Kovo's blog
Thursday 24 February 2022
Friday 7 May 2021
BM83 how-to s
Microchip made new module BM83, and finally all configuration make sort of sense :)
if you have your boards with bm83 (or you have one from me) connect module to your computer using usb cable:
download and extract https://ww1.microchip.com/downloads/en/DeviceDoc/IS2083_Turnkey_1.2.0.zip
lets update module with latest firmware
go to IS2083 Turnkey_1.2.0\Tools\isupdate fire up isupdate.exe
1) select port USB HID, baudrate 115200 number of banks: 3, memory type flash ande subtype serial flash
2) hit connect
3) section "Flash update/dump" select upper browse and browse to IS2083 Turnkey_1.2.0\Software\IS2083 Image\MSPK2v1.3\GFP
4) select all 3 files
5) hit update
6) in popup select if you like to preserve information about paired devices, select what you like :)
7) after update in status window you will have something like "End of Write Memory! Elapsed time: blalbla second"
8) hit disconnect
how-to change setting on BM83
1) go to IS2083 Turnkey_1.2.0\Tools\Config Tool
2) fire up IS208x_Config_GUI_Tool v1.3.08.exe (hit OK on 1st popup)
3) select MSPKv2_GFP(Google Fast Pair) or _PBAP -> will enable pbap profile, microchip pdf (BM83-Bluetooth-Audio-Development-Board-User-Guide-DS50002902B,pdf) suggest to load is208x_config_default_table.ini from same directory both works, hit edit
For more info about profiles and supported features check "IS2083/BM83 Bluetooth ® Applications Design Guide/AN3118"
4) select host/embedded mode: host=> you are going to use mcu for controlling codec, embedded you are going to use buttons?, correct? I did not test this)
5) press next
6) [Sys Setup1] select power switch typ (mfb or power on directly, or cmd from MCU)
7) [Sys Setup2] CHANGE NAME,bt class of device, report battery status to smartphone (disable if using in some non battery project)
8) [CODEC] speaker output -> read help!, CODEC type->internal!!!! if not using i2s module, disable digital mic if you like to use analog one
9) press finish
10) setup your DSP if you like, i did not play with it :) so I simply closed pop-upped window with dsp configuration
11) hit save, select folder and type nice name for your config, you will need it in second
12) press exit and then press NO!!!
go to IS2083 Turnkey_1.2.0\Tools\isupdate fire up isupdate.exe
1) select port USB HID, baudrate 115200 number of banks: 1, memory type flash and subtype serial flash
2) hit connect
3) section "Flash update/dump" select upper browse and find your previously created config, hit Open and then hit Update
4) in popup select if you like to preserve information about paired devices, select what you like :)
5) after update in status window you will have something like "End of Write Memory! Elapsed time: blalbla second"
hit disconnect, reset module and it should works
Arduino library for BM83
and it works with my is2020 library!!
Title: Alice Cooper - Poison (Axizz Hardstyle Bootleg) *FREE TRACK*
how-to unbrick BM83 module:
Sunday 30 August 2020
Easy 2.5" bixenon upgrade for DEPO/VALEO audi a4 b5 facelift headlights
If you like to upgrade your projector assembly in DEPO/VALEO headlights (should works for TYC also) for facelifted Audi A4 B5 for whatever reason here is a simple solution:
you need this 4TL-R 2.5" projector
https://www.aliexpress.com/item/32759121526.html
these are also available from other sources, but I did not test them and can not tell if they are same.
https://my.aliexpress.com/wishlist/shared.htm?groupId=100000023931021
and also here:
https://www.theretrofitsource.com/bi-xenon-4tl-r-P-M-4TLR?quantity=1
Next, you need the template for drilling which can be brought from my tindie store:
https://www.tindie.com/products/tomaskovacik/template-for-4tl-r-bixenon-audi-a4-b5-lights/
With this template also comes document with detailed instructions on how to modify the projector to fit. It requires 4holes to be drilled into projector and made few cuts into projector to clear inside of headlights.
Here are some sample pictures:
The adapter bolted to projector prior drilling new mounting holes. |
Projector inside DEPO headlight. |
Finally inside. |
High beams |
update:
I just use my adapter to insert projector into VALEO(OEM) projectors. Few pictures, from testing it on some broken valeo headlights:
holes are lining up, that is ok |
inner parts must be addjust all way to the front glass |
projector in the headlight |
projector in the headlight |
In document which is provided after buying adapter is more detailed process and also link to YT video how to insert the projector into headlight.
Tuesday 11 August 2020
fixing wiper motor JL 52372
If your wiper motor in V.A.G. car with part number JL 52372 is continuously running (probably as result you leave it on while blade is frozen to window :) ) most probably the chip inside is fried. If so, nee chip can be sourced on aliexpress: https://www.aliexpress.com/item/32958082771.html . After soldering chip in place, everythings works as it should.
Few pictures from module:
8205 datasheet: http://file.elecfans.com/web1/M00/89/C6/o4YBAFyLiueATEfcAAvj6BVhw28408.pdf?filename=1527231143785052751.pdf
Monday 10 August 2020
REFLASHING BM62 to 2.1.3
https://github.com/tomaskovacik/IS2020/wiki/Upgrading-firmware-on-BM62
P2_0 and P2_4 pulled to ground
EAN pulled high directly to VDD_IO (this is required even that datasheet stated there is pullup!)
22uF cap on VDD_IO (check erata)
5V connected to 5V
gnd to gnd
rx to B10 of stm32
tx to B11 of stm32
power up the module or reset it, both leds will be blinking simultaneously
run isbtflash.exe (BM6x Software & Tools(DSPKv2.1.3)\DSPK v2.1.3 Package\Tools\FlashUpdate Tool)
select com port, speed 115200:240, banks: 16 hit connect
browse-> select firmware files (from BM6x Software & Tools(DSPKv2.1.3)\DSPK v2.1.3 Package\Software\Firmware Image\BM64 Firmware yes BM64 als for BM62)
BT5506_SHS_FLASH.H00
BT5506_SHS_FLASH.H01
BT5506_SHS_FLASH.H02
BT5506_SHS_FLASH.H03
BT5506_SHS_FLASH.H04
BT5506_SHS_FLASH.H05
BT5506_SHS_FLASH.H06
BT5506_SHS_FLASH.H07
BT5506_SHS_FLASH.H08
BT5506_SHS_FLASH.H09
BT5506_SHS_FLASH.H10
BT5506_SHS_FLASH.H11
BT5506_SHS_FLASH.H12
BT5506_SHS_FLASH.H13
BT5506_SHS_FLASH.H14
BT5506_SHS_FLASH.H15
hit update button
after the update, remove the jumper from P2_4, hit reset, both LEDs will light solid
Do not forget check "Load default in into IP" on third screen of MPET.exe when generating eeprom (consult BM62 dev board datasheet from microchip website)
code for stm32:
#define BLUETOOTH_EEPROM_UPLOAD PA4 //goes to P2_0
#define BLUETOOTH_FLASH_UPLOAD PA5 //goes to P2_4
#define BLUETOOTH_EAN PA6 //goes to EAN
#define BLUETOOTH_RESET PB14
void setup() {
Serial.begin(115200);
Serial3.begin(115200); //Serial3 => TX = PB10, RX = PB11
// pinMode(BLUETOOTH_EEPROM_UPLOAD, OUTPUT);
// digitalWrite(BLUETOOTH_EEPROM_UPLOAD, LOW);
// pinMode(BLUETOOTH_FLASH_UPLOAD, OUTPUT);
// digitalWrite(BLUETOOTH_FLASH_UPLOAD, LOW);
// pinMode(BLUETOOTH_RESET, OUTPUT);
// digitalWrite(BLUETOOTH_RESET, LOW);
delay(100);
digitalWrite(BLUETOOTH_RESET, HIGH);
}
void loop() {
// Serial.println("Start\nsending 0x0120fc00:");
// delay(1000);
// Serial3.write(0x01);
// Serial3.write(0x20);
// Serial3.write(0xFC);
// Serial3.write(0x00);
// Serial.println("responce:");
// while (Serial3.available()) { // If anything comes in Serial1 (pins 0 & 1)
// Serial.write(Serial3.read()); // read it and send it out Serial (USB)
// }
// delay(1000);
while (1) {
if (Serial3.available()) { // If anything comes in Serial1 (pins 0 & 1)
Serial.write(Serial3.read()); // read it and send it out Serial (USB)
}
if (Serial.available()) { // If anything comes in Serial (USB),
Serial3.write(Serial.read()); // read it and send it out Serial1 (pins 0 & 1)
}
}
//delay(100);
}
Monday 22 June 2020
Fixing AcceleDent Aura
If your unit stops working and the LED Indicator is flashing alternating green and orange it means that you reach some stupid hardcoded lifetime of unit. Check FAQ on https://acceledent.com/faq/:
There is only one correct response to this if you pay 1000euros for this unit:
Open it, desolder Microchip SPI EEPROM 25LC1024, then use Arduino with this sketch to dump content and then another sketch to clear the whole EEPROM. Solder it back and the unit is again working. My dump is saved here.
Friday 11 October 2019
connecting JTAG to BK8000L
https://alephsecurity.com/2019/07/15/xiaomi-zigbee-3/
from which I take jtag HW and SW part
jtag HW and SW part
JTAG HW:
FT232H usb module: https://www.aliexpress.com/item/33052982174.html
SW: https://github.com/alephsecurity/BA2-toolchain (jtag-r34432.tar.xz)
patch for generic FT232H board
open ftdi_driver.c
and add this line to ftdi_driver.c file
{ 0x0403, 0x6014, NULL, NULL, l_amontec_jtagkey2, 0 },
/* vendor, product, name pairs of supported devices */
struct ftdi_device_desc supported_devs[] = {
{ 0x0403, 0x6010, "Beyond", "Debug Key", l_beyond_debug_key_v1_2, 0 }, // Beyond Debug Key
{ 0x0403, 0x6010, "Beyond", "Debug Hub", l_beyond_debug_key_v1_1, 0 }, // (eng. sample 2)
{ 0x0403, 0x6010, "Beyond", "JTAG Adapter", l_beyond_debug_key_v1_0, 0 }, // (eng. sample 1)
{ 0x0403, 0xcff8, "Amontec", NULL, l_amontec_jtagkey2, 0 }, // Amontec jtagkey/jtagkey2
{ 0x15ba, 0x002a, NULL, NULL, l_olimex_armusb, 0 }, // Olimex arm-usb-tiny-h
{ 0x15ba, 0x002b, NULL, NULL, l_olimex_armusb, 0 }, // Olimex arm-usb-ocd-h"
{ 0x15ba, 0x0004, NULL, NULL, l_olimex_armusb, 0 }, // Olimex arm-usb-tiny"
{ 0x15ba, 0x0003, NULL, NULL, l_olimex_armusb, 0 }, // Olimex arm-usb-ocd"
{ 0x0403, 0x6010, "Digilent", "Digilent Adept USB Device", l_digilent_hs1, 0 }, // Digilent hs1 ("adept")
{ 0x0403, 0xac09, "Atomic", NULL, l_amontec_jtagkey, 0 }, // Atomic programming AP-114 (same layout as Amontec)
{ 0x0403, 0x8220, "DISTORTEC", "JTAG-lock-pick Tiny 2", l_lockpick2, 1 }, // JTAG-lock-pick Tiny 2
{ 0x0403, 0x6014, NULL, NULL, l_amontec_jtagkey2, 0 },
{ 0, 0 }
};
Connecting JTAG to BK8000L
AD0 TCK AD1 TDI AD2 TDO AD3 TMS AD5 /SRST
(https://www.tiaowiki.com/w/TIAO_USB_Multi_Protocol_Adapter_Lite_User%27s_Manual#20_PIN_JTAG_Connector)
then short SCLK and SO pin on external flash, so CPU cant start up, plug FT232H adapter to USB and fire up jtag sw:
update: starting jp3 shortly after releasing RESET button does the trick also ...
nail@sid:~/tmp/jtag_ba22$ ./jp3 ftdi jtag://localhost:1234 -t15M jp3: JTAG protocol via USB/parallel port for linux. Version 1.6.3 Assuming debug_if's TAP has an IDCODE of 0x14951185. Using 'FTDI Single RS232-HS (?)' interface. Enabling high speed ftdi mode. Using JTAG clock of 15 MHz Disabling UART not supported/required on this adapter. JTAG chain length: 1 Found device 0 (IDCODE: 14951185) to have a debug_if connected to it Debug interfaces(s) detected: if3 Using debug interface 3. Processor version: BA22 v5.2.2 Memory interface for debuggers: yes Remote ba debugging using jtag://localhost:1234 Press CTRL+c to exit.
OPENOCD
nail@sid:~/tmp/jtag_ba22$ openocd -f interface/ftdi/um232h.cfg -c "adapter_khz 100" -c " transport select jtag"Open On-Chip Debugger 0.10.0+dev-00936-g0a13ca1-dirty (2019-10-07-08:06)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
adapter speed: 100 kHz
jtag
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : clock speed 100 kHz
Warn : There are no enabled taps. AUTO PROBING MIGHT NOT WORK!!
Info : JTAG tap: auto0.tap tap/device found: 0x14951185 (mfg: 0x0c2 (Flextronics (Orbit Semiconductor)), part: 0x4951, ver: 0x1)
Warn : AUTO auto0.tap - use "jtag newtap auto0 tap -irlen 2 -expected-id 0x14951185"
Error: IR capture error at bit 2, saw 0x3FFFFFFFFFFFFFF5 not 0x...3
Warn : Bypassing JTAG setup events due to errors
Warn : gdb services need one or more targets defined
small update:
so I have few minutes while eating my lunch:
https://www.beyondsemi.com/25/beyond-ba22-de-deeply-embedded-processor/#tab3
-> GCC
https://www.beyondsemi.com/86/beyondstudio-integrated-development-environment/
- GCC 4.9.2
- Binutils 2.24
- GDB 7.8,1
- Newlib C library 2.1.0
GCC is GPL, so it one of these applies:
- they must give as patch
Transfer rate in excess of 600 kB/s
30MHz maximum JTAG clock
SW was something special for BA22: https://github.com/alephsecurity/BA2-toolchain
there are patches for gcc and other utils ..... anyone to take look?
then I go back to original site where It all started:
https://alephsecurity.com/2019/07/15/xiaomi-zigbee-3/
and previous post:
https://alephsecurity.com/2019/07/09/xiaomi-zigbee-2/
I installed radare2 pyba2 and run ti against bk8000l.bin, but I never use it so, I only try what I find on net :)
git clone https://github.com/radareorg/radare2
cd radare2 ; sys/install.sh
r2pm init
r2pm -i lang-python
git clone
https://github.com/alephsecurity/pyba2
cd pyba2
r2 -I ba2r2.py BK8000L
in radare2:
aaaa -AA
v