IPAQ hw6915

跳转至: 导航搜索

HTC Sable

great device. expensive, but really good quality components. doesn't have UTMS (3g) but does have GPS _and_ GSM.

nearly everything is supported on the kernel side that makes this device a useable PDA. enough research has been done to access all the major hardware, with the remainder being a fairly easy tidy-up job, or hardware shared with other devices.

the only major bits of work are now primarily user-space related: the GPS (which is a known proprietary chipset, with people 'on the case') and the GSM. the protocol to communicate with the GSM is known: it could in fact be pretty easily done as a tty line-discipline module (if i knew how to write tty line discipline drivers, i'd do it...)





kernel modules - todo

  • Battery monitor (needs asic3_owm common code with universal and hx4700, based on ds1wm)
  • Suspend/Resume (look at h4000, take the jump address from universal)
  • Charging (gpio trace and IRQ needed)
  • camera (same as magician and universal)


CPU: PXA270 PXA280C5C4

sound: AKM 4641VN (same as on HTC_Universal - see HTC_I2C_IDs for i2c address)

bluetooth: TI BRF6150 E1 (same as on HTC_Universal)

1st container

wlan: TI ACX100 includes TNETW 1100B ZHH (TNETW1100BZHH C E 65AC9CT), MAXIM MAX2820 (MAXIM MAX2820 ETM615 NN7N1LQ) and i2c eeprom: 2408 WP (near the TNETW and MAX2820)

(same as on HTC_Universal)

dual-supply bus: wd4245 (WD4245 5CJ AC2L G1) 32-bit dual-supply bus transceiver datasheet: http://www.ortodoxism.ro/datasheets2/c/0gitjh32jszd0j2pi4fkfq8qp7wy.pdf

2nd container

PXA power management: MAXIM MAX 1587A ETL 603 NTIP1FX

sound: AKM 4641VN 0612JBH - in same area as power management, ASIC3 and PXA270.

rtc: R8564 EF096A - right next to ASIC3 drivers/i2c/chips/rtc8564.c

unknown: LC404ZC 75MN6 A602RR10 - right next to ASIC3 (probably a lattice cpld for clock distribution)

RAM: Infineon B HYB18L256160BF-7.5 WVV26909 0614

ASIC3: HTC 30H80028-01M S17102 JAPAN 0605EGI F0038ZAE

diskonchip: m-systems DiskOnChip G4 WD 8832-d1G-V3-X-P JAPAN0615KFD1XU9710

3rd container - lots of weird stuff

i thought you might appreciate this: some other people, on a chinese forum, are also doing disassembly of erikson phones, and finding the same chips as listed here :) http://www.ilephone.com/thread-135-1-2.html

unknown: DB2011 751979AZ 59A9FEW SA RIA GI [1] (apparently same chip used in sony/eriksson k500/k700)

unknown: 3040L0YTQ0 A6077631 Z609I228B - 0s could be Os in the first two numbers. vague preliminary searches indicate that this might be an intel flash memory chip.

unknown: DB2202 751543Z 64A20KW $4 RIA GI

unknown: AB2001 R1A TWL93004CZ R61E73KT - on some random russian site apparently this looks like it's a power supply IC.

references to AB2001 R1A here: http://www.gsmhosting.com/vbb/archive/index.php/t-290096.html someone talking about flashing an EROM (whatever _that_ is)... again: it's something associated with an eriksson k700i.

4th container

bluetooth: B6150E1 63DVKDT

5th container - probably GSM/GPRS

unknown: RF9388 0614 D013NLB - possibly a power amplifier.

unknown: RF 2010 P1P8M cPG605 P38/1

unknown: 6012 58

unknown: 1RA4B 2020L05 - very difficult to read. chip is 5mm square, 20-pin round edges.

6th container - GPS!

Baseband processor: RL - 20000 E1 0520 Z14 http://www.globallocate.com/SEMICONDUCTORS/SEMI_GL20000_Frameset.htm

LNA and mixer: LN22 P1 6Y 60527 - could be a G0527 http://www.globallocate.com/SEMICONDUCTORS/SEMI_LN22_Frameset.htm

both the LN22 and the RL-20000 have a picture of a globe on them. the LN22 is tiny (4mm x 7mm) with edge-pins and the RL-20000 is a BGA 8x8mm

this area has a crystal in it: R4009 Y63B 4T

other info

Power IC TWL93004 SonyEricsson K500/K700

2408 WP - some random information:


ASIC 3 - one rev up from the other ipaqs and HTC smartphones (the same as on HTC Universal).

can't edit the HTC_Partnumbers page to add this one. full chipset number is obscured by a cage shield that is soldered to the circuit board. which i just cut away :)

MAXIM 1587A:


http://www.handhelds.org/moin/moin.cgi/HandheldHardwareXref http://www.handhelds.org/moin/moin.cgi/SupportedHandheldSummary

rs232 / connector pinouts


resetting your hw6915 into bootloader

action button + action button + reset (all at the same time for a few seconds)

reset can only be pressed with a stylus. action buttons are the ones in between the phone buttons and the funny joystick selector thingy.

Ipaq 6500/6900 Disassembly Instructions