sysmobts: Correct sending of LAPDm frames on the SACCH

When a frame is sent on the SACCH the LAPDm code will already
prepend two bytes for the tx_power and the ta. In the BTS we want
to use the values that were set by the BSC though. They currently
come from the RSL CHAN ACT but could also be set through the
RSL MS power control command. Update the comment as the space is
not empty.

At the 30C3 we had a NITB crash because of a RLL timeout on a
TCH/F. Jacob analyzed the problem and tracked it down to the
mismatch of LAPDm and the l1 interface to the DSP.

1 files changed, 7 insertions, 4 deletions

diff --git a/src/osmo-bts-sysmo/l1_if.c b/src/osmo-bts-sysmo/l1_if.c
index 957668d..c43f7e7 100644
--- a/src/osmo-bts-sysmo/l1_if.c
+++ b/src/osmo-bts-sysmo/l1_if.c
@@ -483,13 +483,16 @@ static int handle_ph_readytosend_ind(struct femtol1_hdl *fl1,
 			/* No SACCH data from LAPDM pending, send SACCH filling */
 			uint8_t *si = lchan_sacch_get(lchan, &g_time);
 			if (si) {
-				/* The +2 is empty space where the DSP inserts the L1 hdr */
+				/* +2 to not overwrite the ms_power/ta values */
+				LOGP(DL1C, LOGL_NOTICE, "Data from SI pointer.\n");
 				memcpy(msu_param->u8Buffer+2, si, GSM_MACBLOCK_LEN-2);
-			} else
+			} else {
+				/* +2 to not overwrite the ms_power/ta values */
 				memcpy(msu_param->u8Buffer+2, fill_frame, GSM_MACBLOCK_LEN-2);
+			}
 		} else {
-			/* The +2 is empty space where the DSP inserts the L1 hdr */
-			memcpy(msu_param->u8Buffer+2, pp.oph.msg->data, GSM_MACBLOCK_LEN-2);
+			/* +2 to not overwrite the ms_power/ta values */
+			memcpy(msu_param->u8Buffer+2, pp.oph.msg->data + 2, GSM_MACBLOCK_LEN-2);
 			msgb_free(pp.oph.msg);
 		}
 		break;