Attention is currently required from: laforge, pespin.
Hello Jenkins Builder, laforge,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/osmo-hnbgw/+/39119?usp=email
to look at the new patch set (#2).
The following approvals got outdated and were removed:
Code-Review+1 by laforge
Change subject: map_sccp: Fix crash during ev MAP_SCCP_EV_RAN_DISC in st MAP_SCCP_ST_WAIT_CC
......................................................................
map_sccp: Fix crash during ev MAP_SCCP_EV_RAN_DISC in st MAP_SCCP_ST_WAIT_CC
Recent commit changed event MAP_SCCP_EV_RAN_DISC to have a bool
parameter instead of a msgb pointer, however only code in state
MAP_SCCP_ST_CONNECTED was updated to account for the change; other
states were left checking the data ptr as if it was a msgb and crashed
while accessing mem address 0x1 (bool true) in msg_has_l2_data().
Fixes: 79589556244bf9cea6e8de8793a611f16e9052cd
Related: SYS#7208
Change-Id: If53dbd6b5a8abffcf94e6d666209954f17e9f9d7
---
M src/osmo-hnbgw/context_map_sccp.c
1 file changed, 29 insertions(+), 7 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-hnbgw refs/changes/19/39119/2
--
To view, visit https://gerrit.osmocom.org/c/osmo-hnbgw/+/39119?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: osmo-hnbgw
Gerrit-Branch: master
Gerrit-Change-Id: If53dbd6b5a8abffcf94e6d666209954f17e9f9d7
Gerrit-Change-Number: 39119
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Attention: laforge <laforge(a)osmocom.org>
Gerrit-Attention: pespin <pespin(a)sysmocom.de>
Attention is currently required from: pespin.
laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-hnbgw/+/39119?usp=email )
Change subject: map_sccp: Fix crash during ev MAP_SCCP_EV_RAN_DISC in st MAP_SCCP_ST_WAIT_CC
......................................................................
Patch Set 1: Code-Review+1
--
To view, visit https://gerrit.osmocom.org/c/osmo-hnbgw/+/39119?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-hnbgw
Gerrit-Branch: master
Gerrit-Change-Id: If53dbd6b5a8abffcf94e6d666209954f17e9f9d7
Gerrit-Change-Number: 39119
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Attention: pespin <pespin(a)sysmocom.de>
Gerrit-Comment-Date: Wed, 11 Dec 2024 12:06:41 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-hnbgw/+/39119?usp=email )
Change subject: map_sccp: Fix crash during ev MAP_SCCP_EV_RAN_DISC in st MAP_SCCP_ST_WAIT_CC
......................................................................
map_sccp: Fix crash during ev MAP_SCCP_EV_RAN_DISC in st MAP_SCCP_ST_WAIT_CC
Recent commit changed event MAP_SCCP_EV_RAN_DISC to have a bool
parameter instead of a msgb pointer, however only code in state
MAP_SCCP_ST_CONNECTED was updated to account for the change; other
states were left checking the data ptr as if it was a msgb and crashed
while accessing mem address 0x1 (bool true) in msg_has_l2_data().
Fixes: 79589556244bf9cea6e8de8793a611f16e9052cd
Change-Id: If53dbd6b5a8abffcf94e6d666209954f17e9f9d7
---
M src/osmo-hnbgw/context_map_sccp.c
1 file changed, 29 insertions(+), 7 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-hnbgw refs/changes/19/39119/1
diff --git a/src/osmo-hnbgw/context_map_sccp.c b/src/osmo-hnbgw/context_map_sccp.c
index b39768d..c933e8d 100644
--- a/src/osmo-hnbgw/context_map_sccp.c
+++ b/src/osmo-hnbgw/context_map_sccp.c
@@ -265,11 +265,12 @@
static void map_sccp_init_action(struct osmo_fsm_inst *fi, uint32_t event, void *data)
{
struct hnbgw_context_map *map = fi->priv;
- struct msgb *ranap_msg = data;
+ struct msgb *ranap_msg = NULL;
switch (event) {
case MAP_SCCP_EV_TX_DATA_REQUEST:
+ ranap_msg = data;
/* In the INIT state, the first MAP_SCCP_EV_TX_DATA_REQUEST will be the RANAP message received from the
* RUA Connect message. Send the SCCP CR and transition to WAIT_CC. */
if (tx_sccp_cr(fi, ranap_msg) == 0)
@@ -277,15 +278,22 @@
return;
case MAP_SCCP_EV_RAN_LINK_LOST:
- case MAP_SCCP_EV_RAN_DISC:
case MAP_SCCP_EV_USER_ABORT:
case MAP_SCCP_EV_CN_LINK_LOST:
+ ranap_msg = data;
/* No CR has been sent yet, just go to disconnected state. */
if (msg_has_l2_data(ranap_msg))
LOG_MAP(map, DLSCCP, LOGL_ERROR, "SCCP not connected, cannot dispatch RANAP message\n");
map_sccp_fsm_state_chg(MAP_SCCP_ST_DISCONNECTED);
return;
+ case MAP_SCCP_EV_RAN_DISC:
+ /* bool rua_disconnect_err_condition = !!data; */
+ /* 3GPP TS 25.468 9.1.5: RUA has disconnected.
+ * In this state we didn't send an SCCP CR yet, so nothing to be torn down on CN side. */
+ map_sccp_fsm_state_chg(MAP_SCCP_ST_DISCONNECTED);
+ return;
+
case MAP_SCCP_EV_RX_RELEASED:
/* SCCP RLSD received from CN. This will never happen since we haven't even asked for a connection, but
* for completeness: */
@@ -300,31 +308,41 @@
static void map_sccp_wait_cc_action(struct osmo_fsm_inst *fi, uint32_t event, void *data)
{
struct hnbgw_context_map *map = fi->priv;
- struct msgb *ranap_msg = data;
+ struct msgb *ranap_msg = NULL;
switch (event) {
case MAP_SCCP_EV_RX_CONNECTION_CONFIRM:
+ ranap_msg = data;
map_sccp_fsm_state_chg(MAP_SCCP_ST_CONNECTED);
/* Usually doesn't but if the SCCP CC contained data, forward it to RUA */
handle_rx_sccp(fi, ranap_msg);
return;
case MAP_SCCP_EV_TX_DATA_REQUEST:
+ /* ranap_msg = data; */
LOGPFSML(fi, LOGL_ERROR, "Connection not yet confirmed, cannot forward RANAP to CN\n");
return;
case MAP_SCCP_EV_RAN_LINK_LOST:
- case MAP_SCCP_EV_RAN_DISC:
case MAP_SCCP_EV_USER_ABORT:
case MAP_SCCP_EV_CN_LINK_LOST:
+ ranap_msg = data;
/* RUA connection was terminated. First wait for the CC before releasing the SCCP conn. */
if (msg_has_l2_data(ranap_msg))
LOGPFSML(fi, LOGL_ERROR, "Connection not yet confirmed, cannot forward RANAP to CN\n");
map->please_disconnect = true;
return;
+ case MAP_SCCP_EV_RAN_DISC:
+ /* bool rua_disconnect_err_condition = !!data; */
+ /* 3GPP TS 25.468 9.1.5: RUA has disconnected.
+ * In this state we didn't send an SCCP CR yet, so nothing to be torn down on CN side. */
+ map->please_disconnect = true;
+ return;
+
case MAP_SCCP_EV_RX_RELEASED:
+ ranap_msg = data;
/* SCCP RLSD received from CN. This will never happen since we haven't even received a Connection
* Confirmed, but for completeness: */
handle_rx_sccp(fi, ranap_msg);
@@ -349,7 +367,7 @@
static void map_sccp_connected_action(struct osmo_fsm_inst *fi, uint32_t event, void *data)
{
- struct msgb *ranap_msg;
+ struct msgb *ranap_msg = NULL;
bool rua_disconnect_err_condition;
switch (event) {
@@ -432,11 +450,12 @@
static void map_sccp_wait_rlsd_action(struct osmo_fsm_inst *fi, uint32_t event, void *data)
{
- struct msgb *ranap_msg = data;
+ struct msgb *ranap_msg = NULL;
switch (event) {
case MAP_SCCP_EV_RX_RELEASED:
+ ranap_msg = data;
/* The CN sends the expected SCCP RLSD.
* Usually there is no data, but if there is just forward it.
* Usually RUA is already disconnected, but let the RUA FSM decide about that. */
@@ -445,12 +464,13 @@
return;
case MAP_SCCP_EV_RX_DATA_INDICATION:
+ ranap_msg = data;
/* RUA is probably already disconnected, but let the RUA FSM decide about that. */
handle_rx_sccp(fi, ranap_msg);
return;
case MAP_SCCP_EV_TX_DATA_REQUEST:
- case MAP_SCCP_EV_RAN_DISC:
+ ranap_msg = data;
/* Normally, RUA would already disconnected, but since SCCP is officially still connected, we can still
* forward messages there. Already waiting for CN to send the SCCP RLSD. If there is a message, forward
* it, and just continue to time out on the SCCP RLSD. */
@@ -458,6 +478,7 @@
return;
case MAP_SCCP_EV_RX_CONNECTION_CONFIRM:
+ ranap_msg = data;
/* Already connected. Unusual, but if there is data just forward it. */
LOGPFSML(fi, LOGL_ERROR, "Already connected, but received SCCP CC\n");
handle_rx_sccp(fi, ranap_msg);
@@ -466,6 +487,7 @@
case MAP_SCCP_EV_RAN_LINK_LOST:
case MAP_SCCP_EV_USER_ABORT:
case MAP_SCCP_EV_CN_LINK_LOST:
+ case MAP_SCCP_EV_RAN_DISC:
/* Stop waiting for RLSD, send RLSD now. */
tx_sccp_rlsd(fi);
map_sccp_fsm_state_chg(MAP_SCCP_ST_DISCONNECTED);
--
To view, visit https://gerrit.osmocom.org/c/osmo-hnbgw/+/39119?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: osmo-hnbgw
Gerrit-Branch: master
Gerrit-Change-Id: If53dbd6b5a8abffcf94e6d666209954f17e9f9d7
Gerrit-Change-Number: 39119
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Attention is currently required from: dexter, laforge.
Hello Jenkins Builder, laforge,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/pysim/+/39057?usp=email
to look at the new patch set (#2).
The following approvals got outdated and were removed:
Code-Review+1 by laforge, Verified+1 by Jenkins Builder
Change subject: ara_m fix export of AID-REF-DO (empty)
......................................................................
ara_m fix export of AID-REF-DO (empty)
GPD_SPE_013 Table 6-3 defines two types of AID-REF-DO objects (both
are fully independed TLV IEs with the same name). The version with
tag '4F' identifies an SE application. It may contain an AID prefix
or even be of length 0 in case the rule should apply to all SE
applications. Then there is the version with tag 'C0', which must
always have length 0 and serves a flag to apply the rule to the
implicitly selected SE application. Technically both are completely
different things, so we must also treat them separately in the
pySim-shell code.
Related: OS#6681
Change-Id: I771d5e860b12215280e3d0a8c314ce843fe0d6a2
---
M pySim/ara_m.py
M tests/pySim-shell_test/ara_m/adf_ara-m.cfg.ok
M tests/pySim-shell_test/ara_m/adf_ara-m.script.ok
M tests/pySim-shell_test/ara_m/test.script
4 files changed, 16 insertions(+), 10 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/57/39057/2
--
To view, visit https://gerrit.osmocom.org/c/pysim/+/39057?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: pysim
Gerrit-Branch: master
Gerrit-Change-Id: I771d5e860b12215280e3d0a8c314ce843fe0d6a2
Gerrit-Change-Number: 39057
Gerrit-PatchSet: 2
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Attention: laforge <laforge(a)osmocom.org>
Gerrit-Attention: dexter <pmaier(a)sysmocom.de>
dexter has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38964?usp=email )
Change subject: PCUIF: fix usage of bts number in PCUIF_TXT_IND
......................................................................
PCUIF: fix usage of bts number in PCUIF_TXT_IND
When we receive the PCU_VERSION using tr_PCUIF_TXT_IND we must ignore the
included BTS number because the PCU_VERSION is not addressed to a specific
BTS. When we send a PCU_VERSION using ts_PCUIF_TXT_IND, we should always
use the bts number 0 to be consistent (the BSC/BTS will ignore this number
anyway).
Let's fix the usage of tr_PCUIF_TXT_IND and put comments, to make clear why
the above applies.
