- baseband-devel - lists.osmocom.org

PLMN Scan Rate when off network
by Kurtis Heimerl 24 Apr '12

24 Apr '12

Hi Baseband, I'm trying to figure out if there's any standard set for how often a handset should scan for signal when out of coverage. I haven't been able to find much, just the following in 3GPP TS 22.011: 3.2.2.2 At switch-on or recovery from lack of coverage If registration cannot be achieved on any PLMN, the UE shall indicate "no service" to the user, wait until a new PLMN is detected, or new location areas of an allowed PLMN are found which are not in the forbidden LA list(s), and then repeat the procedure. When registration cannot be achieved, different (discontinuous) PLMN search schemes may be used in order to minimize the access time while maintaining battery life, e.g. by prioritising the search in favour of BCCH carriers which have a high probability of belonging to an available and allowable PLMN. Sounds like it's up to each manufacturer to just pick a delay? Any other thoughts/intuitions which might help us bound this number? Thanks!

1 0

Osmocom RRLP
by maxfeldman14＠berkeley.edu 24 Apr '12

24 Apr '12

To whom it may concern: Has anyone implemented RRLP request handling in osmocombb's layer 3? We are particularly interested in the transmission of GPS data. Additionally, if anyone has any helpful advice/documentation on the message format which is more detailed or useful than the gsm 04.31 spec we would greatly appreciate it. Thanks you, Max Feldman

1 0

April 25, 7pm / Regular Osmocom meeting in Berlin?
by Harald Welte 23 Apr '12

23 Apr '12

Hi all! This is the announcement for the 2nd incarnation of our bi-weekly Osmocom Berlin meeting. April 25, 7pm @ CCC Berlin, Marienstr. 11, 10113 Berlin The schedule is as follows: 19:00 Introduction into the TETRA base station located @ CCCB For quite some time, there is a full TETRA base station located in the Berlin CCC, consisting of two base radios (BR), a site controller (TSC), an auto-tuning cavity combiner and other equipment. The talk will introduce the architecture of the system and the current status of getting it running. 20:00 Presenting the CC32RS512 / towards an Osmocom Card OS The CC32RS512 is a flash-based smart card controller to which the documentation is available without NDA. This means that we finally are able to implement a Smart Card OS (COS) as free software. 20:30 Informal discussions If you are interested to show up, feel free to do so. There is no registration required. If the initial part is not interesting to you, feel free to join us later at 20:30. The meeting is free as in "free beer", despite no actual free beer being around ;) Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

Basic Set Up For PCS 1900
by rola 21 Apr '12

21 Apr '12

Hi all: I've been on and off trying to set up Osmocom-BB for quite a while now. I've tried using several Cxxx with no luck of being able to lock on to a cell. I shifted to Pirelli_dpl10 hoping to avoid configuration change required of dual-band phones to work with Osmocom-BB but no positive outcome. I'm using Sylvain testing branch with transmit enabled; create mobile config file with PCS1900 and GSM850 as the only bands to be supported. For US Motorola dual band phones c139 and c155, I modified the required section of the rffe file to support PCS1900; and for Pirelli, I made the recommended modification to UART option before being able to communicate with the device. I guess I did all what need to be done for preliminary setting. Layer1 load perfectly but mobile application never work. Sim reader worked perfectly; Sim information was read, mobile app used the previous PLMN information to start power measurement. I was able to get average power of -92dB with Pirelli but while still performing the scanning the result output repeatedly fix prim_pm.c file with value to be overwrite message. I guess the issue has to do with passing the right parameters to layer1 to perform ARFCN scanning in order to obtain power measurement of the available channels. I'm not really sure if there is need to modify any part of layer1 or Rita files before accurate measurement could be done for PCS1900. I'm not that deeply knowledgeable in GSM standard but I can still figure out what to do if any hint is given toward what need to be done before PCS1900 band will work with any osmocom-compatible phone. I know that some people have worked on PCS1900 and GSM850 but there is no information towards what need to be done in terms of specific file to hack to change default GSM900 and DCS1800 bands configurations to GSM850 and PCS1900. I am pretty much sure that If I were in Europe I would by now step up from trying to make Osmocom lock to a serving cell to the point studying the code to work for a specific purpose. I am using the project as part of thesis work to analyze the Um interface and to explain processes that occur between BTS and mobile station. I will so much appreciate it if anyone could be of any help. Thanks. Rasak -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Basic-Set-Up-For-PCS-1900-tp3927… Sent from the baseband-devel mailing list archive at Nabble.com.

1 0

CKSN clarification
by Max 20 Apr '12

20 Apr '12

Hello. CKSN - Ciphering Key Sequence Number is associated with Kc and is a bit trickier than trivial counter. According to GSM 04.08 (p. 278 in v5.3.0 in my case) it's comprised as follows: * 3 bits - actual key sequence (value 111 seems to be reserved) * 1 bit - always 0 * 3 bits - CKSN IEI Could you help me to understand how to properly generate it: - the last bit (8th) is not specified - does it mean it's always 0? - what is CKSN IEI and how do I calculate\use it? - am I right that 3-bit key seq. value is simple counter that I increment with each Kc generation? - what do I do when key seq. reach 6 - start over with 0 again? And of course I'm interested if CKSN-related code is available as part of libosmogsm or some other open source project: the code is always helpful in understanding and I don't have to reinvent the wheel :) best regards, Max.

3 3

Mobile phone to act as RF frequency sesnor and detector
by Winston Ojenge 20 Apr '12

20 Apr '12

Dear all, I lecture at strathmore university, Kenya, East Africa. For my PhD, i need to develop a cell-phone model that senses and recognizes a specific RF frequency from a source. It then submits the value of that frequency by SMS. Is it possible to use the OsmocomBB platform to program such a device using motorola C123? Ojenge

2 7

How to implement HLR lookup free
by Chengcheng Gou 18 Apr '12

18 Apr '12

hello How to implement HLR lookup free ?

4 3

bug report about mobile
by Chengcheng Gou 17 Apr '12

17 Apr '12

I am testing mobile app and when the program exit, it occur the flowing errors: Dropping frame with 85 bit errors LOSS counter for ACCH 31 Dropping frame with 85 bit errors Dropping frame with 86 bit errors Dropping frame with 78 bit errors LOSS counter for ACCH 30 Dropping frame with 79 bit errors Dropping frame with 77 bit errors Dropping frame with 86 bit errors

1 0

how to establish a dedicated channel using OsmocomBB
by Chengcheng Gou 16 Apr '12

16 Apr '12

hello anyone can give a demo in the misc floder?

1 0

Interest in a driver for MT5921 wifi chip?
by Heiko Stübner 13 Apr '12

13 Apr '12

Hi, Synopsis -------- I started on a driver for the MT5921 wlan chip from MediaTek and am now trying to find developers wo would be interested in this, as I don't have the necessary knowledge of the whole wireless part, or to determine if trying this is completely futile. Available is: - a (hopefully) nearly complete register-map of the chip - my initial work of basic communication through its spi interface up to and including reading the chips eeprom - a proprietary driver through which it's possible to log the spi-traffic Also it seems I would be able to provide hardware to interested parties. MT5921 and MediaTek ------------------- The MT5921 [1] can be connected via SPI, SDIO, HPI and compact flash. It seems to be used mostly in phones based on MediaTek SoCs, but also gained a relatively wide spread through the ebook readers from Qisda (Oyo in germany, Fnacbook / Sagem Binder in france, bq Avant in spain, Positivo Alfa in brazil, Mr. Book in russia, ...). MediaTek itself does not provide any information about the chip and also does not seem to answer inquiries [via various channels] at all. From talks to some of the device makers, I gathered that MediaTek also completely refuses to release any material to them. The proprietary driver mentioned above also seems to have been made by MediaTek directly. The device ---------- I'm working on the Qisda ebook readers mentioned above (S3C2416 with 400MHz or S3C2450 with 533MHz depending on the device). The overall support at this point is quite good, including the driver for the epd controller, multitouch- capable capacitive touchscreen, suspending and resuming the device. Impressions of these devices can be found on [2]. I have a spare "Oyo 1" that was donated to me, that I could redonate for this and it seems I could gain the support of one of the device makers, who will also supply a small number of devices, if I can find interested developers for this endavour. State of the driver ------------------- The kernel release by Alcatel of their OT890 [3] did include headers describing most of the chips registers and the eeprom structure of the sdio version. It explicitly did non include sources for the wifi driver itself. For things like chip signature and mac address, the eeprom struct also matches the spi version, so I guess it could match also for most of the non-sdio stuff On the Qisda devices modifying the underlying spi-dev driver makes it possible to log the traffic the module sends to and receives from the chip.There also exists a debug-version of the proprietary module that emits more in-depth information on what it's currently doing [4]. I also build a crude script [5] to convert these dumps to a representation of registers and constants form the header. There are probably better tools around to do such things, but it made the reading of the dumps easier, like: Array ( [mode] => write [register] => MCR_RFCR [reg-desc] => Receive Filter Control Register [valstr] => RFCR_RX_SAMEBSSIDPRORESP_CTRL | RFCR_RX_SAMEBSSIDBCN_CTRL [unmatched] => 0x0 ) As written above, bringup of and basic communication with the device works and I'm lacking the necessary knowledge of the whole wireless part. So, if anybody is interested in this I would be very happy :-) . Thanks Heiko [1] http://www.mediatek.com/en/Products/product_content.php?sn=48 [2] http://www.youtube.com/user/MMind81 [3] http://sourceforge.net/projects/alcatel/files/ [4] examples in https://gitorious.org/oyo-hack/kernel/blobs/topic/board/sg060/drivers/net/w… https://gitorious.org/oyo-hack/kernel/blobs/topic/board/sg060/drivers/net/w… [5] https://gitorious.org/oyo-hack/kernel/blobs/topic/board/sg060/drivers/net/w…

1 0

The mobile app error
by Chengcheng Gou 13 Apr '12

13 Apr '12

hello I run the mobile app, but the error occur: What about the cause of the error,and how to solve it? Thanks！ LOSS counter for ACCH 31 Dropping frame with 86 bit errors Dropping frame with 84 bit errors Dropping frame with 79 bit errors LOSS counter for ACCH 30 Dropping frame with 82 bit errors Dropping frame with 82 bit errors Dropping frame with 89 bit errors LOSS counter for ACCH 29 Dropping frame with 86 bit errors Dropping frame with 76 bit errors Dropping frame with 70 bit errors LOSS counter for ACCH 28 Dropping frame with 88 bit errors Dropping frame with 79 bit errors Dropping frame with 70 bit errors LOSS counter for ACCH 27

1 0

Looks connected but no cells avaible ?
by nicki240 10 Apr '12

10 Apr '12

Hi If I insert show cell 1 , it will show me no cells . show cell 1 : ARFCN |MCC |MNC |LAC |cell ID|forb.LA|prio |min-db |max-pwr|rx-lev -------+-------+-------+-------+-------+-------+-------+-------+-------+------- OsmocomBB# But It found a signal and I have an IMSI For more Information and help with the Call rejected Problem here : http://baseband-devel.722152.n3.nabble.com/Call-has-been-rejected-tt3896636… Thanks and Sorry for bad English -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Looks-connected-but-no-cells-ava… Sent from the baseband-devel mailing list archive at Nabble.com.

1 0

Encrypted GSM phone
by Marek Stopka 10 Apr '12

10 Apr '12

Hi, I have been just wondering... would it be possible to use your project as a base for DIY encrypted cellphone? My idea is that if I could get hold to output data after voice is encoded by GSM EFR codec, I might just easily encrypt this digital stream using AES128 and build trully encrypted cellphone. Where does actual "analog voice from microphone to digital data" conversion happends? In a layer1 that runs in a chip, or layer23 that runs on a PC? If it would be in layer23, encrypting a data stream with AES 128 whould be doable, am I missing something? Thanks Marek -- S pozdravem / Best regards Marek Stopka Kontakty / Contacts Mobil/Cell phone:+420 608 149 955 WEB: www.stopkaconsulting.eu

9 10

Call has been rejected
by nicki240 09 Apr '12

09 Apr '12

hi If I try to call someboady , I'll get in the telnet connection this Error : OsmocomBB# call 1 0176********** OsmocomBB# % (MS 1) % Call has been rejected .mobile : <0009> mnccms.c:570 Make call to 0176********** <0009> mnccms.c:150 support TCH/H also <0009> mnccms.c:174 support full rate v2 <0009> mnccms.c:178 support full rate v1 <0009> mnccms.c:187 support half rate v1 <0006> transaction.c:76 ms 1 allocates transaction (proto 3 trans_id 255 callref 2 mem 0x8cfdd28) <0006> gsm48_cc.c:243 new state NULL -> MM_CONNECTION_PEND <0006> gsm48_cc.c:507 Sending MMCC_EST_REQ <0005> gsm48_mm.c:3774 (ms 1) Received 'MMCC_EST_REQ' event in state MM idle <0005> gsm48_mm.c:3777 -> substate PLMN search <0005> gsm48_mm.c:3779 -> callref 2, transaction_id 255 <0005> gsm48_mm.c:3042 Init MM Connection, not in normal state. <0006> gsm48_cc.c:2161 (ms 1) Received 'MMCC_REL_IND' in CC state MM_CONNECTION_PEND <0006> gsm48_cc.c:196 (ms 1 ti ff) Sending 'MNCC_REL_IND' to MNCC. <0006> gsm48_cc.c:243 new state MM_CONNECTION_PEND -> NULL <0006> transaction.c:104 ms 1 frees transaction (mem 0x8cfdd28) <0009> mnccms.c:372 Call has been released (cause 21) <0009> mnccms.c:71 (call 2) Call removed. osmocon : 8a 00 80 00 00 00 00 00 00 90 00 SIM Request (7): a0 a4 00 00 02 7f 10 SIM Response (2): 9f 1e SIM Request (5): a0 c0 00 00 1e SIM Response (32): 00 00 00 20 7f 10 02 00 f4 4f ff 01 11 bb 01 0f 05 00 83 8a 83 8a 00 80 00 00 00 00 00 00 90 00 SIM Request (7): a0 a4 00 00 02 6f 40 SIM Response (2): 9f 0f SIM Request (5): a0 c0 00 00 0f SIM Response (17): 00 00 00 7c 6f 40 04 00 11 ff 44 01 02 01 1f 90 00 SIM Request (5): a0 b2 01 04 1f SIM Response (33): ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 90 00 SIM Request (7): a0 a4 00 00 02 6f 42 SIM Response (2): 9f 0f SIM Request (5): a0 c0 00 00 0f SIM Response (17): 00 00 00 e1 6f 42 04 00 11 ff 44 01 02 01 2d 90 00 SIM Request (5): a0 b2 01 04 2d SIM Response (47): ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f1 ff ff ff ff ff ff ff ff ff ff ff ff 07 91 94 71 07 16 00 00 ff ff ff ff 00 00 ff 90 00 Can somebody help me ? thx nicki240 -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Call-has-been-rejected-tp3896636… Sent from the baseband-devel mailing list archive at Nabble.com.

1 0

Layer1 reset type
by Chengcheng Gou 09 Apr '12

09 Apr '12

hello can anyone explain the different in the three reset types? L1CTL_RES_T_BOOT L1CTL_RES_T_FULL L1CTL_RES_T_SCHED thanks!

