- OpenBSC - lists.osmocom.org

Re: OsmoBTS -> libosmogsm code migration
by Vadim Yanitskiy 14 Oct '16

14 Oct '16

Hi Max, > Unfortunately I could not find any tests for the code in > question so the only way to test it is by: I uploaded tests recently. You can find them here: https://gerrit.osmocom.org/#/c/933/4/tests/coding/coding_test.c > I think the puncturing code should be part of the library (otherwise > every user will have to reimplement the same thing again and again). I am agree with you. We recently discussed this question with Tom Tsou. He said, that there was some performance related reasons to perform puncturing inside both gsm0503_pdtch_encode() / gsm0503_pdtch_decode(). With best regards, Vadim Yanitskiy.

3 6

move to gerrit
by Neels Hofmeyr 14 Oct '16

14 Oct '16

Hi all, opinions please: I would move patch submission for the following osmocom repositories to gerrit: osmo-gsm-manuals asn1c libasn1c osmo-python-tests osmo-trx (TT already agreed) Let me know if any other come to mind. Possibly *all* projects seen at git.osmocom.org? Thanks, ~Neels -- - Neels Hofmeyr <nhofmeyr(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschäftsführer / Managing Directors: Harald Welte

5 6

Re: New Defects reported by Coverity Scan for Osmocom
by Neels Hofmeyr 14 Oct '16

