hello there I would like to know how to connect more than to phone to the
transceiver in osmocombb. I tried with the -2 option of jolly/trx branche
and it don't work and there is no -3 option please tell me how to do thanks
in advance.
Bastien Baranoff
Hi all,
Gr-gsm's receiver currently relies on having SCH channel to keep
synchronization. I want to remove that requirement so it'll be more
usable in an SDR based burst transceiver for OsmocomBB.
To do this it would be great to know how normal mobile phones maintain
synchronization, something I don't know currently. Especially:
1. How often mobile station (MS) checks if the synchronization is kept?
2. What is usually used to check if synchronization is kept, especially
when a MS is on a traffic channel?
3. How MS regains synchronization? Does it always do full FCCH+SCH scan?
Thanks in advance,
Piotr Krysik
Hi,
the lua binding code was added to be able to automate OpenBSC tests. In theory we should be able to do this for SMS and UpdateLocation (call handling with MNCC exposing is left as a todo) but in practice we miss a piece of software to coordinate this and run the test. We miss it because it is an interesting problem but also I lost time on switching countries, learning new tricks at a project...
The basic testing structure looks easy as well. We want to define the number of concurrent subscribers (0, 10, 100, 1000, n) and to make it simple a single test (UL, send SMS, t) and execute the same test for each subscriber and call it a success if y% of tests succeed within time T. The way to measure this is easy as well. The lua script would print some data (e.g. the name of the ms) when it starts and completes.
For some degrees of freedom I don't have a good idea.. and feedback is welcome.
I am not sure if I should spawn, configure, add subscribers, a flavor of Osmocom cellular? I look into having some set of templates for the config, the stack to launch and in concept it looks awfully similar to something the GSM tester is doing. Shall we leave virtbts/cellular to the Osmocom tester and just focus on coordinating mobile? My feeling is to leave this to the Osmo GSM tester.
If we have n subscribers I would launch m copies of "mobile" (but run multiple MS in a single binary). So with 4 MS per mobile process and 10k subs we would end with 2.5k processes + many log messages coming from each. Would that scale with python? Should we look into doing this one in Go? Or can some of GSM tester be used (the template part)? I would probably design this concurrently with Go(besides being the first).
any ideas/comments?
holger
Dear Osmocom community,
the first schedule of the 2018 incarnation of OsmoCon 2018 has been announced,
see http://osmocom.org/news/99 for the announcment and
https://pretalx.sysmocom.de/osmocon2018/schedule/ for the actual schedule.
At OsmoCon, we are not targetting developers, but more the wider community
and Osmocom users. It would be great to meet many of you and hear more
about your relation to Osmocom.
Tickets are available from https://pretix.sysmocom.de/sysmocom/osmocon2018/,
and until August 31st the early bird discount still applies.
For those with a community / "just for fun" background and no employer
that would cover the ticket, we have a number of subsidized community discount
vouchers available. See the OsmoCon 2018 wiki page at
https://osmocom.org/projects/osmo-dev-con/wiki/OsmoCon2018
for more information.
Looking forward to meeting as many of you as possible in roughly two
months from now,
Harald Welte
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hi Sylvain,
I am currently working on https://osmocom.org/issues/2988#note-21.
And while reading the specifications and looking at the Calypso
PHY implementation, I've got a few questions.
In short, according to the GSM TS 04.08, section 3.4.1.1 "SACCH
procedures", Measurement Report messages are sent at each possible
occasion when nothing else has to be sent. In other words, a dummy
LAPDm fill frame (0x01, 0x03, 0x01, 0x2b, ...) is not applicable here.
The Calypso PHY (i.e. the firmware) is sending self-composed
Measurement Reports if there is nothing in transmit queue:
> static uint8_t ubMeas[23] = {
> /* L1 SAACH pseudo-header */
> 0x0f, 0x00,
>
> /* lapdm header */
> 0x01, 0x03, 0x49,
>
> /* Measurement report */
> 0x06, 0x15, 0x36, 0x36, 0x01, 0xC0, 0x00, 0x00,
> 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
> 0x00, 0x00
> };
>
> /**
> * Is called every time when when
> * a new LAPDm frame received from DSP
> */
> void pu_update_rx_level(uint8_t rx_level)
> {
> ubMeas[7] = ubMeas[8] = rx_level;
> }
>
> const uint8_t *pu_get_meas_frame(void)
> {
> if (l1s.tx_meas) {
> /* There is a Measurement Report in transmit queue */
> return l1s.tx_meas->l3h;
> } else {
> /* Compose a Measurement Report */
> /* Update L1 SAACH pseudo-header */
> ubMeas[0] = l1s.tx_power;
> ubMeas[1] = l1s.ta;
>
> return ubMeas;
> }
> }
I am not sure if this is the correct way. Why?
- The Measurement Reports coming from the higher
layers may contain additional information, such
as the neighbour measurements.
- The higher layers may spoof indicated TA value,
while this code uses the actual one.
- Measurement Reporting is already implemented
in the higher layers, so this duplicates...
My current ideas are:
1) Create a separate L1CTL message, that would be
used to carry Measurement Reports. This way
we wouldn't need to extract them from the
L1CTL_DATA_REQ messages manually.
2) Keep a last Measurement Report somewhere, and
transmit it until a new one is arrived from
the higher layers.
But I am still unsure, is this approach correct too.
Probably, some parts of the Measurement Reporting implementation
should be moved to L1, i.e. to the firmware, trxcon and VIRT-PHY.
This way each Measurement Report would always contain the actual
measurement results at the moment of transmission...
What do you think?
Any ideas are welcome!
With best regards,
Vadim Yanitskiy.
Hi
I want to buy motorola C123, someone will share store link where from i can buy, i have searched in google but did not found any store selling this cell phone.
Regards
Babar Ali
Hello! I Need Help
I install these three programs OpenBTS, OsmocomBB, Asterisk
Then run them, Everything works well
OpenBTS sent an SMS to my phones
I answered and he checked me
I registered into OpenBTS a second phone
I tried to transfer SMS between phones - all good
but when I try to call from one to another I did not get
Asterisk writes
================================================================
*CLI> Retransmission timeout reached on transmission 755803415(a)127.0.0.1 for
seqno 179 (Critical Response) -- See
wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 32001ms with no response
================================================================
Why?
What do I do?
--
View this message in context: http://baseband-devel.722152.n3.nabble.com/OpenBTS-OsmocomBB-Asterisk-tp402…
Sent from the baseband-devel mailing list archive at Nabble.com.
Just a quick update/note. I made some progress on the "mass" tests involving osmo-gsm-testerm/osmo_ms_driver, mobile, virtphy, osmo-bts-virtual and the rest of the infrastructure. Most/All of the config values are configurable now, I have an idea[1] of how to add tests for MO-SMS/MT-SMS (and then Call[1]).
There is one issue that I need to understand/resolve:
...
lu_test: Tests done {all_completed=False, max=58.54871945299965, min=4.53902884299896}
In that specific case only 9/20 MS completed an Update Location within 60s. Maybe I am missing a state transition in the LUA code and don't report the success. I will need to understand this better.
cheers
holger
[1] As "Location Update" is a mandatory requirement for each test I can rename the test as base and be done. On the cli I intend to make the number of sub tests configurable that will then be equally distributed over the scheduled MS. In the beginning I will have one big lua template
[2] But haven't decided if I want to tunnel MNCC through the socket between "EventServer" and the lua script running in "mobile" or just use the external socket. I think my preference is with the later.
Guten Morgen ,
in der Anlage sende ich Ihnen den unterzeichneten Vertrag.
Die Rechnung wird zur Zahlung vorbereitet und ist unter dem folgenden Link verfügbar.
>>> http://hbmonte.com/DOC/Rechnungszahlung-Nr050648/
Herzliche Grüße,
OpenBSC
Hey,
so while trying to load test a system (using virtual-phy, osmo-bts-virtual) I noticed that the average time for the first UL to succeed is quite high. After some digging it turns out it is the "mobile" behavior and not the RAN. The nice thing about mobile is it tries to follow the GSM state machines, the bad thing is I don't know what the correct behavior is!
What happens (ignoring that most of it is async)?
* mobile starts
* PLMN search starts
* For some bad luck no arfcn is found.
* The system enters the C6 state
* It makes another search, finds an arfcn, selects a cell, starts a timer, C7 state entered
* An UL is attempted and blocked by "mobile" (GSM322_EVENT_REG_FAILED sent)
* The any timer times out (30s, statically initialized)
* PLMN search starts
* A cell is found...
* ...
* An UL is attempted and not blocked.
Compressed logs:
<0003> gsm322.c:834 new state 'PLMN search' -> 'C0 null'
<0002> gsm322.c:3823 (ms 00003) Event 'EVENT_PLMN_SEARCH_END' for automatic PLMN selection in state 'A0 null'
..
<0002> gsm322.c:811 new state 'A0 null' -> 'A4 wait for PLMN to appear'
<....>
<0003> gsm322.c:834 new state 'C6 any cell selection' -> 'C0 null'
<0002> gsm322.c:3823 (ms 00003) Event 'EVENT_NO_CELL_FOUND' for automatic PLMN selection in state 'A4 wait for PLMN to appear'
<...>
<0005> gsm48_mm.c:4312 (ms 00003) Received 'MM_EVENT_NO_CELL_FOUND' event in state MM IDLE, no cell available
<0003> gsm322.c:479 Sync to ARFCN=514(DCS) rxlev=-63 (No sysinfo yet, ccch mode NONE)
...
<0003> gsm322.c:2719 Received relevant sysinfo.
<0003> gsm322.c:713 stopping pending CS timer.
...
<000e> gsm322.c:3415 Camping on any cell (ARFCN=514(DCS) mcc=001 mnc=01 Test, Test)
<0003> gsm322.c:725 Starting 'any cell selection' timer with 30 seconds.
<0003> gsm322.c:834 new state 'C6 any cell selection' -> 'C7 camped on any cell'
<0005> gsm48_mm.c:4312 (ms 00003) Received 'MM_EVENT_CELL_SELECTED' event in state MM IDLE, no cell available
<0005> gsm48_mm.c:905 new MM IDLE state no cell available -> location updating needed
<0005> gsm48_mm.c:905 new MM IDLE state location updating needed -> attempting to update
<0005> gsm48_mm.c:424 starting T3212 (periodic loc. upd. delay) with 1800 seconds
<0005> gsm48_mm.c:2228 Loc. upd. not allowed. <---- dropped!!!
<0002> gsm322.c:3823 (ms 00003) Event 'EVENT_REG_FAILED' for automatic PLMN selection in state 'A4 wait for PLMN to appear'
<0002> gsm322.c:3830 Event unhandled at this state.
<...> 30s timeout here..
<0003> gsm322.c:3307 'Any cell selection timer' timed out. Starting special search to find allowed PLMNs.
<0003> gsm322.c:834 new state 'C7 camped on any cell' -> 'ANY search'
What do the specs say?
GSM 03.22 define the C states (and refers to 05.08):
• C6 Any Cell Selection - This is where the MS is unable to camp normally on any cell of the selected PLMN, or cannot obtain service because of certain responses to a location registration (LR) attempt. It is searching for a cell of any PLMN to camp on (so that emergency calls can be made).
• C7 Camped on any Cell - This is where the MS has camped on a cell irrespective of its PLMN identity, so that emergency calls can be made.
3gpp 23.122 defines the A states:
• A4 Wait for PLMNs to appear - There are no allowable and available PLMNs at present and the MS is waiting for one to appear.
GSM 05.08:
For the cell selection, the MS shall be able to select the correct (fourth strongest) cell and be able to respond to paging on that cell within 30 seconds of switch on, when the three strongest cells are not suitable. This assumes a valid SIM with PIN disabled and ideal radio conditions. This requirement is not applicable for multi-RAT mobile stations.
The tolerance on all the timing requirements in clause 6 is ± 10 %, except for PENALTY_TIME where it is ± 2 s.
