Let's root our Max Lumi

[Renate]

Hmm, interesting.
It shows that your capacitance touch screen controller (cyttsp5_i2c_adapter) is responding. I'd like to get a datasheet on it and see if I can get the HID report descriptor out of it.

Since this is Cypress, I wouldn't be surprised if this chip gets its firmware downloaded to it. With the wrong/missing FW it wouldn't work. Need that datasheet. My TS is the FocalTech so there's only so much checking that I can do.

FWIW:
aw881xx_smartpa = Audio codec
max17135 = Maxim Eink power management

Edit: Hey, have you seen this one: http://bbs.onyx-international.com/t/...orking/1852/37

[metalkode]

Hmm this is interesting: (From dmesg)

[  834.360950] ONYX_TP: cyttsp5_i2c_adapter: upgrade_firmware_from_builtin: start!
[  834.360958] ONYX_TP: cyttsp5_i2c_adapter: upgrade_firmware_from_builtin:fw name: cyttsp5_fw.bin
[  834.364014] ueventd: firmware: loading 'cyttsp5_fw.bin' for '/devices/soc/c178000.i2c/i2c-4/4-0024/firmware/cyttsp5_fw.bin'
[  834.364554] ueventd: firmware: could not find firmware for cyttsp5_fw.bin
[  834.364770] ONYX_TP: cyttsp5_i2c_adapter: _cyttsp5_firmware_cont_builtin:start
[  834.364779] cyttsp5_i2c_adapter 4-0024: _cyttsp5_firmware_cont_builtin: No builtin firmware
[  834.364782] ONYX_TP: cyttsp5_i2c_adapter: _cyttsp5_firmware_cont_builtin:No builtin firmware
[  834.364864] ueventd: loading /devices/soc/c178000.i2c/i2c-4/4-0024/firmware/cyttsp5_fw.bin took 1ms
[  834.364882] ONYX_TP: cyttsp5_i2c_adapter: upgrade_firmware_from_builtin: finish, ret: -22

It lookd like it calls "upgrade_firmware_from_builtin" after a certain amount of fails... I wonder if there's a way to give it a binary to load.

I tried to retrieve IC data:

MaxLumi:/ # cat /sys/bus/i2c/drivers/cyttsp5_i2c_adapter/4-0024/ic_ver
Firmware Major Version: 0x00
Firmware Minor Version: 0x00
Revision Control Number: 0x00000000
Firmware Configuration Version: 0x0000
Bootloader Major Version: 0x00
Bootloader Minor Version: 0x00
Protocol Major Version: 0x00
Protocol Minor Version: 0x00

But they're only retreived after the HID descriptor. Maybe I'll be able to poke some addresses on the IIC bus to get a response.

I also binded and unbinded the device to see the output, see my previous post.

I'll try to get the firmware .bin somwhere, maybe its hidden in the max3 firmware?

[metalkode]

I extracted the device trees of the max3 V2.2.2 firmware and the build 1834 firmware of the max lumi, and I found something very interesting:

The DTS from build 1834 Max Lumi:

tsc@24 {
	compatible = "cy,cyttsp5_i2c_adapter";
	reg = < 0x24 >;
	status = "okay";
	cy,adapter_id = "cyttsp5_i2c_adapter";
	pinctrl-names = "default";
	pinctrl-0 = < 0x193 >;
	vdd-supply = < 0x187 >;
	vcc-supply = < 0x194 >;
	onyx-tp,irq_gpio = < 0xa1 0x43 0x00 >;
	onyx-tp,rst_gpio = < 0xa1 0x42 0x00 >;
	onyx-tp,vdd-ctrl-gpio = < 0xa1 0x3e 0x00 >;
	onyx-tp,vcc-ctrl-gpio = < 0xa1 0x3d 0x00 >;

	cy,core {
		cy,name = "cyttsp5_core";
		cy,hid_desc_register = < 0x01 >;
		cy,level_irq_udelay = < 0x01 >;
		cy,flags = < 0x06 >;
		cy,easy_wakeup_gesture = < 0x00 >;
		cy,fw_mod_name = "max3";
		cy,btn_keys-tag = < 0x00 >;

