Notices

X50 / X51 Forums Talk about anything related to the X50 / X51 series.

Reply
 
LinkBack Thread Tools
Old 10-20-06, 03:43 AM   #1 (permalink)
Aximsite All Star
 
afarre's Avatar
Super Member
 
Join Date: Nov 2005
Location: Cadiz - Spain
Posts: 614
Device: Sony Ericsson K608i
Thanked 3 Times in 3 Posts

Awards Showcase
Aximsite Bronze Reviews 
Total Awards: 1

Hacking PXA270 internal USB HOST

I just made a short investigation about it at Intel site and I am still surprised how easy it seems to be.

This is the link to Intel PXA270 CPU.

At Technical Documents section we have the doc:
Intel® PXA27x Processor Developer's Kit Schematics

At page 9 (Daughter card secondary connector) is shown:
CPU pins 52 (USBH_PEN0), 54(USBH_PWR0), 58(USBH_P0) and 60(USBH_N0) witch are the CPU USB HOST 0.
CPU pins 40 (USBH_PEN1),42(USBH_PWR1), 46(USBH_P1) and 48(USBH_N1) witch are the CPU USB HOST 1.
Page 29 shows an example of motherboard where the USB circuit driver is completed:
It is labelled as USB HOST 0 and USB HOST 1 (second one is tagged as "do not populate").

See how it just add a couple of integrate circuirs to drive signals and take them directly to a standard USB connector.

It would be nice to know if X51V motherboard populates USB HOST circuit driver or at lest if it has the room left. But still without anything of that:
It seems peace of cake! :approve: :approve: :approve:

I am not going to do anything about that yet because I still have a couple of moths of warranty left. But maybe there is someone interested about it.
Attached Images:
File Type: jpg pxa270_usb_host.JPG (15.3 KB, 778 views)
File Type: jpg usb_host_circuit_driver.JPG (21.5 KB, 984 views)
__________________
__________________
Maximize you Axim with
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
!!


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

Use it as
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
Watch the
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
!!
afarre is offline   Reply With Quote
Sponsor Ads
Old 10-20-06, 04:09 AM   #2 (permalink)
Aximsite All Star
 
Mokubai's Avatar
Elite Member
 
Join Date: Dec 2005
Location: UK
Posts: 833
Device: HTC Touch Dual
Carrier: T-Mobile UK
Thanked 0 Times in 0 Posts
Sadly I very much doubt they have populated any of that circuitry or even routed those pins to any part of the board for future expansion. It's not a feature that Dell (or HTC for that matter) would consider important and the kind of PCB level real estate required, given the size limitations of the device, really don't justify the benefits.

Given that the PXA270 is a BGA device common practice is to route signals out from the chip across multiple layers of PCB through vias and, once again going back to fact that it is valuable real estate that could be better used for something more important, I doubt that those pins are even connected to the board in a way that would allow you access.

I would like to be wrong about this, as it would be nice to use USB without buying a Ratoc card, but I work with PCB designers and know just how difficult it can be to justify routing every pin of a device. Just leaving four pins completely disconnected can make your life thousands of times easier.
Mokubai is offline   Reply With Quote
Old 10-20-06, 04:45 AM   #3 (permalink)
Aximsite All Star
 
afarre's Avatar
Super Member
 
Join Date: Nov 2005
Location: Cadiz - Spain
Posts: 614
Device: Sony Ericsson K608i
Thanked 3 Times in 3 Posts

Awards Showcase
Aximsite Bronze Reviews 
Total Awards: 1

I know hacking a PDA is not an easy job.
But not to be totally fatalist we could step the discussion in several levels:
  1. Would it work just wiring and driving CPU USB HOST lines as shown in schematics?
  2. Could required CPU pins be available and accessible?
  3. Could we find some room inside for USB HOST driver circuit? If not: Could it work taking the CPU USB HOST lines outside the PDA and built the circuit driver outside?
  4. Could USB HOST lines be wired at motherboard?
  5. Could be room left at motherboard for USB host circuit driver?
__________________
__________________
Maximize you Axim with
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
!!


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

Use it as
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
Watch the
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
!!
afarre is offline   Reply With Quote
Old 10-20-06, 04:47 AM   #4 (permalink)
Aximsite All Star
 
afarre's Avatar
Super Member
 
Join Date: Nov 2005
Location: Cadiz - Spain
Posts: 614
Device: Sony Ericsson K608i
Thanked 3 Times in 3 Posts

Awards Showcase
Aximsite Bronze Reviews 
Total Awards: 1

Originally Posted by Mokubai
Sadly I very much doubt they have populated any of that circuitry or even routed those pins to any part of the board for future expansion. It's not a feature that Dell (or HTC for that matter) would consider important and the kind of PCB level real estate required, given the size limitations of the device, really don't justify the benefits.

Given that the PXA270 is a BGA device common practice is to route signals out from the chip across multiple layers of PCB through vias and, once again going back to fact that it is valuable real estate that could be better used for something more important, I doubt that those pins are even connected to the board in a way that would allow you access.

I would like to be wrong about this, as it would be nice to use USB without buying a Ratoc card, but I work with PCB designers and know just how difficult it can be to justify routing every pin of a device. Just leaving four pins completely disconnected can make your life thousands of times easier.
From your words it seems you accept step 1 and deny the others.
I totally agree with you.
But still not impossible :)
__________________
__________________
Maximize you Axim with
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
!!


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

Use it as
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
Watch the
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
!!
afarre is offline   Reply With Quote
Old 10-20-06, 11:54 AM   #5 (permalink)
Aximsite Prospect
 
Join Date: Feb 2006
Posts: 15
Thanked 0 Times in 0 Posts
I could be wrong but I recall that the bluetooth adaptor is wired through a usb interface. If this is the case it might be easier to tap into to bluetooth's daughter board then to try and route your own traces from the cpu.
johnbjones is offline   Reply With Quote
Old 10-20-06, 02:11 PM   #6 (permalink)
Aximsite All Star
 
afarre's Avatar
Super Member
 
Join Date: Nov 2005
Location: Cadiz - Spain
Posts: 614
Device: Sony Ericsson K608i
Thanked 3 Times in 3 Posts

Awards Showcase
Aximsite Bronze Reviews 
Total Awards: 1

Originally Posted by johnbjones
I could be wrong but I recall that the bluetooth adaptor is wired through a usb interface. If this is the case it might be easier to tap into to bluetooth's daughter board then to try and route your own traces from the cpu.
If you are right then BT is taking one USB host.
Then we should think about putting to work the other USB host if we want to keep BT working.
BTW, maybe you are right but it does not make much sense because as you can see at several places of the document (i.e. page 56) PXA270 has its dedicated lines for BT interfacing. Just serach "bluetooth" in the document.
__________________
__________________
Maximize you Axim with
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
!!


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

Use it as
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
Watch the
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
!!
afarre is offline   Reply With Quote
Old 10-20-06, 02:20 PM   #7 (permalink)
Aximsite Veteran
 
Join Date: Mar 2005
Location: Toronto
Posts: 1,093
Device: A1200,Moto-Q
Carrier: Rogers
Thanked 0 Times in 0 Posts
I discussed this in a few threads a while back. I tried to get a damaged X50v motherboard so that I could remove the CPU and trace the circuitry to see if indeed, the built-in USB host is connected to something in the PDA.
Unfortunately, I have not been able to get a bad motherboard (yet).

If you look at the pinouts of the sync connector, there are a few extra pins. I was thinking that these pins 'might' be used for USB host or for a JTAG interface. I found out about a year ago that grounding either pin 5 or 6 will turn on a 3.3v output on pin 7. That is useful for someone wanting to build an rs232 interface.

I also pointed out that there are references in the registry to BT usb devices but I have a copy of the TI BT interface chip and it does not have a BT interface on it.

Also, the older X50v ROM A03 had a USB Host driver in it but it was removed in the A05 ROM and replaced with a new 'preif' driver that was much smaller in size. I never installed the A04 ROM, so I don't know if it was in that one.

