API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Aug 14th, 2012
709
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 37.58 KB | None | 0 0
raw download clone embed print report
  1. /* CCCH passive sniffer */
  2. /* (C) 2010-2011 by Holger Hans Peter Freyther
  3.  * (C) 2010 by Harald Welte <laforge@gnumonks.org>
  4.  *
  5.  * All Rights Reserved
  6.  *
  7.  * This program is free software; you can redistribute it and/or modify
  8.  * it under the terms of the GNU General Public License as published by
  9.  * the Free Software Foundation; either version 2 of the License, or
  10.  * (at your option) any later version.
  11.  *
  12.  * This program is distributed in the hope that it will be useful,
  13.  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14.  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15.  * GNU General Public License for more details.
  16.  *
  17.  * You should have received a copy of the GNU General Public License along
  18.  * with this program; if not, write to the Free Software Foundation, Inc.,
  19.  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  20.  *
  21.  */
  22.  
  23. #include <stdint.h>
  24. #include <errno.h>
  25. #include <stdio.h>
  26. #include <stdlib.h>
  27. #include <time.h>
  28. #include <getopt.h>
  29. #include <string.h>
  30.  
  31. #include <arpa/inet.h>
  32.  
  33. #include <osmocom/core/msgb.h>
  34. #include <osmocom/gsm/rsl.h>
  35. #include <osmocom/gsm/tlv.h>
  36. #include <osmocom/gsm/gsm48_ie.h>
  37. #include <osmocom/gsm/gsm48.h>
  38. #include <osmocom/core/signal.h>
  39. #include <osmocom/gsm/protocol/gsm_04_08.h>
  40. #include <osmocom/core/gsmtap_util.h>
  41. #include <osmocom/core/bits.h>
  42. #include <osmocom/gsm/a5.h>
  43.  
  44. #include <osmocom/bb/common/logging.h>
  45. #include <osmocom/bb/misc/rslms.h>
  46. #include <osmocom/bb/misc/layer3.h>
  47. #include <osmocom/bb/common/osmocom_data.h>
  48. #include <osmocom/bb/common/l1ctl.h>
  49. #include <osmocom/bb/common/l23_app.h>
  50.  
  51. #include <l1ctl_proto.h>
  52.  
  53. #include <osmocom/bb/misc/xcch.h>
  54. #include <codec.h>
  55. #include "conv_tch_afs.h"
  56.  
  57. extern FILE *log_tmsi;
  58. extern struct gsmtap_inst *gsmtap_inst;
  59. FILE *d_speech_file;
  60. const unsigned char amr_nb_magic[6] = { 0x23, 0x21, 0x41, 0x4d, 0x52, 0x0a };
  61.  
  62. enum dch_state_t {
  63.     DCH_NONE,
  64.     CCCH_ACTIVE,
  65.     DCH_WAIT_EST,
  66.     DCH_ACTIVE,
  67.     DCH_TCH,
  68.     DCH_WAIT_REL,
  69. };
  70.  
  71. static struct amr{
  72.     uint8_t amr_acs;
  73.     uint8_t start_mode;
  74. };
  75.  
  76. static struct amr_current{
  77.     uint8_t mode;
  78.     uint8_t i;
  79. };
  80.  
  81. static struct {
  82.     int         has_si1;
  83.     int         has_si3;
  84.     int         ccch_mode;
  85.     int         neci;
  86.     int         sys_count;
  87.        
  88.     enum dch_state_t    dch_state;
  89.     uint8_t         dch_nr;
  90.     int         dch_badcnt;
  91.     int         dch_ciph;
  92.  
  93.     FILE *          fh;
  94.  
  95.     sbit_t          bursts_dl[116 * 4];
  96.     sbit_t          bursts_ul[116 * 4];
  97.     sbit_t          bursts_ccch[4][116*4];
  98.     sbit_t          mI[8][114];
  99.  
  100.     struct gsm_sysinfo_freq cell_arfcns[1024];
  101.  
  102.     uint8_t         kc[8];
  103.     uint8_t         speed_mode;
  104.  
  105.     struct  gsm48_ass_cmd  ia;
  106. } app_state;
  107.  
  108. static char *
  109. gen_filename(struct osmocom_ms *ms, struct l1ctl_burst_ind *bi)
  110. {
  111.     static char buffer[256];
  112.     time_t d;
  113.     struct tm lt;
  114.  
  115.     time(&d);
  116.     localtime_r(&d, &lt);
  117.  
  118.     snprintf(buffer, 256, "voice_%04d%02d%02d_%02d%02d_%d_%d_%02x.amr",
  119.         lt.tm_year + 1900, lt.tm_mon, lt.tm_mday,
  120.         lt.tm_hour, lt.tm_min,
  121.         ms->test_arfcn,
  122.         ntohl(bi->frame_nr),
  123.         bi->chan_nr
  124.     );
  125.  
  126.     return buffer;
  127. }
  128.  
  129. static void dump_bcch(struct osmocom_ms *ms, uint8_t tc, const uint8_t *data)
  130. {
  131.     if(app_state.dch_state == DCH_TCH)
  132.     {
  133.         //BCCH- SDCCH - BCCH -TCH
  134.         struct  gsm48_ass_cmd *ia;
  135.         uint8_t ch_type, ch_subch, ch_ts;
  136.  
  137.         ia = &app_state.ia;
  138.  
  139.         rsl_dec_chan_nr(ia->chan_desc.chan_nr, &ch_type, &ch_subch, &ch_ts);           
  140.        
  141.         if (!ia->chan_desc.h0.h) {
  142.             /* Non-hopping */
  143.             uint16_t arfcn;
  144.        
  145.             arfcn = ia->chan_desc.h0.arfcn_low | (ia->chan_desc.h0.arfcn_high << 8);
  146.  
  147.             LOGP(DRR, LOGL_NOTICE, "ASS CMD(chan_nr=0x%02x, "
  148.                 "ARFCN=%u, TS=%u, SS=%u, TSC=%u) ",
  149.                 ia->chan_desc.chan_nr, arfcn, ch_ts, ch_subch,
  150.                 ia->chan_desc.h0.tsc);
  151.                
  152.             /* request L1 to go to dedicated mode on assigned channel */
  153.             l1ctl_tx_dm_est_req_h0(ms,
  154.                 arfcn, ia->chan_desc.chan_nr, ia->chan_desc.h0.tsc,
  155.                 GSM48_CMODE_SPEECH_EFR, 0);
  156.         }
  157.         else
  158.         {
  159.             printf("unsuport hopping!\n");
  160.         }
  161.        
  162.         return;
  163.     }
  164.  
  165.     struct gsm48_system_information_type_header *si_hdr;
  166.     si_hdr = (struct gsm48_system_information_type_header *) data;
  167.  
  168.     /* GSM 05.02 §6.3.1.3 Mapping of BCCH data */
  169.     switch (si_hdr->system_information) {
  170.     case GSM48_MT_RR_SYSINFO_1:
  171. #ifdef BCCH_TC_CHECK
  172.         if (tc != 0)
  173.             LOGP(DRR, LOGL_ERROR, "SI1 on the wrong TC: %d\n", tc);
  174. #endif
  175.         if (!app_state.has_si1) {
  176.             struct gsm48_system_information_type_1 *si1 =
  177.                 (struct gsm48_system_information_type_1 *)data;
  178.  
  179.             gsm48_decode_freq_list(app_state.cell_arfcns,
  180.                                    si1->cell_channel_description,
  181.                            sizeof(si1->cell_channel_description),
  182.                            0xff, 0x01);
  183.  
