falconia has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-abis/+/37148?usp=email )
Change subject: rtp2trau_hr16: fix UFE bit setting
......................................................................
rtp2trau_hr16: fix UFE bit setting
Per TS 48.061 section 5.1.4.1.1, UFE=1 means UL was good and UFE=0
means UL was bad. In the absence of logic that reports the actual
state of UL, we need to tell the BTS that UL was good (like we do
for FR & EFR) - hence set UFE=1.
Change-Id: Ibeb8db332f2e20806bebb077844a509064b2d89d
---
M src/trau/trau_rtp_conv.c
1 file changed, 15 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/libosmo-abis refs/changes/48/37148/1
diff --git a/src/trau/trau_rtp_conv.c b/src/trau/trau_rtp_conv.c
index 5c87c46..c70736d 100644
--- a/src/trau/trau_rtp_conv.c
+++ b/src/trau/trau_rtp_conv.c
@@ -407,7 +407,7 @@
tf->c_bits[15] = 0; /* C16: SP */
tf->c_bits[16] = 0; /* C17: DTXd shall not be applied */
} else {
- tf->c_bits[11] = 0; /* C12: UFE */
+ tf->c_bits[11] = 1; /* C12: UFE */
tf->c_bits[12] = 1; /* C13: spare */
tf->c_bits[13] = 1; /* C14: spare */
tf->c_bits[14] = 1; /* C15: spare */
--
To view, visit https://gerrit.osmocom.org/c/libosmo-abis/+/37148?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: libosmo-abis
Gerrit-Branch: master
Gerrit-Change-Id: Ibeb8db332f2e20806bebb077844a509064b2d89d
Gerrit-Change-Number: 37148
Gerrit-PatchSet: 1
Gerrit-Owner: falconia <falcon(a)freecalypso.org>
Gerrit-MessageType: newchange
neels has submitted this change. ( https://gerrit.osmocom.org/c/osmo-hnbgw/+/36894?usp=email )
Change subject: hnb_persistent: introduce disconnected timeout
......................................................................
hnb_persistent: introduce disconnected timeout
Add timer hnbgw X35: Clean up all hNodeB persistent state after this
time of the hNodeB being disconnected. Set to zero to never clear hNodeB
persistent state. (default is 60*60*24*27 = a week).
The idea is to bound memory usage at sites where hNodeB do not stay on
one fixed cell id, but use a different cell id after each Iuh
reconnection.
Related: SYS#6773
Related: osmo-ttcn3-hacks Ibec009203d38f65714561b7c28edbdbd8b34e704
Change-Id: Ic819d7cbc03fb39e98c204b70d016c5170dc6307
---
M include/osmocom/hnbgw/hnbgw.h
M src/osmo-hnbgw/hnbgw.c
M src/osmo-hnbgw/tdefs.c
3 files changed, 58 insertions(+), 0 deletions(-)
Approvals:
Jenkins Builder: Verified
laforge: Looks good to me, approved
osmith: Looks good to me, but someone else must approve
diff --git a/include/osmocom/hnbgw/hnbgw.h b/include/osmocom/hnbgw/hnbgw.h
index c28f8bc..36358b1 100644
--- a/include/osmocom/hnbgw/hnbgw.h
+++ b/include/osmocom/hnbgw/hnbgw.h
@@ -412,6 +412,8 @@
struct nft_kpi_val v;
} dl;
} nft_kpi;
+
+ struct osmo_timer_list disconnected_timeout;
};
struct ue_context {
diff --git a/src/osmo-hnbgw/hnbgw.c b/src/osmo-hnbgw/hnbgw.c
index 20d6aa6..6f74d04 100644
--- a/src/osmo-hnbgw/hnbgw.c
+++ b/src/osmo-hnbgw/hnbgw.c
@@ -44,6 +44,7 @@
#include <osmocom/hnbgw/hnbgw_cn.h>
#include <osmocom/hnbgw/context_map.h>
#include <osmocom/hnbgw/mgw_fsm.h>
+#include <osmocom/hnbgw/tdefs.h>
struct hnbgw *g_hnbgw = NULL;
@@ -560,6 +561,24 @@
.item_desc = hnb_stat_desc,
};
+static void hnb_persistent_disconnected_timeout_cb(void *data)
+{
+ hnb_persistent_free(data);
+}
+
+static void hnb_persistent_disconnected_timeout_schedule(struct hnb_persistent *hnbp)
+{
+ unsigned long period_s = osmo_tdef_get(hnbgw_T_defs, -35, OSMO_TDEF_S, 60*60*24*7);
+ if (period_s < 1) {
+ LOG_HNBP(hnbp, LOGL_INFO,
+ "timer X35 is zero, not setting a disconnected timeout for this hnb-persistent instance.\n");
+ return;
+ }
+ /* It is fine if the timer is already active, osmo_timer_del() is done implicitly by the osmo_timer API. */
+ osmo_timer_setup(&hnbp->disconnected_timeout, hnb_persistent_disconnected_timeout_cb, hnbp);
+ osmo_timer_schedule(&hnbp->disconnected_timeout, period_s, 0);
+}
+
struct hnb_persistent *hnb_persistent_alloc(const struct umts_cell_id *id)
{
struct hnb_persistent *hnbp = talloc_zero(g_hnbgw, struct hnb_persistent);
@@ -583,6 +602,11 @@
if (g_hnbgw->nft_kpi.active)
nft_kpi_hnb_persistent_add(hnbp);
+ /* Normally the disconnected timer runs only when the hNodeB is not currently connected on Iuh. This here is paranoia:
+ * In case we have to HNBAP HNB Register Reject, the disconnected timer should be active on this unused hnbp.
+ * On success, hnb_persistent_registered() will stop the disconnected timer directly after this. */
+ hnb_persistent_disconnected_timeout_schedule(hnbp);
+
return hnbp;
out_free_ctrs:
@@ -645,6 +669,9 @@
return;
}
+ /* The hNodeB is now connected, i.e. not disconnected. */
+ osmo_timer_del(&hnbp->disconnected_timeout);
+
/* start counting traffic */
if (g_hnbgw->nft_kpi.active)
hnb_persistent_update_remote_addr(hnbp);
@@ -664,11 +691,15 @@
/* stop counting traffic */
nft_kpi_hnb_stop(hnbp);
+
+ /* The hNodeB is now disconnected. Clear out hnb_persistent when the disconnected timeout has passed. */
+ hnb_persistent_disconnected_timeout_schedule(hnbp);
}
void hnb_persistent_free(struct hnb_persistent *hnbp)
{
/* FIXME: check if in use? */
+ osmo_timer_del(&hnbp->disconnected_timeout);
nft_kpi_hnb_stop(hnbp);
nft_kpi_hnb_persistent_remove(hnbp);
osmo_stat_item_group_free(hnbp->statg);
diff --git a/src/osmo-hnbgw/tdefs.c b/src/osmo-hnbgw/tdefs.c
index cfcd4c2..5092922 100644
--- a/src/osmo-hnbgw/tdefs.c
+++ b/src/osmo-hnbgw/tdefs.c
@@ -36,6 +36,12 @@
{.T = 4, .default_val = 5, .desc = "Timeout to receive RANAP RESET ACKNOWLEDGE from an MSC/SGSN" },
{.T = -31, .default_val = 15, .desc = "Timeout for establishing and releasing context maps (RUA <-> SCCP)" },
{.T = -34, .default_val = 1000, .unit = OSMO_TDEF_MS, .desc = "Period to query network traffic stats from netfilter" },
+ {
+ .T = -35,
+ .default_val = 60*60*24*7,
+ .desc = "Clean up all hNodeB persistent state after this time of the hNodeB being disconnected."
+ " Set to zero to never clear hNodeB persistent state. (default is 60*60*24*27 = a week)",
+ },
{.T = -1002, .default_val = 10, .desc = "Timeout for the HNB to respond to PS RAB Assignment Request" },
{ }
};
--
To view, visit https://gerrit.osmocom.org/c/osmo-hnbgw/+/36894?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-hnbgw
Gerrit-Branch: master
Gerrit-Change-Id: Ic819d7cbc03fb39e98c204b70d016c5170dc6307
Gerrit-Change-Number: 36894
Gerrit-PatchSet: 3
Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de>
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
Gerrit-MessageType: merged
neels has posted comments on this change. ( https://gerrit.osmocom.org/c/osmo-hnbgw/+/36894?usp=email )
Change subject: hnb_persistent: introduce disconnected timeout
......................................................................
Patch Set 3: -Code-Review
(2 comments)
Patchset:
PS3:
I figured out that segfault, it is unrelated to this patch.
PS3:
> let's delay this a bit until https://osmocom. […]
Done
--
To view, visit https://gerrit.osmocom.org/c/osmo-hnbgw/+/36894?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-hnbgw
Gerrit-Branch: master
Gerrit-Change-Id: Ic819d7cbc03fb39e98c204b70d016c5170dc6307
Gerrit-Change-Number: 36894
Gerrit-PatchSet: 3
Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de>
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
Gerrit-Comment-Date: Mon, 10 Jun 2024 01:15:50 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
Comment-In-Reply-To: neels <nhofmeyr(a)sysmocom.de>
Gerrit-MessageType: comment
neels has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-hnbgw/+/37147?usp=email )
Change subject: prevent use-after-free after FSM instance termination
......................................................................
prevent use-after-free after FSM instance termination
- Set osmo_fsm_set_dealloc_ctx(OTC_SELECT) in osmo-hnbgw's main().
- Only dispatch RANAP when FSM instances aren't terminated.
This way we possibly pre-empt use-after-free crashes for deallocating
FSM "nests" for obscure corner cases.
Use-after-free is a general problem for FSM design. For this, we created
osmo_fsm_set_dealloc_ctx(): When an FSM is terminated, move it to a
separate talloc context, instead of being deallocated.
An actual use-after-free was observed as described in OS#6484, but that
needs a separate, orthogonal fix:
When the Iuh link is lost while the CN link is waiting for SCCP CC or
CREF -- the better solution is described in OS#6085: don't wait for CC
at all, just dispatch DISCONN to SCCP-SCOC.
So even though the code where a crash was observed will be removed, this
patch is a general safeguard against corner case crashes, improving
general stability.
Related: OS#6484
Change-Id: Ib41e1a996aaa03221e73643636140947ac8f99e2
---
M src/osmo-hnbgw/context_map_rua.c
M src/osmo-hnbgw/context_map_sccp.c
M src/osmo-hnbgw/osmo_hnbgw_main.c
3 files changed, 42 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-hnbgw refs/changes/47/37147/1
diff --git a/src/osmo-hnbgw/context_map_rua.c b/src/osmo-hnbgw/context_map_rua.c
index 3c6ea1e..7286906 100644
--- a/src/osmo-hnbgw/context_map_rua.c
+++ b/src/osmo-hnbgw/context_map_rua.c
@@ -158,6 +158,11 @@
static int handle_rx_rua(struct osmo_fsm_inst *fi, struct msgb *ranap_msg)
{
struct hnbgw_context_map *map = fi->priv;
+
+ /* If the FSM instance has already terminated, don't dispatch anything. */
+ if (fi->proc.terminating)
+ return 0;
+
if (!msg_has_l2_data(ranap_msg))
return 0;
diff --git a/src/osmo-hnbgw/context_map_sccp.c b/src/osmo-hnbgw/context_map_sccp.c
index 10ddaf2..511577c 100644
--- a/src/osmo-hnbgw/context_map_sccp.c
+++ b/src/osmo-hnbgw/context_map_sccp.c
@@ -198,6 +198,10 @@
struct hnbgw_context_map *map = fi->priv;
int rc;
+ /* If the FSM instance has already terminated, don't dispatch anything. */
+ if (fi->proc.terminating)
+ return 0;
+
/* When there was no message received along with the received event, then there is nothing to forward to RUA. */
if (!msg_has_l2_data(ranap_msg))
return 0;
diff --git a/src/osmo-hnbgw/osmo_hnbgw_main.c b/src/osmo-hnbgw/osmo_hnbgw_main.c
index 2f71251..3e715b0 100644
--- a/src/osmo-hnbgw/osmo_hnbgw_main.c
+++ b/src/osmo-hnbgw/osmo_hnbgw_main.c
@@ -360,6 +360,8 @@
signal(SIGUSR2, &signal_handler);
osmo_init_ignore_signals();
+ osmo_fsm_set_dealloc_ctx(OTC_SELECT);
+
while (1) {
rc = osmo_select_main_ctx(0);
if (rc < 0)
--
To view, visit https://gerrit.osmocom.org/c/osmo-hnbgw/+/37147?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-hnbgw
Gerrit-Branch: master
Gerrit-Change-Id: Ib41e1a996aaa03221e73643636140947ac8f99e2
Gerrit-Change-Number: 37147
Gerrit-PatchSet: 1
Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de>
Gerrit-MessageType: newchange