Page 1 of 4 123 ... LastLast
Results 1 to 20 of 61

Thread: JTAG - anyone get it to work fully? (technical discussion)

  1. #1
    V.I.P
    Join Date
    Jun 2008
    Posts
    331
    Thanks
    1
    Thanked 3 Times in 3 Posts

    JTAG - anyone get it to work fully? (technical discussion)

    i have an elite box stuck in booting. Unfortunately, only the serial port's TX (from the box to pC) works so i cant break into the YAMON prompt. The boot sequence stops at this point:

    tango2_enet: ethernet driver for SMP863x internal mac

    So i am trying to recover box using the JTAG interface. I followed the details in other posts/sites about flashing NOR on a premuim(make parallel cable, use openocd), but i only got to the point where the on-chip debugger cant HALT the processor. Other users that had reached the same response were unable to solve (hanswurscht is one user from here). Also, the original author of that doc said procedure only worked on Premium, nor Elite. I Dont kniow why.

    So, i would like to know has anyone here managed to use the JTAG interace and are there any other users who would like to contribute ideas to this thread in trying to get it to work?.

  2. #2
    Junior Member
    Join Date
    Oct 2010
    Posts
    7
    Thanks
    0
    Thanked 0 Times in 0 Posts
    I think will be easier to reflash it with willem or compatible programmer

    Regards

  3. #3
    V.I.P
    Join Date
    Jun 2008
    Posts
    331
    Thanks
    1
    Thanked 3 Times in 3 Posts
    thx, but i would be unable to remove flash chip and solder it back in again. So i need a JTAG solution.

  4. #4
    V.I.P
    Join Date
    Jun 2008
    Posts
    331
    Thanks
    1
    Thanked 3 Times in 3 Posts
    well i've reached a brick wall trying to get the JTAG to work on my Elite. I tried with unbuffered DLC-5 type and buffered Wiggler clone type cable configurations.

    several programs such as OCD Commander, H-JTAG, TOPJTAG,URJTAG, EJTAG Tiny Tools, dont even see the Jtag connection

    Some variations of hairydairymaids program: wrg54g_o, TJTAG, brjtag etc can get to recognise the chip ID, but cant do anything else.

    Even with Openocd, you think its working in that you get the chip id and it allows to enter some commands like "targets" and you get a response, if you then power unit off, some commands give the same response , so i dont think its doing much more than reading the chip ID like the other programs.


    It maybe my Elite is just plain faulty, but if anyone ever gets JTAG to work on elite, please post the details.

    Also, other SMP8634 based devices have other ways to do emergency type boots, ie power up with TX and RX shorted, or press a key on the remote while booting up. So if anyone is aware of any boot shortcuts on the AZBOX , please let us know.

  5. #5
    Member
    Join Date
    Oct 2010
    Posts
    42
    Thanks
    0
    Thanked 0 Times in 0 Posts

  6. #6
    V.I.P
    Join Date
    Jun 2008
    Posts
    331
    Thanks
    1
    Thanked 3 Times in 3 Posts
    thx, but that is recovery via YAMON and the serial port. I need a JTAG solution.

  7. #7
    V.I.P
    Join Date
    May 2010
    Posts
    945
    Thanks
    160
    Thanked 499 Times in 291 Posts
    jtagging can be a bit hit and miss at the best of times , depending on box .

    i would only buy a box if the jtag solution was solid as reflashing is common and jtagging is normally needed at sometime in a boxes life .

    what jtag are you using ?

    you could try building a few jtags to try .

  8. #8
    V.I.P
    Join Date
    Jun 2008
    Posts
    331
    Thanks
    1
    Thanked 3 Times in 3 Posts
    "I tried with unbuffered DLC-5 type and buffered Wiggler clone type cable configurations."


    I originally made up simple DLC-5 cable and when this didn't seem to work, i bought a universal adapter from TIAO. i connected that up as above, but no joy.

  9. #9
    V.I.P
    Join Date
    May 2010
    Posts
    945
    Thanks
    160
    Thanked 499 Times in 291 Posts
    when jtagging there are a few tips to remember .

    wire all the earths together . i.e. all earths on the serial/parrall port plug .

    keep wires to and from the jtag as short as possible .

    when i made my jtag for my 200s i didnt even use any wires just the resisters soldered from the port plug straight to the board . this also allows me to leave the jtag fitted inside the case , so i never have to look for it or worry about damage to the jtag .

