debrick dp1110

This is JTAG to debrick any JTAG device. Modem, cable boxes, dish boxes routers.
Post Reply
slugworth
Junior Member
Posts: 267
Joined: Sun Feb 17, 2008 1:13 pm

debrick dp1110

Post by slugworth »

Trying to debrick a com21 doxport dp1110 with a variation of the sb4100 debrick script,but usbjtagnt will only program the 1st sector correctly.
Sector 2 and the other sectors get programmed incorrectly.

Code: Select all

poke fffe230c 3
poke fffe2304 0
poke fffe2300 a
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 1c
detect
ldram 9fC00000 fix4100_1.bin
sprogram 9fC00000 40000
ldram 9fc40000 fix4100_2.bin
sprogram 9fc40000 d0000
ldram 9fD10000 fix4100_3.bin
sprogram 9fD10000 10000
ldram 9fD20000 fix4100_4.bin
sprogram 9fD20000 d0000
ldram 9fDF0000 fix4100_5.bin
sprogram 9fDF0000 a000
ldram 9fDFA000 fix4100_6.bin
sprogram 9fDFA000 6000
it's a 2meg sst39vf160 flash chip
the flash chip def says sst39vf1600 if that makes a difference
processor is a bcm3350
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

You should not select SB4100 if your cpu is not BCM3345.
Use erase and spogram for all your sectors. Since SST is not common on modem. After erase use cmpram to make sure it is all blanked before use "sprogram".
I think the flash.xml might not be right thus the erase is not complete.
slugworth
Junior Member
Posts: 267
Joined: Sun Feb 17, 2008 1:13 pm

bcm3350

Post by slugworth »

I thought the sb4100 was bcm3350?
The rca315 setting in usbjtagnt detects 2 flash chips(there are spots on the board for 2 flash chips) but only 1 sst39VF160 is installed.
In usbjtagnt there is no way for me to select just 1 chip.
In ujmodem I have the option of 2meg rca315 or 4meg rca315,so I select 2meg
I have no idea what modem uses what processor,so I selected ones that had the flash address that correctly identifies the flash chip.
I used the sb4100 setting to dump the original flash before I messed it up,that dump may not even be good now.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

slugworth wrote:I thought the sb4100 was bcm3350?
The rca315 setting in usbjtagnt detects 2 flash chips(there are spots on the board for 2 flash chips) but only 1 sst39VF160 is installed.
In usbjtagnt there is no way for me to select just 1 chip.
In ujmodem I have the option of 2meg rca315 or 4meg rca315,so I select 2meg
I have no idea what modem uses what processor,so I selected ones that had the flash address that correctly identifies the flash chip.
I used the sb4100 setting to dump the original flash before I messed it up,that dump may not even be good now.
BCM3345 is for SB4100 I think.
You need 2M configuration for your modem. Modify the XML will work for 2M.
slugworth
Junior Member
Posts: 267
Joined: Sun Feb 17, 2008 1:13 pm

freezes

Post by slugworth »

usbbdm wrote: Use erase and sprogram for all your sectors. Since SST is not common on modem. After erase use cmpram to make sure it is all blanked before use "sprogram".
I think the flash.xml might not be right thus the erase is not complete.
I can only erase the first sector,then it freezes and doesn't erase.

Code: Select all

-detect 
 IDCODE 0335017F
 Broadcom BCM3350
 IMPCODE 008009E8
 EJTAG V1, V2.0
 DMA supoorted
 Found Address= 9fc00000 SST39VF1600
-erase 9fc00000 1000 
 Erase starts...
 Erase time 00:00:00 (.328)
-erase 9fc01000 1000 
 Erase starts...
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

Can you verify that the erase worked?
slugworth
Junior Member
Posts: 267
Joined: Sun Feb 17, 2008 1:13 pm

ff

Post by slugworth »

I erase the first sector and save the 4k bin file to pc,it is all FF's
I then program with a 4k chunk of the original backup,it programs and verifies fine.The second sector fails to erase/program.Speed problem maybe?
The def file for the sst39vf160 matches all others I have seen; 512 sectors of 0x1000 size.
I think there is a block erase for that flash,64k blocks
slugworth
Junior Member
Posts: 267
Joined: Sun Feb 17, 2008 1:13 pm

certain

Post by slugworth »

I can only erase certain addresses, 4k at a time.
Any other address or any other size and the program freezes.
9fc0xxxx
9fc1xxxx
9fc2xxxx
9fc3xxxx
etc. which are 64k blocks but I can only erase 4k of them each.

Code: Select all

-erase 9fc00000 1000 
 Erase starts...
 Erase time 00:00:00 (.187)
-erase 9fc10000 1000 
 Erase starts...
 Erase time 00:00:00 (.328)
-erase 9fc20000 1000 
 Erase starts...
 Erase time 00:00:00 (.953)
-erase 9fc30000 1000 
 Erase starts...
 Erase time 00:00:00 (.609)
-erase 9fc40000 1000 
 Erase starts...
 Erase time 00:00:00 (.468)
-erase 9fc50000 1000 
 Erase starts...
 Erase time 00:00:00 (.593)
slugworth
Junior Member
Posts: 267
Joined: Sun Feb 17, 2008 1:13 pm

blocks

Post by slugworth »

According to the data sheet you can do sector erase or block erase.
The sectors are 4k each and the blocks are 64k each.
Post Reply

Who is online

Users browsing this forum: No registered users and 2 guests