jtag support for a gpon-terminal

This site is best viewed in a modern browser with JavaScript enabled.

jtag support for a gpon-terminal

cornelus1978

i have a bricked device (huawei hg8247), it's a gpon terminal.
boot log from serial before i bricked device attached on message.
procesor : HISILICON - SD5113-V120 - http://www.7-cpu.com/cpu/ARM11.html
flash : SPANSION - S29GL128N
atached images with pcb, processor, flash. - http://imageshack.us/g/822/p10502901.jpg/
i need if is posibble, to add support for this procesor for unbuffered cable, i see flashchip is already supported on zjtag1.0.
thanks.

[deleted]

I'm continuing the development of zJTAG. Please stay tuned for updates, or support the development by donating money or by sending patch.

cornelus1978

Hello.
I have a bricked device (huawei HG8247- erased uboot accidentaly), i have the uboot-file and i want to repair it with jtag.
He have an 2x5 pins jtag connector(smd type) like this "http://wiki.openwrt.org/toh/huawei/hg553"
Configuration of device:
procesor - HISILICON SD5113
flash - SPANSION S29GL128N
I builded a cheap xilinx cable and tryed to connect with all the free jtag tools that i found (zjtag, tjtag, brjtag), without succes, since flash is in supported list seems to be problem with processor(not added to jtag tools), or pin assignment is wrong.
____________
1.TCK 2.GND |
3.TDO 4.VCC |
5.TMS 6.NC | THIS IS 2X5 PINS JTAG ASSIGNMENT THAT I FOUND ON INTERNET, and is like same to openwrt huawei
7.NC 8.NC |
9.TDI 10.GND |
_____________________________________________
1.??? - 1K ohms to gnd ??? | 2.GND - GND - OK |
3.??? - NO SIGNAL ??? | 4.VCC - 3,3V - OK |
5.??? - 3,3V ??? | 6.??? - NO SIGNAL - ??? | THIS IS WHAT I READ WITH MULTIMETTER ON DEVICE.
7.??? - 1K ohms to gnd ??? | 8.??? - NO SIGNAL - ??? |
9.??? - 3,3V ??? |10.GND - GND - OK |
thanks.
here have a picture of pcb
http://img547.imageshack.us/img547/3281/ont.jpg

cornelus1978

solved with pinout findings, succeded to connect to both devices but i got errors.
on first device
spansion S29GL128N flash
got those logs.
step 1.
D:\Windows32>zjtag -flash:cfe /cable:1 /instrlen:32
==============================================
zJTAG EJTAG Debrick Utility v1.0
==============================================
cableid=1, cabletype=1
Probing bus ... Done
Detected IR chain Length is 4
Instruction Length set to 32
CPU Chip ID: 00110011000000000000010010111110 (330004BE)
CPU Manufacturer :Unknown(id=4BE)
CPU Device ID :3000
CPU Revision :3
*** Detected a CPU but not in build-in list ***
*** You can set /skipdetect let operate continue ***
step 2.
D:\Windows32>zjtag -flash:cfe /skipdetect /cable:1 /instrlen:32
==============================================
zJTAG EJTAG Debrick Utility v1.0
==============================================
cableid=1, cabletype=1
Probing bus ... Done
Detected IR chain Length is 4
Instruction Length set to 32
CPU assumed running under LITTLE endian
CPU Chip ID: 00110011000000000000010010111110 (330004BE)
*** CHIP DETECTION OVERRIDDEN ***
- EJTAG IMPCODE ....... : 00000000000010001010000010010000 (0008A090)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...
DMA Write(x2) Addr = 1fc0aaaa Data = ERROR ON WRITE
Detected Chip ID (VenID

evID = 008C : 1318)
DMA Read(x2) Addr = 1fc00022 Data = (0318248c)ERROR ON READ
DMA Read(x2) Addr = 1fc00022 Data = (0318248c)ERROR ON READ
DMA Write(x2) Addr = 1fc0aaaa Data = ERROR ON WRITE
DMA Read(x2) Addr = 1fc00022 Data = (0318248c)ERROR ON READ
*** Unknown or NO Flash Chip Detected ***
*** REQUESTED OPERATION IS COMPLETE ***
step 3.
D:\Windows32>zjtag -flash:cfe /skipdetect /cable:1 /instrlen:32 /verbose /fc:115
==============================================
zJTAG EJTAG Debrick Utility v1.0
==============================================
cableid=1, cabletype=1
Probing bus ... Done
Detected IR chain Length is 4
Instruction Length set to 32
CPU assumed running under LITTLE endian
CPU Chip ID: 00110011000000000000010110101110 (330005AE)
*** CHIP DETECTION OVERRIDDEN ***
- EJTAG IMPCODE ....... : 00000000000000001010000010010000 (0000A090)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Matching Flash Chip (VenID

evID = 017E : 3701)
*** Manually Selected a S29GL128N/M29W128G Uni (16MB) from AMD/Spansion
- Flash Chip Window Start .... : 1C000000
- Flash Chip Window Length ... : 01000000
- Selected Area Start ........ : 1C000000
- Selected Area Length ....... : 00040000
*** You Selected to Flash the CFE.BIN ***
=========================
Flashing Routine Started
=========================
Total Blocks to Erase: 2
Erasing block: 1 (addr = 1C000000)...DMA Write(x2) Addr = 1c000aaa Data = ERROR
ON WRITE
DMA Write(x2) Addr = 1c000aaa Data = ERROR ON WRITE
Done
Erasing block: 2 (addr = 1C020000)...DMA Write(x2) Addr = 1c000aaa Data = ERROR
ON WRITE
DMA Write(x2) Addr = 1c000aaa Data = ERROR ON WRITE
Done
Loading CFE.BIN to Flash Memory...
1C000000: DMA Write(x2) Addr = 1c000aaa Data = ERROR ON WRITE
DMA Write(x2) Addr = 1c000000 Data = ERROR ON WRITE
DMA Write(x2) Addr = 1c000aaa Data = ERROR ON WRITE
DMA Write(x2) Addr = 1c000002 Data = ERROR ON WRITE
DMA Read(x2) Addr = 1c000002 Data = (1300248c)ERROR ON READ
DMA Read(x2) Addr = 1c000002 Data = (1318248c)ERROR ON READ
EA000012 DMA Write(x2) Addr = 1c000aaa Data = ERROR ON WRITE
step 4.
D:\Windows32>zjtag -flash:cfe /skipdetect /cable:1 /instrlen:32 /verbose /fc:088
==============================================
zJTAG EJTAG Debrick Utility v1.0
==============================================
cableid=1, cabletype=1
Probing bus ... Done
Detected IR chain Length is 4
Instruction Length set to 32
CPU assumed running under LITTLE endian
CPU Chip ID: 00110011000000000000010010101110 (330004AE)
*** CHIP DETECTION OVERRIDDEN ***
- EJTAG IMPCODE ....... : 00000000000010001010000010010000 (0008A090)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Matching Flash Chip (VenID

evID = 017E : 2101)
*** Manually Selected a Spansion S29GL128N/P Uni (16MB) from AMD/Spansion
- Flash Chip Window Start .... : 1C000000
- Flash Chip Window Length ... : 01000000
- Selected Area Start ........ : 1C000000
- Selected Area Length ....... : 00040000
*** You Selected to Flash the CFE.BIN ***
=========================
Flashing Routine Started
=========================
Total Blocks to Erase: 2
Erasing block: 1 (addr = 1C000000)...DMA Write(x2) Addr = 1c000aaa Data = ERROR
ON WRITE
DMA Write(x2) Addr = 1c000aaa Data = ERROR ON WRITE
Done
Erasing block: 2 (addr = 1C020000)...DMA Write(x2) Addr = 1c000aaa Data = ERROR
ON WRITE
DMA Write(x2) Addr = 1c000aaa Data = ERROR ON WRITE
Done
Loading CFE.BIN to Flash Memory...
1C000000: DMA Write(x2) Addr = 1c000aaa Data = ERROR ON WRITE
DMA Write(x2) Addr = 1c000000 Data = ERROR ON WRITE
DMA Write(x2) Addr = 1c000aaa Data = ERROR ON WRITE
DMA Write(x2) Addr = 1c000002 Data = ERROR ON WRITE
DMA Read(x2) Addr = 1c000002 Data = (1300248c)ERROR ON READ
DMA Read(x2) Addr = 1c000002 Data = (1318248c)ERROR ON READ
EA000012 DMA Write(x2) Addr = 1c000aaa Data = ERROR ON WRITE
DMA Write(x2) Addr = 1c000aaa Data = ERROR ON WRITE
DMA Write(x2) Addr = 1c000006 Data = ERROR ON WRITE
DMA Read(x2) Addr = 1c000006 Data = (1300248c)ERROR ON READ
E59FF014 DMA Write(x2) Addr = 1c000aaa Data = ERROR ON WRITE
DMA Write(x2) Addr = 1c000aaa Data = ERROR ON WRITE
and on second device.
flash: INTEL-JS28F128 M29FWH
same step 1 and 2
step 3.
D:\Windows32>zjtag -flash:cfe /cable:1 /instrlen:32 /fc:065 /skipdetect /verbose
==============================================
zJTAG EJTAG Debrick Utility v1.0
==============================================
cableid=1, cabletype=1
Probing bus ... Done
Detected IR chain Length is 4
Instruction Length set to 32
CPU assumed running under LITTLE endian
CPU Chip ID: 00110011000000000000011010101110 (330006AE)
*** CHIP DETECTION OVERRIDDEN ***
- EJTAG IMPCODE ....... : 00000000000010001010000010010000 (0008A090)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Matching Flash Chip (VenID

evID = 0089 : 0018)
*** Manually Selected a Intel 28F128J3 8Mx16 (16MB) from Intel
- Flash Chip Window Start .... : 1C000000
- Flash Chip Window Length ... : 01000000
- Selected Area Start ........ : 1C000000
- Selected Area Length ....... : 00040000
*** You Selected to Flash the CFE.BIN ***
=========================
Flashing Routine Started
=========================
Total Blocks to Erase: 2
Erasing block: 1 (addr = 1C000000)...Done
Erasing block: 2 (addr = 1C020000)...Done
Loading CFE.BIN to Flash Memory...
1C000000: DMA Write(x2) Addr = 1c000002 Data = ERROR ON WRITE
DMA Write(x2) Addr = 1c000002 Data = ERROR ON WRITE
EA000012 DMA Write(x2) Addr = 1c000006 Data = ERROR ON WRITE
DMA Write(x2) Addr = 1c000006 Data = ERROR ON WRITE
E59FF014 DMA Write(x2) Addr = 1c00000a Data = ERROR ON WRITE
DMA Write(x2) Addr = 1c00000a Data = ERROR ON WRITE
E59FF014 DMA Write(x2) Addr = 1c00000e Data = ERROR ON WRITE
DMA Write(x2) Addr = 1c00000e Data = ERROR ON WRITE
E59FF014
Tryed all zjtag versions available.
please Volkan, can add support for those devices?

cornelus1978

still nothing about this device ?

[deleted]

Sorry for the late response. I have some exams to finish. I will be able to look for your device next week.

cornelus1978

Need any info, logs from device please ask me, a few days ago buyed another one specialy for this purpose.
thanks.

cornelus1978

found on huawei web site, source code for those series devices, found something intersting but far for my knowledge inside archive, maybe u can manage to make the program compatible for me.
I have uboot file ready to write, so i need if is possible not a full version of software, only a stripped version who can erase, and write uboot on flash.
In zip source code u find on das_uboot folder some adresses for flash memory.
here is the source code.
http://www.huaweidevice.com/worldwide/downloadCenter.do?method=toDownloadFile&flay=software&softid=NDY4MzY=
- i use buffered xilinx cable made by me after this schematic.

cornelus1978

hello, any news about this ?

cornelus1978

Stucked ??????

[deleted]

cornelus1978 wrote: atached images with pcb, processor, flash. - http://imageshack.us/g/822/p10502901.jpg/

I can't access images, could you please re-upload them or e-mail them to me: volkan-k {at} users.sourceforge.net

cornelus1978

done.

cornelus1978

hello volkan, can please answer me if is possible to make zjtag see this, or i hope for impossible?

cornelus1978

hello, any news about this ?

[deleted]

No, not yet. I was unable to develop zJTAG since my Toshiba laptop's LCD screen died, will try replacing LCD cable and inverter, don't know if it will work or not.

cornelus1978

hello, i see a new version of zjtag 1.1.
any news about that HISILICON processor?

[deleted]

zJTAG ver1.1 is a bug-fix release based on Damien Mascord's (tusker.org) contribution which only fixes 64-bit OS problem.

[deleted]

hello,
Please try zJTAG ver1.1 with /skipdetect and /instrlen:32 parameters then it should work with your CPU. (DMA errors should be fixed in ver1.1)
Please don't forget to use /L1:3 parameter to slow down if you are using USB2.0 adapter.

http://www.tiaowiki.com/w/Debrick_Wireless_Router_Using_TUMPA_and_zJTAG wrote:the most important flag is JTAG clock speed divider
/L1:<divider>
. TUMPA can clock TCK as high as 30Mhz, however most router's CPU cannot handle such high clock speed, thus you will have to slow down the clock to make it work.
This is the formula:
Speed in KHz = 30000 / (divider + 1)
For example, if you give the following option:
/L1:3
The TCK clock speed is 7500KHz or 7.5MHz (30000/(3+1)).

cornelus1978

Hello, sorry i missed a period of time to follow forum, i will try tomorow and come back with a feedback about your advice.
I use a buffered wiggler interface as adapter, not usb.
Cheers

cornelus1978

hello, tryed today with no succes.

D:\zjtag1.1>zjtag -probeonly /cable:1
        ==============================================
               zJTAG EJTAG Debrick Utility v1.1
        ==============================================
cableid=1, cabletype=1
Probing bus ... Done
Detected IR chain Length is 4
CPU Chip ID: 00110011000000000000011010111110 (330006BE)
    CPU Manufacturer :Unknown(id=6BE)
    CPU Device ID :3000
    CPU Revision  :3
*** Detected a CPU but not in build-in list ***
*** You can set /skipdetect let operate continue ***
**********************************************************
D:\zjtag1.1>zjtag -probeonly /cable:1 /skipdetect /instrlen:32
        ==============================================
               zJTAG EJTAG Debrick Utility v1.1
        ==============================================
cableid=1, cabletype=1
Probing bus ... Done
Detected IR chain Length is 4
Instruction Length set to 32
CPU assumed running under LITTLE endian
CPU Chip ID: 00110011000000000000011010111110 (330006BE)
*** CHIP DETECTION OVERRIDDEN ***
    - EJTAG IMPCODE ....... : 00000000000010001010000010010000 (0008A090)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Probing Flash at Address: 0x1FC00000 ...
DMA Write(x2) Addr = 1fc0aaaa  Data = ERROR ON WRITE
Detected Chip ID (VenID:DevID = 0080 : 1318)
DMA Read(x2) Addr = 1fc00022  Data = (03182680)ERROR ON READ
DMA Read(x2) Addr = 1fc00022  Data = (03182680)ERROR ON READ
DMA Write(x2) Addr = 1fc0aaaa  Data = ERROR ON WRITE
DMA Read(x2) Addr = 1fc00022  Data = (03182680)ERROR ON READ
*** Unknown or NO Flash Chip Detected ***
********************************************************************
D:\zjtag1.1>zjtag -flash:custom /window:20000000 /start:20000000 /length:40000 /
verbose /cable:1 /skipdetect /instrlen:32 /fc:65
        ==============================================
               zJTAG EJTAG Debrick Utility v1.1
        ==============================================
cableid=1, cabletype=1
Probing bus ... Done
Detected IR chain Length is 4
Instruction Length set to 32
CPU assumed running under LITTLE endian
CPU Chip ID: 00110011000000000000011110111110 (330007BE)
*** CHIP DETECTION OVERRIDDEN ***
    - EJTAG IMPCODE ....... : 00000000000010001010000010010000 (0008A090)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Matching Flash Chip (VenID:DevID = 0089 : 0018)
*** Manually Selected a Intel 28F128J3 8Mx16      (16MB) from Intel
    - Flash Chip Window Start .... : 20000000
    - Flash Chip Window Length ... : 01000000
    - Selected Area Start ........ : 20000000
    - Selected Area Length ....... : 00040000
*** You Selected to Flash the CUSTOM.BIN ***
=========================
Flashing Routine Started
=========================
Total Blocks to Erase: 2
Erasing block: 1 (addr = 20000000)...Done
Erasing block: 2 (addr = 20020000)...Done
Loading CUSTOM.BIN to Flash Memory...
   20000000: DMA Write(x2) Addr = 20000002  Data = ERROR ON WRITE
DMA Write(x2) Addr = 20000002  Data = ERROR ON WRITE
7A020010 DMA Write(x2) Addr = 20000006  Data = ERROR ON WRITE
DMA Write(x2) Addr = 20000006  Data = ERROR ON WRITE
00000000 DMA Write(x2) Addr = 2000000a  Data = ERROR ON WRITE
DMA Write(x2) Addr = 2000000a  Data = ERROR ON WRITE
00000000 DMA Write(x2) Addr = 2000000e  Data = ERROR ON WRITE
DMA Write(x2) Addr = 2000000e  Data = ERROR ON WRITE
00000000......................
same errors

Volkan, can please consider to look over this, as i read in arm processors manual, they have different id(impcode, idcode, idadress)as mips. Can u add a patch in source code to make flash writable.
Thanks.