FORUMS
Remove All Ads from XDA

A80G9 mainboard hacking and chipset information

1,321 posts
Thanks Meter: 748
 
By scholbert, Senior Member on 9th May 2012, 01:17 PM
Post Reply Email Thread
Hi,

it's me again... this time the victim of my surgery is my Archos 80 G9 tablet with 8GByte.
The device is working pretty nice, but it's always fun to start investigation on the hardware .

Some general words about the design:
It seems obvious that Archos engineers started developing with TI Blaze development platform.
There'd been some hints in the source code and the design looks pretty similar.
Unfortunately there's no schematics of this platform... but fortunately there's the PandaBoard .
This board is fully documented (schematics as well) and there are a lot of open development projects all over the web.

Basically the Archos Gen9 tablets share the same base chipset with the Pandaboard and that's why there are many similarities.
One thing notable is the fact, that Archos implemented a eMMC/SD card chipset on the mainboard, instead of using a fully integrated eMMC device as to be found on the Gen8 mainboards.
In other words they coupled an eMMC controller (Phison PS7000) together with raw NAND flash (64GBit MLC).
This subsystem then got connected to mmc2 interface and is used as boot media (eMMC raw boot).

The other thing we may observe, is that the A80G9 and the A101G9 mainboards look pretty much the same in form and shape.
I guess, there are only little differences in the design, if there are any at least .
EDIT2: Have a look over here...
http://forum.xda-developers.com/show....php?t=1449438
Harfainx did a great job and put down some high-res pics from his A101G9.

Anyway there might be a lot to report, but i think it'll be better to come back from time to time and add some details and information.
You may prepare for some pics as well

A80G9 chipset information:
Processor
• Ti OMAP4430/60 (547-pin CBS BGA package) ARM Cortex A9 dual-core at 1/1.5 GHz with DSP
• POWERVR SGX540 Graphic accelerator: 3D OpenGL ES 2.0

Memory
• 512MB/1024MB LPDDR SDRAM (216-pin PoP BGA package) soldered on top of OMAP4430/60
• 8/16GB NAND (52-pin VLGA package) with eMMC bridge chip (PS7000) connected on mmc2 interface

Interfaces
• USB 2.0 OTG (OMAP4430/60 internal interface, MicroUSB connector)
• USB 2.0 EHCI host interface (USB3322 ULPI phy, TYP A connector)
• Micro SD slot (OMAP4430/60 internal mmc1 interface, SDHC compatible)

Display subsystem
• ChiMei 8" TFT-Display EJ080NA-04B (24Bit-LVDS interface)
• Ti SN75LVDS83B LVDS transmitter (56-pin BGA package)

Touchscreen subsystem
• Capacitiv touchscreen unit (Cypress controller TMA340, I2C interface)

HDMI subsystem
• OMAP4430/60 internal 24-Bit HDMI transmitter
• HDMI output (19-pin Mini HDMI connector)

Communication
• Ti WL1271 WiFi (802.11 b/g/n)
• Ti WL1271 Bluetooth 2.1 EDR

GPS chipset
• Ti NL5550 AGPS connected to uart0

Audio chipset
• Ti TWL6040 multichannel audio codec

Miscellaneous
• Built-in speaker
• Built-in Microphone
• Aptina MT9M114 1/6" 720p HD camera (1.26M)

Sensors
• Freescale MMA8453Q G-sensor
• AsahiKasei AK8975 compass-sensor

Power source
• Ti TWL6030 power management chip
• Ti TPS62361 core voltage regulator
• Internal: Lithium Polymer battery
• External: 5V/1.5A Power adapter/charger

Again i did some web research and made a smart datasheet collection.
Grab this zip-file.
EDIT5:
Updated datasheet collection...
Read on for some more information.

So what's next:
I don't know yet...
will start some hacking because i got a damaged mainboard

EDIT1:
Added some low res pics of the mainboard...

EDIT3:
To consider the OMAP4460 variants i added some lines in the chipset spec.
Though i did not open one of these devices, it is likely that Archos did use the same mainboard and upgraded the CPU and PoP-Memory.
Search the Ti website for further information on that SoC.
There's also a document which clarifies the differences between OMAP4430 and OMAP4460.
I may put it here as well if you like

EDIT4:
Some error corrections...

