A80G9 mainboard hacking and chipset information

1,339 posts
Thanks Meter: 809
By scholbert, Senior Member on 9th May 2012, 02:17 PM
Post Reply Email Thread
9th February 2020, 01:09 PM |#111  
Senior Member
Thanks Meter: 32
Originally Posted by Rusik12

Help me please change touchscreen

Software solution for how to change touch screen on Archos 80 G9 Turbo (A80S). I had original touchscreen on US's chip cypress-tma340. Then I bought face side of the tablet on Avito but it appeared with the newer modification of the same A80S tablet (screen panel + touch screen with the sensor chip). It had Taiwaneese TR16C0 chip and Japan-Chineese joint venture product Tango F48 PIX90048NQ. I also bought USB OTG cable, I connected mouse to the tablet and turned on USB Debugging in Settings. Then I installed android-tools (adb and other tools for Android from Google). Reading Initialization chapter of OMAP4460 Technical Reference Manual didn't help much, this book has about 6000 pages. It's better to analyze kernel sources on github archos-gpl-gen9-kernel-ics. Loading and unloading kernel modules for touchscreen didn't help. Touchscreen didn't react and didn't wanna calibrate in SDE menu. The thing is that touchscreen chip connects with i2c interface and you have to registrate it for uevents mechanism of the kernel to work.

This is the part where touch screen chip initialization takes place:
It reads structure using feature tag FTAG_HAS_TOUCHSCREEN, checks vendor field of that structure, if that field not null. Then that code makes initialization for the chip cypress-tma340 in case this field is zero and for the chip tr16c0 otherwise. So, we have to change that field to non-zero value. This is that function:
And these are tags in which we are insterested:

There is a special area of 512 bytes of the eMMC called Feature TAGs (FTAGs). While booting of the device kernel reads it and initialize and configure feautes of the device such as what tablet modification do you have, is it Turbo version or not, does the device have additionals power chip for OMAP4460, which RAM chip does device have, it's frequency, what screen panel and background illumination level and touch screen does device have etc.? This region doesn't change during usual firmware updates. By default device boots from eMMC device /dev/mmcblk0 (you also can configure booting from SD card or through USB alternatively) with 0x00060600 offset from the beginning and also copied into /mnt/rawfs/tags file, but it's mounted in read-only mode. As recommended above it's wise to make a reserve copy of the whole device /dev/mmcblk0, and also /mnt/rawfs/tags into some file, - tags.bin. Then edit exact field in hex editor, add there needed tag and reboot. Attention! Further procedure done in inappropriate way may harm or even make a brick of your tablet!

What do you need before the procedure:
1. Root access on device. Access through USB debugging using adb. Installed busybox on device with dd utility.
2. Modified tags file with correct edit of the touch screen ftag. You also need to know your address offset from the start of 512 bytes page with tags from the start of eMMC image in your case.

The procedure is the following.
0. Stop Zegote service and other Adroid processes:
adb shell

Then you try to remount every partition in read-only mode.
mount -o remount,ro /
mount -o remount,ro /mnt/system
mount -o remount,ro /mnt/rawfs
mount -o remount,ro /data

1. Copy into PC tags file from the tablet:
adb pull /mnt/rawfs/tags tags.bin
2. Backup full eMMC image into PC from the tablet:
adb pull /dev/block/mmcblk0 mmcblk0.raw
Make a copy for modification of tags file on PC:

