NEC MobilePro 900/900c JTAG - discuss here!

Hello cmonex,



i'm sorry to say that, but i think this won't be an effort to get things rollin on the MobilePro.
As you said, Simpad is a Strongarm platform and it uses 16Bit bus size for flash.
I also used Jflash for this device sometime ago but it was a different version for strongarm and 16Bit flash access .

My advice would be:
Try to ask someone with solder skills and build up your own Xilinx compatible adaptor.
Follow the Intel way, check the source code of the enhanced Jflash (link above) to find out how to configure the hardware stuff.
Connect to the platform and hopefully ... Rock'n'Roll

Cheers,

scholbert

i'm sorry to say it but i doubted it myself

this jflash does look nice. so now trying to do this xilinx stuff here with my friend.

just to make some stuff clearer.

there are two pinouts

on the white connector under the modem:
test - 8, H11-nTRST 9, H12-TCK 1, H13-TMS 3, H15-TDI 5, H16-TDO 10, A1-DC3,3V

under the cf slot:
test - 3, H11-nTRST 2, H12-TCK 10, H13-TMS 8, H15-TDI 7, H16-TDO 4, A1-DC3,3V 5

you should use the xscale docs to understand the first half of the listings, the numbers in third place always mean their current pinout on the 900c..



anyone tried ? i didnt have time to play again.

trying to play again:

anyone have any suggestions for jtagging software, our jtag cable is a very simple one see at http://nepe.extra.hu/jtag2.GIF
thanks


p.s: i think we'll abandon the nSRST one in the pic

Edited by cmonex 2007-11-15 3:02 AM

update: found JFlashMM - this is a jtag software from intel

got the version for pxa270, i know there was pxa250 and 255 too.. maybe 270 version still has support for these

it does support 28F128J3A (900c is 28F128J3C, should be ok)

if anyone fancies trying jtagging i can send it just let me know in this thread or by email.

Sorry if this has already been covered but i'm only new here (and have only became a NEC 900 owner about 3 days ago)

Question: Does this 'RedBoot' business have anything to do with this JTAG stuff?

Our processor family.
http://en.wikipedia.org/wiki/XScale

which has an entry about:
http://en.wikipedia.org/wiki/RedBoot

which is supposedly used on all intel Xscale stuff?

http://ecos.sourceware.org/ecos/hardware.html#ARM

redboot source here?
http://www.intel.com/design/network/products/npfamily/ixp400_current.htm

Or perhaps you need the 10-pin JTAG cable that comes in this box?
http://www.hitechglobal.com/boards/PXA255.htm

JTAG pxa255 hints?
http://www.integral.com.br/downloads/Docs_Embedded/jtag_xscale.pdf

A Brief Introduction to the JTAG Boundary Scan Interface
http://www.inaccessnetworks.com/ian/projects/ianjtag/jtag-intro/jtag-intro.html

thanks for the links

however jtag is done, accomplished, fully working and all that!!

wait for next post in a few mins in which i describe the whole process and provide needed info to set it up

OK here is how to setup jtag for 900c and how to flash a bricked device

we used a PC with windows server 2003, and then another with XP. parallel port is used. also cygwin might be required, not 100% sure, as you'll see below.


- jtag cable:

link to a nice homemade cable that costs a few cents/pennies/whatever to build and that is recognized as wiggler by the software:

http://hpcmonex.net/nec900/files/jtag/900c_jtag.jpg

- jtag pinout:

you can connect the cable to either of two places, but i suspect you'll prefer the second one:

1) on the white connector under the modem:
test - 8, H11-nTRST 9, H12-TCK 1, H13-TMS 3, H15-TDI 5, H16-TDO 10, A1-DC3,3V
it looks like this: http://hpcmonex.net/nec900/files/jtag/JTAG_header.jpg

2) under the cf slot - sorry no pic for now, but it's right at the side, 2x 10 pins, jtag is the left one if the slot is facing up and you:
test - 3, H11-nTRST 2, H12-TCK 10, H13-TMS 8, H15-TDI 7, H16-TDO 4, A1-DC3,3V 5
(you should use the xscale docs to understand the first half of the listings, the numbers in third place always mean their current pinout on the 900c..)

if the cable you use is the above one then it's sufficient to just get TCK, TMS, TDI and TDO setup. the rest isn't needed.
use the above linked jpg to see where to connect them on your LPT port on your PC.

then just boot up the 900c and connect it to the LPT on the PC. if it doesn't seem to be booting due to being a brick, well, at least make sure it's powered on, keep it on AC or something

- software:

software is jtag tools 0.5.1 (http://openwince.sourceforge.net/jtag) running under cygwin (http://cygwin.com).

here's a version compiled for cygwin: http://hpcmonex.net/nec900/files/jtag/jtag900cfinal.zip

the strange thing is, the software should work either under full cygwin environment or just with the included cygwin dll's.
on my PC for who knows what reason, it does not work under full cygwin so we worked out a method to work without cygwin

option a) if you use full cygwin to run the software: install cygwin from cygwin.com, then copy the unzipped download under home\yourusername\ (let's assume you create a folder named jtag under this) then run cygwin and cd into jtag\src

option b) if you don't use full cygwin to run jtag tools: you probably still need to install cygwin, see below. but in any case, just unzip the jtag900cfinal.zip somewhere, take the dlls from cygwindlls folder, copy them to src folder.
then take the usr folder, go into it until you get to jtag folder- copy that folder and its contents under cygwin\usr\local\share

(note, when you opt for b) then make sure cygwin isn't running when running jtag.exe)

now you will also need to install and enable ioperm, this is available as a binary from full cygwin (with setup.exe it is under Devel packages), i have not yet tested if it works without it, sorry..
just go into cygwin\bin then using cmd, and enter this command: ioperm -i
(this will activate it, -u deactivates it)

after this you are ready to run the jtagtools:

- commands to flash under jtag tools:

--- if under cygwin, cd into the src folder and type: ./jtag
if outside, cd into src and just type jtag

you should get the >jtag prompt:

N:\jtag\full\src>jtag
JTAG Tools 0.5.1
Copyright (C) 2002, 2003 ETC s.r.o.
JTAG Tools is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain conditions.
There is absolutely no warranty for JTAG Tools.

Warning: JTAG Tools may damage your hardware! Type "quit" to exit!

Type "help" for help.



--- now if you are using the above mentioned home made cable, we need to initialize it,
type the command: cable parallel 0x378 WIGGLER

(your parallel port might be at a different address, see device manager.)

if you are using a different cable then see jtag help

this should give us (if you got ioperm activated!!) :

jtag> cable parallel 0x378 WIGGLER
Initializing Macraigor Wiggler JTAG Cable on parallel port at 0x378



--- next command is to detect cpu: detect

jtag> detect
IR length: 5
Chain length: 1
Device Id: 01101001001001100100000000010011
Manufacturer: Intel
Part: PXA250
Stepping: PXA255A0
Filename: /usr/local/share/jtag/intel/pxa250/pxa250c0



--- next command is to find the flash: detectflash

jtag> detectflash
Query identification string:
Primary Algorithm Command Set and Control Interface ID Code: 0x0001 (I
el/Sharp Extended Command Set)
Alternate Algorithm Command Set and Control Interface ID Code: 0x0000
ull)
Query system interface information:
Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV
Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV
Vpp [Programming] Supply Minimum Write/Erase voltage: 0 mV
Vpp [Programming] Supply Maximum Write/Erase voltage: 0 mV
Typical timeout per single byte/word program: 256 us
Typical timeout for maximum-size multi-byte program: 256 us
Typical timeout per individual block erase: 2048 ms
Typical timeout for full chip erase: 0 ms
Maximum timeout for byte/word program: 1024 us
Maximum timeout for multi-byte program: 1024 us
Maximum timeout per individual block erase: 16384 ms
Maximum timeout for chip erase: 0 ms
Device geometry definition:
Device Size: 16777216 B (16384 KiB, 16 MiB)
Flash Device Interface Code description: 0x0002 (x8/x16)
Maximum number of bytes in multi-byte program: 32
Number of Erase Block Regions within device: 1
Erase Block Region Information:
Region 0:
Erase Block Size: 131072 B (128 KiB)
Number of Erase Blocks: 128



--- if you want to make sure it's indeed able to read the flash correctly:

jtag> readmem 0x0 0x1000 filename
address: 0x00000000
length: 0x00001000
reading:
addr: 0x00001000

that'll contain first 4K of bootloader... if you see ECEC ascii string in the file near the start in a hexeditor then fine. but that verification only makes sense if you have an intact bootloader
so if your device is bricked then i guess just FF FF FF FF is fine, if readmem at least can dump it to a file.



--- ok now you are ready to flash using flashmem

for example if you want to flash a bootloader it should go like this:

jtag> flashmem 0x0 saboot.nb0
Note: Supported configuration is 2 x 16 bit or 1 x 16 bit only
Manufacturer: Intel
Chip: 28F128J3A
program:
addr: 0x0007FFFC
verify:
addr: 0x0007FFFC
Done.

that takes about 40 mins to flash in, 10 mins to verify.


well, that's it.
here's my first jtagging session log (lost the first part of it but that was all errors anyway) http://hpcmonex.net/jtaglog.txt








Edited by cmonex 2008-03-19 12:37 AM

cmonex,
Sorry about the spamming then, I thought JTAG was still an issue (there are so many posts here that suggest that it was still confusing people) and i was excited/eager to help out where I could.

I'll try to lurk more from now on.

oh yeah, one more question cmonex, what are you currently working on? (still linux hacking the 900 right?)

no worries. i just got the jtag worked out yesterday then saw your posts
did you ever jtag stuff btw?






well mostly CE stuff... but i'm willing to help with porting hw stuff to linux.
and this jtag stuff is useful for that too, you can now develop a linux bootloader to be flashed no problems


Edited by cmonex 2008-03-19 4:22 AM

update...

bad news then that turns into good news...


the bad news is... i didn't try actually writing 0x0 when i first tried jtagging on a working device. i wrote the bootloader file (saboot.nb0, same file included in the ce.net updatekit on my site or below in the bootloader package in this post) to 0x01F00000 in flash, because i knew nothing else was at that address and i wanted the device to still boot.

that worked but it turns out jtag tools doesn't handle the flash of the 900c perfectly. it will have to be modified and recompiled. i've yet to find the bug, but i have found a workaround until then...

the bugs are:
1) as for the first flash chip (the 900c has two 16MB NOR flash chips) jtag tools can unlock and erase the blocks OK before writing the data. but it will erase too many blocks so the block you've just written will be erased when writing next block. the bootloader needs at least 2 blocks to fit in (full NB0 is 4 blocks but the rest is just uncompressed splashscreens). but you can only have a block written right at a time so it'll never be flashed correctly!!
2) as for second flash chip, jtag tools will not do an erase before writing. 0x01F00000 is usually in erased state though, unless a) it got corrupt there b) you have cmonex v2.0 rom. anyway, for that reason you can usually write to 0x01F00000 just fine (but when flash is not erased previously the write will not happen)

i didn't have time so just used a quick and dirty workaround for now but it works! as long as the last megabyte (0x01F00000) is in erased state already (unless eraseflash can handle this chip, haven't tried yet, but i'm a bit doubtful). if you had cmonex v2.0 before it bricked then the workaround is a little bit different, but based on similar logic

so what you need to do is:

0. download these files: http://hpcmonex.net/nec900/files/jtag/jtagbootloaders1.zip
1. run jtag, do steps until detectflash reports stuff OK
2. run command: flashmem 0x0 sabootpatched01.nb0
that should run and verify OK, takes about 8 mins (+verify couple of mins)
3. run command: flashmem 0x01F00000 sabootpatched03.nb0
(that takes ~32 mins +verify)
(you can also try this instead: flashmem 0x01F00000 sabootpatched02.nb0 but that won't flash splashscreen, but faster.)
4. quit jtag, remove 900c from lpt, remove power from 900c, then put battery or AC in, try to power it up and it should boot up fine!!! (with a damaged splashscreen, if you used sabootpatched02.nb0)
5. i recommend you quickly update the bootloader with the saboot.nb0 file from a CF card. this bootloader you've just flashed via jtag resides in two parts in the flash, a bit crazy, and if you flash cmonex v2.0 it'll die again (that rom image uses 0x01F00000 too) unless you update the bootloader in the normal CF way before flashing the OS.

...just if you are interested how it works: i simply patched the routine that loads the bootloader from rom to ram in early bootup, patch makes it look for the bootloader image in second flash chip at 0x01F00000. as the first part of the bootloader can be flashed OK at 0x0, and the second part can be flashed in the second flash chip at 0x01F00000, this'll work nicely.

that's it


so the good news, i've unbricked TWO 900c's this night! one of them will not fully power up because keyboard connector on motherboard got damaged when someone else previously took it apart. will have to fix that because it doesn't see keyboard. but it boots bootloader fine, just can't power up due to this small glitch..

the other one had just suddenly died one day... someone sent it to me ages ago because they could not do much with it. well it was able to communicate via jtag, so i did a full readmem of the bootloader and it was there but corrupt in several places (a few bit flipping corruptions)!! so it could not boot up to bootscreen. reflashed via jtag, and woo, it booted OS right away, it had stock 2.01a originally, and that OS image wasn't corrupt

so this means i'm right, many 900/900c's die because of a corrupt bootloader, so if your 900 or 900c died in a similar way, you should try jtagging it by all means!!!

if someone had cmonex v2.0 then i'll make another bootloader file patch for that


finally, this pic will help even complete noobs when soldering the jtag cable to the right pins under cf slot: http://hpcmonex.net/nec900/files/jtag/nec900c_jtag.jpg


Edited by cmonex 2008-03-20 12:26 AM