Project

General

Profile

SciphoneDreamG2 » History » Version 16

steve-m, 02/19/2016 10:49 PM
add engineering menu code

1 1 laforge
= Sciphone Dream G2 =
2 1 laforge
3 1 laforge
The Sciphone Dream G2 is a [wiki:MT6235] based phone running UI software to mimic the look+feel of Android.
4 1 laforge
5 1 laforge
There is currently an u-boot and Linux port for the MT6235 underway, the primary development platform is the Sciphone G2.
6 1 laforge
7 1 laforge
OsmocomBB does not yet support any Mediatek chipsets, so this phone is not supported by OsmocomBB.  Nonetheless, we
8 1 laforge
expect to have support for it at some point in the future.
9 1 laforge
10 16 steve-m
More information on the hardware of the device can be found at [http://en.qi-hardware.com/wiki/Sciphone_Dream_G2] [[BR]]
11 16 steve-m
The phone has a engineering menu which can be activated by dialing *#36466331#
12 16 steve-m
13 1 laforge
== Serial Cable ==
14 2 steve-m
15 16 steve-m
You can make a serial cable by sacrificing the headset that comes with the phone, and swapping the pins inside the connector.
16 2 steve-m
17 2 steve-m
Serial pinout:
18 2 steve-m
19 9 sylvain
||Pin||signal||comment||
20 2 steve-m
||1||GND||
21 2 steve-m
||2||GND||
22 9 sylvain
||5||Rx||(From PC to Phone)||
23 9 sylvain
||7||Tx||(From Phone to PC)||
24 2 steve-m
25 2 steve-m
[[Image(sciphone_serial.jpg,20%)]]
26 2 steve-m
27 1 laforge
== JTAG ==
28 1 laforge
29 1 laforge
The JTAG port of the MT6235 is accessible on the phone PCB, see the attached picture.
30 5 steve-m
You can use [http://openocd.berlios.de/web/ OpenOCD] along with the attached configuration file ([raw-attachment:openocd_mt6235.cfg]) for debugging.
31 4 steve-m
32 6 marcin
[[Image(scig2_front.JPG,20%)]]
33 6 marcin
[[Image(scig2_jtag.jpg,20%)]]
34 6 marcin
35 4 steve-m
== Serial Bootloader == 
36 4 steve-m
37 5 steve-m
Like all Mediatek MT62xx !SoCs, the phone uses the [wiki:MTKRomloader].
38 6 marcin
39 10 steve-m
For executing U-Boot and Linux using the MTK romloader, proceed as follows:
40 10 steve-m
41 11 steve-m
 * clone osmocom-bb.git and checkout the branch 'steve-m/loader_sciphone'
42 10 steve-m
 * compile the code, connect the phone and run osmocon:
43 10 steve-m
   {{{
44 12 steve-m
$ ./osmocon -p /dev/ttyUSB0 -m mtk ../../target/firmware/board/mt62xx/loader.mtkram.bin
45 10 steve-m
   }}}
46 10 steve-m
 * press and '''hold''' the powerbutton of the phone, until the loading has finished and you see the following:
47 10 steve-m
   {{{
48 10 steve-m
[...]
49 10 steve-m
Received branch address ack, code should run now
50 10 steve-m
51 10 steve-m
Running on mt62xx in environment mtkram
52 10 steve-m
HW_CODE = 0x6235
53 10 steve-m
   }}}
54 10 steve-m
55 10 steve-m
'''Uploading U-Boot'''
56 10 steve-m
 * '''don't''' terminate osmocon and execute:
57 10 steve-m
 {{{
58 10 steve-m
$ ./osmoload memload 0x500000 u-boot.bin
59 10 steve-m
$ ./osmoload jump 0x500000
60 10 steve-m
 }}}
61 10 steve-m
62 10 steve-m
 * now terminate osmocon and open a serial terminal of your choice (115200-8N1)
63 10 steve-m
 * see below for loading Linux with U-Boot
64 10 steve-m
65 13 marcin
== MTK boot process ==
66 13 marcin
67 15 marcin
[[Image(mt62xx_boot.jpg,20%)]]
68 15 marcin
69 14 marcin
MT62xx chips have IPL (Initial Program Loader) saved in ROM.[[BR]]
70 13 marcin
71 13 marcin
This is first code executed after power up.[[BR]]
72 13 marcin
73 13 marcin
It configures basic functionality of CPU (serial port 19200n8) and waits on 0xA beacon.[[BR]]
74 13 marcin
75 13 marcin
If beacon won't be received, it jumps to NAND memory read procedure.[[BR]]
76 1 laforge
77 15 marcin
At NAND 0x0 address Boot Header is placed which holds informations about NAND memory and parameters of image which is going to be loaded.[[BR]]
78 13 marcin
79 13 marcin
NAND memory read procedure tries to read NAND memory from 0x0 address with following NFI controller settings:
80 13 marcin
81 13 marcin
||Bus width||Address bytes||Page size||Column shift||Used in Sciphone G2||
82 13 marcin
||1||3||512||8||||
83 13 marcin
||0||3||512||8||||
84 13 marcin
||1||4||512||8||||
85 13 marcin
||0||4||512||8||yes||
86 13 marcin
||1||4||2048||16||||
87 13 marcin
||0||4||2048||16||yes||
88 13 marcin
||1||5||2048||16||||
89 13 marcin
||0||4||2048||16||||
90 13 marcin
91 13 marcin
If Boot Header read from NAND memory will match to currently used NFI configuration, bootloader will start to read data from NAND to internal SRAM. Internal SRAM size is 64kB, which means that code loaded by IPL can't be bigger than that.[[BR]]
92 13 marcin
93 14 marcin
'''Note:''' IPL doesn't configure PLL and SDRAM controller, so there is no possibility to load code to external RAM. Here is where SPL (Secondary Program Loader) comes into the game.
94 13 marcin
95 13 marcin
== SPL - Runing U-Boot from NAND ==
96 13 marcin
97 1 laforge
SPL (Second Program Loader) is just small U-Boot loader which includes low level CPU initialization (PLL, SDRAM) and NAND driver.[[BR]]
98 13 marcin
99 15 marcin
Using default build it occupies less than 4kB, but it lacks NAND memory detection. All the NAND memory types can be specified using preprocessor which is not comfortable. We already identified three different NAND memories and that would be bad to create seperate builds for them.[[BR]]
100 13 marcin
101 13 marcin
Fortunatelly there is no need to strip down SPL size to 4kB, so SPL code has been reworked and new functionalities are added. It detects NAND memory at startup and configures NFI controller automatically. New implementation can be found at "nand_spl/nand_boot_detect.c".[[BR]]
102 13 marcin
103 13 marcin
SPL also automatically configures SDRAM controler according to RAM you have on your device (currently it tries two configurations).[[BR]]
104 1 laforge
105 1 laforge
SPL is generated on every U-Boot build and binary can be found at "nand_spl/u-boot-spl.bin".[[BR]]
106 13 marcin
107 15 marcin
SPL will be loaded and executed by IPL only if Boot Header will contain valid data (in this case checksum and length is most important).[[BR]]
108 13 marcin
109 15 marcin
To generate Boot Header and place it at the begining of binary you should use mtk_image tool. MTK Boot Header generator can be found at "tools/mtk_image.c".
110 13 marcin
111 13 marcin
{{{
112 13 marcin
Usage ./mtk_image [ -s size ] [ -o file ] mtk_dump.bin image.bin
113 13 marcin
	[ -s size ]	- size of image, if not specified file size will be taken
114 13 marcin
	[ -o file ]	- name of output file
115 1 laforge
	mtk_dump.bin	- dump of NAND memory from address 0 (at least 64 bytes)
116 13 marcin
	image.bin	- image to be loaded by MTK bootloader
117 1 laforge
}}}
118 1 laforge
119 14 marcin
mtk_image tool needs dump file from your device (at least 64 bytes read from NAND 0x0 address) as there are different NAND memory configurations. Thanks to that Boot Header will be properly generated for your device.[[BR]]
120 13 marcin
121 14 marcin
'''Note! Before flashing U-Boot to NAND, create full dump of your NAND, otherwise you'll be not able to restore phone's original software.'''
122 14 marcin
123 6 marcin
== U-Boot ==
124 6 marcin
125 6 marcin
Port of U-Boot for Sciphone G2 can be found at [http://git.osmocom.org/gitweb?p=uboot-mt623x.git;a=summary U-Boot]
126 6 marcin
127 6 marcin
Building U-Boot:
128 6 marcin
129 6 marcin
{{{
130 6 marcin
export CROSS_COMPILE=arm-linux-gnueabi-
131 6 marcin
make sciphone_g2_config
132 6 marcin
make
133 6 marcin
}}}
134 6 marcin
135 6 marcin
== Linux kernel ==
136 6 marcin
137 6 marcin
Port of Linux kernel for Sciphone G2 can be found at [http://git.osmocom.org/gitweb?p=linux-mt623x.git;a=summary Linux kernel]
138 6 marcin
139 6 marcin
Building Linux:
140 6 marcin
141 6 marcin
{{{
142 6 marcin
export CROSS_COMPILE=arm-linux-gnueabi-
143 7 marcin
make ARCH=arm sciphone_g2_defconfig
144 6 marcin
make ARCH=arm uImage
145 6 marcin
}}}
146 6 marcin
147 8 marcin
== Building initramfs file system ==
148 8 marcin
149 8 marcin
The easiest way to have file system in Linux kernel is to build [http://www.kernel.org/doc/Documentation/filesystems/ramfs-rootfs-initramfs.txt Initramfs image].[[BR]]
150 8 marcin
151 8 marcin
You need to download [http://www.busybox.net/ Busybox], configure it and build it.
152 8 marcin
153 8 marcin
{{{
154 8 marcin
export CROSS_COMPILE=arm-linux-gnueabi-
155 8 marcin
make menuconfig
156 8 marcin
make
157 13 marcin
make install
158 8 marcin
}}}
159 8 marcin
160 13 marcin
Generated file system by default installs in _install directory.[[BR]]
161 13 marcin
162 8 marcin
Additional to that you'll need to create console device in already built filesystem.
163 8 marcin
164 8 marcin
{{{
165 8 marcin
sudo mknod dev/console c 5 1
166 8 marcin
}}}
167 8 marcin
168 8 marcin
Now you can create CPIO archive:
169 8 marcin
170 8 marcin
{{{
171 8 marcin
find . | cpio -o -H newc > rootfs.cpio
172 8 marcin
}}}
173 8 marcin
174 8 marcin
Next step is to point to Linux kernel where initramfs image is located.[[BR]]
175 8 marcin
176 8 marcin
In menuconfig of Linux kernel you should modify following option:
177 8 marcin
178 8 marcin
{{{
179 8 marcin
CONFIG_INITRAMFS_SOURCE=<path_to_cpio>
180 8 marcin
General setup -> Initial RAM filesystem and RAM disk -> Initramfs source file(s)
181 8 marcin
}}}
182 8 marcin
183 8 marcin
After these steps Linux kernel image will have initramfs built in.[[BR]]
184 8 marcin
185 8 marcin
'''Important note:''' Initramfs ignores 'init=' variable given in kernel boot parameters list. It always executes /init command at startup and you can't change it. Check if you have /init in your file system (BusyBox has /linuxrc by default, so just change its name to init).
186 8 marcin
Every time you change initramfs file system you have to rebuild also Linux kernel.[[BR]]
187 8 marcin
188 8 marcin
To unpack CPIO archive you can use following command:
189 8 marcin
190 8 marcin
{{{
191 8 marcin
cpio -i -d -H newc -F <path_to_cpio_archive> --no-absolute-filenames
192 8 marcin
}}}
193 8 marcin
194 6 marcin
== Reading data files in U-Boot ==
195 6 marcin
196 6 marcin
'''NAND'''
197 6 marcin
198 7 marcin
Following command will read 256 bytes from NAND address 0 at address 0x800000.
199 6 marcin
200 6 marcin
{{{
201 7 marcin
nand read 0x800000 0 0x100
202 6 marcin
}}}
203 6 marcin
204 6 marcin
'''Serial'''
205 6 marcin
206 7 marcin
Following command will read data at address 0x800000 from serial at baudrate 115200 (using kermit protocol).
207 6 marcin
208 6 marcin
{{{
209 7 marcin
loadb 0x800000 115200
210 6 marcin
}}}
211 6 marcin
212 6 marcin
'''SD/MMC'''
213 1 laforge
214 6 marcin
Following command will read uImage file at address 0x800000 from MMC card.
215 7 marcin
216 6 marcin
{{{
217 14 marcin
mmcinfo
218 7 marcin
fatload mmc 0 0x800000 uImage
219 13 marcin
}}}
220 13 marcin
221 13 marcin
== NAND memory ==
222 13 marcin
223 13 marcin
So far three types of NAND memories has been identified:
224 13 marcin
225 13 marcin
||Chip||Size||
226 13 marcin
||HY27XS08121M||512Mb (64MB) NAND||
227 13 marcin
||HY27XA081G1M||1Gb (128MB) NAND||
228 13 marcin
||TC58NVG0S3AFT||1Gb (128MB) NAND||
229 13 marcin
230 13 marcin
All of them are supported by "mt62xx_nand.c" NAND driver in U-Boot.[[BR]]
231 13 marcin
232 13 marcin
This driver has also support for ECC hardware decoding and encoding.[[BR]]
233 13 marcin
234 13 marcin
ECC layout which is used by MTK looks as follows:
235 13 marcin
236 13 marcin
{{{
237 13 marcin
/*
238 13 marcin
 * For small and large page NAND devices ecc block size is the same:
239 13 marcin
 *
240 13 marcin
 *      ecc_block_size = 256
241 13 marcin
 *
242 13 marcin
 * Placement of ecc bytes in spare area is as follows:
243 13 marcin
 *
244 13 marcin
 * --------------------------------------------------------------
245 13 marcin
 * |                            SPARE                           |
246 13 marcin
 * --------------------------------------------------------------
247 13 marcin
 * |    | ECC0  |       | ECC1  |       | ECC2  |       | ECC3  |
248 13 marcin
 * --------------------------------------------------------------
249 13 marcin
 * 0    8       16      24      32      40      48      56      64
250 13 marcin
 *
251 13 marcin
 * ECC0 = 12 bits (from 1st ECC block) + 12 bits (from 2nd ECC block)
252 13 marcin
 * ECC1 = 12 bits (from 3rd ECC block) + 12 bits (from 4th ECC block)
253 13 marcin
 * ECC2 = 12 bits (from 5th ECC block) + 12 bits (from 6th ECC block)
254 13 marcin
 * ECC2 = 12 bits (from 7th ECC block) + 12 bits (from 8th ECC block)
255 13 marcin
 */
256 13 marcin
257 13 marcin
}}}
258 13 marcin
259 13 marcin
ECC layout information is pretty important as built-in bootloader in MT62xx chips
260 13 marcin
has hardware ECC enabled and it won't load code from NAND if ECC layout will
261 13 marcin
not match.[[BR]]
262 13 marcin
263 13 marcin
This layout is also important to properly dump or restore existing firmware.[[BR]]
264 13 marcin
265 13 marcin
NAND driver for Linux is under development.
266 13 marcin
267 13 marcin
== LCD ==
268 13 marcin
Sciphone G2 has LCD with 240x320 resolution.[[BR]]
269 13 marcin
270 13 marcin
Currently two different LCD controllers has been identified (on Sciphone G2):
271 13 marcin
 * ILI9331
272 13 marcin
 * ILI9325
273 13 marcin
These controllers are already supported in U-Boot.[[BR]]
274 13 marcin
275 13 marcin
To identify what kind of controller is in your device, just check U-Boot prints.
276 13 marcin
277 13 marcin
{{{
278 13 marcin
DRAM:  32 MiB
279 13 marcin
NAND:  64 MiB
280 13 marcin
MMC:   msdc_mmc: 0
281 13 marcin
mtk_lcd INFO: Read LCD device code: 9331.
282 13 marcin
}}}
283 13 marcin
284 13 marcin
U-Boot supports displaying bitmap on the screen, you just have to create bitmap in proper format.[[BR]]
285 13 marcin
286 13 marcin
By default U-Boot will build osmocomBB bitmap.[[BR]]
287 13 marcin
288 13 marcin
To convert your customized bitmap change type of bitmap to indexed.[[BR]]
289 13 marcin
290 13 marcin
Using GIMP, select "Image -> Mode -> Indexed...". Maximum number of colours is 240 (16 is used by internal U-Boot CMAP).[[BR]]
291 13 marcin
292 13 marcin
In existing U-Boot bmp logo converting tool (tools/bmp_logo.c) there are two issues:
293 13 marcin
 * width of bitmap has to be aligned to 4 (otherwise padding bytes will be added and bitmap will be not properly displayed)
294 13 marcin
 * size of bitmap can't be bigger than 65535 (LCD on Sciphone G2 is 240x320 = 76800)
295 13 marcin
Both issues are fixed on [http://git.osmocom.org/gitweb?p=uboot-mt623x.git;a=summary uboot-mt623x].[[BR]]
296 1 laforge
297 13 marcin
MT6235 LCD controller shares data lines with NFI (NAND) controller. Currently there is no possibility to use NAND when LCD is used.[[BR]]
298 13 marcin
299 13 marcin
Frame buffer driver for Linux is under development.
300 13 marcin
301 14 marcin
== BBT handling ==
302 13 marcin
303 13 marcin
Comment from "sciphone_g2.h" configuration file explains how BBT is handled.
304 13 marcin
305 13 marcin
{{{
306 13 marcin
/*
307 13 marcin
 * Below option allows U-Boot to save BBT table in NAND.
308 13 marcin
 * Without this option BBT table is created everytime when first nand
309 13 marcin
 * command is executed (except "nand dump"). Full scanning of NAND
310 13 marcin
 * takes long time and unnecessarily delays first command execution.
311 13 marcin
 *
312 13 marcin
 * NOTE! This option is disabled by defaut as at startup it deletes last
313 13 marcin
 * two blocks of NAND. Most of people run code from RAM and don't have
314 13 marcin
 * NAND memory dumped yet. If you don't like to wait on first nand
315 13 marcin
 * command, you should enable below option.
316 13 marcin
 */
317 13 marcin
#define MT62XX_NAND_BBT_IN_NAND
318 13 marcin
}}}
319 13 marcin
320 13 marcin
== MTD partitions ==
321 13 marcin
322 13 marcin
Layout of MTD partitions is following:
323 13 marcin
324 13 marcin
{{{
325 13 marcin
device nand0 <mt62xx_nand.0>, # parts = 5
326 13 marcin
 #: name                size            offset          mask_flags
327 13 marcin
 0: sbl                 0x00020000      0x00000000      0
328 13 marcin
 1: env                 0x00020000      0x00020000      0
329 13 marcin
 2: u-boot              0x00200000      0x00040000      0
330 13 marcin
 3: kernel              0x00200000      0x00240000      0
331 13 marcin
 4: root                0x03bc0000      0x00440000      0
332 6 marcin
}}}
Add picture from clipboard (Maximum size: 48.8 MB)