openbts-p2.8-gprs-exp and pcu issues

Vladimir Rolbin vrolbin at gmail.com
Thu Nov 1 16:59:49 UTC 2012


Hi, Ivan

1) First pls fix the following critical bug, readIndex  is modified by
readField cause delivered by reference, so every not first iteration it'll
have a bad value :

*** ./DCCHDispatch.bug.cpp 2012-11-01 12:33:43.000000000 +0200
--- ./DCCHDispatch.cpp 2012-11-01 16:48:29.000000000 +0200
***************
*** 469,474 ****
--- 469,475 ----
      }
      L3Frame *l3 = new L3Frame(msg->tail(8), UNIT_DATA);
      COUT("RX: [ BTS <- PCU ] AGCH: " << *l3);
+     readIndex = 0; //vr, fix
      l2Len = msg->readField(readIndex, len);
      l3->L2Length(l2Len);
      AGCH->send(l3);


or ( I like it more )

*** ./DCCHDispatch.bug.cpp 2012-11-01 12:33:43.000000000 +0200
--- ./DCCHDispatch.fix0.cpp 2012-11-01 17:58:15.000000000 +0200
***************
*** 431,438 ****

   char buf[MAX_UDP_LENGTH];

-  unsigned len = 6;
-  size_t readIndex = 0;
   size_t l2Len = 0;

   // Send to PCU PhConnectInd primitive.
--- 431,436 ----
***************
*** 469,475 ****
      }
      L3Frame *l3 = new L3Frame(msg->tail(8), UNIT_DATA);
      COUT("RX: [ BTS <- PCU ] AGCH: " << *l3);
!     l2Len = msg->readField(readIndex, len);
      l3->L2Length(l2Len);
      AGCH->send(l3);
      txPhDataIndCnf(*msg, gBTS.time());
--- 467,473 ----
      }
      L3Frame *l3 = new L3Frame(msg->tail(8), UNIT_DATA);
      COUT("RX: [ BTS <- PCU ] AGCH: " << *l3);
!     l2Len = msg->peekField(0, 6);
      l3->L2Length(l2Len);
      AGCH->send(l3);
      txPhDataIndCnf(*msg, gBTS.time());
***************
*** 479,486 ****
      L3Frame *msg1 = new L3Frame(msg->tail(8*4), UNIT_DATA);
      L3Frame *msg2 = new L3Frame(msg->tail(8*4), UNIT_DATA);
      COUT("RX: [ BTS <- PCU ] PCH: " << *msg1);
!     readIndex = 24;
!     l2Len = msg->readField(readIndex, len);
      msg1->L2Length(l2Len);
      msg2->L2Length(l2Len);
      // HACK -- We send every page twice.
--- 477,483 ----
      L3Frame *msg1 = new L3Frame(msg->tail(8*4), UNIT_DATA);
      L3Frame *msg2 = new L3Frame(msg->tail(8*4), UNIT_DATA);
      COUT("RX: [ BTS <- PCU ] PCH: " << *msg1);
!     l2Len = msg->peekField(8*3, 6);
      msg1->L2Length(l2Len);
      msg2->L2Length(l2Len);
      // HACK -- We send every page twice.


I would reccomend also to fix BitVector.cpp known bug:
void BitVector::unpack(const unsigned char* src)
{
 // Assumes MSB-first packing.
 unsigned bytes = size()/8;
 for (unsigned i=0; i<bytes; i++) {
  fillField(i*8,src[i],8);
 }
 unsigned whole = bytes*8;
 unsigned rem = size() - whole;
 if (rem==0) return;
        fillField(whole,src[bytes] >> (8-rem),rem); //here
}

USRPDevice.cpp known bug:
double USRPDevice::setTxGain(double dB) {

   writeLock.lock();
   if (dB > maxTxGain()) dB = maxTxGain();
   if (dB < minTxGain()) dB = minTxGain();
   LOG(NOTICE) << "Setting TX gain to " << dB << " dB.";
   if (!m_dbTx->set_gain(dB)) // here
     LOG(ERR) << "Error setting TX gain";
   writeLock.unlock();

   return dB;
}

BSIC calculation:

prim->u.info_ind.bsic = (gConfig.getNum("GSM.Identity.BSIC.NCC") << 3) |
gConfig.getNum("GSM.Identity.BSIC.BCC");



2) With up to date OpenBTS pulled from git today and critical fix only I've
got the results identical to session 2 and 3 I've recorded yesterday. I
attach the file with problematic scenario. I think you may recreate the
problem with every SonyErricson supporting 3G and GSM (my env is Suse 11.4
or Ubuntu 11.10, libusb_1_0 and libusrp-3.4.2).

Regards,
Vladimir
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/osmocom-net-gprs/attachments/20121101/b6989bb8/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: rlcmac_z750i_1.rar
Type: application/rar
Size: 15858 bytes
Desc: not available
URL: <http://lists.osmocom.org/pipermail/osmocom-net-gprs/attachments/20121101/b6989bb8/attachment.bin>


More information about the osmocom-net-gprs mailing list