Troy
#
# Voipac VPACLink
#
# http://voipac.com/27M-JTG-000
#
telnet_port 4444
gdb_port 3333
#interface ft2232
#ft2232_device_desc "VPACLink"
#ft2232_layout oocdlink
#ft2232_vid_pid 0x0403 0x6010
#adapter_khz 100
interface ftdi
ftdi_device_desc "Dual RS232-HS"
ftdi_vid_pid 0x0403 0x6010
ftdi_layout_init 0x0c08 0x0f1b
ftdi_layout_signal nTRST -data 0x0100 -noe 0x0400
ftdi_layout_signal nSRST -data 0x0200 -noe 0x0800
adapter_khz 1000
#reset_config none
# Freescale i.MX51
if { [info exists CHIPNAME] } {
set _CHIPNAME $CHIPNAME
} else {
set _CHIPNAME imx51
}
# CoreSight Debug Access Port
if { [info exists DAP_TAPID ] } {
set _DAP_TAPID $DAP_TAPID
} else {
set _DAP_TAPID 0x1ba00477
}
jtag newtap $_CHIPNAME DAP -irlen 4 -ircapture 0x1 -irmask 0xf \
-expected-id $_DAP_TAPID
# SDMA / no IDCODE
jtag newtap $_CHIPNAME SDMA -irlen 4 -ircapture 0x0 -irmask 0xf
# SJC
if { [info exists SJC_TAPID ] } {
set _SJC_TAPID SJC_TAPID
} else {
set _SJC_TAPID 0x0190c01d
}
jtag newtap $_CHIPNAME SJC -irlen 5 -ircapture 0x1 -irmask 0x1f \
-expected-id $_SJC_TAPID -ignore-version
# GDB target: Cortex-A, using DAP
set _TARGETNAME $_CHIPNAME.cpu
target create $_TARGETNAME cortex_a -chain-position $_CHIPNAME.DAP -dbgbase 0x60008000
# some TCK tycles are required to activate the DEBUG power domain
jtag configure $_CHIPNAME.SJC -event post-reset "runtest 100"
# have the DAP "always" be active
jtag configure $_CHIPNAME.SJC -event setup "jtag tapenable $_CHIPNAME.DAP"
nand device 29F4G08ABADA mx5 $_TARGETNAME hwecc biswap
init
proc imx51_dbginit {target} {
# General Cortex A debug initialisation
cortex_a dbginit
}
proc load_uboot {} {
halt
arm core_state arm
load_image /home/theosoft/imx-build/u-boot/u-boot.bin 0x97800000
# sdhc 0 0x97800000 0x400 0x4d000
step 0x97800000
}
proc n_steps {steps} {
for {set a 0} {$a <= $steps} {incr a 1} {
step
}
}
# Debug Status and Control register
proc dscr {} {
echo [format 0x%08x [arm mrc 14 0 0 1 0]]
}
# MMU disable
proc mmud {} {
reg cpsr 0x1d3
echo [format 0x%08x [arm mrc 15 0 1 0 0]]
arm mcr 15 0 1 0 0 [expr {[arm mrc 15 0 1 0 0] & 0xffffcc7a}]
step
}
proc wdt_disable {} {
# disable WDT
mwh 0x73f98000 0x3
}
# This program resets the regs to the address 0x17800000
# making the incorrect assumption that the start of the code
# is located there.
# It sets up the cpsr so we can run the code properly.
proc clear_regs {} {
puts "clear_regs begin"
reg r1 0
reg r2 0
reg r3 0
reg r4 0
reg r5 0
reg r6 0
reg r7 0
reg r8 0
reg r9 0
reg r10 0
reg r11 0
reg r12 0
# assume our executable is at 0x17800000. otherwise the
# user must manually set the value after a reset.
reg pc 0x97801000
# shamelessly stolen from the samsung configuration
# this fixes problems executing loaded code.
reg cpsr 0x1d3
arm mcr 15 0 15 2 4 0x70000013
puts "clear_regs end"
}
# MMU enable
proc mmue {} {
reg cpsr 0x1d3
echo [format 0x%08x [arm mrc 15 0 1 0 0]]
arm mcr 15 0 1 0 0 [expr {[arm mrc 15 0 1 0 0] | 0x00000005}]
step
}
# prepare memory access for registers AXI and IP
proc pm {} {
halt
mmud
dap apsel 1
}
# erase page 0 to enable bootstrap
proc bt_enable {} {
pm
#set high Address
mww 0xcfff1e04 0x0
mww 0xcfff1e24 0x0
#set ram to block 0 and NFC reset
mww 0xcfff1e34 0x0
#set autocmd autoprogram
mww 0xcfff1e00 0x0070D060
# do auto_erase
mww 0xcfff1e40 0x20
sleep 500
mdw 0xcfff1e3c
}
# program flash with autowrite NFC option
# number in Range 0x00000000 - 0x000007ff --> Page 0
# number in Range 0x00010000 - 0x000107ff --> Page 1
proc pfpart {p_start p_stop} {
# todo
# NAND's CMD setzen 0x80 0x10
# RAM füllen
# Addr0 und Addr8 setzen
# Auto erase ??
# RAM Quelle setzen
# Autowrite setzen
# register read and set bits ??
# set p_start 0x00030000
# set p_stop 0x000030800
set start_len [string length $p_start]
set stop_len [string length $p_stop]
if [expr $start_len != 12] {break}
if [expr $stop_len != 12] {break}
scan $p_start %x start_int
scan $p_stop...
Read more »
0%
0%
Telstra T-Hub rooting/repurposing
This is an attempt to reuse the mostly useless Telstra T-Hubs that are popping up for peanuts in various secondhand places in Australia
Become a Hackaday.io member
Already have an account? Log in.
Just one more thing
To make the experience fit your profile, pick a username and tell us what interests you.
Pick an awesome username
hackaday.io/
Your profile's URL: hackaday.io/username. Max 25 alphanumeric characters.
Pick a few interests
Projects that share your interests
People that share your interests
Stephen Holdaway
Jose Ricardo
J.C. Nelson
usedbytes
I tried using an ip address in the wav filename with the usb hack via *352#... using a Simple Web Server as my HTML but it didn't work... maybe it didn't like all the dots or periods... though you only mentioned slashes in your post. So I will have to try to learn how to setup IIS or a server or DNS setup to learn have a single word redirect to a machine. The reboot with the bin firmware try worked with reboot.