yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] Wing_Z:
I got a dream that has the original TDO point broken (no point on board) is there a point some where else on the board i can use?
[G1 Android Development] fsl13:
Hi Everyone

I have a problem connecting Dream.

I connected all 5 jtag points using 100k Resistors on LPT port

I can see it connected on H-JTAG software

it shows the CPU ID

but it doesnt connect openOCD

is there a way to call H-jtag connection on telnet

i am really confused and have tried a million times

Please help me someone

or even i am ready to exchange my Rogers DREAM PCB (Bricked) with a working one if anyone wish to exchange please contact me

i am really fedup of reading wiki again and again and ending nowhere

Please help
[G1 Android Development] marchard:
@fsl13: Your jtag adaptor just consists of a bunch of resistors? i'm really no jtag-expert, but my guess is, that you can't do bidirectional jtag communication with that. you need some kind of active signal condition, see jtag wiki. cheapest jtag adaptor is called "Wiggler". You can get something like that already manufactured for around 10 bucks. or DIY even cheaper.

Bye, Marc.
[G1 Android Development] tonne99:
cego command does not run into Fastboot Mode

Hi,

another bricked Magic:

'Soft boot And Flash Engineering SPL' seem to work:

Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> halt
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0xa00000d3 pc: 0x009084c0
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> mww 0x0090379C 0xea000013
> mww 0x9029d8 0x0
> load_image /home/tom/hboot.img 0x0
No working memory available. Specify -work-area-phys to target.
no working area available, falling back to memory writes
524288 bytes written at address 0x00000000
downloaded 524288 bytes in 12.405925s (41.271 kb/s)
> mww 0x00000c0c 0x98000C4C
> mww 0x00000c08 0x98000C4C
> mww 0x00000c04 0x98000C4C
> mww 0x00000c00 0x98000C4C
> resume
> shutdown
shutdown command invoked
> Connection closed by foreign host.

Now serial line 'version' returns

OEMSBL VERSION: 3.22.26.17
OEMSBL Build Date: Jan 17 2010 12:08:33
PLATFORM: SAPPHIRE
PID: 46
PLATFORM ID: 1

But cego command does not enter Fastboot Mode

Done.
ZWH��k�}����}�ɽ��5
Camera 3M
[MDDI] Bitmap_Width = 480
[MDDI] Bitmap_Height = 640
[MDDI] RGB_Capability = 0x8888
[MDDI] Mfr_Name = 0xD263
[MDDI] Product_Code = 0x0
HeapFreeTable[0].StartAddr=0xA15AE180
HeapFreeTable[0].Size=0x6A51E80
HeapFreeTable[1].StartAddr=0xA1500658
HeapFreeTable[1].Size=0x8
HeapFreeTable[2].StartAddr=0xA1500EF8
HeapFreeTable[2].Size=0x8
HeapFreeTable[3].StartAddr=0xA1500F68
HeapFreeTable[3].Size=0x18
HeapFreeTable[4].StartAddr=0xA1500FAC
HeapFreeTable[4].Size=0x14
HeapFreeTable[5].StartAddr=0xA1501178
HeapFreeTable[5].Size=0x8
HeapFreeTable[6].StartAddr=0xA1501328
HeapFreeTable[6].Size=0x18
HeapFreeTable[7].StartAddr=0xA15013A4
HeapFreeTable[7].Size=0xC5C
EEPROM: read 2032 bytes
Board_PID : 0x2E
Wlan data header ++++++++++++++++++++
Signature : 0xEE1251
UpdateStatus : 0x2
UpdateCount : 0x17CB
BodyLength : 0x2F0
BodyCRC : 0x544E1ACB
aDieId(0) : 0x280EC0C0
aDieId(1) : 0xB5CE0684
aDieId(2) : 0x20000000
aDieId(3) : 0x3490
countryID : 0x30
Wlan data header --------------------------
ARM11 Boot Mode: 4
Platform: HBOOT-7201A

Is there another way to enter Fastboot Mode?

t0nne
[G1 Android Development] ezterry:
You appear stuck in "flash_radio" mode:

simple fix:

Change this set of writes:

> mww 0x00000c0c 0x98000C4C
> mww 0x00000c08 0x98000C4C
> mww 0x00000c04 0x98000C4C
> mww 0x00000c00 0x98000C4C
> resume

to:

> [b]mww 0x00000c10 0x98000C4C[/b]
> mww 0x00000c0c 0x98000C4C
> mww 0x00000c08 0x98000C4C
> mww 0x00000c04 0x98000C4C
> mww 0x00000c00 0x98000C4C
> resume

Otherwise everything else stays the same

(You just need to run 'Soft boot And Flash Engineering SPL' section again with that change)
[G1 Android Development] tonne99:
Hi ezterry,

thank you very much, that was the solution :D

Greetings,

t0nne
[G1 Android Development] scholbert:
Hi there,

i've been hunting in foreign regions for a while :p

So it's nice to see there's still conversation over here...

Yupp looks like a clone form China. Should match the G1 board.

If i ever loose my job i'll built such adapters and sell them for 5 bucks ;)

Search the web and read the thread from the beginning.

There were some early posts discussing cheap and usable adaptors.

Nope... AFAIK there's no other testpoint for TDO you might attach to.

So your screwed....

Like marchard also pointed out...

I personally would prefer a buffered one.

Though it might work out for some using a passive adaptor to read out chip ID or stuff, you might get into some trouble during long term JTAG sessions.

Anyway you might try to lower the transmission speed for the JTAG signals.

Verify the values with the one used on H-JTAG.

Also check your connections (pin assignment JTAG<->LPT) again.

Is it based on the wiggler?

AFAIK not...

Perhaps i didn't get you, but why don't you use OpenOCD Windows Edition?

Cheers,

scholbert
[G1 Android Development] fsl13:
Open On-Chip Debugger 0.4.0 (2010-02-22-19:05)

Licensed under GNU GPL v2

For bug reports, read

http://openocd.berlios.de/doc/doxygen/bugs.html

parport port = 0x378

trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain

dcc downloads are enabled

fast memory access is enabled

Info : clock speed 500 kHz

Info : JTAG tap: arm9.cpu tap/device found: 0xa01700e1 (mfg: 0x070, part: 0x0170

, ver: 0xa)

Info : Embedded ICE version 6

Info : arm9: hardware has 2 breakpoint/watchpoint units

Info : accepting 'telnet' connection from 0

target state: halted

target halted in ARM state due to debug-request, current mode: Supervisor

cpsr: 0x600000d3 pc: 0xffff01a4

MMU: disabled, D-Cache: disabled, I-Cache: disabled

Error: No working memory available. Specify -work-area-phys to target.

Info : no working area available, falling back to memory writes

Warn : Bad value '00000240' captured during DR or IR scan:

Warn : check_value: 0x00000009

Warn : check_mask: 0x00000009

Error: JTAG error while reading cpsr

Command handler execution failed

And on TELNET

_____________

Open On-Chip Debugger

> halt

target state: halted

target halted in ARM state due to debug-request, current mode: Supervisor

cpsr: 0x600000d3 pc: 0xffff01a4

MMU: disabled, D-Cache: disabled, I-Cache: disabled

> load_image c:/r.img 0x103B5300

No working memory available. Specify -work-area-phys to target.

no working area available, falling back to memory writes

Bad value '00000240' captured during DR or IR scan:

check_value: 0x00000009

check_mask: 0x00000009

JTAG error while reading cpsr

Command handler execution failed

in procedure 'load_image' called at file "command.c", line 650

called at file "command.c", line 361

>

-------------------------------------------

Whats wrong??? Please help i dont understand

Please Guide me

I am using HTerm as a serial terminal

Plz Reply as quick as possible
[G1 Android Development] scholbert:
Hi fsl13!

First:

Please check if you entered blue LED mode, before you started the debug session.

The program counter points to boot ROM area. AFAIK, PC should point somewhere in RAM.

Second:

I'll have to quote myself :rolleyes:

So to sum it up again:

These troubles could also be hardware related. So check your physical interface here.

I assume you are using the unbuffered adaptor with the resistors only.

As i pointed out this simple hardware might cause transmission errors during long term data transmission.

You might try to lower the frequency in the OpenOCD config and check again.

Anyway these are still basic transfers to the platform.

If they already fail, your adaptor is crap!

Check the posts, there are a lot of alternatives mentioned already.

I'm sorry, but i won't give a noobs guide here again...

Good luck and best regards,

scholbert
[G1 Android Development] robuser007:
I'm trying to get into blue led modus without any battery (external power 4v like the battery) to 2 places where the battery gives power), but there's third place (control?) which is needed to power on (for blue led modus), how should I connect that one ? (middle pin)
[G1 Android Development] stewdk:
The 'mww' offsets are surprisingly the same for radio versions 2.22.23.02, 2.22.28.25 and 2.22.27.08

mww 0x0090398C 0xea000013

mww 0x00902B2C 0x00000000

I have verified that this works with versions 2.22.23.02 and 2.22.28.25. If you can test it out for 2.22.27.08, please post results.

To figure out the offsets for a new radio version, open up a radio version where the offsets are known in a hex editor. HTC_BOOT seems to consistently begin at offset 0x001C0820 in the radio files (no guarantees). In the phone's address space, HTC_BOOT begins at 0x00900000. In this example, the offsets in the file are 0x001C41AC and 0x001C334C (subtract 0x00900000, add 0x001C0820). Look at the byte pattern and search for that in the new radio version. From there you should be able to do the math.

By the way, since radios 2.22.28.25 and 2.22.27.08 are 21626880 bytes long, the radata command should look like this: 'radata 103B5300 014A0000'. But that's only if you're interested in flashing radios of this specific size using JTAG and serial commands.
[G1 Android Development] robuser007:
:confused:

there are three connections (+ and - 1st & last one, see battery), but what about the middle connection (doesn't go to blue led modus without this one connected)?
[G1 Android Development] scholbert:
I would recommend using the standard battery to power up Dream into blue led mode. Without the middle pin connected the device won't start up.

AFAIK, the middle pin is a one-wire connection for internal battery controller.

Regards,

scholbert
[G1 Android Development] robuser007:
How do you do that (battery isn't holding it's place, I don't want to solder pins on the battery)?
[G1 Android Development] ezterry:
Well there are many ways ...

Usually I just solder wires to the test points, then put the phone partly back together (no screws but clip the cover on wires going out the side) so I can use case to hold the battery in place like normal. I find it least likely to cause me any issues like that.

Alternatively there is the option of a rubber band http://twitpic.com/1g6kc7

(but you so much as breath on it, it can disconnect.. not good if while flashing a radio)

.. I think if I recall previous conversations the phone will think something is connected and thus might boot if you lower the middle pin (ie. attach to ground) but its not most optimal and there is a surge of power required to start the hardware (blue light mode or otherwise)
[G1 Android Development] scholbert:
Please be a little patient i'll take a pic and post it here, when i'm home....

Weird stuff :D

EDIT:

See the pics attached. I took the part of the housing to stabilize the 'construction' a little. It fits very nice... of course a rubber band is absolutely required :p

See ya,

scholbert
[G1 Android Development] tonne99:
No Blue-LED-Mode

Hi,

another Magic which remains in Vodafone Splash Screen.

But when I want to start to Blue-LED-Mode the LED shows nothing.

Starting the Magic with serial line attached returns:

boot reason: PM_KPD_PWR_KEY_ON_RT_ST

(PowerOn Status,Boot Reason)=(1,1)
NAND_FLASH_READ_ID : HYNIX_512MB_FLASH_128MB_SDRAM

ARM9_BOOT_MODE0, Boot Android
ZWH��k�}����}�ɽ��5
Camera 3M
[MDDI] Bitmap_Width = 320
[MDDI] Bitmap_Height = 480
[MDDI] RGB_Capability = 0x666
[MDDI] Mfr_Name = 0x0
[MDDI] Product_Code = 0x0
panel_id = 0x1
Sharp ! panel detect
panel_poweron 0x290= 0x0
Panel_NT_sharp_power_on enter.
panel_poweron 0x290= 0x1
EEPROM: read 2032 bytes
Board_PID : 0x2E
Wlan data header ++++++++++++++++++++
Signature : 0xEE1251
UpdateStatus : 0x2
UpdateCount : 0x3
BodyLength : 0x2F0
BodyCRC : 0x75B5AA71
aDieId(0) : 0x0
aDieId(1) : 0x0
aDieId(2) : 0x0
aDieId(3) : 0x0
countryID : 0x30
Wlan data header --------------------------
ARM11 Boot Mode: 3
Platform: HBOOT-7201A
setup_tag addr=0xA9200100 cmdline add=0x98070CA0
TAG:Ramdisk OK
TAG:smi ok, size = 64
TAG:hwid 0x1
TAG:skuid 0x21404
TAG:hero panel = 0x0
TAG:engineerid = 0x2
radio_flash_id=0x5510BCAD
die_size=0x1
radio_flash_id=0x5510BCAD
die_size=0x1
TAG:die_size = 0x1
Device CID is not super CID
CID is VODAP102
setting.cid::VODAP102
serial number: HT9B3KF00833
commandline from head: no_console_suspend=1 console=null
command line length =348
active commandline: board_sapphire.disable_uart3=0 board_sapphire.usb_h2w_sw=0 board_sapphire.disable_sdcard=0 smisize=64 androidboot.baseband=2.22.23.02 androidboot.cid=VODAP102 androidboot.carrier=VODA-Germany androidboot.keycaps=qwerty androidboot.mode=recovery androidboot.serialno=HT9B3KF00833 androidboot.bootloader=1.33.0013d no_console_suspend=1 console=null

PARTITIOM_NUM_MAX

No JTAG connection possible.

When the PSU is connected, the LED doesn't turn to orange but the battery charges.

Any chance to get this Magic working again?

Greetings,

t0nne
[G1 Android Development] ezterry:
Hrmm.. almost looks like its succeeding on booting .. but if you are not in recovery obviously not.. If you did get into recovery its odd bootmode 3 didn't clear letting you flash as normal.

What do you mean by JTAG is not possible.. if you mean something wrong with the testpoints sure.. but if you can get in it looks very possible..

Just rather than a break point you can watch for a memory change while the system writes the SPL .. say at 0x00000d00 [really I've not been in OpenOCD lately check the help screen for the command]

Then when the watch point is triggered:

# mww 0x00000c0c 0x98000C4C

# mww 0x00000c08 0x98000C4C

# mww 0x00000c04 0x98000C4C

# mww 0x00000c00 0x98000C4C

and then you can clear the watch point and resume the CPU.. with luck it will go into fastboot on 1.33.0013d that will let you use 'fastboot nbh <SAPPIMG.nbh>' to restore the phone to a working state..

re-root and continue as normal. (no serial wire is required for the above in theory but as always it may aid in figuring out what is happening)

Odd blue light mode is not working.. make sure you do not have power (AC or USB) attached in blue light mode it makes it act strange.. remember its not really a user mode just a after image for primarily developing the phones and radios; as well as initializing your phones IMEI/Serial number information at the factory. This means it need not be friendly to work with.
[G1 Android Development] tonne99:
Hi ezterry,

the owner of this phone told me that it was bricked due to error during an update.

No recovery mode (home + power), no hboot (volume down + power), no fastboot (return + power)

So I want to make a De-Brick via JTAG, but I recognized that I can't reach "blue LED".

When I start the phone with trackball + power, serial line with 5V attached returns:

boot reason: PM_USB_BUS_VALID_RT_ST

boot reason: PM_WDOG_TOUT_RT_ST

(PowerOn Status,Boot Reason)=(49,6)
NAND_FLASH_READ_ID : HYNIX_512MB_FLASH_128MB_SDRAM

and without 5V:

boot reason: PM_KPD_PWR_KEY_ON_RT_ST

(PowerOn Status,Boot Reason)=(1,1)
NAND_FLASH_READ_ID : HYNIX_512MB_FLASH_128MB_SDRAM

But when I press ? there is no output like "Invalid command : ?" and OpenOCD can't connect. The testpoints are connected.

