Hey everybody!
Just wanted to shared the procedure I used to successfully unbrick an "Xpeed LX2" (Sat/Cable STB, derivate of Cloud IBox 3, similar Hardware, Broadcom 7358 Chipset) with you.
First of all : This is NOT a Jtag procedure. I rather accessed the eeprom directly.. I have NOT been able to make Broadcom Studio 3 work with TUMPA Adapter ... yet
So I had to access the EEProm Pins before. After disassembly of the stb (taking out the board), the eeprom used to store the CFE is located on the bottom-side of the board. In my case this was a Macronix MX25L3206E, but any similar eeprom should basically work the same way. I got the idea from here :
http://ao2.it/en/blog/2012/09/23/tumpa
If you are used to soldering => solder it out, e.g. to solder it on a soic8-pinout board (few cents on ebay) or use a custom-built socket (like I did xD). The pin-pitch of that JEDEC-SOIC8 is not that small.
If not : Get an SOIC8-Clamp anywhere on the internet and attach it to the eeprom. Make sure to attach it the right way (look for pin1 first).
I did NOT use the SPI - Connector on my TUMPA-Lite board, but used the AD0-Pinout Connector directly. Please note that I HAD to connect WP# and HOLD# to high (3.3V) also. Without, I could not detect the eeprom at all.
From the datasheet of the eeprom (=>
http://www.macronix.com/Lists/DataSheet/Attachments/1740/MX25L3206E,%203V,%2032Mb,%20v1.5.pdf , page 7)
, and the FT2232H pinout datasheet, I could verify that I could use "standard" SPI pin-connection like so (I included WP# and Hold# also):
TUMPA SPI - EEPROM
--------------------------------------------------------------
ADBus0 (FT2232H Pin 16) ====> Pin6 (SCLK#)
ADBus1 (FT2232H Pin 17) ====> Pin5 (SI/SIO0#)
ADBus2 (FT2232H Pin 18) ====> Pin2 (SO/SIO1#)
ADBus3 (FT2232H Pin 19) ====> Pin1 (CS#)
3v3 VCC ================> Pin3 (WP#), Pin8(VCC#), Pin7(HOLD#)
GND ================> Pin4 (GND#)
I attached TUMPA Lite adapter first, loaded ftdi_sio module manually and then established pin connections. VCC was the last pin to connect.
Afterwards, I could detect the eeprom with flashrom :
flashrom -p ft2232_spi:type=tumpalite,port=A
Since there are multiple revisions of that eeprom-chip, and flashrom is not able to detect which one (but lists those revisions for me to choose instead), I had to manually specify it :
flashrom -p ft2232_spi:type=tumpalite,port=A -c MX25L3206E
And, finally, writing the bootloader file (CLOUDBOOT.BIN, available in multiple forums, in the Cloud IBox3 JTAG Threads) to the eeprom.. flashrom handles erasing the specific sectors first itself by default, so no need to manually erase before :
flashrom -p ft2232_spi:type=tumpalite,port=A -c MX25L3206E -w CLOUDBOOT.BIN
After resoldering/taking of the clamp, you can put a bootloader on usb. The cfe code in CLOUDBOOT.BIN will probably not be correct for any derivate of the cloud ibox3 (it couldnt boot my xpeedlx2 directly), but it is able to access usb and flash a valid bootloader via usb again. Since there was a bootloader update for my device, that one was available for usb-flash anyways.
After re-flashing the valid cfe via usb and flashing a valid firmware, the box is now back to life again. 8) 8) 8)
Hope this may help someone. I would also like to link to this post in the dedicated stb-forums if I am allowed to.
Best regards and Good Luck to anyone trying to recover his stb =)