1 0

900MHz packet radio?
by Kristen Eisenberg 08 Apr '12

08 Apr '12

I hear what you are saying, and we are working to support inter-BTS meshing for OpenBTS and OpenBSC. However, there is also value in getting the phones to mesh, if only because there are plenty situations where you might not be able to get a BTS, or be able to use any BTS that is around. Kristen Eisenberg Billige Flüge Marketing GmbH Emanuelstr. 3, 10317 Berlin Deutschland Telefon: +49 (33) 5310967 Email: utebachmeier at gmail.com Site: http://flug.airego.de - Billige Flüge vergleichen

1 0

unmerged patches
by jolly 08 Apr '12

08 Apr '12

hi, i just collected all my patches together that i would have merged: 1. i added two patches to jolly/battery branch of osmocombb. it will add a font with symbols and display them at rssi. since i did not receive a reply about that from christian, i pushed it in this seperate branch so far. christian, if you find the time, just look at it. 2. there are several patches in my "testing" branch at jolly/ui of osmocombb. these patches are tested and work quite well. the are not related to the ui. i think they could me mergend: commit 66c21b3b7d30db205202d46893032ae2a73992a2 layer23: Send SIM APDUs via GSMTAP Usefull to trace SIM messages together with Um messages. commit b9ff5044a5fcbd07e6a295d75e14c7c504259914 layer23: Be sure to close mncc socket on exit of mobile instance commit e30e351d66f07e6effee768412a9d8f31202b4ed layer1: Retry fist power measurement, if it seems to fail In some cases (e.g. after a call with TCH) the first power measurement after a full reset will always return 0 (-110dbm). In this case the measurment is repeated once again. This is just a workarround, and it will not fix the actual cause. 3. there are several additions and fixes at jolly/rtpmux branch of openbsc. commit db3a7dd357bd7cd842a80655e734a1b4afdb6f7c and commit 872c6c002add0a741514aa505df9379a6fcdb955 allow to exchange traffic via rtp with a given rtp endpoint. the destination can be controlled via mncc interface. the result is that the traffic is not routed via mncc interface, but directly exchanged with the given rtp endpoint. lcr supports that, so traffic between sip and openbsc is directly forwarded and not routed through lcr and mncc interface. commit 3d407e7c8e5c4e01dc07a530f910d29fac687809 and commit f47d13e55888576c9201a3a7fee04fc58f98ff66 will handle bad frames from e1 bts. if a frame is bad, the rtp packet is dropped (if forwarded via rtp). if the bad frame is received by lcr via mncc interface, lcr will extrapolate the missing audio by repeating last valid frame with reduced value. instead of having a distrorted sound, the audio stream will now be clear, even if some frames are bad. commit 0193b8a76824cdce9d9da3f7374a928efac6f96c allows dynamic payload types when forwarding rtp traffic to a given rtp endpoint. (used for EFR/AMR/HR) commit ea724c6af9e1a5b6df8d0e5965f357896834d3ce and commit a22e598c0a93f88433c6a00bd2acdde5c2f496d5 will fix the problems with delay and loosing audio at nanobts. it uses system clock as a basis to correct timestamp and sequence number of frames transmitted to the bts. commit bf14b25358f7ceb021e2397e90c2fb9484245b7b fixes problem with interruption of traffic, if packet transmission via rtp fails in the beginning. the result of all these patches is a reliable audio stream. the call waiting works, as well as hold/retrieve of calls without audio interruption or increasing/high delay. (even if database access makes openbsc stop for some time.) in conjuction with lcr, a sip gateway can directly exchange audio traffic with openbsc. the codec to be used is negotiated between SIP gateway and MS. (depending on support and preference) 4. long time ago i extraced the sms protocols "smc" and "smr" (TS 11.11) from openbsc and added a state machines. they are now part of libosmocore and are used for sending/receiving sms via osmocombb. i removed all that code from openbsc and use libosmocore instead. see jolly/sms for the 4 patches. i hope that was not too much at a time :) regards, andreas

1 0

the ccch number
by Chengcheng Gou 08 Apr '12

08 Apr '12

hello 1.if a cell has multiple TRX, and the CCCH number >1,then can the phone request channel on other timeslot but timeslot 0 in the uplink; how does a real phone deal with it? 2.how to mitigate the RACH DOS in the GSM network? anyone can help me?

1 0

detecting TMSI and Bursts relation?
by Simian Denson 08 Apr '12

08 Apr '12

Hi, is it technically possible to sniff the air traffic (for example with ccch_scan from the osmocombb burst_ind branch) and correlate the relationship between a burst and a paging request (which contains the tmsi of the mobile) ? Basically: What are the steps to determine which tmsi (mobile) did which burst ? Thank you for your information! cheers, Simian

1 0

how to identify the BTS belong to which BSC
by Chengcheng Gou 05 Apr '12

05 Apr '12

I want to know if there is a method for that, Thanks!

1 0

Reliablility problem in current git?
by Tim Ehlers 04 Apr '12

04 Apr '12

Hi, I have a git clone from 23.01.2012 and a current git clone. When I compile both and use the mobile appliation, I have a strange problem in the current code. Very often I can't send USSD codes (and maybe also can't communicate in other ways; USSD is the costless way to check whether I am connected or not). Ok, this is what I do: I send "service 1 *#21#", wait the answer and the string "% On Network, normal service: Germany, O2". Then send it again and so on. With the old code, I reliable get the answer e.g. "% Status: deactivated". With the new code, I very often (sometime already when trying first time) get nothing back and after some seconds only "% Service connection terminated.". Can someone confirm this behavior? Thanks Tim

4 20

Basic build problem.
by Andrew Back 04 Apr '12

04 Apr '12

Hello, I'm experiencing problems getting started with building BB and wondered if someone might be able to advise. Seems that whenever I specify a toolchain prefix it is ignored. E.g. $make -e CROSS_TOOL_PREFIX=arm-none-linux-gnueabi- Results in an error: "configure: error: in `/home/andrew/Work/AB Open/Projects/GSM/Osmocom/osmocom-bb/src/shared/libosmocore/build-target': configure: error: C compiler cannot create executables See `config.log' for more details" If I check ./shared/libosmocore/build-target/config.log for instances of "arm" these are all still "arm-none-eabi", which I do not have. The prefix example above was to attempt to use CodeSourcery Lite tools. I've also tried with a prefix of "arm-linux-gnueabi-" to use a toolchain installed from Emdebian via apt-get, and I experience the same problem. Although in searching for a fix I read something which suggested that the Emdebian toolchains may be no use. So, am I doing something wrong in the first step? And is there perhaps another toolchain I should be using? Apologies if this has already been answered — I have done a bit of searching but only found similar errors where a prefix was not being specified. Regards, Andrew -- Andrew Back http://carrierdetect.com

2 4

Re: Recording / Re: Regular Osmocom meeting in Berlin?
by Katrin Verclas 01 Apr '12

01 Apr '12

It was my understanding from your suggestion that there would be presentations and discussions after those presentations at the meetings, making this not just having a beer with friends but more formal affairs. That would be useful for people elsewhere to see, given that this is a global community. Not sure what German law has to do with putting online or streaming such presentations. Cameras off when it comes to the informal part and beer time.. Love this list otherwise. And will come to Berlin this summer so may attend one or two, regardless :) Cheers from New York. K ------Original Message------ From: Harald Welte To: Katrin Verclas Cc: Holger Hans Peter Freyther Cc: Akib Sayyed Cc: baseband-devel(a)lists.osmocom.org Cc: openbsc(a)lists.osmocom.org Subject: Recording / Re: Regular Osmocom meeting in Berlin? Sent: Mar 31, 2012 8:01 AM Hi Katrin, On Fri, Mar 30, 2012 at 07:17:17PM +0000, Katrin Verclas wrote: > Could not disagree more. We live-stream local events all the time with > a very unobtrusive webcam/ustream and it bothers no one who is there > but benefits all who are not. And I couldn't disagree more with you. The mere existance of the two words 'camera' and 'unobtrusive' in one sentence are a contradiction in terms. If I want to meet with a small group of people and informally discuss technical topic, than that is _very_ different from being live streamed to an unknonwn number of people, any of which could make recordings and I would have to very carefully think about each and every word that I'm saying. That's not a particularly relaxed environment and would kill all the fun there is in having the meeting in the first place. Legally, In Germany this corresponds to "not publicly spoken word" (nicht oeffentlich gesprochenes Wort). It is punishable under law to record or broadcast that. (Clause 201 of German criminal code). Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6) Sent via mobile. Hence, short.

2 1

how to debug the firmware apps
by Chengcheng Gou 31 Mar '12

31 Mar '12

Hello I want to write an app in the form of Firmware, and don`t know how to debug it effectively! anyone has good suggestions, please? Thanks!

2 1

Re: Regular Osmocom meeting in Berlin?
by Katrin Verclas 31 Mar '12

31 Mar '12

Could not disagree more. We live-stream local events all the time with a very unobtrusive webcam/ustream and it bothers no one who is there but benefits all who are not. Best, Katrin ------Original Message------ From: Holger Hans Peter Freyther Sender: baseband-devel-bounces(a)lists.osmocom.org To: Akib Sayyed Cc: baseband-devel(a)lists.osmocom.org Cc: openbsc(a)lists.osmocom.org Subject: Re: Regular Osmocom meeting in Berlin? Sent: Mar 30, 2012 3:13 PM On 03/30/2012 07:27 PM, Akib Sayyed wrote: > even i am in.people who cannot participate please make some > arrangement for them like live streaming and chat support. > <http://www.ustream.tv/ support free live streaming> Hi, I don't think this is a good idea. It kills the local atmosphere without having any real benefit. Every decision/code and most likely slides will be public anyway. z. Sent via mobile. Hence, short.

3 2

Older releases OsmocomBB
by ondra2000＠centrum.cz 31 Mar '12

31 Mar '12

Hi all, please how can I download some older release of osmocombb source?I have compiled osmocombb source about 3 months ago and everything was ok...now I downloaded using git some new version and compile it and my phone repeatedly register/unregister with network. Sometimes if can call to this phone but I can't send SMS....So I want compile some older version of source code which worked for me. Thanks BR Ondrej

3 2

Regular Osmocom meeting in Berlin?
by Harald Welte 31 Mar '12

31 Mar '12

Hi all, I was pondering to start a regular Osmocom meeting (monthly or bi-weekly) in Berlin. The idea would be not only to converge the existing developers in Berlin (zecke, roh, prom, tobias, peter, kevin, myself, ...) but to also try to share some knowledge and excitement with other interested hackers in the wider community. A split format for the event might make sense: Have a more or less organized 45min talk about one particular topic + 15min discussion and then switch to an informal meeting style without any particular topic or moderator. For the first half there is a long list of topics intended at informing people about the status and capabilities of the respective projects: OsmocomBB, OsmoTETRA, OsmoGMR, SIMtrace, etc. Regarding the venue, I would suggest to hold it at the Berlin CCC. What do you generally think about this? What day of the week should we be aiming at? Tuesday and Thursday is generally not a good idea, as those are already occupied with other events. If you think it's a good idea, I would request/register the event with the CCC Berlin. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

11 13

battery and rx-level symbols
by Andreas Eversberg 30 Mar '12

30 Mar '12

hi christian, just added a symbol font to display battery level and rx level to layer1. also i added these symbols to rssi. regards, andreas

1 0

[PATCH 2/2] layer1/rssi: Adding battery status and rx-level symbol to RSSI.
by Andreas Eversberg 30 Mar '12

30 Mar '12

--- src/target/firmware/apps/rssi/main.c | 17 +++++++++++++++-- 1 files changed, 15 insertions(+), 2 deletions(-) diff --git a/src/target/firmware/apps/rssi/main.c b/src/target/firmware/apps/rssi/main.c index a189740..43713db 100644 --- a/src/target/firmware/apps/rssi/main.c +++ b/src/target/firmware/apps/rssi/main.c @@ -50,6 +50,7 @@ #include <osmocom/gsm/rsl.h> #include <osmocom/gsm/protocol/gsm_04_08.h> #include <osmocom/gsm/gsm48_ie.h> +#include <battery/battery.h> enum key_codes key_code = KEY_INV; int key_pressed = 0; @@ -170,6 +171,7 @@ static void print_display(char *text, int *y, int c) static void refresh_display(void) { char text[16]; + int bat = battery_info.battery_percent; fb_clear(); @@ -179,9 +181,20 @@ static void refresh_display(void) fb_setfg(FB_COLOR_BLUE); fb_setfont(FB_FONT_HELVR08); fb_gotoxy(0, 7); - fb_putstr("Osmocom Monitor Tool", -1); - fb_gotoxy(0, 10); + fb_putstr("Osmocom RSSI", -1); + fb_setfg(FB_COLOR_RGB(0xc0, 0xc0, 0x00)); + fb_setfont(FB_FONT_SYMBOLS); + fb_gotoxy(framebuffer->width - 15, 8); + sprintf(text, "@%c%c%cC", (bat >= 30) ? 'B':'A', + (bat >= 60) ? 'B':'A', (bat >= 90) ? 'B':'A'); + fb_putstr(text, framebuffer->width); + fb_gotoxy(0, 8); + sprintf(text, "%c%cE%c%c", (power >= 40) ? 'D':'G', + (power >= 10) ? 'D':'G', (power >= 10) ? 'F':'G', + (power >= 40) ? 'F':'G'); + fb_putstr(text, framebuffer->width); fb_setfg(FB_COLOR_GREEN); + fb_gotoxy(0, 10); fb_boxto(framebuffer->width - 1, 10); } fb_setfg(FB_COLOR_BLACK); -- 1.7.3.4 --------------020300040706040007050809--

1 0

[PATCH 1/2] layer1/fb: Adding new font for symbols
by Andreas Eversberg 30 Mar '12

30 Mar '12

The first symbols added are special characters to display battery status and receive level. --- src/target/firmware/Makefile | 3 +- src/target/firmware/fb/font.c | 2 + src/target/firmware/fb/symbols.c | 102 +++++++++++++++++++++++++++++++++ src/target/firmware/include/fb/font.h | 1 + 4 files changed, 107 insertions(+), 1 deletions(-) create mode 100644 src/target/firmware/fb/symbols.c diff --git a/src/target/firmware/Makefile b/src/target/firmware/Makefile index 21892a4..a71eef6 100644 --- a/src/target/firmware/Makefile +++ b/src/target/firmware/Makefile @@ -9,7 +9,8 @@ APPLICATIONS?=hello_world compal_dsp_dump layer1 loader chainload rssi # Framebuffer support, board specific drivers # -FB_OBJS=fb/framebuffer.o fb/font.o fb/helvR08.o fb/helvB14.o fb/c64.o +FB_OBJS=fb/framebuffer.o fb/font.o fb/helvR08.o fb/helvB14.o fb/c64.o \ + fb/symbols.o FB_e88_OBJS=$(FB_OBJS) fb/fb_bw8.o fb/fb_st7558.o FB_e99_OBJS=$(FB_OBJS) fb/fb_rgb332.o fb/fb_ssd1783.o diff --git a/src/target/firmware/fb/font.c b/src/target/firmware/fb/font.c index d98096f..18c1bfe 100644 --- a/src/target/firmware/fb/font.c +++ b/src/target/firmware/fb/font.c @@ -32,6 +32,7 @@ extern const struct fb_font font_helvR14; extern const struct fb_font font_helvB14; // extern const struct fb_font font_helvB24; extern const struct fb_font font_c64; +extern const struct fb_font font_symbols; const struct fb_font *fb_fonts[]={ // &font_4x6, @@ -43,6 +44,7 @@ const struct fb_font *fb_fonts[]={ &font_helvB14, // &font_helvB24, &font_c64, + &font_symbols, }; const struct fb_char * diff --git a/src/target/firmware/fb/symbols.c b/src/target/firmware/fb/symbols.c new file mode 100644 index 0000000..5f6c364 --- /dev/null +++ b/src/target/firmware/fb/symbols.c @@ -0,0 +1,102 @@ +#include <fb/font.h> +static const uint8_t font_symbols_data[] = { +/* @ battery - */ + /*0000:*/ 3, 3, 8, 0, 0, /* width and bbox (w,h,x,y) */ + /*0005:*/ 0x60, /* .##..... */ + /*0006:*/ 0x40, /* .#...... */ + /*0007:*/ 0x40, /* .#...... */ + /*0008:*/ 0x40, /* .#...... */ + /*0009:*/ 0x40, /* .#...... */ + /*000a:*/ 0x40, /* .#...... */ + /*000b:*/ 0x40, /* .#...... */ + /*000c:*/ 0x60, /* .##..... */ +/* A battery empty */ + /*000d:*/ 3, 3, 8, 0, 0, /* width and bbox (w,h,x,y) */ + /*0012:*/ 0xe0, /* ###..... */ + /*0013:*/ 0x00, /* ........ */ + /*0014:*/ 0x00, /* ........ */ + /*0015:*/ 0x00, /* ........ */ + /*0016:*/ 0x00, /* ........ */ + /*0017:*/ 0x00, /* ........ */ + /*0018:*/ 0x00, /* ........ */ + /*0019:*/ 0xe0, /* ###..... */ +/* B battery full */ + /*001a:*/ 3, 3, 8, 0, 0, /* width and bbox (w,h,x,y) */ + /*001f:*/ 0xe0, /* ###..... */ + /*0020:*/ 0x00, /* ........ */ + /*0021:*/ 0xc0, /* ##...... */ + /*0022:*/ 0xc0, /* ##...... */ + /*0023:*/ 0xc0, /* ##...... */ + /*0024:*/ 0xc0, /* ##...... */ + /*0025:*/ 0x00, /* ........ */ + /*0026:*/ 0xe0, /* ###..... */ +/* C battery + */ + /*0027:*/ 3, 3, 8, 0, 0, /* width and bbox (w,h,x,y) */ + /*002c:*/ 0x80, /* #....... */ + /*002d:*/ 0x80, /* #....... */ + /*002e:*/ 0xc0, /* ##...... */ + /*002f:*/ 0xc0, /* ##...... */ + /*0030:*/ 0xc0, /* ##...... */ + /*0031:*/ 0xc0, /* ##...... */ + /*0032:*/ 0x80, /* #....... */ + /*0033:*/ 0x80, /* #....... */ +/* D radiation left */ + /*0034:*/ 3, 3, 8, 0, 0, /* width and bbox (w,h,x,y) */ + /*0039:*/ 0x20, /* ..#..... */ + /*003a:*/ 0x40, /* .#...... */ + /*003b:*/ 0x20, /* ..#..... */ + /*003c:*/ 0x00, /* ........ */ + /*003d:*/ 0x00, /* ........ */ + /*003e:*/ 0x00, /* ........ */ + /*003f:*/ 0x00, /* ........ */ + /*0040:*/ 0x00, /* ........ */ +/* E tower */ + /*0041:*/ 5, 5, 8, 0, 0, /* width and bbox (w,h,x,y) */ + /*0046:*/ 0x20, /* ..#..... */ + /*0047:*/ 0x50, /* .#.#.... */ + /*0048:*/ 0x20, /* ..#..... */ + /*0049:*/ 0x20, /* ..#..... */ + /*004a:*/ 0x50, /* .#.#.... */ + /*004b:*/ 0x50, /* .#.#.... */ + /*004c:*/ 0x88, /* #...#... */ + /*004d:*/ 0xf8, /* #####... */ +/* F radiation right */ + /*004e:*/ 3, 3, 8, 0, 0, /* width and bbox (w,h,x,y) */ + /*0053:*/ 0x80, /* #....... */ + /*0054:*/ 0x40, /* .#...... */ + /*0055:*/ 0x80, /* #....... */ + /*0056:*/ 0x00, /* ........ */ + /*0057:*/ 0x00, /* ........ */ + /*0058:*/ 0x00, /* ........ */ + /*0059:*/ 0x00, /* ........ */ + /*005a:*/ 0x00, /* ........ */ +/* G no radiation */ + /*005b:*/ 3, 3, 8, 0, 0, /* width and bbox (w,h,x,y) */ + /*005c:*/ 0x00, /* ........ */ + /*005d:*/ 0x00, /* ........ */ + /*005e:*/ 0x00, /* ........ */ + /*005f:*/ 0x00, /* ........ */ + /*0060:*/ 0x00, /* ........ */ + /*0061:*/ 0x00, /* ........ */ + /*0062:*/ 0x00, /* ........ */ + /*0063:*/ 0x00, /* ........ */ +}; +static const uint16_t font_symbols_offsets[] = { + 0x0000 /* '@' */, + 0x000d /* 'A' */, + 0x001a /* 'B' */, + 0x0027 /* 'C' */, + 0x0034 /* 'D' */, + 0x0041 /* 'E' */, + 0x004e /* 'F' */, + 0x005b /* 'G' */, +}; +const struct fb_font font_symbols = { + .height = 8, + .ascent = 8, + .firstchar = 64, /* '@' */ + .lastchar = 71, + .chardata = font_symbols_data, + .charoffs = font_symbols_offsets, +}; + diff --git a/src/target/firmware/include/fb/font.h b/src/target/firmware/include/fb/font.h index 40a6974..9dee8ff 100644 --- a/src/target/firmware/include/fb/font.h +++ b/src/target/firmware/include/fb/font.h @@ -70,6 +70,7 @@ enum fb_font_id { FB_FONT_HELVB14, // FB_FONT_HELVB24, FB_FONT_C64, + FB_FONT_SYMBOLS, }; extern const struct fb_font *fb_fonts[]; // note: has to match fb_font_id enum! -- 1.7.3.4 --------------020300040706040007050809 Content-Type: text/x-patch; name="0002-layer1-rssi-Adding-battery-status-and-rx-level-symbo.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename*0="0002-layer1-rssi-Adding-battery-status-and-rx-level-symbo.pa"; filename*1="tch"

