Galaxy Tab Serial Cable

Search This thread

Technomancer

Retired Recognized Developer
Feb 15, 2010
562
425
SF Bay Area
Hi guys
I have been investigating making serial cable for Tab for debugging and logging.
There is serial port wired to 30 pin connector.

Here is the pinout for the connector (copied from Wikipedia, unfortunately some asshole deleted it from Wikipedia several days ago)

Code:
Pin 	Signal 	to/from device
1 	Gnd 	P
2 	Gnd 	P
3 	USB_DP_CON 	I/O
4 	USB_DM_CON 	I/O
5 	IF_CON_SENSE 	I
6 	V_ACCESSORY_5.0V 	P
7 	V_BUS_1 	P
8 	V_BUS_1 	P
9 	VOUT_CHARGER 	P
10 	VOUT_CHARGER 	P
11 	--- 	--
12 	--- 	--
13 	ACCESSORY_ID / USB_ID 	I
14 	ACCESSORY_INT 	I
15 	Gnd 	P
16 	Gnd 	P
17 	MHL_DP 	I/O
18 	MHL_DM 	I/O
19 	MHL_ID 	I
20 	IF_RXD 	I
21 	IF_TXD 	O
22 	--- 	--
23 	AP_TV_OUT 	O
24 	REMOTE_SENSE 	I
25 	--- 	--
26 	--- 	--
27 	EAR_L_CRADLE 	O
28 	EAR_R_CRADLE 	O
29 	3.5_INT_TEST 	I
30 	Gnd 	P
The serial port is connected to ttySAC2 (port 2, 0 based)

So we need:
USB to low power serial adapter (repurposed knockoff Nokia DKU-5 cable)
Galaxy Tab USB cable.
Soldering skills and magnifying glass.
Brass balls.

We disassemble the Tab USB cable. There are several blades in the connector. We have to remove 2 blades with USB power and 2 blades for USB D+ D-.

Then we cut the Nokia connector off DKU-5 cable and figure out which wires are GND, TXD and RXD.
In case of my cable with ARK3116 red - GND, grn - RXD, wht - TXD
In case of my cable with PL2303 blu - GND, wht - RXD, ylo - TXD
We want to connect GND to GND, and RXD to pin 21 and TXD to pin 20
This is a good article on hacking DKU-5 cables http://www.neolics.com/pdfs/dku-5.pdf

So now we can solder the GND, TXD and RXD to proper blades on 30 pin connector and insert TXD and RXD blades into slots 20,21 on the connector.

I also tried using 200K trimmer set to 150K ohm between ACCESSORY_ID and GND but I am not sure whether it is the right solution.

Here are some photos:
attachment.php


attachment.php


attachment.php


And some output from bootloader: http://pastie.org/1712603

And in download mode http://pastie.org/1721484


This is the table of resistances from kernel in arch/arm/mach-s5pv210/include/mach/fsa9480_i2c.h
Code:
typedef enum
{
RID_USB_OTG_MODE, /* 0 0 0 0 0 GND USB OTG Mode */
RID_AUD_SEND_END_BTN, /* 0 0 0 0 1 2K Audio Send_End Button*/
RID_AUD_REMOTE_S1_BTN, /* 0 0 0 1 0 2.604K Audio Remote S1 Button */
RID_AUD_REMOTE_S2_BTN, /* 0 0 0 1 1 3.208K Audio Remote S2 Button */
RID_AUD_REMOTE_S3_BTN, /* 0 0 1 0 0 4.014K Audio Remote S3 Button */
RID_AUD_REMOTE_S4_BTN, /* 0 0 1 0 1 4.82K Audio Remote S4 Button */
RID_AUD_REMOTE_S5_BTN, /* 0 0 1 1 0 6.03K Audio Remote S5 Button */
RID_AUD_REMOTE_S6_BTN, /* 0 0 1 1 1 8.03K Audio Remote S6 Button */
RID_AUD_REMOTE_S7_BTN, /* 0 1 0 0 0 10.03K Audio Remote S7 Button */
RID_AUD_REMOTE_S8_BTN, /* 0 1 0 0 1 12.03K Audio Remote S8 Button */
RID_AUD_REMOTE_S9_BTN, /* 0 1 0 1 0 14.46K Audio Remote S9 Button */
RID_AUD_REMOTE_S10_BTN, /* 0 1 0 1 1 17.26K Audio Remote S10 Button */
RID_AUD_REMOTE_S11_BTN, /* 0 1 1 0 0 20.5K Audio Remote S11 Button */
RID_AUD_REMOTE_S12_BTN, /* 0 1 1 0 1 24.07K Audio Remote S12 Button */
RID_RESERVED_1, /* 0 1 1 1 0 28.7K Reserved Accessory #1 */
RID_RESERVED_2, /* 0 1 1 1 1 34K Reserved Accessory #2 */
RID_RESERVED_3, /* 1 0 0 0 0 40.2K Reserved Accessory #3 */
RID_RESERVED_4, /* 1 0 0 0 1 49.9K Reserved Accessory #4 */
RID_RESERVED_5, /* 1 0 0 1 0 64.9K Reserved Accessory #5 */
RID_AUD_DEV_TY_2, /* 1 0 0 1 1 80.07K Audio Device Type 2 */
RID_PHONE_PWD_DEV, /* 1 0 1 0 0 102K Phone Powered Device */
RID_TTY_CONVERTER, /* 1 0 1 0 1 121K TTY Converter */
RID_UART_CABLE, /* 1 0 1 1 0 150K UART Cable */
RID_CEA936A_TY_1, /* 1 0 1 1 1 200K CEA936A Type-1 Charger(1) */
RID_FM_BOOT_OFF_USB, /* 1 1 0 0 0 255K Factory Mode Boot OFF-USB */
RID_FM_BOOT_ON_USB, /* 1 1 0 0 1 301K Factory Mode Boot ON-USB */
RID_AUD_VDO_CABLE, /* 1 1 0 1 0 365K Audio/Video Cable */
RID_CEA936A_TY_2, /* 1 1 0 1 1 442K CEA936A Type-2 Charger(1) */
RID_FM_BOOT_OFF_UART, /* 1 1 1 0 0 523K Factory Mode Boot OFF-UART */
RID_FM_BOOT_ON_UART, /* 1 1 1 0 1 619K Factory Mode Boot ON-UART */
RID_AUD_DEV_TY_1_REMOTE, /* 1 1 1 1 0 1000.07K Audio Device Type 1 with Remote(1) */
RID_AUD_DEV_TY_1_SEND = RID_AUD_DEV_TY_1_REMOTE , /* 1 1 1 1 0 1002K Audio Device Type 1 / Only Send-End(2) */
RID_USB_MODE, /* 1 1 1 1 1 Open USB Mode, Dedicated Charger or Accessory Detach */
RID_MAX

}FSA9480_RID_ENUM_TYPE;
 

Attachments

  • front_small.jpg
    front_small.jpg
    75.3 KB · Views: 17,802
  • dku5_small.jpg
    dku5_small.jpg
    88.7 KB · Views: 17,097
  • cable_small.jpg
    cable_small.jpg
    39.3 KB · Views: 17,348
Last edited:

jeebspawnshop

Senior Member
Feb 6, 2008
1,380
1,127
I have absolutely no idea what you're talking about, but I can only imagine that it will help any work done on the Tab; and for that I just had to thank you ;)
 

lilstevie

Senior Recognized Developer
Apr 17, 2009
1,339
1,040
Someone leaking debugging hardware would be nice, but this is a good start :)
 

Technomancer

Retired Recognized Developer
Feb 15, 2010
562
425
SF Bay Area
Technomancer,

Any chance you could draw up a schematic for the cable.?

Thanks, then I will start playing also.

Just connect GND, and TXD and RXD from serial cable to proper pins on 30 pin connector.

This weekend I will try to make combo usb+serial cable so I can use adb and serial at the same time. Still I couldnt get any output from the kernel.
 

-Mr. X-

Senior Member
Apr 13, 2007
2,246
2,530
Ontario
That's Download mode?

I think it may be for booting kernel off usb so they dont need to flash it.

Yes thats download mode. Its not for booting a kernel.

Sorry to necro bump this. But I bricked my tab. a HARD brick. like dead as **** brick.

Before i send it back to samsung.

What are the chances of making a jig shorting pin 13 and GRND with 301K resistor and bringing this pig back up to flash?

Odin took a **** flashing spl on me.

<ID:0/004> DO NOT TURN OFF TARGET!!
<ID:0/004> Get PIT for mapping..
<ID:0/004> Firmware update start..
<ID:0/004> boot.bin
<ID:0/004> Sbl.bin
<ID:0/004> Complete(Write) operation failed.
<OSM> All threads completed. (succeed 0 / failed 1)
<ID:0/004> Removed!!
 

Technomancer

Retired Recognized Developer
Feb 15, 2010
562
425
SF Bay Area
Yes thats download mode. Its not for booting a kernel.

Sorry to necro bump this. But I bricked my tab. a HARD brick. like dead as **** brick.

Before i send it back to samsung.

What are the chances of making a jig shorting pin 13 and GRND with 301K resistor and bringing this pig back up to flash?

Odin took a **** flashing spl on me.

<ID:0/004> DO NOT TURN OFF TARGET!!
<ID:0/004> Get PIT for mapping..
<ID:0/004> Firmware update start..
<ID:0/004> boot.bin
<ID:0/004> Sbl.bin
<ID:0/004> Complete(Write) operation failed.
<OSM> All threads completed. (succeed 0 / failed 1)
<ID:0/004> Removed!!

I think you will need to use JTAG to recover from that. PM lilstevie, I think he bricked and recovered his Tab with JTAG many times.
 

lilstevie

Senior Recognized Developer
Apr 17, 2009
1,339
1,040
I think you will need to use JTAG to recover from that. PM lilstevie, I think he bricked and recovered his Tab with JTAG many times.

if you open the device up, you can recover with jtag, unfortunantly with sbl taking a **** but pbl in tact you are stuck at what you can do from the dock without the samsung jig.
 

-Mr. X-

Senior Member
Apr 13, 2007
2,246
2,530
Ontario
Thanks for the info guys. I have jtag recovered many devices in my day. I probably could have tackled this with the right reaearch. But i didnt want to crack a 4 month old tab. I enjoy it too much to make it a repair job yet :p

Sent from my HTC Desire using Tapatalk
 

StarLog

Senior Member
Apr 29, 2008
792
76
Orlando, FLA.
I do not believe we need to open the SGT, if you have the breakout connector, then;

Pin

13 - JTAG_USB_ID
5 - JTAG_IF_CON_SENSE
21 - JTAG_TXD
20 - JTAG_RXD
 

lilstevie

Senior Recognized Developer
Apr 17, 2009
1,339
1,040
I do not believe we need to open the SGT, if you have the breakout connector, then;

Pin

13 - JTAG_USB_ID
5 - JTAG_IF_CON_SENSE
21 - JTAG_TXD
20 - JTAG_RXD

it is a matter of getting the jtag to kick to life, even samsung techs seem to fail at this, they are sooner going to replace my tabs logicboard than jtag it,
 

-Mr. X-

Senior Member
Apr 13, 2007
2,246
2,530
Ontario
I've already sent it off, due to Samsungs less the acceptable support, it too 5 hours over 6 phone calls just to get them to give me authorization to return it and send me a shipping label. The only record i have of it being repaired is the fact the service center signed for the package. My on line account has not been updated yet that it has been accepted for repair. I was told this would take 24h its been 4 days.

Hopefully it doesn't just go missing.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 15
    Hi guys
    I have been investigating making serial cable for Tab for debugging and logging.
    There is serial port wired to 30 pin connector.

    Here is the pinout for the connector (copied from Wikipedia, unfortunately some asshole deleted it from Wikipedia several days ago)

    Code:
    Pin 	Signal 	to/from device
    1 	Gnd 	P
    2 	Gnd 	P
    3 	USB_DP_CON 	I/O
    4 	USB_DM_CON 	I/O
    5 	IF_CON_SENSE 	I
    6 	V_ACCESSORY_5.0V 	P
    7 	V_BUS_1 	P
    8 	V_BUS_1 	P
    9 	VOUT_CHARGER 	P
    10 	VOUT_CHARGER 	P
    11 	--- 	--
    12 	--- 	--
    13 	ACCESSORY_ID / USB_ID 	I
    14 	ACCESSORY_INT 	I
    15 	Gnd 	P
    16 	Gnd 	P
    17 	MHL_DP 	I/O
    18 	MHL_DM 	I/O
    19 	MHL_ID 	I
    20 	IF_RXD 	I
    21 	IF_TXD 	O
    22 	--- 	--
    23 	AP_TV_OUT 	O
    24 	REMOTE_SENSE 	I
    25 	--- 	--
    26 	--- 	--
    27 	EAR_L_CRADLE 	O
    28 	EAR_R_CRADLE 	O
    29 	3.5_INT_TEST 	I
    30 	Gnd 	P
    The serial port is connected to ttySAC2 (port 2, 0 based)

    So we need:
    USB to low power serial adapter (repurposed knockoff Nokia DKU-5 cable)
    Galaxy Tab USB cable.
    Soldering skills and magnifying glass.
    Brass balls.

    We disassemble the Tab USB cable. There are several blades in the connector. We have to remove 2 blades with USB power and 2 blades for USB D+ D-.

    Then we cut the Nokia connector off DKU-5 cable and figure out which wires are GND, TXD and RXD.
    In case of my cable with ARK3116 red - GND, grn - RXD, wht - TXD
    In case of my cable with PL2303 blu - GND, wht - RXD, ylo - TXD
    We want to connect GND to GND, and RXD to pin 21 and TXD to pin 20
    This is a good article on hacking DKU-5 cables http://www.neolics.com/pdfs/dku-5.pdf

    So now we can solder the GND, TXD and RXD to proper blades on 30 pin connector and insert TXD and RXD blades into slots 20,21 on the connector.

    I also tried using 200K trimmer set to 150K ohm between ACCESSORY_ID and GND but I am not sure whether it is the right solution.

    Here are some photos:
    attachment.php


    attachment.php


    attachment.php


    And some output from bootloader: http://pastie.org/1712603

    And in download mode http://pastie.org/1721484


    This is the table of resistances from kernel in arch/arm/mach-s5pv210/include/mach/fsa9480_i2c.h
    Code:
    typedef enum
    {
    RID_USB_OTG_MODE, /* 0 0 0 0 0 GND USB OTG Mode */
    RID_AUD_SEND_END_BTN, /* 0 0 0 0 1 2K Audio Send_End Button*/
    RID_AUD_REMOTE_S1_BTN, /* 0 0 0 1 0 2.604K Audio Remote S1 Button */
    RID_AUD_REMOTE_S2_BTN, /* 0 0 0 1 1 3.208K Audio Remote S2 Button */
    RID_AUD_REMOTE_S3_BTN, /* 0 0 1 0 0 4.014K Audio Remote S3 Button */
    RID_AUD_REMOTE_S4_BTN, /* 0 0 1 0 1 4.82K Audio Remote S4 Button */
    RID_AUD_REMOTE_S5_BTN, /* 0 0 1 1 0 6.03K Audio Remote S5 Button */
    RID_AUD_REMOTE_S6_BTN, /* 0 0 1 1 1 8.03K Audio Remote S6 Button */
    RID_AUD_REMOTE_S7_BTN, /* 0 1 0 0 0 10.03K Audio Remote S7 Button */
    RID_AUD_REMOTE_S8_BTN, /* 0 1 0 0 1 12.03K Audio Remote S8 Button */
    RID_AUD_REMOTE_S9_BTN, /* 0 1 0 1 0 14.46K Audio Remote S9 Button */
    RID_AUD_REMOTE_S10_BTN, /* 0 1 0 1 1 17.26K Audio Remote S10 Button */
    RID_AUD_REMOTE_S11_BTN, /* 0 1 1 0 0 20.5K Audio Remote S11 Button */
    RID_AUD_REMOTE_S12_BTN, /* 0 1 1 0 1 24.07K Audio Remote S12 Button */
    RID_RESERVED_1, /* 0 1 1 1 0 28.7K Reserved Accessory #1 */
    RID_RESERVED_2, /* 0 1 1 1 1 34K Reserved Accessory #2 */
    RID_RESERVED_3, /* 1 0 0 0 0 40.2K Reserved Accessory #3 */
    RID_RESERVED_4, /* 1 0 0 0 1 49.9K Reserved Accessory #4 */
    RID_RESERVED_5, /* 1 0 0 1 0 64.9K Reserved Accessory #5 */
    RID_AUD_DEV_TY_2, /* 1 0 0 1 1 80.07K Audio Device Type 2 */
    RID_PHONE_PWD_DEV, /* 1 0 1 0 0 102K Phone Powered Device */
    RID_TTY_CONVERTER, /* 1 0 1 0 1 121K TTY Converter */
    RID_UART_CABLE, /* 1 0 1 1 0 150K UART Cable */
    RID_CEA936A_TY_1, /* 1 0 1 1 1 200K CEA936A Type-1 Charger(1) */
    RID_FM_BOOT_OFF_USB, /* 1 1 0 0 0 255K Factory Mode Boot OFF-USB */
    RID_FM_BOOT_ON_USB, /* 1 1 0 0 1 301K Factory Mode Boot ON-USB */
    RID_AUD_VDO_CABLE, /* 1 1 0 1 0 365K Audio/Video Cable */
    RID_CEA936A_TY_2, /* 1 1 0 1 1 442K CEA936A Type-2 Charger(1) */
    RID_FM_BOOT_OFF_UART, /* 1 1 1 0 0 523K Factory Mode Boot OFF-UART */
    RID_FM_BOOT_ON_UART, /* 1 1 1 0 1 619K Factory Mode Boot ON-UART */
    RID_AUD_DEV_TY_1_REMOTE, /* 1 1 1 1 0 1000.07K Audio Device Type 1 with Remote(1) */
    RID_AUD_DEV_TY_1_SEND = RID_AUD_DEV_TY_1_REMOTE , /* 1 1 1 1 0 1002K Audio Device Type 1 / Only Send-End(2) */
    RID_USB_MODE, /* 1 1 1 1 1 Open USB Mode, Dedicated Charger or Accessory Detach */
    RID_MAX
    
    }FSA9480_RID_ENUM_TYPE;