Unbricking the Cowon V5: SDCFG value for TCCtool needed

[dfkt]

Can someone help me find out the SDCFG value for unbricking the Cowon V5 with TCCtool? I bricked the V5 for good, nothing to do with it anymore. Unfortunately I have no idea how to find out the correct SDCFG value, I just collected all the info that might be helpful. Any help would be highly appreciated.

I assume another issue would be that the 32MB firmware file is too big for TCCtool to transfer onto the device. Would there be a workaround for that?

Here's an informative thread about the endeavors to get TCCtool working with the Cowon S9/J3: http://iaudiophile.net/forums/showthread.php?t=36073

Especially Joeyg's posts are very helpful, like this: http://iaudiophile.net/forums/showpost.php?p=293926&postcount=59



Here's all the info I collected:

Cowon V5 PCB layout photo: http://i45.tinypic.com/wu2eqc.jpg

Cowon V5 1.12_ENG firmware: http://www.cowonglobal.com/zeroboard/zboard.php?id=C08&no=415

+++++++++++++++++++++++++++++++++++++++++++

Telechips TCC9101 (ARM1176JZF-S - TCC91XX) - http://www.mp4nation.net/forum/viewtopic.php?f=20&t=16030

VID 140E / PID B077

"TCC91xx usb-boot mode"=LIBUSB_DEV, USB\VID_140E&PID_B077

+++++++++++++++++++++++++++++++++++++++++++

Memory: Samsung 007 K4T1G164QE-HCE6 ( GWA028GKN / GWL659JGS ) - http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=696&partnum=K4T1G164QE&xFmly_id=

Data sheet: http://www.samsung.com/global/system/business/semiconductor/product/2010/3/24/691229ds_k4t1gxx4qe_rev111.pdf

Device Operation & Timing Diagram: http://www.samsung.com/global/system/business/semiconductor/product/2010/1/20/741738ddr2_device_operation_timing_diagram_may_07.pdf

+++++++++++++++++++++++++++++++++++++++++++

Memory: Shows up as 166636 KB RAM in Windows CE Task Manager

[saratoga]

Do you have the TCC datasheets?  IIRC they explain what the register does.

[dfkt]

No, I didn't find anything about the TCC91xx, but the MP4Nation link above contains a link to the newer TCC89xx datasheets. Here's a direct link to a working torrent if that's any help: http://www.torrenthound.com/hash/f21b0242eac7f91090eaa949c699d2bc9252ca85/torrent-info/Telechips-TCC89XX-Datasheets-%2B-sources - not sure how legal that is, please delete the link in case.

These iAudiophile post have some info about the TCC79xx: http://iaudiophile.net/forums/showpost.php?p=289582&postcount=17 and http://iaudiophile.net/forums/showpost.php?p=293926&postcount=59

[saratoga]

Unfortunately I don't see a datasheet for the TCC chip in there, but I think that register probably doesn't change much from the slightly older TCC chips.  I looked at the 8200 datasheet, and it looks like the main bits that change are just the total memory size and maybe the total base address.  Is there an SDCFG value known for a 32MB player?  Maybe try that.

[dfkt]

You mean a player with 32MB big firmware? No, I'm not aware of any SDCFG known - also, the Korean firmware is even bigger than the international one (~62MB). Furthermore, TCCtool refuses to upload such big firmwares.  I assume in tcctool.c one has to remove or alter the safety check:

Code: [Select]

#define MAX_FIRMWARESIZE   (10*1024*1024)   /* Arbitrary limit (for safety) */

As far as I know, a big part of that 32MB firmware is some Windows CE 6 bloat - other Cowon TCC players run on some more specific embedded systems. Most other Cowon TCC firmwares come in 3-part binaries (format.bin, firmware.bin, resources/fonts.bin), not in one monolithic file. And those parts are usually around 1-8MB sizes.

Is there a way to reverse-engineer the V5 firmware, or any other way to look around in it, which might reveal something about the right SDCFG?

[saratoga]

Sorry I misunderstood.  i thought you meant it had 32MB of RAM, but looking at that link its a 128MB module.  I don't think the firmware size matters to the SDCFG register, probably just the total size of the memory module.  If theres another 128MB player with known register, then you could try that.

Is there a way to reverse-engineer the V5 firmware, or any other way to look around in it, which might reveal something about the right SDCFG?

I guess disassemble the firmware and find the parts where it initializes the memory.  But at least on older TCC devices the SDCFG only has a few possible combinations that make sense, so educated guessing might be quicker.  Of course thats assuming the new chip and firmware are even compatible with tcctool (i have no idea how this works).

[dfkt]

I think the S9/J3 have 128MB RAM - but doesn't the V5 have more, since it has two RAM chips (both different serial/spec numbers as well)? I'm asking since in WinCE the task manager showed 166636 KB RAM. So might it be that total RAM is (at least) 256MB? Here's a screenshot of the task manager, showing 152MB - but since it's bricked I can't check anymore: http://www.anythingbutipod.com/archives/images/cowonv524.jpg

Also, the S9/J3 run Nucleus or VxWorks, while the V5 runs WinCE6 - not sure if that is of any concern for this matter.

Unfortunately, disassembling the firmware is way over my head. I have no experience with that, I wouldn't even know where to start. I just thought there might be some hints in there - but nothing I could do about it.

I can't be sure the new chip and firmware is compatible with tcctool, but I got the V5 into the hidden recovery mode, being recognized by libusb as a TCC device. I got tcctool to recognize the player as well - but didn't try to write any files onto it, due to the filesize limitation in tcctool and due to the lack of the SDCFG value.

[saratoga]

Sorry, i'm basically useless here.  I don't know much about the TCC chips aside from skimming some of the datasheets. 

[dfkt]

Bumping my ancient thread... would the info found in this document be useful for finding the SDCFG value for my player (assuming the 91xx is similar to the SoCs mentioned in there)?

http://ripz.smartru.com/Gpad/patches/smartq-kernel-patches/patches/smartqv/linux-2.6.28/0012-Merge-telechip-nand-driver-to-kernel-V7003.patch

Especially this part seemed interesting:

Code: [Select]

+#elif defined(TCC92XX) || defined(TCC89XX)
+	#define	HwSDR_FIX		0x07282000
+	#define	HwSDR_RFR		0
+	#define	HwSDCFG_P0		HwSDCFG
+	#define	HwSDCFG_P1		HwSDCFG