SUCCESS! De-Bricking Dreams - Complete JTAG Testpoints! UPDATE! 04/07/10

I figured this should be in its own thread so those working on a solution can now focus on the software side of things.



These are the JTAG connection points I traced from the CPU to their test points. i'm almost 90% sure the Primary is still usable. Auxilary JTAG port is Very very hard to get too and i'd imagine even for the technicians that reprogram them at the repair center. I didnt have much luck getting a connection made due to mu lack of JTAG knowledge and incorrect type of JTAG circuit(working on another though). i'm posting up the complete testpoints I spent MANY MANY countless hours and sleepless nights tracing so someone who has done this before can get a recovery procedure made to fix all bricked HTC-dreams. The reason I am doing all of this is not specifically for the Dream but because in the field of work im in, and the type of work I do I could benefit from it both for my personal phones and at work. I did research over the years but could never quite understand how JTAG is used until now. I took my spare fully working beater G1 and unsoldered the CPU with an IR Rework Station(T-870A) at home with the intentions of placing the CPU back on when done. took ALOT longer than I hoped and because of the fact that i had to hold test probes on the contact pads tight so I could flip the board and trace their also, it killed a couple of the pads so thats when I decided to say screw it, still have all the spares for my main Dream, now I can REALLY find the rest of the pins....and a few extras that might be used in the future to add features.

********Technical Notes*******

Their are 4 Mode control pins listed in the pictures.
Mode 3 is under the SIM slot, accessing requires de-soldering 4 points holding the SIM carrier to the board.
Mode 0 is NOT a testpoint, but a solder point were a resistor could go to ground. it is VERY hard to solder too directly.
Watchdog pin can simply be grounded with a resistor in place or with a needle through the shielding which would be ground. its a single solder point.
Primary JTAG is next to the LCD connector.


When you see were the pins for AUX are located you will see why I think thats not were the focus should be...their scattered in odd places, also have to remove the sim slot to access the last one which took forever to find.
Trackball has a hidden test point for the return clock as well, otherwise you need to solder directly to the connector on the main board.

Note: Return Clock is missing in the Picture for the AUX_JTAG connector...it is located at the top right testpoint just above the trackball pad, otherwise you will need to solder directly to the connector on main board.

if you need any more just let me know, if anyone wants to add to this please feel free.
Images are NOT MINE, they are the property of whomever took them, I only traced and added the labels, if their is a problem with using them let me know!





IF anyone wants to donate a bricked G1 board for experimenting or donate in general please feel welcome! email@ irenep@binarytechzone.com

Yea they were easy to trace, also over this past weekend I did manage to find the mode control pins and Watchdog pin, NAND write protection enable pin..basicallly searching for anything that might be helpful. I got the wires all soldered to the board also and the phone does recognize theirs something connected to the port but the data its returning dont seem like its correct. with nothing plugged in I get "no cable connected", after plugging the cable in i'm getting "Phone did not enter debug mode, reset?" This was before I found the mode pins using only what is posted so far and on a perfectly working phone in blue light mode which I dont think matter because it does the same thing with the phone off so long as a battery is in, does not work at all with no battery. I just went out and purchased a new camera for clearer pictures so pointing out the remaining pins is easier. I believe we may see a solution!

BTW i'm using OCD commander, plan on purchasing QMAT with JTAG this week since it tailors to HTC phones, once everything is figured out i'm sure we can use whats available free with a little modding.

@Scholbert, I thought about using those picures myself but didnt want to cause any copyright issues, I am going to put up a better picture anyhow. once thats up can you please remove the image so no one complains?

lbcoder said:

OpenOCD, OpenOCD, OpenOCD.

Did I mention OpenOCD?

http://openocd.berlios.de/web/

Would be great...

Click to expand...

Click to collapse

Hehe yea I didnt try that one yet since my Ubuntu install was killed by the latest update so I had to install windows first, gonna install Ubuntu sometime this week and try the tools available their.

scholbert said:

Ooops double post....

EDIT: You said you got already all the necessary pins.
Anyway, maybe this may help to verify:
http://xdaforums.com/showpost.php?p=4150161&postcount=300

Some time ago r3nrut put a very interesting package for download at his webpage. You may ask him for a link to download DreamJTAGcode.rar.
Included are professional scripts to set up the Dream with a PCI JTAG controller card named JT3710 from JTAG Technologies.
Though no one would afford such a hardware, you may find many useful files

Cheers,

scholbert

Click to expand...

Click to collapse

Yes he gave me the access to the files already, thats one of the reasons I need to installed windows first lol. I never used windows on the development machine but honestly the only thing that seems to hold the important data is the scripts which are human readable so I'm almost sure they could be adopted to OpenOCD or similar. I mean it even has the label on which pins need to be set high, low or what have you, ways to flash, erase, you name it its their. after seeing those files I figured we didnt need the JTAG document that were seeking. if everyone can figure it out on other devices with no documents..surely cant be too hard. i have soooo much more software to test on linux though. i have no plan after work so probably going to install Ubuntu 9.04 , turn off updates and then test OpenOCD. that seems really positive! i've got 3 different parallel Jtag adapters made for testing, Old cheapo, Buffered, and the third is a really complicated one that has all the possible connections needed(but more to go wrong hehe)

I could really use some help on how you normally get a phone into debug mode, or how can I do a simple test to read the Chip ID?
Also does anyone have a bricked board their willing to donate? i'm doing all of this on my primary functional board and would hate to kill i, also not sure if i'm actually in debug mode.

scholbert said:

Hi BinaryDroid!



May help out if i got my device....
Anyway it would be very nice idea to contact ViperBJK (author of QMAT).
He prooved JTAG access to Diamond already and good very deep knowledge of the device.

Debug mode should be also activated by hardware.
If nothing works out it would be a possibility is to ask one of the Hard-SPL creators. Disassembly of the SPL may give a hint of activating debug mode.

It's obvious, that the mode pins are important to be setup correctly.
The watchdog needs to be disabled (can't remember the pin), PS_HOLD would be required too.

The MSM chipset is bit more complex to access for debugging.
We need patience to gather the necessary informations.
MPU on Hermes was much easier i guess

EDIT:
From what i know so far, there would be mainly two methods on MSM to give access to the NAND chip:
1. Using TAP controller
This is a basic access and it is possible to toggle the pins in hardware, simple LPT adaptor should do the job.
2. Using ETM unit
This should be the mode used in QMAT.
Some binary is loaded into RAM (RAM needs to be initialised) and is used as a programming tool.
ETM gives control to the memory, but it's bit more complex to handle.

Anyway, the ARM units inside MSM chip have different ID's. Both should be accessible through primary port.
As far as in know MMU needs to be disabled while accessing the chip.

Regards,

scholbert

Click to expand...

Click to collapse

Ok well purchaed QMAt with JTAG last night since that tool has been written specifically for the job and will help with getting everything figured out, plus i need it for other projects. the QMAT setup does not mention the mode control pins being used at all for some reason. only the pins I already found which did not seem to work with my 5 wire unbuffered Wiggler. I have to do another test tonight with the complete complicated version that is suggested just until I get it working. once I know the connection works i'll adapt the simpler wiggler to do the same job so anyone trying to unbrick can build the simple $10 dollar adapter and build themselves. I aleady have a plan to make the soldering job to the jtag pins painless via modding the EM shield. at least now with QMAT purchased I can feel better asking him questions and getting correct answers. Primary JTAG is definitely the way to go. your correct also about the ps_hold pin attached to 10K resistor to the watchdog pin.