O Canada! > Canadian > TekSavvy > Upgrading Firmware on Thompson DCM475

said by Teddy Boom:

USBJTAG NT has data rates of 3/6/12MHz, so I'm guessing your 8MHz Arduino should be in the ball park for sure. Not a project I'd choose to take on myself, but I guess I'm just stuck in my analog past

Heh, I'd probably have ordered a USBJTAG-NT by now if their website would stop crashing long enough to read more about it -- perhaps you've triggered a mini "slashdot effect" on them.

But it's a good excuse to finally play with Arduino, and things are simpler than I expected there. I might buy a newer Arduino board though, to get 3V logic levels along with built in 12mbit USB. My current board can clock SPI at 8MHz, but is constricted on data transfers to/from the outside world: serial, 115200bps. But for now, I'll try and get it all working with what I have on hand -- it should still take less than 10 minutes to move 4MBytes over that serial link.

to forum · permalink · 2012-09-11 00:29:32 ·

Teddy Boom
k kudos Received

join:2007-01-29
Toronto, ON
kudos:7

said by mlord:

it should still take less than 10 minutes to move 4MBytes over that serial link.

Some cable modems have 16MByte flash!
--
electronicsguru.ca/for_sale/Cablemodems

to forum · permalink · 2012-09-11 01:01:33 ·

mlord

join:2006-11-05
Nepean, ON
kudos:10

Reviews:

I've now broken down and ordered an Arduino Pro Micro 3.3V board for this project. It should be here on Wednesday, and ought to simplify things: faster comms, and no need for level shifting.

Still looking for a cheaper source for the clip-on connector ($12 shipping for a $12 part??).

Cheers

to forum · permalink · 2012-09-11 11:40:51 ·

mlord

join:2006-11-05
Nepean, ON
kudos:10

Reviews:

--
electronicsguru.ca/for_sale/Cablemodems

Update: things are moving along.

Got the 3.3V Arduino board today -- have to get it running soon.
Also have all of the code written and tested (with logic analyzer) for dumping / programming flash on the Arduino.

Haven't found a more affordable source for the (excellent) recommended test clips, but just noticed that the EZ-Hook clips from the analyzer work very well on the in-circuit flash chip. So I'll just use those, since I've got lots of them on hand.

So I'm pretty close to hook-up time. Once I get the new 'duino going, the first task is to rip the 02.08 firmware a few times via different sequences, and do binary compares to judge the reliability of the communications. Then try erasing and reprogramming just the 02.08 firmware, and do readback/verify again.

If that all works, I'll get hold of the 02.16 modem and snatch a copy of the latest firmware from it.

Cheers

to forum · permalink · 2012-09-12 13:26:11 ·

Teddy Boom
k kudos Received

join:2007-01-29
Toronto, ON
kudos:7

said by mlord:

So I'm pretty close to hook-up time. Once I get the new 'duino going, the first task is to rip the 02.08 firmware a few times via different sequences, and do binary compares to judge the reliability of the communications. Then try erasing and reprogramming just the 02.08 firmware, and do readback/verify again.

If that all works, I'll get hold of the 02.16 modem and snatch a copy of the latest firmware from it.

Install the USBJTAG software and take a look at how cable modem flash is organized on other modems, it will help a lot. If you need a flash dump from a modem, I can pass that along..

In particular, what you'll find is that some of the firmware will be human readable. Try searching for "DCM" and "docsis" in a hex editor. If you've read the firmware properly you should find strings like that. When my friend read a DCM425 chip for me, the bytes always came out flipped:

If I load 425-1.bin into USBJTAG and then inspect image0 I see the
string as follows:
CD4M525-.2803.-1118032S-.Sib.n

Flip the bits and I get:
DCM425-52.08.31-110823-SS.bin.

So maybe it is all just pairwise swapped?!?!

So I googled around a bit and found HEX Workshop, which conveniently has a byte swap feature. Not long after that I had a working ST52.08.31 image.
»www.hexworkshop.com/

Unfortunately no Sayal in Ottawa:
»www.sayal.com/zinc/zinc_contactus.asp
But there must be an electronics supply place.. Not sure about test clips, but they aren't that obscure, so the odds can't be too bad.
--
electronicsguru.ca/for_sale/Cablemodems

to forum · permalink · 2012-09-12 13:57:37 ·

TSI Gabe
Premium,VIP
join:2007-01-03
Chatham, ON
kudos:2

That's called Endianness

»en.wikipedia.org/wiki/Endianness

x86 are little endian

While in this case is likely MIPS based which is usually big endian.
--
TSI Gabe - TekSavvy Solutions Inc.
Authorized TSI employee ( »TekSavvy FAQ »Official support in the forum )

to forum · permalink · 2012-09-12 14:19:15 ·

Teddy Boom
k kudos Received

join:2007-01-29
Toronto, ON
kudos:7

said by TSI Gabe:

That's called Endianness

Thanks! I've heard of little endian and big endian before, and I probably even dealt with the ideas a little 15 years ago, but I sure didn't make the connection.

I mentioned that I'm an analog guy right?

to forum · permalink · 2012-09-12 15:12:13 ·

mlord

join:2006-11-05
Nepean, ON
kudos:10

Reviews:

reply to mlord

The test setup.. forgot to disconnect the Logic Analyzer

Unfortunately the new 3.3V Arduino w/USB died after just a minute or so of use. So for now, I'm back to the serial port version at 5V. Turns out level shifting is a non=issue. I was all set to do it, but just hooked things up without it for a trial, and it all works!

Dumping 32mbits of flash now.

to forum · permalink · 2012-09-12 17:12:22 ·

Teddy Boom
k kudos Received

join:2007-01-29
Toronto, ON
kudos:7

said by mlord:

Unfortunately the new 3.3V Arduino w/USB died after just a minute or so of use.

So for now, I'm back to the serial port version at 5V. Turns out level shifting is a non=issue.

Interesting... I think maybe the 3.3V got over loaded because of other loads on the modem board. Maybe the 5V Arduino is more robust--outputs more current. It takes around 0.5A from my bench supply when I apply power direct to the chip in circuit, some modems close to 1A.

5V is on the edge really.. If it is really 4.8V, then I'm sure it is pretty safe (though I'd like to keep it 4V and lower normally). If it is really 5.5V I think you are risking the modem..

said by mlord:

Looking good

--
electronicsguru.ca/for_sale/Cablemodems

to forum · permalink · 2012-09-12 17:27:35 ·

mlord

join:2006-11-05
Nepean, ON
kudos:10

Reviews:

reply to mlord

SPI activity

Well, that wasn't so bad. I've now got an exactly 4 MByte file with a binary dump of the entire flash chip inside. Oddly enough, none of the flash is write-protected either, according to the chip status register.

I'm going to dump it a few more times and check for bit errors between the various dumps. Meanwhile, here's a look at the logic analyzer display during the dumping..

to forum · permalink · 2012-09-12 17:34:16 ·

mlord

join:2006-11-05
Nepean, ON
kudos:10

Reviews:

reply to Teddy Boom

said by Teddy Boom:

said by mlord:

Unfortunately the new 3.3V Arduino w/USB died after just a minute or so of use.
So for now, I'm back to the serial port version at 5V. Turns out level shifting is a non=issue.

Interesting... I think maybe the 3.3V got over loaded because of other loads on the modem board.

No, it died before ever being connected to anything other than my PC's USB port.

A not uncommon issue, apparently. I'm checking to see if I can get it replaced under warranty.

quote:
5V is on the edge really.. If it is really 4.8V, then I'm sure it is pretty safe (though I'd like to keep it 4V and lower normally). If it is really 5.5V I think you are risking the modem..

I'm powering the flash chip with 3V, but feeding it TTL signal levels for the SPI lines. A paper I read earlier suggests this is kosher, and thus far it seems to be. The only real concern was whether the MISO data line from the flash chip would have a high enough logic "1" voltage to work with the Arduino. Correction: I did keep the level conversion for MSIO after all. So just that one line (data-out from the flash chip) gets up-shifted to 5V logic.

Cheers

to forum · permalink · 2012-09-12 17:38:34 ·

mlord

join:2006-11-05
Nepean, ON
kudos:10

Reviews:

Mmm.. interesting. You know how these modems always chop off the log messages displayed in the web interface? Well.. the full log messages (not chopped) are stored near the end of flash.

to forum · permalink · 2012-09-12 17:43:26 ·

TSI Gabe
Premium,VIP
join:2007-01-03
Chatham, ON
kudos:2

I've been meaning to get one of these for a while.

»www.adafruit.com/products/757

Conversion from 3.3 to 5v or the other way around is way too common.
--
TSI Gabe - TekSavvy Solutions Inc.
Authorized TSI employee ( »TekSavvy FAQ »Official support in the forum )

to forum · permalink · 2012-09-12 18:41:26 ·

mlord

join:2006-11-05
Nepean, ON
kudos:10

Reviews:

Yeah, that's the same type of gizmo I'm using here, except mine is from SparkFun: »www.sparkfun.com/products/8745
Edit: But I like the one you posted the link for even better. Gotta get some!

Handy little sucker. I'm actually using the "LV" (Low Voltage) side to POWER the flash chip in-circuit inside the modem. Works rather well!

After disconnecting the logic analyzer, the loading on the pins is now low enough that I'm getting very consistent error-free dumps every time. Takes just under 19 minutes to dump all of flash in ASCII-hex (with spaces) over the serial link. I can speed that up by eliminating the spaces between byte values, which ought reduce the time by 1/3 or so.

At this point, I'm just about ready to borrow a modem with 02.16 firmware to read the image out of.

Cheers

to forum · permalink · 2012-09-12 20:28:35 ·

mlord

join:2006-11-05
Nepean, ON
kudos:10

Reviews: