jTagging along

Background story:
I wanted to create an appliance that simply allows one to listen to web radio and allows S/PDIF output. My idea was that using my old Dreambox DM500-T would be perfect for this - so I started hacking away.

I began with trying to customize and compile my own kernel using tuxbox as a base and mimicking one step after another until I finally had my own cross-compiler and Linux kernel that I could hack as much as I wanted.

Worth noting is that the built in bootloader in DM500 is accessed by pressing Enter a second after power-on. The bootloader allows transfer of the kernel to RAM from TFTP which means I don't actually needed to modify the flash in order to load a new kernel. As a final note, the bootloader is located in the same flash as everything else (uh-oh). A few hacks later and the built-in bootloader printed an error message and nothing else :-(.

Googling, googling and googling did not really produce anything of value except that when people had even more serious issues (no output at all) they resorted to JTAGing. I never had the pleasure of JTAGing and quite frankly I did not possess any knowledge worth nothing about the inner workings of JTAG either. Status: One bricked device and a opportunity to learn something I wanted to learn for a long time - excellent!


The DM500 board exposes 2x8 pads which needs to be soldered to wires in order to access the JTAG signals. JTAGing DM500 is not uncommon and there are quite a number of programs available to do so, but they are all ad-hoc and requires a DB25 to LPT-port. I did not like that solution very much, I wanted to use a real JTAG in order to learn how to do it "the right way".

Schematics of the the ad-hoc DB25 to JTAG was readily available which offered pin positions on the DM500 board of almost all JTAG signals - only lacking TRST and VCC reference.

I tried connecting the available JTAG signals to my ARM-USB-OSD but without luck, I wasn't really surprised since my adapter needs a Vref in order to know what voltage to output (nice feature, it makes burning things up so much harder).

Today during breakfast I discovered a czech forum post listing what I hope is the correct pinout for the whole 2x8 PAD, which means it should only be a matter of soldering the last two signals. If it works, I will upload complete schematics, BSDL (if needed), scripts and how-tos - that is a promise.

For reference, DM500 consists of an IBM STB02500 SoC with an Intel flash.

Comments

Popular posts from this blog

Open Datacenter Hardware - What is OCP?

Open Datacenter Hardware - Leopard Server