USB host mode hacking - Page 2

Kent Walters · 10-28-2009, 10:45 PM

My reservations about enabling Host on the Dr's mini B port are gone, with some reservations/cautions that I'll explain later (some will find it boring

).

On the DR's board, all 5 pins to the USB socket are wired. According to the On The Go Supplement (OTG) to the USB spec., pin 4 of a mini B port is not used. The only reason I can think of for iRex to have wired all 5 pins is that iRex intended the DR to be an On The Go device, and decided not to, and just substituted a Mini B socket for the OTG Mini AB socket (and we must bear in mind that they may have had a good reason for doing this).

I suspect that if an adapter cable that connects pin 4 to pin 5 is used (don't do this) to connect a B device (like a thumb drive) that the DR will power the device and respond with an error message (like "Device not recognized"). If that happens, then the DR's port, for sure, is Host capable, and the 'hardware limitation' iRex spoke of is only the physical socket itself. If it powers the device but doesn't respond, we may have further problems in firmware. If it does nothing, we are right back here.

My plan is to wire a Mini AB socket to a mini B plug, with all 5 pins wired straight thru (this is illegal, according to the USB spec--see the warning below). I'm having trouble finding a suitable cable, but will visit The Robot Store this weekend, with my hopes. Failing there, I will wire it with two lengths of USB cable instead of one.

I'm hoping to do this weekend, but things keep happening... I'll post back with results. I hope everyone keeps in mind that I have a spare (broken screen) DR to test/hack/destroy.

WARNINGS: The main reason for the different USB connectors is to prevent damaging equipment; if a Host port is connected to a Host port, one or both devices may be damaged (and Murphy's Law applies). If you make a cable like the one that I said, 'don't do this,' PAINT IT RED, and NEVER use it to connect your DR (or anything else) to your computer or charger. This is the cause of my reluctance to using this port on the DR.

A cable like the one I'm going to make will keep everything safe, as long as it is used with USB 'legal' cables and devices. If anyone has any questions, please ask.

BTW, scotsman, could you tell me where to find the Freescale spec? I couldn't find it.

I hope you get some help on the software end

.

Magic Is afoot,

Kent

scotsman · 10-29-2009, 07:28 AM

Hi Kent,

thanks for informing about the cables. Now I can almost 100% assure you that when you plug in your new cable, nothing will happen. This is because a) I have once tried it with just bridging the pins with a needle, and b) because as it is, no appropriate driver is running on the device.
Somehow, when you plug in your PC, the DR detects it (when it asks you whether you wnt to mount), and when you say yes, it seems to load some driver to operate the device in gadget (slave/device, not host) mode. Naturally, in this state there is no way of executing a shell script with "lsmod", so there is no way I can tell what module is loaded.
One way to go were to find out which script is executed when mounting the device. I could try that on the emulator maybe, if the script is there, (on the emulator it is not such a pain to browse through directories and "cat" files then on the device - see my "terminal workaround" post).

On your open device, could you check where the usb is wired to? Are all pins connected to the freescale? It is clear that all pins are wired somewhere, since otherwise you could not charge the device and transfer data. The question, however, is wheter the power pins go to the freescale CPU as well, or to some charging circuit. This is important because we will need power out of the socket, which will only come from the CPU's USB controller.

Also, while your hardware solution will work fine (just search for USB OTG Nokia N800), once the right driver is in place, it should be possible to switch to host mode via software only. The Nokia N8x0's do that, for example. But again, the driver needs to be loaded first, and that's where I am stuck now.

scotsman · 10-29-2009, 07:29 AM

Here the links:
general processor information:
http://www.freescale.com/files/32bit...1FS.pdf?fpsp=1
http://www.freescale.com/files/32bit...1PB.pdf?fpsp=1
http://www.freescale.com/files/32bit...X31.pdf?fpsp=1

Specifically about USB:
this thread: http://forums.freescale.com/freescal...thread.id=1863
They refer to a file in a large iso file, I take the liberty to attach that pdf file here, herewith referencing freescale.

Kent Walters · 10-31-2009, 04:30 PM

Quote:

Originally Posted by scotsman

Hi Kent... Now I can almost 100% assure you that when you plug in your new cable, nothing will happen. This is because a) I have once tried it with just bridging the pins with a needle...

