From zero-kelvin at gmx.de Tue Jul 2 18:52:29 2013 From: zero-kelvin at gmx.de (dexter) Date: Tue, 02 Jul 2013 20:52:29 +0200 Subject: UPDATE -- Osmocom Berlin User Group meeting -- NEXT MEETING In-Reply-To: <20130605121428.GA10030@nataraja.gnumonks.org> References: <502d01a9.mirider@mirider.augusta.de> <20120818115942.GV29525@prithivi.gnumonks.org> <51AF0097.10402@gmx.de> <20130605121428.GA10030@nataraja.gnumonks.org> Message-ID: <51D3216D.6040802@gmx.de> Hi All. Thank you for all who have sent me a +1 email. I think it is enough interest to continue the meetings on a regular, monthly basis. The meetings will take place always the 2nd wednesday of the month. Thus, the next meeting will be on the 10.07.2013! -------------------------8<------------------------- This is the announcement for the next Osmocom Berlin meeting. Jul 10, 8pm @ CCC Berlin, Marienstr. 11, 10117 Berlin There is no formal presentation scheduled for this meeting. If you are interested to show up, feel free to do so. There is no registration required. The meeting is free as in "free beer", despite no actual free beer being around. -------------------------8<------------------------- I am looking forward to see you there! regards. Philipp From laforge at gnumonks.org Mon Jul 8 08:22:49 2013 From: laforge at gnumonks.org (Harald Welte) Date: Mon, 8 Jul 2013 10:22:49 +0200 Subject: [ADMIN] Wanted: List moderator Message-ID: <20130708082249.GY28142@nataraja.gnumonks.org> Dear Osmocom community, I'm currently looking for one or multiple volunteers who are willing to tend to the mailman 'moderator queue' of the various osmocom mailing lists (baseband-devel, openbsc, simtrace, tetra, osmocom-pcu, ...) Our lists are 'member posting only' to protect them from spam. This means that spammers will be caught in the list moderation queue together with the occasional legitimate message from a non-subscriber. You need to manually look over that queue in the mailman web interface, select those legitimate posts as 'approve' and 'defer' all others. The task requires very few minutes, but it requires them every day or second day. It is a perfect opportunity how non-developers can contribute to the project :) Please let me know if anyone is willing to take care of this. Thanks! Regards, Harald -- - Harald Welte http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6) From andrew at carrierdetect.com Mon Jul 8 09:14:23 2013 From: andrew at carrierdetect.com (Andrew Back) Date: Mon, 8 Jul 2013 10:14:23 +0100 Subject: [ADMIN] Wanted: List moderator In-Reply-To: <20130708082249.GY28142@nataraja.gnumonks.org> References: <20130708082249.GY28142@nataraja.gnumonks.org> Message-ID: Hi Harald, On 8 July 2013 09:22, Harald Welte wrote: > Dear Osmocom community, > > I'm currently looking for one or multiple volunteers who are willing to > tend to the mailman 'moderator queue' of the various osmocom mailing > lists (baseband-devel, openbsc, simtrace, tetra, osmocom-pcu, ...) > > Our lists are 'member posting only' to protect them from spam. This > means that spammers will be caught in the list moderation queue together > with the occasional legitimate message from a non-subscriber. > > You need to manually look over that queue in the mailman web interface, > select those legitimate posts as 'approve' and 'defer' all others. > > The task requires very few minutes, but it requires them every day or > second day. It is a perfect opportunity how non-developers can > contribute to the project :) > > Please let me know if anyone is willing to take care of this. Thanks! I'd be happy to do this. Best, Andrew -- Andrew Back http://carrierdetect.com From risky at mail.ru Mon Jul 8 10:01:28 2013 From: risky at mail.ru (Sergey V. Efimov) Date: Mon, 8 Jul 2013 14:01:28 +0400 Subject: [ADMIN] Wanted: List moderator In-Reply-To: References: <20130708082249.GY28142@nataraja.gnumonks.org> Message-ID: Hi All, So do I. With exception when I will need to take a couple of weeks for vacations. On Jul 8, 2013, at 1:14 PM, Andrew Back wrote: > Hi Harald, > > On 8 July 2013 09:22, Harald Welte wrote: >> Dear Osmocom community, >> >> I'm currently looking for one or multiple volunteers who are willing to >> tend to the mailman 'moderator queue' of the various osmocom mailing >> lists (baseband-devel, openbsc, simtrace, tetra, osmocom-pcu, ...) >> >> Our lists are 'member posting only' to protect them from spam. This >> means that spammers will be caught in the list moderation queue together >> with the occasional legitimate message from a non-subscriber. >> >> You need to manually look over that queue in the mailman web interface, >> select those legitimate posts as 'approve' and 'defer' all others. >> >> The task requires very few minutes, but it requires them every day or >> second day. It is a perfect opportunity how non-developers can >> contribute to the project :) >> >> Please let me know if anyone is willing to take care of this. Thanks! > > I'd be happy to do this. > > Best, > > Andrew > > -- > Andrew Back > http://carrierdetect.com > > From gandguladze at hotmail.com Tue Jul 16 16:37:39 2013 From: gandguladze at hotmail.com (George Andguladze) Date: Tue, 16 Jul 2013 16:37:39 +0000 Subject: Calypso phone with RX filters removed Message-ID: Hi List, Could anyone suggest me where to buy a C155 with RX filters removed? My soldering skills are not that great so I am trying to avoid buying the filter replacement kit from here http://shop.sysmocom.de/products/osmocombb-filter-kit and doing it myself. It seems from the mailing list (http://comments.gmane.org/gmane.comp.mobile.osmocom.baseband.devel/1840) that you could buy it from shop.sysmocom.de, but not anymore? Kind Regards George AndguladzeSenior Software EngineerBusiness Management Technology www.bmt.ge -------------- next part -------------- An HTML attachment was scrubbed... URL: From craig_comstock at yahoo.com Fri Jul 19 15:39:14 2013 From: craig_comstock at yahoo.com (Craig Comstock) Date: Fri, 19 Jul 2013 08:39:14 -0700 (PDT) Subject: chainload.compalram.bin missing? In-Reply-To: References: Message-ID: <1374248354.79138.YahooMailNeo@web121001.mail.ne1.yahoo.com> I was trying to load some apps to a Motorola C139 and found that after building osmocom-bb that there were no chainload image files built. Am I using the wrong branch somehow? Are the instructions out of date on this page: http://bb.osmocom.org/trac/wiki/MotorolaC140 ./osmocon -p /dev/ttyUSB0 -m c140 -c ../../target/firmware/board/compal_e86/layer1.highram.bin ../../target/firmware/board/compal_e86/chainload.compalram.bin The page mentions something about a magic value that must be placed into memory for the bootloader... could that be added to osmocon somehow so that specifying -m c140 takes care of it? "After the download has completed, it expects the magic string "1003" (0x31 0x30 0x30 0x33) at the RAM address 0x803ce0" Thanks, Craig -------------- next part -------------- An HTML attachment was scrubbed... URL: From steve at steve-m.de Fri Jul 19 21:09:56 2013 From: steve at steve-m.de (Steve Markgraf) Date: Fri, 19 Jul 2013 23:09:56 +0200 Subject: chainload.compalram.bin missing? In-Reply-To: <1374248354.79138.YahooMailNeo@web121001.mail.ne1.yahoo.com> References: <1374248354.79138.YahooMailNeo@web121001.mail.ne1.yahoo.com> Message-ID: <51E9AB24.3090209@steve-m.de> Hi, On 19.07.2013 17:39, Craig Comstock wrote: > I was trying to load some apps to a Motorola C139 and found that after > building osmocom-bb that there were no chainload image files built. Am I > using the wrong branch somehow? Are the instructions out of date on this > page: > > http://bb.osmocom.org/trac/wiki/MotorolaC140 Yes, the instructions are out of date. Meanwhile the chainloader has been integrated into osmocon, you just need to run: > ./osmocon -p /dev/ttyUSB0 -m c140 -c ../../target/firmware/board/compal_e86/layer1.highram.bin Regards, Steve From ubuntugirl2013 at gmail.com Thu Jul 25 21:41:25 2013 From: ubuntugirl2013 at gmail.com (ubuntugirl) Date: Thu, 25 Jul 2013 14:41:25 -0700 Subject: JTAG setup for Pirelli DP-L10 Message-ID: Hello, I finally got some time to play with OsmocomBB again. It works intermittently on my Pirelli DP-L10: sometimes ok, other times MO call attempts fail inexplicably and there are messages pouring in the vty window about network contact being lost and reestablished. I suspect that the lack of RF calibration may be an issue, especially considering that I'm in PCS land whereas most active developers are in EGSM/DCS. So I got this crazy idea: what if we can figure out where and how the original factory calibration values are stored, and make use of them? It looks like the last 64kb sector of the flash (at 0x027f0000 as seen by the cpu) is where the factory data are stored, but the format looks incomprehensible. :( So here's what I'm thinking: I would like to try putting JTAG on this phone, and using a hardware watchpoint to catch where the proprietary fw reads from the 0x027f0000-0x027fffff region. I saw in the Wiki that there is an unpopulated footprint for a JTAG connector, and upon taking my phone apart, I have confirmed that it's there indeed. But I wonder, has anyone here (steve-m perhaps?) actually used this JTAG interface and got it to work? If someone has, I'd like to ask the following: * What connector part did you populate on that footprint? * What actual JTAG adapter gadget did you use? * How did you connect that JTAG adapter gadget to the phone? Thanks, Kim From steve at steve-m.de Fri Jul 26 08:39:49 2013 From: steve at steve-m.de (Steve Markgraf) Date: Fri, 26 Jul 2013 10:39:49 +0200 Subject: JTAG setup for Pirelli DP-L10 In-Reply-To: References: Message-ID: <51F235D5.5070304@steve-m.de> Hi, On 25.07.2013 23:41, ubuntugirl wrote: > * What connector part did you populate on that footprint? None, actually. I just directly soldered some pieces of enamelled wire to the pads of the footprint. > * What actual JTAG adapter gadget did you use? I used a Bus Blaster v2, but any other adapter that is supported by OpenOCD and can handle 3.3V levels should work fine. (Actually the Calypso uses 2.8V IO-levels, but 3.3V works anyway). > * How did you connect that JTAG adapter gadget to the phone? I soldered the wires to a 0.1" pin header, and then used a few 1 pin female-female jumper wires to connect them to the Bus Blaster. Regards, Steve From ubuntugirl2013 at gmail.com Sat Jul 27 18:15:49 2013 From: ubuntugirl2013 at gmail.com (ubuntugirl) Date: Sat, 27 Jul 2013 10:15:49 -0800 Subject: JTAG setup for Pirelli DP-L10 In-Reply-To: <51F235D5.5070304@steve-m.de> References: <51F235D5.5070304@steve-m.de> Message-ID: On 7/26/13, Steve Markgraf wrote: > None, actually. I just directly soldered some pieces of enamelled wire > to the pads of the footprint. Got it. I thought initially that populating the "proper" connector on there (an FPC one, no doubt) would probably be cleaner, but then one would need a custom-made FPC cable to go with that... too expensive. :( > I used a Bus Blaster v2, but any other adapter that is supported by > OpenOCD and can handle 3.3V levels should work fine. (Actually the > Calypso uses 2.8V IO-levels, but 3.3V works anyway). Thanks for the info. At my day job we have some other jtaggers (don't remember the make & model) that appear to be similar (also based on the FTDI chip) - when I'm back at work, I'll take a look and see if they support 3.3V or 2.8V. > I soldered the wires to a 0.1" pin header, and then used a few 1 pin > female-female jumper wires to connect them to the Bus Blaster. Sounds reasonable... will probably do the same or similar once I get my own BB or a similar jtagger. Now while I have your attention... I'm trying to gain a better understanding of the display subsystem on this phone - maybe even get the camera to work (dreaming). I wonder, has anyone been able to find a datasheet or other docs for the SPCA552E chip? The code that's currently in git implements a combined driver for the S6B33B1X and this Sunplus chip; the datasheet for the S6B33B1X was readily findable via Google, but not the other chip. If no one ever succeeded in finding any docs for the SPCA552E, I wonder where the comments on lines 110-123 of src/target/firmware/fb/fb_s6b33b1x.c came from... Kim From steve at steve-m.de Sat Jul 27 22:30:01 2013 From: steve at steve-m.de (Steve Markgraf) Date: Sun, 28 Jul 2013 00:30:01 +0200 Subject: JTAG setup for Pirelli DP-L10 In-Reply-To: References: <51F235D5.5070304@steve-m.de> Message-ID: <51F449E9.2030708@steve-m.de> Hi, On 27.07.2013 20:15, ubuntugirl wrote: > Now while I have your attention... I'm trying to gain a better > understanding of the display subsystem on this phone - maybe even get > the camera to work (dreaming). I wonder, has anyone been able to find > a datasheet or other docs for the SPCA552E chip? The code that's > currently in git implements a combined driver for the S6B33B1X and > this Sunplus chip; the datasheet for the S6B33B1X was readily findable > via Google, but not the other chip. > > If no one ever succeeded in finding any docs for the SPCA552E, I > wonder where the comments on lines 110-123 of > src/target/firmware/fb/fb_s6b33b1x.c came from... Unfortunately there's only a datasheet of the SPCA554 floating around, just search for "SPCA554AV02". I reverse engineered most of the stuff in this driver via JTAG with OpenOCD by setting data watchpoints/breakpoints on the address of the SPCA. The comments were added by looking up the writes in the datasheet mentioned above and trying to understand what happens, but unfortunately the SPCA552 and 554 seem to have quite a few differences, so not everything could be figured out. At least it was enough information to get the bypass mode working, which was my main goal. Since the SPCA has an integrated 8051 core, you probably need to upload proprietary code to get the camera working, or you have to rewrite the firmware for this chip as well... Same thing with the WiFi-chip unfortunately, it needs a proprietary firmware blob. Regards, Steve From ubuntugirl2013 at gmail.com Sun Jul 28 07:20:59 2013 From: ubuntugirl2013 at gmail.com (ubuntugirl) Date: Sat, 27 Jul 2013 23:20:59 -0800 Subject: Pirelli DP-L10 display subsystem (was Re: JTAG setup for Pirelli DP-L10) Message-ID: On 7/27/13, Steve Markgraf wrote: > Unfortunately there's only a datasheet of the SPCA554 floating around, > just search for "SPCA554AV02". Found it, thanks. > unfortunately the SPCA552 and 554 seem to have quite a few differences, > so not everything could be figured out. Yeah, the differences do seem big indeed. While I was searching around for an SPCA552E datasheet, I found this: http://www.download.revosupport.com/scp2009_download_folder!/BONUS%20MEMBER/SKEMA_/Sketma%20Nokia%20CDMA/10_RM218_SM_schem_V1.0_20061108.pdf On page 12 of that schematic there's our lovely Sunplus chip. Of course it's a totally different phone, but at least we can see what are the pin interfaces coming off this chip. In the above schematic, we see that SPCA552E connects to just the host CPU, the LCM and the camera - no frills. But the 554 datasheet you've found describes a much more complex device - adds USB, audio, mass storage... > At least it was enough information to get the bypass mode working, > which was my main goal. Were you ever able to figure out just how the backlight works on this display? Your code has a comment about a particular register in the SPCA supposedly turning the BL on or off, but looking at the pin interfaces of this SPCA in the Nokia schematic, I don't see anything even remotely related to the backlight... Yet the original firmware is able to not only turn this BL on and off at will, but also change the brightness - during calls, the display dims instead of blanking completely. On a related note, were you ever able to figure out the pinout of the 30-pin flex between the main PCB and the LCM? If this pinout were known, I could probably trace out the stuff of interest to me (like the backlight) on the main PCB using your layer pictures, but if I have to reverse-eng the LCM itself, that might be a bit above my skill level. :( > Since the SPCA has an integrated 8051 core, you probably need to upload > proprietary code to get the camera working, or you have to rewrite the > firmware for this chip as well... Bummer. But just out of curiosity, how did you figure out that it's an 8051? Did you see the original phone fw pushing something to the SPCA that looked like 8051 instructions? FWIW, the 554 datasheet describes its CPU as a "32-bit RISC processor" - too closed to even name what it is! Kim From steve at steve-m.de Sun Jul 28 08:53:13 2013 From: steve at steve-m.de (Steve Markgraf) Date: Sun, 28 Jul 2013 10:53:13 +0200 Subject: Pirelli DP-L10 display subsystem (was Re: JTAG setup for Pirelli DP-L10) In-Reply-To: References: Message-ID: <51F4DBF9.1000007@steve-m.de> Hi, On 28.07.2013 09:20, ubuntugirl wrote: > Were you ever able to figure out just how the backlight works on this > display? Your code has a comment about a particular register in the > SPCA supposedly turning the BL on or off, but looking at the pin > interfaces of this SPCA in the Nokia schematic, I don't see anything > even remotely related to the backlight... Yet the original firmware is > able to not only turn this BL on and off at will, but also change the > brightness - during calls, the display dims instead of blanking > completely. Yes, and it took me a while. The basic 'on/off' is controlled by the SPCA with the code we have, the brightness is controlled by the PWL-unit of the Calypso, but inverted if I remember correctly. Just play with the bl_level() function a bit. > On a related note, were you ever able to figure out the pinout of the > 30-pin flex between the main PCB and the LCM? If this pinout were > known, I could probably trace out the stuff of interest to me (like > the backlight) on the main PCB using your layer pictures, but if I > have to reverse-eng the LCM itself, that might be a bit above my skill > level. :( At one point I soldered wires to all connections and hooked them up to a logic analyzer. It's a 16-bit interface and it was quite easy to figure out what was what. For all the initialization only 8 bits are used, for the actual display content you switch to the 16-bit mode. > Bummer. But just out of curiosity, how did you figure out that it's an > 8051? Did you see the original phone fw pushing something to the SPCA > that looked like 8051 instructions? > FWIW, the 554 datasheet describes its CPU as a "32-bit RISC processor" > - too closed to even name what it is! Now that I see the "32-bit RISC processor"-comment as well... no idea where I got that from, it's most likely wrong then. I didn't look at the instructions, but as far as I remember I've seen a code blob being uploaded. Regards, Steve From ubuntugirl2013 at gmail.com Sun Jul 28 22:09:23 2013 From: ubuntugirl2013 at gmail.com (ubuntugirl) Date: Sun, 28 Jul 2013 14:09:23 -0800 Subject: Pirelli DP-L10 display subsystem (was Re: JTAG setup for Pirelli DP-L10) In-Reply-To: <51F4DBF9.1000007@steve-m.de> References: <51F4DBF9.1000007@steve-m.de> Message-ID: On 7/28/13, Steve Markgraf wrote: > Yes, and it took me a while. The basic 'on/off' is controlled by the > SPCA with the code we have, the brightness is controlled by the > PWL-unit of the Calypso, but inverted if I remember correctly. Using your PCB layer pictures, I've traced the PWL signal to the 6-pin IC near the SPCA. The IC label reads "A3-90E", and considering the inductor right next to it, I'm guessing that it's a boost converter for the backlight LED. I'm sure you saw this IC too when you were figuring the BL out - were you perchance able to figure out the full name / part # of this IC, or maybe even find a datasheet for it? > At one point I soldered wires to all connections and hooked them up to > a logic analyzer. It's a 16-bit interface and it was quite easy to > figure out what was what. For all the initialization only 8 bits are > used, for the actual display content you switch to the 16-bit mode. I thus gather that you had (most of) the actual pinout figured out at some point. Would you perchance still have it somewhere in your notes? Kim From steve at steve-m.de Tue Jul 30 16:06:26 2013 From: steve at steve-m.de (Steve Markgraf) Date: Tue, 30 Jul 2013 18:06:26 +0200 Subject: Pirelli DP-L10 display subsystem (was Re: JTAG setup for Pirelli DP-L10) In-Reply-To: References: <51F4DBF9.1000007@steve-m.de> Message-ID: <51F7E482.8000106@steve-m.de> Hi, On 29.07.2013 00:09, ubuntugirl wrote: > Using your PCB layer pictures, I've traced the PWL signal to the 6-pin > IC near the SPCA. The IC label reads "A3-90E", and considering the > inductor right next to it, I'm guessing that it's a boost converter > for the backlight LED. I'm sure you saw this IC too when you were > figuring the BL out - were you perchance able to figure out the full > name / part # of this IC, or maybe even find a datasheet for it? No, and I didn't really care about it to be honest, since it just works. > I thus gather that you had (most of) the actual pinout figured out at > some point. Would you perchance still have it somewhere in your notes? Unfortunately no, I checked if I still have it on my laptop from 28c3, but it doesn't seem like it... Regards, Steve