- baseband-devel - lists.osmocom.org

RE: Sim on C115 & C118
by Bogdan Alecu 18 Jan '11

18 Jan '11

I was going to ask the same question because I have same problem with sim reader mode. However I haven't used Sylvain test. I will and come back with an update.

3 3

Problem compiling OsmocomBB on BT4 RC2
by quem tu quiseres 17 Jan '11

17 Jan '11

Hi, I just started playing around with this great project and am ashamed to say I'm stumped with an annoying error when compiling. I'm compiling on a Backtrack 4 RC2 (*buntu based distro) and that may be why I'm having problems. Basically I downloaded the proper packages as per the instructions on the wiki, exported the PATH and all that, but when I run make I get this error: cd shared/libosmocore/build-target && ../configure \ --host=arm-elf-linux --disable-vty --enable-panic-infloop \ --disable-shared --disable-talloc --disable-tests \ CC="arm-elf-gcc" CFLAGS="-Os -ffunction-sections -I/root/GSM/osmocom-bb/src/target/firmware/include" configure: WARNING: If you wanted to set the --build type, don't use --host. If a cross compiler is detected then cross compile mode will be used. configure: error: cannot find install-sh or install.sh in ".." "../.." "../../.." make: *** [shared/libosmocore/build-target/Makefile] Error 1 Attached is my config.log and you can see the PATH are there. The error can be seen on this line in the log "configure:1766: error: cannot find install-sh or install.sh in ".." "../.." "../../.." Now i've checked to see if I have autoconf and automake installed (I do, I have autoconf 2.61 and automake 1.10) since my searches on the internet seem to indicate that maybe the problem. Now I usually do all my own leg work and I read and read before asking questions, but I'm afraid I can't resolve this on my own. Before I spend another afternoon searching for the solution, I remembered to ask here. Anyone have any hints on what I'm doing wrong? Do I need different automake or autoconf versions? Thanks and keep up the great work. It's been fascinating to watch the evolution of GSM hacking these last few years.

10 13

Sim on C115 & C118
by Dario Lombardo 17 Jan '11

17 Jan '11

Hello everybody I'm trying to run the "mobile" application on a C115 and a C118 phone. I want to use the real sim, so I used "sim reader" in the config. Both phones have the same behaviour: <000e> sim.c:1206 init SIM client <0005> gsm48_cc.c:61 init Call Control <0001> gsm48_rr.c:4944 init Radio Ressource process <0004> gsm48_mm.c:1220 init Mobility Management process <0004> gsm48_mm.c:971 Selecting PLMN SEARCH state, because no SIM. <0002> gsm322.c:3471 init PLMN process <0003> gsm322.c:3472 init Cell Selection process Mobile '1' initialized, please start phone now! VTY available on port 4247. <0004> subscriber.c:556 Requesting SIM file 0x2fe2 <000e> sim.c:209 got new job: SIM_JOB_READ_BINARY (handle=00000004) <000e> sim.c:697 go MF <000e> sim.c:241 SELECT (file=0x3f00) <000e> sim.c:187 sending APDU (class 0xa0, ins 0xa4) no more output beyond this point. Phones work correctly with other softwares, sim works correctly. I get no response from the sim. Is the card reader working on these phones? If yes, does anyone have suggestions to solve this issue? Thanks a lot to everybody. Dario.

2 1

C115 loader.compalram.bin
by list_mailing＠libero.it 16 Jan '11

16 Jan '11

Hello. I'm trying to load the loader.compalram.bin. The behaviour is very strange because sometimes the download is complete and successfull, sometimes; in particular, in this case, the download is complete, but any ACK is sent back from the mobile phone (see below). ./osmocon -p /dev/ttyUSB0 -m c123 ../.. /target/firmware/board/compal_e99/loader.compalram.bin got 2 bytes from modem, data looks like: 2e c8 .. got 5 bytes from modem, data looks like: 1b f6 02 00 41 ....A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD read_file(../../target/firmware/board/compal_e99/loader.compalram.bin): file_size=21752, hdr_len=4, dnload_len=21759 got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 43 C Received PROMPT2 from phone, starting download handle_write(): 4096 bytes (4096/21759) handle_write(): 4096 bytes (8192/21759) handle_write(): 4096 bytes (12288/21759) handle_write(): 4096 bytes (16384/21759) handle_write(): 4096 bytes (20480/21759) handle_write(): 1279 bytes (21759/21759) handle_write(): finished The target phone is C115. I tried compal_exx and the result is the same :-( Please, can someone help me to understand the reasons? Thanks in advance.

2 1

running voice data/encryption on compal?
by Aaron Zauner 15 Jan '11

15 Jan '11

hi, a while ago i've read that someone managed to have an active phone call over osmocom for about 20mins. i woundered if it is theoretically & technically possible to have an active, serious (thus not a5) encryption running for voice or data calls on the stack? thanks in advance & greetings from vienna ;) azet

8 10

[PATCH libosmocore] gsm 03.41: fix GSM341_MSG_CODE macro argument
by Alex Badea 15 Jan '11

15 Jan '11

One usage of the "ms" argument is typoed as "msg". Fix it to prevent subtle future failures. Also paranthesize the macro argument for good measure. Signed-off-by: Alex Badea <vamposdecampos(a)gmail.com> --- This was found by visual inspection. include/osmocore/protocol/gsm_03_41.h | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/include/osmocore/protocol/gsm_03_41.h b/include/osmocore/protocol/gsm_03_41.h index 3b1b7c9..54365cb 100644 --- a/include/osmocore/protocol/gsm_03_41.h +++ b/include/osmocore/protocol/gsm_03_41.h @@ -40,7 +40,7 @@ struct gsm341_etws_message { uint8_t data[0]; } __attribute__((packed)); -#define GSM341_MSG_CODE(ms) (ms->serial.code_lo | (msg->serial.code_hi << 4)) +#define GSM341_MSG_CODE(ms) ((ms)->serial.code_lo | ((ms)->serial.code_hi << 4)) /* Section 9.3.2.1 - Geographical Scope */ #define GSM341_GS_CELL_WIDE_IMMED 0 -- 1.7.0.4

2 1

open cell phone hardware questions
by Scott Weisman 15 Jan '11

15 Jan '11

Hi everyone. I'm admittedly more a lurker than an active participant in this project. I find it very fascinating and regard its objectives as important. I recently watched several of the C3 presentations, from this and previous years. Having open, documented hardware and software seems to be an important goal in itself. Just knowing about all the potential weaknesses in the software stacks of most phones, as well as hidden "features" like SMS messages that could, theoretically, do things like remotely enable the phone mic, among other things (things that are certainly technically possible, and also due to the closed nature of the software, completely unknown) are of grave concern to me. Now, given that the supported phone hardware is old and not reliably available, I was wondering if anyone knows if the Calypso and other chips in these old phones are still available for new designs? How much interest would there be, say, in an open, but VERY SIMPLE, actual phone? Kind of like the Pandora project, but without the ambition to make the most advanced portable game player possible. The Osmocom software would then be very easily portable to such a device. Given the seemingly widespread interest and enthusiasm for the Osmocom, OpenBTS, and OpenBSC projects, a real, genuinely open phone (not a pseudo-open phone like the FreeRunner) might possibly have enough interest, and be buildable for a low-enough cost, to merit further discussion. Anyone want to discuss this?

3 3

TODO: OsmocomBB to continually iterate over all cells and dump SI
by Harald Welte 14 Jan '11

14 Jan '11

Hi! A number of people want to do some long-term evaluation of their cellular environment and would be interested in an 'app' for OsmocomBB that continuously scans the spectrum and dumps the cell parameters such as * ARFCN, Signal Level, SNR * frequency synch offset * SCH info (BCC/NCC) * SI (at least 1-4) from BCCH I would love to do it, but I simply don't have the time. I thought maybe somebody on this list is looking for a relatively simple task and has some time. I think this is a great project to work with OsmocomBB without having to go into the details. The algorithm would look something like STATE 1: Power Scan * do power measurement over all supported bands * pick strongest N carriers and iterate over them STATE 2: FCCH/SCH acquisition * try to get lock on the carrier * if not, go back to next carrier from power scan * if yes, continue with STATE 3 STATE 3: Wait until all relevant SI have been received * generate GSMTAP output for the SI messages (or timeout) * go back to STATE 2 for next strongest ARFCN * after last ARFCN, re-start from STATE 1 This is basically the initial step of the GSM 03.22 cell (re)selection that we already have as part of the 'mobile' program. So all the code is there, but what's needed is a separate rady-made app, not requiring any user interaction. It should also include some e.g. shell script that automatically generates a new pcap file every N minutes/hours, and make sure to never overwrite any existing PCAP file. In the end, having this running for an extended period of time should simply produce a large number of PCAP files without any manual interaction. Lock-ups in any state should be detected by timers, singalling a proper L1_RESET to make sure it continues. Unplugging / re-plugging the phone should also not require any re-start of the program. Optional extensions: * software to aggregate info from the pcap files (remove duplicate entries, e.g.) * optional logging of GPS coordinates from a GPS receiver If anyone has some time to give this some work, I'd most appreciate it. Please inform the mailing list to ensure no duplicate work is created. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

4 3

i need help i use MTK chip to do a GSM USRP For my love girl
by 麦田守望 11 Jan '11

11 Jan '11

i need help i will USE MTK6219+6129 to do a GSM USRP i need baseband Firmware or USB interface to Connection PC the all base openbts

3 2

Is this true? ----> Re: ＵＳＥ　ＭＴＫ　ｃｈｉｐ　ｐｈｏｎｅ　ｆｏｒ　ＤＩＹ　ｙｏｕｒｓｅｌｆ　ＢＴＳ
by SoftwareRadioGuy 10 Jan '11

10 Jan '11

Everyone, Is it true you can use a MTK Chipset as a DIY GSM BTS/USRP ? I've emailed this fellow who posted this back in December 2010 but have gotten no reply to date. This would be excellent for use on something I'm working on in Africa for about 50 - 100 IMPOVERISHED villages. Awaiting anyone's input on this. Thank you SoftwareDefinesRadio 2010/12/15 <baseband-devel-request(a)lists.osmocom.org> > > > Today's Topics: > > 1. Price Cheap of USRP for openbts and GSM ( ???? ) > > > ---------- Forwarded message ---------- > From: "麦田守望" <775725965(a)qq.com> > To: "baseband-devel" <baseband-devel(a)lists.osmocom.org> > Date: Wed, 15 Dec 2010 14:18:50 +0800 > Subject: Price Cheap of USRP for openbts and GSM > > Hello everybody > you may have USRP ＵＳＥＭＴＫｃｈｉｐｐｈｏｎｅｆｏｒＤＩＹｙｏｕｒｓｅｌｆＢＴＳ Simple ａｎｄ > Practical ｉｆｉｎｄ Developmentｅｒ Contact ｍｅ > >

2 1

problems on ubuntu (64bit?)
by mki 10 Jan '11

10 Jan '11

if i boot the c118 from a ubuntu 10.04 lts (64bit) or a g20 arm minipc i get this here /opt/osmocom/bin/osmocon -m c123 -p /dev/ttyUSB0 /opt/osmocom/firmware/board/compal_e88/layer1.compalram.bin got 2 bytes from modem, data looks like: 2f 81 /. got 5 bytes from modem, data looks like: 00 f6 02 00 41 ....A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ got 1 bytes from modem, data looks like: 66 f got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6d m got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6c l Received FTMTOOL from phone, ramloader has aborted got 1 bytes from modem, data looks like: 65 e got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 00 . if i boot it from my mac book or a ubuntu (32bit) i get this: osmocon -m c123xor -p /dev/tty.usbserial sylvain/osmocom-bb/src/target/firmware/board/compal_e88/layer1.compalram.bin got 6 bytes from modem, data looks like: 00 00 00 00 00 00 ...... got 1 bytes from modem, data looks like: 2f / got 1 bytes from modem, data looks like: 81 . got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD read_file(sylvain/osmocom-bb/src/target/firmware/board/compal_e88/layer1.compalram.bin): file_size=54152, hdr_len=4, dnload_len=54159 got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 43 C Received PROMPT2 from phone, starting download handle_write(): 1023 bytes (1023/54159) handle_write(): 1024 bytes (2047/54159) handle_write(): 1024 bytes (3071/54159) handle_write(): 1024 bytes (4095/54159) handle_write(): 1024 bytes (5119/54159) handle_write(): 1024 bytes (6143/54159) handle_write(): 1024 bytes (7167/54159) handle_write(): 1024 bytes (8191/54159) handle_write(): 1024 bytes (9215/54159) handle_write(): 1024 bytes (10239/54159) handle_write(): 1024 bytes (11263/54159) handle_write(): 1024 bytes (12287/54159) handle_write(): 1024 bytes (13311/54159) handle_write(): 1024 bytes (14335/54159) handle_write(): 1024 bytes (15359/54159) handle_write(): 1024 bytes (16383/54159) handle_write(): 1024 bytes (17407/54159) handle_write(): 1024 bytes (18431/54159) handle_write(): 1024 bytes (19455/54159) handle_write(): 1024 bytes (20479/54159) handle_write(): 1024 bytes (21503/54159) handle_write(): 1024 bytes (22527/54159) handle_write(): 1024 bytes (23551/54159) handle_write(): 1024 bytes (24575/54159) handle_write(): 1024 bytes (25599/54159) handle_write(): 1024 bytes (26623/54159) handle_write(): 1024 bytes (27647/54159) handle_write(): 1024 bytes (28671/54159) handle_write(): 1024 bytes (29695/54159) handle_write(): 1024 bytes (30719/54159) handle_write(): 1024 bytes (31743/54159) handle_write(): 1024 bytes (32767/54159) handle_write(): 1024 bytes (33791/54159) handle_write(): 1024 bytes (34815/54159) handle_write(): 1024 bytes (35839/54159) handle_write(): 1024 bytes (36863/54159) handle_write(): 1024 bytes (37887/54159) handle_write(): 1024 bytes (38911/54159) handle_write(): 1024 bytes (39935/54159) handle_write(): 1024 bytes (40959/54159) handle_write(): 1024 bytes (41983/54159) handle_write(): 1024 bytes (43007/54159) handle_write(): 1024 bytes (44031/54159) handle_write(): 1024 bytes (45055/54159) handle_write(): 1024 bytes (46079/54159) handle_write(): 1024 bytes (47103/54159) handle_write(): 1024 bytes (48127/54159) handle_write(): 1024 bytes (49151/54159) handle_write(): 1024 bytes (50175/54159) handle_write(): 1024 bytes (51199/54159) handle_write(): 1024 bytes (52223/54159) handle_write(): 1024 bytes (53247/54159) handle_write(): 912 bytes (54159/54159) handle_write(): finished got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 03 . got 1 bytes from modem, data looks like: 42 B Received DOWNLOAD ACK from phone, your code is running now! OSMOCOM Layer 1 (revision osmocon_v0.0.0-737-ga4e3431-modified) ====================================================================== Device ID code: 0xb4fb Device Version code: 0x0000 ARM ID code: 0xfff3 cDSP ID code: 0x0128 Die ID code: c1900c14ae021565 ====================================================================== REG_DPLL=0x2413 CNTL_ARM_CLK=0xf0a1 CNTL_CLK=0xff91 CNTL_RST=0xfff3 CNTL_ARM_DIV=0xfff9 ====================================================================== Power up simcard: Assert DSP into Reset Releasing DSP from Reset Setting some dsp_api.ndb values Setting API NDB parameters DSP Download Status: 0x0001 DSP API Version: 0x0000 0x0000 Finishing download phase DSP Download Status: 0x0002 DSP API Version: 0x3606 0x0000 LOST 1880! -- its working :-) I have tried to copy the firmware from the working machine to the bad machines but the result is the same. Is it possible that the usb driver from ubuntu 10.04 lts 64bit is silly???? cable (akku-king) phone all is the same on every plattform. Have some body an Idea? -- View this message in context: http://baseband-devel.722152.n3.nabble.com/problems-on-ubuntu-64bit-tp22208… Sent from the baseband-devel mailing list archive at Nabble.com.

