Quick jump:  What's new

Go to:
Weblog: recent changes   
in Dobrica Pavlinušić's random unstructured stuff
Nook Color

This page will try to document my experiment to run mainline kernel on OMAP

Contents: [Dobrica Pavlinušić's random unstructured stuff]

CPU 800 MHz ARM Cortex-A8-based TI OMAP3621[1]
Memory 512 MB
Storage 8 GB internal
32 GB max via microSD
Display 7-inch 1024 x 600 px WSVGA IPS LCD at 170 ppi
Graphics PowerVR SGX 530
Input Capacitive multitouch screen with side volume, Nook Home, and power button
Connectivity Wi-Fi 802.11 b/g/n, USB, Bluetooth(Disabled on stock firmware)
Power Installed battery 3.7 v 4000 mAh (8 hours with Wi-Fi off)
Dimensions 8.1 in (210 mm) H
5.0 in (130 mm) W
0.48 in (12 mm) D
Mass 15.8 oz (450 g)


Contents: [Dobrica Pavlinušić's random unstructured stuff]

first steps

Here I will try to document correct order to read documentation to get setup for ULX3S:


udev rule


git clone https://github.com/f32c/tools f32c-tools
cd f32c-tools/ujprog/
dpavlin@x200:/mnt/nuc/FPGA/f32c-tools/ujprog$ rm ujprog
dpavlin@x200:/mnt/nuc/FPGA/f32c-tools/ujprog$ make -f Makefile.linux
cc -Wall -D__linux__ -std=gnu99 -static ujprog.c /usr/lib/x86_64-linux-gnu/libftdi.a /usr/lib/x86_64-linux-gnu/libusb.a -o ujprog
dpavlin@x200:/mnt/nuc/FPGA/f32c-tools/ujprog$ sudo cp ujprog /usr/local/bin/

  • create udev rule

passthru to access esp32

source at https://github.com/emard/ulx3s-passthru

dpavlin@x200:/mnt/nuc/FPGA/ulx3s-bin/fpga/passthru/passthru-v20-85f$ ujprog -j flash ulx3s_85f_passthru.bit
ULX2S / ULX3S JTAG programmer v 3.0.92 (built Nov 19 2019 10:55:50)
Using USB cable: ULX3S FPGA 12K v3.0.3
[Wed Nov 20 18:02:01 2019] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0
[Wed Nov 20 18:02:01 2019] ftdi_sio 1-5.2:1.0: device disconnected
Programming: 100%
Completed in 24.36 seconds.
[Wed Nov 20 18:02:25 2019] usb 1-5.2: reset full-speed USB device number 56 using ehci-pci
[Wed Nov 20 18:02:26 2019] ftdi_sio 1-5.2:1.0: FTDI USB Serial Device converter detected
[Wed Nov 20 18:02:26 2019] usb 1-5.2: Detected FT-X
[Wed Nov 20 18:02:26 2019] usb 1-5.2: FTDI USB Serial Device converter now attached to ttyUSB0

update size of your FPGA

dpavlin@x200:/mnt/nuc/FPGA/ulx3s-bin$ usb-jtag/linux-amd64/ftx_prog --product "ULX3S FPGA 85K v3.0.3"

power cycle board to get new usb id, test that it's supported by ujprog

dpavlin@x200:/mnt/nuc/FPGA/ulx3s-bin$ ujprog -r

esptool and esp32 booting problems

You should be using ecptool from ulx3s-bin repository to quite @emard from https://gitter.im/ulx3s/Lobby#dark-theme

OK then. If you have issues with ESP32 not booting with SD card but booting without SD card then then the fuse burn script from ulx3s-bin should be run. So far so good, you erased its flash, try linux. If no issue then can try to flash micropython and my new ESP32 OTA programmer ecp5.py end uftpd.py

I have wisely taken some esptool.py which works and frozen it in ulx3s, versions change all the time and maybe you took something in the middle of development action :)

install micropython


dpavlin@nuc:/nuc/FPGA$ git clone https://github.com/emard/esp32ecp5/
dpavlin@nuc:/nuc/FPGA$ cd esp32ecp5/
dpavlin@x200:/mnt/nuc/FPGA/esp32ecp5$ wget https://micropython.org/resources/firmware/esp32-idf3-20191120-v1.11-580-g973f68780.bin

It's important to erase flash or micropyhton will complain about corrupt fat filesystem like:

FAT filesystem appears to be corrupted. If you had important data there, you
may want to make a flash snapshot to try to recover it. Otherwise, perform
factory reprogramming of MicroPython firmware (completely erase flash, followed
by firmware programming).

dpavlin@x200:/mnt/nuc/FPGA/esp32ecp5$ ../ulx3s-bin/esp32/serial-uploader/esptool.py --chip esp32 --port /dev/ttyUSB0 erase_flash
esptool.py v2.6-beta1
Serial port /dev/ttyUSB0
Chip is ESP32D0WDQ6 (revision 1)
Features: WiFi, BT, Dual Core, 240MHz, VRef calibration in efuse, Coding Scheme None
MAC: a4:cf:12:55:c5:60
Uploading stub...
Running stub...
Stub running...
Erasing flash (this may take a while)...
Chip erase completed successfully in 8.7s
Hard resetting via RTS pin...

dpavlin@x200:/mnt/nuc/FPGA/esp32ecp5$ ../ulx3s-bin/esp32/serial-uploader/esptool.py --chip esp32 --port /dev/ttyUSB0 --baud 460800 write_flash -z 0x1000 esp32-idf3-20191120-v1.11-580-g973f68780.bin
esptool.py v2.6-beta1
Serial port /dev/ttyUSB0
Chip is ESP32D0WDQ6 (revision 1)
Features: WiFi, BT, Dual Core, 240MHz, VRef calibration in efuse, Coding Scheme None
MAC: a4:cf:12:55:c5:60
Uploading stub...
Running stub...
Stub running...
Changing baud rate to 460800
Configuring flash size...
Auto-detected Flash size: 4MB
Compressed 1240192 bytes to 783187...
Wrote 1240192 bytes (783187 compressed) at 0x00001000 in 18.7 seconds (effective 529.3 kbit/s)...
Hash of data verified.

Hard resetting via RTS pin...

dpavlin@x200:/mnt/nuc/FPGA/esp32ecp5$ microcom -p /dev/ttyUSB0
connected to /dev/ttyUSB0
Escape character: Ctrl-\
Type the escape character to get to the prompt.

> help()
Welcome to MicroPython on the ESP32!

For generic online docs please visit http://docs.micropython.org/

For access to the hardware use the 'machine' module:

import machine
pin12 = machine.Pin(12, machine.Pin.OUT)
pin13 = machine.Pin(13, machine.Pin.IN, machine.Pin.PULL_UP)
i2c = machine.I2C(scl=machine.Pin(21), sda=machine.Pin(22))
i2c.writeto(addr, b'1234')
i2c.readfrom(addr, 4)

Basic WiFi configuration:

import network
sta_if = network.WLAN(network.STA_IF); sta_if.active(True)
sta_if.scan()                             # Scan for available access points
sta_if.connect("<AP_name>", "<password>") # Connect to an AP
sta_if.isconnected()                      # Check for successful connection

Control commands:
  CTRL-A        -- on a blank line, enter raw REPL mode
  CTRL-B        -- on a blank line, enter normal REPL mode
  CTRL-C        -- interrupt a running program
  CTRL-D        -- on a blank line, do a soft reset of the board
  CTRL-E        -- on a blank line, enter paste mode

For further help on a specific object, type help(obj)
For a list of available modules, type help('modules')


dpavlin@klin:/klin/FPGA$ git clone https://github.com/hyperglitch/webrepl

You can send files from command-line:

dpavlin@x200:/mnt/nuc/FPGA/webrepl$ ./webrepl_cli.py -p ulx3s ../esp32ecp5/ecp5.py
op:put, host:, port:8266, passwd:ulx3s.
../esp32ecp5/ecp5.py -> /ecp5.py
Remote WebREPL version: (1, 11, 0)
Sent 22777 of 22777 bytes
dpavlin@x200:/mnt/nuc/FPGA/webrepl$ ./webrepl_cli.py -p ulx3s ../esp32ecp5/uftpd.py
op:put, host:, port:8266, passwd:ulx3s.
../esp32ecp5/uftpd.py -> /uftpd.py
Remote WebREPL version: (1, 11, 0)
Sent 19482 of 19482 bytes

open source toolchain

this is old and needs update

dpavlin@klin:/klin/FPGA$ git clone https://github.com/SymbiFlow/prjtrellis
dpavlin@klin:/klin/FPGA/prjtrellis$ ./download-latest-db.sh 

dpavlin@klin:/klin/FPGA/prjtrellis$ cd libtrellis/
dpavlin@klin:/klin/FPGA/prjtrellis/libtrellis$ sudo apt-get install libpython3-dev libboost-python-dev libboost-filesystem-dev libboost-thread-dev libboost-program-options-dev
dpavlin@klin:/klin/FPGA/prjtrellis/libtrellis$ cmake -DCMAKE_INSTALL_PREFIX=/usr/local .
dpavlin@klin:/klin/FPGA/prjtrellis/libtrellis$ make
sudo make install

dpavlin@klin:/klin/FPGA/nextpnr$ cmake -DARCH=ecp5 -DBUILD_GUI=OFF -DTRELLIS_ROOT=../prjtrellis/ .
make install






docker run -it -v /host/fpga:/fpga -- local /host/fpga will end up in /fpga in docker

yes path will be fine
you will be missing make
so inside container you need to yum install make
and yum install libxslt
export ETHMAC=b0:5a:da:XX:XX:XX
set your MAC
docker run -it -v /media/internal/FPGA:/fpga -e LM_LICENSE_FILE=/fpga/license.dat --mac-address=$ETHMAC --privileged --ipc host -v /dev/bus/usb/:/dev/bus/usb/ dok3r/diamond:latest
run docker
yum install make libxslt
go tu project inside fpga folder and find makefile for diamond and then just make

then you share it with docker container with -v /yourHOSTfpgadir:/fpgadockerdir -e LM_LICENSE_FILE=/fpgadockerdir
for version you need to use like this dok3r/diamond:version
versions are here
docker run -it -v /media/internal/FPGA:/fpga -e LM_LICENSE_FILE=/fpga/license.dat --mac-address=$ETHMAC --privileged --ipc host -v /dev/bus/usb/:/dev/bus/usb/ dok3r/diamond:v3.7
like this
Not understanding -v /media/internal/FPGA
that is my local FPGA folder with samples and license.dat
it will mount on docker /fpga
and I see now that I need to share prjtrallis folder to docker so it can do ecppll
docker run -it -v /media/internal/FPGA:/fpga -v /local/prjtrellis/libtrellis:/mt/scratch/tmp/openfpga/prjtrellis/libtrellis -e LM_LICENSE_FILE=/fpga/license.dat --mac-address=$ETHMAC --privileged --ipc host -v /dev/bus/usb/:/dev/bus/usb/ dok3r/diamond:v3.7
but for that we will need @kost
we probably need ecppll and tools already there and compiled with centos- maybe just binaries





So, I have now managed to build oberon with diamond 3.7.
What I have to do is:

1. Build it with diamond 3.11, which fails
2. mv clocks clocks_save
3. make clean
4. cp -r clocks_save clocks
5. run docker for diamond 3.7
6. edit synpbase/bin/config/platform_check to allow 5.* linux.
7. make
8. Use ujprog in host linux to upload generated bit file

Thanks @kost for adding for adding make and libxslt to the docker image. It would be useful if you could patch the platform_check to allow versions before 3.11 to run on 5.* linux.
I got a lot of errors in the diamond 3.7 docker build, but the .bit file was created.
I can now run oberon and can see windows on the screen, but I don't have a working mouse or keyboard. I would need Goran's USB board to get both mouse and keyboard.
@lawrie i fixed in latest v3.7 - just make sure that you're running latest:

docker pull dok3r/diamond:v3.7

woohoo! Cool
@kost I pulled the latest v3.7 about 10 minutes ago, but still had to edit platform_check.
synpbase/bin/config/platform_check has:

        case $VERSION in
            4.* | 3.* | 2.4.* | 2.6.* )

It needs:

        case $VERSION in
            5.* | 4.* | 3.* | 2.4.* | 2.6.* )

I did the docker pull to make sure I had the latest version.
I changed oberon makefile to generate clocks in already existing directory to get rid of annoying mkdir clocks
In my instructions above it is safer to do make ECPPLL=echo in docker, so that it does not try to use ecppll, but uses the saved clocks that were generated on host linux.

21f repack from 25f image

ecpunpack --input ulx3s_25.bit --textcfg ulx3s_12f.config --idcode 0x41111043
ecppack --input ulx3s_12f.config --bit ulxs3_12f.bit --idcode 0x21111043





Instructions at https://github.com/lawrie/saxonsoc-ulx3s-bin/tree/master/linux
work for me on 85f :-)


git clone https://github.com/SpinalHDL/buildroot.git -b saxon buildroot
git clone https://github.com/SpinalHDL/linux.git -b vexriscv --depth 1 linux
cd buildroot
cp board/spinal/saxon_default/linux_nonet.config board/spinal/saxon_default/linux.config
# Add extra options to board/spinal/saxon_default/linux.config
make spinal_saxon_default_defconfig
make linux-rebuild all -j$(nproc)
output/host/bin/riscv32-linux-objcopy -O binary output/images/vmlinux output/images/Image
# Make sure Image is at least 116KB less than 4MB

85f version







cd /sys/class/gpio
echo 488 > export
echo out > gpio488/direction
for i in 1 0 1 0 1 0
  sleep  0.1
  echo   $i > gpio488/value







It should not be that hard. I have i2c in SaxonSoc in other projects such as https://github.com/SpinalHDL/SaxonSoc/blob/dev/hardware/scala/saxon/board/blackice/BlackiceSocArduino.scala#L25

The generated board support packages include a generated dts, but it is not used yet and the simple i2c generator that I wrote does not generate the dts.

There is a problem building SaxonSoc Linux, that some build randomly do not work. It seems to be something to do with SDRAM access.

@Dolu1990 is about to redo the SDRAM access for the Ulx3s, which should make it more reliable and faster, as he plans to support double frequency access.

There is a lot of information on the development of the u-boot version here , which might be useful to you - SpinalHDL/SaxonSoc#7


I2c Linux support will also need a spinal.lib driver here - https://github.com/SpinalHDL/linux/tree/linux-5.0.y/drivers/i2c

The terasic De1Soc version of SaxonSoc Linux has a dts entry for an led for disk access - https://github.com/SpinalHDL/buildroot/blob/saxon/board/spinal/saxon_default/spinal_saxon_default_de1_soc.dts#L194

We really need a better GPIO mapping for the Ulx3s. That might involve including adding a second gpio peripheral to the hardware (gpioB) and doing a better lpf file mapping to pins. It might mean increasing the niumbers of pins that support interrupts. It would be good to include access to the buttons and switches and to make it easy to add Pmods that need interrupt support like the enc28j60 one.

u-boot config for 85f with 64M SDRAM

Modify bootcmd to include:

load mmc 0:1 0x80000000 /boot/uImage
load mmc 0:1 0x81EF0000 /boot/dtb
fdt add 0x81EF0000
fdt memory 0x80000000 0x04000000
bootm 0x80000000 - 0x81EF0000

ov7670 pmod


pmod pin mapping:


SCCB Pullup Resistors

from https://github.com/westonb/OV7670-Verilog

The SCCB interface for the camera requires pull up resistors. You need to solder 4.7K resistors from the SIOD and SIOC pins on the camera to the 3.3V supply. You can do this yourself or have the staff in the EDS help you.




