Bug #3426

gprs_llc_process_xid_ind() does not echo L3_PAR, breaks PDP activation for Motorola KRZR

Added by keith 9 months ago. Updated 7 months ago.

Target version:
Start date:
Due date:
% Done:


Spec Reference:


In gprs_llc_process_xid_ind()
(at the time of writing)

We check if (xid_field->type != GPRS_LLC_XID_T_L3_PAR)
before echoing the XID to the MS

The Motorola KRZR responds by sending the XID list again and repeats 4 times before giving up and sending PDP deactivate context, with a cause 25 "LLC or SNDCP Failure"

Removing the check for xid_field->type != GPRS_LLC_XID_T_L3_PAR and echoing the L3 parameter back results in PDP activation success and GPRS session works.

Why this check? Why do we not echo all the xid fields back? Did it break with some other phone?


#1 Updated by laforge 8 months ago

I purchased a KRZR 3 for the sysmocom lab. Not sure when somebody will be able to try to reproduce, but at least we should be able to do now.

#2 Updated by keith 7 months ago

I've been running SGSN now for some weeks with this patch in place to allow the KRZR to attach and I have not seen any related problems. (with any other phone)

#3 Updated by keith 7 months ago

TS 04.06 [EDIT correction TS 04.64 ] is kind of confusing here.

On the one had it says:
As an optimisation, parameters confirming the requested values may be omitted from the XID response.


The responding side may respond with parameters that were not included in the XID command. A parameter that was
not included in the XID command shall in this case be treated as if the current value of the parameter was included in
the XID command. The responding side shall include such a parameter in every XID response until the parameter has
been explicitly negotiated
, either by responding to an XID command that included the parameter, or by explicitly
including the parameter the next time an XID command is transmitted.


Negotiated XID parameters shall apply to the LLE identified by the DLCI of the XID frames used, except Version,
Reset, and IOV-UI that applies to an LLME (i.e., a TLLI), and except Layer-3 Parameters that apply to the layer 3
above the LLE

So from that I understand that while we may not actually be applying this L3 param to the LLE identified by the DLCI (to be honest, I haven't even looked up what the dlci is), we still MUST include it in the response.

Maybe this is a mis understanding that is the origin of this

if (xid_field->type != GPRS_LLC_XID_T_L3_PAR)

in the code?


Also available in: Atom PDF

Add picture from clipboard (Maximum size: 48.8 MB)