JTAG Programming on Kurobox HG with Openwince JTAG 0.5.1

Antiriad · **Joined:** Sat Oct 06, 2007 10:08 pm **Posts:** 29

Guys

A couple of weeks ago I bricked my Kurobox HG by flashing the wrong UBOOT version.

I managed to get a Wiggler type cable and I was able to get a preinstalled package of Openwince JTAG 0.5.1 from
apt-get under Ubuntu and Debian and I copied the mpc8241 file manually.

I was able to get the "cable" and "detect" commands to work however when I try to
run the

Code:

include motorola/mpc8241/1.2

I get

Code:

salias : unknown command

multiple times

and

Code:

unknown bus: mpc824X

It seems to me that the salias command doesn't exist in this version.

I tried to install JTAG 0.6 but I failed multiple times in Ubuntu, Debian and Cygwin

I need serious help...I have spend more than 20 hours trying to fix the problem. Doe anybody have suggestions.

I am also willing to send the box to somebody to flash.

Thanks

I am ready to throw the DAMN thing out the window... :evil:

Sylver · **Posted:** Sat Oct 06, 2007 10:50 pm

http://salias.sourceforge.net/

Antiriad · **Joined:** Sat Oct 06, 2007 10:08 pm **Posts:** 29

I had good progress

Apparently I managed to get the compiled binaries for Openwince JTAG 0.6.

It seems that the missing commands for the 1.2 mpc8241 are implemented only under
this Version meaning that users who where trying with JTAG 0.5.1 are wasting their time.

I was able to get the following scripts to work

Code:

jtag> cable parallel 0x378 WIGGLER
jtag> detect
jtag> include motorola/mpc8241/1.2 
jtag> endian big 
jtag> instruction SAMPLE/PRELOAD 
jtag> shift ir 
jtag> shift dr  
jtag> dr 
jtag> instruction EXTEST 
jtag> shift ir 
jtag> initbus mpc824x 
jtag> detectflash 0xFFC00000 

I flashed the memory at 0xFFF00000 with the U-Boot.bin which took a couple of hours for only 162k :oops:

However where the flashing was complete I got a error when the JTAG program tried to Verify. I then used the
flashread command for the same memory location and the memory contents where COMPLETELY different from the u-boot.bin(You can actually view the u-boot header under a binary editor).

I tried to burn a couple of times and everytime I was getting the same different data.

Anyone has any clues? FYI I am using a WIGGLER Type cable and not the usual DLC5 cable.

Thanks

Mike

Antiriad · **Joined:** Sat Oct 06, 2007 10:08 pm **Posts:** 29

It seems that I cannot write to the Flash. I tried to do a couple of PEEK and POKE commands and I am not able to write to write any data. Anytime I try to read back I read 0x27 on 0xFFF00000.

Is there a problem with the Cable or with the precompiled JTAG 0.6.

Does anyone have a known working JTAG 0.6 compiled the correct way?

I also forgot to mention that I am runnit JTAG under vmware and UBUNTU.

Thanks

Antiriad · **Joined:** Sat Oct 06, 2007 10:08 pm **Posts:** 29

I also noticed the following issues

Vpp [Programming] is set to 0 mV

and the JTAG can only "see" 2 Erase regions.

Do I need to short any pins on the Motherboard in order to enable programming?

Code:

jtag> detectflash 0xFFC00000
 Query identification string:
         Primary Algorithm Command Set and Control Interface ID Code: 0x0002 (AMD
 /Fujitsu Standard Command Set)
         Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (n
 ull)
 Query system interface information:
         Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV
         Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV
         [b]Vpp [Programming] Supply Minimum Write/Erase voltage: 0 mV
         Vpp [Programming] Supply Maximum Write/Erase voltage: 0 mV[/b]
         Typical timeout per single byte/word program: 16 us
         Typical timeout for maximum-size multi-byte program: 0 us
         Typical timeout per individual block erase: 1024 ms
         Typical timeout for full chip erase: 0 ms
         Maximum timeout for byte/word program: 512 us
         Maximum timeout for multi-byte program: 0 us
         Maximum timeout per individual block erase: 16384 ms
         Maximum timeout for chip erase: 0 ms
 Device geometry definition:
         Device Size: 4194304 B (4096 KiB, 4 MiB)
         Flash Device Interface Code description: 0x0002 (x8/x16)
         Maximum number of bytes in multi-byte program: 32
         [b]Number of Erase Block Regions within device: 2[/b]
         Erase Block Region Information:
                 Region 0:
                         Erase Block Size: 16384 B (16 KiB)
                         Number of Erase Blocks: 1
                 Region 1:
                         Erase Block Size: 8192 B (8 KiB)
                         Number of Erase Blocks: 2

