- baseband-devel - lists.osmocom.org

Re: removing ancient libosmocore fork from osmocom-bb.git
by Craig Comstock 17 May '17

17 May '17

Looks like in package libnewlib-dev for stretch (unstable) we have sys/select.h but in jessie (stable) it is not included. https://packages.debian.org/stretch/libnewlib-dev https://packages.debian.org/jessie/libnewlib-dev craig@box:~/libosmocore$ ./configure --prefix=/usr/local/arm-none-eabi --host=arm-none-eabi --enable-embedded --disable-shared CFLAGS="-Os -ffunction-sections -fdata-sections -nostartfiles -nodefaultlibs" craig@box:~/libosmocore$ make make all-recursive make[1]: Entering directory '/home/craig/libosmocore' Making all in include make[2]: Entering directory '/home/craig/libosmocore/include' make all-am make[3]: Entering directory '/home/craig/libosmocore/include' make[3]: Nothing to be done for 'all-am'. make[3]: Leaving directory '/home/craig/libosmocore/include' make[2]: Leaving directory '/home/craig/libosmocore/include' Making all in src make[2]: Entering directory '/home/craig/libosmocore/src' make all-am make[3]: Entering directory '/home/craig/libosmocore/src' CC select.lo select.c:27:24: fatal error: sys/select.h: No such file or directory #include <sys/select.h> ^ compilation terminated. Makefile:510: recipe for target 'select.lo' failed make[3]: *** [select.lo] Error 1 make[3]: Leaving directory '/home/craig/libosmocore/src' Makefile:373: recipe for target 'all' failed make[2]: *** [all] Error 2 make[2]: Leaving directory '/home/craig/libosmocore/src' Makefile:519: recipe for target 'all-recursive' failed make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory '/home/craig/libosmocore' Makefile:382: recipe for target 'all' failed make: *** [all] Error 2 -------------------------------------------- On Tue, 5/16/17, Harald Welte <laforge(a)gnumonks.org> wrote: Subject: removing ancient libosmocore fork from osmocom-bb.git To: baseband-devel(a)lists.osmocom.org Date: Tuesday, May 16, 2017, 11:18 AM Dear all, when we initially crated OsmocomBB, we moved the code that it shared with the pre-existing OpenBSC project into libosmocore.git, where libosmocore and libosmogsm are built. As libosmocore was quite a bit in flux (and we didn't have jenkins+gerrit yet), we decided to have a local clone of libosmocore.git as a git-subtree module inside osmocom-bb.git Meanwhile, upstream libosmocore received more and more code, and none of that was ever built with an 'arm-non-eabi' toolchain and --enable-embedded. I've been working quite a bit during the last week on making that embedded build work again. The idea is to be able to configure + build libosmocore.git master using something like ./configure --prefix=/usr/local/arm-none-eabi \ --host=arm-none-eabi \ --enable-embedded \ --disable-shared \ CFLAGS="-Os -ffunction-sections -fdata-sections -nostartfiles -nodefaultlibs" and then install it onto the host pc. I've used /usr/local/arm-none-eabi as the prefix, but it could of course be anywhere. The above already works for me on Debian unstable using libosmocore.git master. I have some patches pending in laforge/sercomm and laforge/pseudotalloc, but those are not mandatory to make the build work The local clone of libosmocore in OsmocomBB src/shared/libosmocore will be removed, and the Makefiles of osmocom-bb instructed to use the system-installed libosmocore from /usr/local/arm-none-eabi (see my 'laforge/remove-libosmocore' branch in). This also already "works" on my Debian unstable system, in as far as there are no unresolved symbols or other compilation/linking issues, and the firmware images are generated. I have not tested any of the resulting binaries yet, and as I'm travelling without compatible hardware (and overloaded), it's unlikely that I'll be able to test it soon. Nevertheless, this is what I would like to move to. If anyone wants to try if he can build the embedded libosmocore and resulting osmocom-bb from laforge/remove-libosmocore branch, please do so and report your progress/success/issues here. Next steps (after validating the above) are: * remove old sercomm.c code from osmocom-bb and use the new code from libosmocore * remove 'talloc emulation' from osmocom-bb and use pseudotalloc from libosmocore.git (plus an embedded 'malloc' like umm_malloc) Further ideas: * create Debian/Ubuntu package of cross-compiled libosmocore for embedded-arm, which we can add to the Osmocom nightly builds apt repository. * have an (optional?) osmocom-bb makefile step to git clone + configure + make install libosmocore Anyone interested in helping out with this, please feel free to join in. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

removing ancient libosmocore fork from osmocom-bb.git
by Harald Welte 17 May '17

17 May '17

Dear all, when we initially crated OsmocomBB, we moved the code that it shared with the pre-existing OpenBSC project into libosmocore.git, where libosmocore and libosmogsm are built. As libosmocore was quite a bit in flux (and we didn't have jenkins+gerrit yet), we decided to have a local clone of libosmocore.git as a git-subtree module inside osmocom-bb.git Meanwhile, upstream libosmocore received more and more code, and none of that was ever built with an 'arm-non-eabi' toolchain and --enable-embedded. I've been working quite a bit during the last week on making that embedded build work again. The idea is to be able to configure + build libosmocore.git master using something like ./configure --prefix=/usr/local/arm-none-eabi \ --host=arm-none-eabi \ --enable-embedded \ --disable-shared \ CFLAGS="-Os -ffunction-sections -fdata-sections -nostartfiles -nodefaultlibs" and then install it onto the host pc. I've used /usr/local/arm-none-eabi as the prefix, but it could of course be anywhere. The above already works for me on Debian unstable using libosmocore.git master. I have some patches pending in laforge/sercomm and laforge/pseudotalloc, but those are not mandatory to make the build work The local clone of libosmocore in OsmocomBB src/shared/libosmocore will be removed, and the Makefiles of osmocom-bb instructed to use the system-installed libosmocore from /usr/local/arm-none-eabi (see my 'laforge/remove-libosmocore' branch in). This also already "works" on my Debian unstable system, in as far as there are no unresolved symbols or other compilation/linking issues, and the firmware images are generated. I have not tested any of the resulting binaries yet, and as I'm travelling without compatible hardware (and overloaded), it's unlikely that I'll be able to test it soon. Nevertheless, this is what I would like to move to. If anyone wants to try if he can build the embedded libosmocore and resulting osmocom-bb from laforge/remove-libosmocore branch, please do so and report your progress/success/issues here. Next steps (after validating the above) are: * remove old sercomm.c code from osmocom-bb and use the new code from libosmocore * remove 'talloc emulation' from osmocom-bb and use pseudotalloc from libosmocore.git (plus an embedded 'malloc' like umm_malloc) Further ideas: * create Debian/Ubuntu package of cross-compiled libosmocore for embedded-arm, which we can add to the Osmocom nightly builds apt repository. * have an (optional?) osmocom-bb makefile step to git clone + configure + make install libosmocore Anyone interested in helping out with this, please feel free to join in. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

2 1

Re: CalypsoBTS and modern OsmoBSC
by Vadim Yanitskiy 11 May '17

11 May '17

Hi, > I found that the manual from the main site is outdated. Yeah, still couldn't find some time to update the wiki. > If I understood it correct, I have to setup calypso bts > as bts of type nanoBTS, correct? Why do you think so? No, CalypsoBTS has nothing related toip.access nanoBTS. From the other side, we don't have a dedicated type for OsmoBTS, so you can use 'sysmoBTS'. > I can sync with commercial cell, I can run OsmoBSC and > OsmoBTS but I still cannot find my network from my personal > phone in searching mode. Please watch a great Sylvain's talk, where he explained almost everything you need to know: "Further hacks on the Calypso platform" https://media.ccc.de/v/29c3-5226-en-further_hacks_calypso_h264 In short: BTS should transmit a continuous beacon on C0 to be detected. Normal MS can't do that. CalypsoBTS was hacked to perform the following timeslot layout: Tt_R_ttt, where 'T' means TX on Downlink, 'R' means RX on Uplink, and 't' means channel filling - dummy bursts. Phone cannot RX and TX at the same time, so one phone serves only one TS. With two phones you have the following layout: TT_RRttt, so you have two timeslots served. This is why you will have some detection troubles even with working BSS setup :/ > In logs of osmo-bts I can see: > > <0000> rsl.c:246 Tx RSL RF RESource INDication > <000b> trx_if.c:397 transceiver (phy0.0) rejected TRX command with > response: 'RSP SETTSC -1' > <0000> rsl.c:2353 (bts=0,trx=0,ts=0,ss=0) Rx RSL BCCH_INFO Just delete the 'settsc' line from your config, because CalypsoBTS transceiver only supports 'setbsic'. Have a fun! With best regards, Vadim Yanitskiy.

3 8

Timeslot allocation
by Anton Gorbachev 11 May '17

11 May '17

Dear colleagues, Could you please tell me when I am wrong in my assumptions? My story is about beacon channel. >From different resourses I got the information that we transmit bcch data (fcch,sch,bcch) which is required for MS to find our network. OK? On the pictures it's drawn like we transmit BCCH on C0T0. So DL TS1-7 can be used for i.e. TCH. So if we want just to create bts which can be found by MS and that's all, we may not transmit on TS1-7 at all. OK? When we are talking about CalypsoBTS we say that we must transmit several burst in a row. So here I am a bit confused. So if we want to just transmit bcch messages we can transmit every TS0 and rest on TS1-7. Why not? Why I can see in manuals and videos pictures like Ttt_R_tt? Why do I need these dummy "t" bursts? Why one burst is "t" and another is "T"? Sure I understand that we must receive something for normal BTS operation like RACH and need some time to switch Tx/Rx. But why we just cannot use mask like T_R_T_R_ ...? I understood that we cant use mask TTT_RR because calypso phone was not hacked to receive two bursts in a row. Thanks in advance!

1 0

CalypsoBTS and modern OsmoBSC
by Anton Gorbachev 09 May '17

09 May '17

Dear colleagues, I am trying to set up CalypsoBTS with the last version of OsmoNTIB and branch jolly/testing (so using two phones). I found that the manual from the main site is outdated. It doesn't work with the config provided os I am trying to figure out how to tune it manually. If I understood it correct, I have to setup calypso bts as bts of type nanoBTS, correct? I can sync with commercial cell, I can run OsmoBSC and OsmoBTS but I still cannot find my network from my personal phone in searching mode. Could you please tell me what can be wrong? I tried both GSM900 and DSC1800, different channels selected after RSSI checking... Both phones are w/o filter rework, they are motorola c113 and c113a. In logs of osmo-bts I can see: <0000> rsl.c:246 Tx RSL RF RESource INDication <000b> trx_if.c:397 transceiver (phy0.0) rejected TRX command with response: 'RSP SETTSC -1' <0000> rsl.c:2353 (bts=0,trx=0,ts=0,ss=0) Rx RSL BCCH_INFO In osmo-bsc log everything looks fine: <001e> input/ipa.c:263 accept()ed new link from 127.0.0.1 to port 3003 <0005> abis_nm.c:2513 OC=BASEBAND-TRANSCEIVER(04) INST=(00,00,ff) IPACCESS(0xe1): RSL CONNECT ACK <0005> abis_nm.c:698 OC=CHANNEL(03) INST=(00,00,00) Set Channel Attributes ACK <0004> bsc_init.c:288 bootstrapping RSL for BTS/TRX (0/0) on ARFCN 29 using MCC=1 MNC=1 LAC=5 CID=5 BSIC=5 <0003> system_information.c:544 Serving cell: 29 <0003> bsc_init.c:105 SI1: 55 06 19 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 e5 04 00 2b Here below are my configs: ======================================= osmo-bts.cfg phy 0 instance 0 bts 0 band GSM900 ipa unit-id 1801 0 oml remote-ip 127.0.0.1 rtp jitter-buffer 0 paging queue-size 200 paging lifetime 0 ms-power-loop -60 timing-advance-loop settsc setbsic trx 0 phy 0 instance 0 ========================================= open-bsc.cfg phy 0 instance 0 bts 0 band GSM900 ipa unit-id 1801 0 oml remote-ip 127.0.0.1 rtp jitter-buffer 0 paging queue-size 200 paging lifetime 0 ms-power-loop -60 timing-advance-loop settsc setbsic trx 0 phy 0 instance 0 root@osmobox:~/.osmocom# cat open-bsc.cfg ! ! OpenBSC (0.15.0.754-c6e8) configuration saved from vty !! ! log stderr logging filter all 1 logging color 1 logging print category 0 logging timestamp 0 logging level all everything logging level rll everything logging level cc everything logging level mm everything logging level rr everything logging level rsl everything logging level nm everything logging level mncc notice logging level pag notice logging level meas notice logging level sccp notice logging level msc notice logging level mgcp notice logging level ho notice logging level db notice logging level ref notice logging level gprs debug logging level ns info logging level bssgp debug logging level llc debug logging level sndcp debug logging level nat notice logging level ctrl notice logging level smpp debug logging level filter debug logging level ranap debug logging level sua debug logging level lglobal notice logging level llapd notice logging level linp notice logging level lmux notice logging level lmi notice logging level lmib notice logging level lsms notice logging level lctrl notice logging level lgtp notice logging level lstats notice logging level lgsup notice logging level loap notice logging level lss7 notice logging level lsccp notice logging level lsua notice logging level lm3ua notice log file logfile logging filter all 0 logging color 1 logging print category 0 logging timestamp 0 logging level all everything logging level rll notice logging level cc notice logging level mm notice logging level rr notice logging level rsl notice logging level nm info logging level mncc notice logging level pag notice logging level meas notice logging level sccp notice logging level msc notice logging level mgcp notice logging level ho notice logging level db notice logging level ref notice logging level gprs debug logging level ns info logging level bssgp debug logging level llc debug logging level sndcp debug logging level nat notice logging level ctrl notice logging level smpp debug logging level filter debug logging level ranap debug logging level sua debug logging level lglobal notice logging level llapd notice logging level linp notice logging level lmux notice logging level lmi notice logging level lmib notice logging level lsms notice logging level lctrl notice logging level lgtp notice logging level lstats notice logging level lgsup notice logging level loap notice logging level lss7 notice logging level lsccp notice logging level lsua notice logging level lm3ua notice ! stats interval 5 ! line vty no login ! e1_input e1_line 0 driver ipa e1_line 0 port 0 no e1_line 0 keepalive network network country code 1 mobile network code 1 short name HomeGSM long name HomeGSM auth policy closed authorized-regexp .* location updating reject cause 13 encryption a5 0 neci 0 paging any use tch 0 rrlp mode none mm info 0 handover 0 handover window rxlev averaging 10 handover window rxqual averaging 1 handover window rxlev neighbor averaging 10 handover power budget interval 6 handover power budget hysteresis 3 handover maximum distance 9999 timer t3101 10 timer t3103 0 timer t3105 40 timer t3107 0 timer t3109 0 timer t3111 0 timer t3113 60 timer t3115 0 timer t3117 0 timer t3119 0 timer t3122 10 timer t3141 0 dyn_ts_allow_tch_f 0 subscriber-keep-in-ram 0 bts 0 type nanobts band GSM900 cell_identity 5 location_area_code 5 base_station_id_code 5 ms max power 0 cell reselection hysteresis 4 rxlev access min 0 periodic location update 30 radio-link-timeout 32 channel allocator ascending rach tx integer 9 rach max transmission 7 channel-descrption attach 1 channel-descrption bs-pa-mfrms 5 channel-descrption bs-ag-blks-res 1 early-classmark-sending forbidden ip.access unit_id 1801 0 ip.access rsl-ip 127.0.0.1 oml ip.access stream_id 255 line 0 neighbor-list mode automatic codec-support fr hr amr gprs mode none no force-combined-si trx 0 rf_locked 0 arfcn 29 nominal power 23 max_power_red 0 rsl e1 tei 0 timeslot 0 phys_chan_config CCCH+SDCCH4 hopping enabled 0 timeslot 1 phys_chan_config TCH/H hopping enabled 0 timeslot 2 phys_chan_config TCH/H hopping enabled 0 timeslot 3 phys_chan_config TCH/H hopping enabled 0 timeslot 4 phys_chan_config TCH/H hopping enabled 0 timeslot 5 phys_chan_config TCH/H hopping enabled 0 timeslot 6 phys_chan_config TCH/H hopping enabled 0 timeslot 7 phys_chan_config TCH/H hopping enabled 0 mncc-int default-codec tch-f amr default-codec tch-h amr nitb subscriber-create-on-demand assign-tmsi

1 0

Re: CalypsoBTS + GPRS and SDR suggestion
by Vadim Yanitskiy 09 May '17

09 May '17

Hi, > I setup CalypsoBTS to work with 2 old motorola c123, I know that isn't the > best way to do that, but I would like to have a cheap solution. I got the > setup working with a normal phone and the BTS seems to work correctly > (using jolly/testing), but from my understanding it support only GSM calls > and SMS and GPRS is not implemented into the transceiver. I'm wrong or this > part has not been implemented yet? Right, isn't implemented. When you run OsmoBTS, it first does some basic configuration of transceiver, including timeslot type setting. PDCH has its own dedicated type, which is being indicated by the SETSLOT command. So you can look at OsmocomBB sources, and check whether the transceiver handles this type or not. > Also, given that CalypsoBTS can only provide single (or two?) timeslot, > there are a long list of reasons why it would not work straight-forward. > But technically also possible to make work. With two Calypso phones it becomes possible to serve two timeslots. Basically, second phone serves one TCH timeslot, but (if I am correct) PDCH has no fundamental differences from TCH, so its support could be implemented too. After a quick look at OsmoTRX source code, I can assume, that the only difference between TCH channel combinations (I, II and III) and PDCH channel combination (XIII) is a fillerModulus value. Correct me if I am wrong. With best regards, Vadim Yanitskiy.

3 2

CalypsoBTS + GPRS and SDR suggestion
by inode 08 May '17

08 May '17

Hi everybody, I'm pretty new to the GSM/UMTS environment and I'm doing some tests. Currently I need to analyze some IoT devices that use 2G network to comunicate via GPRS. I setup CalypsoBTS to work with 2 old motorola c123, I know that isn't the best way to do that, but I would like to have a cheap solution. I got the setup working with a normal phone and the BTS seems to work correctly (using jolly/testing), but from my understanding it support only GSM calls and SMS and GPRS is not implemented into the transceiver. I'm wrong or this part has not been implemented yet? If needed to use a GPRS BTS can you suggest the best cheap SDR to use with OsmoBTS? (I saw BladeRF and LimeSDR but I was unable to understand if they are full supported via OsmoBTS) Thank you in advance. inode

3 2

Re: to qcom hexagon porting
by Craig Comstock 08 May '17

08 May '17

> what are problem should i expect > while porting to qcom hexagon > is it a bad idea There would be a lot of questions and things to research. I am not familiar with qcom hexagon SDK. I am a little familiar with osmocom-bb source code and 2G GSM details. I am currently in the very beginning stages of porting osmocom-bb to the MediaTek 6260/6261 chip which supports 2G. I also have ideas to try and work through 3G on a MediaTek 6735 (ZTE Obsidian phone). Recently there have been mentions of re-writing the PHY layer of osmocom-bb for an SDR platform like LimeSDR. https://github.com/axilirator/osmocom-bb So at the current time I assume that osmocom-bb communicates with the DSP chip on the motorola phones in a way that abstracts the PHY layer details away and relies on the proprietary Texas Instruments firmware in the DSP as-is. So I would imagine you might have to implement the PHY layer and also the interface to the PHY layer. There was a discussion about this recently on IRC #osmocom. It seems the thought was that qcom had released enough with their Hexagon SDK to allow development of a PHY layer + whatever else. Some links of interest. https://developer.qualcomm.com/ - SDK https://github.com/ttsou/openphy - LTE PHY for Ettus USRP https://androiddatahost.com/fgd43 - qcom flash image loader I have a few qcom modems that I'd be happy to do experiment on if that helps. -Craig

1 0

to qcom hexagon porting
by thayyil09 yil 07 May '17

07 May '17

what are problem should i expect while porting to qcom hexagon is it a bad idea

1 0

Re: CalypsoBTS no sync, ms hang
by Vadim Yanitskiy 06 May '17

06 May '17

> isn't fixed in branch jolly/testing I am using for calypsoBTS. > So all I needed is just implement the fix and recompile from sources. You can also use an older version of toolchain as a temporary solution: https://github.com/axilirator/gnu-arm-installer - in this repo I have fixed some installation (texinfo) related issues. With best regards, Vadim Yanitskiy.

2 1

CalypsoBTS no sync, ms hang
by Anton Gorbachev 05 May '17

05 May '17

Dear colleagues, I am trying to setup CalypsoBTS with two c113 phones. Don't you know why can't I sync to any commercial cell with transceiver from branch jolly/testing? What I have: Motorola c113 and c113a, tried both. All other apps like, RSSI, mobile, ccch_scan works like a charm. What I am doing: Built jolly/testing according to maual https://osmocom.org/projects/baseband/wiki/CalypsoBTS Load firmware ./osmocon -r 99 -m c123xor -p /dev/ttyUSB0 -c ../../target/firmware/board/compal_e88/trx.highram.bin Found several strongest cells with RSSI and cell_log. Trying to sync: ./transceiver -a 50 -r 99 -e 1 Here is the log: 50 41 1 <000c> l1ctl.c:77 Tx Reset Req (1) <000c> l1ctl_link.c:171 Sending: '0d 00 00 00 01 00 00 00 ' <0012> l1ctl.c:383 Reset received: Starting sync. <000c> l1ctl.c:95 Sync Req <000c> l1ctl_link.c:171 Sending: '01 00 00 00 00 32 00 64 27 10 03 20 03 07 00 00 00 ' After that phone hangs, no reaction in osmocon on key pressures, holding on power off button... The last messages are: L1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=50, flags=0x7) Starting FCCH RecognitionFB0 (2515:4): TOA= 3552, Power= -64dBm, Angle= 1328Hz FB1 (2525:8): TOA= 8543, Power= -64dBm, Angle= 114Hz fn_offset=2523 (fn=2525 + attempt=8 + ntdma = 6) delay=8 (fn_offset=2523 + 11 - fn=2525 - 1 scheduling next FB/SB detection task with delay 8 =>FB @ FNR 2523 fn_offset=2523 qbits=3988 Synchronize_TDMA LOST 3398! I tried different cells, maybe I need to wait some time to warm the crystal? But can it be so important? Kind regards, Anton

1 1

Re: OsmocomBB full Opensouce?
by Vadim Yanitskiy 04 May '17

04 May '17

Hi Anton, > There are some ideas floating around of doing a new run of this using > OsmoTRX as basis, but I don't know if there is any actual progress yet. > Vadim should be able to say more about it. Yeah, I started to work on SDR based PHY about a year ago, but so far I was busy with libosmocore development. Right now almost everything (including libosmocoding of course) is in master branch, so it's good point to resume this work. If you would like to contribute this direction or something else, we are always open for that, so feel free! The source code is currently on GitHub: https://github.com/axilirator/osmocom-bb/ BTW: Harald, is it possible to create a new branch for that work in the project's repo? If yes, I can send you my public key in PM. Thanks! With best regards, Vadim Yanitskiy.

4 3

Phone not receiving calls
by samir 04 May '17

04 May '17

Hello, I test osmocombb for some time with motorola c115. I can make calls but not always receive calls. I tried 2 sim cards one of them is working fine but the other doesn’t receive anything. I really need some help to solve my problem. thanks in advance.

1 0

CalypsoBTS + GPRS and SDR suggestion
by Maurizio Agazzini 04 May '17

04 May '17

Hi everybody, I'm pretty new to the GSM/UMTS environment and I'm doing some tests. Currently I need to analyze some IoT devices that use 2G network to comunicate via GPRS. I setup CalypsoBTS to work with 2 old motorola c123, I know that isn't the best way to do that, but I would like to have a cheap solution. I got the setup working with a normal phone and the BTS seems to work correctly (using jolly/testing), but from my understanding it support only GSM calls and SMS and GPRS is not implemented into the transceiver. I'm wrong or this part has not been implemented yet? If needed to use a GPRS BTS can you suggest the best cheap SDR to use with OsmoBTS? (I saw BladeRF and LimeSDR but I was unable to understand if they are full supported via OsmoBTS) Thank you in advance. inode

1 0

OsmocomBB full Opensouce?
by Anton Gorbachev 04 May '17

04 May '17

Dear collegues, Could you please help me to understand one thing.. If I understood everything correct, osmocombb project consist of all the code for GSM stack L1-L3 functionality but Calypdo DSP code is not Opensource and layer1.bin ask non-opensource DSP module to do execute L1 tasks from ghis list: https://osmocom.org/projects/baseband/wiki/TSM30Layer1#DSP-Tasks Of cource we can patch DSP and ask it to do whatever we want, like send raw bursts to the host, but now osmocombb uses mostly DSP firmware written by Texas Instruments, not its own opdnsource. Is it correct or not? Thanks in advance!

2 1

osmocombb for qcom
by thayyil09 yil 01 May '17

01 May '17

is it possible to add new project page to osmocom site. as i mentioned earlear sourcecode already available for qcom i think none intrested in it. is it true .why?

1 0

Re: osmocom-bb moved to gerrit
by Vadim Yanitskiy 26 Apr '17

26 Apr '17

Hi, > The osmocom-bb git repository has now moved to gerrit. Great news! > There are no tests in osmocom-bb yet, but I wonder if it would be possible to add > simple jenkins job which checks that arm cross-compilation for osmocom-bb > succeeds as a patch check? I can take this task and try to write a Jenkins script. Also, we need to have cross-compiler installed on the build machines. With best regards, Vadim Yanitskiy.

4 6

osmocom-bb moved to gerrit
by Neels Hofmeyr 25 Apr '17

25 Apr '17

The osmocom-bb git repository has now moved to gerrit. For patch submission to osmocom-bb, see https://osmocom.org/projects/cellular-infrastructure/wiki/Gerrit ~N

2 1

osmocombb on qualcom android phones
by thayyil09 yil 22 Apr '17

22 Apr '17

2 1

Re: gerrit for osmocom-bb
by Vadim Yanitskiy 20 Apr '17

20 Apr '17

Hi, > I'm not sure if it's just me or if I'm using it wrong but > I'm always annoyed when I have to login to gerrit ... +1 here, Gerrit login is (for now) a bit unfriendly. Even so, there are also some advantages to have OsmocomBB in Gerrit: - Jenkins builder: maintainers / reviewers don't need to manually check whether a new commit fails build or not. - I don't need to copy-paste the source code to leave a contextual comment or ask a question. - Doing 'git push gerrit ...' is simpler and faster for me, than 'git format-patch ...', 'git send-email ...'. So, I would be definitely happy to see OsmocomBB in Gerrit. With best regards, Vadim Yanitskiy.

1 0

gerrit for osmocom-bb
by Max 20 Apr '17

20 Apr '17

Hi. I've just noticed that OsmocomBB is not on the list of projects at https://gerrit.osmocom.org/#/admin/projects/ Is this because nobody bothered adding it there yet or it's because maintainers do not find it suitable? If it's the latter than I'd love to see it added to streamline contributions and patch review process. -- Max Suraev <msuraev(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschaeftsfuehrer / Managing Director: Harald Welte

5 6

Re: Fun with the MTK 6573 Baseband (Patching / Replacing)
by Craig Comstock 19 Apr '17

19 Apr '17

RootZero/bruce lee sent me this github with baseband sources very similar to what I already have for MT626x: https://github.com/zxp86021/MediaTek-HelioX10-Baseband Looking there it seems we have layer 1 GSM/2G support for many more RF chips. The trick is to figure out what AP/SOC they are used in. For example the MediaTek-HelioX10 is a MT6795 which seems to use the MT6169 transciever chip (based on some other files in the sources). My ZTE Obsidian seems to use this same TRX chip (based on a MT6735 datasheet) http://www.datasheet4u.com/pdf/MT6735-pdf/925384 Comparing L1D_RF_PowerOn functions it seems the MT6252 might be the closest to the MT626x which are completely missing from this newer set of sources that are maybe a year or so newer than the MT626x sources I have. m12196.c:/*BRIGHT2*/ void L1D_RF_PowerOn( void ) m12196.c:/*BRIGHT4*/ void L1D_RF_PowerOn( void ) m12196.c:/*BRIGHT5P*/ void L1D_RF_PowerOn( void ) m12196.c:/*AERO*/ void L1D_RF_PowerOn( void ) m12196.c:/*AERO1+*/ void L1D_RF_PowerOn( void ) m12196.c:/*RFMD*/ void L1D_RF_PowerOn( void ) m12196.c:/*SKY74117*/ void L1D_RF_PowerOn( void ) m12196.c:/*SKY74400*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6119*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6119C*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6129A*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6129B*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6129C*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6129D*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6139B*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6139C*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6139E*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6140A*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6140B*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6140C*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6140D*/ void L1D_RF_PowerOn( void ) m12196.c:/*CMOSEDGE*/ void L1D_RF_PowerOn( void ) m12196.c:/*MTKSOC1T*/ void L1D_RF_PowerOn( void ) m12196.c:/*MTKSOC1*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6252RF*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6256RF*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6255RF*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6251RF*/ void L1D_RF_PowerOn( void ) m12196.c:/*SKY74045*/ void L1D_RF_PowerOn( void ) m12196.c:/*AERO2*/ void L1D_RF_PowerOn( void ) m12196.c:/*SKY74137*/ void L1D_RF_PowerOn( void ) m12196.c:/*GRF6201*/ void L1D_RF_PowerOn( void ) m12196.c:/*IRFS3001*/ void L1D_RF_PowerOn( void ) m12196.c:/*AD6548*/ void L1D_RF_PowerOn( void ) m12196.c:/*AD6546*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6162*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6163*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6280RF*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6169*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6169*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6166*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6165*/ void L1D_RF_PowerOn( void ) one set of MT626x sources is called 11CW1418SP4 and supports the following baseband chips. Probably MT626x has an integrated baseband? m12196.c:/*MT6129D*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6139E*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6140D*/ void L1D_RF_PowerOn( void ) m12196.c:/*MTKSOC1*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6252RF*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6261RF*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6260RF*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6250RF*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6256RF*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6255RF*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6251RF*/ void L1D_RF_PowerOn( void ) m12196.c:/*AD6548*/ void L1D_RF_PowerOn( void ) m12196.c:/*AD6546*/ void L1D_RF_PowerOn( void ) m12196.c:/*MT6162*/ void L1D_RF_PowerOn( void ) So I guess I need to look elsewhere in the sources to puzzle out my MT6735 ZTE Obsidian which would give me I think the cheapest/oldest chip that supports 4G/LTE: GSM, UMTS, GPRS, HSPA+, HSUPA, TD-SCDMA, EVDO, LTE Cat 4 (from https://en.wikipedia.org/wiki/MediaTek) -Craig p.s. here are some sources I used to research both github and "from the internet": http://git.huayusoft.com/tomsu/AP7350_MDK-kernel.git https://github.com/akibsayyed/CELLTEL82_WET_KK_GPRS_HSPA_MOLY.WR8.W1315.MD.… https://github.com/akibsayyed/HSPA_MOLY.WR8.W1449.MD.WG.MP.V16.git https://github.com/zxp86021/MT6795.kernel.git mt626x stuff: 11CW1352MP_CENON61D_3232_11C_V2_GPRS_MMI 11CW1418SP4_CORETEK02A_WIFI_BT_V13_GPRS_MMI MTK60D-11B1308-V2 -------------------------------------------- On Thu, 4/13/17, bruce lee <bbsoo7(a)live.com> wrote: Subject: Re: Fun with the MTK 6573 Baseband (Patching / Replacing) To: "Craig Comstock" <craig_comstock(a)yahoo.com> Date: Thursday, April 13, 2017, 11:40 AM check this out. it is modem firmwear source code and this guy's github https://github.com/luckasfb/Development_Documents alots of good stuff.but do not have what am looking for. bruce. From: Craig Comstock <craig_comstock(a)yahoo.com> Sent: Thursday, April 13, 2017 2:10:15 PM To: bruce lee Subject: Re: Fun with the MTK 6573 Baseband (Patching / Replacing) Looking at some kernel sources I see a few things that look familiar to me from mt626x source. Grepping for RIL (radio interface layer) https://github.com/eagleeyetom/android_kernel_mtk_mt6572.git ./mediatek/platform/mt6572/lk/include/platform/mt_reg_base.h: #define RIL_SIZE 0x1600000 ./mediatek/platform/mt6572/lk/include/platform/mt_reg_base.h: #define RIL_SIZE 0x0A00000 ./mediatek/platform/mt6572/lk/include/platform/mt_reg_base.h: #define RIL_SIZE 0x1600000 ./mediatek/platform/mt6572/lk/include/platform/mt_reg_base.h:#define RIL_SIZE 0x100000 //for connsys memory ./mediatek/platform/mt6572/lk/include/platform/mt_reg_base.h:#define MEM_PRELOADER_START (DRAM_PHY_ADDR) //placed mem in RIL 256KB ./mediatek/platform/mt6572/lk/include/platform/mt_reg_base.h:#define RESERVE_MEM_SIZE (RIL_SIZE) they mentioned infrasys and connsys near the RIL bits... craig@z500:~/android_kernel_mtk_mt6572/mediatek$ find | xargs grep -s infrasys ./platform/mt6572/kernel/core/include/mach/mt_reg_base.h:/* infrasys AO */ ./platform/mt6572/kernel/core/include/mach/mt_reg_base.h:/* infrasys */ ./platform/mt6572/kernel/core/core.c: /* infrasys AO first half */ ./platform/mt6572/kernel/core/core.c: /* infrasys AO second half */ ./platform/mt6572/kernel/core/core.c: /* infrasys */ ./platform/mt6572/lk/include/platform/mt_reg_base.h:/* infrasys AO */ ./platform/mt6572/lk/include/platform/mt_reg_base.h:/* infrasys */ craig@z500:~/android_kernel_mtk_mt6572/mediatek$ vi platform/mt6572/kernel/core/core.c So... mt_reg_base.h looks a little familiar to mt626x stuff. There is also this: https://android.googlesource.com/kernel/mediatek/ and this: https://github.com/profglavcho/mt6735-kernel-3.10.61 -------------------------------------------- On Thu, 4/13/17, bruce lee <bbsoo7(a)live.com> wrote: Subject: Re: Fun with the MTK 6573 Baseband (Patching / Replacing) To: "baseband-devel(a)lists.osmocom.org" <baseband-devel(a)lists.osmocom.org>, "Craig Comstock" <craig_comstock(a)yahoo.com> Date: Thursday, April 13, 2017, 1:49 AM maybe it is easiest for developing on some boards which has UART port to look it boot up message. some mt6572 based boards one can find on China market. they event can share code with us if we buy it. it is android based. so should/can we make a osmocom-bb based BP for this android board? or other smartphone? thanks RZ From: Craig Comstock <craig_comstock(a)yahoo.com> Sent: Thursday, April 13, 2017 3:21 AM To: baseband-devel(a)lists.osmocom.org; bruce lee Subject: Re: Fun with the MTK 6573 Baseband (Patching / Replacing) I don't have the files mentioned in that patch. They look very much like some part of an Android source code tree. So far I am working mostly not with Android at all... only osmocom-bb, nuttx, fernly and fernvale-nuttx. My work on the newer MT chip in the ZTE Obsidian is a ways down the road. One thing that was VERY encouraging is that I have tested the beginnings of interaction with it's bootloader (as in the fernly project) and it seems at least the initial MSG and ACK from the bootloader works the same as for fernly types of MT chips (6260/6261). So that might be a good starting point in terms of experimenting/fuzzing/??? Maybe you could find a custom rom source tree and find those files that are being patched. In terms of participating in my project, I have a github repo and am primarily using the fernvale board I purchased from sysmocom as well as some mt6260/6261 based watches and the Seeed Studio RePhone. So I'd say go get one or more of those things and start hacking on fernly, fernvale-nuttx, osmocom-bb and nuttx-bb (combo of osmocom-bb and nuttx). I don't work too hard on the project. This branch is my latest not-working work in progress: https://github.com/craigcomstock/osmocom-bb/tree/feb-22-2017-mt62xx-wip craigcomstock/osmocom-bb github.com Contribute to osmocom-bb development by creating an account on GitHub. I have since changed my strategy and so this branch will likely rot. :( But it might give some indication of what I'm up to. -Craig -------------------------------------------- On Wed, 4/12/17, bruce lee <bbsoo7(a)live.com> wrote: Subject: Re: Fun with the MTK 6573 Baseband (Patching / Replacing) To: "Craig Comstock" <craig_comstock(a)yahoo.com>, "baseband-devel(a)lists.osmocom.org" <baseband-devel(a)lists.osmocom.org> Date: Wednesday, April 12, 2017, 9:39 PM Craig, do you have the files mentioned at https://github.com/shadowsim/shadowsim/blob/master/mdlogger.patch and for your project, seem very interesting, and I would like to participate in. thanks RZ From: Craig Comstock <craig_comstock(a)yahoo.com> Sent: Tuesday, April 11, 2017 11:35 AM To: baseband-devel(a)lists.osmocom.org; RootZero Subject: Re: Fun with the MTK 6573 Baseband (Patching / Replacing) My target was Mt6735 in a Zte Obsidian. I chose it for 4g lte. I could root one and see if similar techniques work. My hope was to leverage leaked source for mt626x and hope to work my way up the chip models. I am currently working on porting osmocom-bb and nuttx-bb to fernvale/rephone/mt626x. On April 11, 2017 4:39:46 AM CDT, RootZero <bbsoo7(a)live.com> wrote: Markus and all, I am very interesting in this project/hack. can you share more information with US? I searched lots web pages and do not find the source of mdlogger.cpp file. I do have the source code of "modem.img" if you want please let me know. thanks RootZero -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Fun-with-the-MTK-6573-Baseband-P… - Fun with the MTK 6573 Baseband (Patching / Replacing)baseband-devel.722152.n3.nabble.comFun with the MTK 6573 Baseband (Patching / Replacing). -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I'm Markus, a security researcher from Germany. I recently did some work on MTK 6573... Sent from the baseband-devel mailing list archive at Nabble.com.Nabble • Free Forum • Embeddable Web Appsnabble.comEmbed into any Website. All Nabble apps are naturally embeddable, which means that they can be easily displayed inside any web page. -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

