[BSC] NM: Correct treatment of ARFCN_LIST for BS-11
For Siemens BS-11, the 'length' value of the ARFCN_LIST IE is interpreted in
violation of the spec. The spec says it is a length in octets, while Siemens
treats it as 'count of 16bit ARFCN values'.
diff --git a/openbsc/src/abis_nm.c b/openbsc/src/abis_nm.c
index 31302f1..63d9d9c 100644
--- a/openbsc/src/abis_nm.c
+++ b/openbsc/src/abis_nm.c
@@ -1990,7 +1990,11 @@
for (i = 0; i < ts->hopping.arfcns.data_len*8; i++) {
if (bitvec_get_bit_pos(&ts->hopping.arfcns, i)) {
msgb_put_u16(msg, i);
- *len += sizeof(uint16_t);
+ /* At least BS-11 wants a TLV16 here */
+ if (bts->type == GSM_BTS_TYPE_BS11)
+ *len += 1;
+ else
+ *len += sizeof(uint16_t);
}
}
}