SIMpad JTAG HOWTO
=================

What can you do with a dead SIMpad?
Try to bring it back to life with JTAG!

SIMpad has a JTAG interface. With this interface you can install
the primary bootloader if it has accidentaly been overwritten. With
the help of the JTAG you can restore the bootloader and reload 
the operating system.

Warning:
--------

This HOWTO describes a modification of SIMpad. If it is badly done,
you might destroy the SIMpad! Do it only, if you are used to modify
electronic deviced.
The backlight inverter generates high voltage and the batteries can
generate high currents. Do not touch the backlight inverter and
do not short circuit the battery!!! 

Neither I nor anyone else of the project will not assume any 
responsibility for any damages on your hardware! In short, 
the use of this howto, software etc is at your own risk!


Prerequisites:
--------------

Hardware:
PC or Laptop with Linux or Windows and parallel port.
JTAG cable DLC5 of Keith&Koep.
SIMpad CL4, SL4 or SLC
Jumper
2 pin jumper connector J10
10 pin jumper connector J12
Torx T8 screwdriver
Philips No. 0 screwdriver
Soldering iron
Solder remover (Solder Wick) 

Software:
JTAG Tools 0.4 http://openwince.sourceforge.net/jtag/
Include package http://openwince.sourceforge.net/include/
SIMpad rom file "pbl-simpad" CL or SL http://sf.net/projects/simpad

Preparation
-----------

The SIMpad does not have the powerjumper and the JTAG connector in
place, so you have to add them by yourself.

Remove the back of the housing of the SIMpad.

 J18  J2                                                 J5  
++-+-+-+-----------------------------+---------------+--+-+--+
|+-+ | |                             |               |  | |  |
+----+++                             |               |  +-+  |
      |                              |               |       |
      ++                             |               |       |
   J7 ||                             |    PCMCIA     |       |
      ||                             |               |       |
      ++                             |               |       |
      |    +-----------------+       |               |       |
      |    |                 |       +---------------+       |
      |    |   Smart Card    |       |               |       |
      |    |                 |       +---------------+       |
      |    |                 |                               |
      |    +-----------------+       +---+      ++---+       |
      |                           J4 | x |   J17||   |J19    |
      ++                             +---+      ++---+       |
   J20||                          J12++++       ++    +--+   |
      ++                           ++||||S2     J10   |  |J3 |
   J13++  ++                    J21++++++             +--+   |
      ++  ++S1                                          ++   |
   J23||                                                ++J6 |
      ++-----------------------------------------------------+


                  SIMpad main board

In the picture above you see the main board with the relevant
connectors. The connectors J10 and J12 are missing. J4 is the
test point head with a small hole in the middle.
S1 is the reset switch, S2 disconnects the battery when pressed.

Unplug the cables in J7, J20, J13, J23, J21, J19, J3 and J6 and
unscrew the main board.

First you have to remove the solder in the holes for J10 and J12.
Some holes of J12 are difficult to unsolder because they are connected
to ground and dissipate the heat. One iron on each side helps.
Then you insert the jumper connectors J12 and J10 and solder them.

As an alternative you can also use some thin wires to make a 
connection between J12 and the JTAG cable, so you do not need remove
the solder and insert the connectors.

           1 o o o o o o  6
           7 o o o o o o 12
          13 o o  X  o o 16
          17 o o o o o o 22
          23 o o o o o o 28
                 J4

            +---+
    TRST  1 |o o| 2  VCC                   +---+
    TDI   3 |o o| 4  VCC                 1 |o o| 2
    TDO   5 |o o| 6  GND                   +---+
    TMS   7 |o o| 8  GND
    TCK   9 |o o| 10 GND
            +---+
             J12                           J10

		J4, J12 and J10 detail


JTAG-Cable
----------

Either you can use the Keith+Koep cable or build a passive one.
A simple cable is a passive version of the DLC5 cable. It must
be kept short because otherwise the signals become unreliable.
I successfully built one with 60 cm 9 pole ribbon cable. Between
each active signal (4) I put a GND (5). The resistors are on the
jtag header:

                                 ---------< 2 VCC
                                 | 
                                 --***----< 1 TRST
______                             200
select 13 >------------------------***----< 5 TDO
			           200
data 0  2 >------------------------***----< 3 TDI
			           200
data 1  3 >------------------------***----< 9 TCK
			           200
data 2  4 >------------------------***----< 7 TMS
			           200
gnd 21-25 >===============================< 6,8,10 GND


DB25 PC         Cable              JTAG Header

Software
--------

The JTAG tools are able to program the SIMpad's FLASH. Use
Version 0.4 for best results. Compile and install them according 
the instructions in the tarball.

Flash Procedure
---------------

Connect the SIMpad to the power supply. You don't need to put the
main board back into the housing and connect all internal cables.
Put a jumper on J10 to keep power on. Plug the JTAG cable to the PC
and to the SIMpad.

Start the JTAG tools with "jtag" and enter the following sequence:

  jtag> cable ppdev /dev/parport0 DLC5        (or KeithKoep)
  jtag> detect

This should identify the SA1110 processor.

  jtag> detectflash

This should identify one 28F128 FLASH with 16 bit bus. The second
chip cannot be reached with the JTAG tools.

  jtag> flashmem 0 simpad.rom

The address should count up after the first block has been erased.
Then the second block is erased and programmed. It takes about 15
minutes until programming is finished. Verification will fail, bug?

After you remove the cable and press reset you should see the PBL
message on the serial interface. If the bootloader is still ok you
are done and the bootloader starts.

If not, short pin 1 and 2 on the test header J4 and press reset again.
The piggy back bootloader should be programmed.


Final Work
----------

To finish remove jumper, power and put the main board back, connect
all internal cables and screw the back on the simpad.


Walter Schweizer
Mon Jun  2 23:11:55 CEST 2003

Viewed by:
Juergen Messerer
Mon Jun  3 00:38:55 CEST 2003
