Hello,
second try to add support to bs11_config for bport0/1 configuration. This
time with enum abis_bs11_line_cfg.
It seems sometimes creating bport1 fails, even LMT shows create obj
greyed out. Don't know why yet.
Regards,
Daniel Willmann
Daniel Willmann (1):
Add {create,delete}-bport1 and bport0-{star,multidrop} to bs11-config
openbsc/include/openbsc/abis_nm.h | 10 +++++++++-
openbsc/src/abis_nm.c | 31 +++++++++++++++++++++++++++++--
openbsc/src/bs11_config.c | 26 ++++++++++++++++++++++++++
3 files changed, 64 insertions(+), 3 deletions(-)
Hi,
I've noticed a problem when delivering several SMS to a mobile back-to-back.
The first one is ok, the second one is received by the MS but OpenBSC fails
with "RX RP-ACK but no sms in transaction?!?" when receiving the "RX SMS
RP-ACK (MO)"
(full log below)
From the symptoms and looking at the code, I would say that the transaction
of the first SMS delivery was not freed, therefore, when we receive the
RP-ACK of the second SMS, we do a trans_find_by_id in gsm0411_rcv_sms, and
we actually find the transaction of the _first_ deliver (which has its .sms
field cleared since it was released already).
I think you wouldn't notice if you waited between SMS because SMC Timer
TC1* would expire, calling trans_free().
The problem is that I don't really know _where_ trans_free should be
called. There are commented out call to it at several places ...
I would think the RP-ACK(MO) reception looks like a good place. But OTOH,
this whole process can queue data, giving away a reference to lchan
(without get) and trans_free does a put on lchan (so I guess that could
invalidate the lchan ref that was queued ? didn't check that in details)
Sylvain
--- SNIP ---
<0100> gsm_04_11.c:920 send_sms_lchan()
<0002> transaction.c:69 subscr=0x1fe52d0, subscr->net=0x1f8fc30
<0002> gsm_subscriber_base.c:131 subscr 46332 usage increases usage to: 4
<0002> gsm_04_11.c:937 lchan (bts=0,trx=0,ts=0,ch=0) increases usage to: 1
<0100> gsm_04_11.c:972 TX: SMS DELIVER
<0100> gsm_04_11.c:188 TX: CP-DATA trans=4
<0100> gsm_04_11.c:149 GSM4.11 TX 49 01 1e 01 2a 07 91 44 77 58 10 06 50 00
12 00 05 b9 72 65 f7 00 00 90 80 72 12 03 41 00 02 44 3a
<0001> abis_rsl.c:1215 channel=(bts=0,trx=0,ts=0) chan_nr=0x20 sapi=3 DATA
INDICATION
<0100> gsm_04_11.c:817 trans_id=c RX SMS CP-ACK
<0001> abis_rsl.c:1215 channel=(bts=0,trx=0,ts=0) chan_nr=0x20 sapi=3 DATA
INDICATION
<0100> gsm_04_11.c:817 trans_id=c RX SMS CP-DATA
<0100> gsm_04_11.c:191 TX: CP-ACK trans=4
<0100> gsm_04_11.c:149 GSM4.11 TX 49 04
<0100> gsm_04_11.c:750 RX SMS RP-ACK (MO)
<0002> gsm_subscriber_base.c:139 subscr 27567 usage decreased usage to: 0
<0002> gsm_subscriber_base.c:139 subscr 46332 usage decreased usage to: 3
DB: Found Subscriber: ID 2, IMSI 206205003327508, NAME '', TMSI 1666608304,
EXTEN '27567', LAC 1, AUTH 1
DBI: -7: The requested variable type does not match what libdbi thinks it
should be
<0002> gsm_subscriber_base.c:131 subscr 46332 usage increases usage to: 4
<0100> gsm_04_11.c:920 send_sms_lchan()
<0002> transaction.c:69 subscr=0x1fe52d0, subscr->net=0x1f8fc30
<0002> gsm_subscriber_base.c:131 subscr 46332 usage increases usage to: 5
<0002> gsm_04_11.c:937 lchan (bts=0,trx=0,ts=0,ch=0) increases usage to: 2
<0100> gsm_04_11.c:972 TX: SMS DELIVER
<0100> gsm_04_11.c:188 TX: CP-DATA trans=4
<0100> gsm_04_11.c:149 GSM4.11 TX 49 01 1f 01 2a 07 91 44 77 58 10 06 50 00
13 00 05 b9 72 65 f7 00 00 90 80 72 12 03 41 00 03 47 39 19
<0001> abis_rsl.c:1215 channel=(bts=0,trx=0,ts=0) chan_nr=0x20 sapi=3 DATA
INDICATION
<0100> gsm_04_11.c:817 trans_id=c RX SMS CP-ACK
<0001> abis_rsl.c:1215 channel=(bts=0,trx=0,ts=0) chan_nr=0x20 sapi=3 DATA
INDICATION
<0100> gsm_04_11.c:817 trans_id=c RX SMS CP-DATA
<0100> gsm_04_11.c:191 TX: CP-ACK trans=4
<0100> gsm_04_11.c:149 GSM4.11 TX 49 04
<0100> gsm_04_11.c:750 RX SMS RP-ACK (MO)
<0100> gsm_04_11.c:640 RX RP-ACK but no sms in transaction?!?
<0100> gsm_04_11.c:561 TX: SMS RP ERROR, cause 111 (Protocol Error)
<0100> gsm_04_11.c:188 TX: CP-DATA trans=4
<0100> gsm_04_11.c:149 GSM4.11 TX 49 01 04 05 2a 01 6f
<0001> abis_rsl.c:1215 channel=(bts=0,trx=0,ts=0) chan_nr=0x20 sapi=3 DATA
INDICATION
<0100> gsm_04_11.c:817 trans_id=c RX SMS CP-ACK
<0100> gsm_04_11.c:159 SMC Timer TC1* is expired, calling trans_free()
<0002> transaction.c:101 lchan (bts=0,trx=0,ts=0,ch=0) decreases usage to: 1
<0002> gsm_subscriber_base.c:139 subscr 46332 usage decreased usage to: 4
--- /SNIP ---
Hello Sergey,
On Mon, 31 Aug 2009 15:11:26 +0400, "Sergey V. Efimoff" <risky(a)mail.ru> wrote:
>
> What type of E1 adapter do you use? If you use an accurate clock source,
> Work and Set values should be similiar (I have Set Value 1024, Work value 1023,
> and I've used Nateks E1 SDH Mux with High-Stability Stratum oscillator when
> calibrating). See http://bs11-abis.gnumonks.org/trac/wiki/isdnsync
The observed difference of "Work Value 1104" and "Set Value 1082" should
be no problem. From my measurements a difference of about 100 of those
values means about 0.1 ppm. And 0.1 ppm is good enough that most phones
should see the BS-11 and the offical networks.
I guess there is some other problem, I would also check if bs11_config
shows that the TRX is loaded. And maybe start with a configuration file
which uses only one TRX.
Best regards,
Dieter
--
Dieter Spaar, Germany spaar(a)mirider.augusta.de
Hi,
we have some troubles finding the network on our cell-phones. There are
a lot of suspicious messages, we can't really make sense out of.
Example: bs11_config_query shows the following line:
BS11 Attributes" a line: E1 Channel: Port=255 Timeslot=161 Subslot=39
This looks completely broken (misparsed by bs11_config?)
Another issue are the Set- and Work-values of the Phase-Locked-Loop:
We synchronized it with the ISDN network (isdnsync) and it leveled off to
1104 for the Work-Value, Set-Value, however, is 1082. I suspect this is
ok and set-value is some informational value only (perhaps the value
of the last calibration?).
One more question about the radio carrier: On startup of bsc_hack we get
the following message:
OC=RADIO CARRIER(02) INST=(00,01,ff) STATE CHG: OP_STATE=Disabled AVAIL=In test(00)
Is this normal behaviour?
Apart from all this questions, does anyone have some more hints what we
should look at? We tried different cell phones, tried switching them off
and on, but without any success.
We're using the latest git version of openbsc.
Thank you for your help!
Martin
Hello Again,
So as my previous post mentioned, I recently acquired an Ericsson RBS 2401.
In looking through the configuration, it only allows for a T1 connection,
not an E1. The first issue I see with this is I haven't been able to find a
mISDN supported T1 card. I assume all of the BS-11 are E1, so I suppose T1
support has never come up. Not a coder myself, I'm not going to be a lot of
help in that department. But I can get a T1 card and hook this RBS up to a
Linux box and do any debugging that might help move things along. I'm open
to any suggestions. I know Harald was looking into getting traces for
Ericsson BSC <-> BTS traffic, so hopefully that will help as well.
Thanks again,
Caleb
Hello all,
I'm new to the list, and new to GSM testing, although I've worked with a
fair share of RF, Linux, and networks. I recently acquired an Ericsson RBS
2401 for testing. This is a 2 TRX BTS with a T1 interface. It works on the
GSM 1900 band, and puts out 300mw at full power. There will be another post
about getting started with that...
Onto the main purpose of this post..I have a contact who has 5 Ericsson RBS
2308's, which are the same as the unit Harald recently purchased. They are
probably a bit bigger than the BS-11, have 4 TRX, output about 2.5 watts,
have a T1 interface, and support EDGE. They are banded for GSM 1900. They
can be bought for a reasonable price, plus shipping from California.
Obviously OpenBSC doesn't support these at the moment, but hopefully support
will be added sometime in the future. These would be a great resource for
anyone in the US wanting to do testing, or overseas testers, if you're
willing to pay shipping. If you want more info on the unit itself, you can
download the manual Harald posted to the list earlier this month. If anyone
is interested, please contact me off list, and I will get you in contact
with the seller.
Thanks
Caleb
Hi all!
By mistake I deleted the password file for the wiki/trac earlier today, so
all of you will need new accounts
I used this opportunity to enable new account registration, i.e. everyone
can now create an account for themselves - you don't need to go through me
to do that anymore.
So sorry for the inconvenience to existing users, you will have to create
a new account using the 'register' tab on http://openbsc.gnumonks.org/
Regards,
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hi,
I had the exact same problem has described here
http://lists.gnumonks.org/pipermail/openbsc/2009-July/000627.html
That is, the first call worked great but after the first call, no way
to make a second, the BTS would respond with NACK to the CHANnel
ACTIvation requests.
I finally found that the chan_rate field of the channel_mode must be 0
for that request to work. And forcing it to 0 in
rsl_chan_activate_lchan, like this :
--- SNIP ---
rc = channel_mode_from_lchan(&cm, lchan);
if (rc < 0)
return rc;
cm.chan_rate = 0; // Hack !
-----------
makes the thing work.
But that's obviously not the root cause. I thing the lchan tch_mode
should be GSM48_CMODE_SIGN, so that channel_mode_from_lchan would set
the proper value directly.
But I haven't traced yet why tch_mode is not at the good value for the
second call ...
Sylvain
Hi,
I just got hold of a ip.access nanoBTS model 139U, but so far my
attemps at making it work with OpenBSC have been unsuccessful :(
It's a 'used' one so there are config already done most likely and I
don't know which.
What differs from http://bs11-abis.gnumonks.org/trac/wiki/nanoBTS :
* It doesn't request an IP by DHCP
It seems to have IP/Netmask and GW hardcoded.
* When plugging it, it tries to do an ARP request for what I guess
his the GW address, and when it get a response, it tries to connect to
TCP port 3022 (yes, it's 3022 and not 3002) of yet another IP in
another subnet (which I guess is the configured Primarly OML IP)
* ipaccess-find does find it :
----
ipaccess-find (C) 2009 by Harald Welte
This is FREE SOFTWARE with ABSOLUTELY NO WARRANTY
Trying to find ip.access BTS by broadcast UDP...
MAC Address='00:02:95:00:31:22' IP Address='10.105.254.142' Unit
ID='65143/0/0' Location 1='NanoBTS FXMarketspace' Location
2='BTS_NBT131G' Equipment Version='139_029_41' Software
Version='120a352_v267b22d0' Unit Name='69419' Serial
Number='00071582'
----
* ipaccess-config fails, the nanoBTS refuses incoming connections on
port tcp 3006
* Here's the result of a NMAP :
----
sh$ sudo nmap -sS 10.105.254.142 -p 1-65535
Starting Nmap 4.76 ( http://nmap.org ) at 2009-08-26 16:21 CEST
Interesting ports on 10.105.254.142:
Not shown: 65533 closed ports
PORT STATE SERVICE
3026/tcp open unknown
3034/tcp open unknown
MAC Address: 00:02:95:00:31:22 (IP.Access Limited)
----
* I then tried to run ipaccess-config to port 3026 but it fails (just
waits a while thensays short read / BTS disappeared)
* I tried making openbsc listen on 3022 but with no real results :
---
sh$ bsc_hack
DB: Database initialized.
DB: Database prepared.
no matching signalling link for hh->proto=0x01
no matching signalling link for hh->proto=0x29
no matching signalling link for hh->proto=0x2b
no matching signalling link for hh->proto=0x1b
short read!
no matching signalling link for hh->proto=0x01
short read!
BTS disappeared, dead socket
short read!
no matching signalling link for hh->proto=0x01
no matching signalling link for hh->proto=0x29
no matching signalling link for hh->proto=0x2b
no matching signalling link for hh->proto=0xc9
short read!
no matching signalling link for hh->proto=0x01
short read!
BTS disappeared, dead socket
---
Any idea any one ?
Sylvain
Hello guys,
Suppose I have 8 MS registered on my nanoBTS and the ninth wants also to
register. How can I tell the ninth MS "Sorry dude, there is no room for
you, try another ARFCN"? I've checked the REJECT causes in gsm 04.08,
but couldn't really find one which is informing the BTS is out of free
channels.
Now my mobile keeps trying to register to my nanoBTS, although I
rejected him with a standard cause.
Maybe someone can give me a hint where to look at?
Thanks.
hi,
here is the almost final patch for fragmenting HFC-E1 cards for multiple
BTS connecting to one card. if it is stable, i will submit it after some
tests.
load module with:
$ modprobe hfcmulti dmask=0x00000042 bmask=0x0000003c,0x00000780
debug=0x40000
the dmask must be given von all E1 cards that have to be fragmented. in
this case we only fragment the first card.
the bmask must be given for all fragments. because we have two bits set
(slot 1 and slot 6), we need two values.
each bmask value will define the the bchannels to use for the given
dchannel.
the card is fragmented from lower dchannel to higher dchannel given in
the mask. (slot 1 for first fragment, slot 2 for second fragment)
run misdn_info after loading to see the fragments.
happy testing,
andreas
hi,
i found some leaking on the subscriber ressource usage. this patch is
not final. maybe we find better solutions.
1. trans_alloc() may not allocate subscriber for transaction, because
may be already done before, so i removed subscr_get() from transaction.c
-> on outgoing calls we allocate subscriber ressource (by searching for
it) and use it for transaction.
-> in incomming calls we use the subscriber pointer from the lchan.
2. on an incomming call/sms, the lchan holds a subscriber ressource, so
i added subscr_get() after successfully calling trans_alloc()
3. when _send_sms_buffer() is called, we already hold a subscriber
ressource for the receiver, so the subsequently called function
sms_from_text() must not allocate the receiver again. if this function
fails, the allocated subcriber ressource must be released in
_send_sms_buffer().
4. on trans_free we don't need to remove pending paging processes,
because it is done when paging expires. anyway if we want to keep it in
trans_free(), we must remove paging_remove_request() from
paging_T3113_expired(), because it will then be done when transaction is
removed. also we need to add paging_remove_request() when sms is removed
due to paging expiery.
i also fixed linux call router for compiling with openbsc without any
patch at all. by linking the source directory to the lcr source
directory, the "configure" script automatically detects it and it will
compile. (latest git)
regards,
andreas
Hi!
I've alerady sent this to wireshark-dev, but maybe somebody on this list
can also help...
I'm right now working for a dissector for the 3GPP IuH (Home-NodeB) protocol.
However, I believe the pcap files that I currently have for the protocol are
actually invalid.
Is there anyone on this list who would be able to provide me with RUA and/or
HNBAP protocol traces (preferrably inside SCTP)?
Thanks a lot.
