From NAS-Central Buffalo - The Linkstation Wiki
OpenWinCE is a collection of tools and utilities for Windows CE on the MIPS platform. The JTAG tool is one of the utilities they provide.
Compiler Your Own or Download a Working Binary Tarball
Build Your Own
cvs -d:pserver:email@example.com:/cvsroot/openwince login cvs -z3 -d:pserver:firstname.lastname@example.org:/cvsroot/openwince co -P jtag
Then compile with
cd jtag ./autogen.sh ./configure make
You could also try the Debian sources from http://packages.ubuntu.com/gutsy/source/openwince-jtag . Running "apt-get build-dep openwince-jtag" (to get dependencies) prior to the build makes things go smoother.
Use a Precompiled Version
As of July 2008, the 0.5.1 version would not build properly for me on Ubuntu-Hardy. Instead I used this precompiled tarball of version 0.6 jtag_compiled_tools.tgz . It worked well and I was able to recover my LS1 (PPC), but be advised that it loads in a few libs into /usr/local/lib that confused other parts of my Ubuntu installation - you may need to remove those after using the software. Update: I have tested it now (after removing those libs and just using the corresponding ones in Ubuntu Heron and Intrepid) a 2nd and 3rd time, unbricking another LS1 and a LS-HS, and it continues to work fine. This may not be the case on other distros, but it worked for me. Davygravy 12:07, 12 February 2009 (UTC)
Interface Cable and Connection
Openwince-JTAG works with parallel port cables such as the Wiggler. There are a couple of patches that try to add support for various USB cables, but they have not been integrated into CVS yet, so you will need to apply them yourself if you have a USB cable. The command help cable will list pertinent info on cables:
jtag> help cable Usage: cable parallel PORTADDR CABLE Usage: cable ppdev DEV CABLE Select JTAG cable connected to parallel port. PORTADDR parallel port address (e.g. 0x378) CABLE cable type DEV ppdev device (e.g. /dev/parport0) List of supported cables: none No cable connected ARCOM Arcom JTAG Cable ByteBlaster Altera ByteBlaster/ByteBlaster II/ByteBlasterMV Parallel Port Download Cable DLC5 Xilinx DLC5 JTAG Parallel Cable III EA253 ETC EA253 JTAG Cable EI012 ETC EI012 JTAG Cable KeithKoep Keith & Koep JTAG cable Lattice Lattice Parallel Port JTAG Cable MPCBDM Mpcbdm JTAG cable TRITON Ka-Ro TRITON Starterkit II (PXA255/250) JTAG Cable WIGGLER Macraigor Wiggler JTAG Cable
You will have to solder headers onto your board as shown here : Add a JTAG Port.
Connect the Wiggler or other adapter using this - pinout. Note that several different machines are shown here.
Depending on your architecture, you may need to find or create a board support file.
- Linkstation 1 (ppc) user can use this board specification file .
- Linkstation HG (ppc) users, use the msp8241 board specification file.
- Linkstation HS (ppc) users use same board specification files as LS1
- TeraStation Original (ppc) users use same board specification files as LS1
- TeraStation Home Server (ppc) users use same board specification files as LS1
- TeraStation Pro (ppc) users use same board specification files as LS1
- Others: post them here when you figure it out.
Jtag Basic Commands and Usage
Run jtag as root, and cd to where ever you have your u-boot image waiting to burn. There is a help command for a list of commands, and help <command> will give you details on each command.
cd / root@bitbaker-i686:/# jtag JTAG Tools 0.6 Copyright (C) 2002, 2003 ETC s.r.o. JTAG Tools is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. There is absolutely no warranty for JTAG Tools. Warning: JTAG Tools may damage your hardware! Type "quit" to exit! Type "help" for help. jtag> help Command list: quit exit and terminate this session help display this help frequency setup JTAG frequency cable select JTAG cable reset reset JTAG chain discovery discovery of unknown parts in the JTAG chain detect detect parts on the JTAG chain signal define new signal for a part salias define an alias for a signal bit define new BSR bit register define new data register for a part initbus initialize bus driver for active part print display JTAG chain list/status part change active part for current JTAG chain bus change active bus instruction change active instruction for a part or declare new instruction shift shift data/instruction registers through JTAG chain dr display active data register for a part get get external signal value set set external signal value endian set/print endianess peek read a single word poke write a single word readmem read content of the memory and write it to file detectflash detect parameters of flash chips attached to a part flashmem burn flash memory with data from a file eraseflash erase flash memory by number of blocks script run command sequence from external file include include command sequence from external repository Type "help COMMAND" for details about a particular command. jtag>
Running the following code should get you ready to reprogram the flash chip if you are using a Wiggler paraport device. If the third line include command doesn't work, the easy workaround is to simply cut and paste the entire file (including comment and blank lines).
cable parallel 0x378 WIGGLER detect include Openwince-jtag-mpc8241.txt endian big instruction SAMPLE/PRELOAD shift ir shift dr dr instruction EXTEST shift ir initbus mpc824x detectflash 0xFFC00000
An alternative is to put these lines into a text file (e.g. ppcjtag) and then include them all using a command of the form:
The most frequently used flash-access commands are readmem and flashmem. Below is output from an actual session where a LS 1 (ppc) was unbricked. The corrupted stock bootloader was replaced with u-boot.
root@bitbaker-i686:/# jtag JTAG Tools 0.6 Copyright (C) 2002, 2003 ETC s.r.o. JTAG Tools is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. There is absolutely no warranty for JTAG Tools. Warning: JTAG Tools may damage your hardware! Type "quit" to exit! Type "help" for help. jtag> cable parallel 0x378 WIGGLER Initializing Macraigor Wiggler JTAG Cable on parallel port at 0x378 nd Ground Signals signal GND jtag> jtag> jtag> jtag> jtag> detect F07 F08 F09 IR length: 8 Chain length: 1 Device Id: 0 chain.c(110) Part 0 without active instruction chain.c(133) Part 0 without active instruction chain.c(110) Part 0 without active instruction jtag> jtag> jtag> jtag> jtag> # signal list (see Table 17 in ) jtag> jtag> # PCI Interface Signals jtag> signal nC/BE3 V11 jtag> signal nC/BE2 V7 jtag> signal nC/BE1 W3 ... blah blah blah ... jtag> bit 2 B 0 AD14 21 0 Z jtag> bit 1 B 0 AD13 21 0 Z jtag> bit 0 B 0 AD12 21 0 Z jtag> jtag> initbus mpc824x jtag> jtag> jtag> jtag> jtag> jtag> # ==================================== jtag> jtag> jtag> endian big jtag> jtag> instruction SAMPLE/PRELOAD jtag> jtag> shift ir jtag> jtag> shift dr jtag> jtag> dr 0101111100001100110111110000100000000000000000000000000000000000000000001111111111111111111111111111111111110 1010110000000000000000000000000000000001000000000000000000000000000000000000000000000000010001111111001110111 1111011110000100111111111111100000000100100010000000011111111110111111111111010111101111010111111011000101100 0000010010111111100000000000000000000000010101101100010001010100111010000000000000000000000000000000000000000 00000100011111010110111011001110011001111101111111100000000000000000000 jtag> jtag> instruction EXTEST jtag> jtag> shift ir jtag> jtag> jtag> jtag> initbus mpc824x jtag> jtag> jtag> jtag> jtag> detectflash 0xFFC00000 Query identification string: Primary Algorithm Command Set and Control Interface ID Code: 0x0002 (AMD/Fujitsu Standard Command Set) Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null) Query system interface information: Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV Vpp [Programming] Supply Minimum Write/Erase voltage: 11500 mV Vpp [Programming] Supply Maximum Write/Erase voltage: 12500 mV Typical timeout per single byte/word program: 16 us Typical timeout for maximum-size multi-byte program: 0 us Typical timeout per individual block erase: 1024 ms Typical timeout for full chip erase: 0 ms Maximum timeout for byte/word program: 512 us Maximum timeout for multi-byte program: 0 us Maximum timeout per individual block erase: 16384 ms Maximum timeout for chip erase: 0 ms Device geometry definition: Device Size: 4194304 B (4096 KiB, 4 MiB) Flash Device Interface Code description: 0x0002 (x8/x16) Maximum number of bytes in multi-byte program: 1 Number of Erase Block Regions within device: 4 Erase Block Region Information: Region 0: Erase Block Size: 65536 B (64 KiB) Number of Erase Blocks: 63 Region 1: Erase Block Size: 32768 B (32 KiB) Number of Erase Blocks: 1 Region 2: Erase Block Size: 8192 B (8 KiB) Number of Erase Blocks: 2 Region 3: Erase Block Size: 16384 B (16 KiB) Number of Erase Blocks: 1 jtag> jtag> flashmem 0xFFF00000 u-boot.bin Chip: AMD Flash Manufacturer: ST/Samsung Chip: M29W320DT Protected: 0000 program: flash_unlock_block 0xFFF00000 IGNORE block 48 unlocked flash_erase_block 0xFFF00000 ..................................................................................................flash_erase_block 0xFFF00000 DONE erasing block 48: 0 flash_unlock_block 0xFFF10000 IGNORE block 49 unlocked flash_erase_block 0xFFF10000 ................................................................................................flash_erase_block 0xFFF10000 DONE erasing block 49: 0 flash_unlock_block 0xFFF20000 IGNORE block 50 unlocked flash_erase_block 0xFFF20000 ..................................................................................................flash_erase_block 0xFFF20000 DONE erasing block 50: 0 addr: 0xFFF2BB58 (done) verify: addr: 0xFFF2BB57 Done. jtag>
- You may need to run as root to access the parallel port device.
- Be sure to specify the correct cable type. Enter "help cable" for a list of cables.
- detect should print out a list of parts detected. If it prints out nothing then the rest of the commands will fail.
- Double check Flash ROM and/or Information/PPCFlashROM to verify the address of the flash for your board.
- I (original author?) did not get this to work so the instructions above may be incorrect.
- I did get 0.6 to work fine for me in July 2008, on Ubuntu Hardy.