Quote:
Originally Posted by customelectronic
Igorsk,
Well, I'd like to get a USB/or real serial interface hard/or not. ... so, following up on your idea(s)... (and assuming I'll be tackling this in 3 weeks...again.)
I don't have any access to check an actual sony for loaded modules, etc, so I can't answer even the simple which way is it *really* questions....
You mentioned a keyboard in the previous post; I see in the kernel for the 900 that the Freescale (ARM processor manufacturer) MXC keyboard port was modified for the ebook reader, strongly suggesting there is an active keyboard port. I can't check lsmod on the sony without control, so I don't know if it is module/compiled/active?
This isn't a USB keyboard .... do you know of how such a keyboard is connected? |
I don't think mxc keyboard controller is used in the 900 at all. I'm pretty sure all keys are connected to the subcpu only.
Quote:
Originally Posted by customelectronic
On the memory:
The actual flash/nand rom is a single chip Samsung KLM2G1DEDD. That's a "moviNand/MCP NAND 2Gig nand1 kind, 1.65-1.95V, with a S3C49VDX02 controller" ... which I assume would make/emulate the MMC/SD interface;  no datasheet. But the chip itself is a dual in line ball grid array. Unfortunately, I don't have a steel mask to re-ball it with new solder, so although I can remove it -- I can't solder it back on; and buying a new one looks to be impossible... |
Yes, moviNAND is Samsung trademark for flash chips with eMMC interface.
Quote:
Originally Posted by customelectronic
So that leaves isolating an access point and extracting it that way, then decoding with linux software BUT....
I see in drivers/mtd/mtd_blkdevs.c that Sony modified all Linux mtd drivers for enhanced speed, then I noticed...
Sony fully wrote a driver/mtd/sbl , the abbr. "sbl" is unexplained, but it seems consistent with "serial block", eg: a serial access device like SD/MMC cards...? so, very similar to your idea of eMMC.
|
sbl means "secondary bootloader", and nbl means "NAND bootloader". I think the sources in the Linux tree is what was used on older models (500/505/300). The new bootloaders are in the separate file )(nandboot_091125.tgz for PRS-900). AFAIR they're based on Freescale-provided code (see Linux BSP on Freescale's site). As far as I could determine, they don't offer any interactivity.
Quote:
Originally Posted by customelectronic
AND driver/mtd/sbl/mtdsbl.c links the sbl acronym to NAND/SBL memory which is the right kind of memory. The source code looks to be coding a proprietary format on the device, though I'm not sure. The Freescale MX31 processor has to have an interface already capable of booting the device, for it is the only rom -- or the ARM has to have an internal flash/mask rom to run a boot. sort of a LILO/GRUB type thing... last far stretch possibility --- otherwise --- there has to be another processor capable of loading RAM with Linux, and then resetting the ARM. hmmm... do you know which it is? or how to find out quickly?
|
It's quite possible that the initial bootloaders come from the eMMC flash as well - i.MX31 has an "SD card" boot mode.
You could enter the serial bootloader of the chip if you know which pins to ground (as someone
did with i.MXL), but that's not really doable without a service manual.
Quote:
Originally Posted by customelectronic
There are driver mods in drivers/mtd/nand/nand_bbt.c, .../mtd/sdmparse.c, ../mtd/eMMC ../mtd/mtdpart which all muddy up  the issue.
Reading the nand memory isn't going to happen today, it's too complicated without a good clue ... but if there are any more suggestions on the software methods, I'll still try them before leaving tomorrow. |
You need to boot into the recovery mode with the diagnostic card in - that loads up the serial USB module and if you use porkupan's login_update package it will replace /etc/shadow so that you can login without a password.
Quote:
Originally Posted by customelectronic
Sony mentioned discontinuing the 900, apparently they are changing the hardware...! so, this info is of limited value ... mostly good for people wishing to maintain and modify a defunct product... DMCA appropriate rvs. engineering. here's a good labeled photo of my board.
|
Actually from what I saw in the published sources of the new models, the hardware looks more or less the same. The E-Ink controller is upgraded to ISIS, the flash is bigger, and they'll probably beef up the subcpu to handle the IR touchscreen, but the rest looks to be more or less the same (main CPU, the R5C807, USB controller etc).
FWIW, attached is the dmesg output for the 900.