14 Oct '16

On Thu, Oct 13, 2016 at 09:32:21AM -0700, scan-admin(a)coverity.com wrote: > > Hi, > > Please find the latest report on new defect(s) introduced to Osmocom found with Coverity Scan. > > 4 new defect(s) introduced to Osmocom found with Coverity Scan. > 2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. > > New defect(s) Reported-by: Coverity Scan > Showing 4 of 4 defect(s) > > > ** CID 150135: Null pointer dereferences (REVERSE_INULL) > /source-Osmocom/openggsn/ggsn/ggsn.c: 142 in delete_context() > > > ________________________________________________________________________________________________________ > *** CID 150135: Null pointer dereferences (REVERSE_INULL) > /source-Osmocom/openggsn/ggsn/ggsn.c: 142 in delete_context() > 136 int delete_context(struct pdp_t *pdp) > 137 { > 138 DEBUGP(DGGSN, "Deleting PDP context\n"); > 139 struct ippoolm_t *member = pdp->peer; > 140 char v[NAMESIZE]; > 141 snprintf(v, sizeof(v), "%" PRIu64 ",%s", pdp->imsi, inet_ntoa(member->addr)); > >>> CID 150135: Null pointer dereferences (REVERSE_INULL) > >>> Null-checking "pdp->peer" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. > 142 if (pdp->peer) > 143 ippool_freeip(ippool, (struct ippoolm_t *)pdp->peer); > 144 else > 145 SYS_ERR(DGGSN, LOGL_ERROR, 0, "Peer not defined!"); > 146 > 147 if (gtp_kernel_tunnel_del(pdp)) { This one's for you, Max. (openggsn commit 727417dd28813c697b4820aef9f54f249e30c4b8) > ** CID 150134: Null pointer dereferences (REVERSE_INULL) > /source-Osmocom/openbsc/openbsc/src/gprs/gprs_sgsn.c: 257 in sgsn_mm_ctx_alloc_iu() > > > ________________________________________________________________________________________________________ > *** CID 150134: Null pointer dereferences (REVERSE_INULL) > /source-Osmocom/openbsc/openbsc/src/gprs/gprs_sgsn.c: 257 in sgsn_mm_ctx_alloc_iu() > 251 ctx->auth_triplet.key_seq = GSM_KEY_SEQ_INVAL; > 252 ctx->ctrg = rate_ctr_group_alloc(ctx, &mmctx_ctrg_desc, 0); > 253 > 254 /* Need to get RAID from IU conn */ > 255 ctx->ra = ctx->iu.ue_ctx->ra_id; > 256 fixed (sysmocom/iu branch). > >>> CID 150134: Null pointer dereferences (REVERSE_INULL) > >>> Null-checking "ctx->iu.ue_ctx" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. > 257 if (ctx->iu.ue_ctx) > 258 ctx->iu.ue_ctx->rab_assign_addr_enc = > 259 sgsn->cfg.iu.rab_assign_addr_enc; > 260 > 261 INIT_LLIST_HEAD(&ctx->pdp_list); > 262 > > ** CID 150133: Memory - corruptions (OVERRUN) > /source-Osmocom/osmo-bts/src/common/msg_utils.c: 121 in dtx_cache_payload() > > > ________________________________________________________________________________________________________ > *** CID 150133: Memory - corruptions (OVERRUN) > /source-Osmocom/osmo-bts/src/common/msg_utils.c: 121 in dtx_cache_payload() > 115 copy_len = OSMO_MIN(length + 1, ARRAY_SIZE(lchan->tch.dtx.cache)); > 116 > 117 lchan->tch.dtx.len = copy_len + amr; > 118 lchan->tch.dtx.fn = fn; > 119 lchan->tch.dtx.is_update = update; > 120 > >>> CID 150133: Memory - corruptions (OVERRUN) > >>> Overrunning buffer pointed to by "&lchan->tch.dtx.cache[amr]" of 20 bytes by passing it to a function which accesses it at byte offset 21 using argument "copy_len" (which evaluates to 20). > 121 memcpy(lchan->tch.dtx.cache + amr, l1_payload, copy_len); @Max, maybe 'copy_len - amr'? In any case there's potentially 'amr' too many bytes. > 122 } > 123 > 124 /*! \brief Check current state of DTX DL AMR FSM and dispatch necessary events > 125 * \param[in] lchan Logical channel on which we check scheduling > 126 * \param[in] rtp_pl buffer with RTP data > > ** CID 150132: Incorrect expression (BAD_SIZEOF) > /source-Osmocom/osmo-bts/src/common/msg_utils.c: 262 in dtx_sched_optional() > > > ________________________________________________________________________________________________________ > *** CID 150132: Incorrect expression (BAD_SIZEOF) > /source-Osmocom/osmo-bts/src/common/msg_utils.c: 262 in dtx_sched_optional() > 256 h1[] = { 14, 16, 18, 20, 66, 68, 70, 72 }; > 257 if (lchan->tch_mode == GSM48_CMODE_SPEECH_V1) { > 258 if (lchan->type == GSM_LCHAN_TCH_F) > 259 return fn_chk(f, fn, ARRAY_SIZE(f)); > 260 else > 261 return fn_chk(lchan->nr ? h1 : h0, fn, > >>> CID 150132: Incorrect expression (BAD_SIZEOF) > >>> The expression "sizeof (lchan->nr ? h1 : h0) / sizeof (lchan->nr ? h1 : h0[0])" is suspicious. Note that "lchan->nr ? h1 : h0" is a pointer and therefore the division will not return the number of array elements which may have been the intent. > 262 ARRAY_SIZE(lchan->nr ? h1 : h0)); @Max, has to be lchan-nr? ARRAY_SIZE(h1) : ARRAY_SIZE(h0) so ARRAY_SIZE can be resolved at compile time. > 263 } > 264 return false; > 265 } > 266 > 267 /* repeat last SID if possible, returns SID length + 1 or 0 */ > > > ________________________________________________________________________________________________________ > -- - Neels Hofmeyr <nhofmeyr(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschäftsführer / Managing Directors: Harald Welte

1 0

multiple phy with osmo-trx
by Max 13 Oct '16

13 Oct '16

Hi! I've asked about it before but this seems to have been lost in communication. The question is basically how to enable multi-TRX support for osmo-bts-trx using phy/instance infrastructure similar to other bts? What I've tried so far is documented in http://projects.osmocom.org/issues/1648 but it did not result in working setup yet. In short, I'd like to configure OpenBSC with 1 BTS with 2 TRX, each with its own arfcn and set of channels. I'm running "osmo-bts-trx -t 2" and correspondingly "osmo-trx -c 2" on usrp b210. Any ideas on what's missing to make this actually work are greatly appreciated. -- Max Suraev <msuraev(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschaeftsfuehrer / Managing Director: Harald Welte

