Hardware Debugging faulty BCM4356 / orange screen / boot loop

SciresM

Developer
Developer
Joined
Mar 21, 2014
Messages
973
Trophies
3
Age
33
XP
8,298
Country
United States
Do you guys have some reader for the chip? Maybe possible to dump the info of it?
@SciresM (sorry I know you hate to be tagged) do you happen to know if the software of that chip is dumped?

I don't hate to be tagged.

iirc we dumped the bcm stuff around the time broadpwn was a thing, but it's also just embedded in the wlan sysmodule(?)
 

linuxares

The inadequate, autocratic beast!
Global Moderator
Joined
Aug 5, 2007
Messages
13,382
Trophies
2
XP
18,305
Country
Sweden
I don't hate to be tagged.

iirc we dumped the bcm stuff around the time broadpwn was a thing, but it's also just embedded in the wlan sysmodule(?)
Can the chips between units be swapped around if you happen to know that? So they aren't fused with the Switch it came from?
 

acidcoolxxx

Active Member
Newcomer
Joined
Mar 14, 2019
Messages
35
Trophies
0
Age
24
XP
105
Country
Austria
Using Droid Info i read out my sys Info. There is a point "WIFI:Yes"
I have installed Terminal info to get some more infos.
Using the command lspci i was able to get the device id: class 0280: 14e4:4354
https://devicehunt.com/view/type/pci/vendor/14E4/device/4357

As you can see the Wifi is not broken or cant be found. It is there but i need to find how to debug the wifi what is really going on.
because if I dumpsys it show me in CHipset information
Version is: null
driver version: null

i checked my other switch the id is here 14e4:43ec

my guess is now u can programm the OTP to this chip id devid 0x43EC Chip ID, CYW4356
 
Last edited by acidcoolxxx,
  • Like
Reactions: ds34

GrimDim

Well-Known Member
OP
Newcomer
Joined
Aug 16, 2019
Messages
77
Trophies
0
Age
34
XP
195
Country
Germany
Ok I'm sure it can't be the wifi chip itself, I've changed it over so many times now without it fixing the issue. But maybe something related to wifi functionality...
 

acidcoolxxx

Active Member
Newcomer
Joined
Mar 14, 2019
Messages
35
Trophies
0
Age
24
XP
105
Country
Austria
This is what I try to do. Want to try to install a different firmware for the bcm4354 maybe i can use wifi than. Im new to android so it take time for me.
found this command but it isnt used in android.
dmesg | grep brcm
[ 3.070795] usbcore: registered new interface driver brcmfmac
[ 3.181274] brcmfmac: brcmf_fw_map_chip_to_name: using brcm/brcmfmac4356-pcie.bin for chip 0x004356(17238) rev 0x000002
[ 3.197897] bluetooth hci0: Direct firmware load for brcm/BCM4354A2-0a5c-640e.hcd failed with error -2
[ 3.197899] Bluetooth: hci0: BCM: Patch brcm/BCM4354A2-0a5c-640e.hcd not found
[ 5.660119] brcmfmac: brcmf_msgbuf_query_dcmd: Timeout on response for query command
[ 5.660126] brcmfmac: brcmf_c_preinit_dcmds: Retreiving cur_etheraddr failed, -5
[ 5.660128] brcmfmac: brcmf_bus_started: failed: -5
[ 5.660135] brcmfmac: brcmf_pcie_attach_bus: dongle is not responding

something like this for anroid will be usefull.
Im reading something about logcat

Some anroid users here? Need a command that does this on Android.

Sadly my SDcard died due to the changing from one to the other. Get two new ones so i can investigate further.
 

GrimDim

Well-Known Member
OP
Newcomer
Joined
Aug 16, 2019
Messages
77
Trophies
0
Age
34
XP
195
Country
Germany
Using Droid Info i read out my sys Info. There is a point "WIFI:Yes"
I have installed Terminal info to get some more infos.
Using the command lspci i was able to get the device id: class 0280: 14e4:4354
https://devicehunt.com/view/type/pci/vendor/14E4/device/4357

As you can see the Wifi is not broken or cant be found. It is there but i need to find how to debug the wifi what is really going on.
because if I dumpsys it show me in CHipset information
Version is: null
driver version: null

i checked my other switch the id is here 14e4:43ec

my guess is now u can programm the OTP to this chip id devid 0x43EC Chip ID, CYW4356
I can't really reproduce your test on my switch, as for me lspci returns nothing! Do you have multiple devices in the output or is 14e4:4354 the only one?
No mention of a wireless device in any other hardware info commands either. Bluetooth is still good though.
 

acidcoolxxx

Active Member
Newcomer
Joined
Mar 14, 2019
Messages
35
Trophies
0
Age
24
XP
105
Country
Austria
I can't really reproduce your test on my switch, as for me lspci returns nothing! Do you have multiple devices in the output or is 14e4:4354 the only one?
No mention of a wireless device in any other hardware info commands either. Bluetooth is still good though.

I also installed magik so im rooted.
use this app:
https://play.google.com/store/apps/details?id=jackpal.androidterm&hl=en

you need to be a superuser just type su so u get the # in the commenline

now try lspci
(Yes, I have two devices there.)

u can use blutooth to get internet on the console
 
Last edited by acidcoolxxx,

GrimDim

Well-Known Member
OP
Newcomer
Joined
Aug 16, 2019
Messages
77
Trophies
0
Age
34
XP
195
Country
Germany
I also installed magik so im rooted.
use this app:
https://play.google.com/store/apps/details?id=jackpal.androidterm&hl=en

you need to be a superuser just type su so u get the # in the commenline

now try lspci
(Yes, I have two devices there.)

u can use blutooth to get internet on the console
Yeah I'm rooted too and I used the terminal from the developer settings. Strange...
(good tip with the bluetooth tethering)

---

Actually, I just discovered a short on one of the caps near the chip, so my last soldering attempt was not a success. Problem is I lost access to the hot air station with current events, so I won't be able to debug with you atm :/ @acidcoolxxx
 
Last edited by GrimDim,

acidcoolxxx

Active Member
Newcomer
Joined
Mar 14, 2019
Messages
35
Trophies
0
Age
24
XP
105
Country
Austria
Yeah I'm rooted too and I used the terminal from the developer settings. Strange...
(good tip with the bluetooth tethering)

---

Actually, I just discovered a short on one of the caps near the chip, so my last soldering attempt was not a success. Problem is I lost access to the hot air station with current events, so I won't be able to debug with you atm :/ @acidcoolxxx

I check with my multimeter too. There are some shorts but on both consols are the same.
 

GrimDim

Well-Known Member
OP
Newcomer
Joined
Aug 16, 2019
Messages
77
Trophies
0
Age
34
XP
195
Country
Germany
I check with my multimeter too. There are some shorts but on both consols are the same.
Are you talking about these parts here? Because they are shorting for me too but as you said I think that's normal.
nintendo-switch-motherboard.png

But I found a short right here, which I'm pretty sure should not be there:
nintendo-switch-motherboard-2.png
 

Modificatorul

Well-Known Member
Member
Joined
Oct 28, 2009
Messages
270
Trophies
1
XP
2,335
Country
Antarctica
The cap next to bcm 4356 it's not shorted on a working switch, remove the ic the short will diseapear reball bcm 4356 and try again, or go to gsm shop thei should have the exprerience to reball the ic and solder properly you can use iphone 6, a8 cpu stencil if you dont have the dedicated one.
Inspect the solder mask on bcm 4356 and corect with uv paint if is the case.
Working donor bcm 4356 can by transplanted i tested on 2 ns and is working.
New cips don't work ,probaly will work if we manage to reflash them.
Some sellers on aliexpress claim thei send pulled ic and if thei are not already broken should work.

@SciresM any chance for a custom sysmodule to disable the wifi/bt checks on boot ?
 
Last edited by Modificatorul,
  • Like
Reactions: ds34

acidcoolxxx

Active Member
Newcomer
Joined
Mar 14, 2019
Messages
35
Trophies
0
Age
24
XP
105
Country
Austria
New cips don't work ,probaly will work if we manage to reflash them.
Some sellers on aliexpress claim thei send pulled ic and if thei are not already broken should work.

So they we where on the right trace. If my SD card are here i try to flash the chip. Should be possible, if i can read out the working one.
 

GrimDim

Well-Known Member
OP
Newcomer
Joined
Aug 16, 2019
Messages
77
Trophies
0
Age
34
XP
195
Country
Germany
The cap next to bcm 4356 it's not shorted on a working switch, remove the ic the short will diseapear reball bcm 4356 and try again, or go to gsm shop thei should have the exprerience to reball the ic and solder properly you can use iphone 6, a8 cpu stencil if you dont have the dedicated one.
Inspect the solder mask on bcm 4356 and corect with uv paint if is the case.
Yeah that's what I've been doing so far with varying levels of success, I have the proper stencil and everything, but it's tricky since everything is so small. I'll do another attempt as soon as I get access to equipment again. Might just buy a cheap hot air station to do it at home.

Working donor bcm 4356 can by transplanted i tested on 2 ns and is working.
New cips don't work ,probaly will work if we manage to reflash them.
Some sellers on aliexpress claim thei send pulled ic and if thei are not already broken should work.
Thanks for confirming our suspicion that new chips won't work. Although it seems to go against what Tariq was saying here:
They do not use any sort of custom firmware for these IC's, it is connected over I2C/UART and that is used to configure on boot/interact.

So they we where on the right trace. If my SD card are here i try to flash the chip. Should be possible, if i can read out the working one.
Yes so I tried looking into how to do that, but I think the biggest challenge will be to get proprietary driver and wl utility that they mention in the document, since it has to be compiled for our specific platform. Not sure if the open source driver support any of that since the OTP is supposed to be programmed during production.
 

acidcoolxxx

Active Member
Newcomer
Joined
Mar 14, 2019
Messages
35
Trophies
0
Age
24
XP
105
Country
Austria
Yes so I tried looking into how to do that, but I think the biggest challenge will be to get proprietary driver and wl utility that they mention in the document, since it has to be compiled for our specific platform. Not sure if the open source driver support any of that since the OTP is supposed to be programmed during production.

https://community.cypress.com/thread/48731 there is soem link for download. Think they provid you with the needed drivers cuz the thing is IOT amied
 

GrimDim

Well-Known Member
OP
Newcomer
Joined
Aug 16, 2019
Messages
77
Trophies
0
Age
34
XP
195
Country
Germany
Last edited by GrimDim,

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    rqkaiju2 @ rqkaiju2: yeehaw