yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] ezterry:
Jlink is a closed source jtag system for windows.. unless you already own one I'd look at other more open devices. If you need a usb device many generic ft2232 jtag devices seem to support openocd out of box.

I also believe it does not have support for Linux/osx.. which makes it far less useful to me.

However openocd has the abillity to interface with jlink (you will need to ask Google/openocd for support with this).. thus you can run my instructions that way.. alternatively jlink has its own ocd interface that if you translate the memory writes (words and binary files) will let you debrick with the process.

The important thing to double check is the device support a 2.6v reference voltage.
[G1 Android Development] drutort:
ya i started to read about the openocd jtags and i saw the jlink listed as a non ft2232, also if the devices range from 1.6-5v or so then i would be ok? or do u mean if it specificaly suports 2.6v

i dont know if i want to deviate too far, i have the skills to build one but would prefer to buy one for under or around $30

i ran into a list on this link

http://openocd.berlios.de/doc/html/Debug-Adapter-Hardware.html

whats intresting is the huge price differences in jtags, i wish i knew one that has the min req for us that would work fine with openocd cheap, some jtags in general can be as cheap as $10 or less

i guess ill just continue to research some of those on the that link with the ft2232
[G1 Android Development] ezterry:
The v-ref you will supply to the adapter will be 2.6v (either from the phone or external source).. the adapters range should support this provided voltage.

So yes that mentioned range is fine.
[G1 Android Development] akivlin:
It looks like drutort will be using the Multi-com G1 JTAG adapter and it routes 2.6v from the motherboard to the JTAG vref pin.
[G1 Android Development] akivlin:
I was tempted to go with a cheap JTAG debugger but I wasn't confident of being able to diagnose problems arising from the cheaper JTAGs not being able to support the 2.6v vref.
[G1 Android Development] ANtiHazarD:
i think this guy is leacher... This work, i think, the man with nick "tamerlan311" from androidfan.ru portal, which buy all dead motherboards and dev them. :-\
[G1 Android Development] drutort:
I guess I might go with this route I have a few pc's some old ones, that I know will have a parellel port, one is a ddr amd system, another one I'm sure has a io on the mobo just need a ribben for that one

intresting how even some new ones have at least a serial io on the mobo

so if i build the parellel jtag and i want to buy JTAG Adapter for Google G1 Dream

i dont really need anything else right? provided i get the 2.6v either from phone or some other means as you mentioned above

I just dont know if i can be bothered to do it the hardway, i would not want to solder the wires and I sure would not want to mess up if i use a tape method to stick the contacts or the glue method (though I would think rubber cemet type would be best as it would just peal and clean up very easy)

also I got a question for the US guys, is this the exact part on this website?

http://www.mouser.com/ProductDetail...=sGAEpiMZZMs9F6aVvY09btkPv7nrVS6TnubCUzQAbVc=

or http://www.digikey.com they carry it too
[G1 Android Development] excogitation:
Status on unbricking a Magic (32B)?

(only blue led mode)
[G1 Android Development] ezterry:
2.8 or 3.3v serial connection to the phone for debug output; and OEMSBL command input.

Also yes I believe that chip will work..

I think I've heard success with the JTAG process on:

* HTC Dream (both HTC/Google branded devices)

* HTC Magic 32A

* HTC Magic 32B

* HTC Magic 3.5mm audio jack (aka Fender edition)

However no; we have not managed to make the radio unlock a phone via a locked OEMSBL or AMSS (the two things accessible via blue light mode)

General FYI:

I know the Dream/32B have the same cpuid + primary read-only boot loader.. The Magic32A and Fender I hear reports that the cpuid may or may not differ
[G1 Android Development] G1ForFun:
Lol, now that is improvising.

Nice work.
[G1 Android Development] XBrav:
Now that is awesome.

Hey, do you have the contact spacing measurement?
[G1 Android Development] scholbert:
Cool...

Hey Xsite_01!

That's the way i like it :D

DIY at it's best and a very nice idea!

Another nice solution is to buy a broken headset for 2 euro's...

I might give some details if you like.

Good luck for your de-bricking!

Regards,

scholbert
[G1 Android Development] shaji007:
eeeeh seems quite expensive lol

if i sent this to you and payed you as well would u be able to fix it for me :)
[G1 Android Development] mippen:
I'm trying to use the tutorial at cyanogenmod.

I have a magic 32B unit.