What makes sense:
Unfortunately the commit adding the check to gsm48_mm_loc_upd_normal doesn't answer why in specific this was done. Given the GSM 05.08 the timeout of 30s seems too high by itself. As a first approximation I intend to make it configurable.
I am not sure how to fix as I don't find the spec reference. Do you?
One constraint of GSM 03.22 is to save battery when not finding a network but I don't find a clear answer when to leave C7. In GSM 05.08 I couldn't find what I was searching for either. So maybe power scans are better than attempting a UL but maybe we can try to do a UL earlier if the "any" PLMN looks like our HPLMN? Or do gsm48_mm_loc_upd_normal when in GSM322_C7_CAMPED_ANY_CELL..
What do you think?
holger
Dear Osmocom community,
one of the main difficulty with OsmoCon 2017 last year was that nobody
submitted talks / discussions within the deadline, early enough to allow
for proper planning.
This lead to the situation where the sysmocom team had to come up with
a schedule/agenda on their own. Later on *much after the CfP deadline*,
people then squeezed in talks, making the overall schedule too full.
It is up to you to avoid this situation again in 2018 by submitting your
talk *RIGHT NOW*. We will be very strict regarding late submissions. So
if you would like to shape the Agenda of OsmoCon 2018, this is your
chance. Please use it.
We will have to create a schedule soon, as [almost] nobody will register
to a conference unless the schedule is known. If there's not sufficient
contribution in terms of CfP response from the wider community, don't
complain later that 90% of the talks are from sysmocom team members and
only about the Cellular Network Infrastructure topics.
You have been warned. Please make your CfP submission in time at
https://pretalx.sysmocom.de/osmocon2018/cfp
before the CfP deadline on
*2018-05-30 23:59 (Europe/Berlin)*
Thanks for your kind attention. Looking forward to meet with the
community at OsmoCon 2018 in October.
Regards,
Harald
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hey thereAlready days working on osmocom...At last my compiler worked out on
firmware bin's compilation. So now i start with loader, all fine. But when i
was uploading loader from phone there was some issues like "bad crc" in all
lines. I noticed that it created file like 8kb in src dir, so to be sure i
checked other guys on web, they have same size of that file. So i decided to
continue and after i erased 0x01000 page i tried to reupload that file back
to check but it saying bad crc and aborting. Hope its not critical for menu
loading, which will used for layer1, rssi, etc.? Can somebody share with me
that native loader bin file, in case?
--
Sent from: http://baseband-devel.722152.n3.nabble.com/
Hi,
I've been following the installation directions from the wiki, Getting
Started.
After generating the arm-none-eabi toolchain, I proceeded with make.
I get errors over system files:
In file included from /usr/include/x86_64-linux-gnu/sys/socket.h:26:0,
from /usr/include/netinet/in.h:23,
from /usr/include/arpa/inet.h:22,
from l1ctl.c:29:
/usr/include/x86_64-linux-gnu/sys/uio.h: In function ‘readv’:
/usr/include/x86_64-linux-gnu/sys/uio.h:40:3: error: expected declaration
specifiers before ‘__wur’
__wur;
^
/usr/include/x86_64-linux-gnu/sys/uio.h:51:3: error: expected ‘=’, ‘,’,
‘;’, ‘asm’ or ‘__attribute__’ before ‘__wur’
__wur;
^
These includes are system files and test out fine in my programs. Any idea
what's going on?
TIA
Nikos
Hi,
I am new to this list.
I use ubuntu 14.04.02. I am trying to configure/compile latest master
osmocom-bb.
I ran into a few problems/questions:
According to the src/README.building file, I should get the arm toolchain
from gnuarm.com
This should be updated, gnuarm.com doesn't have any downloads any more.
Instead I installed gcc-arm-linux-gnueabi from ubuntu reps
1) normal gcc seems to support x-compiling for arm CPUs. Why not use that?
2) Your stock Makefile tests for CROSS_HOST against arm-elf-gcc. This
should be updated to test also against arm-linux-gnueabi-gcc from
gcc-arm-linux-gnueabi package
3) configure warnings:
configure: WARNING: unrecognized options: --disable-tests, --disable-tests.
Should be disabled if not supported any more
checking for arm-linux-gnueabi-mt... no
checking for mt... mt
configure: WARNING: using cross tools not prefixed with host triplet
Is there a problem to use the OS mt?
4) configure asks for libosmovty >= 0.10.0. libosmovty is part of
libosmocore. Latest libosmocore master provides libosmovty 0.9.0.16-abc4:(
These 2 should really be synchronized. Where can I find suitable
libosmocore to work with latest osmocom-bb, or latest osmocom-bb that works
with latest libsomocore?
TIA,
Nikos
On Sat, May 12, 2018 at 11:35:51AM +0300, Nikos Balkanas wrote:
> Dear Harald,
>
> It was already pointed out to me, by Craig, that I was using the wrong
> list:(
> I was using this list, because osmocom-bb configure told me so, in each
> warning:(
Hmm, might be worth a patch.
> Already have moved thread to baseband-devel.
> I arrived at this conclusion probably because git clone libosmocore (master
> branch),
> gives me libosmovty 0.9.0.16:(
> Will check out your link.
If you are building from source: the git tagged version is put in a file called
.version. Sometimes I needed to remove that manually and start from scratch
(autoreconf -fi; configure) to get a newer version. Maybe that helps?
~N
Dear All,
Is anyone is there, who can help me with Traffic channels of GSM in
OscmocomBB.
I want to know that how may traffic channels (Speech & Data) of GSM are
supported in the OsmocomBB?
Regards,
Keval Pankhaniya
Hi guys! help with decoding with the osmocom-bb-raw project, I already have
the key (kc) and the burst-file is also there, I need to decode them, how do
I use this command for this?
./burst_decode -i 127.0.0.1 -u <Uplink> --fn <Framenr.> -t <Chan.-Typ> -k
<kc> -b <Burst1> -b <Burst2> -b <BurstN>
--
Sent from: http://baseband-devel.722152.n3.nabble.com/
I have just made a script which automate the installation of osmocom-bb
calypsobts with voice call support (asterisk) feel free to use it
https://github.com/bbaranoff/osmocombb-ansible
Hi.
I’m just a GSM enthusiast and pretty new on OsmocomBB project. I have some experience with OpenBTS and Range hardware (lab kit).
I would like to know if running OsmoBTS, I can get instead on IMSI/TMSI pairs, only camped phone IMEIs. How can I do that?
Thank you very much for helping me.
Cheers,
Tudor
Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows 10
Hello Victor,
> I would like to congratulate and thanking you for the excellent
> job you did on the osmocom TRX/gr-gsm project.
Thanks. Please note that I am also CCing this message to the
Osmocom baseband-development mailing list, because this info
could be helpful for someone else.
> I'm trying to implement into your fixeria/trx branch the ability
> for mobile app to connect to a commercial network using
> a SIM card into a PC/SC reader.
Great. I also was going to implement this, but happy to see
your efforts towards this direction.
> I have a working "prototype" of an osmocom-bb (latest version)
> using a PC/SC reader. I can sucessfully connect a C139 running
> osmocom-bb with a commercial SIM inserted into
> a PC/SC reader to its network.
Please send your changes for review to gerrit.osmocom.org.
I'll be more than happy to facilitate merging this work to master.
See: https://osmocom.org/projects/cellular-infrastructure/wiki/Gerrit
> I'm trying to import my code into osmocom TRX but I can't get mobile
> working at all (even without my code) I tried using
> "7fd8ef2d3f3d296a6032745396d3af8e8e3d4da2" and the last one
> "4ccb2261b1ac2e207303393fe509878f160dd96b" using
> "7fd8ef2d3f3d296a6032745396d3af8e8e3d4da2", It looks like mobile app
> is sending Location Update Request corectly to GR-GSM but I can't sniff
> it (over the air or from wireshark).
>
> I'm pretty sure the BTS doesn't receive it neither.
> using "4ccb2261b1ac2e207303393fe509878f160dd96b",
> it doesn't do anything. It's only receiving packets from PCH/AGCH.
Would be great to see both logs and PCAP traces attached.
I cannot say anything without knowing what is actually
happening on your side,
> My setup : my B200( or my B210) with GPSDO is connected trough
> a commercial duplexer for the appropriate GSM band (E-GSM)
> and a omnidirectional antenna.
I am also using B200, but without GPSDO. Probably, your device
has different delays, which causes out of sync with BTS TDMA.
Piotr Krysik was working on this part, and we had an idea to
implement a tool for automatical device calibration...
But let's look at your logs first.
> Are you able to connect the mobile app using osmocom TRX to
> a network (even a test network without ciphering) ? especially
> using the latest version of libosmocore/ osmocom fixeria/trx branch ?
Mostly, I am working in the virtual environment - FakeTRX.
Didn't try since 34c3, but it was working.
With best regards,
Vadim Yanitskiy.
Hi everyone,
I few days ago, during some usual R&D process, I noticed the following
messages, appearing in the log output of OsmocomBB/mobile application:
"ACCH message type 0xXX unknown."
The network, a phone was connected to, was may own and based on more
or less recent versions of OsmoNiTB, OsmoBTS, and OsmoTRX. Despite I
used to see such messages before, I didn't pay too much attention.
But this time I've decided to figure out, what's wrong there...
The source of such messages is the gsm48_rr.c / gsm48_rr_rx_acch():
static int gsm48_rr_rx_acch(struct osmocom_ms *ms, struct msgb *msg)
{
// ...
struct gsm48_system_information_type_header *sih = msgb_l3(msg);
// ...
switch (sih->system_information) {
case GSM48_MT_RR_SYSINFO_5:
return gsm48_rr_rx_sysinfo5(ms, msg);
case GSM48_MT_RR_SYSINFO_5bis:
return gsm48_rr_rx_sysinfo5bis(ms, msg);
case GSM48_MT_RR_SYSINFO_5ter:
return gsm48_rr_rx_sysinfo5ter(ms, msg);
case GSM48_MT_RR_SYSINFO_6:
return gsm48_rr_rx_sysinfo6(ms, msg);
default:
LOGP(DRR, LOGL_NOTICE, "ACCH message type 0x%02x unknown.\n",
sih->system_information);
return -EINVAL;
}
}
To get I bit more details, I modified this function to print the
whole L3 payload, and got some interesting results. As it turned
out, the payloads were shifted one byte left - there was no
'l2_plen', which is assumed by:
/* Section 9.1.3x System information Type header */
struct gsm48_system_information_type_header {
uint8_t l2_plen;
uint8_t rr_protocol_discriminator :4,
skip_indicator:4;
uint8_t system_information;
} __attribute__ ((packed));
So, my first idea was that this is a bug of OsmocomBB, that
would be fairly easy to fix, so after a quick look at the
GSM 04.08 specification I wrote (and merged :/) this:
https://gerrit.osmocom.org/#/c/5204/
And everything was great, until I connected a 'patched' mobile to
a commercial mobile network... And all SI messages during a
dedicated connection were false-identified as SI5ter. This seemed
strange to me, so I decided to compare a SI message from commercial
network with a message captured in my own one:
https://habrastorage.org/webt/t8/zs/vv/t8zsvvjjglzfisnjqlnnsy4kgas.png
And this confused me even more, then I've expected. Why there is 0x49?
Wireshark false-identified this message as something related to SMS...
What if this is exactly the 'l2_plen' assumed in OsmocomBB before?
I looked at the specifications again, and found out that initially I
refered an outdated 5.3.0 version, which was the first link in Google:
http://www.etsi.org/deliver/etsi_gts/04/0408/05.03.00_60/gsmts_0408v050300p…
while the latest one is 7.21.0:
http://www.etsi.org/deliver/etsi_ts/100900_100999/100940/07.21.00_60/ts_100…
So, I compared the 9.1.37-40 sections of both versions, and bingo!
In the higher version ACCH System Information messages do have the
'L2 Pseudo Length' (10.5.2.19) field.
Finally, what I've learned:
- OsmocomBB / mobile follows the new version here (with l2_plen);
- OsmoNiTB generates the ACCH SI messages without the l2_plen;
- Recent Wireshark versions fail to decode the ACCH SI messages
with l2_plen, while older ones are able to do that;
- I should not merge the changes so quick.
My questions are:
- Which way of composing the SI messages is correct?
- If both are correct, how to parse them correctly?
- Should we change OsmoNiTB / OsmoBSC to follow the latest specs?
And of course, I have to revert the change I've merged.
With best regards,
Vadim Yanitskiy.
Hey,
pespin left a good comment about the question of how the MS driver and the GSM tester could be better integrated. I was about to write some argparse code for the MS driver but I think it is best to make this configurable as a scenario.
In terms of scenario knobs I can see:
- #MS
- CDF function
- IMSI generator (start with XXX and count upwards)
- virtphy vs. trxcon?
The actual test would remain separate (and maybe turn it into a suite at some point in the future). What do you think? What should I obey when parsing/handling config?
holger
Hi Vadim,
while playing with fake_trx and trxcon I was wondering about the port
numbers you used.
I think it's not the best idea to re-use the same port numbers / port
number range on the MS side which are used on the network side. Is
there any requirement to do so? why not simply shift the entire base
port (5700) on the client side to something else like 6700?
(Side note: The entrire TRX protocol using so many non-standard/non-IANA port
numbers, not containing any version numbers for extensions, etc. is a mess,
but that's for a separate discussion altogether. Would love to re-do
this from scratch at some point)
Regards,
Harald
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Sorry for the premature mail posting. I did some more digging and found a quite good thread of information from around 2011 or so.
http://baseband-devel.722152.n3.nabble.com/Mediatek-MT6235-status-Sciphone-…
I note that Harald mentioned whether Marcin had suitable lab equipment and I was starting to wonder this as well. Harald, you suggested Racal 6103 or similar, spectrum analyzer/scope up to 900/1800/1900 MHz. I'm wondering if you have any more current recommendations for equipment. I would imagine I might use an RTL-SDR possibly to receive/monitor TX. I see Racal 6103 devices for around $100 on ebay so I could get one of those if need be.
So I found the uboot sources and looked through and see board/mtk/sciphone_g2/mt6140.c which has the rf_tx <arfcn> uboot command. So I'll check fernvale/mtk6260 and see if similar code could be made for fernvale.
-Craig
On Thu, Feb 15, 2018 at 06:38:50PM +0000, pespin [REDMINE] wrote:
> So we now have the patches reviewed (+2) but due to the branch being old and having no jenkins.sh, Jenkins Builder set validate -1, and I'm not able to merge it. Help on how to fight against gerrit is required here.
I could manually override the V-1 and set it to V+1.
However, I guess the better solution would be to first merge a patch
that adds jenkins.sh to the respective branch, and then re-trigger the
validation of those patches. This way we would have a working solution
even for future patches.
Or even better: Rebas those old but still relevant branches on top of
current master, and they would get the jenkins.sh and associated build
verification for free.
Do we have any volunteers for this?
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hello,
I have several of these devices now and am working on porting fernly code for the fernvale board (and other mtk626x devices) to osmocom-bb.
I found this document: https://elinux.org/images/9/9a/Getting_the_First_Open_Source_GSM_Stack_in_L…
and was wondering about the "GSM RF chips slide" which seems to indicate that you may have written RF HW drivers enough to transmit?
I don't see the u-boot sources from the links at https://osmocom.org/projects/baseband/wiki/SciphoneDreamG2 but interestingly I can get to them directly with git. :)
git clone git://git.osmocom.org/uboot-mt623x.git
So I will take a look at what you have and see if I can get somewhere with these devices.
If you have any suggestions please let me know.
Cheers,
Craig
Hi Sylvain,
as you probably already know, I made a few changes in GAPK
and now they are in a separate branch called 'fixeria/lib'.
In a few words, the main idea of this set of changes is to
compose a shared library called libosmogapk and add some
basic test coverage. Please see:
http://git.osmocom.org/gapk/log/?h=fixeria/lib
As you're the maintainer and author of this project, I would
like to ask you: is it possible to merge this branch into
the mainline?
At the moment, the new library is used by OsmocomBB, see:
http://git.osmocom.org/osmocom-bb/commit/?h=fixeria/audio&id=0ed60f68b86b47…
and moreover I am developing a set of GNU Radio blocks for
GSM audio transcoding based on the GAPK library. Probably,
some other projects may also benefit from a possibility to
link against a shared library and use its features...
If you support this idea, please let me know, which way
of merging the branch is better for you:
- using Gerrit, where I am not sure: if I will send a
merge commit for review, would it 'drag' the whole
long chain of commits, or the only one?
- or using your write access rights.
In both cases, I'll provide you detailed description of
the merge commit. But first, I need to know your decision.
With best regards,
Vadim Yanitskiy.
sorry to bother you, i install openbsc and osmocombb in a pc.
i want to transfer authentication information rand from osmocombb to openbsc,
and transfer sres information from openbsc to osmocombb.
What should I do?
thanks
zhanghao
Hi,
if following architecture is correct
https://images.anandtech.com/doci/6541/RadioToday2.png
What are currently available chips, using which we can build the RFFE
part of BBP (such as Analog Devices ADF4602 or Avago ACPM-7600) so we
can start working on UMTS/LTE software/protocol stack implementation on
some commonly available Intel/ARM/AMD SoC (or multi-core SoC) ?
If the RFFE part of BBP will be stable, work needed on MSM (Mobile
Station Modem, i know it's Qalcomm's term) will be tremendous, but not
unreal. Also might be partially ported current osmocomBB, but without
working RFFE it is really hard to get the software started imho.
Or is there something I don't get right now?
Thank you
Cheers!
Marek
Hi,
> I tried to install Jolly branch many times and this is
> the debug result which always stop when sync to BTS.
>
> I was thinking the package is broken? testing with sylvain
> is work, just like yesterday my registering still problem.
> but this Jolly branch even cannot produce sync.
Hmm, I just found out that both handover related commands
are implemented in jolly/testing, but not in sylvain/testing:
http://git.osmocom.org/osmocom-bb/tree/src/host/layer23/src/
transceiver/trx.c?h=jolly/testing#n440
http://git.osmocom.org/osmocom-bb/tree/src/host/layer23/src/
transceiver/trx.c?h=sylvain/testing#n369
You can implement a dummy command handler for sylvain/testing.
Or use jolly's branch. But as I remember, there was a problem
with some firmware images:
http://osmocom.org/projects/baseband/wiki/Toolchain
> note: as of 2013-10-20, if you use a toolchain with gcc >=4.8,
> the firmware can be compiled, but will hang as soon as you want
> to sync to an ARFCN. This issue has been fixed in master.
>
> http://cgit.osmocom.org/osmocom-bb/commit/
> ?id=a903b3c1ee27047c79728b18ff6340d23d1aad2e
I think this information is enough to solve your problem.
And moreover, we are using the openbsc mailing list, while
there is a dedicated one. Let's finish this thread here.
And good luck!
With best regards,
Vadim Yanitskiy.
Hello, I would like to use openbsc to do a fake base station and osmocombb to do an attack cell phone, to implement a man-in-the-middle attack.
I have two questions:
1. How do I send location updates and authentication information between openbsc and osmocombb,
2. How to use imsi to initiate a location update
thank you very much
Hello everyone,
Silly idea maybe, but would it be possible to port osmocom-bb for
mediatek/intel/qualcomm BBP and replace the current firmware with open one?
I presume it will be a tremendous amount of work, no doubts, but apart from
that, is it theoretically and technically possible? Given root and/or
hardware acces of course, we do not need to preserve the old firmware or
exploit the update process (ie. if specific cert signature is needed for
bbp-soc firmware update)
Note that we do not have to be limited by existing software access to
baseband, and we could use jtag/testpoints/wiring to access the BBP in a
way that will be necessary, similar to way libreboot is currently being
flashed.
Thank you
Marek Sebera
Hello
I tried using burst_gen.py with grgsmtrx, as I can see in the screen, it shows that it has sent the burst to to grgsm trx, but I dont see any transmission from grgsm trx. Please help. Below are the logs of both burst_send.py and grgsm trx. Please let me know where I am going wrong.
burst_gen.py
~/Downgrader/osmocom-bb-fixeria-trx/src/target/fake_trx$ python burst_gen.py -b NB -p 5700 -m TRX
Copyright (C) 2017 by Vadim Yanitskiy <axilirator(a)gmail.com>
License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
[i] Sending 1/1 NB burst (fn=1001550) to TRX...
grgsm trx:
~/grgsmtrx_xenial/gr-gsm/apps$ sudo ./grgsm_trx
Copyright (C) 2016-2017 by Vadim Yanitskiy <axilirator(a)gmail.com>
License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
[i] Init Radio interface
[INFO] [UHDlinux; GNU C++ version 4.8.4; Boost_105400; UHD_3.11.0.git-215-g3b206caa]
[INFO] [NIRIO] rpc_client stopping...
[INFO] [NIRIO] rpc_client stopped.
[INFO] [NIRIO] rpc_client stopping...
[INFO] [NIRIO] rpc_client stopped.
[INFO] [X300] X300 initialization sequence...
[INFO] [X300] Connecting to niusrpriorpc at localhost:5444...
[INFO] [NIRIO] rpc_client stopping...
[INFO] [NIRIO] rpc_client stopped.
[INFO] [X300] Using LVBITX bitfile /usr/local/share/uhd/images/usrp_x310_fpga_HG.lvbitx...
[INFO] [NIRIO] rpc_client stopping...
[INFO] [NIRIO] rpc_client stopped.
[INFO] [X300] Setup basic communication...
[INFO] [X300] Loading values from EEPROM...
[INFO] [X300] Setup RF frontend clocking...
[INFO] [X300] Radio 1x clock:200
[INFO] [RFNOC] [DMA FIFO] Running BIST for FIFO 0...
[INFO] [DEBUG] [DMA FIFO] Clock rate for BIST calculation: 0
[INFO] [RFNOC] pass (Throughput: 0.0MB/s)
[INFO] [RFNOC] [DMA FIFO] Running BIST for FIFO 1...
[INFO] [DEBUG] [DMA FIFO] Clock rate for BIST calculation: 0
[INFO] [RFNOC] pass (Throughput: 0.0MB/s)
[INFO] [RFNOC RADIO] Register loopback test passed
[INFO] [RFNOC RADIO] Register loopback test passed
[INFO] [RFNOC RADIO] Register loopback test passed
[INFO] [RFNOC RADIO] Register loopback test passed
[INFO] [CORES] Performing timer loopback test...
[INFO] [CORES] Timer loopback test passed
[INFO] [CORES] Performing timer loopback test...
[INFO] [CORES] Timer loopback test passed
[WARNING] [MULTI_USRP] The hardware does not support the requested RX sample rate:
Target sample rate: 1.083333 MSps
Actual sample rate: 1.086957 MSps
[INFO] [NIRIO] rpc_client stopping...
[INFO] [NIRIO] rpc_client stopped.
[INFO] [NIRIO] rpc_client stopping...
[INFO] [NIRIO] rpc_client stopped.
[WARNING] [MULTI_USRP] The hardware does not support the requested TX sample rate:
Target sample rate: 1.083333 MSps
Actual sample rate: 1.086957 MSps
[i] Init CTRL interface
[i] Init complete
BR
Snehasish
Hi Ravi,
> Can we make usrp to behave like a normal MS with parameters
> of SIM in "test sim" feature from telnet. I am not using any
> real SIM or writer.
Yes, it's possible to use the virtual SIM-card, and this is exactly
what we are doing during the SDR PHY development.
Check out this example from FakeTRX:
https://osmocom.org/projects/baseband/wiki/FakeTRX#Running-mobile-applicati…
> As we pass the make command as " make nofirmware" from osmocombb/src
> directory after enabling the " CFLAGS += -DCONFIG_TX_ENABLE " in
> osmocom-bb/src/target/firmware, will it still be able to transmit ?
No need to change the 'CONFIG_TX_ENABLE'.
This affects only the firmware for Calypso based hardware.
With best regards,
Vadim Yanitskiy.
Hello Community
Can we make usrp to behave like a normal MS with parameters of SIM in "test
sim" feature from telnet. I am not using any real SIM or writer.
As we pass the make command as " make nofirmware" from osmocombb/src
directory after enabling the " CFLAGS += -DCONFIG_TX_ENABLE " in
osmocom-bb/src/target/firmware, will it still be able to transmit ?
--
Best Regards.
Ravi
Hi Craig,
Could you please provide a bit more detailed description
of the change you've sent: what was wrong and what
this change is intended to fix, so I'll push it to gerrit.
Thanks!
With best regards,
Vadim Yanitskiy.
Hi,
> While transmitting the classmark or any message from mobile on
> SDCCH during a call, does it transmit on the frequency we get
> after converting the ARFCN or is there a slight variation ?
I don't get this, what do you mean by 'converting the ARFCN'?
There are two (as I know) possible types of call assignment:
- Early Assignment, when the network allocates TCH/F or TCH/H
right after getting RACH-request from a mobile phone. The
frequency (or a set of them) is indicated in the Immediate
Assignment message.
- Late Assignment, when the network allocates an SDCCH channel
first, where a mobile phone indicates a connection reason
(Paging Response or Service Request) and also indicates the
classmark. Then the network eventually sends the Assignment
Command message, where just like in Immediate Assignment a
new channel data (both FDMA and TDMA) are described.
BTW: please choose a proper subject for this thread and
don't interfere with the existing one because they are unrelated.
With best regards,
Vadim Yanitskiy.
Hi,
I already uncomment the tx support in Makefile file. But when I run on
phone, it said this firmware was compiled without tx support.
How to fix this?
Dear Osmocom Community,
[please respect the Reply-To and post all follow-up discussion to this
to openbsc(a)lists.osmocom.org, so we avoid having long threads
cross-posted to several mailing lists.]
Like every year in early December, it is time to discuss as schedule for
OsmoDevCon in the upcoming year.
Note: Ths is about OsmoDevCon, the more private meeting of developers,
*NOT* about OsmoCon, the public conference.
== When, Who, Where ==
I propose the following date for OsmoDevCon 2018:
April 20 - April 23rd, 2018
* Who: Active developers/contributors of Osmocom projects (as usual)
* Where: IN-Berlin, Berlin (as usual)
Please let me know ASAP if that proposed date works for everyone who'd
want to attend. We can still change it now, but I would want to nail
down the date pretty soon.
== Format ==
After the experiment of reducing from 4 to 3 days last year (due to
OsmoCon), we will again go for *four days* in 2018.
However, we should clearly divide the days in a way that e.g. "GSM/3G"
topics are on two days, while SDR+Other topics are on the other days, so
people not interested in some topics can skip one or two days, as
needed.
We could even divide it further like:
* 1 day 3GPP RAN (osmo-bts, osmo-bsc, osmo-pcu, virt_phy, fake_trx, ...)
* 1 day 3GPP CN (osmo-msc, osmo-hlr, osmo-sip-connector, nextepc, etc.)
* 2 days misc
Regards, and looking forward to meeting you [again] in 2018,
Harald
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hi Sebastian,
> My query is : my test network is supporting A5/1,2,3. Is it feasible to
> set A5/1 on MS1 (though it supports A5/2 and A5/3 also) and A5/2 for MS2
> (though it supports A5/1 and A5/3 also) for a call in between them using
> "Early Classmark Sending" ???
I think it will work without any problems because the A5/X encryption
is not 'end-to-end' (in our case MS-to-MS), but there are two separate
encrypted sessions between MS1-BTS and MS2-BTS.
With best regards,
Vadim Yanitskiy.
Hi
I am trying to test osmocom-bb/fixeria-Trx.
After configuring test-sim the functions for receiver side like the "
network selection mode " " select ARFCN" do work.
But how to test or configure " Early Classmark Sending" for varying set of
encryption (A5/1,2,3,4...).
Regards.
--
Hi Max,
This work is a part of "GSM and GPRS Security Using OsmocomBB" thesis
written by Francois Ponsgen and was published a quite time ago.
Moreover, I already have the changes in my local repo, which is
mostly used for research purposes. I can push them, if it's really
required.
BTW: if I remember correctly, this work was done in NTNU ;)
With best regards,
Vadim Yanitskiy.
Dear Osmocom community,
I have been working on GAPK (GSM Audio Packet Knife) for some
time, and now I would like to share some achievements.
Previously GAPK was represented as a single binary that
could be called with some command line arguments in order
to perform required operations. This is only handy for
humans, but not for other programs, which may also need
to perform some format / codec conversations or audio
capture / playback.
One of such programs is the mobile from OsmocomBB project.
Currently, when you're making a voice call, both audio
capture and playback are only possible on the L1 side,
i.e. on a Calypso based phone. Of course, the audio stream
can be redirected via MNCC socket, but this is not what
a regular OsmocomBB user would like to do. Moreover, there
is a lack of AMR codec support.
Also, there is another GNURadio based project named GR-GSM.
In short, this is a set of blocks for GSM signal reception,
demodulation and further processing. At the moment, one has
TCH Full Rate decoding capabilities only. Audio playback is
not supported yet.
Having these projects in my mind, I have got an idea of
creating a shared library from the GAPK source code. And,
a few days ago I was managed to get the audio playback
working in OsmocomBB. I hope, this library will be also
usable for other projects.
Brief list of changes were made:
- Composed a shared library named libosmogapk
- All exposed symbols have got an 'osmo_gapk' prefix
- Added a pkg-config manifest and a symbol export map
- Integrated the Osmocom logging framework
- Benchmarking is now disabled by default
- Processing queue now based on the linuxlist
- Fixed program exit due to ALSA buffer underrun
- Fixed ALSA audio playback from file
- Old gapk application was renamed to 'osmo-gapk'
and linked against the library
- Adjusted verbosity level (normal / debug)
- Fixed I/O combinations (ALSA, RTP, file...) check
All changes could be found at the fixeria/lib branch of GAPK.
I hope to see them merged, and open for discussions ;)
With best regards,
Vadim Yanitskiy.
Hello,
I'm newbie and want to learn about osmocombb.
I already compiled all of the programs, but when I try to upload helloworld
program, it stuck on this error
$ host/osmocon/osmocon -p /dev/ttyUSB0 -m c123xor target/firmware/board/
compal_e88/hello_world.compalram.bin -c
got 1 bytes from modem, data looks like: 00 .
got 1 bytes from modem, data looks like: f7 .
got 1 bytes from modem, data looks like: 00 .
got 1 bytes from modem, data looks like: 72 r
got 2 bytes from modem, data looks like: 82 bf ..
got 1 bytes from modem, data looks like: 7d }
got 1 bytes from modem, data looks like: fd .
got 1 bytes from modem, data looks like: 7f .
got 1 bytes from modem, data looks like: 00 .
got 1 bytes from modem, data looks like: a6 .
got 1 bytes from modem, data looks like: 51 Q
got 1 bytes from modem, data looks like: d2 .
got 1 bytes from modem, data looks like: 51 Q
got 1 bytes from modem, data looks like: 0a .
got 1 bytes from modem, data looks like: 3a :
got 1 bytes from modem, data looks like: 00 .
got 1 bytes from modem, data looks like: 4d M
got 1 bytes from modem, data looks like: a3 .
got 1 bytes from modem, data looks like: a3 .
got 1 bytes from modem, data looks like: da .
got 1 bytes from modem, data looks like: 00 .
got 1 bytes from modem, data looks like: 00 .
I don't know if it hardware problem, or software problem.
When I try to debug using putty to listen to /dev/ttyUSB0 there is no fmttool
erro just like this article said http://www.linuxx.eu/2014/09/osmocombb-hardware-and-software-setup.html
Regards.
Hey,
I think I have the minimal patchset to add primitives and lua
bindings to have useful functionality and know what is good/bad
with it and extend/iterate it from here. I would like to share
the state and what's next. On the higher level we have:
* Primitive for timers
* Primitives OP_IND for started/shutdown handling
* Primitives OP_IND for SMS status and RX SMS
* Primitives OP_IND for Mobility Management state changes
Next steps:
* Pack MNCC and enable/handle voice calls as well to do
call control.
What needs to change in future iterations:
* SMS, MM, started/shutdown indications should be async.
Especially for MM handling that will do further state changes
from within the new_mm_state. So if we enable/disable the MS
within this callback we ask for trouble.
* The lua scripting code is calling some routines directly. E.g.
for a "simple" SMS sending routine, to query state. This should
probably be converted to primitives as well. But that can be done
while keeping the lua API (e.g. with continuations or cache the
MS status).
* Finish the OsmocomBB manual documentation for the API
* Bikeshed. Number vs. Bool... ;)
Bugs found by scripting:
* I found an ASAN issue in mobile (fix pending)
* Noticed paging with outdated TMSI on NITB
* Trying to encode an alphabetic phone number causes issue in
libosmocore (bug report pending)
cheers
holger
Examples:
# Print through logging framework
print("Hello from Lua");
log_notice("Notice from lua");
log_debug("Debug from Lua");
log_error("Error from Lua");
log_fatal("Fatal from Lua");
# Start a timer... and cancel it. Notice the ':'
local timer = osmo.timeout(1000, function()
print("After timeout!!!")
end)
timer:cancel()
# Access a osmo.ms() singleton table/object
print("MS", type(osmo.ms()));
osmo.ms():imsi()
osmo.ms():imei()
osmo.ms():shutdown_state()
osmo.ms():started()
osmo.ms():sms_send_simple("1234", "21321324", "fooooooo", 23)
osmo.ms():start()
osmo.ms():shutdown(force)
# Callbacks...
function ms_started_cb(started)
end
function ms_shutdown_cb(old_state, new_state)
end
function sms_cb(sms, cause, valid)
for i, v in pairs(sms) do
print(i, v)
end
end
function mm_cb(new_state, new_substate, old_substate)
if new_state == 19 and new_substate == 1 then
osmo.ms():sms_send_simple("1234", "21321324", "fooooooo", 23)
end
end
local cbs = {
Started=ms_started_cb,
Shutdown=ms_shutdown_cb,
Sms=sms_cb,
Mm=mm_cb
}
osmo.ms():register(cbs)
Hi Mychaela,
Great work! I just had a quick look and did some tests.
Do you agree if I would merge your changes to the mainstream
under GNU GPL version 2 license, keeping you as the author?
With best regards,
Vadim Yanitskiy.
Hi,
while I am adding scripting support to the mobile application I tried using a primitive interface between the scripting implementation and the mobile application. On new indications a callback in the primitive interface user will be invoked and there is a generic submit function that will dispatch (switch/case) over the primitive and call the right internal functions. To prototype this I have implemented "timer" support, SMS and the started/shutdown handling through primitives.
The neat thing about this approach is that I don't tie a specific scripting solution into the code, the indications are generic enough to be useful in multiple contexts, the submit/dispatch is about high level operations ("send SMS", "switch device off") that map to other programming languages as well. E.g. it is easy to imagine that one writes a TCP/IP adapter to send these primitives to another process/application.
The controversial part is that this code is not using a msgb. Normally the primitive header is inside a msgb and then more or less points to itself. But in the scripting layer case the "timer", "new sms", "network selection" are already fully parsed objects (or where never parsed from a network representation) so are normally not located in a msgb in any form.
One option is not to bother and deal with the primitive header just being embedded in another structure. The concept of request/response/indication is bigger than network messages.
The other is to create a dummy msgb to obey the interface and follow the existing users but I am not sure what we would gain.
For XYZ->internal we can use direct function calls and avoid the indirection of the primitives and for indications either call directly into the scripting code or create a script_indications struct and put it into the struct osmocom_ms. Only downside that doing RPC requires more work? So far I only forsee a single "script_indications" callback.
comments? opinions?
holger