1 0

Please Stream it LIVE ---> Re: Regular Osmocom meeting in Berlin?
by Martin O'Shield 30 Mar '12

30 Mar '12

Hello All, "People who cannot participate please make some arrangement for them like live streaming and chat support. <http://www.ustream.tv/ support free live streaming> " I'd like to vote for this point as I wont be able to attend either but love to be there. Sincerely, Martin On Friday, March 30, 2012, Akib Sayyed <akibsayyed(a)gmail.com> wrote: > even i am in.people who cannot participate please make some > arrangement for them like live streaming and chat support. > <http://www.ustream.tv/ support free live streaming> > > On Fri, Mar 30, 2012 at 5:07 PM, Sergio 'shadown' Alvarez > <shadown(a)gmail.com> wrote: >> The idea sounds great to me too. >> >> On Mar 30, 2012, at 12:06 PM, Tobias Engel wrote: >> >>> On 29.03.2012 21:41, Peter Stuge wrote: >>>> Harald Welte wrote: >>>>> I was pondering to start a regular Osmocom meeting (monthly or >>>>> bi-weekly) in Berlin. >>>> .. >>>>> What do you generally think about this? >>>> >>>> I say go for it. Bi-weekly sounds good. >>> >>> I would say monthly is more realistic. But I'm also fine with bi-weekly. >> >> Bi-weekly would give more chances to people who travel a lot, to at least make it to it once a month. >> >>>>> What day of the week should we be aiming at? >>>> >>>> I like Wednesday. >>> >>> Me too. >>> >>> -Tobias >>> >> >> > > > > -- > Akib Sayyed > Matrix-Shell > akibsayyed(a)gmail.com > akibsayyed(a)matrixshell.com > Mob:- +91-966-514-2243 > >

1 0

Re: Regular Osmocom meeting in Berlin?
by Zsombor 30 Mar '12

30 Mar '12

Can you record the video about the presentations and upload to some video sharing site ? I'm certain, that there would be some interest watching it :) Thanks, Zsombor On 2012.03.30. 13:33, "Tobias Engel" <t-openbsc(a)tobias.org> wrote: On 29.03.2012 21:41, Peter Stuge wrote: > Harald Welte wrote: >> I was pondering to start a regular ... I would say monthly is more realistic. But I'm also fine with bi-weekly. >> What day of the week should we be aiming at? > > I like Wednesday. Me too. -Tobias

1 0

DOS in Cellular network
by Chengcheng Gou 30 Mar '12

30 Mar '12

Hello I want to know how to implement a real DOS in the real cellular network using RACH Flood.As you know, using OsmocomBB ,you can only send flood to one ARFCN at one time, so the phone can seaching for another ARFCN. So I think the RACH Flood is less effective in practice, how about it? and if not,a better suggestion on DOS in Cellular network? Thanks!

5 4

Syntax error - LIBOSMOCORE
by alfonso caponi 29 Mar '12

29 Mar '12

Hi list, sorry for this tedious question. I've already read a previous post about my problem but has not been useful ( http://lists.osmocom.org/pipermail/baseband-devel/2011-October/002351.html). I've this error after the make: checking for ranlib... ranlib ./configure: line 3508: syntax error near unexpected token `LIBOSMOCORE,' ./configure: line 3508: `PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore)' make: *** [host/layer23/Makefile] Error 2 My settings with the last versions of sources: - Linux ubuntu 2.6.38-11-generic-pae #50-Ubuntu SMP Mon Sep 12 22:21:04 UTC 2011 i686 i686 i386 GNU/Linux - PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/root/cell_logger/tool-chain/install/bin - arm-elf-gcc -v (installed with http://bb.osmocom.org/trac/wiki/GnuArmToolchain) Using built-in specs. Target: arm-elf Configured with: ./configure elf Thread model: single gcc version 4.2.3 - Makefile: # this is the host tuple of your cross-toolchain CROSS_HOST ?= $(shell which arm-elf-gcc >/dev/null 2>&1 && echo arm-elf || echo arm-none-eabi) # this is the prefix of your cross-toolchain programs CROSS_TOOL_PREFIX=$(CROSS_HOST)- Any tips? :) Thank you very much, AL

3 3

Call for participation LSM/RMLL
by Mathias Coinchon 29 Mar '12

29 Mar '12

Dear Osmocom community, This email to inform you that the call for participation for the next Libre Software Meeting (LSM or RMLL: Rencontres Mondiales du Logiciel Libre) ends on 31st March: http://2012.rmll.info/en/participate/call-for-papers This edition will take place in Geneva from 7th to 12th July 2012 (7-8 general public days, 9-12 theme focused, professional). It would be of great interest for the communities to learn about the Osmocom projects in presentations or workshop. Real world applications would be interesting too. So please don't hesitate to directly submit. Don't hesitate also to contact me for more information. Mathias Coinchon

1 0

RSSI Firmware of OpenMoko GTA02
by saad_aol 28 Mar '12

28 Mar '12

Hi; I am trying to run rssi.highram.bin on gta02(openmoko) following this [1] gta02 is running SHR-lite distro So far I have 1. cross-compiled rssi firmware using arm-elf- toolchain 2. cross-compiled osmocon for phone using arm-angstrom-linux-gnueabi- [2] make -e CROSS_TOOL_PREFIX=arm-angstrom-linux-gnueabi- HOST_CONFARGS="--host=armv4t-angstrom-linux-gnueabi" 3. Make sure that nothing else is using /dev/ttySAC0 4. loaded rssi firmware on gta02 by running on gta02 ./osmocon -i 13 -m romload -p /dev/ttySAC0 rssi.highram.bin Firmware loads succesfully when I toggle power of baseband using echo 0 >/sys/bus/platform/devices/neo1973-pm-gsm.0/power_on && echo 1 >/sys/bus/platform/devices/neo1973-pm-gsm.0/power_on but it scans only ARFCN 1 :< SIM is present but since /dev/ttySAC0 is only claimed by osmocon, I dont think it can be used by ogsmd [1] http://bb.osmocom.org/trac/wiki/OpenMoko http://bb.osmocom.org/trac/wiki/OpenMoko [2] http://wiki.openmoko.org/wiki/Toolchain http://wiki.openmoko.org/wiki/Toolchain My QUESTIONS are: ================= 1. How can I Scan all ARFCN? 2. Can we use /dev/ttySAC0 for gsm & other things after the firmware is loaded on baseband? LOG FILE: http://baseband-devel.722152.n3.nabble.com/file/n3863628/log log -- View this message in context: http://baseband-devel.722152.n3.nabble.com/RSSI-Firmware-of-OpenMoko-GTA02-… Sent from the baseband-devel mailing list archive at Nabble.com.

1 0

Re: baseband-devel Digest, Vol 26, Issue 15
by Akib Sayyed 27 Mar '12

27 Mar '12

i am assuming that you are using one osmocom phone setup and one normal phone. try to do as follows take 3 osmocom phones then try dos with 2 phones and put sim in 3rd and lock to same arfcn and then see what happens. cheeers On Tue, Mar 27, 2012 at 3:30 PM, <baseband-devel-request(a)lists.osmocom.org> wrote: > Send baseband-devel mailing list submissions to > baseband-devel(a)lists.osmocom.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.osmocom.org/mailman/listinfo/baseband-devel > or, via email, send a message with subject or body 'help' to > baseband-devel-request(a)lists.osmocom.org > > You can reach the person managing the list at > baseband-devel-owner(a)lists.osmocom.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of baseband-devel digest..." > > Today's Topics: > > 1. about RACH DOS (gcc) > > > ---------- Forwarded message ---------- > From: gcc <gouchengcheng(a)gmail.com> > To: baseband-devel(a)lists.osmocom.org > Cc: > Date: Mon, 26 Mar 2012 23:44:16 -0700 (PDT) > Subject: about RACH DOS > I am a student in a University studying on the security of GSM, recently I > want use osmocomBB to realize the RACH DOS attack mentioned in Dieter > Spaar`s speech. but I meet some difficulty. > > I do as follow: > > continuely sending RACH to a cell,and ignore the GSM48_MT_RR_IMM_ASS > message ,also i lock my phone to the attacked cell,but after some time,the > phone can still call to some phone ,why? > > can anyone help me? > > thanks! > > -- > View this message in context: http://baseband-devel.722152.n3.nabble.com/about-RACH-DOS-tp3860492p3860492… > Sent from the baseband-devel mailing list archive at Nabble.com. > > > > _______________________________________________ > baseband-devel mailing list > baseband-devel(a)lists.osmocom.org > https://lists.osmocom.org/mailman/listinfo/baseband-devel > -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

1 0

about RACH DOS
by gcc 27 Mar '12

27 Mar '12

I am a student in a University studying on the security of GSM, recently I want use osmocomBB to realize the RACH DOS attack mentioned in Dieter Spaar`s speech. but I meet some difficulty. I do as follow: continuely sending RACH to a cell,and ignore the GSM48_MT_RR_IMM_ASS message ,also i lock my phone to the attacked cell,but after some time,the phone can still call to some phone ,why? can anyone help me? thanks! -- View this message in context: http://baseband-devel.722152.n3.nabble.com/about-RACH-DOS-tp3860492p3860492… Sent from the baseband-devel mailing list archive at Nabble.com.

1 0

Patch: use-before-free in config_write_file
by Christian Vogel 24 Mar '12

24 Mar '12

Hi Everyone, while discussing config_file_write, I noticed that there's a use-after-free bug in libosmocore config_write_file. Chris

1 1

[PATCH] Fix use-after-free in config_write_file
by Christian Vogel 24 Mar '12

24 Mar '12

--- src/vty/command.c | 13 ++++++------- 1 files changed, 6 insertions(+), 7 deletions(-) diff --git a/src/vty/command.c b/src/vty/command.c index ab1eaca..b3595e5 100644 --- a/src/vty/command.c +++ b/src/vty/command.c @@ -2337,40 +2337,39 @@ DEFUN(config_write_file, vty_out(vty, "Can't unlink backup configuration file %s.%s", config_file_sav, VTY_NEWLINE); + unlink(config_file_tmp); talloc_free(config_file_sav); talloc_free(config_file_tmp); - unlink(config_file_tmp); return CMD_WARNING; } if (link(config_file, config_file_sav) != 0) { vty_out(vty, "Can't backup old configuration file %s.%s", config_file_sav, VTY_NEWLINE); + unlink(config_file_tmp); talloc_free(config_file_sav); talloc_free(config_file_tmp); - unlink(config_file_tmp); return CMD_WARNING; } + talloc_free(config_file_sav); /* we are done with config_file_sav by now */ sync(); + if (unlink(config_file) != 0) { vty_out(vty, "Can't unlink configuration file %s.%s", config_file, VTY_NEWLINE); - talloc_free(config_file_sav); - talloc_free(config_file_tmp); unlink(config_file_tmp); + talloc_free(config_file_tmp); return CMD_WARNING; } if (link(config_file_tmp, config_file) != 0) { vty_out(vty, "Can't save configuration file %s.%s", config_file, VTY_NEWLINE); - talloc_free(config_file_sav); - talloc_free(config_file_tmp); unlink(config_file_tmp); + talloc_free(config_file_tmp); return CMD_WARNING; } unlink(config_file_tmp); sync(); - talloc_free(config_file_sav); talloc_free(config_file_tmp); if (chmod(config_file, 0666 & ~CONFIGFILE_MASK) != 0) { -- 1.7.5.4 --n8g4imXOkfNTN/H1--

1 0

Frame Number--Paging
by R M 24 Mar '12

24 Mar '12

Hi, Lately I have been looking at the GSM traffic through wireshark. In every packet, wireshark tells me about the frame number. But a paging message is spread over four frames. (You need to read four frames to get a single paging message.) So which among these four frames does the frame number displayed in wireshark correspond to for the paging message? Regards, RM

2 2

Problem building OsmocomBB
by Dennis Weider 22 Mar '12

22 Mar '12

Hi! I tried this tutorial to build my osmocomBB enviroment: http://bb.osmocom.org/trac/wiki/GettingStarted I downloaded the gnuarm toolchain from here: http://bb.osmocom.org/trac/wiki/toolchain I set the Path and i tried make, but it stops at > arm-elf-ld: ../../shared/libosmocore/build-target/src/.libs/libosmocore.a(msgb.o): Relocations in generic ELF (EM: 3) > ../../shared/libosmocore/build-target/src/.libs/libosmocore.a: could not read symbols: File in wrong format > make[1]: *** [board/compal_e88/hello_world.compalram.elf] Fehler 1 I found a similar Thread on the mailing list here: http://baseband-devel.722152.n3.nabble.com/unknown-error-td2758006.html#a27… But there is not a solution for the problem I would be happy if anybody would be able to giv a solution. MFG Kandanalor

1 1

GSM specs describing Random Access Procedure
by R M 21 Mar '12

21 Mar '12

Hi, I want to understand the RACH channel acess procedure. I tried to search for it in google. It doesnt lead me to the right GSM spec. Does any one know which GSM spec details out the RACH link access procedure ? Regards, RM

