Messages

1

SIMpad forum / Unable To Jtag Swisscom

« on: March 22, 2006, 12:09:14 pm »

I jtagged 2 Swisscoms alright, no problem, used:

cable parallel 0x3bc DLC5
detect

Make sure which parallel port adress your host computer uses, in my case it is 0x3bc instead of the standard 0x378!

Digi

I finally did it, I bricked my Swisscom CL4.   

I re-flashed blupdater.img, to make sure it was that bootloader that I was using, and directly after that I uploaded the image Fred provided. Then I booted... Maybe that was stupid and I probably should have reset after uploading the bootloader. Anyway, the thing started booting, ran out of memory and halted. And now, aside from the recharching led and a brief flash of the backlight when it's turned on, it's dead.

I already had a JTAG cable and connectors soldered (~30cm, flatcable, 200Ohm resistors at JTAG connector), and I used both:
 - The JTAG openwince-jtag deb package (0.5.1) and openwince-include deb
 - Compiled JTAG 0.4 with the includes provided at openwince.sourceforge.net/includes

and tried:
jtag> cable ppdev /dev/{lp*,par*} DLC5
jtag> cable parallel 0x378 DLC5

Nothing, can't init the thing, tried it on an Ubuntu and Debian Sarge box. I suspect Sascha was right, perhaps the Swisscoms can't be JTAG'ed?

Just a warning
[div align=\"right\"][a href=\"index.php?act=findpost&pid=119631\"][{POST_SNAPBACK}][/a][/div]

2

SIMpad forum / Bost - Built-in Onboard Self Test

« on: March 17, 2006, 05:39:48 pm »

reflashed CE alright! So if you change the FabData, for some reason you have to reflash Windows afterwards...

Ooops, that was quoted too early, ran into the same problem later. Simple reset gave me permanent checkered pattern, hard reset permanent white screen. Trying to reflash the Windows image now...

Digi

I modified my "SLC" (upgraded Swisscom) runnig on the english 4.1 and wrote the original FabData (C420...) without any problems. I made a mistake once en route though and found the PBL replaced my modified BL because of that. So the PBL needs to be modified, too. For the simpadSL.rom look at offsets 0x24B4 and 0x1E620.

Digi

Tonight I managed to get the same corrupt bootloader message after re-loading the original Siemens 2.4 boot-loader with JTAG. So I'm pretty sure that the corrupt bootloader message is being caused by a corrupt flash EEPROM chip on this Simpad, and does not appear to be anything to do with the modified bootloader. That said, I would still recommend that only experienced JTAGers try the modified bootloader until it is proved to be 'safe'.

Since then I have successfully loaded my modified bootloader onto another Simpad, and this Simpad SL then successfully booted OK into WinCE 4.1 several times without incident.

I then went back and wrote the FabData string into this second Simpad using the BOST 'fs' (fabdata serial write) command. This was successful, but appeared to somehow corrupt the 4.1 WinCE image, as the next time the Simpad was reset I just got a continuous 'tartan reset' screen, with no sign of WinCE 4.1 appearing.

Ralph
[div align=\"right\"][a href=\"index.php?act=findpost&pid=118926\"][{POST_SNAPBACK}][/a][/div]

[div align=\"right\"][a href=\"index.php?act=findpost&pid=119059\"][{POST_SNAPBACK}][/a][/div]

[div align=\"right\"][a href=\"index.php?act=findpost&pid=119063\"][{POST_SNAPBACK}][/a][/div]

3

SIMpad forum / Bost - Built-in Onboard Self Test

« on: March 17, 2006, 04:48:25 pm »

Ooops, that was quoted too early, ran into the same problem later. Simple reset gave me permanent checkered pattern, hard reset permanent white screen. Trying to reflash the Windows image now...

Digi

I modified my "SLC" (upgraded Swisscom) runnig on the english 4.1 and wrote the original FabData (C420...) without any problems. I made a mistake once en route though and found the PBL replaced my modified BL because of that. So the PBL needs to be modified, too. For the simpadSL.rom look at offsets 0x24B4 and 0x1E620.

