baseband-devel

baseband-devel@lists.osmocom.org

2023 discussions

Re: Aw: pirelli dp-l10 stuck
by msokolov＠ivan.Harhan.ORG 24 Aug '14

24 Aug '14

"TSAREGORODTSEV, Yury" <yury(a)bridgecommunication.co.uk> wrote: > Damn, yeah > its not charging at all :) > even when connected to hub with external power :) Unfortunately there are no schematics available for the DP-L10 (and reconstructing them from steve-m's PCB layer scans is anything but easy), so everything that follows is ultimately pure guesswork, but it *seems* to me that the battery charging circuit in this phone is fundamentally the same as in the more traditional Calypso+Iota phones (Compal etc), aside from using USB VBUS as the charging power source instead of a dedicated round-plug type of power jack. If the charging circuit in the DP-L10 works the way I think it does, following common sense and all that, than the battery charging process ought to be controlled by Iota ABB. The ABB chip in this phone is TWL3014, but I'll use the more readable TWL3025 datasheet as a reference instead - back in 2011 both Steve M. and Sylvain M. said on this list that the two chips are functionally identical. The battery charging functionality is described on pages 46-48 of TWL3025_SWRS021.pdf; in particular, refer to Figure 4-10 on page 48. If my understanding of this datasheet description is correct, and if the phone in question (Pirelli DP-L10) indeed has its battery charging circuit implemented in the canonical way, then one of the following two conditions must be met in order for charging current to pass from VBUS into the battery: 1. The "precharge" function is enabled inside the ABB chip, such that an internal transistor in the ABB opens up to pass some current from the VCHG pin to the PCHG pin. This precharge function is intended for situation when the battery has discharged so low that it needs to be charged some before one can boot the CPU, hence this precharge phase has to be done entirely in hardware without any CPU firmware supervision. But it appears that this hardware-only precharge function is automatically disabled when the CPU is turned on, or maybe the precharge current is so feeble that the drain from the running CPU is greater than the amount of power coming from the precharge circuit. -or- 2. The "normal" way of charging the battery (with the CPU running) is for the CPU to enable the main charging circuit in the ABB via some register writes. In this case the power flows from the charging source (USB VBUS in the case of Pirelli DP-L10) into the battery through an external power transistor controlled by the ICTL output from the ABB. In TI's standard firmware the battery charging function lives in the PWR SWE (RiViera Software Entity) in the older versions and in the LCC SWE in newer ones. Pirelli's version appears to use PWR rather than LCC. We (the world public) have the source for the PWR SWE in the MV100 find, and that for LCC in the Sotovik find, but I haven't really looked at either of them yet - working on L1 integration currently. If you would like to get Pirelli battery charging working in OsmocomBB, I would recommend that you take the charging code for compal_e88, enable it for the DP-L10 build, and experiment from there. Don't be fooled by Pirelli's use of USB charging instead of a round-plug charger, my guess is that they use USB VBUS in exactly the same way as how Compal etc use their charging power source. It also seems to me that Pirelli's charging mechanism does not strictly comply with the USB spec. Per the spec, you are supposed to draw no more than 100 mA from VBUS until and unless you negotiate a higher power budget with the host, and that negotiation takes place over the D+ and D- wires. But in Pirelli's case these D+ and D- wires go to the CP2102 USB-serial chip and nowhere else, and only this CP2102 speaks the USB protocol - the Calypso only sees UART-serial on the other side of the CP2102. So they "illegally" tap VBUS (which per the spec must not go anywhere but to the device that speaks the USB protocol) to use it as the charging power source, but have no way to negotiate their current draw. When Pirelli's fw detects the presence of VBUS via the charger-insert interrupt from the ABB and decides to start charging the battery, it has no choice but to enable some hard-coded charging current value - the charging current can be adjusted by programming a register in the ABB, but the fw has no way of knowing how much current it is allowed to draw from VBUS, if any at all, because only the USB logic in the CP2102 has access to this knowledge. So whatever charging current it draws, it must do so blindly. I can only guess that this current must be somewhere around 500 mA, as charging at 100 mA would be too slow. I actually like Pirelli's design in this regard, and I currently plan on copying it in my own Pirelli-inspired Calypso dumbphone design: put a CP2102 inside the phone just like Pirelli did, and use the same USB charging arrangement, drawing 500 mA for charging unconditionally, showing "the middle finger" to the developer-unfriendly Unusable Serial Botch specs... Or can someone think of a better way? VLR, SF

2 1

pirelli dp-l10 stuck
by TSAREGORODTSEV, Yury 24 Aug '14

24 Aug '14

Hi, everybody has same trouble that pirelli stuck after some usage ?

3 6

pirelli dp10
by TSAREGORODTSEV, Yury 22 Aug '14

22 Aug '14

Hello, anyone has experience to use application mobile on pirelli ? there is no layer1.compalram.bin for this model, any ideas how to run app mobile? Sincerely Yours, Tsaregorodtsev Yury Bridge Communication Billing & Settlement Plan Limited Fernhills Business Center, Foerster Chambers, Todd Street Bury, Gtr Manchester, BL9 5BJ United Kingdom Tel: +441570200000 ICQ: 622719210 MSN: y.tsaregorodtsev(a)live.com Skype: tsarik-108 web: www.bridgecommunication.co.uk

1 2

[PATCH] layer23: initialize l2h/l3h pointers
by Igor Almeida 21 Aug '14

21 Aug '14

Signed-off-by: Igor Almeida <igor.contato(a)gmail.com> --- src/host/layer23/src/common/l1ctl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/host/layer23/src/common/l1ctl.c b/src/host/layer23/src/common/l1ctl.c index 91bab89..c75872e 100644 --- a/src/host/layer23/src/common/l1ctl.c +++ b/src/host/layer23/src/common/l1ctl.c @@ -148,6 +148,7 @@ static int rx_l1_rach_conf(struct osmocom_ms *ms, struct msgb *msg) } dl = (struct l1ctl_info_dl *) msg->l1h; + msg->l2h = msg->l3h = dl->payload; osmo_prim_init(&pp.oph, SAP_GSM_PH, PRIM_PH_RACH, PRIM_OP_CONFIRM, msg); -- 2.0.1 --------------070704030600070907020805--

1 0

GSM DoS or conditional access project
by Abel Magaña 20 Aug '14

20 Aug '14

Hi I wonder if there is a way to develop a Denial of Service or Conditional Access system for a GSM network based on Osmocom. The idea is to develop a commercial product intended to be used to limit unlawful communication in prisons or correctional facilities. My investigation is that this is a kind of worldwide necessity as inmates use smuggled mobile phones for criminal activities (I live in Central America and constantly see news that confirm this is urgent requirement). Currently there a few options available to achieve this purpose: 1. Government authorities require telecom operators to reduce radio signal in the vicinity of confinement facilities2. The use of radio jamming systems to propagate a noise signal3. One or two commercial solutions like iNAC Managed Access from Tecore (a very clever and patented technology) I imagine a solution based on Osmocom as a base station simulating a roaming area in the correctional facility area, for authorized users, dummy network should appear as a FPLMN but for illegal users the fake network must grant access entering driving them into a dead end network with no communication. However I see there are several flaws for this aproach: one is that inmates could set their mobiles to manual network selection and connect themself to commercial mobile networks but I hope this could serve as a ground for further discussion. I will appreciate very much your comments. Regards,

1 0

Memdump gives bad crc on Motorola C118
by Richard Menedetter 17 Aug '14

17 Aug '14

Hi I thought I try to flash some osmocom tools into a C118. I have the loader loaded succesfully onto the C118. I can do a finfo (see below) So I wanted to backup the complete flash: osmoload memdump 0x000000 0x200000 c118.bin -> I get "bad crc" for every page Same when I try to backup the loader as on the flashing wiki. Dumping 8192 bytes of memory at 0x0 to file compal_loader.bin bad crc 4190 (not 5c9a) at offset 0x00000000 bad crc f041 (not d50d) at offset 0x000000f0 bad crc f041 (not 3afa) at offset 0x000001e0 Is the C118 not supported for flashing? Can somebody give me any helpful hints? CU, Ricsi chip 0 at 0x00000000 of 2097152 bytes in 2 regions region 0 with 31 blocks of 65536 bytes each block 0 with 65536 bytes at 0x00000000 on chip 0 block 1 with 65536 bytes at 0x00010000 on chip 0 block 2 with 65536 bytes at 0x00020000 on chip 0 block 3 with 65536 bytes at 0x00030000 on chip 0 block 4 with 65536 bytes at 0x00040000 on chip 0 block 5 with 65536 bytes at 0x00050000 on chip 0 block 6 with 65536 bytes at 0x00060000 on chip 0 block 7 with 65536 bytes at 0x00070000 on chip 0 block 8 with 65536 bytes at 0x00080000 on chip 0 block 9 with 65536 bytes at 0x00090000 on chip 0 block 10 with 65536 bytes at 0x000a0000 on chip 0 block 11 with 65536 bytes at 0x000b0000 on chip 0 block 12 with 65536 bytes at 0x000c0000 on chip 0 block 13 with 65536 bytes at 0x000d0000 on chip 0 block 14 with 65536 bytes at 0x000e0000 on chip 0 block 15 with 65536 bytes at 0x000f0000 on chip 0 block 16 with 65536 bytes at 0x00100000 on chip 0 block 17 with 65536 bytes at 0x00110000 on chip 0 block 18 with 65536 bytes at 0x00120000 on chip 0 block 19 with 65536 bytes at 0x00130000 on chip 0 block 20 with 65536 bytes at 0x00140000 on chip 0 block 21 with 65536 bytes at 0x00150000 on chip 0 block 22 with 65536 bytes at 0x00160000 on chip 0 block 23 with 65536 bytes at 0x00170000 on chip 0 block 24 with 65536 bytes at 0x00180000 on chip 0 block 25 with 65536 bytes at 0x00190000 on chip 0 block 26 with 65536 bytes at 0x001a0000 on chip 0 block 27 with 65536 bytes at 0x001b0000 on chip 0 block 28 with 65536 bytes at 0x001c0000 on chip 0 block 29 with 65536 bytes at 0x001d0000 on chip 0 block 30 with 65536 bytes at 0x001e0000 on chip 0 region 1 with 8 blocks of 8192 bytes each block 31 with 8192 bytes at 0x001f0000 on chip 0 block 32 with 8192 bytes at 0x001f2000 on chip 0 block 33 with 8192 bytes at 0x001f4000 on chip 0 block 34 with 8192 bytes at 0x001f6000 on chip 0 block 35 with 8192 bytes at 0x001f8000 on chip 0 block 36 with 8192 bytes at 0x001fa000 on chip 0 block 37 with 8192 bytes at 0x001fc000 on chip 0 block 38 with 8192 bytes at 0x001fe000 on chip 0

2 2

Pirelli phone charging function in osmocom-bb
by Richard Menedetter 17 Aug '14

17 Aug '14

Hi List I have just reactivated my Pirelli Osmocom phone, and recompiled osmocom-bb. (after rolling back libosmocore it works great) But can it be that charging is not implemented on the Pirelli phone with OsmocomBB? When I attach the MiniUSB cable, I can upload the code great, but when I leave it running for a longer time, it booted into the default charging pirelli screen. I assume that the battery is not that good any more, and it seems that it is running on battery power instead of on USB power. When I upload the RSSI app to the phone it shows me an empty battery icon in the right. (Pirelli SW showed completely full battery icon) Can somebody confirm that the pirelli phone is not charging in osmocom-bb? Is there a chance tha somebody is looking into this anytime? CU, Ricsi PS: Is it still correct that the jolly/test branch is the best for 2 phone transceiver (for OpenBTS/OpenBSC)? This branch should support 2 phones. But as half rate channels are not supported you can only make one call. (ie not possible to make a testcall without going over SIP) Is this information still valid?

2 1

mobile app crash
by TSAREGORODTSEV, Yury 13 Aug '14

13 Aug '14

Hello, can anyone help with fix? Mobile application crashing all time: root@aero-bts:/with_sim/osmocom-bb/src/host/layer23/src/mobile# ./mobile Copyright (C) 2008-2010 ... Contributions by ... License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. <000f> sim.c:1223 init SIM client <0006> gsm48_cc.c:63 init Call Control <0007> gsm480_ss.c:231 init SS <0019> gsm411_sms.c:63 init SMS <0001> gsm48_rr.c:5500 init Radio Ressource process <0005> gsm48_mm.c:1324 init Mobility Management process <0005> gsm48_mm.c:1037 Selecting PLMN SEARCH state, because no SIM. <0002> gsm322.c:5037 init PLMN process <0003> gsm322.c:5038 init Cell Selection process <0003> gsm322.c:5095 Read stored BA list (mcc=214 mnc=07 Spain, movistar) Mobile '1' initialized, please start phone now! VTY available on port 4247. <0005> subscriber.c:600 Requesting SIM file 0x2fe2 <000f> sim.c:209 got new job: SIM_JOB_READ_BINARY (handle=00000004) <000f> sim.c:697 go MF <000f> sim.c:241 SELECT (file=0x3f00) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) <000f> sim.c:876 received APDU (len=0 sw1=0x9f sw2=0x1e) <000f> sim.c:949 command successfull <000f> sim.c:571 GET RESPONSE (len=30) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xc0) <000f> sim.c:876 received APDU (len=30 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:241 SELECT (file=0x2fe2) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) <000f> sim.c:876 received APDU (len=0 sw1=0x9f sw2=0x0f) <000f> sim.c:949 command successfull <000f> sim.c:571 GET RESPONSE (len=15) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xc0) <000f> sim.c:876 received APDU (len=15 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:1065 selected file (len 10) <000f> sim.c:277 READ BINARY (offset=0 len=10) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xb0) <000f> sim.c:876 received APDU (len=10 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:151 sending result to callback function (type=0) <0005> subscriber.c:232 received ICCID 8934076100140610329 from SIM <0005> subscriber.c:600 Requesting SIM file 0x6f07 <000f> sim.c:209 got new job: SIM_JOB_READ_BINARY (handle=00000004) <000f> sim.c:706 requested path is longer, go child DFgsm <000f> sim.c:241 SELECT (file=0x7f20) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) <000f> sim.c:876 received APDU (len=0 sw1=0x9f sw2=0x1e) <000f> sim.c:949 command successfull <000f> sim.c:571 GET RESPONSE (len=30) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xc0) <000f> sim.c:876 received APDU (len=30 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:241 SELECT (file=0x6f07) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) <000f> sim.c:876 received APDU (len=0 sw1=0x9f sw2=0x0f) <000f> sim.c:949 command successfull <000f> sim.c:571 GET RESPONSE (len=15) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xc0) <000f> sim.c:876 received APDU (len=15 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:1065 selected file (len 9) <000f> sim.c:277 READ BINARY (offset=0 len=9) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xb0) <000f> sim.c:876 received APDU (len=9 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:151 sending result to callback function (type=0) <0005> subscriber.c:262 received IMSI 214075542695571 from SIM <0005> subscriber.c:600 Requesting SIM file 0x6f7e <000f> sim.c:209 got new job: SIM_JOB_READ_BINARY (handle=00000004) <000f> sim.c:241 SELECT (file=0x6f7e) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) <000f> sim.c:876 received APDU (len=0 sw1=0x9f sw2=0x0f) <000f> sim.c:949 command successfull <000f> sim.c:571 GET RESPONSE (len=15) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xc0) <000f> sim.c:876 received APDU (len=15 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:1065 selected file (len 11) <000f> sim.c:277 READ BINARY (offset=0 len=11) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xb0) <000f> sim.c:876 received APDU (len=11 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:151 sending result to callback function (type=0) <0005> subscriber.c:299 received LOCI from SIM (mcc=214 mnc=07 lac=0x0b58 U1) <0005> subscriber.c:600 Requesting SIM file 0x6f20 <000f> sim.c:209 got new job: SIM_JOB_READ_BINARY (handle=00000004) <000f> sim.c:241 SELECT (file=0x6f20) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) <000f> sim.c:876 received APDU (len=0 sw1=0x9f sw2=0x0f) <000f> sim.c:949 command successfull <000f> sim.c:571 GET RESPONSE (len=15) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xc0) <000f> sim.c:876 received APDU (len=15 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:1065 selected file (len 9) <000f> sim.c:277 READ BINARY (offset=0 len=9) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xb0) <000f> sim.c:876 received APDU (len=9 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:151 sending result to callback function (type=0) <0005> subscriber.c:376 received KEY from SIM <0005> subscriber.c:600 Requesting SIM file 0x6f30 <000f> sim.c:209 got new job: SIM_JOB_READ_BINARY (handle=00000004) <000f> sim.c:241 SELECT (file=0x6f30) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) <000f> sim.c:876 received APDU (len=0 sw1=0x9f sw2=0x0f) <000f> sim.c:949 command successfull <000f> sim.c:571 GET RESPONSE (len=15) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xc0) <000f> sim.c:876 received APDU (len=15 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:1065 selected file (len 48) <000f> sim.c:277 READ BINARY (offset=0 len=48) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xb0) <000f> sim.c:876 received APDU (len=48 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:151 sending result to callback function (type=0) <0005> subscriber.c:414 received PLMN selector (mcc=208 mnc=01) from SIM <0005> subscriber.c:414 received PLMN selector (mcc=208 mnc=20) from SIM <0005> subscriber.c:414 received PLMN selector (mcc=234 mnc=10) from SIM <0005> subscriber.c:414 received PLMN selector (mcc=268 mnc=06) from SIM <0005> subscriber.c:414 received PLMN selector (mcc=268 mnc=03) from SIM <0005> subscriber.c:414 received PLMN selector (mcc=222 mnc=01) from SIM <0005> subscriber.c:414 received PLMN selector (mcc=262 mnc=07) from SIM <0005> subscriber.c:414 received PLMN selector (mcc=204 mnc=08) from SIM <0005> subscriber.c:414 received PLMN selector (mcc=604 mnc=00) from SIM <0005> subscriber.c:414 received PLMN selector (mcc=232 mnc=03) from SIM <0005> subscriber.c:414 received PLMN selector (mcc=228 mnc=02) from SIM <0005> subscriber.c:414 received PLMN selector (mcc=272 mnc=02) from SIM <0005> subscriber.c:414 received PLMN selector (mcc=334 mnc=030) from SIM <0005> subscriber.c:414 received PLMN selector (mcc=202 mnc=10) from SIM <0005> subscriber.c:414 received PLMN selector (mcc=226 mnc=10) from SIM <0005> subscriber.c:414 received PLMN selector (mcc=226 mnc=03) from SIM <0005> subscriber.c:600 Requesting SIM file 0x6f31 <000f> sim.c:209 got new job: SIM_JOB_READ_BINARY (handle=00000004) <000f> sim.c:241 SELECT (file=0x6f31) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) <000f> sim.c:876 received APDU (len=0 sw1=0x9f sw2=0x0f) <000f> sim.c:949 command successfull <000f> sim.c:571 GET RESPONSE (len=15) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xc0) <000f> sim.c:876 received APDU (len=15 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:1065 selected file (len 1) <000f> sim.c:277 READ BINARY (offset=0 len=1) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xb0) <000f> sim.c:876 received APDU (len=1 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:151 sending result to callback function (type=0) <0005> subscriber.c:435 received HPPLMN 5 (30 mins) from SIM <0005> subscriber.c:600 Requesting SIM file 0x6f46 <000f> sim.c:209 got new job: SIM_JOB_READ_BINARY (handle=00000004) <000f> sim.c:241 SELECT (file=0x6f46) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) <000f> sim.c:876 received APDU (len=0 sw1=0x9f sw2=0x0f) <000f> sim.c:949 command successfull <000f> sim.c:571 GET RESPONSE (len=15) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xc0) <000f> sim.c:876 received APDU (len=15 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:1065 selected file (len 17) <000f> sim.c:277 READ BINARY (offset=0 len=17) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xb0) <000f> sim.c:876 received APDU (len=17 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:151 sending result to callback function (type=0) <0005> subscriber.c:687 SIM reading failed, file invalid <0005> subscriber.c:600 Requesting SIM file 0x6f78 <000f> sim.c:209 got new job: SIM_JOB_READ_BINARY (handle=00000004) <000f> sim.c:241 SELECT (file=0x6f78) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) <000f> sim.c:876 received APDU (len=0 sw1=0x9f sw2=0x0f) <000f> sim.c:949 command successfull <000f> sim.c:571 GET RESPONSE (len=15) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xc0) <000f> sim.c:876 received APDU (len=15 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:1065 selected file (len 2) <000f> sim.c:277 READ BINARY (offset=0 len=2) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xb0) <000f> sim.c:876 received APDU (len=2 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:151 sending result to callback function (type=0) <0005> subscriber.c:476 received ACC 0002 from SIM <0005> subscriber.c:600 Requesting SIM file 0x6f7b <000f> sim.c:209 got new job: SIM_JOB_READ_BINARY (handle=00000004) <000f> sim.c:241 SELECT (file=0x6f7b) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) <000f> sim.c:876 received APDU (len=0 sw1=0x9f sw2=0x0f) <000f> sim.c:949 command successfull <000f> sim.c:571 GET RESPONSE (len=15) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xc0) <000f> sim.c:876 received APDU (len=15 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:1065 selected file (len 12) <000f> sim.c:277 READ BINARY (offset=0 len=12) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xb0) <000f> sim.c:876 received APDU (len=12 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:151 sending result to callback function (type=0) <0005> subscriber.c:515 received Forbidden PLMN 214 01 from SIM <0005> subscriber.c:515 received Forbidden PLMN 214 03 from SIM <0005> subscriber.c:600 Requesting SIM file 0x6f40 <000f> sim.c:209 got new job: SIM_JOB_READ_RECORD (handle=00000004) <000f> sim.c:697 go MF <000f> sim.c:241 SELECT (file=0x3f00) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) <000f> sim.c:876 received APDU (len=0 sw1=0x9f sw2=0x1e) <000f> sim.c:949 command successfull <000f> sim.c:571 GET RESPONSE (len=30) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xc0) <000f> sim.c:876 received APDU (len=30 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:706 requested path is longer, go child DFtelecom <000f> sim.c:241 SELECT (file=0x7f10) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) <000f> sim.c:876 received APDU (len=0 sw1=0x9f sw2=0x1e) <000f> sim.c:949 command successfull <000f> sim.c:571 GET RESPONSE (len=30) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xc0) <000f> sim.c:876 received APDU (len=30 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:241 SELECT (file=0x6f40) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) <000f> sim.c:876 received APDU (len=0 sw1=0x9f sw2=0x0f) <000f> sim.c:949 command successfull <000f> sim.c:571 GET RESPONSE (len=15) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xc0) <000f> sim.c:876 received APDU (len=15 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:1060 selected record (len 28 structure 1) <000f> sim.c:312 READ RECORD (rec_no=1 mode=4 len=28) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xb2) <000f> sim.c:876 received APDU (len=28 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:151 sending result to callback function (type=0) <0005> subscriber.c:327 received MSISDN from SIM <0005> subscriber.c:600 Requesting SIM file 0x6f42 <000f> sim.c:209 got new job: SIM_JOB_READ_RECORD (handle=00000004) <000f> sim.c:241 SELECT (file=0x6f42) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) <000f> sim.c:876 received APDU (len=0 sw1=0x9f sw2=0x0f) <000f> sim.c:949 command successfull <000f> sim.c:571 GET RESPONSE (len=15) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xc0) <000f> sim.c:876 received APDU (len=15 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:1060 selected record (len 42 structure 1) <000f> sim.c:312 READ RECORD (rec_no=1 mode=4 len=42) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xb2) <000f> sim.c:876 received APDU (len=42 sw1=0x90 sw2=0x00) <000f> sim.c:949 command successfull <000f> sim.c:151 sending result to callback function (type=0) <0005> subscriber.c:357 received SMSP from SIM (sca=+34609090909) <0005> subscriber.c:560 (ms 1) Done reading SIM card (IMSI=214075542695571 Spain, movistar) <0005> subscriber.c:572 -> SIM card registered to 214 07 (Spain, movistar) <0005> gsm48_mm.c:4388 (ms 1) Received 'MMR_REG_REQ' event <0002> gsm322.c:3818 (ms 1) Event 'EVENT_SIM_INSERT' for automatic PLMN selection in state 'A0 null' <000e> gsm322.c:1378 Start search of last registered PLMN (mcc=214 mnc=07 Spain, movistar) <0002> gsm322.c:1382 Use RPLMN (mcc=214 mnc=07 Spain, movistar) <0002> gsm322.c:806 new state 'A0 null' -> 'A1 trying RPLMN' <0003> gsm322.c:4049 (ms 1) Event 'EVENT_NEW_PLMN' for Cell selection in state 'C0 null' <000e> gsm322.c:3631 Selecting PLMN (mcc=214 mnc=07 Spain, movistar) <0003> gsm322.c:3637 Start stored cell selection. <0003> gsm322.c:829 new state 'C0 null' -> 'C2 stored cell selection' <0003> gsm322.c:2793 Scanning power for stored BA list. <0003> gsm322.c:2861 Scanning frequencies. (3..3) <0003> gsm322.c:2910 Found signal (ARFCN 3 rxlev -90 (20)) <0003> gsm322.c:2922 Done with power scanning range. <0003> gsm322.c:2793 Scanning power for stored BA list. <0003> gsm322.c:2861 Scanning frequencies. (5..5) <0003> gsm322.c:2910 Found signal (ARFCN 5 rxlev -82 (28)) <0003> gsm322.c:2922 Done with power scanning range. <0003> gsm322.c:2793 Scanning power for stored BA list. <0003> gsm322.c:2861 Scanning frequencies. (7..8) <0003> gsm322.c:2910 Found signal (ARFCN 7 rxlev -101 (9)) <0003> gsm322.c:2910 Found signal (ARFCN 8 rxlev -86 (24)) <0003> gsm322.c:2922 Done with power scanning range. <0003> gsm322.c:2793 Scanning power for stored BA list. <0003> gsm322.c:2861 Scanning frequencies. (10..19) <0003> gsm322.c:2910 Found signal (ARFCN 10 rxlev -81 (29)) <0003> gsm322.c:2910 Found signal (ARFCN 11 rxlev -88 (22)) <0003> gsm322.c:2910 Found signal (ARFCN 12 rxlev -76 (34)) <0003> gsm322.c:2910 Found signal (ARFCN 13 rxlev -57 (53)) <0003> gsm322.c:2910 Found signal (ARFCN 14 rxlev -75 (35)) <0003> gsm322.c:2910 Found signal (ARFCN 15 rxlev -77 (33)) <0003> gsm322.c:2910 Found signal (ARFCN 16 rxlev -98 (12)) <0003> gsm322.c:2910 Found signal (ARFCN 17 rxlev -97 (13)) <0003> gsm322.c:2910 Found signal (ARFCN 18 rxlev -73 (37)) <0003> gsm322.c:2910 Found signal (ARFCN 19 rxlev -92 (18)) <0003> gsm322.c:2922 Done with power scanning range. <0003> gsm322.c:2793 Scanning power for stored BA list. <0003> gsm322.c:2861 Scanning frequencies. (21..22) <0003> gsm322.c:2910 Found signal (ARFCN 21 rxlev -93 (17)) <0003> gsm322.c:2910 Found signal (ARFCN 22 rxlev -87 (23)) <0003> gsm322.c:2922 Done with power scanning range. <0003> gsm322.c:2793 Scanning power for stored BA list. <0003> gsm322.c:2861 Scanning frequencies. (69..69) <0003> gsm322.c:2910 Found signal (ARFCN 69 rxlev -101 (9)) <0003> gsm322.c:2922 Done with power scanning range. <0003> gsm322.c:2793 Scanning power for stored BA list. <0003> gsm322.c:2836 Found 17 frequencies. <0003> gsm322.c:2255 Scanning frequency 13 (rxlev -57). <0003> gsm322.c:474 Sync to ARFCN=13 rxlev=-57 (No sysinfo yet, ccch mode NONE) <0003> gsm322.c:2947 Channel synched. (ARFCN=13, snr=16, BSIC=7) <0003> gsm322.c:698 Starting CS timer with 4 seconds. <0001> gsm322.c:2968 using DSC of 90 <0003> gsm48_rr.c:4820 Channel provides data. <0003> gsm322.c:698 Starting CS timer with 4 seconds. <0001> gsm48_rr.c:1882 New SYSTEM INFORMATION 2ter <0001> sysinfo.c:705 New SYSTEM INFORMATION 3 (mcc 214 mnc 07 lac 0x0b58) <0001> gsm48_rr.c:1916 Changing CCCH_MODE to 1 <0001> gsm48_rr.c:2159 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2214 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2159 PAGING ignored, we are not camping. <0001> gsm48_rr.c:1950 New SYSTEM INFORMATION 4 (mcc 214 mnc 07 lac 0x0b58) <0001> gsm48_rr.c:2159 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2159 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2159 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2159 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2159 PAGING ignored, we are not camping. <0001> sysinfo.c:616 Now updating previously received SYSTEM INFORMATION 4 <0001> gsm48_rr.c:1795 New SYSTEM INFORMATION 1 <0001> gsm48_rr.c:2159 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2159 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2159 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2159 PAGING ignored, we are not camping. <0001> gsm48_rr.c:1824 New SYSTEM INFORMATION 2 <0003> gsm322.c:2714 Received relevant sysinfo. <0003> gsm322.c:708 stopping pending CS timer. <0003> gsm322.c:2325 Scan frequency 13: Cell found. (rxlev -57 mcc 214 mnc 07 lac 0b58) <0003> gsm322.c:1836 Select using access class <0003> gsm322.c:379 A (RLA_C (-57) - RXLEV_ACC_MIN (-102)) = 45 <0003> gsm322.c:381 B (MS_TXPWR_MAX_CCH (33) - p (33)) = 0 <0003> gsm322.c:382 C1 (A - MAX(B,0)) = 45 <0003> gsm322.c:1955 Cell ARFCN 13: Cell found, (rxlev=-57 mcc=214 mnc=07 lac=0b58 Spain, movistar) <0003> gsm322.c:1966 Cell ARFCN 13 selected. <0003> gsm322.c:2423 Tune to frequency 13. <0003> gsm322.c:468 Sync to ARFCN=13 rxlev=-57 (Sysinfo, ccch mode NON-COMB) <0003> gsm322.c:2450 Cell available. <0003> gsm322.c:4049 (ms 1) Event 'EVENT_CELL_FOUND' for Cell selection in state 'C2 stored cell selection' <000e> gsm322.c:3383 Camping normally on cell (ARFCN=13 mcc=214 mnc=07 Spain, movistar) <0003> gsm322.c:829 new state 'C2 stored cell selection' -> 'C3 camped normally' <0005> gsm48_mm.c:4320 (ms 1) Received 'MM_EVENT_CELL_SELECTED' event in state MM IDLE, PLMN search <0005> gsm48_mm.c:909 new MM IDLE state PLMN search -> location updating needed <0005> gsm48_mm.c:909 new MM IDLE state location updating needed -> attempting to update <0005> gsm48_mm.c:426 starting T3212 (periodic loc. upd. delay) with 14400 seconds <0005> gsm48_mm.c:2287 Do Loc. upd. for IMSI attach. <000e> gsm48_mm.c:2208 Perform location update (MCC 214, MNC 07 LAC 0x0b58) <0005> gsm48_mm.c:2342 LOCATION UPDATING REQUEST <0005> gsm48_mm.c:2364 using LAI (mcc 214 mnc 07 lac 0x0b58) <0005> gsm48_mm.c:2372 using TMSI 0x8800ea74 <0005> gsm48_mm.c:914 new state MM IDLE, attempting to update -> wait for RR connection (location updating) <0001> gsm48_rr.c:5449 (ms 1) Message 'RR_EST_REQ' received in state idle (sapi 0) <000e> gsm48_rr.c:1307 Establish radio link due to mobility management request <0003> gsm322.c:4049 (ms 1) Event 'EVENT_LEAVE_IDLE' for Cell selection in state 'C3 camped normally' <0003> gsm322.c:829 new state 'C3 camped normally' -> 'connected mode 1' <0003> gsm322.c:3665 Going to camping (normal) ARFCN 13. <0003> gsm322.c:452 Sync to ARFCN=13, but there is a sync already pending <0001> gsm48_rr.c:355 new state idle -> connection pending <0001> gsm48_rr.c:1459 CHANNEL REQUEST: 00 (Location Update no NECI) <0003> gsm322.c:2947 Channel synched. (ARFCN=13, snr=16, BSIC=7) <0001> gsm322.c:2968 using DSC of 90 <0003> gsm48_rr.c:4820 Channel provides data. <0001> gsm48_rr.c:1590 RANDOM ACCESS (requests left 5) <0001> gsm48_rr.c:1647 RANDOM ACCESS (Tx-integer 10 combined no S(lots) 0 ra 0x0f) <0001> gsm48_rr.c:1686 Use MS-TXPWR-MAX-CCH power value 5 (33 dBm) msgb(0x1ed6a40): Not enough headroom msgb_push (4262630712 < 7) backtrace() returned 11 addresses /usr/local/lib/libosmocore.so.4(osmo_panic+0xb8) [0x7fb0c623e918] /usr/local/lib/libosmogsm.so.5(+0x18986) [0x7fb0c5e0a986] /usr/local/lib/libosmogsm.so.5(lapdm_phsap_up+0x188) [0x7fb0c5e0b628] ./mobile() [0x437599] ./mobile() [0x43989e] /usr/local/lib/libosmocore.so.4(osmo_wqueue_bfd_cb+0x93) [0x7fb0c623c033] /usr/local/lib/libosmocore.so.4(osmo_select_main+0x19a) [0x7fb0c623aefa] ./mobile() [0x404917] /lib/libc.so.6(__libc_start_main+0xfd) [0x7fb0c58acc8d] ./mobile() [0x404489] Signal 6 received. full talloc report on 'layer2 context' (total 31816 bytes in 30 blocks) Layer2 contains 424 bytes in 1 blocks (ref 0) 0x1ed6a40 GSM 04.08 L3 contains 456 bytes in 1 blocks (ref 0) 0x1ed7cf0 struct gsm48_sysinfo contains 1452 bytes in 1 blocks (ref 0) 0x1ed72e0 struct gsm_sub_plmn_na contains 24 bytes in 1 blocks (ref 0) 0x1ed7270 struct gsm_sub_plmn_na contains 24 bytes in 1 blocks (ref 0) 0x1ed7200 struct gsm_sub_plmn_list contains 24 bytes in 1 blocks (ref 0) 0x1ed7190 struct gsm_sub_plmn_list contains 24 bytes in 1 blocks (ref 0) 0x1ed7120 struct gsm_sub_plmn_list contains 24 bytes in 1 blocks (ref 0) 0x1ed70b0 struct gsm_sub_plmn_list contains 24 bytes in 1 blocks (ref 0) 0x1ed7040 struct gsm_sub_plmn_list contains 24 bytes in 1 blocks (ref 0) 0x1ed6fd0 struct gsm_sub_plmn_list contains 24 bytes in 1 blocks (ref 0) 0x1ed6f60 struct gsm_sub_plmn_list contains 24 bytes in 1 blocks (ref 0) 0x1ed6ef0 struct gsm_sub_plmn_list contains 24 bytes in 1 blocks (ref 0) 0x1ed6e80 struct gsm_sub_plmn_list contains 24 bytes in 1 blocks (ref 0) 0x1ed6e10 struct gsm_sub_plmn_list contains 24 bytes in 1 blocks (ref 0) 0x1ed6da0 struct gsm_sub_plmn_list contains 24 bytes in 1 blocks (ref 0) 0x1ecf440 struct gsm_sub_plmn_list contains 24 bytes in 1 blocks (ref 0) 0x1ecf3d0 struct gsm_sub_plmn_list contains 24 bytes in 1 blocks (ref 0) 0x1ecf360 struct gsm_sub_plmn_list contains 24 bytes in 1 blocks (ref 0) 0x1ecf0c0 struct gsm_sub_plmn_list contains 24 bytes in 1 blocks (ref 0) 0x1ecf050 struct gsm_sub_plmn_list contains 24 bytes in 1 blocks (ref 0) 0x1ed6650 struct gsm_sim_handler contains 32 bytes in 1 blocks (ref 0) 0x1ed68c0 struct gsm_sim_handler contains 32 bytes in 1 blocks (ref 0) 0x1ed6940 struct gsm_sim_handler contains 32 bytes in 1 blocks (ref 0) 0x1ed69c0 telnet_connection contains 1 bytes in 1 blocks (ref 0) 0x1ecf510 struct gsm322_ba_list contains 192 bytes in 1 blocks (ref 0) 0x1ed6c80 struct osmocom_ms contains 28704 bytes in 1 blocks (ref 0) 0x1ecf5d0 /root/.osmocom/bb contains 29 bytes in 1 blocks (ref 0) 0x1e6c770 main.c:240 contains 29 bytes in 1 blocks (ref 0) 0x1e6c6f0 Aborted (core dumped) Thx a lot, Yury

6 9

support for L2/3 on chip
by mark.neuhaus＠email.de 08 Aug '14

08 Aug '14

Does the current version of OsmocomBB supports to run the layer 2 or the layer 3 on the baseband chip, now? I read through the arxiv of the mailing list but have maybe overlooked this. best, \jo

5 6

Re: Usefulness of the Calypso (was Re: seL4 is open source now)
by msokolov＠ivan.Harhan.ORG 06 Aug '14

06 Aug '14

mark.neuhaus(a)email.de wrote: > Pleae, then tell me where to get phones with a Calypso > baseband. www.ebay.com > And I'm talking about marked relevant prices. > Don't waste my time with numbers like 5000$. Several OsmocomBB-supported models are currently available on ebay for dirt cheap. > And to be relevant these phones must still be produced so > I can get many, if I want. How many? My company will be happy to produce 5000 Calypso-based phones for you if you make a non-cancelable purchase order and prepay the cost of parts and production. (5000 is the number of Calypso&co chipsets I can buy immediately from my established supplier *without doing any extensive searching*; one can probably get more with some effort.) > Beside, I think its better to work on reverse engineered > GSM stacks like the Qualcom project as started in It's easy to tell other people what they should work on. While you are busy doing that, I'll just keep working on my own solution which will actually result in a usable phone less than a year from now. VLR, SF

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

baseband-devel