Hi, Vladimir!

Thank you for your fixes, I will check and apply them tomorrow!
In attachment you can find patch for osmo-pcu.
I guess, that this patch should fix problem of receiving PACKET
DOWNLINK ACK messages with unknown FN.
Please, check it with your phones and notify me about results.

2012/11/1 Vladimir Rolbin <vrolbin@gmail.com>:
> Hi, Ivan
>
> 1) First pls fix the following critical bug, readIndex  is modified by
> readField cause delivered by reference, so every not first iteration it'll
> have a bad value :
>
> *** ./DCCHDispatch.bug.cpp 2012-11-01 12:33:43.000000000 +0200
> --- ./DCCHDispatch.cpp 2012-11-01 16:48:29.000000000 +0200
> ***************
> *** 469,474 ****
> --- 469,475 ----
>       }
>       L3Frame *l3 = new L3Frame(msg->tail(8), UNIT_DATA);
>       COUT("RX: [ BTS <- PCU ] AGCH: " << *l3);
> +     readIndex = 0; //vr, fix
>       l2Len = msg->readField(readIndex, len);
>       l3->L2Length(l2Len);
>       AGCH->send(l3);
>
>
> or ( I like it more )
>
> *** ./DCCHDispatch.bug.cpp 2012-11-01 12:33:43.000000000 +0200
> --- ./DCCHDispatch.fix0.cpp 2012-11-01 17:58:15.000000000 +0200
> ***************
> *** 431,438 ****
>
>    char buf[MAX_UDP_LENGTH];
>
> -  unsigned len = 6;
> -  size_t readIndex = 0;
>    size_t l2Len = 0;
>
>    // Send to PCU PhConnectInd primitive.
> --- 431,436 ----
> ***************
> *** 469,475 ****
>       }
>       L3Frame *l3 = new L3Frame(msg->tail(8), UNIT_DATA);
>       COUT("RX: [ BTS <- PCU ] AGCH: " << *l3);
> !     l2Len = msg->readField(readIndex, len);
>       l3->L2Length(l2Len);
>       AGCH->send(l3);
>       txPhDataIndCnf(*msg, gBTS.time());
> --- 467,473 ----
>       }
>       L3Frame *l3 = new L3Frame(msg->tail(8), UNIT_DATA);
>       COUT("RX: [ BTS <- PCU ] AGCH: " << *l3);
> !     l2Len = msg->peekField(0, 6);
>       l3->L2Length(l2Len);
>       AGCH->send(l3);
>       txPhDataIndCnf(*msg, gBTS.time());
> ***************
> *** 479,486 ****
>       L3Frame *msg1 = new L3Frame(msg->tail(8*4), UNIT_DATA);
>       L3Frame *msg2 = new L3Frame(msg->tail(8*4), UNIT_DATA);
>       COUT("RX: [ BTS <- PCU ] PCH: " << *msg1);
> !     readIndex = 24;
> !     l2Len = msg->readField(readIndex, len);
>       msg1->L2Length(l2Len);
>       msg2->L2Length(l2Len);
>       // HACK -- We send every page twice.
> --- 477,483 ----
>       L3Frame *msg1 = new L3Frame(msg->tail(8*4), UNIT_DATA);
>       L3Frame *msg2 = new L3Frame(msg->tail(8*4), UNIT_DATA);
>       COUT("RX: [ BTS <- PCU ] PCH: " << *msg1);
> !     l2Len = msg->peekField(8*3, 6);
>       msg1->L2Length(l2Len);
>       msg2->L2Length(l2Len);
>       // HACK -- We send every page twice.
>
>
> I would reccomend also to fix BitVector.cpp known bug:
> void BitVector::unpack(const unsigned char* src)
> {
>  // Assumes MSB-first packing.
>  unsigned bytes = size()/8;
>  for (unsigned i=0; i<bytes; i++) {
>   fillField(i*8,src[i],8);
>  }
>  unsigned whole = bytes*8;
>  unsigned rem = size() - whole;
>  if (rem==0) return;
>         fillField(whole,src[bytes] >> (8-rem),rem); //here
> }
>
> USRPDevice.cpp known bug:
> double USRPDevice::setTxGain(double dB) {
>
>    writeLock.lock();
>    if (dB > maxTxGain()) dB = maxTxGain();
>    if (dB < minTxGain()) dB = minTxGain();
>    LOG(NOTICE) << "Setting TX gain to " << dB << " dB.";
>    if (!m_dbTx->set_gain(dB)) // here
>      LOG(ERR) << "Error setting TX gain";
>    writeLock.unlock();
>
>    return dB;
> }
>
> BSIC calculation:
>
> prim->u.info_ind.bsic = (gConfig.getNum("GSM.Identity.BSIC.NCC") << 3) |
> gConfig.getNum("GSM.Identity.BSIC.BCC");
>
>
>
> 2) With up to date OpenBTS pulled from git today and critical fix only I've
> got the results identical to session 2 and 3 I've recorded yesterday. I
> attach the file with problematic scenario. I think you may recreate the
> problem with every SonyErricson supporting 3G and GSM (my env is Suse 11.4
> or Ubuntu 11.10, libusb_1_0 and libusrp-3.4.2).
>
> Regards,
> Vladimir
>



--
Regards,
Ivan Kluchnikov.
http://fairwaves.ru