Reflash with JTAG

Schueler

Newbie

Offline

Posts: 21

Re: Reflash with JTAG

« Reply #30 on: June 07, 2009, 15:25:04 PM »

Ok:

I made two files out off the mtd.bin.
mtd64kbl.bin : lower 64kB ( 0x00000000 - 0x0000FFFF )
mtd64kbh.bin : higer 64kB ( 0x003F0000 - 0x003FFFFF )

Code:

+Ethernet eth0: MAC address 00:00:01:02:03:04
IP: 192.168.123.254, Default server: 0.0.0.0

RedBoot(tm) bootstrap and debug environment [ROM]
Non-certified release, version v2_0 - built 17:35:13, Aug 7 2007

Platform: PC (I386)
Copyright (C) 2000, 2001, 2002, Red Hat, Inc.

RAM: 0x00000000-0x000f0000, 0x00072390-0x000a0000 available
MGB100-RB by Schufti 07/08/07
<press Ctrl+C to enter prompt mode>

RedBoot> ^C
RedBoot> ip_address -l 192.168.1.150
IP: 192.168.1.150, Default server: 0.0.0.0
RedBoot> load -r -v -m tftp -h 192.168.1.90 -b 0x400000 [b]mtd64kbl.bin[/b]
|
Raw file loaded 0x00400000-0x0040ffff, assumed entry at 0x00400000
RedBoot> fl -s 0x400000 -d 0xFFC00000 -l 0x10000
NOR Flash ID = 22a7

[First Sector=0h,Last Sector=0h]

Erase sector.
Programming...
RedBoot>

So far so good...

Next step is to program the upper 64kB ( mtd64kbh.bin ) by using RDC tool...
No problem found and ready to go...

fingers crossed!!!

...uhm ...
nothing on the terminal.
Another difference is the the LEDS at the left are on ( normally blinking 8Hz if an update is expected ).

seems not to be ok..

But...
If I flash the device via RedBoot with mtd64kbl.bin it will be placed at the top of the flash ( 3f0000 - 3fffff )
If I flash the device via RDC with mtd64kbh it will be placed on top of the flash ( 3f0000 - 3fffff )

.... I assume the 64kB lower part should be placed at 0x10000 instead of 0xFFC00000?
I tried to put it at 0x10000 but RedBoot doesn't allow me to do so...

Code:

RedBoot> fl -s 0x400000 -d 0x10000 -l 0x10000
Flash destination error

Ben


	Logged

When does the hurt stop...

schufti

Sr. Member

Offline

Posts: 272

Re: Reflash with JTAG

« Reply #31 on: June 07, 2009, 19:36:28 PM »

Hi schueler,

the bottom part should go to ffc0 0000 with RB, that is ok as it is the start of the flash and where the BIOS jumps to.

the top can be programmed via RDC-loader and goes to FFFF FFFF - filesize automatically, what is the top of the flash (I never found out how to change this in RDC-loader).

you might try to flash that via RB, too.
RedBoot> fl -s 0x400000 -d 0xFFFF0000 -l 0x10000

If I reconsider, maybe better try the first 1 MB for the bottom part to get the whole kernel flashed.

schufti

P.S.: you can check the memory locations in RDC-loader for the flashing to be correct.....
just compare the beginning of the areas (FFC0 0000) with the start of lower part file,
and begin and end of (FFFF:0000, FFFF:FFF0) with start end end of top part file.

p.p.s: memory map is:
0000 0000 - 01FF FFFF RAM
FFC0 0000 - FFFF FFFF FLASH


« Last Edit: June 07, 2009, 19:45:14 PM by schufti »	Logged

I won't answer posts or PMs about repair/recovery after bad flash until proven that the wiki was read and followed!
find all my MGB100 files here, pass: mgb100

Schueler

Newbie

Offline

Posts: 21

Re: Reflash with JTAG

« Reply #32 on: June 07, 2009, 20:36:25 PM »

Thank you for your reply.

I am a bit messed up now, completely forgot the memory map.
Next step is to flash the first 1MB and th last 64kb of the bin file.

Quote

you might try to flash that via RB, too.
RedBoot> fl -s 0x400000 -d 0xFFFF0000 -l 0x10000

This is not working Undecided

Ben

P.S.: I was experimenting with the rdc-loader and found out it was in an area where it was not suppose to be ( 2 x 64kb uploaded ).
That could indeed be the reason why it stopped working. So, to upload the 1MB of the lower part can be the outcome.


« Last Edit: June 07, 2009, 20:43:22 PM by Schueler »	Logged

When does the hurt stop...

Schueler

Newbie

Offline

Posts: 21

Re: Reflash with JTAG

« Reply #33 on: June 07, 2009, 21:20:03 PM »

I tried the 1MB lower and 64kB upper part : result the same as previous.

4032kB lower and 64kB upper part : left LEDS lid on right away without touching the keys...

The last test was successfully loaded although it didn't work.
the lower part was loaded via RedBoot and the upper 64kB via RDC-loader.

@ schufti: the ip address in normal boot of mtd is 192.168.2.1 right ( this is what I read at the wiki )
recovery should be 192.168.123.254.

Ben


	Logged

When does the hurt stop...

schufti

Sr. Member

Offline

Posts: 272

Re: Reflash with JTAG

« Reply #34 on: June 08, 2009, 13:55:35 PM »

Hi schueler,

the LEDs won't change if you don't invoke recovery loader by holding down both keys during powering on the box.

with the complete kernel flashed you should see at least some messages on the serial on normal boot, but with different settings than RB if I remember correct (38400/8/1/n)

I can't remember what settings are in this mtd.bin (default would be same as rec-loader). But if it boots up (LEDs will show meaningfull pattern) you can reset to default by holding both buttons pressed until reboot.

Or just wait what IP your PC gets from the running dhcp and connect to the supplied gateway.

schufti


« Last Edit: June 08, 2009, 14:02:30 PM by schufti »	Logged

I won't answer posts or PMs about repair/recovery after bad flash until proven that the wiki was read and followed!
find all my MGB100 files here, pass: mgb100

Schueler

Newbie

Offline

Posts: 21

Re: Reflash with JTAG

« Reply #35 on: June 08, 2009, 17:35:11 PM »

Indeed, the mtd.bin make the recovery tool available so the two bottun "trick" should work.
but, as I mentioned...

If I push the two button's the four leds lid op and nothing happens on the terminal. Even ping to 192.168.123.254 doen.t respond.
When I don't push the buttons at boot, same thing... leds lit up ans no response to whatever.

The uart is 38400/8/n/1.
If the device uart has a different baudrate, I should see at least garbage on the terminal right?

I wrote in the wiki that the version I have is probably version two too.
Maybe that makes a difference?

Ben


	Logged

When does the hurt stop...

Ernst

Full Member

Offline

Posts: 112

Re: Reflash with JTAG

« Reply #36 on: June 08, 2009, 18:40:38 PM »

Just for the record; I have a version 1.0 HW (real unbranded Amit MGB100) and a version 2.0 and had a very careful look and the only difference I saw is the missing R24.

I also believe that only SMC has this marking HW V2.0 on their box so it might even be some internal SMC note.

Ernst


	Logged

Pages: 1 2 [3] Go Up

« previous next »

	Author	Topic: Reflash with JTAG (Read 3363 times)
0 Members and 1 Guest are viewing this topic.