Project

General

Profile

SciphoneDreamG2 » History » Version 29

unrznbl, 05/09/2019 09:31 PM

1 1 laforge
2 22 marcin
h1. Sciphone Dream G2
3 1 laforge
4 22 marcin
5
The Sciphone Dream G2 is a [[MT6235]] based phone running UI software to mimic the look+feel of Android.
6
7 23 laforge
*[[OsmocomBB]] does not yet support any Mediatek chipsets, so this phone is not supported by [[OsmocomBB]].*
8 1 laforge
9 24 laforge
More information on the hardware of the device can be found at http://en.qi-hardware.com/wiki/Sciphone_Dream_G2
10 1 laforge
The phone has a engineering menu which can be activated by dialing *#36466331#
11
12 29 unrznbl
h2. Software
13
14
- There is "loader_mtk firmware":https://git.osmocom.org/osmocom-bb/tree/src/target/firmware/apps/loader_mtk/main.c in osmocom-bb which enables experimentation and loading of software into RAM
15
- There is a "U-Boot port":https://git.osmocom.org/uboot-mt623x/
16
- There is a downstream "OsmocomBB port":https://gitlab.com/unrznbl/osmocom-bb/tree/sciphone-txburst which pulls the txburst example from u-boot into loader_mtk firmware for experimentation purposes
17 16 steve-m
18 26 gnutoo
h2. Presentations
19
20
* Getting the First Open Source GSM Stack in Linux at ELC 2012: "slides":https://events.linuxfoundation.org/images/stories/pdf/lf_elc12_mielczarczyk.pdf "video":https://bootlin.com/pub/video/2012/elc/elc-2012-mielczarczyk-first-open-source-gsm-stack.webm
21
22 22 marcin
h2. Serial Cable
23
24
25 16 steve-m
You can make a serial cable by sacrificing the headset that comes with the phone, and swapping the pins inside the connector.
26 2 steve-m
27
Serial pinout:
28 9 sylvain
29 2 steve-m
||Pin||signal||comment||
30 9 sylvain
||1||GND||
31
||2||GND||
32 1 laforge
||5||Rx||(From PC to Phone)||
33
||7||Tx||(From Phone to PC)||
34
35 25 zecke
{{thumbnail(sciphone_serial.jpg)}}
36 2 steve-m
37 1 laforge
38 22 marcin
h2. JTAG
39
40
41 4 steve-m
The JTAG port of the MT6235 is accessible on the phone PCB, see the attached picture.
42 22 marcin
You can use "OpenOCD":http://openocd.berlios.de/web/ along with the attached configuration file ([raw-attachment:openocd_mt6235.cfg]) for debugging.
43 1 laforge
44 25 zecke
{{thumbnail(scig2_front.JPG,20%)}}
45
{{thumbnail(scig2_jtag.jpg,20%)}}
46 1 laforge
47 11 steve-m
48 22 marcin
h2. Serial Bootloader
49
 
50 1 laforge
51 22 marcin
Like all Mediatek MT62xx SoCs, the phone uses the [[MTKRomloader]].
52
53 10 steve-m
For executing U-Boot and Linux using the MTK romloader, proceed as follows:
54 1 laforge
55 22 marcin
* clone osmocom-bb.git and checkout the branch 'steve-m/loader_sciphone'
56
* compile the code, connect the phone and run osmocon:
57
<pre>
58 1 laforge
$ ./osmocon -p /dev/ttyUSB0 -m mtk ../../target/firmware/board/mt62xx/loader.mtkram.bin
59 22 marcin
</pre>
60
* press and *hold* the powerbutton of the phone, until the loading has finished and you see the following:
61
<pre>
62 1 laforge
[...]
63
Received branch address ack, code should run now
64 10 steve-m
65 1 laforge
Running on mt62xx in environment mtkram
66
HW_CODE = 0x6235
67 22 marcin
</pre>
68 1 laforge
69 22 marcin
*Uploading U-Boot*
70
* *don't* terminate osmocon and execute:
71
<pre>
72 10 steve-m
$ ./osmoload memload 0x500000 u-boot.bin
73
$ ./osmoload jump 0x500000
74 22 marcin
</pre>
75 13 marcin
76 22 marcin
* now terminate osmocon and open a serial terminal of your choice (115200-8N1)
77
* see below for loading Linux with U-Boot
78 13 marcin
79
80 22 marcin
h2. MTK boot process
81
82
83 25 zecke
{{thumbnail(mt62xx_boot.jpg)}}
84 1 laforge
85 22 marcin
MT62xx chips have IPL (Initial Program Loader) saved in ROM.
