JTAG Software/Openwince

Openwince-JTAG
OpenWinCE is a collection of tools and utilities for Windows CE on the MIPS platform. The JTAG tool is one of the utilities they provide.
 * Home Page
 * The JTAG tool

Build Your Own
You can get the source from the sf download site, but that is a bit older than what is in CVS, so I suggest to pull from CVS directly. The module name is jtag.

cvs -d:pserver:anonymous@openwince.cvs.sourceforge.net:/cvsroot/openwince login cvs -z3 -d:pserver:anonymous@openwince.cvs.sourceforge.net:/cvsroot/openwince co -P jtag

Then compile with

cd jtag ./autogen.sh ./configure make

You could also try the Debian sources from http://packages.ubuntu.com/gutsy/source/openwince-jtag. Running "apt-get build-dep openwince-jtag" (to get dependencies) prior to the build makes things go smoother.

Use a Precompiled Version
As of July 2008, the 0.5.1 version would not build properly for me on Ubuntu-Hardy. Instead I used this precompiled tarball of version 0.6 jtag_compiled_tools.tgz. It worked well and I was able to recover my LS1 (PPC), but be advised that it loads in a few libs into /usr/local/lib that confused other parts of my Ubuntu installation - you may need to remove those after using the software. Update: I have tested it now (after removing those libs and just using the corresponding ones in Ubuntu Heron and Intrepid) a 2nd and 3rd time, unbricking another LS1 and a LS-HS, and it continues to work fine. This may not be the case on other distros, but it worked for me. Davygravy 12:07, 12 February 2009 (UTC)

Interface Cable and Connection
Openwince-JTAG works with parallel port cables such as the Wiggler. There are a couple of patches that try to add support for various USB cables, but they have not been integrated into CVS yet, so you will need to apply them yourself if you have a USB cable. The command help cable will list pertinent info on cables: jtag> help cable Usage: cable parallel PORTADDR CABLE Usage: cable ppdev DEV CABLE Select JTAG cable connected to parallel port.

PORTADDR  parallel port address (e.g. 0x378) CABLE     cable type DEV       ppdev device (e.g. /dev/parport0)

List of supported cables: none         No cable connected ARCOM        Arcom JTAG Cable ByteBlaster  Altera ByteBlaster/ByteBlaster II/ByteBlasterMV Parallel Port Download Cable DLC5         Xilinx DLC5 JTAG Parallel Cable III EA253        ETC EA253 JTAG Cable EI012        ETC EI012 JTAG Cable KeithKoep    Keith & Koep JTAG cable Lattice      Lattice Parallel Port JTAG Cable MPCBDM       Mpcbdm JTAG cable TRITON       Ka-Ro TRITON Starterkit II (PXA255/250) JTAG Cable WIGGLER      Macraigor Wiggler JTAG Cable

You will have to solder headers onto your board as shown here : Add a JTAG Port.

Connect the Wiggler or other adapter using this - pinout. Note that several different machines are shown here.

Board Support
Depending on your architecture, you may need to find or create a board support file.


 * Linkstation 1 (ppc) user can use this board specification file.
 * Linkstation HG (ppc) users, use [[Media:openwince-jtag-mpc8241.txt|the msp8241 board specification file]].
 * Linkstation HS (ppc) users use same board specification files as LS1
 * TeraStation Original (ppc) users use same board specification files as LS1
 * TeraStation Home Server (ppc) users use same board specification files as LS1
 * TeraStation Pro (ppc) users use same board specification files as LS1
 * Others: post them here when you figure it out.

Jtag Basic Commands and Usage
Run jtag as root, and cd to where ever you have your u-boot image waiting to burn. There is a help command for a list of commands, and help will give you details on each command. cd / root@bitbaker-i686:/# jtag JTAG Tools 0.6 Copyright (C) 2002, 2003 ETC s.r.o. JTAG Tools is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. There is absolutely no warranty for JTAG Tools.

Warning: JTAG Tools may damage your hardware! Type "quit" to exit!

Type "help" for help.

jtag> help Command list:

quit         exit and terminate this session help         display this help frequency    setup JTAG frequency cable        select JTAG cable reset        reset JTAG chain discovery    discovery of unknown parts in the JTAG chain detect       detect parts on the JTAG chain signal       define new signal for a part salias       define an alias for a signal bit          define new BSR bit register     define new data register for a part initbus      initialize bus driver for active part print        display JTAG chain list/status part         change active part for current JTAG chain bus          change active bus instruction  change active instruction for a part or declare new instruction shift        shift data/instruction registers through JTAG chain dr           display active data register for a part get          get external signal value set          set external signal value endian       set/print endianess peek         read a single word poke         write a single word readmem      read content of the memory and write it to file detectflash  detect parameters of flash chips attached to a part flashmem     burn flash memory with data from a file eraseflash   erase flash memory by number of blocks script       run command sequence from external file include      include command sequence from external repository

Type "help COMMAND" for details about a particular command. jtag>

Flash Programming
Running the following code should get you ready to reprogram the flash chip if you are using a Wiggler paraport device. If the third line include command doesn't work, the easy workaround is to simply cut and paste the entire file (including comment and blank lines).

cable parallel 0x378 WIGGLER detect include Openwince-jtag-mpc8241.txt endian big instruction SAMPLE/PRELOAD shift ir shift dr dr instruction EXTEST shift ir initbus mpc824x detectflash 0xFFC00000

An alternative is to put these lines into a text file (e.g. ppcjtag) and then include them all using a command of the form: script ppcjtag The most frequently used flash-access commands are readmem and flashmem. Below is output from an actual session where a LS 1 (ppc) was unbricked. The corrupted stock bootloader was replaced with u-boot.

root@bitbaker-i686:/# jtag JTAG Tools 0.6 Copyright (C) 2002, 2003 ETC s.r.o. JTAG Tools is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. There is absolutely no warranty for JTAG Tools.

