API tools faq
paste
Guest User

DOCSIS MAC driver for ancient Broadcom cable modems, my attempt to turn them into TV receivers

a guest
Jun 5th, 2023
323
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 18.82 KB | None | 0 0
raw download clone embed print report
  1. #include <stdio.h>
  2. #include <cyg/hal/bcm33xx_regs.h>
  3. #include <cyg/kernel/kapi.h>
  4. #include <sys/types.h>
  5. #include <sys/socket.h>
  6. #include <netinet/in.h>
  7. #include <netinet/ip.h>
  8. #include <inttypes.h>
  9. #include "hwaccess.h"
  10. #include "forth.h"
  11. #include "ficl.h"
  12. #include "shell.h"
  13.  
  14. #include "desTable.h"
  15.  
  16. // bloody hell
  17.  
  18. #define GLOBAL_CTRL_STATUS 0xfffe3000 // 8
  19. #define IRQ_PEND 0xfffe3002 // 16
  20. // bit 6 DS Data DMA??
  21. // bit 5 DS Msg DMA?? (one right, but not sure which!!!)
  22. #define IRQ_DS_DATA_DMA_ERROR (1 << 6)
  23. #define IRQ_DS_MSG_DMA_ERROR (1 << 5)
  24. #define IRQ_DS_MSG_DMA (1 << 1) // packet RX'd
  25. #define IRQ_DS_DATA_DMA (1 << 0) // packet RX'd
  26. #define IRQ_MASK 0xfffe3004 // 16
  27. #define DS_DEVICE_ID 0xfffe300a // 16
  28.  
  29. #define SOMETHING 0x3024
  30.  
  31. // Hardware downstream data filter table UBR925-K.BIN 0x8036d02c
  32.  
  33. #define DS_PID 0xfffe3060 // 16
  34. #define DP_ENABLE (1 << 15)
  35. #define DP_MODE_SEL (1 << 14) // 1=DOCSIS 0=????
  36. #define DP_UNKNOWN13 (1 << 13)
  37. #define DP_PID(n) ((n) & 0x1fff)
  38. #define DS_UNKNOWN3063 0xfffe3063
  39. #define DS_MAC_DA_MC 0xfffe3064 // 32
  40. #define DS_MAC_DA_FILTER_CTRL 0xfffe3068 // 16 FIXME(affects MSG queue)
  41. #define DMDFC_ENABLE (1 << 15) // enable RX of UCD, no
  42. #define DMDFC_PROMISC (1 << 3) // enable promiscuous mode
  43. #define DMDFC_UNKNOWN5 (1 << 5)
  44. #define DMDFC_UNKNOWN7 (1 << 7)
  45. #define DS_MAC_FILTER_CTRL 0xfffe3069 // 8 FIXME
  46. #define DS_MAC_MSG_PROTO_VER_BYTE1 0xfffe306a // 8
  47. #define DS_MAC_MSG_PROTO_VER_BYTE2 0xfffe306b // 8
  48. #define DS_REG_RANG_REQ_SID 0xfffe306e // 8 (read only???)
  49.  
  50.  
  51. // Thank you Cisco!!!!
  52.  
  53.  
  54. #define DS_DES_CTRL 0xfffe3080 // 8
  55. #define DS_DES_UNENCRYPTED_LENGTH 0xfffe3081 // 8 # of initial bytes to be unencrypted defult 0x0c
  56. #define DS_DES_SID_ENABLE 0xfffe3084 // 16 # 1=enable SID matching?
  57. #define DS_DES_SID_TABLE(n) (0xfffe3086 + (n * 4)) // 16, SIDS to be encrypted
  58. #define DS_DES_SV 0xfffe30a6 // 8 ???
  59. DES security version register; the range of the version field in the BPI extended headers that will be accepted by the hardware; high byte is upper limit low byte is lower limit. The Cisco UBR945 will accept versions 0 to 15.
  60. #define US_DES_CTRL 0xfffe30a7 // 8
  61.  
  62. // Timing Recovery Circuit
  63. #define TRC_LOOP_ENABLE 0xfffe3100 // 8
  64. #define TRC_MINISLOT_DIVISOR 0xfffe3101 // 8
  65. #define TRC_K0_CTRL 0xfffe3102 // 8
  66. #define TRC_K1_CTRL 0xfffe3103 // 8
  67. #define TRC_ACQ_THRESHOLD 0xfffe3104 // 8
  68. #define TRC_ERR_THRESHOLD 0xfffe3105 // 8
  69. #define TRC_TIMEOUT_THRESHOLD 0xfffe3106 // 8
  70. #define TRC_NCO_BIAS 0xfffe3108 // 16
  71. #define TRC_RANGING_OFFSET 0xfffe310c // 16 OK
  72. #define TRC_TS_ERR 0xfffe3110 // 8
  73. #define TRC_SYNC_VALID 0xfffe3111 // 8
  74. #define TRC_TIMEOUT_ERR 0xfffe3112 // 8
  75. #define TRC_DELTA_F 0xfffe3114 // 16
  76. #define TRC_MINISLOT_COUNT 0xfffe3118 // 32
  77.  
  78. #define SPI_DYNAMIC_CTRL // 8
  79. #define SPI_STATIC_CTR // 8 0x9f
  80. #define SPI_AUTONOMOUS // 8 0x01
  81. #define SPI_IRQ_ACK // 8
  82. #define SPI_CMD // 8
  83. #define SPI_ADDR // 8
  84. #define SPI_DATA // 7 * 8
  85.  
  86. #define US_RANGE_FIFO 0xfffe3140 // 8
  87. #define US_CTRL_STATUS 0xfffe3141 // 8 us_ctrl_status
  88. #define US_BYTES_PER_MINISLOT_EXP 0xfffe3149
  89. #define US_MINISLOTS_PER_REQ 0xfffe314a // 8
  90. #define US_MAX_RE_REQ 0xfffe314b // 16
  91.  
  92. // MAC MIB Counters
  93. #define DM_DATA_FIFO_OVERRUNS 0xfffe3181
  94. #define DM_HCS_ERRORS 0xfffe3182
  95. #define DM_MAC_MSG_CRC_ERRORS 0xfffe3184
  96. #define DM_MAC_MSG_OVERRUNS 0xfffe3186
  97. #define DM_DS_DATA_OVERRUNS 0xfffe3188
  98. #define DM_US_UNDERFLOWS 0xfffe318a
  99. #define DM_US_RANGE_REQS 0xfffe318c
  100. #define DM_DS_MAP_REJECTS 0xfffe318e
  101. #define DM_DS_MPEG_XPORT_ERRORS 0xfffe3190
  102. #define DM_DS_QUAL_SYNCS 0xfffe3194
  103. #define DM_DS_QUAL_MAPS 0xfffe3198
  104. #define DM_DS_QUAL_UCD_COUNT 0xfffe319c
  105. #define DM_DS_MAC_HDR_COUNT 0xfffe31a0
  106. #define DM_DS_DATA_PKT_COUNT 0xfffe31a4
  107. #define DM_DS_MAC_MSG_COUNT 0xfffe31a8
  108. #define DM_US_TX_BYTE_COUNT 0xfffe31ac
  109. #define DM_DS_MAX_MSG_BYTE_COUNT 0xfffe31b0
  110.  
  111. // Downstream DMA (wrong, not the same in BCM3345)
  112. //#define DS_DATA_BD_BASE 0xfffe3200 // 32 OK
  113. //#define DS_DATA_DMA_INDEX 0xfffe3204 // 16 OK
  114. //#define DS_DATA_DMA_CTRL 0xfffe3206 // 8 OK
  115. //#define DS_MSG_BD_BASE 0xfffe2210 // 32 OK
  116. //#define DS_MSG_DMA_INDEX 0xfffe2214 // 16 OK
  117. //#define DS_MSG_DMA_CTRL 0xfffe2216 // 8 OK
  118.  
  119. // Downstream DMA guessed names and addresses for BCM3345
  120. #define DS_DATA_DMA_CTRL 0xfffe3200 // 8
  121. #define DS_DATA_DMA_INDEX 0xfffe3203
  122. #define DS_DATA_BD_BASE 0xfffe3204 // not sure if it's really PD
  123. #define DS_DATA_PD_BASE 0xfffe3208 // not sure if it's really PD
  124. #define DS_DATA_TRIGGER 0xfffe320c // 8
  125.  
  126. #define DS_MSG_DMA_CTRL 0xfffe3210 // 8
  127. #define DS_MSG_DMA_INDEX 0xfffe3213
  128. #define DS_MSG_BD_BASE 0xfffe3214 // not sure if it's really PD
  129. #define DS_MSG_PD_BASE 0xfffe3218 // not sure if it's really PD
  130. #define DS_MSG_TRIGGER 0xfffe321c // 8
  131.  
  132. // Upstream DMA
  133. #define US_PD_BASE 0xfffe3220 // 32 OK
  134. #define US_BD_BASE 0xfffe3224 // 32 OK
  135. #define US_SID_TABLE(n) (0xfffe3228 + (n * 0x20))
  136. #define US_QUEUE_SID 0xfffe3228 // 16
  137. #define US_DMA_CTRL 0xfffe322a // 8
  138. #define US_DMA_TX_START 0xfffe322c // 8
  139.  
  140. #define MAP_PARSER_SIDS(n) (0xfffe32a2 + ((n) * 2))) // 4 entries, 16bi
  141.  
  142. #define DS_DATA_DA_FILTER_CTRL 0xfffe3500 // 8
  143. #define DS_DATA_DA_EN 0xfffe3502 // 16
  144. #define DS_DATA_DA_MC 0xfffe3504 // 32
  145. #define DS_DATA_FILTER_TABLE(n) (0xfffe3508 + ((n) * 4)) // 16 entries, 32bi
  146.  
  147. // Burst Control
  148. #define BCB_REQUST 0xfffe3603
  149. #define BCB_REQUEST_BANK 0xfffe360e
  150. #define BCB_REQUEST_DATA_BANK 0xfffe360f
  151. #define BCB_INIT_MAINT_BANK 0xfffe3610
  152. #define BCB_STN_MAINT_BANK 0xfffe3611
  153. #define BCB_SHORT_GRANT_BANK 0xfffe3612
  154. #define BCB_LONG_GRANT_BANK 0xfffe3613
  155. #define BCB_SHORT_DATA_GRANT 0xfffe3614
  156. #define BCB_LONG_DATA_GRANT 0xfffe3615
  157. #define BCB_REQ_OVERHEAD_BYTES 0xfffe3616
  158. #define BCB_REQ_CODEWORD_BYTES 0xfffe3617
  159. #define BCB_INIT_MAINT_OVERHEAD_BYTES 0xfffe361a
  160. #define BCB_INIT_MAINT_CODEWORD_BYTES 0xfffe361b
  161. #define BCB_STN_MAINT_OVERHEAD_BYTES 0xfffe361c
  162. #define BCB_STN_MAINT_CODEWORD_BYTES 0xfffe361d
  163. #define BCB_SHORT_GRANT_OVERHEAD_BYTES 0xfffe361e
  164. #define BCB_SHORT_GRANT_CODEWORD_BYTES 0xfffe361f
  165. #define BCB_LONG_GRANT_OVERHEAD_BYTES 0xfffe3620
  166. #define BCB_LONG_GRANT_CODEWORD_BYTES 0xfffe3621
  167.  
  168. // Upstream MAC Registers
  169. #define UM_USCTL 0xfffe3601
  170. #define UM_MTXCTL 0xfffe3602
  171. #define UM_BSIGCTRL 0xfffe3603
  172. #define UM_TCKPMS 0xfffe3604
  173. #define UM_BPMSEXP 0xfffe3605
  174. #define UM_MSPERREQ 0xfffe3606
  175. #define UM_MAXREREQ 0xfffe3607
  176.  
