HD-A1 Exploration / Repair (Standalone HD-DVD)

[sega32x]

In regards to sound, never even tinkered with it. Basically umm, the player boots fine without it, but hangs up. You need to obtain the decrypted libraries, and look at the symbolic links. They all point from the DOC to /tmp, you just replace em w/ the legitimate file, and you got it working without a drive.

Furthermore, Ive hooked a HDD up, albeit unsuccessfully to IDE0. Soldered on a new pad, some 0 value resistors etc, the player refused to boot. If I had to guess it overrides the kernel itself, to be used for testing, but specifically how, I am not yet sure.

[Sechrist]

According to these PDFs I'm reading, a IDE-ssd is used for using the PSP before they burn to the chip.
I guess it could be looking for that on the ide drive.

As for the decrypted binaries, i thought the player executed the explay before(then they're dropped in /tmp for about a split second, I got them though).
explay ran on a non-mangled binary fails, but I'll try playing with symlinks.

[sega32x]

In regards to the binaries, I was talking about the system itself. You can bring the system up without the drive, as long as all of the included libs/kernel modules are decrypted first. There is the player software too, but that is not needed to bring the system up.

[Sechrist]

Well, I've pretty much managed to do everything I wanted to do it with short of a full blown media center.
With an edited GLIBC, and proper checks, you can hijack the boot process pretty early and use your own init scripts before it even needs the HD-DVD player. I've done that and used the _one_ ide port I have to mount a pretty big hard drive, and later pivot_root to it with a normal FC3 system installed. I hooked up the hd-dvd player with a crappy usb thing I had and apparently AACS and the custom ioctls work fine. Unfortunately the sound hardware has no documentation available, so the only way to get a /dev/dsp endpoint is to hack together a userland program that converts /dev/dsp PCM to the appropriate /dev/dsptrans and /dev/dspctl commands. Until then, I have hacked up cdplayerd to play mp3s off of a samba share(Sounds pretty dang good, other than it choking on VBRs!)

As for the video hardware, as sega32x said, it's all documented in the Intel PDK. I was able to compile kernel modules even after applying the 16KSTACK patch, making sure PREEMPT is on, and setting the uname to 2.6.10-R040.
The interfaces are a little changed, and toshiba won't give out code, so we're stuck with a little gimped functionality. I was able to get a UVCVIDEO driver compiled and inserted, so now I have a nice webcam streamer so I can spy on my living room from the office :P, but I digress.

Once we have gotten a /dev/dsp frontend, it's just a matter of porting XBMC to use SDL/DirectFB(Which ever is easier), and watching the magic happen. I hope it doesn't require opengl, as I doubt the 854 chipset has that, but we'd hack the code either way to make it work. MPD would also be nice, but again it needs proper sound support.

If any developers have this thing and are willing to help make an awesome media center, please say so.

[cogent]

Hello everyone! I'm assisting some friends in their quest to get a couple of HD-A1 units setup as media servers.

I've done some research on the Xilinx site in order to determine what the three Xilinx chips are doing. I thought I would share some things.

First, if you didn't already know, the Xilinx chips are completely customizable and could contain an infinite number of possible programming configurations.

With that in mind, I believe the entire purpose of the chips is the remote upgrade features they possess. In fact, there is a reference design (http://www.xilinx.com/support/documentation/application_notes/xapp441.pdf) on the Xilinx website that would seem to be very similar to what I would expect to be programmed on the Xilinx chips.

Ultimately, I think to unlock the true potential of the device we would need to reprogram the Xilinx chips. The only way I can see to do this would be to discover the update process in order to push our own update. Has anyone researched the CD update method?

One more thing, for anyone with an electronic engineering background or experience, the Xilinx site has a plethora of freely available information regarding the Xilinx chips. There is also a freely available design software for the chips.

In the end, we will probably need someone familiar with these chips to assist with discovering the true potential of this device.

[n0n@me]

If any developers have this thing and are willing to help make an awesome media center, please say so.

Sechrist, can you post a little walkthrough on how to get control over the box? The easier it is, the more people will try and and hopefully come up with suggestions on getting more stuff working.

Without using BCM7411, HD-A1 is barely faster then the original XBOX and is probably too slow for HD MPEG2 and useless for H.264/AVC. The way the rest of the system is connected to 7411 (except PCI bus of course) is still a mystery to me. I did not look too deeply into it but at least the way to switch between video output of i854 and BCM7411 needs to be figured out.

[Sechrist]

Has anyone researched the CD update method?

Yes, and this is flashed the same way the kernel and boot loader are. I have in my possession the Toshiba tool to flash, but not to read. Too risky I say =)

And, tomorrow I'll write up a guide and post my pre-fabricated files to hack into this thing. Be advised though, it's not for the linux novice.

Also, I don't see how your logic claims the xbox is almost as fast as the pentium 4 2.6ghz that's in it.
I know the P4s were unoptimized as hell, but 2.6ghz is a great deal faster than 733mhz =)

[n0n@me]

Also, I don't see how your logic claims the xbox is almost as fast as the pentium 4 2.6ghz that's in it.
I know the P4s were unoptimized as hell, but 2.6ghz is a great deal faster than 733mhz =)

It was a poor choice of words on my part. I guess I meant to say that it is not good enough for HD H.264

[tsomctl]

It looks like this has died down, but I figured I should add my two cents. I was looking at explay, and found it to be interesting. It checks the dvd drive when decrypting binaries. It has three calls to ioctl for the drive. The first two times are a generic CDROM_DRIVE_STATUS / CDROM_DISC_STATUS (look in linux/cdrom.h). The third call to ioctl is with SG_IO, and the command 0x46 02 01 08 00 00 00 00 18 00 00 00. This returns the drive serial number, which is printed on a sticker on the drive itself. Therefore, the only special thing explay needs is the serial number from the dvd drive. I've successfully decrypted exadvplayer on a generic pc with the drive added. It would probably run in qemu with the emulated dvd drive modified to return the proper serial number. I have no idea what kind of encryption explay uses, but the keys must be embedded in explay, or based around the serial number, which, again, is easily available. It looks like explay was written in assembly, and it decrypts parts of itself while running. Which is completely stupid because I could run it in gdb, break after it had decrypted itself, and then dump the memory. Or I might be doing something wrong.

Anyways, I've managed to brick my hd-a1, and it no longer boots. And I have no idea what exactly is wrong.