OsmocomBB

== Requirements for the GSM MS side ==

 * transmit and receive in one TS every frame

 * retune Rx and Tx according to hopping sequence for every frame

 * synchronize carrier clock, bitclock and frame with BTS

== Requirements for a GSM scanner ==

 * two independent receivers, one on MS-Rx, the other on BTS-Rx side

 * ability to start decoding at some point (PCH/AGCH/SDCCH) and then follow a given hopping sequence (MAIO) for one TCH

 * ability to decrypt A51/A52 with user-provided Kc

 * Jammer: possibly transmitting interference in the Tx slices of the victim

 * synchronize carrier clock, bitclock and frame with BTS

=== Possible implementation ===

 * two TRF6151 in pure Rx configuration

  * one for MS-Rx side

  * other one for MS-Tx side

 * two TWL3025 in pure Rx configuration

 * both TWL3025 BSP permanently in downlink mode (I/Q samples)

  * we get 2*( 2*16*270k) bps serial samples (7.33Mbps) input signal

 * connect those two serial sample streams to CPU+DSP (blackfin?)

 * forward demodulated/decoded samples to PC

== Requirements for a GSM BTS ==

 * tune MS-Rx side to MS-Tx frequency

 * tune MS-Tx side to MS-Rx frequency

 * continuous Rx and Tx in all timeslots on one ARFCN

 * ability to determine timing advance of Uplink frames

=== Possible implementation ===

 * Use two independent TRF6151 frontends one for uplink, one for downlink

 * First TRF6151 will generate 26MHz and respect AFC from TWL3025

 * Second TRF6151 will use 'external VTXCO' configuration from 26MHz clock

== Internal Interfaces ==

In this board, we have a number of interesting internal interfaces.

It would be great if we could somehow tap/hook our own processor into those interfaces.

=== TWL3025 BSP ===

This is a SPI port with read/write access to all TWL3025 internal registers.  However, in case of downlink Rx operation, the burst

data is transferred over this port (which needs 8.66Mbps of the 13Mbps bandwidth).  It is clocked by CLK13M

This typically connects to the Calypso BSP.

=== TWL3025 USP ===

This is a generic SPI port for read/write to all TWL3025 internal registers.  It is clocked by CLK13M

=== TWL3025 TSP ===

The Time Serial Port is clocked by CLK13M/2 and is a pure input port, i.e. a Frame and a Data-In line are sufficient.

This typically connects to the Calypso TPU.

This interface is used for sequencing the Rx/Tx operation of the baseband interface.

=== TRF6151C TSP ===

This is a serial interface with strobe (not chip select).

It is mostly used to configure the PLL, PGA Gain and power of the transceiver.

This typically connects to the Calypso TSP/TPU