Hi, Ivan

 

1) First pls fix the following critical bug, readIndex  is modified by readField cause delivered by reference, so every not first iteration it'll have a bad value :

 

*** ./DCCHDispatch.bug.cpp 2012-11-01 12:33:43.000000000 +0200
--- ./DCCHDispatch.cpp 2012-11-01 16:48:29.000000000 +0200
***************
*** 469,474 ****
--- 469,475 ----
      }
      L3Frame *l3 = new L3Frame(msg->tail(8), UNIT_DATA);
      COUT("RX: [ BTS <- PCU ] AGCH: " << *l3);
+     readIndex = 0; //vr, fix
      l2Len = msg->readField(readIndex, len);
      l3->L2Length(l2Len);
      AGCH->send(l3);

 

or ( I like it more )

 

*** ./DCCHDispatch.bug.cpp 2012-11-01 12:33:43.000000000 +0200
--- ./DCCHDispatch.fix0.cpp 2012-11-01 17:58:15.000000000 +0200
***************
*** 431,438 ****
 
   char buf[MAX_UDP_LENGTH];
 
-  unsigned len = 6;
-  size_t readIndex = 0;
   size_t l2Len = 0;
 
   // Send to PCU PhConnectInd primitive.
--- 431,436 ----
***************
*** 469,475 ****
      }
      L3Frame *l3 = new L3Frame(msg->tail(8), UNIT_DATA);
      COUT("RX: [ BTS <- PCU ] AGCH: " << *l3);
!     l2Len = msg->readField(readIndex, len);
      l3->L2Length(l2Len);
      AGCH->send(l3);
      txPhDataIndCnf(*msg, gBTS.time());
--- 467,473 ----
      }
      L3Frame *l3 = new L3Frame(msg->tail(8), UNIT_DATA);
      COUT("RX: [ BTS <- PCU ] AGCH: " << *l3);
!     l2Len = msg->peekField(0, 6);
      l3->L2Length(l2Len);
      AGCH->send(l3);
      txPhDataIndCnf(*msg, gBTS.time());
***************
*** 479,486 ****
      L3Frame *msg1 = new L3Frame(msg->tail(8*4), UNIT_DATA);
      L3Frame *msg2 = new L3Frame(msg->tail(8*4), UNIT_DATA);
      COUT("RX: [ BTS <- PCU ] PCH: " << *msg1);
!     readIndex = 24;
!     l2Len = msg->readField(readIndex, len);
      msg1->L2Length(l2Len);
      msg2->L2Length(l2Len);
      // HACK -- We send every page twice.
--- 477,483 ----
      L3Frame *msg1 = new L3Frame(msg->tail(8*4), UNIT_DATA);
      L3Frame *msg2 = new L3Frame(msg->tail(8*4), UNIT_DATA);
      COUT("RX: [ BTS <- PCU ] PCH: " << *msg1);
!     l2Len = msg->peekField(8*3, 6);
      msg1->L2Length(l2Len);
      msg2->L2Length(l2Len);
      // HACK -- We send every page twice.

 

 

I would reccomend also to fix BitVector.cpp known bug:

void BitVector::unpack(const unsigned char* src)
{
 // Assumes MSB-first packing.
 unsigned bytes = size()/8;
 for (unsigned i=0; i<bytes; i++) {
  fillField(i*8,src[i],8);
 }
 unsigned whole = bytes*8;
 unsigned rem = size() - whole;
 if (rem==0) return;
        fillField(whole,src[bytes] >> (8-rem),rem); //here
}

 

USRPDevice.cpp known bug:

double USRPDevice::setTxGain(double dB) {
 
   writeLock.lock();
   if (dB > maxTxGain()) dB = maxTxGain();
   if (dB < minTxGain()) dB = minTxGain();

   LOG(NOTICE) << "Setting TX gain to " << dB << " dB.";

   if (!m_dbTx->set_gain(dB)) // here
     LOG(ERR) << "Error setting TX gain";

   writeLock.unlock();
 
   return dB;
}

BSIC calculation:

 

prim->u.info_ind.bsic = (gConfig.getNum("GSM.Identity.BSIC.NCC") << 3) | gConfig.getNum("GSM.Identity.BSIC.BCC");

 

 

 

2) With up to date OpenBTS pulled from git today and critical fix only I've got the results identical to session 2 and 3 I've recorded yesterday. I attach the file with problematic scenario. I think you may recreate the problem with every SonyErricson supporting 3G and GSM (my env is Suse 11.4 or Ubuntu 11.10, libusb_1_0 and libusrp-3.4.2).

 

Regards,

Vladimir