eGalax TouchScreen

Very old capacitive touch for EeePC 701


dpavlin@brokeee:~$ lsusb -t -v
/:  Bus 05.Port 1: Dev 1, Class=root_hub, Driver=uhci_hcd/2p, 12M
    ID 1d6b:0001 Linux Foundation 1.1 root hub
/:  Bus 04.Port 1: Dev 1, Class=root_hub, Driver=uhci_hcd/2p, 12M
    ID 1d6b:0001 Linux Foundation 1.1 root hub
/:  Bus 03.Port 1: Dev 1, Class=root_hub, Driver=uhci_hcd/2p, 12M
    ID 1d6b:0001 Linux Foundation 1.1 root hub
/:  Bus 02.Port 1: Dev 1, Class=root_hub, Driver=uhci_hcd/2p, 12M
    ID 1d6b:0001 Linux Foundation 1.1 root hub
/:  Bus 01.Port 1: Dev 1, Class=root_hub, Driver=ehci-pci/8p, 480M
    ID 1d6b:0002 Linux Foundation 2.0 root hub
    |__ Port 5: Dev 2, If 0, Class=Mass Storage, Driver=usb-storage, 480M
        ID 0cf2:6225 ENE Technology, Inc. SD card reader (UB6225)
    |__ Port 8: Dev 3, If 0, Class=Hub, Driver=hub/4p, 480M
        ID 05e3:0608 Genesys Logic, Inc. Hub
        |__ Port 3: Dev 5, If 1, Class=Video, Driver=uvcvideo, 480M
            ID eb1a:2761 eMPIA Technology, Inc. EeePC 701 integrated Webcam
        |__ Port 3: Dev 5, If 0, Class=Video, Driver=uvcvideo, 480M
            ID eb1a:2761 eMPIA Technology, Inc. EeePC 701 integrated Webcam
        |__ Port 1: Dev 4, If 0, Class=Human Interface Device, Driver=usbhid, 1.5M
            ID 0eef:0001 D-WAV Scientific Co., Ltd eGalax TouchScreen


xorg error

[    39.523] (II) event14 - eGalax Inc. Touch Touchscreen: is tagged by udev as: Tablet
[    39.719] (EE) event14 - eGalax Inc. Touch Touchscreen: libinput bug: missing tablet capabilities: btn-stylus resolution. Ignoring this device.
[    39.719] (II) event14 - eGalax Inc. Touch Touchscreen: device is a tablet
[    39.720] (II) event14 - failed to create input device '/dev/input/event14'.
[    39.720] (EE) libinput: eGalax Inc. Touch Touchscreen: Failed to create a device for /dev/input/event14
[    39.720] (EE) PreInit returned 2 for "eGalax Inc. Touch Touchscreen"

fix from https://www.embedded-engineer.de/dokuwiki/doku.php?id=start:egalax_touchscreen

apt install xserver-xorg-input-evdev

dpavlin@brokeee:~$ cat /usr/lib/udev/hwdb.d/61-evdev-local.hwdb 
evdev:name:eGalax Inc. Touch Touchscreen*

systemd-hwdb update
udevadm trigger /dev/input/eventXX 

root@brokeee:/etc/X11/xorg.conf.d# apt install xserver-xorg-input-evdev

root@brokeee:/etc/X11/xorg.conf.d# cat evdev-touch.conf 
Section "InputClass"
        Identifier "eGalax Inc. Touch Touchscreen"
        MatchUSBID "0eef:0001"
        Driver "evdev"
        # https://www.x.org/releases/X11R7.5/doc/man/man4/evdev.4.html
	Option "InvertX" "true"

On my touchscreen with touch flex exiting on bottom left, I have to swap X axis


dpavlin@brokeee:~$ xinput_calibrator --output-type xorg.conf.d
Warning: multiple calibratable devices found, calibrating last one (eGalax Inc. Touch Touchscreen)
	use --device to select another one.
Calibrating EVDEV driver for "eGalax Inc. Touch Touchscreen" id=11
	current calibration values (from XInput): min_x=0, max_x=2047 and min_y=0, max_y=2047

Doing dynamic recalibration:
	Inverting X and/or Y axis...
	Setting calibration data: 1997, 73, 120, 1835
	--> Making the calibration permanent <--
  copy the snippet below into '/etc/X11/xorg.conf.d/99-calibration.conf' (/usr/share/X11/xorg.conf.d/ in some distro's)
Section "InputClass"
	Identifier	"calibration"
	MatchProduct	"eGalax Inc. Touch Touchscreen"
	Option	"Calibration"	"1997 73 120 1835"
	Option	"SwapAxes"	"0"

userspace driver for newer chip


dpavlin@brokeee:~/hdmi-usb-touch$ git remote -v
origin  https://github.com/twoerner/hdmi-usb-touch (fetch)
origin  https://github.com/twoerner/hdmi-usb-touch (push)

dpavlin@brokeee:~/hdmi-usb-touch$ autoreconf -i

dpavlin@brokeee:~/hdmi-usb-touch$ sudo apt install libudev-dev

dpavlin@brokeee:~/hdmi-usb-touch$ ./configure

Colorlight 5A-75B


  • Lattice ECP5 LFE5U-25F-6BG256C (product page)
  • Winbond 25Q32JVSIQ, 32 Mbits SPI flash (datasheet)
  • 2x Broadcom B50612D Gigabit Ethernet PHYs (datasheet)
  • 2x ESMT M12L16161A-5T 1M x 16bit 200MHz SDRAMs (organized as 1M x 32bit) (datasheet)
  • 12x 74HC245T Octal Bidirectional Transceiver (used for level translation to 5V)



original protocol

replace level shifters to get input


 SN74CBT3245APW 8bit bidirectional FET switches




UART RX is on J19, labelled key+ on the silk screen on the back
UART TX is on J1, pin 1.

LOCATE COMP "clock" SITE "P6";

LOCATE COMP "io_tx" SITE "F3";
LOCATE COMP "io_rx" SITE "M13";


basic example of litex on colorLight 5A-75B based on fpga_101/lab004



I will try to collect useful stuff about Tegra latest upstream source on this page.

Nvidia Tegra 2/3 APX/nv3p protocol implementation




root@ac100:~# i2cdetect -l
i2c-1   i2c             7000c400.i2c                            I2C adapter
i2c-2   i2c             7000d000.i2c                            I2C adapter
i2c-0   i2c             7000c000.i2c                            I2C adapter
root@ac100:~# i2cdetect -y 0                                                                                                                                                 
Error: Can't use SMBus Quick Write command on this bus                                                                                                                       
root@ac100:~# i2cdetect -F 0                                                                                                                                                 
Functionalities implemented by /dev/i2c-0:                                                                                                                                   
I2C                              yes                                                                                                                                         
SMBus Quick Command              no                                                                                                                                          
SMBus Send Byte                  yes                                                                                                                                         
SMBus Receive Byte               yes                                                                                                                                         
SMBus Write Byte                 yes                                                                                                                                         
SMBus Read Byte                  yes                                                                                                                                         
SMBus Write Word                 yes                                                                                                                                         
SMBus Read Word                  yes                                                                                                                                         
SMBus Process Call               yes                                                                                                                                         
SMBus Block Write                yes                                                                                                                                         
SMBus Block Read                 no
SMBus Block Process Call         no
SMBus PEC                        yes
I2C Block Write                  yes
I2C Block Read                   yes
root@ac100:~# i2cdetect -y -r 0
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- -- -- -- -- -- -- -- -- 
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- UU -- 
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 4f 
50: 50 51 52 53 54 55 56 57 -- -- -- -- -- -- -- -- 
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- --                         

grate-driver tegra2 support for mainline





sudo apt install devscripts build-essential software-properties-common

sudo add-apt-repository ppa:grate-driver/ppa

# enable only deb-src (suggested beaver doesn't work for me)

root@tegra20:/home/dpavlin# cat /etc/apt/sources.list.d/grate-driver-ubuntu-ppa-disco.list 
#deb http://ppa.launchpad.net/grate-driver/ppa/ubuntu beaver main
deb-src http://ppa.launchpad.net/grate-driver/ppa/ubuntu disco main

apt update # make sure that is pass, use apt-key adv --recv-key if needed

# build order is important

apt-get build-dep libdrm
apt source --build libdrm
dpkg -i libdrm*.deb

apt-get build-dep xserver-xorg-video-opentegra

apt source --build xserver-xorg-video-opentegra

# this will fail to instal because of libturbojpg dependency

root@x200:/home/dpavlin/grade-build/xserver-xorg-video-opentegra-201901152016~grate~feac058~ubuntu19.04.1# vi debian/control

Package: xserver-xorg-video-opentegra
Architecture: armhf
Depends: ${shlibs:Depends}, ${misc:Depends}, ${xviddriver:Depends},
 libdrm-tegra0, liblz4-1, libturbojpeg0 (>= 1.5.0), libpng16-16,
Provides: ${xviddriver:Provides}
Description: X.Org X server -- Opensource driver for NVIDIA Tegra.
 This package provides HW-accelerated opensource driver for NVIDIA
 Tegra20+ SoC's from the GRATE project <URL:https://github.com/grate-driver>.

root@x200:/home/dpavlin/grade-build/xserver-xorg-video-opentegra-201901152016~grate~feac058~ubuntu19.04.1# dpkg-buildpackage

root@tegra20:/home/dpavlin# apt-get install x11-xserver-utils

root@tegra20:/etc# git diff
diff --git a/X11/xinit/xserverrc b/X11/xinit/xserverrc
index 94494ec..e6c4aa4 100755
--- a/X11/xinit/xserverrc
+++ b/X11/xinit/xserverrc
@@ -1,3 +1,3 @@
-exec /usr/bin/X -nolisten tcp "$@"
+exec /usr/bin/X -listen tcp "$@"

# let's try it


root@tegra20:/home/dpavlin# export DISPLAY=:0
root@tegra20:/home/dpavlin# xhost +
access control disabled, clients can connect from any host

# on another computer

dpavlin@x200:~$ x2x -to tegra20:0 -south

# and one flip of display later, I have working X11 with remote mouse and keyboard

root@tegra20:/home/dpavlin# xrandr --output LVDS-0 --rotation inverted

# to get mesa to compile beause of dependencies, I needed to update to buster

root@tegra20:/home/dpavlin# apt-get build-dep mesa
Reading package lists... Done
Reading package lists... Done
Building dependency tree
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 builddeps:mesa : Depends: debhelper (>= 11) but 10.2.5 is to be installed
                  Depends: quilt (>= 0.63-8.2~) but it is not going to be installed
                  Depends: x11proto-dev but it is not installable
                  Depends: libxcb-dri3-dev (>= 1.13) but it is not going to be installed
                  Depends: libxcb-present-dev (>= 1.13) but it is not going to be installed
                  Depends: llvm-7-dev (>= 1:7~) but it is not installable
                  Depends: libwayland-dev (>= 1.15.0) but 1.12.0-1 is to be installed
                  Depends: libwayland-egl-backend-dev (>= 1.15.0) but it is not installable
                  Depends: libclang-7-dev (>= 1:7~) but it is not installable
                  Depends: libclc-dev (>= 0.2.0+git20180917-1~) but it is not going to be installed
                  Depends: wayland-protocols (>= 1.9) but it is not going to be installed
                  Depends: libglvnd-core-dev but it is not installable
E: Unable to correct problems, you have held broken packages.

