How to brick a device

(a.k.a. overclock till death)

WARNING!!! This procedure can permanently damage your hardware!

DISCLAIMER: I'm not responsible for any damage to your hardware caused by reading this document. Nor am I responsible for any damage to your health or your stuff.

Then, you asked for it...

There are various methods to brick a device. Here, I'm not referring to flashing bad firmware or changing settings in bootloader/OS, which can make your device unbootable. This is only child's play and can be (almost) always recovered in some way (at least if you have a JTAG connection to your device).

What I'm referring in this article is overclocking your device until it burns, making it really unusable.

NOTE: I didn't test this procedure as I don't have too much money to waste on buying devices ;-)
However, if you don't want to brick your device you can anyway use it for safe overclocking.

As an example I'm going to explain how to overclock the MPU of a Pandaboard until it gets overheated ...and finally dead. However, almost all cell-phones, tablets, PCs use a similar method.

Pandaboard clocks

A brief reminder of how clocks are distributed on Pandaboard (see section 3.6.3.3.1 of OMAP4430 TRM for further details).

A 38.4 MHz crystal oscillator is connected to pin FREF_SLICER_IN. This is also called SYS_CLK.

SYS_CLK is then routed as reference clock (REF_CLK) to to all DPLLs (DPLL_MPU, DPLL_IVA, DPLL_CORE, DPLL_ABE, DPLL_PER, DPLL_USB).

Every DPLL can be programmed to be locked at any frequency given by the following equation:

Fdpll = REF_CLK x 2 x M / (N + 1)

Where:

Fdpll is the DPLL lock frequency.
M is the software-configured multiplication ratio binary value.
N is the software-configured division ratio binary value

In DPLL_MPU (see TRM section 3.6.3.7.1 ) Fdpll is then routed to the main clock output: CLKOUT_M2

CLKOUT_M2 = Fdpll / (2 x M2)

where M2 is another software-configured division ratio binary value

Here is the basic procedure to lock a DPLL to a certain frequency:

Unlock DPLL (Put the DPLL in MN bypass mode)
set bits[2:0] to 0x4 of CM_CLKMODE_DPLL_MPU register (physical address 0x4A004160)
Wait on bit 0 (must be 0) of CM_IDLEST_DPLL_MPU register (physical address 0x4A004164)
(DPLL is now either in bypass mode or in stop mode)
Disable DPLL autoidle
set bits[2:0] to 0x0 of CM_AUTOIDLE_DPLL_MPU register (physical address 0x4A004168)
Set M,N and M2 values:
- M = CM_CLKSEL_DPLL_MPU[18:8]
- N = CM_CLKSEL_DPLL_MPU[6:0]
- M2 = CM_DIV_M2_DPLL_MPU[4:0]
CM_CLKSEL_DPLL_MPU is at address 0x4A00416C
CM_DIV_M2_DPLL_MPU is at address 0x4A004170
Lock DPLL (Enables the DPLL in lock mode)
set bits[4:0] to 0x7 of CM_CLKMODE_DPLL_MPU
Wait on bit 0 (must be 1) of CM_IDLEST_DPLL_MPU (DPLL is now LOCKED)

Default settings are M=125, N=7, M2=1 which produce a frequency of 600 MHz:

MPU_DPLL_CLK = REF_CLK x 2 x M/(N+1)/(2xM2) = 38.4 MHz x 2 x 125/(7+1)/(2x1) = 600 MHz

How to set different frequencies

Generally, DPLLs are configured in bootloader or BIOS and then left untouched afterwards.

For example, in U-Boot v2014.07, clock settings for Panda are kept in this file:

	u-boot/arch/arm/cpu/armv7/omap4/hw_data.c

The relevant code is kept in this structure:

/*
 * dpll locked at 1200 MHz - MPU clk at 600 MHz
 * OMAP4430 OPP_NOM frequency
 */
static const struct dpll_params mpu_dpll_params_1200mhz[NUM_SYS_CLKS] = {
	{50, 0, 1, -1, -1, -1, -1, -1, -1, -1, -1, -1},		/* 12 MHz   */
	{600, 12, 1, -1, -1, -1, -1, -1, -1, -1, -1, -1},	/* 13 MHz   */
	{250, 6, 1, -1, -1, -1, -1, -1, -1, -1, -1, -1},	/* 16.8 MHz */
	{125, 3, 1, -1, -1, -1, -1, -1, -1, -1, -1, -1},	/* 19.2 MHz */
	{300, 12, 1, -1, -1, -1, -1, -1, -1, -1, -1, -1},	/* 26 MHz   */
	{200, 8, 1, -1, -1, -1, -1, -1, -1, -1, -1, -1},	/* 27 MHz   */
	{125, 7, 1, -1, -1, -1, -1, -1, -1, -1, -1, -1}		/* 38.4 MHz */
};

Each line holds the settings for a particular crystal connected to the chip (in our case 38.4 MHz). The first value is M, the second N and the third is M2 (other values are not relevant for MPU DPLL, so they are set to -1).

For example, if you want to set the CPU at 800 MHz change the last line like this:

	{125, 5, 1, -1, -1, -1, -1, -1, -1, -1, -1, -1}		/* 38.4 MHz */

If you want to set the CPU at some crazy frequency (and finally brick the device!) you have to change the values accordingly.

Keep in mind however that sometimes, when you change frequencies, you also have to properly tweak voltages and PMIC settings.

Have fun and good luck!