BCM4751 » History » Version 31
Wolfgang Wiedmeyer, 08/28/2017 05:10 PM
update git.replicant.us links
1 | 24 | Paul Kocialkowski | h1. BCM4751 |
---|---|---|---|
2 | 1 | Paul Kocialkowski | |
3 | 28 | Wolfgang Wiedmeyer | corresponding feature request: #1473 |
4 | |||
5 | 9 | Paul Kocialkowski | h2. Factory image files |
6 | 1 | Paul Kocialkowski | |
7 | 2 | Paul Kocialkowski | The non-free files holding the GPS infos/code are the following: |
8 | 1 | Paul Kocialkowski | <pre> |
9 | /system/vendor/bin/gpsd |
||
10 | /system/vendor/lib/hw/gps.s5pc110.so |
||
11 | /system/vendor/etc/gps.xml |
||
12 | /system/etc/gps.conf |
||
13 | </pre> |
||
14 | |||
15 | 9 | Paul Kocialkowski | h3. gps.xml parameters |
16 | |||
17 | We have tried to change some parameters in gps.xml to see how it behaves: |
||
18 | |||
19 | |_. Parameter |_. Original |_. Changed to |_. Result | |
||
20 | | acPortName | /dev/s3c2410_serial1 | /dev/s3c2410_serial42 | The chip wasn't "booted" | |
||
21 | | gpioNStdbyPath | /sys/class/sec/gps/GPS_PWR_EN/value | /sys/class/sec/gps/GPS_PWR_EN/value2 | The chip was booted | |
||
22 | | gpioNResetPath | /sys/class/sec/gps/GPS_nRST/value | /sys/class/sec/gps/GPS_nRST/value2 | The chip was booted | |
||
23 | |||
24 | After all, it seems that when the gpsd binary is running without the gps.s5pc110.so library, the chip isn't started (our test utility doesn't work) whereas when the library is running and connects to the socket when it is created by starting gpsd, the chip is booted. |
||
25 | |||
26 | gps.s5pc110.so will actually order bootup via the socket, when the gps is requested by the Android framework. When it's not used anymore, it will request poweroff as well. |
||
27 | |||
28 | 1 | Paul Kocialkowski | h2. Protocol |
29 | |||
30 | 9 | Paul Kocialkowski | According to the logs obtained from gpsd, the chip seems to be using the MEIF protocol at first, then a patch is sent and it starts using another protocol, which doesn't seem related to MEIF according to the logs (there are basically no more references to MEIF after uploading the patch). However, as we have no information about what MEIF is (it's a binary proprietary undocumented protocol), these are just guesses. |
31 | We decided to implement the first protocol under the name MEIF, but it could also be some sort of BCM4751-specific bootloader protocol that is in charge of making the patch upload. |
||
32 | 1 | Paul Kocialkowski | |
33 | 9 | Paul Kocialkowski | The GPSD component is in charge of translating the second protocl to standard NMEA that is sent to the gps.s5pc110.so lib via the /dev/socket/gps Unix socket, created by GPSD. |
34 | 1 | Paul Kocialkowski | |
35 | 9 | Paul Kocialkowski | h2. Devices |
36 | 1 | Paul Kocialkowski | |
37 | 9 | Paul Kocialkowski | Here is a list of the devices that are known to use the BCM4751 chip: |
38 | 1 | Paul Kocialkowski | |
39 | 9 | Paul Kocialkowski | |_. Device |_. Vendor |_. BCM4751 revision | |
40 | 30 | Jens Korte | | [[NexusSI902x|Nexus S]] | Google/Samsung | 4751A1 or 4751A2 | |
41 | | [[GalaxyNoteN7000|Note N 7000]] | Samsung | ? | |
||
42 | | [[GalaxySI9000|Galaxy S I9000]] | Samsung | 4751A2 | |
||
43 | | [[GalaxyS3I9300|Galaxy S 3 I9300]] | Samsung | 47511A0 | |
||
44 | 1 | Paul Kocialkowski | | Galaxy Tab P1000 | Samsung | ? | |
45 | 14 | Paul Kocialkowski | | Galaxy Tab 8.9 P7300/P7310 | Samsung | 4751A2 | |
46 | 9 | Paul Kocialkowski | | Nexus 7 | Google/Asus | ? | |
47 | 1 | Paul Kocialkowski | |
48 | 30 | Jens Korte | The BCM4751 chip exists under the following revisions: 4751A0, 4751A1, 4751A2, 47511A0 |
