5 measurements are now performed during a 51 multiframe. They are performed
at one of the 5 FCCH.
Additionally a timeslot offset can be given for each measurement. This way
it is possible to measure each timeslot seperately. The given ARFCN must be in
sync with the serving cell.
By pressing '*', the analyzer is turned on or off.
Each beep indicated a new measurement result.
Right and left button can be used to scroll. By holding the button, the input
is repeated.
This app is used to measure receive level of given channels.
By pressing digits, the channel can be selected.
By pressing left or right button, the frequency is increased/decreased.
By pressing the menu button, the maximum received level is shown until
pressing menu button again. (usefull for hopping)
By pressing up or down button, the volume of a tone is changed, that
indicates rx level.
The left soft button is used to toggle PCS/DCS on shared channel numbers.
The right soft button is used to toggle uplink and downlink.
This application had already been removed a while ago, but
was added again with one of the initial framebuffer commits.
Signed-off-by: Steve Markgraf <steve@steve-m.de>
We revert the initialization of the palette to the behaviour of the
old non-fb driver.
Signed-off-by: Steve Markgraf <steve@steve-m.de>
Signed-off-by: Andreas Eversberg <jolly@eversberg.eu>
Power measurement returned the first measurement result twice, now it is
returned only once.
Wrapping of ARFCN allows to measure the E-band en block. After measuring the
ARFCN 1023, the ARFCN wraps to 0. Special flags like ARFCN_UPLINK or
ARFCN_PCS are preserved while wrapping.
In order to allow applications to use the power button, the keypad handler
will wait half a second if the key is pressed and hold, until the power
is turned off. This way the application does not need to handle it.
The power off function will then wait until the button is released, so the
phone will not start again while the button is still pressed.
This way we can independentely control what frequency we want and
wheter we want to TX or RX. This allow TX on DL band and RX on UL band.
This also means all call to tx_window setup now need to properly set the
ARFCN_UPLINK flag !
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
I2C bus support up to 128 devices (mask 0x7F), but current calypso driver
is masked it to 64 (0x3F). I discover it because Motorola W220 has an I/O
expander PCA9537 at address 0x49 which could be reached.
Signed-off-by: Alan Carvalho de Assis <acassis@gmail.com>
Signed-off-by: Steve Markgraf <steve@steve-m.de>
Originally written by dexter and then Andreas did a lot of cleanup
work to bring it into shape for inclusion in master
Written-by: Philipp Maier <zero-kelvin@gmx.de>
Written-by: Andreas Eversberg <jolly@eversberg.eu>
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
The Compal E86 (C139/C140) has a different RFFE-configuration
than the other Compal phones. The Motorola C139 schematics
on this part look exactly the same, but in fact the board is missing
a transistor (U16), and it uses TSPACT2 adittionally.
This fixes the long-known problem with the C139/C140 phones
of the rx-level being over -20dBm worse as compared to the
E88/E89 phones, as well as the band selection on the
antenna switch in TX-mode (which was completely wrong,
but sort of worked anyway).
Signed-off-by: Steve Markgraf <steve@steve-m.de>
So far, the PA-enable signal has been enabled way to early and
also has been disabled much too late.
We're now setting the RFFE to TX-mode after opening the ABB
window, and setting the RFFE to RX-mode again after TX. This
yields to an almost perfectly timed TX-window, just like with the
stock firmware of the phone.
Signed-off-by: Steve Markgraf <steve@steve-m.de>
Found by clang:
warning: argument to 'sizeof' in 'memset' call is the same expression
as the destination; did you mean to remove the addressof?
Signed-off-by: Steve Markgraf <steve@steve-m.de>
This file was handled as a binary(!) file by git (thus the git rm).
Also, it missed the uppermost line of pixels in each character.
It will be replaced with a correct font in the next commit.
Signed-off-by: Steve Markgraf <steve@steve-m.de>
Since the powerbutton on the Pirelli DP-L10 doesn't seem to be
connected to the keypad scan matrix at all, we're using Iota's
PWON interrupt to determine if the powerbutton has been pressed,
and power off the phone after it has been released again.
This also affects the Compal phones, since the interrupt happens
quite some time before the keypad driver notices the keypress.
The code in the keypad driver that has been used so far to power
off the phone will remain as a backup when running without
interrupts at all (e.g. the loader application).
Signed-off-by: Steve Markgraf <steve@steve-m.de>
Also hard limit to maximum 4 pending frames (should not happen !), the
upstream is supposed to do its own flow control.
Written-by: Andreas Eversberg <jolly@eversberg.eu>
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
- It's broken by the use of compute_gain
- Since there is now an AGC loop, manually setting the register
as no effect.
If someone needs manual gain control for testing, he'll have to
re-implement a proper AGC override.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
When listening to BCCH, layer1 may measure the power level of neighbour
cells. A list of neighbour cell frequencies need to be sent to layer1.
After the measurement is done, the results are indicated to layer23.
rffe_compute_gain() is the new name for rffe_set_gain(). I needed to change
this, to solve the name collision with the rffe_set_gain() function, which
actually sets the absolute gain.
rffe_get_gain() will now read the absolute gain which has been computed by
rffe_compute_gain() or set by rffe_set_gain().
First we add 55500 to an int16_t, then later we subtract it again.
The bug only didn't become apparent as we wrap twice, once adding
then subtracting.
Discovered by Smatch:
firmware/layer1/tpu_window.c +127 l1s_rx_win_ctrl(24) warn: value 55000 can't fit into 32767 'stop'
Credits to Andreas Eversberg for finding this bug after countless
hours of debug and providing initial patch :)
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
Credits to Andreas Eversberg for finding this bug after countless
hours of debug :)
Written-by: Andreas Eversberg <jolly@eversberg.eu>
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
Ideally we should only panic in interrupt context. In user
context, we could wait ...
We could also return NULL and let the calling code deal with it
but it's not ready for that yet.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
gcc3 (and some gcc4) produce code which does not fit into the
0x5000-sized RAM sections. Extend them to 0x6000 for now, so it will
build correctly again. The created binary (gcc3) has been successfully
tested on my G2.
Signed-off-by: Wolfram Sang <wolfram@the-dreams.de>
We also disable them by default because:
- It can operate fine out of spec
- Some phone will actually do it (like using the DCS port for PCS)
- It's verbose for nothing for most people anyway
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
* We actually support TX 850/1900 now
* We try to find the better settings for a given frequency,
no matter if it's in spec or not ...
(for e.g. TXin in DCS downlink is better done with PCS config)
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
Depending on the chipset and the HW, not all ports are connected
and we need to know what we can use when we have the choice ...
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
We are just interested in the loaders here, no other applications needed.
Split it from the compal-based phones. Add mt62xx as first user.
Based on a patch by steve-m, but cleaned up and seperated from compal/calypso.
Signed-off-by: Steve Markgraf <steve@steve-m.de>
Signed-off-by: Wolfram Sang <wolfram@the-dreams.de>
This patch changes include paths to get osmocom-bb working with
the current libosmocore tree.
Among all these renames, you can notice several tweaks that I
added on purpose, and that require some explanation, they are:
* hexdump() in osmocon.c and osmoload.c has been renamed to avoid
clashing with hexdump() defined in libosmocore.
* gsmmap now depends on libosmogsm. Actually I had to cleanup
Makefile.am because I was experiencing weird linking problems,
probably due to a bug in the autotools. With the change included
in this patch, I got it compiled and linked here correctly.
This patch has been tested with the phone Motorola C123 and the
following images files:
* firmware/board/compal_e88/hello_world.compalram.bin
* firmware/board/compal_e88/layer1.compalram.bin
Using the osmocon, bcch_scan and mobile tools.
Signed-off-by: Pablo Neira Ayuso <pablo@gnumonks.org>
Without the delay we would fill the sercomm buffer faster than its
content can be sent, and the phone would end up in a panic and hang.
