Reflashing a H1x0 via BDM
Unbricking a H120 requires soldering either some wires to test points or a flex
connector to the H120 motherboard. It also requires a way to interface with the
's BDM module. A simple design based on an AVR microcontroller is
provided here, but any BDM pod can be used (see Daniel Malik's TBLCF
for a more
complete BDM interface). The H340 uses very similar hardware so a similar
process should be possible, but this has not yet been attempted.
The required signals are taken out to two places on the board. On the front
(LCD) side there's an unpopulated header near the REC button (might be under a
rubber pad). The pinout is on the connectors schematic on the HardwareSchematics
page. On the back there are a couple of large test points, also near the REC button.
As the labels are kind of cramped, I've indicated which point corresponds to
The signal names labelled on the board are JTAG names, but are configured for
BDM signals. Their correspondence is as follows:
Power can be taken from any ground and VCC_33 point on the board, the marked
ones are the closest. Wire up your chosen BDM unit and proceed. The binaries
for reflashing contain the 07pre4 bootloader.
Normal BDM pod
This hasn't been tested, but it should work, possibly with some fiddling around The first step is to make the H120
turn on and stay on. To do this:
Get the MCF5249 to restart into HALT mode
set MBAR = 0x40000001
set MBAR2 = 0x80000001
write 0x000A0000 to 0x80000b0 (GPIO1_OUT)
write 0x000A0000 to 0x80000b4 (GPIO1_ENABLE)
write 0x000A0000 to 0x80000b8 (GPIO1_FUNCTION)
This will also turn on the backlight as a diagnostic measure.
It's possible to make the H120 stay on by holding down the play button, but it's
best to automate this. When it's staying on, load the elf file (or load the
binary file to 0x01000000), set the PC to 0x01000000 and execute. The CPU will
halt again when it's finished. Read back the first few bytes of memory to
confirm the flashing went OK, then try to turn it on normally (you may need to
disconnect the TMS/BKPT line).
This design is based around an Atmel ATMEGA88 because I had it lying around. Any
AVR with at least 15 IO pins and 4K of flash should be usable, but the code will
have to be modified. Wire it up as shown in the schematic. The LEDs aren't
necessary, but are handy to have. The 74*245 may not be necessary, but it's best to include it if possible. To test leave the USB plug unconnected,
connect the VCC from the H120 to the AVR's power and turn it on. If the H120
backlight turns on it's working. Turn off the H120 with the reset button.
To perform the actual reflashing disconnect the H120's power from the AVR , plug
in the USB and turn the H120 back on. On the PC run 'usbdump reflash.bin'. When
it finishes the H120 backlight should go off. If it blinks or stays on after the
transfer has finished (the flashing only takes a second or so) something has
'usbread <file>' will dump the
first 512 bytes of the flash to <file>, to confirm the flashing worked
(only the first 8 bytes should contain anything useful). Disconnect the USB and
the TMS/BKPT line, then test.
Note: Due to the way the usbread and usbdump programs were written, if you have
anything else using the V-USB ID connected they may choose the wrong
USB device. It's fairly unlikely this will become a problem.
No consistency checking is done for the firmware that's being flashed to the
H120. during the BDM transfer. For safety, if rockbox loads, use iriver_flash to
rewrite the bootloader. The flash is fully erased before writing, so you may
also wish to restore the original firmware or install rockbox to the flash.
Copyright © by the contributing authors.