Help to de-brick a device

November 09, 2012, 01:00:11 am

My Clarion CZ500 came up with an error that said "MCU UPG", drained my
battery over the weekend, and now it won't turn on.
I buyed the first time a ulink2 interface, but it only works with the keil software, and is useless to reflash a firmware with a jffs ramdisk image, because it has not the image option.
I see on the schematics from the service manual of the stereo, that the section of the
principal MCU of the 2 cores, is a development of MCSLOGIC, based on a ARM7TDMI, and other 32 bits DSP, the
BX8805, equivalent to the MLC3895:
http://clubimgfile.paran.com/dig/bbs/20 ... _V1.02.pdf

On the website of MCSLOGIC, appear the MLC3890:
http://www.mcslogic.com/3890.asp

The firmware file, appear as a ramdisk image (my stereo is the CZ500):
http://www.clarion.com/ca/en/support/software/

I see on the online documentation from the mcslogic website a
procedure to create a new firmware
(uCLinux initrd):

1) Run “sysconf set”
2) TFTP setting (Refer to Environment Setting)
3) Write “root=/dev/mtdblock2” at Root Device Setting item
4) Select “OFF” at NFS Setting item
5) Move created JFFS2 image to TFTP home directory
6) Change the JFFS2 image name into “jffs2.image”
7) Move created compressed kernel image to TFTP home directory.
8) Change the compressed kernel image into “mcs.gz.jffs”
9) Run “flash prog jffs ” (for recorde to flash device)
10) Run “boot flash”

http://www.mcslogic.com/pds/1_How-to JFFS2 Image.pdf

But I do'nt found what software are using to this procedure.

The flash memory of the board is a SST39VF1601.

You can tell me how is the procedure to write the firmware to the
Flash memory via JTAG, with openocd?

I selected on the config board for openocd the lpc2294, which uses the arm7tdmi, and edited one config file,to add the external flash SST39VF1601, which is present on some boards like the LPC2294, or the Samsung S3C44B0, but in the boards files from openocd the nearest model of Samsung is the S3C4510, which has no one line to setup the flash memories, internal and external.

I tryed with the command "flash write_image firmware.mcs 0x00400000" (the address from the start of the external flash SST39VF1601). The boot file is in the internal flash of the mcu of 256 Kbyte.

They are a similar model of Clarion, the CZ501, which uses the same MCU than the CZ500, and it uses 2 firmware files:
*CZ501MCU.BIN (129kB)
*AUDIO_v2x_V101_CZ501_MXIC_110125_00_375K.mcs (1,585kB)
http://www.clarion.com/ca/en/support/so ... index.html

I tryed to write the littler file which appear as the boot file with:

flash write_image /root/CZ501MCU.BIN 0x00000000
Verification will fail since checksum in image (0x20282024) to be written to flash is different from calculated vector checksum (0x3f482590).
To remove this warning modify build tools on developer PC to inject correct LPC vector checksum.
ThumbEE -- incomplete support
target reentered debug state, but not at the desired exit point: 0xfffffff9
lpc2000 prepare sectors returned -1571637640
error writing to flash at address 0x00000000 at offset 0x00000000
in procedure 'flash'

If I could write at least the boot file to the internal flash, later with the assembled device, I could load the rest of the firmware via USB.

I do'nt know if the error is related to a hardware problem in the interface:
viewtopic.php?f=37&t=4754
Or is other error.
When I tryed to write or see the external flash, I got this error:
flash probe 1
Flash Manufacturer/Device: 0xffff 0xffff
Could not probe bank: no QRY
Try workaround w/0x555 instead of 0x55 to get QRY.
Could not probe bank: no QRY
auto_probe failed
in procedure 'flash'

Thanks in advance,
Juan

Re: Help to de-brick a device

Reply #1 – November 09, 2012, 09:20:15 am

I think at this level of use you might get better feedback from the OpenOCD list. I designed the Bus Blaster to work with OpenOCD, but the hardware is pretty simple. I'm not an expert on the various facets of OpenOCD and different chips.

Re: Help to de-brick a device

Reply #2 – November 09, 2012, 01:11:38 pm

Yes!

I tryed about 3 times to obtain a feedback from the OpenOCD list, but without success.

But I can use urjtag.
I tryed with openocd and urjtag the first day, but because urjtag do'nt detected the interface, I continued with openocd. A few days later, with the imposibility of writing the flash memories, I downloaded the ftd2xx propietary libraries and drivers, and recompiled urjtag with the ftd2xx propietary libraries support, and then urjtag detected the interface, but I could'nt use it, because any time I want to use urjtag with the Bus Blaster JTAG debugger V 2.5, I got the same error:

TDO seems to be stuck at 1

Now, I'm waiting the tracking number of the shipping of a new Bus Blaster, to be sent as replacement.

Yesterday, I searched for the bsdl files and I found the S3C44B0X.BSD in
http://www.codeforge.com/read/37467/Tftp.c__html
which are one of the closer types of boards and mcu to mine. Other similar board is the LPC2294, but the nearest bsdl file are from the LPC23xx series.

But now are a new question:

urjtag detects automatically the flash memories and types?

Or I must to specify in a configuration file the driver for the internal and external flash memories, with his addresses and sizes?

Here is a schematics with the same mcu from JVC, in the page 40 (in my case the stereo car is Clarion, but the mcu board is builded by JVC):
http://es.scribd.com/doc/109151875/JVC-UX-GNX5-UX-GNX6

Thanks,
Juan

Re: Help to de-brick a device

Reply #3 – November 10, 2012, 07:21:59 am

Quote

urjtag detects automatically the flash memories and types?

It detects the ones in its database when you run the 'detect' command. It will also list unknown devices and you must provide a bsdl file for them with the 'bsdl path=c:whatever' command. This is all I know about urJTAG though, and trying JTAG on a device without full BSDL files from the manufacturer is a nightmare I personally avoid at all costs.

I'm surprised the OpenOCD mailing list didn't respond, there's a lot of people and traffic there last time I checked.

Re: Help to de-brick a device

Reply #4 – November 10, 2012, 04:02:00 pm

About the bsdl files, if the info about the flash memories is not included on the file, urjtag detects it?

Thanks