JTAG - anyone get it to work fully? (technical discussion)

**happyhammer** · 16-10-2010, 06:54 PM

i have an elite box stuck in booting. Unfortunately, only the serial port's TX (from the box to pC) works so i cant break into the YAMON prompt. The boot sequence stops at this point:

tango2_enet: ethernet driver for SMP863x internal mac

So i am trying to recover box using the JTAG interface. I followed the details in other posts/sites about flashing NOR on a premuim(make parallel cable, use openocd), but i only got to the point where the on-chip debugger cant HALT the processor. Other users that had reached the same response were unable to solve (hanswurscht is one user from here). Also, the original author of that doc said procedure only worked on Premium, nor Elite. I Dont kniow why.

So, i would like to know has anyone here managed to use the JTAG interace and are there any other users who would like to contribute ideas to this thread in trying to get it to work?.

**andressis2k** · 24-10-2010, 08:13 PM

I think will be easier to reflash it with willem or compatible programmer

Regards

**happyhammer** · 26-10-2010, 11:46 AM

thx, but i would be unable to remove flash chip and solder it back in again. So i need a JTAG solution.

**happyhammer** · 26-11-2010, 10:21 AM

well i've reached a brick wall trying to get the JTAG to work on my Elite. I tried with unbuffered DLC-5 type and buffered Wiggler clone type cable configurations.

several programs such as OCD Commander, H-JTAG, TOPJTAG,URJTAG, EJTAG Tiny Tools, dont even see the Jtag connection

Some variations of hairydairymaids program: wrg54g_o, TJTAG, brjtag etc can get to recognise the chip ID, but cant do anything else.

Even with Openocd, you think its working in that you get the chip id and it allows to enter some commands like "targets" and you get a response, if you then power unit off, some commands give the same response , so i dont think its doing much more than reading the chip ID like the other programs.

It maybe my Elite is just plain faulty, but if anyone ever gets JTAG to work on elite, please post the details.

Also, other SMP8634 based devices have other ways to do emergency type boots, ie power up with TX and RX shorted, or press a key on the remote while booting up. So if anyone is aware of any boot shortcuts on the AZBOX , please let us know.

**triplexxx** · 26-11-2010, 10:57 AM

u can tray here
https://www.satpimps.co.uk/showthread.php?t=141544

**happyhammer** · 26-11-2010, 01:52 PM

thx, but that is recovery via YAMON and the serial port. I need a JTAG solution.

**mikie8** · 26-11-2010, 03:36 PM

jtagging can be a bit hit and miss at the best of times , depending on box .

i would only buy a box if the jtag solution was solid as reflashing is common and jtagging is normally needed at sometime in a boxes life .

what jtag are you using ?

you could try building a few jtags to try .

**happyhammer** · 26-11-2010, 05:45 PM

"I tried with unbuffered DLC-5 type and buffered Wiggler clone type cable configurations."

I originally made up simple DLC-5 cable and when this didn't seem to work, i bought a universal adapter from TIAO. i connected that up as above, but no joy.

**mikie8** · 26-11-2010, 07:42 PM

when jtagging there are a few tips to remember .

wire all the earths together . i.e. all earths on the serial/parrall port plug .

keep wires to and from the jtag as short as possible .

when i made my jtag for my 200s i didnt even use any wires just the resisters soldered from the port plug straight to the board . this also allows me to leave the jtag fitted inside the case , so i never have to look for it or worry about damage to the jtag .

**happyhammer** · 31-12-2010, 04:41 PM

i have an azbox premium stuck on booting, serial port shows only this:

xosPe0 serial#fb6660ccb1914db3d671f1ff6e 9b0713 subid 0x50
xenv cs2

Now, i finally managed to get the JTAG working on this premium, see attached diagram, i used the second one as this premiun has no resistor packs, seven pullup resistors go to 3.3v one pulldown goes to gnd( shown as a ? in diagram).

After succesfully reflashing which took 28 hours to do, the same bloody thing, stuck on booting with "xenv CS2". I really thought that reflashing would cure this.

Has anyone suggestions how i can proceed? I used the instructions and cfe.bin file from a russian web site. I'm hoping there is maybe another file i can flash to get this box recovered, i read somewhere about getting a YAMON loaded without xenv and reset?

So if anyone knows why the box is not getting past the "xenv cs2" bit, i'd appreciate it.

==============
procedure:

1 -Open a terminal and create a new folder named azbox:
mkdir azbox
cd azbox
sudo apt-get install libftdi-dev libftdi1 libusb-dev
-Download the file ===> http://www.4shared.com/file/a6Wz4Bc5...-azboxtar.html
tar xjvf openocd-0.4.0-azbox.tar.bz2
cd openocd-0.4.0-azbox/
./configure --enable-dummy --enable-parport --enable-parport_ppdev --enable-amtjtagaccel --enable-verbose
make
sudo make install
sudo ln sf /usr/local/bin/openocd /usr/bin/openocd
sudo cp smp8634.cfg /usr/local/share/openocd/scripts/target/smp8634.cfg
sudo cp azbox.cfg /usr/local/share/openocd/scripts/board/azbox.cfg
################################# ##############################
-2 UNPROTECT BIOS BEFORE YOU WRITE WITH tjtag
################################# ##############################
sudo rmmod lp
cd /usr/local/share/openocd/scripts
sudo openocd -f interface/parport_dlc5.cfg -f board/azbox.cfg
Open a new terminal and type:
sudo telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
>halt
>reset
>reset init
>flash protect 0 0 last off
>flash protect_check 0
>flash info 0
>shutdown
-3 Flash is ready to use the now unprotected tjtag to flash the bios.
sudo ./tjtag -flash:cfe /fc:104 /bypass

=============

final output lines from flashing log:

.
.
[ 99% Flashed] ac7fffb0: ffffffff ffffffff ffffffff ffffffff
[ 99% Flashed] ac7fffc0: ffffffff ffffffff ffffffff ffffffff
[ 99% Flashed] ac7fffd0: ffffffff ffffffff ffffffff ffffffff
[ 99% Flashed] ac7fffe0: ffffffff ffffffff ffffffff ffffffff
[ 99% Flashed] ac7ffff0: ffffffff ffffffff ffffffff ffffffff
Done (CFE.BIN loaded into Flash Memory OK)

=========================
Flashing Routine Complete
=========================
elapsed time: 103053 seconds

*** REQUESTED OPERATION IS COMPLETE ***

**goginux** · 16-03-2011, 01:37 PM

Originally Posted by happyhammer

i have an azbox premium stuck on booting, serial port shows only this:

xosPe0 serial#fb6660ccb1914db3d671f1ff6e 9b0713 subid 0x50
xenv cs2

Now, i finally managed to get the JTAG working on this premium, see attached diagram, i used the second one as this premiun has no resistor packs, seven pullup resistors go to 3.3v one pulldown goes to gnd( shown as a ? in diagram).

After succesfully reflashing which took 28 hours to do, the same bloody thing, stuck on booting with "xenv CS2". I really thought that reflashing would cure this.

Has anyone suggestions how i can proceed? I used the instructions and cfe.bin file from a russian web site. I'm hoping there is maybe another file i can flash to get this box recovered, i read somewhere about getting a YAMON loaded without xenv and reset?

So if anyone knows why the box is not getting past the "xenv cs2" bit, i'd appreciate it.

==============
procedure:

1 -Open a terminal and create a new folder named azbox:
mkdir azbox
cd azbox
sudo apt-get install libftdi-dev libftdi1 libusb-dev
-Download the file ===> http://www.4shared.com/file/a6Wz4Bc5...-azboxtar.html
tar xjvf openocd-0.4.0-azbox.tar.bz2
cd openocd-0.4.0-azbox/
./configure --enable-dummy --enable-parport --enable-parport_ppdev --enable-amtjtagaccel --enable-verbose
make
sudo make install
sudo ln sf /usr/local/bin/openocd /usr/bin/openocd
sudo cp smp8634.cfg /usr/local/share/openocd/scripts/target/smp8634.cfg
sudo cp azbox.cfg /usr/local/share/openocd/scripts/board/azbox.cfg
################################# ##############################
-2 UNPROTECT BIOS BEFORE YOU WRITE WITH tjtag
################################# ##############################
sudo rmmod lp
cd /usr/local/share/openocd/scripts
sudo openocd -f interface/parport_dlc5.cfg -f board/azbox.cfg
Open a new terminal and type:
sudo telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
>halt
>reset
>reset init
>flash protect 0 0 last off
>flash protect_check 0
>flash info 0
>shutdown
-3 Flash is ready to use the now unprotected tjtag to flash the bios.
sudo ./tjtag -flash:cfe /fc:104 /bypass

=============

final output lines from flashing log:

.
.
[ 99% Flashed] ac7fffb0: ffffffff ffffffff ffffffff ffffffff
[ 99% Flashed] ac7fffc0: ffffffff ffffffff ffffffff ffffffff
[ 99% Flashed] ac7fffd0: ffffffff ffffffff ffffffff ffffffff
[ 99% Flashed] ac7fffe0: ffffffff ffffffff ffffffff ffffffff
[ 99% Flashed] ac7ffff0: ffffffff ffffffff ffffffff ffffffff
Done (CFE.BIN loaded into Flash Memory OK)

=========================
Flashing Routine Complete
=========================
elapsed time: 103053 seconds

*** REQUESTED OPERATION IS COMPLETE ***

please tell me,you are put RP1 and RP2 in azbox??100 ohm???

**happyhammer** · 16-03-2011, 02:45 PM

RP1 and RP2 are resistor packs. I did not have these parts and only an ordinary soldering iron which is very difficult ti use on surface mounted boards. You do this at your own risk as its very easy to damage tracks/pads etc.

all but one of the 100 ohm resisters go between the Jtag pads and the 3.3v, the other goes to GND. Then the connections from the PC parallel port to the Jtag pads. just as in diagram.

The Jtag must also be enabled by jumper.

**zingfrid** · 17-08-2013, 06:46 PM

I've saw, that only happyhammer, on whole internet wide were had same problem with me.
I have my device stuck on booting with message:

Code:

xosPe0 serial#a8e6... subid 0x50
xenv cs2 xosPe0 serial#a8e6... subid 0x50
xenv cs2

Nither ok nor failed.

I've tried to use jtag. I was able to connect but now I'm stuck with putting processor to halt.

Please, tell me, were you able to resolve this issue, because from forum posts it is not clear.

**mikie8** · 31-12-2010, 05:08 PM

not got one of these boxes , but others have .

https://www.satpimps.co.uk/showpost....&postcount=207

**happyhammer** · 31-12-2010, 05:51 PM

thats an old post with a misleading title, thats just using the serial port and YAMON to recover, it does not use JTAG. thx anyway

**mikie8** · 31-12-2010, 07:14 PM

soz only trying to help .

ill try again .

the bottom pic has ltp port earths connected to jtag pin 2 .

try joining 2-4-6-8-10 together on the jtag .

could just be an earth issue .

**happyhammer** · 31-12-2010, 08:16 PM

don't get me wrong, appreciate the help.

pins 2,4,6,8,10 on the jtag are connected together on the board.

I actually have the JTAG working and re-flashed the box, took over 28 hours as in my post. Problem is, even though i have re-flashed it, the box still gets stuck in booting and the serial port only gets as far as "xenv cs2" whereas it shoud be "xenv cs2 ok" and then onto the next step.

**mikie8** · 31-12-2010, 10:07 PM

so the boot loader is probally corrupt or the flash is wrong

is there not a debug / safe mode on the azbox ?

**happyhammer** · 03-01-2011, 06:03 PM

no emergency/safe mode boot that i'm aware of.

So to recap for the AZBOX experts out there.., i have JTAG working, i have re-flashed the box but i still get stuck in "BOOTING" and the serial port shows the bootup process only going this far "xenv cs2 " so no OK message and no failed message follows this message.

Since i have the JTAG working, i should be able to recover the box somehow, just need some help on where i can go from here. I guess i need to know the meaning of the box halting at "xenv cs2" , i assume it meant bad xenv settings but i also assumed re-flashing would have corrected it.

some options might be,

1. try another file (i used cfe.bin from russian site that had the procedure)
2 try loading rippers E2 kernal
3. try loading/running YAMON from a JTAG command

dont know if any of these are possible