Cmd Timeout Error Easy Jtag

Posted on  by 



3.2.1. Overview

Following is a list of commands currently supported by jtag and someexample usage.

bit

كثير منا يعاني في بدايات دخوله الى عالم jtag من اخطاء قد تصادفه اثناء توصيل خطوط isp على البورد واليكم الحل التطبيق على البوكس الاحترافي EASY JTAG أولا: Can’t init device, Reason: CMD Timeout Error. Jun 27, 2020 Can't init device, Reason: CMD Timeout Error Done. Z3X EasyJtag Software ver. 2.5.0.8 Loading eMMC Addon Firmware. IO: 1850 mV Box S/N: 120110093ECEB894,FW Ver.: 01.58 CMD Pullup Level:1753 mV CMD Active Level:1835 mV Box IO Level:1850 mV CLK Rate:14000 khz HiPower mode is off! Can't init device, Reason: CMD Timeout Error Done.

define new BSR bit

bus

change active bus

bsdl

manage BSDL files

cable

select JTAG cable

detect

detect parts on the JTAG chain

Cmd Timeout Error Easy Jtag Setup

detectflash

detect parameters of flash chips attached to a part

discovery

discovery of unknown parts in the JTAG chain

dr

display or set active data register for a part

endian

set/print endianness for reading/writing binary files

eraseflash

erase flash memory by number of blocks

flashmem

burn flash memory with data from a file

frequency

setup JTAG frequency

Cmd Timeout Error Easy Jtag Software

get

get external signal value

help

display this help

include

include command sequence from external file

initbus

initialize bus driver for active part

instruction

change active instruction for a part or declare new instruction

part

change active part for current JTAG chain

peek

read a single word

poke

Cmd Timeout Error Easy Jtag Tutorial

write a single word

print

display JTAG chain list/status

quit

exit and terminate this session

readmem

read content of the memory and write it to file

register

define new data register for a part

scan

detect changes on input pins of current part

set

set external signal value

shift
Cmd Timeout Error Easy Jtag

shift data/instruction registers through JTAG chain

signal

define new signal for a part

svf

execute SVF commands from file

Cmd Timeout Error Easy Jtag
writemem

write content from file to memory

Some tools derived from the same openwince JTAG Tools code base as UrJTAGknow additional commands, which are not supported in UrJTAG. See the sectionabout 'Unsupported commands', below, about workarounds.

3.2.2. Basic commands3.2.2.1. quit

This command closes the jtag console.

3.2.2.2. help

Without additional parameter it gives an overview of the available commands.With a parameter you can get more information about any of the commands.Example:

Most cable drivers require some more details about the cable to start properly.To learn about the details, use the 'cable' command with the name of the cablefollowed by the word 'help'. Example:

3.2.2.3. include

Run commands from a named script file installed with UrJTAG or applies a BSDLfile to the active part. The directory prefix is added automatically(e.g. /usr/share/urjtag/, depending on your installation), unless the filename starts with a dot or slash.

For example, the following startup sequence configures the cable, chain, andloads definitions and bus driver for a Samsung S3C4510B CPU to peek its memoryat 0x0:

If the file contains valid BSDL syntax, it will be converted to nativecommands on the fly.

Optionally, a number X may be specified following the file name, to causean X times repetition of the command sequence from the file.

3.2.3. Chain management3.2.3.1. cable

Sets and initializes the cable driver. This is usually the first command thatyou are executing in a session. Example:

For a parallel cable using the ppdev driver you would use this:

If you get an error, it may be that the parallel port kernel driverwas compiled as a module in your Linux kernel and wasn’t loaded automatically.Then you should try to load the ppdev driver manually (with root rights outsidethe jtag shell):

UrJTAG now also supports some USB cables. Unfortunately, there is no standardfor 'JTAG over USB', so this support is limited to a few selected cables only.For cables based on the FT2232 chip from FTDI, the cable command has to begiven cable name and optionally the driver name, USB Vendor, and Product ID ofthe cable:

For all known cables, UrJTAG knows the VID and PID so you can just say

If your cable isn’t detected automatically though it’s listed as a known andsupported cable, feel free to report its VID and PID. It might be a differentrevision and should be added to the known & tested list of cables.

As stated above, the driver name is not mandatory for the cablecommand. UrJTAG will select the driver automatically based on UrJTAG’sconfiguration. In case your system provides just one of libftdi or FTD2XXthe respective driver is selected. If both libraries are available, thenFTD2XX is selected. That’s simply because FTD2XX showed some performanceadvantages over libftdi in the past. You can still force libftdi with therespective parameter.

There’s one quirk to consider when using FTDI’s FTD2XX driver. Itconnects to any known FTDI chip, randomly. I.e. if there’s more than one FTDIdevice connected to the host, chances are that the driver connects to thewrong USB device. This might be an OEM USB-serial converter and you’ll bebanging your head why there’s no proper reading from the JTAG chain. Thereforeit’s strongly recommended to specify the desc=xxx parameter for the cablecommand if the ftd2xx driver is to be used. Set xxx to the product or serialnumber descriptor string that are exhibited by the USB device.

3.2.3.2. detect

Detects devices on the chain. Example:

During 'detect', UrJTAG searches through the files in its database (usually in/usr/share/urjtag) and optionally in the search path for BSDL files (see bsdlcommand) to find a match for the manufacturer, revision and part number for theIDCODE read from the part. However, not all parts identify themselves in a waythat is useful for 'detect'. For example, many chips with an ARM processor coreinside present an IDCODE that may be specific to the the particular core insidethe chip (e.g. ARM7TDMI), but doesn’t tell about the actual manufacturer ofthe chip. In such case, the data for the part has to be included manually. Seealso the documentation for the 'include' command.

3.2.3.3. print

Print a list of parts in the chain and the currently active instruction per part.Further details of bus, signals and instructions can be obtained with dedicatedcommand options, see 'help print'.

3.2.3.4. initbus

Selects and initializes a bus of the currently selected part, e.g. the externalmemory bus of a CPU. This is required in order to access chips that aren’tconnected in the JTAG chain, but indirectly accessible through other chips(e.g. CPU or programmable logic).

Type 'help initbus' to get a list of supported bus types.If you do not find a bus driver for your specific hardware, you might be luckyenough to have EJTAG in your target (most MIPS-based CPUs do) and should trythe 'ejtag' bus driver. In contrast to the method 'via BSR', it uploads someinstructions to the CPU and triggers their execution to access the bus, andshould work with almost any EJTAG-capable chip (Note: JTAG isn’t EJTAG):

There’s another option to support new chips 'via BSR', the 'prototype' busdriver, which can be adapted to support your part with command parameters.The only prerequisite for using this driver is knowledge of the names of thesignals that represent address bus, data bus, and enable signals, and thataddress and data lines are numbered in order.

For example, assume the signals are named in the BSDL description as follows:

  • Data bus: D0, D1, … D31

  • Address bus: ADDR0, ADDR1, … ADDR22

  • Output Enable: nOE

  • Write Enable: nWE

  • Chip Select: nRCS0

The enable signals seem to be active low (indicated by the leading 'n' in theirnames). Further we assume the interesting connected part, some flash chip, isonly 16 bits wide even though the data bus width is 32 bits. With thisinformation, you could use the following command (all on a single line!) toaccess the bus:

The 'prototype' bus driver cannot deal with systems where address and databus are multiplexed on the same pins. If signals aren’t numbered in the rightorder or with gaps, you may get along by defining proper names as aliases forthe actual signals, with commands like 'salias ADDR12 BSCGX44'.

Most drivers work 'via BSR', i.e. they directly access the pins of the device.Because it isn’t possible to efficiently address only particular pins but onlyall at once, and data for all pins has to be transferred through JTAG for everysingle change, this method isn’t the fastest, but usually easiest to implementand, well, sometimes it counts whether it works at all.

The 'fjmem' (FPGA JTAG memory) bus driver attempts to address this issue bymoving control and observation away from BSR to a device-internalregister. For sure this is only possible on FPGAs where the designer can hookadditional logic to the JTAG chain. A core design plus examples for differentFPGA families is available in the extra/fjmem directory. Refer to the READMElocated there.

Some chips don’t allow direct access to their pins via BSR at all. For these,writing a new bus driver that utilizes a debug module to upload specific codeto access the bus is inevitable.

3.2.3.5. bus

It’s possible to initialize more than one bus for part(s) within a chain. The'bus' command allows to select the active bus for readmem, flashmem,etc. operation.

3.2.4. Part definition commands

The following commands are also used in the data files to define a device (IC)on the JTAG chain. It is not recommended to use these commands in an interactivesession. Instead you should produce a device definition file out of a .bsd fileusing one of the supplied tools (or use the new BSDL subsystem, see below).

bit

define new BSR bit

instruction

change active instruction for a part or declare new instruction

register

define new data register for a part

signal

define new signal for a part

3.2.5. TAP control

The following commands can be used to directly manipulate and display the stateof the TAP controller(s) and registers in the chain:

dr

display or set active data register for a part

instruction

change active instruction for a part or declare new instruction

get

get external signal value

Cmd timeout error easy jtag usb
pod

low level direct access to POD signals like TRST; use with care

scan

detect changes on input pins of current part

set

set external signal value

shift

shift data/instruction registers through JTAG chain

3.2.6. RAM/Flash access

These commands can be used if a part in the chain has memory connected to it(or integrated). Before they can be used, a bus driver has to be selected andinitialized (see initbus command).

detectflash

detect parameters of flash chips attached to a part

endian

set/print endianness for reading/writing binary files

eraseflash

erase flash memory by number of blocks

flashmem

burn flash memory with data from a file

peek

read a single word

poke

write a single word

readmem

read content of the memory and write it to file

writemem

write content from file to memory

3.2.7. Highlevel commands3.2.7.1. svf

The SVF player operates on a single part in the scan chain. Therefore, youhave to bring up the JTAG software, specify a cable and detect the scanchain beforehand.

The player will establish a new instruction called 'SIR' and a new registercalled 'SDR'. They are used internally by the respective SVF commands and arereassigned with new values as the player advances through the file. It is notrecommended to use them outside of the SVF player as their content is dynamic.

An example session:

It is recommended to set the part’s instruction register to BYPASS althoughmost SVF files do this at the end. By setting the instruction explicitely toBYPASS the output of the print command will always show meaningfulinformation.

The SVF player will issue messages when situations arise that cannot behandled. These messages are classified as warnings or errors depending onwhether the player can continue operation (warning) or not (error).In case the TDO parameter of an SDR command leads to a mismatch the playerissues a warning and continues. If the player should abort in this case thenspecify stop at the svf command.

The absence of error or warning messages indicate that the SVF file wasexecuted without problems. To get a progress reporting while the player advancesthrough the SVF file, specify progress at the svf command.

Limitations and Deficiencies

Several limitations exist for the SVF player.

The implementation of some SVF commands has deficiencies.

  • HIR, HDR commands not supported. Their functionality should be covered by the part concept of UrJTAG.

  • PIO command not supported.

  • PIOMAP command not supported.

  • RUNTEST SCK not supported. The maximum time constraint is not guaranteed.

  • TRST Parameters Z and ABSENT are not supported.

  • TIR, TDR commands not supported. Their functionality should be covered by the part concept of UrJTAG.

SVF files for programming flash-based devices might or might not work for a givensetup. This has been observed for Actel IGLOO devices where success and failuredepends on the actual clocking rate of the chosen cable.

The ref_freq=<…> option to the svf command allows to tweak the calculationof RUNTEST xxx SEC commands. For these commands, the SVF player needs tocalculate the equivalent number of clocks and per default it will use thecurrent cable clock frequency. This can be overridden with the ref_freq optionthat specifies a fixed reference frequency for such calculations.

3.2.7.2. bsdl

The bsdl command is used to set up and test the underlying BSDL subsystem ofUrJTAG.

Whenever detect encounters a new part, a configuration process isstarted. This involves matching the retrieved IDCODE against the partdescriptions in /usr/share/urjtag as described above. However, before thisdatabase is searched for a suitable description, the BSDL subsystem is startedand searches for a BSDL file that matches this device. If it finds a matchingfile, traversal of the /usr/share/urjtag database is skipped. If not, thenthis standard process follows.

To tell the BSDL subsytem where to look for BSDL files, the bsdl pathpathlist command has to be issued prior to detect. The contents ofpathlist must be a semicolon-separated list of directories where BSDL filesare located. This list is stored by bsdl path and is used later on whendetect calls the BSDL subsystem.

The BSDL subsystem applies the first BSDL file that parses withouterrors and that contains the correct IDCODE. Scanning the specifieddirectories happens in exactly the given order. Inside a directory however,the order depends largely on your filesystem’s behavior.

Further details of the bsdl command:

  • bsdl path <path1>[;<path2>[;<pathN>]] set paths for locating BSDL files

  • bsdl debug on|off switches debug messages on or off

  • bsdl test [file] reads file (if specified) or all files found via bsdl path and prints a short status, an active part is not required

  • bsdl dump [file] reads file (if specified) or all files found via bsdl path and prints all configuration commands, an active part is not required

The bsdl dump file command implements the same functionality asbsdl2jtag.

3.2.8. Unsupported commands3.2.8.1. script

Although it’s still there, its functionality has been merged into the includecommand. Please use 'include' instead.

3.2.8.2. setdevice

This command was only there to support the SHARC 21065L processor,which has no IDCODE and therefore can’t be initialized correctly byjust running 'detect'. However, the proper initialization can be doneafter 'detect' by loading the proper declarations and bus driver manually:

3.2.8.3. spiflashmem

The commands 'spidetectflash', 'spiflashmem', 'spireadflash' and'spieraseflash' only exist in a version of the JTAG tools copyrighted byIntratrade Ltd., we just know about them from a posting on the net.

PrevHomeNextUsageUpInternals
Hi
I bought an z3x easy-jtag recently.
The box arrived this week and after I installed it, I tried to read eMMC with it but unsuccessfully.
So now I'm here to ask official developers any help.
To be easier to understand my problem by the support people and by anyone who's facing the same problems I'll try to simplify everything, explain my test conditions and give you images of a log of a phone that I've tried to read. Notice: the phone was fully working before trying to read its eMMC (and is still working, I supose...)
Here we go.
Phone: Samsung Galaxy S4 gt-i9505 (which was perfectly booting and working)
Desktop: Windows 10 x64 Pro + admin rights + driver signature verification disabled + Intel processor + 8GB Ram + 200Mb (upload and download) internet very stable conection
Box Software: Z3X EasyJtag Box Software JTAG Classic Suite ver.2.5.0.6
Box Firmware: 01.58
Configs:
-eMMC Voltage: 2.8 Volt IO
-eMMC CLK Rate: 14MHz
-HiPower CLK Drive Mode = checked
Hardware conditions:
-Samsung original 2A wall charger connected to USB port of logic board
-200 Ohm resistors between CMD / Dat0 and 1.8V testpoint
-Strong/thick wire for Ground connection between box and logic board
-All the Ground pins of the box are connected together
-All the wires have at max 5 centimeters of lenght
Log:
EasyJtag Suite Classic ver.: 2.5.0.6 / wxWidgets 3.1.0-W-U started.
OS ver.: Windows 10 (build 14393), 64-bit edition. Admin rights OK
undefined
Android Explorer ver.: 1.0.0.21
eMMC ODIN ver.: 1.0.11.0
Successfully connected to box on COM26
Box S/N: not important, ,FW Ver.: 01.58
Box Working Mode: JTAG Box.
Box Drivers version: 3.0.1.0, are OK
Z3X Card Serial : not important , ver: 22
Z3X Card Activation [LG] : NOT ACTIVATED
Z3X Card Activation [SAMS] : NOT ACTIVATED
Z3X Card Activation [JTAG] : ACTIVATED
Z3X EasyJtag Software ver. 2.5.0.6
Loading eMMC Addon Firmware... IO: 2800 mV
Box S/N: not important, ,FW Ver.: 01.58
CMD Pullup Level:1753 mV
CMD Active Level:2567 mV
Box IO Level:2800 mV
CLK Rate:14000 khz
HiPower mode is ON!
Can't init device, Reason: CMD Timeout Error
Done.

Check the following images
postimg*org/image/7suikbcsh/
postimg*org/image/se9ac7udd/
>>>>>replace the '*' with a '.'
************************************************** *****
All of the above is a test condition to show to official supporters an example o my test conditions.
Now I'll report all that I have already tried to not let people make me waste my time and their with tips and tricks that I could have already tried:
eMMC reading:
I tried to read eMMC of 1 faulty (not booting) gt-i9205 Galaxy Mega
I tried to read eMMC of 1 faulty (not booting) gt-i9505 Galaxy S4
I tried to read eMMC of 1 great condition' gt-i9505 Galaxy S4
----------With Adapter------------
Using th Red Adapter that arrived inside the box' package that I bought from GSMServer, using the adpater's external power (Vcc adpater's pin to 2.8V logic board's testpoint & VccQ adapter's pin to 1.8V logic board's testpoint)
(the adapter is the one on the right side of the picture)
postimg*org/image/75vlusfwh/
>>>>>replace the '*' with a '.'
----------Without adapter---------
Used USB cable to feed the Logic Board internally + HiPower CLK Drive Mode
#############################################
---------configs possible---------
tried all the combinations of eMMC voltages + eMMC CLK rates (with and without adapter
I tested all of this in the 3 phones that I mentioned above in an Windows 10 x64 Pro Desktop and then repeated all again in another different Windows 7 x86 Pro Desktop
The results were the same
In the 2 desktops I tried serveral Box software + Box firmware (downgrade too)
EasyJtag_Release_v1.0.105.0 (plus respective firmware)
EasyJtag_Release_v1.7.0.1 (plus respective firmware)
EasyJtag_Release_v2.0.5.0 (plus respective firmware)
EasyJtag_Release_v2.5.0.6 (plus respective firmware)
#######################################
JTAG reading:

after all of this I tried to JTAG the gt-i9205 follwing all the instrutions of the most recent 'EasyJtag_Release_v2.5.0.6' software suite. Using the USB cable + battery to power the logic boarfd as sugest by software suite, etc.. just to check if it could be a fault of the box.
Result: none....
Log:
EasyJtag Suite Classic ver.: 2.5.0.6 / wxWidgets 3.1.0-W-U started.
OS ver.: Windows 10 (build 14393), 64-bit edition. Admin ri
For support and updates visit 'no links'
Check security...
OK
Initialising: SAMSUNG GT-I9205 Config ver.:1.00
I/O Level set to : 2200 mV
Box S/N: not important ,FW Ver.: 01.58
Connecting to Target...
Done with error(s)...
What I didn't tried:
I didn't tried to dessolder the eMMC chip and read it directly but I don't see any advantage for me and my clients on that kind of service so I'm not interested in trying too
Last toughts:
For general users: If anyone have any valid sugestion please feel free to leave your answer and share your experience
For developers + official z3x supporters: it would be nice to hear any help from you. And if you think that this box unit can be faulty, please tell me so I can ask for a replacement on GSMServer seller
Best regards for all




Coments are closed