HP iPaq H5450 JTAG Howto

Okay, this one is really old. I’m putting it up here for reference. Who knows – maybe someone is still interested in it.


Okay, you managed to shoot your bootloader and turn your iPaq into an expensive, yet stylish, paperweight. Great. So you are probably quite desperate now, just as I was when it happened to me the first time. But fear not! I’m here to tell you what I did to reanimate my iPaq.

This Document describes how to build a JATG connector into an iPaq H5450. The connector I built is accessible through the battery compartment, so I don’t have to disassemble my iPaq again if I need to reflash the bootloader.

It is a little bit easier to build a connector that you use once, and then desolder the wires again, before you reassemble the iPaq. This method has the advantage that you don’t need to cut any holes into your iPaq’s case, but you have to go through the whole procedure again, every time you need a JTAG connection. (Which, hopefully, won’t be often, but…) Decide for youself what you want. I recommend the permanent connector.

Warning

This HOWTO involves soldering on really small points inside a sensitive electronic device. You can make things even worse if you mess up. Don’t do this if you don’t feel comfortable with it! Better ask someone who does, so you can blame him if it does not work.

What you need

  • A parallel cable with a male DB25 plug
  • 4 or 5 100 Ohm resistors
  • Some kind of connector (see below)
  • A few thin wires, I took them from an ATA66 cable
  • A soldering iron with a very small tip
  • SMD soldering lead (i.e. 0.5 mm diameter)
  • Some de-soldering stripe, in case you accidentally short some pins.
  • A Torx screwdriver (size 6)
  • jtag-tools (version 0.4)
  • All the other stuff that I forgot to mention :-)

Part 1 – The JTAG interface for your PC

Build this:

interface-schematics

You don’t need the VCC and TRST pins on the interface: The TRST is already pulled high on the iPaq, that’s why there is no (need for a) TRST pin on the mainboard. But you might want to build a generic JTAG cable that works with other devices too, even if they actually have a TRST pin.

Since this is only a passive cable, make sure that it is not too long. 75cm worked for me.

I was told that this kind of cable may not work with all parallel ports out there, so it is probably better (but a little more work) to build an active cable. You can find links to schematics for various types of cables on the JTAG-Tools website. However, the passive cable worked fine for me and is probably sufficient for most people.

The one I built looks like this:

interface

Install jtag-tools on your PC. I had problems with version 0.5.1, but 0.4 worked well.

Part 2 – The difficult part

Open your iPaq. You only need to unscrew the 4 case screws; the two at the bottom just hold the button board in place. Carefully remove the main board from the button board. You do not need to disconnect the screen. The JTAG pins can be found on the connector between the mainboard and the button board:

connector-pinout

Since it is quite difficult (at least for me) to solder the wires directly to the connector pins, I traced
three of the four JTAG-signals to corresponding test points on the main board. The fourth one can be found at one edge of an SMD resistor, as you can see in the picture below. (Click on the image to get a bigger version.)

mainboard

The connector inside the iPaq needs to be really flat. It must not be thicker than the plastic part of the battery connector on the mainboard, or it will interfere with the battery later. I used 5 pins from a pin header and removed some of the plastic with a file so that it was less than half as thick afterwards.

You may want to use a 6th pin for VCC, but I did not since I have a nice adapter that allows me to connect the iPaq’s power supply without using the cradle. Maybe I’ll add a VCC pin someday, anyway. :-)

The short pins are long enough to get a reliable connection, so I cut off the long pins and left just enough of them to solder the wires to:

connector_inside   wires1

Remember to put a bit of isolating duct tape on the mainboard, so that the connector only connects what you want it to.

Wrap the wires closely around the edge of the mainboard, so that they don’t interfere with the stylus later.

wires2

Put the wires on the mainboard, so that they end up at the soldering points, and shorten them accordingly. There really isn’t much room for air inside the iPaq, so make sure the wires don’t run over any SMD elements but between them, if possible.

Okay, now you need to solder the wires to the corresponding points, namely TDO, TDI, TMS, TCK and GND.

Hint: Apply a little(!) bit of soldering lead to the ends of the wires and to the points on the mainboard first.

wires5

Part 3 – Reflashing the Bootloader

We need to make the iPaq believe that the battery is present, or it will refuse to work. So you have to short the two leftmost pins of the battery connector on the mainboard, and hold down the battery switch with a piece of duct tape.

Connect the power supply to the Ipaq. You need to connect the mainboard to the button board to do this, or you can use GND and the VCC pin directly.

Connect the JTAG cable to your PC and the iPaq.

flash_open

Run the jtag-tools program on your PC:

jtag

Tell it which kind of cable you use:

cable parallel 0x378 DLC5

Now, the big moment has come – type in:

detect

If everything went right, it should detect your iPaq’s Processor. If not, don’t panic. Try to find out if you made a mistake, and check if all wires are still connected properly. Double-check the pinouts you used. Good luck!

Okay, if your processor was detected correctly, continue with:

detectflash

Now you can flash the bootloader:

flashmem 0 bootldr-pxa-2.21.12.bin

This takes some time, go and make yourself a cup of tea and/or do part 4 in the meantime.

When it’s done, disconnect the power and the JTAG cable. Connect the power again.
Push the reset button while holding down the action button. If the bootldr was flashed successfully,
the iPaq should vibrate as usual.

Part 4 – Breaking the case

You need to cut a hole into the iPaq’s case, so that the connector is accessible whithout opening the ipaq later. The connector probably wouldn’t fit into an intact case anyway.

case1

case2

Reassemble the iPaq and check again if the connector works.

flash_closed

After that, I fixed the connector with a small piece of duct tape.

 

That’s it!

Thanks

Many thanks to the people who helped me resurrecting my iPaq, especially to Jamey Hicks, Frank Rittenbruch and Ralf Miunske.

Contact

If you have any questions, ideas or suggestions for improvement regarding this howto,
please drop me a line!

Leave a Reply