OpenBSC

openbsc@lists.osmocom.org

14 participants
4246 discussions

SMS status
by Sylvain Munaut 25 Dec '09

25 Dec '09

Hi, Here's a little report on the SMS status: First, the good news is that in practice everything works fine with the handsets I tested. There are a few issues left to address but they don't seem to cause any operational troubles so far : * In MO transfers, the channel should be closed after the reception of CP-ACK, _unless_ a CM SERVICE REQUEST was sent just before on the channel. Currently the channel is just not closed AFAICT and it times out some time afterwards. * Double RF Channel Release : Here's the log of the end of a typical SMS transfer (MO in this case but MT has a similar problem) : <0000> abis_rsl.c:1408 (bts=0,trx=0,ts=1) SAPI=3 DATA INDICATION <0007> gsm_04_11.c:918 trans_id=c RX SMS CP-ACK [ pause ] <0000> abis_rsl.c:1408 (bts=0,trx=0,ts=1) SAPI=0 RELEASE INDICATION <0004> abis_rsl.c:742 (bts=0,trx=0,ts=1) RF Channel Release CMD <0004> abis_rsl.c:1138 (bts=0,trx=0,ts=1) RF CHANNEL RELEASE ACK <0000> abis_rsl.c:1408 (bts=0,trx=0,ts=1) SAPI=3 RELEASE INDICATION <0004> abis_rsl.c:742 (bts=0,trx=0,ts=1) RF Channel Release CMD <0004> abis_rsl.c:1138 (bts=0,trx=0,ts=1) RF CHANNEL RELEASE ACK As you see, when we receive a RELEASE INDICATION in abis_rsl_rx_rll, we call rsl_rf_chan_release directly. But we'll receive RELEASE INDICATION for both SAPI 0 & 3 and so we'll call it twice which is bad. I tried releasing channel _only_ if all SAPI are unused but the resulting effect was not what I expected : <0000> abis_rsl.c:1418 (bts=0,trx=0,ts=1) SAPI=3 DATA INDICATION <0007> gsm_04_11.c:927 trans_id=b RX SMS CP-ACK [ pause ] <0000> abis_rsl.c:1418 (bts=0,trx=0,ts=1) SAPI=0 RELEASE INDICATION [ pause ] <0004> abis_rsl.c:1137 (bts=0,trx=0,ts=1) <0004> abis_rsl.c:967 CONNECTION FAIL: RELEASINGCAUSE=0x01(Radio Link Failure) <0004> abis_rsl.c:975 <0004> abis_rsl.c:742 (bts=0,trx=0,ts=1) RF Channel Release CMD <0004> abis_rsl.c:1148 (bts=0,trx=0,ts=1) RF CHANNEL RELEASE ACK <0013> gsm_subscriber_base.c:subscr 35414 usage decreased usage to: 0 <0000> abis_rsl.c:1418 (bts=0,trx=0,ts=1) SAPI=3 RELEASE INDICATION <0004> abis_rsl.c:742 (bts=0,trx=0,ts=1) RF Channel Release CMD <0004> abis_rsl.c:1148 (bts=0,trx=0,ts=1) RF CHANNEL RELEASE ACK I need to read the spec and see what happens on a commercial network to understand better what should be done because I'm obviously missing something ... Sylvain

2 1

About the ipaccess-proxy
by Harald Welte 24 Dec '09

24 Dec '09

Hi all, I've committed a new program called ipaccess-proxy to openbsc git. It is - like the name implies - a proxy for the ip.access A-bis over IP protocol. Why would you want to do that? 1) to keep the BCCH live while you restart OpenBSC. This keeps the phones nice and happy on the network while you test/deploy new code 2) to inject packets into the A-bis stream, e.g. from a packet generation tool like scapy. ipaccess-proxy creates udp ports to do this. More documentation after the 26C3. -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

christmas present
by WoMax 24 Dec '09

24 Dec '09

As a christmas present a friend of mine showed me some nanoBTS documents, I can't make copies but I remember some details I will post here ... LED status codes: red/steady: sw error, power-on fails orange/slow flash: ethernet disconnected red/fast blink: dongle attached, factory reset done red-green/fast flash: unit not configured orange/fast flash: code loading in progress orange/slow blink: TRX is waiting for OML orange/steady: self test in progress green/fast flash: OML established, NWL test running green-orange/slow blink: calibrating in progress green/slow flash: no radio carrier transmitted green/steady: operational state TIB pinout: Output-connector - pin 1-spare/fpga 2-spare/fpga 3-26mhz - 4-26mhz + 5-sync out + 6-sync out - 7-ppc serial out 8-ppc serial in 9-fpga serial out 10-gnd Input-connector - pin 1-10mhz in - 2-10mhz in + 3-26mhz in - 4-26mhz in + 5-sync in + 6-sync in - 7-frame sync 8-nc 9-reset 10-gnd A merry christmas, WoMax

1 0

Encryption support, please test :)
by Sylvain Munaut 24 Dec '09

24 Dec '09

Hi everyone, I've just pushed a branch sylvain/encryption on the OpenBSC git that contains my current patches to support encryption. Even if you don't have programmable SIMs, test it still works :) If a subscriber doesn't have a Ki set in the HLR or encryption isn't enabled in the config, the executed code path should be the exact same as before. It uses COMP128 as a3/a8 so you can use common programmable SIMs. Currently a secure channel is established for - LOCATION UPDATEs - CM SERVICE REQUEST. Support for PAGING RESPONSE is a little trickier and I haven't looked deeply into it. To enable : - Either recreate your HLR sqlite3, or update it like this (do a backup before hand !) : bash# sqlite3 hlr.sqlite3 sqlite> ALTER TABLE Subscriber ADD COLUMN ki BLOB; sqlite> UPDATE Meta SET value = '3' WHERE key='revision'; - Add a "a5 encryption 1" line to your openbsc.cfg to enable encryption using A5/1 - Set the Ki of the subscriber. Using the vty interface is the simplest : bash# telnet 127.0.0.1 4242 openbsc> enable openbsc# conf t openbsc# subscriber YOURIMSI openbsc# ki 0123456789abcdef0123456789abcdef Sylvain

1 0

ciphering on nanoBTS
by WoMax 23 Dec '09

23 Dec '09

Beware! Ciphering on nanoBTS is depending on the installed software. If you have a model 139/140 and the software is 120a... the A5/1 and A5/2 encryption is available; 120b... is A5/2 only and 120c... there is no encryption available. When you have a model 108/110 the software should start with 119 and with model 165 it starts with 168.

2 1

RRLP / ephemeris data
by Harald Welte 23 Dec '09

23 Dec '09

Dear Daniel and Jan, you have been working very closely with and on the u-blox GPS receiver during your work on the Openmoko GTA02. As far as I know, it is possible to obtain the ephemeris data from a u-blox receiver. I would like to see some code that obtains and converts that ephemeris data into the format described by the RRLP protocol specification. I know this involves asn.1 PER ugliness, but this can all be done well outside the OpenBSC codebase. What I'll propose is to simply use some pattern matching to determine the RRLP request for assistance data, and if such a request exists, open some file in the filesystem and send the contents binary as-is to the phone in response. Any responses from the phone are already stored in the database anyway. In case any of you are interested in working on something to generate the required ephemeris data and have time before or even at the 26C3, you can simply give me the resulting binary file, I can drop it into the OpenBSC directory and we'll see what happens. If this doesn't happen right now, it doesn't matter all that much, as the 26C3 is an indoor event and I don't think we'll be getting that many GPS fixes in such an environment anyway. But eventually, for the next outdoor test, and to do some more RRLP security research, the ephemeris data formatter would be really great! Cheers, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

2 6

UMTS
by WoMax 22 Dec '09

22 Dec '09

If there is a solution for UMTS (W-CDMA) coming, we don't need the expensive nanoBTS anymore. BTW I've still one for sale ... see at http://umts.zerber.us There are cheap W-CDMA BTS's out there, like Netgear DVG834GH, AT&T 3G Microcell, Alcatel-Lucent 9365 or the Vodafone Access Gateway you can buy in England for just 160 GBP each. All the femtocell's I know have built in GPS for timebase and security reason, so there is a lot to do for our purpose ... I guess the future is W-CDMA and I hope there will be openUMTS available soon ;-) Regards from Switzerland

2 1

new debug / logging architecture
by Harald Welte 22 Dec '09

22 Dec '09

Hi Holger, I'm happy with the new architecture. During testing I made a couple of bug fixes, which I applied to the new 'new-debug-arch' branch in the root directory of the git branch namespace. (i.e. not prefixed with holger/). It would be great if you could finish this work so we can benefit of it before the congress. I'll probably merge some initial parts already now (at least the new macro definitions) to start using log levels in the actual code - even if it doesn't get used yet. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

2 1

[PATCH] bts: Allow config of RACH control parameters tx-integer & max retrans
by Sylvain Munaut 22 Dec '09

22 Dec '09

From: Sylvain Munaut <tnt(a)246tNt.com> Tweaking theses can be useful especially tx-integer that influence both the spread of rach attemps and the delay between two attemps. Looking up GSM 04.08 3.3.1.1.2 & 10.5.2.29 can help determine good values. The default are choosed with a wide spacing between attemps (tx integer = 9 -> T=12 & S=217 (non-combined CCCH/SDCCH) or 115 (for combined CCCH/SDCCH)). This alleviates the problem of responding to several RACH attempts by a same MS, allocating several RF channels when only 1 is needed. Signed-off-by: Sylvain Munaut <tnt(a)246tNt.com> --- openbsc/include/openbsc/gsm_utils.h | 7 +++++++ openbsc/src/bsc_init.c | 5 ----- openbsc/src/gsm_data.c | 4 ++++ openbsc/src/vty_interface.c | 32 ++++++++++++++++++++++++++++++++ 4 files changed, 43 insertions(+), 5 deletions(-) diff --git a/openbsc/include/openbsc/gsm_utils.h b/openbsc/include/openbsc/gsm_utils.h index 5809221..56a4120 100644 --- a/openbsc/include/openbsc/gsm_utils.h +++ b/openbsc/include/openbsc/gsm_utils.h @@ -37,5 +37,12 @@ int ms_pwr_dbm(enum gsm_band band, u_int8_t lvl); int rxlev2dbm(u_int8_t rxlev); u_int8_t dbm2rxlev(int dbm); +/* According to GSM 04.08 Chapter 10.5.2.29 */ +static inline int rach_max_trans_val2raw(int val) { return (val >> 1) & 3; } +static inline int rach_max_trans_raw2val(int raw) { + const int tbl[4] = { 1, 2, 4, 7 }; + return tbl[raw & 3]; +} + void generate_backtrace(); #endif diff --git a/openbsc/src/bsc_init.c b/openbsc/src/bsc_init.c index 547aaa9..c6d891c 100644 --- a/openbsc/src/bsc_init.c +++ b/openbsc/src/bsc_init.c @@ -825,11 +825,6 @@ static int bootstrap_bts(struct gsm_bts *bts) /* T3212 is set from vty/config */ /* some defaults for our system information */ - bts->si_common.rach_control.re = 1; /* no re-establishment */ - bts->si_common.rach_control.tx_integer = 5; /* 8 slots spread */ - bts->si_common.rach_control.max_trans = 3; /* 7 retransmissions */ - bts->si_common.rach_control.t2 = 4; /* no emergency calls */ - bts->si_common.cell_options.radio_link_timeout = 2; /* 12 */ bts->si_common.cell_options.dtx = 2; /* MS shall not use upplink DTX */ bts->si_common.cell_options.pwrc = 0; /* PWRC not set */ diff --git a/openbsc/src/gsm_data.c b/openbsc/src/gsm_data.c index 12f439b..d6ebd92 100644 --- a/openbsc/src/gsm_data.c +++ b/openbsc/src/gsm_data.c @@ -175,6 +175,10 @@ struct gsm_bts *gsm_bts_alloc(struct gsm_network *net, enum gsm_bts_type type, bts->si_common.cell_alloc.data = bts->si_common.data.cell_alloc; bts->si_common.cell_alloc.data_len = sizeof(bts->si_common.data.cell_alloc); + bts->si_common.rach_control.re = 1; /* no re-establishment */ + bts->si_common.rach_control.tx_integer = 9; /* 12 slots spread - 217/115 slots delay */ + bts->si_common.rach_control.max_trans = 3; /* 7 retransmissions */ + bts->si_common.rach_control.t2 = 4; /* no emergency calls */ for (i = 0; i < ARRAY_SIZE(bts->gprs.nsvc); i++) { bts->gprs.nsvc[i].bts = bts; diff --git a/openbsc/src/vty_interface.c b/openbsc/src/vty_interface.c index b13dc5f..5e42e6b 100644 --- a/openbsc/src/vty_interface.c +++ b/openbsc/src/vty_interface.c @@ -140,6 +140,11 @@ static void bts_dump_vty(struct vty *vty, struct gsm_bts *bts) VTY_NEWLINE); vty_out(vty, "Cell Reselection Hysteresis: %u dBm%s", bts->si_common.cell_sel_par.cell_resel_hyst*2, VTY_NEWLINE); + vty_out(vty, "RACH TX-Integer: %u%s", bts->si_common.rach_control.tx_integer, + VTY_NEWLINE); + vty_out(vty, "RACH Max transmissions: %u%s", + rach_max_trans_raw2val(bts->si_common.rach_control.max_trans), + VTY_NEWLINE); if (bts->si_common.rach_control.cell_bar) vty_out(vty, " CELL IS BARRED%s", VTY_NEWLINE); if (is_ipaccess_bts(bts)) @@ -258,6 +263,11 @@ static void config_write_bts_single(struct vty *vty, struct gsm_bts *bts) vty_out(vty, " channel allocator %s%s", bts->chan_alloc_reverse ? "descending" : "ascending", VTY_NEWLINE); + vty_out(vty, " rach tx integer %u%s", + bts->si_common.rach_control.tx_integer, VTY_NEWLINE); + vty_out(vty, " rach max transmission %u%s", + rach_max_trans_raw2val(bts->si_common.rach_control.max_trans), + VTY_NEWLINE); if (bts->si_common.rach_control.cell_bar) vty_out(vty, " cell barred 1%s", VTY_NEWLINE); if (is_ipaccess_bts(bts)) { @@ -1196,6 +1206,26 @@ DEFUN(cfg_bts_challoc, cfg_bts_challoc_cmd, return CMD_SUCCESS; } +DEFUN(cfg_bts_rach_tx_integer, + cfg_bts_rach_tx_integer_cmd, + "rach tx integer <0-15>", + "Set the raw tx integer value in RACH Control parameters IE") +{ + struct gsm_bts *bts = vty->index; + bts->si_common.rach_control.tx_integer = atoi(argv[0]) & 0xf; + return CMD_SUCCESS; +} + +DEFUN(cfg_bts_rach_max_trans, + cfg_bts_rach_max_trans_cmd, + "rach max transmission (1|2|4|7)", + "Set the maximum number of RACH burst transmissions") +{ + struct gsm_bts *bts = vty->index; + bts->si_common.rach_control.max_trans = rach_max_trans_val2raw(atoi(argv[0])); + return CMD_SUCCESS; +} + DEFUN(cfg_bts_cell_barred, cfg_bts_cell_barred_cmd, "cell barred (0|1)", "Should this cell be barred from access?") @@ -1482,6 +1512,8 @@ int bsc_vty_init(struct gsm_network *net) install_element(BTS_NODE, &cfg_bts_oml_e1_cmd); install_element(BTS_NODE, &cfg_bts_oml_e1_tei_cmd); install_element(BTS_NODE, &cfg_bts_challoc_cmd); + install_element(BTS_NODE, &cfg_bts_rach_tx_integer_cmd); + install_element(BTS_NODE, &cfg_bts_rach_max_trans_cmd); install_element(BTS_NODE, &cfg_bts_cell_barred_cmd); install_element(BTS_NODE, &cfg_bts_ms_max_power_cmd); install_element(BTS_NODE, &cfg_bts_per_loc_upd_cmd); -- 1.6.5.1

2 1

[PATCH] Possible BS11 fixes..
by Holger Freyther 22 Dec '09

22 Dec '09

Hi Harlad, does this make sense to you? openbsc/src/abis_nm.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/openbsc/src/abis_nm.c b/openbsc/src/abis_nm.c index bb7248b..dce1c35 100644 --- a/openbsc/src/abis_nm.c +++ b/openbsc/src/abis_nm.c @@ -653,13 +653,13 @@ objclass2nmstate(struct gsm_bts *bts, u_int8_t obj_class, nm_state = &bts->bs11.cclk.nm_state; break; case BS11_OBJ_BBSIG: - if (obj_inst->ts_nr > bts->num_trx) + if (obj_inst->trx_nr >= bts->num_trx) return NULL; trx = gsm_bts_trx_num(bts, obj_inst->trx_nr); nm_state = &trx->bs11.bbsig.nm_state; break; case BS11_OBJ_PA: - if (obj_inst->ts_nr > bts->num_trx) + if (obj_inst->trx_nr >= bts->num_trx) return NULL; trx = gsm_bts_trx_num(bts, obj_inst->trx_nr); nm_state = &trx->bs11.pa.nm_state; -- 1.6.3.3

2 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

OpenBSC