The Series4 (TiVo Premiere) Development Thread

[Omikron]

===============
General Information
===============

So, the Series4 has been been announced, and it looks like it's got some new hardware under the hood. According to Dave Zatz, the platform is powered by the BCM7413 SoC. Like the chips used in the Series3 platform, this SoC probably has an integrated on-die PROM. In the Series3 platform, it wasn't used and TiVo continued to use their legacy external PROM system, thus allowing us to physically toy with with it and break the chain of trust. If TiVo finally moved the PROM on-die, I fear the hacking community very well may be dead for future platforms.

If it's still stored on an external flash chip, we may still have a fighting chance.

I will definitely be picking up a unit as soon as it hits the shelves, and if it has an external PROM, I'll post what info I can get. For now, I've started this thread to begin discussions.



Anyone who wishes to donate money to go towards purchasing development hardware can do so here: DONATE


If you wish to donate via Bitcoin, BTC donations may be sent to: 1NMneWDPS54qb6f5R2YGCVWUvfQg2nsG8Z

If successful, anyone who donated money will be able to apply their donation towards a DIY PROM kit should they become possible.


===========
News Updates
===========

04/02/10: All major parts have been either ordered or received.

03/25/10: tivo4mevo pointed to a great preliminary review that allows us all to take a peek at what's under the hood. Check it out here: http://mysite.verizon.net/~fiosdvr/prem_review_01.pdf

03/30/10: Enough donations came in to cover the cost of some sockets and test chips, so they've been ordered. Still a bit away from the socket adapter needed for programming, but there are other things to look at while we're all waiting. :-)

02/13/13: Focused development has resumed. Let's see if we can keep the momentum going. I should probably re-write this first post with the latest info at some point. :-)

[Omikron]

The TiVo Premiere appears to use the same TTL serial interface as the Gen06 platform (TiVo HD). The unit uses 5V TTL logic to communicate via serial, and any adapters that work with the TiVo HD will also work with the Premiere.





Without any modification to the bootpage, here is what factory TiVo Premiere displays upon power-on:

Shmoo Version=3.5                                                            
DDR Freq=0x0000018C                                                         
%00000001%                                                              
RC1=00000003                                                           
WC1=FFFFFFE2                                                        
RC2=00000018
WC2=0000002F
RC3=0000000D
WC3=FFFFFFE2
RC4=0000000D
WC4=0000002F
NWC=00000008
RC5=00000003
WC5=00000008
RC6=00000018
WC6=00000008
NRC=0000000D
RW=00000016
WW=0000004E
G=00000000 R=0000000D W=00000008 
BL=00000000
RC1=00000000
RC2=00000015

BL=00000001
RC1=00000003
RC2=00000015

BL=00000002
RC1=00000002
RC2=00000019

BL=00000003
RC1=00000003
RC2=00000019

BL=00000004
RC1=00000001
RC2=00000018
                                                                  
BL=00000005
RC1=00000004
RC2=00000019
                                                                  
BL=00000006
RC1=00000002
RC2=00000017
                                                                  
BL=00000007
RC1=00000002
RC2=00000019
                                                                  
TiVo Gen07 release 1.00 (2009-10-20 14:09:37)
Copyright 2009 TiVo Inc.  All Rights Reserved.
TSN: REDACTED  BREV: 0x1060  MAC: RE:DA:CT:ED
Thumbprint: 356515097AED79CCEC5097DA723F8FE654826A83
Disk: WDC WD3200AVVS-63L2B0  F/W: 01.03A01  S/N: WD-REDACTED 
Booting from partition 3... 3800064 bytes
Kernel signed by '... the Porridge bird ...'
Hashing kernel (SHA256)... done
Checking signature... done.
Signed, valid for release
Kernel entry point is 0x802b8000
                                              
cfeBootParms ===> root=/dev/sda4
Kernel boot options: root=/dev/sda4 console=ttyS0,115200 boardID=0x106001 HpkImp
Gen07
                                                                        
BOOTEDFROMFLASH, Base=1c000000
Initial CP0 22 value : 0xe30f3406
node [00000000, 10000000: RAM]
node [20000000, 10000000: RAM]
mips_counter_frequency = 202000000 from Calibration, = 202500000 from header(CPU_MHz/2)

Access to the PROM Boot Menu is no longer restricted by a factory password unique to the unit. Sending ^C to down the line during the first few seconds will display the PROM boot menu.

Currently Known Commands:

boot [-3,-6]
disk
reset

Kernel message logging via serial can be enabled by connecting the disk to PC and using the bootpage.x86 binary to add "dsscon=true console=0,115200" flags to the bootpage parameters.

Since my USB-SATA adapter was located at /dev/sdb, and the TiVo's bootpage was currently set to "root=/dev/sda4" I issued the following command:

bootpage.x86 -P "root=/dev/sda4 dsscon=true console=0,115200" -C /dev/sdb

[Omikron]

So far, here's what we know about the TiVo Premiere's PROM:

• Intel Strataflash JS28F640P30B85
• Datasheet: http://www.xilinx.com/products/board...s/30666604.pdf
• Digikey Part: 873892-ND

TiVo has finally broken free of the previous design. For the first time since the debut of the Series2 platform, TiVo has selected a new type of flash chip to store the the boot PROM. The flash package is TSOP56, which is kind of a pain in the ass to work with for a variety of reasons. Primarily, they're hard to solder and the socket adapters needed to work with them can be quite expensive.

Preliminary review of the datasheet seems to indicate that all of the security features of this flash device seem to relate to write protection, and not read protection, so in theory we should be able to program fresh chips with modified code.

We won't know a whole lot more until I can get my hands on a TiVo Premiere and a TSOP56 socket adapter for my programmer. Since we'll need a new set of hardware to work with the new platform, I've gone ahead and put up a donation link in the first post of this thread along with a list of what we think we need so far.

[Omikron]

Reserved for future info on possible changes in kernel.

[Roger Dylan]

Once things settle down a little bit, and if it looks like its even faintly possible, I'll be sending you a check for the purchase price of the cheaper of the two models. My contribution to the cause.

EDITED TO ADD: Street price BTW; I'm no fracking Ford Foundation

[Omikron]

Once things settle down a little bit, and if it looks like its even faintly possible, I'll be sending you a check for the purchase price of the cheaper of the two models. My contribution to the cause.

EDITED TO ADD: Street price BTW; I'm no fracking Ford Foundation

Street price as opposed to... :-)

[Omikron]

Well, I've got the TiVo Premiere pre-ordered, so let's see how this dance goes...

[Omikron]

Is there any chance someone got their hands on an early unit? Many Best Buys received their shipments early last week, and a few stores accidentally sold a few before the price in the system was modified to $2,000 to prevent sales staff from overriding the hard street date of 03/28.

If anyone has an early unit, photos of the motherboard would be greatly appreciated.

[Omikron]

New link with delicious info: http://mysite.verizon.net/~fiosdvr/prem_review_01.pdf

Link courtesy of tivo4mevo. Info couresty of bkdtv.

[Omikron]

Updated some info regarding the PROM and the possible serial interface.

PROM has changed drastically and has some new "security" features which I'm still investigating. Serial appears to be the same as THD, at least from visual observation.

[Omikron]

After researching a few different test socket vendors, it seems that Meritec seems to make something that would be of great use to those of us who will be busy trying to work on the PROM:



http://meritec.thomasnet.com/item/sm...56-01?&seo=110

[AlphaWolf]

TiVo has finally broken free of the previous design. For the first time since the debut of the Series2 platform, TiVo has selected a new type of flash chip to store the the boot PROM. The flash package is TSOP56, which is kind of a pain in the ass to work with for a variety of reasons. Primarily, they're hard to solder and the socket adapters needed to work with them can be quite expensive.

I figured they'd be easier to remove since TSOPs only have two sides instead of four. Just melt one side, lift it about a millimeter, then repeat on the other side and its off. At least, I would think it would be easier to remove and socket with less risk of lifting any pads.

[Omikron]

I figured they'd be easier to remove since TSOPs only have two sides instead of four. Just melt one side, lift it about a millimeter, then repeat on the other side and its off. At least, I would think it would be easier to remove and socket with less risk of lifting any pads.

I guess it depends on how much you're concerned about damaging the original chip. The leads are certainly far more fragile and it's very easy to get them bent out of shape if you're not careful. Soldering a TSOP directly to the board shouldn't too bad, although soldering the socket is some what of a pain in the ass, more so than the PLCC32 sockets.

Realistically, I'm not sure most users would actually need to socket it. Historically we've never had to replace the PROM once it was installed and now we have an even bigger reason to skip the socket altogether. For initial PROM hacking though, it's clearly needed. :-)

[Jamie]

Another question worth exploring is whether the PROM can be reprogrammed in-place. This assumes, of course, that a root shell can be obtained by a purely software means first.

[tivo4mevo]

Based upon the OTP bits described in the Flash data sheet, the boot code is likely locked.