Hydev

This is an old revision of the document!

---

# JTAG access

## Overview

As detailed on the Schematic (released in the FCC documents), the Nabaztag:tag board breaks out the JTAG port. Let's see how to use it to access the CPU to be able to flash and debug some code !

## Hardware

### JTAG probe: BusBlaster

I think you can use any JTAG probe that's 3.3v compatible, if you have one. If you don't, I recommend the [BusBlaster v3](http://dangerousprototypes.com/docs/Bus_Blaster_v3_design_overview). It's a great board, versatile and cheap; oh ! and it's also open hardware and open source !

On of the best features of the BusBlaster is you can reconfigure the CPLD to emulate any FT2232 JTAG probe. I think it comes pre-programmed with a JTAGkey buffer logic, which should work fine for this application.

_Note_: My BusBlaster (a v4 !) uses a KT-link buffer logic, because I needed the SWD capabilities for another application. If the following steps don't work, try to reprogram the CPLD with a KT-link buffer and try again !

You also need some jumper wires (also called _Dupont wire_ sometimes) F/F to connect the BusBlaster to the Nabaztag

### Nabaztag:tag

Well, of course you need a Nabaztag:tag ( a version 2 ). You also must be ready to open it.

Grab a small flat screwdriver and remove the four screws on the base. You can also use a triangle screwdriver if you happen to have one, I don't.

And this is about it. the JTAG header is on the top left corner of the board.

Pinout is the following (top to bottom):

## Software: OpenOCD

### Patch and compile OpenOCD

The Nabaztag:tag uses a ML67Q4051 micro-controller which is not on the supported hardware list of OpenOCD. It's an ARM7TDMI variant, so I thought it should be possible to use it. I spent some time hacking code and I eventually ended up with a patch good enough to:

- access the CPU registers, which means debug is possible ! - read and write the Internal flash

1. First version was slow as hell: 5 to 10 minutes to read/write the whole flash
2. Second version is much better: under 5 seconds. I had to write ARM assembler code to be run from RAM to write the Flash, which was a rather painful but interesting experience…

So ! Download OpenOCD 0.8.0 from their website, or here (mirror): openocd 0.8.0

Download the patch: openocd_0.8.0_oki

#### Prepare

  sudo aptitude install libtool autoconf automake libusb-1.0-0-dev
  
  gzip -d openocd_0.8.0_oki.patch.gz
  tar xzvf ./openocd-0.8.0.tar.gz

#### Patch

  cd openocd-0.8.0/
  patch -p1 < ../openocd_0.8.0_oki.patch
  

#### Compile

  autoreconf -fi
  ./configure
  make
  

### Usage

## Pictures

## Links