Reflashing a H1x0 via BDM

Physical interface

Unbricking a H120 requires soldering either some wires to test points or a flex connector to the H120 motherboard. It also requires a way to interface with the ColdFire's BDM module. A simple design based on an AVR microcontroller is provided here, but any BDM pod can be used (see Daniel Malik's TBLCF for a more complete BDM interface). The H340 uses very similar hardware so a similar process should be possible, but this has not yet been attempted.

The required signals are taken out to two places on the board. On the front (LCD) side there's an unpopulated header near the REC button (might be under a rubber pad). The pinout is on the connectors schematic on the HardwareSchematics page. On the back there are a couple of large test points, also near the REC button. As the labels are kind of cramped, I've indicated which point corresponds to which signal.

The signal names labelled on the board are JTAG names, but are configured for BDM signals. Their correspondence is as follows:

Label	Function
TDO	DS0
TDI	DSI
TRST	DSCLK
TMS	BKPT

Power can be taken from any ground and VCC_33 point on the board, the marked ones are the closest. Wire up your chosen BDM unit and proceed. The binaries for reflashing contain the 07pre4 bootloader.

Normal BDM pod

This hasn't been tested, but it should work, possibly with some fiddling around The first step is to make the H120 turn on and stay on. To do this:

Get the MCF5249 to restart into HALT mode

set MBAR = 0x40000001
set MBAR2 = 0x80000001
write 0x000A0000 to 0x80000b0 (GPIO1_OUT)
write 0x000A0000 to 0x80000b4 (GPIO1_ENABLE)
write 0x000A0000 to 0x80000b8 (GPIO1_FUNCTION)

This will also turn on the backlight as a diagnostic measure.

It's possible to make the H120 stay on by holding down the play button, but it's best to automate this. When it's staying on, load the elf file (or load the binary file to 0x01000000), set the PC to 0x01000000 and execute. The CPU will halt again when it's finished. Read back the first few bytes of memory to confirm the flashing went OK, then try to turn it on normally (you may need to disconnect the TMS/BKPT line).

AVR reflasher

This design is based around an Atmel ATMEGA88 because I had it lying around. Any AVR with at least 15 IO pins and 4K of flash should be usable, but the code will have to be modified. Wire it up as shown in the schematic. The LEDs aren't necessary, but are handy to have. The 74*245 may not be necessary, but it's best to include it if possible. To test leave the USB plug unconnected, connect the VCC from the H120 to the AVR's power and turn it on. If the H120 backlight turns on it's working. Turn off the H120 with the reset button.

To perform the actual reflashing disconnect the H120's power from the AVR , plug in the USB and turn the H120 back on. On the PC run 'usbdump reflash.bin'. When it finishes the H120 backlight should go off. If it blinks or stays on after the transfer has finished (the flashing only takes a second or so) something has gone wrong.

'usbread <file>' will dump the first 512 bytes of the flash to <file>, to confirm the flashing worked (only the first 8 bytes should contain anything useful). Disconnect the USB and the TMS/BKPT line, then test.

Note: Due to the way the usbread and usbdump programs were written, if you have anything else using the V-USB ID connected they may choose the wrong USB device. It's fairly unlikely this will become a problem.

No consistency checking is done for the firmware that's being flashed to the H120. during the BDM transfer. For safety, if rockbox loads, use iriver_flash to rewrite the bootloader. The flash is fully erased before writing, so you may also wish to restore the original firmware or install rockbox to the flash.