2022-06-12 16:48:05 -05:00
|
|
|
# SPDX-License-Identifier: GPL-2.0-or-later
|
|
|
|
|
|
2019-09-26 00:39:05 -05:00
|
|
|
# Knovative KC-100 cable modem
|
|
|
|
|
|
|
|
|
|
# TNETC4401PYP, 208-QFP U3
|
|
|
|
|
source [find target/tnetc4401.cfg]
|
|
|
|
|
|
|
|
|
|
# 14-pin EJTAG on JP1. Standard pinout, 1-3-5-7-9-11 = nTRST-TDI-TDO-TMS-TCK-nSRST. Use 2 for GND.
|
|
|
|
|
# Was initially disabled in hardware; had to add a solder bridge reenabling R124, R125 on back.
|
|
|
|
|
reset_config trst_and_srst separate
|
|
|
|
|
|
|
|
|
|
# 16Mb Intel CFI flash. Note this CPU has an internal ROM at 0x1FC0000 (phys) for cold boot.
|
|
|
|
|
# All that really does is some minimal checks before jumping to external flash at 0x00000000 phys.
|
|
|
|
|
# That is remapped to 0xB0000000 uncached, 0x90000000 cached.
|
|
|
|
|
flash bank intel cfi 0xB0000000 0x200000 2 2 $_TARGETNAME
|
|
|
|
|
|
|
|
|
|
# Perform this after a clean reboot, halt, and reset init (which should also leave it halted).
|
|
|
|
|
proc kc100_dump_flash {} {
|
|
|
|
|
echo "Probing 48 TSOP Intel CFI flash chip (2MB)..."
|
|
|
|
|
flash probe intel
|
|
|
|
|
echo "Dumping 2MB flash chip to flashdump.bin.
|
|
|
|
|
flash read_bank 0 flashdump.bin 0 0x200000
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#TODO figure out memory init sequence to be able to dump from cached segment instead
|
|
|
|
|
|
|
|
|
|
# There is also a serial console on JP2, 3-5-6 = TX-RX-GND. 9600/8/N/1.
|
|
|
|
|
|
|
|
|
|
# Possibly of note, this modem's ancient ethernet port does not support Auto-MDIX.
|
|
|
|
|
|
|
|
|
|
# This modem in many ways appears to be essentially a clone of the SB5120. See usbjtag.com.
|
|
|
|
|
# The firmware/OS is also susceptible to many of the same procedures in "Hacking the Cable Modem"
|
|
|
|
|
# by DerEngel (Ryan Harris), available from No Starch Press.
|
