- baseband-devel - lists.osmocom.org

bad crc when trying to flash application
by Andreas 02 Oct '13

02 Oct '13

Hello, I have problems flashing applications to the motorola c123. I tried it with several phones. Booting and running applications via USB is working well, but unfortunately flashing does not work. Following both of the tutorials (flashing and flashing_new) the command "host/osmocon/osmoload fprogram 0 0x010000 compal_loader.bin" outputs: Loading 8192 bytes of memory at 0x10000 in chip 0 from file compal_loader.bin bad crc 9bf1 (not e0bc) at offset 0x00000000 status 5242976, aborting The memdump-command seems to work - I get a file compal_loader.bin with an md5sum of f59dee5a67b4114251acd0d279eacd85. The "funlock" and "erase"-command seemed to be successful, according to the output of osmocom ("Unlocking block at 0x00010000, meaning 00010000", "Erasing block 0x00010000...done") and the fact, that the original firmware does not load anymore, when erased :-) I am using debian 6.0 (32bit) with a cross-compile-environment setup as described on http://bb.osmocom.org/trac/wiki/GnuArmToolchain to compile osmocom. The libosmocore has Patch 5b6416a729b46aab8ac7ea25a7ec91f3afeaf4fc (latest master-Branch), but I am using commit f2ab5e14967426f4845b51def4d9105af22f9ad2 from the master-branch of osmocom, because with the latest version of osmocom, the phones would not boot - I get only an output of "got 2 bytes from modem, data looks like: 04 81 ..", then osmocom exits. The motorola c123 is connected via USB-Hub and an CP2102-Cable I got from sysmocom. Could anybody please give me a where the error is or what else I can try to solve the problem. Thanks for help. greetings, Andreas

3 3

Re: [PATCH] Menu App to select highram images from phone's flash memory
by Andreas Eversberg 29 Sep '13

29 Sep '13

sorry, wrong mailing list. so i try again: Andreas Eversberg wrote: > hi, > > this forthcoming tutorial describes the usage (flashing) of the menu app: > > https://bb.osmocom.org/trac/wiki/flashing_new > > andreas > >

1 0

[PATCH] Menu App to select highram images from phone's flash memory
by Andreas Eversberg 29 Sep '13

29 Sep '13

--- src/target/firmware/Makefile | 3 +- src/target/firmware/apps/menu/main.c | 353 ++++++++++++++++++++++++++++++++++ 2 files changed, 355 insertions(+), 1 deletions(-) create mode 100644 src/target/firmware/apps/menu/main.c diff --git a/src/target/firmware/Makefile b/src/target/firmware/Makefile index 42f7ad4..0f4120f 100644 --- a/src/target/firmware/Makefile +++ b/src/target/firmware/Makefile @@ -84,11 +84,12 @@ BOARD_se_j100_ENVIRONMENTS=$(compal_COMMON_ENVIRONMENTS) # # List of all applications (meant to be overridden on command line) -APPLICATIONS?=hello_world compal_dsp_dump layer1 loader rssi +APPLICATIONS?=hello_world compal_dsp_dump layer1 loader rssi menu # Applications specific env requirements APP_loader_ENVIRONMENTS=compalram highram APP_rssi_ENVIRONMENTS=* -compalram +APP_menu_ENVIRONMENTS=* -highram # Various objects that are currently linked into all applications FLASH_OBJS=flash/cfi_flash.o diff --git a/src/target/firmware/apps/menu/main.c b/src/target/firmware/apps/menu/main.c new file mode 100644 index 0000000..47aadc4 --- /dev/null +++ b/src/target/firmware/apps/menu/main.c @@ -0,0 +1,353 @@ +/* Menu for Calypso Phone to load applicatios from flash */ + +/* (C) 2013 by Andreas Eversberg <jolly(a)eversberg.eu> + * + * All Rights Reserved + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + * + */ + +#include <stdint.h> +#include <stdio.h> +#include <string.h> +#include <errno.h> + +#include <debug.h> +#include <memory.h> +#include <delay.h> +#include <byteorder.h> +#include <rffe.h> +#include <keypad.h> +#include <board.h> +#include <abb/twl3025.h> +#include <rf/trf6151.h> +#include <calypso/clock.h> +#include <calypso/tpu.h> +#include <calypso/tsp.h> +#include <calypso/dsp.h> +#include <calypso/irq.h> +#include <calypso/misc.h> +#include <calypso/timer.h> +#include <comm/sercomm.h> +#include <comm/timer.h> +#include <uart.h> +#include <fb/framebuffer.h> +#include <battery/battery.h> +#include <asm/system.h> + +#define RAM 0x00820000 +#define MAGIC 0x0083ff00 + +enum key_codes key_code = KEY_INV; +static volatile enum key_states key_state; + +int cursor = 0, scroll_apps = 0; + +struct apps { + char name[16]; + void *start; + int len; +} apps[32]; + +int _memcmp(char *s1, char *s2, int size) +{ + int i; + + for (i = 0; i < size; i++) { + if (*s1 < *s2) + return -1; + if (*s1 > *s2) + return 1; + s1++; + s2++; + } + + return 0; +} + +static void locate_apps(void) +{ + int i, j, k; + char *p; + + memset(apps, 0, sizeof(apps)); + + for (j = 0, i = 0x010000; i < 0x200000; i += 0x10000) { + p = (char *)i; + /* check for highram header: "highram:" */ + if (!!_memcmp(p, "highram:", 8)) + continue; + p += 8; + /* check for app name after header: "highram:<name>\n" */ + printf("found highram image at flash mem address 0x%p\n", + (char *)i); + for (k = 0; k < (int)sizeof(apps[j].name) - 1; k++) { + if (p[k] == '\n') + break; + } + if (k == sizeof(apps[j].name) - 3) { + printf("skipping: corrupt highram header, no '\\n' " + "after image name or name more larger than %d " + "digits\n", (int)sizeof(apps[j].name) - 3); + continue; + } + if (j < 9) + apps[j].name[0] = '1' + j; + else if (j == 9) + apps[j].name[0] = '0'; + else + apps[j].name[0] = ' '; + apps[j].name[1] = ' '; + memcpy(apps[j].name + 2, p, k); + apps[j].len = 0x20000; + p += k + 1; + /* p points to highram image after header */ + apps[j].start = p; + j++; + } +} + +static void wait_key_release(void) +{ + /* wait for key release */ + while (key_state == PRESSED) { + delay_ms(10); + keypad_poll(); + } +} + +static void load_app(void) +{ + static int i; + static void (*f) (void) = (void (*)(void))RAM; + + wait_key_release(); + + local_irq_disable(); + + for (i = 0; i < apps[cursor].len; i++) + ((unsigned char *)RAM)[i] = ((unsigned char *)apps[cursor].start)[i]; + f(); +} + +/* UI */ + +static void refresh_display(void) +{ +#if 0 + char text[16]; + int bat = battery_info.battery_percent; +#endif + int i; + + fb_clear(); + + /* header */ + fb_setbg(FB_COLOR_WHITE); + if (1) { + fb_setfg(FB_COLOR_BLUE); + fb_setfont(FB_FONT_HELVR08); + fb_gotoxy(0, 7); + fb_putstr("Osmocom Menu", -1); + fb_setfg(FB_COLOR_RGB(0xc0, 0xc0, 0x00)); + fb_setfont(FB_FONT_SYMBOLS); +#if 0 + fb_gotoxy(framebuffer->width - 15, 8); + if (bat >= 100 && (battery_info.flags & BATTERY_CHG_ENABLED) + && !(battery_info.flags & BATTERY_CHARGING)) + fb_putstr("@HHBC", framebuffer->width); + else { + sprintf(text, "@%c%c%cC", (bat >= 30) ? 'B':'A', + (bat >= 60) ? 'B':'A', (bat >= 90) ? 'B':'A'); + fb_putstr(text, framebuffer->width); + } +#endif + fb_gotoxy(0, 8); + fb_putstr("GGEGG", framebuffer->width); + fb_setfg(FB_COLOR_GREEN); + fb_gotoxy(0, 10); + fb_boxto(framebuffer->width - 1, 10); + } + fb_setfg(FB_COLOR_BLACK); + fb_setfont(FB_FONT_C64); + + + for (i = 0; i < 5; i++) { + if (!apps[scroll_apps + i].name) + break; + if (scroll_apps + i == cursor) { + fb_setfg(FB_COLOR_WHITE); + fb_setbg(FB_COLOR_BLUE); + } + fb_gotoxy(0, 20 + i * 10); + fb_putstr(apps[scroll_apps + i].name, + framebuffer->width); + if (scroll_apps + i == cursor) { + fb_setfg(FB_COLOR_BLACK); + fb_setbg(FB_COLOR_WHITE); + } + } + if (i == 0) { + fb_gotoxy(0, 50); + fb_putstr("No apps!", -1); + } + + fb_flush(); +} + +static void handle_key_code() +{ + if (key_code == KEY_INV) + return; + + switch (key_code) { + case KEY_1: + case KEY_2: + case KEY_3: + case KEY_4: + case KEY_5: + case KEY_6: + case KEY_7: + case KEY_8: + case KEY_9: + if (apps[key_code - KEY_1].len) { + cursor = key_code - KEY_1; + load_app(); + } + break; + case KEY_0: + if (apps[9].len) { + cursor = 9; + load_app(); + } + break; + case KEY_UP: + if (cursor == 0) + return; + cursor--; + if (cursor < scroll_apps) + scroll_apps = cursor; + refresh_display(); + break; + case KEY_DOWN: + if (!apps[cursor + 1].name[0]) + return; + cursor++; + if (cursor >= scroll_apps + 5) + scroll_apps = cursor - 4; + refresh_display(); + break; + case KEY_OK: + if (apps[cursor].len) + load_app(); + break; + case KEY_POWER: + wait_key_release(); + twl3025_power_off(); + break; + default: + break; + } + + key_code = KEY_INV; +} + +/* Main Program */ +const char *hr = "======================================================================\n"; + +static void key_handler(enum key_codes code, enum key_states state) +{ + key_state = state; + + if (state != PRESSED) + return; + + key_code = code; +} + +extern void putchar_asm(uint32_t c); + +static const uint8_t phone_ack[] = { 0x1b, 0xf6, 0x02, 0x00, 0x41, 0x03, 0x42 }; + +int main(void) +{ + int i; + + /* Simulate a compal loader saying "ACK" */ + for (i = 0; i < (int)sizeof(phone_ack); i++) { + putchar_asm(phone_ack[i]); + } + + board_init(0); + + puts("\n\nOsmocomBB Menu (revision " GIT_REVISION ")\n"); + puts(hr); + + fb_clear(); + + fb_setfg(FB_COLOR_BLACK); + fb_setbg(FB_COLOR_WHITE); + fb_setfont(FB_FONT_HELVB14); + + fb_gotoxy(2,20); + fb_putstr("menu",framebuffer->width-4); + + fb_setfg(FB_COLOR_RED); + fb_setbg(FB_COLOR_BLUE); + + fb_gotoxy(2,25); + fb_boxto(framebuffer->width-3,38); + + fb_setfg(FB_COLOR_WHITE); + fb_setfont(FB_FONT_HELVR08); + fb_gotoxy(8,33); + fb_putstr("osmocom-bb",framebuffer->width-4); + + fb_flush(); + + /* Dump device identification */ + dump_dev_id(); + puts(hr); + + /* Dump clock config before PLL set */ + calypso_clk_dump(); + puts(hr); + + keypad_set_handler(&key_handler); + + /* Dump clock config after PLL set */ + calypso_clk_dump(); + puts(hr); + +// display_unset_attr(DISP_ATTR_INVERT); + + locate_apps(); + + while (1) { + for (i = 0; i < 50; i++) { + keypad_poll(); + delay_ms(10); + osmo_timers_update(); + handle_key_code(); + } + refresh_display(); + } + + /* NOT REACHED */ + + twl3025_power_off(); +} + -- 1.7.3.4

1 0

Issue related to Communication
by R M 20 Sep '13

20 Sep '13

Hi all, I am asian. I am having this very problematic issue. In my day job, I provide production support for a large application. We have weekly calls with our clients. The clients are mostly European. One of them's surname is Welsh I am having a real hard time understanding their accent. I want to tell them that I cant understand thier accent. If I say so will it bad thing to say. That is, will they get offended by it ? I am asking this question as many here are from the European continent. Regards, Ronald

2 1

toolchain-script with live-cd
by Erich Dachleger 12 Sep '13

12 Sep '13

Hi list, When using the build-toolchain script in the osmocom-bb wiki,which works fine, I sometimes also want to use the obtained toolchain on a live cd, with same OS. When I try to build the script on the live-cd I run out of space so I thougt it would be easy to just copy the the script built on first disk by issuing cp -r /root/dublin/install/* /root/copyfile and then tar cf name.tar copyfile/ && bzip2 name.tar Here dublin is the original folder where the full toolchain resulting from osmocombb buildscript, http://bb.osmocom.org/trac/wiki/GnuArmToolchain, is placed. name.tar.bz2 is then copied onto the live-cd, decompressed into copyfile, but compiling osmocombb fails. I suspect I introduce errors when copying /root/dublin/install/* onto copyfile since that command is omitting files(such as binutils)and some directories, from the original directory, but copying the full original directory osmocombb-buildscript directory dublin would lead to lack of disc-space in the live-cd. Somebody on the list noted in March that a simple chmod 777 /root/copyfile would fix it, but in my case it does not work. When I used the old now removed) toolchain available as tarball on the osmocombb-website about 7 months ago it worked to build on a live cd using that tooldchain, but maybe it is not possible to use the toolchain from the buildscript on such media as an OS booted from a live cd? /regards erich ---------------------------------------------------------------------------------------------------------- some error message from running osmocom-bb/src/make on the live-cd: cd shared/libosmocore/build-target && ../configure \ --host=arm-elf --enable-embedded --disable-shared \ --disable-tests ac_cv_header_sys_select_h=no \ --disable-tests ac_cv_header_sys_socket_h=no \ CFLAGS="-Os -ffunction-sections -I/root/osmocom-bb/src/target/firmware/include -nostartfiles -nodefaultlibs" configure: WARNING: unrecognized options: --disable-tests, --disable-tests configure: WARNING: If you wanted to set the --build type, don't use --host. If a cross compiler is detected then cross compile mode will be used. checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for arm-elf-strip... arm-elf-strip checking for a thread-safe mkdir -p... /bin/mkdir -p checking for gawk... gawk checking whether make sets $(MAKE)... yes checking whether make sets $(MAKE)... (cached) yes checking for arm-elf-gcc... arm-elf-gcc checking whether the C compiler works... no configure: error: in `/root/osmocom-bb/src/shared/libosmocore/build-target': configure: error: C compiler cannot create executables See `config.log' for more details. make: *** [shared/libosmocore/build-target/Makefile] Error 77 ------------------------------------------------------------------------------------- also on live-cd: root@bt:~# arm-elf-gcc -v Using built-in specs. COLLECT_GCC=arm-elf-gcc COLLECT_LTO_WRAPPER=/root/apple/bin/../libexec/gcc/arm-elf/4.5.2/lto-wrapper Target: arm-elf Configured with: /root/dublin/src/gcc-4.5.2/configure --target=arm-elf --prefix=/root/dublin/install --enable-interwork --enable-multilib --with-float=soft --disable-werror --enable-languages=c,c++ --with-newlib --with-headers=/root/dublin/src/newlib-1.19.0/newlib/libc/include --with-system-zlib --disable-shared Thread model: single gcc version 4.5.2 (GCC) ----------------------------------------------------------------------------------------- Some content of osmocom-bb-buildscript on original disk where building of osmocombb works: root@bt:~/dublin# ls -a . .. build gnu-arm-build.2.sh install src root@bt:~/dublin# cd build root@bt:~/dublin/build# ls -a . .. binutils-2.21.1 gcc-4.5.2 newlib-1.19.0 root@bt:~/dublin/build# cd .. root@bt:~/dublin# ls -a . .. build gnu-arm-build.2.sh install src root@bt:~/dublin# cd src root@bt:~/dublin/src# ls -a . .. binutils-2.21.1 binutils-2.21.1a.tar.bz2 gcc-4.5.2 gcc-4.5.2.tar.bz2 newlib-1.19.0 newlib-1.19.0.tar.gz root@bt:~/dublin/src# cd .. root@bt:~/dublin# clear root@bt:~/dublin# ls -a . .. build gnu-arm-build.2.sh install src root@bt:~/dublin# cd build root@bt:~/dublin/build# ls -a . .. binutils-2.21.1 gcc-4.5.2 newlib-1.19.0

1 1

Assigment to TS 0 fails
by Terrel Cooper 02 Sep '13

02 Sep '13

Hello, I figured out that all assigment requests from SDCCH to TCH Timeslot 0 fails. There is no problem for other timeslots. It seems that layer 1 can not sync to ts 0 channel succesfully. Is there anybody who observed this situation ? thanks

1 0

[PATCH] Improve cell_log
by ☎ 29 Aug '13

29 Aug '13

Hi. Attached are set of patches with small improvements to cell_log, si_dump and mcc/mnc printers. Please review and merge if code is ok. -- best regards, Max, http://fairwaves.ru

1 0

[PATCH 4/4] Add filtering and additional information printing to cell_log.
by Max 29 Aug '13

29 Aug '13

--- src/host/layer23/src/misc/app_cell_log.c | 53 ++++++++++++++++++++++++++------ src/host/layer23/src/misc/cell_log.c | 52 +++++++++++++++++++++---------- 2 files changed, 78 insertions(+), 27 deletions(-) diff --git a/src/host/layer23/src/misc/app_cell_log.c b/src/host/layer23/src/misc/app_cell_log.c index a7f42c3..1f69c31 100644 --- a/src/host/layer23/src/misc/app_cell_log.c +++ b/src/host/layer23/src/misc/app_cell_log.c @@ -27,6 +27,7 @@ #include <osmocom/bb/common/osmocom_data.h> #include <osmocom/bb/common/l1ctl.h> +#include <osmocom/bb/common/networks.h> #include <osmocom/bb/common/l23_app.h> #include <osmocom/bb/common/logging.h> #include <osmocom/bb/common/gps.h> @@ -45,6 +46,7 @@ extern uint16_t (*band_range)[][2]; char *logname = "/var/log/osmocom.log"; int RACH_MAX = 2; +uint16_t MCC = 0, MNC = 0, QUIET_PRINT = 0, PRINT_XTRA = 0, SCAN_ONCE = 0; int _scan_work(struct osmocom_ms *ms) { @@ -94,16 +96,21 @@ static int l23_cfg_supported() static int l23_getopt_options(struct option **options) { static struct option opts [] = { - {"logfile", 1, 0, 'l'}, - {"rach", 1, 0, 'r'}, - {"no-rach", 1, 0, 'n'}, + {"logfile", required_argument, NULL, 'l'}, + {"rach", required_argument, NULL, 'r'}, + {"no-rach", no_argument, NULL, 'n'}, #ifdef _HAVE_GPSD - {"gpsd-host", 1, 0, 'g'}, - {"gpsd-port", 1, 0, 'p'}, + {"gpsd-host", required_argument, NULL, 'g'}, + {"gpsd-port", required_argument, NULL, 'p'}, #endif - {"gps", 1, 0, 'g'}, - {"baud", 1, 0, 'b'}, - {"arfcns", 1, 0, 'A'} + {"gps", required_argument, NULL, 'g'}, + {"baud", required_argument, NULL, 'b'}, + {"arfcns", required_argument, NULL, 'A'}, + {"mcc", required_argument, NULL, 'c'}, + {"mnc", required_argument, NULL, 'm'}, + {"quiet", no_argument, NULL, 'q'}, + {"extra", no_argument, NULL, 'x'}, + {"once", no_argument, NULL, 'o'} }; *options = opts; @@ -162,7 +169,11 @@ static int l23_cfg_print_help() printf(" -f --gps DEVICE /dev/ttyACM0. GPS serial device.\n"); printf(" -b --baud BAUDRAT The baud rate of the GPS device\n"); printf(" -A --arfcns ARFCNS The list of arfcns to be monitored\n"); - + printf(" -c --mcc 000 The MCC to look for.\n"); + printf(" -m --mnc 00 The MNC to look for.\n"); + printf(" -q --quiet Do not print additional information.\n"); + printf(" -x --extra Print additional info from SI.\n"); + printf(" -o --once Exit after first scan is complete.\n"); return 0; } @@ -180,6 +191,15 @@ static int l23_cfg_handle(int c, const char *optarg) case 'n': RACH_MAX = 0; break; + case 'q': + QUIET_PRINT = 1; + break; + case 'x': + PRINT_XTRA = 1; + break; + case 'o': + SCAN_ONCE = 1; + break; case 'g': #ifdef _HAVE_GPSD snprintf(g.gpsd_host, ARRAY_SIZE(g.gpsd_host), "%s", optarg); @@ -224,6 +244,19 @@ static int l23_cfg_handle(int c, const char *optarg) parse_band_range((char*)optarg); printf("New frequencies range: %s\n", print_band_range(*band_range, buf, sizeof(buf))); break; + case 'c': + MCC = atoi(optarg); + if (GSM_INPUT_INVALID == MCC) MCC = 0; + else LOGP(DGPS, LOGL_INFO, "Target MCC is %s (%s)\n", gsm_print_mcc(MCC), gsm_get_mcc(MCC)); + break; + case 'm': + MNC = gsm_input_mnc(optarg); + if (GSM_INPUT_INVALID == MNC) MNC = 0; + if (0 != MCC) + LOGP(DGPS, LOGL_INFO, "Target MNC is %s (%s)\n", gsm_print_mnc(MNC), gsm_get_mnc(MCC, MNC)); + else + LOGP(DGPS, LOGL_INFO, "Target MNC is %s\n", gsm_print_mnc(MNC)); + break; } return 0; @@ -234,7 +267,7 @@ cmd_line_error: static struct l23_app_info info = { .copyright = "Copyright (C) 2010 Andreas Eversberg\n", - .getopt_string = "g:p:l:r:nf:b:A:", + .getopt_string = "g:p:l:r:noqxf:b:A:c:m:", .cfg_supported = l23_cfg_supported, .cfg_getopt_opt = l23_getopt_options, .cfg_handle_opt = l23_cfg_handle, diff --git a/src/host/layer23/src/misc/cell_log.c b/src/host/layer23/src/misc/cell_log.c index 7340dcb..8740965 100644 --- a/src/host/layer23/src/misc/cell_log.c +++ b/src/host/layer23/src/misc/cell_log.c @@ -37,6 +37,7 @@ #include <osmocom/gsm/protocol/gsm_04_08.h> #include <osmocom/gsm/rsl.h> +#include <osmocom/bb/common/l23_app.h> #include <osmocom/bb/common/l1ctl.h> #include <osmocom/bb/common/osmocom_data.h> #include <osmocom/bb/common/logging.h> @@ -78,7 +79,7 @@ static struct pm_info { int8_t rxlev_dbm; } pm[1024]; -static int started = 0; +static int started = 0, measured = 0; static int state; static int8_t min_rxlev_dbm = MIN_RXLEV_DBM; static int sync_count; @@ -89,7 +90,11 @@ static int rach_count; static FILE *logfp = NULL; extern char *logname; extern int RACH_MAX; - +extern uint16_t QUIET_PRINT; +extern uint16_t PRINT_XTRA; +extern uint16_t SCAN_ONCE; +extern uint16_t MCC; +extern uint16_t MNC; static struct gsm48_sysinfo sysinfo; @@ -135,14 +140,17 @@ static void log_time(void) LOGFILE("time %lu\n", now); } -static void log_frame(char *tag, uint8_t *data) +static void si_printer(void *priv, const char *fmt, ...) { - int i; + va_list a; + va_start(a, fmt); + fprintf(priv, fmt, a); + va_end(a); +} - LOGFILE("%s", tag); - for (i = 0; i < 23; i++) - LOGFILE(" %02x", *data++); - LOGFILE("\n"); +static void log_frame(char *tag, uint8_t *data) +{ + LOGFILE("%s %s\n", tag, osmo_hexdump(data, 23)); } static void log_pm(void) @@ -183,6 +191,8 @@ static void log_sysinfo(void) int8_t rxlev_dbm; char ta_str[32] = ""; + if (((0 != MCC) && (s->mcc != MCC)) || ((0 != MNC) && (s->mnc != MNC))) return; + if (log_si.ta != 0xff) sprintf(ta_str, " TA=%d", log_si.ta); @@ -198,20 +208,21 @@ static void log_sysinfo(void) rxlev_dbm = meas->rxlev / meas->frames - 110; LOGFILE("rxlev %d\n", rxlev_dbm); if (s->si1) - log_frame("si1", s->si1_msg); + log_frame("si1", s->si1_msg); if (s->si2) - log_frame("si2", s->si2_msg); + log_frame("si2", s->si2_msg); if (s->si2bis) - log_frame("si2bis", s->si2b_msg); + log_frame("si2bis", s->si2b_msg); if (s->si2ter) - log_frame("si2ter", s->si2t_msg); + log_frame("si2ter", s->si2t_msg); if (s->si3) - log_frame("si3", s->si3_msg); + log_frame("si3", s->si3_msg); if (s->si4) - log_frame("si4", s->si4_msg); + log_frame("si4", s->si4_msg); if (log_si.ta != 0xff) LOGFILE("ta %d\n", log_si.ta); - + if (PRINT_XTRA) + gsm48_sysinfo_dump_ext(s, s->arfcn, si_printer, logfp, NULL, 1, 0); LOGFILE("\n"); LOGFLUSH(); } @@ -337,8 +348,10 @@ static void start_sync(void) return; } pm[arfcn].flags |= INFO_FLG_SYNC; - LOGP(DSUM, LOGL_INFO, "Sync ARFCN %d (rxlev %d, %d syncs left)%s\n", - arfcn, pm[arfcn].rxlev_dbm, sync_count--, dist_str); + if (!QUIET_PRINT) { + LOGP(DSUM, LOGL_INFO, "Sync ARFCN %d (rxlev %d, %d syncs left)%s\n", + arfcn, pm[arfcn].rxlev_dbm, sync_count--, dist_str); + } memset(&sysinfo, 0, sizeof(sysinfo)); sysinfo.arfcn = arfcn; state = SCAN_STATE_SYNC; @@ -351,12 +364,17 @@ static void start_pm(void) { uint16_t from, to; + if (measured && SCAN_ONCE) { + l23_app_exit(NULL); + exit(0); + } state = SCAN_STATE_PM; from = (*band_range)[pm_index][0]; to = (*band_range)[pm_index][1]; if (from == 0 && to == 0) { LOGP(DSUM, LOGL_INFO, "Measurement done\n"); + measured = 1; pm_gps_valid = g.enable && g.valid; if (pm_gps_valid) geo2space(&pm_gps_x, &pm_gps_y, &pm_gps_z, -- 1.8.1.2 --------------000206000400030101050401--

1 0

[PATCH 3/4] Make SI printing more flexible.
by Max 29 Aug '13

29 Aug '13

--- .../layer23/include/osmocom/bb/common/sysinfo.h | 3 ++ src/host/layer23/src/common/sysinfo.c | 46 +++++++++++++--------- 2 files changed, 30 insertions(+), 19 deletions(-) diff --git a/src/host/layer23/include/osmocom/bb/common/sysinfo.h b/src/host/layer23/include/osmocom/bb/common/sysinfo.h index f843f27..f0af7ba 100644 --- a/src/host/layer23/include/osmocom/bb/common/sysinfo.h +++ b/src/host/layer23/include/osmocom/bb/common/sysinfo.h @@ -125,6 +125,9 @@ uint8_t gsm_refer_pcs(uint16_t arfcn, struct gsm48_sysinfo *s); int gsm48_sysinfo_dump(struct gsm48_sysinfo *s, uint16_t arfcn, void (*print)(void *, const char *, ...), void *priv, uint8_t *freq_map); +int gsm48_sysinfo_dump_ext(struct gsm48_sysinfo *s, uint16_t arfcn, + void (*print)(void *, const char *, ...), void *priv, + uint8_t *freq_map, uint8_t no_map, uint8_t print_stat); int gsm48_decode_lai(struct gsm48_loc_area_id *lai, uint16_t *mcc, uint16_t *mnc, uint16_t *lac); int gsm48_decode_chan_h0(struct gsm48_chan_desc *cd, uint8_t *tsc, diff --git a/src/host/layer23/src/common/sysinfo.c b/src/host/layer23/src/common/sysinfo.c index b42bd65..3892d1b 100644 --- a/src/host/layer23/src/common/sysinfo.c +++ b/src/host/layer23/src/common/sysinfo.c @@ -68,40 +68,46 @@ uint8_t gsm_refer_pcs(uint16_t arfcn, struct gsm48_sysinfo *s) } int gsm48_sysinfo_dump(struct gsm48_sysinfo *s, uint16_t arfcn, - void (*print)(void *, const char *, ...), void *priv, uint8_t *freq_map) + void (*print)(void *, const char *, ...), void *priv, uint8_t *freq_map) +{ + return gsm48_sysinfo_dump_ext(s, arfcn, print, priv, freq_map, 0, 1); +} + +int gsm48_sysinfo_dump_ext(struct gsm48_sysinfo *s, uint16_t arfcn, + void (*print)(void *, const char *, ...), void *priv, uint8_t *freq_map, uint8_t no_map, uint8_t print_stat) { char buffer[81]; int i, j, k, index; int refer_pcs = gsm_refer_pcs(arfcn, s); - /* available sysinfos */ - print(priv, "ARFCN = %s channels 512+ refer to %s\n", - gsm_print_arfcn(arfcn), - (refer_pcs) ? "PCS (1900)" : "DCS (1800)"); - print(priv, "Available SYSTEM INFORMATIONS ="); - if (s->si1) + if (print_stat) {/* available sysinfos */ + print(priv, "ARFCN = %s channels 512+ refer to %s\n", + gsm_print_arfcn(arfcn), + (refer_pcs) ? "PCS (1900)" : "DCS (1800)"); + print(priv, "Available SYSTEM INFORMATIONS ="); + if (s->si1) print(priv, " 1"); - if (s->si2) + if (s->si2) print(priv, " 2"); - if (s->si2bis) + if (s->si2bis) print(priv, " 2bis"); - if (s->si2ter) + if (s->si2ter) print(priv, " 2ter"); - if (s->si3) + if (s->si3) print(priv, " 3"); - if (s->si4) + if (s->si4) print(priv, " 4"); - if (s->si5) + if (s->si5) print(priv, " 5"); - if (s->si5bis) + if (s->si5bis) print(priv, " 5bis"); - if (s->si5ter) + if (s->si5ter) print(priv, " 5ter"); - if (s->si6) + if (s->si6) print(priv, " 6"); - print(priv, "\n"); - print(priv, "\n"); - + print(priv, "\n"); + print(priv, "\n"); + } /* frequency list */ j = 0; k = 0; for (i = 0; i < 1024; i++) { @@ -173,6 +179,8 @@ int gsm48_sysinfo_dump(struct gsm48_sysinfo *s, uint16_t arfcn, } print(priv, "\n"); + if (no_map) return 0; + /* frequency map */ for (i = 0; i < 1024; i += 64) { sprintf(buffer, " %3d ", i); -- 1.8.1.2 --------------000206000400030101050401 Content-Type: text/x-patch; name="0004-Add-filtering-and-additional-information-printing-to.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename*0="0004-Add-filtering-and-additional-information-printing-to.pa"; filename*1="tch"

1 0

[PATCH 2/4] Declare constant parameters as constant.
by Max 29 Aug '13

29 Aug '13

--- src/host/layer23/include/osmocom/bb/common/networks.h | 4 ++-- src/host/layer23/src/common/networks.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/host/layer23/include/osmocom/bb/common/networks.h b/src/host/layer23/include/osmocom/bb/common/networks.h index d34f316..9311f6f 100644 --- a/src/host/layer23/include/osmocom/bb/common/networks.h +++ b/src/host/layer23/include/osmocom/bb/common/networks.h @@ -17,8 +17,8 @@ const char *gsm_get_mcc(uint16_t mcc); const char *gsm_get_mnc(uint16_t mcc, uint16_t mnc); const char *gsm_imsi_mcc(char *imsi); const char *gsm_imsi_mnc(char *imsi); -const uint16_t gsm_input_mcc(char *string); -const uint16_t gsm_input_mnc(char *string); +const uint16_t gsm_input_mcc(const char *string); +const uint16_t gsm_input_mnc(const char *string); #endif /* _NETWORKS_H */ diff --git a/src/host/layer23/src/common/networks.c b/src/host/layer23/src/common/networks.c index ad2caa6..0bb143f 100644 --- a/src/host/layer23/src/common/networks.c +++ b/src/host/layer23/src/common/networks.c @@ -1852,7 +1852,7 @@ const char *gsm_print_mnc(uint16_t mnc) return string; } -const uint16_t gsm_input_mcc(char *string) +const uint16_t gsm_input_mcc(const char *string) { uint16_t mcc; @@ -1873,7 +1873,7 @@ const uint16_t gsm_input_mcc(char *string) return mcc; } -const uint16_t gsm_input_mnc(char *string) +const uint16_t gsm_input_mnc(const char *string) { uint16_t mnc = 0; -- 1.8.1.2 --------------000206000400030101050401 Content-Type: text/x-patch; name="0003-Make-SI-printing-more-flexible.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="0003-Make-SI-printing-more-flexible.patch"

1 0

[PATCH 1/4] Comment out print duplicating debug output.
by Max 29 Aug '13

29 Aug '13

--- src/host/layer23/src/common/l1ctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/host/layer23/src/common/l1ctl.c b/src/host/layer23/src/common/l1ctl.c index 91bab89..80aa4df 100644 --- a/src/host/layer23/src/common/l1ctl.c +++ b/src/host/layer23/src/common/l1ctl.c @@ -244,7 +244,7 @@ static int rx_ph_data_ind(struct osmocom_ms *ms, struct msgb *msg) } if (dl->fire_crc >= 2) { -printf("Dropping frame with %u bit errors\n", dl->num_biterr); +//printf("Dropping frame with %u bit errors\n", dl->num_biterr); LOGP(DL1C, LOGL_NOTICE, "Dropping frame with %u bit errors\n", dl->num_biterr); msgb_free(msg); -- 1.8.1.2 --------------000206000400030101050401 Content-Type: text/x-patch; name="0002-Declare-constant-parameters-as-constant.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="0002-Declare-constant-parameters-as-constant.patch"

1 0

Re: UI work - qemu and key repeating
by Craig Comstock 29 Aug '13

29 Aug '13

> > I'm writing some UI/firmware [...] > That sounds neat... are you doing it in some visible git repository perchance? I'm just hacking on layer1/main.c right now. Not even sure I would put in a repo since I want to implement some form of t-9 character and word fanciness. Maybe I could make that a module or think of an open-source/free paradigm for entering text w/ the keypad. http://www.google.com/patents?id=PmgCAAAAEBAJ (T9) http://www.google.com/patents/US3967273 (funny bell labs method using two key presses always) (the list goes on and on I think...) My thinking is that I might start with this hacked layer1 and gradually try to bring bits of mobile into the firmware/ui. Also just wanting to fiddle around with how the phone will "feel" with a console interface. aka UI prototyping. Cheers, Craig

1 0

UI work - qemu and key repeating
by Craig Comstock 27 Aug '13

27 Aug '13

Was wondering if anyone has tried to use qemu to make a device emulator? I'm writing some UI/firmware and it seems like it might be a nice way to iterate on code. Also was thinking I would need to rework keypad.c so that I can get key hold/repeat events since I want to know when a key is being held down at some fairly short interval. Any suggestions/previous work/cautions? Thanks, Craig

2 1

chainload.compalram.bin missing?
by Craig Comstock 22 Aug '13

22 Aug '13

I was trying to load some apps to a Motorola C139 and found that after building osmocom-bb that there were no chainload image files built. Am I using the wrong branch somehow? Are the instructions out of date on this page: http://bb.osmocom.org/trac/wiki/MotorolaC140 ./osmocon -p /dev/ttyUSB0 -m c140 -c ../../target/firmware/board/compal_e86/layer1.highram.bin ../../target/firmware/board/compal_e86/chainload.compalram.bin The page mentions something about a magic value that must be placed into memory for the bootloader... could that be added to osmocon somehow so that specifying -m c140 takes care of it? "After the download has completed, it expects the magic string "1003" (0x31 0x30 0x30 0x33) at the RAM address 0x803ce0" Thanks, Craig

3 5

Uplink sniffing
by George Andguladze 22 Aug '13

22 Aug '13

Dear all, I was wondering if uplink sniffing is enabled by default in latest firmware as file "osmocom-bb/src/target/firmware/layer1/prim_sniff.c" has been modified and does not hold "#if 0" bit at line 288 anymore. Thanks, George Andguladze

1 0

howto use osmocom / mobile app without a sim-card
by "Robert Köberl" 19 Aug '13

19 Aug '13

2 1

osmocombb / mobile app ... sms without simcard
by robert 15 Aug '13

15 Aug '13

hello! how is it possible to send a sms without a sim-card in my C123? with simcard its possible ... :-) how to use "sim testcard 1"?

1 0

Re: Calypso/Iota/Rita chip recommendations
by msokolov＠ivan.Harhan.ORG 15 Aug '13

15 Aug '13

Peter Stuge <peter(a)stuge.se> wrote: > > Actually my hope is to build a quad-band phone > That would be neat too. > [...] > I was thinking about phone-as-BTS, but same principle, no > (or just the appropriate) filters. Unfortunately these two goals (quad-band support on the one hand, and filter hackability on the other hand) seem to be in conflict. It seems to me that trying to build a quad-band phone using separate antenna switch and Rx SAW filter components would be very messy, probably too messy for an RF-clean PCB layout - hence necessitating the use of an integrated RF front-end part that has all that mess hidden inside. (See ftp.ifctf.org/pub/GSM/Calypso/M034F.pdf for an example of wha I mean.) But using an integrated RF FEM like that M034F would surely preclude the possibility of filter hacking... Once again, my goal is to produce a Totally Free Phone for everyday use in one's pocket/purse, not GSM hacking - and I reason I must not be the only person on this list who desires such; I reason that there must be other lurkers on this list who watch with frustration as the years go by, there are all kinds of hacks made, but virtually zero progress toward an end-user-usable Free phone. It's obvious that OsmocomBB and FreeCalypso will always be two separate projects: the former focused on GSM hacking and security research, the latter on everyday-phone end-user needs. All I'm hoping for is that the two projects could be at least somewhat amicable, and cooperate in things like amassing hardware knowledge - rather than be all-out hostile. SF

1 0

Re: Calypso/Iota/Rita chip recommendations
by msokolov＠ivan.Harhan.ORG 14 Aug '13

14 Aug '13

Sylvain Munaut <246tnt(a)gmail.com> wrote: > And why exactly should we help you when you publicly stated [1] that > you'd rather shoot us then yourself > [1] http://lists.openmoko.org/pipermail/community/2012-March/066565.html A little clarification is in order: * In my past negative interactions with certain individuals who have previously served as employees or contractors of Openmoko-Inc and who currently serve as lead developers of OsmocomBB, the crux of the dispute was those individuals' unwillingness to share with all Humanity (yes, *all Humanity*, *not* "me" - I could be dead tomorrow and nothing will change) those COFF object files with symbolic information which Om-Inc had received from TI, and/or their voluntary choice to live and/or accept voluntary citizenship in a country that deems such sharing to be illegal - obviously a voluntary choice which I have NOT made. * There has been one major change in the year and a half since that post of mine quoted by Sylvain - I have discovered this: http://scottn.us/downloads/peek/ [In case ScottN, whoever he is, takes the ware down from his website, it's already archived on my mini-Wikileaks at ftp.ifctf.org/pub/GSM/LoCosto - but for as long as ScottN's copy is up, it should be much faster.] The discovery of the above source (which is almost complete source with very little in object-only form) makes it now unnecessary for me to sacrifice my life in a gunfire exchange with German or Russian police in order to free Openmoko's COFF objects - I'm pretty confident in my ability to recreate something very similar, but full-source from this recently discovered "peek" ware and other more recently discovered leaks, also on my FTP site. > than help us in any way ... It is true that I have chosen to use a different Free Software GSM stack (plus UI etc) implementation for my personal use, hence any contributions from me to the software side of the OsmocomBB project are indeed unlikely. However, I am hoping that the project to build new free phone hardware can be done as a joint project between the two camps. The hardware design files will be free for anyone to download and do with as s/he pleases, and obviously each user is free to run whatever software s/he likes: OsmocomBB, FreeCalypso, or some 3rd or 4th or other choice that may exist in the future. SF

2 1

Calypso/Iota/Rita chip recommendations
by msokolov＠ivan.Harhan.ORG 14 Aug '13

14 Aug '13

Hello fellow Calypso phone hackers, Not having found an already-existing Calypso phone that is exactly to my liking (of the ones supported by OsmocomBB, the Pirelli comes closest to my ideal, but even that one has a few things I don't like, and most important of all, the availability of these phones on the market has already shrunk down to zilch - so the day is near when it will be just as legendary-unobtainium as the TSM30), I am setting out to build my own. I am setting out to design and build a new Calypso/Iota/Rita phone, one that will be specifically designed to run Free Software as its firmware: either OsmocomBB or FreeCalypso (my own personal alternative free GSM firmware implementation), up to each user's individual choice. My design will be a phone, not a modem (i.e., complete with the essential UI elements, as in LCD and keypad), and it will be a dumb/plain/feature phone, i.e., the Calypso will be the main/sole CPU - not a smartphone like Openmoko etc. Before I tackle the difficult problem of either making a new plastic case or choosing some existing one, I will start out by building a bare GSM development board - basically a complete phone sans case, built on a non-form-factor-controlled PCB. This development board will probably end up being very similar to the one which Harard Welte has announced here a little over a year ago, but with one major difference: *all* hardware design source files (as in schematic, BOM and PCB layout source) will be openly released, with absolutely nothing withheld, and in fact the development itself will take place in a public source control repository. Therefore, regardless of whether I succeed or fail in the ultimate goal of producing a complete phone packaged in a plastic case, there will be an Open Source Hardware design for a working Calypso GSM board which others will be able to use as a starting point - something that wouldn't be possible (or at least less convenient) with Harald's PDF-schematics-only version. However, the above vaporware announcement is not the real purpose of my post. Instead, I am currently in the negotiations with several Chinese sellers of Calypso/Iota/Rita/etc chips, and I'm soliciting advice on exactly which variant of each chip I should use: * The Calypso chip in both GTA02 and Pirelli DP-L10 (the two existing designs I use as references to be copied whenever it makes sense) is PD751992AZHH. I can easily get this exact part, but I can also get ones with GHH or AGHH suffixes. I'm venturing a guess in that the A seems to go with the 751992 number, i.e., it's part of the die revision, and as to the difference between GHH and ZHH, I'm guessing that it's the RoHS difference: I'm guessing that GHH has balls made of real SnPb solder, whereas ZHH has the "lead-free solder" junk substituted instead. Because I'm very fortunate to NOT live in the EU or anywhere near, I'm not subject to any EU-nian laws like the RoHS idiocy, and I generally prefer to use real SnPb solder whenever possible. So I wonder: can someone confirm if indeed PD751992AGHH is the exact same Calypso chip as the PD751992AZHH used in the GTA02 and Pirelli phones, but with real non-RoHS solder balls instead, or is it something different? * Which Iota variant is better: TWL3014 or TWL3025? I'm thinking TWL3025, reasoning that it being newer probably means having some internal bugfixes or minor improvements, but perhaps the older TWL3014 is better instead? * As to the Rita, the base part number appears to be TRF6151C in all phones currently supported by OsmocomBB, so I'm sticking with this base part number. But there are additional suffixes after the 'C' in that P/N - would anyone happen to know what these suffixes mean, and which variant I should use? * For the RF PA, I see that the GTA02 uses RF3166 from RF Micro Devices (one of Harald Welte's posts regarding his planned Calypso board also mentioned him planning to use the same PA), whereas the Pirelli and most other feature phones supported by OsmocomBB tend to use Skyworks parts instead. Which is better? I'm currently leaning toward the RF3166, but if someone has a recommendation that is actually backed by some knowledge/reason rather than just a guess like mine, I'll listen. :-) * If I do go with the RF3166, any idea as to what the different suffix versions are? TIA for any input, SF

3 4

Re: Calypso/Iota/Rita chip recommendations
by msokolov＠ivan.Harhan.ORG 14 Aug '13

14 Aug '13

Peter Stuge <peter(a)stuge.se> wrote: > It would be neat if you choose a filter part with a footprint that > can also accomodate a balun more easily than in the Compal phones, Actually my hope is to build a quad-band phone (unlike the dual- or tri-band ones we have so far) by copying this reference design from TI: ftp://ftp.ifctf.org/pub/GSM/Calypso/Leonardo_plus_quadband_schem.pdf [The above PDF came from one of the Chinese sites; the /pub/GSM directory of my FTP site above is my own sort of mini-Wikileaks for all things dealing with the Calypso and related things - I encourage everyone to check out the collection of goodies which I've accumulated so far, and which only keeps growing. :-)] As you can see on that schematic, instead of using separate antenna switch and Rx SAW filter parts, the Leonardo reference boards used integrated RF front-end modules - in the case of the quad-band Leonardo Plus, it's a quad-band RF FEM that works perfectly with the Rita. The specific part on that Leonardo+ board seems to be Epcos M034F. A quick search for that part hasn't shown up any availability, but then it was only a very quick search, and even if that specific part isn't available, I reason that there must be functional equivalents from other manufacturers. > so that a phone could be assembled "either way". You mean a filterless sniffer version? I have to admit that sniffing and other GSM hacking aren't really my areas of interest - instead all I want is a 100% "normal" cellphone, but with just one difference: running software/firmware whose full source is physically available (be it legal or otherwise) for the exercise of the Four Freedoms defined by the FSF, as a moral requirement. SF

2 1

Channel Request Info RACH GSMTAP Wireshark?
by dagar 12 Aug '13

12 Aug '13

hello, when reading gsm spec online i have understood that on an MT call the BTS pages the phone on the RR paging channel(PCH) the phone then asks for a channel in the RR channel request (RACH) the BTS replies with RR immediate assignment(AGCH) etc etc Now I have tried to see a live example of this using osmocom-bb layer1/mobile + gsmtap/wirehshark However I cannot figure out or see anywhere in these logs the *RR channel request (RACH) packet*. Does GSMTAP or OsmocomBB actually capture the RR channel request or am I missing something here?? the logs I get are like this (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) System Information Type 1 (CCCH) (RR) System Information Type 2 (CCCH) (RR) System Information Type 3 (CCCH) (SS) (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Immediate Assignment and so on Thanks! -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Channel-Request-Info-RACH-GSMTAP… Sent from the baseband-devel mailing list archive at Nabble.com.

2 1

Filtering in baseband spectrum
by Neela Neela 05 Aug '13

05 Aug '13

Hi I am a beginner with RTL and observing that the baseband spectrum is centred at 0 Hz and is asymmetric going from -1 MHz to +1 MHz. How does one filter a part of such a spectrum? For example if signal of interest lied in -300 kHz to -150 kHz. The filtering techniques for typical band pass filters work with positive frequencies and have symmetric frequency selection response. As such a 150 to 300 KHz band pass filter will select signal in both 150 to 300 kHz band as well as from -150 to 300 kHz. Is there a special filtering method available to work with negative frequencies and with an asymmetric baseband spectrum. I am sure this has been addressed as preassumably the FM and other signals of interest are filtered somehow. Anu indications will be appreciated.

2 2

fmtool error
by Ahmed Gawad 05 Aug '13

05 Aug '13

Hello, I am trying to run osmocom on Motorola C117. Using the following : PC(Ubuntu12 64bit)<---->USB To Serial cable (5v)<---->serial to (3.3V)<---->phone when i press power button all i can get is "fmtoolerror" . and there is no more messages only that . I am wounding if that means the phone is not working properly or it could be a cable issue ? Thanks very much .

1 1

Pirelli DP-L10 display subsystem (was Re: JTAG setup for Pirelli DP-L10)
by ubuntugirl 30 Jul '13

30 Jul '13

On 7/27/13, Steve Markgraf <steve(a)steve-m.de> wrote: > Unfortunately there's only a datasheet of the SPCA554 floating around, > just search for "SPCA554AV02". Found it, thanks. > unfortunately the SPCA552 and 554 seem to have quite a few differences, > so not everything could be figured out. Yeah, the differences do seem big indeed. While I was searching around for an SPCA552E datasheet, I found this: http://www.download.revosupport.com/scp2009_download_folder!/BONUS%20MEMBER… On page 12 of that schematic there's our lovely Sunplus chip. Of course it's a totally different phone, but at least we can see what are the pin interfaces coming off this chip. In the above schematic, we see that SPCA552E connects to just the host CPU, the LCM and the camera - no frills. But the 554 datasheet you've found describes a much more complex device - adds USB, audio, mass storage... > At least it was enough information to get the bypass mode working, > which was my main goal. Were you ever able to figure out just how the backlight works on this display? Your code has a comment about a particular register in the SPCA supposedly turning the BL on or off, but looking at the pin interfaces of this SPCA in the Nokia schematic, I don't see anything even remotely related to the backlight... Yet the original firmware is able to not only turn this BL on and off at will, but also change the brightness - during calls, the display dims instead of blanking completely. On a related note, were you ever able to figure out the pinout of the 30-pin flex between the main PCB and the LCM? If this pinout were known, I could probably trace out the stuff of interest to me (like the backlight) on the main PCB using your layer pictures, but if I have to reverse-eng the LCM itself, that might be a bit above my skill level. :( > Since the SPCA has an integrated 8051 core, you probably need to upload > proprietary code to get the camera working, or you have to rewrite the > firmware for this chip as well... Bummer. But just out of curiosity, how did you figure out that it's an 8051? Did you see the original phone fw pushing something to the SPCA that looked like 8051 instructions? FWIW, the 554 datasheet describes its CPU as a "32-bit RISC processor" - too closed to even name what it is! Kim

2 3

JTAG setup for Pirelli DP-L10
by ubuntugirl 28 Jul '13

28 Jul '13

Hello, I finally got some time to play with OsmocomBB again. It works intermittently on my Pirelli DP-L10: sometimes ok, other times MO call attempts fail inexplicably and there are messages pouring in the vty window about network contact being lost and reestablished. I suspect that the lack of RF calibration may be an issue, especially considering that I'm in PCS land whereas most active developers are in EGSM/DCS. So I got this crazy idea: what if we can figure out where and how the original factory calibration values are stored, and make use of them? It looks like the last 64kb sector of the flash (at 0x027f0000 as seen by the cpu) is where the factory data are stored, but the format looks incomprehensible. :( So here's what I'm thinking: I would like to try putting JTAG on this phone, and using a hardware watchpoint to catch where the proprietary fw reads from the 0x027f0000-0x027fffff region. I saw in the Wiki that there is an unpopulated footprint for a JTAG connector, and upon taking my phone apart, I have confirmed that it's there indeed. But I wonder, has anyone here (steve-m perhaps?) actually used this JTAG interface and got it to work? If someone has, I'd like to ask the following: * What connector part did you populate on that footprint? * What actual JTAG adapter gadget did you use? * How did you connect that JTAG adapter gadget to the phone? Thanks, Kim

2 3

Calypso phone with RX filters removed
by George Andguladze 16 Jul '13

16 Jul '13

Hi List, Could anyone suggest me where to buy a C155 with RX filters removed? My soldering skills are not that great so I am trying to avoid buying the filter replacement kit from here http://shop.sysmocom.de/products/osmocombb-filter-kit and doing it myself. It seems from the mailing list (http://comments.gmane.org/gmane.comp.mobile.osmocom.baseband.devel/1840) that you could buy it from shop.sysmocom.de, but not anymore? Kind Regards George AndguladzeSenior Software EngineerBusiness Management Technology www.bmt.ge

1 0

[ADMIN] Wanted: List moderator
by Harald Welte 08 Jul '13

08 Jul '13

Dear Osmocom community, I'm currently looking for one or multiple volunteers who are willing to tend to the mailman 'moderator queue' of the various osmocom mailing lists (baseband-devel, openbsc, simtrace, tetra, osmocom-pcu, ...) Our lists are 'member posting only' to protect them from spam. This means that spammers will be caught in the list moderation queue together with the occasional legitimate message from a non-subscriber. You need to manually look over that queue in the mailman web interface, select those legitimate posts as 'approve' and 'defer' all others. The task requires very few minutes, but it requires them every day or second day. It is a perfect opportunity how non-developers can contribute to the project :) Please let me know if anyone is willing to take care of this. Thanks! Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

3 2

Sdcch to TCH
by Akib Sayyed 30 Jun '13

30 Jun '13

can current master perform BCCH-> SDCCH->TCH? -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

1 0

scapy gsm-um with trx firmware?
by Miguel Rios 17 Jun '13

17 Jun '13

Hi list, Since getting Sylvain's transceiver to work with my C118, I started to look at scapy and specifically the gsm-um code as another interesting tool in the fuzzer's arsenal. I see that Laurent Weber's personal website, http://0xbadcab1e.lu/scapy_gsm_um-howto.txt, where he apparently had posted some examples and tips on playing with his code, is no longer available. Does anyone have a copy of those instructions? Has anyone tried running gsm-um with the TRX firmware? Any tips or pointers before I dive in? Cheers, Miguel

5 6

no transceiver binary inside src/host/layer23/src/transceiver folder after running make
by Miguel Rios 13 Jun '13

13 Jun '13

Hi list, I'm trying to experiment with Sylvain's transceiver as per the wiki here http://bb.osmocom.org/trac/wiki/Software/Transceiver I think that I may be doing something wrong when making in that I can see no transceiver binary inside /osmocom-bb/src/host/layer23/src/transceiver. The host/layer23/src/transceiver folder is created properly. After running make HOST_layer23_CONFARGS=--enable-transceiver, I don't see any transceiver binary in there, so naturally OpenBTS fails when I execute the exec <your path to osmocom-bb>/src/host/layer23/src/transceiver/transceiver 1 script. I also don't see any errors when running make, although it scrolls by so fast it is hard to be sure. Thanks, Miguel

2 3

osmocombb not stable
by John Wu 12 Jun '13

12 Jun '13

Hi list, I test osmocombb with C118. At the beginning everything seems ok. but after some minutes osmocombb can not camp to any cell. osmocon print the all cell rssi are -138dbm. Then I reload the ram firmware it camp the cell again. since osmocombb do not do release. So anyone know which version in the git is stable version. Regards

1 0

decoding raw sdcch
by Akib Sayyed 11 Jun '13

11 Jun '13

I am trying to decode raw bits god from burst_ind to get detail info about channel assignment. but i am unable to do so. here are steps i used. take raw bites (23 bits) create lapdm entity and then provide message and try to decode (fails) i get correct system information but not asssignment message. can some one please list details on decoding sdcch. i am using burst_ind branch. -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

1 0

Re: Any interest for Osmocom meetings in Bavaria ?
by Dieter Spaar 11 Jun '13

11 Jun '13

So far three persons have indicated their interest to join a meeting at my place. Considering the time it takes to drive to my place, it probably makes sense to have the meeting at the weekend (either Saturday or Sunday) so that there is more time for the meeting itself. I can suggest one of the following dates for the first meeting, somewhere between 10:00 to 18:00 on each day: 25.8. (Sa) or 26.8. (Su) 1.9. (Sa) or 2.9. (Su) 8.9. (Sa) or 9.9. (Su) So please let me know when you have time and also make suggestions in which Osmocom topic you are interested in so that we can have some sort of agenda for the meeting to make best use of the time. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

13 42

umts rrc question
by ☎ 10 Jun '13

10 Jun '13

Hi all. I've problem reading umts standard etsi ts 125.331 - for example 10.2.11 DOWNLINK DIRECT TRANSFER does not specify length of "message type" or "rrc transaction id", it only references 10.3.3.36 which do not specify length as well - only "Integer (0..3)". Where do I look up the actual bit lengths? As far as I recall in gsm spec it was given right away. I've tried to read asn in wireshark/asn1/rrc but got myself only same "Integer (0..3)" and attempt to read generated code makes my brain reboot. I've tried to compile it with erlc and use parsers as is but hit "function not exported" - I don't know enough erlang yet to fix this. -- best regards, Max, http://fairwaves.ru

2 1

Getting burst in binary format for Kraken
by Obscura 10 Jun '13

10 Jun '13

I sniffed some data in UDP (GSMTAP) format using osmocon, ccch_scan and Wireshark . Next step is "feeding" recived data to Kraken. But i need it in binary format. How can i get data in suitable format (114 bit per burst)?

1 0

TOA in burst_ind
by Akib Sayyed 06 Jun '13

06 Jun '13

Hi Sylvain I wanted to know unit for TOA means, is it in miliseconds,nanoseconds etc. help is appreciated -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

2 2

RE: Cannot open serial device /dev/ttyUSB0
by George Andguladze 04 Jun '13

04 Jun '13

No it doesn't. > From: ml(a)mail.tsaitgaist.info > To: baseband-devel(a)lists.osmocom.org > Subject: Re: Cannot open serial device /dev/ttyUSB0 > Date: Tue, 4 Jun 2013 11:29:13 -0700 > > Excerpts from George Andguladze's message of 2013-06-04 10:40:35 -0700: > > Cannot open serial device /dev/ttyUSB0 > > > > I am getting this error message when I try to connect to my C155 phone and upload hello_world.compalram.bin using this command: > > > > ./osmocon -p /dev/ttyUSB0 -m c155 ../../target/firmware/board/compal_e99/hello_world.compalram.bin > > > > Even though device ttyUSB0 exists in my /dev/ directory, and I have set modprobe cp210x, and chmod 777 /dev/ttyUSB0. > > instead of setting 777 permissions on this device, you can simply add yourself to the dialout group (it's the more proper way) > here the debian command (don't forget to log out and in again for this to take effect) > sudo adduser $USER dialout > > > crw-rw---- 1 root dialout 4, 71 2013-06-04 20:40 /dev/ttyS7 > > crw-rw---- 1 root dialout 4, 72 2013-06-04 20:40 /dev/ttyS8 > > crw-rw---- 1 root dialout 4, 73 2013-06-04 20:40 /dev/ttyS9 > > crwxrwxrwx 1 root dialout 188, 0 2013-06-04 21:07 /dev/ttyUSB0 > > > > > > What is it that I am doing wrong? > > does it work with root rights (using sudo)? > > kevin >

1 0

sim reading hanged
by Akib Sayyed 02 Jun '13

02 Jun '13

while running mobile app. mobile app stuck giving following output <000f> sim.c:151 sending result to callback function (type=0) <0005> subscriber.c:379 received KEY from SIM <0005> subscriber.c:601 Requesting SIM file 0x6f30 <000f> sim.c:209 got new job: SIM_JOB_READ_BINARY (handle=00000004) <000f> sim.c:241 SELECT (file=0x6f30) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) <000f> sim.c:876 received APDU (len=0 sw1=0x9f sw2=0x0f) <000f> sim.c:949 command successfull <000f> sim.c:571 GET RESPONSE (len=15) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xc0) <000f> sim.c:876 received APDU (len=15 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:1065 selected file (len 249) <000f> sim.c:277 READ BINARY (offset=0 len=249) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xb0) output of layer1 is SIM Response (17): 00 00 00 0b 6f 7e 04 00 11 ff 1b 21 02 00 00 90 00 LOST 1923! LOST 1827! SIM Request (5): a0 b0 00 00 0b SIM Response (13): ff ff ff ff ff ff ff 00 00 ff 01 90 00 SIM Request (7): a0 a4 00 00 02 6f 20 SIM Response (2): 9f 0f SIM Request (5): a0 c0 00 00 0f LOST 1878! LOST 1873! SIM Response (17): 00 00 00 09 6f 20 04 00 11 ff bb 01 02 00 00 90 00 SIM Request (5): a0 b0 00 00 09 SIM Response (11): ff ff ff ff ff ff ff ff 07 90 00 SIM Request (7): a0 a4 00 00 02 6f 30 SIM Response (2): 9f 0f SIM Request (5): a0 c0 00 00 0f LOST 1880! LOST 1870! SIM Response (17): 00 00 00 f9 6f 30 04 00 11 ff bb 21 02 00 00 90 00 SIM Request (5): a0 b0 00 00 f9 LOST 1880! LOST 1870! Please help me solve this issue -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

1 0

[PATCH] * Bugfix in Firmware: initialising variables
by Bhaskar11 28 May '13

28 May '13

2 3

Suggestions required to implement Calypso BTS with GPRS (minimal)
by Altaf 27 May '13

27 May '13

I have been successful in running the calypso BTS and registering phones to it. I have also examined the source code implemented. I am currently doing an Internship in Berlin and the company wants to demonstrate to it customers that 2G services are not secure. Basically we are designing a securtiy demonstrator. We want to do man-in-the-middle attacks with the existing open source s/w. So we thought a B100 USrp would be the need of the hour. But I am really interested working with the calypso phones because I am comfortable with the source code and have already worked on it. I want to try (do) implementing the GPRS functionality to this calypso BTS. Since the work is mostly involved at Layer1 or lets say transceiver. I tried running OpenBTS-gprs version and resulted with some info. The mframe_sched in the trx doesnt contain info about the how to handle packet channels or the multiframes do not have the Packet channels. So when the BTS assigns (on CCCH) a dedicated channel and the calypso phone fails to receive uplink or doesnt provide a way for the phone to access the BTS. I understand the working of trx and want to add this GPRS functionality to trx. I am aiming to implement minimal GPRS functionality. I have also seen how OpenBTS-gprs has triggers this packet channel or the way multiframes handle PDCH, PTCH.. By observing them I can get some idea. In this regard I request from you few suggestions such as where I have to work more and what are the challenges I will face. your suggestions are valuable to me. -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Suggestions-required-to-implemen… Sent from the baseband-devel mailing list archive at Nabble.com.

1 0

Re: flashing problem fixed
by Bhaskar11 23 May '13

23 May '13

The two patches I have posted (separately) relating to "msgb_pull" use in Osmocom and firmware are required to fix the flashing problem! With these patches, I am able to use all the flash functions now. I still need to load the file "loader.e88loader.bin" which does not appear in my compile, as mentioned in a separate email. I bricked a phone by aborting the flashing at that stage! :-( Any advice on this will be appreciated. B. On Thu, May 23, 2013 at 5:51 PM, Akib Sayyed <akibsayyed(a)gmail.com> wrote: > bhaskar > > Have you solved issue with flashing. > > > On Thu, May 23, 2013 at 4:44 PM, Bhaskar11 <niceguy108(a)gmail.com> wrote: > >> Patched in format according to guidelines. >> >> B. >> >> > > > -- > Akib Sayyed > Matrix-Shell > akibsayyed(a)gmail.com > akibsayyed(a)matrixshell.com > Mob:- +91-966-514-2243 > >

1 0

Patch by email
by Bhaskar11 23 May '13

23 May '13

I have some problem sending patches by "git send-email" since I am working in a Windows system. My next email is an experimental workaround. Please let me know if it works ok. B.

1 0

PATCH: Bugfix in Firmware loader main.c: Assigning correct value to data pointer
by Bhaskar11 23 May '13

23 May '13

Patched in format according to guidelines. B.

2 1

[PATCH] Bugfix in Firmware primfbsb.c "return" with a value in function returning void
by Bhaskar11 23 May '13

23 May '13

1 0

[PATCH] * Bugfix in firmware trf5151.c: Setting correct mask for ARFCN value
by Bhaskar11 23 May '13

23 May '13

1 0

Some Patch files
by Bhaskar11 23 May '13

23 May '13

Here are some bug fix and corrections patches. This is my first attempt, so please forgive errors and let me know if there is any problem. B.

4 5

Re: bad crc in osmoload [SOLVED!] (updated patch)
by Bhaskar11 23 May '13

23 May '13

Here is a better Patch more consistent with rest of OsmocomBB coding style and more elegant. Please ignore previous patch offered (which works also but is relatively kludgy). B. On Wed, May 22, 2013 at 10:57 PM, Bhaskar11 <niceguy108(a)gmail.com> wrote: > Solved the "bad crc" problem in Osmoload. > > The bug was inadvertently introduced in osmoload.c in update SHA > ID 6ce46e7a86f4de0b1eef9c641ef6cfb49f1255cd on 9.9..2012 when msgb_get() > was replaced by msgb_pull() as part of a large scale change. Looks like no > one else had tried a "osmoload memdump" since then. > > Am enclosing patch to fix this bug. > > B. > > > > On Tue, May 14, 2013 at 5:26 PM, Bhaskar11 <niceguy108(a)gmail.com> wrote: > >> Hi all, >> >> I'm trying to flash RSSI app to my C118 following instructions on >> http://bb.osmocom.org/trac/wiki/flashing. >> >> First step Osmocon with loader works fine. >> >> Second step with "osmoload memdump 0x000000 0x2000 compal_loader.bin" >> gives the following output: >> >> Dumping 8192 bytes of memory at 0x0 to file compal_loader.bin >> >> bad crc 4190 (not 0000) at offset 0x00000000 >> bad crc f041 (not b209) at offset 0x000000f0 >> bad crc f041 (not 79d3) at offset 0x000001e0 >> ... >> bad crc f041 (not fe61) at offset 0x00001e00 >> bad crc 8257 (not 4cd6) at offset 0x00001ef0 >> bad crc a401 (not 0000) at offset 0x00001fe0done. >> >> Would appreciate any guidance on what I can do to set this right. >> >> A general question: >> If I flash RSSI app succesfully, can I later restore the original C118 >> code and use the cell as before? (assuming I have saved the full memory >> dump to disk!) Or is that gone for good? >> >> Thanks for your guidance. >> >> B. >> >> >> >

2 1

Re: bad crc in osmoload [SOLVED!]
by Bhaskar11 22 May '13

22 May '13

Solved the "bad crc" problem in Osmoload. The bug was inadvertently introduced in osmoload.c in update SHA ID 6ce46e7a86f4de0b1eef9c641ef6cfb49f1255cd on 9.9..2012 when msgb_get() was replaced by msgb_pull() as part of a large scale change. Looks like no one else had tried a "osmoload memdump" since then. Am enclosing patch to fix this bug. B. On Tue, May 14, 2013 at 5:26 PM, Bhaskar11 <niceguy108(a)gmail.com> wrote: > Hi all, > > I'm trying to flash RSSI app to my C118 following instructions on > http://bb.osmocom.org/trac/wiki/flashing. > > First step Osmocon with loader works fine. > > Second step with "osmoload memdump 0x000000 0x2000 compal_loader.bin" > gives the following output: > > Dumping 8192 bytes of memory at 0x0 to file compal_loader.bin > > bad crc 4190 (not 0000) at offset 0x00000000 > bad crc f041 (not b209) at offset 0x000000f0 > bad crc f041 (not 79d3) at offset 0x000001e0 > ... > bad crc f041 (not fe61) at offset 0x00001e00 > bad crc 8257 (not 4cd6) at offset 0x00001ef0 > bad crc a401 (not 0000) at offset 0x00001fe0done. > > Would appreciate any guidance on what I can do to set this right. > > A general question: > If I flash RSSI app succesfully, can I later restore the original C118 > code and use the cell as before? (assuming I have saved the full memory > dump to disk!) Or is that gone for good? > > Thanks for your guidance. > > B. > > >

1 0

[PATCH] * Bugfix in Firmware: initialising variables
by Bhaskar 22 May '13

22 May '13

Under specific circumstances, these variables would have been used without initialisation. --- src/target/firmware/apps/loader/main.c | 2 +- src/target/firmware/layer1/mframe_sched.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/target/firmware/apps/loader/main.c b/src/target/firmware/apps/loader/main.c index 8bdbc74..c74c045 100644 --- a/src/target/firmware/apps/loader/main.c +++ b/src/target/firmware/apps/loader/main.c @@ -213,7 +213,7 @@ static void cmd_handler(uint8_t dlci, struct msgb *msg) uint8_t command = msgb_pull_u8(msg); - int res; + int res = 0; flash_lock_t lock; diff --git a/src/target/firmware/layer1/mframe_sched.c b/src/target/firmware/layer1/mframe_sched.c index f3a6b43..047d709 100644 --- a/src/target/firmware/layer1/mframe_sched.c +++ b/src/target/firmware/layer1/mframe_sched.c @@ -343,7 +343,7 @@ static const struct mframe_sched_item *sched_set_for_task[32] = { /* encodes a channel number according to 08.58 Chapter 9.3.1 */ uint8_t mframe_task2chan_nr(enum mframe_task mft, uint8_t ts) { - uint8_t cbits; + uint8_t cbits = 0; switch (mft) { case MF_TASK_BCCH_NORM: -- 1.7.9 --047d7bdc15d456c2b204dd61e109 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div><font face=3D"courier new, monospace">From d1ad22fa60= e9d52bac246391b2fb6de57fb067b7 Mon Sep 17 00:00:00 2001</font></div><div><f= ont face=3D"courier new, monospace">From: Bhaskar <<a href=3D"mailto:nic= eguy108(a)gmail.com">niceguy108(a)gmail.com</a>></font></div> <div><font face=3D"courier new, monospace">Date: Wed, 22 May 2013 13:08:02 = +0530</font></div><div><font face=3D"courier new, monospace">Subject: [PATC= H] * Bugfix in Firmware: initialising variables</font></div><div><font face= =3D"courier new, monospace"><br> </font></div><div><font face=3D"courier new, monospace">Under specific circ= umstances, these variables would have been used without initialisation.</fo= nt></div><div><font face=3D"courier new, monospace"><br></font></div><div><= font face=3D"courier new, monospace">---</font></div> <div><font face=3D"courier new, monospace">=A0src/target/firmware/apps/load= er/main.c =A0 =A0| =A0 =A02 +-</font></div><div><font face=3D"courier new, = monospace">=A0src/target/firmware/layer1/mframe_sched.c | =A0 =A02 +-</font= ></div><div><font face=3D"courier new, monospace">=A02 files changed, 2 ins= ertions(+), 2 deletions(-)</font></div> <div><font face=3D"courier new, monospace"><br></font></div><div><font face= =3D"courier new, monospace">diff --git a/src/target/firmware/apps/loader/ma= in.c b/src/target/firmware/apps/loader/main.c</font></div><div><font face= =3D"courier new, monospace">index 8bdbc74..c74c045 100644</font></div> <div><font face=3D"courier new, monospace">--- a/src/target/firmware/apps/l= oader/main.c</font></div><div><font face=3D"courier new, monospace">+++ b/s= rc/target/firmware/apps/loader/main.c</font></div><div><font face=3D"courie= r new, monospace">@@ -213,7 +213,7 @@ static void cmd_handler(uint8_t dlci,= struct msgb *msg)</font></div> <div><font face=3D"courier new, monospace">=A0</font></div><div><font face= =3D"courier new, monospace">=A0<span class=3D"" style=3D"white-space:pre"> = </span>uint8_t command =3D msgb_pull_u8(msg);</font></div><div><font face= =3D"courier new, monospace">=A0</font></div> <div><font face=3D"courier new, monospace">-<span class=3D"" style=3D"white= -space:pre"> </span>int res;</font></div><div><font face=3D"courier new, mo= nospace">+<span class=3D"" style=3D"white-space:pre"> </span>int res =3D 0;= </font></div> <div><font face=3D"courier new, monospace">=A0</font></div><div><font face= =3D"courier new, monospace">=A0<span class=3D"" style=3D"white-space:pre"> = </span>flash_lock_t lock;</font></div><div><font face=3D"courier new, monos= pace">=A0</font></div> <div><font face=3D"courier new, monospace">diff --git a/src/target/firmware= /layer1/mframe_sched.c b/src/target/firmware/layer1/mframe_sched.c</font></= div><div><font face=3D"courier new, monospace">index f3a6b43..047d709 10064= 4</font></div> <div><font face=3D"courier new, monospace">--- a/src/target/firmware/layer1= /mframe_sched.c</font></div><div><font face=3D"courier new, monospace">+++ = b/src/target/firmware/layer1/mframe_sched.c</font></div><div><font face=3D"= courier new, monospace">@@ -343,7 +343,7 @@ static const struct mframe_sche= d_item *sched_set_for_task[32] =3D {</font></div> <div><font face=3D"courier new, monospace">=A0/* encodes a channel number a= ccording to 08.58 Chapter 9.3.1 */</font></div><div><font face=3D"courier n= ew, monospace">=A0uint8_t mframe_task2chan_nr(enum mframe_task mft, uint8_t= ts)</font></div> <div><font face=3D"courier new, monospace">=A0{</font></div><div><font face= =3D"courier new, monospace">-<span class=3D"" style=3D"white-space:pre"> </= span>uint8_t cbits;</font></div><div><font face=3D"courier new, monospace">= +<span class=3D"" style=3D"white-space:pre"> </span>uint8_t cbits =3D 0;</f= ont></div> <div><font face=3D"courier new, monospace">=A0</font></div><div><font face= =3D"courier new, monospace">=A0<span class=3D"" style=3D"white-space:pre"> = </span>switch (mft) {</font></div><div><font face=3D"courier new, monospace= ">=A0<span class=3D"" style=3D"white-space:pre"> </span>case MF_TASK_BCCH_N= ORM:</font></div> <div><font face=3D"courier new, monospace">--=A0</font></div><div><font fac= e=3D"courier new, monospace">1.7.9</font></div><div><br></div></div> --047d7bdc15d456c2b204dd61e109--

1 0

Query on TPU doc
by Bhaskar11 18 May '13

18 May '13

The TPU Debugger code lists: static const char *tpu_addr_name[0x1f] = { [0] = "TSP_CTLR1", [1] = "TSP_CTRL2", [*4*] = "TSP_TX_*1*", [*3*] = "TSP_TX_*2*", [*2*] = "TSP_TX_*3*", [5] = "TSP_TX_4", [6] = "TSPACT_L", ...... Was wondering if the numbering is a typo. Could not find documentation online. Just bringing to your notice for check. Could you please confirm that items 2,3,4 are not supposed to be in sequence. Thanks. B.

2 1

Game Snake for OsmocomBB
by Marcel `sdrfnord` McKinnon 17 May '13

17 May '13

Hi everyone I have hacked the game Snake for OsmocomBB. It was mostly for my own education and I thought I make a short announcement on this list that such piece of code also exists. Feel free to play around with it and merge it in the project repository if you want. Code: https://github.com/sdrfnord/osmocom-bb/tree/sdrfnord/ui A picture of the game: http://www.flickr.com/photos/sdrfnord/8626533489/in/photostream I developed and tested it for the C121. During development I also implemented fb_set_p to set one pixel and fb_bw8_line to draw a line. (For the ST7558 LC Display Controller) The code for fb_bw8_line is copied from http://de.wikipedia.org/w/index.php?title=Bresenham-Algorithmus&stable=1#Ko… I hope this does not interfere with the GPL … Another thing I added is twl3025_power_off_now for a fast reboot which I used for development. -- Kind regards Marcel `sdrfnord` McKinnon

1 0

[osmocom] Fucking battery
by choukoumoun 14 May '13

14 May '13

Hello My Motorola batteries are all swollen and therefore defective. anyone has a solution for connecting to power directly to the battery connector by usb? I thought used a 3.7V zener diodes in parallel between the - and + USB power and a series resistor. Thank you.

4 6

Which is the best branch for running mobile on DP-L10?
by ubuntugirl 13 May '13

13 May '13

Hello, I have just got myself a Pirelli DP-L10, and I would like to use it to demonstrate OsmocomBB to my local LUG. I would like to demonstrate mobile, talking to layer1 via osmocon, making and receiving a voice call, sending and receiving SMS. I only have a few basic questions: - Should I use the master branch in osmocom-bb git, or one of the other branches? The Branches page in the wiki is blank. - Am I correct in my understanding that, at least in some branch (see above), osmocom-bb does support this phone well enough to actually make a call? (Yes, I realize that layers 2&3 run on an attached host, hence the phone has to be tethered to a laptop running osmocon and mobile the whole time, and I do know how to enable Tx in the target build. :) - How is the voice routing implemented? Do I need to use lcr integration on the host, or will the audio come out of the phone's own speaker even though all higher layers of the stack are running on the PC? If the voice call audio does go through the phone's own speaker and mic, which ones? This phone model has both an earpiece speaker and a loudspeaker, plus the usual analog headset jack. Which of these audio routing options are supported, if any? Thanks everyone for this awesome project! I can't wait to show it working to my LUG. Kim

5 6

Pirelli DPL-10 nuttx work in progress?
by Craig Comstock 04 May '13

04 May '13

Hi all, So now I have nuttx console working via IRDA on my Pirelli DPL-10 phone. Here are my next steps... I wanted to see if anyone else was working on these? - port the osmocom fb driver over to a nuttx lcd driver - get layer1 + some version of "mobile" working on the device - write a custom UI so this can be my daily driver - and in relation to the last item... send a finished phone w/ firmware to be certified by the FCC? http://transition.fcc.gov/oet/ea/procedures.html Does that sound about right? Anybody working on any of these bits? I'm not expecting this to happen overnight by any means... just expect it to be interesting and a good learning experience. Thanks, Craig

2 1

Pirelli DPL10 - nuttx and dump flash for restore later
by Craig Comstock 02 May '13

02 May '13

Hey folks, I got my Pirelli DPL10 yesterday and was able to get hello world, rssi, layer1 etc up and working pretty easily. It's quite a bit easier than the other phones I was trying to use with my RaspberryPi. I was wondering if someone could give me a nudge on how to get started getting nuttx working on this phone? Also I'd like to ask if there are directions somewhere on how to save the standard software presently on the phone so I can restore it later. I looked at osmoload but didn't quite understand what to do. finfo seemed to come back with all zeros for information and I confirmed that ping received a pong from the phone. My goal is to work towards using osmocom/nuttx to make this phone my daily use phone. Thanks, Craig

3 5

LOGP and Changes to lapdm.c and lapdm.h
by Arslan Anjum 28 Apr '13

28 Apr '13

Good evening all or whatever time it is there! 1. For debugging I have added a FILE* opf; member to lapdm_entity struct in lapdm.h But when I try to initialize this file pointer in mobile_init function in app_mobile.c I get a compile time error that lapdm_entity does not have a member named 'opf'. 2. When I declare the same member in osmocom_ms struct I don't get this error. 3. Furthermore, any changes I make to lapdm.c don't show up on runtime. I can quote specific examples but the mail would get long. Lastly is there any documentation on for LOGP and how to see it's different log levels. Regards, Arslan

2 4

cell_log + gsmmap = KML without positions
by Matthias Meisser 22 Apr '13

22 Apr '13

Hi list, sorry for abusing the list for a somewhat support request but unfortunatly I didn't got answers in the IRC. I'm interested to use BB for some experiments on mapping GSM cells (opencellid.org and similar). So I finally got cell_log to work and my general BB setup works fine here on my laptop. But even with a working GPS, I don't get any positions in the osmocom logfile or the resulting kml by gsmap. Here is what I do: I pair my Bluetooth GPS via sudo rfcomm connect /dev/rfcomm0 00:AA:BB:CC:DD:EE I test it via sudo cat /dev/rfcomm0 and it prints the usual NMEA stuff I connect my mobile C123 and fire up osmocon with L23: sudo ./osmocon -p /dev/ttyUSB0 -m c123xor '/home/matthias/opencellid/osmocom-bb/src/target/firmware/board/compal_e88/layer1.compalram.bin' After upload I start cell_log sudo ./cell_log -f /dev/rfcomm0 which looks ok: <0010> app_cell_log.c:216 Using GPS serial device /dev/rfcomm0 Failed to connect to '/tmp/osmocom_sap'. Failed during sap_open(), no SIM reader <000e> cell_log.c:804 Scanner initialized Mobile initialized, please start phone now! <000e> cell_log.c:368 Measure from 0 to 124 <000e> cell_log.c:368 Measure from 512 to 885 <000e> cell_log.c:368 Measure from 955 to 1023 <000e> cell_log.c:359 Measurement done <000e> cell_log.c:341 Sync ARFCN 17 (rxlev -59, 421 syncs left) <000e> cell_log.c:341 Sync ARFCN 675 (rxlev -62, 420 syncs left) <000e> cell_log.c:341 Sync ARFCN 85 (rxlev -65, 419 syncs left) <000e> cell_log.c:191 Cell: ARFCN=85 MCC=262 MNC=01 (Germany, T-Mobile) <000e> cell_log.c:341 Sync ARFCN 47 (rxlev -66, 418 syncs left) <000e> cell_log.c:191 Cell: ARFCN=47 MCC=262 MNC=01 (Germany, T-Mobile) <000e> cell_log.c:341 Sync ARFCN 6 (rxlev -73, 417 syncs left) <000e> cell_log.c:191 Cell: ARFCN=6 MCC=262 MNC=02 (Germany, Vodafone) <000e> cell_log.c:341 Sync ARFCN 75 (rxlev -73, 416 syncs left) <000e> cell_log.c:191 Cell: ARFCN=75 MCC=262 MNC=02 (Germany, Vodafone) <000e> cell_log.c:341 Sync ARFCN 671 (rxlev -73, 415 syncs left) <000e> cell_log.c:341 Sync ARFCN 22 (rxlev -75, 414 syncs left) <000e> cell_log.c:341 Sync ARFCN 25 (rxlev -75, 413 syncs left) <000e> cell_log.c:341 Sync ARFCN 20 (rxlev -77, 412 syncs left) <000e> cell_log.c:341 Sync ARFCN 90 (rxlev -78, 411 syncs left) But it doesn't write any positions at the logfile nor shows that it got a working GPS position. Only at a few starts I saw this line coming up: <000e> cell_log.c:804 Scanner initialized Mobile initialized, please start phone now! NMEA checksum error So I tried to set the baud rate but this message doesn't seem to be reproducable. Is there anything else I can do, or might it be some kind of software bug for my specific setup? cya, Matthias

1 0

Layer2/3 Misc apps
by R. Revert 17 Apr '13

17 Apr '13

Hello I hope someone can help me whit this , that i dont understand, the sap_open() function... i already make in C115 , c139 and C118 (actually the C118 is not support for latino america) the Hello_world, Layer1 and Rssi, Im using a Latino american Sim card from Claro and Telefonica.. he provider are actually using GSM 850-1900 MHz.band Actually im trying to log in the Wireshark the GSM calls, sms and other's stuff to look at it... but when i try to run the "Misc apps " all the apps get me the same error- **** Failed to connect to '/tmp/osmocom_sap'. Failed during sap_open(), no SIM reader **** when i try to find this file is not created. root@cyttek:/opt/cellphone/osmocom-bb/src/host/layer23/src/misc# file /tmp/osmocom_* /tmp/osmocom_l2: socket /tmp/osmocom_loader: socket I find that is the file for the process of simcard reader (if im not wrong) .. but actually i didnt find the file its not created.. any one knows whats the problem or how i can dump to wireshark the stuff.? thanks... ================================================================================ root@raf10x:/opt/cellphone/osmocom-bb/src/host/layer23/src/misc# *./ccch_scan * Copyright (C) 2010 Harald Welte <laforge(a)gnumonks.org> Contributions by Holger Hans Peter Freyther License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html > This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Failed to connect to '/tmp/osmocom_sap'. Failed during sap_open(), no SIM reader ^CSignal 2 recevied. ================================================================================ root@raf10x:/opt/cellphone/osmocom-bb/src/host/layer23/src/misc# *./bcch_scan * Copyright (C) 2010 Harald Welte <laforge(a)gnumonks.org> Contributions by Holger Hans Peter Freyther License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html > This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Failed to connect to '/tmp/osmocom_sap'. Failed during sap_open(), no SIM reader ^CSignal 2 recevied. ================================================================================ root@raf10x:/opt/cellphone/osmocom-bb/src/host/layer23/src/misc# *./cbch_sniff * Copyright (C) 2010 Harald Welte <laforge(a)gnumonks.org> Contributions by Holger Hans Peter Freyther License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html > This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Failed to connect to '/tmp/osmocom_sap'. Failed during sap_open(), no SIM reader ^CSignal 2 recevied. ================================================================================ root@raf10x:/opt/cellphone/osmocom-bb/src/host/layer23/src/misc#*./cell_log * Copyright (C) 2010 Andreas Eversberg License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html > This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Failed to connect to '/tmp/osmocom_sap'. Failed during sap_open(), no SIM reader <000e> cell_log.c:804 Scanner initialized Mobile initialized, please start phone now! ^CSignal 2 recevied. <000e> cell_log.c:811 Scanner exit * #__________________ Atte. **Rafael R.*

3 3

asn.1 compilation
by ☎ 16 Apr '13

16 Apr '13

Hello. I'm having troubles compiling asn.1 files from http://www.3gpp.org/ftp/Specs/archive/24_series/24.080/ASN.1/ I'm getting syntax error (syntax error at line 264 in module SS-Operations.asn: got 'SEQUENCE' expected ':') while running erlc SS-Operations.asn using Erlang version 15.b.1 As far as I recall Harald has done this for MAP asn.1 Are there any hints on what might be wrong? Tried online compiler but it gives different errors in different places. Should I use different version? Compile smth else before attempting to compile this file? Fix syntax using some clever trick? Do some rtfm? Any advices would be greatly appreciated. -- best regards, Max, http://fairwaves.ru

3 5

Re: Baseband: MS '1' is up, service is limited
by Pavel Baturko 16 Apr '13

16 Apr '13

As I see your Channel Requests remain unanswered from the network. Are you sure that you are using firmware compiled with enabled TX (I do not remember if it could be observed from layer1.log)? If yes, you can try not to use the ARFCN that is selected by MS automatically (in your log - 748DCS) by signal level, but try to stick on another ARFCN: e.g. 746DCS - second candidate by rxlev - or other. for this case use "stick 746" option and check for network's answers (ImmAss or ImmAssReject). You can also try to use other SIMs. Thanks, Pavel On Mon, Apr 15, 2013 at 1:11 PM, Hoàng Mạnh Hùng <hunghm.vn(a)gmail.com>wrote: > Hi Pavel Baturko, > > > mobile.cfg, mobile.log, layer1.log and other logs in case of automatic > network selection "network-selection-mode auto" ans "no stick" option: > > root@UR:/tmp# telnet 127.0.0.1 4247 > Trying 127.0.0.1... > Connected to 127.0.0.1. > Escape character is '^]'. > Welcome to the OsmocomBB control interface > > OsmocomBB> en > OsmocomBB# sho > > OsmocomBB# show ms > MS '1' is up, service is limited > IMEI: 357337016773249 > IMEISV: 3573370167732490 > IMEI generation: fixed > automatic network selection state: A0 null > cell selection state: PLMN search > radio ressource layer state: idle > mobility management layer state: MM idle, PLMN search > > OsmocomBB# show > OsmocomBB# show sub > OsmocomBB# show subscriber > Mobile Subscriber of MS '1': > IMSI: 452040399998391 > ICCID: 89840403940099983911 > Service Provider Name: VIETTEL > SMS Service Center Address: +84980200030 > Status: U2_NOT_UPDATED IMSI detached LAI: invalid > Key: sequence 1 74 5d 70 bb 32 6a a0 00 > Access barred cells: no > Access classes: C4 > List of preferred PLMNs: > MCC |MNC > -------+------- > 452 |04 (Vietnam, Viettel Mobile) > 456 |08 (Cambodia, Viettel) > 457 |03 (Laos, Unitel) > 372 |03 (Haiti, 03) > > OsmocomBB# show > OsmocomBB# show sup > OsmocomBB# show support > Supported features of MS '1': > Phase 2 mobile station > R-GSM : yes > E-GSM : yes > P-GSM : yes > GSM900 Class : 4 > DCS 1800 : yes > DCS Class : 1 > GSM 850 : yes > GSM 850 Class: 4 > PCS 1900 : yes > PCS Class : 1 > GSM 480 : no > GSM 450 : no > CECS : no > VGCS : no > VBS : no > SMS : yes > SS_IND : yes > PS_CAP : no > CMSP : no > SoLSA : no > LCSVA : no > LOC_SERV : no > A5/1 : yes > A5/2 : yes > A5/3 : no > A5/4 : no > A5/5 : no > A5/6 : no > A5/7 : no > A5/1 : yes > Channels : SDCCH + TCH/F + TCH/H > Full-Rate V1 : yes > Full-Rate V2 : yes > Full-Rate V3 : no > Half-Rate V1 : yes > Half-Rate V3 : no > Min RXLEV : -106 > > OsmocomBB# call 1 0987785050 > OsmocomBB# > % (MS 1) > % Call has been rejected > > OsmocomBB# sms 1 0987785050 testSMS > OsmocomBB# > % (MS 1) > % SMS to 0987785050 failed: (MO) SMS rejected > > OsmocomBB# net > OsmocomBB# network sho > OsmocomBB# network show 1 > > OsmocomBB# > % (MS 1) > % Trying to registering with network... > > % (MS 1) > % Trying to registering with network... > > % (MS 1) > % Trying to registering with network... > > % (MS 1) > % Searching network... > > > % (MS 1) > % Trying to registering with network... > > % (MS 1) > % Trying to registering with network... > > % (MS 1) > % Searching network... > > OsmocomBB# sms 1 0987785050 testSMS > > % (MS 1) > % Trying to registering with network... > call 1 0987785050 > OsmocomBB# > % (MS 1) > % Call has been rejected > > OsmocomBB# sms 1 0987785050 testSMS > OsmocomBB# > % (MS 1) > % SMS to 0987785050 failed: (MO) SMS rejected > > > % (MS 1) > % Trying to registering with network... > > > > 2013/4/15 Pavel Baturko <pabftk(a)gmail.com> > >> Hi, >> >> Could you please provide mobile.log and log from VTY in case of automatic >> network selection "network-selection-mode auto" ans "no stick" option? >> >> Thanks, >> Pavel >> >> >> On Mon, Apr 15, 2013 at 10:46 AM, hungbangchu <hunghm.vn(a)gmail.com>wrote: >> >>> Hi, >>> >>> My attachment is file mobile.log. >>> >>> Any one can mobile.log >>> <http://baseband-devel.722152.n3.nabble.com/file/n4025987/mobile.log> >>> help >>> >>> me? >>> >>> >>> >>> pab wrote >>> > Hi, >>> > >>> >> There is no such command. >>> >> Error occurred during reading below line: >>> >> stick on >>> > 'stick' option should be used as 'stick ARFCN'. with this option your >>> MS >>> > will be forced to use specific ARFCN. Be sure that this ARFCN is >>> visible >>> > by >>> > your MS and owned by your SIM's service provider. >>> > >>> > Also I think it's difficult for people in this list to help you without >>> > logs, at least attached mobile app log could help. >>> > >>> > Thanks, >>> > Pavel >>> >>> >>> >>> >>> >>> -- >>> View this message in context: >>> http://baseband-devel.722152.n3.nabble.com/Baseband-MS-1-is-up-service-is-l… >>> >>> Sent from the baseband-devel mailing list archive at Nabble.com. >>> >>> >> > > > -- > Thanks and Best Regards > -- > From: Hoàng Mạnh Hùng >

2 1

smsc
by ☎ 15 Apr '13

15 Apr '13

Hi all. As far as I recall opensmsc doesn't have dedicated ML yet this seems to be appropriate place so far. I've found this open source project: https://code.google.com/p/smscgateway/ - hopefully it'll be of some use for opensmsc devs. -- best regards, Max, http://fairwaves.ru

2 1

Trying to registering with network...
by hungbangchu 15 Apr '13

15 Apr '13

Hi all, *I get an issue: always "Trying to registering with network..."* *My configs and my logs:* mobile.cfg <http://baseband-devel.722152.n3.nabble.com/file/n4025989/mobile.cfg> layer1.log <http://baseband-devel.722152.n3.nabble.com/file/n4025989/layer1.log> mobile.log <http://baseband-devel.722152.n3.nabble.com/file/n4025989/mobile.log> *Commands on OsmocomBB terminal:* root@UR:/tmp# telnet 127.0.0.1 4247 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. Welcome to the OsmocomBB control interface OsmocomBB> en OsmocomBB# sho OsmocomBB# show ms MS '1' is up, service is limited IMEI: 357337016773249 IMEISV: 3573370167732490 IMEI generation: fixed automatic network selection state: A0 null cell selection state: PLMN search radio ressource layer state: idle mobility management layer state: MM idle, PLMN search OsmocomBB# show OsmocomBB# show sub OsmocomBB# show subscriber Mobile Subscriber of MS '1': IMSI: 452040399998391 ICCID: 89840403940099983911 Service Provider Name: VIETTEL SMS Service Center Address: +84980200030 Status: U2_NOT_UPDATED IMSI detached LAI: invalid Key: sequence 1 74 5d 70 bb 32 6a a0 00 Access barred cells: no Access classes: C4 List of preferred PLMNs: MCC |MNC -------+------- 452 |04 (Vietnam, Viettel Mobile) 456 |08 (Cambodia, Viettel) 457 |03 (Laos, Unitel) 372 |03 (Haiti, 03) OsmocomBB# show OsmocomBB# show sup OsmocomBB# show support Supported features of MS '1': Phase 2 mobile station R-GSM : yes E-GSM : yes P-GSM : yes GSM900 Class : 4 DCS 1800 : yes DCS Class : 1 GSM 850 : yes GSM 850 Class: 4 PCS 1900 : yes PCS Class : 1 GSM 480 : no GSM 450 : no CECS : no VGCS : no VBS : no SMS : yes SS_IND : yes PS_CAP : no CMSP : no SoLSA : no LCSVA : no LOC_SERV : no A5/1 : yes A5/2 : yes A5/3 : no A5/4 : no A5/5 : no A5/6 : no A5/7 : no A5/1 : yes Channels : SDCCH + TCH/F + TCH/H Full-Rate V1 : yes Full-Rate V2 : yes Full-Rate V3 : no Half-Rate V1 : yes Half-Rate V3 : no Min RXLEV : -106 OsmocomBB# call 1 0987785050 OsmocomBB# % (MS 1) % Call has been rejected OsmocomBB# sms 1 0987785050 testSMS OsmocomBB# % (MS 1) % SMS to 0987785050 failed: (MO) SMS rejected OsmocomBB# net OsmocomBB# network sho OsmocomBB# network show 1 OsmocomBB# % (MS 1) % Trying to registering with network... % (MS 1) % Trying to registering with network... % (MS 1) % Trying to registering with network... % (MS 1) % Searching network... % (MS 1) % Trying to registering with network... % (MS 1) % Trying to registering with network... % (MS 1) % Searching network... OsmocomBB# sms 1 0987785050 testSMS % (MS 1) % Trying to registering with network... call 1 0987785050 OsmocomBB# % (MS 1) % Call has been rejected OsmocomBB# sms 1 0987785050 testSMS OsmocomBB# % (MS 1) % SMS to 0987785050 failed: (MO) SMS rejected % (MS 1) % Trying to registering with network... -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Trying-to-registering-with-netwo… Sent from the baseband-devel mailing list archive at Nabble.com.

1 0

[PATCH] fix cli output of mobile app
by Martin Hauke 14 Apr '13

14 Apr '13

Hi, the cli output of the mobile-app command # show support prints the indication for A5/1 support twice. The attached small patch fixed that. - Martin

2 1

osmocom problems
by R. Revert 13 Apr '13

13 Apr '13

Hi every one im having some problems installing osmocom from the wiki tutorial and this is the first time that im installing osmocom.. i buy the motorola C118 from the sysmocom Shop.. i dont know where i have the mistake installing the software , and maybe some of u can help me.... thanks im using: * *root@ubuntu:~# lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 11.10 Release: 11.10 Codename: oneiric So i follow the next Steps>* * *root@ubuntu:/opt: aptitude install libtool shtool autoconf git-core pkg-config make gcc* *root@ubuntu:/opt:git clone git://git.osmocom.org/osmocom-bb.git root@ubuntu:/opt/osmocom-bb/src/shared/libosmocore# autoreconf -i root@ubuntu:/opt/osmocom-bb/src/shared/libosmocore#./configure root@ubuntu:/opt/osmocom-bb/src/shared/libosmocore# make root@ubuntu:/opt/osmocom-bb/src/shared/libosmocore#sudo make install* *after this i download *gnu-arm-build.2.sh<http://bb.osmocom.org/trac/raw-attachment/wiki/GnuArmToolchain/gnu-arm-buil…>in /opt i give the property permission for the .sh file and root@ubuntu:/opt: sudo apt-get install build-essential libgmp3-dev libmpfr-dev libx11-6 libx11-dev texinfo flex bison libncurses5 \ libncurses5-dbg libncurses5-dev libncursesw5 libncursesw5-dbg libncursesw5-dev zlibc zlib1g-dev libmpfr4 libmpc-dev *root@ubuntu:/opt: mkdir build install src* *root@ubuntu:/opt:cd src/ root@ubuntu:/opt:wget http://ftp.gnu.org/gnu/gcc/gcc-4.5.2/gcc-4.5.2.tar.bz2 root@ubuntu:/opt:wget http://ftp.gnu.org/gnu/binutils/binutils-2.21.1a.tar.bz2 root@ubuntu:/opt:wget ftp://sources.redhat.com/pub/newlib/newlib-1.19.0.tar.gz* *root@ubuntu:/opt:./gnu-arm-build.2.sh * I will build an arm-elf cross-compiler: Prefix: opt/install Sources: opt/src Build files: opt/build Press ^C now if you do NOT want to do this. after that i get a ok install, i add in the last line of the .bashrc file i add *export PATH=$PATH:/opt/install/bin* and in the root@ubuntu:/opt/osmocom-bb/src# i run: * root@ubuntu:/opt/osmocom-bb/src# make *cd shared/libosmocore/build-target && ../configure \ --host=arm-elf --enable-embedded --disable-shared \ --disable-tests ac_cv_header_sys_select_h=no \ --disable-tests ac_cv_header_sys_socket_h=no \ CFLAGS="-Os -ffunction-sections -I/opt/osmocom-bb/src/target/firmware/include -nostartfiles -nodefaultlibs" configure: WARNING: unrecognized options: --disable-tests, --disable-tests configure: WARNING: if you wanted to set the --build type, don't use --host. If a cross compiler is detected then cross compile mode will be used checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for arm-elf-strip... arm-elf-strip checking for a thread-safe mkdir -p... /bin/mkdir -p checking for gawk... no checking for mawk... mawk checking whether make sets $(MAKE)... yes checking whether make sets $(MAKE)... (cached) yes checking for arm-elf-gcc... arm-elf-gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... yes checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether arm-elf-gcc accepts -g... yes checking for arm-elf-gcc option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of arm-elf-gcc... gcc3 checking build system type... i686-pc-linux-gnu checking host system type... arm-unknown-elf checking how to print strings... printf checking for a sed that does not truncate output... /bin/sed checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for fgrep... /bin/grep -F checking for ld used by arm-elf-gcc... /opt/install/arm-elf/bin/ld checking if the linker (/opt/install/arm-elf/bin/ld) is GNU ld... yes checking for BSD- or MS-compatible name lister (nm)... /opt/install/bin/arm-elf-nm -B checking the name lister (/opt/install/bin/arm-elf-nm -B) interface... BSD nm checking whether ln -s works... yes checking the maximum length of command line arguments... 805306365 checking whether the shell understands some XSI constructs... yes checking whether the shell understands "+="... yes checking how to convert i686-pc-linux-gnu file names to arm-unknown-elf format... func_convert_file_noop checking how to convert i686-pc-linux-gnu file names to toolchain format... func_convert_file_noop checking for /opt/install/arm-elf/bin/ld option to reload object files... -r checking for arm-elf-objdump... arm-elf-objdump checking how to recognize dependent libraries... unknown checking for arm-elf-dlltool... no checking for dlltool... no checking how to associate runtime and link libraries... printf %s\n checking for arm-elf-ar... arm-elf-ar checking for archiver @FILE support... @ checking for arm-elf-strip... (cached) arm-elf-strip checking for arm-elf-ranlib... arm-elf-ranlib checking command to parse /opt/install/bin/arm-elf-nm -B output from arm-elf-gcc object... ok checking for sysroot... no checking for arm-elf-mt... no checking for mt... mt configure: WARNING: using cross tools not prefixed with host triplet checking if mt is a manifest tool... no checking how to run the C preprocessor... arm-elf-gcc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking for dlfcn.h... no checking for objdir... .libs checking if arm-elf-gcc supports -fno-rtti -fno-exceptions... no checking for arm-elf-gcc option to produce PIC... -fPIC -DPIC checking if arm-elf-gcc PIC flag -fPIC -DPIC works... yes checking if arm-elf-gcc static flag -static works... yes checking if arm-elf-gcc supports -c -o file.o... yes checking if arm-elf-gcc supports -c -o file.o... (cached) yes checking whether the arm-elf-gcc linker (/opt/install/arm-elf/bin/ld) supports shared libraries... yes checking dynamic linker characteristics... no checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... no checking whether to build shared libraries... no checking whether to build static libraries... yes checking for ANSI C header files... (cached) yes checking execinfo.h usability... no checking execinfo.h presence... no checking for execinfo.h... no checking for sys/select.h... (cached) no checking for sys/socket.h... (cached) no checking syslog.h usability... no checking syslog.h presence... no checking for syslog.h... no checking ctype.h usability... yes checking ctype.h presence... yes checking for ctype.h... yes checking for size_t... yes checking for working alloca.h... yes checking for alloca... yes checking for library containing dlopen... no checking for doxygen... false checking if arm-elf-gcc supports -fvisibility=hidden... yes checking whether struct tm has tm_gmtoff member... no configure: creating ./config.status config.status: creating libosmocore.pc config.status: creating libosmocodec.pc config.status: creating libosmovty.pc config.status: creating libosmogsm.pc config.status: creating libosmogb.pc config.status: creating include/Makefile config.status: creating src/Makefile config.status: creating src/vty/Makefile config.status: creating src/codec/Makefile config.status: creating src/gsm/Makefile config.status: creating src/gb/Makefile config.status: creating tests/Makefile config.status: creating utils/Makefile config.status: creating Doxyfile.core config.status: creating Doxyfile.gsm config.status: creating Doxyfile.vty config.status: creating Doxyfile.codec config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged config.status: executing tests/atconfig commands config.status: executing depfiles commands config.status: executing libtool commands configure: WARNING: unrecognized options: --disable-tests, --disable-tests cd shared/libosmocore/build-target && make make[1]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target' make all-recursive make[2]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target' Making all in include make[3]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/include' make[3]: Nothing to be done for `all'. make[3]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/include' Making all in src make[3]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src' make all-am make[4]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src' CC timer.lo CC select.lo CC signal.lo CC msgb.lo CC bits.lo CC bitvec.lo CC statistics.lo ../../src/statistics.c: In function 'osmo_counter_get_by_name': ../../src/statistics.c:72:3: warning: implicit declaration of function 'strcmp' CC write_queue.lo CC utils.lo ../../src/utils.c: In function 'get_value_string': ../../src/utils.c:33:2: warning: format '%x' expects type 'unsigned int', but argument 4 has type 'uint32_t' ../../src/utils.c: In function 'get_string_value': ../../src/utils.c:49:3: warning: implicit declaration of function 'strcasecmp' CC socket.lo CC logging.lo ../../src/logging.c: In function 'log_parse_category_mask': ../../src/logging.c:168:2: warning: implicit declaration of function 'strdup' ../../src/logging.c:168:15: warning: incompatible implicit declaration of built-in function 'strdup' ../../src/logging.c:175:2: warning: implicit declaration of function 'strtok' ../../src/logging.c:175:17: warning: assignment makes pointer from integer without a cast ../../src/logging.c:179:4: warning: implicit declaration of function 'strstr' ../../src/logging.c:179:18: warning: incompatible implicit declaration of built-in function 'strstr' ../../src/logging.c:205:27: warning: assignment makes pointer from integer without a cast ../../src/logging.c: In function '_file_output': ../../src/logging.c:446:2: warning: implicit declaration of function 'fprintf' ../../src/logging.c:446:2: warning: incompatible implicit declaration of built-in function 'fprintf' ../../src/logging.c:447:2: warning: implicit declaration of function 'fflush' ../../src/logging.c: In function 'log_target_create_file': ../../src/logging.c:520:2: warning: implicit declaration of function 'fopen' ../../src/logging.c:520:23: warning: assignment makes pointer from integer without a cast ../../src/logging.c: In function 'log_target_find': ../../src/logging.c:544:4: warning: implicit declaration of function 'strcmp' ../../src/logging.c: In function 'log_target_destroy': ../../src/logging.c:566:4: warning: implicit declaration of function 'fclose' ../../src/logging.c: In function 'log_target_file_reopen': ../../src/logging.c:579:23: warning: assignment makes pointer from integer without a cast CC logging_syslog.lo CC rate_ctr.lo ../../src/rate_ctr.c: In function 'rate_ctr_get_group_by_name_idx': ../../src/rate_ctr.c:153:3: warning: implicit declaration of function 'strcmp' CC gsmtap_util.lo CC crc16.lo CC panic.lo CC backtrace.lo CC conv.lo CC application.lo CC rbtree.lo CC crc8gen.lo CC crc16gen.lo CC crc32gen.lo CC crc64gen.lo CCLD libosmocore.la make[4]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src' make[3]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src' Making all in src/vty make[3]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src/vty' make[3]: Nothing to be done for `all'. make[3]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src/vty' Making all in src/codec make[3]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src/codec' CC gsm610.lo CC gsm620.lo CC gsm660.lo CC gsm690.lo CCLD libosmocodec.la make[3]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src/codec' Making all in src/gsm make[3]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src/gsm' CC a5.lo CC rxlev_stat.lo CC tlv_parser.lo CC comp128.lo CC gsm_utils.lo CC rsl.lo CC gsm48.lo ../../../src/gsm/gsm48.c: In function 'gsm48_mi_to_string': ../../../src/gsm/gsm48.c:369:4: warning: format '%u' expects type 'unsigned int', but argument 4 has type 'uint32_t' CC gsm48_ie.lo CC gsm0808.lo CC sysinfo.lo CC gprs_cipher_core.lo CC gsm0480.lo CC abis_nm.lo CC gsm0502.lo CC gsm0411_utils.lo ../../../src/gsm/gsm0411_utils.c: In function 'gsm340_gen_scts': ../../../src/gsm/gsm0411_utils.c:87:2: warning: #warning find a portable way to obtain timezone offset CC gsm0411_smc.lo CC gsm0411_smr.lo CC lapd_core.lo ../../../src/gsm/lapd_core.c: In function 'lapd_rx_u': ../../../src/gsm/lapd_core.c:834:5: warning: implicit declaration of function 'memcmp' CC lapdm.lo CC auth_core.lo CC auth_comp128v1.lo CC auth_milenage.lo CC aes-encblock.lo CC aes-internal.lo CC aes-internal-enc.lo CC milenage.lo ../../../src/gsm/milenage/milenage.c: In function 'milenage_auts': ../../../src/gsm/milenage/milenage.c:226:6: warning: implicit declaration of function 'memcmp' CC gan.lo CCLD libosmogsm.la make[3]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src/gsm' Making all in src/gb make[3]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src/gb' make[3]: Nothing to be done for `all'. make[3]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src/gb' Making all in tests make[3]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/tests' make[3]: Nothing to be done for `all'. make[3]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/tests' Making all in utils make[3]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/utils' make[3]: Nothing to be done for `all'. make[3]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/utils' make[3]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target' make[3]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target' make[2]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target' make[1]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target' make -C host/layer23 make[1]: Entering directory `/opt/osmocom-bb/src/host/layer23' Making all in include make[2]: Entering directory `/opt/osmocom-bb/src/host/layer23/include' Making all in osmocom make[3]: Entering directory `/opt/osmocom-bb/src/host/layer23/include/osmocom' Making all in bb make[4]: Entering directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb' Making all in common make[5]: Entering directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb/common' make[5]: Nothing to be done for `all'. make[5]: Leaving directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb/common' Making all in misc make[5]: Entering directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb/misc' make[5]: Nothing to be done for `all'. make[5]: Leaving directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb/misc' Making all in mobile make[5]: Entering directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb/mobile' make[5]: Nothing to be done for `all'. make[5]: Leaving directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb/mobile' make[5]: Entering directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb' make[5]: Nothing to be done for `all-am'. make[5]: Leaving directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb' make[4]: Leaving directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb' make[4]: Entering directory `/opt/osmocom-bb/src/host/layer23/include/osmocom' make[4]: Nothing to be done for `all-am'. make[4]: Leaving directory `/opt/osmocom-bb/src/host/layer23/include/osmocom' make[3]: Leaving directory `/opt/osmocom-bb/src/host/layer23/include/osmocom' make[3]: Entering directory `/opt/osmocom-bb/src/host/layer23/include' make[3]: Nothing to be done for `all-am'. make[3]: Leaving directory `/opt/osmocom-bb/src/host/layer23/include' make[2]: Leaving directory `/opt/osmocom-bb/src/host/layer23/include' Making all in src make[2]: Entering directory `/opt/osmocom-bb/src/host/layer23/src' Making all in common make[3]: Entering directory `/opt/osmocom-bb/src/host/layer23/src/common' CC l1ctl.o CC l1l2_interface.o CC sap_interface.o CC logging.o CC networks.o CC sim.o sim.c: In function ‘gsm_sim_reply’: sim.c:146:11: warning: variable ‘payload’ set but not used [-Wunused-but-set-variable] CC sysinfo.o CC gps.o CC l1ctl_lapdm_glue.o AR liblayer23.a make[3]: Leaving directory `/opt/osmocom-bb/src/host/layer23/src/common' Making all in misc make[3]: Entering directory `/opt/osmocom-bb/src/host/layer23/src/misc' CC main.o CC app_bcch_scan.o app_bcch_scan.c: In function ‘signal_cb’: app_bcch_scan.c:48:3: warning: implicit declaration of function ‘fps_start’ [-Wimplicit-function-declaration] app_bcch_scan.c: In function ‘l23_app_init’: app_bcch_scan.c:56:2: warning: implicit declaration of function ‘fps_init’ [-Wimplicit-function-declaration] CC bcch_scan.o bcch_scan.c: In function ‘cinfo_timer_cb’: bcch_scan.c:198:2: warning: enumeration value ‘BSCAN_S_NONE’ not handled in switch [-Wswitch] bcch_scan.c:198:2: warning: enumeration value ‘BSCAN_S_DONE’ not handled in switch [-Wswitch] bcch_scan.c: In function ‘rx_sch_info’: bcch_scan.c:236:1: warning: no return statement in function returning non-void [-Wreturn-type] bcch_scan.c: In function ‘bscan_sig_cb’: bcch_scan.c:263:3: warning: enumeration value ‘FPS_S_NONE’ not handled in switch [-Wswitch] bcch_scan.c:263:3: warning: enumeration value ‘FPS_S_BINFO’ not handled in switch [-Wswitch] bcch_scan.c:241:20: warning: unused variable ‘ci’ [-Wunused-variable] bcch_scan.c: At top level: bcch_scan.c:206:12: warning: ‘rx_bcch_info’ defined but not used [-Wunused-function] bcch_scan.c:233:12: warning: ‘rx_sch_info’ defined but not used [-Wunused-function] CCLD bcch_scan CC app_ccch_scan.o app_ccch_scan.c: In function ‘gsm48_rx_imm_ass’: app_ccch_scan.c:203:12: warning: variable ‘ma’ set but not used [-Wunused-but-set-variable] CC rslms.o CCLD ccch_scan CC app_echo_test.o CCLD echo_test CC app_cell_log.o CC cell_log.o CC geo.o CCLD cell_log CC app_cbch_sniff.o CCLD cbch_sniff make[3]: Leaving directory `/opt/osmocom-bb/src/host/layer23/src/misc' Making all in mobile make[3]: Entering directory `/opt/osmocom-bb/src/host/layer23/src/mobile' CC gsm322.o gsm322.c: In function ‘gsm322_search_end’: gsm322.c:2055:30: warning: variable ‘mnc’ set but not used [-Wunused-but-set-variable] gsm322.c: In function ‘gsm322_exit’: gsm322.c:5142:7: warning: variable ‘rc’ set but not used [-Wunused-but-set-variable] CC gsm480_ss.o gsm480_ss.c: In function ‘gsm480_mmss_ind’: gsm480_ss.c:1221:6: warning: variable ‘rc’ set but not used [-Wunused-but-set-variable] CC gsm411_sms.o gsm411_sms.c: In function ‘gsm340_rx_tpdu’: gsm411_sms.c:228:19: warning: variable ‘sms_mms’ set but not used [-Wunused-but-set-variable] gsm411_sms.c: In function ‘gsm411_rx_rp_ud’: gsm411_sms.c:375:2: warning: format ‘%li’ expects argument of type ‘long int’, but argument 7 has type ‘int’ [-Wformat] gsm411_sms.c: In function ‘gsm411_tx_sms_submit’: gsm411_sms.c:657:3: warning: passing argument 4 of ‘gsm411_smc_init’ from incompatible pointer type [enabled by default] /usr/local/include/osmocom/gsm/gsm0411_smc.h:46:6: note: expected ‘int (*)(struct gsm411_smc_inst *, int, struct msgb *, int)’ but argument is of type ‘int (*)(struct gsm411_smc_inst *, int, struct msgb *)’ gsm411_sms.c:657:3: error: too many arguments to function ‘gsm411_smc_init’ /usr/local/include/osmocom/gsm/gsm0411_smc.h:46:6: note: declared here gsm411_sms.c:659:3: error: too many arguments to function ‘gsm411_smr_init’ /usr/local/include/osmocom/gsm/gsm0411_smr.h:27:6: note: declared here gsm411_sms.c: In function ‘gsm411_rcv_sms’: gsm411_sms.c:911:4: warning: passing argument 4 of ‘gsm411_smc_init’ from incompatible pointer type [enabled by default] /usr/local/include/osmocom/gsm/gsm0411_smc.h:46:6: note: expected ‘int (*)(struct gsm411_smc_inst *, int, struct msgb *, int)’ but argument is of type ‘int (*)(struct gsm411_smc_inst *, int, struct msgb *)’ gsm411_sms.c:911:4: error: too many arguments to function ‘gsm411_smc_init’ /usr/local/include/osmocom/gsm/gsm0411_smc.h:46:6: note: declared here gsm411_sms.c:913:4: error: too many arguments to function ‘gsm411_smr_init’ /usr/local/include/osmocom/gsm/gsm0411_smr.h:27:6: note: declared here make[3]: *** [gsm411_sms.o] Error 1 make[3]: Leaving directory `/opt/osmocom-bb/src/host/layer23/src/mobile' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/opt/osmocom-bb/src/host/layer23/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/opt/osmocom-bb/src/host/layer23' make: *** [host/layer23/layer23] Error 2* //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// or when i clean the installation again i run also the other command root@ubuntu:/opt/osmocom-bb/src# make -e CROSS_TOOL_PREFIX=/opt/install/bin/arm-elf-gcc- *cd shared/libosmocore/build-target && ../configure \ --host=arm-elf --enable-embedded --disable-shared \ --disable-tests ac_cv_header_sys_select_h=no \ --disable-tests ac_cv_header_sys_socket_h=no \ CFLAGS="-Os -ffunction-sections -I/opt/osmocom-bb/src/target/firmware/include -nostartfiles -nodefaultlibs" configure: WARNING: unrecognized options: --disable-tests, --disable-tests configure: WARNING: if you wanted to set the --build type, don't use --host. If a cross compiler is detected then cross compile mode will be used checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for arm-elf-strip... arm-elf-strip checking for a thread-safe mkdir -p... /bin/mkdir -p checking for gawk... no checking for mawk... mawk checking whether make sets $(MAKE)... yes checking whether make sets $(MAKE)... (cached) yes checking for arm-elf-gcc... arm-elf-gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... yes checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether arm-elf-gcc accepts -g... yes checking for arm-elf-gcc option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of arm-elf-gcc... gcc3 checking build system type... i686-pc-linux-gnu checking host system type... arm-unknown-elf checking how to print strings... printf checking for a sed that does not truncate output... /bin/sed checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for fgrep... /bin/grep -F checking for ld used by arm-elf-gcc... /opt/install/arm-elf/bin/ld checking if the linker (/opt/install/arm-elf/bin/ld) is GNU ld... yes checking for BSD- or MS-compatible name lister (nm)... /opt/install/bin/arm-elf-nm -B checking the name lister (/opt/install/bin/arm-elf-nm -B) interface... BSD nm checking whether ln -s works... yes checking the maximum length of command line arguments... 805306365 checking whether the shell understands some XSI constructs... yes checking whether the shell understands "+="... yes checking how to convert i686-pc-linux-gnu file names to arm-unknown-elf format... func_convert_file_noop checking how to convert i686-pc-linux-gnu file names to toolchain format... func_convert_file_noop checking for /opt/install/arm-elf/bin/ld option to reload object files... -r checking for arm-elf-objdump... arm-elf-objdump checking how to recognize dependent libraries... unknown checking for arm-elf-dlltool... no checking for dlltool... no checking how to associate runtime and link libraries... printf %s\n checking for arm-elf-ar... arm-elf-ar checking for archiver @FILE support... @ checking for arm-elf-strip... (cached) arm-elf-strip checking for arm-elf-ranlib... arm-elf-ranlib checking command to parse /opt/install/bin/arm-elf-nm -B output from arm-elf-gcc object... ok checking for sysroot... no checking for arm-elf-mt... no checking for mt... mt configure: WARNING: using cross tools not prefixed with host triplet checking if mt is a manifest tool... no checking how to run the C preprocessor... arm-elf-gcc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking for dlfcn.h... no checking for objdir... .libs checking if arm-elf-gcc supports -fno-rtti -fno-exceptions... no checking for arm-elf-gcc option to produce PIC... -fPIC -DPIC checking if arm-elf-gcc PIC flag -fPIC -DPIC works... yes checking if arm-elf-gcc static flag -static works... yes checking if arm-elf-gcc supports -c -o file.o... yes checking if arm-elf-gcc supports -c -o file.o... (cached) yes checking whether the arm-elf-gcc linker (/opt/install/arm-elf/bin/ld) supports shared libraries... yes checking dynamic linker characteristics... no checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... no checking whether to build shared libraries... no checking whether to build static libraries... yes checking for ANSI C header files... (cached) yes checking execinfo.h usability... no checking execinfo.h presence... no checking for execinfo.h... no checking for sys/select.h... (cached) no checking for sys/socket.h... (cached) no checking syslog.h usability... no checking syslog.h presence... no checking for syslog.h... no checking ctype.h usability... yes checking ctype.h presence... yes checking for ctype.h... yes checking for size_t... yes checking for working alloca.h... yes checking for alloca... yes checking for library containing dlopen... no checking for doxygen... false checking if arm-elf-gcc supports -fvisibility=hidden... yes checking whether struct tm has tm_gmtoff member... no configure: creating ./config.status config.status: creating libosmocore.pc config.status: creating libosmocodec.pc config.status: creating libosmovty.pc config.status: creating libosmogsm.pc config.status: creating libosmogb.pc config.status: creating include/Makefile config.status: creating src/Makefile config.status: creating src/vty/Makefile config.status: creating src/codec/Makefile config.status: creating src/gsm/Makefile config.status: creating src/gb/Makefile config.status: creating tests/Makefile config.status: creating utils/Makefile config.status: creating Doxyfile.core config.status: creating Doxyfile.gsm config.status: creating Doxyfile.vty config.status: creating Doxyfile.codec config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged config.status: executing tests/atconfig commands config.status: executing depfiles commands config.status: executing libtool commands configure: WARNING: unrecognized options: --disable-tests, --disable-tests cd shared/libosmocore/build-target && make make[1]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target' make all-recursive make[2]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target' Making all in include make[3]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/include' make[3]: Nothing to be done for `all'. make[3]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/include' Making all in src make[3]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src' make all-am make[4]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src' CC timer.lo CC select.lo CC signal.lo CC msgb.lo CC bits.lo CC bitvec.lo CC statistics.lo ../../src/statistics.c: In function 'osmo_counter_get_by_name': ../../src/statistics.c:72:3: warning: implicit declaration of function 'strcmp' CC write_queue.lo CC utils.lo ../../src/utils.c: In function 'get_value_string': ../../src/utils.c:33:2: warning: format '%x' expects type 'unsigned int', but argument 4 has type 'uint32_t' ../../src/utils.c: In function 'get_string_value': ../../src/utils.c:49:3: warning: implicit declaration of function 'strcasecmp' CC socket.lo CC logging.lo ../../src/logging.c: In function 'log_parse_category_mask': ../../src/logging.c:168:2: warning: implicit declaration of function 'strdup' ../../src/logging.c:168:15: warning: incompatible implicit declaration of built-in function 'strdup' ../../src/logging.c:175:2: warning: implicit declaration of function 'strtok' ../../src/logging.c:175:17: warning: assignment makes pointer from integer without a cast ../../src/logging.c:179:4: warning: implicit declaration of function 'strstr' ../../src/logging.c:179:18: warning: incompatible implicit declaration of built-in function 'strstr' ../../src/logging.c:205:27: warning: assignment makes pointer from integer without a cast ../../src/logging.c: In function '_file_output': ../../src/logging.c:446:2: warning: implicit declaration of function 'fprintf' ../../src/logging.c:446:2: warning: incompatible implicit declaration of built-in function 'fprintf' ../../src/logging.c:447:2: warning: implicit declaration of function 'fflush' ../../src/logging.c: In function 'log_target_create_file': ../../src/logging.c:520:2: warning: implicit declaration of function 'fopen' ../../src/logging.c:520:23: warning: assignment makes pointer from integer without a cast ../../src/logging.c: In function 'log_target_find': ../../src/logging.c:544:4: warning: implicit declaration of function 'strcmp' ../../src/logging.c: In function 'log_target_destroy': ../../src/logging.c:566:4: warning: implicit declaration of function 'fclose' ../../src/logging.c: In function 'log_target_file_reopen': ../../src/logging.c:579:23: warning: assignment makes pointer from integer without a cast CC logging_syslog.lo CC rate_ctr.lo ../../src/rate_ctr.c: In function 'rate_ctr_get_group_by_name_idx': ../../src/rate_ctr.c:153:3: warning: implicit declaration of function 'strcmp' CC gsmtap_util.lo CC crc16.lo CC panic.lo CC backtrace.lo CC conv.lo CC application.lo CC rbtree.lo CC crc8gen.lo CC crc16gen.lo CC crc32gen.lo CC crc64gen.lo CCLD libosmocore.la make[4]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src' make[3]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src' Making all in src/vty make[3]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src/vty' make[3]: Nothing to be done for `all'. make[3]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src/vty' Making all in src/codec make[3]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src/codec' CC gsm610.lo CC gsm620.lo CC gsm660.lo CC gsm690.lo CCLD libosmocodec.la make[3]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src/codec' Making all in src/gsm make[3]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src/gsm' CC a5.lo CC rxlev_stat.lo CC tlv_parser.lo CC comp128.lo CC gsm_utils.lo CC rsl.lo CC gsm48.lo ../../../src/gsm/gsm48.c: In function 'gsm48_mi_to_string': ../../../src/gsm/gsm48.c:369:4: warning: format '%u' expects type 'unsigned int', but argument 4 has type 'uint32_t' CC gsm48_ie.lo CC gsm0808.lo CC sysinfo.lo CC gprs_cipher_core.lo CC gsm0480.lo CC abis_nm.lo CC gsm0502.lo CC gsm0411_utils.lo ../../../src/gsm/gsm0411_utils.c: In function 'gsm340_gen_scts': ../../../src/gsm/gsm0411_utils.c:87:2: warning: #warning find a portable way to obtain timezone offset CC gsm0411_smc.lo CC gsm0411_smr.lo CC lapd_core.lo ../../../src/gsm/lapd_core.c: In function 'lapd_rx_u': ../../../src/gsm/lapd_core.c:834:5: warning: implicit declaration of function 'memcmp' CC lapdm.lo CC auth_core.lo CC auth_comp128v1.lo CC auth_milenage.lo CC aes-encblock.lo CC aes-internal.lo CC aes-internal-enc.lo CC milenage.lo ../../../src/gsm/milenage/milenage.c: In function 'milenage_auts': ../../../src/gsm/milenage/milenage.c:226:6: warning: implicit declaration of function 'memcmp' CC gan.lo CCLD libosmogsm.la make[3]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src/gsm' Making all in src/gb make[3]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src/gb' make[3]: Nothing to be done for `all'. make[3]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/src/gb' Making all in tests make[3]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/tests' make[3]: Nothing to be done for `all'. make[3]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/tests' Making all in utils make[3]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/utils' make[3]: Nothing to be done for `all'. make[3]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target/utils' make[3]: Entering directory `/opt/osmocom-bb/src/shared/libosmocore/build-target' make[3]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target' make[2]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target' make[1]: Leaving directory `/opt/osmocom-bb/src/shared/libosmocore/build-target' make -C host/layer23 make[1]: Entering directory `/opt/osmocom-bb/src/host/layer23' Making all in include make[2]: Entering directory `/opt/osmocom-bb/src/host/layer23/include' Making all in osmocom make[3]: Entering directory `/opt/osmocom-bb/src/host/layer23/include/osmocom' Making all in bb make[4]: Entering directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb' Making all in common make[5]: Entering directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb/common' make[5]: Nothing to be done for `all'. make[5]: Leaving directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb/common' Making all in misc make[5]: Entering directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb/misc' make[5]: Nothing to be done for `all'. make[5]: Leaving directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb/misc' Making all in mobile make[5]: Entering directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb/mobile' make[5]: Nothing to be done for `all'. make[5]: Leaving directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb/mobile' make[5]: Entering directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb' make[5]: Nothing to be done for `all-am'. make[5]: Leaving directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb' make[4]: Leaving directory `/opt/osmocom-bb/src/host/layer23/include/osmocom/bb' make[4]: Entering directory `/opt/osmocom-bb/src/host/layer23/include/osmocom' make[4]: Nothing to be done for `all-am'. make[4]: Leaving directory `/opt/osmocom-bb/src/host/layer23/include/osmocom' make[3]: Leaving directory `/opt/osmocom-bb/src/host/layer23/include/osmocom' make[3]: Entering directory `/opt/osmocom-bb/src/host/layer23/include' make[3]: Nothing to be done for `all-am'. make[3]: Leaving directory `/opt/osmocom-bb/src/host/layer23/include' make[2]: Leaving directory `/opt/osmocom-bb/src/host/layer23/include' Making all in src make[2]: Entering directory `/opt/osmocom-bb/src/host/layer23/src' Making all in common make[3]: Entering directory `/opt/osmocom-bb/src/host/layer23/src/common' CC l1ctl.o CC l1l2_interface.o CC sap_interface.o CC logging.o CC networks.o CC sim.o sim.c: In function ‘gsm_sim_reply’: sim.c:146:11: warning: variable ‘payload’ set but not used [-Wunused-but-set-variable] CC sysinfo.o CC gps.o CC l1ctl_lapdm_glue.o AR liblayer23.a make[3]: Leaving directory `/opt/osmocom-bb/src/host/layer23/src/common' Making all in misc make[3]: Entering directory `/opt/osmocom-bb/src/host/layer23/src/misc' CC main.o CC app_bcch_scan.o app_bcch_scan.c: In function ‘signal_cb’: app_bcch_scan.c:48:3: warning: implicit declaration of function ‘fps_start’ [-Wimplicit-function-declaration] app_bcch_scan.c: In function ‘l23_app_init’: app_bcch_scan.c:56:2: warning: implicit declaration of function ‘fps_init’ [-Wimplicit-function-declaration] CC bcch_scan.o bcch_scan.c: In function ‘cinfo_timer_cb’: bcch_scan.c:198:2: warning: enumeration value ‘BSCAN_S_NONE’ not handled in switch [-Wswitch] bcch_scan.c:198:2: warning: enumeration value ‘BSCAN_S_DONE’ not handled in switch [-Wswitch] bcch_scan.c: In function ‘rx_sch_info’: bcch_scan.c:236:1: warning: no return statement in function returning non-void [-Wreturn-type] bcch_scan.c: In function ‘bscan_sig_cb’: bcch_scan.c:263:3: warning: enumeration value ‘FPS_S_NONE’ not handled in switch [-Wswitch] bcch_scan.c:263:3: warning: enumeration value ‘FPS_S_BINFO’ not handled in switch [-Wswitch] bcch_scan.c:241:20: warning: unused variable ‘ci’ [-Wunused-variable] bcch_scan.c: At top level: bcch_scan.c:206:12: warning: ‘rx_bcch_info’ defined but not used [-Wunused-function] bcch_scan.c:233:12: warning: ‘rx_sch_info’ defined but not used [-Wunused-function] CCLD bcch_scan CC app_ccch_scan.o app_ccch_scan.c: In function ‘gsm48_rx_imm_ass’: app_ccch_scan.c:203:12: warning: variable ‘ma’ set but not used [-Wunused-but-set-variable] CC rslms.o CCLD ccch_scan CC app_echo_test.o CCLD echo_test CC app_cell_log.o CC cell_log.o CC geo.o CCLD cell_log CC app_cbch_sniff.o CCLD cbch_sniff make[3]: Leaving directory `/opt/osmocom-bb/src/host/layer23/src/misc' Making all in mobile make[3]: Entering directory `/opt/osmocom-bb/src/host/layer23/src/mobile' CC gsm322.o gsm322.c: In function ‘gsm322_search_end’: gsm322.c:2055:30: warning: variable ‘mnc’ set but not used [-Wunused-but-set-variable] gsm322.c: In function ‘gsm322_exit’: gsm322.c:5142:7: warning: variable ‘rc’ set but not used [-Wunused-but-set-variable] CC gsm480_ss.o gsm480_ss.c: In function ‘gsm480_mmss_ind’: gsm480_ss.c:1221:6: warning: variable ‘rc’ set but not used [-Wunused-but-set-variable] CC gsm411_sms.o gsm411_sms.c: In function ‘gsm340_rx_tpdu’: gsm411_sms.c:228:19: warning: variable ‘sms_mms’ set but not used [-Wunused-but-set-variable] gsm411_sms.c: In function ‘gsm411_rx_rp_ud’: gsm411_sms.c:375:2: warning: format ‘%li’ expects argument of type ‘long int’, but argument 7 has type ‘int’ [-Wformat] gsm411_sms.c: In function ‘gsm411_tx_sms_submit’: gsm411_sms.c:657:3: warning: passing argument 4 of ‘gsm411_smc_init’ from incompatible pointer type [enabled by default] /usr/local/include/osmocom/gsm/gsm0411_smc.h:46:6: note: expected ‘int (*)(struct gsm411_smc_inst *, int, struct msgb *, int)’ but argument is of type ‘int (*)(struct gsm411_smc_inst *, int, struct msgb *)’ gsm411_sms.c:657:3: error: too many arguments to function ‘gsm411_smc_init’ /usr/local/include/osmocom/gsm/gsm0411_smc.h:46:6: note: declared here gsm411_sms.c:659:3: error: too many arguments to function ‘gsm411_smr_init’ /usr/local/include/osmocom/gsm/gsm0411_smr.h:27:6: note: declared here gsm411_sms.c: In function ‘gsm411_rcv_sms’: gsm411_sms.c:911:4: warning: passing argument 4 of ‘gsm411_smc_init’ from incompatible pointer type [enabled by default] /usr/local/include/osmocom/gsm/gsm0411_smc.h:46:6: note: expected ‘int (*)(struct gsm411_smc_inst *, int, struct msgb *, int)’ but argument is of type ‘int (*)(struct gsm411_smc_inst *, int, struct msgb *)’ gsm411_sms.c:911:4: error: too many arguments to function ‘gsm411_smc_init’ /usr/local/include/osmocom/gsm/gsm0411_smc.h:46:6: note: declared here gsm411_sms.c:913:4: error: too many arguments to function ‘gsm411_smr_init’ /usr/local/include/osmocom/gsm/gsm0411_smr.h:27:6: note: declared here make[3]: *** [gsm411_sms.o] Error 1 make[3]: Leaving directory `/opt/osmocom-bb/src/host/layer23/src/mobile' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/opt/osmocom-bb/src/host/layer23/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/opt/osmocom-bb/src/host/layer23' make: *** [host/layer23/layer23] Error 2* * * * * *

3 3

AW: The call has been rejected
by Andreas.Eversberg 12 Apr '13

12 Apr '13

hi josephli, > Read stored BA list mnc=01 the mobile application stores the last cells and neighbour cells (band allocation) of each network. this way the scanning is much faster when restarting. because you use the SIM card with MNC == 02 the first time, there is no band allocation stored for that. the mobile will do a full scan in this case. > while the sim card service I am tesing is actually with mnc 00 and 02. i know that MNC == 0 will not work until i commited improvements of cell selection process last sunday. you should retry that, but first try with an MNC > 0. can you provide debug output when trying a call? also can you provide VTY output of "show ms" before you make the call? regards, andreas

3 2

status report layer1 and layer23
by Andreas.Eversberg 11 Apr '13

11 Apr '13

hi, i just fixed some locking issues the last days. fix will follow. it took a bit longer, because there were some race conditions. it took up to about one hour until it crashed. my way to detect the area where the crash happened, was to turn on buzzer before that area, and turn it off after that area. after many hours of approximation, i finally found out that the major crash happend during _talloc_zero. (first it looks for a free memory chunk, then it allocates it.) since it can be called from all contexts (main, irq, fiq), it need to be locked against any interrupt, otherwise the memory chunk can be assigned multiple times. (the process of _talloc_free is "atomic" and requires no locking.) because it seems pretty stable, i think it is time to merge some branches into the master. (i made a 6 hours call yesterday. and no crash after bugfix ever since.) i will do that together with sylvain, if we find the time this weekend. currently i use the jolly/voice together with the sylvain/traffic branch. i am able to use an isdn phone togehter with linux-call-router and make/receive calls. audio is passed both ways. i think this is a stage where it actually become "usable". (if not moving arround.) one of my major work for the next weeks/months will be the neighbour cell measurement, cell re-selection, and handover. this is essential when moving with the phone. regards, andreas

2 1

[PATCH] Add SAP reader stub to libosmosim
by ☎ 10 Apr '13

10 Apr '13

Hello. After overview of libosmosim presented at OsmoDevCon I thought that it would be nice to add SAP backend (implemented by Nico) so it can be transparently integrated with osmocom-bb. Attached is incomplete attempt to do so. Could you please review code and style? Also I'm puzzled by write_queue_* functions - should I use them as well or just write to fd directly? In former case - what should I use as event instead of BSC_FD_READ? In more general - is there some write_queue related description on the wiki? This patch is obviously not ready to be merged but I hope it might help to speed up development :) -- best regards, Max, http://fairwaves.ru

1 0

[PATCH] Add SAP reader stub.
by Max 10 Apr '13

10 Apr '13

--- src/sim/Makefile.am | 4 +- src/sim/reader_sap.c | 182 ++++++++++++++++++++++++++++++++++++++++++++++++++ src/sim/reader_sap.h | 162 ++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 346 insertions(+), 2 deletions(-) create mode 100644 src/sim/reader_sap.c create mode 100644 src/sim/reader_sap.h diff --git a/src/sim/Makefile.am b/src/sim/Makefile.am index fe64278..2fd353a 100644 --- a/src/sim/Makefile.am +++ b/src/sim/Makefile.am @@ -9,11 +9,11 @@ AM_LDFLAGS = $(COVERAGE_LDFLAGS) if ENABLE_PCSC # FIXME: only build the PC/SC dependent part conditional, but always build other parts -noinst_HEADERS = sim_int.h gsm_int.h +noinst_HEADERS = sim_int.h gsm_int.h reader_sap.h lib_LTLIBRARIES = libosmosim.la -libosmosim_la_SOURCES = core.c card_fs_sim.c card_fs_usim.c card_fs_uicc.c reader.c reader_pcsc.c +libosmosim_la_SOURCES = core.c card_fs_sim.c card_fs_usim.c card_fs_uicc.c reader.c reader_pcsc.c reader_sap.c libosmosim_la_LDFLAGS = -version-info $(LIBVERSION) libosmosim_la_LIBADD = $(LIBOSMOCORE_LIBS) $(LIBOSMOGSM_LIBS) $(PCSC_LIBS) diff --git a/src/sim/reader_sap.c b/src/sim/reader_sap.c new file mode 100644 index 0000000..0a74809 --- /dev/null +++ b/src/sim/reader_sap.c @@ -0,0 +1,182 @@ +/* SAP card reader backend for libosmosim */ +/* + * (C) 2013 by Max <Max.Suraev(a)fairwaves.ru> + * + * code shamelessly ripped from Nico Golde's patches to osmocom-bb + * + * All Rights Reserved + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + * + */ + +#include <unistd.h> +#include <string.h> +#include <stdint.h> +#include <stdio.h> +#include <errno.h> +#include <sys/socket.h> +#include <sys/un.h> +#include <arpa/inet.h> + +#include <osmocom/core/talloc.h> +#include <osmocom/sim/sim.h> + +#include "sim_int.h" +#include "reader_sap.h" + +static int osim_sap_send(struct osim_sap_entity *st, struct msgb *msg) +{ + if(st->sap_state == SAP_NOT_CONNECTED && !st->sap_state == SAP_CONNECTION_UNDER_NEGOTIATION) + sap_connect(st); + + if (st->fd <= 0) + return -EINVAL; +/* FIXME: + if (write_queue_enqueue(&ms->sap_wq, msg) != 0) { + LOGP(DSAP, LOGL_ERROR, "Failed to enqueue msg.\n"); + msgb_free(msg); + return -1; + } +*/ + return 0; +} + +static struct msgb *sap_create_msg(uint8_t id, uint8_t num_params, struct sap_param *params) +{ + struct msgb *msg; + uint8_t *msgp; + uint8_t i, plen, padding = 0; + + msg = msgb_alloc(GSM_SAP_LENGTH, "osmosap"); + if (!msg) { + fprintf(stderr, "Failed to allocate msg.\n"); + return NULL; + } + + /* BTSAP 5.1 */ + msgb_put_u8(msg, id); + msgb_put_u8(msg, num_params); + msgb_put_u16(msg, 0); + + for(i = 0; i < num_params; i++){ + plen = params[i].len; + msgb_put_u8(msg, params[i].id); + msgb_put_u8(msg, 0); + msgb_put_u16(msg, plen); + if(plen % 4){ + padding = 4 - (plen % 4); + } + msgp = msgb_put(msg, plen + padding); + memcpy(msgp, params[i].value, plen); + + if(padding){ + memset(msgp + plen, 0, padding); + } + } + + return msg; +} + +static void sap_connect(struct osim_sap_entity *st) +{ + uint8_t buffer[3]; + struct msgb *msg; + uint16_t size = st->max_msg_size; + struct sap_param params[1]; + + params[0].id = SAP_MAX_MSG_SIZE; + params[0].len = 2; + + if(st->sap_state != SAP_NOT_CONNECTED) { + fprintf(stderr, "Attempting to connect while there is an active connection already.\n"); + return; + } + + buffer[0] = (size >> 8) & 0xFF; + buffer[1] = size & 0xFF; + buffer[2] = 0; + params[0].value = buffer; + + msg = sap_create_msg(SAP_CONNECT_REQ, 1, params); + if(!msg) + return; + + osim_sap_send(st, msg); + + st->sap_state = SAP_CONNECTION_UNDER_NEGOTIATION; +} + +static struct osim_reader_hdl *sap_reader_open(int num, const char *id, void *ctx) +{ + struct osim_reader_hdl *rh; + ssize_t rc; + struct sockaddr_un local; + struct osim_sap_entity *st; + + rh = talloc_zero(ctx, struct osim_reader_hdl); + st = rh->priv = talloc_zero(rh, struct osim_sap_entity); + + st->fd = socket(AF_UNIX, SOCK_STREAM, 0); + if (st->fd < 0) { + fprintf(stderr, "Failed to create unix domain socket: %d\n", st->fd); + return NULL; + } + + local.sun_family = AF_UNIX; + strncpy(local.sun_path, id, sizeof(local.sun_path)); + local.sun_path[sizeof(local.sun_path) - 1] = '\0'; + + rc = connect(st->fd, (struct sockaddr *) &local, sizeof(local)); + if (rc < 0) { + fprintf(stderr, "Failed to connect to '%s'\n", local.sun_path); + close(st->fd); + return NULL; + } + st->socket_path = strdup(id); +/* FIXME: + write_queue_init(&ms->sap_wq, 100); + ms->sap_wq.bfd.data = ms; + ms->sap_wq.bfd.when = BSC_FD_READ; + ms->sap_wq.read_cb = sap_read; + ms->sap_wq.write_cb = sap_write; + + rc = bsc_register_fd(&ms->sap_wq.bfd); + if (rc != 0) { + fprintf(stderr, "Failed to register fd.\n"); + return rc; + } +*/ + sap_connect(st); + + return rh; +} + +static struct osim_card_hdl *sap_card_open(struct osim_reader_hdl *rh) +{ + +} + +static int sap_transceive(struct osim_reader_hdl *rh, struct msgb *msg) +{ + +} + +const struct osim_reader_ops sap_reader_ops = { + .name = "SAP", + .reader_open = sap_reader_open, + .card_open = sap_card_open, + .transceive = sap_transceive, +}; diff --git a/src/sim/reader_sap.h b/src/sim/reader_sap.h new file mode 100644 index 0000000..a4161b1 --- /dev/null +++ b/src/sim/reader_sap.h @@ -0,0 +1,162 @@ +/* SAP card reader backend for libosmosim */ +/* + * (C) 2013 by Max <Max.Suraev(a)fairwaves.ru> + * + * code shamelessly ripped from Nico Golde's patches to osmocom-bb + * + * All Rights Reserved + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + * + */ + +#define GSM_SAP_LENGTH 300 +#define GSM_SAP_HEADROOM 32 + +enum osim_sap_state { + SAP_NOT_CONNECTED, + SAP_IDLE, + SAP_CONNECTION_UNDER_NEGOTIATION, + SAP_PROCESSING_ATR_REQUEST, + SAP_PROCESSING_APDU_REQUEST +}; + +/* BTSAP 1.13 */ +enum osim_sap_msg_type { + SAP_CONNECT_REQ = 0x00, + SAP_CONNECT_RESP = 0x01, + SAP_DISCONNECT_REQ = 0x02, + SAP_DISCONNECT_RESP = 0x03, + SAP_DISCONNECT_IND = 0x04, + SAP_TRANSFER_APDU_REQ = 0x05, + SAP_TRANSFER_APDU_RESP = 0x06, + SAP_TRANSFER_ATR_REQ = 0x07, + SAP_TRANSFER_ATR_RESP = 0x08, + SAP_POWER_SIM_OFF_REQ = 0x09, + SAP_POWER_SIM_OFF_RESP = 0x0A, + SAP_POWER_SIM_ON_REQ = 0x0B, + SAP_POWER_SIM_ON_RESP = 0x0C, + SAP_RESET_SIM_REQ = 0x0D, + SAP_RESET_SIM_RESP = 0x0E, + SAP_TRANSFER_CARD_READER_STATUS_REQ = 0x0F, + SAP_TRANSFER_CARD_READER_STATUS_RESP = 0x10, + SAP_STATUS_IND = 0x11, + SAP_ERROR_RESP = 0x12, + SAP_SET_TRANSPORT_PROTOCOL_REQ = 0x13, + SAP_SET_TRANSPORT_PROTOCOL_RESP = 0x14 +}; + +/* BTSAP 5.2 */ +enum osim_sap_param_type { + SAP_MAX_MSG_SIZE = 0x00, + SAP_CONNECTION_STATUS = 0x01, + SAP_RESULT_CODE = 0x02, + SAP_DISCONNECTION_TYPE = 0x03, + SAP_COMMAND_APDU = 0x04, + SAP_COMMAND_APDU_7816 = 0x10, + SAP_RESPONSE_APDU = 0x05, + SAP_ATR = 0x06, + SAP_CARD_READER_STATUS = 0x07, + SAP_STATUS_CHANGE = 0x08, + SAP_TRANSPORT_PROTOCOL = 0x09 +}; + +struct sap_param { + uint8_t id; + uint16_t len; + uint8_t *value; +}; + +struct sap_msg { + uint8_t id; + uint8_t num_params; + struct sap_param *params; +}; + +struct osim_sap_entity { + int fd; + uint8_t sap_state; + uint16_t max_msg_size; + char * socket_path; +}; + +static const struct value_string sap_param_names[] = { + {SAP_MAX_MSG_SIZE, "MaxMsgSize"}, + {SAP_CONNECTION_STATUS, "ConnectionStatus"}, + {SAP_RESULT_CODE, "ResultCode"}, + {SAP_DISCONNECTION_TYPE, "DisconnectionType"}, + {SAP_COMMAND_APDU, "CommandAPDU"}, + {SAP_COMMAND_APDU_7816, "CommandAPDU7816"}, + {SAP_RESPONSE_APDU, "ResponseAPDU"}, + {SAP_ATR, "ATR"}, + {SAP_CARD_READER_STATUS, "CardReaderStatus"}, + {SAP_STATUS_CHANGE, "StatusChange"}, + {SAP_TRANSPORT_PROTOCOL, "TransportProtocol"} +}; + +static const struct value_string sap_msg_names[] = { + {SAP_CONNECT_REQ, "CONNECT_REQ"}, + {SAP_CONNECT_RESP, "CONNECT_RESP"}, + {SAP_DISCONNECT_REQ, "DISCONNECT_REQ"}, + {SAP_DISCONNECT_RESP, "DISCONNECT_RESP"}, + {SAP_DISCONNECT_IND, "DISCONNECT_IND"}, + {SAP_TRANSFER_APDU_REQ, "TRANSFER_APDU_REQ"}, + {SAP_TRANSFER_APDU_RESP, "TRANSFER_APDU_RESP"}, + {SAP_TRANSFER_ATR_REQ, "TRANSFER_ATR_REQ"}, + {SAP_TRANSFER_ATR_RESP, "TRANSFER_ATR_RESP"}, + {SAP_POWER_SIM_OFF_REQ, "POWER_SIM_OFF_REQ"}, + {SAP_POWER_SIM_OFF_RESP, "POWER_SIM_OFF_RESP"}, + {SAP_POWER_SIM_ON_REQ, "POWER_SIM_ON_REQ"}, + {SAP_POWER_SIM_ON_RESP, "POWER_SIM_ON_RESP"}, + {SAP_RESET_SIM_REQ, "RESET_SIM_REQ"}, + {SAP_RESET_SIM_RESP, "RESET_SIM_RESP"}, + {SAP_TRANSFER_CARD_READER_STATUS_REQ, "TRANSFER_CARD_READER_STATUS_REQ"}, + {SAP_TRANSFER_CARD_READER_STATUS_RESP, "TRANSFER_CARD_READER_STATUS_RESP"}, + {SAP_STATUS_IND, "STATUS_IND"}, + {SAP_ERROR_RESP, "ERROR_RESP"}, + {SAP_SET_TRANSPORT_PROTOCOL_REQ, "SET_TRANSPORT_PROTOCOL_REQ"}, + {SAP_SET_TRANSPORT_PROTOCOL_RESP, "SET_TRANSPORT_PROTOCOL_RESP"} +}; + +/* BTSAP table 5.18 */ +static const struct value_string sap_result_names[] = { + {0, "OK, request processed correctly"}, + {1, "Error, no reason defined"}, + {2, "Error, card not accessible"}, + {3, "Error, card (already) powered off"}, + {4, "Error, card removed"}, + {5, "Error, card already powered on"}, + {6, "Error, data not available"}, + {7, "Error, not supported"} +}; + +static const struct value_string sap_status_change_names[] = { + {0, "Unknown Error"}, + {1, "Card reset"}, + {2, "Card not accessible"}, + {3, "Card removed"}, + {4, "Card inserted"}, + {5, "Card recovered"}, +}; + +static const struct value_string sap_status_names[] = { + {0, "OK, Server can fulfill requirements"}, + {1, "Error, Server unable to establish connection"}, + {2, "Error, Server does not support maximum message size"}, + {3, "Error, maximum message size by Client is too small"}, + {4, "OK, ongoing call"} +}; + +static void sap_connect(struct osim_sap_entity *st); -- 1.7.10.4 --------------030201080608040809010804--

1 0

[PATCH] Add A5 and GEA ciphers
by ☎ 09 Apr '13

09 Apr '13

Hello. Attached is A5/3,4 GEA3,4 implementation which was described today at OsmoDevCon. This is "from the scratch" implementation, tests using test vectors from relevant 3GPP standards are included. There are couple of bits missing: * gprs_auth API needs to be changed to use GEA4 with 128 bits key * gea_test only checks algorithm correctness but not loading/using it via gprs_auth plugin api * osmo_a5_1 and osmo_a5_2 probably should be hidden from public api - the only way to call them should be through osmo_a5() function Please review and merge if possible. -- best regards, Max, http://fairwaves.ru

4 12

[PATCH] Add generic a5/* availability test.
by Max 09 Apr '13

09 Apr '13

--- include/osmocom/gsm/gsm_utils.h | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/include/osmocom/gsm/gsm_utils.h b/include/osmocom/gsm/gsm_utils.h index cdbac87..9c3ec19 100644 --- a/include/osmocom/gsm/gsm_utils.h +++ b/include/osmocom/gsm/gsm_utils.h @@ -26,6 +26,7 @@ #define GSM_UTILS_H #include <stdint.h> +#include <stdlib.h> #define ADD_MODULO(sum, delta, modulo) do { \ if ((sum += delta) >= modulo) \ @@ -74,17 +75,36 @@ int rxlev2dbm(uint8_t rxlev); uint8_t dbm2rxlev(int dbm); /* According to GSM 04.08 Chapter 10.5.1.6 */ -static inline int ms_cm2_a5n_support(uint8_t *cm2, int n) { +static inline int ms_cm2_a5n_support(uint8_t *cm2, unsigned n) { switch (n) { case 0: return 1; case 1: return (cm2[0] & (1<<3)) ? 0 : 1; case 2: return (cm2[2] & (1<<0)) ? 1 : 0; case 3: return (cm2[2] & (1<<1)) ? 1 : 0; default: - return 0; + return (n > 7) ? 0 : -1; } } +/* According to GSM 04.08 Chapter 10.5.1.7 */ +static inline int ms_cm3_a5n_support(uint8_t *cm3, unsigned n) { + switch (n) { + case 4: return (cm3[0] & (1<<0)) ? 1 : 0; + case 5: return (cm3[0] & (1<<1)) ? 1 : 0; + case 6: return (cm3[0] & (1<<2)) ? 1 : 0; + case 7: return (cm3[0] & (1<<3)) ? 1 : 0; + default: + return (n > 7) ? 0 : -1; + } +} + +/* Either classmark could be NULL */ +static inline int ms_a5n_support(uint8_t *cm2, uint8_t *cm3, unsigned n) { + if ((NULL != cm3) && n > 3) return ms_cm3_a5n_support(cm3, n); + if ((NULL != cm2) && n < 4) return ms_cm2_a5n_support(cm2, n); + return 0; +} + /* According to GSM 04.08 Chapter 10.5.2.29 */ static inline int rach_max_trans_val2raw(int val) { return (val >> 1) & 3; } static inline int rach_max_trans_raw2val(int raw) { -- 1.7.10.4 --------------080107010001070606070100--

1 0

[PATCH 5/5] Update test suite and build infrastructure.
by Max 07 Apr '13

07 Apr '13

--- .gitignore | 5 ++++- include/Makefile.am | 2 ++ src/gsm/Makefile.am | 4 ++-- src/gsm/libosmogsm.map | 7 +++++++ tests/Makefile.am | 11 +++++++++-- tests/testsuite.at | 12 ++++++++++++ 6 files changed, 36 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 2ed0144..e522b0d 100644 --- a/.gitignore +++ b/.gitignore @@ -40,6 +40,8 @@ debian/tmp/ debian/libosmocore*.substvars debian/libosmocore/ debian/libosmocore.post*.debhelper +debian/libosmocore-dbg/ +debian/libosmocore-utils/ .tarball-version .version @@ -53,7 +55,8 @@ tests/package.m4 tests/testsuite tests/testsuite.dir/ tests/testsuite.log - +tests/kasumi/kasumi_test +teste/gea/gea_test tests/sms/sms_test tests/timer/timer_test tests/msgfile/msgfile_test diff --git a/include/Makefile.am b/include/Makefile.am index b94abec..83ff9f1 100644 --- a/include/Makefile.am +++ b/include/Makefile.am @@ -40,6 +40,8 @@ nobase_include_HEADERS = \ osmocom/gprs/protocol/gsm_08_16.h \ osmocom/gprs/protocol/gsm_08_18.h \ osmocom/gsm/a5.h \ + osmocom/gsm/gea.h \ + osmocom/gsm/kasumi.h \ osmocom/gsm/abis_nm.h \ osmocom/gsm/comp128.h \ osmocom/gsm/gan.h \ diff --git a/src/gsm/Makefile.am b/src/gsm/Makefile.am index 59d4234..e203429 100644 --- a/src/gsm/Makefile.am +++ b/src/gsm/Makefile.am @@ -11,11 +11,11 @@ noinst_HEADERS = milenage/aes.h milenage/aes_i.h milenage/aes_wrap.h \ lib_LTLIBRARIES = libosmogsm.la -libosmogsm_la_SOURCES = a5.c rxlev_stat.c tlv_parser.c comp128.c gsm_utils.c \ +libosmogsm_la_SOURCES = a5.c kasumi.c rxlev_stat.c tlv_parser.c comp128.c gsm_utils.c \ rsl.c gsm48.c gsm48_ie.c gsm0808.c sysinfo.c \ gprs_cipher_core.c gsm0480.c abis_nm.c gsm0502.c \ gsm0411_utils.c gsm0411_smc.c gsm0411_smr.c \ - lapd_core.c lapdm.c \ + lapd_core.c lapdm.c gea.c \ auth_core.c auth_comp128v1.c auth_milenage.c \ milenage/aes-encblock.c milenage/aes-internal.c \ milenage/aes-internal-enc.c milenage/milenage.c gan.c diff --git a/src/gsm/libosmogsm.map b/src/gsm/libosmogsm.map index b2278f1..c5ee6f5 100644 --- a/src/gsm/libosmogsm.map +++ b/src/gsm/libosmogsm.map @@ -188,6 +188,13 @@ osmo_a5; osmo_a5_1; osmo_a5_2; +_kasumi; +_kasumi_key_expand; +_kasumi_kgcore; + +osmo_gea3; +osmo_gea4; + osmo_auth_alg_name; osmo_auth_alg_parse; osmo_auth_gen_vec; diff --git a/tests/Makefile.am b/tests/Makefile.am index bc9b7de..a2de833 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -5,7 +5,8 @@ check_PROGRAMS = timer/timer_test sms/sms_test ussd/ussd_test \ conv/conv_test auth/milenage_test lapd/lapd_test \ gsm0808/gsm0808_test gsm0408/gsm0408_test \ gb/bssgp_fc_test logging/logging_test fr/fr_test \ - loggingrb/loggingrb_test strrb/strrb_test + loggingrb/loggingrb_test strrb/strrb_test \ + kasumi/kasumi_test gea/gea_test if ENABLE_MSGFILE check_PROGRAMS += msgfile/msgfile_test @@ -17,6 +18,12 @@ a5_a5_test_LDADD = $(top_builddir)/src/libosmocore.la $(top_builddir)/src/gsm/li auth_milenage_test_SOURCES = auth/milenage_test.c auth_milenage_test_LDADD = $(top_builddir)/src/libosmocore.la $(top_builddir)/src/gsm/libosmogsm.la +kasumi_kasumi_test_SOURCES = kasumi/kasumi_test.c +kasumi_kasumi_test_LDADD = $(top_builddir)/src/libosmocore.la $(top_builddir)/src/gsm/libosmogsm.la + +gea_gea_test_SOURCES = gea/gea_test.c +gea_gea_test_LDADD = $(top_builddir)/src/libosmocore.la $(top_builddir)/src/gsm/libosmogsm.la + bits_bitrev_test_SOURCES = bits/bitrev_test.c bits_bitrev_test_LDADD = $(top_builddir)/src/libosmocore.la @@ -91,7 +98,7 @@ EXTRA_DIST = testsuite.at $(srcdir)/package.m4 $(TESTSUITE) \ msgfile/msgfile_test.ok msgfile/msgconfig.cfg \ logging/logging_test.ok logging/logging_test.err \ fr/fr_test.ok loggingrb/logging_test.ok \ - loggingrb/logging_test.err strrb/strrb_test.ok + loggingrb/logging_test.err strrb/strrb_test.ok kasumi/kasumi_test.ok DISTCLEANFILES = atconfig diff --git a/tests/testsuite.at b/tests/testsuite.at index 684ec4f..5323096 100644 --- a/tests/testsuite.at +++ b/tests/testsuite.at @@ -28,6 +28,18 @@ cat $abs_srcdir/conv/conv_test.ok > expout AT_CHECK([$abs_top_builddir/tests/conv/conv_test], [0], [expout]) AT_CLEANUP +AT_SETUP([kasumi]) +AT_KEYWORDS([kasumi]) +cat $abs_srcdir/kasumi/kasumi_test.ok > expout +AT_CHECK([$abs_top_builddir/tests/kasumi/kasumi_test], [0], [expout]) +AT_CLEANUP + +AT_SETUP([gea]) +AT_KEYWORDS([gea]) +cat $abs_srcdir/gea/gea_test.ok > expout +AT_CHECK([$abs_top_builddir/tests/gea/gea_test], [0], [expout]) +AT_CLEANUP + if ENABLE_MSGFILE AT_SETUP([msgfile]) AT_KEYWORDS([msgfile]) -- 1.7.10.4 --------------060001040407040305040404--

1 0

[PATCH 4/5] Add A5/3 and A5/4 ciphers.
by Max 07 Apr '13

07 Apr '13

--- include/osmocom/gsm/a5.h | 3 +++ src/gsm/a5.c | 58 +++++++++++++++++++++++++++++++++++++++++-- tests/a5/a5_test.c | 62 ++++++++++++++++++++++++++++++++++------------ tests/a5/a5_test.ok | 24 ++++++++++++++++++ 4 files changed, 129 insertions(+), 18 deletions(-) diff --git a/include/osmocom/gsm/a5.h b/include/osmocom/gsm/a5.h index 2f78a92..2089404 100644 --- a/include/osmocom/gsm/a5.h +++ b/include/osmocom/gsm/a5.h @@ -24,6 +24,7 @@ #define __OSMO_A5_H__ #include <stdint.h> +#include <stdbool.h> #include <osmocom/core/bits.h> @@ -57,6 +58,8 @@ osmo_a5_fn_count(uint32_t fn) int osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); void osmo_a5_1(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); void osmo_a5_2(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); +void osmo_a5_3(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); +void osmo_a5_4(const uint8_t *ck, uint32_t fn, ubit_t *dl, ubit_t *ul); /*! @} */ diff --git a/src/gsm/a5.c b/src/gsm/a5.c index de821e8..314473f 100644 --- a/src/gsm/a5.c +++ b/src/gsm/a5.c @@ -34,10 +34,14 @@ * \brief Osmocom GSM A5 ciphering algorithm implementation */ +#include <stdio.h> #include <errno.h> #include <string.h> +#include <stdbool.h> +#include <osmocom/core/bits.h> #include <osmocom/gsm/a5.h> +#include <osmocom/gsm/kasumi.h> /*! \brief Main method to generate a A5/x cipher stream * \param[in] n Which A5/x method to use @@ -47,7 +51,7 @@ * \param[out] ul Pointer to array of ubits to return Uplink cipher stream * \returns 0 for success, -ENOTSUP for invalid cipher selection. * - * Currently A5/[0-2] are supported. + * Currently A5/[0-4] are supported: -ENOTSUP returned in this case, 0 returned for supported ciphers. * Either (or both) of dl/ul can be NULL if not needed. */ int @@ -70,8 +74,15 @@ osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) osmo_a5_2(key, fn, dl, ul); break; + case 3: + osmo_a5_3(key, fn, dl, ul); + break; + case 4: + osmo_a5_4(key, fn, dl, ul); + break; + default: - /* a5/[3..7] not supported here/yet */ + /* a5/[5..7] not supported here/yet */ return -ENOTSUP; } @@ -368,4 +379,47 @@ osmo_a5_2(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) } } +/* ------------------------------------------------------------------------ */ +/* A5/3 */ +/* ------------------------------------------------------------------------ */ + +/*! \brief Generate a GSM A5/3 cipher stream + * \param[in] key 8 byte array for the key (as received from the SIM) + * \param[in] fn Frame number + * \param[out] dl Pointer to array of ubits to return Downlink cipher stream + * \param[out] ul Pointer to array of ubits to return Uplink cipher stream + * + * Either (or both) of dl/ul should be NULL if not needed. + * + * Implementation based on specifications from 3GPP TS 55.216, 3GPP TR 55.919 and ETSI TS 135 202 + * with slight simplifications (CE hardcoded to 0). + */ +void +osmo_a5_3(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) +{ + /* internal function require 128 bit key so we expand by concatenating supplied 64 bit key */ + uint8_t ck[16]; + memcpy(ck, key, 8); + memcpy(ck + 8, key, 8); + + osmo_a5_4(ck, fn, dl, ul); +} + +void +osmo_a5_4(const uint8_t *ck, uint32_t fn, ubit_t *dl, ubit_t *ul) +{ + uint8_t i, gamma[32]; + + if (ul) { + _kasumi_kgcore(0xF, 0, fn, 0, ck, gamma, 228); + uint8_t uplink[15]; + for(i = 0; i < 15; i++) uplink[i] = (gamma[i + 14] << 2) + (gamma[i + 15] >> 6); + osmo_pbit2ubit(ul, uplink, 114); + } + if (dl) { + _kasumi_kgcore(0xF, 0, fn, 0, ck, gamma, 114); + osmo_pbit2ubit(dl, gamma, 114); + } +} + /*! @} */ diff --git a/tests/a5/a5_test.c b/tests/a5/a5_test.c index 14436f1..c0ed658 100644 --- a/tests/a5/a5_test.c +++ b/tests/a5/a5_test.c @@ -2,6 +2,7 @@ #include <stdlib.h> #include <stdint.h> #include <string.h> +#include <stdbool.h> #include <osmocom/core/bits.h> #include <osmocom/core/utils.h> @@ -36,25 +37,40 @@ static const uint8_t ul[] = { 0x80, 0xba, 0xab, 0xc0, 0x59, 0x26, 0x40, }; -static const char * -binstr(ubit_t *d, int n) -{ - static char str[256]; - int i; +inline bool print_a5(int n, int k, char * dir, ubit_t * out, char * block) { + uint8_t len = 114 / 8 + 1, buf[len], res[len]; + printf("A5/%d - %s: %s => ", n, dir, osmo_ubit_dump(out, 114)); + osmo_hexparse(block, res, len); + osmo_ubit2pbit(buf, out, 114); + if (0 != memcmp(buf, res, len)) { + printf("FAIL"); + printf("\nGOT: [%d] %s", k, osmo_hexdump_nospc(buf, len)); + printf("\nEXP: [%d] %s\n", k, osmo_hexdump_nospc(res, len)); + return false; + } + printf("OK\n"); + return true; +} - for (i=0; i<n; i++) - str[i] = d[i] ? '1' : '0'; +inline bool test_a5(int n, char * kc, uint32_t count, char * block1, char * block2) { + ubit_t out[114]; + int k = (n == 4) ? 16 : 8; + uint8_t key[k]; + osmo_hexparse(kc, key, k); - str[i] = '\0'; + osmo_a5(n, key, count, out, NULL); + bool d = print_a5(n, k, "DL", out, block1); - return str; + osmo_a5(n, key, count, NULL, out); + bool u = print_a5(n, k, "UL", out, block2); + + return d & u; } int main(int argc, char **argv) { - ubit_t exp[114]; - ubit_t out[114]; - int n, i; + ubit_t exp[114], out[114]; + int n, i; for (n=0; n<3; n++) { /* "Randomize" */ @@ -66,13 +82,13 @@ int main(int argc, char **argv) osmo_a5(n, key, fn, out, NULL); - printf("A5/%d - DL: %s", n, binstr(out, 114)); + printf("A5/%d - DL: %s", n, osmo_ubit_dump(out, 114)); if (!memcmp(exp, out, 114)) printf(" => OK\n"); else { printf(" => BAD\n"); - printf(" Expected: %s", binstr(out, 114)); + printf(" Expected: %s", osmo_ubit_dump(out, 114)); fprintf(stderr, "[!] A5/%d DL failed", n); exit(1); } @@ -82,17 +98,31 @@ int main(int argc, char **argv) osmo_a5(n, key, fn, NULL, out); - printf("A5/%d - UL: %s", n, binstr(out, 114)); + printf("A5/%d - UL: %s", n, osmo_ubit_dump(out, 114)); if (!memcmp(exp, out, 114)) printf(" => OK\n"); else { printf(" => BAD\n"); - printf(" Expected: %s", binstr(out, 114)); + printf(" Expected: %s", osmo_ubit_dump(out, 114)); fprintf(stderr, "[!] A5/%d UL failed", n); exit(1); } } +// test vectors from 3GPP TS 55.217 and TS 55.218 + test_a5(3, "2BD6459F82C5BC00", 0x24F20F, "889EEAAF9ED1BA1ABBD8436232E440", "5CA3406AA244CF69CF047AADA2DF40"); + test_a5(3, "952C49104881FF48", 0x061272, "FB4D5FBCEE13A33389285686E9A5C0", "25090378E0540457C57E367662E440"); + test_a5(3, "EFA8B2229E720C2A", 0x33FD3F, "0E4015755A336469C3DD8680E30340", "6F10669E2B4E18B042431A28E47F80"); + test_a5(3, "952C49104881FF48", 0x061527, "AB7DB38A573A325DAA76E4CB800A40", "4C4B594FEA9D00FE8978B7B7BC1080"); + test_a5(3, "3451F23A43BD2C87", 0x0E418C, "75F7C4C51560905DFBA05E46FB54C0", "192C95353CDF979E054186DF15BF00"); + test_a5(3, "CAA2639BE82435CF", 0x2FF229, "301437E4D4D6565D4904C631606EC0", "F0A3B8795E264D3E1A82F684353DC0"); + test_a5(3, "7AE67E87400B9FA6", 0x2F24E5, "F794290FEF643D2EA348A7796A2100", "CB6FA6C6B8A705AF9FEFE975818500"); + test_a5(3, "58AF69935540698B", 0x05446B, "749CA4E6B691E5A598C461D5FE4740", "31C9E444CD04677ADAA8A082ADBC40"); + test_a5(3, "017F81E5F236FE62", 0x156B26, "2A6976761E60CC4E8F9F52160276C0", "A544D8475F2C78C35614128F1179C0"); + test_a5(3, "1ACA8B448B767B39", 0x0BC3B5, "A4F70DC5A2C9707F5FA1C60EB10640", "7780B597B328C1400B5C74823E8500"); + test_a5(4, "3D43C388C9581E337FF1F97EB5C1F85E", 0x35D2CF, "A2FE3034B6B22CC4E33C7090BEC340", "170D7497432FF897B91BE8AECBA880"); + test_a5(4, "A4496A64DF4F399F3B4506814A3E07A1", 0x212777, "89CDEE360DF9110281BCF57755A040", "33822C0C779598C9CBFC49183AF7C0"); + return 0; } diff --git a/tests/a5/a5_test.ok b/tests/a5/a5_test.ok index 4497e14..cefcdb6 100644 --- a/tests/a5/a5_test.ok +++ b/tests/a5/a5_test.ok @@ -4,3 +4,27 @@ A5/1 - DL: 110010111010001001010101011101100001011101011101001110110001110001111 A5/1 - UL: 110110010000001101011110000011110010101011101100000100111001101000000101110101001010100001111011101100010110010010 => OK A5/2 - DL: 010001011001110010001000110000111000001010110111111111111011001110011000110100101111100101101110000011110001010010 => OK A5/2 - UL: 111100000011101010101100110111101110001101011011010111100110010110000000101110101010101111000000010110010010011001 => OK +A5/3 - DL: 100010001001111011101010101011111001111011010001101110100001101010111011110110000100001101100010001100101110010001 => OK +A5/3 - UL: 010111001010001101000000011010101010001001000100110011110110100111001111000001000111101010101101101000101101111101 => OK +A5/3 - DL: 111110110100110101011111101111001110111000010011101000110011001110001001001010000101011010000110111010011010010111 => OK +A5/3 - UL: 001001010000100100000011011110001110000001010100000001000101011111000101011111100011011001110110011000101110010001 => OK +A5/3 - DL: 000011100100000000010101011101010101101000110011011001000110100111000011110111011000011010000000111000110000001101 => OK +A5/3 - UL: 011011110001000001100110100111100010101101001110000110001011000001000010010000110001101000101000111001000111111110 => OK +A5/3 - DL: 101010110111110110110011100010100101011100111010001100100101110110101010011101101110010011001011100000000000101001 => OK +A5/3 - UL: 010011000100101101011001010011111110101010011101000000001111111010001001011110001011011110110111101111000001000010 => OK +A5/3 - DL: 011101011111011111000100110001010001010101100000100100000101110111111011101000000101111001000110111110110101010011 => OK +A5/3 - UL: 000110010010110010010101001101010011110011011111100101111001111000000101010000011000011011011111000101011011111100 => OK +A5/3 - DL: 001100000001010000110111111001001101010011010110010101100101110101001001000001001100011000110001011000000110111011 => OK +A5/3 - UL: 111100001010001110111000011110010101111000100110010011010011111000011010100000101111011010000100001101010011110111 => OK +A5/3 - DL: 111101111001010000101001000011111110111101100100001111010010111010100011010010001010011101111001011010100010000100 => OK +A5/3 - UL: 110010110110111110100110110001101011100010100111000001011010111110011111111011111110100101110101100000011000010100 => OK +A5/3 - DL: 011101001001110010100100111001101011011010010001111001011010010110011000110001000110000111010101111111100100011101 => OK +A5/3 - UL: 001100011100100111100100010001001100110100000100011001110111101011011010101010001010000010000010101011011011110001 => OK +A5/3 - DL: 001010100110100101110110011101100001111001100000110011000100111010001111100111110101001000010110000000100111011011 => OK +A5/3 - UL: 101001010100010011011000010001110101111100101100011110001100001101010110000101000001001010001111000100010111100111 => OK +A5/3 - DL: 101001001111011100001101110001011010001011001001011100000111111101011111101000011100011000001110101100010000011001 => OK +A5/3 - UL: 011101111000000010110101100101111011001100101000110000010100000000001011010111000111010010000010001111101000010100 => OK +A5/4 - DL: 101000101111111000110000001101001011011010110010001011001100010011100011001111000111000010010000101111101100001101 => OK +A5/4 - UL: 000101110000110101110100100101110100001100101111111110001001011110111001000110111110100010101110110010111010100010 => OK +A5/4 - DL: 100010011100110111101110001101100000110111111001000100010000001010000001101111001111010101110111010101011010000001 => OK +A5/4 - UL: 001100111000001000101100000011000111011110010101100110001100100111001011111111000100100100011000001110101111011111 => OK -- 1.7.10.4 --------------060001040407040305040404 Content-Type: text/x-patch; name="0005-Update-test-suite-and-build-infrastructure.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="0005-Update-test-suite-and-build-infrastructure.patch"

1 0

[PATCH 2/5] Add KASUMI implementation.
by Max 07 Apr '13

07 Apr '13

--- include/osmocom/gsm/kasumi.h | 36 ++++++++ src/gsm/kasumi.c | 193 ++++++++++++++++++++++++++++++++++++++++++ tests/kasumi/kasumi_test.c | 128 ++++++++++++++++++++++++++++ tests/kasumi/kasumi_test.ok | 10 +++ 4 files changed, 367 insertions(+) create mode 100644 include/osmocom/gsm/kasumi.h create mode 100644 src/gsm/kasumi.c create mode 100644 tests/kasumi/kasumi_test.c create mode 100644 tests/kasumi/kasumi_test.ok diff --git a/include/osmocom/gsm/kasumi.h b/include/osmocom/gsm/kasumi.h new file mode 100644 index 0000000..8479968 --- /dev/null +++ b/include/osmocom/gsm/kasumi.h @@ -0,0 +1,36 @@ +/* + * KASUMI header + * + * See kasumi.c for details + */ + +#ifndef __KASUMI_H__ +#define __KASUMI_H__ + +#include <stdint.h> + +/* + * Single iteration of KASUMI cipher +*/ +uint64_t _kasumi(uint64_t P, uint16_t *KLi1, uint16_t *KLi2, uint16_t *KOi1, uint16_t *KOi2, uint16_t *KOi3, uint16_t *KIi1, uint16_t *KIi2, uint16_t *KIi3); + +/* + * Implementation of the KGCORE algorithm (used by A5/3, A5/4, GEA3, GEA4 and ECSD) + * + * CA : uint8_t + * cb : uint8_t + * cc : uint32_t + * cd : uint8_t + * ck : uint8_t [8] + * co : uint8_t [output, cl-dependent] + * cl : uint16_t + */ +void _kasumi_kgcore(uint8_t CA, uint8_t cb, uint32_t cc, uint8_t cd, const uint8_t *ck, uint8_t *co, uint16_t cl); + +/*! \brief Expand key into set of subkeys + * \param[in] key (128 bits) as array of bytes + * \param[out] arrays of round-specific subkeys - see TS 135 202 for details + */ +void _kasumi_key_expand(const uint8_t *key, uint16_t *KLi1, uint16_t *KLi2, uint16_t *KOi1, uint16_t *KOi2, uint16_t *KOi3, uint16_t *KIi1, uint16_t *KIi2, uint16_t *KIi3); + +#endif /* __KASUMI_H__ */ diff --git a/src/gsm/kasumi.c b/src/gsm/kasumi.c new file mode 100644 index 0000000..816c681 --- /dev/null +++ b/src/gsm/kasumi.c @@ -0,0 +1,193 @@ +/* Kasumi cipher and KGcore functions */ + +/* (C) 2013 by Max <Max.Suraev(a)fairwaves.ru> + * + * All Rights Reserved + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + * + */ + +#include <stdint.h> +#include <osmocom/core/bits.h> +#include <osmocom/gsm/kasumi.h> + +static uint16_t +_kasumi_FI(uint16_t I, uint16_t skey) +{ + static uint16_t S7[] = { + 54, 50, 62, 56, 22, 34, 94, 96, 38, 6, 63, 93, 2, 18, 123, 33, + 55, 113, 39, 114, 21, 67, 65, 12, 47, 73, 46, 27, 25, 111, 124, 81, + 53, 9, 121, 79, 52, 60, 58, 48, 101, 127, 40, 120, 104, 70, 71, 43, + 20, 122, 72, 61, 23, 109, 13, 100, 77, 1, 16, 7, 82, 10, 105, 98, + 117, 116, 76, 11, 89, 106, 0,125,118, 99, 86, 69, 30, 57, 126, 87, + 112, 51, 17, 5, 95, 14, 90, 84, 91, 8, 35,103, 32, 97, 28, 66, + 102, 31, 26, 45, 75, 4, 85, 92, 37, 74, 80, 49, 68, 29, 115, 44, + 64, 107, 108, 24, 110, 83, 36, 78, 42, 19, 15, 41, 88, 119, 59, 3 + }; + static uint16_t S9[] = { + 167, 239, 161, 379, 391, 334, 9, 338, 38, 226, 48, 358, 452, 385, 90, 397, + 183, 253, 147, 331, 415, 340, 51, 362, 306, 500, 262, 82, 216, 159, 356, 177, + 175, 241, 489, 37, 206, 17, 0, 333, 44, 254, 378, 58, 143, 220, 81, 400, + 95, 3, 315, 245, 54, 235, 218, 405, 472, 264, 172, 494, 371, 290, 399, 76, + 165, 197, 395, 121, 257, 480, 423, 212, 240, 28, 462, 176, 406, 507, 288, 223, + 501, 407, 249, 265, 89, 186, 221, 428,164, 74, 440, 196, 458, 421, 350, 163, + 232, 158, 134, 354, 13, 250, 491, 142,191, 69, 193, 425, 152, 227, 366, 135, + 344, 300, 276, 242, 437, 320, 113, 278, 11, 243, 87, 317, 36, 93, 496, 27, + 487, 446, 482, 41, 68, 156, 457, 131, 326, 403, 339, 20, 39, 115, 442, 124, + 475, 384, 508, 53, 112, 170, 479, 151, 126, 169, 73, 268, 279, 321, 168, 364, + 363, 292, 46, 499, 393, 327, 324, 24, 456, 267, 157, 460, 488, 426, 309, 229, + 439, 506, 208, 271, 349, 401, 434, 236, 16, 209, 359, 52, 56, 120, 199, 277, + 465, 416, 252, 287, 246, 6, 83, 305, 420, 345, 153,502, 65, 61, 244, 282, + 173, 222, 418, 67, 386, 368, 261, 101, 476, 291, 195,430, 49, 79, 166, 330, + 280, 383, 373, 128, 382, 408, 155, 495, 367, 388, 274, 107, 459, 417, 62, 454, + 132, 225, 203, 316, 234, 14, 301, 91, 503, 286, 424, 211, 347, 307, 140, 374, + 35, 103, 125, 427, 19, 214, 453, 146, 498, 314, 444, 230, 256, 329, 198, 285, + 50, 116, 78, 410, 10, 205, 510, 171, 231, 45, 139, 467, 29, 86, 505, 32, + 72, 26, 342, 150, 313, 490, 431, 238, 411, 325, 149, 473, 40, 119, 174, 355, + 185, 233, 389, 71, 448, 273, 372, 55, 110, 178, 322, 12, 469, 392, 369, 190, + 1, 109, 375, 137, 181, 88, 75, 308, 260, 484, 98, 272, 370, 275, 412, 111, + 336, 318, 4, 504, 492, 259, 304, 77, 337, 435, 21, 357, 303, 332, 483, 18, + 47, 85, 25, 497, 474, 289, 100, 269, 296, 478, 270, 106, 31, 104, 433, 84, + 414, 486, 394, 96, 99, 154, 511, 148, 413, 361, 409, 255, 162, 215, 302, 201, + 266, 351, 343, 144, 441, 365, 108, 298, 251, 34, 182, 509, 138, 210, 335, 133, + 311, 352, 328, 141, 396, 346, 123, 319, 450, 281, 429, 228, 443, 481, 92, 404, + 485, 422, 248, 297, 23, 213, 130, 466, 22, 217, 283, 70, 294, 360, 419, 127, + 312, 377, 7, 468, 194, 2, 117, 295, 463, 258, 224, 447, 247, 187, 80, 398, + 284, 353, 105, 390, 299, 471, 470, 184, 57, 200, 348, 63, 204, 188, 33, 451, + 97, 30, 310, 219, 94, 160, 129, 493, 64, 179, 263, 102, 189, 207, 114, 402, + 438, 477, 387, 122, 192, 42, 381, 5, 145, 118, 180, 449, 293, 323, 136, 380, + 43, 66, 60, 455, 341, 445, 202, 432, 8, 237, 15, 376, 436, 464, 59, 461 + }; + uint16_t L, R; + + /* Split 16 bit input into two unequal halves: 9 and 7 bits, same for subkey */ + L = I >> 7; /* take 9 bits */ + R = I & 0x7F; /* take 7 bits */ + + L = S9[L] ^ R; + R = S7[R] ^ (L & 0x7F); + + L ^= (skey & 0x1FF); + R ^= (skey >> 9); + + L = S9[L] ^ R; + R = S7[R] ^ (L & 0x7F); + + return (R << 9) + L; +} + +static uint32_t +_kasumi_FO(uint32_t I, uint16_t *KOi1, uint16_t *KOi2, uint16_t *KOi3, uint16_t *KIi1, uint16_t *KIi2, uint16_t *KIi3, unsigned i) +{ + uint16_t L = I >> 16, R = I; /* Split 32 bit input into Left and Right parts */ + + L ^= KOi1[i]; + L = _kasumi_FI(L, KIi1[i]); + L ^= R; + + R ^= KOi2[i]; + R = _kasumi_FI(R, KIi2[i]); + R ^= L; + + L ^= KOi3[i]; + L = _kasumi_FI(L, KIi3[i]); + L ^= R; + + return (((uint32_t)R) << 16) + L; +} + +static uint32_t +_kasumi_FL(uint32_t I, uint16_t *KLi1, uint16_t *KLi2, unsigned i) +{ + uint16_t L = I >> 16, R = I, tmp; /* Split 32 bit input into Left and Right parts */ + + tmp = L & KLi1[i]; + R ^= rol16(tmp, 1); + + tmp = R | KLi2[i]; + L ^= rol16(tmp, 1); + + return (((uint32_t)L) << 16) + R; +} + +uint64_t +_kasumi(uint64_t P, uint16_t *KLi1, uint16_t *KLi2, uint16_t *KOi1, uint16_t *KOi2, uint16_t *KOi3, uint16_t *KIi1, uint16_t *KIi2, uint16_t *KIi3) +{ + uint32_t i, L = P >> 32, R = P; /* Split 64 bit input into Left and Right parts */ + + for (i = 0; i < 8; i++) + { + R ^= _kasumi_FO(_kasumi_FL(L, KLi1, KLi2, i), KOi1, KOi2, KOi3, KIi1, KIi2, KIi3, i); /* odd round */ + i++; + L ^= _kasumi_FL(_kasumi_FO(R, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3, i), KLi1, KLi2, i); /* even round */ + } + return (((uint64_t)L) << 32) + R; /* Concatenate Left and Right 32 bits into 64 bit ciphertext */ +} + +/*! \brief Expand key into set of subkeys + * \param[in] key (128 bits) as array of bytes + * \param[out] arrays of round-specific subkeys - see TS 135 202 for details + */ +void +_kasumi_key_expand(const uint8_t *key, uint16_t *KLi1, uint16_t *KLi2, uint16_t *KOi1, uint16_t *KOi2, uint16_t *KOi3, uint16_t *KIi1, uint16_t *KIi2, uint16_t *KIi3) +{ + uint16_t i, C[] = { 0x0123, 0x4567, 0x89AB, 0xCDEF, 0xFEDC, 0xBA98, 0x7654, 0x3210 }; + + for (i = 0; i < 8; i++) /* Work with 16 bit subkeys and create prime subkeys */ + { + C[i] ^= osmo_get2bytes(key + i * 2); + } + /* C[] now stores K-prime[] */ + for (i = 0; i < 8; i++) /* Create round-specific subkeys */ + { + KLi1[i] = rol16(osmo_get2bytes(key + i * 2), 1); + KLi2[i] = C[(i + 2) & 0x7]; + + KOi1[i] = rol16(osmo_get2bytes(key + ((2 * (i + 1)) & 0xE)), 5); + KOi2[i] = rol16(osmo_get2bytes(key + ((2 * (i + 5)) & 0xE)), 8); + KOi3[i] = rol16(osmo_get2bytes(key + ((2 * (i + 6)) & 0xE)), 13); + + KIi1[i] = C[(i + 4) & 0x7]; + KIi2[i] = C[(i + 3) & 0x7]; + KIi3[i] = C[(i + 7) & 0x7]; + } +} + +void +_kasumi_kgcore(uint8_t CA, uint8_t cb, uint32_t cc, uint8_t cd, const uint8_t *ck, uint8_t *co, uint16_t cl) +{ + uint16_t KLi1[8], KLi2[8], KOi1[8], KOi2[8], KOi3[8], KIi1[8], KIi2[8], KIi3[8], i; + uint64_t A = ((uint64_t)cc) << 32, BLK = 0, _ca = ((uint64_t)CA << 16) ; + A |= _ca; + _ca = (uint64_t)((cb << 3) | (cd << 2)) << 24; + A |= _ca; + /* Register loading complete: see TR 55.919 8.2 and TS 55.216 3.2 */ + + uint8_t ck_km[16]; + for (i = 0; i < 16; i++) ck_km[i] = ck[i] ^ 0x55; /* Modified key established */ + + /* preliminary round with modified key */ + _kasumi_key_expand(ck_km, KLi1, KLi2, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3); + A = _kasumi(A, KLi1, KLi2, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3); + + /* Run Kasumi in OFB to obtain enough data for gamma. */ + _kasumi_key_expand(ck, KLi1, KLi2, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3); + for (i = 0; i < cl / 64 + 1; i++) /* i is a block counter */ + { + BLK = _kasumi(A ^ i ^ BLK, KLi1, KLi2, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3); + osmo_64pack2pbit(BLK, co + (i * 8)); + } +} diff --git a/tests/kasumi/kasumi_test.c b/tests/kasumi/kasumi_test.c new file mode 100644 index 0000000..5504905 --- /dev/null +++ b/tests/kasumi/kasumi_test.c @@ -0,0 +1,128 @@ +#include <stdio.h> +#include <stdlib.h> +#include <stdint.h> +#include <string.h> +#include <stdbool.h> + +#include <osmocom/core/bits.h> +#include <osmocom/core/utils.h> +#include <osmocom/gsm/kasumi.h> // for testing internal A5/3 functions + + +inline int _compare_mem(uint8_t * x, uint8_t * y, size_t len) { + if (0 != memcmp(x, y, len)) { + printf ("X: %s\t", osmo_hexdump_nospc(x, len)); + printf ("Y: %s\n", osmo_hexdump_nospc(y, len)); + return 0; + } + return 1; +} + +inline static void test_expansion(uint8_t * test_key, uint16_t * _KLi1, uint16_t * _KLi2, uint16_t * _KOi1, uint16_t * _KOi2, uint16_t * _KOi3, uint16_t * _KIi1, uint16_t * _KIi2, uint16_t * _KIi3, uint16_t * _KLi1_r, uint16_t * _KLi2_r, uint16_t * _KOi1_r, uint16_t * _KOi2_r, uint16_t * _KOi3_r, uint16_t * _KIi1_r, uint16_t * _KIi2_r, uint16_t * _KIi3_r) +{ + _kasumi_key_expand(test_key, _KLi1, _KLi2, _KOi1, _KOi2, _KOi3, _KIi1, _KIi2, _KIi3); + int passed = 1; + passed = _compare_mem((uint8_t *)_KLi1, (uint8_t *)_KLi1_r, 16); + passed = _compare_mem((uint8_t *)_KLi2, (uint8_t *)_KLi2_r, 16); + passed = _compare_mem((uint8_t *)_KOi1, (uint8_t *)_KOi1_r, 16); + passed = _compare_mem((uint8_t *)_KOi2, (uint8_t *)_KOi2_r, 16); + passed = _compare_mem((uint8_t *)_KOi3, (uint8_t *)_KOi3_r, 16); + passed = _compare_mem((uint8_t *)_KIi1, (uint8_t *)_KIi1_r, 16); + passed = _compare_mem((uint8_t *)_KIi2, (uint8_t *)_KIi2_r, 16); + passed = _compare_mem((uint8_t *)_KIi3, (uint8_t *)_KIi3_r, 16); + if (passed) printf(" OK. "); else printf("FAILED!"); +} + +int main(int argc, char **argv) +{ + uint16_t _KLi1[8], _KLi2[8], _KOi1[8], _KOi2[8], _KOi3[8], _KIi1[8], _KIi2[8], _KIi3[8], _KLi1_r[8], _KLi2_r[8], _KOi1_r[8], _KOi2_r[8], _KOi3_r[8], _KIi1_r[8], _KIi2_r[8], _KIi3_r[8]; + + printf("testing KASUMI key expansion and encryption (ETSI TS 135 203):\n"); + printf("KASUMI Test Set 1..."); + +uint8_t _test_key1[] = {0x2B, 0xD6, 0x45, 0x9F, 0x82, 0xC5, 0xB3, 0x00, 0x95, 0x2C, 0x49, 0x10, 0x48, 0x81, 0xFF, 0x48}; +_KLi1_r[0] = 0x57AC; _KLi1_r[1] = 0x8B3E; _KLi1_r[2] = 0x058B; _KLi1_r[3] = 0x6601; _KLi1_r[4] = 0x2A59; _KLi1_r[5] = 0x9220; _KLi1_r[6] = 0x9102; _KLi1_r[7] = 0xFE91; +_KLi2_r[0] = 0x0B6E; _KLi2_r[1] = 0x7EEF; _KLi2_r[2] = 0x6BF0; _KLi2_r[3] = 0xF388; _KLi2_r[4] = 0x3ED5; _KLi2_r[5] = 0xCD58; _KLi2_r[6] = 0x2AF5; _KLi2_r[7] = 0x00F8; +_KOi1_r[0] = 0xB3E8; _KOi1_r[1] = 0x58B0; _KOi1_r[2] = 0x6016; _KOi1_r[3] = 0xA592; _KOi1_r[4] = 0x2209; _KOi1_r[5] = 0x1029; _KOi1_r[6] = 0xE91F; _KOi1_r[7] = 0x7AC5; +_KOi2_r[0] = 0x1049; _KOi2_r[1] = 0x8148; _KOi2_r[2] = 0x48FF; _KOi2_r[3] = 0xD62B; _KOi2_r[4] = 0x9F45; _KOi2_r[5] = 0xC582; _KOi2_r[6] = 0x00B3; _KOi2_r[7] = 0x2C95; +_KOi3_r[0] = 0x2910; _KOi3_r[1] = 0x1FE9; _KOi3_r[2] = 0xC57A; _KOi3_r[3] = 0xE8B3; _KOi3_r[4] = 0xB058; _KOi3_r[5] = 0x1660; _KOi3_r[6] = 0x92A5; _KOi3_r[7] = 0x0922; +_KIi1_r[0] = 0x6BF0; _KIi1_r[1] = 0xF388; _KIi1_r[2] = 0x3ED5; _KIi1_r[3] = 0xCD58; _KIi1_r[4] = 0x2AF5; _KIi1_r[5] = 0x00F8; _KIi1_r[6] = 0x0B6E; _KIi1_r[7] = 0x7EEF; +_KIi2_r[0] = 0x7EEF; _KIi2_r[1] = 0x6BF0; _KIi2_r[2] = 0xF388; _KIi2_r[3] = 0x3ED5; _KIi2_r[4] = 0xCD58; _KIi2_r[5] = 0x2AF5; _KIi2_r[6] = 0x00F8; _KIi2_r[7] = 0x0B6E; +_KIi3_r[0] = 0xCD58; _KIi3_r[1] = 0x2AF5; _KIi3_r[2] = 0x00F8; _KIi3_r[3] = 0x0B6E; _KIi3_r[4] = 0x7EEF; _KIi3_r[5] = 0x6BF0; _KIi3_r[6] = 0xF388; _KIi3_r[7] = 0x3ED5; +test_expansion(_test_key1, _KLi1, _KLi2, _KOi1, _KOi2, _KOi3, _KIi1, _KIi2, _KIi3, _KLi1_r, _KLi2_r, _KOi1_r, _KOi2_r, _KOi3_r, _KIi1_r, _KIi2_r, _KIi3_r); + +if (0xDF1F9B251C0BF45F == _kasumi(0xEA024714AD5C4D84, _KLi1, _KLi2, _KOi1, _KOi2, _KOi3, _KIi1, _KIi2, _KIi3)) + printf("OK."); else printf("FAILED!"); + +printf("\nKASUMI Test Set 2..."); + +uint8_t _test_key2[] = {0x8C, 0xE3, 0x3E, 0x2C, 0xC3, 0xC0, 0xB5, 0xFC, 0x1F, 0x3D, 0xE8, 0xA6, 0xDC, 0x66, 0xB1, 0xF3}; +_KLi1_r[0] = 0x19C7; _KLi1_r[1] = 0x7C58; _KLi1_r[2] = 0x8781; _KLi1_r[3] = 0x6BF9; _KLi1_r[4] = 0x3E7A; _KLi1_r[5] = 0xD14D; _KLi1_r[6] = 0xB8CD; _KLi1_r[7] = 0x63E7; +_KLi2_r[0] = 0x4A6B; _KLi2_r[1] = 0x7813; _KLi2_r[2] = 0xE1E1; _KLi2_r[3] = 0x523E; _KLi2_r[4] = 0xAA32; _KLi2_r[5] = 0x83E3; _KLi2_r[6] = 0x8DC0; _KLi2_r[7] = 0x7B4B; +_KOi1_r[0] = 0xC587; _KOi1_r[1] = 0x7818; _KOi1_r[2] = 0xBF96; _KOi1_r[3] = 0xE7A3; _KOi1_r[4] = 0x14DD; _KOi1_r[5] = 0x8CDB; _KOi1_r[6] = 0x3E76; _KOi1_r[7] = 0x9C71; +_KOi2_r[0] = 0xA6E8; _KOi2_r[1] = 0x66DC; _KOi2_r[2] = 0xF3B1; _KOi2_r[3] = 0xE38C; _KOi2_r[4] = 0x2C3E; _KOi2_r[5] = 0xC0C3; _KOi2_r[6] = 0xFCB5; _KOi2_r[7] = 0x3D1F; +_KOi3_r[0] = 0xDB8C; _KOi3_r[1] = 0x763E; _KOi3_r[2] = 0x719C; _KOi3_r[3] = 0x87C5; _KOi3_r[4] = 0x1878; _KOi3_r[5] = 0x96BF; _KOi3_r[6] = 0xA3E7; _KOi3_r[7] = 0xDD14; +_KIi1_r[0] = 0xE1E1; _KIi1_r[1] = 0x523E; _KIi1_r[2] = 0xAA32; _KIi1_r[3] = 0x83E3; _KIi1_r[4] = 0x8DC0; _KIi1_r[5] = 0x7B4B; _KIi1_r[6] = 0x4A6B; _KIi1_r[7] = 0x7813; +_KIi2_r[0] = 0x7813; _KIi2_r[1] = 0xE1E1; _KIi2_r[2] = 0x523E; _KIi2_r[3] = 0xAA32; _KIi2_r[4] = 0x83E3; _KIi2_r[5] = 0x8DC0; _KIi2_r[6] = 0x7B4B; _KIi2_r[7] = 0x4A6B; +_KIi3_r[0] = 0x83E3; _KIi3_r[1] = 0x8DC0; _KIi3_r[2] = 0x7B4B; _KIi3_r[3] = 0x4A6B; _KIi3_r[4] = 0x7813; _KIi3_r[5] = 0xE1E1; _KIi3_r[6] = 0x523E; _KIi3_r[7] = 0xAA32; +test_expansion(_test_key2, _KLi1, _KLi2, _KOi1, _KOi2, _KOi3, _KIi1, _KIi2, _KIi3, _KLi1_r, _KLi2_r, _KOi1_r, _KOi2_r, _KOi3_r, _KIi1_r, _KIi2_r, _KIi3_r); + +if (0xDE551988CEB2F9B7 == _kasumi(0xD3C5D592327FB11C, _KLi1, _KLi2, _KOi1, _KOi2, _KOi3, _KIi1, _KIi2, _KIi3)) + printf("OK."); else printf("FAILED!"); + +printf("\nKASUMI Test Set 3..."); + +uint8_t _test_key3[] = {0x40, 0x35, 0xC6, 0x68, 0x0A, 0xF8, 0xC6, 0xD1, 0xA8, 0xFF, 0x86, 0x67, 0xB1, 0x71, 0x40, 0x13}; +_KLi1_r[0] = 0x806A; _KLi1_r[1] = 0x8CD1; _KLi1_r[2] = 0x15F0; _KLi1_r[3] = 0x8DA3; _KLi1_r[4] = 0x51FF; _KLi1_r[5] = 0x0CCF; _KLi1_r[6] = 0x62E3; _KLi1_r[7] = 0x8026; +_KLi2_r[0] = 0x8353; _KLi2_r[1] = 0x0B3E; _KLi2_r[2] = 0x5623; _KLi2_r[3] = 0x3CFF; _KLi2_r[4] = 0xC725; _KLi2_r[5] = 0x7203; _KLi2_r[6] = 0x4116; _KLi2_r[7] = 0x830F; +_KOi1_r[0] = 0xCD18; _KOi1_r[1] = 0x5F01; _KOi1_r[2] = 0xDA38; _KOi1_r[3] = 0x1FF5; _KOi1_r[4] = 0xCCF0; _KOi1_r[5] = 0x2E36; _KOi1_r[6] = 0x0268; _KOi1_r[7] = 0x06A8; +_KOi2_r[0] = 0x6786; _KOi2_r[1] = 0x71B1; _KOi2_r[2] = 0x1340; _KOi2_r[3] = 0x3540; _KOi2_r[4] = 0x68C6; _KOi2_r[5] = 0xF80A; _KOi2_r[6] = 0xD1C6; _KOi2_r[7] = 0xFFA8; +_KOi3_r[0] = 0x362E; _KOi3_r[1] = 0x6802; _KOi3_r[2] = 0xA806; _KOi3_r[3] = 0x18CD; _KOi3_r[4] = 0x015F; _KOi3_r[5] = 0x38DA; _KOi3_r[6] = 0xF51F; _KOi3_r[7] = 0xF0CC; +_KIi1_r[0] = 0x5623; _KIi1_r[1] = 0x3CFF; _KIi1_r[2] = 0xC725; _KIi1_r[3] = 0x7203; _KIi1_r[4] = 0x4116; _KIi1_r[5] = 0x830F; _KIi1_r[6] = 0x8353; _KIi1_r[7] = 0x0B3E; +_KIi2_r[0] = 0x0B3E; _KIi2_r[1] = 0x5623; _KIi2_r[2] = 0x3CFF; _KIi2_r[3] = 0xC725; _KIi2_r[4] = 0x7203; _KIi2_r[5] = 0x4116; _KIi2_r[6] = 0x830F; _KIi2_r[7] = 0x8353; +_KIi3_r[0] = 0x7203; _KIi3_r[1] = 0x4116; _KIi3_r[2] = 0x830F; _KIi3_r[3] = 0x8353; _KIi3_r[4] = 0x0B3E; _KIi3_r[5] = 0x5623; _KIi3_r[6] = 0x3CFF; _KIi3_r[7] = 0xC725; +test_expansion(_test_key3, _KLi1, _KLi2, _KOi1, _KOi2, _KOi3, _KIi1, _KIi2, _KIi3, _KLi1_r, _KLi2_r, _KOi1_r, _KOi2_r, _KOi3_r, _KIi1_r, _KIi2_r, _KIi3_r); + +if (0x4592B0E78690F71B == _kasumi(0x62A540981BA6F9B7, _KLi1, _KLi2, _KOi1, _KOi2, _KOi3, _KIi1, _KIi2, _KIi3)) + printf("OK."); else printf("FAILED!"); + +printf("\nKASUMI Test Set 4..."); +uint8_t _test_key4[] = {0x3A, 0x3B, 0x39, 0xB5, 0xC3, 0xF2, 0x37, 0x6D, 0x69, 0xF7, 0xD5, 0x46, 0xE5, 0xF8, 0x5D, 0x43}; +uint64_t I4 = 0xCA49C1C75771AB0B, i; +_kasumi_key_expand(_test_key4, _KLi1, _KLi2, _KOi1, _KOi2, _KOi3, _KIi1, _KIi2, _KIi3); + +for (i = 0; i < 50; i++) + I4 = _kasumi(I4, _KLi1, _KLi2, _KOi1, _KOi2, _KOi3, _KIi1, _KIi2, _KIi3); + +if (0x738BAD4C4A690802 == I4) printf(" OK.\n"); else printf("FAILED!"); + + +uint8_t gamma[32]; + +uint8_t _Key1[] = {0x2B, 0xD6, 0x45, 0x9F, 0x82, 0xC5, 0xBC, 0x00, 0x2B, 0xD6, 0x45, 0x9F, 0x82, 0xC5, 0xBC, 0x00}, +_gamma1[] = {0x88, 0x9E, 0xEA, 0xAF, 0x9E, 0xD1, 0xBA, 0x1A, 0xBB, 0xD8, 0x43, 0x62, 0x32, 0xE4, 0x57, 0x28, 0xD0, 0x1A, 0xA8, 0x91, 0x33, 0xDA, 0x73, 0xC1, 0x1E, 0xAB, 0x68, 0xB7, 0xD8, 0x9B, 0xC8, 0x41}; +_kasumi_kgcore(0xF, 0, 0x0024F20F, 0, _Key1, gamma, 228); +printf ("KGCORE Test Set 1: %d\n", _compare_mem(gamma, _gamma1, 32)); + +uint8_t _Key2[] = {0x95, 0x2C, 0x49, 0x10, 0x48, 0x81, 0xFF, 0x48, 0x95, 0x2C, 0x49, 0x10, 0x48, 0x81, 0xFF, 0x48}, +_gamma2[] = {0xFB, 0x4D, 0x5F, 0xBC, 0xEE, 0x13, 0xA3, 0x33, 0x89, 0x28, 0x56, 0x86, 0xE9, 0xA5, 0xC9, 0x42, 0x40, 0xDE, 0x38, 0x15, 0x01, 0x15, 0xF1, 0x5F, 0x8D, 0x9D, 0x98, 0xB9, 0x1A, 0x94, 0xB2, 0x96}; +_kasumi_kgcore(0xF, 0, 0x00061272, 0, _Key2, gamma, 228); +printf ("KGCORE Test Set 2: %d\n", _compare_mem(gamma, _gamma2, 32)); + +uint8_t _Key3[] = {0xEF, 0xA8, 0xB2, 0x22, 0x9E, 0x72, 0x0C, 0x2A, 0xEF, 0xA8, 0xB2, 0x22, 0x9E, 0x72, 0x0C, 0x2A}, +_gamma3[] = {0x0E, 0x40, 0x15, 0x75, 0x5A, 0x33, 0x64, 0x69, 0xC3, 0xDD, 0x86, 0x80, 0xE3, 0x03, 0x5B, 0xC4, 0x19, 0xA7, 0x8A, 0xD3, 0x86, 0x2C, 0x10, 0x90, 0xC6, 0x8A, 0x39, 0x1F, 0xE8, 0xA6, 0xAD, 0xEB}; +_kasumi_kgcore(0xF, 0, 0x0033FD3F, 0, _Key3, gamma, 228); +printf ("KGCORE Test Set 3: %d\n", _compare_mem(gamma, _gamma3, 32)); + +uint8_t _Key4[] = {0x5A, 0xCB, 0x1D, 0x64, 0x4C, 0x0D, 0x51, 0x20, 0x4E, 0xA5, 0x5A, 0xCB, 0x1D, 0x64, 0x4C, 0x0D}, +_gamma4[] = {0xE0, 0x95, 0x30, 0x6A, 0xD5, 0x08, 0x6E, 0x2E, 0xAC, 0x7F, 0x31, 0x07, 0xDE, 0x4F, 0xA2, 0x2D, 0xC1, 0xDF, 0xC9, 0x7D, 0x5B, 0xC5, 0x66, 0x1D, 0xD6, 0x09, 0x6F, 0x47, 0x6A, 0xED, 0xC6, 0x4B}; +_kasumi_kgcore(0xF, 0, 0x00156B26, 0, _Key4, gamma, 228); +printf ("KGCORE Test Set 4: %d\n", _compare_mem(gamma, _gamma4, 32)); + +uint8_t _Key5[] = {0xD3, 0xC5, 0xD5, 0x92, 0x32, 0x7F, 0xB1, 0x1C, 0x40, 0x35, 0xC6, 0x68, 0x0A, 0xF8, 0xC6, 0xD1}, +_gamma5[] = {0xDC, 0xE6, 0x43, 0x62, 0xAB, 0x5F, 0x89, 0xC1, 0x1E, 0xF0, 0xB3, 0x05, 0x16, 0x65, 0x70, 0xF4, 0x88, 0x9D, 0x55, 0x11, 0xE9, 0xE3, 0x57, 0x5D, 0x06, 0x2B, 0x5C, 0xED, 0x60, 0x39, 0x50, 0x6A}; +_kasumi_kgcore(0xF, 0, 0x000A59B4, 0, _Key5, gamma, 228); +printf ("KGCORE Test Set 5: %d\n", _compare_mem(gamma, _gamma5, 32)); + + return 0; +} diff --git a/tests/kasumi/kasumi_test.ok b/tests/kasumi/kasumi_test.ok new file mode 100644 index 0000000..2c2af4c --- /dev/null +++ b/tests/kasumi/kasumi_test.ok @@ -0,0 +1,10 @@ +testing KASUMI key expansion and encryption (ETSI TS 135 203): +KASUMI Test Set 1... OK. OK. +KASUMI Test Set 2... OK. OK. +KASUMI Test Set 3... OK. OK. +KASUMI Test Set 4... OK. +KGCORE Test Set 1: 1 +KGCORE Test Set 2: 1 +KGCORE Test Set 3: 1 +KGCORE Test Set 4: 1 +KGCORE Test Set 5: 1 -- 1.7.10.4 --------------060001040407040305040404 Content-Type: text/x-patch; name="0003-Add-GEA3-and-GEA4-ciphers.patch" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0003-Add-GEA3-and-GEA4-ciphers.patch" =46rom da6079e295966d9de1bba344f926c8c9eb2af33f Mon Sep 17 00:00:00 2001 From: Max <Max.Suraev(a)fairwaves.ru> Date: Sun, 7 Apr 2013 14:56:02 +0200 Subject: [PATCH 3/5] Add GEA3 and GEA4 ciphers. --- include/osmocom/crypt/gprs_cipher.h | 1 + include/osmocom/gsm/gea.h | 28 +++++ src/gsm/gea.c | 45 +++++++ src/gsm/gprs_gea.c | 39 ++++++ tests/gea/gea_test | 228 +++++++++++++++++++++++++++++= ++++++ tests/gea/gea_test.c | 54 +++++++++ tests/gea/gea_test.ok | 11 ++ 7 files changed, 406 insertions(+) create mode 100644 include/osmocom/gsm/gea.h create mode 100644 src/gsm/gea.c create mode 100644 src/gsm/gprs_gea.c create mode 100755 tests/gea/gea_test create mode 100644 tests/gea/gea_test.c create mode 100644 tests/gea/gea_test.ok diff --git a/include/osmocom/crypt/gprs_cipher.h b/include/osmocom/crypt/= gprs_cipher.h index 3051071..f6ca01a 100644 --- a/include/osmocom/crypt/gprs_cipher.h +++ b/include/osmocom/crypt/gprs_cipher.h @@ -10,6 +10,7 @@ enum gprs_ciph_algo { GPRS_ALGO_GEA1, GPRS_ALGO_GEA2, GPRS_ALGO_GEA3, + GPRS_ALGO_GEA4, _GPRS_ALGO_NUM }; =20 diff --git a/include/osmocom/gsm/gea.h b/include/osmocom/gsm/gea.h new file mode 100644 index 0000000..9ea7231 --- /dev/null +++ b/include/osmocom/gsm/gea.h @@ -0,0 +1,28 @@ +/* + * GEA3 header + * + * See gea.c for details + */ + +#ifndef __GEA_H__ +#define __GEA_H__ + +#include <stdint.h> + +#include <osmocom/crypt/gprs_cipher.h> + +/* + * Performs the GEA3 algorithm (used in GPRS) + * out : uint8_t [] + * len : uint16_t + * kc : uint64_t + * iv : uint32_t + * direct: 0 or 1 + */ + +int osmo_gea3(uint8_t *out, uint16_t len, uint64_t kc, uint32_t iv, enum= gprs_cipher_direction direct); + +int osmo_gea4(uint8_t *out, uint16_t len, uint8_t * kc, uint32_t iv, enu= m gprs_cipher_direction direct); + +#endif /* __GEA_H__ */ + diff --git a/src/gsm/gea.c b/src/gsm/gea.c new file mode 100644 index 0000000..ac879a8 --- /dev/null +++ b/src/gsm/gea.c @@ -0,0 +1,45 @@ +/* + * gea.c + * + * Full reimplementation of GEA3 + * + * Copyright (C) 2013 Max <Max.Suraev(a)fairwaves.ru> + * + * All Rights Reserved + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License alo= ng + * with this program; if not, write to the Free Software Foundation, Inc= =2E, + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ +#include <stdint.h> + +#include <osmocom/core/bits.h> +#include <osmocom/crypt/gprs_cipher.h> +#include <osmocom/gsm/kasumi.h> + + +int osmo_gea4(uint8_t *out, uint16_t len, uint8_t * kc, uint32_t iv, enu= m gprs_cipher_direction direction) { + _kasumi_kgcore(0xFF, 0, iv, direction, kc, out, len * 8); + + return 0; +} + +int osmo_gea3(uint8_t *out, uint16_t len, uint64_t kc, uint32_t iv, enum= gprs_cipher_direction direction) { + uint8_t ck[16]; + osmo_64pack2pbit(kc, ck); + osmo_64pack2pbit(kc, ck + 8); + +// _kasumi_kgcore(0xFF, 0, iv, direction, ck, out, len * 8); + + return osmo_gea4(out, len, ck, iv, direction); +} diff --git a/src/gsm/gprs_gea.c b/src/gsm/gprs_gea.c new file mode 100644 index 0000000..3e0fddd --- /dev/null +++ b/src/gsm/gprs_gea.c @@ -0,0 +1,39 @@ +/* + * gprs_gea.c + * + * GEA3 plugin + * + * Copyright (C) 2013 Max <Max.Suraev(a)fairwaves.ru> + * + * All Rights Reserved + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License alo= ng + * with this program; if not, write to the Free Software Foundation, Inc= =2E, + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ +#include <stdint.h> + +#include <osmocom/crypt/gprs_cipher.h> +#include <osmocom/gsm/gea.h> + +static struct gprs_cipher_impl gea3_impl =3D { + .algo =3D GPRS_ALGO_GEA3, + .name =3D "GEA3 (libosmogsm built-in)", + .priority =3D 1000, + .run =3D &osmo_gea3, +}; + +static void __attribute__((constructor)) osmo_crypt_a5_init(void) +{ + gprs_cipher_register(&gea3_impl); +} diff --git a/tests/gea/gea_test b/tests/gea/gea_test new file mode 100755 index 0000000..aa1fb66 --- /dev/null +++ b/tests/gea/gea_test @@ -0,0 +1,228 @@ +#! /bin/bash + +# gea/gea_test - temporary wrapper script for .libs/gea_test +# Generated by libtool (GNU libtool) 2.4.2 Debian-2.4.2-1ubuntu2 +# +# The gea/gea_test program cannot be directly executed until all the lib= tool +# libraries that it depends on are installed. +# +# This wrapper script should never be moved out of the build directory. +# If it is, it will not operate correctly. + +# Sed substitution that helps us do robust quoting. It backslashifies +# metacharacters that are still active within double-quoted strings. +sed_quote_subst=3D's/$[`"$\\]$/\\\1/g' + +# Be Bourne compatible +if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then + emulate sh + NULLCMD=3D: + # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which + # is contrary to our usage. Disable this feature. + alias -g '${1+"$@"}'=3D'"$@"' + setopt NO_GLOB_SUBST +else + case `(set -o) 2>/dev/null` in *posix*) set -o posix;; esac +fi +BIN_SH=3Dxpg4; export BIN_SH # for Tru64 +DUALCASE=3D1; export DUALCASE # for MKS sh + +# The HP-UX ksh and POSIX shell print the target directory to stdout +# if CDPATH is set. +(unset CDPATH) >/dev/null 2>&1 && unset CDPATH + +relink_command=3D"(cd /home/god/source/libosmocore/tests; { test -z \"\$= {LIBRARY_PATH+set}\" || unset LIBRARY_PATH || { LIBRARY_PATH=3D; export L= IBRARY_PATH; }; }; { test -z \"\${COMPILER_PATH+set}\" || unset COMPILER_= PATH || { COMPILER_PATH=3D; export COMPILER_PATH; }; }; { test -z \"\${GC= C_EXEC_PREFIX+set}\" || unset GCC_EXEC_PREFIX || { GCC_EXEC_PREFIX=3D; ex= port GCC_EXEC_PREFIX; }; }; { test -z \"\${LD_RUN_PATH+set}\" || unset LD= _RUN_PATH || { LD_RUN_PATH=3D; export LD_RUN_PATH; }; }; { test -z \"\${L= D_LIBRARY_PATH+set}\" || unset LD_LIBRARY_PATH || { LD_LIBRARY_PATH=3D; e= xport LD_LIBRARY_PATH; }; }; PATH=3D/home/god/bin:/sbin:/usr/local/sbin:/= usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games; = export PATH; gcc -Wall -I../include -g -O2 -o \$progdir/\$file gea_test.o= ../src/.libs/libosmocore.so ../src/gsm/.libs/libosmogsm.so -Wl,-rpath -= Wl,/home/god/source/libosmocore/src/.libs -Wl,-rpath -Wl,/home/god/source= /libosmocore/src/gsm/.libs)" + +# This environment variable determines our operation mode. +if test "$libtool_install_magic" =3D "%%%MAGIC variable%%%"; then + # install mode needs the following variables: + generated_by_libtool_version=3D'2.4.2' + notinst_deplibs=3D' ../src/libosmocore.la ../src/gsm/libosmogsm.la' +else + # When we are sourced in execute mode, $file and $ECHO are already set= =2E + if test "$libtool_execute_magic" !=3D "%%%MAGIC variable%%%"; then + file=3D"$0" + +# A function that is used when there is no print builtin or printf. +func_fallback_echo () +{ + eval 'cat <<_LTECHO_EOF +$1 +_LTECHO_EOF' +} + ECHO=3D"printf %s\\n" + fi + +# Very basic option parsing. These options are (a) specific to +# the libtool wrapper, (b) are identical between the wrapper +# /script/ and the wrapper /executable/ which is used only on +# windows platforms, and (c) all begin with the string --lt- +# (application programs are unlikely to have options which match +# this pattern). +# +# There are only two supported options: --lt-debug and +# --lt-dump-script. There is, deliberately, no --lt-help. +# +# The first argument to this parsing function should be the +# script's ../libtool value, followed by no. +lt_option_debug=3D +func_parse_lt_options () +{ + lt_script_arg0=3D$0 + shift + for lt_opt + do + case "$lt_opt" in + --lt-debug) lt_option_debug=3D1 ;; + --lt-dump-script) + lt_dump_D=3D`$ECHO "X$lt_script_arg0" | /bin/sed -e 's/^X//' -e = 's%/[^/]*$%%'` + test "X$lt_dump_D" =3D "X$lt_script_arg0" && lt_dump_D=3D. + lt_dump_F=3D`$ECHO "X$lt_script_arg0" | /bin/sed -e 's/^X//' -e = 's%^.*/%%'` + cat "$lt_dump_D/$lt_dump_F" + exit 0 + ;; + --lt-*) + $ECHO "Unrecognized --lt- option: '$lt_opt'" 1>&2 + exit 1 + ;; + esac + done + + # Print the debug banner immediately: + if test -n "$lt_option_debug"; then + echo "gea_test:gea/gea_test:${LINENO}: libtool wrapper (GNU libtool)= 2.4.2 Debian-2.4.2-1ubuntu2" 1>&2 + fi +} + +# Used when --lt-debug. Prints its arguments to stdout +# (redirection is the responsibility of the caller) +func_lt_dump_args () +{ + lt_dump_args_N=3D1; + for lt_arg + do + $ECHO "gea_test:gea/gea_test:${LINENO}: newargv[$lt_dump_args_N]: $l= t_arg" + lt_dump_args_N=3D`expr $lt_dump_args_N + 1` + done +} + +# Core function for launching the target application +func_exec_program_core () +{ + + if test -n "$lt_option_debug"; then + $ECHO "gea_test:gea/gea_test:${LINENO}: newargv[0]: $progdir/$pr= ogram" 1>&2 + func_lt_dump_args ${1+"$@"} 1>&2 + fi + exec "$progdir/$program" ${1+"$@"} + + $ECHO "$0: cannot exec $program $*" 1>&2 + exit 1 +} + +# A function to encapsulate launching the target application +# Strips options in the --lt-* namespace from $@ and +# launches target application with the remaining arguments. +func_exec_program () +{ + case " $* " in + *\ --lt-*) + for lt_wr_arg + do + case $lt_wr_arg in + --lt-*) ;; + *) set x "$@" "$lt_wr_arg"; shift;; + esac + shift + done ;; + esac + func_exec_program_core ${1+"$@"} +} + + # Parse options + func_parse_lt_options "$0" ${1+"$@"} + + # Find the directory that this script lives in. + thisdir=3D`$ECHO "$file" | /bin/sed 's%/[^/]*$%%'` + test "x$thisdir" =3D "x$file" && thisdir=3D. + + # Follow symbolic links until we get to the real thisdir. + file=3D`ls -ld "$file" | /bin/sed -n 's/.*-> //p'` + while test -n "$file"; do + destdir=3D`$ECHO "$file" | /bin/sed 's%/[^/]*$%%'` + + # If there was a directory component, then change thisdir. + if test "x$destdir" !=3D "x$file"; then + case "$destdir" in + [\\/]* | [A-Za-z]:[\\/]*) thisdir=3D"$destdir" ;; + *) thisdir=3D"$thisdir/$destdir" ;; + esac + fi + + file=3D`$ECHO "$file" | /bin/sed 's%^.*/%%'` + file=3D`ls -ld "$thisdir/$file" | /bin/sed -n 's/.*-> //p'` + done + + # Usually 'no', except on cygwin/mingw when embedded into + # the cwrapper. + WRAPPER_SCRIPT_BELONGS_IN_OBJDIR=3Dno + if test "$WRAPPER_SCRIPT_BELONGS_IN_OBJDIR" =3D "yes"; then + # special case for '.' + if test "$thisdir" =3D "."; then + thisdir=3D`pwd` + fi + # remove .libs from thisdir + case "$thisdir" in + *[\\/].libs ) thisdir=3D`$ECHO "$thisdir" | /bin/sed 's%[\\/][^\\/]*= $%%'` ;; + .libs ) thisdir=3D. ;; + esac + fi + + # Try to get the absolute directory name. + absdir=3D`cd "$thisdir" && pwd` + test -n "$absdir" && thisdir=3D"$absdir" + + program=3Dlt-'gea_test' + progdir=3D"$thisdir/.libs" + + if test ! -f "$progdir/$program" || + { file=3D`ls -1dt "$progdir/$program" "$progdir/../$program" 2>/dev= /null | /bin/sed 1q`; \ + test "X$file" !=3D "X$progdir/$program"; }; then + + file=3D"$$-$program" + + if test ! -d "$progdir"; then + mkdir "$progdir" + else + rm -f "$progdir/$file" + fi + + # relink executable if necessary + if test -n "$relink_command"; then + if relink_command_output=3D`eval $relink_command 2>&1`; then : + else + printf %s\n "$relink_command_output" >&2 + rm -f "$progdir/$file" + exit 1 + fi + fi + + mv -f "$progdir/$file" "$progdir/$program" 2>/dev/null || + { rm -f "$progdir/$program"; + mv -f "$progdir/$file" "$progdir/$program"; } + rm -f "$progdir/$file" + fi + + if test -f "$progdir/$program"; then + if test "$libtool_execute_magic" !=3D "%%%MAGIC variable%%%"; then + # Run the actual program with our arguments. + func_exec_program ${1+"$@"} + fi + else + # The program doesn't exist. + $ECHO "$0: error: \`$progdir/$program' does not exist" 1>&2 + $ECHO "This script is just a wrapper for $program." 1>&2 + $ECHO "See the libtool documentation for more information." 1>&2 + exit 1 + fi +fi diff --git a/tests/gea/gea_test.c b/tests/gea/gea_test.c new file mode 100644 index 0000000..70a4d2a --- /dev/null +++ b/tests/gea/gea_test.c @@ -0,0 +1,54 @@ +#include <stdio.h> +#include <stdlib.h> +#include <stdint.h> +#include <string.h> +#include <stdbool.h> + +#include <osmocom/core/bits.h> +#include <osmocom/core/utils.h> +#include <osmocom/crypt/gprs_cipher.h> +#include <osmocom/gsm/gea.h> + +void print_check(char * res, uint8_t * out, uint16_t len) { + uint8_t buf[len]; + osmo_hexparse(res, buf, len); + if (0 !=3D memcmp(buf, out, len)) { + printf("FAIL:\n"); + printf("OUT: %s\n", osmo_hexdump_nospc(out, len)); + printf("EXP: %s\n", osmo_hexdump_nospc(buf, len)); + } + else printf("OK\n"); +} + +void test_gea3(uint64_t kc, uint32_t iv, int dir, uint16_t len, char * r= es) { + printf("%d: %d -> 0x%X ", len, dir, iv); + uint8_t out[len]; + osmo_gea3(out, len, kc, iv, dir); + print_check(res, out, len); +} + +void test_gea4(char * kc, uint32_t iv, int dir, uint16_t len, char * res= ) { + printf("%d: %d -> 0x%X ", len, dir, iv); + uint8_t out[len], ck[256]; + osmo_hexparse(kc, ck, len); + osmo_gea4(out, len, ck, iv, dir); + print_check(res, out, len); +} + +int main(int argc, char **argv) +{ + printf("GEA3 support: %d\n", gprs_cipher_supported(GPRS_ALGO_GEA3));= + printf("GEA4 support: %d\n", gprs_cipher_supported(GPRS_ALGO_GEA4));= +// test vectors according to 3GPP TS 55.217 and TS 55.218 +test_gea3(0x2BD6459F82C5BC00, 0x8E9421A3, 0, 59, "5F359709DE950D0105B17B= 6C90194280F880B48DCCDC2AFEED415DBEF4354EEBB21D073CCBBFB2D706BD7AFFD371FC9= 6E3970D143DCB2624054826"); +test_gea3(0x952C49104881FF48, 0x5064DB71, 0, 59, "FDC03D738C8E14FF0320E5= 9AAF75760799E9DA78DD8F888471C4AEAAC1849633A26CD84F459D265B83D7D9B9A0B1E54= F4D75E331640DF19E0DB0E0"); +test_gea3(0xEFA8B2229E720C2A, 0x4BDBD5E5, 1, 59, "4718A2ADFC90590949DDAD= AB406EC3B925F1AF1214673909DAAB96BB4C18B1374BB1E99445A81CC856E47C6E49E9DBB= 9873D0831B2175CA1E109BA"); +test_gea3(0x3451F23A43BD2C87, 0x893FE14F, 0, 59, "B46B1E284E3F8B63B86D9D= F0915CFCEDDF2F061895BF9F82BF2593AE4847E94A4626C393CF8941CE15EA7812690D841= 5B88C5730FE1F5D410E16A2"); +test_gea3(0xCAA2639BE82435CF, 0x8FE17885, 1, 59, "9FEFAF155A26CF35603E72= 7CDAA87BA067FD84FF98A50B7FF0EC8E95A0FB70E79CB93DEE2B7E9AB59D050E126240157= 1F349C68229DDF0DECC4E85"); +test_gea3(0x1ACA8B448B767B39, 0x4F7BC3B5, 0, 59, "514F6C3A3B5A55CA190092= F7BB6E80EF3EDB738FCDCE2FF90BB387DDE75BBC32A04A67B898A3DFB8198FFFC37D437CF= 69E7F9C13B51A868720E750"); +test_gea4("D3C5D592327FB11C4035C6680AF8C6D1", 0x0A3A59B4, 0, 51, "6E217C= E41EBEFB5EC8094C15974290065E42BABC9AE35654A53085CE68DFA4426A2FF0AD4AF3341= 006A3F84B7613ACB4FBDC34"); +test_gea4("3D43C388C9581E337FF1F97EB5C1F85E", 0x48571AB9, 0, 59, "FC7314= EF00A63ED0116F236C5D25C54EEC56A5B71F9F18B4D7941F84E422ACBDE5EEA9A20467900= 2D14F312F3DEE2A1AC917C3FBDC3696143C0F5D"); +test_gea4("A4496A64DF4F399F3B4506814A3E07A1", 0xEB04ADE2, 1, 59, "2AEB59= 70FB06B718027D048488AAF24FB3B74EA4A6B1242FF85B108FF816A303C72757D9AAD862B= 835D1D287DBC141D0A28D79D87BB137CD1198CD"); + + return 0; +} diff --git a/tests/gea/gea_test.ok b/tests/gea/gea_test.ok new file mode 100644 index 0000000..15abd38 --- /dev/null +++ b/tests/gea/gea_test.ok @@ -0,0 +1,11 @@ +GEA3 support: 0 +GEA4 support: 0 +59: 0 -> 0x8E9421A3 OK +59: 0 -> 0x5064DB71 OK +59: 1 -> 0x4BDBD5E5 OK +59: 0 -> 0x893FE14F OK +59: 1 -> 0x8FE17885 OK +59: 0 -> 0x4F7BC3B5 OK +51: 0 -> 0xA3A59B4 OK +59: 0 -> 0x48571AB9 OK +59: 1 -> 0xEB04ADE2 OK --=20 1.7.10.4 --------------060001040407040305040404 Content-Type: text/x-patch; name="0004-Add-A5-3-and-A5-4-ciphers.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="0004-Add-A5-3-and-A5-4-ciphers.patch"

1 0

[PATCH 1/5] Add helper routines.
by Max 07 Apr '13

07 Apr '13

--- include/osmocom/core/bits.h | 14 +++++++++++++- include/osmocom/gsm/gsm_utils.h | 16 ++++++++++++++++ src/bits.c | 33 +++++++++++++++++++++++++++++++++ tests/bits/bitrev_test.c | 18 ++++++++++++++++-- tests/bits/bitrev_test.ok | 1 + 5 files changed, 79 insertions(+), 3 deletions(-) diff --git a/include/osmocom/core/bits.h b/include/osmocom/core/bits.h index 4c68532..bf79445 100644 --- a/include/osmocom/core/bits.h +++ b/include/osmocom/core/bits.h @@ -2,7 +2,7 @@ #define _OSMO_BITS_H #include <stdint.h> - +#include <stddef.h> /*! \defgroup bits soft, unpacked and packed bits * @{ */ @@ -73,6 +73,18 @@ uint32_t osmo_revbytebits_8(uint8_t x); /* \brief reverse the bits of each byte in a given buffer */ void osmo_revbytebits_buf(uint8_t *buf, int len); +/* \brief reverse the order of the bytes in a given buffer */ +void osmo_revbytes_buf(uint8_t *buf, size_t len); + +/* \brief left circular shift */ +uint16_t rol16(uint16_t in, unsigned shift); + +/* return 2 bytes from a given array glued into single uint16_t */ +uint16_t osmo_get2bytes(const uint8_t *a); + +/* convert uint64_t into array of 8 bytes in out */ +void osmo_64pack2pbit(uint64_t in, pbit_t *out); + /*! @} */ #endif /* _OSMO_BITS_H */ diff --git a/include/osmocom/gsm/gsm_utils.h b/include/osmocom/gsm/gsm_utils.h index cdbac87..f215c7b 100644 --- a/include/osmocom/gsm/gsm_utils.h +++ b/include/osmocom/gsm/gsm_utils.h @@ -85,6 +85,22 @@ static inline int ms_cm2_a5n_support(uint8_t *cm2, int n) { } } +/* According to GSM 04.08 Chapter 10.5.1.7 */ +static inline int ms_cm3_a5n_support(uint8_t *cm3, int n) { + switch (n) { + case 4: return (cm3[0] & (1<<0)) ? 1 : 0; + case 5: return (cm3[0] & (1<<1)) ? 1 : 0; + case 6: return (cm3[0] & (1<<2)) ? 1 : 0; + case 7: return (cm3[0] & (1<<3)) ? 1 : 0; + default: + return 0; + } +} + +static inline int ms_a5n_support(uint8_t *cm, int n) { + return ((n < 4) ? ms_cm2_a5n_support(cm, n) : ms_cm3_a5n_support(cm, n)); +} + /* According to GSM 04.08 Chapter 10.5.2.29 */ static inline int rach_max_trans_val2raw(int val) { return (val >> 1) & 3; } static inline int rach_max_trans_raw2val(int raw) { diff --git a/src/bits.c b/src/bits.c index 6be6d7a..41c46df 100644 --- a/src/bits.c +++ b/src/bits.c @@ -211,4 +211,37 @@ void osmo_revbytebits_buf(uint8_t *buf, int len) } } +void osmo_revbytes_buf(uint8_t *buf, size_t len) +{ + uint8_t *end = buf + len - 1, tmp; + + while (buf < end) { + tmp = *buf; + *buf++ = *end; + *end-- = tmp; + } +} + +/* left circular shift */ +uint16_t rol16(uint16_t in, unsigned shift) +{ + return (in << shift) | (in >> (16 - shift)); +} + +/* return 2 bytes from a given array glued into single uint16_t */ +uint16_t osmo_get2bytes(const uint8_t *a) +{ /* UNSAFE! NO out-of-bounds access check. Do NOT use unless you know what you are doing! */ + return (uint16_t)((((uint16_t)a[0]) << 8) + (uint16_t)a[1]); +} + +/* convert uint64_t into array of 8 bytes in out */ +void osmo_64pack2pbit(uint64_t in, pbit_t *out) +{ + int i; + for (i = 7; i >=0; i--) { + out[i] = in & 0xFF; + in >>= 8; + } +} + /*! @} */ diff --git a/tests/bits/bitrev_test.c b/tests/bits/bitrev_test.c index 5eca990..938d261 100644 --- a/tests/bits/bitrev_test.c +++ b/tests/bits/bitrev_test.c @@ -1,4 +1,4 @@ - +#include <inttypes.h> #include <stdio.h> #include <stdlib.h> #include <stdint.h> @@ -12,7 +12,7 @@ static const uint8_t exp_out[] = { 0x80, 0x40, 0x20, 0x10, 0x08, 0x04, 0x02, 0x0 int main(int argc, char **argv) { - uint8_t out[ARRAY_SIZE(input)]; + uint8_t out[ARRAY_SIZE(input)], test[8]; unsigned int offs; for (offs = 0; offs < sizeof(out); offs++) { @@ -32,5 +32,19 @@ int main(int argc, char **argv) printf("\n"); } + printf("checking bit packer... "); + uint64_t _test = ((uint64_t)rand() << 32) + rand(); + osmo_64pack2pbit(_test, test); + char s[18], *p; + snprintf(s, 17, "%.16" PRIx64, _test); + p = osmo_hexdump_nospc(test, 8); + if (0 != memcmp(s, p, 8)) { + printf ("%s\t", s); + printf ("%s\t", p); + printf("FAILED!\n"); + return 2; + } + printf("OK\n"); + return 0; } diff --git a/tests/bits/bitrev_test.ok b/tests/bits/bitrev_test.ok index 47f402f..8a5fc6e 100644 --- a/tests/bits/bitrev_test.ok +++ b/tests/bits/bitrev_test.ok @@ -22,3 +22,4 @@ REVERSED: 02 01 INORDER: 80 REVERSED: 01 +checking bit packer... OK -- 1.7.10.4 --------------060001040407040305040404 Content-Type: text/x-patch; name="0002-Add-KASUMI-implementation.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="0002-Add-KASUMI-implementation.patch"

1 0

[CONFERENCE] HES2013 @Paris
by choukoumoun 06 Apr '13

06 Apr '13

Hackito Ergo Sum 2013 -- Call For Paper -- HES2013 CFP ** http://hackitoergosum.org ** 2-4 May 2013 / Paris / France 11111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111111111111111111111111111111111111 11111111111111111000000111111111111111111000000111111111111111111 11111111111111111000000111111111111111111000000111111111111111111 11111111111111111000000111111111111111111000000111111111111111111 11111111111111111000000111111111111111111000000111111111111111111 11111111111000000000000000000000000000000000000000000111111111111 11111111111000000000000000000000000000000000000000000111111111111 11111111111000000000000000000000000000000000000000000111111111111 11111111111000000000000000000000000000000000000000000111111111111 11111000000000000111111111111000000111111111111000000000000111111 11111000000000000111111111111000000111111111111000000000000111111 11111000000000000111111111111000000111111111111000000000000111111 11111000000000000111111111111000000111111111111000000000000111111 11111000000000000000000000000000000000000000000000000000000111111 11111000000000000000000000000000000000000000000000000000000111111 11111000000000000000000000000000000000000000000000000000000111111 11111000000000000000000000000000000000000000000000000000000111111 11111000000000000000000000000000000000000000000000000000000111111 11111000000000000000000000000000000000000000000000000000000111111 11111000000000000000000000000000000000000000000000000000000111111 11111000000111111000000111111000000111111000000111111000000111111 11111000000111111000000111111000000111111000000111111000000111111 11111000000111111000000111111000000111111000000111111000000111111 11111000000111111000000111111000000111111000000111111000000111111 11111111111000000111111000000111111000000111111000000111111111111 11111111111000000111111000000111111000000111111000000111111111111 11111111111000000111111000000111111000000111111000000111111111111 11111111111000000111111000000111111000000111111000000111111111111 11111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111111111111111111111111111111111111 111111111111111111111111111111111111111111111 111111111111111111111111111111111111111111111 HES 2013 111111111111111111111111111111111111111111111 Paris, 2-4 May 2013 111111111111111111111111111111111111111111111 11111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111111111111111111111111111111111111 --[ Synopsis: Hackito Ergo Sum is an international conference focused on security and hacking breakthroughs from many different perspectives: corporate, hackers, industry, governments, academics. Diversity and creativity in this domain are the key words. HES2013 will have for its 4th edition some of the best hacking talents in the world. --[ Venue: Hackito Ergo Sum 2013 will take place in Paris, France from the 2nd to the 4th of May, 2013, at Cite des sciences et de l'industrie. Address: 30 Avenue Corentin Cariou 75019 Paris FRANCE It is easily accessible via public transport with metro line 7, at the Porte de la Villette, or by car using orbital motorway (Multiverse level I / 61d8327deb882cf99). Map and pictures are available here: https://plus.google.com/110203164083435669962/about?gl=fr&hl=fr --[ Introduction: It's 2013 and we're alive! Awesome! Let's have a look at what hacking future we have. From the tectonic shift of forces from the West to the East, the rise of military-powered attack software, and the evermore sophisticated games of spooks, yesteryear's "cloak-and-dagger" has come to the hacking world. This is a game of mapping individuals and their influences at hacking conferences, cancelling Visas of potential future-enemies in a the foreshadowed "cyber-war", buying AND selling 0-days to identify hidden networks of the underground, raising their filternet, establishing red-button routers, identifying challenge winners and profiling their hacking methodologies, and owning botnets for sheer firepower. We are in deep shit. But hey, wait, that's FUN! No matter the forces that threaten our liberties and trace our modems, we still have not and will not loose our passion to tinker, to explore, to peal back the layers of technological reality. We have not lost the Will to Hack. For the rest of us, we're still all alike when we read media and government propaganda: hackers intruding everything and waging cyberwar, panic-spreading, FUD-driven definition of us as bad guys, mafia, and evil-doers. All alike. Our world is the world of hack, of the beauty of the baud and the sheer madness of the screaming electron, (respect to Phrack and The Mentor), and we won't change it for anything. Because it is the most immense and yet most fragile human creation; it is our world and we own it. If a khaki-pants warmonger or a 3-piece suit master-of-the-world wannabee wants to confiscate it from us, restrict our freedom, ban our activities, turn the public opinion to follow their agenda, well, they may try, they may block some of us, they may even put some of us out of the circuit, but they can't replicate our passion, our energy, our love of what we do, our insane attention to the detail and effectiveness of our techniques. Because in end, we're all alike. And we're damn ALIVE! Now for the enlightened, our shared future is full of opportunities, the humbling discoveries of others, and open projects that inspire us to join and create together. Our futures is limited only by our capability to collaborate in great projects, and also to leave space for the others. TOR is kicking and OONI roaring; TRAILS offers OS privacy and security for who needs it; many conferences are being born everywhere; Frida IRE is an amazing reversing tool; Qubes provides long sought-out tough security; plenty of new tools are being released to reveal unique weaknesses and failures. This furious creativity and ecosystem gives birth to world-changing start-ups, vital resources, must-have open source projects, and of course, one of the most open and creative cultures. All this, against all odds, exists and develops without bias nor prejudice. Just like it is. So for Hackito Ergo Sum 2013, we want to see you exactly in the same way: just like you are (ALERT: if you think about food here you need to smash your TV and DNS bind youtube.com to github.com), new or old school, skiddie or security professional, n00b or l33t, to share and show diversity, and, most of all, to LEARN. It is therefore our utmost pleasure to welcome you to this 4th edition of HES! Since 2010, the goal of Hackito Ergo Sum has been to promote security research, broaden public awareness, and create an open forum so that communication between researchers, the security industry, experts, and the public can happen. Like every year, we offer the possibility to hackers, security researchers, students, and academics to present their projects and research. During the three days of HES, research conferences, solutions presentations, panels, debates, AND PARTIES will aim to share, mix, and determine the future of IT security & hacking. --[ Content of the Research Track: We are expecting submissions in English only. The format will be 45 minutes presentation + 10 minutes Q&A. Please note that talks whose content will be judged too commercial or biased toward a given vendor will be rejected. We will have slots for AnonConf -- that is, speaking about topics for which improved anonymity and freedom of speech is imperative. (Write Anon in email, use PGP). We will also consider new and first time presenters, so that anyone can get his/her foot in the door. Don't be shy, just say "It's one of my first conf submission", and we'll be kind. For the research track, preference will be given to offensive, innovative, and highly technical proposals. As a suggestion, we would love to see things about: * SIPRnet, NIPRnet & other defense networks funny stories * LTE radio and signaling abuses and/or real life hacks * 4G, Diameter & GRX/IPX hacks * Exploit style stylography * CTF Antiforensics: Detection of Intelligence gathering CTFs * Government filternets (formerly known as Internet, R.I.P) * x86/64 & Non-x86 exploitation * New methods to detect software bugs (source or binary based) * Funky Kernel land exploits * Offensive forensics * Current kernel buffer overflows exploit techniques for your grandmother * SAT solving your ROP gadgeting and chaining * Real life hack automation (yeah, default passwords and reuse DO work better than overflows in a kernel 3.x world) * IOS vuln research & vulndev * Identifying tainted 0-day sploits for government-sponsored grey market tracing * Mobile Botnets and Overlay networks-based C&C * IPv6 & "Carrier Grade NATs" advances * M2M Machine Type Communication * Sound hacking: binaural, brown, ... * UEFI malware writing * Android, RIM, Bada, IOS Mobile applications & OS hacks * TPM and Secure Boot kitting & knifing * FPGA backdoors * Automated Hardware reverse engineering * Hardware security & lockpicking in 2013 We will also have a Zero Day Show, as last year, at the end of the conference so that people can share (love/kindness) or show (salivate/envy) their new babies to the world. Prepare! Zombie Exploitocalyps incoming :) We highly encourage any other presentation topic, especially the one we may not even imagine. If you want to share skills on a specific subject during a workshop, feel free to contact us. --[ Submissions: [*] Requested information: Submissions must contain the following information: * Speakers name or alias * Presentation Title * Description * Needs: Internet? Others? * Demo (Y/N) * Company (name) or Independent? (optional) * Address (optional) * Phone (optional) * Email (optional) * Biography (optional) We highly encourage and will favor presentations with demos. Specify if submission contains any of the following information: * Tool * Slides * Whitepaper [*] How to submit: Submit your presentation and materials by sending an email to: hes-cfp(a)lists.hackitoergosum.org --[ Dates: 2013-02-04 Call for Paper 2013-03-31 Submission Deadline 2013-04-04 Acceptance notification 2013-04-07 Program announcement 2013-05-02 Start of conference 2013-05-04 End of conference --[ Program Committee: The following program committee will review the submissions: - Tavis Ormandy (Google) @taviso - Mark Dowd (AzimuthSecurity) @mdowd - Alex Rice (Facebook) - Barnaby Jack (IOactive) @barnaby_jack - Charlie Miller @0xcharlie - David Litchfield (V3rity Software) @dlitchfield - Nico Waisman (Immunity) @nicowaisman - Philippe Langlois (P1 Security) @philpraxis - Laurent Gaffie @laurentgaffie - Julien Tinnes (Google) - Brad Spendler (aka spender) (Grsecurity) - Silvio Cesare (Deakin University) @silviocesare - Carlos Sarraute (Core security) - Itzik Kotler (aka izik) @itzikkotler - Jason A. Donenfeld (ZX2C4) @zx2c4 - Rodrigo Branco (Intel) @bsdaemon - Tim Shelton (HAWK Network Defense) @redsandbl4ck - Ilja Van Sprundel (IOActive) - Raoul Chiesa (tstf) - Dhillon Andrew Kannabhiran (HITB) @hackinthebox - Philip Petterson (aka Rebel) - The Grugq (COSEINC) @thegrugq - Emmanuel Gadaix (TSTF) @gadaix - Kugg (/tmp/lab) - Harald Welte (gnumonks.org) @LaF0rge - Van Hauser (THC) - Fyodor Yarochkin @fygrave - Gamma (THC, Teso) @GammaTHC - Pipacs (Linux Kernel Page Exec Protection) - Nico Golde (Qualcomm) @iamnion --[ Fees: Here is the list of prices for HES 2013: * Corporate ticket: 480 EUR * Security professionals: 160 EUR * Non security professionals: 70 EUR * Discount for students below 26: 50 EUR * Discount for CVE/exploit publisher in 2012-2013: 50 EUR * Volunteers (Must register, see below): 0 EUR Corporate tickets are a great way to directly sponsor HES and help us to continue to organize this event. Special privileges or goodies may be offer with these tickets. Buy your ticket online : http://fr.amiando.com/NGBMIJM.html --[ Sponsors: We are looking for sponsors. Don't forget that sponsors are essential for events like HES. Entrance fees and sponsors fees are used to fund international speakers travel costs and hosting facility. Please ask for the HES2013 Sponsor Kit at hes2013-orga(a)lists.hackitoergosum.org. --[ Volunteers: Volunteers who sign up before 2013-04-07 get free access and will need to be present onsite two days before (2013-04-30) if no further arrangement is made with the organization. --[ Journalists: Journalists are welcome, but are required to comply with simple rules to ensure the mutual respect among adults we aim to bring in Hackito. In particular, filming or taking pictures of attendees without their prior agreement is absolutely prohibited. "We shall respect privacy and people" is the only motto. Register here: http://2013.hackitoergosum.org/press/ --[ Challenges Of course, there will be an online challenge during the conference, hosted and animated by Over The Wire. We will announce the country of honor for that regard shortly. We will also have a new Hacker & Vendors challenge: -^-^-^- The Fuzzor -^-^-^- This challenge will enable the ultimate test between offensive and defensive people. If you think you can hack anything, you're offensive. If you think your product is so secure it won't suffer a hack, you're defensive. And we'll get the two groups to meet on a neutral ground, in a never-done before fashion. Hackers: Register to the conference and prepare your Hacking tools. Vendors: Prepare your software to be tested like never before. We will give more details before the conference. This new challenge will rock your underwear! --[ Security Vacation Club - Hackito Tour After Hackito Ergo Sum, we will need to rest from the intensity of the conference. That's why we're organizing a Hackito tour! Beach, clubs, code, meeting great people and party. We will go from Paris to Ibiza to Berlin and back to Paris. For the lucky few, one sponsored Villa will host us in Ibiza. See you there. --[ Anti-sexism and LGBTA Friendly: This conference is open to any sex, any color, any genre, any alienness, whatever it may be. --[ Greetz: We would like to thank the HES2013 Team, its reviewing committee and all the volunteers for their time and dedication in making this event a success. We would also like to greet all the speakers of last year's edition for the quality of their presentation and the great time we shared in Paris: you are all most welcome back in Paris for the 2013 edition. Likewise, we'd like to thank last year's sponsors for their unconditional support. Feel free to support us again for this 2013 edition. Finally, we would like to thank all the people who participated to last years edition: whatever different views of the world, communication and exchange is probably what makes people human, and that's why we make Hackito happen. See you all in May! Peace, Love, Passion. --[ Contact: hes2013-orga(a)lists.hackitoergosum.org Please submit via hes-cfp(a)lists.hackitoergosum.org Hackito Ergo Sum 2013 conference - http://hackitoergosum.org -- [ Social Media: Keep in touch with the HES Organization via Twitter! Website: http://2013.hackitoergosum.org @hesconference on Twitter ! - https://twitter.com/hesconference -[EOF]-

2 1

osmocon via uart
by tom jerry 31 Mar '13

31 Mar '13

i have a motorola c118 and running osmocon in raspberry. Am using the uart available in gpio pins. What are the ideal settings in terms of baud rate to allow communication,as i can't get hello world working.the cable is ok since when i short tx and rx,and use minicom whatever i type on the keyboard appears on minicom. Thanks

1 0

NEWSDR'13 Workshop / OpenBSC / OsmocomBB
by Harald Welte 29 Mar '13

29 Mar '13

Hi All, as I've just been made aware of by a business contact, there is a NEWSDR'13 workshop which, among other things, has OsmocomBB and OpenBSC on the list of topics: http://ecewp.ece.wpi.edu/wordpress/sdr-boston/newsdr-13/call-for-papers/ Did anyone ever hear of this workshop? Did the organizers ever make contact with us? I'm a bit surprised that somebody organizes a workshop with "our" projects on the agenda without even sending the CfP to us. Or maybe I just missed it? In case somebody is submitting a paper there: Please make sure to coordinate here in order to avoid different developers/contributors from submitting similar/related topics. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

2 1

TRX CLK-indication and failing sync
by Erich Dachleger 29 Mar '13

29 Mar '13

Hi list, I recently built the testing branch and openbts with respect to the transceiver-app. I built openbts without compilation flags for uhd and resamp(saw on irc that that should'nt be required) and without gnuradio.And I use the example sql openbts.db. I then use rssi-app to find the strongest reference cell and modify openbts.db But when I upload the firmware Lost messages occur after a series of stale burst-messages. openbts outputs a long chain of <0011> trx.c:512 TRX DATA ..... interupted by single <0011> trx.c:190 TRX CLK Indication-messages. And phones of cannot register to openbts-network or even see it when doing manual scan. Can the timing advance parameter and the BSIC parameterbe inserted to the openbts.db to remedy the failure of sync of the osmocom-phone-bts? If not can other measures be taken? regards erich Output from upload of firmware: ---------------- Received DOWNLOAD ACK from phone, your code is running now! Enabled Compal ramloader -> Calypso romloader chainloading mode Received ident ack from phone, sending parameter sequence read_file(../../target/firmware/board/compal_e88/trx.highram.bin): file_size=62964, hdr_len=0, dnload_len=62967 Received parameter ack from phone, starting download Finished, sent 63 blocks in total Received branch ack, your code is running now! battery_compal_e88_init: starting up OSMOCOM TRX (revision osmocon_v0.0.0-1747-geeafd9f-modified) ====================================================================== Device ID code: 0xb4fb Device Version code: 0x0000 ARM ID code: 0xfff3 cDSP ID code: 0x0128 Die ID code: 0dd7253ccb039bd6 ====================================================================== REG_DPLL=0x2413 CNTL_ARM_CLK=0xf0a1 CNTL_CLK=0xff91 CNTL_RST=0xfff3 CNTL_ARM_DIV=0xfff9 ====================================================================== Assert DSP into Reset Releasing DSP from Reset Installing DSP extensions patch Setting some dsp_api.ndb values Setting API NDB parameters Finishing download phase DSP Download Status: 0x0002 DSP API Version: 0x3606 0x0000 LOST 819! BAT-ADC: 558 3 0 0 1023 389 364 227 Charger at 26 mV. Battery at 3814 mV. Charging at 0 mA. Battery capacity is 77%. Battery range is 3199..3999 mV. Battery full at 468 LSB .. full at 585 LSB Charging at 239 LSB (204 mA). BCICTL2=0x3ff battery-info.flags=0x00000000 bat_compal_e88_chg_state=0 L1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=1, flags=0x7) Starting FCCH RecognitionFB0 (1271:1): TOA= 384, Power= -64dBm, Angle=-9235Hz FB1 (1275:2): TOA= 1219, Power= -62dBm, Angle= 2081Hz fn_offset=1273 (fn=1275 + attempt=2 + ntdma = 0) delay=8 (fn_offset=1273 + 11 - fn=1275 - 1 scheduling next FB/SB detection task with delay 8 FB1 (1295:11): TOA=12467, Power= -62dBm, Angle= 389Hz fn_offset=1293 (fn=1295 + attempt=11 + ntdma = 9) delay=8 (fn_offset=1293 + 11 - fn=1295 - 1 scheduling next FB/SB detection task with delay 8 =>FB @ FNR 1293 fn_offset=1293 qbits=4684 Synchronize_TDMA LOST 3660! SB1 (2590:1): TOA= 27, Power= -64dBm, Angle= 431Hz => SB 0x00a6d3f1: BSIC=60 fn=1240157(935/ 9/41) qbits=16 Synchronize_TDMA =>FB @ FNR 2589 fn_offset=1240157 qbits=4924 LOST 1909! BAT-ADC: 558 3 0 0 1023 390 365 230 Charger at 26 mV. Battery at 3814 mV. Charging at 0 mA. Battery capacity is 77%. Battery range is 3199..3999 mV. Battery full at 468 LSB .. full at 585 LSB Charging at 239 LSB (204 mA). BCICTL2=0x3ff battery-info.flags=0x00000000 LOST 1877! bat_compal_e88_chg_state=0 LOST 1873! BTS MODE: 2 850 STALE BURST 2246 STALE BURST 2247 STALE BURST 2248 STALE BURST 2249 STALE BURST 2289 LOST 1884! LOST 1866! BAT-ADC: 554 4 0 0 1023 416 387 226 Charger at 34 mV. Battery at 3787 mV. ----------------- ----------------- Test with another strong reference cell ARFCN 53: ---------- L1CTL_FBSB_REQ (arfcn=53, flags=0x7) Starting FCCH RecognitionLOST 2063! FB0 (1629405:2): TOA= 1776, Power= -87dBm, Angle=-5747Hz FB1 (1629416:9): TOA=10523, Power= -87dBm, Angle= -514Hz fn_offset=1629415 (fn=1629416 + attempt=9 + ntdma = 8) delay=9 (fn_offset=1629415 + 11 - fn=1629416 - 1 scheduling next FB/SB detection task with delay 9 =>FB @ FNR 1629415 fn_offset=1629415 qbits=1908 Synchronize_TDMA key=19 released LOST 2618! SB1 (543187:1): TOA= 30, Power= -88dBm, Angle= -409Hz => SB 0x0160516d: BSIC=27 fn=894398(674/24/11) qbits=28 Synchronize_TDMA =>FB @ FNR 543186 fn_offset=894398 qbits=4936 LOST 1914! L1CTL_NEIGH_PM_REQ new list with 8 entries nb_cmd(0) and rxnb.msg != NULLccch_mode=0 TOA AVG is not 16 qbits, correcting (got 20) TOA AVG is not 16 qbits, correcting (got 15) ...................

3 9

Osmocom web Site Down
by R. Revert 23 Mar '13

23 Mar '13

*Hi * *every one, from the 20th of this mounth the web site as some problems , i will like to help if you guy's if maibe osmocom projects need's servers to host the website or anythink else, than i can help whit somo IT resources..* * * *please let me know.* * * *Thanks #__________________ Atte. **Rafael R.* *Security Information Architect * *CEH, CHFI, **ECSA, LPT, VCP5, CEI, VCI*

2 1

A -very old- Sagem Trace Phone
by DFTC2000 22 Mar '13

22 Mar '13

<http://baseband-devel.722152.n3.nabble.com/file/n4025938/sagem2G.jpg> Hi everyone, I'm looking for informations about this very old trace phone. (Power adaptor spec, band type ...) Thanks a lot for your help (I can take some other pics if you want) BR. Dan, France -- View this message in context: http://baseband-devel.722152.n3.nabble.com/A-very-old-Sagem-Trace-Phone-tp4… Sent from the baseband-devel mailing list archive at Nabble.com.

1 0

Not able to see measurement reports in wireshark
by Mehrin Javed 21 Mar '13

21 Mar '13

Dear all, I have successfully made a call from the master branch of Osmocom-bb . After integrating it to wireshark, I am able to see system information 5 and 6 but I am unable to see the measurement reports and voice traffic. Following is what i am able to see when i execute the mobile application . There are valid measurement reports being generated , but why cant i view them in wireshark.? Looking forwards to your response as soon as possible. [0;m[1;32m<0005> gsm48_mm.c:3911 (ms 1) Received 'RR_DATA_IND' from RR in state MM connection active (sapi 0) [0;m[1;33m<0006> gsm48_cc.c:2161 (ms 1) Received 'MMCC_DATA_IND' in CC state MO_CALL_PROC [0;m[1;33m<0006> gsm48_cc.c:2115 (ms 1) Received 'ALERTING' in CC state MO_CALL_PROC [0;m[1;33m<0006> gsm48_cc.c:717 received ALERTING [0;m[1;33m<0006> gsm48_cc.c:243 new state MO_CALL_PROC -> CALL_DELIVERED [0;m[1;33m<0006> gsm48_cc.c:196 (ms 1 ti 0) Sending 'MNCC_ALERT_IND' to MNCC. [0;m[1;37m<0009> mnccms.c:387 Call is alerting [0;m[1;34m<0001> gsm48_rr.c:662 MON: f=57 lev=-75 snr=62 ber=151 LAI=410 03 e165 ID=9463 TA=0 pwr=10 TS=1 [0;m[1;34m<0001> gsm48_rr.c:2864 MEAS REP: pwr=10 TA=0 meas-invalid=0 rxlev-full=-75 rxlev-sub=-75 rxqual-full=0 rxqual-sub=0 dtx 0 ba 0 no-ncell-n 0 [0;m[1;34m<0001> gsm48_rr.c:4767 Indicated ta 0 (actual ta 0) [0;m[1;34m<0001> gsm48_rr.c:4769 Indicated tx_power 10 [0;m[1;34m<0001> gsm48_rr.c:4767 Indicated ta 0 (actual ta 0) [0;m[1;34m<0001> gsm48_rr.c:4769 Indicated tx_power 10 [0;m[1;34m<0001> gsm48_rr.c:662 MON: f=57 lev=-70 snr=49 ber= 81 LAI=410 03 e165 ID=9463 TA=0 pwr=10 TS=1 [0;m[1;34m<0001> gsm48_rr.c:2864 MEAS REP: pwr=10 TA=0 meas-invalid=0 rxlev-full=-70 rxlev-sub=-70 rxqual-full=0 rxqual-sub=0 dtx 0 ba 0 no-ncell-n 0 [0;m[1;34m<0001> gsm48_rr.c:4767 Indicated ta 0 (actual ta 0) [0;m[1;34m<0001> gsm48_rr.c:4769 Indicated tx_power 14 Thanks and Regards

1 0

Sharp drop in SNR during TCH
by Bhaskar11 20 Mar '13

20 Mar '13

Dear Sylvain, I'm studying traffic data using ccch_scan in burstind branch. In prim_sniff.c I track the SNR levels in l1s_sniff_resp() using code from print_tch.c to read snr values from: dsp_api.db_r->a_serv_demod[D_SNR]; I find that the level changes sharply from ccch mode to tch mode. In ccch mode most of the snr values are 16384. After switching to tch mode they range from 200 to 600 typically! Is this normal? Am I doing something wrong when changing mode? Below is the dump of snr values and freq_err during the run. B. =============== data dump fnx = fn % 26; freq_err = ANGLE_TO_FREQ(dsp_api.db_r->a_serv_demod[D_ANGLE]); snr = dsp_api.db_r->a_serv_demod[D_SNR]; fnx=6, bidx=0, freq_err=-24, snr=16384. SACCH fnx=7, bidx=0, freq_err=-6, snr=16384. SACCH fnx=8, bidx=0, freq_err=9, snr=16384. SACCH fnx=9, bidx=0, freq_err=-15, snr=16384. SACCH fnx=25, bidx=0, freq_err=-26, snr=16384. fnx=0, bidx=0, freq_err=10, snr=16384. fnx=1, bidx=0, freq_err=38, snr=16384. fnx=2, bidx=0, freq_err=-14, snr=*16384*. fnx=24, bidx=0, freq_err=46, snr=*16384*. fnx=25, bidx=0, freq_err=23, snr=*16384*. fnx=0, bidx=0, freq_err=-1, snr=*16384*. afc_correct(error=-1Hz, arfcn=24): delta=0, afc_dac(old=544,new=544) fnx=1, bidx=0, freq_err=22, snr=16384. *(Immediate Assignment starts here)* L1CTL_FBSB_REQ (arfcn=4, flags=0x7) Starting FCCH RecognitionFB0 (1266881:8): TOA= 8784, Power= -61dBm, Angle=10831Hz afc_correct(error=10831Hz, arfcn=4): delta=1283, afc_dac(old=-700,new=583) FB0 (1266892:9): TOA=10032, Power= -61dBm, Angle= -340Hz afc_correct(error=-340Hz, arfcn=4): delta=-40, afc_dac(old=583,new=543) FB1 (1266902:8): TOA= 8755, Power= -61dBm, Angle= 0Hz afc_correct(error=0Hz, arfcn=4): delta=0, afc_dac(old=543,new=543) fn_offset=1266900 (fn=1266902 + attempt=8 + ntdma = 6) delay=8 (fn_offset=1266900 + 11 - fn=1266902 - 1 scheduling next FB/SB detection task with delay 8 =>FB @ FNR 1266900 fn_offset=1266900 qbits=4836 Synchronize_TDMA LOST 3717! SB1 (2533807:1): TOA= 26, Power= -61dBm, Angle= 176Hz => SB 0x00a9dd65: BSIC=25 fn=1266912(955/10/21)=> DSP reports SB in bit that is 1127709799 bits in the future?!? Synchronize_TDMA => DSP reports FB in bit that is 1127709776 bits in the future?!? LOST 1907! afc_correct(error=4Hz, arfcn=4): delta=0, afc_dac(old=543,new=543) L1CTL_DM_EST_REQ (arfcn=12545, chan_nr=0x15, tsc=1) LOST 3047! *(tch mode is now active)* fnx=4, bidx=0, freq_err=-92, snr=*238*. fnx=6, bidx=0, freq_err=-132, snr=*82*. fnx=8, bidx=0, freq_err=103, snr=*145*. fnx=10, bidx=0, freq_err=-234, snr=*316*. fnx=12, bidx=0, freq_err=-89, snr=*292*. SACCH fnx=13, bidx=0, freq_err=46, snr=*270*. fnx=15, bidx=0, freq_err=35, snr=*387*. fnx=17, bidx=0, freq_err=201, snr=*1055*. fnx=19, bidx=0, freq_err=130, snr=549. fnx=21, bidx=0, freq_err=-94, snr=51. fnx=23, bidx=0, freq_err=-52, snr=173. fnx=0, bidx=0, freq_err=157, snr=322. fnx=2, bidx=0, freq_err=107, snr=95. afc_correct(error=12Hz, arfcn=24): delta=1, afc_dac(old=543,new=544) fnx=4, bidx=0, freq_err=86, snr=135. fnx=6, bidx=0, freq_err=-126, snr=207. ====================================

2 2

PROBLEM WHEN INSTALL LIPO-OSMO-DSP
by alishageri 17 Mar '13

17 Mar '13

WHEN I GIT LIPO-OSMO-DSP AND TYPE IN TERMENAL MAKE O HAVE PROBLE THAT SAY MAKE *** NO TARGET SPESIFIC AND NO MAKEFILE FOUND . STOP CAN ANY BODY TELL ME WHAT IS THE WRONG -- View this message in context: http://baseband-devel.722152.n3.nabble.com/PROBLEM-WHEN-INSTALL-LIPO-OSMO-D… Sent from the baseband-devel mailing list archive at Nabble.com.

2 4

Bounce action notification
by mailman＠lists.osmocom.org 17 Mar '13

17 Mar '13

This is a Mailman mailing list bounce action notice: List: baseband-devel Member: alex.id(a)vmail.me Action: Subscription disabled. Reason: Excessive or fatal bounces. The triggering bounce notice is attached below. Questions? Contact the Mailman site administrator at mailman(a)lists.osmocom.org.

1 0

About SysmoBTS/ sysmoBSC
by choukoumoun 14 Mar '13

14 Mar '13

Hello, The SysmoBTS and SysmoBSC is Open Hardware ?

2 1

Re: About SysmoBTS/ sysmoBSC
by choukoumoun 14 Mar '13

14 Mar '13

you're right, sorry Le 14/03/2013 13:43, Andrew Back a écrit : > > > On 14 Mar 2013 12:34, "choukoumoun" <choukoumoun(a)gmail.com > <mailto:choukoumoun@gmail.com>> wrote: > > > > Hello, > > > > The SysmoBTS and SysmoBSC is Open Hardware ? > > Wrong list to ask questions about BTS/BSC, and questions about > commercial products are best directed to the vendor. > > Regards, > > Andrew >

1 0

HNBAP protocol
by choukoumoun 14 Mar '13

14 Mar '13

Hello, Is there a project, project start, see an idea about the protocol HNBAP example mount a HNB-GW in opensource. if it is already past the list forgive me thank you.

1 0

gsmmap work good but ..
by alishageri 13 Mar '13

13 Mar '13

helow every body here i am from saudia arabia and nice to meet you in this forum i have problem when i compile the tool that writen in wiki i dont konw what is the resone but i fllow all the step that in wiki and when i run gsmmap it work good and it scan the all network and do ccch_scan and cell_scan becouse it is compile correctlly but gsmmap dose not have wireshark and vty of bsc that mean it is not work if any body can make gsmma work with wireshark and osmo-bts transcerver of sylan manout or ann body can make osmocom with all tool and app work as iso like gsmmap thank you for your timing -- View this message in context: http://baseband-devel.722152.n3.nabble.com/gsmmap-work-good-but-tp4025917.h… Sent from the baseband-devel mailing list archive at Nabble.com.

1 0

Decoding SDCCH
by Akib Sayyed 12 Mar '13

12 Mar '13

Dear List I am trying to decode SDCCH. but I am not able to do it properly. Here is part of burst_ind app_ccch.c code. if (rv == 0) { uint8_t chan_type, chan_ts, chan_ss; uint8_t gsmtap_chan_type; struct osmo_phsap_prim pp; /* Send to GSMTAP */ rsl_dec_chan_nr(bi->chan_nr, &chan_type, &chan_ss, &chan_ts); gsmtap_chan_type = chantype_rsl2gsmtap( chan_type, bi->flags & BI_FLG_SACCH ? 0x40 : 0x00 ); gsmtap_send(gsmtap_inst, arfcn, chan_ts, gsmtap_chan_type, chan_ss, ntohl(bi->frame_nr), bi->rx_level, bi->snr, l2, sizeof(l2) ); here l2 is 23 byte. I need to remove send it to lapdm to decode it further then will pass it to RR. Please help me in using Lapdm for decoding :) -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

1 0

Documentation for L1Ctl
by Bhaskar11 11 Mar '13

11 Mar '13

Sylvain, Where are the L1ctl.c calls documented? I want to know more about l1ctl_tx_fbsb_req() options and what they mean. But could not find any reference in 3GPP TS docs. Thanks for your help.

2 3

Error: no such instruction: `eor %edx,%ecx,%ecx,ror'
by Arslan Anjum 03 Mar '13

03 Mar '13

Hello All, I can't compile after the last pull. I know that it is an error with toolchain detection but I have tried almost everything. ------------------------------- As you can see the $PATH variable has the address to gnu-arm-elf binary : arslan@arslan-Lenovo-B575:~/osmocom-bb/src$ echo $PATH /home/arslan/arm-elf/bin:/usr/lib/lightdm/lightdm:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games ------------------------------- and when I list the items in that directory I can clearly see that the binary is there : arslan@arslan-Lenovo-B575:~/arm-elf/bin$ ls arm-elf-addr2line arm-elf-cpp arm-elf-ld arm-elf-size arm-elf-ar arm-elf-g++ arm-elf-nm arm-elf-strings arm-elf-as arm-elf-gcc arm-elf-objcopy arm-elf-strip arm-elf-c++ arm-elf-gcc-4.0.4 arm-elf-objdump arm-elf-cc arm-elf-gccbug arm-elf-ranlib arm-elf-c++filt arm-elf-gcov arm-elf-readelf ------------------------------- But I still get the following error: /home/arslan/osmocom-bb/src/target/firmware/include/asm/swab.h: Assembler messages: /home/arslan/osmocom-bb/src/target/firmware/include/asm/swab.h:32: Error: no such instruction: `eor %edx,%ecx,%ecx,ror' make[4]: *** [gsmtap_util.lo] Error 1 make[4]: Leaving directory `/home/arslan/osmocom-bb/src/shared/libosmocore/build-target/src' make[3]: *** [all] Error 2 make[3]: Leaving directory `/home/arslan/osmocom-bb/src/shared/libosmocore/build-target/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/home/arslan/osmocom-bb/src/shared/libosmocore/build-target' make[1]: *** [all] Error 2 make[1]: Leaving directory `/home/arslan/osmocom-bb/src/shared/libosmocore/build-target' make: *** [shared/libosmocore/build-target/src/.libs/libosmocore.a] Error 2 Regards, Arslan Anjum Research Assitant Lahore University of Management Sciences, Pakistan

2 4

Decoding AMR
by Akib Sayyed 02 Mar '13

02 Mar '13

Dear Sylvain While Decoding AMR do need to just decode and pack it into raw amr frames or we need to think about hysterasis and all parts also also there are total 8 codec modes but in band data have details of on 4 codec modes which one to choose out of 8 codec modes from those 8 modes. -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

2 4

Sending DTMF
by dagar 01 Mar '13

01 Mar '13

Hello all does osmocom support dtmf tones and can they be sent during a call if so how? thanks -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Sending-DTMF-tp4025895.html Sent from the baseband-devel mailing list archive at Nabble.com.

2 1

trouble loading trx-firmware
by Erich Dachleger 01 Mar '13

01 Mar '13

Hi list, I am trying, with no success so far ,to chain-load the trx-firmware on my c118 with usb-serial-cable.: ------output----- ./osmocon -p /dev/ttyUSB0 -m c123xor -c ../ ../target/firmware/board/compal_e88/trx.compalram.bin ../ ../target/firmware/board/compal_e88/chainload.highram.bin got 2 bytes from modem, data looks like: 04 81 .. got 5 bytes from modem, data looks like: 1b f6 02 00 41 ....A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD opening file: No such file or directory ------------------------------------ I also tried switching highram-compalram: ./osmocon -p /dev/ttyUSB0 -m c123xor -c ../ ../target/firmware/board/compal_e88/trx.highram.bin ../ ../target/firmware/board/compal_e88/chainload.compalram.bin And also ./osmocon -p /dev/ttyUSB0 -m c123xor -c target/firmware/board/compal_e88/trx.compalram.bin target/firmware/board/compal_e88/chainload.highram.bin but got same errors. I used the script in the wiki for building the toolchain prior to building the code. ---------------------------------- Any ideas what might be wrong? Regards erich

4 4

Paging Attack 29C3
by choukoumoun 27 Feb '13

27 Feb '13

hello aliens of osmoland! I saw Nico Golde conference, he did a great job. but the code has not been shared?

2 1

[PATCH] Support of UCS2 for SMS/USSD
by Pavel Baturko 27 Feb '13

27 Feb '13

Hi list, Attached 3 patches for decoding UCS2 MT-SMS and incoming USSD. Main idea: convert UCS2 text to UTF-8, check if terminal supports UTF-8 and if yes - print, otherwise - print in hex, and notify VTY to check mobile log (since we can't send UTF text to VTY, if someone knows how to do it - please tell me). Waiting for comments. Thanks, Pavel

3 17

[ANNOUNCE] OsmoDevCon 2013-04-04 till 2013-04-07, Berlin
by Harald Welte 26 Feb '13

26 Feb '13

Dear fellow Osmcoom developers, it is my pleasure to finally announce the date + venue of OsmoDevCon 2013: Date: April 04 through April 07, 2013 Place: IN-Berlin, Lehrter Str. 53, Berlin Like last year, this is an event for developers of the various Osmocom proejects. Reservation and confirmation of reservation is required. The event is free of charge. The Room is made available by IN-Berlin e.V., an Internet related non-profit organization. Lunch catering will be sponsored (so far by sysmocom GmbH, but if any other sponsors come up, we are happy to share the cost). So all you have to cover is your own travel + accomodation costs, as well as breakfast and dinner. If you are an active developer and cannot afford travel/accomodation, please let me know and I'll see if we can do something about it. If you would like to attend, please send a message to laforge(a)gnumonks.org applying for registration of the event. The registration deadline is March 5, i.e. one week from now. There is no detailed schedule of talks yet. I will start a separate discussion suggesting / collecting topics in the next couple of days. More information is (and will be made) available at http://openbsc.osmocom.org/trac/wiki/OsmoDevCon2013 Further discussion regarding the event should be directed at the osmocom-event-orga(a)lists.osmocom.org mailing list, to avoid cross-posting over the various project-specific lists. Best regards and happy hacking, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

Osmocom Transceiver (was: Osmovom-BB on Raspberry Pi)
by Dario Lombardo 25 Feb '13

25 Feb '13

Hi, I'm having a try with your software. A small suggestion I can give you is about the chapter "Starting OpenBTS" of your howto: a better way to host the transceiver script is to create a new dir under the openbts root (lets call it TransceiverOSMOCOM) that hosts your script. Then to create a link in the apps dir that point to the new transceiver, to follow the model openbts uses. This allows the user to switch between many hardware pieces using the same openbts installation (if compilation flags apply), avoiding to overwrite your script if openbts compilation instructions are literally followed. Just my 2 cents. Dario. On Sun, Feb 24, 2013 at 3:33 PM, Sylvain Munaut <246tnt(a)gmail.com> wrote: >> PS: Any news on the "emulated BTS" that has been presented at last years chaos communication congress? > > http://bb.osmocom.org/trac/wiki/Software/Transceiver > > Cheers, > > Sylvain >

3 15

trouble while using sony erricson J100i
by Shahzeb - 25 Feb '13

25 Feb '13

hi all i cant understand where i am wrong when i run this command this is the response which i get root@shahzeb-laptop:~/Desktop/toolchain/osmocom-bb/src/host/osmocon# ./osmocon -p /dev/ttyUSB0 -m c140xor -c ../../target/firmware/board/se_j100/layer1.highram.bin got 1 bytes from modem, data looks like: 00 . and then it gets hanged and nothing happens. i have checked the cable aswell it seems like cable is working i have consulted J100i_cable.pdf for the data cable. i would really appreciate your help thanks shahzeb

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

baseband-devel