2 3

Re: Fun with the MTK 6573 Baseband (Patching / Replacing)
by Craig Comstock 13 Apr '17

13 Apr '17

I don't know much about the architecture of these MT based Android phones yet. We would need some source for the actual baseband part of the code in order to port osmocom-bb. I was able to quickly search for mt6572 kernel sources but that's not what we need. I also found custom ROMs like CyanogenMod. That might get us a bit further. Also there are "scatter" files that newer MT based devices use as a sort of map for fastboot flashing images onto a device (I think, not much experience here). So that might give a clue as well. This one has U-Boot! That might be helpful. https://github.com/GoldRenard/AllegroROM_4.2.2_mt6572/blob/master/HWPackage… So if you can purchase a 6572 based board and get enough source that might be what is needed to make progress. If you find a link to something share it I suppose. I'm mostly focused on porting osmocom-bb to 626x at this point and figuring out how to get layer1+modem built as nuttx-bb... but... as I mentioned I work slow so if others push forward with a newer chip that would be cool. If we could end up with something like AOSP + osmocom-bb image for RILD I suppose that might be fun. I am more interested in NOT using Android for what it's worth. -Craig -------------------------------------------- On Thu, 4/13/17, bruce lee <bbsoo7(a)live.com> wrote: Subject: Re: Fun with the MTK 6573 Baseband (Patching / Replacing) To: "baseband-devel(a)lists.osmocom.org" <baseband-devel(a)lists.osmocom.org>, "Craig Comstock" <craig_comstock(a)yahoo.com> Date: Thursday, April 13, 2017, 1:49 AM maybe it is easiest for developing on some boards which has UART port to look it boot up message. some mt6572 based boards one can find on China market. they event can share code with us if we buy it. it is android based. so should/can we make a osmocom-bb based BP for this android board? or other smartphone? thanks RZ From: Craig Comstock <craig_comstock(a)yahoo.com> Sent: Thursday, April 13, 2017 3:21 AM To: baseband-devel(a)lists.osmocom.org; bruce lee Subject: Re: Fun with the MTK 6573 Baseband (Patching / Replacing) I don't have the files mentioned in that patch. They look very much like some part of an Android source code tree. So far I am working mostly not with Android at all... only osmocom-bb, nuttx, fernly and fernvale-nuttx. My work on the newer MT chip in the ZTE Obsidian is a ways down the road. One thing that was VERY encouraging is that I have tested the beginnings of interaction with it's bootloader (as in the fernly project) and it seems at least the initial MSG and ACK from the bootloader works the same as for fernly types of MT chips (6260/6261). So that might be a good starting point in terms of experimenting/fuzzing/??? Maybe you could find a custom rom source tree and find those files that are being patched. In terms of participating in my project, I have a github repo and am primarily using the fernvale board I purchased from sysmocom as well as some mt6260/6261 based watches and the Seeed Studio RePhone. So I'd say go get one or more of those things and start hacking on fernly, fernvale-nuttx, osmocom-bb and nuttx-bb (combo of osmocom-bb and nuttx). I don't work too hard on the project. This branch is my latest not-working work in progress: https://github.com/craigcomstock/osmocom-bb/tree/feb-22-2017-mt62xx-wip craigcomstock/osmocom-bb github.com Contribute to osmocom-bb development by creating an account on GitHub. I have since changed my strategy and so this branch will likely rot. :( But it might give some indication of what I'm up to. -Craig -------------------------------------------- On Wed, 4/12/17, bruce lee <bbsoo7(a)live.com> wrote: Subject: Re: Fun with the MTK 6573 Baseband (Patching / Replacing) To: "Craig Comstock" <craig_comstock(a)yahoo.com>, "baseband-devel(a)lists.osmocom.org" <baseband-devel(a)lists.osmocom.org> Date: Wednesday, April 12, 2017, 9:39 PM Craig, do you have the files mentioned at https://github.com/shadowsim/shadowsim/blob/master/mdlogger.patch and for your project, seem very interesting, and I would like to participate in. thanks RZ From: Craig Comstock <craig_comstock(a)yahoo.com> Sent: Tuesday, April 11, 2017 11:35 AM To: baseband-devel(a)lists.osmocom.org; RootZero Subject: Re: Fun with the MTK 6573 Baseband (Patching / Replacing) My target was Mt6735 in a Zte Obsidian. I chose it for 4g lte. I could root one and see if similar techniques work. My hope was to leverage leaked source for mt626x and hope to work my way up the chip models. I am currently working on porting osmocom-bb and nuttx-bb to fernvale/rephone/mt626x. On April 11, 2017 4:39:46 AM CDT, RootZero <bbsoo7(a)live.com> wrote: Markus and all, I am very interesting in this project/hack. can you share more information with US? I searched lots web pages and do not find the source of mdlogger.cpp file. I do have the source code of "modem.img" if you want please let me know. thanks RootZero -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Fun-with-the-MTK-6573-Baseband-P… - Fun with the MTK 6573 Baseband (Patching / Replacing)baseband-devel.722152.n3.nabble.comFun with the MTK 6573 Baseband (Patching / Replacing). -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I'm Markus, a security researcher from Germany. I recently did some work on MTK 6573... Sent from the baseband-devel mailing list archive at Nabble.com.Nabble • Free Forum • Embeddable Web Appsnabble.comEmbed into any Website. All Nabble apps are naturally embeddable, which means that they can be easily displayed inside any web page. -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

1 0

Re: Fun with the MTK 6573 Baseband (Patching / Replacing)
by Craig Comstock 13 Apr '17

13 Apr '17

I don't have the files mentioned in that patch. They look very much like some part of an Android source code tree. So far I am working mostly not with Android at all... only osmocom-bb, nuttx, fernly and fernvale-nuttx. My work on the newer MT chip in the ZTE Obsidian is a ways down the road. One thing that was VERY encouraging is that I have tested the beginnings of interaction with it's bootloader (as in the fernly project) and it seems at least the initial MSG and ACK from the bootloader works the same as for fernly types of MT chips (6260/6261). So that might be a good starting point in terms of experimenting/fuzzing/??? Maybe you could find a custom rom source tree and find those files that are being patched. In terms of participating in my project, I have a github repo and am primarily using the fernvale board I purchased from sysmocom as well as some mt6260/6261 based watches and the Seeed Studio RePhone. So I'd say go get one or more of those things and start hacking on fernly, fernvale-nuttx, osmocom-bb and nuttx-bb (combo of osmocom-bb and nuttx). I don't work too hard on the project. This branch is my latest not-working work in progress: https://github.com/craigcomstock/osmocom-bb/tree/feb-22-2017-mt62xx-wip I have since changed my strategy and so this branch will likely rot. :( But it might give some indication of what I'm up to. -Craig -------------------------------------------- On Wed, 4/12/17, bruce lee <bbsoo7(a)live.com> wrote: Subject: Re: Fun with the MTK 6573 Baseband (Patching / Replacing) To: "Craig Comstock" <craig_comstock(a)yahoo.com>, "baseband-devel(a)lists.osmocom.org" <baseband-devel(a)lists.osmocom.org> Date: Wednesday, April 12, 2017, 9:39 PM Craig, do you have the files mentioned at https://github.com/shadowsim/shadowsim/blob/master/mdlogger.patch and for your project, seem very interesting, and I would like to participate in. thanks RZ From: Craig Comstock <craig_comstock(a)yahoo.com> Sent: Tuesday, April 11, 2017 11:35 AM To: baseband-devel(a)lists.osmocom.org; RootZero Subject: Re: Fun with the MTK 6573 Baseband (Patching / Replacing) My target was Mt6735 in a Zte Obsidian. I chose it for 4g lte. I could root one and see if similar techniques work. My hope was to leverage leaked source for mt626x and hope to work my way up the chip models. I am currently working on porting osmocom-bb and nuttx-bb to fernvale/rephone/mt626x. On April 11, 2017 4:39:46 AM CDT, RootZero <bbsoo7(a)live.com> wrote: Markus and all, I am very interesting in this project/hack. can you share more information with US? I searched lots web pages and do not find the source of mdlogger.cpp file. I do have the source code of "modem.img" if you want please let me know. thanks RootZero -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Fun-with-the-MTK-6573-Baseband-P… - Fun with the MTK 6573 Baseband (Patching / Replacing)baseband-devel.722152.n3.nabble.comFun with the MTK 6573 Baseband (Patching / Replacing). -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I'm Markus, a security researcher from Germany. I recently did some work on MTK 6573... Sent from the baseband-devel mailing list archive at Nabble.com.Nabble • Free Forum • Embeddable Web Appsnabble.comEmbed into any Website. All Nabble apps are naturally embeddable, which means that they can be easily displayed inside any web page. -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

2 1

Re: Fun with the MTK 6573 Baseband (Patching / Replacing)
by RootZero 13 Apr '17

13 Apr '17

Markus and all, I am very interesting in this project/hack. can you share more information with US? I searched lots web pages and do not find the source of mdlogger.cpp file. I do have the source code of "modem.img" if you want please let me know. thanks RootZero -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Fun-with-the-MTK-6573-Baseband-P… Sent from the baseband-devel mailing list archive at Nabble.com.

3 2

FreeCalypso GSM MS development board built and mostly works
by Mychaela Falconia 10 Apr '17

10 Apr '17

Hello fellow GSM baseband hackers, Harald invited me to share this news with this list, so here it goes: the FreeCalypso project's GSM MS development board with the TI Calypso+Iota+Rita chipset, called FCDEV3B, has been built, and it mostly works, although there are still some issues being debugged. Pictures of this board can be seen here: https://www.freecalypso.org/members/falcon/fcdev3b/IMG_7580.jpeg https://www.freecalypso.org/members/falcon/fcdev3b/IMG_7581.jpeg Now the following part is bad news for me, but probably good news for you guys: right now OsmocomBB works on this board to the point of being able to connect to the live commercial GSM network in my part of the world, send and receive SMS and make a call, but my own preferred firmware is not currently able to the connect to the network (fails in the FB/SB acquisition step) because of the lack of VCXO calibration. To run OsmocomBB on my board, the same version of layer1.highram.bin that is currently built in board/gta0x works unchanged on the FCDEV3B, as my board design is derived from Openmoko GTA02. Both Calypso UARTs are equally accessible on header pins, so use whichever you prefer - tweak board/gta0x/init.c if you prefer to use the IrDA UART - for example, if you wish to use the external serial port when running the same layer1.highram.bin on Openmoko hardware. The on-board SIM socket wired to the Calypso+Iota chipset works - I used this native SIM socket (not an external SIM adapter) for the real SIM used to connect to Operator 310260's live commercial GSM network, and SMS sending and receiving worked without a hitch. After several tries I was also able to dial and connect a voice call - it took several tries, but voice calls from OsmocomBB have always been unreliable for me, even on pre-existing Calypso targets where they work flawlessly with the official firmware. However, the voice path has not been tested yet, as the hardware is not complete enough for it yet. I designed the FCDEV3B with the intent of being able to make test calls from the lab bench without needing anything except the board itself, and for this purpose there is a loudspeaker driver circuit and a microphone input circuit on the board, based on TI's Leonardo schematics. However, the actual loudspeaker and microphone themselves aren't on the board, instead there are headers meant for connecting them. At some point I will need to acquire some loudspeaker and microphone parts, wire them up to the headers and test these on-board audio circuits, but right now there are higher priorities. The following parts do not work properly yet: * There is a flash + external RAM chip on the board, the same part as used in the Pirelli DP-L10, with the gigantic capacity of 16 MiB of flash and 8 MiB of RAM. The external RAM works (I can run the large FreeCalypso firmware entirely from RAM without flashing), and the flash works in that I can erase, program and verify images in both banks of the flash - it is organized as two chip select banks of 8 MiB each. However, some strange problems happen when booting FreeCalypso fw that has been flashed - I will need to hook up JTAG (and exercise that hardware path) in order to debug it further. I am guessing that this problem affects only FreeCalypso and not OsmocomBB, as it is my understanding that you guys have no interest in producing firmware that runs fully on the baseband processor, instead of an attached PC host, and for the purpose of running your teensy-tiny L1 you don't need any flash or external RAM at all. (Sure, one can build a flashable version of this little L1, but what is the point of doing so if you still need to run osmocon in order to talk to it?) * TI's TCS211 firmware for the Calypso (the basis for FreeCalypso) expects per-unit RF calibration to be performed on the production line, and the VCXO calibration appears to be the most critical step: if I delete the VCXO calibration files on an Openmoko-made GTA02, the modem stops working (fails to acquire FB/SB in the network search just like on my FCDEV3B), whereas all other RF calibration files can be deleted and it still works. Hence I reason that the lack of this VCXO calibration is the cause of my current inability to connect to the network from my board using my preferred firmware. Now here is the part I don't understand: how are you able to get away with not requiring RF calibration in OsmocomBB? As I understand it, the requirement that each individual GSM MS unit must be RF-calibrated in production was not specific to TI Calypso, but is a general industry-wide requirement, or at least was in that time period. Per-unit calibration adds to the production test time, time is money, and the calibration equipment (R&S CMU200 is the industry gold standard) is not cheap either - so there is a non-trivial cost to this calibration requirement. So I figure that there must have been some good reason for TI and other mainstream GSM MS chipset manufacturers to require per-unit RF calibration - if they could have dispensed away with this calibration requirement like you did in OsmocomBB, they surely would have done it. So where is the catch? There must be some good reason why TI's TCS211 fw requires VCXO calibration, and when the fw is redesigned to not require such calibration as you seem to have done in OsmocomBB, something else (something important probably) must be sacrificed. So what is the good reason for requiring accurate VCXO calibration, and what is sacrificed when one cheats on this requirement like you seem to be doing? Viva La Revolucion, Mychaela aka Spacefalcon the Outlaw

3 3

Re: Connecting OsmocomBB to OpenBTS
by Vadim Yanitskiy 01 Apr '17

01 Apr '17

Hi, > I'm guessing I would need to perform surgery on OSMOCOM-BB code in order to > connect it to another network? Is there any in built feature that would > allow me to do so directly? As I understand, you want to connect the network you running yourself on OpenBTS. There are two modes of network selection: manual and automatic (when MCC/MNC from SIM card are used). Have a look at the 'network-selection-mode' in your config file (~/.osmocom/bb/mobile.cfg). Also, have a look at the 'network' command in VTY. You can also create a virtual SIM card in your ~/.osmocom/bb/mobile.cfg (look at the 'test-sim' section) with desired IMSI and RPLMN (001 / 01 by default). Then you will be able to attach one using the 'sim testcard 1'. With best regards, Vadim Yanitskiy.

2 1

Re: ARM Core and UI
by Vadim Yanitskiy 29 Mar '17

29 Mar '17

Hi Anton, Feel free to watch OsmocomBB related talks, such as: https://youtu.be/ihbRtTzc0NI https://youtu.be/H7rNKZdASBE You'll wind a lot of useful information. Good luck! With best regards, Vadim Yanitskiy.

1 0

OsmocomBB MNCC socket implementation without LCR
by Gerard Pinto 29 Mar '17

29 Mar '17

Greetings, I have been working with Layer23 stack of OsmocomBB since a couple of months. I decided to try MNCC socket interface without LCR (I'm aware there is an implementation embedded in LCR gsm-ms). I reverse engineered and wrote a simple C application taking mncc.h. Problem: I'm unable to make a call on live network, although it does channel allocation, ciphering etc. Flow: 1. Create MNCC struct and write on to the osmocomBB socket 2. OsmocomBB parses it well and request for channel, ciphering mode, init MM, sending SETUP etc works great. 3. However, in response to step.2 after sending SETUP it returns with (ms 1) Received 'RELEASE_COMPL' in CC state INITIATED. Why does it release CC? 4. I further debugged, the reason for release is in fn. gsm48_cc_rx_release_compl in (gsm8_cc.c) it says mncc-cause = *GSM48_IE_CAUSE*. with no description. I really don't know whats causing this issue. Any help would be much appreciated. Or It would be very kind if someone could guide me. My mncc socket create code: struct gsm_mncc *mncc; int i = 0; int call_ref = new_callref++; mncc = create_mncc(MNCC_SETUP_REQ, call_ref); if (!strncasecmp(number, "emerg", 5)) { printf("Make emergency call\n"); mncc->emergency = 1; } else { printf("make call to %s\n", number); mncc->fields |= MNCC_F_CALLED; if(number[0] == '+') { number++; mncc->called.type = 1; /*international*/ } else { mncc->called.type = 0; /*auto-unknown -prefix must be used*/ } mncc->called.plan = 1; strncpy(mncc->called.number, number, sizeof(mncc->called.number) - 1); printf("Calling number %s\n", mncc->called.number); /* bearer capability (mandatory) */ mncc->fields |= MNCC_F_BEARER_CAP; mncc->bearer_cap.coding = 0; mncc->bearer_cap.speech_ctm = 0; mncc->bearer_cap.radio = 3; /** Support TCH/H also*/ /** Supported rates **/ mncc->bearer_cap.speech_ver[i++] = 2; /* support full rate v2 */ mncc->bearer_cap.speech_ver[i++] = 0; /* support full rate v1 */ mncc->bearer_cap.speech_ver[i++] = 1; /* support half rate v2 */ mncc->bearer_cap.speech_ver[i] = -1; /* end of list */ /** END **/ mncc->bearer_cap.transfer = 0; mncc->bearer_cap.mode = 0; /* CC capabilities (optional) DTMF */ mncc->fields |= MNCC_F_CCCAP; mncc->cccap.dtmf = 1; mncc->fields |= MNCC_F_CCCAP; mncc->clir.inv = 1; mncc->clir.sup = 1; } return send_and_free_mncc(mncc->msg_type, mncc); Looking forward to the reply, Thanks, Gerard -- View this message in context: http://baseband-devel.722152.n3.nabble.com/OsmocomBB-MNCC-socket-implementa… Sent from the baseband-devel mailing list archive at Nabble.com.

