JTAG to the mainboard

[Go4IT]

In this thread i will explain what i have learned about the JTAG interface of the mainboard. I applies to FX, NX and MCA units.

First thing i was looking for as i started with reverse engineering the board is a debug port. JTAG is always a good one to find because most MPUs provide sich an interface. And i soon found the place and connections of it on the orange service port connector on the bottom of the mainboard, which is accessible without disassembling the unti:

b1549218978.25099.jpg

b1549218978.25095.jpg

Here is the pinout i determined for it, by trace the wires from the OMAP, measure it out using my DSO and, of course, try and error testing:

b1549218978.25098.jpg

To connect it use my Segger J-Link interface. Because the OMAP has an ARM9 MPU inside, i choose this one and could connect to it right from the start using the default values:

CDD38211-9C8E-4809-944B-655F497F12F7.jpeg

The JTAG specification says that a TAP will place it's ID into the data register on reset. The OMAP JTAG chain has 50 bits and consists of three devices. There are techniques to determine the IR lenght, but it leaves some guessing. Segger seems to do a good job, but only find the ARM CPU part, the others are unknown.

The IRprint is just what shifts out of the TDO pin until the shift-in pattern arrives there. This pattern is a sequence of bits the Segger shifts into TDI until it discovers it on TDO. The number of clockcycles needed equals the number of Bits in the chain. The IRprint is the hex notation of the IR chain bits after reset. Uh, reset here does not necessarilly mean the system or chip reset, the TAP has it's own reset (TRST) which only resets the test logic.

The hard part is to find out how much devices are inside a chain and on which position. I guess the J-Link software looks for known IDs inside the IRprint, found the ARM and therefore knows that some other device is in front and after the chain position of the CPU. That are the "unknown" ones. I already lookup up the ID in the public lists, but they are not registered anywhere. I will crawl the TI docs of the OMAP5912 maybe it brings light to this...

[tomy75]

This pinout work with FX radio,no work with MCA radio
Can you please send me jtag pinout for MCA?

Thenx

[DGAlexandru]

It works for MCA also.
You need to put another pin to GND, from the pads on the left, so that other IC (radio, V850) doesn't send a reset request to OMAP.

Go4IT, why did you start a new thread for JTAG for this units.. isn't it already discussed in others, here, on this forum?