Digi

Tonight I managed to get the same corrupt bootloader message after re-loading the original Siemens 2.4 boot-loader with JTAG. So I'm pretty sure that the corrupt bootloader message is being caused by a corrupt flash EEPROM chip on this Simpad, and does not appear to be anything to do with the modified bootloader. That said, I would still recommend that only experienced JTAGers try the modified bootloader until it is proved to be 'safe'.

Since then I have successfully loaded my modified bootloader onto another Simpad, and this Simpad SL then successfully booted OK into WinCE 4.1 several times without incident.

I then went back and wrote the FabData string into this second Simpad using the BOST 'fs' (fabdata serial write) command. This was successful, but appeared to somehow corrupt the 4.1 WinCE image, as the next time the Simpad was reset I just got a continuous 'tartan reset' screen, with no sign of WinCE 4.1 appearing.

Ralph
[div align=\"right\"][a href=\"index.php?act=findpost&pid=118926\"][{POST_SNAPBACK}][/a][/div]

[div align=\"right\"][a href=\"index.php?act=findpost&pid=119059\"][{POST_SNAPBACK}][/a][/div]

4

SIMpad forum / Bost - Built-in Onboard Self Test

« on: March 17, 2006, 04:13:55 pm »

I modified my "SLC" (upgraded Swisscom) runnig on the english 4.1 and wrote the original FabData (C420...) without any problems. I made a mistake once en route though and found the PBL replaced my modified BL because of that. So the PBL needs to be modified, too. For the simpadSL.rom look at offsets 0x24B4 and 0x1E620.

Digi

Tonight I managed to get the same corrupt bootloader message after re-loading the original Siemens 2.4 boot-loader with JTAG. So I'm pretty sure that the corrupt bootloader message is being caused by a corrupt flash EEPROM chip on this Simpad, and does not appear to be anything to do with the modified bootloader. That said, I would still recommend that only experienced JTAGers try the modified bootloader until it is proved to be 'safe'.

Since then I have successfully loaded my modified bootloader onto another Simpad, and this Simpad SL then successfully booted OK into WinCE 4.1 several times without incident.

I then went back and wrote the FabData string into this second Simpad using the BOST 'fs' (fabdata serial write) command. This was successful, but appeared to somehow corrupt the 4.1 WinCE image, as the next time the Simpad was reset I just got a continuous 'tartan reset' screen, with no sign of WinCE 4.1 appearing.

Ralph
[div align=\"right\"][a href=\"index.php?act=findpost&pid=118926\"][{POST_SNAPBACK}][/a][/div]

5

SIMpad forum / Bost - Built-in Onboard Self Test

« on: March 15, 2006, 03:46:47 pm »

I go via blupdater.img, but that way I loose the FabData (which I can restore now, thanks ;-))

Sorry I have no experience of the older Simpads. Most of the BOST commands are for test purposes, and few if any actually modify the flash. Are you currently using JTAG for to get the bootloaders into the modified Simpads ?

Ralph
[div align=\"right\"][a href=\"index.php?act=findpost&pid=118752\"][{POST_SNAPBACK}][/a][/div]

6

SIMpad forum / Bost - Built-in Onboard Self Test

« on: March 15, 2006, 03:00:48 pm »

Is it really necessary to erase the bootstrap first? Can't you just load the modified bootloader with serload?

As for entering BOST other than that... I'm sure there is a back door, like a string of extended commands in a certain order or something like that. But on the other hand, your method is easy enough not to worry about that anymore.

Do you think, with the new commands at our disposal now, there is an easy way to
replace a PBL 1.4 with 2.4? I'm upgrading 16/32MB Simpads to 32/64, and this is always a pain in the butt.

Digi

8. Enter the extended command 'x'.

9. Type 'e' and then 'b' which should being up the menu to erase the existing boot image. Type 'y' to erase. Note that this does not appear to erase the master boot file from the 16-bit part of the Simpad's flash. When you reset the Simpad, it will re-load the boot image.

=====================
Monitor:
=====================
Boot from Flash   'f'
Boot from Net     'n'
Power Off         'o'
Erase PSM+Registry'p'
Exit              'q'
Erase Registry    'r'
Soft  Reset       's'
Print Fab-String  'w'
-> x

Extended Command
Enter hexcode to execute:eb
Erasing Bootstrap. Please Wait
[***************************************-]

Bootstrap Erased.
You will see me never again.
ByeBye !

10. Rest the Simpad again. The following test should appear:-

PBL V2.4 20.07.2001
Booting internal PBL image...
================================================
Siemens Switzerland Bootloader V2.4 20.07.2001
Running @206Mhz Processor ID 0x6901b118
Press ESC for monitor
Occupied Memory: [0x00004000-0x00008000],[0x01f00014-0x01f74b9c]
Flash Id 0x00000018 at virt adr 0x05000000 Size 0x01000000
No 32Bit Flash detected 0x00000000
FlashImage Checksum 0x05040014-0x05061ab0=0xffff7959 Image Update, Old Image unchecked
Fabdata Flash @0x05040014 Ram @0x01f21ab4 Init Fabdata... Done
[***************************************\]
Firmware Update Successfully Finished
Press Button to restart
Firmware Update Successfully Finished
Press Button to restart
Firmware Update Successfully Finished
Press Button to restart
etc.

11. Close the terminal session to release the serial port.

12. Use serial load programme to load in the modified bootloader.

C:\simpad> serload <filename>

13. When completed, reset the Simpad and you should now get the monitor option to enter BOST. Type 'h' for a list of the commands.

=====================
Monitor:
=====================
Boot from Flash   'f'
Boot from Net     'n'
Power Off         'o'
Erase PSM+Registry'p'
BOST              'b'
Erase Registry    'r'
Soft  Reset       's'
Print Fab-String  'w'
-> b

 Start BOST Siemens

BOST SIMPAD V1.01

etc...

e.g. memory monitor allows you to look as memory locations:-


z(b)yte,(w)ord,(l)ong :Adr: $00080000
 00080000 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080010 ff bf ff ff ff ff ff ff ff ff ff ff bf ff ff ff ................
 00080020 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080030 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080040 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080050 ff ff ff ff ff ff ff ff ff ff ff ff fe ff ff ff ................
 00080060 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080070 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080080 ff bf ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080090 ff ff ff ff ff ff ff ff fd ff ff ff df ff ff ff ................
 000800a0 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 000800b0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 000800c0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 000800d0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 000800e0 ff ff ff ff ff ff ff ff fe ff ff ff ff ff ff ff ................
 000800f0 ff ff ff ff ff ff ff ff ff ff ff ff ff ef ff ff ................

Some of the commands appear to be vaguely useful, especially if you have a Simpad that has an unresolved problem (like one of mine:-().

A similar 'modification' will probably also work for the Siemens 2.5.3 bootloader, although I've not tried this yet. Note that I've found that the original Siemens rev. 2.4 bootloader to be easier to use for loading images, as the 2.4 bootloader never has a problem 'seeing' the incoming serial data. I often have to do 20-30 resets in succession with the 2.5.3 loader before it 'sees' that there is a serload 'in progress'. I suspect that this has caused many people to believe that their Simpad is 'bricked' !

And for all I know you can enter BOST directly without modifying the bootloader. If anybody knows how to do this, then please do let us know...

Hope that somebody out there finds this useful...

Ralph
[div align=\"right\"][a href=\"index.php?act=findpost&pid=118748\"][{POST_SNAPBACK}][/a][/div]

7

SIMpad forum / Bost - Built-in Onboard Self Test

« on: March 15, 2006, 11:57:46 am »

These items look very familiar!!! I saw most of them looking at the bootloaders with a hex-editor, and thats what made me post the question with the extended commands. Veeery interesting!

Digi

The original Siemens bootlader contains the code for BOST - the Simpad's Built-in Onboard Self Test routines. BOST even has an option to programme the fabdata string(s) - in answer to Digi's question this is how it can be done !

Not sure if you can access BOST using the standard Siemens 2.4 or 2.5.3 bootloaders. I managed to get BOST running by simply changing one byte of the 2.4 bootloader code, and then reflashing the modified 2.4 bootloader into my Simpad.

Instructions to follow (first I want to have a look at the test commands:-)

Ralph

BOST Commands:
a,A b,B  : Connect Audio Path Mike => Speaker and Headset, exit with 'e'
a,A h,H or s,S : Audio Path Mike => Headset or Speaker, exit with 'e'
a,A t,T  : Short Tone burst to Speaker and Headset
b,B 1..6 : Control Backlight brightness
c,C i,I  : Init and Accesstest CODEC UCB1200 / UCB1300
c,C j,J 1..3 : Get CODEC AD1: BL_POWER, AD2: DC_IN_FUSED, AD3: ICHARGE
c,C k,K  : Get P and X,Y-Coordinates from Touch Panel
c,C l,L  : Loop Get P and X,Y-Coordinates, exit with 'e'
d,D a,A  : ATM commands to DECT Modul MD34
d,D b,B  : Set DIV_BAUD for UART1 (default = 0x01)
d,D c,C  : Connect MD34 to DECT Base Station BS3070
d,D d,D or i,I : DECT Module Power Down or Init DECT Modul MD34
d,D e,E  : Escape Command +++ to DECT Modul
d,D f,F  : Back to Factory settings DECT Modul
f,F d,D or r,R : Display Fabdata Magic or Read Fabdata buffer
f,F s,S  : Write Serial number to Fabdata buffer
f,F t,T or l,L : Write Test Date Ttt.mm.jj or Load Date Ltt.mm.jj
g,G b,B or w,W : Fill Background with Black or White
g,G h,H or v,V : Fill Color Pattern horizontal or vertical
g,G l,L or n,N : Write White or Black Lines
h,H,?    : Help text
i,I b,B  : Set DIV_BAUD for UART2 (default = 0x01)
i,I r,R or t,T : Receive or Transmit 20 Bytes from/to IrDA
l,L 2 or 0 : Set LED2 on or off
m,M a,A  : Set ACCESS to RAM (default = 0x32)
m,M b,B or e,E : Set RAM BEGIN-ADR or END-ADR (default = 0)
m,M d,D or m,M : RAM Data Test or RAM Memory Test
n,N c,C or g,G or s,S : Get CODEC or GPIO or CS3 DIN Port
n,N k,K or m,M : Alternate Output 32kHz or 3.6MHz at GPIO_27
o,O h,H or l,L : High or Low to CS3 Latch Pins
o,O i,I or o,O : In or Out in GPIO Pin Direction Register (GPDR)
o,O c,C or s,S : Clear or Set GPIO Output Register (GPCR or GPSR)
p,P 0 or 3 or 5 : PCMCIA Vcc/Vpp to 0V or 3.3V or 5V
p,P a,A or s,S : Set ACCESS Variable or DOUT Variable
p,P d,D or m,M : PCMCIA RAM Data Test or PCMCIA Memory Test
p,P r,R or w,W : Read DIN from or write DOUT to PCMCIA Address
r,R      : Soft Reset
s,S a,A or s,S or i,I : Smart Card Answer to Reset (ATR) or Init TDA8007
u,U d,D or e,E : Disable or Enable USB Device Controller
u,U s,S  : Get UDC Status Register
v,V      : BOST Version
x,X      : Power Off
y,Y      : FLASH Burst Test
z,Z      : Memory Dump
(Textlen 2297 Bytes)
[div align=\"right\"][a href=\"index.php?act=findpost&pid=118703\"][{POST_SNAPBACK}][/a][/div]

8

SIMpad forum / Erase Flash Chip Before Jtaging

« on: March 12, 2006, 10:39:00 am »

Why don't you create a file with 16 Mbytes of 0x00 and flashmem it in one step?

I suppose flashmem 0 16mbfile erases the first bank, while flashmem 0x1000000 16mbfile erases the second bank. Haven't tried it, though...

Digi

There are times when even re-loading the Siemens 2.4 SL bootloader with the JTAG utility does not appear to recover a 'bricked' Simpad. For example loading the Siemens 2.4 CL bootloader into a Simpad SL appears to be a good way of 'bricking' your Simpad ! (I tried this just to see what happens).

I found that JTAG (version 2.4) supports a scripting option. So I created a file called 'null' with the contents of just 4 bytes (0x00 0x00 0x00 0x00). Then used the following script file to write this data into every block of the first 16-bit flash chip. During the flash process, all EEprom flash blocks are first erased, so the script below effectively erases the 16-bit 'accessible' flash chip that is used to hold the boot-loader.

Command is :-

jtag> script
Q. Does anybody know a good way of completely erasing the 2nd flash ROM chip in the Simpad ?

My experience is that the contents of certain locations in the flash chips can cause all sorts of different failure modes when going from WinCE-Linux, or back from Linux->WinCE.

Ralph

**********************
flashmem 0x00000000 null
flashmem 0x00020000 null
flashmem 0x00040000 null
flashmem 0x00060000 null
flashmem 0x00080000 null
flashmem 0x000a0000 null
flashmem 0x000c0000 null
flashmem 0x000e0000 null
flashmem 0x00100000 null
flashmem 0x00120000 null
flashmem 0x00140000 null
flashmem 0x00160000 null
flashmem 0x00180000 null
flashmem 0x001a0000 null
flashmem 0x001c0000 null
flashmem 0x001e0000 null
flashmem 0x00200000 null
flashmem 0x00220000 null
flashmem 0x00240000 null
flashmem 0x00260000 null
flashmem 0x00280000 null
flashmem 0x002a0000 null
flashmem 0x002c0000 null
flashmem 0x002e0000 null
flashmem 0x00300000 null
flashmem 0x00320000 null
flashmem 0x00340000 null
flashmem 0x00360000 null
flashmem 0x00380000 null
flashmem 0x003a0000 null
flashmem 0x003c0000 null
flashmem 0x003e0000 null
flashmem 0x00400000 null
flashmem 0x00420000 null
flashmem 0x00440000 null
flashmem 0x00460000 null
flashmem 0x00480000 null
flashmem 0x004a0000 null
flashmem 0x004c0000 null
flashmem 0x004e0000 null
flashmem 0x00500000 null
flashmem 0x00520000 null
flashmem 0x00540000 null
flashmem 0x00560000 null
flashmem 0x00580000 null
flashmem 0x005a0000 null
flashmem 0x005c0000 null
flashmem 0x005e0000 null
flashmem 0x00600000 null
flashmem 0x00620000 null
flashmem 0x00640000 null
flashmem 0x00660000 null
flashmem 0x00680000 null
flashmem 0x006a0000 null
flashmem 0x006c0000 null
flashmem 0x006e0000 null
flashmem 0x00700000 null
flashmem 0x00720000 null
flashmem 0x00740000 null
flashmem 0x00760000 null
flashmem 0x00780000 null
flashmem 0x007a0000 null
flashmem 0x007c0000 null
flashmem 0x007e0000 null
flashmem 0x00800000 null
flashmem 0x00820000 null
flashmem 0x00840000 null
flashmem 0x00860000 null
flashmem 0x00880000 null
flashmem 0x008a0000 null
flashmem 0x008c0000 null
flashmem 0x008e0000 null
flashmem 0x00900000 null
flashmem 0x00920000 null
flashmem 0x00940000 null
flashmem 0x00960000 null
flashmem 0x00980000 null
flashmem 0x009a0000 null
flashmem 0x009c0000 null
flashmem 0x009e0000 null
flashmem 0x00a00000 null
flashmem 0x00a20000 null
flashmem 0x00a40000 null
flashmem 0x00a60000 null
flashmem 0x00a80000 null
flashmem 0x00aa0000 null
flashmem 0x00ac0000 null
flashmem 0x00ae0000 null
flashmem 0x00b00000 null
flashmem 0x00b20000 null
flashmem 0x00b40000 null
flashmem 0x00b60000 null
flashmem 0x00b80000 null
flashmem 0x00ba0000 null
flashmem 0x00bc0000 null
flashmem 0x00be0000 null
flashmem 0x00c00000 null
flashmem 0x00c20000 null
flashmem 0x00c40000 null
flashmem 0x00c60000 null
flashmem 0x00c80000 null
flashmem 0x00ca0000 null
flashmem 0x00cc0000 null
flashmem 0x00ce0000 null
flashmem 0x00d00000 null
flashmem 0x00d20000 null
flashmem 0x00d40000 null
flashmem 0x00d60000 null
flashmem 0x00d80000 null
flashmem 0x00da0000 null
flashmem 0x00dc0000 null
flashmem 0x00de0000 null
flashmem 0x00e00000 null
flashmem 0x00e20000 null
flashmem 0x00e40000 null
flashmem 0x00e60000 null
flashmem 0x00e80000 null
flashmem 0x00ea0000 null
flashmem 0x00ec0000 null
flashmem 0x00ee0000 null
flashmem 0x00e00000 null
flashmem 0x00f20000 null
flashmem 0x00f40000 null
flashmem 0x00f60000 null
flashmem 0x00f80000 null
flashmem 0x00fa0000 null
flashmem 0x00fc0000 null
flashmem 0x00fe0000 null
flashmem 0 simpadSL.rom
**********************
[div align=\"right\"][a href=\"index.php?act=findpost&pid=118166\"][{POST_SNAPBACK}][/a][/div]

9

SIMpad forum / Siemens Bootloader Extended Commands

« on: March 10, 2006, 04:54:07 pm »

No, putting the FabData back would just be cosmetics. Which 4.1 image are you having problems with? I used sl4_winCEnet41_ENG with 27.255.299 bytes without any problems.

Digi

No I've not found a way of getting the FabData reloaded yet. However I guess that you might be able to use the flashmem JTAG command to put the correct string back into the flash ?? However JTAG can only access the first flash IC, presumably in 16-bit mode. I guess that the FabData string is probably 32-bit aligned ?? (I'm just guessing here as I am not sure how the memory map of the Simpad's flash looks in detail).

Perhaps loading WinCE3.0 initialises the FabData string ?? (I'll try and see what happens). Siemens must had dome this somehow ?

Is getting the FabData string re-entered important ?

Incidentally the 'x' commands E0 and E1 appear to work differently with the original Siemens 2.4 bootloader, to the modified (linux/WinCE) 2.5.3 bootloader. Using the E0 and E1 commands allows you to delete different areas of the flash from the 2.4 bootlader (similar to the 'y' command with the 2.5.3 bootloader).

When I get my Simpad working with WinCE 4.1 (I've been working on this for almost 2 weeks now!), I will write up all of my experiences, and suggestions. I've had about 20 different lock up states all with different symptoms. Usually these lock-ups stop the bootladers from working correctly. However all these states appear to be caused by different things in the flash. Erasing all 128 blocks in the first flash chip using a JTAG script, and then re-loading the 2.4 bootloader using the JTAG command "flashmem 0 simpadSL.rom" appears to always allow the 2.4 boot-loaders to be loaded with serload, and then the primary 2.5.3 bootloader to be loaded OK. Don't think that I've ever managed to load the alternative 2.5.3 bootloader though ??

Ralph

10

SIMpad forum / Siemens Bootloader Extended Commands

« on: March 08, 2006, 01:02:46 pm »

Do you know of a way to put the FabData back in once it has been deleted?

Digi

11

SIMpad forum / Siemens Bootloader Extended Commands

« on: March 04, 2006, 02:51:17 pm »

Hi all,

does anybody know any more extended commands (done by typing 'X', followed by a hex value between 00 and ff) than the ones I found so far:

01 raises CPU frequency
ff lowers it
e0 erases flash bank 0
e1 erases flash bank 1
eb erases bootstrap (whatever that is, but it includes the FabData)

Digi

12

SIMpad forum / No Serial Download Request

« on: March 04, 2006, 02:44:51 pm »

ronaldw,

type the serload command and then hit ENTER and reset the Simpad at the same time, not ENTER first and then reset. Sometimes helps.

Digi

13

SIMpad forum / Pcmcia Connector

« on: March 04, 2006, 02:35:41 pm »

Hi garbo,

I have the necessary parts in stock (PCMCIA connector, bus drivers, power controller, some Rs and Cs), I'd sell them for €40 plus shipping. But beware, as Berend said, the soldering is extremely tricky!

Digi