2 4

OSX build
by MATTHEW EVANS 09 Jan '11

09 Jan '11

Hi All, I'm really struggling to get the latest source to build on OSX. Would anyone be kind enough to offer some assistance to getting this compiled? Build fails with: ./configure: line 3461: syntax error near unexpected token `LIBOSMOCORE,' ./configure: line 3461: `PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore)' Any help or advice would be appreciated! Many Thanks, Matt.

2 1

C123: reading SIM stuck
by Frank Rosengart 09 Jan '11

09 Jan '11

Hi, just for curiosity, I would like to get the osmocomBB running on the Motorola C123. Everything works fine (radio starts scanning for networks) if I use the test SIM feature. But reading a real SIM plugged into the phone does not work for me. The 'mobile' app shows: <0004> subscriber.c:556 Requesting SIM file 0x2fe2 <000e> sim.c:209 got new job: SIM_JOB_READ_BINARY (handle=00000004) <000e> sim.c:697 go MF <000e> sim.c:241 SELECT (file=0x3f00) <000e> sim.c:187 sending APDU (class 0xa0, ins 0xa4) -end- Any hints where to start debugging? (does neither work with 3 different SIMs: swisscom, blau, super-sim) BTW: Are there any plans to support external SIM readers via PC/SC etc.? Thanks Frank

4 4

GSM Codes with Osmocombb
by Tim Ehlers 09 Jan '11

09 Jan '11

Hi, I'm playing around with Osmocom for a while now. My final goal is to use it as a stationary phone on a PC to be able to remotly control the phone. I checked out the sylvain/testing tree, to use my SIM card and managed to be able to make and receive calls. Very amazing so far. :-) Now I tried to send GSM codes (like *#21#, oder *21*{NUMBER}#) to set and unset call diverts. It seems, that "call 1 *21*{NUMBER}#" does not work. Normal GSM cellphones seem to handle these codes not as a normal call. Does anybody know how one could send GSM codes to the network? Thanks Tim

3 2

where to get osmocom-supported phones
by Scott Weisman 09 Jan '11

09 Jan '11

I know this has been asked before, but I can't find the email(s). eBay in the past has generally had a few GSM900/1800 Osmocom-supported phones, although the prices weren't always great. I managed to get a V171 that way from a Hong Kong source (for about US$20 including shipping). However, the only phones that seem available today are all GSM850/1900. Someone a while back gave a link to Polish site where you could buy phones for even cheaper. Does someone have that site, or other sites that might be useful? Thanks, Scott

2 1

osmocom on windows
by Enzo Zordan 09 Jan '11

09 Jan '11

Hello from Argentina, I'm a 26 years old student of Electronical Engineering, I'm realy very interesting in this project, I have a C115, so I'll try to compile the code, but I'm not Linux user yet. Can I run this in Windows? If not... I'll download a live cd distribution of linux =) I want to use this c115 as a test field. Best regards buddy Enzo.

3 2

simtrace simtrace_usb.h
by ml＠mail.tsaitgaist.info 08 Jan '11

08 Jan '11

Hi in simtrace/at91sam7/host, simtrace_usb.h is symbolically linked to sunbeam/home/laforge/projects/git/openpcd/firmware/include/simtrace_usb.h this might not be generic enough to keep it linked, it could point to ../../../openpcd/firmware/include/simtrace_usb.h or will openpcd and simtrace be merged, or combined in any way ? thanks, kevin

2 1

sam7utils
by ml＠mail.tsaitgaist.info 08 Jan '11

08 Jan '11

Hi, I'm trying to flash simtrace on an at91sam7s, using samba. sam7utils compiles well under amd64, but does not work. It does not output anything and quits. the only indication on dmesg is : usb 4-1: usbfs: interface 0 claimed by cdc_acm while 'sam7' sets config #1 Sam_I_Am works great on amd64, but the firmware format is not the same. Does anyone knows how to convert main_simtrace.samba to a valid intel hex ? Kevin

2 2

stuck in A1 Trying RPLMN while using testing branch? - change toolchain
by Dobrica Pavlinusic 08 Jan '11

08 Jan '11

Yesterday I asked on #osmocom irc channel about my problems with using provider card and testing branch of osmocom-bb to connect to network. I was stuck in "A1 Trying RPLMN", and I didn't see any response received with all debugging turned on. Today, I decided to change my arm toolchain to gnu-arm recommended at http://bb.osmocom.org/trac/wiki/GettingStarted I recompiled, and it worked without problems. I'm writing this e-mail as future reference since I saw few people having problem with this on irc. -- Dobrica Pavlinusic 2share!2flame dpavlin(a)rot13.org Unix addict. Internet consultant. http://www.rot13.org/~dpavlin

1 0

connect to a specific network with the mobil app
by mki 07 Jan '11

07 Jan '11

I hink my mobil is always connecting to the net with the most power. is there a way to connect to a specific network? Down her my config and tries to connect to t-mobile. if i type in the vty: local# network select 1 262 01 Network not in list! local# network search 1 local# my config: local# sh run Current configuration: ! service advanced-vty ! line vty no login ! gps device /dev/ttyACM0 gps baudrate default no gps enable ! ms 1 layer2-socket /tmp/osmocom_l2 sap-socket /tmp/osmocom_sap sim none network-selection-mode auto imei 000000000000000 0 imei-fixed no emergency-imsi no call-waiting no auto-answer no clip no clir tx-power auto no simulated-delay no stick location-updating codec full-speed prefer codec half-speed no abbrev support sms a5/1 a5/2 p-gsm e-gsm r-gsm dcs class-900 4 class-dcs 1 channel-capability sdcch+tchf+tchh full-speech-v1 full-speech-v2 half-speech-v1 min-rxlev -106 dsc-max 90 exit test-sim imsi 001010000000000 ki xor 00 00 00 00 00 00 00 00 00 00 00 00 no barred-access no rplmn hplmn-search foreign-country exit no shutdown exit ! end -- View this message in context: http://baseband-devel.722152.n3.nabble.com/connect-to-a-specific-network-wi… Sent from the baseband-devel mailing list archive at Nabble.com.

1 1

Re: Osmocon not loading
by Bogdan Alecu 07 Jan '11

07 Jan '11

I used the steps from here http://bb.osmocom.org/trac/wiki/GnuArmToolchain to build the toolchain. I also tried with and without xor, no results.

4 9

RE: AW: AW: Osmocom-BB
by Sebastian --- 07 Jan '11

07 Jan '11

no,display shows nothing. Osmocon shows: r00t@r00t-laptop:~/install/osmocom-bb/src/host/osmocon$ ./osmocon -p /dev/ttyUSB0 -m c123xor ../../target/firmware/board/compal_e88/loader.compalram.bin got 2 bytes from modem, data looks like: 2f 81 /. got 1 bytes from modem, data looks like: 00 . got 4 bytes from modem, data looks like: f6 02 00 41 ...A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ got 1 bytes from modem, data looks like: 66 f got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6d m got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6c l Received FTMTOOL from phone, ramloader has aborted got 1 bytes from modem, data looks like: 65 e got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 2f / got 1 bytes from modem, data looks like: 81 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ got 1 bytes from modem, data looks like: 66 f got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6d m got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6c l Received FTMTOOL from phone, ramloader has aborted got 1 bytes from modem, data looks like: 65 e got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 2f / got 1 bytes from modem, data looks like: 81 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ got 1 bytes from modem, data looks like: 66 f got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6d m got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6c l Received FTMTOOL from phone, ramloader has aborted got 1 bytes from modem, data looks like: 65 e got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 2e . got 1 bytes from modem, data looks like: c8 . got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD read_file(../../target/firmware/board/compal_e88/loader.compalram.bin): file_size=21740, hdr_len=4, dnload_len=21747 got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 43 C Received PROMPT2 from phone, starting download handle_write(): 1023 bytes (1023/21747) handle_write(): 768 bytes (1791/21747) handle_write(): 768 bytes (2559/21747) handle_write(): 768 bytes (3327/21747) handle_write(): 768 bytes (4095/21747) handle_write(): 768 bytes (4863/21747) handle_write(): 768 bytes (5631/21747) handle_write(): 768 bytes (6399/21747) handle_write(): 768 bytes (7167/21747) handle_write(): 768 bytes (7935/21747) handle_write(): 768 bytes (8703/21747) handle_write(): 768 bytes (9471/21747) handle_write(): 768 bytes (10239/21747) handle_write(): 768 bytes (11007/21747) handle_write(): 768 bytes (11775/21747) handle_write(): 768 bytes (12543/21747) handle_write(): 768 bytes (13311/21747) handle_write(): 768 bytes (14079/21747) handle_write(): 768 bytes (14847/21747) handle_write(): 768 bytes (15615/21747) handle_write(): 768 bytes (16383/21747) handle_write(): 768 bytes (17151/21747) handle_write(): 768 bytes (17919/21747) handle_write(): 768 bytes (18687/21747) handle_write(): 768 bytes (19455/21747) handle_write(): 768 bytes (20223/21747) handle_write(): 768 bytes (20991/21747) handle_write(): 756 bytes (21747/21747) handle_write(): finished got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 03 . got 1 bytes from modem, data looks like: 42 B Received DOWNLOAD ACK from phone, your code is running now! Received DOWNLOAD ACK from phone, your code is running now! OSMOCOM Loader (revision osmocon_v0.0.0-740-g34bbb12-modified) ====================================================================== Running on compal_e88 in environment compalram Found flash of 2097152 bytes at 0x0 with 2 regions I have to press Power on few times before it loads. Subject: AW: AW: Osmocom-BB Date: Fri, 7 Jan 2011 15:59:21 +0100 From: Andreas.Eversberg(a)versatel.de To: seppel18(a)hotmail.com does the mobile show "layer1.bin" on the display after startup? did the firmware actually load on the phone? p.s. do you mind if we CC to the mailing list, so others can help or profit from the final solution? Von: Sebastian --- [mailto:seppel18@hotmail.com] Gesendet: Freitag, 7. Januar 2011 15:51 An: Andreas.Eversberg Betreff: RE: AW: Osmocom-BB still shows "MS '1' is down, radio is not started" Subject: AW: Osmocom-BB Date: Fri, 7 Jan 2011 09:43:32 +0100 From: Andreas.Eversberg(a)versatel.de To: seppel18(a)hotmail.com CC: baseband-devel(a)lists.osmocom.org hi, can you try the following steps: 1. start osmocon 2. start mobile (be sure it is not shutdown) 3. press the power button on the phone to start the loading process after loading the binary into the phone, the phone should indicate power on to the mobile process. andreas Von: Sebastian --- [mailto:seppel18@hotmail.com] Gesendet: Freitag, 7. Januar 2011 01:37 An: Andreas.Eversberg Betreff: Osmocom-BB Hi Thanks for your Help. Now it says ms 1 is still down "radio not started". Osmocon is running (with ramloader) and layer2 socket is available. hi sebastian, there are three ways to bing it down: - "enable" -> "conf t" -> "ms 1" -> "shutdown" - the layer2 socket does not exist on startup (osmocon loader not started) - the shutdown state is stored in the config (doing "write" when it is down) just bring it up after starting osmocon: - "enable" -> "conf t" -> "ms 1" -> "no shutdown" and don't forget "write" the config, so it must not be done on every startup. andreas

2 2

Osmocon not loading
by Bogdan Alecu 07 Jan '11

07 Jan '11

Hello, I have managed to compile everything, I connected my phone trough USB but when I try to run ./osmocon -p /dev/ttyUSB0 -m c123xor ../../target/firmware/board/compal_e88/loader.compalram.bin I do not get the " Received PROMPT1 from phone, responding with CMD" message All I get is this: root@ubuntu:/home/trepx/osmocom-bb/src/host/osmocon# ./osmocon -p /dev/ttyUSB0 -m c123xor ../../target/firmware/board/compal_e88/loader.compalram.bin got 2 bytes from modem, data looks like: f1 06 .. got 5 bytes from modem, data looks like: 72 82 bf 7d fd r..}. got 1 bytes from modem, data looks like: 7f . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: a6 . got 1 bytes from modem, data looks like: 0a . got 1 bytes from modem, data looks like: 3a : got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 4d M got 1 bytes from modem, data looks like: da . root@ubuntu:/home/trepx/osmocom-bb/src/host/osmocon# ./osmocon -p /dev/ttyUSB0 -m c123xor ../../target/firmware/board/compal_e88/loader.compalram.bin got 2 bytes from modem, data looks like: f1 06 .. got 4 bytes from modem, data looks like: a6 51 d2 51 .Q.Q got 1 bytes from modem, data looks like: 4d M got 1 bytes from modem, data looks like: a3 . got 1 bytes from modem, data looks like: a3 . got 1 bytes from modem, data looks like: 00 . I have waited for 10 minutes and still nothing. Any idea how to make it work? Regards, Bogdan

