- baseband-devel - lists.osmocom.org

Anybody using a BTS for debugging?
by Gianni Tedesco 13 May '11

13 May '11

Hi, It seems like a BTS is required in order to really debug anything one develops with osmocombb. I'm still looking at implementing SMS. However the only off-the-shelf option seems to be USRP which is about $1,000 right? Is this going to become a very expensive hobby or are there cheaper options here? Is there a way to bypass L1CTL on the phone and feed the data in to, say, openBTS? If not, it would seem useful to hack such a thing up... Gianni

2 2

Planning for Radio Village at 2011 CCC Camp
by Harald Welte 12 May '11

12 May '11

Hi all! [This message is cross-posted to many lists, please be careful when replying to it! Think twice if your respones really matters to all those projects...] In order to do some better planning for our Camp activities this summer, I would like to request all people who intend to participate in the radio village to add themselves to the wiki: https://events.ccc.de/camp/2011/wiki/index.php/RadioVillage The list of citizens is auto-generated if you use Person template like I have done in my user page at https://events.ccc.de/camp/2011/wiki/index.php/User:LaForge The large main tent is not really intended as a place to sleep, but more like a place where we set up our gear and work on the various projects, similar to what happened at HAR. Thanks in advance! -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

reading bts parameters
by Tom Mayer 12 May '11

12 May '11

hello, I am not quite sure if this is the right place to ask, so sorry in advance for spamming ir i'm in the wrong place. I have build and run osmocom on my C123. I am using it for a university project and we try to read parameters from surrounding BTS. The final goal will be to separate real bts from imsi catchers. So my question is, can I use the osmocom library to gather some data from surrounding BTS? Are there some example programs? Would anyone know a good way to read the SIM data from the connected C123? Thanks in advance! Cheers Tom ---------------------------------------------------------------------------- Short example scenario: A very obvious catcher fault would be not having set the regional code or having set a wrong regional code. So it would theoretically be possible to read the regional code from the own SIM card and the regional code of the transmitting BTS and compare those.