3 2

Video : Deepsec 2010 Targeted Dos Attack And Various Fun With Gsm Um
by R M 21 Mar '12

21 Mar '12

Hi, I am looking for this video. I found it at the official Deepsec video archives. But you require to register to the video host site and I am unable to download it using wget Does any one know of any bit torrent site that has this video so that I can download it? Regards, RM

3 3

Working with OpenBSC + Osmocon: Paging response fails to activate SDCCH
by David Bahr 20 Mar '12

20 Mar '12

Hi, Ive just setup an OpenBSC + nanoBTS environment to experiment around with your Osmocom software and a Motorola C123. I tried wo write a little application similiar to app_ccch scan, which is able of responding to paging requests by sending a rach request and the following paging response procedure. The rach access is working fine, but i cant get the paging response to work properly. The message itself is correct (layer2/layer3 parts) according to the specs. OpenBSC is also working correctly as it is working with my normal cell phone or your mobile application. What i'm doing in my code is the following: 1. After getting the immediate assignment i call l1ctl_tx_dm_est_req_h0 in l1ctl.c (l1ctl_tx_dm_est_req_h0(ms, arfcn, ia->chan_desc.chan_nr, ia->chan_desc.h0.tsc, GSM48_CMODE_SIGN, 0)) in order to tune to the assigned channel (or the h1 procedure for hopping). 2. Afterwards i build the paging response (layer2 + layer3), pad the msg and send it via osmo_send_l1(ms, msg) similiar to l1ctl_tx_data_req in l1ctl.c That it is not working can be seen in the OpenBSC abis debug output: <0004> abis_rsl.c:1318 (bts=0,trx=0,ts=0,ss=0) Activating ARFCN(514) SS(0) lctype SDCCH r=OTHER ra=0x67 ta=0 <0004> abis_rsl.c:1064 (bts=0,trx=0,ts=0,ss=0) CHANNEL ACTIVATE ACK <0004> abis_rsl.c:891 (bts=0,trx=0,ts=0,ss=0) CONNECTION FAIL: RELEASING CAUSE=0x01(Radio Link Failure) <0004> abis_rsl.c:621 (bts=0,trx=0,ts=0,ss=0) RF Channel Release CMD due error 1 <0004> abis_rsl.c:658 (bts=0,trx=0,ts=0,ss=0) RF CHANNEL RELEASE ACK <0004> abis_rsl.c:594 (bts=0,trx=0,ts=0,ss=0) is back in operation. It should be looking like this: <0004> abis_rsl.c:1318 (bts=0,trx=0,ts=0,ss=0) Activating ARFCN(514) SS(0) lctype SDCCH r=OTHER ra=0x10 ta=0 <0004> abis_rsl.c:1064 (bts=0,trx=0,ts=0,ss=0) CHANNEL ACTIVATE ACK <0000> abis_rsl.c:1490 (bts=0,trx=0,ts=0,ss=0) SAPI=0 ESTABLISH INDICATION <0003> gsm_04_08.c:1076 PAGING RESPONSE: mi_type=0x04 MI(...) Has anyone an idea what I'm doing wrong? Thanks in advance for any help! Best regards, David

1 0

Use OsmocomBB as OpenBTS / airprobe clock generator
by Harald Welte 15 Mar '12

15 Mar '12

Hi! Recently we've had the idea of using OsmocomBB with a simple firmware that synchronizes to an existing GSM networks FCCH and use the resulting 13MHz clock to drive the USRP for airprobe or OpenBTS. Ideally, we would even use the Calypso-internal PLL (for ARM or DSP) to multiply it up to the required 52 MHz. However, neither the Openmoko nor the Compal/Motorola phones expose any of the 3 clock output pads :( So the only choice is to use something along the lines of the http://focus.ti.com/docs/prod/folders/print/cdcvf25084.html as a quad clock multiplier and attach it to the CLK13OUT signal of the phone. The chip is available for 9 USD in single quantities at digikey, and possibly cheaper at other sources. Combined with a sub-20EUR phone it might be a very cheap but still accurate frequency source for OpenBTS - at least as long as there are any commercial gsm networks available. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

8 17

any one have clone of MTK project hosted on google
by Akib Sayyed 12 Mar '12

12 Mar '12

guys i recently came across mobile-phone-mtk-project.googlecode.com but it seems to be down.does any one have copy of this one?? also can be create osmocom like project with help of MTK chipsets?? -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

1 0

osmocom
by Carlos Cecanecchia Neto 11 Mar '12

11 Mar '12

Dear Srs, We are working in a project that uses a GSM modem to send a GMSK beacom in 904 MHZ with 2W. This beacom send a random bits, but we only need to measure the RSSI Visiting you site, we found a GSM RSSI software working in a phone. Can we use it in 904 Mhz ? This is the uplink GSM ARFCN channel 70. It is possible ? Best Regards Carlos Cecanecchia Neto www.mobipower.com.br 55-11-3257.7736 <http://www.mobipower.com.br/> New Picture (2)

2 2

Re: tsm30 source code
by msokolov＠ivan.Harhan.ORG 10 Mar '12

10 Mar '12

> Hi.=0AIs there any place where I can download the TSM30 source code?=A0 Fou= > nd few torrents but they all seem to be dead.=0ACheers. It looks like the copy I've sent to Cryptome.org for preservation is still up: http://cryptome.org/tsm30/tsm30.7z HTH, MS

1 0

Airprobe main Mmailing list
by R M 10 Mar '12

10 Mar '12

Hi, I am looking for the airprobe mailing list. The only thing I get is the a5/1 mailing list. Where is the airprobe main mailing list archives kept? Thanks and Regards, RM

2 1

a plan it is about a small GSM Station , i think use two phone ......
by 麦田守望者 07 Mar '12

07 Mar '12

i think use two phone to make GSM RF and use wlan Router of usb Interface Connection two phone .... the small GSM base station maybe connection the internet

1 0

[nuttx-bb] how to integrate nuttx-bb into upstream nuttx.
by Denis 'GNUtoo' Carikli 01 Mar '12

01 Mar '12

Hi, Nuttx is BSD licensed while osmocom-bb's src/target/firmware is GPLv2(or later). Mixing GPlv2 and BSD code is legally possible. As I understand it the whole work becomes GPLv2 when the code is mixed, the BSD part however can be used independently of the GPL part if you strip out the GPL part and the BSD copyright headers have to remain intact. The problem is that upstream(nuttx) will unlikely accept GPL code as-is for inclusion in nuttx. However there is a misc directory for software made under different licenses such as applications or drivers(there is one GPL driver for the rtl8187x wifi chipsets). To use the driver the user is expected to run a script that install the driver in nuttx normal source code directory. The list of files touched by the patches mades on top of nuttx and their licenses is listed here: http://bb.osmocom.org/trac/wiki/nuttx-bb/code-audit Basically the GPL parts are composed by : * the irq * the timer * the clock * the uart some of the related files have the following authors(can be combined together): * Harald Welte * Stefan Richter * Ingo Albrecht I guess Stefan Richter and Ingo Albrecht will be hard to reach. So I wonder what's the best thing to do. Denis.

3 4

[PATCH] Added option for mobile-app to bind to other interfaces than localhost.
by Tim Ehlers 01 Mar '12

01 Mar '12

Signed-off-by: Tim Ehlers <osmocom(a)ehlers.info> --- .../layer23/include/osmocom/bb/common/l23_app.h | 1 + .../layer23/include/osmocom/bb/mobile/app_mobile.h | 2 +- src/host/layer23/src/common/main.c | 11 ++++++++++- src/host/layer23/src/mobile/app_mobile.c | 4 ++-- src/host/layer23/src/mobile/main.c | 13 ++++++++++--- .../include/osmocom/vty/telnet_interface.h | 1 + src/shared/libosmocore/src/vty/telnet_interface.c | 11 ++++++++++- 7 files changed, 35 insertions(+), 8 deletions(-) diff --git a/src/host/layer23/include/osmocom/bb/common/l23_app.h b/src/host/layer23/include/osmocom/bb/common/l23_app.h index e4c5d55..0b9994c 100644 --- a/src/host/layer23/include/osmocom/bb/common/l23_app.h +++ b/src/host/layer23/include/osmocom/bb/common/l23_app.h @@ -10,6 +10,7 @@ enum { L23_OPT_TAP = 4, L23_OPT_VTY = 8, L23_OPT_DBG = 16, + L23_OPT_VTYIP = 32, }; /* initialization, called once when starting the app, before entering diff --git a/src/host/layer23/include/osmocom/bb/mobile/app_mobile.h b/src/host/layer23/include/osmocom/bb/mobile/app_mobile.h index 4010a68..351dec3 100644 --- a/src/host/layer23/include/osmocom/bb/mobile/app_mobile.h +++ b/src/host/layer23/include/osmocom/bb/mobile/app_mobile.h @@ -4,7 +4,7 @@ char *config_dir; int l23_app_init(int (*mncc_recv)(struct osmocom_ms *ms, int, void *), - const char *config_file, uint16_t vty_port); + const char *config_file, const char *vty_ip, uint16_t vty_port); int l23_app_exit(void); int l23_app_work(int *quit); int mobile_delete(struct osmocom_ms *ms, int force); diff --git a/src/host/layer23/src/common/main.c b/src/host/layer23/src/common/main.c index eb47b26..59cee03 100644 --- a/src/host/layer23/src/common/main.c +++ b/src/host/layer23/src/common/main.c @@ -56,6 +56,7 @@ static char *sap_socket_path = "/tmp/osmocom_sap"; struct llist_head ms_list; static struct osmocom_ms *ms = NULL; static char *gsmtap_ip = NULL; +static char *vty_ip = "127.0.0.1"; unsigned short vty_port = 4247; int (*l23_app_work) (struct osmocom_ms *ms) = NULL; @@ -106,6 +107,10 @@ static void print_help() if (options & L23_OPT_DBG) printf(" -d --debug Change debug flags.\n"); + if (options & L23_OPT_VTYIP) + printf(" -u --vty-ip The VTY IP to bind telnet to. " + "(default %s)\n", vty_ip); + if (app && app->cfg_print_help) app->cfg_print_help(); } @@ -122,13 +127,14 @@ static void build_config(char **opt, struct option **option) {"sap", 1, 0, 'S'}, {"arfcn", 1, 0, 'a'}, {"gsmtap-ip", 1, 0, 'i'}, + {"vty-ip", 1, 0, 'u'}, {"vty-port", 1, 0, 'v'}, {"debug", 1, 0, 'd'}, }; app = l23_app_info(); - *opt = talloc_asprintf(l23_ctx, "hs:S:a:i:v:d:%s", + *opt = talloc_asprintf(l23_ctx, "hs:S:a:i:v:d:u:%s", app && app->getopt_string ? app->getopt_string : ""); len = ARRAY_SIZE(long_options); @@ -174,6 +180,9 @@ static void handle_options(int argc, char **argv) case 'i': gsmtap_ip = optarg; break; + case 'u': + vty_ip = optarg; + break; case 'v': vty_port = atoi(optarg); break; diff --git a/src/host/layer23/src/mobile/app_mobile.c b/src/host/layer23/src/mobile/app_mobile.c index da388b2..d911ab3 100644 --- a/src/host/layer23/src/mobile/app_mobile.c +++ b/src/host/layer23/src/mobile/app_mobile.c @@ -352,7 +352,7 @@ static struct vty_app_info vty_info = { /* global init */ int l23_app_init(int (*mncc_recv)(struct osmocom_ms *ms, int, void *), - const char *config_file, uint16_t vty_port) + const char *config_file, const char *vty_ip, uint16_t vty_port) { struct telnet_connection dummy_conn; int rc = 0; @@ -376,7 +376,7 @@ int l23_app_init(int (*mncc_recv)(struct osmocom_ms *ms, int, void *), } } vty_reading = 0; - telnet_init(l23_ctx, NULL, vty_port); + telnet_init_dynif(l23_ctx, NULL, vty_ip, vty_port); if (rc < 0) return rc; printf("VTY available on port %u.\n", vty_port); diff --git a/src/host/layer23/src/mobile/main.c b/src/host/layer23/src/mobile/main.c index 89c9b94..312bcd6 100644 --- a/src/host/layer23/src/mobile/main.c +++ b/src/host/layer23/src/mobile/main.c @@ -52,6 +52,7 @@ void *l23_ctx = NULL; struct llist_head ms_list; static char *gsmtap_ip = 0; struct gsmtap_inst *gsmtap_inst = NULL; +static char *vty_ip = "127.0.0.1"; unsigned short vty_port = 4247; int debug_set = 0; char *config_dir = NULL; @@ -88,6 +89,8 @@ static void print_help() printf(" Some help...\n"); printf(" -h --help this text\n"); printf(" -i --gsmtap-ip The destination IP used for GSMTAP.\n"); + printf(" -u --vty-ip The VTY IP to telnet to. " + "(default %s)\n", vty_ip); printf(" -v --vty-port The VTY port number to telnet to. " "(default %u)\n", vty_port); printf(" -d --debug Change debug flags. default: %s\n", @@ -104,6 +107,7 @@ static void handle_options(int argc, char **argv) static struct option long_options[] = { {"help", 0, 0, 'h'}, {"gsmtap-ip", 1, 0, 'i'}, + {"vty-ip", 1, 0, 'u'}, {"vty-port", 1, 0, 'v'}, {"debug", 1, 0, 'd'}, {"daemonize", 0, 0, 'D'}, @@ -111,7 +115,7 @@ static void handle_options(int argc, char **argv) {0, 0, 0, 0}, }; - c = getopt_long(argc, argv, "hi:v:d:Dm", + c = getopt_long(argc, argv, "hi:u:v:d:Dm", long_options, &option_index); if (c == -1) break; @@ -125,6 +129,9 @@ static void handle_options(int argc, char **argv) case 'i': gsmtap_ip = optarg; break; + case 'u': + vty_ip = optarg; + break; case 'v': vty_port = atoi(optarg); break; @@ -226,9 +233,9 @@ int main(int argc, char **argv) config_dir = dirname(config_dir); if (use_mncc_sock) - rc = l23_app_init(mncc_recv_socket, config_file, vty_port); + rc = l23_app_init(mncc_recv_socket, config_file, vty_ip, vty_port); else - rc = l23_app_init(NULL, config_file, vty_port); + rc = l23_app_init(NULL, config_file, vty_ip, vty_port); if (rc) exit(rc); diff --git a/src/shared/libosmocore/include/osmocom/vty/telnet_interface.h b/src/shared/libosmocore/include/osmocom/vty/telnet_interface.h index 2de4f19..65a1dd9 100644 --- a/src/shared/libosmocore/include/osmocom/vty/telnet_interface.h +++ b/src/shared/libosmocore/include/osmocom/vty/telnet_interface.h @@ -47,6 +47,7 @@ struct telnet_connection { }; int telnet_init(void *tall_ctx, void *priv, int port); +int telnet_init_dynif(void *tall_ctx, void *priv, const char *ip, int port); void telnet_exit(void); diff --git a/src/shared/libosmocore/src/vty/telnet_interface.c b/src/shared/libosmocore/src/vty/telnet_interface.c index 167acc1..bbc0791 100644 --- a/src/shared/libosmocore/src/vty/telnet_interface.c +++ b/src/shared/libosmocore/src/vty/telnet_interface.c @@ -18,6 +18,7 @@ * */ +#include <arpa/inet.h> #include <sys/socket.h> #include <netinet/in.h> #include <stdlib.h> @@ -59,6 +60,14 @@ static struct osmo_fd server_socket = { */ int telnet_init(void *tall_ctx, void *priv, int port) { + int rc; + rc = telnet_init_dynif(tall_ctx, priv, "127.0.0.1", port); + + return rc; +} + +int telnet_init_dynif(void *tall_ctx, void *priv, const char *ip, int port) +{ struct sockaddr_in sock_addr; int fd, rc, on = 1; @@ -78,7 +87,7 @@ int telnet_init(void *tall_ctx, void *priv, int port) memset(&sock_addr, 0, sizeof(sock_addr)); sock_addr.sin_family = AF_INET; sock_addr.sin_port = htons(port); - sock_addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); + sock_addr.sin_addr.s_addr = inet_addr(ip); rc = bind(fd, (struct sockaddr*)&sock_addr, sizeof(sock_addr)); if (rc < 0) { -- 1.7.1

3 2

ARFCH
by R M 01 Mar '12

01 Mar '12

Hi, I am using Nokia 3310 to look at GSM traffic. The system information messages are displayed in wireshark. Is it possible to get the ARFCN of the becaon channel of the cell to which the phone has locked from the System Information messages( SI ) ? I am getting confused because of the following screen shots which I have attached. Screen shot 1 says that the SI 4 message is in ARFCN 108. Screen shot 2 says that the SI 4 message is in ARFCN 57. So now which is the real ARFCN of the beacon channel in my cell ? Regards, RM

1 0

neighbour cells
by jolly 29 Feb '12

29 Feb '12

hi, i improved the generation of neighbour cells of openbsc. the patch is committed at origin/jolly/rtpmux. it generated the system information messages of neighbour cells in the same and in other bands. depending on the location of the bcch and the neighbour cells, the messages SI 2/5 and optionally SI 2bis/5bis and SI 2ter/5ter are generated. i have tested it with several configurations. i would like to commit it to master. any suggestions? regards, andreas

1 0

unbreak nuttx-bb and add support for compal_e88 phones
by Denis 'GNUtoo' Carikli 25 Feb '12

25 Feb '12

Hi, Alan Carvalho de Assis and me have been working on making nuttx-bb work on our phones( I've a gta02 and he has a Motorola W220) and here are the patches(against nuttx-bb). To try it, clone nuttx-bb and osmocom-bb, put it in the same directory and keep the name of the osmocom-bb directory. Then put the gnuarm(for 64bit) or the codesourcery(for 32bit) in your path(there is a problem with gnuarm for 32bit). Compile osmocom-bb as usual(cd osmocom-bb/src && make). Then go in nuttx-bb directory and do: cd nuttx/tools/ ./configure.sh compal_e88/nsh #for for compal_e88( gta02 and Motorola W220). ./configure.sh compal_e99/nsh #we need testers for compal_e99, we don't have one. cd ../ make That will create a nuttx.bin, load it as usual(like any other firmware for your calypso). Then the following will appear: Finished, sent 63 blocks in total Received block ack from phone Sending checksum: 0x66 Checksum on phone side matches, let's branch to your code Branching to 0x00820000 Received branch ack, your code is running now! NuttShell (NSH) To send commands to the shell you need to run loadwriter.py that is included in the source code at: nuttx/drivers/sercomm/loadwriter.py The list of commands can be found by typing help. Denis.

4 7

set sm-rp-oa in gsm411_sms.c
by ondra2000＠centrum.cz 22 Feb '12

22 Feb '12

Hello, I need to set originating address in MO SMS (SM submit, SM-RP-OA field)... I found this field in src/host/layer23/src/mobile/gsm411_sms.c --> /* no orig Address */ data = (uint8_t *)msgb_put(msg, 1); data[0] = 0x00; /* originator length == 0 */ Field has 0 length. Can anybody pleas help me how to set this field to some MSISDN...I know that there must be some fields for TON,NPI, number ... but I don't know how to write these fields into source code... With this change i want to find out how MSC behave when is field SM-RP-OA set to some real MSISDN. Thank you! Andrew

2 2

set sm-RP-OA in gsm411_sms.c
by ondra2000＠centrum.cz 22 Feb '12

22 Feb '12

Hello, I need to set originating address in MO SMS (SM-RP-OA)... I found this field in src/host/layer23/src/mobile/gsm411_sms.c --> /* no orig Address */ data = (uint8_t *)msgb_put(msg, 1); data[0] = 0x00; /* originator length == 0 */ Field has 0 length. Can anybody pleas help me how to set this field to some MSISDN...I know that there must be some fields for TON,NPI, number ... but I don't know how to write these fields into source code... With this change i want to find out how MSC behave when is field SM-RP-OA set to some real MSISDN. Thank you! Andrew

1 0

nuxttx-bb issues
by Denis 'GNUtoo' Carikli 21 Feb '12

21 Feb '12

hi, Me and Alan Carvalho de Assis tried nuttx-bb on the calypso and we failed to get any serial or sercomm output. The setup: ------------ 1) clone the following repository(or add as remote and checkout the correct branch): git://git.osmocom.org/osmocom-bb git://gitorious.org/gnutoo-s-for-upstream-osmocom-bb-and-nuttx-bb/nuttx-bb- gta02.git osmocom-bb and nuttx-bb-gta02 must be in the same directory. nuttx-bb-gta02 has 2 small patches made by me. One is for fixing compilation. And the other one is the result of a diff between compal_e99's init.c and the gta02's init.c 2) setup the toolchain: we didn't use gnuarm toolchain because it gave that when compiling nuttx-bb: arm-elf-ld: ERROR: /home/gnutoo/temp/osmo/nuttx-bb-gta02/nuttx/../../osmocom- bb/src/target/firmware/comm/libcomm.a(sercomm.o) uses hardware FP, whereas /home/gnutoo/temp/osmo/nuttx-bb-gta02/nuttx/nuttx uses software FP So we tried the arm-2010.09 codesourcey we put it in the path. 3) compile osmocom-bb: cd osmocom-bb/src make clean make cd ../../ 3) compile nuttx-bb: cd nuttx-bb-gta02/nuttx cd tools ./configure.sh compal_e99/nsh cd ../ make CROSSDEV="arm-none-eabi-" clean make CROSSDEV="arm-none-eabi-" that gives a file named nuttx.bin Then I tried it to load on my om-gta02: scp nuttx.bin root(a)192.168.7.2: ssh root(a)192.168.7.2 root@om-gta02:~# /etc/init.d/dbus-1 stop Stopping system message bus: root@om-gta02:~# /etc/init.d/xserver-nodm stop Stopping XServer root@om-gta02:~# osmocon -i 13 -m romload -p /dev/ttySAC0 nuttx.bin and on another console: ssh root(a)192.168.7.2 root@om-gta02:~# echo 1 > /sys/bus/platform/devices/gta02-pm-gsm.0/download root@om-gta02:~# echo 0 >/sys/bus/platform/devices/gta02-pm-gsm.0/power_on root@om-gta02:~# echo 1 >/sys/bus/platform/devices/gta02-pm-gsm.0/power_on which results in the following on the first console: [...] Finished, sent 63 blocks in total Received block ack from phone Sending checksum: 0xf6 Checksum on phone side matches, let's branch to your code Branching to 0x00820000 Received branch ack, your code is running now! but nothing on sercomm. And nothing on IRDA serial port either.... and IRDA serial cable works too: if I do that again: root@om-gta02:~# echo 0 >/sys/bus/platform/devices/gta02-pm-gsm.0/power_on root@om-gta02:~# echo 1 >/sys/bus/platform/devices/gta02-pm-gsm.0/power_on I get the default modem software messages on the serial port... Previously I tried to print on the IRDA serial port with: cons_puts("HELLO WORLD\n\n"); in apps/examples/hello/main.c and of course enabling the hello world application in the apps config. Nothing was printed either.... here's the app config: CONFIGURED_APPS += examples/hello in apps/.config And here's the diff for the application: diff --git a/apps/examples/hello/main.c b/apps/examples/hello/main.c index 308603f..db55ac3 100644 --- a/apps/examples/hello/main.c +++ b/apps/examples/hello/main.c @@ -58,7 +58,10 @@ int user_start(int argc, char *argv[]) { - printf("Hello, World!!\n"); - return 0; + while (1){ + cons_puts("HELLO WORLD\n"); + printf("Hello, World!!\n"); + } + return 0; } Alan Carvalho de Assis tried on features phones and not on the gta02 with the same result... Denis.

2 1

[PATCH] Added option for mobile-app to bind to other interfaces than localhost. Signed-off-by: Tim Ehlers <osmocom@ehlers.info>
by Tim Ehlers 21 Feb '12

21 Feb '12

--- .../layer23/include/osmocom/bb/common/l23_app.h | 1 + .../layer23/include/osmocom/bb/mobile/app_mobile.h | 2 +- src/host/layer23/src/common/main.c | 11 ++++- src/host/layer23/src/mobile/app_mobile.c | 4 +- src/host/layer23/src/mobile/main.c | 13 ++++- .../include/osmocom/vty/telnet_interface.h | 1 + src/shared/libosmocore/src/vty/telnet_interface.c | 45 ++++++++++++++++++++ 7 files changed, 70 insertions(+), 7 deletions(-) diff --git a/src/host/layer23/include/osmocom/bb/common/l23_app.h b/src/host/layer23/include/osmocom/bb/common/l23_app.h index e4c5d55..0b9994c 100644 --- a/src/host/layer23/include/osmocom/bb/common/l23_app.h +++ b/src/host/layer23/include/osmocom/bb/common/l23_app.h @@ -10,6 +10,7 @@ enum { L23_OPT_TAP = 4, L23_OPT_VTY = 8, L23_OPT_DBG = 16, + L23_OPT_VTYIP = 32, }; /* initialization, called once when starting the app, before entering diff --git a/src/host/layer23/include/osmocom/bb/mobile/app_mobile.h b/src/host/layer23/include/osmocom/bb/mobile/app_mobile.h index 4010a68..351dec3 100644 --- a/src/host/layer23/include/osmocom/bb/mobile/app_mobile.h +++ b/src/host/layer23/include/osmocom/bb/mobile/app_mobile.h @@ -4,7 +4,7 @@ char *config_dir; int l23_app_init(int (*mncc_recv)(struct osmocom_ms *ms, int, void *), - const char *config_file, uint16_t vty_port); + const char *config_file, const char *vty_ip, uint16_t vty_port); int l23_app_exit(void); int l23_app_work(int *quit); int mobile_delete(struct osmocom_ms *ms, int force); diff --git a/src/host/layer23/src/common/main.c b/src/host/layer23/src/common/main.c index eb47b26..59cee03 100644 --- a/src/host/layer23/src/common/main.c +++ b/src/host/layer23/src/common/main.c @@ -56,6 +56,7 @@ static char *sap_socket_path = "/tmp/osmocom_sap"; struct llist_head ms_list; static struct osmocom_ms *ms = NULL; static char *gsmtap_ip = NULL; +static char *vty_ip = "127.0.0.1"; unsigned short vty_port = 4247; int (*l23_app_work) (struct osmocom_ms *ms) = NULL; @@ -106,6 +107,10 @@ static void print_help() if (options & L23_OPT_DBG) printf(" -d --debug Change debug flags.\n"); + if (options & L23_OPT_VTYIP) + printf(" -u --vty-ip The VTY IP to bind telnet to. " + "(default %s)\n", vty_ip); + if (app && app->cfg_print_help) app->cfg_print_help(); } @@ -122,13 +127,14 @@ static void build_config(char **opt, struct option **option) {"sap", 1, 0, 'S'}, {"arfcn", 1, 0, 'a'}, {"gsmtap-ip", 1, 0, 'i'}, + {"vty-ip", 1, 0, 'u'}, {"vty-port", 1, 0, 'v'}, {"debug", 1, 0, 'd'}, }; app = l23_app_info(); - *opt = talloc_asprintf(l23_ctx, "hs:S:a:i:v:d:%s", + *opt = talloc_asprintf(l23_ctx, "hs:S:a:i:v:d:u:%s", app && app->getopt_string ? app->getopt_string : ""); len = ARRAY_SIZE(long_options); @@ -174,6 +180,9 @@ static void handle_options(int argc, char **argv) case 'i': gsmtap_ip = optarg; break; + case 'u': + vty_ip = optarg; + break; case 'v': vty_port = atoi(optarg); break; diff --git a/src/host/layer23/src/mobile/app_mobile.c b/src/host/layer23/src/mobile/app_mobile.c index da388b2..d911ab3 100644 --- a/src/host/layer23/src/mobile/app_mobile.c +++ b/src/host/layer23/src/mobile/app_mobile.c @@ -352,7 +352,7 @@ static struct vty_app_info vty_info = { /* global init */ int l23_app_init(int (*mncc_recv)(struct osmocom_ms *ms, int, void *), - const char *config_file, uint16_t vty_port) + const char *config_file, const char *vty_ip, uint16_t vty_port) { struct telnet_connection dummy_conn; int rc = 0; @@ -376,7 +376,7 @@ int l23_app_init(int (*mncc_recv)(struct osmocom_ms *ms, int, void *), } } vty_reading = 0; - telnet_init(l23_ctx, NULL, vty_port); + telnet_init_dynif(l23_ctx, NULL, vty_ip, vty_port); if (rc < 0) return rc; printf("VTY available on port %u.\n", vty_port); diff --git a/src/host/layer23/src/mobile/main.c b/src/host/layer23/src/mobile/main.c index 89c9b94..312bcd6 100644 --- a/src/host/layer23/src/mobile/main.c +++ b/src/host/layer23/src/mobile/main.c @@ -52,6 +52,7 @@ void *l23_ctx = NULL; struct llist_head ms_list; static char *gsmtap_ip = 0; struct gsmtap_inst *gsmtap_inst = NULL; +static char *vty_ip = "127.0.0.1"; unsigned short vty_port = 4247; int debug_set = 0; char *config_dir = NULL; @@ -88,6 +89,8 @@ static void print_help() printf(" Some help...\n"); printf(" -h --help this text\n"); printf(" -i --gsmtap-ip The destination IP used for GSMTAP.\n"); + printf(" -u --vty-ip The VTY IP to telnet to. " + "(default %s)\n", vty_ip); printf(" -v --vty-port The VTY port number to telnet to. " "(default %u)\n", vty_port); printf(" -d --debug Change debug flags. default: %s\n", @@ -104,6 +107,7 @@ static void handle_options(int argc, char **argv) static struct option long_options[] = { {"help", 0, 0, 'h'}, {"gsmtap-ip", 1, 0, 'i'}, + {"vty-ip", 1, 0, 'u'}, {"vty-port", 1, 0, 'v'}, {"debug", 1, 0, 'd'}, {"daemonize", 0, 0, 'D'}, @@ -111,7 +115,7 @@ static void handle_options(int argc, char **argv) {0, 0, 0, 0}, }; - c = getopt_long(argc, argv, "hi:v:d:Dm", + c = getopt_long(argc, argv, "hi:u:v:d:Dm", long_options, &option_index); if (c == -1) break; @@ -125,6 +129,9 @@ static void handle_options(int argc, char **argv) case 'i': gsmtap_ip = optarg; break; + case 'u': + vty_ip = optarg; + break; case 'v': vty_port = atoi(optarg); break; @@ -226,9 +233,9 @@ int main(int argc, char **argv) config_dir = dirname(config_dir); if (use_mncc_sock) - rc = l23_app_init(mncc_recv_socket, config_file, vty_port); + rc = l23_app_init(mncc_recv_socket, config_file, vty_ip, vty_port); else - rc = l23_app_init(NULL, config_file, vty_port); + rc = l23_app_init(NULL, config_file, vty_ip, vty_port); if (rc) exit(rc); diff --git a/src/shared/libosmocore/include/osmocom/vty/telnet_interface.h b/src/shared/libosmocore/include/osmocom/vty/telnet_interface.h index 2de4f19..65a1dd9 100644 --- a/src/shared/libosmocore/include/osmocom/vty/telnet_interface.h +++ b/src/shared/libosmocore/include/osmocom/vty/telnet_interface.h @@ -47,6 +47,7 @@ struct telnet_connection { }; int telnet_init(void *tall_ctx, void *priv, int port); +int telnet_init_dynif(void *tall_ctx, void *priv, const char *ip, int port); void telnet_exit(void); diff --git a/src/shared/libosmocore/src/vty/telnet_interface.c b/src/shared/libosmocore/src/vty/telnet_interface.c index 167acc1..d74ec09 100644 --- a/src/shared/libosmocore/src/vty/telnet_interface.c +++ b/src/shared/libosmocore/src/vty/telnet_interface.c @@ -18,6 +18,7 @@ * */ +#include <arpa/inet.h> #include <sys/socket.h> #include <netinet/in.h> #include <stdlib.h> @@ -101,6 +102,50 @@ int telnet_init(void *tall_ctx, void *priv, int port) return 0; } +int telnet_init_dynif(void *tall_ctx, void *priv, const char *ip, int port) +{ + struct sockaddr_in sock_addr; + int fd, rc, on = 1; + + tall_telnet_ctx = talloc_named_const(tall_ctx, 1, + "telnet_connection"); + + /* FIXME: use new socket.c code of libosmocore */ + fd = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP); + + if (fd < 0) { + LOGP(0, LOGL_ERROR, "Telnet interface socket creation failed\n"); + return fd; + } + + setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)); + + memset(&sock_addr, 0, sizeof(sock_addr)); + sock_addr.sin_family = AF_INET; + sock_addr.sin_port = htons(port); + sock_addr.sin_addr.s_addr = inet_addr(ip); + + rc = bind(fd, (struct sockaddr*)&sock_addr, sizeof(sock_addr)); + if (rc < 0) { + LOGP(0, LOGL_ERROR, "Telnet interface failed to bind\n"); + close(fd); + return rc; + } + + rc = listen(fd, 0); + if (rc < 0) { + LOGP(0, LOGL_ERROR, "Telnet interface failed to listen\n"); + close(fd); + return rc; + } + + server_socket.data = priv; + server_socket.fd = fd; + osmo_fd_register(&server_socket); + + return 0; +} + extern struct host host; static void print_welcome(int fd) -- 1.7.1

2 1

[PATCH] bind VTY to other interfaces than localhost
by Tim Ehlers 20 Feb '12

20 Feb '12

Hi, in some usecases, for people knowing what they are doing, it maybe an advantage to control osmocombb over the network. Since the VTY is already network capable, it just needs to bind to an alternative network interface than localhost. Here is a patch for layer23 (mobile), having an option "-u" (because -v is the port). Passing "-u 0.0.0.0" would bind to any interface. If you think it is useful, please commit it in the git. Cheers Tim

4 4

Network registration fails
by To Beat 20 Feb '12

20 Feb '12

Hi I've a problem with the mobile application since ~1 month. Registering in the network always fails and I don't have any idea why. It used to work in the past, but currently it is not working. Independently from the osmocom version i use (even the version from december 2011 which had worked once now always fail). I am using a C123 with an ftdi cable and the testing branch from sylvain. I tried sim cards for Vodafone/O2/Eplus. The related outputs/logs are the following: Output on telnet interface: OsmocomBB# % (MS 1) % Searching network... % (MS 1) % Trying to registering with network... layer 1 output: http://pastebin.com/c0AhJ3gt mobile app output: http://pastebin.com/vP0YPfpT Any suggestions are appreciated! greetings Philip

2 1

USSD Commands
by Abdul Hakeem 20 Feb '12

20 Feb '12

Hello, Does anyone have a comprehensive list of USSD commands (either at the MS and server sides ), or a link to such a resource ? Regards, Abdul Hakeem

1 0

Problem with decoding.
by Jaka Hudoklin 17 Feb '12

17 Feb '12

Hello. I'm trying to figure out what am i doing wrong for days, and i can't. I'm doing GSM security research for my university. I sniffed A5/1 encrypted bursts of my mobile phone with known KC. The example of burst output is below(C-cyphertext, P-plaintext, F- decoded data): > C 2310735 > 111000010011011101110001010111110100001010101111110001110100011010011011101100101100010010011011010100101111100111 > P 2310735 > 100000000001110111010100000000000001000011011101000000001000000000010101110100000100000010000101010111010101000010 > C 2310736 > 101110101001101010010111111111101010111001111001001110011000011111011001010010010111110010010000111000111011100011 > P 2310736 > 101011111111010101010001100000101010111111010101000100001010111110111101110100010010100010111011111101010001001010 > C 2310737 > 100011010101111101001111011110111010100001010010100010010110000010111110001011010010100111101000011110010100100101 > P 2310737 > 000100010111010100010000101000010100011101010000000010100001000101110101010000000000100001000111010101000000001010 > C 2310738 > 100011100100110101110100001001001111110110110000001101100110001101100011011000011011111111011100101110100000101111 > P 2310738 > 010100001000101011101101010101010100001010111111110101110100000010101010101011010101010100001000101010101101110101 > F 1 22 9 6 32 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b > C 2310752 > 110011010101101010011000000101011010111000001111110111011101011010111101110101000101101001110001000000100000101011 > P 2310752 > 111000101001100101011000011010100001110010100101111101010011000111000111011100110001111110111100000111110100000101 > C 2310753 > 011010111101000101101001001111001001100001101010001011110111011000010101100001000100101010100110110100001000110111 > P 2310753 > 000011111011011101100101100000101011111000100110110001010110010011101111111011000000110010011110001011011000010010 > C 2310754 > 011011000011001100000110001110000011010100000101100000011111101100101000011001001010100001011100001011111011001011 > P 2310754 > 100000010010110101010001101110110100000110011101010111100010100000001001010101011001001001100010101101110100101010 > C 2310755 > 001001010111101010011010100110100011101001010101010010001011111101001000000111101101001011001111001001010001010011 > P 2310755 > 111001001001100011101001100100110100100000110010100110011101010000101010010010101011010001011000000001001100101111 > F 5 3 3 3 2d 6 1e 7 1e 92 f3 14 0 3b 97 88 2b 2b 2b 2b 2b 2b 2b As you can see frames are decoded correctly and they are correctly displayed in wireshark. If i put XOR-ed value betwene cyprtext and plaintext-> keystream to kraken, i don't get any usefull results only the ones that do not produce correct KC. i calculate frame count correctly, because i test it with data from http://lists.lists.reflextor.com/pipermail/a51/2010-July/000803.html. Kraken works correctly for me since i can get correct kc with keystream from http://lists.lists.reflextor.com/pipermail/a51/2010-July/000688.html. The ouput bursts in example above are written using following lines of code: for (i=0; i<57; i++) fprintf( app_state.fh, "%d", bt[i] ); for (i=59; i<116; i++) fprintf( app_state.fh, "%d", bt[i] ); where bt is generated using: osmo_pbit2ubit_ext(bt, 0, bi->bits, 0, 57, 0); osmo_pbit2ubit_ext(bt, 59, bi->bits, 57, 57, 0); Can you help me identify why can't i correctly crack bursts? Thanks!

3 3

osmocombb and usrp
by Paul Lambert 14 Feb '12

14 Feb '12

Hello, I have a ursp1 working fine and I want to use my c123 to conenct to it with osmocombb. Now I face some problems. First of all I have no sim, so I do: sim testcard 1 001 01 The usrp runs a testnetwork (001 01) I don't know how I can associate with the usrp. I tried: network search (lot of output and also my testnet) network show (nothing happens) network select 1 001 01: Network not in list! Any idea what I'm doing wrong? Would be really Cool if i could use opensource only. With best regards, Paul

3 3

changing key as security feature in osmocom?
by Tim Ehlers 13 Feb '12

13 Feb '12

Hi, I just saw the talk of Karsten Nohl at 28C3 and ask myself if it would be possible to trigger a new session key (KC) after every e.g. Call,SMS,USSD and silent SMS :) for next event. I mean it seems that e.g. in O2 Network in germany the key never changes, only when turning off and on the phone and after many events. For O2 it maybe enough to reconnect to the network? I really would like to get a somewhat secure GSM connection for my anchor mobile at home (remotely controlled from the PC) for my nationwide homezone (BWHZ), using osmocombb. :) Has anyone a suggestion, idea? Thanks Tim

3 10

libosmocore re-sync
by Harald Welte 08 Feb '12

08 Feb '12

FYI, I have committed a 'git-subtree' update of libosmocore to osmocom-bb earlier today. It seemed non-intrusive to me, as most of the changes were in testing and gsm 08.08 code, both of which are not used in the ARM-target builds. Nonetheless, if you experience strange new problems, the libosmocore update might be a possible cause. The update was required due to a __attribute((packed)) fix by Andreas to some GSM 04.08 structures... -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

USSD Traffic analysis
by ty 07 Feb '12

07 Feb '12

Hallo all. I have been playing around with OsmoscomBB for GSM voice traffic and capture. My interested has now stemmed into USSD traffic. Whenever I initiate a ussd session, I get the error "Session Terminated". Has anyone attempted to capture ussd sessions using the Motorola C123 or do I need specialized equipment for this? Also, am looking into researching more into ussd because here in Africa, specifically Kenya, there is a proliferation of financial services over USSD and this begs the question just how secure is it? If anyone on the list might have done a bit of digging around I'd really love to share learnings and insights. -ty

2 3

Patch: Automatically run osmoload from osmocon
by Christian Vogel 05 Feb '12

05 Feb '12

Hi, I'm getting kind of annoyed by the new >64k firmwares that need to be loaded via osmoload. Included patch #2 adds a "-a" option to osmocon that runs an arbitrary script after the main firmware has been successfully uploaded to the phone. This script could, for example, then handle upload of a second stage firmware via osmoload. Also layer23 could be started here just before uploading layer1. The script will be given the socket, serial port, loader method (c123xor...) and main firmware as arguments, those can be used to distinguish several phones that are connected to the same PC. Example usage (using attached osmoload.sh script): osmocon -p /dev/ttyUSB0 -m c155 -a .../osmoload.sh \ .../board/compal_e99/loader.compalram.bin Received DOWNLOAD ACK from phone, your code is running now! OSMOCOM Loader (revision osmocon_v0.0.0-1299-g7c08201) (---- 2 second delay ----) [osmoload.sh] Socket is /tmp/osmocom_loader, port is /dev/ttyUSB0. [osmoload.sh] Loader method was c155. [osmoload.sh] New firmware will be osmocom-bb/src/target/firmware/board/compal_e99/rssi.highram.bin. Received pong. Loading 75472 bytes of memory to address 0x820000 from file osmocom-bb/src/target/firmware/board/compal_e99/rssi.highram.bin .................................................................. Chris

2 2

[PATCH 2/2] osmocon: Option -a runs program/script on upload
by Christian Vogel 05 Feb '12

05 Feb '12

The program option "-a program" runs the specified program or script after a ACK from the phone has been received. This can be used to trigger uploading the second-stage firmware with osmoload after the osmocom loader has successfully been run on the phone. --- src/host/osmocon/osmocon.c | 76 ++++++++++++++++++++++++++++++++++++++++++- 1 files changed, 74 insertions(+), 2 deletions(-) diff --git a/src/host/osmocon/osmocon.c b/src/host/osmocon/osmocon.c index b3eaedb..eefbed2 100644 --- a/src/host/osmocon/osmocon.c +++ b/src/host/osmocon/osmocon.c @@ -30,6 +30,7 @@ #include <stdint.h> #include <fcntl.h> #include <errno.h> +#include <signal.h> #include <termios.h> #include <sys/ioctl.h> #include <sys/types.h> @@ -178,6 +179,19 @@ struct dnload { static struct dnload dnload; static struct osmo_timer_list tick_timer; +/* Information needed for callback on successful program upload to mobile. + * Only active if ack_prog_info.progname != NULL. */ + +#define ACK_PROG_TIMER_DELAY 2000000 +static struct osmo_timer_list ack_prog_timer; +struct ack_prog_info { + char *progname; + char *sockname; + char *serialdev; + char * const *envp; +}; +static struct ack_prog_info ack_prog_info = { NULL }; + /* Compal ramloader specific */ static const uint8_t phone_prompt1[] = { 0x1b, 0xf6, 0x02, 0x00, 0x41, 0x01, 0x40 }; static const uint8_t dnload_cmd[] = { 0x1b, 0xf6, 0x02, 0x00, 0x52, 0x01, 0x53 }; @@ -823,6 +837,9 @@ static int handle_read(void) dnload.write_ptr = dnload.data; dnload.expect_hdlc = 1; + if(ack_prog_info.progname) + osmo_timer_schedule(&ack_prog_timer,0,ACK_PROG_TIMER_DELAY); + /* check for romloader chainloading mode used as a workaround * for the magic on the C139/C140 and J100i */ if (dnload.chainload_filename != NULL) { @@ -1202,6 +1219,7 @@ dnload_mode_to_str(enum dnload_mode mode){ "\t\t [ -m {c123,c123xor,c140,c140xor,c155,romload,mtk} ]\n" \ "\t\t [ -c /to-be-chainloaded-file.bin ]\n" \ "\t\t [ -i beacon-interval (mS) ]\n" \ + "\t\t [ -a program-to-be-run-after-upload-ack ]\n" \ "\t\t file.bin\n\n" \ "* Open serial port /dev/ttyXXXX (connected to your phone)\n" \ "* Perform handshaking with the ramloader in the phone\n" \ @@ -1401,7 +1419,46 @@ void parse_debug(const char *str) } } -int main(int argc, char **argv) +/* timer callback function that gets triggered after ACK + * for successful program upload has been received from the phone + */ + +void +ack_prog_callback(void *p) +{ + pid_t chld; + char *argv[]={ + ack_prog_info.progname, + ack_prog_info.sockname, + ack_prog_info.serialdev, + (char*)dnload_mode_str[dnload.mode], + dnload.filename, + NULL + }; + int i; + + signal(SIGCHLD,SIG_IGN); + + if((chld=fork()) != 0){ /* ---- in parent ---- */ + if(chld == -1) + perror("fork()"); + else + fprintf(stderr,"Running %s on ack.\n", + ack_prog_info.progname); + return; + }; + + /* ---- in child ---- */ + for(i=3;i<1024;i++) + close(i); + + execve(ack_prog_info.progname,argv,ack_prog_info.envp); + perror(ack_prog_info.progname); + exit(1); +} + +int +main(int argc, char **argv,char **envp) { int opt, flags; uint32_t tmp_load_address = ROMLOAD_ADDRESS; @@ -1414,7 +1471,7 @@ int main(int argc, char **argv) dnload.previous_filename = NULL; dnload.beacon_interval = DEFAULT_BEACON_INTERVAL; - while ((opt = getopt(argc, argv, "d:hl:p:m:c:s:i:v")) != -1) { + while ((opt = getopt(argc, argv, "d:hl:p:m:c:s:i:va:")) != -1) { switch (opt) { case 'p': serial_dev = optarg; @@ -1444,6 +1501,9 @@ int main(int argc, char **argv) case 'i': dnload.beacon_interval = atoi(optarg) * 1000; break; + case 'a': + ack_prog_info.progname = optarg; + break; case 'h': default: usage(argv[0]); @@ -1451,12 +1511,23 @@ int main(int argc, char **argv) } } + if (argc <= optind) { dnload.filename = NULL; } else { dnload.filename = argv[optind]; } + if(ack_prog_info.progname){ + fprintf(stderr,"Will run %s on successful upload.\n", + ack_prog_info.progname); + ack_prog_info.sockname = (char*)loader_un_path; + ack_prog_info.serialdev = serial_dev; + ack_prog_info.envp = envp; + ack_prog_timer.cb = ack_prog_callback; + ack_prog_timer.data = &ack_prog_info; + } + dnload.serial_fd.fd = osmo_serial_init(serial_dev, MODEM_BAUDRATE); if (dnload.serial_fd.fd < 0) { fprintf(stderr, "Cannot open serial device %s\n", serial_dev); @@ -1520,3 +1591,4 @@ int main(int argc, char **argv) exit(0); } + -- 1.7.0.4 --X1bOJ3K7DJ5YkBrT Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="osmoload_sh.txt" #!/bin/bash socket="$1" port="$2" method="$3" main_fw="$4" fw_dir="${main_fw%/*}" new_fw="${fw_dir}/rssi.highram.bin" osmoload="$OSMOCOM_ROOT/osmocom-bb/src/host/osmocon/osmoload" tag="[${0##*/}]" echo "Environment:" env if ! [ -x "$osmoload" ] ; then echo "$tag *** $osmoload not found/not executable." >&2 exit 1 fi if ! [ -f "$new_fw" ] ; then echo "$tag *** $new_fw not found." >&2 exit 1 fi echo "$tag Socket is $socket, port is $port." >&2 echo "$tag Loader method was $method." >&2 echo "$tag New firmware will be $new_fw." >&2 MAX_PINGS=5 N=0 while [ "$N" -lt "$MAX_PINGS" ] ; do N="$(( $N + 1 ))" $osmoload -l $socket ping if [ "$?" == 0 ] ; then break fi done if [ "$N" -ge $MAX_PINGS ] ; then echo "$tag *** could not ping phone!" >&2 exit 1 fi $osmoload -l $socket memload 0x820000 $new_fw if [ "$?" != 0 ] ; then echo "$tag *** could not upload firmware!" >&2 exit 1 fi $osmoload -l $socket jump 0x820000 if [ "$?" != 0 ] ; then echo "$tag *** could not run firmware!" >&2 exit 1 fi --X1bOJ3K7DJ5YkBrT--

1 0

[PATCH 1/2] osmocon: array of download-method names
by Christian Vogel 05 Feb '12

05 Feb '12

An array of method names for the parser methods (c123xor, mtk, ...) has been introduced, so that we can easily convert back and forth. --- src/host/osmocon/osmocon.c | 39 ++++++++++++++++++++++++--------------- 1 files changed, 24 insertions(+), 15 deletions(-) diff --git a/src/host/osmocon/osmocon.c b/src/host/osmocon/osmocon.c index fc29506..b3eaedb 100644 --- a/src/host/osmocon/osmocon.c +++ b/src/host/osmocon/osmocon.c @@ -126,6 +126,16 @@ enum dnload_mode { MODE_INVALID, }; +const char * const dnload_mode_str[]={ + [MODE_C123]="c123", + [MODE_C123xor]="c123xor", + [MODE_C140]="c140", + [MODE_C140xor]="c140xor", + [MODE_C155]="c155", + [MODE_ROMLOAD]="romload", + [MODE_MTK]="mtk", +}; + struct dnload { enum dnload_state state; enum romload_state romload_state; @@ -1170,24 +1180,21 @@ static int serial_read(struct osmo_fd *fd, unsigned int flags) static int parse_mode(const char *arg) { - if (!strcasecmp(arg, "c123")) - return MODE_C123; - else if (!strcasecmp(arg, "c123xor")) - return MODE_C123xor; - else if (!strcasecmp(arg, "c140")) - return MODE_C140; - else if (!strcasecmp(arg, "c140xor")) - return MODE_C140xor; - else if (!strcasecmp(arg, "c155")) - return MODE_C155; - else if (!strcasecmp(arg, "romload")) - return MODE_ROMLOAD; - else if (!strcasecmp(arg, "mtk")) - return MODE_MTK; + int i; + for(i=0;i<MODE_INVALID;i++) + if(!strcasecmp(arg,dnload_mode_str[i])) + return i; return MODE_INVALID; } +const char * +dnload_mode_to_str(enum dnload_mode mode){ + if(mode < 0 || mode >= MODE_INVALID) + return "invalid"; + return dnload_mode_str[mode]; +} + #define HELP_TEXT \ "[ -v | -h ] [ -d [t][r] ] [ -p /dev/ttyXXXX ]\n" \ "\t\t [ -s /tmp/osmocom_l2 ]\n" \ @@ -1414,8 +1421,10 @@ int main(int argc, char **argv) break; case 'm': dnload.mode = parse_mode(optarg); - if (dnload.mode == MODE_INVALID) + if (dnload.mode == MODE_INVALID){ + fprintf(stderr,"Invalid download mode!\n"); usage(argv[0]); + } break; case 's': layer2_un_path = optarg; -- 1.7.0.4 --X1bOJ3K7DJ5YkBrT Content-Type: text/x-diff; charset=us-ascii Content-Disposition: attachment; filename="0002-osmocon-Option-a-runs-program-script-on-upload.patch"

1 0

Power-savvy GSM network (was: gsm322.c Bug Fix Patch)
by Alexander Chemeris 03 Feb '12

03 Feb '12

Hi Kurtis, (I'm changing subject to the actual topic of this discussion) Yes, I quickly looked through your code. Looks like a big hack right now, but I guess it's meant to be a hack at this point :) So, your idea is to manipulate Tx power of a BTS to cover only actually working handsets, if I understand correctly. It's not possible to do with a normal GSM phone, because phone does not transmit until it sees a beacon. So you want to create a "wake up BTS" channel to get around. Am I following your logic correctly? It does look like an interesting idea if could be done dirt-cheap. But how do you plan to do paging in this system? I see the only way - to use the same "wake up channel", but in other direction. So basically you have a network-specific "default" ARFCN which is used when no active BTS is in range. All communications are first tried on this ARFCN and only then on other ones. Right? On Thu, Feb 2, 2012 at 22:43, Kurtis Heimerl <kheimerl(a)cs.berkeley.edu> wrote: > This is part of my thesis work at Cal, yes. Range is not in any way involved. > > That's roughly the use case, areas where there are too few users to > keep a BTS in constant use. Our designs allow the power usage to scale > with the number of users, rather than sit at a fixed output, as they > do now. The BTS side is simple; the osmocom side is complicated. We > have a handset that can wakeup a sleeping tower, or a "wakeup button" > device which only transmits when a button is pressed. That thing is ~5 > bucks and can probably be attached to the back of a legacy phone in > case we can't convince a large manufacturer to incorporate our changes > into the baseband. > > Anyhow, the code is online if you're interested in looking at our > progress (https://github.com/kheimerl). It's nowhere near ready, but > you're a very knowledgeable guy, and I'd be happy to hear your > opinions on any of our designs. > > On Thu, Feb 2, 2012 at 10:37 AM, Alexander Chemeris > <alexander.chemeris(a)gmail.com> wrote: >> Is it a part of your TIER university work? >> I wonder about use cases for this. >> >> One use case I see is when you have a BTS which is rarely used, like >> in a desert and you don't want it to work all the time. What use cases >> do you plan to use it for? >> >> On Thu, Feb 2, 2012 at 22:03, Kurtis Heimerl <kheimerl(a)cs.berkeley.edu> wrote: >>> >>> Yeah, and we have that working. >>> >>> On Thu, Feb 2, 2012 at 12:56 AM, Alexander Chemeris >>> <alexander.chemeris(a)gmail.com> wrote: >>> > On Thu, Feb 2, 2012 at 12:08, Kurtis Heimerl <kheimerl(a)cs.berkeley.edu> wrote: >>> >> I think I looked at that... I'll give you some context. >>> >> >>> >> We've modified osmocom to "wakeup" a specific tower at a specific >>> >> ARFCN. >>> > >>> > Interesting. Do you mean you send some packet to a "sleeping" BTS to wake it up? >>> > >>> > -- >>> > Regards, >>> > Alexander Chemeris. >> >> >> >> >> -- >> Regards, >> Alexander Chemeris. -- Regards, Alexander Chemeris.

3 3

Re: Operator name in cell_log log file
by Andreas Eversberg 03 Feb '12

03 Feb '12

Dario Lombardo wrote: > Why doesn't cell_log write the operator name in its log file? Is there > any issue related to it? > Attached a patch to log operator name and country. > Dario. hi dario, the reason for that is that cell_log only logs the raw data. later it can be decoded (e.g. by gsmmap tool) with all the info you like. decoding things like "operator" could lead to the following problems when they are stored in the log file: - operator names may change - list of operators may have wrong names or is incomplete - decoding functions may have bugs, so they might output wrong results - decoding several informations would inflate the log file - someone using the log file may not care about operator names in the past we had a bug in the frequency list decoder. after i fixed it, i just parsed my log file again and got the right frequencies. if you need to know what operators you have in your log, i suggest to write a tool that parses the log file and outputs a list of operator infos and other infos you like. look at "gsmmap" to see how it is done. regards, andreas

1 0

develop a software radio front end
by Jerry Giant 03 Feb '12

03 Feb '12

Proposal to develop a software front end Hi, list. --Intro: After watching ccc camp videos, I bought myself a moto c118 and run the Osmocom-bb software on it. It's great fun to get a free software running on proprietary hardware, and so much could be learned from the source code. But what to do when the gray market stock sold out, or some one want to pick up the task of implementing the hardware in a open source fashion? OpenBTS used USRP to implement its radio, but USRP is aged, and it's documentation and price is not so friendly as I see. If further sub projects of osmocom matured, still we have to stick on the hacking hardware would not be so fun. To better the integrity and usefulness of the whole project, we can design and build a software radio front end for osmocom project. Interested? --Background: I am a Chinese electronic engineer working at small company in China, working on machine vision, now our product is building a FPGA/TI DSP based embedded device. I have some free time to learn and very interested in build a software radio front end. --Initial Thought: The goal of build a Osmocom Software Radio Kit, is to build a multipurpose radio front end which compatible to All or Most air interfaces now osmocom is interested. Interfacing an emulated Calypso DSP interface is way to reuse the code, or build another L1 dedicated for OSRK is an option. The hardware spec could be much better than USRP as vendor's products line evolved, but OSRK better to be mobile, has modular RF power amplifier interface, and battery powered. --Hardware Specification: Let get started.

3 2

RSSI firmware
by Dario Lombardo 03 Feb '12

03 Feb '12

Hello everybody I'm trying to use the RSSI firmware on a c118 and c115. Both of them give me this error host/osmocon/osmocon -p /dev/ttyUSB0 -m c123xor target/firmware/board/compal_e88/rssi.compalram.bin got 1 bytes from modem, data looks like: 04 . got 1 bytes from modem, data looks like: 81 . got 5 bytes from modem, data looks like: 1b f6 02 00 41 ....A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD The maximum file size is 64kBytes (65535 bytes) read_file(target/firmware/board/compal_e88/rssi.compalram.bin) failed with -27 Do I need to do something different to load this FW or simply my phones have no enough room for it? Thanks for your help. Dario.

5 7

gsm322.c Bug Fix Patch
by Kurtis Heimerl 02 Feb '12

02 Feb '12

Just a quick bug fix to gsm322.c. Basically, there were two commands in an "else" block without brackets, causing the "end = 1023+299" command to execute regardless of the state of index.

4 8

[PATCH 2/2] rearm_timer: update run-time and re-activate
by Christian Vogel 29 Jan '12

29 Jan '12

Instead of calling schedule_timer() inside the callback (which causes list-reshuffling) just call rearm_timer(self,milliseconds) to have it re-execute after the specified time. --- src/target/firmware/comm/timer.c | 6 ++++++ src/target/firmware/include/comm/timer.h | 1 + 2 files changed, 7 insertions(+), 0 deletions(-) diff --git a/src/target/firmware/comm/timer.c b/src/target/firmware/comm/timer.c index 6a649ae..d135e24 100644 --- a/src/target/firmware/comm/timer.c +++ b/src/target/firmware/comm/timer.c @@ -63,6 +63,12 @@ void schedule_timer(struct osmo_timer_list *timer, int milliseconds) add_timer(timer); } +void rearm_timer(struct osmo_timer_list *timer, int milliseconds) +{ + timer->expires = jiffies + ((milliseconds * TIMER_HZ) / 1000); + timer->active = 1; +} + void del_timer(struct osmo_timer_list *timer) { if (timer->in_list) { diff --git a/src/target/firmware/include/comm/timer.h b/src/target/firmware/include/comm/timer.h index db7d1a5..6ca51b5 100644 --- a/src/target/firmware/include/comm/timer.h +++ b/src/target/firmware/include/comm/timer.h @@ -60,6 +60,7 @@ extern unsigned long volatile jiffies; */ void add_timer(struct osmo_timer_list *timer); void schedule_timer(struct osmo_timer_list *timer, int miliseconds); +void rearm_timer(struct osmo_timer_list *timer, int milliseconds); void del_timer(struct osmo_timer_list *timer); int timer_pending(struct osmo_timer_list *timer); -- 1.7.0.4

2 1

[PATCH 1/2] printf: Hack to support gcc printf() optimization
by Christian Vogel 28 Jan '12

28 Jan '12

gcc optimizes printf("x") to putchar('x'), but we #define putchar to be something else. Now lib/printf.c defines a putchar() function that always prints on the sercomm port, it will break uart consoles. --- src/target/firmware/lib/printf.c | 16 ++++++++++++++++ 1 files changed, 16 insertions(+), 0 deletions(-) diff --git a/src/target/firmware/lib/printf.c b/src/target/firmware/lib/printf.c index a4fc687..887b5b4 100644 --- a/src/target/firmware/lib/printf.c +++ b/src/target/firmware/lib/printf.c @@ -17,3 +17,19 @@ int printf(const char *fmt, ...) return r; } + +/* HACK: we define putchar to be sercomm_putchar, + * but gcc optimizes printf("x") to putchar('x') + * so it will generate a call to the function putchar(). + * + * Note: This will break non-sercomm consoles! + */ + +#ifdef putchar +#undef putchar + +int putchar(char c){ + return sercomm_putchar(c); +} + +#endif -- 1.7.0.4

1 0

mobile DTMF timing
by mad 27 Jan '12

27 Jan '12

Hi list, hi Jolly, I just tested the DTMF support on a real network and discovered that the timeout of 70ms for receiving the Start DTMF ACK is too short. The consequences are many repeated Start DTMF messages, never received ACKs and no tone is played. Using a timer value of 170ms in mnccms.c:759 fixes this for that network. Unfortunately I didn't found - or overlooked - a mandatory timeout value for Ta in TS 23.014 which the MSC has to meet. Is that undefined in the standard and where came the 70ms from? Regards, Mad

2 2

Re: Linux + u-boot port to MT6235
by Victor Rojas 26 Jan '12

26 Jan '12

Nacesito temas y confaguracion

1 0

Creating unique features for a real OsmocomBB phone
by alphaflux 26 Jan '12

26 Jan '12

A novel feature would be direct connections to other OsmocomBB handsets that are in range. So not only handsets communicate with towers but a handset also listens to announcements of compatible handsets within range. Reason is to have free communication between different buildings, floors, rooms.

6 5

Re: Creating unique features for a real OsmocomBB phone
by Dave Schmidt 25 Jan '12

25 Jan '12

> why should two phones use uplink frequency to communicate directly > together? why not using downlink frequency? Because in most if not all counties transmission on downlink frequency requires a license? (Sorry and please correct me if this is some obvious nonsense... to me, the original proposal was looking quite nonsensial because of this, but I'd love to learn if I'm wrong...) Dave.

3 2

Asterisk GSM channel driver?
by Tim Ehlers 22 Jan '12

22 Jan '12

Hi, I have seen, that there are channel driver for the DECT project, where you can connect your DECT handset to the Asterisk PBX. There is also somehow a possibility to connect a mobile GSM phone via openBSC and asterisk. But has somebody thought about just connecting the osmocombb mobile phone (which is connected to a public mobile network [or openBSC]) to asterisk? I would think of making a call through a channel driver, osmocombb is doing a call like "call ms number", but instead of using mike and speaker asterisk would send the already in GSM-codec modulated voice data through the serial port (maybe it would needed to use the non-standard USB-TTL version to handle full duplex GSM speech). And layer1 of osmocombb could send that nearly untouched on the air. For incoming calls this could be similar + signalling the call through the channel driver. Has somebody already thought of that? Would that be a achieveable task or is it technically impossible? Thanks Tim

2 2

read Kc with osmocombb
by Tim Ehlers 20 Jan '12

20 Jan '12

Hi, today I seached for a possibility to read the temporary session key "Kc" from my phone in osmocombb. I did not find a function. So I used the function, which writes SMS into sms.txt to write the Kc. Since I never used the Kc to decode something I would like to ask if I did it correct this way: --- old/host/layer23/src/mobile/subscriber.c 2012-01-10 17:06:40.000000000 +0100 +++ new/host/layer23/src/mobile/subscriber.c 2012-01-19 23:52:36.000000000 +0100 @@ -60,6 +60,39 @@ return NULL; } +static int gsm_kc(struct osmocom_ms *ms, uint8_t *kc) +{ + const char osmocomkc[] = ".osmocom/bb/kc.txt"; + int len; + const char *home; + char *kc_file; + FILE *fp; + + home = getenv("HOME"); + if (!home) { +fail: + fprintf(stderr, "Can't deliver SMS, be sure to create '%s' in " + "your home directory.\n", osmocomkc); + return NULL; + } + len = strlen(home) + 1 + sizeof(osmocomkc); + kc_file = talloc_size(l23_ctx, len); + if (!kc_file) + goto fail; + snprintf(kc_file, len, "%s/%s", home, osmocomkc); + + fp = fopen(kc_file, "a"); + if (!fp) + goto fail; + fprintf(fp, "%s %02X%02X%02X%02X%02X%02X%02X%02X\n", ms->name, kc[0], kc[1], kc[2], kc[3], kc[4], kc[5], kc[6], kc[7], kc[8]); + fclose(fp); + + talloc_free(kc_file); + + return 0; +} + + static char *sim_decode_bcd(uint8_t *data, uint8_t length) { int i, j = 0; @@ -377,6 +410,7 @@ subscr->key_seq = data[8] & 0x07; LOGP(DMM, LOGL_INFO, "received KEY from SIM\n"); + gsm_kc(subscr->ms, subscr->key); return 0; } Maybe it would be a better way to implement a function in VTY. BTW, am I wrong or why did nobody do that until present? Thanks Tim

