BD-D8900 debug console

[oga83]

Hello,

Did anybody find the rs232 debug console port on BD-D8900 (or BD-D8200, BD-D8500) ?

The pcb is not the same than in BD-D6900 (the console pins have been located for this model).
I tried to locate the pins among unused ones with my oscilloscope, without success



Thanks in advance

[julianbb]

Please make some high resolution photo of main board !Upload them...somewhere...
it's there somewhere just to be found...should be 4 or 5 copper visible contacts.
If you have ossciloscope will be easier to identify Tx/Rx
BTW, prepare your Exlink cable...3.3V - 5 V (i used Prolific serial to usb from a mobile phone cable)

[oga83]

There is nothing under the white label or under the wifi module.

I have tested the following footprints :
- CN1703_D
- the 14-pin dil pattern just aside
- HCN-501_D
- the 2 patterns near C401 and C402
- TP210 and TP211 near video cinch connectors

I also checked that the front USB connector was not used for debug console (with a USB/RS232 adaptor on it).

I have checked that Debug mode is enabled in the service menu.
However, to do my tests, I was looking for some data to come on the pins during a power-up cycle.
Am I right ? or does the unit remain silent until the magic codes 20112012 are sent to it ?

I am using a USB/TTL cable from FDDI (also used for arduino dev)

Can anybody check on which component are connected the RX and TX pins in the DB-D6900 ? It might help.

Let me know if you see something I missed on the photos.
Thank you for your help !

[julianbb]

Nice pictures,
Don't try to connect to BD usb port... I tested on my device D8900 firmware and serial console works the same way...
Serial port goes directly on ARM !!! no other chip...
When i searched for serial port i used remote control to give commands which are logged instantly to console and watch the ossciloscope screen for data output on the tested pin...Better use "menu" and "exit" , if your not sure of tx discovery use "smart" and exit because data perssistance (log output) is longer then simple commands
I think serial port should be located near Arm proccesor...
My guess:
1.between crystal and wifi module connector(CN302) are 2 copper points...
2.CN 1703_D , try first pin with triangle sign and last on diagonal...
3. C401 and C402 in the right up corner of Arm. Strange position for two capacitors not soldered !!!
Anyway you should see on ossciloscope screen some data... attention ! normal level is high (3.3v)when no data outputting
Good luck !
Wait for news...

[oga83]

Found it !

TXD is on R859 near the SATA connector...
RXD might be on R852 but I need to do some investigations before injecting my signal.

It look strange to me that there is no pattern for the debug console (connector like D6900, pad or test point) . It must be somewhere else on the board but as the pcb is a multilayer one, it is not easy to follow the signals (and I hope there is no buried via holes).

I hope to have good news about it tomorrow !

Power up log :
[PM] Revision number : 1
[PM] prefetch=0x71800000
>>[HFASTBOOT: HyperFastBoot.cpp] HyperFastBoot: Resume Start!!!
>>[HFASTBOOT: ODsBarcelonaVideoProcessor.cpp] HFResume: is called [4]
>>[ERR:ODsSiIHdmiTxProcessor.cpp] MakeCallbackEvent():8555 m_RxSenseCallback is not initiated, stored m_uPendedEvent(0040) !!!
>>[HFASTBOOT: TDaSystem.cpp] HFResume: is called [1]
>>[HFASTBOOT: TDsSystem.cpp] HFResume: is called [1]
>>[HFASTBOOT: TDaSystem.cpp] HFResume: is called [2]
>>[HFASTBOOT: TDsSystem.cpp] HFResume: is called [2]
>>[HFASTBOOT: HyperFastBoot.cpp] HyperFastBoot: Thread Mode!!!
>>[HFASTBOOT: TDaCommonInterface.cpp] HFResume: is called [0]
>>[HFASTBOOT: TDsSamCommonInterface.cpp] HFResume: is called [0]
>>[HFASTBOOT: HyperFastBoot.cpp] pthd_t_InitCiMachine: CI Card is not detected. Waiting
>>[HFASTBOOT: HyperFastBoot.cpp] HyperFastBoot: [Init. CI Machine] Thread_ID=0x821f7460 : CREATE
>>[HFASTBOOT: HyperFastBoot.cpp] HyperFastBoot: [Resume Tuner] Thread_ID=0x817f7460 : CREATE
>>[HFASTBOOT: ODsBarcelonaVideoProcessor.cpp] HFResume: is called [0]

[julianbb]

Congratulations !!!

Check if the signal reach on HCN501_D pads...it should be there...or thru missing R859...
Before injecting TX from ExLink check with ossciloscope on R852 (pad where is "R") if you have data during cold start of BD...just to be sure...

[oga83]

Thank you very much julianbb for your help.
Your hint about menu/exit on remote to probe the TX signal was a great help.

The debug console now works fine

Here are the connections :


I followed the signals on the top and bottom layers : RX and TX come directly from the processor (the chip with the heatsink). No via in the middle except the one just near the resistors.
If RX and TX go somewhere else, it's via an internal layer. I was not able to locate it anywhere else on the board.
You can see on high resolution pictures that R859 is a fake resistor footprint. The second pin is not connected to anything (no via, no thermal, no leading track).
R852 is just a pull-up for RX to be tied at 3.3v.
As these resistor footprints are on 'deadend' tracks that lead to R859 (TX) and R852 (RX), I assume it is the only possible connection for the debug console.

Now, back on the software.
The magic codes 20102011 and 20089999 work fine, but I was not able to find any 'shell' command in the menu.
Is it available for the BD-C8900 ?
[Edit] My firmware is 1007_275. In the boot log, I can see some FIRHRDEUC, but no FIRURDEUC as listed in the compatibility list.

So far, I cannot root the unit

Has anyone played with the setup menu 'RS232 Jack' option set to 'UART' (instead of 'Debug') ?
My hope is that it enables a standard TTY on the console instead of a debug log...

[julianbb]

I tried opyions from SM to UART,TTL,DEBUG...no succes
Console is locked to HEX ...

[oga83]

Here is the final installation, with an Ex-link-like jack connector.
The connector is installed in place of the existing black plastic-cable-holder : no hole to drill
I used a 2.5mm micro jack that fits in the existing hole.

I also used two 100-ohms resistors on RX and TX as a protection, just in case.

[julianbb]

Nice work Olivier!
If you still have BD dismounted ...can you follow where the 4 wires from Hdd Sata connector goes ? directly to Arm or to another IC ?
Could be a chance to upgrade hardware D6900 to D8900
I already tested firmware 1006 from D8900 and with some precautions(disable from SM dual tuner and dual hdmi)... worked...
Reason ?
For internal Hdd... and CD Ripping...