yashsingh1/xdaforums huggingface dataset:
[Windows Mobile Development and Hacking General] cr2:
I have managed to boot the kernel

and added the ID to wiki.

SD does not work, can't really test the GSM modem without 'cu' or similar.

These messages look strange:

ttyS3 at MMIO 0x41600000 (irq = 0) is a HWUART

Console: switching to colour frame buffer device 60x53

FYI:

asic3 hwprotect

4854 432d 5344 494f 2050 2f4e 3a33 3048 3830 3032 382d 3030

asic3: using irq 104-173 on irq 26

~ # cat /proc/interrupts

CPU0

4: 4296 pxa2xx_udc

10: 0 LCD

13: 3 STUART

18: 0 DMA

19: 208450 PXA Timer Tick

20: 0 rtc timer

23: 9 rtc 1Hz

24: 0 rtc Alrm

Err: 0

~ # cat /proc/iomem

08100000-0812ffff : himalaya-fb.0

08100000-081257ff : LCD

0c000000-0c0fffff : asic3.0

40301680-403016a3 : pxa2xx-i2c.0

40600000-4060ffff : pxa2xx-udc

41100000-41100fff : pxa2xx-mci

44000000-4400ffff : pxa2xx-fb

a0000000-a7ffffff : System RAM

a001c000-a017f32b : Kernel text

a0180000-a01cc797 : Kernel data

~ # cat /proc/cpuinfo

Processor : XScale-PXA255 rev 6 (v5l)

BogoMIPS : 397.31

Features : swp half thumb fastmult edsp

CPU implementer : 0x69

CPU architecture: 5TE

CPU variant : 0x0

CPU part : 0x2d0

CPU revision : 6

Cache type : undefined 5

Cache clean : undefined 5

Cache lockdown : undefined 5

Cache format : Harvard

I size : 32768

I assoc : 32

I line length : 32

I sets : 32

D size : 32768

D assoc : 32

D line length : 32

D sets : 32

Hardware : HTC Blueangel

Revision : 0000

Serial : 0000000000000000
[Windows Mobile Development and Hacking General] cp15:
It works for 2 BAs at least... But it was already there, it just had to be adaptet to the BA

Did you get a source?
[Windows Mobile Development and Hacking General] cp15:
No, it is encoded in 4 GPIO bits. Strangely one of it is normally configured as output.

It should work.

You need the following modules loaded:

ssp, himalaya_ts3, himalaya_tsc2200, evdev, tsdev

And you need a symlink /dev/ts to /dev/input/event0

Yes, its slow, and sometimes doesn't work at all.
[Windows Mobile Development and Hacking General] cp15:
Thanks. Interesting. The Board ID seems to refer mainly to the lcd display

You need mmc_core, mmc_block and asic3_mmc loaded.

Do you get a hang or any messages?

GSM modem works. You have to prefix each command with 0x02 0x16 and postfix it with 0x16 0x02. Use the FFUART at 115200 bps.

To register on network, you need:

at+cfun=1 [gives an error, but works]

at+cpin="your pin"

at+cops=0

Dial out with atdt[number]; (the semicolon is important)

Don't know why the HWUART states using irq 0. Maybe because it is shared with the BTUART.

Nothing unusual here.

The font is a bit tiny, so we get 60x53 characters on a 240x320 screen

Rest is similar to my BA.
[Windows Mobile Development and Hacking General] cr2:
I was dumb enough to believe that the

hotplug will load the modules. Now it is

working!

http://parts4pdas.de
[Windows Mobile Development and Hacking General] cr2:
That should go to wiki. I hope the same applies to GPRS.

BT is connected to HWUART, and BTUART is not used ?

IMHO, irda is connected to STUART, so with the running getty it should be possible to log in over IR :)

Well, actually the most important thing now is to find the ACX100 base address.
[Windows Mobile Development and Hacking General] cp15:
I am afraid not. Data calls are not yet working. I assume the dpram is used for transfer data and digital audio between gsm and cpu, and the FFUART is only for control.

Actually HWUART and BTUART share the same pins. I hope HWUART is used for bluetooth, because it needs high speed for transfer of audio data and HWUART has hardware flow control.

STUART is multiplexed between IRDA and the connector serial port.

I haven't tried yet to use IRDA.

It is already known. The ACX100 is connected to the first socket pcmcia interface of the pxa. I can already get its id via cardinfo. But the ACX100 driver is missing a card service, therefore does not work yet.
[Windows Mobile Development and Hacking General] cr2:
The touchscreen works, but has nonlinear

calibration.
[Windows Mobile Development and Hacking General] cr2:
Well, then i'll delete it from there.

The HaRET traces show that.

I'm really impressed by your work!!!
[Windows Mobile Development and Hacking General] cp15:
You need to run xtscal (not included in ramdisk, but in handheld root images)
[Windows Mobile Development and Hacking General] cp15:
I think it would still be useful.

I see. Do you know at which baudrate it is running?

Thanks, but I think only your and sjs'es work (and many others) made it possible.
[Windows Mobile Development and Hacking General] cr2:
You can dump the (physical)

0x41600000 and

0x41600004

in haret with a working BT,

and calculate the rate.
[Windows Mobile Development and Hacking General] cr2:
I wanted to write a summary of my yesterday tests, so others can correct me

if something is wrong and which questions are still open:

SD: works

MMC: works

SDIO: ? (don't have such hardware)

BT data: no

BT audio in/out: ?

WIFI: no (work in progress)

VIDEO: himalaya_lcd hack, no HW 2D accel/ IDCT

RS232: works

SIR: ?

FIR: ?

USB: client works, what about ATI3200 host ? can it be used at all?

GSM voice in: ?

GSM voice out: ?

GSM data in: ?

GSM data out: ?

GSM fax in: ?

GSM fax out: ?

GSM SMS in: ?

GSM SMS out: ?

GSM SIM phonebook, etc.: ?

GPRS: ?

UDA1380 audio in/out: ? headphone ?

CAMERA: no, linux driver exists, how is it connected ?

TOUCHSCREEN: works

KEYBOARD: no, is it connected to TSC2200 ?

BUTTONS: two buttons are missing-calendar and contacts ?

LEDs: ?

BATTERY: ?

BACKLIGHT: ?

PXA FLASH: read yes, write ? :)

M-SYSTEMS FLASH: ?

DPRAM: no

what is the purpose of PIC ? of I2C memory ?
[Windows Mobile Development and Hacking General] cp15:
Mmm... Don't want to boot windows for this :-)
[Windows Mobile Development and Hacking General] cr2:
Add a printk to the kernel before doing anything with this port.

Hmm. That doesn't help... If you have

mapped this area, use 'dd if=/dev/mem skip=... | od -x' :-)
[Windows Mobile Development and Hacking General] cr2:
Is there any linux(-arm) software that

can deal with the voice ?

I don't know the details of how MMS are transported.

http://lists.gnu.org/archive/html/gnokii-users/2004-07/msg00016.html

http://lists.gnu.org/archive/html/gnokii-users/2005-01/msg00116.html

http://lists.gnu.org/archive/html/gnokii-users/2005-01/msg00169.html

was some time ago, maybe something has changed.

Are you using gsmlib or what ?

There are plenty of unknown GPIOs.

IMHO I2S is used for the sound ("flash").

The ADCM-2650 has a documented 8bit parallel interface, and there exists a linux

driver.

The question was if ADCM is connected

to the ATI3200 capture port, or directly

to the PXA.

The tester should be a tough guy :-)
[Windows Mobile Development and Hacking General] cr2:
http://www.openmobilealliance.org/release_program/mms_v1_1.html
[Windows Mobile Development and Hacking General] immolo:
Hey, first off I wanted to say great port :D but I was wondering how the sdcard driver was coming as I can't show linux off while its in the cradle and also I was wondering is it possible to setup a ram disk to run gpe if the sdcard driver is going to take a while to finish?

Thanks
[Windows Mobile Development and Hacking General] cp15:
There is a more comfortable devmem command in the ramdisk.

Since it uses mmap it works also on normally not mapped areas.
[Windows Mobile Development and Hacking General] cr2:
The SD driver itself is working. If you don't

want to change the card, simply load the

modules in your ramdisk. You can't expect

that everything is plug-and-pray at this stage :)
[Windows Mobile Development and Hacking General] cr2:
The greatest thing about Linux is that

one always learns new things!
[Windows Mobile Development and Hacking General] immolo:
If the sd card works how do you mount it? I have an ext2 partition on my sdcard which holds gpe and all the normal tricks didn't work for me.
[Windows Mobile Development and Hacking General] cr2:
modprobe mmc_block and asic3_mmc since they are not compiled

into the kernel,

then mount /dev/mmc/blk0/partX /somewhere.

X is the partition number.
[Windows Mobile Development and Hacking General] cr2:
more on SD

There is some resource leaking here ?:

MMC-->

mmcblk0: mmc0:0001 SDMB-8 7840KiB

/dev/mmc/blk0: p1

Device 'asic3_mmc.0' does not have a release function.

platform_device_register asic3_mmc

SD-->

mmcblk0: mmc1:afb8 SD512 500224KiB

/dev/mmc/blk0: p1

mmcblk0: mmc2:afb8 SD512 500224KiB

/dev/mmc/blk0: p1

mmcblk0: mmc3:ca52 SD128 123008KiB

/dev/mmc/blk0: p1

mmcblk0: mmc4:ff8f SD512 500224KiB
[Windows Mobile Development and Hacking General] immolo:
Thanks cr2 my sd card is now mounted and I can enjoy linux outside of the cradle a bit but I was wondering is there a frontend for using the phone/sms in linux I've had a look on the gpe site but only found a SIP program.

I would of though there would be one seeings as the ipaqs also have phone feautres nowadays.
[Windows Mobile Development and Hacking General] cr2:
For the SMS i'm thinking about gsmlib and gnokii.

There are even more HP PDAs where they don't tell you how the sound works.

I wish they have supported some

mass consumer oriented developments

(i.e. google money),

since only that will destroy microsft in the

long run.
[Windows Mobile Development and Hacking General] cr2:
SMS gui:

http://www.schuerig.de/michael/linux/ksms/

This one is supposed to be 'gtkSMS':

http://www.ceti.pl/~miki/komputery/sms.html

MMS decoding:

http://heyman.info/mmsdecoder.php
[Windows Mobile Development and Hacking General] cr2:
latest GPE

Has anybody tried the latest hx4700 GPE

image from

http://userpage.fu-berlin.de/~zabel/hx4700 ?

Eventually we will need to extend and embrace

the hx4700 setup :)
[Windows Mobile Development and Hacking General] cp15:
There is now a (still alpha) phone app for the blueangel at

http://cvs.sourceforge.net/viewcvs.py/xanadux/gomunicator

(checkout with cvs -z3 -d:pserver:anonymous@cvs.sourceforge.net:/cvsroot/xanadux co -P gomunicator)

It has incomplete number lookup in gpe-contacts, diallist, incomplete sms send and receive, and the phone functions are also... incomplete.

It also supports dialling a number from gpe-contacts, but you need to patch gpe-contacts for this.
[Windows Mobile Development and Hacking General] cp15:
Re: latest GPE

Looks good, especially since it shows how to integrate patches into openembedded.

Is there a volunteer who wants to create a distribution for the blueangel?
[Windows Mobile Development and Hacking General] cr2:
I have added the (imho "full") AT command list for Universal here:

http://wiki.xda-developers.com/index.php?pagename=UniversalGSM

If there will be some more time i will do the same for Blueangel.

For many of these commands there is no documentation, but

maybe i was looking at the wrong place.
[Windows Mobile Development and Hacking General] cr2:
Done.

http://wiki.xda-developers.com/index.php?pagename=BlueangelGSM
[Windows Mobile Development and Hacking General] cp15:
Good work, thanks.

Did you get the list from ril or from the radio rom?

The "%%" are maybe errors, coming from using the command as a arg to sprintf and thus requiring to double the "%".

I will see if I can add some information
[Windows Mobile Development and Hacking General] cr2:
strings from rilgsm, btagsvc and btagext.

I dont know how to get at the radio rom.

Not always, sometimes they are really documented with %%. We should test this

list by feeding it to the GSM port, anyway.
[Windows Mobile Development and Hacking General] cp15:
Download your favorite firmware image and extract radio_.nbf from it.

Decode radio_.nbf to radio_.nba with

xda3nbftool -x radio_.nbf radio_.nba 0x20040523

decrypt radio_.nba to radio_.bin

decoderadio.pl radio_.nba radio_.bin

Ah, interesting

I have updated the list with the output of at+clac (list all at commands).
[Windows Mobile Development and Hacking General] cr2:
I think these links can be useful too:

http://doc.trolltech.com/qtopia2.1/html/phonelibrary.html

http://doc.trolltech.com/qtopia2.1/html/qtopia-gprs-networking.html
[Windows Mobile Development and Hacking General] cr2:
sshd and bluetooth

What kernel should i use to login into BA over

bluetooth ? Are the pand, bnep, hciattach & friends

started in the gpe.tar.gz from handhelds.org ?
[Windows Mobile Development and Hacking General] cp15:
Re: sshd and bluetooth

No, you have to start it from hand at this stage.

The "power on bluetooth" code is missing in the current published kernel. I will publish a kernel which includes this code soon (and also includes the bluetooth protocol modules). For now you have to set bit 0 in asic3 gpio0 and bit 12 in asic3 gpio1.

If you want BTUART speed of more than 115200 bps then you need a patched hciattach. I will publish... ah... you know already.

Still missing is dma support for the btuart, I think it will be useful to relax the interrupt load when using it.
[Windows Mobile Development and Hacking General] cr2:
wifi & sdio

FYI: there are (closed source) ACX100 linux drivers at

http://www.c-guys.net/support/download/link_e.shtml

What makes it really a great fun, ACX100 is on a SDIO card!
[Windows Mobile Development and Hacking General] cr2:
BOARDID3 ?

The PXA GPIO list is now complete,

but many pins remain undecoded.

I suspect that BOARDID3 GPIO does not exist

(the pin configured as output on my BA).
[Windows Mobile Development and Hacking General] cp15:
Re: BOARDID3 ?

On mine too.

I am temporarily configuring it as input when getting the boardid.

But the bootloader seems to query it. It may be a pullup/pulldown resistor or a bug in the bootloader or...

I am keeping it until we found out what GPIO21 really does.

I was also hoping GPIO69 is something like "DPRAM tx buffer empty", but in my tests I couldn't get it triggered.

A dpram driver and a half working sound driver (special haret required which activates sound in windows) is in the works.
[Windows Mobile Development and Hacking General] cr2:
GPIOs

I have added the missing pins to the ASIC3 page,

too.

Is there any GPIO for the readonly SD cards ?

I'd like to draw a diagramm: which device is

connected to which bus, and what resources

it grabs.

Still not sure about the purpose of PWM, if it is

not the LCD brightness/contrast.
[Windows Mobile Development and Hacking General] cr2:
Re: BOARDID3 ?

We should also think about a specialized haret

version that takes only the "free" pages and

transfers this list to the kernel

(and maybe kills the useless wince programs). Doing the hard

reset after each kernel start is a real PITA.
[Windows Mobile Development and Hacking General] cr2:
Audio

Looking at the [BlueangelGPIO] page one can see

an interesting thing:

I2S TXD is never used, but SSP TXD works

during audio out.

At the same time the SSP RXD is

also never used. Any hints ?
[Windows Mobile Development and Hacking General] cp15:
Re: GPIOs

I guess it's one of the two sd bits in ASIC3 GPIOD.

I think that would be useful, but also a lot of work

Contrast is controlled via asic3 (register offset 0x304). Values can range from 0x0 (minimum brightness) to 0x40 (maximum brightness). Windows only uses 0x10-0x40.

Don't know also for what the PWM is.

All it's registers are on the reset value. Which gives a frequency of 737.2 khz at a duty cycle of 0%. Is it used at all?
[Windows Mobile Development and Hacking General] cp15:
Re: BOARDID3 ?

Not that easy. The kernel has to be extended to support many and small memory areas, since the allocated memory is (physically) most likely very fragmented.

As for linux: Maybe LAB can be used as a module also, so reboots will be much faster and less anoying.

I have also an autorun.exe (attached) which can be put into a directory named 2577 on your SD card and loads \Storage Card\linux\haret.exe

This means linux boots right after the touchscreen setup and cut & paste excercise or if you insert the SD card.

