firmware/dsp: Send framenumber, TSC, checksum and magic via MCSI
In addition to the last commit we now send: * a burst start magic * the framenumber * the Training Sequence Code number * 2 simple XOR checksums The data of a burst now looks like: struct burst { uint8_t garbage1; uint8_t magic[8]; /* "IQDATAv1" in ASCII */ uint16_t iq_samples[302]; uint16_t iq_lrc; uint8_t garbage2; uint16_t demod[34]; uint32_t fn; uint16_t tsc; uint16_t demod_lrc; }; Signed-off-by: Steve Markgraf <steve@steve-m.de>
This commit is contained in:
parent
711eec8b4f
commit
4f9dc140bb
|
@ -230,6 +230,14 @@ static void dsp_set_params(int16_t *param_tab, int param_size)
|
|||
|
||||
dsp_api.param->d_gprs_install_address = DSP_SNIFF_PATCH_START;
|
||||
|
||||
/* Set MCSI burst start magic, stored in unused holes.
|
||||
* The sniffing task will send those over MCSI at the begin
|
||||
* of each burst, in this case ASCII "IQDATAv1" */
|
||||
dsp_api.param->d_hole2_param[0] = 0x4951;
|
||||
dsp_api.param->d_hole2_param[1] = 0x4441;
|
||||
dsp_api.param->d_hole2_param[2] = 0x5441;
|
||||
dsp_api.param->d_hole2_param[3] = 0x7631;
|
||||
|
||||
dsp_dump_version();
|
||||
|
||||
dputs("Finishing download phase\n");
|
||||
|
@ -568,6 +576,12 @@ void dsp_load_tch_param(struct gsm_time *next_time,
|
|||
dsp_api.db_w->d_ctrl_tch = d_ctrl_tch; /* Channel config. */
|
||||
}
|
||||
|
||||
void dsp_load_sniff_fn(struct gsm_time *next_time)
|
||||
{
|
||||
dsp_api.db_w->a_a5fn[0] = (next_time->fn >> 16);
|
||||
dsp_api.db_w->a_a5fn[1] = (next_time->fn & 0xffff);
|
||||
}
|
||||
|
||||
void dsp_load_ciph_param(int mode, uint8_t *key)
|
||||
{
|
||||
dsp_api.ndb->d_a5mode = mode;
|
||||
|
|
|
@ -5,7 +5,7 @@
|
|||
static const struct dsp_section dsp_sniffcode[] = {
|
||||
{
|
||||
.addr = 0x015c,
|
||||
.size = 0x00a1,
|
||||
.size = 0x00be,
|
||||
.data = _SA_DECL {
|
||||
0x76f8, 0x3f6b, 0x0160, 0xfc00,
|
||||
0x76f8, 0x439e, 0x0164, 0xfc00,
|
||||
|
@ -17,37 +17,44 @@ static const struct dsp_section dsp_sniffcode[] = {
|
|||
0x7211, 0x2114, 0xf495, 0xf495,
|
||||
0x1281, 0xf845, 0x018a, 0xf010,
|
||||
0x0001, 0x8081, 0xf074, 0xb74c,
|
||||
0xf020, 0x01c3, 0xf074, 0xaa9f,
|
||||
0xf020, 0x01c1, 0xf074, 0xaa9f,
|
||||
0xf073, 0x0178, 0xfc00, 0x7681,
|
||||
0x0010, 0x7581, 0x0806, 0xfc00,
|
||||
0x7711, 0x2116, 0x7681, 0x0002,
|
||||
0x7581, 0x0805, 0x7681, 0x004f,
|
||||
0x7581, 0x0801, 0x7681, 0x0001,
|
||||
0x7581, 0x0800, 0xf074, 0x018b,
|
||||
0xfc00, 0x7711, 0x2116, 0xf074,
|
||||
0x018b, 0x7594, 0x0820, 0x7481,
|
||||
0x0806, 0x6181, 0x0010, 0xf820,
|
||||
0x01a7, 0xfc00, 0x1282, 0xf074,
|
||||
0x01a1, 0xf010, 0x0001, 0xf844,
|
||||
0x01af, 0xfc00, 0x7711, 0x2116,
|
||||
0x7481, 0x0806, 0x6181, 0x0020,
|
||||
0xf820, 0x01b8, 0x7681, 0x0002,
|
||||
0x7581, 0x0800, 0xfc00, 0x7714,
|
||||
0x0cce, 0xf074, 0x0190, 0x7712,
|
||||
0x2117, 0x7782, 0x017c, 0xf074,
|
||||
0x01ae, 0xf074, 0x01b6, 0xe834,
|
||||
0xf074, 0xa9ea, 0x7213, 0x2115,
|
||||
0xf495, 0xf495, 0x7093, 0x3fa4,
|
||||
0x7093, 0x3fa5, 0x7093, 0x3fa7,
|
||||
0x7093, 0x3fa6, 0x7093, 0x0cce,
|
||||
0x7712, 0x0ccf, 0x7711, 0x001c,
|
||||
0x47f8, 0x0011, 0xe589, 0x7214,
|
||||
0x2115, 0x7313, 0x2115, 0xf074,
|
||||
0x0190, 0x7712, 0x2117, 0x7782,
|
||||
0x0022, 0xf074, 0x01ae, 0xf074,
|
||||
0x01b6, 0x7211, 0x2114, 0xf495,
|
||||
0xf495, 0x6be1, 0x0001, 0x0001,
|
||||
0xfc00,
|
||||
0x7581, 0x0800, 0xfc00, 0x7711,
|
||||
0x2116, 0xf074, 0x018b, 0x1d84,
|
||||
0x7594, 0x0820, 0x7481, 0x0806,
|
||||
0x6181, 0x0010, 0xf820, 0x01a6,
|
||||
0xfc00, 0xf074, 0x019f, 0xf010,
|
||||
0x0001, 0xf844, 0x01ad, 0xfc00,
|
||||
0x7711, 0x2116, 0x7481, 0x0806,
|
||||
0x6181, 0x0020, 0xf820, 0x01b6,
|
||||
0x7681, 0x0002, 0x7581, 0x0800,
|
||||
0xfc00, 0xf074, 0x0190, 0xe900,
|
||||
0x7714, 0x0c39, 0xe804, 0xf074,
|
||||
0x01ad, 0x7714, 0x0cce, 0xf020,
|
||||
0x012e, 0xf074, 0x01ad, 0x7714,
|
||||
0x2117, 0x8184, 0xf074, 0x019f,
|
||||
0xf074, 0x01b4, 0xe834, 0xf074,
|
||||
0xa9ea, 0x7213, 0x2115, 0xf495,
|
||||
0xf495, 0x7093, 0x3fa4, 0x7093,
|
||||
0x3fa5, 0x7093, 0x3fa7, 0x7093,
|
||||
0x3fa6, 0x7093, 0x0cce, 0x7712,
|
||||
0x0ccf, 0x7711, 0x001c, 0x47f8,
|
||||
0x0011, 0xe589, 0x7214, 0x2115,
|
||||
0x7313, 0x2115, 0xf074, 0x0190,
|
||||
0xe900, 0xe822, 0xf074, 0x01ad,
|
||||
0x7714, 0x2117, 0x7714, 0x080c,
|
||||
0x61f8, 0x3fb0, 0x0001, 0xf820,
|
||||
0x0203, 0x7714, 0x0820, 0xf074,
|
||||
0x019f, 0xf074, 0x019f, 0x6b14,
|
||||
0x0002, 0xf074, 0x019f, 0x7714,
|
||||
0x2117, 0x8184, 0xf074, 0x019f,
|
||||
0xf074, 0x01b4, 0x7211, 0x2114,
|
||||
0xf495, 0xf495, 0x6be1, 0x0001,
|
||||
0x0001, 0xfc00,
|
||||
},
|
||||
},
|
||||
{ /* Guard */
|
||||
|
|
|
@ -32,6 +32,7 @@ void dsp_load_apc_dac(uint16_t apc);
|
|||
void dsp_load_tch_param(struct gsm_time *next_time,
|
||||
uint8_t chan_mode, uint8_t chan_type, uint8_t chan_sub,
|
||||
uint8_t tch_loop, uint8_t sync_tch, uint8_t tn);
|
||||
void dsp_load_sniff_fn(struct gsm_time *next_time);
|
||||
void dsp_load_ciph_param(int mode, uint8_t *key);
|
||||
void dsp_end_scenario(void);
|
||||
|
||||
|
|
|
@ -236,6 +236,10 @@ l1s_sniff_cmd(uint8_t ul, __unused uint8_t burst_id, __unused uint16_t p3)
|
|||
|
||||
rfch_get_params(&l1s.next_time, &arfcn, &tsc, &tn);
|
||||
|
||||
/* Load the frame number (which is dumped via MCSI and used for
|
||||
* MCSI/serial synchronization */
|
||||
dsp_load_sniff_fn(&l1s.next_time);
|
||||
|
||||
dsp_load_rx_task(SNIFF_DSP_TASK, 0, tsc);
|
||||
|
||||
/* enable dummy bursts detection */
|
||||
|
|
|
@ -68,7 +68,7 @@ sniff_burst_ptr .ds 1
|
|||
|
||||
; Variables for MCSI
|
||||
mcsi_tmp .ds 1
|
||||
mcsi_cnt .ds 1
|
||||
mcsi_dat .ds 1
|
||||
|
||||
; ----------------------------------------------------------------------------
|
||||
; The code itself
|
||||
|
@ -181,8 +181,6 @@ mcsi_init:
|
|||
st #1, *AR1
|
||||
portw *AR1, MCSI_CONTROL_REG
|
||||
|
||||
call mcsi_clear_status
|
||||
|
||||
; Done
|
||||
ret
|
||||
|
||||
|
@ -196,6 +194,9 @@ mcsi_send_word:
|
|||
stm #mcsi_tmp, AR1
|
||||
call mcsi_clear_status
|
||||
|
||||
; perform XOR LRC
|
||||
xor *AR4, B
|
||||
|
||||
; Write TX word and increase address
|
||||
portw *AR4+, MCSI_TX0_REG
|
||||
|
||||
|
@ -212,13 +213,10 @@ mcsi_send_word:
|
|||
;
|
||||
; MCSI send burst
|
||||
;
|
||||
; Sends a burst of *AR2 words, beginning at the address of AR4
|
||||
; Parameters: the number of words to send at *AR2, start-address in AR4
|
||||
; Sends a burst of A words, beginning at the address of AR4
|
||||
; Parameters: the number of words to send in A, start-address in AR4
|
||||
;
|
||||
mcsi_send_burst:
|
||||
; Load word-count in A
|
||||
ldu *AR2, A
|
||||
|
||||
; Loop over all words
|
||||
1:
|
||||
call mcsi_send_word
|
||||
|
@ -257,17 +255,29 @@ mcsi_disable:
|
|||
; done for us. Only real work goes here.
|
||||
;
|
||||
burst_handler:
|
||||
; Store address of I/Q data
|
||||
stm #0x0CCE, AR4
|
||||
|
||||
; Initialize MCSI
|
||||
call mcsi_init
|
||||
|
||||
; Send the I/Q data over MCSI
|
||||
stm #mcsi_cnt, AR2
|
||||
stm #380, *AR2 ; 190 samples, 380 words
|
||||
; Initialize B used for XOR LRC
|
||||
ld #0, B
|
||||
|
||||
; Send magic string, stored in ndb param section
|
||||
stm #0x0C39, AR4 ; d_hole2_param[1]
|
||||
ld #4, A ; 4 words
|
||||
call mcsi_send_burst
|
||||
|
||||
; Store address of I/Q data
|
||||
stm #0x0CCE, AR4
|
||||
|
||||
; Send the NB I/Q data over MCSI
|
||||
ld #302, A ; 151 samples, 302 words
|
||||
call mcsi_send_burst
|
||||
|
||||
; Store and send XOR LRC
|
||||
stm #mcsi_dat, AR4
|
||||
stl B, *AR4
|
||||
call mcsi_send_word
|
||||
|
||||
; Disable MCSI
|
||||
call mcsi_disable
|
||||
|
||||
|
@ -302,11 +312,36 @@ burst_handler:
|
|||
; Initialize MCSI
|
||||
call mcsi_init
|
||||
|
||||
; Initialize B used for XOR LRC
|
||||
ld #0, B
|
||||
|
||||
; Send the demodulated burst data over MCSI
|
||||
stm #mcsi_cnt, AR2
|
||||
stm #34, *AR2 ; 5 + 29 words
|
||||
ld #34, A ; 5 + 29 words
|
||||
call mcsi_send_burst
|
||||
|
||||
stm #mcsi_dat, AR4
|
||||
|
||||
; Store address of a_a5fn[1] @ DSP page 0
|
||||
stm #0x080C, AR4
|
||||
|
||||
; Check DSP page
|
||||
bitf *(dsp_page), #1
|
||||
bc 1f, ntc
|
||||
|
||||
; Store address of a_a5fn[1] @ DSP page 1
|
||||
stm #0x0820, AR4
|
||||
1:
|
||||
; Send FN and d_ctrl_system via MCSI (contains the TSC)
|
||||
call mcsi_send_word ; send a_a5fn[0]
|
||||
call mcsi_send_word ; send a_a5fn[1]
|
||||
addm #2, AR4 ; AR4 = 0x0810/0x0824
|
||||
call mcsi_send_word ; send d_ctrl_system
|
||||
|
||||
; Store and send XOR LRC
|
||||
stm #mcsi_dat, AR4
|
||||
stl B, *AR4
|
||||
call mcsi_send_word
|
||||
|
||||
; Disable MCSI
|
||||
call mcsi_disable
|
||||
|
||||
|
|
Loading…
Reference in New Issue