yashsingh1/xdaforums huggingface dataset:
[JASJAR, XDA Exec, MDA Pro General] scholbert:
We're not alone

Hi,

i just came across this thread:

http://xdaforums.com/showthread.php?t=253585

So basically this attempt is exactly what we're trying to solve here!

Due to the fact that the basic function of both DOC devices (M+ <-> G3) are similar, the structure of DOC Millenium Plus driver should be usable for the G3 devices too!

Some parts of this driver, can also be found in universal's IPL loader :D.

Anyway, to implement the G3 into openwince-jtag we need more info about some registers. Unfortunately there are unknown registers, that are involved in those low-level routines. These are not documented in the datasheet of the chip :mad: .

So what we really need is a full register description.

This is what we got from the wiki (thanks to the brave, who discovered this!!) and from the datasheets:

offset	length	documented	read/write	Description
+1000	short	+	RO	chipid_0 (G3=0x200, G4=0x400)
+1004	byte	+	RW	test
+1008	short	+	RW	endian control
+100a	byte	+	RW	device id select
+100c	byte	+	RW	DoC control
+100e	byte	+	RW	configuration
+1010	short	+	RW	interrupt control
+1014	byte	+	RW	output control
+101a	short	+	RW	read address
+101c	short	+	RW	multiburst mode control
+101e	byte	-	W	0x0
+1020	byte	+	RW	interrupt status
+1022	byte	-	W+
+1032	byte	-	W	?FlashSelect : 0xe, 0x12, 0x0, 0x9, (0x31,0x1d, 0x27-erase)
+1034	byte	-	W	?FlashCmd : 0x30, 0x5, 0xe0, 0x60, 0x22, (0x3c, 0xa2, 0x50, 0xff, 0x71, 0x80, 0x11,0xd0-erase)
+1036	byte	-	W	?FlashAddr
+1038	byte	-	RW	?FlashCtrl: w 0x39, r &0x6
+103a	short	-	R	read data from flash
+103e	short	+	W	NOP (write here causes a delay)
+1040	short	-	(R)W	0x8a0f
+1042	byte	-	R	tst 0x80 (tst 0x20 -hamm)
+1044	byte	-	W+	0
+1046	byte	-	R+	hamm
+1056	byte	-	RW+	(orr 0x8)
+105c	byte	-	W+
+106c	byte	-	R+
+1072	byte	+	RW	DoC control confirmation
+1074	short	+	RO	chipid_1 (G3=0xfdff(~200), G4=0xfbff(~400))
+1076	byte	-	R+	(orr 0x80, 0xc3)
+1078	short	+	RW	dma control 0
+107a	short	+	RW	dma control 1
+107c	byte	+	RW	DPD

Anyone out there, who has a complete header file for mDOC G3?

Regards,

scholbert
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Some more info...

This is how a basic access to the NAND chips inside mDOC should look like.

Taken from "Guidelines for Integrating DiskOnChip in a Host System":

This is were the HTC Universal IPL code lives.

These are the low-level routines for our driver!!!

This sequence has to be coded into subroutines in driver code....

Very funny statement!

At least the settings and commands are not fully discovered, and yet not complete :(.

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
Linux drivers for mDOC

Hi scholbert, do you know that linux has drivers for these bastard chips?

/linux-2.6.23.14/drivers/mtd/nand/diskonchip.c

It seems that only older version of disk-on-chip are supported but anyway it could be a good place to try to very already know register and look for others information.

Cheers,

roglio.
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi roglio,

sure i knew that...

The DOC Millenium Plus was the last device supported by this driver.

So nothing about G3 in there. Anyway thanks for posting the file!

At least the there's similar code in the patch from the mypal A620 project.

This seems to be a better starting point for the JTAG tool.

Everything for DOC Millenium Plus is included there....

We have to crack the G3 nut :cool:

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
JFlash_MM

I've just finished to implement the wiggler pinout into jflashmm...

Tonight I'll try it.

A miracle: I've found the .dat file for pxa270 platform...

BTW it miss the .dat file for mDOC chips... But this is another story.

We could try using the .dat configuration guide, to create it.

But, one step at once...

Cheers,

roglio
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi roglio,

Sure... one small step for a man, but a huge step for mankind :D

Good luck for that anyway!!!

