HSL Femto » History » Version 8
laforge, 02/19/2016 10:48 PM
add note about behavior of vendor
1 | 8 | laforge | {{>toc}} |
---|---|---|---|
2 | 1 | laforge | |
3 | 8 | laforge | h1. The HSL 2.75G Femtocell |
4 | |||
5 | |||
6 | 1 | laforge | The HSL 2.75G Femtocell is a relatively recent product implementing a single-ARFCN BTS with 23dBm maximum output power. |
7 | 5 | laforge | |
8 | 8 | laforge | *NOTE: All information on this website is gathered on our own, without any cooperation of the manufacturer. There is no guarantee of correctness. There is no relationship between HSL and the [[OpenBSC]] project developers! |
9 | 1 | laforge | |
10 | 8 | laforge | *Due to hostile reaction from HSL, there is currently no interest in maintaining support for this BTS model |
11 | 1 | laforge | |
12 | |||
13 | 8 | laforge | h2. Hardware |
14 | |||
15 | |||
16 | 1 | laforge | The hardware seems to be a much more software radio approach than the nanoBTS, which are |
17 | built from telephone baseband processors. |
||
18 | |||
19 | 8 | laforge | * Ti [[DaVinci]] TMS320DM6443A (ARM9 CPU + DSP) |
20 | * Xilinx Spartan-3A FPGA (XC3SD1800A) |
||
21 | * 128 MByte DDR-2 RAM |
||
22 | * 128 MByte NAND flash |
||
23 | * Realtek RTL8201 Ethernet MAC |
||
24 | * Dual 12-bit 65Ms/sec ADC (ADS5232) |
||
25 | * Dual 14-bit 275Ms/sec DAC (DAC5672) |
||
26 | 1 | laforge | |
27 | As you can see, the hardware is _much_ more powerful than you would ever |
||
28 | need for a simple single-ARFCN femtocell. Using the high-speed DAC/ADC, |
||
29 | the combined power of the FPGA (with DSP slices) and DSP, you can probably |
||
30 | expect that they will at least want to do multi-ARFCN (if not 3G) on the |
||
31 | same hardware at some later point. |
||
32 | |||
33 | 8 | laforge | There's a dedicated [[HSL_FemtoHardware]] page with more details. |
34 | 1 | laforge | |
35 | |||
36 | 8 | laforge | h3. Serial Port |
37 | |||
38 | |||
39 | 1 | laforge | There's a real RS232 port (+/-12V levels) on JP1. Only Rxd, Txd and GND are present. |
40 | |||
41 | 8 | laforge | In order to enable the [[DaVinci]] UART boot mode, you need to place 1kOhm (0603 sized) resistors on the unpopulated |
42 | 6 | laforge | footprints of R28 and R29. You will get "BOOTME BOOTME BOOTME ..." on the UART at 115200, from whihc point on |
43 | 1 | laforge | you can use the DVFlasher tool of TI. |
44 | |||
45 | 8 | laforge | |
46 | h2. Protocol |
||
47 | |||
48 | 1 | laforge | They use an odd down-sized minimalistic dialect of the ip.access Abis/IP. |
49 | |||
50 | 8 | laforge | |
51 | h3. ACS |
||
52 | |||
53 | 1 | laforge | Prior to connecting to the BSC, the cell downloads its current configuration |
54 | via https, using a HTTP POST of its serial number. |
||
55 | |||
56 | 8 | laforge | |
57 | h3. IPA layer |
||
58 | |||
59 | 1 | laforge | The IPA multiplex layer does not have PING/PONG keepalives, and it does |
60 | not do the ID_GET/ID_RESP/ID_CONF identification with the Unit ID. |
||
61 | Furthermore, both OML and RSL are encapsulated in the same TCP connection. |
||
62 | |||
63 | Stream identifier 0xDD is used for passing string debug messages from the |
||
64 | BTS to the BSC. |
||
