Hi All!
That's true, I managed to run U-Boot on MT6235, but linux kernel is
not fully functional yet (it's fresh stuff as I managed to ran it on
Tuesday and then I was off to conference).
For MT6235 development I chose Sciphone G2, which is pretty cheap.
After some time I managed to download code to SRAM (just 64KB) using
MTK's FlashTool.
MTK FlashTool communicates over UART directly with MT6235 bootloader
and sends its own chunk of code (about 58KB) which is executed in SRAM
and communicates with FlashTool.
I found on pudn.com some pack to customize code loaded by FlashTool,
thanks to which I could download my own code to SRAM (without JTAG).
The problem was that it had to be linked with some security libraries
which occupied about 56KB and not much memory left for my own code.
Then I decided to try find JTAG pins to get all control on MT6235.
That took me sometime, but finally I succeeded.
The other bigger issue was initializing DRAM controller to be able to
download bigger code (linux kernel + uboot) to external RAM. In
sciphone there is problem that all interesting chips are under metal
shield which is pretty havily soldered. In this case I couldn't read
what kind of RAM memory is mounted without destroying the board (I
don't have such soldering machine which could unsolder so big metal
shield). Thanks to JTAG I could attach to target and then dump DRAM
controller registers from processor running MTK's software, but
setting these values after processor start and configuration of PLL
didn't work.
I decided to disassemble bootloader which could show me how DRAM
controller is initialized and how code fron NAND is loaded (to be able
to flash U-Boot and kernel to NAND so MT6235 will start my code
automatically and I will not have to use JTAG). Currently I have
knowledge how internal MT6235 bootloader is loading code from memory
during startup and I also extracted procedure of DRAM controller
initialization. Thanks to that I'm able to run U-Boot from the very
begining of processor startup.
The problem is that I have just one piece of Sciphone G2 and I don't
want to flash it yet to not break existing code in it. Thanks to
running device I'm able to attach with JTAG and check how peripherals
are configured (i.e. LCD, MMC, etc.). I have backup of flash, but I'm
not 100% sure if I will flash it back, phone will startup. That's why
I bought second piece of Sciphone G2 and should receive it today or on
Tuesday (this Monday is holiday in Poland). In this case I'll flash
U-Boot to NAND and try to make it working. Then we could load the rest
of code from U-Boot (to RAM or NAND over serial).
You can see how my setup looks on attached picture.
The good thing about it is that the same bootloader is used in MT622x,
so it should be fairly easy to do the same on phones based on that
SoCs (but unfortuantely it's just ARM7).
If it comes to code, of course I can share it on "git.osmocom.org".
Currently it's just basic port of U-Boot and not much for linux
kernel, but I'm working on this now so I'll push it when it'll be
ready.
Currently I'm working on driver for NAND memory for U-Boot, so we
could flash linux kernel. When that will be ready I'll push the code.
Then I'll switch to linux kernel and when it'll be functional I also
push the code. At this stage you will not need to have JTAG and you
could load the code over serial in U-Boot.
If it comes to GSM I didn't work with it before. I actualy worked 6
months in L2/3 team for LTE (on RRC) but it's different story.
That could be really outstanding thing if we could run first phone
ever with whole code open (from BB up to APP).
BR,
Marcin
Hi Dario,
i suggest you to download the last Sylvain's burst_ind, because is improved of some features and patch it manually with Nohl's patch.
Then you will be able to dump the bursts using ccch_scan, instead of layer23.
Cheers,
Luca
> Can someone drive me to the right direction?
P.S: http://comments.gmane.org/gmane.comp.mobile.osmocom.baseband.devel/1754
The SIM and the SIM reader in the phone and the mechanical contact
between them are definitely working because the SIM can be accessed from
the motorola firmware, from another phone and from a PC smartcard reader
with no PIN or anything.
However, under simtest firmware no data is received by the phone, even
the ATR is zero bytes...
Anybody had this problem?
Also, is l1CTL SIM APDU command not implemented in the layer1 firmware?
