| SB4200 Cable modem |
Motorola SB4200 surfboard
The CPU of the board uses BCM3345. The tool to debug the CPU is EJTAG (DMA).
| Picture showing JTAG connector |
| Flash | One 2MB | 28F160C3T |
| Firmware | 2MB | $9FC00000-$9FDFFFFF |
| RAM | 16MB | $80000000-$81000000 |
| Definition in usbjtag.def | Commands (usbjtag 0.12): |
|
Name=SB4200 Endian=Big Memory=Ram,0,0x80000000,800000 Memory=Firm,1,0x9fC00000,110000 Memory=Cfg0,1,0x9fD10000,10000 Memory=Firm1,1,0x9fD20000,E0000 Programram=0x80400000 Endian=Big IRLength=5 Protocol=EJTAG DMA=Yes ProbTrap=1 DebugMem=0 // watch dog Init=0xfffe0224,0 |
Backup firmware getram 9fc00000 200000 save 9fc00000 200000 Program whole firmware. (Should not interrupt) detect ldram 9fc00000 program 9fc00000 200000 cmpram 9fc00000 200000 cmpram is optional. It can be used after program only when DMA is supported.After that you should see DEBUG ON. You should see "Compair data OK" Rescue SB4200. When box not fire up. Normal programming will not work. You can not use sprogram or erase for SB4200!! ldram 9fc00000(Select the backed up file) poke fffe230c 3 poke fffe2304 0 poke fffe2300 a poke fffe2300 9 poke fffe2300 9 poke fffe2300 9 poke fffe2300 9 poke fffe2300 9 poke fffe2300 9 poke fffe2300 9 poke fffe2300 9 poke fffe2300 1c detect program 9fc00000 200000 cmpram 9fc00000 200000 if cmpram failed, power off and on the box again and do delect program 9fc00000 200000 cmpram 9fc00000 200000 |
