path: root/src/target
AgeCommit message (Collapse)AuthorFilesLines
2019-08-29trx_toolkit/ enrich some ValueError messagesVadim Yanitskiy1-2/+2
Change-Id: Icdf0d136a9b820cfaec534e2604204da9ea42092
2019-08-29trx_toolkit/ also print burst length in desc_hdr()Vadim Yanitskiy1-0/+3
Change-Id: Ia0036cbf70a3736a7f9779e030e05221cba8add9
2019-08-29trx_toolkit/ fix: make sure header version is knownVadim Yanitskiy1-3/+5
Before using DATA_MSG.HDR_LEN, we need to make sure that a parsed header version is known and supported. Otherwise we will get an IndexError exception. Change-Id: Ie1887aa8709da1a2a287aa58a7873e72c0b4ed33
2019-08-29trx_toolkit/ fix message length check in parse_msg()Vadim Yanitskiy1-3/+8
Unlike DATA_MSG.HDR_LEN, the CHDR_LEN is a constant that defines length of the common header, which is mandatory for every version. DATA_MSG.HDR_LEN in its turn defines length of the whole header, including the version specific fields. Thus we need to know the header version before using it. In DATA_MSG.parse_msg() we need to parse the common header first, so then we know the version and length of the whole header. After that we can safely use DATA_MSG.HDR_LEN. Change-Id: I2809f5f96209eed64bdabf7a15575144313f7cc9
2019-08-27trx_toolkit/ also print header for incorrect messagesVadim Yanitskiy1-1/+4
Change-Id: I376f1e7af46750e53305109cf4a9f64427b9960c
2019-08-27trx_toolkit/ also validate() sniffed messagesVadim Yanitskiy1-0/+1
Change-Id: Ica3e4702fdabfdae0c1025b650ff32c8e85a6edf
2019-08-27trx_toolkit/ print exact message parsing errorVadim Yanitskiy1-5/+5
For sure, the following message is much more informative: Ignoring an incorrect message: Unhandled version 12 than: Failed to parse message, dropping... NOTE: since the way of printing exceptions is different in both Python versions, I had to drop Python 2 support. Change-Id: I5fb02ce508c58ff94e47accc0ed655939eb53062
2019-08-27trx_toolkit/ raise exceptions from validate() methodsVadim Yanitskiy3-61/+74
Raising exceptions is a Pythonic way to handle errors, which in this particular case will help us to know *why* exactly a given message is incorrect or incomplete. Change-Id: Ia961f83c717066af61699c80536468392b8ce064
2019-08-11fw: Add support for Huawei GTM900-B modulesSteve Markgraf5-1/+464
Both MG01GSMT and MG01GSMT hardware variants are supported and automatically detected based on the flash manufacturer. Change-Id: I3a770ea93fc72c4e9b63078e253602f204b5be23
2019-08-11fw/flash: Read extended ID, expose APISteve Markgraf2-14/+36
We now unlock the flash before reading the extended ID (required for Spansion and Samsung flash chips). These commands will be ignored by Intel/ST flash chips, and this change has been verified with all flash chips we support. Furthermore, expose the API for reading the flash ID. Change-Id: I3bcd71c84c8931bcd574953063737b51a41738a3
2019-08-11fw/keypad: Poll Iota powerbutton if requiredSteve Markgraf4-8/+27
This commit adds polling of the TWL3025 PWON signal. If the powerbutton is pressed on targets that use it (Pirelli DP-L10, Huawei GTM900-B), a normal keypad scanning cycle is started in order to preserve the timing, required for the 500ms power off press duration for example. Change-Id: I904baf40d621bd680b602b88d12ff462b3c17596
2019-08-11fw/abb/twl3025: Add function to query PWON stateSteve Markgraf2-0/+30
This allows us to detect power button presses on the Pirelli DP-L10 and the Huawei GTM900-B module. Polling will only be activated once the power button has been pressed and we received the interrupt. The goal is to reduce the required amount of TWL3025 register accesses to a minimum. Change-Id: I31be61c8089173aed616abd1ede6c4cf5c9b6770
