Fairphone 3 internals - Fairphone

I started to collect some data about the internals of the Fairphone 3, including a PCB close-up and some findings regarding probe points available on the board. I'd love to get a serial console on that device and wonder which pads could be it. Search: github, k65onyx, fp3-notes.
The FP2 seems to expose the USB port via probe points. However, given the FP3 has USB-C connector and the processor used supports USB 3.1, I kind of doubt that's exposed via PCB pads. Plus, the pads L, K, I are adjacent to the MMC, not the CPU. Judging by location, it's maybe rather R, S, T that exposes an UART?
I'm a software engineer. I'd be curious about the opinion of an electronics engineer.

Do you have an oszilloscope at hand to probe R, S and T on bootup?

Matombo said:
Do you have an oszilloscope at hand to probe R, S and T on bootup?
Click to expand...
Click to collapse
user @michlx did that over on the Fairphone forum.
The R pad is apparently the Tx pin of a 1.8V debug UART:
sorry, because of new-user-spam-protection, i had to obfuscate the link:
hxxps://forum.fairphone.com/t/fp3-custom-rom-development-based-on-released-source-code/56355/160?u=corvuscorax
If I'm not mistaken, it outputs some useful aboot bootloader debug messages as well as Android Linux Kernel console output once the system has started.

Related

[INFO] i'm Watch hardware

I did some research on the internal hardware of the i'm Watch Android watch and found out a few things:
The CPU is probably a MCIMX233CJM4B or maybe a MCIMX233DJM4B (the latter is only spec'd for temperatures down to -10 C, which wouldn't be suitable for a watch) and come in BGA169 packages.
Since the CPU only has 32 KB SRAM, external RAM is needed (supported types are mDDR and DDR1) and can most likely be seen next to the 4 GB flash and the CPU itself in the presentation video on their site (3:42).
The CPU has many things built-in such as a resistive touch screen controller, 1.5W speaker amplifier. It also has a host of interfaces; SAIF (Serial Audio Interface) which according to the data sheet could provide hardware accelerated Bluetooth audio, I2C, 2x SSPs, 2x UARTs, JTAG and USB with host mode.
The circuits are split into 2 separate boards, maybe with the Bluetooth chip on the board opposite to the one with the CPU on it.
The SSPs are basically highly configurable serial interfaces and also natively support the SDIO interface, which in turn might enable us to hack in some cheap SDIO WiFi card (found out there's a TI 1271 chip which someone used with Android and a Beagle Board link). Reaching this connector might not be possible from either the hardware nor the software side, but I'm an optimist .
Data sheet for the CPU is available here, I'd recommend page 33 and 1411 to get your inspiration going.
TL;DR
CPU is narrowed down to 2 options
WiFi might be possible with extensive hacking
Djhg2000 said:
I did some research on the internal hardware of the i'm Watch Android watch and found out a few things:
The CPU is probably a MCIMX233CJM4B or maybe a MCIMX233DJM4B (the latter is only spec'd for temperatures down to -10 C, which wouldn't be suitable for a watch) and come in BGA169 packages.
Since the CPU only has 32 KB SRAM, external RAM is needed (supported types are mDDR and DDR1) and can most likely be seen next to the 4 GB flash and the CPU itself in the presentation video on their site (3:42).
The CPU has many things built-in such as a resistive touch screen controller, 1.5W speaker amplifier. It also has a host of interfaces; SAIF (Serial Audio Interface) which according to the data sheet could provide hardware accelerated Bluetooth audio, I2C, 2x SSPs, 2x UARTs, JTAG and USB with host mode.
The circuits are split into 2 separate boards, maybe with the Bluetooth chip on the board opposite to the one with the CPU on it.
The SSPs are basically highly configurable serial interfaces and also natively support the SDIO interface, which in turn might enable us to hack in some cheap SDIO WiFi card (found out there's a TI 1271 chip which someone used with Android and a Beagle Board link). Reaching this connector might not be possible from either the hardware nor the software side, but I'm an optimist .
Data sheet for the CPU is available here, I'd recommend page 33 and 1411 to get your inspiration going.
TL;DR
CPU is narrowed down to 2 options
WiFi might be possible with extensive hacking
Click to expand...
Click to collapse
does anybody have one?
karonatui said:
anybody know how to do it?
Click to expand...
Click to collapse
huh, how to do what?
I picked one up
is there a major forum discussion somewhere for this watch?
I have one (since 3 days) and i think it is too soon for this kind of products.
The software is slow, battery should be longer than at least 5 days and bluetooth it is a technology than i never like it at all. By the way, if you try to use the i'm watch as a speaker, the quality is very poor for your calls.
on the other hand, this tecnology it is beginning and i believe future will be based on this kind of products.
C u!
santjust said:
I have one (since 3 days) and i think it is too soon for this kind of products.
The software is slow, battery should be longer than at least 5 days and bluetooth it is a technology than i never like it at all. By the way, if you try to use the i'm watch as a speaker, the quality is very poor for your calls.
on the other hand, this tecnology it is beginning and i believe future will be based on this kind of products.
C u!
Click to expand...
Click to collapse
any other places where there is more talk on this watch?
it has a LOT of potential, im sure some smart folks can tweak it

Finding the serial (UART) pinout on KF

How to find the UART
Click to expand...
Click to collapse
Thanks to jamez70's, we now know where the serial pins are.
Here is where the UART pins sits on the back of the motherboard.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
(Courtesy of ifixit photo and jamez70's illustration)
The pins from 1-4 are:
RX TX GND GND (where #4 is marked)
From probing, we can detect the 1V8 level signal and the baud rate of 115200.
(Courtesy of jamez70)
If you want to hook this up, I suggest you solder on some wires to the pads and run the wires to the front, making life easier to re-assemble the KF.
Details
Click to expand...
Click to collapse
I suggest you get something like the Breakout Board for FT232RL USB to Serial for hooking this up. Note that the KF is 1V8, so when you want to connect this unit (default 3V3), you may want to use a level shifter, or simply find the VCC on the KF and loop that back that through the VCCIO on the Sparkfun-converter. Sending 3V3 directly into the KF could possibly seriously hurt it!
If you want to construct a simple voltage divider, simply get two resistors and get your soldering gun out. According to Vout = Vin * Rb/(Ra+Rb)
Voltage divider circuit (courtesy of calculatoredge.com)
Vin: 3V3
Vout: 1V8
Ra: 10 kOhm
Rb: 12 kOhm
If you need more UART details, here are some tips:
Baud: 115200
Bits: 8
Parity: None
Stop Bits: 1
Background
Click to expand...
Click to collapse
In the work to get a booting 3.0 kernel on the KF we need some low level access to debug since the USB initializes way later in the kernel sequence. I did some research on the OMAP4430 (the CPU in our dear KF) to try and find out where the UART interface might be accessed.
Looking at the datasheet we get a feeling of all the ball points ("pins") on the CPU. (Observe that this is seen from under the CPU)
OMAP4430 ball bottom layout
By then looking at the UART table TX pin numbers I try to get a feel where they might be located on the chip.
UART 1, 2, 3, 4 table
Finally, I cross referenced the UART table with TX pin and physical position on the board. The colors represent UART 1 TX, UART 2 TX and UART 4 TX. UART 3 doesn't seem likely to be mapped.
UART 1, 2 and 4 TX pin guesses
Observe that these are all estimates, but should narrow the search down (unless they're mapped somewhere way outside of the CPU area that is). I haven't had a chance of testing any of my guesses yet, but I thought I'd at least post my thoughts to get the ball running.
I'd put money on the four solder pads near the edge on the back (lcd facing) side.
pokey9000 said:
I'd put money on the four solder pads near the edge on the back (lcd facing) side.
Click to expand...
Click to collapse
Where exactly? Could you describe more in detail? If you're referring to the ones on the right, I'm pretty sure they are for the two speakers.
Courtesy of iFixit.net
I opened my attempted to probe my KF one more time today. It was a close call where I tried finding the TX amongst the bigger solder pads and a spark went off. Luckily, an unplug/plug of the battery connector booted it right up again. My probes on my multimeter are waaay to big for all the small dots. Hopefully, somebody has some more fitting equipment for the task.
csholmq said:
Where exactly? Could you describe more in detail.
Click to expand...
Click to collapse
I'd be willing to shave my pet poodle that he means the four solder pads in the middle on the right side of your image.
Buffet_of_Lies said:
I'd be willing to shave my pet poodle that he means the four solder pads in the middle on the right side of your image.
Click to expand...
Click to collapse
Yeah, I just realised that I had been flipping it the wrong way in my head The pads on that side looks very promising! I'm not sure how I'm gonna test out the pads without disconnecting everything from the board. Our best bet is probably to solder some wires and test directly on them. Won't do that on my KF atm though. Too dependant on it for my lecture slides
Yeah. I don't blame you. I'm a big fan of circuit-bending but you usually use old junky electronics, not a brand new state-of-the-art device like this. Not really willing to go near this thing with my soldering iron at this point. But something else I noticed is that on a photo of the OTHER side of that board... there's a serialnumber/MAC address sticker right smack on top of where those four solder pads are. Totally screaming in an attempt to hide where the traces are going!
Something else of interest is the closeup photo of the wifi/bt chip:
What I've long suspected is that the bluetooth isn't wired onto the motherboard. Looking at the image you posted above it's on the upper left side and darned if I don't see some empty component spaces!
Buffet_of_Lies said:
Yeah. I don't blame you. I'm a big fan of circuit-bending but you usually use old junky electronics, not a brand new state-of-the-art device like this. Not really willing to go near this thing with my soldering iron at this point. But something else I noticed is that on a photo of the OTHER side of that board... there's a serialnumber/MAC address sticker right smack on top of where those four solder pads are. Totally screaming in an attempt to hide where the traces are going!
Something else of interest is the closeup photo of the wifi/bt chip:
What I've long suspected is that the bluetooth isn't wired onto the motherboard. Looking at the image you posted above it's on the upper left side and darned if I don't see some empty component spaces!
Click to expand...
Click to collapse
I'm no kernel dev. But for those who are, it would certainly be worth looking under the sticker! Assuming the UART is TTL, I recommend getting Teensy USB dev board or something similar. Certainly helps with the debugging. I have one and it works great (it's compatible with the Arduino IDE).
csholmq said:
I'm no kernel dev. But for those who are, it would certainly be worth looking under the sticker! Assuming the UART is TTL, I recommend getting Teensy USB dev board or something similar. Certainly helps with the debugging. I have one and it works great (it's compatible with the Arduino IDE).
Click to expand...
Click to collapse
The Teensy's great, and would probably work if you're running it at 3.3V. The serial port on the Fire should be 1.8V, and the ATMEGA32U4 at 3.3V should have a suitable input threshold. I recommend though getting an FT232R breakout board from Sparkfun if you're going to be hacking serial ports onto modern embedded gadgets. I've heard that the Bus Pirate works too, but I thought the buffer doesn't go down that low.
As for missing components and bluetooth, there are only a couple of no-pop discretes, and some that look like a pull-up/pull-down select. I wouldn't count BT out just yet.
There's a lot of busted lcd kindles on ebay for cheap. Probably a good place to start.
pokey9000 said:
The Teensy's great, and would probably work if you're running it at 3.3V. The serial port on the Fire should be 1.8V, and the ATMEGA32U4 at 3.3V should have a suitable input threshold. I recommend though getting an FT232R breakout board from Sparkfun if you're going to be hacking serial ports onto modern embedded gadgets. I've heard that the Bus Pirate works too, but I thought the buffer doesn't go down that low.
As for missing components and bluetooth, there are only a couple of no-pop discretes, and some that look like a pull-up/pull-down select. I wouldn't count BT out just yet.
Click to expand...
Click to collapse
Sure, but the Teensy has analog inputs aswell. So as long as it's below 5 V you should be able to use it to read serial. Even though the KF is just at 1.8 V.
Edit: Actually, it looks like it reads high signal in above 0.7*Vcc, which makes 3.3V a no go - as with the Teensy :/ At least with proper serial communication.
In the interest of clarity, the KF is 5 VOLTS at 1.8 AMPS not 1.8 Volts..
Buffet_of_Lies said:
In the interest of clarity, the KF is 5 VOLTS at 1.8 AMPS not 1.8 Volts..
Click to expand...
Click to collapse
What? But the battery is just 3.7 V.
csholmq said:
What? But the battery is just 3.7 V.
Click to expand...
Click to collapse
I stand corrected.
Buffet_of_Lies said:
I stand corrected.
Click to expand...
Click to collapse
I see. I read your post in the other thread now. You referred to your USB charger? Yeah, that sounds about right. The KF is 1.8 Volts though.
When you talk about Amps (current) you almost always talk about "max current". I.e maximum discharge current from the battery or maximum load current from charger adaptor.
Btw, I found a great piece of looking breakout board. UART to USB micro for basically no money at all! It can be driven on either 3V3 (standard with jumper), 5V (from USB) or Vcc directly from device (1.8, 3.3 etc etc).
Now I just need to find a KF motherboard. All the broken screen units gets hogged on Ebay...
csholmq said:
Btw, I found a great piece of looking breakout board. UART to USB microUART to USB for basically no money at all! It can be driven on either 3V3 (standard with jumper), 5V (from USB) or Vcc directly from device (1.8, 3.3 etc etc).
Now I just need to find a KF motherboard. All the broken lcd units gets hogged on Ebay...
Click to expand...
Click to collapse
That's exactly the one I was referring to. I've used mine on a Nook Color and Nook Tablet (both 1.8V I/O) and it works great.
Chatted some with Hashcode on IRC. He found lines suggesting UART 3.
Code:
11:55 <@Hashcode> if ((up2->pdev->id == CONSOLE_UART)
11:55 <@Hashcode> #define CONSOLE_UART UART3
As I didn't find any dots likely to be mapped next to the CPU, this might suggest that they are actually mapped somewhere else. Easy to access maybe?
So our best bet atm are the 4 pads on the right middle back ("under" the touch controller). I would love to have a look under the MAC sticker on the top. To see if it hides something interesting.
UART 3 (serial) pads estimates. TX/RX/GND/VCC (not in order)
Chatted some more, this time with UberDuper. He gave me some hands on proof that all 4 UART are defined and UART2 is actually up and running!
I was afraid that if everything was disabled, it would severely obstruct finding the port. I'll try to get my hands on some tech as soon as I can to have a look.
# cat /proc/interrupt
Code:
102: 0 0 GIC serial idle
103: 0 0 GIC hsi_dma_mpu
104: 0 0 GIC serial idle
105: 0 0 GIC serial idle
106: 16 0 GIC serial idle, OMAP UART2
# dmesg
Code:
<6>[0.201904] omap-hsuart.0: ttyO0 at MMIO 0x4806a000 (irq = 104) is a OMAP UART0
<6>[0.202148] omap-hsuart.1: ttyO1 at MMIO 0x4806c000 (irq = 105) is a OMAP UART1
<6>[0.202362] omap-hsuart.2: ttyO2 at MMIO 0x48020000 (irq = 106) is a OMAP UART2
<6>[1.437225] console [ttyO2] enabled
<6>[1.441101] omap-hsuart.3: ttyO3 at MMIO 0x4806e000 (irq = 102) is a OMAP UART3
A thread popped up yesterday that seemed to be relevant to this one.
KF Serial Port
Apparently you all were right about it being at the 4 pads on the right side... but what next?
UrticantOwl said:
A thread popped up yesterday that seemed to be relevant to this one.
KF Serial Port
Apparently you all were right about it being at the 4 pads on the right side... but what next?
Click to expand...
Click to collapse
Now we need kernel devs to connect up to it and get the 3.x Android kennel booting. Hashcode said he's getting the gear for it. I've got some stuff that should work, so I might get into it as well. I'm pretty busy though, so not sure how much I can contribute...
What's the voltage level this CPU uses for serial? 1.8? If it can take 3.3 on those pins, I'm good to go. If not, I might need to toss a level shifter in there...
UrticantOwl said:
A thread popped up yesterday that seemed to be relevant to this one.
KF Serial Port
Apparently you all were right about it being at the 4 pads on the right side... but what next?
Click to expand...
Click to collapse
ttabbal said:
Now we need kernel devs to connect up to it and get the 3.x Android kennel booting. Hashcode said he's getting the gear for it. I've got some stuff that should work, so I might get into it as well. I'm pretty busy though, so not sure how much I can contribute...
What's the voltage level this CPU uses for serial? 1.8? If it can take 3.3 on those pins, I'm good to go. If not, I might need to toss a level shifter in there...
Click to expand...
Click to collapse
OP in the thread link UrticantOwl posted said 3.3v and I plan on getting the gear soon. Probably from sparkfun or something.

Looking for a lcd connector diagram from Repair Guide for Nexus 7 2013 ME571K

Hi,
I want to make a small project and I thought of using N7 2013 LCD because this display have full-hd resolution 16:10. I know how to hook up a previous N7 lcd (2012 aka gen1) to DVI-LVDS adapter, but I wanted higher resolution
FYI: Designing and building pcb circuit is not difficult thing to do for me so this is not issue.
I tried to get in my hands a datasheet for LCD panel but no luck. The number printed on LCD is almost different for each display photo that I found - so this is not a panel symbol.
So the point is: I would like to ask someone that have ME571K repair guide, if he/she could share with me a part (screenshot) where is a LCD connector on motherboard described (signal names, pinout, connector manufacturer & part number).
I would be really happy, I sb actually shared a more information: a whole way from CPU to the LCD panel - this would be terrific - but this a little too much to ask
saper_2 said:
I would like to ask someone that have ME571K repair guide, if he/she could share with me a part (screenshot) where is a LCD connector on motherboard described (signal names, pinout, connector manufacturer & part number)
Click to expand...
Click to collapse
Hi, I don't have the pinouts nor repair guide, but here are manufacturer & part numbers...
Just search online for lcd monitor driver board ...you will find some good results
@k23m - thanks, but actually I need a other side connector of the LCD FPC P/N the one you connect to main board:
@deadgiveaway - you mean DVI/HDMI to LVDS adapter board? I know them (and I plan to use one but this is not issue), but I'm looking at least for a pinout of LCD FPC connector or the mainboard connector to lcd FPC (on the attached photo). Without this information the "adapter board" (DVI/HDMI to LVDS) is useless. I've done some reverse engineering on the FPC connecting mainboard with LCD and I've got in result some questions, e.g.: I'm certain there is a 6 differential signal pairs, but LVDS commonly use: 4 or 8, but I found in some datasheet there might be 6 too (rare case). Also the CPU Snapdragon have multiple video interfaces: HDMI, LVDS and (the worst case for me) MIPI-DSI.
Just got an some idea, there might be some information about display interface in /sys (linux/android file system path ) on Nexus 7.
Hi,
Thanks for attempts to help me. Unfortunatly I found out looking at /sys/calss/graphics/fb0/msm_fb_type ...
Code:
[email protected]:/sys/class/graphics/fb0 $ ls
bits_per_pixel
blank
console
cursor
dev
mode
modes
msm_fb_fps_level
msm_fb_type
name
pan
power
rotate
state
stride
subsystem
uevent
virtual_size
vsync_event
[email protected]:/sys/class/graphics/fb0 $ cat msm_fb_type
mipi dsi cmd panel
MIPI-DSI interface is no good for any use for me (there is no doc publicly available...). So I'm going to use lcd from N7 2012
Ps. For interested, is possible to use LCD from nexus 7 2012. A user aBUGSworstnightmare @ Raspberrypi forum, managed to hook up LCD from N7 2012 to DVI-LVDS converter/adapter: https://www.raspberrypi.org/forums/viewtopic.php?p=1052828#p1052828
!close
Im trying to find the pinout moto x play or any other mobile displays. But I wasn't get any success
Can you tell me how did you get these pinout information
I'm doing a project on HDMI input to the display I found a module on hackaday project
Look fo service manual schematic for you phone. But almost always in displays that have resolution over 640*480 you find only mipi dsi interface. To get datasheet from manufacturer ( and MIPI DSI interface spec too ) is almost impossible [emoji3525] - unless you work for company and sign NDA with them for docs ...
Sent from my VTR-L29 using Tapatalk

Any ideas how to access vehicle information through USB socket?

I own a SEAT IBIZA car with Android Auto and Mirror-Link features.
I'm curious to know if there is a possible way to read some information Via CANBUS protocol like RPM, Speed, Oil temperature etc.
through the original USB plug and not from the OBD II.
Thanks in advance!
Chen_Gold said:
I own a SEAT IBIZA car with Android Auto and Mirror-Link features.
I'm curious to know if there is a possible way to read some information Via CANBUS protocol like RPM, Speed, Oil temperature etc.
through the original USB plug and not from the OBD II.
Thanks in advance!
Click to expand...
Click to collapse
Of course there is! Not everyone uses those damned rigged* Autel DS708 scantools anymore (even though they have been the gold standard for years, the UI has always been such a......tool.) VAG makes a scanner (not a code reader) that has a USB adapter for some foreign and domestic higher end vehicles.
Just do a Web search for a diagnostic auto scanner with USB adapters, or for the cars with USB diagnostic ports (sometimes they hide diag ports under the hood, too) - I threw it into a Google search and the Seat Ibiza was just the first car I came up with, followed by several scanners with matching port adapters.
Not to sound like a heifer, but finding a tech who is savvy enough to be able to tell the difference between a 16-pin OBD2 port and a USB port is a boon in and of itself. You'd do well to find a well rounded tech with a some history in electronics (wave forms are a marvelous thing when applied to the dynamics of an internal combustion engine and it's components!)
Automotive technicians are a rapidly changing group of people, with those who can't make the cut quickly fall by the wayside, so just be politely persistent about your needs, and [eventually] you may run across someone who specializes [which can be costly] or someone who has enough general knowledge to put a scanner to good use.
Just don't pay a ton of money for the "service" of plugging a scanner in and reading codes or resetting your sun roof - dealerships escalate the costs tremendously, but with intelligent scanners running anywhere from several hundred to several thousand dollars, I'd look for a smaller shop or individual. For what some of the dealers/specialists charge to plug in a scanner you could buy your own scantool!!
All that said, check with your favorite garage and inquire about the make/model of their scanner. The techs who stay up to date may charge a bit more for diagnostics, but it makes the repair a LOT less expensive when they can pinpoint the issues right away, and most are quick to offer up their services to show off that shiny new gadget that can read the cars' minds.
Depending on where you are, I may be able to offer a connect through a tech in your area. They may or may not have a scanner or a friend who does, but I don't mind asking if you'd like.
Good luck!
CC~
EDITED TO ADD: *The Autel Maxidas DS708 is, and has been planned as a terminal application, neatly coinciding with the termination date of Wince 6.x. Want more info? Drop me a line.

UIS7862 Display/GPIO(?) pinout

Since I've purchased the Joying JY-UQD11N6G I have had nothing but problems with it. Such as:
The device will not power off or sleep when the ignition is switched off no matter the configuration.
The connected amp constantly remains on.
4G does not work with one of the suggested provider's SIM (T-Mobile). The SIM is recognized, works in other phones, but zero bars. Support has zero solution, and the solution in the blog does nothing.
A one pixel wide red line from top to bottom exists in the display. Support will not replace it.
These are just a few of the issues. So i've decided to scrap the board. I'm going to keep the display and the case and put either a Raspberry Pi 4 or a Radxa Rock 3a w/ 8GB of RAM in the case. I'll put a Hi-fi Berry hat or something similar on top for digital audio output and 5.1 signal processing to run to the amp. I could really use some help with the pinout of the UIS7862 40 pin display connector from the community. I can't find this or a schematic for the device anywhere. I'm not certain if this is just using the same protocols as the GPIO standard or if it's something custom.
Looking inside the display case one finds a board with a large 40 pin connector on the back. Its mipi dsi/csi to edp converter is the Lontium LT8911EXB chip, but the board has no part number on it, so again, I can find no schematics/manual. Both the LCD display connect to this via a 40-pin ribbon and 2-pin wire harness, and the capacitive touchscreen via a 6-pin ribbon. I've attached pics of the board and the PDF that has some info about the chip.
So I'm not sure if the display connector on the UIS7862 is an unconventional adaptation of a DSI 40-pin output or a GPIO interface, but whatever it is, it carries the display data, touch data, and power for both. If anyone has a schematic showing the pinout, the actual FYT manual from this year or the last few years, or any information about this display that would be appreciated!
Bump

Categories

Resources