Warning: JTAG Tools may damage your hardware! Type "quit" to exit!

Type "help" for help.

jtag> cable parallel 0x378 WIGGLER Initializing Macraigor Wiggler JTAG Cable on parallel port at 0x378 nd Ground Signals signal GND jtag> jtag> jtag> jtag> jtag> detect F07 F08 F09 IR length: 8 Chain length: 1 Device Id: 0 chain.c(110) Part 0 without active instruction chain.c(133) Part 0 without active instruction chain.c(110) Part 0 without active instruction jtag> jtag> jtag> jtag> jtag> # signal list (see Table 17 in [1]) jtag> jtag> # PCI Interface Signals jtag> signal nC/BE3 V11 jtag> signal nC/BE2 V7 jtag> signal nC/BE1 W3

... blah blah blah ...

jtag> bit 2 B 0 AD14 21 0 Z jtag> bit 1 B 0 AD13 21 0 Z jtag> bit 0 B 0 AD12 21 0 Z jtag> jtag> initbus mpc824x jtag> jtag> jtag> jtag> jtag> jtag> # ==================================== jtag> jtag> jtag> endian big jtag> jtag> instruction SAMPLE/PRELOAD jtag> jtag> shift ir jtag> jtag> shift dr jtag> jtag> dr 0101111100001100110111110000100000000000000000000000000000000000000000001111111111111111111111111111111111110 1010110000000000000000000000000000000001000000000000000000000000000000000000000000000000010001111111001110111 1111011110000100111111111111100000000100100010000000011111111110111111111111010111101111010111111011000101100 0000010010111111100000000000000000000000010101101100010001010100111010000000000000000000000000000000000000000 00000100011111010110111011001110011001111101111111100000000000000000000 jtag> jtag> instruction EXTEST jtag> jtag> shift ir jtag> jtag> jtag> jtag> initbus mpc824x jtag> jtag> jtag> jtag> jtag> detectflash 0xFFC00000 Query identification string: Primary Algorithm Command Set and Control Interface ID Code: 0x0002 (AMD/Fujitsu Standard Command Set) Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null) Query system interface information: Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV  Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV   Vpp [Programming] Supply Minimum Write/Erase voltage: 11500 mV   Vpp [Programming] Supply Maximum Write/Erase voltage: 12500 mV   Typical timeout per single byte/word program: 16 us   Typical timeout for maximum-size multi-byte program: 0 us   Typical timeout per individual block erase: 1024 ms   Typical timeout for full chip erase: 0 ms   Maximum timeout for byte/word program: 512 us   Maximum timeout for multi-byte program: 0 us   Maximum timeout per individual block erase: 16384 ms   Maximum timeout for chip erase: 0 ms Device geometry definition: Device Size: 4194304 B (4096 KiB, 4 MiB) Flash Device Interface Code description: 0x0002 (x8/x16) Maximum number of bytes in multi-byte program: 1 Number of Erase Block Regions within device: 4 Erase Block Region Information: Region 0: Erase Block Size: 65536 B (64 KiB) Number of Erase Blocks: 63 Region 1: Erase Block Size: 32768 B (32 KiB) Number of Erase Blocks: 1 Region 2: Erase Block Size: 8192 B (8 KiB) Number of Erase Blocks: 2 Region 3: Erase Block Size: 16384 B (16 KiB) Number of Erase Blocks: 1 jtag> jtag> flashmem 0xFFF00000 u-boot.bin Chip: AMD Flash Manufacturer: ST/Samsung Chip: M29W320DT Protected: 0000 program: flash_unlock_block 0xFFF00000 IGNORE

block 48 unlocked flash_erase_block 0xFFF00000 ..................................................................................................flash_erase_block 0xFFF00000 DONE erasing block 48: 0 flash_unlock_block 0xFFF10000 IGNORE

block 49 unlocked flash_erase_block 0xFFF10000 ................................................................................................flash_erase_block 0xFFF10000 DONE erasing block 49: 0 flash_unlock_block 0xFFF20000 IGNORE

block 50 unlocked flash_erase_block 0xFFF20000 ..................................................................................................flash_erase_block 0xFFF20000 DONE erasing block 50: 0 addr: 0xFFF2BB58 (done) verify: addr: 0xFFF2BB57 Done. jtag>

NOTES:
 * You may need to run as root to access the parallel port device.
 * Be sure to specify the correct cable type. Enter "help cable" for a list of cables.
 * detect should print out a list of parts detected. If it prints out nothing then the rest of the commands will fail.
 * Double check Flash ROM and/or Information/PPCFlashROM to verify the address of the flash for your board.
 * I (original author?) did not get this to work so the instructions above may be incorrect.
 * I did get 0.6 to work fine for me in July 2008, on Ubuntu Hardy.