Work with a poorly documented chinese processor + several questions - Page 1
Forum section: electronics / projects

author: soFPG
author_rank: Frequent Contributor
timestamp: November 02, 2019, 07:53:51 pm
content: First and foremost I want to say that I am doing this as a hobby, so fun and learning by doing is the main goal of this project. I don't care if it seems possible or not, at least I want to try it.But what is the project? I basically want to step out of the microcontroller world and work with a "real" processor, external RAM, external Flash etc. I know there are several microcontrollers from Atmel / STM which have broken out address - and databus...but I want to go a different way!A different way means to work with a cheap 16-year old GSM baseband processor from Mediatek: the MT6205B. It features a 26MHz 32-bit ARM7TDMI CPU.What I have at the moment is 176 pages of datasheet and a reference schematic for a "simple" GSM phone. But I don't really care about GSM or network stuff, my first goal is to get the processor working together with RAM/Flash and display (16-bit 8080 interface).Unfortunately the two documents I have are marked as "confidential" so I am not sure if I am allowed to share them here - but I do it anyways:https://www.yumpu.com/en/document/view/39819735/mt6205b-gsm-baseband-processor-data-sheet-data-sheet-gadget(if this is not allowed here I can remove this link of course)The most important part for me at the moment is to understand the boot-up sequence of the processor and how to get my C-program from my PC over a interface (don't know which interface is used at the end) to the CPU and into the external Flash.What I know at the moment is that the MT6205B has internal SRAM and internal Boot ROM which are used for "factory programming" and the Boot ROM is not writeable (I assume). The Boot-Mode is configured by a GPIO called "BOOT" depending on whether it is tied to GND or VCC. There are these two boot modes:Running code from Boot Code for factory programming(I don't really know what "Boot Code" means here?)Running code from external flash for normal operationQuoteI don't understand where this "Boot Code" is comming from? It sounds to me that Boot Code is not equal to System ROM - but where is it stored?QuoteAgain, I don't quite understand what is Boot Code and what is System ROM. Boot Code are these two instructions described above (LDR + jump to 0x48.....) and System ROM contains UART1 initialization? And the stuff which is received by UART1 is then transferred to System RAM - so it makes sense that the program which is transferred over UART1 contains initialization code for external Flash and then can be used as a "bootloader" to actually program the flash?Unfortunately that's basically all information for the boot up sequence and no further hints about what is "valid information". No further information about the baud rate (maybe 230.000?).The MT6205B has JTAG-pins - I don't know if they can be used to program the flash via a JLink for example? I've never done anything with JTAG so I don't know if it is enough for the JTAG interface to know that there is a "ARM7TDMI"-based processor connected or if I actually need some kind of config file for the specific processor?What I hope for at the moment is to find some people here who have experience with boot up sequences of processors and / or JTAG flash programming and maybe can give me some hints here or there.

author: GeorgeOfTheJungle
author_rank: Super Contributor
timestamp: November 02, 2019, 08:49:53 pm
content: Everything you are saying sounds almost exactly like this:https://github.com/espressif/esptool/wiki

author: soFPG
author_rank: Frequent Contributor
timestamp: November 02, 2019, 09:52:20 pm
content: Doesn't sound too complicated to write a piece of software which pushes data over UART but then I found this:https://github.com/espressif/esptool/wiki/Firmware-Image-FormatSo in case the MT6205B expects any specific image format (besides just raw asm instructions) I am pretty much fckd - right?Edit: There is actually some information regarding an image header used by Mediatek for the bootloader:https://github.com/u-boot/u-boot/blob/master/doc/README.mediatekBut I don't know if this one is also applicable for the MT6205 (maybe they use the same across all their chips?)Edit_2: Found something again (maybe bootloader code for MT6205):https://github.com/mtek-hack-hack/mtktest/tree/master/%20mtktest%20--username%20qq413187589/N65/N65_V1/bootloader/srcEdit_3: More information on bootloader:https://wenku.baidu.com/view/eef683a1b0717fd5360cdc0c//https://wenku.baidu.com/view/35306fc5aa00b52acec7ca07.html

author: soFPG
author_rank: Frequent Contributor
timestamp: November 03, 2019, 09:55:29 am
content: What I am also wondering about right now is this schematic:http://read.pudn.com/downloads183/ebook/858385/MT6205.pdfAs you can see on Page1 the "VD33" pins are connected to "VDD". "VDD" is connected, as shown an page 3, to "Vio" of the MT6305 IC (which generates all the voltage levels to fit the MT6205).But as you can see in the datasheet of the MT6305 at page 9:https://datasheetspdf.com/pdf-file/746585/MediaTek/MT6305B/1"Vio" is only max. "2.9V". I would have expected to have 3.3V on a pin called "VD33" and also 2.9V is a rather strange voltage for I/O-pins, isn't it?Can anyone lift this curtain for me?

author: GeorgeOfTheJungle
author_rank: Super Contributor
timestamp: November 03, 2019, 12:03:51 pm
content: See page 20-21 of the MT6205B .pdf, it says VDD33 typical 2.8V.

author: soFPG
author_rank: Frequent Contributor
timestamp: November 03, 2019, 05:47:56 pm
content: Thanks for your reply,VDD is 2.8V so I guess that it is used for GPIOs and UARTs. I am wondering whether UART1 is 3.3V compatible or not. Because if not, I can't use my USB-to-UART converter or any other USB/UART converter chip (like the CH340G)Why are they even doing 2.8V

author: GeorgeOfTheJungle
author_rank: Super Contributor
timestamp: November 03, 2019, 06:27:25 pm
content: Quote from: soFPG on November 03, 2019, 05:47:56 pmYes yes, you can use it, just put a 1kΩ resistor in the TXD output of the usb-serial chip, the voltage difference is only 0.5 volts. And RXD will have no problems in recognizing 2.8V as a one.

author: RoGeorge
author_rank: Super Contributor
timestamp: November 03, 2019, 06:31:23 pm
content: Wikipedia says that is an ARM7 processor. AFAIK ARM7 use to have JTAG interface, and indeed your MT6502 has it, too, on pins C2, C3, A1, C1, D3 - JTRST, JTCK, JTDI, JTMS, JTDO in the posted schematic. You should use JTAG to load and test your bootloader.You'll need a toolchain that supports ARM7, preferably should support your exact processor model, and a JTAG programmer compatible with that toolchain.Anyway, even if you would have complete documentation, it will still be a considerable time and effort spent to write a bootloader together with the other BSP (Board Support Package) files and firmware required to control that GSM board.If you have the time and the will to spend it on reverse engineering, better look into some very widespread old mobile phone, like a Nokia 3310 or 5110, so once you manage to take control of it, you would have virtualy infinite free hardware to play with, or to re-purpose it for future projects.The question is, why that old GSM board/processor?

author: soFPG
author_rank: Frequent Contributor
timestamp: November 03, 2019, 08:15:48 pm
content: Quote from: GeorgeOfTheJungle on November 03, 2019, 06:27:25 pmNiceEdit: I almost forgot: I either have 5V or 2.8V on this board and I don't really want to add another voltage regulator just for the CH340G USB-to-UART bridge..do you think the CH340G will work with 2.8V too?QuoteThe question is if I am able to do it just with a JTAG programmer (like J-Link EDU) and IDE (like Embedded Studio from Segger) alone or if I need some kind of JTAG config file for this specific MT6205B? I don't know - I have never worked with JTAG.QuoteThe J-Link EDU supports every ARM-architecture:https://www.segger.com/products/debug-probes/j-link/technology/cpus-and-devices/overview-of-supported-cpus-and-devices/It also supports infinite flash breakpoints but I am not sure if directly programming into external flash is supported for the EDU version or for this MT6205B at all.Their IDE "Embedded Studio" is free for non-commercial purposes.QuoteIt is nothing too complicated:simple external memory interface (for SRAM, Flash, parallel Display)doable BGA pin pitch for hobbyist (0.8mm)low pin-count (181)cheap (1.50$)I won't to any GSM / SIM stuff, not really interested in it. I also heard that it is almost impossible to get it workingMy plan is to work with some more high speed processors after that. I hope I can adapt some of the knowledge I gain with this project.

author: RoGeorge
author_rank: Super Contributor
timestamp: November 03, 2019, 08:29:58 pm
content: These pages explain what is JTAG, how and why it came into existence, in general.https://www.fpga4fun.com/JTAG.htmlI don't know if those particular JTAG models you mentioned will work with your processor or not, most probably yes, but you should ask the producer of the JTAG programmer, just to be sure.

author: amyk
author_rank: Super Contributor
timestamp: November 03, 2019, 10:34:04 pm
content: Article about "opening" a slightly newer MTK processor, might be of help:https://www.bunniestudios.com/blog/?p=4297

author: soFPG
author_rank: Frequent Contributor
timestamp: November 05, 2019, 07:33:26 pm
content: QuoteThanks for your reply. I read the blog post two times and watched his talk at the conference but I wasn't able to pull much information out for me. Not much indepth detail in my opinion. Also wasn't able to find his GitHub...So meanwhile what I found out is that the CH340G actually supports 2.8V as a minimum supply voltage (see attached picture).I am still looking for a cheap SRAM with capacity >= 512kByte...

author: coppice
author_rank: Super Contributor
timestamp: November 05, 2019, 07:50:53 pm
content: Quote from: RoGeorge on November 03, 2019, 06:31:23 pmThere are enormous numbers of old phones based on the Mediatek chip sets. They are no better or worse documented than the TI chip sets in old Nokia phones. Both makers produced good documentation, but the documentation was only made available to verified customers. Some of the Mediatek documentation might only be in Chinese (probably both simplified and traditional, with Mediatek being a Taiwanese company, but most of their customers being in China). You might be able to be get hold of stray copies for either chip set, but its pot luck.

author: soFPG
author_rank: Frequent Contributor
timestamp: November 07, 2019, 10:46:23 pm
content: So this chip has a shared memory bus for SRAM and Flash. Besides address- and data lines there are also #UB and #LB pins which select either the upper or lower byte of the 16 bits of data.I was able to find SRAM modules which also have these #UB and #LB pins but unfortunately I wasn't successful with flash modules (which makes sense - why would you want to split a cpu instruction?).Anyone here who knows if I can just ignore #UB & #LB pins for the flash module?A possible solution of course would be to use two 8-bit modules and then somehow combine #CS and #UB / #LB.

author: soFPG
author_rank: Frequent Contributor
timestamp: November 08, 2019, 10:06:10 pm
content: Found this tool which claims to be able to flash MT6205B CPU:http://mobisoft.com.ua/files/3113_china-tools-v1.03.html(this site in general is a pure gold)Edit: Also a firmware for the MT6205B:http://mobisoft.com.ua/files/773_full-sky-mix-301-300-6205.html, but don't know what I can do with itEdit_2: The schematic from a chinese phone with an MT6205B uses combined flash + sram IC AM41DL6408G:http://www.chipfind.ru/datasheet/amd/am41dl6408g.htmand according to the block diagram on page 5, #UB & #LB are only used for the SRAM, not for the flash! So that basically means that I can use any 16-bit flash and don't have to worry about #UB / #LB.