O Canada! > Canadian > Canadian Broadband > Thomson SpeedTouch 5x6 & 585 EJTAG "De-Brick" Access

reply to Bicephale

Re: Thomson SpeedTouch 5x6 & 585 EJTAG "De-Brick" Access

Hi DiskAce,

My subject is in the title, i thought it was clear
enough for the average reader:  Thomson SpeedTouch
5x6 & 585 EJTAG "De-Brick" Access.  Here's another
hint:  HairyDairyMaid is likely to work with this:



Feel free to contribute with some feedback if any!

Hi bicephale, does the JTAG interface only interact with the BCM chipset ? I thought JTAG was for the entire circuit board.

What are you trying to do ?
--
Electronic Box Inc.

Hi DiskAce,

I didn't have much time to browse around but if we
can assume that the PinOut information & suggested
interface are correct it means the JTAG feature of
the BCM6348 ChipSet is now available.  The archive
which this site links to must be renamed as a .RAR
file.  The file inside got no extension but that's
one more .RAR file, apparently, and it extracts as
'HairyDairyMaid_WRT54G_Debrick_Utility_v48'...  It
seems what we have here is a 'WRT54G EJTAG DeBrick
Utility' under the form of Linux source code and a
set of Windows binaries.  I'd suggest you refer to
'ReadMe.Txt' for details about the supported FLASH
chips, etc...  As i wrote in my opening message, i
wanted to read anecdotes from others, not to write
my own!  Look at 'jtag-hairydairymaid.png', that's
some 12 pins JTAG Connector in the LinkSys WRT54G;
a .PDF guide is also provided that shows where the
'TRST' pin should go when someone tries to build a
generic JTAG cable.  There are passages about some
BCM94710 chip, it also shows two possible layouts:
a VisionIce 14 pins JTAG header or a 12 pins EJTAG
one.  My SpeedTouch's BCM chip may use a different
PinOut and yet remain electrically compatible with
the interface described by this document, i guess.



If we're able to backup and restore the FLASH chip
that means we can effectively "De-Brick" our ST5x6
device instead of throwing it away in case of some
incident.  During the late storm, for example, the
power outages caused my ST546 to switch to "BootP"
mode.  What else could have happened, i wonder but
in another six months i may be able to fix that if
there's a FLASH image file handy.  So, i'm curious
to see who was tempted to be the 1st guinea pig so
far since i'd bet others found out before i did...

According to the readme the BCM6348 JTAG support is implemented in the V4.4. I am not sure whether or not the ST780WLi use the BCM6348 chipset but i will try later on this week to make a JTAG connector.

On your side, i would suggest to work on the 546. Pretty sure you will find more informations on their forum »www.f-x.fr/forum/index.php (French) for compatibility with the 546.

BTW the .zip extension is working here.

--
Electronic Box Inc.

Hi DiskAce,

Well, i've found discrepancies already.  One ST516
picture to which i linked shows the 4 pins 3 Volts
Console pads and the 14 pins "De-Brick" access but
the European site appears to exchange them!  There
is a way to make sure which is which, it happens a
scope trace is included that strongly suggests the
TTL serial port is reached via some of the 14 pins
instead of the four ones but the coulours from the
French text don't match with those on the picture;
unless their orange and my yellow are the same and
both would correspond to pin #8, that is...  If it
is so, pin #1 is Tx, pin #4 is Rx, pin #8 is power
(+3.3 Volts) and pin #7 is gound (0 Volts).  Also,
they have a 12 pins header were i expected to find
a 14 pins one so i conclude caution is required...

On the ST546 picture, closing up on J3 and J6 will
not allow me to follow signal paths and this means
i'd need to open mine to take even closer shots or
i won't be able to tell where the EJTAG plug goes.

Moreover, the chipset on the ST546 photograph will
be a BroadCom BCM6338, its PinOut may differ quite
radically!  I conclude more caution is required!!!

reply to diskace

BroadCom BCM6338 - EEtChina, 2005-Nov (0511A_DC_S11F1)

reply to Bicephale
OpenWRT page (ST585)