Hello,
second try to add support to bs11_config for bport0/1 configuration. This
time with enum abis_bs11_line_cfg.
It seems sometimes creating bport1 fails, even LMT shows create obj
greyed out. Don't know why yet.
Regards,
Daniel Willmann
Daniel Willmann (1):
Add {create,delete}-bport1 and bport0-{star,multidrop} to bs11-config
openbsc/include/openbsc/abis_nm.h | 10 +++++++++-
openbsc/src/abis_nm.c | 31 +++++++++++++++++++++++++++++--
openbsc/src/bs11_config.c | 26 ++++++++++++++++++++++++++
3 files changed, 64 insertions(+), 3 deletions(-)
Hi,
I've noticed a problem when delivering several SMS to a mobile back-to-back.
The first one is ok, the second one is received by the MS but OpenBSC fails
with "RX RP-ACK but no sms in transaction?!?" when receiving the "RX SMS
RP-ACK (MO)"
(full log below)
From the symptoms and looking at the code, I would say that the transaction
of the first SMS delivery was not freed, therefore, when we receive the
RP-ACK of the second SMS, we do a trans_find_by_id in gsm0411_rcv_sms, and
we actually find the transaction of the _first_ deliver (which has its .sms
field cleared since it was released already).
I think you wouldn't notice if you waited between SMS because SMC Timer
TC1* would expire, calling trans_free().
The problem is that I don't really know _where_ trans_free should be
called. There are commented out call to it at several places ...
I would think the RP-ACK(MO) reception looks like a good place. But OTOH,
this whole process can queue data, giving away a reference to lchan
(without get) and trans_free does a put on lchan (so I guess that could
invalidate the lchan ref that was queued ? didn't check that in details)
Sylvain
--- SNIP ---
<0100> gsm_04_11.c:920 send_sms_lchan()
<0002> transaction.c:69 subscr=0x1fe52d0, subscr->net=0x1f8fc30
<0002> gsm_subscriber_base.c:131 subscr 46332 usage increases usage to: 4
<0002> gsm_04_11.c:937 lchan (bts=0,trx=0,ts=0,ch=0) increases usage to: 1
<0100> gsm_04_11.c:972 TX: SMS DELIVER
<0100> gsm_04_11.c:188 TX: CP-DATA trans=4
<0100> gsm_04_11.c:149 GSM4.11 TX 49 01 1e 01 2a 07 91 44 77 58 10 06 50 00
12 00 05 b9 72 65 f7 00 00 90 80 72 12 03 41 00 02 44 3a
<0001> abis_rsl.c:1215 channel=(bts=0,trx=0,ts=0) chan_nr=0x20 sapi=3 DATA
INDICATION
<0100> gsm_04_11.c:817 trans_id=c RX SMS CP-ACK
<0001> abis_rsl.c:1215 channel=(bts=0,trx=0,ts=0) chan_nr=0x20 sapi=3 DATA
INDICATION
<0100> gsm_04_11.c:817 trans_id=c RX SMS CP-DATA
<0100> gsm_04_11.c:191 TX: CP-ACK trans=4
<0100> gsm_04_11.c:149 GSM4.11 TX 49 04
<0100> gsm_04_11.c:750 RX SMS RP-ACK (MO)
<0002> gsm_subscriber_base.c:139 subscr 27567 usage decreased usage to: 0
<0002> gsm_subscriber_base.c:139 subscr 46332 usage decreased usage to: 3
DB: Found Subscriber: ID 2, IMSI 206205003327508, NAME '', TMSI 1666608304,
EXTEN '27567', LAC 1, AUTH 1
DBI: -7: The requested variable type does not match what libdbi thinks it
should be
<0002> gsm_subscriber_base.c:131 subscr 46332 usage increases usage to: 4
<0100> gsm_04_11.c:920 send_sms_lchan()
<0002> transaction.c:69 subscr=0x1fe52d0, subscr->net=0x1f8fc30
<0002> gsm_subscriber_base.c:131 subscr 46332 usage increases usage to: 5
<0002> gsm_04_11.c:937 lchan (bts=0,trx=0,ts=0,ch=0) increases usage to: 2
<0100> gsm_04_11.c:972 TX: SMS DELIVER
<0100> gsm_04_11.c:188 TX: CP-DATA trans=4
<0100> gsm_04_11.c:149 GSM4.11 TX 49 01 1f 01 2a 07 91 44 77 58 10 06 50 00
13 00 05 b9 72 65 f7 00 00 90 80 72 12 03 41 00 03 47 39 19
<0001> abis_rsl.c:1215 channel=(bts=0,trx=0,ts=0) chan_nr=0x20 sapi=3 DATA
INDICATION
<0100> gsm_04_11.c:817 trans_id=c RX SMS CP-ACK
<0001> abis_rsl.c:1215 channel=(bts=0,trx=0,ts=0) chan_nr=0x20 sapi=3 DATA
INDICATION
<0100> gsm_04_11.c:817 trans_id=c RX SMS CP-DATA
<0100> gsm_04_11.c:191 TX: CP-ACK trans=4
<0100> gsm_04_11.c:149 GSM4.11 TX 49 04
<0100> gsm_04_11.c:750 RX SMS RP-ACK (MO)
<0100> gsm_04_11.c:640 RX RP-ACK but no sms in transaction?!?
<0100> gsm_04_11.c:561 TX: SMS RP ERROR, cause 111 (Protocol Error)
<0100> gsm_04_11.c:188 TX: CP-DATA trans=4
<0100> gsm_04_11.c:149 GSM4.11 TX 49 01 04 05 2a 01 6f
<0001> abis_rsl.c:1215 channel=(bts=0,trx=0,ts=0) chan_nr=0x20 sapi=3 DATA
INDICATION
<0100> gsm_04_11.c:817 trans_id=c RX SMS CP-ACK
<0100> gsm_04_11.c:159 SMC Timer TC1* is expired, calling trans_free()
<0002> transaction.c:101 lchan (bts=0,trx=0,ts=0,ch=0) decreases usage to: 1
<0002> gsm_subscriber_base.c:139 subscr 46332 usage decreased usage to: 4
--- /SNIP ---
Hello Sergey,
On Mon, 31 Aug 2009 15:11:26 +0400, "Sergey V. Efimoff" <risky(a)mail.ru> wrote:
>
> What type of E1 adapter do you use? If you use an accurate clock source,
> Work and Set values should be similiar (I have Set Value 1024, Work value 1023,
> and I've used Nateks E1 SDH Mux with High-Stability Stratum oscillator when
> calibrating). See http://bs11-abis.gnumonks.org/trac/wiki/isdnsync
The observed difference of "Work Value 1104" and "Set Value 1082" should
be no problem. From my measurements a difference of about 100 of those
values means about 0.1 ppm. And 0.1 ppm is good enough that most phones
should see the BS-11 and the offical networks.
I guess there is some other problem, I would also check if bs11_config
shows that the TRX is loaded. And maybe start with a configuration file
which uses only one TRX.
Best regards,
Dieter
--
Dieter Spaar, Germany spaar(a)mirider.augusta.de
Hi,
we have some troubles finding the network on our cell-phones. There are
a lot of suspicious messages, we can't really make sense out of.
Example: bs11_config_query shows the following line:
BS11 Attributes" a line: E1 Channel: Port=255 Timeslot=161 Subslot=39
This looks completely broken (misparsed by bs11_config?)
Another issue are the Set- and Work-values of the Phase-Locked-Loop:
We synchronized it with the ISDN network (isdnsync) and it leveled off to
1104 for the Work-Value, Set-Value, however, is 1082. I suspect this is
ok and set-value is some informational value only (perhaps the value
of the last calibration?).
One more question about the radio carrier: On startup of bsc_hack we get
the following message:
OC=RADIO CARRIER(02) INST=(00,01,ff) STATE CHG: OP_STATE=Disabled AVAIL=In test(00)
Is this normal behaviour?
Apart from all this questions, does anyone have some more hints what we
should look at? We tried different cell phones, tried switching them off
and on, but without any success.
We're using the latest git version of openbsc.
Thank you for your help!
Martin
Hello Again,
So as my previous post mentioned, I recently acquired an Ericsson RBS 2401.
In looking through the configuration, it only allows for a T1 connection,
not an E1. The first issue I see with this is I haven't been able to find a
mISDN supported T1 card. I assume all of the BS-11 are E1, so I suppose T1
support has never come up. Not a coder myself, I'm not going to be a lot of
help in that department. But I can get a T1 card and hook this RBS up to a
Linux box and do any debugging that might help move things along. I'm open
to any suggestions. I know Harald was looking into getting traces for
Ericsson BSC <-> BTS traffic, so hopefully that will help as well.
Thanks again,
Caleb
Hello all,
I'm new to the list, and new to GSM testing, although I've worked with a
fair share of RF, Linux, and networks. I recently acquired an Ericsson RBS
2401 for testing. This is a 2 TRX BTS with a T1 interface. It works on the
GSM 1900 band, and puts out 300mw at full power. There will be another post
about getting started with that...
