JTAG setup for Pirelli DP-L10
ubuntugirl2013 at gmail.com
Thu Jul 25 21:41:25 UTC 2013
I finally got some time to play with OsmocomBB again. It works
intermittently on my Pirelli DP-L10: sometimes ok, other times MO call
attempts fail inexplicably and there are messages pouring in the vty
window about network contact being lost and reestablished.
I suspect that the lack of RF calibration may be an issue, especially
considering that I'm in PCS land whereas most active developers are in
EGSM/DCS. So I got this crazy idea: what if we can figure out where
and how the original factory calibration values are stored, and make
use of them? It looks like the last 64kb sector of the flash (at
0x027f0000 as seen by the cpu) is where the factory data are stored,
but the format looks incomprehensible. :(
So here's what I'm thinking: I would like to try putting JTAG on this
phone, and using a hardware watchpoint to catch where the proprietary
fw reads from the 0x027f0000-0x027fffff region.
I saw in the Wiki that there is an unpopulated footprint for a JTAG
connector, and upon taking my phone apart, I have confirmed that it's
there indeed. But I wonder, has anyone here (steve-m perhaps?)
actually used this JTAG interface and got it to work? If someone has,
I'd like to ask the following:
* What connector part did you populate on that footprint?
* What actual JTAG adapter gadget did you use?
* How did you connect that JTAG adapter gadget to the phone?
More information about the baseband-devel