To use JTAG for unbricking it is necessary to disassemble the device and solder wires to the JTAG pads. On some Sansa models the pinout is documented on the PCB, on others the JTAG pinout is not documented. Please look at http://forums.rockbox.org/index.php?topic=14064 first if the pinout is not yet documented on this page. You will also need a JTAG interface for your computer, if you have a parallel port a simple 'wiggler' type will do the job, but might be slow. The cheapest option for USB JTAG interfaces are FT2232 based devices like the OOCDLink http://www.joernonline.de/contrexx2/cms/index.php?page=126 (a DIY device, schematics, partslist etc. available on the site) or the commercial JTAGKey2. Finally you need JTAG interfacing software, this guide is written for the open source openocd http://openocd.berlios.de/. This guide assumes you will use a OOCDLink or compatible, if you use a different device you will have to adjust the openocd configuration accordingly.
Open On-Chip Debugger 0.4.0 (2010-02-23-17:04) Licensed under GNU GPL v2 For bug reports, read http://openocd.berlios.de/doc/doxygen/bugs.html jtag_ntrst_delay: 100 Info : clock speed 6000 kHz Info : JTAG tap: as3525.cpu tap/device found: 0x00922f0f (mfg: 0x787, part: 0x0922, ver: 0x0) Info : Embedded ICE version 2 Info : as3525.cpu: hardware has 2 breakpoint/watchpoint units
Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Open On-Chip Debugger >
> halt target state: halted target halted in ARM state due to debug-request, current mode: Supervisor cpsr: 0x60000093 pc: 0x30047bc4 MMU: enabled, D-Cache: enabled, I-Cache: enabled > reg cpsr 0x60000013 cpsr (/32): 0x60000013 > load_image /path/to/firmware 0 118332 bytes written at address 0x00000000 downloaded 118332 bytes in 4.371294s (26.436 kb/s) > resume 0
> halt target state: halted target halted in ARM state due to debug-request, current mode: Supervisor cpsr: 0x60000093 pc: 0x30047bc4 MMU: enabled, D-Cache: enabled, I-Cache: enabled > bp 0 4 hw breakpoint set at 0x00000000 > resume
target state: halted target halted in ARM state due to breakpoint, current mode: Supervisor cpsr: 0x000000d3 pc: 0x00000000 MMU: disabled, D-Cache: disabled, I-Cache: disabled > resume target state: halted target halted in ARM state due to breakpoint, current mode: Supervisor cpsr: 0x60000053 pc: 0x00000000 MMU: disabled, D-Cache: disabled, I-Cache: disabled
Example OpenOCD configuration
telnet_port 4444 gdb_port 3333 # Note: This is for FT2232 based USB interfaces, if you use a wiggler type parallel port interface refer to the openocd documentation on how to configure it interface ft2232 # Note: Substitute different layout here if you don't use a oocdlink, refer to openocd documentation for supported layouts. ft2232_layout oocdlink # Note: I used an EEPROM-less FT2232 board with the default USB ids, you will have to substitute your JTAG interface USB ids here ft2232_vid_pid 0x0403 0x6010 jtag_ntrst_delay 100 set _CHIPNAME as3525 set _ENDIAN little set _CPUTAPID 0x00922f0f #jtag scan chain jtag newtap $_CHIPNAME cpu -irlen 4 -expected-id $_CPUTAPID set _TARGETNAME $_CHIPNAME.cpu target create $_TARGETNAME arm920t -endian $_ENDIAN -chain-position $_TARGETNAME -variant arm920t # FIXME: copied from Samsung config $_TARGETNAME configure -work-area-phys 0x200000 -work-area-size 0x4000 -work-area-backup 1
C240v2 JTAG pinout USB 1 GND F 2 TDO L 3 TCLK A 4 TMS S 5 TDI H 6 TRST 7 VCC RAM
ClipPlus JTAG pinout DISPLAY CONNECTOR 8 GND 7 nSRST 6 TDO (high impedance) 5 TCK (pulldown) 4 TMS (pullup) 3 TDI (pullup) 2 nTRST (pulldown) 1 VCC BUTTONS
r3 - 05 May 2010 - 15:23:23 - TobiasDiedrich
Copyright © by the contributing authors.