Difference between revisions of "Config TIAO Universal JTAG Cable As A Buffered Xilinx Parallel Platform Cable III"

From TIAO's Wiki
Jump to: navigation, search

10 PCS, 10cm x 10cm, 2 layers prototype for $38.80 shipped!
(New page: <meta name="keywords" content="TIAOWIKI,JTAG,TJTAG,FTA,JTAG,WRT54G,DD-WRT,urjtag, openocd, flashrom,USB jtag, debrick,tomato,router,wireless router,motorola modem,sb5100,wiggler,arm,mips,a...)
 
(Overview)
 
(9 intermediate revisions by the same user not shown)
Line 18: Line 18:
  
 
In this tutorial, I am going to show you how to config it as a Xilinx Buffered Parallel Cable III to erase/read and program Xilinx CPLD.
 
In this tutorial, I am going to show you how to config it as a Xilinx Buffered Parallel Cable III to erase/read and program Xilinx CPLD.
 +
'''If you have [http://www.diygadget.com/jtag-cables/universal-jtag-adapter-v2-wiggler-and-xilinx-platform-cable-compatible-debrick-routers-modems-and-more.html V2] of our Universal JTAG Adapter, this step is not required as the V2 has onboard pins, all you have to do is to short pins using jumpers.'''
 +
 +
<font color=red>This tutorial works for CPLDs operating on +3.3v voltage only</font>
  
 
== Required Hardware ==
 
== Required Hardware ==
Line 23: Line 26:
 
* [http://www.diygadget.com/jtag-cables/universal-jtag-adapter-for-routers-modem-fta-and-more.html TIAO Universal Buffered Parallel JTAG Adapter]
 
* [http://www.diygadget.com/jtag-cables/universal-jtag-adapter-for-routers-modem-fta-and-more.html TIAO Universal Buffered Parallel JTAG Adapter]
  
 +
[http://www.diygadget.com/jtag-cables/universal-jtag-adapter-for-routers-modem-fta-and-more.html http://www.diygadget.com/media/catalog/product/u/n/universal.jtag.600_2.jpg]
 
== Xilinx Buffered Platform Cable III Schematic ==
 
== Xilinx Buffered Platform Cable III Schematic ==
  
 
This is the schematic of the official Xilinx Buffered Platform Cable III:
 
This is the schematic of the official Xilinx Buffered Platform Cable III:
  
 +
[[Image:Xilinx.platform.cable3.jpg|none|thumb]]
  
The first step is to disassemble your router. In this example, the WRT54GS is very easy to disassemble.  See reference here: [[Debrick Routers Using JTAG Cable]].  If you don't know how to disassemble your router, just search it on google :-)
+
The key points of the schematic are as follows:
 
 
== Locate the JTAG Header/Pin on the router's PCB board ==
 
The JTAG pin on the WRT54GS is the JP2.  See reference here: [[Debrick Routers Using JTAG Cable]]
 
 
 
== Install TUMPA Drivers ==
 
Depending on your system, you can follow the following tutorials to install the drivers on your Windows machine:
 
 
 
[[How to install TIAO USB Multi Protocol Adapter Driver on Windows XP]]
 
 
 
[[How to install TIAO USB Multi Protocol Adapter Driver on Windows Vista or Windows 7]]
 
 
 
Once the driver is installed, unplug TUMPA from your USB port.
 
 
 
== Make The Connections ==
 
 
 
Once you have identified the JTAG pins on your router, you can connect the router with TUMPA board with the supplied female to female flex cable now.  We recommend to use the short cable.
 