  177. struct BcmDescriptor {
  178. uint32_t lenStatus;
  179. uint32_t address;
  180. };
  181.  
  182. volatile struct BcmDescriptor *dsData1;
  183. volatile struct BcmDescriptor *dsData2;
  184.  
  185. volatile struct BcmDescriptor *dsMsg1;
  186. volatile struct BcmDescriptor *dsMsg2;
  187.  
  188. // EnetBCM3310.c
  189.  
  190. // FFFE3068 something to do with the CPE table
  191.  
  192. // BCM3300 upstream registers
  193. // FFFE3040
  194. // FFFE3046
  195. // FFFE3068
  196.  
  197. // FFFE3000 - BCM3350 MAC Base Address
  198. // FFFE300A - BCM3350 ID Register
  199. // FFFE300C - BCM3350 Chip Register
  200. // BCM3350 Id register
  201.  
  202. // FFFE3500 - Downstream Phy control register (1 byte)
  203. // FFFE3500 (i.e. bit 3 enables Promiscuous Mode !!!!) 0x08 - or with this to enable promiscuous mode, yes
  204.  
  205. // FFFE3502
  206. // FFFE3508
  207.  
  208. FILE *mpegOut;
  209.  
  210. void hexdump(uint8_t *buffer, int len)
  211. {
  212. int lineAddr;
  213.  
  214. for(lineAddr = 0; lineAddr < len; lineAddr += 16) {
  215. int bytePos;
  216. fprintf(mpegOut, "%08x: ", lineAddr);
  217. for(bytePos = 0; bytePos < 16; bytePos++) {
  218. if((lineAddr + bytePos) < len)
  219. fprintf(mpegOut, "%02x ", buffer[lineAddr + bytePos]);
  220. else
  221. fprintf(mpegOut, " ");
  222. if(bytePos == 7)
  223. fprintf(mpegOut, " ");
  224. }
  225.  
  226. fprintf(mpegOut, " |");
  227. for(bytePos = 0; bytePos < 16; bytePos++) {
  228. uint8_t chr = buffer[lineAddr + bytePos];
  229. chr = (chr < 32) ? '.' : chr;
  230. chr = (chr >= 127) ? '.' : chr;
  231. fprintf(mpegOut, "%c", (char) chr);
  232. if(bytePos == 7)
  233. fprintf(mpegOut, " ");
  234.  
  235. }
  236. fprintf(mpegOut, "| \n");
  237. }
  238. fflush(mpegOut); // FIXME
  239. }
  240.  
  241. // PD status byte bits
  242. #define PD_OWN (1 << 7)
  243. #define PD_WRAP (1 << 5)
  244. #define PD_OVERFLOW (1 << 4)
  245. #define PD_OVERRUN (1 << 3)
  246. #define PD_PHS (1 << 2)
  247. #define PD_SEQ (1 << 1)
  248. #define PD_CRC_ERROR (1 << 0)
  249.  
  250. #define BD_OWN (1 << 31)
  251. #define BD_WRAP (1 << 29)
  252. #define BD_LAST (1 << 27)
  253. #define BD_FIRST (1 << 26)
  254.  
  255. struct DmaDescriptor {
  256. uint32_t lenStatus;
  257. uint32_t addr;
  258. };
  259.  
  260. struct eth_driver_sg {
  261. CYG_ADDRESS buf;
  262. CYG_ADDRWORD len;
  263. };
  264.  
  265. //volatile uint8_t vlanHeader[4];
  266.  
  267. int mpegSock;
  268.  
  269. int mpegSockInit()
  270. {
  271. int sock;
  272. int rv;
  273.  
  274. sock = socket(AF_INET, SOCK_DGRAM, 0);
  275. if(sock == -1) {
  276. fprintf(mpegOut, "socket() failed: %s\n", strerror(errno));
  277. return -1;
  278. }
  279.  
