baseband-devel

baseband-devel@lists.osmocom.org

2 participants
2003 discussions

Start a nNew thread

Fwd: Problems
by Bilguun Tugs 08 May '19

08 May '19

I have these problems on make command. What should i do ? I'm using Ubuntu 16.04 32 bit

2 1

Silabs Aero II transceiver datasheet?
by Mychaela Falconia 28 Apr '19

28 Apr '19

Hello OBB gang, The Potential Calypso Targets page in your wiki lists a whole bunch of phones with Silabs Aero II (Si4210) RF transceivers: http://projects.osmocom.org/projects/baseband/wiki/PotentialCalypsoTargets I wonder, has anyone ever succeeded in finding a datasheet for this transceiver? I found the datasheet for the older Aero+ transceiver (a 3-chip solution), but not for the single-chip Aero II aka Si4210. Here are the Silabs Aero materials I have found so far: ftp://ftp.freecalypso.org/pub/GSM/Silabs/ I got the marketing briefs for Aero+ and for Aero II, and the full technical datasheet for the former of the two. If anyone has a datasheet for Si4210 and would be willing to share it, I will gladly add it to the above collection. In the interest of full disclosure, if I get a hold of this datasheet, adding it to the above FTP archive may be all that I will ever do with it: even if I had the datasheet, I do not currently have any realistic plans of adding Silabs Aero RF support to FreeCalypso, let alone to OBB. I do have a couple of Motorola W220 phones on their way to me from ebay, and hopefully at least one of them will actually make it to me, unlike the first one that appears to have fallen into a black hole somewhere, but even with ideal documentation (full schematics and chip datasheets), adding support for a very different RF subsystem (in particular, Silabs' way of doing AGC is entirely different from TI's way) would require more systems engineering work than I can do at the moment. It also doesn't help that the only tpudrv12.c reference TPU driver we have is a reconstructed source made from the disassembly of tpudrv12.obj, not TI's original source - thus all quarter-bit timing numbers (there are lots of them, and they are very critical) are just "magic" numbers, and their original derivation has been lost - does not bode well for the task of figuring out what the corresponding timings should be for a different RF transceiver. All that being said, however, this Si4210 transceiver does look like an attractive alternative to TI's Rita: the Si4210 is 5x5 mm compared to TI's 7x7 mm (every square mm counts in a tightly squeezed modem module), and it has 4 separate LNA inputs for the 4 GSM bands, to be contrasted with Rita and Aero+ arrangement of 3 LNA inputs, one of which is shared between EGSM and GSM850. The Si4210 way with 4 separate LNA inputs allows a fully quadband MS to be implemented in a much more straightforward way. Thus tracking down a datasheet for this Silabs Aero II transceiver and adding it to the knowledge base should be a good step for the GSM enthusiast community as a whole. I already tried asking Silabs for the datasheet, and got the answer that the product line in question was sold to NXP back in 2007. Reading up on Wikipedia, it appears that this stuff did not stay long with NXP either, transferred first to ST-NXP Wireless and then to ST-Ericsson, and when the latter closed, it is totally unclear where the Silabs Aero stuff went, other than the great bit bucket in the sky. :-( M~

1 1

Free board offer to OBB developer with a CMU200
by Mychaela Falconia 09 Apr '19

09 Apr '19

Hello again OBB folks, In light of my discovery two days ago through CMU200 testing that current OBB on all Calypso devices (with or without my OS#3582 patch) produces grossly incorrect (spec-violating) radio transmissions, I am making the following offer to your gang in the case that any of you are interested in doing the work to fix your software and bring its radio transmissions into compliance. The offer is: if there is anyone in this so-called "community" who (a) has a CMU200 instrument or is willing to invest into buying one and getting it properly calibrated, and (b) is willing to do the major work of bringing OBB's radio transmissions into compliance as verified with that CMU200 instrument, then I am willing to send that person a fully tested, fully working and properly calibrated FCDEV3B GSM MS board free of cost. To recap, the areas in which OBB's radio transmissions were found to be non-compliant in my CMU200 tests last Saturday are as follows: 1) At least in the test scenario when the CMU200 instrument acting as a BTS makes a call to the connected MS, OBB's implementation of GSM MS transmits at each band's maximum power level instead of the lower power level commanded by the CMU acting as the BTS. 2) When the CMU200 commands the connected MS to change its Tx power level, OBB's implementation of GSM MS does not act on these commands. 3) Even when the MS Tx power level is set to each band's maximum on the CMU200 before initiating the call to the MS and not changed afterward, the power ramp put out by OBB is flagged by the CMU as being out of tolerance - despite the OS#3582 patch which makes OBB use the same Tx ramp template bits as the official FreeCalypso and Motorola firmwares (I tested on both hw platforms), or FreeCalypso fw on Motorola's hw, all of which produce perfectly compliant power ramps as deemed by the CMU200. 4) Without the OS#3582 patch, not only the power ramp but also the power level itself is out of tolerance. I do not see how anyone could address these defects without having their own CMU200 instrument so they can reproduce the problem first, and see the same thing I am seeing, which is why I am limiting my FCDEV3B offer only to those who have a CMU200 or are willing to invest in one. Furthermore, I also know from first-hand experience that many CMU200 units that sell on ebay for cheap may be defective in very subtle and non-obvious ways, or may have been subjected to repairs or repair attempts in less than fully diligent ways. Therefore, unless you bought your CMU200 from a high-end seller who sells it with a recent calibration certificate and with all case seals from the calibration lab intact, the only way to know for sure if the instrument's measurements are trustworthy is to send it to your nearest Rohde&Schwarz office for calibration, which costs about $1400 at least at the Columbia, Maryland (USA) office, which is where I had mine calibrated. For the above reasons, I further limit my free-of-cost FCDEV3B offer to those who not just own a CMU200 instrument in some unknown condition, but are also able to present a recent calibration certificate for it. (And don't even think about faking one, as I know what real ones look like - I got my own.) You will also need to have an N-to-SMA RF cable with precisely known insertion loss at GSM frequencies (at the center frequency of each uplink and downlink band, 8 frequencies in total), i.e., you need to demonstrate sufficient RF knowledge to compute a good estimate for these insertion loss numbers if you don't have access to a VNA to measure them directly. (In case it isn't already obvious, let me spell it out: producing your own GSM MS implementation that is safe to use on public airwaves does require spending a non-trivial amount of money on proper test equipment.) If you have the necessary test equipment as above and are interested in getting a free-of-cost FCDEV3B, you will need to further agree to do the following upon receiving the board: 1) Connect the FCDEV3B to your CMU200 while the board still runs its official FreeCalypso fw, and confirm with your own eyes and your own CMU200 that all RF transmissions put out by the FreeCalypso hw+fw combo satisfy all of the compliance tests. 2) Run OBB on the same FCDEV3B still connected to your CMU200, and confirm with your own eyes and your own CMU200 that OBB's transmissions exhibit the same problems which I see in my test setup. 3) Work toward bringing OBB's RF transmissions into compliance as seen by the CMU200, i.e., toward being like what the official FreeCalypso fw puts out. The tests performed by the CMU200 are the exact same ones which are performed by official certification labs on candidate GSM MS devices submitted for type approval testing; I don't know exactly what equipment those labs use, but I wouldn't be surprised if it is the very same CMU200 at least for the low-level tests, plus something else (a real BTS maybe) for higher-level GSM L3 protocol tests. Aside from the just-detailed offer of a free-of-cost board to whoever is willing to do the above work and has the necessary setup, I am now restricting sales of FCDEV3B hardware to OBB users. If anyone is interested in buying an FCDEV3B for the purpose of running OBB on it, I will only sell it to you if you can demonstrate that you have one of the following 3 acceptable setups: Option 1: a CMU200 or some other instrument acting as a base station simulator; Option 2: your own BTS plus all of the numerous pieces which are required in order to connect an MS directly to a BTS with a cabled setup without any radiated transmissions; Option 3: your own BTS plus a solid RF-blocking enclosure (reliably blocking any leakage) that is big enough to fit both your BTS and your MS. If I were to sell a board to an OBB user who does not have any of the above, then I would be helping facilitate willful interference and disruption of public radio communication networks, and could potentially be held liable for whatever damage you will cause by letting OBB transmit on GSM frequencies in open air, so nope, sorry, won't do. And finally let me pre-emptively address one very likely response: if someone says "why don't you, Mychaela, do the work of bringing OBB's radio transmissions into compliance and contribute code patches, given that you already have all of the needed high-end test equipment", my answer is that this work can only be done by someone who believes that investing effort into further development of OsmocomBB is the right thing to do, which is a position I disagree with - instead I believe that OBB (or at least OBB on Calypso, no opinion regarding OBB on SDR or the floating-around vaporware idea of OBB on MTK) should be deprecated from use and retired to the dustbin of history as a failed project that may have been interesting and may have had some merit at one time, but is now completely pointless. Sincerely, Mychaela Falconia, Mother of FreeCalypso www.freecalypso.org