Onto the main purpose of this post..I have a contact who has 5 Ericsson RBS
2308's, which are the same as the unit Harald recently purchased. They are
probably a bit bigger than the BS-11, have 4 TRX, output about 2.5 watts,
have a T1 interface, and support EDGE. They are banded for GSM 1900. They
can be bought for a reasonable price, plus shipping from California.
Obviously OpenBSC doesn't support these at the moment, but hopefully support
will be added sometime in the future. These would be a great resource for
anyone in the US wanting to do testing, or overseas testers, if you're
willing to pay shipping. If you want more info on the unit itself, you can
download the manual Harald posted to the list earlier this month. If anyone
is interested, please contact me off list, and I will get you in contact
with the seller.
Thanks
Caleb
Hi all!
By mistake I deleted the password file for the wiki/trac earlier today, so
all of you will need new accounts
I used this opportunity to enable new account registration, i.e. everyone
can now create an account for themselves - you don't need to go through me
to do that anymore.
So sorry for the inconvenience to existing users, you will have to create
a new account using the 'register' tab on http://openbsc.gnumonks.org/
Regards,
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hi,
I had the exact same problem has described here
http://lists.gnumonks.org/pipermail/openbsc/2009-July/000627.html
That is, the first call worked great but after the first call, no way
to make a second, the BTS would respond with NACK to the CHANnel
ACTIvation requests.
I finally found that the chan_rate field of the channel_mode must be 0
for that request to work. And forcing it to 0 in
rsl_chan_activate_lchan, like this :
--- SNIP ---
rc = channel_mode_from_lchan(&cm, lchan);
if (rc < 0)
return rc;
cm.chan_rate = 0; // Hack !
-----------
makes the thing work.
But that's obviously not the root cause. I thing the lchan tch_mode
should be GSM48_CMODE_SIGN, so that channel_mode_from_lchan would set
the proper value directly.
But I haven't traced yet why tch_mode is not at the good value for the
second call ...
Sylvain
Hi,
I just got hold of a ip.access nanoBTS model 139U, but so far my
attemps at making it work with OpenBSC have been unsuccessful :(
It's a 'used' one so there are config already done most likely and I
don't know which.
What differs from http://bs11-abis.gnumonks.org/trac/wiki/nanoBTS :
* It doesn't request an IP by DHCP
It seems to have IP/Netmask and GW hardcoded.
* When plugging it, it tries to do an ARP request for what I guess
his the GW address, and when it get a response, it tries to connect to
TCP port 3022 (yes, it's 3022 and not 3002) of yet another IP in
another subnet (which I guess is the configured Primarly OML IP)
* ipaccess-find does find it :
----
ipaccess-find (C) 2009 by Harald Welte
This is FREE SOFTWARE with ABSOLUTELY NO WARRANTY
Trying to find ip.access BTS by broadcast UDP...
MAC Address='00:02:95:00:31:22' IP Address='10.105.254.142' Unit
ID='65143/0/0' Location 1='NanoBTS FXMarketspace' Location
2='BTS_NBT131G' Equipment Version='139_029_41' Software
Version='120a352_v267b22d0' Unit Name='69419' Serial
Number='00071582'
----
* ipaccess-config fails, the nanoBTS refuses incoming connections on
port tcp 3006
* Here's the result of a NMAP :
----
sh$ sudo nmap -sS 10.105.254.142 -p 1-65535
Starting Nmap 4.76 ( http://nmap.org ) at 2009-08-26 16:21 CEST
Interesting ports on 10.105.254.142:
Not shown: 65533 closed ports
PORT STATE SERVICE
3026/tcp open unknown
3034/tcp open unknown
MAC Address: 00:02:95:00:31:22 (IP.Access Limited)
----
* I then tried to run ipaccess-config to port 3026 but it fails (just
waits a while thensays short read / BTS disappeared)
* I tried making openbsc listen on 3022 but with no real results :
---
sh$ bsc_hack
DB: Database initialized.
DB: Database prepared.
no matching signalling link for hh->proto=0x01
no matching signalling link for hh->proto=0x29
no matching signalling link for hh->proto=0x2b
no matching signalling link for hh->proto=0x1b
short read!
no matching signalling link for hh->proto=0x01
short read!
BTS disappeared, dead socket
short read!
no matching signalling link for hh->proto=0x01
no matching signalling link for hh->proto=0x29
no matching signalling link for hh->proto=0x2b
no matching signalling link for hh->proto=0xc9
short read!
no matching signalling link for hh->proto=0x01
short read!
BTS disappeared, dead socket
---
Any idea any one ?
Sylvain