Ericsson RBS2308 support / Status on LAPD

historical

Hi all,

Some people have been working together in order to finally start with
support of the Ericsson RBS2308 (and similar models) in OpenBSC.

The biggest issue so far is bringing up the actualy LAPD on the E1/T1 link.
It seems Ericsson is using some dynamic timeslot configuration between BSC
and BTS, so unlike e.g. Siemens, you cannot explicitly configure the OML E1
timeslot on the BTS using local configuration tools.

The current working assumption is: Somehow the BSC produces bit-patterns on the
E1 link and uses them to let the BTS know where to start LAPD for OML.

One contributor was friendly enough to do raw bit-traces of a Racal 6113
connected to the Ericsson RBS, and they look like this:

Racal to BTS 

Initialization

openbsc:/etc/dahdi# cat /dev/dahdi/1 | hexdump
0000000 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa
*
00092e0 aaaa aaaa aaaa aaaa aaaa aaaa aaaa 55aa
00092f0 ffff ffff ffff ffff ffff ffff ffff ffff
*
0009600 ffff ffff ffff ffff ffff ffff ffff 7e7e
0009610 7e7e 7e7e 7e7e 7e7e 7e7e 7e7e 7e7e 7e7e
*
00096b0 7e7e 7e7e 7e7e 7e7e 7e7e 7e7e 7e7e 5f7e
00096c0 3e5f 49ce cfef cfcf cfcf cfcf cfcf cfcf
00096d0 cfcf cfcf cfcf cfcf cfcf cfcf cfcf cfcf
*

I've written a small C program to do soft-hdlc decode.

* a pattern of alternating bits (0xaa)
* a pattern of all-1 bits(0xff)
* a sequence of FLAG symbols (01111110)
* a HDLC message FA 7D 7F 4E F2, which is a TEI=62/SAPI=62 SABME
  (SAPI 62 / TEI62 is configured for OML on the BTS)

The interesting part is:

1) this is a SABME from BSC to BTS, whereas GSM 08.56
   specifically says the BTS is the TE and the BSC the NT
2) we have not seen any TEI manager related messages(L2ML)

Keep alives afterwards, about every 8 seconds

001d5e0 cfcf cfcf cfcf ebcb 04e4 a805 f323 f3f3
001d5f0 f3f3 f3f3 f3f3 f3f3 f3f3 f3f3 f3f3 f3f3
*
0031630 f3f3 f2f3 f9fa 0101 086a fcfc fcfc fcfc
0031640 fcfc fcfc fcfc fcfc fcfc fcfc fcfc fcfc
*
0045680 fcfc fcfc fcfc fcfc fcfc fcfc bebe 4040
0045690 825a 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f
00456a0 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f
*
00596e0 3f3f 2f3f 90af 1610 8fa0 cfcf cfcf cfcf
00596f0 cfcf cfcf cfcf cfcf cfcf cfcf cfcf cfcf
*
006d730 cfcf cfcf cfcf cfcf cbcf e4eb 0504 23a8
006d740 f3f3 f3f3 f3f3 f3f3 f3f3 f3f3 f3f3 f3f3
*
0081790 faf2 01f9 6a01 fc08 fcfc fcfc fcfc fcfc
00817a0 fcfc fcfc fcfc fcfc fcfc fcfc fcfc fcfc
*
00957e0 fcfc fcfc fcfc befc 40be 5a40 3f82 3f3f
00957f0 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f

If you decode this, you get

FA 7D 01 01 AD 20 (LAPD RR)
FA 7D 01 01 21 AC (LAPD RR)
FA 7D 01 01 AD 20 (LAPD RR)
FA 7D 01 01 AD 20 (LAPD RR)
FA 7D 01 01 AD 20 (LAPD RR)
FA 7D 01 01 AD 20 (LAPD RR)
FA 7D 01 01 AD 20 (LAPD RR)

If we look at the BTS to Racal 6113 side:

Initialization

openbsc:/etc/dahdi# cat /dev/dahdi/1 | hexdump
0000000 e7e7 e7e7 e7e7 e7e7 e7e7 e7e7 e7e7 e7e7
*
000fe00 e7e7 e7e7 e7e7 e7e7 e7e7 e7e7 e5e7 f3f5
000fe10 1039 f971 f9f9 f9f9 f9f9 f9f9 f9f9 f9f9
000fe20 f9f9 f9f9 f9f9 f9f9 f9f9 f9f9 f9f9 f9f9
*

Keep Alives, every 8 seconds

0023e40 f9f9 f9f9 f9f9 f9f9 f9f9 7c7d 8080 04b5
0023e50 7e7e 7e7e 7e7e 7e7e 7e7e 7e7e 7e7e 7e7e
*
0037ea0 5f5f 2020 412d 9f1f 9f9f 9f9f 9f9f 9f9f
0037eb0 9f9f 9f9f 9f9f 9f9f 9f9f 9f9f 9f9f 9f9f
*
004bef0 9f9f 9f9f 9f9f 9f9f 979f c8d7 0b08 4750
004bf00 e7e7 e7e7 e7e7 e7e7 e7e7 e7e7 e7e7 e7e7
*
005ff40 e7e7 e7e7 e7e7 e7e7 e7e7 e7e7 e7e7 f5e5
005ff50 02f2 d402 f911 f9f9 f9f9 f9f9 f9f9 f9f9
005ff60 f9f9 f9f9 f9f9 f9f9 f9f9 f9f9 f9f9 f9f9
*
0073fa0 f9f9 f9f9 f9f9 7c7d 8080 04b5 7e7e 7e7e
0073fb0 7e7e 7e7e 7e7e 7e7e 7e7e 7e7e 7e7e 7e7e
*
0087ff0 7e7e 7e7e 7e7e 7e7e 7e7e 7e7e 5f7e 205f
0088000 2d20 1f41 9f9f 9f9f 9f9f 9f9f 9f9f 9f9f
0088010 9f9f 9f9f 9f9f 9f9f 9f9f 9f9f 9f9f 9f9f
*
009c050 9f9f 9f9f 979f c8d7 0b08 4750 e7e7 e7e7
009c060 e7e7 e7e7 e7e7 e7e7 e7e7 e7e7 e7e7 e7e7
*

Decoded, we get:

FA 7D 73 60 3A (LAPD UA)
FA 7D 01 01 AD 20 (LAPD RR)
FA 7D 25 25 AD 20 (LAPD unknown??)
FA 7D 01 01 AD 20 (LAPD RR)
FA 7D 01 01 AD 20 (LAPD RR)
FA 7D 01 01 AD 20 (LAPD RR)
FA 7D 01 01 AD 20 (LAPD RR)
FA 7D 01 01 AD 20 (LAPD RR)

So as a summary, it seems that 

1) the BSC applies some magic pattern (0xaa / 0xff)
2) the BSC establishes the LAPD session for OML TEI/SAPI
3) there is no L2ML, contrary to lots of Ericsson Abis documentation
   that you can find online.

We'll continue our attempts and see if we can get the OML up...

-- 
- Harald Welte <laforge at gnumonks.org>           http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
                                                  (ETSI EN 300 175-7 Ch. A6)