3 2

Newbie: C123 + layer1.compalram.bin + layer23
by Nicolas Bareil 07 Jan '11

07 Jan '11

Hello, I try to use the 'host23/mobile' application on a C123 but without success. I followed Steve's instructions[1] with today's git tree (d95eddad): 1. osmocon -p /dev/ttyS0 -m c123xor layer1.compalram.bin 2. ./host/layer23/src/mobile/mobile 3. Power on the phone (output of theses commands is thereafter) But I'm not sure it really works: the firmware seems to freeze (not responding to the power button anymore) and the last output of 'mobile' is: <0003> gsm322.c:257 Sync to ARFCN=104 rxlev=-65 (No sysinfo yet, ccch mode NONE) Based on the low rxlevel, I guess it is not acquiring any meaningful signal? In [2], Steve said the internal antenna was switched off when the cable is plugged in, is it still true? I tried to RTFM but I am stuck here. Thanks for your patience, Footnotes: [1] http://baseband-devel.722152.n3.nabble.com/Running-osmocombb-on-a-Motorol-C… [2] http://lists.osmocom.org/pipermail/baseband-devel/2010-May/000435.html ,---- | % osmocon -p /dev/ttyS0 -m c123xor layer1.compalram.bin | ... | Received DOWNLOAD ACK from phone, your code is running now! | | OSMOCOM Layer 1 (revision osmocon_v0.0.0-598-gd95edda) | ====================================================================== | Device ID code: 0xb4fb | Device Version code: 0x0000 | ARM ID code: 0xfff3 | cDSP ID code: 0x0128 | Die ID code: ebd8283cba021198 | ====================================================================== | REG_DPLL=0x2413 | CNTL_ARM_CLK=0xf0a1 | CNTL_CLK=0xff91 | CNTL_RST=0xfff3 | CNTL_ARM_DIV=0xfff9 | ====================================================================== | | THIS FIRMWARE WAS COMPILED WITHOUT TX SUPPORT!!! | Assert DSP into Reset | Releasing DSP from Reset | Setting some dsp_api.ndb values | Setting API NDB parameters | DSP Download Status: 0x0001 | DSP API Version: 0x0000 0x0000 | Finishing download phase | DSP Download Status: 0x0002 | DSP API Version: 0x3606 0x0000 | LOST 7478! | L1CTL_RESET_REQ: FULL!L1CTL_PM_REQ start=0 end=124 | PM MEAS: ARFCN=0, 27 dBm at baseband, -110 dBm at RF | PM MEAS: ARFCN=0, 26 dBm at baseband, -112 dBm at RF | PM MEAS: ARFCN=1, 30 dBm at baseband, -107 dBm at RF | PM MEAS: ARFCN=2, 29 dBm at baseband, -108 dBm at RF | PM MEAS: ARFCN=3, 43 dBm at baseband, -94 dBm at RF | PM MEAS: ARFCN=4, 32 dBm at baseband, -105 dBm at RF | ../.. | PM MEAS: ARFCN=1023, 33 dBm at baseband, -104 dBm at RF | L1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=104, flags=0x7) | Starting FCCH RecognitionFB0 (1748:10): TOA=11712, Power=-106dBm, Angle=-22058Hz | FB0 (1775:11): TOA=12528, Power= -65dBm, Angle=-3818Hz | FB0 (1796:5): TOA= 5280, Power= -68dBm, Angle=-16117Hz | FB0 (1799:1): TOA= 96, Power=-109dBm, Angle= 7082Hz `---- ,---- | % ./host/layer23/src/mobile/mobile | ... | Failed to connect to '/tmp/osmocom_sap'. | Failed during sap_open(), no SIM reader | <000e> sim.c:1206 init SIM client | <0005> gsm48_cc.c:61 init Call Control | <0001> gsm48_rr.c:5330 init Radio Ressource process | <0004> gsm48_mm.c:1220 init Mobility Management process | <0004> gsm48_mm.c:971 Selecting PLMN SEARCH state, because no SIM. | <0002> gsm322.c:3466 init PLMN process | <0003> gsm322.c:3467 init Cell Selection process | <0003> gsm322.c:3521 No stored BA list | VTY available on port 4247. | Mobile initialized, please start phone now! | <0002> gsm322.c:3093 (ms 1) Event 'EVENT_SWITCH_ON' for automatic PLMN selection in state 'A0 null' | <000d> gsm322.c:1055 SIM is removed | <0002> gsm322.c:1056 SIM is removed | <0002> gsm322.c:511 new state 'A0 null' -> 'A6 no SIM inserted' | <0003> gsm322.c:3313 (ms 1) Event 'EVENT_SWITCH_ON' for Cell selection in state 'C0 null' | <0003> gsm322.c:2986 Switch on without SIM. | <0003> gsm322.c:540 new state 'C0 null' -> 'C6 any cell selection' | <0003> gsm322.c:2404 Getting PM for frequency 0 twice. Overwriting the first! Please fix prim_pm.c | <0003> gsm322.c:2415 Found signal (frequency 3 rxlev -94 (16)) | <0003> gsm322.c:2415 Found signal (frequency 8 rxlev -86 (24)) | <0003> gsm322.c:2415 Found signal (frequency 16 rxlev -93 (17)) | ... | <0003> gsm322.c:2415 Found signal (frequency 819 rxlev -97 (13)) | <0003> gsm322.c:2404 Getting PM for frequency 955 twice. Overwriting the first! Please fix prim_pm.c | <0003> gsm322.c:2415 Found signal (frequency 982 rxlev -98 (12)) | ... | <0003> gsm322.c:2415 Found signal (frequency 1004 rxlev -91 (19)) | <0003> gsm322.c:2415 Found signal (frequency 1007 rxlev -89 (21)) | <0003> gsm322.c:2415 Found signal (frequency 1009 rxlev -97 (13)) | <0003> gsm322.c:2415 Found signal (frequency 1010 rxlev -86 (24)) | <0003> gsm322.c:2415 Found signal (frequency 1011 rxlev -67 (43)) | <0003> gsm322.c:2415 Found signal (frequency 1012 rxlev -86 (24)) | <0003> gsm322.c:2415 Found signal (frequency 1013 rxlev -80 (30)) | <0003> gsm322.c:2415 Found signal (frequency 1014 rxlev -87 (23)) | <0003> gsm322.c:2415 Found signal (frequency 1021 rxlev -82 (28)) | <0003> gsm322.c:2415 Found signal (frequency 1022 rxlev -98 (12)) | <0003> gsm322.c:2348 Found 97 frequencies. | <0003> gsm322.c:257 Sync to ARFCN=104 rxlev=-65 (No sysinfo yet, ccch mode NONE) `----

4 7

AW: Osmocom-BB
by Andreas.Eversberg 07 Jan '11

07 Jan '11

hi, can you try the following steps: 1. start osmocon 2. start mobile (be sure it is not shutdown) 3. press the power button on the phone to start the loading process after loading the binary into the phone, the phone should indicate power on to the mobile process. andreas ________________________________ Von: Sebastian --- [mailto:seppel18@hotmail.com] Gesendet: Freitag, 7. Januar 2011 01:37 An: Andreas.Eversberg Betreff: Osmocom-BB Hi Thanks for your Help. Now it says ms 1 is still down "radio not started". Osmocon is running (with ramloader) and layer2 socket is available. hi sebastian, there are three ways to bing it down: - "enable" -> "conf t" -> "ms 1" -> "shutdown" - the layer2 socket does not exist on startup (osmocon loader not started) - the shutdown state is stored in the config (doing "write" when it is down) just bring it up after starting osmocon: - "enable" -> "conf t" -> "ms 1" -> "no shutdown" and don't forget "write" the config, so it must not be done on every startup. andreas

1 0

OsmocomBB support in Motorola C168
by rakesh mukundan 06 Jan '11

06 Jan '11

Hi All. I am a newbie to OssmocomBB, though I have been reading the mails, never actually got a chance to start working. But after watching the 27C3 video, now I am totally inspired :) The problem I am facing the unavailability of the hardware, the only phone available to me as of now is Motorola C168, Can anyone tell me if it will be compact able with OsmocomBB? I have searched in the mailing list archives but could find an answer :( Thanks in Advance Regards ----- Rakesh Mukundan http://simplified-security.blogspot.com/

3 2

MT612X RF Transceiver Data Sheet
by Fadil Berisha 06 Jan '11

06 Jan '11

I need programming Data Sheet for MT612X RF Transceiver, especially data for programming serial interface, internal registers, vco etc. Does somebody know link to get data? I did some google search and come to this link: http://code.google.com/p/ptmtk/source/checkout There, under directory mtk_datasheet found MT612X IC data with electrical data, pin description etc. There is also, reference phone design and detailed programming data sheet for Baseband processors MT6217, MT6219 and MT6253. Knowing that is under developing osmocomBB driver for MT, I thought this might interest you! koliqi

1 0

Dropping the layer23 application?
by Holger Hans Peter Freyther 06 Jan '11

06 Jan '11

Hi all, I think the layer23 app was great when Dieter and others worked on the TX part of Osmocom but right now it has the potential of disturbing a real network. So it could be changed in a way that it checks if the firmware has TX disabled (maybe even make TX disabling a runtime setting), and then still follow the first assignment, never transmit anything and on a CIPHER MODE COMMAND switch back to the BCCH (or when no enc is used at the release message). comments? holger

2 1

AW: administratively down?
by Andreas.Eversberg 06 Jan '11

06 Jan '11

hi sebastian, there are three ways to bing it down: - "enable" -> "conf t" -> "ms 1" -> "shutdown" - the layer2 socket does not exist on startup (osmocon loader not started) - the shutdown state is stored in the config (doing "write" when it is down) just bring it up after starting osmocon: - "enable" -> "conf t" -> "ms 1" -> "no shutdown" and don't forget "write" the config, so it must not be done on every startup. andreas ________________________________ Von: baseband-devel-bounces(a)lists.osmocom.org [mailto:baseband-devel-bounces@lists.osmocom.org] Im Auftrag von Sebastian --- Gesendet: Mittwoch, 5. Januar 2011 21:57 An: baseband-devel(a)lists.osmocom.org Betreff: administratively down? Next Problem: ./mobile says "MS '1' is administratively down". I tried everything..put osmocom.cfg in /etc/osmocom .... How can I bring it "UP"? (Like in Cisco world :)

1 0

Compile Errors
by Sebastian --- 06 Jan '11

06 Jan '11

Hi, I use Ubuntu 9.10, when i try to Compile Osmocom, i get this: root@r00t-laptop:~# cd /home/r00t/install/osmocom-bb/src root@r00t-laptop:~/install/osmocom-bb/src# make cd shared/libosmocore/build-target && ../configure \ --host=arm-elf-linux --disable-vty --enable-panic-infloop \ --disable-shared --disable-talloc --disable-tests \ CC="/home/r00t/install/gnuarm-3.4.3/bin/arm-elf-gcc" CFLAGS="-Os -ffunction-sections -I/home/r00t/install/osmocom-bb/src/target/firmware/include" configure: WARNING: If you wanted to set the --build type, don't use --host. If a cross compiler is detected then cross compile mode will be used. checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for arm-elf-linux-strip... no checking for strip... strip checking for a thread-safe mkdir -p... /bin/mkdir -p checking for gawk... gawk checking whether make sets $(MAKE)... yes checking whether make sets $(MAKE)... (cached) yes checking for arm-elf-linux-gcc... /home/r00t/install/gnuarm-3.4.3/bin/arm-elf-gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... yes checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether /home/r00t/install/gnuarm-3.4.3/bin/arm-elf-gcc accepts -g... yes checking for /home/r00t/install/gnuarm-3.4.3/bin/arm-elf-gcc option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of /home/r00t/install/gnuarm-3.4.3/bin/arm-elf-gcc... gcc3 checking build system type... i686-pc-linux-gnulibc1 checking host system type... arm-elf-linux-gnu checking for a sed that does not truncate output... /bin/sed checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for fgrep... /bin/grep -F checking for ld used by /home/r00t/install/gnuarm-3.4.3/bin/arm-elf-gcc... /home/r00t/install/gnuarm-3.4.3/arm-elf/bin/ld checking if the linker (/home/r00t/install/gnuarm-3.4.3/arm-elf/bin/ld) is GNU ld... yes checking for BSD- or MS-compatible name lister (nm)... no checking for arm-elf-linux-dumpbin... no checking for arm-elf-linux-link... no checking for dumpbin... no checking for link... link -dump -symbols configure: WARNING: using cross tools not prefixed with host triplet checking the name lister (link -dump -symbols) interface... BSD nm checking whether ln -s works... yes checking the maximum length of command line arguments... 805306365 checking whether the shell understands some XSI constructs... yes checking whether the shell understands "+="... yes checking for /home/r00t/install/gnuarm-3.4.3/arm-elf/bin/ld option to reload object files... -r checking for arm-elf-linux-objdump... no checking for objdump... objdump checking how to recognize dependent libraries... pass_all checking for arm-elf-linux-ar... no checking for ar... ar checking for arm-elf-linux-strip... strip checking for arm-elf-linux-ranlib... no checking for ranlib... ranlib checking command to parse link -dump -symbols output from /home/r00t/install/gnuarm-3.4.3/bin/arm-elf-gcc object... failed checking how to run the C preprocessor... /home/r00t/install/gnuarm-3.4.3/bin/arm-elf-gcc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... no checking for inttypes.h... no checking for stdint.h... yes checking for unistd.h... yes checking for dlfcn.h... no checking for objdir... .libs checking if /home/r00t/install/gnuarm-3.4.3/bin/arm-elf-gcc supports -fno-rtti -fno-exceptions... no checking for /home/r00t/install/gnuarm-3.4.3/bin/arm-elf-gcc option to produce PIC... -fPIC -DPIC checking if /home/r00t/install/gnuarm-3.4.3/bin/arm-elf-gcc PIC flag -fPIC -DPIC works... yes checking if /home/r00t/install/gnuarm-3.4.3/bin/arm-elf-gcc static flag -static works... yes checking if /home/r00t/install/gnuarm-3.4.3/bin/arm-elf-gcc supports -c -o file.o... yes checking if /home/r00t/install/gnuarm-3.4.3/bin/arm-elf-gcc supports -c -o file.o... (cached) yes checking whether the /home/r00t/install/gnuarm-3.4.3/bin/arm-elf-gcc linker (/home/r00t/install/gnuarm-3.4.3/arm-elf/bin/ld) supports shared libraries... yes checking dynamic linker characteristics... GNU/Linux ld.so checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... yes checking whether to build shared libraries... no checking whether to build static libraries... yes checking for ANSI C header files... (cached) yes checking execinfo.h usability... no checking execinfo.h presence... no checking for execinfo.h... no checking sys/select.h usability... no checking sys/select.h presence... no checking for sys/select.h... no checking if /home/r00t/install/gnuarm-3.4.3/bin/arm-elf-gcc supports -fvisibility=hidden... no configure: creating ./config.status config.status: creating libosmocore.pc config.status: creating libosmocodec.pc config.status: creating libosmovty.pc config.status: creating include/osmocom/Makefile config.status: creating include/osmocom/vty/Makefile config.status: creating include/osmocom/codec/Makefile config.status: creating include/osmocom/crypt/Makefile config.status: creating include/osmocore/Makefile config.status: creating include/osmocore/protocol/Makefile config.status: creating include/Makefile config.status: creating src/Makefile config.status: creating src/vty/Makefile config.status: creating src/codec/Makefile config.status: creating tests/Makefile config.status: creating tests/timer/Makefile config.status: creating tests/sms/Makefile config.status: creating tests/msgfile/Makefile config.status: creating tests/ussd/Makefile config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged config.status: executing depfiles commands config.status: executing libtool commands cd shared/libosmocore/build-target && make make[1]: Betrete Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target' make all-recursive make[2]: Betrete Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target' Making all in include make[3]: Betrete Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/include' Making all in osmocom make[4]: Betrete Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/include/osmocom' Making all in codec make[5]: Betrete Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/include/osmocom/codec' make[5]: Für das Ziel »all« ist nichts zu tun. make[5]: Verlasse Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/include/osmocom/codec' Making all in crypt make[5]: Betrete Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/include/osmocom/crypt' make[5]: Für das Ziel »all« ist nichts zu tun. make[5]: Verlasse Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/include/osmocom/crypt' make[5]: Betrete Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/include/osmocom' make[5]: Für das Ziel »all-am« ist nichts zu tun. make[5]: Verlasse Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/include/osmocom' make[4]: Verlasse Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/include/osmocom' Making all in osmocore make[4]: Betrete Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/include/osmocore' Making all in protocol make[5]: Betrete Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/include/osmocore/protocol' make[5]: Für das Ziel »all« ist nichts zu tun. make[5]: Verlasse Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/include/osmocore/protocol' make[5]: Betrete Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/include/osmocore' make[5]: Für das Ziel »all-am« ist nichts zu tun. make[5]: Verlasse Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/include/osmocore' make[4]: Verlasse Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/include/osmocore' make[4]: Betrete Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/include' make[4]: Für das Ziel »all-am« ist nichts zu tun. make[4]: Verlasse Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/include' make[3]: Verlasse Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/include' Making all in src make[3]: Betrete Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/src' Making all in . make[4]: Betrete Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/src' CC rate_ctr.lo ../../src/rate_ctr.c:24:22: inttypes.h: No such file or directory make[4]: *** [rate_ctr.lo] Fehler 1 make[4]: Verlasse Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/src' make[3]: *** [all-recursive] Fehler 1 make[3]: Verlasse Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target/src' make[2]: *** [all-recursive] Fehler 1 make[2]: Verlasse Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target' make[1]: *** [all] Fehler 2 make[1]: Verlasse Verzeichnis '/home/r00t/install/osmocom-bb/src/shared/libosmocore/build-target' make: *** [shared/libosmocore/build-target/src/.libs/libosmocore.a] Fehler 2 root@r00t-laptop:~/install/osmocom-bb/src#

11 14

administratively down?
by Sebastian --- 05 Jan '11

05 Jan '11

Next Problem: ./mobile says "MS '1' is administratively down". I tried everything..put osmocom.cfg in /etc/osmocom .... How can I bring it "UP"? (Like in Cisco world :)

1 0

HP 8922 at Helmut Singer
by Harald Welte 03 Jan '11

03 Jan '11

Hi, just in case anyone is looking for a HP 8922 MS tester, there is one available from Helmut Singer. It has an 'ok but not ridiculously cheap' price, based on Dieter and my experience. http://www.helmut-singer.de/stock/1552426140.html The 8922 is particularly well suited for layer 1 testing + development. I personally don't have one (only Racal 6103), and don't want to put another 20kg of old measurement equipment in my lab... -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

2 1

IMPORTANT clarifications about 27C3 GSM Sniff Talk
by Sylvain Munaut 31 Dec '10

31 Dec '10

Hi, Since a lot of people are asking the same questions and there seems to be a rush on the C123 on ebay I tought some clarification is needed. Short version: - The exact tools I used on stage are _not_ and will _not_ be released (or sold ... several people asked ...) - Any one willing to re-code them without any apriori knowledge of GSM would most likely need months to read/understand both the specifications and the way the code works. (That's thousands of page of GSM spec and thousands of line of code) - Osmocom-BB project is not designed to be a sniffer, it's a baseband implementation, I just used part of it as a base. So basically, unless you are really interested in GSM and are willing to dedicate time to understand it deeply and to contribute the various projects, there is not much point in you buying phones, or hanging out in the ml/irc or whatever ... For those who are still reading and interested here's a little more detail: * The HLR query step: -> Go watch the awesome 25C3 talk about it * The TMSI recovering step - Won't be published - If you know how paging works, you know what to do anyway and it's trivial. Method is in the talk, there is nothing to it. * The targeted sniffing application - Won't be published either - Some improvements to the layer23 app frame work will be done but these are generic framework stuff, not app-specific - Again, if you know how L2 works and have looked at several traces, it's obvious what to do. - The 'DSP' part of the sniffer is public for a while with a small demo app (single phone and doesn't exploit the full potential of the DSP patch) and it's perfectly sufficient to debug things on your o wn controlled network. (This is basically what I showed at Deepsec 2010). * The tool to generate the input to Kraken - Won't be published either - Making the guesses is easy for anyone that knows what he's doing. * The improved Kraken - No idea about it, see with Karsten / Sacha / Frank, I only got access to it 1 hour or so before the talk :) * Conversion from burst to audio - This was a hacked software mostly with airprobe code. - The exact app will not be released but I'd like to see the capability put in some clean library we can re-use from airprobe and other application without having to multiply the code each time. - ... But since I'd like it to support AMR and viterbi softoutput before that happens, it could take some time. - Anyone familiar with GSM, airprobe and C could re-hack the same thing in an hour ... As you can see, everything you need to analyze your own network / your own traffic, even at the burst level is already published and has been for more than a month. The other tools have been written only so that we could demonstrate that what we _say_ is possible for about year, we can now do it _practically_. It's apparently needed to get people attentions, "theoretical" attacks are not enough to get the operators / gsma to react. We'll see if that did it ... A few advices that are always good: - Make sure to checkout the a5/1 project ML and airprobe project ML and try to ask your questions in the proper mailing list as much as possible. - Check the wiki and mailing list archives toroughly before asking questions. Cheers, Sylvain Munaut PS: I only posted on this list because it seems a lot of people were pointed here while in fact airprobe would probably be more appropriate to discuss attack scenarios and such, so make sure to answer / start new discussion on the right list.

1 0

27c3 videos
by Jason 31 Dec '10

31 Dec '10

I found the videos at [1], but I don't have an iphone... Are the videos available in different formats? Apparently, Apple's HTTP streaming, segmented mpeg-ts is rather new [2] and there isn't much support for it. I found how to create them [3] and code [4] to create the playlist and segments, but nothing on how to play them or cat them back together. I tried using ffmpeg to convert them the mpeg-ps files, then catting them together (from the ffmpeg manual). This worked, except that the audio went out of sync, and every five seconds the screen goes grey because of the original file boundaries. Any pointers? thx, Jason. [1] http://27c3.iphoneblog.de/recordings/3952.html [2] http://tools.ietf.org/html/draft-pantos-http-live-streaming-01 [3] http://www.ioncannon.net/projects/http-live-video-stream-segmenter-and-dist… [4] https://github.com/carsonmcdonald/HTTP-Live-Video-Stream-Segmenter-and-Dist…

2 2

On the gsm positioning faking
by Fabio Pietrosanti (naif) 30 Dec '10

30 Dec '10

Hi guys, i just looked at 27c3 talk on http://27c3.iphoneblog.de/recordings/3952.html (i really wanted to be there!) and heard about the concept of being able to fake gsm based position systems. Which could in theory the distance that could be faked respect to the knowledge that the BTS can acquire? I mean, the modified timing information provided by phone running osmocombb, how many meters distance from BTS could be? -naif

1 0

Fwd: MTK port: Interesting device.
by Andrew 29 Dec '10

29 Dec '10

Hello all. Just back from the hospital, so I haven't followed the development much for some time. Anyway, I've recently stumbled upon an interesting device: https://www.dealextreme.com/details.dx/sku.50391 I think I'll order that one sometime soon, so that I can look at it in more detail. This is a chinese phone with android, but some things make me think that's MTK inside. According to desctiption: ARM926EJ-S rev 5(v5l) BogoMIPS: 207.66 Android 2.2.1 OS system/Wifi(802.11b)/TV/GPS/FM/JAVA Price - 130 bucks. Sounds familiar? Compared to my E1000: ARM926EJ-S rev 5 (v5l) BogoMIPS: 104.24 Twice more Bogomips. The hardware pretty much seems like a typical MTK, and for that price I guess there actually is MTK inside, something a little better than 2635, so the problem is to find the sources somewhere (And my bet is, that if they don't make it to the mainline - they'll leak out to the web) If the chips are pretty much identical, and they are, this might be a good thing. I think I'll buy one after the holiday madness is over and, hopefully, provide teardown photos, firmware dump and more details. Regards, Andrew.

3 2

AW: TODO: OsmocomBB to continually iterate over all cells and dump SI
by Andreas.Eversberg 26 Dec '10

26 Dec '10

> Just to avoid any duplicate of work as well: most of this is already > done by cell_log (layer23/src/misc). It iterates over the whole spectrum > and tries to get an Immediate Assignment by sending a RACH to every cell. > It stores SI1-4, GPS position and the TA in a logfile, and using the > gsmmap utility you can create a *.kml map of the calculated cell > positions for Google Earth. > So what's missing is really only the PCAP support and a command line > switch to turn off the "active" scanning by sending no RACHs. hi steve, exactly. almost everything is already there. there are some things that may need to be improved in my opinion: - deactivating/activating the RACH request - altering maximum distance (gps) moving off the position of last power scan, before restarting scanning process. - multiple radio support for faster scanning and deeper scanning while moving. - selecting between the generic text format and PCAP. - option to wait some more time to receive more system informations than the mandatory 1..4 regards, andreas

2 2

different behaviour when osmocom-bb runs on c155 and c115
by ste7an 23 Dec '10

23 Dec '10

When running the layer23/mobile host application in combination with layer1 firmware on a c115 (compal_e88 based) I can easily connect with a network (when using Sylvain's test trunk, which supports the SIM very well!). However, running the same code on the C155 (compal_e99 based) the phone refuses to connect to the network and keeps scanning ARFCN's. Is there any real difference between these phones except for the LCD's? In rffe_dualband.c I see a remark about the value of SYSTEM_INHERENT_GAIN that has been measured by Harald on the C123. May that be a different value for the C155? Is this a problem observed by others, or is there a workaround?

1 0

can't get SAM7-p64 board into SAM-BA
by Stefan Op de Beek 21 Dec '10

21 Dec '10

I tried to load the dfu.bin+main.bin (=samba) onto the Olimex SAM7-P64 board. I connected jumper TEST for >10s, disconnected power, reconnected power. I assume that it is possible now to upload firmware using sam-ba (i tried both linux and windows) over the USB port. Even trying to connect through the dbg serial port failed. Is there something wrong with the board or in the procedure I follow. Should I see a USB-CDC serial port when the SAM7 is running the SAM-BA bootloader? Any comments would be appreciated.

2 1

Working on the documentation...
by Holger Freyther 20 Dec '10

20 Dec '10

Hi all, I have started a GettingStarted[1] page to cover the topics of getting the code, getting an ARM toolchain and pointing to the osmocon and layer23 pages for the details. I was also going through the search to update the names of the firmware binaries. The CalypsoRomloader[2] page deserves an update as well. It is referring to the GTA0X but then tries to flash a nonexistent E88 binary. I am not sure what to turn this page into. Do we also have a list of Milestones we want to accomplish (besides merging the sending code to master)? Do we have junior tasks for people that would like to get started on target and host firmware? regards z. [1] http://bb.osmocom.org/trac/wiki/GettingStarted [2] http://bb.osmocom.org/trac/wiki/CalypsoRomloader

1 0

SIMtrace hardware
by ml＠mail.tsaitgaist.info 18 Dec '10

18 Dec '10

Hi, I made a lot of changes to the SIMtrace hardware schema. Here my v0.5 : https://gsm.tsaitgaist.info/SIMtrace/v0.5/SIMtrace.ps Some important point that are unclear, where I would like to have some comments : - I do not use USB_DP_PUP which I found in several at91sam7s design (and openPCD). I don't know if it will be useful or required. - I use npn transistor as switches (2 for I/O because bidirectional). Maybe (N/P/C)MOS is a better solution. I already bought most of the parts and would like to start drawing the PCB. Please tell me if you find some errors or have any advices. kevin

1 0

got Simtrace to compile
by ste7an 17 Dec '10

17 Dec '10

I ordered a SAM7-P64 board for running Simtrace (received board today, but still waiting for the REBELSIm connectors). When compiling the code (using Gnuarm3.4.3) I got two errors: 1) the --g($DEBUGF) option was not understood; omitting this, made the Makefile (for dfu and main) working 2) in /lib/vsprintf.c I had to add #include <limits.h> in order to prevent errors related to MAX_INT etc. Are there any ideas for making a man-in-the-middle SIM device? One master interface to a real SIM, another slave interface providing a SIM interface towards a phone with the possibility to filter certain APDU's or to add files or commands on top of the real SIM. This would need an additional SIM master interface (to send and receive APDU's to the real SIM) on top of what already is in SIMtrace and the slave interface should be capable of sending messaged back to the real SIM master. I will look into it, first starting with implementing a simple SIM card master on the other UART.

3 4

sciphone g2 connector
by Alexander Huemer 17 Dec '10

17 Dec '10

hi, i want to make a cable for the sciphone g2 that provides serial communication and charging with one connector. unfortunately the pictures at [1] aren't clear enough for me. i don't want to kill my phone. actually i count 15 pins in the picture, where mine has only 12. that's weird. i guess that 2 are just for aligning the case, but that still makes 13 vs. 12. i tried to ascii draw the connector from the back (soldering) side. the rounded half of the connector on the upper side. The pins i found described elsewhere on the internet are already marked. -------------------------- ( ) ( ) | ( ) | +-------------------------+ | | | | | | | | | / | | | | | | | | / +-------------------------+/ ^ ^ ^ ^ | | | | | | | +--- GND | | +----- GND | +----------- RX (PC -> Phone) +--------------- TX (Phone -> PC) could someone please mark the pins that have to be connected for charging ? i guess one of the two GND pins is involved. kind regards and thanks for your time -Alex [1] http://en.qi-hardware.com/wiki/Sciphone_Dream_G2

2 1

Price Cheap of USRP for openbts and GSM
by 麦田守望 15 Dec '10

15 Dec '10

Hello everybody you may have USRP ＵＳＥ　ＭＴＫ　ｃｈｉｐ　ｐｈｏｎｅ　ｆｏｒ　ＤＩＹ　ｙｏｕｒｓｅｌｆ　ＢＴＳ　Simple　ａｎｄ　Practical　　ｉ　ｆｉｎｄ　Developmentｅｒ　Contact　ｍｅ

1 0

MTK chip for GSM USRP
by 麦田守望 14 Dec '10

14 Dec '10

Hello everybody I want to develop USB Interface USRP Use MTK 6218 chip, But no Firmware Source Code 6218 is ARM Core 'USE it is a GSM Way of USRP .Friends if you Have to know Please contact me

1 0

Qualcomm documentation
by Andreas Galauner 13 Dec '10

13 Dec '10

Hello everybody, last year I stumbled upon a PDF which describes all registers inside the Qualcomm MSM7200 series chipset. I now got a new mobile phone and remembered about that document because wanted to play a bit with my old one (HTC Magic/Sapphire/G2/Ion). I googled a few hours now and found several documents from Qualcomm, but I just found a whole svn repository full of Documentation [1]. Those Qualcomm chipsets are particularly interesting, because, due to Android, there already is a Linux kernel for the ARM11 core available. The missing part is a free implementation of the ARM9 baseband. My next goal is, as soon as I managed to solder cables to the JTAG pins covered in epoxy, to get own code running on the ARM9. I don't know how hard this will get, because this chipset has several security features like signature checking of code, fusebits for security configuration etc., but I will give it a try. JTAG definitely is still activated, because several people developed a method to unbrick their phones in case they have a bad ARM11 bootloader. And even if there is no chance to get own code running right away, I'm pretty certain that there somewhere is a buffer overflow which is exploitable. Either inside the baseband itself or in the serial console command parser of the early bootloaders provided by the OEM (OEMSBL). Time will tell. I hope I've got something to show you at the 27C3. My problem is that I don't have enough experience and knowledge about GSM yet to estimate if all this documentation is sufficient to implement a real baseband software on this chipset. If it's not, I think it's pointless to invest several days/nights of work to get own code running. Maybe somebody of you can have a quick look over the repository and the documents? Thanks, Andy [1]: http://code.google.com/p/ptwcdma/source/browse/

4 4

Osmocom SIMtrace
by Simon Barnett 13 Dec '10

13 Dec '10

Hi All, I'm not 100% sure this is the right place to post this really, maybe someone can point me in the right direction if I'm in the wrong place. I'm trying to build the Osmocom SIMtrace firmware, but so far I'm not having much luck When I try to make it I get the following output: - make -f Makefile.dfu BOARD=OLIMEX -------- begin (mode: RUN_FROM_ROM) -------- arm-elf-gcc (GCC) 4.0.2 Copyright © 2005 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. scripts/mkcompile_h > include/compile.h svn: '.' is not a working copy svn: warning: '.' is not a working copy make: *** No rule to make target `src/simtrace/usb_strings_dfu.txt', needed by `src/simtrace/usb_strings_dfu.h'. Stop. Has anyone got any ideas how I might be able to fix this? Thanks, Simon

4 5

Sciphone's Versions and European Shops
by luca bongiorni 12 Dec '10

12 Dec '10

Hi mates, i was thinking to start to work also on Sciphone and starting to learn as much as i can and contribute to the community (even if actually i'm a noob of phone firmwares, i worked only on MIPS router firmwares ). Have you some usefull books/wiki/etc to start on? These are the 3 versions identified of Sciphone: HY27XS08121M - 512Mb (64MB) NAND + 32MB RAM HY27XA081G1M - 1Gb (128MB) NAND + 32MB RAM TC58NVG0S3AFT - 1Gb (128MB) NAND + 64MB RAM How i could ask to sellers for the best version? (TC58NVG0S3AFT - 1Gb (128MB) NAND + 64MB RAM) Do you know an european shop where i can find it? Thankyou for attention folks Regards Luca

2 1

[ADM] Please try to avoid merges in the git tree
by Harald Welte 11 Dec '10

11 Dec '10

Hi all, this is just a general request to everyone with git commit access on the OpenBSC / Osmocom repositories. I would appreciate to restrict the use of 'git merge' to the absolute minimum neccessarry, as it makes the commitlog and timeline much harder to understand. If you're working on some private branch on a particular feature, please rebase that private branch on current master before pushing the changes. Thanks! -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

2 1

[PATCH] connect's addrlen should be sizeof(local), not the contained path's length. Permits layer23 to work on OS X.
by David Wilson 11 Dec '10

11 Dec '10

--- src/host/layer23/src/common/l1l2_interface.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/host/layer23/src/common/l1l2_interface.c b/src/host/layer23/src/common/l1l2_interface.c index e72b86e..08ef7be 100644 --- a/src/host/layer23/src/common/l1l2_interface.c +++ b/src/host/layer23/src/common/l1l2_interface.c @@ -118,9 +118,10 @@ int layer2_open(struct osmocom_ms *ms, const char *socket_path) local.sun_path[sizeof(local.sun_path) - 1] = '\0'; rc = connect(ms->l2_wq.bfd.fd, (struct sockaddr *) &local, - sizeof(local.sun_family) + strlen(local.sun_path)); + sizeof(local)); if (rc < 0) { - fprintf(stderr, "Failed to connect to '%s'.\n", local.sun_path); + fprintf(stderr, "Failed to connect to '%s': %s\n", local.sun_path, + strerror(errno)); close(ms->l2_wq.bfd.fd); return rc; } -- 1.7.3.2 -- Computers are useless. They can only give you answers. -- Pablo Picasso

5 6

MT6235/6140 and MT6516?
by Duane Lew 08 Dec '10

08 Dec '10

Dear Members, I incidentally see your development of linux drivers for MT6235/6140 chipset(the sciphone G2), and wanna share my 50 cents: The year 2009 released AP+BB monolithic chip MT6156 from mediatek is an ARM9 AP + ARM7 BB (the old MT6235 is ARM9 AP, MT6140 is ARM7 BB), considering the timeline of mediatek processors, it should be conjectured that MT6516 is a combination of these two chips. They already have Windows mobile 6.5 drivers mature for MT6516, and they have android drivers (not only driver but the whole system image), which might be an important referenece for developing MT6235 linux drivers. So I believe it's a good idea to ask MTK for its MT6516 linux driver and see what can be ported. Best for all, Duane

2 1

[PATCH] protocol: typofix for gsm_03_41.h
by Hermann Gausterer 07 Dec '10

07 Dec '10

On Tue, Dec 07, 2010 at 08:16:06PM +0200, Alex Badea wrote: > On 12/07/2010 06:36 PM, Hermann Gausterer wrote: > >Small typo in the second Serial Number Octet > > > >Signed-off-by: Hermann Gausterer<libosmocore-2010(a)mrq1.org> > > Good catch, thanks! > > You should send this patch to baseband-devel(a)lists.osmocom.org such > that one of the maintainers can apply it. > > Thanks, > Alex

1 0

Sciphone G2 (MT6235) status
by Marcin.Mielczarczyk＠tieto.com 04 Dec '10

04 Dec '10

Hi list, Last days I was focused on getting self-built code running from NAND memory and finally I got it working. You can find short demo which actually covers all the functionality which is currently working on Sciphone: http://www.youtube.com/watch?v=w_Iwsckm7Ko Here is the list of functionalities which are already working: * NAND memory driver with HW ECC control and MTK's ECC layout (ECC layout is important for loading SPL, creating dumps of firmware and restoring it). NAND driver also supports all the NAND memories found so far on Sciphone G2 (small page and large page). * SD/MMC card support * LCD driver (automatically detects LCD controller, so far identified two different LCD controllers mounted in G2: ILI9331 and ILI9325) * tool for creating bootable image from given binary file (should work on all MT62xx chips). It doesn't need to be SPL (from U-Boot), it can be self-built binary which will be run by IPL on the phone (not bigger than 64kB). * automatic detection of RAM memory in SPL (two configurations checked) - this will be added by Steve to osmocon loader as well * BBT and ENV can be saved in NAND (BBT in NAND is disabled by default, as deletes last two NAND blocks, and most people are running from RAM) I also updated wiki with informations about new features added: http://bb.osmocom.org/trac/wiki/SciphoneDreamG2 Open issues: * LCD controller is using the same data lines as NFI (NAND) controller. Currently it's not possible to use NAND when LCD is enabled. * vibrator in SPL code - vibrator will be turned on in SPL when it'll start reading NAND and turned off when it'll finish, thanks to that user will know that SPL code has started (short code which doesn't change SPL size). * boot process from NAND has been tested only on small page NAND device - I'll create dump of my second phone and try this process on large page NAND device as well I recommend to create full NAND dump before playing with new software. There is already driver for NAND running and you can erase/write NAND easily by mistake. I turned on define CONFIG_ENV_IS_IN_NAND, which will not erase/write NAND at start, but when you execute "saveenv" command it'll do so. Please, make NAND dump first. The problem with NAND dump is that I haven't found built-in functionality in U-Boot that sends dump of RAM memory (where NAND will be read) to PC/SD card. Dump also has to be created in chunks, as there is less RAM memory than NAND. I'm planning to create dump/restore commands which will save/restore dumps using SD card, but I didn't start it yet. Currently the easiest way is to create dump in FlashTool. I checked that restoring of phone using dump created in FlashTool works, so going back to previous firmware is possible. Unfortunatelly code for LCD driver is not yet in git as my coleague didn't manage to finish it today. Hopefully it'll be available during weekend or beginning next week. Now I'm going to switch to Linux kernel side and start writing drivers there... Other good new is that Andrew has reported last week that he successfully run our code on E1000 chinese phone which is also based on MT6235. There was no need to make any changes. Here is how E1000 phone looks like: http://triray.en.made-in-china.com/product/kbYJeomynHhs/China-N97-WiFi-Java… BR, Marcin

3 2

Free Software GSM Talk in Berlin on Dec. 9th
by Ali Gündüz 02 Dec '10

02 Dec '10

Hello all, I'm going to be giving a presentation about free software GSM implementations at the FSFE's Berlin meeting on December 9th, 2010. It will be very elementary and newcomer-friendly. I'm planning to go over OsmocomBB, OpenBTS and OpenBSC, and discuss their security and practical implications. The talk will start at 19:30 in Newthinking Store Tucholskystr. 48, 10117 Berlin. You can find more about it on http://aligunduz.org/blog/free_gsm_talk_next_week.html Considering I'm not an expert on GSM myself, it would be nice to have people more familiar with it in attendance. Ali Gündüz

1 0

Re: bb-osmocom: sim.c
by Dieter Spaar 30 Nov '10

30 Nov '10

Hello Ton, On Sun, 28 Nov 2010 23:09:59 +0100, "Ton Slewe" <ton.slewe(a)gmail.com> wrote: > > I have tracked down the error to sim.c. I tried to push it to the GIT > repository which does not seem to work (credentials?). Maybe somebody > can patch it in their version and then push it. Or otherwise please > point me in the direction to get it fixed in the repository. You have take the version from Sylvain's testing branch (Sylvain, please correct me if the extended SIM driver is no longer there) ? I ask because there is already a fixed version with several improvments which is supposed to work in this branch (at least for those SIM task required to access a real network). Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

3 2

bb-osmocom: sim.c
by Ton Slewe 29 Nov '10

29 Nov '10

I have trying the osmocom apps today (firmware). One of the apps, simtest, did not seem to work well. I have tracked down the error to sim.c. I tried to push it to the GIT repository which does not seem to work (credentials?). Maybe somebody can patch it in their version and then push it. Or otherwise please point me in the direction to get it fixed in the repository. Some of the variables on top of the file are not declared as volatile (they should be because they are modified in an Interrupt Service Routine). I changed all the variables on top of the file into volatile: static volatile int sim_rx_character_count = 0; /* How many bytes have been received by calypso_sim_receive() */ static volatile int sim_tx_character_count = 0; /* How many bytes have been transmitted by calypso_sim_transmit() */ static volatile int sim_tx_character_length = 0; /* How many bytes have to be transmitted by calypso_sim_transmit() */ static volatile uint8_t *rx_buffer = 0; /* RX-Buffer that is issued by calypso_sim_receive() */ static volatile uint8_t *tx_buffer = 0; /* TX-Buffer that is issued by calypso_sim_transmit() */ Now simtest is working as expected. Kind regards, Ton

2 1

[PATCH 0/3] layer23 SMSCB support
by Alex Badea 29 Nov '10

29 Nov '10

Hi, This patch series adds layer23 support for receiving SMSCB messages. Patches 1/3 and 2/3 add common layer2 code for reassembling blocks and sending them up to L3. Patch 3/3 is an addition to cell_log for logging cell-info-display-type SMSCB messages, if available. This series requires patches[1][2][3] to libosmocore protocol headers. Cheers, Alex [1] http://lists.osmocom.org/pipermail/baseband-devel/2010-November/000827.html [2] http://lists.osmocom.org/pipermail/baseband-devel/2010-November/000830.html [3] http://lists.osmocom.org/pipermail/baseband-devel/2010-November/000831.html Alex Badea (3): layer23: introduce SMSCB framework layer23 smscb: reassemble blocks and pass them up to L3 layer23 cell_log: log CBCH cell info src/host/layer23/include/osmocom/bb/common/lapdm.h | 2 + src/host/layer23/include/osmocom/bb/common/smscb.h | 28 +++ src/host/layer23/src/common/Makefile.am | 2 +- src/host/layer23/src/common/lapdm.c | 7 + src/host/layer23/src/common/smscb.c | 211 ++++++++++++++++++++ src/host/layer23/src/misc/cell_log.c | 107 ++++++++++- 6 files changed, 354 insertions(+), 3 deletions(-) create mode 100644 src/host/layer23/include/osmocom/bb/common/smscb.h create mode 100644 src/host/layer23/src/common/smscb.c

2 8

[PATCH libosmocore] protocol: introduce gsm_03_41.h
by Alex Badea 28 Nov '10

28 Nov '10

This currently contains definitions for the BTS->MS SMSCB message. Signed-off-by: Alex Badea <vamposdecampos(a)gmail.com> --- include/osmocore/protocol/gsm_03_41.h | 34 +++++++++++++++++++++++++++++++++ 1 files changed, 34 insertions(+), 0 deletions(-) create mode 100644 include/osmocore/protocol/gsm_03_41.h diff --git a/include/osmocore/protocol/gsm_03_41.h b/include/osmocore/protocol/gsm_03_41.h new file mode 100644 index 0000000..250d667 --- /dev/null +++ b/include/osmocore/protocol/gsm_03_41.h @@ -0,0 +1,34 @@ +#ifndef PROTO_GSM_03_41_H +#define PROTO_GSM_03_41_H + +#include <stdint.h> + +/* GSM TS 03.41 definitions */ + +/* Chapter 9.3.2 */ +struct gsm341_ms_message { + struct { + uint8_t code_hi:6; + uint8_t gs:2; + uint8_t update:2; + uint8_t code_lo:6; + } serial; + uint16_t msg_id; + struct { + uint8_t language:4; + uint8_t group:4; + } dcs; + struct { + uint8_t total:4; + uint8_t current:4; + } page; + uint8_t data[0]; +} __attribute__((packed)); + +/* Section 9.3.2.1 - Geographical Scope */ +#define GSM341_GS_CELL_WIDE_IMMED 0 +#define GSM341_GS_PLMN_WIDE 1 +#define GSM341_GS_LA_WIDE 2 +#define GSM341_GS_CELL_WIDE 3 + +#endif /* PROTO_GSM_03_41_H */ -- 1.7.0.4

2 1

[RFC][PATCH] layer1: clear dedicated mode on FULL reset
by Alex Badea 27 Nov '10

27 Nov '10

This is particularly useful if a layer23 app exists uncleanly; the next app would not be able to synchronize at all. Signed-off-by: Alex Badea <vamposdecampos(a)gmail.com> --- More to the point, I'd get stuck on the CBCH ;) I'm not sure if this would negatively impact other FULL reset use-cases, hence the RFC. Thanks, Alex src/target/firmware/layer1/l23_api.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/target/firmware/layer1/l23_api.c b/src/target/firmware/layer1/l23_api.c index 19838f1..82b86d7 100644 --- a/src/target/firmware/layer1/l23_api.c +++ b/src/target/firmware/layer1/l23_api.c @@ -381,6 +381,7 @@ static void l1ctl_rx_reset_req(struct msgb *msg) switch (reset_req->type) { case L1CTL_RES_T_FULL: printf("L1CTL_RESET_REQ: FULL!\n"); + l1s.dedicated.type = GSM_DCHAN_NONE; l1s_reset(); l1s_reset_hw(); audio_set_enabled(0); -- 1.7.0.4

2 1

[PATCH libosmocore] gsm_08_58: add struct and constants for RSL_IE_CB_CMD_TYPE
by Alex Badea 27 Nov '10

27 Nov '10

Signed-off-by: Alex Badea <vamposdecampos(a)gmail.com> --- include/osmocore/protocol/gsm_08_58.h | 21 +++++++++++++++++++++ 1 files changed, 21 insertions(+), 0 deletions(-) diff --git a/include/osmocore/protocol/gsm_08_58.h b/include/osmocore/protocol/gsm_08_58.h index 5fe332e..74a4083 100644 --- a/include/osmocore/protocol/gsm_08_58.h +++ b/include/osmocore/protocol/gsm_08_58.h @@ -441,6 +441,27 @@ struct rsl_ie_chan_ident { #define RSL_CHANNEED_TCH_F 0x02 #define RSL_CHANNEED_TCH_ForH 0x03 +/* Chapter 9.3.45 */ +struct rsl_ie_cb_cmd_type { + uint8_t last_block:2; + uint8_t spare:1; + uint8_t def_bcast:1; + uint8_t command:4; +} __attribute__ ((packed)); +/* ->command */ +#define RSL_CB_CMD_TYPE_NORMAL 0x00 +#define RSL_CB_CMD_TYPE_SCHEDULE 0x08 +#define RSL_CB_CMD_TYPE_DEFAULT 0x0e +#define RSL_CB_CMD_TYPE_NULL 0x0f +/* ->def_bcast */ +#define RSL_CB_CMD_DEFBCAST_NORMAL 0 +#define RSL_CB_CMD_DEFBCAST_NULL 1 +/* ->last_block */ +#define RSL_CB_CMD_LASTBLOCK_4 0 +#define RSL_CB_CMD_LASTBLOCK_1 1 +#define RSL_CB_CMD_LASTBLOCK_2 2 +#define RSL_CB_CMD_LASTBLOCK_3 3 + /* Chapter 3.3.2.3 Brocast control channel */ /* CCCH-CONF, NC is not combined */ #define RSL_BCCH_CCCH_CONF_1_NC 0x00 -- 1.7.0.4

1 0

Linux + u-boot port to MT6235 (E1000 phone)
by Andrew 27 Nov '10

27 Nov '10

Hello, everyone. I've just stumbled on the post in maillists following a news tip on one of the linux forums. I myself have two MTK-based devices - E1000 (MTK6335) and Nokla TV E71 (MTK6225) and have done some research some time ago. However, from what I heard there was no MMU there (even on 35), so I didn't study the possibility to start linux there. To make the story short, I'm now trying to run all the good stuff on my phone and cannot get past the loader. While now I cannot get past the osmocon part and upload ramloader: When I hook up my phone I get ---cut--- ~~~ Welcome to MTK Bootloader V005 (since 2005) ~~~ **===================================================** Main=0x3, Tmp=0x0, Fota=0x0, Bak=0x0 Number of image segments = 4 ..[0] Image size = 352Bytes, start addr. =0x428 ..[1] Image size = 4516152Bytes, start addr. =0x0 ..[2] Image size = 12494144Bytes, start addr. =0x452938 ..[3] Image size = 10340676Bytes, start addr. =-0xe000000 Start loading image... ....................................................................NFB image index: 1... Bye bye bootloader, jump to=0x0 ---cut--- And this comes out at 115200 baud. Trying osmocon: osmocon looks like it sends the beacon - but nothing happens - the phone just turns on. (I do hold the power button, but that just doesn't help) I altered the sources and changed initial baudrate to 115200, but nothing still. I have not yet figured out jtag pins out there, and I guess I will hook my old atmega-based jtag scanner only if there would be not other way to make serial method work. I think I can be of some help, since I have the hardware and some experience in kernel hacking. But I guess I cannot be of any use in the gsm part since I just don't know that stuff. That's it, And thanks for starting the porting process.

1 0

[PATCH libosmocore] gsm_04_12: fix 04.13 typos
by Alex Badea 27 Nov '10

27 Nov '10

There are two occurrences of "413" in the 04.12 header file. These are probably typos; correct them to "412". Signed-off-by: Alex Badea <vamposdecampos(a)gmail.com> --- include/osmocore/protocol/gsm_04_12.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/include/osmocore/protocol/gsm_04_12.h b/include/osmocore/protocol/gsm_04_12.h index bd9e088..9b1538a 100644 --- a/include/osmocore/protocol/gsm_04_12.h +++ b/include/osmocore/protocol/gsm_04_12.h @@ -10,7 +10,7 @@ #define GSM412_SEQ_TRD_BLOCK 0x2 #define GSM412_SEQ_FTH_BLOCK 0x3 #define GSM412_SEQ_FST_SCHED_BLOCK 0x8 -#define GSM413_SEQ_NULL_MSG 0xf +#define GSM412_SEQ_NULL_MSG 0xf struct gsm412_block_type { uint8_t seq_nr : 4, @@ -19,7 +19,7 @@ struct gsm412_block_type { spare : 1; } __attribute__((packed)); -struct gsm413_sched_msg { +struct gsm412_sched_msg { uint8_t beg_slot_nr : 6, type : 2; uint8_t end_slot_nr : 6, -- 1.7.0.4

1 0

Fresh people's build problem
by chenyu xu 26 Nov '10

26 Nov '10

Hello guys: In order to participate in OSMOCOM-BB project, I have buy the old moto C118 and made the T191 cable by myself. But when I run "make" in ****/src/osmocom-bb/src directory, the error info is below: alexander@Foundation:~/src/osmocom-bb/src$ make cd shared/libosmocore/build-target && ../configure \ --host=arm-elf-linux --disable-vty --enable-panic-infloop \ --disable-shared --disable-talloc --disable-tests \ CC="arm-elf-gcc" CFLAGS="-Os -ffunction-sections -I../../../../target/firmware/include" configure: WARNING: If you wanted to set the --build type, don't use --host. If a cross compiler is detected then cross compile mode will be used. checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for arm-elf-linux-strip... no checking for strip... strip checking for a thread-safe mkdir -p... /bin/mkdir -p checking for gawk... gawk checking whether make sets $(MAKE)... yes checking whether make sets $(MAKE)... (cached) yes checking for arm-elf-linux-gcc... arm-elf-gcc checking whether the C compiler works... no configure: error: in `/home/alexander/src/osmocom-bb/src/shared/libosmocore/build-target': configure: error: C compiler cannot create executables See `config.log' for more details. make: *** [shared/libosmocore/build-target/Makefile] Error 77 After my investigating on this issue, I think I must build my own arm-elf-linux-gcc, am I right? I want to know how the experienced person handle this scenario? Please answer my questions! Thanks! alexander Xu

2 1

[PATCH 0/2] Small CBCH fixes, and playground
by Alex Badea 22 Nov '10

22 Nov '10

Hi all, I've been looking at receiving CBCH traffic (where I live, 226-01 broadcasts a geographical area name with each cell). Patches 1/1 and 1/2 are small fixes for the layer23 system information parser, for storing the required CBCH channel description and mobile allocation info. I'll also reply with WIP patches for a small CBCH sniffing l23 app, and for decoding CBCH in Wireshark. The latter is a quick hack job, as it only decodes the first block, and it's bodged onto the LAPDm dissector. Also a question: what would be the best place to integrate CBCH handling into osmocom-bb? I'm guessing host/layer23/src/common/lapdm.c would handle block reassembly, then send CBS frames up the stack. Would any existing messages fit the bill (RSL_MT_UNIT_DATA_IND?) or should we add a new one? Cheers, Alex Alex Badea (2): layer23 sysinfo: store chan_nr when decoding CBCH Channel Description layer23 sysinfo: fix parsing of CBCH Mobile Allocation src/host/layer23/src/common/sysinfo.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-)

5 8

simtrac hw
by ml＠mail.tsaitgaist.info 22 Nov '10

22 Nov '10

Hi, Because I'm also deceived by the rebelSIM, I was programming a sim sniffer using an atmega, by detecting the clock freq. manualy. Until Harald announced his SIMtrac. His solution is way easier, and more reliable. This is why I've now done a hw design for it. I don't know if it's the right mailing list, but it seemed to be the best. I'm not a electronic expert, I just follow datasheets and examples. I used the openPCD schema to do this one. There is : - the AT91SAM7SXXX - 2 SC sockets (ID-1 and ID-000) for the SIM in credit card and usual size, as on the rebelSIM - 1 SC port (IN) to connect the SIM for the phone (I would use the ones from rebelSIM) - 1 SC port (OUT) to be able to use the signal using external HW - the sam-ba port to be able to flash it here the schema : https://file.tsaitgaist.info/www/?a=d&i=CWn6xIaCVe please tell me if there is something wrong, or needs some improvement. I will design the PCB shortly. thanks, tsaitgaist

8 23

AW: Announcing Osmocom SIMtrace
by Andreas.Eversberg 19 Nov '10

19 Nov '10

> As none of my projects is complete without wireshark integration, > SIMtrace abuses the GSMTAP format to feed messages into wireshark. A > simplistic wireshark dissector for the GSM TS 11.11 APDUs is included, > and it is expected to become much more complete in the fuutre (USIM support, > parsing of file contents, etc.) hi laforge, cool project! i think it can be usefull to debugging the sim client/reader of osmocom-bb. as DATA_IND/DATA_REQ is already tapped at layer23/src/common/l1ctl.c, it would be cool if SIM_IND/SIM_REQ will be tapped for wireshark too. regards, andreas

4 4

Announcing Osmocom SIMtrace
by Harald Welte 19 Nov '10

19 Nov '10

Hi all! After what has become much more time than originally anticipated, I'm happy to announce the first developer version of Osmocom SIMtrace: http://bb.osmocom.org/trac/wiki/SIMtrace (project page) git://git.osmocom.org/simtrace.git (host software + wireshark) git://git.gnumonks.org/openpcd.git (firmware) You can use it to passively sniff the smart card interface between SIM and phone. It consists of some firmware for an AT91SAM7S USB-attached microcontroller, together with a host PC program that receives the APDUs from USB. As none of my projects is complete without wireshark integration, SIMtrace abuses the GSMTAP format to feed messages into wireshark. A simplistic wireshark dissector for the GSM TS 11.11 APDUs is included, and it is expected to become much more complete in the fuutre (USIM support, parsing of file contents, etc.) What can you use it for? * Determine what is really going on between phone and sim * Debugging of SIM Application Toolkit (SAT) programs Why is it better than existing hardware like Season or the RebelSIM Scanner? * We do proper auto-bauding and support PPS, i.e. you can automatically see all communication on any SIM card interface * We support all clock rates / dividers as per the ISO 7816-3 spec Future plans: * In addition to passive tracing, implement SIM-card side interface in the hardware and have SIM/USIM simulator as host PC software. * Build custom board for it, with 1.8V SIM support Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

3 2

Re: Linux + u-boot port to MT6235
by Marcin Mielczarczyk 18 Nov '10

18 Nov '10

Hi, Finally I have running Linux on Sciphone G2. Code for U-Boot and Linux kernel can be found here: http://git.osmocom.org/gitweb?p=uboot-mt623x.git;a=summary http://git.osmocom.org/gitweb?p=linux-mt623x.git;a=summary To run U-Boot in RAM you can use osmocon loader for MTK. When U-Boot will start than you can load Linux kernel using serial port (U-Boot commands: loadb or loady). Default load address is set to 0x800000, so Linux kernel will be loaded there. To start executing Linux kernel type in following command: bootm 0x800000 After this command Linux kernel will be relocated, uncompressed and executed. After short time you should have working console in Linux. For testing purposes I prepared binaries which you can load and check that Linux works on your phone: http://downloads.qi-hardware.com/people/marcin/g2_uboot.bin http://downloads.qi-hardware.com/people/marcin/g2_uImage.bin uImage binary has already ramfs image built in, so you don't need any additional filesystem. These binaries were also tested by Steve Markgraf and keytwo, so it should work on most G2s. Today I was also able to load files from MMC card in U-Boot, so hopefully this functionality will be available very soon. Next step will be running UBoot and Linux from NAND, to make development more convenient. Recently we discovered that Sciphone G2 phones are sold with different memory configurations. So far we identified 3 types of memories: HY27XS08121M - 512Mb (64MB) NAND + 32MB RAM (http://hynix.com/datasheet/pdf/flash/HY27US(08_16)12(1_2)B%20Series(Rev0.5)…) HY27XA081G1M - 1Gb (128MB) NAND + 32MB RAM (http://hynix.com/datasheet/eng/nand/details/small_11_HY27US081G1M.jsp?menu1…) TC58NVG0S3AFT - 1Gb (128MB) NAND + 64MB RAM (http://www.datasheetcatalog.com/datasheets_pdf/T/C/5/8/TC58NVG0S3AFT.shtml) This has to be detected in osmocon loader and U-Boot. I write about it so, you'll be aware of it. When U-Boot starts it detects your memory configuration and shows you how much NAND and RAM you have. If it comes to status of work in progress, following drivers are under development: - NAND controller (U-Boot/Linux) - SD/MMC controller (U-Boot/Linux) - GPIO (Linux) - LCD (U-Boot/Linux) I saw that MT6140 (RF) is connected over I2C bus, so probably this driver will be next on the list. BR, Marcin

1 0

Its posible that OsmocomBB work as a USRP?
by Hernani 18 Nov '10

18 Nov '10

Ok, first of all congratulation for this project... Ok, I understood that it wouldn´t work as USRP. But would it allow you to tune (or listen - sory don´t know the tecnical term in english) an especific ARFCN and time slot ? Hernani > Hi Harald > > Thanks for clarifying this confusion. I bought a motorola C123 on ebay > with RS232 data cable. When I arrive I'll try this fantastic software. > Thank you very much for your work, this world needs more people like > you > > On Sat, 6 Nov 2010 08:32:31 +0100, Harald Welte <laforge at gnumonks.org <https://lists.osmocom.org/mailman/listinfo/baseband-devel>> > wrote: >>* Hi Oscar, *>>* *>*> On Sat, Nov 06, 2010 at 03:02:37AM +0100, Oscar Soriano Riera wrote: *>>* *>>*> Its posible use *>>*> OsmocomBB on C123 for do task as a USRP ? or similar scanner ? *>>* *>*> No, I think you have some conceptual misunderstanding about radio *>*> technology in general. *>>* *>*> In your subject you ask if OsmocomBB can work as USRP: *>*> This is wrong, as OsmocomBB is a protocol stack and radio driver, and *>*> the USRP *>*> is hardware. How can some software work as hardware? *>>* *>*> In the body of your mail you ask if the C123 can act as USRP: *>*> No. The USRP is a wide-band software defined radio, and the *>*> Calypso/Iota/Rita *>*> design implements a more traditional narrow-band zero-if transceiver *>*> with a DSP *>*> in the baseband. *>>* *>*> Nevertheless, you can use both hardware design to receive and *>*> transmit GSM *>*> signals. But this is very far from what you ask by "one device *>*> working like *>*> the other" *

2 1

[PATCH 0/4] Fixes for gta0x targets
by Alex Badea 18 Nov '10

18 Nov '10

Hi all, I've been trying to join the party with my OpenMoko GTA02, and I found that a few tweaks were required. Patch 1/4 was required to get the romloader to start, otherwise osmocon would only receive an occasional '\x00' character instead of the ident_cmd. It works perfectly with the beacon interval reduced to 13 mS, but I've made it configurable just in case other targets don't like it. Patches 2/4 and 3/4 are bugfixes for the calypso uart code. The LCR register ended up being clobbered, and this rendered the uart on my board silent. Finally, I'm using the GTA02 AP as the "host", communicating via the internal ttySAC0 UART. Patch 4/4 allowed me to cross-compile osmocon & friends on my x86 box with the AP ARM as the target. Now I can run, ./osmocon -m romload -p /dev/ttySAC0 -i 13 -d tr firmware/layer1.highram.bin while toggling power via, echo 0 >/sys/bus/platform/devices/neo1973-pm-gsm.0/power_on echo 1 >/sys/bus/platform/devices/neo1973-pm-gsm.0/power_on and get: OSMOCOM Layer 1 (revision osmocon_v0.0.0-696-ge801cee-modified) ====================================================================== Device ID code: 0xb496 Device Version code: 0x0000 ARM ID code: 0xfff3 cDSP ID code: 0x0128 Die ID code: e4942219e4949b52 ====================================================================== REG_DPLL=0x2413 CNTL_ARM_CLK=0xf0a1 CNTL_CLK=0xff91 CNTL_RST=0xfff3 CNTL_ARM_DIV=0xfff9 ====================================================================== Cheers, Alex Alex Badea (4): osmocon: make beacon interval configurable via cmdline target uart: fix preservation of LCR target uart: remove REG_OFFS() macro side-effect toplevel Makefile: accept arguments for host ./configure calls src/Makefile | 8 ++++---- src/host/osmocon/osmocon.c | 26 ++++++++++++++++---------- src/target/firmware/calypso/uart.c | 10 +++++----- 3 files changed, 25 insertions(+), 19 deletions(-)

2 5

Sciphone Dream G2 WLan MT5921
by Heiko Stübner 12 Nov '10

12 Nov '10

Hi, Harald Welte wrote: > bluetooth or FM radio. The GSM RF transceiver is probably possible to > reverse engineer from the test mode + 3wire protocol sniffing, but wifi e.g. is > defnitely too complex to do a 100% reverse engineered driver for... while looking through the component listing on Wolgang's wiki page I recognized the MediaTek MT5921 WLan-chipset. This should be the same (or at least similar) chip built into the german Thalia/Bol/Buch.de Oyo ebook-reader (also released in France). The module is called mt5921sta_spi.ko and claims to be released under the GPL but until now no source release happened for any GPL component. The module is also contained in the firmware of the Booq Avant released in Spain (http://www.booqreaders.com/en/product_Avant) and possibly many more ebook-readers as these models seem to share their basic design. Heiko

2 2

GSMTAP
by Marten Christophe 10 Nov '10

10 Nov '10

Hello All, I have a question regarding GSMTAP , If it is used for sending messages to wireshark only or it has some other significant, like communication between L2 and L3 or communication with layer1, as the uint8_t and uint16_t were widely used in source code Kind regards,

2 1

application ./mobil
by Dev Purohit 09 Nov '10

09 Nov '10

Hello List, Ii'm facing problem when i'l trying to run ./mobil application i'm getting below error. if i need some USB or serial SIM reader, or should insert the sim in my MS itself thanks in advance for help. ========= Failed to connect to '/tmp/osmocom_sap'. <<<<<<<<< Failed during sap_open(), no SIM reader <000e> sim.c:1206 init SIM client <0005> gsm48_cc.c:61 init Call Control <0001> gsm48_rr.c:4944 init Radio Ressource process <0004> gsm48_mm.c:1220 init Mobility Management process <0004> gsm48_mm.c:971 Selecting PLMN SEARCH state, because no SIM. <0002> gsm322.c:3471 init PLMN process <0003> gsm322.c:3472 init Cell Selection process <0003> gsm322.c:3526 No stored BA list Failed to parse the config file: '/etc/osmocom/osmocom.cfg' Please check or create config file using: 'touch /etc/osmocom/osmocom.cfg' <<<<<<<< What Is the solution for this how i can do this ========== Regards, Dev

2 4

Its posible that OsmocomBB work as a USRP?
by Oscar Soriano Riera 06 Nov '10

06 Nov '10

Hi everyone from Spain I have one question: Its posible use OsmocomBB on C123 for do task as a USRP ? or similar scanner ? Thanks for your BIG work ¡¡¡¡ congratulations

2 2

problem starting out...please help
by Scott Weisman 06 Nov '10

06 Nov '10

Hi All, I now have a V171 phone and cable so I thought I might get started with this. I checked out the code and started make. Osmocon built with no problem, but I got this error next: cd shared/libosmocore/build-target && ../configure \ --host=arm-elf-linux --disable-vty --enable-panic-infloop \ --disable-shared --disable-talloc --disable-tests \ CC="arm-elf-gcc" CFLAGS="-Os -ffunction-sections -I../../../../target/firmware/include" configure: WARNING: if you wanted to set the --build type, don't use --host. If a cross compiler is detected then cross compile mode will be used checking for a BSD-compatible install... /bin/install -c checking whether build environment is sane... yes checking for arm-elf-linux-strip... no checking for strip... strip checking for a thread-safe mkdir -p... /bin/mkdir -p checking for gawk... gawk checking whether make sets $(MAKE)... yes checking whether make sets $(MAKE)... (cached) yes checking for arm-elf-linux-gcc... arm-elf-gcc checking whether the C compiler works... no configure: error: in `/mnt/site/osmocom-bb/src/shared/libosmocore/build-target': configure: error: C compiler cannot create executables See `config.log' for more details make: *** [shared/libosmocore/build-target/Makefile] Error 77 Checking config.log I can see it chokes here: /usr/bin/arm-elf-ld: this linker was not configured to use sysroots collect2: ld returned 1 exit status I am running Arch Linux and have the packages cross-arm-elf-binutils and cross-arm-elf-gcc-base installed. Does anyone have any suggestions to fix this? Thanks!

3 3

Re: osmocom on windows
by eisencah eisenach 06 Nov '10

06 Nov '10

:D Yup the timers too. That's why I would like to keep that piece of code as it is and move only the serial port handling elsewhere (a different thread I) --- On Thu, 10/21/10, Holger Hans Peter Freyther <holger(a)freyther.de> wrote: From: Holger Hans Peter Freyther <holger(a)freyther.de> Subject: Re: osmocom on windows To: baseband-devel(a)lists.osmocom.org Date: Thursday, October 21, 2010, 8:09 PM On 10/21/2010 07:00 PM, eisencah eisenach wrote: > Here's another one. Regarding the select mechanism (the one in select.c). > Other then the serial port and sockets is anything else registered there? > Cause I would like to keep sockets for communication after all (but the select > function will not work on windows for serial ports handles). So I would use a > different mechanism only for serial port scheduling. > Cheers, > Mihai. well.. we handle the timers with it too.

2 2

850Mhz support
by Hugo Fortier 30 Oct '10

30 Oct '10

Hi everyone, I am fairly new to OsmocomBB. Been in North America I acquired a C118(850Mhz/1900Mhz version of the C123) and a C156(850Mhz / 1900mhz version of the C155) but from what I understand at this point is that only 900Mhz and 1800Mhz are supported. I am trying to figure out what modification I need to do in order to implement North American support for OsmocomBB, do I need to modify the firmware or do I only need to modify the host application? Any pointer would be greatly appreciated. I tried to modify the host application but I didn't had any success so far... Also I am trying to acquire a C123 and I find it quite difficult to find in North America, anyone know where I could acquire it from? I have look online but I could only find it on https://www.samstores.com/ and it seem a bit pricey and I have no idea if this store is trust worthy. I am also interested to acquire a BTS for OpenBSC(I currently have OpenBTS running on my USRP) so if you have any pointer on how I could acquire one, let me know. Thanks, Hugo

2 2

TCH/F
by Marten Christophe 29 Oct '10

29 Oct '10

Hello All, Can Any one expert in programming add new command line in full stack GSM application like , ./mobile. to tune or enter for particular. ARFCN , Time slot, hopping sequence. my understanding here is , once i will logged to any cell , it will automatically find FCCH, and SCH and my MS will synchronize, to a cell and read bcch. only thing left over to finish my work is to tune to right ARFN and TS with appropriate HS i want signaling to be involved without it it wont receive TCH. see, to be frank my not expert in C language and even lots of try i couldn't make API for it . so any one can help me . Kind Regards,

2 3

L1 TCH code status
by Sylvain Munaut 29 Oct '10

29 Oct '10

Hi, Just a quick update for those that don't follow the git or IRC: A few days ago, I merged most of was in my sylvain/testing branch into master. It's now in a state where you can place a call on a BS11 or nanobts. It took a while for me to go from the raw prototype from Dieter to a state I was happy with. (especially because I wanted to understand the purpose of every line I was rewriting since my main goal is to learn :) There were also some extensions (mode switching / bugs fixes / partial HR support / ...). There are still somethings that are only in my testing/ because they're hacks (or even missing): - SIM support: The code is clearly [WIP]. I may get to cleaning it myself at some point, but that's not a priority for me ... - TS change fixup: There is a bug when going from a high TS to a low TS that's tricky to fix. I'm still thinking about the best way to handle this. There is a hack to work around it in my testing branch. This case can't happen on nanoBTS or BS-11 but it may happen on a real network. - TOA loop: I want to check if I can re-use the common code from our AFC/AGC loop rather than adding some other regulation stuff. - Enabling HR: Well ... it doesn't work yet, so no point in putting it in master :) All theses will be added when I have the time to do it. Cheers, Sylvain Munaut

2 1

osmocom and map
by Andreas.Eversberg 27 Oct '10

27 Oct '10

hi, recently i committed a conversion tool to convert logged cell information ("SYSTEM INFORMATION" messages) from "cell_log" application into a geographical KML map layer. the quick and dirty name "gsmmap" is about confusing. MAP is actually a short term for "mobile application part", which has absolutely nothing todo with a geographical map. does anyone have a name for it? (my best idea so far: "bcch2kml") regards, andreas

1 0

libosmocom VERSION doesn't get set properly
by jakob borg 26 Oct '10

26 Oct '10

hi, when building libosmocom in osmocom-bb/src/shared (using the git-subtree script to keep everything up to date), the Makefile in src/shared/libosmocore/build-host doesn't have the version information set properly, instead i get: PACKAGE_VERSION = UNKNOWN VERSION = UNKNOWN this is causing problems compiling stuff that require libosmocom at a specific version, like some of the airprobe tools. i'm running mac os x 10.6.4, using autoconf 2.68, automake 1.11.1, binutils 2.20.1, gcc 4.5.1. when building the master git branch of libosmocom outside of osmocom-bb (bootstrapping using the bootstrap script from airprobe/gsm-receiver), the version gets set properly. thanks jakob -- jakob borg jakborg(a)fastmail.fm -- http://www.fastmail.fm - One of many happy users: http://www.fastmail.fm/docs/quotes.html

3 3

command line options for layer23 apps
by Andreas.Eversberg 26 Oct '10

26 Oct '10

hi, i like to change the handling of command line options in layer23 applications, because different layer23 applications require different individual options, and common options also. (e.g. the "mobile" application does not required "--arfcn" option, but "--vty-port". others do not require "--vty-port", but might require a "--gps-device". all apps together require "--socket" and "--gsmtap-ip".) therefore i like to leave all common options in common/main.c. additional options i like to put in the individual app_*.c files. each options i like to check at the individual app file. if it doesn't exist there, the main.c checks if the option is a common option: ... c = l23_app_handle_options(); if (c == -1) c = getopt_long(argc, argv, "hs:S:a:i:v:d:", long_options, &option_index); if (c == -1) break; ... an individual help for each application: l23_app_print_help(); any suggestions or complains? best regards, andreas

3 4

AW: LAPDm bug: How to exit LAPDm_STATE_TIMER_RECOV state
by Andreas.Eversberg 25 Oct '10

25 Oct '10

>> you are right. in case of an RR "response" (or an I frame) with the F >> bit set to "1", there is no clearing of the "timer recovery state". in >> other cases (RNR, REJ) it is handled. > Where did you see that an I-Frame with the F bit set should clear the > condition ? you are right. i searched through the document. the I-Frame is handled during "timer recovery state", but this state is not cleared then. anyway: i am missing the description for "Receiving RR frames". A general description for RR, RNR, REJ is given in 5.5.3, but it does not describe what todo on a valid RR response with F bit set to "1". this is why i missed it.

1 0

AW: LAPDm bug: How to exit LAPDm_STATE_TIMER_RECOV state
by Andreas.Eversberg 25 Oct '10

25 Oct '10

> The timer recovery condition is only cleared if the data link layer > entity receives a valid supervisory frame response > with the F bit set to "1". If the N(R) of this received supervisory > frame is within the range from its current state variable > V(A) to its current send state variable V(S) inclusive, it shall set > its send state variable V(S) to the value of the received > N(R). Timer T200 shall be reset if the received supervisory frame > response is an RR or REJ response with F bit set to > "1". The data link layer entity shall then resume with I frame > transmission or retransmission, as appropriate. > Timer T200 shall be set if the received supervisory response is an RNR > response, and the data link layer shall proceed > with the enquiry process in accordance with subclause 5.5.5. hi sylvain, you are right. in case of an RR "response" (or an I frame) with the F bit set to "1", there is no clearing of the "timer recovery state". in other cases (RNR, REJ) it is handled. i would like to test this with a prepared frame drop tonight. if this works, i will commit it. regards, andreas

2 1

Switching to TCH
by Sylvain Munaut 24 Oct '10

24 Oct '10

> but when i doing so , it is chasing up to SDCCH , and after this it is > started to dropping frames .. and not getting tune to any TCH/F Have you even _read_ the code of layer23 ... it _will_ not do what you want directly. It's a starting point, but you're gonna have to learn to write things by yourself. > though there is no encryption being used. A5/0, i have seen , no ciphering. > in traces. Well it's a perfectly normal behavior that after some time you only see lost frames. I suggest you re-read the code and the specs until you understand _why_ it's normal. > kindly confirm with layer1.compalram.bin , if i will be able to listen > TCH/F assign to some other MS , Not out of the box, as I said, you will need to do some programming. Given the question you ask, you obviously don't understand GSM or the code enough yet to do it. Cheers, Sylvain PS: Please don't hijack a thread that has nothing to do with what you're writing about by just clicking the reply button and not even bothering to change the subject ... seems like you need to read the emails RFC as well ...

2 1

LAPDm bug: How to exit LAPDm_STATE_TIMER_RECOV state
by Sylvain Munaut 24 Oct '10

24 Oct '10

Hi, In GSM 05.06 Section 5.5.7 at the end it says : --- The timer recovery condition is only cleared if the data link layer entity receives a valid supervisory frame response with the F bit set to "1". If the N(R) of this received supervisory frame is within the range from its current state variable V(A) to its current send state variable V(S) inclusive, it shall set its send state variable V(S) to the value of the received N(R). Timer T200 shall be reset if the received supervisory frame response is an RR or REJ response with F bit set to "1". The data link layer entity shall then resume with I frame transmission or retransmission, as appropriate. Timer T200 shall be set if the received supervisory response is an RNR response, and the data link layer shall proceed with the enquiry process in accordance with subclause 5.5.5. --- And I don't see where this is supposed to be handled in the code. I tried this quick fix: diff --git a/src/host/layer23/src/common/lapdm.c b/src/host/layer23/src/common/lapdm.c index b1c0d40..8bd42a7 100644 --- a/src/host/layer23/src/common/lapdm.c +++ b/src/host/layer23/src/common/lapdm.c @@ -1081,8 +1081,12 @@ static int lapdm_rx_s(struct msgb *msg, struct lapdm_msg_ctx *mctx) /* 5.4.2.2: Inidcate error on supervisory reponse F=1 */ if (LAPDm_ADDR_CR(mctx->addr) == CR_BS2MS_RESP && LAPDm_CTRL_PF_BIT(mctx->ctrl)) { - LOGP(DLAPDM, LOGL_NOTICE, "S frame response with F=1 error\n"); - rsl_rll_error(RLL_CAUSE_UNSOL_SPRV_RESP, mctx); + if (dl->state != LAPDm_STATE_TIMER_RECOV) { + LOGP(DLAPDM, LOGL_NOTICE, "S frame response with F=1 error\n"); + rsl_rll_error(RLL_CAUSE_UNSOL_SPRV_RESP, mctx); + } else { + dl->state = LAPDm_STATE_MF_EST; + } } switch (dl->state) { which seems to fix the issue I encountered but my understanding of how lapdm.c works is very limited and I doubt that it's all that's needed to properly handle this case. Cheers, Sylvain Munaut

2 1

cross-compiling osmocom on mac os x
by jakob borg 24 Oct '10

24 Oct '10

hi, i'm struggling to get a working cross-compile toolchain for osmocom-bb on os x, i've been playing with a script called summon-arm-toolchain (http://github.com/esden/summon-arm-toolchain) for a while now without success, my toolchain seems to build fine, but when trying to compile for my target, i get: checking for arm-elf-linux-gcc... arm-elf-gcc checking whether the C compiler works... no config.log says: configure:3106: checking whether the C compiler works configure:3128: arm-elf-gcc -Os -ffunction-sections -I../../../../target/firmware/include conftest.c >&5 /usr/local/arm-elf/lib/gcc/arm-elf/4.5.1/../../../../arm-elf/lib/libc.a(lib_a-exit.o): In function `exit': /usr/local/src/summon-arm-toolchain/build/arm-elf/newlib/libc/stdlib/../../../../../newlib-1.18.0/newlib/libc/stdlib/exit.c:65: undefined reference to `_exit' collect2: ld returned 1 exit status i'm running mac os x 10.6.4, using autoconf 2.68, automake 1.11.1, binutils 2.20.1, gcc 4.5.1. any idea what i might be doing wrong? has anybody successfully cross-compiled the arm part of osmocom-bb on osx? thanks jakob -- jakob borg jakborg(a)fastmail.fm -- http://www.fastmail.fm - Faster than the air-speed velocity of an unladen european swallow

