From NAS-Central Buffalo - The Linkstation Wiki
- Add a 10-pin JTAG connector at the pads labeled CN7. The pin numbering is the same as CN3 on Install_a_JTAG_Port.
- Bridge TMS at the two pads labeled C227 on the top side, near the CPU.
- Bridge TDO under C25 on the bottom side, near CN7.
Open On-Chip Debugger
JTAG tap: feroceon.cpu tap/device found: 0x07926041 (mfg: 0x020, part: 0x7926, ver: 0x0)
JTAG Tap/device matched
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x800000d3 pc: 0x00f3aac0
MMU: disabled, D-Cache: disabled, I-Cache: enabled
> flash probe 0
Flash Manufacturer/Device: 0x00bf 0x00d6
flash 'cfi' found at 0xfffc0000
> dump_image currentcontents.bin 0xfffc0000 0x40000
dumped 262144 byte in 156.199112s
- This procedure has been tested on only one unit. Someone please confirm.
- Writing to the flash with JTAG has not been tested.
- Bridging C228 instead of C227 activates another JTAG target with ID 0x5182 instead of 0x7926. One pin is probably JT_TMS_CPU and the other JT_TMS_CORE (from the Marvel 88F5182 datasheets). Apparently both cannot be active simultaneously.
- See also this topic: http://forum.buffalo.nas-central.org/viewtopic.php?f=61&t=20726