DP311

JTAG on Dish Receivers.
Post Reply
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

DP311

Post by usbbdm »

Just got a DP311 and hookup JTAG properly. The CPU is STi5517 and it uses DCU3. need to find this specification and make it work. Should be quite easy to do if I have the document or sample executable. I believe the protocol changed slightly. To enter DCU just send 0x10 to control register and ready to go. Each command consist of two bits (peek or poke). Ack is peeked or poked.
elkora
Junior Member
Posts: 245
Joined: Wed Jan 03, 2007 8:57 pm

Post by elkora »

ohhhhhhhhhhhhh man you are in bussines now :shock: let me know if I can help.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

Just found DP311 can not use 12Mhz of TCK (DP301-013 and 2700 that Sti5518 STi5500 can support 12Mhz TCK no problem. But the timing of TDO is different. Do not know if this is to prevent people jtaging or by design. More and more device supporting TCK much highter. (MIPS EJTAG support minimum of 40MHz). Looks like 6MHz can work on DP311.
elkora
Junior Member
Posts: 245
Joined: Wed Jan 03, 2007 8:57 pm

Post by elkora »

ok I'm going to receive my jtag this week if I can help on something just let me know.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

Lower the clock does not help. The TDO seems having no output when issue DCU command but the CPU seems follow the command. In order to program and backup the flash, TDO must have output. Read the schematic the TDO is there and use it to read IDCODE is easy.
The only thing is not tested with is TRST but non of the datasheet said TRST is used. Normally we reset tap by setting 5 1s to TMS and it is ready to go.
elkora
Junior Member
Posts: 245
Joined: Wed Jan 03, 2007 8:57 pm

Post by elkora »

on the DP322 & DP522 the TDO its not activate. maybe we need to do the same with DP311
Image
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

Very strange that TDO can be disabled. If TDO is disabled, what the use of TDI. Because most the debug protocol needs feedback from TDO to determin futher commands.

But if the chip do support real JTAG standard, we should be able to program/read the chip via JTAG scan chain, not the CPU debug (in theory), even though this will be very slow but should be better than nothing. The matter is we do not have the scan description file(BSDL). If we do then even DP311 should be JTAGable. At that time we just need to issue simple DCU command to halt CPU (I have done that) and then scan the chip to get data or write data to flash.) The scan chain can be very long 300 more bites to write address and 300 more bits to read one 32 bits data. I will assume even use USB JTAG might only get a fee KB/s. This will consider very slow to me.
ahaxxer
Junior Member
Posts: 1
Joined: Fri Nov 03, 2006 2:22 pm

Post by ahaxxer »

Current methodology for the BCM73XX boxes to allow use of the EJTAG port for READ/WRITE has been to invoke JTAG control and send a serial COM bootloader into RAM and then poll for it out the UART COM and then take over using the UART serial comm to send data that would normally be retrieved from the TDO output. Personally from experience with the BCM7XXX and the STi5517 based IRDs I don't think the JTAG or EJTAG is used at all from the factory during the device FLASH load-up and burn-in. I think they have a special COMs based serial bootloader fed into the CPU by the UART COM to load the bootsector and setup the bootloader and then use the bootloader for a fast protocol load or some sort of BDM programming mode... On the very latest products of the VIP IRDs for DN and eVU several of the EJTAG pins are not even terminated to traceable pinouts or testpads on the IRD motherboards. I have valid schematics for the new model units and the design reference labels are not coming to accessible points for connection from the BGA CPU device.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

I am not familar iwth BCM73XX EJTAG COM solution, but EJTAG needs proper feedback from TDO to do certain things unless we assume JTAG is slow enough and the command will be executed. By looking at DP311 schematic, it is almost certain that TDO is enabled, I can read device ID. So I should be able to use scan chain to read memory if I have the description file. But going to DCU mode seems generate no response from TDO pins. There does not seems to have any pin configuration to enable TDO. All JTAG pins are routed on the back of the PC board with test pins. It is quite easy to connect JTAG pins on DP311. I know that reset plays a big roll to enable DCU mode. My JTAG is fast enouh to enable DCU mode. I have generated test code to force it to DCU mode (I can tell the LED will not light on/off as normal) but still can not get TDO response). I even pull up/down pins and change the timing to TDO (assume it is very slow or fast) but once I shift 0x10 to IR and then to DR, TDO is just 0.

I do not think COM will be good enough to program boot. It might be one solution but JTAG will be much better one. I am search a STi5516 board which should give similar JTAG capability to Sti5518 and hope I can find something there.
elkora
Junior Member
Posts: 245
Joined: Wed Jan 03, 2007 8:57 pm

Post by elkora »

keep the good work usbbdm I know you can find the solution.
intruder
Junior Member
Posts: 4
Joined: Sat May 12, 2007 3:19 pm

311

Post by intruder »

Puedes leer el tsop del 311 pero no lo puedes escribir viene protegito como el otp de la card.... saludos a elkora.... :D
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

I found I might made mistake before. I am soldering the back side of the PCB and I am not 100% sure now if I had solder TDI properly. If not then explains why DCU pokes not working. I will do more study on that TDI pin.
elkora
Junior Member
Posts: 245
Joined: Wed Jan 03, 2007 8:57 pm

Post by elkora »

ok usbbdm thank you for you hard work...
elkora
Junior Member
Posts: 245
Joined: Wed Jan 03, 2007 8:57 pm

Post by elkora »

can you communicate with the USB JTAG ? if so can you backup the tsop or I'm asking to much now :wink:
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

elkora wrote:can you communicate with the USB JTAG ? if so can you backup the tsop or I'm asking to much now :wink:
I can detect the CPU, but since TDI might not be right, the command shift in the to CPU generate unexpected result. If I can read the flash I should be able to get the flash. I know people are waiting for 311 support and I have dp311 siting on my shelf for a long time. I wanted to remove it heavily.

There is a growing pile of devices on my shelf needs to be supported and these device helped a lot to find bugs in software even EJTAG.
The recent device I am working on now is Microsoft MN700 router andit triggered a bug I never thought of. No matter what setting I am using on earlier version of software, you simply just can not backup the memory.

Of course I promise it will be fixed in 0.20. This is not a simple usbjtag.def change.
Post Reply

Who is online

Users browsing this forum: No registered users and 4 guests