I've hit a wall in my quest to improve the Samsung Gravity Smart (SGH-T589). The kernel source that Samsung released for it doesn't quite work right (no wifi, broken touchscreen drivers). I'm trying to do something about it, but my test kernels hang before ADB is able to detect and connect to the phone.
The phone is powered by the Qualcomm MSM 7227 (S1 Snapdragon @800Mhz), which I understand is supposed to have a debug UART. How do I access it?
Reading the Google Nexus i9250 thread, I took a closer look at the system board. I've highlighted what I suspect is the JTAG header (see attachment).
However, I lack both the tools and expertise to determine if that is the header, and what the pinout is (most jtag pinouts I see pictures of online are in 2-column layout).
But, I might not need that. If I understand the discussion in the i9250 thread correctly, what I need is a combination of this miniUSB breakout kit, a 619Kohm resistor, and the FTDI Friend to use to connect the UART to my PC. I'm not quite sure where I go from there, but I expect that Windows will detect the serial port and give me something to connect to via SecureCRT or the like.
Is this correct? I'd kinda like to know before I spend any money on parts
Alternately, if anyone wants to take a crack at wiring up the JTAG port, I have a spare (broken) phone I can ship out. Screen doesn't work, but it still boots which will make it perfect for testing with!
Now, if you had bothered to SEARCH you'd have found THIS post in this thread with this picture!
I actually did come across that thread, however that particular post would not have come up in a search and you'll forgive me for missing a post in a 25-page thread However, I appreciate your help nonetheless.
Next question: I have 2 conflicting schematics for wiring an LPT JTAG cable. One shows TDO wired to pin 13, the other has it wired to pin 11. Which is correct? Or should I just try it both ways?
Try both. Shouldn't happen anything bad until you connect it to 12V or so.
I'm banging my head against a wall here, trying to figure things out but not finding clear instructions.
Is it true that, in order to perform JTAG, I need to use some kind of adapter (i.e. RiffBox), or can I connect it directly to the LPT port of my PC? If I can use my PC, what software do I use to read the debug output? I'm less concerned with recovering from hard brick than I am with getting the early debug output.
I'm thinking a hacked USB approach might be simpler and less expensive. My problem is lack of tools. If anyone else has made such a cable, could I buy it off you for a reasonable price?
Hello, i have a semi bricked Samsung Galaxy S5770 Mini/Pop/Next. It is a Qualcomm MSM7227 board. I have tryied the usb UART approach, but the only thing i can get from it is AST-POWERON, and it repeats (i think it bootloops)
I am trying to find UART on board, there are some little pads around the CPU.
Sent from my GT-I9003 using XDA
Ah my TDO is wired to pin 11. You don't need riffbox if you make a LPT JTAG adapter such as the Wiggler (low voltage variant 3.3V).
There are many softwares that can handle the wiggler, such as H-JTAG, openocd and urjtag.
I used "H-JTAG" and "NoICE for ARM" on windows. It's easy to setup H-JTAG for the wiggler and you don't have to do anything from the command line.
The msm7227 platform is multi-cpu (modem cpu, applications cpu).
With the JTAG port you saw, you can access the modem cpu, which is a ARM926ej-s.
Sent from my GT-I9003 using XDA
tanks for you
Another way, without looking for UART is just comparing what you've changed in kernel, revert it all and apply changes one by one until it stops booting again. You might also find/create some proper thread for that and ask for help. With original repo pulled from opensource.samsung and your changes applied on it commit by commit.
Rebellos said:
Another way, without looking for UART is just comparing what you've changed in kernel, revert it all and apply changes one by one until it stops booting again. You might also find/create some proper thread for that and ask for help. With original repo pulled from opensource.samsung and your changes applied on it commit by commit.
Click to expand...
Click to collapse
The issue here is that I'm trying to backport the MXT224 driver because the driver that's in the Samsung release is butchered beyond repair--the orientation is wrong, the resolution is wrong, the alignment is wrong.
My backported driver either fails to recognize the hardware (which is odd, because the init code uses the exact same kernel calls as the FUBAR driver for the I2C transfers), or locks up the boot process too early to get any useful debug output.
Anyway, I have the parts I need on order, all I need is for the orders to show up and a decent soldering iron and I should be in business.
Ah! The MXT224. I know this one pretty well, aswell as messup that Samsung does, configuring it in hundreds of different ways, with usually same result.
I think you don't need to port anything there. There's parameter table passed to MXT224 during init, that's probably only one thing you need to setup. You might want to reverse driver from some stock kernel, or adjust it experimentally, or simply request Samsung for proper parameter table.
There are many helping examples in various kernel arounds, sometimes it's called MXT224, and sometimes it's QT602240. This is in fact 100% same thing.
I'm not sure if any datasheet is publicily available. Though setup structures explaination should be enough, there it is:
https://bitbucket.org/gokhanmoral/s.../drivers/input/touchscreen/qt602240.h#cl-4848
For example flipping it would be changing "orient" byte in T9 structure. Probably all othere parameters you need to change are also in T9.
Thanks for the link. I managed to figure out the correct "orient" value by trial-and-error, but the screen alignment is screwed up. On a stock kernel, the top-left is 0,0. On a compiled kernel, top-left doesn't even register properly (none of the edges do). I've tried a few experimental things but nothing helped so far. I'll check out that link when I get home and hopefully find something useful.
You might also want to look into mach_aries.c and mach_herring.c files from I9000 and I9020 kernel sources. These shows pretty good how very similiar results can be done in pretty different set of T9 parameters.
I appreciate your input. I'm experimenting with different T9 values. I found a partial datasheet that shed a little light into some of the parameters.
I've managed to strip out the "piggy" (uncompressed vmlinux) from the stock kernel. Is there anything I can do with that to somehow find out what T9 parameters are used by the actual stock kernel (as opposed to what Samsung released)? I did some searching for kernel disassembly but didn't find anything that looked promising.
Can you upload it somewhere? I'd take a look into it.
Sure thing. I'll upload it tonight when I get home. Thanks!
Here it is, gzipped:
http://min.us/mrUKEtr7W
Thanks, one more request - could you also upload .map file generated during your kernel compilation? I don't remember what was the full name of it, AFAIR it's ~70meg textfile in kernel source root or arch/arm/bin dir. Not sure though.
Also, are sources for this kernel available on github somewhere? Downloading tarball but this will take few hours more. :\
Ty in advance.
Rebellos said:
Thanks, one more request - could you also upload .map file generated during your kernel compilation? I don't remember what was the full name of it, AFAIR it's ~70meg textfile in kernel source root or arch/arm/bin dir. Not sure though.
Also, are sources for this kernel available on github somewhere? Downloading tarball but this will take few hours more. :\
Ty in advance.
Click to expand...
Click to collapse
It's not on github at the moment. I'm just working from the kernel sources posted on opensource.samsung.com for the SGH-T589. I'll start an account tonight when I get home and upload what I have. I'll get the map file you're after uploaded too.
Related
I have a problem that I hope some of the code gurus here can help me with. I have an HTC PDA that was codenamed Colorado. The Colorado is actually the Dell Axim X50 series. I have a thread on Aximsite http://www.aximsite.com/boards/showthread.php?t=140071 where I am trying to add a USB host hardware interface to the PDA. I have done quite a bit of hardware reverse engineering of the X50v device (I'm a old-time hardware hacker) and have been able to bring out the PXA270 USB host port1 interface to the outside world via two unused pins on the sync connector.
I originally noticed that the X50v A02 ROM had the OHCI driver included, so I rolled back to that release on my test PDA and have been attempting to get the interface operational. In my quest, I have determined that I need the usbd.dll driver as well as any client device drivers for HID, mass storage, etc.
I've used a number of the great utilities I've found on this site (thank you very much) to grab a copy of the Axim ROM and pull it apart. I consider myself great at working on hardware but my software skills have become rusty over the years (hey - I started by building this system a 'few' years ago: http://www.sol20.org/ )
What do I need?
I would appreciate getting some guidance on how to dissassemble the ohci.dll module so I can see if in fact, it was designed for the X50 or if it was left in by accident by HTC as the later ROM updates for the X50 series had the ohci.dll module replcaed with one named peripheral.dll which was about 1/5th the size.
Also, I'm wondering if either the ohci or usbd drivers require the irq and/or the membase of the PXA270 USB host port1 interface and if so, how do I determine those.
My original idea was to use a simple 2 port hub to bring out the interface. Unfortunately, I recently discovered that a hub requires a hub client driver. Because of that, I will settle on getting a USB flash memory key to interface directly as the drivers are already available. One of the problems I have is interfacing the 3v USB host lines on the PDA to the 5v data signals that may be present on the client device. The PXA270 USB host lines are already terminated on the PCB with 15K resistors. All that is needed is a transient protection chip and/or port driver chip.
I have installed the free Microsoft WinCE dev environments which I thought contained the source for the generic ohci driver, but I can't find it anywhere so I guessing it's not included in the free dev s/w.
Although this is only my 2nd post here, I do hope to be able to contribute technical information going forward. What I'm doing on the Aximsite is quite advanced as far as hardware hacking goes and I hope to be able to simplify it so a few others can 'play'.
Thanks in advance for any help and I wish everyone here a great New Year!
Wow. Well this is a bit over my head, but does sound great.
I will try pointing you toward a couple of useful tools:
1st is IDA probably the most powerful disassembler for ARM code. The free evaluation works fine, but won't save and closes about every 30 min. Still should do the trick if you just want to look at the code.
2nd to get sample driver code, you need Platform Builder. Not sure if that is what you downloaded, but try the provided link. Evaluation version contains all the source code MS is willing to give, it just has some limitations on ROM compilation (which you should not care about).
The only problem is, it's a real b*** to install. Takes hours even if you have a goo internet connection.
Hope this helps.
Thanks for the quick reply.
Do you know if there is anyone who knows a little on how the low level device drivers actually interact with the hardware ports?
Also, I assume that with just the ohci and usbd drivers, if the port is actually activated by pulling one of the data lines high, I should get the popup box asking for the name of the device driver. correct?
how to determine I/O base offset?
In trying to reverse engineer the ohci driver for a couple for the HTC units, I need to figure out where the I/O register base starts.
Are there any memory dump utils, like dumprom, that would indicate that?
I've installed platform builder and want to try compiling the standard ohci driver, but I need to know how to determine the start of the I/O registers on a given WM2003SE platform.
Any assistance would be greatly appreciated.
thanks
Background:
Since I'm a ROM developer, and I've recommended using ODIN3 in the past, I feel obligated to help unbrick phones. Investigation of unbricking methods for Galaxy S phones involve a lot of hacking since documentation is not available on the Samsung Galaxy S line of phones.
Myself and others have been doing some work on trying to revive bricked phones...
Ever tried JTAG unbrick recovery?--superhuman soldering skills no longer required for JTAG
Developing methods to recover bricks without JTAG - I keep this updated with current information as it develops.
ALL JIG VALUES here! --this will give you some resistor values to try
Altered water damage indicators --um... just in case you lick your battery and need warranty replacement
Galaxy S UART JIG & Debugging Connector--the hardware required for UART communications
Lets save some bricks...--Detailed hardware and software hacking in an attempt to bring gt-i9000s back to life, this is where the real hardware/software hacking is going on.
We'd appreciate more help in these threads....
Introduction:
However, you are here looking for the GalaxyS Hack Pack. During the last few months I've been collecting software and resources. This package contains everything known to help with research, investigation, security and hacking on GalaxyS phones and the Android platform. I'm not helping you root your phone, nor providing market applications. This package is not intended for new users. You are expected to be an advanced user capable of reading.
Warning:
This package contains binaries capable of bricking your phone. I have not yet mastered all of them.
Included in the package:
Android binaries go in /system/bin
bash 4.1- the best scriptable shell ever
i2cdetect - tool for i2c communications
i2cdump-dumps data from i2c
i2cget -requests data from i2c
i2cset -sends data to i2c
tcpdump-view inbound and outbound communications packets
viewmem-view memory at any location in the phone
Windows Software
AttachHeader - used for attaching a header for USB boot over OTG line.
hypertermina - sets up hyperterminal on Windows Vista and higher computers
moviNAND_Fusing_Tool & 512K-boot prepares an MMC card for booting
windows-dltool -allows terminal comms and transfers files over UART for booting
Useful Reading Material
GalaxyS i9000 service manuals- Contains 14 different levels of service manuals for GT-I9000 and are 90% valid for all SGS devices
ODROID-7 -technical manual for the development platform for our phones.. Someone translate please
Datasheets
FSA928-A_88A_full - USB Switch chip which responds to resistors and routes communications around the phone
S5PC110_EVT1_UM10 - The processor which drives our phones, the datasheet is 2400 pages long and contains alot of useful information
Disassembled binaries
bootdumps - disassembled and annotated IROM and PBL
Arduino Code
SerialConnector - Allows for UART communications with the Android Open Accessory Platform/Arduino Mega.
JTAG
Various items - Generic reading material collected about JTAG on a GalaxyS phone
Phone Speciffic
Various items - Images and documentation on specific models of phones.
Download GalaxyS Hack Pack v2
Please note, a very small amount of the files included in the hack pack are my original work. They have mostly been collected over months of searching. I am providing this as a resource for those wanting information on our devices. Over time this file will grow larger. I will continue to update and maintain this compilation.
Additional Resources:
Heimdall: An Open-Source replacement for Odin http://forum.xda-developers.com/showthread.php?t=755265
Heimdall One-Click: A repackagable one-click software uploading method http://oneclick.adamoutler.com
One-Click UnBrick: A piece of software which removes the bootlocks that cause Phone--/!\--PC http://forum.xda-developers.com/showthread.php?t=1153310
UnBrickable Mod: This is a hardware modifiction that allows upload of custom firmware including uploading Download Mode to a dead device: http://forum.xda-developers.com/showthread.php?t=1236273
ModeDetect for Linux: This piece of software will let you know what mode your device is currenly in, regardless of what is on-screen: http://forum.xda-developers.com/showthread.php?t=1257434
Using internal UART for debugging: This utilizes an external adapter to hook to UART inside the device to show what is happening on the System-On-a-Chip http://forum.xda-developers.com/showthread.php?t=1235219
bhundven said:
I've also just found these links to also be very helpful:
http://forum.xda-developers.com/showthread.php?t=1209288
http://forum.xda-developers.com/showthread.php?p=13473163 (By: UberPinguin)
Click to expand...
Click to collapse
Please post anything you feel should be included in this distribution.
Credits:
TheBeano - compiled i2c libraries
Samsung - GT-I9000 manuals/software
???? - shoot me a PM or post here to be added to this list.
Looks awesome man thanks for all your hard work for the community!
Sent from my GT-I9000 using XDA App
Sweet! Can't wait to see what it leads to!
(being the brickaphobic i am.)
I just realized that s5pc110 manual seems to be... incomplete.
There is no info about LCD FIMD and MDNIE controllers, which are most likely inside of there, or are at least mapped somehow in CPU, their SFRs arent even mentioned in manual, but are present and used in SBL and files in kernel/driver/video/samsung/ of kernel src (just try to find 0xF8200000 or0xFAE00000 for example in the cpu manual).
Probably docs about that can be called S3CFB documentation or something like that (so is called the driver)
If you have got any closer info about it - I'd be glad to see it. Im analyzing screen init sequence but it isnt fully possible without docs. :/
Updated. Added pictures of internals and other information.
thanks so much for sharing! genius, you are brilliant!
this is a new level of hacking and freedom. just be careful
can wait to see what this brings for new tools, etc.
mega thanks man =D
now that there is galaxy s2 abundance
i'm really thankful for the support we could still find on xda regarding our precious i9000
thanks a lot for this hard work
Will it be available for Galaxy Ace?
palito1980 said:
Will it be available for Galaxy Ace?
Click to expand...
Click to collapse
I have not come across anything for the Ace. If youd like to contribute, Ill add it.
THANK YOU SO MUCH!! lol
Information is very useful. Thank You!
AdamOutler said:
Background:
Since I'm a ROM developer, and I've recommended using ODIN3 in the past, I feel obligated to help unbrick phones.
Click to expand...
Click to collapse
My good sir, I have but one thing to say:
I love you.
Infuse Speaker, Earphone Issue
Hi Team,
Actually I got my Infuse and found that that everything else is working fine except the earphone, Mic and Speaker plus the earphone jack. So I am not able to hear any call or voice on phone. However I am able to dial and receive calls but with no voice. Although I tried using a stereo Bluetooth headphone but unfortunately phone calls are not audible via Bluetooth however I am able to listen to music and video's via Bluetooth.
I took the phone for repair and they told me its water damaged.. and they need the PCB diagram for repairing it. So I am wondering if someone can help me with the Diagram or some kind of documentation for the same.
Appreciate your time and reply..!!!
Regards
Gaurav
You realize this is the Captivate forum, not the Infuse.
The GalaxyS Hack Pack covers infuse too. It's practically the same processor... it's more GalaxyS2ish in it's design, but same basic GalaxyS hardware. I don't have an answer for this question though... This isn't Q&A and it's more of an informational thread.
The community and I thank you!!! U saved my brick!!!
seiledt12 said:
The community and I thank you!!! U saved my brick!!!
Click to expand...
Click to collapse
It means more if you hit the thanks button. A Guy with 11 posts cannot speak for the community.
Would this work with the vibrant?
Yes, anything that applies to Captivate applies to Vibrant. They're practically the same phone.
Hi,
as i wrote in another thread, i purchased a bricked A101.
There's no response from the system so i decided to start investigation on the hardware .
A101it chipset information:
Processor
• Ti OMAP3630 (515-pin CBB/P BGA package) ARM Cortex A8 at 1 GHz with DSP
• POWERVR SGX530 Graphic accelerator: 3D OpenGL ES 2.0
Memory
• 256MB LPDDR SDRAM (168-pin PoP BGA package) soldered on top of OMAP3630
• 8/16GB eMMC (169-pin BGA package) connected to OMAP3630 internal mmc2 interface
Interfaces
• USB slave 2.0 (OMAP3630 internal interface, MicroUSB connector)
• USB host interface (TPS65921 host interface, TYP A connector)
• Micro SD slot (OMAP3630 internal mmc1 interface, SDHC compatible)
Display subsystem
• ChiMei 10.1" TFT-Display N101L6-L02 (18Bit-LVDS interface)
• Ti SN75LVDS83B LVDS transmitter (56-pin BGA package)
Touchscreen subsystem
• Pixcir capacitiv touchscreen unit (TR16C0 controller, USB interface)
• Ti TUSB2551A USB transceiver (16-pin QFN package)
HDMI subsystem
• NXP TDA19989AET 24-Bit HDMI transmitter
• HDMI output (19-pin Mini HDMI connector)
Communication
• Ti WL1270/1 WiFi (802.11 b/g/n)
• Ti WL1270/1 Bluetooth 2.1 EDR
Miscellaneous
• Built-in speaker
• Built-in Microphone
• Freescale MMA7660FC G-sensor
• Omnivison OV7675 VGA camera (0.3M)
Power source
• Ti TPS65921 power management chip
• Intersil ISL9220 LiPo charger
• Internal: Lithium Polymer battery
• External: 5V/1A Power adapter/charger
To get some detailed informations about these chips, i made a sweet datasheet collection.
Grab the zip-file here.
TBC...
EDIT: The brick issue is solved.
The platform did not boot up due to a broken connection to onboard RAM.
This thread will present various hacks and other stuff a geek might have fun with
Read on for some more information.
So here's my first result:
I successfully located the sys_boot signals of the OMAP3630.
I made a first test by changing the default boot mode.
With sys_boot5 pulled high the boot order changes to peripheral boot first.
In other words you may use this tool to directly access the OMAP memory (e.g. RAM).
In theory it should alos be possible to boot the device form external microSD as well, but at factory default the microSD slot is covered by power management. In other words, power is switched off at boot time.
This could be hacked as well
My attempt will be to un-brick my device by using external boot mechanism.
Maybe i'll need some help at a later point!
EDIT: Peripheral boot modes had successfully been verifed.
It definitely works on the Archos 101. Perhaps this may be useful for some open bootloader project.
Aynway, i already discovered some other things, that might be helpful for hardware hackers. So if you are kind leave a comment or ask some questions.
Stay tuned!
scholbert
Oh, that's interesting ... I don't know anything about hardware hacking but I'd like to learn hope you will show us ... keep on the good effort ... and I'll keep an eye on this tread .... might come handy ... jejeje
sounds great, keep on rolling
peripheral boot
Hi,
thanks for your replies.
So as expected using peripheral boot over USB/UART is working (sys_boot5 pulled high).
At least the ASIC ID is send correctly and the initial communication starts.
See the screenshot attached.
Flash V1.6 also got a eMMC driver included.
So this could be the way .
Right now there's an error message:
Code:
Unknown status message 'dKAYd 2nd stdrted?' during peripheral boot (waiting for 2nd)
I guess the response should be: OKAY! 2nd started?
EDIT:
MMMh strange... i'll have to find out who is generating this message.
If it is comming from OMAP the SDRAM setup should be verified.
Seems that the LSB byte stuck @ 0x64.
Code:
dKAYd 2nd stdrted?
ascii = dKAY -> hex = 0x59414b64 (msb..lsb)
ascii = d 2n -> hex = 0x6e322064
ascii = d st -> hex = 0x74732064
ascii = drte -> hex = 0x65747264
ascii = d? -> hex = 0x00003F64
See the session log file for more details!
Anyway i justed started to play around... maybe some tweaks in the configuration are needed
Have fun!
scholbert
Pretty Cool
Thanks for attesting coolness
Made some further tests... though my time is really limited right now.
I found out that the message is send from 2nd loader which is used for Ti's Flash tool.
So this might indicate that there's something wrong with my memory or memory bus.
I re-checked the RAM setup sripts for the Ti tool again but could not find any error. Reduced the timing as well. Still got that message...
It's very strange that the pattern really seems to stick, which is unusual for damaged memory... i will report further findings.
Anyway this is open discussion, feel free to post
Cheers,
scholbert
Nice try. Can you tell us about the RAM, it's built in the mainboard or changable?
We already know that, it's built-in ^^
(some have opened their Archos before ^^)
trungvn1988 said:
Nice try. Can you tell us about the RAM, it's built in the mainboard or changable?
Click to expand...
Click to collapse
http://forum.archosfans.com/viewtopic.php?f=74&t=42806
Soldered on, not changable by anyone with home soldering tools. Very small ball soldering. I gave it an attempt, even got a replacement 1GB RAM module as a test piece... Didn't work out well for me.
I'll definitely be keeping an eye on this topic, seems like some good information might come of it.
.............yippie yeah it's working out!!!!
Thanks for the feedback
First i'll have to quote myself:
It's very strange that the pattern really seems to stick, which is unusual for damaged memory... i will report further findings.
Click to expand...
Click to collapse
Guess what...... it's fixed!!!!!
I really go crazy. See attached log file.
External boot over USB and 2nd loader started up successfully, using the Ti tool.
So RAM is working now!
This definitely saved my day...
What happened exactly?
As i pointed out, the data on memory bus stucked at 0x64, so i assumed there was an issue with DQM/DQS signals on PoP memory.
See some related documents about the function of these signals on RAM chips.
The DQM/DQS where not toggled in the right way because of bad soldering at the PoP memory chip.
See the attached pic for the excact position of these signals (marked in red).
The chip itself is soldered on top of the OMAP3630.
In the end i used a hot-air solder gun and soem soldering flux and fixed the broken connection. In fact i used this "technique" some time ago to fix a "No GSM" issue on HTC Hermes.
Though i'm very excited right know, i'll have to make a break for today, because i have a date
Harfainx said:
I'll definitely be keeping an eye on this topic, seems like some good information might come of it.
Click to expand...
Click to collapse
Yes i'll try my very best
Kind regards,
scholbert
Guy, it's so nice! Keep up the good work!
datasheet collection
Hey,
i was lucky last week. My device is up and running.
Fortunately the eMMC data structure was O.K. In the end my device refused to boot, because of that broken connection to the RAM.
So there'd been no need to fiddle around with eMMC for now.
Maybe i'll do some investigation at a later point.
Feel free to set up your device for peripheral boot and try the Ti Flash tool debugging possibilities.
Right now i decided to re-assemble the device and use it for a while.
I must assume that i know nothing about the internal structure of the firmware. So it would be essential to get some insights
I got some additional information about the eMMC/microSD data lines.
If there's some interest i might post further pics.
To get some background about the chips on the A101 mainboard, i collected some datasheets of the main components.
Grab the zip-file here.
Most of them are easy to find other's are not
Anyway, saves your time i guess.
BTW, is there any tool to unpack gen8 AOS files?
Regards,
scholbert
yes it would be great if we could find one, maybe we could find a way to get inside and change some things
scholbert said:
...
Most of them are easy to find other's are not
Anyway, saves your time i guess.
BTW, is there any tool to unpack gen8 AOS files?
Regards,
scholbert
Click to expand...
Click to collapse
As far as i know we can't extract aos files since they are encrrypted and we don't have they proper KEY - its saved inside the device somewhere
But good luck with going on! Rly sounds interesting who knows what it's good for in future
good news - check out:
http://forum.xda-developers.com/showthread.php?t=1214674
seems we got a way to extract soon
..... uuuh great!!!
FrEcP said:
good news - check out:
http://forum.xda-developers.com/showthread.php?t=1214674
seems we got a way to extract soon
Click to expand...
Click to collapse
Yupp, that's awesome. I just joined that thread.
In the meantime i disassembled my device again, because i want to spent some more time on research.
I found out some more details about the chips and the design in general.
The A101 seems a pretty neat device for extensive hacking, because archos did a good job and made a very clear design.
I started to prepare a pin map by looking at the kernel sources again.
Maybe i'll be able to find some other useful testpoints on the mainboard (e.g. UART2)
As you might know, the touchscreen is connected to USB using OHCI mode.
To attach it to the OMAP ports they also used a chip from Ti.
See this datasheet for more information:
http://focus.ti.com/docs/prod/folders/print/tusb2551a.html
If i'll find some time i'll try to make kind of a floor plan from the mainboard and post some pics as well.
P.S.: If someone knows the manufaturer of the speaker drivers, please tell me! The parts are marked as 8JAM892 and are located near the soldering points for the speaker.
Keep on hackin'
scholbert
What I would like to find out is what component it is that dies when the USB port fails (and it stops sleeping as well). Maybe it's replaceable (if you can do SMD soldering).
pbarrett said:
What I would like to find out is what component it is that dies when the USB port fails (and it stops sleeping as well). Maybe it's replaceable (if you can do SMD soldering).
Click to expand...
Click to collapse
Mmmh... without being affected by this issue it's hard to tell.
If the port dies, there could be many reasons of course.
Maybe the 5V power supply for Vbus is dying on these devices, due to "over-current" issue. I have not identified that part right now.
The signal lines itself usually won't be harmed... apart from injecting ESD pulses right to the connector.
The USB host port is directly connected to data lines of the USB PHY inside TPS65921 (Power Management chip).
OMAP3630 itself uses ULPI mode to connect to this part.
That's all i could say for now.
Regards,
scholbert
FrEcP said:
good news - check out:
http://forum.xda-developers.com/showthread.php?t=1214674
seems we got a way to extract soon
Click to expand...
Click to collapse
If we can't extract those AOS files - how are custom ROM builders such as $auron getting their hands on the upper layer of the firmware? I know I am not expressing myself technically correct, but what I understand is that for instance $auron's UrukDroid is a custom Linux kernel etc. with on top of it the modules, GUI etc of the official Archos packages...
you don't need to extract the aos file to get the filesystem of the archos android. you simply have to root your device or just install angstrom (which comes with SDE) and then you can copy the squashfs file to your computer so you can extract whatever you need. it's not encrypted but signed, you only have to skip the first 256 bytes (if I remember correctly) of the file to get a valid squashfs image.
ok so I'm thinking of trying to get usb host mode working on x10
problem 1, the usb port in x10 does not provide power.to external devices...
i want some crazy tester to set.up a jig as mentioned here
http://forum.xda-developers.com/showthread.php?p=24618556
(just make the jig....do not.think about that kernel...that's a totally different phone)
next, the kernel.you have to.use.is this
http://forum.xda-developers.com/showthread.php?p=24217211
or, one.of.the two.kernels here
http://forum.xda-developers.com/showthread.php?p=24026342
(as per your ROM, select kernel)
next we.need a usb host controller app (sztupy has made.one)
so get that
if someone is ready to go through this.... please contact me
maybe we can get usb otg up and running on x10
Sent from my X10S using xda premium
Hey champ, just curious what the purpose of the jig is? If my understanding of a jig is correct, isn't it simply a 301ohm resistor between pins 4 and 5 in a USB connector? Usually used to put Samsung phones into download mode, I believe. I can see how I would need a usb OTG cable and a powered hub, but why the jig?
I hope that you're on to something here, USB host on the x10 would be incredible!
Sent from my X10 using Tapatalk
;24732035 said:
Hey champ, just curious what the purpose of the jig is? If my understanding of a jig is correct, isn't it simply a 301ohm resistor between pins 4 and 5 in a USB connector? Usually used to put Samsung phones into download mode, I believe. I can see how I would need a usb OTG cable and a powered hub, but why the jig?
I hope that you're on to something here, USB host on the x10 would be incredible!
Sent from my X10 using Tapatalk
Click to expand...
Click to collapse
actually yes....
we just need the otg cable and some way to provide power to the usb device....
rest my kernels i linked.to...I've complied them with host mode drivers enabled...
at the moment (for next 4-5 weeks) i do not have the time/energy/money/resources to set this hardware monkeying business....for that i need a volunteer.....
rest the kernel is up, and once device is connected, i can guide the person into mounting it too....
we just MIGHT do a big thing here
Sent from my X10S using xda premium
Hey champ, I did have a usb 4 port hub that used a power supply. Will something like this work?
Sent from my X10S using XDA
ToledoJab said:
Hey champ, I did have a usb 4 port hub that used a power supply. Will something like this work?
Sent from my X10S using XDA
Click to expand...
Click to collapse
yes maybe... see my fxp mod kernels have usb mode enabled...we have to try and see if it works
Sent from my X10S using xda premium
championswimmer said:
yes maybe... see my fxp mod kernels have usb mode enabled...we have to try and see if it works
Sent from my X10S using xda premium
Click to expand...
Click to collapse
I have not used fxp yet. Whats a good kernel & rom to test with.
Sent from my X10S using XDA
The circuit/adapter needed is rather simple:
It will let data pass through, and from an external source provide power to both the phone and the device.
I might be up to test this, but I have to gather some leftover parts from broken USB gadgets I have lying around.
Now where did I place that 5 volt power supply? * looks around*
I'll be back...
http://forum.xda-developers.com/showthread.php?t=923864
^^^ build your own hub.
get the hardware up guys, (I'm currently shifting homes, and all hardware related stuff cannot be found easily...lol)
I'll see what can be done about kernel and about mounting it..we might *just* be able to pull this off....
Sent from my X10S using xda premium
OmegaRED^ said:
http://forum.xda-developers.com/showthread.php?t=923864
^^^ build your own hub.
Click to expand...
Click to collapse
Wouldn't it be easier and cheaper just to buy a powered one? But it does remind me of how pissed off I was as a kid when I ordered a Sinclair ZX81 kit to build and the bloody idiots sent me an assembled unit instead at no additional charge. Useless.
TAL333 said:
Wouldn't it be easier and cheaper just to buy a powered one? But it does remind me of how pissed off I was as a kid when I ordered a Sinclair ZX81 kit to build and the bloody idiots sent me an assembled unit instead at no additional charge. Useless.
Click to expand...
Click to collapse
Usb connection needs to be modded to micro usb either way.
I had ZX81.. such a awesome toy and tool.
Hey all,
I have all the nessesary hardware - DIY battery powered hub module with PWM power.Works fine on some other devices, not on X10.
It is because I was making a lot of developing and experiments with otg mode on X10 (X10 schematics helped). I have also built kernel modules, loaded them succesfully, but nothing else - logcat or dmesg didnt see anything and no errors returned (stick,HDD,mouse,keyboard...).
So, i could be volunteer, because I am interested of it, and slso have hardware and software skills
BTW.: I am also very curious about new ideas in otg X10
HeliumX10 said:
Hey all,
I have all the nessesary hardware - DIY battery powered hub module with PWM power.Works fine on some other devices, not on X10.
It is because I was making a lot of developing and experiments with otg mode on X10 (X10 schematics helped). I have also built kernel modules, loaded them succesfully, but nothing else - logcat or dmesg didnt see anything and no errors returned (stick,HDD,mouse,keyboard...).
So, i could be volunteer, because I am interested of it, and slso have hardware and software skills
BTW.: I am also very curious about new ideas in otg X10
Click to expand...
Click to collapse
try using my v5 kCernel
(you'll have to use fxp cm7 rom along with it )
it has usb otg enabled in kernel
Sent from my X10S using xda premium
Ou... see that it requires unlocked bootloader
Sorry, is there any other solution how to get this kernel working? I. e. source code which can allow me to build locked bootloader kernel image?
And for your information, in kernel page (from your signature) version 5, link for wifi modules is dead , says file not found.
HeliumX10 said:
Ou... see that it requires unlocked bootloader
Sorry, is there any other solution how to get this kernel working? I. e. source code which can allow me to build locked bootloader kernel image?
And for your information, in kernel page (from your signature) version 5, link for wifi modules is dead , says file not found.
Click to expand...
Click to collapse
will try to build locked bl kernel for you...
for file download see my signature, there is dev host mirror and direct link both... (look inside x10 folder inside kernels)
Sent from my X10S using xda premium
championswimmer said:
will try to build locked bl kernel for you...
for file download see my signature, there is dev host mirror and direct link both... (look inside x10 folder inside kernels)
Sent from my X10S using xda premium
Click to expand...
Click to collapse
Anyway thanks for even try ! Good luck
(TX pressed )
I've been experminetning hoping i'd get anything to show up in the kernel logs when attempting to connect something to the port.
However, even if the chip itself does support this, I start to believe the circuit board simply isn't wired up to function in this way.
Now think about it: Why would SE put the extra circuitry in (even if themselves are rather primitive), if they never planned to include it in the first place?
What I've done so far:
Made a simple adapter based on a experiment board with two USB connectors, and a DC in jack that supplies both connectors with 5 volts, that charges the phone, provides the common ground and supplies the gadget one connects (In my case a simple USB flash memory)
I tested this adapter on another device that does support USB on the Go, or what it's called. It works.
Even if a kernel doesn't support the device itself, the log will show signs that an unknown device is connected, which is good enough for me, as confirms the hardware works.
Now onto the X10:
Tried the ROM FreeXperia FXP117, with the kernel from FXP115, as is. dmesg gives no result at all. Also tried flipping around the data + and -, no result. Device is charging, bu nothing else.
Tried the kCernels, from the link provided by the OP in the first post.
While I had trouble booting the device up completely (My own fault, has nothing tod with this thread), at least I was able to boot the kernel and was able to access the device from the debug bridge (adb shell).
Yet again no result. Nothing from dmesg, nothing on the flash memory that indicates kernel accessing it. (It flashes a few times initially when detected otherwise)
Questions:
Are we talking about a separate modified kernel module here?
If so I might have missed it.
Have I missed any importants steps? (loading the external modules for instance?)
EDIT:
Are now "screwing" around with some USB hubs, connectors and are also looking int othis S3C USB Host thing. I suspect that one is aspecial thing for samsung, and are not the same as other devices uses.
We might need another way to control the USB-mode in the X10 chipset, which I suspect is not a S3C based one.
I also suspect the device need a special chip in order to switch between host and device mode, and that chip also provides the "root hub" in question. I suspect the X10 lacks all those things, even if the chipset itself proviced support for it.
EDIT 2:
No success at all. I even tried to detect if there where any data exchange between the X10 and the hubs I've tried (Both straight and crossover on the data leads)
Nothing. There is no whatsoever activity at all going on between the devices.
With that. I'm pretty sure one need a special chip that wakes up the USB host mode in the chipset when certain circumstances are fulfilled. (Normally a chip integrated in the device itself, which the X10 lacks)
I'll place this little project of mine, on the shelf for the time being.
At least until someone can provide us with additional tips that can lead into forcing the X10 chipset into USB host mode.
To put this in simpler terms:
One cannot simply connect to devices to eachother. Nothing will happen.
Both devices will sit there, waiting for the other one to start speaking so either one can respond to the other.
That is how USB device and host mode works:
When a device is connected, the host will detect it and start speaking to it, asking questions the device have to respond to. The device itself will never start speaking, it will only listen, and only respond when asked.
Once this has happened, the data exchange between the device and the operating system can take its course.
The X10 is a device, it listens.
If we try to connect a device/gadget to it, that is not a host itself, it will also sit there listening.
In this situation, we have two or more devices that refuses to speak, as there are no host around to start the conversation.
What we nee to do here, is encourage the X10 to start speaking, by forcing it into host mode BEFORE we connect anything.
for SysGhost:
Same as I did before on doomlord kernels with same (no) results
If you want, i have X10i block diagram schemes. I have already researched them for many many days, but maybe you will find something else...
And one thing - have you loaded usb host kernel modules? Even if hardware supports it, but doesnt have its module, nothing will show up in kernel or system message bus Maybe you know it, maybe not....
HeliumX10 said:
for SysGhost:
Same as I did before on doomlord kernels with same (no) results
If you want, i have X10i block diagram schemes. I have already researched them for many many days, but maybe you will find something else...
And one thing - have you loaded usb host kernel modules? Even if hardware supports it, but doesnt have its module, nothing will show up in kernel or system message bus Maybe you know it, maybe not....
Click to expand...
Click to collapse
Any documents on the X10 would be helpful. If you got any, I'd gladly have a look.
SysGhost said:
Any documents on the X10 would be helpful. If you got any, I'd gladly have a look.
Click to expand...
Click to collapse
here there are
As I am uploading them here, i remember that I had found, that USB host cables are located (as in diagram) on the right side of the JTAG pins (under battery stick), because there is located an usb switcher (page 15).
But not sure about it - time to brainstorm
Hi,
so, after the new wave of Nexus 4 in the play store, and the rev 11 (12 ?), is this a new changelog for the rev ? And is this now OTG support ?
Thanks for your answer
(can't buy my N4, Google canceled my order :'()
uh ...... no
I just received my Nexus 4 two days ago, and USB OTG doesn't work on it. I don't know which revision it is. How do you find out?
Btw., I'm trying to find a solution, and I made a wiki where I am collecting everything I know about the problem:
http://www.wikihost.org/w/nexus4otg
Unfortunately, I can't post it in the dev thread http://forum.xda-developers.com/showthread.php?t=2048545 , because I don't have enough posts, which is a bit silly. Could someone please link it there? Everybody who wants to contribute to the wiki is welcome.
My next steps:
Get a power injector cable, see if I can get a low-level response (dmesg etc.) with it.
Make a debug kernel that spits out more information.
Check what parts are disabled, and put them back in (Shaky156 make a kernel like this, I'm not sure what exactly he did though).
If all fails, see if I can mod it to manually enter host mode (instead of on OTG sensing), or bypass the slimport chip (if it is the problem).
CaptainMuon said:
I just received my Nexus 4 two days ago, and USB OTG doesn't work on it. I don't know which revision it is. How do you find out?
Btw., I'm trying to find a solution, and I made a wiki where I am collecting everything I know about the problem:
http://www.wikihost.org/w/nexus4otg
Unfortunately, I can't post it in the dev thread http://forum.xda-developers.com/showthread.php?t=2048545 , because I don't have enough posts, which is a bit silly. Could someone please link it there? Everybody who wants to contribute to the wiki is welcome.
My next steps:
Get a power injector cable, see if I can get a low-level response (dmesg etc.) with it.
Make a debug kernel that spits out more information.
Check what parts are disabled, and put them back in (Shaky156 make a kernel like this, I'm not sure what exactly he did though).
If all fails, see if I can mod it to manually enter host mode (instead of on OTG sensing), or bypass the slimport chip (if it is the problem).
Click to expand...
Click to collapse
In the boot loader
heat361 said:
In the boot loader
Click to expand...
Click to collapse
Thanks, it's rev_11.
CaptainMuon said:
I just received my Nexus 4 two days ago, and USB OTG doesn't work on it. I don't know which revision it is. How do you find out?
Btw., I'm trying to find a solution, and I made a wiki where I am collecting everything I know about the problem:
http://www.wikihost.org/w/nexus4otg
Unfortunately, I can't post it in the dev thread http://forum.xda-developers.com/showthread.php?t=2048545 , because I don't have enough posts, which is a bit silly. Could someone please link it there? Everybody who wants to contribute to the wiki is welcome.
My next steps:
Get a power injector cable, see if I can get a low-level response (dmesg etc.) with it.
Make a debug kernel that spits out more information.
Check what parts are disabled, and put them back in (Shaky156 make a kernel like this, I'm not sure what exactly he did though).
If all fails, see if I can mod it to manually enter host mode (instead of on OTG sensing), or bypass the slimport chip (if it is the problem).
Click to expand...
Click to collapse
A link to a wiki page doesn't belong in the dev section, read the rules. If you get a kernel up and working that can be posted in development.
kzoodroid said:
A link to a wiki page doesn't belong in the dev section, read the rules. If you get a kernel up and working that can be posted in development.
Click to expand...
Click to collapse
Sorry, but then how does anything in that thread, maybe with exception of the opening post, belong there? None of it is the announcement of finished work or similar. People are trying to get it to work in that thread.
(Edit: Just to clarify, of course I don't want to open a new thread there. I was hoping to get into contact with the people discussing in the thread I linked, and trying to help. I did read the rules.)
USB OTG for Nexus4
Hi...
I have some idea about nexus4 otg....
that is i have voltage converter that means 4V to 5V.
if nexus4 slimport out put 4v then converter makes it 5v ...so it can run the USB...
its not needs external power .......or power usb hub
I had tried it.. but I cant make it
how can i solve the problem????
Vincent2013 said:
Hi...
I have some idea about nexus4 otg....
that is i have voltage converter that means 4V to 5V.
if nexus4 slimport out put 4v then converter makes it 5v ...so it can run the USB...
its not needs external power .......or power usb hub
I had tried it.. but I cant make it
how can i solve the problem????
Click to expand...
Click to collapse
AFAIK the Nexus 4 usb itself is not powered.. so no matter what you wont get voltage from it. For now, atleast, I hope.