CMU200 Options for tracking generator
=====================================

Ebay supply:
http://www.ebay.co.uk/itm/CMU200-Radio-Services-Monitor-Tracking-Generator-Duplexer-Measurement-Sources-/252464888662?hash=item3ac8147b56:g:B3EAAOSwbsBXowJ-
This requires 9-12V. You feed in 1816.115MHz and pick up the spectrum analyzer first LO from the middle of the RXTX board. These are mixed to give a tracking generator. It works quite well, though there is some ripple. On the RXTX board there are two rigid SMA leads and a MCX lead which need disconnecting to remove the RXTX board.

You will need to drill a hole in the air guide sheet to access the LO mcx connector. See:
http://www.eevblog.com/forum/testgear/rohde-schwarz-cmu200/msg1007175/#msg1007175

This works up to 1200MHz. For 1200MHz to 2200MHz you use 843.085MHz, for above 2200MHZ you use 1816.115MHz again. The required frequency needs to be at as low a level as works, around -18dBm, and can be generated by the CMU2200. Too low a level gives more ripple on the response.
The local oscillator can use the supplied cable, but could instead use a spare AUX1 BNC and lead if this is unused or not needed. Having all the connectors at the front is more convenient.
Up to 1200MHz you get some ripple. This gets much much worse and attenuated as the frequency goes higher. It still works as a tracking generator, but you have to compensate for the tracking generator level changes.

CMU200 is very sensitive to 1816.115MHz breakthrough to the first IF at 1816.115MHz. Ideally you would use an external oscillator and filter out 1816.115MHz before it reaches the CMU200.

It is possible to use a mixer instead of the Chinese solution. A mixer could output down to DC, which would be useful for looking at signals below 10MHz(also possible is above 2700MHz) with a converter. The problem with a mixer is that you will get 1816.115MHz breakthrough. This breakthrough increases the apparent noise floor, so giving worse results. If you have a separate signal generator (I don't so have not checked this)and are looking at responses with little output at 1816,115MHz, for example a 10.7MHz xtal filter, then the mixer should work quite well. You would probably want to amplify the LO to get a good reference level.

So mixer is possible, and within limits works, and in the end could be better than the Chinese tracking generator. For instant results use a mixer if you have a suitable one. For better results use the Chinese tracking generator, for best results you need to do some work. An improvement to the Chinese mixer would be to generate the required frequencies externally from the ref output. And add a notch filter after the mixer. To keep 1816MHz out of the CMU200. Pick your mixer for the correct frequency range and for good isolation. I got quite good results from a mixer, but it doesn't have the frequency coverage needed.

Block diagram showing filter frequencies:
http://www.eevblog.com/forum/testgear/gotcha-for-cmu200-and-crtu-users/msg694796/#msg694796

Tracking generator review:
http://www.eevblog.com/forum/testgear/rohde-schwarz-cmu200/msg1006966/#msg1006966

Link to some tracking generator install photos I got from the seller:
http://pan.baidu.com/s/1jIi5o8m

The principle here is that the spectrum analyzer uses a fixed filter. It varies the local oscillator to convert the monitored frequency to 1816.115MHz using a mixer. So by mixing the LO with a signal generator set to 1816.115MHz we reverse this process and generate an output at the monitored frequency, so tracking the LO.

Two photos of wide span with the tracking output fed to the RF4 input. One with RF set to 1816.115MHz covering 10-1200MHz and 2200-2700MHz, the other with RF set to 843.085MHz covering 1200MHz to 2200MHz. Both drop by about the correct amount when an (unknown frequency response, 6dB) attenuator is fitted.

So a question. Is it possible to correct the frequency response to level the tracking generator?




CMU200 - Method for listening to Audio without Audio Board!! Enjoy
==================================================================

For all of you who want to expand how you use your CMU200 and actually listen to audio from the analyzer, here is a way to accomplish that.

