JTAG Interfacing with the ST40 (STB71xx) boxes HOW TO (rev 2) THE “CLONE” HARDWARE ………………………………………………………………………….. page 2 Wiring the module …………………………………………………………………………………………. page 3 The “CLONE” schematic and port A to JTAG wiring …………………………………………………….. page 4 Converting the module into an STMC Clone (usb descriptors) ………………………… page 5 Software to use with the Clone interface ………………………………………………………. page 7 The STburner utility ………………………………………………………………………………………… page 8 FT2232H USB JTAG interface based on the same principles. (Thanks to Grantor) …….. page 10 Using a module (Thanks to Duxzero) ………………………………………………………………. page 12 ANNEX1 : the .ept file (usb descriptors) …………………………………………………………………….. page 16 FT4232H Mini Module or FT2232H Mini Module UM232H mini module 1 Revision 2 ‐ 10.04.2011 JTAG Interfacing with the ST40 (STB71xx) boxes – HOW TO This howto is dedicated to STb71xx SoC's JTAG interface (Hardware ‐ USB ). This is a resume of a thread published on : http://www.avi‐plus.com/repair‐tips‐forum/others/re‐st40‐stb71xx‐jtag‐interfacing‐234.html 1‐ THE “CLONE” HARDWARE 1.1 FTDI Modules The new low cost ST Micro Connect Lite interface (STMC Lite is an ST Microelectronics trade name) (still a ghost on the market) (see pdf in the last ST Micro Connection package 1.6.0) uses the FTDI FT4232H mini USB module. That module is rather cheap (about 50 USD) and easy to buy. This is the module from FTDI : The FT4232H is a USB to 4 ports module handling the basic jtag lines on ports A and B and virtual COM port on ports C and D. ST uses the standard drivers with that module. The FT4232H datasheet and module datasheet can be found here: http://www.ftdichip.com/Support/Documents/DataSheets/ICs/DS_FT4232H.pdf http://www.ftdichip.com/Support/Documents/DataSheets/Modules/DS_FT4232H_Mini_Module.pdf You can also use the 2 ports version, the FT2232H/L module, as the two FT4232H extra ports are not really necessary. http://www.ftdichip.com/Support/Documents/DataSheets/ICs/DS_FT2232H.pdf http://www.ftdichip.com/Support/Documents/DataSheets/Modules/DS_FT2232H_Mini_Module.pdf 2 Revision 2 ‐ 10.04.2011 1.2 Wiring the module First thing to do is to solder that module on a breadboard and connect the power lines as mentioned in the FTDI documentation. This module is sold fully assembled as shown on the picture above. Take care of using the correct module connectors pin numbering. That module can of course be USB powered and the internal voltage regulator delivers 3.3V for the external IC's. USB Bus-powered: 1) Connect VBUS to VCC (CN3, pin 1 to CN3, pin 3). This connection takes the power from the USB bus (VBUS) and connects it to the voltage regulator input on the FT4232H Mini Module. The voltage regulator, in turn, provides V3V3, VPLL and VUSB power inputs to the FT4232H chip. 2) Connect V3V3 to VIO (CN2, pins 1, 3 & 5 to CN2, pins 11 & 21 and CN3, pins 12 & 22). This connection provides the correct 3.3VDC operating voltage for VCCIO on the FT4232H chip. Once the module is correctly wired, it can be connected to a PC and normally it would install the drivers without any problem. There are two side plugs (2 X 26 pin) that allows the user to connect whatever he want depending upon the application. If you do not want to etch a PCB, you have to use a breadboard (copper around each hole) easy to find in an electronic shop. As you can see on the second picture, the only thing to do is to solder 2 female 26 pin connectors in order to plug in the module and one connector for your jtag connection. (Depends upon your STB configuration, 14 pin, 20 pin ...) (If you want you may even solder the 2X 26 pin plugs if it's too difficult to find the female connectors.) The rest of the job is to wire the connections between the module and the jtag connector. Not very difficult: there are 16 wires to solder on my 3 Revision 2 ‐ 10.04.2011 experimental board. (keep them short) It can be done even with a plumber soldering iron! Here is the final JTAG wiring for the ST40/STB71xx and the picture of that very simple interface. (A breadboard, 2 sockets, a JTAG connector and that’s it.) 1.3 The “CLONE” schematic and port A to JTAG wiring The JTAG signals shown here above have to be wired to a 20 pin JTAG connector as shown below. (20 pin connector on the left side of the picture) 4 Revision 2 ‐ 10.04.2011 Please note that the pull down and pull up shown are usually located on the box board. You should verify if these resistors are existing on your board. If not, add them on the jtag board. It’s also a good idea to add a LED with a 470R resistor in series between 5Vcc and GND to show that the board is active. Please note that PORT B can also be wired as port A but using a 14 pin JTAG connector (see STMC lite pdf in the Targetpack package or STLinux 2.4 package.) Port C and D can be used as RS232 virtual com ports via MAX3232 logic level interfaces. debugging via rs232 terminal). Here is a picture of the wiring side. (I’ve used a little 4 pins connectors (green and black‐gray wires) near the module to make experiments with the nRST and nTRST wiring, but this option is not necessary.) It’s a good idea to add a 10uF 10V tantalium capacitor between the USB 5V cc power pins on the interface side. (noise reduction) 5 Revision 2 ‐ 10.04.2011 2‐ Converting the module into an STMC Clone (usb descriptors) In order to convert that module into an ST Micro Connect Lite interface, you need to change the SUB descriptors in the module EEPROM. This allows the module to automatically load the ST driver and descriptors when the USB module is connected to a PC. This can be easily done by using the MPROG utility from FTDI. You can download that utility from the FTDI website : http://www.ftdichip.com/Support/Utilities/MProg3.5.zip To use that utility, you have first to connect the module to your PC and load the original FT drivers, especially the FTD2XX driver. [BTW FT recommends now to use FT_PROG to program the EEPROM – 16/02/2013] http://www.ftdichip.com/Support/Utilities/FT_Prog%20v2.6.8.zip Once the drivers are fully installed, you may launch the MPROG utility and change the descriptors and options (right side) as shown below. 6 Revision 2 ‐ 10.04.2011 You could personalize your Fixed Serial Number by changing the four digits serial number to whatever you want. The STMCLTxxxx name will be used to address the interface when using the STLinux package or the ToolSet. I’ve added the MPROG template in ANNEX 1 that can be used to change the options (click on File, load, and load the template.. Paste the template into a text file and save it with the .ept suffix. Once the template loaded, click on Device and Program to burn that template into the eeprom. Now, your module is an ST Micro Connect clone. Disconnect the module from your PC and install the ST drivers included in the ToolSet R 5.1.0 drivers directory (WIN version). You may automatically install the drivers if you select the driver install option when installing the Targetpack R 1.6.0. There is also a manual install in the drivers directory. (The Linux drivers are automatically installed with STLINUX 2.4 if you fully update the package after installation with stmyum. under Fedora 14 with STLinux 2.4, you simply connect the Clone module and it will be recognized as an ST Micro Connect Lite interface) Once the drivers are installed, connect your module and the drivers should automatically be installed. You may verify this using the Windows device manager under Windows : (Device manager under Win7 x64 – FT4232H module) 7 Revision 2 ‐ 10.04.2011 3‐ Software to use with the Clone interface The software installation will not be detailed here. Under Windows, you should install the last ST40 Toolset together with the last Targetpack manager. Take care of selecting the PATH update during the installation. Under Linux (it’s better to use Fedora 14 + updates for compatibility reasons), install STLinux 2.4 ( www.stlinux.com )and fully update the package with stmyum after installation, otherwise the new STMC Lite drivers will not be installed. 4‐ The STburner utility If you don’t use U‐BOOT (see STLinux), you may use the STBurner utility (download from the forum or PUDN) Decompress that utility in the TS examples directory and make the following modifications to the files mentioned hereafter: build.mkf Remove the + sign before = in build.mkf lines 23 and 24 (generates a macro error during compilation) targets.mkf in the mkf directory Modify the default target according to your needs in line 83 . flasher.c warning line 783 ‐ string too long ‐ OK need not be modified flashutil.c warning line 2162 Spanion not used ‐ OK need not be modified Added: poketable.h into the stburner directory (needed with mb442) memory_mb442xxxx.x files into the stburner directory (needed with mb442) These files can be found in the examples/os21/romxxxx examples. flasher.h added MW39W320DT device in the device list (see other similar flash descriptions in the same file) (flash in the Homecast HS5001 CI) flashutil.c added device ID 0x22ca and blockinfo for M29W320DT flash chip (see other similar flash descriptions in the same file) Recompile the utility : make clean 8 Revision 2 ‐ 10.04.2011 make This will generate the flasher.out file that will run on your target SoC. (Ignore the testapp.exe error) Connect your interface to your target and switch the target board ON. Run the following command to test your installation with no risk for your flash : sh4xrun –c sh4tp ‐t STMCLT1000A:mb411:st40 ‐e ./flasher.out ‐a ‐r romdump.bin The sh4xrun –a option is to be used when you need to add arguments to the executable. The –c sh4tp tells sh4xrun to use the targetpack manager. This will dump the flash rom content to a file named romdump.bin saved in the stburner directory. If you want to see the stburner options, just type the following command which will show you the burner usage options. sh4xrun –c sh4tp ‐t STMCLT1000A:mb411:st40 ‐e flasher.out Screen output : flasher: Usage: flasher [‐t <target board>] [‐p <binary or hex image>[@<binary_base_address>]] | [‐r <binary image>] | [[‐v <bootvector image> [‐v...]] [‐s <bootstrap image> [‐s...]] [‐fs <fail‐safe image>] [‐i <application image>[@<slot>] [‐i...]] [‐d <slot> [‐d ...]] [‐b <slot>] [‐bootsep]] [‐f <option file>] [‐e] <slot> must be in the range 0..63 ‐v <imgfile> : install image as a CPU boot vector ‐s <imgfile> : install image as a CPU boot strap ‐fs <imgfile>: install image as the fail‐safe image ‐i <imgfile> : install image as an application image ‐d <slot> : delete the image in slot ‐b <slot> : make the image in slot a boot image ‐bootsep : separate FLASH blocks containing boot code and application code so they can be protected ‐p <binfile> : program with raw binary image (or ST20‐style hex file if .hex extension) ‐r <binfile> : dump all FLASH to binary image ‐f <optfile> : read options from file ‐e : erase the FLASH ‐t <board> : override default target board (mb411stb7100) mb411 mb411stb7100 mb442 mb442stb7100 stb7100ref 9 Revision 2 ‐ 10.04.2011 Remark : To verify if your interface is OK, you could compile the “Hello World” simple example in the examples/bare/getstart directory: make clean make TARGET=mb411stb7100 Once compiled, run the test program with : sh4xrun -c sh4tp -t STMCLT1000A:mb411:st40 -e hello.out If everything is OK, you should see “Hello World” on your screen. That means that the test program has been successfully executed from the target RAM. This is a ‘harmless for your flash’ test, as it uses only the target RAM. You are now ready to go further with your experiments …. ####### 10 Revision 2 ‐ 10.04.2011 5‐ FT2232H USB JTAG interface based on the same principles. (Thanks to Grantor) I hope to do something pleasant for the implementation of the interface support FT4232H. 11 Revision 2 ‐ 10.04.2011 UM232H USB JTAG interface based on the same principles. (Thanks to Grantor) And this is the wiring for the new, cheap single channel UM232H mini‐module: 12 Revision 2 ‐ 10.04.2011 6‐ Examples : Using a module (Thanks to Duxzero) Duxzero has decided to directly wire the connections to the module using mini connectors. Direct wiring A couple of Macbook Pro's Wiring on the STB side. This is my success story unbricking an IPBox 910HD (CubeRevo mini2 board). This has the STi7109 cut30 CPU. Thanks a lot to YLG80 for making this possible in the first place, without his great work on all this I would still have an IPBox brick laying around! Tools used: FT4232H micro module A couple of Macbook Pro's UC232 ‐ USB ‐> serial interface from ATEN (guess the serial ports on the FT4232 coule be used too) RS232 nullmodem cable Several wires with single DIL connectors Bricked IPBox 910HD Fedora 14 (fully updated) STLinux 2.4 (fully updated) 13 Revision 2 ‐ 10.04.2011 To make the FT4232H module into a ST Micro Connect Lite clone and wire it all up, read the great guide here from YLG80. (updates are available in the forum) Now, when everything is wired up and loaded, first off you need a U‐Boot ELF file. Either grab some of the precompiled ones from the STLinux 2.3 distro (the 2.4 distro do not have them yet), or compile your own U‐ Boot files. My receiver did not give out any output from the serial port when I tried the precompiled ones, so I had to compile my own from the U‐Boot sources included with the STLinux 2.4 distro. Follow these procedures to avoid files not found errors etc, in terminal: Code: su export PATH=/opt/STM/STLinux-2.4/devkit/sh4/bin:$PATH cd /opt/STM/STLinux-2.4/devkit/sources/u-boot/u-boot-sh4 make distclean make mb442_27_config make Where mb442_27_config have to match whatever config suits your board best. Look inside the Makefile (scroll down almost at the bottom) to see all SH4 supported boards. I had to do some modifications to the mb442 header file too. The header is found in /opt/STM/STLinux‐2.4/devkit/sources/u‐boot/u‐boot‐sh4/include/configs/mb442.h The modifications I had to make to have it working with my board was to make it use UART3 instead of UART2. By default it sends console output to the first serial port, on my board that port is used by the front processor (I believe) and the second port UART3 (/dev/ttyAS1) is the RS232 serial port on the backside of the STB. The other changes I made was changing CFG_SDRAM_SIZE to 0x080000000 (it was 0x040000000) and CFG_MAX_FLASH_SECT to 256 (was 128 I think). I know these changes can actually be added to the Makefile too adding them as parameters to the board config, but I did it the quick way and edited the mb442.h. If the compilation completed successfully you should now have 4 new files in your directory. uboot uboot.bin uboot.map and uboot.srec. The file we want here is uboot, which is the ELF file. To keep things nice and tidy move these files to the ...target/u‐boot folder. 14 Revision 2 ‐ 10.04.2011 Code: mv u-boot* /opt/STM/STLinux-2.4/devkit/sh4/target/boot/u-boot/ open a new tab in your terminal (keeping things tidy, remember?) and: Code: export PATH=/opt/STM/STLinux-2.4/devkit/sh4/bin:$PATH Make sure everything is connected as it should be and turn the STB on, then: Code: st40load_gdb -t STMCLT1000_A:mb442:st40 -b /opt/STM/STLinux2.4/devkit/sh4/target/boot/u-boot/u-boot Now you should see some interesting things happening, U‐Boot should be loaded into your receiver memory, now just type c to continue and watch the serial console output (you have hopefully hooked up the STB to a serial port running a terminal emulator already). The generic (and stripped I may say) U‐Boot that I compiled did not have the network drivers compiled into it that my STB has (RTL8201) so I had to use ymodem to upload a uboot.bin to memory and write that to flash (I made that uboot.bin out from the uboot.img file for my receiver, just remember to remove the header information first, that is how I bricked mine in the first place!) In U‐Boot console: Code: loady (default it loads to 0x84000000, start ymodem upload with your uboot.bin from the terminal emulator) protect off 1:0-2 erase all cp.b 0x84000000 0xA0000000 0x41000 protect on 1:0-2 reset 15 Revision 2 ‐ 10.04.2011 That is pretty much how I unbricked my STB anyway... took a lot of trial and error to get it all right but hey.. nobody is born with JTAG information already present in the brain right? ########## ANNEX 1 : The .ept template for MPROG. (Paste it into a text file saved with the .ept suffix) (You can change the Fixed Serial Number to what ever you want, providing that you use your customized Serial number as a target name) [START COPY‐PASTE FROM THE LINE BELOW] [Basic Details] Device Type=10 VID PID Type=2 USB VID=0483 USB PID=3747 [USB Power Options] Bus Powered=1 Self Powered=0 Max Bus Power=200 [USB Serial Number Control] Prefix=FT Use Fixed Serial Number=1 Fixed Serial Number=STMCLT1000 [USB Remote WakeUp] Enable Remote WakeUp=1 [Windows Plug and Play] Enable Plug and Play=0 16 Revision 2 ‐ 10.04.2011 [USB String Descriptors] Manufacturer=ST Product=ST Micro Connect Lite [Programming Options] Only Program Blank Devices=0 [BM Device Specific Options] USB Version Number=0 Disable Serial Number=0 IO Pin Pull Down in Suspend=0 [Dual Device Specific Options A] RS 232 mode=1 245 FIFO mode=0 245 CPU FIFO mode=0 OPTO Isolate mode=0 High Current Drive=0 [Dual Device Specific Options B] RS 232 mode=1 245 FIFO mode=0 245 CPU FIFO mode=0 OPTO Isolate mode=0 High Current Drive=0 [Dual Device Driver Options A] Virtual Com Port Driver=1 D2XX Driver=0 [Dual Device Driver Options B] Virtual Com Port Driver=1 D2XX Driver=0 [R Device Specific Options] Invert TXD=0 Invert RXD=0 Invert RTS#=0 Invert CTS#=0 Invert DTR#=0 Invert DSR#=0 Invert DCD#=0 Invert RI#=0 C0 Signal=‐1 C1 Signal=‐1 C2 Signal=‐1 C3 Signal=‐1 C4 Signal=‐1 Enable Ext Osc=0 High Current I/O=0 Load D2XX Driver=0 In EndPoint Size=0 [DualHS Device Specific Options] IFAIsFifo7=0 IFAIsFifoTar7=0 IFAIsFastSer7=0 AIsVCP7=1 IFBIsFifo7=0 IFBIsFifoTar7=0 17 Revision 2 ‐ 10.04.2011 IFBIsFastSer7=0 BIsVCP7=1 IOPinDriveDual=0 UTMIDrive=0 UTMIVendor=0 SuspendOnD7Low=0 [QuadHS Device Specific Options] AIsVCP8=0 BIsVCP8=0 CIsVCP8=1 DIsVCP8=1 ARIisTXDEN=0 BRIisTXDEN=0 CRIisTXDEN=0 DRIisTXDEN=0 IOPinDriveQuad=13107 [END OF COPY‐PASTE SECTION] 18 Revision 2 ‐ 10.04.2011