Mediatek RF development informations

Hi list, I'd like to give you some informations about findings on Mediatek's RF. Sciphone G2 has MT6140 transceiver which seems to be different than MT6139. MT6140 has much more registers to configure at init time (CW0 - CW12, CW15) while MT6139 has just 5 registers (CW0, CW1, CW2, CW9 and CW11). Common registers for MT6140 and MT6139 has also different fields (i.e. register CW0 has reset bit on different offset on MT6140). These findings where first discovered during sniffing of BSI interface. After some time I also found source code for Mediatek's SoCs family on Google Code pages: http://code.google.com/p/mobile-phone-mtk-project/ You can find there source code with drivers for Mediatek RF part (MT6139, MT6140, Murata antenna switches and Mediatek Power Amplifiers). Source code is located under "l1/l1d" directory. This part is delivered as source code because Mediatek wants to give customers chance to change RF electronic components (customers are able to write thair own drivers). The rest of layer 1 code (code which calls RF drivers and uses DSP) is delivered as library "l1.lib". Thanks to above code I confirmed my concernings about difference between MT6139 and MT6140. I prepared initial version of drivers for BPI, BSI, BFE (Baseband Front End) and MT6140 and placed them in U-Boot. MT6140 driver is based on Harald's MT6139 driver from OsmocomBB. It's initial driver which just configures needed peripherals (BSI, BPI, BFE, TDMA, APC, MT6140, MURA465 and RF3159) and performs TX on given ARFCN channel. U-Boot command for that is following: Rf_tx <arfcn> After execution, using spectrum analyzer you should see transmission on given frequency (so far I just tested on low band). This code doesn't use APC yet, but driver is already written, it just needs to be tested (it means that TX has currently very low power). If it comes to RF part, documentation which is available is sufficient, I already know how to configure hardware and I don't expect bigger problems here, that's why I started investigations on DSP. MT6235 has two DSP processors (master and slave). These procesors are from Analog Devices family ADSP-218x. Most probably it's ADSP-2181 (it's just assumption, I haven't found any statement about it). Thanks to code mentioned above it's possible to identify DSP functions and disassemble them. Above code is compiled for MT6223 (ARM7) SoC and it provides symbols table (file: BIRDCELLTEL23_08B_NEP_162_PCB01_gsm_MT6223_S00.sym). Most of this code is also available on Sciphone G2 (comparing binary files) and I'm able to identify addresses of functions and break in these functions using JTAG. It means that I can debug on real hardware, that's really convenient and easy to understand what's going on. I already disassembled functions for DSP init and patch loading over IDMA port (probably DSP code is executed from ROM) and I'll continue this task. Hopefully we'll be able to start sending real TX data soon. -- Recently I received patches with Linux drivers for Sciphone's USB port from Krzysztof Antonowicz and I wanted to thank for his effort. Right now it's possible to use Sciphone as Mass Storage device and it'll be possible to run Ethernet gadget. Unfortunatelly I can't clone Linux/Uboot repository right now and I didn't deliver patches for RF and USB. As soon as I'll succeed cloning of repository, I'll deliver functionality which I described above. I'll also backport drivers I'm writing now to OsmocomBB. Best regards, Marcin