I will concentrate on driver code.... not sure if the .dat file thing would work for G3.... No idea...

scholbert
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Keep it up...

Hi there,

just thought that it is worth to keep this thread alive :D

In the meantime a had a look around...

There are many out there who tried to crack the DOC G3 nut.

There's the linux geeks who made first attempts to access the G3 with a char device driver. This code is based on a typhoon device.

There's another source i found from a guy who also disassembled the IPL of a G3 device...

Do not remember at the moment, it's also a HTC device.

The code is very equal to what the disassembled IPL of the uni does looks like.

And of course there's the guy who successfully jtag'd a myPal A620....

So let's put things together :rolleyes:

By the way.. roglio some progress with jtag?

Cheers,

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
No news is a BAD news

Hi scholbert, last two weeks are passed without any noticeable advancement.:(

My attempt to modify jflash_mm are failed and seems that my silly jtag cable wont work anymore...:mad:

During the coming week I will try to fix it to do some further experiments...:p

I'll keep the forum and you informed!

Cheers,

roglio

P.S.: I've dumped from a working uni another IPL: this time is a v0.38 (attached)
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi roglio,

thanks for the ipl V0.38 code.

It's basically the same as V0.36, only some busdrivers are loaded with different values.

All the doc G3 stuff is the same.

So, this what is going on...

This project is growing more and more into a software project.

I found at least some guys in the web who tried to gain access to G3 doc devices. Maybe i already posted this :confused:

...

What will be very useful for some guys out there would be a GPL'ed g3 driver.

Perhaps one of them is willing to help ;)

At least i'm not a very good hacker...

cheers,

scholbert
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Just another report

Hi,

now i use urjtag 0.7 for implementation of some DOC G3 routines.

The urjtag project has been started recently as a successor of the famous openwince jtag (www.urjtag.org).

Unfortunately, using this tool there are some basic problems to access the bus on htc universal. This has to be fixed first.

There's a lot of active work by the project maintainers at the moment, so it may be a good thing to contact them for help :D

Once the bus access is working properly further steps should follow.

The basic implementation of the G3 code should work though :rolleyes:

If writing some code to the G3 devices will be possible using this method, is not clear at the moment ...

Stay tuned!

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
Hi scholbert, any news about mdoc g3 integration into urjtag?

Cheers,

roglio

P.S.: I've installed ubuntu to work directly in linux that seems to be more stable than windows for jtag operations. For instance openwince-jtag works seamlessly
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Busy times

Hi roglio and anyone who came along here!

I'm very busy at the moment. So no time to waste :p

Seriously, the JTAG stuff is a hard piece of work.

As i reported there some bus access problems using urjtag.

It seems it's not an hardware issue, because i used the same adaptor successfully with other software. The uni is also fine!

It' impresive, this piece of hardware survived all the experiments so far :D

So what's left is checking urjtag's bus driver, perhaps some parts have to be modified for the universal. Check again bus timing and reset generation.

For now i am not able to halt the pxa cpu :confused:

Damn thing.

I'm not sure if there will be some progress in the near future. Hardware is getting cheaper all the time, and the G3 is already obsolete.

I suppose the interest of the people to spent some development in here will fade. Perhaps i will succeed.

Cheers,

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
Damn work!

Hi scholbert, it's nice to read you.

Just a dumb question: what is the command to halt the cpu with urjtag?

I'll test with my equipment. Under linux it work really well and detect the pxa270 like a charm.

I'm busy too with work, real life, etc... I underdestand you very well :)
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Greetings

Hi roglio,

yeah check it out!

The command is very simple:

reset halt

more simple:

halt

The help command gives you anything :)

Best regards,

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
halt?

Hi scholbert, halt command isn't recognized by urjtag...

Anyway these are the results for some commands:

jtag> detect

IR length: 7

Chain length: 1

Device Id: 01111001001001100101000000010011 (0x0000000079265013)

Manufacturer: Intel

Part(0): PXA270

Stepping: C5

Filename: /usr/local/share/urjtag/intel/pxa270/pxa270

jtag> print

No. Manufacturer Part Stepping Instruction Register

---------------------------------------------------------------------------------------------

0 Intel PXA270 C5 BYPASS BR

Active bus:

*0: Intel PXA27x compatible bus driver via BSR (JTAG part No. 0)

start: 0x00000000, length: 0x04000000, data width: 16 bit, (Static Chip Select 0)

start: 0x04000000, length: 0x04000000, data width: 16 bit, (Static Chip Select 1 = GPIO[15] )

start: 0x08000000, length: 0x04000000, data width: 16 bit, (Static Chip Select 2 = GPIO[78] )

start: 0x0C000000, length: 0x04000000, data width: 16 bit, (Static Chip Select 3 = GPIO[79] )

start: 0x10000000, length: 0x04000000, data width: 16 bit, (Static Chip Select 4 = GPIO[80] )

start: 0x14000000, length: 0x04000000, data width: 16 bit, (Static Chip Select 5 = GPIO[33] )

start: 0x40000000, length: 0x20000000, data width: 32 bit, (PXA270 internal address space (cfg, SRAM))

start: 0xA0000000, length: 0x10000000, data width: 32 bit, (PXA270 SDRAM space (4x 64MB))
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi,

that's right. The command should be supported, but it has no effect on the device.

It's the same with my hardware.

Regards,

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
discovery?

Does you know what's the meaning of the discovery command?

On my hardware it attempts for 128 times (7 bits) to discover for an IR something...

It returns 1 or -1 but for these IRs:

Detecting DR length for IR 0000000 ... 504

Detecting DR length for IR 0000001 ... 504

Detecting DR length for IR 0110001 ... 24

Detecting DR length for IR 0110100 ... 40

Detecting DR length for IR 1011010 ... 40

Detecting DR length for IR 1011011 ... 45

Detecting DR length for IR 1011100 ... 71

Detecting DR length for IR 1100011 ... 38

Detecting DR length for IR 1100100 ... 22

Detecting DR length for IR 1100111 ... 16

Detecting DR length for IR 1101000 ... 16

Detecting DR length for IR 1101011 ... 21

Detecting DR length for IR 1101100 ... 40

Detecting DR length for IR 1111110 ... 32

Could it be possible that these IR are addresses where other jtag devices are in chain?
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi roglio,

no.

The PXA270 is the only active part in the jtag chain, if you use the port you documented in the picture some time ago.

To understand the discovery command you'll have to take a deep look into the JTAG specifications.

Every device that offers jtag access (or jtag service at least) got a TAP controller. TAP controllers are kind of a command interpreter.

So if you send a command it will return certain data over the serial data line.

e.g.:

Detecting DR length for IR 0000000 ... 504

does mean sending TAP comand 0000000 give a return value of 504 serial bits.

This seems to be the hole processor chain length.

The other commands give different values, content of special core registers etc., that are also managed by the TAP controller.

urjtag is able to send 7-bit commands (128 commands). Some are not supported by PXA (return length zero)

Regards,

scholbert
[JASJAR, XDA Exec, MDA Pro General] roglio:
Thanks

Thank you for these clear explanations! Now I understand.

Anyway give a look to this address: http://www.handhelds.org/moin/moin.cgi/MyPal620JTAG

The author applied some patches to original jtag 051 to handle doc plus...

Tomorrow night I'll give it a chance.

Goodnight and again thank you.

Cheers,

roglio
[JASJAR, XDA Exec, MDA Pro General] roboknave:
JTAG

roglio,

The info you were seeing with the JTAG are the different register lengths.

The 504 bit registers are most likely the extest/sample/preload registers. The ones where you can monitor the pins. There should also be a register that contains the chip ID that you can clock out (it is usually 32 bits long).

The other registers serve other functions (unknown what they all do on the PXA270).

When you do a "detect" it sends in various commands on the IR register and checks the length of the DR by clocking a bit pattern through to find the length (when it finds the matching pattern, all the bits before it represent the bits in the register before the pattern was clocked in... so it is the register length). Depending on how many bits the IR has (which if I'm correct, its 7 in the PXA 270 case), that determines how many POSSIBLE combinations have to be checked. the -1 and 1 combinations are probably invalid.

At any rate, you can use the results to determine what the commands most likely are by the lengths they return (at least for a few like extest and sample/preload as well as ID code... most of those are pretty standard).
[JASJAR, XDA Exec, MDA Pro General] Cotulla:
Any news? .
[JASJAR, XDA Exec, MDA Pro General] roglio:
Hi, due to lack of time I haven't touched the uni 'till now.