How are people making calls without a SIM? :P
Gianni
----------------SIMTEST----8<-----------------
Initializing driver:
SIM: Registering interrupt handler for simcard-interface
====================== CALYPSO SIM REGISTER DUMP =====================
Reg_sim_cmd register (R/W) - FFFE:0000
|-REG_SIM_CMD = 0000
| |-REG_SIM_CMD_CMDCARDRST = 0 ==> SIM card reset sequence disabled.
| |-REG_SIM_CMD_CMDIFRST = 0
| |-REG_SIM_CMD_CMDSTOP = 0
| |-REG_SIM_CMD_CMDSTART = 0
| |-REG_SIM_CMD_MODULE_CLK_EN = 0 ==> Clock of the module disabled.
|-REG_SIM_STAT = 000b
| |-REG_SIM_STAT_STATNOCARD = 1 ==> No card!
| |-REG_SIM_STAT_STATTXPAR = 1 ==> Parity ok!
| |-REG_SIM_STAT_STATFIFOFULL = 0
| |-REG_SIM_STAT_STATFIFOEMPTY = 1 ==> Fifo empty!
|-REG_SIM_CONF1 = 000c
| |-REG_SIM_CONF1_CONFCHKPAR = 0 ==> Parity check on reception disabled.
| |-REG_SIM_CONF1_CONFCODCONV = 0 ==> Coding convention is direct (normal).
| |-REG_SIM_CONF1_CONFTXRX = 1 ==> SIO line direction is in transmit mode.
| |-REG_SIM_CONF1_CONFSCLKEN = 1 ==> SIM clock in normal mode.
| |-REG_SIM_CONF1_reserved = 0 ==> ETU period is CONFETUPERIOD.
| |-REG_SIM_CONF1_CONFSCLKDIV = 0 ==> SIM clock frequency is 13/4 Mhz.
| |-REG_SIM_CONF1_CONFSCLKLEV = 0 ==> SIM clock idle level is low.
| |-REG_SIM_CONF1_CONFETUPERIOD = 0 ==> ETU period is 372/8*1/Fsclk.
| |-REG_SIM_CONF1_CONFBYPASS = 0 ==> Hardware timers and start and stop sequences are normal.
| |-REG_SIM_CONF1_CONFSVCCLEV = 0 ==> SVCC Level is low (Only valid when CONFBYPASS = 1).
| |-REG_SIM_CONF1_CONFSRSTLEV = 0 ==> SRST Level is low (Only valid when CONFBYPASS = 1).
| |-REG_SIM_CONF1_CONFTRIG = 0x0 (FIFO trigger level)
| |-REG_SIM_CONF1_CONFSIOLOW = 0
|-REG_SIM_CONF2 = 0940
| |-REG_SIM_CONF2_CONFTFSIM = 0x0 (time delay for filtering of SIM_CD)
| |-REG_SIM_CONF2_CONFTDSIM = 0x4 (time delay for contact activation/deactivation)
| |-REG_SIM_CONF2_CONFWAITI = 0x9 (CONFWAITI overflow wait time between two received chars)
|-REG_SIM_IT = 0000
| |-REG_SIM_IT_SIM_NATR = 0 ==> On read access to REG_SIM_IT.
| |-REG_SIM_IT_SIM_WT = 0 ==> On read access to REG_SIM_IT.
| |-REG_SIM_IT_SIM_OV = 0 ==> On read access to REG_SIM_IT.
| |-REG_SIM_IT_SIM_TX = 0 ==> On write access to REG_SIM_DTX or on switching
| | from transmit to receive mode (CONFTXRX bit)
| |-REG_SIM_IT_SIM_RX = 0 ==> On read access to REG_SIM_DRX.
|-REG_SIM_DRX = 0100
| |-REG_SIM_DRX_SIM_DRX = 0x0 (next data byte in FIFO available for reading)
| |-REG_SIM_DRX_STATRXPAR = 1 ==> Parity Ok.
|-REG_SIM_DTX = 00 (next data byte to be transmitted)
|-REG_SIM_MASKIT = 003f
| |-REG_SIM_MASKIT_MASK_SIM_NATR = 1 ==> No-answer-to-reset interrupt is masked.
| |-REG_SIM_MASKIT_MASK_SIM_WT = 1 ==> Character wait-time overflow interrupt is masked.
| |-REG_SIM_MASKIT_MASK_SIM_OV = 1 ==> Receive overflow interrupt is masked.
| |-REG_SIM_MASKIT_MASK_SIM_TX = 1 ==> Waiting characters to be transmit interrupt is masked.
| |-REG_SIM_MASKIT_MASK_SIM_RX = 1 ==> Waiting characters to be read interrupt is masked.
| |-REG_SIM_MASKIT_MASK_SIM_CD = 1 ==> SIM card insertion/extraction interrupt is masked.
|-REG_SIM_IT_CD = fffe0010
|-REG_SIM_IT_CD_IT_CD = 0 ==> SIM card insertion/extraction interrupt is unmasked.
Power up simcard:
* Power enabled!
* Clock enabled!
* Reset released!
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Character underflow!
(0 bytes)
Reset simcard:
* Reset pulled down!
* Reset released!
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Character underflow!
(0 bytes)
SIM-T0: Transceiving APDU-Header: (a0 a4 00 00 02)
SIM-ISR: Interrupt caught: Waiting for character to transmit...
SIM-ISR: Interrupt caught: Waiting for character to transmit...
SIM-ISR: Interrupt caught: Waiting for character to transmit...
SIM-ISR: Interrupt caught: Waiting for character to transmit...
SIM-ISR: Interrupt caught: Waiting for character to transmit...
SIM-T0: Case 2: No input / Output of known length (See also GSM 11.11 Page 34)
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Character underflow!
SIM-T0: T0 Protocol error: Missing ACK byte -- aborting!
SIM-T0: Transceiving APDU-Header: (a0 c0 00 00 0f)
SIM-ISR: Interrupt caught: Waiting for character to transmit...
SIM-ISR: Interrupt caught: Waiting for character to transmit...
SIM-ISR: Interrupt caught: Waiting for character to transmit...
SIM-ISR: Interrupt caught: Waiting for character to transmit...
SIM-ISR: Interrupt caught: Waiting for character to transmit...
SIM-T0: Case 4: Input / No output (See also GSM 11.11 Page 34)
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Character underflow!
SIM-T0: T0 Protocol error: Incorrect or missing answer -- aborting!
e0 73 d7 b9 ae ea bf 7e f7 3b 7f 6f 32 fe 25 (15 bytes)
Test Phase 1: Testing bare sim commands...
* Testing SELECT: Selecting MF
SIM-T0: Transceiving APDU-Header: (a0 a4 00 00 02)
SIM-ISR: Interrupt caught: Waiting for character to transmit...
SIM-ISR: Interrupt caught: Waiting for character to transmit...
SIM-ISR: Interrupt caught: Waiting for character to transmit...
SIM-ISR: Interrupt caught: Waiting for character to transmit...
SIM-ISR: Interrupt caught: Waiting for character to transmit...
SIM-T0: Case 2: No input / Output of known length (See also GSM 11.11 Page 34)
SIM-ISR: Interrupt caught: Waiting characters to be read...
SIM-ISR: Interrupt caught: Character underflow!
SIM-T0: T0 Protocol error: Missing ACK byte -- aborting!
==> Status word: ffff
* Testing SELECT: Selecting DF_GSM
SIM-T0: Transceiving APDU-Header: (a0 a4 00 00 02)
SIM-ISR: Interrupt caught: Waiting for character to transmit...
SIM-ISR: Interrupt caught: Waiting for character to transmit...
SIM-ISR: Interrupt caught: Waiting for character to transmit...
At this point it hangs "forever" - well at least half hour.
Hello everybody
Not sure if someone has pointed it out already, but I'm getting stuck
following the gprs decode tutorial
[...]
- Prepare OsmocomBB's burst_ind branch
cd ~/gprs_sniffer/osmocom-bb
git checkout origin/sylvain/burst_ind
git checkout d1cb8ea9b784c7acbafbb2fdcedbdf4655c2f6f5
At this point I get
fatal: reference is not a tree: d1cb8ea9b784c7acbafbb2fdcedbdf4655c2f6f5
Next step fails too... pretty obvious...
# patch -p1 < ~/gprs_sniffer/gprs_multi.patch
can't find file to patch at input line 5
[...]
Can someone drive me to the right direction?
Thanks!
Dario
hi,
i just finished SMS support for osmocombb. everything is committed in my
jolly/testing branch.
in order to support SMS, i extracted the SMS transcoding from openbsc.
(jolly/sms branch) the SMC and SMR layer protocols are extracted and
rewritten and use messages between layers and have state machines. they
are added to libosmocore also. (jolly/sms branch) openbsc (jolly/sms
branch) now uses the SMS layers and transcoding of libosmocore.
LAPDm now supports correct handling of SAPI 3 datalink, especially on
SACCH. the mobility management and radio ressource layers of osmocombb
now support MM connections with SAPI 3.
i have tested it on test BTS setup only, so feel free to run it and
report bugs.
regards,
andreas
Hi guys,
I dunno if that is the right place for my concern about building the
osmocomBB source. Here is what I already have done:
- downloading the sources for osmocomBB and GNU toolchain for ARM,
- setting the PATH for the arm-elf-* executables,
- calling make in the src directory.
Now, this appears as response of the make command in the terminal:
cd shared/libosmocore/build-host && ../configure
configure: error: cannot find install-sh, install.sh, or shtool in ".."
"../.." "../../.."
make: *** [shared/libosmocore/build-host/Makefile] Error 1.
If you need details about my system, you can look at the following
snippet from the config.log file:
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
It was created by libosmocore configure UNKNOWN, which was
generated by GNU Autoconf 2.65. Invocation command line was
$ ../configure
## --------- ##
## Platform. ##
## --------- ##
hostname = ubuntu-stefan
uname -m = x86_64
uname -r = 2.6.32-24-generic
uname -s = Linux
uname -v = #41-Ubuntu SMP Thu Aug 19 01:38:40 UTC 2010
/usr/bin/uname -p = unknown
/bin/uname -X = unknown
/bin/arch = unknown
/usr/bin/arch -k = unknown
/usr/convex/getsysinfo = unknown
/usr/bin/hostinfo = unknown
/bin/machine = unknown
/usr/bin/oslevel = unknown
/bin/universe = unknown
PATH: /usr/local/sbin
PATH: /usr/local/bin
PATH: /usr/sbin
PATH: /usr/bin
PATH: /sbin
PATH: /bin
PATH: /usr/games
PATH: /home/stefan/osmocomBB/gnuarm-4.0.2/bin
## ----------- ##
## Core tests. ##
## ----------- ##
configure:2032: error: cannot find install-sh, install.sh, or shtool in
".." "../.." "../../..".
So, I would be very glad, if someone could give me a hint to solve the
problem. Thank you in advance.
Regards,
begy
hi,
i am thinking about moving sms code from openbsc to libsomocore.
my idea is to move the core code of openbsc to libosmocore's src/gsm and
include/osmocom/gsm/ respectively.
one problem is that the transaction structure of osmocombb and openbsc
is different. for sms support there could be a common part inside the
union of each transaction:
struct gsm_trans {
...
union {
...
struct {
uint8_t link_id; /* RSL Link ID to be
used for this trans */
int is_mt; /* is this a MO (0) or MT (1)
transfer */
enum gsm411_cp_state cp_state;
struct osmo_timer_list cp_timer;
enum gsm411_rp_state rp_state;
struct gsm_sms *sms;
} sms;
};
};
i would suggest to move the common part to libosmocore and name it
"gsm_trans_sms". then both openbsc and osmocombb can use the same sms
structure. also the "gsm_sms" structure itself must be generalized and
not rely on openbsc structures. (i have not yet looked at it.)
to get reference to the private gsm_trans, openbsc and osmocombb can now
use "container_of" in the specific sms glue code.
any ideas / suggestions?
andreas
Hi all:
I try make usrp work on Muti-antenna mode , 1 to downlink , 1 to uplink.
first , i only decode downlink, it can found FCCH,but can't decode sch.
any suggestion?
tianxing@tianxing-MS-7345:~/gsm/airprobe-gprs/gsm-receiver/src/python$ ./gsm_reive_usrp_mono.py -c 122
A side: Flex 900 Rx MIMO B
B side: Flex 900 Rx MIMO B
gain_a: 45.0
gain_b: 45.0
A side: The carrier frequency is set as 959400000.0
B side: The carrier frequency is set as 959400000.0
mux_val = 0x2301
input_rate: 571428.571429 sample rate: 0.527472527473 filter_cutoff: 145000.0 filter_t_width: 10000.0
>>> gr_fir_ccc: using SSE
input_rate: 571428.571429 sample rate: 0.527472527473 filter_cutoff: 145000.0 filter_t_width: 10000.0
>>> gr_fir_ccf: using SSE
Key: '0000000000000000'
Configuration: '0C'
Configuration TS: 0
configure_receiver
1319360150.211137 3014114160: fcch found on position: 24508
1319360150.211206 3014114160: freq_offset: -2659.853516
1319360150.254086 3014114160: fcch found on position: 77189
1319360150.254132 3014114160: freq_offset: -261.283386
sch.c:260 ERR: conv_decode 11
1319360150.307770 3014114160: fcch found on position: 135276
1319360150.307814 3014114160: freq_offset: -2574.190186
sch.c:260 ERR: conv_decode 10
1319360150.352075 3014114160: fcch found on position: 188023
1319360150.352120 3014114160: freq_offset: -375.097321
sch.c:260 ERR: conv_decode 8
Hi, all
The osmocomBB no AMR support yet now (only FR, HR and EFR).
/* no AMR yet */
void dsp_load_tch_param(struct gsm_time *next_time,
if (tch_mode) {
switch (l1s.tch_mode) {
case GSM48_CMODE_SPEECH_V1:
*tch_mode = *tch_f_hn ? TCH_FS_MODE : TCH_HS_MODE;
break;
case GSM48_CMODE_SPEECH_EFR:
*tch_mode = *tch_f_hn ? TCH_EFR_MODE : SIG_ONLY_MODE;
break;
default:
*tch_mode = SIG_ONLY_MODE;
}
}
i checked the product datasheet, the C123 can support AMR from the beginning.
does anyone can give me some information to patch it?
BTW, i havn't 30 source, so i can't reference it.
Best regards
Aegean Chou