Home Live Radio Podcast Live TV Vodcast Forum Files Login Register :     Contact : 
 
Forum index Forum: Device: SkyTC - KMP510 (Envivo Otek Xenta Arnova) Topic: Xoro HMT350 dismantling guide Last replied to: April 16, 2012, 9:25 pm Back to post view
AuthorPostOptions
Posted by probutus Message # 1     Posted at April 6, 2012, 10:07 am,     subject: Xoro HMT350 dismantling guide  
Messages: 17 posts
Registration date: March 27, 2012
Status: Offline

just stumbled upon this great site after buying my Xoro HMT350 and finding out that the original firmware sucks. I have seen some pictures for the Penbex devices but none for the HMT350 so I decided to do some myself and thank the community for their effort with some neat pics

Here's a picture of the bottom; you have to remove the rubber feet to reach all screws:


After you removed the screws beware the plastc latches on the backside where the power plug is; gently pull the plastic bottom towards you:

Now you can see the top PCB:

After removing  four more screws you can lift off the mainboard and see the CPU, RAM and Flash (luckily no BGA)

I also have highres pictures of the PCB here:






Happy Easter! (
 
Posted by penbex Message # 2     Posted at April 6, 2012, 8:07 pm,     subject: Xoro HMT350 dismantling guide  
Messages: 2279 posts
Registration date: May 21, 2009
Status: Offline

Nice, I would like to add that when you try to open the case, the pcb is on the bottom part of the case, while the wifi antenna is glued to the top part of the case.
When you pull too hard when opening you might kill the antenna..
 
Posted by probutus Message # 3     Posted at April 6, 2012, 8:26 pm,     subject: Xoro HMT350 dismantling guide  
Messages: 17 posts
Registration date: March 27, 2012
Status: Offline

Just saw, that the Pictures do not link to the higher res versions; so here are the links again:

Top view:


Bottom view:

What is very interesting is that there is a 16Gbit MLC NAND onboard but the CPU only "sees" an eMMC device; so I would guess that the small chip below the NAND is an eMMC controller (I have never seen them as a standalone chip).

I also have the datasheet for the AR6102 and the NAND flash; is there a way to upload them to the database somehow?

(Last Edited by probutus on April 6, 2012, 9:28 pm)
 
Posted by penbex Message # 4     Posted at April 6, 2012, 10:16 pm,     subject: Xoro HMT350 dismantling guide  
Messages: 2279 posts
Registration date: May 21, 2009
Status: Offline

You can use the upload function. or mail them and I will put them in the download area.

Btw, the controller is only there on the newer models. On the older ones its just nand.


(Last Edited by penbex on April 6, 2012, 11:17 pm)
 
Posted by explmag Message # 5     Posted at April 6, 2012, 10:31 pm,     subject: Xoro HMT350 dismantling guide  
Messages: 91 posts
Registration date: September 7, 2011
Status: Offline

dismantling guide - for what reason, please??

What should we do now ..?

 
Posted by TheFug Message # 6     Posted at April 6, 2012, 11:10 pm,     subject: Xoro HMT350 dismantling guide  
Messages: 10 posts
Registration date: March 12, 2012
Status: Offline

Quote:

dismantling guide - for what reason, please??

What should we do now ..?

In general, most of the time an inner look will reveal something about used chipsets, hardware version of the mainboard, if there are more versions, or updated ones, important for software updates, sometimes there are parts that are not (yet) used by the software....
Un used connections..... extra memory options, enhancing wifi antenna´s , replacing wifi modules, replacing loudspeakers... improving the sound quality in the housing, by modifications to it.
Reseting bricked radios.

Reasons enough, imho
 
Posted by probutus Message # 7     Posted at April 6, 2012, 11:10 pm,     subject: Xoro HMT350 dismantling guide  
Messages: 17 posts
Registration date: March 27, 2012
Status: Offline

Quote:

dismantling guide - for what reason, please??

What should we do now ..?

 
Well, just for fun, I would say  

There is a connector on the top PCB which is very likely a debug uart; you could use this to resurrect your SkyTC device if you accidentially bricked it, for example (just one use case...) I usually prefer to know the guts of the system I'm playing with; (luckily I'm not a surgeon...)

 
Posted by probutus Message # 8     Posted at April 6, 2012, 11:40 pm,     subject: Xoro HMT350 dismantling guide  
Messages: 17 posts
Registration date: March 27, 2012
Status: Offline

Quote:

You can use the upload function. or mail them and I will put them in the download area.

Btw, the controller is only there on the newer models. On the older ones its just nand.


(Last Edited by penbex on April 6, 2012, 11:17 pm)

Uploaded them; Do you know whether we have a "real" datasheet of the JZ4755 chip somewhere? I mean not only the description of the pinnings but also the description of all soc peripherals and registers?
 
Posted by puxxi2003 Message # 9     Posted at April 7, 2012, 12:39 pm,     subject: Xoro HMT350 dismantling guide  
Messages: 33 posts
Registration date: July 30, 2011
Status: Offline

 here it is:
http://www.ingenic.cn/product.aspx?CID=11

but i think you only have a 4750 in your device
 
Posted by puxxi2003 Message # 10     Posted at April 8, 2012, 1:34 am,     subject: Xoro HMT350 dismantling guide  
Messages: 33 posts
Registration date: July 30, 2011
Status: Offline

opened my lookee and see the 4755
thought its a 4750 because dmesg said:
JZ4750D CETUS board setup

i'm blind, didn't see it on your photos

the wifi-antenna is connected via U.FL-clip and it have 2 way speakers




(Last Edited by puxxi2003 on April 8, 2012, 2:38 am)
 
Posted by probutus Message # 11     Posted at April 8, 2012, 7:47 am,     subject: Xoro HMT350 dismantling guide  
Messages: 17 posts
Registration date: March 27, 2012
Status: Offline

Quote:

opened my lookee and see the 4755
thought its a 4750 because dmesg said:
JZ4750D CETUS board setup

i'm blind, didn't see it on your photos

the wifi-antenna is connected via U.FL-clip and it have 2 way speakers




(Last Edited by puxxi2003 on April 8, 2012, 2:38 am)

Thanks for the info!

BTW: I managed to get the SSH dropbear client and server up and running along with a NFS client and server :

# cat /proc/filesystems 
nodev   sysfs
nodev   rootfs
nodev   bdev
nodev   proc
nodev   sockfs
nodev   pipefs
nodev   anon_inodefs
nodev   futexfs
nodev   tmpfs
nodev   inotifyfs
nodev   devpts
        ext2
nodev   ramfs
        minix
        msdos
        vfat
nodev   cifs
nodev   rpc_pipefs
nodev   smbfs
nodev   nfs
nodev   nfs4
# ps w
  PID  Uid        VSZ Stat Command
    1 root       4176 S   init       
    2 root            SW< [kthreadd]
    3 root            SW< [ksoftirqd/0]
    4 root            SW< [events/0]
    5 root            SW< [khelper]
   32 root            SW< [kblockd/0]
   40 root            SW< [kseriod]
   44 root            SW< [kmmcd]
   66 root            SW  [pdflush]
   67 root            SW  [pdflush]
   68 root            SW< [kswapd0]
   69 root            SW< [aio/0]
   70 root            SW< [cifsoplockd]
   71 root            SW< [cifsdnotifyd]
  149 root            SW< [udc_workqueue]
  171 root            SW< [wpen_workqueue/]
  193 root            SW< [fm_rda580x_work]
  207 root            SW< [mmcqd]
  222 root            SW< [mmcqd]
  246 root       3288 S < /sbin/udevd --daemon 
  292 root       4176 S   /sbin/telnetd 
  295 1          2588 S   /sbin/portmap 
  304 root       3200 S   dropbear -d /etc/dropbear/dropbearkey_dss -r /etc/dropbear/dropbearkey_rsa 
  315 root            DW< [SDIO Helper]
  319 root            DW< [SDIO IrqHelper]
  335 root            SW< [rpciod/0]
  351 root      54108 S   ./jz-media-app 
  352 root       4240 S   -sh 
  383 root      54108 S   ./jz-media-app 
  402 root      54108 S   ./jz-media-app 
  403 root      54108 S   ./jz-media-app 
  408 root       2188 S   ./wpa_supplicant -i eth0 -D wext -c /mnt/mtdblock7/w.conf -B 
  422 root       4240 S   udhcpc -i eth0 -h iRadioAAE340 
  446 root      54108 S   ./jz-media-app 
  447 root      54108 S   ./jz-media-app 
  450 root      54108 S   ./jz-media-app 
  454 root      54108 S   ./jz-media-app 
 1048 root      54108 S   ./jz-media-app 
 1052 root      54108 S   ./jz-media-app 
 1055 root      54108 S   ./jz-media-app 
 1063 root       5084 R   dropbear -d /etc/dropbear/dropbearkey_dss -r /etc/dropbear/dropbearkey_rsa 
 1064 root       4240 S   -sh 

I zipped all executables and modules and uploaded them here
 
Posted by penbex Message # 12     Posted at April 8, 2012, 10:34 am,     subject: Xoro HMT350 dismantling guide  
Messages: 2279 posts
Registration date: May 21, 2009
Status: Offline

Quote:

opened my lookee and see the 4755
thought its a 4750 because dmesg said:
JZ4750D CETUS board setup

i'm blind, didn't see it on your photos

the wifi-antenna is connected via U.FL-clip and it have 2 way speakers




(Last Edited by puxxi2003 on April 8, 2012, 2:38 am)
The 4750D is a 4755...
 
Posted by penbex Message # 13     Posted at April 13, 2012, 8:36 am,     subject: Xoro HMT350 dismantling guide  
Messages: 2279 posts
Registration date: May 21, 2009
Status: Offline

Thanks for the dropbear files.
They are added to the firmware and can be activated through the settings screen.
This should make it easier for people that want to use SSH but dont want to mess with the filesystem.

~W.

 
Posted by probutus Message # 14     Posted at April 13, 2012, 9:08 pm,     subject: Xoro HMT350 dismantling guide  
Messages: 17 posts
Registration date: March 27, 2012
Status: Offline



Quote:

Thanks for the dropbear files.
They are added to the firmware and can be activated through the settings screen.
This should make it easier for people that want to use SSH but dont want to mess with the filesystem.

~W.


You're welcome! I included dropbear mainly for the easy file transfer support via scp. Since I am a lazy person I very much prefer scp/nfs instead of walking around with SDcards to transfer files
 
Posted by probutus Message # 15     Posted at April 16, 2012, 9:25 pm,     subject: Xoro HMT350 dismantling guide  
Messages: 17 posts
Registration date: March 27, 2012
Status: Offline

Hi again,

I asked a friend to solder some wires to the RXD and TXD line (pin 28 and 33, 0.4mm pitch yuck!)




First off, If I connect the UART to the PC (via 3V3 adapter, of course) The system goes straight into USB boot mode and asks for drivers for a JZ4750 Device... (This might become handy for debricking)

If I switch on the device and connect the cables directly afterward, I get this (along with a console, 57600 8N1 no flow control):

pretty cool, eh?

