here's a mystery :
while not connected to the charger (althogh the battery is charged) the BA will not turn on.
if i plug it to the charger, it then wakes up and starts as if it was hard reset but wether i wait for 20 seconds and do nothing (just keep looking on the "Windows Mobile ...tap the screen to....") or proceed with the touch screen alignment untill it gets to to setting up the device - it all of a sudden hard reset again !!
any idea any 1 ? what could that be ?
OK, I solved the problem
After thinking for a while on the matter and after looking in the hardware specs at WIKIS link ( http://www.electronicproducts.com/whatsinside/viewteardown.asp?filename=HTC_XDA_III_web.html )
I came across a fuse which was burnt - I replaced it and VOILA !!!
the device is once again operational.
attached is the picture of the fuse.
i hope it will help anyone who has a similar problem.
enjoy, yol.
Are you sayin that there is a fuse that you DONT need to solder in there?
I had a look at that page and got no were.
Did add the link to wiki techy section
Basicly, this a soldered SMD fuse. i took the wire out of a 2A regular fuse and solder it to the burnt SMD fuse as i curently dont have a fuse like the original one (i made this just for checking it solves the problem - which it does) - i will get a fuse like that on thursday and replace it with the bad one.
MDAIIIUser, I think there should be a page or a section that has to do more with hardware and technical stuff, a page that will gather this kind of information from all users...
Yol
Well I for one won't be doing that upgrade as I have enough problems getting my eggs in the pan for breakfast.
Wiki is the place for that
Info on how to do a page is here
http://wiki.xda-developers.com/index.php?pagename=BA_Wiki_Development
Example of a wiki page on that same page
http://wiki.xda-developers.com/index.php?pagename=Wiki_Fromat
I have a small problem with my BA. Somehow it started making some strange high frequency (buzzing) noise. Before last few days it was working very good with each ROM I installed. First I thouhgt that the source of mentioned noise is the speaker, but I was wrong. Source is in the bottom of device, somewhere beneath the screen, just above the mail button. Now, even when it just lies down on the table, screen flashes, and noise starts and some how turns off after 30, 40 seconds all by itself. Also, my battery life is reduced from two days to less than 1 day as a result of this issue. I dont know what shuld I do? Can anyone help me?
Specs please
How old is the device ?
Are there dark (or darker) spots at the edge(s) of the screen ?
Have you run the device at maximum lighting level ? - How long until the Backlight goes to powersave ? ... etc.
I assume - lacking further information - that the lighting is failing.
To my knowledge, there's a CCFL in the LCD I... that'll age over time and then show spots and flickering.
If you _can_ swap the CCFL you'll probable save your inverter ... CCFLs are relatively cheap elements (around USD 20 for 40cm which fits a 18.4" HD TFT Screen), though I have no idea how much a CCFL for the 9090 will amount to.
cf. to e.g. alibaba.com search for qtek 9090 lcd
eBay might help, too.
Good luck...
/pipedevnull
Hi there,
my problem is as shortly described in the topic.
The device drains between 50-190mA in an OFF state depending on the voltage applied.
I used a lab power supply to check it.
The procedure to measure it is:
0) perform repair using PC Companion - the device is completely clean
Model: LT18i
Android version: 4.0.4
Kernel: 2.6.32.9-perf
Build: 4.1.B.0.587
It has been upgraded from its factory version quite some time ago.
The drain problem started long after the upgrade.
1) Installed (just for formality): Battery Widget, Battery Stats Plus, OsmAnd, GPS Test, Total Commander
- the rest is usual bloatware that installs itself
1) switch off all possible functions (plane mode, WiFi OFF, BT OFF, ...)
- no alarms, no calendar notifications
2) power down the phone
3) take out battery, SIM card and SD card
4) connect power supply directly to ± battery connectors on the phone
5) no other cables connected (neither the battery)
6) apply voltage 4.2V (190mA) -> 3.0V (33mA) in 0.1V steps
Let me stress it again - the phone is in OFF state - no power button pressed, no attempt to boot it.
At this state I would consider 10mA normal, but definitaly not 200mA.
I have done a bit more measurements, but I don't think it is of use now.
As I mentioned above, the problem started suddenly, long after I upgraded to a newer OS version.
I noticed it since the phone started heating, which I could feel in the pocket.
Now, a bit about the heating. It seems that the source of it is a chip that I have identified as a Flash memory.
It sits around the top left under a metal shield when looking from the back of the phone,
after unscrewing the plastic mid-part. It is worm even in OFF state (no charger, just battery).
It gets very warm when the phone is ON and "unpleasantly" warm when there is some activity
(I actually played with the camera).
Otherwise the phone is fine. I haven't noticed any problems with it.
I use it as a navigation, SD card and SIM inserted, but no service (I mean the SIM card is inactive).
Now the actual question - is there a SW way (I mean without desoldering anything) to possibly
correct this problem? Unfortunately my suspicion is that some power management component
must have failed and it keeps delivering power.
Any help will be appreciated. It is still quite a nice device.
Marcin
I had this problem with my device as well (not as specific as yours, i didnt do any diagnostics just noticed the battery was draining even when off and the same part remained warm) which was the main reason I upgraded to an N5. Brought it to a service centre they said motherboard damage (apparently caused by water but i can't think of any instant i exposed my phone to water unless its from the humid climate here). It's not the battery because i have 2 batteries and both has the same problem, and definitely can't be fixed with software.. From 1 month trying different ROMs kernels and mods trying to fix it.
Sent from my Nexus 5 using Tapatalk
Thanks tangosierra_, I have heard a lot of bad things about "authorised" service centers (of any kind).
I heard and read a lot of users complain about their lack of competence. They would always make sure
to void your warranty by showing you mechanical damage. If there is no damage, they would say
it was caused by water - why not? Everybody sweats - right?
Looking for some info about the flash chip (it is micron nw238) I came across this blog:
theelectronicfreak.blogspot.com/2011/08/sony-ericsson-xperia-arc-teardown-and.html
It seems to have a lot of interesting info in it.
For the moment I give up. It doesn't have to be this chip and I don't have enough experience
with such small devices. Resoldering a BGA of this size is beyond my capablities
Hi folks,
it seems there's a number of those with hard bricked e98x devices. The only real solution so far is a JTAG service which often is not an option.
Unfortunately, this device though great is not so widely spread as many others, that's may be the reason why HEX file is not publicly available and you can do nothing with (as seen in Linux)
Code:
05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
on APQ8064T device (turning your device into SDCARD mode). The only chance I see so far is booting from external microSD card what you can achieve (probably) by forcing your CPU to alternate boot sequence.
Surprisingly, there's Service Manual available in Internet. It is marked as preliminary. It has interesting information about internal design of LG-E980, including data for boot configuration.
And here comes where more help needed. I personally do not have much skills and time to understand it from first glance. If some guidance and help added, I belive it's possible to accomplish the goal.
What I understand so far (please correct if it's mistake):
(1) According to the manual (page 208) the GPIO_87 is connected to 10K resistor R6023 which normally has TRUE for secure boot there;
(2) It is safe to connect CPU side of this resistor to the ground, 10K is enough to keep safe the transistor it is conneced to (Boot Config diagram on the same page);
(3) The location of R6023 is shown on page 240;
(4) This should change the boot sequence.
I want to clarify the matter even before connecting my oscillograph in. If the motherboard is blown, I loose any interest in the project, and I do not want that
Any comments are welcome.
Just in case
Just in case
yakovpol said:
Hi folks,
it seems there's a number of those with hard bricked e98x devices. The only real solution so far is a JTAG service which often is not an option.
Unfortunately, this device though great is not so widely spread as many others, that's may be the reason why HEX file is not publicly available and you can do nothing with (as seen in Linux)
Code:
05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
on APQ8064T device (turning your device into SDCARD mode). The only chance I see so far is booting from external microSD card what you can achieve (probably) by forcing your CPU to alternate boot sequence.
Surprisingly, there's Service Manual available in Internet. It is marked as preliminary. It has interesting information about internal design of LG-E980, including data for boot configuration.
And here comes where more help needed. I personally do not have much skills and time to understand it from first glance. If some guidance and help added, I belive it's possible to accomplish the goal.
What I understand so far (please correct if it's mistake):
(1) According to the manual (page 208) the GPIO_87 is connected to 10K resistor R6023 which normally has TRUE for secure boot there;
(2) It is safe to connect CPU side of this resistor to the ground, 10K is enough to keep safe the transistor it is conneced to (Boot Config diagram on the same page);
(3) The location of R6023 is shown on page 240;
(4) This should change the boot sequence.
I want to clarify the matter even before connecting my oscillograph in. If the motherboard is blown, I loose any interest in the project, and I do not want that
Any comments are welcome.
Click to expand...
Click to collapse
now??
yakovpol said:
Hi folks,
<snip>
What I understand so far (please correct if it's mistake):
(1) According to the manual (page 208) the GPIO_87 is connected to 10K resistor R6023 which normally has TRUE for secure boot there;
(2) It is safe to connect CPU side of this resistor to the ground, 10K is enough to keep safe the transistor it is conneced to (Boot Config diagram on the same page);
(3) The location of R6023 is shown on page 240;
(4) This should change the boot sequence.
I want to clarify the matter even before connecting my oscillograph in. If the motherboard is blown, I loose any interest in the project, and I do not want that
Any comments are welcome.
Click to expand...
Click to collapse
R6011 to GPIO_50 = BOOT_CONFIG_0_1_6
R6007 to GPIO_4 = BOOT_CONFIG_0_1_6
R6023 to GPIO_87 = BOOT_CONFIG_0_1_6
Shorting either side to GND via a 1k resistor should not cause any harm.
I am going to take a stab in the dark and the say 0_1_6 of the boot config is bit 0/1/6 of the boot chart, E:V:A's documentation into bootloaders should allow you to match the boot order chosen.
EDIT My PDF viewer didnt show the chart at first, displayed here for speed
Code:
Config 1 Config 0
0 0 EMER. BOOT(SDC3 FOLLOWED BY USB HS)
0 1 SDC3 FOLLOWED BY SDC1
1 0 SDC3 FOLLOWED BYSDC2
1 1 SDC1 (eMMC, DEFAULT)
Config 6
0 Secure Boot
1 Fast Boot
Secure boot can be controlled via GPIO or QFUSE, if QFUSE is used then gpio options wont matter even if stilll present on the board. Early models may have not had the qfuse blown until the device had been proven which may mean some devices will load a hex file no problem and others wont. (educated assumption)
if you are using a oscilloscope then you should watch these GPIO's at power up and also record your DMESG for changes in the PID/VID of the device,
use this code to see a live view of DMESG when devices are sending their PID/VID
Code:
sudo tail -f /proc/kmsg
use CTRL+C to stop.
I've looked into some of the sources that would have been supplied to the manufacturer for them to develop with and there is options for them to alter the fail to boot behavior except the CPU PBL, this is why having no bootloader at all might work where having a failed bootloader wont.
I suggest also try other HEX files, not all are made equal.
darkspr1te
darkspr1te said:
R6011 to GPIO_50 = BOOT_CONFIG_0_1_6
R6007 to GPIO_4 = BOOT_CONFIG_0_1_6
R6023 to GPIO_87 = BOOT_CONFIG_0_1_6
......
I suggest also try other HEX files, not all are made equal.
Click to expand...
Click to collapse
darkspr1te, many thanks for your reply!
In fact, CPU side of the diagram shows the exact name for the signals:
R6007 to GPIO_4 = BOOT_CONFIG_6
R6011 to GPIO_50 = BOOT_CONFIG_1
R6023 to GPIO_87 = BOOT_CONFIG_0
I did not notice all except GPIO_87: search through PDF file found only horizontally oriented text.
As for HEX files, I tried ALL that I could find, one by one.
yakovpol said:
darkspr1te, many thanks for your reply!
In fact, CPU side of the diagram shows the exact name for the signals:
R6007 to GPIO_4 = BOOT_CONFIG_6
R6011 to GPIO_50 = BOOT_CONFIG_1
R6023 to GPIO_87 = BOOT_CONFIG_0
I did not notice all except GPIO_87: search through PDF file found only horizontally oriented text.
As for HEX files, I tried ALL that I could find, one by one.
Click to expand...
Click to collapse
Ok, progress, sort of. We now know that R6007 is the BOOT_CFG_6 bit, aka fastboot/secure boot. This could still be controlled by a qfuse or they may have shorted to gnd this point making it secure, removing the resistor to gnd and replacing with one to 1.8v/3.3v would always force fastboot.
you should find this on the diagram and board (sorry , time my side is limited)
measure this resistor to ground with device powered . The same for the others once you have found them.
EDIT:- Manual says they are powered from Q6000, so check for the actual precence of R6007, if it's missing then that gpio does not get power and boots in secure mode not fastboot.
darkspr1te
darkspr1te said:
Ok, progress, sort of. We now know that R6007 is the BOOT_CFG_6 bit, aka fastboot/secure boot.
...
Manual says they are powered from Q6000, so check for the actual precence of R6007
Click to expand...
Click to collapse
darkspr1te, thanks again.
In fact, I checked opposite to CPU sides of R6007, R6011, R6023: resistors really exist and all are connected together to the Drain of Q6000 (exactly like on the scheme in the manual). So Q6000 controls the signal on all three of GPIOs. It means it shoud have False in normal conditions.
I am still in preparations to the actual power on. I do not have a lab and some materials (like 1K resistors) needed.
What I think is most difficult for now is that all resistors are on the back side of the motherboard, faced to the screen. I do not know how to deal with that, I want to keep screen attached during the try.
yakovpol said:
darkspr1te, thanks again.
In fact, I checked opposite to CPU sides of R6007, R6011, R6023: resistors really exist and all are connected together to the Drain of Q6000 (exactly like on the scheme in the manual). So Q6000 controls the signal on all three of GPIOs. It means it shoud have False in normal conditions.
I am still in preparations to the actual power on. I do not have a lab and some materials (like 1K resistors) needed.
What I think is most difficult for now is that all resistors are on the back side of the motherboard, faced to the screen. I do not know how to deal with that, I want to keep screen attached during the try.
Click to expand...
Click to collapse
For most of the repair nothing will show on the screen, all the interaction is done via USB, the device will function without it for your purpose.
As we know that Q6000 drain is connected to our GPIO we can assume that on power up before the cpu is taken out of reset then power will be applied.
darkspr1te
FM Radio
One more thought.
It is known that manufacturer disabled the FM radio. If someone knows which pins exactly should be disconnected from the ground, that would be nice to check if there's any chance to use them for radio. This is U29001 chip, pages 221 and 235. I see a number of pins with name starting FM_...
FM_LNAVSS = B2
FM_PLLVSS = B3
FM_LNAVCOVDD = A1
FM_VCOVSS = A2
FM_PLLVDD = A3
Who knows the meaning of them? I see that all VSS ones are grounded, including those for Bluetooth. The question is about A1 and A3.
PS Tomorrow or on day after tomorrow I'll be hopefully able to try power on.
yakovpol said:
One more thought.
It is known that manufacturer disabled the FM radio. If someone knows which pins exactly should be disconnected from the ground, that would be nice to check if there's any chance to use them for radio. This is U29001 chip, pages 221 and 235. I see a number of pins with name starting FM_...
FM_LNAVSS = B2
FM_PLLVSS = B3
FM_LNAVCOVDD = A1
FM_VCOVSS = A2
FM_PLLVDD = A3
Who knows the meaning of them? I see that all VSS ones are grounded, including those for Bluetooth. The question is about A1 and A3.
PS Tomorrow or on day after tomorrow I'll be hopefully able to try power on.
Click to expand...
Click to collapse
VSS often means ground on IC's, VDD is power for IC's
PLL is Phase Locked Loop, this often refers to a antenna tunner,
at a Guess B2,B3,A2 goto ground, A1, A3 to power.
The diagram confirms this, A1,A3 get power from VDD_LN,
B1 is labled FM_RFIN, at a guess FM antenna IN, this normal is connected to headphones via some components(not sure exactly what parts)
You would need to not only check to see if the rquired hardware is there but also have access to the API/chip to switch on the FM input then decode it via the I2C audio channel which will mean changes to the kernel (trust me there, i had same issue with a Rockchip device with FM chip)
NOTE: the page 235 shows the BGA pinouts, not all may be connected on the board.
darkspr1te
QFUSE is not used!
Some good news here.
After some preparations I finally tried to boot the motherboard with putting BOOT_CONFIG_6 to TRUE. And I could get
USB HID v1.11 Device [HID 05c6:f006]
as a result. But it doesn't stay such, it enumerates once again to 05c6:f006, then switches to 05c6:f008 and remains so.
What I did is:
Unfortunately, I do not have soldering iron tidy and small enough for putting a wire on a resistor which provides BOOT_CONFIG_6 for the CPU. So I simply took a piece of wire sodered to a resistor 1K and connected two pins on sides. While I was holding pins connected to + and CPU side of the resistor, my wife connected a USB. At the same time I was watching
watch -n1 "lsusb | grep 05c6"
and
tail -f /var/log/kern.log
What I found: 1) the battery should be attached in order to get 05c6:f006; 2) pins are not sharp enough, needles should be used; 3) I should probably change the signal on other BOOT_CONFIG_0 and BOOT_CONFIG_1 to have it booting from external SD-card.
The questions: should I hold BOOT_CONFIG_6 on TRUE during all process long, or it will be enough for a few seconds? Or should I press some buttons during the moment when I have 05c6:f006?
As for the Antenna input of U29001 MDM9215M (FM_RFIN, B1), it is next to the edge/side of chip. Theoretically it is possible to connect there a wire, because there's a gap in between motherboard and the chip. But I'm sure special tools needed here and sides are covered by glaze.