:(
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hello,

my spare time is also very limited at the moment........

So nothing special to report :(.

The only thing i did in the meantime, was grabbing another JTAG Hardware debugger and build a script to access the PXA270 on the uni.

But this adaptor also has no G3 support.

So i have to quote myself again:

By the way, the urjtag stuff seems to be the only useful way to implement mDOC G3 routines, because there's still active development and it's GPL.

To get this working comfortable, will be hard stuff.

Maybe someone else could contact one of the developers of urjtag how we could integrate some NAND stuff, msystems DOC support.....

Version 0.8 has just been released in February!

Regards,

scholbert
[JASJAR, XDA Exec, MDA Pro General] Silto:
Hi Scholbert,

I'm looking to for a solution to update/reprogram the IPL.

I have done the same way like you and I have the same problems.

I can't reprogram the IPL.

To put Data to the memory, you must set the word 0x0AC80AC9 to the Address 0x48000000.

This will enable the Memory (without settings of memory refresh times!).

Regards

Silto
[JASJAR, XDA Exec, MDA Pro General] Silto:
Oh, I have read you have solved the memory settings for your self!

At the moment, I try to organize the "Boot Software Developement Kit" BDK from M-SYSTEMS (new: SanDisk)!

Regards

Silto
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi,

very nice that there's still some interest and people around who dig deep in the universal hardware.

At the moment i'm on vacation, so nothing but relax at the moment:D

To have access to this software package would be great:p

I think it's no easy task to get it, because you'll have to sign a NDA.

Silto, good luck anyway!!!

Best regards,

scholbert
[JASJAR, XDA Exec, MDA Pro General] Yudgin:
JTAG interface (cables) scheme

You can download scheme of JTAG cables (xilinx, Wiggler and ByteBlaster) from my post here:http://pda2u.ru/forum/index.php?showtopic=295&view=findpost&p=4988
[JASJAR, XDA Exec, MDA Pro General] Curehead:
what's up ?

Hi there,

My Universal got stuck in bootloader(mtty and other stuff does noet work, "serial" does not change in to "usb". So som forums suggested JTAG and that's how I ended up here. I gotta admit, this is WAY OVER my head in order to contribute.

But I was wondering is there a "JTAG" solution to start from scratch. This would help me, and a whole bunch of others (as I saw on the forums) out.

Any reaction would be aprreciated

greetings to all!!

Curehead
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi Curehead,

same with my device when i started this thread.

My device got broken bootcode, so there was not even the bootloader coming up :o

So if you stuck in bootloader there must be another problem with your device.

If you still get into bootloader there might anything helpful apart from JTAG.

Unfortunately i have no idea what to do :rolleyes:

Please read the wiki intensely or search for some threads reporting the same problem.

Anyway, i gave up this JTAG project because lack of time.

To answer this very clearly:

No, there is no final solution to reflash the G3- or G4-Flash chip inside the universal using JTAG.

Best regards,

scholbert
[JASJAR, XDA Exec, MDA Pro General] Curehead:
Hi Scholbert,

thx for your answer. The other forums I read mentioned that when stuck in bootloader, I should connect to pc and then the "serial" should change to "usb" and in that case there are solutions. In my case it DOES NOT change to usb on connecting.

Funny thing is that when I retract my usb connection HALF Way from my ppc it does change to usb in the screen, any idea?

thx a lot

C.
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi,

only thing you should note, before you connect to your host and use mtty in bootloader mode:

- don't use a hub, direct connection to host is recommended

- disable active sync usb connection

Perhaps this helps....

scholbert
[JASJAR, XDA Exec, MDA Pro General] Curehead:
thx and what about hub

Hi scholbert,

thx. I tried deactivating usb in AS, no success? About these hubs: My PC (vista) list all usbports (in hardwarelist) as part from a "universal usb hub". Could this be a part of the problem? I do not know how to connect otherwise to my PC. I am ofcourse not using an external hub.

Greetings,

C.
[JASJAR, XDA Exec, MDA Pro General] scholbert:
Hi,

i did mean external hub ;)

The internal hubs belong to the chipset, that's why they are listed.

Quite normal i guess :p

Maybe you should try connection with a win XP host. Don't know the behaviour of vista PC together with uni in bootloader mode.

Perhaps you'll need some extra drivers for that, don't know...

Regards,

scholbert
[JASJAR, XDA Exec, MDA Pro General] paulorosa:
Hi!

My device Is dead. No bootloader, nothing...

So my only hope is this JTAG project.

I don't understand nothing about FPGA, but I have done some electronic's in past.

Can help me to start ?

What hardware do I need ?

What Software do I need ?

Thanks!
[JASJAR, XDA Exec, MDA Pro General] Curehead:
the ABSURD answer ...

Being at my fantasy's end., but ...:

Since my new universal is a replacement (my lovely 4year old daughter smashed it, and my phone connections were breaking up), I had still a functioning one (except the phone part that is!). So i started testing from scratch with my old universal and .... ALSO stuck in serial without changing to usb !!!!!

I read somewhere a post about changing cables, so I rounded up al mu usb-miniusb cables and what the F***: ALtough it did not work with my original cable, it DID work with another cable (don't know if it's A or B) which came with some old stuff.

and then it DID change to usb.

SECOND THING: ALtough I followed all the stuff concerning vista (wmdc, drivers, processes, it DID NOT WORK.

So I retook possession of my old laptop (OS=XP) and .... there it is able to flash ..

Now I am able to flash a certain rom (tomal) and a certain bl (v1.01). I am now trying out different roms.

Only thing annoying remaining is: when upgrading/flashing the install program never finds the already installed rom, radio, ....

well; I hope this helps some one, i mean I really tried about anything only to discover that another cable and another OS-laptop ( what scholbert also tought off!) was the answer instead of thousands software try-outs

Success to all!

Curehead
[JASJAR, XDA Exec, MDA Pro General] {Red}Lyon:
hello, I have a htc universal is not updated correctly, and now will not start, the screen does not show anything ...

I tried every combination of keys for different reset or the bootloader mode but nothing happens, and windows tells me usb device not recognized.

I would try the JTAG interface but I do not know which interface they need and what software they use and commands to be sent ...

can you help me?

p.s. sorry for my English.
[JASJAR, XDA Exec, MDA Pro General] roglio:
Hi RedLyon, in my understanding no one has been able until now to restore a bricked uni...
[JASJAR, XDA Exec, MDA Pro General] rapboy23:
help me scholbert

ı have wiggler jtag cable. ı dont fınd tck.tdo.nrst. .... jtag out _?_ jtag out alot of cable 15 .which tck.tdo.nrst.gnu....? how connect board with jtag?
[JASJAR, XDA Exec, MDA Pro General] rapboy23:
which port 20pin or 14 pin connect cable

hel me pls .my wiggler jtag 20 pin and 14 pin port connected .
[JASJAR, XDA Exec, MDA Pro General] roglio:
The problem isn't the cable but the software.

Nobody knows how to reflash a G3 (or a G4) flashrom...

mdocs was aquired by sandisk and is very difficult to find documentation about these chips.

Then...
[JASJAR, XDA Exec, MDA Pro General] rapboy23:
ı dont understand

roglio problem my jtag cable out cable . how connect 20 pin port shema or other 14 pin schmea .which ? my jasjar g3 chip.and ı have jtag utilty software .can you help me? tomorrow my cam opening and watch my wiggler jtag . ı want learn jtag how connect motherboard and jtag out tck other ... tdo .. add me rapper_735@hotmail.com now time here 00.24 pm night.tomorrow morning teach me my system xp sp 2 .
[JASJAR, XDA Exec, MDA Pro General] roglio:
well, is not so simple, btw you should start from this picture:

http://wiki.xda-developers.com/index.php?pagename=Universal_JTAG

Using it you should be able to connect your wiggler adapter to your jasjar.

As I've already told before, I don't know how to re-flash the G3 chip.

If you are able to do it, please share your knowledge!

What program do you will use to connect via jtag?

Take a look also to this picture: http://xdaforums.com/attachment.php?attachmentid=66036&d=1200387744

Each point is highlighted and named.
[JASJAR, XDA Exec, MDA Pro General] rapboy23:
ı will trying

but 2 photos different
[JASJAR, XDA Exec, MDA Pro General] roglio:
Hi rapboy you have to study a little :)

Both photos are related to jtag pinout. The first one is taken from a completely desoldered board, the second instead is taken from a fully populated board and in my own opinion is better.

It is time to take your welder and solder some wires :)