Of course, if someone would like to donate a bad X50/X50v/X51v motherboard for me to trace, that would allow me to figure this out once and for all.
bigbop is offline   Reply With Quote
Old 10-20-06, 02:36 PM   #8 (permalink)
Aximsite All Star
 
afarre's Avatar
Super Member
 
Join Date: Nov 2005
Location: Cadiz - Spain
Posts: 614
Device: Sony Ericsson K608i
Thanked 3 Times in 3 Posts

Awards Showcase
Aximsite Bronze Reviews 
Total Awards: 1

Originally Posted by bigbop
I discussed this in a few threads a while back. I tried to get a damaged X50v motherboard so that I could remove the CPU and trace the circuitry to see if indeed, the built-in USB host is connected to something in the PDA.
Unfortunately, I have not been able to get a bad motherboard (yet).

If you look at the pinouts of the sync connector, there are a few extra pins. I was thinking that these pins 'might' be used for USB host or for a JTAG interface. I found out about a year ago that grounding either pin 5 or 6 will turn on a 3.3v output on pin 7. That is useful for someone wanting to build an rs232 interface.

I also pointed out that there are references in the registry to BT usb devices but I have a copy of the TI BT interface chip and it does not have a BT interface on it.

Also, the older X50v ROM A03 had a USB Host driver in it but it was removed in the A05 ROM and replaced with a new 'preif' driver that was much smaller in size. I never installed the A04 ROM, so I don't know if it was in that one.

Of course, if someone would like to donate a bad X50/X50v/X51v motherboard for me to trace, that would allow me to figure this out once and for all.
Can you tell me some registry keys to check if USB host driver has been removed from A12 rom?
You are right, I was also thinking in those free pins those pins to wire the USB host.
Have you opened your PDA? I will do it as soon as warranty expires.

Time ago I read a step by step to open X50 series, but I am not able to find it now. Does anybody have the link?
__________________
__________________
Maximize you Axim with
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
!!


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

Use it as
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
Watch the
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
!!
afarre is offline   Reply With Quote
Old 10-20-06, 02:52 PM   #9 (permalink)
uzziah0
Guest
 
Posts: n/a
I agree with Mokubai, I too work with HW engineers, and they really don't like putting in stuff that is not NEEDED (especially in devices were space is at a premium) .
Another think, is, if it is wired, what about SW to do something with the HW?
  Reply With Quote
Old 10-20-06, 02:54 PM   #10 (permalink)
MichaelWilliams
Guest
 
Posts: n/a
Originally Posted by afarre
Can you tell me some registry keys to check if USB host driver has been removed from A12 rom?
You are right, I was also thinking in those free pins those pins to wire the USB host.
Have you opened your PDA? I will do it as soon as warranty expires.

Time ago I read a step by step to open X50 series, but I am not able to find it now. Does anybody have the link?
Hi,

Think it must be this one

:-) Will
  Reply With Quote
Old 10-20-06, 03:57 PM   #11 (permalink)
Aximsite All Star
 
afarre's Avatar
Super Member
 
Join Date: Nov 2005
Location: Cadiz - Spain
Posts: 614
Device: Sony Ericsson K608i
Thanked 3 Times in 3 Posts

Awards Showcase
Aximsite Bronze Reviews 
Total Awards: 1

Originally Posted by MichaelWilliams
Hi,

Think it must be this one

:-) Will
Thank you!
__________________
__________________
Maximize you Axim with
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
!!


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

Use it as
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
Watch the
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
!!
afarre is offline   Reply With Quote
Old 10-20-06, 11:03 PM   #12 (permalink)
Aximsite Veteran
 
Join Date: Mar 2005
Location: Toronto
Posts: 1,093
Device: A1200,Moto-Q
Carrier: Rogers
Thanked 0 Times in 0 Posts
Originally Posted by afarre
Can you tell me some registry keys to check if USB host driver has been removed from A12 rom?
You are right, I was also thinking in those free pins those pins to wire the USB host.
Have you opened your PDA? I will do it as soon as warranty expires.
I've had to replace the digitizer on one of my X50v PDAs, so yes, I've been inside the unit. As stated above, companies don't like to put extra parts into a device but they DO put the solder pads on the PCB sometimes but leave off the parts.
Take the X50 and X51 series. The same PCB (motherboard) is used for several models. Only the components change. Refer to the FCC internal photos to check this out. (One of my previous posts has the URLs).

Also, I only have X50v units, so I can't check out the A12 ROM for the driver.
bigbop is offline   Reply With Quote
Old 10-27-06, 06:59 PM   #13 (permalink)
Aximsite All Star
 
afarre's Avatar
Super Member
 
Join Date: Nov 2005
Location: Cadiz - Spain
Posts: 614
Device: Sony Ericsson K608i
Thanked 3 Times in 3 Posts

Awards Showcase
Aximsite Bronze Reviews 
Total Awards: 1

I could not wait any more and I just opened my Axim.

All of you where right, PXA270 uses BGA format: all pins are below the integrated circuit and are not accesible nor visible.
There is also no way to locate possible wired lines to USB HOSTS pins, if they would exist.

USB HOST could only be hacked if pins were wired and with some help from Dell to identify the lines

Tomorrow, with day light, I will take a whole set of macro pictures before closing PDA and I will post them at current thread.
__________________
__________________
Maximize you Axim with
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
!!


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

Use it as
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
Watch the
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
!!
afarre is offline   Reply With Quote
Old 10-27-06, 07:55 PM   #14 (permalink)
Aximsite All Star
 
afarre's Avatar
Super Member
 
Join Date: Nov 2005
Location: Cadiz - Spain
Posts: 614
Device: Sony Ericsson K608i
Thanked 3 Times in 3 Posts

Awards Showcase
Aximsite Bronze Reviews 
Total Awards: 1

Originally Posted by afarre
...Tomorrow, with day light, I will take a whole set of macro pictures before closing PDA and I will post them at current thread.
I better started this new thread:

What do you want to see from my disassembled X51V?

As main thread for publishing internal pictures.
__________________
__________________
Maximize you Axim with
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
!!


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

Use it as
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
Watch the
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
!!
afarre is offline   Reply With Quote
Old 10-27-06, 09:00 PM   #15 (permalink)
Aximsite Hall of Fame
 
aximbigfan's Avatar
Addicted Member
 
Join Date: May 2005
Posts: 9,194
Thanked 0 Times in 0 Posts
Blog Entries: 1
ok, well....

since BT is wired up with usb why not...

here is a pic of the axim main board (not to scale, not actul positons, jkust an example, usb pinout not in order +5 GND DATA GND)


what would happen if we used soem sort of drill to destry a small part i nthe lines as seen in this pic...


then we soldered the traces fro mthe proc to the source conenction on a usb hub, then back to the BT modual on device side as well as a usb port as seen in next pic as in next pic...


now the thing abotu this is that we would have to mod the dell axim x5xx rom to have a driver for the hub in it. but do you guys kinda see what im saying?

oh also, sorry fro ther crappy image quality, i dotn have photoshop installed on this computer yet...

chris

Last edited by aximbigfan; 10-27-06 at 09:03 PM.
aximbigfan is online now   Reply With Quote
Reply

Tags
hacking, host, internal, pxa270, usb

Sponsor Ads

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On
Trackbacks are On
Pingbacks are On
Refbacks are On


Similar Threads
Thread Thread Starter Forum Replies Last Post
What version of programs to use on PXA270 Axim x30 Squelch Windows Mobile 2003 1 05-01-05 10:54 AM
PXA270 Info ctouch Water Fountain 2 12-21-04 06:58 PM
XCPUScalar 2004 v2.84 is out for PXA270 and VGA pocket pc's Immier Mobility Site News 3 11-22-04 09:51 AM
XCPUScalar clocks your Axim X30 & PXA270 XScales upto 741MHz Immier Mobility Site News 6 07-06-04 04:13 PM
Wifi/BT/PXA270/2003SE for $249? No, I''ll take X3i for $30 more! lancie10 X30 / X3 / X3i Forums 4 05-21-04 01:47 PM


All times are GMT -5. The time now is 04:14 AM.
Powered by vBulletin® Version 3.8.2
Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
Search Engine Friendly URLs by vBSEO 3.3.0
Copyright © 2003-09 LeckMedia, LLC