Finding the serial (UART) pinout on KF - Kindle Fire Android Development

How to find the UART
Click to expand...
Click to collapse
Thanks to jamez70's, we now know where the serial pins are.
Here is where the UART pins sits on the back of the motherboard.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
(Courtesy of ifixit photo and jamez70's illustration)
The pins from 1-4 are:
RX TX GND GND (where #4 is marked)
From probing, we can detect the 1V8 level signal and the baud rate of 115200.
(Courtesy of jamez70)
If you want to hook this up, I suggest you solder on some wires to the pads and run the wires to the front, making life easier to re-assemble the KF.
Details
Click to expand...
Click to collapse
I suggest you get something like the Breakout Board for FT232RL USB to Serial for hooking this up. Note that the KF is 1V8, so when you want to connect this unit (default 3V3), you may want to use a level shifter, or simply find the VCC on the KF and loop that back that through the VCCIO on the Sparkfun-converter. Sending 3V3 directly into the KF could possibly seriously hurt it!
If you want to construct a simple voltage divider, simply get two resistors and get your soldering gun out. According to Vout = Vin * Rb/(Ra+Rb)
Voltage divider circuit (courtesy of calculatoredge.com)
Vin: 3V3
Vout: 1V8
Ra: 10 kOhm
Rb: 12 kOhm
If you need more UART details, here are some tips:
Baud: 115200
Bits: 8
Parity: None
Stop Bits: 1
Background
Click to expand...
Click to collapse
In the work to get a booting 3.0 kernel on the KF we need some low level access to debug since the USB initializes way later in the kernel sequence. I did some research on the OMAP4430 (the CPU in our dear KF) to try and find out where the UART interface might be accessed.
Looking at the datasheet we get a feeling of all the ball points ("pins") on the CPU. (Observe that this is seen from under the CPU)
OMAP4430 ball bottom layout
By then looking at the UART table TX pin numbers I try to get a feel where they might be located on the chip.
UART 1, 2, 3, 4 table
Finally, I cross referenced the UART table with TX pin and physical position on the board. The colors represent UART 1 TX, UART 2 TX and UART 4 TX. UART 3 doesn't seem likely to be mapped.
UART 1, 2 and 4 TX pin guesses
Observe that these are all estimates, but should narrow the search down (unless they're mapped somewhere way outside of the CPU area that is). I haven't had a chance of testing any of my guesses yet, but I thought I'd at least post my thoughts to get the ball running.

I'd put money on the four solder pads near the edge on the back (lcd facing) side.

pokey9000 said:
I'd put money on the four solder pads near the edge on the back (lcd facing) side.
Click to expand...
Click to collapse
Where exactly? Could you describe more in detail? If you're referring to the ones on the right, I'm pretty sure they are for the two speakers.
Courtesy of iFixit.net
I opened my attempted to probe my KF one more time today. It was a close call where I tried finding the TX amongst the bigger solder pads and a spark went off. Luckily, an unplug/plug of the battery connector booted it right up again. My probes on my multimeter are waaay to big for all the small dots. Hopefully, somebody has some more fitting equipment for the task.

csholmq said:
Where exactly? Could you describe more in detail.
Click to expand...
Click to collapse
I'd be willing to shave my pet poodle that he means the four solder pads in the middle on the right side of your image.

Buffet_of_Lies said:
I'd be willing to shave my pet poodle that he means the four solder pads in the middle on the right side of your image.
Click to expand...
Click to collapse
Yeah, I just realised that I had been flipping it the wrong way in my head The pads on that side looks very promising! I'm not sure how I'm gonna test out the pads without disconnecting everything from the board. Our best bet is probably to solder some wires and test directly on them. Won't do that on my KF atm though. Too dependant on it for my lecture slides

Yeah. I don't blame you. I'm a big fan of circuit-bending but you usually use old junky electronics, not a brand new state-of-the-art device like this. Not really willing to go near this thing with my soldering iron at this point. But something else I noticed is that on a photo of the OTHER side of that board... there's a serialnumber/MAC address sticker right smack on top of where those four solder pads are. Totally screaming in an attempt to hide where the traces are going!
Something else of interest is the closeup photo of the wifi/bt chip:
What I've long suspected is that the bluetooth isn't wired onto the motherboard. Looking at the image you posted above it's on the upper left side and darned if I don't see some empty component spaces!

Buffet_of_Lies said:
Yeah. I don't blame you. I'm a big fan of circuit-bending but you usually use old junky electronics, not a brand new state-of-the-art device like this. Not really willing to go near this thing with my soldering iron at this point. But something else I noticed is that on a photo of the OTHER side of that board... there's a serialnumber/MAC address sticker right smack on top of where those four solder pads are. Totally screaming in an attempt to hide where the traces are going!
Something else of interest is the closeup photo of the wifi/bt chip:
What I've long suspected is that the bluetooth isn't wired onto the motherboard. Looking at the image you posted above it's on the upper left side and darned if I don't see some empty component spaces!
Click to expand...
Click to collapse
I'm no kernel dev. But for those who are, it would certainly be worth looking under the sticker! Assuming the UART is TTL, I recommend getting Teensy USB dev board or something similar. Certainly helps with the debugging. I have one and it works great (it's compatible with the Arduino IDE).

csholmq said:
I'm no kernel dev. But for those who are, it would certainly be worth looking under the sticker! Assuming the UART is TTL, I recommend getting Teensy USB dev board or something similar. Certainly helps with the debugging. I have one and it works great (it's compatible with the Arduino IDE).
Click to expand...
Click to collapse
The Teensy's great, and would probably work if you're running it at 3.3V. The serial port on the Fire should be 1.8V, and the ATMEGA32U4 at 3.3V should have a suitable input threshold. I recommend though getting an FT232R breakout board from Sparkfun if you're going to be hacking serial ports onto modern embedded gadgets. I've heard that the Bus Pirate works too, but I thought the buffer doesn't go down that low.
As for missing components and bluetooth, there are only a couple of no-pop discretes, and some that look like a pull-up/pull-down select. I wouldn't count BT out just yet.

There's a lot of busted lcd kindles on ebay for cheap. Probably a good place to start.

pokey9000 said:
The Teensy's great, and would probably work if you're running it at 3.3V. The serial port on the Fire should be 1.8V, and the ATMEGA32U4 at 3.3V should have a suitable input threshold. I recommend though getting an FT232R breakout board from Sparkfun if you're going to be hacking serial ports onto modern embedded gadgets. I've heard that the Bus Pirate works too, but I thought the buffer doesn't go down that low.
As for missing components and bluetooth, there are only a couple of no-pop discretes, and some that look like a pull-up/pull-down select. I wouldn't count BT out just yet.
Click to expand...
Click to collapse
Sure, but the Teensy has analog inputs aswell. So as long as it's below 5 V you should be able to use it to read serial. Even though the KF is just at 1.8 V.
Edit: Actually, it looks like it reads high signal in above 0.7*Vcc, which makes 3.3V a no go - as with the Teensy :/ At least with proper serial communication.

In the interest of clarity, the KF is 5 VOLTS at 1.8 AMPS not 1.8 Volts..

Buffet_of_Lies said:
In the interest of clarity, the KF is 5 VOLTS at 1.8 AMPS not 1.8 Volts..
Click to expand...
Click to collapse
What? But the battery is just 3.7 V.

csholmq said:
What? But the battery is just 3.7 V.
Click to expand...
Click to collapse
I stand corrected.

Buffet_of_Lies said:
I stand corrected.
Click to expand...
Click to collapse
I see. I read your post in the other thread now. You referred to your USB charger? Yeah, that sounds about right. The KF is 1.8 Volts though.
When you talk about Amps (current) you almost always talk about "max current". I.e maximum discharge current from the battery or maximum load current from charger adaptor.
Btw, I found a great piece of looking breakout board. UART to USB micro for basically no money at all! It can be driven on either 3V3 (standard with jumper), 5V (from USB) or Vcc directly from device (1.8, 3.3 etc etc).
Now I just need to find a KF motherboard. All the broken screen units gets hogged on Ebay...

csholmq said:
Btw, I found a great piece of looking breakout board. UART to USB microUART to USB for basically no money at all! It can be driven on either 3V3 (standard with jumper), 5V (from USB) or Vcc directly from device (1.8, 3.3 etc etc).
Now I just need to find a KF motherboard. All the broken lcd units gets hogged on Ebay...
Click to expand...
Click to collapse
That's exactly the one I was referring to. I've used mine on a Nook Color and Nook Tablet (both 1.8V I/O) and it works great.

Chatted some with Hashcode on IRC. He found lines suggesting UART 3.
Code:
11:55 <@Hashcode> if ((up2->pdev->id == CONSOLE_UART)
11:55 <@Hashcode> #define CONSOLE_UART UART3
As I didn't find any dots likely to be mapped next to the CPU, this might suggest that they are actually mapped somewhere else. Easy to access maybe?
So our best bet atm are the 4 pads on the right middle back ("under" the touch controller). I would love to have a look under the MAC sticker on the top. To see if it hides something interesting.
UART 3 (serial) pads estimates. TX/RX/GND/VCC (not in order)

Chatted some more, this time with UberDuper. He gave me some hands on proof that all 4 UART are defined and UART2 is actually up and running!
I was afraid that if everything was disabled, it would severely obstruct finding the port. I'll try to get my hands on some tech as soon as I can to have a look.
# cat /proc/interrupt
Code:
102: 0 0 GIC serial idle
103: 0 0 GIC hsi_dma_mpu
104: 0 0 GIC serial idle
105: 0 0 GIC serial idle
106: 16 0 GIC serial idle, OMAP UART2
# dmesg
Code:
<6>[0.201904] omap-hsuart.0: ttyO0 at MMIO 0x4806a000 (irq = 104) is a OMAP UART0
<6>[0.202148] omap-hsuart.1: ttyO1 at MMIO 0x4806c000 (irq = 105) is a OMAP UART1
<6>[0.202362] omap-hsuart.2: ttyO2 at MMIO 0x48020000 (irq = 106) is a OMAP UART2
<6>[1.437225] console [ttyO2] enabled
<6>[1.441101] omap-hsuart.3: ttyO3 at MMIO 0x4806e000 (irq = 102) is a OMAP UART3

A thread popped up yesterday that seemed to be relevant to this one.
KF Serial Port
Apparently you all were right about it being at the 4 pads on the right side... but what next?

UrticantOwl said:
A thread popped up yesterday that seemed to be relevant to this one.
KF Serial Port
Apparently you all were right about it being at the 4 pads on the right side... but what next?
Click to expand...
Click to collapse
Now we need kernel devs to connect up to it and get the 3.x Android kennel booting. Hashcode said he's getting the gear for it. I've got some stuff that should work, so I might get into it as well. I'm pretty busy though, so not sure how much I can contribute...
What's the voltage level this CPU uses for serial? 1.8? If it can take 3.3 on those pins, I'm good to go. If not, I might need to toss a level shifter in there...

UrticantOwl said:
A thread popped up yesterday that seemed to be relevant to this one.
KF Serial Port
Apparently you all were right about it being at the 4 pads on the right side... but what next?
Click to expand...
Click to collapse
ttabbal said:
Now we need kernel devs to connect up to it and get the 3.x Android kennel booting. Hashcode said he's getting the gear for it. I've got some stuff that should work, so I might get into it as well. I'm pretty busy though, so not sure how much I can contribute...
What's the voltage level this CPU uses for serial? 1.8? If it can take 3.3 on those pins, I'm good to go. If not, I might need to toss a level shifter in there...
Click to expand...
Click to collapse
OP in the thread link UrticantOwl posted said 3.3v and I plan on getting the gear soon. Probably from sparkfun or something.