 
 
The pinout on the router is as follows:
 
 
 
nTRST  1  2 GND
 
TDI    3  4 GND
 
TDO    5  6 GND
 
TMS    7  8 GND
 
TCK    9  10 GND
 
nSRST 11  12 GND
 
 
 
 
 
and the pinout one the TUMPA is:
 
 
 
 
 
[[Image:tumpa.jtag.connector.1.png|none]]
 
 
 
{|
 
! align="left"|Pin #
 
! Description
 
|-
 
| 1
 
| VTAR
 
|-
 
| 3
 
| nTRST
 
|-
 
| 5
 
| TDI
 
|-
 
| 7
 
| TMS
 
|-
 
| 9
 
| TCK
 
|-
 
| 11
 
| RTCK
 
|-
 
| 13
 
| TDO
 
|-
 
| 15
 
| RST
 
|-
 
| 17
 
| DBGRQ
 
|-
 
| 19
 
| DBGACK
 
|-
 
| 2
 
| Not Connected
 
|-
 
| 4, 6, 8, 10, 12, 14, 16, 18, 20
 
| GND
 
|}
 
 
 
 
 
So, it is easy to make the connections: (Make sure both router and TUMPA are not powered on)
 
 
 
<pre>
 
Use a flex female to female to connect TDI together (PIN 5 on Router to PIN 3 on TUMPA's 20 PIN JTAG Header
 
Use a flex female to female to connect TCK together (PIN 9 on Router to PIN 9 on TUMPA's 20 PIN JTAG Header
 
Use a flex female to female to connect TMS together (PIN 7 on Router to PIN 7 on TUMPA's 20 PIN JTAG Header
 
Use a flex female to female to connect TDO together (PIN 13 on Router to PIN 5 on TUMPA's 20 PIN JTAG Header
 
Use a flex female to female to connect GND together (PIN 4 on Router to PIN 4 on TUMPA's 20 PIN JTAG Header
 
</pre>
 
 
 
So, it will look like this:
 
 
 
[[Image:Tumpa.wrt54tgs.jpg|none]]
 
  
OK, double check the connections, do not power on both router and TUMPA yet.
+
* PIN 2 of DB25 is TDI
 +
* PIN 3 of DB25 is TCK
 +
* PIN 4 of DB25 is TMS
 +
* PIN 13 of DB25 is TDO
 +
* PIN 8, 11 and 12 of DB25 are shorted (connected)
  
== Get zJTAG Ready ==
+
Thus, we can simulate the above schematic on TIAO Universal Buffered Parallel JTAG Adapter.
  
Download [[http://www.tiaowiki.com/download//category.php?id=8 zJTAG]] and unzip it to an empty directory.  In my example, I unzipped it to d:\dev\debrick\zJTAG directory.
+
== Xilinx Buffered Platform Cable III Connections on TIAO Universal Buffered Parallel JTAG Adapter ==
  
Double check connections make sure they are correct and secure. Then, connect router to the power outlet and connect TUMPA to your computer's USB port via an USB cable (USB A to Mini B, most digital cameras and camcorders use this kind of cable).
+
[[Image:Xilinx.on.ujtag-1.jpg|none|thumb]]
  
== Run zJTAG to Debrick Your Router ==
+
Basically, make the following connections:
 
 
It's time to debrick your router now. First, open a DOS prompt window, run <pre>zjtag</pre> without parameters will give you all the command line options.
 
 
 
The following are useful commands:
 
 
<pre>
 
<pre>
-probeonly -&gt; Detect router's CPU and Flash chip.
+
* Short DB25's pin 8, 11 and 12
-erase:&lt;area name&gt; -&gt; example: -erase:NVRAM
+
* Use female to female jumper wire to connect D2, D3, D4, D13 to A1, A2, A3, Y8 on TIAO Universal JTAG adapter respectively.
-backup:&lt;area name&gt; -&gt; example: -backup:CFE
+
* Use female to female jumper wire to connect Y1, Y2, Y3, A8, GND, 3.3V to CPLD's TDI, TCK, TMS, TDO, GND and Vcc respectively.
-flash:&lt;area name&gt; -&gt; example: -flash:Kernel
 
</pre>
 
Also, the most important flag is <font color=red><b>JTAG clock speed divider</b></font> <pre>/L1:&lt;divider&gt;</pre>.  TUMPA can clock TCK as high as 30Mhz, however most router's CPU cannot handle such high clock speed, thus you will have to slow down the clock to make it work.
 
