Group: Hardware/Computers/e-readers/Kobo/Aura H2O Edition 2

== External interfaces ==
=== USB ===
Several interfaces are exposed through USB:
* It's possible to make the device switch to fastboot during boot
* If the device is not registered, you can switch to mass-storage by selecting "no wifi" during the device boot.

=== Power button ===
=== Touchscreen ===

== Internal interfaces ==
=== Serial/UART ===
{| class="wikitable"  border="1"
|-
| Voltage
| 3.3v
|-
| Baudrate
| 115200
|-
| Settings
| 8N1 (the default almost everywhere)
|}

To get a shell you can login through the serial port with the user 'root':
 (none) login: root
 [root@(none) ~]# 

However once logged the console will probably freeze at some point. This is because the device has aggressive power management which makes the device goes into suspend.

To wake up the device, touching the screen is enough, however touching the screen all the time is not very convenient for development.

It seems to be an userspace application that makes the device goes into suspend.
So we will overwrite /sys/power/state with a file that does nothing.
We have ram filesystem mounted in /tmp, so we will use that to be saver (as it will not make permanent modifications):
 [root@(none) ~]# mount
 [...]
 none on /tmp type tmpfs (rw,relatime,size=16384k)
 [...]
We can overwrite /sys/power/state like that:
 [root@(none) ~]# touch /tmp/state
 [root@(none) ~]# mount -o bind /tmp/state /sys/power/state

This effectively prevent the device from going into suspend.

=== main storage ===

==== Partitions ====
With fdisk or by looking in /proc/partition we can see 3 partitions:
{| class="wikitable"  border="1"
|-
| partition
| size
| function
| source
|- 
| mmcblk0p1
| 256M
| rootfs
| cat /proc/cmdline: root=/dev/mmcblk0p1
|-
| mmcblk0p2
| 256M
| Backup rootfs ?
| after mounting it, there are some similar files. Strangely there are no kernel modules in this one.
|-
| mmcblk0p3
| 6.8G
| user data
| mount: /dev/mmcblk0p3 on /mnt/onboard type vfat
|-
|}

==== Exporting the internal eMMC as a block device ====
After getting a shell in u-boot we can look at the list of eMMC/SD cards:
 eBR-1A # mmc list
 FSL_SDHC: 0 (eMMC)
 FSL_SDHC: 1

The second mmc listed above doesn't seem to exist:
 eBR-1A # mmc dev 1
 Card did not respond to voltage select!
This is probably because the u-boot code is based on the code for a Freescale developement/evaluation board and since device manufacturers need to ship products fast they probably didn't bother removing the code for that non-existing hardware.

There is a command called 'ums' in u-boot that can export the e-MMC card through USB and make it appear as a mass storage device (like an USB key or an USB hard disk) to the computer it's connected to.

To use it you need to first connect an usb cable between your computer and the e-book reader and then type 'ums 0 mmc 0' in u-boot like that:
 eBR-1A # ums 0 mmc 0
 UMS: LUN 0, dev 0, hwpart 0, sector 0xe90000

You can then see it on your laptop:
 $ lsblk 
 [...]
 sdb                         8:16   1   7.3G  0 disk  
 ├─sdb1                      8:17   1   256M  0 part  
 ├─sdb2                      8:18   1   256M  0 part  
 └─sdb3                      8:19   1   6.8G  0 part

==== Fastboot ====
There is a fastboot command in u-boot. If you want to enable it from the u-boot shell you can do it like that:
 # fastboot 0
 ptn 0 name='mbr' start=0 len=1
 ptn 1 name='sn' start=1 len=1
 ptn 2 name='bootloader' start=2 len=1022
 ptn 3 name='hwcfg' start=1024 len=2
 ptn 4 name='ntxfw' start=1030 len=255
 ptn 5 name='waveform' start=14336 len=20480
 ptn 6 name='logo' start=34816 len=4096
 ptn 7 name='bootenv' start=1536 len=510
 ptn 8 name='kernel' start=2048 len=12284
 ptn 9 name='dtb' start=1286 len=250
 ptn 10 name='rootfs' start=49152 len=524289
 ptn 11 name='vfat' start=1097730 len=14139389
 ptn 12 name='recoveryfs' start=573441 len=524289

Here we have access to a lot more partition than with the block device export over USB.

=== Hidden partitions ===

== PCB ==
Here are the chips on the top of the PCB.
Caevats:
* you need a big screen to view properly the markings as it will line-break with smaller screens
* The markings might contain errors as they are tiny and some letter/number could be mixed up
* I didn't disassemble it enough to see the bottom because the connectors seemed really fragile (they even had glue inside them) so if I do, I fear that I won't be able to put everything back in place. There might be some more chips on the bottom.

{| class="wikitable"  border="1"
|-
! Usage
! Location
! Package
! Markings
! Driver(s)
! Documentation
|-
| 512M [https://en.wikipedia.org/wiki/Random-access_memory RAM]
| 
| 168-Ball PoP-FBGA
| 
 [http://www.nanya.com NANYA] 1718
 [http://www.nanya.com/en/Product/3803/NT6TL128M32BQ-G0 NT6TL 128M 32BQ-G0]
 7201166 AEP 3TW
| ?
| 
* [http://www.nanya.com/Files/692?Filename=4Gb_LPDDR2_B_Die_component_Datasheet.pdf&ProductId=3,803 Datasheet]
|-
| ?
|
| ?
| 
 SEC 737
 BO41
 KLM8616EME
 H56P4788D
| ?
|
|-
| [https://en.wikipedia.org/wiki/System_on_a_chip System on a chip]
| 
| ? (BGA)
| 
 MCIMX6V7DVN10AB
 XAA 1739
 TAIW HMAAXK
| Lots of drivers
|
|-
| WiFi chip (and potentially other features)
| 
| ?
|
 REALTEK
 8189PTY
 H857492
 GH438
| ?
|
|-
| ?
|
| ?
|
 RICOH AC5T619
 1137
 7409N1
|
|-
| [https://en.wikipedia.org/wiki/Power_management_integrated_circuit Power management integrated circuit] (and potentially other features)
| 
| ?
|
 TPS
 65185
 T1 7AI
 CS6S G4
| ?
|
|-
|
| On the display flex cable
| ?
|
 TT21000
 -48L0I
 1725 B03
 PRD627959
 PHI   □ C
 041
| ?
|
|-
|}

=== Pictures ===
Some pictures of the top PCB taken with a camera:
* https://archive.org/details/kobo_aura_H2O_edition_2_pcb_01.jpeg
* https://archive.org/details/kobo_aura_H2O_edition_2_pcb_02.jpeg
* https://archive.org/details/kobo_aura_H2O_edition_2_pcb_03.jpeg
* https://archive.org/details/kobo_aura_H2O_edition_2_pcb_04.jpeg
* https://archive.org/details/kobo_aura_H2O_edition_2_pcb_05.jpeg
* https://archive.org/details/kobo_aura_H2O_edition_2_pcb_06.jpeg
* https://archive.org/details/kobo_aura_H2O_edition_2_pcb_07.jpeg
* https://archive.org/details/kobo_aura_H2O_edition_2_pcb_08.jpeg
* https://archive.org/details/kobo_aura_H2O_edition_2_pcb_09.jpeg
* https://archive.org/details/kobo_aura_H2O_edition_2_pcb_10.jpeg

== Software ==
=== Kobo u-boot version ===
U-boot is a free software bootloader.
The [https://github.com/kobolabs/Kobo-Reader/blob/master/hw/imx6sll-aurah2o2-aura/bootloader.tar.bz2?raw=true source code] is provided by kobo.

It is based on one of the branches/commits of the freescale fork of u-boot for their I.MX System on a chip.

==== u-boot serial console ====
To get a shell in u-boot you will need to setup a serial cable, and press a key in the serial console during boot:
 U-Boot 2016.03-00031-gcd5f70c (Aug 31 2017 - 13:17:25 +0800)
 
 CPU:   Freescale i.MX6SLL rev1.1 996 MHz (running at 792 MHz)
 CPU:   Commercial temperature grade (0C to 95C) at 43C
 Reset cause: WDOG
 Board: MX6SLL LPDDR2 NTX
 I2C:   ready
 DRAM:  512 MiB
 __get_sd_number(),cfg23=0,cfg24=0 
 MMC:   board_mmc_init() : isd=0 
 board_mmc_init() : wifi=2 
 FSL_SDHC: 0, FSL_SDHC: 1
 In:    serial
 Out:   serial
 Err:   serial
 ntx_hw_early_init() 0
 ram p=80000000,size=536870912
 switch to partitions #0, OK
 mmc0(part 0) is current device
 mmc read 0x9ffffe00 0x3ff 0x1
 
