SB4200 fails to detect Toshiba Flash

SB4XXX,SBV4XXX.
Locked
kdkool
Junior Member
Posts: 6
Joined: Sun Oct 04, 2009 4:07 pm

SB4200 fails to detect Toshiba Flash

Post by kdkool »

Hi,

I have a SB4200 with a toshiba flash with USB JTAGNT.

What I notice is that if I do a detect, it properly detects the processor and flash device. If I do another detect right after it, it detects the wrong flash. If I power cycle the modem, the right flash is detected again.

Once the wrong flash is detected, an attempt to erase will fail (immediately finishes). If I power cycle the modem, and hit then hit erase, it does seemingly erase the flash. Unfortunately, I have not been sucessful with programming. Reading seems to be working if I power cycle the device after the detect. I have tried all JTAG speeds.

Copyright (C) 2010,2011,2012
USB JTAG NT 0.40d
Target: SB4200
-detect
IDCODE 0334517F
Broadcom BCM3345
IMPCODE 00800908
EJTAG V1, V2.0
DMA supoorted
Found Address= 9fc00000 TC58FVT160
-detect
IDCODE 0334517F
Broadcom BCM3345
IMPCODE 00800908
EJTAG V1, V2.0
DMA supoorted
Found Address= 9fc00000 CFI AMD016
-detect
IDCODE 0334517F
Broadcom BCM3345
IMPCODE 00800908
EJTAG V1, V2.0
DMA supoorted
Found Address= 9fc00000 CFI AMD016
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

kdkool wrote:Hi,

I have a SB4200 with a toshiba flash with USB JTAGNT.

What I notice is that if I do a detect, it properly detects the processor and flash device. If I do another detect right after it, it detects the wrong flash. If I power cycle the modem, the right flash is detected again.

Once the wrong flash is detected, an attempt to erase will fail (immediately finishes). If I power cycle the modem, and hit then hit erase, it does seemingly erase the flash. Unfortunately, I have not been sucessful with programming. Reading seems to be working if I power cycle the device after the detect. I have tried all JTAG speeds.

Copyright (C) 2010,2011,2012
USB JTAG NT 0.40d
Target: SB4200
-detect
IDCODE 0334517F
Broadcom BCM3345
IMPCODE 00800908
EJTAG V1, V2.0
DMA supoorted
Found Address= 9fc00000 TC58FVT160
-detect
IDCODE 0334517F
Broadcom BCM3345
IMPCODE 00800908
EJTAG V1, V2.0
DMA supoorted
Found Address= 9fc00000 CFI AMD016
-detect
IDCODE 0334517F
Broadcom BCM3345
IMPCODE 00800908
EJTAG V1, V2.0
DMA supoorted
Found Address= 9fc00000 CFI AMD016
Try speed 1. Those modems are quite old and fast JTAG speed does not work well. Try speed 2 if needed.
kdkool
Junior Member
Posts: 6
Joined: Sun Oct 04, 2009 4:07 pm

Post by kdkool »

I have tried all JTAG speeds from the GUI. 1 2 or 3, it behaves the same. Anything else I could try?

Thanks
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

kdkool wrote:I have tried all JTAG speeds from the GUI. 1 2 or 3, it behaves the same. Anything else I could try?

Thanks
CFI is more accurate result. Non-CFI is just get the ID of the flash.
kdkool
Junior Member
Posts: 6
Joined: Sun Oct 04, 2009 4:07 pm

Post by kdkool »

I'm sorry, I don't quite understand. Are you saying CFI AMD is a more correct "ID" of the flash device of the Toshiba flash?

From the behavior I noticed, once it detects a "CFI" flash, it fails to erase. I'm guessing that the JTAG state machine is in a strange state. Its as if its missing a TRESET somewhere between transactions.

Is there a manual way of injecting a TRESET?
kdkool
Junior Member
Posts: 6
Joined: Sun Oct 04, 2009 4:07 pm

Post by kdkool »

Or timing is off somewhere between transactions.

I've tried the test on another SB4200 with an intel flash and that seems to work fine. Something weird about the Toshiba flash that causes it to not play well with the USB JTAG NT.

It seems to work fine if I use PJTAG with blackcat / tom's utility.

All I really want to do is inject the original certificates back onto the device. For some reason, I can't load the original 2MB dump I created from USBJTAG with PJTAG. I loaded another 2MB dump but it's not of the original certicates.

I saved the original cfg file (reads out fine of serial / MAC when loaded into umodem). What offsets are the Certificates at so I can inject them with PJTAG?

Thanks!
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

kdkool wrote:Or timing is off somewhere between transactions.

I've tried the test on another SB4200 with an intel flash and that seems to work fine. Something weird about the Toshiba flash that causes it to not play well with the USB JTAG NT.

It seems to work fine if I use PJTAG with blackcat / tom's utility.

All I really want to do is inject the original certificates back onto the device. For some reason, I can't load the original 2MB dump I created from USBJTAG with PJTAG. I loaded another 2MB dump but it's not of the original certicates.

I saved the original cfg file (reads out fine of serial / MAC when loaded into umodem). What offsets are the Certificates at so I can inject them with PJTAG?

Thanks!
Then simple option for you is to type "cfi 0" This disable the CFI and should give you the same result each time.
Locked

Who is online

Users browsing this forum: No registered users and 4 guests