As for windows: I think we probably better invest the time and energy into making windows no longer needed :-)
[Windows Mobile Development and Hacking General] cp15:
Re: Audio

Yes, audio out is transmitted via SSP TXD. I can generate a "beep" when writing data to it.

But there is still a missing initalisation, probably related to the left/right frame input on the uda1380, which SSP cannot generate.

There is also something strange with the SSP clock. The clock is generated by ASIC3 (enabled via CLOCK_CDEX_CONTROL_CX) and gives a sample rate in the range of 40 kHz.

If the I2S is used to receive data this would mean full duplex is impossible, since the data formats are IMO different.

Can anybody tell whether full duplex audio works on the ba or not?

I2S is not used for playback (CKEN8 not set).

Could anyone please check whether CKEN8 (Physical Location 0x41300004) is set during record? Same for CKEN3 (SSP)?
[Windows Mobile Development and Hacking General] cr2:
Re: Audio

It is really confusing. The ASSP shares the same

pins as I2S, but it is disabled during "normal"

times. The bluetooth audio must be also routed

somehow.

And the ASSP. If haret had a WADDR command...
[Windows Mobile Development and Hacking General] cr2:
Re: Audio

Finally synce compiles on amd64.

CKEN8 is set during record, normally it is off.

CKEN3 is set during play, normally it is off.
[Windows Mobile Development and Hacking General] cr2:
Re: GPIOs

We can not avoid it because of /sys/bus 8)
[Windows Mobile Development and Hacking General] cr2:
Re: Audio

I have logged (wgpio) the voice call with BT headset (only listened, not talked myself

<- no money on the prepaid card :oops: )

Nothing spectacular, something is sent

over the BT data link to the headset, probably

the commands to switch on and off. It seems that

the cpu has nothing to do with it.
[Windows Mobile Development and Hacking General] cp15:
Re: Audio

Why might they have done something that stupid?

Maybe an undocumented restriction in using dma?

At least the bit formats seem to be compatible, the uda1380, ssp and i2s all support MSB-justified, so full duplex is not yet impossible.
[Windows Mobile Development and Hacking General] cr2:
Re: Audio

Why is it stupid ? I2S is assumed to be a single-directional bus.

I don't really get the bigger picture including

DPRAM. What route is taken by the raw PCM data, to/from the microphone and GSM radio ?
[Windows Mobile Development and Hacking General] cr2:
Re: Audio

The SSP is 16bit, TI, external clock, SCR=7 (f=EXTCLK/16)

I2S generates BITCLK(master), works in I2S mode, SADIV=0x34 -> 708.92KHz

You should know better about UDA1380.
[Windows Mobile Development and Hacking General] cp15:
Re: Audio

To my knowledge both ssp and i2s are full-duplex.

It seems the GSM radio is directly connected to the microphone and the analogue input of uda1380. There is a mixer register (not activated in the official uda1380 driver) which sets the phone volume. Don't know what the Windows "AGC" setting does.

DPRAM is only used for digital data transfer (GPRS and CSD). There is a 512 Byte buffer for both directions. AT%DPRAMTEST=1 connects the TX and RX buffer, but you can only transmit about 10 bytes at once, else there seems to be a buffer overrun.

Bluetooth audio is probably transmitted via an pcm interface from GSM to bluetooth chip. It keeps working for a few seconds when you boot linux.
[Windows Mobile Development and Hacking General] cp15:
Re: Audio

Gives with mono 16 bit samples 44.3 KHz sample rate. Sounds reasonable.

Just found out that the uda1380 supports different audio formats for playback and capture.
[Windows Mobile Development and Hacking General] cr2:
Re: Audio

Well, this is an academic discussion. There is

the master and slave at a given time, and they

can't send/receive simultaneously.

Compare it with rs232.

Very interesting. That means the brother controls your microphone, even if

you have removed wince and replaced it with linux :evil:

I have managed to hard crash wince, still listening to the GSM voice transmission over bluetooth.

The connection was broken only at hard reset.
[Windows Mobile Development and Hacking General] cr2:
Terminology.

I suggest to differentiate between

internal microphone,

external microphone,

BT microphone;

internal speaker,

external speaker,

BT speaker.

