State of the HSL Femtocell support

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/OpenBSC@lists.osmocom.org/.

Harald Welte laforge at gnumonks.org
Fri Jan 14 19:54:29 UTC 2011


Hi!

Today I've done the first push of the 'laforge/hsl' branch, an attempt
to support the HSL 2.75G Femtocell from OpenBSC.

It is far from being complete, but you can get the BTS to start up
on the right ARFCN and process location area updates and other signalling
traffic.  Voice support is still being worked on.

To give you a quick overview of what you are dealing with:

== Hardware ==
 * Ti DaVinci TMS320DM6443A (ARM9 CPU + DSP)
 * Xilinx Spartan-3A FPGA (XC3SD1800A)
 * 128 MByte DDR-2 RAM
 * 128 MByte NAND flash
 * Realtek RTL8201 Ethernet MAC
 * Dual 12-bit 65Ms/sec ADC (ADS5232)
 * Dual 14-bit 275Ms/sec DAC (DAC5672)

As you can see, the hardware is _much_ more powerful than you would ever
need for a simple single-ARFCN femtocell.  Using the high-speed DAC/ADC,
the combined power of the FPGA (with DSP slices) and DSP, you can probably
expect that they will at least want to do multi-ARFCN (if not 3G) on the
same hardware at some later point.

== Protocol ==
They use an odd down-sized minimalistic dialect of the ip.access Abis/IP.

=== ACS ===
Prior to connecting to the BSC, the cell downloads its current configuration
via https, using a HTTP POST of its serial number.

=== IPA layer ===
The IPA multiplex layer does not have PING/PONG keepalives, and it does
not do the ID_GET/ID_RESP/ID_CONF identification with the Unit ID.
Furthermore, both OML and RSL are encapsulated in the same TCP connection.

Stream identifier 0xDD is used for passing string debug messages from the
BTS to the BSC.

Neither OML nor RSL are implemented fully, as per 12.21 / 08.58

=== RSL ===
It seems to have a very 'creative' interpretation of the RSL specification.  Some examples:
 * use of SACCH INFO MODIFY instead of SACCH FILLING for default SI5/SI6
 * it forgets to send RSL CHAN REL ACK on TS1...7
 * it does not implement RSL CHAN MODIFY
 * it seems to be unable to run without DTX
 * it often detects RACH requests where there are none (!)

=== OML ===

OML is almost not present at all.  Only software download and setting of
ARFCN + BSIC are supported.  No managed objects, no state transitions, no
software activation procedures/events at all.

The configuration of each timeslot seems to happen 'on demand', i.e.
there are no OML commands to configure the timeslots, but it depends on your
RSL CHAN ACT whether a timeslot will become a TCH/H or TCH/F.  

I have not managed to use a SDCCH/8 anywhere, just TCH/F and TCH/H as well as
SDCCH/4.

The BCCH _claims_ to be a Combination 4, but in reality it is a Combination 5
(i.e. including the SDCCH/4)

=== GPRS ===

GPRS is quiite odd, too.  The BSSGP is encapsulated in the RSL L3_INFO_IE,
this means we will have to run a NS link from the BSC to the SGSN, combining
all the BSSGP links from HSL Femtocells to the BSC.

-- 
- Harald Welte <laforge at gnumonks.org>           http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
                                                  (ETSI EN 300 175-7 Ch. A6)




More information about the OpenBSC mailing list