This is an old revision of the document!
Table of Contents
Polycom Pano Hax
Bringing Linux and Other Operating Systems to the Polycom Pano.
Work in progress, no end-user guide yet!
Hardware
Jetson TX1 module + Polycom carrier board.
TX1
Stock module, probably 4GiB LPDDR4 and 16GB eMMC?
I/O
| Port | Description |
|---|---|
| 2x GbE | 1x PoE, in wired to on-board USB3-ethernet adapter, 1x Non-PoE port wired directly to TX1-internal USB3-ethernet adapter |
| 2x USB | USB A 2.0 (OTG, upper) + USB A Super Speed |
| HDMI Out | Directly from TX1 |
| HDMI In | Through ??? under a metal can. |
| DC In | 5.5×2.5(?), Labeled 54VDC, runs from 36VDC min. |
| WiFi? Antenna | Built-in Jetson TX1 2.4 + 5G WIFI + Bluetooth radio |
| Button | Capacitive touch + RGB indicator LED |
| Header | Description |
|---|---|
| SW1102 RECOVERY | Internal RCM button |
| SW1101 RESET | Internal SoC Reset button |
| J901 SERIAL | Pinout: 1.8V, TX, GND, RX. Mind the logic 1.8V levels! 1.8V line dips when RESET button is pushed down. |
| TP1201 | Unmarked 12V DC rail test point (between AON_P5VO and T1502 transformer), can be used to power up the device directly (bypasses PoE/DC IN circuit), boots from ~11V DC |
Stock Software
It's running highly customized Android.
Serial port exposes password prompt. Unencrypted update bundle from Polycom/HPE reveals default password: EyZeBuYTQ - this should land a user shell, from which su just gets you root access.
“Devfeatures” (disabled iptables firewall, enabled adb, disabled serial password, enabled telnet I think) can be enabled via fw_setenv devfeatures true. fw_printenv can be used to check current environment variables.
Jetson TX1 is SecureBoot/Production-fused. Standard CBoot (first-stage bootloader) is unlocked ie. it does not do any signature verification over loaded boot partition or the operating system altogether.
Flashing
Fastboot
Flashing is possible via Fastboot (implemented in cboot) over USB-A 2.0 connector (via cursed USB A-A or USB A-C connector). In order to enter Fastboot you can either:
reboot bootloaderfrom Android firmware- Use customized fusee-launcher with
force_fastboot.binpayload:./fusee-launcher.py -w -V 0x0955 -P 0x7721 force_fastboot.bin
QUIRK: Fastboot tends to crash/reset whenever HDMI Out is not connected to any display lmao.
RCM/TegraFlash
Alternative: tegraflash.py from L4T BSP. NOTE: Latest L4T tooling doesn't really seem to work very well. Use R24.2.3. As –bl use cboot from our device (mmcblk0p4).
./fusee-launcher.py -w -V 0x0955 -P 0x7721 ipatch_rcm_sample.bin python3 tegraflash.py --bl mmcblk0p4.img --applet nvtboot_recovery.bin --chip 0x21 --cmd "read DTB dtb-extracted.bin"
Booting Linux
Mainline U-Boot (d0615e4a67c commit tested) with p2371-2180_defconfig can be flashed over boot (mmcblk0p18) partition.
CROSS_COMPILE=aarch64-unknown-linux-gnu- make V=1 && \ mkbootimg --kernel u-boot.bin --pagesize 4096 --base 0x10008000 --output u-boot.aimg && \ fastboot flash boot u-boot.aimg && \ fastboot reboot