Project

General

Profile

BCM4751 » History » Version 14

Paul Kocialkowski, 11/18/2012 10:54 AM

1 1 Paul Kocialkowski
h1. Broadcom4751GPS
2
3 9 Paul Kocialkowski
h2. Factory image files
4 1 Paul Kocialkowski
5 2 Paul Kocialkowski
The non-free files holding the GPS infos/code are the following:
6 1 Paul Kocialkowski
<pre>
7
/system/vendor/bin/gpsd
8
/system/vendor/lib/hw/gps.s5pc110.so
9
/system/vendor/etc/gps.xml
10
/system/etc/gps.conf
11
</pre>
12
13 9 Paul Kocialkowski
h3. gps.xml parameters 
14
15
We have tried to change some parameters in gps.xml to see how it behaves:
16
17
|_. Parameter |_. Original |_. Changed to |_. Result |
18
| acPortName | /dev/s3c2410_serial1 | /dev/s3c2410_serial42 | The chip wasn't "booted" |
19
| gpioNStdbyPath | /sys/class/sec/gps/GPS_PWR_EN/value | /sys/class/sec/gps/GPS_PWR_EN/value2 | The chip was booted |
20
| gpioNResetPath | /sys/class/sec/gps/GPS_nRST/value | /sys/class/sec/gps/GPS_nRST/value2 | The chip was booted |
21
22
After all, it seems that when the gpsd binary is running without the gps.s5pc110.so library, the chip isn't started (our test utility doesn't work) whereas when the library is running and connects to the socket when it is created by starting gpsd, the chip is booted. 
23
24
gps.s5pc110.so will actually order bootup via the socket, when the gps is requested by the Android framework. When it's not used anymore, it will request poweroff as well.
25
26 1 Paul Kocialkowski
h2. Protocol
27
28 9 Paul Kocialkowski
According to the logs obtained from gpsd, the chip seems to be using the MEIF protocol at first, then a patch is sent and it starts using another protocol, which doesn't seem related to MEIF according to the logs (there are basically no more references to MEIF after uploading the patch). However, as we have no information about what MEIF is (it's a binary proprietary undocumented protocol), these are just guesses.
29
We decided to implement the first protocol under the name MEIF, but it could also be some sort of BCM4751-specific bootloader protocol that is in charge of making the patch upload.
30 1 Paul Kocialkowski
31 9 Paul Kocialkowski
The GPSD component is in charge of translating the second protocl to standard NMEA that is sent to the gps.s5pc110.so lib via the /dev/socket/gps Unix socket, created by GPSD.
32 1 Paul Kocialkowski
33 9 Paul Kocialkowski
h2. Devices
34 1 Paul Kocialkowski
35 9 Paul Kocialkowski
Here is a list of the devices that are known to use the BCM4751 chip:
36 1 Paul Kocialkowski
37 9 Paul Kocialkowski
|_. Device |_. Vendor |_. BCM4751 revision |
38
| Nexus S | Google/Samsung | 4751A1 |
39
| Galaxy S I9000 | Samsung | 4751A2 |
40
| Galaxy Tab P1000 | Samsung | ? |
41 14 Paul Kocialkowski
| Galaxy Tab 8.9 P7300/P7310 | Samsung | 4751A2 |
42 9 Paul Kocialkowski
| Nexus 7 | Google/Asus | ? |
43 1 Paul Kocialkowski
44 9 Paul Kocialkowski
h2. Free software implementation
45 1 Paul Kocialkowski
46 9 Paul Kocialkowski
On January 2012, the work to write a free software implementation that could handle the BCM4751 chip was started.
47
The main target is the Nexus S, even though it should work with few changes on other BCM4751 devices.
48 1 Paul Kocialkowski
49 9 Paul Kocialkowski
The code source is available at: https://gitorious.org/replicant/crespo-gps-utils
50 1 Paul Kocialkowski
51 9 Paul Kocialkowski
h3. Current status
52 1 Paul Kocialkowski
53 9 Paul Kocialkowski
|_. Part |_. Status |_. Comments |
54
| Serial setup | "DONE":https://gitorious.org/replicant/crespo-gps-utils/commit/e4f94e901b9b4c5fef5642ad9580863fc2bfe336 | Magic is: @termios.c_cflag = 0x800018b2;@ |
55
| MEIF parsing | "DONE":https://gitorious.org/replicant/crespo-gps-utils/commit/927c1c92dd092cec8c56351bf663101183f19076 | |
56
| MEIF dispatch | "DONE":https://gitorious.org/replicant/crespo-gps-utils/commit/f952dde8f3a29634be1c8fa19b8eed367c1ad878 | |
57
| MEIF patch upload | "DONE":https://gitorious.org/replicant/crespo-gps-utils/commit/9a5827778189b7e0f91879430a4e160567ee6bbd | Nexus S and Galaxy S patches differ |
58 1 Paul Kocialkowski
59 9 Paul Kocialkowski
h3. Utilities
60
61
|_. Name |_. Task |_. Arguments |
62
| bcm4751_gpsd | Main utility, boots the chip, send the patch, switch protocol | None |
63
| bcm4751_test | Deprecated utility, can be used for poweroff | @stop@: poweroff the chip |
64
| bcm4751_hal | Acts as the framework: permits to trace gps.s5pc110.so | None |
65
| bcm4751_daemon | Acts as (a fake) gpsd to the lib | None |
66
| bcm4751_lib | Acts as (a fake) lib to gpsd | None |
67
68
h3. BCM4751 gpsd
69
70
This is where MEIF is implemented. It currently does the following:
71
* Serial setup
72
* Autobaud
73
* MEIF reader loop
74
* MEIF parsing
75
* MEIF dispatch
76
* MEIF patch upload
77
* Protocol switch (sends unknown bytes in the second protocol to get a response)
78
* Response dump
79
80
Sample output log:
81 1 Paul Kocialkowski
<pre>
82 9 Paul Kocialkowski
Turning the GPS on...
83
Opening the GPS serial...
84
Sending autobaud...
85
Read 17 bytes
86
Read 32 bytes
87
MEIF message: MEIF_STATE_REPORT_MSG with 18 bytes of data:
88
[0000]   01 00 00 00 01 00 00 00   00 00 00 00 00 00 00 00   ........ ........
89
[0010]   1A 00                                               ..
90
Got a STATE_REPORT message
91 1 Paul Kocialkowski
92 9 Paul Kocialkowski
Read 23 bytes
93
Read 32 bytes
94
Read 16 bytes
95
Read 7 bytes
96
MEIF message: MEIF_CONFIG_VALUES_MSG with 70 bytes of data:
97
[0000]   02 00 01 00 01 00 40 00   01 00 02 00 00 00 00 00   ........ ........
98
[0010]   01 00 02 00 00 00 00 00   00 00 06 00 81 11 00 09   ........ ........
99
[0020]   07 07 D9 07 42 52 4F 41   44 43 4F 4D 00 00 00 00   ....BROA DCOM....
100
[0030]   00 00 00 00 34 37 35 31   41 31 00 00 00 00 00 00   ....4751 A1......
101
[0040]   00 00 00 00 B3 05                                   ......
102
Got config values:
103
	vendor: BROADCOM
104
	product: 4751A1
105
106
Sending the first part of the patch...
107
Sending 2054 bytes!
108
MEIF message: MEIF_SEND_PATCH_MSG with 2046 bytes of data:
109
110
Read 14 bytes
111
MEIF message: MEIF_NACK_MSG with 6 bytes of data:
112
[0000]   03 00 03 00 0F 00                                   ......
113
Got a NACK message
114
Reason is: MEIF_NACK_GARBAGE_RECEIVED
115
116
Read 12 bytes
117
MEIF message: MEIF_ACK_MSG with 4 bytes of data:
118
[0000]   04 01 0B 00                                         ....
119
Got an ACK message
120
121
Sending the second part of the patch...
122
Sending 706 bytes!
123
MEIF message: MEIF_SEND_PATCH_MSG with 698 bytes of data:
124
125
Read 12 bytes
126
MEIF message: MEIF_ACK_MSG with 4 bytes of data:
127
[0000]   05 02 0D 00                                         ....
128
Got an ACK message
129
130
Ready to switch protocol!
131
Sending unknown bytes!
132
Read 12 bytes:
133
[0000]   FE 00 FD 40 00 00 F1 B1   12 20 67 FC               ........ ..g.
134
</pre>
135 1 Paul Kocialkowski
136 10 Paul Kocialkowski
h3. BCM4751 patch
137
138
In order to use the same protocol as the non-free gpsd, a patch needs to be sent. It is hardcoded in the non-free gpsd binary.
139
Note that we don't know what that patch exactly is nor what it does. In any case, it must be considered as the propriety of Broadcom (or Samsung maybe) and falls under the non-free gpsd license.
140
141
Here are notes on how to extract the patch from various non-free gpsd binaries:
142 13 Paul Kocialkowski
|_. Device |_. Source |_. GPSD MD5 |_. Offset |_. Length |_. dd command |
143
| Nexus S | CM 9.0.0 | 4a6c0027e530b5b8a346153a355ef8e3 | 0x15DDEA | 2738 bytes | dd skip=1433066 count=2738 if=gpsd of=bcm4751a1.fw bs=1 |
144
| Galaxy S | CM 9.1.0 | 4a6c0027e530b5b8a346153a355ef8e3 | 0x15E89E | 6406 bytes | dd skip=1435806 count=6406 if=gpsd of=bcm4751a2.fw bs=1 |
145 10 Paul Kocialkowski
146 13 Paul Kocialkowski
The @bcm4751_gpsd@ utility will attempt to read the patch from @/data/bcm4751a1.fw@ or @/data/bcm4751a2.fw@
147 10 Paul Kocialkowski
148 1 Paul Kocialkowski
h3. Random notes with the new utility program
149
150
<pre>
151
echo -n "ab" > /dev/s3c2410_serial1
152
</pre>
153
produces:
154
<pre>
155
Read 14 bytes:
156
[0000]   49 27 01 00 10 00 40 00   07 00 58 00 49 D0         I....... ..X.I.
157
Read 14 bytes:
158
[0000]   49 27 01 00 10 00 41 00   07 00 59 00 49 D0         I.....A. ..Y.I.
159
</pre>
160
* The only thing that changes seem to be the 40->41 and the 58->59, so theses seem to be something like a sequence number....