  280. struct sockaddr_in sa;
  281. memset(&sa, 0, sizeof(sa));
  282. sa.sin_family = AF_INET;
  283. sa.sin_port = htons(8000);
  284. sa.sin_addr.s_addr = inet_addr("239.255.32.1");
  285.  
  286. rv = connect(sock, (struct sockaddr *) &sa, sizeof(sa));
  287. if(rv == -1) {
  288. fprintf(mpegOut, "connect() failed: %s\n", strerror(errno));
  289. return -1;
  290. }
  291.  
  292. int ttl = 32;
  293. rv = setsockopt(sock, IPPROTO_IP, IP_MULTICAST_TTL, &ttl, sizeof(ttl));
  294. if(rv == -1) {
  295. fprintf(mpegOut, "setsockopt() failed: %s\n", strerror(errno));
  296. return -1;
  297. }
  298.  
  299. return sock;
  300. }
  301.  
  302. volatile cyg_uint16 dsIrqStatus;
  303.  
  304. cyg_sem_t dsIrqSemaphore;
  305.  
  306. // DSR called when a DOCSIS / (MPEG, hopefully) downstream packet arrives
  307. static void snifferDsr(void *data)
  308. {
  309. cyg_uint16 status;
  310.  
  311. status = REG16(IRQ_PEND);
  312. if(status)
  313. cyg_semaphore_post(&dsIrqSemaphore);
  314. }
  315.  
  316. void snifferIrqInit()
  317. {
  318. cyg_semaphore_init(&dsIrqSemaphore, 0);
  319.  
  320. hal_map_periph_interrupt(CMAC_IRQ_BIT, snifferDsr, (void *) 0);
  321. hal_enable_periph_interrupt(CMAC_IRQ_BIT);
  322.  
  323. REG16(IRQ_PEND) = 0xffff;
  324. REG16(IRQ_MASK) = 0xffff;
  325. }
  326.  
  327. int numDescriptors = 256;
  328. volatile uint8_t *dmaBuffer[4];
  329. volatile struct DmaDescriptor *dmaDesc[4];
  330.  
  331. void snifferInit()
  332. {
  333. int n;
  334.  
  335. // create a socket for TXing the MPEG-2 TS data
  336. mpegSock = mpegSockInit();
  337. if(mpegSock == -1)
  338. return; // it failed!
  339.  
  340. // Now to test the DOCSIS MAC
  341.  
  342. // dmaBuf 0 - 512 bytes apart
  343. // dmaBuf 1 - 1576 bytes apart
  344. // dmaBuf 2 - 512 bytes apart
  345. // dmaBuf 3 - 1576 bytes apart
  346.  
  347. for(n = 0; n < 4; n++) {
  348. void *ptr;
  349. int bufferSize = numDescriptors * 2048;
  350.  
  351. ptr = malloc(bufferSize);
  352. if(ptr == NULL) {
  353. fprintf(mpegOut, "buffer malloc() failed\n");
  354. return;
  355. }
  356. dmaBuffer[n] = (uint8_t *) UNCACHED_ADDR(ptr);
  357. memset(dmaBuffer[n], 0, bufferSize);
  358. }
  359.  
  360. for(n = 0; n < 4; n++) {
  361. void *ptr;
  362. int descSize = numDescriptors * sizeof(struct DmaDescriptor) * 2;
  363.  
  364. ptr = malloc(descSize);
  365. if(ptr == NULL) {
  366. fprintf(mpegOut, "buffer malloc() failed\n");
  367. return;
  368. }
  369. dmaDesc[n] = (uint8_t *) UNCACHED_ADDR(ptr);
  370. memset(dmaDesc[n], 0, descSize);
  371. }
  372.  
  373. snifferIrqInit(); // enable DOCSIS / MPEG Interrupts
  374. printf("MPEG/DOCSIS Sniffer Initialisation Complete!\n");
  375. }
  376.  
