FreeCalypso > hg > freecalypso-docs

annotate TCH-tap-modes @ 105:72a272083f46 default tip

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Linux-DTR-RTS-flaw: link to new fc-linux-patch repository
author Mychaela Falconia <falcon@freecalypso.org>
date Mon, 11 Dec 2023 19:02:01 +0000
parents 8a45cd92e3c3
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
95
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
1 It has been discovered that the DSP ROM in the Calypso GSM baseband processor
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
2 makes it possible to "tap" into speech traffic on GSM traffic channels (TCH):
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
3
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
4 1) In the downlink direction, the signal processing chain which every GSM MS
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
5 must implement includes a GSM 05.03 channel decoder, operating in one of
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
6 several variants as necessary for each supported TCH mode, followed by speech
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
7 decoders for each supported codec. TI's DSP naturally implements this
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
8 required signal processing chain, and this implementation includes one nifty
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
9 feature: the bits that make up the internal interface from GSM 05.03 channel
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
10 decoder output to the input of speech decoders are written into the NDB API
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
11 RAM page that is also accessible to the ARM core, and these bits can be
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
12 externally read out. The act of reading these bits is completely
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
13 non-invasive (we are only reading bits that are already there, not modifying
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
14 anything), thus we can sniff TCH downlink on any voice call in real time
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
15 without disrupting or impacting standard type-approved GSM MS operation in
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
16 any way.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
17
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
18 2) In the uplink direction, there is a reverse signal processing chain in which
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
19 the output of the internal speech encoder for the selected codec feeds into
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
20 the input of the corresponding GSM 05.03 channel encoder. In this direction
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
21 there are two tapping possibilities:
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
22
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
23 2a) There is a buffer in the NDB API RAM page from which one can read the bits
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
24 that pass from the speech encoder output to the channel encoder input -
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
25 let's call this form of TCH tap "uplink sniffing";
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
26
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
27 2b) There is a special mode in which the output of the internal speech encoder
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
28 is effectively suppressed and the input to the channel encoder comes from
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
29 another NDB API RAM buffer that needs to be filled by ARM firmware - let's
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
30 call this form of TCH tap "uplink substitution".
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
31
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
32 Sources of knowledge about these DSP functions
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
33 ==============================================
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
34
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
35 For the functions of TCH DL sniffing (tap 1 in the above summary) and TCH UL
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
36 substitution (tap 2b in the above summary), the primary source of knowledge is
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
37 the defunct '#if TRACE_TYPE==3' code in TSM30 and LoCosto L1 sources. I call
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
38 this code defunct because the TRACE_TYPE preprocessor symbol is set to 4 (not 3)
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
39 in both TCS211 and LoCosto versions, and appears to be set to 0 (all trace
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
40 disabled) in the ancient TSM30 build. This code appears to be some very old
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
41 test mode, apparently sending some test bit patterns into TCH UL and expecting
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
42 the same bit patterns back on TCH DL, presumably with a test instrument such as
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
43 CMU200 providing a loopback from UL to DL on this test TCH, and has only
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
44 survived in an incomplete form:
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
45
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
46 * There are '#if TRACE_TYPE==3' stanzas in l1_cmplx.c, in both TSM30 and LoCosto
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
47 versions, that implement DSP buffer writing for TCH UL substitution (TCH/F
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
48 only) and timing control for TCH DL buffer reading (both TCH/F and TCH/H),
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
49 calling a function named play_trace() for the latter.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
50
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
51 * There is no play_trace() code in the LoCosto source. but there is an
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
52 hw_debug.c source module in the TSM30 code drop under MCU/Layer1/L1c/Src,
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
53 and it contains (presumed) TI-legacy play_trace() and play_diagnostics()
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
54 functions, once again under '#if (TRACE_TYPE==3)'. play_trace() reads the
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
55 DSP's TCH DL buffer and saves the bits in an ARM firmware RAM buffer, and
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
56 then play_diagnostics() analyzes the captured booty - and studying the second
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
57 function is how we learn the apparent original intent of doing test bit
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
58 patterns on TCH.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
59
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
60 * The code that feeds "UL play" test bit patterns to the earlier-mentioned
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