86 1 laforge
87
88 22 marcin
This is first code executed after power up.
89 1 laforge
90
91 22 marcin
It configures basic functionality of CPU (serial port 19200n8) and waits on 0xA beacon.
92 1 laforge
93 22 marcin
94
If beacon won't be received, it jumps to NAND memory read procedure.
95
96
97
At NAND 0x0 address Boot Header is placed which holds informations about NAND memory and parameters of image which is going to be loaded.
98
99
100 1 laforge
NAND memory read procedure tries to read NAND memory from 0x0 address with following NFI controller settings:
101
102 13 marcin
||Bus width||Address bytes||Page size||Column shift||Used in Sciphone G2||
103 1 laforge
||1||3||512||8||||
104 13 marcin
||0||3||512||8||||
105 14 marcin
||1||4||512||8||||
106 13 marcin
||0||4||512||8||yes||
107 1 laforge
||1||4||2048||16||||
108
||0||4||2048||16||yes||
109
||1||5||2048||16||||
110
||0||4||2048||16||||
111 15 marcin
112 22 marcin
If Boot Header read from NAND memory will match to currently used NFI configuration, bootloader will start to read data from NAND to internal SRAM. Internal SRAM size is 64kB, which means that code loaded by IPL can't be bigger than that.
113 1 laforge
114
115 22 marcin
*Note:* IPL doesn't configure PLL and SDRAM controller, so there is no possibility to load code to external RAM. Here is where SPL (Secondary Program Loader) comes into the game.
116 1 laforge
117 13 marcin
118 22 marcin
h2. SPL - Runing U-Boot from NAND
119 1 laforge
120 15 marcin
121 22 marcin
SPL (Second Program Loader) is just small U-Boot loader which includes low level CPU initialization (PLL, SDRAM) and NAND driver.
122 1 laforge
123 15 marcin
124 22 marcin
Using default build it occupies less than 4kB, but it lacks NAND memory detection. All the NAND memory types can be specified using preprocessor which is not comfortable. We already identified three different NAND memories and that would be bad to create seperate builds for them.
125 1 laforge
126 22 marcin
127
Fortunatelly there is no need to strip down SPL size to 4kB, so SPL code has been reworked and new functionalities are added. It detects NAND memory at startup and configures NFI controller automatically. New implementation can be found at "nand_spl/nand_boot_detect.c".
128
129
130
SPL also automatically configures SDRAM controler according to RAM you have on your device (currently it tries two configurations).
131
132
133
SPL is generated on every U-Boot build and binary can be found at "nand_spl/u-boot-spl.bin".
134
135
136
SPL will be loaded and executed by IPL only if Boot Header will contain valid data (in this case checksum and length is most important).
137
138
139 6 marcin
To generate Boot Header and place it at the begining of binary you should use mtk_image tool. MTK Boot Header generator can be found at "tools/mtk_image.c".
140
141 22 marcin
<pre>
142 1 laforge
Usage ./mtk_image [ -s size ] [ -o file ] mtk_dump.bin image.bin
143
	[ -s size ]	- size of image, if not specified file size will be taken
144 6 marcin
	[ -o file ]	- name of output file
145 1 laforge
	mtk_dump.bin	- dump of NAND memory from address 0 (at least 64 bytes)
146 6 marcin
	image.bin	- image to be loaded by MTK bootloader
147 22 marcin
</pre>
148 1 laforge
149 22 marcin
mtk_image tool needs dump file from your device (at least 64 bytes read from NAND 0x0 address) as there are different NAND memory configurations. Thanks to that Boot Header will be properly generated for your device.
150 6 marcin
151 1 laforge
152 22 marcin
*Note! Before flashing U-Boot to NAND, create full dump of your NAND, otherwise you'll be not able to restore phone's original software.*
153 1 laforge
154 6 marcin
155 22 marcin
h2. U-Boot
156
157
158 27 unrznbl
Port of U-Boot for Sciphone G2 can be found at "U-Boot":https://git.osmocom.org/uboot-mt623x/
159 22 marcin
160 1 laforge
Building U-Boot:
161
162 22 marcin
<pre>
163 1 laforge
export CROSS_COMPILE=arm-linux-gnueabi-
164
make sciphone_g2_config
165 8 marcin
make
166 22 marcin
</pre>
167 1 laforge
168
169 22 marcin
h2. Linux kernel
170 1 laforge
171 22 marcin
172
Port of Linux kernel for Sciphone G2 can be found at "Linux kernel":http://git.osmocom.org/gitweb?p=linux-mt623x.git;a=summary
173
174 1 laforge
Building Linux:
175
176 22 marcin
<pre>
177 8 marcin
export CROSS_COMPILE=arm-linux-gnueabi-
178
make ARCH=arm sciphone_g2_defconfig
179 1 laforge
make ARCH=arm uImage
180 22 marcin
</pre>
181 1 laforge
182 8 marcin
183 22 marcin
h2. Building initramfs file system
184 1 laforge
185 8 marcin
186 22 marcin
The easiest way to have file system in Linux kernel is to build "Initramfs image":http://www.kernel.org/doc/Documentation/filesystems/ramfs-rootfs-initramfs.txt.
187
188
189
You need to download "Busybox":http://www.busybox.net/, configure it and build it.
190
191
<pre>
192 8 marcin
export CROSS_COMPILE=arm-linux-gnueabi-
193
make menuconfig
194
make
195
make install
196 22 marcin
</pre>
197 1 laforge
198 22 marcin
Generated file system by default installs in _install directory.
199 1 laforge
200 22 marcin
201 1 laforge
Additional to that you'll need to create console device in already built filesystem.
202
203 22 marcin
<pre>
204 1 laforge
sudo mknod dev/console c 5 1
205 22 marcin
</pre>
206 1 laforge
207
Now you can create CPIO archive:
208
209 22 marcin
<pre>
210 1 laforge
find . | cpio -o -H newc > rootfs.cpio
211 22 marcin
</pre>
212 7 marcin
213 22 marcin
Next step is to point to Linux kernel where initramfs image is located.
214 7 marcin
215 22 marcin
216 1 laforge
In menuconfig of Linux kernel you should modify following option:
217
218 22 marcin
<pre>
219 1 laforge
CONFIG_INITRAMFS_SOURCE=<path_to_cpio>
220
General setup -> Initial RAM filesystem and RAM disk -> Initramfs source file(s)
221 22 marcin
</pre>
222 1 laforge
223 22 marcin
After these steps Linux kernel image will have initramfs built in.
224 1 laforge
225 14 marcin
226 22 marcin
*Important note:* Initramfs ignores 'init=' variable given in kernel boot parameters list. It always executes /init command at startup and you can't change it. Check if you have /init in your file system (BusyBox has /linuxrc by default, so just change its name to init).
227
Every time you change initramfs file system you have to rebuild also Linux kernel.
228
229
230 13 marcin
To unpack CPIO archive you can use following command:
231
232 22 marcin
<pre>
233 1 laforge
cpio -i -d -H newc -F <path_to_cpio_archive> --no-absolute-filenames
234 22 marcin
</pre>
235 13 marcin
236 1 laforge
237 22 marcin
h2. Reading data files in U-Boot
238 1 laforge
239 22 marcin
240
*NAND*
241
242 1 laforge
Following command will read 256 bytes from NAND address 0 at address 0x800000.
243 13 marcin
244 22 marcin
<pre>
245 1 laforge
nand read 0x800000 0 0x100
246 22 marcin
</pre>
247 13 marcin
248 22 marcin
*Serial*
249 1 laforge
250
Following command will read data at address 0x800000 from serial at baudrate 115200 (using kermit protocol).
251
252 22 marcin
<pre>
253 1 laforge
loadb 0x800000 115200
254 22 marcin
</pre>
255 1 laforge
256 22 marcin
*SD/MMC*
257 1 laforge
258 13 marcin
Following command will read uImage file at address 0x800000 from MMC card.
259 1 laforge
260 22 marcin
<pre>
261 1 laforge
mmcinfo
262 13 marcin
fatload mmc 0 0x800000 uImage
263 22 marcin
</pre>
264 13 marcin
265
266 22 marcin
h2. NAND memory
267
268
269 13 marcin
So far three types of NAND memories has been identified:
270 1 laforge
271
||Chip||Size||
272
||HY27XS08121M||512Mb (64MB) NAND||
273 13 marcin
||HY27XA081G1M||1Gb (128MB) NAND||
274 1 laforge
||TC58NVG0S3AFT||1Gb (128MB) NAND||
275
276 22 marcin
All of them are supported by "mt62xx_nand.c" NAND driver in U-Boot.
277 1 laforge
278
279 22 marcin
This driver has also support for ECC hardware decoding and encoding.
280
281
282 1 laforge
ECC layout which is used by MTK looks as follows:
283 13 marcin
284 22 marcin
<pre>
285 13 marcin
/*
286 22 marcin
* For small and large page NAND devices ecc block size is the same:
287 13 marcin
 *
288 22 marcin
*      ecc_block_size = 256
289 13 marcin
 *
290 22 marcin
* Placement of ecc bytes in spare area is as follows:
291 1 laforge
 *
292 22 marcin
* --------------------------------------------------------------
293
* |                            SPARE                           |
294
* --------------------------------------------------------------
295
* |    | ECC0  |       | ECC1  |       | ECC2  |       | ECC3  |
296
* --------------------------------------------------------------
297
* 0    8       16      24      32      40      48      56      64
298 1 laforge
 *
299 22 marcin
* ECC0 = 12 bits (from 1st ECC block) + 12 bits (from 2nd ECC block)
300
* ECC1 = 12 bits (from 3rd ECC block) + 12 bits (from 4th ECC block)
301
* ECC2 = 12 bits (from 5th ECC block) + 12 bits (from 6th ECC block)
302
* ECC2 = 12 bits (from 7th ECC block) + 12 bits (from 8th ECC block)
303 1 laforge
 */
304
305 22 marcin
</pre>
306 1 laforge
307 13 marcin
ECC layout information is pretty important as built-in bootloader in MT62xx chips
308
has hardware ECC enabled and it won't load code from NAND if ECC layout will
309 22 marcin
not match.
310 13 marcin
311 1 laforge
312 22 marcin
This layout is also important to properly dump or restore existing firmware.
313
314
315 1 laforge
NAND driver for Linux is under development.
316
317
318 22 marcin
h2. LCD
319
320
Sciphone G2 has LCD with 240x320 resolution.
321
322
323 1 laforge
Currently two different LCD controllers has been identified (on Sciphone G2):
324 22 marcin
* ILI9331
325
* ILI9325
326
These controllers are already supported in U-Boot.
327 1 laforge
328 22 marcin
329 1 laforge
To identify what kind of controller is in your device, just check U-Boot prints.
330
331 22 marcin
<pre>
332 13 marcin
DRAM:  32 MiB
333
NAND:  64 MiB
334
MMC:   msdc_mmc: 0
335 1 laforge
mtk_lcd INFO: Read LCD device code: 9331.
336 22 marcin
</pre>
337 1 laforge
338 22 marcin
U-Boot supports displaying bitmap on the screen, you just have to create bitmap in proper format.
339 1 laforge
340
341 22 marcin
By default U-Boot will build osmocomBB bitmap.
342 13 marcin
343
344 22 marcin
To convert your customized bitmap change type of bitmap to indexed.
345
346
347
Using GIMP, select "Image -> Mode -> Indexed...". Maximum number of colours is 240 (16 is used by internal U-Boot CMAP).
348
349
350 13 marcin
In existing U-Boot bmp logo converting tool (tools/bmp_logo.c) there are two issues:
351 22 marcin
* width of bitmap has to be aligned to 4 (otherwise padding bytes will be added and bitmap will be not properly displayed)
352
* size of bitmap can't be bigger than 65535 (LCD on Sciphone G2 is 240x320 = 76800)
353
Both issues are fixed on "uboot-mt623x":http://git.osmocom.org/gitweb?p=uboot-mt623x.git;a=summary.
354 13 marcin
355
356 22 marcin
MT6235 LCD controller shares data lines with NFI (NAND) controller. Currently there is no possibility to use NAND when LCD is used.
357
358
359 1 laforge
Frame buffer driver for Linux is under development.
360 13 marcin
361
362 22 marcin
h2. BBT handling
363
364
365 13 marcin
Comment from "sciphone_g2.h" configuration file explains how BBT is handled.
366
367 22 marcin
<pre>
368 13 marcin
/*
369 22 marcin
* Below option allows U-Boot to save BBT table in NAND.
370
* Without this option BBT table is created everytime when first nand
371
* command is executed (except "nand dump"). Full scanning of NAND
372
* takes long time and unnecessarily delays first command execution.
373 13 marcin
 *
374 22 marcin
* NOTE! This option is disabled by defaut as at startup it deletes last
375
* two blocks of NAND. Most of people run code from RAM and don't have
376
* NAND memory dumped yet. If you don't like to wait on first nand
377
* command, you should enable below option.
378 13 marcin
 */
379
#define MT62XX_NAND_BBT_IN_NAND
380 22 marcin
</pre>
381 13 marcin
382
383 22 marcin
h2. MTD partitions
384
385
386 13 marcin
Layout of MTD partitions is following:
387
388 22 marcin
<pre>
389 13 marcin
device nand0 <mt62xx_nand.0>, # parts = 5
390
 #: name                size            offset          mask_flags
391
 0: sbl                 0x00020000      0x00000000      0
392
 1: env                 0x00020000      0x00020000      0
393
 2: u-boot              0x00200000      0x00040000      0
394
 3: kernel              0x00200000      0x00240000      0
395 6 marcin
 4: root                0x03bc0000      0x00440000      0
396 22 marcin
</pre>
397 17 marcin
398
399 22 marcin
h2. Building images with [[OpenEmbedded]]
400 17 marcin
401
402 22 marcin
Currently the easiest way to build your own Linux distribution for Sciphone G2 is to use OE.