Seems to be no profit in f006
Service manual shows quite tricky booting sequence. I loose hope it this approach
What I found is hardware/software solution Octoplus/Octopus. It has surprisingly much info included, mentioning no-JTAG booting problem solution by their software with single TP used on the motherboard. I attach here the way it is described.
By doing so I did not notice any enumeration after releasing the TP.
Encouraging fact is there exists non-JTAG (almost software-only) solution .
EDIT: I realised that TP is for hard hard brick, when no 9008 device comes up via USB on boot.
yakovpol said:
Service manual shows quite tricky booting sequence. I loose hope it this approach
What I found is hardware/software solution Octoplus/Octopus. It has surprisingly much info included, mentioning no-JTAG booting problem solution by their software with single TP used on the motherboard. I attach here the way it is described.
By doing so I did not notice any enumeration after releasing the TP.
Encouraging fact is there exists non-JTAG (almost software-only) solution .
EDIT: I realised that TP is for hard hard brick, when no 9008 device comes up via USB on boot.
Click to expand...
Click to collapse
That TP could be the DAT0 test point which stop the device from actually detecting a EMMC flash and will cause it to only follow the PBL. can you give me some timings on when the device switches USB VID/PID, like 1 sec on 9006, two on 9006.
The boot happens the moment the device see's power, normally for just getting the cpu up the usb power is enough although a few times i found that was not enough and had to use battery but that may have been usb port (front are poor for power) or the desktop itself.
as the boot path is emmc - sdcard - pbl in that order, if you notice that only changing one of the boot_0/1 skips the first boot option which is emmc so only one need to be targeted, see captive dev thread on unbrickable mod to get the basic idea of that , i think i posted that link a few posts back.
darkspr1te
To be continued
Long story short: I was very busy because of my work/obligations and did not write here in April.
I needed the phone much, so I tried to find an appropriate technician where I live now. I gave the phone to him, and he requested US$80 for repair. I refused and took the phone back. Then I realized that that technician used JTAG and phone became hard hard brick (100% dead, no 9008 state or any other sign of life). Removing lot of fluxing material I discovered short circuit between two JTAG contacts. I removed it and the phone came back to the hard brick state. Meanwhile I purchased Medusa Box (along with shipping and taxes it cost me US$128) and used it for so called USB repaire (the software knows HEX and all other things needed to work with e980's APQ8064T QDL mode, no JTAG needed). The phone came back to life.
I would sniff USB bus during communication with the phone in QDL mode and continue finding a way to boot it from sdcard. And I want to get FM radio working.
A chance to get HEX file
Recently I had to use testpoint on the motherboard to enter QDL mode again. I took the opportunity to sniff USB traffic while using Medusa box for restoring the bootloader, so I hope in the PCAP files I have HEX file is present. If someone wants to help me to extract it, please let me know with a private message or give me a hint how to do it.
I recently bought one from this units and i am very happy with it (minor some cold weldings in the main board that i fixed them)
Immediately i saw that the unit in idle without running anything with Hardware Info had 50-55 celcius in a cold winder night here in Greece (5 degrees) so i opened it and from some other users that i saw here i installed a 6cm fan with a heatsink that i bought from Amazon.
The specific fan is this one and with this adhensive i set it to place.
After the installation with all my programs on (DVR, maps, radio, torque for example) the system never passes the 35 degrees which is great because my main worry is the heat here in Greece in the summer.
This fan if you go near the Head Unit has some noise if you mute the radio and you have complete silence in the car but this is not a problem for me since im not in complete silence never . If you troubled you can put a smaller fan for sure.
Also i noticed when i oppened it that the board with the PX5 that was soldered in the main board had Cold Weldings so i passed them to be sure that will not cause any trouble in time.
Finally the 2 cables that fan was needed for power the positive i had solder it to the 5th pin if you see the photo of the main output plug of the Pumpkin. This pin is the Amplifier signal. The ground i soldered it to the Sasi of the Antenna. Now when you start the unit the fan does not start till a full boot is implemented where it sends the signal to the amplifier and then the Fan starts. It doesnt matter if you have amplifier or not in your installation, the unit when is fully booted sends power to that pin.
Also there is no electrical noise because of the fan.
If you have any questions i will be glad to answer them.
Chris
great explanation
thanks !
which software did you use to monitor board temperature ?
carmelo42 said:
great explanation
thanks !
which software did you use to monitor board temperature ?
Click to expand...
Click to collapse
Sorry for the late reply. Hardware info i use.