 MMC read: dev # 0, block # 1023, count 1 ... 1 blocks read: OK
 mmc read 0x9ffffe00 0x400 0x1
 
 MMC read: dev # 0, block # 1024, count 1 ... 1 blocks read: OK
 ntx_hw_late_init()
 mmc read 0x9ffffc00 0x1 0x1
 
 MMC read: dev # 0, block # 1, count 1 ... 1 blocks read: OK
 NTXSN not avalible !
 ntx_gpio_get_value(402) : error parameter ! null ptr !
 ntx_config_fastboot_layout():10 binaries partition added
 ntx_config_fastboot_layout():3 mbr partition added
 check_and_clean: reg 0, flag_set 0
 Fastboot: Normal
 Net:   CPU Net Initialization Failed
 No ethernet found.
 Hit any key to stop autoboot:  0 
 eBR-1A #

=== Stock OS analysis ===
* The default OS forces the user to register or use some network services like Kobo, google, facebook, etc, however we can get a shell through the serial port.

==== Source code ====
* The [https://github.com/kobolabs/Kobo-Reader/blob/master/hw/imx6sll-aurah2o2-aura/kernel.tar.bz2?raw=true Linux source code] is provided by Kobo. It is most probably based on an unknown branch in Freescale's fork of Linux for I.MX system on a chip.
* Some less interesting userspace source code is probably also provided at the same location.

==== Linux sources analysis ====
The sources have multiples boards selected:
 CONFIG_MACH_MX6Q_ARM2=y
 CONFIG_MACH_MX6SL_ARM2=y
 CONFIG_MACH_MX6SL_EVK=y
 CONFIG_MACH_MX6SL_NTX=y
 # CONFIG_MACH_MX6Q_SABRELITE is not set
 CONFIG_MACH_MX6Q_SABRESD=y
However there is a gen_bootimg.sh with inside:
 ./mkbootimg --kernel arch/arm/boot/zImage --ramdisk uramdisk.img --base 0x80800000 --cmdline "console=ttymxc0,115200 init=/init androidboot.console=ttymxc0 max17135:pass=2, fbmem=6M video=mxcepdcfb:E060SCM,bpp=16 no_console_suspend" --board evk_6sl_eink -o boot.img

This seem to indicate that the file describing the e-reader hardware is arch/arm/mach-mx6/board-mx6sl_evk.c (along with arch/arm/mach-mx6/mx6sl_evk_pmic_pfuze100.c)

The source code of this file seem to be derived from a single board computer from Freescale/NXP, but it is odd as some features not present in this e-reader hardware aren't disabled at compilation time.

==== Firmwares ====
Since Linux and u-boot sources are available, the most interesting information (for RYF certification) to look for is if some peripherals require a non-free firmware.
The most common places where firmwares can be used or required are:
* The WiFi/bluetooth driver
* The touchscreen driver

It might also be a good idea to double check that the e-paper display only needs some calibration data and doens't require any nonfree firmware

==== GPU ====
According to the linux compilation configuration the GPU is unused:
 #
 # MXC Vivante GPU support
 #
 # CONFIG_MXC_GPU_VIV is not set

==== WiFi ====
The WiFi chip seem to use an out of tree driver:
 CONFIG_WLAN=y
 # CONFIG_USB_ZD1201 is not set
 # CONFIG_WIFI_CONTROL_FUNC is not set
 # CONFIG_BCM4329 is not set
 # CONFIG_BCMDHD is not set
 # CONFIG_HOSTAP is not set
This will need a bit more research to get some confirmation on that

==== Boot logs ====
* [[Group:Hardware/Freest/e-readers/Aura_H2O_Edition_2/boot_log_Bienvenue_sur_Kobo_!|First Boot]]

==== runtime informations ====
/proc/cmdline:
 console=ttymxc0,115200 rootwait rw no_console_suspend hwcfg_p=0x9ffffe00 hwcfg_sz=110 waveform_p=0x9fdc8a00 waveform_sz=2323160 ntxfw_p=0x9fdc6400 ntxfw_sz=9474 mem=509M boot_port=0 rootfstype=ext4 root=/dev/mmcblk0p1 quiet

== Manufacturer informations ==
* [https://kbdownload1-a.akamaihd.net/magento/userguides/downloads/KoboAuraH2O-ed2/KoboAuraH2O-Edition2-userguide_EN.pdf Device manual]