I purchased one of these recently and applied the matter update. Afterwards, it seems like ADB is closed off. A factory reset (under info, long-press device name) just clears the user settings but doesn’t actually downgrade the OS. Long-pressing WiFi Address brings up a menu with two factory test apps, one for checking out all the internal functionality, and one for doing a burn-in test. Interestingly, doing a factory reset and then setting up with Matter again, without ever telling the MixPad which WiFi network to connect to, gets it on the right WiFi network. Is that part of Matter or is that the device not actually erasing all the user data?
With the goal of getting ADB working, I disassembled the device and found some TX/RX pads on the back side of the low-voltage PCB. This is a serial port with a bit period of 666.6 ns according to my scope (1.5 MBaud). Here’s the bootup dump (with all ribbon cables disconnected):
DDR V2.06 20220317
ln
vlog1v
D3,512MB,333MHz
bw col bk row cs dbw
16 10 8 15 1 16
OUT
Boot1 Release Time: Dec 28 2021 15:25:31, version: 1.35
support nand flash type: slc
ROM VER:0x56323030, 26
hamming_distance:3326 3330 3
chip_id:524b3326_0,0
ChipType = 0x1a, 1044
...nandc_flash_init enter...
No.1 FLASH ID:98 dc 90 26 76 16
No.2 FLASH ID:ff ff ff ff ff ff
SFTL version: 5.0.57 20211222
...FtlVpcCheckAndModify enter...
SdmmcInit=0 NOT PRESENT
StorageInit ok = 169809
SecureMode = 0
Secure read PBA: 0x4
Secure read PBA: 0x204
Secure read PBA: 0x404
Secure read PBA: 0x604
Secure read PBA: 0x804
SecureInit ret = 0, SecureMode = 0
atags_set_bootdev: ret:(0)
GPT part: 0, name: uboot, start:0x4000, size:0x2000
GPT part: 1, name: trust, start:0x6000, size:0x2000
GPT part: 2, name: misc, start:0x8000, size:0x800
GPT part: 3, name: boot, start:0x8800, size:0x4000
GPT part: 4, name: recovery, start:0xc800, size:0x7000
GPT part: 5, name: sn, start:0x13800, size:0x80
GPT part: 6, name: uuid, start:0x13880, size:0x80
GPT part: 7, name: rootfs, start:0x13900, size:0x23000
GPT part: 8, name: oem, start:0x36900, size:0x37000
GPT part: 9, name: orb_data, start:0x6d900, size:0x16000
GPT part: 10, name: rootfs_data, start:0x83900, size:0x1000
GPT part: 11, name: backup_data, start:0x84900, size:0x3000
GPT part: 12, name: userdata, start:0x87900, size:0x666df
find part:uboot OK. first_lba:0x4000.
find part:trust OK. first_lba:0x6000.
LoadTrust Addr:0x6000
No find bl30.bin
Load uboot, ReadLba = 4000
Load OK, addr=0x200000, size=0xdc468
RunBL31 0x40000 @ 276635 us
INFO: Preloader serial: 2
NOTICE: BL31: v2.3():v2.3-354-g14c8e3da7:huan.he
NOTICE: BL31: Built : 09:00:18, Apr 20 2022
NOTICE: BL31:Rockchip release version: v1.0
INFO: ARM GICv2 driver initialized
INFO: Using opteed sec cpu_context!
INFO: boot cpu mask: 1
INFO: plat_rockchip_pmu_init: pd status f00e
INFO: BL31: Initializing runtime services
INFO: BL31: Initializing BL32
I/TC:
I/TC: OP-TEE version: 3.13.0-641-g4167319d3 #hisping.lin (gcc version 10.2.1 20201103 (GNU Toolchain for the A-profile Architecture 10.2-2020.11 (arm-10.16))) #9 Wed Mar 16 17:44:01 CST 2022 aarch64
I/TC: Primary CPU initializing
I/TC: Primary CPU switching to normal world boot
INFO: BL31: Preparing for EL3 exit to normal world
INFO: Entry point address = 0x200000
INFO: SPSR = 0x3c9
U-Boot 2017.09 (May 16 2023 - 07:11:09 +0000)
Model: Rockchip RK3326 EVB
PreSerial: 2, raw, 0xff160000
DRAM: 502 MiB
Sysmem: init
Relocation Offset: 1db9e000
Relocation fdt: 1bd93200 - 1bd94cc3
CR: M/C/I
Using default environment
DM: v1
...nandc_flash_init enter...
