06:02.52 | *** join/#htc-linux awelux (n=awelux__@dslb-084-058-153-192.pools.arcor-ip.net) |
08:50.02 | *** join/#htc-linux rob_w (n=bob@p213.54.193.20.tisdip.tiscali.de) |
09:58.19 | *** join/#htc-linux pH5 (n=ph5@p5485F591.dip.t-dialin.net) |
11:10.18 | *** join/#htc-linux pwr (n=pwr@82.78.120.186) |
12:32.52 | rob_w | i will now try to make the battery code irq driven on ac connects , including led`s |
12:56.01 | *** join/#htc-linux WizMaui (n=WizMaui@62.112.90.216) |
13:45.49 | *** join/#htc-linux rob_w (n=bob@p213.54.220.74.tisdip.tiscali.de) |
14:33.21 | *** join/#htc-linux jeanseb (n=jeanseb@62.147.133.94) |
14:57.05 | *** join/#htc-linux skodde (n=skodde@213-140-16-178.fastres.net) |
15:03.58 | *** join/#htc-linux Kevin2 (n=Kevin@207-237-52-30.c3-0.avec-ubr12.nyr-avec.ny.cable.rcn.com) |
16:30.28 | *** join/#htc-linux pleemans (n=peter@d54C248DE.access.telenet.be) |
16:42.22 | Kevin2 | Hi |
16:44.37 | *** join/#htc-linux pwr (n=pwr@82.78.120.186) |
16:45.27 | Kevin2 | Any universal users awake? |
17:03.06 | Kevin2 | Well, if anyone comes on please try running the haret steps at http://pastebin.ca/159143 and plug/unplug the phone while in the "wi" stage. |
17:19.11 | rob_w | hmm gpio 0 toggles in the powerbutton and on connecting AC alone |
17:22.01 | rob_w | what sense does this have ?? |
18:19.40 | *** join/#htc-linux WizMaui_ (n=WizMaui@62.112.90.216) |
19:49.38 | cr2 | hi. somebody around? |
19:59.36 | MB300E | i am here |
19:59.59 | *** join/#htc-linux WizMaui (n=WizMaui@62.112.90.216) |
20:00.57 | pH5 | hey cr2 |
20:02.06 | pH5 | I'd like to do *something* about the phone here, but I don't know where to start. |
20:02.25 | pH5 | Is there a more clever tracing method now than just looking at the gpios when turning on/off the phone? |
20:03.21 | pH5 | I know the GSM reset routine from the bootloader disassembly, but not much else. |
20:04.19 | Kevin2 | Hi |
20:04.51 | Kevin2 | ph5: Have you looked at: http://www.handhelds.org/moin/moin.cgi/ApachePhoneTrace |
20:12.57 | pH5 | Kevin2: thanks! this will be very useful once I get to talk to the chipset. |
20:14.17 | Kevin2 | ph5: What phone do you have? |
20:14.29 | pH5 | htc magician |
20:14.41 | pH5 | the ttySx don't answer to anything yet |
20:14.58 | Kevin2 | Hrrmm. Is it pxa based? Does it use wm5? |
20:15.28 | pH5 | it's pxa272, and it uses the old wince 2003(?) |
20:16.17 | Kevin2 | Can you run haret on it? If so, you should be able to trace the serial port like I did. |
20:18.55 | pH5 | Kevin2: I'll try it. |
20:19.56 | Kevin2 | Hrrm. You have a MAX1587A also.. Can you run the commands at http://pastebin.ca/159143 and plug/unplug the phone while running "wi"? I'm trying to see if the other phones are using the power management i2c bus like the apache is. |
20:23.59 | pH5 | Kevin2: Difficult, I usually run haret over that usb connection. That's the only DC input. |
20:24.21 | cr2 | hi Kevin |
20:24.31 | cr2 | universal does not use power i2c |
20:26.49 | Kevin2 | cr2: Are you sure? On my phone it shows as powered down (cken off), but I've confirmed that it brings it up and then down to write voltage changes on the i2c bus. |
20:27.40 | Kevin2 | BTW, welcome back. I hope your vacation was fun. |
20:29.44 | cr2 | yes, only if my hdd survived that time ;) |
20:30.03 | cr2 | you think that power i2c is connected to max1587a ? |
20:30.23 | Kevin2 | ph5: Hrmm. That is a pain. What happens if you unplug/plug the phone while running haret? I've been able to stop/start wifi while connected to haret over wifi. |
20:30.52 | Kevin2 | cr2: Yep, the above commands that I posted at pastebin clearly show it. |
20:31.52 | Kevin2 | wm5 writes to the pm i2c transmit address at 0xaef00188 |
20:33.32 | pH5 | Kevin2: unfortunately the ppp-over-usb connection breaks doesn't survive pulling the plug |
20:34.27 | cr2 | i have not tried it with "wi", but did not see any cken change or 0xaef00188 changes with usual tools. |
20:35.04 | Kevin2 | cr2: Neither did I. But the wi did show it for me. |
20:36.09 | cr2 | ok. |
20:37.30 | cr2 | i will try it. |
20:37.53 | cr2 | btw, can we trace an usb endpoint in a similar way ? |
20:38.07 | Kevin2 | ph5: When you bring the ppp back up do you get the same IP addresses? If you get the same IPs, the telnet session should survive it. |
20:38.28 | Kevin2 | cr2: USB uses dma. So, it is theoretically possible, but an order of magnitude harder. |
20:39.07 | Kevin2 | We'd have to trace the dma enable command and then write C code to copy the stuff that was being transmitted / received. |
20:39.50 | cr2 | is it a normal dma channel ? i don't remember. |
20:40.04 | Kevin2 | I don't recall either. |
20:40.22 | cr2 | lcd uses some internal dma engine. |
20:40.25 | Kevin2 | Do you think anything interesting goes over the usb connection? |
20:40.37 | cr2 | gprs/umts data |
20:41.04 | pH5 | Kevin2: I don't get the pppd connection up again, there seems to be some ugly interference with activesync on the phone. can I kill this somehow? |
20:41.25 | cr2 | haret "kill pid" |
20:42.16 | cr2 | "dump ps" first or "dump wince" afaik |
20:43.33 | Kevin2 | cr2: Do you have a list of phone related gpios and what they do? I have 5 gpio pins (at least) that are phone related. I think I figured out one of them, but I'm curious if they'll map the same as the universal. |
20:44.08 | pH5 | hmm, that didn't work out. I'll try to log to a file instead. |
20:44.38 | cr2 | http://wiki.xda-developers.com/index.php?pagename=UniversalGPIO |
20:45.03 | cr2 | http://wiki.xda-developers.com/index.php?pagename=UniversalASIC3 |
20:46.25 | cr2 | GPIOB8 , GPIOB12, GPIOD8 - phone reset. |
20:46.29 | cr2 | on asic3 |
20:46.31 | cr2 | on pxa: |
20:47.00 | Kevin2 | cr2 / ph5 what does "pd 0x40f0001c 4" report? |
20:47.00 | cr2 | GPIO 19 - usb host something |
20:48.35 | cr2 | GPIO 27, GPIO 98, GPIO 109, GPIO 110, GPIO 112 - more or less understood. |
20:49.06 | pH5 | Kevin2: PCFR? 0x00001071 |
20:50.21 | cr2 | GPIOB0, GPIOB3 - somthing mysterious is going on there. b0 is some kind of "ready" signal, b3 - has some fast changes when logging into the network. |
20:51.00 | cr2 | so 9 +2 gpios on universal ;-) and ffuart + 2 serial usb host endpoints. |
20:51.05 | Kevin2 | ph5: Yes - PCFR has an override for gpio pins. So you have both "nRESET_GPIO" and 'PWR_SCL' / 'PWR_SDA' mapped. |
20:51.53 | cr2 | i'll look at PCFR. it should be in some "dump pxa27x*" output, btw. |
20:52.03 | pH5 | Kevin2: I don't see any i2c traffic with the trace from http://pastebin.ca/159143 when I un/plug |
20:52.06 | cr2 | pxa27xpower maybe |
20:53.52 | pH5 | Kevin2: only gpio 13, but that's the irq line of the cpld iirc |
20:54.45 | Kevin2 | Hrmm. Okay. |
20:54.54 | Kevin2 | I see the following on plug in: |
20:54.56 | Kevin2 | 000.357422 9058ce28: e5c34008 strb r4, [r3, #8] # r4=00000028 r3=aef00180 |
20:54.56 | Kevin2 | 000.357448 9058cea8: e5c3a008 strb sl, [r3, #8] # r10=0000001a r3=aef00180 |
20:54.57 | cr2 | battery empty. red led on. |
20:55.11 | Kevin2 | On unplug I see: |
20:55.15 | Kevin2 | 000.923275 9058ce28: e5c34008 strb r4, [r3, #8] # r4=00000028 r3=aef00180 |
20:55.15 | Kevin2 | 000.923302 9058cea8: e5c3a008 strb sl, [r3, #8] # r10=0000000b r3=aef00180 |
20:56.03 | pH5 | cr2, Kevin2: should I submit this haret patch: http://en.pastebin.ca/173343 |
20:56.51 | Kevin2 | I'd definitely find it useful. |
20:57.05 | Kevin2 | cr2: BTW, I have a haret patch at: |
20:57.53 | Kevin2 | svn://www.shadowmite.com/home/svn/ppc6700 as haret/gharet-20060830.patch |
20:58.18 | cr2 | imho, already applied. |
20:58.53 | Kevin2 | Oh. Thanks. |
21:00.16 | cr2 | pH5: can you also make "unlog" or something to switch logging off ? |
21:02.07 | pH5 | cr2: ok |
21:02.47 | *** join/#htc-linux rob_w (n=bob@p213.54.220.74.tisdip.tiscali.de) |
21:03.51 | cr2 | Kevin2: i have also addred haretconsole tools to CVS. |
21:04.29 | Kevin2 | cr2: I just saw that. Thanks! BTW, have you been able to trace your FFUART port like I was able to? |
21:04.37 | pH5 | Kevin2: my gsm cmd is on BTUART, how can I trace this one? |
21:05.02 | Kevin2 | ph5: Do you have the same memory map as universal/apache? |
21:06.38 | cr2 | pH5: change the base address |
21:06.39 | pH5 | Kevin2: yes, so that should be just 0xae200000? |
21:06.57 | cr2 | Kevin2: trying now. |
21:07.37 | rob_w | re |
21:07.38 | cr2 | PCFR is in "dump pxa27xpower" |
21:08.07 | Kevin2 | ph5: Yes. That is the address I would use. |
21:10.18 | cr2 | Kevin2: 1071 too. |
21:10.47 | pH5 | Kevin2: that seemed to work. |
21:12.34 | Kevin2 | cr2: So, GPIO pins 3 and 4 are power management i2c pins regardless of what the gpio settings are at. |
21:13.24 | rob_w | also here it is strange that one gpio is triggered both when the power button is pressed and the ac is connected |
21:14.56 | cr2 | Kevin2: i get only RTC0 and TMR1 interrupts. nothing more. |
21:15.34 | cr2 | where is the ffuart trace link ? |
21:15.48 | Kevin2 | Okay. Thanks for looking into it. |
21:16.01 | Kevin2 | http://www.handhelds.org/moin/moin.cgi/ApachePhoneTrace |
21:16.09 | cr2 | thx. |
21:16.18 | rob_w | hmm it is maybe a error in the gpio map on xanadux again |
21:21.47 | pH5 | cr2: http://en.pastebin.ca/173366, ok to commit? |
21:25.44 | cr2 | yes, why should i be against :) |
21:26.26 | cr2 | Kevin2: i've done a 5min 'script' log, will try to decode it now. |
21:29.26 | rob_w | cr2 can you point me to the haret which has powermon sources |
21:30.10 | cr2 | rob_w: haret-gnu subdir in CVS haret/haret-gnu |
21:30.20 | cr2 | it's the only one we are using and working on. |
21:31.07 | cr2 | you may need to make some changes pxa27x -> pxa26x for some parts. |
21:31.34 | rob_w | on xanadux-cvs ? |
21:33.15 | Kevin2 | cr2: Did scanserial.py work for you? |
21:33.23 | cr2 | Kevin2: cool. |
21:33.54 | cr2 | yes. it works, but i don't see anything new, that wince do not log. but it's also good to know. |
21:34.33 | cr2 | AT+GTK* undocumented stuff it also there, with long encoded strings of unknown numbers. |
21:34.53 | cr2 | but it should be some htc sim toolkit weirdness. |
21:34.59 | pH5 | Kevin2: scanserial.py works here, too - I only have to adapt the instruction codes for BTUART |
21:35.01 | cr2 | no $HTC_ stuff. |
21:35.14 | pH5 | 0xe5801000 write, 0xe5901000 read |
21:37.27 | pH5 | read: '\x02\x02\x02\x160\r\x02\x00\x02\x02\x02\x12GSM Version : 1.12.00 G23 Version : 1337.42\x02\x02\x02\x16AT-Command Interpreter ready\r\n' |
21:37.27 | pH5 | read: '\x02' |
21:37.29 | pH5 | :) |
21:38.18 | cr2 | ok. so you have framing. |
21:38.50 | Kevin2 | I've been trying to figure out ways to trace the gpios and the read/writes at the same time. I think it should be possible. |
21:39.00 | cr2 | i do not have framing, but i knew that from the nk.exe disassembly :) |
21:39.20 | cr2 | Kevin2: just wanted to ask about it. |
21:39.52 | Kevin2 | cr2: What's that? |
21:40.08 | pH5 | but I wonder, shouldn't I get this first hello string under linux too, when I listen on ttyS1 and do the GSM reset procedure right? |
21:41.05 | cr2 | Kevin2: himalaya,blueangel,magician use the TI phone chipset, which does not send "raw" AT commands, but encasulates them in frames. |
21:41.36 | cr2 | pH5: you need to pull the right gpios with right timing before you'll get it. |
21:42.10 | cr2 | 000.617349-001.521909 read: '\x00AT-Command Interpreter ready\r\n' |
21:42.10 | cr2 | 001.588414-001.588429 write: 'ATZ\r' |
21:42.37 | cr2 | i can get this messages in linux, but don't get a response to ATZ\r ;-) |
21:43.31 | Kevin2 | cr2: One of my gpio pins seems to change after every transmit. It looks like some kind of "clear to send" gpio. Odd though, because the serial has a CTS already. |
21:44.01 | cr2 | yes. i have something like that too. on asic3 gpio. |
21:45.20 | Kevin2 | It seems like the read/write code is always at the same address. So I'm going to try catching reads/writes by using the instruction tracing features of the chip. That leaves me the memory access tracing functions to watch gpio activity. :-) |
21:46.34 | Kevin2 | Unfortunately, that doesn't help too much with input pins, because it is hard to tell when a read access is just sloppy programming and when it really does control behavior. |
21:47.27 | cr2 | we can try to filter them afterwards. |
21:51.44 | cr2 | pH5: the gomunicator assumes simple x02x16<command>x02x16 framing. your output looks more interesting. |
21:52.34 | cr2 | \x02\x12GSM Version : 1.12.00 G23 Version : 1337.42\x02\x02 |
21:52.55 | cr2 | so it goes to 0x12 channel. |
21:53.43 | cr2 | 0x12 - other gsm trace |
21:53.54 | cr2 | 0x16 - gsm AT commands |
21:53.57 | cr2 | http://www.xs4all.nl/~itsme/projects/xda/serial-protocols.html |
21:58.56 | cr2 | Kevin2: i can see this in the log: |
21:59.00 | cr2 | 002.598342-002.598375 write: 'AT@USBPOWER=1\r' |
21:59.00 | cr2 | 002.598377 irq 22(FFUART) |
21:59.01 | cr2 | 002.604738-002.604750 read: '0\r' |
21:59.01 | cr2 | 002.674312 irq 3(USBh1) |
21:59.01 | cr2 | 002.678370 irq 3(USBh1) |
21:59.01 | cr2 | 002.680880 irq 3(USBh1) |
21:59.51 | Kevin2 | Interesting. What action did you take? I haven't seen that. |
21:59.53 | cr2 | so AT command initializes the Qualcomm chip as USB slave, and then something goes on with pxa usb host. |
22:00.04 | cr2 | it's on startup. |
22:00.13 | cr2 | phone init string. |
22:00.19 | cr2 | includes this command. |
22:00.48 | cr2 | http://wiki.xda-developers.com/index.php?pagename=HTC_GSM |
22:03.56 | Kevin2 | The closest thing I have is: write: 'AT+HTC_ROTKSL=0\r' |
22:04.08 | cr2 | this command is only found on universal. not surprising because it is the only phone with qualcomm chipset. maybe newer htc umts phones like tytn have it too. |
22:04.08 | Kevin2 | which is then followed by USBh1 interrupts. |
22:04.15 | cr2 | ok. |
22:04.29 | cr2 | rotksl ? what can it mean ? |
22:05.50 | Kevin2 | Roll on the ... |
22:06.06 | Kevin2 | I tried googling for it when I first got the trace - but to no avail. |
22:06.30 | cr2 | i think you are the only person who is working on linux cdma phone. |
22:06.54 | cr2 | btw, there was a report that gomunicator worked on a cdma blueangel. |
22:07.32 | cr2 | i don't know what baseband chipset they use. (boardid=0x4) |
22:07.41 | Kevin2 | I think I've basically figured out all the hardware on the phone. I need to nail down the rechange disable sequence. Then the only thing left is the phone. |
22:08.05 | Kevin2 | The phone could be difficult.. But the basic call / receive stuff seems to be straight-forward. |
22:09.42 | cr2 | i'd like to see the usbh log first, before going deep in the gpio details. |
22:10.31 | Kevin2 | Not much info on harrier (cdma blue angel) around. |
22:11.15 | cr2 | afaik, it just worked. so it should use the same gpio/comm protocol. |
22:13.02 | cr2 | pH5: if i'll trace the btuart, i'll grab the bluetooth init stuff !? |
22:13.11 | cr2 | Kevin2: where is your bt ? |
22:13.50 | Kevin2 | bluetooth is on the BTUART. I was able to do some basic pings under linux. Even with the high speed firmware. |
22:14.12 | Kevin2 | I don't know much about bt so I didn't do extensive tests, but it appears to work. |
22:15.55 | cr2 | it works here too, but nothing is known about the "audio" firmware control for the headset. |
22:17.54 | Kevin2 | It looks to me like the phone talks directly to the sound codec. I wonder if the BT headset also takes some shortcut. |
22:20.48 | cr2 | yes. there is a PCM input/output on the BT chipset, so it talks to the phone directly. |
22:21.18 | cr2 | i have seen a htc schematic picture somewheres. |
22:23.12 | Kevin2 | Well, you should be able to trace reads/writes to the BTUART and to the I2C to see what is going on. |
22:23.55 | cr2 | I2C ? |
22:24.47 | Kevin2 | The sound codec is attached to the i2c port. |
22:25.01 | Kevin2 | set trace 0xae301688 |
22:25.14 | cr2 | ah. ok. |
22:26.08 | pH5 | cr2: magician's bluetooth isn't connected to btuart, but to usb host - this already works here |
22:27.05 | cr2 | pH5: yes, but if you have modified the .py script for btuart tracing, it can be reused :) |
22:27.20 | pH5 | no idea about the headset shortcut here, I just know it exists from the wavedev.dll code |
22:29.17 | cr2 | the PCM routing on magician (and himalaya/blueangel) is a mystery for me. |
22:30.15 | pH5 | ack. I know that the GPIOs on the CPLD chip are involved, but that's not all.. |
22:30.18 | cr2 | it sends over i2s and receives over ssp, no idea where the bluetooth audio is connected and how it is multiplexed. |
22:31.17 | Kevin2 | cr2: You have ssp involved in audio/bt stuff? |
22:31.37 | cr2 | not on the universal. |
22:33.00 | Kevin2 | Oh. Okay. I seem to recall reading that SSP could be used to drive/receive I2S. |
22:34.42 | cr2 | uda1380 can do both. |
22:35.08 | cr2 | we have ak4641 and only i2s is used. |
22:39.02 | Kevin2 | Oh, BTW, I found that the camera chip is attached to the i2c port. It can't be detected with a normal scan, because it is using some derivated i2c protocol. (Tracing i2c and playing with the camera shows activity.) |
22:39.21 | cr2 | ok. |
23:00.12 | cr2 | Kevin2: we need some fresh idea how to trace the usb host endpoints. or maybe trap into the wince usb-serial driver. |
23:09.58 | pH5 | cr2: where should I put the gsm reset code in the linux kernel? I currently only have a module that does the GPIO setting on module_init. |
23:13.49 | cr2 | pH5: clone the bt serial port setup from hx4700 |
23:16.49 | pH5 | cr2: ah, so platform_pxa_serial_funcs it is. thanks. |
23:41.05 | Kevin2 | cr2: Do you think critical info is on the usb port? I was hoping it was just a serial port with a ppp interface.. |
23:46.44 | cr2 | the usb says "vendor specific" protocol: |
23:46.47 | cr2 | http://wiki.xda-developers.com/index.php?pagename=ApacheProgress |
23:47.45 | pH5 | what is the difference between gpio 45 HWRTS and BTRTS mode (alt2 / alt3)? |
23:48.06 | pH5 | the bootloader switches to HWRTS during reset |
23:50.56 | cr2 | HW ? it's pxa26x-specific. |
23:52.24 | Kevin2 | I thought fimbulvetr said he was able to get a serial port active on it. |
23:54.46 | cr2 | Kevin2: you can force-load usbserial, but will it work ? |
23:55.56 | pH5 | that's indeed strange. I'm on pxa272, the dev manual says that alt3 out is SSPSYSCLK3 |
23:59.17 | pH5 | ahh, I read it wrong. that was a bic, not an orr. |