I guess the current changes for BlueangelASIC3

are dealing with the internal speaker and microphone.
[Windows Mobile Development and Hacking General] cr2:
Watching ASIC3 status and MMIO values.

What software can be currently used for that purpose ?

I'm thinking of writing a haret extension (again

:oops: ).
[Windows Mobile Development and Hacking General] cr2:
Voltages.

How many voltages are used by the LCD ?

5V, 9V, XV, something else ?

The same for WLAN:

1.8V, 3.0V, 3.3V ?
[Windows Mobile Development and Hacking General] buzz_lightyear:
@cr2 &cp15

hi guys... which language do you speak here? ;o)))

it looks like some german hw hardcore group is forming here... ;o)))

good job actually...

buzz
[Windows Mobile Development and Hacking General] cr2:
ASIC3 GPIOD

I don't see anything on GPIOD13 and

GPIOD14. There is a periodic packet coming

at GPIOD2.

Can confirm all other assigned pins.
[Windows Mobile Development and Hacking General] cr2:
Looking for Linux coming to a microsoft device

near you :)
[Windows Mobile Development and Hacking General] cp15:
Re: Voltages.

Don't know exactly. On a boardid 0x6 BA there are 4 Bits which you can flip and see the LCD content disappear. Don't know the voltages. On a boardid 0x5 BA there are even 2 more (not yet documented...)

But I think we should know because usually the power should be shutdown in a certain sequence.

Don't know also.

I have implemented a card service for the acx100 driver now. Unfortunately it does not yet work. I can get the firmware loaded (and read back confirms it gets loaded correctly), but when the cpu should start, there is no sign of life from it.

Maybe there is something more in the GPIO/ASIC3 direction we need to do.

Also there seems to be no shared memory window between cpu and acx100, which probably means we have to transfer the data via an io register.
[Windows Mobile Development and Hacking General] cp15:
Re: ASIC3 GPIOD

They indicated whether a sd card was in the slot in my tests. But I might be wrong.

This might be the "Battery is charging", especially since the neighbor bit indicates whether the charger is usb or ac based.

GPIOD6 might also be charge related. The charger device has 3 inputs which may be connected here: USB charge current select, charge enable, timer and termination enable.
[Windows Mobile Development and Hacking General] cr2:
ASIC3+200

What is located at +200 in ASIC3 ?

Seems to be used by the keyboard

together with some magic numbers.
[Windows Mobile Development and Hacking General] cr2:
Re: ASIC3+200

Looking deeper into the hhorg CVS,

the holes must be filled by SPI and I2C:

#define ASIC3_SPI_IRQ 67

#define ASIC3_SMBUS_IRQ 68

This ASIC3 looks quite capable.
[Windows Mobile Development and Hacking General] cr2:
GPIOC3

Doesn't look like SPI input. I get only one flip

per button press.
[Windows Mobile Development and Hacking General] cr2:
ASIC3+200

0x0c000204 - some data is transferred at the

button press.

0x0c000208 - the first bit flips as the button is pressed.
[Windows Mobile Development and Hacking General] cr2:
Re: ASIC3+200

Looking even deeper shows that ASIC2 really

had SPI there, but it doesn't mean ASIC3 does

the same.

{ 4, _H3800_ASIC2_Base + 0x0400, "SPICR", "SPI control register" },

{ 4, _H3800_ASIC2_Base + 0x0404, "SPIDR", "SPI data register" },

{ 4, _H3800_ASIC2_Base + 0x0408, "SPIDCS", "SPI chip select disabled register" },
[Windows Mobile Development and Hacking General] cr2:
left LED

The left LED (BT&Wifi) has something to do with

the 0x11000000 and 0x1100000a addresses.

I don't know what is located at 0x11000000.
[Windows Mobile Development and Hacking General] cp15:
Re: ASIC3+200

According to ipaq-asic3.h SD_CONFIG_BASE (starting at +0x8), but 0x0-0x6 seem to be the SPI interface.

GPIOD6 seems to be the kbd controller reset line.

GPIOC6 might be its power control

Can confirm now that GPIOC3-GPIOC5 is the SPI bus for the kbd controller