yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] ezterry:
Not sure your setup.. but the ARM-USB-OCD has 2 FTDI chips

1 = jtag adapter (Part A listed above)

2 = serial port (Part B separate entry still in the file)

After commenting out part A everything seems correct; the 'B' part still exists in /dev/tty.* but the A part is not shown and openocd can access it.

Make sure you don't have any FTDI usb adapters attached when unloading/loading the ktext.. I'm sure with some poking you will get it to work... that or lots of restarting things since you don't actually need JTAG and Serial at the same time..

On that topic I'm finding one in a few phones 'cego' fails to run the soft loaded SPL while the jtag adapter is still attached..

I wish you luck.. Certainly given the scale of what is involved.. I'm not really set up to do such a project.

but today was a bad day to be soldering apparently (did manage to succeed rooting the phone in the end but I'd rather not need to hold a wire against the remains of a trace because I pulled the testpad off)

Day is ending here.. thinking of sleep soon; enjoy the hacking
[G1 Android Development] gymmy:
Sorry to hear about that, im just not even going to attempt to do it, and am thinking of other ways of attaching to these points, but since they are spaced about 0.5 mm apart its going to make it hard :(

Thanks for your help btw and ive sorted out the driver issue.

Have a great week

G.
[G1 Android Development] bucharsky:
Hi again!

problem was in Tx wire. Now i`ve solved it. PuTTY works.

I`ve flashed raido using that manual

_ttp://wiki.cyanogenmod.com/index.php/JTAG_DREAM_AND_MAGIC#Loading_Radio_3.22.26.17

Everything was ok, after

Erase Block: 277
Done

HTCST ���HTCE

i sent powerdown command.

But now there is no vibro in normal boot.

Dont know about blue light - i have no screen attached.

And there is no any boot messages in PuTTY
[G1 Android Development] ezterry:
* What type of phone model/brand/ect?

* If you have odd things please detach your serial wire and all power from the jtag adapter + battery + USB wire .. then see if things work again

* If you soldered to the board make sure nothing became loose; same goes for the serial wire

Ensure openocd is not running .. the phones usually refuse to boot if it is. (usually the shutdown command is enogh and I can leave the jtag adapter plugged into the computer.. but sometimes I've needed to unplug the USB jtag adapter (includes v-ref in my setup) as well.

And the power from jtag or serial data lines prevents the phone form fully shutting down so things get strange in memory sometimes.
[G1 Android Development] bucharsky:
* HTC g1 (not rogers)

* Same thing with all detached

* Everything soldered fine

When i plug USB charge + jtag (without battery):

- continious vibro with trackball pressed

- no vibro in normal boot and it is possible to run JTAG console

seems there is full brick =\
[G1 Android Development] ezterry:
So happy case (While the process is a bit tailored to rogers phones) the test phone I used to verify the steps while writing the wiki and other documentation was a T-Mobile G1 so that ought to not be an issue

Unless you had some bad blocks or something else caused a block in the radio to flash incorrectly I don't think the issue is the process..

only time I've seen continuous vibration is booting with the serial line attached when the phone hasn't been in blue light mode for a long time.. and that I think was confined to one phone

If JTAG still sees the processor we may be able to do something.. try it.. and run halt.. tell us where the program counter is.. that might give us an idea what is up..

Also while trying everything keep the serial wire plugged in and see if there is any output (that is where debug messages go after all)
[G1 Android Development] bucharsky:
JTAG still works.

I can halt and resume

Now when i plug serial wire phone starts continuous vibro
[G1 Android Development] ezterry:
> For the serial; just power up holding the action button (ie. enter blue light mode) then plug in the serial adapter

> For the device.. I think something went wrong [at a very low hardware level] with the radio flash; since what you did is the same as 'fastboot flash radio.img' with all the signature and checksum checks in place; so its unlikely the issue was an error transferring the radio to the phone .. (as those usually break sha2 checksums ... least I think I see sha256 code)

It also means all the bad block logic ought to have stayed intact.

So my guess is a hardware glitch while flashing.. but as the processor is still alive there may be hope yet.. this will take some work however since some of our process and software doesn't cover this yet.
[G1 Android Development] scholbert:
ouuuch~~~~~~~~~~~

Hi fellas!

What happens if you start the device with everything connected?

Using the device without battery is no normal operating state.

From looking at the screenshot the program counter is at 0x8000e1cc

Seems very similar to one of my devices that died during some experiments.

The battery connection was interrupted and from my conclusion this caused some bad block during flash access.

I already started some attempts to recover, but so far without success.

Maybe it's possible to revive these kind of bricks.

Would be even harder i suppose.... :(

Regards,

scholbert
[G1 Android Development] bart9984:
maybe using PSAS/QMAT full version there is JTAG access to writing nand? You could try it to re-flash radio.

Jlink should be the only JTAG adaptor supported

bart99
[G1 Android Development] sorenjul:
Hi

Few years back I did digital design and during debugging the easiest way to load code to the boards was to use a jtag debugger. These were systems with no kind of storage meaning when power was cycled all was lost.

I've been through the thread a couple of times but can't remember if we do have the memory map for the different types of memory attached to the processor.

If we do could it be possible to write a little piece of test code that flashes the nand with a radio image loaded to ram?

We would though then need to know basic stuff about the types of memory since we would have to initialize it as the first thing.

Just my thouhgts about what to do when the radio code is broken.

Best regards

Soren Jul
[G1 Android Development] scholbert:
thought's...

Hi sorenjul!

I know what you are talking of...

It's a bit different situation on a bricked device, i'll try to explain in short.

Please correct me if i'm wrong :rolleyes:

First there's a thing called OTP-PBL... it's like the BIOS of the MSM7201 which is not re-writable.

This code already checks the existence of RAM/NAND, entry points and/or valid partitions. There's also some basic system check in this piece of code.

The OTP-PBL is programmed by Qualcomm/HTC and the CPU automatically jumps into this code after cold reset.

We have to leave this code with the correct settings and it might be necessary to re-enter some routines to setup parts of the SoC in a usable state.

Maybe some cheats are needed here...

Second, there might be still some valid content in NAND memory of the bricked device. The CPU will these commands untill data gets corrupt.

As a result the CPU stucks in a loop or crashes into an exception error.

In some cases this may leave the CPU in an unknown state or even unreachable for the debugger.

The main problem is, that many parts of the firmware and it's function is still unknown and the CPU might refuse to execute injected code due to security restraints.

I don't know if anyone ever tried to block the NAND memory to completely prevent any firmware code execution.

Maybe we should point out if the chip select for the NAND could be disconnected and what is going to happen in this case :D.

See my older posts for some general information.

MSM memory map:

http://xdaforums.com/showpost.php?p=6042802&postcount=403

NAND flash partition offsets:

http://xdaforums.com/showpost.php?p=5885268&postcount=290

This code already exists (NPRG7200.BIN).

ViperBJK has adopted this code to work within his PSAS environment.

Unfortunately this piece of software is a little mysterious to work with :p

Obviously the RAM and the SoC's NAND controller has to be setup correctly. AFAIK some initial settings are already done by OTP-PBL.

Nice thought's ;)

Have fun!

scholbert
[G1 Android Development] Broken:
Ok, have read a bunch and now my head hurts but think I have the gist.

So now I am looking at a probable price for the needed stuff.

Now I am not into soldering so was looking at one of these:

http://www.gsm-technology.com/index.php/en_US,browse,id_gr,1307,menu_mode,categories.html

About $20 minus shipping.

Then need the JTAG to USB adapter and looking like ARM-USB-OCD is cheapest??? at $70.

Looks like I can use the free software floating around out there so looking at around $120 just to get my Wife's stupid Dream rootable...

Is there a cheaper method or am I looking at doing this and trying to help my losses by offering to fix other unfortunate peoples Dream's here in the US for cheap?

Otherwise I will probably give my Wife my Milestone and get me something like a Nexus 1 or similar Android device as I don't really use the hardware keyboard....

Thoughts?

If I could get the stuff required for about $60 I would probably just do that....
[G1 Android Development] gymmy:
yeah this is the easy part buying and setting it up, the hard part is connecting to the points ! Since i dont like doing high res soldering and i dont have any flux to put on the pads and im a bit of a chicken im trying to sort out a way to mate up the jtag pads with the pins to carry out the fix... I sort of got it sorted last night, but run out of time, i hope to have a solution this weekend :)

G
[G1 Android Development] marxmarv:
Olimex gear is consistently overpriced.

Consider http://www.ecrater.com/product.php?pid=5735294 for $40. The important things are that it's OpenOCD compatible and that it works with a minimum Vref of 2.6v or less. You might be able to do better if you shop it harder.
[G1 Android Development] scholbert:
Well said....

IMHO the solution presented in this thread is NOT...

1. valuable for people who never get into deeper touch with electronics.

2. useful for thoose who got no equipment at all but intent to unbrick only one device without spending money.

Thoose who look for cheap solution (e.g. the schematic i once posted here... simple LPT adaptors lbcoder refered to a thousand times) should have heard about...

1. logic circuits.

2. how to use a soldering iron.

3. what it means to be a cusious guy and modify a harddrive to act as a radio

I really would appreciate if this thread won't be transformed to a basic lecture of financial statistics.

Also all these questions about matching adaptors get's boring.

As far as the JTAG dongle supports ARM9 or got additional features like full MultiICE support and/or sweet debugging software, it would work.

OpenOCD is only one tool to make it work the way ezterry and bart did it!

In fact any free/commercial debugging software matching to your ARM9 dongle would be capable to unbrick a G1.

O.K. as marxmarv said it... you should check the specs of the adaptor to support low voltage levels.

All you need is at least some basic knowledge about debugging ARM cores using a JTAG interface.

So if there are technical issues this should be the right place to discuss everything in detail.

That's my decent opinion and i don't want to flame anyone.

Best regards,

scholbert
[G1 Android Development] dr4stic:
If this is gonna break the bank that bad, don't do it. Me, I'm taking the "build your own jtag" approach which I'm hoping will save me some money. It's listed in the WiKi as the "low cost wiggler clone". I'm not big on soldering either so I'm just doing it with a breadboard. The hard part has been finding the 74lvc245 in the states, but I think I found it. I've got a computer with a parallel port and a 25 pin d-sub cable I can cut up, so I'm good.

You could also take the use-it-once-and-return-it approach, however that just smacks of being dishonest, not cool, etc. Then again, you'd be paying all sorts of shipping and a 15% restocking fee (about $25-30 in the end) to a company whose revenues exceed 10m annually. This is if you're really desperate. Or, you could just re-sell the thing on eBay once you're done.

I'm personally doing this with a very limited knowledge of electronics and just a very small bit of experience I gained some 16-17 years ago. I'm trusting in the guides that I'm reading. I've already come to terms with the idea that my phone is a brick and may not make it out of that state, and this is an adventure for me. Every now and then I like pushing the limits of what I can and can't do.

If you can't do that, then this might not be the adventure for you...
[G1 Android Development] scholbert:
FYI:

http://xdaforums.com/showpost.php?p=6185680&postcount=489

Happy hacking... :p

scholbert
[G1 Android Development] ezterry:
Its not reading the processor Id correctly..

May be a few reasons.

A: did you start openocd with the phone already in blue light mode? The processor needs to be running for jtag to notice it. Thus best to enter blue light mode before starting the openocd app.

B: are you sure all the wires are securely attached

C: verify vref is 2.6v .. while jtag is running (make sure you don't short anything with the multi meter)

D: what type of jtag adapter are you using? can it support that speed?
[G1 Android Development] bart9984:
I confirm what said by ezterry, the id is wrong, in my case it happened cause of the gnd wire not properly fixed, or one of the other wires too. Try also to disconnect the +5v from the serial cable, in my case I used it connected to start the phone and serial console and then I used to disconnect it. When it was connected openocd had problems.

Enjoy,

bart99
[G1 Android Development] sorenjul:
Hi

Thanks for the reply

A: I did enter blue led mode before starting openocd. Serial debug is listed below

boot reason: PM_KPD_PWR_KEY_ON_RT_ST

(PowerOn Status,Boot Reason)=(1,1)

NAND_FLASH_READ_ID : SAMSUNG_512MB_FLASH_256MB_SDRAM

ARM9_BOOT_MODE1

B: I did not solder the wires to the board myself - a friend did it at my old company under a microscope. Any way to test the connecttion with the jtag debugger? I left out the RTCK signal like Bart99 cause it is (impossible) to solder between the cpu and the shield case.

C:Vref is supplied from a lab voltage source so it should be ok

D: I'm using the Olimex arm-usb-ocd. I can't seem to find out if the debugger is powered by the USB or do I have to supply voltage to the debugger.

Regards Soren Jul

C:
[G1 Android Development] bart9984:
Hi,

Well the debugger is powered by usb, it has a led that should became green. But I don't think your problem it's about power, it seems to be a lost connection one. Try removing battery and usb and with a multimeter check there are not cortos between wires and gnd or between wires themself. In my case a common value of the resistance between wires and gnd was 400 to 800, a good connection one should be about in the middle of the range. What I'm saying is what i've experiencenced in my tries, also me had some problem at the beginning.

Enjoy,

bart99
[G1 Android Development] sorenjul:
Oh I guess I just have to borrow a scope and check each of the signals and see if some of them are quiet. My multimeter is way to slow to measure any of the voltages I will not get any readings at all.

Just a questions - how long wires did any of you use. Mine could easily be shorter, hope I don't have too bad signal quality. I just noticed the the ribbon cable on the jtag debugger has a 50/50 ground/signal to keep crosstalk down.

If the debugger is equipped with new fast output buffers (can't buy those old slow ones any longer) I surely will have significant crosstalk on my interface.

Regards Soren Jul
[G1 Android Development] sorenjul:
better results but still not there

Hi

I shortened the jtag wires and resoldered the and now I think I'm a step closer to the goal line.

When I start openocd I get:

ubuntu@ubuntu:~/Downloads/flash$ sudo openocd -f dream.cfg
Open On-Chip Debugger 0.4.0 (2010-04-26-19:27)
Licensed under GNU GPL v2
For bug reports, read

trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain
dcc downloads are enabled
fast memory access is enabled
Info : clock speed 6000 kHz
Info : JTAG tap: arm9.cpu tap/device found: 0x301700e1 (mfg: 0x070, part: 0x0170, ver: 0x3)
Warn : JTAG tap: arm9.cpu UNEXPECTED: 0x301700e1 (mfg: 0x070, part: 0x0170, ver: 0x3)
Error: JTAG tap: arm9.cpu expected 1 of 1: 0xa01700e1 (mfg: 0x070, part: 0x0170, ver: 0xa)
Error: Trying to use configured scan chain anyway...
Warn : Bypassing JTAG setup events due to errors
Info : Embedded ICE version 6
Info : arm9: hardware has 2 breakpoint/watchpoint units

And when I try to "halt" the processor I get

> halt
invalid mode value encountered 20
cpsr contains invalid mode value - communication failure
Command handler execution failed
in procedure 'halt' called at file "command.c", line 650
called at file "command.c", line 361
Halt timed out, wake up GDB.
>

And In openocd I get:

Error: invalid mode value encountered 20
Error: cpsr contains invalid mode value - communication failure
Command handler execution failed
Info : Halt timed out, wake up GDB.

Any suggestions to what my problem is. As far as I can tell the only problems could be that I did not compile and install openocd correct or else the radio ver. 6.35 is causing problems.

Best regards

Soren Jul
[G1 Android Development] ezterry:
Since my jtag wires are not exactly short I'm very curious how long yours are that you are worrying about the length...

bart9984:

The dream has CPU id: 0xa01700e1 .. Did the magic match that or is it 0x301700e1? I remember you indicating it was the same as the dream; but the Omnia forums seems to also have references to 0x301700e1?

sorenjul:

openocd will not send the halt command unless the CPU ID matches.. this is just defined in the CFG so easy to change; however if we know we have the right ID; it could indicate you still have a loose connection.

set _CPUTAPID 0xa01700e1

I know both the T-Mobile G1 and Rogers Dream both are 0xa01700e1 but I have not tried a magic.
[G1 Android Development] bart9984:
Hi,

During my tries I experienced both id=0x301700e1 and id=0x901700e1,

In my case if id =0x3001700e1 I was not able to use jtag cause to "halt time out error"...

another important think is Info : Embedded ICE version 6 , during my experiments I had ICE=15 and it was an error caused by not well soldered wires.

At the and I had a warning caused by the id and ICE=6 and it worked. In my config file I used set _CPUTAPID 0xa01700e1. So should be sorenjul still have not well soldered wires problem...

Cheers,

bart99
[G1 Android Development] scholbert:
Hi!

i also would recommend to examine the soldered wires first.

My suspicion is, there could be something wrong with the power supply environment.

As a result there could be some noise/bounce on GND of your mainboard which causes erroneous data transfers.

I got it like this:

1. Host PC -> powers Olimex USB (5V)

2. Lab voltage source -> powers Olimex USB output drivers (2.6V)

3. Battery -> powers Dream mainboard (is the source of TDO level)

Try the following...

Connect Olimex USB to your PC and attach it also to the Dream mainboard.

Do not connect the lab supply to Olimex yet.

Power up your lab supply and check if there's a potential difference between GND of your supply and the Dream mainboard.

If you measure high voltage levels between GND...

...try to minimize it by choosing the same AC supply for your host PC and the lab supply.

...try to change polarity of one of the AC plugs.

...use good GND connection between the different parts.

Other things to check have already been mentioned here...

...use short wires to your buffered adaptor (mainboard <-> Olimex USB)

...try to reduce JTAG signal speed (6000kHz is pretty fast)

...keep your environment clean (power off additional switching supplies in your AC network you do not need, e.g. laptop power supply)

Regards,

scholbert
[G1 Android Development] scholbert:
Direct NAND access for MSM720x with OpenOCD

Hi!

just grabbed the latest source code of OpenOCD.

http://openocd.git.sourceforge.net/git/gitweb.cgi?p=openocd/openocd;a=summary

While stepping through the code i realized that there's already support for the NAND controllers of the famous S3C24xx and S3C64xx SoC's from Samsung.

There's also some interesting patch to integrate NAND access for the PXA3xx family:

http://openpxa.git.sourceforge.net/...b14f902c0def2250b465e1f7fe0e0361c42;hb=master

This project started from scratch using the NAND kernel driver for PXA as a base.

With some programming skills and basic knowledge about the OpenOCD framework it should be possible to integrate the MSM720x NAND controller as well.

Concerning MSM NAND integration...

we got some kernel drivers:

https://android.git.kernel.org/?p=k...4e01af059af08ec9bd68cb8;hb=android-msm-2.6.27

and some bootcode examples:

https://android.git.kernel.org/?p=p...3f0ca8950b20962d2dba949ec1fa92635743;hb=donut

the header:

https://android.git.kernel.org/?p=p...f9a832b330332f3a4a2a08dd5ed508d514d2;hb=donut

Of course there's source code from other/newer versions as well.

Once integrated into OpenOCD this would give us direct access to NAND flash on HTC Dream and might open the door for further investigation and/or techniques to rewrite parts of the firmware.

Any thought's are welcome :D

Regards,

scholbert
[G1 Android Development] gymmy:
hey guys,

Had a bit of a disaster today :(

Soldered the wires on all fine left to take a call, and come back to find the cat on my work desk playing catch the wire !! :( Grrrr, anyhow to cut a long story short the ridgness of the wires i soldered on to the points has caused the jtag point to be fractured from the board :( so im kinda screwed now :(

Never mind was all fun and games :) Phone still works though so here is hoping for a serial fix for it ! :)

G
[G1 Android Development] lbcoder:
Get rid of the cat.

Get a dog. They live on the floor so tend not to mess with anything but low hanging wires. :D
[G1 Android Development] dr4stic:
You must be talking about either really tiny dogs, or really big dogs. Otherwise, I have a rat terrier that jumps on anything and everything... which in his younger days included things like chairs, sofas, tables, desks, kitchen counters, etc :-)
[G1 Android Development] gymmy:
haha yeah tell me about , she certainly have 9-1 lifes left that for sure ! never mind, ill just have to trace out alternatives or just trash it lol
[G1 Android Development] lbcoder:
.... that sounds like training issues to me. :D

FYI: one of my dogs is also a rat terrier.

It is the most obedient and well behaved animal I've ever had. I can put it in one place and it'll stay there for a month if I don't release it, even if there were squirrels mating 10 feet away.
[G1 Android Development] eleazar6:
Quick question... can I interchange AUX and primary JTAG points? I also tore off a solder pad for TDI. Can I use AUX_TDI on the other side of the board?
[G1 Android Development] dflipb:
I don't know if this has been suggested, (I have read through the entire thread but can't remember) but for those that aren't that skilled at soldering, wouldn't it be easier to just buy this:

(World Wide Web)gsm-technology.com/index.php/en_US,details,id_pr,7183,menu_mode,categories.html (sorry it wouldn't let me post a freakin link! argh!)

it's the JTAG adapter for the G1 so instead of trying to get in there at those micro points, you could just get a data ribbon and hook your $2 self made JTAG to this. I think that would greatly improve soldering contact problems.

Thoughts?

Keep up the great work!! I bow to your excellence!

Mark