921 only flashes above 0x100000 - not below

BDM (NT) on Star Choice
ivn101
Posts: 13
Joined: Tue Jul 01, 2008 9:23 pm

921 only flashes above 0x100000 - not below

Post by ivn101 » Thu Oct 04, 2012 11:01 am

Hi folks,

I have a 921 loaded with v61 software.
I have a v6D file, all matches, right sizes etc. but I can only erase and flash 100000 and higher (quite succesfully and repeatedly) but NOTHING ever happens below 100000.
The flash never recognized, comes up 9999,9999 so I had to fool it to see it as a AMD AM29F800B-120sc. That seems to partially work.

Any ideas? Is there a trick to go below 100000? I even use "R A7 FFB00000" but still no luck.

Please help!

usbbdm
Posts: 8651
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm » Thu Oct 04, 2012 11:22 am

ivn101 wrote:Hi folks,

I have a 921 loaded with v61 software.
I have a v6D file, all matches, right sizes etc. but I can only erase and flash 100000 and higher (quite succesfully and repeatedly) but NOTHING ever happens below 100000.
The flash never recognized, comes up 9999,9999 so I had to fool it to see it as a AMD AM29F800B-120sc. That seems to partially work.

Any ideas? Is there a trick to go below 100000? I even use "R A7 FFB00000" but still no luck.

Please help!
Setup teamviewer and I can take a look remotely.

usbbdm
Posts: 8651
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm » Thu Oct 04, 2012 2:42 pm

Most likely that the write is not enabled (chip select) for 0-0x100000. Init sequence is needed to enable that.

ivn101
Posts: 13
Joined: Tue Jul 01, 2008 9:23 pm

Post by ivn101 » Fri Oct 05, 2012 6:38 am

Hi,

I promise sometime soon I will set up Teamviewer, just so busy between work and life, no time for what is important.
I usually enter like this:
-reset 1
-init
-flshdct
- erase 0 200000

The screen shows it took the erase command, but the progress bar never ever starts moving.

If I type
-erase 100000 100000
The progress indicator works and then I can type
-sprogram 100000 100000
and it actually works.

Any thoughts? Am I using "init" at the wrong time?

Thank you SO MUCH, your help is appreciated.

usbbdm
Posts: 8651
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm » Fri Oct 05, 2012 7:36 am

Yesterday I pull out the DSR and it works with erase and sprogram. So there should not be a big deal for your box.

ivn101
Posts: 13
Joined: Tue Jul 01, 2008 9:23 pm

Post by ivn101 » Fri Oct 05, 2012 8:15 am

I agree, I am sure there is something I am not doing properly.
I was able to read,flash, and repair a different model DSR, so I know your software and hardware is good.
The other model flashed from 0 to 200000 no problem. The BDM recognized the flash on that box.

The flash on my DSR921 is AM29F800B-120SC. BDM did not recognize, BDM saw 9999,9999. I had to create a flash file for the chip, and ID'd it as the 9999,9999.

I think my trying to fix one problem has created the reason why I can only flash half the memory.
Here is similar flash:
<flash>
<id1>0x1</id1>
<id2>0x225B</id2>
<name>AMD AM29LV800BB</name>
<size>0x100000</size>
<protocol>0</protocol>
<block>
<secnum>1</secnum>
<secsize>0x4000</secsize>
<secnum>2</secnum>
<secsize>0x2000</secsize>
<secnum>1</secnum>
<secsize>0x8000</secsize>
<secnum>15</secnum>
<secsize>0x10000</secsize>
</block>
</flash>

Here is what I created:

<flash>
<id1>0x99</id1>
<id2>0x9999</id2>
<name>AMD AM29F800B-120sc</name>
<size>0x100000</size>
<protocol>0</protocol>
<block>
<secnum>1</secnum>
<secsize>0x4000</secsize>
<secnum>2</secnum>
<secsize>0x2000</secsize>
<secnum>1</secnum>
<secsize>0x8000</secsize>
<secnum>15</secnum>
<secsize>0x10000</secsize>
</block>
</flash>

I can only flash the top half of the chip this way.
I think my problem must be from not properly identifying the AM29F800B-120sc to the USBBDM.

(Is this chip 1Meg (size=0x100000), but software is 2 Meg?)
I must try and find time to do Teamviewer with you.

Thank you for your help and patience.

usbbdm
Posts: 8651
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm » Fri Oct 05, 2012 9:46 am

ivn101 wrote:I agree, I am sure there is something I am not doing properly.
I was able to read,flash, and repair a different model DSR, so I know your software and hardware is good.
The other model flashed from 0 to 200000 no problem. The BDM recognized the flash on that box.

The flash on my DSR921 is AM29F800B-120SC. BDM did not recognize, BDM saw 9999,9999. I had to create a flash file for the chip, and ID'd it as the 9999,9999.

I think my trying to fix one problem has created the reason why I can only flash half the memory.
Here is similar flash:
<flash>
<id1>0x1</id1>
<id2>0x225B</id2>
<name>AMD AM29LV800BB</name>
<size>0x100000</size>
<protocol>0</protocol>
<block>
<secnum>1</secnum>
<secsize>0x4000</secsize>
<secnum>2</secnum>
<secsize>0x2000</secsize>
<secnum>1</secnum>
<secsize>0x8000</secsize>
<secnum>15</secnum>
<secsize>0x10000</secsize>
</block>
</flash>

Here is what I created:

<flash>
<id1>0x99</id1>
<id2>0x9999</id2>
<name>AMD AM29F800B-120sc</name>
<size>0x100000</size>
<protocol>0</protocol>
<block>
<secnum>1</secnum>
<secsize>0x4000</secsize>
<secnum>2</secnum>
<secsize>0x2000</secsize>
<secnum>1</secnum>
<secsize>0x8000</secsize>
<secnum>15</secnum>
<secsize>0x10000</secsize>
</block>
</flash>

I can only flash the top half of the chip this way.
I think my problem must be from not properly identifying the AM29F800B-120sc to the USBBDM.

(Is this chip 1Meg (size=0x100000), but software is 2 Meg?)
I must try and find time to do Teamviewer with you.

Thank you for your help and patience.
No That is the problem. 9999,9999 is NOT the flash ID. Your chip select is not enabled for you to detect the flash. I think the init sequence needs to be changed so you can detect the flash properly. No wonder you cannot erase the flash.

ivn101
Posts: 13
Joined: Tue Jul 01, 2008 9:23 pm

Making some progress, still needing advice!

Post by ivn101 » Thu Oct 11, 2012 9:25 am

Ok, I now can get the flash to be recognized, but every time I try to erase or flash it forgets it.

-reset 1
-init
-R
-flshdct 100000
Found Address= 00100000 AMD AM29F800B-120sc
-r a7 b1000000
-reset 1
-init
-R
-ldram 0
C:/DSR921 Stuff/Using USBBDM/Preferred 921v6D/v6D AllFlash (405) 0-1FFFFF.bin loaded
-r a7 b1000000
-init
-flshdct 100000
Found Address= 00100000 AMD AM29F800B-120sc
-program 0 200000
Detect the flash type first!

It sees the Flash, bu doesn't seem to acknowledge it.

Do I have the memory mapped out properly?

My "READ"s for Allflash look ok, but they all start at 000000, yet I see correct Flash at 100000, and I have no problem erasing and programming from 100000 and up.

Wrong Memory Map Structure?

usbbdm
Posts: 8651
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm » Thu Oct 11, 2012 11:29 am

ivn101 wrote:Ok, I now can get the flash to be recognized, but every time I try to erase or flash it forgets it.

-reset 1
-init
-R
-flshdct 100000
Found Address= 00100000 AMD AM29F800B-120sc
-r a7 b1000000
-reset 1
-init
-R
-ldram 0
C:/DSR921 Stuff/Using USBBDM/Preferred 921v6D/v6D AllFlash (405) 0-1FFFFF.bin loaded
-r a7 b1000000
-init
-flshdct 100000
Found Address= 00100000 AMD AM29F800B-120sc
-program 0 200000
Detect the flash type first!

It sees the Flash, bu doesn't seem to acknowledge it.

Do I have the memory mapped out properly?

My "READ"s for Allflash look ok, but they all start at 000000, yet I see correct Flash at 100000, and I have no problem erasing and programming from 100000 and up.

Wrong Memory Map Structure?
You only detect 0x10000 not 0.

ivn101
Posts: 13
Joined: Tue Jul 01, 2008 9:23 pm

Post by ivn101 » Sun Oct 14, 2012 7:40 am

When I connect to any other box (non-DSR921) the software reads flash and works fine.
But when I connect to the DSR921's (2 of them) it doesn't detect flash, it reports Flashdct has looked at location 000000 and found unknown flash. If I manually make it check 0x100000 it finds the correct flash, but doesn't seem to keep the info and let me erase and program. It says "Detect Flash First".

How can I make either "init" or flashdct see the correct location and acknowledge the flash?

Is there a line somewhere that can/should be changed?

Thanks for the excellent support. :)

usbbdm
Posts: 8651
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm » Sun Oct 14, 2012 8:23 am

ivn101 wrote:When I connect to any other box (non-DSR921) the software reads flash and works fine.
But when I connect to the DSR921's (2 of them) it doesn't detect flash, it reports Flashdct has looked at location 000000 and found unknown flash. If I manually make it check 0x100000 it finds the correct flash, but doesn't seem to keep the info and let me erase and program. It says "Detect Flash First".

How can I make either "init" or flashdct see the correct location and acknowledge the flash?

Is there a line somewhere that can/should be changed?

Thanks for the excellent support. :)
In order to detect the flash properly you need to make the chip select for 0x0 writable. This can be done by the poke command. For the address you need to read manual of MC68331 and find which address it should use.
Since I do not have the exact box, I would suggest you to disassemble the firmware and find out which one is that. Recently I had done almost the same thing for ECU411.

I might be able to help you through the teamviewer but it could take about a few hours remotely. All it needs is a few poke commands in script or put them in the xml and you can then detect and flash this chip.

ivn101
Posts: 13
Joined: Tue Jul 01, 2008 9:23 pm

Still Looking

Post by ivn101 » Thu Nov 01, 2012 5:45 pm

Hey Boss,

Does Part 4.2 of this Doc have what I need to be able to Poke to be able to write for )-100000 of the DSR920/921?

http://www.gndusa.com/upload/gnd/gessbs-1011.pdf

Thanks.

usbbdm
Posts: 8651
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm » Thu Nov 01, 2012 7:20 pm

ivn101 wrote:Hey Boss,

Does Part 4.2 of this Doc have what I need to be able to Poke to be able to write for )-100000 of the DSR920/921?

http://www.gndusa.com/upload/gnd/gessbs-1011.pdf

Thanks.
No. What you need is this "MC68331 User’s Manual". Hope you can find it useful. Document credit to freescale.
Attachments
MC68331Ref.rar
(947.95 KiB) Downloaded 299 times

ivn101
Posts: 13
Joined: Tue Jul 01, 2008 9:23 pm

Here is what I "Think" I understand, so far

Post by ivn101 » Sat Nov 03, 2012 9:37 am

MODE BYTE R/W STRB
0 = ASYNC 11 = Both 10 = Write 1 = DS

DSACK SPACE IPL AVEC
1111 = External 10 = Supv 000 = All* 0 = Off*

So I have 0111011111100000, = (dec) 30688, or (hex) 77E0.

I think this is the number to poke, but I can't seem to find to what address to Poke to. (I am not even sure the above is even correct)
Am I in the right track?

Although I want to do this fast, I also DO appreciate learning why rather than just being "Given a fish". Better to "learn to fish"! :)

Thanks for the help.

usbbdm
Posts: 8651
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm » Sat Nov 03, 2012 10:56 am

ivn101 wrote:MODE BYTE R/W STRB
0 = ASYNC 11 = Both 10 = Write 1 = DS

DSACK SPACE IPL AVEC
1111 = External 10 = Supv 000 = All* 0 = Off*

So I have 0111011111100000, = (dec) 30688, or (hex) 77E0.

I think this is the number to poke, but I can't seem to find to what address to Poke to. (I am not even sure the above is even correct)
Am I in the right track?

Although I want to do this fast, I also DO appreciate learning why rather than just being "Given a fish". Better to "learn to fish"! :)

Thanks for the help.
In the datasheet it has all the address. However if may appear as $ffxxxx and you might need to use $fffxxxx. Try to peek its value first before poke to it. Should not take you a lot of time.

Post Reply