Related

[MOD] Pogo Pin Charging for Verizon Car Dock

I posted this earlier in the long thread about the official car dock with pogo pins that has still not been released but I don't want to derail the main topic of that thread so here is a new one, with a bit more detail added.
I have the steps that I actually took to do this listed below. I think there is probably room for improvement and many ways to accomplish the same end result depending on whatever strong skills you may have or what tools you happen to have. Not every step has a picture associated with it because either I couldn't hold a camera and do it at the same time or it just wasn't worth it to photograph a mundane task like tracing a line.
Also, keep in mind I was doing this for a GSM nexus. I can test whether an LTE nexus (both standard & extended battery) will charge in the dock sometime on Tuesday or Wednesday.
Tools & materials used are described throughout. After the steps/pictures I have some concluding thoughts including some lessons learned, things I would do differently, and some alternate ideas others might wish to consider.
DISCLAIMER: Bad photography ahead.
Step 1: Grab a good beer, somehow these things always take longer than you expect.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Step 2: Tape the phone & dock where you will be measuring with a caliper or holding it in a vise. I used masking tape which turned out to have the extra benefit of being able to see the contact points through it. Take a lot of measurements. You end up drilling the dock blindly so your results all start in how carefully you measure things. Don't use the numbers on my caliper for your own use... Somewhere around the time of these pictures I accidently zeroed the caliper so I don't know which ones are showing correct values or not. I only realized this because I measured everything again and realized something wasn't right with the numbers.
Step 3: Double check your measurements, make sure everything is square... I want to say the following picture is over board on my part... but it really is a fine line between making contact b/w the pins and the phone 100% of the time, 50% of the time, or hardly ever.
Step 4: I used a pencil to trace a line from the contacts up the side of the phone, and onto the front glass. I then place the phone in the dock and put a new piece of tape from the edge of the phone around the edge of the dock and traced the line back over the dock so that I had a good reference for where to drill in the side-to-side dimension. The vertical dimension was purely based off my measurement from the face of the phone down to the contact points. Because the glass is curved, take separate measurements for each pin.
Step 5: At this point I used a 1/16" drill bit to make two holes and then pushed the pogo pins through. Before proceeding I hooked up 5V power using aligator clips to the pins and put the phone in the dock just to make sure everything was in the right place before I really made anything permanent. In this picture the pins are only held in place by friction. The dock is very rubbery at this location which is nice for holding the pins in place. You can see how well you lined up the holes by placing the phone in the dock and looking through the holes. You absolutely want to see the entire gold contact nicely centered in there. If not, fix things now before proceeding.
Step 6: I then took a car charger and cut the micro USB end off. There really isn't much to picture here. I happened to use a car charger with a permanently attached cord so there were no data wires. If you use a USB cord that contains 4 wires, usually red, green, white, and black, just tape off the green and white (date + & data -), and use the red (+ 5V DC) and black (ground). The pogo pin closest to the power button is the ground and the pin closest to the bottom is for 5V (I confirmed this for both the LTE & GSM models). Middle pin, assuming the same paradigm used for the nexus one, is for signaling the type of dock and the bluetooth id of the dock.
Step 7: I soldered the 5V and GND wires to the pins as described, sealed some exposed conductor with heat shrink, and used an epoxy to permanently seal them in place. You want to make sure you use an epoxy that bonds plastic and I would also recommend one that advertises some level of flex/gel. If it's too rigid or poorly bonded to plastic you could end up cracking off on the very first insertion. Make absolutely sure that the pogo pin plunger is the only part of the pogo pin that is on the inside of the dock. Even a small portion of the rigid part will cause you problems when you push the phone in and it pops the pins back out or damages the epoxy.
So, did it work...
After waiting enough time for the epoxy to set I got what I had hoped for.
I also added an NFC tag to the inside that I'm using to turn on bluetooth, set car mode, etc, etc...
Here's a few extra pics:
It successfully charges my GSM nexus with both the standard and extended battery. It would appear to me that the dock holds the phone with the position of the front glass relative to the lip of the dock in a constant position. So I'm assuming my wife's LTE nexus will be able to charge on the dock as well (will test on Tuesday/Wednesday). That would be really good news for VZW people who aren't up to the modification but would like to buy the GSM dock if it ever comes to market. At this point at least, it can concluded that it's possible to make a dock that charges the GSM model with both the standard and extended battery with the pogo pins in a fixed position.
Now that it's been done once the thing that would make this an extremely fast and easy mod in my mind would be a drill guide jig. An L-shaped jig with drill guide holes that you simple place against a reference point on the dock and drill in the holes and never have to worry about all that measuring and how well you measure.
I also wish I hadn't soldered the pins to a fixed car charger. Now I'm tied to that thing unless I want to cut the cord and splice a new USB plug on the end. In hindsight I actually wish I had used a 2 conductor "boot" close to the pogo pins that would allow me change the cord easy and provide some level of emergency strain relief or break-free ability if the cord were to get yanked. On the topic of strain relief, this is why I recommend right angle leads off the pogo pins. It also might be a good idea to adhere the cord to a spot on the back of the part that holds the phone so that a snap tug on the cord pulls on that and not your pogo pin connection. It feels very durable and I don't expect any problems it's just something I would recommend.
As for the NFC tag, I would use the thin adhesive tags, you don't want anything thick enough to change the contact position. I used a 1K tag so that there was plenty of storage for long instructions/information that may be handy to write to it. Right now it just launches car home, maxes the media volume, starts bluetooth, turns off wifi, and sets a high brightness level.
Finally, I wish I had gone ahead and installed a middle pogo pin with a free hanging wire lead off of it. Just in case I felt up to going down that rabbit hole in the future. I wish I still had a nexus one dock around to see if the signal pin on those docks would communicate on the galaxy nexus middle pin. I know, different OEMs (HTC) but the code is Google's so I figure there's a 50/50 chance it actually would work.
Your move, Samsung.
Definitely going to try this. Where'd you get the pogo pins?
Also, the third pin ::should:: be shorted to ground to trigger car dock, if that's the purpose of it.
Keep in mind that the OEM GSM dock plays music through those 3 pins somehow, though it makes no sense to me whatsoever. Not enough pins.
Jewremy said:
Definitely going to try this. Where'd you get the pogo pins?
Also, the third pin ::should:: be shorted to ground to trigger car dock, if that's the purpose of it.
Keep in mind that the OEM GSM dock plays music through those 3 pins somehow, though it makes no sense to me whatsoever. Not enough pins.
Click to expand...
Click to collapse
The stock docks play the audio over bluetooth since it'll help alleviate any grounding issues/hiss that may occur. One of the reasons they cost so much.
Jewremy said:
Definitely going to try this. Where'd you get the pogo pins?
Also, the third pin ::should:: be shorted to ground to trigger car dock, if that's the purpose of it.
Keep in mind that the OEM GSM dock plays music through those 3 pins somehow, though it makes no sense to me whatsoever. Not enough pins.
Click to expand...
Click to collapse
Shorting to the ground is definitely not how the dock pin worked for the nexus one. Audio is also definitely not over the pin, its by Bluetooth. I've seen the code somewhere that insinuates the dock identifies whether it is a car or desk dock and its Bluetooth MAC. Shorting to ground isn't going to do anything.
Jewremy said:
Definitely going to try this. Where'd you get the pogo pins?
Also, the third pin ::should:: be shorted to ground to trigger car dock, if that's the purpose of it.
Keep in mind that the OEM GSM dock plays music through those 3 pins somehow, though it makes no sense to me whatsoever. Not enough pins.
Click to expand...
Click to collapse
Pogo pins were left over from some other project. Take a look at digikey or someplace like it. Might have to search for "spring contacts" or "pogo pins/contacts".. different vendors seem to use different terminology.
Hmm i don't understand the north to south measurement couldn't you extend the marks around the tape to get the height and the all you need is the distance from the top... not sure if that makes sense
The NFC tag can be hidden behind the glossy cover for the mount attachment. It's only held on by two all adhesive strips that run along the long edges of it.
Sent from my Galaxy Nexus using xda premium
mcso619 said:
The NFC tag can be hidden behind the glossy cover for the mount attachment. It's only held on by two all adhesive strips that run along the long edges of it.
Sent from my Galaxy Nexus using xda premium
Click to expand...
Click to collapse
Good idea, I sort of like it exposed right now but I think I'll eventually do that.
veli69 said:
Hmm i don't understand the north to south measurement couldn't you extend the marks around the tape to get the height and the all you need is the distance from the top... not sure if that makes sense
Click to expand...
Click to collapse
Unfortunately I'm not sure I understand what you're describing. I'd like to know because I'm certain there are some clever and better ways then my own.
If you extend the holes with a pencil to top side of the phone on the tape when you put it in the doc you know their location, then all you need is your measurement from the top and you are all set.. I dont have a laser like yours though
Great work! Which dock did you use for this?
veli69 said:
View attachment 899531
If you extend the holes with a pencil to top side of the phone on the tape when you put it in the doc you know their location, then all you need is your measurement from the top and you are all set.. I dont have a laser like yours though
Click to expand...
Click to collapse
Oh, I did that. Guess I didn't explain it better.
nmprodan said:
Great work! Which dock did you use for this?
Click to expand...
Click to collapse
The Verizon galaxy nexus dock.
http://search.digikey.com/us/en/products/0930-0-15-20-75-14-11-0/ED90344-ND/1873757
Would a pin like that work?
mca312 said:
http://search.digikey.com/us/en/products/0930-0-15-20-75-14-11-0/ED90344-ND/1873757
Would a pin like that work?
Click to expand...
Click to collapse
yea, that looks good. Actually looks shorter than the ones I used so I think it might be even better than the ones I used. Just did some searching on that site and found some that look similar to the ones I used http://search.digikey.com/us/en/products/829-22-003-20-001101/ED90504-ND/2416224. Looks like they come in a connector already but they're easy to remove from those kinds of connectors by just pushing the pins out. I like the style you found though. Ideally you don't want the lead part sticking out too far from the dock for a clean look so a pin that's just a hair bigger than the thickness of the side-wall of the dock is best. I say go with one of the style you posted over the ones that look similar to what I used.
Mil-Max (the mfg in the digikey ad) will send out a few samples. I got 20 to try and make my version of this.
What device is making the laser lines?
Would these work so you could have connectivity to all 3 pogo pins? I'd like to be able to play audio as well as charge the phone.
http://search.digikey.com/us/en/products/811-22-003-30-000101/ED8110-03-ND/682271
chuckdz3 said:
Would these work so you could have connectivity to all 3 pogo pins? I'd like to be able to play audio as well as charge the phone.
Click to expand...
Click to collapse
I *think* that might work. I grabbed a set of (older analog) calipers to measure the pogopins on my LTE GNex and found some estimates. It looks to me that the pogopins are spaced ~.112" apart (from center to center) and are ~.042" in diameter. The pins you found on digikey list the spacing between each pin to be ~.100" apart (from center to center) and ~.042" in diameter.
With those measurements in mind, there would be some slight overlap of the outer two pins onto the plastic casing but the pins would likely still strike the connector on the phone.
Keep in mind though that a number of users have noted that the center pin is not used for audio. I have no personal knowledge of this but I am passing the info along. Apparently audio is passed via bluetooth to a receiver in the mount which converts it to a line level output that is seen on the mount itself.
(Also, I guess I cannot include the hyperlink you had because I am too new to xda)
Update: I stand corrected, as noted later in this thread the spacing is .118" for the GNex pogopins. Apologies for the misinformation.
The GN pogo pin spacing is 3mm (.118"). The All the Digi-Key pins mounted in strips seem to be .1" spacing which I think will be marginal, or at least make the position of the pins really critical.

POGO Pins reverse engineering - UPDATE!!!

What we found so far..
Pins counted from bottom of the phone:
1. - GND
2. - Audio Dock output
3. - Audio Dock
4. - Dock ID
5. - Re-charge
Pins functions:
1. - GND: It's a common ground of the phone. Using as "-" while charging, GND or COM for audio signal, physically connected to pin5 [GND] on microusb port
2. - Audio Dock output: In dock mode - analogue audio output (channel left) while playing music. When phone is triggered in dock mode, it can be used to play audio on earphones or connect to external amplifier. During phonecall : speaker out [mono]. In car dock mode - not testet yet. Data transmition - not tested yet.
3. - Audio Dock : In dock mode - analogue audio output (channel right) while playing music. When phone is triggered in dock mode, it can be used to play audio on earphones or connect to external amplifier. During phonecall- [not tested yet]. In car dock mode - not testet yet. Data transmition - not tested yet.
4. - Dock ID : Pin used to informing phone what is connected to it (resistance checking). Working only when pin 5 is connected to +5 volt and pin 1 to GND (when phone is on charging). Connecting pin 4 to GND with resistor 10kOhm trigerring car dock mode (resistor have to be connected all the time). Connecting resistor 1,1kOhm trigerring dock mode, don't have to be all the time, ones dock mode is on, resistor can be disconected, phone will stay in dock mode until power (+5v to pin 5) is connected.
5. - Re-charge : Physically connected to pin1 [VBUS] on microusb port. It's used to charge phone by connecting +5 volt. This is USB charging (500mA max), I'm trying to figured out how to force AC charging on it, but may be not possible, maybe HTC has blocked this funcionality because it can be danger for pogo pin ( 1 A throughput).
Post will be updated when we'll find out something more.
Thanks to: @pehkblui , @neovius and all others trying to help
good post !
I will be following this thread, Sorry I don't have the technical know how to figure out how it works, but if you can get the wiring I do have the tech ability to build one... I am going to buy some pogo pins off ebay and make a dock for my bedside table...
graymonkey44 said:
Fixes for Internal Memory and External SD card are at bottom of post!
May be easier to make a completely new thread instead of people searching through the "s-off discussion" thread.
I'm going to make a huge SD Card post right at the top because it seems like people still are overlooking it in the "s-off discussion" thread... Not trying to be a ****, just making sure people don't lose crucial information on their SD cards...
Don't forget this will format your SD card so save all your contents or use a spare!!! V.02 does not wipe Internal SD anymore.
Here's the link for Instructions:
http://unlimited.io/instructions/
Read the Instructions carefully and thoroughly at least once before attempting. This will temporarily brick your phone. Don't be lazy. Don't forget this will format your SD card so save all your contents or use a spare!!! I used my old 2GB droid incredible sd card for mine...
Some notes:
Make sure back cover is off before running program.
Plug in phone before running program.
Boot phone into ROM before running program, it will automatically boot into fastboot by itself.
Don't do wire trick until after you run the program and tells you to do so!!!
Make sure you have "USB debugging" enabled!
If in Windows, right click program and make sure you click "Run as Administrator"
This post sums up everything nicely...
http://forum.xda-developers.com/showpost.php?p=25154023&postcount=1289
Here's link for wire trick:
http://unlimited.io/htc-rezound/
Wire Tips:
22ga wire fits almost perfect in the lower hole.
Use a piece about 8 inches long and stripped the end for the lower contact about 3/8 of an inch and the other end just a small amount. Did this to two phones and it worked the first time both times.
It was reported that the large coated paper clips work well too.
Others are using odd objects or other weird improvised wires and having a lot of trouble. It seems to be one of the big sticking points.
I honestly used a paperclip and it worked just fine. Not even insulated... even though they don't recommend it: you could use it as a last resort.... or wrap it with an insulated material. I didn't know the paper clip had to be because I was one of the beta testers.
Don't make this mistake either.
If you're not getting it after wire trick, keep trying! Timing is crucial!!!
Don't forget this will format your SD card so save all your contents or use a spare!!!
Picture of Points:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Video of Wire Trick:
New ICS hboot should be included in the download now.
http://forum.xda-developers.com/showpost.php?p=25147001&postcount=1141
Pretty much copied everything off the site, but it may be easier to use instead of switch tabs/windows... Good Luck...
Disclaimer: I am not responsible for bricked devices or anything happening to your handset!!!! Just relaying the message
If you're still having issues... The search button is your friend. There's a high chance your problem has already been solved. Either search this thread or the discussion of s-off thread.
Oh yeah... ENJOY S-OFF!!!!!
These guys put in a hell of a lot of effort into doing this process... Any donation would be greatly appreciated!
Donate to JuopunutBear Team!!!
Click to expand...
Click to collapse
..this could be interesting?
On the HTC rezound they achieved s-off by pulling off the back cover, taking a wire and short out to pins.
Trying to find good pictures of the One X with back cover off to see if there is a PIN1.
jires said:
What I found so far..
Pins counted from bottom of the phone:
1. - GND
2. - ? (resistance 40 Ohms to COM, audio out?)
3. - ? (resistance 40 Ohms to COM, audio out?)
4. - +1,8V constant voltage when phone turned on (data?)
5. - V+ (charging)
Post will be updated when I'll find out something more.
Can someone make oscilloscope measurements of pins 2,3,4?
Click to expand...
Click to collapse
Just probed 2,34 with a scope.
4 constant 1.8V.
2 & 3, there are little spikes +/-200mV at regular intervals when music or radio is playing. Maybe some form of audio output. Don't look like audio waveform to me though.
Sounds to me like its polling for status, looking to see if its docked to an audio output.Try applying a load to it to see if it starts chucking out analogue audio
Edit: Forgot to say thanks
Looking promising aye, being that the one x is a sealed unit I assumed the pins where also to be doubled up for other tasks....
Sent from my HTC One X using XDA Premium HD app
xmoo said:
Trying to find good pictures of the One X with back cover off to see if there is a PIN1.
Click to expand...
Click to collapse
I can't see any pins like those on the rezound in these fotos..
Edit: But then again i see some pins on the left of the micro sim and some more around the headphone jack...
JamesBarnes said:
Sounds to me like its polling for status, looking to see if its docked to an audio output.Try applying a load to it to see if it starts chucking out analogue audio
Edit: Forgot to say thanks
Click to expand...
Click to collapse
Maybe it's a bit like Apple's accessory where it is trying to communication with whatever is touching the pin and will only dump out the analogue audio once authenticated.
The probe itself is at least 10pF (or 50p?). That should be a load by itself. Or maybe should try connecting a small or active speaker to it.
anko184 said:
I can't see any pins like those on the rezound in these fotos..
Edit: But then again i see some pins on the left of the micro sim and some more around the headphone jack...
Click to expand...
Click to collapse
Check on the right midle of the battery. You see some small pins,three which has some kind of connection with the back cover.
j4n87 said:
..this could be interesting?
On the HTC rezound they achieved s-off by pulling off the back cover, taking a wire and short out to pins.
Click to expand...
Click to collapse
It took them around 20 days from talking about it to actually achieving S-off! I hope we can see something for the One-X coming along like this....
angusc said:
It took them around 20 days from talking about it to actually achieving S-off! I hope we can see something for the One-X coming along like this....
Click to expand...
Click to collapse
Yes but there is also a ENG SPL foe that device. I havn't seen one for the HOX.
i tried to bridge the pogo pins like its done for the unlimited.io unlock. i tried it with the gnd and data pins but it did nothing. maybe my timing wasn correct, the method was removed by htc or these are not the right pins.
xmoo said:
Check on the right midle of the battery. You see some small pins,three which has some kind of connection with the back cover.
Click to expand...
Click to collapse
Aren't those pins for the speaker?
pehkblui said:
Just probed 2,34 with a scope.
4 constant 1.8V.
2 & 3, there are little spikes +/-200mV at regular intervals when music or radio is playing. Maybe some form of audio output. Don't look like audio waveform to me though.
Click to expand...
Click to collapse
PIN4 may be an UART/SERIAL TX. UART can operate at 1.8V or 3.3V.
About the PINs 2 and 3, is it a sine or square wave?
The EternityProject Team Manager & Main Developer,
--kholk
It's unlikely that any of the pins will be outputing analogue audio. The design and price of the Dock and Car dock look very similar to the Nexus One style which made bluetooth connection to the phone. The pins are most likely for charging and possibly a device ID function to let the phone know its been placed into a car or desk cradle. With a bit of luck though these may also be multipurpose and allow some sort of direct serial or jtag type connection to the processor.
yes but nexus has only three pins right?
why on earth would htc put any kind of debug interface (jtag or uart) on a retail device?! the phone can "easily" be opened. the phone has a usb-otg cappable interface.
there is absolutly no reason for these pins to be part of any kind of debug-interface
jires said:
Can someone make oscilloscope measurements of pins 2,3,4?
Click to expand...
Click to collapse
Sure, but not before friday when I'm back home...

[Q] Am I totally bricked now???

So my FTV came in today (it was free from Giggle points... but still) - Of course, having been around Android for years and always rooting I had to look into it.
It seemed it didn't have new FW until my wife took iota upon herself to set it up and it received the newest update (Wife is an IT person as well - but not interested in hacking devices...)
So I figured, no problem - I'll use the emmc method - I ordered my adapter, but while I waited I thought I would solder up my pins, which is no issue - Soldering is easy.
All points are good, so I figured I would check it out to make sure it still powered up and booted - and low and behold, I'm stuck at the Amazon FireTV logo screen . (and the white led pulsates a bit...). The point where the resister is, I did decoder the entire resistor, so I soldered a wire on the other side and connected it to the other side. Still no luck...
Is there anything I should look at? All solder points are good .... No shorts or anything like that.....
** Edit ** I knew I needed a new solder tip - so now I think I have no more pad on the Resistor point closest to the chip - Usually the Resistors have another connection,. Does anyone know where it connects to as an alternate solder point?
Thanks for any ideas...
PensFan66 said:
So my FTV came in today (it was free from Giggle points... but still) - Of course, having been around Android for years and always rooting I had to look into it.
It seemed it didn't have new FW until my wife took iota upon herself to set it up and it received the newest update (Wife is an IT person as well - but not interested in hacking devices...)
So I figured, no problem - I'll use the emmc method - I ordered my adapter, but while I waited I thought I would solder up my pins, which is no issue - Soldering is easy.
All points are good, so I figured I would check it out to make sure it still powered up and booted - and low and behold, I'm stuck at the Amazon FireTV logo screen . (and the white led pulsates a bit...). The point where the resister is, I did decoder the entire resistor, so I soldered a wire on the other side and connected it to the other side. Still no luck...
Is there anything I should look at? All solder points are good .... No shorts or anything like that.....
** Edit ** I knew I needed a new solder tip - so now I think I have no more pad on the Resistor point closest to the chip - Usually the Resistors have another connection,. Does anyone know where it connects to as an alternate solder point?
Thanks for any ideas...
Click to expand...
Click to collapse
Not sure if i got you right, you accedently removed the pad from the PCB?. In that case it is a very importent question which one. As long as you the the firetv booting there is still a clock and and you probably just need to remove the wires you connected as they work as antennas and will confuse the signals on the busses.
If you rely lost the pad (and the firetv isn't booting at all, no blinky led no amazon logo on tv) and it depends which pad is gone. The one where the wiki tells you to solder the clock wire to or the closer to the cpu. Its unlikly that there is another pad between this one and the cpu. You may need to scratch VERY CAREFULLY some of the PCB top away to connect to the wire that lead to the lost pad.
Can you add a picture?
Thanks for the reply....
I toyed around with it last night a bit, and the boot lock must have been caused by that pad and the little connection I had - It would boot to that point but not anywhere past that. Like you said, if its not connected at all the FTV just sits there with no power.
So I can make a connection and currently my FTV works but I have put solder between the two pads. My concern is when IO get my eMMC reader, I need to remove that solder and if this is the last time I can do it (In case I lose what connection I have there) - I was hoping for a backup plan.
I thought about the trace on the PCB, but I don't see one from that Resistor - its odd, not on either side of the PCB - I wasn't sure, but doubted, it may have more than two layers?
I think I have it --- So around the same area there are 4 resistors, and I can see the traces for 3 of them, they go to a capacitor near the CPU. So I logically figured the same for the resistor I no longer have a pad for - In a meter, they theory is correct - so the resistors go to the Capacitor. If I need to, I should be able to go furthest solder pad for the resistor to the capacitor side... With any luck, I can avoid it - but I like a plan B....
PensFan66 said:
I think I have it --- So around the same area there are 4 resistors, and I can see the traces for 3 of them, they go to a capacitor near the CPU. So I logically figured the same for the resistor I no longer have a pad for - In a meter, they theory is correct - so the resistors go to the Capacitor. If I need to, I should be able to go furthest solder pad for the resistor to the capacitor side... With any luck, I can avoid it - but I like a plan B....
Click to expand...
Click to collapse
very goodm, you go for it i am rooting for you
PensFan66 said:
... it may have more than two layers?
Click to expand...
Click to collapse
I guarantee that it does.
I used to do layout and library support for a living. Now it's just the other way around. Anything with fine pitch BGAs (Ball Grid Arrays) is going to be multi-layer.
This thing has four: https://www.ifixit.com/Teardown/Amazon+Fire+TV+Teardown/23856
iff10 - . Thanks ... With any luck I can avoid it, but if that pad becomes useless, I can't lose anything trying it to the capacitor direct ...
Wellers - Yep, that makes sense - I assumed it had to ... Always a cool design, but makes finding certain paths a little difficult ....

Pumpkin Head unit dead by wiring fault. Any chances to recover it?

Hi,
i have a pumpkin HU (Model: RK3066, Dual Core, 800x600, KLD2 MCU) for my 2007 Audi A4
It now ran great with Malaysk root etc.
But yesterday i installed a rear view cam. After hours of routing the cable from back of my car to the front, i couldn´t wait to plug it in and try it.
But i only had the chinch input available. There was no available cable for the cam to switch on. So i had no idea where to connect the cable of rear parking lights.
On the wiring label on the head unit it says, there should be an orange cable for that.
But the only orange cable i found, already was plugged into the CAN-Bus adapter box.
So i thought, maybe it not needed to connect this cable, maybe the radio get the "switch on cam" signal from CAN bus.
But it didn´t.
It didn´t work at all (and yes, i enabled the rear-view cam in the settings.. that wasn´t the problem)
So i tried to connect my parking light cable to the pink "brake" cable, which also didn´t work.
And then i tried it with the only one left available cable. It was a white one, and since then... My head unit is dead...
Screen keeps beeing black.
No chance to turn it on again. holding Reset and Power buttons does not help either.
I know, this was very stupid! But i was so frustrated after all those hours disassembling the whole car, i just wanted to get it to work finally.
So i tried things without thinking...
(afterwards i found out, the solution would have been, to cut the orange/black cable that leads to the CAN-bus adapter and connect my parking light cable there. But now its too late)
Anyhow...
Does anyone have an idea what could be blown by this action? isn´t there any internal protection against short circuits?
Is it completely dead, or is there a simple way to bring it back to live?
thats the current status:
- I have checked all my car circuit breakers - all are OK
- if i connect the power harnees to the head unit, there is a short "beep"
- if i hold the power botton for a few seconds, there are three short "beep" "beep" "beep"
- the dvd-drive does work. So it ejects CDs without problems.
- also i can hear the fan of the head unit, once ignition is on.
but the screen keeps beeing black.
Any ideas, how i could get it to work again?
Or do i need to get a new one?
many thanks!
You should have powered your rear view camera from your backup tail lights and be done with it, but too late for that.
Now two critical pieces of information are missing from your post:
1. What is the label of the unit's white cable that you connected and caused it to stop working? (All the cables coming out of the unit are labeled.)
2. What did you connect the white cable to? (+12V, ground or what?)
I should have used my brain, then nothing would have gone wrong
The cable i tried to connect is the +12V from the tail lights.
This needs to be connected with the head unit to enable the rear-view screen.
The white cable isn´t labeled, nor its shown on the wiring diagram label that is attached on my unit.
Therefore i just gave it a try, as there was no other free cable available. (i can punsch myself now, for that stupid try)
I will take a photo of this white cable and the associated pin on the connector.
Maybe someone has an idea what this is usually used for, and what could be damaged now.
Do you have similar picture? (This is the one for my unit). The sticker on top of the unit has a label for every single pin on every single port that comes out of the unit. Maybe you should look there. You can see my sticker on the very top of the picture below.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Hi,
as i am a new user, i am not allowed to post photos.
Can i send it to you via message and you post it?
would be great
Sure, but you also need to specify the exact model. It is cut from the first picture and without that it will not be possible to find a pin-out diagram of the main port. All I can see is KD-C1*****. What are the letters after that?
C-V-T said:
Sure, but you also need to specify the exact model. It is cut from the first picture and without that it will not be possible to find a pin-out diagram of the main port. All I can see is KD-C1*****. What are the letters after that?
Click to expand...
Click to collapse
its a KD-C1214
(Model: RK3066, Dual Core, 800x600, KLD2 MCU)
my thinking is, i might burned some internal module or chip, that switches on the display.
As said, the fan is working, also i get "beeps" if i push the reset button.
But no matter, what i try, the display keeps being black.
Ok, this exact thing happens (booting with black screen) when the CAN bus box is not connected. So there is a chance that you have only burned your box. One thing you can try is to see if this white wire is directly connected through the unit to any of the wires of the CAN bus box. Just get a multi-meter, disconnect the CAN bus box and check for a direct connection between the white wire and any of the wires going into it (with the cable plugged in to the unit of course).
Otherwise I cannot tell what this white wire is - its not on any of the diagrams I could find. Maybe its worth a shot to ask Pumpkin.
This is your unit as far as I could tell: http://www.autopumpkin.com/pumpkin-best-7-pure-android-4-4-kitkat-plug-and-play-car-stereo-support-gps-can-bus-3g-wifi-obd2-for-audi-a4-2003-2008.html
Here are your pictures:
this one shows the wiring-label on my head unit:
http://www.pic-upload.de/view-31416762/DSC_4852_1.jpg.html
This one shows my cable coming from the tail-lights (+12V) http://www.pic-upload.de/view-31416770/DSC_4855.jpg.html
Here you can see all available free cable leads:
http://www.pic-upload.de/view-31416783/DSC_4858.jpg.html
And here, the pin location of those free leads:
http://www.pic-upload.de/view-31416787/DSC_4859.jpg.html
Ok, i did check those wires:
The white one does not "beep" with any cable on the (disconnected) can connector
But it does "beep" with four cables there, if the Can adapter box is connected:
With black
With green
With orange
With blue (but here only very short like every 3-5. Seconds)
Also:
There is +0,5V on this white cable, no matter if ignition is on or off, if CAN Box is disconnected.
And there is +2,2V on it, if Can box is connected + ignition is on
If it is not connected directly to any of the cables doing into the CAN bus box, it's unlikely that you have damaged the CAN bus box.
Ask the manufacturer to tell you what is the wire for.
If you cannot get it from them maybe it's a good idea to open it and see exactly where the pin of this wire leads to. The unit is built with "over the counter" standard IC chips and components.
I don't know, if this makes any sense... But this white cable leads to the IR sensor on the Front dash board...
How could this break my head unit???!?
Ok, thats too much for my brain today..
i now have attached photos of the pin of the IR sensor, where that white cable leads to.
its the lower pin of the IR-Sensor.
The middle pin of the IR-Sensor is ground.
And the upper pin is.... ?! i have no idea.
But anyhow...
Could a blown IR-Sensor prevent my head unit from booting?
Yes, this makes a lot of sense. I guess they provided the white wire so you can attach an external IR sensor.
The IR sensor itself is just a photo-cell that produces a small voltage when you shine light on it. Putting +12V across if would definitely have burned it. But it is also connected to an IC chip that interprets its signal and talks to the main CPU. My guess is the CPU halts while booting as soon as it fails to talk to it. This chip would have burned it as well, so you have to find it too. It would be connected to the IR sensor either directly or through a resistor. (Most likely its through a resistor in order to limit the current and protect the chip.) This connection (the one the white wire is connected to) would not terminate anywhere else, except in this chip. Look for a fairly small chip, not more than 20 pins, maybe fewer.
Once you find it, take a picture so the writing on it is visible. It would not be hard to get a replacement, since they are standard and are present in every device that has a remote control. If you are having trouble finding it, just open your remote and then look for a chip with the same manufacturer as the chips in the remote to narrow the search.
There is a chance you only burned the IR sensor if the current limiting resistor was high enough to handle 12 volts, but I doubt it. You can unsolder the IR sensor and try to boot without it. Also once unsoldered you can test it by shining a flashlight on it. It would produce a voltage between the pin that was connected to ground and the pin that was connected to the white wire. But again I don't see how the chip that interprets its signals would have survived a +12V on its input pin. The voltage the IR sensor produces is around 1V at best.
Also look for writings on the IR sensor. Without those I have no idea how to find a replacement. Both the IR sensor and its chip would cost cents to replace, the challenge is identifying them.
If you are having trouble finding it with a multimeter, you can always lookup the various chips on Google. For example from one of your pictures I can see that one of the chips is WM8731. A quick Google search tells me that this is your audio chip + CODEC provider: http://www.mouser.com/ds/2/76/WM8731_v4.9-532414.pdf
great thanks for the help and patience so far.
here are my findings:
The IR-photodiode has some letters on it:
"CHOE" or "CHQE"
here is a picture of IR-photodiode Pins:
and through some resistors, it leads to 3 pins of this IC:
i tried to google this chip, but only got to a chinese homepage with malware warnings...
oh wait, sorry.
that was too quick....
This other end of the R21 resistor leads to like everywhere. Maybe this is some kind of common 5V supply or something??!
So the burned component could also be like everywhere else, isn´t it?!
I guess i need to find the source of this common supply.
But this could also be the main MTC. This is also somehow connected. I have highlighted this with the blue lines in the attached photo.... those blue lines lead to some pins the RK3066 MTC
My hopes are getting smaller and smaller, to be able to get it to work again...
Pedaaa said:
oh wait, sorry.
that was too quick....
This other end of the R21 resistor leads to like everywhere. Maybe this is some kind of common 5V supply or something??!
So the burned component could also be like everywhere else, isn´t it?!
I guess i need to find the source of this common supply.
But this could also be the main MTC. This is also somehow connected. I have highlighted this with the blue lines in the attached photo.... those blue lines lead to some pins the RK3066 MTC
My hopes are getting smaller and smaller, to be able to get it to work again...
Click to expand...
Click to collapse
I have a different model (KD-CO235) -- no can bus. It has a brown wire for steering wheel key sensing in place of your white wire, so it is obviously quite different. However the main board looks nearly identical and includes the same R21. My main board is marked KD-HCT-MB 2015/07/18 Rev-3.1 1535 and also uses KLD2 firmware. Here's what I have:
1) R21 is 100 ohms
2) One side of R21 connects only to one pin on the CN3 ribbon connector that goes to my 8133 CPU.
3) The other side of R21 connects to V3.3, the Vcc power source for the MCU (that's the square chip marked with "IAP").
So I think you can bet that your "common supply" is the 3.3 volts for MCU power. If your white wire really does connect to the right side of R21 as you said, then you probably fed 12 volts (at least) onto your V3.3 supply through a 100 ohm resistor. Current would have been on the order of 90mA until something gave up.
It's possible that the 3.3v regulator (on my board that is U4, above and to the right of the MCU) got fried. You might check to see whether or not you still have 3.3 volts on the left side of R21. But chances are very good that you will have to replace that main board.
Pedaaa said:
oh wait, sorry.
that was too quick....
This other end of the R21 resistor leads to like everywhere. Maybe this is some kind of common 5V supply or something??!
So the burned component could also be like everywhere else, isn´t it?!
I guess i need to find the source of this common supply.
But this could also be the main MTC. This is also somehow connected. I have highlighted this with the blue lines in the attached photo.... those blue lines lead to some pins the RK3066 MTC
My hopes are getting smaller and smaller, to be able to get it to work again...
Click to expand...
Click to collapse
Ok, a couple of notes:
1. Make sure the circuit checker (beeper) on your multi-meter is not fooling you by beeping even when there is no direct connection. To be sure once it beeps, always turn in to Ohmmeter and measure the resistance, It should be no more than a 1 ohm for a direct connection.
2. Remove the IR sensor and try to boot without it.
3. Replace your IR sensor with this one (it's the most generic one I could find and it will operate both on a 3V and a 5V rail): https://www.sparkfun.com/products/10266
I could not find anything on this 5L2K7S2 or 5L2K1S2 chip. Have you tried asking Pumpkin for the schematics?
P.S. The IR sensor has 3 pins:
1 . Output (connected to the white cable)
2. Ground
3. +3V (or +5V) power.
Don't bother tracing pins 2 and 3. They are ground and power and will go to 1001 places. Only find out where pin 1 goes (the one attached to the white cable). From your pictures I can tell that you have not found where it goes. It is impossible for it to go to the IR sensor and nowhere else!
Hello guys,
thanks for that great help, but i am now giving up on it, and will just order a new one.
(Or to be honest, my girlfriend would kill me, if i would continue traceing pins all night long So i have no other chance than giving up )
I understand completely!
If you are giving up, did you try just cutting off the IR sensor?

Newbie needs a little help for KLD unit

Greetings, gurus and fellow users of android head units,
I recently took the plunge and bought myself one of these head units after much browsing of the forums and trying to read up as much as I can. The exact one is shown here: https://world.taobao.com/item/528347515585.htm?spm=a312a.7700714.0.0.3Y4Xhq#detail
For those who are unable to view the link/understand Chinese, here are some quick specs:
- 10.1 inch touchscreen, 1024x600 resolution
- RK3188
- 1GB ram, 16GB storage
- Android 5.1.1
- MTCC-KLD6-V2.97 Aug 02 2016 10:35:08
Interestingly, this is only unit I've seen so far that still comes with a DVD slot, plus it comes with an external mic, which pretty much solves the issue of the crappy internal mic that many of you have experienced in the past. Also, apart from 2 USB ports that are connected to the back of the unit, there is another USB port in front, just to the right of the sd card slot and below the DVD slot.
All went well with this head unit, but there are some minor issues that I would like to ask for your help or guidance:
- 3G USB dongle is not stable - If I turn on the unit with the dongle attached first, it does not work at all. If I attach it after the unit completes booting, it sometimes will lose 3G connectivity. I have downloaded the mobile network settings app and removed all but 1 APN. Searching on the forums tell me this should pretty much be a power issue. I'm currently looking around to see if I can find a USB hub that accepts 12V DC power so I can connect to the ACC circuit and see if the issue goes away. If anyone has any other suggestions, please feel free to let me know.
- Custom firmware - I decided to try Malaysk's rom from here: http://forum.xda-developers.com/showpost.php?p=69114366&postcount=691 however, it didn't work. After updating the firmware from sd card and wiping the data/cache/etc a couple of times, all I got after rebooting the unit was a black screen and an unresponsive status bar. Booting into recovery shows me the "Block device required" message and a bunch of others that I've forgotten. Fortunately, I was able to restore via USB to a newer version of MTCC-KLD6 firmware posted here: http://forum.xda-developers.com/showpost.php?p=69206883&postcount=165 and everything still works. However, I would still like to try Malaysk's rom, and possibly in the future try 7floor's sound mod.
- Steering wheel control - According to the shop where I went to get my unit installed, my 2007 Subaru Impreza comes with only 1 wire for swc. Using the default Key Study app I was able to map the vol+, vol-, mute, mode, previous ( |< ) and next ( >| ) keys successfully. However, I noticed that sometimes, the keys would not work. Also, the unit sometimes confuses the vol+ and mute signals. Is there anything I can do to make this better?
- Screen dimming - Is there any way to dim the display brightness using the signal from the car's lights? Currently, the soft touch buttons along the left edge of the display will light up automatically when I switch on the headlights, and go dark when I turn the lights off, but the display brightness does not change. End result, I have a screen that is either too bright at night, or too dark during the day.
Many thanks in advance to all who give me suggestions and answers to my questions above. :good:
firefly_hm said:
- 3G USB dongle is not stable - If I turn on the unit with the dongle attached first, it does not work at all. If I attach it after the unit completes booting, it sometimes will lose 3G connectivity. I have downloaded the mobile network settings app and removed all but 1 APN. Searching on the forums tell me this should pretty much be a power issue. I'm currently looking around to see if I can find a USB hub that accepts 12V DC power so I can connect to the ACC circuit and see if the issue goes away. If anyone has any other suggestions, please feel free to let me know.
Click to expand...
Click to collapse
Igave up on using a 3G modem and started using a cheap USB 3G hotspot powered from the lighter socket. The headunit connects to it through WiFi and that's it.
firefly_hm said:
- Custom firmware - I decided to try Malaysk's rom from here: http://forum.xda-developers.com/showpost.php?p=69114366&postcount=691 however, it didn't work. After updating the firmware from sd card and wiping the data/cache/etc a couple of times, all I got after rebooting the unit was a black screen and an unresponsive status bar. Booting into recovery shows me the "Block device required" message and a bunch of others that I've forgotten. Fortunately, I was able to restore via USB to a newer version of MTCC-KLD6 firmware posted here: http://forum.xda-developers.com/showpost.php?p=69206883&postcount=165 and everything still works. However, I would still like to try Malaysk's rom, and possibly in the future try 7floor's sound mod.
Click to expand...
Click to collapse
The problem is with 5.1 recovery. Malaysk's latest 5.1.1 ROM from October 30 uses a 4.4 recovery and can be installed om your unit. You can also try his 4.4 ROM or @dsa8310 5.1.1 ROM
firefly_hm said:
- Steering wheel control - According to the shop where I went to get my unit installed, my 2007 Subaru Impreza comes with only 1 wire for swc. Using the default Key Study app I was able to map the vol+, vol-, mute, mode, previous ( |< ) and next ( >| ) keys successfully. However, I noticed that sometimes, the keys would not work. Also, the unit sometimes confuses the vol+ and mute signals. Is there anything I can do to make this better?
Click to expand...
Click to collapse
1 wire is pure nonsense. You have a resistive SWC and need 2 wires, one of which is GND. Find the SWC ground wire and make sure it's connected and you'll get rid of these issues.
firefly_hm said:
- Screen dimming - Is there any way to dim the display brightness using the signal from the car's lights? Currently, the soft touch buttons along the left edge of the display will light up automatically when I switch on the headlights, and go dark when I turn the lights off, but the display brightness does not change. End result, I have a screen that is either too bright at night, or too dark during the day.
Click to expand...
Click to collapse
There is an Xposed module that will dim the screen based on time of the day.
m00n61 said:
1 wire is pure nonsense. You have a resistive SWC and need 2 wires, one of which is GND. Find the SWC ground wire and make sure it's connected and you'll get rid of these issues.
Click to expand...
Click to collapse
Indeed, there are 2 wires. The SWC signal wire is connected to the Key1 wire on the unit and the SWC ground is spliced together with the unit's ground. There is another Key2 wire which presumably is for other makes/models of cars that have 2 SWC signal wires. Our conclusion is that the unit is not sensitive enough to sense the differences between the mute signal and the vol+ signal. All other SWC functions are operating normally though.
Another issue that I forgot to mention earlier, for some reason the GPS apps that I'm using (Waze and Maps.Me) are unable to automatically switch to night mode display of the maps when night comes. Any ideas as to why this is happening?
firefly_hm said:
Indeed, there are 2 wires. The SWC signal wire is connected to the Key1 wire on the unit and the SWC ground is spliced together with the unit's ground. There is another Key2 wire which presumably is for other makes/models of cars that have 2 SWC signal wires. Our conclusion is that the unit is not sensitive enough to sense the differences between the mute signal and the vol+ signal. All other SWC functions are operating normally though.
Another issue that I forgot to mention earlier, for some reason the GPS apps that I'm using (Waze and Maps.Me) are unable to automatically switch to night mode display of the maps when night comes. Any ideas as to why this is happening?
Click to expand...
Click to collapse
Your conclusion is ..., how should I put it? Not right?
Ground key2. It's a resistive matrix for **** sake. It's not a MOS-FET preamp.
m00n61 said:
Your conclusion is ..., how should I put it? Not right?
Ground key2. It's a resistive matrix for **** sake. It's not a MOS-FET preamp.
Click to expand...
Click to collapse
That was what I interpreted from your first post - SWC signal to Key1, ground to Key2. However when I tried that, the unit was totally unable to detect any SWC signal at all. On closer inspection of the wires on the unit, both Key1 and Key2 wires were marked as 5V. With SWC signal to Key1 and ground tied to unit ground, I was able to get SWC to work, albeit intermittently.
firefly_hm said:
That was what I interpreted from your first post - SWC signal to Key1, ground to Key2. However when I tried that, the unit was totally unable to detect any SWC signal at all. On closer inspection of the wires on the unit, both Key1 and Key2 wires were marked as 5V. With SWC signal to Key1 and ground tied to unit ground, I was able to get SWC to work, albeit intermittently.
Click to expand...
Click to collapse
Looking at the unit pictures it seems it has a CANBUS decoder, which explains Key1 and 2 both marked as 5V. And your car seems to have CANBUS. Not sure if Subaru also used it for SWC though, you will need the schematics. If this is the case you need to enter Factory settings (use 126 as password) and, under the Application tab select the proper CANBUS setting. But then, both wires need to be connected. I presume you did not get a proper harness but the zillions of wires as in the picture so I suggest you get the proper one for your car. It will probably be easier to get a standard ISO wiring for the unit and a ISO/car connector adapter wiring.
m00n61 said:
Looking at the unit pictures it seems it has a CANBUS decoder, which explains Key1 and 2 both marked as 5V. And your car seems to have CANBUS. Not sure if Subaru also used it for SWC though, you will need the schematics. If this is the case you need to enter Factory settings (use 126 as password) and, under the Application tab select the proper CANBUS setting. But then, both wires need to be connected. I presume you did not get a proper harness but the zillions of wires as in the picture so I suggest you get the proper one for your car. It will probably be easier to get a standard ISO wiring for the unit and a ISO/car connector adapter wiring.
Click to expand...
Click to collapse
I've look through the service manual, the SWC controls are connected to the CAN communication system, but I'm not sure how this works. Will research this further, thanks.
In other news, I've managed to get Malaysk's latest firmware running on my unit, like you said it's due to the recovery. Many thanks for that. One thing I've noticed, the blank screen button in the status bar no longer works (The one near the return button on the right, not the screensaver button on the left). Is this normal?
Also, do you have any idea on the navigation apps map night mode issue?
firefly_hm said:
I've look through the service manual, the SWC controls are connected to the CAN communication system, but I'm not sure how this works. Will research this further, thanks.
Click to expand...
Click to collapse
Something like this should help
firefly_hm said:
In other news, I've managed to get Malaysk's latest firmware running on my unit, like you said it's due to the recovery. Many thanks for that. One thing I've noticed, the blank screen button in the status bar no longer works (The one near the return button on the right, not the screensaver button on the left). Is this normal?
Click to expand...
Click to collapse
Check the mtc-status bar module in xposed (and mtc-statusbar.ini). It could be disabled
firefly_hm said:
Also, do you have any idea on the navigation apps map night mode issue?
Click to expand...
Click to collapse
No idea. Apart from app configuration settings - night mode may be disabled.
firefly_hm said:
That was what I interpreted from your first post - SWC signal to Key1, ground to Key2. However when I tried that, the unit was totally unable to detect any SWC signal at all. On closer inspection of the wires on the unit, both Key1 and Key2 wires were marked as 5V. With SWC signal to Key1 and ground tied to unit ground, I was able to get SWC to work, albeit intermittently.
Click to expand...
Click to collapse
From what I have seen of the MCU code itself, I don't think that Key2 is meant to be a ground reference for Key1. They are both handled the same way in the code -- as separate analog inputs. When they change and become stable, the MCU sends a message to the Android cpu. So if Key2 is being used as a reference it has to be happening on the Android side of things. Looks to me far more likely that Key2 is just used for cars with more than one resistive ladder.
If your SWC keys work but are sometimes unreliable, you might try placing a small bypass capacitor across key1 to key ground. This will smooth out the signal presented to the analog input. The best value would depend on the resistance in the ladder itself, so all you can do is try some values to see if something helps. I would start with something like a .1uF or .22uF bypass cap just because they are fast and cheap. If the value is too small it will not help, & if too large the key response time may become slow. You may also have to "teach" your HU the new key values again. Might be worth a try anyway.
m00n61 said:
Check the mtc-status bar module in xposed (and mtc-statusbar.ini). It could be disabled
Click to expand...
Click to collapse
I've checked the mtc-statusbar.ini, there is no mention of this function. I'll try asking over at Malaysk's thread, but I'm afraid he might not be able to help much as well since he doesn't have a 1024x600 unit and he announced that he will be retiring.
m00n61 said:
No idea. Apart from app configuration settings - night mode may be disabled.
Click to expand...
Click to collapse
Night mode is set to auto in the navigation apps. However, they do not switch to night mode at all. Manually setting them to night mode works, but the maps become too dark for use during the day.
dhmsjs said:
From what I have seen of the MCU code itself, I don't think that Key2 is meant to be a ground reference for Key1. They are both handled the same way in the code -- as separate analog inputs. When they change and become stable, the MCU sends a message to the Android cpu. So if Key2 is being used as a reference it has to be happening on the Android side of things. Looks to me far more likely that Key2 is just used for cars with more than one resistive ladder.
If your SWC keys work but are sometimes unreliable, you might try placing a small bypass capacitor across key1 to key ground. This will smooth out the signal presented to the analog input. The best value would depend on the resistance in the ladder itself, so all you can do is try some values to see if something helps. I would start with something like a .1uF or .22uF bypass cap just because they are fast and cheap. If the value is too small it will not help, & if too large the key response time may become slow. You may also have to "teach" your HU the new key values again. Might be worth a try anyway.
Click to expand...
Click to collapse
Thanks for the suggestion. Based on what I've found, the ladder for my car looks something like this:
No buttons pressed: Approx. 4.7k ohms
Mute: Approx 22 ohms
Vol+: Approx 90 ohms
Vol-: Approx 200 ohms
Mode: Approx 360 ohms
Seek >: Approx 690 ohms
Seek <: Approx 1.5k ohms
My colleague has suggested that perhaps 22 ohms is too little for the unit to sense properly and adding a resister of say 500 ohms to Key1 may solve the issue.
firefly_hm said:
Based on what I've found, the ladder for my car looks something like this:
No buttons pressed: Approx. 4.7k ohms
Mute: Approx 22 ohms
Vol+: Approx 90 ohms
Vol-: Approx 200 ohms
Mode: Approx 360 ohms
Seek >: Approx 690 ohms
Seek <: Approx 1.5k ohms
My colleague has suggested that perhaps 22 ohms is too little for the unit to sense properly and adding a resister of say 500 ohms to Key1 may solve the issue.
Click to expand...
Click to collapse
firefly_hm said:
I've look through the service manual, the SWC controls are connected to the CAN communication system, but I'm not sure how this works. Will research this further, thanks.
Click to expand...
Click to collapse
If your SWC is through CAN BUS then it is not a resistive ladder.
Maybe you should start here to understand how this works.
m00n61 said:
If your SWC is through CAN BUS then it is not a resistive ladder.
Maybe you should start here to understand how this works.
Click to expand...
Click to collapse
This is the diagram that is shown in the service manual for my car. As you can see, it is a resistive latter, and it is also connected to CAN:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
firefly_hm said:
This is the diagram that is shown in the service manual for my car. As you can see, it is a resistive latter, and it is also connected to CAN:
Click to expand...
Click to collapse
The fact that both the SWC wires and the CAN BUS module connect to the audio board doesn't mean SWC is connected to CAN BUS. Anyway, have fun with your unit.
firefly_hm said:
...Thanks for the suggestion. Based on what I've found, the ladder for my car looks something like this:
No buttons pressed: Approx. 4.7k ohms
Mute: Approx 22 ohms
Vol+: Approx 90 ohms
Vol-: Approx 200 ohms
Mode: Approx 360 ohms
Seek >: Approx 690 ohms
Seek <: Approx 1.5k ohms
My colleague has suggested that perhaps 22 ohms is too little for the unit to sense properly and adding a resister of say 500 ohms to Key1 may solve the issue.
Click to expand...
Click to collapse
Here are some more details about the SWC algorithm that may help your colleague. This is based on what I see in the MTCB-KLD2-V2.77 MCU, but is also true in MTCC-KLD6-V2.91 as far as I have seen, so I suspect it is common to most MTCB & MTCC MCUs.
The MTCD MCU is a different processor altogether so this does not necessarily apply to those.
The A to D converter is 10 bits with a voltage range of 0 to 3.3v. Conversions are triggered every 1.1 mSec and each conversion takes about 49uSec. To accommodate a wide range of ladder impedance, the MCU sequentially applies 3 different bias currents to the ladder and reads the voltage present with each one. It adds the 3 readings together to form a composite value. Three of these composite readings are averaged together to form the final value, and to detect stability of the signal. The 3 bias levels are
With key bias 1 and 2 both off:
Key 1 input pulled up to 3.3v with 22k
Key 2 input pulled up to 3.3v with 22k
With key bias 1 on:
Add 2.2k pullup to Key 1 input
Add 2.2k pullup to Key 2 input
With key bias 2 on:
Add 470 ohm pullup to key 1 input
Add 470 ohm pullup to key 2 input

Categories

Resources