2 1

DSP TCH task : time to get/put FAACH
by Sylvain Munaut 22 Oct '10

22 Oct '10

Hi Dieter, Hi everyone, (cc'd the list, for the record and if other people are interested in the inner workings :) I'm pretty satisfied with the current state of the TCH primitive (as it is in my testing branch now). But there is still two things I'm stumbling upon: * When to put / read data for FACCH. Getting downlink FACCH blocks looks quite logic: just check the B_BLUD bit on the TCH response of the last burst of the block. So with rx_time being the time at which the burst was received (i.e., one frame before the response is executed) - For TCH/F: (rx_time.fn % 13) % 4 == 3 - For TCH/H: (rx_time.t2 - subchannel) in {6,15,23} But for when to load the next FACCH block, it seems weird. From what I understand of what you did and what the TSM30 does, you need to load the data on the TCH cmd corresponding to the bursts _before_ the first burst. So with tx_time being the time at which the burst will transmitted (i.e., one frame after the command is executed = l1s.next_time) - For TCH/F (tx_time.fn % 13) % 4 == 3 - For TCH/H (tx_time.t2 - subchannel) in {6,15,23} (2 TDMA before the first burst because on TCH/H, we're executed one once every two frame) Why the need to load it one burst in advance ? (while on the RX side, which seems more complex to do, data is available directly after the last burst is received). * TCH/H support: AFAIK, I did everything that should be required for it to work: - set fn_report properly for TCH/H - set chan_type to TCH_H in dsp_load_tch_parameters - Use a different condition for when to put/read FACCH bursts (according to 05.02) - Schedule the TCH task appropriately ... But still can't get it to work (testing with the racal). SACCH seems to work fine (I see the SI messages), but I don't see a single FACCH message (and eventually the racal says T3107 expired, assignement to TCH failed). Do you see anything else that would be required ? Cheers, Sylvain

1 1

TCH.. OsmocomBB
by Marten Christophe 21 Oct '10

21 Oct '10

Hello Deiter ,Sylvian As u advised I completed reading GSM standard, and dig down source code AFAIK , i have recognized the files and parameters where i need to change values to tune for particular TCH, and also understood that how important signaling is to be involved . I just want to know one thing that is , during the channel request MS send burst on RACH with RA ref number, where this RAF or RA reference number stored on MS side , because when Immediate assignment send from the network it must be match before tuning to particular SDCCH, i want to apply a trick here i will copy the RA reference from the immediate assignment message and will replace with original one stored in MS, hence MS will think this channel is for me and tune to the SDCCH accordingly, further it will keep on listening all process like authentication, location updating , again the TCH channel information is send SDCCH without encryption as only authentication procedure needs Kc Ki and SRES, SDCCH is not encrypted and all MS hosting on that SDCCH can decode TCH parameter like FN , TS, ARFCN hopping sequence. but again i need to clarify how L1ctl.c and L23_api.c fetch the decoded data, from immediate assinment masseg. as it is written printf..........%u . From where this will scan or fetch. if i will be able to know, where MS kept stored the input values advised in signaling messages by BTS on PCH, or AGCH. so i can manipulate them and land on CCCH, and then SDCCH then TCH. kindly tell me if it is feasible , or there is more i need to think. Kind Regards,

2 1

Re: osmocom on windows
by Dieter Spaar 21 Oct '10

21 Oct '10

Hello Peter, On Thu, 7 Oct 2010 11:54:28 +0200, "Peter Stuge" <peter(a)stuge.se> wrote: > > Does e.g. the CodeSourcery toolchain really need Cygwin? That would > suck. I don't know CodeSourcery, I use GNU ARM directly from www.gnuarm.com. According to the CodeSourcery FAQ, they do not require Cygwin. Are there any benefit using CodeSourcery ? I had issues in the past with the firmware using a different GNU ARM version, so I switched back to 4.0.2 which seems to be the same other use on Linux and so far it works OK. You don't seem to like Cygwin, my experience with it is not that bad, OpenBSC (not with GPRS yet due to the need for the TUN device), OsmocomBB, GNUradio and Airprobe run with minor adjustments (just to name GSM related stuff I use under Cygwin). Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

4 4

AW: wrong decoding of bit vectors
by Andreas.Eversberg 21 Oct '10

21 Oct '10

> if (bv->data[bytenum] & (1 << bitnum) == bitval) > return H; i must correct: if ((bv->data[bytenum] & (1 << bitnum)) == bitval) return H;

2 1

wrong decoding of bit vectors
by Andreas.Eversberg 21 Oct '10

21 Oct '10

/* check if the bit is L or H for a given position inside a bitvec */ enum bit_value bitvec_get_bit_pos_high(const struct bitvec *bv, unsigned int bitnr) { unsigned int bytenum = bytenum_from_bitnum(bitnr); unsigned int bitnum = 7 - (bitnr % 8); uint8_t bitval; if (bytenum >= bv->data_len) return -EINVAL; bitval = bitval2mask(H, bitnum); if (bv->data[bytenum] & bitval) return H; return L; } hi, this is part of bitvec.c of libosmocore. it returns if a given bit in the vector is "high" or "low". the bitval that represents "high" depends on the bit position. bitval2mask returns that. so we must check if the bit in the vector equals the returned bitval. i suggest to fix it that way: if (bv->data[bytenum] & (1 << bitnum) == bitval) return H; any complains? without it we cannot check the system information's rest octets. they are essential for any multiband mobile. regards, andreas

1 0

Inquiry on osmocom
by Akilesh Sethu 20 Oct '10

20 Oct '10

Hey, I am working on Android Mobile Operating System. Is it possible for me to port osmocom GSM stack to any of the Android compatible mobiles. Regards, Akilesh Sethu

2 1

Re: osmocom on windows
by Dieter Spaar 16 Oct '10

16 Oct '10

Hello Peter, On Thu, 7 Oct 2010 13:24:50 +0200, "Peter Stuge" <peter(a)stuge.se> wrote: > > In practise it can be negligeable, just another DLL, but it isn't > Windowsy, and for someone who wants Windowsy, Cygwin isn't a really > good answer. (But it can save plenty of time instead!) Exactly, saving time is the point. A software developer, regardless of coming from Windows or Linux should have no problem to understand OpenBSC/OsmocomBB/Airprobe from the OS or C language perspective (I don't talk about GSM specific things, this is something else). I want to use those project and develop for them and not waste my time with things like adopting C language specific issues. > OpenVPN has one, it's signed too. I know, but you have to use the TUN device differently than on Linux, so some adjustments are necessary (besides not knowing if Windows will do proper NAT with the IP traffic from the phone). So I run OpenBSC in a VM if I need GPRS support instead spending time on issues I don't care if I want to use this software or develop for it. > Cool, that's proof that Cygwin is pretty good stuff. It doesn't say > almost anything about how these projects run on Windows though. They work for me, I want to use them and I want to develop for them and so far I could do all I want. Of course this is something else if you for example want to run OpenBSC in a production environment with lots of BTSs. A native Windows port is surely possible, but for me I don't see any benefits besides wasting time. Of course if someone want to sponsor a native port, why not, than at least the time for this effort is paid ;-) > That isn't neccessarily a bad thing at all, evolving the project > internally or the featureset or whatever can be much more important > than adapting the project to work "on" more operating systems. I don't have the impression that more people would work on those GSM related projects if they would directly run on Windows. I think the main obstacle is that you need to know quite a lot of GSM to make use of them. And if you are able to learn and understand the GSM related stuff, using Windows and/or Linux should be no problem at all for you ;-) Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

4 4

Removing the C123 RX filter
by Sylvain Munaut 15 Oct '10

15 Oct '10

Hi, As a prelude to various experimentations, I had to remove the RX filter on some C123. As this can be useful to others, I've done a little summary of how I do it. It's not for the faint of heart tough :) http://www.246tnt.com/gsm/rx_filter.html Comments welcome of course. Cheers, Sylvain Munaut

4 3

AW: Newbie: C123 + layer1.compalram.bin + layer23
by Andreas.Eversberg 14 Oct '10

14 Oct '10

> But I'm not sure it really works: the firmware seems to freeze (not > responding to the power button anymore) and the last output of 'mobile' > is: > > <0003> gsm322.c:257 Sync to ARFCN=104 rxlev=-65 (No sysinfo yet, ccch mode NONE) hi nicolas, be sure to use the branch of sylvain: sylvain/testing (i think you did) the process freezes after many sync requests due to a memory leak that has not been fixed. without the fix, the full network search process should run several times without freeze. but in your case it looks like freezing every first sync request. can you watch the display of your c123? see if it gets a little darker at the point it freezes (when trying to sync). regards, andreas

2 1

PATCH: Framebuffer for C123 and C155
by Christian Vogel 12 Oct '10

12 Oct '10

{Resent, it didn't appear on the list after 20 minutes.} Hi, I had some spare time the last days and put together a first attempt at a framebuffer for the OSMOCOM mobiles. It currently supports the C123 and the C155, the only two phones I own. > On Sat, 10 Apr 2010 10:26:05 +0300, Harald Welte > >1) we need a way to select between individual fonts ... > > Something like display_select_font(FONT_5x8) to be called > > before a display_puts() sounds like a reasonable API for this. the current API looks like this: fb_clear(); fb_setfg(FB_COLOR_GREEN); fb_setbg(FB_COLOR_WHITE); fb_setfont(FB_FONT_HELVB14); fb_gotoxy(2,20); fb_putstr("Hello World!",framebuffer->width-4); fb_setfg(FB_COLOR_RED); fb_setbg(FB_COLOR_BLUE); fb_gotoxy(2,25); fb_boxto(framebuffer->width-3,38); fb_setfg(FB_COLOR_WHITE); fb_setfont(FB_FONT_5X8); fb_gotoxy(8,33); fb_putstr("osmocom-bb",framebuffer->width-4); fb_flush(); Which results in an output such as: http://vogel.cx/git/20101011_hello_world_c123.jpg http://vogel.cx/git/20101011_hello_world_c155.jpg > - If we want to support arbitrary sized fonts, we either should buffer > the display in RAM (might be wasteful on high res color displays?) ... This patch keeps a image of the LCD in a RAM and only copies "dirty" parts upon changes. > >2) Removing all the special characters might not be the best idea to do. > > If at all, it should be a compile time option whether or not to drop > > the special characters. > > Also, the check for replacing a character with '?' needs to be > > a font-specific and not a global decision. This patch currently encodes only #32..#127 to conserve space, but it supports leaving out arbitrary characters. When the data is actually put into ROM we can spare additional space on more glyphs and/or fonts. I currently don't have commit access to the git-repo, so I couldn't upload my vogelchr/framebuffer branch. Please have a look at the patch you can download from http://vogel.cx/git/20101011_framebuffer.diff It removes the old display code completely and replaces it with the framebuffer, but currently only "hello world" makes use of it by creating the image in the photographs linked above. It should apply cleanly to today's master (11.Oct.2010) as it doesn't touch anything where currently work is being done. Please send me your comments on that patch. Greetings from the Dillberg, Chris

1 1

PATCH: Framebuffer for C123 and C155
by Christian Vogel 11 Oct '10

11 Oct '10

Hi, I had some spare time the last days and put together a first attempt at a framebuffer for the OSMOCOM mobiles. It currently supports the C123 and the C155, the only two phones I own. > On Sat, 10 Apr 2010 10:26:05 +0300, Harald Welte > >1) we need a way to select between individual fonts ... > > Something like display_select_font(FONT_5x8) to be called > > before a display_puts() sounds like a reasonable API for this. the current API looks like this: fb_clear(); fb_setfg(FB_COLOR_GREEN); fb_setbg(FB_COLOR_WHITE); fb_setfont(FB_FONT_HELVB14); fb_gotoxy(2,20); fb_putstr("Hello World!",framebuffer->width-4); fb_setfg(FB_COLOR_RED); fb_setbg(FB_COLOR_BLUE); fb_gotoxy(2,25); fb_boxto(framebuffer->width-3,38); fb_setfg(FB_COLOR_WHITE); fb_setfont(FB_FONT_5X8); fb_gotoxy(8,33); fb_putstr("osmocom-bb",framebuffer->width-4); fb_flush(); Which results in an output such as: http://vogel.cx/git/20101011_hello_world_c123.jpg http://vogel.cx/git/20101011_hello_world_c155.jpg > - If we want to support arbitrary sized fonts, we either should buffer > the display in RAM (might be wasteful on high res color displays?) ... This patch keeps a image of the LCD in a RAM and only copies "dirty" parts upon changes. > >2) Removing all the special characters might not be the best idea to do. > > If at all, it should be a compile time option whether or not to drop > > the special characters. > > Also, the check for replacing a character with '?' needs to be > > a font-specific and not a global decision. This patch currently encodes only #32..#127 to conserve space, but it supports leaving out arbitrary characters. When the data is actually put into ROM we can spare additional space on more glyphs and/or fonts. I currently don't have commit access to the git-repo, so I couldn't upload my vogelchr/framebuffer branch. Please have a look at the patch you can download from http://vogel.cx/git/20101011_framebuffer.diff It removes the old display code completely and replaces it with the framebuffer, but currently only "hello world" makes use of it by creating the image in the photographs linked above. It should apply cleanly to today's master (11.Oct.2010) as it doesn't touch anything where currently work is being done. Please send me your comments on that patch. Greetings from the Dillberg, Chris

1 1

Re: osmocom on windows
by Dieter Spaar 07 Oct '10

07 Oct '10

Hello Mihai, On Thu, 7 Oct 2010 05:25:27 -0700 (PDT), "eisencah eisenach" <wbg_1000(a)yahoo.com> wrote: > > PS. The thing is I've done windows programming up until now, but maybe I > should adapt instead of trying to the sw :) I am mainly doing Windows software development, but I don't see any benefits from spending lots of time to adopt C language specific things in the source code so that it compiles with the MS compiler (be it either gcc specific language features or missing language features in the MS compiler). So I use Cygwin which also emulates at least those Unix specific features used in OpenBSC/OsmocomBB/Airprobe. And the C standard libraries are not that different that you won't understand what is going on. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

1 0

Re: OsmocomBB.TCH.
by Dieter Spaar 07 Oct '10

07 Oct '10

Hello Marten, just some basic technical note about what you are planning to do. The following _could_ work (to be sure if this is really usable in the planed environment much more research has to be investigated): - The BTS is based on a modified version of OpenBTS which allows to send a TCH without the need for signalling to setup the TCH. Similar everything on the uplink TCH will be played back. - The phones are based on OsmocomBB and receive the TCH from the BTS and play it back, they do not send anything on the TCH yet. - If you make sure that only one phone at once will send, it would be possible to press a button on the phone which will start transmitting on the TCH and then talk, similar to simple CB Radio handsets. On the BTS side you will hear the result. However all the adjustments to OpenBTS and OsmocomBB, even for a simple "Proof of concecpt" are not trivial. So you have to understand OpenBTS and OsmocomBB to make the required changes, you cannot expect that a short answere here on the list is the solution for the problem. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

baseband-devel