  10. #10
    V.I.P
    Join Date
    Jun 2008
    Posts
    331
    Thanks
    1
    Thanked 3 Times in 3 Posts
    i have an azbox premium stuck on booting, serial port shows only this:

    xosPe0 serial#fb6660ccb1914db3d671f1ff6e 9b0713 subid 0x50
    xenv cs2


    Now, i finally managed to get the JTAG working on this premium, see attached diagram, i used the second one as this premiun has no resistor packs, seven pullup resistors go to 3.3v one pulldown goes to gnd( shown as a ? in diagram).

    After succesfully reflashing which took 28 hours to do, the same bloody thing, stuck on booting with "xenv CS2". I really thought that reflashing would cure this.

    Has anyone suggestions how i can proceed? I used the instructions and cfe.bin file from a russian web site. I'm hoping there is maybe another file i can flash to get this box recovered, i read somewhere about getting a YAMON loaded without xenv and reset?


    So if anyone knows why the box is not getting past the "xenv cs2" bit, i'd appreciate it.








    ==============
    procedure:

    1 -Open a terminal and create a new folder named azbox:
    mkdir azbox
    cd azbox
    sudo apt-get install libftdi-dev libftdi1 libusb-dev
    -Download the file ===> http://www.4shared.com/file/a6Wz4Bc5...-azboxtar.html
    tar xjvf openocd-0.4.0-azbox.tar.bz2
    cd openocd-0.4.0-azbox/
    ./configure --enable-dummy --enable-parport --enable-parport_ppdev --enable-amtjtagaccel --enable-verbose
    make
    sudo make install
    sudo ln sf /usr/local/bin/openocd /usr/bin/openocd
    sudo cp smp8634.cfg /usr/local/share/openocd/scripts/target/smp8634.cfg
    sudo cp azbox.cfg /usr/local/share/openocd/scripts/board/azbox.cfg
    ################################# ##############################
    -2 UNPROTECT BIOS BEFORE YOU WRITE WITH tjtag
    ################################# ##############################
    sudo rmmod lp
    cd /usr/local/share/openocd/scripts
    sudo openocd -f interface/parport_dlc5.cfg -f board/azbox.cfg
    Open a new terminal and type:
    sudo telnet localhost 4444
    Trying 127.0.0.1...
    Connected to localhost.
    Escape character is '^]'.
    Open On-Chip Debugger
    >halt
    >reset
    >reset init
    >flash protect 0 0 last off
    >flash protect_check 0
    >flash info 0
    >shutdown
    -3 Flash is ready to use the now unprotected tjtag to flash the bios.
    sudo ./tjtag -flash:cfe /fc:104 /bypass

    =============

    final output lines from flashing log:


    .
    .
    [ 99% Flashed] ac7fffb0: ffffffff ffffffff ffffffff ffffffff
    [ 99% Flashed] ac7fffc0: ffffffff ffffffff ffffffff ffffffff
    [ 99% Flashed] ac7fffd0: ffffffff ffffffff ffffffff ffffffff
    [ 99% Flashed] ac7fffe0: ffffffff ffffffff ffffffff ffffffff
    [ 99% Flashed] ac7ffff0: ffffffff ffffffff ffffffff ffffffff
    Done (CFE.BIN loaded into Flash Memory OK)

    =========================
    Flashing Routine Complete
    =========================
    elapsed time: 103053 seconds


    *** REQUESTED OPERATION IS COMPLETE ***
    Attached Images Attached Images

  11. #11
    V.I.P
    Join Date
    May 2010
    Posts
    945
    Thanks
    160
    Thanked 499 Times in 291 Posts
    not got one of these boxes , but others have .

    https://www.satpimps.co.uk/showpost....&postcount=207

  12. #12
    V.I.P
    Join Date
    Jun 2008
    Posts
    331
    Thanks
    1
    Thanked 3 Times in 3 Posts
    thats an old post with a misleading title, thats just using the serial port and YAMON to recover, it does not use JTAG. thx anyway

  13. #13
    V.I.P
    Join Date
    May 2010
    Posts
    945
    Thanks
    160
    Thanked 499 Times in 291 Posts
    soz only trying to help .

    ill try again .

    the bottom pic has ltp port earths connected to jtag pin 2 .

    try joining 2-4-6-8-10 together on the jtag .

    could just be an earth issue .

  14. #14
    V.I.P
    Join Date
    Jun 2008
    Posts
    331
    Thanks
    1
    Thanked 3 Times in 3 Posts
    don't get me wrong, appreciate the help.

    pins 2,4,6,8,10 on the jtag are connected together on the board.

    I actually have the JTAG working and re-flashed the box, took over 28 hours as in my post. Problem is, even though i have re-flashed it, the box still gets stuck in booting and the serial port only gets as far as "xenv cs2" whereas it shoud be "xenv cs2 ok" and then onto the next step.

