[Q] Nook Color ULPI transceiver/internal modem - Nook Color General

Hi!
As a new member, I cannot post to developer section, so I try to ask this question here. Nook Color PCB contains solder pads for Sierra SL808x AirPrime 3G module (probably non-GPS versions - GPS antenna pin is not used), connected to OMAP ULPI port probably via TUSB1211 ULPI transceiver (absent 36 pin TFBGA chip near flash disk chip - PCB pinout seems to be identical to TUSB1211 pinout). I will try to order several transceivers, solder one and several required SMD decoupling caps (I have experience in BGA rework and soldering, so I hope this task will be not so tricky) and try to get this internal USB working. The question is simple - have someone trying this hardware hack already? Is the last CM7 kernel able to support additional integrated OMAP 3621 ULPI port or such hack needs research and kernel/ULPI module patching?
Thank you in advance, Gleb.
P.S.: sorry for my bad english - I'm more a reader, than a writer.

Related

Someone Please Help - iGPS Wiring

Hey everyone, I'm trying to Wire a iGPS-180 for my SX56... the original wiring was for an iPAQ 3100-3700... I've got the pinouts for the SX56 but I was wondering if anyone knew what the pinout for an iPAQ 3100-3700 were? I'm tying to trace these wires so I know which one is which because the color codes given in another post do not match what I have.
Thanks,
MMC
One more thing... when I plug everything in and try to Enable GPS it gives me a communication error and says that in can't open communication port... I'm using OSTIA 3.25, Do I need a higher version?
Go to settings/connections and uncheck "beams" if it is checked you will have no com1 port which is the port the wired gps wants to use, also if you have a keyboard driver present you will need to disable the driver.
You're a frickn' Genius!!!! You just solved 24 hours of head scratching
THANKYOU!!!

Tilt communication with an Arduino?

Hey all,
I was wondering if it is possible to communicate with an Arduino with a Tilt through the Tilt's USB port? I've just gotten into device application development and I had a cool idea I was wanting to make but the biggest hurdle is how to communicate between the Arduino microcontroller and the Tilt.
For those that don't know what an Arduino is (I feel sorry for you ), it is a microcontroller platform based off of the AVR Atmel168 processor. The version I've got on hand right now is a Seeeduino that has a mini-USB port on-board communicating to the Atmel168 through an FTDI USB-Serial chip (shows up as a serial port when plugged into the computer). It would be great if the Arduino showed up as a new serial port on the phone when plugged in, but I doubt it will be that easy. Does anyone know if the Tilt/Kaiser USB port can host other devices?
If anyone has a suggestion or has tried something like this, please comment. Or if I'm just crazy for thinking the phone can do this, tell me so.
Thanks all!
-Jeremy
USB drivers
Im not sure how much this could help, but it may get you off to a good start http://forum.xda-developers.com/showthread.php?t=480899
i noticed it said serial port in there somewhere, so i hope it helps!
You can have a try with the drivers mentioned above. If this fails, hook a Bluetooth module to your Arduino and forget about wires
When I was waiting for a haircut today, I was fiddling in the task manager and looked at the devices tab. Just thought I'd run these by you all:
Com 8: serialusbfn.dll (\Drivers\USB\FunctionDrivers\Serial_Class)
Com 9: Serial_UART.dll (Drivers\BuiltIn\SERIAL_UART3)
I haved searched around or messed with these yet but what in the world could com 8 be being used for right now?
-Jeremy
P.S. I did see that link and that will be the next thing I'll try, Thanks!
AFAIK there are some internal peripherals that are connected to the main processor through serial ports. That might be those.
Use I2C - you can get at it through the DS2746... when looking at the PCB on the side with all of the metal-enclosed areas, it's on the left, and towards the bottom (IIRC)... should be able to run 4 wires (get a ribbon cable) out the bottom (into the battery compartment)...
I've been considering this seriously... I2C is a damn useful bus, and it's underused in this device (only battery chip, touch screen, and camera control, AFAIK)....
The bus itself is two wires - SDA (data) and SCL (clock), and you'll also need +5v and ground.
Would be nice to hook up a spare ds1621 (you can get these as free samples) or a compass/accelerometer chip

tools needed to unbrick G1

Hey guys,
Im looking to unbrick my G1 (no bootloader). I have asked some questions previously but haven't had the time to do anything besides that up to now.
I haven't had any luck here in India locating what I need with confidence, but today I happened across a helpful website.
Could anyone tell me if this is what Im looking for?
wiggler-clone
robokits.co.in/shop/index.php?main_page=product_info&cPath=12&products_id=240
pc-serial
robokits.co.in/shop/index.php?main_page=product_info&cPath=6_64&products_id=64
The wiggler look-a-like says its compatible with GCC OCD.
The pc-serial page offers a driver under the name of pl230.
I am hoping to be able to follow the unbrick page here: wiki.cyanogenmod.com/index.php?title=JTAG_for_Dream/Magic
Thanks
The unbrick process originated on this forum and was really moved along by member ezterry. You really ought to read the threads here in the dev section about this. They do tend to be long, but there is every bit of information you could possibly want to know about unbricking a dream.
http://forum.xda-developers.com/showpost.php?p=5911627&postcount=302
http://forum.xda-developers.com/showpost.php?p=5934885&postcount=6
thanks for the links. i am currently working through the multitude of posts.
Hey,
I am learning a lot and have what i think is my last issue before i order some parts. The pc-serial cable should be at 2.8 v but i only have access to converters that give 5 v output.
I first consulted the datasheet for the pl2303hx (link provided above) which states:
"RS-232 VDD. The RS-232 output signals (Pin 1 ~ Pin 3) are
designed for 5V, 3.3V or 3V operation. VDD_232 should be
connected to the same power level of the RS-232 interface.
(The RS-232 input signals are always 5V~3V tolerant.)"
which was a little confusing, so i consulted the vendor:
"It will output 5V if the jumper is shorted or else it will be 0V. But the unit is self powered and can accept 3.3V input and output levels.
which is self contradictory. but, from what i gather, the serial output will be the same as the usb input.
Lastly, from this google group discussion:
groups.google.com/group/android-platform/msg/bf66abf4515132fb
Someone states that they used an lm317 circuit to drop voltage to 2.8, and it seems like this is the route ill take.
Question is, which voltage do i control? I think if i drop usb vcc voltage i should be good?
I think i just going to buy it and see, whats 400 INR anyways (its like 8 bucks)
salsavirdi said:
"RS-232 VDD. The RS-232 output signals (Pin 1 ~ Pin 3) are
designed for 5V, 3.3V or 3V operation. VDD_232 should be
connected to the same power level of the RS-232 interface.
(The RS-232 input signals are always 5V~3V tolerant.)"
Click to expand...
Click to collapse
If you can't understand that, then you should find someone to assist you who does.
I suppose im being a overly paranoid, and would like some corroboration. Id really hate to fry my phone, im rather attached to it.

Kindle Fire HD 7" eMMC access

Hi all, following on from kurohyou's excellent work on the KF2, I thought I would go about trying to develop a tutorial for unbricking a hardbricked Kindle Fire HD 7". This would be for the 2012 model, NOT the 2013.
A little bit of background on myself. I have always had a keen interest in electronics and studied microelectronics at college. I am pretty good at soldering etc even on small SMD devices, even more so now I have spent out on some decent kit (helping hands, rework station etc). Now I have decided to carry out this project as a summer hobby and hopefully I will get some support from you guys.
I have managed to piece together enough information that I think will enable me to complete this tutorial, with the exception of Linux, something that I am very new to and would need some assistance with.
I have seen common names among the forums when it comes to this type of subject, stunts513, soupmagnet, hashcode to name a few. I am hoping with the assistance of these members I can complete a comprehensive guide on unbricking a Kindle Fire HD 7", similar to http://forum.xda-developers.com/showthread.php?t=2415870
But please beware, IF YOU HAVE ANYTHING OTHER THAN A KINDLE FIRE HD 7" DO NOT USE THIS GUIDE!!
My main goal is to acquire a dead Kindle Fire HD 7" motherboard, as easily as possible. Unfortunately looking on eBay there seem to be very few from the UK and they are normally very expensive. I will keep looking but if anyone is willing to donate a non working or working motherboard for this cause I would be very grateful, just PM me if you can help. Just bear in mind due to the process it needs to go through, you will not get a working motherboard back, should you want it returned.
I aim to completely remove the eMMC from the motherboard and get exact pinout locations, as kurohyou did with his excellent KF2 guide. I will then use the same USB SD Card adaptor to see if the eMMC can even be read in the same way as the KF2. I have working knowledge of GParted in linux so I will also be using this to verify partition layouts and sizes. Once I have had any success in doing this I will update this post to reflect my progress.
There is my plan so far, if this has already been done, someone please tell me as I cannot find it anywhere.
overlode said:
Hi all, following on from kurohyou's excellent work on the KF2, I thought I would go about trying to develop a tutorial for unbricking a hardbricked Kindle Fire HD 7". This would be for the 2012 model, NOT the 2013.
A little bit of background on myself. I have always had a keen interest in electronics and studied microelectronics at college. I am pretty good at soldering etc even on small SMD devices, even more so now I have spent out on some decent kit (helping hands, rework station etc). Now I have decided to carry out this project as a summer hobby and hopefully I will get some support from you guys.
I have managed to piece together enough information that I think will enable me to complete this tutorial, with the exception of Linux, something that I am very new to and would need some assistance with.
I have seen common names among the forums when it comes to this type of subject, stunts513, soupmagnet, hashcode to name a few. I am hoping with the assistance of these members I can complete a comprehensive guide on unbricking a Kindle Fire HD 7", similar to http://forum.xda-developers.com/showthread.php?t=2415870
But please beware, IF YOU HAVE ANYTHING OTHER THAN A KINDLE FIRE HD 7" DO NOT USE THIS GUIDE!!
My main goal is to acquire a dead Kindle Fire HD 7" motherboard, as easily as possible. Unfortunately looking on eBay there seem to be very few from the UK and they are normally very expensive. I will keep looking but if anyone is willing to donate a non working or working motherboard for this cause I would be very grateful, just PM me if you can help. Just bear in mind due to the process it needs to go through, you will not get a working motherboard back, should you want it returned.
I aim to completely remove the eMMC from the motherboard and get exact pinout locations, as kurohyou did with his excellent KF2 guide. I will then use the same USB SD Card adaptor to see if the eMMC can even be read in the same way as the KF2. I have working knowledge of GParted in linux so I will also be using this to verify partition layouts and sizes. Once I have had any success in doing this I will update this post to reflect my progress.
There is my plan so far, if this has already been done, someone please tell me as I cannot find it anywhere.
Click to expand...
Click to collapse
Great job,will be useful to a lot of people if successful. And as for the support,we're all here to help ya
A lot of people spend time tinkering with Linux partitions,so getting support won't be as difficult as getting a dead motherboard,which is what worries me now. I would suggest you to buy a Fire HD,root it and leave the rest to your imagination (I would try to flash a Galaxy S3 Kernel using Odin or something )
Anyway,good luck!
I have managed to get myself a cheap Fire HD so just waiting for it to come in the post.As far as I can tell the Fire HD uses a very similar eMMC chip as the Fire 2 so I am hoping the partition structure is the same. If /dev/sdc2 is 256Kb and listed as bootloader then I think it should be straightforward to flash in the same way using the dd command.
Anyway, more updates to come
Update - I have now got a motherboard from a Kindle Fire HD 7", will go ahead and solder USB adaptor in the next few days and see what happens - more details to follow.
Ok, so I have opted to try and use a mini SD card adaptor for this project as it is very easy to kill a USB SD card adaptor if you get just one wiring point wrong, although this does have an increased risk of frying your USB port if you are VERY unlucky.
The SD card is wired like so -
https://www.dropbox.com/s/9zsrbevo97ifccj/SD%20Card%20wiring.JPG?dl=0
I drilled some very small holes close to the end of the mini SD internal connections to add stability to the wires. I used Valery_'s image to get the connection labels -
https://www.dropbox.com/s/fur0gxy72lox6yb/SD%20Card%20pinout.jpg?dl=0
For the VCC and VccQ wires, because there are two paired together it was not going to be possible to fit them into the SD card adaptor so I made a fly lead off of the main VCC wire -
https://www.dropbox.com/s/ocmw7p2dgsp4ia6/VCC%20fly%20lead.JPG?dl=0
Next I will be attempting to solder each wire onto the KFHD7 motherboard.
All done. I haven't cut the tracks that have been indicated in this picture as my PC recognises the eMMC under Windows 8 -
https://www.dropbox.com/s/1lyumxvw5h7agx4/Fire%20HD%20Pinout%20with%20VDDI.jpg?dl=0
So here is the motherboard soldered up -
https://www.dropbox.com/s/n30jpvbyhapoub7/Motherboard%20wiring%20KFHD7.JPG?dl=0
Update - after the eMMC was not recognised by Ubuntu I cut the 2 tracks in question, and still nothing. I am also now getting 0v from the card reader however the laptop still recognises SD cards inserted. I will acquire some more USB SD card adaptors and try again with those. More to follow.
Ok, a little frustrating but after checking and rechecking the solder points on the motherboard they are definitely correct, however Vcc, VccQ and Vss are still casting some doubt in my mind, considering that the VccQ and Vss points are both sides of capacitor 801 (C801). I am not 100% convinced that Vcc, VccQ and Vss have other points on the board. Reading the eMMC specifics here there are lots of Vcc, Vss and VccQ. I am not totally sure if there is a definite one that needs connecting
Any help on this would be much appreciated.
Ok, another post, sorry
Been doing some more research on the eMMC chip and I have found an official data sheet for the chip here
It seems that there are different pins for Vss and Vcc and I am wondering if this is causing the problem as I may be supplying power to the wrong part of the eMMC. Will see if R10 and T10 on the schematic lead to anywhere else and negate the need to cut the tracks, something which I still don't quite fully understand. Edit - R10 (Vss) does not seem to have a place on the board
As you can see from the following table it lists all the necessary locations for applying power to modify the eMMC -
https://www.dropbox.com/s/a7f299p492gf7qe/eMMC%20Pinout.jpg
VDDF is Vcc and VDD is VccQ .
I will check out these two pins later on and see where they lead on the board.
More to follow...
overlode said:
Ok, a little frustrating but after checking and rechecking the solder points on the motherboard they are definitely correct, however Vcc, VccQ and Vss are still casting some doubt in my mind, considering that the VccQ and Vss points are both sides of capacitor 801 (C801). I am not 100% convinced that Vcc, VccQ and Vss have other points on the board. Reading the eMMC specifics here there are lots of Vcc, Vss and VccQ. I am not totally sure if there is a definite one that needs connecting
Any help on this would be much appreciated.
Click to expand...
Click to collapse
http://forum.xda-developers.com/attachment.php?attachmentid=2784284&d=1402079403
http://forum.xda-developers.com/showthread.php?t=2775022
good luck
Valery_ said:
http://forum.xda-developers.com/attachment.php?attachmentid=2784284&d=1402079403
http://forum.xda-developers.com/showthread.php?t=2775022
good luck
Click to expand...
Click to collapse
Ok, I have put your image side by side with your top image and colour coded the points (Just bear in mind the right hand image is a mirror image of the BGA). No matter how I look at it, everything is correct and all Vcc, VccQ and Vss points are interconnected so I do not see how it is not working. Can you explain to me the need for cutting the tracks in your original image and what the version 1 and version 2 mean please?
How have you got on with this? The closest I have been is Windows 8 detecting something but Ubuntu doesn't see anything.
Cheers
overlode said:
Can you explain to me the need for cutting the tracks in your original image and what the version 1 and version 2 mean please?
Click to expand...
Click to collapse
Cutting the tracks had two goals: 1. to decrease power of supply from cardreader, 2. to protect the chips which are supplying 1.8 V
Additionally I used diode Schottky to decrease voltage to 1.6 V
There were impulses CMD and CLK, but there was a problem with signals Data0 - Data3. Level on these pinouts didn't change, was about 1 V
Supposedly the processor blocked Data0..3
I tried to connect cardreader with signal Reset on the motherboard, but there weren't Data0..3
So both in the case with 1.8 V and in the case with 3.3 V on the contact VccQ, there was a voltage about 1 V on Data0..3
I think there is a possibility of access to eMMC if OMAP is blocked and then it will make Data0..3 free (third output state Z)
Valery_ said:
Cutting the tracks had two goals: 1. to decrease power of supply from cardreader, 2. to protect the chips which are supplying 1.8 V
Additionally I used diode Shotky to decrease voltage to 1.6 V
There were impulses CMD and CLK, but there was a problem with signals Data0 - Data3. Level on these pinouts didn't change, was about 1 V
Supposedly the processor blocked Data0..3
I tried to connect cardreader with signal Reset on the motherboard, but there weren't Data0..3
So both in the case with 1.8 V and in the case with 3.3 V on the contact VccQ, there was a voltage about 1 V on Data0..3
I think there is a possibility of access to eMMC if OMAP is blocked and then it will make Data0..3 free (third output state Z)
Click to expand...
Click to collapse
I can't understand why they changed it so radically just for the KFHD 7" as the eMMC on the KF2 and the KFHD 8.9" are both easily accessible. It seems weird how they would use the OMAP to block it just on this model. Looking at the datasheet, are we missing something with VDDI, there is a suggestion to ground it via a 0.1 micro farad capacitor. Any thoughts on this?
VDDi Connections
The VDDi (K2) ball must only be connected to an external capacitor that is connected to VSS. This signal may not be left floating. The capacitor’s specifications and its placement instructions are detailed below.
The capacitor is part of an internal voltage regulator that provides power to the controller.
Caution: Failure to follow the guidelines below, or connecting the VDDi ball to any external signal or power supply, may cause the device to malfunction.
The trace requirements for the VDDi (K2) ball to the capacitor are as follows:
• Resistance: <2 ohm
• Inductance: <5 nH
The capacitor requirements are as follows:
• Capacitance: >=0.1 uF
• Voltage Rating: >=6.3 V
• Dielectric: X7R or X5R
Click to expand...
Click to collapse
Thanks to RolF2 from this post
SanDisk iNAND has three power domains assigned to VCCQ, VCC and VDDi, as shown in Table
10.
Table 10 - Power Domains
Pin Power Domain Comments
Supported voltage ranges:
High Voltage Region: 3.3V (nominal)
VCCQ Host Interface
Low Voltage Region: 1.8V (nominal)
VCC Memory Supported voltage range:
High Voltage Region: 3.3V (nominal)
VDDi Internal VDDi is the internal regulator connection to an
external decoupling capacitor.
Page 25+26 of this document explains it more. Looks like we may only need to ground VDDI with a 0.1uf capacitor. From what I can see on the motherboard all other connections already have capacitors grounding Vcc and VccQ.
Found the connection for VDDI -
https://www.dropbox.com/s/gzk11dywlmxzcmk/Fire%20HD%20Pinout%20with%20VDDI.jpg
overlode said:
Found the connection for VDDI -
https://www.dropbox.com/s/gzk11dywlmxzcmk/Fire%20HD%20Pinout%20with%20VDDI.jpg
Click to expand...
Click to collapse
I think that this will not resolve the problem. Connection of capacitor is strange. But this finding is a plus in the investigation.
Valery_ said:
I think that this will not resolve the problem. Connection of capacitor is strange. But this finding is a plus in the investigation.
Click to expand...
Click to collapse
The thing that confuses me is the fact that there are no other connections to the BGA array that come from a different source, all Vcc, VccQ and Vss connections are linked and already grounded with capacitors so you should be able to apply power to anywhere of these points. The fact that it is stated that this particular chip has 3 power domains, not 2 like the previous chips is encouraging.
As for your comment about the OMAP blocking access to the eMMC I don't think this is the case as the chip is used in a lot of nand flash technologies that do not have any OMAP device paired with them.
As soon as I get my next motherboard I am going to try the VDDI connection, it cannot do any harm as it controls internal voltage to the eMMC.
I will keep digging but I am pretty sure there is nothing more we have missed as I have been over the data sheet again and again.
Ok, I understand VDDI now, you don't need to touch this connection as it is used internally to regulate chip voltage. So back to the drawing board
Ok, I am going to make a simple voltage regulator to go inline with my USB card reader to make sure input voltage to the eMMC is 3.3v as I suspect over voltage may be causing a malfunction within the internal voltage stabiliser circuit of the eMMC. It seems over voltage triggers complete shutdown of the eMMC using internal diodes so this may explain the 1v or less output from the DAT pins.
Valery_, if I make sure input voltage is 3.3v then that would dismiss the need to cut the tracks yes?
Ok, I think this project has to be put on hold again. No matter what I try Ubuntu will not recognise the partitions of the eMMC even though the SD card adaptor flashes and then stops flashing as if being read properly. Connecting to VDDI fries your card reader instantly so do not try this!!
I just cannot see what we are missing and why this motherboard is so different from the KF2 yet not?
There has to be some way to gain access to the eMMC as the chip is so commonly used with other devices.
I will continue this project if I make any break through or if someone finds out something that we may be missing.
For the meantime I will continue with the KF2 unbricking as that is going rather well for me at the moment.
Reserved
overlode said:
Reserved
Click to expand...
Click to collapse
Maybe this information will be useful:
The MAX3002 accept VL voltages from +1.2V to +5.5V and VCC voltages from +1.65V to +5.5V, making them ideal for data transfer between low-voltage ASICs/PLDs and higher voltage systems.
Valery_ said:
Maybe this information will be useful:
The MAX3002 accept VL voltages from +1.2V to +5.5V and VCC voltages from +1.65V to +5.5V, making them ideal for data transfer between low-voltage ASICs/PLDs and higher voltage systems.
Click to expand...
Click to collapse
Isn't this just what we have been supplying though? My simple voltage regulator supplied 3.3v
picture not load
overlode said:
Ok, so I have opted to try and use a mini SD card adaptor for this project as it is very easy to kill a USB SD card adaptor if you get just one wiring point wrong, although this does have an increased risk of frying your USB port if you are VERY unlucky.
The SD card is wired like so -
Update - after the eMMC was not recognised by Ubuntu I cut the 2 tracks in question, and still nothing. I am also now getting 0v from the card reader however the laptop still recognises SD cards inserted. I will acquire some more USB SD card adaptors and try again with those. More to follow.
Click to expand...
Click to collapse
can you fix those picture? . it was prolem with dropbox
Thanks
kero2005 said:
can you fix those picture? . it was prolem with dropbox
Thanks
Click to expand...
Click to collapse
Pictures fixed, for what it's worth

P9 eMMC data recovery?

I am trying to recover files from the built-in (32GB) eMMC of a water damaged Huawai P9 (motherboard is corroded and no longer boots..). I'd like to somehow create a logical dump of the contained file system preferably using the least intusive method suitable for the task.
(unfortunately I am not allowed to link to the photo here.. so you'll have to manually patch the respective URL: www-wothke-ch*p9*motherboard.jpg )
Looking at the schematics ("14. eMMc AND LpDDR3") I see that various eMMC related test points are exposed on the PCB (i.e. DAT0, CLK, VSP1, VSP2, VSP3, VSP4) and I might be able to directly patch into those, to directly connect to some SD adapter (like this one: %&&ç - unfortunately I am not allowed to post the link - but you can google for "dumping-the-emmc-nand-on-the-nintendo-switch").. eventhough those pads are terribly small and I guess I'd still have to find CMD, 1v8 & 3v0 somewhere else on the PCB. however I have no experience if the remaining stuff on the PCB might just interfere too much for a respective patch to actually work.. any thoughts? Would I rather need to desolder the eMMC chip and to directly connect to the SD adapter?
Is Huawai actually using the on-chip (eMMC) controller or are they using some separate controller, so that using the on-chip one would not actually recover the logical image (if the on-chip controller was even functional and not some cheaper defective version that Huawai might be sourcing to save money - like those 1$ eMMC/SD adapters that can be found on aliexpress)?
The phone supposedly was *not* password protected. Does this automatically mean that the data on the eMMC is not encrypted or does Huawai use some kind of additional built-in/proprietary encryption scheme?
I found the JTAG pads on the PCB but if I understand it correctly those would at best allow me to recover a physical dump. So I'd need addtional hardware to even connect to those and then some expensive analyzer software to transfrom the physical dump to the logical image that I actually need... right?
There are also some ISP related test points exposed on the PCB.. but I guess using those (if they even still work on the damaged board )would lead to situation similar to the JTAG one, right?
Anything I have missed? Any recommendations?

Categories

Resources