Project

General

Profile

Fernvale » History » Version 47

unrznbl, 05/09/2019 09:21 PM

1 1 craig_comstock
h1. Fernvale
2
3 41 gnutoo
Fernvale is an open-source development platform for the Mediatek MT6260.
4
5
It was also specifically designed to make reverse engineering easier.
6 1 craig_comstock
7 15 gnutoo
It is available on the "sysmocom web-shop":http://shop.sysmocom.de/products/fernvale-mt6260-reverse-engineering-development-kit-dvt2
8 1 craig_comstock
9 22 gnutoo
h2. Software
10
11 42 gnutoo
* There is a simple bootloader/interactive shell called "fernly":https://github.com/xobs/fernly/ which can also be used for reverse engineering.
12 22 gnutoo
* There is a downstream "port to Nuttx":https://github.com/sutajiokousagi/fernvale-nuttx which is bootable but provides limited features
13 47 unrznbl
* There is a downstream "OsmocomBB port":https://gitlab.com/unrznbl/osmocom-bb/tree/mtk-layer1 which has a bootable layer1 image that doesn't support any of the GSM hardware yet.
14 22 gnutoo
15 17 gnutoo
|_. Hardware feature |_. Support |
16 1 craig_comstock
| Backlight | "Fernly":https://github.com/xobs/fernly/blob/master/cmd-bl.c |
17
| Bluetooth | None yet |
18
| External memory | "Fernly":https://github.com/xobs/fernly/blob/master/emi.c "Nuttx":https://github.com/sutajiokousagi/fernvale-nuttx/blob/master/nuttx/configs/kosagi-fernvale/src/fernvale_mem.c |
19
| GSM, GPRS | None yet |
20
| Keypad | "Fernly":https://github.com/xobs/fernly/blob/master/cmd-keypad.c |
21
| LCD | "Fernly":https://github.com/xobs/fernly/blob/master/cmd-lcd.c , "Nuttx":https://github.com/sutajiokousagi/fernvale-nuttx/blob/master/nuttx/arch/arm/src/mt6260/mt6260_framebuffer.c |
22
| Leds | "Fernly":https://github.com/xobs/fernly/blob/master/cmd-led.c "Nuttx":https://github.com/sutajiokousagi/fernvale-nuttx/blob/master/nuttx/configs/kosagi-fernvale/src/fernvale_leds.c |
23
| SDIO | "Nuttx":https://github.com/sutajiokousagi/fernvale-nuttx/blob/master/nuttx/configs/kosagi-fernvale/src/fernvale_mmcsd.c |
24
| SPI | "Fernly":https://github.com/xobs/fernly/blob/master/cmd-spi.c "Nuttx":https://github.com/sutajiokousagi/fernvale-nuttx/blob/master/nuttx/configs/kosagi-fernvale/src/fernvale_spi.c |
25
| UART | "Fernly":https://github.com/xobs/fernly/blob/master/serial.c "Nuttx":https://github.com/sutajiokousagi/fernvale-nuttx/blob/master/nuttx/arch/arm/src/mt6260/mt6260_serial.c |
26
| USB peripheral? | "Nuttx":https://github.com/sutajiokousagi/fernvale-nuttx/blob/master/nuttx/configs/kosagi-fernvale/src/fernvale_hidkbd.c |
27
| USB host | "Nuttx":https://github.com/sutajiokousagi/fernvale-nuttx/blob/master/nuttx/configs/kosagi-fernvale/src/fernvale_usbhost.c |
28 37 gnutoo
29 45 unrznbl
h2. Load Layer1 via Fernly
30 1 craig_comstock
31 45 unrznbl
For now only loading into RAM is supported and via the fernly loader. Use this script: https://gitlab.com/unrznbl/fernly/blob/mtk-layer1/load-layer1.sh to load a built layer1 firmware from osmocom-bb to the fernvale via fernly.
32
33
h2. Boot ROM cycles due to no Firmware flashed
34
35 44 unrznbl
If you simple connect the fernvale via micro USB cable to your host you will likely see some failures like this:
36
37
<pre>
38
[10045.367504] usb 1-4: new full-speed USB device number 14 using xhci_hcd
39
[10045.516385] usb 1-4: New USB device found, idVendor=0e8d, idProduct=0003, bcdDevice= 1.00
40
[10045.516397] usb 1-4: New USB device strings: Mfr=0, Product=0, SerialNumber=0
41
[10046.102791] cdc_acm 1-4:1.1: ttyACM0: USB ACM device
42
[10046.103011] usbcore: registered new interface driver cdc_acm
43
[10046.103012] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
44
[10046.109599] usbcore: registered new interface driver usbserial_generic
45
[10046.109623] usbserial: USB Serial support registered for generic
46
[10046.116192] usbcore: registered new interface driver option
47
[10046.116229] usbserial: USB Serial support registered for GSM modem (1-port)
48
[10051.794634] usb 1-4: USB disconnect, device number 14
49
[10052.491445] usb 1-4: new full-speed USB device number 15 using xhci_hcd
50
[10052.640174] usb 1-4: New USB device found, idVendor=0e8d, idProduct=0003, bcdDevice= 1.00
51
[10052.640184] usb 1-4: New USB device strings: Mfr=0, Product=0, SerialNumber=0
52
[10052.643070] option 1-4:1.0: GSM modem (1-port) converter detected
53
[10052.652198] usb 1-4: GSM modem (1-port) converter now attached to ttyUSB0
54
[10052.652881] cdc_acm: probe of 1-4:1.1 failed with error -16
55
[10058.956408] usb 1-4: USB disconnect, device number 15
56
[10058.956910] option1 ttyUSB0: GSM modem (1-port) converter now disconnected from ttyUSB0
57
[10058.956972] option 1-4:1.0: device disconnected
58
[10059.651427] usb 1-4: new full-speed USB device number 16 using xhci_hcd
59
[10059.800240] usb 1-4: New USB device found, idVendor=0e8d, idProduct=0003, bcdDevice= 1.00
60
[10059.800247] usb 1-4: New USB device strings: Mfr=0, Product=0, SerialNumber=0
61
[10059.803041] option 1-4:1.0: GSM modem (1-port) converter detected
62
[10059.803284] usb 1-4: GSM modem (1-port) converter now attached to ttyUSB0
63
[10059.803885] cdc_acm: probe of 1-4:1.1 failed with error -16
64
</pre>
65
66 1 craig_comstock
This is likely due to no firmware being flashed onto fernvale but only the BROM firmware being available and since BROM doesn't have anything to transfer control to, it cycles.
67 44 unrznbl
68 45 unrznbl
69 44 unrznbl
70 37 gnutoo
h2. Progress
71 1 craig_comstock
72 44 unrznbl
Apr 22 2018 - layer1 firmware has stubbed out implementations for mediatek/fernvale. layer1/main blinks the big LED on fernvale and fernly usb serial is ported so that debug messages are possible. See "mtk-layer1 branch":https://gitlab.com/unrznbl/osmocom-bb/tree/mtk-layer1 on gitlab.
73 37 gnutoo
74
Feb 13 2018 - fixed up Makefile.mtk so that both [[SciphoneDreamG2]] and Fernvale firmwares build. An LED blink firmware is working on Fernvale but the loader_mtk firmware no longer seems to work on the [[SciphoneDreamG2]].
75
76
h2. TODOs
77
78 46 unrznbl
* port [[Layer1bin]] - "unrznbl":https://gitlab.com/unrznbl is working on this currently
79 37 gnutoo
* create library from osmocom-bb to be used in NuttX layer1 app (hopefully very little copying of code into nuttx tree)
80
* port [[Mobile]] to NuttX
81 3 gnutoo
82 38 gnutoo
h2. Help welcome
83
84 39 gnutoo
Very few people are working on it[1], and because of that progress have been very slow.
85 38 gnutoo
86
fn1. See "This blog post":http://laforge.gnumonks.org/blog/20180929-fernvale-discount/ for more background on the issue.
87
88 8 gnutoo
h2. References and documentation
89 3 gnutoo
90 4 gnutoo
* https://postmarketos.org/blog/2018/04/14/lowlevel/ : Article on porting OsmocomBB to the Fernvale
91 5 gnutoo
* https://kosagi.com/w/index.php?title=Fernvale_Main_Page : Fernvale hardware documentation
92 7 gnutoo
* https://kosagi.com/forums/ : Kosagi forums: they have a section on the Fernvale
93 11 gnutoo
* https://www.bunniestudios.com/blog/?p=4297 : Blog post on the initial hardware and software reverse engineering
94 9 gnutoo
* https://xobs.io/fernvale-the-path-not-taken/ : Blog post on the initial software reverse engineering
95 10 gnutoo
* There was a talk at the 31c3 about the Fernvale. "video":https://media.ccc.de/v/31c3_-_6156_-_en_-_saal_1_-_201412282145_-_fernvale_an_open_hardware_and_software_platform_based_on_the_nominally_closed-source_mt6260_soc_-_bunnie_-_xobs "slides":http://www.bunniefoo.com/fernvale/fernvale-31c3.pdf
96 34 gnutoo
* Nuttx's "mt6260_tdma.h":https://github.com/sutajiokousagi/fernvale-nuttx/blob/master/nuttx/arch/arm/src/mt6260/mt6260_tdma.h seem to contain some information on the GSM part
Add picture from clipboard (Maximum size: 48.8 MB)