[GUIDE] Hardware root via emmc chip (requires soldering!) - Fire TV General

So there is a guide from gtvhacker how to hook up an sdcard reader to the FireTV's emmc chip and mount it on a linux machine to put the superuser binary and SuperSU.apk to the system partition.
Link to the guide
xXhighpowerXx managed to do it and put together a tutorial on youtube, big thanks to him!
Link to his post
Also there is this detailed blog post of derPeter, I recommend reading it to everyone interested in this hardware hack. Link to the post
This requires disassembling the fireTV, soldering electronic parts and also basic linux skills (and a linux machine)!
Try at your own risk!
Also he updated the information in the GTVHacker wiki linked above, so everything you need to know is there.
MAKE SURE TO ALSO READ THIS POST, AS THERE IS A SOLID RISK OF BRICKING YOUR DEVICE IF YOU ARE NOT CAREFUL! Thanks to ingrimsch for talking to the gtv guys on IRC and providing the log.

VCC is shown on the first picture with the tx/rx pinout.
GND should be usable from the (usb) shield(s).
Will try it the next few days when i have time
Sammy98

So i have to solder the 5 data lines the cmd, clk, vcc, vss points to a sdcard snifer and unplug the fire tv?
The snifer goes in the pc. Rest is software.
Sent from my Nexus 4 using XDA Free mobile app

simondo22 said:
So i have to solder the 5 data lines the cmd, clk, vcc, vss points to a sdcard snifer and unplug the fire tv?
The snifer goes in the pc. Rest is software.
Sent from my Nexus 4 using XDA Free mobile app
Click to expand...
Click to collapse
One data should be sufficient - according to the homepage where the pictures are

simondo22 said:
So i have to solder the 5 data lines the cmd, clk, vcc, vss points to a sdcard snifer and unplug the fire tv?
The snifer goes in the pc. Rest is software.
Sent from my Nexus 4 using XDA Free mobile app
Click to expand...
Click to collapse
Alright - just soldered as provided - the connections are fine on the pcb - connected with the sd-card sniffer pinouts, but no luck.
I used gnd from the powerr supply shield. No emmc visible in dmesg.
FireTV is not powered and only the emmc is connected to the reader. Same reader works fine with another emmc chip ...
Sammy98

Could it be that the electrical current wich comes from the reader (pc) is to low?
Because it have to supplied the whole fire tv
Sent from my Nexus 4 using XDA Free mobile app

simondo22 said:
Could it be that the electrical current wich comes from the reader (pc) is to low?
Because it have to supplied the whole fire tv
Sent from my Nexus 4 using XDA Free mobile app
Click to expand...
Click to collapse
No the reader should only power the emmc chip. Thats why we asked where to connect vcc and vss. Ground should not be the problem.
I will stop playing now as we want to watch a movie. When the pinout is clear, i will open up the ftv again
Sammy98

But vss and vcc are parallel conected to other chips on the board so the "I" (ampere) divides maybe
Sent from my Nexus 4 using XDA Free mobile app

simondo22 said:
But vss and vcc are parallel conected to other chips on the board so the "I" (ampere) divides maybe
Sent from my Nexus 4 using XDA Free mobile app
Click to expand...
Click to collapse
Jepp but how much current and ampere should be used on what pins? A perhaps 1.7V on the pin like in the pinout is not enough for me to try that und probably fry the atv
Sammy98

Have you tried whithout vcc, vss from the cardreader an powered ftv?
Sent from my Nexus 4 using XDA Free mobile app

simondo22 said:
Have you tried whithout vcc, vss from the cardreader an powered ftv?
Click to expand...
Click to collapse
i STRONGLY advise against this, but you could measure voltages when the ftv is on, to compare to what your card reader supplies.
Also you could try the 5 data line mode.

I guess the voltage or pins are the culprint. I did not power the atv and will not while connected to the reader. I dont write the emmc while the system is using it
Gesendet von meinem Nexus 7 mit Tapatalk

Ok, stupid idea from me. :banghead:
Sent from my Nexus 4 using XDA Free mobile app

No problem. Just keep Brainstorming

Hi,
I can find via google these 'SD Card Sniffer Sparkfun' (different versions: TOL-11468 and TOL-09419) and also e.g. 'MicroSD Breakout' and maybe I have an idea how to soldering/connecting the TOL's to pcb (CMD, CLK, DAT0 do I find (not really difficult) but not VCC, VSS), BUT I have no idea what and how I have to do after that (or maybe I'm also wrong at the starting)...
Can someone link me into the right direction?
THX
EDIT:
Maybe I understand it:
1. soldering / connecting the pins at the pcb with wire to the pins at the TOL
2. place the TOL into a card-reader at e.g. PC or another BOX
3. mount the SD card... (but there I don't know how to identify the system-MTD)

no_spam_for_me said:
Hi,
I can find via google these 'SD Card Sniffer Sparkfun' (different versions: TOL-11468 and TOL-09419) and also e.g. 'MicroSD Breakout' and maybe I have an idea how to soldering/connecting the TOL's to pcb (CMD, CLK, DAT0 do I find (not really difficult) but not VCC, VSS), BUT I have no idea what and how I have to do after that (or maybe I'm also wrong at the starting)...
Can someone link me into the right direction?
THX
Click to expand...
Click to collapse
Did you even read the last posts in the current thread concerning vss and vcc? We dont know either
no_spam_for_me said:
EDIT:
Maybe I understand it:
1. soldering / connecting the pins at the pcb with wire to the pins at the TOL
2. place the TOL into a card-reader at e.g. PC or another BOX
3. mount the SD card... (but there I don't know how to identify the system-MTD)
Click to expand...
Click to collapse
The steps 1-3 are correct. The emmc only has a read/writable ext4 according to the gtv hacker.
If you dont know how to mount the ext4 of the sd-card, you probably should not begin to solder.

sammy98 said:
Did you even read the last posts in the current thread concerning vss and vcc? We dont know either
Click to expand...
Click to collapse
Yes, I read it, but I ALSO have no idea (that's what I want to say)...
sammy98 said:
The steps 1-3 are correct. The emmc only has a read/writable ext4 according to the gtv hacker.
If you dont know how to mount the ext4 of the sd-card, you probably should not begin to solder.
Click to expand...
Click to collapse
To mount isn't a problem, but I'm wondering in, if the eMMC only contains one "partition" because of the different MTD's (but that is something I don't understand because I have never done it before THIS way via a 'SD Card Sniffer')...

no_spam_for_me said:
To mount isn't a problem, but I'm wondering in, if the eMMC only contains one "partition" because of the different MTD's (but that is something I don't understand because I have never done it before THIS way via a 'SD Card Sniffer')...
Click to expand...
Click to collapse
The emmc only provides the partion with the data trough the sd-card reader

hey guys,
i dont have my FTV yet, so I cant try hooking up the EMMC to the SD Sniffer myself yet, but maybe I can supply you with a few infos I found in the datasheets. I live in Germany, so my only option to get root access on the FTV will be the EMMC/SD way, which is why I follow this thread with great interest.
@sammy98: are you able to measure the VCC/GND when the SD Sniffer is connected to your PC? As far as I know most SD Cards run on 3.3V, but will work on slightly higher and lower voltages (usually 2.7 to 3.6V). I´ll make an educated guess and say if you measure VCC/GND on the Sniffer you will see a voltage of 3.3V.
According to an article here h t t p : / / w w w .computerbase.de/2014-04/amazon-fire-tv-in-einzelteile-zerlegt the EMMC Chip is a Toshiba THGBM5G6A2JBAIR. So I peeked into the Datasheet (h t t p : / / w w w .magic-sun.com.cn/product/download/pdf/13) and found a pinout plus the Power Supply Voltages for VccQ accepting voltages from 1.7 V to 1.95 V and 2.7 V to 3.6 V. So if the SD Sniffer supplies nice 3.3V as expected, we should be able to use it... just maybe not on the 1.8V spot shown in the UART picture
Only thing I have not found out yet is where to connect the 3.3 V voltage to supply the EMMC yet. In the Datasheet Pinout you can find the correct Pins for Vcc/VccQ, but as the EMMC is a BGA package, they are under the package. Too bad gtvhacker did not trace the Vcc lanes, so we now have to find a spot to inject the voltage to get the EMMC/SD bridge running...
Hope this helps in any way. Until I finally get my FTV (delivery date still unknown :crying I can only help in theory...

ingrimsch said:
hey guys,
@sammy98: are you able to measure the VCC/GND when the SD Sniffer is connected to your PC? As far as I know most SD Cards run on 3.3V, but will work on slightly higher and lower voltages (usually 2.7 to 3.6V). I´ll make an educated guess and say if you measure VCC/GND on the Sniffer you will see a voltage of 3.3V.
According to an article here h t t p : / / w w w .computerbase.de/2014-04/amazon-fire-tv-in-einzelteile-zerlegt the EMMC Chip is a Toshiba THGBM5G6A2JBAIR. So I peeked into the Datasheet (h t t p : / / w w w .magic-sun.com.cn/product/download/pdf/13) and found a pinout plus the Power Supply Voltages for VccQ accepting voltages from 1.7 V to 1.95 V and 2.7 V to 3.6 V. So if the SD Sniffer supplies nice 3.3V as expected, we should be able to use it... just maybe not on the 1.8V spot shown in the UART picture
Only thing I have not found out yet is where to connect the 3.3 V voltage to supply the EMMC yet. In the Datasheet Pinout you can find the correct Pins for Vcc/VccQ, but as the EMMC is a BGA package, they are under the package. Too bad gtvhacker did not trace the Vcc lanes, so we now have to find a spot to inject the voltage to get the EMMC/SD bridge running...
Click to expand...
Click to collapse
Yes i measured the power of the reader and therefore i decided to put the 1,7V on the pin of the uart with an external device. Did not work as i wrote.
I read the datasheet to, but as the gtv hackers did not measure out the vcc (or did not find the pin), we need the spot to inject the voltage.
Sammy98

Related

USB Host disconnected pin?

