Fixed pseudo length of IMMEDIATE ASSIGNMENT message.

The pseudo length may not include the rest-octets, so it stays compatible
to non-GPRS phones.

At pcu_l1_if.c (OpenBTS) no pseudo length is given, so the frame is
only 22 bytes long. I could not test if it works.

4 files changed, 24 insertions, 18 deletions

diff --git a/src/gprs_rlcmac.cpp b/src/gprs_rlcmac.cpp
index b68af3fc..4adbe7dc 100644
--- a/src/gprs_rlcmac.cpp
+++ b/src/gprs_rlcmac.cpp
@@ -322,6 +322,7 @@ int write_immediate_assignment(bitvec * dest, uint8_t downlink, uint8_t ra,
 	uint8_t polling, uint32_t poll_fn)
 {
 	unsigned wp = 0;
+	uint8_t plen;
 
 	bitvec_write_field(dest, wp,0x0,4);  // Skip Indicator
 	bitvec_write_field(dest, wp,0x6,4);  // Protocol Discriminator
@@ -356,6 +357,13 @@ int write_immediate_assignment(bitvec * dest, uint8_t downlink, uint8_t ra,
 	// A zero-length LV.  Just write L=0.
 	bitvec_write_field(dest, wp,0,8);
 
+	if ((wp % 8)) {
+		LOGP(DRLCMACUL, LOGL_ERROR, "Length of IMM.ASS without rest "
+			"octets is not multiple of 8 bits, PLEASE FIX!\n");
+		exit (0);
+	}
+	plen = wp / 8;
+
 	if (downlink)
 	{
 		// GSM 04.08 10.5.2.16 IA Rest Octets
@@ -405,10 +413,7 @@ int write_immediate_assignment(bitvec * dest, uint8_t downlink, uint8_t ra,
 		bitvec_write_field(dest, wp, 0, 1);    // TBF_STARTING_TIME_FLAG
 	}
 
-	if (wp%8)
-		return wp/8+1;
-	else
-		return wp/8;
+	return plen;
 }
 
 /* generate uplink assignment */
diff --git a/src/gprs_rlcmac_data.cpp b/src/gprs_rlcmac_data.cpp
index a2b21a96..71bad5c4 100644
--- a/src/gprs_rlcmac_data.cpp
+++ b/src/gprs_rlcmac_data.cpp
@@ -835,11 +835,11 @@ int gprs_rlcmac_rcv_rach(uint8_t ra, uint32_t Fn, int16_t qta)
 	tbf_timer_start(tbf, 3169, bts->t3169, 0);
 	LOGP(DRLCMAC, LOGL_NOTICE, "TBF: [UPLINK] START TFI: %u\n", tbf->tfi);
 	LOGP(DRLCMAC, LOGL_NOTICE, "RX: [PCU <- BTS] TFI: %u RACH qbit-ta=%d ra=%d, Fn=%d (%d,%d,%d)\n", tbf->tfi, qta, ra, Fn, (Fn / (26 * 51)) % 32, Fn % 51, Fn % 26);
-	LOGP(DRLCMAC, LOGL_NOTICE, "TX: [PCU -> BTS] TFI: %u Packet Immidiate Assignment\n", tbf->tfi);
-	bitvec *immediate_assignment = bitvec_alloc(23);
-	bitvec_unhex(immediate_assignment, "2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b");
-	int len = write_immediate_assignment(immediate_assignment, 0, ra, Fn, tbf->ta, tbf->arfcn, tbf->ts, tbf->tsc, tbf->tfi, usf, 0, 0, 0);
-	pcu_l1if_tx_agch(immediate_assignment, len);
+	LOGP(DRLCMAC, LOGL_NOTICE, "TX: [PCU -> BTS] TFI: %u Packet Immidiate Assignment (AGCH)\n", tbf->tfi);
+	bitvec *immediate_assignment = bitvec_alloc(22) /* without plen */;
+	bitvec_unhex(immediate_assignment, "2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b");
+	int plen = write_immediate_assignment(immediate_assignment, 0, ra, Fn, tbf->ta, tbf->arfcn, tbf->ts, tbf->tsc, tbf->tfi, usf, 0, 0, 0);
+	pcu_l1if_tx_agch(immediate_assignment, plen);
 	bitvec_free(immediate_assignment);
 
 	return 0;
@@ -1325,12 +1325,12 @@ struct msgb *gprs_rlcmac_send_packet_downlink_assignment(
 static void gprs_rlcmac_downlink_assignment(gprs_rlcmac_tbf *tbf, uint8_t poll)
 {
 	LOGP(DRLCMAC, LOGL_NOTICE, "TX: [PCU -> BTS] TFI: %u TLLI: 0x%08x Immidiate Assignment (CCCH)\n", tbf->tfi, tbf->tlli);
-	bitvec *immediate_assignment = bitvec_alloc(23);
-	bitvec_unhex(immediate_assignment, "2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b");
+	bitvec *immediate_assignment = bitvec_alloc(22); /* without plen */
+	bitvec_unhex(immediate_assignment, "2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b");
 	/* use request reference that has maximum distance to current time,
 	 * so the assignment will not conflict with possible RACH requests. */
-	int len = write_immediate_assignment(immediate_assignment, 1, 125, (tbf->pdch->last_rts_fn + 21216) % 2715648, tbf->ta, tbf->arfcn, tbf->ts, tbf->tsc, tbf->tfi, 0, tbf->tlli, poll, tbf->poll_fn);
-	pcu_l1if_tx_agch(immediate_assignment, len);
+	int plen = write_immediate_assignment(immediate_assignment, 1, 125, (tbf->pdch->last_rts_fn + 21216) % 2715648, tbf->ta, tbf->arfcn, tbf->ts, tbf->tsc, tbf->tfi, 0, tbf->tlli, poll, tbf->poll_fn);
+	pcu_l1if_tx_agch(immediate_assignment, plen);
 	bitvec_free(immediate_assignment);
 }
 
diff --git a/src/pcu_l1_if.cpp b/src/pcu_l1_if.cpp
index 21e454b8..f6ba7750 100644
--- a/src/pcu_l1_if.cpp
+++ b/src/pcu_l1_if.cpp
@@ -112,7 +112,7 @@ void pcu_l1if_tx_pdtch(msgb *msg, uint8_t trx, uint8_t ts, uint16_t arfcn,
 	msgb_free(msg);
 }
 
-void pcu_l1if_tx_agch(bitvec * block, int len)
+void pcu_l1if_tx_agch(bitvec * block, int plen)
 {
 	struct msgb *msg = l1p_msgb_alloc();
 	GsmL1_Prim_t *prim = msgb_l1prim(msg);
@@ -120,7 +120,8 @@ void pcu_l1if_tx_agch(bitvec * block, int len)
 	prim->id = GsmL1_PrimId_PhDataReq;
 	prim->u.phDataReq.sapi = GsmL1_Sapi_Agch;
 	bitvec_pack(block, prim->u.phDataReq.msgUnitParam.u8Buffer);
-	prim->u.phDataReq.msgUnitParam.u8Size = len;
+#warning Please review, if OpenBTS requires AGCH frame without pseudo length:
+	prim->u.phDataReq.msgUnitParam.u8Size = 22;
 	osmo_wqueue_enqueue(&l1fh->udp_wq, msg);
 }
 
diff --git a/src/sysmo_l1_if.cpp b/src/sysmo_l1_if.cpp
index a2dff87a..2d3c7965 100644
--- a/src/sysmo_l1_if.cpp
+++ b/src/sysmo_l1_if.cpp
@@ -140,13 +140,13 @@ void pcu_l1if_tx_ptcch(msgb *msg, uint8_t trx, uint8_t ts, uint16_t arfcn,
 	msgb_free(msg);
 }
 
-void pcu_l1if_tx_agch(bitvec * block, int len)
+void pcu_l1if_tx_agch(bitvec * block, int plen)
 {
-	uint8_t data[24]; /* prefix PLEN */
+	uint8_t data[23]; /* prefix PLEN */
 	
 	/* FIXME: why does OpenBTS has no PLEN and no fill in message? */
 	bitvec_pack(block, data + 1);
-	data[0] = (len << 2) | 0x01;
+	data[0] = (plen << 2) | 0x01;
 	pcu_tx_data_req(0, 0, PCU_IF_SAPI_AGCH, 0, 0, 0, data, 23);
 }