2019-08-11fw/build: Use arm-none-eabi as default toolchainSteve Markgraf1-1/+1
This is what we describe in our wiki and what ships with recent distros. Change-Id: I70da7eeb33275fa5fff1d8a3581c384e031b12e5
2019-08-05trx_toolkit: Fixes in TRXD documentationPau Espin Pedrol1-5/+5
Change-Id: I126a8aed6b2bac7a620e95f06ecb98642a63b5f0
2019-07-24trx_toolkit/ support additional capture filterVadim Yanitskiy1-0/+8
Change-Id: I761debb2e1c411f2c6d489eac0adf32060966a4c
2019-07-24trx_toolkit/ support sniffing on multiple portsVadim Yanitskiy1-6/+7
Change-Id: I76b818c673b98c427b5621ddb852f947c74557d6
2019-07-24trx_toolkit/ add support for reading from PCAP fileVadim Yanitskiy1-7/+23
Change-Id: I8a3481fbea5f6c917ae5684d0b5b806f4a76ff78
2019-07-24trx_toolkit/ basic TRXD header version 1 supportVadim Yanitskiy1-4/+27
Change-Id: Icd4505d211816dc80e91d65094be92f2aed856bd
2019-07-24trx_toolkit: fix compatibility with Python 3: 'is' vs '=='Vadim Yanitskiy5-5/+6
Change-Id: I8ba05c04f206578cf61df58573c24cba1d6fba52
2019-07-24trx_toolkit/ fix compatibility with Python 3Vadim Yanitskiy1-0/+1
Change-Id: I362881af83664f94be09d40f43dfb23d18a35136
2019-07-24trx_toolkit/ fix compatibility with Python 3Vadim Yanitskiy1-1/+1
Change-Id: I9cd9b7baae31045c6495b90df2517d32772098ed
2019-07-16target/*.py: shebang: use /usr/bin/env pythonAlexander Couzens20-20/+20
Use the system default python instead of a hardcoded python2 Allow to use python2 and python3. Change-Id: Iab185759b574eff1ca1b189dcbb4e1a3eec52132
2019-07-16trx_toolkit/ introduce a TRXC command for C/I simulationVadim Yanitskiy1-2/+29
C/I (Carrier-to-Interference ratio) is a value in cB (centiBels), computed from the training sequence of each received burst, by comparing the "ideal" training sequence with the received one. This change introduces a new command similar to FAKE_TOA and FAKE_RSSI, so it can be used by TTCN-3 test case 'TC_pcu_data_ind_lqual_cb' to verify that the link quality measurements are delivered to the PCU. Change-Id: I7080effbbc1022d1884c6d6f0cb580eba8e514ff Related: OS#1855
2019-07-16trx_toolkit/ implement TRXD header version negotiationVadim Yanitskiy2-1/+75
Messages on DATA interface may have different header formats, defined by a version number, which can be negotiated on the control interface. By default, the Transceiver will use the legacy header version (0). The header format negotiation can be initiated by the L1 using the 'SETFORMAT' command. If the requested version is not supported by the transceiver, status code of the response message should indicate a preferred (basically, the latest) version. The format of this message is the following: L1 -> TRX: CMD SETFORMAT VER_REQ L1 <- TRX: RSP SETFORMAT VER_RSP VER_REQ where: - VER_REQ is the requested version (suggested by the L1), - VER_RSP is either the applied version if matches VER_REQ, or a preferred version if VER_REQ is not supported. If the transceiver indicates VER_RSP different than VER_REQ, the L1 is supposed to reinitiate the version negotiation using the suggested VER_RSP. For example: L1 -> TRX: CMD SETFORMAT 2 L1 <- TRX: RSP SETFORMAT 1 2 L1 -> TRX: CMD SETFORMAT 1 L1 <- TRX: RSP SETFORMAT 1 1 If no suitable VER_RSP is found, or the VER_REQ is incorrect, the status code in the response shall be -1. As soon as VER_RSP matches VER_REQ in the response, the process of negotiation is complete. Changing the header version is supposed to be done before POWERON, but can be also done after. Change-Id: I8d441b2559863d2dbd680db371062e4f3a2f9ff9 Related: OS#4006
2019-07-16trx_toolkit/ basic TRXD version 0x01 supportVadim Yanitskiy3-5/+78
Since the new TRXD header format has been introduced, FakeTRX needs to be able to fill it correctly. In particular, the following: - Modulation, which can be determined from the burst length; - Training Sequence Code (and set), which needs to be detected by comparing the burst bits of L12TRX message against known training sequences (only GMSK and the default TS set for now); - C/I (Carrier-to-Interference ratio), which can be simulated later on, as instructed on the TRXC interface ('FAKE_CI'). The actual TRXD header version is stored in the instance of class DATAInterface. By default (at startup), legacy version 0 is used. The version negotiation is supposed to be performed on the TRXC interface, and to be implemented in a follow-up change. Different Transceivers may use different header versions, thus in FakeTRX.send_data_msg() we need to override the original version of the L12TRX message, and generate the corresponding PDU. Limitations: - NOPE / IDLE indications are not (yet) supported; - TSC detection: GMSK modulation only. Change-Id: I164f5ae4ce7694d6e324aab927a04e96d489ebd8 Related: OS#4006
2019-07-16trx_toolkit/ use TrainingSeqGMSK and BurstType enumsVadim Yanitskiy1-56/+16
Change-Id: I8a3faceae4a8d9b57d86d42600db839da073dad6
2019-07-16trx_toolkit/ introduce a new enum TrainingSeqGMSKVadim Yanitskiy1-1/+78
Training Sequences are defined in 3GPP TS 45.002, and used by the transceiver for detecting bursts. This change introduces an enum with training sequences for GMSK for Access and Normal bursts. This enumeration is needed for the follow-up changes that implement TRXD header version 1 support, and can now be used by RandBurstGen. Change-Id: If3bf102019ef53d6ee9ad230ef98bb45845b5af5
2019-07-11firmware/ make it compatible with python3Alexander Couzens1-1/+1
Change-Id: I711df515012f5542de5e5008c8fe4e601609759e
2019-07-02trx_toolkit/ legacy flag is only for version 0x00Vadim Yanitskiy1-1/+1
Since version 0x01, the burst bits are encoded as L16V, so appending two dummy octets doesn't make sense. Change-Id: I4d6c0bf54649d636ea6cb3fa2f37486b6619d5b3
2019-07-02trx_toolkit/ introduce header coding version 0x01Vadim Yanitskiy1-33/+362
The new version adds the following fields to the TRX2L1 message, keeping the L12TRX message unchanged: +------+-----+-----+-----+--------------------+ | RSSI | ToA | MTS | C/I | soft-bits (254..0) | +------+-----+-----+-----+--------------------+ - MTS (1 octet) - Modulation and Training Sequence info, and - C/I (2 octets) - Carrier-to-Interference ratio (big endian). == Coding of MTS: Modulation and Training Sequence info 3GPP TS 45.002 version 15.1.0 defines several modulation types, and a few sets of training sequences for each type. The most common are GMSK and 8-PSK (which is used in EDGE). +-----------------+---------------------------------------+ | 7 6 5 4 3 2 1 0 | bit numbers (value range) | +-----------------+---------------------------------------+ | . . . . . X X X | Training Sequence Code (0..7) | +-----------------+---------------------------------------+ | . X X X X . . . | Modulation, TS set number (see below) | +-----------------+---------------------------------------+ | X . . . . . . . | IDLE / nope frame indication (0 or 1) | +-----------------+---------------------------------------+ The bit number 7 (MSB) is set to high when either nothing has been detected, or during IDLE frames, so we can deliver noise levels, and avoid clock gaps on the L1 side. Other bits are ignored, and should be set to low (0) in this case. == Coding of modulation and TS set number GMSK has 4 sets of training sequences (see tables 5.2.3a-d), while 8-PSK (see tables 5.2.3f-g) and the others have 2 sets. Access and Synchronization bursts also have several synch. sequences. +-----------------+---------------------------------------+ | 7 6 5 4 3 2 1 0 | bit numbers (value range) | +-----------------+---------------------------------------+ | . 0 0 X X . . . | GMSK, 4 TS sets (0..3) | +-----------------+---------------------------------------+ | . 0 1 0 X . . . | 8-PSK, 2 TS sets (0..1) | +-----------------+---------------------------------------+ | . 0 1 1 X . . . | AQPSK, 2 TS sets (0..1) | +-----------------+---------------------------------------+ | . 1 0 0 X . . . | 16QAM, 2 TS sets (0..1) | +-----------------+---------------------------------------+ | . 1 0 1 X . . . | 32QAM, 2 TS sets (0..1) | +-----------------+---------------------------------------+ | . 1 1 1 X . . . | RESERVED (0) | +-----------------+---------------------------------------+ == C/I: Carrier-to-Interference ratio The C/I value is computed from the training sequence of each burst, where we can compare the "ideal" training sequence with the actual training sequence, and then express that difference in centiBels. Change-Id: Ie810c5a482d1c908994e8cdd32a2ea641ae7cedd Related: OS#4006, OS#1855
2019-07-01trx_toolkit/ implement header version codingVadim Yanitskiy1-15/+115
It may be necessary to extend the message specific header with more information. Since this is not a TLV-based protocol, we need to include the header format version. +-----------------+------------------------+ | 7 6 5 4 3 2 1 0 | bit numbers | +-----------------+------------------------+ | X X X X . . . . | header version (0..15) | +-----------------+------------------------+ | . . . . . X X X | TDMA TN (0..7) | +-----------------+------------------------+ | . . . . X . . . | RESERVED (0) | +-----------------+------------------------+ Instead of prepending an additional byte, it was decided to use 4 MSB bits of the first octet, which used to be zero-initialized due to the value range of TDMA TN. Therefore, the current header format has implicit version 0x00. Otherwise Wireshark (or would need to guess the header version, or alternatively follow the control channel looking for the version setting command. The reserved bit number 3 can be used in the future to extend the TDMA TN range to (0..15), in case anybody would need to transfer UMTS bursts. Change-Id: Idb0377d66290eb9c15d6998a5806a84fa2e5dd02 Related: OS#4006
2019-07-01trx_toolkit/ add burst randomization helpersVadim Yanitskiy1-18/+30
Change-Id: Idf1393d3d1f04e6c60b356b797a18e6f77b23554
2019-07-01trx_toolkit/ mark bit conversion methods as @staticmethodVadim Yanitskiy1-10/+14
Change-Id: I2f9fdd514908f186b1c6c043ee9b31c27a396900
2019-06-24trx_toolkit/ add basic class documentationVadim Yanitskiy1-0/+79
Change-Id: I538bc96e5e24d3b7e344e4dbe2877bf60c13c720 Related# OS#4006
2019-06-24trx_toolkit/ inline both gen_fn() and parse_fn()Vadim Yanitskiy1-14/+3
Both functions are never used outside of both gen_msg() and parse_msg(). AFAIR, they were more complicated until we started to use struct, but now they can be easily inlined. Change-Id: Ie64b271cf502f3df23b32f4b14a1e2b551a0f794
2019-06-24trx_toolkit/ drop double field initializationVadim Yanitskiy1-5/+0
Those fields are being initialized by __init__(). Change-Id: Ibf71be552a7eb5dab1d096421a8557514294683e
2019-06-24trx_toolkit/ tests: use random reference dataVadim Yanitskiy1-27/+14
Having fn = 1024 and tn = 0 in all tests decreases the chances to spot encoding / decoding bugs of higher or lower values. Let's randomize the reference data before all the tests. Change-Id: Id3c5be9faaf0bef727b975c7182098af0cec6e71
2019-06-01trx_toolkit/ fix: extend RSSI value range to [-47..-120]Vadim Yanitskiy1-1/+3
Change-Id: I9fce3462db14bd273a1498762cc9293fc888b45a
2019-05-28firmware/scheduler: Fix CBCH related RSL channel numbersVadim Yanitskiy2-10/+15
CBCH support in the firmware has been introduced almost at the same time it was implemented in trxcon, and the same mistake was made as described in Ia9a415628c659cbc2dd5dc65b875b7f935d6e211. Despite Calypso based PHY does not support PDCH (GPRS channels), let's avoid collisions and use the following cbits values: 0x19 / 0b11001 - MF_TASK_SDCCH4_CBCH on GSM_DCHAN_SDCCH_4_CBCH, 0x1a / 0b11010 - MF_TASK_SDCCH8_CBCH on GSM_DCHAN_SDCCH_8_CBCH. Change-Id: Ibb0f90695460e6ede12016c12a0cfdf9c74dfb24 Related: OS#4027
2019-05-17trx_toolkit/ avoid logging \0-terminatorVadim Yanitskiy1-1/+1
Change-Id: I93da2e8ba9d3fda944b8171bc42e49063c925f9c
2019-05-13firmware/Makefile: clarify toolchain configuration includeVadim Yanitskiy1-1/+1
Change-Id: I77ce68d5904ff623f10f6475309052666bab7742
2019-05-13firmware/ fix sections with overlapping VMAHarald Welte2-4/+4
Starting from [1], not only LMA but also VMA areas are now checked for overlaps (see also [2]). This results into linking errors: arm-none-eabi-ld: section .text.exceptions VMA [000000000080001c,0000000000800037] overlaps section .compal.reservedram VMA [0000000000800000,00000000008000fe] arm-none-eabi-ld: section .text.exceptions VMA [000000000080001c,0000000000800037] overlaps section .compal.loader VMA [0000000000800000,00000000008000ff] Let's try to work around this. [1];h=a87dd97a2098b7e18ff2574a4e81ae521ef7e6f2 [2] Change-Id: I098ddd33aabd7ec27981e2f09d8582f167bb649b Fixes: OS#1917
2019-04-24trx_toolkit/ fix TOA256 MIN/MAX constantsVadim Yanitskiy1-3/+3
The old TOA256 range was bigger than we can actually store: struct.error: 'h' format requires -32768 <= number <= 32767 Change-Id: I5d4e1fea9d07f2c49f01e6644d1c0d1dc8cf4e40
2019-03-06target/firmware/tiffs: update copyright statementsVadim Yanitskiy2-6/+8
In OS#3582, the autor of TIFFS code, Mychaela Falconia, has noted: ... all of my code contributions are in the public domain and are NOT copyrighted by me, and I strenuously object to anyone taking it upon themselves to insert a copyright notice with my name in it. Let's update the copyright statements as recommended by the author. Change-Id: If115991425372a4cdbcfefa115532c9c410e58c4
2019-02-19firmware/lib: introduce TIFFS filesystem supportMychaela Falconia17-2/+496
All known TI GSM firmwares implement some kind of flash file system, or FFS. We call it TIFFS (Texas Instruments FFS) because it is TI's invention. TIFFS is a file system with a hierarchical directory tree structure, and with Unixy forward-slash-separated, case-sensitive pathnames; the semantics of "what is a file" and "what is a directory" are exactly the same as in UNIX; and TIFFS even supports symlinks, although that support is a little under-developed, and apparently no FFS symlinks were ever used in any production GSM device. Thus the FFS implemented in TI-based GSM devices (modems and "dumbphone" handsets) is really no different from, for example, JFFS2 in embedded Linux systems. The FFS in a GSM device typically stores two kinds of content: - Factory data: IMEI, RF calibration values, device make/model/revision ID strings etc. These files are expected to be programmed on the factory production line and not changed afterward. - Dynamic data written into the FFS in normal device operation: contacts, settings / preferences, call history, received SMS, etc. It should be noted that both Compal (Mot C1xx) and Foxconn (Pirelli DP-L10) vendors moved their vital per-unit factory data out of the FFS into their own ad hoc flash data structures, leaving their FFS only for less critical data. However, we do enable TIFFS access for them anyway. The location of TIFFS within the flash memory of a given GSM device is defined by the firmware design of that device, but is always some integral number of contiguous flash sectors. - On Motorola/Compal C139/140 phones, the FFS used by the original proprietary firmware occupies 5 sectors of 64 KiB each (320 KiB in total), starting at 0x370000. C11x/123 use smaller FFS configurations, whereas C155/156 seem to have switched to some other FFS format, different from our familiar TIFFS. - On the Pirelli DP-L10, the FFS used by the original proprietary firmware occupies 18 sectors of 256 KiB each (for 4.5 MiB in total), starting at the beginning of the 2nd flash chip select (0x02000000 in the ARM7 address space). - On FCDEV3B (FreeCalypso hardware), the FFS is located in the first 8 sectors (of 256 KiB each) in the 2nd flash chip select bank, which appears at 0x01800000 in the ARM7 address space. - On the GTA01/02 GSM modem, FFS occupies 7 sectors of 64 KiB each, starting at flash offset 0x380000. For more information, please refer to the FreeCalypso project documentation, from where this great contribution comes from. Please note that existing MediaTek targets most likely use different storage format as they have nothing from TI Calypso. Also, we don't (yet) know the location of TIFFS on SE J100i and Compal E99 targets. The TIFFS support is needed for the follow-up change, that implements reading of the factory RF calibration values. Tweaked (coding style changes) by Vadim Yanitskiy <> Change-Id: If6e212baeb10953129fb0d5253d263567f5e12d6 Related: OS#3582
2019-02-19firmware/board: introduce new FCDEV3B (FreeCalypso) targetMychaela Falconia2-1/+148
FCDEV3B (stands for "FreeCalypso development board, triband") is a GSM mobile station development board by FreeCalypso project. The board features the same legendary TI Calypso GSM MS chipset that was used in commercial GSM/GPRS modems such as Openmoko's, and functions as a standalone (or "bare") GSM modem. For more information, please see the project's web side: Change-Id: I09bd35a18d3ea094000050169a62fd82ba6eccfe Related: OS#3581
2019-02-13firmware/board/compal_e99: enable reading the second half of flashMychaela Falconia1-0/+6
The ability to read the second half of flash on E99 is needed for the follow-up change, that implements reading of the factory RF calibration values. Change-Id: Ia677ebdc1ada9fd41daf211fd9da06cd118365fa Related: OS#3582
2019-02-13firmware/board/compal: indicate both DCS and PCS Rx ports as connectedMychaela Falconia2-4/+44
Each given Mot C1xx phone is made either for 900+1800 MHz, in which case only the DCS Rx port is connected, or for 850+1900 MHz, in which case only the PCS Rx port is connected. Let's tell the TRF6151 driver that both DCS and PCS ports are connected, so that the same binary build can be used on both EU-band and US-band C1xx phones. If one needs to tune the TRF6151 receiver out of spec, or at least outside of the DCS/PCS Rx SAW filter's legitimate passband (or if the SAW filter was changed or removed), then the rffe_get_rx_ports() function might be changed to indicate which Rx port is physically connected: PORT_DCS1800 only or PORT_PCS1900 only. Change-Id: I620084c33ad165faffbbfc45923faedad77aafb2
2019-02-12firmware/board/gta0x: fix GPIO and ASIC_CONF_REG configurationMychaela Falconia1-13/+10
Most Calypso peripheral interface signals are unconnected on Openmoko GTA0x. Let's configure them to be GPIOs in IO_CONF_REG, then configure them to be outputs in IO_CNTL_REG, then set the outputs to 0 in ARMIO_LATCH_OUT. Change-Id: I306ffacb623d2b06a188f84026ccadab408d1676
2019-02-12firmware/board/pirelli_dpl10: fix ASIC_CONF_REG settingMychaela Falconia1-2/+2
Set LPG and PWL pin mux like Pirelli's firmware does. Change-Id: I099e13800b7821a8fb274c5264c9823153afe564