JTAG Success!

For the next article I’ll have to provide some extra background.

We have two research subjects. A 3com 3870 and a Dell Powerconnect 3324.

Both have a Broadcom switch fabric  (3com: BCM5690+BCM5670, Dell: BCM5615) coupled with a MPC8245 for management.  So the hardware appears similar (both in specs and by visual inspection). However, the 3com was developed by Accton and the Dell was developed by Radlan. So they’re different in software. For starters they both use a completely different fileformat (BIX vs. ROS/DOS).

I had already noticed earlier that both boards have 2 JTAG connectors. One 16-pin next to the MPC8245 with only the MPC8245 on the chain and one 8-pin with two CPLDs on the chain.

I have an Olimex ARM-USB-OCD, but it seems to be that with the JTAG tools the software and hardware is very tightly coupled. So I’m limited to a small set of software and it seems like the opensource embedded hacking community is mostly focussed on ARM, so there’s only one opensource JTAG tool that seems to support MPC8245. UrJTAG. But also with this it was not able to detect the flash ROM on the device. UrJTAG seems to be using BSR (Boundary-Scan. In short it allows you to peek and poke individual pins on the chip) to try to access the memory mapped ROM in the memory of the CPU.

There’s also one other non-opensource company that supports the ARM-USB-OCD. They are TopJTAG. They have TopJTAG Probe and TopJTAG Flash Programmer. TopJTAG Flash Programmer differs in that it does not do BSR to the CPU, but basically uses the CPU as a set of GPIO (General Purpose I/O) pins to the attached Flash ROM. This does require defining which pins on the CPU are connected to which pins on the Flash ROM(s). I had struggled in the past, but was never succesfull. After a bit of Googling I stumbled upon a Japanese Wikipage where the guy was using TopJTAG Flash Programmer to flash the ST M29W324DB Flash ROM attached to a MPC8245 in a Buffalo Linkstation. And he was friendly enough to share his signalmapping. For completenesssake I’ve included it here:

 <SignalPin Name="CE" Device="0" PortName="RCS0_L" PortIndex="-1" Inverted="0"/>
 <SignalPin Name="OE" Device="0" PortName="FOE_L" PortIndex="-1" Inverted="0"/>
 <SignalPin Name="WE" Device="0" PortName="WE_L" PortIndex="-1" Inverted="0"/>
 <SignalPin Name="A0" Device="0" PortName="SDMA0" PortIndex="-1"/>
 <SignalPin Name="A1" Device="0" PortName="SDMA1" PortIndex="-1"/>
 <SignalPin Name="A2" Device="0" PortName="SDMA" PortIndex="2"/>
 <SignalPin Name="A3" Device="0" PortName="SDMA" PortIndex="3"/>
 <SignalPin Name="A4" Device="0" PortName="SDMA" PortIndex="4"/>
 <SignalPin Name="A5" Device="0" PortName="SDMA" PortIndex="5"/>
 <SignalPin Name="A6" Device="0" PortName="SDMA" PortIndex="6"/>
 <SignalPin Name="A7" Device="0" PortName="SDMA" PortIndex="7"/>
 <SignalPin Name="A8" Device="0" PortName="SDMA" PortIndex="8"/>
 <SignalPin Name="A9" Device="0" PortName="SDMA" PortIndex="9"/>
 <SignalPin Name="A10" Device="0" PortName="SDMA" PortIndex="10"/>
 <SignalPin Name="A11" Device="0" PortName="SDBA0" PortIndex="-1"/>
 <SignalPin Name="A12" Device="0" PortName="PAR_AR" PortIndex="7"/>
 <SignalPin Name="A13" Device="0" PortName="PAR_AR" PortIndex="6"/>
 <SignalPin Name="A14" Device="0" PortName="PAR_AR" PortIndex="5"/>
 <SignalPin Name="A15" Device="0" PortName="PAR_AR" PortIndex="4"/>
 <SignalPin Name="A16" Device="0" PortName="PAR_AR" PortIndex="3"/>
 <SignalPin Name="A17" Device="0" PortName="PAR_AR" PortIndex="2"/>
 <SignalPin Name="A18" Device="0" PortName="PAR_AR" PortIndex="1"/>
 <SignalPin Name="A19" Device="0" PortName="PAR_AR" PortIndex="0"/>
 <SignalPin Name="A20" Device="0" PortName="SDBA1" PortIndex="-1"/>
 <SignalPin Name="A21" Device="0" PortName="SDMA" PortIndex="11"/>
 <SignalPin Name="A22" Device="0" PortName="SRESET_L" PortIndex="-1"/>
 <SignalPin Name="A23" Device="0" PortName="TBEN" PortIndex="-1"/>
 <SignalPin Name="A24" Device="0" PortName="CHKSTOP_IN_L" PortIndex="-1"/>
 <SignalPin Name="D0" Device="0" PortName="MDH" PortIndex="7"/>
 <SignalPin Name="D1" Device="0" PortName="MDH" PortIndex="6"/>
 <SignalPin Name="D2" Device="0" PortName="MDH" PortIndex="5"/>
 <SignalPin Name="D3" Device="0" PortName="MDH" PortIndex="4"/>
 <SignalPin Name="D4" Device="0" PortName="MDH" PortIndex="3"/>
 <SignalPin Name="D5" Device="0" PortName="MDH" PortIndex="2"/>
 <SignalPin Name="D6" Device="0" PortName="MDH" PortIndex="1"/>
 <SignalPin Name="D7" Device="0" PortName="MDH" PortIndex="0"/>

So I started TopJTAG Flash Progammer

1. Configured my ARM-USB-OCD through Setup -> JTAG Connection

2. Setup the chain with Setup -> Setup, Examine the chain (it shows n/a for manufacturer and IDCODE, but that’s correct. This is not set on the MPC8245), next -> next -> next

3. Load the BSDL definition with BSDL File -> Update / Replace, Manually specificy and point it to MPC8245BSDL2.txt that’s in the BSDL Files list on the Freescale site.

4. Save the setup with File -> Save Setup As.

5. Open the file in a texteditor and replace <Pins/> with the definition above

6. Load the file with File -> Load Setup

7. Set the Flash ROM in Setup – > Setup -> Flash Array to:

Data Bus Organisation: 8-bit (1 chip x 8-bit)

The maximum data width a single chip is capable of: 16-bit capable operating in 8-bit mode (BYTE# is low).

And then I checked with ‘F5’ if I could find a Flash ROM. At first I was testing with the 3com 3870. The 3com 3870 has two 128Mbit JS28F128 Flash ROMs. It was not able to detect a Flash ROM. Only if I set the RCS0_L to high I was able to detect a single Flash ROM. This is odd, because RCS0 is supposed to be ‘active low’, so there’s something iffy going on. Adding 8 extra data pins and setting it to 16-bit (2 x 8-bit) also did not help. Only a single Flash ROM remained accessible.

After a few hours of playing I remember I also still had the Dell Powerconnect 3324 laying around. This only has a single 64Mbit 28F640J3A. I hooked it up, configured it as above and done, I had a functional setup. I can now read and write the entire flash rom.This allows me to fiddle a bit more safely and maybe even take a stab at replacing the bootloader with U-boot. Of course, the 3com 3870 is a more interesting animal, so I’ll continue there later. If somebody has any hints, let me know.


5 Responses to “JTAG Success!”

  1. brutester Says:

    When you have two chips you should use both RCS0_L and RCS1_L. Take a look at Figure 6-30 in MPC8245 User’s Manual.

  2. James Says:

    I was wondering what the pinout was for the 16 pin header with the jtag chain with the freescale on – The netgear GSM73xxS switches seem to have a similar arangement – 2 lattice cplds on an 8 pin header and a 16 pin header with the freescale on it. But the standard freescale jtag is 10 pins.

  3. Matt Says:

    Second request for information on the pinout for the 16 pin header w/ JTAG chain on freescale. I have a similar switch and need to reload bootloader over jtag. Thanks!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: