Products > Test Equipment
R&S RTB2004 Snooping
<< < (15/20) > >>
YetAnotherTechie:

--- Quote from: ElectronMan on November 02, 2020, 03:04:23 am ---
--- Quote from: YetAnotherTechie on November 02, 2020, 12:40:58 am ---ElectronMan:

Do you know how to issue SET FEATURE (EFh) commands to the nand via jtag?

--- End quote ---

Normally you talk to the controller and not the NAND directly, but there are some pass-through commands. I'd have to look it up. Why?

--- End quote ---

From PeDre list we can see that OTP area is in use. Therefore any backup that doesn't have those thirty full pages (2112 bytes per page) of data is incomplete. Things like model/serial number, board type, permanent licenses or certificates could be stored there and couldn't be restored in case of nand failure.
Is there a way to read it using the monitor?

In a previous post you mentioned running a raw dump, does this mean talking directly to the nand and including ecc, or the entire chip through the HPS layer?
tv84:

--- Quote from: YetAnotherTechie on November 02, 2020, 12:04:02 pm ---In a previous post you mentioned running a raw dump, does this mean talking directly to the nand and including ecc, or the entire chip through the HPS layer?

--- End quote ---

When we mentioned "raw dump", we meant dumping without deleting any byte from the read instruction (look at Electroman original script where he cutted 16 bytes for each page).

The goal is read all the NAND and post process after. The NAND controller provides a very clean output with all the ECC taken care of.
ElectronMan:

--- Quote from: tv84 on November 02, 2020, 12:55:26 pm ---
--- Quote from: YetAnotherTechie on November 02, 2020, 12:04:02 pm ---In a previous post you mentioned running a raw dump, does this mean talking directly to the nand and including ecc, or the entire chip through the HPS layer?

--- End quote ---

When we mentioned "raw dump", we meant dumping without deleting any byte from the read instruction (look at Electroman original script where he cutted 16 bytes for each page).

The goal is read all the NAND and post process after. The NAND controller provides a very clean output with all the ECC taken care of.

--- End quote ---

The OTPData SCPI command appears to just write data to Block 0, Page 0. It does disable ECC before doing this, but I don't see it writing into the spare area.

You can write to a register to tell it the read mode you want (just MAIN area, or MAIN and SPARE) so it would not be difficult to make the script grab that area in a dump as well.

EDIT: It is writing 0x840 bytes, which is the full 2112 byte MAIN + SPARE. I'll see if I can get that data out of Block 0, page 0 on my device.
YetAnotherTechie:

--- Quote from: ElectronMan on November 02, 2020, 03:24:05 pm ---
The OTPData SCPI command appears to just write data to Block 0, Page 0. It does disable ECC before doing this, but I don't see it writing into the spare area.

You can write to a register to tell it the read mode you want (just MAIN area, or MAIN and SPARE) so it would not be difficult to make the script grab that area in a dump as well.

EDIT: It is writing 0x840 bytes, which is the full 2112 byte MAIN + SPARE. I'll see if I can get that data out of Block 0, page 0 on my device.

--- End quote ---

From the datasheet:
https://eu.mouser.com/datasheet/2/671/micron_technology_micts06228-1-1759217.pdf
"The OTP area is only accessible while in OTP operation mode. To set the device to OTP operation mode, issue the SET FEATURE (EFh)
command to feature address 90h and write 01h to P1, followed by three cycles of 00h to P2-P4. For parameters to enter OTP mode, see Features Operations.
When the device is in OTP operation mode, all subsequent PAGE READ (00h-30h) and PROGRAM PAGE (80h-10h) commands are applied to the OTP area. The OTP area is assigned to page addresses 02h-1Fh. "

So the code would look like reading block 0 page 0, but it's a diferent block than what you read before (bootblock) do you agree?
It would also be interesting to get "read id" byte 4 to determine if they are using the internal on-chip ecc or not. it's also possible to use command "get features" to check ECC status and/or if you are reading from otp area or not.

tv84:

--- Quote from: ElectronMan on November 02, 2020, 03:24:05 pm ---The OTPData SCPI command appears to just write data to Block 0, Page 0. It does disable ECC before doing this, but I don't see it writing into the spare area.

--- End quote ---

Maybe you have to set the block/page with another command prior to read.
Navigation
Message Index
Next page
Previous page
There was an error while thanking
Thanking...

Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod