fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-bsc/+/42593?usp=email )

Change subject: handover_fsm: fix send_handover_performed() using wrong lchan ......................................................................

handover_fsm: fix send_handover_performed() using wrong lchan

send_handover_performed() is called from handover_end() before gscon_change_primary_lchan() updates conn->lchan to the new lchan. As a result, the Cell Identifier, Chosen Channel, Chosen Encryption Algorithm, and Speech Version/Codec IEs were all populated from the source (old) lchan rather than the target (new) lchan.

As per 3GPP TS 48.008 §3.2.1.25, HANDOVER PERFORMED must report the target cell and channel. For intra-BSC handover to a different BTS this caused the MSC to receive the wrong Cell Identifier.

Fix by initialising lchan from ho->new_lchan instead of conn->lchan, and deriving the BTS via lchan->ts->trx->bts.

Change-Id: I4111351dc38fc2dbe844c2bd07b3ecfaaadd864e Related: osmo-ttcn3-hacks.git I82aadcc3a80c183cb93522b829071294b156a218 Found-By: Claude Sonnet 4.6 --- M src/osmo-bsc/handover_fsm.c 1 file changed, 3 insertions(+), 3 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/93/42593/1

diff --git a/src/osmo-bsc/handover_fsm.c b/src/osmo-bsc/handover_fsm.c index 24766a5..cddb138 100644 --- a/src/osmo-bsc/handover_fsm.c +++ b/src/osmo-bsc/handover_fsm.c @@ -897,8 +897,8 @@

static void send_handover_performed(struct gsm_subscriber_connection *conn) { - struct gsm_lchan *lchan = conn->lchan; struct handover *ho = &conn->ho; + struct gsm_lchan *lchan = ho->new_lchan; struct osmo_cell_global_id *cell; struct gsm0808_handover_performed ho_perf_params = {}; struct msgb *msg; @@ -909,7 +909,7 @@ ho_perf_params.cause = GSM0808_CAUSE_HANDOVER_SUCCESSFUL;

/* Cell Identifier 3.2.2.17 */ - cell = cgi_for_msc(conn->sccp.msc, conn_get_bts(conn)); + cell = cgi_for_msc(conn->sccp.msc, lchan->ts->trx->bts); if (!cell) { LOG_HO(conn, LOGL_ERROR, "Failed to generate Cell Identifier IE, can't send HANDOVER PERFORMED!\n"); return; @@ -941,7 +941,7 @@ if (gscon_is_aoip(conn)) { /* Extrapolate speech codec from speech mode */ gsm0808_speech_codec_from_chan_type(&sc, ho_perf_params.speech_version_chosen); - sc.cfg = conn->lchan->current_ch_mode_rate.s15_s0; + sc.cfg = lchan->current_ch_mode_rate.s15_s0; memcpy(&ho_perf_params.speech_codec_chosen, &sc, sizeof(sc)); ho_perf_params.speech_codec_chosen_present = true; }