		cy,mt {
			cy,name = "cyttsp5_mt";
			cy,inp_dev_name = "cyttsp5_mt";
			cy,flags = < 0x80 >;
			cy,abs = < 0x35 0x00 0x672 0x00 0x00 0x36 0x00 0x898 0x00 0x00 0x3a 0x00 0xff 0x00 0x00 0xffff 0x00 0xff 0x00 0x00 0x39 0x00 0x0f 0x00 0x00 0x30 0x00 0xff 0x00 0x00 0x31 0x00 0xff 0x00 0x00 0x34 0xffffff81 0x7f 0x00 0x00 0x37 0x00 0x01 0x00 0x00 0x3b 0x00 0xff 0x00 0x00 >;
			cy,vkeys_x = < 0x672 >;
			cy,vkeys_y = < 0x898 >;

And from the max 3:

tsc@24 {
	compatible = "cy,cyttsp5_i2c_adapter";
	reg = < 0x24 >;
	cy,adapter_id = "cyttsp5_i2c_adapter";
	pinctrl-names = "default";
	pinctrl-0 = < 0xe3 >;

	cy,core {
		cy,name = "cyttsp5_core";
		cy,pwr_gpio = < 0xbe 0x74 0x00 >;
		cy,pwr_1v8_gpio = < 0xbe 0x75 0x00 >;
		cy,irq_gpio = < 0xbe 0x41 0x00 >;
		cy,rst_gpio = < 0xbe 0x40 0x00 >;
		cy,hid_desc_register = < 0x01 >;
		cy,level_irq_udelay = < 0x01 >;
		cy,flags = < 0x06 >;
		cy,easy_wakeup_gesture = < 0x00 >;
		cy,fw_mod_name = "max3";
		cy,btn_keys-tag = < 0x00 >;

		cy,mt {
			cy,name = "cyttsp5_mt";
			cy,inp_dev_name = "cyttsp5_mt";
			cy,flags = < 0x80 >;
			cy,abs = < 0x35 0x00 0x672 0x00 0x00 0x36 0x00 0x898 0x00 0x00 0x3a 0x00 0xff 0x00 0x00 0xffff 0x00 0xff 0x00 0x00 0x39 0x00 0x0f 0x00 0x00 0x30 0x00 0xff 0x00 0x00 0x31 0x00 0xff 0x00 0x00 0x34 0xffffff81 0x7f 0x00 0x00 0x37 0x00 0x01 0x00 0x00 0x3b 0x00 0xff 0x00 0x00 >;
			cy,vkeys_x = < 0x672 >;
			cy,vkeys_y = < 0x898 >;

Yes, they are pretty much identical. Even the field "cy,fw_mod_name = "max3";" is the same. Which should mean that the firmware are cross compatible right?

[Renate]

22 = EINVAL, Invalid argument

FWIW: This is a dmesg from a Kobo Aura H2O https://libreplanet.org/wiki/Group:H.../boot_dmesg_01

set cyttsp5 touch flags by dts=0x4
set cyttsp5 touch flags by hwconfig=0x30
cyttsp5_i2c_adapter 1-0024: cyttsp5_init: INIT CYTTSP RST gpio=114 and IRQ gpio=120 r=0
cyttsp5_i2c_adapter 1-0024: cyttsp5_startup_: Bootloader mode
cyttsp5_i2c_adapter 1-0024: cyttsp5_startup_: Operational mode
cyttsp5_i2c_adapter 1-0024: cyttsp5_startup_: Reading report descriptor
cyttsp5_i2c_adapter 1-0024: cyttsp5 Protocol Version: 1.6
input: cyttsp5_mt as /devices/platform/soc/2100000.aips-bus/21a4000.i2c/i2c-1/1-0024/input/input1
cyttsp5_i2c_adapter 1-0024: cyttsp5_loader_probe: Successful probe 1-0024
cyttsp5_loader_init: Parade TTSP FW Loader Driver (Built TTDA.03.07.844339) rc=0

Maybe get somebody with a working unit to show their dmesg?

Edit: Huh? You didn't try a

#find / -name cyttsp5_fw.bin 2>/dev/null

Ditto on getting somebody with a working unit to do this too.

[metalkode]

Originally Posted by Renate

Edit: Huh? You didn't try a

#find / -name cyttsp5_fw.bin 2>/dev/null

Ditto on getting somebody with a working unit to do this too.

Hehe, It was one of the first things I did, but instead with "*cyttsp5*". Didn't find anything except the device at /sys/.

I added the extracted devicetrees to my post, for the max3 there seem to be three versions. Some add support for different devices which other versions don't. They are not really zip files, just remove the ".zip" extension.

I'm starting to think maybe the Max Lumi they started selling recently is another version of which they haven't released an update yet...

Thanks for your help so far, I really appreciate it.

[Renate]

Well, the Cypress TrueTouch series 5 is discontinued for a while now.
I'm wondering if the firmware only gets flashed on updates, not loaded on reset.
In that case cyttsp5_fw.bin might even be deleted afterwards.
If it's not found on anybody else's device.
Did you already look in all the updates?

[metalkode]

Okay... I found the bin from a sketchy Russian site hosting a full ROM for some random phone.
I'm not sure how MobileRead thinks about hosting proprietary binaries though, so I think I won't upload it publicly.

I'll try it tomorrow, /vendor/firmware should work, right?

[metalkode]

Hmm, I believe it found the file it but it's unable to compare it to the "Existing" firmware. Which probably doesn't exist.

There's a "manual_upgrade" in the sysfs. I'll try to evoke that and see what happens.

[  609.944719] ONYX_TP: cyttsp5_i2c_adapter: upgrade_firmware_from_builtin:fw name: cyttsp5_fw.bin
[  609.947630] ueventd: firmware: loading 'cyttsp5_fw.bin' for '/devices/soc/c178000.i2c/i2c-4/4-0024/firmware/cyttsp5_fw.bin'
[  609.959873] ueventd: loading /devices/soc/c178000.i2c/i2c-4/4-0024/firmware/cyttsp5_fw.bin took 12ms
[  609.959927] ONYX_TP: cyttsp5_i2c_adapter: _cyttsp5_firmware_cont_builtin:start
[  609.959935] ONYX_TP: cyttsp5_i2c_adapter: _cyttsp5_firmware_cont_builtin:Found firmware, size: 62130
[  609.959942] cyttsp5_i2c_adapter 4-0024: cyttsp5_check_firmware_version_builtin: No firmware infomation found, device FW may be corrupted
[  609.959989] ONYX_TP: cyttsp5_i2c_adapter: upgrade_firmware_from_builtin: finish, ret: 0

[Renate]

Well, it returned zero, doesn't that mean it succeeded?

[metalkode]

Originally Posted by Renate

Well, it returned zero, doesn't that mean it succeeded?

You're right, however it still times out getting the HID descriptor

There must be something different with the build 2026 boot.img... I don't believe they updated the kernel drivers since the one in 1834 is from 2017.

So I'm starting to suspect something changed in the device tree, maybe they decided to change "fw_mod_name" of the touchscreen from "Max3" to "Max4". Or maybe they changed some GPIO around due to a board revision. I'm not sure I'll be able to find out though.

When I let the tablet do its thing untill it decides to update the cyttsp5 firmware again, it shows the same

cyttsp5_i2c_adapter 4-0024: cyttsp5_check_firmware_version_builtin: No firmware infomation found, device FW may be corrupted

Interesting...

[Renate]

I think you need a new file.

I don't have anything, but I was surprised to see this:

Poke3:/sys/bus/i2c/drivers/cyttsp5_i2c_adapter # ls -l
total 0
--w------- 1 root root 4096 2021-10-20 12:14 bind
--w------- 1 root root 4096 2021-10-20 12:14 uevent
--w------- 1 root root 4096 2021-10-20 12:14 unbind

[metalkode]

Originally Posted by Renate

I think you need a new file.

I don't have anything, but I was surprised to see this:

Poke3:/sys/bus/i2c/drivers/cyttsp5_i2c_adapter # ls -l
total 0
--w------- 1 root root 4096 2021-10-20 12:14 bind
--w------- 1 root root 4096 2021-10-20 12:14 uevent
--w------- 1 root root 4096 2021-10-20 12:14 unbind

Hmm what's your uname? Maybe Onyx builds a single kernel for their Qualcomm devices.

MaxLumi:/ # uname -a
Linux localhost 4.4.194-perf-g29fe3f4-dirty #165 SMP PREEMPT Thu Feb 4 11:31:26 CST 2021 armv8l

I have these drivers in bus/i2c/drivers sf:

127|MaxLumi:/ # ls -l /sys/bus/i2c/drivers
total 0
drwxr-xr-x 2 root root 0 2021-03-31 13:22 aw881xx_smartpa
drwxr-xr-x 2 root root 0 2021-03-31 13:22 bmi160
drwxr-xr-x 2 root root 0 2021-03-31 13:22 cyttsp5_i2c_adapter
drwxr-xr-x 2 root root 0 2021-03-31 13:22 dummy
drwxr-xr-x 2 root root 0 2021-03-31 13:22 fts_ts
drwxr-xr-x 2 root root 0 2021-03-31 13:22 i2c_camera
drwxr-xr-x 2 root root 0 2021-03-31 13:22 i2c_pmic
drwxr-xr-x 2 root root 0 2021-03-31 13:22 lfe5u
drwxr-xr-x 2 root root 0 2021-03-31 13:22 lm3630a_bl
drwxr-xr-x 2 root root 0 2021-03-31 13:22 lm36923h_bl
drwxr-xr-x 2 root root 0 2021-03-31 13:22 max17135
drwxr-xr-x 2 root root 0 2021-03-31 13:22 msm_eeprom
drwxr-xr-x 2 root root 0 2021-03-31 13:22 mxo
drwxr-xr-x 2 root root 0 2021-03-31 13:22 nq-nci
drwxr-xr-x 2 root root 0 2021-03-31 13:22 synaptics_dsx_i2c
drwxr-xr-x 2 root root 0 2021-03-31 13:22 tabla-i2c-core
drwxr-xr-x 2 root root 0 2021-03-31 13:22 tasha-i2c-core
drwxr-xr-x 2 root root 0 2021-03-31 13:22 tc358762
drwxr-xr-x 2 root root 0 2021-03-31 13:22 tps6518x
drwxr-xr-x 2 root root 0 2021-03-31 13:22 wacom_ts
drwxr-xr-x 2 root root 0 2021-03-31 13:22 wcd9xxx-i2c-core

There are 2 or 3 different touchscreen drivers available.

[Renate]

Poke3:

ONYX/Poke3/Poke3:10/2021-03-31_23-02_3.1_0631e26/1914:user/dev-keys

Linux localhost 4.4.194-perf-gad92c13-dirty #170 SMP PREEMPT Thu Mar 25 18:18:59 CST 2021 aarch64

[lightsparks]

Is it not possible to extract the OTA update anymore and or even root the lumi? I was considering buying one but not if I can't root it. I see the max is still rootable.

[lightsparks]

It seems the broken touch problem above happened due to flashing the files in the 1st post files which were from older firmware onto a device running newer firmware. Can I use the firmware extractor here to download the latest firmware and root it with magisk? https://gist.github.com/winstonma/41...c7b4227ab7e9f0

Alternatively, wouldn't using EDL mode to extract the latest firmware then running magisk work? That would seem to avoid the touch screen loss issue since firmware versions wouldn't be mixed. https://blog.tho.ms/hacks/2021/03/27...-note-air.html