Shorting pins 4 & 5? In what way?

Quote:

Originally Posted by scotsman

... Somehow, when you plug in your PC, the DR detects it (when it asks you whether you wnt to mount)

When a USB connection is made, the power pins (being longer) connect first. This causes the device that senses the power to poll the data lines (lines 2 & 3). If there is no signal, some devices, like the DR, assume that charge only is intended, and go to that mode. (Other devices shut down the port if there is no data; this is why some--adequately powered--chargers will not charge some devices.)

Quote:

Originally Posted by scotsman

... and when you say yes, it seems to load some driver to operate the device in gadget (slave/device, not host) mode.

I was hoping, if everything was wired as it might be, that that OTG Host would be enabled at the hardware level, but that the Freescale, lacking drivers, would not know what to do, and throw up an error message. There are different ways for USB to be set up, but this would have been a sure fire way to know that we are not headed for a dead-end.

Quote:

Originally Posted by scotsman

One way to go were to find out which script is executed when mounting the device. I could try that on the emulator maybe, if the script is there, (on the emulator it is not such a pain to browse through directories and "cat" files then on the device - see my "terminal workaround" post).

Back in 'the good old days' (the 70s) we used to be able to replace the processor's clock with a de-bounced switch, and one-step through cycles; logic levels could be measured with a multi-meter at each 'cycle'--didn't really need a data analyzer or scope. Oh, the good old days. I don't envy you, scotsman, but I wish I could help.

Quote:

Originally Posted by scotsman

On your open device, could you check where the usb is wired to? Are all pins connected to the freescale? It is clear that all pins are wired somewhere, since otherwise you could not charge the device and transfer data. The question, however, is wheter the power pins go to the freescale CPU as well, or to some charging circuit. This is important because we will need power out of the socket, which will only come from the CPU's USB controller.

I will check, but tracing these circuits may not be as straightforward as you think. Also, as I have noted on another thread, when the battery is plugged in, the DR behaves the same as when a wall charger is plugged into the USB port. That suggests that they both go to the power management circuit.

For a mini B port, only pins 1,2,3 and 5 are used, those are all that are needed for power and data for a non-Host connection. On the DR, all 5 pins are wired on the circuit board, and this suggests that iRex designed for OTG; there is no other reason to wire pin 4, that is for Host. Note also that any Data Out can trigger the USB power output--it depends how the designers chose to do it. It is choices like that, security-locked one-time-programmable (OTP) chips, and 'house marked' (i.e., unidentifiable) chips that complicate circuit tracing.

If iRex designed for OTG, one has to wonder why they didn't implement it (it might even have failed the USB OTG testing requirements). Considering also that iRex has not fully implemented Host on any device that I know of, my only guesses are not heartening for our effort.

Quote:

Originally Posted by scotsman

Also... once the right driver is in place, it should be possible to switch to host mode via software only.

That is part of the USB OTG Supplement, but it is an optional implementation, and may not be available--Oh, but it would be nice... If the DR's case weren't a lock-box, the easiest thing would be to swap the mini B socket with a Mini AB--simple as pie--but it is what it is. Let us hope for the software option.

Thanks for the links and PDF, I'll go over it all and see if I can find anything useful before I start tracing circuits.

The last few days have been hectic... I just started a job that turned into a can of worms... and took my Mom to the Hospital... I'll put what time I can into this.

Okay, I'm going shopping.

Kent

scotsman · 07-02-2010, 06:49 AM

NEWS:
The new firmware 2.0 RC allows for executing modprobe ehci-hcd without crashes, and lsmod shows the module as loaded. Also, one can load usbnet, and the file system has a preconfigured /etc/network/interfaces, such that it should be able to usb network to the device.

However, none of these actions produces any effect (no voltage on USB port, no network device detected if I try to ifup the usbnet connection from my laptop). Thus I suspect that the USB port thus accessed is the one that is NOT connected to the mini USB connector of the device, but either unconnected or connected via the expansion slot (although I fail to measure any 5V signal between any two of its pints after supposedly activating host mode).

Thus the main task seems to be to address the right port, which supposedly works via linking drivers to devices in the /sys/ directory. However, I have no idea of how to do that, and no experience. I also do not have the time to play around with it in the near future, unfortunately.

repods · 07-02-2010, 07:30 AM

Quote:

Originally Posted by scotsman

NEWS:
The new firmware 2.0 RC allows for executing modprobe ehci-hcd without crashes, and lsmod shows the module as loaded. Also, one can load usbnet, and the file system has a preconfigured /etc/network/interfaces, such that it should be able to usb network to the device.

However, none of these actions produces any effect (no voltage on USB port, no network device detected if I try to ifup the usbnet connection from my laptop). Thus I suspect that the USB port thus accessed is the one that is NOT connected to the mini USB connector of the device, but either unconnected or connected via the expansion slot (although I fail to measure any 5V signal between any two of its pints after supposedly activating host mode).

Thus the main task seems to be to address the right port, which supposedly works via linking drivers to devices in the /sys/ directory. However, I have no idea of how to do that, and no experience. I also do not have the time to play around with it in the near future, unfortunately.

thanks for the infos.. it would be necessary to disassemble the device and drop warranty...
maybe it is somewhere under the battery slot..
but I think that Gertjan could be the only one that could help us..
so Gertjan can you please tell us where this usb port is phisically placed ?
or if it's possible enable the host mode on the charging one ?
I don't think that it's an information that needs to be secret..

Shaggy · 07-06-2010, 11:32 AM

Quote:

Originally Posted by scotsman

However, none of these actions produces any effect (no voltage on USB port, no network device detected if I try to ifup the usbnet connection from my laptop). Thus I suspect that the USB port thus accessed is the one that is NOT connected to the mini USB connector of the device

Didn't they say before that the mini USB connector is physically limited to peripheral mode only? IE, even if you activate host mode, it's not wired to carry a 5V signal.

dima_tr · 08-04-2010, 06:29 PM

I've got a thought: as there's no power from DR to peripherals (anything plugged to microUSB), we have to provide powered devices. Self-powered USB hub like this one and USB-fem/USB-fem adapter should solve the task. Usually the hubs come with 220v adapter, but I know about several ones powered from 4*AAA batteries = portable. Altogether looks a bit ugly but should work, what do you think?

Another nice thing: this way you can have several USB devices connected, say keyboard+wifi.

10-28-2009, 10:45 PM	#16
Kent Walters Connoisseur Posts: 79 Karma: 92 Join Date: Sep 2009 Location: Northern California, USA Device: iRex DR1000S, Astak EZreader (Hanlin V3)	Hey, scotsman, I'm glad you're back! My reservations about enabling Host on the Dr's mini B port are gone, with some reservations/cautions that I'll explain later (some will find it boring ). On the DR's board, all 5 pins to the USB socket are wired. According to the On The Go Supplement (OTG) to the USB spec., pin 4 of a mini B port is not used. The only reason I can think of for iRex to have wired all 5 pins is that iRex intended the DR to be an On The Go device, and decided not to, and just substituted a Mini B socket for the OTG Mini AB socket (and we must bear in mind that they may have had a good reason for doing this). I suspect that if an adapter cable that connects pin 4 to pin 5 is used (don't do this) to connect a B device (like a thumb drive) that the DR will power the device and respond with an error message (like "Device not recognized"). If that happens, then the DR's port, for sure, is Host capable, and the 'hardware limitation' iRex spoke of is only the physical socket itself. If it powers the device but doesn't respond, we may have further problems in firmware. If it does nothing, we are right back here. My plan is to wire a Mini AB socket to a mini B plug, with all 5 pins wired straight thru (this is illegal, according to the USB spec--see the warning below). I'm having trouble finding a suitable cable, but will visit The Robot Store this weekend, with my hopes. Failing there, I will wire it with two lengths of USB cable instead of one. I'm hoping to do this weekend, but things keep happening... I'll post back with results. I hope everyone keeps in mind that I have a spare (broken screen) DR to test/hack/destroy. WARNINGS: The main reason for the different USB connectors is to prevent damaging equipment; if a Host port is connected to a Host port, one or both devices may be damaged (and Murphy's Law applies). If you make a cable like the one that I said, 'don't do this,' PAINT IT RED, and NEVER use it to connect your DR (or anything else) to your computer or charger. This is the cause of my reluctance to using this port on the DR. A cable like the one I'm going to make will keep everything safe, as long as it is used with USB 'legal' cables and devices. If anyone has any questions, please ask. BTW, scotsman, could you tell me where to find the Freescale spec? I couldn't find it. I hope you get some help on the software end. Magic Is afoot, Kent

10-29-2009, 07:28 AM	#17
scotsman Enthusiast Posts: 32 Karma: 106 Join Date: Mar 2009 Device: irex DR1000S	Hi Kent, thanks for informing about the cables. Now I can almost 100% assure you that when you plug in your new cable, nothing will happen. This is because a) I have once tried it with just bridging the pins with a needle, and b) because as it is, no appropriate driver is running on the device. Somehow, when you plug in your PC, the DR detects it (when it asks you whether you wnt to mount), and when you say yes, it seems to load some driver to operate the device in gadget (slave/device, not host) mode. Naturally, in this state there is no way of executing a shell script with "lsmod", so there is no way I can tell what module is loaded. One way to go were to find out which script is executed when mounting the device. I could try that on the emulator maybe, if the script is there, (on the emulator it is not such a pain to browse through directories and "cat" files then on the device - see my "terminal workaround" post). On your open device, could you check where the usb is wired to? Are all pins connected to the freescale? It is clear that all pins are wired somewhere, since otherwise you could not charge the device and transfer data. The question, however, is wheter the power pins go to the freescale CPU as well, or to some charging circuit. This is important because we will need power out of the socket, which will only come from the CPU's USB controller. Also, while your hardware solution will work fine (just search for USB OTG Nokia N800), once the right driver is in place, it should be possible to switch to host mode via software only. The Nokia N8x0's do that, for example. But again, the driver needs to be loaded first, and that's where I am stuck now. Last edited by scotsman; 10-29-2009 at 07:30 AM. Reason: added last paragaph

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
302 USB host mode, or: WOW!	Serif	PocketBook	5	06-10-2010 05:35 AM
Question about using it in USB mode	ficbot	Amazon Kindle	3	01-13-2010 06:44 PM
USB Host Mode?	brecklundin	PocketBook	2	11-19-2009 02:49 AM
Host USB?	fargo	iRex	6	05-05-2008 05:36 PM
iLiad USB hacking	arivero	iRex Developer's Corner	0	07-19-2006 11:30 AM

07-02-2010, 06:49 AM	#20
scotsman Enthusiast Posts: 32 Karma: 106 Join Date: Mar 2009 Device: irex DR1000S	NEWS: The new firmware 2.0 RC allows for executing modprobe ehci-hcd without crashes, and lsmod shows the module as loaded. Also, one can load usbnet, and the file system has a preconfigured /etc/network/interfaces, such that it should be able to usb network to the device. However, none of these actions produces any effect (no voltage on USB port, no network device detected if I try to ifup the usbnet connection from my laptop). Thus I suspect that the USB port thus accessed is the one that is NOT connected to the mini USB connector of the device, but either unconnected or connected via the expansion slot (although I fail to measure any 5V signal between any two of its pints after supposedly activating host mode). Thus the main task seems to be to address the right port, which supposedly works via linking drivers to devices in the /sys/ directory. However, I have no idea of how to do that, and no experience. I also do not have the time to play around with it in the near future, unfortunately.

08-04-2010, 06:29 PM	#23
dima_tr Groupie Posts: 175 Karma: 863 Join Date: Oct 2009 Location: Germany, Karlsruhe Device: Iliad v2, DR800S (inlove)	I've got a thought: as there's no power from DR to peripherals (anything plugged to microUSB), we have to provide powered devices. Self-powered USB hub like this one and USB-fem/USB-fem adapter should solve the task. Usually the hubs come with 220v adapter, but I know about several ones powered from 4*AAA batteries = portable. Altogether looks a bit ugly but should work, what do you think? Another nice thing: this way you can have several USB devices connected, say keyboard+wifi.

Advert

Advert