EDIT6:
Archos 3.0.8 kernel seems to be heavily based on this branch of Ti OMAP kernels:
http://git.omapzoom.org/?p=kernel/om...-omap-3.0-4470
If you run a diff between these two you'll get a pretty good overview about the Archos specific changes.
Might be interesting for those who like to create a newer kernel for the Gen9

Stay tuned!

scholbert
Attached Thumbnails
Click image for larger version

Name:	bottom_battery_s.JPG
Views:	1539
Size:	144.9 KB
ID:	1050576   Click image for larger version

Name:	bottom_ps7000_s.JPG
Views:	1476
Size:	130.4 KB
ID:	1050577   Click image for larger version

Name:	bottom_testpoints_s.JPG
Views:	1417
Size:	147.3 KB
ID:	1050578   Click image for larger version

Name:	tft_back_id_s.JPG
Views:	1309
Size:	67.6 KB
ID:	1050580   Click image for larger version

Name:	tft_touchcontroller_s.JPG
Views:	1353
Size:	74.0 KB
ID:	1050583   Click image for larger version

Name:	top_cpu_s.JPG
Views:	1357
Size:	134.7 KB
ID:	1050584   Click image for larger version

Name:	top_middle_s.JPG
Views:	1325
Size:	132.2 KB
ID:	1050585   Click image for larger version

Name:	top_nand_s.JPG
Views:	1261
Size:	123.6 KB
ID:	1050586   Click image for larger version

Name:	usb_host_s.JPG
Views:	1258
Size:	100.7 KB
ID:	1050589  
The Following 11 Users Say Thank You to scholbert For This Useful Post: [ View ] Gift scholbert Ad-Free
 
 
9th May 2012, 01:20 PM |#2  
DarkhShadow's Avatar
Senior Member
Flag Essex
Thanks Meter: 278
 
More
Maybe you would do some work with OMAP 4460 versions? Most new ones are 4460 now

Sent from my ice cream powered Nexus S
The Following User Says Thank You to DarkhShadow For This Useful Post: [ View ] Gift DarkhShadow Ad-Free
9th May 2012, 01:23 PM |#3  
OP Senior Member
Thanks Meter: 748
 
More
Quote:
Originally Posted by DarkhShadow

Maybe you would do some work with OMAP 4460 versions? Most new ones are 4460 now

Yupp i know, but i use to focus on the devices i personally own.
There's no need for me to buy one of these newer ones as i won't spent all my money on the latest stuff

Cheers scholbert
10th May 2012, 02:31 PM |#4  
OP Senior Member
Thanks Meter: 748
 
More
tweaking bootmode... success!!!!!
Hey

just a short update for the geeks out there...
Started to find the bootmode signals... not yet finished, but as you see it's obvious where to search
EDIT:
Hoho... got it!!!
See the new attachment.
I successfully tweaked bootmode to send ASIC ID over usb first.
This way it is posssible to get low level access to the platform.
With some additional work we might also recover bricks
Here's my first log:
Code:
» OMAPFlash v4.15 (Aug 12 2011)

» -v
» Entering parameter file:Targets\Projects\archos\usb_sdram.txt at line: 1
»     -omap 4
»     -t 600
»     -p SEVM_MDDR_ELPIDA_4G
»     -2
»     chip_download SDRAM C:\Projects\OMAPflasher\OMAPFlash\test_data\pattern_1k.bin
» Leaving parameter file:Targets\Projects\archos\usb_sdram.txt
» @Targets\Projects\archos\usb_sdram.txt
» Looking for device (omap usb)
» Please turn on device
» Waiting for device (omap usb)
» Found device (omap usb)
» Requesting ASIC id
» AsicId items 05
» AsicId id             01 05  01  44 30 07 04
» AsicId secure_mode    13 02  01  00
» AsicId public_id      12 15  01  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
» AsicId root_key_hash  14 21  01  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
» AsicId checksum       15 09  01  9C 66 9A D9 00 00 00 00
» Searching 2nd for: SEVM_MDDR_ELPIDA_4G 443007 04 GP
» Loading second file Targets\2nd-Downloaders\dnld_startup_omap4_gp_4g.2nd
» Entering parameter file:omapflash2nd.txt at line: 28
»     -pheriphalboot_reopen
» Reading board configuration file Targets\Configurations\configuration_evm4430es2.0_elpida_4g.txt
» Reading definition file .\targets\definitions\definitions_omap4.txt
»     -board_config Targets\Configurations\configuration_evm4430es2.0_elpida_4g.txt
» Leaving parameter file:omapflash2nd.txt
» Sending size of second file (0x00007804 bytes)
» Transferring second file to target (0x7804 bytes)
» Closing boot connection
» Found device (omap usb)
» Waiting for 2nd
Unfortunately the 2nd loader does not respond the way it should...
I found out that there's some trouble caused by the USB cable serving power to the board.
I guess this might be the reason for the interrupt of the transfer (the platform gets a soft reset at this point and does not return properly).
So i'll have to modify the cable for the next step.
Stay tuned!!!

