Hardware: Difference between revisions

From Sharpfin
Jump to navigation Jump to search
m (→‎Main CPU: typo)
 
(32 intermediate revisions by the same user not shown)
Line 1: Line 1:
= Radio's =
= Radios =


The Barracuda is used in the the following radios:
The Barracuda is used in [[Radios|these radios]].


* [[AE Wifi Radio]]
If you think you can help build this public information resource, please [http://sharpfin.zevv.nl/index.php?title=Special:Userlogin&returnto=Main_Page create an account]and get involved.
* Bush TR2015WIFI
* [[IMP Magicbox]]
* IMP Adaptor
* [[IR100]]
* Scitec IR-001W


== Hardware Matrix ==
== Hardware Matrix ==
Line 16: Line 11:
= Barracuda hardware =
= Barracuda hardware =


The Barracuda module is a pretty straightforward, but very compact, board with CPU, flash, ram and some interfaceing for audio, buttons and LCD display
The Barracuda module is a pretty straightforward, but very compact, board with CPU, flash, ram and some interfacing for audio, buttons and LCD display


{|
{|
Line 22: Line 17:
| [[Image:barracuda-bottom.jpg|thumb|Back of the PCB]]
| [[Image:barracuda-bottom.jpg|thumb|Back of the PCB]]
|-
|-
| [[Image:Barracuda-board-outline.jpg|thumb|Board outline with numbered pins]]
| [[Image:Barracuda-board-outline.jpg|thumb|Board outline with numbered pins including JTAG]]
| [[Image:barracuda-pinout.svg|thumb|Connector pinout, under construction]]
| [[Image:Processor-pin-types.jpg|thumb|Processor Pin Types]]
|-
| [[Image:barracuda-pinout.svg|thumb|Connector pinout, thanks to rdk]]
|-
| [[Image:Barracuda-layers.jpg|thumb|Composite image showing top and bottom layers]]
| [[Image:Barracuda-layers.jpg|thumb|Composite image showing top and bottom layers]]
|-
| [[Image:Barracuda.jpg|thumb|Original and later Lead-Free versions]]
|}
|}


The Processor board is marked 'Reciva' and 'IRM2' in the silk screen, and contains (mainly) three devices, all manufactured by Samsung.   
The Processor board is marked 'Reciva' and 'IRM2' in the silk screen, and contains (mainly) three devices, all manufactured by Samsung.   


The right image shows a board outline with pin numbers on the pads. These numbers are by no means official, but until we know the exact purpose of the pins, it's handy to give them a number so everybody is talking about the same thing.
The next row of images shows a board outline with pin numbers on the pads. These numbers are by no means official, but until we know the exact purpose of the pins, it's handy to give them a number so everybody is talking about the same thing.  Reciva's application note for the Barracuda module is at http://www.reciva.com/data/barracuda_1.6.pdf.  It contains the official pin numbers and descriptions.


== Diagnostics ==
== Diagnostics ==
Line 35: Line 35:
Diagnostic Captures have been taken to diagnose:
Diagnostic Captures have been taken to diagnose:


* [[Probe Pins]]
* [[Connector Pins]]
* [[Connector Pins]]
* [[Component Pads]]
* [[Component Pads]]
Line 41: Line 40:
== Main CPU ==
== Main CPU ==


* The central one is the main processor, [http://www.samsung.com/products/semiconductor/MobileSoC/ApplicationProcessor/ARM9Series/S3C2410/S3C2410.htm Samsung S3C2410] for which a complete [http://www.samsung.com/Products/Semiconductor/MobileSoC/ApplicationProcessor/ARM9Series/S3C2410/2410UserManual.pdf datasheet] is available
* The central one is the main processor, [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=836&partnum=S3C2410&xFmly_id=229 Samsung S3C2410] for which a complete datasheet has been available. Samsung recently updated their website, and the datasheet is now only available to registered companies.
 
The processor is running at 202.80MHz (MPLLCON=000a1031)


The CPU has the following on-board functions:
The CPU has the following on-board functions:
Line 49: Line 50:
* USB host/device interface
* USB host/device interface
* TFT LCD/STN LCD Controller (16bit, 640x480 maximum)
* TFT LCD/STN LCD Controller (16bit, 640x480 maximum)
* [[JTAG Port]]
* JTAG Port (is TRST Open Drain or Push Pull?)
* ...
* ...


== Smally Tiny12 CPU ==
== Smally Tiny12 CPU ==


There's also an [http://www.atmel.com/dyn/resources/prod_documents/doc1006.pdf Atmel Tiny12L MCU] onboard. No idea what it's doing yet.
There's also an [http://www.atmel.com/dyn/resources/prod_documents/doc1006.pdf Atmel Tiny12L MCU] onboard. There is only a rough idea what it is doing.
 
The sernum daemon uses it to:
 
* create the DES and 3DES keys for the [http://www.g3gg0.de/wordpress/?p=31 reciva:// protocol] using XTEA cipher. (That protocol is e.g. used to get the playlists from the reciva servers)
* get the serial number of the device
* reset the device (not tested yet)
 
Atmel is accessed via a simple serial protocol using these ports:
GPE11  -  SACK (ARM <-  Atmel)
GPE12  -  SDAT (ARM <-> Atmel)
GPE13  -  SCLK (ARM  -> Atmel)
 
At startup the sernum daemon simply mmaps the memory area at 0x56000000 with size 0x100 to directly access the GPIO's at 0x56000040 and 0x56000044.
 
Some standalone tool which access the Atmel and reads serial number, version and calculates some example challenges will soon be uploaded into the SVN repository.
 
 
Another guess is that it controls the booting of the main processor. The big processors often have built-in boot loaders that are accessed by setting pins high or low at reset. This can be controlled with links, but using a tiny processor makes more sense. It could for instance invoke the boot loader at start-up and check for a few seconds to see if there is any communication. If there is some, it lets the boot continue. If there is none it resets the processor, set the links to run mode and the starts the processor. This is much easier than opening the box and setting links/switches!


== Flash ==
== Flash ==


* The top left device is a [http://www.samsung.com/products/semiconductor/NANDFlash/SLC_SmallBlock/128Mbit/K9F2808U0C/K9F2808U0C.htm K9F2808U0C]: 16Mb*8 flash memory
* The top left device is the [[Reciva NAND Flash]], which a [http://www.samsung.com/products/semiconductor/NANDFlash/SLC_SmallBlock/128Mbit/K9F2808U0C/K9F2808U0C.htm K9F2808U0C]: 16Mb*8 flash memory.


== RAM ==
== RAM ==
Line 66: Line 85:
== Schematic ==
== Schematic ==


This [http://sharpfin.zevv.nl/index.php/Image:Barracuda-Schematic-Top.pdf schematic] (work in progress) is an amalgumation of information extracted from several disassembled radios, plus information extracted from the GPL'd source.
This [http://sharpfin.zevv.nl/index.php/Image:Barracuda-Schematic-Top.pdf schematic] (work in progress) is an amalgamation of information extracted from several disassembled radios, plus information extracted from the GPL'd source.
 
== Source Data ==
 
Source files (schematic, drawings, etc...) can be found on the [[Source Files]] page.

Latest revision as of 09:42, 22 September 2010

Radios

The Barracuda is used in these radios.

If you think you can help build this public information resource, please create an accountand get involved.

Hardware Matrix

The radios contain slightly different internal hardware architectures, including different LCDs, Keypads and some different pin connections on the Barracuda module. A Hardware Matrix showing the differences, plus datasheets for the hardware has been compiled.

Barracuda hardware

The Barracuda module is a pretty straightforward, but very compact, board with CPU, flash, ram and some interfacing for audio, buttons and LCD display

Front of the PCB
Back of the PCB
Board outline with numbered pins including JTAG
Processor Pin Types
Connector pinout, thanks to rdk
Composite image showing top and bottom layers
Original and later Lead-Free versions

The Processor board is marked 'Reciva' and 'IRM2' in the silk screen, and contains (mainly) three devices, all manufactured by Samsung.

The next row of images shows a board outline with pin numbers on the pads. These numbers are by no means official, but until we know the exact purpose of the pins, it's handy to give them a number so everybody is talking about the same thing. Reciva's application note for the Barracuda module is at http://www.reciva.com/data/barracuda_1.6.pdf. It contains the official pin numbers and descriptions.

Diagnostics

Diagnostic Captures have been taken to diagnose:

Main CPU

  • The central one is the main processor, Samsung S3C2410 for which a complete datasheet has been available. Samsung recently updated their website, and the datasheet is now only available to registered companies.

The processor is running at 202.80MHz (MPLLCON=000a1031)

The CPU has the following on-board functions:

  • ARM920T core
  • PCM Sound device
  • USB host/device interface
  • TFT LCD/STN LCD Controller (16bit, 640x480 maximum)
  • JTAG Port (is TRST Open Drain or Push Pull?)
  • ...

Smally Tiny12 CPU

There's also an Atmel Tiny12L MCU onboard. There is only a rough idea what it is doing.

The sernum daemon uses it to:

  • create the DES and 3DES keys for the reciva:// protocol using XTEA cipher. (That protocol is e.g. used to get the playlists from the reciva servers)
  • get the serial number of the device
  • reset the device (not tested yet)

Atmel is accessed via a simple serial protocol using these ports:

GPE11  -  SACK (ARM <-  Atmel)
GPE12  -  SDAT (ARM <-> Atmel)
GPE13  -  SCLK (ARM  -> Atmel)

At startup the sernum daemon simply mmaps the memory area at 0x56000000 with size 0x100 to directly access the GPIO's at 0x56000040 and 0x56000044.

Some standalone tool which access the Atmel and reads serial number, version and calculates some example challenges will soon be uploaded into the SVN repository.


Another guess is that it controls the booting of the main processor. The big processors often have built-in boot loaders that are accessed by setting pins high or low at reset. This can be controlled with links, but using a tiny processor makes more sense. It could for instance invoke the boot loader at start-up and check for a few seconds to see if there is any communication. If there is some, it lets the boot continue. If there is none it resets the processor, set the links to run mode and the starts the processor. This is much easier than opening the box and setting links/switches!

Flash

RAM

Schematic

This schematic (work in progress) is an amalgamation of information extracted from several disassembled radios, plus information extracted from the GPL'd source.

Source Data

Source files (schematic, drawings, etc...) can be found on the Source Files page.