61 '#if TRACE_TYPE==3' TCH UL substitution code in l1_cmplx.c (apparently once
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
62 hacked into dll_read_dcch() and tx_tch_data()) has not been found anywhere.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
63
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
64 For TCH tap 2a in our summary at the beginning of this article (non-invasive
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
65 sniffing of TCH UL bits produced by the internal speech encoder) there does not
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
66 exist any authoritative source of knowledge. It naturally follows from
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
67 otherwise-known Calypso DSP architecture that these internally produced TCH UL
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
68 bits should reside in the "main" a_du_0 buffer (or in a_du_1 when TCH/H
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
69 subchannel 1 is active), and I (Mother Mychaela) have heard an anecdotal report
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
70 (from someone who once worked with Calypso in a non-community-based manner) that
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
71 these UL bits could indeed be read out of this buffer - but in the absence of
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
72 an authoritative source, we don't know when would be the correct time to read
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
73 this buffer.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
74
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
75 In our current state of knowledge, only TCH DL sniffing can be exercised safely:
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
76 for UL sniffing we don't know the correct time when the buffer would need to be
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
77 read, while active UL substitution is obviously an invasive hack involving a DSP
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
78 debug or test feature that is never used in standard GSM MS operation.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
79
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
80 Support for different speech codecs
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
81 ===================================
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
82
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
83 When it comes to passively sniffing TCH DL and/or UL, we are merely reading bits
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
84 that are already there, and basic reasoning tells us that the DSP's DL and UL
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
85 buffers involved in this exercise exist in all speech TCH modes supported by
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
86 the DSP: FR1, HR1, EFR and AMR. However:
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
87
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
88 * The ancient '#if TRACE_TYPE==3' reference code exists only for FR1, HR1 and
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
89 EFR - it clearly predates the addition of AMR in the later Calypso DSP
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
90 versions.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
91
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
92 * FR1, HR1 and EFR are the only codecs for which we (FreeCalypso community) know
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
93 the format in which TCH DL bits appear in the DSP's a_dd_0 and a_dd_1 buffers.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
94
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
95 * I (Mother Mychaela) have heard an anecdotal report (from the same
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
96 non-community-based party mentioned earlier) that TCH DL bits could be read
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
97 out of a_dd_0 buffer in TCH/AFS (AMR) mode - but I never got any details.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
98
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
99 In contrast with passive sniffing, active TCH UL substitution requires explicit
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
100 support from the DSP - and this explicit DSP support is known to exist for
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
101 certain only for TCH/FS and TCH/EFS channel modes, i.e., for FR1 and EFR codecs
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
102 only. In the case of TCH/HS channel mode (HR1 codec), it *appears* that the DSP
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
103 supports UL substitution in this mode too, but this combination has only been
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
104 exercised by OsmocomBB people (the original '#if TRACE_TYPE==3' code for UL play
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
105 only supports TCH/F), and FreeCalypso policy is to treat everything coming out
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
106 of OBB as highly suspect.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
107
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
108 What about AMR? The anecdotal report (from the same already-mentioned party) is
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
109 that TCH UL substitution that works for FR1 and EFR appears to NOT work for AMR
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
110 - that's all I know - but frankly speaking, given that it's a weird DSP debug
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
111 mode that is never needed in standard GSM MS operation, I find it more
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
112 surprising that it works for FR1 and EFR than the observation that it doesn't
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
113 work for AMR.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
114
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
115 FreeCalypso support for TCH tap functions
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
116 =========================================
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
117
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
118 TCH DL sniffing and UL substitution provisions were initially implemented in
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
119 FreeCalypso back in 2016, but only in the Citrine version, which was deemed to
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
120 be a dead end later that same year. However, this functionality is now being
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
121 resurrected, and it has been incorporated into our production FC Tourmaline
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
122 firmware as of 2022-12-13.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
123
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
124 In order to activate the function of TCH DL sniffing and save the recording of a
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
125 TCH DL session into a file, one needs to use the fc-shell utility from FC host
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
126 tools, specifically the tch record command in an interactive fc-shell session.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
127 The format in which TCH DL tap traffic is passed over RVTMUX (an original
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
128 FreeCalypso invention) has changed in a slight but incompatible way between the
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
129 original hackish version from 2016 and the new production version as of 2022,
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
130 and capturing TCH DL with new firmware requires the updated version of fc-shell
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
131 that will be released as part of fc-host-tools-r18. The current (late 2022)
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
132 incarnation of FreeCalypso TCH DL sniffing feature supports FR1, HR1 and EFR
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
133 codecs, although only FR1 and EFR have been tested so far.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
134
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
135 The function of TCH UL substitution is currently implemented in FC Tourmaline
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
136 only for FR1 and EFR (no HR1, no AMR), and it likewise requires running an
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
137 interactive fc-shell session in which you would invoke the tool's tch play
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
138 command. In the case of TCH UL play feature there has been NO change in the
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
139 RVTMUX transport format between 2016 and 2022 versions.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
140
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
141 TCH DL DSP buffers and capture format
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
142 =====================================
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
143
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
144 The DSP's NDB API page has two buffers in which TCH DL bits appear: a_dd_0 and
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
145 a_dd_1. All TCH/F modes use a_dd_0, but TCH/H uses one buffer or the other
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
146 depending on the subchannel: subchannel 0 uses a_dd_0, subchannel 1 uses a_dd_1.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
147 (It is certainly a strange design - the DSP won't be able to receive and decode
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
148 the "wrong" subchannel because it doesn't know the ciphering key for the other
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
149 MS - but perhaps the designers of this DSP architecture aeons ago found this
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
150 design to somehow flow more naturally with their scheduling of DSP tasks.) Each
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
151 buffer consists of 22 16-bit words - they were originally 20 words, but then
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
152 extended to 22 words to support CSD 14.4 kbps mode.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
153
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
154 Each TCH buffer in the DSP's NDB API page consists of 3 status or header words
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
155 followed by N words of payload, where N depends on TCH mode: 17 for TCH/FS and
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
156 TCH/EFS, 8 for TCH/HS, and not-yet-studied for AMR and CSD. Let's begin our
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
157 analysis with the 3 status words that make up the buffer header:
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
158
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
159 Status word 0 (a_dd_0[0] or a_dd_1[0]) is a word of flag bits. We don't know
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
160 the meaning of every bit in this word, but at least for TCH/FS and TCH/EFS (we
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
161 haven't exercised TCH/HS at all) we know the following bits:
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
162
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
163 * Bit 15 (B_BLUD) is a "buffer filled" or "data present" flag. This flag is
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
164 observed as 1 in *almost* every 20 ms window in which a traffic frame is
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
165 expected (fn_report_mod13_mod4 == 0 in l1s_read_dedic_dl(), case TCHTF),
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
166 except for certain instances early in the call setup process which remain to
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
167 be studied.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
168
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
169 * Bit 14 (B_AF) will be set if the block of 8 half-bursts (block diagonal
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
170 interleaving of GSM 05.03) corresponding to this buffer was channel-decoded
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
171 as speech rather than as FACCH - see further analysis below.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
172
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
173 * Bit 9 (B_ECRC) has only ever been observed as 1 when B_AF is set, i.e., when
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
174 the speech-not-FACCH channel decoder was invoked. In the case of TCH/EFS this
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
175 bit is set to 1 if the EFR-added CRC-8 was bad, and cleared if this CRC-8 was
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
176 good; in the case of TCH/FS this bit has always been observed as 1 and should
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
177 be ignored because there is no CRC-8 in TCH/FS.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
178
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
179 * Bit 7 has always been observed as 1 wheneven B_BLUD is set but B_AF is
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
180 cleared, i.e., whenever the block was channel-decoded in FACCH rather than
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
181 speech mode.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
182
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
183 * Bits 6:5 indicate the result of FIRE decoding in the event that the FACCH
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
184 decoder was invoked.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
185
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
186 * Bits 4:3 carry the ternary SID flag encoded as in section 6.1.1 of GSM 06.31
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
187 and 06.81, but only when the speech-not-FACCH channel decoder was invoked as
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
188 indicated by B_AF.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
189
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
190 * Bit 2 is BFI as defined in section 6.1.1 of GSM 06.31 and 06.81. Whenever
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
191 the block was decoded as FACCH (bit 14 clear, bit 7 set), bit 2 has always
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
192 been observed as set, agreeing with the stipulation in GSM 06.31 and 06.81
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
193 that BFI=1 whenever a FACCH frame has been received. However, in the case of
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
194 TCH/EFS it appears that CRC-8 status (reported in bit 9) is NOT factored into
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
195 the logic that sets bit 2 - it appears that the subsequent speech decoding
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
196 logic is expected to OR bits 2 and 9 together to get the BFI flag for the Rx
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
197 DTX handler of GSM 06.81.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
198
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
199 In the case of 20 ms blocks (reassembled from 8 half-bursts) that were channel-
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
200 decoded as speech rather than FACCH, the observed behavior is that bits 15 and
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
201 14 are set, the payload portion of the buffer is filled with the output from the
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
202 channel decoder, and bits 4:3 are set from this payload by the bit-counting rule
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
203 of section 6.1.1 of GSM 06.31 and 06.81 irrespective of the good-or-bad status
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
204 in bits 2 and 9. However, when bit 14 is clear and bit 7 is set, indicating
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
205 that the block (from 8 half-bursts) was channel-decoded in FACCH mode, the
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
206 following additional behavior is observed:
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
207
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
208 * The payload portion of the buffer remains unchanged from its previous content,
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
209 last written when a frame was channel-decoded in speech-not-FACCH mode;
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
210
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
211 * Bit 2 is set, bit 9 is cleared;
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
212
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
213 * Bits 4:3 are cleared even when they previously indicated SID based on the bit
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
214 pattern in the payload portion of the buffer, even when that SID-encoding
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
215 payload is still there.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
216
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
217 In the standard TCH DL signal processing chain, GSM 05.03 channel decoding is
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
218 followed by the Rx DTX handler of GSM 06.31 or 06.81 for TCH/FS or TCH/EFS,
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
219 respectively. It appears that the Rx DTX handler implemented in TI's DSP is
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
220 driven by this status word 0 at the head of the buffer, and we can only guess
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
221 as to its exact logic. At this point it bears reminding that the functions of
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
222 the Rx DTX handler are not rigidly prescribed in the specs: in the case of EFR
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
223 the bit-exact reference implementation is normative only in certain aspects
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
224 (e.g., comfort noise generation after receiving SID), but is considered a non-
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
225 normative example in some other key aspects (all GSM 06.61 functions, including
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
226 what happens when a FACCH block was received when speech frames were expected),
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
227 and in the case of FR1 there is no bit-exact reference implementation at all,
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
228 only general guidance.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
229
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
230 Having the curiosity of a cat, I (Mother Mychaela) naturally desire to know
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
231 exactly how the Rx DTX handler (the bridge between the channel decoder and the
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
232 speech decoder) works in TI's DSP. A full static reversing job on the DSP ROM
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
233 would provide complete answers, but is a very daunting proposition, thus I am
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
234 also looking at the idea of behavioral analysis: the output of the speech
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
235 decoder can be captured from MCSI on FCDEV3B hardware, or from the VSP tap on
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
236 FC Venus if we ever build that board, and if we combine that speech decoder
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
237 output capture with the currently-discussed capture of TCH DL buffers, we may
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
238 be able to glean some insight into the workings of the Rx DTX handler block: we
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
239 could implement a candidate Rx DTX handler clone in software and compare the
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
240 output (of this proposed handler followed by the spec-defined speech decoder)
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
241 against the actual speech output from the DSP.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
242
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
243 Back to our exposition of TCH DL buffer content:
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
244
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
245 Status word 1 (a_dd_0[1] or a_dd_1[1]) is some kind of DSP measurement or count
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
246 which Calypso ARM fw does not need to look at, except when debugging - the only
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
247 code which I (Mother Mychaela) could find that does anything with this DSP
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
248 status word is the ancient play_diagnostics() code in the TSM30 version
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
249 (obviously never included in any production fw); this code looks at the unknown
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
250 word in question and calls it "D_MACC". This play_diagnostics() code compares
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
251 the D_MACC reading against a threshold, and if the per-block reading is below
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
252 the threshold, an error message is printed. That's all we know!
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
253
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
254 Status word 2 (a_dd_0[2] or a_dd_1[2]) is a bit error count: the code in
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
255 l1s_read_dedic_dl() reads this error count and uses it for RXQUAL computation
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
256 for measurement reports.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
257
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
258 If one's area of interest is in replicating Rx DTX handling and speech decoding
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
259 that happens in the DSP, status words 1 and 2 can probably be ignored - instead
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
260 the important parts are status word 0 (extensively covered above) and the
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
261 payload portion of the buffer.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
262
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
263 The payload portion of the buffer consists of some number of 16-bit words: 17
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
264 of them for TCH/FS and TCH/EFS, or 8 of them for TCH/HS. The DSP does not have
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
265 any notion of 8-bit bytes, instead it operates on 16-bit words as its elementary
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
266 data unit. The ordering of bits within these 16-bit words (in the payload
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
267 portion of TCH buffers) is from the most-significant bit toward the least-
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
268 significant bit, thus when these TCH buffers are transferred via octet-oriented
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
269 interfaces, the upper byte of each word should be transferred first, even though
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
270 this byte order is counter to the little-endian byte order of the Calypso ARM
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
271 core.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
272
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
273 In the case of TCH/FS and TCH/EFS, the fill order of bits in the payload words
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
274 is as follows, starting with the most-significant bit of buffer word 3 (first
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
275 word of the payload portion):
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
276
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
277 * 182 bits of class 1;
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
278
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
279 * 4 dummy bits (always observed as 0);
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
280
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
281 * 78 bits of class 2;
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
282
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
283 * the last 8 bits of a_dd_0[19] are unused.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
284
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
285 In the case of TCH/HS, the fill order is similar, but modified as appropriate
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
286 for TCH/HS:
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
287
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
288 * 95 bits of class 1;
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
289
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
290 * 4 dummy bits;
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
291
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
292 * 17 bits of class 2;
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
293
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
294 * the last 12 bits of a_dd_0[10] or a_dd_1[10] are unused.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
295
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
296 Aside from the insertion of 4 extra dummy bits at the boundary between class 1
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
297 and class 2, the overall bit order is that of GSM 05.03 Figure 1 interface 1.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
298
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
299 In the case of TCH/EFS, the following additional considerations apply:
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
300
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
301 * Bits [65:73] in all received DL frames, where CRC-8 would go in the 260-bit
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
302 frame of GSM 05.03 interface 1 for EFR, are always observed as 0, whether
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
303 this CRC-8 was good (a_dd_0[0] bit 9 clear) or bad (a_dd_0[0] bit 9 set).
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
304
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
305 * The handling of repetition bits (4 bits of 244-bit EFR codec frame, each of
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
306 which is triplicated in the channel encoding for transmission) is unclear.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
307
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
308 Further detail regarding the repetition bits of TCH/EFS: distinct bit positions
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
309 exist in the 260-bit frame of GSM 05.03 interface 1 (which is the frame format
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
310 in the TCH buffers of TI's DSP) for each of the 3 copies of each of the 4
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
311 triplicated bits. It is obvious that correct decoding of these triplicated bits
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
312 requires a majority-vote function just like the one implemented in TMR systems
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
313 in space gear - but it is not absolutely and unquestionably obvious where this
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
314 TMR voting function is implemented in the Rx processing chain of TI's DSP. It
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
315 *appears* that this majority-vote function has already been performed by the DSP
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
316 function that writes a_dd_0, and that the first bit position out of each group
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
317 of 3 holds the output of this voting function, so that the subsequent speech
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
318 decoder only needs to use those "cooked" bits - but there is this mystery:
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
319
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
320 * At certain times, particularly during the main part of a test call, TCH DL
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
321 buffer readouts contain zeros in the "extra" repetition bit positions: for
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
322 each group of 3 bits, the first will contain 0 or 1, but the other two will
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
323 always be 0.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
324
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
325 * At other times, seemingly in the beginning and ending parts of test calls,
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
326 TCH DL buffer readouts contain matching bit values in all 3 positions: for
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
327 each group of 3 bits, if the first bit is 0, the other two will also be 0, or
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
328 if the first bit is 1, then the other two will also be 1.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
329
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
330 One possibility is that the DSP applies the required majority-voting function,
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
331 writes its output into the first bit position of each group of 3, but then
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
332 sometimes (and not at other times) applies another function that writes the
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
333 voting function output into the remaining bit positions, perhaps for loopback
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
334 of TCH DL into TCH UL. More study is needed in this area.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
335
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
336 FreeCalypso file format for TCH DL captures
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