Change-Id: I93de261fc77806b2f817e0d30cb1b0d377ed0dbb
related: OS#6507
---
M bts/BTS_Tests.ttcn
M bts/BTS_Tests_OML.ttcn
M pcu/PCUIF_Components.ttcn
M pcu/PCU_Tests_NS.ttcn
4 files changed, 10 insertions(+), 4 deletions(-)
Approvals:
laforge: Looks good to me, approved
pespin: Looks good to me, but someone else must approve
Jenkins Builder: Verified
diff --git a/bts/BTS_Tests.ttcn b/bts/BTS_Tests.ttcn
index 1ba8d53..8c05bb3 100644
--- a/bts/BTS_Tests.ttcn
+++ b/bts/BTS_Tests.ttcn
@@ -5446,6 +5446,8 @@
f_init();
map(self:PCU, system:PCU);
f_init_pcu(PCU, testcasename(), g_pcu_conn_id, g_pcu_last_info);
+ /* For TXT indications of type PCU_VERSION, the receiving process is expected to ignore the BTS number (0) we
+ * use when sending the PCU_VERSION. */
PCU.send(t_SD_PCUIF(g_pcu_conn_id, ts_PCUIF_TXT_IND(0, PCU_VERSION, testcasename())));
}
diff --git a/bts/BTS_Tests_OML.ttcn b/bts/BTS_Tests_OML.ttcn
index 980643a..e1b75e6 100644
--- a/bts/BTS_Tests_OML.ttcn
+++ b/bts/BTS_Tests_OML.ttcn
@@ -150,6 +150,8 @@
Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, "Timeout waiting for PCU INFO_IND");
}
}
+ /* For TXT indications of type PCU_VERSION, the receiving process is expected to ignore the BTS number (0) we
+ * use when sending the PCU_VERSION. */
pt.send(t_SD_PCUIF(pcu_conn_id, ts_PCUIF_TXT_IND(0, PCU_VERSION, testcasename())));
}
diff --git a/pcu/PCUIF_Components.ttcn b/pcu/PCUIF_Components.ttcn
index 6e956ba..75e7a35 100644
--- a/pcu/PCUIF_Components.ttcn
+++ b/pcu/PCUIF_Components.ttcn
@@ -503,8 +503,9 @@
PCUIF.receive(tr_RAW_PCU_EV(PCU_EV_CONNECT));
alt {
- /* Wait for TXT.ind (PCU_VERSION) and respond with INFO.ind (SI13) */
- [] PCUIF.receive(tr_PCUIF_TXT_IND(bts_nr, PCU_VERSION, ?)) -> value pcu_msg {
+ /* Wait for TXT.ind (PCU_VERSION) and respond with INFO.ind (SI13). We may ignore the bts_nr field because for
+ * TXT indications of type PCU_VERSION this field has no meaning. */
+ [] PCUIF.receive(tr_PCUIF_TXT_IND(?, PCU_VERSION, ?)) -> value pcu_msg {
log("Rx TXT.ind from the PCU, version is ", pcu_msg.u.txt_ind.text);
/* Send System Information 13 to the PCU */
diff --git a/pcu/PCU_Tests_NS.ttcn b/pcu/PCU_Tests_NS.ttcn
index eea8d3f..7155d58 100644
--- a/pcu/PCU_Tests_NS.ttcn
+++ b/pcu/PCU_Tests_NS.ttcn
@@ -55,8 +55,9 @@
g_pcu_conn_id := f_pcuif_listen(PCU, mp_pcu_sock_path);
PCU.receive(UD_connected:?);
- /* Wait for PCU_VERSION and return INFO_IND */
- PCU.receive(t_SD_PCUIF(g_pcu_conn_id, tr_PCUIF_TXT_IND(0, PCU_VERSION, ?)));
+ /* Wait for PCU_VERSION and return INFO_IND. We may ignore the bts_nr field because for TXT indications of type
+ * PCU_VERSION this field has no meaning. */
+ PCU.receive(t_SD_PCUIF(g_pcu_conn_id, tr_PCUIF_TXT_IND(?, PCU_VERSION, ?)));
/* FIXME: make sure to use parameters from mp_gb_cfg.bvc[0].cell_id in the PCU INFO IND */
var template PCUIF_Message info_ind_msg := ts_PCUIF_INFO_IND(0, info_ind);
PCU.send(t_SD_PCUIF(g_pcu_conn_id, info_ind_msg));
--
To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38964?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: osmo-ttcn3-hacks
Gerrit-Branch: master
Gerrit-Change-Id: I93de261fc77806b2f817e0d30cb1b0d377ed0dbb
Gerrit-Change-Number: 38964
Gerrit-PatchSet: 3
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
dexter has abandoned this change. ( https://gerrit.osmocom.org/c/pysim/+/39056?usp=email )
Change subject: ara_m: put hex string values in quotes
......................................................................
Abandoned
We think its better to keep consistency with the other commands.
--
To view, visit https://gerrit.osmocom.org/c/pysim/+/39056?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: abandon
Gerrit-Project: pysim
Gerrit-Branch: master
Gerrit-Change-Id: Ia365e83638ff4f1b1a02e1671852cf2006f80c7f
Gerrit-Change-Number: 39056
Gerrit-PatchSet: 1
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-CC: laforge <laforge(a)osmocom.org>