  184.             app_state.has_si1 = 1;
  185.             LOGP(DRR, LOGL_ERROR, "SI1 received.\n");
  186.         }
  187.         break;
  188.     case GSM48_MT_RR_SYSINFO_2:
  189. #ifdef BCCH_TC_CHECK
  190.         if (tc != 1)
  191.             LOGP(DRR, LOGL_ERROR, "SI2 on the wrong TC: %d\n", tc);
  192. #endif
  193.         break;
  194.     case GSM48_MT_RR_SYSINFO_3:
  195. #ifdef BCCH_TC_CHECK
  196.         if (tc != 2 && tc != 6)
  197.             LOGP(DRR, LOGL_ERROR, "SI3 on the wrong TC: %d\n", tc);
  198. #endif     
  199.         if(!app_state.has_si3)
  200.         {
  201.             if (app_state.ccch_mode == CCCH_MODE_NONE) {
  202.                 struct gsm48_system_information_type_3 *si3 =
  203.                     (struct gsm48_system_information_type_3 *)data;
  204.                 //printf("si3->control_channel_desc.ccch_conf = %d\n",si3->control_channel_desc.ccch_conf);
  205.                 switch (si3->control_channel_desc.ccch_conf) {
  206.                     case RSL_BCCH_CCCH_CONF_1_C:
  207.                         app_state.ccch_mode = CCCH_MODE_COMBINED;
  208.                         break; 
  209.                     case RSL_BCCH_CCCH_CONF_1_NC:
  210.                         app_state.ccch_mode = CCCH_MODE_NON_COMBINED;
  211.                         break; 
  212.                     case RSL_BCCH_CCCH_CONF_2_NC:
  213.                         app_state.ccch_mode = CCCH_MODE_NON_COMBINED2;
  214.                         break; 
  215.                     case RSL_BCCH_CCCH_CONF_3_NC:
  216.                         app_state.ccch_mode = CCCH_MODE_NON_COMBINED4;
  217.                         break; 
  218.                     case RSL_BCCH_CCCH_CONF_4_NC:
  219.                         app_state.ccch_mode = CCCH_MODE_NON_COMBINED6;
  220.                         break; 
  221.                     default:
  222.                         fprintf(stderr, "\tUnknown CCCH_MODE\n");
  223.                         return;                    
  224.                 }
  225.                 app_state.neci = si3->cell_sel_par.neci;
  226.                 app_state.has_si3 = 1;
  227.  
  228.                 l1ctl_tx_ccch_mode_req(ms, app_state.ccch_mode);
  229.             }      
  230.         }
  231.  
  232.         break;
  233.     case GSM48_MT_RR_SYSINFO_4:
  234. #ifdef BCCH_TC_CHECK
  235.         if (tc != 3 && tc != 7)
  236.             LOGP(DRR, LOGL_ERROR, "SI4 on the wrong TC: %d\n", tc);
  237. #endif
  238.         break;
  239.     case GSM48_MT_RR_SYSINFO_5:
  240.         break;
  241.     case GSM48_MT_RR_SYSINFO_6:
  242.         break;
  243.     case GSM48_MT_RR_SYSINFO_7:
  244. #ifdef BCCH_TC_CHECK
  245.         if (tc != 7)
  246.             LOGP(DRR, LOGL_ERROR, "SI7 on the wrong TC: %d\n", tc);
  247. #endif
  248.         break;
  249.     case GSM48_MT_RR_SYSINFO_8:
  250. #ifdef BCCH_TC_CHECK
  251.         if (tc != 3)
  252.             LOGP(DRR, LOGL_ERROR, "SI8 on the wrong TC: %d\n", tc);
  253. #endif
  254.         break;
  255.     case GSM48_MT_RR_SYSINFO_9:
  256. #ifdef BCCH_TC_CHECK
  257.         if (tc != 4)
  258.             LOGP(DRR, LOGL_ERROR, "SI9 on the wrong TC: %d\n", tc);
  259. #endif
  260.         break;
  261.     case GSM48_MT_RR_SYSINFO_13:
  262. #ifdef BCCH_TC_CHECK
  263.         if (tc != 4 && tc != 0)
  264.             LOGP(DRR, LOGL_ERROR, "SI13 on the wrong TC: %d\n", tc);
  265. #endif
  266.         break;
  267.     case GSM48_MT_RR_SYSINFO_16:
  268. #ifdef BCCH_TC_CHECK
  269.         if (tc != 6)
  270.             LOGP(DRR, LOGL_ERROR, "SI16 on the wrong TC: %d\n", tc);
  271. #endif
  272.         break;
  273.     case GSM48_MT_RR_SYSINFO_17:
  274. #ifdef BCCH_TC_CHECK
  275.         if (tc != 2)
  276.             LOGP(DRR, LOGL_ERROR, "SI17 on the wrong TC: %d\n", tc);
  277. #endif
  278.         break;
  279.     case GSM48_MT_RR_SYSINFO_2bis:
  280. #ifdef BCCH_TC_CHECK
  281.         if (tc != 5)
  282.             LOGP(DRR, LOGL_ERROR, "SI2bis on the wrong TC: %d\n", tc);
  283. #endif
  284.         break;
  285.     case GSM48_MT_RR_SYSINFO_2ter:
  286. #ifdef BCCH_TC_CHECK
  287.         if (tc != 5 && tc != 4)
  288.             LOGP(DRR, LOGL_ERROR, "SI2ter on the wrong TC: %d\n", tc);
  289. #endif
  290.         break;
  291.     case GSM48_MT_RR_SYSINFO_5bis:
  292.         break;
  293.     case GSM48_MT_RR_SYSINFO_5ter:
  294.         break;
  295.     default:
  296.         app_state.sys_count++;
  297.         if(app_state.sys_count == 2)
  298.             l1ctl_tx_reset_req(ms, L1CTL_RES_T_FULL);
  299.         fprintf(stderr, "\tUnknown SI\n");
  300.         break;
  301.     };
  302. }
  303.  
  304.  
  305. /**
  306.  * This method used to send a l1ctl_tx_dm_est_req_h0 or
  307.  * a l1ctl_tx_dm_est_req_h1 to the layer1 to follow this
  308.  * assignment. The code has been removed.
  309.  */
  310. static int gsm48_rx_imm_ass(struct msgb *msg, struct osmocom_ms *ms)
  311. {
  312.     struct gsm48_imm_ass *ia = msgb_l3(msg);
  313.     uint8_t ch_type, ch_subch, ch_ts;
  314.     int rv;
  315.     uint8_t chan_req_val, chan_req_mask, ra;
  316.  
  317.     /* Discard packet TBF assignement */
  318.     if (ia->page_mode & 0xf0)
  319.         return 0;
  320.  
  321.     /* If we're not ready yet, or just busy ... */
  322.     if ((!app_state.has_si1) || (!app_state.has_si3) || (app_state.dch_state != DCH_NONE))
  323.         return 0;
  324.     printf("imm_ra %x,################!\n",ia->req_ref.ra);
  325.  
  326.     rsl_dec_chan_nr(ia->chan_desc.chan_nr, &ch_type, &ch_subch, &ch_ts);
  327.  
  328.     if (!ia->chan_desc.h0.h) {
  329.         /* Non-hopping */
  330.         uint16_t arfcn;
  331.  
  332.         arfcn = ia->chan_desc.h0.arfcn_low | (ia->chan_desc.h0.arfcn_high << 8);
  333.  
  334.         LOGP(DRR, LOGL_NOTICE, "GSM48 IMM ASS (ra=0x%02x, chan_nr=0x%02x, "
  335.             "ARFCN=%u, TS=%u, SS=%u, TSC=%u) ", ia->req_ref.ra,
  336.             ia->chan_desc.chan_nr, arfcn, ch_ts, ch_subch,
  337.             ia->chan_desc.h0.tsc);
  338.  
  339.         /* request L1 to go to dedicated mode on assigned channel */
  340.         rv = l1ctl_tx_dm_est_req_h0(ms,
  341.             arfcn, ia->chan_desc.chan_nr, ia->chan_desc.h0.tsc,
  342.             GSM48_CMODE_SIGN, 0);
  343.     } else {
  344.         /* Hopping */
  345.         uint8_t maio, hsn, ma_len;
  346.         uint16_t ma[64], arfcn;
  347.         int i, j, k;
  348.  
  349.         hsn = ia->chan_desc.h1.hsn;
  350.         maio = ia->chan_desc.h1.maio_low | (ia->chan_desc.h1.maio_high << 2);
  351.  
  352.         LOGP(DRR, LOGL_NOTICE, "GSM48 IMM ASS (ra=0x%02x, chan_nr=0x%02x, "
  353.             "HSN=%u, MAIO=%u, TS=%u, SS=%u, TSC=%u) ", ia->req_ref.ra,
  354.             ia->chan_desc.chan_nr, hsn, maio, ch_ts, ch_subch,
  355.             ia->chan_desc.h1.tsc);
  356.  
  357.         /* decode mobile allocation */
  358.         ma_len = 0;
  359.         for (i=1, j=0; i<=1024; i++) {
  360.             arfcn = i & 1023;
  361.             if (app_state.cell_arfcns[arfcn].mask & 0x01) {
  362.                 k = ia->mob_alloc_len - (j>>3) - 1;
  363.                 if (ia->mob_alloc[k] & (1 << (j&7))) {
  364.                     ma[ma_len++] = arfcn;
  365.                 }
  366.                 j++;
  367.             }
  368.         }
  369.  
  370.         /* request L1 to go to dedicated mode on assigned channel */
  371.         rv = l1ctl_tx_dm_est_req_h1(ms,
  372.             maio, hsn, ma, ma_len,
  373.             ia->chan_desc.chan_nr, ia->chan_desc.h1.tsc,
  374.             GSM48_CMODE_SIGN, 0);
  375.     }
  376.  