Signed-off-by: Steve Markgraf <steve@steve-m.de>
This attribute is toggled with the RTC interrupt, which is disabled
in layer1_init(). If an interrupt between rtc_init() and layer1_init()
occured, the display of the E88 phones remained inverted
Signed-off-by: Steve Markgraf <steve@steve-m.de>
This is for being able to read the whole flash on devices that use the bootrom,
and also fixes flash detection on the C139/C140/J100i
Signed-off-by: Steve Markgraf <steve@steve-m.de>
* This might be a workaround for a compiler bug
(gcc 4.5.2, binutils 2.21)
Signed-off-by: Andreas Oberritter <obi@saftware.de>
Signed-off-by: Steve Markgraf <steve@steve-m.de>
Newer GCC with GNU LIBC do not like our minimalistic version of
stdint.h and will have conflicts. Older GCC with older C Libs do
not have a stdint.h yet and the #include_next trick is failing. To
make matters worse NEWLIB does not export its version via the
pre-processor.
We will have to guess once more about the compiler. This code now
assumes that if we have a GCC < 4 that it does not have a stdint.h
and we will not try to include the next stdint.h file.
Don't assign to the variable given as argument. This prevents
clobbering the local 'reg' variables in uart_reg_{read,write}(),
which would in turn prevent the latch bits from being restored
correctly.
Signed-off-by: Alex Badea <vamposdecampos@gmail.com>
Store old_lcr only when switching to LCR == 0xBF. We don't want
to clobber old_lcr when switching back, otherwise we can't restore
the previous LCR value.
Signed-off-by: Alex Badea <vamposdecampos@gmail.com>
This works for both the default ROM bootloader and for our
custom one.
This will allow to implement easy patch loading.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
Altough quite counterintuitive, the TCH_A task does some voice coding
work ... at least during TCH/H subchannel 1 ...
Go figure ...
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
Otherwise, when it reached AFC_RETRY_COUNT, no new FB0 tasks
were scheduled, and you needed to restart the phone in order to
successfully sync to a cell
Signed-off-by: Steve Markgraf <steve@steve-m.de>
The initial bringup is mainly Dieter Spaar's work. I took the
logic and rewrote it, adapting to later scheduler changes and
adding support for several other things (tch_mode, initial HR
support, various cleanup, ...).
Initially-Written-by: Dieter Spaar <spaar@mirider.augusta.de>
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
At this point in the code, we don't know if we're TCH/H or TCH/F, so
just store the speech mode and we'll figure out what to tell the DSP
in the task code itself.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
If the task interrupted because of a reset, an allocated msgb
will be present and we need to free it instead of just loosing
the reference to it.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
Copying to/from the DSP API shared memory must be done using
16 bits word only. Using those method, we avoid the hassle of
repeating the code when we copy buffer back and forth.
API address must be 16 bits aligned but for our purpose, it's
good enough.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
For the host build the local_irq_save/_restore is a NOOP
and the compiler warns about the unused flags variable. Cast
it to void to avoid compiler warning.
This is Dieter's sync method adapted to the new TPU stuff.
Not perfect, but should work for TS[0:7] as long as you
leave a free frame between each TS changes ...
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
It's up to L23 to change the parameters using the appropriate
L1CTL call.
This is a mix between Harald's version and Dieter's version of
the TX control code.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
Instead of each primitive doing it independently, if there is a TPU
scenario in one of the item, we do a common setup with the base tn
returned by rfch_get_params.
Then each rx / tx window setup is relative to that 'base tn'. For
TX window, you have to explicitely request an offset of 3. (this
would allow for some test code to TX on ts=0 for eg.)
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
If those flags are set in one of the item of the current frame,
we end the tpu & dsp scenario in common code.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
Each item has a priority associated to it. The standard is :
-4 -> Responses processing
-3 -> L1S parameters changes
-2 -> [Reserved for TPU window setup]
-1 -> (anything)
0..7 -> Commands relative to time slot n
(relative to current l1s main timeslot)
8 -> (anything)
9 -> [Reserved for TPU window cleanup]
10 -> (anthing)
Note that with this modification, an item scheduled for the
current frame from within a call back won't have its priority
respected !
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
While releasing dedicated mode, pending SDCCH and SACCH messages need to be
flushed. Without it, it would also cause old pending messages to be sent
during next dedicated mode.
During IRQ handling, disabling and enabling IRQ may cause the same IRQ to
fire again. This is because the condition for this IRQ may be fullfilled
again, while still handling it. Using local_firq_save() and
local_irq_resore() intead, the IRQ handling will be completed before it is
cleared, and may then fire again.
The problem was detected during process of messages from layer23 to layer1.
In the IRQ context, the TX-functions of l23_api.c are called. There,
messages are queued and events are scheduled. During access to a queue or
a scheduler from any IRQ context or from normal context, interrupts must be
locked to prevent nested calls.
If it is not desired to call l23_api.c inside IRQ context, a message queue
must be used. If a message is written to that queue, it must be locked.
Afterwards a signal must be sent to the main process. The main process
locks the queue and de-queues the message. This is how it is done by all
layer 1 drivers of mISDN.
The given new frequency set will be used at given frame number.
If the frame number is already reached, the frequency set will be changed
directly.
The functionality has been successfully tested.
The layer23 will now set crypto mode and key when CIPHERING MODE COMMAND is
received. After crypto mode has been set, CIPHERING MODE COMPLETE is sent.
NOTE: Layer1 implements only the interface, there is no functionality to it
yet.
The interface between l1 and upper layer is called by several
name. IMHO l1ctl is shorted and sounds good so try to unify
using that.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
We've had two sets of TRF6151 GAIN related #defines which were used
in an incorrect manner, resulting in a vga_gain of 60, which is
outside of the allowed gain range.
Thanks to Dieter Spaar for spotting this bug
The keys are correctly detected and debounced. There is no delay_ms in the
interrupt handler anymore.
When a key is pressed, the columns of the keypad are polled and debounced
via timer interrupt. If no key is pressed, the timer interrupt is ignored
again.
Now layer23 supports selecting TS 0-4 with SDCCH/8 channels.
But some tests showed me that it doesn't work. Please help debugging.
Added DM release function to l1ctl.c and gsm48_rr.c.
We introduce trf6151_compute_gain() to compute the gain setting that
leads to the ideal analog baseband power input level.
This function is called from rffe_set_gain() for both the compal and
the gta0x rf frontend, as there are no other amplifiers inside those
phone designs.
The new AGC function is not used yet from the regular layer1 code.
Instead of using the 'normal burst' receive window, use the proper
RXWIN_PW for power measurements. However, in this case, one PW window
corresponds to one PM measurement and in order to do two measurements,
multiple PW windows need to be set-up in the TPU. Since we don't support
that yet, we simply switch to doing only one power measurement for now.
This allows to easily get the tsc/timeslot/arfcn we need to
use to the rx/tx of a burst.
Using this also sets properly the TSC and ARFCN now !
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
We include all the parameters we're gonna need to support
TS!=0, hopping, TSC, ...
We also assume the upper layer have decoded the low level
bit fields and gives us neat accessible variables and a
sorted ARFCN array for the Mobile Allocation
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
--gc-sections throws away any symbol that is not referenced from
either the entry symbol or explicit KEEP statements in the linker script.
We add KEEP() to make sure the constructors are kept.
We introduce the concept of CCCH mode. It can be either
- NONE: receive BCCCH only
- COMBINED: CCCH on a BCCH/CCCH+SDDCH/4
- NON_COMBINED: CCCH on a BCCH/CCCH
There is also a new command to change the mode without having
to do the resync.
Currently, we keep the previous default behavior of requesting
a combined CCCH by default
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
Andreas Eversberg
Harald Welte
Steve Markgraf
Sylvain Munaut
Dieter Spaar