Database Users

Some words about bluetooth....

Hi,
i know there are a lot of threads about all this stuff already and i also know that the hero is not the latest gadget anymore.
Anyway, a few days ago i started investigating on the bluetooth sub-system running on my HTC Hero. I tried to find out how things work out on latest stock ROM 3.32.405.2 compared to some of latest nightly ROM builds based on cyanogen.
I just wanted to post what i found out in the meantime and what might be worth discussing. Here we go
The chipset:
Th Hero in fact uses a BRF6350 from Texas Intruments which is a successor of the BRF6300. This chip definitely has FM capabilites, but there's no access to this function per default.
It is yet unknown if the hardware connections would basically support this option, if set up correctly.
Again, there is some basic information at TI's website:
http://focus.ti.com/general/docs/wt...ateId=6123&navigationId=12659&contentId=14646
I also found a very interesting document in the web, that gives a more detailed block diagram of the BRF6350 chipset (see attachment).
The firmware:
In stock ROM there's only a BRF6300 firmware file, though a BRF6350 is used one the mainboard.
On the latest cyanogen nightly builds there's also a BRF6350 firmware file.
See this thread for more: http://forum.xda-developers.com/showthread.php?t=704976
I could not find out what is the origin of this file, maybe it was extracted form a WM-ROM...
Who ever knows more about it please post it here!
Anyway the firmware get's loaded during boot up, using a service call in init.hero.rc. This one is common in stock and AOSP ROM's:
Code:
service hciattach /system/bin/hciattach \
-n -s 115200 /dev/ttyHS0 texasalt 4000000 flow
user bluetooth
group bluetooth net_bt_admin
disabled
On stock ROM there's an additonal service started in init.hero.rc:
Code:
#btips - 2.22
service btips /system/bin/btipsd --logfile /data/btips/btips_log.txt -no_android_log
socket bluetooth stream 660 bluetooth bluetooth
socket dbus_bluetooth stream 660 bluetooth bluetooth
group bluetooth net_bt_admin misc
disabled # the MCP monitor service is responsible for bringing up the daemon
oneshot
AFAIK, this service is needed to start the TI bluetooth stack and does a more specific setup of the chipset.
Also it might be possible, that on stock ROMs hciattach is obsolete and btipsd in fact loads the BRF6300 firmware to the BRF6350 chipset. Some further investigation is required here...
There'd also been some discussions early this year in the IRC channel about btipsd.
By stepping through the binary, i found out that btipsd also includes some hard coded start-up scripts (*.bts).
These are similar to the scripts located in /etc/firmware.
The scripts:
After the firmware has been transferred to the chipset, a basic setup has to be made. So that's what these scripts are doing.
The firmware uses some binary command mode to communicate at this point.
Also some tweaks might be injected to match the current API.
These are the basic scripts located in /etc/firmware (stock ROM and AOSP):
avpr.bts (Description: BRF6450 AVPR FW Initialization Script, Compatibility: BRF6450 PG1 ROM)
fm_rx_init_1273.2.bts (Description: This script could be used to put the FM IP in RCV mode)
fmc_init_1273.2.bts (Description : FM Firmware Patch - v2.140, Compatibility : BL6450 2.1, BL6450 3.0, WL127x 2.0, NL55xx 2.0 ROM)
tiinit_5.3.53.bts (Description : BRF6350 2.11 ROM Initialization Script, Compatibility: BRF6350 2.11 ROM)
It seems that these scripts are generic and are used on other platforms as well. By extracting the debug messages of these scripts, if found out, that on stock ROM none of them is matching to the given firmware (BRF6300.bin).
In other words they seem to be useless!
By integrating BRF6350.bin into the AOSP ROMs, there's only one that maybe used: tiinit_5.3.53.bts
Some cross referals....
E.g. the Xperia X1 (also uses BRF6350 chipset) got a couple init scripts to match different firmware versions:
TIInit_5_3_53.bts (Description : BRF6350 2.11 ROM Initialization Script, Compatibility: BRF6350 2.11 ROM)
TIInit_5_2_34.bts (Description : BRF6350 2.34 ROM Initialization Script, Compatibility: BRF6350 2.34 ROM)
TIInit_4_2_38.bts (Description : BRF6300 1.31 ROM Initialization Script, Compatibility: BRF6300 1.31 ROM)
Inside Xperia X1 ROMs there are also some scripts to activate FM radio on a BRF6530 chipset
Fm_on_2_0.bts
Fm_on_2_1.bts (Description : BRF6350 2.11 FM Initialization, Compatibility: BRF6350 2.11 ROM)
FMInit_2.bts (Description : BRF6350 2.0 FW 2.34 FM Initialization, Compatibility: BRF6350 2.0 ROM w/ 2.0.34 Firmware)
There's also a package called HTC tools for the WM phones (HTC Diamond, HTC Raphel, etc) including similar scripts for FM.
So maybe it will be possible some day to tweak Hero ROMs and make use of these scripts. This would probably solve this issue: http://forum.xda-developers.com/showthread.php?t=533780
The stack:
HTC Hero stock ROM's use TI proprietary bluetooth stack.
The HCI communication to the chipset is mainly done through btipsd, which is also closed source.
There's also some nice command line interface (btipsd_cli) to gather some low level information.
Some proprietary libraries might be in use for the stack as well...
The firmware file is BRF6300.bin.
On the AOSP ROMs the bluetooth framework is little more open.
AFAIK the BlueZ stack is used on these ROMs.
The HCI communication seems to rely entirely on hci toolset (e.g. hciattach, hciconfig, hcitool...)
The latest cyanogen nightly ROMs make use of BRF6350.bin.
As already stated, i just started to investigate a few days ago...
... still many secrets and still little confusing, but i just wanted to start collecting some information and give it out to the community.
Another nice thread at G1 sub-forum: http://forum.xda-developers.com/showthread.php?t=527027
Please post your knowledge here or correct me, if i pointed out something wrong!
TBC....
Best regards,
scholbert

extended info about *.bts files
Init files from HTC Hero...
Debug strings in fm_rx_init_1273.2.bts:
Code:
0x24 0x4F # +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
0x78 0x1B # RCV Power On - v0.8
0x9E 0x4A # Description: This script could be used to put the FM IP in RCV mode
0xED 0x19 # Author: Manav
0x010B 0x17 # Date: Dec 29, 2007
0x0127 0x14 # Changes:
0x0147 0x20 # 0] Dec'29 2007 - Initial Edits
0x016C 0x43 # 1] Jan'31 2008 - Clean up - Moved register settings to code patch
0x01B4 0x1C # 2] Mar'15 2008 - No Change
0x01DB 0x2E # Notes: Use this script after running FM Init
0x020E 0x50 # ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
0x026D 0x22 # Putting the Synth in Closed Loop
0x02BD 0x57 # Select if RDS is needed (Make fm_rcv_mode =3 for RDS and FM and =1 for only FM Audio)
0x0319 0x10 #fm_rcv_mode = 3
0x033C 0x52 # RCV POWER ON API (Arg = 3 for both FM Audio and RDS / Arg = 1 for only FM Audio)
0x03B8 0x0E #Audio Enable.
0x03CB 0x31 #Send_HCI_VS_I2C_Write_to_FM 0xFD35, 0x1D, 0x0002
0x0401 0x4C #Wait_HCI_Command_Complete_VS_I2C_Write_to_FM_Event 5000, 0x00, 0xfd35, 0x00
Debug Strings in fmc_init_1273.2.bts:
Code:
0x29 0x53 #--------------------------------------------------------------------------------
0x81 0x2D # Description : FM Firmware Patch - v2.140
0xBA 0x21 # Author : Sumeer Bhatara
0xE8 0x46 # Compatibility : BL6450 2.1, BL6450 3.0, WL127x 2.0, NL55xx 2.0 ROM
0x013B 0x1D # Last Updated : 02/06/2009
0x0165 0x3C # Notes : Please refer to the SP2.22 RN for details
0x01A6 0x53 #--------------------------------------------------------------------------------
0x020D 0x39 # FM ON Command - This would activate the I2C co-relator
0x0250 0x29 #Send_HCI_VS_I2C_FM_POWER_MODE 0xFD37, 1
0x027E 0x60 #Wait_HCI_Command_Complete_VS_I2C_FM_POWER_MODE_Event 5000, any, HCI_VS_I2C_FM_POWER_MODE, 0x00
0x02E8 0x1F #time needed for APLL to lock
0x030C 0x0A #sleep 30
0x0345 0x0D #Data patch
0x035C 0x1B # PA VOLTAGE TABLE CHANGE
0x08A1 0x35 #Program the g_tCapAdjTable[5] = {-2, -1 ,0 ,2 ,4 }
0x08DB 0x32 # g_tCapAdjTable[1] = -1 , g_tCapAdjTable[0] = -2
0x093B 0x30 # g_tCapAdjTable[3] =2 , g_tCapAdjTable[2] = 0
0x0999 0x28 # g_tgLow[0] =2 , g_tCapAdjTable[4] =4
0x09EF 0x1F # g_tCapValTable TABLE CHANGE
0x0A13 0x20 # Program the g_tCapValTable[0]
0x0A61 0x20 # Program the g_tCapValTable[1]
0x0AAF 0x20 # Program the g_tCapValTable[2]
0x0AFD 0x20 # Program the g_tCapValTable[3]
0x0B4B 0x20 # Program the g_tCapValTable[4]
0x0B99 0x20 # Program the g_tCapValTable[5]
0x0BE7 0x20 # Program the g_tCapValTable[6]
0x0C35 0x20 # Program the g_tCapValTable[7]
0x0C8D 0x0C #Code Patch
0x4BD7 0x4F # +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
0x4C2B 0x1B # RCV Power On - v0.8
0x4C51 0x4A # Description: This script could be used to put the FM IP in RCV mode
0x4CA0 0x19 # Author: Manav
0x4CBE 0x17 # Date: Dec 29, 2007
0x4CDA 0x14 # Changes:
0x4CFA 0x20 # 0] Dec'29 2007 - Initial Edits
0x4D1F 0x43 # 1] Jan'31 2008 - Clean up - Moved register settings to code patch
0x4D67 0x1C # 2] Mar'15 2008 - No Change
0x4D8E 0x2E # Notes: Use this script after running FM Init
0x4DC1 0x50 # ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
0x4E20 0x22 # Putting the Synth in Closed Loop
0x4E70 0x57 # Select if RDS is needed (Make fm_rcv_mode =3 for RDS and FM and =1 for only FM Audio)
0x4ECC 0x10 #fm_rcv_mode = 3
0x4EEF 0x52 # RCV POWER ON API (Arg = 3 for both FM Audio and RDS / Arg = 1 for only FM Audio)
0x4F6B 0x0E #Audio Enable.
0x4F7E 0x31 #Send_HCI_VS_I2C_Write_to_FM 0xFD35, 0x1D, 0x0002
0x4FB4 0x4C #Wait_HCI_Command_Complete_VS_I2C_Write_to_FM_Event 5000, 0x00, 0xfd35, 0x00
In fact these inits are for WiLink 6.0 mobile platform WL1271/WL1273 (WLAN 802.11 a/b/g/, Bluetooth v2.1 + EDR, FM)
Debug strings in tiinit_5.3.53.bts:
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x37 # Description : BRF6350 2.11 ROM Initialization Script
0xBE 0x22 # Compatibility: BRF6350 2.11 ROM
0xEC 0x29 # Last Updated: 14-Dec-2009 15:39:50.51
0x0121 0x1D # Version : TI_P2_11.158
0x014A 0x4D # Notes : Use this script on BRF6350 2.11 ROM device only (FW v3.0.53)
0x019C 0x52 #--------------------------------------------------------------------------------
0x36C6 0x65 #####################################################################################################
0x3730 0x65 ############## BEGIN POWER TABLE SECTION ##########################################################
0x379A 0x65 #####################################################################################################
0x3D07 0x65 #####################################################################################################
0x3D71 0x65 ############## END POWER TABLE SECTION ############################################################
0x3DDB 0x65 #####################################################################################################
0x3F63 0x3E ##############################################################
0x3FA6 0x3E #### This portion of the Init Script is for custom use. #####
0x3FE9 0x3E #### Enable/Disable as required for the actual platform. #####
0x402C 0x3E ##############################################################
0x4074 0x5C ############ Fast Clock Configuration - Disable Crystal ##############################
0x40DB 0x35 # When Crystal in use - please remove this command.
0x4115 0x4C # Please refer to BT-SW-0030 Vendor Specific document for more information.
0x419A 0x42 #-----------------------------------------------------------------
0x41EB 0x18 # Enable Protocol Viewer
0x4208 0x42 #-----------------------------------------------------------------
0x4270 0x42 #-----------------------------------------------------------------
0x42C1 0x1B # Initialize voice settings
0x42E1 0x42 #-----------------------------------------------------------------
0x436A 0x51 #Send_HCI_VS_Write_CODEC_Configuration 0xFF08, 0x01, 0x00, 0x19, 0x19, 0x19, 0x01
0x43C0 0x56 #Wait_HCI_Command_Complete_VS_Write_CODEC_Configuration_Event 5000, 0x00, 0xff08, 0x00
0x4420 0x4D # Set inactivity timer to 320 frames - 400 msec (recommended for most hosts)
0x4472 0x6A # value may be reduced in accordance to host limitations for power saving (default: 80 frames - 100msec).
0x4506 0x2D # Accept PA_SD signaling from WLAN during TX
0x456F 0x15 # Enable co-existence
0x4589 0x42 #-----------------------------------------------------------------
0x45D0 0xAB #Send_HCI_VS_Write_Wlan_Configuration 0xFD1D, 0x04, 0x01, 0x05e9, 0x0000, 0x00, 0x00, "FF:FF:FF:FF:FF:FF:FF:FF:FF:FF", 0x04, 0x01, 0x00, 0x01, 0x02, 0x01, 0x00, 0xff, 0x00
0x4680 0x55 #Wait_HCI_Command_Complete_VS_Write_Wlan_Configuration_Event 5000, 0x00, 0xfd1d, 0x00
0x46DA 0x26 #set IO17 to be the BT RF-Activity pin
0x473B 0x22 # 0x5e8 - remove SCO from Priority
0x4762 0xAB #Send_HCI_VS_Write_Wlan_Configuration 0xFD1D, 0x04, 0x01, 0x05e8, 0x0000, 0x00, 0x00, "FF:FF:FF:FF:FF:FF:FF:FF:FF:FF", 0x05, 0x01, 0x00, 0x01, 0x02, 0x01, 0x00, 0xff, 0x00
0x4812 0x55 #Wait_HCI_Command_Complete_VS_Write_Wlan_Configuration_Event 5000, 0x00, 0xfd1d, 0x00
0x4876 0x18 # HCI_VS_Set_DDIP_Params
0x48BE 0x18 # Enable deep sleep mode
It seems this init could be used after brf6350.bin has been loaded on HTC Hero.
Debug Strings in avpr.bts:
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x37 # Description: BRF6450 AVPR FW Initialization Script
0xBE 0x21 # Compatibility: BRF6450 PG1 ROM
0xEB 0x2A # Last Updated: 30-Jun-2008 19:06:31.35
0x0121 0x15 # Version: 1.1
0x0142 0x52 #--------------------------------------------------------------------------------
0x019E 0x11 #Mask All domains
0x01DA 0x39 #Issue Switch On command (all domains - including wibree)
0x023E 0x29 #turn on COREX clock (should read 0xnnn9)
0x0292 0x31 # Cortex Reset (hold in reset while loading IMEM)
0x8FB4 0x15 #release Cortex Reset
This init is used for newer chipset BRF6450.
HTC Tools for WM (capable HTC Diamond, HTC Raphael, etc. to test FM radio) includes some FM init scripts.
Debug Strings in FMInit_2.bts:
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x35 # Description : BRF6350 2.0 FW 2.34 FM Initialization
0xBC 0x33 # Compatibility: BRF6350 2.0 ROM w/ 2.0.34 Firmware
0xFB 0x1C # Last Updated: 14-Feb-2007
0x0123 0x13 # Version : 2.2
0x0142 0x43 # Notes : Required after runnung BRF6350 Bluetooth Initscript
0x018A 0x52 #--------------------------------------------------------------------------------
0x01E6 0x07 # FM ON
Debug Strings in FM_on_2_0.bts:
Code:
0x24 0x1C #log "FM_ON" (default 32KHz)
0x66 0x1C #log "FM_ON" (Optional FREF)
0x87 0x28 #Send_HCI_VS_I2C_FM_POWER_MODE 0xFD37, 1
0xB4 0x5F #Wait_HCI_Command_Complete_VS_I2C_FM_POWER_MODE_Event 5000, any, HCI_VS_I2C_FM_POWER_MODE, 0x00
0x0122 0x09 #SW patch
0x0130 0x20 # No FW patch defined for D2_11
0x015F 0x2D # Changes recommended by the AFE team - V0.1
0x01DF 0x0D #ADC settings
0x0297 0x15 #power on: FM and RDS
Debug Strings in FM_on_2_1.bts:
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x2E # Description : BRF6350 2.11 FM Initialization
0xB5 0x21 # Compatibility: BRF6350 2.11 ROM
0xE2 0x1C # Last Updated: Oct 10, 2007
0x010A 0x13 # Version : 3.7
0x0129 0x15 # Author : Manav
0x0149 0x45 # Notes : Required after runnung BRF6350 Bluetooth Initscript.
0x0193 0x2F # Includes FM Register Patch v0.5
0x01C7 0x52 #--------------------------------------------------------------------------------
0x0223 0x44 # ------------------------------------------------------------------
0x026C 0x07 # FM ON
0x0278 0x44 # ------------------------------------------------------------------
0x02E7 0x44 # ------------------------------------------------------------------
0x0330 0x3A # Note: Delay of 20ms is required in after FM Power ON API
0x036F 0x40 # Checksum command has been used to create required delay.
0x03B4 0x44 # ------------------------------------------------------------------
0x03FD 0x09 #sleep 20
0x3839 0x06 x *yx
0x3F61 0x44 # ------------------------------------------------------------------
0x3FAA 0x39 # Note: Delay of ~4ms is required in after RESET command.
0x3FE8 0x40 # Checksum command has been used to create required delay.
0x402D 0x44 # ------------------------------------------------------------------
0x4076 0x09 #sleep 40
0x4586 0x44 # ------------------------------------------------------------------
0x45CF 0x42 # Un-mark SWITCH2FREF command below when working with FREF for FM
0x4616 0x2E # Default : FM on 32K (command below remarked)
0x4649 0x44 # ------------------------------------------------------------------
0x4692 0x2B # Send_HCI_VS_I2C_Write_to_FM 0xFD35, 36, 1
0x46C2 0x5C # Wait_HCI_Command_Complete_VS_I2C_Write_to_FM_Event 5000, any, HCI_VS_I2C_Write_to_FM, 0x00
0x4728 0x44 # ------------------------------------------------------------------
0x4771 0x18 # FM Register Patch v0.5
0x478E 0x44 # ------------------------------------------------------------------
0x4872 0x44 # ------------------------------------------------------------------
0x48BB 0x1E # FM Register Patch v0.5 (End)
0x48DE 0x44 # ------------------------------------------------------------------
0x4954 0x15 # Power on FM and RDS
0x4993 0x44 # ------------------------------------------------------------------
0x49DC 0x42 # Note: Delay of 30ms is required in after FM POWER ON RCV command
0x4A23 0x40 # Checksum command has been used to create required delay.
0x4A68 0x44 # ------------------------------------------------------------------
0x4AB1 0x0A # sleep 30
0x4AE2 0x20 # Enable Dynamic LNA mode switch
Stolen from Xperia X1 ROM this init is basically the same as on HTC Hero (tiinit_5.3.53.bts).
Debug strings in TIInit_5_3_53.bts (Xperia X1):
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x37 # Description : BRF6350 2.11 ROM Initialization Script
0xBE 0x22 # Compatibility: BRF6350 2.11 ROM
0xEC 0x29 # Last Updated: 04-Mar-2008 1:32:43.58
0x0121 0x1C # Version : TI_P2_11.34
0x0149 0x4D # Notes : Use this script on BRF6350 2.11 ROM device only (FW v3.0.53)
0x019B 0x52 #--------------------------------------------------------------------------------
0x01F7 0x51 #--------------------------------------------------------------------------------
0x0257 0x24 # Update the Baudrate to 4000000 bps
0x0280 0x51 #--------------------------------------------------------------------------------
0x0301 0x51 #--------------------------------------------------------------------------------
0x2A99 0x65 #####################################################################################################
0x2B03 0x65 ############## BEGIN POWER TABLE SECTION ##########################################################
0x2B6D 0x65 #####################################################################################################
0x3191 0x65 #####################################################################################################
0x31FB 0x65 ############## END POWER TABLE SECTION ############################################################
0x3265 0x65 #####################################################################################################
0x335E 0x5A # SW bypass for spikes on IOs - Leave HCI TX, RX, CTS, RTS and BT_Wakeup during deep sleep
0x3408 0x3E ##############################################################
0x344B 0x3E #### This portion of the Init Script is for custom use. #####
0x348E 0x3E #### Enable/Disable as required for the actual platform. #####
0x34D1 0x3E ##############################################################
0x3519 0x57 ############ Enable Protocol Viewer ###############################################
0x3596 0x54 ############ Change baudrate example ###############################################
0x35F5 0x3D # Example below changes baudrate to 921k (16mHz system clock)
0x3637 0x58 # For other baudrates and system frequencies please contact your support representative.
0x3694 0x49 # Please note that the VS_Set_Uart_HCI_Baudrate_Island3 has replaced the
0x36E2 0x3A # HCI_VS_Update_Uart_HCI_Baudrate vendor specific command.
0x372C 0x3E #Send_HCI_VS_Set_Uart_HCI_Baudrate_Island3 0xFD38, 2, 17, 0, 7
0x376F 0x77 #Wait_HCI_Command_Complete_VS_Set_Uart_HCI_Baudrate_Island3_Event 5000, any, HCI_VS_Set_Uart_HCI_Baudrate_Island3, 0x00
0x37F0 0x42 #-----------------------------------------------------------------
0x3841 0x1B # Initialize voice settings
0x3861 0x42 #-----------------------------------------------------------------
0x38EA 0x42 #-----------------------------------------------------------------
0x393B 0x15 # Enable co-existence
0x3955 0x42 #-----------------------------------------------------------------
0x39D7 0x56 ############ Sleep Mode Setup ##################################################
0x3A32 0x4D # Set inactivity timer to 320 frames - 400 msec (recommended for most hosts)
0x3A84 0x6A # value may be reduced in accordance to host limitations for power saving (default: 80 frames - 100msec).
0x3AF3 0x3A #Send_HCI_VS_hcill_parameters 0xFD2B, 0x0640, 0xffff, 0xff
0x3B32 0x4D #Wait_HCI_Command_Complete_VS_hcill_parameters_Event 5000, 0x00, 0xfd2b, 0x00
0x3B89 0x0F #deep sleep: 2s
0x3BC7 0x63 # Default Settling time of 15ms may be reduced in accordance to design requirments for power saving
0x3C2F 0x2C #Send_HCI_VS_Set_Settling_Time 0xFF79, 15000
0x3C60 0x5F #Wait_HCI_Command_Complete_VS_Set_Settling_Time_Event 5000, any, HCI_VS_Set_Settling_Time, 0x00
0x3CC9 0x2B # Enable deep sleep with default parameters
Debug strings in TIInit_5_2_34.bts (Xperia X1):
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x37 # Description : BRF6350 2.34 ROM Initialization Script
0xBE 0x22 # Compatibility: BRF6350 2.34 ROM
0xEC 0x29 # Last Updated: 08-Mar-2007 20:15:32.73
0x0121 0x17 # Version : P11.11
0x0144 0x2F # RAM consumption : 2892B used, 328B available
0x017F 0x25 # Patch entries : used 14 out of 24
0x01B0 0x4D # Notes : Use this script on BRF6350 2.34 ROM device only (FW v2.0.34)
0x0202 0x52 #--------------------------------------------------------------------------------
0x025E 0x51 #--------------------------------------------------------------------------------
0x02BE 0x24 # Update the Baudrate to 4000000 bps
0x02E7 0x51 #--------------------------------------------------------------------------------
0x0368 0x51 #--------------------------------------------------------------------------------
0x3511 0x57 ############ Enable Protocol Viewer ###############################################
0x356D 0x30 #Send_HCI_VS_Enable_Protocol_Viewer 0xFF68, 0x01
0x35A2 0x53 #Wait_HCI_Command_Complete_VS_Enable_Protocol_Viewer_Event 5000, 0x01, 0xff68, 0x00
0x35FF 0x42 #-----------------------------------------------------------------
0x3650 0x1B # Initialize voice settings
0x3670 0x42 #-----------------------------------------------------------------
0x36F9 0x42 #-----------------------------------------------------------------
0x374A 0x15 # Enable co-existence
0x3764 0x42 #-----------------------------------------------------------------
0x37E6 0x56 ############ Sleep Mode Setup ##################################################
0x3841 0x42 #-----------------------------------------------------------------
0x3892 0x18 # Enable Deep Sleep Mode
0x38AF 0x4D # Set inactivity timer to 320 frames - 400 msec (recommended for most hosts)
0x3901 0x6A # value may be reduced in accordance to host limitations for power saving (default: 80 frames - 100msec).
0x3970 0x42 #-----------------------------------------------------------------
0x39B7 0x3A #Send_HCI_VS_hcill_parameters 0xFD2B, 0x0140, 0xffff, 0xff
This is also included in Xperia stock ROM but used with a firmware for BRF6300 chipset. This chipset got no FM support.
Debug strings in TIInit_4_2_38.bts (Xperia X1):
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x37 # Description : BRF6300 1.31 ROM Initialization Script
0xBE 0x22 # Compatibility: BRF6300 1.31 ROM
0xEC 0x29 # Last Updated: 30-Sep-2007 18:14:28.93
0x0121 0x21 # Version : DVM_BOOST_P13.48
0x014E 0x4D # Notes : Use this script on BRF6300 1.31 ROM device only (FW v2.0.38)
0x01A0 0x52 #--------------------------------------------------------------------------------
0x01FC 0x51 #--------------------------------------------------------------------------------
0x025C 0x24 # Update the Baudrate to 4000000 bps
0x0285 0x51 #--------------------------------------------------------------------------------
0x2921 0x5C ############# DEVM output power threshold. Please see release note for further information.
0x2A19 0x08 €€€€€€€€
0x2A4B 0x08 €€€€€€€€
0x2A7D 0x08 €€€€€€€€
0x2AAF 0x08 €€€€€€€€
0x2B0E 0x09 €€€€€€€€€
0x4745 0x65 #####################################################################################################
0x47AF 0x65 ############## BEGIN POWER TABLE SECTION ##########################################################
0x4819 0x65 #####################################################################################################
0x50C4 0x65 #####################################################################################################
0x512E 0x65 ############## END POWER TABLE SECTION ############################################################
0x5198 0x65 #####################################################################################################
0x532C 0x3E ##############################################################
0x536F 0x3E #### This portion of the Init Script is for custom use. #####
0x53B2 0x3E #### Enable/Disable as required for the actual platform. #####
0x53F5 0x3E ##############################################################
0x543D 0x5C ############ Fast Clock Configuration - Disable Crystal ##############################
0x54A4 0x35 # When Crystal in use - please remove this command.
0x54DE 0x4C # Please refer to BT-SW-0030 Vendor Specific document for more information.
0x5563 0x57 ############ Enable Protocol Viewer ###############################################
0x55E0 0x54 ############ Change baudrate example ###############################################
0x563F 0x3D # Example below changes baudrate to 921k (16mHz system clock)
0x5681 0x41 # For other baudrates and system frequencies please use the UART
0x56C7 0x51 # Baudrate Calculator tool. Please note that the VS_Set_Uart_HCI_Baudrate_Island3
0x571D 0x4B # has replaced the HCI_VS_Update_Uart_HCI_Baudrate vendor specific command.
0x5778 0x3E #Send_HCI_VS_Set_Uart_HCI_Baudrate_Island3 0xFD38, 2, 17, 0, 7
0x57BB 0x77 #Wait_HCI_Command_Complete_VS_Set_Uart_HCI_Baudrate_Island3_Event 5000, any, HCI_VS_Set_Uart_HCI_Baudrate_Island3, 0x00
0x583C 0x56 ############ Sleep Mode Setup ##################################################
0x589C 0x4D # Set inactivity timer to 320 frames - 400 msec (recommended for most hosts)
0x58EE 0x6A # value may be reduced in accordance to host limitations for power saving (default: 80 frames - 100msec).
0x595D 0x3A #Send_HCI_VS_hcill_parameters 0xFD2B, 0x0140, 0xffff, 0xff
0x599C 0x4D #Wait_HCI_Command_Complete_VS_hcill_parameters_Event 5000, 0x00, 0xfd2b, 0x00
0x59F3 0x63 # Default Settling time of 15ms may be reduced in accordance to design requirments for power saving
0x5A5B 0x2C #Send_HCI_VS_Set_Settling_Time 0xFF79, 15000
0x5A8C 0x5F #Wait_HCI_Command_Complete_VS_Set_Settling_Time_Event 5000, any, HCI_VS_Set_Settling_Time, 0x00
0x5AF5 0x2B # Enable deep sleep with default parameters
0x5B25 0x53 #Send_HCI_VS_Sleep_Mode_Configurations 0xFD0C, 1, 1, 0xFF, 0xFF, 0xFF, 0xFF, 0, 100
0x5B7D 0x6F #Wait_HCI_Command_Complete_VS_Sleep_Mode_Configurations_Event 5000, any, HCI_VS_Sleep_Mode_Configurations, 0x00
0x5BF6 0x42 #-----------------------------------------------------------------
0x5C47 0x28 # Initialize voice settings for 7500 PCM
0x5C74 0x42 #-----------------------------------------------------------------
0x5CFD 0x42 #-----------------------------------------------------------------
0x5D4E 0x15 # Enable co-existence
0x5D68 0x42 #-----------------------------------------------------------------
0x5E68 0x42 #-----------------------------------------------------------------
0x5EB9 0x18 # Enable Deep Sleep Mode
0x5ED6 0x4D # Set inactivity timer to 320 frames - 400 msec (recommended for most hosts)
0x5F28 0x6A # value may be reduced in accordance to host limitations for power saving (default: 80 frames - 100msec).
0x5F97 0x42 #-----------------------------------------------------------------
0x5FDE 0x3A #Send_HCI_VS_hcill_parameters 0xFD2B, 0x0140, 0xffff, 0xff
0x601D 0x3A #Send_HCI_VS_hcill_parameters 0xFD2B, 0x1f40, 0xffff, 0xff
0x605C 0x4D #Wait_HCI_Command_Complete_VS_hcill_parameters_Event 5000, 0x00, 0xfd2b, 0x00
Sorry for this extensive post, but i wanted to put it down here for completeness
Regards,
scholbert

[Q] Heimdall i9500 can't flash recovery.

New, unlocked GS4 arrived today!
Can't flash recovery to get Samsung's $#!7 off of it...
I've rebooted to make sure that everything's using the right module(s), tried various usb2 and usb3 ports and cables(only have usb2 cables tho), and tried it on a different machine with the exact same results. I've used heimdall 1.4.1rc2 and from git.
Code:
total used free shared buffers cached
Mem: 16015 6102 9912 0 1 3852
-/+ buffers/cache: 2247 13767
Swap: 0 0 0
16:32:13 ~hal_j/gs4 # heimdall detect
Device detected
16:32:20 ~hal_j/gs4 # heimdall flash --recovery recovery.img --no-reboot
Heimdall v1.4 RC2
Copyright (c) 2010-2012, Benjamin Dobell, Glass Echidna
[url]http://www.glassechidna.com.au/[/url]
This software is provided free of charge. Copying and redistribution is
encouraged.
If you appreciate this software and you would like to support future
development please consider donating:
[url]http://www.glassechidna.com.au/donate/[/url]
Initialising connection...
Detecting device...
Claiming interface...
Attempt failed. Detaching driver...
Claiming interface again...
Setting up interface...
Checking if protocol is initialised...
Protocol is not initialised.
Initialising protocol...
ERROR: Failed to send data!Releasing device interface...
Re-attaching kernel driver...
Bus 004 Device 008: ID 04e8:685d Samsung Electronics Co., Ltd GT-I9100 Phone [Galaxy S II] (Download mode)
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 2 Communications
bDeviceSubClass 2 Abstract (modem)
bDeviceProtocol 0 None
bMaxPacketSize0 64
idVendor 0x04e8 Samsung Electronics Co., Ltd
idProduct 0x685d GT-I9100 Phone [Galaxy S II] (Download mode)
bcdDevice 2.1b
iManufacturer 1 (error)
iProduct 2 (error)
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 67
bNumInterfaces 2
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xc0
Self Powered
MaxPower 50mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 2 Communications
bInterfaceSubClass 2 Abstract (modem)
bInterfaceProtocol 1 AT-commands (v.25ter)
iInterface 0
CDC Header:
bcdCDC 1.10
CDC Call Management:
bmCapabilities 0x00
bDataInterface 1
CDC ACM:
bmCapabilities 0x00
CDC Union:
bMasterInterface 0
bSlaveInterface 1
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x83 EP 3 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0010 1x 16 bytes
bInterval 9
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 10 CDC Data
bInterfaceSubClass 0 Unused
bInterfaceProtocol 0
iInterface 1 (error)
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Device Status: 0x0001
Self Powered
Yes, I ran all that under root. I'm using Arch and did a full update before rebooting and trying this last time. Still no joy.
What did I miss?

The latest release is 1.4.0, not 1.4RC2. Please pull from Github, rebuild and see if you have different result with 1.4.0.

Hacking the new Nook GlowLight

I just got a new Nook GlowLight (NGL), and came here assuming I would find all sorts of wonderful information about rooting it, and cool hacks I could do to make it more usable. Imagine my surprise when I could only find a couple of threads about it at all, with almost zero information! Finding information is definitely hampered by the name of the device. Any time I google for Nook GlowLight, 99% of the results are instead about the completely different product, Nook Simple Touch with GlowLight. Frustrating!
Anyway, in an effort to get the ball rolling, I will post the little bit that I have been able to find out about my NGL.
I cannot seem to ADB into it. I plugged it in, but ADB does not recognize it. It shows up as a regular mass storage device. The USB VendorID is 2080, and the ProductID is 0007. There seems to be no information out there anywhere about 2080:0007, unfortunately.
I took the back cover off to see if there was a magical "press here to root" button. Sadly, there was not. Since there does not appear to be a NGL teardown annnnnnnnnnnnnywhere on the whole wide Interwebs, I took some amateur photos of mine to share. I didn't want to chance breaking it, as I can't really go and buy a new one right now, so it's not torn down to the individual components, sorry. Hopefully it will be enough to spark some ideas, at least.
I don't know much about hardware hacking, but I've heard about JTAG ports being used to get inside of plenty of Android devices. One of the things I noticed was four unmarked copper pads on the board. That seems about right, as apparently most JTAG interfaces have either 4 or 5 lines, plus Ground. I created a picture with the four unmarked pads + Ground marked.
I know it's not much, but hopefully this information will spark some ideas from people with more experience in cracking these devices! If anyone else has additional information to add, please post it here.

Wow, thanks for the photos.
It's really interesting how they reformulated the Nook to use the small PCB.
It seems to be the same hardware basically.
They are using a different WiFi module than the Jorjin in the old Nooks.
There might be hope for having Bluetooth.
No, those four point that you circled are definitely not JTAG.
Some of the tiny gold contact points near the OMAP 3621 processor could be.
There is a missing IC at the top which could be a TXB0104 level shifter for a UART.
I'd be interested to see if/what is on the bottom of the PCB.
VID 2080 is B&N. They have been using the PIDs sequentially, so 0007 is expected.
Presumably it presents a single USB interface and one UMS volume.
Try rebooting the Nook with the USB connected to a PC.
Does it ever say, "New device found"?
You are not going to find an ADB without modifying the INF file for the ADB driver.
Try downloading Microsoft's UsbView from here. (Thank you, FTDI.)
Run it and select the Nook on the left pane, select all on the right pane and copy it here, please.
Oh! Be sure to overwrite your serial number on the text dump.
It's not a big security risk, but still....
Just type "MYSERIALNUMBER" or something.

USBview
Renate NST said:
Wow, thanks for the photos.
It's really interesting how they reformulated the Nook to use the small PCB.
It seems to be the same hardware basically.
They are using a different WiFi module than the Jorjin in the old Nooks.
There might be hope for having Bluetooth.
No, those four point that you circled are definitely not JTAG.
Some of the tiny gold contact points near the OMAP 3621 processor could be.
There is a missing IC at the top which could be a TXB0104 level shifter for a UART.
I'd be interested to see if/what is on the bottom of the PCB.
VID 2080 is B&N. They have been using the PIDs sequentially, so 0007 is expected.
Presumably it presents a single USB interface and one UMS volume.
Try rebooting the Nook with the USB connected to a PC.
Does it ever say, "New device found"?
You are not going to find an ADB without modifying the INF file for the ADB driver.
Try downloading Microsoft's UsbView from. (Thank you, FTDI.)
Run it and select the Nook on the left pane, select all on the right pane and copy it here, please.
Oh! Be sure to overwrite your serial number on the text dump.
It's not a big security risk, but still....
Just type "MYSERIALNUMBER" or something.
Click to expand...
Click to collapse
I'm not sure if this gonna be help. Anyway, I will copy the data from mine.
Device Descriptor:
bcdUSB: 0x0200
bDeviceClass: 0x00
bDeviceSubClass: 0x00
bDeviceProtocol: 0x00
bMaxPacketSize0: 0x40 (64)
idVendor: 0x2080
idProduct: 0x0007
bcdDevice: 0x0216
iManufacturer: 0x01
0x0409: "B&N"
iProduct: 0x02
0x0409: "NOOK GlowLight"
iSerialNumber: 0x03
0x0409: "MYSERIALNUMBER"
bNumConfigurations: 0x01
ConnectionStatus: DeviceConnected
Current Config Value: 0x01
Device Bus Speed: High
Device Address: 0x02
Open Pipes: 2
Endpoint Descriptor:
bEndpointAddress: 0x81 IN
Transfer Type: Bulk
wMaxPacketSize: 0x0200 (512)
bInterval: 0x00
Endpoint Descriptor:
bEndpointAddress: 0x01 OUT
Transfer Type: Bulk
wMaxPacketSize: 0x0200 (512)
bInterval: 0x01
Configuration Descriptor:
wTotalLength: 0x0020
bNumInterfaces: 0x01
bConfigurationValue: 0x01
iConfiguration: 0x00
bmAttributes: 0xE0 (Bus Powered Self Powered Remote Wakeup)
MaxPower: 0xFA (500 Ma)
Interface Descriptor:
bInterfaceNumber: 0x00
bAlternateSetting: 0x00
bNumEndpoints: 0x02
bInterfaceClass: 0x08
bInterfaceSubClass: 0x06
bInterfaceProtocol: 0x50
iInterface: 0x00
Endpoint Descriptor:
bEndpointAddress: 0x81 IN
Transfer Type: Bulk
wMaxPacketSize: 0x0200 (512)
bInterval: 0x00
Endpoint Descriptor:
bEndpointAddress: 0x01 OUT
Transfer Type: Bulk
wMaxPacketSize: 0x0200 (512)
bInterval: 0x01

I got a little confused between this thread and private messages.
In short, the new Glow does not have ADB enabled out of the box.
The USB dumps are showing just a single UMS storage ("flash" drive) interface.

my nook just gives the same information
Renate NST said:
I got a little confused between this thread and private messages.
In short, the new Glow does not have ADB enabled out of the box.
The USB dumps are showing just a single UMS storage ("flash" drive) interface.
Click to expand...
Click to collapse
my nook just gives exactly the same information, is there any hope for hacking the new nook glowlight?

Sure, there is hope.
There doesn't seem to be any ADB over USB.
A port scan of the WiFi would be a confirmation of no ADB over WiFi.
Check to see if any different VID/PIDs pop up when rebooting with the USB connected.
That could indicate a bootloader, fastboot.
Check to see if recovery has any options besides factory restore.
(Power up with the bottom two buttons depressed.)
Then there are all the possibilities with the case open:
a console interface
a JTAG interface
bootloader jumpers
If B&N releases an update image it could be examined for exploits.
The image could probably be loaded onto an older Nook, rooted and played with.

I ran a complete nmap against the Nook on both TCP and UDP while it was connected to my WiFi. No open ports found.
The USB startup looks more promising, though --
PHP:
Dec 13 21:19:33 MyLinuxBox kernel: [ 741.701292] usb 5-1: new high-speed USB device number 5 using xhci_hcd
Dec 13 21:19:33 MyLinuxBox kernel: [ 741.719705] usb 5-1: unable to get BOS descriptor
Dec 13 21:19:33 MyLinuxBox kernel: [ 741.722625] usb 5-1: New USB device found, idVendor=0451, idProduct=d00e
Dec 13 21:19:33 MyLinuxBox kernel: [ 741.722634] usb 5-1: New USB device strings: Mfr=33, Product=37, SerialNumber=0
Dec 13 21:19:33 MyLinuxBox kernel: [ 741.722639] usb 5-1: Product: OMAP3630
Dec 13 21:19:33 MyLinuxBox kernel: [ 741.722643] usb 5-1: Manufacturer: Texas Instruments
Dec 13 21:19:33 MyLinuxBox mtp-probe: checking bus 5, device 5: "/sys/devices/pci0000:00/0000:00:10.0/usb5/5-1"
Dec 13 21:19:33 MyLinuxBox mtp-probe: bus: 5, device: 5 was not an MTP device
Dec 13 21:19:36 MyLinuxBox kernel: [ 744.721151] usb 5-1: USB disconnect, device number 5
Dec 13 21:19:48 MyLinuxBox kernel: [ 757.351633] usb 5-1: new high-speed USB device number 6 using xhci_hcd
Dec 13 21:19:48 MyLinuxBox kernel: [ 757.371138] usb 5-1: New USB device found, idVendor=2080, idProduct=0007
Dec 13 21:19:48 MyLinuxBox kernel: [ 757.371146] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
Dec 13 21:19:48 MyLinuxBox kernel: [ 757.371152] usb 5-1: Product: NOOK GlowLight
Dec 13 21:19:48 MyLinuxBox kernel: [ 757.371156] usb 5-1: Manufacturer: B&N
Dec 13 21:19:48 MyLinuxBox kernel: [ 757.371160] usb 5-1: SerialNumber: 303xxxxxxxxxxxxx
Dec 13 21:19:48 MyLinuxBox kernel: [ 757.378672] scsi6 : usb-storage 5-1:1.0
Dec 13 21:19:48 MyLinuxBox mtp-probe: checking bus 5, device 6: "/sys/devices/pci0000:00/0000:00:10.0/usb5/5-1"
Dec 13 21:19:48 MyLinuxBox mtp-probe: bus: 5, device: 6 was not an MTP device
Dec 13 21:19:49 MyLinuxBox kernel: [ 758.378396] scsi 6:0:0:0: Direct-Access B&N NOOK GlowLight 0100 PQ: 0 ANSI: 2
Dec 13 21:19:49 MyLinuxBox kernel: [ 758.378613] scsi 6:0:0:1: Direct-Access B&N NOOK GlowLight 0100 PQ: 0 ANSI: 2
Dec 13 21:19:49 MyLinuxBox kernel: [ 758.379838] sd 6:0:0:0: Attached scsi generic sg2 type 0
Dec 13 21:19:49 MyLinuxBox kernel: [ 758.380186] sd 6:0:0:1: Attached scsi generic sg3 type 0
Dec 13 21:19:49 MyLinuxBox kernel: [ 758.390847] sd 6:0:0:1: [sdc] Attached SCSI removable disk
Dec 13 21:19:49 MyLinuxBox kernel: [ 758.392285] sd 6:0:0:0: [sdb] Attached SCSI removable disk
Dec 13 21:20:06 MyLinuxBox kernel: [ 774.892800] sd 6:0:0:0: [sdb] 1040352 512-byte logical blocks: (532 MB/507 MiB)
Dec 13 21:20:06 MyLinuxBox kernel: [ 774.893133] sd 6:0:0:0: [sdb] No Caching mode page found
Dec 13 21:20:06 MyLinuxBox kernel: [ 774.893143] sd 6:0:0:0: [sdb] Assuming drive cache: write through
Dec 13 21:20:06 MyLinuxBox kernel: [ 774.894122] sd 6:0:0:0: [sdb] No Caching mode page found
Dec 13 21:20:06 MyLinuxBox kernel: [ 774.894129] sd 6:0:0:0: [sdb] Assuming drive cache: write through
Dec 13 21:20:06 MyLinuxBox kernel: [ 774.895708] sdb:
As you can see, when the NGL first powers on, it presents itself as VID 0451, PID d00e for three seconds.
This seems like good news! Some sort of TI OMAP boot mode?

Yup, that's the TI 1st stage bootloader (before x-loader & u-boot).
The good news is that it's the same as the Nook Touch.
That means that we can try a bunch of things with the old Nooks.
We also know already where the console UART is on the old Nooks.

Renate NST said:
Yup, that's the TI 1st stage bootloader (before x-loader & u-boot).
The good news is that it's the same as the Nook Touch.
That means that we can try a bunch of things with the old Nooks.
We also know already where the console UART is on the old Nooks.
Click to expand...
Click to collapse
Fantastic. Any suggestions on where to begin? I'm willing to try experiments (though I'd obviously prefer to avoid trying things with a high likelihood of bricking my reader!)

I did some googling to see what I could figure out on my own.
If I am understanding this correctly, that 3 second window between when it identifies itself as 0451:d00e and when it disconnects again, it is receptive to receiving xloader code over the USB.
So we could, in theory, send it an xloader that will read a u-boot over USB as well. Then use that to boot the device into a minimal configuration that would basically "dd" out all of the partitions from the internal flash and emit it over the USB, so we could have a complete image of the built-in disk?
Of course, I have no idea HOW to do those things... But if you can give me some pointers, I am willing to learn.

Yes, that 3 second window is the place.
But it's not a big deal.
As soon as you identify down the line it will pause and you have all the time in the world.
I think the thing to do is to get the concept working on an older Nook with SD card.
These (because the ROM bootloader checks the SD card) are unbrickable
and with the UART console dmesg output we'll have some feedback.
At some point we'll have to make the leap and try it on a SD-less new Nook.

Some of the work has been done for the Nook Color which also uses the OMAP 3630. There is a working boot from USB for the Nook Color. It boots over USB to CWM from Linux. We have CWM for the NST. So I thought this ought to be easy to boot my NST over USB to CWM by using the Nook Color USB boot process and replace the image and ramdisk with the NST CWM. If that works someone could try it on a Nook Glowlight. So I gave it a shot but no go. For some reason the usbboot program that tests every 250ms for an OMAP USB device to show up and then sends over the initial boot program never sees it. My log shows 0451:d00e appearing for 3 seconds and disappearing. If I run lsusb when I boot the NST I see 0451:d00e. But for some reason usbboot doesn't see it and just sits there waiting for an OMAP device. I looked at the code and its definitely looking for that VIDID. I tried recompiling usbboot but still no go. Anybody more familiar with USB internals want to take a look at usbboot and see if they can sort out why it doesn't recognize the NST? Here is some more doc on the OMAP USB boot process.

Edit: Oops, that solution is for Linux, for Windows this comment would be appropriate:
Do you have the generic USB device driver loaded for the OMAP3630?

straygecko said:
Some of the work has been done for the Nook Color which also uses the OMAP 3630. There is a working boot from USB for the Nook Color. It boots over USB to CWM from Linux. We have CWM for the NST. So I thought this ought to be easy to boot my NST over USB to CWM by using the Nook Color USB boot process and replace the image and ramdisk with the NST CWM. If that works someone could try it on a Nook Glowlight. So I gave it a shot but no go. For some reason the usbboot program that tests every 250ms for an OMAP USB device to show up and then sends over the initial boot program never sees it. My log shows 0451:d00e appearing for 3 seconds and disappearing. If I run lsusb when I boot the NST I see 0451:d00e. But for some reason usbboot doesn't see it and just sits there waiting for an OMAP device. I looked at the code and its definitely looking for that VIDID. I tried recompiling usbboot but still no go. Anybody more familiar with USB internals want to take a look at usbboot and see if they can sort out why it doesn't recognize the NST? Here is some more doc on the OMAP USB boot process.
Click to expand...
Click to collapse
Am I going to break my Nook if I try this as-is (the Nook Color version) to see how far the process gets?
That is, this process does not attempt to replace the recovery partition on the device or anything, right? Just boots it by loading an image over USB serial?
As long as it doesn't make any modifications to the Nook at this point, I don't mind trying it out.

Failure between chair and keyboard. Forgot to sudo when running it and couldn't claim the USB device. Now it gets through recognizing the NST and sending aboot & u-boot to the device. Now u-boot doesn't work. Its a Nook Color u-boot so I tried the u-boot from a noogie and the NST boots but not from USB. Looking into compiling a NST u-boot with USB enabled.
---------- Post added at 12:15 PM ---------- Previous post was at 12:10 PM ----------
Edgur said:
Am I going to break my Nook if I try this as-is (the Nook Color version) to see how far the process gets?
That is, this process does not attempt to replace the recovery partition on the device or anything, right? Just boots it by loading an image over USB serial?
As long as it doesn't make any modifications to the Nook at this point, I don't mind trying it out.
Click to expand...
Click to collapse
Its not breaking my NST so I don't think it will brick your Nook Glowlight. AFAIK your assumptions are correct but I make no guarantees as nearly the same process is used to flash a device. Might be better to wait for the process to get ironed out better on an NST where we can backup and restore the device with an SD card in case something goes wrong.

OK, I sorted out how to compile the NST u-boot and applied the patches to it from the diff file provided in the Nook Color usb boot package. I ran into an issue where it won't work using virtualbox so I had to boot with a live CD to get the NST to boot over USB into CWM but it worked! ADB works fine but for some reason backup doesn't seem to work. It hangs on "Backing up boot...." - the first partition to backup. But ADB is a good start so you can explore your Nook Glowlight.
I looked at the kernel source for the Nook Glowlight and it has a different u-boot config. I'm not sure how different but I think the best next step will be to compile a Nook Glowlight u-boot before giving this a try on a new glowlight.

straygecko said:
ADB works fine but for some reason backup doesn't seem to work.
Click to expand...
Click to collapse
The best way to make a backup - through noogie.img by this manual
blog.the-ebook-reader.com/2012/05/02/how-to-backup-and-restore-nook-glow-and-nook-simple-touch/
If this method will adapt, it will be very cool!
Sorry for my bad english.

Dimasio said:
The best way to make a backup - through noogie.img by this manual
blog.the-ebook-reader.com/2012/05/02/how-to-backup-and-restore-nook-glow-and-nook-simple-touch/
If this method will adapt, it will be very cool!
Sorry for my bad english.
Click to expand...
Click to collapse
Yeah, I might try booting a noogie image over USB and see if I can get a backup that way. I'm not sure how either a CWM backup or noogie backup will translate to the Nook Glowlight as both backup methods backup to the SD card which is non-existent on the Nook Glowlight.

Do you have any progress？
straygecko said:
Yeah, I might try booting a noogie image over USB and see if I can get a backup that way. I'm not sure how either a CWM backup or noogie backup will translate to the Nook Glowlight as both backup methods backup to the SD card which is non-existent on the Nook Glowlight.
Click to expand...
Click to collapse
Do you have any progress，I have the new Nook glowlight

As I started to build a u-boot.bin from the B&N source I noticed in the config that USB booting might be built into the new Nook Glowlight. Makes sense for a device without an SD slot. Would somebody with a new Glowlight try powering off then powering on while holding down the n button and see what happens?

[Q] Hard bricked G2 won't appear in /dev/sdb* on linux

I was trying this to fix a hard-bricked G2 I just recieved:
http://forum.xda-developers.com/showthread.php?t=2582142
The device is in the following state:
No download mode
No recovery mode
Shows qhsusb_bulk in lsusb -v
I don't know much more about it (e.g. I don't know if it was rooted or what type of ROM was on it).
I need to unplug the battery by removing the back cover to have a chance to reboot it. The first boot after that it shows the LG logo, then a blank screen (back lit but no text).
(UPDATE: Pressing the power button 8 seconds also reboots the phone without having to unplug the battery).
When I wire it up to my Arch Linux computer here is what the command `dmesg` shows:
Code:
[ 3693.728255] usb 1-2: new high-speed USB device number 93 using xhci_hcd
[ 3693.901772] usb 1-2: config 1 has an invalid interface number: 20 but max is 1
[ 3693.901784] usb 1-2: config 1 has no interface number 1
[ 3693.903319] usb-storage 1-2:1.20: USB Mass Storage device detected
[ 3693.903868] scsi host843: usb-storage 1-2:1.20
[ 3694.905067] scsi 843:0:0:0: Direct-Access Qualcomm MMC Storage 1.00 PQ: 0 ANSI: 2
[ 3694.906568] sd 843:0:0:0: [sdb] 30777344 512-byte logical blocks: (15.7 GB/14.6 GiB)
[ 3694.906872] sd 843:0:0:0: [sdb] Write Protect is off
[ 3694.906883] sd 843:0:0:0: [sdb] Mode Sense: 0f 0e 00 00
[ 3694.907373] sd 843:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[ 3694.919101] sdb: sdb1 sdb2 sdb3 sdb4 sdb5 sdb6 sdb7 sdb8 sdb9 sdb10 sdb11 sdb12 sdb13 sdb14 sdb15 sdb16 sdb17 sdb18 sdb19 sdb20 sdb21 sdb22 sdb23 sdb24 sdb25 sdb26 sdb27 sdb28 sdb29 sdb30 sdb31 sdb32 sdb33 sdb34 sdb35 sdb36
[ 3694.923664] sd 843:0:0:0: [sdb] Attached SCSI disk
[ 3695.061360] usb 1-2: USB disconnect, device number 93
[ 3695.065521] sd 843:0:0:0: [sdb] Synchronizing SCSI cache
[ 3695.065552] sd 843:0:0:0: [sdb]
[ 3695.065554] Result: hostbyte=0x01 driverbyte=0x00
[ 3695.065557] sd 843:0:0:0: [sdb] CDB:
[ 3695.065558] cdb[0]=0x28: 28 00
[ 3695.065562] sd 843:0:0:0: [sdb]
[ 3695.065563] Result: hostbyte=0x01 driverbyte=0x00
[ 3695.065565] sd 843:0:0:0: [sdb] CDB:
[ 3695.065566] cdb[0]=0x28:
[ 3695.065567] 00 00 00
[ 3695.065569] 28
[ 3695.065571] 00
[ 3695.065571] 00
[ 3695.065572] 00
[ 3695.065573] 01
[ 3695.065573] 70
[ 3695.065574] 00
[ 3695.065574] 00
[ 3695.065575] 90
[ 3695.065576] 00
[ 3695.065578] end_request: I/O error, dev sdb, sector 368
[ 3695.065579] 80 00 00 f0 00
[ 3695.065582] quiet_error: 134 callbacks suppressed
[ 3695.065583] Buffer I/O error on device sdb, logical block 46
[ 3695.065586] Buffer I/O error on device sdb, logical block 47
[ 3695.065587] Buffer I/O error on device sdb, logical block 48
[ 3695.065589] end_request: I/O error, dev sdb, sector 128
[ 3695.065590] Buffer I/O error on device sdb, logical block 16
[ 3695.065592] Buffer I/O error on device sdb, logical block 49
[ 3695.065594] Buffer I/O error on device sdb, logical block 17
[ 3695.065595] Buffer I/O error on device sdb, logical block 50
[ 3695.065597] Buffer I/O error on device sdb, logical block 51
[ 3695.065598] Buffer I/O error on device sdb, logical block 52
[ 3695.065599] Buffer I/O error on device sdb, logical block 18
[ 3695.065633] sd 843:0:0:0: [sdb]
[ 3695.065636] Result: hostbyte=0x01 driverbyte=0x00
[ 3695.750741] usb 1-2: new high-speed USB device number 94 using xhci_hcd
[ 3695.924146] usb 1-2: config 1 has an invalid interface number: 20 but max is 1
[ 3695.924151] usb 1-2: config 1 has no interface number 1
...
Note the "config 1 has an invalid interface number: 20 but max is 1" error, and all the Buffer I/O errors.
Here is the relevant section of `lsusb -v`
Code:
Bus 001 Device 054: ID 05c6:9006 Qualcomm, Inc.
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x05c6 Qualcomm, Inc.
idProduct 0x9006
bcdDevice 0.00
iManufacturer 1 LG Electronics Inc.
iProduct 2 QHSUSB__BULK
iSerial 3 1234567890ABCDEF
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 55
bNumInterfaces 2
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 2mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 255 Vendor Specific Protocol
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 20
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 8 Mass Storage
bInterfaceSubClass 6 SCSI
bInterfaceProtocol 80 Bulk-Only
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Device Status: 0x0000
(Bus Powered)
Is there anything that could be done to fix these Buffer I/O errors so I can mount the phone (and continue with the FIX tutorial posted above)?
Anyone able to shed some lights on the meaning of these lines would be of great help in my quest of learning how to unbrick my phone.
Note: when connected to the computer the blank screen goes in a repeating cycle of being back lit for 1 second then no backlights for 1 second. The cycle stops (with backlights) when unplugging the phone.

Hello. I've got exactly the same problem, how you already somehow solved the problem?

NECRO:
same problem on a lg device, any input is appreaciated.

ALPS FF5000 8227L_demo OTG, usb tether, and Bluetooth capabilities (upgrade firmware help?)

Hey all!
I have a HIZPO head unit, labeled as the title for the model number. I have been able to root the device a while ago and got it setup best I could but there's a few things bugging me that I would like to solve. First of course is the bluetooth capabilities. As others mentioned the bluetooth doesn't work traditionally, but can be with another bluetooth adapter like mentioned here.
The other biggie is the USB connection. It appears that the devices can only access FAT32 formatted drives which is fine if you just want to load up some mp3's but I would like to get OTG to work. The information on these units in the forum are scattered with no concise answer from what I can tell.
I've connected my phone with a USB-C cable to the head unit, and the unit sees my phone. Using an app, "OTG Guru" I can see my phone and it's details which I have posted below.
ID: 0
Path: /dev/bus/usb/002/051
VID: 0x04E8 (Samsung Electronics Co., Ltd)
PID: 0x6860 (Galaxy A5 (MTP))
Class: 0 (USB_CLASS_PER_INTERFACE)
Subclass: 0
Protocol: 0
5 Interfaces:
ID: 0
Class: 6 (USB_CLASS_STILL_IMAGE)
Subclass: 1
Protocol: 1
3 Endpoints:
ID: 0
Descriptor: [0x07 0x05 0x81 0x02 0x00 0x02 0x00]
Address: 0x81
Endpoint Number: 1
Direction: 1 (device to host)
Attributes: 0b00000010
Type: 0b10 (Bulk)
Max. Packet Size: 512 Bytes
Interval: 0
ID: 1
Descriptor: [0x07 0x05 0x01 0x02 0x00 0x02 0x01]
Address: 0x01
Endpoint Number: 1
Direction: 0 (host to device)
Attributes: 0b00000010
Type: 0b10 (Bulk)
Max. Packet Size: 512 Bytes
Interval: 1
ID: 2
Descriptor: [0x07 0x05 0x82 0x03 0x1C 0x00 0x06]
Address: 0x82
Endpoint Number: 2
Direction: 1 (device to host)
Attributes: 0b00000011
Type: 0b11 (Interrupt)
Max. Packet Size: 28 Bytes
Interval: 6
ID: 1
Class: 2 (USB_CLASS_COMM)
Subclass: 2
Protocol: 1
1 Endpoint:
ID: 0
Descriptor: [0x07 0x05 0x84 0x03 0x0A 0x00 0x09]
Address: 0x84
Endpoint Number: 4
Direction: 1 (device to host)
Attributes: 0b00000011
Type: 0b11 (Interrupt)
Max. Packet Size: 10 Bytes
Interval: 9
ID: 2
Class: 10 (USB_CLASS_CDC_DATA)
Subclass: 0
Protocol: 0
2 Endpoints:
ID: 0
Descriptor: [0x07 0x05 0x83 0x02 0x00 0x02 0x00]
Address: 0x83
Endpoint Number: 3
Direction: 1 (device to host)
Attributes: 0b00000010
Type: 0b10 (Bulk)
Max. Packet Size: 512 Bytes
Interval: 0
ID: 1
Descriptor: [0x07 0x05 0x02 0x02 0x00 0x02 0x00]
Address: 0x02
Endpoint Number: 2
Direction: 0 (host to device)
Attributes: 0b00000010
Type: 0b10 (Bulk)
Max. Packet Size: 512 Bytes
Interval: 0
ID: 3
Class: 255 (USB_CLASS_VENDOR_SPEC)
Subclass: 64
Protocol: 2
2 Endpoints:
ID: 0
Descriptor: [0x07 0x05 0x85 0x02 0x00 0x02 0x00]
Address: 0x85
Endpoint Number: 5
Direction: 1 (device to host)
Attributes: 0b00000010
Type: 0b10 (Bulk)
Max. Packet Size: 512 Bytes
Interval: 0
ID: 1
Descriptor: [0x07 0x05 0x03 0x02 0x00 0x02 0x00]
Address: 0x03
Endpoint Number: 3
Direction: 0 (host to device)
Attributes: 0b00000010
Type: 0b10 (Bulk)
Max. Packet Size: 512 Bytes
Interval: 0
ID: 4
Class: 255 (USB_CLASS_VENDOR_SPEC)
Subclass: 66
Protocol: 1
2 Endpoints:
ID: 0
Descriptor: [0x07 0x05 0x04 0x02 0x00 0x02 0x00]
Address: 0x04
Endpoint Number: 4
Direction: 0 (host to device)
Attributes: 0b00000010
Type: 0b10 (Bulk)
Max. Packet Size: 512 Bytes
Interval: 0
ID: 1
Descriptor: [0x07 0x05 0x86 0x02 0x00 0x02 0x00]
Address: 0x86
Endpoint Number: 6
Direction: 1 (device to host)
Attributes: 0b00000010
Type: 0b10 (Bulk)
Max. Packet Size: 512 Bytes
Interval: 0
My knowledge is limited here, but it seems as if the device hardware wise can see the phone, and there's 5 interfaces, and each has 2 endpoints, both host to device, and device to host except for USB_CLASS_COMM which just has device to host and not host to device. I wonder if this is why we can't access the phone's storage? However this is not my goal. I tether my phone to the head unit for data, and since I use PDAnet to hide my tether usage from my isp I have to use "WIFI DIRECT" mode, which also uses a VPN, which then makes a lot of apps think the device is online since there isn't a default wifi connection. Plus it's a lot slower. I would like to do USB Tether, and of course have normal OTG and USB functionality. Has anyone made headway with this?
Lastly my main question is regarding the desire for everyone to update the firmware and OS. Are there any significant functionality benefits to upgrading? Is there additional MCU functions with the updates?
Edit: I want to add, in the system settings there are options for Bluetooth version. Has anyone played with these settings?

I just bought a Junsun FF-5000 head unit for a Chevy Cruze and the resolution is bad and when you enter code 1616 and switch Gamma to 1 or 2 it clears it up but the setting will not save. Is there any new firmware? Here is my radio info. Any help is much appreciated!