UrJtag + PXA255 - Page 1
Forum section: electronics / general

author: orion242
author_rank: Unknown
timestamp: February 09, 2014, 04:50:25 pm
content: So I have a device that bricked during a firmware upgrade that I would like to try and restore. I have working units, so I hope to suck out the memory of a working unit and transplant it. If nothing else I should make for a good learning exercise, never played with JTAG before.So this device running WinCE .net 4.2 on a PXA255 processor. The firmware was held on a 28F640K3 flash chip. After spending the day tracing things out, I have the JTAG pinout figured out on an 8 pin SIP header. The PXA255 and a Lattice 125LF256 PLD appear to be the only devices on the JTAG chain.So I have the bus pirate v3 & v4. I know they are not ideal JTAG interfaces. So I looking for suggestions for software and hardware adapters to try and revive this device. This is for a home lab so I’m looking to stay within $100-$200 budget and open source software.

author: nctnico
author_rank: Super Contributor
timestamp: February 09, 2014, 05:08:20 pm
content: Look at openOCD. It even supports a parallel port JTAG dongle.

author: orion242
author_rank: Unknown
timestamp: February 09, 2014, 05:50:37 pm
content: I have my eye on that and UrJTAG.From the looks of it they should do the trick. Do you know how the WinCE key is dealt with? I assume I will need to stick the correct key back in the image before I stuff it back in the nonworking unit, or is there no check of this license in WinCE?I have a PC with parallel port, but USB would be preferred and there seems to be tons of USB adapters.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: February 09, 2014, 07:41:06 pm
content: Never seen a hw-locked WinCE at all.

author: orion242
author_rank: Unknown
timestamp: February 09, 2014, 08:42:18 pm
content: So its just the honor system, good enough.I got the bus blaster v4 coming, guess I give that a try.Thanks!

author: matkar
author_rank: Regular Contributor
timestamp: February 09, 2014, 09:40:51 pm
content: What did you do to brick the device? Were you updating bootloader or WinCE?If you were updating WinCE you have probably used the bootloader, which should be still fine.If you were messing with bootloader, try to figure out which bootloader is installed. Connect to a working device via debug serial port and see what it outputs. Some hardware has double flash, one for bootloader and the other for image. In this case there should be some kind of selection switch to make it boot to bootloader...

author: orion242
author_rank: Unknown
timestamp: February 09, 2014, 10:59:02 pm
content: The device has a SD card slot for upgrades. Pretty sure it was a full update, including the bootloader. Normally you format the card, pull power, insert the card and power it up. Once the lights come back on, its good to go. Well this unit will not do anything, Ethernet port is not firing up, none of the normal indicator lights are coming on, nothing on the serial port, just the power lights.There is a MAX793S uC monitor on the board. Just for giggles I tied into the watchdog input pin with a scope. On power up, nothing is sent and within 2sec WDO drops and holds the unit in reset. So I’m pretty sure no code is running.

author: orion242
author_rank: Unknown
timestamp: February 17, 2014, 01:34:40 am
content: So I got my bus blaster and after messing around for a few I got it talking to everything using UrJtag. Dumped the flash on the dead unit and a working unit, easy enough.So I proceeded to try and erase the flash in the dead unit and I get an error "low vpen" when issuing the eraseflash command. I assume the voltage on the vpen pin on the flash must be low. Anyone know if there is a command I'm missing to enable this in urjtag?I assume this must be tied to the PXA255 since it would have to be part of writing to the flash during normal flashing. The thought of pulling the flash off to figure out where its connected for a "manual override" is not sounding all that hot to me.Any help would be appreciated.

author: C
author_rank: Super Contributor
timestamp: February 17, 2014, 10:34:29 am
content: Boundary scan?http://en.wikipedia.org/wiki/JTAG_boundary_scanC

author: orion242
author_rank: Unknown
timestamp: February 17, 2014, 01:24:07 pm
content: Without a schematic, how can I prevent toasting a pin when I make it an output and something external is already asserting that pin the opposite way?

author: orion242
author_rank: Unknown
timestamp: February 19, 2014, 04:52:13 am
content: The lack of response tells me its lift the BGA flash or risk destruction. It's a small chip and I would like to have the gear to home brew this kind of rework anyhow.Guess that is the path...

author: abyrvalg
author_rank: Frequent Contributor
timestamp: February 20, 2014, 05:32:48 pm
content: You can find that pin by disassembling bootloader and looking for GPIO registers references.O try the other way - executing the bootloader in RAM via JTAG and using it's builtin update functionality (if any present).