Archives

Altera USB-Blaster plug pinout (update)

The Altera USB-Blaster is an efficient USB JTAG programmer. Clones sell for US$10 or less.

The programmer comes with a comprehensive manual with a pinout diagram for the JTAG device side. [1]

That diagram unfortunately shows no orientation. There should be a polarisation lug to the 10-pin female plug in figure 2-3, but it isn’t shown.  The lug is critical to making the right connections.

Every time we want to use this programmer, it takes ages to re-discover the pinout!

Obviously we are not alone because here, voilà, is an idiot-proof pinout diagram for the USB-Blaster.

The diagram comes courtesy of Gerry O’Brien at Digital-Circuitry.com. [2]

Thanks Gerry!

Click to enlarge: USB Blaster pinout (courtesy of Gerry from digital-circuitry.com)

UPDATE:

On the forum of edaboard.com, Ozzie poster cube007 provides a schematic for the Altera USB-Blaster JTAG programmer. [3] The diagram was found in the Rev. 1c12 schematics for the Altera Nios-II Demo Board.  You need to register with edaboard.com to download attachments but a local copy is at [4].

USB-Blaster revision 1c12 board schematic. Click to enlarge. Full PDF at (4)

[1] http://www.altera.com/literature/ug/ug_usb_blstr.pdf
[2] http://www.alteraforum.com/forum/showthread.php?t=28850
[3] http://www.edaboard.com/thread35648.html
[4] http://hackingbtbusinesshub.files.wordpress.com/2012/01/nios2_evaluation_1c12_board_schematic_131.pdf

Discovering JTAG registers

Michael Pudeev has authored an excellent article on JTAG programming. [1]

Michael documents his use of UrJTAG, an open source JTAG tool, to program the flash memory of a MIPS-based Broadcom device.

The CPU used in the BT BusinessHub has a 2Wire-branded Trimedia VLIW core. It is closely related to the Philips PNX15xx family of processors.

Michael’s commentary is in Russian, but his screenshots are almost self-explanatory by themselves..

It’s interesting to see how Michael adds Device Identification Register entries to urjtag for an unknown part discovered in the JTAG chain.

[1] http://pudeev.livejournal.com/33915.html#cutid1

Discovering JTAG pinout for the 2Wire 2700HG (update)

UPDATE:

We now have the pinout for the card edge connector used in 2Wire routers.  The pinout is the same for all routers. See [2]

The information below is retained for interest only.


The following is lifted from the openwrt.org forum. It was posted back in 2009 by tjm08 (Troy J. Mueller).

tjm08 writes:

I have a 2Wire 2700HG-D which has an Atheros-based [802.11] chipset, 128Mbit flash, 64 MByte RAM, and a TriMedia VLIW processor.

There are two headers for an edge connector, J-1 (14 pins) and J-2 (2 pins). I am trying to figure how to access the flash for JTAG.

The stock firmware does not support tftp, and the firmware is corrupted due to some experimentation.

I believe that I can fabricate a parallel interface cable, using all 8 of the data pins, and three of the ground pins.

2 of the 14 pins at J-1 are not connected, three are ground, and the remaining nine (2 @ 0.0v 7 @ 3.3v) are unidentified.

One pin (#10) bridges to pin 1 of J-2, and J-2 is documented as starting a diagnostic “Functional Test Mode”.

Pins 6 and 8 appear to cause a reset (post light blink pattern) when connected to ground.

J-1 Header
Note: Even pins are on the top of the board, odd pins underneath

01 – 3.3v
02 – GND (connects to 04 via trace; continuity to GND)
03 – 0.0v
04 – GND (connects to 02 via trace; continuity to GND
Key
05 – 3.3v
06 – 3.3v (nSRST?; causes sys reset LED pattern when pulled to GND)
07 – 3.3v
08 – 3.3v (nSRST?; causes sys reset LED pattern when pulled to GND)
09 – 3.3v
10 – 3.3V (FTM) (Functional Test Mode;connects to pin 1 of J-1 hdr as documented)
11 – N.C.
12 – 0.0v
13 – N.C.
14 – GND (continuity to GND)

J-2 Header
01 – 3.3V (FTM)
02 – GND (Documented for “Functional Test Mode”)

To find:
nSRST (optional JTAG, consistent with observed behavior)
nTRST (optional JTAG, possible; used for logic reset of JTAG chain)
TCK (essential JTAG; Test clock signal)
RTCK (optional JTAG, possible; used for adaptive clocking and higher data transfer)
TDI (essential JTAG; Test Data Input)
TDO (essential JTAG; Test Data Output)

I believe that nTRST may be either pin #3 or pin #12, based on the procedure used by Smiggy and Revs Per Minute.

tjm then quotes from Revs-Per-Min, who documents his test method as follows on

http://forums.whirlpool.net.au/forum-replies.cfm?t=808533&p=9&#r176

The method I used [for determining JTAG pinout on the 2701] was fairly simple but laborious.

1. Measure the resistance of all pins to GND and 3.3V power supply. You need to measure under the electrolytic capacitors to determine which is the main 3.3v supply. Mark them carefully on a pinout graphic all your measurements. This is important to do a clean accurate test. Turn it on and measure all voltages. Mark them on your graphic.

2. The pins that have already been defined as putting the box into special boot mode. Mark those.

3. One pin will have high resistance to GND and 3.3v. It is TDO, ie output which cannot be pulled up or down but floating. Mine showed 3Mohm.

4. One pin will be at either full supply potential 3.3v or 0v will be nTRST. (Assuming they have nTRST turned off. It was in mine.) It will more than likely have a different resistance than other pins. Mine was 5K to 3.3v 1.5K GND. It will, hence have much lower voltage to ground and be at or near 0v.

5. Hopefully you now have a bunch of pins next to each other, which are unknown. In my case 4,5 then 12,13,14 All measure 3.3v. All have 1k to 3.3v and 2k to GND. I traced pins 4, 5 to I2C serial eprom. So it won’t be those. That leaves the 3 pins bunched together. 12,13,14 which makes sense. The rest is trial and error.

Make up a grid and work through the combinations. TDI, TMS, TCK. Start the JTAG software each time. I just used the hairy dairy maid one. When I hit the right combo all the LEDs turned on indicating I had put the processor in a diagnostic mode. Only one or perhaps two combinations will do that. So you now have the 4 JTAG pins plus NTRST defined. Or perhaps two possibles.

There is a procedure documented on JTAG Finder, which is essentially a logic procedure where all potential JTAG Pins are hooked up simultaneously. A data signal is sent to one pin at a time, and all of the other pins are observed for changes in logic state. More information can be found at: http://www.elinux.org/JTAG_Finder

Given the tentative JTAG pinout that I have now, I think that I can build an unbuffered parallel interface with 8 connects on parallel pins 2-9 (data pins), and reserve pin 13 for TDO when found.

Then I should be able to implement the finder method to narrow things down.

After that, figure how to work with the TriMedia VLIW CPU and the NAND flash. The cable would be identical to the unbuffered cable described in the wiki, with the exception of using all eight of the data bus signals.

Any thoughts on this method?

Last edited by tjm08 (2009-12-09 15:43:47)

Taken from: the openwrt forum thread entitled “Finding JTAG Pinouts, New Hardware (2Wire 2700HG-D)”   [1]

[1] https://forum.openwrt.org/viewtopic.php?id=22816

[2] http://hackingbtbusinesshub.wordpress.com/2012/01/16/discovering-2wire-card-edge-pinout-for-jtag-i2c/

PCB photos of the 2Wire 2701HG-B and 2700

The following photos of the 2Wire 2701HG-B and the 2700 were taken by “Smiggy“, a contributor to the Australian Whirlpool forum for broadband discussion.

Here, Smiggy highlights the card edge connector for the JTAG TAP (and the i2c bus) on the 2Wire 2700.

Photo courtesy of "smiggy"

Here, Smiggy is illustrating the pinout of the boot ROM (where fitted) on the 2701.

Photo courtesy of "smiggy"

The Ares CPU on the 2Wire 2701HG-B board. The Ares is a Trimedia TM32 core:

Photo courtesy of "smiggy"

Photos found at [1].

[1] http://a.nfshost.com/2701hgb.jpg