Age | Commit message (Collapse) | Author | Files | Lines |
|
Change-Id: Id824f7c9d9d6110b4dc443653a14bfcd2e0cc2b3
|
|
Change-Id: I67cb04cfacdc4f2efa8bd829ecf66f0040bf430a
|
|
1. "no neighbor-measurement idle": neighbor cell measurement for cell
re-selection
2. "no neighbor-measurement dedicated": neighbor cell measurement for
handover
Change-Id: Icc5ff58aee3a1a4705e38839bd5cdf6bf7e30f03
|
|
Change-Id: I4897ed2c71ddf30afd057389ca67a9b9d6d88ace
|
|
Change-Id: Ic184772a57451d53797370d2cbac6653ec7b9847
|
|
The initial cell channel decription is received via SI1. During a call this
description may change due to handover, assignment, frequency redefinition.
Whenever it changes, the last received cell channel description is used to
handle messages that do not include this information element.
Example of one call with handover inbetween. The assignments do not include
a cell channel description:
IMMEDIATE ASSIGNMENT: Use cell channel description from SI1.
ASSIGNMENT COMMAND: Re-use cell channel description from SI1.
HANDOVER COMMAND: Use new cell channel description from HANDOVER COMMAND.
ASSIGNMENT COMMAND: Re-use cell channel description from HANDOVER COMMAND.
Change-Id: I4981b0a2a3f896a75e624d07c2d3628442f13ecf
|
|
sel_si structure tracks content of SI5* and SI6 messages. The informations
will change after handover, so they do not refer to the origin cell.
The list of scanned cells is not affected. The sel_si structure will be
overwritten with the selected cell after leaving dedicated mode.
Change-Id: Idd6a35c13de56115645e0861d95c256ebf9257f8
|
|
The handover is forced by reporting perfect measurement results of a given
neighbor cell. All other neighbor cells and the serving cell is reported as
poor. The falke report will sustain until the connection is released or a
new 'better' cell is specified.
Change-Id: Ie9245dbbb9142f14459ed13b2ff29a6c2dbf3d6c
|
|
The implementation supports:
- Non-synchronised handover
- Synchronized handover
- Pre-sychronized handover
- Pseudo-synchronized handover
Change-Id: I0aebe1adfddcc3ff794b980ea4e3651ff616c032
|
|
Change-Id: I1a972d9bac5749c67c1b139825400854f7cf1490
|
|
When establishing dedicate mode, a flag is used to disable transitter.
When transmitter is disabled, access bursts are allowed.
After sending a L1CTL_PARAM_REQ, the transmitter is enabled with given
parameters.
Change-Id: I43b14089e0b8988db6a73dd143c8ea806284ab7a
|
|
* Flag to enter dedicated mode with TX disabled
* Flag to use sync info of neighbor cell
* Flag to use sync info of previous serving cell
* Index of neighbor cell
All these parameters are required to handover to a new channel.
Change-Id: Iadbc47f006d1f8a019822aedee180814de13cb2d
|
|
The task will try to sync to neighbor cell during search (idle) frame.
Change-Id: I7f2c6b5438676a816c546cb9dce404762ee5d5b5
|
|
The task will measure power between TX and RX of successive TCH frames.
Change-Id: I0c5a1714249799ff0f2031ca0585ec051c61cc6b
|
|
Change-Id: I792b52d9bf115a2def9720eed3d62982d8cdbe00
|
|
When TPU offset must be changed (assignment to different timeslot or handover
to a different cell), all tasks will be disabled until new TPU offset has been
applied. Currently scheduled tasks are finished before the new TPU offset is
applied.
On change of TPU offset, the TPU's interrupt may skip one frame when changing
backwards in time. Also it may generate two interrupts when changing
significantly forward in time. This is compensated by changing the GSM time.
Change-Id: If858484a9cf497e0f6e8d84593ab3637c2668869
|
|
Change-Id: I03918bd864c711b377a795186123c85bb6f4dc4a
|
|
sap_fsm.c: In function ‘sap_negotiate_msg_size’:
sap_fsm.c:103:15: warning: passing argument 1 of ‘__bswap_16’ makes integer from pointer without a cast [-Wint-conversion]
size = ntohs((uint16_t *) param->value);
^~~~~~~~~~~~~~~~~~~~~~~~~
Change-Id: Ie58af6162c67ae377809b42daa897ca3f3d72af1
|
|
Change-Id: Ic48e240ee1484aaa793af23c62a24d2949900b86
|
|
Change-Id: I435ef2032b9cefe844c37f395d9087be6af8934a
|
|
Change-Id: I93da2e8ba9d3fda944b8171bc42e49063c925f9c
|
|
Change-Id: Id5c325ffcfea8175bc5d5499a0904c0984e00349
Fixes: OS#198542
|
|
Change-Id: I77ce68d5904ff623f10f6475309052666bab7742
|
|
Starting from [1], not only LMA but also VMA areas are now checked
for overlaps (see also [2]). This results into linking errors:
arm-none-eabi-ld: section .text.exceptions VMA
[000000000080001c,0000000000800037] overlaps section
.compal.reservedram VMA [0000000000800000,00000000008000fe]
arm-none-eabi-ld: section .text.exceptions VMA
[000000000080001c,0000000000800037] overlaps section
.compal.loader VMA [0000000000800000,00000000008000ff]
Let's try to work around this.
[1] https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=a87dd97a2098b7e18ff2574a4e81ae521ef7e6f2
[2] https://sourceware.org/bugzilla/show_bug.cgi?id=18452
Change-Id: I098ddd33aabd7ec27981e2f09d8582f167bb649b
Fixes: OS#1917
|
|
Change-Id: I4a489be6fafcd057c3edc4f3d5f76d645899f884
|
|
Change-Id: If3aaa730c306e703d1d430a8920284aa592c999c
|
|
According to the man page of recv(), the only difference of this
call from read() is the presence of flags. With a zero flags
argument, recv() is generally equivalent to read().
Change-Id: I6d43bbf8d52c5fbb8ee0592b7d1c1dfd2dd1548e
|
|
Since we only set both ARFCN and TDMA frame number of the DL info
header, other fields remain uninitialized. Let's memset() them.
Change-Id: Ib39c333f1724fefa5d8bd8a2315b77a5612f7fa9
|
|
This would allow to abstract both L1CTL and TRX interfaces
from each other in the upcoming refactoring.
Change-Id: I74a23c73b03bad822272b9cfe76c2501666912b7
|
|
Change-Id: I29ed122b8956260b9f847cc0e3e81a28d6762632
|
|
In both gsm48_mm.c and gsm48_rr.c we put / push 'gsm48_rr_hdr'
structure into the message buffers, so then it's retrieved by
the message receivers. The AddressSanitizer complains about
unaligned pointer access and potentially unexpected behaviour.
Change-Id: I8aa2c0074b405afd0e76044ef076b6819fe1083b
|
|
In gsm322_l1_signal(), if S_L1CTL_FBSB_ERR is received, we free
stored System Information of the current cell, but cs->si may
still point to it. Let's set it to NULL.
Found with AddressSanitizer:
DL1C ERROR l1ctl.c:96 FBSB RESP: result=255
DCS INFO gsm322.c:2995 Channel sync error, try again
DCS INFO gsm322.c:467 Sync to ARFCN=860(DCS) rxlev=-106
DRR INFO gsm48_rr.c:665 MON: no cell info
DRR INFO gsm48_rr.c:665 MON: no cell info
DRR INFO gsm48_rr.c:665 MON: no cell info
DRR INFO gsm48_rr.c:665 MON: no cell info
DL1C ERROR l1ctl.c:96 FBSB RESP: result=255
DCS INFO gsm322.c:3008 Channel sync error.
DCS DEBUG gsm322.c:3013 free sysinfo ARFCN=860(DCS)
DCS INFO gsm322.c:3020 Unselect cell due to sync error!
DCS INFO gsm322.c:509 Unselecting serving cell.