3 8

ARM Core and UI
by Anton Gorbachev 29 Mar '17

29 Mar '17

Dear Osmocom members, I am new in OsmocomBB but trying to understand how all the stuff works. And I have a question. As I understood we have DigitalBB Calypso in our Motorola phones which consist of DSP and ARM Cores. If we are talking about "normal" phone firmware, In DSP L1 processing is done, in ARM core L2 and L3 processing of GSM stack is done. But we must also have some "regular" OS somewhere, am I right? So I mean all the menus, applications like "Settings", "Phone book", etc. In modern phones, I believe Adnroid or iOS communicate with some RTOS running in ARM core of DigitalBB. But what is about Motorola phone? Does it have separate ARM processor/RAM for a refular firmware? Did you create some applications for ARM part of DigitalBB and some applications for UI which run outside the RTOS? It's possible that I am confusing with all the terms but I would appreciate if you help me to understand. Kind regards, Anton

2 1

Connecting OSMOCOM to OpenBTS
by Usama Muneeb 26 Mar '17

26 Mar '17

I recently set up OpenBTS which is working perfectly. I can make a test call by calling 2600 using an Android phone. However when I try "show subscriber" in OSMOCOM, various BTS are listed, with their MNC and MCC values but OpenBTS is not listed. Any solution to this? P.S. I've determined the MNC and MCC values for OpenBTS which are 001 and 01 respectively.

3 3

git.osmocom.org cgit improvements
by Harald Welte 20 Mar '17

20 Mar '17

Hi all, today I've deployed some cgit improvements on https://git.osmocom.org/, in the hope that it makes this tool even more useful: 1) syntax highlighting of source code (requested by Hoernchen) The source code is now highlighted by pygments. I don't really understand why somebody would want to look at source code a lot in a browser, but well, it was as easy as to enable the existing pygments based filter plugin. 2) rendering of "about" page from README.md As you might have noticed, I've introduced a README.md in a number of repositoires, and cgit is now rendering an about page for every repository, e.g. at http://git.osmocom.org/libosmo-abis/about/ 3) gerrit change-ID hyperlink generation All gerrit Change-IDs in commit messages are now automatically converted to hyperlinks to the respective gerrit change, see e.g. the below example: http://git.osmocom.org/openbsc/commit/?id=6dd0fc685b7149f67a5fe17a5bce55c44… Please note that this works for the "Change-Id" line of the actual change, but also for change-ids in the free text (e.g. "this depends on change-id ... in libosmocore") 4) Osmocom ticket/issue hyperlink generation Any Line that matches the "^((Relate|Close|Fixe)[ds]):" prefix is scanned for occurrences of "OS#(\d+)" which are then amended with hyperlinks to the respective issue on osmocom.org Please note the OS# prefix is mandatory, so things like "OS#1614, 1615" will not work, as can be seen at http://git.osmocom.org/osmo-pcu/commit/?id=0a8fae8d141c2cfa4387ffe9b35402d5… Please format your commit messages accordingly. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

3 3

Complexity of emergency-only baseband development
by Denver Gingerich 13 Mar '17

13 Mar '17

Hi everyone, I'm building some FOSS tools that let people send/receive calls/SMS without a cell plan (mainly using VoIP carriers that also offer SMS/MMS). Eventually I would like to be able to bundle these tools with a phone that runs only free software. In order to still provide standard emergency calling features (112/999/911 calling/SMS), the phone would require a free baseband (like OsmocomBB), but it would not need to offer any non-emergency phone features, since those would be handled by the aforementioned FOSS tools primarily on wifi. As I understand it, OsmocomBB can currently be run on certain Calypso-based phones, but does require a larger computer be connected to run part of the baseband. If one were to only require emergency calling features in OsmocomBB, would that larger computer still be required? If so, would developing the remaining pieces needed to run directly on the phone be substantially easier for an emergency-only use case than for a complete all-purpose use case? I'm guessing that there are certain parts of OsmocomBB that would not be required for emergency-only operation (perhaps some of the SIM card communication, for example), but I haven't written baseband software before so I don't have a good sense of how large the differences would be. So I'd be curious to know if the emergency-only use case is substantially easier to develop for, or if it's roughly the same complexity as developing for the all-purpose use case, or somewhere in between. My apologies if this isn't the right list for such questions; I'm happy to post elsewhere if that is more appropriate. Thanks for reading! Denver http://soprani.ca/

3 2

Quectel modem documentation etc
by Fisher Grubb 10 Mar '17

10 Mar '17

Hi all, I know of some publicly available documentation and tools. I assume you have it, let me know if you don't and I'll post links. I downloaded it last year for UC20 (124MB zip file),and EC21 (60MB zip file). Fisher

1 0

Re: Virtual layer 1 - Questions
by Harald Welte 03 Mar '17

03 Mar '17

Hi Sebastian, On Sun, Feb 12, 2017 at 02:29:05PM +0100, Sebastian Stumpf wrote: > The virtual layer 1 is currently in a state where the l23 app can > successfully connect to the bts and most of the signaling messages > will be forwarded and handled. TCH is not yet implemented. this is excellent news! Thanks for sticking with this and pushing it forward. > - Trying to initiate a call via the mobile vty will result in > VTY: > call 1 123 > OsmocomBB# > % (MS 1) > % Call has been rejected > call 1 123 > OsmocomBB# > % (MS 1) > % Call has been released > And no actual call setup message is transfered over the Um interface. > What could be reasons for that? I am using the test-sim option the > mobile app offers. I'm not sure if this is the root cause, but it seems there is some timeslot mis-matches in your traces. The Immediate Assignment contains TS 2 or TS 7, but I see Uplink frames for FACH on TS0, which is impossible (TS0 never has a channel combination with FACCH). Also, The uplink frames don't have the Uplink bit set in the GSMTAP header. This is a bit confusing, and I think it would be a good idea to introduce some consistency/invariant checking on both sides, i.e. the BTS should drop all non-uplink frames received, and the MS should drop all uplink frames received. I'm also surprised to see you're seeing an immediate assignment reject in downlink. This should only happen if all channels are allocated and the BTS is out of resources. Also, in your traces, there are typically several frames that are on the same timeslot in the same GSM frame number. This is not possible (probably related to the wrong TS above?). At maximum, there can be one L2 signalling message for a given TS + FN. Also, on the real radio interface a MAC block takes typically four frames on that channel, so the actual rate is lower. > - Occasionaly the T3210 timer is fired, which causes a new registering > within the network. well, it means that something got lost between MS and MSC for such a long time (between sending the LU REQ and receving a response) that the MS gives up. > LOG: > gsm48_mm.c:336 timer T3210 (loc. upd. timeout) has fired > How can i prevent that? The underlying problem must be resolved. On the simulated L1 you shouldn't loose messages, so this shouldn't happen if all messages arrive as expected on both sides. > - I did not implement a tdma or multiframe scheduler in the mobile > uplink as the logical channel is directly put to the gsmtap-header and > thus known by the bts. As Harald used a multiframe based scheduling > for the bts downlink, i wonder if this might be necessary, though. To > submit msgs with the correct frame number for example. It is primarily a question of how real the simulation should be. By using a multiframe scheduler one can make sure that the actual bandwidth/speed of GSM is maintained even over a virtual L1. Also, on the BTS side it must be present to schedule the BCCH (system information, ...) without which a MS would never even see the cell. I think one can do without on the MS side, but then the BTS must basically queue the incoming frames until the respective frame number indicated in the frame matches the current frame number. > - In my wireshark capture files, the gsmtap messages sent over the > multicast sockets are only recognized as UDP messages. I have to > "cast" them with the wireshark context menu "Decode as...". Why? This seems because you're using a non-standard port for the messages: In the capture I see UDP port 6666 rather than the IANA-registered port for GSMTAP which is 4729. > I would be super happy if someone of you could check out my project > (osmo-bts, branch stumpf/virt-phy + osmocom-bb, branch > stumpf/virt-phy) try to run it with the config files lying within the > project folders and tell me the problems they see :). I'll have a look, but not straight away now, sorry. > Here you can find a wireshark capture file of 2 mobiles connecting to > a virt bts. I also tried to init calls from both of them but the call > setup is not send. Already the LU is not working stable, so I think the first step is to stabilize this. You can see in packet 740 that the MS is sneding a LU Req, which the BTS forwards in frame 741 as RSL message to the NITB. The NITB then responds with an IDENTITY REQUEST which can be seen on RSL but which seems to disappear in the BTS without being ever sent on the virtual Um interface. As a result, the MS never sends the identity response, and the NITB will give up. I also see that the RACH requesets all are sent with a bogus frame number: 42. This will not work. The RACH request needs to be sent with the current frame number at the time being. Also, RACH retransmissions are happening way too quick. See Packets 600...644 where there are 7 RACH requests all within soemething like 10ms. The BTS then allocates 7 channels rather than one, ... So I think those lower-layer issues should be addressed before moving on to voice calls. Keep up the good work! Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

2 6

Re: Flashing Problem: C117
by Craig Comstock 18 Feb '17

18 Feb '17

You know that generally flashing the phone isn't needed. You can load all of the different osmocom images just with the osmocon loader into ram and "do things". The flashing can brick your device. Just my $0.02, Craig -------------------------------------------- On Sat, 2/18/17, Dennis Schneck <dennisschneck(a)web.de> wrote: Subject: Flashing Problem: C117 To: baseband-devel(a)lists.osmocom.org Date: Saturday, February 18, 2017, 2:44 AM Hello, i try to Flash a Motorola C117. But did not work ... what did i wrong ? $ sudo host/osmocon/osmocon -p /dev/ttyUSB0 -m c123xor target/firmware/board/compal_e88/loader.compalram.bin got 1 bytes from modem, data looks like: 00 . got 2 bytes from modem, data looks like: 00 00 .. got 4 bytes from modem, data looks like: 1b f6 02 00 .... got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD read_file(target/firmware/board/compal_e88/loader.compalram.bin): file_size=27072, hdr_len=4, dnload_len=27079 got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 43 C Received PROMPT2 from phone, starting download handle_write(): 4096 bytes (4096/27079) handle_write(): 4096 bytes (8192/27079) handle_write(): 4096 bytes (12288/27079) handle_write(): 4096 bytes (16384/27079) handle_write(): 4096 bytes (20480/27079) handle_write(): 4096 bytes (24576/27079) handle_write(): 2503 bytes (27079/27079) handle_write(): finished got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 03 . got 1 bytes from modem, data looks like: 42 B Received DOWNLOAD ACK from phone, your code is running now! Received DOWNLOAD ACK from phone, your code is running now! battery_compal_e88_init: starting up OsmocomBB Loader (revision osmocon_v0.0.0-1773-g0cdf4b0-modified) ====================================================================== Running on compal_e88 in environment compalram $ sudo host/osmocon/osmoload memdump 0x000000 0x2000 compal_loader.bin [sudo] password for builder: Dumping 8192 bytes of memory at 0x0 to file compal_loader.bin ...................................done. builder@buildervm:~/build/osmocom-bb/src$ sudo host/osmocon/osmoload funlock 0x010000 0x10000 Unlocking 65536 bytes of flash at 0x10000 requesting flash info to determine block layout chip 0 at 0x00000000 of 2097152 bytes in 2 regions region 0 with 31 blocks of 65536 bytes each block 0 with 65536 bytes at 0x00000000 on chip 0 block 1 with 65536 bytes at 0x00010000 on chip 0 block 2 with 65536 bytes at 0x00020000 on chip 0 block 3 with 65536 bytes at 0x00030000 on chip 0 block 4 with 65536 bytes at 0x00040000 on chip 0 block 5 with 65536 bytes at 0x00050000 on chip 0 block 6 with 65536 bytes at 0x00060000 on chip 0 block 7 with 65536 bytes at 0x00070000 on chip 0 block 8 with 65536 bytes at 0x00080000 on chip 0 block 9 with 65536 bytes at 0x00090000 on chip 0 block 10 with 65536 bytes at 0x000a0000 on chip 0 block 11 with 65536 bytes at 0x000b0000 on chip 0 block 12 with 65536 bytes at 0x000c0000 on chip 0 block 13 with 65536 bytes at 0x000d0000 on chip 0 block 14 with 65536 bytes at 0x000e0000 on chip 0 block 15 with 65536 bytes at 0x000f0000 on chip 0 block 16 with 65536 bytes at 0x00100000 on chip 0 block 17 with 65536 bytes at 0x00110000 on chip 0 block 18 with 65536 bytes at 0x00120000 on chip 0 block 19 with 65536 bytes at 0x00130000 on chip 0 block 20 with 65536 bytes at 0x00140000 on chip 0 block 21 with 65536 bytes at 0x00150000 on chip 0 block 22 with 65536 bytes at 0x00160000 on chip 0 block 23 with 65536 bytes at 0x00170000 on chip 0 block 24 with 65536 bytes at 0x00180000 on chip 0 block 25 with 65536 bytes at 0x00190000 on chip 0 block 26 with 65536 bytes at 0x001a0000 on chip 0 block 27 with 65536 bytes at 0x001b0000 on chip 0 block 28 with 65536 bytes at 0x001c0000 on chip 0 block 29 with 65536 bytes at 0x001d0000 on chip 0 block 30 with 65536 bytes at 0x001e0000 on chip 0 region 1 with 8 blocks of 8192 bytes each block 31 with 8192 bytes at 0x001f0000 on chip 0 block 32 with 8192 bytes at 0x001f2000 on chip 0 block 33 with 8192 bytes at 0x001f4000 on chip 0 block 34 with 8192 bytes at 0x001f6000 on chip 0 block 35 with 8192 bytes at 0x001f8000 on chip 0 block 36 with 8192 bytes at 0x001fa000 on chip 0 block 37 with 8192 bytes at 0x001fc000 on chip 0 block 38 with 8192 bytes at 0x001fe000 on chip 0 confirmed operation on chip 0 address 0x00010000, status FAILED operation done Thanks

1 0

Flashing Problem: target/firmware/board/compal_e88/menu.e88loader.bin mssing
by Dennis Schneck 18 Feb '17

18 Feb '17

1 0

Flashing Problem: C117 - additional info
by Dennis Schneck 18 Feb '17

18 Feb '17

1 1

Flashing Problem: C117
by Dennis Schneck 18 Feb '17

18 Feb '17

1 0

Motorola C117 - Is compal E87 ?
by Dennis Schneck 17 Feb '17

17 Feb '17

2 2

Aw: Re: Re: Compile error - osmocom-bb | No package 'libosmocore' found but libosmocore is installed
by Dennis Schneck 17 Feb '17

17 Feb '17

2 3

Aw: Re: Compile error - osmocom-bb | No package 'libosmocore' found but libosmocore is installed
by Dennis Schneck 15 Feb '17

15 Feb '17

2 1

Compile error - osmocom-bb | No package 'libosmocore' found but libosmocore is installed
by Dennis Schneck 15 Feb '17

15 Feb '17

Hello, I am suing Manjaro Linux (Arch Linux based) and do not get the osmocom-bb compiled. git clone https://github.com/osmocom/osmocom-bb cd osmocom-bb/src make .... .... checking pkg-config is at least version 0.9.0... yes checking for LIBOSMOCORE... no configure: error: Package requirements (libosmocore) were not met: No package 'libosmocore' found Consider adjusting the PKG_CONFIG_PATH environment variable if you installed software in a non-standard prefix. Alternatively, you may set the environment variables LIBOSMOCORE_CFLAGS and LIBOSMOCORE_LIBS to avoid the need to call pkg-config. See the pkg-config man page for more details. make: *** [Makefile:69: host/layer23/Makefile] Fehler 1 but libosmocore is compiled and installed ( /usr/local ) $ ls -la /usr/local/include/osmocom/ insgesamt 40 drwxr-xr-x 10 root root 4096 12. Feb 06:45 . drwxr-xr-x 3 root root 4096 12. Feb 06:45 .. drwxr-xr-x 2 root root 4096 12. Feb 06:45 codec drwxr-xr-x 2 root root 4096 12. Feb 06:45 core drwxr-xr-x 2 root root 4096 12. Feb 06:45 crypt drwxr-xr-x 2 root root 4096 12. Feb 06:45 ctrl drwxr-xr-x 3 root root 4096 12. Feb 06:45 gprs drwxr-xr-x 3 root root 4096 12. Feb 06:45 gsm drwxr-xr-x 2 root root 4096 12. Feb 06:45 sim drwxr-xr-x 2 root root 4096 12. Feb 06:45 vty $ ls -la /usr/local/lib/ insgesamt 3408 drwxr-xr-x 3 root root 4096 12. Feb 06:45 . drwxr-xr-x 11 root root 4096 16. Feb 2015 .. -rwxr-xr-x 1 root root 981 12. Feb 06:45 libosmocodec.la lrwxrwxrwx 1 root root 21 12. Feb 06:45 libosmocodec.so -> libosmocodec.so.0.0.0 lrwxrwxrwx 1 root root 21 12. Feb 06:45 libosmocodec.so.0 -> libosmocodec.so.0.0.0 -rwxr-xr-x 1 root root 26968 12. Feb 06:45 libosmocodec.so.0.0.0 -rwxr-xr-x 1 root root 945 12. Feb 06:45 libosmocore.la lrwxrwxrwx 1 root root 20 12. Feb 06:45 libosmocore.so -> libosmocore.so.8.0.0 lrwxrwxrwx 1 root root 20 12. Feb 06:45 libosmocore.so.8 -> libosmocore.so.8.0.0 -rwxr-xr-x 1 root root 441216 12. Feb 06:45 libosmocore.so.8.0.0 -rwxr-xr-x 1 root root 1033 12. Feb 06:45 libosmoctrl.la lrwxrwxrwx 1 root root 20 12. Feb 06:45 libosmoctrl.so -> libosmoctrl.so.0.0.0 lrwxrwxrwx 1 root root 20 12. Feb 06:45 libosmoctrl.so.0 -> libosmoctrl.so.0.0.0 -rwxr-xr-x 1 root root 100072 12. Feb 06:45 libosmoctrl.so.0.0.0 -rwxr-xr-x 1 root root 1021 12. Feb 06:45 libosmogb.la lrwxrwxrwx 1 root root 18 12. Feb 06:45 libosmogb.so -> libosmogb.so.4.0.0 lrwxrwxrwx 1 root root 18 12. Feb 06:45 libosmogb.so.4 -> libosmogb.so.4.0.0 -rwxr-xr-x 1 root root 430400 12. Feb 06:45 libosmogb.so.4.0.0 -rwxr-xr-x 1 root root 969 12. Feb 06:45 libosmogsm.la lrwxrwxrwx 1 root root 19 12. Feb 06:45 libosmogsm.so -> libosmogsm.so.6.1.0 lrwxrwxrwx 1 root root 19 12. Feb 06:45 libosmogsm.so.6 -> libosmogsm.so.6.1.0 -rwxr-xr-x 1 root root 957032 12. Feb 06:45 libosmogsm.so.6.1.0 -rwxr-xr-x 1 root root 1018 12. Feb 06:45 libosmosim.la lrwxrwxrwx 1 root root 19 12. Feb 06:45 libosmosim.so -> libosmosim.so.0.0.0 lrwxrwxrwx 1 root root 19 12. Feb 06:45 libosmosim.so.0 -> libosmosim.so.0.0.0 -rwxr-xr-x 1 root root 175416 12. Feb 06:45 libosmosim.so.0.0.0 -rwxr-xr-x 1 root root 969 12. Feb 06:45 libosmovty.la lrwxrwxrwx 1 root root 19 12. Feb 06:45 libosmovty.so -> libosmovty.so.3.0.0 lrwxrwxrwx 1 root root 19 12. Feb 06:45 libosmovty.so.3 -> libosmovty.so.3.0.0 -rwxr-xr-x 1 root root 378280 12. Feb 06:45 libosmovty.so.3.0.0 -rw-r--r-- 1 root root 578174 6. Jan 2016 libphysfs.a lrwxrwxrwx 1 root root 14 6. Jan 2016 libphysfs.so -> libphysfs.so.1 lrwxrwxrwx 1 root root 18 6. Jan 2016 libphysfs.so.1 -> libphysfs.so.2.0.3 -rwxr-xr-x 1 root root 340504 6. Jan 2016 libphysfs.so.2.0.3 $ pacman -Ss arm- community/arm-none-eabi-binutils 2.27-2 [Installiert] A set of programs to assemble and manipulate binary and object files for the ARM EABI (bare-metal) target community/arm-none-eabi-gcc 6.3.0-1 [Installiert] The GNU Compiler Collection - cross compiler for ARM EABI (bare-metal) target community/arm-none-eabi-gdb 7.12-3 [Installiert] The GNU Debugger for the ARM EABI (bare-metal) target community/arm-none-eabi-newlib 2.5.0-1 [Installiert] A C standard library implementation intended for use on embedded systems (ARM bare metal) What did i wrong ? Thanks

1 0

Re: Why not have the “sim spoof MS” command in now OSMOCOM-BB
by Etraud 11 Feb '17

11 Feb '17

Hi! Which branch was that code in? Thank you. -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Why-not-have-the-sim-spoof-MS-co… Sent from the baseband-devel mailing list archive at Nabble.com.

1 0

Downtime due FreeBSD upgrade.
by Holger Freyther 05 Feb '17

05 Feb '17

Hi, the machine hosting most of *.osmocom.org is running FreeBSD9.3 which EOLed end of december and I would like to upgrade to FreeBSD10.3. I do not expect many problems but I also don't want to interfere with other peoples work. Even if it is short notice, any objections for Saturday->Sunday night of a European timezone? Otherwise I would pick next Friday->Saturday. regards holger

2 2

osmocom-BB
by salar007 16 Jan '17

16 Jan '17

Hi all, 1) Is it possible to increase the number of phones from two to three or more phones as TS in osmocom-BB? plz answer just this question. I strongly need it's answer, if NOT I STOP my working.. 2) what's this ERROR : "DSP Error Status: 24" thank you. -- View this message in context: http://baseband-devel.722152.n3.nabble.com/osmocom-BB-tp4026767.html Sent from the baseband-devel mailing list archive at Nabble.com.

3 2

Contribute to Osmocom and receive a free 3.5G femtocell
by Harald Welte 09 Jan '17

09 Jan '17

Dear all, not everyone might have seen the news item that was posted in late December on our website at http://osmocom.org/news/62 I'm looking forward to receiving your proposal on how you would contribute to the Osmocom project if you were to receive one of those free 3.5G femtocells. Quote of the news item below: ------ So please excuse me to cross-post this over several Osmocom project mailing lists. I know that a number of people have either hacked on femtocells in the past, or at least expressed interest in doing so... Osmocom's support for 2G/GSM is mature and widespread. Since 2016, we're taking on the next level: 3G/3.5G. The key to running your own 3G network is to obtain actual 3G cell hardware -- here is an exciting opportunity to get started: No less than 50 femtocells will be given away for free by sysmocom, one of the main drivers of the Osmocom project. To receive a free 3G femtocell, tell us how you will help the Osmocom project drive 3.5G forward if you had one, before the end of January 2017. This marks the launch of the 3.5G Acceleration Project, backed by the Osmocom community. Join us! Find further details on the 3.5G Acceleration Project and receiving your own 3G femtocell for free at https://sysmocom.de/downloads/accelerate_3g5_cfp.pdf. ------ Best regards and happy hacking, Harald Welte -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

Moving from trac to a single redmine
by Holger Freyther 28 Dec '16

28 Dec '16

Hi guys, I think some of us would like to move to redmine and start using public tickets more frequently. So in case we move there are some topics to be discussed and I would like to start with a couple of them right now. Tickets: Redmine has a global linear sequence of ticket numbers. If we move from many tracs to a single redmine we can either: * not import tickets * only import from one project * deal with changing ticket numbers In terms of installations the GMR trac is broken in regard to tickets, there are some for SDR that are probably not being fixed anytime soon, baseband might be relevant and OpenBSC is unlikely to be relevant. I don't think we have ever used ticket reference in OpenBSC commit messages so in terms of OpenBSC having changing ticket numbers would not be a big deal. E.g. we could add a custom field with the old trac number? Wiki: We have external references that should be redirected to the new place. Is there any way besides maintaining a list in the apache2/nginx configuration and making redirects as we find broken references? Can we proactively manage this? Is anybody willing to come up with a script and nginx configuration for doing this? kind regards holger

8 26

More phones through Transceiver
by salar007 18 Dec '16

18 Dec '16

Hi all, I've a question about transceiver module in osmocomBB.. I'm gonna to increase the number of TS as the number of connected phones.. now I'll be able to sync 2 phones but in order to have more TS => more traffic channel , I should be able to sync more phones as TS , how can I? plz help me.. tanx. -- View this message in context: http://baseband-devel.722152.n3.nabble.com/More-phones-through-Transceiver-… Sent from the baseband-devel mailing list archive at Nabble.com.

1 0

Calypso BTS: my phone my phone doesn't see my base station
by phreaker1983 15 Dec '16

15 Dec '16

hi guys, my phone doesn't see my base station.. To start I used : 1. First terminal: ~/osmocombb/trx/src# sudo host/osmocon/osmocon -m c123xor -p /dev/ttyUSB0 -c target/firmware/board/compal_e88/trx.highram.bin -r 99 2. Second terminal: ~/osmocombb/trx/src/host/layer23/src/transceiver# sudo ./transceiver -a 40 -r 99 Then I showed <0012> l1ctl.c:383 Reset received: Starting sync. <0012> l1ctl.c:338 Sync acquired, setting BTS mode ... <0011> trx.c:194 TRX CLK Indication 1890062 <0011> trx.c:194 TRX CLK Indication 1890113 <0011> trx.c:194 TRX CLK Indication 1890164 <0011> trx.c:194 TRX CLK Indicatn 1890215 ........ 3. third terminal: osmo-nitb -c ~/.osmocom/open-bsc.cfg -l ~/.osmocom/hlr.sqlite3 -P -C —debug=DRLL:DCC:DMM:DRR:DRSL:DNM DB: Database initialized. DB: Database prepared. My open-bsc.cfg contains: ! OpenBSC configuration saved from vty ! ! password foo ! line vty no login ! e1_input e1_line 0 driver ipa network network country code 1 mobile network code 1 short name OpenBSC long name OpenBSC auth policy closed location updating reject cause 13 encryption a5 0 neci 1 rrlp mode none mm info 1 handover 0 handover window rxlev averaging 10 handover window rxqual averaging 1 handover window rxlev neighbor averaging 10 handover power budget interval 6 handover power budget hysteresis 3 handover maximum distance 9999 timer t3101 10 timer t3103 0 timer t3105 0 timer t3107 0 timer t3109 4 timer t3111 0 timer t3113 60 timer t3115 0 timer t3117 0 timer t3119 0 timer t3141 0 bts 0 type sysmobts band DCS1800 cell_identity 0 location_area_code 1 training_sequence_code 7 base_station_id_code 63 ms max power 15 cell reselection hysteresis 4 rxlev access min 0 channel allocator ascending rach tx integer 9 rach max transmission 7 ip.access unit_id 1801 0 oml ip.access stream_id 255 line 0 gprs mode none trx 0 rf_locked 0 arfcn 514 nominal power 23 max_power_red 20 rsl e1 tei 0 timeslot 0 phys_chan_config CCCH+SDCCH4 timeslot 1 phys_chan_config SDCCH8 timeslot 2 phys_chan_config TCH/F timeslot 3 phys_chan_config TCH/F timeslot 4 phys_chan_config TCH/F timeslot 5 phys_chan_config TCH/F timeslot 6 phys_chan_config TCH/F timeslot 7 phys_chan_config TCH/F arfcn I chose the 514..... 4. fourth terminal: cd /osmocombb/osmo-bts/src/osmo-bts-trx osmo-bts-trx -c ~/.osmocom/osmo-bts.cfg showed me: ((*)) | / \ OsmoBTS <0017> control_if.c:693 CTRL at 127.0.0.1 4238 <0010> telnet_interface.c:95 telnet at 127.0.0.1 4241 <0012> input/ipaccess.c:881 enabling ipaccess BTS mode <0006> phy_link.c:58 PHY link state change shutdown -> connectiong <0006> scheduler.c:174 Init scheduler for trx=0 <000b> trx_if.c:584 Open transceiver for phy0.0 <0006> phy_link.c:58 PHY link state change connectiong -> connected <0006> phy_link.c:68 trx_set_avail(1) <0006> scheduler_trx.c:1514 GSM clock skew: old fn=0, new fn=1908169 <0006> scheduler_trx.c:1519 GSM clock jitter: -691 <0006> scheduler_trx.c:1519 GSM clock jitter: 128 <0006> scheduler_trx.c:1519 GSM clock jitter: 674 <0006> scheduler_trx.c:1519 GSM clock jitter: 204 <0006> scheduler_trx.c:1519 GSM clock jitter: 467 <0006> scheduler_trx.c:1519 GSM clock jitter: -1620 <0006> scheduler_trx.c:1519 GSM clock jitter: 1362 <0006> scheduler_trx.c:1519 GSM clock jitter: -668 <0006> scheduler_trx.c:1519 GSM clock jitter: -846 <0006> scheduler_trx.c:1519 GSM clock jitter: 519 <0006> scheduler_trx.c:1519 GSM clock jitter: 457 <0006> scheduler_trx.c:1519 GSM clock jitter: 384 <0006> scheduler_trx.c:1519 GSM clock jitter: 218 ..... My osmo-bts.cfg contains: !OsmoBTS (0.0.1.100-0455) configuration saved from vty !! ! phy 0 instance 0 bts 0 band DCS1800 ipa unit-id 1801 0 oml remote-ip 192.168.100.11 trx 0 phy 0 instance 0 Where I erred? Thank you. -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Calypso-BTS-my-phone-my-phone-do… Sent from the baseband-devel mailing list archive at Nabble.com.

3 4

Re: Calypso BTS
by Holger Freyther 12 Dec '16

12 Dec '16

> On 12 Dec 2016, at 18:13, ak-74*** ... <87078838964(a)mail.ru> wrote: > > root@osmocombb-VirtualBox:~# osmo-nitb -c ~/.osmocom/open-bsc.cfg -l ~/.osmocom/hlr.sqlite3 -P -C —debug=DRLL:DCC:DMM:DRR:DRSL:DNM > > DB: Failed to init database. Please check the option settings. > if you look at the debian/control libdbd-sqlite3 needs to be installed to run osmo-nitb. Did you install that? holger

1 0

Sniffing GPRS
by canarion 12 Dec '16

12 Dec '16

Hi, After compiling osmocom-bb and apply sylvain/burst_ind branch and gprs_multi.patch, I execute it and try to sniff gprs traffic. I loaded the layer1 into my C139 and I obtained an ARFCN code (883). When I run ccch_scan -a 883 I get the next result: opyright (C) 2010 Harald Welte <laforge(a)gnumonks.org> Contributions by Holger Hans Peter Freyther License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Failed to connect to '/tmp/osmocom_sap'. Failed during sap_open(), no SIM reader <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(1476410343) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(1207963561) <0001> app_ccch_scan.c:400 Paging1: Normal paging chan tch/f to TMSI M(0x1ad1cda) <0001> app_ccch_scan.c:403 Paging2: Normal paging chan tch/f to TMSI M(0x41ae98f9) <0001> app_ccch_scan.c:426 Paging3: Normal paging chan n/a to imsi M(214031385056117) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3306441249) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214031482053520) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214036185306441) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4207880193) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4135931713) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4214223105) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3388536385) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(134915836) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3961436929) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4229756769) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(531909) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214034185316455) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3829437761) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214033485554660) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3639403521) <0001> app_ccch_scan.c:105 SI1 received. <0001> app_ccch_scan.c:464 unknown PCH/AGCH type 0x00 <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3827744513) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(335734299) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3561969409) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4294310401) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3698994241) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3682615617) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(67866789) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4003487553) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3770351169) <0001> app_ccch_scan.c:400 Paging1: Normal paging chan tch/f to TMSI M(0x41ae98f9) <0001> app_ccch_scan.c:403 Paging2: Normal paging chan tch/f to TMSI M(0x1ad1cda) <0001> app_ccch_scan.c:426 Paging3: Normal paging chan n/a to imsi M(214031385056117) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3306441249) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214031482053520) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214036185306441) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4102036289) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4135931713) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214032485273805) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3798414145) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(134915836) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3988859137) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3735175681) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(531909) <0001> app_ccch_scan.c:248 GSM48 IMM ASS (ra=0x78, chan_nr=0x0f, HSN=24, MAIO=1, TS=7, SS=0, TSC=1) Dropping frame with 55 bit errors <000c> l1ctl.c:238 Dropping frame with 55 bit errors <000c> l1ctl.c:290 BURST IND: @(830928 = 0626/20/36) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830928 = 0626/20/36) (-110 dBm, SNR 8) <000c> l1ctl.c:290 BURST IND: @(830929 = 0626/21/37) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830929 = 0626/21/37) ( -83 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830930 = 0626/22/38) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830930 = 0626/22/38) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830931 = 0626/23/39) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830931 = 0626/23/39) ( -83 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830932 = 0626/24/40) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830932 = 0626/24/40) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830933 = 0626/25/41) (-105 dBm, SNR 8, UL, SACCH) <000c> l1ctl.c:290 BURST IND: @(830933 = 0626/25/41) (-107 dBm, SNR 5, SACCH) <000c> l1ctl.c:290 BURST IND: @(830934 = 0626/00/42) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830934 = 0626/00/42) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830935 = 0626/01/43) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830935 = 0626/01/43) ( -83 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830936 = 0626/02/44) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830936 = 0626/02/44) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830937 = 0626/03/45) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830937 = 0626/03/45) ( -89 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830938 = 0626/04/46) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830938 = 0626/04/46) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830939 = 0626/05/47) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830939 = 0626/05/47) ( -82 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830940 = 0626/06/48) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830940 = 0626/06/48) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830941 = 0626/07/49) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830941 = 0626/07/49) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830942 = 0626/08/50) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830942 = 0626/08/50) ( -86 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830943 = 0626/09/00) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830943 = 0626/09/00) ( -86 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830944 = 0626/10/01) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830944 = 0626/10/01) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830945 = 0626/11/02) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830945 = 0626/11/02) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830947 = 0626/13/04) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830947 = 0626/13/04) ( -84 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830948 = 0626/14/05) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830948 = 0626/14/05) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830949 = 0626/15/06) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830949 = 0626/15/06) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830950 = 0626/16/07) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830950 = 0626/16/07) ( -89 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830951 = 0626/17/08) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830951 = 0626/17/08) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830952 = 0626/18/09) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830952 = 0626/18/09) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830953 = 0626/19/10) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830953 = 0626/19/10) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830954 = 0626/20/11) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830954 = 0626/20/11) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830955 = 0626/21/12) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830955 = 0626/21/12) (-106 dBm, SNR 0) <000c> l1ctl.c:290 BURST IND: @(830956 = 0626/22/13) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830956 = 0626/22/13) (-107 dBm, SNR 5) <000c> l1ctl.c:290 BURST IND: @(830957 = 0626/23/14) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830957 = 0626/23/14) (-106 dBm, SNR 2) <000c> l1ctl.c:290 BURST IND: @(830958 = 0626/24/15) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830958 = 0626/24/15) (-108 dBm, SNR 1) <000c> l1ctl.c:290 BURST IND: @(830959 = 0626/25/16) (-106 dBm, SNR 2, UL, SACCH) <000c> l1ctl.c:290 BURST IND: @(830959 = 0626/25/16) (-109 dBm, SNR 5, SACCH) <000c> l1ctl.c:290 BURST IND: @(830960 = 0626/00/17) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830960 = 0626/00/17) (-108 dBm, SNR 3) <000c> l1ctl.c:290 BURST IND: @(830961 = 0626/01/18) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830961 = 0626/01/18) (-106 dBm, SNR 2) <000c> l1ctl.c:290 BURST IND: @(830962 = 0626/02/19) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830962 = 0626/02/19) (-108 dBm, SNR 3) <000c> l1ctl.c:290 BURST IND: @(830963 = 0626/03/20) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830963 = 0626/03/20) (-107 dBm, SNR 0) <000c> l1ctl.c:290 BURST IND: @(830964 = 0626/04/21) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830964 = 0626/04/21) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830965 = 0626/05/22) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830965 = 0626/05/22) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830966 = 0626/06/23) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830966 = 0626/06/23) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830967 = 0626/07/24) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830967 = 0626/07/24) ( -86 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830968 = 0626/08/25) (-107 dBm, SNR 6, UL) <000c> l1ctl.c:290 BURST IND: @(830968 = 0626/08/25) (-109 dBm, SNR 0) <000c> l1ctl.c:290 BURST IND: @(830969 = 0626/09/26) (-101 dBm, SNR 6, UL) But it stop to capture frames, seems to be left in a standby state and I don't know why that is. With gprsdecode I can see the next image in the wireshark: http://baseband-devel.722152.n3.nabble.com/file/n3712433/wireshark-capture.… If someone knows what is the problem, please tell me. Thanks in advance. Cheers, Dani -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Sniffing-GPRS-tp3712433p3712433.… Sent from the baseband-devel mailing list archive at Nabble.com.

8 12

OpenBTS the phone does not see
by phreaker1983 11 Dec '16

11 Dec '16

Hi, I installed OpenBTS 5.0 for tutorials:https://www.youtube.com/watch?v=Ja7oSyyx7zw, everything went without error , after starting the phone doesn't see my base station, what could be the problem? -- View this message in context: http://baseband-devel.722152.n3.nabble.com/OpenBTS-the-phone-does-not-see-t… Sent from the baseband-devel mailing list archive at Nabble.com.

2 1

USRP Free BULK SMS SMS device
by superben 10 Dec '16

10 Dec '16

https://youtu.be/YJ_qkJEFNcg UGS is a portable system designed to send SMS messages and data to GSM phones in a pre-defined area. Unlike existed advertisement systems UGS sends normal or flash SMS instead of broadcast messages (receipt of broadcast messages can be disabled by mobile phone user); UGS is an independent stand-alone system, which does not require any cooperation with cellular operators. UGS does not use phone numbers of mobile phones, hence there is no need in the lists of phone numbers to be obtained from various sources. Those lists are often not complete, outdated, irrelevant and costly. The UGS can be used for commercial or security purposes: Send commercial advertisements, announcements, free gift coupons, useful information or welcome messages in specific places: shopping areas, banks, restaurants, train or bus stations, exhibitions, shows, etc. Send warning messages or requests to the people in the case of emergency. Send messages with the request to contact police to potential crime witnesses in the crime areas. SMS messages can be sent: To New in the Area or To Known in the Area or To pre-defined groups or To everyone, The UGS can be installed in a fixed location or carried to the places of need in a small, hand carry suitcase. Potential users of the system are small stores, large organizations, advertisement providers, rescue services, police forces and others. System can be operated locally or remotely via the Internet. SMS sent by the system are free of charge; neither owner of the system nor mobile phone users pay for them. The system is comprised of compact Base Station Unit and notebook computer. Because of unique sophisticated algorithm implemented in the system, the UGS transmits very low power and does not interfere with existed GSM networks. User can define any phone number or name of the sender, which will appear on the screens of mobile phones. Main specifications: Frequency coverage: 850, 900, 1800, 1900 MHz Number of SMS: No limitations Number of handsets: No limitations System output: From 10mW up to 10w (adjustable) Power: 220V / 110V / 24V / 12-16V or Batteries Operation Range: 10...1500 m SMS language: All languages -- View this message in context: http://baseband-devel.722152.n3.nabble.com/USRP-Free-BULK-SMS-SMS-device-tp… Sent from the baseband-devel mailing list archive at Nabble.com.

2 1

RFC: OsmoDevCon 2017 planning
by Harald Welte 10 Dec '16

10 Dec '16

Dear Osmocom Community, [please respect the Reply-To and post all follow-up discussion to this to openbsc(a)lists.osmocom.org, so we avoid having long threads cross-posted to several mailing lists.] >From 2012 to 2016 we were running a series of small, invitation-only Osmocom Developer Conferences. Access was intentionally restricted to those community members who have demonstrated an existing track record of contribution to any of the projects under the Osmocom umbrella. This format of a small, tightly knit group of about 20 people has been successful over the years, and I have received a lot of positive feedback from past participants. On the other hand, the Osmocom project has grown in scope and diversity, and some of those projects don't have all that much relationship to each other - except being started by people from within the same group. There's the cellular communications (GSM/GPRS/EDGE/UMTS and hopefully at some point LTE) protocols which is attracting a lot of professional users. And then there's pure community projects like rtl-sdr, OsmocomBB, OsmocomGMR and many other efforts. Particularly the cellular infrastructure projects (OsmoBTS, OsmoPCU, OsmoBTS, OsmoNITB, OsmoSGSN, OpenGGSN, OsmoIuh & co) are somehow "standing out" of the othe projects in the context of having a wider user bsae, and in that user base also primarily commercial users. So I'd like to start a discussion on how to possibly change the event format to accomodate the various interests and parties. I definitely don't want to loose the "annual meeting of old friends" atmosphere, while at the same time also opening up to other interested parties. One idea would be to keep OsmoDevCon as-is and have a separate event where non-contributing/developing users / sysadmins / system integrators could also be attending. Another idea would be to split into a 'user day' and 'developer days' format. This is something the netfilter developer workshops have been using for many years, and from my limited insight quite successfully so. The "user day" is more like a traditional tech conference, with a large auditorium and talks oriented towards users / sysadmins / integrators of the software. The "developer days" are the invitation-only part, for known contributing developers only, similar to what we have at OsmoDevCon. Having both events (or both parts of an event) back-to-back has the advantage that a large number of potential speakers for the 'user day' are already present, and they don't have to travel yet another time. One could even structure it further and say we have one user day, one public 'Osmocom cellular developer day' and then the closed 'OsmoDevCon classic', maybe reduced from 4 days to 3 or even 2 days only? What is the general opinion about this? Are there people lurking on this list who would be interested in attending a public 'user day' or even 'developer day' about the Osmocom cellular projects, with presentations and workshops around topics such as running Osmocom based cellular networks? In terms of when/where, I would suggest to keep the tradition of April in Berlin/Germany. But I'm of course very happy if somebody wants to host it some place else... Regards, and looking forward to meeting you [again] in 2017, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

"Type not handled! 40" gprsdecode
by George Andguladze 21 Nov '16

21 Nov '16

Hey there, I bumped into this error when testing gprsdecode from srldabs.de When I try the sample .dat files provided from srlabs.de it works fine though. Any hints? Kind Regards George AndguladzeSenior Software EngineerBusiness Management Technology www.bmt.ge

2 1

Re: omsocombb not receiving calls
by robert 26 Oct '16

26 Oct '16

Hi, I didn’t find anything useful yet. Everything seems normal during the IMSI attach procedure (location updating request, authentication request/response, identity request/response …), I can call and send SMS normally but the phone doesn’t get paged in any way. It seems strange that no differences can be seen during the IMSI attach procedure while some sim cards do not work. On Mar 4, 2016, at 7:13 PM, Dennis Eisenbarth <dennis.eisenbarth(a)gmail.com> wrote: > GSM specs, it is. > > On 04.03.2016 17:32, robert wrote: >> >> I read about sim card types since it must be a sim card problem but I didn’t find anything useful. >> >> >> On Mar 4, 2016, at 6:05 PM, Dennis Eisenbarth <dennis.eisenbarth(a)gmail.com> wrote: >> >>> A good start would be a look into the specifications. >>> >>> >>> On 04.03.2016 14:31, robert wrote: >>>> >>>> Hi, >>>> >>>> I tried two sim cards one that works fine and another one that doesn’t get paged, I noticed that during the location update procedure everything is exactly the same (using wireshark). The log files are also similar. Although both cards work fine if used in a normal phone (even with a motorola c123/118 …). >>>> >>>> Another thing to mention is that some sim cards only work when i stick them on a BTS that has the "SI type 3, GPRS indicator" as follows: >>>> "3G Early Classmark Sending Restriction: Neither UTRAN, CDMA2000 nor GERAN IU MODE CLASSMARK CHANGE message shall be sent with the Early classmark sending" >>>> while they can only make calls without being able to receive anything on other BTS where the "SI type 3, GPRS indicator" is as follows: >>>> "3G Early Classmark Sending Restriction: The sending of UTRAN,CDMA2000 and GERAN IU MODE CLASSMARK CHANGE messages are controlled by the Early Classmark Sending Control parameter" >>>> I would be very grateful if anyone has some explanations to what is going on. >>>> >>>> >>>> >>>> Best regards, >>>> Robert, >>>> >>>> >>>> On Jan 26, 2016, at 6:30 PM, Tomcsányi Domonkos <domi(a)tomcsanyi.net> wrote: >>>> >>>>> Hi Robert, >>>>> >>>>> I think it would help us out a lot if you could provide at least one complete log file from the output of the mobile app, so we can start having some ideas. >>>>> >>>>> >>>>> Cheers, >>>>> Domi >>>>> >>>>> >>>>>> 2016. jan. 26. dátummal, 17:24 időpontban robert steve <robert.steve07(a)gmail.com> írta: >>>>>> >>>>>> Hi, >>>>>> I would first like to thank all those who participated in this nice project. >>>>>> I recently started working with osmocombb and was able to have it working fine on a motorola c118. >>>>>> However, I noticed that some sim cards can connect normally to the BTS, can make calls and send SMS but can’t receive anything. They simply don't get paged. While for some other sim cards everything seems to be working fine. >>>>>> >>>>>> Does anyone know what might be causing this issue ? >>>>>> >>>>>> thanks, >>>>>> Robert >>>>> >>>> >>> >> >

4 22

Solution to the shortage of Calypso devices
by Mychaela Falconia 20 Oct '16

20 Oct '16

Hello baseband hacking folks, I have heard several people complain that they are no longer able to find/obtain a Motorola C1xx phone or any other Calypso device for playing with OsmocomBB. I assume these complaints probably come from people in the EU and other 900/1800 MHz regions, as US band C139 phones are still readily available on ebay (63 listings as of right now, all dirt cheap), but either way, I have what I believe to be the proper solution to the shortage and the crippled nature of all pre-existing Calypso devices: a new Calypso board. Back in 2012 Harald Welte posted here saying that his company was going to be making a new Calypso board for the very same purpose of addressing the shortage and the deficiencies of pre-existing devices, but as far as I know, no such product has ever been produced - nor do I know if whoever was behind that project even got as far as creating the design for it. Fast-forwarding to the present, we now have a ready-to-build design for a Calypso development board called FCDEV3B, which stands for FreeCalypso development board, triband. It is based on a reuse of the known-working Calypso modem design from Openmoko, reuse at the level of physical PCB layout, based on the GTA02 design files which Openmoko founder Mr. Sean Moss-Pultz released in April of 2015 at my urging. Back in 2012 Harald was saying that he was only going to release PDF schematics but not the full design files for his board; I feel differently about such matters, hence the complete design files for *my* board are free to the world: ftp://ftp.freecalypso.org/pub/GSM/FreeCalypso/fcdev3b/ Now we need to get these boards physically made, and toward that end I have started a crowdfunding campaign: https://www.gofundme.com/fcdev3b-board-production-2umevjw In the interest of transparency, I have to disclose (most people know it already, but I have to state it anyway) that I do not use OsmocomBB and will never contribute to Osmocom software because I am working on my own personally preferred alternative GSM MS firmware implementation, but when it comes to the hardware I seek to build and offer to the community, there is no reason why it won't work with OsmocomBB - it should work just fine. Because my board is a derivative of Openmoko's modem design and the part that is different between Openmoko's board and mine (the flash chip - I will populate a higher-capacity chip on the same footprint) is not used by OsmocomBB software, the images currently built in board/gta0x/*.highram.bin should work as-is on my FCDEV3B without needing any code changes. Hasta la Victoria, Siempre, M~

2 2

[PATCH] adjust Makefile.mtk so that mtk-firmware works again
by Craig Comstock 15 Oct '16

15 Oct '16

--- src/target/firmware/Makefile.mtk | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/target/firmware/Makefile.mtk b/src/target/firmware/Makefile.mtk index 30fa2fc..927e31a 100644 --- a/src/target/firmware/Makefile.mtk +++ b/src/target/firmware/Makefile.mtk @@ -4,14 +4,16 @@ BOARDS?=mt62xx # List of all applications (meant to be overridden on command line) APPLICATIONS?=loader_mtk -mtkram_LDS=board/mediatek/ram.lds -mtkram_OBJS=board/mediatek/start.ram.o +APP_loader_mtk_ENVIRONMENTS=mtkram + +ENV_mtkram_LDS=board/mediatek/ram.lds +ENV_mtkram_OBJS=board/mediatek/start.ram.o mtk_COMMON_OBJS=board/mediatek/uart.o # Mediatek MT62xx -mt62xx_OBJS=$(mtk_COMMON_OBJS) board/mt62xx/init.o -mt62xx_ENVIRONMENTS=mtkram +BOARD_mt62xx_OBJS=$(mtk_COMMON_OBJS) board/mt62xx/init.o +BOARD_mt62xx_ENVIRONMENTS=mtkram # Global include path INCLUDES=-Iinclude/ -I../../../include -I../../shared/libosmocore/include -- 2.1.4

1 0

Re: nuttx-bb layout? inside or outside nuttx?
by Craig Comstock 13 Oct '16

13 Oct '16

Yes, my plan was: - get osmocom-bb (layer1/rssi) firmware working (without graphics probably) - use that work side-by-side to integrate into fernvale nuttx - create a layer1 "app" in nuttx - port "mobile" app to nuttx With the goal being that you can call/text from the nuttx shell. I have the following hardware with which to experiment: - c139 motorola phones - pirelli phone - a few other calypso phones - seeedstudio rephone (mtk6261) - sim800 of various types - several watch phones (dz09 gt08 v9, both 6260 and 6261) - raw 6260 chips which I hope to design a custom pcb for My end goal which is far too ambitious is to make a rock-like device which has no ports/holes: - bluetooth serial to nuttx shell - qi wireless charging - accelerometer gestures for basic controls - bone conducting speaker - speech synth (sam/espeak) and voice recognition (pocketsphinx) - all source is included on-device, even to the point that I would like to port all this work to a forth-like language of my own invention so you can debug, learn and experiment on the device I have so far fixed up the existing mtk-firmware target and was debating whether to submit that small patch or wait until I get some 626x work done. On that front I have the basic registers and an initial BSI power on routine written (but not tested). Thanks to all the giants upon whose shoulders I stand to do this work, Craig -------------------------------------------- On Thu, 10/13/16, Harald Welte <laforge(a)gnumonks.org> wrote: Subject: Re: nuttx-bb layout? inside or outside nuttx? To: "Craig Comstock" <craig_comstock(a)yahoo.com> Cc: "Marcin Mielczarczyk" <marcin.mielczarczyk(a)gmail.com>, "baseband-devel" <baseband-devel(a)lists.osmocom.org> Date: Thursday, October 13, 2016, 2:09 AM Hi Craig, this is just a small note that I just met Marcin Mielczarczyk (who did the existing but still incomplete MTK support work a few years back) at Embedded Linux Conf Europe, and informed him about your work. It is really exciting for both of us to see somebody picking this up and trying to bring things together. If I'm not mistaken, you basically have the following agenda: * Structure OsmocomBB in a way that it can be built 'side-by-side into Nuttx * Build /integrate it from the fernvale nuttx port that is available * Implement the bulk of the MTK L1 integration, i.e. the interface to the DSP. And afterwards hope that you have something that supports either the Fernvale, SIM800H, Linkit One, or other MTK 2G baseband chips out there. Please let me know this was an accurate understanding. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

osmocom+c118+openbts send sms
by superben 27 Aug '16

27 Aug '16

osmocom+c118+openbts send sms : youtube: https://youtu.be/r_U7DKFYuqo blog: http://gsmsuperben.blogspot.my/2016/07/osmocomc118openbts-send-sms.html First you need to successfully install osmocom： http://gsmsuperben.blogspot.my/2016/07/osmocombbc118-gsm-sniffer.html Assuming you have installed the gnu-arm-build.3.sh 1：Download and compile osmocomBB and libosmo-dsp $ git clone git://git.osmocom.org/libosmocore.git $ git clone git://git.osmocom.org/libosmo-dsp.git $ git clone git://git.osmocom.org/osmocom-bb.git $ sudo apt-get install libfftw3-dev libfftw3-doc When installing libosmocore execute ./configure many people will encounter No package 'talloc' found such a mistake , because they can not talloc, Here is the solution $ wget https://www.samba.org/ftp/talloc/talloc-2.1.7.tar.gz $ tar -zxvf talloc-2.1.7.tar.gz $ cd talloc-2.1.7/ $ ./configure $ make $ sudo make install install libosmocore $ cd libosmocore/ $ autoreconf -i $ ./configure $ make $ sudo make install $ cd .. install libosmo-dsp $ cd libosmo-dsp/ $ autoreconf -i $ ./configure $ make $ sudo make install Compile osmocombb $ cd osmocom-bb $ git checkout sylvain/testing $ cd src $ make HOST_layer23_CONFARGS=--enable-transceiver 2:Download openbts and install dependencies（The best use of root privileges） $ su $ apt-get install subversion $ svn co http://wush.net/svn/range/software/public $ sudo apt-get install autoconf libtool libosip2-dev libortp-dev libusb-1.0-0-dev g++ sqlite3 libsqlite3-dev erlang libreadline6-dev libncurses5-dev 3:install openbts $ cd pubilc $ cd a53/trunk $ make install $ cd openbts/trunk $ autoreconf -i $ ./configure $ make $ cd apps $ ln -s ../TransceiverRAD1/transceiver . $ cd .. $ sudo mkdir /etc/OpenBTS $ sudo sqlite3 -init ./apps/OpenBTS.example.sql /etc/OpenBTS/OpenBTS.db ".quit" $ sqlite3 /etc/OpenBTS/OpenBTS.db .dump $ sudo mkdir -p /var/lib/asterisk/sqlite3dir 4:install sipauthserve in pubilc $ cd subscriberRegistry/trunk $ make $ sudo sqlite3 -init subscriberRegistry.example.sql /etc/OpenBTS/sipauthserve.db ".quit" 5:install smqueue in public $ cd smqueue/trunk $ autoreconf -i $ ./configure $ make $ sudo sqlite3 -init smqueue/smqueue.example.sql /etc/OpenBTS/smqueue.db ".quit" 6:open all osmocom: $ osmocom-bb/src/host/osmocon/osmocon -p /dev/ttyUSB0 -m c123xor ../../target/firmware/board/compal_e88/trx.compalram.bin transceiver: $ osmocom-bb/src/host/layer23/src/transceiver/transceiver ARFCN smqueue: $ public/smqueue/trunk/smqueue/smqueue sipauthserve: $ public/subscriberRegistry/trunk/sipauthserve OpenBTS: $ public/openbts/trunk/apps/OpenBTS $ public/openbts/trunk/apps/OpenBTSCLI 7:Configuration openbts OpenBTSCLI $ config $ config Control.LUR.OpenRegistration .* $ config GSM.Radio.Band 900 $ config GSM.Radio.C0 YOU transceiver ARFCN $ config GSM.Identity.MCC 001 $ config GSM.Identity.MNC 01 （001 01 test） Configuration is complete, reboot your openbts 8:Mobile search and access OpenBTS 9:View tmsis OpenBTSCLI $ tmsis 10:try send sms OpenBTSCLI $ sendsms YOUTMSIS number messege -- View this message in context: http://baseband-devel.722152.n3.nabble.com/osmocom-c118-openbts-send-sms-tp… Sent from the baseband-devel mailing list archive at Nabble.com.

1 0

smocombb+c118 gsm-sniffer
by superben 27 Aug '16

27 Aug '16

osmocombb+c118 gsm-sniffer： youtube: https://youtu.be/ZDToZIYHmJM blog: http://gsmsuperben.blogspot.my/2016/07/osmocombbc118-gsm-sniffer.html System ： ubuntu12.04-i386（or kali）一：update system update（or vi /etc/apt/sources.list ） settings Inside find software update source download from modifying their own country Then save the exit now open terminal $ sudo apt-get update $ sudo apt-get upgrade 二：Then install a series of dependency $ sudo apt-get install libusb-0.1-4 libpcsclite1 libccid pcscd $ sudo apt-get install libtool shtool autoconf git-core pkg-config make gcc build-essential libgmp3-dev libmpfr-dev libx11-6 libx11-dev texinfo flex bison libncurses5 libncurses5-dbg libncurses5-dev libncursesw5 libncursesw5-dbg libncursesw5-dev zlibc zlib1g-dev libmpfr4 libmpc-dev libpcsclite-dev （copy）三：Create several directories , download ARM compiler $ mkdir osmocombb $ cd osmocombb $ mkdir build install src $ cd src $ wget ftp://sources.redhat.com/pub/newlib/newlib-1.19.0.tar.gz 四：install gnu-arm-build.3.sh $ cd .. $ chmod +x gnu-arm-build.3.sh $ ./gnu-arm-build.3.sh See here you can directly enter 五：After you install the add environment $ cd install/bin $ pwd $ vi ~/./. bashrc export PATH=$PATH:/osmocombb/ install/bin $ source ~/.bashrc 六：Download and compile osmocomBB back osmocombb download osmocom $ git clone git://git.osmocom.org/libosmocore.git $ git clone git://git.osmocom.org/osmocom-bb.git When installing libosmocore execute ./configure many people will encounter No package 'talloc' found such a mistake , because they can not talloc, Here is the solution $ wget https://www.samba.org/ftp/talloc/talloc-2.1.7.tar.gz $ tar -zxvf talloc-2.1.7.tar.gz $ cd talloc-2.1.7/ $ ./configure $ make $ sudo make install install libosmocore $ cd libosmocore/ $ autoreconf -i $ ./configure $ make $ sudo make install $ cd .. Compile osmocombb $ cd osmocom-bb $ git checkout --track origin/luca/gsmmap $ cd src $ make 七：Modify the problem file ( if you are gnu-arm-build.2.sh and no cell scanning immobile problem , skip this step ) Enter osmocom-bb find these files and modify them vi osmocom-bb/ src/target/firmware/board/compal/highram.lds vi osmocom-bb/ src/target/firmware/board/compal/ram.lds vi osmocom-bb/ src/target/firmware/board/compal_e88/flash.lds vi osmocom-bb/ src/target/firmware/board/compal_e88/loader.lds vi osmocom-bb/ src/target/firmware/board/mediatek/ram.lds Found inside this string of code KEEP(*(SORT(.ctors))) In the following is added KEEP(*(SORT(.init_array))) Listed as： To save , all changes well in entering osmocom-bb / src recompile $ make -e CROSS_TOOL_PREFIX=arm-none-eabi- 八：Insert your brush into the firmware 118 in osmocom-bb directory $ cd src/host/osmocon $ sudo ./osmocon -m c123xor -p /dev/ttyUSB0 ../../target/firmware/board/compal_e88/layer1.compalram.bin Enter appear so wait when you click c118 power button , click on it If this is the brush into failure , look at your c118 cable, if you are buying a new phone line proposed to insert a little tight . . Best to shell removed 九：Scanning station information Open a new terminal or in osmocom-bb directory $ cd src/host/layer23/src/misc $ sudo ./cell_log -O Then enter $ sudo ./ccch_scan -i 127.0.0.1 -a ARFCN ARFCN is circled out above that value , such as column $ sudo ./ccch_scan -i 127.0.0.1 -a 59 十：install wireshark Open a new terminal $ sudo apt-get install wireshark $ sudo wireshark -k -i lo -f 'port 4729' In the filter input gsm_sms Then quietly wait for it。。。 -- View this message in context: http://baseband-devel.722152.n3.nabble.com/smocombb-c118-gsm-sniffer-tp4026… Sent from the baseband-devel mailing list archive at Nabble.com.

1 0

layer 1 port to nuttx-bb progress?
by Craig Comstock 12 Aug '16

12 Aug '16

I have fernvale-nuttx running on a couple of MTK6260-based watch phones and plan on working on porting layer1 to these devices. https://www.kosagi.com/forums/viewtopic.php?id=407 I saw the most recent activity on nuttx-bb seems to be http://cgit.osmocom.org/nuttx-bb/log/?h=gnutoo/layer1-2015-wip wondering if anyone else is working on this elsewhere that we can coordinate? If there are any particular suggestions/hints/warnings please chime in so I make better progress and have less trouble when I submit pull requests and such. Cheers,Craig

2 1

OsmocomBB - C155 - stuck at flashing firmware
by Gerard Pinto 12 Aug '16

12 Aug '16

Greetings, I have been working with OsmocomBB with C155 model. After a lot of reading and understanding issues on mailing list, following the right instructions I am unable to understand where the problem is - cable or the locked tracfone C155 or my setup. I was successfully able to build the project. I am stuck on executing the following command ~/osmocom-bb/src/host/osmocon# ./osmocon -p /dev/ttyUSB0 -m c155 ../../target/firmware/board/compal_e99/layer1.compalram.bin <No output at all> <Even on slight push on power button no output> Please find my specifications and findings below: 1. C155 locked tracfone. 2. FTDI adapter USB serial from - Fonefunshop Is there a way to test the FTDI adapter ? dmesg - list that FTDI adapter attached to ttyUSB0. FTDI VCP driver is built into the Linux kernel. Do I need D2XX driver ? 3. I'm trying to write the firmware (layer1) with a working GSM sim inside and not tracfone sim card. 4. strace gives me no trouble other than this access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) - Is it a worry ? 5. When I execute ./osmocon with all necessary params. I open a new console and type the following ./osmoload memdump 0x000000 0x2000 dump. - Is this valid at this point? just to see where the actual firmware is located at? Dumping 12288 bytes of memory at 0x0 to file dump - Nothing gets dumped into file dump Although, I see some output - 'got 2 bytes from modem... ' in the osmocon window - ./osmocon It would be very kind if someone could guide me. How do I verify there is a cable issue <Any software to test TX> since I have bought these and if not the cable them am I doing something wrong ? Looking forward to the reply! Thanks, Gerard. -- View this message in context: http://baseband-devel.722152.n3.nabble.com/OsmocomBB-C155-stuck-at-flashing… Sent from the baseband-devel mailing list archive at Nabble.com.

2 1

Re: osmocombb paging group problem
by Vadim Yanitskiy 05 Aug '16

05 Aug '16

Hi, My advice you is to stop waiting for someone, who will help you. Just try to dig into the source code yourself, it's interesting! And in case of any successes, patches are welcome. With best regards, Vadim Yanitskiy.

2 1

layer2/3 ported to target? paging attack code?
by Craig Comstock 05 Aug '16

05 Aug '16

Hey, I finally watched Nico's talk "let me answer that for you" and heard him say he ported layer2/3 to target. Also found a mailing list message about him cleaning it up and putting it up on git and sending it to a few folks. Did that code ever get shared? Would be cool to play around with and is certainly something I would eventually want to accomplish for my project of making a phone that works by itself. -Craig

8 15

osmocombb paging group problem
by sami 01 Aug '16

01 Aug '16

Dear all, I have been testing the mobile app for some time but I faced a small problem where not all my sim cards work fine when listening to paging messages. I have seen the patch presented by Harald Welte and I printed the value of ‘tn’ and found out that it is always 0 whatever the IMSI of the sim card is. Did I miss something or is the paging group part still not implemented in the mobile app. I really appreciate any help.

1 1

Re: rx sensitivity issue
by Vadim Yanitskiy 01 Aug '16

01 Aug '16

Hi Robert, There are many possible issues, which can cause your problem. So, it would be good to see more details. Please, prepare two measurements using cell_log application: one inside any building, and another one outside. Attach both outputs from the cell_log and from the osmocon. I have several phones, and some of them have different RX signal level. I think, it's due to individual calibration tables, which aren't used in OsmocomBB firmware. BTW: if your phone's case is open, make sure that antenna is connected to the phone's board. With best regards, Vadim Yanitskiy.

2 1

rx sensitivity issue
by robert 26 Jul '16

26 Jul '16

Hi, when using the mobile app I cannot connect to the BTS unless I get my phone outside any building, although when using the original firmware I can connect from inside my room. Is there a way to increase the sensitivity of the phone ?

1 0

[PATCH] Makefile: add forgotten gsmmap to (dist)clean section
by Vadim Yanitskiy 07 Jul '16

07 Jul '16

--- src/Makefile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/Makefile b/src/Makefile index 8075082..2d43f9c 100644 --- a/src/Makefile +++ b/src/Makefile @@ -99,6 +99,7 @@ clean: make -C host/layer23 $@ make -C host/osmocon $@ make -C host/trxcon $@ + make -C host/gsmmap $@ make -C target/firmware $@ make -C target/firmware -f Makefile.mtk $@ @@ -107,5 +108,6 @@ distclean: make -C host/layer23 $@ make -C host/osmocon $@ make -C host/trxcon $@ + make -C host/gsmmap $@ # 'firmware' also handles 'mtk-firmware' make -C target/firmware $@ -- 2.9.0

1 1

OsmocomBB hardware migration to SDR
by Вадим Яницкий 01 Jul '16

01 Jul '16

Hi lists! It's no secret for everyone, that today OsmocomBB is not actively maintained as well as OpenBSC, for example. I think it's mostly due to supported hardware limitations. Currently supported platforms is still a bit of 'black box'. Moreover every day it's harder to find and buy a new one. Fortunately, there are many SDR platforms available now. Especially interesting devices are USRP, UmTRX, bladeRF, and recently introduced LimeSDR. They can be easily programmed to support just about any type of wireless standard, of course, including some mobile telecommunication stacks. As well as for network side back-end, they can be used to perform MS side operations, excepting frequency-hopping and some phone specific features (like SIM I/O). So, I think there is a way to bring a new live to, amazing child of the Osmocom umbrella, OsmocomBB. We can make one work on SDR hardware platforms implementing a 'bridge' between both already implemented L2/L3 and OsmoTRX. I know that there already was some attempts (see sylvain/ms-sdr branch) to make described dreams come true, but development was stopped. And now I am going to start to work around this direction. What for? - GPRS and EDGE support - More flexible voice routing - Multi SIM support - Next generation networks support (UMTS, LTE) - ... Currently I am looking for developers interested in this subject. So, any ideas and contributions are welcome! Together we can realize all the things faster and create a new area of research and development. Also for me it's very important to know opinions of Osmocom community members and exactly OsmocomBB founders/developers. Thanks! С наилучшими пожеланиями, Яницкий Вадим.

5 15

Issue with c139
by Ajay Fuloria 28 Jun '16

28 Jun '16

Hi all, I have been using C123 for a long time with FTDI cable. I recently bought a C139 on which I wanted to run layer1 fw, i check the SW version using #02# and software version is "1.3.29", UART Flag is "0" On going through the mailing list I found these to be sufficient for using osmocom-bb but some how there is a problem on loading. When I use the fwg command ./osmocon -p /dev/ttyUSB0 -m c140 -c ../../target/firmware/board/compal_e86/layer1.highram.bin I get the following got 2 bytes from modem, data looks like: 04 81 .. got 5 bytes from modem, data looks like: 1b f6 02 00 41 ....A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD read_file(chainloader): file_size=32, hdr_len=4, dnload_len=15341 got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 43 C Received PROMPT2 from phone, starting download handle_write(): 4096 bytes (4096/15341) handle_write(): 4096 bytes (8192/15341) handle_write(): 4096 bytes (12288/15341) handle_write(): 3053 bytes (15341/15341) handle_write(): finished It receives prompt2 and loads the file but doesn't move ahead, the phone does not show layer1 on the screen either. when i use fwg command (add -m c140xor ) ./osmocon -p /dev/ttyUSB0 -m c140xor -c ../../target/firmware/board/compal_e86/layer1.highram.bin I get the fwg: got 1 bytes from modem, data looks like: 04 . got 1 bytes from modem, data looks like: 81 . got 5 bytes from modem, data looks like: 1b f6 02 00 41 ....A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD read_file(chainloader): file_size=32, hdr_len=4, dnload_len=15341 got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 43 C Received PROMPT2 from phone, starting download handle_write(): 4096 bytes (4096/15341) handle_write(): 4096 bytes (8192/15341) handle_write(): 4096 bytes (12288/15341) handle_write(): 3053 bytes (15341/15341) handle_write(): finished got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 03 . got 1 bytes from modem, data looks like: 57 W Received MAGIC NACK from phone, you need to have "1003" at 0x803ce0 got 1 bytes from modem, data looks like: 66 f got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6d m got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6c l Received FTMTOOL from phone, ramloader has aborted got 1 bytes from modem, data looks like: 65 e got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 72 r It now move ahead and says the received MAGIC NACK and also that you need to have "1003" at 0x803ce0, this is a documented problem and i believe in compal_e86 binaries must have been taken care of. Any ideas on how can I get around this and load the firmware on my c139 ? I am again usung the same cable FTDI which works perfectly with c123. My setup is native Ubuntu 14.04 , host machine and Intel i5.. (hw does not seem to be the problem) Looking forward to hear from you guys. Thanks in advance. Regards, Ajay merlinsignals.blogspot.in

1 0

Issue with C139
by Ajay Fuloria 28 Jun '16

28 Jun '16

Hi all, I have been using C123 for a long time with FTDI cable. I recently bought a C139 on which I wanted to run layer1 fw, i check the SW version using #02# and software version is "1.3.29", UART Flag is "0" On going through the mailing list I found these to be sufficient for using osmocom-bb but some how there is a problem on loading. When I use the fwg command ./osmocon -p /dev/ttyUSB0 -m c140 -c ../../target/firmware/board/compal_e86/layer1.highram.bin I get the following got 2 bytes from modem, data looks like: 04 81 .. got 5 bytes from modem, data looks like: 1b f6 02 00 41 ....A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD read_file(chainloader): file_size=32, hdr_len=4, dnload_len=15341 got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 43 C Received PROMPT2 from phone, starting download handle_write(): 4096 bytes (4096/15341) handle_write(): 4096 bytes (8192/15341) handle_write(): 4096 bytes (12288/15341) handle_write(): 3053 bytes (15341/15341) handle_write(): finished It receives prompt2 and loads the file but doesn't move ahead, the phone does not show layer1 on the screen either. when i use fwg command (add -m c140xor ) ./osmocon -p /dev/ttyUSB0 -m c140xor -c ../../target/firmware/board/compal_e86/layer1.highram.bin I get the fwg: got 1 bytes from modem, data looks like: 04 . got 1 bytes from modem, data looks like: 81 . got 5 bytes from modem, data looks like: 1b f6 02 00 41 ....A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD read_file(chainloader): file_size=32, hdr_len=4, dnload_len=15341 got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 43 C Received PROMPT2 from phone, starting download handle_write(): 4096 bytes (4096/15341) handle_write(): 4096 bytes (8192/15341) handle_write(): 4096 bytes (12288/15341) handle_write(): 3053 bytes (15341/15341) handle_write(): finished got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 03 . got 1 bytes from modem, data looks like: 57 W Received MAGIC NACK from phone, you need to have "1003" at 0x803ce0 got 1 bytes from modem, data looks like: 66 f got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6d m got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6c l Received FTMTOOL from phone, ramloader has aborted got 1 bytes from modem, data looks like: 65 e got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 72 r It now move ahead and says the received MAGIC NACK and also that you need to have "1003" at 0x803ce0, this is a documented problem and i believe in compal_e86 binaries must have been taken care of. Any ideas on how can I get around this and load the firmware on my c139 ? I am again usung the same cable FTDI which works perfectly with c123. My setup is native Ubuntu 14.04 , host machine and Intel i5.. (hw does not seem to be the problem) Looking forward to hear from you guys. Thanks in advance. Regards, Ajay merlinsignals.blogspot.in

1 0

Openphone
by Madhu Macaque Labs 21 Jun '16

21 Jun '16

I am the project lead for the SHAKTI open source processor project. See bitbucket.org/casl This is a large Indian processor development effort that aims to develop a range of processors (from uController to high end servers) based on the RISCV ISA. We work closely with UCB and Cambridge as part of this effort. As part of our processor family, we have just started on a mobile SoC. The goal is to have an octa core SoC with the performance of a snapdragon 820 or the Apple A9. the CPU core is pretty much under control but we are exploring the DSP needed for running the lower levels of the 3G/LTE stack. Another group does LTE stacks and so we have complete testing equipment available to test for compliance. I am basically looking for co-conspirators who can help identify the components I can use from the osmocom stack and figure out what else we need to develop. Then of course we need to develop the DSP core. We are currently reusing the UCB vector processor and we are trying to figure out if a vector thread processor or a conventional DSP will do the trick. Our goal is to have am SoC that will the functionality of a basic smart phone but we do not intend to focus only on a basic phone with voice/data ca[ability but with basic display (even 4 line display is OK). Plan to use the AD SDR board for the SDR section. So it will be a large board that is not optimized for size. Any comments, thoughts appreciated . In case you are wondering, yes we realize this a mammoth task but we are well funded ! This is part of the India processor project. And most importantly all our work will be patent free open source. HW will be BSD, SW will be GPL3/2 -- Regards, Madhu

7 9

Re: Sv: 2G repeater/booster w/ osmocom-bb? or 3G w/ osmocom-bb?
by Craig Comstock 21 Jun '16

21 Jun '16

I found a 1900 band analog booster/repeater to try. > On Jun 20, 2016, at 2:32 PM, Erich Dachleger <edachleger(a)yahoo.com> wrote: > > Does anybody know if it would be possible to use some of the old vodaphone-femtocells together with openbsc/osmo-bts? > RegardsErich > > Den Mandag, 23. mai 2016 11.46 skrev etienne . <etiennehelluy(a)gmail.com>: > > > Short answer: no & no > 1 - A gsm repeater is an analog device. With osmocom-bb phones you would need to demodulate/remodulate bursts. > This wi

1 0

OsmocomBB on Openmoko GTA02
by Cosmin - Ioan PETRI?OR 18 Jun '16

18 Jun '16

Hi guys, I have a lot of problems using osmocom-bb with an Openmoko GTA02. First of all, I followed all the instructions from here [1] and uploaded layer1.highram.bin via external jack serial port (second tutorial). Well, after the firmware is downloaded on the phone osmocon prints: " Finished, sent 54 blocks in total Received branch ack, your code is running now! " and nothing is printed anymore. Moreover, I see no activity on the serial port, all LEDs on my USB adapter being off. When I try to run cell_log from my PC, it prints the following error message and blocks / does nothing: " Failed to connect to '/tmp/osmocom_sap'. Failed during sap_open(), no SIM reader <000e> cell_log.c:804 Scanner initialized Mobile initialized, please start phone now! " I've read about this error and figured out that it is not fatal, but still cell_log doesn't work, nor does the 'mobile' application. I tried the code from master and from sylvain/testing branch and I uncommented "CONFIG_TX_ENABLE". I even tried hello_world.highram.bin and that doesn't print anything after loading it. I don't know what to do anymore. [1] http://bb.osmocom.org/trac/wiki/OpenMoko#no1

1 0

L1 power measurement logs
by Вадим Яницкий 17 Jun '16

17 Jun '16

Hello everyone! During power measurement process we can see some messages like: PM MEAS: ARFCN=8, 55 dBm at baseband, -83 dBm at RF If I understood correctly, in this example received signal has -83 dBm (about 5e-12 W) strength before amplifier and 55 dBm (about 316.2 W) strength after one. It looks like the strength of amplified signal should be printed as -55 (about 3.2e-9 W), because 316.2 W is very high value. Am I right? Or is it internal signal strength representation used by DSP? С наилучшими пожеланиями, Яницкий Вадим.