 
 
This is the formula:
 
 
 
<pre>Speed in KHz = 30000 / (divider + 1)</pre>
 
 
 
For example, if you give the following option:
 
 
 
<pre>/L1:3</pre>
 
 
 
The TCK clock speed is 7500KHz or 7.5MHz (30000/(3+1)).
 
 
 
Let's detect the CPU and Flash now by running the following command:
 
 
 
<pre>zJTAG -probeonly</pre>
 
 
 
[[Image:Wrt54gs.zjtag.30Mhz.jpg]]
 
 
 
As you can see from the above photo, the TCK is set to 30Mhz, however, zJTAG won't be able to detect the CPU and Flash.
 
 
 
Now if we run it with /L1:3 option:
 
 
 
<pre>
 
zJTAG -probeonly /L1:3
 
</pre>
 
 
 
[[Image:Wrt54gs.zjtag.7500Khz.jpg]]
 
 
 
Once we set the TCK to 7.5Mhz, now zJTAG is able to detect CPU and Flash for my WRT54GS.
 
 
 
 
 
Most time, you only need to erase NVRAM, so let's do it:
 
 
 
<pre>
 
 
 
D:\dev\debrick\zjtag>zjtag.exe -erase:NVRAM /L1:3
 
 
 
        ==============================================
 
              TUMPA EJTAG Debrick Utility V0.1
 
        ==============================================
 
 
 
 
 
Set I/O speed to 7500 KHz
 
 
 
USB TAP device has been initialized. Please confirm VREF signal connected!
 
Press any key to continue... ONCE target board is powered on!
 
 
 
Probing bus ... Done
 
 
 
Detected IR Length is 8
 
 
 
CPU assumed running under LITTLE endian
 
 
 
CPU Chip ID: 00010100011100010010000101111111 (1471217F)
 
*** Found a Broadcom manufactured BCM4712 REV 01 CPU ***
 
 
 
    - EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
 
    - EJTAG Version ....... : 1 or 2.0
 
    - EJTAG DMA Support ... : Yes
 
    - EJTAG Implementation flags: R4k MIPS32
 
 
 
Issuing Processor / Peripheral Reset ... Done
 
Enabling Memory Writes ... Done
 
Halting Processor ... <Processor Entered Debug Mode!> ... Done
 
Clearing Watchdog ... Done
 
Loading CPU Configuration Code ... Skipped
 
 
 
Probing Flash at Address: 0x1FC00000 ...
 
Detected Chip ID (VenID:DevID = 0089 : 0017)
 
*** Found a Intel 28F640J3 4Mx16      (8MB) Flash Chip from Intel
 
 
 
    - Flash Chip Window Start .... : 1C000000
 
    - Flash Chip Window Length ... : 00800000
 
    - Selected Area Start ........ : 1C7E0000
 
    - Selected Area Length ....... : 00020000
 
 
 
*** You Selected to Erase the NVRAM.BIN ***
 
 
 
=========================
 
Erasing Routine Started
 
=========================
 
Total Blocks to Erase: 1
 
 
 
Erasing block: 64 (addr = 1C7E0000)...Done
 
=========================
 
Erasing Routine Complete
 
=========================
 
elapsed time: 3 seconds
 
 
 
 
 
*** REQUESTED OPERATION IS COMPLETE ***
 
 
 
 
 
D:\dev\debrick\zjtag>
 
 
</pre>
 
</pre>
  
It's always a good idea to check the result of an erase or flash by running a backup command to compare the output.
+
== Short DB25's PIN 8, 11 and 12 ==
 
 
In the case of erase, after the action, each bit of the whole area should be 1 (or each byte should be 0xFF).
 
In the case of flash, always use a binary comparator software to compare the backup image after the flash with the original one.
 
