Changes

handover_fsm: send_handover_performed(): check lchan != NULL

The target lchan is expected to be valid on HO_RESULT_OK, but it's
still safer to check it against NULL before dereferencing.

Change-Id: Iee734c98dc79681808e7d75360c208a941cc6821
Related: 107391d8c ("handover_fsm: fix send_handover_performed() using wrong lchan")

assignment_fsm: ipacc_chan_mode_supported(): log unsupported chan_mode

Change-Id: I1718994e25ff1349618bdb4660afbe735c5c3977
Related: aa959d74f ("assignment_fsm: check ipaccess channel mode support")

lchan_fsm: don't mark lchan as BORKEN on unsupported mode NACK

When the BTS NACKs a Channel Activation with RSL_ERR_SERV_OPT_UNAVAIL
or RSL_ERR_SERV_OPT_UNIMPL, it means the requested service or channel
mode is not supported - not that the hardware is broken.  In this
case the lchan should transition to LCHAN_ST_WAIT_AFTER_ERROR rather
than LCHAN_ST_BORKEN, which is reserved for genuine hardware failures.

Also add LCHAN_EV_RTP_ERROR to LCHAN_ST_WAIT_AFTER_ERROR's in_event_mask
so that a late LCHAN_EV_RTP_ERROR (e.g. MGCP CRCX timeout arriving after
the NACK was already handled) is silently absorbed rather than triggering
an unexpected-event warning.

Change-Id: Ide3830a697501a0c245a41451302f1e68d553b3c
Related: osmo-ttcn3-hacks.git I000b7b44749380c5af4da42abe37b4ada6e06ee4
Related: OS#6324

assignment_fsm: pass lchan to lchan_type_compat_with_mode()

The lchan pointer is needed by the next patch, which will check
the BTS ipaccess supported-features flags to reject channel modes
that the BTS has reported as unsupported before attempting to
activate the lchan.

Change-Id: I51d5d1a1cf3c51f85f738196967d5c69870681bb
Related: OS#6324

bssap: use LOGPFSML in bssmap_handle_assignm_req()

Change-Id: If99661c0ff1177214bacdb2d1bcb9da1d2d2957c

bssap: mark some pointers as const

Change-Id: Iebb28d6ae0b468545994669248a442dd17f36d4c

ipaccess: fix buffer overread in ipacc_parse_supp_flags()

The loop used OSMO_MAX(e->len, 4), which iterates at least 4 times
even when the IE is shorter than 4 bytes, causing a buffer overread.
Replace with OSMO_MIN(e->len, sizeof(u32)) to cap the iteration both
at the actual IE length and at the uint32_t accumulator size.

Change-Id: I97c69a71eb650cbef1cc3652d0a2a966cfd6cf60

assignment_fsm: check ipaccess channel mode support

Add ipacc_chan_mode_supported(), which checks the NM_IPAC_F_CHANM_*
flags stored in the Baseband Transceiver's MO state (populated during
OML bring-up) to decide whether the BTS can handle a requested channel
mode.  If the IE containing supported channel modes was never received,
the function returns true as if the given mode was supported.

Without this change, requesting a channel mode not supported by the
BTS results in a NACK to the RSL Channel Activation, which causes
the lchan to be marked as BROKEN and thus unavailable.

Change-Id: I680ba7993786f5486d671f931e75df4543670a37
Related: OS#6324

bssap: use LOGPFSML in bssmap_handle_ass_req_tp_codec_list()

Change-Id: Ie51ada174388f4c3e9ffe8a5bec4297bda38584b

lchan_fsm: ignore late lchan_rtp_fsm events

The lchan_rtp_fsm is a child FSM that manages the MGW/RTP endpoint.
When the parent lchan_fsm transitions away before the child has
finished its work (e.g. a CRCX timeout or a DLCX completing after
the lchan is already idle), the child can still deliver
LCHAN_EV_RTP_RELEASED or LCHAN_EV_RTP_ERROR to the parent.

Currently these late events are not in the in_event_mask of every
state that can be reached with the child still running:

* LCHAN_ST_UNUSED: entered from WAIT_AFTER_ERROR after the error timer
  fires, while a DLCX triggered at error time may still be in flight.
* LCHAN_ST_WAIT_AFTER_ERROR: already handles LCHAN_EV_RTP_RELEASED but
  misses LCHAN_EV_RTP_ERROR (e.g. CRCX timeout arriving after the
  NACK was handled).

Add the missing events to both states' in_event_mask and provide a
no-op handler in lchan_fsm_unused() so that the assert is not hit.

Change-Id: Ie6333bd941e4e5a6ddf0e3f113b8764e8bc2bbc0

handover_fsm: fix send_handover_performed() using wrong lchan

send_handover_performed() is called from handover_end() before
gscon_change_primary_lchan() updates conn->lchan to the new lchan.
As a result, the Cell Identifier, Chosen Channel, Chosen Encryption
Algorithm, and Speech Version/Codec IEs were all populated from the
source (old) lchan rather than the target (new) lchan.

As per 3GPP TS 48.008 §3.2.1.25, HANDOVER PERFORMED must report the
target cell and channel.  For intra-BSC handover to a different BTS
this caused the MSC to receive the wrong Cell Identifier.

Fix by initialising lchan from ho->new_lchan instead of conn->lchan,
and deriving the BTS via lchan->ts->trx->bts.

Change-Id: I4111351dc38fc2dbe844c2bd07b3ecfaaadd864e
Related: osmo-ttcn3-hacks.git I82aadcc3a80c183cb93522b829071294b156a218
Found-By: Claude Sonnet 4.6

ipaccess: store Supported Features IE to the MO state

Change-Id: Ic89d42c478677ffda4d544f461e7850dd3157040
Related: OS#6324

nokia_site: add objects to query TRX power and power steps

This commit adds a method to query per TRX RF power and
power control step capabilities of radio HW.

Change-Id: Ib5a00c0b528407144cca88e5cbde940d7a5509f0