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hello All,
When trying to run bsc_hack I get the following messages:
bootstrapping OML for BTS 0
<0020> abis_nm.c:1644 Set BTS Attr (bts=0)
<0020> abis_nm.c:1661 Set TRX Attr (bts=0,trx=0)
<0020> abis_nm.c:1754 Set Chan Attr (bts=0,trx=0,ts=0)
<0020> abis_nm.c:1754 Set Chan Attr (bts=0,trx=0,ts=1)
<0020> abis_nm.c:1624 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=1) E1=(0,2,1)
<0020> abis_nm.c:1754 Set Chan Attr (bts=0,trx=0,ts=2)
<0020> abis_nm.c:1624 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=2) E1=(0,2,2)
<0020> abis_nm.c:1754 Set Chan Attr (bts=0,trx=0,ts=3)
<0020> abis_nm.c:1624 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=3) E1=(0,2,3)
<0020> abis_nm.c:1754 Set Chan Attr (bts=0,trx=0,ts=4)
<0020> abis_nm.c:1624 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=4) E1=(0,3,0)
<0020> abis_nm.c:1754 Set Chan Attr (bts=0,trx=0,ts=5)
<0020> abis_nm.c:1624 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=5) E1=(0,3,1)
<0020> abis_nm.c:1754 Set Chan Attr (bts=0,trx=0,ts=6)
<0020> abis_nm.c:1624 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=6) E1=(0,3,2)
<0020> abis_nm.c:1754 Set Chan Attr (bts=0,trx=0,ts=7)
<0020> abis_nm.c:1624 CONNECT TERR TRAF Um=(bts=0,trx=0,ts=7) E1=(0,3,3)
bootstrapping RSL for BTS/TRX (0/0) using MCC=1 MNC=1 BSIC=1 TSC=7
<0020> abis_nm.c:805 OC=SIEMENSHW(a5) INST=(03,00,00) STATE CHG:
<0020> abis_nm.c:805 OC=SIEMENSHW(a5) INST=(03,00,00) Failure Event
Report Severity=indeterminate failure
<0020> abis_nm.c:805 OC=SIEMENSHW(a5) INST=(03,00,00) STATE CHG:
Debug with -dDMI:DRSL:DNM shows strange lines:
...
<1000> input/misdn.c:132 DL_INFORMATION_IND: use channel(0) sapi(63)
tei(127) for now
mISDN message for unknown sign_link
...
<1000> input/misdn.c:132 DL_INFORMATION_IND: use channel(2) sapi(62)
tei(1) for now
mISDN message for unknown sign_link
...
Why TEI=1 or TEI=127 while it should be 25?
Also, dmesg produces:
...
mISDN_send: error -12
...
I've reviewed mailing list for similiar problems description and found
that several people have already seen
these problems, but didn't find the solution.
I thought that these problems may be connected with internal BS11
oscillator calibration, so
I've performed calibration as described in wiki (though I used Nateks
SDH mux with Stratum oscillator
as E1 clock source instead of HFC-S ISDN card, which I don't have).
Calibration was successful, but
it didn't help. Here is query output while running bsc_hack:
...
LMT LOGON: ACK
PHASE: 3 Normal MBCCU0: Load MBCCU1: No Load
Abis-link: Up
BS11 ATTRIBUTES:
BS-11 ESN PCB Serial Number: 001132
BS-11 ESN Hardware Code Number: 135-2044/03.03
BS-11 ESN Firmware Code Number: 135-2044/03.03
E1 Channel: Port=255 Timeslot=161 Subslot=39
PLL Set Value=1024, Work Value=1023
SITE MANAGER ATTRIBUTES:
E1 Channel: Port=0 Timeslot=1 (Full Slot)
TEI: 25
BS11 Line Interface ATTRIBUTES:
PLL Mode: Standalone
BS11 CCLK ATTRIBUTES:
CCLK Accuracy: Medium (0)
BS11 Power Amplifier 0 ATTRIBUTES:
TRX Power: 30mW (GSM)
LMT LOGOFF: ACK
...
It seems that everything should be ok, but... there is no success.
Best regards,
Sergey.
Hey guys,
for some historic reason our tmsi is an character array but all places dealing
with it treat it as a 4 octet, and according to the spec it is a four octet. I
have changed the definition and the code using the tmsi. It can be found in my
onwaves.com branch.
Does it make sense to switch?
z.
both subdevices: b553 and b523 are already part of the driver.
{ PCI_VENDOR_ID_CCD, PCI_DEVICE_ID_CCD_HFCE1, PCI_VENDOR_ID_CCD,
PCI_SUBDEVICE_ID_CCD_IOB1E1, 0, 0, H(24)}, /* IOB1E1 */
{ PCI_VENDOR_ID_CCD, PCI_DEVICE_ID_CCD_HFCE1, PCI_VENDOR_ID_CCD,
PCI_SUBDEVICE_ID_CCD_JHSE1, 0, 0, H(25)}, /* Junghanns E1 */
please check definitions. PCI_SUBDEVICE_ID_CCD_IOB1E1 should be b523 and PCI_SUBDEVICE_ID_CCD_JHSE1 should be b553. (do a grep onto your repository (grep b523 <path>/* -r)
-----Ursprüngliche Nachricht-----
Von: openbsc-bounces(a)lists.gnumonks.org [mailto:openbsc-bounces@lists.gnumonks.org] Im Auftrag von Harald Welte
Gesendet: Mittwoch, 19. August 2009 18:08
An: dexter
Cc: openbsc(a)lists.gnumonks.org
Betreff: Re: Problems with HFC-E1 card (Unknown HFC multiport controller)
On Mon, Aug 17, 2009 at 08:24:50PM +0200, dexter wrote:
> Here is an output from a linux box that works with the other card:
> Unknown HFC multiport controller (vendor:1397 device:30b1
> subvendor:ffffffff subdevice:ffffffff) Please contact the driver
> maintainer for support.
Hi, I think you should report this to the misdn development list.
as a quick workaround, I suggesty you add the pci vendor / device ID to the hfcmulti.c driver (hfcmulti_probe() would be the case).
What particular HFC-E1 card is this?
At least according to my kernel,
PCI_VENDOR_ID_CCD is 0x1397
PCI_DEVICE_ID_CCD_HFCE1 is 0x30b1
so I don't know why you get that message...
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
the controller has no eeprom, so it has no subvendor/subdevice id. try
this: (drivers/isdn/hardware/mISDN/hfcmulti.c)
{ PCI_VENDOR_ID_CCD, PCI_DEVICE_ID_CCD_HFCE1, PCI_ANY_ID,
PCI_ANY_ID,
- 0, 0, 0},
+ 0, 0, H(19)},
the driver should now handle this card. try it.
what vendor is this? maybe they should register at cologne chip for
subvendor IDs.
> [ 796.302786] Unknown HFC multiport controller (vendor:1397
device:30b1
> subvendor:ffffffff subdevice:ffffffff)
> [ 796.302891] Please contact the driver maintainer for support
this must be the case.
-----Ursprüngliche Nachricht-----
The vendor is junghanns.net I got the card directly from them.
You said that the controller has no eeprom. Or do you mean that it has
an eeprom that is not programmed? (FFFFFFFF). If this is the case,
someone at junghanns.net might have forgotten to program the eeprom?
regards.
Philipp
The attached message was received as a bounce, but either the bounce
format was not recognized, or no member addresses could be extracted
from it. This mailing list has been configured to send all
unrecognized bounce messages to the list administrator(s).
For more information see:
https://lists.gnumonks.org/mailman/admin/openbsc/bounce
JFYI:
http://mobile.slashdot.org/story/09/08/17/0014235/Open-Source-GSM-Network-A…
I'll be writing a report on our test network as soon as I find time for it.
This list will obviously be notified once it is finished.
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hello WoMax,
On Mon, 17 Aug 2009 18:10:26 +0200, "WoMax" <womax(a)gmx.ch> wrote:
>
> I got the bs11_config and the bsc_hack compiled,
>
> yes I use cygwin ..
>
>
> but ipaccess-find and the other programs won't compiled.
Cygwin does not seem to support SO_BINDTODEVICE. The line which
uses it was introduced with one the recent updates, as far as I
understand it, you can now optionally specify the network
interface for ipaccess-find (Harald might correct me if I am
wrong).
As long as you only have one network card, you most certainly
don't need this option and so for now just comment the line or
put it inside "#if !defined(__CYGWIN__)" "#endif" and it will
compile with Cygwin and should still work.
Best regards,
Dieter
--
Dieter Spaar, Germany spaar(a)mirider.augusta.de
I got the bs11_config and the bsc_hack compiled,
yes I use cygwin ..
but ipaccess-find and the other programs won't compiled.
Can somebody bring me on the right lane?
Tom@HAL2008 ~
$ cd openbsc/openbsc
Tom@HAL2008 ~/openbsc/openbsc
$ make
make all-recursive
make[1]: Entering directory `/home/Tom/openbsc/openbsc'
Making all in include
make[2]: Entering directory `/home/Tom/openbsc/openbsc/include'
Making all in openbsc
make[3]: Entering directory `/home/Tom/openbsc/openbsc/include/openbsc'
make[3]: Nothing to be done for `all'.
make[3]: Leaving directory `/home/Tom/openbsc/openbsc/include/openbsc'
Making all in vty
make[3]: Entering directory `/home/Tom/openbsc/openbsc/include/vty'
make[3]: Nothing to be done for `all'.
make[3]: Leaving directory `/home/Tom/openbsc/openbsc/include/vty'
make[3]: Entering directory `/home/Tom/openbsc/openbsc/include'
make[3]: Nothing to be done for `all-am'.
make[3]: Leaving directory `/home/Tom/openbsc/openbsc/include'
make[2]: Leaving directory `/home/Tom/openbsc/openbsc/include'
Making all in src
make[2]: Entering directory `/home/Tom/openbsc/openbsc/src'
if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../include -Wall -g -O2 -MT
ipaccess-find.o -MD -MP -MF ".deps/ipaccess-find.Tpo" -c -o ipaccess-find.o
ipaccess-find.c; \
then mv -f ".deps/ipaccess-find.Tpo" ".deps/ipaccess-find.Po"; else
rm -f ".deps/ipaccess-find.Tpo"; exit 1; fi
In file included from ipaccess-find.c:13:
../include/openbsc/ipaccess.h:37: warning: "struct e1inp_line" declared
inside parameter list
../include/openbsc/ipaccess.h:37: warning: its scope is only this definition
or declaration, which is probably not what you want
ipaccess-find.c: In function `udp_sock':
ipaccess-find.c:46: error: `SO_BINDTODEVICE' undeclared (first use in this
function)
ipaccess-find.c:46: error: (Each undeclared identifier is reported only once
ipaccess-find.c:46: error: for each function it appears in.)
make[2]: *** [ipaccess-find.o] Error 1
make[2]: Leaving directory `/home/Tom/openbsc/openbsc/src'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/home/Tom/openbsc/openbsc'
make: *** [all] Error 2
Tom@HAL2008 ~/openbsc/openbsc
$
Hello WoMax,
On Fri, 14 Aug 2009 13:17:01 +0200, "WoMax" <womax(a)gmx.ch> wrote:
> ... here are some (interesting) pics about nanoBTS:
>
> http://www.umts.zerber.us
>
> more to come ...
Great :-). You noticed that there are a few pictures from another
nanoBTS model at the following location ?
http://bs11-abis.gnumonks.org/trac/wiki/nanoBTS_Internals
Best regards,
Dieter
--
Dieter Spaar, Germany spaar(a)mirider.augusta.de
Hello Nordin,
On Fri, 14 Aug 2009 12:54:19 +0200, "Nordin" <bouchtaoui(a)gmail.com> wrote:
>
> Well it should at least know it is dealing with the nanobts, which is
> not the case.
> In function bootstrap_network() of bsc_hack.c the function
> vty_read_config_file() is called, and that's it. So bsc_hack.c does
> nothing with the config file. Furthermore, I can't seem to find where
> the bts->type is filled. So my conclusion is this part is not finished yet.
Sorry, wrong. The type is set, your configuration file is wrong.
If you use "nanobts1800" instead of "nanoBTS", add
"ip.access unit_id 1800 0" (you might have to ajust the numbers)
everything will work (at least the nanoBTS is configured). I
just tried it with the version from the GIT. Why do I have to
try it, instead that you look carefully ?
Best regards,
Dieter
--
Dieter Spaar, Germany spaar(a)mirider.augusta.de
Hello Nordin,
On Fri, 14 Aug 2009 11:42:09 +0200, "Nordin" <bouchtaoui(a)gmail.com> wrote:
>
> I attached the modified config file, but it's not really special about it.
> I think Harald hasn't finished that part, as we know he is a very busy
> man :)
If you look at vty_interface.c, you will notice that there a different
configuration commands for the BS-11 and the nanoBTS. For example there
is "oml ..." for the BS-11 and "ip.access ..." for the nanoBTS. So the
"oml ..." commands in the config file you posted won't work for the
nanoBTS. I have not tried it yet, but thats where I would start
to modify the config file for the nanoBTS.
Best regards,
Dieter
--
Dieter Spaar, Germany spaar(a)mirider.augusta.de
Hello guys,
Today I've pulled the latest sources and have issues of executing
bsc_hack with config file.
It complains about:
GSM900 channel must be between 1-124.
mi_e1_line_update could not open socket Address family not supported by
protocol
But I changed the config file for the nanoBTS1800, is there something
missing?
Hey Guys,
this is just a small note of the current work in the holger/on-waves-msc-sccp
branch.
The goal of this branch is to implement A over IP and hook OpenBSC into a real
GSM network. This work is on the way thanks to on-waves.com.
The current state:
- Partially implemented SCCP. We can send UDT messages, and full connection
handling exists. I have not implemented segmenting for DT1 yet and
will try to avoid doing that.
- Split out vty_interfaces into two parts. One for the MSC
functionality and one for the BSC
- Split out gsm_subscriber into two sets. One for BSC and one for MSC.
- Do not compile gsm_04_08.c but provide the layer2->layer3 ourselves with
moving shared stuff to gsm48_utils.c. This way creating and parsing
of messages can be shared and the policy can remain in the old file.
(this is the biggest change to earlier approaches).
What will be next:
- Use bsc_msc_ip.c to initialize the the tcp connection, do the handshaking,
start sending the reset as seen in the traces.
What can be merged:
- I think I will propose to merge the vty and gsm subscriber changes after
HAR2009 as they have little chance to break stuff.
z.
Hi!
I've got a few nanoBTS, type 139 and 140.
So I need just one, the others are now for sale.
Type 140(1900), you don't disturb the existing providers, for 1300 euro,
working well with all quadband handsets.
Type 139(1800) for 1200 euro.
All equipment is in working order, supplied with PoE-Adapter.
If you buy 2, there is a 10% off.
The Unit's are located in Switzerland and can be picked up here on Lake
Constance
or shipped by german post, so you don't have to pay for expensive shipment
like from US.
BTW I can't reach Harald Welte by email to ask him where is my ordered
BS-11.
Regards,
--
- Thomas Mueller <womax(a)gmx.ch>
Hey,
I compiled with -Wall -Werror and fixed the easy ones. While doing it I
encountered one bug in the bsc_hack.c..
int ipaccess_setup(struct gsm_network *gsmnet) is called with a struct
gsm_bts*... The current ipaccess_setup need to be called once per network (as
we should only bind to the address once...).
any idea what to do?
z.
Hello,
this patch should add support to bs11_config for bport0/1 configuration.
This should enable you to configure a BS11 to run in multidrop mode and
so contol two BS11 from one E1 link.
I only have one BS11 so I was only able to verify that the objects are
indeed created/modified. If it's okay I can also directly push the patch.
Regards,
Daniel Willmann
Daniel Willmann (1):
Add {create,delete}-bport1 and bport0-{star,multidrop} to bs11-config
openbsc/include/openbsc/abis_nm.h | 4 +++-
openbsc/src/abis_nm.c | 31 +++++++++++++++++++++++++++++--
openbsc/src/bs11_config.c | 26 ++++++++++++++++++++++++++
3 files changed, 58 insertions(+), 3 deletions(-)
On Sat, Aug 08, 2009 at 02:03:06PM +0400, Sergey V. Efimov wrote:
> I've compiled mISDN module into kernel and it loads with
> hfcmulti.dslot=1 parameter.
> I think there is no difference between dynamically loadable module
> and statically compiled in.
> Also when I did not provide this parameter, nothing worked at all.
>
> Is there any issues regarding processor architecture? I use AMD64
> platform, though
> the system (Debian) has i386 architecture working in compatibility mode.
I'm using both debian on 32bit and 64bit.
Your problem might be related to the actual cabling. I believe it is
definitely a layer1 (cabling) or layer 2 (mISDN) problem.
I don't really know any other advice but to double-check the cabling, the
jumpers on the E1 board as well as the termination jumpers on the BS-11.
Everything has to be set to 120 Ohms.
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hi!
I've committed the first working version of OpenBSC with vty-based
configuration file to the 'config_file' branch in git.
Using this version, all parameters such as BTS E1 card / timeslot / sub-slot /
TEI for OML and RSL, MNC, MCC, BSIC, TSC as well as the physical channel
configuration of each Um timeslot can be configured in openbsc.cfg.
As an example, I'm attaching a configuration for two bts with two trx each.
You can change the configuration interactively by using the telnet interface
by a sequence of commands like:
================
enable
configure terminal
network
bts 0
trx 0
arfcn 111
write file
================
At this point you still need to restart OpenBSC, as we don't support changing
configuration at runtime yet.
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
On Thu, Aug 06, 2009 at 09:22:17PM +0400, Sergey V. Efimov wrote:
> This is a bs11_config log:
Your BS-11 is lacking its firmware, please refer to
http://bs11-abis.gnumonks.org/trac/wiki/BS11_Configuration
and
http://bs11-abis.gnumonks.org/trac/wiki/bs11_config
Specifically, it seems the SMU Safety load is installed and the minimal
configuration exists, but no actual Software is installed. Thus,
the MBCCU0 and MBCCU1 remains in "No Load", i.e. no firmware running.
Regards,
Harald
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hi!
JFYI: I've bought an Ericsson RBS 2308 a couple of days ago, this is a
BTS with traditional E1 interface, but with GPRS + EDGE support.
I've managed to find the manual online at
http://rapidshare.com/files/178080402/RBS2308.rar
I have not yet received the unit, but there are more availalbe by a seller
based in Texas / USA (USD 750). I can't promise that OpenBSC will have good
support anytime soon, but I'll definitely look into it.
Regards,
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hi!
I've been experimenting for the last couple of hours with two BS-11 in
a multi-drop configuration.
The connection looks like this:
HFC-E1 connects to BTS A Y01/Y02, just like normal.
BTS-A Y03/Y04 connect to BTS-B Y01/Y02.
BTS-A LI object is configured as multi-drop
BTS-B LI object is configured normal (star)
BTA-A is configured to use TEI 25 on TS 1 for OML (normal)
BTS-B is configured to use TEI 26 on TS 10 for OML (differnt)
If I put the MA-10 A-bis signal analyzer between BTS A and BTS, I can see
* that the E1 physical layer is up and there are no alarms
* BTS-B sends TEI requests on timeslot 10, as requested
however, there is no response. Looking at TS 10 between BTS-A and BSC,
I can see that there are no TEI requests or any other data.
GSM 12.21 specifies a "CONNECT MULTI-DROP LINK" message, using which you can
map two E1 timeslots on two interfaces to each other. I've done this (mapping
port 0, TS 10 to port 1, TS 10) - but it seems the BS-11 does not support this
message. The MA-10 also calls it an "unknown message".
I'm Sending this message to object class 0xa5 (SiemensHW) and to the LI object
in that class (object instance 7, 0, 0). The BS-11 does not respond with ACK
and not with NACK. It seems it is simply ignored silently.
Does anyone have an idea how to proceed? Or does anyone have an A-bis trace
from a working multi-drop configuration?
Thanks.
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hello Harald,
On Tue, 4 Aug 2009 10:18:55 +0200, "Harald Welte" <laforge(a)gnumonks.org> wrote:
>
> Status update: I have now hard-coded a MS power limit of 20dBm (100mW) for all
> activated channels. The BS-11 still doesn't use dynamic MS power control
> yet, but that is optional anyway. At least we're sure the MS now get told to
> use no more than 100mW to talk to the BTS.
If you not already modified it, please don't forget to adjust the "Cell
Selection Parameters" in System Information 3 and 4. The GIT version
from a few days ago still sets MS-TXPWR-MAX-CCH to the maximum. This
means that the power of the initial RACH burst is too high although
the channel power gets properly adjusted later.
Best regards,
Dieter
--
Dieter Spaar, Germany spaar(a)mirider.augusta.de
Hi again,
I'm currently in the train, so forgive me posting the initial TODO list
to the mailing list rather than the wiki.
I'll put it in the wiki soon. If you want to take on of the items, just let
me know!
What I think we have to do before HAR is as follows:
== Actual code ==
=== absolutely required ===
* finish and test the SMS implementation [Harald]
* make sure we enable MS power control and impose a global limit of
100mW for the uplink (MS->BSC) direction by means of the MS POWER IE's
and the BCCH information. That sounds like something for Dieter to
figure out, especially since he has measurement equipment ;)
* test dual-BTS-on-single-E1-card config [Harald]
** up to now, we have only tested with two nanoBTS, not BS-11 !
* test dual-TRX operation of BS-11 on OpenBSC [Stefan/Daniel, can you do that?]
** channel allocator can be tweaked to give 2nd TRX a preference for debugging
[I'll add those to trac, since they are really important]
=== optional ===
* implement a 'provisioning mode' to OpenBSC that
** acccepts every new IMSI the first time we see it
** sends a SMS with a auth token to that mobile
** disconnects that mobile immediately
* implement a web site / cgi script
** once user enters correct tuple of ISMI + auth code, we
*** assign him a number (user cannot choose, we assign)
*** set authorized=1 in the sql table
* implement a web site bug tracker for user bug reports
** the should include detailed information about the phone model,
his phone number and the exact timestamp, so we can match it in
the pcap's
* add more introspection code for the VTY interface to explore the run-time
data structures in OpenBSC
* implement different TCH assignment schemes (early / very early / OCASU)
* do we really want a SDCCH/8 or is SDCCH/4 for each BTS sufficient?
* some more testing with two BTS
* in case we call a user who is currently offline/busy, generate SMS
about missed call and store it in the SMS table
* web interface ideas
** SMS gateway where people can send SMS from the web site
*** SMS spam function for us in case we want to inform users about something
** simplistic phone book
* enhance vty interface with administrative functions such as
** ability to close arbitrary channels (i.e. terminate a call)
** ability to kick-ban a user out of the network
*** set authorized=0
*** perform authentication procedure with reject at its end
* make sure we store all the 'this phone was registerd before to MCC/MNC/LAC'
from the LOC UPD REQ data
* make sure we really store the classmark1/2/3 together with IMEI in SQL table
== Things to bring to the event ==
* spectrum analyzer [from CCCB]
* stable OCXO reference to calibrate BS-11 internal clock
** this could be done before the event, but Harald has no precision clock source
* trace mobiles / monitor mode mobiles (if anyone has some)
* some poles to which we can mount the BS-11 ?
== Misc ==
* draft 'usage terms & conditions' to be put on the registration web site
and the HAR2009 wiki, indicating
** all signalling and traffic data will be stored for R&D purpose
** we do not employ authentication and/or encryption
** we do not provide any service guarantee
** this is for evaluation+testing only
** no handover/roaming and/or external calls
** no warranty for any damage to MS, SIM, ...
** IMSI/IMEI information will not be disclosed by us, but people can sniff it
Regards,
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hello Johannes,
On Mon, 03 Aug 2009 22:56:08 +0200, "Johannes Schmitz" <jsemail(a)gmx.de> wrote:
>
> At this point I have got one general question, maybe also towards
> Dieter:
> How can A3/A8 be proprietary by any operator? How does international
> roaming work then if there is no standardized algorithm?
As far as I know for roaming the foreign network receives a RAND-Kc-SRES
Triple from the home network so there is no need to know A3/A8 used by
the other operator.
Best regards,
Dieter
--
Dieter Spaar, Germany spaar(a)mirider.augusta.de
Hi, I'm a long time lurker into this project and I've wondered something for
a bit of time.Knowing that we can use an ip.access nanoBTS to work on
OpenBSC, why not adapt OpenBSC for UMA (unlicensed mobile access)
standards?
I know over here in the US we currently use UMA with T-Mobile over WiFi to
communicate back to the T-Mobile servers and eventually off to the GSM and
regular ol' networks.
http://www.umatechnology.org/specifications/index.htm is the UMA
specification, and to my knowledge T-Mobile US's @Home service uses the
1.0.3 protocol revision.
To me it seems like it'd be trivial to make a derived copy of OpenBSC with
UMA support up and running, but I'd like some other thoughts into this
matter. I'm not a programmer by any means here, so if this is impossible,
well, then so be it.
-DC
Hello Harald,
On Mon, 3 Aug 2009 12:49:40 +0200, "Harald Welte" <laforge(a)gnumonks.org> wrote:
>
> I've been asking Dieter all the time to send patches that we can integrate.
> However, nothing has been coming forward yet. Especially if we look at
> nanoBTS-only and ignore the HFC-E1/BS11 stuff, it should be pretty easy,
> most likely just some different header filee includes here and there.
See my other post, basically only one function is missing. There might
be issues with the "<linux/xxx>" header files included in mISDNif.h (I
am not sure if this affects the current Cygwin version too, if yes, three
dummy empty header files are good enough). The rest can be used "out of
the box" (I had to create a "bootstrap.sh" file here, not sure how it is
done in Linux, in some other projects "bootstrap.sh" seems to be included
which runs the automake tools). Because of this I did not see any reason
to post something (it might be too trivial and till now there was no real
need).
So this is preety much straightforward, at least for anyone with Linux
experience. If you don't have any Linux experience, you have of course
learn everything related to the GNU tools (GCC and so on). Then its most
certainly easier to start with Linux, maybe with a "command-line" only
version running in a Virtual Machine (which will most certainly work
with the nanaoBTS too).
Best regards,
Dieter
--
Dieter Spaar, Germany spaar(a)mirider.augusta.de
Hello Johannes,
On Mon, 3 Aug 2009 11:54:17 +0200, "Johannes Schmitz" <jsemail(a)gmx.de> wrote:
>
> I am thinking for some time now how this could be done. What i have seen so
> far, is that A5 is open to the public so implementing it is no problem. But
> A3/8 is secret so what is you idea of implementing it? Since it is inside
> the SIM I don't see how it could be replaced.
You might have a look here:
http://lists.gnumonks.org/pipermail/openbsc/2009-July/000584.html
Best regards,
Dieter
--
Dieter Spaar, Germany spaar(a)mirider.augusta.de
Hello Nordin,
On Mon, 03 Aug 2009 09:50:18 +0200, "Nordin" <bouchtaoui(a)gmail.com> wrote:
>
> If Dieter has a Windows variant of OpenBSC, it would be great. For me
> now, it's still much easier to debug in windows than in Linux, because
> I'm not yet comfortable with gdb in comman-line.
Just as a clarification: I don't have a Windows variant of OpenBSC, I
just compile it with Cygwin. Beside the installation of the required
libraries (for the database) all what is needed is a minor modification
for a missing function in vty.c (Cygwin does not have it, the following
is taken from a Cygwin related posting). The Cygwin version works fine
with the nanaoBTS.
#if defined(__CYGWIN__)
/* Workaround for Cygwin, which is missing cfmakeraw */
/* Pasted from man page; added in serial.c arbitrarily */
void cfmakeraw(struct termios *termios_p)
{
termios_p->c_iflag &= ~(IGNBRK|BRKINT|PARMRK|ISTRIP|INLCR|IGNCR|ICRNL|IXON);
termios_p->c_oflag &= ~OPOST;
termios_p->c_lflag &= ~(ECHO|ECHONL|ICANON|ISIG|IEXTEN);
termios_p->c_cflag &= ~(CSIZE|PARENB);
termios_p->c_cflag |= CS8;
}
#endif /* defined(__CYGWIN__) */
For the BS-11 I have a private, experimental modification which is not
public, it requires a special Windows driver for the E1 card.
Best regards,
Dieter
--
Dieter Spaar, Germany spaar(a)mirider.augusta.de