I have not been able to find anything more detailed about the internals of the AI Thinker A6 GSM modem.

I bought one, fired up my heat air gun and:


We can see two major components:

A RDA8851MS controller and a RDA6625e frontend

At the same time I am looking for an SDK to it. So called CSDTK.

I have got a NewPos NEW6210 mPOS to do some application development.

I wanted to get the development env rolling on my Ubuntu 14.04
The manual suggests using 32 bit RedHat Enterprise Server 6 x86 32bit version, but you know no pain no gain.

The documentation and the overall quality of the support is something what you expect from a typical chinese company. You got an FTP access and figure out what you need.

So let's get a gcc to compile a hello world. The official toolchain is based on a 32 bit glibc-oabi-toolchain-arm-generic compiler.

To get this tool working you will need a 32 bit build of the mpfr-2.4.2 (the manual lists it as reqirement too -- Because this toolchain uses a high grade version of GCC toolchain, --).
You can grab it from here:
http://www.mpfr.org/mpfr-2.4.2/mpfr-2.4.2.tar.bz2

Some things are changed around the gmp so replace all occurrences of __gmp_const with a simple const. (Do it with sed or whatever you like).
./configure --prefix=/usr "CFLAGS=-m32" "CXXFLAGS=-m32" "LDFLAGS=-m32"
To compile it to 32 bit you will need to set the proper cflags.
./configure --prefix=/usr "CFLAGS=-m32" "CXXFLAGS=-m32" "LDFLAGS=-m32"

After installing it the cross compiler will claim about the missing libgmp.so.3.

Install the 32 bit version of the libgmp10 lib with:
sudo apt-get install libgmp10:i386

Then create a symlink:
sudo ln -s /usr/lib/i386-linux-gnu/libgmp.so /usr/lib/i386-linux-gnu/libgmp.so.3

Aaaannnd at this point we have a somewhat working crosscompiler.

ATM I cannot ssh to the target, as the manual says, so stay tuned!

I have a system bootlog from UART, which reveals some deeper details about the HW:

[secu] S-Boot: v1.0.6_C (2014-12-25 14:31:09)
[secu] DDR initialization...
[secu] Reset DDR Controller
[secu] Configuring DDR
[secu] mclk = 133, auto refresh = 0x3df
[secu] DDR DLL locked...!!!
[secu] Doing DDR data eye training sequence ....
[secu] DDR data eye training sequence passed...!!!
[secu] Tamper Status: None
[secu] Boot(3): 2016-08-30 12:34:08
[secu] NAND: ESMT NAND 128MiB 1,8V 16-bit, ID = 0xc8-0xb1
[secu] U-Boot loading from NAND 0x20000 ==> 0x41bfffc0 0x670e8 bytes
[secu] Switching to Open mode... Done
[open] Start U-Boot at 0x41c00000 ...
U-Boot 2011.12-svn499 (Jun 18 2015 - 09:16:15)
Copyright (C) 2012 by LiHua_338@163.com
U-Boot code: 41C00000 -> 41C60338 BSS: -> 41CA3338
CPU: BCM5892-0300
FCLK: 400 MHz
HCLK: 133 MHz
MCLK: 133 MHz
PCLK: 66 MHz
DRAM: 64 MiB
NAND: 128 MiB
*** Warning - bad CRC, using default environment
LCD Type: 320*240ch
hx8347_hw_init ID: 95
LCD Chip: 0x00008347
In: serial
Out: serial
Err: serial
Update by USB: None
Update by local: None
Hit any key to stop autoboot: 0

Search kernel...Creating 1 MTD partitions on "nand0":
0x000000600000-0x000004000000 : "mtd=2"
Loading kernel: 0%Loading file '/boot/uImage' to addr 0x40400000 with size 2153084 (0x0020da7c)...
Done
Booting kernel ... ## Booting kernel from Legacy Image at 40400000 ...
Image Name: Linux-2.6.32.65-bcm5892-secure
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2152564 Bytes = 2.1 MiB
Load Address: 40008000
Entry Point: 40008000
Loading Kernel Image ... OK
OK
Starting kernel ...
[ 0.460000] bootmemheap_init: Error - bootmemheap_setup() not called
INIT: version 2.88 booting

INIT: Entering runlevel: 3
$Install driver fusion: [ 4.050000] fusion: unable to register major 250. Registered 248 instead
[ OK ]
$Install driver bcm589x_otg: [ OK ]
$Install driver g_serial: [ OK ]
$Install driver bcm589x_spi: [ OK ]
$Install driver leds: [ OK ]
$Install driver beeper: [ OK ]
$Install driver matrix_keys: [ OK ]
$Install driver bcm5892_adc_driver: [ OK ]
$Install driver touch_screen: [ OK ]
$Install driver iso7816_uart: [ OK ]
$Install driver iccard: [ OK ]
$Install driver nfc: [ OK ]
$Install driver nfc_pn512: FATAL: Error inserting nfc_pn512 (/lib/modules/2.6.32.65-bcm5892-secure/kernel/drivers/char/nfc/nfc_pn512.ko): No such device
[FAILED]
$Install driver nfc_rc663: [ OK ]
$Install driver magstripe: [ OK ]
$Install driver idtechencmag: [ OK ]
$Install driver bcm589x_pm: [ OK ]
$Install driver dhd: [ OK ]
$Install driver pdriver: [ OK ]
$Install driver pdriver_file: [ OK ]
$Install driver pdriver_printer: [ OK ]
$Install driver pdriver_uart: [ OK ]
$Install driver modem: [ OK ]
$Install driver slnsp: [ OK ]
$Install driver cx930xx: [ OK ]
$Install driver bcm_new_udc_dwc: [ OK ]
$Starting mdev: [ OK ]
$Setting clock (localtime): Tue Aug 30 12:34:22 CEST 2016 [ OK ]
$Starting network: [ OK ]
$Starting system logger: [ OK ]
$Starting kernel logger: [ OK ]
$Starting system message bus: [ OK ]
$Starting system update:


Create a square label with fixed size, let's say 24*24px.

Use the following stylesheet:
"background-color: rgb(85, 255, 0); border-radius: 12px;"

Change/clear the stylesheet when the LED is off.

A while ago I have bought a Hi3518 based camera module from the Aliexpress.

It is called BLK18E-0712C-38X38_S (V1.01)

Some initial findings:

- No DHCP is set. Static IP at 192.168.1.10
- Default username for HTTP and RSTP is admin with blank password.
- HTTP interface lang is set to chinese atm. I have no idea where to change this.
- Streaming is done through RSTP on the following URL: rtsp://192.168.1.10:554/user=admin&password=&channel=1&stream=0.sdp?real_stream--rtp-caching=100
(Firefox did not have a plugin for this on Ubuntu, but VLC plays the stream well.)
- I have tried several telnet passwords which is out in the wild root+(juantech, klv123) but neither let me in.

NMAP log shows nothing more intresting (port 8899 IMHO for onvif):

PORT STATE SERVICE VERSION
23/tcp open telnet Busybox telnetd
80/tcp open tcpwrapped
|_http-favicon: Unknown favicon MD5: EC9D1C872C50DD7DA7D826D9C85FC158
|_http-methods: No Allow or Public header in OPTIONS response (status code 200)
|_http-title: NETSurveillance WEB
554/tcp open rtsp?
| rtsp-methods:
|_ OPTIONS, DESCRIBE, SETUP, TEARDOWN, GET_PARAMETER, PLAY, PAUSE
8899/tcp open soap gSOAP soap 2.7


Bonus:
I have managed to find the UART on the device:



Uboot output:

U-Boot 2010.06-svn (Jan 04 2015 - 13:37:41)

DRAM: 256 MiB
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x17 0xC2 0x20 0x17
Spi(cs1): Block:64KB Chip:8MB Name:"MX25L6406E"
envcrc 0xc96922ac
ENV_SIZE = 0xfffc
In: serial
Out: serial
Err: serial
Press Ctrl+C to stop autoboot
hisilicon # <INTERRUPT>
hisilicon # <INTERRUPT>
hisilicon # <INTERRUPT>
hisilicon # <INTERRUPT>
hisilicon # help
? - alias for 'help'
base - print or set address offset
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
cmp - memory compare
cp - memory copy
crc32 - checksum calculation
fload - fload - load binary file from a filesystem image for system boot

flwrite - SPI flash sub-system
getinfo - print hardware information
go - start application at address 'addr'
help - print command description/usage
lip - lip - set local ip address but not save to flash

loadb - load binary file over serial line (kermit mode)
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
mac - mac - set mac address and save to flash

md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mtest - simple RAM read/write test
mw - memory write (fill)
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
sip - sip - set server ip address but not save to flash

tftp - tftp - download or upload image via network using TFTP protocol
version - print monitor version

I got a task to get a CSMIO/IP-M based machine running.
First I have started the experimentation in Virtualbox.
Installed MACH3, and the CSLab plugin. From MACH 3 it says it needs firmware update. Okay, let's check the firmware updater!

I have started to have bad feelings when it started with the following message:

Float point division by zero.

What?

After passing this dialog here is the main screen:


Okay, it must be some problem with the Virtualbox.
So I have setup a Windows based machine, and it produced the same there. Contacted with the support, but no response.

While waiting to their support I have fired up my VBox and accidentally resized my Virtualbox window, and guess what:


After this trick I have been able to flash my drive and use the MACH3 later.

Driven by the curiosity I have tried to change the resolution on the native machine, but it did not helped, however the buttons are working even if you do not see anything in the window. So if you need this tool try to click blindly and it will ask for the FW upload file. They attached two files, nothing says which one needs to be flashed, so T have flashed both and it runs now.

Bastards!