- baseband-devel - lists.osmocom.org

Re: Calypso/Iota/Rita chip recommendations
by msokolov＠ivan.Harhan.ORG 14 Aug '13

14 Aug '13

Sylvain Munaut <246tnt(a)gmail.com> wrote: > And why exactly should we help you when you publicly stated [1] that > you'd rather shoot us then yourself > [1] http://lists.openmoko.org/pipermail/community/2012-March/066565.html A little clarification is in order: * In my past negative interactions with certain individuals who have previously served as employees or contractors of Openmoko-Inc and who currently serve as lead developers of OsmocomBB, the crux of the dispute was those individuals' unwillingness to share with all Humanity (yes, *all Humanity*, *not* "me" - I could be dead tomorrow and nothing will change) those COFF object files with symbolic information which Om-Inc had received from TI, and/or their voluntary choice to live and/or accept voluntary citizenship in a country that deems such sharing to be illegal - obviously a voluntary choice which I have NOT made. * There has been one major change in the year and a half since that post of mine quoted by Sylvain - I have discovered this: http://scottn.us/downloads/peek/ [In case ScottN, whoever he is, takes the ware down from his website, it's already archived on my mini-Wikileaks at ftp.ifctf.org/pub/GSM/LoCosto - but for as long as ScottN's copy is up, it should be much faster.] The discovery of the above source (which is almost complete source with very little in object-only form) makes it now unnecessary for me to sacrifice my life in a gunfire exchange with German or Russian police in order to free Openmoko's COFF objects - I'm pretty confident in my ability to recreate something very similar, but full-source from this recently discovered "peek" ware and other more recently discovered leaks, also on my FTP site. > than help us in any way ... It is true that I have chosen to use a different Free Software GSM stack (plus UI etc) implementation for my personal use, hence any contributions from me to the software side of the OsmocomBB project are indeed unlikely. However, I am hoping that the project to build new free phone hardware can be done as a joint project between the two camps. The hardware design files will be free for anyone to download and do with as s/he pleases, and obviously each user is free to run whatever software s/he likes: OsmocomBB, FreeCalypso, or some 3rd or 4th or other choice that may exist in the future. SF

2 1

Calypso/Iota/Rita chip recommendations
by msokolov＠ivan.Harhan.ORG 14 Aug '13

14 Aug '13

Hello fellow Calypso phone hackers, Not having found an already-existing Calypso phone that is exactly to my liking (of the ones supported by OsmocomBB, the Pirelli comes closest to my ideal, but even that one has a few things I don't like, and most important of all, the availability of these phones on the market has already shrunk down to zilch - so the day is near when it will be just as legendary-unobtainium as the TSM30), I am setting out to build my own. I am setting out to design and build a new Calypso/Iota/Rita phone, one that will be specifically designed to run Free Software as its firmware: either OsmocomBB or FreeCalypso (my own personal alternative free GSM firmware implementation), up to each user's individual choice. My design will be a phone, not a modem (i.e., complete with the essential UI elements, as in LCD and keypad), and it will be a dumb/plain/feature phone, i.e., the Calypso will be the main/sole CPU - not a smartphone like Openmoko etc. Before I tackle the difficult problem of either making a new plastic case or choosing some existing one, I will start out by building a bare GSM development board - basically a complete phone sans case, built on a non-form-factor-controlled PCB. This development board will probably end up being very similar to the one which Harard Welte has announced here a little over a year ago, but with one major difference: *all* hardware design source files (as in schematic, BOM and PCB layout source) will be openly released, with absolutely nothing withheld, and in fact the development itself will take place in a public source control repository. Therefore, regardless of whether I succeed or fail in the ultimate goal of producing a complete phone packaged in a plastic case, there will be an Open Source Hardware design for a working Calypso GSM board which others will be able to use as a starting point - something that wouldn't be possible (or at least less convenient) with Harald's PDF-schematics-only version. However, the above vaporware announcement is not the real purpose of my post. Instead, I am currently in the negotiations with several Chinese sellers of Calypso/Iota/Rita/etc chips, and I'm soliciting advice on exactly which variant of each chip I should use: * The Calypso chip in both GTA02 and Pirelli DP-L10 (the two existing designs I use as references to be copied whenever it makes sense) is PD751992AZHH. I can easily get this exact part, but I can also get ones with GHH or AGHH suffixes. I'm venturing a guess in that the A seems to go with the 751992 number, i.e., it's part of the die revision, and as to the difference between GHH and ZHH, I'm guessing that it's the RoHS difference: I'm guessing that GHH has balls made of real SnPb solder, whereas ZHH has the "lead-free solder" junk substituted instead. Because I'm very fortunate to NOT live in the EU or anywhere near, I'm not subject to any EU-nian laws like the RoHS idiocy, and I generally prefer to use real SnPb solder whenever possible. So I wonder: can someone confirm if indeed PD751992AGHH is the exact same Calypso chip as the PD751992AZHH used in the GTA02 and Pirelli phones, but with real non-RoHS solder balls instead, or is it something different? * Which Iota variant is better: TWL3014 or TWL3025? I'm thinking TWL3025, reasoning that it being newer probably means having some internal bugfixes or minor improvements, but perhaps the older TWL3014 is better instead? * As to the Rita, the base part number appears to be TRF6151C in all phones currently supported by OsmocomBB, so I'm sticking with this base part number. But there are additional suffixes after the 'C' in that P/N - would anyone happen to know what these suffixes mean, and which variant I should use? * For the RF PA, I see that the GTA02 uses RF3166 from RF Micro Devices (one of Harald Welte's posts regarding his planned Calypso board also mentioned him planning to use the same PA), whereas the Pirelli and most other feature phones supported by OsmocomBB tend to use Skyworks parts instead. Which is better? I'm currently leaning toward the RF3166, but if someone has a recommendation that is actually backed by some knowledge/reason rather than just a guess like mine, I'll listen. :-) * If I do go with the RF3166, any idea as to what the different suffix versions are? TIA for any input, SF

3 4

Re: Calypso/Iota/Rita chip recommendations
by msokolov＠ivan.Harhan.ORG 14 Aug '13

14 Aug '13

Peter Stuge <peter(a)stuge.se> wrote: > It would be neat if you choose a filter part with a footprint that > can also accomodate a balun more easily than in the Compal phones, Actually my hope is to build a quad-band phone (unlike the dual- or tri-band ones we have so far) by copying this reference design from TI: ftp://ftp.ifctf.org/pub/GSM/Calypso/Leonardo_plus_quadband_schem.pdf [The above PDF came from one of the Chinese sites; the /pub/GSM directory of my FTP site above is my own sort of mini-Wikileaks for all things dealing with the Calypso and related things - I encourage everyone to check out the collection of goodies which I've accumulated so far, and which only keeps growing. :-)] As you can see on that schematic, instead of using separate antenna switch and Rx SAW filter parts, the Leonardo reference boards used integrated RF front-end modules - in the case of the quad-band Leonardo Plus, it's a quad-band RF FEM that works perfectly with the Rita. The specific part on that Leonardo+ board seems to be Epcos M034F. A quick search for that part hasn't shown up any availability, but then it was only a very quick search, and even if that specific part isn't available, I reason that there must be functional equivalents from other manufacturers. > so that a phone could be assembled "either way". You mean a filterless sniffer version? I have to admit that sniffing and other GSM hacking aren't really my areas of interest - instead all I want is a 100% "normal" cellphone, but with just one difference: running software/firmware whose full source is physically available (be it legal or otherwise) for the exercise of the Four Freedoms defined by the FSF, as a moral requirement. SF

2 1

Channel Request Info RACH GSMTAP Wireshark?
by dagar 12 Aug '13

12 Aug '13

hello, when reading gsm spec online i have understood that on an MT call the BTS pages the phone on the RR paging channel(PCH) the phone then asks for a channel in the RR channel request (RACH) the BTS replies with RR immediate assignment(AGCH) etc etc Now I have tried to see a live example of this using osmocom-bb layer1/mobile + gsmtap/wirehshark However I cannot figure out or see anywhere in these logs the *RR channel request (RACH) packet*. Does GSMTAP or OsmocomBB actually capture the RR channel request or am I missing something here?? the logs I get are like this (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) System Information Type 1 (CCCH) (RR) System Information Type 2 (CCCH) (RR) System Information Type 3 (CCCH) (SS) (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Paging Request Type 1 (CCCH) (RR) Immediate Assignment and so on Thanks! -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Channel-Request-Info-RACH-GSMTAP… Sent from the baseband-devel mailing list archive at Nabble.com.

2 1

Filtering in baseband spectrum
by Neela Neela 05 Aug '13

05 Aug '13

Hi I am a beginner with RTL and observing that the baseband spectrum is centred at 0 Hz and is asymmetric going from -1 MHz to +1 MHz. How does one filter a part of such a spectrum? For example if signal of interest lied in -300 kHz to -150 kHz. The filtering techniques for typical band pass filters work with positive frequencies and have symmetric frequency selection response. As such a 150 to 300 KHz band pass filter will select signal in both 150 to 300 kHz band as well as from -150 to 300 kHz. Is there a special filtering method available to work with negative frequencies and with an asymmetric baseband spectrum. I am sure this has been addressed as preassumably the FM and other signals of interest are filtered somehow. Anu indications will be appreciated.

2 2

fmtool error
by Ahmed Gawad 04 Aug '13

04 Aug '13

Hello, I am trying to run osmocom on Motorola C117. Using the following : PC(Ubuntu12 64bit)<---->USB To Serial cable (5v)<---->serial to (3.3V)<---->phone when i press power button all i can get is "fmtoolerror" . and there is no more messages only that . I am wounding if that means the phone is not working properly or it could be a cable issue ? Thanks very much .

