Logitech Revue Technical
Specs
- Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
- Gigabyte GA-SBKAN2 motherboard
- Samsung K9F8G08U0M 1 GB NAND Flash (RAM) Datasheet Mirror
- Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
- Silicon Image Sil9135 HDMI 1.3 Receiver Chip Information Datasheet from TI
- Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) Datasheet
- Realtek Semiconductor RTL8201N 10/100M PHYceiver Datasheet
- Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller Datasheet
- Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
- IDT ICS9LPRS525AGLF Clock for CPU Datasheet
The Logitech Revue was recently torndown and its inners revealed.
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/
Usage
Samsung K9F8G08U0M 1 GB NAND Flash
- Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
- Used for persistent storage, device is /dev/sda - possible to override with an external USB drive
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
- Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard
Silicon Image Sil9135 HDMI 1.3 Receiver
- Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
- Supports DTS even though the Revue does not (An update can probably enable this feature)
IDT ICS9LPRS525AGLF Clock for CPU
- Provides a clock and resistance for the Intel Atom CPU
Update Procedure
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)
Boot into recovery mode: (confirm?)
- Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
- Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
- You can then update the box, with a newer update. Downgrading fails however due to a date check.
Firmware Links
(Add update history?)
Flash Layout
via: http://googletv.pastebin.com/233dZqZx
Creating 13 MTD partitions on "intel_ce_nand":
- 0x00000000-0x00200000 : "mbr"
- 0x00200000-0x00a00000 : "cefdk"
- 0x00a00000-0x00c00000 : "redboot"
- 0x00c00000-0x00e00000 : "cefdk-config"
- 0x01000000-0x01800000 : "splash"
- 0x01800000-0x01900000 : "fts"
- 0x01900000-0x02d00000 : "recovery"
- 0x02d00000-0x03200000 : "kernel"
- 0x03200000-0x07200000 : "boot"
- 0x07200000-0x1f200000 : "system"
- 0x1f200000-0x3fa00000 : "data"
- 0x3fa00000-0x3ff00000 : "keystore"
- 0x3ff00000-0x40000000 : "bbt"
mbr - Master Boot Record
cefdk - Boot loader, may or may not have a shell
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu
Kernel - The kernel image
Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format
Serial Output
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).
The pins operate at 3.3v and the port at 9600 baud with the following pinout:
Serial output
via: http://googletv.pastebin.com/233dZqZx Pasted Locally
PIC Access
- There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.
- The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. PIC Pinout
PIC Hex Dump Local PIC Hex Dump
Updates
The updates contain a subset of update files, a boot.img and a recovery.img
boot.img & recovery.img
The thread at xda-developer has the process to extract from the .img files (thx bftb0):
"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."
" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".
You can search for the occurence of the beginning of the squashfs archive with the command
hexdump -C system/boot/recovery.img | grep hsqs
and then do a little math to figure out how to dump that portion of the recovery image, e.g.:
dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img
and then unpack that file using unsquashfs."
Odex files
The .odex files can be extracted by using the following guide Deodex Instructions
Available Pinouts
- UART1 --> Uart Pinout
- J3 --> PIC Chip Access
- SW1 --> Push Button Switch (Use is unknown)
- J20 --> Unknown (May be JTAG)
- J69 --> USB Pinout
- SATA1 --> SATA pinout (may have power included, needs verification)
- J24 --> Unknown (may be power for SATA)
- J13 --> Power for another fan probably
- XDP1 --> Possibly a Intel XDP Debug Adapter Information on XDP Debugging
