Hi, Sylvain Munaut
It's china mobile, i can provide more information if you need.
Thanks for pointing out the right way, i'll try to modify codes according to BCCH'.
BTW, i modify TS (line l1s_rx_win_ctrl _ONLY_) from 0 to 2, 4 and 6, the TS2 and TS4 work well, but the TS6 crash very soon because FCCH error,
for example, what's wrong? (high TS -> low TS)?
THIS FIRMWARE WAS COMPILED WITHOUT TX SUPPORT!!!
Assert DSP into Reset
Releasing DSP from Reset
Installing DSP sniff patch
Setting some dsp_api.ndb values
Setting API NDB parameters
DSP Download Status: 0x0001
DSP API Version: 0x0000 0x0000
Finishing download phase
DSP Download Status: 0x0002
DSP API Version: 0x3606 0x0000
LOST 1831!
L1CTL_FBSB_REQ (arfcn=70, flags=0x7)
Starting FCCH RecognitionFB0 (11:6): TOA= 7200, Power= -69dBm, Angle= 3691Hz
FB1 (21:8): TOA= 9651, Power= -69dBm, Angle= 103Hz
fn_offset=20 (fn=21 + attempt=8 + ntdma = 7)
delay=9 (fn_offset=20 + 11 - fn=21 - 1
scheduling next FB/SB detection task with delay 9
=>FB @ FNR 20 fn_offset=20 qbits=3420
Synchronize_TDMA
LOST 3186!
SB1 (46:1): TOA= 29, Power= -69dBm, Angle= 217Hz
=> SB 0x00c12184: BSIC=33 fn=89118(67/16/21) qbits=24
Synchronize_TDMA
=>FB @ FNR 45 fn_offset=89118 qbits=4932
LOST 1912!
TOA AVG is not 16 qbits, correcting (got 20)
L1CTL_DM_EST_REQ (arfcn=4866, chan_nr=0x41, tsc=1)
LOST 2110!
L1CTL_DM_REL_REQL1CTL_FBSB_REQ (arfcn=70, flags=0x7)
Starting FCCH RecognitionLOST 3515!
FB0 (91861:3): TOA= 2544, Power= -67dBm, Angle= 3754Hz
FB1 (91871:8): TOA= 8751, Power= -67dBm, Angle= 40Hz
fn_offset=91869 (fn=91871 + attempt=8 + ntdma = 6)
delay=8 (fn_offset=91869 + 11 - fn=91871 - 1
scheduling next FB/SB detection task with delay 8
=>FB @ FNR 91869 fn_offset=91869 qbits=4820
Synchronize_TDMA
LOST 3711!
SB1 (183745:1): TOA= 29, Power= -67dBm, Angle= 160Hz
=> SB 0x01e12284: BSIC=33 fn=91882(69/24/31) qbits=24
Synchronize_TDMA
=>FB @ FNR 183744 fn_offset=91882 qbits=4932
LOST 1912!
L1CTL_DM_EST_REQ (arfcn=4866, chan_nr=0x69, tsc=1)
LOST 2109!
L1CTL_DM_REL_REQL1CTL_FBSB_REQ (arfcn=70, flags=0x7)
Starting FCCH RecognitionLOST 3516!
FB0 (92514:8): TOA= 8784, Power= -67dBm, Angle= 3696Hz
FB1 (92524:8): TOA= 8755, Power= -67dBm, Angle= 69Hz
fn_offset=92522 (fn=92524 + attempt=8 + ntdma = 6)
delay=8 (fn_offset=92522 + 11 - fn=92524 - 1
scheduling next FB/SB detection task with delay 8
=>FB @ FNR 92522 fn_offset=92522 qbits=4836
Synchronize_TDMA
LOST 3717!
SB1 (185051:1): TOA= 27, Power= -66dBm, Angle= 47Hz
=> SB 0x00852284: BSIC=33 fn=92535(69/ 1/21) qbits=16
Synchronize_TDMA
=>FB @ FNR 185050 fn_offset=92535 qbits=4924
LOST 1909!
TOA AVG is not 16 qbits, correcting (got 19)
L1CTL_DM_EST_REQ (arfcn=4866, chan_nr=0x73, tsc=1)
LOST 2578!
L1CTL_DM_REL_REQL1CTL_FBSB_REQ (arfcn=70, flags=0x7)
Starting FCCH RecognitionLOST 3047!
FB0 (93574:9): TOA=10032, Power= -72dBm, Angle= 3770Hz
FB1 (93585:9): TOA=10003, Power= -72dBm, Angle= -11Hz
fn_offset=93583 (fn=93585 + attempt=9 + ntdma = 7)
delay=8 (fn_offset=93583 + 11 - fn=93585 - 1
scheduling next FB/SB detection task with delay 8
=>FB @ FNR 93583 fn_offset=93583 qbits=4828
Synchronize_TDMA
LOST 3713!
SB1 (187172:1): TOA= 27, Power= -72dBm, Angle= 132Hz
=> SB 0x01582384: BSIC=33 fn=93596(70/22/11) qbits=16
Synchronize_TDMA
=>FB @ FNR 187171 fn_offset=93596 qbits=4924
LOST 1910!
L1CTL_DM_EST_REQ (arfcn=4866, chan_nr=0x43, tsc=1)
LOST 2578!
L1CTL_DM_REL_REQL1CTL_FBSB_REQ (arfcn=70, flags=0x7)
Starting FCCH RecognitionLOST 3047!
FB0 (94186:1): TOA= 48, Power= -68dBm, Angle= 3743Hz
FB1 (94197:9): TOA=10007, Power= -68dBm, Angle= 3738Hz
fn_offset=94195 (fn=94197 + attempt=9 + ntdma = 7)
delay=8 (fn_offset=94195 + 11 - fn=94197 - 1
scheduling next FB/SB detection task with delay 8
FB1 (94217:11): TOA=12507, Power= -68dBm, Angle= 3783Hz
fn_offset=94215 (fn=94217 + attempt=11 + ntdma = 9)
delay=8 (fn_offset=94215 + 11 - fn=94217 - 1
scheduling next FB/SB detection task with delay 8
FB1 (94237:11): TOA=12507, Power= -69dBm, Angle= 3743Hz
fn_offset=94235 (fn=94237 + attempt=11 + ntdma = 9)
delay=8 (fn_offset=94235 + 11 - fn=94237 - 1
scheduling next FB/SB detection task with delay 8
FB1 (94248:2): TOA= 1259, Power= -69dBm, Angle= 3689Hz
fn_offset=94246 (fn=94248 + attempt=2 + ntdma = 0)
delay=8 (fn_offset=94246 + 11 - fn=94248 - 1
scheduling next FB/SB detection task with delay 8
... ...
======= 2011-09-26 14:10:17 =======
>> the bts arround me uses MultiCCCH, it's CCCH_CONF = 110 (6), so it uses TS0, TS2, TS4 and TS6 in a frame for PCH/AGCH.
>
>Mmm ,interesting, I had never seen that option being used before. What
>network is this.
>
>> but the burst_ind only CCCH-CONF 0 & 1 are supported, it can sniff TS0 only, so only catch 1/4 IMM ASS for me.
>> my OWN phone, it's just not in TS0 (i use nokia netmonitor to check it), so i can't catch it at all (phones use IMSI to decide page group).
>
>Well, it's your own phone (or any known target phone), you know the
>IMSI, hence the paging group ...
>
>
>> i think the bottleneck is the DSP, as the DSP task (ALLC_DSP_TASK) can only process one TS of a frame (it's enough for phone),
>> i think maybe backup/restore the DSP task variable patch needed, i'm new to the DSP disassemble and patch, anyone can help? thanks
>
>That's gonna be _very_ hard, the DSP uses _plenty_ of global variables ...
>
>But OTOH, instead of using the normal 'RX task', you can use the sniff
>task to listen to the CCCH. The sniff task will _not_ do the channel
>decoding (i.e. you'll have to call xcch_decode to get the actual 23
>bytes L2 frame), but it can sniff up to 4 bursts in a frame. just look
>at how sdcch sniffing is done, it currently sniff 2 timeslot 0 & 3 (to
>get DL & UL).
>
>This way you won't need any hard DSP patching, just a minor patch on
>the firmware to convert CCCH listening to burst_ind (leave the BCCH
>task as-it is, just mod the CCCH). And then a patch in the host app to
>call xcch_decode appropriately and feed the results 'as if' it cames
>from the phone directly.
>
>Cheers,
>
> Sylvain
= = = = = = = = = = = = = = = = = = = =
Best regards
Steve
Dear all,
the bts arround me uses MultiCCCH, it's CCCH_CONF = 110 (6), so it uses TS0, TS2, TS4 and TS6 in a frame for PCH/AGCH.
but the burst_ind only CCCH-CONF 0 & 1 are supported, it can sniff TS0 only, so only catch 1/4 IMM ASS for me.
my OWN phone, it's just not in TS0 (i use nokia netmonitor to check it), so i can't catch it at all (phones use IMSI to decide page group).
i read the source briefly, and modify prim_rx_nb.c line "l1s_rx_win_ctrl(arfcn, L1_RXWIN_NB, 0);" for TS2, TS4, TS6 temporarily,
but this way i'll need 4 phones to catch ONE station. it's very strange, and not beauty.
i think the bottleneck is the DSP, as the DSP task (ALLC_DSP_TASK) can only process one TS of a frame (it's enough for phone),
i think maybe backup/restore the DSP task variable patch needed, i'm new to the DSP disassemble and patch, anyone can help? thanks
Best Regards
Steve
Please find attached a proposed patch for libosmocore
The modifications are needed if we want to be able to send a gsmtap packet with a type different than GSMTAP_TYPE_UM.
It's a fairly straightforward patch.
Best Regards,
iZsh
Hi All,
Is IPv6 connectivity to bb.osmocom.org down for me or for everybody?
$ host -6 bb.osmocom.orgbb.osmocom.org has address 213.95.46.201
bb.osmocom.org has IPv6 address 2001:780:45:f046::201
$ ping6 2001:780:45:f046::201
PING 2001:780:45:f046::201(2001:780:45:f046::201) 56 data bytes
^C
--- 2001:780:45:f046::201 ping statistics ---
6 packets transmitted, 0 received, 100% packet loss, time 4999ms
$ telnet 2001:780:45:f046::201 80
Trying 2001:780:45:f046::201...
telnet: connect to address 2001:780:45:f046::201: Connection timed out
$ traceroute 2001:780:45:f046::201
traceroute to 2001:780:45:f046::201 (2001:780:45:f046::201), 30 hops
max, 80 byte packets
1 * * *
2 gige-g2-4.core1.fra1.he.net (2001:470:0:69::1) 75.265 ms 75.266
ms 75.552 ms
3 gi0-3-rt1-ffm2.core.noris.net (2001:7f8::3031:0:1) 72.963 ms
72.883 ms 72.891 ms
4 vl604-rt3-nbg3.core.noris.net (2001:780:40:10::1) 75.429 ms
75.448 ms 75.416 ms
5 fa0-0-31-rt6-nbg3.access.noris.net (2001:780:40:23::5) 75.374 ms
75.048 ms 75.128 ms
6 2001:780:0:f::13 (2001:780:0:f::13) 75.030 ms 50.987 ms 50.882 ms
7 * * *
8 * * *
(...)
29 * * *
30 * * *
Regards,
André.
Hi all,
Do you see any interest in the domain of femtocells?
this model, that will be sold in France, claims to be pluggable
(probably via ethernet) into nearly any ISP provided home router
(internet "box").
http://www.pcinpact.com/actu/news/65810-sfr-mobile-adsl-3g-femto.htm
Is it in any way comparable to the nanoBTS and other stuff you're
hacking nowadays ?
Regards
Sebastien
Hi All,
I have done all what I could in setting up the project and running of it as
indicated in the wiki and mailing list.
It has been over two weeks of trial and error of figuring out of what the
problem is that led me to this conclusion
that OsmocomBB project might not be designed optimally for US GSM Bands (GSM
850/ PCS 1900). The system
could not get synchronised to a frequency when FSBS request is carried out.
I read from the mailing-list about the possible modification to be done on
the file rffe_dualband.c for GSM band in US in order to resolve the issue of
synchronisation. I made a changed of DCS 1800 to PCS 1900 and yet the output
remain the same with no difference.
Perhaps, I am still overlooking a possible detail that might make the MS not
synchronising. However the power measure is of average -90dBm which I think
might be too low for required level. If there can be anyone with any clue to
resolve or shed more light on this issue I am kindly requesting for
assistance
I have my configuration and output as followed:
SYSTEM CONFIGURATION:
OS : Ubuntu 10.10 Maverick Meerkat
TI- Calypso: Motorola C155 (US Model)
Cable: PL2303 USB cable
Tool-chain: Self compiled GNUArm tool-chain based on instruction on
http://bb.osmocom.org/trac/wiki/GnuArmToolchain
OsmocomBB Branch: Successful installation of both Master and Sylvain branch
with modification to Makefile to enable transmitting
PROGRAM OUTPUTS:
Running OsmocomBB (Sylvain Branch)
Osmocon Output 1 :
rola@amira:~/test2-osmocom-bb/osmocom-bb/src/host/osmocon$ ./osmocon -p
/dev/ttyUSB0 -m c155
../../target/firmware/board/compal_e99/layer1.compalram.bin
got 1 bytes from modem, data looks like: 00 .
got 6 bytes from modem, data looks like: 1b f6 02 00 41 01 ....A.
got 1 bytes from modem, data looks like: 40 @
Received PROMPT1 from phone, responding with CMD
read_file(../../target/firmware/board/compal_e99/layer1.compalram.bin):
file_size=53804, hdr_len=4, dnload_len=53811
got 1 bytes from modem, data looks like: 1b .
got 1 bytes from modem, data looks like: f6 .
got 1 bytes from modem, data looks like: 02 .
got 1 bytes from modem, data looks like: 00 .
got 1 bytes from modem, data looks like: 41 A
got 1 bytes from modem, data looks like: 02 .
got 1 bytes from modem, data looks like: 43 C
Received PROMPT2 from phone, starting download
handle_write(): 4096 bytes (4096/53811)
handle_write(): 4096 bytes (8192/53811)
handle_write(): 4096 bytes (12288/53811)
handle_write(): 4096 bytes (16384/53811)
handle_write(): 4096 bytes (20480/53811)
handle_write(): 4096 bytes (24576/53811)
handle_write(): 4096 bytes (28672/53811)
handle_write(): 4096 bytes (32768/53811)
handle_write(): 4096 bytes (36864/53811)
handle_write(): 4096 bytes (40960/53811)
handle_write(): 4096 bytes (45056/53811)
handle_write(): 4096 bytes (49152/53811)
handle_write(): 4096 bytes (53248/53811)
handle_write(): 563 bytes (53811/53811)
handle_write(): finished
got 1 bytes from modem, data looks like: 1b .
got 1 bytes from modem, data looks like: f6 .
got 1 bytes from modem, data looks like: 02 .
got 1 bytes from modem, data looks like: 00 .
got 1 bytes from modem, data looks like: 41 A
got 1 bytes from modem, data looks like: 03 .
got 1 bytes from modem, data looks like: 42 B
Received DOWNLOAD ACK from phone, your code is running now!
OSMOCOM Layer 1 (revision osmocon_v0.0.0-1111-ge838620)
======================================================================
Device ID code: 0xb4fb
Device Version code: 0x0000
ARM ID code: 0xfff3
cDSP ID code: 0x0128
Die ID code: 7e570d2eb10393bb
======================================================================
REG_DPLL=0x2413
CNTL_ARM_CLK=0xf0a1
CNTL_CLK=0xff91
CNTL_RST=0xfff3
CNTL_ARM_DIV=0xfff9
======================================================================
Power up simcard:
Assert DSP into Reset
Releasing DSP from Reset
Setting some dsp_api.ndb values
Setting API NDB parameters
DSP Download Status: 0x0001
DSP API Version: 0x0000 0x0000
Finishing download phase
DSP Download Status: 0x0002
DSP API Version: 0x3606 0x0000
LOST 3907!
LOST 3750!
Above output was done with Mobile App not in used.
Running Osmocon with Mobile App.
Mobile App Output 1:
rola@amira:~$ cd test2-osmocom-bb/osmocom-bb/src/host/layer23/src/mobile/
rola@amira:~/test2-osmocom-bb/osmocom-bb/src/host/layer23/src/mobile$
./mobile -i 127.0.0.1
Copyright (C) 2008-2010 ...
Contributions by ...
License GPLv2+: GNU GPL version 2 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
<000f> sim.c:1206 init SIM client
<0006> gsm48_cc.c:63 init Call Control
<0001> gsm48_rr.c:5100 init Radio Ressource process
<0005> gsm48_mm.c:1312 init Mobility Management process
<0005> gsm48_mm.c:1035 Selecting PLMN SEARCH state, because no SIM.
<0002> gsm322.c:5023 init PLMN process
<0003> gsm322.c:5024 init Cell Selection process
***
Warning: Mobile '1' has default IMEI: 000000000000000
This could relate your identitiy to other users with default IMEI.
***
Mobile '1' initialized, please start phone now!
VTY available on port 4247.
<0005> subscriber.c:567 Requesting SIM file 0x2fe2
<000f> sim.c:209 got new job: SIM_JOB_READ_BINARY (handle=00000004)
<000f> sim.c:697 go MF
<000f> sim.c:241 SELECT (file=0x3f00)
<000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4)
******The above output runs with MS still turned off.
Telnet Output:
rola@amira:~$ telnet localhost 4247
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Welcome to the OsmocomBB control interface
OsmocomBB> en
OsmocomBB# sim read 1
OsmocomBB# conf t
OsmocomBB(config)# ms 1
OsmocomBB(ms)#noshutdown
% Unknown command.
OsmocomBB(ms)#
% (MS 1)
% No service.
