A101it mainboard hacking and chipset information

Search This thread

MarkY972

Member
Apr 23, 2012
24
2
Tel Aviv
work in progress....

Hello Scholbert,

First off all let me thank you for your responce and your try help me!!!!

Sorry it took me a long time to responce, new build is on the way at work...
Well i tryied to install the ti flash tool still nothing, the tool is waiting for the device to be connected (see attached screen shot).
I also tried to connect the device when he is powered off and and then turn on , there no new usb devices under device manager.
I thought about some interesting project: i got bricked :) (i love brick things) motorola milestone and as i know archos and milestone share the same ti platform, meiby there is possebillity to solder the nand from the milestone to archos? what you say?

What about to boot the archos from sd card? is there something that i can do without the
possibility of connecting the archos to the pc?


Best regards
marky
 

Attachments

  • ti.jpg
    ti.jpg
    241.6 KB · Views: 193
Last edited:

scholbert

Senior Member
Aug 1, 2007
1,347
821
Hi MarkY972,

so it was worth a try, but it seems your device stucks in bootloader... though i do not know if your MBR on the eMMC is still intact.
Anyway i'll leave some comments, maybe you are willing to play around with this stuff ;)
Well i tryied to install the ti flash tool still nothing, the tool is waiting for the device to be connected (see attached screen shot).
I also tried to connect the device when he is powered off and and then turn on , there no new usb devices under device manager.
O.k., basically device still accepts the eMMC as a boot media, or at least tries to boot from it. At some point the CPU definitely get's into a dead loop or something, because higher level loaders could not be started.
There are basically two possibilites to get out of this:
- change the boot mode with a hardware hack to enable peripheral booting
- shorten some data lines of internal eMMC and hope the ROM loader will then enter USB boot mode

So if you like to check this out you'll have to open the case.
You'll definitely need to cheat some logic on the board to go ahead...

I thought about some interesting project: i got bricked :) (i love brick things) motorola milestone and as i know archos and milestone share the same ti platform, meiby there is possebillity to solder the nand from the milestone to archos? what you say?
Forget about that...
Apart from entering the art of soldering at high level, it won't be of a real use.
The milestone uses NAND flash, while Archos uses eMMC media to boot from.
Apart form that the first stage loaders are completely different and so is the hardware mapping of the devices.

What about to boot the archos from sd card?
Yeah sure this was a project i once started here... but you'll need some extensive tweaks at hardware level :p
So far i got no kernel booting up though. This needs to be developed.

is there something that i can do without the
possibility of connecting the archos to the pc?
No not that much i guess.
As i said basically, you could force the device to boot from MicroSD.
Maybe it's a better choice to enter the path of USB boot mode...

If you are willing to open your device and read through the information i already posted here, we might enter the next step :rolleyes:

Have nice day!

scholbert
 
Last edited:

MarkY972

Member
Apr 23, 2012
24
2
Tel Aviv
work in progress...

Hey !!!

" If you are willing to open your device and read through the information i already posted here, we might enter the next step"

The tablet is all ready bricked so i guess i got nothing to loose so i there something that can be done i can give it a try .... :)
What you mean "....enter the path of USB boot mode....."

Thank's scholbert , Have a nice weekend

Marky
 
Last edited:

scholbert

Senior Member
Aug 1, 2007
1,347
821
What you mean "....enter the path of USB boot mode....."
We could try to enter peripheral USB boot mode by shorting a pair of data signals to the eMMC during early boot.

As stated in the picture of my first post... the boot mode is set up to detect MMC2 device first.
... but if it fails, the OMAP starts to probe for other devices as well.

The order is defined by the boot mode signals.
The default boot mode of archos is 0b1010001, which means OMAP ROM checks in this order:
MMC2 -> USB -> UART3 -> MMC1

Apart form tweaking the boot mode signals directly, we could also cheat the CPU by breaking conversation to eMMC at MMC2 interface during ROM loader boot device scan. This way we might get into USB boot mode.
Please refer to the datasheet for further information.

In fact this would be not a real step ahead, because there's nothing useful yet to load via USB... but if we easily could enter this mode, we could try to prepare some second stage loader, transfer it to the device's SDRAM and start it...
You'll need the TI Flash tool to do so.

It a nice playground anyway... :D
I'll post a pic of the data lines to the eMMC early next week.

Have fun!

scholbert
 
Last edited:

MarkY972

Member
Apr 23, 2012
24
2
Tel Aviv
fe:

Hey,

"You'll need the TI Flash tool to do so.
It a nice playground anyway... :D
I'll post a pic of the data lines to the eMMC early next week."


Waiting for the "data lines"....and whatever you think can help with the project...

P.S. can you please attach the screen shot from "Ti flash tool" for the settings that you used to flash your Archos It101. It seems that there is no 3630 ?

Thank's scholbert
Marky
 
Last edited:

scholbert

Senior Member
Aug 1, 2007
1,347
821
Waiting for the "data lines"....and whatever you think can help with the project...
See the pics below... you'll need to short the lower data lines, it's simply trial and error.

P.S. can you please attach the screen shot from "Ti flash tool" for the settings that you used to flash your Archos It101. It seems that there is no 3630 ?
OMAP3630 is compatible with DM3730 or partly with AM37xx.
So in this case you might use the file attached and replace the one found in the Ti package.
In the Ti Flash tool GUI select custom AM37xx board, you may refer to the screenshot... this one had been already posted.

With this configuration the SDRAM and PLL is set up and a second loader is transfered, nothing more nothing less.
I never flashed a A101IT this way... but i wrote some files to SDRAM.
There'd been only experiments so far, so i got no ready to use solution.

You'll definitely need to spend some research on this stuff to make some progress. I may answer some questions, but right now there's no spare time for such experiments.
Good luck!

scholbert
 

Attachments

  • configuration_custom_am37xx.txt
    8.1 KB · Views: 32
  • mainboard_bottom_mmc2.jpg
    mainboard_bottom_mmc2.jpg
    88.4 KB · Views: 183
  • mmc2_data0-7.jpg
    mmc2_data0-7.jpg
    96.9 KB · Views: 183
  • Flash_a101.jpg
    Flash_a101.jpg
    72.1 KB · Views: 184
  • Like
Reactions: MarkY972

Top Liked Posts

  • There are no posts matching your filters.
  • 3
    ... A101IT booting u-boot

    Hey guys,

    i know Gen9 devices are becoming more and more famous these days,
    but i could not resist to do some hacks and spent some more time on open development for Gen8 :D

    So here it is!!!
    First proof of concept for a true open bootloader, a.k.a. u-boot on A101IT Gen8:

    Code:
    Texas Instruments X-Loader 1.5.1 (Mar  7 2012 - 00:07:18)
    Found 0256 MB
    Testing memory, please wait...
    DRAM: 0253 MB OK
    Memory Test success!
    Archos Gen8
    PRM_CLKSEL         = 0x00000003
    PRM_CLKSRC_CTRL    = 0x00000040
    CM_CLKSEL1_PLL     = 0x08a60c00
    CM_CLKSEL2_PLL     = 0x0481b00c
    CM_CLKSEL3_PLL     = 0x00000009
    CM_CLKSEL1_PLL_MPU = 0x0011f40c
    CM_CLKSEL2_PLL_MPU = 0x00000001
    dpll_param_p = 0x40200c94
    Reading boot sector
    Loading u-boot.bin from mmc
    Done!
    
    
    U-Boot 2011.09 (Mar 19 2012 - 23:58:12)
    
    OMAP3630/3730-GP ES1.2, CPU-OPP2, L3-165MHz, Max CPU Clock 1 Ghz
    Archos 101 internet tablet + LPDDR/MMC
    I2C:   ready
    DRAM:  256 MiB
    MMC:   OMAP SD/MMC: 0
    Using default environment
    In:    serial
    Out:   serial
    Err:   serial
    Die ID #144800029ff800000160a4bb18027009
    Hit any key to stop autoboot:  0
    reading boot.scr
    
    ** Unable to read "boot.scr" from mmc 0:1 **
    reading uImage
    
    ** Unable to read "uImage" from mmc 0:1 **
    Booting from nand ...
    Unknown command 'nand' - try 'help'
    Wrong Image Format for bootm command
    ERROR: can't get kernel image!
    A101IT #

    The errors are there because i die not place the files on card yet :rolleyes:

    The work i've done so far, is pretty straight forward, though the code will need some clean up and i'm planning to implement more cool features (e.g. graphics and probably a boot menu)
    Right now A101It is just booting into u-boot, that's it.
    Pretty sure it would start a kernel already, but i'd like to do some more tweaks on low level ;).
    As soon as it will get useful, i'll put all the source down at gitorious.
    Might take some time though...

    So stay tuned, don't throw away your Gen8 device and leave some comments...

    Have fun!

    scholbert
    3
    x-loader port for A101IT

    O.k. if you my previous post, you might realize that there'd been some difficulties
    to make the external boot process work with the stock loader.

    Being fed up with digging in boot code disassemby i started to port the well known x-loader to the A101IT.
    At first this seemed to be no big job and i started with two different bootloader sources:

    x-loader 1.41 for Nook
    There's some similarity to our device and Zoom3 is also included.
    Seemed to be the best starting point first, but after digging around for a while i stucked at some point.
    There'd been no output and it seems there's some basic problem here.

    x-loader 1.5.1 from https://gitorious.org/x-loader/x-loader
    This is a more recent one and the code is in a good shape.
    So i started with the beagleboard-xm setup and modified muxing stuff to match the Archos.

    To make a long story short:
    After reading many many pages of the OMAP HWR, dumping many registers values, calculating hex and tweaking the code...
    It's booting!!!

    I implemented few additional things to have some debugging and check whether the DRAM is working or not.
    See the output:
    Code:
    Texas Instruments X-Loader 1.5.1 (Mar  7 2012 - 00:07:18)
    Found 0256 MB
    Testing memory, please wait...
    DRAM: 0253 MB OK
    Memory Test success!
    Archos Gen8
    PRM_CLKSEL         = 0x00000003
    PRM_CLKSRC_CTRL    = 0x00000040
    CM_CLKSEL1_PLL     = 0x08a60c00
    CM_CLKSEL2_PLL     = 0x0481b00c
    CM_CLKSEL3_PLL     = 0x00000009
    CM_CLKSEL1_PLL_MPU = 0x0011f40c
    CM_CLKSEL2_PLL_MPU = 0x00000001
    dpll_param_p = 0x40200c94
    Reading boot sector
    Done!
    u-boot.bin not found or blank nand contents - attempting serial boot . . .
    ## Ready for binary (kermit) download to 0x80008000 at 115200 bps...

    What is working so far:
    - initial A101IT board setup
    - 256MB DDR memory init
    - print boot messages using UART3 at 115200bps
    - serial kermit download of ARM binaries to 0x80008000
    - sending debug information....

    What's next:
    - clean up code and some fine-tuning
    - starting to port u-boot
    - deliver the source code

    I may provide the MLO binary... but you know you'll need serial console tweak and at least the kernel module from vitalif to change boot mode to external.

    P.S.: It would be no big deal to change setup for 512MB support using this bootcode. You just need to assemble a bigger PoP memory chip :p

    Cheers,

    scholbert
    2
    partly there...

    Hi again,

    as pointed out i stepped back to u-boot 2011.09 for now... and it seems this was a good decision :D

    Code:
    U-Boot 2011.09 (Mar 23 2012 - 18:53:39)
    
    OMAP3630/3730-GP ES1.2, CPU-OPP2, L3-165MHz, Max CPU Clock 1 Ghz
    Archos 101IT Gen8 + LPDDR/MMC
    I2C:   ready
    DRAM:  256 MiB
    MMC:   OMAP SD/MMC: 0
    Using default environment
    In:    serial
    Out:   serial
    Err:   serial
    Die ID #144800029ff800000160a4bb18027009
    Hit any key to stop autoboot:  0
    reading boot.scr
    
    ** Unable to read "boot.scr" from mmc 0:1 **
    reading uImage
    
    2987000 bytes read
    Booting from mmc ...
    ## Booting kernel from Legacy Image at 82000000 ...
       Image Name:   Linux-2.6.29-omap1
       Image Type:   ARM Linux Kernel Image (uncompressed)
       Data Size:    2986936 Bytes = 2.8 MiB
       Load Address: 80008000
       Entry Point:  80008000
       Verifying Checksum ... OK
       Loading Kernel Image ... OK
    OK
    
    Starting kernel ...
    
    Uncompressing Linux.............................................................
    ................................................................................
    ..................................................... done, booting the kernel.
    <6>Initializing cgroup subsys cpu
    <5>Linux version 2.6.29-omap1 (scholbert@thinkpad) (gcc version 4.4.1 (GCC) ) #1
     PREEMPT Thu Mar 22 23:59:34 CET 2012
    CPU: ARMv7 Processor [413fc082] revision 2 (ARMv7), cr=10c5387f
    CPU: ARMv7 Processor [413fc082] revision 2 (ARMv7), cr=10c5387f
    Machine: Archos A101IT board
    fixup_archos: [console=ttyS2,115200n8 androidboot.console=ttyGS0 init=/linuxrc d
    ebug omapdss.debug=0 vram=4915200 omapfb.vram=0:4915200 omapfb.debug=0 mmc_block
    .split=0.0001:512M]
    Memory policy: ECC disabled, Data cache writeback
    <7>On node 0 totalpages: 65536
    <7>free_area_init_node: node 0, pgdat c05fd368, node_mem_map c06a5000
    <7>  Normal zone: 512 pages used for memmap
    <7>  Normal zone: 0 pages reserved
    <7>  Normal zone: 65024 pages, LIFO batch:15
    <4>L2 CACHE is enabled in bootloader
    <6>OMAP3630 ES1.2
    <6>DIE ID: 144800029FF800000160A4BB18027009
    <6>FEATURE_STATUS: 00000c00
    <6>SRAM: Mapped pa 0x40200000 to va 0xfc800000 size: 0x100000
    <6>Reserving 4915200 bytes SDRAM for VRAM
    Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65024
    <5>Kernel command line: console=ttyS2,115200n8 androidboot.console=ttyGS0 init=/
    linuxrc debug omapdss.debug=0 vram=4915200 omapfb.vram=0:4915200 omapfb.debug=0
    mmc_block.split=0.0001:512M
    <3>Unknown boot option `androidboot.console=ttyGS0': ignoring
    <3>Unknown boot option `omapdss.debug=0': ignoring
    <6>Clocking rate (Crystal/DPLL/ARM core): 26.0/166/600 MHz

    No problem with machine ID here... but now there's the PLL again.
    It stucks at this point trying to find nice settings for SDRC.
    Here's the same message with stock setup using avboot loader:
    Code:
    ...
    Clocking rate (Crystal/DPLL/ARM core): 26.0/332/600 MHz
    Reprogramming SDRC
    GPMC revision 5.0
    ...
    As you see the DPLL value differs. I already corrected this in x-loader, but it seems that u-boot changes this value back (26.0/166/600 MHz seems to a default for beagleboard&Co.)
    EDIT:
    Not correct... Beagleboard-XM uses 26.0/332/600 MHz.
    Reviewed my Archos specific hacks in x-load and went back to defaults.
    Now PLL seems to be setup correct.

    Whatever no more digging the next days, i'm off for the weekend.
    I'll post some sources next week.

    Some thoughts about u-boot 2011.12 on Archos:
    Seems there are some code parts not matching well with the Archos device.
    There are several sources floating around based on this, but with more or less hacks to be found in the code. So it's hard to point it all out and get a clean starting point.
    Grabbed the mainline sources form git.denx and got some problems with mmc initializing correctly, so again might be not completely bugfixed or causing some incompatibilities.

    Maybe i'll check u-boot 2012.09 mainline, because right now i'm using a modified source for a DM3730 board from technexion.
    Not the cleanest to start from to be honest... :rolleyes:

    Have fun and drink some beer!!!

    scholbert
    2
    hi letama!
    :) Well, I've been soldering long times ago, but never that small. When I was at school, surface mounted where not that common.
    If you start with SMD stop drinking coffee that day :D

    Multimeter, I have (cheap one, not sure how it behaves with low voltage).
    Oscilloscope, niet!
    Multimeter is all you need.

    Ok, got it now.. When you were saying that mmc got shifted and messed up urukdroid, I thought it was coming from kernel.
    Ah now i remember what i wrote down. Yeah sure i made an attempt to start from external, and the mmc got "shifted", but i realized that the slot has to be powered all the time obviously. It is switched off by default (after reset).

    Well, I was thinking about using Archos bootloader and rawfs partitions mechanism, we'll see.
    Yeah sure i'm talking about the stock bootloader. We gonna hack this code :p

    Ok, do you have any reference of something that is 1.8 ready? The less I have to play with, the better, so even if it's a little more expensive, it's worth it for me. My first goal is to have console as I expect error message on the bootloader with it, it would at least confirm that I have a chance to do something. And maybe boot from serial would be easier ? Could be interesting...
    Yepp agreed, console should give some message at early boot.
    For the adaptor there's nothing reallymade but this one would be capable to manage 1.8V levels on chip-level:
    http://www.digitus.info/fr/produits...isseurs/adaptateur-usb-serie-usb-20-da-70156/

    This one's inside:
    http://www.ftdichip.com/Products/ICs/FT232R.htm

    I'd prepare a pic from the PCB, but right now i could not find this bloody thing...
    EDIT: O.k. found it...
    This is also little fiddly but might be the easiest way because no additonal logic is needed.
    You might find better soldering points for RX, TX and please remind the directions:
    Code:
    Transceiver  Archos board
    TX     ->    RX
    RX     <-    TX
    Yes, completely new and very interesting! I have some basic electronic knowledge, it's so far ago that I forgot most of it, so that's why I said consider me as a complete noob.

    I won't do much more damage than the state it is right now, it won't go to rma with what I did to it.
    Yeah no problem... let's kick that OMAP :p

    Interesting option too. Well, first, let's try console, if it goes smooth there, we'll see.
    Using this method there's no need for extensive soldering and stuff (apart of change the bootmode of course).
    We connect to host using the microUSB port. The tool then listens for OMAP boot strings and kicks in the internal ROM bootcode.
    You than are able to initiate SDRAM and run everything you like...

    Anyway, we should start with the console as you said.

    Regards,

    scholbert
    1
    datasheet collection

    Hey,

    i was lucky last week. My device is up and running.
    Fortunately the eMMC data structure was O.K. In the end my device refused to boot, because of that broken connection to the RAM.
    So there'd been no need to fiddle around with eMMC for now.
    Maybe i'll do some investigation at a later point.

    Feel free to set up your device for peripheral boot and try the Ti Flash tool debugging possibilities.

    Right now i decided to re-assemble the device and use it for a while.
    I must assume that i know nothing about the internal structure of the firmware. So it would be essential to get some insights :D

    I got some additional information about the eMMC/microSD data lines.
    If there's some interest i might post further pics.

    To get some background about the chips on the A101 mainboard, i collected some datasheets of the main components.
    Grab the zip-file here.

    Most of them are easy to find other's are not ;)
    Anyway, saves your time i guess.

    BTW, is there any tool to unpack gen8 AOS files?

    Regards,

    scholbert