Project

General

Profile

BCM4751 » History » Version 29

Jens Korte, 06/07/2017 03:52 PM
added S3 I9300 to the table of devices

1 24 Paul Kocialkowski
h1. BCM4751
2 1 Paul Kocialkowski
3 28 Wolfgang Wiedmeyer
corresponding feature request: #1473
4
5 9 Paul Kocialkowski
h2. Factory image files
6 1 Paul Kocialkowski
7 2 Paul Kocialkowski
The non-free files holding the GPS infos/code are the following:
8 1 Paul Kocialkowski
<pre>
9
/system/vendor/bin/gpsd
10
/system/vendor/lib/hw/gps.s5pc110.so
11
/system/vendor/etc/gps.xml
12
/system/etc/gps.conf
13
</pre>
14
15 9 Paul Kocialkowski
h3. gps.xml parameters 
16
17
We have tried to change some parameters in gps.xml to see how it behaves:
18
19
|_. Parameter |_. Original |_. Changed to |_. Result |
20
| acPortName | /dev/s3c2410_serial1 | /dev/s3c2410_serial42 | The chip wasn't "booted" |
21
| gpioNStdbyPath | /sys/class/sec/gps/GPS_PWR_EN/value | /sys/class/sec/gps/GPS_PWR_EN/value2 | The chip was booted |
22
| gpioNResetPath | /sys/class/sec/gps/GPS_nRST/value | /sys/class/sec/gps/GPS_nRST/value2 | The chip was booted |
23
24
After all, it seems that when the gpsd binary is running without the gps.s5pc110.so library, the chip isn't started (our test utility doesn't work) whereas when the library is running and connects to the socket when it is created by starting gpsd, the chip is booted. 
25
26
gps.s5pc110.so will actually order bootup via the socket, when the gps is requested by the Android framework. When it's not used anymore, it will request poweroff as well.
27
28 1 Paul Kocialkowski
h2. Protocol
29
30 9 Paul Kocialkowski
According to the logs obtained from gpsd, the chip seems to be using the MEIF protocol at first, then a patch is sent and it starts using another protocol, which doesn't seem related to MEIF according to the logs (there are basically no more references to MEIF after uploading the patch). However, as we have no information about what MEIF is (it's a binary proprietary undocumented protocol), these are just guesses.
31
We decided to implement the first protocol under the name MEIF, but it could also be some sort of BCM4751-specific bootloader protocol that is in charge of making the patch upload.
32 1 Paul Kocialkowski
33 9 Paul Kocialkowski
The GPSD component is in charge of translating the second protocl to standard NMEA that is sent to the gps.s5pc110.so lib via the /dev/socket/gps Unix socket, created by GPSD.
34 1 Paul Kocialkowski
35 9 Paul Kocialkowski
h2. Devices
36 1 Paul Kocialkowski
37 9 Paul Kocialkowski
Here is a list of the devices that are known to use the BCM4751 chip:
38 1 Paul Kocialkowski
39 9 Paul Kocialkowski
|_. Device |_. Vendor |_. BCM4751 revision |
40 16 Denis 'GNUtoo' Carikli
| Nexus S | Google/Samsung | 4751A1 or 4751A2 |
41 9 Paul Kocialkowski
| Galaxy S I9000 | Samsung | 4751A2 |
42 29 Jens Korte
| Galaxy S 3 I9300 | Samsung | 47511A0  |
43 9 Paul Kocialkowski
| Galaxy Tab P1000 | Samsung | ? |
44 14 Paul Kocialkowski
| Galaxy Tab 8.9 P7300/P7310 | Samsung | 4751A2 |
45 9 Paul Kocialkowski
| Nexus 7 | Google/Asus | ? |
46 1 Paul Kocialkowski
47 15 Paul Kocialkowski
The bCM4751 chip exists under the following revisions: 4751A0, 4751A1, 4751A2, 47511A0
48
49 9 Paul Kocialkowski
h2. Free software implementation
50 1 Paul Kocialkowski
51 9 Paul Kocialkowski
On January 2012, the work to write a free software implementation that could handle the BCM4751 chip was started.
52
The main target is the Nexus S, even though it should work with few changes on other BCM4751 devices.
53 1 Paul Kocialkowski
54 26 Wolfgang Wiedmeyer
The source code is available at: https://git.replicant.us/PaulK/bcm4751/
55 1 Paul Kocialkowski
56 9 Paul Kocialkowski
h3. Current status
57 1 Paul Kocialkowski
58 9 Paul Kocialkowski
|_. Part |_. Status |_. Comments |
59 27 Wolfgang Wiedmeyer
| Serial setup | "DONE":https://git.replicant.us/PaulK/bcm4751/commit/e4f94e901b9b4c5fef5642ad9580863fc2bfe336 | Magic is: @termios.c_cflag = 0x800018b2;@ |
60
| MEIF parsing | "DONE":https://git.replicant.us/PaulK/bcm4751/commit/927c1c92dd092cec8c56351bf663101183f19076 | |
61
| MEIF dispatch | "DONE":https://git.replicant.us/PaulK/bcm4751/commit/f952dde8f3a29634be1c8fa19b8eed367c1ad878 | |
62
| MEIF patch upload | "DONE":https://git.replicant.us/PaulK/bcm4751/commit/9a5827778189b7e0f91879430a4e160567ee6bbd | Nexus S and Galaxy S patches differ |
63 1 Paul Kocialkowski
64 9 Paul Kocialkowski
h3. Utilities
65
66
|_. Name |_. Task |_. Arguments |
67
| bcm4751_gpsd | Main utility, boots the chip, send the patch, switch protocol | None |
68
| bcm4751_test | Deprecated utility, can be used for poweroff | @stop@: poweroff the chip |
69
| bcm4751_hal | Acts as the framework: permits to trace gps.s5pc110.so | None |
70
| bcm4751_daemon | Acts as (a fake) gpsd to the lib | None |
71
| bcm4751_lib | Acts as (a fake) lib to gpsd | None |
72
73
h3. BCM4751 gpsd
74
75
This is where MEIF is implemented. It currently does the following:
76
* Serial setup
77
* Autobaud
78
* MEIF reader loop
79
* MEIF parsing
80
* MEIF dispatch
81
* MEIF patch upload
82
* Protocol switch (sends unknown bytes in the second protocol to get a response)
83
* Response dump
84
85
Sample output log:
86 1 Paul Kocialkowski
<pre>
87 9 Paul Kocialkowski
Turning the GPS on...
88
Opening the GPS serial...
89
Sending autobaud...
90
Read 17 bytes
91
Read 32 bytes
92
MEIF message: MEIF_STATE_REPORT_MSG with 18 bytes of data:
93
[0000]   01 00 00 00 01 00 00 00   00 00 00 00 00 00 00 00   ........ ........
94
[0010]   1A 00                                               ..
95
Got a STATE_REPORT message
96 1 Paul Kocialkowski
97 9 Paul Kocialkowski
Read 23 bytes
98
Read 32 bytes
99
Read 16 bytes
100
Read 7 bytes
101
MEIF message: MEIF_CONFIG_VALUES_MSG with 70 bytes of data:
102
[0000]   02 00 01 00 01 00 40 00   01 00 02 00 00 00 00 00   ........ ........
103
[0010]   01 00 02 00 00 00 00 00   00 00 06 00 81 11 00 09   ........ ........
104
[0020]   07 07 D9 07 42 52 4F 41   44 43 4F 4D 00 00 00 00   ....BROA DCOM....
105
[0030]   00 00 00 00 34 37 35 31   41 31 00 00 00 00 00 00   ....4751 A1......
106
[0040]   00 00 00 00 B3 05                                   ......
107
Got config values:
108
	vendor: BROADCOM
109
	product: 4751A1
110
111
Sending the first part of the patch...
112
Sending 2054 bytes!
113
MEIF message: MEIF_SEND_PATCH_MSG with 2046 bytes of data:
114
115
Read 14 bytes
116
MEIF message: MEIF_NACK_MSG with 6 bytes of data:
117
[0000]   03 00 03 00 0F 00                                   ......
118
Got a NACK message
119
Reason is: MEIF_NACK_GARBAGE_RECEIVED
120
121
Read 12 bytes
122
MEIF message: MEIF_ACK_MSG with 4 bytes of data:
123
[0000]   04 01 0B 00                                         ....
124
Got an ACK message
125
126
Sending the second part of the patch...
127
Sending 706 bytes!
128
MEIF message: MEIF_SEND_PATCH_MSG with 698 bytes of data:
129
130
Read 12 bytes
131
MEIF message: MEIF_ACK_MSG with 4 bytes of data:
132
[0000]   05 02 0D 00                                         ....
133
Got an ACK message
134
135
Ready to switch protocol!
136
Sending unknown bytes!
137
Read 12 bytes:
138
[0000]   FE 00 FD 40 00 00 F1 B1   12 20 67 FC               ........ ..g.
139
</pre>
140 1 Paul Kocialkowski
141 10 Paul Kocialkowski
h3. BCM4751 patch
142
143
In order to use the same protocol as the non-free gpsd, a patch needs to be sent. It is hardcoded in the non-free gpsd binary.
144
Note that we don't know what that patch exactly is nor what it does. In any case, it must be considered as the propriety of Broadcom (or Samsung maybe) and falls under the non-free gpsd license.
145
146
Here are notes on how to extract the patch from various non-free gpsd binaries:
147 13 Paul Kocialkowski
|_. Device |_. Source |_. GPSD MD5 |_. Offset |_. Length |_. dd command |
148
| Nexus S | CM 9.0.0 | 4a6c0027e530b5b8a346153a355ef8e3 | 0x15DDEA | 2738 bytes | dd skip=1433066 count=2738 if=gpsd of=bcm4751a1.fw bs=1 |
149
| Galaxy S | CM 9.1.0 | 4a6c0027e530b5b8a346153a355ef8e3 | 0x15E89E | 6406 bytes | dd skip=1435806 count=6406 if=gpsd of=bcm4751a2.fw bs=1 |
150 10 Paul Kocialkowski
151 13 Paul Kocialkowski
The @bcm4751_gpsd@ utility will attempt to read the patch from @/data/bcm4751a1.fw@ or @/data/bcm4751a2.fw@
152 10 Paul Kocialkowski
153 18 Denis 'GNUtoo' Carikli
h4. Post protocol switching
154
155 20 Denis 'GNUtoo' Carikli
Sending this string:
156
"\xfe\x00\xfd\x6f\x3a\x01\x00\x00\x00\x00\x34\xfc"
157
many times makes some other string appear on the serial port...
158 17 Denis 'GNUtoo' Carikli
<pre>
159 20 Denis 'GNUtoo' Carikli
fe 00 fd 0f ff 07 06 00 00 01 54 fc
160
fe 00 fd 0f ff 08 06 00 00 01 1c fc
161
</pre>
162
Here's the decoding of the first bytes:
163
<pre>
164 17 Denis 'GNUtoo' Carikli
ff00 = 8bytes
165
fe00 = 12bytes
166
fe01 = 16bytes
167
fe02 = 20bytes
168
fe03 = 24bytes
169
fe04 = 28bytes
170
fe05 = 32bytes
171
fe06 = 36bytes
172
fe07 = 40bytes
173
</pre>
174 20 Denis 'GNUtoo' Carikli
175 22 Denis 'GNUtoo' Carikli
 * fc seem an end marker and 54/c1 a checksum....
176 23 Denis 'GNUtoo' Carikli
 * 07,08 seem a sequence number, if I do it right after booting the chip it starts with 01
177 21 Denis 'GNUtoo' Carikli
178
h5. howto
179
run that python program:
180
<pre>
181
print "\xfe\x00\xfd\x6f\x3a\x01\x00\x00\x00\x00\x34\xfc"
182
</pre>
183
like that
184 22 Denis 'GNUtoo' Carikli
<pre>python foo.py > serial.txt</pre>
185 21 Denis 'GNUtoo' Carikli
<pre>adb push serial.txt /sdcard/</pre>
186
on target:
187
<pre>hexdump -C /dev/s3c2410_serial1</pre>
188
<pre>cat /sdcard/serial.txt > /dev/s3c2410_serial1</pre>