6 11

Re: OBB does not work against CMU200 BTS simulator
by craig 10 Mar '19

10 Mar '19

Oops, I accidentally replied to Mychaela directly, here's our conversation so far, please others join in with thoughts. On Sun, Mar 10, 2019 at 09:09:31AM -0800, Mychaela Falconia wrote: > Hi Craig, > > > Thanks again for your details Mychaela. I will read this very carefully > > and keep it in mind as I try to port osmocom-bb to fernvale/mediatek. > > I already expect a good dose of refactoring in layer1 so maybe I will touch > > on fixing the issue. > > Have you got yourself a CMU200 instrument or not yet? A CMU200 is > absolutely required if you wish to have any chance of success at your > idea of OBB on MTK. I do have a Racal Instruments 6103E GSM Digital Radio Test Set which seems to work well so far. I have tested some SIM800 modules (mtk6261) with the internal BTS. Not sure if that will fall short or not but I'll take things one step at a time. When I need a CMU200 I'll probably get one. :) > Another question: is there any way to run any official MTK-based > firmware, however non-free and blob-laden it may be, on Fernvale hw? Probably. I know from reading that Bunnie and Xobs who designed fernvale did run standard firmware/OS on some similar 6260 based devices. Maybe we could track down a good firmware and test on fernvale. For what it's worth the fernvale isn't exactly my main target. I would much rather use a SIM800 module or eventually design of my own. > Has anyone actually done it and posted howto instructions? If not, > then how do you know if the RF hw on your Fernvale kit is actually any > good and not physically defective? Whoever physically manufactured > those Fernvale boards sold by Sysmocom, have they actually tested > their RF hw and how? And what about calibration - have they performed > individual per-unit calibration of various RF parameters on those > Fernvale kits like every standard GSM MS hardware manufacturer is > required to? I don't have any clue about these details. Will have to rely on Harald or maybe inquire of Bunnie and Xobs. > I calibrate my FCDEV3B boards at production time, use > the calibration procedure to also serve as a test of the RF tract, and > ship every unit with turnkey-working official firmware and a fully > valid and legitimate IMEI, fully fit for operation as an MS on public > GSM networks - do they do likewise or not? If not, then they are > substandard. > > M~ Thanks for your efforts, Craig

2 1

OBB does not work against CMU200 BTS simulator
by Mychaela Falconia 10 Mar '19

10 Mar '19

Hello OsmocomBB gang, Earlier today I was trying to run OBB against my CMU200 GSM MS RF tester, with the objective of trying to determine if the change currently stalled in OS#3582 (switching the Tx APC code in OBB from the original to my modified version that uses the same numbers as each target's respective original fw, i.e., Compal's numbers on Mot C1xx or FreeCalypso numbers on the FCDEV3B) makes things better or worse on OBB's primary compal_e88 platform (Mot C118). Running OBB with Tx enabled on a Motorola phone that has its internal antenna connection fully intact is not only illegal (transmitting in the tightly regulated GSM bands from an unlicensed device) but actually dangerous and harmful: as my CMU200 experiments have confirmed, OBB's transmissions are so wildly out of spec that the risk of causing *actual* interference and disruption to cellular networks is very real. While I don't give a damn about silly laws that declare perfectly safe and harmless things to be illegal, I do very much care about not disrupting cellular networks which people actually use for important communication, including safety-of-life communication, hence letting OBB transmit on real live airwaves is a big no-no. Instead the *only* safe way to run a Tx-enabled build of OBB layer1 on a Mot C1xx or SE J100 phone is to insert an RF cable terminated with an appropriate probe adapter into the RF test port on the back of the phone, and connect this cable to your own test BTS or to a specialized GSM MS RF tester like R&S CMU200. Pull out the rubber plug that keeps dust out, and insert the appropriate adapter. I use a Hirose MS-147-HRMJ-1 adapter for old-style MS-147 RF test ports on C118 and C155/156 phones, and a Murata MXHS83QH3000 adapter for the newer style of RF test ports found on Mot C139/140, SE J100, Openmoko, Pirelli and most newer phones. Both adapters are from Digi-Key, and both are still readily and cheaply available there. Both adapters convert the RF test port to SMA, and unlike the other SMA to MS-147 pigtail sold by Sysmocom, neither of my adapters requires any disassembly of the phone case - just pull out the rubber plug. The critical point here is that when you insert a probe into that RF test port under the rubber cover, the internal antenna is disconnected. Because I do not currently have my own sysmoBTS (at least not yet, may be able to afford one in another couple of months) and I have no interest in messing with SDR devices or trying to make a poor man's BTS out of one, the only thing to which I can connect GSM MS devices under test is my R&S CMU200 instrument. This instrument is generally considered to be the gold standard in the mainstream professional (non-FOSS) GSM industry, and I use it all the time to test not only my own FreeCalypso devices, but also various pre-existing ones, and they don't have to be TI-based or have hackable firmware. The CMU200 does have a so-called non-signalling mode that allows low-level Rx and Tx operations to be tested directly, and this mode of operation does require GSM MS firmware with special RF test modes that bypass all higher layers of the protocol stack - but the CMU200 instrument also has a "signalling" mode in which it acts as a standard BTS, allowing any MS to be tested as a black box. This signalling mode of the CMU200 works with every GSM MS in my experience (with FreeCalypso, with Motorola's original fw on all C1xx phones, and with various other phones with completely unknown chipsets and firmware architectures) with the exception of OBB. At first I had no success with getting OBB to play nice with the CMU200 at all: I would turn on the simulated BTS downlink signal on the CMU, run OBB's mobile app, and it would register to the test network - but as soon as I press the "Connect mobile" (call to MS) button on the CMU, everything would go haywire. However, after a lot of trial and error I figured out where at least some of the breakage is happening: 1) In order for the "call to MS" operation to succeed, the MS Tx power level setting on the CMU200 (i.e., the power level which the CMU acting as a BTS directs the MS to transmit at) must be set to each band's respective maximum (PCL 5 for low bands or PCL 0 for high bands), which is not the default setting. If one tries to make a call-to-MS from the CMU with the MS Tx power level set to something lower, it works just fine with every type-approved or would-pass-approval-if-someone- paid-for-it GSM MS including FreeCalypso and Mot original fw, but if one tries the same thing with OBB, a message pops up on the CMU200 screen saying "Overload at connector RF2", mobile's vty window says "% Call has been released", and everything breaks from there onward. At first I was totally bewildered as to how CMU200's input could possibly be overloaded when the RF2 port in question is rated for 33 dBm continuous power, the PA on my FCDEV3B or on Mot C1xx phones cannot put out anything more than 30 dBm in the DCS/PCS high bands, and my cable has about 2.2 dB of attenuation which I account for in my calibration and test procedures - an overload sounds physically impossible in this setup. But then I realized what is happening: because the CMU200 expects the MS to transmit at the power level instructed by the CMU acting as the BTS, the instrument software configures its sophisticated Rx chain for optimal reception at power levels around that target. What appears to be happening with OBB as the MS is that OBB does not implement Tx power control correctly, and transmits at the maximum power level even when the BTS told it to transmit at some much lower level. The CMU does not expect such gross misbehaviour from candidate MS devices submitted for type approval testing, and some stage in the configured Rx chain gets overloaded. Next experiment: I established a call between OBB and the CMU200 by setting the MS Tx power level knob to the maximum for the band I am testing in, and then tried changing it within the active call, i.e., had the CMU acting as the BTS command the MS to change its Tx power level while staying in dedicated mode. I am not sure if this signalling happens over FACCH or SACCH, but once again it works without a hitch with every type-approved or would-pass-approval phone I have available for testing, and I use this method all the time to verify the complete range of Tx power levels on the MS under test. Not so with OBB: I don't remember the exact error message displayed by the CMU200, but it was something along the lines of the MS failing to act on the Tx power level change command, and then it would drop the call. So apparently OBB fails to implement this aspect of the spec as well. So what about the OS#3582 change? Does it make things better or worse? Answer: I was unable to test it because the other show-stopping defects in OBB's GSM MS implementation prevent me from getting that far. The combination of the two bugs above (no ability to establish the call unless the MS Tx power level is set to max, and no ability to change the power level within the test call) makes it impossible to step through the power levels and see what the mobile puts out at each PCL, hence no ability to test the change. There also appears to be something wrong with OBB's timing of various steps involved in burst transmission, i.e., Calypso TPU programming. I say so because even if I stay at the band's maximum power level (don't try to change it), the CMU200 reports the power ramp as being out of tolerance, even with my OS#3582 patch which makes the actual ramp programming exactly the same as what each device's official fw uses to produce perfectly passing ramps - so it is probably something to do with timing. OK, so why did I produce this OS#3582 patch if it doesn't make things any better in practice because of other major bugs elsewhere? The answer is that it was my knee-jerk reaction to seeing hard-coded numbers for Tx power levels and ramps and for the VCXO slope that are completely and obviously wrong for Openmoko/FCDEV3B hardware. The hard-coded Tx power level and VCXO slope numbers in the current OBB master are approximately correct (at least within the ballpark of correctness) for Mot C11x/12x/155/156, but are NOT correct even for Mot C139/140 (different PA with different characteristics), and are wildly off-base for the completely different Openmoko/FCDEV3B RF hw - someone claimed Openmoko gta0x as "supported" all those years ago without anyone doing any real tests on that platform, and without noticing the utter bogosity. What was happening is that people were asking about running OBB on FCDEV3B hardware, I was trying to support those people in the hope that they would buy the hardware at the fair commercial price (which hasn't happened), it was obvious to me from a very cursory glance at the code that the stuff in current master has exactly zero chance of working anywhere close to correctly on my hw given those totally wrong hard-coded numbers, so I felt that at that very minimum, I had to fix those bogus numbers. Trying to fix just the numbers while keeping the architecture of the code that uses them was also a non-starter (more utter bogosity like trying to use GSM900 band APC numbers for all bands), so I did the only thing that seemed sensible: ripped that gunk out and replaced it with Tx parameter tables in the chip vendor's original format, filled with bits read from factory RF calibration records. But as today's experiments show, it was pretty much for nothing: while you do need to apply this patch if you wish to have any chance of ever putting out spec-compliant radio transmissions, it is nowhere close to being sufficient. The *only* way how OBB would ever reach a point of being safe to use as a GSM MS on live airwaves and being able to seriously compete with properly functioning, spec-compliant GSM MS products like FreeCalypso or Qualcomm/MTK/etc phones running their respective official fw would be if someone were to invest many, many person-years into it, and also invest their own money into appropriate test equipment - a CMU200 or equivalent is an absolute must, otherwise you have no way of knowing what your MS really puts out. And I will *not* *ever* be that person who invests her time and energy into whipping OBB into something that could kinda-sorta approach what MTK, Spreadtrum and FreeCalypso (have I missed any other GSM chipset vendors? I don't count Qualcomm as they hate GSM and give it the "unwanted bastard child" level of support) already provide today, with at least one of the listed vendors freely publishing their full source code. Meanwhile, the takeaway lesson is that running current OBB with Tx enabled on a Motorola phone without disconnecting its internal antenna is NOT safe, and the danger of interference to GSM or other cellular networks is way too high. People on this list swear up and down that no one uses OBB as a phone, instead people who call themselves "researchers" supposedly use it in their test setups somehow. But how exactly? I somehow doubt that most of you so-called "researchers" have expensive Faraday cages or go to the trouble of a fully cabled setup (lots of extra components required: duplexer, attenuators, multiple cables, adapters for connecting to RF test ports on phones) with no radiated transmissions. It seems far more likely to me that most of you so-called "researchers" probably operate your SDR-acting- as-a-BTS in open air, with the downlink signal power level set low enough so you don't get caught despite having no actual license, and your OBB phone transmits back to your home-grown BTS via open air. What I am here to tell you is that doing the above is NOT as safe as you think: if OBB is transmitting at the maximum power level the phone can put out, which is 2 W in the GSM900 band, if the power control is not working (OBB does not lower its Tx power when the BTS tells it to) and the power ramp is wrong for whatever reason (the CMU200 shows it as being out of tolerance), then only Cthulhu knows what kind of interference you may be putting out. My greatest hope is that some day more people will see the light and do the right thing: retire OBB to the dustbin of history as a project that may have been interesting once upon a time but is absolutely NOT worth doing any more work on in the present reality, and redirect their forces to more productive efforts. I am convinced that it would take far less work to reimplement the researcher-oriented functionality of OBB on top of the rock-solid FreeCalypso code base than to bring OBB to a point of being able to compete on technical merit. M~

1 0

Google Summer of Code 2019
by Vadim Yanitskiy 26 Feb '19

26 Feb '19

Dear Osmocom community, starting from 16th of January (until 7th of February) we can apply Google Summer of Code as an Open source mentor organization. Many well-known projects, such as Debian, FFmpeg, Apache, Git, GCC, GNURadio and others, have been participating last year. Personally, I think it's a great opportunity to move some of our projects forward. I would like to know your opinions about this idea, should we participate? I would be happy to be a mentor. With best regards, Vadim Yanitskiy.

3 3

Scaling up virtual bts tests for the BTS test - how I hold it wrong?
by Holger Freyther 22 Jan '19

22 Jan '19

After a lot of work[1] the gsm tester can finally: * Start a virtual bts * Mobile/virtphy processes * Complete LUs for 10 MS. The next step (besides having a proper test verdict) is scaling this beyond what a simple physical set-up can provide. Let's go to 100+ BTS and 10k subscribers but somehow I am still holding it wrongly and would like to have feedback to see how to evolve the gsm tester. What do I need to change to scale this up and how to externally parameterize it? * suite.conf: Add one line per virtual bts to reserve (I would prefer to specify type+num) * resources.prod.conf: Add more Virtual BTS. I started to pick IPs from 127.0.1.0/24 as it avoids having to configure special IPs. * register_default_mass.py: I need to somehow know how many BTS (and NITBs) were reserved. Or in the long run the topology of how to connect M BTS to N BSCs? Currently I can run until I get an exception but that is not desirable. What's missing: * High-level API of the SuiteRun to get me the toplogy of the network. It seems undesirable in the specific suite to discover how many BTSs were reserved in suite.conf or what the topology is. * ARFCN usage. Besides the redundancy all my BTS currently have the same ARFCN. There should be an easy way to configure an band+arfcn pool. * IMSI/MSISDN pooling. I would like to specify pools of IMSI/MSISDN pairs (and size) and then draw from it. I needs these to program into the mobile, NITB/HLR/AuC and for client to client SMS transfers. * Configure these capacities from the outside. Changing from 1 to 256 BTS should be a single line (or even a parameter change). Any idea or comment on how to achieve this? cheers holger [1] Hindsight is 20/20 and the difficulty was not adding scripting to mobile but getting the GSM tester to spawn the network and we are unfortunately not done yet.

