yashsingh1/xdaforums huggingface dataset:
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Yeah i know. I once worked with the eval version.

Very nice piece of software, but no freeware.

Good luck for your experiments!!!

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
IPL disassembled

Hi scholbert!

Attached you will find the IPL asm I've disassembled with IDA.

I hope it could be of some usefulness!

Cheers,

roglio
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi,

Great work!

Here's mine. As you will see it's very equal (at least it should be :D).

I made some comments already, but it's not finished yet.

The structure can be seen already. It is soon possible to reconstruct the whole asm code and compile it :p.

scholbert
[JASJAR, XDA Exec, MDA Pro General] mo3ulla:
is it all necessary ?? more easy way in desoldering flash ... and program it or change to flash from dead device
[JASJAR, XDA Exec, MDA Pro General] roglio:
@scholbert: wow you're always at least a step ahead!!! :eek:

Great! ;)

@mo3ulla: hi! yes it is worth the effort because the chance to have skills to build a jtag connector is greater than have skills (and tools) to reball a bga chip (and program it!).

With jtag interface and a relocated IPL we can resurrect bricked uni simply loading it in ram and running. Then reflash the pda with a simple usb cable :cool:
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi,

roglio thanks for the credits :).

But at least this no competition, it's really great that someone took a look at this posting and started to discuss.

This goes out to you roglio ;).

When i started this topic, i thought about a way to de-brick some uni's without touching the hardware. So roglio is absolutely right!

Once tried reballing at home???

At least the major point is:

Why touch the hardware, when it's a software problem?

Obviously no one got a programmer for mDOC devices!

If the universal would have NOR flash all things would be less complicated.

So what we are doing here, is to replace a 10.000$ programmer.

These professional devices do the same in the end, they use software algorithm to programm these NAND flashes.

The SPL uses the same software parts to reprogram G3 NAND flashes, but to start SPL (get into bootloader menu), IPL is needed. On a heavily bricked device these parts are damaged.

If we setup the device like IPL does or recompile IPL to run from RAM using JTAG, it could be possible to start SPL and get into bootloader menu.

The rest is already described here ....

Regards,

scholbert
[JASJAR, XDA Exec, MDA Pro General] scholbert:
O.K., here's dump from the bricked uni.

The screenshot shows the IPL section. It seems to be IPL version 2.36 which is for devices with a G4 NAND.

Mine is a G3, so this is the reason why it got bricked.

Someone updated the bootloader with a wrong version :(.

I enhanced the config file for the JTAG debugger with the settings i found out by disassembling IPL version 0.36 (G3 devices).

But unfortunately no success. The SDRAM is not accessible :confused:.

Without SDRAM initialised, i am not able do download SPL to the platform.

grumbl....

I'll have to check all settings again.

Especially the SDRAM setup...........

No time for that at the moment:rolleyes:.

Anyone who'd like to join our experiments????

Cheers,

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
Wow scholbert! Nice try!

I would try me too when my jtag equipment comes fully functional (lack of time).

Does you have a IPL dump for a G3 uni?

I think that we could disassemble it and peek all init values to try again!
[JASJAR, XDA Exec, MDA Pro General] scholbert:
:confused:

No it's everything in this post:

There's a dump from IPL 0.36 already and i also made a disassembly...

So you're joking ;) ?

Anyway thanks for your help so far!!!

If someone like's to check the SDRAM settings int the OCD config file, you're welcome :D

regards,

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
asleep

:eek: ehm... perhaps was too late to reply to posts :D

Weeeelllll: weekend is coming!!!!!!!!! And I'll be free to do some test :D

I'll post results!

Cheers!

roglio
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi again,

short update of my efforts so far:

Checked all settings of the SDRAM init again and found an error at least.

To make things safe i verified the init process with some other similar platforms.

Now everything seems to be fine :D.

At the least the configuration...

Unfortunately on my device only the lower half of SDRAM data bits are accessible. This seems to be a hardware problem of my bricked device.

Maybe one of the SDRAM chips died :(.

This not a good base for further experiments, because the RAM is not 100% O.K.

Anyone out there, who would like to make some experiments with JTAG on the uni?

Try the JTAG config file attached, with your device and load something to RAM.

It needs to be verified if the SDRAM can be accessed 32bit wide!

As i already said my hardware seems to be damaged....

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
Hi scholbert, I need an helping hand to make my jtag equipment working...

I spent the whole sunday trying to in any way to communicate with my uni but nothing!

What kind of hw interface are you using?

Where you bought it?

Which power source are you using?

OCD Commander say always "Internal error 43" and "cable disconnected".

I'm very tired!!!

I swapped nRESET and nTRST, I pulled them hi and low, I checked my jtag with a software that access to the parallel port and seems to work...

HELP!!! :(
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi roglio,

Arrgh, that's really annoying...

I use Macraigor Raven, it was part of a development kit. This hardware is connected to LPT port and is definitely supported by OCD Commander software package (so this is a must).

Use the JTAG Chain analyzer first (included) and make sure you choose the right hardware adapter. Which one are you using?

The raven needs external power supply, as well as supply from the uni itself for internal level shifters. If your hardware also uses level shifters these have to be powered from your target (HTC uni).

So please make sure, that you press the power button of the uni once, otherwise the connection will fail, because target power is missing.

Make some measurements, there must be 3.15V at the capacitors near the IRDA port.

I don't know what this error will tell us.

It seems that the adapter is not detected properly or not supported by the driver.

If the target power is missing or the PXA270 is not detected there would normally be another error (at least in my environment).

So this seems to be a more basic problem :confused:

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
Hi scholbert, thank you for suggestions!

My hardware is a wiggler clone with level shifters (74HCT244).

I've stolen the power supply from a cristal oscillator near jtag connection inside the uni but the voltage reach only 2,8 volts...

I pray that the problem wasn't that I doesn't have pressed the power button... because I'll going to kill by myself :mad:

This night I'll test it again, pressing the power button this time...
[JASJAR, XDA Exec, MDA Pro General] roglio:
Hi again, I've just found a workaround for Internal errror 43:

"This might be caused by a missing connection inside your "wiggler"

clone. Connect pins 8 and 15, then error 43 should go away."

I'll try this night too...

Cheers,

roglio
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hey folks,

time to resume:

I think it soon will be possible to recover heavy bricked uni and bring them back to usability :rolleyes:.

Unfortunately my device is not only bricked, the hardware also got damaged.

Today i configured the uni for 16bit SDRAM bus and voilà...

32MB useful memory.

Unfortunately the SPL still cannot be loaded to RAM for some reason (target bus error ) :confused:.

Perhaps need to convert SPL code to 16bit adressing ....

In addition the mDOC cannot be switched to normal mode.....

Perhaps all this stuff might be helpful at least....

i dunno,

P.S.: attached there's some info about the mDOC 3 devices used in the uni. Might be useful...

Best regards,

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
Don't give up!

Hi scholbert, I've fighted all night with my "so called" wiggler adapter that isn't a WIGGLER!!!! :mad:

I'm already finished to modify it to be compliant with wiggler's jtag interface: the only thing it still miss is to invert the nTRST signal and it will work.

I've also found GND and VCC pins near jtag connections (see picture attached).

Anyway with a program called h-jtag I've talked with the pxa270 and recognized it as a c5 stepping.

This night I count to start with first experiments (thank you for G3 documents).

Just for feedback: the OCD Commander "Internal error 43" was fixed connecting pin 8 with 15 on parallel port.

Cheers,

roglio
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi,

i really don't like to give up, but i think i'll have to stop working with my bricked device. There's definitely something wrong with one of the SDRAM devices.

Without 32Bit SDRAM working, further experiments do not make sense :o.

The SPL would never run correctly.

By the way i was able to load this file into RAM (configured 16Bit access). Single stepping through the code stopped at address 0xa0001...

It would be a waste of time to debug this, because there are to many	uncertainties about the cause...

So what could i do?

I won't disassemble my working device because i use it everyday :p.

Perhaps i will try to get some new memory chips and try to resolder SDRAM, like some guys out there already did!

Anyway let me comment on your efforts:

Coooool... nice pic!!!!

This seems to be the right choice for all windows users who might play around with JTAG. Very nice tool!

This might be very helpful for others, who stick at this point.

Good luck!

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
Your support

Hi scholbert, I'm near to solve my jtag connectivity problems: i need 1 transistor and 3 resistor to build an inverter for nTRST signal and make my jtag dongle finally compatible with wiggler's one.

After this big step, I will be ready to do some deep test with it.

Could I count on your support to go further?

Let me know if you have already some ideas that you couldn't apply because your uni is faulty. I will be pleased to test them for you (if my jtag works :D).

Cheers,

roglio
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi roglio,

Sure, i will answer everything i am able to!

The main idea was already described here:

1. use a JTAG config that sets up the universal hardware the way IPL does, afterwards SDRAM should be read- and writeable.

2. convert the dumped SPL binary (see previous posts) to make it loadable with your JTAG progammer/debugger

(H-JTAG uses HEX format, OCD Commander requires S19 format to load to RAM).

3. set PXA's program counter accordingly with JTAG (PC = 0xa0000000 or 0xa0001000) and start the SPL remotely.

4. start the code and see what happens, perhaps the lcd or USB cable should be connected to the uni to notice if anything comes back to life, at least the bootloader menu ???

If nothing will happen try single stepping through SPL.

Perhaps it is necessary to set the G3 to normal mode manually (this was not successfully done yet).

I'm not totally sure if this will ever work, but it's worth a try :D .

scholbert
[JASJAR, XDA Exec, MDA Pro General] scholbert:
hi again,

i just wondered if there's still any interest in this topic!

roglio excluded :D

I'm sure that some issues that we already pointed out, would be also useful for similar projects, e.g. modify IPL or SPL, in general Bootloader for mobile devices.

So experts, or anyone who's interested please join the discussion :o.

NAND devices like the mDOC G3 or similar are very common ... and will be even more the future i think.

I really hope there will be a GPL driver for these devices soon.

Back on track...

Due to the damaged SDRAM on my device, i'll concentrate on investigate the R/W sequence to gain access to the damned registers of the G3!!!!

Cheers,

scholbert
[JASJAR, XDA Exec, MDA Pro General] gquipster:
I for one certainly find it interesting - I have 2 bricked Universals in a drawer which I'm not entirely sure whats wrong with them.

I have no knowledge of JTAG or any JTAG hardware so can't help unfortunately but please do keep us informed.

Thanks for all your efforts.

G
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi gquipster,

thanks for your feedback :) .

It would be nice to have them back to life, wouldn't it?

Perhaps you'll find someone in your area who might do it for you!

I'll post all useful information here...

Thank you!!!

Again, any comments welcome :D

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
It works! (a little halting)

Hi scholbert! Finally my sh***y jtag dongle works!!!

I've modified it completely to get it recognized by OCD Commander.

Some problems still remains: sometimes it hangs and ocd say "command timeout".

It's probably dued to my poor lpt extension cord.

Anyway, first attempt done with my brand new wiggler clone was verify what version of IPL was fitted into my universal. Unexpectedly is the v 0.36 (the right version for G3 mDOC). Probably my uni was bricked by a bad SPL flash.

What do you think about it?

When I finished to fight with cables and soldering iron, I was too tired to continue testing. But just to study the memory map I've discovered that our pxa270c5 has 256KB of memory on die!

Does we could use it to load relocated ipl and spl?

Well is time to sleep.

Cheers,

roglio

P.S.: I've found these information here: http://wiki.xda-developers.com/index.php?pagename=Universal_Technical

P.P.S.: the physical address for the PXA270 Internal memory (256K) is: 0x5c000000-5c100000
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi roglio,

congratulation for this major step!!

Yes this could be one of the causes!

There could be many more reasons why it does not work the way it should.

Sometimes it's hard to say what's up with a little gadget.

By the way, have you ever tried to enter bootmenu on your device?

Just to make sure that your device is really bricked ;)

Why should we?

If your hardware is physically in good shape you might use 64MByte of SDRAM for that purpose (O.K. you'll have to initialize it :p ).

We have 1:1 memory dump of the SPL residing in RAM, why not use it!

Anyway, how would you perform a relocation of SPL???

This code has a 256KByte footprint, not that easy to examine.

IPL was easier to disassemble, it is XIP code and only 2K in size :D.

Regards,

scholbert
[JASJAR, XDA Exec, MDA Pro General] scholbert:
G3 access via JTAG!!!

Hi folks,

i can't believe it :D

Just found out how to switch the mDOC G3 into normal mode by a script using a JTAG connection (read/write access should be possible now).

At least this is a quite simple sequence if you got it!

The Chip ID can only be read out in normal mode, as well as modify some registers. So this was successfully done using the config attached :p.

Further tests will follow!

Perhaps it will be possible to create a sequence of reads and writes to the registers, to transfer a hole block or rewrite the IPL.

Cheers,

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
Awesome!!!

Hi scholbert! Great work! :)

This news open the way to the final solution!!!

Anyway, I would submit a little report of some tests I've done yesterday night...

Finally with my jtag dongle working, I started to play with cpu, memory and registers. I noticed that if I execute the IPL step by step, it will hang at address 0x20 without reason. My uni behave very strange because if I execute step by step the second copy of the IPL at address 0x400 it doesn't hang!!!!?

Why?

The good news is that this second IPL works correctly and initialize the uni to jump at address 0xa0000000 (SDRAM start address).

Then I suppose that loading the SPL in ram at that address it should work.

What do you think about the strange hanging and the second presumption?
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi,

:confused:

I really don't know. There's similar behaviour on my device when i use single step. Maybe this does not work in any case?

That's great news :)

I wished mine would do also!

Yeah, maybe!

If the SPL could be started remotely, this would be another milestone! I'll keep my fingers crossed.

You should attach your LCD to see if something is happening.

I'm already getting nervous ;).

Good luck,

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
This night I'll load a working SPL in ram.

Yes, me too!

Already done! :D

Arg! Damn work! I wish I was at home testing... :mad:

Cheers,

roglio
[JASJAR, XDA Exec, MDA Pro General] roglio:
First try failed...

Well I resume what I did:

1. connected to uni via jtag and halt it

2. set PC to 0x4008 (IPL working copy)

3. set hardware breakpoint just before the IPL jumps to 0xA0000000 (SPL)

4. downloaded a fresh SPL in ram

5. go... but nothing :(

I've tried also to keep pushed power + light during the process but nothing.

Now it has some errors in the process or the SPL I loaded is broken...

I don't know :confused:

Suggestions?

Thanks.

roglio
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi roglio,

this hardware is a real nut. Very hard to crack :(

Yepp, this is definitely the first step ;).

Mmmmh, normaly the IPL resides at 0x0-0x800. That's the address the PXA should jump to after power on reset...

A copy of IPL is placed at 0x1800-0x1FFF. Both IPL bootblock areas should contain absolutely the same code

Inside the mDOC G3 there's a download engine that copies the code from internal NAND chip into these areas right after reset is released (at least it is kind of mirroring the code to these adresses).

So perhaps you should check these memory area again.

Should be O.K.!

Anyway which file format do you use for SPL download?

grrrrrmmblll

Though it did not work, the steps sound good to me.

When you do this.... try to halt the CPU. What's the value of PC?

Ufff... i don't know what' the state of the hardware at this point...

This is what i'll try next:

1.Try to desolder at least one of the contacts of the tiny backup battery. Without it buffering RAM you could be sure, we do a real hard reset. Do not try to push any button, let it roll...

2. Halt the CPU again and check the area at address 0x0, there should be some code of IPL, because this is the reset entry point.

3. Load SPL again... check if it was really loaded to SDRAM, do the bytes look O.K.

4. Set program couter to 0xa0000000 and go.....

Even without any button the device should reach an early stage of the SPL code in SDRAM.

Cross finger's again.

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
Linux ?

Hi scholbert, at moment I'm very tired and tomorrow is another hard work day (the last of the week at least :cool: )

In the meantime I was reading some information about the memory map of the universal, I stumbled on the linux project... and thinking that it could be interesting to do some experiments with that...

Tomorrow I'll take a deep look.

Cheers,

roglio
[JASJAR, XDA Exec, MDA Pro General] roglio:
New ways

Hi scholbert, hi forum. At moment I have no idea on how to proceed.

Some experiment are already done and failed.

We need to put focus on how restore a bricked uni or in general how to restore a bricked device using jtag facilties.

The main issue is that mdoc chips (g3 and g4) are hard to understand.

Scholbert have already discovered how to access to the G3 configuration register but at moment isn't clear how to reflash it.

Some other ways are:

1. using linux, boot via jtag loading the kernel in memory and launch it;

2. find jtag tools that handles mdoc chips

3. modify jtag_mm (once a time distribuited by intel) to handle PXA270 and mdoc chips.

I will try to put my effort on the last point.

Someone has other suggestions? Them are welcome!!

Cheers,

roglio
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi there,

first, many thanks to roglio for summing up!

Yes of course, this was the reason for this thread ;)

That's true, but i think there's a way to get full access to these devices, even without a fully blown JTAG programmer. Either this will be possible using a very tricky JTAG setup or developing a simple driver integrated into a linux environment.

This should work, but without a driver for mDOC won't be such a big help!

That'll be nice. But there's nothing out there :confused:.

Of course this would be nice!

A more or less simple tool to for recovering bricked devices would be the result. Anyway this could be a hard job!

I will give you as much support as i can!

If we're looking for alternatives there's not much left.

There's a version of the famous openwince-jtag tool out there, that already supports DOC Millenium devices. These we're predecessors of the mDOC G3.

So these devices a quite near from technology point of view!

Maybe another starting point :rolleyes:.

At least the G4 is a successor of the G3 but many parts, concerning the handling (e.g. memory windows, CPU acccess) we're changed.

So perhaps it will be useful to concentrate on the G3 first.

Another very adventurous way would be the use of a bootloader completely designed for SDRAM, which integrates simple routines to access the DOC.

I am thinking of a project, dedicated to the IPAQ H4700.

The aim of this project was to create a GPL bootloader to start a linux distribution without using wince for this. It is simply called bootldr and was developed by some guys at the Compaq Research Laboratories. Have a look at handhelds.org.

Since it's birth, this bootloader has been used for many platforms.

But as i said this would be an adventure :D .

To get back on track...

I'll have a look at the jtag_mm and the openwince jtag sources too. The information i got about the mDOC is growing every day (of course i still need more time...), perhaps we'll find a solution.

Regards,

scholbert
[JASJAR, XDA Exec, MDA Pro General] scholbert:
openwince jtag DOC devices

Hi again,

at least roglio might be interested...

Here's the link to the mypal A620 project, using modified openwince jtag to restore DOC.

In this case it was a DOC Millenium Plus.

http://www.handhelds.org/moin/moin.cgi/MyPal620

Cheers,

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
Hi scholbert! Yes it is very interesting!

At moment I have a dumb problem :( How could I extract information and modules from .nbf and nb0 files?
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi,

i personally use HyperCore Kitchen. Very comfortable!!

Have a look around in the forum, to download this tool.

Edit:

Just found the thread here:

http://xdaforums.com/showthread.php?t=309549

Regards,

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
Thanks! It is perfect!

Cheers,

roglio