Flameman/dht-walnut/jtag

From eLinux.org
< Flameman‎ | dht-walnut
Revision as of 03:35, 31 January 2010 by Flameman (talk | contribs) (OCD, Recovering a bricked board)
Jump to: navigation, search

JTAG & OCD Commander

The OCD Commander is macraigor's free debugger software, which allows you to connect to your supported target type chip via the On-Chip Debug port (BDM or JTAG) using a Macraigor hardware device. You will be able to test the connection, memory access, modify memory and registers, run code and more using this product. This debugger is not designed to be used to program flash devices connected to your target. The OCD Commander software is supported under Windows 98/ME, NT, 2000, 2003, XP operating systems

supported devices

  • mpDemon
  • Raven
  • wiggle <------- it will be illustrated
  • usb2demon
  • usb2sprite
  • usbwiggler

See How To build the JTAG Wiggle interface & add the JTAG connector at J10, Just in case you make a brick, you could fix the jam, using this procedure: JTAG Bootloader Installation

JTAG add the J10 to the board

J10

To add the J10 to the board suck or wick the solder out of the holes and solder it in, but be minded a common header has pins larger than holes, so ... be careful about what you do: you could damage the PCB

Dht-walnut-ppc405-jtag.jpg

pinout

NOTE

  • DHT-Walnut: JTAG Pin Out Connector Specifications for DHT-walnut-PPC405GP
  • AMCC-PPC4xx: JTAG Pin Out Connector Specifications for AMCC PPC 44X, 40X (4XX) Processors: 405EP, 405GP, 405GPR, 440GP, 440EP, 440GX, 440GR, 440EPX, 440GRX, 440SP, 440SPE


pin DHT-WALNUT AMCC-PCC4xx
01 TDO TDO
02 nc nc
03 TDI TDI
04 TRST TRST
05 *NC* *NC*
06 Vcc Vcc
07 TCK TCK
08 nc KSTP_IN
09 TMS TMS
10 nc nc
11 SRESET SRESET
12 nc nc
13 HRESET HRESET
14 nc reserved
15 nc CKSTP_OUT
16 gnd gnd


Pin Out description

  • TDO=JTAG Test Data Out
  • TDI=JTAG Test Data In
  • TRST=JTAG Test Reset
  • TCK=JTAG Test Clock
  • TMS=JTAG Test Mode Select
  • *NC*=not connected, used as cable reference
  • nc=simply not connected
  • SRESET=Soft-Reset
  • HRESET=Hard-Reset
  • KSTP_OUT=?
  • CKSTP_IN=?
  • Vcc=board ref voltage, 3V

About the software for the jtag cable

from http://www.macraigor.com/cpus.htm and you can download the OCD-commander, but it will not work with the wiggle

  • 'cause in the new OCD-commander AMCC PowerPC PPC405 wiggler is NOT supported
  • 'cause in the new OCD-commander IBM PowerPC PPC 405 wiggler is NOT supported

you need to download this old version, that i tested with success under windows2000 OCD-Commander-for-wiggle.zip (i can't include it for download cause of the copyright, if you need it, please email me)

parallel port setting

  • bidirectional
  • ecp
  • epp <---- set to this

OCD setting

  • target processor IBM, ppc4xx
  • interface driver wiggler

press reset, halt, cpu

you can understand everything is OK if PC=fffffffc (that is where PC points at boot)

NOTA jtag scan is not pretty working, it needs to reset the TAP machine, but only OCD has been programmed to do that (i guess why ... anyway)

get started

OCD-commander packets is composed by

  • OCD-cmd
  • jtag-chain-scan

jtag-chain-scan does not reset the target board, so if you want to run it you need to invoke OCD-cmd and hardly force "reset", then you could use the jtag-chain-scan


OCD-* has been tested on

  • windows 2000: success, it is my reference working env
  • windows NT (it needs service pack6): a bit of issues ... not suggested


what about *nix ? maybe sooner or later you will be interested about implementing a jtag tap machine on microchip PIC (usb, ethernet, serial) and porting a ppv405gp bdl scan ? if so, let me know (see how to contact me)

JTAG build the Wiggle Cable

the the "Wiggler Buffered JTAG Programmer" is compatible with the old OCD. This schematic has been tested and it is working.

Dht-walnut-ppc405-wiggler.png

Dht-walnut-ppc405-wiggler-cable.jpg

OCD, Experimental hack

Experimental hack to set a hardware breakpoint inside OCD Commander [media:hardbreak.tgz]

  • OCD Commander macro file to dump the CPU configuration (all but PCI) [media:dump_config.mac]
  • OCD Commander macro file to configure the system for recovery attachment:recovery_config.mac]
  • CPU configuration of the system after a warm reset [media:warm_reset.config]
  • CPU configuration of the system once ppcboot v1.1.2 is up and running [media:ppcboot.config]
  • CPU configuration of the system once ppcboot v1.1.6 is up and running [media:ppcboot_116.config]
  • Example OCD logfile of the using the recovery macro to load ppcboot [media:ocd_recovery_log.txt]
  • Example console log from ppcboot v.1.1.6 running from ram after recovery macro [media:ocd_recovery_console_log.txt]

OCD, Recovering a bricked board (download and use the recovery kit)

Using OCD Commander, a JTAG adapter, and GPSFan's ram resident ppcboot, it is possible to reprogram the flash. In short, use OCD Commander to turn on the sdram, download the ram targeted ppcboot, and install a new bootloader.

You'll need this dht-walnut-firmware-recovery-kit.rar

It contains an OCD macro and an experimental ram-resident version of u-boot-1.1.4 that can be downloaded to 0x400000 (and executed at 0x400100). Expect to see much more output at boot, as this version has debug output turned on.

changes:

  • debug enabled
  • ram entry point in the linker script
  • output file u-boot.s19 and u-boot.elf
  • sdram config disabled
  • added debug info on code relocation
  • modified default environment

bug:

  • it doesn't work if you have more than 32Mb of ram

install:

  • Start OCD Commander, connect to the board, reset, and halt.
  • type "reset"
  • The CPU should be ready to fetch the first instruction:
  • type "cpu"
PC: FFFFFFFC    CR: 00000000  MSR: 00000000  LR: 01FD327C
  • Configure the system:
  • recovery_config (Or hit the macro button and navigate to the recovery_config.mac file.)
  • type "endian big" #(BIG Endian set for WORD and DASM commands)
  • Download the uboot-ram-image (srec format) to ram
uboot_ram.s19: downloaded 163100 bytes in 0 minutes, 22.785 seconds
PC set to starting address 0x00400000
  • Jump to the startup (which isn't the same as the download address)
  • type "go 0x400100"

At this point, you should have a running bboot v1.1.4. Install a new flash resident bootloader using the bootloader update procedure