need help unbricking an Allworx 9112 VOIP phone

This is JTAG to debrick any JTAG device. Modem, cable boxes, dish boxes routers.
Post Reply
zippydan
Junior Member
Posts: 8
Joined: Thu Dec 11, 2014 10:36 pm

need help unbricking an Allworx 9112 VOIP phone

Post by zippydan »

I have received my USBJTAG NT.

I have installed the drivers and my Windows PC seems to recognize it.

I have connected the device to my JTAG headers on the phone.

Now what?

Problem
I have several Allworx VOIP phones that periodically update their firmware from a central server. Over the years I have lost some phones either because of bad flashes or because users have unplugged the phones during flashing. The phones still power on (power lights come on), but don't respond or show anything on their screens.

Here are some pictures of what the phone board looks like: http://imgur.com/a/i55O8

Expected Solution
Since I have many identical phones that are working, I was hoping I could use the JTAG interface to connect to a working phone and then download the flash memory contents to a file.

Once I have an image from a working phone, I am hoping that I can connect to a "bricked" phone and manually reflash them with the working image.

How can I do this?

Feeble Attempts
I tried connecting the USBJTAG NT to a working phone.

How do I know if the device is succesfully reading from the phone?
  1. When the USBJTAG NT software first came up, I left the default configuration which seems to be MODEM / EJTAG / Ambit120. No idea if this was correct.
  2. At the bottom of the window, it says "USB Connected".
  3. I clicked the DETECT CHIP ID button. A blue bar moves at the bottom of the window. It seemed to work.
  4. I clicked the READ FROM CHIP button. It seemed to work.
  5. I clicked the VERIFY DATA button. It seemed to work.
Now I'm assuming I can just click "SAVE" and save the read data to a .bin file. Then I would connect the bricked phone and choose ERASE CHIP and then WRITE CHIP?

It all seems to work, but there are SO MANY OPTIONS, I'm not sure if I'm doing this right.

I got the following Output in my initial test:

Code: Select all

USB JTAG NT 0.74
Target: Ambit120
-detect
IDCODE 00000000
-getram 9fc00000 200000
Time 00:00:08 (.601)
-cmpram 9fc00000 200000
Time 00:00:08 (.576)
Compare data OK
-save Ram
Edit Followup
Ok. Ya I really don't understand what I'm doing because I unplugged the USBJTAG NT from the phone and did a DETECT CHIP ID and READ FROM CHIP and it still worked! Just a little slower...

Code: Select all

-detect
IDCODE 00000000
-getram Ram
Time 00:00:34 (.318)
-ldram Ram
-cmpram Ram
Time 00:00:34 (.304)
Compare data OK
Now, I noticed that there are no longer any memory addresses after "Ram", so maybe that is how I know it is not connected any longer? It still seems like it should bring up an error instead of successfully reading "nothing".
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

To be able to debrick you need to know something basic.
What kind of CPU this box has? Based on the pic I do not think it is MIPS based.
This is step one.
Then we need to find the memory map of the device and see if we can detect and erase the flash.
zippydan
Junior Member
Posts: 8
Joined: Thu Dec 11, 2014 10:36 pm

Post by zippydan »

I looked up all the chips that seemed important and came up with this list:

Marvell 88E6021-RCJ Ethernet Controller
Texas Instruments TMS 320VC547 Digital Signal Processor
Pulse H2009 Power Over Ethernet
Intel TE28F160 C3BD70 Flash Memory
Micron 48LC2M32B2 64MB SDRAM
Cooper Industries CTX01-16679 Power Inductor
Texas Instruments TLV320AIC22C Audio VOIP Coder/Decoder

Which of those would be the CPU? It seems it must be one of the TI chips?
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

http://forums.anandtech.com/showthread.php?p=37469176

It's the TMS320VC5471.

It has an ARM7TDMI microcontroller alongside the DSP.

There is very limited support for ARM7 on USB JTAG NT. Simply I do not have a lot of target to test.
zippydan
Junior Member
Posts: 8
Joined: Thu Dec 11, 2014 10:36 pm

Post by zippydan »

usbbdm wrote:http://forums.anandtech.com/showthread.php?p=37469176

It's the TMS320VC5471.

It has an ARM7TDMI microcontroller alongside the DSP.

There is very limited support for ARM7 on USB JTAG NT. Simply I do not have a lot of target to test.
Ha! That is my AnandTech thread :)

Does that mean it is not possible?

Can I send you a working sample?
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

Sure it is possible. It just needs some serious develop time to fully support ARM7.
zippydan
Junior Member
Posts: 8
Joined: Thu Dec 11, 2014 10:36 pm

Post by zippydan »

usbbdm wrote:Sure it is possible. It just needs some serious develop time to fully support ARM7.
I am assuming you are the developer, so the question is: is this something you are interested in doing? What is my next step? Give up? Wait? As I said, I have a spare working board that I could send you. I don't need "full" support (though I'm not really sure what that means, so maybe I do), I just need to be able to copy the firmware off a working device and write it to a bricked device.
zippydan
Junior Member
Posts: 8
Joined: Thu Dec 11, 2014 10:36 pm

Post by zippydan »

Hello there
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

I think adding support to this phone is possible but needs some development and I am not sure if it is worth the effort. ARM7 are too old. I have done some ARM9 work and several targets are supported.
zippydan
Junior Member
Posts: 8
Joined: Thu Dec 11, 2014 10:36 pm

Post by zippydan »

usbbdm wrote:I think adding support to this phone is possible but needs some development and I am not sure if it is worth the effort. ARM7 are too old. I have done some ARM9 work and several targets are supported.
Is there not quite a bit of overlap in the architectures?
zippydan
Junior Member
Posts: 8
Joined: Thu Dec 11, 2014 10:36 pm

Post by zippydan »

zippydan wrote:Is there not quite a bit of overlap in the architectures?
If you have already done some work with ARM9, I'm betting that ARM7 isn't that different. I've already bought your USBJTAGNT device, so you have already made some money off me. I'm willing to put up some more money to see if you can get me just basic read/erase/write functionality on this ARM7 memory. I could put up $100 USD for 4 hours of your dev time toward this project, plus send you a working sample. After that, you can see how much more difficult it would be to continue, and maybe give an estimate of how much more work it would take to finish.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

Check your PM.
Post Reply

Who is online

Users browsing this forum: No registered users and 9 guests