OpenDMR
This project started by an idea of a colleague of mine, Niccolò Izzo (IU2KIN), and is heavily inspired by another open-source project, OpenGD77.
Aim of this project, following the trail of the OpenGD77 people, is developing (nearly) from scratch an open-source firmware for the Tytera MD-380 radio transceiver. Future plans envisage merging our work with the OpenGD77 one, creating a unique open-source firmware for multiple radio transceivers.
We ground our work on the reverse-engineering efforts of Travis Goodspeed and other people, which allowed to have an extensive documentation of the radio hardware: we have complete schematics, baseband documentation, and the on-board microcontroller (STM32) is well-known.
As regards flashing and running the new firmware on the radio, we worked to leave untouched the original Tytera recovery bootloader: this allows for an easy rollback to the original (or md380tools) firmware in case this is needed. A virtual serial port over USB has been set up also, currently used only for debugging.
The source code is available in this GitHub repository, with a minimal and sparse documentation available here.
Current progress:
[x] Craft jailbreak bootloader
[x] Put radio in STM32 bootloader mode
[x] Dump all the flash from bootloader
[x] Flash the jailbreak recovery
[x] Correctly flash arbitrary payload with TYT recovery
[x] Boot baremetal blinking LED
[x] Test interrupts
[x] Expand RAM at 0x02020000
[x] Boot FreeRTOS blinking LED
[x] USB Virtual Serial is working
[x] stdio to Virtual Serial
[x] Keyboard handler
[x] Channel knob + buttons
[x] Display driver
[x] ADC
[ ] UI
[x] Rectangles
[x] Text
[ ] All shapes
[ ] RSSI + Battery demo
[x] RTC
[x] Watchdog
[ ] FM is working!
[ ] Rebase on OpenGD77 codebase
[ ] Flash
[ ] EEPROM
[ ] C5000 registers!
[ ] SPI is working
[ ] I2C is working
[ ] DMR Tier 1
[ ] DMR Tier 2
[ ] Fancy display graphics
[ ] Hotspot mode
[ ] SMS
[ ] GPS
[ ] …
Note: even if present in the progress list, it’s not strictly necessary to craft a jailbroken recovery bootloader to run the new firmware. As described in the Travis Goodspeed’s writeup, the recovery bootloader patch prevents it from setting the flash read protection flag, allowing to do a complete flash dump through the SWD debugging interface.
References:
[2] OpenGD77 project’s repository