5 5

[PATCH]: Implement SMS decoding
by Gianni Tedesco 12 May '11

12 May '11

Hi, Attached patch implements SMS decoding. Right now it just logs it all to DMM (when I tried DSMS I didn't get any output?!). What remains is to plumb this through to mobile so that the messages can be displayed over a vty and also to send a response other than GSM48_REJECT_MSG_TYPE_NOT_IMPLEMENTED - but I'm not sure what needs to happen here. Is anyone else working in this area? Gianni commit a244cccb6f7600cb867e4949926cc7d877b58f31 Author: Gianni Tedesco <gianni(a)scaramanga.co.uk> Date: Thu May 12 03:24:19 2011 +0100 Implement SMS decoding diff --git a/src/host/layer23/src/mobile/Makefile.am b/src/host/layer23/src/mobile/Makefile.am index fb0423e..60e8d23 100644 --- a/src/host/layer23/src/mobile/Makefile.am +++ b/src/host/layer23/src/mobile/Makefile.am @@ -4,7 +4,7 @@ LDADD = ../common/liblayer23.a $(LIBOSMOCORE_LIBS) $(LIBOSMOVTY_LIBS) $(LIBOSMOG noinst_LIBRARIES = libmobile.a libmobile_a_SOURCES = gsm322.c gsm48_cc.c gsm48_mm.c gsm48_rr.c \ - mnccms.c settings.c subscriber.c support.c \ + gsm48_sms.c mnccms.c settings.c subscriber.c support.c \ transaction.c vty_interface.c bin_PROGRAMS = mobile diff --git a/src/host/layer23/src/mobile/gsm48_mm.c b/src/host/layer23/src/mobile/gsm48_mm.c index bf5bbc2..84069f3 100644 --- a/src/host/layer23/src/mobile/gsm48_mm.c +++ b/src/host/layer23/src/mobile/gsm48_mm.c @@ -36,6 +36,7 @@ #include <osmocom/bb/common/networks.h> #include <osmocom/bb/common/l1ctl.h> #include <osmocom/bb/mobile/gsm48_cc.h> +#include <osmocom/bb/mobile/gsm48_sms.h> #include <osmocom/bb/mobile/app_mobile.h> extern void *l23_ctx; @@ -737,10 +738,10 @@ int gsm48_mmxx_dequeue(struct osmocom_ms *ms) case GSM48_MMSS_CLASS: gsm48_rcv_ss(ms, msg); break; +#endif case GSM48_MMSMS_CLASS: gsm48_rcv_sms(ms, msg); break; -#endif } msgb_free(msg); work = 1; /* work done */ @@ -3847,9 +3848,10 @@ static int gsm48_mm_data_ind(struct osmocom_ms *ms, struct msgb *msg) case GSM48_PDISC_NC_SS: return gsm48_rcv_ss(ms, msg); - case GSM48_PDISC_SMS: - return gsm48_rcv_sms(ms, msg); #endif + case GSM48_PDISC_SMS: + LOGP(DMM, LOGL_NOTICE, "SMS PDISC = 0x%.2x\n", GSM48_PDISC_SMS); + gsm48_rcv_sms(ms, msg); default: LOGP(DMM, LOGL_NOTICE, "Protocol type 0x%02x unsupported.\n", diff --git a/src/host/layer23/src/mobile/gsm48_sms.c b/src/host/layer23/src/mobile/gsm48_sms.c new file mode 100644 index 0000000..63b1965 --- /dev/null +++ b/src/host/layer23/src/mobile/gsm48_sms.c @@ -0,0 +1,306 @@ +/* + * (C) 2010 by Andreas Eversberg <jolly(a)eversberg.eu> + * (C) 2011 by Gianni Tedesco <gianni(a)scaramanga.co.uk> + * + * All Rights Reserved + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + * + */ + +#include <stdint.h> +#include <errno.h> +#include <stdio.h> +#include <string.h> +#include <stdlib.h> +#include <arpa/inet.h> + +#include <osmocom/core/msgb.h> +#include <osmocom/core/utils.h> +#include <osmocom/gsm/gsm48.h> +#include <osmocom/core/talloc.h> + +#include <osmocom/bb/common/logging.h> +#include <osmocom/bb/common/osmocom_data.h> +#include <osmocom/bb/common/networks.h> +#include <osmocom/bb/common/l1ctl.h> +#include <osmocom/bb/mobile/gsm48_sms.h> +#include <osmocom/bb/mobile/app_mobile.h> + +#define CP_DATA 1 + +#define RP_DATA 1 +#define RP_ACK 3 +#define RP_ERROR 5 + +#define TP_MTI_MASK 3 +#define SMS_DELIVER 0 +#define SMS_SUBMIT_REPORT 1 +#define SMS_STATUS_REPORT 2 + +#define TP_RP 0x80 +#define TP_UDHI 0x40 +#define TP_SRI 0x20 +#define TP_MMS 0x04 + +static void decode_7bit(const uint8_t *inp, size_t octets, size_t len) +{ + uint8_t out[len + 1]; + unsigned int i; + + for(i = 0; i <= len; i++) { + int ipos = i - (i >> 3); + int offset = (i & 0x7); + + out[i] = (inp[ipos] & (0x7F >> offset)) << offset; + if( 0 == offset ) + continue; + + out[i] |= (inp[ipos - 1] & + (0x7F << (8 - offset)) & 0xFF) >> (8 - offset); + } + + out[len] = '\0'; + LOGP(DMM, LOGL_NOTICE, "SMS: \"%s\"\n", out); +} + +static uint8_t hi_nibble(uint8_t byte) +{ + return byte >> 4; +} + +static uint8_t lo_nibble(uint8_t byte) +{ + return byte & 0xf; +} + +static int parse_address(struct msgb *msg, int rp, const char *name) +{ + uint8_t len, type; + + if ( !msg->len ) + return -EPROTO; + + len = msgb_get_u8(msg); + if ( !len ) + return 0; + + type = msgb_get_u8(msg); + + if ( rp ) { + /* for RP address, len is in bytes including type field */ + len = len - 1; + }else{ + /* TP address is in BCD digits, not including type field */ + len = len / 2; + } + + if ( msg->len < len ) + return -EPROTO; + + LOGP(DMM, LOGL_NOTICE, "%s: type=0x%.2x %s\n", + name, type, hexdump(msg->data, len)); + + msgb_pull(msg, len); + return 0; +} + +static int parse_timestamp(struct msgb *msg, const char *name) +{ + if ( msg->len < 7 ) + return -EPROTO; + LOGP(DMM, LOGL_NOTICE, + "%s: 20%1x%1x-%1x%1x-%1x%1x %1x%1x:%1x%1x:%1x%1x\n", + name, + lo_nibble(msg->data[0]), + hi_nibble(msg->data[0]), + lo_nibble(msg->data[1]), + hi_nibble(msg->data[1]), + lo_nibble(msg->data[2]), + hi_nibble(msg->data[2]), + lo_nibble(msg->data[3]), + hi_nibble(msg->data[3]), + lo_nibble(msg->data[4]), + hi_nibble(msg->data[4]), + lo_nibble(msg->data[5]), + hi_nibble(msg->data[5])); + msgb_pull(msg, 7); + return 0; +} +static int sms_deliver(struct osmocom_ms *ms, struct msgb *msg, uint8_t b) +{ + uint8_t tp_pid, tp_dcs, tp_udlen; + int rc; + + if ( !(b & TP_MMS) ) + LOGP(DMM, LOGL_NOTICE, "SMS-DELIVER: More messages to send.\n"); + + rc = parse_address(msg, 0, "TP-Originating"); + if ( rc ) + return -EPROTO; + + if ( msg->len < 2 ) + return -EPROTO; + + tp_pid = msgb_get_u8(msg); + tp_dcs = msgb_get_u8(msg); + LOGP(DMM, LOGL_NOTICE, "TP-PID: 0x%.2x\n", tp_pid); + LOGP(DMM, LOGL_NOTICE, "TP-DCS: 0x%.2x\n", tp_dcs); + + rc = parse_timestamp(msg, "TP-Service-Center-Time-Stamp"); + if ( rc ) + return -EPROTO; + + if ( !msg->len ) + return -EPROTO; + tp_udlen = msgb_get_u8(msg); + + /* check for unknown data coding scheme */ + if (tp_dcs) + return 0; + + decode_7bit(msg->data, msg->len, tp_udlen); + return 0; +} + +static int sms_tpdu_decode(struct osmocom_ms *ms, struct msgb *msg) +{ + uint8_t tp_mti; + + if ( !msg->len ) + return 0; + tp_mti = msgb_get_u8(msg); + + switch(tp_mti & TP_MTI_MASK) { + case SMS_DELIVER: + return sms_deliver(ms, msg, tp_mti); + case SMS_SUBMIT_REPORT: + LOGP(DMM, LOGL_NOTICE, "Received SMS-SUBMIT-REPORT: %s\n", + hexdump(msg->data, msg->len)); + break; + case SMS_STATUS_REPORT: + LOGP(DMM, LOGL_NOTICE, "Received SMS-STATUS-REPORT: %s\n", + hexdump(msg->data, msg->len)); + break; + default: + LOGP(DMM, LOGL_NOTICE, "Reserved MTI: 0x%.2x\n", + tp_mti); + return -EPROTO; + } + + return 0; +} + +static int rp_data_decode(struct osmocom_ms *ms, struct msgb *msg, uint8_t ref) +{ + static const char * const str[2] = {"RP-Origination", "RP-Destination"}; + unsigned int i; + uint8_t tpdu_len; + + LOGP(DMM, LOGL_NOTICE, "Received RP-DATA: ref %d\n", ref); + + for(i = 0; i < 2; i++) { + int rc; + + rc = parse_address(msg, 1, str[i]); + if ( rc ) + return -EPROTO; + } + + if ( !msg->len ) + return -EPROTO; + tpdu_len = msgb_get_u8(msg); + if ( tpdu_len < msg->len ) + return -EPROTO; + if ( tpdu_len < msg->len ) { + LOGP(DMM, LOGL_NOTICE, "RP-DATA: %u trailing bytes: %s\n", + msg->len - tpdu_len, + hexdump(msg->data + tpdu_len, msg->len - tpdu_len)); + msg->len = tpdu_len; + } + + /* TODO: pass in reference, and src/dst addresses */ + return sms_tpdu_decode(ms, msg); +} + +static int rp_decode(struct osmocom_ms *ms, struct msgb *msg) +{ + uint8_t rp_mt, rp_ref; + + if ( msg->len < 2 ) + return -EPROTO; + + rp_mt = msgb_get_u8(msg); + rp_ref = msgb_get_u8(msg); + + switch(rp_mt) { + case RP_DATA: + return rp_data_decode(ms, msg, rp_ref); + case RP_ACK: + LOGP(DMM, LOGL_NOTICE, "Received RP-ACK: %s\n", + hexdump(msg->data, msg->len)); + return -ENOTSUP; + case RP_ERROR: + LOGP(DMM, LOGL_NOTICE, "Received RP-ERROR: %s\n", + hexdump(msg->data, msg->len)); + return -ENOTSUP; + default: + LOGP(DMM, LOGL_NOTICE, "Bad RP Message-type: 0x%.2x\n", rp_mt); + return -ENOTSUP; + } + + return 0; +} + +static int cp_data(struct osmocom_ms *ms, struct msgb *msg) +{ + uint8_t len; + + if ( !msg->len ) + return -EPROTO; + len = msgb_get_u8(msg); + if ( len != msg->len ) { + LOGP(DMM, LOGL_NOTICE, "CP-DATA: size mismatch " + "%u != %u bytes\n", len, msg->len); + }else{ + LOGP(DMM, LOGL_NOTICE, "CP-DATA: %u bytes\n", len); + } + + return rp_decode(ms, msg); +} + +int gsm48_rcv_sms(struct osmocom_ms *ms, struct msgb *msg) +{ + uint8_t cp_type; + + LOGP(DMM, LOGL_NOTICE, "Received SMS: %s\n", + hexdump(msg->data, msg->len)); + + if ( msg->len < 2) + return -EPROTO; + + msgb_pull(msg, 1); /* protocol discriminator */ + cp_type = msgb_get_u8(msg); + + switch(cp_type) { + case CP_DATA: + return cp_data(ms, msg); + default: + LOGP(DMM, LOGL_NOTICE, "Unknown SMS type: 0x%.2x\n", cp_type); + return 0; + } + + return 0; +}

2 3

GSM specs doubt
by Gerard 09 May '11

09 May '11

Hi list, while studing burst_ind (I know that burst_ind must be used in a own controlled network) i see that one SDCCH for a specific operator has been shared by more than one MS (different TMSIs), some MS use for SMS other use for calls. Is that an interpratation error (due the fact of using burst_ind in real networks) or that could be possible? i didn't find explanations on sepcs. TIA

2 1

[ANN] libosmocore stable API/ABI
by Harald Welte 08 May '11

08 May '11

Hi all! I think now that the namespace issues in libosmocore have been resolved, we seriously have to think of maintaining a stable API and ABI. This allows us to have truly independent library and application releases, and the dynamic linker library versioning support should ensure compatibility. So please think twice about any modifying libosmocore. It is safe to add new functions, but we cannot change the prototypes (number of arguments) for existing functions. As soon as new functions are introduced, we should increment the library interface number. For more information, see http://www.gnu.org/software/libtool/manual/libtool.html#Versioning especially the rules in Chapter 7.3: # If the library source code has changed at all since the last update, then increment revision (‘c:r:a’ becomes ‘c:r+1:a’). # If any interfaces have been added, removed, or changed since the last update, increment current, and set revision to 0. # If any interfaces have been added since the last public release, then increment age. # If any interfaces have been removed or changed since the last public release, then set age to 0. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

2 2

[ADM] osmocom.org via IPv6
by Harald Welte 08 May '11

08 May '11

Hi all, JFYI: For a couple of days, *.osmocom.org is reachable via IPv6. I've had native IPv6 at my co-located servers for more than 10 years, but somehow never configured it for the virtual machines like *.osmocom.org - this is now fixed. If you encounter any difficulties, please let me know. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

SPMA100B ringtone chip
by l--putt 07 May '11

07 May '11

Hi list! To get closer to a useful phone, I started a project to create a driver for the SPMA100B ringtone chip of the C155. I can replay the commands to play the startup and shutdown sounds and have some idea about the registers. A problem is the MIDI(?) data send to the chip: It's possible to extract the MIDI files from a flash image but the tracks are interleaved by the firmware. Some random single track files don't work either. Anybody an idea? I've found other datasheets (in particular for the W56964 of the DPL10) and they helped a lot in understanding the SPMA100B due to the similarities. Hence, I suggest a common framework for all those chips. However, even salsa (embedded version of ALSA) seems excessive since we have just a single device. I considered a really simple design with just single write-call that blocks until played. Some ioctl solve volume etc. But this doesn't communicate the state (playing, fifo empty, finished, error) well. Any ideas? Does anybody know cc-licensed MIDI ringtones? http://www.ringtonepirates.de/ seems to have only MP3 sounds. Given its name, you also need balls to download there (at least in Germany: "offensichtlich illegale Quelle" :-P ) Regards, Stefan A hack of hello_world example to play ringtones on SPMA100B chip --- src/target/firmware/apps/hello_world/main.c | 330 ++++++++++++++++++++++++++- 1 files changed, 328 insertions(+), 2 deletions(-) diff --git a/src/target/firmware/apps/hello_world/main.c b/src/target/firmware/apps/hello_world/main.c index 5e3ed85..f247795 100644 --- a/src/target/firmware/apps/hello_world/main.c +++ b/src/target/firmware/apps/hello_world/main.c @@ -68,6 +68,310 @@ static void l1a_l23_rx_cb(uint8_t dlci, struct msgb *msg) puts("\n"); } +/* Define GPIO interface */ +#define ARMIO_LATCH_OUT 0xfffe4802 +#define IO_CNTL_REG 0xfffe4804 +#define ASIC_CONF_REG 0xfffef008 + +#define IO_CONF_REG 0xfffef00a +#define CALYPSO_CONF_OFF 4 + +#define CALYPSO_IO4 (1 << 4) +#define CALYPSO_IO7 (1 << 7) +#define CALYPSO_IO8 (1 << 8) +#define CALYPSO_IO12 (1 << 12) + +#define GPIO_ENABLE(pins) { \ + uint16_t reg = readw(IO_CONF_REG); \ + reg |= (pins) >> CALYPSO_CONF_OFF; \ + writew(reg, IO_CONF_REG); } + +#define GPIO_OUTPUT(pins) { \ + uint16_t reg = readw(IO_CNTL_REG); \ + reg &= ~(pins); \ + writew(reg, IO_CNTL_REG); } + +#define GPIO_SET(pins) { \ + uint16_t reg = readw(ARMIO_LATCH_OUT); \ + reg |= (pins); \ + writew(reg, ARMIO_LATCH_OUT); } + +#define GPIO_UNSET(pins) { \ + uint16_t reg = readw(ARMIO_LATCH_OUT); \ + reg &= ~(pins); \ + writew(reg, ARMIO_LATCH_OUT); } + +/* Define W569x constants */ +#define MUSIC_REG 0x01800000 + +#define MUSIC_IRQ CALYPSO_IO4 +#define MUSIC_A0 CALYPSO_IO8 +#define MUSIC_ON CALYPSO_IO12 + +static uint8_t spma100_regread(uint8_t bank) +{ + GPIO_UNSET(MUSIC_A0); + delay_ms(1); + writeb(bank, MUSIC_REG); + GPIO_SET(MUSIC_A0); + + delay_ms(1); + + return readb(MUSIC_REG); +} + +static void spma100_dumpregs(void) +{ + int i; + for(i=0; i<256; i++) { + printf("%02x,", spma100_regread(i)); + } + printf("\n\n"); +} + +static void spma100_deltaregs(void) +{ + int i; + static uint8_t state[256]; + for(i=0; i<256; i++) { + char tmp = spma100_regread(i); + if(tmp ^ state[i]) + printf("%02x: %02x, changed by %02x\n", i, tmp, tmp ^ state[i]); + state[i] = tmp; + } + printf("\n\n"); +} + +static void spma100_regwrite(uint8_t bank, uint8_t data) +{ + GPIO_UNSET(MUSIC_A0); + delay_ms(1); + writeb(bank, MUSIC_REG); + GPIO_SET(MUSIC_A0); + + delay_ms(1); + + writeb(data, MUSIC_REG); + + delay_ms(1); + + //spma100_dumpregs(); + //spma100_deltaregs(); +} + +void music_onoff(int on) +{ + uint16_t reg = readw(0xfffe4802); + + if(on) { + reg |= 0x1000; + } else { + reg &= 0xefff; + } + + writew(reg, 0xfffe4802); +} + +/* HW init */ +void music_init(void) +{ + GPIO_ENABLE(MUSIC_ON); + GPIO_OUTPUT(MUSIC_ON); + + GPIO_ENABLE(MUSIC_IRQ); + + GPIO_ENABLE(MUSIC_A0); + GPIO_OUTPUT(MUSIC_A0); + + writeb(2, 0xfffe4818); + printf("GPIO event mode %x\n", readw(0xfffe4814)); + + music_onoff(1); +} + +int play_midi = -1; +static char midi1[] = {0x72, 0xab, 0x62, 0x00, 0xb0, 0xb3, 0x7f, 0xc0, 0xd2, 0x0b, 0xa7, 0x07, 0xef, 0x3c, 0xce, 0x2f, 0x5e, 0x40, 0x25, 0x3c, 0xb1, 0x07, 0x18, 0x60, 0x30, 0x7b, 0x57, 0x00, 0x91, 0x7f, 0x3f, 0x92, 0x63, 0xf3, 0x0b, 0x18, 0x47, 0xf3, 0xc1, 0x10, 0x54, 0x00, 0xb1, 0x4b, 0x7c, 0x81, 0xe1, 0x00, 0x60, 0x13, 0x50, 0xd6, 0x8a, 0x68, 0x43, 0x90, 0x43, 0x26, 0x74, 0x81, 0xc1, 0x4c, 0x18, 0x00, 0xd9, 0x2a, 0xe0, 0x63, 0x5b, 0xb0, 0x0b, 0x5b, 0x6a, 0x11, 0x37, 0x20, 0x13, 0x00, 0xf6, 0x60, 0x99, 0x70, 0xd6, 0x47, 0x63, 0x5b, 0x7e, 0x31, 0x7b, 0x51, 0x00, 0x90, 0x0c, 0x0a, 0x92, 0x70, 0xfd, 0x0b, 0x19, 0x47, 0xe1, 0xc1, 0x14, 0x54, 0x13, 0xb0, 0x43, 0x68, 0x81, 0xe0, 0x0b, 0x66, 0x13, 0x4c, 0xc2, 0x8a, 0x69, 0x4c, 0x91, 0x43, 0x29, 0x67, 0x92, 0xc0, 0x44, 0x19, 0x00, 0xd8, 0x32, 0xe6, 0x63, 0x48, 0xb1, 0x0b, 0x55, 0x77, 0x10, 0x37, 0x2b, 0x13, 0x13, 0xff, 0x73, 0x9b, 0x70, 0xdf, 0x48, 0x69, 0x40, 0x7a, 0x30, 0x7b, 0x49, 0x00, 0x91, 0x04, 0x12, 0x92, 0x63, 0xfc, 0x0b, 0x1a, 0x4f, 0xed, 0xc2, 0x1a, 0x5c, 0x00, 0xb1, 0x58, 0x64, 0x81, 0xe1, 0x10, 0x6a, 0x13, 0x47, 0xcf, 0x8e, 0x4a, 0x54, 0x90, 0x47, 0x94, 0x3c, 0x00, 0xfc, 0x5f, 0x68, 0x6b, 0x91, 0x47, 0x6b, 0xa7, 0x13, 0x71, 0x5e, 0x1b, 0xb1, 0x97, 0x10, 0x6d, 0x82, 0x3c, 0xef, 0x8a, 0x6b, 0x3c, 0x91, 0x48, 0x2d, 0x73, 0x92, 0xc0, 0x4b, 0x1b, 0x00, 0xd3, 0x2d, 0xef, 0x63, 0x43, 0xb1, 0x0b, 0x5c, 0x63, 0x10, 0x3c, 0x29, 0x13, 0x13, 0xf0, 0x6f, 0x9d, 0x70, 0xd0, 0x47, 0x70, 0x50, 0x66, 0x30, 0x7b, 0x5f, 0x00, 0x91, 0x00, 0x17, 0x92, 0x63, 0xf7, 0x0b, 0x1c, 0x48, 0xf9, 0xc9, 0x01, 0x5b, 0x00, 0xb1, 0x48, 0x76, 0x81, 0xe1, 0x0b, 0x71, 0x13, 0x54, 0xdb, 0x8a, 0x6c, 0x47, 0x90, 0x4c, 0x3b, 0x7e, 0x81, 0xc1, 0x43, 0x1c, 0x00, 0xdd, 0x22, 0xf2, 0x63, 0x5f, 0xb0, 0x0b, 0x5a, 0x70, 0x11, 0x3f, 0x33, 0x13, 0x00, 0xf9, 0x7a, 0x9c, 0x70, 0xd9, 0x4f, 0x74, 0x5f, 0x60, 0x31, 0x7b, 0x51, 0x00, 0x90, 0x07, 0x01, 0x92, 0x70, 0xfe, 0x0b, 0x1d, 0x48, 0xe4, 0xc9, 0x05, 0x5b, 0x13, 0xb0, 0x47, 0x6a, 0x81, 0xe0, 0x00, 0x77, 0x13, 0x4f, 0xc9, 0x8a, 0x6d, 0x4f, 0x91, 0x4c, 0x24, 0x69, 0x92, 0xc0, 0x58, 0x1e, 0x00, 0xdc, 0x34, 0xf9, 0x63, 0x4c, 0xb1, 0x0b, 0x51, 0x7d, 0x10, 0x3f, 0x37, 0x13, 0x13, 0xe3, 0x75, 0x9f, 0x70, 0xc3, 0x53, 0x7a, 0x47, 0x7f, 0x34, 0x5b, 0x4a, 0x00, 0x91, 0xac, 0x55, 0x13, 0x23, 0x80, 0x46, 0x4a, 0x68, 0xf4, 0x4c, 0x7b, 0x13, 0x06, 0xb1, 0x0a, 0x1e, 0x03, 0x92, 0x8c, 0x36, 0x47, 0x61, 0xdb, 0x0b, 0x1f, 0x00, 0xcc, 0x4f, 0x82, 0x10, 0x08, 0xc4, 0x65, 0x6b, 0x69, 0xe5, 0x23, 0x18, 0x77, 0x13, 0x4f, 0x09, 0x3e, 0x43, 0xff, 0x23, 0x07, 0x61, 0x69, 0xd6, 0x63, 0x6b, 0x20, 0x38, 0x73, 0x4c, 0x23, 0x23, 0x82, 0x2b, 0x7d, 0x79, 0xb0, 0x10, 0x1e, 0x4e, 0x69, 0xd5, 0x2b, 0x5d, 0x72, 0xf4, 0x3a, 0x11, 0x5d, 0x4a, 0xff, 0xd0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; +static char midi2[] = {0x00, 0x74, 0x62, 0xc0, 0xd2, 0x07, 0xcf, 0x07, 0xcf, 0x0b, 0x8e, 0x54, 0xe9, 0xd5, 0x09, 0x47, 0x00, 0xc1, 0x06, 0x7a, 0x30, 0x77, 0x09, 0x01, 0xb1, 0x44, 0x6f, 0x81, 0xe1, 0x2c, 0x5f, 0x06, 0x4a, 0xc6, 0x8a, 0x67, 0x4c, 0x91, 0x62, 0x0c, 0x73, 0x87, 0xc1, 0x58, 0x17, 0x00, 0xde, 0x12, 0xde, 0x76, 0x4a, 0xb0, 0x0b, 0x52, 0x72, 0x11, 0x23, 0x36, 0x13, 0x01, 0xf9, 0x7b, 0x96, 0x70, 0xd9, 0x60, 0x5f, 0x49, 0x68, 0x30, 0x7b, 0x58, 0x00, 0x91, 0x13, 0x32, 0x87, 0x76, 0xfd, 0x0b, 0x17, 0x48, 0xfa, 0xdf, 0x2f, 0x4e, 0x05, 0xb0, 0x4c, 0x77, 0x81, 0xe0, 0x08, 0x78, 0x13, 0x4d, 0xd9, 0x8a, 0x67, 0x4c, 0x91, 0x5d, 0x17, 0x60, 0x87, 0xc1, 0x43, 0x17, 0x00, 0xd6, 0x38, 0xde, 0x76, 0x41, 0xb1, 0x0b, 0x54, 0x63, 0x10, 0x2b, 0x1c, 0x06, 0x05, 0xf8, 0x6a, 0x9c, 0x70, 0xd8, 0x4c, 0x77, 0x54, 0x5e, 0x30, 0x7b, 0x50, 0x00, 0x91, 0x19, 0x01, 0x87, 0x76, 0xf2, 0x0b, 0x17, 0x40, 0xcd, 0xd8, 0x2f, 0x46, 0x06, 0xb1, 0x4c, 0x4d, 0x81, 0xe1, 0x1f, 0x5f, 0x06, 0x46, 0xe9, 0x8a, 0x6d, 0x43, 0x90, 0x53, 0x35, 0x44, 0x80, 0xc1, 0x4b, 0x17, 0x00, 0xad, 0x02, 0xde, 0x76, 0x3a, 0xb1, 0x0b, 0xe8, 0x2f, 0x91, 0x1b, 0x0b, 0x74, 0x6d, 0xb1, 0x0b, 0x16, 0xb6, 0x91, 0x94, 0x0a, 0x06, 0xb4, 0xb7, 0x51, 0x13, 0x91, 0xf3, 0x10, 0x23, 0x70, 0x02, 0xb1, 0x69, 0x48, 0x50, 0xf3, 0x54, 0x5f, 0x67, 0x59, 0xe1, 0x6a, 0x17, 0x00, 0xf1, 0x0c, 0x0f, 0x66, 0x06, 0xb1, 0x54, 0x48, 0x50, 0xce, 0x52, 0x5f, 0x58, 0x5b, 0xe0, 0x55, 0x1c, 0x00, 0xcd, 0x13, 0x22, 0x4e, 0x02, 0xb1, 0x57, 0x48, 0x50, 0xcd, 0x51, 0x5f, 0x5d, 0x59, 0xe1, 0x50, 0x17, 0x00, 0xcb, 0x0f, 0x0f, 0x5c, 0x06, 0xb1, 0x52, 0x48, 0x50, 0xc8, 0x4f, 0x5f, 0x5e, 0x5b, 0xe0, 0x53, 0x1c, 0x00, 0xc7, 0x17, 0x20, 0x44, 0x02, 0xb1, 0x5d, 0x48, 0x50, 0xc7, 0x4e, 0x5f, 0x53, 0x59, 0xe1, 0x5e, 0x17, 0x0f, 0xc5, 0x12, 0x0f, 0x52, 0x06, 0xb1, 0x58, 0x48, 0x50, 0xc2, 0x4c, 0x5f, 0x54, 0x5b, 0xe0, 0x59, 0x1b, 0x00, 0xc1, 0x10, 0x3e, 0x42, 0x02, 0xb1, 0x5b, 0x48, 0x50, 0xc1, 0x4b, 0x5f, 0x49, 0x59, 0xe1, 0x44, 0x17, 0x00, 0xdf, 0x15, 0x0f, 0x48, 0x06, 0xb1, 0x46, 0x48, 0x50, 0xdc, 0x49, 0x5f, 0x4a, 0x5b, 0xe0, 0x47, 0x1b, 0x00, 0xdb, 0x13, 0x3d, 0x58, 0x02, 0xb1, 0x41, 0x48, 0x50, 0xdb, 0x48, 0x5f, 0x4f, 0x59, 0xe1, 0x42, 0x17, 0x00, 0xd9, 0x18, 0x0f, 0x4e, 0x06, 0xb1, 0x4c, 0x48, 0x50, 0xd6, 0x46, 0x5f, 0x40, 0x5b, 0xe0, 0x4d, 0x1a, 0x00, 0xd5, 0x17, 0x3b, 0x56, 0x02, 0xb1, 0x4f, 0x48, 0x50, 0xd5, 0x45, 0x5f, 0x45, 0x59, 0xe1, 0x48, 0x17, 0x00, 0xd3, 0x1b, 0x0f, 0x44, 0x06, 0xb1, 0x4a, 0x48, 0x50, 0xd0, 0x43, 0x5f, 0x46, 0x5b, 0xe0, 0x4b, 0x1a, 0x00, 0xaf, 0x18, 0x39, 0x2c, 0x02, 0xb1, 0x35, 0x48, 0x50, 0xaf, 0x42, 0x5f, 0x3b, 0x59, 0xe1, 0x36, 0x17, 0x00, 0xad, 0x1e, 0x0f, 0x3a, 0x06, 0xb1, 0x30, 0x48, 0x50, 0xaa, 0x40, 0x5f, 0x3c, 0x64, 0xe0, 0x31, 0x1a, 0x00, 0xa9, 0x2c, 0x38, 0x2a, 0x02, 0xb1, 0x33, 0x77, 0x50, 0xa9, 0x3f, 0x5f, 0x31, 0x66, 0xe1, 0x3c, 0x17, 0x00, 0xa7, 0x5e, 0x0f, 0x30, 0x06, 0xb1, 0x3e, 0x77, 0x50, 0xa4, 0x3d, 0x5f, 0x32, 0x64, 0xe0, 0x3f, 0x19, 0x00, 0xa3, 0x28, 0x36, 0x20, 0x02, 0xb1, 0x39, 0x77, 0x50, 0xa3, 0x3c, 0x5f, 0x37, 0x66, 0xe1, 0x3a, 0x17, 0x00, 0xa1, 0x5a, 0x1f, 0x29, 0x67, 0xa1}; + +/* SPMA100B driver */ +/* XXX: WARNING! Just guessed! Don't rely on anything! */ + +static void spma100_volume(uint8_t vol1, uint8_t vol2, uint8_t vol3, uint8_t vol4) +{ + /* + * Volume registers + * VDS also OK for VDD=2.8V and SPVDD=3.3V + */ + spma100_regwrite(0xe3, vol1); // MIDI or Master + spma100_regwrite(0xe4, vol2); // PCM??? + spma100_regwrite(0xe5, vol3); // PCM??? + spma100_regwrite(0xe6, vol4); // opposite of 0xe3 +} + +static void spma100_standby(void) +{ + /* Volume: Mute */ + spma100_volume(0, 0, 0, 0); + + spma100_regwrite(0xe2, 0x00); + spma100_regwrite(0xe2, 0x01); + spma100_regwrite(0xe1, 0xff); + spma100_regwrite(0xe2, 0x00); + spma100_regwrite(0xe2, 0x01); + spma100_regwrite(0xf2, 0x04); +} + +static void spma100_start(void) +{ + /* Toggle something. Power? */ + spma100_regwrite(0xe2, 0x00); + spma100_regwrite(0xe2, 0x01); + + spma100_regwrite(0xff, 0x07); + spma100_regwrite(0xe9, 0x00); + spma100_regwrite(0xf2, 0x00); + + /* Volume: Mute */ + spma100_volume(0, 0, 0, 0); + + /* Power-up sequence/disable power-downs. Clicks otherwise */ + spma100_regwrite(0xe1, 0x7e); + spma100_regwrite(0xe1, 0x1e); + spma100_regwrite(0xe1, 0x04); + spma100_regwrite(0xe1, 0x00); + + /* + * PLL settings + * With OKI's table 8, this would be 13*34/10 = 44.2MHz + * -> 0.2% error for 44.1kHz * 1000 cycles/sample + * XXX: why twice!? + */ + spma100_regwrite(0xe7, 0x22); + spma100_regwrite(0xe8, 0x09); + spma100_regwrite(0xf3, 