Hacking PXA270 internal USB HOST

[afarre]

I just made a short investigation about it at Intel site and I am still surprised how easy it seems to be.

This is the link to Intel PXA270 CPU.

At Technical Documents section we have the doc:
Intel® PXA27x Processor Developer's Kit Schematics

At page 9 (Daughter card secondary connector) is shown:
CPU pins 52 (USBH_PEN0), 54(USBH_PWR0), 58(USBH_P0) and 60(USBH_N0) witch are the CPU USB HOST 0.
CPU pins 40 (USBH_PEN1),42(USBH_PWR1), 46(USBH_P1) and 48(USBH_N1) witch are the CPU USB HOST 1.
Page 29 shows an example of motherboard where the USB circuit driver is completed:
It is labelled as USB HOST 0 and USB HOST 1 (second one is tagged as "do not populate").

See how it just add a couple of integrate circuirs to drive signals and take them directly to a standard USB connector.

It would be nice to know if X51V motherboard populates USB HOST circuit driver or at lest if it has the room left. But still without anything of that:
It seems peace of cake!

I am not going to do anything about that yet because I still have a couple of moths of warranty left. But maybe there is someone interested about it.

[Mokubai]

Sadly I very much doubt they have populated any of that circuitry or even routed those pins to any part of the board for future expansion. It's not a feature that Dell (or HTC for that matter) would consider important and the kind of PCB level real estate required, given the size limitations of the device, really don't justify the benefits.

Given that the PXA270 is a BGA device common practice is to route signals out from the chip across multiple layers of PCB through vias and, once again going back to fact that it is valuable real estate that could be better used for something more important, I doubt that those pins are even connected to the board in a way that would allow you access.

I would like to be wrong about this, as it would be nice to use USB without buying a Ratoc card, but I work with PCB designers and know just how difficult it can be to justify routing every pin of a device. Just leaving four pins completely disconnected can make your life thousands of times easier.

[afarre]

I know hacking a PDA is not an easy job.
But not to be totally fatalist we could step the discussion in several levels:

1. Would it work just wiring and driving CPU USB HOST lines as shown in schematics?
2. Could required CPU pins be available and accessible?
3. Could we find some room inside for USB HOST driver circuit? If not: Could it work taking the CPU USB HOST lines outside the PDA and built the circuit driver outside?
4. Could USB HOST lines be wired at motherboard?
5. Could be room left at motherboard for USB host circuit driver?

[afarre]

Originally Posted by Mokubai

Sadly I very much doubt they have populated any of that circuitry or even routed those pins to any part of the board for future expansion. It's not a feature that Dell (or HTC for that matter) would consider important and the kind of PCB level real estate required, given the size limitations of the device, really don't justify the benefits.

Given that the PXA270 is a BGA device common practice is to route signals out from the chip across multiple layers of PCB through vias and, once again going back to fact that it is valuable real estate that could be better used for something more important, I doubt that those pins are even connected to the board in a way that would allow you access.

I would like to be wrong about this, as it would be nice to use USB without buying a Ratoc card, but I work with PCB designers and know just how difficult it can be to justify routing every pin of a device. Just leaving four pins completely disconnected can make your life thousands of times easier.

From your words it seems you accept step 1 and deny the others.
I totally agree with you.
But still not impossible

[johnbjones]

I could be wrong but I recall that the bluetooth adaptor is wired through a usb interface. If this is the case it might be easier to tap into to bluetooth's daughter board then to try and route your own traces from the cpu.

[afarre]

Originally Posted by johnbjones

I could be wrong but I recall that the bluetooth adaptor is wired through a usb interface. If this is the case it might be easier to tap into to bluetooth's daughter board then to try and route your own traces from the cpu.

If you are right then BT is taking one USB host.
Then we should think about putting to work the other USB host if we want to keep BT working.
BTW, maybe you are right but it does not make much sense because as you can see at several places of the document (i.e. page 56) PXA270 has its dedicated lines for BT interfacing. Just serach "bluetooth" in the document.

[bigbop]

I discussed this in a few threads a while back. I tried to get a damaged X50v motherboard so that I could remove the CPU and trace the circuitry to see if indeed, the built-in USB host is connected to something in the PDA.
Unfortunately, I have not been able to get a bad motherboard (yet).

If you look at the pinouts of the sync connector, there are a few extra pins. I was thinking that these pins 'might' be used for USB host or for a JTAG interface. I found out about a year ago that grounding either pin 5 or 6 will turn on a 3.3v output on pin 7. That is useful for someone wanting to build an rs232 interface.

I also pointed out that there are references in the registry to BT usb devices but I have a copy of the TI BT interface chip and it does not have a BT interface on it.

Also, the older X50v ROM A03 had a USB Host driver in it but it was removed in the A05 ROM and replaced with a new 'preif' driver that was much smaller in size. I never installed the A04 ROM, so I don't know if it was in that one.

Of course, if someone would like to donate a bad X50/X50v/X51v motherboard for me to trace, that would allow me to figure this out once and for all.

[afarre]

Originally Posted by bigbop

I discussed this in a few threads a while back. I tried to get a damaged X50v motherboard so that I could remove the CPU and trace the circuitry to see if indeed, the built-in USB host is connected to something in the PDA.
Unfortunately, I have not been able to get a bad motherboard (yet).

If you look at the pinouts of the sync connector, there are a few extra pins. I was thinking that these pins 'might' be used for USB host or for a JTAG interface. I found out about a year ago that grounding either pin 5 or 6 will turn on a 3.3v output on pin 7. That is useful for someone wanting to build an rs232 interface.

I also pointed out that there are references in the registry to BT usb devices but I have a copy of the TI BT interface chip and it does not have a BT interface on it.

Also, the older X50v ROM A03 had a USB Host driver in it but it was removed in the A05 ROM and replaced with a new 'preif' driver that was much smaller in size. I never installed the A04 ROM, so I don't know if it was in that one.

Of course, if someone would like to donate a bad X50/X50v/X51v motherboard for me to trace, that would allow me to figure this out once and for all.

Can you tell me some registry keys to check if USB host driver has been removed from A12 rom?
You are right, I was also thinking in those free pins those pins to wire the USB host.
Have you opened your PDA? I will do it as soon as warranty expires.

Time ago I read a step by step to open X50 series, but I am not able to find it now. Does anybody have the link?

[uzziah0]

I agree with Mokubai, I too work with HW engineers, and they really don't like putting in stuff that is not NEEDED (especially in devices were space is at a premium) .
Another think, is, if it is wired, what about SW to do something with the HW?

[MichaelWilliams]

Originally Posted by afarre

Can you tell me some registry keys to check if USB host driver has been removed from A12 rom?
You are right, I was also thinking in those free pins those pins to wire the USB host.
Have you opened your PDA? I will do it as soon as warranty expires.

Time ago I read a step by step to open X50 series, but I am not able to find it now. Does anybody have the link?

Hi,

Think it must be this one

:-) Will

[afarre]

Originally Posted by MichaelWilliams

Hi,

Think it must be this one

:-) Will

Thank you!

[bigbop]

Originally Posted by afarre

Can you tell me some registry keys to check if USB host driver has been removed from A12 rom?
You are right, I was also thinking in those free pins those pins to wire the USB host.
Have you opened your PDA? I will do it as soon as warranty expires.

I've had to replace the digitizer on one of my X50v PDAs, so yes, I've been inside the unit. As stated above, companies don't like to put extra parts into a device but they DO put the solder pads on the PCB sometimes but leave off the parts.
Take the X50 and X51 series. The same PCB (motherboard) is used for several models. Only the components change. Refer to the FCC internal photos to check this out. (One of my previous posts has the URLs).

Also, I only have X50v units, so I can't check out the A12 ROM for the driver.

[afarre]

I could not wait any more and I just opened my Axim.

All of you where right, PXA270 uses BGA format: all pins are below the integrated circuit and are not accesible nor visible.
There is also no way to locate possible wired lines to USB HOSTS pins, if they would exist.

USB HOST could only be hacked if pins were wired and with some help from Dell to identify the lines

Tomorrow, with day light, I will take a whole set of macro pictures before closing PDA and I will post them at current thread.

[afarre]

Originally Posted by afarre

...Tomorrow, with day light, I will take a whole set of macro pictures before closing PDA and I will post them at current thread.

I better started this new thread:

What do you want to see from my disassembled X51V?

As main thread for publishing internal pictures.

[aximbigfan]

ok, well....

since BT is wired up with usb why not...

here is a pic of the axim main board (not to scale, not actul positons, jkust an example, usb pinout not in order +5 GND DATA GND)


what would happen if we used soem sort of drill to destry a small part i nthe lines as seen in this pic...


then we soldered the traces fro mthe proc to the source conenction on a usb hub, then back to the BT modual on device side as well as a usb port as seen in next pic as in next pic...


now the thing abotu this is that we would have to mod the dell axim x5xx rom to have a driver for the hub in it. but do you guys kinda see what im saying?

oh also, sorry fro ther crappy image quality, i dotn have photoshop installed on this computer yet...

chris