New Nook Glowlight Plus

[rupor]

Renate, it would be really nice if you would be able to publish dumps somewhere - before buying device I would like to check a couple of things. Now that Sony is not an option and I am not really happy with my kindle - new Nook seems like valid alternative...

 

[Renate]

Making some progress, but currently you are not going to get here without opening your Nook up at least one time.

 

[dnastase]

Bravo!
But besides bringing the serial interface physically to the outside of the case, how do you see it that the case has to be opened only once ?

 

[Windsor1959]

Looks very promising! Alas, I've never done a root console connection before, and the searches I've done so far haven't turned up much that looks relevant to this - or I might try it, for the experience of learning a new trick! But I can wait. I want to be able to install a launcher and sideload two or three apps. That's all.

 

[Renate]

Ok! Here's the results.

C:\>adb shell
[email protected]_6sl:/ #

How is this different? It's not over the hardware connection, it's over ADB on USB.
(As said, at the current state of knowledge you will have to crack open your Nook one time to get here.)

Now I've got to get out and get some exercise.

 

[dnastase]

Oh, ok, now I understand. Yes, that's exactly what I was not getting... thanks.

 

[Renate]

Some information points:

The first two partitions are not file systems, they are raw images with kernel and ramdisk.
The images are "ANDROID!" format and not generic Linux.
/dev/block/mmcblk1 is the primary boot
/dev/block/mmcblk2 is recovery
Partition 1 is only defined for about 6 Megs even though it is has a full 19 Megs of space available to it.
The adbd in both of these partitions is compiled to not allow root operation even if the properties are set correctly.
The Plus is 4.4.2, but most of the user software seems a rehash of the old Nook stuff.

To make things rooted:

Change default.prop
Change init.rc
Replace sbin/adbd with a version snarfed off the Android emulator Nexus 5, API 19, ARM.
setprop persist.sys.usb.config mtp,adb
setprop sys.usb.config mtp,adb
Optional: Modify init.E60QD0.usb.rc if you want ADB without MTP

Try writing your new images to partition 2.
You can run them with reboot recovery
If it all works out, write it to partition 1.

(I'm working on updating my bootutil tool to work with "ANDROID!" image headers.)

 

[rupor]

Well, not sure yet, I only looked quickly but judging by OSS code B&N just released device should fully support fastboot.

delta\u-boot\drivers\fastboot\fastboot.c:         printf("fastboot is in init......");

And we should be able to enter various modes by putting our fingers on screen during boot:

distro\u-boot\board\freescale\mx6sl_ntx\ntx_cmd.c:

					if (3 == flag) {
						_led_R (1);
						printf ("Entering recovery mode !!\n");
						iRet = 1;
						break;
					}
					else if (0x30 == flag) {
						_led_R (1);
						printf ("Entering external sd boot mode !!\n");
						iRet = 2;
						break;
					}
					else if (0x11 == flag) {
						_led_R (1);
						printf ("Entering fastboot mode !!\n");
						iRet = 3;
						break;
					}
					else {
						printf ("Wrong points combination ! 0x%x\n",flag);
					}

 

[dnastase]

Wow.! that would be interesting !

I just tried with two and three fingers but nothing happened. Maybe it depends on other things (eg: a screen region) ?

Where is this code ? what is OSS ?

 

[Renate]

Good catch @rupor !

There is fastboot supported.
The console prompts you to hit any key to go to fastboot mode.

The regular screen sensor driver is two point (verified with UsbMode).
It's clear from the snippet of code that it's looking for two fingers.
There could be other conditions, power switch, home key, USB connected...
It's also nice that it seems to print the flag if you hit the wrong points.

OTOH, I've tried a bunch of combinations and never seen a peep on the console.
We need to look at the rest of the code.

 

[rupor]

@dnastase I cannot post links here, but is you google for "OSS Release for NOOK 4.2" you will find "NOOK Device Terms of Service" with links to OSS releases.

Check happens during boot process (obviously as it is part of u-boot sources), presumably LED should blink:

_led_R(iRLight);iRLight=!iRLight;

And here is the rest:

			dataCnt=zforce_read (data);
			if (0 <= iRet && 4 == data[0]) {
				if (2 == data[1]) {
					int x,y;
					unsigned long flag=0;
					printf ("Got dual finger touched!!\n");
					x = (data[3]<<8) | data[2];
					y = (data[5]<<8) | data[4];
					if (60 > x && (DEFAULT_PANEL_W-60) < y)
						flag |= 1;
					if ((DEFAULT_PANEL_H-60) < x && (DEFAULT_PANEL_W-60) < y)
						flag |= 2;
					if (60 > x && 60 > y)
						flag |= 0x10;
					if ((DEFAULT_PANEL_H-60) < x && 60 > y)
						flag |= 0x20;
					x = (data[12]<<8) | data[11];
					y = (data[14]<<8) | data[13];

					if (60 > x && (DEFAULT_PANEL_W-60) < y)
						flag |= 1;
					if ((DEFAULT_PANEL_H-60) < x && (DEFAULT_PANEL_W-60) < y)
						flag |= 2;
					if (60 > x && 60 > y)
						flag |= 0x10;
					if ((DEFAULT_PANEL_H-60) < x && 60 > y)
						flag |= 0x20;

So it checking coordinates it seems - 2 fingers should be in some areas of the screen, will analyze code some more tomorrow.

Renate is right though - some other conditions may apply albeit I have not seen it yet...

 

[Renate]

The OSS sources are here:
http://dispatch.barnesandnoble.com/content/dam/ccr/nook/nook12/oss/nook_glowlight_plus_4_2_0.tgz
http://dispatch.barnesandnoble.com/content/dam/ccr/nook/nook12/oss/nook_4.5-delta.tgz

If you manage to get fastboot to popup it will appear as VID 18D1, PID 0D02.
For Windows users you may need to add this to your INF for the driver:

; IMX6SL
%SingleFastBootInterface%    = USB_Install, USB\VID_18D1&PID_0D02

 

[Renate]

Looking through the code, it appears that the two fingers must be in adjacent corners.
They must be within 60 pixels of the corner, that means, pretty tight inside.
I see all the messages from the source in the actual u_boot ("Got dual finger touched!!"),
but I have never seen that message. It should be easy to get a dual finger message.

 

[rupor]

If I am reading code right (and I do not have the device - will try to visit store tomorrow, but who knows) it goes like that:

Device should be turned on by pressing power key and holding finger on home key (let's say "pressing" home key) - this initiates selection procedure. LED should change status and then you suppose to have your fingers in proper corners of the screen to select fastboot or recovery procedure. If fingers are in adjacent corners it will be fastboot, if in diagonal - recovery.

Of course I could be totally wrong, but entering recovery on Sony (also FreeScale) was never easy and device had physical buttons

Renate, if you could get into u-boot shell - verifying that we are looking at proper code should be fairly easy. Just issue

ntxup init
ntxup waittouch [interval (ms)] [timeout (ms)]

And you should be able to check this two-finger procedure locating proper positions...

 

[Renate]

Hmm, it looks like something is screwed up somewhere:

eBR-1A # ntxup waittouch
i2c_addr:chip address cycle fail(a1)
i2c_addr failed
zforce read failed !

It goes into a loop and repeats.
It's the same with supplied arguments.

 

[rupor]

The only thing which comes to mind is issuing "ntxup release" and then trying to read again. If it would not help - I am looking in the wrong place, that would not be the first time

 

[dnastase]

There is also some confusion I think to the orientation of the screen:

#define DEFAULT_PANEL_W 1440
#define DEFAULT_PANEL_H 1080

so maybe it should be hold horizontally ??

 

[Renate]

#define DEFAULT_PANEL_W 1440
#define DEFAULT_PANEL_H 1080

Yes, the native viewpoint is landscape.
That is fairly typical, also true of the other Nooks.
OTOH, the coordinates in that routine are considered from the portrait viewpoint.

ntxup release goes without a complaint.
(OTOH, all unknown commands to ntxup also do.)
ntxup waittouch does as before, loops on failure to read.

Wait! I know what the problem is:
They have the u-boot touch configured for Zforce IR screen.
We have an Elan touch.

 

[rupor]

Nice - and I though it would be easy :laugh:

Seriously - device cannot be serviced without opening the case as it has no way to enter recovery mode during boot? Or I am missing something here? Back to sources...

 

[rupor]

OK, how about this one:

in ntx_comm.c:

		iUSB_in=ntx_detect_usb_plugin(0);
                . . . . .
		if(iUSB_in&USB_CHARGER_OTG) {
			printf("\n**********************************\n\n");
			printf("\n** fastboot mode OTG USB        **\n\n");
			printf("\n**********************************\n\n");
			iRet = NTX_BOOTMODE_FASTBOOT;
			//fastboot_connection_timeout_us_set(5*1000*1000);
			fastboot_connection_timeout_us_set(0);
			fastboot_connection_abort_at_usb_remove_chk_setup(&ntx_is_fastboot_abort_inusbremove);
		}

ntx_detect_usb_plugin seems to be ntx_hw.c. I am not sure what parts are relevant to us (since I do not know what hardware configuration we have) but in one particular case it seems to be looking for usb id pin and then returns USB_CHARGER_OTG. Execution of this particular branch of code depends on hardware configuration:

	if(49==gptNtxHwCfg->m_val.bPCB && gptNtxHwCfg->m_val.bPCB_REV>=0x20) {
		// E60QDXA2
		// detect the usb id pin .
		if(!ntx_gpio_get_value(&gt_ntx_gpio_USBID)) {
			iRet |= USB_CHARGER_OTG;
		}
	}

Do you think it worth exploring? I am not sure why timeout is set to 0 here...