1 1

Pirelli DP-L10 display subsystem (was Re: JTAG setup for Pirelli DP-L10)
by ubuntugirl 30 Jul '13

30 Jul '13

On 7/27/13, Steve Markgraf <steve(a)steve-m.de> wrote: > Unfortunately there's only a datasheet of the SPCA554 floating around, > just search for "SPCA554AV02". Found it, thanks. > unfortunately the SPCA552 and 554 seem to have quite a few differences, > so not everything could be figured out. Yeah, the differences do seem big indeed. While I was searching around for an SPCA552E datasheet, I found this: http://www.download.revosupport.com/scp2009_download_folder!/BONUS%20MEMBER… On page 12 of that schematic there's our lovely Sunplus chip. Of course it's a totally different phone, but at least we can see what are the pin interfaces coming off this chip. In the above schematic, we see that SPCA552E connects to just the host CPU, the LCM and the camera - no frills. But the 554 datasheet you've found describes a much more complex device - adds USB, audio, mass storage... > At least it was enough information to get the bypass mode working, > which was my main goal. Were you ever able to figure out just how the backlight works on this display? Your code has a comment about a particular register in the SPCA supposedly turning the BL on or off, but looking at the pin interfaces of this SPCA in the Nokia schematic, I don't see anything even remotely related to the backlight... Yet the original firmware is able to not only turn this BL on and off at will, but also change the brightness - during calls, the display dims instead of blanking completely. On a related note, were you ever able to figure out the pinout of the 30-pin flex between the main PCB and the LCM? If this pinout were known, I could probably trace out the stuff of interest to me (like the backlight) on the main PCB using your layer pictures, but if I have to reverse-eng the LCM itself, that might be a bit above my skill level. :( > Since the SPCA has an integrated 8051 core, you probably need to upload > proprietary code to get the camera working, or you have to rewrite the > firmware for this chip as well... Bummer. But just out of curiosity, how did you figure out that it's an 8051? Did you see the original phone fw pushing something to the SPCA that looked like 8051 instructions? FWIW, the 554 datasheet describes its CPU as a "32-bit RISC processor" - too closed to even name what it is! Kim

2 3

JTAG setup for Pirelli DP-L10
by ubuntugirl 27 Jul '13

27 Jul '13

Hello, I finally got some time to play with OsmocomBB again. It works intermittently on my Pirelli DP-L10: sometimes ok, other times MO call attempts fail inexplicably and there are messages pouring in the vty window about network contact being lost and reestablished. I suspect that the lack of RF calibration may be an issue, especially considering that I'm in PCS land whereas most active developers are in EGSM/DCS. So I got this crazy idea: what if we can figure out where and how the original factory calibration values are stored, and make use of them? It looks like the last 64kb sector of the flash (at 0x027f0000 as seen by the cpu) is where the factory data are stored, but the format looks incomprehensible. :( So here's what I'm thinking: I would like to try putting JTAG on this phone, and using a hardware watchpoint to catch where the proprietary fw reads from the 0x027f0000-0x027fffff region. I saw in the Wiki that there is an unpopulated footprint for a JTAG connector, and upon taking my phone apart, I have confirmed that it's there indeed. But I wonder, has anyone here (steve-m perhaps?) actually used this JTAG interface and got it to work? If someone has, I'd like to ask the following: * What connector part did you populate on that footprint? * What actual JTAG adapter gadget did you use? * How did you connect that JTAG adapter gadget to the phone? Thanks, Kim

2 3

Calypso phone with RX filters removed
by George Andguladze 16 Jul '13

16 Jul '13

Hi List, Could anyone suggest me where to buy a C155 with RX filters removed? My soldering skills are not that great so I am trying to avoid buying the filter replacement kit from here http://shop.sysmocom.de/products/osmocombb-filter-kit and doing it myself. It seems from the mailing list (http://comments.gmane.org/gmane.comp.mobile.osmocom.baseband.devel/1840) that you could buy it from shop.sysmocom.de, but not anymore? Kind Regards George AndguladzeSenior Software EngineerBusiness Management Technology www.bmt.ge

1 0

[ADMIN] Wanted: List moderator
by Harald Welte 08 Jul '13

08 Jul '13

Dear Osmocom community, I'm currently looking for one or multiple volunteers who are willing to tend to the mailman 'moderator queue' of the various osmocom mailing lists (baseband-devel, openbsc, simtrace, tetra, osmocom-pcu, ...) Our lists are 'member posting only' to protect them from spam. This means that spammers will be caught in the list moderation queue together with the occasional legitimate message from a non-subscriber. You need to manually look over that queue in the mailman web interface, select those legitimate posts as 'approve' and 'defer' all others. The task requires very few minutes, but it requires them every day or second day. It is a perfect opportunity how non-developers can contribute to the project :) Please let me know if anyone is willing to take care of this. Thanks! Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

3 2