  15. #15
    V.I.P
    Join Date
    May 2010
    Posts
    945
    Thanks
    160
    Thanked 499 Times in 291 Posts
    so the boot loader is probally corrupt or the flash is wrong

    is there not a debug / safe mode on the azbox ?

  16. #16
    V.I.P
    Join Date
    Jun 2008
    Posts
    331
    Thanks
    1
    Thanked 3 Times in 3 Posts
    no emergency/safe mode boot that i'm aware of.


    So to recap for the AZBOX experts out there.., i have JTAG working, i have re-flashed the box but i still get stuck in "BOOTING" and the serial port shows the bootup process only going this far "xenv cs2 " so no OK message and no failed message follows this message.

    Since i have the JTAG working, i should be able to recover the box somehow, just need some help on where i can go from here. I guess i need to know the meaning of the box halting at "xenv cs2" , i assume it meant bad xenv settings but i also assumed re-flashing would have corrected it.

    some options might be,

    1. try another file (i used cfe.bin from russian site that had the procedure)
    2 try loading rippers E2 kernal
    3. try loading/running YAMON from a JTAG command


    dont know if any of these are possible

  17. #17
    V.I.P
    Join Date
    Nov 2008
    Posts
    719
    Thanks
    1
    Thanked 42 Times in 28 Posts
    Look whar Pr2 wrote for you about "booting" issue
    Attached Files Attached Files

  18. #18
    V.I.P
    Join Date
    Jun 2008
    Posts
    331
    Thanks
    1
    Thanked 3 Times in 3 Posts
    thx carp, but recovering the box via serial port and YAMON is well known and easy to do.

    We are discussing here, recovering boxes stuck in Booting that do not boot as far as the YAMON prompt, so the only alternative is to recover via JTAG or remove the flash and re-program it. (Yes, we could return unit to Opensat, but this does not suit all situations and is not part of this discussion). Removing flash is beyond my capabilities, so recovering the box via JTAG is what this discussion is about and hopefully we can all learn from it.
    Last edited by happyhammer; 04-01-2011 at 12:00 PM.

  19. #19
    V.I.P
    Join Date
    Jan 2005
    Posts
    384
    Thanks
    34
    Thanked 42 Times in 29 Posts
    @happyhammer

    Have you tried reading the flash from your Azbox before flashing it? I mean Are you confident that the interface works? Also I think you should just try to upload the YAMON bootloader via JTAG (should not take 28H).

    I suspect that you have not been able to flash the box even though the program tells you so.

    Best regards!

  20. #20
    Member
    Join Date
    Dec 2009
    Posts
    66
    Thanks
    4
    Thanked 3 Times in 2 Posts
    Quote Originally Posted by happyhammer View Post
    thx carp, but recovering the box via serial port and YAMON is well known and easy to do.

    We are discussing here, recovering boxes stuck in Booting that do not boot as far as the YAMON prompt, so the only alternative is to recover via JTAG or remove the flash and re-program it. (Yes, we could return unit to Opensat, but this does not suit all situations and is not part of this discussion). Removing flash is beyond my capabilities, so recovering the box via JTAG is what this discussion is about and hopefully we can all learn from it.
    @happyhammer ...

    I do not know if you have an Elite or Premium AZBox !

    I must specify that I have not tested the procedure reflash with JTAG-LPT !

    ... but as I understood and translated in my guide on our board, the correct procedure for reflash is slightly different for the Elite model (see point 3.2.3.1) ...

    Extract from kkaapp Tutorial
    2. Post treatment to remove the protection in the flash memory of the receiver:

    2.1. We execute the following commands

    2.1.1. sudo rmmod lp
    2.1.2.cd /usr/local/share/openocd/scripts
    2.1.3. sudo openocd -f interface/parport_dlc5.cfg -f board/azbox.cfg

    2.2. Open a second terminal shell and type the command
    2.2.1. sudo telnet localhost 4444

    2.2.2. On the screen you see something like this:
    Code:
      Trying 127.0.0.1...
    Connected to localhost.
    Escape character is '^]'.
    Open On-Chip Debugger
    >
    2.2.3. In this terminal type the following commands:

    2.2.3.1. halt
    2.2.3.2. reset
    2.2.3.3. reset init
    2.2.3.4. flash protect 0 0 last off
    2.2.3.5. flash protect_check 0
    2.2.3.6. flash info 0
    2.2.3.7. shutdown

    This is the log of removing protection:
    Code:
    Open On-Chip Debugger 0.4.0 (2010-07-13-19:47)
    Licensed under GNU GPL v2
    For bug reports, read
       http://openocd.berlios.de/doc/doxygen/bugs.html
    parport port = 0x0
    jtag_nsrst_delay: 100
    jtag_ntrst_delay: 100
    trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain
    Warn : smp8634.cpu: nonstandard IR mask
    Warn : use 'smp8634.cpu' as target identifier, not '0'
    Info : clock speed 500 kHz
    Info : JTAG tap: smp8634.cpu tap/device found: 0x08630001 (mfg: 0x000, part: 0x8630, ver: 0x0)
    Info : accepting 'telnet' connection from 0
    target state: halted
    target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
    Info : JTAG tap: smp8634.cpu tap/device found: 0x08630001 (mfg: 0x000, part: 0x8630, ver: 0x0)
    target state: halted
    target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
    Info : JTAG tap: smp8634.cpu tap/device found: 0x08630001 (mfg: 0x000, part: 0x8630, ver: 0x0)
    target state: halted
    target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
    Info : Flash Manufacturer/Device: 0x007f 0x22cb
    Error: protect: cfi primary command set 2 unsupported
    cleared protection for sectors 0 through 134 on flash bank 0
    successfully checked protect state
    #0 : cfi at 0xac000000, size 0x00800000, buswidth 2, chipwidth 2
    #  0: 0x00000000 (0x2000 8kB) not protected
    #  1: 0x00002000 (0x2000 8kB) not protected
    #  2: 0x00004000 (0x2000 8kB) not protected
    #  3: 0x00006000 (0x2000 8kB) not protected
    
    --------------------------------------------------------   
    #134: 0x007f0000 (0x10000 64kB) not protected
       
    cfi information:
    
    mfr: 0x007f, id:0x22cb
    qry: 'QRY', pri_id: 0x0002, pri_addr: 0x0040, alt_id: 0x0000, alt_addr: 0x0000
    Vcc min: 2.7, Vcc max: 3.6, Vpp min: 0.0, Vpp max: 0.0
    typ. word write timeout: 16, typ. buf write timeout: 1, typ. block erase timeout: 1024, typ. chip erase timeout: 1
    max. word write timeout: 512, max. buf write timeout: 1, max. block erase timeout: 16384, max. chip erase timeout: 1
    size: 0x800000, interface desc: 2, max buffer write size: 1
    
    Spansion primary algorithm extend information:
    pri: 'PRI', version: 1.1
    Silicon Rev.: 0x0, Address Sensitive unlock: 0x0
    Erase Suspend: 0x2, Sector Protect: 0x4
    VppMin: 10.5, VppMax: 12.5
    
    shutdown command invoked
       
    ubuntu@ubuntu:/usr/local/share/openocd/scripts$
    3. Programming the nor-flash memory

    3.1. We return to the first terminal window open
    3.2. Let's go to the root directory where the files are registered and enter the commands:

    3.2.1. make
    3.2.2. sudo rmmod lp
    3.2.3. sudo ./tjtag -flash:cfe /fc:104 /bypass

    From the research I did ... added ....

    3.2.3.1 In the case of Azbox Elite on section 3.2.3, type command:sudo ./tjtag -flash:cfe /fc:87 /bypass

    Code:
    [ 99% Flashed]   ac7fffb0: ffffffff ffffffff ffffffff ffffffff
    [ 99% Flashed]   ac7fffc0: ffffffff ffffffff ffffffff ffffffff
    [ 99% Flashed]   ac7fffd0: ffffffff ffffffff ffffffff ffffffff
    [ 99% Flashed]   ac7fffe0: ffffffff ffffffff ffffffff ffffffff
    [ 99% Flashed]   ac7ffff0: ffffffff ffffffff ffffffff ffffffff
    Done  (CFE.BIN loaded into Flash Memory OK)
    
    =========================
    Flashing Routine Complete
    =========================
    elapsed time: 85853 seconds
    
    
     *** REQUESTED OPERATION IS COMPLETE ***
    I hope this help You to solve the problem ...

    Br ... Arci
    Last edited by arcibald; 04-01-2011 at 02:42 PM. Reason: errata corrige point. 2.1.3 "sudo openocd -f interface/parport_dlc5.cfg -f board/azbox.cfg "

Page 1 of 4 123 ... LastLast

Similar Threads

  1. How to Jtag the Intel TE28F160 chipped 7000E+
    By splinters24hr in forum Tools & Editors
    Replies: 2
    Last Post: 15-05-2010, 09:27 AM
  2. JTag 9080
    By clyde in forum M-Vision
    Replies: 4
    Last Post: 07-06-2008, 12:22 PM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •