Jump to content

Amazon Echo Spot 2017 (amazon-rook)

From postmarketOS Wiki
Amazon Echo Spot (2017)
Amazon Echo Spot (2017 release)
Amazon Echo Spot (2017 release)
Manufacturer Amazon
Name Echo Spot (2017)
Codename amazon-rook
Model VN94DQ
Released 2017
Type embedded
Hardware
Chipset MediaTek MT8163
CPU Quad-core 1.3 GHz Cortex-A53
GPU Mali-T720
Display 480x480 IPS LCD
Storage 8 GB
Memory 2 GB
Architecture aarch64
Software
Original software
The software and version the device was shipped with.
FireOS 5
Extended version
The most recent supported version from the manufacturer.
FireOS 5
FOSS bootloader no
postmarketOS
Category testing
Mainline
Instead of a Linux kernel fork, it is possible to run (Close to) Mainline.
yes
Unixbench score
Unixbench Whetstone/Dhrystone score. See Unixbench.
1266.1
Features
Flashing
It is possible to flash the device with pmbootstrap flasher.
Works
USB Networking
After connecting the device with USB to your PC, you can connect to it via telnet (initramfs) or SSH (booted system).
Works
Internal storage
eMMC, SD cards, UFS, ...
Works
Screen
Display works. Ideally with sleep mode and brightness control.
Partial
Touchscreen
Works
Multimedia
3D Acceleration
Works
Audio
Audio playback, microphone, headset and buttons.
Broken
Camera
Broken
Connectivity
WiFi
Works
Bluetooth
Broken
GPS
Broken
Miscellaneous
FDE
Full disk encryption and unlocking with unl0kr.
Broken

Users owning this device

  • Bengris32 (Notes: 3x, Unlocked with amonet, attempting to mainline)
  • ItsVixano
  • R0rt1z2 (Notes: Unlocked with amonet, UART wires soldered)


Contributors

  • R0rt1z2
  • bengris32
  • itsVixano

How to enter flash mode

You need to unlock the bootloader using amonet: https://xdaforums.com/t/unlock-root-twrp-unbrick-amazon-echo-spot-2017-rook.4754878/

The unlock provides a hacked fastboot mode, which is the one you must use for flashing. Stock fastboot will remain locked because of how the exploit works.

To access hacked fastboot mode, you have two options:

  • Run the boot-fastboot.sh script from the amonet package.
  • Hold all three buttons at the same time while booting, but ONLY AFTER the Amazon logo appears (not before).

To access TWRP / recovery mode, you can either:

  • Run the boot-recovery.sh script from the amonet package.
  • Press and hold Volume - and Mute while turning on the device.

As long as STOCK (NOT HACKED) fastboot mode is accessible (by holding all three buttons while booting), you can enter bootrom by running the brick.sh script again, then re-run bootrom-step.sh to unbrick the device.

If fastboot mode isn't accessible and the device is bricked, YOU'LL NEED TO OPEN IT UP and short CLK to unbrick the device.

Note NOTE: The general rule is to flash boot and recovery images to the boot_x and recovery_x partitions, since the original partitions contain the exploit. However, hacked fastboot mode and TWRP handle the remapping automatically, so you can safely flash to boot or recovery instead in these two modes.

Status

Feature Components Status Notes
USB MediaTek USB Controller1 Y Working in mainline
eMMC MediaTek MSDC1 Y Working in mainline
Display MediaTek DRM1

MediaTek DSI1

N Any writes to DSI registers causes the system to hang. Using simpledrm for now.
GPU ARM Mali-T7201 Y Working with Panfrost
UART MediaTek UART1

APDMA1

Y Working with APDMA support
I2C MediaTek I2C1 Y Working in mainline
SPI MediaTek SPI1 P Untested in mainline
Power MediaTek SCPSYS1

MediaTek PWRAP1 MediaTek MT6323

Y SCPSYS and PWRAP with MT6323 PMIC working
Clocks MediaTek Clock Controller1

MediaTek FHCTL1

P Missing details of a few clocks

Frequency Hopping (FHCTL) requires work

Pin Control / EINT MediaTek Pinctrl1 Y Working in mainline
SMP ARM Cortex CPU cores1 P Requires downstream hacks on old ATF. High chance of random kernel panics and hangs when it's enabled, but it seems to work fine on the rare few boots that it decides to.
Watchdog MediaTek WDT1 Y Working in mainline
IOMMU MediaTek IOMMU1 N Possibly broken
USB Wi-Fi BCM43566 Y Working with brcmfmac driver. Though, trying to use it with onboard_usb_dev causes a kernel panic.
Front Camera

MediaTek IMGSYS1

N

1: Part of SoC

UART

UART access is available through the TM3 pad (RX). By default, kernel logs are not displayed to UART since this is disabled by LK. The baud rate is 921600.

However, with the exploit installed, you can forcefully enable them by flashing a custom MISC image. You can generate (and flash) this image using the following command(s):

dd if=/dev/zero of=misc-uart.bin bs=1 count=32
echo -ne "UART_PLEASE" | dd of=misc-uart.bin bs=1 seek=16 conv=notrunc
fastboot flash MISC misc-uart.bin

Installation

See also