- baseband-devel - lists.osmocom.org

About sniff multi bursts in a frame, CCCH_CONF
by Aegean Chou 26 Sep '11

26 Sep '11

Dear all, the bts arround me uses MultiCCCH, it's CCCH_CONF = 110 (6), so it uses TS0, TS2, TS4 and TS6 in a frame for PCH/AGCH. but the burst_ind only CCCH-CONF 0 & 1 are supported, it can sniff TS0 only, so only catch 1/4 IMM ASS for me. my OWN phone, it's just not in TS0 (i use nokia netmonitor to check it), so i can't catch it at all (phones use IMSI to decide page group). i read the source briefly, and modify prim_rx_nb.c line "l1s_rx_win_ctrl(arfcn, L1_RXWIN_NB, 0);" for TS2, TS4, TS6 temporarily, but this way i'll need 4 phones to catch ONE station. it's very strange, and not beauty. i think the bottleneck is the DSP, as the DSP task (ALLC_DSP_TASK) can only process one TS of a frame (it's enough for phone), i think maybe backup/restore the DSP task variable patch needed, i'm new to the DSP disassemble and patch, anyone can help? thanks Best Regards Steve

2 1

Proposed patch for libosmocore/gsmtap
by iZsh 23 Sep '11

23 Sep '11

Please find attached a proposed patch for libosmocore The modifications are needed if we want to be able to send a gsmtap packet with a type different than GSMTAP_TYPE_UM. It's a fairly straightforward patch. Best Regards, iZsh

1 0

IPv6 connectivity to bb.osmocom.org
by AndrXX 23 Sep '11

23 Sep '11

Hi All, Is IPv6 connectivity to bb.osmocom.org down for me or for everybody? $ host -6 bb.osmocom.org bb.osmocom.org has address 213.95.46.201 bb.osmocom.org has IPv6 address 2001:780:45:f046::201 $ ping6 2001:780:45:f046::201 PING 2001:780:45:f046::201(2001:780:45:f046::201) 56 data bytes ^C --- 2001:780:45:f046::201 ping statistics --- 6 packets transmitted, 0 received, 100% packet loss, time 4999ms $ telnet 2001:780:45:f046::201 80 Trying 2001:780:45:f046::201... telnet: connect to address 2001:780:45:f046::201: Connection timed out $ traceroute 2001:780:45:f046::201 traceroute to 2001:780:45:f046::201 (2001:780:45:f046::201), 30 hops max, 80 byte packets 1 * * * 2 gige-g2-4.core1.fra1.he.net (2001:470:0:69::1) 75.265 ms 75.266 ms 75.552 ms 3 gi0-3-rt1-ffm2.core.noris.net (2001:7f8::3031:0:1) 72.963 ms 72.883 ms 72.891 ms 4 vl604-rt3-nbg3.core.noris.net (2001:780:40:10::1) 75.429 ms 75.448 ms 75.416 ms 5 fa0-0-31-rt6-nbg3.access.noris.net (2001:780:40:23::5) 75.374 ms 75.048 ms 75.128 ms 6 2001:780:0:f::13 (2001:780:0:f::13) 75.030 ms 50.987 ms 50.882 ms 7 * * * 8 * * * (...) 29 * * * 30 * * * Regards, André.

2 1

what about femtocells?
by Sébastien Lorquet 22 Sep '11

22 Sep '11

Hi all, Do you see any interest in the domain of femtocells? this model, that will be sold in France, claims to be pluggable (probably via ethernet) into nearly any ISP provided home router (internet "box"). http://www.pcinpact.com/actu/news/65810-sfr-mobile-adsl-3g-femto.htm Is it in any way comparable to the nanoBTS and other stuff you're hacking nowadays ? Regards Sebastien

3 2

Issue with Airprobe & USRP1/RFX900/52M
by nghia phan 21 Sep '11

21 Sep '11

Hello everyone, I'm looking for help. I have downloaded and built Airprobe (gsm-receiver, gssm, ) on my Ubuntu machine. a/ Using the capture file provided on the web site, I could get a first level of decoding done: nphan@ubuntu:~/airprobe/gsm-receiver/src/python$ more capture_941.8M_112.log Key: '0000000000000000' Configuration: '' No configuration set. configure_receiver 1670173 0: 15 06 21 00 01 00 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 1670177 0: 15 06 21 00 01 00 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 1670183 0: 15 06 21 00 01 00 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 1670187 0: 15 06 21 00 01 00 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 1670193 0: 15 06 21 00 01 00 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 1670197 0: 15 06 21 00 01 00 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 1670204 0: 01 06 07 60 00 25 54 a8 f9 74 05 5e 18 73 2b 2b 2b 2b 2b 2b 2b 2b 2b 1670208 0: 01 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 1670214 0: 01 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 1670218 0: 01 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 1670224 0: 15 06 21 00 01 00 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 1670228 0: 15 06 21 00 01 00 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 1670234 0: 15 06 21 00 01 00 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b but in wireshark I can't see any decoded info such as BCCH system info etc... b/ It looks like my capture isn't working properly either (ie I can't even get the 1st level of decoding as with capture file provided in the web site). nphan@ubuntu:~/airprobe/gsm-receiver/src/python$ ./capture.sh 953.4M /usr/local/bin/usrp_rx_cfile.py Capturing for 10 seconds to capture_953.4M_112.cfile (4642850 samples) Using RX d'board B: Flex 900 Rx USB sample rate 571.428k nphan@ubuntu:~/airprobe/gsm-receiver/src/python$ ./go.sh capture_953.4M_112.cfile >>> gr_fir_ccc: using SSE >>> gr_fir_ccf: using SSE Key: '0000000000000000' Configuration: '' No configuration set. configure_receiver gr_buffer::allocate_buffer: warning: tried to allocate 115 items of size 568. Due to alignment requirements 512 were allocated. If this isn't OK, consider padding your structure to a power-of-two bytes. On this platform, our allocation granularity is 4096 bytes. nphan@ubuntu:~/airprobe/gsm-receiver/src/python$ I have a USRP1 with 2 RFX900 with a ClockTamer providing 52Mhz clock. I have changed the various Python scripts so that the RFX daughter on side B and RX2 are selected. I have also changed the clock rate to 52M to match my HW. I have input the frequency of a known BTS (which kal can see and measure the offset). Any hints about what is wrong in my set-up or process? Thanks Nghia

1 0

GSM 850 / PCS 1900 : PLEASE HELP NEEDED
by rola 21 Sep '11

21 Sep '11

Hi All, I have done all what I could in setting up the project and running of it as indicated in the wiki and mailing list. It has been over two weeks of trial and error of figuring out of what the problem is that led me to this conclusion that OsmocomBB project might not be designed optimally for US GSM Bands (GSM 850/ PCS 1900). The system could not get synchronised to a frequency when FSBS request is carried out. I read from the mailing-list about the possible modification to be done on the file rffe_dualband.c for GSM band in US in order to resolve the issue of synchronisation. I made a changed of DCS 1800 to PCS 1900 and yet the output remain the same with no difference. Perhaps, I am still overlooking a possible detail that might make the MS not synchronising. However the power measure is of average -90dBm which I think might be too low for required level. If there can be anyone with any clue to resolve or shed more light on this issue I am kindly requesting for assistance I have my configuration and output as followed: SYSTEM CONFIGURATION: OS : Ubuntu 10.10 Maverick Meerkat TI- Calypso: Motorola C155 (US Model) Cable: PL2303 USB cable Tool-chain: Self compiled GNUArm tool-chain based on instruction on http://bb.osmocom.org/trac/wiki/GnuArmToolchain OsmocomBB Branch: Successful installation of both Master and Sylvain branch with modification to Makefile to enable transmitting PROGRAM OUTPUTS: Running OsmocomBB (Sylvain Branch) Osmocon Output 1 : rola@amira:~/test2-osmocom-bb/osmocom-bb/src/host/osmocon$ ./osmocon -p /dev/ttyUSB0 -m c155 ../../target/firmware/board/compal_e99/layer1.compalram.bin got 1 bytes from modem, data looks like: 00 . got 6 bytes from modem, data looks like: 1b f6 02 00 41 01 ....A. got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD read_file(../../target/firmware/board/compal_e99/layer1.compalram.bin): file_size=53804, hdr_len=4, dnload_len=53811 got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 43 C Received PROMPT2 from phone, starting download handle_write(): 4096 bytes (4096/53811) handle_write(): 4096 bytes (8192/53811) handle_write(): 4096 bytes (12288/53811) handle_write(): 4096 bytes (16384/53811) handle_write(): 4096 bytes (20480/53811) handle_write(): 4096 bytes (24576/53811) handle_write(): 4096 bytes (28672/53811) handle_write(): 4096 bytes (32768/53811) handle_write(): 4096 bytes (36864/53811) handle_write(): 4096 bytes (40960/53811) handle_write(): 4096 bytes (45056/53811) handle_write(): 4096 bytes (49152/53811) handle_write(): 4096 bytes (53248/53811) handle_write(): 563 bytes (53811/53811) handle_write(): finished got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 03 . got 1 bytes from modem, data looks like: 42 B Received DOWNLOAD ACK from phone, your code is running now! OSMOCOM Layer 1 (revision osmocon_v0.0.0-1111-ge838620) ====================================================================== Device ID code: 0xb4fb Device Version code: 0x0000 ARM ID code: 0xfff3 cDSP ID code: 0x0128 Die ID code: 7e570d2eb10393bb ====================================================================== REG_DPLL=0x2413 CNTL_ARM_CLK=0xf0a1 CNTL_CLK=0xff91 CNTL_RST=0xfff3 CNTL_ARM_DIV=0xfff9 ====================================================================== Power up simcard: Assert DSP into Reset Releasing DSP from Reset Setting some dsp_api.ndb values Setting API NDB parameters DSP Download Status: 0x0001 DSP API Version: 0x0000 0x0000 Finishing download phase DSP Download Status: 0x0002 DSP API Version: 0x3606 0x0000 LOST 3907! LOST 3750! Above output was done with Mobile App not in used. Running Osmocon with Mobile App. Mobile App Output 1: rola@amira:~$ cd test2-osmocom-bb/osmocom-bb/src/host/layer23/src/mobile/ rola@amira:~/test2-osmocom-bb/osmocom-bb/src/host/layer23/src/mobile$ ./mobile -i 127.0.0.1 Copyright (C) 2008-2010 ... Contributions by ... License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. <000f> sim.c:1206 init SIM client <0006> gsm48_cc.c:63 init Call Control <0001> gsm48_rr.c:5100 init Radio Ressource process <0005> gsm48_mm.c:1312 init Mobility Management process <0005> gsm48_mm.c:1035 Selecting PLMN SEARCH state, because no SIM. <0002> gsm322.c:5023 init PLMN process <0003> gsm322.c:5024 init Cell Selection process *** Warning: Mobile '1' has default IMEI: 000000000000000 This could relate your identitiy to other users with default IMEI. *** Mobile '1' initialized, please start phone now! VTY available on port 4247. <0005> subscriber.c:567 Requesting SIM file 0x2fe2 <000f> sim.c:209 got new job: SIM_JOB_READ_BINARY (handle=00000004) <000f> sim.c:697 go MF <000f> sim.c:241 SELECT (file=0x3f00) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) ******The above output runs with MS still turned off. Telnet Output: rola@amira:~$ telnet localhost 4247 Trying ::1... Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Welcome to the OsmocomBB control interface OsmocomBB> en OsmocomBB# sim read 1 OsmocomBB# conf t OsmocomBB(config)# ms 1 OsmocomBB(ms)#noshutdown % Unknown command. OsmocomBB(ms)# % (MS 1) % No service. OsmocomBB(ms)#en OsmocomBB# sh ms MS '1' is up, service is unavailable IMEI: 000000000000000 IMEISV: 0000000000000000 IMEI generation: fixed automatic network selection state: A4 wait for PLMN to appear cell selection state: C6 any cell selection radio ressource layer state: idle mobility management layer state: MM idle, no cell available OsmocomBB# sh support Supported features of MS '1': Phase 2 mobile station R-GSM : yes E-GSM : yes P-GSM : yes GSM900 Class : 4 DCS 1800 : yes DCS Class : 1 GSM 850 : disabled PCS 1900 : disabled GSM 480 : no GSM 450 : no CECS : no VGCS : no VBS : no SMS : no SS_IND : yes PS_CAP : no CMSP : no SoLSA : no LCSVA : no LOC_SERV : no A5/1 : yes A5/2 : yes A5/3 : no A5/4 : no A5/5 : no A5/6 : no A5/7 : no A5/1 : yes Channels : SDCCH + TCH/F + TCH/H Full-Rate V1 : yes Full-Rate V2 : yes Full-Rate V3 : no Half-Rate V1 : yes Half-Rate V3 : no Min RXLEV : -106 OsmocomBB# **** Clearly above under supporrt command, PCS 1900 and GSM 850 is disabled. I have no clue of how turn it on. Osmocon Output 2: PM MEAS: ARFCN=120, 35 dBm at baseband, -102 dBm at RF PM MEAS: ARFCN=121, 41 dBm at baseband, -97 dBm at RF PM MEAS: ARFCN=122, 40 dBm at baseband, -97 dBm at RF PM MEAS: ARFCN=123, 41 dBm at baseband, -96 dBm at RF PM MEAS: ARFCN=124, 41 dBm at baseband, -97 dBm at RF L1CTL_PM_REQ start=512 end=885 PM MEAS: ARFCN=512, 43 dBm at baseband, -94 dBm at RF PM MEAS: ARFCN=512, 40 dBm at baseband, -97 dBm at RF PM MEAS: ARFCN=513, 40 dBm at baseband, -97 dBm at RF - - - PM MEAS: ARFCN=883, 41 dBm at baseband, -96 dBm at RF PM MEAS: ARFCN=884, 43 dBm at baseband, -94 dBm at RF PM MEAS: ARFCN=885, 44 dBm at baseband, -94 dBm at RF L1CTL_PM_REQ start=955 end=1023 PM MEAS: ARFCN=955, 41 dBm at baseband, -96 dBm at RF PM MEAS: ARFCN=955, 37 dBm at baseband, -101 dBm at RF - - - PM MEAS: ARFCN=1021, 43 dBm at baseband, -94 dBm at RF PM MEAS: ARFCN=1022, 36 dBm at baseband, -101 dBm at RF PM MEAS: ARFCN=1023, 41 dBm at baseband, -96 dBm at RF L1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=872, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=1002, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=1000, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=983, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=979, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=966, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=962, flags=0x7) Starting FCCH RecognitionLOST 1885! LOST 1865! L1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=958, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=957, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=879, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=877, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=876, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=874, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=871, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=867, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=849, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=844, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=839, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=837, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=835, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=828, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=827, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=826, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=824, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=820, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=818, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=817, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=811, flags=0x7) Starting FCCH RecognitionL1CTL_RESET_REQ: FULL!L1CTL_FBSB_REQ (arfcn=809, flags=0x7) ^C rola@amira:~/test2-osmocom-bb/osmocom-bb/src/host/osmocon$ **** The FBSB yield no result Mobile App Output2: <0003> gsm322.c:2900 Found signal (ARFCN 648(DCS) rxlev -94 (16)) <0003> gsm322.c:2900 Found signal (ARFCN 649(DCS) rxlev -96 (14)) <0003> gsm322.c:2900 Found signal (ARFCN 650(DCS) rxlev -94 (16)) <0003> gsm322.c:2900 Found signal (ARFCN 651(DCS) rxlev -94 (16)) <0003> gsm322.c:2900 Found signal (ARFCN 652(DCS) rxlev -93 (17)) <0003> gsm322.c:2900 Found signal (ARFCN 653(DCS) rxlev -94 (16)) <0003> gsm322.c:2900 Found signal (ARFCN 654(DCS) rxlev -94 (16)) <0003> gsm322.c:2900 Found signal (ARFCN 655(DCS) rxlev -94 (16)) <0003> gsm322.c:2900 Found signal (ARFCN 656(DCS) rxlev -94 (16)) - - -- - <0003> gsm322.c:2900 Found signal (ARFCN 876(DCS) rxlev -93 (17)) <0003> gsm322.c:2900 Found signal (ARFCN 877(DCS) rxlev -93 (17)) <0003> gsm322.c:2900 Found signal (ARFCN 878(DCS) rxlev -96 (14)) <0003> gsm322.c:2900 Found signal (ARFCN 879(DCS) rxlev -93 (17)) <0003> gsm322.c:2900 Found signal (ARFCN 880(DCS) rxlev -94 (16)) <0003> gsm322.c:2900 Found signal (ARFCN 881(DCS) rxlev -94 (16)) <0003> gsm322.c:2900 Found signal (ARFCN 882(DCS) rxlev -94 (16)) <0003> gsm322.c:2900 Found signal (ARFCN 883(DCS) rxlev -96 (14)) <0003> gsm322.c:2900 Found signal (ARFCN 884(DCS) rxlev -94 (16)) <0003> gsm322.c:2900 Found signal (ARFCN 885(DCS) rxlev -94 (16)) <0003> gsm322.c:2912 Done with power scanning range. <0003> gsm322.c:2790 Scanning power for all frequencies. <0003> gsm322.c:2851 Scanning frequencies. (955..955) <0003> gsm322.c:2900 Found signal (ARFCN 955 rxlev -96 (14)) <0003> gsm322.c:2888 Getting PM for ARFCN 955 twice. Overwriting the first! Please fix prim_pm.c <0003> gsm322.c:2900 Found signal (ARFCN 955 rxlev -101 (9)) <0003> gsm322.c:2900 Found signal (ARFCN 956 rxlev -100 (10)) <0003> gsm322.c:2900 Found signal (ARFCN 957 rxlev -93 (17)) <0003> gsm322.c:2900 Found signal (ARFCN 958 rxlev -93 (17)) <0003> gsm322.c:2900 Found signal (ARFCN 959 rxlev -96 (14)) -- -- -- -- <0003> gsm322.c:2900 Found signal (ARFCN 998 rxlev -96 (14)) <0003> gsm322.c:2900 Found signal (ARFCN 999 rxlev -96 (14)) <0003> gsm322.c:2900 Found signal (ARFCN 1000 rxlev -93 (17)) <0003> gsm322.c:2900 Found signal (ARFCN 1001 rxlev -96 (14)) <0003> gsm322.c:2900 Found signal (ARFCN 1002 rxlev -93 (17)) <0003> gsm322.c:2900 Found signal (ARFCN 1003 rxlev -96 (14)) <0003> gsm322.c:2900 Found signal (ARFCN 1004 rxlev -101 (9)) <0003> gsm322.c:2900 Found signal (ARFCN 1005 rxlev -96 (14)) <0003> gsm322.c:2900 Found signal (ARFCN 1006 rxlev -96 (14)) <0003> gsm322.c:2900 Found signal (ARFCN 1007 rxlev -96 (14)) <0003> gsm322.c:2900 Found signal (ARFCN 1008 rxlev -101 (9)) <0003> gsm322.c:2900 Found signal (ARFCN 1009 rxlev -101 (9)) <0003> gsm322.c:2900 Found signal (ARFCN 1010 rxlev -101 (9)) <0003> gsm322.c:2900 Found signal (ARFCN 1011 rxlev -96 (14)) <0003> gsm322.c:2900 Found signal (ARFCN 1012 rxlev -96 (14)) <0003> gsm322.c:2900 Found signal (ARFCN 1013 rxlev -101 (9)) <0003> gsm322.c:2900 Found signal (ARFCN 1014 rxlev -96 (14)) <0003> gsm322.c:2900 Found signal (ARFCN 1015 rxlev -96 (14)) <0003> gsm322.c:2900 Found signal (ARFCN 1016 rxlev -96 (14)) <0003> gsm322.c:2900 Found signal (ARFCN 1017 rxlev -101 (9)) <0003> gsm322.c:2900 Found signal (ARFCN 1018 rxlev -96 (14)) <0003> gsm322.c:2900 Found signal (ARFCN 1019 rxlev -96 (14)) <0003> gsm322.c:2900 Found signal (ARFCN 1020 rxlev -96 (14)) <0003> gsm322.c:2900 Found signal (ARFCN 1021 rxlev -94 (16)) <0003> gsm322.c:2900 Found signal (ARFCN 1022 rxlev -101 (9)) <0003> gsm322.c:2900 Found signal (ARFCN 1023 rxlev -96 (14)) <0003> gsm322.c:2912 Done with power scanning range. <0003> gsm322.c:2790 Scanning power for all frequencies. <0003> gsm322.c:2828 Found 568 frequencies. <0003> gsm322.c:2248 Scanning frequency 872(DCS) (rxlev -92). <0003> gsm322.c:469 Sync to ARFCN=872(DCS) rxlev=-92 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 40 frequencies left in band 512..885 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=872(DCS) <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 1002 (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=1002 rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 30 frequencies left in band 955..124 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=1002 <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 1000 (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=1000 rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 29 frequencies left in band 955..124 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=1000 <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 983 (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=983 rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 28 frequencies left in band 955..124 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=983 <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 979 (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=979 rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 27 frequencies left in band 955..124 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=979 <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 966 (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=966 rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 26 frequencies left in band 955..124 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=966 <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 962 (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=962 rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 25 frequencies left in band 955..124 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=962 <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 958 (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=958 rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 24 frequencies left in band 955..124 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=958 <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 957 (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=957 rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 23 frequencies left in band 955..124 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=957 <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 879(DCS) (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=879(DCS) rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 39 frequencies left in band 512..885 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=879(DCS) <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 877(DCS) (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=877(DCS) rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 38 frequencies left in band 512..885 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=877(DCS) <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 876(DCS) (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=876(DCS) rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 37 frequencies left in band 512..885 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=876(DCS) <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 874(DCS) (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=874(DCS) rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 36 frequencies left in band 512..885 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=874(DCS) <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 871(DCS) (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=871(DCS) rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 35 frequencies left in band 512..885 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=871(DCS) <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 867(DCS) (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=867(DCS) rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 34 frequencies left in band 512..885 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=867(DCS) <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 849(DCS) (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=849(DCS) rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 33 frequencies left in band 512..885 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=849(DCS) <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 844(DCS) (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=844(DCS) rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 32 frequencies left in band 512..885 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=844(DCS) <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 839(DCS) (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=839(DCS) rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 31 frequencies left in band 512..885 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=839(DCS) <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 837(DCS) (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=837(DCS) rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 30 frequencies left in band 512..885 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=837(DCS) <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 835(DCS) (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=835(DCS) rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 29 frequencies left in band 512..885 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=835(DCS) <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 828(DCS) (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=828(DCS) rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 28 frequencies left in band 512..885 <0003> gsm322.c:2993 Channel sync error. -- -- -- <0003> gsm322.c:2268 23 frequencies left in band 512..885 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=818(DCS) <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 817(DCS) (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=817(DCS) rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 22 frequencies left in band 512..885 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=817(DCS) <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 811(DCS) (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=811(DCS) rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 21 frequencies left in band 512..885 <0003> gsm322.c:2993 Channel sync error. <0003> gsm322.c:2998 free sysinfo ARFCN=811(DCS) <0003> gsm322.c:2734 Cell selection failed, sync timeout. <0003> gsm322.c:2248 Scanning frequency 809(DCS) (rxlev -93). <0003> gsm322.c:469 Sync to ARFCN=809(DCS) rxlev=-93 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2268 20 frequencies left in band 512..885 **** The output displayed cell selection failure. The process repeats itself continuously Thanks Rasak -- View this message in context: http://baseband-devel.722152.n3.nabble.com/GSM-850-PCS-1900-PLEASE-HELP-NEE… Sent from the baseband-devel mailing list archive at Nabble.com.

2 2

Architecture of oscomBB
by nghia phan 18 Sep '11

18 Sep '11

Hello everyone, I'm new to OscomBB and have few questions about its architecture. I have ordered the C123 and the serial cable. Note: I have OpenBTS running quite well and would like now to explore the other end. I did look at the Software Overview page and have the following questions: a/ where can I log the raw burst (156 bits)? [ not the IQ samples ] on the PC? on the ARM7? b/ on the downllink path, how is the FCH detection process split between dsp, arm7 and PC? ie from raw burst to FCH detection indication and offset value. c/ on the downllink path, how is the SCH decode process split between dsp, arm7 and PC? ie from raw burst to GSM frame number, BSIC etc.. d/ on the downllink path, how is the BCCH decode process split between dsp, arm7 and PC? ie from raw burst to System Informations... d/ on the uplink path, how the RACH encode process (RACH_REQ) is split between dsp, arm7 and PC? Thank your for your kind answers. Rgds Nghia

2 1

RFC: libosmocore generic CRC
by Sylvain Munaut 17 Sep '11

17 Sep '11

Hi, I've just pused in libosmocore a branch sylvain/crc with a proposal for some generic CRC function. The goal here is to provide a base implementation so that channel coding/decoding of the various other projects can use this as a base rather than reimplement their own for each poly. The API is targeted towards that use (using array of ubit_t rather than a buffer of packed bits). The code is generated from a template and expanded into a 8 / 16 / 32 / 64 bits version by the Makefile (each capable of supporting any crc length inferior or equal to that. So a CRC12 would use the 16bits state function). Appropriate doxygen doc is included. If nobody has objection / comments / ... I'll go ahead and merge it. Cheers, Sylvain

2 1

Failed to initialize flash! Why?
by Tobias Funke 16 Sep '11

16 Sep '11

Hi, sorry if I shouldn`t write correclly, i'm not that good in english. i have a Motorola c118 and now aFTDI cable. my problem: compiling was successfully. than i run osmocon: ./osmocon -p /dev/ttyUSB0 -m c123xor /home/test/install/osmocom-bb/src/target/firmware/board/compal_e88/layer1.ramload.bin i pressed power button and get this output: got 2 bytes from modem, data looks like: 04 81 .. got 5 bytes from modem, data looks like: 1b f6 02 00 41 ....A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD read_file(../../target/firmware/board/compal_e88/loader.compalram.bin): file_size=17184, hdr_len=4, dnload_len=17191 got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 43 C Received PROMPT2 from phone, starting download handle_write(): 4096 bytes (4096/17191) handle_write(): 4096 bytes (8192/17191) handle_write(): 4096 bytes (12288/17191) handle_write(): 4096 bytes (16384/17191) handle_write(): 807 bytes (17191/17191) handle_write(): finished got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 03 . got 1 bytes from modem, data looks like: 42 B Received DOWNLOAD ACK from phone, your code is running now! Received DOWNLOAD ACK from phone, your code is running now! OSMOCOM Loader (revision osmocon_v0.0.0-1108-g7bbd2ac) ====================================================================== Running on compal_e88 in environment compalram Failed to initialize flash! _____________________ Why initializing flash failed? what is my fault? can you help me? thanks a lot, tobsen

3 2

Comprehensive User Directive Manual Needed
by rola 16 Sep '11

16 Sep '11

Hi all, I am really thrill to set up OsmocomBB program single handedly after scourging through mailing list and crash learning linux environment from online tutorials. This is an amazing project with a lot of concept and idea that can only be acquired through years of working as a developer. I really appreciate the great work each and everyone put into this project and I am taking advantage of this to set myself back as a programmer. Could there be a comprehensive documentation on how to setup the the project from the first stage of firmware download to the linking of various applications to the running osmocon program. It took a lot of time to get myself around the project before I could finally set it up. Beside the core participant programmers and those that were previously familiar with this nature of application many of the interested enthusiast like me are left in the dark on what to do at one point or the other during the set up of the project. For an instance after successfully setting up the osmocomBB, I couldn't run the program with my C155 just for the fact that I mistakenly took the passing parameter for C155 for "C155xor" following the given example based on C123. It took me over two days to realized where the error was all because I was having legitimate error report of "NACK" that was explained on the blog to be due to different transmission rate between the hosting system and the MS onboard chip. By stroke of luck, I removed the "xor" based on solution suggested for similar issue on different Motorola model and VIOLA !!! firmware completes downloading and I'm set on track . The funniest thing is that it was after I've resolved the problem that I later read the reference to the C155 parameter passing. Secondly, setting up config file for MOBILE APP was like searching for needle in the hail. My thought was that the file needed to contain a written configuration of VTY with telnet parameters. That took me on a journey of learning what telnet is, what Virtual Terminal is. Anyway, I learn a lot from googling here and there before I finally read in some solution that the file is just an empty file. I know that it might be trivial issue to many of the grounded programmers but to some like me it was really a big issue. Right now I am running the Mobile App and about to setup the patch wireshark but still have no clue of what command to send through the telnet interface or what next to do on the Mobile prompt section. It will be a nice to have a compiled possible errors that newbies might encounter and as well a basic step on what to do at each stage of setting up and running of the programs. Just to give a little background about myself; I have a two semester of wireless technology as part of my graduate study and I intend to use OsmocomBB as the basis of my thesis on analyzing GSM Um interface. Great work guys and God bless. Rasak -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Comprehensive-User-Directive-Man… Sent from the baseband-devel mailing list archive at Nabble.com.

4 10