65 | |||
66 | Neither OML nor RSL are implemented fully, as per 12.21 / 08.58 |
||
67 | |||
68 | 8 | laforge | |
69 | h3. RSL |
||
70 | |||
71 | 1 | laforge | It seems to have a very 'creative' interpretation of the RSL specification. Some |
72 | examples: |
||
73 | 8 | laforge | * use of SACCH INFO MODIFY instead of SACCH FILLING for default SI5/SI6 |
74 | * it forgets to send RSL CHAN REL ACK on TS1...7 |
||
75 | * it does not implement RSL CHAN MODIFY |
||
76 | * it seems to be unable to run without DTX |
||
77 | * it often detects RACH requests where there are none (!) |
||
78 | 1 | laforge | |
79 | 8 | laforge | |
80 | h3. OML |
||
81 | |||
82 | 1 | laforge | OML is almost not present at all. Only software download and setting of |
83 | ARFCN + BSIC are supported. No managed objects, no state transitions, no |
||
84 | software activation procedures/events at all. |
||
85 | |||
86 | The configuration of each timeslot seems to happen 'on demand', i.e. |
||
87 | there are no OML commands to configure the timeslots, but it depends on your |
||
88 | RSL CHAN ACT whether a timeslot will become a TCH/H or TCH/F. |
||
89 | |||
90 | I have not managed to use a SDCCH/8 anywhere, just TCH/F and TCH/H as well as |
||
91 | SDCCH/4. |
||
92 | |||
93 | The BCCH _claims_ to be a Combination 4, but in reality it is a Combination 5 |
||
94 | (i.e. including the SDCCH/4) |
||
95 | |||
96 | 8 | laforge | |
97 | h3. RTP |
||
98 | |||
99 | 1 | laforge | There is a proprietary RSL message used to connect the BTS to the TRAU. |
100 | 4 | laforge | |
101 | Codec data is exchanged by RTP packets exchanged between BTS UDP port 1000 and the |
||
102 | TRAU IP and UDP port. |
||
103 | |||
104 | 8 | laforge | The [[CellID]] is used as SSRC of all RTP packets, enabling the TRAU to distinguish frames |
105 | 4 | laforge | from different cells |
106 | |||
107 | If multiple TCH are active, the RTP payload contains the codec frames from all active TCH |
||
108 | channels. The format is like a sequence of elements formatted like this: |
||
109 | 8 | laforge | * byte 1: RSL Channel number (e.g. 0x09 = TCH/F on TS 1) |
110 | * byte 2: length of codec frame (e.g. 0x22 hex for EFR) |
||
111 | * byte 3..length: Codec Data |
||
112 | 4 | laforge | |
113 | 8 | laforge | |
114 | h3. GPRS |
||
115 | |||
116 | 1 | laforge | GPRS is quiite odd, too. The BSSGP is encapsulated in the RSL L3_INFO_IE, |
117 | this means we will have to run a NS link from the BSC to the SGSN, combining |
||
118 | all the BSSGP links from HSL Femtocells to the BSC. |
||
119 | 2 | laforge | |
120 | |||
121 | 8 | laforge | h2. Software support |
122 | 2 | laforge | |
123 | 8 | laforge | |
124 | |||
125 | h3. wireshark |
||
126 | |||
127 | |||
128 | 3 | laforge | We have some wireshark patches for adding HSL RSL/OML support: |
129 | 8 | laforge | * http://cgit.osmocom.org/cgit/openbsc/plain/wireshark/0005-rsl-hsl.patch |
130 | * http://cgit.osmocom.org/cgit/openbsc/plain/wireshark/0006-abis_oml-hsl.patch |
||
131 | 2 | laforge | |
132 | 1 | laforge | |
133 | 8 | laforge | h3. [[OpenBSC]] |
134 | |||
135 | |||
136 | <pre> |
||
137 | * http://cgit.osmocom.org/cgit/openbsc/log/?h=laforge/hsl |