yashsingh1/xdaforums huggingface dataset:
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
alternative schematic

Hi geeks,

due to some request arriving through PM, i decided to quickly draw some alternative schematic for LPT adaptor (using better available 74LVC245, 74AHC245 will also do).

This one will work nicely with hermes hardware :rolleyes:

Important:

You won't need to connect TRST# because it is not supported by software and not needed by hermes power up circuit.

Please connect VCC3 of schematic to the VCC testpin shown in the pic of Hermes JTAG pinout in the first post.

Please share your success stories :D

Good luck,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] amjad4u:
hi scholbert

hi scholbert thanks for your help! today i found 2 ic in the market (diffrent city) ic is 74HC244 & 74LS541. which for me best and easy to build.... advice me
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Great!

Hi amjad4u,

congratulations!

Very nice, that you found some chips :)

Please use 74HC244 because this chip can be supplied by 3V power supply.

The LS-family of chips is 5V only :o

The hermes uses 3V for I/O and will be used to supply the buffer (74HC...).

Download datasheet of 74HC244 and compare it to 74HC245 (the one used in the provided schematic), because pinout and numbering is different.

Good luck for the soldering job :D

scholbert
[8525, TyTN, MDA Vario II, JasJam General] the_dipe:
For all you guys don't getting /WP up

Hi,

first of all: Thanks Scholbert for figuring out the JTAG pins.

Second: I managed to flash a bootloader to my bricked tytn via jtag.

The installed one seemed to be corrupted, resulting in not pulling /WP high after power on, making NAND theoretically unflashable.

However, besides I think one could figure out which S3C2440 GPIO is used for controlling the flash's /WP and change it's level via jtag, there is an easier solution for this problem:

Simply overwrite the signal through the /WP board test point. I did this by applying 3.3V to the test point.

!Note!: You should use a power supply allowing to limit output current to 100mAmps.

@Scholbert: I hope you will manage to flash your NAND soon.

Update: The measured output voltage of the ARM driving /WP is just 1.8V. So use this value to drive the flash's input.

On the newly flashed hermes (200), /WP goes high about one second after power on.
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Fantastic....

Hey that's great news!

Wow, the_dipe you did it...and it worked!!!

Well done, thanks go out to the brave :rolleyes:

I must admit that i did some of these experiments too. Also did some measurements, but it was to coward to force this pin to 1.8V for about 10 minutes, because i thought the hardware will take irreversible damage :o

Guess the hermes is more robust than i thought :D

Yeah, i will try it :p

Thanks again, you may cross fingers...

Yes i can confirm this. In addition i'm quite sure that it's the xilinix CPLD (so called egpio) that is driving the WP pin.

Anyway, some kind of warning maybe also appropriate at this point (especially for the newbies out there):

Accessing the hermes jtag testpoints using the wrong hardware adaptor or attaching wrong voltage could damage your hardware. So please be aware what you're doing!

Always take care of electrostatic discharge while doing experiments!

Very, very nice ride!

Cheers,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Every brick may come to live again...

Hi again,

just to confirm again:

The method of forcing the /WP pin to VCC1.8 to unprotect the NAND flash is working.

So if you got a corupt bootloader and your flash is blocked and cannot be rewritten by flash software, check it out :p

Yesterday tried this with my device. Flash is now fixed :D

Verified O.K.

Thanks again to the_dipe, who was brave enough to try it first on his device!

But again some parential advisory ;):

By forcing the /WP to VCC1.8 you do a short-circuit to some PIO output of hermes. This may result in permanent damaging the hardware.

Nevertheless a brick is a brick so it's worth a try and it works :cool:

Go for flashing..........

scholbert
[8525, TyTN, MDA Vario II, JasJam General] the_dipe:
Happy to hear these good news!

Yep, and remember: It is most important to limit current to 100mA. A todays IC's pad driver should get along with 'short-circuiting', then.
[8525, TyTN, MDA Vario II, JasJam General] stan23:
100 mA is pretty much!

Might be better if a 1 kOhm (or 10 kOhm) series resistor is used to limit the current and protect the internal clamping diodes (if the voltage is to high and they get conductive).
[8525, TyTN, MDA Vario II, JasJam General] the_dipe:
Pads are short-circuit-protected, internally. The corresponding diodes will carry 100mA.

You can of course use a resistor in series to limit current, as long as you drive the 1.8V at the test point. I prefer using a current limited power supply.
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi,

Yes i agree!

I used some resistors in the past, from my experience 1K is too much to drive it to 1.8V. The onboard 1.8V form DC/DC could be used, it's a current limiting supply :D

If i remember correctly, i once measured ~40mA while pulling /WP to the onboard voltage.

Anyway the words of caution are mainly for the noobs out there.

Some of these guys check out weird things and wonder if something goes wrong :p

scholbert
[8525, TyTN, MDA Vario II, JasJam General] the_dipe:
40mA is a reasonable value, when using an IO-cell as a current sink (I had nearly 80mA, but just because I used 3.3V :rolleyes:, which btw. didnt damage the IO).

Note that this current is not limited by the onboard dc supply, it's in the end rather been limited by the pad driver itself. So the 100mA are just for 'high level safety', the rest is done by the CPLD's/ARM's (whatever is responsible for driving /WP) IO driver.

Bookmarked thread on http://wiki.xda-developers.com/index.php?pagename=Hermes_Unbrick
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
I appreciate..

Hi the_dipe,

very nice thanks a lot :)

Yes sure (was not that serious..:D)!

Anyway, thanks for clearing this up!!!

Fantastic!

Thanks for helping out and crack the /WP-nut :p

Best regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] gom3z:
Hello hermes fans,

Today I had Herm300 bricked, I have tried Jtag+IPLSPL1.04.

all went ok, flash ic was recognized, programmed.. but then while trying to power on I have realized it's dead. How do you think, is it because of WP pin and somethig goes wrong while flashing? OR when WP pin is enabled it's not allow to flash via JTAG at all ?

I have checked exactly flex cable, connections etc, all is ok. I'm sure before it was going to bootloader (yes, I know about mtty but at this time I coudn't repair via task 32 etc)

waiting for reply

gom3z.
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi gom3z,

i wil try to follow your steps ;)

You flashed the combined binary from this thread.

Is that right?

The software won't recognize that the flash is write protected, because all registers are read back o.k. by the software (verifying is not implemented).

So maybe your flash is blocked by hardware -> WP stucks to GND :eek:

You may check the first blocks of NAND with the read function of the software, to verify if they had been rewritten.

There's a map of NAND layout in this thread, please have look around.

I think your cable connection is O.K., because the chip ID's had been detected by the software.

Check the WP testpoint's voltage while booting. If it is 0V all the time, NAND is blocked.

As long as there's no other way, use the force to 1.8V method.

Just made another pic to make it easy ;)

From my point of view it's O.K. to use the onboard voltage!

Please be aware of the things you do.....

Here it is :D

scholbert
[8525, TyTN, MDA Vario II, JasJam General] cr2:
Hmm, then it's worth to look at the SPL once again.
[8525, TyTN, MDA Vario II, JasJam General] gom3z:
Hello,

So... my herm300 works again perfectly ;)

The point was to put 1.8V to WP testpoint, then flash again IP+SPL, after that all was simply, go to bootloader, flash with full firmware and voila - htc is alive again.

BIG THANKS !

btw. any service manual level 4 is avaiable ? anybody has got it?
[8525, TyTN, MDA Vario II, JasJam General] cr2:
I have found some more CPLD gpios (see wiki), but none of them deal with NAND flashing. WP should be some S3C2442 gpio.
[8525, TyTN, MDA Vario II, JasJam General] amjad4u:
:(

Cpu is not detected! :(
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi!

@cr2:

Thanks for having a look in SPL loader and clear up some parts of EGPIO.

I was assuming it is the CPLD controlling the /WP because of 1.8V voltage level to deactivate.

The GP-pins on the Samsung are powered with 3.15V on hermes, this is not within spec of NAND MCP :rolleyes:

Maybe some other logic is used for level-shifting.

@amjad4u:

- Please verify all your connections.

- Make sure your battery got still some charge.

- Press power button for min.2 seconds before starting flash software.

- Do some measurements at some of the capacitors on the mainboard (take the biggest one's), there have to be at least three voltages somewhere: 1.5V, 1.8V, 3.15V.

- Measure voltage level of VCC3 shown in the JTAG location pic (has to be ~3.15V)

Good luck!

scholbert
[8525, TyTN, MDA Vario II, JasJam General] cmonex:
if it is really a GPIO (in the samsung cpu) I have an idea..

to enable nand writing, clear the 0th bit in 0x56000000 then set 0th bit in 0x56000004

and to disable writing, clear the 0th bit in 0x56000004

(though you might have to config these first correctly on bootup)

i.e. the GPACON and GPADAT io ports in the cpu... I can post the s3c2440 manual if needed?

but what dosn't make sense.. this code is already in SPL, that's where i found it... so why wouldn't it work if you run an SPL? god knows if there is any other factor in this,

---

P.S, the relevant code in SPL:

(copypasted code from an SPL)

for enabling flash writing:

MOVL R1, 0xB6600004

MOVL R2, 0xB6600000

LDR R3, [R2]

BIC R3, R3, #1

STR R3, [R2]

LDR R3, [R1]

ORR R3, R3, #1

STR R3, [R1]

for disabling flash writing:

MOVL R1, 0xB6600004

LDR R3, [R1]

BIC R3, R3, #1

STR R3, [R1]

the virtual->physical maps like this:

0xB6600000 = 0x56000000

0xB6600004 = 0x56000004
[8525, TyTN, MDA Vario II, JasJam General] Wupper:
Could you guys tell me if I'm right about this?

Is it possible with the jtag to get another ipl and spl on my phone,

so I can put every rom on my phone with the sd card flash trick?

Tyvm for helping (again :p)
[8525, TyTN, MDA Vario II, JasJam General] cmonex:
yes but overkill if your phone boots fine.
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
I'm going crazy!!!!

Hi again!

cmonex, that's crazy stuff!

Great finding.

Unfortunately i am really f**kin' busy at the moment. So very limited time to try some hacks right now.

Additionally i go on holiday on saturday and i don't believe that i will take all my electronic stuff with me :rolleyes:

I will go deeper when i'm back in town, i promise!

As i said a few threads before my device is kind of damaged in another part of mainboard. It's does not boot anymore even with the right code in place.

Think i'd done to much experiments. Anyway, flashing went well with the "force /WP"-method.

Afterwards, i read back the affected sectors, no errors...

For me it makes sense, that all that writing to NAND procedures are done in SPL.

This second part of bootcode does all that higher level initialization, check the power controller, init graphics, activate MMU, init USB controller, manage DMA.....

At least this leads to much more control of the onboard devices.

Why not manage all that writing to flash in there too?

While flashing a new firmware, you throw around 60MB of code to the flash in a few minutes using the bootloader. You'll need some kind of checksum controll too.

I'm pretty sure this can't be down i a few 100 bytes of code (IPL)

These are my thought's, maybe i'm wrong :o

We'll see if your investigation will lead to a 1000% proof flash software for hermes.

So it's time to hack it all.........

@wupper:

Yes that's right, as long as the IPL/SPL support this.

But i agree:

Apart from that, again have a look at the openmoko projekt.

The first openmoko mobile device (GTA1) used the NAND for booting like it is done on hermes. They adapted u-boot (GPL'd bootloader) to the platform and build there own first stage loader (what we call IPL).

It's very, very sad, that important drivers for hermes are missing in the linux kernel, because the essential tools are there.

We have it all....

(unfortunately still excluding access to Radio ROM :( )

Cheers,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] Wupper:
Well.. according to the wiki unbrick guide the only thing I can do is trough jtag. (ipl 1.01 spl 1.09).

I've also tried sd card flashing but that said with 10 different roms: not allow with a code above it.
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
yeeeeeeeaaaaaaaaaaaaaahhhhhhhhhhhh

Hi again,

can't believe it, cmonex you did it!!!

I was to exited to wait. Even if it's already solved using the hardware hammer :p

So i just pulled out my bloody hermes mainboard, attached JTAG, started the debugger and did, excactly this:

You might guess the GPA0 controlls the /WP pin on hermes!

If i'm not completely gone this is it :D

Thanks a lot cmonex for this gift.

Next we need to hack the samsung software to support this.

No more bricking :p

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] cmonex:
wow, glad my tip worked =) :D

which debugger do you use btw?

when I said I didn't understand why SPL code didn't work - I meant the cases when you tried to execute an SSPL in RAM. but maybe that had some other unrelated issue then.

(it is obvious that IPL does not do any flashing, that's the job of SPL.)
[8525, TyTN, MDA Vario II, JasJam General] cmonex:
oh, mm, was it you I PM'd once? maybe not... maybe I still have an idea for you :)
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi cmonex,

yes it does!

Though i'm a bit confused about the fact that GPA0 shares resource with address bit A0. Obviously hermes does all external access on a minimum bussize of 16Bit, so A0 gets obsolete and may be used as GPA0 output only.

Anyhow, bit weird idea.

ARM developer suite (AXD1.2).

Yes of course, it's also obvious that you knew function of IPL/SPL ;)

By the way, i wanted to point that out for some others reading this thread and not that familiar with these parts of software. You may consider it as, .... thinking in words ???

Thanks again!

scholbert
[8525, TyTN, MDA Vario II, JasJam General] cmonex:
yeah, the samsung cpu manual is interesting about these GPIOs... but I guess, the point is that you can setup these as you want if you don't want to use the original function, so HTC went for this for some reason :)

thinking in words is not a bad thing :D

having any luck with implementing this in the samsung software? :) don't remember what that software allows for, can it access all memory mapped stuff easily?
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi,

yeah, it seems that mobile phone engineers are lateral thinkers ;)

Yupp!

I'm in the process of getting stuff together for vacation.

Maybe i'll hack some lines tomorrow when i'm in the office.

Samsungs flash software is actually more basic and does real hardware access through TAP, to toggle some pins.

Accessing registers in memory map is not implemented, as far as i remember.

There are some limits.

Have to look at the code again :rolleyes:

scholbert
[8525, TyTN, MDA Vario II, JasJam General] Wupper:
Yeah, you pm'd me :). But after you said that I should pm olipro I stopped working on my phone because he never gave me a reply :(.

But 2 days ago I thought let's try something different with the phone. So after trying to flash it trough the sd card (unsuccesfull), I think it's time for jtag :p.
[8525, TyTN, MDA Vario II, JasJam General] cmonex:
oh, I can help too if Olipro is too busy. drop me a PM. jtag is really overkill if it boots to SPL :)
[8525, TyTN, MDA Vario II, JasJam General] Wupper:
Is there something else possible:eek:

I thought that only jtag was possible for my phone.
[8525, TyTN, MDA Vario II, JasJam General] cmonex:
there is :) PM me.
[8525, TyTN, MDA Vario II, JasJam General] cr2:
The GPA0 bit was free ->

http://wiki.xda-developers.com/index.php?pagename=HermesGPIO

Now i have filled it :)
[8525, TyTN, MDA Vario II, JasJam General] Wupper:
PM sent :)
[8525, TyTN, MDA Vario II, JasJam General] zdzihu:
Hi guys, I must say you did a great job here! I got my H300 bricked 1,5 year ago and haven't tried to fix it since then. But that topic gives me a good hope to get it up and running again.

When I power up my Tytn all I can see is LCD flashing black/white. Also, white "photo" diode on the back flashes simultaneously.

That happened after unsuccessful flashing and makes me thinking that bootloader is damaged. So I decided to give a try again but this time with JTAG :)

My question now is: will included software work with programmer below:

It's 74HC244 based, but I'd like to get a confirmation it suits before I order it from ebay :)

Thanks in advance, Jack
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Never brick OS again

Hi,

so i'm back in town!

@zdzihu:

Looks like a nice adaptor, but how should i confirm this :confused:

Anyway just did some dirty hacks...

Here's the updated software tool (see first post).

It's based on the original samsung software package.

Including a slight mod to handle the /WP issue and enable the NAND properly :D

Enjoy!

EDIT: See first post for the Hermes software tool!

I decided to put down all the information in there step by step, to complete the thread :p

Anyway, further discussion welcome..........

scholbert
[8525, TyTN, MDA Vario II, JasJam General] oma:
CPU not detected

Hello,

the Samsung tool doesn't detect my Hermes' CPU. There was at least one other person in this thread with the same problem, did anybody find out what causes it? The signals look ok to me on a scope, both on the 5V and the 3.3V side. There's definitely something coming back from the phone, but the tool reports only zeroes for the CPU id.

So, before I start debugging this step by step (when I can find some time), did anybody find a solution I could try?

Cheers,

oma
[8525, TyTN, MDA Vario II, JasJam General] bartan:
Hi

Is there a possibility to fix noGSM errors via JTAG ??

btw good luck on your experiments :) ,

thanks
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi!

No idea what exactly is wrong with your environment.

There are obviously some things that should be checked is there's no access:

- check again all signals are connected correctly to hermes mainboard

- check if your adaptor uses the same LPT-pin assignment for the jtag signals like the reference hardware

(refer to the schematic in the source package)

Another thing to mention is that you may need to install the giveio driver. Also check BIOS printer port settings, it must be set to standard printer port function (SPP).

Additonally i was never able to test the software on a host system using Vista OS, maybe someone could confirm it works :rolleyes:

No, never heard of it!

Basically it would be possible.

It is still unknown if the hermes got these testpoints for radio chipset and where they are located :o

I started some investigation on this topic, but there's nothing to report right now...

Regards,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
laboratory excursion

Hi hardware geeks,

my hermes hardware had gone through a lot of experiments the last few weeks. Concerning the noGSM error, i had a suspicion that this could be a true hardware related issue.

Not a broken radio bootloader or similar...

I decided to take out my heatgun again and heated up the radio chipset.

You might guess what happend: The noGSM was solved.

The first time after i started to work with this broken piece of hardware, the phone completely booted up with full radio support!!!

Unfortunately i did some further soldering on the board and this was the begining of sudden death for my device.

At least it looks like that from todays view. The voltage regulators do not seem to work anymore.

Maybe this is caused by a missing clock or similar secondary function on the mainboard.

Anyway, this leads me to a weird conclusion:

There might be some devices with noGSM error that seem to have a bricked radio rom, but in fact it is caused by broken hardware connection.

So apart from true software errors there are mainly two hardware related aspects to consider:

Connection between the MSM6275 and the NAND flash that holds the radio rom is broken -> radio rom cannot be started

Connection between System MPU (s3C2442) and Radio Chipset is broken -> radio rom could be started but there's no connection to the system

So i know this won't help that much for most of the users out there,

but it is at least a confirmation of all these strange descriptions out there concerning the broken radio.

... my radio rom seems to vanish...

... one day i was able to boot with radio, the other day it has gone...

... i put it in the fridge, afterwards the radio was o.k....

and so on.

I already placed a post on the dedicated "noGSM" thread, but i will focus on this issue a bit closer in this hardware related topic.

So, stay tuned...

Cheers,

scholbert
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Wanted!

Hi geeks,

i did some investigation on radio chipset of the hermes platform.

So here's some detailed picture of the MSM6275 used on hermes.

Maybe we will lift the secret of bricked radio roms some day....

If someone got a totally bricked mainboard the green ones should be traced :D

Good luck!

scholbert
[8525, TyTN, MDA Vario II, JasJam General] Monrad:
One question, is it possible that gsm chipset is ok but maybe it has some soldering problems?

Does anybody know if heting the board with a heatgun could "fix" bad soldering iron contact (under gsm chipset) with the mainboard?

I have a Herald with me that can ONLY be upgraded if you put it inside the fridge. Im planning to sell it in the north pole :p It should work ok over there :D
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
Hi Monrad,

Yeah, that's what i tried to say in on of my last posts above :o

Yes i had success two times with the heatgun method.

Anyway it's a bit like 50/50 chance, because in the end i killed one mainboard because i heated too much.

Another advice would be to concentrate on an area around one chip while heating, because of mechanic distortion. You also may use some soldering fluid.

Please be aware that you also may totally brick your device!

Yeah this would be the alternative.....nice joke!!!

Good luck with your device!

scholbert
[8525, TyTN, MDA Vario II, JasJam General] Monrad:
Thanks scholbert, what about using an oven? :eek:
[8525, TyTN, MDA Vario II, JasJam General] scholbert:
I won't suggest this, because my PCB got totally damaged.

We used a professional oven, but perhaps we gave too much heat...

As a result some of the inner layers ripped of from the outer layers, so it became totally ripped of. Now the surface has some kind of big bubbles :D

At least it's your choice :o

scholbert
[8525, TyTN, MDA Vario II, JasJam General] jozinecko:
Hello,

I am very sorry for my idiot questions, but I have bricket m3100, it is still on operator logo, but when I tried flash with original shipped rom it finish but is still only boot for operator logo and than stop, but show no gsm, I know no gsm now I cant fix, but if is possible I use it without gsm:(

I know that you dont have time but I tried read threats but I still dont understand, can you explayn me what i need to make? I can use only lpt with resistors or I need there 74HC244 or 74LVC245 or which?

I know that you dot have time for guide but please help me, i tried to understand but my english skill I thing is not able to understad all what is is here writed.

sorry for my grammar.

Thank you for help