I was trying to load some apps to a Motorola C139 and found that after building osmocom-bb that there were no chainload image files built. Am I using the wrong branch somehow? Are the instructions out of date on this page:
http://bb.osmocom.org/trac/wiki/MotorolaC140
./osmocon -p /dev/ttyUSB0 -m c140 -c ../../target/firmware/board/compal_e86/layer1.highram.bin ../../target/firmware/board/compal_e86/chainload.compalram.bin
The page mentions something about a magic value that must be placed into memory for the bootloader... could that be added to osmocon somehow so that specifying -m c140 takes care of it?
"After the download has completed, it expects the magic string "1003" (0x31 0x30 0x30 0x33) at the RAM address 0x803ce0"
Thanks,
Craig
On 7/27/13, Steve Markgraf <steve(a)steve-m.de> wrote:
> Unfortunately there's only a datasheet of the SPCA554 floating around,
> just search for "SPCA554AV02".
Found it, thanks.
> unfortunately the SPCA552 and 554 seem to have quite a few differences,
> so not everything could be figured out.
Yeah, the differences do seem big indeed. While I was searching around
for an SPCA552E datasheet, I found this:
http://www.download.revosupport.com/scp2009_download_folder!/BONUS%20MEMBER…
On page 12 of that schematic there's our lovely Sunplus chip. Of
course it's a totally different phone, but at least we can see what
are the pin interfaces coming off this chip.
In the above schematic, we see that SPCA552E connects to just the host
CPU, the LCM and the camera - no frills. But the 554 datasheet you've
found describes a much more complex device - adds USB, audio, mass
storage...
> At least it was enough information to get the bypass mode working,
> which was my main goal.
Were you ever able to figure out just how the backlight works on this
display? Your code has a comment about a particular register in the
SPCA supposedly turning the BL on or off, but looking at the pin
interfaces of this SPCA in the Nokia schematic, I don't see anything
even remotely related to the backlight... Yet the original firmware is
able to not only turn this BL on and off at will, but also change the
brightness - during calls, the display dims instead of blanking
completely.
On a related note, were you ever able to figure out the pinout of the
30-pin flex between the main PCB and the LCM? If this pinout were
known, I could probably trace out the stuff of interest to me (like
the backlight) on the main PCB using your layer pictures, but if I
have to reverse-eng the LCM itself, that might be a bit above my skill
level. :(
> Since the SPCA has an integrated 8051 core, you probably need to upload
> proprietary code to get the camera working, or you have to rewrite the
> firmware for this chip as well...
Bummer. But just out of curiosity, how did you figure out that it's an
8051? Did you see the original phone fw pushing something to the SPCA
that looked like 8051 instructions?
FWIW, the 554 datasheet describes its CPU as a "32-bit RISC processor"
- too closed to even name what it is!
Kim
Hello,
I finally got some time to play with OsmocomBB again. It works
intermittently on my Pirelli DP-L10: sometimes ok, other times MO call
attempts fail inexplicably and there are messages pouring in the vty
window about network contact being lost and reestablished.
I suspect that the lack of RF calibration may be an issue, especially
considering that I'm in PCS land whereas most active developers are in
EGSM/DCS. So I got this crazy idea: what if we can figure out where
and how the original factory calibration values are stored, and make
use of them? It looks like the last 64kb sector of the flash (at
0x027f0000 as seen by the cpu) is where the factory data are stored,
but the format looks incomprehensible. :(
So here's what I'm thinking: I would like to try putting JTAG on this
phone, and using a hardware watchpoint to catch where the proprietary
fw reads from the 0x027f0000-0x027fffff region.
I saw in the Wiki that there is an unpopulated footprint for a JTAG
connector, and upon taking my phone apart, I have confirmed that it's
there indeed. But I wonder, has anyone here (steve-m perhaps?)
actually used this JTAG interface and got it to work? If someone has,
I'd like to ask the following:
* What connector part did you populate on that footprint?
* What actual JTAG adapter gadget did you use?
* How did you connect that JTAG adapter gadget to the phone?
Thanks,
Kim
Dear Osmocom community,
I'm currently looking for one or multiple volunteers who are willing to
tend to the mailman 'moderator queue' of the various osmocom mailing
lists (baseband-devel, openbsc, simtrace, tetra, osmocom-pcu, ...)
Our lists are 'member posting only' to protect them from spam. This
means that spammers will be caught in the list moderation queue together
with the occasional legitimate message from a non-subscriber.
You need to manually look over that queue in the mailman web interface,
select those legitimate posts as 'approve' and 'defer' all others.
The task requires very few minutes, but it requires them every day or
second day. It is a perfect opportunity how non-developers can
contribute to the project :)
Please let me know if anyone is willing to take care of this. Thanks!
Regards,
Harald
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
