Hi All
I recently bricked my Acer A210 and it's running in APX mode. In a effort to bring it back to life i have been researching the jtag setup.
As you can see from this image, on the rigth hand side is JDBUG1, with pin 1 mark at the top.
Now this is a A510 in the image, but the same 10 pin connect is on my A210 and possibly on the A700,
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Now using many different tegra3 manuals and dev board guides i've reversed the jtag connector, well mostly, I've some more to confirm but i though i would put this out there in case any one has any thing to add, i will also upload as much info as i have and the pdf in case any one want to confirm my research,
Hopefully we can fix without $$$$ hardware.
I have a o'scope (30 years old crt based) ,arduino, buspirate, Open Source logic sniffer.
The latter two from dangerous prototypes, the main one i will use is the bus pirate in jtag mode.
I have already connected the buspirate up but no results i could rely on so i went back to research, here is what i've turned up ,
Code:
1 1.8v Tegra System Voltage
2 TRST (on A210 a 0R resistor is missing or 'un-stuffed' or not 'stuffed', see info about tying to gnd for CPU access )
3 10K to +v 1.8v for TDI
4 10K to +v 1.8v for TMS
5 100K to GND for TCK
6 10K to GND for RTCK (Return clock , see [URL="http://en.wikipedia.org/wiki/Joint_Test_Action_Group"]RTCK wiki[/URL] )
7 TDO (direct into CPU )
8 HOT_RESET (1.8v)
9 ON_KEY# (+5v )
10 GND
Now this information has been gleamed from many sources.
please see attached images for now, on the A210 the tracks are more exposed but I think its safe to assum the debug connector pin outs would be the same for the 3 devices,
EDIT** Ive found the A510 Schematic Online A510 Schematic - See Page 7 for JTAG
darkspr1te
<place holder for additional files>
Various Tegra(3) Files
Tegra Files / Manuals / PDFs ETC
Very interesting stuff, unfortunately my knowledge is not sufficient to contribute. But i'll definitely follow this topic, hope you can fix it.
Always an awesome moment went you succeeded "DIY" without spending big bucks.
herogjan said:
Very interesting stuff, unfortunately my knowledge is not sufficient to contribute. But i'll definitely follow this topic, hope you can fix it.
Always an awesome moment went you succeeded "DIY" without spending big bucks.
Click to expand...
Click to collapse
Yes, when We have that eureka moment and it works it's a great feeling, sadly I am not having that moment yet with the Acer. But I wont give up.
I am taking a break from the actual JTAG hacking part for Xmas and just to give myself a break from IT, I will return to the project in the new year.
Darkspr1te
What can we do with JTAG on our Acer Axxx ?
Envoyé de mon GT-I9505 en utilisant Tapatalk
imtheyoyo said:
What can we do with JTAG on our Acer Axxx ?
Envoyé de mon GT-I9505 en utilisant Tapatalk
Click to expand...
Click to collapse
We will be able to turn it into the most powerful tablet and take over the world *evil laugh*. Or we could recover our bricked tablets that are in apx mode like he said in post 1.
Sent from my A701 using Tapatalk
Hi All,
I've made some progress
Code:
> scan_chain
TapName Enabled IdCode Expected IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
0 tegra3.arm Y 0x330173d7 0x330173d7 2 0x01 0x01
> jtag init
JTAG tap: tegra3.arm tap/device found: 0x330173d7 (mfg: 0x1eb, part: 0x3017, ver: 0x3)
> halt
Halt timed out, wake up GDB.
timed out while waiting for target halted
in procedure 'halt'
Cant get cpu to halt, could be due to many things, am i taking to the right core? it the jtag instructions i am sending the right ones for the arm/corex cores
right now, I dont know, most users dont document building the jtag instruction up so it's going to be new for me.
darkspr1te
Hi All,
I've made some progress
Code:
> scan_chain
TapName Enabled IdCode Expected IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
0 tegra3.arm Y 0x330173d7 0x330173d7 2 0x01 0x01
> jtag init
JTAG tap: tegra3.arm tap/device found: 0x330173d7 (mfg: 0x1eb, part: 0x3017, ver: 0x3)
> halt
Halt timed out, wake up GDB.
timed out while waiting for target halted
in procedure 'halt'
Cant get cpu to halt, could be due to many things, am i taking to the right core? it the jtag instructions i am sending the right ones for the arm/corex cores
right now, I dont know, most users dont document building the jtag instruction up so it's going to be new for me.
EDIT** Seems what I am looking at here is the JTAG Route controller (similar to TI's ICEPICK router controller) but as I have not information yet on how to shift the router controller I am lost, Anyone got any input ?
for the ICEPICK it does the following commands to setup the router controller
Code:
# Utilities for TI ICEpick-C ... used in DaVinci, OMAP3, and more.
# jrc == TAP name for the ICEpick
# port == a port number, 0..15
proc icepick_c_tapenable {jrc port} {
# NOTE: it's important not to enter RUN/IDLE state until
# done sending these instructions and data to the ICEpick.
# And never to enter RESET, which will disable the TAPs.
# select router
irscan $jrc 7 -endstate IRPAUSE
drscan $jrc 8 0x89 -endstate DRPAUSE
# set ip control
irscan $jrc 2 -endstate IRPAUSE
drscan $jrc 32 [expr 0xa0002108 + ($port << 24)] -endstate DRPAUSE
irscan $jrc 0x3F -endstate RUN/IDLE
runtest 10
}
Now i dont know if the Tegra3 has it's own route controller an how it's programmed/setup
This is my first time into JTAG so it's a massive learning curve,
I am assuming that once i send the tegra3 the correct IRSCAN/DRSCAN jtag codes it will setup access in to the device further.
EDIT **
Some additional information I am still trying to understand/process, it's from tegra2 but one could assume it's valid for tegra3 as a lot of what i've turned up has been the case. This excludes security
based information
Code:
Note that in the circuit in Figure 24, there is an optional resistor on JTAG_TRST_N. For normal JTAG operation, this resistor
should not be present. The JTAG_TRST_N pin on the Tegra 250 selects whether the JTAG interface is to be used for
communicating with the Tegra 250 CPU complex, or for Test/Scan purposes. When JTAG_TRST_N is pulled low, the JTAG
interface is enabled for access to the CPU complex. When high, it is in Test/Scan mode.
When used in the normal operating mode to access the internal CPUs, in order to reset the Tegra 250 JTAG block, a reset
command is used rather than toggling the JTAG_TRST_N pin.
darkspr1te
imtheyoyo said:
What can we do with JTAG on our Acer Axxx ?
Envoyé de mon GT-I9505 en utilisant Tapatalk
Click to expand...
Click to collapse
Right now, with current public information, Nothing. But Who knows what it may turn up, access to SBK maybe? I dont know, I am not that level of expert, but it may turn up some interesting stuff. it may allow users to debrick devices (hopefully)
Let me start todays post off with a small request,
if anyone knows of a guide to using openocd/buspirate to investigate a jtag connection that is totally unknown then please post a link here,
I have read billions (well maybe dozens) of ducuments talking about boundry scans, config files, jtag route controllers but it seems almost none show you, they all are the same, they talk about in a vague way that your already ment to know what they are on about. Gah.
Anyway, i've ran some irscan/drscan commands and i've really got no where, i am confirming that keeping TRSRT high gives you the IDCODE of 0x330173d7 and if low then it errors out and you get all zeros,
ive found some tegra2 setup files for a jtag system called BDI-x0000 and they include a lot of info on the registers which are similar if not the same as tegra3, but the IDCODE is different and it's a different language to openocd, again plenty of documents hint at it being a simple conversion but i dont see it, maybe a case of 'cant see the wood for the trees' but it's not for noobs, which drives me a little insane,
Has anyone seen any docs of nexus 7 jtag ? i mean it's operation/setup not pin outs, i've got copies of that info but not actual irscan/drscan codes or anything.
Well I hope someone can provide a little input.
darkspr1te
Let me start todays post off with a small request,
if anyone knows of a guide to using openocd/buspirate to investigate a jtag connection that is totally unknown then please post a link here,
I have read billions (well maybe dozens) of ducuments talking about boundry scans, config files, jtag route controllers but it seems almost none show you, they all are the same, they talk about in a vague way that your already ment to know what they are on about. Gah.
Anyway, i've ran some irscan/drscan commands and i've really got no where, i am confirming that keeping TRSRT low gives you the IDCODE of 0x330173d7 and if high then it errors out and you get all zeros,
ive found some tegra2 setup files for a jtag system called BDI-x0000 and they include a lot of info on the registers which are similar if not the same as tegra3, but the IDCODE is different and it's a different language to openocd, again plenty of documents hint at it being a simple conversion but i dont see it, maybe a case of 'cant see the wood for the trees' but it's not for noobs, which drives me a little insane,
Has anyone seen any docs of nexus 7 jtag ? i mean it's operation/setup not pin outs, i've got copies of that info but not actual irscan/drscan codes or anything.
Well I hope someone can provide a little input.
darkspr1te
Click to expand...
Click to collapse
And i am double posting again.
After trying to deal with Acer to resolve the APX issue this is what hapnned
Code:
Sunil: Hi, my name is Sunil. How may I help you?
darkspr1te: hello
Sunil: Hello, darkspr1te.
darkspr1te: Hi Sunil, happy new year
darkspr1te: I have a Acer A210 that stopped booting, windows detects it as a Nvidia APX device
Sunil: Thank you and same to you.
Sunil: I am sorry to know about the issue.
Sunil: Do not worry. I will do my best to resolve the issue.
Sunil: I have the SNID number as 23203532115, is it correct?
darkspr1te: One sec let me double check
darkspr1te: yes that is correct
Sunil: Thank you for the confirmation.
darkspr1te: so what is the way forward ?
Sunil: In order to help you in a better way, please let me know the name of the country you reside now.
Sunil: Sure, I will help you in this regard.
Sunil: In order to help you in a better way, please let me know the name of the country you reside now.
darkspr1te: i am currently in Zambia, Ive tried for the past two weeks to get support from South Africa which is the closest agent to where I am, please dont tell me that i can only deal with them, they dont answer emails or live chat (i have screen shots and email logs to show this)
Sunil: I am sorry for that.
darkspr1te: so what is the way forward ?
Sunil: Your chat has come through to the Acer UK Support; hence, we are unable to assist with your enquiry.
We are able to assist UK customers with technical queries for products covered under warranty.
Sunil: Please click on the link below and select your country. You will then be directed to your local Acer website with the Service and Support section, containing contact details for your local Acer service centre.
Here is the weblink: http://www.acer.com/worldwide/support/
darkspr1te: Suni, ive tried that link, i've got nowhere, please I am begging you to help
Sunil: I completely understand your concern, darkspr1te. We are able to assist UK customers with technical queries for products covered under warranty.
darkspr1te: I am a uk customer, I carry a british passport, I can trace my family back 150 years in uk and I purchased the device in UK. what more do you need?
darkspr1te: I am only out of the country on work.
Sunil: darkspr1te, from our records, I see the unit is purchased in Zambia. We cannot pull any information of the unit.
darkspr1te: Thats impossible, I personally purchased it in Portsmouth , we have NO ACER agent or reseller here in Zambia
Sunil: I am sorry for that.
darkspr1te: Please I am begging you, just give me My Secure Boot key for the device that I purchased and own, i can deal with the rest my self
Sunil: Please be online for 2 minutes while I check the information on your query.
darkspr1te: thansk you
Sunil: Thank you.
Sunil: Thank you for staying online. I appreciate your patience.
Sunil: darkspr1te, please let me know the exact issue with the unit to assist you in a better way.
darkspr1te: The unit does not boot, it is only detectedd in windows as Nvidia APX device
Sunil: Alright.
darkspr1te: prior to that it rebooted while watching a movie and in the top left it said fastboot error
Sunil: Okay.
Sunil: darkspr1te, I have checked my records, We cannot come to a conclusion regarding the fault without the unit being physically diagnosed by the technician. I request you to contact South Africa Acer support for more information.
darkspr1te: Then can you please provide me with my Secure Boot key for the device so I can resolve the issue myself.
Sunil: I am so sorry, We do not have such information available.
Sunil: Is there anything else I may help you with?
darkspr1te: actually thats not true,I have a contact in uk who used to work with acer support and he said you can send a BCT config file which is keyed with my boot key and only usable on my device, sadly he left acer otherwise it would be him i would be talking to
Sunil: darkspr1te, If we had the options, we would have definitely helped you. we hope you can understand the situation.
darkspr1te: using the BCT file and nvidia NVFLASH i can fix my device in seconds
Sunil: We do not have such information available.
