Question about the SMP8634/SMP8635 MIPS processor
Hi,
I am new to the list, I recently bought a set-top-box (Netbox 8160) which uses a SMP8635 MIPS processor. The original fimware is a disaster and for fun I want to try to build my own linux based firmware for this set-to-box.
I am absolutely not afraid, because I do a lot of embedded linux at office (on ARM9 arch and Blackfin arch).
The board of this set-top-box is pretty simple, there is the SMP8635 processor, 256MB of DDRAM, 16 MB of NOR flash, mini pci with atheros wifi card, ethernet MII phy, and 2 DVB-T tuners (maybe USB2 or PCI, for now I don't now).
The SMP8635 processor comes from Sigma Design and I found on its FTP site a 2.6.15 kernel with associated patches for the SMP863x processors serie.
My problem is that they doesn't provide the datasheet alone, visibly they provide it with the SMP8634 developement board (http://www.sigmadesigns.com/public/Products/SMP8630/SMP8630_series.html).
And to begin to developp on this board, I need at least to know where is located the JTAG. It will be the starting point to try to access the NOR flash to backup the original firmware, and play with the board. I don't see any SPI eeprom/flash thus I think even the boot loader is located the 16MB nor flash, so I thing at startup the processor directly try to execute code from the NOR, maybe at adress 0x0.
Is someone has some information on this processor ? Or maybe the datasheet ? With the datasheet I will be have to locate the JTAG pin :)
Thank you for reading my message, and sorry because my english is not perfect.
I wish you a good day
Regards,
Cyril HAENEL
Signature · 2 lines
Cyril Haenel Registered Linux User #332632
Cyril HAENEL wrote:
[...]
Quoted 4 lines
The SMP8635 processor comes from Sigma Design and I found on its FTP site a 2.6.15 kernel with associated patches for the SMP863x processors serie.
My problem is that they doesn't provide the datasheet alone, visibly they provide it with the SMP8634 developement board (http://www.sigmadesigns.com/public/Products/SMP8630/SMP8630_series.html).
In the past the datasheet was only available under NDA...
Quoted 3 lines
And to begin to developp on this board, I need at least to know where is located the JTAG. It will be the starting point to try to access the NOR flash to backup the original firmware, and play with the board. I don't see any SPI eeprom/flash thus I think even the boot loader is located the 16MB nor flash, so I thing at startup the processor directly try to execute code from the NOR, maybe at adress
0x0.
The 8634 has an internal 'security' processor that executes code out of on-chip flash/RAM. This security processor boots the main CPU only after verifying that the boot loader's cryptographic signatures are valid. Unless the factory firmware is permissive, there is very little you can do with it.
Quoted 1 line
Is someone has some information on this processor ? Or maybe the datasheet ? With the datasheet I will be have to locate the JTAG pin :)
The JTAG is multiplexed with the second serial port. Often you have to change a strapping pin so that JTAG is enabled when the board is powered on. Different boards have a variety of JTAG connectors, you would have to search for it on your board. Generally it is some form of 14 pin dual-inline header.
If you haven't already found it, probably the first thing you want to do is find primary serial port. Most configurations print at least a couple of lines indicating DRAM configuration before booting. If you are lucky you may be able to get to a YAMON prompt from the serial port.
The zboot loader may read a character from the serial port. '0', '1', '2', and '3' will override the default boot image.
David Daney
Quoted 9 lines · David Daney
Cyril HAENEL wrote:
[...]Quoted 5 lines
The SMP8635 processor comes from Sigma Design and I found on its FTP site a 2.6.15 kernel with associated patches for the SMP863x processors serie.
My problem is that they doesn't provide the datasheet alone, visibly they provide it with the SMP8634 developement board (http://www.sigmadesigns.com/public/Products/SMP8630/SMP8630_series.html).
In the past the datasheet was only available under NDA...
Maybe I can ask them....
Or maybe I must buy the development kit, but I thing price will be very high !
Quoted 6 lines
Quoted 4 lines
And to begin to developp on this board, I need at least to know where is located the JTAG. It will be the starting point to try to access the NOR flash to backup the original firmware, and play with the board. I don't see any SPI eeprom/flash thus I think even the boot loader is located the 16MB nor flash, so I thing at startup the processor directly try to execute code from the NOR, maybe at adress
0x0.The 8634 has an internal 'security' processor that executes code out of on-chip flash/RAM. This security processor boots the main CPU only after verifying that the boot loader's cryptographic signatures are valid. Unless the factory firmware is permissive, there is very little you can do with it.
Ok, thus the 8635 has an internal flash and some security routine at startup. Not a good new for me :( This cryptographic signature are only done on the boot loader ?
Quoted 4 lines
Quoted 2 lines
Is someone has some information on this processor ? Or maybe the datasheet ? With the datasheet I will be have to locate the JTAG pin :)
The JTAG is multiplexed with the second serial port. Often you have to change a strapping pin so that JTAG is enabled when the board is powered on. Different boards have a variety of JTAG connectors, you would have to search for it on your board. Generally it is some form of 14 pin dual-inline header.
Ok, so I have found it. With the scope when I power up the board I can see a clock signal and a data signal on a non connected 14 pin header. It should be the second serial port you talk about.
Quoted 4 lines
If you haven't already found it, probably the first thing you want to do is find primary serial port. Most configurations print at least a couple of lines indicating DRAM configuration before booting. If you are lucky you may be able to get to a YAMON prompt from the serial port.
The zboot loader may read a character from the serial port. '0', '1', '2', and '3' will override the default boot image.
I really don't know where the first serial port can be located. The other non mounter header are connected to an auxiliary microcontroller. I need to search again !
Regards,
Cyril
Quoted 6 lines
David Daney
Signature · 2 lines
Cyril Haenel Registered Linux User #332632