JTAG-ing - Anyone able to advise?

Java Jive wrote:
Thanks, yes, I am aware of that possibility, and will try it as soon
as I have a PC free to be disconnected from the wider network, but:

:-( The output given up thread and the lack of response to keystrokes
sent from the PC suggest that the bootloader is cream-crackered.

:-( QNAP have a list of the models that can upgrade via TFTP, and
mine is not included in the list.

Have you tried USB -

http://www.qnap.com/useng/index.php?...sc=1150&n=5061

No, but I tried the Hard Disk equivalent without success before I
realised just how broken the damned thing really is. I previously had
a look at the scripts that do the flashing, and the USB method is part
of the same script that the HD method is, and it relies on normal
booting as far as the init scripts, and this is not taking place.

On Mon, 22 Sep 2014 20:47:44 +0100, Andy Furniss [email protected] wrote:

Have you tried USB -

http://www.qnap.com/useng/index.php?...sc=1150&n=5061

--
================================================== =======
Please always reply to ng as the email in this post's
header does not exist. Or use a contact address at:
http://www.macfh.co.uk/JavaJive/JavaJive.html
http://www.macfh.co.uk/Macfarlane/Macfarlane.html

On Mon, 22 Sep 2014 11:10:30 +0100, Peter Duncanson wrote:

On Mon, 22 Sep 2014 02:30:39 +0100, Bill Wright wrote:

Java Jive wrote:
I have a QNAP NMP-1000, it's a network media player. It's no' bad,

Can we avoid this sort of pseudo-Scottish idiom from now on? If you're
going to remain as part of the UK I think it would be better if you
communicated in Home Counties English only.

Perhaps we should have a referendum to decide on the type of English we
should use.

Wha' abou' the sor' of English, yeah, used by people who don' have a "t"
in their alphabe'. I' seems to be qui'e common these days.

On 22 Sep 2014 19:52:11 +0100 (BST), Theo Markettos
wrote:


There's a 14-pin unfitted SMD header just above the SoC and below the
battery (marked CN8) - 14 pins is something of a telltale for JTAG.
http://www.jtagtest.com/pinouts/

I'd buzz out the connector and see if it matches one of those.


This would certainly agree with the 14 pin layout on the link given:-
http://www.linux-mips.org/wiki/JTAG#JTAG_headers

pins 4 and 6 are connected together ( on the top layer for some
reason) so identifying them as ground may be a quick check
The pads are probably used with pogo pins in production.

Thanks both ...

Before answering your points in detail, I'll just mention in answer to
others that I spent a good while trying to get both the TFTP and the
USB drive methods working last night, but to no avail. This confirms
my opinion that the bootloader itself is a gonner, so any such method
based on the assumption of it working is never going to succeed.

It seems to be JTAG or nothing ...

On Tue, 23 Sep 2014 11:57:53 +0100, Geo
wrote:

On 22 Sep 2014 19:52:11 +0100 (BST), Theo Markettos
wrote:

In uk.comp.os.linux Java Jive wrote:

Yes, since my first post, I've had a bright light, my glasses, and a
hand-lens over the board, and, although I'm reasonably certain that it
IS a JTAG system, I can't see any connector that I can definitely
recognise as that for JTAG (6MB - to ensure preservation of original
detail):

http://www.macfh.co.uk/Temp/QNAP_NMP-1000_Board.png

There's a 14-pin unfitted SMD header just above the SoC and below the
battery (marked CN8) - 14 pins is something of a telltale for JTAG.
http://www.jtagtest.com/pinouts/

I'd buzz out the connector and see if it matches one of those.

This would certainly agree with the 14 pin layout on the link given:-
http://www.linux-mips.org/wiki/JTAG#JTAG_headers

pins 4 and 6 are connected together ( on the top layer for some
reason) so identifying them as ground may be a quick check
The pads are probably used with pogo pins in production.

One thing that worries me is that the pitch seems to be exactly 2mm,
right in between the two most common sizes available of 1.27mm
(1/20in) and 2.54mm (1/10in). Consequently, despite there being
hundreds of possible suppliers, I haven't found one which definitely
and unambiguously has what I need. Further many of the hits are for
supplying commercial quantities only.

I can also forsee problems with the soldering. I do have an Antec
with a small tip, but it struggles with modern lead-free solder, and
these days my hands are not so steady as they used to be. Still, as
the unit's otherwise dead anyway, I might as well give it a go.

There's the staggered line of four connector pairs, without pins
(bottom left in the photo). However, I suspect that is too few
connectors for JTAG ...

http://www.linux-mips.org/wiki/JTAG#JTAG_headers

Possible, but that looks like an RJ45. Phone? RS4xx? Ethernet?
Most of those seem unlikely - missing other necessary components.

The ethernet is on the back of the unit, part of a shrouded block also
containing 2 USB host sockets (top left of photo). See further
discussion below. If you can't suggest what that pad arrangement is,
I'd probably better not try too hard - the only thing that I can
think of is that it may be left over from an older version of the
board, perhaps something to do with an older style of front panel:
ISTR that earlier versions had a row of LEDs along the front edge of
the mainboard rather than as here an 8-segment display on a separate
board connected by the ribbon cable that you can see, and the
unidentified connector is behind where the front panel power switch
now is.

Would the photo above help settle between these two possibilities?

That indicates the flash is a Spansion NOR flash, to the bottom left, can't read the
number. That means the boundary scan technique is what you need to use.

The NAS uses an SMP8635 SoC from Sigma Designs. The odds are good that it
can be made to work with public information, but the question is whether
anyone has done so. 'SMP8635 jtag flash' comes up with quite a few google
hits. This bit mostly depends on the SoC and not the device it's inside
(since there will probably be only one way to wire up the flash chip).

The other question is: if your flash is broken, can you find a known-good image to
flash onto it. 'Factory restore' images don't necessarily contain partitions
in the right format. This image is the bit that is model-specific, so
an image from another SMP8635-based device might not work (but worth a try
in extremis).

I would imagine the various upgrade images available from QNAP would
be entire and complete, and would work, if I can just get the JTAG
hardware side of things together.

To do which (I'll summarise by quoting back at you to make sure that
I've understood it correctly):

1) I need to find and buy a suitable set of header pins and
solder them on to the board.

2a) Either: I need to buy a suitable USB JTAG active connection
lead with software

For example (quite expensive) ...
http://www.diygadget.com/tiao-usb-mu...2c-serial.html
.... or (cheap) ...
http://www.ebay.de/itm/SainSmart-USB...p2054897.l5658

Any thoughts on either of these?

2b) Or: Use the parallel port method

PS: did you know your NAS is actually native PATA and there's a PATA-to-SATA
bridge chip on the board?

No, but I'm not entirely surprised ...

According to the spec, it's supposed to be Gigabit Ethernet, but I've
never got it to connect at anything above Fast Ethernet. Looking at
the init scripts the other day, I thought that maybe I could see why,
but all this blew up before I could investigate restarting the network
at a faster speed to see if the hardware could actually support it.
Can anyone tell from the photograph whether the chips on the board are
capable of Gigabit? If so, this would definitely be something I'd
wish to pursue if and when I can get it working again.
--
================================================== =======
Please always reply to ng as the email in this post's
header does not exist. Or use a contact address at:
http://www.macfh.co.uk/JavaJive/JavaJive.html
http://www.macfh.co.uk/Macfarlane/Macfarlane.html

Java Jive wrote:

One thing that worries me is that the pitch seems to be exactly 2mm,
right in between the two most common sizes available of 1.27mm
(1/20in) and 2.54mm (1/10in).

They've been slowly going metric

I would imagine the various upgrade images available from QNAP would
be entire and complete, and would work, if I can just get the JTAG
hardware side of things together.

Not unusual for flash images to omit the very first stage bootloader,
because any failed update to that will result in a bricked device
(requiring JTAG repair rather than TFTP repair which may just be do-able
by the end-user)

I should've though to include this info before. The markings on the
block shrouding are ...

RU1 - 161A9WGF
0946Sa 1000BT

.... and the first thing I find ...

http://www.ude-corp.com/uploads/cust...0618025252.pdf

... suggests that the hardware is indeed Gigabit capable, but what I
can't work out is whether the actual rating implemented depends on
driver circuitry external to the unit, somewhere else on the board.

On Wed, 24 Sep 2014 04:28:38 +0100, Java Jive
wrote:

According to the spec, it's supposed to be Gigabit Ethernet
--
================================================== =======
Please always reply to ng as the email in this post's
header does not exist. Or use a contact address at:
http://www.macfh.co.uk/JavaJive/JavaJive.html
http://www.macfh.co.uk/Macfarlane/Macfarlane.html

I have to repost my replies, because Geo took out the cross-post, and
that most helpful man Theo probably won't see it in uk.tech.digital-tv
alone:

1) Thanks both ...