Another thing is serial console... unfortunately no success yet, though i can tell there's something behind these marked testpoints.
I attached some logic and got some data, but nothing readable yet.
I tried with baudrates of 115200 and 1000000 (very common on Archos boards).
Nothing useful
I don't even know if it is connected to ttyO2 (uart3).
EDIT:
There's some news!!
Please see this post http://forum.xda-developers.com/show...3&postcount=22

EDIT2:
Just for your information:
JTAG debug pins had been identified in the meantime.
If you need low level debug features send me PM!

Anyway, i thought it would not harm to put it down here.

Cheers,

scholbert
Attached Thumbnails
Click image for larger version

Name:	top_cpu_bootmode_pins_id.jpg
Views:	941
Size:	172.5 KB
ID:	1062421  
The Following 3 Users Say Thank You to scholbert For This Useful Post: [ View ] Gift scholbert Ad-Free
10th May 2012, 07:56 PM |#5  
Shano56's Avatar
Senior Member
Flag Seattle
Thanks Meter: 555
 
More
Mr scholbert

I love your detailed descriptions and photos! good work!
The Following User Says Thank You to Shano56 For This Useful Post: [ View ] Gift Shano56 Ad-Free
11th May 2012, 01:53 PM |#7  
OP Senior Member
Thanks Meter: 748
 
More
OMAP4430 resource table
Hey,

first of all thanks for the positiv feedback.

I started stepping through some kernel code and hardware docs to collect information for low level programming
Just to give an overview of the internal resources here's how it looks like:
Code:
BASIC OFFSETs (stock loader)
=========================================================
loader offset           0x40300000      (SRAM)
avboot offset           0x87e80000      (SDRAM)
framebuffer base        0x9c000000      (SDRAM)

ACCELEROMETER
=========================================================
accel-interface         i2c_3           (addr 0x1c)
accel_int1              gpio_45         (pin  B20, mode3)
accel_int2              gpio_174        (pin  H25, mode3)

AUDIO
=========================================================
audio-interface         abe_pdm
                        abe_clks        (pin AH26, mode0)
                        abe_pdm_ul_data (Pin AG25, mode0)
                        abe_pdm_dl_data (pin AF25, mode0)
                        abe_pdm_frame   (pin AE25, mode0)
                        abe_pdm_lb_clk  (pin AF25, mode0)
audio_power_on          gpio_127        (pin AA27, mode3)
audio_irq               sys_nirq2       (pin  AF6, mode0)

CAMERA
=========================================================
camera interface        csi21
                        csi21_dx0       (pin  R26, mode0)
                        csi21_dy0       (pin  R25, mode0)
                        csi21_dx1       (pin  T26, mode0)
                        csi21_dy1       (pin  T25, mode0)
camera_reset            gpio_62         (pin  B23, mode3)

COMPASS
=========================================================
compass-interface       i2c_3           (addr 0x0C)
compass_data_ready      gpio_51         (pin  C21, mode3)

eMMC
=========================================================
emmc-interface          mmc2 (8bit I/O)
                        sdmmc2_clk      (pin  B11, mode1)
                        sdmmc2_cmd      (pin  B12, mode1)
                        sdmmc2_dat0     (pin  C12, mode1)
                        sdmmc2_dat1     (pin  D12, mode1)
                        sdmmc2_dat2     (pin  C13, mode1)
                        sdmmc2_dat3     (pin  D13, mode1)
                        sdmmc2_dat4     (pin  C15, mode1)
                        sdmmc2_dat5     (pin  D15, mode1)
                        sdmmc2_dat6     (pin  A16, mode1)
                        sdmmc2_dat7     (pin  B16, mode1)

GPS
=========================================================
gps-interface           uart0
gps_enable              gpio_41         (pin  A18, mode3)

HDMI
=========================================================
hdmi_pwr                gpio_37         (pin  D18, mode3)
hdmi_hpd                hdmi_hpd        (pin   B9, mode0)

POWER MANAGEMENT
=========================================================
twl6030-interface       i2c_0

tps62361_vsel0          gpio_wk7        (pin  AC2)	

1v8_pwron               gpio_34         (pin  C17, mode3)
vcc_pwron               gpio_35         (pin  D17, mode3)
5v_pwron                gpio_36         (pin  C18, mode3)

TFT
=========================================================
lcd_pwon                gpio_38         (pin  C19, mode3)
lvds_en                 gpio_39         (pin  D19, mode3)
lcd_rst                 gpio_53         (pin  C22, mode3)
lcd_stdby               gpio_101        (pin  A24, mode3)
lcd_avdd_en             gpio_12         (pin   N2, mode3)
bkl_en                  gpio_122        (pin AH24, mode3)
bkl_pwm                 dmtimer8_pwm_evt(pin  G27, mode1)

TOUCHSCREEN
=========================================================
tsp-interface           i2c_1
tsp_irq_gpio            gpio_112        (pin AD25, mode3)
tsp_pwr_gpio            gpio_110        (pin AD27, mode3)
tsp_shtdwn_gpio         gpio_0          (pin  J27, mode3)

USB OTG
=========================================================
vbus_musb_pwron         gpio_111        (pin AD26, mode3)
vbus_flag               gpio_113        (pin AC28, mode3)
vbus_detect             gpio_48         (pin  C20, mode3)
id                      gpio_49         (pin  D20, mode3)

USB EHCI
=========================================================
ehci_enable             gpio_42         (pin  B18, mode3)
3g_enable               gpio_40         (pin  B17, mode3)

WIFI/BT
=========================================================
wifi/bt	control         uart1
wifi-interface          mmc4 (SDIO)
                        sdmmc4_clk      (pin AE21, mode1)
                        sdmmc4_cmd      (pin AF20, mode1)
                        sdmmc4_dat0     (pin AF21, mode1)
                        sdmmc4_dat1     (pin AH19, mode1)
                        sdmmc4_dat2     (pin AG20, mode1)
                        sdmmc4_dat3     (pin AE20, mode1)
wifi_irq                gpio_102        (pin  B24, mode3)
wifi_power              gpio_103        (pin  C24, mode3)
bt_power                gpio_104        (pin  D24, mode3)
This table will get updated form time to time.
EDIT:
- added eMMC resources (mmc2 pins)

In the end this will result in a header file for x-load, u-boot or similar stuff

Have a nice day!

scholbert
The Following User Says Thank You to scholbert For This Useful Post: [ View ] Gift scholbert Ad-Free
12th May 2012, 10:13 AM |#8  
Junior Member
Thanks Meter: 0
 
More
The GPS chipset information shows it has a FM interface as well. Does it mean that Archos can be used as a FM radio receiver ? Sorry I am not such an expert in hardware. Is there an app that we can install if it is possible to make this work as a radio runer ?
12th May 2012, 12:11 PM |#9  
DarkhShadow's Avatar
Senior Member
Flag Essex
Thanks Meter: 278
 
More
Quote:
Originally Posted by mprasa

The GPS chipset information shows it has a FM interface as well. Does it mean that Archos can be used as a FM radio receiver ? Sorry I am not such an expert in hardware. Is there an app that we can install if it is possible to make this work as a radio runer ?

I think someone already looked into it and found while it does have one its not connected to anything

Sent from my ice cream powered Nexus S
14th May 2012, 01:17 PM |#10  
OP Senior Member
Thanks Meter: 748
 
More
Quote:
Originally Posted by mprasa

The GPS chipset information shows it has a FM interface as well. Does it mean that Archos can be used as a FM radio receiver ? Sorry I am not such an expert in hardware. Is there an app that we can install if it is possible to make this work as a radio runer ?

To be more precisely... the datasheet is about the NL5500, while on the Archos Gen9 a NL5550 is used.
The only difference is, that NL5550 is GPS only.
No FM in this chipset.

Quote:
Originally Posted by DarkhShadow

I think someone already looked into it and found while it does have one its not connected to anything

The truth is that WL1271 has FM capabilites, but unfortunately Archos decided to leave that out.
Cajl had contact to one of the developers, telling him that essential parts are not connected (e.g. FM antenna).
So no FM on Gen9

Regards,

scholbert
The Following User Says Thank You to scholbert For This Useful Post: [ View ] Gift scholbert Ad-Free
15th May 2012, 02:17 PM |#11  
OP Senior Member
Thanks Meter: 748
 
More
Sorry to interrupt you...
There's some news:
http://forum.xda-developers.com/show...28&postcount=4

Hihi

Cheers scholbert
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes