diff --git a/_media/c62_bk4819.jpeg b/_media/c62_bk4819.jpeg new file mode 100644 index 0000000..b176c3a Binary files /dev/null and b/_media/c62_bk4819.jpeg differ diff --git a/_media/c62_csk6011b.jpeg b/_media/c62_csk6011b.jpeg new file mode 100644 index 0000000..b999094 Binary files /dev/null and b/_media/c62_csk6011b.jpeg differ diff --git a/_media/c62_mainboard.jpeg b/_media/c62_mainboard.jpeg new file mode 100644 index 0000000..c7eb172 Binary files /dev/null and b/_media/c62_mainboard.jpeg differ diff --git a/hardware/c62.md b/hardware/c62.md new file mode 100644 index 0000000..57b19ad --- /dev/null +++ b/hardware/c62.md @@ -0,0 +1,133 @@ +# Retevis C62 + +## Development Status + +**⚠️ Important Note: The Retevis C62 is not yet ready to run M17 protocol. While the hardware is capable of supporting M17, firmware development is currently in progress.** + +The C62 was identified as a candidate for M17 development after discovering an undocumented DMR-like digital mode in its factory firmware, which prompted investigation into its suitability for open-source protocol implementation. + +## Device Models +- Retevis C62 5W Long Range UV Dual Band Business Radio + +## Specifications + +### General Specifications +* **Power Output**: 5W +* **Frequency Bands**: Dual Band (UV - specific ranges TBD) +* **Display**: TBD +* **Battery**: TBD +* **AI Noise Reduction**: Built-in AI noise reduction technology + +## Hardware Configuration + +### Key Components +* **Main MCU**: ListenAI CSK6011B +* **RF Front-end**: BK4819 (same chip used in UV-K5 radios) +* **FM Receiver**: BK1080 + +### Hardware Images + +#### Main Processor (CSK6011B) +![CSK6011B Main Processor](../_media/c62_csk6011b.jpeg) + +#### RF Front-end (BK4819) +![BK4819 RF Chip](../_media/c62_bk4819.jpeg) + +#### Main Board Overview +![C62 Main Board](../_media/c62_mainboard.jpeg) + +## Development Environment + +### Docker Setup +The C62 development environment uses Docker for cross-platform compatibility: + +```bash +docker run --platform linux/amd64 --privileged -v /dev:/dev -v /run/udev:/run/udev -it listenai/csk6:latest +``` + +**Note**: The `--platform linux/amd64` flag is required only when developing on M-series Mac computers. + +### Required Hardware +* **Programming Cable**: TalkPod A36 (recommended) +* **Debug Access**: Debug pads located on opposite side of CSK6011B chip + +## Firmware Development + +### Firmware Extraction +To extract the original firmware for analysis: + +```bash +cskburn --read "0x0000000:4096000:app.bin" -C 6 -b 115200 -v -s {device} +``` + +**Parameters:** +- `0x0000000:4096000:app.bin`: Read 4MB starting from address 0x0 +- `-C 6`: Communication parameter 6 +- `-b 115200`: Baud rate 115200 +- `-v`: Verbose output +- `-s {device}`: Specify device path + +### Development Tools +* **Reverse Engineering**: Ghidra with armv8-LE processor definitions +* **Firmware Tool**: Modified cskburn from OE3ANC + +## Hardware Disassembly + +### Disassembly Process +1. Remove 4 corner screws from the radio case +2. Carefully disconnect the volume knob +3. Disconnect the antenna connection +4. Remove the screen carefully (secured by 2 clips) +5. Separate internal components to access main board +6. Locate debug pads on the opposite side of the CSK6011B chip + +**⚠️ Caution**: Handle internal components with care, especially the screen and cable connections. + +## Build Instructions + +### Development Environment Setup +1. Install Docker on your development machine +2. Pull the ListenAI CSK6 development image: + ```bash + docker pull listenai/csk6:latest + ``` +3. Run the development container with appropriate permissions +4. Set up the modified cskburn tool for firmware operations + +### Firmware Development Status +* **Current Status**: Firmware development in progress +* **Memory Mapping**: Incomplete - community contributions welcome +* **Decompilation**: Partial success with Ghidra armv8-LE definitions +* **Target Protocol**: M17 implementation planned + +## Technical Notes + +### Unique Characteristics +* Undocumented digital mode discovered in factory firmware +* Shares BK4819 RF chip with popular UV-K5 platform +* ListenAI CSK6011B processor offers development potential +* Hardware architecture suitable for M17 protocol implementation + +### Development Challenges +* Incomplete memory map requires further reverse engineering +* Decompilation accuracy needs improvement +* Community contributions needed for complete chip understanding + +### Hardware Compatibility +* BK4819 RF chip provides proven radio frequency performance +* CSK6011B processor architecture supports complex protocol development +* Hardware debugging access available through exposed pads + +## Community Development + +The C62 development effort welcomes community contributions, particularly in: +* Complete memory map development +* Improved decompilation accuracy +* M17 protocol firmware implementation +* Hardware debugging and analysis + +--- + +*Hardware analysis and development information from:* +- *GitHub Repository: https://github.com/JKI757/C62_Teardown* +- *Official Product Information: https://www.retevis.com/retevis-c62-5-w-long-range-uv-dual-band-ai-noise-reducation-business-radio-us* \ No newline at end of file diff --git a/hardware/cs7000.md b/hardware/cs7000.md new file mode 100644 index 0000000..e2b50f1 --- /dev/null +++ b/hardware/cs7000.md @@ -0,0 +1,181 @@ +# CS7000-M17 + +## Device Models +- Connect Systems CS7000-M17 +- Connect Systems CS7000-M17 Plus + +The CS7000-M17 series represents the first amateur digital radios specifically designed for M17 protocol support while maintaining compatibility with traditional DMR and analog modes. + +## Model Variants + +### CS7000-M17 (Standard) +- Basic M17/DMR/Analog radio +- Optional GPS module +- Standard processing capabilities + +### CS7000-M17 Plus +- Built-in GPS +- Built-in Bluetooth +- Man Down Sensor +- Vibrator +- Enhanced processing (3x faster processor) +- Expanded memory configuration +- Advanced protocol development capabilities + +## Specifications + +### Common Specifications (Both Models) +* **Display**: 1.8" color TFT, 160x128 resolution +* **Frequency Range**: 400-512 MHz (UHF) +* **Receiver Type**: Dual Conversion Superhetrodyne +* **Front-end**: Varactor tuning +* **Battery**: 2400 mAh with belt clip +* **Waterproof Rating**: IP67 +* **Programming Port**: Compatible with Motorola +* **Accessories Included**: Programming cable, power supply, and charger + +### Memory Configuration + +| Component | CS7000-M17 | CS7000-M17 Plus | +|-----------|-------------|------------------| +| Flash Memory | 128MB | 256MB | +| Code Memory | 1MB | 2MB | +| RAM | 384KB | 1MB | + +## Hardware Configuration + +### MCU and Baseband +* **MCU**: STM32F405VG (CS7000-M17), STM32H743VI (CS7000-M17 Plus) +* **DMR Baseband**: HR-C6000 +* **RF Chip**: SKY72310 +* **Display Controller**: HX8302A +* **Non-volatile Memory**: 25Q128FV SPI flash +* **GPS**: MC-1010-2RE (Plus model built-in, standard model optional) + +### Additional Hardware (Plus Model Only) +* Built-in Bluetooth module +* Man Down Sensor +* Vibrator motor +* Enhanced processing unit (3x faster than standard DMR radios) + +## Firmware Features + +### Multi-Protocol Support +The CS7000-M17 series supports multiple digital protocols: +- **M17 Protocol**: Native support for the open-source M17 digital mode +- **DMR**: Full DMR digital mode compatibility +- **Analog**: Traditional FM analog operation + +### DMR Mode Features +* Digital encryption +* Voice auto record +* Channel voice announcement +* CTCSS/DCS encode and decode +* DTMF/MDC1200/2 Tone/5 Tone encode and decode +* Dual priority scan +* VOX (Voice Operated eXchange) +* Kill/Revive functionality +* DMR slot, color code, and contact support + +## Development Features + +### Enhanced Development Capabilities (Plus Model) +- Increased program memory for complex protocol stacks +- Expanded Flash and RAM + +## Build Instructions +The CS7000 plus adopts a relatively complex procedure for storage of firmware. First, it stores two different applications, and must be rebooted between use of DMR and M17. + +If you need to flash the radio, the instructions are here: +[CS7000 M17 Plus Software](https://www.connectsystems.com/amateur-software/CS7000_m17_plus_software.html) + +Flashing the radio in the factory manner requires windows and the use of the factory flash tool. + +If you all you want on the radio is openRTX for FM/M17 use, there is an alternate procedure that involves rebuilding/linking OpenRTX. That procedure can be done on Linux/Mac. + +Again, be aware, you will *NOT* have DMR capability if you flash the radio this way. + +Procedure follows: + +Make the following modifications: + +[meson.build](https://github.com/OpenRTX/OpenRTX/blob/master/meson.build) (currently on line 892) +The code section looks like this: + +``` +{ + 'name' : 'cs7000p', + 'opts' : cs7000p_opts, + 'flashable': true, + 'wrap' : ' ', + 'load_addr': '0x08100000' +}, +``` + +You need to replace the `load_addr` with `0x08000000` + +And the second file: +[linker_script_cs7000p.ld](https://github.com/OpenRTX/OpenRTX/blob/master/platform/mcu/STM32H7xx/linker_script_cs7000p.ld) (currently line 52) + +The code section looks like this: + +``` +MEMORY +{ + flash(rx) : ORIGIN = 0x08100000, LENGTH = 1M + + /* NOTE: for now wer support only the AXI SRAM */ + ram(wx) : ORIGIN = 0x24000200, LENGTH = 512K-0x200 +} +``` + +Again, you need to replace the "origin" variable with `0x08000000` + +When this is complete, build the firmware using the commands from the developer's guide: + +```bash +meson setup --cross-file cross_cm7.txt build_arm +``` + +Then put the radio into dfu mode (press TK1 and hold while turning the radio on -- you should see a grey screen) + +Then run: +```bash +meson compile -C build_arm openrtx_cs7000p_flash +``` +This will take a while without a lot of output, and there won't be any indication on the radio. Just wait. + +Eventually you'll get some output and then it should finish up with this: + +``` +DfuSe interface name: "Internal Flash " +Downloading element to address = 0x08000000, size = 200496 +Erase [=========================] 100% 200496 bytes +Erase done. +Download [=========================] 100% 200496 bytes +Download done. +File downloaded successfully +``` + +The size could be slightly different if you're not building the same version as this was taken from, but the start address is what's important. + +Reboot the radio and it will boot into OpenRTX. You will *NOT* have DMR capability if you flash the radio this way. + + + +## Technical Notes + +### Unique Characteristics +- First amateur digital radio designed specifically for M17 protocol +- Hardware optimized for multi-protocol operation +- Enhanced memory architecture supporting protocol flexibility +- Professional-grade build quality with IP67 rating + +### Development Considerations + +--- + +*Information gathered from Connect Systems product specifications at:* +- *https://www.connectsystems.com/products/top/radios/CS7000_M17.htm* +- *https://www.connectsystems.com/products/top/radios/CS7000_M17_PLUS.htm* +- *https://www.connectsystems.com/amateur-products/CS7000-M17-plus.html* \ No newline at end of file diff --git a/hardware/hardware.md b/hardware/hardware.md index 151ced9..3c8409c 100644 --- a/hardware/hardware.md +++ b/hardware/hardware.md @@ -16,6 +16,7 @@ This table provides a glance on the underlying hardware of each of the supported | T-TWR Plus | ESP32-S3 | SA868S | AT1846S | SH1106 | optional microSD | L76K | | CS7000-M17 | STM32F405VG | HR-C6000 | SKY72310 | HX8302A | 25Q128FV SPI flash | MC-1010-2RE| | CS7000-M17 Plus| STM32H743VI | HR-C6000 | SKY72310 | HX8302A | 25Q128FV SPI flash | MC-1010-2RE| +| C62 | CSK6011B | - | BK4819 | TBD | TBD | - | ### Device documentation @@ -28,3 +29,5 @@ This table provides a glance on the underlying hardware of each of the supported * [Anytone UV878](hardware/uv878.md) * [LILYGO T-TWR Plus](hardware/ttwrplus.md) * [Radtel RT-4D](hardware/rt4d.md) +* [Connect Systems CS7000-M17 and CS7000-M17 Plus](hardware/cs7000.md) +* [Retevis C62](hardware/c62.md)