Have made a wiggler clone with 2.6 v ref.

It's in blue led mode and I have serial data connection to it.

But when I run openocd with "abCHbGvX.txt" i get an error "The specified JTAG interface was not found (parport)"

is there a way to test if the wiggler can communicate with the openocd?

Right now I do not know how to continue.
[G1 Android Development] ezterry:
Error seems to indicate openocd can't find your parport. . And/or doesn't have permissions to access it.

An if that odd file name is the pastbin short url.. feel free to name it to magic.cfg
[G1 Android Development] mippen:
Downloaded the files AsIs via the tutorial.. but agree that the name isn't the best one.

In that conf file the parport is set to 0x378.

As I'm a Linux newbie, how do a list the LPT ports with there address?
[G1 Android Development] ezterry:
.. Google is your friend.. but the hint is the address in the file is for the first parallel port if you only have one don't touch.. instead be more interest in you /dev parport device and who has permissions to use it.

My Linux box with a parport died about 2 years ago so I'm not exactly in a position to do more than Google it..
[G1 Android Development] brtb:
I had to do several things not in the documentation to make my wiggler cable work with Ubuntu 10.04 and a really old laptop that's only survived because it has a full set of ports:

While compiling openocd 0.4.0, use this option:

bash-3.2# ./configure --enable-parport

Try removing the lp module -

bash-3.2# rmmod lp

Also try letting openocd find the parallel port on its own - set the line that says:

parport_port 0x378

to this:

parport_port 0

And try running openocd as root to ensure it has permissions to access the hardware.
[G1 Android Development] mippen:
I got a little bit further with your help.

Now I got:

parport port = 0x0

dcc download are enables

fast memory access is enabled

info : clock speed 500kHz

Error: JTAG scan chain interrogation failed: all ones

Error: Check JTAG interface, timings, target power, etc.

How do I know if this is a HW failure or is it still a installation problem
[G1 Android Development] scholbert:
Hey mippen!

i once posted my wiggler LPT config for Dream.

See here: http://xdaforums.com/showpost.php?p=6523646&postcount=627

But i think you got it already.

Anyway, seems that the LPT could now be opened.

There could be some problem with power supply of your DIY Wiggler or something is wrong with your wiring.

You might check again, if all signals match the schematics/connector assignments.

Regards,

scholbert
[G1 Android Development] mippen:
After some detailed checking I found the problem with the hardware... It dosn't like not having the vref connected..

A cold solder didn't connect the pin onthe chip to the pad where the vref where... Must be someone else who made that solder... :-)

Now I got some step further.

Have connected (but I only have 500 kHz as clock speed?)

Running telnet and trying to load the radio gives me:

load_image /tmp/radio-3.22.26.17_dream.img 0x19500000

No working memory available. Specify -work-area-phys to target.

Tested both the 0x103B5300 and 0x19500000 address with the same result.. What could the problem be this time...
[G1 Android Development] scholbert:
Anyway, should be followed by this message:

no working area available, falling back to memory writes

Might be worth a try to uncomment the following lines:

# .. seems to work until watchdog is triggered..
#arm9 configure -work-area-phys 0x103B5000 \
# -work-area-size 0x200 -work-area-backup 0

EDIT: O.K. i'm sorry for this missleading info.

Defining workspace in this area does not seem to work properly on Dream.

This setting will cause watchdog to be triggered and resets the platform.

So don not use it for your config!!!

Regards,

scholbert
[G1 Android Development] ezterry:
Besides the watchdog issue. .. that warning is in the wiki too.. did it not fall back to memory writes?
[G1 Android Development] akivlin:
It should also say:

There is no load_image progress indicator and the radio takes a long time to transfer to the phone (~8 minutes with my ARM-USB-TINY at 6000 kHz) so you must wait for it to complete.

If you know which radio is installed you can de-brick MUCH faster by soft booting the engineering SPL then use fastboot to flash the correct radio.
[G1 Android Development] scholbert:
Yepp, just edited my post....

Regards,

scholbert
[G1 Android Development] mippen:
entering the load_image command with corrected cfg the phone leaves the blue led boot mode...

(using address 0x19500000)

Shall read the wiki carefully before asking why it does this...

:rolleyes:
[G1 Android Development] mippen:
Have made a couple of more tests but the result is the same.

Entering the load_image command the phone restarts, showing me the "htc magic" logo.

The serial wire indicates that I'm in ARM11 Boot Mode:3

Have not found any info about this, but might have been searching the wrong place.

Is there something I miss about loading the radio image?
[G1 Android Development] ezterry:
Did you enable those commented lines? As we just mentioned the watchdog doesn't like that range (or any other range I've poked to date) and restarts the phone.. leave it commented

Also the warning you had is not usually a problem, it usually Just uses slower memory writes..

Last what is the output to the serial line while you are doing this? (The ARM9 boot reason)
[G1 Android Development] mippen:
must have miss read the posts..

I first had the lines commented... uncommented them made it work a little bit further... Trying with commented lines again...

No.. lookes like it needs some address in the config file to work.

In my dream_wiggler.cfg I have tested the following:

With arm9 configure -work-area-phys 0x103B5000

-the device reboots when load_image

Same result but with -work-area-phys 0x19500000

With no configure of -work-area-phys (commented lines)

Error: Target not halted

Info: no working area available, falling back to memory writes

EDIT:

Halt works but get "specify -work-area-phys" error without any in the config file

EDIT2:

load_image command gives

Target not halted

no working area available, falling back to memory writes

target not halted

Command handler execution failed

.....

I had a "target state: halted" before the load_image command.
[G1 Android Development] ezterry:
You may not like the idea. . But take a short break, reread the most recent posts when you return , and compaire your output with the wiki's test run..

If you want to test if you are actually halted send '?' Followed by enter to the serial. .. it can't reply if the CPU is halted
[G1 Android Development] mippen:
to take a break when everything starts working but doesn't is not fun.. but was needed.

I have managed to download the radio img to the phone and but going back to serial commands doesn't work yet.

One main problem is the slow radio download.

With a clock speed at 500 kHz it takes almost 60 minutes to download the radio..

Is it the LPT wiggler that has this limitation?

Takes a long time to test each additional step right now.
[G1 Android Development] akivlin:
Here it talks about adapter_khz:

http://openocd.berlios.de/doc/html/Debug-Adapter-Configuration.html

For the ARM-USB-TINY USB JTAG adapter it is automatically set to 6000 but for you 500. Add adapter_khz 6000 to your config and see if it works?

The engineering SPL is only 512 KB so a much faster de-bricking method is to JTAG soft boot the engineering SPL and then fastboot the correct radio but it only works if you know which radio is installed on the phone.

For example I had a bricked G1 with 1.22.12.29 radio and 1.33.2005 SPL so I follow ezterry's instructions to soft boot so I can use fastboot to quickly flash the correct radio:

At the OpenOCD console enter the following: (hboot.img should be your phone's engineering SPL)

halt
mww 0x00902EB4 0xea000013
mww 0x00901A20 0x0
load_image /tmp/hboot.img 0x0
mww 0x00000c0c 0x98000C4C
mww 0x00000c08 0x98000C4C
mww 0x00000c04 0x98000C4C
mww 0x00000c00 0x98000C4C
resume

Now at the serial console enter the following:

cego

The cego command in serial console puts us in fast boot mode and we can use fastboot to quickly flash the correct radio.

For me it only takes only a few seconds to JTAG soft boot compared to ~8 minutes with the JTAG radio flashing method.

The instructions are similar for the other radios. Here are the first two lines required for each radio and the rest of the commands are the same for all radios:

# 1.22.12.29 radio

mww 0x00902EB4 0xea000013

mww 0x00901A20 0x0

# 2.22.19.26I radio

mww 0x009038F0 0xea000013

mww 0x00902B2C 0x0

# 3.22.20.17 radio (same as 2.22.19.26I)

mww 0x009038F0 0xea000013

mww 0x00902B2C 0x0

# 3.22.26.17 radio

mww 0x0090379C 0xea000013

mww 0x009029D8 0x0

I got the above addresses from ezterry's posts on XDA which explain everything in detail:

http://xdaforums.com/showpost.php?p=5934885&postcount=6

http://xdaforums.com/showpost.php?p=5911627&postcount=302
[G1 Android Development] ezterry:
you did 'resume' call in openocd right? then test the commands..

could be your battery is near dead. as you have had many tests.

There is always typing '?' + enter to verify the serial connection is working again after the resume/shutdown of openocd (before running radata)

I just copy the radata command as is from the wiki; prevents typos in the command without echo. it takes 2mins or so before it responds at all.. then another 2 mins or so to flash the radio.. unlike the SPL we don't have a fake progress meter to time the 3-4 mins total for you.
[G1 Android Development] mippen:
as it takes so long to get to finished radio download I have not figure out if I have serial command or not.

Just now I had a finished radio dl. then I userd the resume and the shutdown.. as I was going to the console the phone restarted to the Htc magic logotype

I have no clue on which radio I have in the phone so I guess I have to go through all the steps.

I think I bricked the phone when trying to replace a radio file so the best thing would be to get to a known point on the installed images.
[G1 Android Development] akivlin:
Try without doing the shutdown command. Only do the resume command then test the serial console is working by entering:

?

It should respond with:

Invalid command : ?

If you see the "Invalid command" response then all is well so you can proceed with the JTAG wiki instructions.
[G1 Android Development] Sirfearoth:
i skimmed through this thread trying to find any helpful info i my g1 that boots into the bootloader when powering on, camera not stuck, so i was thinking that the flash might have become corrupted i was wondering if anyone here thinks that this de-bricking method "might" work on my g1
[G1 Android Development] akivlin:
No JTAG should not be necessary.

You should be able to recover from a corrupted flash by copying DREAIMG.nbh to a SD card and allowing the bootloader to flash it to your phone.

By using this method to recover you would be downgrading your phone to RC29 (US) or RC8 (Europe). You can use the instructions on the Cyanogen Wiki to do so:

http://wiki.cyanogenmod.com/index.php?title=Full_Update_Guide_-_HTC_Dream
[G1 Android Development] Sirfearoth:
yeah, i tried that but it still boots into the bootloader, just hitting power, button for camera is out
[G1 Android Development] ezterry:
If it won't enter normal boot the jtag wont help you..

If you had a serial wire we may be able to tell more, but it may not be easy to fix, and my require fixing a trace on the phone's main board.

Do you have (or can you make) a goldcard? There may be some other things we can try.
[G1 Android Development] akivlin:
I believe there is a safety feature where a corrupted recovery and boot image causes it to boot to the bootloader which suggests your phone is incapable of successfully flashing those images.

Does it show your phone's serial number when you do fastboot devices?

Does it successfully erase cache and data with fastboot -w?

Have you tried to boot the kernel with fastboot boot <boot.img>?
[G1 Android Development] Sirfearoth:
sorry i should have said before hand its all stock 'recovery and spl' phone was a freebie from a co-worker, he got decided to play mr.fix it after i told him that i wouldn't root it for him, he was complaining about the battery
[G1 Android Development] akivlin:
I just tested by fastboot erasing boot and recovery and with no boot or recovery images the phone boots to the G1 T-Mobile logo screen and at the top it shows FASTBOOT USB in black on red background.

Are you sure the camera button isn't somehow stuck?
[G1 Android Development] mippen:
Search the net for a faster use of the wiggler.

1h wait between each try is a little bit too long since some of the load_image failes and some goes longer than the remaining power in the phone..

jtag_khz, adapter_khz and some other configs does not seem to work.

Read somewhere that it isn't the config file that sets the speed.

Could it be a generic LPT port setting?

is there a way to figure out what radio that is current in the phone? A small 512 KB SPL debrick would be nice now..

What would happen if I try with the wrong radio? Watchdog time out and reset?
[G1 Android Development] ezterry:
@mippen

I'll tell you that you are having quite a bit of problems with something that usually just works. (its unlikely you have the 6.x radio unless you bricked flashing that from fastboot.. and if that is the case we really want to flash the radio back via jtag)

can you provide the output to both your serial and openocd sessions? (post the full output to: http://android.pastebin.com/ and give us the link)

Also provide me the output to 'checksum oemsbl' (enter it flowed by enter to the serial console) it will tell us the checksum of the oemsbl partition of the current radio.. I may be able to find it I've seen most of them.

As for the speed.. you are asking quite a bit of a parport to go faster.

Last make sure there is no interruptions to power during the process. Ideal is not touching the phone or wires to it once the openocd is started.
[G1 Android Development] he3r0:
does that mean that I can strat phone in blue led mode, unplug serial, plug power, plug jtag, start openocd? (im a bit concerned about powering board, though i do known that battery was full, and there is nothing that will drain it too fast (screen, etc) but im still affraid that it may die in the mid process...
[G1 Android Development] mippen:
my chechSumCRC = 0x12061159

I will start another 1hour session here and log the result.

Have to google a little bit to see how I copy text from a PuTTY session...

I have also borrowed a Segger Jlink ARM Pro adapter from work.

Have anyone used this with openocd?

Will have to google it's interface and openocd support.
[G1 Android Development] mippen:
In my setup I have both access to serial and usb at the same time. But having the power from the usb connected closes / disables the serial data stream.

I do not know if this is a problem when running jtag.

In my attempts I only use battery power.. have enough of problems :-)
[G1 Android Development] ezterry:
12061159 = radio 2.22.23.02

I have not poked this yet (and unfortunately the position seems to have moved from 26I)

select it? (they use the posix method don't they)

successful de-bricks using this process yes.. but I don't think they made it work with openocd.. used its own ocd + converted the memory writes to its commands
[G1 Android Development] ezterry:
Um usually I'm on battery while using JTAG/serial

you can power the board and do a little bit of work with jtag.. but the serial won't allow input from oemsbl (not a problem with SPL commands.. however if you are de-bricking I assume you are not booting that far)

My real recommendation was to charge battery while "off"; ensure its full (so you don't run out of time) and then do the process via battery only (charge led=red/orange while charging and green when charged)

Its safe if you die while loading the radio into ram.. but we don't want to die after radata outputs the hex digits indicating that the validations are done and the radio is now flashing. Also I recommend not changing any wiring while the flash happens something my fry.
[G1 Android Development] mippen:
I managed to get through the load_image bit.

Did a resume.. could talk over serial.

Made the radata command.. and now i'm waiting....

No info on screen at all.. "only" 10 min ago now.

Should I follow the procedure on the wiki with the 0x19500000 address?

Shouldn't be a problem flashing with the device over jtag when it has 2.22.23.02 radio?
[G1 Android Development] akivlin:
Urgh, I assumed the above meant you had already flashed DREAIMG.nbh but now I am finding the original G1 SPL doesn't ask if we want to proceed with flashing DREAIMG.nbh. So you couldn't have flashed it?

I wanted to get my phone in same situation as yours so I wiped boot, recovery, system, cache and data and flashed the original G1 SPL and now my G1 boots only to the bootloader. I have DREAIMG.nbh on the SD card but the G1 original SPL doesn't ask if I want to flash it.

I power on and it goes to the bootloader. I press phone + menu + power and it reboots to the bootloader. I can't do anything but go into the bootloader.

EDIT: But I now find when I hold camera + power it boots to the bootloader and is allowing me to flash DREAIMG.nbh! I told it to flash it and rebooted and it's booted to Android. Phew! :cool:
[G1 Android Development] mippen:
Feels like that the phone got stuck when running radata command.

SessionLink

I'm using the "Magic 32A users with 6.x radio" data from the wiki.

Should I use any different data on the Magic 32B device?

After 45 min I removed battery, reset and checked the checksum. Hasn't changed.

I could make a second attempt with this but feels something is still wrong.
[G1 Android Development] ezterry:
2.22.23.02 != 6.x radio thus normal memory location is needed.

> The 6.x radio and 1.76.* SPL use 0x195XXXXX

> The 1.x 2.x and 3.x radios and related SPLs use 0x103XXXXX addresses

Is this a magic or dream (not that it maters much .. I've run the process as stated on both)

(BTW: I highly recommend not using a 6.x radio if you don't have a magic 32A.. may or may not work on a magic 32B.. but you will be needing JTAG to unbrick via the wiki instructions if you install it on a dream)
[G1 Android Development] he3r0:
thank you for your answea, and yeah i have 2 more (working) G1`s and multiple batteries, but even if they are fully charged, it will not really help if one of them die while doing some operations...

and im actually stuck atm...

question is, after i upload radio to the memory, can i swap battery to fully charged, or everything have to be done on one operation?

(since after i upload hboot.img, my serial line does not answer for version, or cego, all im getting is "invalid command")
[G1 Android Development] ezterry:
As I said blue light mode and jtag the phone will last at least 4 hours on a good charge from a good battery.. If even a slow parport jtag adapter can load the radio into ram within an hour that gives plenty of time for a 2-4min radio flash.

You are more likely to cause damage swapping batteries. Or inadvertently reset the device.

Also there are more steps than just uploading the hboot.img.. the mww commands are when open the access to the other oemsbl commands.
[G1 Android Development] he3r0:
yeah got that steps too...

now it just hangs on FA0F129C (on the serial line...)