JTAG Software/Openwince

From NAS-Central Buffalo - The Linkstation Wiki
Jump to: navigation, search

Contents

Openwince-JTAG

OpenWinCE is a collection of tools and utilities for Windows CE on the MIPS platform. The JTAG tool is one of the utilities they provide.

Compiler Your Own or Download a Working Binary Tarball

Build Your Own

You can get the source from the sf download site, but that is a bit older than what is in CVS, so I suggest to pull from CVS directly. The module name is jtag.

cvs -d:pserver:anonymous@openwince.cvs.sourceforge.net:/cvsroot/openwince login
cvs -z3 -d:pserver:anonymous@openwince.cvs.sourceforge.net:/cvsroot/openwince co -P jtag

Then compile with

cd jtag
./autogen.sh
./configure
make

You could also try the Debian sources from http://packages.ubuntu.com/gutsy/source/openwince-jtag . Running "apt-get build-dep openwince-jtag" (to get dependencies) prior to the build makes things go smoother.


Use a Precompiled Version

As of July 2008, the 0.5.1 version would not build properly for me on Ubuntu-Hardy. Instead I used this precompiled tarball of version 0.6 jtag_compiled_tools.tgz . It worked well and I was able to recover my LS1 (PPC), but be advised that it loads in a few libs into /usr/local/lib that confused other parts of my Ubuntu installation - you may need to remove those after using the software. Update: I have tested it now (after removing those libs and just using the corresponding ones in Ubuntu Heron and Intrepid) a 2nd and 3rd time, unbricking another LS1 and a LS-HS, and it continues to work fine. This may not be the case on other distros, but it worked for me. Davygravy 12:07, 12 February 2009 (UTC)

Interface Cable and Connection

Openwince-JTAG works with parallel port cables such as the Wiggler. There are a couple of patches that try to add support for various USB cables, but they have not been integrated into CVS yet, so you will need to apply them yourself if you have a USB cable. The command help cable will list pertinent info on cables:

jtag> help cable
Usage: cable parallel PORTADDR CABLE
Usage: cable ppdev DEV CABLE
Select JTAG cable connected to parallel port.

PORTADDR   parallel port address (e.g. 0x378)
CABLE      cable type
DEV        ppdev device (e.g. /dev/parport0)

List of supported cables:
none          No cable connected
ARCOM         Arcom JTAG Cable
ByteBlaster   Altera ByteBlaster/ByteBlaster II/ByteBlasterMV Parallel Port Download Cable
DLC5          Xilinx DLC5 JTAG Parallel Cable III
EA253         ETC EA253 JTAG Cable
EI012         ETC EI012 JTAG Cable
KeithKoep     Keith & Koep JTAG cable
Lattice       Lattice Parallel Port JTAG Cable
MPCBDM        Mpcbdm JTAG cable
TRITON        Ka-Ro TRITON Starterkit II (PXA255/250) JTAG Cable
WIGGLER       Macraigor Wiggler JTAG Cable

You will have to solder headers onto your board as shown here : Add a JTAG Port.

Connect the Wiggler or other adapter using this - pinout. Note that several different machines are shown here.

Board Support

Depending on your architecture, you may need to find or create a board support file.

  • Linkstation 1 (ppc) user can use this board specification file .
  • Linkstation HG (ppc) users, use the msp8241 board specification file.
  • Linkstation HS (ppc) users use same board specification files as LS1
  • TeraStation Original (ppc) users use same board specification files as LS1
  • TeraStation Home Server (ppc) users use same board specification files as LS1
  • TeraStation Pro (ppc) users use same board specification files as LS1
  • Others: post them here when you figure it out.

Jtag Basic Commands and Usage

Run jtag as root, and cd to where ever you have your u-boot image waiting to burn. There is a help command for a list of commands, and help <command> will give you details on each command.

cd /
root@bitbaker-i686:/# jtag
JTAG Tools 0.6
Copyright (C) 2002, 2003 ETC s.r.o.
JTAG Tools is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
There is absolutely no warranty for JTAG Tools.

Warning: JTAG Tools may damage your hardware! Type "quit" to exit!

Type "help" for help.

jtag> help
Command list:

quit          exit and terminate this session
help          display this help
frequency     setup JTAG frequency
cable         select JTAG cable
reset         reset JTAG chain
discovery     discovery of unknown parts in the JTAG chain
detect        detect parts on the JTAG chain
signal        define new signal for a part
salias        define an alias for a signal
bit           define new BSR bit
register      define new data register for a part
initbus       initialize bus driver for active part
print         display JTAG chain list/status
part          change active part for current JTAG chain
bus           change active bus
instruction   change active instruction for a part or declare new instruction
shift         shift data/instruction registers through JTAG chain
dr            display active data register for a part
get           get external signal value
set           set external signal value
endian        set/print endianess
peek          read a single word
poke          write a single word
readmem       read content of the memory and write it to file
detectflash   detect parameters of flash chips attached to a part
flashmem      burn flash memory with data from a file
eraseflash    erase flash memory by number of blocks
script        run command sequence from external file
include       include command sequence from external repository

Type "help COMMAND" for details about a particular command.
jtag>


Flash Programming

Running the following code should get you ready to reprogram the flash chip if you are using a Wiggler paraport device. If the third line include command doesn't work, the easy workaround is to simply cut and paste the entire file (including comment and blank lines).

cable parallel 0x378 WIGGLER
detect
include Openwince-jtag-mpc8241.txt
endian big 
instruction SAMPLE/PRELOAD 
shift ir 
shift dr  
dr 
instruction EXTEST 
shift ir 
initbus mpc824x 
detectflash 0xFFC00000

An alternative is to put these lines into a text file (e.g. ppcjtag) and then include them all using a command of the form:

script ppcjtag

The most frequently used flash-access commands are readmem and flashmem. Below is output from an actual session where a LS 1 (ppc) was unbricked. The corrupted stock bootloader was replaced with u-boot.

root@bitbaker-i686:/# jtag
JTAG Tools 0.6
Copyright (C) 2002, 2003 ETC s.r.o.
JTAG Tools is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
There is absolutely no warranty for JTAG Tools.

