The Series5 (Tivo Roamio) Development Thread

[GaveUp]

Figure a new thread will keep from the Premiere information/efforts and the Roamio efforts getting intertwined. Here are some high res pics of the PCB. They're a but slanted and blurry in a couple of places but it was the best I was able to get with the camera and lens I have.

They were too large to attach, but here are the links:

Top
Bottom

eMMC is KLM4G1YE4C-B001. Datasheet

[prom.eth.eus]

Ok, the next step would be to identify all the connectors.

Top left is:
Sata
Power for the Hard Drive
Fan?

2 Bottom edge connectors go to the front panel.

Which leaves J3200 in the middle, as the most interesting.

What does the connector between the wifi daughtercard and the motherboard look like?

Next, we need a boot log either via serial console or reading /var/log/* off of a booted hard drive. And if anyone is pulling out their hard drive, what the partition map looks like would be useful as well.

[GaveUp]

Ok, the next step would be to identify all the connectors.

Top left is:
Sata
Power for the Hard Drive
Fan?

2 Bottom edge connectors go to the front panel.

Which leaves J3200 in the middle, as the most interesting.

What does the connector between the wifi daughtercard and the motherboard look like?

Next, we need a boot log either via serial console or reading /var/log/* off of a booted hard drive. And if anyone is pulling out their hard drive, what the partition map looks like would be useful as well.

You're right on the top left. Sata, Sata power, and a fan. Two connectors on the bottom left and right wire up to the LEDs. When pulling it apart I don't remember seeing any unpopulated headers, but now I'm actually not sure on J3200 (yeah, should have taken intermediary photos). Dumping the HD is on the list as well. It would be nice to get the contents of a never powered on image and the first boot log as well.

Lastly, it would be nice to get a couple highres photos of the other roamio models. Comparing to the linked photos in the other thread there are quite a few differences (including a labeled uart0).

[GaveUp]

It looks like the HD ships blank on the Roamios so the OS must be contained on the eMMC. Anyone have the equipment to pop that off so we can trace out CLK/CMD/DAT lines for dumping?

[GaveUp]

Probably not news to most but J3200 is the serial. Pin 1 is TX, 2 is GND, 3 appears to be RX. You can connect to it with an FTDI cable, MicroFTX or similar. Settings are 115200 8N1. Output on boot is:

Initializing XXXXXXXX (LOCKED)...

TiVo Gen10 release 1.00 (2013-06-17 18:31:53)
Copyright by TiVo Inc.  All Rights Reserved.
System temperature: 32C
TSN: XXXXXXXXXXXXXXX  BREV: 0xXXXX  MAC: 00:00:00:00:00:00
Initializing mmc...
Booting from internal device partition 3...
Loading 6196192 bytes...
Image signed by '... the Porridge bird ...'
Hashing image... done
Checking signature... done.
Valid for release
Kernel entry point is 0x8037c510

Confirms that it is booting off the eMMC and given it's booting off partition 3 it's probably safe to assume it's using a similar partition layout to previous models. The, obvious, next step is getting a dump of the eMMC. I'll also wager J2205 is probably JTAG so that would also be worth investigating.

J3202 is most likely a second serial port, but it doesn't display anything nor accept any input.

[Omikron]

It looks like the HD ships blank on the Roamios so the OS must be contained on the eMMC. Anyone have the equipment to pop that off so we can trace out CLK/CMD/DAT lines for dumping?

I have access to IR rework equipment now, so I can pop off the chip.

I'm currently trying to get Xeltek to add support for this chip so I can dump the firmware directly.

[Omikron]

I should note that I have yet to be able to see a Roamio in person, but if we have a sure-fire way of pulling the data off, perhaps it's wroth getting a Roamio to start dumping code...

[GaveUp]

If we had the lines of the chip it should be possible to dump it with an SD reader as has been done with the consoles that have eMMC chips. I do have a heat gun that could pop the chip off easy enough, but I don't have the equipment or skills to get it back on in working order. Without a throwaway tivo it's not a route I want to go down at this point.

[Omikron]

If we had the lines of the chip it should be possible to dump it with an SD reader as has been done with the consoles that have eMMC chips. I do have a heat gun that could pop the chip off easy enough, but I don't have the equipment or skills to get it back on in working order. Without a throwaway tivo it's not a route I want to go down at this point.

I'm not worried about getting the chip back on as much as I am about accidentally corrupting the chip with the SD reader method. If that happens, the TiVo is still dead.

[GaveUp]

I'm not worried about getting the chip back on as much as I am about accidentally corrupting the chip with the SD reader method. If that happens, the TiVo is still dead.

True. On that I'd be curious how the thing behaves with the chip removed. Does it try to boot from somewhere else (hard drive)? JTAG might be an option for poking at the chip too, assuming it's functional. I'd guess it's not.

[Omikron]

True. On that I'd be curious how the thing behaves with the chip removed. Does it try to boot from somewhere else (hard drive)? JTAG might be an option for poking at the chip too, assuming it's functional. I'd guess it's not.

Most likely the JTAG fuse in the Broadcom CPU is blown. There's no reason they wouldn't blow it, and since it was blown on the S4, it's got to be blown here as well. Still, no reason not to try anyway...

My guess is that it behaves the same way the other platforms do when you remove the PROM, which is for the CPU to halt.

I've contacted Xeltek and they are willing to add the programing algorithm for this chip to the SP6000 series, but there's a $200 development fee, plus they need three samples of the chip to test with (we should be able to source these externally), plus the BGA153 adapter, which is about $600.

All in all, it's a fairly expensive proposition but from my experience it's a known-good way of getting a perfect, reliable, read and write. Unfortunately, considering how stymied the S4 development got, it's hard to justify the money since it's likely that we'll be stopped in our tracks even once we get the firmware out. We won't know if we don't try...

[Omikron]

So after looking through what people are doing on the Xbox One side to dump the NAND via the SD card method, I think it may have merit.

Now to find a Roamio to start attacking with hot pointy things... ;-)

[djl]

Omikron - if you get to a point where a donation call is in order, don't hesitate. Some of us old-timers still stop by, but we've all been stymied by the Premiere for the past few years.

[GaveUp]

Omikron - if you get to a point where a donation call is in order, don't hesitate. Some of us old-timers still stop by, but we've all been stymied by the Premiere for the past few years.

At this point I think the most helpful thing would be tracking down more of the datasheets and tracing the pin outs of the main chips. Even the less technically inclined can help in that area.

Most likely the JTAG fuse in the Broadcom CPU is blown. There's no reason they wouldn't blow it, and since it was blown on the S4, it's got to be blown here as well. Still, no reason not to try anyway...

My guess is that it behaves the same way the other platforms do when you remove the PROM, which is for the CPU to halt.

I'd guess the same on the JTAG as well. It'd be a pretty big oops if not. The eMMC is different in purpose over the PROM in that it holds the OS as well. Just my thought is there's probably some, presumably disabled, way of telling it to boot of some other media. It'd make sense from the development perspective.

[Omikron]

Omikron - if you get to a point where a donation call is in order, don't hesitate. Some of us old-timers still stop by, but we've all been stymied by the Premiere for the past few years.

At this point I don't have physical access to a Roamio, so for me that's one of the first things I'd like to get taken care of. At the moment I'm just trying to keep an eye out for Roamio Plus hardware that is discounted enough to justify buying.

Since I don't actually have cable service or TiVo service at the moment (not until I move), I'm not so excited about paying full price for a box I will have no personal use for outside of hacking it. :-)