Attend XDA's Second Annual Developer Conference, XDA:DevCon 2014!
5,807,128 Members 40,964 Now Online
XDA Developers Android and Mobile Development Forum

Matsunichi/Innocomm 'Griffin' M6001 (aka Le Pan TC970) ICS/CM9 development thread

Tip us?
 
fv+
Old
(Last edited by fv+; 15th March 2012 at 10:53 PM.) Reason: Added pointer to cas_xp work on running ICS/CM9 on LePan TC970
#1  
Junior Member - OP
Thanks Meter 35
Posts: 20
Join Date: Oct 2010
Default Matsunichi/Innocomm 'Griffin' M6001 (aka Le Pan TC970) ICS/CM9 development thread

I am no longer working on this project (see the 3/15 update below).
However cas_xp is already working on porting ICS/CM9 to the LePan TC970.
The XDA thread with all his work is here: http://forum.xda-developers.com/show....php?t=1483954
(if anyone has a link to the thread specific to CM9 for the TC970, please let me know and I'll update the link above).

================================================== ==============================


This thread is about gathering and sharing info about the hardware, firmware, Linux kernel and modules for the Mitsunichi/Innocom 'Griffin' M6001 tablet, aka Le Pan TC970 in order to be able to port ICS/CM9 to it, if possible.

I'd like to keep this thread about 'low-level' hardware/kernel, i.e. please do not post questions about rooting this tablet (it has already been done, see here: http://forum.xda-developers.com/show....php?t=1353951) or about problems with specific applications.

Since there are so many awesome developments in this thread, I decided to just put the interesting news and links here and move the historical info in the second post below.

Franco

================================================== ==============================

Update 3/15/2012

Last Sunday flying back home they had me check-in with the regular luggage my bag with the LePan 970 and when I turned it back on at home that night, it had a bunch of stripes of dead pixels on the screen; it is pretty much unusable now.
Also my wife gave me a new different tablet (which already runs ICS) for my birthday yesterday, so at this point I won't be working on the LePan TC970 anymore.

I just saw that the great cas_xp is already working and making good progress on a version of CM9/ICS for the LePan TC970 (see here http://forum.xda-developers.com/show....php?t=1483954 and here https://github.com/cas-xp/device_lepan_griffin) and I wish the best of luck in this project.

I had really fun working on this tablet with all the people here (chinabull, cas_xp, and everyone else of course) and I am already working on the new one.

See you later,
Franco

================================================== ==============================

Update 2/20/2012

I was finally able to compile all of CM9/ICS with specific files for the griffin/TC970 (no ROM yet).
All the details, how to get the files, and compile it on your PC are in the 'how-to' post ( http://forum.xda-developers.com/show...&postcount=113).
Please do try to compile it yourself, but don't try to run those files on your tablet.

================================================== ==============================

Update 2/7/2012

Big news!
cas_xp has released a beta version of Gingerbread/CM7 for the griffin/TC970. The thread with all the information is here: http://forum.xda-developers.com/show....php?t=1483954

Awesome job cas_xp!!!


================================================== ==============================

Update 1/30/2012

I tried to put together an initial attempt of an 'how-to' docoment about trying to build CM9/ICS for the griffin/TC970 tablet (movie spoiler: no, I can't build/run ICS yet).
The link to the post is here: http://forum.xda-developers.com/show...&postcount=113

I also created a github repository with the device specific code and configuration files to port CM9/ICS to this tablet (it is all in the post).

Comments, contributions to the code and conf files in the repo are most welcome!


================================================== ==============================

Update 1/27/2012

cas_xp was able to get Gingerbread (CM7) running on the first time! (http://forum.xda-developers.com/show...2&postcount=93)!!!

Congratulations to cas_xp for this big success!


================================================== ==============================

Update 1/22/2012

I finally found the time to write the Innocomm firmware 'packer' (and a newer version of 'unpacker'), so we can create our own firmwares for the TC970/griffin.

Since I thought it is better if I keep this post just for the progress updates for this this thread, I just put the descriptions on what 'unpacker 'and 'packer' do and how to use them here: http://forum.xda-developers.com/show...8&postcount=80.

Sometime I'll also clean up this post a little bit (and put all the historical information in the second post).


================================================== ==============================

Update 1/19/2012

chinabull has created a working ClockworkMod Recovery for the LePan TC970/griffin; his post with all the instructions is here: http://forum.xda-developers.com/show...8&postcount=44.
Please read his whole post wuth all the instructions; please not that this is still a work in progress and that there are risks with your tablet involved with this installation; you may want to read all the posts after chinabull's to have an idea of the possible risks and workarounds.

Again my hat off to chinabull for this great achivement!

================================================== ==============================

Update 18/1/2012

More great news!
chinabull figured out a way to replace Innocomm recovery with an already existing ClockworkMod, sign the firmware with this new version and install it on his tablet.
This means that we should now the able to build our own firmwares for the TC970/griffin.
Many thanks to chinabull for his awesome achievement!


================================================== ==============================

You can find all the other information in the 'historical' log below.
Attached Files
File Type: tar unpacker.tar - [Click for QR Code] (30.0 KB, 47 views)
File Type: tar packer.tar - [Click for QR Code] (20.0 KB, 33 views)
The Following 10 Users Say Thank You to fv+ For This Useful Post: [ Click to Expand ]
 
fv+
Old
(Last edited by fv+; 28th January 2012 at 01:17 AM.) Reason: historical information
#2  
Junior Member - OP
Thanks Meter 35
Posts: 20
Join Date: Oct 2010
This post is just to keep an archive of all the historical information about porting ICS/CM9 to the griffin/TC970 tablet.

Most of the information here has been superseded by the progress made more recently (see post #1), but I thought it would be useful to have it around, just in case.

Franco

================================================== ==============================

Update 1/16/2012

Great news!
With chinabull's help, I found out how to generate the 20 bytes SHA1 checksum for trhe images contained in the firmware.
It is the SHA1 checksum of the image + the 'cafeefac' trailer + the length of the image (including the 'cafeefac' trailer).

I updated the C program 'unpacker.c' to also compute and check the SHA1 checksum.
The program can be compiled with the following command:
gcc -O -Wall -o unpacker unpacker.c -lz -lcrypto

We still haven't found out how to generate the 20 byte SHA1 checksum for the whole firmware, but I think we are very close now.

I'll also start writing the 'packer' because I think we'll have all the pieces in place very soon.

Many thanks to chinabull again for all his help.

Franco


================================================== ==============================

Update 1/15/2012

What chinabull found is the CRC32-like checksum for the header of the firmware and for each of the images.
As he pointed out in the thread there is still a 20 bytes (160 bits) signature/checksum that we haven't figured out.
I updated the 'unpacker' code attached to this thread with the header CRC checksum stuff that chinabull found out.
The still unknown 160 bits field is displayed as 'signature/checksum' if you run the'unpacker'; if you figure out how to generate it from each image content, please let us know, since this is the last thing we need to know to be able to create ourown firmware images.

Franco

================================================== ==============================

Update 1/13/2012

Very good news!
Chinabull figured out the algorithm used by Innocom to sign/checksum the images and the firmware!
This means that it should be possible to create our own firmware images (possibly with CWM recovery) and start replacing parts of the firmware on the TC970/griffin.

Congratulations to chinabull!

Franco


================================================== ==============================
Update 1/8/12

First of all, thanks to the many who posted useful information about the hardware in this tablet and thanks for the comments (btw, negative critiques do not upset me, so don't worry about them, as long as they don't violate this forums policies).

I thought that in order to boot any alternative ROM or firmware it would be useful to find out how locked down Innocomm has made this tablet.
Since the CPU is an OMAP3630 and the Wifi is a WL1271 and they are the same on the Nook Color tablet and since we know that the TC970 can boot off the SD card using the same type of MLO x-loader and bootloader used by the Nook Color, I downloaded the Nook Color 'Monster Bootpack' SD card bootable images from here: http://code.google.com/p/monster-roo...downloads/list. They have a couple of 2GB SD card images there.
I tried both of them and in both cases I had the 'bad firmware image' screen, which seems to indicate that the Innocomm recovery boot checks for 'something' (beyond what a normal OMAP3630 does) in order to boot an MLO x-loader from the SD card.

At this point I thought I would try to discover the full format of the 'griffin.ifw' file, in order to be able to create our own ROM images.
I was able to decode a few more fields in the firmware (the memory load address and a few other value) and I have updated the attached 'unpacker.c' accordingly.
Unfortunately a couple of values are still unknown:
- one is a 28 byte (224 bits) field in the header of each image in the firmware - I strongly suspect it is some sort of checksum (224 bits is the length of a SHA224 checksum), but I haven't been able to find out how to generate that value (I tried doing SHA224 checksums of the image,the image+header, and other combinations, but without any luck). If someone here can find how to generate it, big reward!
- the second one is a 24 byte (192 bits) field in the header of the whole firmware - it is probably some other checksum/signature, but I haven't found out any kind of 192 bit signature to make sense of it, so big reward here too if you can figure out what it is.

Both values are printed out by this version of 'unpacker', so you can play around with it and let me know if you find anything.

Finally, I saw from the FCC schematics that the TC970 presents the OMAP3630 UART3/serial port on the 30 pin connector and I saw that one guy ('chinabull') in the TC970 rooting thread was able to connect to it and obtain a shell in recovery mode. My next step is going to be buying the $15 'podbreakout' from sparkfun Electronics (among others) http://www.sparkfun.com/products/8295 (I am not good with the soldering iron; if you are good and have patience, you may want to try with the $4 iPod connector from the same site) and connect to pins 17, 18, and the ground to have a serial connection and be able to see the actual messages when I try to boot with a different MLO x-loader (should be also useful to 'de-brick' the TC970, since I only have this tablet).

I'll let you know how it goes.

Franco


================================================== ==============================


This thread is about gathering and sharing info about the hardware, firmware, Linux kernel and modules for the Mitsunichi/Innocom 'Griffin' M6001 tablet, aka Le Pan TC970 in order to be able to port ICS/CM9 to it, if possible.

I'd like to keep this thread about 'low-level' hardware/kernel, i.e. please do not post questions about rooting this tablet (it has already been done, see here: http://forum.xda-developers.com/show....php?t=1353951) or about problems with specific applications.

Below is what I found so far.


- Hardware
According to the application with the FCC, these are the most interesting components:

- Name: griffin
- Model: 6001
- Manifacturer: Innocomm
- Processor: TI OMAP3630 ES1.2
- LCD: LP097X02-SLA3 (transmitter: TI SN75LVDS83B)
- Power regulator: TI TWL5030
- Front facing camera: 2M pixel fixed focus CM8188-A200SF-E
- g-Sensor: BMA150
- e-Compass: YAS529-PZ
- light sensor: EPL5804
- gas gauge: OZ8805
- Wireless/Bluetooth/FM: TI WL1271-YFV
- GPS: GSD-4t


- Firmware:
Le Pan has apparentely two versions of its latest firmware, V4431 and V4431-2. My analysis below is based on the one with MD5 checksum f9cabf696f08f1c3791d0a4ec14876db.

I wrote the attached C program to extract all the 'images' (files) from the firmware.
The program can be compiled with the following command:
gcc -O -Wall -o unpacker unpacker.c -lz
(all these commands should work on Linux - Fedora 64 bit; you may have to change them to run them on a different version of Linux/OS).

The firmware is composed of the following nine 'images':

- recovery ('.cpio.gz' archive - it can be opened with the command: gzip -dc recovery | cpio -idm)
- linux (this is the actual Linux kernel; see more about it below)
- iload (same as the first stage 'MLO' x-loader binary in the firmware installation disk)
- iboot (same as the second stage 'iboot.ism' loader in the firmware installation disk)
- splash (probably a bitmap image for the splash screen)
- chargesplash (probably a bitmap image for the splash screen when charging)
- bootifw_logo (probably a bitmap image with the company logo to be displayed at boot time)
- ramdisk (.cpio.gz' archive - it can be opened with the command: gzip -dc ramdisk | cpio -idm)
- system (a YAFFS2 filesystem - it can be opened with the 'unyaffs' program - available here: http://code.google.com/p/unyaffs/downloads/list)

The griffin board is based on the TI OMAP3630 ARM CPU, which is the same used by the very popular BeagleBoard (http://beagleboard.org/). Most of the information available for the BeagleBoard apply to griffin, included the functions of the files MLO, iload, iboot (see here: http://omappedia.org/wiki/Bootloader_Project - OMAPpedia is definitely a good starting point here).


- Kernel and drivers:
The firmware file 'linux' is the actual Linux ARM kernel; it has some code at the beginning to uncompress it and the rest is a 'gzip' compressed file.
The actual uncompressed kernel can be extracted with the command:
dd if=linux bs=12878 skip=1 | gunzip -dc > kernel

I then ran 'strings -td -a kernel' and it looks like all the drivers are compiled into this kernel (also confirmed by the very few '.ko' files contained in 'system').

The 'strings' command shows the following lines toward the beginning:

183356 twl5030
183392 griffin-i2c-touch
183428 bma150
183464 yas529
183500 OZ8805
183536 epl5800-ls
183572 hynix253
183608 griffin-ha2608-tk

I think these are the drivers which we need to come up in order to be able to compile ICS/CM9 for this tablet.

Here is what I found about them:
- 'twl5030' is the power regulator for the OMAP board and it is already supported by Linux
- 'griffin-i2c-touch' is the capacitive touch screen (see more about it below)
- 'bma150' is the accelerometer and it is already supported by Linux
- 'yas529' is the magnetometer and it is already supported by Linux
- 'oz8805' is the gas gauge - I didn't find much about it
- 'epl5800-ls' is the light sensor - I didn't find much about it
- 'hynix253' is the 2M pixel camera - I didn't find much about it
- 'griffin-ha2608-tk' is the touch key - I found some code about it here http://topic.csdn.net/u/20110810/09/...d4c980b4e.html

I started looking at the touch screen first, since it is probably the most critical component in this list (and the one that took some work to get to work correctly on the CM7 for the HP Touchpad).

The 'bootinfo.txt' log file posted on the TC970 rooting thread shows the following kernel message lines for the TS:

input: griffin-i2c-touch as /devices/virtual/input/input7
griffin-i2c-touch 2-0055: registered with irq (313)
Goodix TouchScreen Version:GT801NI_1R02_13T
griffin-i2c-touch 2-0055: Create proc entry success!
Goodix debug sysfs create success!
griffin-i2c-touch 2-0055: Start touchscreen griffin-i2c-touch in interrupt mode

which show that the TS is a Goodix GT801.

Search for Goodix Linux drivers, I found the following page (in Chinese) http://blog.csdn.net/baiduluckyboy/a...etails/6616533. It looks like it contains the source code for the Linux driver for the TS and it looks like the driver is under the GPL license. Unfortunately the source code refers to a couple of include files ('goodix_touch.h' and 'goodix_queue.h') that I was not able to find anywhere. The guy who posted that source code might have them, I did not try to contact him. Also the 'goodix_touch.ko' kernel drivers out there refer to a source file 'goodix_touch_1024n.c' that I was not able to find either.

Interestingly enough, the schematics posted on the FCC site do not mention any Goodix chip at all (at least I wasn't able to find it there).

This is what I found so far; I'll add more updates as I find them.

I would also appreciate very much if anyone could post information about the source code for the drivers (or even developer's guides, SDKs, datasheets) for the touch screen (most important), the light sensor, the camera, the GPS, etc

Thanks,
Franco
The Following User Says Thank You to fv+ For This Useful Post: [ Click to Expand ]
 
cdesai
Old
#3  
cdesai's Avatar
Recognized Developer
Thanks Meter 3,993
Posts: 2,277
Join Date: Jan 2011
Location: IN YOUR HEAD

 
DONATE TO ME
If you want the kernel source, contact the manufacturer, as the Linux kernel is licenced under GPL and they need to release source!

From my fingers to your eyez
CyanogenMod Maintainer | SGT7 | TeamBBQ

 
BBQLinux - An Arch based Linux distribution for Android developers
Website: http://www.bbqlinux.org | Downloads: [url]http://sourceforge.net/projects/bbqlinux/files//url]
IRC: #bbqlinux on freenode
 
fv+
Old
#4  
Junior Member - OP
Thanks Meter 35
Posts: 20
Join Date: Oct 2010
just in case 2
 
DerKoch
Old
#5  
Member
Thanks Meter 36
Posts: 79
Join Date: Dec 2010
Best of luck!!!!

DerKoch

Sent from my SGH-I897 using XDA App
 
dbaybay
Old
(Last edited by dbaybay; 19th December 2011 at 06:32 PM.)
#6  
dbaybay's Avatar
Senior Member
Thanks Meter 260
Posts: 619
Join Date: Oct 2011
Location: Florida
Good luck.
 
BreeZyer
Old
(Last edited by BreeZyer; 19th December 2011 at 08:32 PM.)
#7  
BreeZyer's Avatar
Junior Member
Thanks Meter 0
Posts: 7
Join Date: Dec 2011
Location: montreal
Appreciate the work to gather the info together, OP. Glad another soul fights for our shiny toy

Having a forum would help putting such info in stickies. Keep voting!
Vote +1 Le Pan forum here

As for source code... anyone threatening legal action yet? j/k ...
 
TchuLandry
Old
#8  
Junior Member
Thanks Meter 0
Posts: 1
Join Date: Dec 2011
Location: Montreal, Quebec
Dude, problem? Calm down, I think this is the best thread with all the infos right now.
 
dbaybay
Old
(Last edited by dbaybay; 6th March 2012 at 10:05 AM.)
#9  
dbaybay's Avatar
Senior Member
Thanks Meter 260
Posts: 619
Join Date: Oct 2011
Location: Florida
10chars...
 
gfinockio
Old
#10  
gfinockio's Avatar
Senior Member
Thanks Meter 38
Posts: 523
Join Date: Aug 2008
$30 US to the first person with a working CM7 (or CM9) custom ROM on the Le Pan, via Paypal!

Tags
cm9, griffin, ics, le pan, tc970
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes