Hi! Today I've done the first push of the 'laforge/hsl' branch, an attempt to support the HSL 2.75G Femtocell from OpenBSC. It is far from being complete, but you can get the BTS to start up on the right ARFCN and process location area updates and other signalling traffic. Voice support is still being worked on. To give you a quick overview of what you are dealing with: == Hardware == * Ti DaVinci TMS320DM6443A (ARM9 CPU + DSP) * Xilinx Spartan-3A FPGA (XC3SD1800A) * 128 MByte DDR-2 RAM * 128 MByte NAND flash * Realtek RTL8201 Ethernet MAC * Dual 12-bit 65Ms/sec ADC (ADS5232) * Dual 14-bit 275Ms/sec DAC (DAC5672) As you can see, the hardware is _much_ more powerful than you would ever need for a simple single-ARFCN femtocell. Using the high-speed DAC/ADC, the combined power of the FPGA (with DSP slices) and DSP, you can probably expect that they will at least want to do multi-ARFCN (if not 3G) on the same hardware at some later point. == Protocol == They use an odd down-sized minimalistic dialect of the ip.access Abis/IP. === ACS === Prior to connecting to the BSC, the cell downloads its current configuration via https, using a HTTP POST of its serial number. === IPA layer === The IPA multiplex layer does not have PING/PONG keepalives, and it does not do the ID_GET/ID_RESP/ID_CONF identification with the Unit ID. Furthermore, both OML and RSL are encapsulated in the same TCP connection. Stream identifier 0xDD is used for passing string debug messages from the BTS to the BSC. Neither OML nor RSL are implemented fully, as per 12.21 / 08.58 === RSL === It seems to have a very 'creative' interpretation of the RSL specification. Some examples: * use of SACCH INFO MODIFY instead of SACCH FILLING for default SI5/SI6 * it forgets to send RSL CHAN REL ACK on TS1...7 * it does not implement RSL CHAN MODIFY * it seems to be unable to run without DTX * it often detects RACH requests where there are none (!) === OML === OML is almost not present at all. Only software download and setting of ARFCN + BSIC are supported. No managed objects, no state transitions, no software activation procedures/events at all. The configuration of each timeslot seems to happen 'on demand', i.e. there are no OML commands to configure the timeslots, but it depends on your RSL CHAN ACT whether a timeslot will become a TCH/H or TCH/F. I have not managed to use a SDCCH/8 anywhere, just TCH/F and TCH/H as well as SDCCH/4. The BCCH _claims_ to be a Combination 4, but in reality it is a Combination 5 (i.e. including the SDCCH/4) === GPRS === GPRS is quiite odd, too. The BSSGP is encapsulated in the RSL L3_INFO_IE, this means we will have to run a NS link from the BSC to the SGSN, combining all the BSSGP links from HSL Femtocells to the BSC. -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)