psmears wrote:On a more positive note, the board seems to have a space to solder on a JTAG connector with the standard ARM pinout - this could be very useful for trying to get Linux to come up on the box.
It is a standard JTAG connector. OpenOCD works with this config file:
telnet_port 4444
gdb_port 3333
interface <whatever interface you use>
reset_config trst_only
jtag newtap mp101 cpu -irlen 4 -ircapture 1 -irmask 0x0f
target create 88w8500 arm9tdmi -chain-position mp101.cpu
flash bank cfi 0xffe00000 0x200000 2 2 88w8500
Additionally, current URJtag svn can be used to access the flash:
# jtag
UrJTAG 0.10 #
Copyright (C) 2002, 2003 ETC s.r.o.
Copyright (C) 2007, 2008, 2009 Kolja Waschk and the respective authors
UrJTAG is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
There is absolutely no warranty for UrJTAG.
jtag.c:537 main() Warning: UrJTAG may damage your hardware!
Type "quit" to exit, "help" for help.
Connected to libftdi driver.
jtag> detect
IR length: 4
Chain length: 1
Device Id: 00010101100101000110001111010011 (0x00000000159463D3)
Manufacturer: Marvell
Part(0): MV88W8500
Stepping: BAN
Filename: /usr/share/urjtag/marvell/88w8500/88w8500-ban
The target is halted in ARM mode.
jtag> detectflash 0xffe00000
Query identification string:
Primary Algorithm Command Set and Control Interface ID Code: 0x0002 (AMD/Fujitsu Standard Command Set)
Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null)
Query system interface information:
Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV
Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV
Vpp [Programming] Supply Minimum Write/Erase voltage: 0 mV
Vpp [Programming] Supply Maximum Write/Erase voltage: 0 mV
Typical timeout per single byte/word program: 128 us
Typical timeout for maximum-size multi-byte program: 0 us
Typical timeout per individual block erase: 1024 ms
Typical timeout for full chip erase: 0 ms
Maximum timeout for byte/word program: 256 us
Maximum timeout for multi-byte program: 0 us
Maximum timeout per individual block erase: 16384 ms
Maximum timeout for chip erase: 0 ms
Device geometry definition:
Device Size: 2097152 B (2048 KiB, 2 MiB)
Flash Device Interface Code description: 0x0002 (x8/x16)
Maximum number of bytes in multi-byte program: 1
Number of Erase Block Regions within device: 4
Erase Block Region Information:
Region 0:
Erase Block Size: 16384 B (16 KiB)
Number of Erase Blocks: 1
Region 1:
Erase Block Size: 8192 B (8 KiB)
Number of Erase Blocks: 2
Region 2:
Erase Block Size: 32768 B (32 KiB)
Number of Erase Blocks: 1
Region 3:
Erase Block Size: 65536 B (64 KiB)
Number of Erase Blocks: 31
Primary Vendor-Specific Extended Query:
Major version number: 1
Minor version number: 3
Address Sensitive Unlock: Required
Process Technology: CS99
Erase Suspend: Read/write
Sector Protect: 1 sectors per group
Sector Temporary Unprotect: Not supported
Sector Protect/Unprotect Scheme: 29BDS640 mode (Software Command Locking)
Simultaneous Operation: Not supported
Burst Mode Type: Supported
Page Mode Type: Not supported
ACC (Acceleration) Supply Minimum: 0 mV
ACC (Acceleration) Supply Maximum: 0 mV
Top/Bottom Sector Flag: No boot
Program Suspend: Not supported
jtag> quit
vrnul03074nb:~# openocd
Open On-Chip Debugger 0.2.0-in-development (2009-07-05-20:55) svn:2462M
$URL: http://svn.berlios.de/svnroot/repos/openocd/trunk/src/openocd.c $
For bug reports, read http://svn.berlios.de/svnroot/repos/openocd/trunk/BUGS
jtag_speed: 1
Info : JTAG tap: mp101.cpu tap/device found: 0x159463d3 (mfg: 0x1e9, part: 0x5946, ver: 0x1)
target state: halted
target halted in ARM state due to breakpoint, current mode: Abort
cpsr: 0xa00000d7 pc: 0xffffeb80
Info : accepting 'telnet' connection from 0
Info : Flash Manufacturer/Device: 0x0001 0x0000
flash 'cfi' found at 0xffe00000
successfully checked protect state
#0 : cfi at 0xffe00000, size 0x00200000, buswidth 2, chipwidth 2
# 0: 0x00000000 (0x4000 16kB) not protected
# 1: 0x00004000 (0x2000 8kB) not protected
# 2: 0x00006000 (0x2000 8kB) not protected
# 3: 0x00008000 (0x8000 32kB) not protected
# 4: 0x00010000 (0x10000 64kB) not protected
# 5: 0x00020000 (0x10000 64kB) not protected
# 6: 0x00030000 (0x10000 64kB) not protected
# 7: 0x00040000 (0x10000 64kB) not protected
# 8: 0x00050000 (0x10000 64kB) not protected
# 9: 0x00060000 (0x10000 64kB) not protected
# 10: 0x00070000 (0x10000 64kB) not protected
# 11: 0x00080000 (0x10000 64kB) not protected
# 12: 0x00090000 (0x10000 64kB) not protected
# 13: 0x000a0000 (0x10000 64kB) not protected
# 14: 0x000b0000 (0x10000 64kB) not protected
# 15: 0x000c0000 (0x10000 64kB) not protected
# 16: 0x000d0000 (0x10000 64kB) not protected
# 17: 0x000e0000 (0x10000 64kB) not protected
# 18: 0x000f0000 (0x10000 64kB) not protected
# 19: 0x00100000 (0x10000 64kB) not protected
# 20: 0x00110000 (0x10000 64kB) not protected
# 21: 0x00120000 (0x10000 64kB) not protected
# 22: 0x00130000 (0x10000 64kB) not protected
# 23: 0x00140000 (0x10000 64kB) not protected
# 24: 0x00150000 (0x10000 64kB) not protected
# 25: 0x00160000 (0x10000 64kB) not protected
# 26: 0x00170000 (0x10000 64kB) not protected
# 27: 0x00180000 (0x10000 64kB) not protected
# 28: 0x00190000 (0x10000 64kB) not protected
# 29: 0x001a0000 (0x10000 64kB) not protected
# 30: 0x001b0000 (0x10000 64kB) not protected
# 31: 0x001c0000 (0x10000 64kB) not protected
# 32: 0x001d0000 (0x10000 64kB) not protected
# 33: 0x001e0000 (0x10000 64kB) not protected
# 34: 0x001f0000 (0x10000 64kB) not protected
cfi information:
mfr: 0x0001, id:0x0000
qry: 'QRY', pri_id: 0x0002, pri_addr: 0x0040, alt_id: 0x0000, alt_addr: 0x0000
Vcc min: 2.7, Vcc max: 3.6, Vpp min: 0.0, Vpp max: 0.0
typ. word write timeout: 128, typ. buf write timeout: 1, typ. block erase timeout: 1024, typ. chip erase timeout: 1
max. word write timeout: 256, max. buf write timeout: 1, max. block erase timeout: 16384, max. chip erase timeout: 1
size: 0x200000, interface desc: 2, max buffer write size: 1
Spansion primary algorithm extend information:
pri: 'PRI', version: 1.3
Silicon Rev.: 0x2, Address Sensitive unlock: 0x0
Erase Suspend: 0x2, Sector Protect: 0x1
VppMin: 00.0, VppMax: 00.0
Unfortunately, the serial port of the CPU is being used to communicate with the Winbond W78LE51P (probably for the IR control). However, there are two jumpers on the board and next to them there's a 4 pin connector. Changing the position of the jumpers will detach the Winbond chip and connect the serial port to the connector.
The boot loader seems to be some proprietary code (Netgear MP101-BLDR).