Before answering your points in detail, I'll just mention in answer to
others that I spent a good while trying to get both the TFTP and the
USB drive methods working last night, but to no avail. This confirms
my opinion that the bootloader itself is a gonner, so any such method
based on the assumption of it working is never going to succeed.

It seems to be JTAG or nothing ...

On Tue, 23 Sep 2014 11:57:53 +0100, Geo
wrote:

On 22 Sep 2014 19:52:11 +0100 (BST), Theo Markettos
wrote:

In uk.comp.os.linux Java Jive wrote:

Yes, since my first post, I've had a bright light, my glasses, and a
hand-lens over the board, and, although I'm reasonably certain that it
IS a JTAG system, I can't see any connector that I can definitely
recognise as that for JTAG (6MB - to ensure preservation of original
detail):

http://www.macfh.co.uk/Temp/QNAP_NMP-1000_Board.png

There's a 14-pin unfitted SMD header just above the SoC and below the
battery (marked CN8) - 14 pins is something of a telltale for JTAG.
http://www.jtagtest.com/pinouts/

I'd buzz out the connector and see if it matches one of those.

This would certainly agree with the 14 pin layout on the link given:-
http://www.linux-mips.org/wiki/JTAG#JTAG_headers

pins 4 and 6 are connected together ( on the top layer for some
reason) so identifying them as ground may be a quick check
The pads are probably used with pogo pins in production.

One thing that worries me is that the pitch seems to be exactly 2mm,
right in between the two most common sizes available of 1.27mm
(1/20in) and 2.54mm (1/10in). Consequently, despite there being
hundreds of possible suppliers, I haven't found one which definitely
and unambiguously has what I need. Further many of the hits are for
supplying commercial quantities only.

I can also forsee problems with the soldering. I do have an Antec
with a small tip, but it struggles with modern lead-free solder, and
these days my hands are not so steady as they used to be. Still, as
the unit's otherwise dead anyway, I might as well give it a go.

There's the staggered line of four connector pairs, without pins
(bottom left in the photo). However, I suspect that is too few
connectors for JTAG ...

http://www.linux-mips.org/wiki/JTAG#JTAG_headers

Possible, but that looks like an RJ45. Phone? RS4xx? Ethernet?
Most of those seem unlikely - missing other necessary components.

The ethernet is on the back of the unit, part of a shrouded block also
containing 2 USB host sockets (top left of photo). See further
discussion below. If you can't suggest what that pad arrangement is,
I'd probably better not try too hard - the only thing that I can
think of is that it may be left over from an older version of the
board, perhaps something to do with an older style of front panel:
ISTR that earlier versions had a row of LEDs along the front edge of
the mainboard rather than as here an 8-segment display on a separate
board connected by the ribbon cable that you can see, and the
unidentified connector is behind where the front panel power switch
now is.

Would the photo above help settle between these two possibilities?

That indicates the flash is a Spansion NOR flash, to the bottom left, can't read the
number. That means the boundary scan technique is what you need to use.

The NAS uses an SMP8635 SoC from Sigma Designs. The odds are good that it
can be made to work with public information, but the question is whether
anyone has done so. 'SMP8635 jtag flash' comes up with quite a few google
hits. This bit mostly depends on the SoC and not the device it's inside
(since there will probably be only one way to wire up the flash chip).

The other question is: if your flash is broken, can you find a known-good image to
flash onto it. 'Factory restore' images don't necessarily contain partitions
in the right format. This image is the bit that is model-specific, so
an image from another SMP8635-based device might not work (but worth a try
in extremis).

I would imagine the various upgrade images available from QNAP would
be entire and complete, and would work, if I can just get the JTAG
hardware side of things together.

To do which (I'll summarise by quoting back at you to make sure that
I've understood it correctly):

1) I need to find and buy a suitable set of header pins and
solder them on to the board.

2a) Either: I need to buy a suitable USB JTAG active connection
lead with software

For example (quite expensive) ...
http://www.diygadget.com/tiao-usb-mu...2c-serial.html
.... or (cheap) ...
http://www.ebay.de/itm/SainSmart-USB...p2054897.l5658

Any thoughts on either of these?

2b) Or: Use the parallel port method

PS: did you know your NAS is actually native PATA and there's a PATA-to-SATA
bridge chip on the board?

No, but I'm not entirely surprised ...

According to the spec, it's supposed to be Gigabit Ethernet, but I've
never got it to connect at anything above Fast Ethernet. Looking at
the init scripts the other day, I thought that maybe I could see why,
but all this blew up before I could investigate restarting the network
at a faster speed to see if the hardware could actually support it.
Can anyone tell from the photograph whether the chips on the board are
capable of Gigabit? If so, this would definitely be something I'd
wish to pursue if and when I can get it working again.

2) I should've thought to include this info before. The markings on
the ethernet/USB block shrouding are ...

RU1 - 161A9WGF
0946Sa 1000BT

.... and the first thing I find ...

http://www.ude-corp.com/uploads/cust...0618025252.pdf

.... suggests that the hardware is indeed Gigabit capable, but what I
can't work out is whether the actual rating implemented depends on
driver circuitry external to the unit, somewhere else on the board.
--
================================================== =======
Please always reply to ng as the email in this post's
header does not exist. Or use a contact address at:
http://www.macfh.co.uk/JavaJive/JavaJive.html
http://www.macfh.co.uk/Macfarlane/Macfarlane.html

In uk.comp.os.linux Java Jive wrote:
One thing that worries me is that the pitch seems to be exactly 2mm,
right in between the two most common sizes available of 1.27mm
(1/20in) and 2.54mm (1/10in). Consequently, despite there being
hundreds of possible suppliers, I haven't found one which definitely
and unambiguously has what I need. Further many of the hits are for
supplying commercial quantities only.

It's a fairly common item, such as:
http://uk.farnell.com/samtec/tmm-107...way/dp/1668542
(which is way expensive for what it is, but never mind)
You can buy these on strips and cut them down to length if you need.

I can also forsee problems with the soldering. I do have an Antec
with a small tip, but it struggles with modern lead-free solder, and
these days my hands are not so steady as they used to be. Still, as
the unit's otherwise dead anyway, I might as well give it a go.

Just use leaded solder. Tack two corners of the connector down to hold it
in place with a small amount of solder, then solder each of the pins.

The ethernet is on the back of the unit, part of a shrouded block also
containing 2 USB host sockets (top left of photo). See further
discussion below. If you can't suggest what that pad arrangement is,
I'd probably better not try too hard - the only thing that I can
think of is that it may be left over from an older version of the
board, perhaps something to do with an older style of front panel:
ISTR that earlier versions had a row of LEDs along the front edge of
the mainboard rather than as here an 8-segment display on a separate
board connected by the ribbon cable that you can see, and the
unidentified connector is behind where the front panel power switch
now is.

The 8-way 'RJ45' is probably a red herring, so best ignore it.

I would imagine the various upgrade images available from QNAP would
be entire and complete, and would work, if I can just get the JTAG
hardware side of things together.

If it does a 'dd' into the partitions you're OK, if it untars things then
maybe not.

To do which (I'll summarise by quoting back at you to make sure that
I've understood it correctly):

1) I need to find and buy a suitable set of header pins and
solder them on to the board.

2a) Either: I need to buy a suitable USB JTAG active connection
lead with software

Yes.

For example (quite expensive) ...
http://www.diygadget.com/tiao-usb-mu...2c-serial.html
... or (cheap) ...
http://www.ebay.de/itm/SainSmart-USB...p2054897.l5658

Any thoughts on either of these?

It looks like OpenOCD supports the Altera-clone cable, so if that's your
tool of choice it should be fine. Likewise it looks like OpenOCD supports
the FT2232 like in the first board.

2b) Or: Use the parallel port method

You'd need voltage conversion, so it isn't quite as simple as that.
You might do this with some resistors, but I reckon this is more hassle than
buying a USB adaptor (unless you're in a hurry and have all the bits).

The other things you need to find:
Will OpenOCD work with your SoC? Is there a boundary scan pin definition file
about?
Is there a script/code to flash the Spansion flash chip via the boundary
scan?
Can you assemble an image of what the flash should look like? This is a raw
reflash, so it knows nothing about partitions for instance.

Theo

Java Jive wrote:

For example (quite expensive) ...
http://www.diygadget.com/tiao-usb-mu...2c-serial.html

Looks like a handy card to have around, especially as I've mislaid my
USB to TTL level RS232 dongle, there is a cheaper "lite" version of the
TUMPA

http://vgshop.ecrater.co.uk/p/157748...otocol-adapter