Sunil: I request you to contact South Africa Acer support for more information.
darkspr1te: then who does
Sunil: Is there anything else I may help you with?
darkspr1te: south africa HAVE NOT responded at all
Sunil: We are able to assist UK customers who reside in UK with technical queries for products covered under warranty.
darkspr1te: fine
Sunil: I request you to contact South Africa Acer support for more information.
Sunil: Is there anything else I may help you with?
darkspr1te: you're joking right ?
Sunil: darkspr1te, If we had the options, we would have definitely helped you. we hope you can understand the situation.
darkspr1te: No I dont understand, I dont know why I have a device that I cannot use because Acer is withholding the key to my own device
darkspr1te: you i had a nexus 7 with same tegra3 cpu and they gave me the secure key within a day of me reqquesting it
Sunil: darkspr1te, you have contacted Acer UK hardware technical support department and we do not have such information available with us. I request you to contact South Africa Acer support for more information.
Sunil: It was a pleasure working with you. Thank you for contacting Acer live chat. Have a nice day.
I will no longer recomend acer devices, I am pulling my github files for the acer as I dont want to be responsable for bricking someone else's device either. I just hope that someone at acer reads this and knows how useless chat/email support is.
darkspr1te
Another support agent in south africa, who after 3 hours of contant hello's finally answered.
Code:
Jacques: Hi, my name is Jacques. How may I help you?
darkspr1te: hello
darkspr1te: hello, is there anyone there
Jacques: yes can we help you?
darkspr1te: i have a acer A210 and it's not booting , i was watching a video and it rebooted, in the top left it said fastboot error and now windows only detects Nvidia APX device
Jacques: you will have to restore the operating system
darkspr1te: ok,
darkspr1te: how do i do that ?
Jacques: you can send it in for repair so we can reflash the device
darkspr1te: Jacques, I am currently not in a situation where that can be done, please I am begging you to assist me with my secure boot key so i can do it, I've sent two tablets to south africa in the past, first one stolen, second one came back still broken ( at the cost of the tablet), i cant afford the third.
darkspr1te: i know using nvflash and the BCT file thats linked to my secure boot key will fix the device
Jacques: we do not supply the files available for download on any of our sites , so to get assistance you will have to send it for repairs
darkspr1te: but I cant, please, i am begging.
darkspr1te: hello, are you still there
Jacques: I'm here
Jacques: unfortunately nothing more I can assist with as the files you looking for is not available for downbload
darkspr1te: Please Jacques, I am only asking for the key to my own device,
darkspr1te: i can give you the URL for acer Tiawan where acer support perrsonell get the key from
darkspr1te: but as i dont have a acer login account i cant get the key for my device
darkspr1te: if i had the key i can just use NVFLASH to fix in seconds
darkspr1te: all you need is the CPUID
darkspr1te: which is androidboot.serialno=015d256487300205
darkspr1te: ?
darkspr1te: are you still there
darkspr1te: hello
darkspr1te: hello
darkspr1te: hello
darkspr1te: anyone there ?
That was support in south africa
darkspr1te
Hi All,
i recently picked up this project again, I've got some new doc's and info but as yet no solution.
My current thinking is to attack the emmc, to which ive produced some photo doc's to upload.
In the first picture is the underneath of the emmc,
Red is CLK or clock
Yellow is CMD or command
light blue is VSS @ 1.8v
red border shows the outline of the emmc chip on the otherside of the pcb. see the picture called blend for a blended view of the same.
My current thinking is the emmc has failed or locked up, why ? well on the clock and cmd lines i get a nice clear trace on my logic sniffer and scope,
Now looking at the the picture called marked, look in the bottom right of the red box, those resistors more or less lighn up with the DAT0/7 pins but i do not get any signal at all from them with the scope. The system outputs CMD's down the CMD line to the emmc at power on, that and the clock can clearly be seen on the scope.
I have also referred to the a510 schema and emmc pins are ment to be the following on the T30 cpu
Dat0 - B6 (z = floating)
CLK - F8 z
CMD - H10 z
i have hunted around this area with the scope and found nothing.
from the SMARC sAT30 manual, it says the following for the EMMC
Either A:
DAT0 - K1 (pu = pull up)
CMD -N6 pu
CLK - M6 pu
or B:
DAT0 L27
CMD - J29
CLK - G30
both location have not shown either clk/cmd or a response from DAT0. Still more research to do.
last time i buy a tegra i can tell you. damn locked up piece of sh!t.
darkspr1te
Edit: I forgot to add the specs for the EMMC
Samsung KLMAG2GE4A
PDF attached
Futher reading ont this emmc at ps3wiki http://www.psdevwiki.com/ps3/KLMAG2GE4A-A001
More pictures Of EMMC
Final group of pictures
WTF! That eMMC is really blank! Do you have any info on that? Can you do anything to it's surface to see what it says?
Also, on the OP schematics there's a "UART debug" port. What's on that?
I am having a similar issue using JTAG on a Tegra 2 device.
Would it possible for you to post the Tegra 2 documentation you have?
darkspr1te said:
EDIT **
Some additional information I am still trying to understand/process, it's from tegra2 but one could assume it's valid for tegra3 as a lot of what i've turned up has been the case. This excludes security
based information
Code:
Note that in the circuit in Figure 24, there is an optional resistor on JTAG_TRST_N. For normal JTAG operation, this resistor
should not be present. The JTAG_TRST_N pin on the Tegra 250 selects whether the JTAG interface is to be used for
communicating with the Tegra 250 CPU complex, or for Test/Scan purposes. When JTAG_TRST_N is pulled low, the JTAG
interface is enabled for access to the CPU complex. When high, it is in Test/Scan mode.
When used in the normal operating mode to access the internal CPUs, in order to reset the Tegra 250 JTAG block, a reset
command is used rather than toggling the JTAG_TRST_N pin.
darkspr1te
Click to expand...
Click to collapse
Tom_Perman said:
I am having a similar issue using JTAG on a Tegra 2 device.
Would it possible for you to post the Tegra 2 documentation you have?
Click to expand...
Click to collapse
I can tell that you will find the most useful docs via baidu
also search for terga2 and terga3, some docs were misspelled.
I will post any documentation i've created if I can find it, i've recently moved a lot of data to archive that i was not working on, the acer stuff was among it .
How far along are you jtag wise? any comms with the chips ?
darkspr1te
Tom_Perman said:
I am having a similar issue using JTAG on a Tegra 2 device.
Would it possible for you to post the Tegra 2 documentation you have?
Click to expand...
Click to collapse
Do you have a photo with your JTAG connection? which acer is it?
hello,
i bought the easycap viewer android application,
and installed it on my devices
The easycap viewer needs an easycap frame grabber , connected via usb to the device and connected to a camera (via bnc or s-video or rca connector)
the devices i have are these:
- Acer iconia tab a500 (tegra 2 , android 4.03)
- Created N7 (china phablet, mt6592, android 4.4.2)
- Xiaomi m2s (qualcomm snapdragon, miui v5)
The application does work flawlessly with the Xiaomi m2s,
instead:
on the Acer, when i start the app, the screen become black, and the app is not responding
on the Created N7,, the appl starts , but when i connect the camera, i cannot see the video coming from the camera
I dont understand why on these devices the app does not work,
and need help to understand what is the cause of the problem.
The app includes an option to send log report to the developer
(autodroid), i sent it, but autodroid told me to try with a powered hub, but this did not help...now they are working on other project, so they told me they cannot help
Could you please help me to find the cause of the problems?
By the way, on the Acer i cannot send the report, because the appl is not responding:
so i enabled the logcat, and i was able to see in it that the appl is hanging when it tries to load the streaming library...
Could you help me?
I can send you all the data you need to debug the appl..
or, if not possible to fix it, could you suggest me an alternative frame grabber application/usb dongle that can work with my devices?
PS for the forum moderators:
this question was submitted also on XDA assist,
but there only a user answered to me.
The answer was absolutely general and not satisfactory,
then the thread was closed by the same user.
So i opened this new thread.
Please keep it open,
so that i can get also other opinions from other users.
Thanks.
Thank you!!
Lodovico