U-Boot 1.1.6 (Oct 20 2011 - 15:44:08)

Board: Ingenic CETUS (CPU Speed 378 MHz)
DRAM:  64 MB
Top of RAM usable for U-Boot at: 84000000
LCD panel info: 320 x 240, 32 bit/pix
Reserving 304k for LCD Framebuffer at: 83fb4000
Reserving 419k for U-Boot at: 83f48000
Reserving 8192k for malloc() at: 83747e00
Reserving 44 Bytes for Board Info at: 83747dd4
Reserving 60 Bytes for Global Data at: 83747d98
Reserving 128k for boot params() at: 83727d98
Stack Pointer at: 83727d78
Now running in RAM - U-Boot at: 83f48000
Flash:  0 kB
Build: 101222-0, based on patch-090903
Support custom u-boot logo in NAND
SD init ok
*** Warning - MMC/SD first load, using default environment

MAC address = 00:0A:EB:AA:E3:40
Use default Remote On Key
Use default Remote User ID
Remote User ID = 0x00, Power On Key = 0x0A
Powwer on by on/off key
[LCD] Initializing LCD frambuffer at 83fb4000
Now reset KMP510 TFT panel
palette_mem_size = 0x00000200
[LCD] Drawing the logo...
Show default logo
Logo: width 320  height 240  colors 256  cmap 512
In:    serial
Out:   lcd
Err:   lcd
### main_loop entered: bootdelay=1

### main_loop: bootcmd="smartstart"
Hit any key to stop autoboot:  1  0 
altbt from environment is 0x10
Select noraml kernel and rootfs...

MSC readSD init ok
 3145728 bytes OK: 
## Booting image at 80600000 ...
   Image Name:   Linux-2.6.24.3
   Image Type:   MIPS Linux Kernel Image (gzip compressed)
   Data Size:    1754870 Bytes =  1.7 MB
   Load Address: 80010000
   Entry Point:  802bc790
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 802bc790) ...
## Giving linux memsize in MB, 64

Starting kernel ...

Linux version 2.6.24.3 (root@kingjore-laptop) (gcc version 4.1.2) #352 PREEMPT Thu Oct 20 15:51:42 CST 2011
SDRAM: Bus Width = 32, CAS Width = 9, RAS Width = 13, # of Bank = 4, Total Size = 64 Mbyte
CPU revision is: 2ed0024f (Ingenic JZRISC)
CPU clock: 378MHz, System clock: 126MHz, Peripheral clock: 126MHz, Memory clock: 126MHz
JZ4750D CETUS board setup
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal          0 ->    16384
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0:        0 ->    16384
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 16256
Kernel command line: console=ttyS1,57600n8 ip=off root=/dev/mmcblk0p5 rw build=101222-0
Primary instruction cache 16kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes
Synthesized clear page handler (25 instructions).
Synthesized copy page handler (44 instructions).
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 256 (order: 8, 1024 bytes)
Console: colour dummy device 80x25
console [ttyS1] enabled
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 60964k/65536k available (2759k kernel code, 4512k reserved, 885k data, 136k init, 0k highmem)
Mount-cache hash table entries: 512
net_namespace: 64 bytes
NET: Registered protocol family 16
Linux Plug and Play Support v0.97 (c) Adam Belay
SCSI subsystem initialized
NET: Registered protocol family 2
Time: jz_clocksource clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
Total 16MB memory at 0x3000000 was reserved for IPU
Total 0MB memory1 at 0x111a000 was reserved for IPU
Power Management for JZ
io scheduler noop registered
io scheduler anticipatory registered (default)
io scheduler deadline registered
io scheduler cfq registered
LCDC: PixClock:6406779
LCDC: PixClock:6406779
fb0: jz-lcd frame buffer device, using 2048K of video memory
JzSOC onchip RTC installed !!!
JzSOC: char device family.
Jz generic touch screen driver registered
JZ4740 SAR-ADC driver registered
JZ UDC hotplug driver registered
Virtual Driver of TCSM registered
Serial: 8250/16550 driver $Revision: 1.5 $ 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 9) is a 16550A


(Last Edited by probutus on April 16, 2012, 11:02 pm)
(Last Edited by probutus on April 16, 2012, 11:07 pm)
(Last Edited by probutus on April 16, 2012, 11:07 pm)