Nintendo Switch - fully working except payload injection

I do have an odd thing with one of my repaired Nintendo Switches.
The Switch is a V1 Switch and seems to be fully working - so it can be started normally, can be charged. Dock is working - so everything seems fine.

I can bring the switch in rcm mode, but payload injection does not work - so simply payload won’t be injected.

Screenshot 2021-11-05 171929

I currently have no idea what is wrong and how this can be fixed. Any ideas / experiences with such a problem and an idea how to fix this ?

What’s the HAC-CPU ## on the board?
Did you check serial number? https://ismyswitchpatched.com/

Yes, I checked it - but even if this would be a patched switch the payload injection will work - only without the desired result…

Does TegraRcmGUI spit out a code following hitting the inject payload button, like 0x0000 ? or simply nothing?

Simply nothing - so the payload won’t be injected. TegraRCM will stay in the attached image. So there is no return code or something - it simply won’t be sent to the switch… I checked with the PC and a dongle - same result… very odd.

Yeah odd, did you try changing USB orientation? As it does seem to imply potential USB issues

Also tried without any change… :question: :question: :question:

Is your PC reporting a connection to the Switch under normal circumstances, non RCM?

Best guess would be USB issues, I’d verify continuity with USBC breakout first

Well, in normal mode when I connect the USB-C via Windows the Switch in charging normally - I asked myself if a trinket would work or is this would be wasted time…

Yep. Check resistance on D-/D+ - you should be getting 3.9 MOhm on both IIRC. This is a common failure mode as these lines go straight to the SOC and can kill the USB controller required for the boot CPU to communicate in RCM. Typically caused by a damaged connector and 15v getting to where is shouldn’t.

The other symptom which gives it away would be failure to fast-charge using a standard USB A-C cable as these rely on the D+/D- lines for crude level signalling. I’ve got a couple of old unpatched boards here with knackered D+/D- lines effectively blocking any payload.

Sheriff.

Hey @SheriffBuck - thanks for that information - I was going to think that I am the only one having such a strange problem.

Even the USB port looked ok I changed it - with no positive effect - so still everything is working but the payload injection.

I’ve got a couple of old unpatched boards here with knackered D+/D- lines effectively blocking any payload.

Was there a possibility to fix this ? Seems to be a good protection…
Will probably sell the Switch as the normal functions are all working…

What diode or resistance reading do you get on D+/D- relative to ground in both probe polarities do you get? (diode mode is better here due to the differences in board revisions and the typically high resistance)

At least some USB functionality must be remaining if it’s showing up in RCM state in TegraRCMGUI

No, I haven’t checked the Tegra datasheet but would imagine there is more USB bus I/O, though I have no idea if they are broken out anywhere, if they are a potential workaround could in theory be installed - assuming of course it isn’t reliant on the presumed bad I/O

Actually there is another USB controller (USB 3) in there that’s totally separate (this joins the DP data across the USB-C in addition to USB 1) and provides services to the dock etc. I suspect it’s not accessible by the BPMP or at least insuficiently coded in the boot firmware to activate it.

Actually you make a great point here. When the D+/D- lines are damaged in some way, then Windows will generally report USB Device Not Recognised…