OsmocomDECT » Misc DECT hacks

h1. Gigaset Elements Base

h2. Hardware

* Dialog SC14452 CR16C based DECT SoC

* Dialog LMX4181 RF frontend

* Winbond W9825G6KH-6 RAM

* SMSC 8720A Ethernet PHY

* MX25??? QSPI flash

{{thumbnail(20221211_104138.jpg)}}

{{thumbnail(20221211_104127.jpg)}}

{{thumbnail(20221211_104300.jpg)}}

{{thumbnail(20221211_104108.jpg)}}

{{thumbnail(20221211_104324.jpg)}}

{{thumbnail(20221211_104059.jpg)}}

h3. Connectors / Test Pads

h4. 3-pin UART header

There is an unpopulated 3-pin 2.54mm header on the board.  It has the following pin-out, in left-toright direction when looking at the component side of the PCBA with the ethernet jack facing downwards:

|_.Pin|_.Signal|

|left|P0 [1] / URX|

|center|GND|

|right|P0 [0] / UTX|

The voltage of the UART is about 3.2V; the data sheet states up to 3.45V should be fine, so a normal 3.3V UART should work.

h4. 2-pin jumper

There is an unpopulated 2-pin 2.54mm header on the board. It has the following pin-out, in left-toright direction when looking at the component side of the PCBA with the ethernet jack facing downwards:

|_.Pin|_.Signal|

|left|GND|

|right|P2 [5] / ADC1|

h4. Row of large test pads

There is a row of large (3mm?) test pads close to the unpopulated 3pin header / 2pin jumper. It has the following pin-out, in left-toright direction when looking at the component side of the PCBA with the ethernet jack facing downwards:

|_.Pin|_.Signal|

|1 (left)|P2 [5] / ADC1|

|2|6.5V voltage input|

|3|GND|

|4|P0 [1] / URX|

|5 (right)|P0 [0] / UTX|

h4. test pads on the back side

FIXME: Picture with annotations.  So far we know the single-wire JTAG pin.

h2. Open Source Tarball

In remarkably good compliance with the GNU GPLv2, Gigaset has published a tarball containing the _complete and corresponding_ soure code for the open source parts of the firmware.

h2. building

It can be built on a current (Debian 11) system, if you install the following dependencies:

<pre>

apt install genromfs build-essential default-jdk gcc-multilib lib32z1

dpkg --add-architecture i386

apt update

apt install liblzo2-2:i386

</pre>

After that, you shoul be able to compile it using the instructions from the README_BUILDING file that's in the source code.

h2. flashing

<pre>

HomeConnector_001.000.026/uniprog $ ./uniprog.sh

Creating empty file:

   size         0 kB

   file:       'reef_boot_rec_sys_fs.bin'

Inserting image file:

   file        'image452.bin'

   at offset    0

   size         131072

Inserting image file:

   file        '../reef_vmlinuz-recovery'

   at offset    131072

   size         819200

Inserting image file:

   file        '../reef_vmlinuz'

   at offset    950272

   size         2560000

Not creating new filesystem image.

Using old one: ../reef_fs.bin

Inserting image file:

   file        '../reef_fs.bin'

   at offset    3510272

   size         1138688

/tmp/HomeConnector_001.000.026 /tmp/HomeConnector_001.000.026/uniprog

/tmp/HomeConnector_001.000.026/uniprog

----------------------------------------------------------

 Image: / (size 4648960) created.

----------------------------------------------------------

To skip this question, you can assign serial port to environment variable PROGRAM_PORT or PORT

Please choose serial port:

1) ttyS0      3) ttyS2     5) ttyUSB0   7) ttyUSB2   9) ttyUSB4

2) ttyS1      4) ttyS3     6) ttyUSB1   8) ttyUSB3  10) ttyUSB5

#? 10

Programming HW via /dev/ttyUSB5

Please do following things:

1. Push "Program" button,

2. Push "Reset" button,

3. Pop "Reset" button,

4. Pop "Program" button.

Be patient

Programmer File Size 3464

Programmer File CRC 0x6E

Image File Size 4648960

Image File CRC 0x62

--- IDLE ---

Uart RX[1]=0xFE,...

state IDLE rec: 0xFE

--- IDLE ---

Uart RX[1]=0x02,...

state IDLE rec: 0x02

Uart TX[3]=0x01,...

Downloading programmer & image...

--- WAIT_ACK ---

Uart RX[1]=0x06,...

state WAIT_ACK rec: 0x06

ACK received, flashing loader (size 3464)...

Uart TX[3464]=0x04,...

--- WAIT_CRC ---

Uart RX[1]=0x6E,...

CRC expected 6E, received 6E CRC OK

Uart TX[1]=0x06,...

--- CHANGE_UART_BPS ---

--- PROG_IDLE ---

Uart RX[1]=0x05,...

Writing image header...

Uart TX[5]=0x03,...

--- PROG_WAIT_ACK ---

Uart RX[1]=0x07,...

Writing image (size 4648960)...

Uart TX[4648960]=0x70,...

--- PROG_WAIT_CRC ---

Uart RX

FIXME

</pre>