# after buster upgrade and rebuild of everything

(with dpkg-buildpackage)

root@tegra20:/home/dpavlin/grade-build# apt source --build mesa

dpkg -i *.deb

~50 fps with 25% cpu usage in glxgears

root@tegra20:/home/dpavlin/grade-build# apt-get build-dep libvdpau-tegra
Reading package lists... Done
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 builddeps:libvdpau-tegra : Depends: libdri2-dev but it is not installable
E: Unable to correct problems, you have held broken packages.

# sigh

root@tegra20:/home/dpavlin/grade-build# apt source --build libvdpau-tegra
dpkg-checkbuilddeps: error: Unmet build dependencies: libxv-dev libdri2-dev

root@tegra20:/home/dpavlin/grade-build# apt --fix-broken install
root@tegra20:/home/dpavlin/grade-build# apt-get install libxv-dev

root@tegra20:/home/dpavlin/grade-build/libvdpau-tegra-201901220047~grate~8efb41c~ubuntu18.10.1# vi debian/control 

remove libdri2-dev and libdri2

root@tegra20:/home/dpavlin/grade-build/libvdpau-tegra-201901220047~grate~8efb41c~ubuntu18.10.1# dpkg-buildpackage

dpkg -i ../libvdpau-tegra*.deb

partition table support


Nexus 7 (2012) grouper

Codename grouper
Vendor: Google
Type: Tablet
Also known as: grouper
Platform: NVIDIA Tegra 3
CPU: 1.3 GHz quad-core Cortex A9
GPU: Nvidia GeForce ULP
Bluetooth: 3.0
Wi-Fi: 802.11 b/g/n 2.4GHz
GSM freq: not supported
LTE freq: not supported
Main camera: 1.2 MP
Secondary camera: not supported
Peripherals: accelerometer / gyroscope / proximity sensor / digital compass / GPS / magnometer / microphone / NF




dpavlin@klin:/klin/pmos/pmbootstrap$ pmbootstrap install --android-recovery-zip

pmbootstrap flasher --method=adb sideload

To make pmbootstrap flasher work, I have to issue adb kill-server on my normal terminal console so that postmarketos
chroot can start new adb to flash device.

desktop network config

dpavlin@klin:/klin/pmos/pmbootstrap$ grep -A3 usb0 /etc/network/interfaces
allow-hotplug usb0
iface usb0 inet static
# postmarket os

dpavlin@klin:/klin/pmos/pmbootstrap$ grep -A5 pmos ~/.ssh/config
Host pmos
    UserKnownHostsFile /dev/null

reboot-mode to reboot into recovery


pogo pins

Top ground.

Bottom +5 volts.

USB armory Mk II

This page describes pre-prelease version of usb armory, so if you are receiving release version,
 head over to usb armory wiki https://github.com/f-secure-foundry/usbarmory/wiki which improved massively
since this page was first written.

I had wrong expectations from this board: I was hoping to be able to use GPIO for serial or connecting sensors and that is not possible.

SoC: NXP i.MX6ULZ ARM® Cortex™-A7 900 MHz
RAM: 512 MB DDR3
Storage: internal 16 GB eMMC + external microSD
Bluetooth module: u-blox ANNA-B112 BLE
USB-C ports: DRP (Dual Role Power) receptacle + UFP (Upstream Facing Port) plug, USB 2.0 only (no video support)
LEDs: two
Slide switch: for boot mode selection between eMMC and microSD
External security elements: Microchip ATECC608A + NXP A71CH
Physical size: 66 mm x 19 mm x 8 mm (without enclosure, including USB-C connector)


dpavlin@klin:~/usb-armory/usbarmory-debian-base_image$ ls -al usbarmory-mark-two-debian_stretch-base_image-20191013.raw
-rw-r--r-- 1 root root 3670016000 Oct 13 13:30 usbarmory-mark-two-debian_stretch-base_image-20191013.raw

dpavlin@nuc:/mnt/klin/home/dpavlin/usb-armory/usbarmory-debian-base_image$ dd if=usbarmory-mark-two-debian_stretch-base_image-20191013.raw of=/dev/sdb bs=1M

dpavlin@nuc:~$ dmesg
[764607.538898] usb 2-1: new high-speed USB device number 34 using xhci_hcd
[764607.689068] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a2, bcdDevice= 4.19
[764607.689078] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[764607.689082] usb 2-1: Product: RNDIS/Ethernet Gadget
[764607.689100] usb 2-1: Manufacturer: Linux 4.19.78-0 with 2184000.usb
[764607.900916] cdc_subset: probe of 2-1:1.0 failed with error -22
[764607.902622] cdc_subset 2-1:1.1 usb0: register 'cdc_subset' at usb-0000:00:14.0-1, Linux Device, ae:47:47:81:a0:a4
[764607.902666] usbcore: registered new interface driver cdc_subset
[764607.902711] cdc_ether: probe of 2-1:1.0 failed with error -16
[764607.902732] usbcore: registered new interface driver cdc_ether
[764607.914234] cdc_subset 2-1:1.1 enp0s20u1i1: renamed from usb0

network setup

dpavlin@nuc:~$ sudo ifconfig enp0s20u1i1 netmask

dpavlin@nuc:~$ sudo iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE

dpavlin@nuc:~$ ssh usbarmory@
# password is usbarmory

usbarmory@usbarmory:~$ uname -a
Linux usbarmory 4.19.78-0 #1 PREEMPT Sun Oct 13 11:05:18 UTC 2019 armv7l GNU/Linux
usbarmory@usbarmory:~$ cat /proc/cpuinfo
processor	: 0
model name	: ARMv7 Processor rev 5 (v7l)
BogoMIPS	: 109.09
Features	: half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae
CPU implementer	: 0x41
CPU architecture: 7
CPU variant	: 0x0
CPU part	: 0xc07
CPU revision	: 5

Hardware	: Freescale i.MX6 Ultralite (Device Tree)
Revision	: 0000
Serial		: 0000000000000000
usbarmory@usbarmory:~$ free
              total        used        free      shared  buff/cache   available
Mem:         512204       25588      436744        7624       49872      467984
Swap:             0           0           0

boot select switch

Switch near sdcard select booting from emmc or microsd (silkscreen is somewhat poor, but by default bafore removing sticker it will boot from sdcard)

If it's closer to sdcard, it will boot from sdcard

image delivered on device

Password for image delivered with device is not usbarmory (?)

