Bicephale
join:2005-09-24
 ·TekSavvy Solutions..
1 edit | reply to chaveiro
Re: Thomson SpeedTouch 5x6 & 585 EJTAG "De-Brick" Access
Commented Schematic |
Can you complete the right part (in red) of this edited schematic?
I only have the .PDF from HairyDairyMaid's DeBrick v2.2 tool at the moment...
P.S.:
I refered to this picture for the four data pins of the left side:
Parallel Port Layout |
|
Cidi Rome
join:2007-12-12
| reply to Bicephale
If the Schematic is correct:
the TOP pin numbered IRD 15 is TDO
and the other numbered IRD 19 is TRST.
I'm using an active JTAG like that one too and I'm not using that connection (TRST) because I'm connecting the TRST to the +3.3V with a 100Ohm resistor and if you use it, the software must send the trust signal (don't know if the -wiggler parameter does that).
So I Can say this for that image:
This schema IRD Pins >> JTAG Name >> Speedtouch Connector
20 >> GND >> 2,4,6,8
19 >> TRST >> 1 (May not be used, I connected to Serial port pin 1 through a 100Ohm resistor)
13 >> TMS >> 7
11 >> TCK >> 9
9 >> TDI >> 3
15 >> TDO >> 5
Best Regards. |
|
Bicephale
join:2005-09-24
·TekSavvy Solutions..
|  .PNG/thumb.jpg "64232 bytes")
Transitional ST6x5 E-JTAG Adaptor Schematic |
Hi Cidi Rome,
I'm still not sure where the 'TRst' pin (purple item at right) would be in an ST5x6 E-JTAG connector...
|
|
Cidi Rome
join:2007-12-12 | reply to Bicephale
It is, as I said, it is pin 1 of the ST JTAG connector, but I'm not sure if the Application can provide the TRST signal through LPT port pin 5 (Data 3).
Anyway I'm not using it with any of my JTAG dongles (As I said). |
|
chaveiro
join:2007-12-06
3 edits | reply to Bicephale
I did not connect nTRST nor nSRST.
Anyway i've read somewere that you can use the reset button in the back of modem to simulate these pins. Their function is to reset the cpu for jtag access.
I simply powerup the modem prior to use the jtag.
The voltage to power the jtag tool is 3.3V. |
|
Bicephale
join:2005-09-24
·TekSavvy Solutions..
|  .PNG/thumb.jpg "717974 bytes")
GTronica E-JTAG Adaptor (with 3.0 Volts Battery Socket) |
If there's a 'TRst' signal available in the E-JTAG
maintenance connector then it's leading to pin 23M
of the BCM6348 chip, that's what i had in mind but
lets forget about this detail. Now, relatively to
the power supply present in the adaptor, i couln't
but notice a socket in the upper left corner which
is labelled "BT1" and then i concluded the circuit
runs on a 3.0 Volts battery - which brings my next
question... Knowing that the 74HC244 chip has two
functions: buffering and logic level shifting, is
it not suitable to prefer a 74AHC244 chip instead?
N.B.:
I've tilted the picture by 180 degrees, this means
the upper left corner is now at the lower right... |
|
Bicephale
join:2005-09-24
·TekSavvy Solutions..
1 edit | reply to Cidi Rome
ST585iv6 JTAG & Console Access | 
ST546v6 JTAG Access | 
ST516v6 Console & JTAG Access |
I examined the photographs which were published in
the very 1st post of this thread, i found that the
JTAG maintenance connector is properly labelled on
the ST585v6 printed-circuit board so lets use this
as a reference for all future pin numberings. The
lower left corner of the rectangle around the JTAG
pads provides a clue about where pin 1 is located,
the numbers printed around that box clear an doubt
which might remain. Another clue are the five top
left ground pins (2, 4, 6, 8 and 10) with pin 2 on
top of pin 1, pin 4 on top of pin 3, etc. I think
it's important to agree from the start on which is
which, we can recognize the same sequencing scheme
looking closely at the above magnified pictures by
using the ground pins as the reference (there's no
pin 1 key-corner available in the ST516v6 case)...
The pins are numbered differently on DIP chips, it
felt appropriate to ensure that no readers will be
exposed to any further confusion about the layout.
To make certain we've all followed, the odd number
pins are together on one side and the even ones on
the other. It's important to pay attention to the
layout because the ST516v6 JTAG connector just can
not be installed on the components side as for the
ST546v6/ST585v6: instead of a "top view", its pin
layout corresponds to a transparent "bottom view". |
|
Cidi Rome
join:2007-12-12
| reply to Bicephale
Hi there.
I think there's an Error on the last picture ST516.
The +3.3V is the Pin one of the Serial Port, at last it was from where I got the signal for the JTAG PIN 1 TRST.
Take a look at my picture.
By the way, In my picture is missing the necessary pin for GND, It fallout and I hadn't the time to solder it back.
Best Regards. |
|
Bicephale
join:2005-09-24
·TekSavvy Solutions..
| Hi,
Thanks a lot for the correction, Cidi Rome!!! Now
that you mention it, i start to remember that this
serial port had its I/O lines grouped together and
hence this means pin 1 got to be the one on top...
So, we need to tie up the JTAG 'TRst' pin to a 3.3
Volts source, it seems!!! Do you concur? I'll be
editing the ST516 picture in the next few hours in
order to post a revised version shortly. I'm also
trying to sort out the voltage translation issues:
5 Volts tolerant chips operating at 3.3 volts will
handle 5 Volts TTL levels on the inputs just fine,
this 'TDO' output, on the other hand, will fail to
meet the requirements of any computer of which the
parallel port is based on 5 Volts CMOS logic (Vih=
3.15 Volts): i'm worried that loading isn't light
enough on that line... The level shifting problem
haunts me since the day i read about those 8 hours
long UpLoads; to be honest with you, i didn't try
to understand how HairyDairyMaid's tool is working
exactly but i thought that it wouldn't hurt to try
a dual-supply translator chip! After all, what if
UpLoads are slow because of retransmission errors?
We can use the console's port 3.3 Volts supply pin
and add a 78L05 regulator to generate 5 Volts from
the 12 Volts rail... That way, there's no risk of
injecting voltage on the SpeedTouch's pins when it
is turned down - which is a problem when using the
lithium cell solution. Our adaptor should be made
compatible with all types of parallel interface, i
am also trying to find what's the safest solution.
|
|
Cidi Rome
join:2007-12-12
1 edit | reply to Bicephale
Hi there...
Have more (strange) news...
Today I took booth my Routers ST516 and ST585 to a friend that has equipment to remove and solder back the flash chips in order to program them in an external programmer.
We were able to read them to files, but not write.
After that we exchanged them, the flash from 585 is on 516 and vice-versa, that lead me to discover that my 585 is not bricked because of some bad programed flash. It stills react exactly the same as before and I was able to correctly flash and put back to work the 516 with the 585 flash chip.
I don't know what happened with my ST585, it is a very strange coincidence that it became bricked while I was programing its flash thought JTAG connection.
If someone has any idea, please come forward.
Bicephale: I think I've read that you have a ST546, have you managed to back it up? I was looking to it's picture and The serial port is there too.
Best Regards. |
|
Bicephale
join:2005-09-24
·TekSavvy Solutions..
|  .GIF/thumb.jpg "81346 bytes")
AVR JTAG-ICE Clone (Edit of Schematic by Molchun) | 
ST 546v6 3.3 Volts Console Access |
The experiment you describe may happen to reveal a
feature of Spansion's Flash chip which i mentioned
in my post of January 2: the ESN signature. It's
possible the strange behaviours you observe may be
related to this, don't you think? Well, if i were
an ISP who bothers to "brand" the FirmWare you can
bet i'd certainly take advantage of it! Maybe you
need another ST585v6 from the very same ISP to fix
the 1st unit, maybe not. Worst, lets suppose that
you caused damage while testing the four resistors
interface: these protect against over-current but
such a configuration doesn't prevent over-voltage.
Contributions you and Chaveiro made are bringing a
new life to this thread. Real progress is finally
being done thanks to you both and it's appreciated
but, no matter how i value the benefit of messages
from visitors that resourceful, i'm worried by the
risks you've taken. We're all big boys so i don't
mean to under-estimate anyone's capabilities and i
won't insist. Lets now address the last question!
As motivating as the thread sounds i haven't tried
to open my Speedtouch yet. The reason is this: i
am stalled at the preliminary stage! You see, i'm
still gathering information here and there in hope
to learn a few lessons from other guys who managed
with this type of interface problem before. There
are quite a few questions which remain unanswered,
your posts show that we effectively got the proper
signal paths together and at this point i'm almost
satisfied that we successfully identified the JTAG
pins/layouts but i must still browse around a bit.
As the thread initiator, i need the information to
be made crystal clear for our future readers so it
takes time and it reminds me i yet have to correct
a previous post! The next step on my agenda is to
get a suitable interface that i can recommend with
no reserve and i've found just what i needed: the
above drawing is my reformatted verion of the 'AVR
JTAG-ICE Clone' project illustrated by Molchun and
it's demonstrating how we can build a split-supply
logic translator/buffer using the suitable HCT and
AHC chips! We only need to cut the surplus parts,
of which i've removed a section already to make my
image clearer. Once this schematic is simplified,
it will be easy enough to adapt it for our purpose
by numbering the connectors adequately. We have a
3.3 Volts supply, the 2nd picture shows where it's
located on an ST546v6 exactly and my graphic edits
will take that into account in future messages; i
might even want to add an RS-232 port, actually...
I'll most likely take the next design steps to the
background but i had to make sure our readers were
informed of some basic interfacing considerations.
About the ST585v6, you'd try to exchange the Flash
chips between two ST585v6 units should this become
possible for sure. A "bricked" unit which started
working again would mean you've put your finger on
something, if not it wouldn't prove much though...
All i can do is wish you luck! And to be careful!
Ref.:
AVR JTAG clone, Testu, 2004-Jul-7
Logic Level Translation Using Buffer Gates, Fig. 16 |
|
Bicephale
join:2005-09-24
·TekSavvy Solutions..
| reply to ggpr
US Robotics 9108 Console & JTAG Access |
Can you get a better snapshot of this area for us please? |
|
Cidi Rome
join:2007-12-12
3 edits | reply to Bicephale
Hi Bicephale.
About your router's serial port, I'd say that you signaled correctly pin 1 because I know that Pin 2 is GND and that can be seen in your picture. The same applies to other pictures or looking at the router JTAG port and check that pins 2, 4, 6, 8 and 10 are connected to the board ground.
About what you said about "ISP who bothers to brand the FirmWare"... I don't believe you are 100% correct unless that kind of protection is only applying to ST585. I believe that they don't even know how the CFE or Kernel of this routers works (too dumb for that), they ordered Thomson some thousands of Routers and requested to only permit their username standard (xxx@sapo, xxx@telepac and xxx@netcabo), and a firmware file that is accepted by the upgrade tool that unlocks them. About the username standard, I go further, I believe that the real limitation is not to have a dot (.) after the at (@) symbol, all other operators use usernames with the suffix .pt ex: xxx@clix.pt or xxx@simplesnet.pt. They just don't want to have other customers buying their routers (ST516v6) for 25 Euros or leaving the operator with a working router for that price.
"As motivating as the thread sounds i haven't tried
to open my Speedtouch yet." >>> I think You are being too cautious...
About the schematic you posted, seems to complex to carry out, but good luck.
About my bricked ST585 I don't believe the problem is the flash, anyway the next time I go to my friend (probably I won't) I'll take the ST516 with the flash containing the ST585 firmware just in case to switch them again. I believe even that its problem have nothing to do with the bad flashing process.
Best Regards and good luck to everyone that is thinking in going on with this project and backup their router flash. |
|
Bicephale
join:2005-09-24
·TekSavvy Solutions..
2 edits | 
3 Volts Input Limitation |
The ST546v6 3.3 Volts console port section has two
pull-up resistors (R64 & R65) on the signal lines,
i'll bet these connect to this larger copper trace
tied to pin 1 and its decoupling capacitor (C120).
Well, J3 would be easy to deceipher if it were not
for the serial lines which we can't tell appart...
Relatively to the Spansion Flash ESN signature, it
is not an item i can contribute about so i'll pass
and address something i know better: electronics.
The circuit appears to be complex because i didn't
completely remove the extraneous parts like J3 and
the Mega16 chip: i left such remains for clarity,
actually! I could have retained the circuit built
around U4/U5 only but i wanted the readers to know
where the I/O-P and TGP-On lines end up exactly...
Keep in mind it's a different application meant to
demonstrate how level shifting can be implemented.
Now, about the basic four resistors cable and that
of GTronica, i may be mistaking but the datasheets
suggest that no input should be above 3.3 Volts in
this case. I don't want to stress the adapter and
much less the SpeedTouch unit so you'll find above
the bare minimal safety measure i will agree with:
five cheap 1N4148 diodes in series will bring each
input within safe operating conditions, i believe.
Finally, you sound like you won't return to follow
our progress. I was hoping you'd stick around but
i can accept you got your own motivations... Good
luck to you! I'm sure time will help you triomph.
|
|
Cidi Rome
join:2007-12-12
1 edit | reply to Bicephale
Good Night.
Why do you say I sound like I won't return?
I will stick around for a while...
I believe you can help me when you decide to backup your router's firmware, because i think it is fully compatible with ST516 and that will be a great help.
I am patiently waiting for you or any other users with compatible routers, as at this time I only have 2 different router CFEs/Kernels to analyze.
And even after that I will stick around to see what others have achieved with my hints. I believe in the future there will be custom firmwares for this routers like the ones that were made for WRT54G.
By the way, I understand your idea with the 1N4148 diodes, wouldn't it be easier with a 3.3V Zenner, I believe that exists?
Still, I think you are worrying too much, as long as I know the JTAG interface (at least the active one with the 74244 logic chip) has been used for long with satellite receivers successfully with little casualties.
Best Regards. |
|
Bicephale
join:2005-09-24
·TekSavvy Solutions..
| Hi Cidi Rome,
I'm relieved, i thought this was good bye! You're
quite right to think that i'll get a BackUp of the
Flash contents because i must and i will: there's
no way for this "insurance plan" to work without a
BackUp image, after all... Only, i'm still in the
process of studying the interface to make sure i'm
not exposing our readers to any unnecessary risks.
We seem to share similar visions of the future. A
day will come when the ST owners can dream of more
features for their BroadCom-based units, BandWidth
Shaping is one: if i'm not mistaking it's already
available in the US Robotics 9108 product... I'll
leave that to others on other sites to explore, we
need to be patient while we limit ourselves to the
main (and modest) goal of this thread: to backup,
then to restore for those who are ready to try it!
Expertise over serial numbers and/or MAC addresses
might be of some interest, eventually. We'll need
you around - relatively to the legitimate parts...
The zener diode solution is much more elegant than
having all those stacked diodes packed in a corner
of the board, i'd agree it's the way to go but the
pictured circuit is operating from a lithium cell,
at 3.0 Volts, and i thought that normal diodes are
easier to find (i live in the country-side). This
isn't definitive as i had Maxim's MAX3392 chip in
mind, i'm simply attempting to make this safer for
everyone. It's true we can find the 74HC244 based
ciruits on a multitude of sites but is this really
appropriate in all cases? Here's a manufacturer's
set of datasheets, their papers mention it if it's
made "5 Volts tolerant" and the 74HC series isn't:
Philips Product DataSheets
Philips, "74AHC125; 74AHCT125 Octal buffer/line driver; 3-state" (Rev. 04, 2007-Sep-25)
Philips, "74HC244; 74HCT244 Octal buffer/line driver; 3-state" (Rev. 03, 2005-Dec-22)
Philips is using a wide assortment of technologies
based on silicon and maybe even other materials, a
neat list of those is available on their web site:
Philips Logic Families
ABT AUP HC(T) LVT(H) SSTL
AHC(T) AVC(M) HEF4000 MB SSTU
ALVC CBT(D)(LV)(S)(V) HSTL PCK SSTV
ALVT FAST LV PDI
AUC GTL LVC(H) PTN
Some designs may be right but that depends! I bet
you have 5 Volts on your own parallel port, right?
It can't hurt to understand the problem better and
while i was browsing around i identified a pair of
JTAG layouts which are quite similar to Thomson's:
Amontec, Application Note 003
Page 10: MIPS EJTAG-2.5 14 Pins (JTAG)
Page 14: Toshiba MIPS 20 Pins (JTAG)
What we have on our STs is a truncated version and
it might include variations not mentioned in there
but i foresee the possibility that other utilities
will handle the BroadCom/Spansion combination just
fine. Are you curious? I am very much indeed!...
Imagine some GUI tool for the clickers among us!!!
|
|
chaveiro
join:2007-12-06
3 edits | Bicephale, keep it simple.
- TTL-logic works at 5V which will be interpreted as a "low" or "high" level are anything less than 0.8 volts, or more than 2.0 volts, respectively.
- HC CMOS devices switch high at Vcc/2 typical which is 1.65V at Vcc = 3.3.
- Paralel ports are open collector TTL (or open drain for CMOS devices). This means that it has two states. A low state (0v) and a high impedance state (open circuit) anything > 0.8V with internal pulup resistors to 5v (or 3.3v in some laptops).
So 3.3V level to paralel port interface is no problem.
And 5V to the 74HC244 is possible due to the R1 and R2 resistors that limit current to safe values.
Also i dont see any problem powering the jtag tool without the modem powered up.
Now go dump a backup of your modem!
Regards |
|
Cidi Rome
join:2007-12-12
1 edit | reply to Bicephale
Good morning.
There was one thing I forgot to tell: I wasn't satisfected with the 3V cell on the JTAG and powered it from the Router Serial Port, not the LPT port, and it works as well as the passive JTAG.
About the Spansion Chip: It is detected with the same ID as the AMD, so there is nothing to worry about that, for working proposes it IS an AMD 29LV320, that was the configuration used with the external flasher when I removed the flash from the router.
Best Regards. |
|
Bicephale
join:2005-09-24
·TekSavvy Solutions..
| reply to chaveiro
Open Collector Output | 
ST546v6 - BCM5325 | | 
BCM5325 Silicon Geometry |
For the reader's convenience, we'll have a look at
the classic open-collector output stage. It's all
too clear that there is 5 Volts at the output when
the transistor (Q3) is turned off but i sure agree
that this voltage source is current-limited by the
pull-up resistor (R4), in addition to that on your
adaptor. The Philips documentation states that we
can submit the 74HC inputs to no more than Vcc, or
3.3 Volts (unless running the adaptor on a lithium
battery); i measured 4.96 Volts on the parallel's
Data outputs to TDI, TCk and TMS respectively, the
74HC inputs connect to it through one series 100 Ω
resistor and it's tied to the 3.3 Volts supply via
a 2.2 KΩ pull-up resistor. The Maximum "clamping"
current for a 74HC chip is 20 mA (max) @ Vcc + 0.5
Volts (3.8 Volts), i won't try to calculate what's
the net effect of all these resistors on a 5 Volts
source but can the readers rest assured that their
combination of HardWares won't cause the voltage &
current to exceed safe values? The five diodes or
zener shunt can handle a couple hundreds of mA and
eliminate over-voltage so is there a reason not to
use any of that? Also, isn't it more appealing to
simply get rid of these considerations by building
around a MAX3392 chip which also improves speed???
I may be mistaking but i think i can tell to which
Logic family the BCM63x8 chips belong, check this:
BroadCom BCM5325 Product Brief, Page 2
I'm showing the part which attracted my attention.
While i browsed around i found a puzzling passage:
JStamp I/O Pins (see the section titled «JStamp output to 5V CMOS input»):
"Won't work reliably since 5V CMOS needs Vih of as
much as 3.15V... Use a level shifter or buffer."
 |
|
chaveiro
join:2007-12-06
4 edits | Bicephale you made me investigate...
See my diagram above.
Typical paralel ports can provide 2 - 2.6mA on data port.
All CMOS logic have protective ESD diodes inside that can be used for overvoltage protection.
74HC logic diodes rating can take 20mA. The resistor net in out design gives 4.131V (clamped to vcc 3.3v by ESD diodes) at 3.674mA more than within the 20mA tolerance.
If we folow IEEE 1284 Level II paralel interface drivers that must be able to source 14 mA current at least +2.4V voltage. For 5V at 14mA (worst case and highly improbable) the values at cmos port are 12mA still within the 20mA specification.
The downside of using this net resistor protection is that we get degraded performance at high speed rates. Not the speeds used here.
Since this interface is to be used very few times i see no reason to build an expensive one with the max level shifter but you can do that if you want.
Regards |
|
