DIT7421/05 SMP8634LF REV-C JTAG

[aks]

hi - i'm new to this forum since i found a BTVision box in  a skip and rather than see it go for scrap thought it would make a nice development platform to play with.
Unfortunately its one with no obvious jtag connector - has anyone tracked out the jtag on the rev-c board ?
i've located points where TRST_N and TDI can be soldered to fairly easily
but the JTAG-Enable TCK and TMS seem to be connected down to 0V.
anyone else investigated ?

[darcy]

Hi aks,
I realise that this is an old post but I have done the same thing and come to the same conclusion that JTAG-Enable TCK and TMS all run to ground.
Taking this a step further and in the hope of being able repair this by cutting a few traces I decided to remove the chip from a second board and proceeded map each JTAG wire from the top of the chip to the balls underneath (unfortunately I could not find a datasheet for this chip and spent hours with a sewing needle taped to my multi-meter probe)
The result were as follows
JTAG-Enable TCK and TMS are attached to each other beneath the chip and then to ground
TDO is not attached to anything
TRST_N can be found on the bottom of the board beneath the chip
TDI can be found on the top of the board to the right of the chip
I think it is therefore safe to say that this box cannot be modified. (please prove me wrong)
The attached picture shows the pin outs on the SMP8634LF chip and also traces connecting JTAG-Enable TCK and TMS

[mce2222]

there is always the option to connect the jtag from the cpu-top ..
like shown here: http://www.t-hack.com/wiki/index.php/EJTAG_on_SMP

it is definately not an easy task, but several forum users, were able to do it.

[is0-mick]

there is always the option to connect the jtag from the cpu-top ..
like shown here: http://www.t-hack.com/wiki/index.php/EJTAG_on_SMP

it is definately not an easy task, but several forum users, were able to do it.

He mentions that:
"JTAG-Enable TCK and TMS are attached to each other beneath the chip and then to ground"

so I don't think that would be possible??

Mick

[joca]

I have here also a box  ( KMM 3010-PT )with this processor ( SMP8634LF REV. C ), i tried JTAG but nothing happen, doesn't seem to be working however i was able to get some output with serial port (RS-232). I was wondering if it's possible to do something with this type of hardware ( firmware change ) since these devices are locked to the ISP ?

Regards,
joca

[mce2222]

if there is mediaroom running on the box (which is very likely) then you cannot get anywhere with the serial connection.
the only option is to patch the bootloader with JTAG during startup.

[joca]

if there is mediaroom running on the box (which is very likely) then you cannot get anywhere with the serial connection.
the only option is to patch the bootloader with JTAG during startup.

Thanks for the info. , but i found out that there's missing a resistor ( R428 ) in the JTAG_Enable Pin on the box that i have here. In this picture : http://www.t-hack.com/wiki/images/1/12/Pinout.jpg there's a 10Kohm for the JTAG-enable ( R428 ).
I will try again with JTAG and see if i can get any results.


Regards
Joca

[aks]

Hi aks,
I realise that this is an old post but I have done the same thing and come to the same conclusion that JTAG-Enable TCK and TMS all run to ground.
Taking this a step further and in the hope of being able repair this by cutting a few traces I decided to remove the chip from a second board and proceeded map each JTAG wire from the top of the chip to the balls underneath (unfortunately I could not find a datasheet for this chip and spent hours with a sewing needle taped to my multi-meter probe)
The result were as follows
JTAG-Enable TCK and TMS are attached to each other beneath the chip and then to ground
TDO is not attached to anything
TRST_N can be found on the bottom of the board beneath the chip
TDI can be found on the top of the board to the right of the chip
I think it is therefore safe to say that this box cannot be modified. (please prove me wrong)
The attached picture shows the pin outs on the SMP8634LF chip and also traces connecting JTAG-Enable TCK and TMS

Hi darcy
apologies for the late response ! been distracted by child rearing unfortunately - guess things have moved on to other boards by now.
your disassembly looks conclusive to me  - i dont think theres any way to get to those signals with the chip attached to the pcb unless you can add some tracks and then reattach your smp. out of scope for my soldering iron !

aks