HSL Femto » History » Version 9
laforge, 02/20/2016 09:00 PM
1 | 8 | laforge | {{>toc}} |
---|---|---|---|
2 | 1 | laforge | |
3 | 8 | laforge | h1. The HSL 2.75G Femtocell |
4 | |||
5 | 1 | laforge | The HSL 2.75G Femtocell is a relatively recent product implementing a single-ARFCN BTS with 23dBm maximum output power. |
6 | 5 | laforge | |
7 | 8 | laforge | *NOTE: All information on this website is gathered on our own, without any cooperation of the manufacturer. There is no guarantee of correctness. There is no relationship between HSL and the [[OpenBSC]] project developers! |
8 | 1 | laforge | |
9 | 9 | laforge | *Due to hostile reaction from HSL, there is currently no interest in maintaining support for this BTS model* |
10 | 1 | laforge | |
11 | 9 | laforge | |
12 | {{child_pages}} |
||
13 | 1 | laforge | |
14 | 8 | laforge | h2. Hardware |
15 | |||
16 | |||
17 | 1 | laforge | The hardware seems to be a much more software radio approach than the nanoBTS, which are |
18 | built from telephone baseband processors. |
||
19 | |||
20 | 8 | laforge | * Ti [[DaVinci]] TMS320DM6443A (ARM9 CPU + DSP) |
21 | * Xilinx Spartan-3A FPGA (XC3SD1800A) |
||
22 | * 128 MByte DDR-2 RAM |
||
23 | * 128 MByte NAND flash |
||
24 | * Realtek RTL8201 Ethernet MAC |
||
25 | * Dual 12-bit 65Ms/sec ADC (ADS5232) |
||
26 | * Dual 14-bit 275Ms/sec DAC (DAC5672) |
||
27 | 1 | laforge | |
28 | As you can see, the hardware is _much_ more powerful than you would ever |
||
29 | need for a simple single-ARFCN femtocell. Using the high-speed DAC/ADC, |
||
30 | the combined power of the FPGA (with DSP slices) and DSP, you can probably |
||
31 | expect that they will at least want to do multi-ARFCN (if not 3G) on the |
||
32 | same hardware at some later point. |
||
33 | |||
34 | 8 | laforge | There's a dedicated [[HSL_FemtoHardware]] page with more details. |
35 | 1 | laforge | |
36 | |||
37 | 8 | laforge | h3. Serial Port |
38 | |||
39 | |||
40 | 1 | laforge | There's a real RS232 port (+/-12V levels) on JP1. Only Rxd, Txd and GND are present. |
41 | |||
42 | 8 | laforge | In order to enable the [[DaVinci]] UART boot mode, you need to place 1kOhm (0603 sized) resistors on the unpopulated |
43 | 6 | laforge | footprints of R28 and R29. You will get "BOOTME BOOTME BOOTME ..." on the UART at 115200, from whihc point on |
44 | 1 | laforge | you can use the DVFlasher tool of TI. |
45 | |||
46 | 8 | laforge | |
47 | h2. Protocol |
||
48 | |||
49 | 1 | laforge | They use an odd down-sized minimalistic dialect of the ip.access Abis/IP. |
50 | |||
51 | 8 | laforge | |
52 | h3. ACS |
||
53 | |||
54 | 1 | laforge | Prior to connecting to the BSC, the cell downloads its current configuration |
55 | via https, using a HTTP POST of its serial number. |
||
56 | |||
57 | 8 | laforge | |
58 | h3. IPA layer |
||
59 | |||
60 | 1 | laforge | The IPA multiplex layer does not have PING/PONG keepalives, and it does |
61 | not do the ID_GET/ID_RESP/ID_CONF identification with the Unit ID. |
||
62 | Furthermore, both OML and RSL are encapsulated in the same TCP connection. |
||
63 | |||
64 | Stream identifier 0xDD is used for passing string debug messages from the |
||
65 | BTS to the BSC. |