I did eleven successful De-Bricks before.
[G1 Android Development] ezterry:
Well either something has become loose in your serial wire.. or something is loose with the serial interface in the phone.

regardless try: (This process is theoretical and may need some adjustments)

1) plug in +5 [best be just your USB wire] (will start the phone charging)

2) in OpenOCD:

halt
wp 0x00000d00 0x4
resume

3) press power and wait for the CPU to halt in the debugger

4) in OpenOCD:

mww 0x00000c0c 0x98000C4C
mww 0x00000c08 0x98000C4C
mww 0x00000c04 0x98000C4C
mww 0x00000c00 0x98000C4C
rwp 0x00000d00
resume

5) with luck fastboot appears use USB to run 'fastboot flash nbh SAPPIMG.nbh' where SAPPIMG.nph is any 32b sappimg file (I'd use this one as its one I know works.. but there must be better ones)
[G1 Android Development] tonne99:
Hi ezterry,

I followed your instruction, but unfortunately fastboot didn't appear. Only the Vodafone splash is shown.

fastboot devices

echoed nothing.

Can you please provide some further hints.

Thank you.

Greetings,

t0nne
[G1 Android Development] tonne99:
FEEDBACK:

I found no possibility to get the Magic working again with Olimex ARM-USB-Tiny because serial connection and commands were not established.

But at least Riff Box did it :D.

Greetings,

t0nne
[G1 Android Development] scholbert:
I got two dream mainboards that are not able to enter blue led mode.

Unfortunately i'm not that familiar with the boot sequence anymore... :rolleyes:

As far as i remember, the phone stucks in QCSBL or could not load OEMSBL for some reason in these cases.

Nice to hear.

AFAIK Riff Box handles raw access to NAND memory.

Did you recover using one of thoose dumps?

Regards,

scholbert
[G1 Android Development] ra100x:
help?

sorry, if I'm in wrong topic, sorry.

I there any guide on what to do if I am stuck with splash screen "T-Mobile G1"

this happened, arter flashing spl via amon ra recovery, everything seemed to be ok, I rebooted phone and it is stucked on splash screen, no access to recovery, no fastboot. Any ideas?

EDIT: I've found JTAG guide on wiki, at last. But still one question, is there any way how to flash SPL only via JTAG? (without serial wire)
[G1 Android Development] doktorx:
please help i find next pin TDO on board HTC G-1

HI all , please help me

Im seeking more pin TDO on board HTC G-1 - this normal pin tdo is wrong -"go ON" :-(. Perhaps the wrong question : this pin TDO must be connected , for unbrick htc G-1? Thx a lot
[G1 Android Development] scholbert:
..back from the dead ;-)

Hi BLKro,

i guess this thread will never die ;)

Obviously your JTAG chain is not working correctly... perhaps the TAP controller is in the wrong mode.

Check this out:

- download dream-wig.cfg.txt and rename to dream-wig.cfg

- on your linux host open a console window and gain root access (e.g. su)

- put your hardware right in place and power up the board

- make sure nTRST is permanently pulled high (@2.6V) and your board is powered up properly

- step into your openocd directory and start openocd using dream-wig.cfg

What happens?

Good luck,

scholbert
[G1 Android Development] BLKro:
Hi, thanks for the reply.

I am already using this config (with parport 0), tried with yours too, the nTRST is high when opening openocd, I will soldering it to 2.6V and see if that helps. The response is the same, sometimes the cpuid changes but to some junk like "JTAG tap: arm9.cpu tap/device found: 0x000000" or "0xf0f0f0f0". Not once have I seen a valid CPUID (I read about 3 of them in this thread). I do not have long wires, but some of them are tangled and go over the board, crosing some other wires (not shorting, because the wires are insulated). I never before had problems at this low frequency with wires... But I will try to clean up the prototype board when I have a little spare time. It's odd cause I tried 1kHz and 500kHz and get the same result. If I try some other frequencies, at some I get a faster response from openocd, at some other I get a really slow response (slower than at 1kHz at some).

In the meantime, I already compiled openocd myself to make sure I have a parport configured version, but the problems are the same.

Thanks again, will come back with more info, when I have it.
[G1 Android Development] scholbert:
Hi BLKro,

please check your LPT-adaptor too.

Which logic family did you use to build it?

Regards,

scholbert
[G1 Android Development] TmobileDash12:
So I left the G1 scene awhile ago and moved on to the mytouch 4g scene.

I lent my friend my G1, and got it back bricked.

It doesn't boot. No LED backlight, no splash screen, no booting into recovery, no booting into fastboot, and no ADB.

I don't know where to even start.

Any help, directions, or pointers to be in the right direction is appreciated.

Thanks in advance!

EDIT:

I also tried connecting several USB cables from the laptop, or through an outlet adapter. I don't remember if the G1 has a LED for charging, but I didn't see any.

Also tried using a different battery.
[G1 Android Development] scholbert:
Hi th0br0,

thanks for this information.

So we need to connect ot serial line on the 11pin USB header to get in touch with it?

Do you remember anything ;) ?

How about JTAG'ing, is there anybody out there doing some experiments?

Regards,

scholbert
[G1 Android Development] th0br0:
forum(dot)revskills(dot)de/viewtopic.php?f=10&t=123

You got the connector laid out there.

And here you go for the commands: T=369754 (that's the thread ID on XDA)

Entering was either via normal boot up or via the blue led ...
[G1 Android Development] bfikkert:
Radio bootloader serial fuctions links.

I'm not a hacker or programmer. Just out off interest i follow this tread.

I did some search and found these links about the Radiobootloader or Serial interface connections. I really don't know, but maybe there's something in there for you to go with.

The Hermes bootloader.

http://wiki.xda-developers.com/index.php?pagename=Hermes_BootLoader

The Hermes radio boorloader commands.

http://wiki.xda-developers.com/index.php?pagename=Hermes_RadioBootLoader

How to enter radio bootloader (OEMSBL) (it's a different phone. But it's a HTC)

http://xdaforums.com/showthread.php?t=369754

[Access OEMSBL] Bricked by setboot 1 after ATCMD

http://xdaforums.com/archive/index.php/t-487945.html

Good luck. (for all people witch have a brink.):)

Bob
[G1 Android Development] scholbert:
Hi,

thanks for pointing that out :D

I suppose this interface may be used in "blue led mode".

Needs to be confirmed for HTC Dream i guess :p

Best regards,

scholbert
[G1 Android Development] bfikkert:
This looks like really interesting.

It's not a HTC G1 but it's a HTC with a Qualcom processor.

It's a lot of interesting reading.

http://xdaforums.com/archive/index.php/t-372305.html
[G1 Android Development] G1Hope:
I just got my serial cable, so I can do some experiments.
[G1 Android Development] kR105!:
Do you know if that cable can be bought from eBay? I would LOVE to participate in this project!
[G1 Android Development] G1Hope:
I got mine here: bestcelldist.com/htc_dream_1_serial_data_cable.html

Arrived on time so they seem trustworthy. =)

From there you can hook it up to a USB->RS232 adapter, or directly to your comp if it has an RS232 port (getting rarer these days). The extended connector that HTC uses has some extra pins for audio and RS232, and this cable hooks onto those pins. This gets you at the serial debugging console (which is not accessible over USB on a bricked system since the radio code does not include a USB stack).
[G1 Android Development] scholbert:
Hey some interest..... ;)

We're leaving the JTAG topic right now...

...but after reading some of the threads about radio bootloader, the serial debug thing looks very interesting.

DIY: http://www.instructables.com/id/Android_G1_Serial_Cable/

Maybe i'll have a look for the testpoints of the serial lines on the mainboard :D

Have fun with your experiments!

scholbert
[G1 Android Development] bart9984:
Hi guys,

I've really appreciated your work on the g1 unbriking...

I've have an htc Magic 32A bricked, as some of your g1 dream it stucks on first splash screen. No way to start it in fastboot, hard reset, recovery mode neither attaching it via official usb cable.

I can boot in blue led mode holding trackball + power buttons.

I hope your work could be ported to such devices too...

bart99
[G1 Android Development] bart9984:
Hi,

I found this cable on ebay.it

cgi.ebay.it/Serial-JTAG-USB-TTL-rs232-fonera-OpenWrt-DD-WRT-Seagate_W0QQitemZ230427240372QQihZ013QQcategoryZ41993QQssPageNameZWDVWQQrdZ1QQcmdZViewItem

that should be fine if you only connect rx tx and gnd, according to the site

...instructables.com/id/Android_G1_Serial_Cable

Anyone of you can tell me where to find an extUsb to attach to it that ships easly in Europe?

Bye,

bart99