any progress on sa 8300/4250

JTAG (NT) on Cable Boxes

Moderator: justsomeguy

Skillet50
Junior Member
Posts: 54
Joined: Wed Jun 30, 2010 9:03 am

Post by Skillet50 »

IDCODE 10001B4B is consistant, but have never seen impcode.
bl nand

~ attribute ~\ value \

-------------------------------

{"total blocks" }[ 0x00000400 ]

{"page size" }[ 0x00000800 ]

{"page count" }[ 0x0040 ]

{"boot size" }[ 0x00000100 ]

{"spare start" }[ 0x00000200 ]
Just a sample of what I can get out of the Serial Port. Will gladly get into the donating side, just need an address.
Skillet50
Junior Member
Posts: 54
Joined: Wed Jun 30, 2010 9:03 am

Post by Skillet50 »

and thanks to Merkin....
#define CALLIOPE_IO_BASE 0x08000000

and the serial port says....
flash

$ serial | NAND $

\type Size|type Size\

---------------------------------------

[AMTEL 2048|ST 131072]

*0*
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

So this box has nand and spi flash.

Are you familiar with how to use 'tap' commands with usbjtagnt?

If you want to donate just pm usbbdm.
Skillet50
Junior Member
Posts: 54
Joined: Wed Jun 30, 2010 9:03 am

Post by Skillet50 »

I've only seen tap c and tap a ffffffff in the forums. I believe it was to get debug/trap on and yes just tried it and debug changed to on then box reset and turned it back off. That's as familiar as I am. What different things can be done is a mystery to me.
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

yeah gotta teach yourself, have doubt that anyone here can explain it, but usbbdm.

so here goes
"tap c" is ejtag boot instruction and

"tap a" selects the ejtag control register with value "ffffffff"
you can read page 100 for explanation of all 32 bits here: http://downloads.buffalo.nas-central.or ... -03.10.pdf

similarly "tap 1" and "tap 3" accesses the IDCODE and IMPCODE registers, respectively.
so you can manually try reading IMPCODE and you should also receive the same IDCODE.
Skillet50
Junior Member
Posts: 54
Joined: Wed Jun 30, 2010 9:03 am

Thanks again Merkin...

Post by Skillet50 »

-detect
IDCODE 10001B4B
Manufacturer not found 5A5
-tap 1
Eco :10001B4B
-tap 3
Eco :60414000
So Impcode is 60414000 for the MIPS JTAG PORT.The Boss is still working on the ST-40 cores there are some results over in the SAT forums
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

Very strange that you are not getting an IMPCODE when you detect, but it works with "tap 3"

Anyway 0x60414000 = 1100000010000010100000000000000

So here is the register map
Image

It looks like valid IMPCODE...Good Job!
usbbdm
Junior Member
Posts: 8979
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

I am actively working on ST40 core. However if it is ST40 core, no need to work on IMPCODE. That is for MIPS core.
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

usbbdm wrote:... no need to work on IMPCODE. That is for MIPS core.
Yeah, no kidding and we already confirmed mips ejtag port is working.
Calliope cpu is under linux-2.6/arch/mips/powertv/asic/
http://kerneldox.com/kdox-linux-2.6/dir ... 09908.html

So where is the confusion?
usbbdm
Junior Member
Posts: 8979
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

merkin wrote:Yeah, no kidding and we already confirmed mips ejtag port is working.
Calliope cpu is under linux-2.6/arch/mips/powertv/asic/
http://kerneldox.com/kdox-linux-2.6/dir ... 09908.html

So where is the confusion?
Confusion is that someone said it is ST40 core not MIPS core.
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

Well if you look back at schematic, this asic cpu appears to have two seperate debug modules.
Why not accept donation since the mips port is active?

This will be first cablecard box with ejtag access. :)
Skillet50
Junior Member
Posts: 54
Joined: Wed Jun 30, 2010 9:03 am

Doublemints

Post by Skillet50 »

It's two mints in one...... This is the Calliope. Earlier boxes used an Atlas (EXP-XXXX boxes the Thread starter) the HDMI boxes use the Cronus and I believe the RNG200N uses a Zeus...
usbbdm
Junior Member
Posts: 8979
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

merkin wrote:Well if you look back at schematic, this asic cpu appears to have two seperate debug modules.
Why not accept donation since the mips port is active?

This will be first cablecard box with ejtag access. :)
I am having some board with me now and stuck on the ST40. I am afraid I will not work on it right away.
If there is already one MIPS core, why not hook up JTAG NT and see if you can get DEBUG ON. (Trap ON need proper xml, DEBUG ON normally do not).

From what I see here is the CPU ID might not be right yet. This could indicate different flavor of MIPS core if it is MIPS core.
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

okay wait for st40 support first.

1. Why does the user not get IMPCODE when 'detect'?

2. But 'tap 3' shows valid IMPCODE?

3. What bits of IDCODE look wrong?
usbbdm
Junior Member
Posts: 8979
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

IDCODE 10001B4B
Manufacturer not found 5A5

The parts number seems odd but I could be wrong. What CPU is this? If you define it properly in vender.xml you might get IMPCODE detection.
Post Reply

Who is online

Users browsing this forum: No registered users and 2 guests