4 15

[PATCH] mobile/vty_interface.c: Fix typo
by Martin Hauke 13 Oct '16

13 Oct '16

--- src/host/layer23/src/mobile/vty_interface.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/host/layer23/src/mobile/vty_interface.c b/src/host/layer23/src/mobile/vty_interface.c index 9a86880..f4d7df1 100644 --- a/src/host/layer23/src/mobile/vty_interface.c +++ b/src/host/layer23/src/mobile/vty_interface.c @@ -528,7 +528,7 @@ static int _sim_test_cmd(struct vty *vty, int argc, const char *argv[], DEFUN(sim_test, sim_test_cmd, "sim testcard MS_NAME [MCC] [MNC] [LAC] [TMSI]", - "SIM actions\nAttach bulit in test SIM\nName of MS (see \"show ms\")\n" + "SIM actions\nAttach built-in test SIM\nName of MS (see \"show ms\")\n" "Optionally set mobile Country Code of RPLMN\n" "Optionally set mobile Network Code of RPLMN\n" "Optionally set location area code of RPLMN\n" @@ -539,7 +539,7 @@ DEFUN(sim_test, sim_test_cmd, DEFUN(sim_test_att, sim_test_att_cmd, "sim testcard MS_NAME MCC MNC LAC TMSI attached", - "SIM actions\nAttach bulit in test SIM\nName of MS (see \"show ms\")\n" + "SIM actions\nAttach built-in test SIM\nName of MS (see \"show ms\")\n" "Set mobile Country Code of RPLMN\nSet mobile Network Code of RPLMN\n" "Set location area code\nSet current assigned TMSI\n" "Indicate to MM that card is already attached") @@ -1758,7 +1758,7 @@ DEFUN(cfg_ms_sap, cfg_ms_sap_cmd, "sap-socket PATH", DEFUN(cfg_ms_sim, cfg_ms_sim_cmd, "sim (none|reader|test|sap)", "Set SIM card to attach when powering on\nAttach no SIM\n" - "Attach SIM from reader\nAttach bulit in test SIM\n" + "Attach SIM from reader\nAttach built-in test SIM\n" "Attach SIM over SAP interface") { struct osmocom_ms *ms = vty->index; -- 2.6.6

1 0

[PATCH] Typo in Chapter 14.2
by Ivaylo Kostov 13 Oct '16

13 Oct '16

--- OsmoNITB/chapters/smpp.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/OsmoNITB/chapters/smpp.adoc b/OsmoNITB/chapters/smpp.adoc index 2557580..91f8c07 100644 --- a/OsmoNITB/chapters/smpp.adoc +++ b/OsmoNITB/chapters/smpp.adoc @@ -44,7 +44,7 @@ SMPP (`no smpp-first`). === ESME configuration -nder the `smpp` vty node, you can add any number of `esme` nodes, one +Under the `smpp` vty node, you can add any number of `esme` nodes, one for each ESME that you wish to configure. Use the `esme NAME` command (where NAME corresponds to the system-id of -- 2.7.4

2 1

Re: [MERGED] libosmo-abis[master]: Resync RTP session in case of timestamp jump
by Neels Hofmeyr 13 Oct '16

13 Oct '16

In below patch (already merged) there's apparently only a LOGP tweak. Looks like something is missing there and Harald didn't spot it? It can't possibly fix OS#1803, can it? ~Neels On Wed, Oct 12, 2016 at 09:26:01AM +0000, Harald Welte wrote: > Harald Welte has submitted this change and it was merged. > > Change subject: Resync RTP session in case of timestamp jump > ...................................................................... > > > Resync RTP session in case of timestamp jump > > This will prevent the timestamp jump to occur between each call for DTX > if something goes wrong. It's handy as oRTP does not manage well > timestamp jump if it is not resynced. > > Fixes: OS#1803 > Change-Id: Iae5da832218dbd1ede7a9451102074f2a5eb66df > --- > M src/trau/osmo_ortp.c > 1 file changed, 2 insertions(+), 1 deletion(-) > > Approvals: > Harald Welte: Looks good to me, approved > Jenkins Builder: Verified > > > > diff --git a/src/trau/osmo_ortp.c b/src/trau/osmo_ortp.c > index 6ce70d2..e3c6234 100644 > --- a/src/trau/osmo_ortp.c > +++ b/src/trau/osmo_ortp.c > @@ -139,7 +139,8 @@ > uint32_t ts = rtp_session_get_current_recv_ts(rs); > > LOGP(DLMIB, LOGL_NOTICE, > - "osmo-ortp(%d): timestamp_jump, new TS %d\n", port, ts); > + "osmo-ortp(%d): timestamp_jump, new TS %d, resyncing\n", port, ts); > + rtp_session_resync(rs); > } > > > > -- > To view, visit https://gerrit.osmocom.org/1028 > To unsubscribe, visit https://gerrit.osmocom.org/settings > > Gerrit-MessageType: merged > Gerrit-Change-Id: Iae5da832218dbd1ede7a9451102074f2a5eb66df > Gerrit-PatchSet: 4 > Gerrit-Project: libosmo-abis > Gerrit-Branch: master > Gerrit-Owner: Max <msuraev(a)sysmocom.de> > Gerrit-Reviewer: Harald Welte <laforge(a)gnumonks.org> > Gerrit-Reviewer: Jenkins Builder -- - Neels Hofmeyr <nhofmeyr(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschäftsführer / Managing Directors: Harald Welte

