irclog2html for #htc-linux on 20060916

06:02.52*** join/#htc-linux awelux (n=awelux__@dslb-084-058-153-192.pools.arcor-ip.net)
08:50.02*** join/#htc-linux rob_w (n=bob@p213.54.193.20.tisdip.tiscali.de)
09:58.19*** join/#htc-linux pH5 (n=ph5@p5485F591.dip.t-dialin.net)
11:10.18*** join/#htc-linux pwr (n=pwr@82.78.120.186)
12:32.52rob_wi will now try to make the battery code irq driven on ac connects , including led`s
12:56.01*** join/#htc-linux WizMaui (n=WizMaui@62.112.90.216)
13:45.49*** join/#htc-linux rob_w (n=bob@p213.54.220.74.tisdip.tiscali.de)
14:33.21*** join/#htc-linux jeanseb (n=jeanseb@62.147.133.94)
14:57.05*** join/#htc-linux skodde (n=skodde@213-140-16-178.fastres.net)
15:03.58*** join/#htc-linux Kevin2 (n=Kevin@207-237-52-30.c3-0.avec-ubr12.nyr-avec.ny.cable.rcn.com)
16:30.28*** join/#htc-linux pleemans (n=peter@d54C248DE.access.telenet.be)
16:42.22Kevin2Hi
16:44.37*** join/#htc-linux pwr (n=pwr@82.78.120.186)
16:45.27Kevin2Any universal users awake?
17:03.06Kevin2Well, if anyone comes on please try running the haret steps at http://pastebin.ca/159143 and plug/unplug the phone while in the "wi" stage.
17:19.11rob_whmm gpio 0 toggles in the powerbutton and on connecting AC alone
17:22.01rob_wwhat sense does this have ??
18:19.40*** join/#htc-linux WizMaui_ (n=WizMaui@62.112.90.216)
19:49.38cr2hi. somebody around?
19:59.36MB300Ei am here
19:59.59*** join/#htc-linux WizMaui (n=WizMaui@62.112.90.216)
20:00.57pH5hey cr2
20:02.06pH5I'd like to do *something* about the phone here, but I don't know where to start.
20:02.25pH5Is there a more clever tracing method now than just looking at the gpios when turning on/off the phone?
20:03.21pH5I know the GSM reset routine from the bootloader disassembly, but not much else.
20:04.19Kevin2Hi
20:04.51Kevin2ph5: Have you looked at: http://www.handhelds.org/moin/moin.cgi/ApachePhoneTrace
20:12.57pH5Kevin2: thanks! this will be very useful once I get to talk to the chipset.
20:14.17Kevin2ph5: What phone do you have?
20:14.29pH5htc magician
20:14.41pH5the ttySx don't answer to anything yet
20:14.58Kevin2Hrrmm.  Is it pxa based?  Does it use wm5?
20:15.28pH5it's pxa272, and it uses the old wince 2003(?)
20:16.17Kevin2Can you run haret on it?  If so, you should be able to trace the serial port like I did.
20:18.55pH5Kevin2: I'll try it.
20:19.56Kevin2Hrrm.  You have a MAX1587A also..  Can you run the commands at http://pastebin.ca/159143 and plug/unplug the phone while running "wi"?  I'm trying to see if the other phones are using the power management i2c bus like the apache is.
20:23.59pH5Kevin2: Difficult, I usually run haret over that usb connection. That's the only DC input.
20:24.21cr2hi Kevin
20:24.31cr2universal does not use power i2c
20:26.49Kevin2cr2: Are you sure?  On my phone it shows as powered down (cken off), but I've confirmed that it brings it up and then down to write voltage changes on the i2c bus.
20:27.40Kevin2BTW, welcome back.  I hope your vacation was fun.
20:29.44cr2yes, only if my hdd survived that time ;)
20:30.03cr2you think that power i2c is connected to max1587a ?
20:30.23Kevin2ph5: Hrmm.  That is a pain.  What happens if you unplug/plug the phone while running haret?  I've been able to stop/start wifi while connected to haret over wifi.
20:30.52Kevin2cr2: Yep, the above commands that I posted at pastebin clearly show it.
20:31.52Kevin2wm5 writes to the pm i2c transmit address at 0xaef00188
20:33.32pH5Kevin2: unfortunately the ppp-over-usb connection breaks doesn't survive pulling the plug
20:34.27cr2i have not tried it with "wi", but did not see any cken change or 0xaef00188 changes with usual tools.
20:35.04Kevin2cr2: Neither did I.  But the wi did show it for me.
20:36.09cr2ok.
20:37.30cr2i will try it.
20:37.53cr2btw, can we trace an usb endpoint in a similar way ?
20:38.07Kevin2ph5: When you bring the ppp back up do you get the same IP addresses?  If you get the same IPs, the telnet session should survive it.
20:38.28Kevin2cr2: USB uses dma.  So, it is theoretically possible, but an order of magnitude harder.
20:39.07Kevin2We'd have to trace the dma enable command and then write C code to copy the stuff that was being transmitted / received.
20:39.50cr2is it a normal dma channel ? i don't remember.
20:40.04Kevin2I don't recall either.
20:40.22cr2lcd uses some internal dma engine.
20:40.25Kevin2Do you think anything interesting goes over the usb connection?
20:40.37cr2gprs/umts data
20:41.04pH5Kevin2: I don't get the pppd connection up again, there seems to be some ugly interference with activesync on the phone. can I kill this somehow?
20:41.25cr2haret "kill pid"
20:42.16cr2"dump ps" first or "dump wince" afaik
20:43.33Kevin2cr2: Do you have a list of phone related gpios and what they do?  I have 5 gpio pins (at least) that are phone related.  I think I figured out one of them, but I'm curious if they'll map the same as the universal.
20:44.08pH5hmm, that didn't work out. I'll try to log to a file instead.
20:44.38cr2http://wiki.xda-developers.com/index.php?pagename=UniversalGPIO
20:45.03cr2http://wiki.xda-developers.com/index.php?pagename=UniversalASIC3
20:46.25cr2GPIOB8 , GPIOB12, GPIOD8 - phone reset.
20:46.29cr2on asic3
20:46.31cr2on pxa:
20:47.00Kevin2cr2 / ph5 what does "pd 0x40f0001c 4" report?
20:47.00cr2GPIO 19 - usb host something
20:48.35cr2GPIO 27, GPIO 98, GPIO 109, GPIO 110, GPIO 112 - more or less understood.
20:49.06pH5Kevin2: PCFR? 0x00001071
20:50.21cr2GPIOB0, GPIOB3 - somthing mysterious is going on there. b0 is some kind of "ready" signal, b3 - has some fast changes when logging into the network.
20:51.00cr2so 9 +2 gpios on universal ;-) and ffuart + 2 serial usb host endpoints.
20:51.05Kevin2ph5: Yes - PCFR has an override for gpio pins.  So you have both "nRESET_GPIO" and 'PWR_SCL' / 'PWR_SDA' mapped.
20:51.53cr2i'll look at PCFR. it should be in some "dump pxa27x*" output, btw.
20:52.03pH5Kevin2: I don't see any i2c traffic with the trace from http://pastebin.ca/159143 when I un/plug
20:52.06cr2pxa27xpower maybe
20:53.52pH5Kevin2: only gpio 13, but that's the irq line of the cpld iirc
20:54.45Kevin2Hrmm.  Okay.
20:54.54Kevin2I see the following on plug in:
20:54.56Kevin2000.357422 9058ce28: e5c34008 strb   r4, [r3, #8]   # r4=00000028 r3=aef00180
20:54.56Kevin2000.357448 9058cea8: e5c3a008 strb   sl, [r3, #8]   # r10=0000001a r3=aef00180
20:54.57cr2battery empty. red led on.
20:55.11Kevin2On unplug I see:
20:55.15Kevin2000.923275 9058ce28: e5c34008 strb   r4, [r3, #8]   # r4=00000028 r3=aef00180
20:55.15Kevin2000.923302 9058cea8: e5c3a008 strb   sl, [r3, #8]   # r10=0000000b r3=aef00180
20:56.03pH5cr2, Kevin2: should I submit this haret patch: http://en.pastebin.ca/173343
20:56.51Kevin2I'd definitely find it useful.
20:57.05Kevin2cr2: BTW, I have a haret patch at:
20:57.53Kevin2svn://www.shadowmite.com/home/svn/ppc6700  as haret/gharet-20060830.patch
20:58.18cr2imho, already applied.
20:58.53Kevin2Oh.  Thanks.
21:00.16cr2pH5: can you also make "unlog" or something to switch logging off ?
21:02.07pH5cr2: ok
21:02.47*** join/#htc-linux rob_w (n=bob@p213.54.220.74.tisdip.tiscali.de)
21:03.51cr2Kevin2: i have also addred haretconsole tools to CVS.
21:04.29Kevin2cr2:  I just saw that.  Thanks!  BTW, have you been able to trace your FFUART port like I was able to?
21:04.37pH5Kevin2: my gsm cmd is on BTUART, how can I trace this one?
21:05.02Kevin2ph5: Do you have the same memory map as universal/apache?
21:06.38cr2pH5: change the base address
21:06.39pH5Kevin2: yes, so that should be just 0xae200000?
21:06.57cr2Kevin2: trying now.
21:07.37rob_wre
21:07.38cr2PCFR is in "dump pxa27xpower"
21:08.07Kevin2ph5: Yes.  That is the address I would use.
21:10.18cr2Kevin2: 1071 too.
21:10.47pH5Kevin2: that seemed to work.
21:12.34Kevin2cr2:  So, GPIO pins 3 and 4 are power management i2c pins regardless of what the gpio settings are at.
21:13.24rob_walso here it is strange that one gpio is triggered both when the power button is pressed and the ac is connected
21:14.56cr2Kevin2: i get only RTC0 and TMR1 interrupts. nothing more.
21:15.34cr2where is the ffuart trace link ?
21:15.48Kevin2Okay.  Thanks for looking into it.
21:16.01Kevin2http://www.handhelds.org/moin/moin.cgi/ApachePhoneTrace
21:16.09cr2thx.
21:16.18rob_whmm it is maybe a error in the gpio map on xanadux again
21:21.47pH5cr2: http://en.pastebin.ca/173366, ok to commit?
21:25.44cr2yes, why should i be against :)
21:26.26cr2Kevin2: i've done a 5min 'script' log, will try to decode it now.
21:29.26rob_wcr2 can you point me to the haret which has powermon sources
21:30.10cr2rob_w: haret-gnu subdir in CVS haret/haret-gnu
21:30.20cr2it's the only one we are using and working on.
21:31.07cr2you may need to make some changes pxa27x -> pxa26x for some parts.
21:31.34rob_won xanadux-cvs ?
21:33.15Kevin2cr2: Did scanserial.py work for you?
21:33.23cr2Kevin2: cool.
21:33.54cr2yes. it works, but i don't see anything new, that wince do not log. but it's also good to know.
21:34.33cr2AT+GTK* undocumented stuff it also there, with long encoded strings of unknown numbers.
21:34.53cr2but it should be some htc sim toolkit weirdness.
21:34.59pH5Kevin2: scanserial.py works here, too - I only have to adapt the instruction codes for BTUART
21:35.01cr2no $HTC_ stuff.
21:35.14pH50xe5801000 write, 0xe5901000 read
21:37.27pH5read: '\x02\x02\x02\x160\r\x02\x00\x02\x02\x02\x12GSM Version : 1.12.00 G23 Version : 1337.42\x02\x02\x02\x16AT-Command Interpreter ready\r\n'
21:37.27pH5read: '\x02'
21:37.29pH5:)
21:38.18cr2ok. so you have framing.
21:38.50Kevin2I've been trying to figure out ways to trace the gpios and the read/writes at the same time.  I think it should be possible.
21:39.00cr2i do not have framing, but i knew that from the nk.exe disassembly :)
21:39.20cr2Kevin2: just wanted to ask about it.
21:39.52Kevin2cr2: What's that?
21:40.08pH5but I wonder, shouldn't I get this first hello string under linux too, when I listen on ttyS1 and do the GSM reset procedure right?
21:41.05cr2Kevin2: himalaya,blueangel,magician use the TI phone chipset, which does not send "raw" AT commands, but encasulates them in frames.
21:41.36cr2pH5: you need to pull the right gpios with right timing before you'll get it.
21:42.10cr2000.617349-001.521909  read: '\x00AT-Command Interpreter ready\r\n'
21:42.10cr2001.588414-001.588429 write: 'ATZ\r'
21:42.37cr2i can get this messages in linux, but don't get a response to ATZ\r ;-)
21:43.31Kevin2cr2: One of my gpio pins seems to change after every transmit.  It looks like some kind of "clear to send" gpio.  Odd though, because the serial has a CTS already.
21:44.01cr2yes. i have something like that too. on asic3 gpio.
21:45.20Kevin2It seems like the read/write code is always at the same address.  So I'm going to try catching reads/writes by using the instruction tracing features of the chip.  That leaves me the memory access tracing functions to watch gpio activity.  :-)
21:46.34Kevin2Unfortunately, that doesn't help too much with input pins, because it is hard to tell when a read access is just sloppy programming and when it really does control behavior.
21:47.27cr2we can try to filter them afterwards.
21:51.44cr2pH5: the gomunicator assumes simple x02x16<command>x02x16 framing. your output looks more interesting.
21:52.34cr2\x02\x12GSM Version : 1.12.00 G23 Version : 1337.42\x02\x02
21:52.55cr2so it goes to 0x12 channel.
21:53.43cr20x12 - other gsm trace
21:53.54cr20x16 - gsm AT commands
21:53.57cr2http://www.xs4all.nl/~itsme/projects/xda/serial-protocols.html
21:58.56cr2Kevin2: i can see this in the log:
21:59.00cr2002.598342-002.598375 write: 'AT@USBPOWER=1\r'
21:59.00cr2002.598377 irq 22(FFUART)
21:59.01cr2002.604738-002.604750  read: '0\r'
21:59.01cr2002.674312 irq 3(USBh1)
21:59.01cr2002.678370 irq 3(USBh1)
21:59.01cr2002.680880 irq 3(USBh1)
21:59.51Kevin2Interesting.  What action did you take?  I haven't seen that.
21:59.53cr2so AT command initializes the Qualcomm chip as USB slave, and then something goes on with pxa usb host.
22:00.04cr2it's on startup.
22:00.13cr2phone init string.
22:00.19cr2includes this command.
22:00.48cr2http://wiki.xda-developers.com/index.php?pagename=HTC_GSM
22:03.56Kevin2The closest thing I have is:  write: 'AT+HTC_ROTKSL=0\r'
22:04.08cr2this command is only found on universal. not surprising because it is the only phone with qualcomm chipset. maybe newer htc umts phones like tytn have it too.
22:04.08Kevin2which is then followed by USBh1 interrupts.
22:04.15cr2ok.
22:04.29cr2rotksl ? what can it mean ?
22:05.50Kevin2Roll on the ...
22:06.06Kevin2I tried googling for it when I first got the trace - but to no avail.
22:06.30cr2i think you are the only person who is working on linux cdma phone.
22:06.54cr2btw, there was a report that gomunicator worked on a cdma blueangel.
22:07.32cr2i don't know what baseband chipset they use. (boardid=0x4)
22:07.41Kevin2I think I've basically figured out all the hardware on the phone.  I need to nail down the rechange disable sequence.  Then the only thing left is the phone.
22:08.05Kevin2The phone could be difficult..  But the basic call / receive stuff seems to be straight-forward.
22:09.42cr2i'd like to see the usbh log first, before going deep in the gpio details.
22:10.31Kevin2Not much info on harrier (cdma blue angel) around.
22:11.15cr2afaik, it just worked. so it should use the same gpio/comm protocol.
22:13.02cr2pH5: if i'll trace the btuart, i'll grab the bluetooth init stuff !?
22:13.11cr2Kevin2: where is your bt ?
22:13.50Kevin2bluetooth is on the BTUART.  I was able to do some basic pings under linux.  Even with the high speed firmware.
22:14.12Kevin2I don't know much about bt so I didn't do extensive tests, but it appears to work.
22:15.55cr2it works here too, but nothing is known about the "audio" firmware control for the headset.
22:17.54Kevin2It looks to me like the phone talks directly to the sound codec.  I wonder if the BT headset also takes some shortcut.
22:20.48cr2yes. there is a PCM input/output on the BT chipset, so it talks to the phone directly.
22:21.18cr2i have seen a htc schematic picture somewheres.
22:23.12Kevin2Well, you should be able to trace reads/writes to the BTUART and to the I2C to see what is going on.
22:23.55cr2I2C ?
22:24.47Kevin2The sound codec is attached to the i2c port.
22:25.01Kevin2set trace 0xae301688
22:25.14cr2ah. ok.
22:26.08pH5cr2: magician's bluetooth isn't connected to btuart, but to usb host - this already works here
22:27.05cr2pH5: yes, but if you have modified the .py script for btuart tracing, it can be reused :)
22:27.20pH5no idea about the headset shortcut here, I just know it exists from the wavedev.dll code
22:29.17cr2the PCM routing on magician (and himalaya/blueangel) is a mystery for me.
22:30.15pH5ack. I know that the GPIOs on the CPLD chip are involved, but that's not all..
22:30.18cr2it sends over i2s and receives over ssp, no idea where the bluetooth audio is connected and how it is multiplexed.
22:31.17Kevin2cr2: You have ssp involved in audio/bt stuff?
22:31.37cr2not on the universal.
22:33.00Kevin2Oh.  Okay.  I seem to recall reading that SSP could be used to drive/receive I2S.
22:34.42cr2uda1380 can do both.
22:35.08cr2we have ak4641 and only i2s is used.
22:39.02Kevin2Oh, BTW, I found that the camera chip is attached to the i2c port.  It can't be detected with a normal scan, because it is using some derivated i2c protocol.  (Tracing i2c and playing with the camera shows activity.)
22:39.21cr2ok.
23:00.12cr2Kevin2: we need some fresh idea how to trace the usb host endpoints. or maybe trap into the wince usb-serial driver.
23:09.58pH5cr2: where should I put the gsm reset code in the linux kernel? I currently only have a module that does the GPIO setting on module_init.
23:13.49cr2pH5: clone the bt serial port setup from hx4700
23:16.49pH5cr2: ah, so platform_pxa_serial_funcs it is. thanks.
23:41.05Kevin2cr2: Do you think critical info is on the usb port?  I was hoping it was just a serial port with a ppp interface..
23:46.44cr2the usb says "vendor specific" protocol:
23:46.47cr2http://wiki.xda-developers.com/index.php?pagename=ApacheProgress
23:47.45pH5what is the difference between gpio 45 HWRTS and BTRTS mode (alt2 / alt3)?
23:48.06pH5the bootloader switches to HWRTS during reset
23:50.56cr2HW ? it's pxa26x-specific.
23:52.24Kevin2I thought fimbulvetr said he was able to get a serial port active on it.
23:54.46cr2Kevin2: you can force-load usbserial, but will it work ?
23:55.56pH5that's indeed strange. I'm on pxa272, the dev manual says that alt3 out is SSPSYSCLK3
23:59.17pH5ahh, I read it wrong. that was a bic, not an orr.

Generated by irclog2html.pl by Jeff Waugh - find it at freshmeat.net! Modified by Tim Riker to work with blootbot logs, split per channel, etc.