My Setup

* CMU200 set up with spectrum analyzer running, enter frequency, set span to acceptable range (I set to .002) just for testing.
* General Coverage Receiver capable of receiving 10.7 Mhz (Should be capable of type of modulation you wish to demod)
* Connect IF3 RX OUT on rear of CMU200 to Antenna Input on General Coverage Receiver (You may choose to place an attenuator here) I didnt need to.
* Start general coverage receiver and set to 10.7mhz and demod mode (AM,FM,FMW,LSB,USB) Whatever mode you need.
* Adjust squelch and volume to your desired levels and listen away.
* DONT Change the frequency of the general coverage receiver as it is relying on the IF RX 3 signal for its source.
* Manipulate the CMU200 Frequency to whatever you desire, Play around with some settings.

I am able to listen to AM,FM, FM Broadcast, LSB, USB.  No issues, plus as the signal strength increases so does the IF level which allows the use of squelch.

'73
K7RLW - RadioRick


Rohde & Schwarz CMU200 TG:
==========================
It doesn't have a tracking generator, simply because it's a communications test set designed for digital 
communication standards like GSM, W-CDMA, Bluetooth or GPS. What it has are one or two (depending on the options) 
RF generator(s), a Spectrum Analyzer (sweeping VSA), an RF Analyzer, a power meter (wideband and narrow band), 
and a 20 tone audio generator/analyzer, all in one box.

You can replicate the tracking generator if you connect the CMU200 to a PC and command the RF generator via 
software to "sweep" through a  frequency band while the SA is set to max hold. The dwell time for the generator 
needs to be larger than the sweep time, so it will be slow. But it works.

Much easier and quicker however is just using a wideband noise source, which you can even build yourself.


==========================
B11(simple ocxo),  B41(audio analyzer) and B95(second RF generator).
==========================

Ok, Thank You ZL1CVD for your comments..

I work in GPIB programming for a company, and although I don't have extensive experience in the matter, 
I don't have the time to play with the program inside the unit..
Long ago in the hacking games times, I run softice and cracked several programs in windows98, 
but nowadays my time is important to me and I have not the time nor patience to approach this issue.

I prefer to use a laptop or rasperry pi or similar board to automatize via GPIB the measures as noise 
figure, tracking, swr plots, Third order intercept, 1dB compression, and all the measures that interest me. 
The GPIB support of the unit is very good, extensive, as example you can access files from hard disk through 
GPIB calls.

However, if you make progress in the hacking I can support you by test or advice. You can transform a 
dll in a .h file to call from a programing language, but you will have only the entry points of the 
procedures inside the dll, not the information on parameters or functionality...  So, if you call the 
dll it can crash, and it will crash every time.

When I receive the new hard disk, i will see the innards of the file system..

I measured THD (as SINAD I cannot measure because my B41 unit has old firmware  >:( ) on my 500MHz 
receiver with this little program:

*CLS
-> OUTP:STAT RF3
-> SOUR:RFG:FREQ 500 MHz
-> SOUR:RFG:MOD FM
-> SOUR:RFG:MOD:FM:FREQ 1KHZ
-> SOUR:RFG:MOD:FM:DEV 3KHZ
-> SOUR:RFG:LEV -40DBM
-> INIT:RFG;*OPC

-> CONF:AFAN:FILT:WEIG CCI
-> INIT:AFAN;*OPC
-> READ:AFAN?

So, the units can work at the same time.. no problem..  :-+

Update:  Works with python and VISA with Agilent usb<->gpib adapter, no problem..
I back up the Hard disk without problem. I see the dos app and found the version of the SW as 5.1 but 
the version of the audio FW is old 3.4.. It can be possible to update the firmware???  
I think so.. It is detailed in the service manual as the board firmware must be updated after 
installation... I am not sure if I mess something..

Advice??

====================================================================

The HDD of my CMU200 is a HITACHI MK2018GAP with 20Gbytes but with only a 2GB partition  :-//.
I try a KingSpeed SSD PATA 32GB with no luck.
Also I try a hgst 40GBytes ATA from my old laptop with no luck.
I think It is possible to enter the disk geometry manually in Bios, but I do not have information about the parameters of the disks.

But It appears that the BIOS is very OLD and doesn't read new hard disk..
I will try with a Compact Flash Adapter... 

====================================================================

Mixer_4_0Hz_Start_Freq.jpg
So... I measure the phase noise performance of the set with my 10 MHz Rubidium Frequency Standard, 
a EFRATOM LPRO-101 Unit that is very nice, and has low phase noise.  
I also build a simple ADE-1 Mixer to test if the unit can do Spectrum analysis from 0 MHz, with the internal 
generator and 1Ghz OL, and it work, of course... Although the ADE-1 is for no more than 500MHz, 
it works at 1GHz... outside of specs..  :-//

I put 7dBm @ 1GHz from the RF2 OUTPUT into the OL input of the mixer, a 30dB pad from the +10dBm 
EFRATOM source to the input IF of the mixer. And in the output (RF) of the mixer I connect directly 
to the CMU200 input. The spectrum is clean.

The trending on phase noise in my lab, from the poorer to the better:

RIGOL DSA-815 TG:   At 1Khz   -56dBc  @ 100Hz BW  (What a dissaster!!  :palm:)
TEKTRONIX 492BP:    At 1Khz   -69.6dBc @ 100Hz BW
RHODE & SCHWARZ   At 1Khz   With Mixer AD-1:  -72.5dBc  @ 100Hz BW
STABILOCK 4032:      At 1Khz   -76.2dBc @ 100Hz BW
RHODE & SCHWARZ   At 1Khz   -76.6dBc @ 100Hz BW


=======================================================================

i designed this board.now there is a new version .
for this board
power:DC 9-12V/0.33A
RF IN:connect to rx/tx board rx lo port.
P2:connect to front panel RF3 ,RF3 setting 1816.115M/-20DBM
IF OUT:TG output 10M-1.2G/0DBM.

any problem send email : bg7tbl@qq.com/BG7TBL@GMAIL.COM

=======================================================================

B11:   HW-option for CMU200: Reference oscillator OXCO, aging 2 X 10E-7/year
B12:   HW-option for CMU200/300: Reference oscillator OXCO, aging 3.5x10E-8/year
B17:   HW-option for CMU200: IQ/IF interface, analog, one channel
B21:   HW option for CMU200: Universal signalling unit CMU-B21V14 incl. CMUB54
B21/2:   Universal Signalling Unit
B41:   HW-option for CMU200: Audio generator and analyzer
B52:   HW-option for CMU200: Speech codec for CMU-B21/var. 14
B52/2:   Speech Coder f. CMU-B21/2
B53:   HW-option for CMU200: Bluetooth extension for CMU-B21/var. 14
B53/2:   Signalling Module f.Bluetooth
B54:   HW-option for CMU200 signalling module for AMPS, TDMA, GSM for CMUB21/var. 14
B55:   Signalling Module f. €GPRS Applic. Test
B56:   HW-option for CMU200: WCDMA and data E2E for CMU-B21/var. 14
B66:   Versatile base band board
B83:   HW option for CMU200: CDMA2000 Signalling Unit (requires CMU-U65)
B85:   HW-option for CMU200: 8K/8K ENH/13K speech codec for CDMA2000 signalling unit CMU-B83/V12
B89:   HW option for CMU200: 1xEV-DO Signalling Module (requires CMU-B83/V22 and CMU-U65)
B68:   HW-option for CMU200 layer 1-board (3GPP/FDD, DL+UL)
B95:   HW-option for CMU200: Additional RF generator (max. input power 2 W)
B96:   HW-option for CMU200: Additional RF generator, 2 channels for GSM, CDMA, WCDMA

===========================================================================

Ich habe mit eine PCMCIA-compactflash Adapter ein Backup gemacht auf 
eine cf-karte
Geht einfach :
PS/2 Tastatur anschließen, ‘F4’ taste drucken, die Software schließt 
sich, und man kommt auf die DOS-ebene (Dos6.22)
Dann einfach mit Norton Commander alles kopieren (ich fand auf meinem 
Server noch ne Kopie 😉 ). Die CF-karte ist dann D:

Am besten formatierst Du die in Deinem Notebook. Mit FAT, nicht FAT32 
oder NTFS!

Im CMU müsste das über FDISK laufen. Partition anlegen, aktivieren, 
formatieren.

Dann den Volkov Commander installieren und ein dateiweises Backup 
erstellen. Die neue Platte wird dann mit DOS formatiert und alles wieder 
zurückkopiert.

In der Datei SWOPT.DAT sind die Softwareoptionen gespeichert.


Controller is a standard PC architecture running MS-DOS. CPU upgrades and SSD conversions are possible.

FMR5 motherboard uses AMD K6-2/300 CPU (Socket 7).
FMR6 motherboard uses Celeron Mobile CPU
FMR6Plus motherboard uses Celeron Mobile CPU (socket 495), BIOS 1.00 supports Pentium III 933

Be aware of the following options. If installed, they reduce the max input power on RF 1, which may be undesirable:
if R&S CMU-B95 is installed, RF 1 continuous input power = max 2 W
if R&S CMU-B96 is installed, RF 1 continuous input power = max 2 W

================================================================================

Decrypt License File Keys:

from Crypto.Cipher import ARC2
import struct

for l in open("SWOPT.DAT"):
   if len(l) == 17:  # == 18: see below !!!
      a, b = struct.unpack("<II", ARC2.new("Revision\0").decrypt(l.strip().decode("hex")))
      print "SN: %d - %08x" % (a, b)


OK, so it's Python, it runs after importing pycrypto to my Raspberry Pi, needed a minor tweak 
I think related to the difference between DOS and Linux EOL/LF handling but the output appears valid.

I get output which is my serial number and then an option number I can tie up to installed options, 
trivial to work out the option number from this code.

I think I'm safe to assume I need to encipher 01D000C3 using my serial number as key (or vice versa) 
to obtain the option key for K29 and this is where I'm stuck as I'm struggling to understand the 
python code and how it decrypts, let alone how to reverse the process and obtain a valid ciphertext key.

What's also worrying me at the moment is that there's no 'installed version' for K29 so I have a 
sinking dread that K29 software may not actually be on the machine unless it's hidden somewhere in 
an archive and needs to be installed by Version Manager?

Also very curious about the 'FM Stereo' option in there if anyone has any knowledge of it?


I only used a Pi to run the Python code provided by TMBInc earlier in this thread because Python is 
included with the Raspbian image and it's very simple to install the PyCrypto software so I went with 
the easiest option available to me.

It would have been non trivial for me to install Python and PyCrypto on my laptop, though if you're 
proficient with Python I'm sure it would be very simple to install. 

The only change I had to make to the code was to change

if len(l) == 17:

to

if len(l) == 18:

because I think the way DOS and Linux terminate lines is different. Or perhaps there's a difference 
between CMU and CRTU SWOPT.DAT files

I'm really not a programmer so it's going to be a voyage of discovery for me to unpick what is almost 
definitely a very simple python script and reverse it to make myself a key generator. 

===========================================================================================

CJay - I am curious;  how did you figure out that you need to encipher 01D000C3 to obtain the option key for K29?

If I've understood the code and its output correctly, the licenses decode to serial number - option code 
where option code is 0xx0003C and xx is the hex representation of the decimal option number.

So, K29 would be 01d0003C

Hi,
I have a CMU200 with the K29 option enabled.
Below is the contents from swopt.dat:
Code: [Select]

FEEC0364A639F575
A2AF0325E648F54D
4D8CB38F128844B2
0A4080E5DDB3F339
08678B2806514740
D710C80B984FFD23
8E1182008AE45EB2
42D23B964CE7C522
DE8BC25F5305D1EB
6E1701C72B5F9256
6B53740D41CF8780
DBBE31F8EAEB9C22

And the options installed are
K21-K24, K27-K29, K42, K43, K53, K84, K85. Serial 837109/035

From another,
Code: [Select]

917D1CFF38E8F2C1
AC15C4AFBA26733A
D87CDA77974C9514
BE238053BEA30B16
75AE27EBF3F52E40
DFB718A6C9D85764
11B26D02CEE94BEA

and options:
K21-K24, K42, K43 and K45. Oh, and serial 103086.

For those, like me, with little experience of python, that fragment can be expressed less tersely as :

from Crypto.Cipher import ARC2
import struct
KEY = "Revision\0"  # decryption key for the data
STRUCT_TWO_UNSIGNED_INTS = "<II"
for line in open("SWOPT.DAT"):
    if len(line) == 17:
        cipher = ARC2.new(KEY)  # a new ARC2 cipher with the right key (ARC2 is a symmetric block cipher, we need a new cipher for each ciphertext)
        ciphertext = line.strip().decode("hex")  # Decode our ciphertext from hex, removing whitespace from the start and end
        plaintext = cipher.decrypt(ciphertext)  # Decrypt the cyphertext using the key
        a, b = struct.unpack(STRUCT_TWO_UNSIGNED_INTS, plaintext)  # unpack two unsigned ints from the plaintext
        print "SN: %d - %08x" % (a, b)


The decrypt does give the 0023 or whatever, from your existing licences. I don't see that you'd need to 
do it for any other reason than proving the process. It would be better to know how to derive the 23 
(or 2, or C3 ..) directly, so you don't need an existing licence to make a new one.

The encrypt process would be something like :

make a record consisting of serial number, option number, suffix (23 etc) in binary
encrypt it using the RC2 cypher and the key 'Revision'
convert to ascii
add to the license file

That last byte (or perhaps two bytes)  would seem to be the /xxx part of the serial number, mine 
is 836072/060 and the last byte of what I'm calling the option code is 3C, 060 decimal, the last 
byte of OH2FTU's matches the /035 of his serial number.

The SWOPT.DAT file will probably exist on all machines and have at least one or two licences in it, 
but even if it's empty it should be possible to create an 'option code' from the full serial number 
and the desired option.

This seems to do the reverse :

Code: [Select]

from Crypto.Cipher import ARC2
import struct

serial = 103086
serial2 = 2      # I set serial2 as 35 instead of 035 and bang! it works!
option = 45

record = struct.pack("<II", serial, serial2 + (option <<20))
encyphered = ARC2.new("Revision\0").encrypt(record)
print encyphered.encode("hex")


produces

11b26d02cee94bea

i.e. the last entry in oh2ftu's list

Check it with some existing options for your machine first

I set serial2 as 35 instead of 035 and bang! it works!


Looks as though python (like C) interprets a leading 0 as meaning 'octal'. So 035 is 29 decimal.

Your serial number will be something like 111264/xxx, you need this full serial number.


You then need to edit the python code so that it reflects your serial number but if the last 
part of your serial, xxx, starts with a 0 it must be omitted, change 'yy' to the option number you wish to enable

In your case, for option 29

serial = 111264
serial2 = xxx
option = 29


Ernesto, for your information:

1. Download and Install python(x,y), use google for download link  ;)
2. Open program and select in Applications "IPython QT console" and click the green checkmark to run it.
3. In the console window that open, cut and paste the following code line by line (press enter after you 
   paste each line), change XX for your second serial number, you can get it from the IDENTITY.TXT file 
   (the soft has option to generate it):

from Crypto.Cipher import ARC2
import struct

serial = 111264
serial2 = XX
option = 29

record = struct.pack("<II", serial, serial2 + (option <<20))
encyphered = ARC2.new("Revision\0").encrypt(record)
print encyphered.encode("hex").upper()

4. Note the resulting code on paper.
5. In the CMU200 exit from program to MSDOS(Alt-F4) and go to the location of SWOPT.DAT file, 
   i don't remember, you will need a keyboard  ;).
6. Make a backup of file (I always make a backup of entire disk before make modifications).
7. Use the MSDOS edit command with the file and put the code at end of file. Save the file.
8. Restart the equipment.

It's very easy, right?
By the way, I think it is possible to enter the code directly in the program as an option of 
system menu.


To bypass editing the file and to enter the code directly, the menu is 
"Setup" under the System box -> Options -> your desired option -> enter.

Then enter your generated code and there you go!

To those above enabling K29 - how did you get around the option enabling but the 
features not appearing? Did it require copying over new files to the internal hard drive?

Yes, the memory is important...

Mine does have 128MB base in a weird configuration...
However i upgrade it with a Infineon 128MB PC133 133MHz 144-Pin SODIMM HYS64V16220GDL-7.5-C2 without problem...

Mine is a slooooow AMD K6 with INTEL Triton chipset and It has only cache for 64MB of RAM unfortunately. 
In programm I not noted anything different with 256MB.
==================================================================================
maybe this may help:
https://bitschubbser.org/nextcloud/index.php/s/6TCghFbYMsbkfph (PW: eevblog)

This is the r+s software for CMU200: Base, Bluetooth, AMPS, GSM.
Completely untested (may even be that these are the wrong files) because I don't have a PCMCIA-card for my unit yet.

Okay,
everybody just downloading, nobody replying. So here it goes:
I was able to activate the AMPS-module with the "keygen" and by installing
the IS1MV5.20.exe package.

Note:
The files from the IS1MV5.20.exe need to be in a directory called "IS1MV5.20"
for the CMU200 versionmanager to find them. AND you need to install the
corresponding base-package first.

Greetings

========================================================================================

CMU200_BASE_5.21

CMU200_BASE_5.21
File Information
Release Date: 	02/09/2011
File size: 	14777475 bytes
Important

This page is only available until 12/31/2017
File Attachment
Download the file BASEV5.21.exe on your PCMCIA-Memory card and execute it.

It will create the installation folder "BASEV5.21" with the necessary files for the software update.
After this you can delete the file BASEV5.21.exe

CMU200_GSM_5.22

CMU200_GSM_5.22
File Information
Release Date: 	05/13/2009
File size: 	19866889 bytes
Important

This page is only available until 12/31/2017
File Attachment

CMU200 firmware GSM V5.22
(Version Manager) Base-Software V5.20 or newer must be installed first !

Download the file GSMSV5.22.exe on your PCMCIA-Memory card and execute it.
It will create the installation folder "GSMSV5.22" with the necessary files for the firmware update.
After this you can delete the file GSMSV5.22.exe

CMU200_AMPS/TDMA_V5.20

CMU200_AMPS/TDMA_V5.20
File Information
Release Date: 	03/06/2009
File size: 	2634629 bytes
Important

This page is only available until 12/31/2017
File Attachment
Download the file IS1MV5.20.exe on your PCMCIA-Memory card and execute it.

It will create the installation folder "IS1MV5.20" with the necessary files for the software update.
After this you can delete the file IS1MV5.20.exe

CMU200_Bluetooth_5.20

CMU200_Bluetooth_5.20
File Information
Release Date: 	05/13/2009
File size: 	1613503 bytes
Important

This page is only available until 12/31/2017
File Attachment

CMU200 firmware Bluetooth V5.20
(Version Manager) Base-Software V5.20 or newer must be installed first !

Download the file BLTHV5.20.exe on your PCMCIA-Memory card and execute it.
It will create the installation folder "BLTHV5.20" with the necessary files for the firmware update.
After this you can delete the file BLTHV5.20.exe

CMU200_WCDMA_5.20

CMU200_WCDMA_5.20
File Information
Release Date: 	05/13/2009
File size: 	20104125 bytes
Important

This page is only available until 12/31/2017
File Attachment

CMU200 firmware WCDMA V5.20
(Version Manager) Base-Software V5.20 or newer must be installed first !

Download the file wcdmV5.20.exe on your PCMCIA-Memory card and execute it.
It will create the installation folder "WCDMV5.20" with the necessary files for the firmware update.
After this you can delete the file wcdmV5.20.exe

CMU200_CDMA200_5.20

CMU200_CDMA200_5.20
File Information
Release Date: 	05/13/2009
File size: 	14483891 bytes
Important

This page is only available until 12/31/2017
File Attachment
Note: CDMA2000 software V5.20 for R&S CMU200.

Download the file CD2KV5.20.exe on your PCMCIA-Memory card and execute it.
It will create the installation folder "CD2KV5.20" with the necessary files for the firmware update.
After this you can delete the file CD2KV5.20.exe

Base software (V5.20 or newer) must be installed first !

CMU200_1xEV-DO_5.20

CMU200_1xEV-DO_5.20
File Information
Release Date: 	05/13/2009
File size: 	11846612 bytes
Important

This page is only available until 12/31/2017
File Attachment

CMU200 firmware 1xEV-DO V5.20
(Version Manager) Base-Software V5.20 or newer must be installed first !

Download the file EVDOV5.20.exe on your PCMCIA-Memory card and execute it.
It will create the installation folder "EVDOV5.20" with the necessary files for the firmware update.
After this you can delete the file EVDOV5.20.exe


===========================================================================

Back to to the original topic, I was able to install the downloaded base software on my CRTU using the following steps:

1. Unpack BASEV5.21.exe; you'll get a number of ARCHIV.0?? files, and a CONFIG.INI (and a couple of more files)
2. copy /b ARCHIV.0?? archiv.tgz
3. un-gzip; depending on the tool, you may get a "trailing payload" warning.
3. Boot the CRTU into Windows. On the DOS OPSW partition (containing "CMU" etc.), create \CMU\BINV5.21.
4. Copy all files from "archive" into there - it will end up with \CMU\BIN_V5.21\BASE\bsw\dll etc.
5. Copy CONFIG.INI into \CMU\BIN_V5.21\CONFIG.INI
6. Optionally, unpack the GSM stuff, and add "GSMSV5.22" to CONFIG.INI
7. reboot into DOS OPSW, and keep pressing MENU/SELECT to enter version manager
8. "Activate Software"
9. It should list V5.21; select it, and activate it. (It will take a while)
10. If you get a "FATAL ERROR" about not being able to open "REFTREE.DAT", press alt-f4 (exit DOS OPSW to dos prompt), 
go into C:\CMU\BIN_V5.21, and run "tools\reftree", it will create tools\reftree.dat. Reboot.

1. support of new CMU hardware boards:
   CMU-B21v14    1135.4580.02
   CMU-B66/B68    1135.5070.53
   Digital Board    1100.1956.05 and product index: >=10.02
2. new SW option CMU-K49 2G continuous sync
3. selftest internal loopback supports new frontends (1100.3120.02, product index >=10.03)
1. Frequency dependent external attenuation has 100 instead of 50 steps now, RX and TX are configurable seperately
2. Tool for easier retrievement of log files at the command prompt
3. Support of Power Quicc III module CMU-B56var54 for CMU var10 (service tester)
1. Support of new CMU hardware boards:
   CMU-B21v14   1135.4580.02
   CMU-B66/B68   1135.5070.53
   Digital Board   1100.1956.05 and TAZ: >=10.02
2. Support of Power Quicc III module CMU-B56var54 for CMU var10 (service tester)
1. support of new software options CMU-K18, CMU-K19, CMU-K25
1. new Rf spectrum command CONFigure:SPECtrum:CONTrol:MODe[?] to set the display mode (CUR, AVG, MIN, MAX)
1. Support of the software option CMU-K90
1. Support of CMUs equipped with a FMR7
2. New mode for GPIB subarray commands: average power (PAVG)
3. At the DOS prompt the US keyboard is active by default
1. SW options CMU-K42 and CMU-K43 (GPRS/EGPRS) are available for CMU200var30 now
2. in the remote mode report display, the output can be filtered to show measurement results only
1. FMR processor is correctly displayed at Setup->Hardware Equipment

===========================================================================
You can always generate the IDENTITY.DAT file from the setup or maintenance menu, 
I can't remember. Inside the file you can find the full serial number and the options 
of the equipment. My old IDENTITY.DAT file is:


/***************************************************************/
/***************************************************************/
/************************* CMU IDENTITY ************************/
/***************************************************************/
/***************************************************************/

GENERAL INFORMATION


Serial number: XXXXXX/XXX


CPU and memory:

CPU (FMR)       FMR5
Memory          128 MB
BSW/FSW         V5.10

Statistics data:


Firmware versions:

RXTX_1 CP-SW    08.50, 2006-05-02
....

And the file continues with much more...

Here is the actual procedure to create the identity.dat file:

1. Once the unit has completed booting, press ‘MENU SELECT’
2. Select ‘BASE FUNCTIONS’ -> ‘BASE’.
3. Press the button beside ‘SELECT’
4. Scroll down to the second selection ‘SYSTEM IDENTITY’ and press ENTER
5. Press the button beside ‘Test’ and then press ‘ON’

The unit will then write the file to your memory card under the name of Identity.dat
If you are not using a PCMCIA card then follow the same steps as above and the file identlty.dat 
is written in the internal disk of the CMU.

C:\internal\log\identlty.dat.

You can attach a PS2 or USB keyboard and press Alt-F4 to exit to MS-DOS, then go to 
the c:\INTERNAL\LOG\ and use the MS-DOS command "edit identity.dat" to edit the file and take note of the serial number.

The SWOPT.DAT file is plain text and you can find it in c:\CMU\DATA folder. You can save the keys for your licenses.
In message #59 I explain as you can generate the keys with python(x,y) by cut and paste the lines of python code, it is easy.


=======================================================================

What I'm slightly unclear on is the I/Q IN/OUT CH1/CH2 connectors on the back. 
They are present even without Option B7. Do they actually work? What's the difference between them, 
and the BNC connectors that Option B7 adds? 
For the BNC connectors, the manual is always very clear that they are only present with B7. 
For the IQ IN/OUT, there is no such designation. 

On both of the units with the IQ interface, the top row IF connectors are present. 
I did not trace the DB15 IQ connectors, which are present on all units.My guess is 
that they're routed on the main board.

Since the system works using IF between the RF and digital boards, my guess is that 
the IQ signals are not available anywhere without the B7 option. The IF signals could 
be easily extracted from the internal coax cables, though.

========================================================================

Linux on CRTU-RU (o;
====================

/dev/mem will do that. Something like:

int fd = open("/dev/mem",O_RDWR|O_SYNC);
unsigned char* RxTxMem1 = (unsigned char *) mmap(0, getpagesize(), PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0x000D4000);
unsigned char* RxTxMem2 = (unsigned char *) mmap(0, getpagesize(), PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0x000D5000);

Also, accessing I/O ports from user space is pretty simple:

#include <sys/io.h>
//...
ioperm(0x0100, 0x10, 1);
ioperm(0x0140, 0x30, 1);
//...
uint8_t val8 = inb(0x100); // 8-bit wide read
uint16_t val16 = inw(0x100); // 16-bit wide read
uint32_t val32 = inl(0x100); // 32-bit wide read
outb(val8, 0x100); // 8-bit wide write
outw(val16, 0x100); // 16-bit wide write
outl(val32, 0x100); // 32-bit wide write

Dealing with interrupts from userspace is not as simple. But, writing a very simple driver that can block a userspace process 
that does a read (or ioctl) on a special file until the interrupt fires isn't that hard. I did it once years ago. 
The "Linux Device Drivers" O'Reily book is a pretty good resource for these things.

===========================================================================