view · edit · print · history
JTAG SignalIXP420 BallPCB Location
TDIBall AE24Connected to LHS R133
TMSBall AF25Connected to LHS R132
TCKBall AF26Connected to LHS R134/R138
TDOBall AD23Connected to LHS R137
TRSTn (Optional)Ball AC22Connected to bottom of R135
RESET_IN_NBall AC13See below

JTAG users may also need the IXP4xx signal RESET_IN_N (ball AC13). the trace takes a tortured path, via under CPU to become the trace closest to edge of board by R145. then via under Q8, connect to Q8 pin 1. then on to lower side of R75 and R76 (missing). then under the flash chip, and I think to flash pin 15 (Vpen), and thru a via to the right side of R140 (missing). This signal is driven by an open-collector circuit. Q8 (most likely) is an EM6325 reset circuit with manual reset (1.3V-4.6V, SOT23?) datasheet at: http://www.emmicroelectronic.com/

Note on TRSTn: This signal is actively driven (R135 is a 0 Ohm jumper). It gets deasserted 400ms before RESET_IN_N is deasserted. If you want to drive this signal you have to remove R135. Do not forget to add a 10k pulldown otherwise the JTAG TAP in the IXP420 CPU will not be properly initialized during reset.

JTAG is a IEEE standard 1149.1 for in-circuit testing of complex electronic systems, typically using FPGAs or microprocessors. In essence, it allows one to switch off and bypass the internal functionality of a chip and take external control of its I/O lines to provide test stimulus to the rest of the circuit it's in. See also http://www.ee.ic.ac.uk/pcheung/teaching/ee3_DSD/ti_jtag_seminar.pdf for a tutorial, or Google for JTAG, Linux, Intel etc.

One popular use for JTAG (and what we're primarily interested in) is to do in-circuit programming of the flash memory chips in the system. For our case this is for when we've made the NSLU2 unbootable by replacing the bootloader with a broken copy. The official Linksys firmware, Unslung and OpenSlug do NOT alter the bootloader so you are safe from this. There are several commercial and one Open Source system that appear to be able to do this for the Intel processor the NSLU2 uses.

IXP420 Ident : 1001001001110111 ixp425 IXP4xx-266MHz (dyoung)

Attach:NSLU2-board-rear-jtag.jpg Δ


The JTAG port has been tested and found to be working with a Altera ByteBlaster MV cable, Digilent Xilinx III clone cable and a BDI2000 JTAG interface. The JTAG interface was connected directly to the pads on the NSLU2. No pullup resistors were needed.

If you wish to use JTAG Tools then you must add the IXP4xx @ 266MHz ident string (1001001001110111) to jtag/intel/PARTS and the B0 stepping (0001) to jtag/intel/ixp425/STEPPINGS

The BSDL file for the IXP420 can be found on the IXP42x product page.


Update (as of 27-Nov-2008): urjtag supports the NSLU2 natively (it is a fork of the openwince jtag tool). More about urjtag + slug in RecoverFromABadFlashUsingJTAG.

Example run using JTAG Tool 0.51:

 JTAG Tools 0.5.1
 Copyright (C) 2002, 2003 ETC s.r.o.
 JTAG Tools is free software, covered by the GNU General Public License, and you are
 welcome to change it and/or distribute copies of it under certain conditions.
 There is absolutely no warranty for JTAG Tools.

 Warning: JTAG Tools may damage your hardware! Type "quit" to exit!

 Type "help" for help.

 jtag> cable parallel 0x378 ByteBlaster
 Initializing Altera ByteBlaster/ByteBlaster II/ByteBlasterMV Parallel Port Download Cable on parallel port at 0x378

 jtag> detect
 IR length: 7
 Chain length: 1
 Device Id: 00011001001001110111000000010011
   Manufacturer: Intel
   Part:         IXP4xx-266MHz
   Stepping:     B0
   Filename:     /usr/local/share/jtag/intel/ixp425/ixp425

 jtag> print
  No. Manufacturer              Part                 Stepping Instruction  Register
    0 Intel                     IXP4xx-266MHz        B0       BYPASS       BR

 Active bus:
 *0: Intel IXP425 compatible bus driver via BSR (JTAG part No. 0)
         start: 0x00000000, length: 0x100000000, data width: 16 bit

 jtag> detectflash
 Query identification string:
         Primary Algorithm Command Set and Control Interface ID Code: 0x0001 (Intel/Sharp Extended Command Set)
         Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null)
 Query system interface information:
         Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV
         Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV
         Vpp [Programming] Supply Minimum Write/Erase voltage: 0 mV
         Vpp [Programming] Supply Maximum Write/Erase voltage: 0 mV
         Typical timeout per single byte/word program: 256 us
         Typical timeout for maximum-size multi-byte program: 256 us
         Typical timeout per individual block erase: 2048 ms
         Typical timeout for full chip erase: 0 ms
         Maximum timeout for byte/word program: 1024 us
         Maximum timeout for multi-byte program: 1024 us
         Maximum timeout per individual block erase: 16384 ms
         Maximum timeout for chip erase: 0 ms
 Device geometry definition:
         Device Size: 8388608 B (8192 KiB, 8 MiB)
         Flash Device Interface Code description: 0x0002 (x8/x16)
         Maximum number of bytes in multi-byte program: 32
         Number of Erase Block Regions within device: 1
         Erase Block Region Information:
                 Region 0:
                        Erase Block Size: 131072 B (128 KiB)
                        Number of Erase Blocks: 64
view · edit · print · history · Last edited by vs.
Based on work by vs, tman, ep1220, kitno455, ka6sox, and rwhitby.
Originally by ka6sox.
Page last modified on November 27, 2008, at 01:42 PM