Neo1973 Debug Board v2/Unbricking

From Openmoko

Revision as of 03:38, 22 January 2008 by Mmontour (Talk | contribs)

Jump to: navigation, search

This page describes a manual procedure for recovering a "bricked" Neo1973 GTA01Bv4 phone, using the Neo1973 Debug Board v2. You may prefer to use the Devirginator to perform an automatic version of this procedure.

Contents

Preconditions

Please read and understand this entire procedure before performing any of the steps.

Charged Battery

First, make sure that your problem really is related to u-boot or its environment. The most common cause of an unresponsive Neo1973 is a deeply-discharged battery. See Neo1973_Battery_Charger#Neo1973_emergency_charging for more information.

Debug Board

Please connect your debug board as described on the Neo1973 Debug Board v2 page. This procedure will refer to the following terminal windows:

openocd console

This is the window in which you are using "telnet localhost 4444" to connect to the openocd program.

serial console

This is the window in which you are using a terminal emulator to connect to /dev/ttyUSB1.

USB console

This is the window in which you are using a terminal emulator to connect to /dev/ttyACM0. Note that this device is only present when u-boot is running, so you will have to connect and dis-connect your terminal program at the appropriate times.

Images

Before starting this procedure you should collect the software images that you will write to the Neo1973:

u-boot

You should use a recent version of u-boot, and it must be the one for your model of phone (e.g. gta01bv4). The actual filename will be similar to "u-boot-gta01bv4-1.3.0+git20071214+svnr3648-r1.bin" but this procedure will refer to it as "u-boot.bin"

A tested version of u-boot is available from [1] (released on 2008-01-13). This u-boot (and newer) includes an endian change for the framebuffer, so there is a minor cosmetic issue if it is used with an older splash.gz.

NOTE - this procedure assumes that you are using a modern u-boot in which the default console is on USB. Older versions have a default console on the serial port, so some (hopefully fairly obvious) modifications to the procedure would be required.

lowlevel_foo

You need a version of this package that matches your u-boot. The actual filename will be similar to "lowlevel_foo-gta01bv4-1.3.0+git20071214+svnr3648-r1.bin" but this procedure will refer to it as "lowlevel.bin".

splash.gz

This is a compressed splash-screen image.

uImage and rootfs

These are the standard kernel and root-filesystem images that you will flash to your phone at the end of the procedure.

Procedure

The unbricking steps are shown below. You should be watching the serial console throughout this process, although you will not actually use it to enter any text.

From the openocd console, first reset and halt the CPU.

> reset halt
> Target 0 halted
target halted in ARM state due to debug request, current mode:  Supervisor
cpsr: 0x600000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled

Next, the lowlevel.bin image must be used to initialize the Neo1973's RAM controller:

> load_binary lowlevel.bin 0
280 byte written at address 0x00000000
downloaded 280 byte in 0s 102067us
> bp 0x33f80000 4 hw
breakpoint added at address 0x33f80000
> resume
Target 0 resumed
> Target 0 halted
target halted in ARM state due to breakpoint, current mode:  Supervisor
cpsr: 0x600000d3 pc: 0x33f80000
MMU: disabled, D-Cache: disabled, I-Cache: enabled

Load the u-boot image into RAM:

> load_binary u-boot.bin 0x33000000
214860 byte written at address 0x33000000
downloaded 214860 byte in 16s 533236us

Hold down the Neo's Aux button (to prevent the Neo from trying to boot the kernel) and run u-boot:

> resume 0x33000000
Target 0 resumed

At this point you should see some output like the following on the serial console:

U-Boot 1.3.1+git20071214+svnr3648 (Dec 14 2007 - 09:36:50)

DRAM:  128 MB
NAND:  64 MiB
*** Warning - bad CRC or NAND, using default environment

Video: 640x480x8 31kHz 59Hz
USB:   S3C2410 USB Deviced
mtdparts variable not set, see 'help mtdparts'
mtdparts variable not set, see 'help mtdparts'
mtdparts variable not set, see 'help mtdparts'
mtdparts variable not set, see 'help mtdparts'
mtdparts variable not set, see 'help mtdparts'
Clearing SETUP_END
Clearing SETUP_END

and you should also see a small penguin on the Neo1973 screen. If not, go back to the "reset halt" step and try again.

Now connect to the USB console. The first thing to do here is to clear your entire NAND flash and update the bad-block table.

WARNING: This will erase your entire device, although it should preserve your existing bad-block table. See NAND_bad_blocks for more information


GTA01Bv4 # nand createbbt
Create BBT and erase everything ? <y/N>
Skipping bad block at  0x03ff0000
Skipping bad block at  0x03ff4000
Skipping bad block at  0x03ff8000
Skipping bad block at  0x03ffc000

Press y and Enter...

Creating BBT. Please wait ...

Next, create the environment variable that defines the NAND partition table:

GTA01Bv4 # dynpart
mtdparts mtdparts=neo1973-nand:0x00040000(u-boot),0x00004000(u-boot_env),0x00200000(kernel),0x000a0000(splash),0x03d1c000(rootfs)

Next, copy the u-boot image from RAM to its flash partition:

GTA01Bv4 # nand write.e 0x33000000 u-boot

NAND write: device 0 offset 0x0, size 0x40000

Writing data at 0x3fe00 -- 100% complete.
 262144 bytes written: OK

Set and confirm the environment offset:

GTA01Bv4 # dynenv set u-boot_env
device 0 offset 0x40000, size 0x4000
45 4e 56 30 - 00 00 04 00
GTA01Bv4 # dynenv get
0x00040000

This step was successful if the 'dynenv get' result is equal to the 'offset' shown above. The actual values may differ from what is shown here.

Now temporarily set the "bootdelay" environment variable to disable auto-boot, then save the environment:

GTA01Bv4 # setenv bootdelay -1
GTA01Bv4 # saveenv
Saving Environment to NAND...
Erasing Nand...Writing to Nand... done

Disconnect from the USB console. From the openocd console, reboot the Neo1973.

> reset
> Target 0 halted
target halted in ARM state due to debug request, current mode: Supervisor
cpsr: 0x200000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> resume
Target 0 resumed

You should again see some text on the serial console, and a penguin on the screen. You now have a DFU-capable device, so you can load the remaining images:

./dfu-util -R -a splash -D ./splash.gz
./dfu-util -R -a kernel -D ./uImage-neo1973-latest.bin
./dfu-util -R -a rootfs -D ./openmoko-devel-image-fic-gta01.jffs2

The final step is to go back into the USB console and set some more environment variables:

GTA01Bv4 # setenv splashimage nand read.e 0x32000000 splash\;unzip 0x32000000 0x33d00000 0x96000
GTA01Bv4 # setenv bootargs_base rootfstype=jffs2 root=/dev/mtdblock4 console=tty0 loglevel=8
GTA01Bv4 # setenv quiet 1
GTA01Bv4 # setenv bootdelay 5
GTA01Bv4 # saveenv
Saving Environment to NAND...
Erasing Nand...Writing to Nand... done

Now disconnect from the USB console. From the openocd console, reboot the device one more time to ensure that it now boots successfully:

> reset
> Target 0 halted
target halted in ARM state due to debug request, current mode: Supervisor
cpsr: 0x200000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> resume
Target 0 resumed

You should see the regular splash screen, followed by the kernel boot messages and (eventually) the OpenMoko GUI. You may now shut the phone down and disconnect it from the debug board. Remember to remove the USB cables and the battery before disconnecting the FPC cable.

Personal tools

This page describes a manual procedure for recovering a "bricked" Neo1973 GTA01Bv4 phone, using the Neo1973 Debug Board v2. You may prefer to use the Devirginator to perform an automatic version of this procedure.

Preconditions

Please read and understand this entire procedure before performing any of the steps.

Charged Battery

First, make sure that your problem really is related to u-boot or its environment. The most common cause of an unresponsive Neo1973 is a deeply-discharged battery. See Neo1973_Battery_Charger#Neo1973_emergency_charging for more information.

Debug Board

Please connect your debug board as described on the Neo1973 Debug Board v2 page. This procedure will refer to the following terminal windows:

openocd console

This is the window in which you are using "telnet localhost 4444" to connect to the openocd program.

serial console

This is the window in which you are using a terminal emulator to connect to /dev/ttyUSB1.

USB console

This is the window in which you are using a terminal emulator to connect to /dev/ttyACM0. Note that this device is only present when u-boot is running, so you will have to connect and dis-connect your terminal program at the appropriate times.

Images

Before starting this procedure you should collect the software images that you will write to the Neo1973:

u-boot

You should use a recent version of u-boot, and it must be the one for your model of phone (e.g. gta01bv4). The actual filename will be similar to "u-boot-gta01bv4-1.3.0+git20071214+svnr3648-r1.bin" but this procedure will refer to it as "u-boot.bin"

A tested version of u-boot is available from [1] (released on 2008-01-13). This u-boot (and newer) includes an endian change for the framebuffer, so there is a minor cosmetic issue if it is used with an older splash.gz.

NOTE - this procedure assumes that you are using a modern u-boot in which the default console is on USB. Older versions have a default console on the serial port, so some (hopefully fairly obvious) modifications to the procedure would be required.

lowlevel_foo

You need a version of this package that matches your u-boot. The actual filename will be similar to "lowlevel_foo-gta01bv4-1.3.0+git20071214+svnr3648-r1.bin" but this procedure will refer to it as "lowlevel.bin".

splash.gz

This is a compressed splash-screen image.

uImage and rootfs

These are the standard kernel and root-filesystem images that you will flash to your phone at the end of the procedure.

Procedure

The unbricking steps are shown below. You should be watching the serial console throughout this process, although you will not actually use it to enter any text.

From the openocd console, first reset and halt the CPU.

> reset halt
> Target 0 halted
target halted in ARM state due to debug request, current mode:  Supervisor
cpsr: 0x600000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled

Next, the lowlevel.bin image must be used to initialize the Neo1973's RAM controller:

> load_binary lowlevel.bin 0
280 byte written at address 0x00000000
downloaded 280 byte in 0s 102067us
> bp 0x33f80000 4 hw
breakpoint added at address 0x33f80000
> resume
Target 0 resumed
> Target 0 halted
target halted in ARM state due to breakpoint, current mode:  Supervisor
cpsr: 0x600000d3 pc: 0x33f80000
MMU: disabled, D-Cache: disabled, I-Cache: enabled

Load the u-boot image into RAM:

> load_binary u-boot.bin 0x33000000
214860 byte written at address 0x33000000
downloaded 214860 byte in 16s 533236us

Hold down the Neo's Aux button (to prevent the Neo from trying to boot the kernel) and run u-boot:

> resume 0x33000000
Target 0 resumed

At this point you should see some output like the following on the serial console:

U-Boot 1.3.1+git20071214+svnr3648 (Dec 14 2007 - 09:36:50)

DRAM:  128 MB
NAND:  64 MiB
*** Warning - bad CRC or NAND, using default environment

Video: 640x480x8 31kHz 59Hz
USB:   S3C2410 USB Deviced
mtdparts variable not set, see 'help mtdparts'
mtdparts variable not set, see 'help mtdparts'
mtdparts variable not set, see 'help mtdparts'
mtdparts variable not set, see 'help mtdparts'
mtdparts variable not set, see 'help mtdparts'
Clearing SETUP_END
Clearing SETUP_END

and you should also see a small penguin on the Neo1973 screen. If not, go back to the "reset halt" step and try again.

Now connect to the USB console. The first thing to do here is to clear your entire NAND flash and update the bad-block table.

WARNING: This will erase your entire device, although it should preserve your existing bad-block table. See NAND_bad_blocks for more information


GTA01Bv4 # nand createbbt
Create BBT and erase everything ? <y/N>
Skipping bad block at  0x03ff0000
Skipping bad block at  0x03ff4000
Skipping bad block at  0x03ff8000
Skipping bad block at  0x03ffc000

Press y and Enter...

Creating BBT. Please wait ...

Next, create the environment variable that defines the NAND partition table:

GTA01Bv4 # dynpart
mtdparts mtdparts=neo1973-nand:0x00040000(u-boot),0x00004000(u-boot_env),0x00200000(kernel),0x000a0000(splash),0x03d1c000(rootfs)

Next, copy the u-boot image from RAM to its flash partition:

GTA01Bv4 # nand write.e 0x33000000 u-boot

NAND write: device 0 offset 0x0, size 0x40000

Writing data at 0x3fe00 -- 100% complete.
 262144 bytes written: OK

Set and confirm the environment offset:

GTA01Bv4 # dynenv set u-boot_env
device 0 offset 0x40000, size 0x4000
45 4e 56 30 - 00 00 04 00
GTA01Bv4 # dynenv get
0x00040000

This step was successful if the 'dynenv get' result is equal to the 'offset' shown above. The actual values may differ from what is shown here.

Now temporarily set the "bootdelay" environment variable to disable auto-boot, then save the environment:

GTA01Bv4 # setenv bootdelay -1
GTA01Bv4 # saveenv
Saving Environment to NAND...
Erasing Nand...Writing to Nand... done

Disconnect from the USB console. From the openocd console, reboot the Neo1973.

> reset
> Target 0 halted
target halted in ARM state due to debug request, current mode: Supervisor
cpsr: 0x200000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> resume
Target 0 resumed

You should again see some text on the serial console, and a penguin on the screen. You now have a DFU-capable device, so you can load the remaining images:

./dfu-util -R -a splash -D ./splash.gz
./dfu-util -R -a kernel -D ./uImage-neo1973-latest.bin
./dfu-util -R -a rootfs -D ./openmoko-devel-image-fic-gta01.jffs2

The final step is to go back into the USB console and set some more environment variables:

GTA01Bv4 # setenv splashimage nand read.e 0x32000000 splash\;unzip 0x32000000 0x33d00000 0x96000
GTA01Bv4 # setenv bootargs_base rootfstype=jffs2 root=/dev/mtdblock4 console=tty0 loglevel=8
GTA01Bv4 # setenv quiet 1
GTA01Bv4 # setenv bootdelay 5
GTA01Bv4 # saveenv
Saving Environment to NAND...
Erasing Nand...Writing to Nand... done

Now disconnect from the USB console. From the openocd console, reboot the device one more time to ensure that it now boots successfully:

> reset
> Target 0 halted
target halted in ARM state due to debug request, current mode: Supervisor
cpsr: 0x200000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> resume
Target 0 resumed

You should see the regular splash screen, followed by the kernel boot messages and (eventually) the OpenMoko GUI. You may now shut the phone down and disconnect it from the debug board. Remember to remove the USB cables and the battery before disconnecting the FPC cable.