Turbo Quattro

Кому нибудь удалось подключиться через jtag к миб , как вычитать флеш без выпайки флешки?

JTAG to where, the J5 or the MMX module (Tegra 2/3) ?

any jtag to read write flash

In MIB there are three flashes.
One is near the J5 - the IPL is in that flash.
The other two are near T20/30 on the MMX board. One is for the efs-system, efs-persist, qb_recovery and qb_primary the other is for app and navi data.
Unfortunately there is little to no info about that board. I know that its nVidia Tegra VCM (Visual Computing Module)
Do anyone have have bsdl for T20/T30.

i need jtag j5 to read s29gl512 , do you know what jtag tool support this board ?

Unfortunately not, i'm also searching about it
What happened to your unit ?
Is all flash erased or just some parts of it?

In the new MIB units there are two images joined together in ifs-root.ifs for the RCC
The first one gets mounted in normal and emergency mode the secondary one gets mounted only in normal mode.
Do anyone knows how to remount it for full access or how to build new one?

Does anyone have photos of the MIB board(s) ?

If you need J5 Ext.Flash I can send you.But you will need to modify the HW Coding block to match your unit,otherwise unit will fail to flash.
Also SWAP certificates will needed to be transfered.

MIB2 MMX Board JTAG pins: 1 TDI
2 TCK
3
4 GND
5
6 TMS
7 TDO
8 VTref

With help of TegraRCM ( https://turbo-quattro.com/showthread.ph ... post642068 ) in UNIX system you need to load alternative bootloader and BCT file for Tegra 30, for example q-boot, because in own bootloader JTAG debugging is disabled. Use command: sudo tegrarcm -- bct mmx.bct -- booloader qboot.bin --loadaddr 0x84000000 (qboot.bin your own bootloader, mmx.bct your cutoff of MMX dump in 0 to 17EF adresses)

qboot.bin https://yadi.sk/d/YrR4ZywIGi3BQQ
mmx.bct https://yadi.sk/d/_Xbre2kQ4HQi8A

After booting qboot and BCT don't reboot MIB.

IN JTAG setting select Cortex-a9, Flash Memory Spansion S29GL512S, base address: 4800 0000
Connecting to target via JTAG
TotalIRLen = 8, IRPrint = 0x0011
JTAG chain detection found 2 devices:
#0 Id: 0x4BA00477, IRLen: 04, CoreSight JTAG-DP
#1 Id: 0x4F1F0F0F, IRLen: 04, ARM7TDMI-S Core
Scanning AP map to find all available APs
AP[3]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x44770001)
AP[1]: APB-AP (IDR: 0x24770002)
AP[2]: JTAG-AP (IDR: 0x14760010)
Iterating through AP map to find APB-AP to use
AP[0]: Skipped. Not an APB-AP
AP[1]: APB-AP found
ROMTbl[0][0]: CompAddr: 80001000 CID: B105900D, PID:04-003BB907 ETB
ROMTbl[0][1]: CompAddr: 80002000 CID: B105900D, PID:04-003BB906 CTI
ROMTbl[0][2]: CompAddr: 80003000 CID: B105900D, PID:04-004BB912 TPIU
ROMTbl[0][3]: CompAddr: 80004000 CID: B105900D, PID:04-001BB908 CSTF
ROMTbl[0][4]: CompAddr: 80005000 CID: B105900D, PID:04-002BB913 ITM
ROMTbl[0][5]: CompAddr: 80006000 CID: B105900D, PID:04-002BB914 SWO
ROMTbl[0][6]: CompAddr: 80020000 CID: B105100D, PID:04-000BB4A9 ROM Table
ROMTbl[1][0]: CompAddr: 80030000 CID: B105900D, PID:04-000BBC09 Cortex-A9
Found Cortex-A9 r2p9
6 code breakpoints, 4 data breakpoints
Debug architecture ARMv7.0
Data endian: little
Main ID register: 0x412FC099
I-Cache L1: 32 KB, 256 Sets, 32 Bytes/Line, 4-Way
D-Cache L1: 32 KB, 256 Sets, 32 Bytes/Line, 4-Way
System control register:
Instruction endian: little
Level-1 instruction cache enabled
Level-1 data cache enabled
MMU enabled
Branch prediction enabled
Memory zones:
[0]: Default (Default access mode)
[1]: AHB-AP (AP0) (DMA like acc. in AP0 addr. space)
[2]: APB-AP (AP1) (DMA like acc. in AP1 addr. space)
Cortex-A9 identified.
J-Link>

How connect jtag to Technisat???

thanks @[CENTER]aleka great work can you also post RCC board JTAG ?[/CENTER]

chris2011 писал(а):thanks @[CENTER]aleka great work can you also post RCC board JTAG ?[/CENTER]

I don't know RCC JTAG pins, but it not need, if you have working MMX Emergency tool.

hrdinaveliky писал(а):How connect jtag to Technisat???

as i know TSD Jtag is LOCKED

Could you open in the emergency menu.

hrdinaveliky писал(а):Could you open in the emergency menu.

yes but then you just get message "device is now broken" :-) , nothing more.

It's not true.

Thanks for the pinout for Tegra @aleka
Does anybody know how to connect MIB2 Delphi via JTag?

Hi aleka,

I managed to kill RCC and MMX on my MIB2.5 HIGH unit (Skoda Columbus).
MMX emergency boot is dead.
RCC still accessible, however no SD/CD/USB can be mounted.

I saw your solution get MMX back.
I also saw a discussion (somewhere else) talking about an emergency button on the bottom of the unit to boot into some kind of emergency mode.
I could locate this button on the PCB. Currently waiting to get the USB dapter to check what's happening (did not want to solder to the unit).

Is this solution similar to yours?

BR

Hi. No, i think without JTAG adapter you can not repair MMX flash.