 
 
So, let's do a backup and see if erase command was indeed good:
 
 
 
<pre>
 
 
 
D:\dev\debrick\zjtag>zjtag.exe -backup:NVRAM /L1:3
 
  
        ==============================================
+
In this step, you need to solder wires to make DB25's PIN 8, 11 and 12 connected.
              TUMPA EJTAG Debrick Utility V0.1
 
        ==============================================
 
  
 +
[[Image:Xilinx.81112.jpg|none|thumb]]
  
Set I/O speed to 7500 KHz
+
I soldered them together with a leg of a resistor:
  
USB TAP device has been initialized. Please confirm VREF signal connected!
+
[[Image:xilinx.81112-1.jpg|none|thumb]]
Press any key to continue... ONCE target board is powered on!
 
  
Probing bus ... Done
+
== Connect the female to female wires ==
  
Detected IR Length is 8
+
In this example, I use XC2C64A CoolRunner-II CPLD Dev Board (RGH) as the example:
  
CPU assumed running under LITTLE endian
+
[[Image:xilinx.first.jpg|none|thumb]]
  
CPU Chip ID: 00010100011100010010000101111111 (1471217F)
+
[[Image:xilinx.2.jpg|none|thumb]]
*** Found a Broadcom manufactured BCM4712 REV 01 CPU ***
 
  
    - EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
+
[[Image:Xilinx.3.jpg|none|thumb]]
    - EJTAG Version ....... : 1 or 2.0
 
    - EJTAG DMA Support ... : Yes
 
    - EJTAG Implementation flags: R4k MIPS32
 
 
 
Issuing Processor / Peripheral Reset ... Done
 
Enabling Memory Writes ... Done
 
Halting Processor ... <Processor Entered Debug Mode!> ... Done
 
Clearing Watchdog ... Done
 
Loading CPU Configuration Code ... Skipped
 
 
 
Probing Flash at Address: 0x1FC00000 ...
 
Detected Chip ID (VenID:DevID = 0089 : 0017)
 
*** Found a Intel 28F640J3 4Mx16      (8MB) Flash Chip from Intel
 
 
 
    - Flash Chip Window Start .... : 1C000000
 
    - Flash Chip Window Length ... : 00800000
 
    - Selected Area Start ........ : 1C7E0000
 
    - Selected Area Length ....... : 00020000
 
 
 
*** You Selected to Backup the NVRAM.BIN ***
 
 
 
=========================
 
Backup Routine Started
 
=========================
 
 
 
Saving NVRAM.BIN.SAVED_20110829_221700 to Disk...
 
Done  (NVRAM.BIN.SAVED_20110829_221700 saved to Disk OK)
 
 
 
bytes written: 131072
 
=========================
 
Backup Routine Complete
 
=========================
 
elapsed time: 4 seconds
 
 
 
 
 
*** REQUESTED OPERATION IS COMPLETE ***
 
 
 
 
 
D:\dev\debrick\zjtag>
 
</pre>
 
 
 
Open the file <pre>NVRAM.BIN.SAVED_20110829_221700</pre> in any Hex editor (I use UltraEdit), as you see, it is all 0xFF:
 
 
 
[[Image:Wrt54gs.nvram.erased.jpg]]
 
 
 
This should resolve your problem.  If this doesn't work, erase the kernel (firmware): <pre>zJTAG -erase:kernel /L1:3</pre> then reflash the kernel via TFTP (see [http://www.dd-wrt.com/wiki/index.php/TFTP_flash TFTP Flashing])
 
 
 
Or still doesn't work, you may need to flash CFE:
 
 
 
<pre>
 
zJTAG -flash:CFE /L1:3
 
</pre>
 
 
 
The CFE bin files in the repository all have MAC addresses that DO NOT MATCH your hardware, you will need to edit it before you flash it to your router.  Please read [[Debrick Routers Using JTAG Cable]] first.
 
 
 
Again, to make sure flash is really successful, run a backup command after flash and compare the content with the original one to make sure.
 
 
 
If flash doesn't work or erase doesn't work, try to lower the speed by giving a larger divider, e.g. in my case, use
 
 
 
<pre>
 
/L1:4
 
</pre>
 
  
will decrease TCK to 6Mhz.
 