2 2

Re: OsmoBTS -> libosmogsm code migration
by Vadim Yanitskiy 11 Oct '16

11 Oct '16

Hi Max, Thanks for your reply! > I think extending utils/conv_gen.py is the way to go because it will > allow us to have concise description of the convolutional codes in one > place and as close to the description in standards as possible. Ok, I will keep your opinion in my mind. > Could you specify which files exactly are you referring to? Also you can > use 'git blame' to clarify authorship. No problem, they are: - gsm0503_conv.c - gsm0503_interleaving.c - gsm0503_mapping.c - gsm0503_parity.c - gsm0503_tables.c Almost all the gsm0503_*, excluding the 'gsm0503_coding.*'. Thank you for this hint, this command is very usable! :) > I don't think library functions should do any sort of logging by itself > (unless it's a logging functions of course :) > Instead they should return clearly distinguishable values and let caller > do the logging as they see fit. I am agree with you. It's time to use return codes. Have a nice day! With best regards, Vadim Yanitskiy.

6 17

openbsc: rate ctr segfault in master
by Neels Hofmeyr 10 Oct '16

10 Oct '16

Hi lynxis, I have reverted your recent commit 38e9ea3 (see below): it introduces a reproducable segfault in openbsc, because msg->trx is not actually set/used in the openbsc code paths (it seems only osmo-bts uses msg->trx). FYI, struct msgb is used very generically in osmocom, and it's dangerous to assume that any of its members are valid or consistent with other callers, without fully understanding and testing the surrounding code paths. commit 38e9ea3f7f385c6660c5958970af5c71adc1682b Author: Alexander Couzens <lynxis(a)fe80.eu> Date: Tue Aug 23 06:27:19 2016 +0200 bsc: count the usage of codec by setting the lchan active we count the codec when the channel was successful setted up Change-Id: Ifc8a406a11dce16b9e7f3310841e470545550a2c Backtrace: 20161010011516712 DCC <0001> ../../../src/libmsc/transaction.c:71 subscr=0x813b20, net=0x7e0150 20161010011516712 DPAG <0007> ../../../src/libbsc/paging.c:291 Start paging of subscriber 49 on bts 0. 20161010011517034 DRLL <0000> ../../../src/libbsc/abis_rsl.c:1959 (bts=0,trx=0,ts=2,ss=0) SAPI=0 DATA INDICATION 20161010011517034 DRSL <0004> ../../../src/libbsc/abis_rsl.c:2176 (bts=0,trx=0,ts=2,ss=0) IPAC_BIND speech_mode=0x10 RTP_PAYLOAD=3 Program received signal SIGSEGV, Segmentation fault. count_codecs (lchan=0x1, bts=<optimized out>) at ../../../src/libbsc/abis_rsl.c:104 104 rate_ctr_inc(&bts->network->bsc_ctrs->ctr[BSC_CTR_CODEC_V1_FR]); (gdb) bt #0 count_codecs (lchan=0x1, bts=<optimized out>) at ../../../src/libbsc/abis_rsl.c:104 #1 0x0000000000425661 in abis_rsl_rx_dchan (msg=<optimized out>) at ../../../src/libbsc/abis_rsl.c:1516 #2 abis_rsl_rcvmsg (msg=0x8143f0) at ../../../src/libbsc/abis_rsl.c:2611 #3 0x00007ffff71420d0 in handle_ts1_read (bfd=<optimized out>) at ../../src/input/ipaccess.c:271 #4 ipaccess_fd_cb (bfd=0x815af8, what=1) at ../../src/input/ipaccess.c:386 #5 0x00007ffff7779b62 in osmo_fd_disp_fds (_eset=0x7fffffffe590, _wset=0x7fffffffe510, _rset=0x7fffffffe490) at ../../src/select.c:149 #6 osmo_select_main (polling=polling@entry=0) at ../../src/select.c:189 #7 0x0000000000406fac in main (argc=<optimized out>, argv=0x7fffffffe738) at ../../../src/osmo-nitb/bsc_hack.c:385 (gdb) Hope you can find a different way to count codec uses :) ~Neels -- - Neels Hofmeyr <nhofmeyr(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschäftsführer / Managing Directors: Harald Welte

