OsmocomBB

= CalypsoBTS =

This tutorial describes how to turn cheap Calypso based phone(s) into a BTS. Due to hardware limitations the CalypsoBTS setup cannot provide normal quality of service and only can be used to learn how the base stations works. Because Calypso based phone cannot perform BTS functionality itself, in this tutorial we consider how to use it with [http://openbsc.osmocom.org/trac/wiki/OsmoBTS OsmoBTS] and [http://openbts.org/ OpenBTS] front-ends.

== Requirements ==

First of all you have to understand what you're doing and possible consequences. You can use the frequencies you have valid license for. In many countries you cannot operate any GSM RF equipment unless you have obtained a proper license from the regulatory authority. Accomplishing to operate a BTS without having such a license and/or interfering with a public telecommunications network is a crime and punishable under applicable law! 

Also you need to have a [http://bb.osmocom.org/trac/wiki/Software/GettingStarted working setup] of OsmocomBB. And finally some things can be differ in your distribution, so you should be able to solve possible problems yourself because it's your machine.

== TRX preparation ==

There are two OsmocomBB branches provide the transceiver firmware and application. I advice you to use the jolly/testing branch because it have multiple phones support. The transceiver app is an external interface of CalypsoBTS which abstracts a BTS software from the L1 physical layer. It needs libosmo-dsp as a dependency:

{{{

#!sh

git clone git://git.osmocom.org/libosmo-dsp.git

cd libosmo-dsp/

autoreconf -i

./configure

make

sudo make install

cd ..

}}}

Then clone and compile the jolly/testing branch:

{{{

#!sh

# Get the sources	

git clone git://git.osmocom.org/osmocom-bb.git trx

cd trx/

git checkout jolly/testing

cd src/

# It needs TX support

# Just uncomment 'CFLAGS += -DCONFIG_TX_ENABLE' in target/firmware/Makefile

# And make with transceiver support

make HOST_layer23_CONFARGS=--enable-transceiver

}}}

And at this step your transceiver is ready. Let's check how it works!

==== A bit of theory ====

It is very important to have a good clock synchronization between the BTS and mobile phones. Time-division (TDMA) systems require very accurate counting of the time segments and when they start and stop. If the towers clocking were out of sync, then communications would falter as each node would be trying to deal with segments that were slightly offset and this would introduce errors. The GPS signals can be used as clock source. But there is more simple way to grab the clock from existing public mobile networks.

Using [wiki:rssi.bin RSSI] or cell_log find the strongest cell and remember it's ARFCN number.

==== Usage ====

{{{

Usage: ./transceiver -a arfcn_sync

Some useful options:

  -h   --help             this text

  -d   --debug MASK       Enable debugging (e.g. -d DL1C:DTRX)

  -e   --log-level LOGL   Set log level (1=debug, 3=info, 5=notice)

  -D   --daemonize        For the process into a background daemon

  -s   --disable-color    Don't use colors in stderr log output

  -a   --arfcn-sync ARFCN Set ARFCN to sync to

  -p   --arfcn-sync-pcs   The ARFCN above is PCS

  -2   --second-phone     Use second phone for TS 1

  -r   --realtime PRIO    Set realtime scheduler with given prio

}}}

Where --arfcn-sync or --arfcn-sync-pcs indicates the '''ARFCN of clock source cell'''. High priority scheduling required for handling bursts (-r 99). Just try to sync:

{{{

#!sh

# Load the TRX firmware in first terminal

cd trx/src/

sudo host/osmocon/osmocon -r 99 -m c123xor -p /dev/ttyUSB0 -c target/firmware/board/compal_e88/trx.highram.bin

# In second terminal run the transceiver

cd trx/src/host/layer23/src/transceiver/

sudo ./transceiver -a <ARFCN> -r 99

}}}

And you should see something like this:

{{{

<0012> l1ctl.c:383 Reset received: Starting sync.

<0012> l1ctl.c:338 Sync acquired, setting BTS mode ...

<0011> trx.c:194 TRX CLK Indication 1255520

<0011> trx.c:194 TRX CLK Indication 1255571

<0011> trx.c:194 TRX CLK Indication 1255622

<0011> trx.c:194 TRX CLK Indication 1255673

<0011> trx.c:194 TRX CLK Indication 1255724

<0011> trx.c:194 TRX CLK Indication 1255775

<0011> trx.c:194 TRX CLK Indication 1255826

<0011> trx.c:194 TRX CLK Indication 1255877

<0011> trx.c:194 TRX CLK Indication 1255928

<0011> trx.c:194 TRX CLK Indication 1255979

<0011> trx.c:194 TRX CLK Indication 1256030

<0011> trx.c:194 TRX CLK Indication 1256081

...

}}}

If something goes wrong, find another ARFCN and try again.

= CalypsoBTS with OsmoBTS =

[http://openbsc.osmocom.org/trac/wiki/OsmoBTS OsmoBTS] is a software implementation of Layer2/3 of a BTS. Currently it supports a few hardware back-ends only:

* Multiple indoor and outdoor BTS products called ​sysmoBTS which is sold by ​[http://sysmocom.de/ sysmocom].

* Multiple indoor and outdoor ​fairwaves BTSs, like UmDESK and UmSITE.

* Wideband SDR transceiver hardware supported by OpenBTS transceiver or [http://openbsc.osmocom.org/trac/wiki/OsmoTRX OsmoTRX] PHY layer software, including the UmTRX, the USRP family, etc.

* A pretty crazy experimental BTS hardware based on several OsmocomBB phones.

The simplest way to test how it works is to use OsmoBTS with OpenBSC in NiTB mode. Refer [http://openbsc.osmocom.org/trac/wiki/OpenBSC project home] for details. NiTB is a simple core network implementation - network in the box. It emulates basic core elements like MSC, HLR, VLR, etc.

=== Dependences ===

Make sure that you have installed [http://bb.osmocom.org/trac/wiki/libosmocore libosmocore].

Install/update the following packages in your distribution:

{{{sudo apt-get install sqlite3 libdbi-dev libdbd-sqlite3 libsctp-dev}}}

==== oRTP ====

This package installs the open source RTP protocol required for libosmo-abis. It can be downloaded at [http://download.savannah.gnu.org/releases/linphone/ortp/sources/]. Current OsmoBTS source works fine with **0.22.0 oRTP** version only. Otherwise there may be problems with voice support.

{{{

#!sh

wget http://download.savannah.gnu.org/releases/linphone/ortp/sources/ortp-0.22.0.tar.gz

tar -xvf ortp-0.22.0.tar.gz

cd ortp-0.22.0/

./configure

make

sudo make install

sudo ldconfig

cd ..

}}}

==== libosmo-abis ====

{{{git clone git://git.osmocom.org/libosmo-abis.git}}}

Sometimes it is necessary to point to different pkgconfig path, because your distribution may use other pkgconfig path than the default path of the packages above. Use the following prefix: 

{{{PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/ ./configure .....}}}

{{{

#!sh

cd libosmo-abis

autoreconf -i

./configure

(sometimes it is necessary to point to different .../lib/pkgconfig/ path: PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/ ./configure .....)

make

sudo make install

sudo ldconfig

cd ..

}}}

==== libosmo-netif ====

This package is dependency of OsmoNITB.

{{{

#!sh

git clone git://git.osmocom.org/libosmo-netif.git

cd libosmo-netif/

autoreconf -i

./configure

make

sudo make install

sudo ldconfig

cd ..

}}}

=== OsmoNITB ===

The latest version can downloaded via git:

{{{git clone git://git.osmocom.org/openbsc.git}}}

Finish the installation:

{{{

#!sh

cd openbsc/openbsc/

autoreconf -i

./configure

make

sudo make install

cd ../..

}}}

=== OsmoBTS ===

The latest version can downloaded via git:

{{{git clone git://git.osmocom.org/osmo-bts.git}}}

Finish the installation:

{{{

#!sh

cd osmo-bts

autoreconf -i

./configure --enable-trx

make

sudo make install

cd ..

}}}

=== Basic configuration ===

Now wee need to configure OpenBSC and OsmoBTS to work together with CalypsoBTS.

