sb5100 flash wont program, always 0xFF

[suteny0r]

I made the mistake of interrupting the flashing of an SB5100

power cycle, could not be identified by jtagusb

followed the 3.3v instructions. after a few passes, it finally worked... sort of

now can read/write at normal speeds, and seems to succeed, but verify fails.

whatever is written, by program, or sprogram, reading those same bytes always returns 0xff

if i edit the first row of ram, then write it, then read it back, the edits are still there

if i do the same with any flash area, write seems to succeed, read always retursn 0xFF


what can i try next?

ive tried the debrick method included in sb5100 script
ive tried both method 1 and method 2 scripts from here in the forum.

[ivan242]

detect
ldram 9fc00000 (Select the 2mb dump file)
poke fffe230c 3
poke fffe2304 0
poke fffe2300 a
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 1c
detect (if detect couldn't detect flash chip the first time)
program 9fc00000 200000

[suteny0r]

I meant to say usbjtagNT. I just bought the programmer, so it is the latest version, and i'm using .073b of the software

[suteny0r]

detect
ldram 9fc00000 (Select the 2mb dump file)
poke fffe230c 3
poke fffe2304 0
poke fffe2300 a
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 1c
detect (if detect couldn't detect flash chip the first time)
program 9fc00000 200000

This is one of the methods that I tried, which didnt not help

the other, unsuccessful one was:

detect
ldram boot
erase boot
sprogram boot
echo Power off and on SB5100
pause
detect
ldram 9fc00000
program 9fc00000 200000
cmpram 9fc00000 200000

[EuroDJ]

This is one of the methods that I tried, which didnt not help

the other, unsuccessful one was:

detect
ldram boot
erase boot
sprogram boot
echo Power off and on SB5100
pause
detect
ldram 9fc00000
program 9fc00000 200000
cmpram 9fc00000 200000

did u make the hard reset and then
detect and then put the original flash backup dude

[suteny0r]

did u make the hard reset and then
detect and then put the original flash backup dude

if by 'hard reset' you mean 'power off then on, the target', as the script comment indicates.. yes.

multiple times.

[EuroDJ]

if by 'hard reset' you mean 'power off then on, the target', as the script comment indicates.. yes.

multiple times.

no men do this Power ON run a wire from the 3.3v leg of the power rectifier closest to the flash chip.


To pin 1 of the Jtag port (header removed for clarity) (the #1 Pin has a square pad on both sides of the PCB, Top RH in this picture).
Hold it there for a couple of seconds.
Then run the 3.3v wire across each one of the Jtag pins quickly, the lights on the modem will falsh quickly) and you may even see a small spark (normal, but explains why you don't hold the 3.3v wire on the rest of the pins for long, 1 second "hit" is fine)

Leave the modem powered on and connect the Jtag.

now open the JtagUtility or but ever ur using and then try the original backup u did before mod the modem ok

1.detect
2.ldram 9fc10000
3.program 9fc10000 130000

and if u see a writing error try to turn the modem off and quickly connected back fast u can this is the way it work with me on SB5100

[EuroDJ]

if by 'hard reset' you mean 'power off then on, the target', as the script comment indicates.. yes.

multiple times.

no men do this Power ON run a wire from the 3.3v leg of the power rectifier closest to the flash chip.


To pin 1 of the Jtag port (header removed for clarity) (the #1 Pin has a square pad on both sides of the PCB, Top RH in this picture).
Hold it there for a couple of seconds.
Then run the 3.3v wire across each one of the Jtag pins quickly, the lights on the modem will falsh quickly) and you may even see a small spark (normal, but explains why you don't hold the 3.3v wire on the rest of the pins for long, 1 second "hit" is fine)

Leave the modem powered on and connect the Jtag.

now open the JtagUtility or but ever ur using and then try the original backup u did before mod the modem ok

1.detect
2.ldram 9fc10000
3.program 9fc10000 130000

and if u see a writing error try to turn the modem off and quickly connected back fast u can this is the way it work with me on SB5100

[suteny0r]

no men do this Power ON run a wire from the 3.3v leg of the power rectifier closest to the flash chip.


To pin 1 of the Jtag port (header removed for clarity) (the #1 Pin has a square pad on both sides of the PCB, Top RH in this picture).
Hold it there for a couple of seconds.
Then run the 3.3v wire across each one of the Jtag pins quickly, the lights on the modem will falsh quickly) and you may even see a small spark (normal, but explains why you don't hold the 3.3v wire on the rest of the pins for long, 1 second "hit" is fine)

Leave the modem powered on and connect the Jtag.

now open the JtagUtility or but ever ur using and then try the original backup u did before mod the modem ok

1.detect
2.ldram 9fc10000
3.program 9fc10000 130000

and if u see a writing error try to turn the modem off and quickly connected back fast u can this is the way it work with me on SB5100

I smell a troll. :/

[suteny0r]

after doing the 3.3v pin 2 trick, and the script of pokes, i got the flash to identify again, but programming failed. always thought it wrote, and verify showed that it did not.

turns out, the answer was to slow it down to 'speed 2'

works perfectly.

i suspect that perhaps the root cause was that the usbjtagNT can't reliably work at speed 0, with all sb5100s. more importantly, it seems not to be able to tell when it's not successful.

this afternoon, it had bricked a second modem. this one without me having done anything wrong (like interrupting a flash).

I suggest adding this to the debrick faq, and adding to the documentation.

[usbbdm]

after doing the 3.3v pin 2 trick, and the script of pokes, i got the flash to identify again, but programming failed. always thought it wrote, and verify showed that it did not.

turns out, the answer was to slow it down to 'speed 2'

works perfectly.

i suspect that perhaps the root cause was that the usbjtagNT can't reliably work at speed 0, with all sb5100s. more importantly, it seems not to be able to tell when it's not successful.

this afternoon, it had bricked a second modem. this one without me having done anything wrong (like interrupting a flash).

I suggest adding this to the debrick faq, and adding to the documentation.

Speed 2 works when you use DMA mode. If you use non-DMA mode (DEBUG ON) speed 0 works.
This is not problem of NT. It is the CPU is not initialized properly when no boot is programmed. Actually I have tested SB5101 with JTAG clock up to 24M and worked. But if the memory is not initialized then "sprogram" using DMA will run more stable with speed 2.

[suteny0r]

Speed 2 works when you use DMA mode. If you use non-DMA mode (DEBUG ON) speed 0 works.
This is not problem of NT. It is the CPU is not initialized properly when no boot is programmed. Actually I have tested SB5101 with JTAG clock up to 24M and worked. But if the memory is not initialized then "sprogram" using DMA will run more stable with speed 2.

I noticed the bricked modem stayed in DEBUG mode.

what is the proper method to ensure that it does not initialize in DEBUG mode?

btw, are EuroDJ's suggestions as ridiculous and destructive as they sound? Do you ban users for such pranks?

fyi, http://www.virustotal.com/ indicates that both usbjtagNT.exe contains 'suspicous' behavior, and usbjtag.exe in fact, contains malware/trojans. You may wish to investigate, as it casts your product in an unflattering light.

[usbbdm]

I noticed the bricked modem stayed in DEBUG mode.

what is the proper method to ensure that it does not initialize in DEBUG mode?

btw, are EuroDJ's suggestions as ridiculous and destructive as they sound? Do you ban users for such pranks?

fyi, http://www.virustotal.com/ indicates that both usbjtagNT.exe contains 'suspicous' behavior, and usbjtag.exe in fact, contains malware/trojans. You may wish to investigate, as it casts your product in an unflattering light.

If modem is bricked I suggest you debrick it with DEBUG ON. That is much stable to debrick than the non DEBUG mode.
To force it to DEBUG ON mode, use
"tap c"
"tap a ffffffff"
After you see DEBUG ON then detect the CPU and flash, if you can detect the flash, use erase boot
sprogram boot
to program the boot.
Then power off on the modem and you now can use normal program.

Another method is use the script to poke the modem to initialize the memory then you can direct use "program"

Anyway I hope the script comes with the software will help you debrick it properly.

For the software USB JTAG NT no longer play with the host file you I do not know why it is report as an issue. It is simply packed to prevent someone clone again and claim copyright. For old USBJTAG 0.31 (if you can still find it). the host is removed but copyright cannot be removed. It is copyrighted usbjtag.com. Old USB JTAG had been stopped for 1.5 years and I no longer care what it does.

[suteny0r]

I noticed the bricked modem stayed in DEBUG mode.

what is the proper method to ensure that it does not initialize in DEBUG mode?

btw, are EuroDJ's suggestions as ridiculous and destructive as they sound? Do you ban users for such pranks?

fyi, http://www.virustotal.com/ indicates that both usbjtagNT.exe contains 'suspicous' behavior, and usbjtag.exe in fact, contains malware/trojans. You may wish to investigate, as it casts your product in an unflattering light.

Why is the 5100 no-dma, and the 5101 dma?

can this be changed with a console command?

if one way or the other is more reliable, but possibly a little slower, i would have liked the default to be the more conservative of the two

[SIKDIDIT]

Excellent reference material..Thankx for sharing suteny0r.