2 1

Please can anyone advise me - FMTOOL Error and no further processing
by Raz Sharif 25 May '16

25 May '16

Dear all, I vae the C115 with a T1 USB to Serial cable with the Prolific chipset. When i run osmocon i get :- an its just sits there with no further processing. ./osmocon -p /dev/ttyUSB0 -m c123xor ../../target/firmware/board/compal_e88/loader.compalram.bin read_file(../../target/firmware/board/compal_e88/loader.compalram.bin): file_size=17120, hdr_len=4, dnload_len=17127 read_file(../../target/firmware/board/compal_e88/loader.compalram.bin): file_size=17120, hdr_len=4, dnload_len=17127 got 1 bytes from modem, data looks like: 00 . got 2 bytes from modem, data looks like: 2f 00 /. got 1 bytes from modem, data looks like: 1b . got 3 bytes from modem, data looks like: f6 02 00 ... got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD got 1 bytes from modem, data looks like: 66 f got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6d m got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6c l Received FTMTOOL from phone, ramloader has aborted got 1 bytes from modem, data looks like: 65 e got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . I think the cable is ok as when i run my fingers on the tip i get random Zeros so it appears to be talking to the cable. Also when i tried to run Mobile i get the :- even though i created the Mobile.cfg file in /etc/osmoco Failed to parse the config file: '/home/raz/.osmocom/bb/mobile.cfg' Please check or create config file using: 'touch /home/raz/.osmocom/bb/mobile.cfg' I have spent some hours researching the lists and trying various things to no avail but I want to continue until I resolve this issues and use this great stack to learn about the GSM network. Please advise. Great full for any help or pointers but this maybe a timing issue that is difficult to debug. Thanks Raz

5 6

Re: Terminal-profile DB
by Вадим Яницкий 21 May '16

21 May '16

> What are your ideas to make this database alive? I think we can make it more friendly to user. What do you think about merging both TAC and terminal-profile databases? One common DB and one web-interface seems good for me. Also I am thinking about implementation of a simple Java cardlet which will be aimed to extract device's profile and provide the results through SIM-menu. In this case everything that user need is get one programmable SIM and install this app. С наилучшими пожеланиями, Яницкий Вадим. 2016-05-21 10:13 GMT+06:00 Kévin Redon <kevredon(a)mail.tsaitgaist.info>: > What are your ideas to make this database alive? > > The easiest way to get the terminal profile of a phone is to monitor the > SIM interface. To automate that a script to be used along with SIMtrace is > provided. Alternatively you can use the email address. > Currently the database it is not very active because no one is submitting > entries since it's not as easy as getting a TAC/IMEI. > I also kind of like read only. It keeps external from messing around with > it. > But I'm happy to here what you have to propose. > > On Sat, May 21, 2016 at 12:13:56AM +0600, Вадим Яницкий wrote: > > Hi, > > > > I think it would be cool to "make alive" the terminal-profile database. > > Currently it can be visited in readonly mode: > > > > https://terminal-profile.osmocom.org/ > > > > I can make a page simular to http://tacdb.osmocom.org/ where > > anybody will be abble to contribute and download the lastest > > version of database. > > > > But before I begin, I would like to know your opinions. > > > > С наилучшими пожеланиями, > > Яницкий Вадим. >

1 0

Terminal-profile DB
by Вадим Яницкий 20 May '16

20 May '16

Hi, I think it would be cool to "make alive" the terminal-profile database. Currently it can be visited in readonly mode: https://terminal-profile.osmocom.org/ I can make a page simular to http://tacdb.osmocom.org/ where anybody will be abble to contribute and download the lastest version of database. But before I begin, I would like to know your opinions. С наилучшими пожеланиями, Яницкий Вадим.

1 0

Calypso_BTS stopping after few minutes
by robert 19 May '16

19 May '16

Hi, While experimenting with the calypsoBTS using a Motorola C118, I noticed that the transceiver always stops after a few minutes and displays the following messages: <0011> trx.c:419 TRX Control recv: |POWEROFF| <0011> trx.c:220 TRX Control send: |RSP POWEROFF 0| Does anyone know what is causing this problem? Best regards, Robert,

1 0

disable force rekey
by frank.holtz＠tutanota.com 13 May '16

13 May '16

Hello, I am facing an issue with the mobile app inside osmocom-bb. I checked with gr-gsm that my telecom operator changes the Kc ( by sending auth request) every 5 events (call or sms). But with the same sim card, I can see on Wireshark connected to the mobile app, the osmocom-bb phone received an auth request before every event. So my guess something causes the BTS to send a new auth request but only with osmocom-bb mobile app. I checked the source code, i found the option "force-rekey". Even with this option in mobile.cfg disabled I got the same issue. I saw that when enabled this option set the key sequence to 7. I tried with the latest version of osmocombb/libosmocore. Even with previous version from 2012 and last 2011 both osmocom-bb/libosmocore, different computer/ different phone (C123, c118 and c139), different cables (I use a shielded FTDI and a CP2102). Has anybody faced the same situation ? Have you an idea from where it can come from ? Thank you for your help Frank

1 0

Help with a bricked C118
by Simone Margaritelli 21 Apr '16

21 Apr '16

Hi everyone, I just got today a Motorola C118 with a CP2102 interface, so I’ve cloned and compiled the osmocom-bb and started playing with it, everything looked great ( osmocon working, hello world app, rssi and so forth, everything 100% perfect ). Then I started following this page http://osmocom.org/projects/baseband/wiki/Flashing_new <http://osmocom.org/projects/baseband/wiki/Flashing_new> Until I reached the point where the menu.e88loader.bin file was referenced … I don’t have this file (I’m on the master branch), so I closed every tabs of the terminal to search which branch contained that file. Problem is, I’ve executed all the commands prior to this one: host/osmocon/osmoload fprogram 0 0x012000 target/firmware/board/compal_e88/menu.e88loader.bin ( also saved the original loader ) and now the phone doesn’t turn on anymore, neither osmocon is able to detect it … so I guess it’s bricked? is there any way to unbrick it? Thanks for your help.

1 0

OsmoDevCon 2016 update
by Harald Welte 06 Apr '16

06 Apr '16

Dear attendees of OsmoDevCon 2016, below are some updates regarding OsmoDevCon 2016 = Lunch Catering = OsmoDevCon lunch catering has been finalized by now. I wanted to try some change by having (authentic) thai food, but unfortunately that didn't work out and we're back to our trusted old suppliers for all of the lunches. More details are available on http://projects.osmocom.org/projects/openbsc/wiki/OsmoDevCon2016 = Dinner Catering = In terms of dinner catering, we didn't plan/schedule anything yet. I know it was a request to have it and we introduced it (last year?) but I didn't have time to actively look for a sponsor for this in 2016, sorry. If you think it's important, I can try to get something organized for dinner too, but there's not much time left. It might be easier to simply go out in 2-3 groups, order pizza from the place down the road or even place a larger 'a la carte' order from another place. = Schedule / Talks = Thre's already a list of topics listed at the wiki, specifically: http://projects.osmocom.org/projects/openbsc/wiki/OsmoDevCon2016#TalksDiscu… I think we still have plenty of slots for talks, presentations, discussions, workshops, you name it. Each of you: Please take some time to think about a) topics that you would be able to contribute to the event by giving a talk or leading a discussion or workshop b) topics that you would like to hear about from somebody else Even if we do the actual scheduling ad-hoc at the event itself, it still is useful to have some advance notice about the topics, as the speaker(s) will need to prepare accordingly. = Attendance = If you have registered but will not attend, please let us know as we can still adjust the amount of food we get delivered, and we might offer your seat to somebody else. If you did not register but are an active contributor to the project(s) and would like to attend, let me know, too. I will let you know if somebody cancels their attendance. Looking forward to meeting all of you in Berlin soon. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

2 2

ANN: https://patchwork.osmocom.org
by Holger Freyther 31 Mar '16

31 Mar '16

Hi, we are now running our own copy of patchwork at https://patchwork.osmocom.org. In addition to single patches this version can track series and has a REST API and git-pw client support. The system is currently subscribed to the GPRS, OpenBSC and OsmocomBB mailinglist. The installation is running offlineimap every couple of minutes to fetch new mail, this means it can take some minutes for your comment or patch to be visible. kind regards holger

1 0

Can't flash app on C140(E86)
by Alex 31 Mar '16

31 Mar '16

I'm trying to flash the EMI app on a C140 using this tutorial: http://bb.osmocom.org/trac/wiki/flashing_new I can't fine menu.e86loader.bin file so I've flashed the menu.compalram.bin instead. All seem to be fine, but if I press the power button the screen doesn't turn on. I've made this procedure many times, but without success. Instead if I flash it in the ram, it work great. Why?

1 0

BSIC neighboring cells dedicated mode
by asghar.mustafa 30 Mar '16

30 Mar '16

I am working on obtaining BSIC of neighbouring cells in dedicated mode. Any help would be highly appreciated. -- View this message in context: http://baseband-devel.722152.n3.nabble.com/BSIC-neighboring-cells-dedicated… Sent from the baseband-devel mailing list archive at Nabble.com.

1 0

Re: Time to rename projects.osmocom.org to osmocom.org
by Вадим Яницкий 28 Mar '16

28 Mar '16

> I added: > proxy_set_header X-Forwarded-Ssl on; I think if nginx is used as main back-end (without Apache), this header means nothing. In this case just refer this guide: https://scotthelme.co.uk/setting-up-hsts-in-nginx/ If I'm not right, and there is also Apache server, follow: http://stackoverflow.com/questions/16042647/whats-the-de-facto-standard-for… С наилучшими пожеланиями, Яницкий Вадим.

1 0

Time to rename projects.osmocom.org to osmocom.org
by Holger Freyther 27 Mar '16

27 Mar '16

Hi, I think we all liked tnt's proposal to just call it osmocom.org. Are we ready to make the redmine available as osmocom.org (and redirect www.osmocom.org, projects.osmocom.org to it)? As first step of redirects I propose: http://bb.osmocom.org/ -> http://osmocom.org/projects/baseband http://openbsc.osmocom.org/ -> http://osmocom.org/projects/openbsc http://tetra.osmocom.org/ -> http://osmocom.org/projects/tetra http://simtrace.osmocom.org/ -> http://osmocom.org/projects/simtrace http://security.osmocom.org/ -> http://osmocom.org/projects/security http://gmr.osmocom.org/ -> http://osmocom.org/projects/gmr http://sdr.osmocom.org/ -> http://osmocom.org/projects/sdr any objections or corrections to that? kind regards holger

5 7

Record call
by robert 10 Mar '16

10 Mar '16

Hi, Is is possible to record a specific call using osmocombb? I want to record a call being made on the osmocombb phone not to sniff calls over the air. Best regards, Robert,

3 3

Redmine theme
by Вадим Яницкий 08 Mar '16

08 Mar '16

Dear all, I suggest to change a stock Redmine theme to something more beautiful, for example gitmike: https://github.com/makotokw/redmine-theme-gitmike which used by srlabs.de and looks like pretty. Furthermore, the Osmocom logo will look better on light background. Opinions? С наилучшими пожеланиями, Яницкий Вадим.

5 8

toolchain problem
by fotos-aller-art＠web.de 05 Mar '16

05 Mar '16

Hallo zusammen, ich wollte toolchain auf meinem Backtrack5r3 als VM installieren, dabei sind Fehler aufgetreten die ich nicht verstehe. Wie kann ich da Abhilfe schaffen? Bis hierhin war noch alles gut. GNU ARM toolchain This page will describe the procedure for compiling a GNU ARM toolchain. We will build a toolchain consisting of: * GCC 4.8.2 * Binutils 2.21.1 * Newlib 1.19 Getting the buildscript First of all, create a directory you want to use for building the toolchain, and download the buildscript <http://bb.osmocom.org/trac/raw-attachment/wiki/GnuArmToolchain/gnu-arm-buil d.3.sh> gnu-arm-build.3.sh there. You will need to make it executable: $ chmod +x gnu-arm-build.3.sh Dependencies In order to build the toolchain, you will need to install the following packages (assuming you're using a Debian-based distribution): $ sudo apt-get install build-essential libgmp3-dev libmpfr-dev libx11-6 libx11-dev texinfo flex bison libncurses5 \ libncurses5-dbg libncurses5-dev libncursesw5 libncursesw5-dbg libncursesw5-dev zlibc zlib1g-dev libmpfr4 libmpc-dev Preparation Open a shell in the directory of gnu-arm-build.sh and create the following directories: $ mkdir build install src Download the needed sources to src/: $ cd src/ $ wget http://ftp.gnu.org/gnu/gcc/gcc-4.8.2/gcc-4.8.2.tar.bz2 $ wget http://ftp.gnu.org/gnu/binutils/binutils-2.21.1a.tar.bz2 $ wget ftp://sources.redhat.com/pub/newlib/newlib-1.19.0.tar.gz Building the toolchain $ cd .. $ ./gnu-arm-build.3.sh I will build an arm-none-eabi cross-compiler: Prefix: <YOURPATH>/install Sources: <YOURPATH>/src Build files: <YOURPATH>/build Press ^C now if you do NOT want to do this. Dann kam folgendes, als wenn er Probleme mit den Ordnern hatte. cid:image001.jpg@01D17613.420C17C0 Könnt ihr mir weiterhelfen? Gruß Peseta3

2 1

cell re-selection
by Andreas.Eversberg 05 Mar '16

05 Mar '16

hi, i did a lot of resarch and testing on cell selection and re-selection process the last two week. the cell selection process, network selection process (manual and automatic) and mobility management process were already implemented in OsmocomBB a long time, but turned out to be buggy and incomplete. i made test drives to check the process and debugged it. the re-selection process is new. it is used to track surrounding cells while listening to the BCCH of the current cell (camping on a cell). special extension to the layer1 firmare is used to measure neighbour cells. if an neighbour cell becomes 'better', the mobile switches to that cell, depening on different criteria. now it is possible to move with OsmocomBB. the re-selection process is not handover! handover is a process where a phone switches between cells while doing a call. handover is one next step to implement. the process is a little more complex, because it requires not only neighbour cell measurements, but also syncing to them without interrupting the traffic channel. most layer 3 stuff of handover is already implemented. if you like to play and test your moving OsmocomBB, you can check out the "jolly/roaming" branch. it contains the extension to layer1, as well as sim reader and fixes from "sylvain/testing" branch. use both "mobile" and "layer1" firmware from this branch. in order to see some process at VTY, you can do: enable monitor network 1 (continously display the strongest cell and neighbour cells) show ms 1 (to see current states) show neighbour-cells 1 (to see a more detailed current list of neighbours) andreas

3 3

omsocombb not receiving calls
by robert steve 04 Mar '16

04 Mar '16

Hi, I would first like to thank all those who participated in this nice project. I recently started working with osmocombb and was able to have it working fine on a motorola c118. However, I noticed that some sim cards can connect normally to the BTS, can make calls and send SMS but can’t receive anything. They simply don't get paged. While for some other sim cards everything seems to be working fine. Does anyone know what might be causing this issue ? thanks, Robert

3 2

Re: Record call
by robert 04 Mar '16

04 Mar '16

Can it be done without using LCR ? On Mar 4, 2016, at 10:21 AM, Dennis Eisenbarth <dennis.eisenbarth(a)gmail.com> wrote: > It should not be a problem. > > Have a nice day, > Dennis > > On 03.03.2016 18:47, robert wrote: >> Hi, >> >> Is is possible to record a specific call using osmocombb? I want to record a call being made on the osmocombb phone not to sniff calls over the air. >> >> >> Best regards, >> Robert, >

1 0

Re: Record call
by robert 04 Mar '16

04 Mar '16

On Mar 4, 2016, at 10:21 AM, Dennis Eisenbarth <dennis.eisenbarth(a)gmail.com> wrote: > It should not be a problem. > > Have a nice day, > Dennis > > On 03.03.2016 18:47, robert wrote: >> Hi, >> >> Is is possible to record a specific call using osmocombb? I want to record a call being made on the osmocombb phone not to sniff calls over the air. >> >> >> Best regards, >> Robert, >

1 0

Mobility Management in OsmocomBB code
by Ahmed Salman 01 Mar '16

01 Mar '16

Hello, I hope that this email finds you in good health. I am working on implementing the call handover part of mobility management in the OsmocomBB code as part of my Senior Year Project in University. I would like to ask you a few things about what you have implemented. Your help will guide me a lot in my endeavor. Please let me know whenever we can skype or call. Thanks and Regards, Ahmed

1 0

Set fixed TMSI and Kc
by Simian Denson 29 Feb '16

29 Feb '16

Hi, in the osmocom bb mobile.cfg I don't see any posibility to set a fixed Kc encryption key and the tmsi. How could I achieve that osmocom uses my defined Kc and tmsi? cheers, Simian

5 21

Re: Set fixed TMSI and Kc
by Вадим Яницкий 29 Feb '16

29 Feb '16

Look at this strings from your log: <0005> subscriber.c:601 Requesting SIM file 0x2fe2 <000f> sim.c:209 got new job: SIM_JOB_READ_BINARY (handle=00000004) <000f> sim.c:697 go MF <000f> sim.c:241 SELECT (file=0x3f00) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) <000f> sim.c:876 received APDU (len=0 sw1=0x00 sw2=0x00) <000f> sim.c:952 command failed <000f> sim.c:151 sending result to callback function (type=1) <0005> subscriber.c:657 SIM reading failed Maybe something wrong with your SIM? Try another one. Are you at the master branch? С наилучшими пожеланиями, Яницкий Вадим.

1 0

flashing firmware
by robert 29 Feb '16

29 Feb '16

Hi, Can someone confirm if the steps described in http://bb.osmocom.org/trac/wiki/flashing are still valid, as I can’t find “loader.e88loader.bin”. I’m using sylvain/testing branch. Best regards, Robert,

3 5

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

baseband-devel