{{{

#!sh

# Create the configuration folder if it isn't exist yet

mkdir ~/.osmocom

cd ~/.osmocom

touch ~/.osmocom/open-bsc.cfg

touch ~/.osmocom/osmo-bts.cfg

}}}

Then init default configuration:

{{{

#!sh

# Run OpenBSC

osmo-nitb -c ~/.osmocom/open-bsc.cfg -l ~/.osmocom/hlr.sqlite3 -P -C --debug=DRLL:DCC:DMM:DRR:DRSL:DNM

# In another terminal

telnet localhost 4242

en

write file

exit

# Kill OpenBSC

Ctrl + C

}}}

Configure OsmoBTS manually:

{{{

bts 0

 band DCS1800

 ipa unit-id 1801 0

 oml remote-ip 127.0.0.1

 rtp jitter-buffer 0

 paging queue-size 200

 paging lifetime 0

 fn-advance 30

 ms-power-loop -60

 timing-advance-loop

 settsc

 setbsic

 trx 0

  rxgain 0

  power 0

  slotmask 1 0 0 0 0 0 0 0

}}}

**NOTE: "ms-power-loop" at osmo-bts.cfg should be set to -65, in order to prevent saturating the input. Also if the phone is only one or few meters away, "ms max power" should be set to 0. In case of long distance test it can be set to 30 (DCS) or 33 (GSM 900).**

In case of one phone as TRX only one timeslot will be available for OsmoBTS. This is enough for basic network functionality including Location Update, SMS and USSD support. For the voice calls support you need one more phone serving a TCH channel. In case of two phones change slotmask to:

{{{slotmask 1 1 0 0 0 0 0 0}}}

Now find and change following initial config parameters of OpenBSC:

{{{

# In network section

network country code <MNC (for test use 001)>

mobile network code <MCC (for test use 01)>

short name <NAME>

long name <NAME>

# In trx[0] section

arfcn <your BTS ARFCN (see note)>

}}}

'''Warning:''' Only use an ARFCN you have a '''valid license''' for.

For other configuration parameters description, see [http://openbsc.osmocom.org/trac/wiki/osmo-nitb_VTY OpenBSC VTY reference].

=== Voice calls support ===

By default NiTB has built-in voice call routing support. In this case you need at least one timeslot serving TCH/H or TCH/F. If you do a call from one phone to another, you will need one channel for each phone. However, it is possible to allow two traffic channels on a single timeslot. To do this configure second timeslot (TS1) as TCH/H at open-bsc.cnf:

{{{

...

trx 0

   rf_locked 0

   arfcn <ARFCN>

   nominal power 23

   max_power_red 0

   rsl e1 tei 0

   timeslot 0

    phys_chan_config CCCH+SDCCH4

    hopping enabled 0

   timeslot 1

    phys_chan_config TCH/H

    hopping enabled 0

    ...

mncc-int

 default-codec tch-f amr

 default-codec tch-h amr

...

}}}

=== LCR (optional) ===

If you want to manage/route calls outside of NiTB, you can replace internal call control by [http://isdn.eversberg.eu/ Linux Call Router].

==== opencore-amr ====

This package installs GSM adaptive multirate codecs and the EFR codec. The Full-Rate and Half-Rate codecs are included in LCR's repository.

It can downloaded at [http://sourceforge.net/projects/opencore-amr/files/opencore-amr/].

{{{

#!sh

tar xvzf opencore-amr-x.x.x.tar.gz

cd opencore-amr-x.x.x

./configure

make

sudo make install

sudo ldconfig

cd ..

}}}

==== Sip-Sofia ====

This package installs the open source SIP stack of Nokia Research Center.

It can downloaded at [http://sourceforge.net/projects/sofia-sip/files/sofia-sip/].

{{{

#!sh

tar xvzf sofia-sip-x.xx.xx.tar.gz

cd sofia-sip-x.xx.xx

./configure

make

sudo make install

sudo ldconfig

cd ..

}}}

==== LCR ====

This package installs the open source PBX software to bridge ISDN (DSS1) / SIP / GSM (MNCC protocol).

The latest version can downloaded via git:

{{{git clone git://git.misdn.eu/lcr.git}}}

Now configure, as described here:

{{{

#!sh

cd lcr

autoreconf -i

./configure --with-sip --with-gsm-bs --with-gsm-ms

}}}

Please note, that Half-Rate codec (--enable-gsmhr) codec is so slow, that only one or two calls may occupy CPU completely. So avoid it's usage except for testing.

Sometimes it is necessary to point to different pkgconfig path, because your distribution may use other pkgconfig path than the default path of the packages above. Use the following prefix:

{{{PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/ ./configure .....}}}

The configure result should include:

{{{

configure: Compiled with GSM network side support 

configure: Compiled with GSM mobile side support

configure: Compiled with GSM AMR codec support

configure: Compiled with SIP support

}}}

Finish the installation:

{{{

#!sh

make

sudo make install

sudo ldconfig

cd ..

}}}

=== LCR configuration (optional) ===

==== options.conf ====

{{{edit /usr/local/etc/lcr/options.conf}}}

Add a line to show logging to the console:

{{{debug 0x100000}}}

==== interface.conf ====

The simplest configuration uses only the GSM interface. It allows LCR to forward calls from GSM to GSM or from GSM to a call test feature. 

{{{edit /usr/local/etc/lcr/interface.conf}}}

You can remove (or comment out) everything and just add this interface:

{{{

[gsm]

gsm-bs

tones yes

earlyb no

extern

}}}

==== routing.conf ====

{{{edit /usr/local/etc/lcr/routing.conf}}}

You can remove (or comment out) everything and just add these rulesets:

{{{

# All calls from interface 'gsm' are forwarded to rule set 'gsm'.

[main]

interface=gsm                           : goto ruleset=gsm

                                        : disconnect cause=31

# All calls that dial '99' prefix, will be test calls. All other calls will be forwarded back to 'gsm' interface.

[gsm]

dialing=99                              : test

                                        : extern interfaces=gsm

}}}

== Running ==

I suggest to have one shell for every process to run, rather than stating all processes as daemon from one shell. Not starting as daemon allows to easily see the debugging output.

==== 1. Transceiver ====

First load the TRX firmware. In case of one phone:

{{{

#!sh

# Shell #1

cd trx/src/

sudo host/osmocon/osmocon -m c123xor -p /dev/ttyUSB0 -c target/firmware/board/compal_e88/trx.highram.bin -r 99

# Shell #2

cd trx/src/host/layer23/src/transceiver/

sudo ./transceiver -a <ARFCN to sync> -r 99

}}}

In case of two phones you should run two osmocon applications:

{{{

#!sh

# Shell #1

cd trx/src/

sudo host/osmocon/osmocon -m c123xor -p /dev/ttyUSB0 -s /tmp/osmocom_l2 -c target/firmware/board/compal_e88/trx.highram.bin -r 99

# Shell #2

cd trx/src/

sudo host/osmocon/osmocon -m c123xor -p /dev/ttyUSB1 -s /tmp/osmocom_l2.2 -c target/firmware/board/compal_e88/trx.highram.bin -r 99

# Shell #3

cd trx/src/host/layer23/src/transceiver/

sudo ./transceiver -a <ARFCN> -2 -r 99

}}}

Make sure that transceiver successfully synchronized to the clock source BTS.

==== 2. OpenBSC ====

Open another shell and start OpenBSC:

{{{osmo-nitb -c ~/.osmocom/open-bsc.cfg -l ~/.osmocom/hlr.sqlite3 -P -C --debug=DRLL:DCC:DMM:DRR:DRSL:DNM}}}

OpenBSC runs as a stand-alone network with given config file and data base. In order to use LCR, add '-m' option. In this case the LCR replaces the built-in call control.

{{{osmo-nitb -c ~/.osmocom/open-bsc.cfg -l ~/.osmocom/hlr.sqlite3 -P -m -C --debug=DRLL:DCC:DMM:DRR:DRSL:DNM}}}

Very important is the option '-C'. On certain machines, osmo-nitb will halt from time to time while writing counters to database. This Without this option, audio might interrupt several seconds from time to time.

The debugging is useful for early tests, because you will quickly see what happens if a mobile requests something.

{{{

<0005> bsc_init.c:423 

WARNING: You are running an 'accept-all' network on a BTS that is not barred. This configuration is

likely to interfere with production GSM networks and should only be used in a RF shielded environment 

such as a faraday cage!

<001a> input/ipaccess.c:831 enabling ipaccess BSC mode

DB: Database initialized.

DB: Database prepared.

}}}

==== 2.1 LCR (optional) ====

Start the LCR:

{{{

#!sh

sudo lcr start

}}}

You should see following output:

{{{

** LCR  Version 1.14

000000 DEBUG (in sip.cpp/sip_init() line 1997): SIP globals initialized

LCR 1.14 started, waiting for calls...

000000 TRACE 05.02.16 00:05:03.444 --: LCR 1.14 started, waiting for calls...

}}}

And following message at OpenBSC log:

{{{

<0006> mncc_sock.c:273 MNCC Socket has connection with external call control application

}}}

==== 3. OsmoBTS ====

And finally start the OsmoBTS instance:

{{{sudo osmobts-trx -c ~/.osmocom/osmo-bts.cfg -r 99}}}

{{{

((*))

  |

 / \ OsmoBTS

Using MAC address of eth0: 'xx:xx:xx:xx:xx:xx'

...

<000a> trx_if.c:176 No response from tranceiver

<000a> trx_if.c:176 No response from tranceiver

<000a> trx_if.c:176 No response from tranceiver

}}}

== Test ==

=== Location Updating ===

Switch on the phone.

If you have a SIM card for your network MCC/MNC, you can use it and do automatic network search. If not, do a manual network and select this network. You should see debugging output on OpenBSC like this:

{{{

...

 <0002> gsm_04_08.c:424 -> LOCATION UPDATE ACCEPT

...

}}}

=== USSD ===

Request {{{*#100#}}} to know which number associated with your IMSI.

=== Call the music (LCR required) ===

Now enter phone number 995 to select the test function 5 of LCR. This test function just plays the hold music.

=== Echo and BFI test (LCR required) ===

Enter phone number 993 to select the test function 3 of LCR. This test function echoes back everything that is received. Note that it will re-transcode the speech data, so the audio from your voice is compressed and decompressed twice until you can hear a fraction of a second later.

You may experience short beeps. These beeps represent all bad frames that could not be decoded or got lost over the air. (Without this test, the missing frames will be extrapolated from previous frame, so some loss rate will not be recognized by the remote end.)

== VTY control interface ==

It is possible (of course) to control your working setup manually. Connect the OpenBSC VTY telnet interface (port 4242 by default):

{{{

telnet localhost 4242

en

# Type 'list' for help

# Go to 'configure terminal' if you want to change some configuration params

OpenBSC#

  help        Description of the interactive help system

  list        Print command list

  write       Write running configuration to memory, network, or terminal

  show        Show running system information

  exit        Exit current mode and down to previous mode

  disable     Turn off privileged mode command

  configure   Configuration from vty interface

  copy        Copy configuration

  terminal    Set terminal line parameters

  who         Display who is on vty

  logging     Configure log message to this terminal

  drop        Debug/Simulation command to drop Abis/IP BTS

  bts         BTS related commands

  sms         SMS related comamnds

  subscriber  Operations on a Subscriber

  sms-queue   SMS Queue

  meas-feed   Measurement export related

# Example: sending an SMS

subscriber imsi <IMSI> sms sender imsi <IMSI2> send Hello, world!

}}}

See [http://openbsc.osmocom.org/trac/wiki/osmo-nitb_VTY VTY reference] for details.

= CalypsoBTS with OpenBTS =

OpenBTS is another open source software project aimed to replace legacy telecommunication protocols and traditionally complex, proprietary hardware systems by IP a flexible software architecture. It implements the BTS side protocol stack and also some core network elements like OpenBSC in NiTB mode.

=== Installation and configuration ===

Follow this [https://github.com/RangeNetworks/dev/wiki howto] in the project wiki. Once you have OpenBTS up and running, you need to change the following configuration parameters in the database (/etc/OpenBTS/OpenBTS.db):

{{{

Control.GSMTAP.TargetIP = 127.0.0.1

GSM.Radio.NeedBSIC = 1

GSM.Radio.Band = 1800

GSM.CellSelection.Neighbors =   (set to empty string)

GSM.RACH.MaxRetrans = 3

GSM.RACH.TxInteger = 8

GSM.Radio.C0 = <your ARFCN>

Control.LUR.OpenRegistration = ^26242.*$ (see note)

}}}

**Note:** in this example only IMSIs with MCC 262 and the MNC 42 will be allowed to register to the network, change that accordingly.

=== TRX executable ===

Make sure that OpenBTS in not running. In the folder where the OpenBTS executable resides, create a script with the filename 'transceiver' with the following content:

{{{

#!/bin/bash

exec <your path to osmocom-bb>/src/host/layer23/src/transceiver/transceiver -a <ARFCN> -r 99

}}}

Where ARFCN is the channel of clock source cell.

And make it executable:

{{{

#!sh

sudo chmod +x transceiver

}}}

== Running ==

Run TRX application on the phone as described above.

You now can start up OpenBTS and should hopefully see the BTS by performing a manual network search with your phone. Monitor the output of osmocon and the transceiver/OpenBTS to see if all goes well. If anything should fail, reboot the phone and start over. 

The OpenBTS CLI allows you to monitor system status and change many operating parameters of OpenBTS and the Transceiver in real time. Its executable is located at /OpenBTS/OpenBTSCLI.

Have a fun!