JTAG Manager Version 1.60, RIFF Box Firmware v1.39, eMMC support

[legija]

12.04.2011 QUALCOMM NOT Generic DLL-s update:

• QSC1100_X14_NOR,
• QSC60XX_L18_D08_NOR,
• QSC60XX_L20_D08_NOR,
• QSC60XX_L24_D08_NOR

Whats new:

• Added support for NOR Chips which have Intel/Sharp Extended Command Set (according to the CFI specification)

This means any NOR flash chip which is manufactured by CFI standard (it means all NOR flash chips) will be supported with above listed DLL-s. There is no need to update DCC Loaders for single flash chip ID, since configuration data are obtained from CFI.

[legija]

20.04.2011 JTAG Manager v1.31, RIFF Box Firmware v1.23 released


Whats new :


JTAG Manager 1.31

• “RUN/STOP” Loaders functionality is added (and alternative to the DCC Loaders)

This is required for some ARM7 cores when Debug Communication Channel (DCC) to/from core is not functional (like in MSM6000)


Firmware 1.23

• Added 8/16/32-bit bus read/write access rotuines for ARM7 core
• ARM7 debug is now available in ARM/Thumb modes (use the GDBServer for this);

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

[legija]

21.04.2011 JTAG Manager 1.32 released
---------------------------

• Resurrector DLLs can now request current Memory Chip IDs

This is most usefull for NOR-based devices since sometimes such devices require different firmware for different NOR memory chip IDs. Thus resurrector DLLs will be able to perform automatic selection of resurrection data.

[legija]

Firmware 1.24
---------------------------
- The Most Annoying RIFF Bug (THE BUG) is Fixed Finally!!!
During flashing operations both RIFFBOX and JTAG Manager were frozing while DATA LED was blinking constantly.

[legija]

Firmware 1.25
---------------------------
- added 5.0V USB Power On/Off controlling feature
- changed sequence for 32-bit write accesses for ARM11 core (MSM8xxx support)


JTAG Manager 1.33
---------------------------
- Improved connection policy:
Resurrection/DCC connection to device is implemented in such way that JTAG speed changes have 2 stages - booting stage and working stage.
Booting stage is the one from the connection start and until the DCC Loader upload is complete. Booting TCK/RTCK speed are setup
by JTAG Manager no matter what are the TCK settings by user (JTAG TCK Speed field in the JTAG Manager). Booting speed is hardcoded in the DLL.
After "booting" stage is complete, the "working" speed is set - the one which is selected by user in the JTAG TCK Speed field.
If Booting Speed in resurrector DLL is hardcoded as 'RTCK' the JTAG Manager would always use RTCK mode during booting stage.
Now policy is changed that is when user selects a fixed TCK frequency the JTAG Manager will automatically
change booting speed to the fixed TCK too.
- fixed bug: if "Use End Address" and "AutoFull Flash Size" were checked there was error setting valid length to read.
- for Advanced Users: advanced settings are now moved from the DCC Read/Write page ("Notifications...") into separate button on Box Service page (Advanced Settings button)
- added 5.0V USB Power On/Off controlling feature
For this go to Box Service page, click Advanced Settings: the Notifications dialog will be displayed,
go to "Advanced Settings" page and set desired mode for "Enable 5.0V output" checkbox.
When enabled, 5.0V power will be on after any "JTAG" operation executed and will remain "ON" until
box restart or until "Enable 5.0V output" checkbox is unchecked and any "JTAG" operation is executed.
- added optimization for flashing memory devices which are sector-based (like MDOC H3 or MMC/SD memory cards)
- if error code 0x3C (write-protect) is received no recover attempts are made.

[legija]

29.07.2011 JTAG Manager v1.34, RIFF Box firmware v1.26 – Cortex-A9 Dual core support added ! GDB Server v1.04
Whats new :
RIFF JTAG Manager v1.34:

• JTAG Manager Project has been migrated into UNICODE.

Main advantage of this – GUI (captions of buttons, labels, etc) can now support all international characters, for example chinese
WARNING!!! Due to UNICODE migration old plugin DLLs are not compatible with JTAG Manager 1.34
Simply download new set of plugins which are unicode compatible now.

• Multilanguage GUI is implemented (and due to migration to UNICODE even chinese language can be fully supported)

You need to download language pack dll, for example Russian.dll. After installation go to BOX SERVICE page and there will
be available language selection.
Following items are translated into selected language by the language DLL:
1. JTAG Manager interface – labels, captions, etc.
2. JTAG Manager messages which are shown during active operation.
3. Most of messages shown by resurrector DLLs
4. Some of Resurrection Manuals (if current version of language pack does not have translated version of Resurrection Manual, then an original, English version will be shown)

• A dded warning window which will appear on DCC Read/Write page in case user tries to flash full dump with wrong settings.

So user can check what he does wrong and thus avoid losing time and making mistakes.

• ARM Core Cortex-A9 (Single and MPCore) and Chipset OMAP4430 (Dual-core Cortex-A9) are addred to the supported cores list;
• Cortex-A9 core added to the CMM Script Engine: Example: SYSTEM.CPU CORTEXA9
• OMAP4430 core added to the CMM Script Engine: Example: SYSTEM.CPU OMAP4430
• Multicore control is added to the CMM Script Engine (Use CORE.SELECT instructions to switch between cores in multicore targets)

For example CORE.SELECT 0 will select core0, CORE.SELECT 3 will select core3

• Added access (32-bit Read/Write) to the APB bus of CoreSight-compatible targets (Cortex-A8, Cortex-A9, etc.)

through the CMM Script Engine (‘APB’ segment specifier added)
Thus, for example instruction: &Resp=data.long(APB:0×12345678) – will read dword from APB bus at address 0×12345678

• Added SYSTEM.CONFIG.RESETTIMEOUT variable to the CMM Script Engine, thus it’s now possible to customise reset type and timeout

by setting this variable prior SYSTEM.UP command.

• Fixed bug which caused saving trash after read operaions on DCC Read/Write page in these cases:

a) reading was stopped by user
b) after JTAG Manager exe restart

• DCC Read/Write Page operations now allow 64-bit addressing, thus user can have full access to memory devices which size exceeds 0xFFFFFFFF bytes range.

For this, the Address and Length fields have now 10 digits instead of old 8 digits. Be carefull entering values there.
UNEXPERIENED USERS PLEASE NOTE: For example 8 digit hex value 0×12345678 entered into 10 digit field IS NOT 0×1234567800 (!!!!!) CORRECT IS 0×0012345678

• TGauge64 component was implemented in order to support full 64-bit range of progress indications (while old progress bars were limited to 31-bit maximum value)
• Fixed bug with incorrect display of scrollbars during scroling through Model and Manufacturer Lists
• Fixed bug during erase:
  If bad block happened, and user choosed Ignore method and checked ‘Remember selection’ – software would again popup selection dialog on next bad block.

• JTAG I/O Voltage (for Custom Target Settings) now has voltages from 1.6V upto 3.30V with resolution 0.05V
• Just for convenience added button “Target Continue” to the JTAG Read/Write page.
  This just allows to resume target running from current PC value without need to enter it explicitly into “Address” field as is needed for the “Target GO” button

RIFF Box firmware v1.26 :

• Added support for Cortex-A9 single processor core;
• Added support for Cortex-A9 multiprocessor cores. Multicore handling rules are following:1. After target reset (NRST=1-0-1) the Core0 is automatically selected;2. HALT operation halts only currently selected core (by default core0 is selected); Thus in order to halt other core user has to select required core and then execute halt operation.
  3. Reset operation can accept different strategies of reset and halt:
  - Reset, then halt all cores at the very first instruction (for now only for OMAP MCUs)
  - Reset, than halt only core0 at the very first instruction (for now only for OMAP MCUs)
  - Reset, pause, then halt all cores
  - Reset, pause, than halt only core0
  4. RUN operation starts only currently selected core.

Thus in order to start other core user has to select required core and then execute run operation.
For example, if target has 4 cores (Quad-core MCU), then after HALT operation only Core0 is halted.
To halt Core2 user has to write script:
CORE.SELECT 2
BREAK
For example, to run Core3 user has to write script:
CORE.SELECT 3
GO

• Added H/W script (*.has) instruction which enables selection of core for multiprocessor targets;
• Added script (CMM/HAS) access (32-bit Read/Write) to the APB bus of CoreSight-compatible targets (Cortex-A8, Cortex-A9, etc.)
• Added support for OMAP4430 Dual-core Cortex-A9 MCU

RIFF GDB Server v1.04 :

• Fixed bug with reset timeout – erroneously value in Edit field was taken as HEX not decimal, Now is ok
• Added few more GDB commands for compatibility with IDA 6.1 remote debugging.
• Added Thumb2 instruction TBB and TBW for single stepping
• Fixed bug in Thumb/Thumb2 when stepping out of sub when POP {RegList, PC} is used (In Thumb mode return PC address is 0×01 ORed)

Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

[legija]

04.08.2011 JTAG Manager v1.35 released

Whats new :

• Added an arbitrary feature “Settings by Code” to the DCC Read/Write page.

Main purpose is to improve support quality for users: via “Settings Code” string a supporter person sees all settings which were set by user on the DCC Read/Write page.
Though, end-user may benefit from this too: Use “Settings Code” string for JTAG Manager to automatically setup all DCC Read/Write settings

• Fixed data loss during read and save operations in case there is not enough disk space available to store required amount of data.

(for example reading full on DCC Read/Write page, or saving read full, etc).
Now available disk space checks are performed prior disk write operations.


Please click “Check For Updates” button in order to download and apply new files. Closing all running application before starting update process is recommended.

[legija]

JTAG Manager 1.36
---------------------------
- added fast presets for automatic selection of settings for most common operations on DCC Read/Write page
For this click Settings by Code button and select a desired preset from list and then click Apply Settings.
For example if user selects "Write Full Image into NAND memory" the valid settings on the DCC Read/Write page
for writting full images into devices with NAND memory will be automatically selected
- fixed serious bug which caused resurrector DLLs which do upload data into RAM to upload broken data
For example DLLs which start Downlad Mode directly use this feature.
- added feature to accept text name of memory chip from DCC Loader and display it (currently used to display eMMC memory product name)
- fixed bug for resumming interrupted DCC Read: ifvcurrently cached file size was greater than > 2GB
(that is if read was interrupted on point when there was already more than 2GB of data read) the new reading data was not appended to the readout file end, but instead the file was corrupted.
- fixed bug for saving big files (after reading on DCC Read/Write page): if size exceeded 0x7FFFFFFF bytes JTAG Manager show no free disk space error.
- added TEGRA2 chipset selection in the Target list
- fixed an issue with the resurrection progress bar: in some cases during resurrection operations the progress bar would always stay at 0%.


Firmware 1.27
---------------------------
- added TEGRA2 debugging support (dual-core Cortex-A9)
- added new breakpoint type: "address mismatch" which allows geniune single-stepping on Cortex-A8,A9 (CoreSight) targets
(thus GDB Server can now perform low-level single step commands)

[legija]

JTAG Manager 1.37
---------------------------
- fixed bug which caused not to report improper firmware version of riff box
- (SDK): more functions are now available (exported) for future Resurrector DLLs;


Firmware 1.28
---------------------------
- added few more H/W script (*.has) instructions;
- added some security extensions for Xperia repair;

[legija]

19.11.2011 - QUALCOMM MDM6600 NAND Generic DLL released

Whats new:

• QUALCOMM MDM6600 NAND DLL

Use this for phones which have MDM6600 in baseband - eg LG P999, iPhone 4s, and many other phones which use TEGRA2 AP CPU.

• QUALCOMM MSM7227 OneNAND DLL (2kb page)
• QUALCOMM MSM7227 OneNAND DLL (4kb page)
• QUALCOMM QSC6xxx OneNAND DLL

All other QUALCOMM Generic DLL-s are now under same branch, so here is full revised list :

• ESM7xxx L41 D04 NAND
• MDM6600 NAND
• MSM6xxx L06 D02 NAND
• MSM7227 L41 D08 OneNAND
• MSM7227 L41 D08 OneNAND 4k
• MSM7xxx L41 D04 NAND
• MSM7xxx L41 D08 NAND
• QSC1100 x14 NOR
• QSC60xx L18 D08 NOR
• QSC6xx L20 D08 NOR
• QSC60xx L24 D08 NOR
• QSC6xxx L32 D08 NAND
• QSC6xxx L36 D08 NAND
• QSC6xxx L36 D08 OneNAND
• QSD8xxx L41 D04 NAND

Press "Check for updates" button in order to download and install new files.

[legija]

25.02.2012 DirectProgramming.dll Version 1.02

Whats new:

• Added MSM7627A eMMC controller #3 support World First !
  
• Added S5PC100/S5PC110 eMMC controllers #0..3 support World First !
  
• Added MDM9600 NAND Controller support - World First !
  
• Addres/Length fields are changed into custom GUI representation:
  now 12-digit hex values are shown in more human ‘readable’ way.

Please check here for more details.

16.12.2011 Direct JTAG Access to Flash Memory Plugin v1.00

Release info:

This plugin performs direct access to a flash memory used in the selected target. No DCC Loader is used here, thus it is completely independent of target hardware implementation (RAM memory availability, visibility, addressing and layout, core clocking, etc.). Main disadvantage is a noticeable data exchange speed decrease comparing to the DCC Loader’s data exchange speeds (approximately 10...20 times slower).

With the help of this plugin you can do:

• Read selected flash memory range;
• Write selected flash memory range;
• Erase selected flash memory range.

Currently supported memory controllers are:

• OneNAND Memory (connected directly to the MCU’s address space);
• CFI Compliant NOR Memory with CFI Command sets 0x0001, 0x0002, 0x0200 and 0x0003;
• NAND Controller in MSM6250, MSM6250A;
• NAND Controller in QSC6055, QSC6085, QSC6240, QSC6270;
• NAND Controller in MDM6085, MDM6200, MDM6600;
• NAND Controller in MSM6245, MSM6246, MSM6270, MSM6275, MSM6280, MSM6280A, MSM6281, MSM6290, MSM6800A, MSM6801A;
• NAND Controller and OneNAND Controller in MSM7225, MSM7227, MSM7625, MSM7627;
• NAND Controller in MSM7200, MSM7200A, MSM7201A, MSM7500, MSM7500A, MSM7501A, MSM7600;
• NAND Controller in QSD8250, QSD8650;
• eMMC Controller #2 in MSM7230, MSM8255, MSM8255T;
• eMMC Controller #0 in S5PV310;

Currently supported chipsets and cores for JTAG I/O operations:

• Generic ARM Cores: ARM7, ARM9 (ARM920, ARM926, ARM946), ARM11, CORTEX-A8,CORTEX-A9;
• Qualcomm QSC Family: QSC1100, QSC1110, QSC6010, QSC6020, QSC6030, QSC6055, QSC6085, QSC6240, QSC6270;
• Qualcomm MSM Family: MSM6000, MSM6150, MSM6245, MSM6246, MSM6250, MSM6250A, MSM6260, MSM6275, MSM6280, MSM6280A, MSM6281, MSM6800A, MSM6801A, MSM6290, MSM7225, MSM7227, MSM7625, MSM7627, MSM7230, MSM8255, MSM8255T, MSM8260;
• Qualcomm QSD Family: QSD8250, QSD8650;
• Qualcomm ESM Family: ESM7602A;
• Qualcomm MDM Family: MDM6085 MDM6200, MDM6600;
• OMAP Family: OMAP1710, OMAP3430, OMAP3630, OMAP4430;
• NVIDIA Family: TEGRA2;
• Marvell/XScale Family: PXA270, PXA271, PXA272, PXA310, PXA312, PXA320.
• Samsung Processors: S5P6422, S5PV310.

Memory reading/programming logic is almost same as is performed on the DCC Read/Write page in the JTAG Manager - Main and Spare fields, Auto FullFlash size detection, ability to flash image files (for NAND)., etc. Users familiar with the DCC Read/Write page features will not be required to learn almost anything new in order to be able to use this plugin. Thus it means data files read from memory by this plugin (partial or full flash image) can be flashed back through the DCC Read/Write page, and vice versa.
Here, it is user’s task now to know such info about target as what exact MCU is used in current device, what memory is used (NAND, OneNAND, NOR, eMMC/SD, MDOC or other), which component of target system can see this memory (for example NAND memory is usually visible to MCU’s Embedded Memory Controller, while NOR is directly accessible by the MCU itself; OneNAND memory in most cases is directly accessible by MCU but sometimes it can be visible via MCU’s Embedded Memory Controller).

Please note main differences with the DCC Read/Write methods:

• Exact chipset (MCU) name selection is required;
• Memory type selection is required (for example: NAND or NOR memory);
• Which component of target system can see this memory (for example: MCU itself or MCU’s Embedded Memory Controller): the ‘Memory Type & Host’ setting;
• Memory Controller Mode is introduced here (while on DCC Read/Write page in the JTAG Manger the Memory Controller Mode was automatically chosen depending on ROMi Address Space selected). Many Qualcomm NAND Controllers are widely configurable, for example they allow for firmware to select any desired position of bad block marker byte inside of NAND page’s main or spare area, and upon reads/writes this byte will be handled by controller itself, making it ‘invisible’ in the NAND page data. Thus reading NAND with configuration different to the one used by the manufacturer for writing data into this NAND memory (firmware for example) will result in 1 byte to be erroneously read or lost. In many cases (by many manufacturers) the default bad block marker position is configured to be at offset 0x01D1 in the page’s main area (abbreviated Memory Controller Mode you will see in the list as this: “M:0200/S:10/BM:01D1” - meaning NAND controller to be configured for main area 0x0200 bytes, spare area 0x0010 bytes, bad block marker position in main area (BM) at offset 0x01D1 (BM:01D1)); other most common case is for bad block marker to be at position 0x0006 in spare area (such abbreviated Memory Controller Mode you will see in the list as this: “M:0200/S:10/BS:0006” - meaning NAND controller to be configured for main area 0x0200 bytes, spare area 0x0010 bytes, bad block marker position in spare area (BS) at offset 0x0006 (BS:0006));

• During NAND read operations, if ECC Module Enable is checked, the ECC status is checked too. Thus make sure to disable ECC checks during reads unless you’re in need for an advanced operation.

Short Manual how to Read/Write/Erase memory:

• Select chipset (MCU) used in the current target (for example MSM6280);
• Select memory type and it’s host (MCU or MCU’s Embedded Memory Controller);
• Setup TCK/RTCK frequencies, JTAG I/O Voltage levels, target’s core position on the JTAG scan chain (TAP#);
• Connect target device to the RIFF BOX, make sure it has power, and click Connect & Flash ID button to ensure target device is connected and selected memory is initialized and visible;
• All further actions are completely same as is done when using DCC Read/Write page features.

Most common errors which can happen during direct read/write operations:

• The NRST signal is neglected by user. Please take into account that NRST signal is the most important one. Making system reset helps debugger (RIFF BOX) to establish device into 100% pre-known hardware state, which guarantees that a MCU’s memory controller selected by user will be configured as it should be and successful memory access will be established;
• Cannot connect to selected memory (Connect & Flash ID): check NRST signal; check Reset Method in settings; make sure proper MCU, memory type and controller is selected in settings; in case NOR or directly accessible OneNAND memory is selected make sure valid memory base is set;
• “Resetting and Halting Target…” fails: make sure device is powered and power on key (if present) is pressed during this stage; some devices like HTCs based on the MSM8255 chipsets are fused, and JTAG may be enabled only by started firmware - thus you may need to vary the Reset Method settings: disable reset at all (which is not desirable though) or adjust higher waiting time after system is reset by the NRST signal assertion to the moment when an attempt to HALT core is made (for fused HTCs based on MSM8255 this is 670 ms and more);

___________

28.12.2011 Direct JTAG Access to Flash Memory Plugin v1.01, TEGRA2 eMMC Supported
Whats new:

• Added MSM6500
• Added TEGRA2 eMMC controller #2 support
• Added partition access selection for eMMC devices
• Fixed AutoFlash Size bug for eMMC devices

Important info:
TEGRA 2 can be connected via CORTEX or ARM7 cores. In some cases, where CORTEX core is in sleep mode, it’s only possible to access ARM7 core, thus allowing access to shared memory space. Restoring Boot partitions via ARM7 core will enable access to CORTEX core after power reset.
Sample:

[legija]

Guys, please keep this thread CLEAN for useless posts.
It should be used for precise and specific questions related ONLY to use of this plugin.

Thank You.

[pablov300]

i pablo, i wanna ask is posible conect iphone 4 - iphone 4s to riff box, with jtag? to work whit the baseband?

[maxieboy]

i just want to ask if this update is supported for dead MF180 ? i have one which is dead, maining even i connect to usb does no reaction happen, this history is happen after i flash the wrong firmware,

i just make as a trial because i ask in support regarding this isue but no body can know. i dont know if they know r may be they are busy, or is just ignore ,

well this is the good update hope more models added, not by fixing some old supported phones and modems problems.

[BABAK NURI]

Mr.Legija please tell me about omap4430....... I can see omap4430 in Description Page...
but i can't see in List....? not supported at this moment????

Currently supported chipsets and cores for JTAG I/O operations:

"OMAP Family: OMAP1710, OMAP3430, OMAP3630, OMAP4430"