JTAG port on the DNS-323

WARNING: attaching a JTAG port will certainly void your warranty and could destroy your unit.

Please feel free to update, cleanup or correct this page.

What is this?

This document shows how to use the JTAG port on the DNS-323.

• You need openocd OpenOCDinstalled on a linux box
• You can get the sources svn checkout svn://svn.berlios.de/openocd/trunk
• You need a JTAG cable

JTAG Port Pinout and Wiggler style Programmer

[http://www.amontec.com/jtagkey-tiny.shtml| JTAGKey Tiny]

Solder 4K7 Ohm resistors @ R202 R201 R200 Connect JTAG pins just like the Wrigler port, and also bridge R199 (EN pin to VCC) to enable JTAG.

openocd.cfg:

telnet_port 4444
gdb_port 3333

interface ft2232
ft2232_device_desc "Amontec JTAGkey"
ft2232_layout jtagkey
ft2232_vid_pid 0x0403 0xcff8
jtag_speed 3

reset_config srst_only
jtag_device 4 0x1 0xf 0xe

jtag_nsrst_delay 1200
jtag_ntrst_delay 1200

#target <type> <endianness> <chainpos> <variant>
target feroceon little 0

# planing with flash code - work in progress
#working_area 0 0x00400000 0x40000 nobackup

#          driver   addr       size     chip_width  bus_width  options
flash bank cfi      0xff800000 0x800000 1           2          0

#target configuration
init
reset run
sleep 500
halt

TOP VIEW Note Pin 1 is square pin

Note nTRST must be sent a buffered high signal to use JTAG

cat openocd.cfg
#daemon configuration
telnet_port 4444
gdb_port 3333

#interface
interface parport
parport_port 0x378
parport_cable wiggler
#parport_cable old_amt_wiggler
jtag_speed 1
#use combined on interfaces or targets that can't set TRST/SRST separately
#reset_config trst_and_srst srst_pulls_trst
#reset_config trst_only
#reset_config trst_and_srst combined
reset_config srst_only

#jtag scan chain
#format L IRC IRCM IDCODE (Length, IR Capture, IR Capture Mask, IDCODE)
jtag_device 4 0x1 0xf 0xe

jtag_nsrst_delay 1200
jtag_ntrst_delay 1200

#target <type> <endianness> <chainpos> <variant>
target feroceon little 0

# planing with flash code - work in progress
working_area 0 0x00400000 0x40000 nobackup

#          driver   addr       size     chip_width  bus_width  options
flash bank cfi      0xff800000 0x400000 1           2          0

#target configuration
init
reset run
sleep 500
halt

• Start the program

openocd -d3 --log_output log.txt

• Telnet to the debug interface

telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger

• Memory dump of the U-Boot flash

> mdb 0xfffd0000 0x10
0xfffd0000: 12 00 00 ea 14 f0 9f e5 
0xfffd0008: 14 f0 9f e5 14 f0 9f e5 

• Dump Marvell» U-BOOT prompt in firmware example

> mdb 0xfffea826 0x8
0xfffea826: 72 76 65 6c 6c 3e 3e 20

• Reset CPU

 Target 0 halted
target halted in ARM state due to debug request, current mode: Supervisor
cpsr: 0x200000d3 pc: 0x00f12a2c
MMU: disabled, D-Cache: disabled, I-Cache: enabled

           Table 26. S29GL064M (Model R4) Sector Group Protection/Unprotection Addresses
                     Sector/Sector                      Sector/Sector                        Sector/Sector
  Sector    A21–A12    Block Size    Sector    A21–A12    Block Size     Sector     A21–A12    Block Size
                        (Kbytes)                           (Kbytes)                             (Kbytes)
   SA0    0000000000       8       SA23–SA26 00100XXXXX  256 (4x64)    SA79–SA82  10010XXXXX  256 (4x64)
   SA1    0000000001       8       SA27-SA30 00101XXXXX  256 (4x64)    SA83–SA86  10011XXXXX  256 (4x64)
   SA2    0000000010       8       SA31-SA34 00110XXXXX  256 (4x64)    SA87–SA90  10100XXXXX  256 (4x64)
   SA3    0000000011       8       SA35-SA38 00111XXXXX  256 (4x64)    SA91–SA94  10101XXXXX  256 (4x64)
   SA4    0000000100       8       SA39-SA42 01000XXXXX  256 (4x64)    SA95–SA98  10110XXXXX  256 (4x64)
   SA5    0000000101       8       SA43-SA46 01001XXXXX  256 (4x64)   SA99–SA102  10111XXXXX  256 (4x64)
   SA6    0000000110       8       SA47-SA50 01010XXXXX  256 (4x64)   SA103–SA106 11000XXXXX  256 (4x64)
   SA7    0000000111       8       SA51-SA54 01011XXXXX  256 (4x64)   SA107–SA110 11001XXXXX  256 (4x64)
          0000001XXX               SA55–SA58 01100XXXXX  256 (4x64)   SA111–SA114 11010XXXXX  256 (4x64)
SA8–SA10 0000010XXX   192 (3x64)   SA59–SA62 01101XXXXX  256 (4x64)   SA115–SA118 11011XXXXX  256 (4x64)
          0000011XXX               SA63–SA66 01110XXXXX  256 (4x64)   SA119–SA122 11100XXXXX  256 (4x64)
SA11–SA14 00001XXXXX  256 (4x64)   SA67–SA70 01111XXXXX  256 (4x64)   SA123–SA126 11101XXXXX  256 (4x64)
SA15–SA18 00010XXXXX  256 (4x64)   SA71–SA74 10000XXXXX  256 (4x64)   SA127–SA130 11110XXXXX  256 (4x64)
SA19–SA22 00011XXXXX  256 (4x64)   SA75–SA78 10001XXXXX  256 (4x64)   SA131–SA134 11111XXXXX  256 (4x64)

Any clues how to use this to write a cfi_spansion_protect function for openocd would be greatly appreciated.

• The flash code in OPENOCD does not understand CFI mode 2 access. However this looks to be easy to fix. There is an early patch that attempted to address this but was never added into the project release. This code provides a good starting point.

• Forum thread