OESF Portables Forum
Everything Else => General Support and Discussion => Zaurus General Forums => Archived Forums => Hardware Mods => Topic started by: wrc4 on September 18, 2006, 11:05:16 pm
-
Last week I opened my Zaurus SL-7500C and replaced the Flash chip with a K9F1G08UOM. (My original chip is also K9F... the only difference is the capacity).
I carefully checked the pins to make sure they are properly connected. Then I booted to the Service Menu using Fn+D+M. The up-right corner of Sevice Menu shows "SL-C760". But the chip wasn't properly recognized. Clicking on the version list gave me the following information:
CPU: PXA255 A0
Board: c760
Serial No: 00000b0d
ROM Checksum: bca1
RAM Size: 65536KB
NAND modules(0MB)
unknown[unknown]
I tried all the NAND Flash related command (NAND restore and NAND Full Erase) in the service menu and they all gave me an "Error -2". Restoring NAND backup or installing U-Boot didn't work either.
I can't put back my original chip because I damaged it when I removed it. (There must be some glue under the chip.) So basically my 7500 is dead.
I heard that somebody has successfully upgraded their Flash chip. So maybe he can share his experience with me. I'd be very appreciated.
-
I'm going to upgrade my C3000 and the first thing I care about is to SAVE THE ORIGINAL CHIP. I think that hot air blower with careful temperature adjusting will help to melt the glue and save the chip, maybe at 200 C or a little bit higher (chip won't desolder at temperatures lower than 180 C, if I'm correct).
-
I'm going to upgrade my C3000 and the first thing I care about is to SAVE THE ORIGINAL CHIP. I think that hot air blower with careful temperature adjusting will help to melt the glue and save the chip, maybe at 200 C or a little bit higher (chip won't desolder at temperatures lower than 180 C, if I'm correct).
[div align=\"right\"][a href=\"index.php?act=findpost&pid=141765\"][{POST_SNAPBACK}][/a][/div]
It was so difficult to remove the original chip from the board. I didn't have any trouble when I removed the chip I was going use from a USB key drive, but blowing the chip off Zaurus is another story.
Let me know when you finish the upgrade work. I still want to know whether the new chip is supposed to be recognized automatically.
-
wrc4: you probably need to use same chip as the one in c760/c860 because sharp bootloader (which initialize chip) has it hardcoded rather.
-
wrc4: you probably need to use same chip as the one in c760/c860 because sharp bootloader (which initialize chip) has it hardcoded rather.
[div align=\"right\"][a href=\"index.php?act=findpost&pid=141782\"][{POST_SNAPBACK}][/a][/div]
That's what I'm afraid of: If the code is in the EEPROM. there will be no way to upgrade it. That would also mean the bootloader in my 7500C is the same or at least very similar to that of a C760. (The most confusing part is the Service Menu says my Zaurus is a C760, but the only thing I changed is the Flash chip).
Does anyone want to open his/her C760 and tell me the exact model of the Flash chip? I really wonder what is the difference between the SAMSUNG chips (K9K, K9F, etc.). Is there a way to trick one model into another? I heard that the Flash of some Windows CE PDAs (like the iPaq hx4700) can be easily upgraded.
-
I found a same 64MB chip as the previous one and soldered it back. (Thanks Jason for giving me your old USB drive.) Now my 7500 is up and running again. (With a bad block in the flash, thanks Jason again for using it so HARD...)
So one conclusion is that K9F1G08UOM does NOT work on SL-7500C (and may be the same thing is true for SL-C750).
-
Wow, so cool.
I even asked the maker on this repair issue, they cannot provide since they don't have the flash chip.
But you made it.
Flash chip may have different sector size in organization. It seems that RAM may be a little easier.
-
What was the full code on the original chip? When I looked at the datasheet I'm pretty sure that different K9F's can report different chip ID's - which would definitely make your Z unable to recognise the chip even if it's otherwise compatible.
-
pelrun,
The full code is:
K9F1G08UOM YCBO
I will try to look at the datasheet and compare the difference between the chips. (I really should have done this BEFORE changine the chip)
chyang,
You can easily find such a chip in an old "LG" branded USB disk. The 128M model usually has two of such chips.
-
No, I meant the original chip from your Z, you already mentioned the one you replaced it with
-
No, I meant the original chip from your Z, you already mentioned the one you replaced it with
[div align=\"right\"][a href=\"index.php?act=findpost&pid=142096\"][{POST_SNAPBACK}][/a][/div]
Sorry:
K9F1208UOM YCBO
It's really just the size difference. Every other code is the same.
-
From the datasheets, the K9F1208UOM ID is 76C0, but the K9F1G08UOM's is F115 - the Z would be querying the ID and giving up on the unfamiliar one, even if the chips are functionally identical.
The only real way to get it to work in that case would be to cram in a microcontroller to intercept the new ID and inject the old one in a similar fashion as a console modchip does.
It might also be possible to patch the in-flash version of the firmware to replace the ID with the newer one - though if that worked you couldn't use the Fn+D+M menu (as it's in ROM) to save you from a bad subsequent flashing...
-
From the datasheets, the K9F1208UOM ID is 76C0, but the K9F1G08UOM's is F115 - the Z would be querying the ID and giving up on the unfamiliar one, even if the chips are functionally identical.
The only real way to get it to work in that case would be to cram in a microcontroller to intercept the new ID and inject the old one in a similar fashion as a console modchip does.
It might also be possible to patch the in-flash version of the firmware to replace the ID with the newer one - though if that worked you couldn't use the Fn+D+M menu (as it's in ROM) to save you from a bad subsequent flashing...
[div align=\"right\"][a href=\"index.php?act=findpost&pid=142124\"][{POST_SNAPBACK}][/a][/div]
Is there any way to patch the in-flash version of the firmware? Can it be done by running some scripts in the SD or CF card or by connecting to the serial port? Since the Fn+D+M is rarely used and even if it's needed, we can restore the original fireware and patch it again. I wonder how much we can do with the Service Menu.
The good thing is, if we can modify the firmware, we might be able to use even larger flash chips--maybe a 1GByte one.
-
How would you replace the firmware if you need the Fn+D+M menu to do it and it doesn't recognise your flash?
Not to mention the whole problem of getting the firmware on there in the first place - though if you were scavenging the chip from a USB key you could probably use it to write the raw firmware to the chip before transplanting it.
Come to think of it, the Z would be using the ROM copy as a first stage bootloader, so you're probably SOL already - can't read the flash until you've already got some code loaded that lets you read the flash, and that code is in the flash. Ouch.
-
How would you replace the firmware if you need the Fn+D+M menu to do it and it doesn't recognise your flash?
Not to mention the whole problem of getting the firmware on there in the first place - though if you were scavenging the chip from a USB key you could probably use it to write the raw firmware to the chip before transplanting it.
Come to think of it, the Z would be using the ROM copy as a first stage bootloader, so you're probably SOL already - can't read the flash until you've already got some code loaded that lets you read the flash, and that code is in the flash. Ouch.
[div align=\"right\"][a href=\"index.php?act=findpost&pid=142149\"][{POST_SNAPBACK}][/a][/div]
Yes, you're right.
In fact, I would think about building a daughter board just for the flash chip. After all, there are only about 20 out of the 48 pins need to be connected. This way we can change the chip whenever we want and preload the basic boot loader that can recognize the chip. But that's a little far from what I can do now.
-
The easiest way is to fill up the new chip with a new bootloader like uboot, and never use the D+M menu - or replace the ROM where the d+m menu is stored by a flash with uboot as well.
Guylhem
with a zaurus needing flash memory repair
-
is it possible to put a jtag interface on the Z and load a flash image like that? I would imagine this is what Sharp do.
Paul
with a zaurus needing a BGA ram repair
-
I belive that JTAG is available on the Zaurus, At least on CXXX, there're test contact pads next to CPU/RAM chips, I need to check my records, but I think it;s JTAG lines.
-albertr
-
The P2ROM is where the FN+D+M menu is stored, but development versions use NAND flash instead of P2ROM for the FN+D+M menu. Open your zaurus, locate the P2ROM and look around - there are soldering pins for a NAND flash.
I think it would have to be flashed on an external NAND flasher with a copy of the hacked d+m menu, then soldered instead of the P2ROM.
But IMHO this would be easier
-
http://www.hrw.one.pl/2006/08/09/sharp-zaurus-jtag-cable/ (http://www.hrw.one.pl/2006/08/09/sharp-zaurus-jtag-cable/)
-
Hrw, your link must be for old Zaurii models, like 5500/5600. AFIK, there's no JTAG lines on Sharp I/O port connector on clamshell Zaurii. Also, the seven test contact pads I mentioned before don't have JTAG lines either.
-albertr
-
albertr: iirc there was infos that cxx00 serial i/o port is 'JTAG only' now - not to be used by users at all...
-
My old (and bricked due to KB cable/connector problem ) C760 uses K9F1G08UOM, so that's why I recommended this one. So, usual Sharp serial cable won't do the trick, according to hrw site JTAG cable pinout? Then I'll have to improve my home-brew serial cable before doing any upgrades like that - I don't want to brick one more Z.
-
Hrw - I didn't see that in the 3xxx service manual.
Reaper - did you try the fn+d+m menu? you should at least be able to reformat it from there, then do a nand restore. you can't brick a zaurus by software- only by hardware hacks or hardware failure of the flash.
Regarding the flash repair, looks like I need a K9F1208UOM YCBO. If anyone has one, Id be interested.
Guylhem
-
Thank you very much for advice. I'll try it as soon as I get new U-BOOT and new pdaXrom that safely works on C3K. You can (and are ought to ) smash me into pieces for such cowardice, but I'm like that, you know - never make a step when you don't know exactly how to retreat.
-
albertr: iirc there was infos that cxx00 serial i/o port is 'JTAG only' now - not to be used by users at all...
[div align=\"right\"][a href=\"index.php?act=findpost&pid=142777\"][{POST_SNAPBACK}][/a][/div]
I came accross this post and perhaps this is the wrong place to resume, but i read so many things about the JTAG thing on I/O.
At the moment i'm completely confused about the signals on the I/O connector of the C1000/C3x00.
In an older post albertr mentioned he got nothing valid out of the serial lines on his C1000.
In another post some reported, that the standard sharp serial cable (C170) is still working with the C1000 as well as with the C3x00 devices.
I personally use a C3100 and was able to get something out of the serial lines with a homemade cable. So i assume that the serial port is still there.
For now it is not completely tested, but let's assume pin 3-7 and pin 14 might still carry the serial lines of ttyS0.
Excluded are pins 1,2 and 15,16 of the I/O which are told not to be connected internally (formerly used as power input).
Pin 11 (VCC3) and Pin 8 (GND) deliver 3.3V power. That's verified.
How about the USB pins of the traditional I/O connector pinout?
Did anyone make some measurements or had success to make these lines work for USB?
If USB is not there, 4 pins are left to carry JTAG.
This is the absolute minimum for using this interface.
nTRST may not be needed to toggle some pins (i once used a PXA255 design which didn't use it either).
If i remember correctly, the first one who mentioned the JTAG on I/O port was Trisoft.
Perhaps they know?
I don't. But i'd really like to find out!!!
Perhaps one should put it down as a new topic, maybe i do.
Regards,
scholbert
-
Hmm. checked in 3100sm and there is UART connected to i/o port (so it can have serial) but no info how JTAG is connected ;(
-
Hmm. checked in 3100sm and there is UART connected to i/o port (so it can have serial) but no info how JTAG is connected ;(
[div align=\"right\"][{POST_SNAPBACK}][/a][/div] (http://index.php?act=findpost&pid=147455\")
Hi hrw,
thanks for your reply. I started a new topic for this.
Just got a reply from Trisoft regarding the functions on I/O. It does have serial!
Look at [a href=\"https://www.oesf.org/forums/index.php?showtopic=22106]this topic[/url].
Concerning JTAG i spent some thoughts about my pin counting i posted yesterday and had another glance on the cable wiring you had published on your website.
I think i was wrong in counting the pins like that, because JTAG may be multiplexed on some serial lines. But this is not verified at all !
Regards,
scholbert
-
In an older post albertr mentioned he got nothing valid out of the serial lines on his C1000.
No, I never said that. In fact, I posted many times on this (and other forum) that serial UART lines are available on Sharp I/O port on 1000/3x00 Zaurii. They are logical 3V TTL levels, so need RS232 tranceiver. In fact, I'm using it on my C1000 with Sharp serial cable quite often.
There's no JTAG lines on Sharp I/O port on 1000/3x00 AFAIK.
-albertr
-
According to the datasheets, there are JTAG lines just like on the previous models , but they require a special sharp cable (which schema has already been published here)
-
In an older post albertr mentioned he got nothing valid out of the serial lines on his C1000.
No, I never said that. In fact, I posted many times on this (and other forum) that serial UART lines are available on Sharp I/O port on 1000/3x00 Zaurii. They are logical 3V TTL levels, so need RS232 tranceiver. In fact, I'm using it on my C1000 with Sharp serial cable quite often.
There's no JTAG lines on Sharp I/O port on 1000/3x00 AFAIK.
-albertr
[div align=\"right\"][a href=\"index.php?act=findpost&pid=147655\"][{POST_SNAPBACK}][/a][/div]
Hi albertr,
i'd really like to apologize for my statement .
I didn't remember the exact post as i wrote these lines and i thought it was you who once mentioned kind a thing. Blame on me
Never ever i'll write something down again, if i do not exactly know where i got it from.
At least i wanted to point out that there were many different opinions about the serial stuff and I/O connector.
But it seemed that i was the only one confused !
Perhaps this is a good moment for me to send a personally "thank you, albertr".
It amazing what you have done so far and what information you put down into this forum!
Let me go back to the topics.
guylhem may be right.
I think there could be some kind of gate logic inside C1000/3x00, which is activated with pin 13 and maps the JTAG lines to the pins 5,6,7 and 14 on the I/O connector.
I will do some investigation. Unfortunately i got no schematic of the device.
scholbert
-
No problem, I just wanted to set the record streigth.
If I'm not mistaken, Guylhem probably mentioned the older models, not pxa270-based C1000/3x00....
Thanks.
-albertr
-
The 3100 schematic definitely provides for JTAG wired to behave as scholbert says: holding pin 13 high remaps 5 as TDI, 6 as TMS, 7 as TDO, 14 as TCK.
Unfortunately it looks like all the components in that circuit have been left off the production board, as one of albertr's nice highres photos of the board (http://www.iral.com/~albertr/linux/zaurus/wireless/front.jpg) shows unpopulated chip positions right where I'd expect to see the two TC7WB66FK bus select chips, and the schematic has all the components in that part of the circuit marked as "OPEN".
-
Hi pelrun,
great information. I thought it would be like that.
I just quoted your posting in the C1000/3x00 Hardware section (https://www.oesf.org/forums/index.php?showtopic=22106).
Just for completion of the information about the I/O connector.
I hope it's O.K. for you that way!
Perhaps this could be very helpful to those who are interested in upgrading flash or (un)bricking their device completely !
Greets,
scholbert