Group: Hardware/Computers/e-readers/Kobo/Aura H2O Edition 2

Revision as of 14:16, 18 June 2018

External interfaces

USB

Several interfaces are exposed through USB:

It's possible to make the device switch to fastboot during boot
If the device is not registered, you can switch to mass-storage by selecting "no wifi" during the device boot.

Power button

Touchscreen

Internal interfaces

Serial/UART

Voltage	3.3v
Baudrate	115200
Settings	8N1 (the default almost everywhere)

To get a shell you can login through the serial port with the user 'root':

(none) login: root
[root@(none) ~]#

However once logged the console will probably freeze at some point. This is because the device has aggressive power management which makes the device goes into suspend.

To wake up the device, touching the screen is enough, however touching the screen all the time is not very convenient for development.

It seems to be an userspace application that makes the device goes into suspend. So we will overwrite /sys/power/state with a file that does nothing. We have ram filesystem mounted in /tmp, so we will use that to be saver (as it will not make permanent modifications):

[root@(none) ~]# mount
[...]
none on /tmp type tmpfs (rw,relatime,size=16384k)
[...]

We can overwrite /sys/power/state like that:

[root@(none) ~]# touch /tmp/state
[root@(none) ~]# mount -o bind /tmp/state /sys/power/state

This effectively prevent the device from going into suspend.

PCB

Here are the chips on the top of the PCB. Caevats:

you need a big screen to view properly the markings as it will line-break with smaller screens
The markings might contain errors as they are tiny and some letter/number could be mixed up
I didn't disassemble it enough to see the bottom because the connectors seemed really fragile (they even had glue inside them) so if I do, I fear that I won't be able to put everything back in place. There might be some more chips on the bottom.

Usage	Location	Package	Markings	Driver(s)	Documentation
512M RAM		168-Ball PoP-FBGA	NANYA 1718 NT6TL 128M 32BQ-G0 7201166 AEP 3TW	?	Datasheet
?		?	SEC 737 BO41 KLM8616EME H56P4788D	?
System on a chip		? (BGA)	MCIMX6V7DVN10AB XAA 1739 TAIW HMAAXK	Lots of drivers
WiFi chip (and potentially other features)		?	REALTEK 8189PTY H857492 GH438	?
?		?	RICOH AC5T619 1137 7409N1
Power management integrated circuit (and potentially other features)		?	TPS 65185 T1 7AI CS6S G4	?
	On the display flex cable	?	TT21000 -48L0I 1725 B03 PRD627959 PHI □ C 041	?

Pictures

Some pictures of the top PCB taken with a camera:

Software

Kobo u-boot version

U-boot is a free software bootloader. The source code is provided by kobo.

It is based on one of the branches/commits of the freescale fork of u-boot for their I.MX System on a chip.

u-boot serial console

To get a shell in u-boot you will need to setup a serial cable, and press a key in the serial console during boot:

U-Boot 2016.03-00031-gcd5f70c (Aug 31 2017 - 13:17:25 +0800)

CPU:   Freescale i.MX6SLL rev1.1 996 MHz (running at 792 MHz)
CPU:   Commercial temperature grade (0C to 95C) at 43C
Reset cause: WDOG
Board: MX6SLL LPDDR2 NTX
I2C:   ready
DRAM:  512 MiB
__get_sd_number(),cfg23=0,cfg24=0 
MMC:   board_mmc_init() : isd=0 
board_mmc_init() : wifi=2 
FSL_SDHC: 0, FSL_SDHC: 1
In:    serial
Out:   serial
Err:   serial
ntx_hw_early_init() 0
ram p=80000000,size=536870912
switch to partitions #0, OK
mmc0(part 0) is current device
mmc read 0x9ffffe00 0x3ff 0x1

MMC read: dev # 0, block # 1023, count 1 ... 1 blocks read: OK
mmc read 0x9ffffe00 0x400 0x1

MMC read: dev # 0, block # 1024, count 1 ... 1 blocks read: OK
ntx_hw_late_init()
mmc read 0x9ffffc00 0x1 0x1

MMC read: dev # 0, block # 1, count 1 ... 1 blocks read: OK
NTXSN not avalible !
ntx_gpio_get_value(402) : error parameter ! null ptr !
ntx_config_fastboot_layout():10 binaries partition added
ntx_config_fastboot_layout():3 mbr partition added
check_and_clean: reg 0, flag_set 0
Fastboot: Normal
Net:   CPU Net Initialization Failed
No ethernet found.
Hit any key to stop autoboot:  0 
eBR-1A #

Exporting the internal eMMC as a block device

After getting a shell in u-boot we can look at the list of eMMC/SD cards:

eBR-1A # mmc list
FSL_SDHC: 0 (eMMC)
FSL_SDHC: 1

The second mmc listed above doesn't seem to exist:

eBR-1A # mmc dev 1
Card did not respond to voltage select!

This is probably because the u-boot code is based on the code for a Freescale developement/evaluation board and since device manufacturers need to ship products fast they probably didn't bother removing the code for that non-existing hardware.

There is a command called 'ums' in u-boot that can export the e-MMC card through USB and make it appear as a mass storage device (like an USB key or an USB hard disk) to the computer it's connected to.

To use it you need to first connect an usb cable between your computer and the e-book reader and then type 'ums 0 mmc 0' in u-boot like that:

eBR-1A # ums 0 mmc 0
UMS: LUN 0, dev 0, hwpart 0, sector 0xe90000

You can then see it on your laptop:

$ lsblk 
[...]
sdb                         8:16   1   7.3G  0 disk  
├─sdb1                      8:17   1   256M  0 part  
├─sdb2                      8:18   1   256M  0 part  
└─sdb3                      8:19   1   6.8G  0 part

Fastboot

There is a fastboot command in u-boot. If you want to enable it from the u-boot shell you can do it like that:

# fastboot 0
ptn 0 name='mbr' start=0 len=1
ptn 1 name='sn' start=1 len=1
ptn 2 name='bootloader' start=2 len=1022
ptn 3 name='hwcfg' start=1024 len=2
ptn 4 name='ntxfw' start=1030 len=255
ptn 5 name='waveform' start=14336 len=20480
ptn 6 name='logo' start=34816 len=4096
ptn 7 name='bootenv' start=1536 len=510
ptn 8 name='kernel' start=2048 len=12284
ptn 9 name='dtb' start=1286 len=250
ptn 10 name='rootfs' start=49152 len=524289
ptn 11 name='vfat' start=1097730 len=14139389
ptn 12 name='recoveryfs' start=573441 len=524289

Stock OS analysis

The default OS forces the user to register or use some network services like Kobo, google, facebook, etc, however we can get a shell through the serial port.

Source code

The Linux source code is provided by Kobo. It is most probably based on an unknown branch in Freescale's fork of Linux for I.MX system on a chip.
Some less interesting userspace source code is probably also provided at the same location.

Linux sources analysis

The sources have multiples boards selected:

CONFIG_MACH_MX6Q_ARM2=y
CONFIG_MACH_MX6SL_ARM2=y
CONFIG_MACH_MX6SL_EVK=y
CONFIG_MACH_MX6SL_NTX=y
# CONFIG_MACH_MX6Q_SABRELITE is not set
CONFIG_MACH_MX6Q_SABRESD=y

However there is a gen_bootimg.sh with inside:

./mkbootimg --kernel arch/arm/boot/zImage --ramdisk uramdisk.img --base 0x80800000 --cmdline "console=ttymxc0,115200 init=/init androidboot.console=ttymxc0 max17135:pass=2, fbmem=6M video=mxcepdcfb:E060SCM,bpp=16 no_console_suspend" --board evk_6sl_eink -o boot.img

This seem to indicate that the file describing the e-reader hardware is arch/arm/mach-mx6/board-mx6sl_evk.c (along with arch/arm/mach-mx6/mx6sl_evk_pmic_pfuze100.c)

The source code of this file seem to be derived from a single board computer from Freescale/NXP, but it is odd as some features not present in this e-reader hardware aren't disabled at compilation time.

Firmwares

Since Linux and u-boot sources are available, the most interesting information (for RYF certification) to look for is if some peripherals require a non-free firmware. The most common places where firmwares can be used or required are:

The WiFi/bluetooth driver
The touchscreen driver

It might also be a good idea to double check that the e-paper display only needs some calibration data and doens't require any nonfree firmware

GPU

According to the linux compilation configuration the GPU is unused:

#
# MXC Vivante GPU support
#
# CONFIG_MXC_GPU_VIV is not set

WiFi

The WiFi chip seem to use an out of tree driver:

CONFIG_WLAN=y
# CONFIG_USB_ZD1201 is not set
# CONFIG_WIFI_CONTROL_FUNC is not set
# CONFIG_BCM4329 is not set
# CONFIG_BCMDHD is not set
# CONFIG_HOSTAP is not set

This will need a bit more research to get some confirmation on that

Boot logs

First Boot

main storage

Here we have 3 partitions:

partition	size	function	source
mmcblk0p1	256M	rootfs	cat /proc/cmdline: root=/dev/mmcblk0p1
mmcblk0p2	256M	Backup rootfs ?	after mounting it, there are some similar files. Strangely there are no kernel modules in this one.
mmcblk0p3	6.8G	user data	mount: /dev/mmcblk0p3 on /mnt/onboard type vfat

runtime informations

/proc/cmdline:

console=ttymxc0,115200 rootwait rw no_console_suspend hwcfg_p=0x9ffffe00 hwcfg_sz=110 waveform_p=0x9fdc8a00 waveform_sz=2323160 ntxfw_p=0x9fdc6400 ntxfw_sz=9474 mem=509M boot_port=0 rootfstype=ext4 root=/dev/mmcblk0p1 quiet

Manufacturer informations

Device manual

Navigation menu