cp tags.bin tags_new.bin
Open tags_new.bin file in hex editor. I used okteta. Tags are of u32 size, that is 32-bit fields (it's 4 pairs of hex numbers in editor). At the beginning is the size of tags structure (for example,
03 00 00 00 - opposite ordering, that is so called little-endian code - that is the size of tag is 3, that is 3 times by u32), then tag's identifier goes (for example,
14 00 00 00 - is FTAG_TURBO, equal to 0x00000014), then there are fields of the structure, i.e. in case FTAG_TURBO it would be the following structure:
struct feature_tag_turbo {
u32 flag;
that is it has only 1 field of size u32 (flag), (for ex.,
01 00 00 00, if you have Turbo-version of the device). Carefully read all tags starting from
FTAG_CORE 0x00000001, which has so called magic number field u32 magic; // 34 12 A0 FE,
to understand how these tags are written. In the end I have the latest tag - FTAG_TURBO, after which I have only zeros. There in this free area I added new tag: the size of the new tag
07 00 00 00
tag's identifier
0e 00 01 00
it's vendor
74 70 6C 73 (tpls)
it's product
74 72 31 36 (tr16)
it's type
it's revision
00 00 00 00
it's flags
And that's all new tag which we have written and saved in new modified file tags_new.bin in hex editor. And copy it into tablet:
adb push tags_new.bin /mnt/sdcard/Download/

2. Then open on your PC in hex editor file mmcblk0.bin and find there the start of the page with tags. In my case it was showed like this, from the 0x60600 offset from the beginning of the file:
0x60600: 0x05 0x00 0x00 0x00 0x01 0x00 0x00 0x00 0x34 0x12 0xa0 0xfe 0x01 0x00 0x00 0x00
That is, the size of the tag is 5 times by u32, it's tag's identifier is
0x00000001 - is the tag FTAG_CORE, then it's first magic field
FEATURE_LIST_MAGIC 0xFEA01234, then it's field list_revision
0x00000001 - revision is 1.
Determine the offset of the beginning of this page, that is from which place after zeros the size of the first tag starts. You can use dd utility (from busybox) to read and write files to not error with offsets.

Determine the number of blocks for search for dd command:
Hex 0x60600 = decimal 394752 -> divide it by 512 - page size -> therefore the number of blocks is 771.

3. Then we need to write modified tags file, which is we have already placed on SD card of our tablet. Shell into tablet:
adb shell
Umount raw partition:
umount /mnt/rawfs
Write a new file with tags page into it with appropriate offset:
dd if=/mnt/sdcard/Download/tags_new.bin of=/dev/block/mmcblk0 bs=512 count=1 seek=771
Then do not hurry and check that you have been written is right. That is, read block of 50 MB size, as have been described earlier:
dd if=/dev/block/mmcblk0 of=/mnt/sdcard/Download/mmcblk0_new.bin bs=512 count=102720
adb pull /mnt/sdcard/Download/mmcblk0_new.bin
Make sure that you wrote everything in the right place with correct offset accordingly before reboot.
If everything looks OK than you can reboot. In case anything went wrong you can use the reserved copy. Good luck.

After procedure touch screen appeared in kernel boot log (from dmesg):
<7>[ 6.358734] <3>01 31 01 .1.
<6>[ 6.358886] tr16c0_i2c_tsp 4-005c: tr16c0_startup_sequence: v0.1.131 1 - 0x00000000
<6>[ 6.359497] input: tr16c0_i2c_tsp as /devices/virtual/input/input5
<6>[ 6.360321] cpufreq_interactive_input_connect: connect to tr16c0_i2c_tsp

# ls /sys/bus/i2c/devices/

# cat /sys/bus/i2c/devices/*/name
OMAP I2C adapter
OMAP I2C adapter
OMAP I2C adapter
OMAP I2C adapter

# cat /sys/bus/i2c/devices/4-005c/uevent

Then you can unload old touch screen module
rmmod cypress_tma340
And also comment it from init.archosa80sboard.rc (CM 11.0 Android 4.4.4):
# head init.archosa80sboard.rc

import init.archos_init.rc

on init
#insmod /system/lib/modules/cypress-tma340.ko
insmod /system/lib/modules/tr16c0-i2c.ko

P.S. But, before editing this file, you need to remount partitions on write:
mount -o remount,rw /
That's all. You can find the same instruction on Russian on 4pda. Also I recommend update tablet to Xiaomi one with open kernel and Adroid firmware sources.
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes