Доброго времени суток!
Вопрос-возможно ли на Вашем замечательном программаторе программирование
Intel Strata Flash memory Easy BGA:
28F256J3,
28F128J3,
28F640J3,
28F320J3?
А также снятие бита защиты?
И что для этого необходимо(кроме панелек :D )?
С уважением Dymgreen.
Программирование 28f...j3
Дааааа (!) , вопрос (ЕBGA !) которого никто незадавал в форуме Виллема.
Что за чипы, нет ли возможностей переписать без выпаивания (к примеру софт для мобильников, jtag,..) ?
Имеешь оборудование для снятия и пайки со соответсвующими навыками ?
Обратно к программатору -
проблема софта. Нет прямого софта к J3 чипам. Автор софта занятый и не очень отзывчивый. Можно использовать алгоритм программирования с выбранным чипом LH28F160. Это только 16Мбит и чипы большей емкости нужно программировать по частям , ручным устанавливая верхние адреса. Так проверены чипы MT28F320J3, MT28F640J3, M58LW032D, M58LW064D на и tsop56a1 . Адаптер позволяет управление и для 128Мбит чипа.
Относительно защиты
- с регистром защиты нет возможности читать и установить. Раз установлен вряд ли можно стереть (ОТР)
- с защитой блоков ситуация похожа, 8бит софт неимеет опцию снятия. Вариант с 16бит софтом (28F..В3,С3) имеет опцию, но не проверено.Так, что апгрейд софта наверняка необходим.
> Еzoflash+ адаптер для ЕBGA можно бы сделать, вопрос относительно панелек - где достать, цена, насколько удобны при создании адаптера и дальше в эксплуатации. Как часто придется программировать и нет ли лучще выбрать дорогой программатор или другой метод.
Что за чипы, нет ли возможностей переписать без выпаивания (к примеру софт для мобильников, jtag,..) ?
Имеешь оборудование для снятия и пайки со соответсвующими навыками ?
Обратно к программатору -
проблема софта. Нет прямого софта к J3 чипам. Автор софта занятый и не очень отзывчивый. Можно использовать алгоритм программирования с выбранным чипом LH28F160. Это только 16Мбит и чипы большей емкости нужно программировать по частям , ручным устанавливая верхние адреса. Так проверены чипы MT28F320J3, MT28F640J3, M58LW032D, M58LW064D на и tsop56a1 . Адаптер позволяет управление и для 128Мбит чипа.
Относительно защиты
- с регистром защиты нет возможности читать и установить. Раз установлен вряд ли можно стереть (ОТР)
- с защитой блоков ситуация похожа, 8бит софт неимеет опцию снятия. Вариант с 16бит софтом (28F..В3,С3) имеет опцию, но не проверено.Так, что апгрейд софта наверняка необходим.
> Еzoflash+ адаптер для ЕBGA можно бы сделать, вопрос относительно панелек - где достать, цена, насколько удобны при создании адаптера и дальше в эксплуатации. Как часто придется программировать и нет ли лучще выбрать дорогой программатор или другой метод.
У меня паяльная станция(852 аналог),занимаюсь ремонтом сотовых и поэтому периодически возникает потребность в подобном программаторе.Долго искал в сети подходящий вариант и думаю,что данная модель программатора - отличный вариант.Начинаю собирать, о результатах отпишусь.
По поводу защиты
7.0 Security Modes
This device offers both hardware and software security features. Block lock operations, PRs, and
VPEN allow the user to implement various levels of data protection. The following section
describes security features in detail.
7.1 Set Block Lock-Bit
A flexible block locking scheme is enabled via block lock-bits. The block lock-bits gate program
and erase operations. Individual block lock-bits can be set using the Set Block Lock-Bit command.
This command is invalid while the WSM is running or the device is suspended.
Set block lock-bit commands are executed by a two-cycle sequence. The set block setup along with
appropriate block address is followed by either the set block lock-bit confirm (and an address
within the block to be locked). The WSM then controls the set lock-bit algorithm. After the
sequence is written, the device automatically outputs Status Register data when read (see Figure 20
on page 59). The CPU can detect the completion of the set lock-bit event by analyzing the STS
signal output or SR7.
When the set lock-bit operation is complete, SR4 should be checked. If an error is detected, the
Status Register should be cleared. The CUI will remain in Read Status Register mode until a new
command is issued.
This two-step sequence of setup followed by execution ensures that lock-bits are not accidentally
set. An invalid Set Block Lock-Bit command will result in SR4 and SR5 being set. Also, reliable
operations occur only when VCC and VPEN are valid. With VPEN ≤ VPENLK, lock-bit contents are
protected against alteration.
7.2 Clear Block Lock-Bits
All set block lock-bits are cleared in parallel via the Clear Block Lock-Bits command. Block lockbits
can be cleared using only the Clear Block Lock-Bits command. This command is invalid while
the WSM is running or the device is suspended.
Clear block lock-bits command is executed by a two-cycle sequence. A clear block lock-bits setup
is first written. The device automatically outputs Status Register data when read (see Figure 21 on
page 60). The CPU can detect completion of the clear block lock-bits event by analyzing the STS
signal output or SR7.
When the operation is complete, SR5 should be checked. If a clear block lock-bit error is detected,
the Status Register should be cleared. The CUI will remain in Read Status Register mode until
another command is issued.
This two-step sequence of setup followed by execution ensures that block lock-bits are not
accidentally cleared. An invalid Clear Block Lock-Bits command sequence will result in SR4 and
SR5 being set. Also, a reliable clear block lock-bits operation can only occur when VCC and VPEN
are valid. If a clear block lock-bits operation is attempted while VPEN ≤ VPENLK, SR3 and SR5will
be set.
28F256J3, 28F128J3, 28F640J3, 28F320J3
Datasheet 27
If a clear block lock-bits operation is aborted due to VPEN or VCC transitioning out of valid range,
block lock-bit values are left in an undetermined state. A repeat of clear block lock-bits is required
to initialize block lock-bit contents to known values.
7.3 Protection Register Program
The Intel StrataFlash® memory (J3) includes a 128-bit Protection Register that can be used to
increase the security of a system design. For example, the number contained in the PR can be used
to “mate” the flash component with other system components such as the CPU or ASIC, preventing
device substitution.
The 128-bits of the PR are divided into two 64-bit segments. One of the segments is programmed at
the Intel factory with a unique 64-bit number, which is unalterable. The other segment is left blank
for customer designers to program as desired. Once the customer segment is programmed, it can be
locked to prevent further programming.
7.3.1 Reading the Protection Register
The Protection Register is read in the identification read mode. The device is switched to this mode
by issuing the Read Identifier command (0x90). Once in this mode, read cycles from addresses
shown in Table 8 or Table 9 retrieve the specified information. To return to read array mode, write
the Read Array command (0xFF).
7.3.2 Programming the Protection Register
Protection Register bits are programmed using the two-cycle Protection Program command. The
64-bit number is programmed 16 bits at a time for word-wide configuration and eight bits at a time
for byte-wide configuration. First write the Protection Program Setup command, 0xC0. The next
write to the device will latch in address and data and program the specified location. The allowable
addresses are shown in Table 8 or Table 9. See Figure 22, “Protection Register Programming
Flowchart” on page 61
Any attempt to address Protection Program commands outside the defined PR address space will
result in a Status Register error (SR4 will be set). Attempting to program a locked PR segment will
result in a Status Register error (SR4 and SR1 will be set).
7.3.3 Locking the Protection Register
The user-programmable segment of the Protection Register is lockable by programming Bit 1 of
the PLR to 0. Bit 0 of this location is programmed to 0 at the Intel factory to protect the unique
device number. Bit 1 is set using the Protection Program command to program “0xFFFD” to the
PLR. After these bits have been programmed, no further changes can be made to the values stored
in the protection register. Protection Program commands to a locked section will result in a Status
Register error (SR4 and SR1 will be set). PR lockout state is not reversible.
28F256J3, 28F128J3, 28F640J3, 28F320J3
28 Datasheet
NOTE: A0 is not used in x16 mode when accessing the protection register map (See Table 8 for x16
addressing). For x8 mode A0 is used (See Table 9 for x8 addressing).
Figure 6. Protection Register Memory Map
0x88
0x85
64-bit Segment
(User-Programmable)
0x84
0x81
0x80
Lock Register 0
64-bit Segment
(Factory-Programmed)
15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
128-Bit Protection Register 0
Word
Address A[23:1]: 128 Mbit A[21:1]: 32 Mbit
A[22:1]: 64 Mbit A[24:1]: 256 Mbit
28F256J3, 28F128J3, 28F640J3, 28F320J3
Datasheet 29
Table 8. Word-Wide Protection Register Addressing
Word Use A8 A7 A6 A5 A4 A3 A2 A1
LOCK Both 1 0 0 0 0 0 0 0
0 Factory 1 0 0 0 0 0 0 1
1 Factory 1 0 0 0 0 0 1 0
2 Factory 1 0 0 0 0 0 1 1
3 Factory 1 0 0 0 0 1 0 0
4 User 1 0 0 0 0 1 0 1
5 User 1 0 0 0 0 1 1 0
6 User 1 0 0 0 0 1 1 1
7 User 1 0 0 0 1 0 0 0
NOTE: All address lines not specified in the above table must be 0 when accessing the Protection Register
(i.e., A[MAX:9] = 0.)
Table 9. Byte-Wide Protection Register Addressing
Byte Use A8 A7 A6 A5 A4 A3 A2 A1 A0
LOCK Both 1 0 0 0 0 0 0 0 0
LOCK Both 1 0 0 0 0 0 0 0 1
0 Factory 1 0 0 0 0 0 0 1 0
1 Factory 1 0 0 0 0 0 0 1 1
2 Factory 1 0 0 0 0 0 1 0 0
3 Factory 1 0 0 0 0 0 1 0 1
4 Factory 1 0 0 0 0 0 1 1 0
5 Factory 1 0 0 0 0 0 1 1 1
6 Factory 1 0 0 0 0 1 0 0 0
7 Factory 1 0 0 0 0 1 0 0 1
8 User 1 0 0 0 0 1 0 1 0
9 User 1 0 0 0 0 1 0 1 1
A User 1 0 0 0 0 1 1 0 0
B User 1 0 0 0 0 1 1 0 1
C User 1 0 0 0 0 1 1 1 0
D User 1 0 0 0 0 1 1 1 1
E User 1 0 0 0 1 0 0 0 0
F User 1 0 0 0 1 0 0 0 1
NOTE: All address lines not specified in the above table must be 0 when accessing the Protection Register,
i.e., A[MAX:9] = 0.
28F256J3, 28F128J3, 28F640J3, 28F320J3
30 Datasheet
7.4 Array Protection
The VPEN signal is a hardware mechanism to prohibit array alteration. When the VPEN voltage is
below the VPENLK voltage, array contents cannot be altered. To ensure a proper erase or program
operation, VPEN must be set to a valid voltage level. To determine the status of an erase or program
operation, poll the Status Register
Может я чего то не понял :oops:
Есть pdf на эти флэшки.
С уважением Dymgreen.
По поводу защиты
7.0 Security Modes
This device offers both hardware and software security features. Block lock operations, PRs, and
VPEN allow the user to implement various levels of data protection. The following section
describes security features in detail.
7.1 Set Block Lock-Bit
A flexible block locking scheme is enabled via block lock-bits. The block lock-bits gate program
and erase operations. Individual block lock-bits can be set using the Set Block Lock-Bit command.
This command is invalid while the WSM is running or the device is suspended.
Set block lock-bit commands are executed by a two-cycle sequence. The set block setup along with
appropriate block address is followed by either the set block lock-bit confirm (and an address
within the block to be locked). The WSM then controls the set lock-bit algorithm. After the
sequence is written, the device automatically outputs Status Register data when read (see Figure 20
on page 59). The CPU can detect the completion of the set lock-bit event by analyzing the STS
signal output or SR7.
When the set lock-bit operation is complete, SR4 should be checked. If an error is detected, the
Status Register should be cleared. The CUI will remain in Read Status Register mode until a new
command is issued.
This two-step sequence of setup followed by execution ensures that lock-bits are not accidentally
set. An invalid Set Block Lock-Bit command will result in SR4 and SR5 being set. Also, reliable
operations occur only when VCC and VPEN are valid. With VPEN ≤ VPENLK, lock-bit contents are
protected against alteration.
7.2 Clear Block Lock-Bits
All set block lock-bits are cleared in parallel via the Clear Block Lock-Bits command. Block lockbits
can be cleared using only the Clear Block Lock-Bits command. This command is invalid while
the WSM is running or the device is suspended.
Clear block lock-bits command is executed by a two-cycle sequence. A clear block lock-bits setup
is first written. The device automatically outputs Status Register data when read (see Figure 21 on
page 60). The CPU can detect completion of the clear block lock-bits event by analyzing the STS
signal output or SR7.
When the operation is complete, SR5 should be checked. If a clear block lock-bit error is detected,
the Status Register should be cleared. The CUI will remain in Read Status Register mode until
another command is issued.
This two-step sequence of setup followed by execution ensures that block lock-bits are not
accidentally cleared. An invalid Clear Block Lock-Bits command sequence will result in SR4 and
SR5 being set. Also, a reliable clear block lock-bits operation can only occur when VCC and VPEN
are valid. If a clear block lock-bits operation is attempted while VPEN ≤ VPENLK, SR3 and SR5will
be set.
28F256J3, 28F128J3, 28F640J3, 28F320J3
Datasheet 27
If a clear block lock-bits operation is aborted due to VPEN or VCC transitioning out of valid range,
block lock-bit values are left in an undetermined state. A repeat of clear block lock-bits is required
to initialize block lock-bit contents to known values.
7.3 Protection Register Program
The Intel StrataFlash® memory (J3) includes a 128-bit Protection Register that can be used to
increase the security of a system design. For example, the number contained in the PR can be used
to “mate” the flash component with other system components such as the CPU or ASIC, preventing
device substitution.
The 128-bits of the PR are divided into two 64-bit segments. One of the segments is programmed at
the Intel factory with a unique 64-bit number, which is unalterable. The other segment is left blank
for customer designers to program as desired. Once the customer segment is programmed, it can be
locked to prevent further programming.
7.3.1 Reading the Protection Register
The Protection Register is read in the identification read mode. The device is switched to this mode
by issuing the Read Identifier command (0x90). Once in this mode, read cycles from addresses
shown in Table 8 or Table 9 retrieve the specified information. To return to read array mode, write
the Read Array command (0xFF).
7.3.2 Programming the Protection Register
Protection Register bits are programmed using the two-cycle Protection Program command. The
64-bit number is programmed 16 bits at a time for word-wide configuration and eight bits at a time
for byte-wide configuration. First write the Protection Program Setup command, 0xC0. The next
write to the device will latch in address and data and program the specified location. The allowable
addresses are shown in Table 8 or Table 9. See Figure 22, “Protection Register Programming
Flowchart” on page 61
Any attempt to address Protection Program commands outside the defined PR address space will
result in a Status Register error (SR4 will be set). Attempting to program a locked PR segment will
result in a Status Register error (SR4 and SR1 will be set).
7.3.3 Locking the Protection Register
The user-programmable segment of the Protection Register is lockable by programming Bit 1 of
the PLR to 0. Bit 0 of this location is programmed to 0 at the Intel factory to protect the unique
device number. Bit 1 is set using the Protection Program command to program “0xFFFD” to the
PLR. After these bits have been programmed, no further changes can be made to the values stored
in the protection register. Protection Program commands to a locked section will result in a Status
Register error (SR4 and SR1 will be set). PR lockout state is not reversible.
28F256J3, 28F128J3, 28F640J3, 28F320J3
28 Datasheet
NOTE: A0 is not used in x16 mode when accessing the protection register map (See Table 8 for x16
addressing). For x8 mode A0 is used (See Table 9 for x8 addressing).
Figure 6. Protection Register Memory Map
0x88
0x85
64-bit Segment
(User-Programmable)
0x84
0x81
0x80
Lock Register 0
64-bit Segment
(Factory-Programmed)
15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
128-Bit Protection Register 0
Word
Address A[23:1]: 128 Mbit A[21:1]: 32 Mbit
A[22:1]: 64 Mbit A[24:1]: 256 Mbit
28F256J3, 28F128J3, 28F640J3, 28F320J3
Datasheet 29
Table 8. Word-Wide Protection Register Addressing
Word Use A8 A7 A6 A5 A4 A3 A2 A1
LOCK Both 1 0 0 0 0 0 0 0
0 Factory 1 0 0 0 0 0 0 1
1 Factory 1 0 0 0 0 0 1 0
2 Factory 1 0 0 0 0 0 1 1
3 Factory 1 0 0 0 0 1 0 0
4 User 1 0 0 0 0 1 0 1
5 User 1 0 0 0 0 1 1 0
6 User 1 0 0 0 0 1 1 1
7 User 1 0 0 0 1 0 0 0
NOTE: All address lines not specified in the above table must be 0 when accessing the Protection Register
(i.e., A[MAX:9] = 0.)
Table 9. Byte-Wide Protection Register Addressing
Byte Use A8 A7 A6 A5 A4 A3 A2 A1 A0
LOCK Both 1 0 0 0 0 0 0 0 0
LOCK Both 1 0 0 0 0 0 0 0 1
0 Factory 1 0 0 0 0 0 0 1 0
1 Factory 1 0 0 0 0 0 0 1 1
2 Factory 1 0 0 0 0 0 1 0 0
3 Factory 1 0 0 0 0 0 1 0 1
4 Factory 1 0 0 0 0 0 1 1 0
5 Factory 1 0 0 0 0 0 1 1 1
6 Factory 1 0 0 0 0 1 0 0 0
7 Factory 1 0 0 0 0 1 0 0 1
8 User 1 0 0 0 0 1 0 1 0
9 User 1 0 0 0 0 1 0 1 1
A User 1 0 0 0 0 1 1 0 0
B User 1 0 0 0 0 1 1 0 1
C User 1 0 0 0 0 1 1 1 0
D User 1 0 0 0 0 1 1 1 1
E User 1 0 0 0 1 0 0 0 0
F User 1 0 0 0 1 0 0 0 1
NOTE: All address lines not specified in the above table must be 0 when accessing the Protection Register,
i.e., A[MAX:9] = 0.
28F256J3, 28F128J3, 28F640J3, 28F320J3
30 Datasheet
7.4 Array Protection
The VPEN signal is a hardware mechanism to prohibit array alteration. When the VPEN voltage is
below the VPENLK voltage, array contents cannot be altered. To ensure a proper erase or program
operation, VPEN must be set to a valid voltage level. To determine the status of an erase or program
operation, poll the Status Register
Может я чего то не понял :oops:
Есть pdf на эти флэшки.
С уважением Dymgreen.
28F640J3A-Siemens A55,c55
F640W18B-Motorola C330
F320C3TC -Siemens A50
По панелькам надеюсь повторить - http://www.mobile-files.ru/forum/showth ... adid=39846
(ссылка на любимый сайт :D )
F640W18B-Motorola C330
F320C3TC -Siemens A50
По панелькам надеюсь повторить - http://www.mobile-files.ru/forum/showth ... adid=39846
(ссылка на любимый сайт :D )
tsop56a1. Софт 0.97ja, device LH28F160-Bкорпус TSOP-56, из спутникового ресивера. Переходник я в схемах нашёл.
Да. На адаптере делать разрыв к выводам 35 и 36. Управлять адресами мануално A21 (джампер Jp10), A22 (джампер Jp9).Технология та-же по блоками по 16 Мбит?
Cтирание, проверка на чистоту и программирование по 4х16Мб блокам.
Наверно по начальним адресам , A21 и A22 лог.0, Jp10 и Jp9 установлены. 131кБ это 1Мб, так что запись в первом блоке. Остальных только стирать.мне нужно проверить эту флэш и залить загрузчик 131 кБ. По каким адресам находится загрузчик пока не выяснил.
Убедись в правильном ответе на команду get ID.
Удачи !
А можно подробнее насчет разрыва проводников к 35 и 36 выводам - это там где разъем А19-А22?.
Что это за джамперы jp9 и jp10? Это то что в полученных разрывах?
И какая комбинация их при считывании - записи? Я так понял 4 варианта для 4-х блоков?
И еще вопросик: если есть цельная прошивка, как ее делить на части в таком случае?
Очень нужно - жду ответа. Адаптер уже вытравил.
Что это за джамперы jp9 и jp10? Это то что в полученных разрывах?
И какая комбинация их при считывании - записи? Я так понял 4 варианта для 4-х блоков?
И еще вопросик: если есть цельная прошивка, как ее делить на части в таком случае?
Очень нужно - жду ответа. Адаптер уже вытравил.
Да. В документации адаптера (Adapters > tsop56a1) это указано. Там видно где разрыв, где находится джампера.А можно подробнее насчет разрыва проводников к 35 и 36 выводам - это там где разъем А19-А22?.
Там же , думаю достаточно понятно хоть по-английски :
Jumpers Jp10 (A21), Jp9 (A22) allow manage highest adress manually. Set jumper to get low level (log0) adress, remove jumper for high level (log1) adress.
Source file split in 16Mb parts. Load 16Mb block, erase, blank check, write, verify on each block:
0-16Mb Jp10 on (A21-low), Jp9 on (A22-low) ; here check valid get ID response.
16-32Mb Jp10 off (A21-high), Jp9 on (A22-low)
32-48Mb Jp10 on (A21-low), Jp9 off (A22-high)
48-64Mb Jp10 off (A21-high), Jp9 off (A22-high)
Используй эту программу. Исходный файл 8192кВ. Package size 2048k. Split. В результате получишь 4 файла по 2048кВ. Неисключено, что реально содержание (не FF) будет только в первых файлах.И еще вопросик: если есть цельная прошивка, как ее делить на части в таком случае?
Убедись ответа get ID 0x89 Intel 0x17 -Забыл сказать что для чипа JS28F640-J3D75