Amazon Echo Dot 2nd gen (amazon-biscuit)

From postmarketOS
Amazon Echo Dot (2nd gen)
Second generation Echo Dot
Second generation Echo Dot
Manufacturer Amazon
Name Echo Dot (2nd gen)
Codename amazon-biscuit
Model RS03QR
Released 2016
Category testing
Pre-built images no
Original software Android
Original version 5.1 (FireOS 5.5)
postmarketOS kernel 3.18.19
Hardware
Chipset MediaTek MT8163
CPU Quad-core 1.3 GHz Cortex-A53
Storage 4 GB
Memory 512 MB
Architecture ARMv7
Type embedded
Features
USB Networking
Works
Flashing
Works
WiFi
FDE
Broken
Mainline
Audio
Bluetooth
Internal storage
Works
USB OTG
Sensors
Ambient Light
Misc
FOSS bootloader
Broken


Contributors

  • BenTheTechGuy

Users owning this device

  • BenTheTechGuy (Notes: Improving port)
  • Dragon863 (Notes: creator of EchoCLI, investigating untethered)
  • Neko (Notes: Stock, for now)


How to unlock the bootloader

  • Install mtkclient and ensure adb and fastboot are installed.
  • Install Python modules flask, requests, and pyserial.
  • Disable ModemManager if it is installed.
  • Clone the EchoCLI repo.
  • Take apart the Echo Dot following this iFixIt guide.
  • Remove the IO shield to expose the components in this image. Get ready to short the components outlined in the rectangle to ground.
  • Run python main.py and follow the instructions to root the device, shorting the outlined components when instructed.
  • Verify that the root succeeded by running adb shell to get a root shell.
  • If successful, put the Echo Dot back together. The device will now automatically boot to the required BootROM mode as its Preloader is purposefully broken.
  • There will be a new file preloader_no_hdr.bin. Put it somewhere safe, because it is now required to boot the device.
  • The device can be booted from BootROM by running mtk plstage --preloader=preloader_no_hdr.bin.

How to enter flash mode

Plug the device in and run mtk plstage --preloader=preloader_no_hdr.bin while holding the Uber (circle) button. Release it when the LED ring turns green.

Installation

  • pmbootstrap init
  • pmbootstrap install
  • Select 'console' as UI since the device has no screen
  • Follow #How to enter flash mode to enter fastboot
  • pmbootstrap flasher flash_kernel
  • pmbootstrap flasher flash_rootfs
  • The largest partition on the device is only 1.8 GB. If more space is needed, use netboot instead of flashing rootfs.

Port status

What works:

  • USB Networking
  • Control of the LED ring
  • Button press detection

What doesn't work:

  • WiFi
  • Bluetooth
  • Speakers
  • Microphone
  • Ambient Light Sensor

LEDs

The current state of the LED ring is described in the file /sys/bus/i2c/devices/0-003f/frame as a series of 12 hex color codes. It can be written to in the same format to change the color. For example, to make the whole ring red (#FF0000), the command echo "ff0000ff0000ff0000ff0000ff0000ff0000ff0000ff0000ff0000ff0000ff0000ff0000" > /sys/bus/i2c/devices/0-003f/frame could be run.

This script is an example of running a basic animation. It spins a green (#00FF00) segment around the LED ring.

#!/bin/ash

frame="00ff00000000000000000000000000000000000000000000000000000000000000000000"
echo "$frame" > /sys/bus/i2c/devices/0-003f/frame
sleep 0.1

for ((i=1; ;++i)); do
	# Shift green LED over one space by adding a black "pixel"; since there
	# are 12 LEDs, add a green pixel instead on every 12th run of the loop.
	if [ $(( i % 12 )) -eq 0 ]; then
		shift="00ff00"
	else
		shift="000000"
	fi

	# Truncate string to only include 12 color codes
	frame=$(echo "${shift}${frame}" | cut -c -72)
	echo "$frame" > /sys/bus/i2c/devices/0-003f/frame
	sleep 0.1
done

The file /sys/bus/i2c/devices/0-003f/boot_animation is used to enable or disable the Echo Dot's built-in boot animation. By default, it stays on after boot, but this port includes init scripts to replace it with a rainbow ring when boot is finished, and put it back during shutdown.

Buttons

The kernel provides evdevs for all of the buttons on the Echo Dot. /dev/input/event1 handles the Uber button as well as the mute button, and /dev/input/event2 handles the volume buttons. In addition to event code 1 for pressing a button and 0 for releasing it, the volume buttons also have a code 2 for when they're being held down.

The LED on the mute button can be enabled with the files /sys/devices/soc/10010000.keypad/amz_privacy/enable or /sys/devices/soc/10010000.keypad/amz_privacy/privacy_trigger. This also mutes the microphone, as if the button was physically pressed. The mute cannot be undone in software; the button must be manually pressed. The mute status is available in /sys/devices/soc/10010000.keypad/amz_privacy/privacy_state.

See also