May 2012 - baseband-devel - lists.osmocom.org

Engagetted !

by Sébastien Lorquet

http://www.engadget.com/2010/12/29/researchers-eavesdrop-on-encrypted-gsm-c… Congrats!

7 months

5
5
0 0

Sniffing GPRS

by canarion

Hi, After compiling osmocom-bb and apply sylvain/burst_ind branch and gprs_multi.patch, I execute it and try to sniff gprs traffic. I loaded the layer1 into my C139 and I obtained an ARFCN code (883). When I run ccch_scan -a 883 I get the next result: opyright (C) 2010 Harald Welte <laforge(a)gnumonks.org> Contributions by Holger Hans Peter Freyther License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Failed to connect to '/tmp/osmocom_sap'. Failed during sap_open(), no SIM reader <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(1476410343) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(1207963561) <0001> app_ccch_scan.c:400 Paging1: Normal paging chan tch/f to TMSI M(0x1ad1cda) <0001> app_ccch_scan.c:403 Paging2: Normal paging chan tch/f to TMSI M(0x41ae98f9) <0001> app_ccch_scan.c:426 Paging3: Normal paging chan n/a to imsi M(214031385056117) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3306441249) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214031482053520) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214036185306441) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4207880193) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4135931713) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4214223105) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3388536385) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(134915836) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3961436929) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4229756769) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(531909) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214034185316455) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3829437761) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214033485554660) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3639403521) <0001> app_ccch_scan.c:105 SI1 received. <0001> app_ccch_scan.c:464 unknown PCH/AGCH type 0x00 <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3827744513) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(335734299) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3561969409) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4294310401) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3698994241) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3682615617) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(67866789) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4003487553) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3770351169) <0001> app_ccch_scan.c:400 Paging1: Normal paging chan tch/f to TMSI M(0x41ae98f9) <0001> app_ccch_scan.c:403 Paging2: Normal paging chan tch/f to TMSI M(0x1ad1cda) <0001> app_ccch_scan.c:426 Paging3: Normal paging chan n/a to imsi M(214031385056117) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3306441249) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214031482053520) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214036185306441) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4102036289) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4135931713) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214032485273805) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3798414145) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(134915836) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3988859137) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3735175681) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(531909) <0001> app_ccch_scan.c:248 GSM48 IMM ASS (ra=0x78, chan_nr=0x0f, HSN=24, MAIO=1, TS=7, SS=0, TSC=1) Dropping frame with 55 bit errors <000c> l1ctl.c:238 Dropping frame with 55 bit errors <000c> l1ctl.c:290 BURST IND: @(830928 = 0626/20/36) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830928 = 0626/20/36) (-110 dBm, SNR 8) <000c> l1ctl.c:290 BURST IND: @(830929 = 0626/21/37) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830929 = 0626/21/37) ( -83 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830930 = 0626/22/38) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830930 = 0626/22/38) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830931 = 0626/23/39) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830931 = 0626/23/39) ( -83 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830932 = 0626/24/40) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830932 = 0626/24/40) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830933 = 0626/25/41) (-105 dBm, SNR 8, UL, SACCH) <000c> l1ctl.c:290 BURST IND: @(830933 = 0626/25/41) (-107 dBm, SNR 5, SACCH) <000c> l1ctl.c:290 BURST IND: @(830934 = 0626/00/42) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830934 = 0626/00/42) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830935 = 0626/01/43) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830935 = 0626/01/43) ( -83 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830936 = 0626/02/44) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830936 = 0626/02/44) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830937 = 0626/03/45) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830937 = 0626/03/45) ( -89 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830938 = 0626/04/46) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830938 = 0626/04/46) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830939 = 0626/05/47) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830939 = 0626/05/47) ( -82 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830940 = 0626/06/48) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830940 = 0626/06/48) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830941 = 0626/07/49) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830941 = 0626/07/49) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830942 = 0626/08/50) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830942 = 0626/08/50) ( -86 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830943 = 0626/09/00) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830943 = 0626/09/00) ( -86 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830944 = 0626/10/01) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830944 = 0626/10/01) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830945 = 0626/11/02) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830945 = 0626/11/02) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830947 = 0626/13/04) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830947 = 0626/13/04) ( -84 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830948 = 0626/14/05) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830948 = 0626/14/05) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830949 = 0626/15/06) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830949 = 0626/15/06) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830950 = 0626/16/07) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830950 = 0626/16/07) ( -89 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830951 = 0626/17/08) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830951 = 0626/17/08) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830952 = 0626/18/09) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830952 = 0626/18/09) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830953 = 0626/19/10) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830953 = 0626/19/10) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830954 = 0626/20/11) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830954 = 0626/20/11) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830955 = 0626/21/12) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830955 = 0626/21/12) (-106 dBm, SNR 0) <000c> l1ctl.c:290 BURST IND: @(830956 = 0626/22/13) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830956 = 0626/22/13) (-107 dBm, SNR 5) <000c> l1ctl.c:290 BURST IND: @(830957 = 0626/23/14) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830957 = 0626/23/14) (-106 dBm, SNR 2) <000c> l1ctl.c:290 BURST IND: @(830958 = 0626/24/15) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830958 = 0626/24/15) (-108 dBm, SNR 1) <000c> l1ctl.c:290 BURST IND: @(830959 = 0626/25/16) (-106 dBm, SNR 2, UL, SACCH) <000c> l1ctl.c:290 BURST IND: @(830959 = 0626/25/16) (-109 dBm, SNR 5, SACCH) <000c> l1ctl.c:290 BURST IND: @(830960 = 0626/00/17) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830960 = 0626/00/17) (-108 dBm, SNR 3) <000c> l1ctl.c:290 BURST IND: @(830961 = 0626/01/18) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830961 = 0626/01/18) (-106 dBm, SNR 2) <000c> l1ctl.c:290 BURST IND: @(830962 = 0626/02/19) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830962 = 0626/02/19) (-108 dBm, SNR 3) <000c> l1ctl.c:290 BURST IND: @(830963 = 0626/03/20) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830963 = 0626/03/20) (-107 dBm, SNR 0) <000c> l1ctl.c:290 BURST IND: @(830964 = 0626/04/21) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830964 = 0626/04/21) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830965 = 0626/05/22) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830965 = 0626/05/22) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830966 = 0626/06/23) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830966 = 0626/06/23) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830967 = 0626/07/24) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830967 = 0626/07/24) ( -86 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830968 = 0626/08/25) (-107 dBm, SNR 6, UL) <000c> l1ctl.c:290 BURST IND: @(830968 = 0626/08/25) (-109 dBm, SNR 0) <000c> l1ctl.c:290 BURST IND: @(830969 = 0626/09/26) (-101 dBm, SNR 6, UL) But it stop to capture frames, seems to be left in a standby state and I don't know why that is. With gprsdecode I can see the next image in the wireshark: http://baseband-devel.722152.n3.nabble.com/file/n3712433/wireshark-capture.… If someone knows what is the problem, please tell me. Thanks in advance. Cheers, Dani -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Sniffing-GPRS-tp3712433p3712433.… Sent from the baseband-devel mailing list archive at Nabble.com.

7 years, 5 months

8
12
0 0

Please can anyone advise me - FMTOOL Error and no further processing

by Raz Sharif

Dear all, I vae the C115 with a T1 USB to Serial cable with the Prolific chipset. When i run osmocon i get :- an its just sits there with no further processing. ./osmocon -p /dev/ttyUSB0 -m c123xor ../../target/firmware/board/compal_e88/loader.compalram.bin read_file(../../target/firmware/board/compal_e88/loader.compalram.bin): file_size=17120, hdr_len=4, dnload_len=17127 read_file(../../target/firmware/board/compal_e88/loader.compalram.bin): file_size=17120, hdr_len=4, dnload_len=17127 got 1 bytes from modem, data looks like: 00 . got 2 bytes from modem, data looks like: 2f 00 /. got 1 bytes from modem, data looks like: 1b . got 3 bytes from modem, data looks like: f6 02 00 ... got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD got 1 bytes from modem, data looks like: 66 f got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6d m got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6c l Received FTMTOOL from phone, ramloader has aborted got 1 bytes from modem, data looks like: 65 e got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . I think the cable is ok as when i run my fingers on the tip i get random Zeros so it appears to be talking to the cable. Also when i tried to run Mobile i get the :- even though i created the Mobile.cfg file in /etc/osmoco Failed to parse the config file: '/home/raz/.osmocom/bb/mobile.cfg' Please check or create config file using: 'touch /home/raz/.osmocom/bb/mobile.cfg' I have spent some hours researching the lists and trying various things to no avail but I want to continue until I resolve this issues and use this great stack to learn about the GSM network. Please advise. Great full for any help or pointers but this maybe a timing issue that is difficult to debug. Thanks Raz

7 years, 12 months

5
6
0 0

cell re-selection

by Andreas.Eversberg

hi, i did a lot of resarch and testing on cell selection and re-selection process the last two week. the cell selection process, network selection process (manual and automatic) and mobility management process were already implemented in OsmocomBB a long time, but turned out to be buggy and incomplete. i made test drives to check the process and debugged it. the re-selection process is new. it is used to track surrounding cells while listening to the BCCH of the current cell (camping on a cell). special extension to the layer1 firmare is used to measure neighbour cells. if an neighbour cell becomes 'better', the mobile switches to that cell, depening on different criteria. now it is possible to move with OsmocomBB. the re-selection process is not handover! handover is a process where a phone switches between cells while doing a call. handover is one next step to implement. the process is a little more complex, because it requires not only neighbour cell measurements, but also syncing to them without interrupting the traffic channel. most layer 3 stuff of handover is already implemented. if you like to play and test your moving OsmocomBB, you can check out the "jolly/roaming" branch. it contains the extension to layer1, as well as sim reader and fixes from "sylvain/testing" branch. use both "mobile" and "layer1" firmware from this branch. in order to see some process at VTY, you can do: enable monitor network 1 (continously display the strongest cell and neighbour cells) show ms 1 (to see current states) show neighbour-cells 1 (to see a more detailed current list of neighbours) andreas

8 years, 2 months

3
3
0 0

Set fixed TMSI and Kc

by Simian Denson

Hi, in the osmocom bb mobile.cfg I don't see any posibility to set a fixed Kc encryption key and the tmsi. How could I achieve that osmocom uses my defined Kc and tmsi? cheers, Simian

8 years, 2 months

5
21
0 0

AW: The call has been rejected

by Andreas.Eversberg

hi josephli, > Read stored BA list mnc=01 the mobile application stores the last cells and neighbour cells (band allocation) of each network. this way the scanning is much faster when restarting. because you use the SIM card with MNC == 02 the first time, there is no band allocation stored for that. the mobile will do a full scan in this case. > while the sim card service I am tesing is actually with mnc 00 and 02. i know that MNC == 0 will not work until i commited improvements of cell selection process last sunday. you should retry that, but first try with an MNC > 0. can you provide debug output when trying a call? also can you provide VTY output of "show ms" before you make the call? regards, andreas

11 years, 1 month

3
2
0 0

status report layer1 and layer23

by Andreas.Eversberg

hi, i just fixed some locking issues the last days. fix will follow. it took a bit longer, because there were some race conditions. it took up to about one hour until it crashed. my way to detect the area where the crash happened, was to turn on buzzer before that area, and turn it off after that area. after many hours of approximation, i finally found out that the major crash happend during _talloc_zero. (first it looks for a free memory chunk, then it allocates it.) since it can be called from all contexts (main, irq, fiq), it need to be locked against any interrupt, otherwise the memory chunk can be assigned multiple times. (the process of _talloc_free is "atomic" and requires no locking.) because it seems pretty stable, i think it is time to merge some branches into the master. (i made a 6 hours call yesterday. and no crash after bugfix ever since.) i will do that together with sylvain, if we find the time this weekend. currently i use the jolly/voice together with the sylvain/traffic branch. i am able to use an isdn phone togehter with linux-call-router and make/receive calls. audio is passed both ways. i think this is a stage where it actually become "usable". (if not moving arround.) one of my major work for the next weeks/months will be the neighbour cell measurement, cell re-selection, and handover. this is essential when moving with the phone. regards, andreas

11 years, 1 month

2
1
0 0

Can't compile after last pull

by Dario Lombardo

I've pulled git repo today, but the RSSI firmware gets an error. apps/rssi/main.c: In function `main': apps/rssi/main.c:896: warning: 'a' might be used uninitialized in this function apps/rssi/main.c:896: warning: 'e' might be used uninitialized in this function CC board/compal_e88/rssi.compalram.manifest.o LD board/compal_e88/rssi.compalram.elf OBJ board/compal_e88/rssi.compalram.bin CC board/compal_e88/rssi.highram.manifest.o LD board/compal_e88/rssi.highram.elf OBJ board/compal_e88/rssi.highram.bin CC board/compal_e88/rssi.e88loader.manifest.o LD board/compal_e88/rssi.e88loader.elf OBJ board/compal_e88/rssi.e88loader.bin CC board/compal_e88/rssi.e88flash.manifest.o LD board/compal_e88/rssi.e88flash.elf OBJ board/compal_e88/rssi.e88flash.bin CC board/compal_e86/rssi.compalram.manifest.o LD board/compal_e86/rssi.compalram.elf arm-elf-ld: region LRAM is full (board/compal_e86/rssi.compalram.elf section .data) make[1]: *** [board/compal_e86/rssi.compalram.elf] Error 1 make[1]: Leaving directory src/target/firmware' make: *** [firmware] Error 2 $ git pull Already up-to-date. $ Anyone experiencing the same issue?

11 years, 5 months

9
11
0 0

cp2102 (betemcu, B75937)

by lonelysurfer

...a never ending story: i have a working ftdi-ttl, but the cp2102-adapters (http://www.ebay.de/itm/USB-2-0-to-UART-TTL-6PIN-Module-Serial-Converter-CP2…) with the same cable dont work under ubuntu or windows. if i rub the top of the 2.55mm with my finger random data appears. but the loader doesnt upload the firmware. i used the txd, rxd and gnd pins and checked the connections with a multimeter. i tested -m c123xor, -m c123 and the default firmware. flashing custom baudrates was no problem. rivers are installed correctly (stady ttyusb0 under ubuntu/ com1 under win). is there any hint? -- View this message in context: http://baseband-devel.722152.n3.nabble.com/cp2102-betemcu-B75937-tp3489336p… Sent from the baseband-devel mailing list archive at Nabble.com.

11 years, 9 months

3
4
0 0

Receiving on TS=1 ?

by Sylvain Munaut

Hi, I've hacked something together to quickly test non-combined CCCH. However, I've hit a problem when trying to receive anything on another timeslot than 0. The TX side seems to work fine as the BTS can see my location update request and answers with a reject, but on the MS side, I never see the reject and wireshark only shows invalid incohrent data on the RX. The frames for SDCCH/8 show really nothing valid (looks like random bytes), things like 09 80 7f 47 49 06 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 47 d5 2d 06 1e 00 00 69 7c a0 91 3d 22 ff ab fe 6c 4f 56 4f 36 ... while the frames for the associated SAACH show at least something gsm-like : 03 03 01 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b but that's not quite a SI5/6 ... To RX/TX on TS=1, I just delayed the RX/TX window by 625 bits (4 * 156.25) when I'm in dedicated channel mode by chaning the 'start' in l1s_tx_win_ctrl / l1s_rx_win_ctrl Is there something else that should be done ? Cheers, Sylvain

11 years, 10 months

2
5
0 0

burst_ind and TCH

by Mad

Hi Sylvain, hi list! I'm experimenting with burst_ind and TCHs right now and ran into some problem I couldn't solve yet. After receiving an Assignment Command for a hopping TCH/F I call l1ctl_tx_dm_est_req_h1() with all necessary parameters and tch_mode GSM48_CMODE_SPEECH_V1 or _EFR. After that I do get burst indications containing the received bits on up- and downlink for the active arfcn on each consecutive frame number. BUT the rx level measurements are most of the time very low and sporadic higher, surely not from that nearby bts and the very close cellphone. It looks like the layer1 doesn't "hit" the right timeslot on the right arfcn at the right time. There are some possible sources of error leading to that, like hopping parameters, channel number and MA list. But I checked these and I took all of them directly from the ASS CMD, the MA as word list in ascending order, like in layer23 IMM ASS handling. The specific AC doesn't have any specialties like Starting Time or "before time" parameters. So my question is if there is some obvious pitfall I'm missing and are there any suggestions how to debug that? Regards, Mad

11 years, 10 months

4
5
0 0

the airprobe port to BB

by Chengcheng Gou

Hi, I am studying the GSM voice interception of airprobe,and want to port to BB,using the ccch_scan.c .the problem is that, the airprobe is written by C++,and the BB is C; I find the useful part of airport is airprobe/gsm-receiver/src/lib/decoder/openbtsstuff, and how to modify the makefile of BB to use the source of openbtsstuff? Thanks!

11 years, 10 months

4
4
0 0

Osmocom user group meetings in Berlin

by Harald Welte

Hi all, I have upated the wiki page at http://openbsc.osmocom.org/trac/wiki/OsmoUserGroup/Berlin to indicate the meeting dates for the next couple of months. So now it is clear that even without any explicit separate announcement, we will be meeting at the indicated date: June 13, 2012 June 27, 2012 July 11, 2012 July 25, 2012 August 8, 2012 August 22, 2012 It had been requested to start a bit later (8pm instead of 7pm), and from the next meeting onwards we will follow that request. Looking forward to meeting you! Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

11 years, 11 months

2
1
0 0

bursts****.dat

by Victor P

Hi, I am trying to use burst_ind branch of osmocom. I have noticed that layer23 creates bursts****.dat files when it indicates uplink. What data are written to these files and what should I use to see its data? Thank you.

11 years, 11 months

5
6
0 0

the structure of "TCH + SACCH" is depend on timeslot?

by Chengcheng Gou

Hi, I am studying the TCH channel, and read the BB source. I find that the structure of "TCH + SACCH" is depend on ts.that is when the timeslot is even, the 12 of a TCH multiframes is SACCH,and the 25 is idle;and When the timeslot is odd, the 25 of a TCH multiframes is SACCH,and the12 is idle. is that right? if that`s right, why ? I can`t find any Material about it. Thanks!

11 years, 11 months

2
1
0 0

Unfix BUG in GSM322.c and prim_pm.c

by rola

Hi All, Many of us are striving to find a way to make use of OBB but due to limited knowledge of programming we get stuck at one point or the other. I've tried to make OBB work for me but nothing has happened. I've passed through the level of installation and file configuration with everything set except for an assuming bug left unfix in gsm322.c or prim_pm.c. This bug is at the point of power measurement when cell selection is in the state of any cell. The first band is always measured accurately while the next band range works at layer1 with no response back to mobile. Due to this, the same second band range power is measured twice and that leads to overwriting error. I've look through the code to figure out where it is appropriate to make correction in order for the process to flow accordingly. But, in as much as I try, I end back at the same spot of not knowing where to effect a change. Two conspicuous identifiable issues are: 1. PCS arfcn range calculation seems to be incorrect. The initial arfcn and final are passed with extremely high range values in reverse order. 2. Perhaps as a result of the above, no response of measured power is feed back to mobile and that breakdown the program flow in gsm322.c. Thereby causing the same erring band to be measured twice and stuck in that cycle of measurement. I just need a guidance on what changes to make in order to fix these issues. I will greatly appreciate it if the only response is just to confirm if I'm right or wrong in my assumptions. Thanks. Sincerely, Rasaki -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Unfix-BUG-in-GSM322-c-and-prim-p… Sent from the baseband-devel mailing list archive at Nabble.com.

11 years, 11 months

2
2
0 0

TODAY: May 23, 7pm / Osmocom meeting in Berlin

by Harald Welte

Hi all! This is the announcement for the 4th incarnation of our bi-weekly Osmocom Berlin meeting. May 23, 7pm @ CCC Berlin, Marienstr. 11, 10113 Berlin There is no particular schedule for now, but if there is interest we can do an introduction + demo of the new sysmoBTS. Also, I'll have my SIMtrace with me, to read out TERMINAL PROFILE from phones for https://terminal-profile.osmocom.org/ . So if you have any phones to read out: Please bring them (with charged battery or charger!) So we'll just meet + talk. There seem to be some SMSC related questions that we would want to adress, so you have been warned ;) If you are interested to show up, feel free to do so. There is no registration required. The meeting is free as in "free beer", despite no actual free beer being around ;) Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

11 years, 12 months

3
2
0 0

the Paging response can be received every time I get SMS?

by Chengcheng Gou

the Paging response is uplink, How can I received it?

11 years, 12 months

4
3
0 0

How to transmit burst in different time slots at the same time

by Chengcheng Gou

Hi The BB can transmit burst in different time slots at the same time? Thanks!

11 years, 12 months

3
2
0 0

Osmocom-bb Making a call

by Altaf

Hello. *Can someone help me out at this point of the Osmocom-bb project [making a call].... I am done with all the steps involved in the project. 1. i have added the /.osmocom/bb/mobile.cfg 2. i am in the branch sylvian/testing I used git checkout --track -b remotes/origin/sylvian/testing command to enter this branch. It worked right... Am i RIGHT here? 3. when i download the firmware layer 1 on the phone it worked pretty good. it says..* handle_write(): finished got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 03 . got 1 bytes from modem, data looks like: 42 B Received DOWNLOAD ACK from phone, your code is running now! battery_compal_e88_init: starting up OSMOCOM Layer 1 (revision osmocon_v0.0.0-1348-g083a2dc) ====================================================================== Device ID code: 0xb4fb Device Version code: 0x0000 ARM ID code: 0xfff3 cDSP ID code: 0x0128 Die ID code: f2d81c119e039be2 ====================================================================== REG_DPLL=0x2413 CNTL_ARM_CLK=0xf0a1 CNTL_CLK=0xff91 CNTL_RST=0xfff3 CNTL_ARM_DIV=0xfff9 ====================================================================== Power up simcard: Assert DSP into Reset Releasing DSP from Reset Setting some dsp_api.ndb values Setting API NDB parameters DSP Download Status: 0x0001 DSP API Version: 0x0000 0x0000 Finishing download phase DSP Download Status: 0x0002 DSP API Version: 0x3606 0x0000 LOST 1161! BAT-ADC: 549 6 0 0 1023 349 328 204 Charger at 51 mV. Battery at 3753 mV. Charging at 0 mA. Battery capacity is 69%. Battery range is 3199..3999 mV. Battery full at 468 LSB .. full at 585 LSB Charging at 239 LSB (204 mA). BCICTL2=0x3ff battery-info.flags=0x00000000 bat_compal_e88_chg_state=0 * 4. when i launch the MOBILE application it says like* 000f> sim.c:1223 init SIM client <0006> gsm48_cc.c:63 init Call Control <0007> gsm480_ss.c:231 init SS <0017> gsm411_sms.c:63 init SMS <0001> gsm48_rr.c:5479 init Radio Ressource process <0005> gsm48_mm.c:1315 init Mobility Management process <0005> gsm48_mm.c:1037 Selecting PLMN SEARCH state, because no SIM. <0002> gsm322.c:5025 init PLMN process <0003> gsm322.c:5026 init Cell Selection process Mobile '1' initialized, please start phone now! VTY available on port 4247. <0005> subscriber.c:601 Requesting SIM file 0x2fe2 <000f> sim.c:209 got new job: SIM_JOB_READ_BINARY (handle=00000004) <000f> sim.c:697 go MF <000f> sim.c:241 SELECT (file=0x3f00) 000f> sim.c:949 command successfull <000f> sim.c:151 sending result to callback function (type=0) <0005> subscriber.c:360 received SMSP from SIM (sca=+49232********000) <0005> subscriber.c:561 (ms 1) Done reading SIM card (IMSI=26****************654 Germany, E-Plus) <0005> subscriber.c:573 -> SIM card registered to 262 03 (Germany, E-Plus) <0005> gsm48_mm.c:4379 (ms 1) Received 'MMR_REG_REQ' event <0002> gsm322.c:3806 (ms 1) Event 'EVENT_SIM_INSERT' for automatic PLMN selection in state 'A0 null' <000e> gsm322.c:1372 Start search of last registered PLMN (mcc=262 mnc=03 Germany, E-Plus) <0002> gsm322.c:1376 Use RPLMN (mcc=262 mnc=03 Germany, E-Plus) <0002> gsm322.c:800 new state 'A0 null' -> 'A1 trying RPLMN' <0003> gsm322.c:4037 (ms 1) Event 'EVENT_NEW_PLMN' for Cell selection in state 'C0 null' <000e> gsm322.c:3619 Selecting PLMN (mcc=262 mnc=03 Germany, E-Plus) <0003> gsm322.c:3628 Start normal cell selection. <0003> gsm322.c:823 new state 'C0 null' -> 'C1 normal cell selection' <0003> gsm322.c:2791 Scanning power for all frequencies. * Here its starts to search for frequencies and cells..... and see what happens.... * <0003> gsm322.c:2852 Scanning frequencies. (0..0) <0003> gsm322.c:2913 Done with power scanning range. <0003> gsm322.c:2791 Scanning power for all frequencies. <0003> gsm322.c:2852 Scanning frequencies. (512(DCS)..512(DCS)) <0003> gsm322.c:2913 Done with power scanning range. <0003> gsm322.c:2791 Scanning power for all frequencies. <0003> gsm322.c:2852 Scanning frequencies. (975..975) <0003> gsm322.c:2913 Done with power scanning range. <0003> gsm322.c:2791 Scanning power for all frequencies. <0003> gsm322.c:2813 Found no frequency. This repeats all the TIME........ *I am able to login to the vty terminal and able to execute some instructions..... * enable show ms show subscriber etc* when I try to make a call..... see what happens* <0009> mnccms.c:570 Make call to 01747180018 <0009> mnccms.c:150 support TCH/H also <0009> mnccms.c:174 support full rate v2 <0009> mnccms.c:178 support full rate v1 <0009> mnccms.c:187 support half rate v1 <0006> transaction.c:76 ms 1 allocates transaction (proto 3 trans_id 255 callref 1 mem 0x8cf7370) <0006> gsm48_cc.c:243 new state NULL -> MM_CONNECTION_PEND <0006> gsm48_cc.c:507 Sending MMCC_EST_REQ <0005> gsm48_mm.c:3774 (ms 1) Received 'MMCC_EST_REQ' event in state MM idle <0005> gsm48_mm.c:3777 -> substate PLMN search <0005> gsm48_mm.c:3779 -> callref 1, transaction_id 255 <0005> gsm48_mm.c:3042 Init MM Connection, not in normal state. <0006> gsm48_cc.c:2161 (ms 1) Received 'MMCC_REL_IND' in CC state MM_CONNECTION_PEND <0006> gsm48_cc.c:196 (ms 1 ti ff) Sending 'MNCC_REL_IND' to MNCC. <0006> gsm48_cc.c:243 new state MM_CONNECTION_PEND -> NULL <0006> transaction.c:104 ms 1 frees transaction (mem 0x8cf7370) <0009> mnccms.c:372 Call has been released (cause 21) <0009> mnccms.c:71 (call 1) Call removed. 0003> gsm322.c:2889 Getting PM for ARFCN 858(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 859(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 860(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 861(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 862(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 863(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 864(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 865(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 866(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 867(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 868(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 869(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 870(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 871(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 872(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 873(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 874(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 875(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 876(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 877(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 878(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 879(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 880(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 881(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 882(DCS) twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2889 Getting PM for ARFCN 883(DCS) twice I even find this sometimes................ can someone fix this for me.... where could be the error...... Looking forward for a helping hand..... Thank you.. -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Osmocom-bb-Making-a-call-tp39972… Sent from the baseband-devel mailing list archive at Nabble.com.

11 years, 12 months

10
26
0 0

the cause of error "l1ctl.c:238 Dropping frame with 93 bit errors"

by Chengcheng Gou

I am running the ccch_scan, and the error occurs: <000c> l1ctl.c:238 Dropping frame with 93 bit errors Dropping frame with 84 bit errors <000c> l1ctl.c:238 Dropping frame with 84 bit errors Dropping frame with 83 bit errors <000c> l1ctl.c:238 Dropping frame with 83 bit errors Dropping frame with 86 bit errors <000c> l1ctl.c:238 Dropping frame with 86 bit errors Dropping frame with 85 bit errors <000c> l1ctl.c:238 Dropping frame with 85 bit errors Dropping frame with 71 bit errors <000c> l1ctl.c:238 Dropping frame with 71 bit errors Dropping frame with 78 bit errors <000c> l1ctl.c:238 Dropping frame with 78 bit errors Dropping frame with 80 bit errors <000c> l1ctl.c:238 Dropping frame with 80 bit errors in which situations the error may appear? Does anyone know? Thanks!

12 years

2
1
0 0

Re: The SMOS project / 72h civil emergency communications system

by Kalle Pietila

Thanks Paul for pointing to this Softbank's press release. Japanese have recently witnessed their local need for civil emergency communications and they also have money to make it happen, not to mention good supporting infrastructure already in place. So it was just matter of time to see someone there addressing this problem. I guess in Japan there is no such earthquake that could compromise the functionality of their mobile core (or at least locals think so). So it is then "just" matter of deploying new balloon-basestations to the disaster area. Someone will go there to the washed-out area with all the required gear, and raise a new BTS-balloon every 3km. On poor countries it will remain as a different story however. it would be interesting to see what kind is that Softbank Mobile's Balloon-BTS proof of concept. I do not know about Softbank but I just directly assume that an operator do not have their own BTS R&D. They must be relying on some existing technology and just make it fly with the balloon. Keeping in mind that one weather sounding balloon can raise 500g payload and probably they will need to feed the power via some sort of cable from the ground level up to the high. So very interesting to follow-up how this all will be implemented in practice. Best Wishes, - Kalle > ---------- Forwarded message ---------- > From: Paul Dart <pauldart(a)gmail.com> > To: baseband-devel(a)lists.osmocom.org > Cc: > Date: Fri, 18 May 2012 09:24:18 +0100 > Subject: Re: The SMOS project / 72h civil emergency communications system > On 17 May 2012 08:17, Alexander Chemeris <alexander.chemeris(a)gmail.com> wrote: >> Have you thought about using a balloon for carrying a BTS instead of >> dropping to a ground? This would give you much better coverage easily >> then on-the-ground installation. > > http://www.cellular-news.com/story/54354.php?s=h > > It appears Softbank Mobile have! > > (also I emailed the OP about Telecom Sans Frontier http://www.tsfi.org ) > > Good luck, > > Paul

12 years

1
0
0 0

Return value for fucntion class_of_band in gsm322.c

by rola

Hi All, I just need a quick clarification on the return value of the function class_of_band in gsm332.c. The switch portion of the function takes care of other bands except 900 band which happen to be isolated separately after the switch statement. By that the 900 band is set to be default and only band to be used. I just want to know if this is deliberate or an oversight. If this situation is actually what I have in mind, I think it will definitely have effect on anyone trying to use Osmocom-bb for other band beside 900. I've been trying to get OBB work for PCS that happen to be only working GSM band in my location with no avail. For this, I need to know if including the 900 band as part of the switch statement will resolve the problem of having PCS band not working. Also is that the only section that need to be corrected in order for PCS band to camp and register with any approved cell in a location. Thank you. Sincerely, Rasak. -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Return-value-for-fucntion-class-… Sent from the baseband-devel mailing list archive at Nabble.com.

12 years

1
0
0 0

the problem of burst_ind receive SMS in a cell

by Chengcheng Gou

first,the network is not encrypt. I test burst_ind to receive SMS in a cell, but I can`t receive the SMS transfered in my two phone, the two phone is lock to the cell, do I miss anything ? Another problem I am only interest in SMS but not voice,and how to difference the two types of SDCCH? thanks!

12 years

3
3
0 0

The SMOS project / 72h civil emergency communications system

by Kalle Pietila

Dear baseband enthusiasts, on SMOS project we had this crazy idea for catastrophe communications in which cellular base stations would be miniaturized enough to be airdropped into disaster zones. We felt that this might be possible if all functionality except SMS was stripped from the base stations (hence SMOS, SMS Our Souls). Most ideally such technology would come in near cellphone size (excluding batteries), something like osmocom's earlier "Phone acting as BTS" hackwork. We did not have the guts nor skills to start doing this by ourselves, so we just published our findings and studies under Creative Commons BY license. As we wish to keep this idea open to everyone, our web-documentation would benefit on this regard from some more in-depth HW-related analysis and suggestions (our team fell short on this area). Once it's all published, it cannot be patented. I personally see some humanitarian & karma-improving angle in doing it this way. Helping human kinds in disaster should not be bound by patent laws. So I'm asking for constructive criticism and also offering possibility to write some informal blogs about your views on www.zygomatica.com/smos (with our team's editorial support) . At the same time it should be noted that such technically oriented blog writings at my friends' site zygomatica.com would likely reach 50 readers at most. To put it more nicely, reaching the widest possible audience is not our focus here anyways. My technical vision is presented at http://www.zygomatica.com/wp-content/uploads/2012/04/SMOS6-Technical-goals-… .. and the full list of formal documents at end of http://www.zygomatica.com/smos/ . The other provided background material might be even more valuable to those that start considering this idea more seriously. So, For instance, can stripping down the functionality just to supporting SMS delivery bring down the power consumption in any significant manner? Thanks and regards, Kalle Pietilä P.S. Mailed to this list as suggested by Harald.

12 years

3
4
0 0

What does FBSB RESP: result=255 mean?

by Joshua Pereyda

Hello, Hopefully this question is appropriate on this list (please let me know otherwise). Running ccch_scan or bcch_scan in the sylvain/burst_ind branch, I keep getting this error: <000c> l1ctl.c:114 FBSB RESP: result=255 I tried checking the code, but I can't quite figure out what's going on. It looks like 255 is an error code, but I don't know where to go from there. This may be related to my SIM card being locked (I think). Running mobile on the sylvain/testing branch, I get: <0005> subscriber.c:625 PIN is required, 3 tries left Will not having the PIN intefere with ccch_scan as well? Thanks, Josh Pereyda

12 years

2
2
0 0

Has the TMSI has the limitation of using count?

by Chengcheng Gou

I stat the TMSI of my near cell in CCCH, and not find a TMSI occurs more than 6 times; that`s Why?

12 years

1
0
0 0

How to construct a "Slient SMS"

by Chengcheng Gou

I want to study the Slient SMS, How can it be constructed? Anyone kowns?

12 years

4
3
0 0

alcatel bic phone?

by Sebastien Lorquet

hello, what do you specialist think of the "bic phone" as an osmocombb candidate? it's very cheap and available in france at various suppliers (including grocery shops!). It seems to be an Alcaltel OneTouch S210 (1) and this wikipedia page (2), even if it does not mention this model, have several models with a MTK or Calypso chipset indication. I searched the best as I could but I didn't find any accurate info. Maybe one of you may have already investigated this thing? (1) http://en.wikipedia.org/wiki/Bic_Phone (2) http://en.wikipedia.org/wiki/Alcatel_Mobile_Phones Regards, Sebastien

12 years

2
1
0 0

BB can`t send SMS successfully 100%?

by Chengcheng Gou

I use the BB sending SMS, but it can`t be success to do it 100%, Why?

12 years

2
1
0 0

[nuttx] data abort issues(maybe linker script issues)

by Denis 'GNUtoo' Carikli

Hi, Since there is only 256k of internal memory(starting from 0x00800000 and finishing at 0x00840000 ) on the compal_e99, And that in nuttx we went over 0x00840000(which is bad and may be cause a similar data abort than the follownig one), I wonder if we could use the external RAM like in the attached patch(we're a bit short on memory). However the patch may still be wrong because it still produces a data abort: nsh> nxtext nxtext [2:100] nsh> nxtext_initialize: Initializing external graphics device nxtext_initialize: Open NX [...] nxtext_main: NX handle=1006ea0 nxtext_main: Set background color=32 [...] row: 60 col: 0 npixels: 98 row: 61 col: 0 npixels: 98 row: 62 col: 0 npixels: 98 row: 63 col: 0 npixels: 98 row: 64 col: 0 npixels: 98 row: 65 col: 0 npixels: 98 row: 66 col: 0 npixels: 98 [...] row: 50 col: 0 npixels: 98 rowData abort. PC: 00826090 Assertion failed at file:arm/up_dataabort.c line: 198 error code: 32773 sp: 01006d78 IRQ stack: base: 010003fc size: 000003fc User stack: base: 01006e88 size: 000007fc 01006d60: 00008005 000000b0 008212d4 008318f0 01006d80 000000c6 00008005 000000b0 01006d80: 00000055 0100104c 008210ec a0000053 00821128 00826090 0082012c 01001444 01006da0: 00000000 e1d2c0b0 e20c10ff 00000020 000000b0 00000055 0100104c 00832df8 01006dc0: 01006ea4 00000000 00000000 0100104c 01006de0 00826014 00826090 a0000053 01006de0: 00000011 01001058 01000d24 0082ac98 00832c48 01000d24 01000d24 00832c48 01006e00: 01006ea4 01000d52 01006ea4 0082aef0 01006ea4 01000d24 00832c48 00000018 01006e20: 008327d0 00000006 008327cd 0082a744 01006ea4 008327cd 00000008 008327d6 01006e40: 00000001 00000001 00000000 008327cd 01006ea4 00000000 00000000 0082a3c4 01006e60: 00000001 00000020 00000000 00000000 00000000 00000000 00000000 00823c54 01006e80: 00000000 00000000 00000000 00000000 00000000 00000000 00000060 80000810 R0: 01001444 00000000 e1d2c0b0 e20c10ff 00000020 000000b0 00000055 0100104c R8: 00832df8 01006ea4 00000000 00000000 0100104c 01006de0 00826014 00826090 CPSR: a0000053 The PC is in the following malloc, but sometimes it was previously in semaphores... 00825fec <malloc>: 825fec: e92d4038 push {r3, r4, r5, lr} 825ff0: e2504000 subs r4, r0, #0 825ff4: 0a000020 beq 82607c <malloc+0x90> 825ff8: e2844017 add r4, r4, #23 825ffc: e3c4500f bic r5, r4, #15 826000: ebffffa2 bl 825e90 <mm_takesemaphore> 826004: e3550501 cmp r5, #4194304 ; 0x400000 826008: 23a00012 movcs r0, #18 82600c: 31a00005 movcc r0, r5 826010: 3bffffe9 blcc 825fbc <mm_size2ndx> 826014: e59f309c ldr r3, [pc, #156] ; 8260b8 <malloc+0xcc> 826018: e0830200 add r0, r3, r0, lsl #4 82601c: e5904008 ldr r4, [r0, #8] 826020: ea000000 b 826028 <malloc+0x3c> 826024: e5944008 ldr r4, [r4, #8] 826028: e3540000 cmp r4, #0 82602c: 0a000011 beq 826078 <malloc+0x8c> 826030: e5943000 ldr r3, [r4] 826034: e1530005 cmp r3, r5 826038: 3afffff9 bcc 826024 <malloc+0x38> 82603c: ea000011 b 826088 <malloc+0x9c> 826040: e0840005 add r0, r4, r5 826044: e7843005 str r3, [r4, r5] 826048: e5805004 str r5, [r0, #4] 82604c: e5845000 str r5, [r4] 826050: e0842002 add r2, r4, r2 826054: e5921004 ldr r1, [r2, #4] 826058: e2011102 and r1, r1, #-2147483648 ; 0x80000000 82605c: e1833001 orr r3, r3, r1 826060: e5823004 str r3, [r2, #4] 826064: ebffffba bl 825f54 <mm_addfreechunk> 826068: e5943004 ldr r3, [r4, #4] 82606c: e3833102 orr r3, r3, #-2147483648 ; 0x80000000 826070: e5843004 str r3, [r4, #4] 826074: e2844008 add r4, r4, #8 826078: ebffffa1 bl 825f04 <mm_givesemaphore> 82607c: e1a00004 mov r0, r4 826080: e8bd4038 pop {r3, r4, r5, lr} 826084: e12fff1e bx lr 826088: e2842008 add r2, r4, #8 82608c: e892000c ldm r2, {r2, r3} 826090: e5832008 str r2, [r3, #8] 826094: e5943008 ldr r3, [r4, #8] 826098: e3530000 cmp r3, #0 82609c: 1594200c ldrne r2, [r4, #12] 8260a0: 1583200c strne r2, [r3, #12] 8260a4: e5942000 ldr r2, [r4] 8260a8: e0653002 rsb r3, r5, r2 8260ac: e353000f cmp r3, #15 8260b0: 9affffec bls 826068 <malloc+0x7c> 8260b4: eaffffe1 b 826040 <malloc+0x54> 8260b8: 01001414 tsteq r0, r4, lsl r4 The data abort prevents us from testing the lcd with the nuttx examples applications that makes use of the LCD.... (for now it only draws a background and then crash like mentioned above). I've also attached the appconfig and the defconfig. What other informations should I give? The branch I'm using is here: https://gitorious.org/gnutoo-s-for-upstream-osmocom-bb-and-nuttx-bb/nuttx-b… gta02/commits/lcd-cleanup (which will be rebased for cleanup purposes). Denis.

12 years

1
0
0 0

[PATCH] [for upstream ???]: fix linker script for compal_e99 highram

by Denis 'GNUtoo' Carikli

Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo(a)no-log.org> --- nuttx/configs/compal_e99/nsh_highram/ld.script | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/nuttx/configs/compal_e99/nsh_highram/ld.script b/nuttx/configs/compal_e99/nsh_highram/ld.script index 7096a61..34ce015 100644 --- a/nuttx/configs/compal_e99/nsh_highram/ld.script +++ b/nuttx/configs/compal_e99/nsh_highram/ld.script @@ -16,7 +16,7 @@ MEMORY LRAM (rw) : ORIGIN = 0x00800000, LENGTH = 0x00020000 TRAM (rw) : ORIGIN = 0x00820000, LENGTH = 0x00020000 /* compal-loaded binary: our unitialized data, stacks, heap */ - IRAM (rw) : ORIGIN = 0x00840000, LENGTH = 0x00010000 + IRAM (rw) : ORIGIN = 0x01000000, LENGTH = 0x011fffff } SECTIONS { -- 1.7.5.4 --nextPart2762333.I70qBvf3Po Content-Disposition: attachment; filename="appconfig" Content-Transfer-Encoding: 7Bit Content-Type: text/x-matlab; charset="UTF-8"; name="appconfig" ############################################################################ # configs/compal_e99/nsh_highram/appconfig # # Copyright (C) 2011 Gregory Nutt. All rights reserved. # Author: Gregory Nutt <spudmonkey(a)racsa.co.cr> # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in # the documentation and/or other materials provided with the # distribution. # 3. Neither the name NuttX nor the names of its contributors may be # used to endorse or promote products derived from this software # without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT # LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS # FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE # COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, # INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, # BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS # OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED # AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN # ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE # POSSIBILITY OF SUCH DAMAGE. # ############################################################################ # NSH shell CONFIGURED_APPS += examples/nsh CONFIGURED_APPS += system/readline CONFIGURED_APPS += nshlib # Path to example in apps/examples #CONFIGURED_APPS += examples/hello CONFIGURED_APPS += vsn/poweroff #CONFIGURED_APPS += examples/ostest CONFIGURED_APPS += examples/nxtext #CONFIGURED_APPS += examples/nxhello #CONFIGURED_APPS += examples/nxlines #CONFIGURED_APPS += examples/nximage --nextPart2762333.I70qBvf3Po Content-Disposition: attachment; filename="defconfig" Content-Transfer-Encoding: 7Bit Content-Type: text/x-matlab; charset="UTF-8"; name="defconfig" ############################################################################ # configs/compal_e99/nsh_highram/defconfig # # Copyright (C) 2007-2012 Gregory Nutt. All rights reserved. # Author: Gregory Nutt <gnutt(a)nuttx.org> # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in # the documentation and/or other materials provided with the # distribution. # 3. Neither the name NuttX nor the names of its contributors may be # used to endorse or promote products derived from this software # without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT # LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS # FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE # COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, # INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, # BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS # OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED # AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN # ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE # POSSIBILITY OF SUCH DAMAGE. # ############################################################################ # # architecture selection # # CONFIG_ARCH - identifies the arch subdirectory and, hence, the # processor architecture. # CONFIG_ARCH_family - for use in C code. This identifies the # particular chip family that the architecture is implemented # in. # CONFIG_ARCH_architecture - for use in C code. This identifies the # specific architecture within the chip familyl. # CONFIG_ARCH_CHIP - Identifies the arch/*/chip subdirectory # CONFIG_ARCH_CHIP_name - For use in C code # CONFIG_ARCH_BOARD - identifies the configs subdirectory and, hence, # the board that supports the particular chip or SoC. # CONFIG_ARCH_BOARD_name - for use in C code # CONFIG_BOARD_LOOPSPERMSEC - for delay loops # CONFIG_ENDIAN_BIG - define if big endian (default is little endian) # CONFIG_ROM_VECTORS - unique to c5471 # CONFIG_DRAM_END - the size of installed DRAM. # Unique to c5471 # CONFIG_ARCH_LEDS - Use LEDs to show state. Unique to c5471. # CONFIG_ARCH_INTERRUPTSTACK - This architecture supports an interrupt # stack. If defined, this symbol is the size of the interrupt # stack in bytes. If not defined, the user task stacks will be # used during interrupt handling. # CONFIG_ARCH_STACKDUMP - Do stack dumps after assertions # CONFIG_ARCH=arm CONFIG_ARCH_ARM=y CONFIG_ARCH_ARM7TDMI=y CONFIG_ARCH_CHIP=calypso CONFIG_ARCH_CHIP_CALYPSO=y CONFIG_ARCH_BOARD=compal_e99 CONFIG_ARCH_BOARD_COMPALE99=y CONFIG_BOARD_LOOPSPERMSEC=1250 CONFIG_ROM_VECTORS=n CONFIG_DRAM_END=0x00840000 CONFIG_ARCH_LEDS=n CONFIG_ARCH_INTERRUPTSTACK=1024 CONFIG_ARCH_STACKDUMP=y # # C5471 specific device driver settings # # CONFIG_SERIAL_IRDA_CONSOLE - selects the IRDA UART for the # console ant ttys0 (default is the modem UART). # CONFIG_UART_*_HWFLOWCONTROL - enables hardware flow control # CONFIG_UART_*_RXBUFSIZE - Characters are buffered as received. # This specific the size of the receive buffer # CONFIG_UART_*_TXBUFSIZE - Characters are buffered before # being sent. This specific the size of the transmit buffer # CONFIG_UART_*_BAUD - The configure BAUD of the UART. Must be # CONFIG_UART_*_BITS - The number of bits. Must be either 7 or 8. # CONFIG_UART_*_PARTIY - 0=no parity, 1=odd parity, 2=even parity # CONFIG_UART_*_2STOP - Two stop bits # CONFIG_SERIAL_IRDA_CONSOLE=n CONFIG_UART_IRDA_HWFLOWCONTROL=n CONFIG_UART_MODEM_HWFLOWCONTROL=n CONFIG_UART_IRDA_RXBUFSIZE=256 CONFIG_UART_MODEM_RXBUFSIZE=256 CONFIG_UART_IRDA_TXBUFSIZE=256 CONFIG_UART_MODEM_TXBUFSIZE=256 CONFIG_UART_IRDA_BAUD=115200 CONFIG_UART_MODEM_BAUD=115200 CONFIG_UART_IRDA_BITS=8 CONFIG_UART_MODEM_BITS=8 CONFIG_UART_IRDA_PARITY=0 CONFIG_UART_MODEM_PARITY=0 CONFIG_UART_IRDA_2STOP=0 CONFIG_UART_MODEM_2STOP=0 # # C5471 Ethernet Driver settings CONFIG_C5471_NET_STATS=n ETHERNET_PHY_LU3X31T_T64=1 ETHERNET_PHY_AC101L=2 CONFIG_C5471_ETHERNET_PHY=ETHERNET_PHY_LU3X31T_T64 CONFIG_NET_C5471_AUTONEGOTIATION=y CONFIG_NET_C5471_BASET100=n CONFIG_NET_C5471_BASET10=n # # General build options # # CONFIG_RRLOAD_BINARY - make the rrload binary format used with # BSPs from www.ridgerun.com using the tools/mkimage.sh script # CONFIG_INTELHEX_BINARY - make the Intel HEX binary format # used with many different loaders using the GNU objcopy program # Should not be selected if you are not using the GNU toolchain. # CONFIG_RAW_BINARY - make a raw binary format file used with many # different loaders using the GNU objcopy program. This option # should not be selected if you are not using the GNU toolchain. # CONFIG_HAVE_LIBM - toolchain supports libm.a # CONFIG_RRLOAD_BINARY=n CONFIG_INTELHEX_BINARY=n CONFIG_RAW_BINARY=y CONFIG_HAVE_LIBM=n # # General OS setup # # CONFIG_APPS_DIR - Identifies the relative path to the directory # that builds the application to link with NuttX. Default: ../apps # CONFIG_DEBUG - enables built-in debug options # CONFIG_DEBUG_VERBOSE - enables verbose debug output # CONFIG_DEBUG_SYMBOLS - build without optimization and with # debug symbols (needed for use with a debugger). # CONFIG_MM_REGIONS - If the architecture includes multiple # regions of memory to allocate from, this specifies the # number of memory regions that the memory manager must # handle and enables the API mm_addregion(start, end); # CONFIG_ARCH_LOWPUTC - architecture supports low-level, boot # time console output # CONFIG_TICKS_PER_MSEC - The default system timer is 100Hz # or TICKS_PER_MSEC=10. This setting may be defined to # inform NuttX that the processor hardware is providing # system timer interrupts at some interrupt interval other # than 10 msec. # CONFIG_RR_INTERVAL - The round robin timeslice will be set # this number of milliseconds; Round robin scheduling can # be disabled by setting this value to zero. # CONFIG_SCHED_INSTRUMENTATION - enables instrumentation in # scheduler to monitor system performance # CONFIG_TASK_NAME_SIZE - Spcifies that maximum size of a # task name to save in the TCB. Useful if scheduler # instrumentation is selected. Set to zero to disable. # CONFIG_START_YEAR, CONFIG_START_MONTH, CONFIG_START_DAY - # Used to initialize the internal time logic. # CONFIG_JULIAN_TIME - Enables Julian time conversions # CONFIG_DEV_CONSOLE - Set if architecture-specific logic # provides /dev/console. Enables stdout, stderr, stdin. # CONFIG_DEV_LOWCONSOLE - Use the simple, low-level serial console # driver (minimul support) # CONFIG_MUTEX_TYPES: Set to enable support for recursive and # errorcheck mutexes. Enables pthread_mutexattr_settype(). # CONFIG_PRIORITY_INHERITANCE : Set to enable support for priority # inheritance on mutexes and semaphores. # CONFIG_SEM_PREALLOCHOLDERS: This setting is only used if priority # inheritance is enabled. It defines the maximum number of # different threads (minus one) that can take counts on a # semaphore with priority inheritance support. This may be # set to zero if priority inheritance is disabled OR if you # are only using semaphores as mutexes (only one holder) OR # if no more than two threads participate using a counting # semaphore. # CONFIG_SEM_NNESTPRIO. If priority inheritance is enabled, # then this setting is the maximum number of higher priority # threads (minus 1) than can be waiting for another thread # to release a count on a semaphore. This value may be set # to zero if no more than one thread is expected to wait for # a semaphore. # CONFIG_FDCLONE_DISABLE. Disable cloning of all file descriptors # by task_create() when a new task is started. If set, all # files/drivers will appear to be closed in the new task. # CONFIG_FDCLONE_STDIO. Disable cloning of all but the first # three file descriptors (stdin, stdout, stderr) by task_create() # when a new task is started. If set, all files/drivers will # appear to be closed in the new task except for stdin, stdout, # and stderr. # CONFIG_SDCLONE_DISABLE. Disable cloning of all socket # desciptors by task_create() when a new task is started. If # set, all sockets will appear to be closed in the new task. # CONFIG_NXFLAT. Enable support for the NXFLAT binary format. # This format will support execution of NuttX binaries located # in a ROMFS filesystem (see examples/nxflat). # #CONFIG_APPS_DIR= CONFIG_DEBUG=n CONFIG_DEBUG_VERBOSE=n CONFIG_DEBUG_SYMBOLS=n CONFIG_MM_REGIONS=2 CONFIG_ARCH_LOWPUTC=y CONFIG_RR_INTERVAL=200 CONFIG_SCHED_INSTRUMENTATION=n CONFIG_TASK_NAME_SIZE=0 CONFIG_START_YEAR=2007 CONFIG_START_MONTH=2 CONFIG_START_DAY=13 CONFIG_JULIAN_TIME=n CONFIG_DEV_CONSOLE=y CONFIG_DEV_LOWCONSOLE=n CONFIG_MUTEX_TYPES=n CONFIG_PRIORITY_INHERITANCE=n CONFIG_SEM_PREALLOCHOLDERS=0 CONFIG_SEM_NNESTPRIO=0 CONFIG_FDCLONE_DISABLE=n CONFIG_FDCLONE_STDIO=n CONFIG_SDCLONE_DISABLE=y CONFIG_NXFLAT=n # # The following can be used to disable categories of # APIs supported by the OS. If the compiler supports # weak functions, then it should not be necessary to # disable functions unless you want to restrict usage # of those APIs. # # There are certain dependency relationships in these # features. # # o mq_notify logic depends on signals to awaken tasks # waiting for queues to become full or empty. # o pthread_condtimedwait() depends on signals to wake # up waiting tasks. # CONFIG_DISABLE_CLOCK=n CONFIG_DISABLE_POSIX_TIMERS=n CONFIG_DISABLE_PTHREAD=n CONFIG_DISABLE_SIGNALS=n CONFIG_DISABLE_MQUEUE=y CONFIG_DISABLE_MOUNTPOINT=n CONFIG_DISABLE_ENVIRON=n CONFIG_STDIO_LINE_BUFFER=y CONFIG_DISABLE_POLL=y # # FAT filesystem configuration # CONFIG_FS_FAT - Enable FAT filesystem support # CONFIG_FAT_SECTORSIZE - Max supported sector size # CONFIG_FS_ROMFS - Enable ROMFS filesystem support CONFIG_FS_FAT=n CONFIG_FS_ROMFS=n # # Misc libc settings # # CONFIG_NOPRINTF_FIELDWIDTH - sprintf-related logic is a # little smaller if we do not support fieldwidthes # CONFIG_NOPRINTF_FIELDWIDTH=n # # Allow for architecture optimized implementations # # The architecture can provide optimized versions of the # following to improve sysem performance # CONFIG_ARCH_MEMCPY=n CONFIG_ARCH_MEMCMP=n CONFIG_ARCH_MEMMOVE=n CONFIG_ARCH_MEMSET=n CONFIG_ARCH_STRCMP=n CONFIG_ARCH_STRCPY=n CONFIG_ARCH_STRNCPY=n CONFIG_ARCH_STRLEN=n CONFIG_ARCH_STRNLEN=n CONFIG_ARCH_BZERO=n # # Sizes of configurable things (0 disables) # # CONFIG_MAX_TASKS - The maximum number of simultaneously # active tasks. This value must be a power of two. # CONFIG_MAX_TASK_ARGS - This controls the maximum number of # of parameters that a task may receive (i.e., maxmum value # of 'argc') # CONFIG_NPTHREAD_KEYS - The number of items of thread- # specific data that can be retained # CONFIG_NFILE_DESCRIPTORS - The maximum number of file # descriptors (one for each open) # CONFIG_NFILE_STREAMS - The maximum number of streams that # can be fopen'ed # CONFIG_NAME_MAX - The maximum size of a file name. # CONFIG_STDIO_BUFFER_SIZE - Size of the buffer to allocate # on fopen. (Only if CONFIG_NFILE_STREAMS > 0) # CONFIG_NUNGET_CHARS - Number of characters that can be # buffered by ungetc() (Only if CONFIG_NFILE_STREAMS > 0) # CONFIG_PREALLOC_MQ_MSGS - The number of pre-allocated message # structures. The system manages a pool of preallocated # message structures to minimize dynamic allocations # CONFIG_MQ_MAXMSGSIZE - Message structures are allocated with # a fixed payload size given by this settin (does not include # other message structure overhead. # CONFIG_MAX_WDOGPARMS - Maximum number of parameters that # can be passed to a watchdog handler # CONFIG_PREALLOC_WDOGS - The number of pre-allocated watchdog # structures. The system manages a pool of preallocated # watchdog structures to minimize dynamic allocations # CONFIG_PREALLOC_TIMERS - The number of pre-allocated POSIX # timer structures. The system manages a pool of preallocated # timer structures to minimize dynamic allocations. Set to # zero for all dynamic allocations. # CONFIG_MAX_TASKS=16 CONFIG_MAX_TASK_ARGS=4 CONFIG_NPTHREAD_KEYS=4 CONFIG_NFILE_DESCRIPTORS=8 CONFIG_NFILE_STREAMS=8 CONFIG_NAME_MAX=32 CONFIG_STDIO_BUFFER_SIZE=1024 CONFIG_NUNGET_CHARS=2 CONFIG_PREALLOC_MQ_MSGS=0 CONFIG_MQ_MAXMSGSIZE=32 CONFIG_MAX_WDOGPARMS=4 CONFIG_PREALLOC_WDOGS=8 CONFIG_PREALLOC_TIMERS=8 # SPI driver # CONFIG_SPI_OWNBUS - Set if there is only one active device # on the SPI bus. No locking or SPI configuration will be performed. # It is not necessary for clients to lock, re-configure, etc.. # CONFIG_SPI_EXCHANGE - Driver supports a single exchange method # (vs a recvblock() and sndblock ()methods) # CONFIG_SPI_OWNBUS=y CONFIG_SPI_EXCHANGE=y # # TCP/IP and UDP support via uIP # CONFIG_NET - Enable or disable all network features # CONFIG_NET_IPv6 - Build in support for IPv6 # CONFIG_NSOCKET_DESCRIPTORS - Maximum number of socket descriptors per task/thread. # CONFIG_NET_SOCKOPTS - Enable or disable support for socket options # CONFIG_NET_BUFSIZE - uIP buffer size # CONFIG_NET_TCP - TCP support on or off # CONFIG_NET_TCP_CONNS - Maximum number of TCP connections (all tasks) # CONFIG_NET_TCP_READAHEAD_BUFSIZE - Size of TCP read-ahead buffers # CONFIG_NET_NTCP_READAHEAD_BUFFERS - Number of TCP read-ahead buffers (may be zero) # CONFIG_NET_TCPBACKLOG - Incoming connections pend in a backlog until # accept() is called. The size of the backlog is selected when listen() is called. # CONFIG_NET_MAX_LISTENPORTS - Maximum number of listening TCP ports (all tasks) # CONFIG_NET_UDP - UDP support on or off # CONFIG_NET_UDP_CHECKSUMS - UDP checksums on or off # CONFIG_NET_UDP_CONNS - The maximum amount of concurrent UDP connections # CONFIG_NET_ICMP - ICMP ping response support on or off # CONFIG_NET_ICMP_PING - ICMP ping request support on or off # CONFIG_NET_PINGADDRCONF - Use "ping" packet for setting IP address # CONFIG_NET_STATISTICS - uIP statistics on or off # CONFIG_NET_RECEIVE_WINDOW - The size of the advertised receiver's window # CONFIG_NET_ARPTAB_SIZE - The size of the ARP table # CONFIG_NET_BROADCAST - Broadcast support # CONFIG_NET_FWCACHE_SIZE - number of packets to remember when looking for duplicates # CONFIG_NET=n CONFIG_NET_IPv6=n CONFIG_NSOCKET_DESCRIPTORS=8 CONFIG_NET_SOCKOPTS=y CONFIG_NET_BUFSIZE=420 CONFIG_NET_TCP=y CONFIG_NET_TCP_CONNS=8 CONFIG_NET_NTCP_READAHEAD_BUFFERS=32 CONFIG_NET_TCPBACKLOG=n CONFIG_NET_MAX_LISTENPORTS=8 CONFIG_NET_UDP=y CONFIG_NET_UDP_CHECKSUMS=y #CONFIG_NET_UDP_CONNS=4 CONFIG_NET_ICMP=y CONFIG_NET_ICMP_PING=n #CONFIG_NET_PINGADDRCONF=0 CONFIG_NET_STATISTICS=y #CONFIG_NET_RECEIVE_WINDOW= #CONFIG_NET_ARPTAB_SIZE=8 CONFIG_NET_BROADCAST=n #CONFIG_NET_FWCACHE_SIZE=2 # # UIP Network Utilities # CONFIG_NET_DHCP_LIGHT - Reduces size of DHCP # CONFIG_NET_RESOLV_ENTRIES - Number of resolver entries CONFIG_NET_DHCP_LIGHT=n CONFIG_NET_RESOLV_ENTRIES=4 # # Settings for examples/uip CONFIG_EXAMPLE_UIP_NOMAC=y CONFIG_EXAMPLE_UIP_IPADDR=(10<<24|0<<16|0<<8|2) CONFIG_EXAMPLE_UIP_DRIPADDR=(10<<24|0<<16|0<<8|1) CONFIG_EXAMPLE_UIP_NETMASK=(255<<24|255<<16|255<<8|0) CONFIG_EXAMPLE_UIP_DHCPC=n # # Settings for examples/nettest CONFIG_EXAMPLE_NETTEST_SERVER=n CONFIG_EXAMPLE_NETTEST_PERFORMANCE=n CONFIG_EXAMPLE_NETTEST_NOMAC=y CONFIG_EXAMPLE_NETTEST_IPADDR=(10<<24|0<<16|0<<8|2) CONFIG_EXAMPLE_NETTEST_DRIPADDR=(10<<24|0<<16|0<<8|1) CONFIG_EXAMPLE_NETTEST_NETMASK=(255<<24|255<<16|255<<8|0) CONFIG_EXAMPLE_NETTEST_CLIENTIP=(10<<24|0<<16|0<<8|1) # # Settings for examples/nsh CONFIG_NSH_CONSOLE=y CONFIG_NSH_TELNET=n CONFIG_NSH_IOBUFFER_SIZE=512 CONFIG_NSH_CMD_SIZE=40 CONFIG_NSH_STACKSIZE=4096 CONFIG_NSH_DHCPC=n CONFIG_NSH_NOMAC=y CONFIG_NSH_IPADDR=(10<<24|0<<16|0<<8|2) CONFIG_NSH_DRIPADDR=(10<<24|0<<16|0<<8|1) CONFIG_NSH_NETMASK=(255<<24|255<<16|255<<8|0) CONFIG_NSH_BUILTIN_APPS=y # # LCD Drivers settings CONFIG_NX_LCDDRIVER=y CONFIG_LCD_SSD1783=y # # Graphics CONFIG_NX=y CONFIG_NXCONSOLE=n CONFIG_NX_KBD=y CONFIG_LCD_MAXPOWER=1 CONFIG_NX_BLOCKING=y CONFIG_NX_DISABLE_1BPP=y CONFIG_NX_DISABLE_2BPP=y CONFIG_NX_DISABLE_4BPP=y CONFIG_NX_DISABLE_8BPP=n CONFIG_NX_DISABLE_16BPP=y CONFIG_NX_DISABLE_32BPP=y CONFIG_NXCONSOLE_BPP=8 CONFIG_NXCONSOLE_NOGETRUN=y CONFIG_NXFONT_SANS17X22=y CONFIG_NX_MULTIUSER=n CONFIG_EXAMPLES_NXTEXT_BPP=8 CONFIG_EXAMPLES_NXTEXT_DEVNO=0 # # Settings for examples/hello CONFIG_EXAMPLES_HELLO_BUILTIN=y CONFIG_EXAMPLES_NXHELLO_BUILTIN=y CONFIG_EXAMPLES_NXTEXT_BUILTIN=y CONFIG_EXAMPLES_NXIMAGE_BUILTIN=y CONFIG_EXAMPLES_NXLINES_BUILTIN=y CONFIG_EXAMPLES_NXLINES_EXTERNINIT=y CONFIG_EXAMPLES_NXHELLO_EXTERNINIT=y CONFIG_EXAMPLES_NXTEXT_EXTERNINIT=y CONFIG_EXAMPLES_NXIMAGE_EXTERNINIT=y # # Settings for examples/wget # CONFIG_EXAMPLE_WGET_URL - The URL of the file to get # CONFIG_EXAMPLE_WGET_NOMAC - (May be defined to use software assigned MAC) # CONFIG_EXAMPLE_WGET_IPADDR - Target IP address # CONFIG_EXAMPLE_WGET_DRIPADDR - Default router IP addess # CONFIG_EXAMPLE_WGET_NETMASK - Network mask CONFIG_EXAMPLE_WGET_URL="http://www.nuttx.org/index.html" CONFIG_EXAMPLE_WGET_NOMAC=y CONFIG_EXAMPLE_WGET_IPADDR=(10L<<24|0L<<16|0L<<8|2L) CONFIG_EXAMPLE_WGET_DRIPADDR=(10L<<24|0L<<16|0L<<8|1L) CONFIG_EXAMPLE_WGET_NETMASK=(255L<<24|255L<<16|255L<<8|0L) # # Stack and heap information # # CONFIG_BOOT_RUNFROMFLASH - Some configurations support XIP # operation from FLASH but must copy initialized .data sections to RAM. # CONFIG_BOOT_COPYTORAM - Some configurations boot in FLASH # but copy themselves entirely into RAM for better performance. # CONFIG_CUSTOM_STACK - The up_ implementation will handle # all stack operations outside of the nuttx model. # CONFIG_STACK_POINTER - The initial stack pointer (arm7tdmi only) # CONFIG_IDLETHREAD_STACKSIZE - The size of the initial stack. # This is the thread that (1) performs the inital boot of the system up # to the point where user_start() is spawned, and (2) there after is the # IDLE thread that executes only when there is no other thread ready to # run. # CONFIG_USERMAIN_STACKSIZE - The size of the stack to allocate # for the main user thread that begins at the user_start() entry point. # CONFIG_PTHREAD_STACK_MIN - Minimum pthread stack size # CONFIG_PTHREAD_STACK_DEFAULT - Default pthread stack size # CONFIG_HEAP_BASE - The beginning of the heap # CONFIG_HEAP_SIZE - The size of the heap # CONFIG_BOOT_RUNFROMFLASH=n CONFIG_BOOT_COPYTORAM=n CONFIG_CUSTOM_STACK=n #CONFIG_STACK_POINTER CONFIG_IDLETHREAD_STACKSIZE=4096 CONFIG_USERMAIN_STACKSIZE=4096 CONFIG_PTHREAD_STACK_MIN=256 CONFIG_PTHREAD_STACK_DEFAULT=4096 CONFIG_HEAP_BASE= CONFIG_HEAP_SIZE= # Application configuration CONFIG_APPS_DIR="../apps" --nextPart2762333.I70qBvf3Po--

12 years

1
0
0 0

jtag trouble j100i

by Mathias K.

Hello, i try to connect the j100i with the latest openocd (git) but there is always something wrong with the embedded ice module. My configuration script is based on openocd_calypso.cfg and the calypso_magic.svf. The main difference i can see is the idcode and the irlen. My changes in the script looks like this: set _CPUTAPID 0xf9001807 jtag newtap $_CHIPNAME dsp -expected-id 0x00000000 -irlen 5 jtag newtap $_CHIPNAME arm -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id $_CPUTAPID This changes are based on some appended svf scripts that simple scan the jtag chain to get more informations. The jtag_idcodes.svf returns the shifted idcodes like this: SDR 32 TDI(ffffffff); length = 32 TDI = 0xFFFFFFFF TDO read = 0xF200300E SDR 32 TDI(ffffffff); length = 32 TDI = 0xFFFFFFFF TDO read = 0xFFFFFFFF The jtag_devices.svf told me the device count and the possible ir register count/length: SIR 32 TDI(ffffffff); length = 32 TDI = 0xFFFFFFFF TDO read = 0xFFFFFE25 TDO: 11...11000100101 Looks like 3 ir registers with 4,3 and 2 bit length SDR 32 TDI(ffffffff); length = 32 TDI = 0xFFFFFFFF TDO read = 0xFFFFFFFC TDO: 11...1100 Looks like 2 devices But every access to the embedded ice registers (they are located in the internal scan chain 2) result in random (most time zero) values for the comms ctrl register and a cpu halt state. Is there anything wrong? Is there a different "magic" 0x0b jtag command or argument for this kind of cpu? Thanks & Regards, Mathias

12 years

2
4
0 0

Re: How to send a sms using BB

by Henk

It works Chengcheng Gou <gouchengcheng(a)gmail.com>schreef: >Hi, >anyone did try it? >

12 years

1
0
0 0

How to send a sms using BB

by Chengcheng Gou

Hi, anyone did try it?

12 years

1
0
0 0

Re: Sagem OT-290 trace phone / GSMTAP integration

by Tyson Key

Hi list, It's my first time posting here, and I've just subscribed - so apologies for totally wrecking archive threading. I've just received a copy of the e-mail regarding the OT-290, thanks to Andrew Back; and I'm wondering it's possible to discuss the feasibility of implementing this functionality with Harald - since it doesn't seem to have generated much interest from others, and I'm "fortunate" enough to live in a small British town without EDGE coverage (which should make it easier to test GPRS-related tracing functionality). Although I'm unfamiliar with how things work in Osmocom, I've previously worked on Wireshark dissectors for USB-encapsulated AT commands, and various NFC/smartcard-related protocols (PN532, FeliCa and MiFare); and am also familiar with Nokia's proprietary ISI baseband protocol, and parts of ETSI's GSM/UMTS specifications - so this sort of stuff isn't totally alien to me. I'm also currently studying Computer Science as an undergraduate (at the University of Bradford) - but I should be able to make time to work on this. Thanks, Tyson. -- Fight Internet Censorship! http://www.eff.org http://vmlemon.wordpress.com | Twitter/FriendFeed/Skype: vmlemon | 00447934365844

12 years

3
2
0 0

[PATCH] Adding the manufacturer id of STMicroelectronics (try 2)

by Christian Inci

For supporting the flash on a Motorola C118. Note: Flashing rssi on it worked fine. Signed-off-by: Christian Inci <chris.pcguy.inci(a)gmail.com>

12 years

2
1
0 0

key generation on SIM failed (cause 2)

by Alojzij Sinur

Hi, I have a question. When using osmocombb with C118, we are getting error when SIM tries to authenticate itself to the network. Here are the messages: <0005> gsm48_mm.c:3902 (ms 1) Received 'RR_DATA_IND' from RR in state location updating initiated (sapi 0) <0005> gsm48_mm.c:4091 (ms 1) Received 'MT_MM_AUTH_REQ' in MM state location updating initiated <0005> gsm48_mm.c:1637 AUTHENTICATION REQUEST (seq 2) <0005> subscriber.c:955 Generating KEY at SIM <000f> sim.c:209 got new job: SIM_JOB_RUN_GSM_ALGO (handle=00000006) <000f> sim.c:697 go MF <000f> sim.c:241 SELECT (file=0x3f00) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) <000f> sim.c:876 received APDU (len=0 sw1=0x00 sw2=0x00) <000f> sim.c:952 command failed <000f> sim.c:151 sending result to callback function (type=1) <0005> subscriber.c:990 key generation on SIM failed (cause 2) SIM is new. It works if you start phone without osmocom. And It also works if you start without osmocom and when SIM logs into network you restart the phone with osmocom. We tried several new cards and there was always same result. There is also no PIN set up (SIM is not locked). We tried with USIM. When we try old cards (>2 years old) osmocom works without problem. Have you ever encountered this kind of trouble? Is there any fix for it? Thank you. Regards, Alojzij

12 years

4
9
0 0

Sagem OT-290 trace phone / GSMTAP integration

by Harald Welte

Hi all! Thanks to a generous donor, we have received a couple of OT-290 trace phones. These are commercial products intended for taking L2/L3 air interface traces. If you've read any of the fabulous GSM papers by Prof. Dr.-Ing. Joachim Goeller: The OT-phones is what he used to generate all his traces. The majority of what those phones can do is now also possible with OsmocomBB. However, OT-290 support GPRS tracing/testing - for CS-1 throguh CS-4. I would be willing to give away one of the two remaining OT-290 (for free) to anyone who would in return commit to developing a GSMTAP interface for it. The message format on the serial UART between phone and PC is documented (PDF documentation by Sagem included with the phones). So based on this documentation and an OT-290 phone, it should be possible to write a small command-line program that receives the GSM/GPRS messages from the OT-290 and sends them via GSMTAP into wireshark. The result would then be similar to what http://cgit.osmocom.org/cgit/dct3-gsmtap/ is for DCT-3 phones. If you're interested, please respond to this message. Please don't apply for the phone if you are not able to find the required time and interest for actually doing the GSMTAP integration. Thanks! -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

12 years

2
2
0 0

Adding the manufacturer id of STMicroelectronics

by Christian Inci

For supporting the flash on a Motorola C118. Note: Flashing rssi on it worked fine. Signed-off-by: Christian Inci <chris.pcguy.inci(a)gmail.com> --- src/target/firmware/flash/cfi_flash.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/target/firmware/flash/cfi_flash.c b/src/target/firmware/flash/cfi_flash.c index 69369d5..8ecd206 100644 --- a/src/target/firmware/flash/cfi_flash.c +++ b/src/target/firmware/flash/cfi_flash.c @@ -71,6 +71,7 @@ struct cfi_query { /* manufacturer ids */ enum cfi_manuf { + CFI_MANUF_ST = 0x0020, CFI_MANUF_INTEL = 0x0089, }; @@ -532,8 +533,7 @@ int flash_init(flash_t * flash, void *base_addr) if (res) { return res; } - if (m_id != CFI_MANUF_INTEL) { - /* we only support intel devices */ + if (m_id != CFI_MANUF_INTEL && m_id != CFI_MANUF_ST) { return -ENOTSUP; } -- 1.7.8.6 --------------090106030808000805030408--

12 years

1
0
0 0

[PATCH] Adding the manufacturer id of STMicroelectronics (resend)

by Christian Inci

For supporting the flash on a Motorola C118. Signed-off-by: Christian Inci <chris.pcguy.inci(a)gmail.com>

12 years

2
1
0 0

[ticket] RSSI fails to sync on 1800Mhz bands

by Henk

Version: OSMOCOM Monitor Tool (revision osmocon_v0.0.0-1346-g186fefc-modified) RSSI is running from flash There seems to be a problem when trying to sync to the DCS bands also the spectum window is not that what you expect. There seem to be a few very strong peaks but the rest is flat.

12 years

1
1
0 0

Ramblings of a Osmocom supporter

by Henk

Hi all, First of all, what an exciting piece of hacking, well done guys! So after one year I revisited the osmocom and flashed the bootloader and the RSSI on my C116 device. I was wondering is there something of a TODO of sorts in order to get users of different skill levels involved? One thing I can think of is extending the loader with functions to access the DSP: read (p)rom, read write regs & memory, potentially adding DSP patching support. Regards, Henk

12 years

1
0
0 0

Adding the manufacturer id of STMicroelectronics

by Christian Inci

For supporting the flash on a Motorola C118. Signed-off-by: Christian Inci <chris.pcguy.inci(a)gmail.com> --- src/target/firmware/flash/cfi_flash.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/src/target/firmware/flash/cfi_flash.c b/src/target/firmware/flash/cfi_flash.c index 69369d5..474dcbb 100644 --- a/src/target/firmware/flash/cfi_flash.c +++ b/src/target/firmware/flash/cfi_flash.c @@ -71,6 +71,7 @@ struct cfi_query { /* manufacturer ids */ enum cfi_manuf { + CFI_MANUF_ST = 0x0020, CFI_MANUF_INTEL = 0x0089, }; @@ -532,7 +533,7 @@ int flash_init(flash_t * flash, void *base_addr) if (res) { return res; } - if (m_id != CFI_MANUF_INTEL) { + if (m_id != CFI_MANUF_INTEL && m_id != CFI_MANUF_ST) { /* we only support intel devices */ return -ENOTSUP; } -- 1.7.8.6 --------------020907080906030400030607--

12 years

1
0
0 0

uwire.c relicensing

by Denis 'GNUtoo' Carikli

Hi, We(Alan Carvalho de Assis and me) also need the permission of Sylvain Munaut and Steve Markgraf for the relicensing of src/target/firmware/ of osmocombb for inclusion in nuttx(BSD licensed). What we need right now is to get the permission on that file: src/target/firmware/calypso/uwire.c Basically we want to add LCD support as quickly as possible to the compal e99(And in parallel to fix the configs and the linker scripts to get more space). Denis.

12 years

2
1
0 0

May 09, 7pm / Osmocom meeting in Berlin

by Harald Welte

Hi all! This is the announcement for the 3rd incarnation of our bi-weekly Osmocom Berlin meeting. May 09, 7pm @ CCC Berlin, Marienstr. 11, 10113 Berlin The schedule is as follows: 19:00 Introduction / Workshop on Osmocom SIMtrace (Kevin Redon) Kevin will introduce SIM/USIM/UICC cards, present what SIMtrace is and how it works, as well as how to use it to trace communication between SIM card and phone. 20:00 Informal discussions If you are interested to show up, feel free to do so. There is no registration required. If the initial part is not interesting to you, feel free to join us later at 20:00. The meeting is free as in "free beer", despite no actual free beer being around ;) Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

12 years

1
0
0 0

BER

by Micka A.

Hello, there is one question, how in layer23 calculates BER?? for example it shows 143.. 120 .. and so on, there for sure not percent.

12 years

1
0
0 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

baseband-devel May 2012