2 2

[PATCH] Switch to new gpsd API
by Paul Wise 18 Jan '12

18 Jan '12

--- src/host/layer23/src/common/gps.c | 26 +++++++++++++------------- 1 files changed, 13 insertions(+), 13 deletions(-) diff --git a/src/host/layer23/src/common/gps.c b/src/host/layer23/src/common/gps.c index 38aae2c..2bdfb97 100644 --- a/src/host/layer23/src/common/gps.c +++ b/src/host/layer23/src/common/gps.c @@ -56,7 +56,7 @@ static struct osmo_fd gps_bfd; #ifdef _HAVE_GPSD -static struct gps_data_t* gdata; +static struct gps_data_t gdata; int osmo_gpsd_cb(struct osmo_fd *bfd, unsigned int what) { @@ -66,25 +66,25 @@ int osmo_gpsd_cb(struct osmo_fd *bfd, unsigned int what) g.valid = 0; /* gps is offline */ - if (gdata->online) + if (gdata.online) goto gps_not_ready; /* gps has no data */ - if (gps_waiting(gdata)) + if (gps_waiting(&gdata, 500)) goto gps_not_ready; /* polling returned an error */ - if (gps_poll(gdata)) + if (gps_read(&gdata)) goto gps_not_ready; /* data are valid */ - if (gdata->set & LATLON_SET) { + if (gdata.set & LATLON_SET) { g.valid = 1; - g.gmt = gdata->fix.time; + g.gmt = gdata.fix.time; tm = localtime(&g.gmt); diff = time(NULL) - g.gmt; - g.latitude = gdata->fix.latitude; - g.longitude = gdata->fix.longitude; + g.latitude = gdata.fix.latitude; + g.longitude = gdata.fix.longitude; LOGP(DGPS, LOGL_INFO, " time=%02d:%02d:%02d %04d-%02d-%02d, " "diff-to-host=%d, latitude=%do%.4f, longitude=%do%.4f\n", @@ -111,16 +111,15 @@ int osmo_gpsd_open(void) gps_bfd.when = BSC_FD_READ; gps_bfd.cb = osmo_gpsd_cb; - gdata = gps_open(g.gpsd_host, g.gpsd_port); - if (gdata == NULL) { + if (gps_open(g.gpsd_host, g.gpsd_port, &gdata) == -1) { LOGP(DGPS, LOGL_ERROR, "Can't connect to gpsd\n"); return -1; } - gps_bfd.fd = gdata->gps_fd; + gps_bfd.fd = gdata.gps_fd; if (gps_bfd.fd < 0) return gps_bfd.fd; - if (gps_stream(gdata, WATCH_ENABLE, NULL) == -1) { + if (gps_stream(&gdata, WATCH_ENABLE, NULL) == -1) { LOGP(DGPS, LOGL_ERROR, "Error in gps_stream()\n"); return -1; } @@ -139,7 +138,8 @@ void osmo_gpsd_close(void) osmo_fd_unregister(&gps_bfd); - gps_close(gdata); + gps_stream(&gdata, WATCH_DISABLE, NULL); + gps_close(&gdata); gps_bfd.fd = -1; /* -1 or 0 indicates: 'close' */ } -- 1.7.7.3

6 9

Strange issues booting layer1
by EMP 18 Jan '12

18 Jan '12

Hi all I have compiled osmocombb and everything seems ok. Now i'm having a strange issue which I can replicate across a number of phones. Using a C118 I could boot everything and run the mobile app. Using a C139 I could do the same. However, now the phones dont seem to want to boot? I start everything up (after running the mobile app a few times, stopping the phone and PC etc) and then when I press the Power Off key, nothing happens. It just refuses to download anything. Am wondering if i'm damaging the phones somehow as its now two phones that will no longer start via the USB cable. The phones boot the normal phone firmware fine but wont respond to osmocom. Guess i'm just curious as to others thoughts as i'm unsure where its breaking?

1 0

GSM 7bit encoding/decoding
by Tim Ehlers 15 Jan '12

15 Jan '12

Hello, since I had problems with german umlauts when receiving (and probably also when sending) SMS, I looked today in the gsm translating part in libosmocore. I first noticed a problem, when sending "NETZ Number" to "4636" in O2 network, you get a response SMS saying in which network the number is located. Using osmocombb, I get: [SMS from 66399] Sehr geehrter Kunde, die angefragte Nummer ist im Netz von o2 aktiv (Angabe ohne Gew§hr). So the umlaut "ae" is converted to "§". The problem seems to be in the convert table in src/shared/libosmocore/src/gsm/gsm_utils.c, which is not bijective. "Ae" in gsm7 is "0x7b" and must be converted to latin1 "0xe4". Looking in gsm_7bit_alphabet at place "0xe4", the is "0x7b". But there is also an "0x7b" at place "0xa7", which comes first and is indeed "§". So the question is, are there mistakes in the table or is there a reason for the double entries? Thanks Tim

1 1

Paging Request3 - not standard compliant? o2-germany
by Stefan Bauer 14 Jan '12

14 Jan '12

Good evening, according to EN 300 940 - V7.7.1 - Digital cellular telecommunications system (Phase 2+); Mobile radio interface layer 3 specification (GSM 04.08 version 7.7.1 Release 1998) 9.1.24 Paging request type 3 such requests shall only address MSs by T/MSIs but i notice Type3-Requests with IMSI in o2-germany network. <0001> app_ccch_scan.c:378 Paging3: Normal paging chan n/a to imsi M(2261022118380XX) What do i miss? Stefan

2 1

Re: 3GPP - paging references
by Stefan Bauer 14 Jan '12

14 Jan '12

-----Ursprüngliche Nachricht----- Von: Sylvain Munaut <246tnt(a)gmail.com> Gesendet: Fr 13.01.2012 18:24 Betreff: Re: 3GPP - paging references An: baseband-devel(a)lists.osmocom.org; > >> Are you talking about a hardware modification of the motorola phone > > > > http://bb.osmocom.org/trac/wiki/Hardware/FilterReplacement > > Note that to receive a phone only a few meters next to you, it's not > necessary. The filters aren't that good. Thank to you point this out. I'm not interested in traffic from other phones. What i miss from the wiki or maybe just havent found yet is a statement whether i need to modify osmocom's default firmware to see uplink-traffic? (i want to see the MS response to a paging call) to understand the process of the imm.ass from BTS. Have a nice weekend stefan

1 0

AW: Re: 3GPP - paging references
by Stefan Bauer 13 Jan '12

13 Jan '12

Hi Peter, I just use the motorola to listen to my providers arcfn. Then i watch for traffic from my regular non-osmocom cell phone operating in the same cell. Are you talking about a hardware modification of the motorola phone to receive also uplink or just some software 'tuning'? I'm the transmitter in my case. Thank you Stefan ----- Ursprüngliche Nachricht ----- Von: Peter Stuge <peter(a)stuge.se> Gesendet: Freitag, 13. Januar 2012 14:47 An: baseband-devel(a)lists.osmocom.org Betreff: Re: 3GPP - paging references Stefan Bauer wrote: > I could match the informations from imm.ass (downlink) against the > paging response (uplink) on sdcch right? Anyway i still see no way > to listen to uplink traffic on sdcch without usrp-hardware. You already know what you send. If you want to listen to what someone else sends you indeed need a receiver. The Motorola phone can be modified to receive also uplink, but if the transmitter is far away it might not work anyway. //Peter

3 2

AW: Re: Re: 3GPP - paging references
by Stefan Bauer 13 Jan '12

13 Jan '12

My information is from 'decoding gsm' master thesis from glendrange, hove, hvideberg (2010) norwegian university of science and technology, page 92, figure 5.4. I,m getting closer to understand the process of assignment if i understand you correctly now. I could match the informations from imm.ass (downlink) against the paging response (uplink) on sdcch right? Anyway i still see no way to listen to uplink traffic on sdcch without usrp-hardware. Greetings stefan ----- Ursprüngliche Nachricht ----- Von: Sylvain Munaut <246tnt(a)gmail.com> Gesendet: Freitag, 13. Januar 2012 14:12 An: Stefan Bauer <stefan.bauer(a)cubewerk.de> Cc: baseband-devel(a)lists.osmocom.org Betreff: Re: Re: 3GPP - paging references Hi, > I just red that if early assignment is used (non-oascu) in a ms terminating call, there is no channel request on RACH by ms. ??? !!! ??? Where would you have read that in the spec ? > I still dont quite get then howto match imsi/tmsi to an immediate assignment. You can't ... I just said so in the previous mails ... There is no indication in the imm.ass that would allow you to know for which mobile identity a channel is intended. You can only know if it matches _your_ request (by matching time and random reference) Cheers, Sylvain

3 2

AW: Re: 3GPP - paging references
by Stefan Bauer 13 Jan '12

13 Jan '12

Sylvain, I just red that if early assignment is used (non-oascu) in a ms terminating call, there is no channel request on RACH by ms. I still dont quite get then howto match imsi/tmsi to an immediate assignment. stefan ----- Ursprüngliche Nachricht ----- Von: Sylvain Munaut <246tnt(a)gmail.com> Gesendet: Donnerstag, 12. Januar 2012 18:30 An: Stefan Bauer <stefan.bauer(a)cubewerk.de> Cc: baseband-devel(a)lists.osmocom.org Betreff: Re: 3GPP - paging references Hi, > In detail how can i match the paging for my specific imsi/tmsi to the data-channel assignment? You can't ... There is no relation between paging and the channel assignment. When the phone sees he's being paged, he will initiate the channel request procedure. He sends a RACH at a given time fn with a random reference (8bits). And then he looks for assignement matching his RACH (i.e. the time fn and random reference are repeated back by the network in the assignment so that a phone knows the channel was for it). Cheers, Sylvain

2 1

Re: 3GPP - paging references
by Stefan Bauer 13 Jan '12

13 Jan '12

-----Ursprüngliche Nachricht----- Von: Joshua Lackey <jl(a)thre.at> Gesendet: Fr 13.01.2012 01:09 Betreff: Re: AW: Re: 3GPP - paging references An: Stefan Bauer <stefan.bauer(a)cubewerk.de>; > On 01/12/2012 01:05 PM, Stefan Bauer wrote: > > Hi, > > > > Well thank you for your answer. I thought i could simply call my phone, the > network would page it and i would have the imsi/tmsi. As i'm in a very busy > cell, there are huge amounts of pagings. I have to rethink my first idea. > > Call yourself 10 times. The TMSI that appears 10 times will be yours. > (With a high probability anyway.) Hi Jushua, i don't see a way to really narrow this down by this "technique". For example in my cell, the paging traffic is very high, so there are always several pagings with the same amount. Also if i do 10 calls, i do not get put through after the first paging-request on all attempts so this is not quite precise. Am i wrong? Stefan

1 0

AW: 3GPP - paging references
by Stefan Bauer 13 Jan '12

13 Jan '12

-----Ursprüngliche Nachricht----- Von: Sylvain Munaut <246tnt(a)gmail.com> > When the phone sees he's being paged, he will initiate the channel > request procedure. > > He sends a RACH at a given time fn with a random reference (8bits). > And then he looks for assignement matching his RACH (i.e. the time fn > and random reference are repeated back by the network in the > assignment so that a phone knows the channel was for it). Sylvain, so it goes like this: ? 1. BSC starts paging MS by either TMSI/IMSI (Paging1: Normal paging chan any to imsi M(262073948077454)) 2. MS sends channel request procedure to BSC over RACH (MS uses special(random) parameters inside this request) (is there a way to see the RACH-traffic in the "air" with regular tools?) 3. BSC sends Immediate Assignment message to MS and repeates the random parameters from request (GSM48 IMM ASS (ra=0x0f, chan_nr=0x49, ARFCN=667, TS=1, SS=1, TSC=5)) Greetings Stefan

1 0

AW: Re: 3GPP - paging references
by Stefan Bauer 12 Jan '12

12 Jan '12

Hi, Well thank you for your answer. I thought i could simply call my phone, the network would page it and i would have the imsi/tmsi. As i'm in a very busy cell, there are huge amounts of pagings. I have to rethink my first idea. Stefan ----- Ursprüngliche Nachricht ----- Von: Sylvain Munaut <246tnt(a)gmail.com> Gesendet: Donnerstag, 12. Januar 2012 18:28 An: Stefan Bauer <stefan.bauer(a)cubewerk.de> Cc: baseband-devel(a)lists.osmocom.org Betreff: Re: 3GPP - paging references Hi, > In detail how can i match the paging for my specific imsi/tmsi to the data-channel assignment? You can't ... There is no relation between paging and the channel assignment. When the phone sees he's being paged, he will initiate the channel request procedure. He sends a RACH at a given time fn with a random reference (8bits). And then he looks for assignement matching his RACH (i.e. the time fn and random reference are repeated back by the network in the assignment so that a phone knows the channel was for it). Cheers, Sylvain

1 0

3GPP - paging references
by Stefan Bauer 12 Jan '12

12 Jan '12

Dear developers & users, can somebody please provide further documents to understand how paging works? In detail how can i match the paging for my specific imsi/tmsi to the data-channel assignment? I dont see my tmsi/imsi as reference in the data-channel request-frame in wireshark nor in the output of ccch_scan. I guess i have to do some math :) Thank you. Stefan

2 1

Bounce action notification
by mailman＠lists.osmocom.org 12 Jan '12

12 Jan '12

This is a Mailman mailing list bounce action notice: List: baseband-devel Member: fabian(a)auth.se Action: Subscription disabled. Reason: Excessive or fatal bounces. The triggering bounce notice is attached below. Questions? Contact the Mailman site administrator at mailman(a)lists.osmocom.org.

1 0

Creating a real usable phone using OsmocomBB
by Harald Welte 11 Jan '12

11 Jan '12

Hi all! I've mentioned this before, and I keep getting back to it: With all the great work that has been put into OsmocomBB, we are "at an arms lengh" away from being able to create a true Free Software mobile phone. We already have the hardware drivers, protocol stack and even the 'mobile' program which can be used for making and receiving voice calls and sending/receiving SMS text messages on real GSM networks! While the journey has been a lot of fun and everyone involved has learned a lot, we have so far been catering mstly about "scratching our own itch", i.e. implementing what we needed in order to satisfy our ego and/or to implement the ideas we had regarding cellular security. I believe we cannot miss the bigger opportunity here to put our code into bigger use: To create something like a very simple GSM feature phone. When we look at various areas of computing like Operating Systems or Web browsers, Free Software is not just "the hobby project catching up" with the vendors of proprietary software. Free Software can compete. In the cellular area, we have still not managed to even implement the most basic GSM feature phone that existed 15 years ago using proprietary software. We need to work on closing that gap. We need to show that a small community of Free Software developers can actually implement what teams of hundreds of engineers did in a proprietary software setting 15 years ago - despite all the lack of hardware documentation or any kind of positive feedback from the cellular chipset, handset or operator industry. If we don't at least get a 2G GSM cellphone implemented now, it will probably not happen before 2G networks become insignificant in large parts of the world. This is a call to all hands, please support this project! Regards, Harald == Technical aspects == I believe the first major decision is whether we focus on 1) the Openmoko FreeRunner / Neo1973 phones Advantages: * large screen for UI with bells and whistles * lots of RAM and Flash, even script languages or compilation on the device itself possible * second processor doesn't require us to run stack + UI on once CPU * easier debugging of UI * various existing telephony middleware and phone dialer UI projects of which hopefully one could be recycled or 2) the Motorola/Compal C1xx phones Advantags: * many more phones available, even after our software is released * lower cost of the individual phone * less power consumption due to only one small ARM7 core * smaller screen also means less fancy UI requirements Problems: * full stack + UI needs to run on calypso (L2/L3) and we'd probably some kind of RTOS like NuttX instead of our 'bare iron' code. ==== What we need in any case ==== * power management on the baseband processor through all of the stack (though it's mostly a driver/L1 kind of thing) == Summary / Opinion == It seems like running the OsmocomBB layer1 + 'mobile' as-is on the Openmoko baseband + application processor might be the quicker road to progress. Sure, the power consumption will be horrible as the AP will have to be woken up for each and every SI message, neighbor cell measurment or paging request that ew see comining in in our paging group (even in idle mode). But then, there is always the negative impact of using a relatively complex system, with two processors, a complex software stack (Linux, X11, toolkit, etc.) on one of them, etc. On the other hand, using the C1xx phones will result in a much more widely available result. The phones can still be bought in batches of 1,000 units, and they are small enough for lots of people to carry around. Furthermore, the battery lifetime is far beyond anything you would ever be able to achieve on a power-hungry smartphone platform. I believe it would be the "smart' solution, as it means we need to get everything integrated, etc. What does the community on this list think? Which way shoul we go? But maybe the best thing is to actually stat working on the power management aspects, as we will need them in both cases. Happy hacking, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

14 27

Control Update Location with osmocom
by Todor Pirov 11 Jan '12

11 Jan '12

Hi All, I'd like to know if it is possible to control with osmocom the UL requests sent from the handsets. More specifically the interval between the UL request iterations when there is no response from the HLR. Also is it possible to simulate manual registration to the network i.e. keep sending UL to the same network after the 4th UL has timed out? I guess this could be a function of the baseband chip itself but some settings are controlled by the firmware. BR, Todor

1 0

AW: random net disconn. - o2 germany - motorola c123 + c140
by Stefan Bauer 09 Jan '12

09 Jan '12

-----Ursprüngliche Nachricht----- Von: Sylvain Munaut <246tnt(a)gmail.com> > Damnit, I forgot to enable TX ... sorry about that. > > http://minus.com/mbiuqRunDm Sylvain, now it behaves much more stable!! That is awesome. Thank you. What have you changed / what was the issue? Now I'm in the network only with a single disconnect since a few minutes. I also had the chance to make a phone-call now. Stefan

4 4

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

baseband-devel