JTAG - anyone get it to work fully? (technical discussion)

i have an elite box stuck in booting. Unfortunately, only the serial port's TX (from the box to pC) works so i cant break into the YAMON prompt. The boot sequence stops at this point:

tango2_enet: ethernet driver for SMP863x internal mac

So i am trying to recover box using the JTAG interface. I followed the details in other posts/sites about flashing NOR on a premuim(make parallel cable, use openocd), but i only got to the point where the on-chip debugger cant HALT the processor. Other users that had reached the same response were unable to solve (hanswurscht is one user from here). Also, the original author of that doc said procedure only worked on Premium, nor Elite. I Dont kniow why.

So, i would like to know has anyone here managed to use the JTAG interace and are there any other users who would like to contribute ideas to this thread in trying to get it to work?.

I think will be easier to reflash it with willem or compatible programmer

Regards

thx, but i would be unable to remove flash chip and solder it back in again. So i need a JTAG solution.

well i've reached a brick wall trying to get the JTAG to work on my Elite. I tried with unbuffered DLC-5 type and buffered Wiggler clone type cable configurations.

several programs such as OCD Commander, H-JTAG, TOPJTAG,URJTAG, EJTAG Tiny Tools, dont even see the Jtag connection

Some variations of hairydairymaids program: wrg54g_o, TJTAG, brjtag etc can get to recognise the chip ID, but cant do anything else.

Even with Openocd, you think its working in that you get the chip id and it allows to enter some commands like "targets" and you get a response, if you then power unit off, some commands give the same response , so i dont think its doing much more than reading the chip ID like the other programs.


It maybe my Elite is just plain faulty, but if anyone ever gets JTAG to work on elite, please post the details.

Also, other SMP8634 based devices have other ways to do emergency type boots, ie power up with TX and RX shorted, or press a key on the remote while booting up. So if anyone is aware of any boot shortcuts on the AZBOX , please let us know.

u can tray here
https://www.satpimps.co.uk/showthread.php?t=141544

thx, but that is recovery via YAMON and the serial port. I need a JTAG solution.

jtagging can be a bit hit and miss at the best of times , depending on box .

i would only buy a box if the jtag solution was solid as reflashing is common and jtagging is normally needed at sometime in a boxes life .

what jtag are you using ?

you could try building a few jtags to try .

"I tried with unbuffered DLC-5 type and buffered Wiggler clone type cable configurations."


I originally made up simple DLC-5 cable and when this didn't seem to work, i bought a universal adapter from TIAO. i connected that up as above, but no joy.

when jtagging there are a few tips to remember .

wire all the earths together . i.e. all earths on the serial/parrall port plug .

keep wires to and from the jtag as short as possible .

when i made my jtag for my 200s i didnt even use any wires just the resisters soldered from the port plug straight to the board . this also allows me to leave the jtag fitted inside the case , so i never have to look for it or worry about damage to the jtag .

i have an azbox premium stuck on booting, serial port shows only this:

xosPe0 serial#fb6660ccb1914db3d671f1ff6e 9b0713 subid 0x50
xenv cs2


Now, i finally managed to get the JTAG working on this premium, see attached diagram, i used the second one as this premiun has no resistor packs, seven pullup resistors go to 3.3v one pulldown goes to gnd( shown as a ? in diagram).

After succesfully reflashing which took 28 hours to do, the same bloody thing, stuck on booting with "xenv CS2". I really thought that reflashing would cure this.

Has anyone suggestions how i can proceed? I used the instructions and cfe.bin file from a russian web site. I'm hoping there is maybe another file i can flash to get this box recovered, i read somewhere about getting a YAMON loaded without xenv and reset?


So if anyone knows why the box is not getting past the "xenv cs2" bit, i'd appreciate it.








==============
procedure:

1 -Open a terminal and create a new folder named azbox:
mkdir azbox
cd azbox
sudo apt-get install libftdi-dev libftdi1 libusb-dev
-Download the file ===> http://www.4shared.com/file/a6Wz4Bc5...-azboxtar.html
tar xjvf openocd-0.4.0-azbox.tar.bz2
cd openocd-0.4.0-azbox/
./configure --enable-dummy --enable-parport --enable-parport_ppdev --enable-amtjtagaccel --enable-verbose
make
sudo make install
sudo ln sf /usr/local/bin/openocd /usr/bin/openocd
sudo cp smp8634.cfg /usr/local/share/openocd/scripts/target/smp8634.cfg
sudo cp azbox.cfg /usr/local/share/openocd/scripts/board/azbox.cfg
################################# ##############################
-2 UNPROTECT BIOS BEFORE YOU WRITE WITH tjtag
################################# ##############################
sudo rmmod lp
cd /usr/local/share/openocd/scripts
sudo openocd -f interface/parport_dlc5.cfg -f board/azbox.cfg
Open a new terminal and type:
sudo telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
>halt
>reset
>reset init
>flash protect 0 0 last off
>flash protect_check 0
>flash info 0
>shutdown
-3 Flash is ready to use the now unprotected tjtag to flash the bios.
sudo ./tjtag -flash:cfe /fc:104 /bypass

=============

final output lines from flashing log:


.
.
[ 99% Flashed] ac7fffb0: ffffffff ffffffff ffffffff ffffffff
[ 99% Flashed] ac7fffc0: ffffffff ffffffff ffffffff ffffffff
[ 99% Flashed] ac7fffd0: ffffffff ffffffff ffffffff ffffffff
[ 99% Flashed] ac7fffe0: ffffffff ffffffff ffffffff ffffffff
[ 99% Flashed] ac7ffff0: ffffffff ffffffff ffffffff ffffffff
Done (CFE.BIN loaded into Flash Memory OK)

=========================
Flashing Routine Complete
=========================
elapsed time: 103053 seconds


*** REQUESTED OPERATION IS COMPLETE ***

not got one of these boxes , but others have .

https://www.satpimps.co.uk/showpost....&postcount=207

thats an old post with a misleading title, thats just using the serial port and YAMON to recover, it does not use JTAG. thx anyway

soz only trying to help .

ill try again .

the bottom pic has ltp port earths connected to jtag pin 2 .

try joining 2-4-6-8-10 together on the jtag .

could just be an earth issue .

don't get me wrong, appreciate the help.

pins 2,4,6,8,10 on the jtag are connected together on the board.

I actually have the JTAG working and re-flashed the box, took over 28 hours as in my post. Problem is, even though i have re-flashed it, the box still gets stuck in booting and the serial port only gets as far as "xenv cs2" whereas it shoud be "xenv cs2 ok" and then onto the next step.

so the boot loader is probally corrupt or the flash is wrong

is there not a debug / safe mode on the azbox ?

no emergency/safe mode boot that i'm aware of.


So to recap for the AZBOX experts out there.., i have JTAG working, i have re-flashed the box but i still get stuck in "BOOTING" and the serial port shows the bootup process only going this far "xenv cs2 " so no OK message and no failed message follows this message.

Since i have the JTAG working, i should be able to recover the box somehow, just need some help on where i can go from here. I guess i need to know the meaning of the box halting at "xenv cs2" , i assume it meant bad xenv settings but i also assumed re-flashing would have corrected it.

some options might be,

1. try another file (i used cfe.bin from russian site that had the procedure)
2 try loading rippers E2 kernal
3. try loading/running YAMON from a JTAG command


dont know if any of these are possible

Look whar Pr2 wrote for you about "booting" issue

thx carp, but recovering the box via serial port and YAMON is well known and easy to do.

We are discussing here, recovering boxes stuck in Booting that do not boot as far as the YAMON prompt, so the only alternative is to recover via JTAG or remove the flash and re-program it. (Yes, we could return unit to Opensat, but this does not suit all situations and is not part of this discussion). Removing flash is beyond my capabilities, so recovering the box via JTAG is what this discussion is about and hopefully we can all learn from it.

@happyhammer

Have you tried reading the flash from your Azbox before flashing it? I mean Are you confident that the interface works? Also I think you should just try to upload the YAMON bootloader via JTAG (should not take 28H).

I suspect that you have not been able to flash the box even though the program tells you so.

Best regards!

Quote:

---

Originally Posted by happyhammer

thx carp, but recovering the box via serial port and YAMON is well known and easy to do.

We are discussing here, recovering boxes stuck in Booting that do not boot as far as the YAMON prompt, so the only alternative is to recover via JTAG or remove the flash and re-program it. (Yes, we could return unit to Opensat, but this does not suit all situations and is not part of this discussion). Removing flash is beyond my capabilities, so recovering the box via JTAG is what this discussion is about and hopefully we can all learn from it.

---

@happyhammer ...

I do not know if you have an Elite or Premium AZBox !

I must specify that I have not tested the procedure reflash with JTAG-LPT !

... but as I understood and translated in my guide on our board, the correct procedure for reflash is slightly different for the Elite model (see point 3.2.3.1) ...

Extract from kkaapp Tutorial

Quote:

---

2. Post treatment to remove the protection in the flash memory of the receiver:

2.1. We execute the following commands

2.1.1. sudo rmmod lp
2.1.2.cd /usr/local/share/openocd/scripts
2.1.3. sudo openocd -f interface/parport_dlc5.cfg -f board/azbox.cfg

2.2. Open a second terminal shell and type the command
2.2.1. sudo telnet localhost 4444

2.2.2. On the screen you see something like this:

Code:

---

  Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
>

---

2.2.3. In this terminal type the following commands:

2.2.3.1. halt
2.2.3.2. reset
2.2.3.3. reset init
2.2.3.4. flash protect 0 0 last off
2.2.3.5. flash protect_check 0
2.2.3.6. flash info 0
2.2.3.7. shutdown

This is the log of removing protection:

Code:

---

Open On-Chip Debugger 0.4.0 (2010-07-13-19:47)
Licensed under GNU GPL v2
For bug reports, read
  http://openocd.berlios.de/doc/doxygen/bugs.html
parport port = 0x0
jtag_nsrst_delay: 100
jtag_ntrst_delay: 100
trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain
Warn : smp8634.cpu: nonstandard IR mask
Warn : use 'smp8634.cpu' as target identifier, not '0'
Info : clock speed 500 kHz
Info : JTAG tap: smp8634.cpu tap/device found: 0x08630001 (mfg: 0x000, part: 0x8630, ver: 0x0)
Info : accepting 'telnet' connection from 0
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
Info : JTAG tap: smp8634.cpu tap/device found: 0x08630001 (mfg: 0x000, part: 0x8630, ver: 0x0)
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
Info : JTAG tap: smp8634.cpu tap/device found: 0x08630001 (mfg: 0x000, part: 0x8630, ver: 0x0)
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
Info : Flash Manufacturer/Device: 0x007f 0x22cb
Error: protect: cfi primary command set 2 unsupported
cleared protection for sectors 0 through 134 on flash bank 0
successfully checked protect state
#0 : cfi at 0xac000000, size 0x00800000, buswidth 2, chipwidth 2
#  0: 0x00000000 (0x2000 8kB) not protected
#  1: 0x00002000 (0x2000 8kB) not protected
#  2: 0x00004000 (0x2000 8kB) not protected
#  3: 0x00006000 (0x2000 8kB) not protected

-------------------------------------------------------- 
#134: 0x007f0000 (0x10000 64kB) not protected
 
cfi information:

mfr: 0x007f, id:0x22cb
qry: 'QRY', pri_id: 0x0002, pri_addr: 0x0040, alt_id: 0x0000, alt_addr: 0x0000
Vcc min: 2.7, Vcc max: 3.6, Vpp min: 0.0, Vpp max: 0.0
typ. word write timeout: 16, typ. buf write timeout: 1, typ. block erase timeout: 1024, typ. chip erase timeout: 1
max. word write timeout: 512, max. buf write timeout: 1, max. block erase timeout: 16384, max. chip erase timeout: 1
size: 0x800000, interface desc: 2, max buffer write size: 1

Spansion primary algorithm extend information:
pri: 'PRI', version: 1.1
Silicon Rev.: 0x0, Address Sensitive unlock: 0x0
Erase Suspend: 0x2, Sector Protect: 0x4
VppMin: 10.5, VppMax: 12.5

shutdown command invoked
 
ubuntu@ubuntu:/usr/local/share/openocd/scripts$

---

3. Programming the nor-flash memory

3.1. We return to the first terminal window open
3.2. Let's go to the root directory where the files are registered and enter the commands:

3.2.1. make
3.2.2. sudo rmmod lp
3.2.3. sudo ./tjtag -flash:cfe /fc:104 /bypass

From the research I did ... added ....

3.2.3.1 In the case of Azbox Elite on section 3.2.3, type command:sudo ./tjtag -flash:cfe /fc:87 /bypass

Code:

---

[ 99% Flashed]  ac7fffb0: ffffffff ffffffff ffffffff ffffffff
[ 99% Flashed]  ac7fffc0: ffffffff ffffffff ffffffff ffffffff
[ 99% Flashed]  ac7fffd0: ffffffff ffffffff ffffffff ffffffff
[ 99% Flashed]  ac7fffe0: ffffffff ffffffff ffffffff ffffffff
[ 99% Flashed]  ac7ffff0: ffffffff ffffffff ffffffff ffffffff
Done  (CFE.BIN loaded into Flash Memory OK)

=========================
Flashing Routine Complete
=========================
elapsed time: 85853 seconds


 *** REQUESTED OPERATION IS COMPLETE ***

---

---

I hope this help You to solve the problem ... :smash:

Br ... Arci