- baseband-devel - lists.osmocom.org

Re: baseband-devel Digest, Vol 21, Issue 4
by Akib Sayyed 06 Oct '11

06 Oct '11

only DSP patch is released which allow you to sniff one time slot out of 7. rest code is not published and i guess will never be published On Thu, Oct 6, 2011 at 3:30 PM, <baseband-devel-request(a)lists.osmocom.org>wrote: > Send baseband-devel mailing list submissions to > baseband-devel(a)lists.osmocom.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.osmocom.org/mailman/listinfo/baseband-devel > or, via email, send a message with subject or body 'help' to > baseband-devel-request(a)lists.osmocom.org > > You can reach the person managing the list at > baseband-devel-owner(a)lists.osmocom.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of baseband-devel digest..." > > Today's Topics: > > 1. Sniff code.. as shown in c27 video (Marten Christophe) > > > ---------- Forwarded message ---------- > From: Marten Christophe <technosabby(a)gmail.com> > To: Sylvain Munaut <246tnt(a)gmail.com> > Date: Thu, 6 Oct 2011 01:26:59 +0000 > Subject: Sniff code.. as shown in c27 video > > Hello Sylvain, > > If sniff code has been released as shown in the chao Video conference c27 > .. if any sniff code have been merged to any of Osmocom branch, lately i > have lost the track of mails and git for quit a some time. > > Kind Regards, > > _______________________________________________ > baseband-devel mailing list > baseband-devel(a)lists.osmocom.org > https://lists.osmocom.org/mailman/listinfo/baseband-devel > > -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

1 0

Sniff code.. as shown in c27 video
by Marten Christophe 06 Oct '11

06 Oct '11

Hello Sylvain, If sniff code has been released as shown in the chao Video conference c27 .. if any sniff code have been merged to any of Osmocom branch, lately i have lost the track of mails and git for quit a some time. Kind Regards,

1 0

libosmocore patch to support custom baud rates on OS X
by Richard James 02 Oct '11

02 Oct '11

This patch should allow custom baud-rate setting to work on OS X; tested on Mac OS X 10.7 with a FT232BL-based adapter. diff --git a/src/shared/libosmocore/src/serial.c b/src/shared/libosmocore/src/serial.c index 26cf59d..d702153 100644 --- a/src/shared/libosmocore/src/serial.c +++ b/src/shared/libosmocore/src/serial.c @@ -38,8 +38,9 @@ #include <sys/ioctl.h> #include <sys/types.h> #include <sys/stat.h> +#ifdef __linux__ #include <linux/serial.h> - +#endif #include <osmocom/core/serial.h> @@ -155,6 +156,7 @@ osmo_serial_set_baudrate(int fd, speed_t baudrate) int osmo_serial_set_custom_baudrate(int fd, int baudrate) { +#ifdef __linux__ int rc; struct serial_struct ser_info; @@ -174,6 +176,23 @@ osmo_serial_set_custom_baudrate(int fd, int baudrate) } return _osmo_serial_set_baudrate(fd, B38400); /* 38400 is a kind of magic ... */ +#elsif defined(__APPLE__) +#ifndef IOSSIOSPEED +#define IOSSIOSPEED _IOW('T', 2, speed_t) +#endif + int rc; + + unsigned int speed = baudrate; + rc = ioctl(fd, IOSSIOSPEED, &speed); + if (rc < 0) { + dbg.perror("ioctl(IOSSIOSPEED)"); + return -errno; + } + return 0; +#else +#warning osmo_serial_set_custom_baudrate: unsupported platform + return 0; +#endif } /*! \brief Clear any custom baudrate @@ -186,6 +205,7 @@ int osmo_serial_clear_custom_baudrate(int fd) { int rc; +#ifdef __linux__ struct serial_struct ser_info; rc = ioctl(fd, TIOCGSERIAL, &ser_info); @@ -202,7 +222,7 @@ osmo_serial_clear_custom_baudrate(int fd) dbg_perror("ioctl(TIOCSSERIAL)"); return -errno; } - +#endif return 0; }

3 4

Ciphermode
by Ronny Moser 02 Oct '11

02 Oct '11

Hi guys.. I have a question about cipher mode. I saw, that currently a5/1 and a5/2 is implemented. Now, I want to force the phone to use no encryption (A5/0). Is it enough to disable both of these algos? Because when I tried that, I was not longer able to sign in.. Are there any patches that are necessary, or may it be, that the network is not willing to provide a non-encrypted connection? Usually, the phone is using A5/1 and with that algo, everything is working fine.. Thanks for your help. Ronny

2 3

R: Re: R: Layer23 missing
by Luca Bongiorni 30 Sep '11

30 Sep '11

Hi Bogdan, > I've used all types of phones and different networks - same result. If I capture the uplink then every time after a > few seconds I get "segmentation fault". My guess is that in a controlled environment it's going to work, but with a live one, where you have a > lot of arfcn (on a quick scan I get about 50 on my location) it's unlikely to work. well, the success could depends from many things: - wich cable are you using: FTDI or CP2102; - which phone you have tried: sometimes the jack on C1xx could be not so clean or used and it could create problems of communication at high baudrates. - the environment that you are using: public network, as i saw from my tests, is quite horrible to make tests (eg. arfcn hopping). Using a DP-L10 and modifying the AFC value, seems to work well on public netwroks, even if, sometimes it get stuck: problem related with channel hopping/sync IIRC. I used a Blackberry Test Field to disable EDGE and identify which ARFCN that doesn't hop on GPRS: ( eg. this one is hopping, others may not [1] ) Obviously a private and controlled environment could give you the full percentage of success. Regards, Luca [1] http://tinyurl.com/gprs-hopping

3 5

Re: baseband-devel Digest, Vol 20, Issue 26
by Bogdan Alecu 30 Sep '11

30 Sep '11

Hi Luca, I've noticed the change and manual patched everything, but for me seems that it's not going to work. If I capture the downlink, sometimes it capture some bursts, other times not, but even so there is nothing to decode - the arfcn is correct. I've used all types of phones and different networks - same result. If I capture the uplink then every time after a few seconds I get "segmentation fault". My guess is that in a controlled environment it's going to work, but with a live one, where you have a lot of arfcn (on a quick scan I get about 50 on my location) it's unlikely to work. Bogdan ________________________________ From: "baseband-devel-request(a)lists.osmocom.org" <baseband-devel-request(a)lists.osmocom.org> To: baseband-devel(a)lists.osmocom.org Sent: Friday, September 30, 2011 1:00 PM Subject: baseband-devel Digest, Vol 20, Issue 26 ----- Forwarded Message ----- Send baseband-devel mailing list submissions to baseband-devel(a)lists.osmocom.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.osmocom.org/mailman/listinfo/baseband-devel or, via email, send a message with subject or body 'help' to baseband-devel-request(a)lists.osmocom.org You can reach the person managing the list at baseband-devel-owner(a)lists.osmocom.org When replying, please edit your Subject line so it is more specific than "Re: Contents of baseband-devel digest..." Today's Topics: 1. Layer23 missing (Bogdan Alecu) Hello, I'm trying to use the gprsdecode but when I try to patch it there is no layer3.c and also it can't find " d1cb8ea9b784c7acbafbb2fdcedbdf4655c2f6f5" in the tree. Can someone explain a little bit the new steps? Regards, Bogdan _______________________________________________ baseband-devel mailing list baseband-devel(a)lists.osmocom.org https://lists.osmocom.org/mailman/listinfo/baseband-devel

1 0

Layer23 missing
by Bogdan Alecu 30 Sep '11

30 Sep '11

Hello, I'm trying to use the gprsdecode but when I try to patch it there is no layer3.c and also it can't find " d1cb8ea9b784c7acbafbb2fdcedbdf4655c2f6f5" in the tree. Can someone explain a little bit the new steps? Regards, Bogdan

2 1

About sniff multi bursts in a frame, CCCH_CONF
by Aegean Chou 28 Sep '11

28 Sep '11

Hi, Sylvain Munaut Another method, same error, and i tried any _ONE_ ts, it's no problem. static const struct mframe_sched_item mf_ccch[] = { { .sched_set = SNIFF_CCCH0, .modulo = 51, .frame_nr = 6 }, { .sched_set = SNIFF_CCCH2, .modulo = 51, .frame_nr = 6 }, { .sched_set = SNIFF_CCCH4, .modulo = 51, .frame_nr = 6 }, { .sched_set = SNIFF_CCCH6, .modulo = 51, .frame_nr = 6 }, { .sched_set = SNIFF_CCCH0, .modulo = 51, .frame_nr = 12 }, { .sched_set = SNIFF_CCCH2, .modulo = 51, .frame_nr = 12 }, { .sched_set = SNIFF_CCCH4, .modulo = 51, .frame_nr = 12 }, { .sched_set = SNIFF_CCCH6, .modulo = 51, .frame_nr = 12 }, { .sched_set = SNIFF_CCCH0, .modulo = 51, .frame_nr = 16 }, { .sched_set = SNIFF_CCCH2, .modulo = 51, .frame_nr = 16 }, { .sched_set = SNIFF_CCCH4, .modulo = 51, .frame_nr = 16 }, { .sched_set = SNIFF_CCCH6, .modulo = 51, .frame_nr = 16 }, { .sched_set = SNIFF_CCCH0, .modulo = 51, .frame_nr = 22 }, { .sched_set = SNIFF_CCCH2, .modulo = 51, .frame_nr = 22 }, { .sched_set = SNIFF_CCCH4, .modulo = 51, .frame_nr = 22 }, { .sched_set = SNIFF_CCCH6, .modulo = 51, .frame_nr = 22 }, { .sched_set = SNIFF_CCCH0, .modulo = 51, .frame_nr = 26 }, { .sched_set = SNIFF_CCCH2, .modulo = 51, .frame_nr = 26 }, { .sched_set = SNIFF_CCCH4, .modulo = 51, .frame_nr = 26 }, { .sched_set = SNIFF_CCCH6, .modulo = 51, .frame_nr = 26 }, { .sched_set = SNIFF_CCCH0, .modulo = 51, .frame_nr = 32 }, { .sched_set = SNIFF_CCCH2, .modulo = 51, .frame_nr = 32 }, { .sched_set = SNIFF_CCCH4, .modulo = 51, .frame_nr = 32 }, { .sched_set = SNIFF_CCCH6, .modulo = 51, .frame_nr = 32 }, { .sched_set = SNIFF_CCCH0, .modulo = 51, .frame_nr = 36 }, { .sched_set = SNIFF_CCCH2, .modulo = 51, .frame_nr = 36 }, { .sched_set = SNIFF_CCCH4, .modulo = 51, .frame_nr = 36 }, { .sched_set = SNIFF_CCCH6, .modulo = 51, .frame_nr = 36 }, { .sched_set = SNIFF_CCCH0, .modulo = 51, .frame_nr = 42 }, { .sched_set = SNIFF_CCCH2, .modulo = 51, .frame_nr = 42 }, { .sched_set = SNIFF_CCCH4, .modulo = 51, .frame_nr = 42 }, { .sched_set = SNIFF_CCCH6, .modulo = 51, .frame_nr = 42 }, { .sched_set = SNIFF_CCCH0, .modulo = 51, .frame_nr = 46 }, { .sched_set = SNIFF_CCCH2, .modulo = 51, .frame_nr = 46 }, { .sched_set = SNIFF_CCCH4, .modulo = 51, .frame_nr = 46 }, { .sched_set = SNIFF_CCCH6, .modulo = 51, .frame_nr = 46 }, { .sched_set = NULL } }; const struct tdma_sched_item sniff_ccch0_sched_set[] = { SCHED_ITEM_DT(l1s_sniff_cmd, 0, 0, 0), SCHED_END_FRAME(), SCHED_ITEM_DT(l1s_sniff_cmd, 0, 0, 1), SCHED_END_FRAME(), SCHED_ITEM(l1s_sniff_resp, -5, 0, 0), SCHED_ITEM_DT(l1s_sniff_cmd, 0, 0, 2), SCHED_END_FRAME(), SCHED_ITEM(l1s_sniff_resp, -5, 0, 1), SCHED_ITEM_DT(l1s_sniff_cmd, 0, 0, 3), SCHED_END_FRAME(), SCHED_ITEM(l1s_sniff_resp, -5, 0, 2), SCHED_END_FRAME(), SCHED_ITEM(l1s_sniff_resp, -5, 0, 3), SCHED_END_FRAME(), SCHED_END_SET() }; const struct tdma_sched_item sniff_ccch2_sched_set[] = { SCHED_ITEM_DT(l1s_sniff_cmd, 0, 4, 0), SCHED_END_FRAME(), SCHED_ITEM_DT(l1s_sniff_cmd, 0, 4, 1), SCHED_END_FRAME(), SCHED_ITEM(l1s_sniff_resp, -5, 4, 0), SCHED_ITEM_DT(l1s_sniff_cmd, 0, 4, 2), SCHED_END_FRAME(), SCHED_ITEM(l1s_sniff_resp, -5, 4, 1), SCHED_ITEM_DT(l1s_sniff_cmd, 0, 4, 3), SCHED_END_FRAME(), SCHED_ITEM(l1s_sniff_resp, -5, 4, 2), SCHED_END_FRAME(), SCHED_ITEM(l1s_sniff_resp, -5, 4, 3), SCHED_END_FRAME(), SCHED_END_SET() }; const struct tdma_sched_item sniff_ccch4_sched_set[] = { SCHED_ITEM_DT(l1s_sniff_cmd, 0, 8, 0), SCHED_END_FRAME(), SCHED_ITEM_DT(l1s_sniff_cmd, 0, 8, 1), SCHED_END_FRAME(), SCHED_ITEM(l1s_sniff_resp, -5, 8, 0), SCHED_ITEM_DT(l1s_sniff_cmd, 0, 8, 2), SCHED_END_FRAME(), SCHED_ITEM(l1s_sniff_resp, -5, 8, 1), SCHED_ITEM_DT(l1s_sniff_cmd, 0, 8, 3), SCHED_END_FRAME(), SCHED_ITEM(l1s_sniff_resp, -5, 8, 2), SCHED_END_FRAME(), SCHED_ITEM(l1s_sniff_resp, -5, 8, 3), SCHED_END_FRAME(), SCHED_END_SET() }; const struct tdma_sched_item sniff_ccch6_sched_set[] = { SCHED_ITEM_DT(l1s_sniff_cmd, 0, 12, 0), SCHED_END_FRAME(), SCHED_ITEM_DT(l1s_sniff_cmd, 0, 12, 1), SCHED_END_FRAME(), SCHED_ITEM(l1s_sniff_resp, -5, 12, 0), SCHED_ITEM_DT(l1s_sniff_cmd, 0, 12, 2), SCHED_END_FRAME(), SCHED_ITEM(l1s_sniff_resp, -5, 12, 1), SCHED_ITEM_DT(l1s_sniff_cmd, 0, 12, 3), SCHED_END_FRAME(), SCHED_ITEM(l1s_sniff_resp, -5, 12, 2), SCHED_END_FRAME(), SCHED_ITEM(l1s_sniff_resp, -5, 12, 3), SCHED_END_FRAME(), SCHED_END_SET() }; ======= 2011-09-26 14:10:17 ======= >> the bts arround me uses MultiCCCH, it's CCCH_CONF = 110 (6), so it uses TS0, TS2, TS4 and TS6 in a frame for PCH/AGCH. > >Mmm ,interesting, I had never seen that option being used before. What >network is this. > >> but the burst_ind only CCCH-CONF 0 & 1 are supported, it can sniff TS0 only, so only catch 1/4 IMM ASS for me. >> my OWN phone, it's just not in TS0 (i use nokia netmonitor to check it), so i can't catch it at all (phones use IMSI to decide page group). > >Well, it's your own phone (or any known target phone), you know the >IMSI, hence the paging group ... > > >> i think the bottleneck is the DSP, as the DSP task (ALLC_DSP_TASK) can only process one TS of a frame (it's enough for phone), >> i think maybe backup/restore the DSP task variable patch needed, i'm new to the DSP disassemble and patch, anyone can help? thanks > >That's gonna be _very_ hard, the DSP uses _plenty_ of global variables ... > >But OTOH, instead of using the normal 'RX task', you can use the sniff >task to listen to the CCCH. The sniff task will _not_ do the channel >decoding (i.e. you'll have to call xcch_decode to get the actual 23 >bytes L2 frame), but it can sniff up to 4 bursts in a frame. just look >at how sdcch sniffing is done, it currently sniff 2 timeslot 0 & 3 (to >get DL & UL). > >This way you won't need any hard DSP patching, just a minor patch on >the firmware to convert CCCH listening to burst_ind (leave the BCCH >task as-it is, just mod the CCCH). And then a patch in the host app to >call xcch_decode appropriately and feed the results 'as if' it cames >from the phone directly. > >Cheers, > > Sylvain = = = = = = = = = = = = = = = = = = = = Best regards 　　　　　　　　Aegean Chou 　　　　　　　　aegean2000(a)21cn.com 　　　　　　　　　　2011-09-28

2 1

Re: where is the gprs part source in the osmocom source tree?&In-Reply
by or_ora＠ovi.com 26 Sep '11

26 Sep '11

2 1

Re: Re: About sniff multi bursts in a frame, CCCH_CONF
by Aegean Chou 26 Sep '11

26 Sep '11

Hi, Sylvain Munaut It's china mobile, i can provide more information if you need. Thanks for pointing out the right way, i'll try to modify codes according to BCCH'. BTW, i modify TS (line l1s_rx_win_ctrl _ONLY_) from 0 to 2, 4 and 6, the TS2 and TS4 work well, but the TS6 crash very soon because FCCH error, for example, what's wrong? (high TS -> low TS)? THIS FIRMWARE WAS COMPILED WITHOUT TX SUPPORT!!! Assert DSP into Reset Releasing DSP from Reset Installing DSP sniff patch Setting some dsp_api.ndb values Setting API NDB parameters DSP Download Status: 0x0001 DSP API Version: 0x0000 0x0000 Finishing download phase DSP Download Status: 0x0002 DSP API Version: 0x3606 0x0000 LOST 1831! L1CTL_FBSB_REQ (arfcn=70, flags=0x7) Starting FCCH RecognitionFB0 (11:6): TOA= 7200, Power= -69dBm, Angle= 3691Hz FB1 (21:8): TOA= 9651, Power= -69dBm, Angle= 103Hz fn_offset=20 (fn=21 + attempt=8 + ntdma = 7) delay=9 (fn_offset=20 + 11 - fn=21 - 1 scheduling next FB/SB detection task with delay 9 =>FB @ FNR 20 fn_offset=20 qbits=3420 Synchronize_TDMA LOST 3186! SB1 (46:1): TOA= 29, Power= -69dBm, Angle= 217Hz => SB 0x00c12184: BSIC=33 fn=89118(67/16/21) qbits=24 Synchronize_TDMA =>FB @ FNR 45 fn_offset=89118 qbits=4932 LOST 1912! TOA AVG is not 16 qbits, correcting (got 20) L1CTL_DM_EST_REQ (arfcn=4866, chan_nr=0x41, tsc=1) LOST 2110! L1CTL_DM_REL_REQL1CTL_FBSB_REQ (arfcn=70, flags=0x7) Starting FCCH RecognitionLOST 3515! FB0 (91861:3): TOA= 2544, Power= -67dBm, Angle= 3754Hz FB1 (91871:8): TOA= 8751, Power= -67dBm, Angle= 40Hz fn_offset=91869 (fn=91871 + attempt=8 + ntdma = 6) delay=8 (fn_offset=91869 + 11 - fn=91871 - 1 scheduling next FB/SB detection task with delay 8 =>FB @ FNR 91869 fn_offset=91869 qbits=4820 Synchronize_TDMA LOST 3711! SB1 (183745:1): TOA= 29, Power= -67dBm, Angle= 160Hz => SB 0x01e12284: BSIC=33 fn=91882(69/24/31) qbits=24 Synchronize_TDMA =>FB @ FNR 183744 fn_offset=91882 qbits=4932 LOST 1912! L1CTL_DM_EST_REQ (arfcn=4866, chan_nr=0x69, tsc=1) LOST 2109! L1CTL_DM_REL_REQL1CTL_FBSB_REQ (arfcn=70, flags=0x7) Starting FCCH RecognitionLOST 3516! FB0 (92514:8): TOA= 8784, Power= -67dBm, Angle= 3696Hz FB1 (92524:8): TOA= 8755, Power= -67dBm, Angle= 69Hz fn_offset=92522 (fn=92524 + attempt=8 + ntdma = 6) delay=8 (fn_offset=92522 + 11 - fn=92524 - 1 scheduling next FB/SB detection task with delay 8 =>FB @ FNR 92522 fn_offset=92522 qbits=4836 Synchronize_TDMA LOST 3717! SB1 (185051:1): TOA= 27, Power= -66dBm, Angle= 47Hz => SB 0x00852284: BSIC=33 fn=92535(69/ 1/21) qbits=16 Synchronize_TDMA =>FB @ FNR 185050 fn_offset=92535 qbits=4924 LOST 1909! TOA AVG is not 16 qbits, correcting (got 19) L1CTL_DM_EST_REQ (arfcn=4866, chan_nr=0x73, tsc=1) LOST 2578! L1CTL_DM_REL_REQL1CTL_FBSB_REQ (arfcn=70, flags=0x7) Starting FCCH RecognitionLOST 3047! FB0 (93574:9): TOA=10032, Power= -72dBm, Angle= 3770Hz FB1 (93585:9): TOA=10003, Power= -72dBm, Angle= -11Hz fn_offset=93583 (fn=93585 + attempt=9 + ntdma = 7) delay=8 (fn_offset=93583 + 11 - fn=93585 - 1 scheduling next FB/SB detection task with delay 8 =>FB @ FNR 93583 fn_offset=93583 qbits=4828 Synchronize_TDMA LOST 3713! SB1 (187172:1): TOA= 27, Power= -72dBm, Angle= 132Hz => SB 0x01582384: BSIC=33 fn=93596(70/22/11) qbits=16 Synchronize_TDMA =>FB @ FNR 187171 fn_offset=93596 qbits=4924 LOST 1910! L1CTL_DM_EST_REQ (arfcn=4866, chan_nr=0x43, tsc=1) LOST 2578! L1CTL_DM_REL_REQL1CTL_FBSB_REQ (arfcn=70, flags=0x7) Starting FCCH RecognitionLOST 3047! FB0 (94186:1): TOA= 48, Power= -68dBm, Angle= 3743Hz FB1 (94197:9): TOA=10007, Power= -68dBm, Angle= 3738Hz fn_offset=94195 (fn=94197 + attempt=9 + ntdma = 7) delay=8 (fn_offset=94195 + 11 - fn=94197 - 1 scheduling next FB/SB detection task with delay 8 FB1 (94217:11): TOA=12507, Power= -68dBm, Angle= 3783Hz fn_offset=94215 (fn=94217 + attempt=11 + ntdma = 9) delay=8 (fn_offset=94215 + 11 - fn=94217 - 1 scheduling next FB/SB detection task with delay 8 FB1 (94237:11): TOA=12507, Power= -69dBm, Angle= 3743Hz fn_offset=94235 (fn=94237 + attempt=11 + ntdma = 9) delay=8 (fn_offset=94235 + 11 - fn=94237 - 1 scheduling next FB/SB detection task with delay 8 FB1 (94248:2): TOA= 1259, Power= -69dBm, Angle= 3689Hz fn_offset=94246 (fn=94248 + attempt=2 + ntdma = 0) delay=8 (fn_offset=94246 + 11 - fn=94248 - 1 scheduling next FB/SB detection task with delay 8 ... ... ======= 2011-09-26 14:10:17 ======= >> the bts arround me uses MultiCCCH, it's CCCH_CONF = 110 (6), so it uses TS0, TS2, TS4 and TS6 in a frame for PCH/AGCH. > >Mmm ,interesting, I had never seen that option being used before. What >network is this. > >> but the burst_ind only CCCH-CONF 0 & 1 are supported, it can sniff TS0 only, so only catch 1/4 IMM ASS for me. >> my OWN phone, it's just not in TS0 (i use nokia netmonitor to check it), so i can't catch it at all (phones use IMSI to decide page group). > >Well, it's your own phone (or any known target phone), you know the >IMSI, hence the paging group ... > > >> i think the bottleneck is the DSP, as the DSP task (ALLC_DSP_TASK) can only process one TS of a frame (it's enough for phone), >> i think maybe backup/restore the DSP task variable patch needed, i'm new to the DSP disassemble and patch, anyone can help? thanks > >That's gonna be _very_ hard, the DSP uses _plenty_ of global variables ... > >But OTOH, instead of using the normal 'RX task', you can use the sniff >task to listen to the CCCH. The sniff task will _not_ do the channel >decoding (i.e. you'll have to call xcch_decode to get the actual 23 >bytes L2 frame), but it can sniff up to 4 bursts in a frame. just look >at how sdcch sniffing is done, it currently sniff 2 timeslot 0 & 3 (to >get DL & UL). > >This way you won't need any hard DSP patching, just a minor patch on >the firmware to convert CCCH listening to burst_ind (leave the BCCH >task as-it is, just mod the CCCH). And then a patch in the host app to >call xcch_decode appropriately and feed the results 'as if' it cames >from the phone directly. > >Cheers, > > Sylvain = = = = = = = = = = = = = = = = = = = = Best regards Steve

2 1