Unable to verify forceware firmware with BCUSB

[D3m0n]

Unfortunately , i am working away from home and will only be back on Friday , so i do not have any access to my files.
Have you managed to get hold of a multimeter ? I would like you to give me the VCC of the pins 1,3,5,7 & 9 .with the software running , but not connected to the modem.

 

[bushe777]

No, unfortunately I still can't get a multimeter, the person that has one haven't been able to find it, but how exactly do I get this info? I put one probe directly on the pin and the other probe where? I haven't done that before really.

Another command I can use is Memory.ReadVerify, I use it like this:
Memory.ReadVerify(0,8388608) and gives this log:
Opened file for writing: Spansion_S25FL064_00-7FFFFF.bin (binary hex format), total file size: 8,388,608 bytes
Beginning memory read from SPI Flash
Start address: 0 (0x00) Length: 8388608"
Read operation complete
Read 8388608 bytes in 29.271 seconds, 286,594 Bytes/s
Beginning memory read from SPI Flash
Start address: 0 (0x00) Length: 8388608"
Read operation complete
Read 8388608 bytes in 29.311 seconds, 286,213 Bytes/s

Could you help me with the command Memory.Write, example says Memory.Write(dataVar,0,256) what do I put on dataVar?
Memory.Write(0x00,0,256) if I put that is says "error in Memory.Write: data type in argument 0 is not Bytes"

 

[bushe777]

Memory.EraseSector(0) somehow worked twice but not completely, if I turn it off and on it returns to the same flash it has always had. And if I didn't turn it off and write the 8mb dump it stills gets the mismatches, and it appears that not everything is FF's as I scrolled down.

In both cases I wasn't able to get rid of the first two bytes EA 1F

 

[bushe777]

Paying more attention to the mismatches what they really mean is that the byte is going to write gets compared by reading what byte was there before, for example:

Address 0x40004: wrote 0xF3 and read 0x1D (64496 mismatches)

If I hex edit the dump and go to address 0x40004 on the 8mb backup the byte is 1D and on the 8mb forceware backup the byte is F3, so if modify the 8mb forceware backup from byte F3 to byte 1D on address 0x40004 and try to flash it I stop getting this mismatch on that address but get new mismatch on the next address 0x40005 and one less mismatch overall (64495 mismatches), so basically all I'm doing is comparing dumps, same theory goes to "flashing the original backup" no mismatch happens but all it did was comparing and saying "ok they are the same" but it didn't actually flash it onto the chip, hence that is why I can't go back to virgin state. It also can be applied to flashing after miraculously being able to use the Memory.EraseSector(0) it will only compare it and the read will say "0xFF" and that it wrote whatever byte was supposed to be for the forceware dump.

Is there a chance I mess up a setting? or that I should change?
If the bcusb is not connected to software I see this tab "SPI settings" the one that interests me more is the check box for "Use enable write status" and an address "0x50" what does that means?
When I connect the BCUSB this tab disappears so I can't change anything when the device is connected, there are commands like SPI.Fosc to change clock divider and SPI.mode or SPI.order that I can change through the console commands when the bcusb is connected, but there is no command for "enabling write status" and as this point you know that strangely enough I can only "read" the flash but can't "write" to it. There are other addresses for "Sector Erase" and "Write Enable", do you a better idea on how I can take advantage of all this settings. Maybe I could try other program mode or something that is on this settings but not able to change when the device is connected.

 

[D3m0n]

Apologies for the late reply , been rather busy at work. There is nothing you can change in the SPI settings tab as your flash gets detected as it should . From what we can see it is not erasing properly , thus will not program properly.
Any luck on checking the VCC of the pins i asked for yet ? We need to determine if it is the programmer or something else causing this issue .

 

[bushe777]

Don't worry, I was away too. I wasn't able to get the voltage from the pins so that info will be uncertain still. I will be able to test a usbjtag nt but I will need to wait some days for some wires to get shipped to me, I will post how it went.

 

[bushe777]

After a long wait I finally have the usb jtag nt, but to my bad luck it has the same behavior of only being able to read the flash but not able to write to it at all

I uploaded the backup I got with the usb jtag nt and also compared it on hex with the backup I made with the bcusb, they match 100%.

I can only assume that maybe the modem may have something wrong, because I now have another device and different cables and same results, it is just really confusing that I can backup but not flash it. Any ideas to what I can do with the usb jtag nt?

 

[bushe777]

The problem is that I'm stuck on the programming part, this is what happens:

-flshdct 0
Found Address= 00000000 25FL064A
-ldram 0
C:/Users/.../Desktop//Spansion_S25FL064_00-7FFFFF (8 meg dump).bin loaded
-program 0 800000
Erase starts...
Erase time 00:00:00 (.055)
Program Starts...

Erase time takes less than a second and it gets stuck on programming.

If I release the clip from the chip while it is on "Program Starts..." the programming gets unstuck:

Program Starts...
Program speed 11.44 KB/s
Program time 00:05:38 (.109)
Program pass, if no further programming needed, power off/on the target

But obviously it won't write anything since the clip is disconnected.

Do you know what other commands I could use to rescue the SB6120, I found this commands on usbjtag website for the SB5100:

Rescue SB5100. When box not fire up. Normal programming will not work. First need to program boot
(if method 1 does not work use method 2)
Method 1.
detect
ldram 9fc00000(Select the backed up file)
poke fffe230c 3
poke fffe2304 0
poke fffe2300 a
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 1c
program 9fc00000 200000
cmpram 9fc00000 200000
if cmpram failed, power off and on the box again and do
delect
program 9fc00000 200000
cmpram 9fc00000 200000
 
Method 2.
detect
ldram boot (Select proper boot file)
erase boot
sprogram boot (Slow programming)
Power off and on SB5100
detect
ldram 9fc00000(Select the backed up file)
program 9fc00000 200000
cmpram 9fc00000 200000

How could I apply this to the SB6120, what offsets should I use?

I found a video on youtube, this one ->

That makes this commands:

-tap c
-tap a ffffffff
-peek 9fc00000
-ldram boot
-erase boot
-sprogram boot
-ldram 9fc00000
-program 9fc00000
-program 9fc00000 200000
-cmpram 9fc00000 200000

But when I try "tap c" it says bad command.

 

[D3m0n]

Tap commands and poke commands are not used on SPI devices , therefore you will get the bad command .
Does flashing work on any other SPI device you have , that way we can see it if is indeed an issue with the modem .

 

[bushe777]

No luck with that, I don't have another SPI device to try flashing. I only tried flashing another device that uses JTAG port, with successful results.

The only thing I found different is that in the software it doesn't say "DEBUG OFF" in the bottom part of the window as shown on videos where they flash the SB6120 with USBJTAG NT, in my case it says "NO DEBUG", I don't know if this could make a difference since both terms refer to not be in debug mode but I'm sure why it says that instead of DEBUG OFF, I have used several versions of the software and it always says NO DEBUG.

 

[D3m0n]

Mine remains at NO DEBUG as well that is not an issue. Try loading the full dump and using the command " sprogram 0 800000 and see if that programs at all.

 

[specialist]

load boot
sprogram boot
load flash
sprogram 9fc00000 200000
done

 

[jd02902]

Using your existing original dump , i have pre-loaded Forceware for you , so you just have to write this on the SPI Flash tab.

Hi D3mon, I like to know how you inserted force ware into his original dump? Did you write force ware to a specific memory block on his original dump? Can the flash cat software do that and if so, please point me to the right direction. Many thanks