0x22); + spma100_regwrite(0xf4, 0x09); + + /* + * Would be transition from MUTE to 0dB for W56964 + */ + spma100_volume(0, 0, 0, 0); + spma100_volume(0x1f, 0x1f, 0x1f, 0x10); + + spma100_regwrite(0xdb, 0x08); + spma100_regwrite(0xdc, 0x00); + spma100_regwrite(0xde, 0x08); + spma100_regwrite(0xdf, 0x00); +} + +static void spma100_senddata(char *data, int length) +{ + int i; + for(i=0; i<length; i++) + spma100_regwrite(0xc5, data[i]); +} + +static void spma100_play_midi(char *data, int length) +{ + spma100_regwrite(0xe0, 0x02); + spma100_regwrite(0xc8, 0x02); + spma100_regwrite(0xc8, 0x04); + spma100_regwrite(0xd6, 0x00); + spma100_regwrite(0xc4, 0x02); + spma100_regwrite(0xc6, 0xff); + spma100_regwrite(0xd6, 0x01); + spma100_senddata(data, length); + spma100_regwrite(0xd6, 0x00); + spma100_regwrite(0xc8, 0x01); +} + +static void spma100_init(void) +{ + static const char setup_cmd[] = { /* removed because of unknown copyright */ }; + + int i; + /* XOR with flash for copyright issues */ + for(i=0; i<449; i++) + midi1[i] = *(uint8_t *)(0x6f0694 + i) ^ midi1[i]; + for(i=0; i<sizeof(midi2); i++) + midi2[i] = *(uint8_t *)(0x6f0884 + i) ^ midi2[i]; + + music_init(); + +/* Not required to play music! + spma100_regwrite(0xd6, 0x01); + spma100_regwrite(0xc8, 0x06); + spma100_regwrite(0xd6, 0x00); + + // XXX: timestamp advanced! What happened? + spma100_regwrite(0xc8, 0x02); + spma100_regwrite(0xc8, 0x04); + spma100_regwrite(0xd6, 0x00); + spma100_regwrite(0xc0, 0x02); + spma100_regwrite(0xc4, 0x00); + spma100_senddata(setup_cmd, sizeof(setup_cmd)); + + // XXX: timestamp advanced! What happened? + spma100_regwrite(0xc6, 0xff); + spma100_regwrite(0xc8, 0x01); + + spma100_standby(); +*/ +} + +static void spma100_voodoo1(void) +{ + spma100_regwrite(0xda, 0x35); + spma100_regwrite(0xdb, 0x02); + spma100_regwrite(0xdd, 0x59); + spma100_regwrite(0xde, 0x02); +} + +static void spma100_voodoo2(void) +{ + spma100_regwrite(0xd2, 0x00); + spma100_regwrite(0xd3, 0x0f); + spma100_regwrite(0xd4, 0x0f); + spma100_regwrite(0xd8, 0x00); +} + +static void spma100_voodoo3(void) +{ + spma100_regwrite(0xc8, 0x06); + spma100_regwrite(0xd6, 0x00); + spma100_regwrite(0xc8, 0x06); + spma100_regwrite(0xd6, 0x00); + spma100_regwrite(0xd6, 0x00); + spma100_regwrite(0xd9, 0x0f); + spma100_regwrite(0xd9, 0x00); + spma100_regwrite(0xd3, 0x0f); + spma100_regwrite(0xd4, 0x0f); + spma100_regwrite(0xd8, 0x00); +} + +static void spma100_clear_fifo() +{ + int i; + spma100_regwrite(0xd6, 0x01); + for(i=0; i<256; i++) + spma100_regwrite(0xc5, 0); +} + +void spma100(const char *midi, int length) +{ + spma100_start(); + + /* XXX: Volume? */ + //spma100_regwrite(0xe1, 0x00); + + spma100_voodoo1(); + spma100_voodoo2(); + spma100_play_midi(midi, length); + + //spma100_clear_fifo(); + //spma100_voodoo3(); + //spma100_standby(); +} + int main(void) { board_init(); @@ -103,9 +407,30 @@ int main(void) sercomm_register_rx_cb(SC_DLCI_CONSOLE, console_rx_cb); sercomm_register_rx_cb(SC_DLCI_L1A_L23, l1a_l23_rx_cb); - /* beyond this point we only react to interrupts */ - puts("entering interrupt loop\n"); + /* MIDI player */ + int i; + spma100_init(); + puts("Play MIDI on keypress\n"); while (1) { + switch(play_midi) { + case 1: + spma100(midi1, sizeof(midi1)); + break; + case 2: + spma100(midi2, sizeof(midi2)); + break; + case 9: + printf("GPIO status %04x\n", readw(0xfffe4800)); + spma100(midi1, sizeof(midi1)); + for(i=0; i<20; i++) { + spma100_deltaregs(); + printf("GPIO status %04x\n", readw(0xfffe4800)); + delay_ms(50); + } + break; + } + play_midi = -1; + update_timers(); } @@ -132,6 +457,7 @@ void key_handler(enum key_codes code, enum key_states state) case KEY_7: case KEY_8: case KEY_9: + play_midi = code - KEY_0; sprintf(test, "%d", code - KEY_0); display_puts(test); break; -- 1.7.1

1 0

R: Re: R: Re: lost dump ?!?!?
by screaming-pain＠libero.it 06 May '11

06 May '11

Thanks Sylvain, Harald and Alex, > >Can you please verify this? If you do have a listener on the UDP port >and still get write errors, we need to fix something in 'mobile'. >Otherwise, no need for that... > I was using nc -u -l 4729 > /dev/null I added the -p option and tried again: as you said this solved the problem!!! Thanks again, Loretta

1 0

simtrace: New mailing list / progress
by Harald Welte 06 May '11

06 May '11

Hi all! Since Kevin and I are trying to re-vitalize the simtrace project, I have decided to create a new simtrace(a)lists.osmocom.org mailing list dedicated to this project. Yesterday at a meeting we have discussed * to use a digitally-controlled analog switch to select sniffing / emulation mode (i.e. to do a software-controlled 'cut' the electrical connection between the SIM card and the phone) * to add a header next to the USB socket so we can attach a battery pack for autonomous operation * to add a SPI NOR flash (for storage of data in autonomous operation) * to not care about 1.8V-only SIM cards and make it a 3.3V-only device We expect to do a bit more schematics review and component placement + routing as well as a prototype PCB in the next couple of weeks. Kevin is in charge of the hardware prototype, while I will look at the firmware side as well as provide funding for the PCB manufacturing and prototype components. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0