||
66 | |||
67 | Neither OML nor RSL are implemented fully, as per 12.21 / 08.58 |
||
68 | |||
69 | 8 | laforge | |
70 | h3. RSL |
||
71 | |||
72 | 1 | laforge | It seems to have a very 'creative' interpretation of the RSL specification. Some |
73 | examples: |
||
74 | 8 | laforge | * use of SACCH INFO MODIFY instead of SACCH FILLING for default SI5/SI6 |
75 | * it forgets to send RSL CHAN REL ACK on TS1...7 |
||
76 | * it does not implement RSL CHAN MODIFY |
||
77 | * it seems to be unable to run without DTX |
||
78 | * it often detects RACH requests where there are none (!) |
||
79 | 1 | laforge | |
80 | 8 | laforge | |
81 | h3. OML |
||
82 | |||
83 | 1 | laforge | OML is almost not present at all. Only software download and setting of |
84 | ARFCN + BSIC are supported. No managed objects, no state transitions, no |
||
85 | software activation procedures/events at all. |
||
86 | |||
87 | The configuration of each timeslot seems to happen 'on demand', i.e. |
||
88 | there are no OML commands to configure the timeslots, but it depends on your |
||
89 | RSL CHAN ACT whether a timeslot will become a TCH/H or TCH/F. |
||
90 | |||
91 | I have not managed to use a SDCCH/8 anywhere, just TCH/F and TCH/H as well as |
||
92 | SDCCH/4. |
||
93 | |||
94 | The BCCH _claims_ to be a Combination 4, but in reality it is a Combination 5 |
||
95 | (i.e. including the SDCCH/4) |
||
96 | |||
97 | 8 | laforge | |
98 | h3. RTP |
||
99 | |||
100 | 1 | laforge | There is a proprietary RSL message used to connect the BTS to the TRAU. |
101 | 4 | laforge | |
102 | Codec data is exchanged by RTP packets exchanged between BTS UDP port 1000 and the |
||
103 | TRAU IP and UDP port. |
||
104 | |||
105 | 8 | laforge | The [[CellID]] is used as SSRC of all RTP packets, enabling the TRAU to distinguish frames |
106 | 4 | laforge | from different cells |
107 | |||
108 | If multiple TCH are active, the RTP payload contains the codec frames from all active TCH |
||
109 | channels. The format is like a sequence of elements formatted like this: |
||
110 | 8 | laforge | * byte 1: RSL Channel number (e.g. 0x09 = TCH/F on TS 1) |
111 | * byte 2: length of codec frame (e.g. 0x22 hex for EFR) |
||
112 | * byte 3..length: Codec Data |
||
113 | 4 | laforge | |
114 | 8 | laforge | |
115 | h3. GPRS |
||
116 | |||
117 | 1 | laforge | GPRS is quiite odd, too. The BSSGP is encapsulated in the RSL L3_INFO_IE, |
118 | this means we will have to run a NS link from the BSC to the SGSN, combining |
||
119 | all the BSSGP links from HSL Femtocells to the BSC. |
||
120 | 2 | laforge | |
121 | |||
122 | 8 | laforge | h2. Software support |
123 | 2 | laforge | |
124 | 8 | laforge | |
125 | |||
126 | h3. wireshark |
||
127 | |||
128 | |||
129 | 3 | laforge | We have some wireshark patches for adding HSL RSL/OML support: |
130 | 8 | laforge | * http://cgit.osmocom.org/cgit/openbsc/plain/wireshark/0005-rsl-hsl.patch |
131 | * http://cgit.osmocom.org/cgit/openbsc/plain/wireshark/0006-abis_oml-hsl.patch |
||
132 | 2 | laforge | |
133 | 1 | laforge | |
134 | 8 | laforge | h3. [[OpenBSC]] |
135 | |||
136 | |||
137 | <pre> |
||
138 | * http://cgit.osmocom.org/cgit/openbsc/log/?h=laforge/hsl |