49 | 15 | Paul Kocialkowski | |
50 | 9 | Paul Kocialkowski | h2. Free software implementation |
51 | 1 | Paul Kocialkowski | |
52 | 9 | Paul Kocialkowski | On January 2012, the work to write a free software implementation that could handle the BCM4751 chip was started. |
53 | The main target is the Nexus S, even though it should work with few changes on other BCM4751 devices. |
||
54 | 1 | Paul Kocialkowski | |
55 | 31 | Wolfgang Wiedmeyer | The source code is available at: https://git.replicant.us/contrib/PaulK/bcm4751/ |
56 | 1 | Paul Kocialkowski | |
57 | 9 | Paul Kocialkowski | h3. Current status |
58 | 1 | Paul Kocialkowski | |
59 | 9 | Paul Kocialkowski | |_. Part |_. Status |_. Comments | |
60 | 31 | Wolfgang Wiedmeyer | | Serial setup | "DONE":https://git.replicant.us/contrib/PaulK/bcm4751/commit/?id=e4f94e901b9b4c5fef5642ad9580863fc2bfe336 | Magic is: @termios.c_cflag = 0x800018b2;@ | |
61 | | MEIF parsing | "DONE":https://git.replicant.us/contrib/PaulK/bcm4751/commit/?id=927c1c92dd092cec8c56351bf663101183f19076 | | |
||
62 | | MEIF dispatch | "DONE":https://git.replicant.us/contrib/PaulK/bcm4751/commit/?id=f952dde8f3a29634be1c8fa19b8eed367c1ad878 | | |
||
63 | | MEIF patch upload | "DONE":https://git.replicant.us/contrib/PaulK/bcm4751/commit/?id=9a5827778189b7e0f91879430a4e160567ee6bbd | Nexus S and Galaxy S patches differ | |
||
64 | 1 | Paul Kocialkowski | |
65 | 9 | Paul Kocialkowski | h3. Utilities |
66 | |||
67 | |_. Name |_. Task |_. Arguments | |
||
68 | | bcm4751_gpsd | Main utility, boots the chip, send the patch, switch protocol | None | |
||
69 | | bcm4751_test | Deprecated utility, can be used for poweroff | @stop@: poweroff the chip | |
||
70 | | bcm4751_hal | Acts as the framework: permits to trace gps.s5pc110.so | None | |
||
71 | | bcm4751_daemon | Acts as (a fake) gpsd to the lib | None | |
||
72 | | bcm4751_lib | Acts as (a fake) lib to gpsd | None | |
||
73 | |||
74 | h3. BCM4751 gpsd |
||
75 | |||
76 | This is where MEIF is implemented. It currently does the following: |
||
77 | * Serial setup |
||
78 | * Autobaud |
||
79 | * MEIF reader loop |
||
80 | * MEIF parsing |
||
81 | * MEIF dispatch |
||
82 | * MEIF patch upload |
||
83 | * Protocol switch (sends unknown bytes in the second protocol to get a response) |
||
84 | * Response dump |
||
85 | |||
86 | Sample output log: |
||
87 | 1 | Paul Kocialkowski | <pre> |
88 | 9 | Paul Kocialkowski | Turning the GPS on... |
89 | Opening the GPS serial... |
||
90 | Sending autobaud... |
||
91 | Read 17 bytes |
||
92 | Read 32 bytes |
||
93 | MEIF message: MEIF_STATE_REPORT_MSG with 18 bytes of data: |
||
94 | [0000] 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
95 | [0010] 1A 00 .. |
||
96 | Got a STATE_REPORT message |
||
97 | 1 | Paul Kocialkowski | |
98 | 9 | Paul Kocialkowski | Read 23 bytes |
99 | Read 32 bytes |
||
100 | Read 16 bytes |
||
101 | Read 7 bytes |
||
102 | MEIF message: MEIF_CONFIG_VALUES_MSG with 70 bytes of data: |
||
103 | [0000] 02 00 01 00 01 00 40 00 01 00 02 00 00 00 00 00 ........ ........ |
||
104 | [0010] 01 00 02 00 00 00 00 00 00 00 06 00 81 11 00 09 ........ ........ |
||
105 | [0020] 07 07 D9 07 42 52 4F 41 44 43 4F 4D 00 00 00 00 ....BROA DCOM.... |
||
106 | [0030] 00 00 00 00 34 37 35 31 41 31 00 00 00 00 00 00 ....4751 A1...... |
||
107 | [0040] 00 00 00 00 B3 05 ...... |
||
108 | Got config values: |
||
109 | vendor: BROADCOM |
||
110 | product: 4751A1 |
||
111 | |||
112 | Sending the first part of the patch... |
||
113 | Sending 2054 bytes! |
||
114 | MEIF message: MEIF_SEND_PATCH_MSG with 2046 bytes of data: |
||
115 | |||
116 | Read 14 bytes |
||
117 | MEIF message: MEIF_NACK_MSG with 6 bytes of data: |
||
118 | [0000] 03 00 03 00 0F 00 ...... |
||
119 | Got a NACK message |
||
120 | Reason is: MEIF_NACK_GARBAGE_RECEIVED |
||
121 | |||
122 | Read 12 bytes |
||
123 | MEIF message: MEIF_ACK_MSG with 4 bytes of data: |
||
124 | [0000] 04 01 0B 00 .... |
||
125 | Got an ACK message |
||
126 | |||
127 | Sending the second part of the patch... |
||
128 | Sending 706 bytes! |
||
129 | MEIF message: MEIF_SEND_PATCH_MSG with 698 bytes of data: |
||
130 | |||
131 | Read 12 bytes |
||
132 | MEIF message: MEIF_ACK_MSG with 4 bytes of data: |
||
133 | [0000] 05 02 0D 00 .... |
||
134 | Got an ACK message |
||
135 | |||
136 | Ready to switch protocol! |
||
137 | Sending unknown bytes! |
||
138 | Read 12 bytes: |
||
139 | [0000] FE 00 FD 40 00 00 F1 B1 12 20 67 FC ........ ..g. |
||
140 | </pre> |
||
141 | 1 | Paul Kocialkowski | |
142 | 10 | Paul Kocialkowski | h3. BCM4751 patch |
143 | |||
144 | In order to use the same protocol as the non-free gpsd, a patch needs to be sent. It is hardcoded in the non-free gpsd binary. |
||
145 | Note that we don't know what that patch exactly is nor what it does. In any case, it must be considered as the propriety of Broadcom (or Samsung maybe) and falls under the non-free gpsd license. |
||
146 | |||
147 | Here are notes on how to extract the patch from various non-free gpsd binaries: |
||
148 | 13 | Paul Kocialkowski | |_. Device |_. Source |_. GPSD MD5 |_. Offset |_. Length |_. dd command | |
149 | | Nexus S | CM 9.0.0 | 4a6c0027e530b5b8a346153a355ef8e3 | 0x15DDEA | 2738 bytes | dd skip=1433066 count=2738 if=gpsd of=bcm4751a1.fw bs=1 | |
||
150 | | Galaxy S | CM 9.1.0 | 4a6c0027e530b5b8a346153a355ef8e3 | 0x15E89E | 6406 bytes | dd skip=1435806 count=6406 if=gpsd of=bcm4751a2.fw bs=1 | |
||
151 | 10 | Paul Kocialkowski | |
152 | 13 | Paul Kocialkowski | The @bcm4751_gpsd@ utility will attempt to read the patch from @/data/bcm4751a1.fw@ or @/data/bcm4751a2.fw@ |
153 | 10 | Paul Kocialkowski | |
154 | 18 | Denis 'GNUtoo' Carikli | h4. Post protocol switching |
155 | |||
156 | 20 | Denis 'GNUtoo' Carikli | Sending this string: |
157 | "\xfe\x00\xfd\x6f\x3a\x01\x00\x00\x00\x00\x34\xfc" |
||
158 | many times makes some other string appear on the serial port... |
||
159 | 17 | Denis 'GNUtoo' Carikli | <pre> |
160 | 20 | Denis 'GNUtoo' Carikli | fe 00 fd 0f ff 07 06 00 00 01 54 fc |
161 | fe 00 fd 0f ff 08 06 00 00 01 1c fc |
||
162 | </pre> |
||
163 | Here's the decoding of the first bytes: |
||
164 | <pre> |
||
165 | 17 | Denis 'GNUtoo' Carikli | ff00 = 8bytes |
166 | fe00 = 12bytes |
||
167 | fe01 = 16bytes |
||
168 | fe02 = 20bytes |
||
169 | fe03 = 24bytes |
||
170 | fe04 = 28bytes |
||
171 | fe05 = 32bytes |
||
172 | fe06 = 36bytes |
||
173 | fe07 = 40bytes |
||
174 | </pre> |
||
175 | 20 | Denis 'GNUtoo' Carikli | |
176 | 22 | Denis 'GNUtoo' Carikli | * fc seem an end marker and 54/c1 a checksum.... |
177 | 23 | Denis 'GNUtoo' Carikli | * 07,08 seem a sequence number, if I do it right after booting the chip it starts with 01 |
178 | 21 | Denis 'GNUtoo' Carikli | |
179 | h5. howto |
||
180 | run that python program: |
||
181 | <pre> |
||
182 | print "\xfe\x00\xfd\x6f\x3a\x01\x00\x00\x00\x00\x34\xfc" |
||
183 | </pre> |
||
184 | like that |
||
185 | 22 | Denis 'GNUtoo' Carikli | <pre>python foo.py > serial.txt</pre> |
186 | 21 | Denis 'GNUtoo' Carikli | <pre>adb push serial.txt /sdcard/</pre> |
187 | on target: |
||
188 | <pre>hexdump -C /dev/s3c2410_serial1</pre> |
||
189 | <pre>cat /sdcard/serial.txt > /dev/s3c2410_serial1</pre> |