2 5

Re: I have a problem compiling osmocombb in Ubuntu 14.04
by Vadim Yanitskiy 21 Jan '19

21 Jan '19

> It is the same version of libosmocore that comes with osmocombb. https://osmocom.org/projects/baseband/wiki/Software_Getting_Started#Depende… > For osmocomBB, as for several other osmocom projects, you will also need libosmocore. > Note: Although libosmocore is included when getting osmocom-bb from the git repository, > you have to install it separately. The libosmocore subtree is only used to compile the > embedded ARM version of libosmocore. With best regards, Vadim Yanitskiy.

2 5

I have a problem compiling osmocombb in Ubuntu 14.04
by Andi Kita 21 Jan '19

21 Jan '19

sched_clck.o: In function `sched_clck_tick': /home/imsicatcher/osmocom-bb/src/host/trxcon/sched_clck.c:64: undefined reference to `osmo_clock_gettime' sched_clck.o: In function `sched_clck_handle': /home/imsicatcher/osmocom-bb/src/host/trxcon/sched_clck.c:123: undefined reference to `osmo_clock_gettime' Any help is appreciated. Thank you

2 1

Fwd: OSMOCOM-BB HandOver
by Muhammad Awais Aslam 12 Jan '19

12 Jan '19

Hi, We have been working on the handover feature in OsmocomBB and have managed to make some progress including SB/BSIC detection in dedicated mode which was not previously being successfully done in firmware. I wanted to share it and seek guidance on the last bit of handover implementation on which we are stuck. I hope someone would be able to help us or make use of our work. We took code related to handover from the osmocom-bb jolly branch by manually adding/deleting stuff in the master branch as updating to the latest copy was giving us issues. We added code from the “Safely change TPU offset on TS change or sync change” commit till the “Use only sel_si for information about the current cell” commit. Using the handover code in the jolly branch and after making the changes explained below we were able to obtain the handover command from the BTS. The synchronized handover case works sometimes though still not every time, however the non-synchronized case doesn't work at all as we are not able to get the physical information command from the new cell. I'll explain the changes/additions we made to achieve this. Firstly, we noted that in dedicated mode SB burst was not being detected. Changes were required at three main places in order to correctly perform FB/SB detection: - It was seen that the results for SB were being read from DSP API location dsp_api.db_r->a_sch which is for the idle mode. The results had to be read from the dsp_api.ndb->a_sch26 location for the dedicated case if TCH_SB_DSP_TASK is used. - After reading the FB we needed to update the quarter-bit offset of the TPU using the TOA of the FB to sync it with the start of frame of the neighbour cell in order to catch the SB (by changing the vaule of l1s.tpu_offset using the TOA of the FB). - Frequency compensation needed to be performed using the afc_correct function before reading the SB. * We actually kind of cheated a bit by adding 3 frames to the original idle frame in order to give us more time to perform FB/SB detection including the synchronizations mentioned above. This was because we weren't that proficient with the code and someone with more understanding could do this better. The call did not get dropped. We used the initial added “idle” frame to perform the quarter-bit and frequency compensation which was reversed in the idle frame with the response function to tune back to the serving cell. These things, when added to the code did the trick and BSIC of the neighbours was obtained. Once the BSICs were decoded the measurement report sent to the BTS became meaningful and the handover command was received. Upon receiving handover command, access bursts needed to be sent on the new channel which again was not currently being implemented properly as in order to tune to the new cell we needed to know its quarter-bit offset for start of frame, frequency compensation and absolute frame number which were not previously being obtained. Now that we were able to detect FB and SB these values were stored for the neighbours following detection of these bursts and were used to tune to a neighbour cell in case of a handover to it before the sending of access bursts. However, here is where we are stuck. We were expecting a physical information message following the access bursts but were not able to receive it due to which the handover failed. If only that could be achieved we believe handover should be successful. Either we are not syncing properly to the new cell or we might not be following GSM protocol properly. We also might not be reading the FACCH properly for physical information message after tuning to the new cell as we couldn't really understand that bit very well. We wanted someone expertise on this matter and were hoping our work could be of use. We were more interested in getting the work done first up. Best Regards, M. Awais Aslam

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

baseband-devel