=================================================================
==6014==ERROR: AddressSanitizer: heap-use-after-free on address
0x61b0000000e6 at pc 0x00000050d6dd
bp 0x7fff7f84aa60 sp 0x7fff7f84aa58
Change-Id: I9cc526c18d69695d810de98703579818408de011
|
|
Change-Id: I4fe2fd6584a453a951361e1b67fb986583b176be
|
|
The old TOA256 range was bigger than we can actually store:
struct.error: 'h' format requires -32768 <= number <= 32767
Change-Id: I5d4e1fea9d07f2c49f01e6644d1c0d1dc8cf4e40
|
|
According to 3GPP TS 05.03, section 5.3, two coding schemes are
specified for access bursts: one for regular 8-bit bursts,
another - for extended 11-bit packet access bursts.
According to 3GPP TS 05.02, section 5.2.7, there are two
additional training (synchronization) sequences for RACH
bursts: TS1 & TS2. By default, TS0 synch. sequence is used,
unless explicitly stated otherwise (see 3GPP TS 04.60).
According to 3GPP TS 04.60, section 11.2.5a, the EGPRS capability
can be indicated by the MS using an alternative training sequence
(i.e. TS1 or TS2) and the 11-bit RACH coding scheme.
Change-Id: I36fd20cd5502ce33c52f644ee4c22abb83350df8
|
|
Use static helper to prepare l1ctl_fbsb_conf - this simplifies
fbsb-related functions and make difference between timer callback and
regular response more obvious.
Change-Id: I43832d6a912a32ea5795ed0110981e0b714a7a61
|
|
Change-Id: I0168d43951494f4010df891f391ddad4b57493d7
|
|
Use static helpers to add l1ctl_info_dl to msgb - this simplifies
l1ctl_* routines and reduce code duplication.
Change-Id: I0b5b81f1fcd2984136e553a93735ea5456d2b3df
|
|
It's only used as a boolean value so let's set proper type for it.
Change-Id: Iaf50cdd19ac2139ee2d625671410a486edae2999
|
|
Inspired by Sylvain's message at #osmocom.
Change-Id: I3f499837413e1dbd0ca62229dc9cb6f0f7475a42
|
|
In OS#3582, the autor of TIFFS code, Mychaela Falconia, has noted:
... all of my code contributions are in the public domain and
are NOT copyrighted by me, and I strenuously object to anyone
taking it upon themselves to insert a copyright notice with
my name in it.
Let's update the copyright statements as recommended by the author.
Change-Id: If115991425372a4cdbcfefa115532c9c410e58c4
|
|
Instead of counting both RSSI and ToA measurements separately,
let's have a single counter in trx_lchan_state.meas struct.
Change-Id: I45454a3ac92b8cc85dd74092e4ab6eb350f20c9a
|
|
All known TI GSM firmwares implement some kind of flash file system, or FFS.
We call it TIFFS (Texas Instruments FFS) because it is TI's invention.
TIFFS is a file system with a hierarchical directory tree structure, and
with Unixy forward-slash-separated, case-sensitive pathnames; the semantics
of "what is a file" and "what is a directory" are exactly the same as in
UNIX; and TIFFS even supports symlinks, although that support is a little
under-developed, and apparently no FFS symlinks were ever used in any
production GSM device. Thus the FFS implemented in TI-based GSM devices
(modems and "dumbphone" handsets) is really no different from, for example,
JFFS2 in embedded Linux systems.
The FFS in a GSM device typically stores two kinds of content:
- Factory data: IMEI, RF calibration values, device make/model/revision
ID strings etc. These files are expected to be programmed on the
factory production line and not changed afterward.
- Dynamic data written into the FFS in normal device operation: contacts,
settings / preferences, call history, received SMS, etc.
It should be noted that both Compal (Mot C1xx) and Foxconn (Pirelli DP-L10)
vendors moved their vital per-unit factory data out of the FFS into their
own ad hoc flash data structures, leaving their FFS only for less
critical data. However, we do enable TIFFS access for them anyway.
The location of TIFFS within the flash memory of a given GSM device is
defined by the firmware design of that device, but is always some integral
number of contiguous flash sectors.
- On Motorola/Compal C139/140 phones, the FFS used by the original
proprietary firmware occupies 5 sectors of 64 KiB each (320 KiB
in total), starting at 0x370000. C11x/123 use smaller FFS
configurations, whereas C155/156 seem to have switched to some
other FFS format, different from our familiar TIFFS.
- On the Pirelli DP-L10, the FFS used by the original proprietary
firmware occupies 18 sectors of 256 KiB each (for 4.5 MiB in total),
starting at the beginning of the 2nd flash chip select (0x02000000
in the ARM7 address space).
- On FCDEV3B (FreeCalypso hardware), the FFS is located in the first
8 sectors (of 256 KiB each) in the 2nd flash chip select bank,
which appears at 0x01800000 in the ARM7 address space.
- On the GTA01/02 GSM modem, FFS occupies 7 sectors of 64 KiB each,
starting at flash offset 0x380000.
For more information, please refer to the FreeCalypso project
documentation, from where this great contribution comes from.
Please note that existing MediaTek targets most likely use different
storage format as they have nothing from TI Calypso. Also, we don't
(yet) know the location of TIFFS on SE J100i and Compal E99 targets.
The TIFFS support is needed for the follow-up change, that
implements reading of the factory RF calibration values.
Tweaked (coding style changes) by Vadim Yanitskiy <axilirator@gmail.com>
Change-Id: If6e212baeb10953129fb0d5253d263567f5e12d6
Related: OS#3582
|
|
FCDEV3B (stands for "FreeCalypso development board, triband") is a
GSM mobile station development board by FreeCalypso project. The
board features the same legendary TI Calypso GSM MS chipset that
was used in commercial GSM/GPRS modems such as Openmoko's, and
functions as a standalone (or "bare") GSM modem.
For more information, please see the project's web side:
https://www.freecalypso.org/fcdev3b.html.
Change-Id: I09bd35a18d3ea094000050169a62fd82ba6eccfe
Related: OS#3581
|
|
The ability to read the second half of flash on E99 is needed
for the follow-up change, that implements reading of the
factory RF calibration values.
Change-Id: Ia677ebdc1ada9fd41daf211fd9da06cd118365fa
Related: OS#3582
|
|
Each given Mot C1xx phone is made either for 900+1800 MHz, in which
case only the DCS Rx port is connected, or for 850+1900 MHz, in which
case only the PCS Rx port is connected. Let's tell the TRF6151 driver
that both DCS and PCS ports are connected, so that the same binary
build can be used on both EU-band and US-band C1xx phones.
If one needs to tune the TRF6151 receiver out of spec, or at least
outside of the DCS/PCS Rx SAW filter's legitimate passband (or if
the SAW filter was changed or removed), then the rffe_get_rx_ports()
function might be changed to indicate which Rx port is physically
connected: PORT_DCS1800 only or PORT_PCS1900 only.
Change-Id: I620084c33ad165faffbbfc45923faedad77aafb2
|
|
Most Calypso peripheral interface signals are unconnected on
Openmoko GTA0x. Let's configure them to be GPIOs in IO_CONF_REG,
then configure them to be outputs in IO_CNTL_REG, then set
the outputs to 0 in ARMIO_LATCH_OUT.
Change-Id: I306ffacb623d2b06a188f84026ccadab408d1676
|
|
Set LPG and PWL pin mux like Pirelli's firmware does.
Change-Id: I099e13800b7821a8fb274c5264c9823153afe564
|
|
Change-Id: Ie5843c8adafc37da0d69c335c97b422552b85049
|
|
This change fixes the following compiler warning:
sim.c: In function ‘gsm_sim_reply’:
sim.c:149:11: warning: variable ‘payload’ set but not used
[-Wunused-but-set-variable]
uint8_t *payload;
Change-Id: I3767b23bb1b28d3f4bb515d399bce160ba2eee09
|