TViX M-6500A (based on SMP8635) eJTAG Debrick Utility request

Started by qinray, 08. Apr 2008, 15:28

previous topic - next topic
Go Down

qinray

08. Apr 2008, 15:28 Last Edit: 08. Apr 2008, 15:32 by qinray
The player TViX M-6500A http://www.tvix.co.kr/Eng/products/HDM6500A.aspx which used SMP8635 chipset has became into brick, is the eJTAG for X300/301 can working for it? If the debrick can not work, what patch we should apply?

TViX 6500A running with full Linux (kernel 2.6.15) with uclibc, about the brick box, you can refer to here: http://forum.opentvix.com/viewtopic.php?f=7&t=47&start=10 for detail, thanks.
Code: [Select]

sh-3.00# uname -a
Linux (none) 2.6.15-sigma #381 PREEMPT Fri Mar 28 20:29:39 KST 2008 mips unknown
sh-3.00# lsmod
Module                  Size  Used by    Tainted: PF
r8169                  26832  0
ufsd                  262176  1
tvixdtvprob             5792  0
rt73                  264512  0
chkusb                  1840  0
utf16conv               5392  0
nlsconv                 4656  0
ide_cd                 40672  0
ide_disk               16368  2
ide_generic              496  0 [permanent]
tangox_pbide            5952  0
tangox_bmide            9520  0
ide_core               98896  5 ide_cd,ide_disk,ide_generic,tangox_pbide,tangox_bmide
em8xxx                841600  4
llad                   95648  11 em8xxx
fipkernel               9760  2
8139too                21248  0
sh-3.00# cat /proc/cpuinfo
system type             : Sigma Designs TangoX
processor               : 0
cpu model               : MIPS 4KEc V6.9
Initial BogoMIPS        : 291.84
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes
ASEs implemented        : mips16
VCED exceptions         : not available
VCEI exceptions         : not available
System bus frequency    : 198000000 Hz
CPU frequency           : 297000000 Hz
DSP frequency           : 297000000 Hz
sh-3.00# cat /proc/meminfo
MemTotal:        90592 kB
MemFree:         23660 kB
Buffers:             0 kB
Cached:          46680 kB
SwapCached:          0 kB
Active:          16868 kB
Inactive:        38032 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:        90592 kB
LowFree:         23660 kB
SwapTotal:           0 kB
SwapFree:            0 kB
Dirty:               0 kB
Writeback:           0 kB
Mapped:          13764 kB
Slab:             8620 kB
CommitLimit:     45296 kB
Committed_AS:    16336 kB
PageTables:        260 kB
VmallocTotal:  1048560 kB
VmallocUsed:    198924 kB
VmallocChunk:   849124 kB
sh-3.00#

mce2222

the tool that is in the wiki is for dumping the flash ... it is not meant for reflashing.

the openwrt debrick tool does not work for flashing either, since it does not correctly initialize the SMP863x CPU.
I created a modified version that you can use to reflash. it should work on all SMP863x based devices because the bootprocess
is always exactly the same.

I will upload the tool to our WIKI probably tomorrow... I am too tired right now ;)

qinray

Thanks mce2222, hope that the tools can ready soon, thanks for your great help!

Regards,
QinRay


the tool that is in the wiki is for dumping the flash ... it is not meant for reflashing.

the openwrt debrick tool does not work for flashing either, since it does not correctly initialize the SMP863x CPU.
I created a modified version that you can use to reflash. it should work on all SMP863x based devices because the bootprocess
is always exactly the same.

I will upload the tool to our WIKI probably tomorrow... I am too tired right now ;)


qinray

Hi mce2222, is there any update on it? thanks.

mce2222

finally found some time to upload the tool.

http://www.t-hack.com/wiki/index.php/Debrick_SMP863x_Device

let me know if it works for you.

qinray

Thanks mce2222, as I'm only have DLC5 JTAG so can not test it, I'll test it after my  Wiggler JTAG is ready, OR hope you can modify a new DLC5 Jtag version  :)

Thanks again!


finally found some time to upload the tool.

http://www.t-hack.com/wiki/index.php/Debrick_SMP863x_Device

let me know if it works for you.

mce2222

it is better to use a DLC cable anyway.
with wiggler cable you often get problems when connecting to SMP863x ... not sure why.

the tool uses DLC cable as default. if you have wiggler cable you need to use the /wiggler parameter

eiza

hi!
i have TViX M-7000A which used SMP8635 chipset and it has became into brick for me.
i have try Wrt54g2 tool but i don´t get it to work.
i don´t have enything in mine flash becuse when i have flash back a older firmware
it only empty the flash and when it shoud flash the new it stop and becom bricked.
i have make me one jtag cabel and test this tool but i only get this result:

C:\wrt54g_o -backup:wholeflash

====================================
WRT54G/GS EJTAG Debrick Utility v4.8
====================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 11111111111111111111111111111111 (FFFFFFFF)
*** Unknown or NO CPU Chip ID Detected ***

*** Possible Causes:
    1) WRT54G/GS is not Connected.
    2) WRT54G/GS is not Powered On.
    3) Improper JTAG Cable.
    4) Unrecognized CPU Chip ID.

now i wonder have i soldit cable wrong ore is it the prog that don´t reed smp 8635?
is there any update on it?
what shoud i do to solve mine problem to get a new firm in mine flash so it work agine?

//eiza

mce2222

if you get FFFFFFFF for CPU ID, then your cable does not work.
you should get something like  8630xxxx  if it works

eiza

hi!
i have check mine cable and i have it fasten it wrong way...
now i get this:
c:\wrt54g_o -probeonly

====================================
WRT54G/GS EJTAG Debrick Utility v4.8
====================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00001000011000110000000000000001 (08630001)
*** Unknown or NO CPU Chip ID Detected ***

*** Possible Causes:
    1) WRT54G/GS is not Connected.
    2) WRT54G/GS is not Powered On.
    3) Improper JTAG Cable.
    4) Unrecognized CPU Chip ID.

i have try:
c:\wrt54g_o -flash:wholeflash and flash:wholeflash /noemw
and so on with no suckses...
i get the same results every time:

CPU Chip ID: 00001000011000110000000000000001 (08630001)
*** Unknown or NO CPU Chip ID Detected ***

*** Possible Causes:
    1) WRT54G/GS is not Connected.
    2) WRT54G/GS is not Powered On.
    3) Improper JTAG Cable.
    4) Unrecognized CPU Chip ID.

is mine memory totaly blocked by tvix fake firms??
is the only solution to bye a new tvix?
i can´t desolder it and reprogram becuse i don´t have
the skill and the nessery tools to do it.
is there any out there that coud help me what to do?

//eiza

mce2222

are you using the tool from our WIKI ?
because the CPU ID is correct, so it should be detected as SMP863x...

you could use /skipdetect to ignore the cpu detection.

and you definately have to use the custom flash options because the presets for -flash:kernel -flash:wholeflash,.... only work for WRT routers.
so try this first, to see if you can read your flash memory... i guess something should be in there  ;)

-backup:custom

and use
-flash:custom

to write the content of a file named "custom.bin" to the flash

most likely you also have to set start and length parameters:
/start:AC000000 /length:XXXXXXXX

length depends on the box...not sure how large the flash of a TViX is.

eiza

Thanks again!

hi, yes i am using tool from wiki Wrt54g2 and giveio.sys from HairyDairyMaid_WRT54G_Debrick_Utility_v48.
what i find out of tvix 6500 and 7000 is it have ram 256 MB and flash size is quite small (64MB on the 65k).
i read on opentvix forum:

This data is located at the begining of the external flash
and is signed with SHA1 algorithm.
The exact structure of the xenv paramters is the following:

0x00-0x03: Size of the xenv datastrcutre (including this 4 bytes and the sha1 hash)
0x04-0x17: SHA1 hash value (20 bytes length)
0x18- : XEN records and values in the following format:

first byte is allways 0x00
second byte is the size of the record (including this and the first bytes)
Name of the record (0 terminated string)
Value of the record

The SHA1 hash is calculated only from the data of the XEN records.

and i also find this about mine briked tvix 7000A:
By your symptoms it sounds as if some data in one of the first two flash partitions is corrupt.

so now i wounder what to doo?
flash new, yes
how shoud i do that, jtag and this prog?
must i flash complet flash ore coud i flash only first flash partitions?
i don´t now if it is the first ore 2:e partitions that are bricked.

if i find some one as have a fake tvix 7000A dumped file that not is briked ore
use a briked one and flash to mine that has empty flash, how shoud i de-brick then?

how shoud i do all of this?
i have windows xp, if linux is needed four this i can install that to, linux version?
prog that i need an so on?

Thanks again four help!   

piranha

My apologies for being offtopic, but I figured you guys may know the answer.

I have a Scientific Atlanta IPN330HD IP-based Set Top Box. It uses the SMP8634 cpu and runs some version of Linux. I believe I've located the eJtag interface (2 rows of 7 pins).

Should I expect this tool to work? Or will I need to modify it slightly?

Thanks,

-Piranha

is0-mick

It should work on any SMP8634 based box.

Mick

eiza

Thanks again!
wat i can see don´t this prog reed Spansion S29GLxxxN memory.
Mine bricked Tvix 7000A need prog that can reed Spansion S29GLxxxN becuse
that all tvix prog is in that memory.
I think tvix block some thing in that memory so i can´t reflash mine Spansion.
Can you make this prog to reed Spansion S29GLxxxN ?
Many shode be happy if you do this.
I have found some thing that i don´t now if it is some help to change youre prog.

//---------------------------------------------------------
// Spansion S29GLxxxN MirrorBit Flash: XJEase device file
// S29GLxxxN.xje Revision: 1.20
// (c)2001-2008 XJTAG Limited
//
// Disclaimer: XJTAG makes no guarantees whatsoever
// about this code.  You use it at your own risk ...
// This code requires XJTAG version 1.4 or later.
//
// This file tests Non-JTAG Flash using TestNonDestructive()(INT result)
//                                      TestDestructive()(INT result)   
//---------------------------------------------------------
// This file covers the whole S29GLxxxN family of Flash
// devices. Select all the appropriate package options
// for your device before running the code.
//---------------------------------------------------------

DEVICE NAME := "S29GLxxxN"

  PINS
    // 56-pin TSOP
    // word mode
    ADDR   := 56, 1, 2, 15, 12, 11, 18, 19, 54, 3, 4, 5, 6, 7, 8, 9, 10, 20, 21, 22, 23, 24, 25, 26, 31;
    DATA   := 51, 49, 47, 45, 42, 40, 38, 36, 50, 48, 46, 44, 41, 39, 37, 35;
    // byte mode : remember to set NYBTE low and change to byte mode commands.
    //ADDR   := 56, 1, 2, 15, 12, 11, 18, 19, 54, 3, 4, 5, 6, 7, 8, 9, 10, 20, 21, 22, 23, 24, 25, 26, 31, 51;
    //DATA   := 50, 48, 46, 44, 41, 39, 37, 35;
    NWE    := 13;
    NCE    := 32;
    NOE    := 34;
    RDY    := 17;
    NRESET := 14;
    BYTE  := 53;
/*
    // 56-pin reverse TSOP
    // word mode
    ADDR   := 1, 56, 55, 42, 45, 46, 39, 38, 3, 54, 53, 52, 51, 50, 49, 48, 47, 37, 36, 35, 34, 33, 32, 31, 26;
    DATA   := 6, 8, 10, 12, 15, 17, 19, 21, 7, 9, 11, 13, 16, 18, 20, 22;
    // byte mode : remember to set NYBTE low and change to byte mode commands.
    //ADDR   := 1, 56, 55, 42, 45, 46, 39, 38, 3, 54, 53, 52, 51, 50, 49, 48, 47, 37, 36, 35, 34, 33, 32, 31, 26, 6;
    //DATA   := 7, 9, 11, 13, 16, 18, 20, 22;
    NWE    := 44;
    NCE    := 25;
    NOE    := 23;
    RDY    := 40;
    NRESET := 43;
    BYTE  := 4;

    // 64-ball fortified BGA
    // word mode
    ADDR := F8, C8, B8, C5, D4, D5, C4, B3, E7, D7, C7, A7, B7, D6, C6, A6, B6, A3, C3, D3, B2, A2, C2, D2, E2;
    DATA := G7, F6, G6, F5, G4, F4, G3, F3, E6, H6, E5, H5, H4, E4, H3, E3;
    // byte mode : remember to set NYBTE low and change to byte mode commands.
    //ADDR := F8, C8, B8, C5, D4, D5, C4, B3, E7, D7, C7, A7, B7, D6, C6, A6, B6, A3, C3, D3, B2, A2, C2, D2, E2, G7;
    //DATA := E6, H6, E5, H5, H4, E4, H3, E3;
    NWE    := A5;
    NCE    := F2;
    NOE    := G2;
    RDY    := A4;
    NRESET := B5;
    BYTE  := F7;
*/
  END;

  DISABLE DEVICE
    NCE := 1;
    NOE := 1;
  END;

  TEST COVERAGE
    ADDR   := SHORTS OPEN HI LO;
    DATA   := SHORTS OPEN HI LO;
    NCE    := OPEN HI LO;
    NOE    := OPEN HI LO;
    NWE    := OPEN HI LO;
  END;
 
  FILES
    "memtestFlash.xje";
    //"DataReader.xje";
  END;
 
END;

/*
// Commands: x8
INT ADDR_UNLOCK_1    := 0xAAA;
INT ADDR_UNLOCK_2    := 0x555;
INT ADDR_AUTOSELECT  := 0xAAA;
INT ADDR_PROGRAM     := 0xAAA;
INT ADDR_ERASE_SETUP := 0xAAA;
INT ADDR_ERASE       := 0xAAA;
INT ADDR_ABORT_PROG  := 0xAAA;
INT ADDR_DEV_ID0 := 0x02;
INT ADDR_DEV_ID1 := 0x1C;
INT ADDR_DEV_ID2 := 0x1E;
*/
// Commands: x16
INT ADDR_UNLOCK_1    := 0x555;
INT ADDR_UNLOCK_2    := 0x2AA;
INT ADDR_AUTOSELECT  := 0x555;
INT ADDR_PROGRAM     := 0x555;
INT ADDR_ERASE_SETUP := 0x555;
INT ADDR_ERASE       := 0x555;
INT ADDR_ABORT_PROG  := 0x555;
INT ADDR_DEV_ID0 := 0x01;
INT ADDR_DEV_ID1 := 0x0E;
INT ADDR_DEV_ID2 := 0x0F;


// Commands: x8 and x16
INT DATA_UNLOCK_1    := 0xAA;
INT DATA_UNLOCK_2    := 0x55;
INT DATA_AUTOSELECT  := 0x90;
INT DATA_PROGRAM     := 0xA0;
INT DATA_ERASE_SETUP := 0x80;
INT DATA_ERASE_ALL   := 0x10;
INT DATA_ERASE_SEC   := 0x30;
INT ADDR_MAN_ID      := 0x00;
INT ADDR_DEV_ID      := 0x01;
INT DATA_WRITETOBUF  := 0x25;
INT DATA_PROGBUF     := 0x29;
INT ABORT_PROGBUF    := 0xF0;

INT MANUFACTURER_ID  := 0x0001;   //Intel

// S29GLxxxN IDs: x16
INT DEVICE_ID        := 0x227E22212201;  // S29GL128N
//INT DEVICE_ID        := 0x227E22222201;  // S29GL256N
//INT DEVICE_ID        := 0x227E22232201;  // S29GL512N
//INT DEVICE_ID        := 0x227E22132201; // S29GL064N model 06/07/V6/V7
//INT DEVICE_ID        := 0x227E220C2201; // S29GL064N model 01/02/V1/V2
//INT DEVICE_ID        := 0x227E22102200; // S29GL064N model 04 (bottom boot)
//INT DEVICE_ID        := 0x227E22102201; // S29GL064N model 03 (top boot)
//INT DEVICE_ID        := 0x227E221D2200; // S29GL032N model 01/02/V1/V2
//INT DEVICE_ID        := 0x227E221A2200; // S29GL032N model 04 (bottom boot)
//INT DEVICE_ID        := 0x227E221A2201; // S29GL032N model 03 (top boot)

// S29GLxxxN IDs: x8
//INT DEVICE_ID        := 0x7E2101;  // S29GL128N
//INT DEVICE_ID        := 0x7E2201;  // S29GL256N
//INT DEVICE_ID        := 0x7E2301;  // S29GL512N
//INT DEVICE_ID        := 0x7E1301; // S29GL064N model 06/07/V6/V7
//INT DEVICE_ID        := 0x7E0C01; // S29GL064N model 01/02/V1/V2
//INT DEVICE_ID        := 0x7E1000; // S29GL064N model 04 (bottom boot)
//INT DEVICE_ID        := 0x7E1001; // S29GL064N model 03 (top boot)
//INT DEVICE_ID        := 0x7E1D00; // S29GL032N model 01/02/V1/V2
//INT DEVICE_ID        := 0x7E1A00; // S29GL032N model 04 (bottom boot)
//INT DEVICE_ID        := 0x7E1A01; // S29GL032N model 03 (top boot)

/*
INT MANUFACTURER_ID  := 0x0020;   //Numonyx/ST

// M29W128
INT DEVICE_ID := 0x227E22212201;    //GH *16
//INT DEVICE_ID := 0x227E22212200;    //GL *16
//INT DEVICE_ID := 0x7E2101;    //GH *8
//INT DEVICE_ID := 0x7E2100;    //GL *8
//INT DEVICE_ID := 0x227E2212228A;    //FH *16
//INT DEVICE_ID := 0x227E2212228B;    //FL *16
//INT DEVICE_ID := 0x7E128A;    //GH *8
//INT DEVICE_ID := 0x7E128B;    //GL *8
*/




CONST INT BUFFER_LENGTH := 0x10; // double if 8 bit wide data bus ?

CONST INT ADDR_BUS_WIDTH := WIDTHOF(ADDR);
CONST INT DATA_BUS_WIDTH := WIDTHOF(DATA);

CONST INT FLASH_SIZE := (1<<ADDR_BUS_WIDTH)*DATA_BUS_WIDTH;

CONST INT BLOCK_LENGTH := (0x10000/DATA_BUS_WIDTH)*8; // For boot sector devices, use larger block size

CONST INT FLASH_PROG_LEVEL_NONE       := 0;  // Flash erased everywhere
CONST INT FLASH_PROG_LEVEL_SOME       := 1;  // Flash programmed enough to verify data/addr bus for opens/stucks and data bus
                                             // for shorts. Ie. Data written to a single block, or small number of blocks.
CONST INT FLASH_PROG_LEVEL_LOTS       := 2;  // Flash programmed enough to data/addr bus for opens/stucks and shorts.
                                            // Ie. Data written to a large number of blocks.

//------------------------------------------------------------------------
// The higher this level is set, the more test coverage will be attained.
// The aim is to set the highest level  possible with the test still passing.
// If the flash is totally erased, the test will only pass if this variable
// is set to FLASH_PROG_LEVEL_NONE.
//------------------------------------------------------------------------
CONST INT FLASH_PROG_LEVEL := FLASH_PROG_LEVEL_NONE;

CONST INT RESULT_PASS := FALSE;
CONST INT RESULT_FAIL := TRUE;

// Globals
INT DEBUG := FALSE;
INT ALL_ONES WIDTH FLASH_SIZE   := ~0[(FLASH_SIZE-1)..0];
INT dataSet WIDTH  FLASH_SIZE;




//------------------------------------------------------------------------
// Includes Read ID test and optional Readonly Data and Address bus tests.
// The optional test only be used if the flash has been sufficiently
// programmed (by setting FlASH_PROGRAMMED to TRUE).
// Much quicker alternative to Destructive test.
//------------------------------------------------------------------------
TestNonDestructive()(INT result)

  INT tempResult;
 
  result := RESULT_PASS;
 
  IF (WRITEABLE(BYTE)) THEN
    SET BYTE := 1;
  END;
  IF (WRITEABLE(NRESET)) THEN
    SET NRESET := 0;
    SET NRESET := 1;
  END;
 
  PRINT("\n\nStarting Read ID test...\n");
  ReadIDtest()(result);
 
  IF (FLASH_PROG_LEVEL > FLASH_PROG_LEVEL_NONE) THEN
    PRINT("\nStarting Non-Destructive memory test\n");
    MemTestNonDestructive()(tempResult);
    IF tempResult = RESULT_FAIL THEN
      result := RESULT_FAIL;
    END;
  ELSE
    PRINT("FLASH_PROG_LEVEL  currently set to FLASH_PROG_LEVEL_NONE\nAlthough the ReadID test excersises the data/addr bus and control lines,\na more comprehensive test can be done by changing FLASH_PROG_LEVEL\nThis can only be done if the flash is progammed (see device file for more information).\n\n");
  END;
 
  IF result = RESULT_FAIL THEN
    PRINT("Non Destructive Memory Test FAILED...\n\n");
  ELSE
    PRINT("Non Destructive Memory Test PASSED...\n\n");
  END;
 
END;

Okey it is not all code, i can´t insert all ore sent the file.

//eiza

Go Up