403 17 marcin
404
405 22 marcin
Setting up of OE is described "here":http://www.openembedded.org/index.php/Getting_started.
406
407
408
To have Sciphone G2 target and Linux kernel with U-Boot from [[OsmocomBB]] repositories, you need to apply patch from "here":http://downloads.qi-hardware.com/people/marcin/.
409
410
411
Under above link you can also find example config file for OE build.
412
413
414 17 marcin
So far following images has been successfully run on Sciphone G2:
415
416 22 marcin
<pre>
417 17 marcin
minimal-image
418
opie-image-16mb
419
opie-image
420
x11-image
421 22 marcin
</pre>
422 17 marcin
After successfull build of image, following directory will contain U-Boot, Linux kernel and file system image:
423
424 22 marcin
<pre>
425 18 marcin
/YOUR_BUILD_DIRECTORY/deploy/images/sciphone_g2/
426 22 marcin
</pre>
427 17 marcin
428 22 marcin
U-Boot and Linux kernel are built from latest sources found in [[OsmocomBB]] repositories.
429 17 marcin
430
431 22 marcin
h2. Running Linux distro
432
433
434 25 zecke
{{thumbnail(scig2_opie.jpg)}}
435 17 marcin
436 22 marcin
It's possible to run any Linux distribution without flashing Sciphone's original firmware.
437 17 marcin
438
439 22 marcin
To do this, you need to prepare microSD card and use osmocon loader to load u-Boot image to RAM.
440 17 marcin
441
442 22 marcin
Current images for U-Boot and Root File Systems can be found "here":http://downloads.qi-hardware.com/people/marcin/.
443 17 marcin
444 22 marcin
First of all ext3 partition has to be created on SD card.
445
446
447
*Note!!! Followig method will erase all data on your SD card.*
448
449
<pre>
450 17 marcin
sudo fdisk /dev/sdbX
451
press p (prints partition table)
452
press d (deletes partition table)
453
press n (adds new partition)
454
sudo mkfs.ext3 /dev/sdbX
455 22 marcin
</pre>
456 17 marcin
457
Next step is to copy built image to SD card:
458
459 22 marcin
<pre>
460 17 marcin
sudo dd if=<path_to_ext3_image_file> of=/dev/sdbx
461 22 marcin
</pre>
462 19 marcin
463 22 marcin
When operation is finished, you can pull out SD card from PC and insert it to Sciphone.
464 20 marcin
465
466 22 marcin
Now you can load U-Boot image using osmocon tool.
467 20 marcin
468
469 22 marcin
When U-Boot starts, it loads /boot/uImage kernel file from SD card to RAM and boots it (OE automatically copies built kernel to /boot directory).
470 21 marcin
471 20 marcin
472 22 marcin
After that you should see [[OsmocomBB]] splash screen with "Please wait ..." text and after few moments an OPIE welcome screen should appear.
473 19 marcin
474 22 marcin
475
*Note!!! Initial boot takes much longer time than next ones.*
476
477
If your screen is not properly calibrated, execute *ts_calibrate* command from shell which will recalibrate your touchscreen.
478
479
480
h2. Additional equipment
481
482
483
Sciphone G2 has microSD card slot in hardly available place.
484
485
During development process you'll waste a lot of time to pull out and put in microSD card with new software.
486
487 1 laforge
Below picture shows home made microSD card extension cable which makes SD card changes much faster.
488
489 25 zecke
{{thumbnail(microsd_extension.jpg)}}
490
{{thumbnail(scig2_microsd.jpg)}}
491 1 laforge
492
493 22 marcin
h2. Links
494 1 laforge
495 28 osmith
- "video showing Sciphone G2 running Angstrom Linux with OPIE":http://www.youtube.com/watch?v=-_guRruQi0I
496 22 marcin
497 28 osmith
- "video showing Sciphone G2 running Linux kernel":http://www.youtube.com/watch?v=w_Iwsckm7Ko
498 22 marcin
499 28 osmith
- "Sciphone G2 binary images and patches":http://downloads.qi-hardware.com/people/marcin/
Add picture from clipboard (Maximum size: 48.8 MB)