2 1

problems compiling for sysmobts
by Neels Hofmeyr 10 Oct '16

10 Oct '16

Hi all, I'd like to share my odd? interesting? unnerving? experience today. All I wanted to do is quickly check something (gerrit #713) on sysmobts, but I faced a series of problems. First some sysmobts related problems, later two problems entirely unrelated to osmocom... (*) My sysmobts SDK no longer works: libosmo-abis now requires libortp >= 0.22.0, but the SDK I have used so far doesn't have that: poky-eglibc-i686-meta-toolchain-osmo-armv5te-toolchain-osmo-1.5.3-20160323112523.sh (I didn't go through it in this sequence, but tried these things:) a) tried to build a more recent libortp into the installed SDK. It goes fine up to a point. It takes a bit of work to find and fetch all the repositories that are required: git://git.linphone.org/bcunit.git git://git.linphone.org/bctoolbox.git git://git.linphone.org/ortp.git but sadly, bctoolbox wants libpolarssl aka mbedtls git@github.com:ARMmbed/mbedtls.git -- which has no automake/autoconf, only a plain Makefile! It also has cmake and others, but so far I only know how to tell the ./configure script to cross-compile and install into the SDK, so I kind of gave up on figuring out cmake for that, for now. b) just reverted the libortp version bumping commit in libosmo-abis (15d9b7929d449e4138bcb003c614035bceadc3d1) Everything compiles and works out, but alas, I get constant very weird distortion/blip-tones/hickups on the voice channels, a bit of voice still audible but definitely some bad codec problem. A regression? Is it related to libortp? This happens both for a TS config of TCH/H and TCH/F. c) tried fetching a new SDK from 201310-testing/sdk: poky-eglibc-i686-meta-toolchain-osmo-armv5te-toolchain-osmo-1.5.3-20160910200558.sh This has the same problem with too old libortp. Again I revert the libortp version bump from libosmo-abis. Same results as above: badly broken voice. d) tried a new 1.5.4 SDK from 201310-nightly/sdk: poky-eglibc-i686-meta-toolchain-osmo-armv5te-toolchain-osmo-1.5.4-20161004010024.sh Here libosmo-abis is fine with the libortp it finds, so far so good. Sadly, this doesn't even do hickuped voice, only low noise on both ends. So I decided to go back to the SDK that worked for me last time to bisect. I will post another mail in case I found a regression. (*) For half a minute there I wondered why GPRS wasn't working until I remembered our two-phase-access aka WAIT_ASSIGN problem in osmo-pcu and reverted f1a7b8fc. With that, GPRS works fine with all of the above. phew ;) (*) Entirely unrelated to osmocom: I launch my CN programs from a script that launches multiple terminals. I happen to use rxvt-unicode for that and always have for a year. Turns out this time urxvt strips the LD_LIBRARY_PATH when it is invoked. I still don't know how this changed, but when I drop the suid that I find for unknown reasons sitting on the urxvt binary's group ('chmod g-s /usr/bin/urxvt'), it lets the LD_LIBRARY_PATH be, and the binaries run. How did this change from the last time I ran my CN scripts?? No idea. (*) Same with sudo: LD_LIBRARY_PATH now all of a sudden gets stripped during my sudo ggsn -f -c ggsn.conf invocation. I use sudo for ggsn to allow establishing tunnels. Again I didn't change anything about my scripts, just today it doesn't find the libraries in /usr/local/lib anymore. I have to manually add it like sudo LD_LIBRARY_PATH=/usr/local/lib ggsn ... but then sudo tells me I'm not allowed to set the env. After searching around, I add 'SETENV:' to my sudoers file: neels ALL= NOPASSWD:SETENV: /usr/local/bin/ggsn * This time ggsn starts again like it always used to. How did this change from last time I ran ggsn this way?? No idea at all. So my quick test took a bit longer than expected (hasn't started), and the night has progressed at an alarming rate... I'll write again when I found anything on the broken voice. ~Neels -- - Neels Hofmeyr <nhofmeyr(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschäftsführer / Managing Directors: Harald Welte

3 7