Erase Flash Chip Before Jtaging

[fladda]

There are times when even re-loading the Siemens 2.4 SL bootloader with the JTAG utility does not appear to recover a 'bricked' Simpad. For example loading the Siemens 2.4 CL bootloader into a Simpad SL appears to be a good way of 'bricking' your Simpad ! (I tried this just to see what happens).

I found that JTAG (version 2.4) supports a scripting option. So I created a file called 'null' with the contents of just 4 bytes (0x00 0x00 0x00 0x00). Then used the following script file to write this data into every block of the first 16-bit flash chip. During the flash process, all EEprom flash blocks are first erased, so the script below effectively erases the 16-bit 'accessible' flash chip that is used to hold the boot-loader.

Command is :-

jtag> script
Q. Does anybody know a good way of completely erasing the 2nd flash ROM chip in the Simpad ?

My experience is that the contents of certain locations in the flash chips can cause all sorts of different failure modes when going from WinCE-Linux, or back from Linux->WinCE.

Ralph

**********************
flashmem 0x00000000 null
flashmem 0x00020000 null
flashmem 0x00040000 null
flashmem 0x00060000 null
flashmem 0x00080000 null
flashmem 0x000a0000 null
flashmem 0x000c0000 null
flashmem 0x000e0000 null
flashmem 0x00100000 null
flashmem 0x00120000 null
flashmem 0x00140000 null
flashmem 0x00160000 null
flashmem 0x00180000 null
flashmem 0x001a0000 null
flashmem 0x001c0000 null
flashmem 0x001e0000 null
flashmem 0x00200000 null
flashmem 0x00220000 null
flashmem 0x00240000 null
flashmem 0x00260000 null
flashmem 0x00280000 null
flashmem 0x002a0000 null
flashmem 0x002c0000 null
flashmem 0x002e0000 null
flashmem 0x00300000 null
flashmem 0x00320000 null
flashmem 0x00340000 null
flashmem 0x00360000 null
flashmem 0x00380000 null
flashmem 0x003a0000 null
flashmem 0x003c0000 null
flashmem 0x003e0000 null
flashmem 0x00400000 null
flashmem 0x00420000 null
flashmem 0x00440000 null
flashmem 0x00460000 null
flashmem 0x00480000 null
flashmem 0x004a0000 null
flashmem 0x004c0000 null
flashmem 0x004e0000 null
flashmem 0x00500000 null
flashmem 0x00520000 null
flashmem 0x00540000 null
flashmem 0x00560000 null
flashmem 0x00580000 null
flashmem 0x005a0000 null
flashmem 0x005c0000 null
flashmem 0x005e0000 null
flashmem 0x00600000 null
flashmem 0x00620000 null
flashmem 0x00640000 null
flashmem 0x00660000 null
flashmem 0x00680000 null
flashmem 0x006a0000 null
flashmem 0x006c0000 null
flashmem 0x006e0000 null
flashmem 0x00700000 null
flashmem 0x00720000 null
flashmem 0x00740000 null
flashmem 0x00760000 null
flashmem 0x00780000 null
flashmem 0x007a0000 null
flashmem 0x007c0000 null
flashmem 0x007e0000 null
flashmem 0x00800000 null
flashmem 0x00820000 null
flashmem 0x00840000 null
flashmem 0x00860000 null
flashmem 0x00880000 null
flashmem 0x008a0000 null
flashmem 0x008c0000 null
flashmem 0x008e0000 null
flashmem 0x00900000 null
flashmem 0x00920000 null
flashmem 0x00940000 null
flashmem 0x00960000 null
flashmem 0x00980000 null
flashmem 0x009a0000 null
flashmem 0x009c0000 null
flashmem 0x009e0000 null
flashmem 0x00a00000 null
flashmem 0x00a20000 null
flashmem 0x00a40000 null
flashmem 0x00a60000 null
flashmem 0x00a80000 null
flashmem 0x00aa0000 null
flashmem 0x00ac0000 null
flashmem 0x00ae0000 null
flashmem 0x00b00000 null
flashmem 0x00b20000 null
flashmem 0x00b40000 null
flashmem 0x00b60000 null
flashmem 0x00b80000 null
flashmem 0x00ba0000 null
flashmem 0x00bc0000 null
flashmem 0x00be0000 null
flashmem 0x00c00000 null
flashmem 0x00c20000 null
flashmem 0x00c40000 null
flashmem 0x00c60000 null
flashmem 0x00c80000 null
flashmem 0x00ca0000 null
flashmem 0x00cc0000 null
flashmem 0x00ce0000 null
flashmem 0x00d00000 null
flashmem 0x00d20000 null
flashmem 0x00d40000 null
flashmem 0x00d60000 null
flashmem 0x00d80000 null
flashmem 0x00da0000 null
flashmem 0x00dc0000 null
flashmem 0x00de0000 null
flashmem 0x00e00000 null
flashmem 0x00e20000 null
flashmem 0x00e40000 null
flashmem 0x00e60000 null
flashmem 0x00e80000 null
flashmem 0x00ea0000 null
flashmem 0x00ec0000 null
flashmem 0x00ee0000 null
flashmem 0x00e00000 null
flashmem 0x00f20000 null
flashmem 0x00f40000 null
flashmem 0x00f60000 null
flashmem 0x00f80000 null
flashmem 0x00fa0000 null
flashmem 0x00fc0000 null
flashmem 0x00fe0000 null
flashmem 0 simpadSL.rom
**********************

[Digi]

Why don't you create a file with 16 Mbytes of 0x00 and flashmem it in one step?

I suppose flashmem 0 16mbfile erases the first bank, while flashmem 0x1000000 16mbfile erases the second bank. Haven't tried it, though...

Digi

There are times when even re-loading the Siemens 2.4 SL bootloader with the JTAG utility does not appear to recover a 'bricked' Simpad. For example loading the Siemens 2.4 CL bootloader into a Simpad SL appears to be a good way of 'bricking' your Simpad ! (I tried this just to see what happens).

I found that JTAG (version 2.4) supports a scripting option. So I created a file called 'null' with the contents of just 4 bytes (0x00 0x00 0x00 0x00). Then used the following script file to write this data into every block of the first 16-bit flash chip. During the flash process, all EEprom flash blocks are first erased, so the script below effectively erases the 16-bit 'accessible' flash chip that is used to hold the boot-loader.

Command is :-

jtag> script
Q. Does anybody know a good way of completely erasing the 2nd flash ROM chip in the Simpad ?

My experience is that the contents of certain locations in the flash chips can cause all sorts of different failure modes when going from WinCE-Linux, or back from Linux->WinCE.

Ralph

**********************
flashmem 0x00000000 null
flashmem 0x00020000 null
flashmem 0x00040000 null
flashmem 0x00060000 null
flashmem 0x00080000 null
flashmem 0x000a0000 null
flashmem 0x000c0000 null
flashmem 0x000e0000 null
flashmem 0x00100000 null
flashmem 0x00120000 null
flashmem 0x00140000 null
flashmem 0x00160000 null
flashmem 0x00180000 null
flashmem 0x001a0000 null
flashmem 0x001c0000 null
flashmem 0x001e0000 null
flashmem 0x00200000 null
flashmem 0x00220000 null
flashmem 0x00240000 null
flashmem 0x00260000 null
flashmem 0x00280000 null
flashmem 0x002a0000 null
flashmem 0x002c0000 null
flashmem 0x002e0000 null
flashmem 0x00300000 null
flashmem 0x00320000 null
flashmem 0x00340000 null
flashmem 0x00360000 null
flashmem 0x00380000 null
flashmem 0x003a0000 null
flashmem 0x003c0000 null
flashmem 0x003e0000 null
flashmem 0x00400000 null
flashmem 0x00420000 null
flashmem 0x00440000 null
flashmem 0x00460000 null
flashmem 0x00480000 null
flashmem 0x004a0000 null
flashmem 0x004c0000 null
flashmem 0x004e0000 null
flashmem 0x00500000 null
flashmem 0x00520000 null
flashmem 0x00540000 null
flashmem 0x00560000 null
flashmem 0x00580000 null
flashmem 0x005a0000 null
flashmem 0x005c0000 null
flashmem 0x005e0000 null
flashmem 0x00600000 null
flashmem 0x00620000 null
flashmem 0x00640000 null
flashmem 0x00660000 null
flashmem 0x00680000 null
flashmem 0x006a0000 null
flashmem 0x006c0000 null
flashmem 0x006e0000 null
flashmem 0x00700000 null
flashmem 0x00720000 null
flashmem 0x00740000 null
flashmem 0x00760000 null
flashmem 0x00780000 null
flashmem 0x007a0000 null
flashmem 0x007c0000 null
flashmem 0x007e0000 null
flashmem 0x00800000 null
flashmem 0x00820000 null
flashmem 0x00840000 null
flashmem 0x00860000 null
flashmem 0x00880000 null
flashmem 0x008a0000 null
flashmem 0x008c0000 null
flashmem 0x008e0000 null
flashmem 0x00900000 null
flashmem 0x00920000 null
flashmem 0x00940000 null
flashmem 0x00960000 null
flashmem 0x00980000 null
flashmem 0x009a0000 null
flashmem 0x009c0000 null
flashmem 0x009e0000 null
flashmem 0x00a00000 null
flashmem 0x00a20000 null
flashmem 0x00a40000 null
flashmem 0x00a60000 null
flashmem 0x00a80000 null
flashmem 0x00aa0000 null
flashmem 0x00ac0000 null
flashmem 0x00ae0000 null
flashmem 0x00b00000 null
flashmem 0x00b20000 null
flashmem 0x00b40000 null
flashmem 0x00b60000 null
flashmem 0x00b80000 null
flashmem 0x00ba0000 null
flashmem 0x00bc0000 null
flashmem 0x00be0000 null
flashmem 0x00c00000 null
flashmem 0x00c20000 null
flashmem 0x00c40000 null
flashmem 0x00c60000 null
flashmem 0x00c80000 null
flashmem 0x00ca0000 null
flashmem 0x00cc0000 null
flashmem 0x00ce0000 null
flashmem 0x00d00000 null
flashmem 0x00d20000 null
flashmem 0x00d40000 null
flashmem 0x00d60000 null
flashmem 0x00d80000 null
flashmem 0x00da0000 null
flashmem 0x00dc0000 null
flashmem 0x00de0000 null
flashmem 0x00e00000 null
flashmem 0x00e20000 null
flashmem 0x00e40000 null
flashmem 0x00e60000 null
flashmem 0x00e80000 null
flashmem 0x00ea0000 null
flashmem 0x00ec0000 null
flashmem 0x00ee0000 null
flashmem 0x00e00000 null
flashmem 0x00f20000 null
flashmem 0x00f40000 null
flashmem 0x00f60000 null
flashmem 0x00f80000 null
flashmem 0x00fa0000 null
flashmem 0x00fc0000 null
flashmem 0x00fe0000 null
flashmem 0 simpadSL.rom
**********************
[div align=\"right\"][a href=\"index.php?act=findpost&pid=118166\"][{POST_SNAPBACK}][/a][/div]

[fladda]

JTAG flash programming is *painfully* slow. I reckon that flashing a 16Mbyte file using JTAG on the Simpad at the 'normal speed would take about 24 hours (or more?). My method achieves almost the same result, but uses the 'erase block' function to clear the flash more quickly. That said flashing the contents of the flash to 0x00000000 would always be better than erasing the flash blocks (to 0xFFFFFFFFFF ? or whatever ?), as 0x00000000 corresponds to the ARM instruction :-

ANDEQ   R0,R0,R0 ; this is effectively the same as a NOP instruction.

So if this 'code' was ever run in error, it would not do anything 'dangerous', but eventually I guess that an ARM memory exception would occur ??

Ralph

Why don't you create a file with 16 Mbytes of 0x00 and flashmem it in one step?

I suppose flashmem 0 16mbfile erases the first bank, while flashmem 0x1000000 16mbfile erases the second bank. Haven't tried it, though...

Digi

There are times when even re-loading the Siemens 2.4 SL bootloader with the JTAG utility does not appear to recover a 'bricked' Simpad. For example loading the Siemens 2.4 CL bootloader into a Simpad SL appears to be a good way of 'bricking' your Simpad ! (I tried this just to see what happens).

I found that JTAG (version 2.4) supports a scripting option. So I created a file called 'null' with the contents of just 4 bytes (0x00 0x00 0x00 0x00). Then used the following script file to write this data into every block of the first 16-bit flash chip. During the flash process, all EEprom flash blocks are first erased, so the script below effectively erases the 16-bit 'accessible' flash chip that is used to hold the boot-loader.


[div align=\"right\"][a href=\"index.php?act=findpost&pid=118166\"][{POST_SNAPBACK}][/a][/div]

[div align=\"right\"][a href=\"index.php?act=findpost&pid=118173\"][{POST_SNAPBACK}][/a][/div]