  377. void snifferThreadEntry()
  378. {
  379. int n;
  380. int rxDataIndex;
  381. int rxMsgIndex;
  382.  
  383. rxDataIndex = rxMsgIndex = 0;
  384.  
  385. // now fill the descriptor buffers
  386. for(n = 0; n < numDescriptors; n++) {
  387. int i;
  388.  
  389. for(i = 0; i < 4; i++) {
  390. struct DmaDescriptor *desc = &dmaDesc[i][n];
  391. desc->lenStatus = BD_OWN | BD_LAST | BD_FIRST;
  392. if( n == (numDescriptors - 1))
  393. desc->lenStatus |= BD_WRAP;
  394. desc->addr = PHYS_ADDR(dmaBuffer[i] + n * 0x800);
  395. }
  396. }
  397.  
  398. REG16(DS_PID) = 0;
  399.  
  400. REG8(DS_DATA_DMA_CTRL) = 0x57;
  401. REG32(DS_DATA_BD_BASE) = PHYS_ADDR(dmaDesc[0]);
  402. REG32(DS_DATA_PD_BASE) = PHYS_ADDR(dmaDesc[1]);
  403.  
  404. REG8(DS_MSG_DMA_CTRL) = 0x57;
  405. REG32(DS_MSG_BD_BASE) = PHYS_ADDR(dmaDesc[2]);
  406. REG32(DS_MSG_PD_BASE) = PHYS_ADDR(dmaDesc[3]);
  407.  
  408. REG8(0xfffe3201) = 2; // was 2, bitmask =3
  409. REG8(0xfffe3211) = 2; // was 2, bitmask =3
  410.  
  411. REG8(0xfffe3202) = 0x0; // was 0
  412. REG8(0xfffe3212) = 0x0; // was 0
  413.  
  414. REG8(DS_DATA_DMA_INDEX) = 0;
  415. REG8(DS_MSG_DMA_INDEX) = 0;
  416.  
  417. REG8(DS_DATA_DMA_CTRL) |= (1 << 7); // Enable RX
  418. REG8(DS_MSG_DMA_CTRL) |= (1 << 7); // Enable RX
  419.  
  420. REG8(DS_DATA_TRIGGER) = 0x01;
  421. REG8(DS_MSG_TRIGGER) = 0x01;
  422.  
  423. // select the PID for downstream data RX
  424. // why can't I get at the TS directly!!!
  425. cyg_thread_delay(10);
  426. REG16(DS_PID) = DP_ENABLE | DP_MODE_SEL | DP_PID(8190);
  427.  
  428. // REG16(DS_MAC_DA_FILTER_CTRL) = 0xff00 | DMDFC_PROMISC;
  429.  
  430. for(;;) {
  431. struct DmaDescriptor *desc;
  432. struct DmaDescriptor *macDesc;
  433. cyg_uint16 status;
  434.  
  435. // Wait for an incoming interrupt
  436. cyg_semaphore_wait(&dsIrqSemaphore);
  437.  
  438. // Check what's pending
  439. status = REG16(IRQ_PEND);
  440. REG16(IRQ_PEND) = status;
  441.  
  442. // re-enable the peripheral interrupt
  443. hal_enable_periph_interrupt(CMAC_IRQ_BIT);
  444.  
  445. if(status & IRQ_DS_DATA_DMA) {
  446. while(!((macDesc = &dmaDesc[0][rxDataIndex])->lenStatus & (1 << 31))) {
  447. desc = &dmaDesc[1][rxDataIndex];
  448. int len = desc->lenStatus & 0xfff;
  449. uint32_t status;
  450.  
  451. send(mpegSock, (void *) UNCACHED_ADDR(desc->addr), len, 0);
  452.  
  453. status = BD_OWN | BD_LAST | BD_FIRST;
  454. if(rxDataIndex == (numDescriptors - 1))
  455. status |= BD_WRAP;
  456. desc->lenStatus = status;
  457.  
