Dangerous Prototypes

Dangerous Prototypes => Bus Pirate Support => OpenOCD JTAG => Topic started by: adamoutler on June 23, 2011, 05:35:17 pm

Title: cfg for JTAG Cortex A8?
Post by: adamoutler on June 23, 2011, 05:35:17 pm
Over on XDA-Developers.com we've seen a rash of carnage from developers recommending that new users flash improper firmware in risky ways...  Anyways... I'm trying to come up with an every man's solution.  The bus pirate is perfect for it's multi-tool capabilities and price.

I've been working on non-invasive recovery methods, but it seems that I've run out of options now.  So It's time to really look at JTAG. 

The target CPU is a Cortex A8 with CoreSight.  I've worked out the proper pinout and connectors to use here: http://forum.xda-developers.com/showthr ... ?t=1000175 (http://forum.xda-developers.com/showthread.php?t=1000175)

I have:
A working device, a daily use device, and some guy's random brick
A bus pirate
The proper connectors worked out.

I need to get a solution for this processor though.  Which .cfg do I use?
Title: Re: How to JTAG Cortex A8?
Post by: robots on June 23, 2011, 05:51:56 pm
You might check http://elinux.org/BeagleBoardJTAG (http://elinux.org/BeagleBoardJTAG)
Beagleboard has OMAP3530 - CortexA8 from TI. You will need to know what company made the chip. Cortex-A8 is just the core. Every vendor has slightly different method to access the JTAG.

Your best bet is to ask on OpenOCD mailing list, but be sure to know what Chip you are dealing with.
Title: Re: cfg for JTAG Cortex A8?
Post by: adamoutler on June 23, 2011, 07:48:04 pm
What sense does that make for using a Bus Pirate?  I'm not trying to make money, I'm looking for a DIY method with a good open source component.  I've got hardware to work with and I'm willing to ship it to someone for help if required.  I'd like to promote both Bus Pirate and Open OCD..  The open source community caused the problems so it would only be right if the open source community can fix the problems as well...  everyone benefeits.

The processor is a HummingBird Cortext A8 with CoreSight.  model: S5PC110.
Title: Re: cfg for JTAG Cortex A8?
Post by: adamoutler on June 23, 2011, 07:56:44 pm
I found this thread here: http://comments.gmane.org/gmane.comp.de ... evel/15041 (http://comments.gmane.org/gmane.comp.debugging.openocd.devel/15041)

it says something about the problem being 1.8V...  Well, the Bus Pirate has a VPU line for powering pullup resistors, so that should not be a problem if a 1.8V power source is used.... It seems that the hardware should be capable of the work required.... I'm just not smart enough to do it. 

I will support anyone who belives they may be able to get the Bus Pirate to JTAG a S5PC110 processor with anything in my means.

I forgot to mention....  People are selling JTAG services for $50  and a RIFF JTAG(a 1-click device) is available for $199.  The bus pirate is the best answer here.
Title: Re: cfg for JTAG Cortex A8?
Post by: arhi on June 23, 2011, 08:59:03 pm
wrt "best answer" I used BP as JTAG with some m3 and I gave up on it as it was unusably slow. BusBlaster on the other hand works crazy fast (v2, have not tried v1) and is not much more expensive then BP (BP is 30$ and BB is 35$). BP is a great tool, but if you need to use JTAG more then once, you really want BB :)

I never tried A8 so can't help in that regard.
Title: Re: cfg for JTAG Cortex A8?
Post by: adamoutler on June 23, 2011, 10:13:55 pm
Yeah...  this is for that once that the users screw something up.  Im writing software to help in the future called heimdall one click, but that does not help the already screwed up devices.  Id like to get this working for people.  For just once situations.
Title: Re: cfg for JTAG Cortex A8?
Post by: arhi on June 23, 2011, 10:58:17 pm
Cool, then it is much bigger chance they will have BP then BB and BP is for them more versatile device.
Title: Re: cfg for JTAG Cortex A8?
Post by: adamoutler on June 24, 2011, 02:41:00 am
Yeah. So,  how to set it up?  What configs do I use?  How do I get it working? What do I expect to see?  How do I troubleshoot?
Title: Re: cfg for JTAG Cortex A8?
Post by: arhi on June 24, 2011, 08:22:20 am
what is the jtag software you use? openocd? urjtag?
Title: Re: cfg for JTAG Cortex A8?
Post by: adamoutler on June 24, 2011, 03:17:14 pm
Being that OpenOCD is the most supported for BusPirate, I'd say OpenOCD, unless URJTAG is better.  I really don't know which one I should go with.  I'm guessing OpenOCD?

I've never JTAGged anything.  I really have no clue what needs to be established for firmware upload.  I've been reading alot and it is all very confusing.
Title: Re: cfg for JTAG Cortex A8?
Post by: arhi on June 24, 2011, 03:56:22 pm
what do you use to generate elf's ? gcc?
Title: Re: cfg for JTAG Cortex A8?
Post by: adamoutler on June 24, 2011, 04:04:58 pm
Sure... that sounds good.  I use Linux, so GCC would be a good choice.  I've never generated an elf.  What's an elf?  I don't really know where to start.  I hooked up my bus pirate, Started an OpenOCD telnet server with stm32.cfg, telnetted into that server, it did nothing, it wouldn't connect is the unit supposed to be in DIO mode?  I don't really know what the next step would be.  Like I said...  I've never JTAGged anything..  What do I do?

( ! ) Fatal error: Uncaught exception 'Elk_Exception' with message 'Please try again. If you come back to this error screen, report the error to an administrator.' in /var/www/dangerousprototypes/forum/sources/database/Db-mysql.class.php on line 696
( ! ) Elk_Exception: Please try again. If you come back to this error screen, report the error to an administrator. in /var/www/dangerousprototypes/forum/sources/database/Db-mysql.class.php on line 696
Call Stack
#TimeMemoryFunctionLocation
10.01072087024session_write_close ( )...(null):0
20.01102218616ElkArte\sources\subs\SessionHandler\DatabaseHandler->write( )...(null):0
30.01102219392Database_MySQL->query( ).../DatabaseHandler.php:119
40.05392358128Database_MySQL->error( ).../Db-mysql.class.php:273