[alpha]
Warning: This software may damage your hardware!

Several Types of Cables
There are several different types of cables that are popular for hooking up to JTAG headers inside consumer electronic equipment. Most of these rely on a regular PC's parallel port to drive the JTAG signal lines. There are vendors of commercial JTAG cables that sell them at extravagent prices. For the home user or hobbyist, however, a better choice is usually to construct a cable at home from commonly available parts.

For SOHO routers and other network devices there are two popular cables: the buffered Wiggler-type cable and the unbuffered-type cable. The single largest segment of homemade JTAG cable users is probably satellite television receiver owners. A search on ebay for JTAG will turn up many people selling JTAG cables for use with satellite TV receivers. The JTAG interface is pretty much standardized but the difference in pinouts for different equipment can vary widely. The cables for sale on ebay could probably be easily made to work with SOHO routers, and vice versa, but this page will not cover them. I've never bought or used one so I don't know exactly how they are constructed.

There are other types of JTAG cables as well. Macraigor sells the Raven cable which is even more expensive than the Wiggler. Lately there are also cables that use a USB interface on the PC side instead of the 25-pin parallel port connector. I have not had any experience with these. There are still other JTAG solutions out there that are faster and more sophisticated than the interfaces built by hobbyists, but these are generally not cost-effective for someone who just wants to re-flash a single flash chip. A complete JTAG test rig is used in industry for much more than programming flash chips. Some of these industrial-strength setups can cost thousands and thousands of dollars.

Driving a JTAG interface through the parallel port on a PC is a slow proposition. Really slow. This is due more to the nature of the parallel port connection than an inherent limit of the JTAG specification. In fact, the JTAG spec allows for up to 25 milliion bits-per-second transfers. With a parallel port cable, however, you will be lucky to achieve more than about 400,000 bits-per-second. With these speeds it is not unusual to spend 25 minutes writing a mere 256 KB of data over a JTAG cable. Programming an entire 2 MB or 4 MB flash chip can literally take hours. It's worth it, however, if you have an otherwise worthless device on your hands and JTAG is the only way to revive it. The Macraigor Raven and USB JTAG adaptors are much faster, but there are no known schematic to implement it.

There are a many varians of the LPT-to-JTAG cables. All of them are different in the LPT pins -to- JTAG pins mapping and may be in the buffered and unbuffered variant.

Unbuffered Cable, Xilinx DLC5 Cable III
This is the simplest type of JTAG cable, the easiest to construct and the cheapest to make. The original cable was introduces by Xilinx and has a full name "Xilinx DLC5 JTAG Parallel Cable III". Someone removed a buffer and changed it with a four 100 Ohm resistor. Popularized by the Hairydairymaid de-brick utility software for Linksys routers, many people have successfully built their own unbuffered JTAG cable. It consists of only a few cheap resistors, a 25-pin parallel port connector and a ribbon-cable with a 12-pin connector that slides onto a header soldered onto the PCB found inside the cases of Linksys WRT54G and WRT54GS routers. The chief limitation of this type of cable is that it must be very short; the length must be 6 inches or less (15 cm) to avoid problems with electrical noise.

http://wiki.openwrt.org/JTAG_Cables?act ... &target=JT AGunbuffered.png

[list=]TDI - DATA0 - pin 2
TDO - SELECT - pin 13
TMS - DATA2 - pin 4
TCK - DATA1 - pin 3[/list]

The Linksys WRT54G and WRT54GS routers are based on Broadcom CPUs which are a type of MIPS32 processor. Broadcom has implemented EJTAG version 2.0 in their chips. This allows the use of DMA transfers via JTAG which, while slow, is faster than the implementation of EJTAG v2.5 and v2.6 which do not support DMA transfers.

------------------------------

Buffered Cable, Wiggler
This type of cable is a bit more complicated than the unbuffered one, although it is also fairly easy to construct. The cable most often used in this category is the so-called Wiggler cable. The Wiggler is a commercial cable sold by Macraigor Systems. With a list price of $150 USD they are not cheap. There is a schematic on the internet that is commonly accepted to be the equivalent of what's inside a Wiggler cable. This schematic, by Alec, was drawn up for devicves that implement a typical EJTAG header in devices based on the ADM5120 System-on-Chip, another design based on the MIPS32 architecture. The ADM5120 has support for EJTAG v2.6, which does not support DMA transfers.



JTAG-to-LPT mapping

[list=] TDI - DATA3 - pin 5
TDO - BUSY - pin 11
TMS - DATA1 - pin 3
TCK - DATA2 - pin 4
nSRST - DATA0 - pin 2
nTRST - DATA4 - pin 6[/list]

Whereas an unbuffered cable can be constructed for maybe $5 USD or less, the parts for a Wiggler-type cable will cost a little more, perhaps in the $15 to $30 USD range. The advantage of a buffered cable is that it is not as constrained as to length and is more immune to noise and static, thus permitting a higher data transfer rate.

This cable is filly compatible with Macraigor OCD Commander. The wire between DATA6 (pin 8 on the LPT DB-25) and ERROR (pin 15) is used to identify a presence of the Wiggler cable and requred by some JTAG software (i.e. Macraigor). It may be omitted for Hairydairymaid debrick utility.

Another consideration is that a buffered Wiggler-style cable requires a voltage source to operate. Usually +3.3 volts is needed and is commonly referred to as Vcc (voltage common-collector is the traditional meaning of Vcc). The buffer IC may take a Vcc from the PC LPT also. The DATA7 pin may be used for this purposes, so Wiggler software should provide aclive "1" at this pin. Do not use this pin if your JTAG header provides Vcc.

I's possible also to biuld an unbuffered Wiggler cable with just a four resistors.

Software

The most famous software for JTAG is probably the Linksys De-Brick Utility by Hairydairymaid (aka Lightbulb). As of 1 April 2006 the most recent version is v4.5. You can download it from the OpenWrt site. Virtually everyone who uses this software opts for an unbuffered cable, and the software itself, by default, expects this type of cable to be used.

The Hairydairymaid de-brick utility is mainly with Linksys WRT54G and WRT54GS routers. It will not help you de-brick other routers that are not based on Broadcom CPUs (e.g. Edimax and its clones).

Another popular JTAG utility is a Openwince JTAG. Unfortunately, the development is stalled, but you can use a CVS snapshot fork with EJTAG driver implemented by Marek Michalkiewicz : jtag-0.6-cvs-20051228

Using a Buffered Cable with the De-Brick Utility
Inside the zip file download for the Hairydairymaid WRT54G Debrick Utility there is a PDF file that describes the software and how to use it. He specifically talks about using an unbuffered cable and pointedly notes that the cable he uses does not tie pin 1 of the JTAG header to anything.

That's all well and good for an unbuffered cable, but if you do happen to have a buffered Wiggler-style cable then you will have to deal with the nTRST signal. The Hairydairymaid software doesn't account for that signal line since the recommended cable doesn't carry it, but your Wiggler-style cable does use that signal and the debrick utility will not work out-of-the-box with a Wiggler-style cable as a result. The reason for this is because the software leaves the output for the nTRST line at logic-level 0, which means the signal coming out of your cable to the JTAG header will always be asserted, and as a result the JTAG circuitry inside your router will forever be resetting itself.

Hairydairymaid notes in one of his files (wrt54g.h) that there are a few changes to make if you're using a Wiggler-style buffered cable, but those changes alone are not enough. In order to use a Wiggler-style cable with the debrick utility there are a couple of other changes you will need to make.

First and foremost is an external voltage supply. Vcc from the Linksys board must be brought to the Wiggler interface. Usually this means an extra jumper wire in addition to the 14-connector ribbon cable. Note that if your Wiggler cable has a 14-pin connector that pins 13 and 14 in it will not be connected to anything on the Linksys board. Pins 1 through 12 correspond properly to the signals on the 12-pin Linksys JTAG header, but positions 13 and 14 will not be connected to anything at all. On most Linksys routers there is another connector near the JTAG header that can be used to connect two serial ports to the router. This is typically a 10-pin header and, fortunately for us, pins 1 and 2 of this serial port header carry Vcc at 3.3 volts. This is perfect, and all that needs to be done is to run a jumper wire from one of those pins into your homemade Wiggler circuit at any appropriate spot where Vcc is called for. If you build your own cable from Alec's schematic then you should know where those spots are. Alternatively, you could also run a short jumper from pin 1 or 2 of the serial port header to the open hole of the ribbon cable connector at position 14. That might actually be the best choice.

Second is the software. File 'wrt54g.c' must be modified so that logic-level 1 is always output to pin 1 of the JTAG header. Alternatively you could just not connect pin 1 to anything, but then your cable wouldn't be a true Wiggler clone anymore. Ensuring that nTRST is always a '1' will prevent the JTAG circuitry on your device from being in a constant state of 'reset'.

Another change to the software is not directly related to the cable per-se. Some have observed that certain Intel flash chips are not successfully erased by the debrick utility. I believe that is because there is a time delay that must be observed after commanding a block of flash memory to be erased that is not observed by the program. I had this problem, specifically, on a WRT54GS v2.1 router with an Intel StrataFlash 28F640J3 chip. The datasheet for this chip states that it may take up to 5 seconds for an "erase block" command to complete. The software should account for this delay.

The following patch file addresses the issues outlined above. It should be applied to version 4.5 of Hairydairymaid's de-brick utility. It modified both 'wrt54g.h' and 'wrt54g.c'. The changes are not that extreme and less than 35 lines altogether are modified (or added; no lines are deleted).


JTAG tools

http://openwince.sourceforge.net/jtag/

http://sourceforge.net/project/showfile ... release_id =190231

Running JTAG Tools
Connect your JTAG adapter between your PC and target device and turn on your device.

To run JTAG Tools type jtag and press <Enter>. jtag should start and display some initial informations. Output should end with line like this:

jtag>

This is "jtag command prompt". Type help and press <Enter> for initial help about available commands. To exit JTAG Tools type "quit" and press <Enter>.

First task: Select JTAG cable and parallel port address.
Type help cable for list of supported JTAG cables. Type cable command with arguments. Example:

jtag> cable parallel 0x378 EA253
Initializing ETC EA253 JTAG Cable on parallel port at 0x378

Second task: Detect parts on the JTAG chain.
Type detect at the jtag command prompt:

jtag> detect

Your output should look like this:

IR length: 5
Chain length: 1
Device Id: 01011001001001100100000000010011
Manufacturer: Intel
Part: PXA250
Stepping: C0
Filename: /usr/local/share/jtag/intel/pxa250/pxa250c0

If you get empty output or an error message your JTAG adapter is not connected properly, or your target board doesn't work, or it is turned off.

detect command is required before all other commands.

Third task: Print current JTAG chain status.
Type print at the jtag command prompt. Here is an output example:

jtag> print chain
No. Manufacturer Part Stepping Instruction Register
---------------------------------------------------------------------- -----------------------
0 Intel PXA250 C0 BYPASS BR
jtag>

Fourth task: Sample device pin status.
jtag> instruction SAMPLE/PRELOAD
jtag> shift ir
jtag> shift dr
jtag> dr
1000110010000010000110010111111111111111111001101110000011101111111111 1111111111
1111111111111111111111111111111111111111111110111111110110000010001010 1000000000
0001111100000011101011111110000010000110010000000000000000011100001110 0000000000
0000000000000000000000000000000100000000000000000000000000000000000000 0000000000
1111000000000000000000000000000000000000000000100000000000000000000000 0000000000
0000000000
jtag> print chain
No. Manufacturer Part Stepping Instruction Register
---------------------------------------------------------------------- -----------------------
0 Intel PXA250 C0 SAMPLE/PRELOAD BSR
jtag> get signal BOOT_SEL[0]
BOOT_SEL[0] = 0
jtag>

Note: BSR is "Boundary Scan Register"

Fifth task: Burn flash connected to the part.
jtag> flashmem 0 brux.b
0x00000000
Note: Supported configuration is 2 x 16 bit only
BOOT_SEL: Asynchronous 32-bit ROM

2 x 16 bit CFI devices detected (QRY ok)!

program:
block 0 unlocked
erasing block 0: 0
addr: 0x00002854
verify:
addr: 0x00002854
Done.
jtag>

or:

jtag> flashmem msbin xboot.bin
Note: Supported configuration is 2 x 16 bit only
BOOT_SEL: Asynchronous 32-bit ROM

2 x 16 bit CFI devices detected (QRY ok)!

block 0 unlocked
erasing block 0: 0
program:
record: start = 0x00000000, len = 0x00000004, checksum = 0x000001EB
record: start = 0x00000040, len = 0x00000008, checksum = 0x000001B0
record: start = 0x00001000, len = 0x00002B30, checksum = 0x00122CAB
record: start = 0x00004000, len = 0x00000160, checksum = 0x0000684B
record: start = 0x00005000, len = 0x00000054, checksum = 0x000008EE
record: start = 0x00005054, len = 0x00000030, checksum = 0x00000DA9
record: start = 0x00000000, len = 0x00001000, checksum = 0x00000000

verify:
record: start = 0x00000000, len = 0x00000004, checksum = 0x000001EB
record: start = 0x00000040, len = 0x00000008, checksum = 0x000001B0
record: start = 0x00001000, len = 0x00002B30, checksum = 0x00122CAB
record: start = 0x00004000, len = 0x00000160, checksum = 0x0000684B
record: start = 0x00005000, len = 0x00000054, checksum = 0x000008EE
record: start = 0x00005054, len = 0x00000030, checksum = 0x00000DA9
record: start = 0x00000000, len = 0x00001000, checksum = 0x00000000

Done.
jtag>



1. Obtain a BSDL file for each of the devices in your chain. Most manufacturers have these readily
available on their web sites. (If possible, try to find a design with only one device in the chain - it
will make everything easier for your first attempt).

2. Make sure your scan chain is set up as follows:



3. For best results, make sure the JTAG signals (TDI, TDO, TCK, TMS) are buffered as they enter/leave
the board.

4. If you have more than a few devices in the chain, consider adding more buffers inline with the JTAG
signals every few devices. Try to group similar technologies together in the chain between buffers.

5. Make sure the power to the pod is appropriate for the pod you are using.

6. It is a good idea to make sure the JTAG Signals are accessible between the devices in the chain: if
you have a major failure in one of the devices, you’ll be able to jumper around it and get the rest of
the chain up and running.

7. Make sure the JTAG signals are pulled up and not left floating. (TRST is an optional signal that should
be pulled low when not scanning).



Links

http://forum.amilda.org/viewtopic.php?id=43

R&D
http://www.topmods.net/tin/unlock/1.jpg
http://www.topmods.net/tin/unlock/2.jpg

R&D Area

DeviceID's readed via K8U_ES rev.1

AMD Athlon 64 3000+ Venice E3
1111 1111111111110000 00000000001 1
E3 F F F 0 AMD 1 JTAG.S
Intel Pentium Socket 7 CPU
0110 1000001010101000 00000001001 1
via PDF
ver. Type Gen. Model Vendor
0011 1 000001 0101 00100 00000001001 1
3 1 5 4
6 8 2 A 8 Intel 1
Intel Pentium MMX166 CPU
0011 1000001010100011 00000001001 1
via PDF
ver. Type Gen. Model Vendor
0011 1 000001 0101 00011 00000001001 1
3 1 5 3 Intel 1

ATMEL Mega128L 8AI 0518I
1000 1001011100000010 00000011111 1
mega128L ATMEL AVR
3 9 7 0 2

0011 0000001011000111 00000001001 1
Bstp Pentium III Xeon Intel Required by the 1149.1 standard

1001 1000001100000011 00000001001 1
D1 Pentium 4 0.13um Intel Required by the 1149.1 standard

0000 0000010111010000 00000000001 1
ver K6 II/III/III+ AMD Required by the 1149.1 standard


AMD Athlon 64 FX-57 SanDiego MSR Dump

MSR : 63-32 31-0
----------------------------
C0000080 : 00000000 00000000
C0000081 : 00000000 00000000
C0000082 : 00000000 00000000
C0000083 : 00000000 00000000
C0000084 : 00000000 00000000
C0000100 : 00000000 FFDFF000
C0000101 : 00000000 00000000
C0000102 : 00000000 00000000
C0010000 : 00000000 6F9CDBFF
C0010001 : 00000000 FE9D5DBA
C0010002 : 00000000 F41F57CB
C0010003 : 00000000 DF8EBC1E
C0010004 : 0000CF70 CF574A85
C0010005 : 00007C25 88A5A714
C0010006 : 00003DA9 679724A5
C0010007 : 000041FD 86A21C0C
C0010010 : 00000000 00360601
C0010015 : 00000000 14000000
C0010016 : 00000000 00000000
C0010017 : 00000000 00000000
C0010018 : 00000000 00000000
C0010019 : 00000000 00000000
C001001A : 00000000 20000000
C001001D : 00000000 00000000
C001001E : 00000000 00000041
C001001F : 00000000 00000008
C0010030 : 6C687441 20444D41
C0010031 : 3620296D 74286E6F
C0010032 : 2035322D 58462034
C0010033 : 6F737365 636F7250
C0010034 : 00000000 00000072
C0010035 : 00000000 00000000
C001003E : 00000000 00000000
C001003F : 00000000 00000000
C0010041 : 00002710 0000060C
C0010042 : 12040606 042A140C
C0010043 : 00000000 08460320
C0010044 : 00000000 00000000
C0010045 : 00000000 00000000
C0010046 : 00000000 00000000
C0010047 : 00000000 00000000
C0010048 : 00000000 00000400
C0010050 : 00000000 00000000
C0010051 : 00000000 00000000
C0010052 : 00000000 00000000
C0010053 : 00000000 00000000
C0010054 : 00000000 00000000
C0010055 : 00000000 0333142E
C0010111 : 00000000 000A0000
C0010112 : 00000000 00000000
C0010113 : 00000000 00000001
C0010114 : 00000000 00000000
C0010115 : 00000000 00000000
C0010116 : 00000000 00000000
C0010117 : 00000000 00000000
C0010118 : 00000000 00000000
C0010119 : 00000000 00000000
C001011A : 00000000 00000000
C001011B : 00000000 00000000
C001011C : 00000002 CF15B001
C001011D : 00000000 00000000

AMD Athlon 64 3000+ Venice E3 Unlocked:
edx eax
C0010041: 00002710 00000610
C0010042: 12040606 043A0A10
C0010015: 00000000 0A000000

AMD Athlon 64 3700+ SanDiego @ 2900MHz 290x10 F71

Function 00000000 00000001 68747541 444d4163 69746e65
Function 00000001 00020f71 00000800 00000001 078bfbff
Function 80000000 80000018 68747541 444d4163 69746e65
Function 80000001 00020f71 0000010f 00000001 e3d3fbff
Function 80000002 20444d41 6c687441 74286e6f 3620296d
Function 80000003 72502034 7365636f 20726f73 30303733
Function 80000004 0000002b 00000000 00000000 00000000
Function 80000005 ff08ff08 ff20ff20 40020140 40020140
Function 80000006 00000000 42004200 04008140 00000000
Function 80000007 00000000 00000000 00000000 0000003f
Function 80000008 00003028 00000000 00000000 00000000
Function 80000009 00000000 00000000 00000000 00000000
Function 8000000a 00000000 00000000 00000000 00000000
Function 8000000b 00000000 00000000 00000000 00000000
Function 8000000c 00000000 00000000 00000000 00000000
Function 8000000d 00000000 00000000 00000000 00000000
Function 8000000e 00000000 00000000 00000000 00000000
Function 8000000f 00000000 00000000 00000000 00000000
Function 80000010 00000000 00000000 00000000 00000000
Function 80000011 00000000 00000000 00000000 00000000
Function 80000012 00000000 00000000 00000000 00000000
Function 80000013 00000000 00000000 00000000 00000000
Function 80000014 00000000 00000000 00000000 00000000
Function 80000015 00000000 00000000 00000000 00000000
Function 80000016 00000000 00000000 00000000 00000000
Function 80000017 00000000 00000000 00000000 00000000
Function 80000018 00000000 00000000 00000000 00000000

edx eax
MSR C0010041 00002710 0000060C
MSR C0010042 12040606 040E0E0C
MSR C0010015 00000000 0E000000

AMD Athlon 64 3000+ Venice Usual 230x9 FF0

Function 00000000 00000001 68747541 444d4163 69746e65
Function 00000001 00020ff0 00000800 00000001 078bfbff
Function 80000000 80000018 68747541 444d4163 69746e65
Function 80000001 00020ff0 00000108 00000001 e3d3fbff
Function 80000002 20444d41 6c687441 74286e6f 3620296d
Function 80000003 72502034 7365636f 20726f73 30303033
Function 80000004 0000002b 00000000 00000000 00000000
Function 80000005 ff08ff08 ff20ff20 40020140 40020140
Function 80000006 00000000 42004200 02008140 00000000
Function 80000007 00000000 00000000 00000000 0000003f
Function 80000008 00003028 00000000 00000000 00000000
Function 80000009 00000000 00000000 00000000 00000000
Function 8000000a 00000000 00000000 00000000 00000000
Function 8000000b 00000000 00000000 00000000 00000000
Function 8000000c 00000000 00000000 00000000 00000000
Function 8000000d 00000000 00000000 00000000 00000000
Function 8000000e 00000000 00000000 00000000 00000000
Function 8000000f 00000000 00000000 00000000 00000000
Function 80000010 00000000 00000000 00000000 00000000
Function 80000011 00000000 00000000 00000000 00000000
Function 80000012 00000000 00000000 00000000 00000000
Function 80000013 00000000 00000000 00000000 00000000
Function 80000014 00000000 00000000 00000000 00000000
Function 80000015 00000000 00000000 00000000 00000000
Function 80000016 00000000 00000000 00000000 00000000
Function 80000017 00000000 00000000 00000000 00000000
Function 80000018 00000000 00000000 00000000 00000000

edx eax
MSR C0010041 00002710 0000040A
MSR C0010042 12040604 040A0A0A
MSR C0010015 00000000 0A000000

AMD Athlon 64 3200+ @ X2 3800+ TM LAB

Свойства CPUID:
Производитель CPUID AuthenticAMD
Имя ЦП CPUID AMD Athlon(tm) 64 X2 Dual Core Processor 3800+
Версия CPUID 00020FB1h
Расширенная версия CPUID 00020FB1h
Идентификатор AMD 0150h (Athlon 64 X2 3800+)
Идентификатор платформы D1h (Socket 939)
Серийный номер ЦП IA Неизвестно
HTT / CMP 0 / 2

Наборы инструкций:
64-бит x86-расширение (AMD64, EM64T) Поддерживается
AMD 3DNow! Поддерживается
AMD 3DNow! Professional Поддерживается
AMD Enhanced 3DNow! Поддерживается
AMD Extended MMX Поддерживается
Cyrix Extended MMX Не поддерживается
IA-64 Не поддерживается
IA MMX Поддерживается
IA SSE Поддерживается
IA SSE 2 Поддерживается
IA SSE 3 Поддерживается
IA SSE 4 Не поддерживается
VIA Alternate Instruction Set Не поддерживается
Инструкция CLFLUSH Поддерживается
Инструкция CMPXCHG8B Поддерживается
Инструкция CMPXCHG16B Не поддерживается
Инструкция Conditional Move Поддерживается
Инструкция MONITOR / MWAIT Не поддерживается
Инструкция RDTSCP Не поддерживается
Инструкция SYSCALL / SYSRET Поддерживается
Инструкция SYSENTER / SYSEXIT Поддерживается
Инструкция VIA FEMMS Не поддерживается

Функции безопасности:
Advanced Cryptography Engine (ACE) Не поддерживается
Запрет исполнения данных (DEP, NX, EDB) Поддерживается
Hardware Random Number Generator (RNG) Не поддерживается
Montgomery Multiplier & Hash Engine Не поддерживается
Processor Serial Number (PSN) Не поддерживается

Функции электропитания:
Automatic Clock Control Не поддерживается
Enhanced Halt State (C1E) Не поддерживается
Enhanced SpeedStep Technology (EIST, ESS) Не поддерживается
Frequency ID Control Поддерживается
LongRun Не поддерживается
LongRun Table Interface Не поддерживается
PowerSaver 1.0 Не поддерживается
PowerSaver 2.0 Не поддерживается
PowerSaver 3.0 Не поддерживается
Processor Duty Cycle Control Не поддерживается
Software Thermal Control Не поддерживается
Temperature Sensing Diode Поддерживается
Thermal Monitor 1 Не поддерживается
Thermal Monitor 2 Не поддерживается
Thermal Monitoring Не поддерживается
Thermal Trip Поддерживается
Voltage ID Control Поддерживается

Функции CPUID:
36-bit Page Size Extension Поддерживается
Address Region Registers (ARR) Не поддерживается
CPL Qualified Debug Store Не поддерживается
Debug Trace Store Не поддерживается
Debugging Extension Поддерживается
Fast Save & Restore Поддерживается
Hyper-Threading Technology (HTT) Не поддерживается
L1 Context ID Не поддерживается
Local APIC On Chip Поддерживается
Machine Check Architecture (MCA) Поддерживается
Machine Check Exception (MCE) Поддерживается
Memory Configuration Registers (MCR) Не поддерживается
Memory Type Range Registers (MTRR) Поддерживается
Model Specific Registers (MSR) Поддерживается
Page Attribute Table (PAT) Поддерживается
Page Global Extension Поддерживается
Page Size Extension (PSE) Поддерживается
Pending Break Event Не поддерживается
Physical Address Extension (PAE) Поддерживается
Secure Mode Extensions (SMX) Не поддерживается
Secure Virtual Machine Extensions (Pacifica) Не поддерживается
Self-Snoop Не поддерживается
Time Stamp Counter (TSC) Поддерживается
Virtual Machine Extensions (Vanderpool) Не поддерживается
Virtual Mode Extension Поддерживается

CPUID Registers (CPU #1):
CPUID 00000000 00000001-68747541-444D4163-69746E65
CPUID 00000001 00020FB1-00020800-00000001-178BFBFF
CPUID 80000000 80000018-68747541-444D4163-69746E65
CPUID 80000001 00020FB1-00000150-00000003-E3D3FBFF
CPUID 80000002 20444D41-6C687441-74286E6F-3620296D
CPUID 80000003 32582034-61754420-6F43206C-50206572
CPUID 80000004 65636F72-726F7373-30383320-00002B30
CPUID 80000005 FF08FF08-FF20FF20-40020140-40020140
CPUID 80000006 00000000-42004200-02008140-00000000
CPUID 80000007 00000000-00000000-00000000-0000000F
CPUID 80000008 00003028-00000000-00000001-00000000
CPUID 80000009 00000000-00000000-00000000-00000000
CPUID 8000000A 00000000-00000000-00000000-00000000
CPUID 8000000B 00000000-00000000-00000000-00000000
CPUID 8000000C 00000000-00000000-00000000-00000000
CPUID 8000000D 00000000-00000000-00000000-00000000
CPUID 8000000E 00000000-00000000-00000000-00000000
CPUID 8000000F 00000000-00000000-00000000-00000000
CPUID 80000010 00000000-00000000-00000000-00000000
CPUID 80000011 00000000-00000000-00000000-00000000
CPUID 80000012 00000000-00000000-00000000-00000000
CPUID 80000013 00000000-00000000-00000000-00000000
CPUID 80000014 00000000-00000000-00000000-00000000
CPUID 80000015 00000000-00000000-00000000-00000000
CPUID 80000016 00000000-00000000-00000000-00000000
CPUID 80000017 00000000-00000000-00000000-00000000
CPUID 80000018 00000000-00000000-00000000-00000000

CPUID Registers (CPU #2):
CPUID 00000000 00000001-68747541-444D4163-69746E65
CPUID 00000001 00020FB1-01020800-00000001-178BFBFF
CPUID 80000000 80000018-68747541-444D4163-69746E65
CPUID 80000001 00020FB1-00000150-00000003-E3D3FBFF
CPUID 80000002 20444D41-6C687441-74286E6F-3620296D
CPUID 80000003 32582034-61754420-6F43206C-50206572
CPUID 80000004 65636F72-726F7373-30383320-00002B30
CPUID 80000005 FF08FF08-FF20FF20-40020140-40020140
CPUID 80000006 00000000-42004200-02008140-00000000
CPUID 80000007 00000000-00000000-00000000-0000000F
CPUID 80000008 00003028-00000000-00000001-00000000
CPUID 80000009 00000000-00000000-00000000-00000000
CPUID 8000000A 00000000-00000000-00000000-00000000
CPUID 8000000B 00000000-00000000-00000000-00000000
CPUID 8000000C 00000000-00000000-00000000-00000000
CPUID 8000000D 00000000-00000000-00000000-00000000
CPUID 8000000E 00000000-00000000-00000000-00000000
CPUID 8000000F 00000000-00000000-00000000-00000000
CPUID 80000010 00000000-00000000-00000000-00000000
CPUID 80000011 00000000-00000000-00000000-00000000
CPUID 80000012 00000000-00000000-00000000-00000000
CPUID 80000013 00000000-00000000-00000000-00000000
CPUID 80000014 00000000-00000000-00000000-00000000
CPUID 80000015 00000000-00000000-00000000-00000000
CPUID 80000016 00000000-00000000-00000000-00000000
CPUID 80000017 00000000-00000000-00000000-00000000
CPUID 80000018 00000000-00000000-00000000-00000000

MSR Registers:
MSR C0010015 0000-0000-0C00-0040
MSR C0010042 1206-0806-060C-0C0C

Number of CPUs 2

CPU #1
APIC ID 0
Name AMD Athlon 64 X2 3800+
Code name Manchester
Specification AMD Athlon(tm) 64 X2 Dual Core Processor 3800+
Family/Model/Stepping FB1
Extended Family/Model F/2B
Brand ID 5
Package Socket 939
Core Stepping BH-E4
Technology 90nm
Instructions Sets MMX, Extended MMX, 3DNow!, Extended 3DNow!, SSE, SSE2, SSE3, x86-64
Features NX
Clock Speed 2500.7 MHz
Clock multiplier x10.0
HTT Bus Frequency 250.1 MHz
P-Rating 3800+
L1 Data Cache 64 KBytes, 2-way set associative, 64 Bytes line size
L1 Instruction Cache 64 KBytes, 2-way set associative, 64 Bytes line size
L2 Cache 512 KBytes, 16-way set associative, 64 Bytes line size
L2 Speed 2500.7 MHz (Full)
L2 Location On Chip
L2 Data Prefetch Logic yes
L2 Bus Width 128 bits

eax ebx ecx edx
Function 00000000 00000001 68747541 444d4163 69746e65
Function 00000001 00020fb1 00020800 00000001 178bfbff
Function 80000000 80000018 68747541 444d4163 69746e65
Function 80000001 00020fb1 00000150 00000003 e3d3fbff
Function 80000002 20444d41 6c687441 74286e6f 3620296d
Function 80000003 32582034 61754420 6f43206c 50206572
Function 80000004 65636f72 726f7373 30383320 00002b30
Function 80000005 ff08ff08 ff20ff20 40020140 40020140
Function 80000006 00000000 42004200 02008140 00000000
Function 80000007 00000000 00000000 00000000 0000000f
Function 80000008 00003028 00000000 00000001 00000000
Function 80000009 00000000 00000000 00000000 00000000
Function 8000000a 00000000 00000000 00000000 00000000
Function 8000000b 00000000 00000000 00000000 00000000
Function 8000000c 00000000 00000000 00000000 00000000
Function 8000000d 00000000 00000000 00000000 00000000
Function 8000000e 00000000 00000000 00000000 00000000
Function 8000000f 00000000 00000000 00000000 00000000
Function 80000010 00000000 00000000 00000000 00000000
Function 80000011 00000000 00000000 00000000 00000000
Function 80000012 00000000 00000000 00000000 00000000
Function 80000013 00000000 00000000 00000000 00000000
Function 80000014 00000000 00000000 00000000 00000000
Function 80000015 00000000 00000000 00000000 00000000
Function 80000016 00000000 00000000 00000000 00000000
Function 80000017 00000000 00000000 00000000 00000000
Function 80000018 00000000 00000000 00000000 00000000

edx eax
MSR C0010041 00002710 0000080C
MSR C0010042 12060808 060C0C0C
MSR C0010015 00000000 0C000040


Athlon 64 3500+ Manchester (Single Core)

Number of CPUs 1
APIC ID 0
Name AMD Athlon 64 3500+
Code name Manchester
Specification AMD Athlon(tm) 64 Processor 3500+
Family/Model/Stepping FF2
Extended Family/Model F/3F
Brand ID 4
Package Socket 939
Core Stepping BH-E4
Technology 90nm
Instructions Sets MMX, Extended MMX, 3DNow!, Extended 3DNow!, SSE, SSE2, SSE3, x86-64
Features NX
Clock Speed 2211.1 MHz
Clock multiplier x11.0
HTT Bus Frequency 201.0 MHz
P-Rating 3500+
L1 Data Cache 64 KBytes, 2-way set associative, 64 Bytes line size
L1 Instruction Cache 64 KBytes, 2-way set associative, 64 Bytes line size
L2 Cache 512 KBytes, 16-way set associative, 64 Bytes line size
L2 Speed 2211.1 MHz (Full)
L2 Location On Chip
L2 Data Prefetch Logic yes
L2 Bus Width 128 bits

eax ebx ecx edx
Function 00000000 00000001 68747541 444d4163 69746e65
Function 00000001 00030ff2 00000800 00000001 078bfbff
Function 80000000 80000018 68747541 444d4163 69746e65
Function 80000001 00030ff2 0000010d 00000001 e3d3fbff
Function 80000002 20444d41 6c687441 74286e6f 3620296d
Function 80000003 72502034 7365636f 20726f73 30303533
Function 80000004 0000002b 00000000 00000000 00000000
Function 80000005 ff08ff08 ff20ff20 40020140 40020140
Function 80000006 00000000 42004200 02008140 00000000
Function 80000007 00000000 00000000 00000000 0000000f
Function 80000008 00003028 00000000 00000000 00000000
Function 80000009 00000000 00000000 00000000 00000000
Function 8000000a 00000000 00000000 00000000 00000000
Function 8000000b 00000000 00000000 00000000 00000000
Function 8000000c 00000000 00000000 00000000 00000000
Function 8000000d 00000000 00000000 00000000 00000000
Function 8000000e 00000000 00000000 00000000 00000000
Function 8000000f 00000000 00000000 00000000 00000000
Function 80000010 00000000 00000000 00000000 00000000
Function 80000011 00000000 00000000 00000000 00000000
Function 80000012 00000000 00000000 00000000 00000000
Function 80000013 00000000 00000000 00000000 00000000
Function 80000014 00000000 00000000 00000000 00000000
Function 80000015 00000000 00000000 00000000 00000000
Function 80000016 00000000 00000000 00000000 00000000
Function 80000017 00000000 00000000 00000000 00000000
Function 80000018 00000000 00000000 00000000 00000000

edx eax
MSR C0010041 00002710 0000080E
MSR C0010042 12060808 060E0E0E
MSR C0010015 00000000 0E000000





Код:
# Some platform need ESI and EDI as password to access MSR.
#ESI=89098937h
#EDI=7890ef0eh

#MSR List
# format:
#MSR(ECX) Description
10h TIME_STAMP_COUNTER, Timer Stamp Counter
1Bh APIC_BASE
2Ah EBL_CR_POWERON
8Bh PATCH_LEVEL
FEh MTRRCAP, MTRR Information.
#174h SYSENTER_CS, CS register target for CPL 0 code.
#175h SYSENTER_ESP, Stack Pointer for CPL 0 stack.
#176h SYSENTER_EIP, CPL 0 code entry point.
#179h MCG_CAP, Machine check capabilities.
#17Ah MCG_STATUS, Machine check status.
#17Bh MCG_CTL, Machine check feature enable.
#1D9h DEBUGCTL, Debug Control.
#1DBh LASTBRANCHFromIP
#1DCh LastBranchToIP
#1DDh LastIntToIP
#1DEh LastIntFromIP
200h MTRR_PHYSBASE0, Variable Range Base MTRR.
201h MTRR_PHYSMASK0, Variable Range Mask MTRR.
202h MTRR_PHYSBASE1, Variable Range Base MTRR.
203h MTRR_PHYSMASK1, Variable Range Mask MTRR.
204h MTRR_PHYSBASE2, Variable Range Base MTRR.
205h MTRR_PHYSMASK2, Variable Range Mask MTRR.
206h MTRR_PHYSBASE3, Variable Range Base MTRR.
207h MTRR_PHYSMASK3, Variable Range Mask MTRR.
208h MTRR_PHYSBASE4, Variable Range Base MTRR.
209h MTRR_PHYSMASK4, Variable Range Mask MTRR.
20Ah MTRR_PHYSBASE5, Variable Range Base MTRR.
20Bh MTRR_PHYSMASK5, Variable Range Mask MTRR.
20Ch MTRR_PHYSBASE6, Variable Range Base MTRR.
20Dh MTRR_PHYSMASK6, Variable Range Mask MTRR.
20Eh MTRR_PHYSBASE7, Variable Range Base MTRR.
20Fh MTRR_PHYSMASK7, Variable Range Mask MTRR.
250h MTRR_FIX64K_00000, Fixed Range MTRR.
258h MTRR_FIX16K_80000, Fixed Range MTRR.
259h MTRR_FIX16K_A0000, Fixed Range MTRR.
268h MTRR_FIX4K_C0000, Fixed Range MTRR.
269h MTRR_FIX4K_C8000, Fixed Range MTRR.
26Ah MTRR_FIX4K_D0000, Fixed Range MTRR.
26Bh MTRR_FIX4K_D8000, Fixed Range MTRR.
26Ch MTRR_FIX4K_E0000, Fixed Range MTRR.
26Dh MTRR_FIX4K_E8000, Fixed Range MTRR.
26Eh MTRR_FIX4K_F0000, Fixed Range MTRR.
26Fh MTRR_FIX4K_F8000, Fixed Range MTRR.
#277h CR_PAT, Page Attribute Table
#2FFh MTRR_DEF_TYPE, Default Memory Types.
#400h MC0_CTL
#401h MC0_STATUS
#402h MC0_ADDR
#403h MC0_MISC
#404h MC1_CTL
#405h MC1_STATUS
#406h MC1_ADDR
#407h MC1_MISC
#408h MC2_CTL
#409h MC2_STATUS
#40Ah MC2_ADDR
#40Bh MC2_MISC
#40Ch MC3_CTL
#40Dh MC3_STATUS
#40Eh MC3_ADDR
#40Fh MC3_MISC
C0000080h EFER, Extended Feature Enable Register
#C0000081h STAR
#C0000082h LSTAR
#C0000083h CSTAR
#C0000084h SF_MASK
#C0000100h FS.Base
#C0000101h GS.Base
#C0000102h KernelGSBase
#C0010000h PerfEvtSel0, Performance Event-Select register
#C0010001h PerfEvtSel1, Performance Event-Select register
#C0010002h PerfEvtSel2, Performance Event-Select register
#C0010003h PerfEvtSel3, Performance Event-Select register
#C0010004h PerfCtr0, Performance Counter.
#C0010005h PerfCtr1, Performance Counter.
#C0010006h PerfCtr2, Performance Counter.
#C0010007h PerfCtr3, Performance Counter.
C0010010h SYSCFG, System Configuration Register
#C0010015h HWCR
C0010016h IORRBase0
C0010017h IORRMask0
C0010018h IORRBase1
C0010019h IORRMask1
C001001Ah TOP_MEM
#C001001Dh TOP_MEM2
#C001001Eh MANID
#C001001Fh NB_CFG
#C0010020h PATCH_LOADER
#C0010041h FIDVID_CTL
#C0010042h FIDVID_STATUS
#C0010054h IOTRAP_CTL
#C0010111h SMM_BASE
#C0010112h SMM_ADDR
#C0010113h SMM_MASK

#EOF



JTAG-Cable
----------

Either you can use the Keith+Koep cable or build a passive one.
A simple cable is a passive version of the DLC5 cable. It must
be kept short because otherwise the signals become unreliable.
I successfully built one with 60 cm 9 pole ribbon cable. Between
each active signal (4) I put a GND (5). The resistors are on the
jtag header:

---------< 2 VCC
|
--***----< 1 TRST
______ 200
select 13 >------------------------***----< 5 TDO
200
data 0 2 >------------------------***----< 3 TDI
200
data 1 3 >------------------------***----< 9 TCK
200
data 2 4 >------------------------***----< 7 TMS
200
gnd 21-25 >===============================< 6,8,10 GND


DB25 PC Cable JTAG Header


DLC5 Cable


Start the JTAG tools with "jtag" and enter the following sequence:

jtag> cable ppdev /dev/parport0 DLC5 (or KeithKoep)
jtag> detect

This should identify the SA1110 processor.

jtag> detectflash

This should identify one 28F128 FLASH with 16 bit bus. The second
chip cannot be reached with the JTAG tools.

jtag> flashmem 0 simpad.rom

Код:
DFI JTAG TERMINATOR R&D

NoCPU + 102 terminator

RESET_L - 0v
DBREQL - 2.5v
DBRDY -2.5v
TMS -2.5v
TCK -2.5v
TRSTL -2.5v
TDI -2.5v
TDO -2.5v
'GND' - 2.5V

CPU ON + 102 terminator

RESET_L - 0v 0.1sec >> 2.5v permanent
DBREQL - 2.5v
DBRDY -2.5v
TMS -2.5v
TCK -2.5v
TRSTL -2.5v
TDI -2.5v
TDO -2.5v
'GND' - 2.5V

NoCPU no terminator

RESET_L - 0v
DBREQL - UNCONNECTED
DBRDY -UNCONNECTED
TMS -UNCONNECTED
TCK -UNCONNECTED
TRSTL -UNCONNECTED
TDI -UNCONNECTED
TDO -UNCONNECTED
'GND' - 2.5V

CPU ON no terminator

RESET_L - 0v 0.1sec >> 2.5v permanent
DBREQL - 2.5V
DBRDY -0V
TMS -2.5V
TCK -2.5V
TRSTL -2.5V
TDI -2.5V
TDO -2.5V
'GND' - 2.5V