  458. status = BD_OWN | BD_LAST | BD_FIRST;
  459. if(rxDataIndex == (numDescriptors - 1))
  460. status |= BD_WRAP;
  461. macDesc->lenStatus = status;
  462.  
  463. rxDataIndex = (rxDataIndex + 1) & 0xff;
  464. }
  465. }
  466.  
  467. if(status & IRQ_DS_MSG_DMA) {
  468. while(!((macDesc = &dmaDesc[2][rxMsgIndex])->lenStatus & (1 << 31))) {
  469. desc = &dmaDesc[3][rxMsgIndex];
  470. int len = desc->lenStatus & 0xfff;
  471. uint32_t status;
  472.  
  473. send(mpegSock, (void *) UNCACHED_ADDR(desc->addr), len, 0);
  474.  
  475. status = BD_OWN | BD_LAST | BD_FIRST | 0x7ff;
  476. if(rxMsgIndex == (numDescriptors - 1))
  477. status |= BD_WRAP;
  478. desc->lenStatus = status;
  479.  
  480. status = BD_OWN | BD_LAST | BD_FIRST | 0x7ff;
  481. if(rxMsgIndex == (numDescriptors - 1))
  482. status |= BD_WRAP;
  483. macDesc->lenStatus = status;
  484.  
  485. rxMsgIndex = (rxMsgIndex + 1) & 0xff;
  486. }
  487. }
  488.  
  489. // if(status & 0xfffc)
  490. // fprintf(mpegOut, "Got unknown IRQ, status=0x%04x\n", status);
  491. // fprintf(mpegOut, "rxDataIndex=%d rxMsgIndex=%d\n", rxDataIndex, rxMsgIndex);
  492. }
  493. }
  494.  
  495. static char snifferStack[16384];
  496. static cyg_handle_t snifferThread_h;
  497. static cyg_thread snifferThread;
  498.  
  499. void docsisSnifferStart()
  500. {
  501.  
  502. cyg_thread_create(2, snifferThreadEntry, (cyg_addrword_t) 0,
  503. "Sniffer", snifferStack, sizeof(snifferStack),
  504. &snifferThread_h, &snifferThread);
  505.  
  506. cyg_thread_resume(snifferThread_h);
  507. }
  508.  
  509. void prim_ss(ficlVm *vm)
  510. {
  511. struct ShellPrivate *priv = (struct ShellPrivate *) vm->priv;
  512. mpegOut = priv->io;
  513. // snifferThreadEntry();
  514. docsisSnifferStart();
  515. }
  516.  
  517. static struct word_def dsMacWords[] = {
  518. // { "dmt", prim_dmt, FICL_WORD_DEFAULT },
  519. { "ss", prim_ss, FICL_WORD_DEFAULT },
  520. { NULL, NULL, 0 }
  521. };
  522.  
  523. void dsMacInit()
  524. {
  525. printf("Initialising DOCSIS MAC...\n");
  526. printf("Reset MAC\n");
  527. REG8(GLOBAL_CTRL_STATUS) = 0xff;
  528. cyg_thread_delay(1);
  529. REG8(GLOBAL_CTRL_STATUS) = 0x00;
  530. cyg_thread_delay(1);
  531.  
  532. REG16(0xfffe3008) = 0x000f;
  533.  
  534. printf("Configure DS Data Filters\n");
  535. // REG16(DS_PID) = 0xc000 | 8190; // 0xc000 normal DOCSIS operation
  536. REG16(DS_PID) = 0xc000 | 8190; // 0x8000 something special !!!
  537. REG8(DS_MAC_FILTER_CTRL) = 0x41; // 0x40
  538. REG8(DS_MAC_MSG_PROTO_VER_BYTE1) = 0xff; // 0xff
  539. REG8(DS_MAC_MSG_PROTO_VER_BYTE2) = 0x00; // 0x00
  540.  