  377.     LOGPC(DRR, LOGL_NOTICE, "\n");
  378.  
  379.     /* Set state */
  380.     app_state.dch_state = DCH_WAIT_EST;
  381.     app_state.dch_nr = ia->chan_desc.chan_nr;
  382.     app_state.dch_badcnt = 0;
  383.  
  384.     return rv;
  385. }
  386.  
  387. static const char *pag_print_mode(int mode)
  388. {
  389.     switch (mode) {
  390.     case 0:
  391.         return "Normal paging";
  392.     case 1:
  393.         return "Extended paging";
  394.     case 2:
  395.         return "Paging reorganization";
  396.     case 3:
  397.         return "Same as before";
  398.     default:
  399.         return "invalid";
  400.     }
  401. }
  402.  
  403. static char *chan_need(int need)
  404. {
  405.     switch (need) {
  406.     case 0:
  407.         return "any";
  408.     case 1:
  409.         return "sdch";
  410.     case 2:
  411.         return "tch/f";
  412.     case 3:
  413.         return "tch/h";
  414.     default:
  415.         return "invalid";
  416.     }
  417. }
  418.  
  419. static char *mi_type_to_string(int type)
  420. {
  421.     switch (type) {
  422.     case GSM_MI_TYPE_NONE:
  423.         return "none";
  424.     case GSM_MI_TYPE_IMSI:
  425.         return "imsi";
  426.     case GSM_MI_TYPE_IMEI:
  427.         return "imei";
  428.     case GSM_MI_TYPE_IMEISV:
  429.         return "imeisv";
  430.     case GSM_MI_TYPE_TMSI:
  431.         return "tmsi";
  432.     default:
  433.         return "invalid";
  434.     }
  435. }
  436.  
  437. /**
  438.  * This can contain two MIs. The size checking is a bit of a mess.
  439.  */
  440. static int gsm48_rx_paging_p1(struct msgb *msg, struct osmocom_ms *ms)
  441. {
  442.     struct gsm48_paging1 *pag;
  443.     int len1, len2, mi_type, tag;
  444.     char mi_string[GSM48_MI_SIZE];
  445.  
  446.     /* is there enough room for the header + LV? */
  447.     if (msgb_l3len(msg) < sizeof(*pag) + 2) {
  448.         LOGP(DRR, LOGL_ERROR, "PagingRequest is too short.\n");
  449.         return -1;
  450.     }
  451.  
  452.     pag = msgb_l3(msg);
  453.     len1 = pag->data[0];
  454.     mi_type = pag->data[1] & GSM_MI_TYPE_MASK;
  455.  
  456.     if (msgb_l3len(msg) < sizeof(*pag) + 2 + len1) {
  457.         LOGP(DRR, LOGL_ERROR, "PagingRequest with wrong MI\n");
  458.         return -1;
  459.     }
  460.  
  461.     if (mi_type != GSM_MI_TYPE_NONE) {
  462.         gsm48_mi_to_string(mi_string, sizeof(mi_string), &pag->data[1], len1);
  463.         LOGP(DRR, LOGL_NOTICE, "Paging1: %s chan %s to %s M(%s) \n",
  464.              pag_print_mode(pag->pag_mode),
  465.              chan_need(pag->cneed1),
  466.              mi_type_to_string(mi_type),
  467.              mi_string);
  468.         fputs(mi_string,log_tmsi);
  469.         fputs("\n",log_tmsi);
  470.     }
  471.  
  472.     /* check if we have a MI type in here */
  473.     if (msgb_l3len(msg) < sizeof(*pag) + 2 + len1 + 3)
  474.         return 0;
  475.  
  476.     tag = pag->data[2 + len1 + 0];
  477.     len2 = pag->data[2 + len1 + 1];
  478.     mi_type = pag->data[2 + len1 + 2] & GSM_MI_TYPE_MASK;
  479.     if (tag == GSM48_IE_MOBILE_ID && mi_type != GSM_MI_TYPE_NONE) {
  480.         if (msgb_l3len(msg) < sizeof(*pag) + 2 + len1 + 3 + len2) {
  481.             LOGP(DRR, LOGL_ERROR, "Optional MI does not fit here.\n");
  482.             return -1;
  483.         }
  484.  
  485.         gsm48_mi_to_string(mi_string, sizeof(mi_string), &pag->data[2 + len1 + 2], len2);
  486.         LOGP(DRR, LOGL_NOTICE, "Paging2: %s chan %s to %s M(%s) \n",
  487.              pag_print_mode(pag->pag_mode),
  488.              chan_need(pag->cneed2),
  489.              mi_type_to_string(mi_type),
  490.              mi_string);
  491.         fputs(mi_string,log_tmsi);
  492.         fputs("\n",log_tmsi);
  493.     }
  494.     return 0;
  495. }
  496. char temp[20];
  497. static int gsm48_rx_paging_p2(struct msgb *msg, struct osmocom_ms *ms)
  498. {
  499.     struct gsm48_paging2 *pag;
  500.     int tag, len, mi_type;
  501.     char mi_string[GSM48_MI_SIZE];
  502.  
  503.     if (msgb_l3len(msg) < sizeof(*pag)) {
  504.         LOGP(DRR, LOGL_ERROR, "Paging2 message is too small.\n");
  505.         return -1;
  506.     }
  507.     memset(temp,0,sizeof(temp));
  508.     pag = msgb_l3(msg);
  509.     LOGP(DRR, LOGL_NOTICE, "Paging1: %s chan %s to TMSI M(0x%x) \n",
  510.              pag_print_mode(pag->pag_mode),
  511.              chan_need(pag->cneed1), pag->tmsi1);
  512.     memset(temp,0,sizeof(temp));
  513.     sprintf(temp, "%x", ntohl(pag->tmsi1));
  514.     fputs(temp,log_tmsi);
  515.     fputs("\n",log_tmsi);
  516.  
  517.     LOGP(DRR, LOGL_NOTICE, "Paging2: %s chan %s to TMSI M(0x%x) \n",
  518.              pag_print_mode(pag->pag_mode),
  519.              chan_need(pag->cneed2), ntohl(pag->tmsi2));
  520.     memset(temp,0,sizeof(temp));
  521.     sprintf(temp, "%x", pag->tmsi2);
  522.     fputs( temp,log_tmsi);
  523.     fputs("\n",log_tmsi);
  524.  
  525.     /* no optional element */
  526.     if (msgb_l3len(msg) < sizeof(*pag) + 3)
  527.         return 0;
  528.  
  529.     tag = pag->data[0];
  530.     len = pag->data[1];
  531.     mi_type = pag->data[2] & GSM_MI_TYPE_MASK;
  532.  
  533.     if (tag != GSM48_IE_MOBILE_ID)
  534.         return 0;
  535.  
  536.     if (msgb_l3len(msg) < sizeof(*pag) + 3 + len) {
  537.         LOGP(DRR, LOGL_ERROR, "Optional MI does not fit in here\n");
  538.         return -1;
  539.     }
  540.  
  541.     gsm48_mi_to_string(mi_string, sizeof(mi_string), &pag->data[2], len);
  542.     LOGP(DRR, LOGL_NOTICE, "Paging3: %s chan %s to %s M(%s) \n",
  543.          pag_print_mode(pag->pag_mode),
  544.          "n/a ",
  545.          mi_type_to_string(mi_type),
  546.          mi_string);
  547.     fputs(mi_string,log_tmsi);
  548.     fputs("\n",log_tmsi);
  549.     return 0;
  550. }
  551.  
  552. static int gsm48_rx_paging_p3(struct msgb *msg, struct osmocom_ms *ms)
  553. {
  554.     struct gsm48_paging3 *pag;
  555.  
  556.     if (msgb_l3len(msg) < sizeof(*pag)) {
  557.         LOGP(DRR, LOGL_ERROR, "Paging3 message is too small.\n");
  558.         return -1;
  559.     }
  560.  
  561.     pag = msgb_l3(msg);
  562.     LOGP(DRR, LOGL_NOTICE, "Paging1: %s chan %s to TMSI M(0x%x) \n",
  563.              pag_print_mode(pag->pag_mode),
  564.              chan_need(pag->cneed1), pag->tmsi1);
  565.     memset(temp,0,sizeof(temp));
  566.     sprintf(temp, "%x", ntohl(pag->tmsi1));
  567.     fputs(temp,log_tmsi);
  568.     fputs("\n",log_tmsi);
  569.     LOGP(DRR, LOGL_NOTICE, "Paging2: %s chan %s to TMSI M(0x%x) \n",
  570.              pag_print_mode(pag->pag_mode),
  571.              chan_need(pag->cneed2), pag->tmsi2);
  572.     memset(temp,0,sizeof(temp));
  573.     sprintf(temp, "%x", ntohl(pag->tmsi2));
  574.     fputs(temp,log_tmsi);
  575.     fputs("\n",log_tmsi);
  576.     LOGP(DRR, LOGL_NOTICE, "Paging3: %s chan %s to TMSI M(0x%x) \n",
  577.              pag_print_mode(pag->pag_mode),
  578.              "n/a ", pag->tmsi3);
  579.     memset(temp,0,sizeof(temp));
  580.     sprintf(temp, "%x", ntohl(pag->tmsi3));
  581.     fputs(temp,log_tmsi);
  582.     fputs("\n",log_tmsi);
  583.     LOGP(DRR, LOGL_NOTICE, "Paging4: %s chan %s to TMSI M(0x%x) \n",
  584.              pag_print_mode(pag->pag_mode),
  585.              "n/a ", pag->tmsi4);
  586.     memset(temp,0,sizeof(temp));
  587.     sprintf(temp, "%x", ntohl(pag->tmsi4));
  588.     fputs(temp,log_tmsi);
  589.     fputs("\n",log_tmsi);
  590.     return 0;
  591. }
  592.  
  593.  
  594. int gsm48_rx_ccch(struct msgb *msg, struct osmocom_ms *ms)
  595. {
  596.     struct gsm48_system_information_type_header *sih = msgb_l3(msg);
  597.     int rc = 0;
  598.  
  599.     if(app_state.dch_state == DCH_TCH)
  600.     {
  601.         //BCCH- SDCCH - BCCH -TCH
  602.         struct  gsm48_ass_cmd *ia;
  603.         uint8_t ch_type, ch_subch, ch_ts;
  604.  
  605.         ia = &app_state.ia;
  606.  
  607.         rsl_dec_chan_nr(ia->chan_desc.chan_nr, &ch_type, &ch_subch, &ch_ts);           
  608.        
  609.         if (!ia->chan_desc.h0.h) {
  610.             /* Non-hopping */
  611.             uint16_t arfcn;
  612.        
  613.             arfcn = ia->chan_desc.h0.arfcn_low | (ia->chan_desc.h0.arfcn_high << 8);
  614.  
  615.             LOGP(DRR, LOGL_NOTICE, "ASS CMD(chan_nr=0x%02x, "
  616.                 "ARFCN=%u, TS=%u, SS=%u, TSC=%u) ",
  617.                 ia->chan_desc.chan_nr, arfcn, ch_ts, ch_subch,
  618.                 ia->chan_desc.h0.tsc);
  619.                
  620.             /* request L1 to go to dedicated mode on assigned channel */
  621.             l1ctl_tx_dm_est_req_h0(ms,
  622.                 arfcn, ia->chan_desc.chan_nr, ia->chan_desc.h0.tsc,
  623.                 GSM48_CMODE_SPEECH_EFR, 0);
  624.         }
  625.         else
  626.         {
  627.             printf("unsuport hopping!\n");
  628.         }
  629.        
  630.         return 0;
  631.     }
  632.     /* CCCH marks the end of WAIT_REL */
  633.     if (app_state.dch_state == DCH_WAIT_REL)
  634.         app_state.dch_state = DCH_NONE;
  635.  
  636.     if (sih->rr_protocol_discriminator != GSM48_PDISC_RR)
  637.         LOGP(DRR, LOGL_ERROR, "PCH pdisc != RR\n");
  638.  
  639.     switch (sih->system_information) {
  640.     case GSM48_MT_RR_PAG_REQ_1:
  641.         gsm48_rx_paging_p1(msg, ms);
  642.         break;
  643.     case GSM48_MT_RR_PAG_REQ_2:
  644.         gsm48_rx_paging_p2(msg, ms);
  645.         break;
  646.     case GSM48_MT_RR_PAG_REQ_3:
  647.         gsm48_rx_paging_p3(msg, ms);
  648.         break;
  649.     case GSM48_MT_RR_IMM_ASS:
  650.         gsm48_rx_imm_ass(msg, ms);
  651.         break;
  652.     case GSM48_MT_RR_NOTIF_NCH:
  653.         /* notification for voice call groups and such */
  654.         break;
  655.     case 0x07:
  656.         /* wireshark know that this is SI2 quater and for 3G interop */
  657.         break;
  658.     default:
  659.         LOGP(DRR, LOGL_NOTICE, "unknown PCH/AGCH type 0x%02x\n",
  660.             sih->system_information);
  661.         rc = -EINVAL;
  662.     }
  663.  
  664.     return rc;
  665. }
  666.  
  667. int gsm48_rx_bcch(struct msgb *msg, struct osmocom_ms *ms)
  668. {
  669.     /* BCCH marks the end of WAIT_REL */
  670.     if (app_state.dch_state == DCH_WAIT_REL)
  671.         app_state.dch_state = DCH_NONE;
  672.  
  673.     /* FIXME: we have lost the gsm frame time until here, need to store it
  674.      * in some msgb context */
  675.     //dump_bcch(dl->time.tc, ccch->data);
  676.     dump_bcch(ms, 0, msg->l3h);
  677.  
  678.     return 0;
  679. }
  680.  
  681. void tch_deinterleave(ubit_t *mC, int blockOffset)
  682. {
  683.     int k;
  684.     for (k = 0; k < 456; k++) {
  685.         int B = ( k + blockOffset ) % 8;
  686.         int j = 2 * ((49 * k) % 57) + ((k % 8) / 4);
  687.         mC[k] = app_state.mI[B][j];
  688.     }
  689. }
  690.  
  691. void tch_unmap(const uint16_t *map, size_t mapSize, ubit_t * dest, ubit_t * soure)
  692. {
  693.     unsigned int i;
  694.     for(i=0; i<mapSize; i++)
  695.     {
  696.         dest[map[i]] = soure[i];
  697.     }
  698. }
  699.  
  700. void tch_map(const uint16_t *map, size_t mapSize, ubit_t * dest, ubit_t * soure)
  701. {
  702.     unsigned int i;
  703.     for(i=0; i<mapSize; i++)
  704.     {
  705.         dest[i] = soure[map[i]];
  706.     }
  707. }
  708.  
  709. void fillField(ubit_t *mStart, size_t writeIndex, uint64_t value, unsigned length)
  710. {
  711.     char *dpBase = mStart + writeIndex;
  712.     char *dp = dpBase + length - 1;
  713.  
  714.     while (dp>=dpBase) {
  715.         *dp-- = value & 0x01;
  716.         value >>= 1;
  717.     }
  718. }
  719.  
  720. uint64_t count_tch = 0;
  721. uint32_t flag = 0;
  722. ubit_t hu[8],hl[8];
  723.  
  724. static void process_tch_efr(struct osmocom_ms *ms,struct l1ctl_burst_ind *bi)
  725. {
  726.     int16_t rx_dbm;
  727.     uint16_t arfcn;
  728.     uint32_t fn,B;
  729.     uint8_t cbits, tn, lch_idx;
  730.     int ul, bid, i, k, length;
  731.     sbit_t *bursts, mC[456];
  732.     ubit_t steal_bit[2], bt[116],convu[260],convd[260],tch_raw[260],TCHW[260],EFRBits[244],EFRAMR[8 + 244 +10];
  733.  
  734.     pbit_t voice[33];
  735.     /* Get params (Only for SDCCH and SACCH/{4,8,F,H}) */
  736.     arfcn  = ntohs(bi->band_arfcn);
  737.     rx_dbm = rxlev2dbm(bi->rx_level);
  738.  
  739.     fn     = ntohl(bi->frame_nr);
  740.     ul     = !!(arfcn & ARFCN_UPLINK);
  741.  
  742.     cbits  = bi->chan_nr >> 3;
  743.     tn     = bi->chan_nr & 7;
  744.  
  745.     B  = -1;
  746.  
  747.     if(( fn % 13 ) % 4 == 0) flag = 1;
  748.  
  749.     if(!flag) return;
  750.  
  751.     //B = count_tch % 8;
  752.     B = ( fn % 13 ) % 8;
  753.     printf("fn % 26 = %d, fn % 13 = %d, B = %d\n",fn%26 , fn%13 , B);
  754.  
  755.     if (B == -1)
  756.         return;
  757.  
  758.     /* Unpack (ignore hu/hl) */
  759.     osmo_pbit2ubit_ext(bt,  0, bi->bits,  0, 57, 0);
  760.     osmo_pbit2ubit_ext(bt, 57, bi->bits, 57, 57, 0);
  761.  
  762.  
  763.     /* save stealing flags */
  764.         hl[B] = !!(bi->bits[14] & 0x10); // hl 57
  765.         hu[B] = !!(bi->bits[14] & 0x20); // hu 58
  766.     printf("steal_bit %x , %x\n", hl[B],hu[B]);
  767.  
  768.  
  769.     /* Convert to softbits */
  770.     for (i=0; i<114; i++)
  771.         app_state.mI[B][i] = bt[i] ? - (bi->snr >> 1) : (bi->snr >> 1);
  772.  
  773.     count_tch++;
  774.  
  775.     if((B % 4 ==3)&&(count_tch >= 7)){
  776.         if(B == 3)
  777.         {
  778.             tch_deinterleave(mC, 4);
  779.         }else{
  780.             tch_deinterleave(mC, 0);
  781.         }
  782.  
  783.         for (k = 0; k < 78; k++) {
  784.             tch_raw[182 + k] = mC[378 +k];
  785.         }
  786.  
  787.         osmo_conv_decode(&conv_tch_afs_12_2, mC, convu);
  788.  
  789.         // 3.1.2.1
  790.         // copy class 1 bits u[] to d[]
  791.         for (k = 0; k <= 90; k++) {
  792.             convd[2*k] = convu[k];
  793.             convd[2*k+1] = convu[184-k];
  794.         }
  795.  
  796.         memcpy(tch_raw,convd,182);  // the last 78 bit has been stored!
  797.  
  798.         //now only process EFR or AMR 12_2, fix me!
  799.         tch_unmap(gsm660_bitorder, 260, TCHW, tch_raw);
  800.  
  801.         // Remove repeating bits and CRC to get raw EFR frame (244 bits)
  802.         for (k=0; k<71; k++)
  803.         EFRBits[k] = TCHW[k] & 1;
  804.  
  805.         for (k=73; k<123; k++)
  806.         EFRBits[k-2] = TCHW[k] & 1;
  807.  
  808.         for (k=125; k<178; k++)
  809.         EFRBits[k-4] = TCHW[k] & 1;
  810.  
  811.         for (k=180; k<230; k++)
  812.         EFRBits[k-6] = TCHW[k] & 1;
  813.  
  814.         for (k=232; k<252; k++)
  815.         EFRBits[k-8] = TCHW[k] & 1;
  816.  
  817.         // Map bits as AMR 12.2k
  818.         tch_map(gsm690_12_2_bitorder, 244, EFRAMR + 8,EFRBits);
  819.  
  820.         // Put the whole frame (hdr + payload)
  821.         //mVFrameAMR.pack(mPrevGoodFrame);
  822.         //mPrevGoodFrameLength = 32;
  823.         fillField(EFRAMR, 0, 0x3c, 8);
  824.         voice[32] = 0;
  825.         length = osmo_ubit2pbit(voice, EFRAMR, 8 + 244);
  826.         fwrite(voice, 1, 32, d_speech_file);
  827.     }
  828.  
  829. }
  830.  
  831.  
  832.  
  833. static void process_tch_fr(struct osmocom_ms *ms,struct l1ctl_burst_ind *bi)
  834. {
  835.     int16_t rx_dbm;
  836.     uint16_t arfcn;
  837.     uint32_t fn,B;
  838.     uint8_t cbits, tn, lch_idx;
  839.     int ul, bid, i, k, length;
  840.     sbit_t *bursts, mC[456];
  841.     ubit_t steal_bit[2], bt[116],convu[260],convd[260],tch_raw[260],TCHW[260],EFRBits[244],EFRAMR[8 + 244 +10];
  842.  
  843.     uint8_t voice[33];
  844.     /* Get params (Only for SDCCH and SACCH/{4,8,F,H}) */
  845.     arfcn  = ntohs(bi->band_arfcn);
  846.     rx_dbm = rxlev2dbm(bi->rx_level);
  847.  
  848.     fn     = ntohl(bi->frame_nr);
  849.     ul     = !!(arfcn & ARFCN_UPLINK);
  850.  
  851.     cbits  = bi->chan_nr >> 3;
  852.     tn     = bi->chan_nr & 7;
  853.  
  854.     B  = -1;
  855.    
  856.     if(( fn % 13 ) % 4 == 0) flag = 1;
  857.  
  858.     if(!flag) return;
  859.  
  860.     //B = count_tch % 8;
  861.     B = ( fn % 13 ) % 8;
  862.     printf("fn % 26 = %d, fn % 13 = %d, B = %d\n",fn%26 , fn%13 , B);
  863.  
  864.     if (B == -1)
  865.         return;
  866.  
  867.     /* Unpack (ignore hu/hl) */
  868.     osmo_pbit2ubit_ext(bt,  0, bi->bits,  0, 57, 0);
  869.     osmo_pbit2ubit_ext(bt, 57, bi->bits, 57, 57, 0);
  870.  
  871.  
  872.     /* save stealing flags */
  873.         hl[B] = !!(bi->bits[14] & 0x10); // hl 57
  874.         hu[B] = !!(bi->bits[14] & 0x20); // hu 58
  875.     printf("steal_bit %x , %x\n", hl[B],hu[B]);
  876.  
  877.  
  878.     /* Convert to softbits */
  879.     for (i=0; i<114; i++)
  880.         app_state.mI[B][i] = bt[i] ? - (bi->snr >> 1) : (bi->snr >> 1);
  881.    
  882.     count_tch++;
  883.  
  884.     if((B % 4 ==3)&&(count_tch >= 7)){
  885.         if(B == 3)
  886.         {
  887.             tch_deinterleave(mC, 4);
  888.         }else{
  889.             tch_deinterleave(mC, 0);
  890.         }
  891.  
  892.         for (k = 0; k < 78; k++) {
  893.             tch_raw[182 + k] = mC[378 +k];
  894.         }
  895.    
  896.         osmo_conv_decode(&conv_tch_afs_12_2, mC, convu);
  897.  
  898.         // 3.1.2.1
  899.         // copy class 1 bits u[] to d[]
  900.         for (k = 0; k <= 90; k++) {
  901.             convd[2*k] = convu[k];
  902.             convd[2*k+1] = convu[184-k];
  903.         }
  904.        
  905.         memcpy(tch_raw,convd,182);  // the last 78 bit has been stored!
  906.  
  907.         //now only process EFR or AMR 12_2, fix me!
  908.         tch_unmap(gsm610_bitorder, 260, TCHW, tch_raw);
  909.  
  910.         // Remove repeating bits and CRC to get raw EFR frame (244 bits)
  911.         //for (k=0; k<71; k++)
  912.         //EFRBits[k] = TCHW[k] & 1;
  913.    
  914. //      for (k=73; k<123; k++)
  915.     //  EFRBits[k-2] = TCHW[k] & 1;
  916.     //
  917.         //for (k=125; k<178; k++)
  918.         //EFRBits[k-4] = TCHW[k] & 1;
  919.     //
  920.         //for (k=180; k<230; k++)
  921.         //EFRBits[k-6] = TCHW[k] & 1;
  922.    
  923.         //for (k=232; k<252; k++)
  924.         //EFRBits[k-8] = TCHW[k] & 1;
  925.  
  926.         // Map bits as AMR 12.2k
  927.     //  tch_map(gsm690_12_2_bitorder, 244, EFRAMR + 8,EFRBits);
  928.    
  929.         // Put the whole frame (hdr + payload)
  930.         //mVFrameAMR.pack(mPrevGoodFrame);
  931.         //mPrevGoodFrameLength = 33;
  932.         fillField(TCHW, 0,0x0d,4);
  933.         memset(voice, 0x00, 33);
  934.         length = osmo_ubit2pbit(voice, TCHW, 260);
  935.         fwrite(voice, 1, 33, d_speech_file);       
  936.     }
  937.    
  938. }
  939.  
  940. static void
  941. local_burst_decode(struct osmocom_ms *ms,struct l1ctl_burst_ind *bi)
  942. {
  943.     int16_t rx_dbm;
  944.     uint16_t arfcn;
  945.     uint32_t fn;
  946.     uint8_t cbits, tn, lch_idx;
  947.     int ul, bid, i;
  948.     sbit_t *bursts;
  949.     ubit_t bt[116];
  950.  
  951.     /* Get params (Only for SDCCH and SACCH/{4,8,F,H}) */
  952.     arfcn  = ntohs(bi->band_arfcn);
  953.     rx_dbm = rxlev2dbm(bi->rx_level);
  954.  
  955.     fn     = ntohl(bi->frame_nr);
  956.     ul     = !!(arfcn & ARFCN_UPLINK);
  957.     bursts = ul ? app_state.bursts_ul : app_state.bursts_dl;
  958.  
  959.     cbits  = bi->chan_nr >> 3;
  960.     tn     = bi->chan_nr & 7;
  961.  
  962.     bid    = -1;
  963.  
  964.     if (cbits == 0x01) {            /* TCH/F */
  965.         lch_idx = 0;
  966.         printf("SNR is %d\n",bi->snr);
  967.         if (bi->flags & BI_FLG_SACCH) {
  968.             uint32_t fn_report;
  969.             fn_report = (fn - (tn * 13) + 104) % 104;
  970.             bid = (fn_report - 12) / 26;
  971.             printf(" SACCH fn = %d fn_report = %d\n",fn,fn_report);
  972.         }else{
  973.             switch (app_state.speed_mode ) {
  974.            
  975.                 case GSM48_CMODE_SPEECH_EFR:
  976.                     process_tch_efr(ms,bi);
  977.                     break;
  978.                 case GSM48_CMODE_SPEECH_V1:
  979.                     process_tch_fr(ms,bi);
  980.                     break; 
  981.                 default:
  982.                 {
  983.                     printf("mode is %02x",app_state.speed_mode);                   
  984.                     printf("unknown speed mode! %x\n",app_state.speed_mode);
  985.                     return;
  986.                 }
  987.             }                      
  988.         }
  989.     } else if ((cbits & 0x1e) == 0x02) {    /* TCH/H */
  990.         lch_idx = cbits & 1;
  991.         if (bi->flags & BI_FLG_SACCH) {
  992.             uint32_t fn_report;
  993.             uint8_t tn_report = (tn & ~1) | lch_idx;
  994.             fn_report = (fn - (tn_report * 13) + 104) % 104;
  995.             bid = (fn_report - 12) / 26;
  996.         }
  997.     } else if ((cbits & 0x1c) == 0x04) {    /* SDCCH/4 */
  998.         lch_idx = cbits & 3;
  999.         bid = bi->flags & 3;
  1000.         printf(" SDCCH/4\n");
  1001.     } else if ((cbits & 0x18) == 0x08) {    /* SDCCH/8 */
  1002.         lch_idx = cbits & 7;
  1003.         bid = bi->flags & 3;
  1004.  
  1005.     }
  1006.  
  1007.     if (bid == -1)
  1008.         return;
  1009.  
  1010.     /* Clear if new set */
  1011.     if (bid == 0)
  1012.         memset(bursts, 0x00, 116 * 4);
  1013.  
  1014.     /* Unpack (ignore hu/hl) */
  1015.     osmo_pbit2ubit_ext(bt,  0, bi->bits,  0, 57, 0);
  1016.     osmo_pbit2ubit_ext(bt, 59, bi->bits, 57, 57, 0);
  1017.     bt[57] = bt[58] = 1;
  1018.  
  1019.     /* A5/x */
  1020.     if (app_state.dch_ciph) {
  1021.         ubit_t ks_dl[114], ks_ul[114], *ks = ul ? ks_ul : ks_dl;
  1022.         osmo_a5(app_state.dch_ciph, app_state.kc, fn, ks_dl, ks_ul);
  1023.         for (i= 0; i< 57; i++)  bt[i] ^= ks[i];
  1024.         for (i=59; i<116; i++)  bt[i] ^= ks[i-2];
  1025.     }
  1026.  
  1027.     /* Convert to softbits */
  1028.     for (i=0; i<116; i++)
  1029.         bursts[(116*bid)+i] = bt[i] ? - (bi->snr >> 1) : (bi->snr >> 1);
  1030.  
  1031.     /* If last, decode */
  1032.     if (bid == 3)
  1033.     {
  1034.         uint8_t l2[23];
  1035.         int rv,i;
  1036.         struct  gsm48_ass_cmd *ia;
  1037.         uint8_t ch_type, ch_subch, ch_ts;
  1038.         uint8_t chan_req_val, chan_req_mask, ra;
  1039.  
  1040.         rv = xcch_decode(l2, bursts);
  1041.  
  1042.         if((l2[0] == 0x03) && (l2[4] == 0x2e))
  1043.         {
  1044.             ia =(struct  gsm48_ass_cmd *)&l2[5];
  1045.  
  1046.             memcpy(&app_state.ia , ia, sizeof(struct  gsm48_ass_cmd));
  1047.  
  1048.            
  1049.             app_state.speed_mode = ia->chan_mode.voice_mode;
  1050.  
  1051.             /* Clear if new set */
  1052.             for(i=0; i<8; i++){
  1053.                 memset(app_state.mI[i], 0x00, 114);
  1054.             }        
  1055.  
  1056.             /* open speech file and configure d_tch_decoders */
  1057.             switch (app_state.speed_mode ) {
  1058.    
  1059.                 case GSM48_CMODE_SPEECH_V1:
  1060.                     d_speech_file = fopen( "speech.au.gsm", "wb" );
  1061.                     break;
  1062.                            
  1063.                 default:
  1064.                 {
  1065.                     printf("unknown speed mode! %x\n",app_state.speed_mode);
  1066.                     d_speech_file = NULL;
  1067.                     return;
  1068.                 }
  1069.             }      
  1070.    
  1071.             app_state.dch_state = DCH_TCH;
  1072.  
  1073.             l1ctl_tx_reset_req(ms, L1CTL_RES_T_FULL);   //BCCH- SDCCH - BCCH -TCH
  1074.            
  1075.             return;
  1076.  
  1077.             if (!ia->chan_desc.h0.h) {
  1078.                 /* Non-hopping */
  1079.                 uint16_t arfcn;
  1080.        
  1081.                 arfcn = ia->chan_desc.h0.arfcn_low | (ia->chan_desc.h0.arfcn_high << 8);
  1082.        
  1083.                 LOGP(DRR, LOGL_NOTICE, "ASS CMD(chan_nr=0x%02x, "
  1084.                     "ARFCN=%u, TS=%u, SS=%u, TSC=%u) ",
  1085.                     ia->chan_desc.chan_nr, arfcn, ch_ts, ch_subch,
  1086.                     ia->chan_desc.h0.tsc);
  1087.        
  1088.                 /* request L1 to go to dedicated mode on assigned channel */
  1089.                 rv = l1ctl_tx_dm_est_req_h0(ms,
  1090.                     arfcn, ia->chan_desc.chan_nr, ia->chan_desc.h0.tsc,
  1091.                     GSM48_CMODE_SPEECH_EFR, 0);
  1092.             }
  1093.         #ifdef TCH_HOPPING 
  1094.             else {
  1095.                 /* Hopping is not support now! */
  1096.                 uint8_t maio, hsn, ma_len;
  1097.                 uint16_t ma[64], arfcn;
  1098.                 int i, j, k;
  1099.  
  1100.                 //initialize tch count and flag
  1101.                 count_tch = 0;
  1102.                 flag = 0;
  1103.  
  1104.                 hsn = ia->chan_desc.h1.hsn;
  1105.                 maio = ia->chan_desc.h1.maio_low | (ia->chan_desc.h1.maio_high << 2);
  1106.        
  1107.                 LOGP(DRR, LOGL_NOTICE, "ASS CMD( chan_nr=0x%02x, "
  1108.                     "HSN=%u, MAIO=%u, TS=%u, SS=%u, TSC=%u) ",
  1109.                     ia->chan_desc.chan_nr, hsn, maio, ch_ts, ch_subch,
  1110.                     ia->chan_desc.h1.tsc);
  1111.  
  1112.                 /* decode mobile allocation */
  1113.                 ma_len = 0;
  1114.                 for (i=1, j=0; i<=1024; i++) {
  1115.                     arfcn = i & 1023;
  1116.                     if (app_state.cell_arfcns[arfcn].mask & 0x01) {
  1117.                         k = ia->mob_alloc_len - (j>>3) - 1;
  1118.                         if (ia->mob_alloc[k] & (1 << (j&7))) {
  1119.                             ma[ma_len++] = arfcn;
  1120.                         }
  1121.                         j++;
  1122.                     }
  1123.                 }
  1124.                
  1125.                 /* request L1 to go to dedicated mode on assigned channel */
  1126.                 rv = l1ctl_tx_dm_est_req_h1(ms,
  1127.                     maio, hsn, ma, ma_len,
  1128.                     ia->chan_desc.chan_nr, ia->chan_desc.h1.tsc,
  1129.                     GSM48_CMODE_SPEECH_EFR, 0);
  1130.             }
  1131.         #endif
  1132.         }/*else{
  1133.             return;
  1134.         }
  1135. target sms sniffer
  1136.         if( (l2[0] == 0x01)&&(l2[1] == 0x73)&&(l2[10] == 0x05) )
  1137.         {
  1138.             unsigned int tmsi,object_tmsi;
  1139.             tmsi = *(int *)&l2[12];
  1140.             for(i =12;i<12+4;i++)
  1141.             {
  1142.                 printf("%x ",l2[i]);
  1143.             }
  1144.             printf("\n");
  1145.             object_tmsi = ntohl(0x97034024);
  1146.             printf("object_tmsi is %x, tmsi is %x\n",object_tmsi,tmsi);
  1147.             if(tmsi != object_tmsi)
  1148.             {
  1149.                 printf("not match!\n");
  1150.            
  1151.                 l1ctl_tx_dm_rel_req(ms);
  1152.                 l1ctl_tx_fbsb_req(ms, ms->test_arfcn,
  1153.                         L1CTL_FBSB_F_FB01SB, 100, 0,
  1154.                         app_state.ccch_mode);
  1155.        
  1156.                
  1157.                 app_state.dch_state = DCH_WAIT_REL;
  1158.                 app_state.dch_badcnt = 0;
  1159.                 app_state.dch_ciph = 0;
  1160.        
  1161.            
  1162.                 if (app_state.fh) {
  1163.                     fclose(app_state.fh);
  1164.                     app_state.fh = NULL;
  1165.                 }
  1166.             }else{
  1167.  
  1168.                 printf("$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$\n");
  1169.             }
  1170.  
  1171.         }
  1172. */ 
  1173.         if (rv == 0)
  1174.         {
  1175.             uint8_t chan_type, chan_ts, chan_ss;
  1176.             uint8_t gsmtap_chan_type;
  1177.  
  1178.             /* Send to GSMTAP */
  1179.             rsl_dec_chan_nr(bi->chan_nr, &chan_type, &chan_ss, &chan_ts);
  1180.             gsmtap_chan_type = chantype_rsl2gsmtap(
  1181.                 chan_type,
  1182.                 bi->flags & BI_FLG_SACCH ? 0x40 : 0x00
  1183.             );
  1184.             gsmtap_send(gsmtap_inst,
  1185.                 arfcn, chan_ts, gsmtap_chan_type, chan_ss,
  1186.                 ntohl(bi->frame_nr), bi->rx_level, bi->snr,
  1187.                 l2, sizeof(l2)
  1188.             );
  1189.  
  1190.             /* Crude CIPH.MOD.COMMAND detect */
  1191.             if ((l2[3] == 0x06) && (l2[4] == 0x35) && (l2[5] & 1))
  1192.                 app_state.dch_ciph = 1 + ((l2[5] >> 1) & 7);
  1193.         }
  1194.     }
  1195. }
  1196.  
  1197. static void
  1198. ccch_tn_decode(struct l1ctl_burst_ind *bi,uint8_t tn,struct osmocom_ms *ms)
  1199. {
  1200.     int16_t rx_dbm;
  1201.     uint16_t arfcn;
  1202.     uint32_t fn;
  1203.     uint8_t cbits, lch_idx;
  1204.     int ul, bid, i;
  1205.     sbit_t *bursts;
  1206.     ubit_t bt[116];
  1207.  
  1208.     /* Get params (Only for SDCCH and SACCH/{4,8,F,H}) */
  1209.     arfcn  = ntohs(bi->band_arfcn);
  1210.     rx_dbm = rxlev2dbm(bi->rx_level);
  1211.     //printf("tn is %d\n",tn);
  1212.     bursts = app_state.bursts_ccch[tn/2];
  1213.    
  1214.     fn     = ntohl(bi->frame_nr);
  1215.  
  1216.     cbits  = bi->chan_nr >> 3;
  1217.  
  1218.     bid    = -1;
  1219.  
  1220.     bid = bi->flags & 3;
  1221.     //printf("cbits is %x\n",cbits);
  1222.     if ( cbits  == 0x12) {          /* TCH/F */
  1223.         bid = bi->flags & 3;
  1224.     }
  1225.  
  1226.     if (bid == -1)
  1227.         return;
  1228.  
  1229.     /* Clear if new set */
  1230.     if (bid == 0)
  1231.         memset(bursts, 0x00, 116 * 4);
  1232.  
  1233.     /* Unpack (ignore hu/hl) */
  1234.     osmo_pbit2ubit_ext(bt,  0, bi->bits,  0, 57, 0);
  1235.     osmo_pbit2ubit_ext(bt, 59, bi->bits, 57, 57, 0);
  1236.     bt[57] = bt[58] = 1;
  1237.  
  1238.     /* A5/x */
  1239.     if (app_state.dch_ciph) {
  1240.         ubit_t ks_dl[114], ks_ul[114], *ks = ul ? ks_ul : ks_dl;
  1241.         osmo_a5(app_state.dch_ciph, app_state.kc, fn, ks_dl, ks_ul);
  1242.         for (i= 0; i< 57; i++)  bt[i] ^= ks[i];
  1243.         for (i=59; i<116; i++)  bt[i] ^= ks[i-2];
  1244.     }
  1245.  
  1246.     /* Convert to softbits */
  1247.     for (i=0; i<116; i++)
  1248.         bursts[(116*bid)+i] = bt[i] ? - (bi->snr >> 1) : (bi->snr >> 1);
  1249.  
  1250.     /* If last, decode */
  1251.     if (bid == 3)
  1252.     {
  1253.         uint8_t l2[23];
  1254.         int rv;
  1255.         rv = xcch_decode(l2, bursts);
  1256.  
  1257.         if (rv == 0)
  1258.         {
  1259.             struct msgb *msg;
  1260.             msg = msgb_alloc_headroom(30 ,0,"layer3");
  1261.             msg->tail =30;
  1262.             msg->l3h =l2;
  1263.             msg->data_len = msg->len =23;
  1264.             gsm48_rx_ccch(msg,ms);     
  1265.             //struct abis_rsl_rll_hdr *rllh = l2;//l3
  1266.             //printf("chan_nr = %x,bi->chan_nr = %x\n",rllh->chan_nr,bi->chan_nr);
  1267.             uint8_t chan_type, chan_ts, chan_ss;
  1268.             uint8_t gsmtap_chan_type;
  1269.  
  1270.             /* Send to GSMTAP */
  1271.             rsl_dec_chan_nr(bi->chan_nr, &chan_type, &chan_ss, &chan_ts);
  1272.             gsmtap_chan_type = chantype_rsl2gsmtap(
  1273.                 chan_type,
  1274.                 bi->flags & BI_FLG_SACCH ? 0x40 : 0x00
  1275.             );
  1276.             gsmtap_send(gsmtap_inst,
  1277.                 arfcn, chan_ts, gsmtap_chan_type, chan_ss,
  1278.                 ntohl(bi->frame_nr), bi->rx_level, bi->snr,
  1279.                 l2, sizeof(l2)
  1280.             );
  1281.  
  1282.             /* Crude CIPH.MOD.COMMAND detect */
  1283.             if ((l2[3] == 0x06) && (l2[4] == 0x35) && (l2[5] & 1))
  1284.                 app_state.dch_ciph = 1 + ((l2[5] >> 1) & 7);
  1285.         }
  1286.     }
  1287.  
  1288. }
  1289.  
  1290. static void
  1291. local_ccch_burst_decode(struct l1ctl_burst_ind *bi,struct osmocom_ms *ms)
  1292. {
  1293.     uint8_t  tn;
  1294.  
  1295.     tn = bi->chan_nr & 7;
  1296.     ccch_tn_decode(bi,tn,ms);
  1297. }
  1298.  
  1299. void layer3_rx_burst(struct osmocom_ms *ms, struct msgb *msg)
  1300. {
  1301.     struct l1ctl_burst_ind *bi;
  1302.     int16_t rx_dbm;
  1303.     uint16_t arfcn;
  1304.     int ul,do_rel=0;
  1305.  
  1306.     /* Header handling */
  1307.     bi = (struct l1ctl_burst_ind *) msg->l1h;
  1308.  
  1309.     arfcn = ntohs(bi->band_arfcn);
  1310.     rx_dbm = rxlev2dbm(bi->rx_level);
  1311.     ul = !!(arfcn & ARFCN_UPLINK);
  1312.  
  1313.     if (app_state.dch_state == DCH_NONE)
  1314.         local_ccch_burst_decode(bi,ms);
  1315.     /* Check for channel start */
  1316.     if (app_state.dch_state == DCH_WAIT_EST) {
  1317.         if (bi->chan_nr == app_state.dch_nr) {
  1318.             if (bi->snr > 64) {
  1319.                 /* Change state */
  1320.                 app_state.dch_state = DCH_ACTIVE;
  1321.                 app_state.dch_badcnt = 0;
  1322.  
  1323.                 /* Open output */
  1324.                 //app_state.fh = fopen(gen_filename(ms, bi), "wb");
  1325.             } else {
  1326.                 /* Abandon ? */
  1327.                 do_rel = (app_state.dch_badcnt++) >= 4;
  1328.             }
  1329.         }
  1330.     }
  1331.  
  1332.     /* Check for channel end */
  1333.     if (app_state.dch_state == DCH_ACTIVE) {
  1334.         if (!ul) {
  1335.             /* Bad burst counting */
  1336.             if (bi->snr < 64)
  1337.                 {
  1338.                     app_state.dch_badcnt++;
  1339.                     printf("sdcch app_state.dch_badcnt++\n");
  1340.                 }
  1341.             else if (app_state.dch_badcnt >= 2)
  1342.                 app_state.dch_badcnt -= 2;
  1343.             else
  1344.                 app_state.dch_badcnt = 0;
  1345.  
  1346.             /* Release condition */
  1347.             do_rel = app_state.dch_badcnt >= 6;
  1348.         }
  1349.     }
  1350.  
  1351.     // when in TCH mode, we only measure the SACCH to kown the link quanlity
  1352.     if (app_state.dch_state == DCH_TCH) {
  1353.         //printf("app_state.dch_state == DCH_TCH\n");
  1354.         if (!ul && (bi->flags & BI_FLG_SACCH)) {
  1355.             //printf("TCH SACCH\n");
  1356.             /* Bad burst counting */
  1357.             if (bi->snr < 40)
  1358.                 {
  1359.                     app_state.dch_badcnt++;
  1360.                     printf("sacch app_state.dch_badcnt++\n");
  1361.                 }
  1362.             else if (app_state.dch_badcnt >= 2)
  1363.                 app_state.dch_badcnt -= 2;
  1364.             else
  1365.                 app_state.dch_badcnt = 0;
  1366.  
  1367.             /* Release condition */
  1368.             do_rel = app_state.dch_badcnt >= 6;
  1369.         }
  1370.     }
  1371.  
  1372.     /* Release ? */
  1373.     if (do_rel) {
  1374.         printf("The Delicate Channel is released because of bad SNR!\n");
  1375.         /* L1 release */
  1376.         l1ctl_tx_dm_rel_req(ms);
  1377.         l1ctl_tx_fbsb_req(ms, ms->test_arfcn,
  1378.                 L1CTL_FBSB_F_FB01SB, 100, 0,
  1379.                 app_state.ccch_mode);
  1380.  
  1381.         /* Change state */
  1382.         app_state.dch_state = DCH_WAIT_REL;
  1383.         app_state.dch_badcnt = 0;
  1384.         app_state.dch_ciph = 0;
  1385.  
  1386.         /* Close output */
  1387.         if (app_state.fh) {
  1388.             fclose(app_state.fh);
  1389.             app_state.fh = NULL;
  1390.         }
  1391.     }
  1392.  
  1393.     /* Save the burst */
  1394.     if (app_state.dch_state == DCH_ACTIVE || app_state.dch_state == DCH_TCH)
  1395.         //fwrite(bi, sizeof(*bi), 1, app_state.fh);
  1396.  
  1397.     /* Try local decoding */
  1398.     if (!ul && (app_state.dch_state == DCH_ACTIVE || app_state.dch_state == DCH_TCH))
  1399.         local_burst_decode(ms,bi);
  1400. }
  1401.  
  1402. void layer3_app_reset(void)
  1403. {
  1404.     /* Reset state */
  1405.     app_state.has_si1 = 0;
  1406.     app_state.has_si3 = 0;
  1407.     app_state.neci = 0;
  1408.     app_state.ccch_mode = CCCH_MODE_NONE;
  1409.     app_state.dch_state = DCH_NONE;
  1410.     app_state.dch_badcnt = 0;
  1411.     app_state.dch_ciph = 0;
  1412.     app_state.sys_count= 0;
  1413.  
  1414.     if (app_state.fh)
  1415.         fclose(app_state.fh);
  1416.     app_state.fh = NULL;
  1417.  
  1418.     memset(&app_state.cell_arfcns, 0x00, sizeof(app_state.cell_arfcns));
  1419. }
  1420.  
  1421. static int signal_cb(unsigned int subsys, unsigned int signal,
  1422.              void *handler_data, void *signal_data)
  1423. {
  1424.     struct osmocom_ms *ms;
  1425.     struct osmobb_msg_ind *mi;
  1426.     struct osmobb_fbsb_res *fr;
  1427.    
  1428.     if (subsys != SS_L1CTL)
  1429.         return 0;
  1430.  
  1431.     switch (signal) {
  1432.     case S_L1CTL_BURST_IND:
  1433.         mi = signal_data;
  1434.         layer3_rx_burst(mi->ms, mi->msg);
  1435.         break;
  1436.     case S_L1CTL_FBSB_ERR:
  1437.         fr=signal_data;
  1438.  
  1439.         l1ctl_tx_reset_req(fr->ms, L1CTL_RES_T_FULL);
  1440.         /* FIXME: L1CTL_RES_T_FULL doesn't reset dedicated mode
  1441.         * (if previously set), so we release it here. */
  1442.         l1ctl_tx_dm_rel_req(fr->ms);
  1443.         //printf("fr->band_arfcn is %d\n",ntohs(fr->band_arfcn));
  1444.         //return l1ctl_tx_fbsb_req(fr->ms, ntohs(fr->band_arfcn),
  1445.                                 // L1CTL_FBSB_F_FB01SB, 100, 0,
  1446.                                 // CCCH_MODE_NONE);
  1447.         break;
  1448.     case S_L1CTL_RESET:
  1449.         if(app_state.dch_state == DCH_ACTIVE) //if we are going TCH,we need rest_sched?
  1450.             break; 
  1451.         ms = signal_data;
  1452.         if(app_state.dch_state != DCH_TCH)
  1453.             layer3_app_reset();
  1454.         return l1ctl_tx_fbsb_req(ms, ms->test_arfcn,
  1455.                                  L1CTL_FBSB_F_FB01SB, 100, 0,
  1456.                                  app_state.ccch_mode);
  1457.         break;
  1458.     }
  1459.     return 0;
  1460. }
  1461.  
  1462.  
  1463. int l23_app_init(struct osmocom_ms *ms)
  1464. {
  1465.     osmo_signal_register_handler(SS_L1CTL, &signal_cb, NULL);
  1466.     l1ctl_tx_reset_req(ms, L1CTL_RES_T_FULL);
  1467.     return layer3_init(ms);
  1468. }
  1469.  
  1470. static int l23_cfg_supported()
  1471. {
  1472.     return L23_OPT_TAP | L23_OPT_DBG;
  1473. }
  1474.  
  1475. static int l23_getopt_options(struct option **options)
  1476. {
  1477.     static struct option opts [] = {
  1478.         {"kc", 1, 0, 'k'},
  1479.     };
  1480.  
  1481.     *options = opts;
  1482.     return ARRAY_SIZE(opts);
  1483. }
  1484.  
  1485. static int l23_cfg_print_help()
  1486. {
  1487.     printf("\nApplication specific\n");
  1488.     printf("  -k --kc KEY           Key to use to try to decipher DCCHs\n");
  1489.  
  1490.     return 0;
  1491. }
  1492.  
  1493. static int l23_cfg_handle(int c, const char *optarg)
  1494. {
  1495.     switch (c) {
  1496.     case 'k':
  1497.         if (osmo_hexparse(optarg, app_state.kc, 8) != 8) {
  1498.             fprintf(stderr, "Invalid Kc\n");
  1499.             exit(-1);
  1500.         }
  1501.         break;
  1502.     default:
  1503.         return -1;
  1504.     }
  1505.     return 0;
  1506. }
  1507.  
  1508. static struct l23_app_info info = {
  1509.     .copyright  = "Copyright (C) 2010 Harald Welte <laforge@gnumonks.org>\n",
  1510.     .contribution   = "Contributions by Holger Hans Peter Freyther\n",
  1511.     .getopt_string  = "k:",
  1512.     .cfg_supported  = l23_cfg_supported,
  1513.     .cfg_getopt_opt = l23_getopt_options,
  1514.     .cfg_handle_opt = l23_cfg_handle,
  1515.     .cfg_print_help = l23_cfg_print_help,
  1516. };
  1517.  
  1518. struct l23_app_info *l23_app_info()
  1519. {
  1520.     return &info;
  1521. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!