- OpenBSC - lists.osmocom.org

ciphering on nanoBTS
by WoMax 23 Dec '09

23 Dec '09

Beware! Ciphering on nanoBTS is depending on the installed software. If you have a model 139/140 and the software is 120a... the A5/1 and A5/2 encryption is available; 120b... is A5/2 only and 120c... there is no encryption available. When you have a model 108/110 the software should start with 119 and with model 165 it starts with 168.

2 1

RRLP / ephemeris data
by Harald Welte 23 Dec '09

23 Dec '09

Dear Daniel and Jan, you have been working very closely with and on the u-blox GPS receiver during your work on the Openmoko GTA02. As far as I know, it is possible to obtain the ephemeris data from a u-blox receiver. I would like to see some code that obtains and converts that ephemeris data into the format described by the RRLP protocol specification. I know this involves asn.1 PER ugliness, but this can all be done well outside the OpenBSC codebase. What I'll propose is to simply use some pattern matching to determine the RRLP request for assistance data, and if such a request exists, open some file in the filesystem and send the contents binary as-is to the phone in response. Any responses from the phone are already stored in the database anyway. In case any of you are interested in working on something to generate the required ephemeris data and have time before or even at the 26C3, you can simply give me the resulting binary file, I can drop it into the OpenBSC directory and we'll see what happens. If this doesn't happen right now, it doesn't matter all that much, as the 26C3 is an indoor event and I don't think we'll be getting that many GPS fixes in such an environment anyway. But eventually, for the next outdoor test, and to do some more RRLP security research, the ephemeris data formatter would be really great! Cheers, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

2 6

UMTS
by WoMax 22 Dec '09

22 Dec '09

If there is a solution for UMTS (W-CDMA) coming, we don't need the expensive nanoBTS anymore. BTW I've still one for sale ... see at http://umts.zerber.us There are cheap W-CDMA BTS's out there, like Netgear DVG834GH, AT&T 3G Microcell, Alcatel-Lucent 9365 or the Vodafone Access Gateway you can buy in England for just 160 GBP each. All the femtocell's I know have built in GPS for timebase and security reason, so there is a lot to do for our purpose ... I guess the future is W-CDMA and I hope there will be openUMTS available soon ;-) Regards from Switzerland

2 1

new debug / logging architecture
by Harald Welte 22 Dec '09

22 Dec '09

Hi Holger, I'm happy with the new architecture. During testing I made a couple of bug fixes, which I applied to the new 'new-debug-arch' branch in the root directory of the git branch namespace. (i.e. not prefixed with holger/). It would be great if you could finish this work so we can benefit of it before the congress. I'll probably merge some initial parts already now (at least the new macro definitions) to start using log levels in the actual code - even if it doesn't get used yet. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

2 1

[PATCH] bts: Allow config of RACH control parameters tx-integer & max retrans
by Sylvain Munaut 22 Dec '09

22 Dec '09

From: Sylvain Munaut <tnt(a)246tNt.com> Tweaking theses can be useful especially tx-integer that influence both the spread of rach attemps and the delay between two attemps. Looking up GSM 04.08 3.3.1.1.2 & 10.5.2.29 can help determine good values. The default are choosed with a wide spacing between attemps (tx integer = 9 -> T=12 & S=217 (non-combined CCCH/SDCCH) or 115 (for combined CCCH/SDCCH)). This alleviates the problem of responding to several RACH attempts by a same MS, allocating several RF channels when only 1 is needed. Signed-off-by: Sylvain Munaut <tnt(a)246tNt.com> --- openbsc/include/openbsc/gsm_utils.h | 7 +++++++ openbsc/src/bsc_init.c | 5 ----- openbsc/src/gsm_data.c | 4 ++++ openbsc/src/vty_interface.c | 32 ++++++++++++++++++++++++++++++++ 4 files changed, 43 insertions(+), 5 deletions(-) diff --git a/openbsc/include/openbsc/gsm_utils.h b/openbsc/include/openbsc/gsm_utils.h index 5809221..56a4120 100644 --- a/openbsc/include/openbsc/gsm_utils.h +++ b/openbsc/include/openbsc/gsm_utils.h @@ -37,5 +37,12 @@ int ms_pwr_dbm(enum gsm_band band, u_int8_t lvl); int rxlev2dbm(u_int8_t rxlev); u_int8_t dbm2rxlev(int dbm); +/* According to GSM 04.08 Chapter 10.5.2.29 */ +static inline int rach_max_trans_val2raw(int val) { return (val >> 1) & 3; } +static inline int rach_max_trans_raw2val(int raw) { + const int tbl[4] = { 1, 2, 4, 7 }; + return tbl[raw & 3]; +} + void generate_backtrace(); #endif diff --git a/openbsc/src/bsc_init.c b/openbsc/src/bsc_init.c index 547aaa9..c6d891c 100644 --- a/openbsc/src/bsc_init.c +++ b/openbsc/src/bsc_init.c @@ -825,11 +825,6 @@ static int bootstrap_bts(struct gsm_bts *bts) /* T3212 is set from vty/config */ /* some defaults for our system information */ - bts->si_common.rach_control.re = 1; /* no re-establishment */ - bts->si_common.rach_control.tx_integer = 5; /* 8 slots spread */ - bts->si_common.rach_control.max_trans = 3; /* 7 retransmissions */ - bts->si_common.rach_control.t2 = 4; /* no emergency calls */ - bts->si_common.cell_options.radio_link_timeout = 2; /* 12 */ bts->si_common.cell_options.dtx = 2; /* MS shall not use upplink DTX */ bts->si_common.cell_options.pwrc = 0; /* PWRC not set */ diff --git a/openbsc/src/gsm_data.c b/openbsc/src/gsm_data.c index 12f439b..d6ebd92 100644 --- a/openbsc/src/gsm_data.c +++ b/openbsc/src/gsm_data.c @@ -175,6 +175,10 @@ struct gsm_bts *gsm_bts_alloc(struct gsm_network *net, enum gsm_bts_type type, bts->si_common.cell_alloc.data = bts->si_common.data.cell_alloc; bts->si_common.cell_alloc.data_len = sizeof(bts->si_common.data.cell_alloc); + bts->si_common.rach_control.re = 1; /* no re-establishment */ + bts->si_common.rach_control.tx_integer = 9; /* 12 slots spread - 217/115 slots delay */ + bts->si_common.rach_control.max_trans = 3; /* 7 retransmissions */ + bts->si_common.rach_control.t2 = 4; /* no emergency calls */ for (i = 0; i < ARRAY_SIZE(bts->gprs.nsvc); i++) { bts->gprs.nsvc[i].bts = bts; diff --git a/openbsc/src/vty_interface.c b/openbsc/src/vty_interface.c index b13dc5f..5e42e6b 100644 --- a/openbsc/src/vty_interface.c +++ b/openbsc/src/vty_interface.c @@ -140,6 +140,11 @@ static void bts_dump_vty(struct vty *vty, struct gsm_bts *bts) VTY_NEWLINE); vty_out(vty, "Cell Reselection Hysteresis: %u dBm%s", bts->si_common.cell_sel_par.cell_resel_hyst*2, VTY_NEWLINE); + vty_out(vty, "RACH TX-Integer: %u%s", bts->si_common.rach_control.tx_integer, + VTY_NEWLINE); + vty_out(vty, "RACH Max transmissions: %u%s", + rach_max_trans_raw2val(bts->si_common.rach_control.max_trans), + VTY_NEWLINE); if (bts->si_common.rach_control.cell_bar) vty_out(vty, " CELL IS BARRED%s", VTY_NEWLINE); if (is_ipaccess_bts(bts)) @@ -258,6 +263,11 @@ static void config_write_bts_single(struct vty *vty, struct gsm_bts *bts) vty_out(vty, " channel allocator %s%s", bts->chan_alloc_reverse ? "descending" : "ascending", VTY_NEWLINE); + vty_out(vty, " rach tx integer %u%s", + bts->si_common.rach_control.tx_integer, VTY_NEWLINE); + vty_out(vty, " rach max transmission %u%s", + rach_max_trans_raw2val(bts->si_common.rach_control.max_trans), + VTY_NEWLINE); if (bts->si_common.rach_control.cell_bar) vty_out(vty, " cell barred 1%s", VTY_NEWLINE); if (is_ipaccess_bts(bts)) { @@ -1196,6 +1206,26 @@ DEFUN(cfg_bts_challoc, cfg_bts_challoc_cmd, return CMD_SUCCESS; } +DEFUN(cfg_bts_rach_tx_integer, + cfg_bts_rach_tx_integer_cmd, + "rach tx integer <0-15>", + "Set the raw tx integer value in RACH Control parameters IE") +{ + struct gsm_bts *bts = vty->index; + bts->si_common.rach_control.tx_integer = atoi(argv[0]) & 0xf; + return CMD_SUCCESS; +} + +DEFUN(cfg_bts_rach_max_trans, + cfg_bts_rach_max_trans_cmd, + "rach max transmission (1|2|4|7)", + "Set the maximum number of RACH burst transmissions") +{ + struct gsm_bts *bts = vty->index; + bts->si_common.rach_control.max_trans = rach_max_trans_val2raw(atoi(argv[0])); + return CMD_SUCCESS; +} + DEFUN(cfg_bts_cell_barred, cfg_bts_cell_barred_cmd, "cell barred (0|1)", "Should this cell be barred from access?") @@ -1482,6 +1512,8 @@ int bsc_vty_init(struct gsm_network *net) install_element(BTS_NODE, &cfg_bts_oml_e1_cmd); install_element(BTS_NODE, &cfg_bts_oml_e1_tei_cmd); install_element(BTS_NODE, &cfg_bts_challoc_cmd); + install_element(BTS_NODE, &cfg_bts_rach_tx_integer_cmd); + install_element(BTS_NODE, &cfg_bts_rach_max_trans_cmd); install_element(BTS_NODE, &cfg_bts_cell_barred_cmd); install_element(BTS_NODE, &cfg_bts_ms_max_power_cmd); install_element(BTS_NODE, &cfg_bts_per_loc_upd_cmd); -- 1.6.5.1

2 1

[PATCH] Possible BS11 fixes..
by Holger Freyther 22 Dec '09

22 Dec '09

Hi Harlad, does this make sense to you? openbsc/src/abis_nm.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/openbsc/src/abis_nm.c b/openbsc/src/abis_nm.c index bb7248b..dce1c35 100644 --- a/openbsc/src/abis_nm.c +++ b/openbsc/src/abis_nm.c @@ -653,13 +653,13 @@ objclass2nmstate(struct gsm_bts *bts, u_int8_t obj_class, nm_state = &bts->bs11.cclk.nm_state; break; case BS11_OBJ_BBSIG: - if (obj_inst->ts_nr > bts->num_trx) + if (obj_inst->trx_nr >= bts->num_trx) return NULL; trx = gsm_bts_trx_num(bts, obj_inst->trx_nr); nm_state = &trx->bs11.bbsig.nm_state; break; case BS11_OBJ_PA: - if (obj_inst->ts_nr > bts->num_trx) + if (obj_inst->trx_nr >= bts->num_trx) return NULL; trx = gsm_bts_trx_num(bts, obj_inst->trx_nr); nm_state = &trx->bs11.pa.nm_state; -- 1.6.3.3

2 2

Disabling RF for a TRX / Tracking abis NM state
by Harald Welte 21 Dec '09

21 Dec '09

Hi Holger! I'm currently reviewing changeset 2d501ea26a219176b1c556449e45ebd90d4accfb and just noticed that you introduce a new 'int rf_locked' member to struct gsm_bts_trx, which I believe is not needed. We are already tracking the administrative state of all objects in the BTS and mirror their state. The specific state you are looking for should be in gsm_bts_trx.nm_state.administrative I would appreciate if you could fix this. -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

2 5

fix on trau frame check
by Andreas.Eversberg 21 Dec '09

21 Dec '09

minor fix for master branch. (self explaining) LCR works with the main branch also.

2 1

[PATCH 1/3] chan_alloc: Delete T3101 on lchan_free as well
by Sylvain Munaut 21 Dec '09

21 Dec '09

From: Sylvain Munaut <tnt(a)246tNt.com> If a RF channel is assigned but no response is ever heard from the phone, we will receive a CONNECTION FAIL from the BTS, triggering a RF release freeing the channel. Then sometime later, T3101 will expire as well and free the channel again ... Signed-off-by: Sylvain Munaut <tnt(a)246tNt.com> --- openbsc/src/chan_alloc.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/openbsc/src/chan_alloc.c b/openbsc/src/chan_alloc.c index 786e8b1..a23192a 100644 --- a/openbsc/src/chan_alloc.c +++ b/openbsc/src/chan_alloc.c @@ -251,6 +251,7 @@ void lchan_free(struct gsm_lchan *lchan) /* stop the timer */ bsc_del_timer(&lchan->release_timer); + bsc_del_timer(&lchan->T3101); /* clear cached measuement reports */ lchan->meas_rep_idx = 0; -- 1.6.5.1

2 5

[PATCH 1/2] [signal] Differentiate paging success from expiration in SS_PAGING
by Sylvain Munaut 21 Dec '09

21 Dec '09

From: Sylvain Munaut <tnt(a)246tNt.com> This is useful information to know and actually fixes a segfault in rllp.c where lchan is accessed even tough it could be NULL in case of failure. Signed-off-by: Sylvain Munaut <tnt(a)246tNt.com> --- openbsc/include/openbsc/signal.h | 3 ++- openbsc/src/gsm_04_08_utils.c | 2 +- openbsc/src/paging.c | 2 +- openbsc/src/rrlp.c | 4 +++- 4 files changed, 7 insertions(+), 4 deletions(-) diff --git a/openbsc/include/openbsc/signal.h b/openbsc/include/openbsc/signal.h index 8c815f8..3680d56 100644 --- a/openbsc/include/openbsc/signal.h +++ b/openbsc/include/openbsc/signal.h @@ -45,7 +45,8 @@ enum signal_subsystems { /* SS_PAGING signals */ enum signal_paging { - S_PAGING_COMPLETED, + S_PAGING_SUCCEEDED, + S_PAGING_EXPIRED, }; /* SS_SMS signals */ diff --git a/openbsc/src/gsm_04_08_utils.c b/openbsc/src/gsm_04_08_utils.c index e96a1ca..2183743 100644 --- a/openbsc/src/gsm_04_08_utils.c +++ b/openbsc/src/gsm_04_08_utils.c @@ -488,7 +488,7 @@ int gsm48_handle_paging_resp(struct msgb *msg, struct gsm_subscriber *subscr) sig_data.bts = msg->lchan->ts->trx->bts; sig_data.lchan = msg->lchan; - dispatch_signal(SS_PAGING, S_PAGING_COMPLETED, &sig_data); + dispatch_signal(SS_PAGING, S_PAGING_SUCCEEDED, &sig_data); /* Stop paging on the bts we received the paging response */ paging_request_stop(msg->trx->bts, subscr, msg->lchan); diff --git a/openbsc/src/paging.c b/openbsc/src/paging.c index b273419..6cd4d05 100644 --- a/openbsc/src/paging.c +++ b/openbsc/src/paging.c @@ -212,7 +212,7 @@ static void paging_T3113_expired(void *data) cbfn = req->cbfn; paging_remove_request(&req->bts->paging, req); - dispatch_signal(SS_PAGING, S_PAGING_COMPLETED, &sig_data); + dispatch_signal(SS_PAGING, S_PAGING_EXPIRED, &sig_data); if (cbfn) cbfn(GSM_HOOK_RR_PAGING, GSM_PAGING_EXPIRED, NULL, NULL, cbfn_param); diff --git a/openbsc/src/rrlp.c b/openbsc/src/rrlp.c index 60ce750..3504451 100644 --- a/openbsc/src/rrlp.c +++ b/openbsc/src/rrlp.c @@ -89,10 +89,12 @@ static int paging_sig_cb(unsigned int subsys, unsigned int signal, struct paging_signal_data *psig_data = signal_data; switch (signal) { - case S_PAGING_COMPLETED: + case S_PAGING_SUCCEEDED: /* A subscriber has attached. */ send_rrlp_req(psig_data->lchan); break; + case S_PAGING_EXPIRED: + break; } return 0; } -- 1.6.5.1

2 2