337 ===========================================
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
338
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
339 The file format written by fc-shell tch record command is ASCII hex, line-based,
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
340 with one line for every captured 20 ms window. The new format as of 2022 is:
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
341
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
342 * Each line begins with an FR, HR or EFR keyword indicating which variant of
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
343 TCH DL has been captured;
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
344
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
345 * This keyword is followed by 3 space-separated DSP status words, each written
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
346 as 4 hex digits;
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
347
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
348 * The main body of the frame is written as 33 (TCH/FS & TCH/EFS) or 15 (TCH/HS)
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
349 hex bytes, produced from the payload portion of the TCH DL buffer by turning
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
350 each 16-bit word into 2 bytes (MSB first) and discarding the last byte that
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
351 is unused (always 0);
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
352
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
353 * Each line ends with a frame number in decimal, specifically the value of
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
354 fn_mod_104 variable in the l1s_read_dedic_dl() function when the DSP buffer
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
355 was read.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
356
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
357 The addition of the frame number field allows these TCH DL captures to be
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
358 reconciled against the SACCH multiframe structure, which matters for the rules
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
359 of DTX.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
360
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
361 TCH UL substitution: open questions
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
362 ===================================
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
363
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
364 Moving from the mostly-understood realm of TCH DL capture into the much more
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
365 experimental realm of TCH UL substitution, we have some open questions: how does
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
366 this DSP special mode really work? Here is what we know: if we load externally
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
367 sourced speech frames into otherwise-unused a_du_1 DSP buffer at the time of
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
368 (fn_report_mod13_mod4 == 3), which is the same time when FACCH or CSD UL would
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
369 be expected, and set B_PLAY_UL bit in DSP NDB API word d_tch_mode, the speech
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
370 frame stream going to the other end of the call will be the one we feed into
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
371 a_du_1 instead of the one produced from the microphone input by the internal
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
372 speech encoder. But here are the parts we don't know:
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
373
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
374 * If one were to set B_PLAY_UL in d_tch_mode but not feed external UL input
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
375 into a_du_1 buffer at the needed time, what will happen?
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
376
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
377 * Vice-versa, if one were to load a_du_1 and set its B_BLUD bit without setting
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
378 B_PLAY_UL in d_tch_mode, what will happen?
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
379
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
380 * Can the frame stream fed into a_du_1 be encoded in DTX-enabled mode, including
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
381 SID frames? If this possibility is allowed, what magic bits would need to be
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
382 set where in order to get the correct behavior from the DSP's subsequent
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
383 burst-by-burst DTX logic?
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
384
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
385 TCH UL substitution: implemented PoC
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
386 ====================================
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
387
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
388 Back in 2016 we implemented a proof-of-concept TCH UL play feature in
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
389 FreeCalypso (only for TCH/FS and TCH/EFS), and the same PoC has been retained
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
390 when the overall TCH tap facility has been mainlined in late 2022. Having this
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
391 highly experimental (not fit for production use) TCH UL play code present in our
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
392 current production fw is deemed acceptable because this code will never be
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
393 invoked unless the user sends TCH_ULBITS_REQ packets to the running fw via
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
394 RVTMUX - and if you do send such packets (via tch play command in an fc-shell
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
395 session or by any other means), you are leaving the realm of production-approved
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
396 functionality and entering the realm of wild experimentation.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
397
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
398 The PoC TCH UL play mechanism consists of a small buffer (holding up to 4 FR1 or
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
399 EFR frames) implemented in the ARM firmware; this buffer is filled by arriving
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
400 TCH_ULBITS_REQ packets and drained by the tchf_substitute_uplink() function
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
401 called from l1s_ctrl_tchtf(). Specifically, a flag named tch_ul_play_mode is
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
402 set when TCH_ULBITS_REQ input is received, telling l1s_ctrl_tchtf() to start
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
403 calling tchf_substitute_uplink() when (fn_report_mod13_mod4 == 3); the called
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
404 function drains an uplink frame from the ring buffer, writes it into the DSP's
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
405 a_du_1 buffer, sets B_PLAY_UL in d_tch_mode and sends a TCH_ULBITS_CONF packet
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
406 back to the host. If the ring buffer is empty, the function clears both
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
407 B_PLAY_UL and the firmware's tch_ul_play_mode flag, ending the special TCH UL
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
408 play mode.
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
409
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
410 This PoC mechanism is meant to be exercised with tch play command in an
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
411 interactive fc-shell session: this command reads an ASCII line-based uplink data
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
412 file and sends it to the firmware frame by frame, paced by TCH_ULBITS_CONF
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
413 packets from the target. The input to this command is a line-based ASCII hex
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
414 file similar to the format written by tch record, but simplified: each line is
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
415 just the 33-byte frame to be sent (in TI DSP buffer format, following GSM 05.03
8a45cd92e3c3 TCH-tap-modes: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff changeset
416 interface 1), without any flags or status words or frame numbers.