SIM card related Projects » SIMtrace

h2. Production Flashing v1.3

Unfortunately, v1.3 has a bug in the design, which requires a specific PCB trace to be cut before it can be used.  The idea of that PCB trace was to

pull one formerly unised GPIO to GND, permitting software to detect it is running on a v1.3 harware (As opposed to v1.2 or earlier).

Instead, we need to store the hardware version in an OTP region of the SPI flash.

So After that trace has been cut, the following steps need to be performed (with following [attachment:simtrace_v13_fw.tar.bz2 firmware]):

[[Image(simtrace_v13_cut.jpg, 33%)]]

1. put the rom loader into the flash, using the TEST jumper

1. use the sam7 utility to install the main_factory.samba file (containing sam7dfu and main_factory.bin)

<pre>

$ sam7 -l /dev/ttyACM0 --exec set_clock --exec unlock_regions --exec "flash ./main_factory.samba"

Chip Version: 2

Embedded Processor: ARM7TDMI

NVRAM Region 1 Size: 128 K

NVRAM Region 2 Size: 0 K

SRAM Size: 32 K

Series: AT91SAM7Sxx

Page Size: 256 bytes

Lock Regions: 8

warning: magic read 0x00200000 != 0x13

warning: magic read 0x00200000 != 0x13

</pre>

1. attach a serial cable to the board and press the reset button, generating the following output:

<pre>

(C) 2006-2011 by Harald Welte <hwelte@hmw-consulting.de>

This software is FREE SOFTWARE licensed under GNU GPL

Version 0.5.7-6d5f-dirty compiled 20131117-202832 by laforge@radha.de.gnumonks.org

DEBUG Interface:

0) Set Pull-up 1) Clear Pull-up 2) Toggle LED1 3) Toggle LED2

9) Reset

RSTC_SR=0x00010000

                  Inititalizing usbcmd_gen_init

                                               udp_open(437): entering

spiflash_init

spi_transceive: enter(tx_len=4) leave(): 0x01 0x02 0x15 0x4d 

SPI ID: 01 02 15

</pre>

1. entering the 'p' key to program the v1.3 into OTP

1. entering the 'P' key to verify / generate the following output:

<pre>

spi_transceive: enter(tx_len=5) leave(): 0xce 0x5a 0x07 0x51 0x00 0x00 0x00 0x00 0x00 0x03 0x01 0x00 0x00 0x00 0x00 0x00 

OTP READ(0x114): ce 5a 07 51 00 00 00 00 00 03 01 00 00 00 00 00 

Version: 0x00010300

</pre>

1. using dfu-util to overwrite main_factory with main_simtrace:

<pre>

$ dfu-util -a 0 -D ./main_simtrace.bin -R

dfu-util 0.5

(C) 2005-2008 by Weston Schmidt, Harald Welte and [[OpenMoko]] Inc.

(C) 2010-2011 Tormod Volden (DfuSe support)

This program is Free Software and has ABSOLUTELY NO WARRANTY

dfu-util does currently only support DFU version 1.0

Opening DFU capable USB device... ID 16c0:0762

WARNING: Can not find cached DFU functional descriptor

Warning: Assuming DFU version 1.0

Run-time device DFU version 0100

Claiming USB DFU Runtime Interface...

Determining device status: state = appIDLE, status = 0

Device really in Runtime Mode, send DFU detach request...

Resetting USB...

Opening DFU USB Device...

Found DFU: [16c0:0762] devnum=0, cfg=1, intf=0, alt=0, name="SimTrace DFU Interface - Application Partition"

Claiming USB DFU Interface...

Setting Alternate Setting #0 ...

Determining device status: state = dfuIDLE, status = 0

dfuIDLE, continuing

DFU mode device DFU version 0100

Device returned transfer size 256

No valid DFU suffix signature

Warning: File has no DFU suffix

bytes_per_hash=415

Copying data from PC to DFU device

Starting download: [##################################################] finished!

state(7) = dfuMANIFEST, status(0) = No error condition is present

state(2) = dfuIDLE, status(0) = No error condition is present

Done!

can't detach

Resetting USB to switch back to runtime mode

</pre>

1. observing the serial output of the regular firmware starting:

<pre>

sam7dfu: switching to APP mode�

(C) 2006-2011 by Harald Welte <hwelte@hmw-consulting.de>

This software is FREE SOFTWARE licensed under GNU GPL

Version 0.5.6-bb28 compiled 20131117-201527 by laforge@radha.de.gnumonks.org

DEBUG Interface:

0) Set Pull-up 1) Clear Pull-up 2) Toggle LED1 3) Toggle LED2

9) Reset

RSTC_SR=0x00010300

                  Inititalizing usbcmd_gen_init

                                               udp_open(437): entering

USART Initializing

pio_irq_register(109): registering handler 00107538 for PIOA 7

RST

computed Fi(1) Di(1) ratio: 372

ISO_SW Initializing

pio_irq_register(109): registering handler 001079cc for PIOA 8

pio_irq_register(109): registering handler 001078c0 for PIOA 25

VCC_PHONE off

USART Entering Rx Mode

RST

computed Fi(1) Di(1) ratio: 372

MODE: SNIFFER

RST

computed Fi(1) Di(1) ratio: 372

main(76): entering main (idle) loop

</pre>