Warning: JTAG Tools may damage your hardware! Type "quit" to exit!

Type "help" for help.

jtag> cable parallel 0x378 WIGGLER
Initializing Macraigor Wiggler JTAG Cable on parallel port at 0x378
nd Ground Signals
signal GND jtag>
jtag>
jtag>
jtag>
jtag> detect
F07 F08 F09
IR length: 8
Chain length: 1
Device Id: 0
chain.c(110) Part 0 without active instruction
chain.c(133) Part 0 without active instruction
chain.c(110) Part 0 without active instruction
jtag>
jtag>
jtag>
jtag>
jtag> # signal list (see Table 17 in [1])
jtag>
jtag> # PCI Interface Signals
jtag> signal nC/BE3 V11
jtag> signal nC/BE2 V7
jtag> signal nC/BE1 W3


...  blah blah blah ...


jtag> bit 2 B 0 AD14 21 0 Z
jtag> bit 1 B 0 AD13 21 0 Z
jtag> bit 0 B 0 AD12 21 0 Z
jtag>
jtag> initbus mpc824x
jtag>
jtag>
jtag>
jtag>
jtag>
jtag> # ====================================
jtag>
jtag>
jtag> endian big
jtag>
jtag> instruction SAMPLE/PRELOAD
jtag>
jtag> shift ir
jtag>
jtag> shift dr 
jtag>
jtag> dr
0101111100001100110111110000100000000000000000000000000000000000000000001111111111111111111111111111111111110
1010110000000000000000000000000000000001000000000000000000000000000000000000000000000000010001111111001110111
1111011110000100111111111111100000000100100010000000011111111110111111111111010111101111010111111011000101100
0000010010111111100000000000000000000000010101101100010001010100111010000000000000000000000000000000000000000
00000100011111010110111011001110011001111101111111100000000000000000000
jtag>
jtag> instruction EXTEST
jtag> 
jtag> shift ir
jtag>
jtag>
jtag>
jtag> initbus mpc824x
jtag>
jtag>
jtag>
jtag>
jtag> detectflash 0xFFC00000
Query identification string:
   Primary Algorithm Command Set and Control Interface ID Code: 0x0002 (AMD/Fujitsu Standard Command Set)
   Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null)
Query system interface information:
   Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV
   Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV
   Vpp [Programming] Supply Minimum Write/Erase voltage: 11500 mV
   Vpp [Programming] Supply Maximum Write/Erase voltage: 12500 mV
   Typical timeout per single byte/word program: 16 us
   Typical timeout for maximum-size multi-byte program: 0 us
   Typical timeout per individual block erase: 1024 ms
   Typical timeout for full chip erase: 0 ms
   Maximum timeout for byte/word program: 512 us
   Maximum timeout for multi-byte program: 0 us
   Maximum timeout per individual block erase: 16384 ms
   Maximum timeout for chip erase: 0 ms
Device geometry definition:
   Device Size: 4194304 B (4096 KiB, 4 MiB)
   Flash Device Interface Code description: 0x0002 (x8/x16)
   Maximum number of bytes in multi-byte program: 1
   Number of Erase Block Regions within device: 4
   Erase Block Region Information:
      Region 0:
         Erase Block Size: 65536 B (64 KiB)
         Number of Erase Blocks: 63
      Region 1:
         Erase Block Size: 32768 B (32 KiB)
         Number of Erase Blocks: 1
      Region 2:
         Erase Block Size: 8192 B (8 KiB)
         Number of Erase Blocks: 2
      Region 3:
         Erase Block Size: 16384 B (16 KiB)
         Number of Erase Blocks: 1
jtag>
jtag> flashmem 0xFFF00000 u-boot.bin
Chip: AMD Flash
   Manufacturer: ST/Samsung
   Chip: M29W320DT
   Protected: 0000
program:
flash_unlock_block 0xFFF00000 IGNORE

block 48 unlocked
flash_erase_block 0xFFF00000
..................................................................................................flash_erase_block 0xFFF00000 DONE
erasing block 48: 0
flash_unlock_block 0xFFF10000 IGNORE

block 49 unlocked
flash_erase_block 0xFFF10000
................................................................................................flash_erase_block 0xFFF10000 DONE
erasing block 49: 0
flash_unlock_block 0xFFF20000 IGNORE

block 50 unlocked
flash_erase_block 0xFFF20000
..................................................................................................flash_erase_block 0xFFF20000 DONE
erasing block 50: 0
addr: 0xFFF2BB58 (done)
verify:
addr: 0xFFF2BB57
Done.
jtag> 


NOTES:

  • You may need to run as root to access the parallel port device.
  • Be sure to specify the correct cable type. Enter "help cable" for a list of cables.
  • detect should print out a list of parts detected. If it prints out nothing then the rest of the commands will fail.
  • Double check Flash ROM and/or Information/PPCFlashROM to verify the address of the flash for your board.
  • I (original author?) did not get this to work so the instructions above may be incorrect.
  • I did get 0.6 to work fine for me in July 2008, on Ubuntu Hardy.

See Also