mercredi 10 septembre 2025, 00:55 UTC+2

Vous n’êtes pas connecté.

  • Connexion
  • S’inscrire

Trying to locate the JTAG signals on the IB-NAS4210 mainboard

HWguru

NAS2000-Team

Messages: 1 039

Localisation: Wien

1

jeudi 4 mars 2021, 20:32

Trying to locate the JTAG signals on the IB-NAS4210 mainboard

Hi,
as I know from emails some users are trying to find the JTAG signal locations on the PCB.
I will try to help you and give you some advice.

Code source

 
1
2
3
4
5
6
7
8
9
10
11
12
13

JTAG signal positions on the SL3512 CPU:

--- verified -----------------------------
DBGRQ	T1 --> R157 --> GND
DBGACK	R5 --> R148 (not equipped)

TRST#	U1 --> R152 --> VCC (not needed)

--- 99% verified -------------------------
  TCK	T3 --> R149 --> VCC
  TMS	T4 --> R150 --> VCC
  TDI	T5 --> R151 --> VCC
  TDO	T2 --> ??? --> VCC

Could you measure if R149, R152 and R157 are connected to GND or VCC.
Maybe someone can try to pulse DBGRQ with a resistor in the range of 100 to 330 Ohm to 3.3V and check if DBGACK changes from L (0V) to H (3.3V).
--------------------
Updates:
verified TRST --> R152
verified DBGRQ --> R157
verified DBGACK --> R148 when R80, R81, R82 equipped
verified 99% TCK, TMS, TDI - TDO still unknown

HWguru
Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

dalo

Débutant

Messages: 2

2

vendredi 5 mars 2021, 21:26

Hi,

When I have LAN connector on bottom, so labels are oriented correctly then:

Top side of board:
R154, R153, R155, R156 -> to GND (GND is on left side)
R149, R148, R150, R151 -> to VCC (Vcc is on right side)

Bottom side of board:
R152 -> To VCC (Vcc is on right side)


I connected 200ohm resistor to DBGRQ pin thru switch to VCC, and try to pulse on this pin, but I counld not find DBGACK pin. No level change on any of those resistors.

HWguru

NAS2000-Team

Messages: 1 039

Localisation: Wien

3

vendredi 5 mars 2021, 22:22

That's a pity.
I tried to find the via locations on the bottom of the CPU.
Maybe I was one pin offset X and Y.
I will try to find new resistor locations...
Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

dalo

Débutant

Messages: 2

4

dimanche 7 mars 2021, 08:54

I connected jtag adapter like this:

JTAG PIN ~ Signal | NAS resistor
RI ~ TDO | R149
DCD ~ TCK | R148
RSD ~ TMS | R150
DTR ~ TDI | R151
GND ~ GND | GND


SW output of JTAG test:
Before I power ON the NAS:

Code source

 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

Testing cabletype 3
JTAG-IDCODE: 0x00000000 - not OK
 Expected: 0x00526fa1
Bypass-test: 0x00000000 - not OK
 Expected: 0xaaab5554


Testing cabletype 4
JTAG-IDCODE: 0xffffffff - not OK
 Expected: 0x00526fa1
Bypass-test: 0xffffffff - not OK
 Expected: 0xaaab5554


Error:
 - No cable detected
 - Testdevice not connected


Some errors detected!





When I power ON the NAS:

Code source

 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

Testing cabletype 3
JTAG-IDCODE: 0xffffffff - not OK
 Expected: 0x00526fa1
Bypass-test: 0xffffffff - not OK
 Expected: 0xaaab5554


Testing cabletype 4
JTAG-IDCODE: 0xffffffff - not OK
 Expected: 0x00526fa1
Bypass-test: 0xffffffff - not OK
 Expected: 0xaaab5554


Error:
 - No cable detected
 - Testdevice not connected


Some errors detected!

HWguru

NAS2000-Team

Messages: 1 039

Localisation: Wien

5

dimanche 7 mars 2021, 11:08

Ok, what I can see:
You are using a cable Type 3 - we know that

Code source

 
1

JTAG-IDCODE: 0x00000000 - not OK

means that we always receive a 0 during each clock from the hardware which is normal becase the hardware is not powered.
After power on we receive 1s and there is not any change to 0 --> 0xffffffff

I think the best is to keep the TDO/R149 - RI connection as it is and then swap the the other signals and try all possible connections.

Good luck!
Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

HWguru

NAS2000-Team

Messages: 1 039

Localisation: Wien

6

mercredi 10 mars 2021, 00:44

Mybe the CPU is not in the correct mode for debug.
Can you tell me if the Resistors R84, 85, 86, 87 are connected to GND or VCC?

This is a block of 2x4 resistors R84-84 and 80-83.
Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

Blindfisch

Débutant

Messages: 3

7

mercredi 10 mars 2021, 19:15

R84, 85, 86 and 87 (all 1 kOhm) are connected to ground. R80, 81, 82 and 83 ( all unequipped) are connected to VCC.

I can confirm that T1 is connected to R157. Pulling this input to VCC doesn't change the voltage on any other resistor. Maybe DBGACK needs a pullup (or pulldown) resistor which is not equipped? Is it worth the effort to check all naked resistor pads with a pullup and a pulldown resistor?

HWguru

NAS2000-Team

Messages: 1 039

Localisation: Wien

8

mercredi 10 mars 2021, 19:49

Hi,
I think we have to move R84, R85, R86 (=GND) to R80, R81, R82 (=VCC)
or we could keep them and only short the Pads of R80-82. We only waste 10mA current if we pull these resistors to 3.3V.

This I hope puts the CPU into "ICE Mode ARM"
DBGACK is an output and should not need a pullup.
Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

Blindfisch

Débutant

Messages: 3

9

mercredi 10 mars 2021, 20:43

I thought of an open drain output...
With shortening the pads for R80, R81 and R82 (omit R83?) it's easier to establish the original state and I don't care about the 10 mA. What would be the next step then? Searching for DBGACK again or experimenting with R149 to R151?
Thanks for your support!

HWguru

NAS2000-Team

Messages: 1 039

Localisation: Wien

10

mercredi 10 mars 2021, 20:53

Yes, first check is DBGRQ/DBGACK.

I had a very intense look at the traces and vias of the PCB but cannot see where TCK / Pin T3 is connected.
Maybe you have a thin enamelled copper wire to push it below the BGA and measure pin T3.
Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

Blindfisch

Débutant

Messages: 3

11

jeudi 11 mars 2021, 21:13

I shortened the pads for R80, R81 and R82 but still can't find the DBGACK signal.
Accessing the T3 pin with a thin wire doesn't work. Next week I'll have access to a special station where I could desolder the processor. Then we should be able to follow the traces and vias. I'll probably not be able to solder the processor back to the board, but this will hopefully help others saving their device.

HWguru

NAS2000-Team

Messages: 1 039

Localisation: Wien

12

vendredi 12 mars 2021, 00:16

Hi, another thing we should try:
It could be necessary to move R153 to R148 (no short allowed here)
Or maybe it is R81 to R83 - so short the pads for R83 instead of R80.

Before removing the processor we should try connecting the JTAG signals. Validating the JTAG chain and reading the chip ID is possible without DBGRQ / ACK.
Or maybe dalo has some success. We have to be a little patient.

Removing the chip is the very last option. I think I have the skill and equipment to put the chip back on the PCB.

Here you see a graphics that shows a possible BGA layout [attach]295[/attach]

It's like the 4210's layout where there are no vias for the outer 2 rows and colums of solder balls.
Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

fratzicu

Débutant

Messages: 23

Localisation: Romania

13

dimanche 14 mars 2021, 12:50

Hi, what jtag software do you use when yoj identify the pinout?

You could find some answers on the page opengemini.free.fr.

http://opengemini.free.fr/wiki/doku.php?id=cortina
Raidsonic IcyBox IB-4210-B
Lacie Internet Space v1 500 Gb designed by Neil Poulton
Huawei EchoLife HG655b

Ce message a été modifié 1 fois. Dernière modification effectuée par "fratzicu" (14 mars 2021, 12:56)

HWguru

NAS2000-Team

Messages: 1 039

Localisation: Wien

14

dimanche 14 mars 2021, 14:49

Hi fratzicu!
Thank you for the Link to opengemini.

For trying to find the JTAG pins we use our NAS_FlashTool.
I never tried openocd but it would be interesting if someone does and tells us his experiences.

HWguru
Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

HWguru

NAS2000-Team

Messages: 1 039

Localisation: Wien

15

mardi 23 mars 2021, 22:47

updated first post with the latest findings - TDO still unknown

Edit: TDO is unknown, not TDI
Leute ohne Laster haben oft wenige Tugenden...
NAS2000 2.3.2.IB.2.RS.1+Lüfterabschaltung+SSH+do_it+zusätzliche commandline tools+changed root password
1. suchen - lesen - Google - lesen - 1. Fragen gehören ins Forum, dann profitieren alle davon!

Discussions similaires