No.1 FLASH ID:98 dc 90 26 76 16
SFTL version: 5.0.56 20210329
Bootdev(atags): rknand 0
PartType: EFI
boot mode: None
Found DTB in boot part
DTB: rk-kernel.dtb
HASH(s): OK
I2c0 speed: 400000Hz
PMIC: RK8090 (on=0x40, off=0x00)
vdd_logic 1000000 uV
vdd_arm 900000 uV
Could not find baseparameter partition
Model: Rockchip rk3326 mixpad-d
orb main key status:
key1:[0],key2:[0],key3:[0]
key4:[1],key5:[0],key6:[0]
get_mixpad_main_gpio_id:value=0x0010
main hw not match, use default
get_mixpadmini_secondary_gpio_id key1=0,key2=1,key3=1
get_mixpadmini_secondary_gpio_id mixpad_model=0x0003
get_mixpadmini_secondary_gpio_id2 key1=0,key2=0,key3=0
get_mixpadmini_secondary_gpio_id2 mixpad_model_id2=0x0000
saradc 0 val = 511
orb_mixpad_model_check : main_model=0
orb_mixpad_model_check : device_model=2
orb_mixpad_model_check : device_model_id2=0
orb_mixpad_model_check : device_model_adc_val=511
orb-logo]devtype:rknand,devnum:0
orb-logo] read logo-header(.orb_logo.bmp) ++
orb-logo],partNUm:0:d
orb-logo],Error:file(.orb_logo.bmp) not exist
orb-logo] read logo-header --
orb-logo],1,Using default-logo,for read logo-file(.orb_logo.bmp) failed
orb-logo],2,Using default-logo,for read logo-file(.orb_logo.bmp) failed
Rockchip UBOOT DRM driver version: v1.0.1
Using display timing dts
rgb: detailed mode clock 165000 kHz, flags[a]
H: 0170 0175 0185 0195
V: 0320 0325 0335 0345
bus_format: 101c
CLK: (sync kernel. arm: enter 400000 KHz, init 600000 KHz, kernel 600000 KHz)
apll 600000 KHz
dpll 1332000 KHz
cpll 660000 KHz
npll 1188000 KHz
gpll 1200000 KHz
aclk_bus 200000 KHz
hclk_bus 150000 KHz
pclk_bus 100000 KHz
aclk_peri 200000 KHz
hclk_peri 150000 KHz
pclk_pmu 100000 KHz
Net: Net Initialization Skipped
No ethernet found.
Hit key to stop autoboot('CTRL+C'): 0
ANDROID: reboot reason: "(none)"
optee api revision: 2.0
TEEC: Waring: Could not find security partition
Booting LZ4 kernel at 0x03e80000(Uncompress to 0x00280000) with fdt at 0x08300000...
Fdt Ramdisk skip relocation
## Booting Android Image at 0x03e7f800 ...
Kernel: 0x00280000 - 0x008c8cb5 (6436 KiB)
## Flattened Device Tree blob at 0x08300000
Booting using the fdt blob at 0x08300000
Uncompressing LZ4 Kernel Image from 0x03e80000 to 0x00280000 ... with 00cdc008 bytes OK
kernel loaded at 0x00280000, end = 0x00f5c008
'reserved-memory' ramoops@110000: addr=110000 size=f0000
Using Device Tree in place at 0000000008300000, end 000000000831d59d
orb-logo]devtype:rknand,devnum:0
orb-logo] read logo-header(.orb_logo.bmp) ++
orb-logo],partNUm:0:d
orb-logo],Error:file(.orb_logo.bmp) not exist
orb-logo] read logo-header --
orb-logo],1,Using default-logo,for read logo-file(.orb_logo.bmp) failed
orb-logo],2,Using default-logo,for read logo-file(.orb_logo.bmp) failed
failed to reserve drm-cubic-lut memory
Adding bank: 0x00200000 - 0x08400000 (size: 0x08200000)
Adding bank: 0x08c00000 - 0x20000000 (size: 0x17400000)
Total: 1652.100 ms
Starting kernel ...
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Initializing cgroup subsys cpuset
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Initializing cgroup subsys cpuacct
[ 0.000000] Linux version 4.4.194 (root@55d5dd6ab898) (gcc version 6.3.1 20170404 (Linaro GCC 6.3-2017.05) ) #13 SMP Tue May 16 07:11:50 UTC 2023
[ 0.000000] Boot CPU: AArch64 Processor [410fd042]
[ 0.000000] earlycon: Early serial console at MMIO32 0xff160000 (options '')
[ 0.000000] bootconsole [uart0] enabled
[ 0.000000] On node 0 totalpages: 128512
[ 0.000000] DMA zone: 2040 pages used for memmap
[ 0.000000] DMA zone: 0 pages reserved
[ 0.000000] DMA zone: 128512 pages, LIFO batch:31
[ 0.000000] psci: probing for conduit method from DT.
[ 0.000000] psci: PSCIv1.1 detected in firmware.
[ 0.000000] psci: Using standard PSCI v0.2 function IDs
[ 0.000000] psci: Trusted OS migration not required
[ 0.000000] PERCPU: Embedded 21 pages/cpu @ffffffc01ff21000 s45736 r8192 d32088 u86016
[ 0.000000] pcpu-alloc: s45736 r8192 d32088 u86016 alloc=21*4096
[ 0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
[ 0.000000] Detected VIPT I-cache on CPU0
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 126472
[ 0.000000] Kernel command line: storagemedia=nand androidboot.storagemedia=nand androidboot.mode=normal orbmodel=MixpadHostD androidboot.serialno=<removed> rootwait earlycon=uart8250,mmio32,0xff160000 swiotlb=1 loglevel=8 root=PARTUUID=614e0000-0000 rootfstype=squashfs
[ 0.000000] PID hash table entries: 2048 (order: 2, 16384 bytes)
[ 0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes)
[ 0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes)
[ 0.000000] software IO TLB: mapped [mem 0x1fe1d000-0x1fe5d000] (0MB)
[ 0.000000] Memory: 481552K/514048K available (8190K kernel code, 1200K rwdata, 2772K rodata, 960K init, 612K bss, 32496K reserved, 0K cma-reserved)
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] modules : 0xffffff8000000000 - 0xffffff8008000000 ( 128 MB)
[ 0.000000] vmalloc : 0xffffff8008000000 - 0xffffffbdbfff0000 ( 246 GB)
[ 0.000000] .init : 0xffffff8008b40000 - 0xffffff8008c30000 ( 960 KB)
[ 0.000000] .text : 0xffffff8008080000 - 0xffffff8008880000 ( 8192 KB)
[ 0.000000] .rodata : 0xffffff8008880000 - 0xffffff8008b40000 ( 2816 KB)
[ 0.000000] .data : 0xffffff8008c30000 - 0xffffff8008d5c008 ( 1201 KB)
[ 0.000000] vmemmap : 0xffffffbdc0000000 - 0xffffffbfc0000000 ( 8 GB maximum)
[ 0.000000] 0xffffffbdc0008000 - 0xffffffbdc0800000 ( 7 MB actual)
[ 0.000000] fixed : 0xffffffbffe7fb000 - 0xffffffbffec00000 ( 4116 KB)
[ 0.000000] PCI I/O : 0xffffffbffee00000 - 0xffffffbfffe00000 ( 16 MB)
[ 0.000000] memory : 0xffffffc000200000 - 0xffffffc020000000 ( 510 MB)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[ 0.000000] Hierarchical RCU implementation.
[ 0.000000] Build-time adjustment of leaf fanout to 64.
[ 0.000000] RCU restricting CPUs from NR_CPUS=8 to nr_cpu_ids=4.
[ 0.000000] RCU: Adjusting geometry for rcu_fanout_leaf=64, nr_cpu_ids=4
[ 0.000000] NR_IRQS:64 nr_irqs:64 0
[ 0.000000] GIC: Using split EOI/Deactivate mode
[ 0.000000] Architected cp15 timer(s) running at 24.00MHz (phys).
[ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
[ 0.000009] sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
[ 0.002515] Console: colour dummy device 80x25
[ 0.002939] console [tty0] enabled
[ 0.003273] bootconsole [uart0] disabled
I/TC: Secondary CPU 1 initializing
I/TC: Secondary CPU 1 switching to normal world boot
I/TC: Secondary CPU 2 initializing
I/TC: Secondary CPU 2 switching to normal world boot
I/TC: Secondary CPU 3 initializing
I/TC: Secondary CPU 3 switching to normal world boot
I’ve done some work with Yocto/uboot in the past but I’m going to have to read up on how to get the boot console to stay up (unless anybody here knows?). Edit: I hooked up the RX side of the UART and it seems like maybe bootdelay is set to 0 because it doesn’t register my CTRL+C (and also doesn’t visibly count down). I was able to interrupt it eventually and get into the uboot cmd.
=> printenv
arch=arm
autoload=no
baudrate=1500000
board=evb_px30
board_name=evb_px30
boot_a_script=load ${devtype} ${devnum}:${distro_bootpart} ${scriptaddr} ${prefix}${script}; source ${scriptaddr}
boot_extlinux=sysboot ${devtype} ${devnum}:${distro_bootpart} any ${scriptaddr} ${prefix}extlinux/extlinux.conf
boot_net_usb_start=usb start
boot_prefixes=/ /boot/
boot_script_dhcp=boot.scr.uimg
boot_scripts=boot.scr.uimg boot.scr
boot_targets=mmc1 mmc0 rknand0 usb0 pxe dhcp
bootargs=storagemedia=nand androidboot.storagemedia=nand androidboot.mode=normal orbmodel=MixpadHostD
bootcmd=boot_android ${devtype} ${devnum};boot_fit;bootrkp;run distro_bootcmd;
bootcmd_dhcp=run boot_net_usb_start; if dhcp ${scriptaddr} ${boot_script_dhcp}; then source ${scriptaddr}; fi;
bootcmd_mmc0=setenv devnum 0; run mmc_boot
bootcmd_mmc1=setenv devnum 1; run mmc_boot
bootcmd_pxe=run boot_net_usb_start; dhcp; if pxe get; then pxe boot; fi
bootcmd_rknand0=setenv devnum 0; run rknand_boot
bootcmd_usb0=setenv devnum 0; run usb_boot
bootdelay=0
cpu=armv8
devnum=0
devtype=rknand
distro_bootcmd=for target in ${boot_targets}; do run bootcmd_${target}; done
eth1addr=<removed>
ethaddr=<removed>
fdt_addr_r=0x08300000
kernel_addr_c=0x03e80000
kernel_addr_r=0x00280000
mmc_boot=if mmc dev ${devnum}; then setenv devtype mmc; run scan_dev_for_boot_part; fi
partitions=uuid_disk=${uuid_gpt_disk};name=loader1,start=32K,size=4000K,uuid=${uuid_gpt_loader1};name=loader2,start=8MB,size=4MB,uuid=${uuid_gpt_loader2};name=trust,size=4M,uuid=${uuid_gpt_atf};name=boot,size=112M,bootable,uuid=${uuid_gpt_boot};name=rootfs,size=-,uuid=B921B045-1DF0-41C3-AF44-4C6F280D3FAE;
pxefile_addr_r=0x00600000
ramdisk_addr_r=0x0a200000
rkimg_bootdev=if mmc dev 1 && rkimgtest mmc 1; then setenv devtype mmc; setenv devnum 1; echo Boot from SDcard;elif mmc dev 0; then setenv devtype mmc; setenv devnum 0;elif mtd_blk dev 0; then setenv devtype mtd; setenv devnum 0;elif mtd_blk dev 1; then setenv devtype mtd; setenv devnum 1;elif mtd_blk dev 2; then setenv devtype mtd; setenv devnum 2;elif rknand dev 0; then setenv devtype rknand; setenv devnum 0;elif rksfc dev 0; then setenv devtype spinand; setenv devnum 0;elif rksfc dev 1; then setenv devtype spinor; setenv devnum 1;elsesetenv devtype ramdisk; setenv devnum 0;fi;
scan_dev_for_boot=echo Scanning ${devtype} ${devnum}:${distro_bootpart}...; for prefix in ${boot_prefixes}; do run scan_dev_for_extlinux; run scan_dev_for_scripts; done;
scan_dev_for_boot_part=part list ${devtype} ${devnum} -bootable devplist; env exists devplist || setenv devplist 1; for distro_bootpart in ${devplist}; do if fstype ${devtype} ${devnum}:${distro_bootpart} bootfstype; then run scan_dev_for_boot; fi; done
scan_dev_for_extlinux=if test -e ${devtype} ${devnum}:${distro_bootpart} ${prefix}extlinux/extlinux.conf; then echo Found ${prefix}extlinux/extlinux.conf; run boot_extlinux; echo SCRIPT FAILED: continuing...; fi
scan_dev_for_scripts=for script in ${boot_scripts}; do if test -e ${devtype} ${devnum}:${distro_bootpart} ${prefix}${script}; then echo Found U-Boot script ${prefix}${script}; run boot_a_script; echo SCRIPT FAILED: continuing...; fi; done
scriptaddr=0x00500000
serial#=<removed>
soc=rockchip
stderr=serial,vidconsole
stdout=serial,vidconsole
usb_boot=usb start; if usb dev ${devnum}; then setenv devtype usb; run scan_dev_for_boot_part; fi
vendor=rockchip
There are also pads for USB (5V/GND/ID/D+/D-) on the top side of the low-voltage board which are easily accessible without disconnecting any of the ribbon cables. I wonder if ADB will connect through that USB interface?
Looking into Dart/Flutter, there is a WebView widget with a native Android implementation; seems like it could be quick to build a simple Flutter UI with just this single WebView widget set up to load either a pre-baked Home Assistant URL, or a URL from a file, etc.
Anybody here make any more progress? Any thoughts on how to get ADB/SSH access again after applying the Matter update?