  
 +
== Connect the JTAG board to PC ==
  
One more suggestion is, always backup each area and whole flash before you do anything to it. You never know!
+
* Connect the JTAG board and your PC with a USB A to Mini USB cable (most digital camera supplies this kind of cable)
 +
* Plug the board to your PC's parallel port
 +
* Run Xilinx iMPACT from lab tools, select Parallel Cable III in cable setup dialog
 +
* Now, you can use iMPACT to read/erase/write CPLDs.
  
 +
[[Image:xilinx.4.jpg|none|thumb]]
  
 +
You can read [[Program Xilinx XC2C64A Or Similar Xilinx CPLD Using TIAO Universal JTAG Cable]] on how to program CPLD using our Universal Parallel JTAG board.
  
 
<span class="plainlinks">
 
<span class="plainlinks">

Latest revision as of 03:21, 15 May 2012








Buy various JTAG cables for your Satellite Receiver, Cable Modem, Wireless Router, Standard Wiggler from http://www.easymg.com and http://www.diygadget.com


Overview

TIAO Universal Buffered Parallel JTAG Adapter is a multi-functional parallel JTAG adapter for hobbyists or engineers.

In this tutorial, I am going to show you how to config it as a Xilinx Buffered Parallel Cable III to erase/read and program Xilinx CPLD. If you have V2 of our Universal JTAG Adapter, this step is not required as the V2 has onboard pins, all you have to do is to short pins using jumpers.

This tutorial works for CPLDs operating on +3.3v voltage only

Required Hardware

universal.jtag.600_2.jpg

Xilinx Buffered Platform Cable III Schematic

This is the schematic of the official Xilinx Buffered Platform Cable III:

Xilinx.platform.cable3.jpg

The key points of the schematic are as follows:

  • PIN 2 of DB25 is TDI
  • PIN 3 of DB25 is TCK
  • PIN 4 of DB25 is TMS
  • PIN 13 of DB25 is TDO
  • PIN 8, 11 and 12 of DB25 are shorted (connected)

Thus, we can simulate the above schematic on TIAO Universal Buffered Parallel JTAG Adapter.

Xilinx Buffered Platform Cable III Connections on TIAO Universal Buffered Parallel JTAG Adapter

Xilinx.on.ujtag-1.jpg

Basically, make the following connections:

* Short DB25's pin 8, 11 and 12
* Use female to female jumper wire to connect D2, D3, D4, D13 to A1, A2, A3, Y8 on TIAO Universal JTAG adapter respectively.
* Use female to female jumper wire to connect Y1, Y2, Y3, A8, GND, 3.3V to CPLD's TDI, TCK, TMS, TDO, GND and Vcc respectively.

Short DB25's PIN 8, 11 and 12

In this step, you need to solder wires to make DB25's PIN 8, 11 and 12 connected.

Xilinx.81112.jpg

I soldered them together with a leg of a resistor:

Xilinx.81112-1.jpg

Connect the female to female wires

In this example, I use XC2C64A CoolRunner-II CPLD Dev Board (RGH) as the example:

Xilinx.first.jpg
Xilinx.2.jpg
Xilinx.3.jpg


Connect the JTAG board to PC

  • Connect the JTAG board and your PC with a USB A to Mini USB cable (most digital camera supplies this kind of cable)
  • Plug the board to your PC's parallel port
  • Run Xilinx iMPACT from lab tools, select Parallel Cable III in cable setup dialog
  • Now, you can use iMPACT to read/erase/write CPLDs.
Xilinx.4.jpg

You can read Program Xilinx XC2C64A Or Similar Xilinx CPLD Using TIAO Universal JTAG Cable on how to program CPLD using our Universal Parallel JTAG board.








Buy various JTAG cables for your Satellite Receiver, Cable Modem, Wireless Router, Standard Wiggler from http://www.easymg.com and http://www.diygadget.com



10 PCS, 10cm x 10cm, 2 layers prototype for $38.80 shipped!