hello,
i've heard that the universal WOULD support USB host drivers if an unconnected pin inside the universal was connected... could anyone tell me;
- if i manage to get the pin connected, would i get usb host features like on any other usb host phone with proper drivers?
- how hard is it to do?
- WHAT to do?
Oh man,really really nice interesting idea,hope it's true and possible,i hope someone knows all about that and soon writes here how that is possible maaan,would be really awesome to play with that
PalDragan said:
Oh man,really really nice interesting idea,hope it's true and possible,i hope someone knows all about that and soon writes here how that is possible maaan,would be really awesome to play with that
Click to expand...
Click to collapse
nice to hear someone else would like to get it to work too
EDIT: just found this on another thread on another forum about a PXA270 phone, someone was trying to get it to work, seems like all we need is
- switch the pin to host mode
- a driver (maybe zenos latest ones?)
After about 6 months of not touching this project, I decided to take another quickie look at the PXA270 docs and programmers reference. What I now see is very interesting.
Originally, I was looking at bringing out the USB Host 1 interface pins to the outside world as they were only terminated internally on the motherboard. Only about 1% of users might be able to do that.
I then started to look at the USB OTG (On The Go) interface that this chip supports. The USB OTG interface can be used as both a client and host. It shares the same pins as the Axim's serial port. Unfortuately, there are two serial control lines pins that are not brought out to the connector, so I scrubbed that idea.
This past weekend I picked up the programmer's design reference book to look at how the various USB interfaces are programmed and I saw something that I missed before as this was in the USB Client section. It appears (to me anyways) that the USB Client pins can also be programmed to act as a USB Host when in the USB OTG low power operation mode. The manual discusses how the additional control registers are used along with an output mux and charge-pump circuit (to provide the +5v). Refer to the PXA27x Processor Family Developer's Manual - dated Jan 2006, sections 12.5.2 and 20.
I will be looking at this more closely to see if a simple driver can be written (Afarre, where are you...) to switch the USB client pins into Host mode. In addition to this, the USB device drivers would be needed. Please remember, an additional IO interface circuit will be needed to connect between any USB device and the Axim as the proper voltages are not on the sync connector.
Click to expand...
Click to collapse
the_fish said:
nice to hear someone else would like to get it to work too
Click to expand...
Click to collapse
Suuuuuuuuuure,every crazy idea to abuse my PPC and i'm in for the quest
PalDragan said:
Suuuuuuuuuure,every crazy idea to abuse my PPC and i'm in for the quest
Click to expand...
Click to collapse
haha same, btw thats the link to the topic:
http://www.mobilitysite.com/boards/x50-x51-forums/140071-hacking-pxa270-internal-usb-host-24.html
Unfortunately, this means it's not for 99% of users as it requires a delicate hardware mod/addition to the motherboard (see my earlier posts & photos in this thread).
Click to expand...
Click to collapse
seems like they were still working on the driver (which we already have(?)) so we only need the hardware mod.... i guess...
the_fish said:
haha same, btw thats the link to the topic:
http://www.mobilitysite.com/boards/x50-x51-forums/140071-hacking-pxa270-internal-usb-host-24.html
seems like they were still working on the driver (which we already have(?)) so we only need the hardware mod.... i guess...
Click to expand...
Click to collapse
Ummm it's definately a crazy idea. We were discussing with mamaich (our guru) last year. Unfortunately it's not that simple to provide the power in sync connector, which is acting as a usb client (connector) at the moment.
tomal said:
Ummm it's definately a crazy idea. We were discussing with mamaich (our guru) last year. Unfortunately it's not that simple to provide the power in sync connector, which is acting as a usb client (connector) at the moment.
Click to expand...
Click to collapse
did you read in the thread i posted a link to? they had the same problem, but also found out that it maybe is possible to provide the nessecary +5v too, they were not sure tho, and i thought maybe zenos drivers contain the code to do that.
the_fish said:
did you read in the thread i posted a link to? they had the same problem, but also found out that it maybe is possible to provide the nessecary +5v too, they were not sure tho, and i thought maybe zenos drivers contain the code to do that.
Click to expand...
Click to collapse
Ok, seems there is a new idea of power injection from outside.
Anybody tried it...?
Couple of months ago, I was trying with outside +5v power but nothing happens
Win_XP said:
Couple of months ago, I was trying with outside +5v power but nothing happens
Click to expand...
Click to collapse
did you use one of those special USB cables that have two female USB-A, one for power and the other for the device to plug in?
http://htc-tytn-ii.handster.com/software.php?id=3339&for=HTC+TyTN+II
i don't know anything about this.. i'm actually looking to hook up something that normally has a rs-232 port.. but is also made in usb.. It draws power from another source
with something like that program doesn't that suggest usb host is possible..
http://gnalpgnarf.handster.com/software.php?id=3339&for=gnalpgnarf
hmmm....am I right or am I wrong?
Theoretically speaking the idea with a pin is supposed to redirect power from intake to output, however, not only Uni is incapable of supporting the output (you are essentially attempting to piggyback another device), the external support will not be possible due to pin configuration, regardless of the cable used.
Another thing, other than sheer experimentation, what would be the real point of such USB host?
STOP TORTURING YOUR UNIs, GUYS!!!!
I am pretty sure, that the Universal doesn't support USB Host.
It did not, it does not, it will not.
Sorry guys!
To be honest:
Yes, the PXA270 chip supports USB Host, but in most HTC devices they use this feature already for something else, like: WLAN or 3G connection.
DOMy
seen this?:
http://hhtinker.blogspot.com/2008/10/usb-host-on-treo-650.html
do you know what USB Host already busy?
it used as data call transfer radio <-> CE.
USB hub will not solve this problem easy.
also if you want attach it to miniUSB connector, you need additional OTG chip.
=> Host on universal is very hard to do, ...impossible.

A101it mainboard hacking and chipset information

Hi,
as i wrote in another thread, i purchased a bricked A101.
There's no response from the system so i decided to start investigation on the hardware .
A101it chipset information:
Processor
• Ti OMAP3630 (515-pin CBB/P BGA package) ARM Cortex A8 at 1 GHz with DSP
• POWERVR SGX530 Graphic accelerator: 3D OpenGL ES 2.0
Memory
• 256MB LPDDR SDRAM (168-pin PoP BGA package) soldered on top of OMAP3630
• 8/16GB eMMC (169-pin BGA package) connected to OMAP3630 internal mmc2 interface
Interfaces
• USB slave 2.0 (OMAP3630 internal interface, MicroUSB connector)
• USB host interface (TPS65921 host interface, TYP A connector)
• Micro SD slot (OMAP3630 internal mmc1 interface, SDHC compatible)
Display subsystem
• ChiMei 10.1" TFT-Display N101L6-L02 (18Bit-LVDS interface)
• Ti SN75LVDS83B LVDS transmitter (56-pin BGA package)
Touchscreen subsystem
• Pixcir capacitiv touchscreen unit (TR16C0 controller, USB interface)
• Ti TUSB2551A USB transceiver (16-pin QFN package)
HDMI subsystem
• NXP TDA19989AET 24-Bit HDMI transmitter
• HDMI output (19-pin Mini HDMI connector)
Communication
• Ti WL1270/1 WiFi (802.11 b/g/n)
• Ti WL1270/1 Bluetooth 2.1 EDR
Miscellaneous
• Built-in speaker
• Built-in Microphone
• Freescale MMA7660FC G-sensor
• Omnivison OV7675 VGA camera (0.3M)
Power source
• Ti TPS65921 power management chip
• Intersil ISL9220 LiPo charger
• Internal: Lithium Polymer battery
• External: 5V/1A Power adapter/charger
To get some detailed informations about these chips, i made a sweet datasheet collection.
Grab the zip-file here.
TBC...
EDIT: The brick issue is solved.
The platform did not boot up due to a broken connection to onboard RAM.
This thread will present various hacks and other stuff a geek might have fun with
Read on for some more information.
So here's my first result:
I successfully located the sys_boot signals of the OMAP3630.
I made a first test by changing the default boot mode.
With sys_boot5 pulled high the boot order changes to peripheral boot first.
In other words you may use this tool to directly access the OMAP memory (e.g. RAM).
In theory it should alos be possible to boot the device form external microSD as well, but at factory default the microSD slot is covered by power management. In other words, power is switched off at boot time.
This could be hacked as well
My attempt will be to un-brick my device by using external boot mechanism.
Maybe i'll need some help at a later point!
EDIT: Peripheral boot modes had successfully been verifed.
It definitely works on the Archos 101. Perhaps this may be useful for some open bootloader project.
Aynway, i already discovered some other things, that might be helpful for hardware hackers. So if you are kind leave a comment or ask some questions.
Stay tuned!
scholbert
Oh, that's interesting ... I don't know anything about hardware hacking but I'd like to learn hope you will show us ... keep on the good effort ... and I'll keep an eye on this tread .... might come handy ... jejeje
sounds great, keep on rolling
peripheral boot
Hi,
thanks for your replies.
So as expected using peripheral boot over USB/UART is working (sys_boot5 pulled high).
At least the ASIC ID is send correctly and the initial communication starts.
See the screenshot attached.
Flash V1.6 also got a eMMC driver included.
So this could be the way .
Right now there's an error message:
Code:
Unknown status message 'dKAYd 2nd stdrted?' during peripheral boot (waiting for 2nd)
I guess the response should be: OKAY! 2nd started?
EDIT:
MMMh strange... i'll have to find out who is generating this message.
If it is comming from OMAP the SDRAM setup should be verified.
Seems that the LSB byte stuck @ 0x64.
Code:
dKAYd 2nd stdrted?
ascii = dKAY -> hex = 0x59414b64 (msb..lsb)
ascii = d 2n -> hex = 0x6e322064
ascii = d st -> hex = 0x74732064
ascii = drte -> hex = 0x65747264
ascii = d? -> hex = 0x00003F64
See the session log file for more details!
Anyway i justed started to play around... maybe some tweaks in the configuration are needed
Have fun!
scholbert
Pretty Cool
Thanks for attesting coolness
Made some further tests... though my time is really limited right now.
I found out that the message is send from 2nd loader which is used for Ti's Flash tool.
So this might indicate that there's something wrong with my memory or memory bus.
I re-checked the RAM setup sripts for the Ti tool again but could not find any error. Reduced the timing as well. Still got that message...
It's very strange that the pattern really seems to stick, which is unusual for damaged memory... i will report further findings.
Anyway this is open discussion, feel free to post
Cheers,
scholbert
Nice try. Can you tell us about the RAM, it's built in the mainboard or changable?
We already know that, it's built-in ^^
(some have opened their Archos before ^^)
trungvn1988 said:
Nice try. Can you tell us about the RAM, it's built in the mainboard or changable?
Click to expand...
Click to collapse
http://forum.archosfans.com/viewtopic.php?f=74&t=42806
Soldered on, not changable by anyone with home soldering tools. Very small ball soldering. I gave it an attempt, even got a replacement 1GB RAM module as a test piece... Didn't work out well for me.
I'll definitely be keeping an eye on this topic, seems like some good information might come of it.
.............yippie yeah it's working out!!!!
Thanks for the feedback
First i'll have to quote myself:
It's very strange that the pattern really seems to stick, which is unusual for damaged memory... i will report further findings.
Click to expand...
Click to collapse
Guess what...... it's fixed!!!!!
I really go crazy. See attached log file.
External boot over USB and 2nd loader started up successfully, using the Ti tool.
So RAM is working now!
This definitely saved my day...
What happened exactly?
As i pointed out, the data on memory bus stucked at 0x64, so i assumed there was an issue with DQM/DQS signals on PoP memory.
See some related documents about the function of these signals on RAM chips.
The DQM/DQS where not toggled in the right way because of bad soldering at the PoP memory chip.
See the attached pic for the excact position of these signals (marked in red).
The chip itself is soldered on top of the OMAP3630.
In the end i used a hot-air solder gun and soem soldering flux and fixed the broken connection. In fact i used this "technique" some time ago to fix a "No GSM" issue on HTC Hermes.
Though i'm very excited right know, i'll have to make a break for today, because i have a date
Harfainx said:
I'll definitely be keeping an eye on this topic, seems like some good information might come of it.
Click to expand...
Click to collapse
Yes i'll try my very best
Kind regards,
scholbert
Guy, it's so nice! Keep up the good work!
datasheet collection
Hey,
i was lucky last week. My device is up and running.
Fortunately the eMMC data structure was O.K. In the end my device refused to boot, because of that broken connection to the RAM.
So there'd been no need to fiddle around with eMMC for now.
Maybe i'll do some investigation at a later point.
Feel free to set up your device for peripheral boot and try the Ti Flash tool debugging possibilities.
Right now i decided to re-assemble the device and use it for a while.
I must assume that i know nothing about the internal structure of the firmware. So it would be essential to get some insights
I got some additional information about the eMMC/microSD data lines.
If there's some interest i might post further pics.
To get some background about the chips on the A101 mainboard, i collected some datasheets of the main components.
Grab the zip-file here.
Most of them are easy to find other's are not
Anyway, saves your time i guess.
BTW, is there any tool to unpack gen8 AOS files?
Regards,
scholbert
yes it would be great if we could find one, maybe we could find a way to get inside and change some things
scholbert said:
...
Most of them are easy to find other's are not
Anyway, saves your time i guess.
BTW, is there any tool to unpack gen8 AOS files?
Regards,
scholbert
Click to expand...
Click to collapse
As far as i know we can't extract aos files since they are encrrypted and we don't have they proper KEY - its saved inside the device somewhere
But good luck with going on! Rly sounds interesting who knows what it's good for in future
good news - check out:
http://forum.xda-developers.com/showthread.php?t=1214674
seems we got a way to extract soon
..... uuuh great!!!
FrEcP said:
good news - check out:
http://forum.xda-developers.com/showthread.php?t=1214674
seems we got a way to extract soon
Click to expand...
Click to collapse
Yupp, that's awesome. I just joined that thread.
In the meantime i disassembled my device again, because i want to spent some more time on research.
I found out some more details about the chips and the design in general.
The A101 seems a pretty neat device for extensive hacking, because archos did a good job and made a very clear design.
I started to prepare a pin map by looking at the kernel sources again.
Maybe i'll be able to find some other useful testpoints on the mainboard (e.g. UART2)
As you might know, the touchscreen is connected to USB using OHCI mode.
To attach it to the OMAP ports they also used a chip from Ti.
See this datasheet for more information:
http://focus.ti.com/docs/prod/folders/print/tusb2551a.html
If i'll find some time i'll try to make kind of a floor plan from the mainboard and post some pics as well.
P.S.: If someone knows the manufaturer of the speaker drivers, please tell me! The parts are marked as 8JAM892 and are located near the soldering points for the speaker.
Keep on hackin'
scholbert
What I would like to find out is what component it is that dies when the USB port fails (and it stops sleeping as well). Maybe it's replaceable (if you can do SMD soldering).
pbarrett said:
What I would like to find out is what component it is that dies when the USB port fails (and it stops sleeping as well). Maybe it's replaceable (if you can do SMD soldering).
Click to expand...
Click to collapse
Mmmh... without being affected by this issue it's hard to tell.
If the port dies, there could be many reasons of course.
Maybe the 5V power supply for Vbus is dying on these devices, due to "over-current" issue. I have not identified that part right now.
The signal lines itself usually won't be harmed... apart from injecting ESD pulses right to the connector.
The USB host port is directly connected to data lines of the USB PHY inside TPS65921 (Power Management chip).
OMAP3630 itself uses ULPI mode to connect to this part.
That's all i could say for now.
Regards,
scholbert
FrEcP said:
good news - check out:
http://forum.xda-developers.com/showthread.php?t=1214674
seems we got a way to extract soon
Click to expand...
Click to collapse
If we can't extract those AOS files - how are custom ROM builders such as $auron getting their hands on the upper layer of the firmware? I know I am not expressing myself technically correct, but what I understand is that for instance $auron's UrukDroid is a custom Linux kernel etc. with on top of it the modules, GUI etc of the official Archos packages...
you don't need to extract the aos file to get the filesystem of the archos android. you simply have to root your device or just install angstrom (which comes with SDE) and then you can copy the squashfs file to your computer so you can extract whatever you need. it's not encrypted but signed, you only have to skip the first 256 bytes (if I remember correctly) of the file to get a valid squashfs image.

[Q] Anyone find a Serial Console yet?

I'm trying to find a serial console, hopefully to access u-boot, but I'm not having any luck.
I found 4 possible candidates on the main board.
JP1 is near the WiFi card and has mostly 3.3v on the lines.
JLTE1 is near the power LED, and has 3.3v on 2 of the lines.
JLTE2 is hidden under the front camera cable, and also has 3.3v on one of the lines.
Last is JP6, which is near the 3G connector, and also has 3.3v on 1/2 the lines.
-- dag nabit, can't post images yet --
I've hooked a scope up to all pins of these jumpers during boot and reboot, as that's when most of the serial console/kernel output would occur. But no luck.
So, has anyone found a serial console on the TPT? (or a schematic?)
Thanks!
I'm also looking for a serial port. Have you already checked the Dock connector? I think there is a chance that Lenovo made it on this port.
I have opened my Dock yesterday and also found some unpopulated PCB pads which are for HDMI.
Thanks!
Duh! I forgot about the dock connector, as I don't have a dock. Can you take a pic of the PCB? I'll order a dock, kinda handy anyway...
BTW, I also tried a USB/mini-PCIe adapter in the 3G slot. The kernel recognized the USB stick as /dev/sda, but would not mount it. So if you have root, you might want to make a mount point and rule for something like this.
Here's a cheap source for hardware:
www hwtools net slash Adapter slash PM3U dot html
The microSD option has potential, too. Make sure you get the USB, not the PCI versions. (As I'm pretty sure the PCI functionality is not available here.)
Someone harvasted a 3g mini pci modem from a lenovo laptop and installed it. The HC os had the drivers and the modem was recognized.
Yes, Ihave an Ericsson F5521GW 3G modem here. The tablet and Android recognize it and prompt me for a SIM card, which I don't have.
If you want it, I can mail it to you...
The mini-PCIe adapter for USB and microSDHC work fine. You just need to be root to mount them.
Don't know if this would help you guys or not
If you are looking for a serial output I have a http://www.g2microsystems.com/products/RN_270.
Basically it's a bluetooth to serial adapter. I use it on my phones and tablets with a free app called bluterm to connect to Cisco equipment with. Its pretty cool but pricey (work sprang for it).
There are a lot of different brands of these adapters (I had one from http://www.aircable.net as well that worked good).
Thanks Karl, but I'm looking to gain access to the u-boot loader. I want to hijack the boot and make it boot Linux off of the micro-sdhc card (installed in the 3G slot). Ideally I'll have it dual-boot.
I have a Trim-Slice PC on the way. It's also a Tegra-2, so theoretically, I can develop on Trim-Slice, save on micro-sd and boot from there.
However, those are some cool devices I could use for other projects. Thanks for the links!
AbeOwitz said:
Thanks!
Duh! I forgot about the dock connector, as I don't have a dock. Can you take a pic of the PCB? I'll order a dock, kinda handy anyway...
Click to expand...
Click to collapse
Sorry for my late response. I have taken some pictures and uploaded them to rapidshare. I cannot post the link here so I will send you a pm
Wow, thanks for taking the time to do that!
BTW, it seems the rapid-charger cable is not available any more?
Found some dock details here: http rootzwiki com topic 8523-reverse-engineering-the-dock-charger
So, i finally got the dock. No luck in finding the console.
I disassembled the dock, and probed both the 20 pins that are soldered through the board and the 40 pins on the inter-board connector.
As root I did a "cat /dev/urandom > /dev/ttyS0" to generate output, but no luck. I did find the audio and microphone lines. (/dev/ttyS0 is defined as console on the kernel boot parameter line.)
There must be a RTS/CTS line that needs to be enabled...? Or perhaps it's simply not passed through?

crazy testers needed

ok so I'm thinking of trying to get usb host mode working on x10
problem 1, the usb port in x10 does not provide power.to external devices...
i want some crazy tester to set.up a jig as mentioned here
http://forum.xda-developers.com/showthread.php?p=24618556
(just make the jig....do not.think about that kernel...that's a totally different phone)
next, the kernel.you have to.use.is this
http://forum.xda-developers.com/showthread.php?p=24217211
or, one.of.the two.kernels here
http://forum.xda-developers.com/showthread.php?p=24026342
(as per your ROM, select kernel)
next we.need a usb host controller app (sztupy has made.one)
so get that
if someone is ready to go through this.... please contact me
maybe we can get usb otg up and running on x10
Sent from my X10S using xda premium
Hey champ, just curious what the purpose of the jig is? If my understanding of a jig is correct, isn't it simply a 301ohm resistor between pins 4 and 5 in a USB connector? Usually used to put Samsung phones into download mode, I believe. I can see how I would need a usb OTG cable and a powered hub, but why the jig?
I hope that you're on to something here, USB host on the x10 would be incredible!
Sent from my X10 using Tapatalk
;24732035 said:
Hey champ, just curious what the purpose of the jig is? If my understanding of a jig is correct, isn't it simply a 301ohm resistor between pins 4 and 5 in a USB connector? Usually used to put Samsung phones into download mode, I believe. I can see how I would need a usb OTG cable and a powered hub, but why the jig?
I hope that you're on to something here, USB host on the x10 would be incredible!
Sent from my X10 using Tapatalk
Click to expand...
Click to collapse
actually yes....
we just need the otg cable and some way to provide power to the usb device....
rest my kernels i linked.to...I've complied them with host mode drivers enabled...
at the moment (for next 4-5 weeks) i do not have the time/energy/money/resources to set this hardware monkeying business....for that i need a volunteer.....
rest the kernel is up, and once device is connected, i can guide the person into mounting it too....
we just MIGHT do a big thing here
Sent from my X10S using xda premium
Hey champ, I did have a usb 4 port hub that used a power supply. Will something like this work?
Sent from my X10S using XDA
ToledoJab said:
Hey champ, I did have a usb 4 port hub that used a power supply. Will something like this work?
Sent from my X10S using XDA
Click to expand...
Click to collapse
yes maybe... see my fxp mod kernels have usb mode enabled...we have to try and see if it works
Sent from my X10S using xda premium
championswimmer said:
yes maybe... see my fxp mod kernels have usb mode enabled...we have to try and see if it works
Sent from my X10S using xda premium
Click to expand...
Click to collapse
I have not used fxp yet. Whats a good kernel & rom to test with.
Sent from my X10S using XDA
The circuit/adapter needed is rather simple:
It will let data pass through, and from an external source provide power to both the phone and the device.
I might be up to test this, but I have to gather some leftover parts from broken USB gadgets I have lying around.
Now where did I place that 5 volt power supply? * looks around*
I'll be back...
http://forum.xda-developers.com/showthread.php?t=923864
^^^ build your own hub.
get the hardware up guys, (I'm currently shifting homes, and all hardware related stuff cannot be found easily...lol)
I'll see what can be done about kernel and about mounting it..we might *just* be able to pull this off....
Sent from my X10S using xda premium
OmegaRED^ said:
http://forum.xda-developers.com/showthread.php?t=923864
^^^ build your own hub.
Click to expand...
Click to collapse
Wouldn't it be easier and cheaper just to buy a powered one? But it does remind me of how pissed off I was as a kid when I ordered a Sinclair ZX81 kit to build and the bloody idiots sent me an assembled unit instead at no additional charge. Useless.
TAL333 said:
Wouldn't it be easier and cheaper just to buy a powered one? But it does remind me of how pissed off I was as a kid when I ordered a Sinclair ZX81 kit to build and the bloody idiots sent me an assembled unit instead at no additional charge. Useless.
Click to expand...
Click to collapse
Usb connection needs to be modded to micro usb either way.
I had ZX81.. such a awesome toy and tool.
Hey all,
I have all the nessesary hardware - DIY battery powered hub module with PWM power.Works fine on some other devices, not on X10.
It is because I was making a lot of developing and experiments with otg mode on X10 (X10 schematics helped). I have also built kernel modules, loaded them succesfully, but nothing else - logcat or dmesg didnt see anything and no errors returned (stick,HDD,mouse,keyboard...).
So, i could be volunteer, because I am interested of it, and slso have hardware and software skills
BTW.: I am also very curious about new ideas in otg X10
HeliumX10 said:
Hey all,
I have all the nessesary hardware - DIY battery powered hub module with PWM power.Works fine on some other devices, not on X10.
It is because I was making a lot of developing and experiments with otg mode on X10 (X10 schematics helped). I have also built kernel modules, loaded them succesfully, but nothing else - logcat or dmesg didnt see anything and no errors returned (stick,HDD,mouse,keyboard...).
So, i could be volunteer, because I am interested of it, and slso have hardware and software skills
BTW.: I am also very curious about new ideas in otg X10
Click to expand...
Click to collapse
try using my v5 kCernel
(you'll have to use fxp cm7 rom along with it )
it has usb otg enabled in kernel
Sent from my X10S using xda premium
Ou... see that it requires unlocked bootloader
Sorry, is there any other solution how to get this kernel working? I. e. source code which can allow me to build locked bootloader kernel image?
And for your information, in kernel page (from your signature) version 5, link for wifi modules is dead , says file not found.
HeliumX10 said:
Ou... see that it requires unlocked bootloader
Sorry, is there any other solution how to get this kernel working? I. e. source code which can allow me to build locked bootloader kernel image?
And for your information, in kernel page (from your signature) version 5, link for wifi modules is dead , says file not found.
Click to expand...
Click to collapse
will try to build locked bl kernel for you...
for file download see my signature, there is dev host mirror and direct link both... (look inside x10 folder inside kernels)
Sent from my X10S using xda premium
championswimmer said:
will try to build locked bl kernel for you...
for file download see my signature, there is dev host mirror and direct link both... (look inside x10 folder inside kernels)
Sent from my X10S using xda premium
Click to expand...
Click to collapse
Anyway thanks for even try ! Good luck
(TX pressed )
I've been experminetning hoping i'd get anything to show up in the kernel logs when attempting to connect something to the port.
However, even if the chip itself does support this, I start to believe the circuit board simply isn't wired up to function in this way.
Now think about it: Why would SE put the extra circuitry in (even if themselves are rather primitive), if they never planned to include it in the first place?
What I've done so far:
Made a simple adapter based on a experiment board with two USB connectors, and a DC in jack that supplies both connectors with 5 volts, that charges the phone, provides the common ground and supplies the gadget one connects (In my case a simple USB flash memory)
I tested this adapter on another device that does support USB on the Go, or what it's called. It works.
Even if a kernel doesn't support the device itself, the log will show signs that an unknown device is connected, which is good enough for me, as confirms the hardware works.
Now onto the X10:
Tried the ROM FreeXperia FXP117, with the kernel from FXP115, as is. dmesg gives no result at all. Also tried flipping around the data + and -, no result. Device is charging, bu nothing else.
Tried the kCernels, from the link provided by the OP in the first post.
While I had trouble booting the device up completely (My own fault, has nothing tod with this thread), at least I was able to boot the kernel and was able to access the device from the debug bridge (adb shell).
Yet again no result. Nothing from dmesg, nothing on the flash memory that indicates kernel accessing it. (It flashes a few times initially when detected otherwise)
Questions:
Are we talking about a separate modified kernel module here?
If so I might have missed it.
Have I missed any importants steps? (loading the external modules for instance?)
EDIT:
Are now "screwing" around with some USB hubs, connectors and are also looking int othis S3C USB Host thing. I suspect that one is aspecial thing for samsung, and are not the same as other devices uses.
We might need another way to control the USB-mode in the X10 chipset, which I suspect is not a S3C based one.
I also suspect the device need a special chip in order to switch between host and device mode, and that chip also provides the "root hub" in question. I suspect the X10 lacks all those things, even if the chipset itself proviced support for it.
EDIT 2:
No success at all. I even tried to detect if there where any data exchange between the X10 and the hubs I've tried (Both straight and crossover on the data leads)
Nothing. There is no whatsoever activity at all going on between the devices.
With that. I'm pretty sure one need a special chip that wakes up the USB host mode in the chipset when certain circumstances are fulfilled. (Normally a chip integrated in the device itself, which the X10 lacks)
I'll place this little project of mine, on the shelf for the time being.
At least until someone can provide us with additional tips that can lead into forcing the X10 chipset into USB host mode.
To put this in simpler terms:
One cannot simply connect to devices to eachother. Nothing will happen.
Both devices will sit there, waiting for the other one to start speaking so either one can respond to the other.
That is how USB device and host mode works:
When a device is connected, the host will detect it and start speaking to it, asking questions the device have to respond to. The device itself will never start speaking, it will only listen, and only respond when asked.
Once this has happened, the data exchange between the device and the operating system can take its course.
The X10 is a device, it listens.
If we try to connect a device/gadget to it, that is not a host itself, it will also sit there listening.
In this situation, we have two or more devices that refuses to speak, as there are no host around to start the conversation.
What we nee to do here, is encourage the X10 to start speaking, by forcing it into host mode BEFORE we connect anything.
for SysGhost:
Same as I did before on doomlord kernels with same (no) results
If you want, i have X10i block diagram schemes. I have already researched them for many many days, but maybe you will find something else...
And one thing - have you loaded usb host kernel modules? Even if hardware supports it, but doesnt have its module, nothing will show up in kernel or system message bus Maybe you know it, maybe not....
HeliumX10 said:
for SysGhost:
Same as I did before on doomlord kernels with same (no) results
If you want, i have X10i block diagram schemes. I have already researched them for many many days, but maybe you will find something else...
And one thing - have you loaded usb host kernel modules? Even if hardware supports it, but doesnt have its module, nothing will show up in kernel or system message bus Maybe you know it, maybe not....
Click to expand...
Click to collapse
Any documents on the X10 would be helpful. If you got any, I'd gladly have a look.
SysGhost said:
Any documents on the X10 would be helpful. If you got any, I'd gladly have a look.
Click to expand...
Click to collapse
here there are
As I am uploading them here, i remember that I had found, that USB host cables are located (as in diagram) on the right side of the JTAG pins (under battery stick), because there is located an usb switcher (page 15).
But not sure about it - time to brainstorm

Extending your KF or: what to use the debug connector for

Hi all,
I already had an older post asking for what the unpopulated soldered line of pads close to the Samsung flash memory chip might be useful for. To me it's clear already that it has been used during development (e.g. from the kernel sources it looks like they used to connect an ethernet interface to those pins).
Yesterday I spent some time probing for signals with an oscilloscope. There's already good news to those who might think about extending flash memory size of the Kindle Fire: pads 1-4 are directly connected to the OMAP4's MCSPI1_{CLK,SOMI,SIMO,CS0}, pads 36-37 carry GND and pads 39-40 carry 4.2V (unregulated from battery I guess as it's also not switched off when KF is off). The MCSPI can be configured to 48MHz (according to the kernel sources) and we can start connecting SPI hardware to it. I did for fun with some tiny CAN controller I had lying around and that worked out of the box using the spidev and some generic CAN driver from the network section.
Luckily, most SDcards can also be accessed via SPI. I will also try that out soon. Transfer speeds will not exceed 6MByte/s, in practice probably only half of that, but it might be enough for those who dare to extend flash memory. While probing for signals, I also noticed that the Samsung chip seems to be accessed by a single wire only, too. I might be wrong on this, but it would certainly fit the picture as max. transfer speeds do exactly match the 208MBit/s for a 1-wire eMMC connection. Maybe someone else noticed the same already.
Unfortunately, I yet only found two other useful signals routed directly to those pads: DPM_EMU0/1 (pads 16-17). I suspect that 6 other JTAG signals are also routed there, but I can't probe for them as those pads can't be configured to be used as GPIOs.
More on this to come soon...
Best,
STYLON
I just realized that I should send out a quick warning to those that are a little less well equipped with electronics gear.
Most signals on that connector are connected directly to the OMAP4430 without any buffer. They're also from the 1.8 volt domain. That means you can't connect an SD card directly to those pins.
In order to connect an SD card you need at least a level shifter (like the SN74AVCH4T245 that is already somewhere on the board) to convert signals between 1.8v and 3.3v (that's what the SD cards expect). You may also need a 3.3v LDO and connect it to the unregulated battery voltage from that connector.
I'll do some experiments with that very soon, but just wanted to order an SD card slot (don't like to solder to SD card pads directly) and some other pieces before I go ahead.
Best,
STYLON

Categories

Resources