Update:

After doing more research I found out that the problem is related with the compilation of JTAG 0.6 WITHOUT the modified amd.c file on the source. I have tried to compile the JTAG tools from source multiple times without ANY success.

I download the JTAG compiled tools from http://buffalo.nas-central.org/download/ALL_LS_KB_PPC/Packages/

mindbender · **Posted:** Mon Oct 08, 2007 1:20 pm

have you bridged R67? there the power comes from.

Antiriad · **Joined:** Sat Oct 06, 2007 10:08 pm **Posts:** 29

mindbender wrote:

have you bridged R67? there the power comes from.

I added a Bridge initially but I replaced it with a 1k Resistor(603 Surface mount). It seem that bridging the R67 brings power to the JTAG Port. However my JTAG cable is USB powered.

It seems that the R67 Bridge doesn't provide enough power to Wiggler cable that I have.

Could somebody e-mail me the precompiled JTAG tools out of a working System?

I had done some research on this forums and one other guy had the same problem and he managerd to solved it when his friend recompiled the JTAG 0.6 software for him.

kuroguy · **Joined:** Tue Mar 21, 2006 9:11 pm **Posts:** 658

use the version of jtag tools linked from the "building and using jtag tools" wiki page. it is patched to work with the 8241 SOC.

Antiriad · **Joined:** Sat Oct 06, 2007 10:08 pm **Posts:** 29

kuroguy wrote:

use the version of jtag tools linked from the "building and using jtag tools" wiki page. it is patched to work with the 8241 SOC.

I recompiled everything under Centos 4.

Still cannot but to Flash....I always get the verify error and contents do not match.

Is there an issue with the JTAG Cable?

deathrattle · **Joined:** Tue Sep 26, 2006 4:46 pm **Posts:** 20

Dear fellows,

I am trying to unbrick my HG too.

But I did not get that far...

I build the cable from the wiki and now I was stopped at the jtagtools (jtag_compiled_tools from the download section).

Evertime I try to use the "include motorola/mpc8241/1.2" command it quits with "Unable to open file 'motorola/mpc8241/1.2'".

Can anybody give me a hint please?

Thx !

DeathRattle

mindbender · **Posted:** Wed Nov 07, 2007 2:20 pm

yes! i always ran/run into that problem. i always used ubuntu....the jtagtools tarball was compiled with suse...i don`t know if that makes a difference.

i never found the reason for that....the only workaround i found out is to copy & paste all the lines from the file motorola/mpc8241/1.2 directly into the jtag-tools-shell.

then it works.

deathrattle · **Joined:** Tue Sep 26, 2006 4:46 pm **Posts:** 20

Hi mindbender,

you are totally right !

The chip is being flashed right now.
So I can test in a few hours.

I hope it gets through.

Thank you very much for your workaround! :biglol:

mindbender · **Posted:** Wed Nov 07, 2007 9:01 pm

when you already flash your box via jtag..i hope you flash the uboot bootloader? because then you can flash the 2.4.33.3 firmimg.bin from within uboot as far as i know...should be done within an hour both together...

deathrattle · **Joined:** Tue Sep 26, 2006 4:46 pm **Posts:** 20

It is running again.

Yes, I flashed the u-boot file and it took round about one and a half hour.

I use u-boot (and the 2.4.33.3) for more than a year now.

Unfortunately I ran into an accident with it...

I tried to flash a new firmware out of the u-boot console.
But I forgot to place the file on the harddisk. Two sectors were erased and the box didn´t start anymore.

JTAG reanimated the "zombie" again.

davy_gravy · **Joined:** Mon Aug 28, 2006 1:15 am **Posts:** 2606

mindbender wrote:

yes! i always ran/run into that problem. i always used ubuntu....the jtagtools tarball was compiled with suse...i don`t know if that makes a difference.

i never found the reason for that....the only workaround i found out is to copy & paste all the lines from the file motorola/mpc8241/1.2 directly into the jtag-tools-shell.

then it works.

I had to think about this for a second... so I just cut and pasted the entire page in one fell swoop...

I'm using URJTAG 0.8 in Ubuntu Hardy ... it is currently flashing ... we'll see if it works...

EDIT:

Code:

jtag 

UrJTAG 0.8 #1067
Copyright (C) 2002, 2003 ETC s.r.o.
Copyright (C) 2007, 2008 Kolja Waschk and the respective authors

UrJTAG is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
There is absolutely no warranty for UrJTAG.

WARNING: UrJTAG may damage your hardware!
Type "quit" to exit, "help" for help.

jtag> cable parallel 0x378 WIGGLER
Note: the 'cable' command syntax changed, please read the help text
Initializing parallel port at 0x378
jtag> cable help
Unknown cable type: help
jtag> help
Command list:

quit          exit and terminate this session
help          display this help
frequency     setup JTAG frequency
cable         select JTAG cable
reset         reset JTAG chain
discovery     discovery of unknown parts in the JTAG chain
detect        detect parts on the JTAG chain
signal        define new signal for a part
scan          read BSR and show changes since last scan
salias        define an alias for a signal
bit           define new BSR bit
register      define new data register for a part
initbus       initialize bus driver for active part
print         display JTAG chain list/status
part          change active part for current JTAG chain
bus           change active bus
instruction   change active instruction for a part or declare new instruction
shift         shift data/instruction registers through JTAG chain
dr            display active data register for a part
get           get external signal value
test          test external signal value
shell         shell cmmd
set           set external signal value
endian        set/print endianess
peek          read a single word
poke          write a single word
readmem       read content of the memory and write it to file
writemem      write content of file to the memory
detectflash   detect parameters of flash chips attached to a part
flashmem      burn flash memory with data from a file
eraseflash    erase flash memory by number of blocks
script        run command sequence from external file
include       include command sequence from external repository
svf           execute svf commands from file
bsdl          manage BSDL files
debug         debug jtag program

Type "help COMMAND" for details about a particular command.
jtag> quit
root@bitbaker-i686:/usr/src/urjtag-0.8# jtag 

UrJTAG 0.8 #1067
Copyright (C) 2002, 2003 ETC s.r.o.
Copyright (C) 2007, 2008 Kolja Waschk and the respective authors

UrJTAG is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
There is absolutely no warranty for UrJTAG.

WARNING: UrJTAG may damage your hardware!
Type "quit" to exit, "help" for help.

jtag> help cable
Usage: cable DRIVER [DRIVER_OPTS]
Select JTAG cable type.

DRIVER      name of cable
DRIVER_OPTS options for the selected cable

Type "cable DRIVER help" for info about options for cable DRIVER.

List of supported cables:
ARCOM         Arcom JTAG Cable
ByteBlaster   Altera ByteBlaster/ByteBlaster II/ByteBlasterMV Parallel Port Download Cable
DLC5          Xilinx DLC5 JTAG Parallel Cable III
EA253         ETC EA253 JTAG Cable
EI012         ETC EI012 JTAG Cable
IGLOO         Excelpoint IGLOO JTAG Cable
KeithKoep     Keith & Koep JTAG cable
Lattice       Lattice Parallel Port JTAG Cable
MPCBDM        Mpcbdm JTAG cable
TRITON        Ka-Ro TRITON Starterkit II (PXA255/250) JTAG Cable
WIGGLER       Macraigor Wiggler JTAG Cable
WIGGLER2      Modified (with CPU Reset) WIGGLER JTAG Cable
jtag> cable WIGGLER help
Usage: cable WIGGLER parallel PORTADDR [TDO,TRST,TDI,TCK,TMS,SRESET]
   or: cable WIGGLER ppdev PPDEV [TDO,TRST,TDI,TCK,TMS,SRESET]

PORTADDR   parallel port address (e.g. 0x378)
PPDEF      ppdev device (e.g. /dev/parport0)
TDO, ...   parallel port bit number, prepend '#' for inversion
           default is '7,4,3,2,1,#0'

jtag> cable WIGGLER parallel 0x378
Initializing parallel port at 0x378
jtag> detect
IR length: 8
Chain length: 1
Device Id: 0 (0x0000000000000000)
chain.c(129) Part 0 without active instruction
chain.c(160) Part 0 without active instruction
chain.c(129) Part 0 without active instruction
jtag> endian big


  ...blah blah ...

jtag> bit 1 B 0 AD13 21 0 Z
jtag> bit 0 B 0 AD12 21 0 Z
jtag> 
jtag> initbus mpc824x
jtag> 
jtag> instruction SAMPLE/PRELOAD
jtag> shift ir
jtag> shift dr
jtag> dr 
110101100011110011011111000010000000000000000000000000000000000000000000100000001111111111111111111111111111010101100000000000000000000000000000000010000000000000000000000000000000001111111000000001000011110000011101111111111110001000011111111111111110000111100000000000011111101110111111111111010101111111010101011011000101100000001001011111110101010000001000000111001010111110001000101010011101111111111111000000000000000000000000000000000111111111010110111010001110010001111101111110011111111111111111111
jtag> instruction EXTEST
jtag> shift ir 
jtag> initbus mpc824x
jtag> detectflash 0xFFC00000
Query identification string:
   Primary Algorithm Command Set and Control Interface ID Code: 0x0002 (AMD/Fujitsu Standard Command Set)
   Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null)
Query system interface information:
   Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV
   Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV
   Vpp [Programming] Supply Minimum Write/Erase voltage: 11500 mV
   Vpp [Programming] Supply Maximum Write/Erase voltage: 12500 mV
   Typical timeout per single byte/word program: 16 us
   Typical timeout for maximum-size multi-byte program: 0 us
   Typical timeout per individual block erase: 1024 ms
   Typical timeout for full chip erase: 0 ms
   Maximum timeout for byte/word program: 512 us
   Maximum timeout for multi-byte program: 0 us
   Maximum timeout per individual block erase: 16384 ms
   Maximum timeout for chip erase: 0 ms
Device geometry definition:
   Device Size: 4194304 B (4096 KiB, 4 MiB)
   Flash Device Interface Code description: 0x0002 (x8/x16)
   Maximum number of bytes in multi-byte program: 1
   Number of Erase Block Regions within device: 4
   Erase Block Region Information:
      Region 0:
         Erase Block Size: 16384 B (16 KiB)
         Number of Erase Blocks: 1
      Region 1:
         Erase Block Size: 8192 B (8 KiB)
         Number of Erase Blocks: 2
      Region 2:
         Erase Block Size: 32768 B (32 KiB)
         Number of Erase Blocks: 1
      Region 3:
         Erase Block Size: 65536 B (64 KiB)
         Number of Erase Blocks: 63
jtag> flashmem 0xFFF00000 u-boot-lsppchd-flash-1.2.0-r2.bin 
Chip: AMD Flash
   Manufacturer: ST/Samsung
   Chip: Unknown (ID 0x0000)
   Protected: 00ca
program:
flash_unlock_block 0xFFF00000 IGNORE

block 51 unlocked
flash_erase_block 0xFFF00000
flash_erase_block 0xFFF00000 DONE
erasing block 51: 0
flash_unlock_block 0xFFF10000 IGNORE

block 52 unlocked
flash_erase_block 0xFFF10000
flash_erase_block 0xFFF10000 DONE
erasing block 52: 0
flash_unlock_block 0xFFF20000 IGNORE

block 53 unlocked
flash_erase_block 0xFFF20000
flash_erase_block 0xFFF20000 DONE
erasing block 53: 0
addr: 0xFFF2BB0000
verify:

verify error:
read: 0x00000000
expected: 0x00000027

No joy yet.

Buffalo NAS-Central Forums

JTAG Programming on Kurobox HG with Openwince JTAG 0.5.1

Who is online