Embedded Systems blog and reports

Brian Schüler

Last update: January 31, 2012


Contents


Samsung Galaxy Nexus: Flashing custom ROMs can break your phone

Figure: Left: Samsung Galaxy Nexus being unboxed, Right: Voice search on a broken microphone
Image galaxy_nexus Image galaxy_nexus_voicesearch

WARNING!! DANGER!! WARNING!! DANGER!! WARNING!! DANGER!!
==========================================================
PLEASE!! DO NOT TRY TO FOLLOW ANY OF THE STEPS THAT I DESCRIBED HERE!
YOU MAY BREAK YOUR DEVICE!!
THIS IS NOT AN INSTRUCTION MANUAL!!
I'M NOT RESPONSIBLE FOR ANY DAMAGES - IT DESCRIBES HOW TO
DESTROY HARDWARE - PLEASE DO *NOT* FOLLOW ANY INSTRUCTIONS
==========================================================
WARNING!! DANGER!! WARNING!! DANGER!! WARNING!! DANGER!!


WARNUNG!! GEFAHR!! WARNUNG!! GEFAHR!! WARNUNG!! GEFAHR!!
==========================================================
IN DIESEM ARTIKEL WIRD ERKLAERT UND BESCHRIEBEN,
WIE EIN GERAET BESCHAEDIGT UND UNBRAUCHBAR GEMACHT
WERDEN KANN.
DIES IST KEINE BETRIEB- ODER INSTALLATIONSSANLEITUNG!!
HIERMIT ENTZIEHE ICH MICH JEDER VERANTWORTUNG FUER
ZERSTOERTE HARDWARE, DIE DURCH ANWENDUNG VON
SCHRITTEN AUS FOLGENDEM ARTIKEL ENTSTEHEN KOENNEN.
==========================================================
WARNUNG!! GEFAHR!! WARNUNG!! GEFAHR!! WARNUNG!! GEFAHR!!

As I became 30 years old I made myself a big birthday surprise - so I bought a Samsung Galaxy Nexus (http://de.wikipedia.org/wiki/Galaxy_Nexus) especially for Android development. It comes with an amazing hi-resolution AMOLED display, a 1.2 GHz dual core Cortex-A9 CPU and it's the first Android 4 phone on the market. I played with it a lot to test the cool features - espeacially video-chatting with Skype was very exciting on the 1.3 Mpx front camera. Telephony was very clear cause of the noice reducing technology realized by a second microphone on the back. After I had put it to the acid I wanted to unlock and reflash the device. Unlocking the bootloader and installing Clockwork Recovery was wery easy. Then I installed a nightly snapshot of CyanogenMod 9 Alpha that was dated 5th of Jan. 2012. It also worked fine und the device booted into the rooted Android 4.0.3 CM9 custom build. I have installed all the apps that I need for my daily life and after that - I started a video call with one of my friends - but he could not hear me. A also tested Shazam, Voice Search and some audio recording apps, but they all didn't work (except of the camcorder (which uses the microphone on the back)) - even telephony did not work. This condition was not useful anymore so I tried other custom ROMs like Open Kang, Modaco, Euroskank, DG builds and some re-compiled Google builds. All ROMs booted fine but in all cases the microphone didn't work. So I flashed the original Google (unrooted) Stock-ROM and the bad surprise: The microphone still didn't work. Testing newer builds of custom ROMs didn't help. I sold it to one of my best friends (after clearing up with the state) who only has a SIM with a data plan and without telephony implicitrly wanted to have this Galaxy Nexus. He obtained a stock ROM directly from the device manufacturer Samsung - and also without success (working operating system, no microphone). In all this time he and I were googling around in forums in the hope to find hints about this problem but found no ponderable entries.
A geek friend has also bought a Galaxy Nexus and borrowed it to me to flash CM9 (cause he wanted it, too). I attentively read a lot in different forums for flashing instructions that promised successful operation. I was smarter this time and did a NANDroid backup after unlocking and installing the CWM recovery system. (OS and mic still worked fine after unlocking, CWM installation, NAND backup and rebooting the original ROM). It was time to install CM9 (but a more recent version (date 25. Jan. 2012) that works for other people) and after flashing and rebooting the microphone on the second Galaxy Nexus was also broken, suddenly. So I restored my NAND backup with the originally shipped untouched Google stock ROM. And the microphone was still broken. Even the full vender reflash procedure (original ROM, original recovery system, locked bootloader) did not help.
What I made wrong? I took regular ways using the proper fastboot tool and a known-to-work version of Clockwork Recovery (v5.5.0.2) to flash custom ROMs and indeed probably broke the sound chip or flashed any (forbidden) memory region that blocks the microphone operation. I can't say whether it's a hardware or a software issue - but this is clear: Flashing a custom ROM the way I took has made the microphone on the Samsung Galaxy Nexus unusable (and I haven't any solution for this to fix it - still no other people on the web with the same problem). Our decision were to send the phones back to a repair service (after flasing the original ROM, the original recovery system and locking the bootloader).

WARNING!! DANGER!! WARNING!! DANGER!! WARNING!! DANGER!!
==========================================================
PLEASE!! DO NOT TRY TO FOLLOW ANY OF THE STEPS THAT I DESCRIBED HERE!
YOU MAY BREAK YOUR DEVICE!!
I'M NOT RESPONSIBLE FOR ANY DAMAGES - IT DESCRIBES HOW TO
DESTROY HARDWARE - PLEASE DO *NOT* FOLLOW ANY INSTRUCTIONS
==========================================================
WARNING!! DANGER!! WARNING!! DANGER!! WARNING!! DANGER!!

BS - 31. 01. 2012


Solid state drive - yes or no?

Solid State Drives (SSD's) or FLASH-based storage does have some advantages in contrast to conventional hard drives. They are shock resistant and in most cases faster - especially on loading small files. They also saves power, which is important for mobile devices. In 2009 I equipped my ThinkPad X41 Tablet with a 64 GB 44-PIN IDE solid state drive (PhotoFast G-Monster II, 80MB/s read, 40MB/s write, http://www.maxxxware.de/maxxx_product_gmonster_ide18_44_v2.php ) and I was really happy with that, because the speed increased amazingly. I was using the notebook for developing and package building intensively. There was a 4 GB swap partition and two additional 5 GB ext3 cache partitions for /var/cache/mock and /var/cache/yum configured for these purposes. For as little as 4 weeks the drive began to complain about bad blocks, I/O errors and file system panics. So I returned the faulty drive and got a new one. After additional 5 weeks the new drive also broke down. After return I got my money back and inserted the old Hitachi 60 GB hard disk drive - and it still works up to today. I waited 2 years in the hope that MLC SSH Flash technology will become more advanced to get along with intensive write usage. My new X220t was eqipped with an Intel 510 ( http://ark.intel.com/de/products/56577/Intel-SSD-510-Series-(250GB-2_5in-SATA-6Gbs-34nm-MLC)) with 250 Gbyte with very fast 500MB/s read and 315MB/s write rate. You see? And as the drive was quicker I had the chance to destroy it quicker - in only two weeks! How I did it? With the power of a 2.7 GHz Core i7 and the extremly fast drive I refreshed (recompiled) my complete packages in my repository against the updated RHEL versions 5.7 and 6.1 for 32 and 64 Bit and I also set up a full featured Gentoo System (from source). As I was looking for a compilation error I saw that the file system was remounted read-only. After calling 'dmesg': surprise! Trying to reinstall the operating systems also showed that the drive was also broken. I switched to a Samsung 500 GB (5400 rpm) HDD and I am more happy with it although it is drastically slower. I will give the next try to the year 2015 (doubling the waiting time).

BS - 20. 11. 2011


Impressive - The Long Night of Sciences

Figure: left: The VolksBot robot at the LNdW
right: Slam visualization in 3D
Image lndw2011_1 Image lndw2011_2

The Lange Nacht der Wissenschaften (Long Night of Sciences) Event take place every year in Berlin and Potsdam (the captital of Brandenburg) (http://www.langenachtderwissenschaften.de/). At this year at 28th of May our laboratory (http://labor.beuth-hochschule.de/pst/pst-profil/) and the laboratory for automatisation technology (http://labor.beuth-hochschule.de/lat/) presented the VolksBot in the PlayerStage configuration [*] and we explained the Player and Stage concept. Cause of preparing very late the colleague from the automatisation lab and I had to code a lot and so the day before we hacked late into the night until we got down. But at the presentation day we got the system running nearly perfectly. The robot is now able to do simultaneous localization and mapping (SLAM) (http://en.wikipedia.org/wiki/Simultaneous_localization_and_mapping) and to visualize the map in 3D (https://ziyan.info/2009/05/slam-visualization-for-player-final-report/) using the Iterative Closest Point (ICP) algorithm (http://en.wikipedia.org/wiki/Iterative_Closest_Point) on scan matching with the range finder to improve the position data. The client software (a high-level program, which does the things what we want) has now replaced my Master Thesis custom software which did the same things, but without the generalized Player/Stage model. It's now able to run on other robots using the Player interface. Player/Stage will be the underlaying development platform for our laboratory exercises in the Autonomous Mobile Systems (AMS) lessons from now on in the Embedded Systems Master study path.

BS - 30. 05. 2011

FOSDEM - Open Source Developer's European Meeting

Figure: CentOS Booth at FOSDEM 2011 with a lot of promotion stuff
Image centos_fosdem2011

FOSDEM (http://www.fosdem.org) is the biggest European meeting for Open Source developers, which take place in Brussels every year on one weekend. At the Friday there is a big beer event near the Grand Place by tradition. Since I like CentOS (http://www.centos.org) Linux (because it's free and it's stable) I began to develop on it and for it. I got in touch with some developers on the LinuxTag 2007 in Berlin (http://www.linuxtag.org) - and it was more like a party and I got real good friends. CentOS is not only a Linux distribution - it's a clan!
I decided to come to the big meeting and to have a talk about distributed rebuilding of RPMs on a cluster with a nice dependency resolving calculator that generates a source package build order before any build is started. On 4th of February 2011 I traveled to Brussels together with a friend of the TU-Berlin (http://www.tu-berlin.de). Brussels have a lot of nice pubs with an atmosphere of comfort and there is no comparision between these ones in Berlin. It's great! On the beer event I got in touch with other four nice CentOS guys and one of Debian who also lived in our hotel room. The Day 1 of FOSDEM was more like selling T-shirts and respond to the same question every time: "When will be CentOS-6 released?". On Day 2 I lectured my talk which can also be downloaded here: http://public.beuth-hochschule.de/~bschueler/dyn/files/Distributed_Compilation_of_RPMs.pdf. The Event schedule is at http://www.fosdem.org/2011/schedule/event/distro_compilation. I was very impressed of Brussels and my TU friend was wondering about of why I was looking so interestingly (for him it was nothing special because he was in Brussels so often). Some of photos I've takean can be found at https://picasaweb.google.com/brisch1982/Fosdem2011

Blogs of my CentOS friends - it's interesting:
http://www.ribalba.de
http://www.lestighaniker.de
http://www.arrfab.net
http://www.karan.org
http://dag.wieers.com

BS - 11. 02. 2011

Visualized - My embedded systems SVN repository

Figure: Gource visualizes the actions on a SVN repository done over the time
Image gource

To work efficiently from differnet places I decided to use a versioning control system in my study time about 2006 (but also because of blackouts of the university's data center). At my internship at GFaI (http://www.gfai.de) I got in touch with subversion (http://subversion.tigris.org) and worked in a team and really appreciated this tool. To keep backups, to keep track of the versions on the different work places and not to lose any data I used SVN for my diploma or master thesisses and I checked out copies (also with full automatic snapshots) to all my computers including my (Linux-based) video recorder. I also heared of people who kept their diploma thesis only on one laptop on which the harddisk broke.
For my hobby projects on embedded systems I also created an SVN repository for the different devices and tools (WRT54g, NSLU2, HTC-msm, Sheevaplug, JTAG configurations, data sheet collections, offline Wikis, and so on) and it grew up to over 4 Gigabytes (including some binary stuff). (This is a critical size and it becomes slow so I have to split it now.) To show what and when happend on each subdirectory at over the time there is an awesome tool called gource (http://code.google.com/p/gource/) to visualize these events. The gource package with SVN support for CentOS-5 is available on my BS yum repository.

BS - 04. 12. 2010

Player/Stage - Common robot interface and simulator

Figure: Volksbot (left) with differential drive and laser range scanner - and its virtual model in stage (right)
Image volksbot Image volksbot-stage

William Shakespeare once said that "All the world's a stage, And all the men and women merely players." (http://en.wikipedia.org/wiki/All_the_world%27s_a_stage)
This is the motto of the two projects Player and Stage (http://playerstage.sourceforge.net/) - where player is an abstracted common interface to any (real or simulated) mobile robot ("the player") which acts more like a network service daemon providing interfaces to the robots' components (i.e. steering control, odometric data, laser range finder, sonar and bumpers). Stage is a simulated world ("the stage") where a model of a landmap and of robots can be put in. The behaviour of a real robot can be nearly modelled in Stage. A control program (i.e. autonomous navigation) acting as a client for Player can be used to steer the robot through the world bypassing obstacles. If the simulation is good enough the same client code can be moved to a real robot without modification.
The mobile robots in our laboratory are based on the VolksBot (http://www.volksbot.de) designed by the Fraunhofer Institute for Intelligent Analysis and Information Systems (IAIS) (http://www.iais.fraunhofer.de). They were normally designed to put a laptop on it, but here mini ITX motherboards (with WiFi, RS232 and USB) are used as the robot's 'brain'. They run CentOS-5 Linux and Player 3.1. A nice guy (recently got master graduate) employed at the laboratory for automation (who I visit in his lab sometimes after work) made a patch for Player to get the motor controller driver working and to improve parts of the Kalman filtering. I was moddeling the robot for the Stage simulator and did the RPM packaging.
Our robots are now Player aware and do not need custom software anymore. (Damn, my master thesis is such a custom software but very nice and impressive.)

BS - 05. 11. 2010

ISSE 2010 - Informatics Security Conference GI-Sicherheit

Figure: Me at presenting a demonstration of the MinixWall
Image isse2010-a Image isse2010-b

ISSE 2010 (http://www.isse.eu.com) was a informatics security conference which took place in Berlin from 5th to 7th of October 2010. It was very nice getting in touch with security experts from around the globe. The keynote was discoursed by the German Federal Minister of Interior - Thomas de Maizière. My diploma thesis supervisor Dr. R. Weis (http://public.beuth-hochschule.de/~rweis/) and I presented "Secure and Reliable firewall systems based on Minix 3" in a talk with a following live demonstration - and it was impressive. A Canadian exhibitor of a process control system company, who had nice Ethernet based embedded control nodes on his booth, consideres to use MinixWall and replacing the Linux firmware on these devices. The most of the tracks and talks were very interesting and there were a lot of new things to learn about.

BS - 07. 10. 2010

Roof party - Beuth gets WiFi link to freifunk.net

Figure: Freifunk.net is a non-commercial cummunity WiFi network - image: Ubiquity NanoStation2 Loco with Freifunk firmware
Image freifunk

It was cloudy, windy, but nice and with a fantastic view of Berlin. We - "the Wedding$^1$ pirates" - a little hacker$^2$ group met with Dr. Weis to establish a node of the Freifunk wireless network at the University of Applied Sciences Berlin.

Figure: South view of Berlin seen from the roof of Grashof building
Image berlin-view-south

On a pole on the top of Grashof Building (sorry, I don't know the height now) two NanoStation2 (directional WiFi radios in a 26x8x3 cm white box) equipped with the newest Freifunk firmware (OpenWRT-based with DHCP, routing metric, RDF, OpenVPN and much more) are mounted there. There are two stable radio links to Segenskirche (3.5 km) and Koloniestrasse (2.5 km). After I was done with crimping and connecting ethernet cables I scanned for WiFi networks with a sensitive 802.11b/g USB WiFi radio (Realtek RTL8192) and got up to 26 networks at one go.

Figure: Left: The pole with two mounted NanoStation2 and a flat directional antenna
Right: A huge list of wireless networks in the sourrounding
Image wifi-pole Image wifi-list

The ethernet cables of the NanoStations go into a room where they are attached to the fixed LAN with a PoE supply. Afaik a third link to south-west is planned, so there will be a next roof party :-)

$^1$ Marriage? Here - Wedding is a district of Berlin
$^2$ Not in terms of crackers

BS - 10. 09. 2010

Icecream/mock - Compiling software on a cluster

Image mockbuild

Icecream (http://old-en.opensuse.org/Icecream) is a powerful and flexible distributed compiler daemon for spreading compile jobs to computers on a local network. Instead of distcc, icecream does not require that the same Linux distribution / the same gcc version is installed on all cluster members. The icecc scheduler distributes the compiler binary from the issuer to all other members, which is then held in a cache.
Mock (http://fedoraproject.org/wiki/Projects/Mock) is a system to compile RPMs in a clean chroot (mostly used by distributions like RHEL and Fedora) which I configured to set up icecc as default compiler after buildjail initialization. The %{smp_mflags}=-j$n$ macro must be set to the number of all CPU cores of all members. In the lab I have 22 dual-core PCs running Linux - so I can distribute up to 44 jobs working simultaneosly. The parallelization and synchronization of source code (with dependencies) is done by 'make' with the '-j' option or some other build tools (i.e cmake). As more software has to be compiled as more the fun rises:

Figure: Left: Icecream monitor in star view - Right: Icecream monitor in gantt chart view
Image icemon-star Image icemon-gantt

At home I have Qemu-arm (running on a 2GHz machine), a SheevaPlug (1.2 GHz), an HTC Touch Pro (528 MHz) and Desire (1 GHz) that also joins a cloud to compile up to 4 jobs for the ARM platform. The mobile phones are running CentOS-5 for ARMv5tel which are chrooted via ConnectBot on a SD card partition. (Android phones must be rooted to do so.) The Sheeva is running Ubuntu.
Iceccd, icecream-monitor and mock-0.9.19 configured for icecc / ccache are available for CentOS-5 on the BS yum repository.

BS - 03. 09. 2010

JTAG - the Swiss army knife for hardware debugging

Figure: Cross debugging with mixed source code/assembler
Image debug-screenshot

JTAG is a synonym to that standard which is defined as IEEE 1149.1 Formally designed for boundary scan the standard has been extended for in-curcuit programming and debugging. For more informaton see http://en.wikipedia.org/wiki/JTAG. I got in touch with it when I've done handicrafts on my Linksys NSLU2 USB NAS Server. As I tried to boot my custom Linux kernel via the kexec mechanism (http://en.wikipedia.org/wiki/Kexec) the disaster happened - the kernel ran amok and overwrote parts of the Flash memory (including the bootloader). The device was bricked! This is a situation in which the device is unable to boot. Many modern embedded CPUs are equipped with an in-circuit programming and debugging interface so I decided to buy a low-cost JTAG-USB dongle and got the NSLU2 reflashed and working with the urjtag tool (http://www.urjtag.org).
After setting up an ARM cross-toolchain I'm able to debug the embedded software (the Linux kernel itself and user processes) with the Open On-Chip debugger OpenOCD http://openocd.berlios.de/web/ and the Data Display Debuger 'ddd' (http://www.gnu.org/software/ddd/).
GNU cross-toolchains {arm,mipsel}-redhat-linux, openocd and urjtag as well as flash tools like upslug2 and uboot-mkimage are available as RPMs for CentOS-5 on my Yum repository at http://repo1.pst.beuth-hochschule.de/repo/bs/el5.

WARNING!!! I'm not responsible for any hardware damages that may occur in conjunction with software from the repository. Use at your own risk!

BS - 31. 08. 2010

MinixWall - becoming an enterprise firewall solution?

Figure: MinixWall is a port of Linux Netfilter/Iptables firewall running on Minix-3
Image minixwall

MinixWall (http://wiki.beuth-hochschule.de/~minixwall) - the project that envolved off my diploma thesis in June 2007 gets slowly but steady more important for mission critical network infrastructures - thanks to the sophisticated design of Minix-3. In the gap between my diploma finalization and my Masters study I worked at GFaI (http://www.gfai.de) and submitted this project to a talent contest which is performed every year at there.
"And the winner is ......... " :-)
My supervisor Dr. R. Weis - himself an graduate of A. S. Tanenbaum - presented MinixWall at the Hacking at Random (HAR2009) congress (http://secdocs.lonerunners.net/documents/details/1434-minixwall). In 2010 a research project was founded for porting Minix-3 to embedded router platforms and to virtualize hundreds of Minix instances on Linux-based Servers running Xen or the Kernel Virtual Machine (KVM). The researcher's work was presented at the 'Lange Nacht der Wissenschaften 2010' (long night of sciences).

- Project description in German: http://www.beuth-hochschule.de/fileadmin/oe/tt/Forschungsassistenz/Forschungsassistenz_05/tt_fa_05_flemming-bergmann.pdf
- A final paper written by Dr. Weis and the researcher S. Flemming: http://public.beuth-hochschule.de/~rweis/WeisSchuelerFlemmingMinixWallSicherheit2010.pdf

A presentation with a live demo is called for October 2010 at a German security conference by Dr. Weis and me as speakers. I'm curious about it!

BS - 30. 08. 2010

Resources



bschueler@beuth-hochschule.de