  541. // Configure DES
  542. REG8(DS_DES_SID_ENABLE) = 0x80;
  543. REG8(DS_DES_UNENCRYPTED_LENGTH) =0x0c;
  544. REG16(DS_DES_SV) = 0x0f00; // accept all BPI versions 0-15
  545. REG8(DS_DES_CTRL) = 0x0e; // 0x2e enables SES
  546. REG8(DS_DATA_DA_FILTER_CTRL) = 0x3f; // 0x3f
  547.  
  548. REG8(0xfffe306c) = 0x02;
  549. REG16(DS_DATA_DA_EN) = 1; // 0x01
  550.  
  551. #if 0
  552. // Init some extra regs...
  553. REG8(0xfffe3074) = 0x0d;
  554.  
  555. // Initialise DES
  556. int idx;
  557. for(idx = 0; idx < 128; idx++)
  558. REG32(0xfffe3300 + idx * 4) = desTable[idx];
  559.  
  560.  
  561. REG32(0xfffe3080) = 0x2e0c0000;
  562. REG32(0xfffe3084) = 0x00010b40;
  563. REG32(0xfffe30a4) = 0x0000f024;
  564. REG32(0xfffe3230) = 0x000000c0;
  565. REG32(0xfffe3230) = 0x00000b40;
  566. REG32(0xfffe32a0) = 0x00010001;
  567. REG32(0xfffe32b0) = 0x00695e08;
  568. #endif
  569.  
  570. #if 1
  571. printf("Configure Timing Recovery...\n");
  572. REG8(TRC_LOOP_ENABLE) = 0;
  573. REG8(TRC_MINISLOT_DIVISOR) = 3;
  574. REG8(TRC_K0_CTRL) = 6;
  575. REG8(TRC_K1_CTRL) = 7;
  576. REG8(TRC_ACQ_THRESHOLD) = 1;
  577. REG8(TRC_ERR_THRESHOLD) = 4;
  578. REG8(TRC_TIMEOUT_THRESHOLD) = 0xff;
  579. REG16(TRC_NCO_BIAS) = 0x51eb;
  580. REG16(TRC_RANGING_OFFSET) = 0x851e;
  581. REG32(TRC_MINISLOT_COUNT) = 0x02de3cc3;
  582. REG8(TRC_LOOP_ENABLE) = 1;
  583. #endif
  584.  
  585. // REG8(DS_DATA_DMA_CTRL
  586. #if 0
  587. printf("Configure Downstream DMA...\n");
  588. REG32(0xfffe3200) = 0x17020000;
  589. // REG32(0xfffe3204) = 0x007f0008;
  590. // REG32(0xfffe3208) = 0x007f0008;
  591. REG32(0xfffe3210) = 0x17020000;
  592. // REG32(0xfffe3214) = 0x006a5608;
  593. // REG32(0xfffe3218) = 0x006a3508;
  594. // REG32(0xfffe3238) = 0x007f9008;
  595. // REG32(0xfffe323c) = 0x007f7e08;
  596. REG32(0xfffe3240) = 0x00020000;
  597. // REG32(0xfffe32b0) = 0x00695e08;
  598.  
  599. // REG32(0xfffe3500) = 0x3f000001; // 0xfffe3500 byte bit 3 set for promisc
  600. REG32(0xfffe3588) = 0x023f3f00;
  601. REG32(0xfffe3600) = 0x00000011;
  602. #endif
  603.  
  604. #if 0
  605. // Setup the calibration table (approximate)
  606. int index;
  607. for(index = 0; index < 256; index++) {
  608. int value;
  609. if(index < 6) {
  610. value = 0;
  611. } else {
  612. value = 0x17 + (index - 6) * 8;
  613. }
  614. REG16(0xfffe3800 + (index * 2)) = value;
  615. }
  616. #endif
  617.  
  618. forthRegisterWords(dsMacWords);
  619.  
  620. cyg_thread_delay(10);
  621.  
  622. printf("DOCSIS MAC Initialisation complete\n");
  623.  
  624. snifferInit();
  625. cyg_thread_delay(10);
  626. docsisSnifferStart();
  627. }
  628.  
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!