About sniff multi bursts in a frame, CCCH_CONF
aegean2000 at 21cn.com
Mon Sep 26 05:08:43 UTC 2011
the bts arround me uses MultiCCCH, it's CCCH_CONF = 110 (6), so it uses TS0, TS2, TS4 and TS6 in a frame for PCH/AGCH.
but the burst_ind only CCCH-CONF 0 & 1 are supported, it can sniff TS0 only, so only catch 1/4 IMM ASS for me.
my OWN phone, it's just not in TS0 (i use nokia netmonitor to check it), so i can't catch it at all (phones use IMSI to decide page group).
i read the source briefly, and modify prim_rx_nb.c line "l1s_rx_win_ctrl(arfcn, L1_RXWIN_NB, 0);" for TS2, TS4, TS6 temporarily,
but this way i'll need 4 phones to catch ONE station. it's very strange, and not beauty.
i think the bottleneck is the DSP, as the DSP task (ALLC_DSP_TASK) can only process one TS of a frame (it's enough for phone),
i think maybe backup/restore the DSP task variable patch needed, i'm new to the DSP disassemble and patch, anyone can help? thanks
More information about the baseband-devel