OsmocomBB(ms)#en
OsmocomBB# sh ms
MS '1' is up, service is unavailable
IMEI: 000000000000000
IMEISV: 0000000000000000
IMEI generation: fixed
automatic network selection state: A4 wait for PLMN to appear
cell selection state: C6 any cell selection
radio ressource layer state: idle
mobility management layer state: MM idle, no cell available
OsmocomBB# sh support
Supported features of MS '1':
Phase 2 mobile station
R-GSM : yes
E-GSM : yes
P-GSM : yes
GSM900 Class : 4
DCS 1800 : yes
DCS Class : 1
GSM 850 : disabled
PCS 1900 : disabled
GSM 480 : no
GSM 450 : no
CECS : no
VGCS : no
VBS : no
SMS : no
SS_IND : yes
PS_CAP : no
CMSP : no
SoLSA : no
LCSVA : no
LOC_SERV : no
A5/1 : yes
A5/2 : yes
A5/3 : no
A5/4 : no
A5/5 : no
A5/6 : no
A5/7 : no
A5/1 : yes
Channels : SDCCH + TCH/F + TCH/H
Full-Rate V1 : yes
Full-Rate V2 : yes
Full-Rate V3 : no
Half-Rate V1 : yes
Half-Rate V3 : no
Min RXLEV : -106
OsmocomBB#
**** Clearly above under supporrt command, PCS 1900 and GSM 850 is disabled.
I have no clue of how turn it on.
Osmocon Output 2:
PM MEAS: ARFCN=120, 35 dBm at baseband, -102 dBm at RF
PM MEAS: ARFCN=121, 41 dBm at baseband, -97 dBm at RF
PM MEAS: ARFCN=122, 40 dBm at baseband, -97 dBm at RF
PM MEAS: ARFCN=123, 41 dBm at baseband, -96 dBm at RF
PM MEAS: ARFCN=124, 41 dBm at baseband, -97 dBm at RF
L1CTL_PM_REQ start=512 end=885
PM MEAS: ARFCN=512, 43 dBm at baseband, -94 dBm at RF
PM MEAS: ARFCN=512, 40 dBm at baseband, -97 dBm at RF
PM MEAS: ARFCN=513, 40 dBm at baseband, -97 dBm at RF
-
-
-
PM MEAS: ARFCN=883, 41 dBm at baseband, -96 dBm at RF
PM MEAS: ARFCN=884, 43 dBm at baseband, -94 dBm at RF
PM MEAS: ARFCN=885, 44 dBm at baseband, -94 dBm at RF
L1CTL_PM_REQ start=955 end=1023
PM MEAS: ARFCN=955, 41 dBm at baseband, -96 dBm at RF
PM MEAS: ARFCN=955, 37 dBm at baseband, -101 dBm at RF
-
-
-
PM MEAS: ARFCN=1021, 43 dBm at baseband, -94 dBm at RF
PM MEAS: ARFCN=1022, 36 dBm at baseband, -101 dBm at RF
PM MEAS: ARFCN=1023, 41 dBm at baseband, -96 dBm at RF
L1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=872, flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=1002,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=1000,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=983,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=979,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=966,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=962,
flags=0x7)
Starting FCCH RecognitionLOST 1885!
LOST 1865!
L1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=958, flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=957,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=879,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=877,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=876,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=874,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=871,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=867,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=849,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=844,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=839,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=837,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=835,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=828,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=827,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=826,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=824,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=820,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=818,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=817,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=811,
flags=0x7)
Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=809,
flags=0x7)
^C
rola@amira:~/test2-osmocom-bb/osmocom-bb/src/host/osmocon$
**** The FBSB yield no result
Mobile App Output2:
<0003> gsm322.c:2900 Found signal (ARFCN 648(DCS) rxlev -94 (16))
<0003> gsm322.c:2900 Found signal (ARFCN 649(DCS) rxlev -96 (14))
<0003> gsm322.c:2900 Found signal (ARFCN 650(DCS) rxlev -94 (16))
<0003> gsm322.c:2900 Found signal (ARFCN 651(DCS) rxlev -94 (16))
<0003> gsm322.c:2900 Found signal (ARFCN 652(DCS) rxlev -93 (17))
<0003> gsm322.c:2900 Found signal (ARFCN 653(DCS) rxlev -94 (16))
<0003> gsm322.c:2900 Found signal (ARFCN 654(DCS) rxlev -94 (16))
<0003> gsm322.c:2900 Found signal (ARFCN 655(DCS) rxlev -94 (16))
<0003> gsm322.c:2900 Found signal (ARFCN 656(DCS) rxlev -94 (16))
-
-
--
-
<0003> gsm322.c:2900 Found signal (ARFCN 876(DCS) rxlev -93 (17))
<0003> gsm322.c:2900 Found signal (ARFCN 877(DCS) rxlev -93 (17))
<0003> gsm322.c:2900 Found signal (ARFCN 878(DCS) rxlev -96 (14))
<0003> gsm322.c:2900 Found signal (ARFCN 879(DCS) rxlev -93 (17))
<0003> gsm322.c:2900 Found signal (ARFCN 880(DCS) rxlev -94 (16))
<0003> gsm322.c:2900 Found signal (ARFCN 881(DCS) rxlev -94 (16))
<0003> gsm322.c:2900 Found signal (ARFCN 882(DCS) rxlev -94 (16))
<0003> gsm322.c:2900 Found signal (ARFCN 883(DCS) rxlev -96 (14))
<0003> gsm322.c:2900 Found signal (ARFCN 884(DCS) rxlev -94 (16))
<0003> gsm322.c:2900 Found signal (ARFCN 885(DCS) rxlev -94 (16))
<0003> gsm322.c:2912 Done with power scanning range.
<0003> gsm322.c:2790 Scanning power for all frequencies.
<0003> gsm322.c:2851 Scanning frequencies. (955..955)
<0003> gsm322.c:2900 Found signal (ARFCN 955 rxlev -96 (14))
<0003> gsm322.c:2888 Getting PM for ARFCN 955 twice. Overwriting the first!
Please fix prim_pm.c
<0003> gsm322.c:2900 Found signal (ARFCN 955 rxlev -101 (9))
<0003> gsm322.c:2900 Found signal (ARFCN 956 rxlev -100 (10))
<0003> gsm322.c:2900 Found signal (ARFCN 957 rxlev -93 (17))
<0003> gsm322.c:2900 Found signal (ARFCN 958 rxlev -93 (17))
<0003> gsm322.c:2900 Found signal (ARFCN 959 rxlev -96 (14))
--
--
--
--
<0003> gsm322.c:2900 Found signal (ARFCN 998 rxlev -96 (14))
<0003> gsm322.c:2900 Found signal (ARFCN 999 rxlev -96 (14))
<0003> gsm322.c:2900 Found signal (ARFCN 1000 rxlev -93 (17))
<0003> gsm322.c:2900 Found signal (ARFCN 1001 rxlev -96 (14))
<0003> gsm322.c:2900 Found signal (ARFCN 1002 rxlev -93 (17))
<0003> gsm322.c:2900 Found signal (ARFCN 1003 rxlev -96 (14))
<0003> gsm322.c:2900 Found signal (ARFCN 1004 rxlev -101 (9))
<0003> gsm322.c:2900 Found signal (ARFCN 1005 rxlev -96 (14))
<0003> gsm322.c:2900 Found signal (ARFCN 1006 rxlev -96 (14))
<0003> gsm322.c:2900 Found signal (ARFCN 1007 rxlev -96 (14))
<0003> gsm322.c:2900 Found signal (ARFCN 1008 rxlev -101 (9))
<0003> gsm322.c:2900 Found signal (ARFCN 1009 rxlev -101 (9))
<0003> gsm322.c:2900 Found signal (ARFCN 1010 rxlev -101 (9))
<0003> gsm322.c:2900 Found signal (ARFCN 1011 rxlev -96 (14))
<0003> gsm322.c:2900 Found signal (ARFCN 1012 rxlev -96 (14))
<0003> gsm322.c:2900 Found signal (ARFCN 1013 rxlev -101 (9))
<0003> gsm322.c:2900 Found signal (ARFCN 1014 rxlev -96 (14))
<0003> gsm322.c:2900 Found signal (ARFCN 1015 rxlev -96 (14))
<0003> gsm322.c:2900 Found signal (ARFCN 1016 rxlev -96 (14))
<0003> gsm322.c:2900 Found signal (ARFCN 1017 rxlev -101 (9))
<0003> gsm322.c:2900 Found signal (ARFCN 1018 rxlev -96 (14))
<0003> gsm322.c:2900 Found signal (ARFCN 1019 rxlev -96 (14))
<0003> gsm322.c:2900 Found signal (ARFCN 1020 rxlev -96 (14))
<0003> gsm322.c:2900 Found signal (ARFCN 1021 rxlev -94 (16))
<0003> gsm322.c:2900 Found signal (ARFCN 1022 rxlev -101 (9))
<0003> gsm322.c:2900 Found signal (ARFCN 1023 rxlev -96 (14))
<0003> gsm322.c:2912 Done with power scanning range.
<0003> gsm322.c:2790 Scanning power for all frequencies.
<0003> gsm322.c:2828 Found 568 frequencies.
<0003> gsm322.c:2248 Scanning frequency 872(DCS) (rxlev -92).
<0003> gsm322.c:469 Sync to ARFCN=872(DCS) rxlev=-92 (No sysinfo yet, ccch
mode NONE)
<0003> gsm322.c:2268 40 frequencies left in band 512..885
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=872(DCS)
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 1002 (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=1002 rxlev=-93 (No sysinfo yet, ccch mode
NONE)
<0003> gsm322.c:2268 30 frequencies left in band 955..124
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=1002
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 1000 (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=1000 rxlev=-93 (No sysinfo yet, ccch mode
NONE)
<0003> gsm322.c:2268 29 frequencies left in band 955..124
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=1000
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 983 (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=983 rxlev=-93 (No sysinfo yet, ccch mode
NONE)
<0003> gsm322.c:2268 28 frequencies left in band 955..124
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=983
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 979 (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=979 rxlev=-93 (No sysinfo yet, ccch mode
NONE)
<0003> gsm322.c:2268 27 frequencies left in band 955..124
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=979
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 966 (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=966 rxlev=-93 (No sysinfo yet, ccch mode
NONE)
<0003> gsm322.c:2268 26 frequencies left in band 955..124
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=966
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 962 (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=962 rxlev=-93 (No sysinfo yet, ccch mode
NONE)
<0003> gsm322.c:2268 25 frequencies left in band 955..124
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=962
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 958 (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=958 rxlev=-93 (No sysinfo yet, ccch mode
NONE)
<0003> gsm322.c:2268 24 frequencies left in band 955..124
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=958
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 957 (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=957 rxlev=-93 (No sysinfo yet, ccch mode
NONE)
<0003> gsm322.c:2268 23 frequencies left in band 955..124
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=957
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 879(DCS) (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=879(DCS) rxlev=-93 (No sysinfo yet, ccch
mode NONE)
<0003> gsm322.c:2268 39 frequencies left in band 512..885
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=879(DCS)
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 877(DCS) (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=877(DCS) rxlev=-93 (No sysinfo yet, ccch
mode NONE)
<0003> gsm322.c:2268 38 frequencies left in band 512..885
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=877(DCS)
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 876(DCS) (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=876(DCS) rxlev=-93 (No sysinfo yet, ccch
mode NONE)
<0003> gsm322.c:2268 37 frequencies left in band 512..885
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=876(DCS)
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 874(DCS) (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=874(DCS) rxlev=-93 (No sysinfo yet, ccch
mode NONE)
<0003> gsm322.c:2268 36 frequencies left in band 512..885
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=874(DCS)
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 871(DCS) (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=871(DCS) rxlev=-93 (No sysinfo yet, ccch
mode NONE)
<0003> gsm322.c:2268 35 frequencies left in band 512..885
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=871(DCS)
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 867(DCS) (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=867(DCS) rxlev=-93 (No sysinfo yet, ccch
mode NONE)
<0003> gsm322.c:2268 34 frequencies left in band 512..885
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=867(DCS)
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 849(DCS) (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=849(DCS) rxlev=-93 (No sysinfo yet, ccch
mode NONE)
<0003> gsm322.c:2268 33 frequencies left in band 512..885
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=849(DCS)
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 844(DCS) (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=844(DCS) rxlev=-93 (No sysinfo yet, ccch
mode NONE)
<0003> gsm322.c:2268 32 frequencies left in band 512..885
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=844(DCS)
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 839(DCS) (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=839(DCS) rxlev=-93 (No sysinfo yet, ccch
mode NONE)
<0003> gsm322.c:2268 31 frequencies left in band 512..885
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=839(DCS)
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 837(DCS) (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=837(DCS) rxlev=-93 (No sysinfo yet, ccch
mode NONE)
<0003> gsm322.c:2268 30 frequencies left in band 512..885
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=837(DCS)
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 835(DCS) (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=835(DCS) rxlev=-93 (No sysinfo yet, ccch
mode NONE)
<0003> gsm322.c:2268 29 frequencies left in band 512..885
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=835(DCS)
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 828(DCS) (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=828(DCS) rxlev=-93 (No sysinfo yet, ccch
mode NONE)
<0003> gsm322.c:2268 28 frequencies left in band 512..885
<0003> gsm322.c:2993 Channel sync error.
--
--
--
<0003> gsm322.c:2268 23 frequencies left in band 512..885
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=818(DCS)
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 817(DCS) (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=817(DCS) rxlev=-93 (No sysinfo yet, ccch
mode NONE)
<0003> gsm322.c:2268 22 frequencies left in band 512..885
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=817(DCS)
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 811(DCS) (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=811(DCS) rxlev=-93 (No sysinfo yet, ccch
mode NONE)
<0003> gsm322.c:2268 21 frequencies left in band 512..885
<0003> gsm322.c:2993 Channel sync error.
<0003> gsm322.c:2998 free sysinfo ARFCN=811(DCS)
<0003> gsm322.c:2734 Cell selection failed, sync timeout.
<0003> gsm322.c:2248 Scanning frequency 809(DCS) (rxlev -93).
<0003> gsm322.c:469 Sync to ARFCN=809(DCS) rxlev=-93 (No sysinfo yet, ccch
mode NONE)
<0003> gsm322.c:2268 20 frequencies left in band 512..885
**** The output displayed cell selection failure. The process repeats itself
continuously
Thanks
Rasak
--
View this message in context: http://baseband-devel.722152.n3.nabble.com/GSM-850-PCS-1900-PLEASE-HELP-NEE…
Sent from the baseband-devel mailing list archive at Nabble.com.
Hello everyone,
I'm new to OscomBB and have few questions about its architecture. I have
ordered the C123 and the serial cable. Note: I have OpenBTS running quite
well and would like now to explore the other end.
I did look at the Software Overview page and have the following questions:
a/ where can I log the raw burst (156 bits)? [ not the IQ samples ] on the
PC? on the ARM7?
b/ on the downllink path, how is the FCH detection process split between
dsp, arm7 and PC? ie from raw burst to FCH detection indication and offset
value.
c/ on the downllink path, how is the SCH decode process split between dsp,
arm7 and PC? ie from raw burst to GSM frame number, BSIC etc..
d/ on the downllink path, how is the BCCH decode process split between dsp,
arm7 and PC? ie from raw burst to System Informations...
d/ on the uplink path, how the RACH encode process (RACH_REQ) is split
between dsp, arm7 and PC?
Thank your for your kind answers.
Rgds
Nghia
Hi,
I've just pused in libosmocore a branch sylvain/crc with a proposal
for some generic CRC function.
The goal here is to provide a base implementation so that channel
coding/decoding of the various other projects can use this as a base
rather than reimplement their own for each poly. The API is targeted
towards that use (using array of ubit_t rather than a buffer of packed
bits).
The code is generated from a template and expanded into a 8 / 16 / 32
/ 64 bits version by the Makefile (each capable of supporting any crc
length inferior or equal to that. So a CRC12 would use the 16bits
state function).
Appropriate doxygen doc is included.
If nobody has objection / comments / ... I'll go ahead and merge it.
Cheers,
Sylvain
Hi,
sorry if I shouldn`t write correclly, i'm not that good in english.
i have a Motorola c118 and now aFTDI cable.
my problem:
compiling was successfully.
than i run osmocon:
./osmocon -p /dev/ttyUSB0 -m c123xor
/home/test/install/osmocom-bb/src/target/firmware/board/compal_e88/layer1.ramload.bin
i pressed power button and get this output:
got 2 bytes from modem, data looks like: 04 81 ..
got 5 bytes from modem, data looks like: 1b f6 02 00 41 ....A
got 1 bytes from modem, data looks like: 01 .
got 1 bytes from modem, data looks like: 40 @
Received PROMPT1 from phone, responding with CMD
read_file(../../target/firmware/board/compal_e88/loader.compalram.bin):
file_size=17184, hdr_len=4, dnload_len=17191
got 1 bytes from modem, data looks like: 1b .
got 1 bytes from modem, data looks like: f6 .
got 1 bytes from modem, data looks like: 02 .
got 1 bytes from modem, data looks like: 00 .
got 1 bytes from modem, data looks like: 41 A
got 1 bytes from modem, data looks like: 02 .
got 1 bytes from modem, data looks like: 43 C
Received PROMPT2 from phone, starting download
handle_write(): 4096 bytes (4096/17191)
handle_write(): 4096 bytes (8192/17191)
handle_write(): 4096 bytes (12288/17191)
handle_write(): 4096 bytes (16384/17191)
handle_write(): 807 bytes (17191/17191)
handle_write(): finished
got 1 bytes from modem, data looks like: 1b .
got 1 bytes from modem, data looks like: f6 .
got 1 bytes from modem, data looks like: 02 .
got 1 bytes from modem, data looks like: 00 .
got 1 bytes from modem, data looks like: 41 A
got 1 bytes from modem, data looks like: 03 .
got 1 bytes from modem, data looks like: 42 B
Received DOWNLOAD ACK from phone, your code is running now!
Received DOWNLOAD ACK from phone, your code is running now!
OSMOCOM Loader (revision osmocon_v0.0.0-1108-g7bbd2ac)
======================================================================
Running on compal_e88 in environment compalram
Failed to initialize flash!
_____________________
Why initializing flash failed?
what is my fault? can you help me?
thanks a lot,
tobsen
