Building and using Openwince's JTAG Tools

From NAS-Central Buffalo - The Linkstation Wiki

WARNING! There is a possibility that you could brick your NAS with these instructions. Please make sure that you read the entire page carefully. There is also the possibility that you could unbrick your Kurobox with these instructions.

Building JTAG tools

JTAG tools command sequence to flash the bootloader

Commands to prepare the Kuro:

start jtag and execute the following commands at the jtag prompt:

jtag> cable parallel 0x378 DLC5
jtag> include motorola/mpc8241/1.2 
jtag> endian big 
jtag> instruction SAMPLE/PRELOAD 
jtag> shift ir 
jtag> shift dr  
jtag> dr 
jtag> instruction EXTEST 
jtag> shift ir 
jtag> initbus mpc824x 
jtag> detectflash 0xFFC00000 

According to the Flash ROM page, the flash map is as follows:

start	Size (HEX)	size	contents
0xFFF80000	0x080000	512 K	Empty
0xFFC00000	0x300000	3 MB	Linux/initrd
0xFFF00000	0x070000	448 K	bootcode.bin
0xFFF70000	0x010000	64K	HDD status (OKOKOK)

To read the bootloader which is stored at the area described as bootcode.bin type:

jtag> readmem 0xFFF00000 0x0070000 bootloader 

To write the bootloader type with file u-boot.bin type:

jtag> flashmem 0xFFF00000 u-boot.bin