Hi,
I've tried to make the Distortec JTAG-lock-pick Tiny 2[1][2] work with flashrom and for some reason it always read the same thing.
Back in April there was also a thread about it[0], but not much details were shared about the setup, so since I tried things, I also took the occasion to try to share them here.
The JTAG-lock-pick Tiny 2 connector is similar to the one of the Olimex ARM-USB-TINY that is described in the wiki[3].
Even if the connector is the same, there are some differences between both hardware designs: - On the JTAG-lock-pick Tiny 2, VREF and VTARGET are connected together according to its schematics that are in its manual[4]. - Users are supposed to connect a reference voltage to any of these two pins (VREF and VTARGET). - The pins 17 and 19 are not connected (NC) at all. - The JTAG-lock-pick Tiny 2 uses an FTD232HL chip (among with other chips like a CPLD and some chips to isolate the target device from it).
I've made the following patch to try to use it: diff --git a/ft2232_spi.c b/ft2232_spi.c index e32d7f81..d986e0a2 100644 --- a/ft2232_spi.c +++ b/ft2232_spi.c @@ -38,6 +38,7 @@ #define FTDI_FT2232H_PID 0x6010 #define FTDI_FT4232H_PID 0x6011 #define FTDI_FT232H_PID 0x6014 +#define DISTORTEC_JTAG_LOCK_PICK_TINY_2_PID 0x8220 #define TIAO_TUMPA_PID 0x8a98 #define TIAO_TUMPA_LITE_PID 0x8a99 #define AMONTEC_JTAGKEY_PID 0xCFF8 @@ -66,6 +67,7 @@ static const struct dev_entry devs_ft2232spi[] = { {FTDI_VID, TIAO_TUMPA_PID, OK, "TIAO", "USB Multi-Protocol Adapter"}, {FTDI_VID, TIAO_TUMPA_LITE_PID, OK, "TIAO", "USB Multi-Protocol Adapter Lite"}, {FTDI_VID, AMONTEC_JTAGKEY_PID, OK, "Amontec", "JTAGkey"}, + {FTDI_VID, DISTORTEC_JTAG_LOCK_PICK_TINY_2_PID, OK, "Distortec", "JTAG-lock-pick"}, {GOEPEL_VID, GOEPEL_PICOTAP_PID, OK, "GOEPEL", "PicoTAP"}, {GOOGLE_VID, GOOGLE_SERVO_PID, OK, "Google", "Servo"}, {GOOGLE_VID, GOOGLE_SERVO_V2_PID0, OK, "Google", "Servo V2 Legacy"}, @@ -350,6 +352,13 @@ static int ft2232_spi_init(void) ft2232_vid = GOEPEL_VID; ft2232_type = GOEPEL_PICOTAP_PID; channel_count = 2; + } else if (!strcasecmp(arg, "JTAG-lock-pick")) { + ft2232_type = DISTORTEC_JTAG_LOCK_PICK_TINY_2_PID; + /* It contains an FTD232HL chip. Its datasheet has + * "FT232H SINGLE CHANNEL HI-SPEED USB TO MULTIPURPOSE + * UART/FIFO IC" + */ + channel_count = 1; } else if (!strcasecmp(arg, "tumpa")) { /* Interface A is SPI1, B is SPI2. */ ft2232_type = TIAO_TUMPA_PID;
I've connected it in the same way described in the wiki for the Olimex ARM-USB-TINY[3], with wires that are about 10 centimeters, and I've provided 3.3v on VREF/VTARGET. When doing that flashrom always reads 0xff:
./flashrom -p ft2232_spi:type=JTAG-lock-pick,divisor=131072 --verbose [...] Probing for Sanyo unknown Sanyo SPI chip, 0 kB: RDID byte 0 parity violation. compare_id: id1 0xff, id2 0xffff Probing for Winbond unknown Winbond (ex Nexcom) SPI chip, 0 kB: RDID byte 0 parity violation. compare_id: id1 0xff, id2 0xffff Probing for Generic Variable Size SPI chip, 64 kB: Probing for Generic unknown SPI chip (RDID), 0 kB: RDID byte 0 parity violation. compare_id: id1 0xff, id2 0xffff Probing for Generic unknown SPI chip (REMS), 0 kB: compare_id: id1 0xff, id2 0xff No EEPROM/flash device found. Note: flashrom can never write if the flash chip isn't found automatically. Releasing I/Os
If instead I remove the power source, flashrom always reads zeros (0x00) instead of ones (0xff).
If I go to about 1volt, flashrom still reads 0xff.
That device is also supported by openocd and there I managed to use it to reprogram a microcontroller through SWD.
With the same connection, on an openmoko debug board (connecting the 3.3v source to VTARGET), I get the following result:
./flashrom -p ft2232_spi:type=openmoko,divisor=131072 --verbose Probing for Winbond unknown Winbond (ex Nexcom) SPI chip, 0 kB: compare_id: id1 0xef, id2 0x4017 Probing for Generic Variable Size SPI chip, 64 kB: Probing for Generic unknown SPI chip (RDID), 0 kB: compare_id: id1 0xef, id2 0x4017 Probing for Generic unknown SPI chip (REMS), 0 kB: compare_id: id1 0xef, id2 0x16 Found Winbond flash chip "W25Q64.V" (8192 kB, SPI). This chip may contain one-time programmable memory. flashrom cannot read and may never be able to write it, hence it may not be able to completely clone the contents of this chip (see man page for details). No operations were specified. Releasing I/Os
So something is probably wrong somewhere.
Note that in the distribution I use (Parabola i686), the FT232H support seems to be supported in libftdi as when running make in the flashrom source directory I have:
Checking for FTDI support... found. Checking for FT232H support in libftdi... found.
I wonder if there is some easy way to make the JTAG-lock-pick Tiny 2 work, as it is quite small and it also does JTAG and SWD, and it'd probably be more reliable than the Arduino that I use at 3.3v (which also needs a 3.3v power source to run at 3.3v).
References: ----------- [0]https://www.mail-archive.com/flashrom@flashrom.org/msg14801.html [1]https://distortec.com/jtag-lock-pick-tiny-2/ [2]https://shop.sysmocom.de/products/jtag-lock-pick-tiny-2 [3]https://www.flashrom.org/FT2232SPI_Programmer#Olimex_ARM-USB-TINY.2F-H_and_A... [4]https://distortec.com/download/70/ [5]https://ftdichip.com/products/ft232hl/ [6]https://ftdichip.com/wp-content/uploads/2020/07/DS_FT232H.pdf [7]https://www.mail-archive.com/flashrom@flashrom.org/msg14801.html
Denis.