DSM-G600, DNS-3xx and NSA-220 Hack Forum

Unfortunately no one can be told what fun_plug is - you have to see it for yourself.

You are not logged in.

Announcement

#1 2007-02-18 03:59:29

magore
Member
Registered: 2007-01-05
Posts: 25

DNS-323 JTAG Pinout and interface details

I now have the JTAG port giveing meaning full results for the DNS323! (see "CON5" on the PCB)
I made a mistake on the previous diagram - hence the weird results I had before

Note the debug line attached shows the correct value for the arm926ej-s CPU
---> Debug:   jtag.c:1215 jtag_examine_chain(): JTAG device found: 0x07926041 (Manufacturer: 0x020, Part: 0x7926, Version: 0x0


See JTAG WIKI documentation for details http://dns323.kood.org/hardware:jtag

Last edited by magore (2007-03-04 11:30:07)

Offline

 

#2 2007-02-18 12:12:10

Paul
Member
From: Landshut, Germany
Registered: 2007-01-19
Posts: 35
Website

Re: DNS-323 JTAG Pinout and interface details

wow! that's great !! I'm soooo excited :-)

Offline

 

#3 2007-02-18 12:17:46

KRH
Member
From: Denmark
Registered: 2006-10-27
Posts: 219
Website

Re: DNS-323 JTAG Pinout and interface details

looks harder then tje wrt54 jtag bud aslong its works and easy to set up i will love it smile


First user to fun_plug the dns-323.

Offline

 

#4 2007-03-02 00:47:02

magore
Member
Registered: 2007-01-05
Posts: 25

Re: DNS-323 JTAG Pinout and interface details

I have the JTAG working - I can now read and write memory
See JTAG WIKI documentation for details http://dns323.kood.org/hardware:jtag

Last edited by magore (2007-03-04 11:29:36)

Offline

 

#5 2008-11-07 00:03:49

arnaud35770
New member
Registered: 2008-11-06
Posts: 4

Re: DNS-323 JTAG Pinout and interface details

Hello,

thanks for your good job.
But I'm a newbie in embedded hacking and I wan't to compile my own kernel ( in order to have a build in nfs module).

So I think to  enable the JTAG Port on my DNS323, and so in order to help me, have you some photos of the connections beetween JTAG cable and DNS 323.
My JTAG Cable is http://www.minford.ca/html/mf166.html (hope is good)

Ps : sorry for my English

Arnaud

Offline

 

#6 2008-12-13 02:16:46

pseudonym404
Member
Registered: 2008-12-13
Posts: 6

Re: DNS-323 JTAG Pinout and interface details

What did you do to get openocd to write to flash?

I know the commands, it's just not working - probing works, info is fine if you modify the size calculation in cfi.c (ignore bus_width), operations don't seem to have any effect, and some sectors claim to be protected.

I'm trying to put uboot back on the flash after it erased itself when it was supposed to be loading a kernel over the serial line...

Any help would be greatly appreciated.

Offline

 

#7 2008-12-14 13:50:50

maligor
Member
Registered: 2008-11-16
Posts: 8

Re: DNS-323 JTAG Pinout and interface details

pseudonym404 wrote:

What did you do to get openocd to write to flash?

I know the commands, it's just not working - probing works, info is fine if you modify the size calculation in cfi.c (ignore bus_width), operations don't seem to have any effect, and some sectors claim to be protected.

I'm trying to put uboot back on the flash after it erased itself when it was supposed to be loading a kernel over the serial line...

Any help would be greatly appreciated.

I guess you're trying to use something like:
flash write_bank 0 uboot.bin 0x7d0000

I seem to get the same results, it appears to do something but nothing is written. The protect states for the flash seem strangely random too, and flash protect is missing mode 2.

Offline

 

#8 2008-12-14 21:00:19

pseudonym404
Member
Registered: 2008-12-13
Posts: 6

Re: DNS-323 JTAG Pinout and interface details

maligor wrote:

I guess you're trying to use something like:
flash write_bank 0 uboot.bin 0x7d0000

I seem to get the same results, it appears to do something but nothing is written. The protect states for the flash seem strangely random too, and flash protect is missing mode 2.

Yep, pretty much.

From further reading, I get the impression that if those sectors are infact protected, and openocd isn't just screwy, we may need to apply VID (11.5-12.5V) to RESET# on the flash chip as well as write our own cfi_spansion_protect function to unprotect those areas (although it should be possible to write to 'protected' sectors while VID is applied). There's 11.7V available on the SATA pins....

Of course, the openocd flash code may not be accessing the spansion flash properly...

I'm not overly keen on applying 12V (through a resistor of course) without being much more sure that openocd isn't at fault. smile

EDIT: forget the RESET# nonsense, it's definitely openocd, I've got the protection status read correctly, currently testing erase/write.

Last edited by pseudonym404 (2008-12-16 06:01:08)

Offline

 

#9 2008-12-16 06:57:17

pseudonym404
Member
Registered: 2008-12-13
Posts: 6

Re: DNS-323 JTAG Pinout and interface details

Attached patch uses 8bit writes for bus_width 2 when x16_as_x8 is added to the end of the flash bank line in the config file, reads work without patching. In other words, flashing works. wink

Code:

svn checkout svn://svn.berlios.de/openocd/trunk -r1193 openocd-r1193
cd openocd-r1193
patch -p1 -i <path to patch>
./bootstrap
....etc.

make sure your config file contains:

Code:

flash bank cfi      0xff800000 0x800000 1           2          0        x16_as_x8

Attachments:
Attachment Icon openocd-dns323-spansion.patch, Size: 16,159 bytes, Downloads: 782

Offline

 

#10 2008-12-17 17:31:13

maligor
Member
Registered: 2008-11-16
Posts: 8

Re: DNS-323 JTAG Pinout and interface details

pseudonym404 wrote:

Attached patch uses 8bit writes for bus_width 2 when x16_as_x8 is added to the end of the flash bank line in the config file, reads work without patching. In other words, flashing works. wink

Code:

svn checkout svn://svn.berlios.de/openocd/trunk -r1193 openocd-r1193
cd openocd-r1193
patch -p1 -i <path to patch>
./bootstrap
....etc.

make sure your config file contains:

Code:

flash bank cfi      0xff800000 0x800000 1           2          0        x16_as_x8

Yes, this does seem to work, I've now successfully broken my bootloader and reflashed it back with the dns-323 original bootloader.

Some notes:
If you have a broken bootloader use:
reset halt
instead of: reset run / halt

pseudonym404: I hope you have a copy of the uboot if you're trying to restore it? It stores the mac address at the last flash block, that contains a part of the bootloader.

Offline

 

#11 2008-12-17 21:44:47

pseudonym404
Member
Registered: 2008-12-13
Posts: 6

Re: DNS-323 JTAG Pinout and interface details

maligor wrote:

pseudonym404: I hope you have a copy of the uboot if you're trying to restore it? It stores the mac address at the last flash block, that contains a part of the bootloader.

Yep, one of the first things i did when i got my serial console up and running was dump the contents of the mtd partitions. My dns323 is now back up and running, so I'm now back to putting together a debian installer firmware image. Matt Palmer seems to have beaten me to it while my dns323 has been dead: http://www.hezmatt.org/~mpalmer/blog/ge … s_323.html, so I'll be using his work on d-i as well as my kernel patches (I'm a little further on that, I have the sensor chips working too). smile

edit: I was working on etch before uboot committed suicide, so it'll take me a little while to rebuild my env for lenny.

Last edited by pseudonym404 (2008-12-17 22:56:55)

Offline

 

#12 2008-12-19 20:44:26

maligor
Member
Registered: 2008-11-16
Posts: 8

Re: DNS-323 JTAG Pinout and interface details

Well, I've managed to build a working u-boot image now from the sources. There's something strange with the jtag now tho.

I think I'm only able to write using 'flash write_image', 'flash write_sector' seems to give a lot of noise to the write and always get corrupted results.

Edit:
The Marvell u-boot is painful. Adding anything useful will make it overflow past the start segment which is at 0xffff0000.

Edit2:
I've now modified the u-boot orion5x to boot on dns-323, it seems to read flash, memory is initialized. Currently the power led stays lit when it starts and the orange one aswell so clearly not everything is correct tongue

Also not too sure about the ram settings, but I can read and write the first 64mb
And there's something strange in flinfo, but it seems to read it fine. It checksums the images on the flash.

Edit3:
Heh, now both orange leds get lit and the power led flashes.

Last edited by maligor (2008-12-20 03:36:35)

Offline

 

#13 2008-12-21 07:09:26

pseudonym404
Member
Registered: 2008-12-13
Posts: 6

Re: DNS-323 JTAG Pinout and interface details

Sounding good. smile

So far all I've really got is some Makefiles for building (using dpkg-cross where possible to avoid compile time) everything debian-installer needs to make images (toolchain, a few armel libs, kernel, udebs from kernel package), and a bunch of patches for the kernel and d-i - the kernel stuff is mostly not applied yet, but it worked with vanilla 2.5, so hopefully just minor tweaks. wink

debian-installer is clearly not designed to 'cross compile' (it actually uses prebuilt packages).. had a few headaches persuading it to use armel packages on amd64, and fixing various utility invocations to make that actually work. smile

Haven't actually had a successful boot yet, but I don't think it's far off. wink

Edit: I didn't actually test flash write_sector, as write_image worked, and I moved on. I'm not likely to get round to fixing it anytime soon either, would take up time I'd rather spend working on a (aiming for) near-perfect debian installer image. wink

Edit2: I thought I was quite close. smile Stupid bug, one of my d-i tweaks was picking up ld-2.7.so instead of ld-linux.so.3 (armel, to pass to mklibs), ld was being installed as both, but the latter which the system was trying to use wasn't executable.. Resulting in 'failed to load init'.. It's booting now, time to start tweaking the kernel. smile

Edit3: I now have everything working, I'll put together a firmware image and some sort of dns323-support debian package (dynamic fan control, drop scripts in the right directories to make buttons work, etc.) as soon as (if) I can get some patches accepted for the debian kernel. smile

Last edited by pseudonym404 (2008-12-23 07:26:53)

Offline

 

#14 2009-05-13 11:52:16

balou1974
Member
Registered: 2009-05-13
Posts: 10

Re: DNS-323 JTAG Pinout and interface details

@pseudonym404:

How did you managed to control the powerbutton and Powerled ? Does your DNS323 poweroff if you tell it to do so?
I am currently using Debian Lenny + Debian 2.6.30-rc5-experimental
from Martin Michlmayr / http://www.cyrius.com/journal/debian/or … k/dns-323.
If you got scripts or deb-pakets please share them smile.
Debian runs very well but GPIO control seems not to be supported very well (userland tools) smile

Offline

 

#15 2010-02-11 02:04:04

pseudonym404
Member
Registered: 2008-12-13
Posts: 6

Re: DNS-323 JTAG Pinout and interface details

I eventually got round to putting up a page with my bits and pieces for the dns323 at http://dns323.randomhacking.net/, there's a small apt repository there with a recent kernel with LED fixes, and dns323d, a simple fan/button/led control daemon I've written.

Offline

 

#16 2010-04-27 12:51:51

willjcroz
New member
Registered: 2010-04-27
Posts: 1

Re: DNS-323 JTAG Pinout and interface details

Hi, many thanks for the information on JTAG here. One question should the SMD resistors be 47K or 4K7? On dns323.randomhacking.net it mentions they should be 47K but on Mike's diagram on dns323.kood.org it says 4K7. I'd be grateful if this could be clarified.

cheers,
Will

Offline

 

#17 2010-05-01 18:33:58

sweede
New member
Registered: 2009-09-12
Posts: 1

Re: DNS-323 JTAG Pinout and interface details

4K7, but anything close is probably ok.

Offline

 

#18 2010-07-01 23:04:55

RoganDawes
Member
Registered: 2010-07-01
Posts: 44

Re: DNS-323 JTAG Pinout and interface details

Hi folks,

I'm looking for an updated u-boot for my DNS323 Rev B1. Have any of you JTAG hackers managed to successfully build and boot your own U-boot?

I'm hoping for network support primarily, but things like booting from ext2 would also be great!

Offline

 

Board footer

Powered by PunBB
© Copyright 2002–2010 PunBB