Trying to locate the JTAG signals on the IB-NAS4210 mainboard

HWguru

NAS2000-Team

Posts: 1,039

Location: Wien

1

Thursday, March 4th 2021, 8:32pm

Hi,
as I know from emails some users are trying to find the JTAG signal locations on the PCB.
I will try to help you and give you some advice.

Source code

JTAG signal positions on the SL3512 CPU:

--- verified -----------------------------
DBGRQ	T1 --> R157 --> GND
DBGACK	R5 --> R148 (not equipped)

TRST#	U1 --> R152 --> VCC (not needed)

--- 99% verified -------------------------
  TCK	T3 --> R149 --> VCC
  TMS	T4 --> R150 --> VCC
  TDI	T5 --> R151 --> VCC
  TDO	T2 --> ??? --> VCC

Could you measure if R149, R152 and R157 are connected to GND or VCC.
Maybe someone can try to pulse DBGRQ with a resistor in the range of 100 to 330 Ohm to 3.3V and check if DBGACK changes from L (0V) to H (3.3V).
--------------------
Updates:
verified TRST --> R152
verified DBGRQ --> R157
verified DBGACK --> R148 when R80, R81, R82 equipped
verified 99% TCK, TMS, TDI - TDO still unknown

HWguru

Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

Go to the top of the page

dalo

Beginner

Posts: 2

2

Friday, March 5th 2021, 9:26pm

Hi,

When I have LAN connector on bottom, so labels are oriented correctly then:

Top side of board:
R154, R153, R155, R156 -> to GND (GND is on left side)
R149, R148, R150, R151 -> to VCC (Vcc is on right side)

Bottom side of board:
R152 -> To VCC (Vcc is on right side)

I connected 200ohm resistor to DBGRQ pin thru switch to VCC, and try to pulse on this pin, but I counld not find DBGACK pin. No level change on any of those resistors.

Go to the top of the page

HWguru

NAS2000-Team

Posts: 1,039

Location: Wien

3

Friday, March 5th 2021, 10:22pm

That's a pity.
I tried to find the via locations on the bottom of the CPU.
Maybe I was one pin offset X and Y.
I will try to find new resistor locations...

Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

Go to the top of the page

dalo

Beginner

Posts: 2

4

Sunday, March 7th 2021, 8:54am

Source code

Testing cabletype 3
JTAG-IDCODE: 0x00000000 - not OK
 Expected: 0x00526fa1
Bypass-test: 0x00000000 - not OK
 Expected: 0xaaab5554


Testing cabletype 4
JTAG-IDCODE: 0xffffffff - not OK
 Expected: 0x00526fa1
Bypass-test: 0xffffffff - not OK
 Expected: 0xaaab5554


Error:
 - No cable detected
 - Testdevice not connected


Some errors detected!

When I power ON the NAS:

Source code

Testing cabletype 3
JTAG-IDCODE: 0xffffffff - not OK
 Expected: 0x00526fa1
Bypass-test: 0xffffffff - not OK
 Expected: 0xaaab5554


Testing cabletype 4
JTAG-IDCODE: 0xffffffff - not OK
 Expected: 0x00526fa1
Bypass-test: 0xffffffff - not OK
 Expected: 0xaaab5554


Error:
 - No cable detected
 - Testdevice not connected


Some errors detected!

Go to the top of the page

HWguru

NAS2000-Team

Posts: 1,039

Location: Wien

5

Sunday, March 7th 2021, 11:08am

Ok, what I can see:
You are using a cable Type 3 - we know that

	Source code
1	JTAG-IDCODE: 0x00000000 - not OK

means that we always receive a 0 during each clock from the hardware which is normal becase the hardware is not powered.
After power on we receive 1s and there is not any change to 0 --> 0xffffffff

I think the best is to keep the TDO/R149 - RI connection as it is and then swap the the other signals and try all possible connections.

Good luck!

Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

Go to the top of the page

HWguru

NAS2000-Team

Posts: 1,039

Location: Wien

6

Wednesday, March 10th 2021, 12:44am

Mybe the CPU is not in the correct mode for debug.
Can you tell me if the Resistors R84, 85, 86, 87 are connected to GND or VCC?

This is a block of 2x4 resistors R84-84 and 80-83.

Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

Go to the top of the page

Blindfisch

Beginner

Posts: 3

7

Wednesday, March 10th 2021, 7:15pm

R84, 85, 86 and 87 (all 1 kOhm) are connected to ground. R80, 81, 82 and 83 ( all unequipped) are connected to VCC.

I can confirm that T1 is connected to R157. Pulling this input to VCC doesn't change the voltage on any other resistor. Maybe DBGACK needs a pullup (or pulldown) resistor which is not equipped? Is it worth the effort to check all naked resistor pads with a pullup and a pulldown resistor?

Go to the top of the page

HWguru

NAS2000-Team

Posts: 1,039

Location: Wien

8

Wednesday, March 10th 2021, 7:49pm

Hi,
I think we have to move R84, R85, R86 (=GND) to R80, R81, R82 (=VCC)
or we could keep them and only short the Pads of R80-82. We only waste 10mA current if we pull these resistors to 3.3V.

This I hope puts the CPU into "ICE Mode ARM"
DBGACK is an output and should not need a pullup.

Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

Go to the top of the page

Blindfisch

Beginner

Posts: 3

9

Wednesday, March 10th 2021, 8:43pm

I thought of an open drain output...
With shortening the pads for R80, R81 and R82 (omit R83?) it's easier to establish the original state and I don't care about the 10 mA. What would be the next step then? Searching for DBGACK again or experimenting with R149 to R151?
Thanks for your support!

Go to the top of the page

HWguru

NAS2000-Team

Posts: 1,039

Location: Wien

10

Wednesday, March 10th 2021, 8:53pm

Yes, first check is DBGRQ/DBGACK.

I had a very intense look at the traces and vias of the PCB but cannot see where TCK / Pin T3 is connected.
Maybe you have a thin enamelled copper wire to push it below the BGA and measure pin T3.

Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

Go to the top of the page

Blindfisch

Beginner

Posts: 3

11

Thursday, March 11th 2021, 9:13pm

I shortened the pads for R80, R81 and R82 but still can't find the DBGACK signal.
Accessing the T3 pin with a thin wire doesn't work. Next week I'll have access to a special station where I could desolder the processor. Then we should be able to follow the traces and vias. I'll probably not be able to solder the processor back to the board, but this will hopefully help others saving their device.

Go to the top of the page

HWguru

NAS2000-Team

Posts: 1,039

Location: Wien

12

Friday, March 12th 2021, 12:16am

Hi, another thing we should try:
It could be necessary to move R153 to R148 (no short allowed here)
Or maybe it is R81 to R83 - so short the pads for R83 instead of R80.

Before removing the processor we should try connecting the JTAG signals. Validating the JTAG chain and reading the chip ID is possible without DBGRQ / ACK.
Or maybe dalo has some success. We have to be a little patient.

Removing the chip is the very last option. I think I have the skill and equipment to put the chip back on the PCB.

Here you see a graphics that shows a possible BGA layout [attach]295[/attach]

It's like the 4210's layout where there are no vias for the outer 2 rows and colums of solder balls.

Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

Go to the top of the page

fratzicu

Beginner

Posts: 23

Location: Romania

13

Sunday, March 14th 2021, 12:50pm

Hi, what jtag software do you use when yoj identify the pinout?

You could find some answers on the page opengemini.free.fr.

http://opengemini.free.fr/wiki/doku.php?id=cortina

Raidsonic IcyBox IB-4210-B
Lacie Internet Space v1 500 Gb designed by Neil Poulton
Huawei EchoLife HG655b

This post has been edited 1 times, last edit by "fratzicu" (Mar 14th 2021, 12:56pm)

Go to the top of the page

HWguru

NAS2000-Team

Posts: 1,039

Location: Wien

14

Sunday, March 14th 2021, 2:49pm

Hi fratzicu!
Thank you for the Link to opengemini.

For trying to find the JTAG pins we use our NAS_FlashTool.
I never tried openocd but it would be interesting if someone does and tells us his experiences.

HWguru

Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

Go to the top of the page

HWguru

NAS2000-Team

Posts: 1,039

Location: Wien

15

Tuesday, March 23rd 2021, 10:47pm

updated first post with the latest findings - TDO still unknown

Edit: TDO is unknown, not TDI

Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

Go to the top of the page

NAS Forum