In fact, it doesn't have usbarmory user in /etc/passwd, but has it in /etc/shadow, go figure!

root@usbarmory:/# cat /etc/passwd
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false

root@usbarmory:/# cat /etc/shadow

After adding usbarmory account, running apt upgrade (since image has old kernel) device isn't bootable any more (at least it's not detected by host in which it's plugged in).

Let's try to rebuild image for emmc and flash it.

Well, re-build fails with patches allready applied errors in linux source, so let's wipe it:

root@813046ba7c77:/opt/armory# rm -Rf linux-* u-boot-2019.07*

root@813046ba7c77:/opt/armory# make all V=mark-two IMX=imx6ull BOOT=eMMC -j 8

pads on board

there is kicad project of production one which just removed pads https://github.com/f-secure-foundry/usbarmory/tree/master/hardware/mark-two

      jtag_mod jtag_tck
jtag_ntrst jtag_tms jtag_nsrst jtag_tdo jtag_tdi

from changelog those pads might be jtag (since it's enabled in u-boot), but schematics confirms it.

It seems that 8 gpio pins are available using additional board: https://github.com/inversepath/usbarmory/tree/master/hardware/mark-two-debug-accessory

sdcard vs emmc speed

root@usbarmory:/mnt/klin/home/dpavlin/usb-armory/usbarmory-debian-base_image# hdparm -Tt /dev/mmcblk[01]

/dev/mmcblk0: # -- sdcard
 Timing cached reads:   664 MB in  2.00 seconds = 331.99 MB/sec
 Timing buffered disk reads:  34 MB in  3.03 seconds =  11.21 MB/sec

/dev/mmcblk1: # -- emmc
 Timing cached reads:   716 MB in  2.00 seconds = 357.40 MB/sec
 Timing buffered disk reads: 128 MB in  3.04 seconds =  42.17 MB/sec




led heartbeat off


very bright and annoying in dark room

sbarmory@usbarmory:/sys/class/leds/LED_WHITE$ cat trigger
none kbd-scrolllock kbd-numlock kbd-capslock kbd-kanalock kbd-shiftlock kbd-altgrlock kbd-ctrllock kbd-altlock kbd-shiftllock kbd-shiftrlock kbd-ctrlllock kbd-ctrlrlock mmc0 mmc1 cpu cpu0 [heartbeat]

root@usbarmory:/sys/devices/soc0/leds/leds/LED_WHITE# echo none > trigger

network speed

root@usbarmory:~# iperf3 -c
Connecting to host, port 5201
[  4] local port 33574 connected to port 5201
[ ID] Interval           Transfer     Bandwidth       Retr  Cwnd
[  4]   0.00-1.03   sec  23.0 MBytes   188 Mbits/sec    0    174 KBytes
[  4]   1.03-2.00   sec  20.6 MBytes   178 Mbits/sec    0    272 KBytes
[  4]   2.00-3.01   sec  21.1 MBytes   176 Mbits/sec    0    286 KBytes
[  4]   3.01-4.01   sec  21.8 MBytes   182 Mbits/sec    0    297 KBytes
[  4]   4.01-5.00   sec  20.1 MBytes   171 Mbits/sec    0    297 KBytes
[  4]   5.00-6.00   sec  21.0 MBytes   176 Mbits/sec    0    329 KBytes
[  4]   6.00-7.00   sec  20.3 MBytes   171 Mbits/sec    0    329 KBytes
[  4]   7.00-8.00   sec  20.4 MBytes   171 Mbits/sec    0    329 KBytes
[  4]   8.00-9.00   sec  20.3 MBytes   171 Mbits/sec    0    329 KBytes
[  4]   9.00-10.00  sec  20.1 MBytes   169 Mbits/sec    0    329 KBytes
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bandwidth       Retr
[  4]   0.00-10.00  sec   209 MBytes   175 Mbits/sec    0             sender
[  4]   0.00-10.00  sec   208 MBytes   174 Mbits/sec                  receiver

iperf Done.

network setup for desktop

dpavlin@nuc:~$ grep usbarmory -A 5 /etc/network/interfaces
# usbarmory
allow-hotplug enx1a5589a26942
iface enx1a5589a26942 inet static
	post-up iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE



root@usbarmory:/home/usbarmory# microcom -p /dev/ttymxc0



usbarmory@usbarmory:~$ sudo apt install armoryctl

since device is on stretch it has go 1.7 which can't compile it.

dpavlin@klin:~/usb-armory$ git clone https://github.com/inversepath/armoryctl

dpavlin@klin:~/usb-armory/armoryctl$ make armoryctl GOARCH=arm
# github.com/inversepath/armoryctl/anna_b112
anna_b112/openocd.go:328:9: undefined: strings.ReplaceAll
anna_b112/openocd.go:329:8: undefined: strings.ReplaceAll
note: module requires Go 1.12make: *** [Makefile:27: armoryctl] Error 2

After compile:

usbarmory@usbarmory:~$ sudo ./armoryctl tusb id
usbarmory@usbarmory:~$ sudo ./armoryctl ble info
manufacturer:"u-blox" model:"ANNA-B1" serial:"0" sw:"1.0.0-017" device_name:"USBARMORY-MKII-DUT-3776"
usbarmory@usbarmory:~$ sudo ./armoryctl se1 info
serial:0x0123455d2a9039e5ee revision:0x00006002
usbarmory@usbarmory:~$ sudo ./armoryctl pmic info
id:0x4("PF1510") family:0xf("15") otp:"A6" rev:0x11


root@usbarmory:/home/usbarmory# i2cdetect -l
root@usbarmory:/home/usbarmory# modprobe i2c-dev
root@usbarmory:/home/usbarmory# i2cdetect -l
i2c-0	i2c       	21a0000.i2c                     	I2C adapter
root@usbarmory:/home/usbarmory# i2cdetect -y 0
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- 08 -- -- -- -- -- -- --
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
30: -- 31 -- -- -- -- -- -- -- -- -- -- -- -- -- --
40: -- -- -- -- -- -- -- -- 48 -- -- -- -- -- -- --
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
60: 60 61 -- -- -- -- -- -- -- -- -- -- -- -- -- --
70: -- -- -- -- -- -- -- --

Honor 5c

Also known as Huawei Honor 7 Lite, Huawei GT3

but 5c doesn't have finger printer server (EU model)


Technology GSM / HSPA / LTE
Launch Announced 2016, April
Status Available. Released 2016, May
Body Dimensions 147.1 x 73.8 x 8.3 mm (5.79 x 2.91 x 0.33 in)
Weight 156 g (5.50 oz)
SIM Hybrid Dual SIM (Nano-SIM, dual stand-by)
Display Type IPS LCD capacitive touchscreen, 16M colors
Size 5.2 inches, 74.5 cm2 (~68.7% screen-to-body ratio)
Resolution 1080 x 1920 pixels, 16:9 ratio (~424 ppi density)
Platform OS Android 6.0 (Marshmallow), upgradable to 7.0 (Nougat); EMUI 4.1
Chipset HiSilicon Kirin 650 (16 nm)
CPU Octa-core (4x2.0 GHz Cortex-A53 & 4x1.7 GHz Cortex-A53)
GPU Mali-T830MP2
Memory Card slot microSDXC (uses shared SIM slot)
Internal 16GB 2GB RAM
Main Camera Single 13 MP, f/2.0, AF
Features LED flash, panorama, HDR
Video 1080p@30fps
Selfie camera Single 8 MP, f/2.0
Sound Loudspeaker Yes
3.5mm jack Yes
Comms WLAN Wi-Fi 802.11 b/g/n, hotspot
Bluetooth 4.1, A2DP, LE
GPS Yes, with A-GPS, GLONASS/ BDS (region dependent)
Radio FM radio
USB microUSB 2.0
Features Sensors Accelerometer, proximity, compass
Battery Non-removable 3000 mAh battery
Misc Colors Silver, Gray, Gold
Models NEM-UL10, NEM-TL00H, NEM-L21, NMO-L31, NMO-L22, NMO-L23, NMO-L01, NEM-L22, NEM-L51, NEM-AL10
SAR 1.26 W/kg (head) 0.43 W/kg (body)
SAR EU 1.56 W/kg (head) 1.24 W/kg (body)
Price About 170 EUR
Tests Performance Basemark OS II 2.0: 1221
Basemark X: 7735
Display Contrast ratio: 733 (nominal), 2.506 (sunlight)
Camera Photo / Video
Loudspeaker Voice 66dB / Noise 71dB / Ring 74dB
Audio quality Noise -90.4dB / Crosstalk -87.9dB
Battery life Endurance rating 75h

[167374.310193] usb 3-2: new high-speed USB device number 8 using ehci-pci
[167374.467237] usb 3-2: New USB device found, idVendor=12d1, idProduct=107e, bcdDevice= 2.99
[167374.467244] usb 3-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[167374.467247] usb 3-2: Product: NEM-L21
[167374.467250] usb 3-2: Manufacturer: HUAWEI
[167374.467253] usb 3-2: SerialNumber: 8SC4C17419000317
[167374.472036] usb-storage 3-2:1.1: USB Mass Storage device detected
[167374.476015] scsi host4: usb-storage 3-2:1.1
[167375.503071] scsi 4:0:0:0: CD-ROM            Linux    File-CD Gadget   0401 PQ: 0 ANSI: 2
[167375.504618] sr 4:0:0:0: Power-on or device reset occurred
[167375.511385] sr 4:0:0:0: [sr0] scsi-1 drive
[167375.513109] sr 4:0:0:0: Attached scsi CD-ROM sr0
[167375.513522] sr 4:0:0:0: Attached scsi generic sg1 type 5

but doesn't show in adb devices

Dial *#*#1357946#*#*

unlock bootloader

huawei doesn't provide official way to do so any more.



Blue Pill

stm32f103 board

arduino boot loader

triple usb serial

Function Pin and Port

USART TX pin RX pin special speed sensor linux
3 PB10 PB11   9600 MH-Z19B /dev/ttyACM1
2 PA2 PA3   9600    
1 PA9 PA10 BOOT=0 9600    

dpavlin@nuc:/nuc/stm32/pill_serial$ cat flash.sh
sudo ../stlink/build/Release/st-flash write src/pill_serial.bin 0x08000000
Weblog Navigation
Weblog Archives
  • Loading...