[DEV] Acer JTAG Pin Outs [WIP]

darkspr1te · Dec 19, 2013

Hi All
I recently bricked my Acer A210 and it's running in APX mode. In a effort to bring it back to life i have been researching the jtag setup.

As you can see from this image, on the rigth hand side is JDBUG1, with pin 1 mark at the top.
Now this is a A510 in the image, but the same 10 pin connect is on my A210 and possibly on the A700,

Now using many different tegra3 manuals and dev board guides i've reversed the jtag connector, well mostly, I've some more to confirm but i though i would put this out there in case any one has any thing to add, i will also upload as much info as i have and the pdf in case any one want to confirm my research,

Hopefully we can fix without $$$$ hardware.

I have a o'scope (30 years old crt based) ,arduino, buspirate, Open Source logic sniffer.
The latter two from dangerous prototypes, the main one i will use is the bus pirate in jtag mode.

I have already connected the buspirate up but no results i could rely on so i went back to research, here is what i've turned up ,

Code:

1 1.8v Tegra System Voltage
2 TRST (on A210 a 0R resistor is missing or 'un-stuffed' or not 'stuffed', see info about tying to gnd for CPU access )  
3 10K to +v 1.8v for TDI
4 10K to +v 1.8v for TMS
5 100K to GND for TCK
6 10K to GND for RTCK (Return clock , see [URL="http://en.wikipedia.org/wiki/Joint_Test_Action_Group"]RTCK wiki[/URL] ) 
7 TDO (direct into CPU )
8 HOT_RESET (1.8v)
9 ON_KEY# (+5v )
10 GND

Now this information has been gleamed from many sources.
please see attached images for now, on the A210 the tracks are more exposed but I think its safe to assum the debug connector pin outs would be the same for the 3 devices,

EDIT** Ive found the A510 Schematic Online A510 Schematic - See Page 7 for JTAG

darkspr1te

darkspr1te · Dec 19, 2013

<place holder for additional files>
Various Tegra(3) Files

Tegra Files / Manuals / PDFs ETC

herogjan · Dec 21, 2013

Very interesting stuff, unfortunately my knowledge is not sufficient to contribute. But i'll definitely follow this topic, hope you can fix it.

Always an awesome moment went you succeeded "DIY" without spending big bucks.

darkspr1te · Dec 23, 2013

herogjan said:
Very interesting stuff, unfortunately my knowledge is not sufficient to contribute. But i'll definitely follow this topic, hope you can fix it.

Always an awesome moment went you succeeded "DIY" without spending big bucks.

Yes, when We have that eureka moment and it works it's a great feeling, sadly I am not having that moment yet with the Acer. But I wont give up.
I am taking a break from the actual JTAG hacking part for Xmas and just to give myself a break from IT, I will return to the project in the new year.

Darkspr1te

imtheyoyo · Dec 23, 2013

What can we do with JTAG on our Acer Axxx ?

Envoyé de mon GT-I9505 en utilisant Tapatalk

Dc0de · Dec 24, 2013

imtheyoyo said:
What can we do with JTAG on our Acer Axxx ?

Envoyé de mon GT-I9505 en utilisant Tapatalk

We will be able to turn it into the most powerful tablet and take over the world *evil laugh*. Or we could recover our bricked tablets that are in apx mode like he said in post 1.

Sent from my A701 using Tapatalk

darkspr1te · Dec 24, 2013

Hi All,
I've made some progress

Code:

> scan_chain 
   TapName             Enabled  IdCode     Expected   IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
 0 tegra3.arm             Y     0x330173d7 0x330173d7     2 0x01  0x01
> jtag init 
JTAG tap: tegra3.arm tap/device found: 0x330173d7 (mfg: 0x1eb, part: 0x3017, ver: 0x3)
> halt
Halt timed out, wake up GDB.
timed out while waiting for target halted
in procedure 'halt'

Cant get cpu to halt, could be due to many things, am i taking to the right core? it the jtag instructions i am sending the right ones for the arm/corex cores
right now, I dont know, most users dont document building the jtag instruction up so it's going to be new for me.

darkspr1te

darkspr1te · Dec 24, 2013

Hi All,
I've made some progress

Code:

> scan_chain 
   TapName             Enabled  IdCode     Expected   IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
 0 tegra3.arm             Y     0x330173d7 0x330173d7     2 0x01  0x01
> jtag init 
JTAG tap: tegra3.arm tap/device found: 0x330173d7 (mfg: 0x1eb, part: 0x3017, ver: 0x3)
> halt
Halt timed out, wake up GDB.
timed out while waiting for target halted
in procedure 'halt'

Cant get cpu to halt, could be due to many things, am i taking to the right core? it the jtag instructions i am sending the right ones for the arm/corex cores
right now, I dont know, most users dont document building the jtag instruction up so it's going to be new for me.

EDIT** Seems what I am looking at here is the JTAG Route controller (similar to TI's ICEPICK router controller) but as I have not information yet on how to shift the router controller I am lost, Anyone got any input ?

for the ICEPICK it does the following commands to setup the router controller

Code:

# Utilities for TI ICEpick-C ... used in DaVinci, OMAP3, and more.

# jrc	== TAP name for the ICEpick
# port	== a port number, 0..15
proc icepick_c_tapenable {jrc port} {

	# NOTE:  it's important not to enter RUN/IDLE state until
	# done sending these instructions and data to the ICEpick.
	# And never to enter RESET, which will disable the TAPs.

	# select router
	irscan $jrc 7 -endstate IRPAUSE
	drscan $jrc 8 0x89 -endstate DRPAUSE

	# set ip control
	irscan $jrc 2 -endstate IRPAUSE
	drscan $jrc 32 [expr 0xa0002108 + ($port << 24)] -endstate DRPAUSE

	irscan $jrc 0x3F -endstate RUN/IDLE
	runtest 10
}

Now i dont know if the Tegra3 has it's own route controller an how it's programmed/setup
This is my first time into JTAG so it's a massive learning curve,
I am assuming that once i send the tegra3 the correct IRSCAN/DRSCAN jtag codes it will setup access in to the device further.

EDIT **
Some additional information I am still trying to understand/process, it's from tegra2 but one could assume it's valid for tegra3 as a lot of what i've turned up has been the case. This excludes security
based information

Code:

 Note that in the circuit in Figure 24, there is an optional resistor on JTAG_TRST_N. For normal JTAG operation, this resistor
should not be present. The JTAG_TRST_N pin on the Tegra 250 selects whether the JTAG interface is to be used for
communicating with the Tegra 250 CPU complex, or for Test/Scan purposes. When JTAG_TRST_N is pulled low, the JTAG
interface is enabled for access to the CPU complex. When high, it is in Test/Scan mode.
When used in the normal operating mode to access the internal CPUs, in order to reset the Tegra 250 JTAG block, a reset
command is used rather than toggling the JTAG_TRST_N pin.

darkspr1te

darkspr1te · Dec 24, 2013

imtheyoyo said:
What can we do with JTAG on our Acer Axxx ?

Envoyé de mon GT-I9505 en utilisant Tapatalk

Right now, with current public information, Nothing. But Who knows what it may turn up, access to SBK maybe? I dont know, I am not that level of expert, but it may turn up some interesting stuff. it may allow users to debrick devices (hopefully)

darkspr1te · Dec 26, 2013

Let me start todays post off with a small request,
if anyone knows of a guide to using openocd/buspirate to investigate a jtag connection that is totally unknown then please post a link here,
I have read billions (well maybe dozens) of ducuments talking about boundry scans, config files, jtag route controllers but it seems almost none show you, they all are the same, they talk about in a vague way that your already ment to know what they are on about. Gah.

Anyway, i've ran some irscan/drscan commands and i've really got no where, i am confirming that keeping TRSRT high gives you the IDCODE of 0x330173d7 and if low then it errors out and you get all zeros,
ive found some tegra2 setup files for a jtag system called BDI-x0000 and they include a lot of info on the registers which are similar if not the same as tegra3, but the IDCODE is different and it's a different language to openocd, again plenty of documents hint at it being a simple conversion but i dont see it, maybe a case of 'cant see the wood for the trees' but it's not for noobs, which drives me a little insane,

Has anyone seen any docs of nexus 7 jtag ? i mean it's operation/setup not pin outs, i've got copies of that info but not actual irscan/drscan codes or anything.

Well I hope someone can provide a little input.

darkspr1te

darkspr1te · Dec 27, 2013

Let me start todays post off with a small request,
if anyone knows of a guide to using openocd/buspirate to investigate a jtag connection that is totally unknown then please post a link here,
I have read billions (well maybe dozens) of ducuments talking about boundry scans, config files, jtag route controllers but it seems almost none show you, they all are the same, they talk about in a vague way that your already ment to know what they are on about. Gah.

Anyway, i've ran some irscan/drscan commands and i've really got no where, i am confirming that keeping TRSRT low gives you the IDCODE of 0x330173d7 and if high then it errors out and you get all zeros,
ive found some tegra2 setup files for a jtag system called BDI-x0000 and they include a lot of info on the registers which are similar if not the same as tegra3, but the IDCODE is different and it's a different language to openocd, again plenty of documents hint at it being a simple conversion but i dont see it, maybe a case of 'cant see the wood for the trees' but it's not for noobs, which drives me a little insane,

Has anyone seen any docs of nexus 7 jtag ? i mean it's operation/setup not pin outs, i've got copies of that info but not actual irscan/drscan codes or anything.

Well I hope someone can provide a little input.

darkspr1te

And i am double posting again.

darkspr1te · Jan 2, 2014

After trying to deal with Acer to resolve the APX issue this is what hapnned

Code:

 Sunil: Hi, my name is Sunil. How may I help you?
 darkspr1te: hello
 Sunil: Hello, darkspr1te.
 darkspr1te: Hi Sunil, happy new year
 darkspr1te: I have a Acer A210 that stopped booting, windows detects it as a Nvidia APX device 
 Sunil: Thank you and same to you.
 Sunil: I am sorry to know about the issue.
 Sunil: Do not worry. I will do my best to resolve the issue.

 Sunil: I have the SNID number as 23203532115, is it correct?

 darkspr1te: One sec let me double check 
 darkspr1te: yes that is correct 
 Sunil: Thank you for the confirmation.
 darkspr1te: so what is the way forward ?
 Sunil: In order to help you in a better way, please let me know the name of the country you reside now.

 Sunil: Sure, I will help you in this regard.
 Sunil: In order to help you in a better way, please let me know the name of the country you reside now.

 darkspr1te: i am currently in Zambia, Ive tried for the past two weeks to get support from South Africa which is the closest agent to where I am, please dont tell me that i can only deal with them, they dont answer emails or live chat (i have screen shots and email logs to show this)
 Sunil: I am sorry for that.
 darkspr1te: so what is the way forward ?
 Sunil: Your chat has come through to the Acer UK Support; hence, we are unable to assist with your enquiry. 
We are able to assist UK customers with technical queries for products covered under warranty. 

 Sunil: Please click on the link below and select your country. You will then be directed to your local Acer website with the Service and Support section, containing contact details for your local Acer service centre.

Here is the weblink:  http://www.acer.com/worldwide/support/

 darkspr1te: Suni, ive tried that link, i've got nowhere, please I am begging you  to help 
 Sunil: I completely understand your concern, darkspr1te. We are able to assist UK customers with technical queries for products covered under warranty. 

 darkspr1te: I am a uk customer, I carry a british passport, I can trace my family back 150 years in uk and I purchased the device in UK. what more do you need? 
 darkspr1te: I am only out of the country on work.
 Sunil: darkspr1te, from our records, I see the unit is purchased in Zambia. We cannot pull any information of the unit.
 darkspr1te: Thats impossible, I personally purchased it in Portsmouth , we have NO ACER agent or reseller here in Zambia
 Sunil: I am sorry for that.
 darkspr1te: Please I am begging you, just give me My Secure Boot key for the device that I purchased and own, i can deal with the rest my self 
 Sunil: Please be online for 2 minutes while I check the information on your query.

 darkspr1te: thansk you 
 Sunil: Thank you.
 Sunil: Thank you for staying online. I appreciate your patience.

 Sunil: darkspr1te, please let me know the exact issue with the unit to assist you in a better way.

 darkspr1te: The unit does not boot, it is only detectedd in windows as Nvidia APX device
 Sunil: Alright.
 darkspr1te: prior to that it rebooted while watching a movie and in the top left it said fastboot error 
 Sunil: Okay.
 Sunil: darkspr1te, I have checked my records, We cannot come to a conclusion regarding the fault without the unit being physically diagnosed by the technician. I request you to contact South Africa Acer support for more information.

 darkspr1te: Then can you please provide me with my Secure Boot key for the device so I can resolve the issue myself. 
 Sunil: I am so sorry, We do not have such information available.
 Sunil: Is there anything else I may help you with?     

 darkspr1te: actually thats not true,I have a contact in uk who used to work with acer support and he said you can send a BCT config file which is keyed with my boot key and only usable on my device, sadly he left acer otherwise it would be him i would be talking to 
 Sunil: darkspr1te, If we had the options, we would have definitely helped you. we hope you can understand the situation.

 darkspr1te: using the BCT file and nvidia NVFLASH i can fix my device in seconds 
 Sunil: We do not have such information available.
 Sunil:  I request you to contact South Africa Acer support for more information.

 darkspr1te: then who does 
 Sunil: Is there anything else I may help you with?     

 darkspr1te: south africa HAVE NOT responded at all 
 Sunil: We are able to assist UK customers who reside in UK with technical queries for products covered under warranty. 

 darkspr1te: fine
 Sunil: I request you to contact South Africa Acer support for more information.

 Sunil: Is there anything else I may help you with?     

 darkspr1te: you're joking right ?
 Sunil: darkspr1te, If we had the options, we would have definitely helped you. we hope you can understand the situation.

 darkspr1te: No I dont understand, I dont know why I have a device that I cannot use because Acer is withholding the key to my own device 
 darkspr1te: you i had a nexus 7 with same tegra3 cpu and they gave me the secure key within a day of me reqquesting it 
 Sunil: darkspr1te, you have contacted Acer UK hardware technical support department and we do not have such information available with us. I request you to contact South Africa Acer support for more information.

 Sunil: It was a pleasure working with you. Thank you for contacting Acer live chat. Have a nice day.

I will no longer recomend acer devices, I am pulling my github files for the acer as I dont want to be responsable for bricking someone else's device either. I just hope that someone at acer reads this and knows how useless chat/email support is.

darkspr1te

darkspr1te · Jan 2, 2014

Another support agent in south africa, who after 3 hours of contant hello's finally answered.

Code:

 Jacques: Hi, my name is Jacques. How may I help you?
 darkspr1te: hello
 darkspr1te: hello, is there anyone there 
 Jacques: yes can we help you?
 darkspr1te: i have a acer A210 and it's not booting , i was watching a video and it rebooted, in the top left it said fastboot error and now windows only detects Nvidia APX device 
 Jacques: you will have to restore the operating system
 darkspr1te: ok, 
 darkspr1te: how do i do that ?
 Jacques: you can send it in for repair so we can reflash the device
 darkspr1te: Jacques, I am currently not in a situation where that can be done, please I am begging you to assist me with my secure boot key so i can do it, I've sent two tablets to south africa in the past, first one stolen, second one came back still broken ( at the cost of the tablet), i cant afford the third. 
 darkspr1te: i know using nvflash and the BCT file thats linked to my secure boot key will fix the device 
 Jacques: we do not supply the files available for download on any of our sites , so to get assistance you will have to send it for repairs
 darkspr1te: but I cant, please, i am begging. 
 darkspr1te: hello, are you still there 
 Jacques: I'm here
 Jacques: unfortunately nothing more I can assist with as the files you looking for is not available for downbload
 darkspr1te: Please Jacques, I am only asking for the key to my own device, 
 darkspr1te: i can give you the URL for acer Tiawan where acer support perrsonell get the key from 
 darkspr1te: but as i dont have a acer login account i cant get the key for my device 
 darkspr1te: if i had the key i can just use NVFLASH to fix in seconds
 darkspr1te: all you need is the CPUID 
 darkspr1te: which is androidboot.serialno=015d256487300205
 darkspr1te: ?
 darkspr1te: are you still there 
 darkspr1te: hello
 darkspr1te: hello
 darkspr1te: hello
 darkspr1te: anyone there ?

That was support in south africa
darkspr1te

darkspr1te · Jul 1, 2014

Hi All,
i recently picked up this project again, I've got some new doc's and info but as yet no solution.

My current thinking is to attack the emmc, to which ive produced some photo doc's to upload.

In the first picture is the underneath of the emmc,
Red is CLK or clock
Yellow is CMD or command
light blue is VSS @ 1.8v
red border shows the outline of the emmc chip on the otherside of the pcb. see the picture called blend for a blended view of the same.

My current thinking is the emmc has failed or locked up, why ? well on the clock and cmd lines i get a nice clear trace on my logic sniffer and scope,
Now looking at the the picture called marked, look in the bottom right of the red box, those resistors more or less lighn up with the DAT0/7 pins but i do not get any signal at all from them with the scope. The system outputs CMD's down the CMD line to the emmc at power on, that and the clock can clearly be seen on the scope.

I have also referred to the a510 schema and emmc pins are ment to be the following on the T30 cpu
Dat0 - B6 (z = floating)
CLK - F8 z
CMD - H10 z
i have hunted around this area with the scope and found nothing.
from the SMARC sAT30 manual, it says the following for the EMMC
Either A:
DAT0 - K1 (pu = pull up)
CMD -N6 pu
CLK - M6 pu
or B:
DAT0 L27
CMD - J29
CLK - G30

both location have not shown either clk/cmd or a response from DAT0. Still more research to do.
last time i buy a tegra i can tell you. damn locked up piece of sh!t.

darkspr1te

Edit: I forgot to add the specs for the EMMC

Samsung KLMAG2GE4A
PDF attached
Futher reading ont this emmc at ps3wiki http://www.psdevwiki.com/ps3/KLMAG2GE4A-A001

darkspr1te · Jul 1, 2014

More pictures Of EMMC

darkspr1te · Jul 2, 2014

Final group of pictures

E:V:A · Jul 3, 2014

WTF! That eMMC is really blank! Do you have any info on that? Can you do anything to it's surface to see what it says?

Also, on the OP schematics there's a "UART debug" port. What's on that?

Tom_Perman · Feb 11, 2015

I am having a similar issue using JTAG on a Tegra 2 device.

Would it possible for you to post the Tegra 2 documentation you have?

darkspr1te said:
EDIT **
Some additional information I am still trying to understand/process, it's from tegra2 but one could assume it's valid for tegra3 as a lot of what i've turned up has been the case. This excludes security
based information

Code:

Note that in the circuit in Figure 24, there is an optional resistor on JTAG_TRST_N. For normal JTAG operation, this resistor should not be present. The JTAG_TRST_N pin on the Tegra 250 selects whether the JTAG interface is to be used for communicating with the Tegra 250 CPU complex, or for Test/Scan purposes. When JTAG_TRST_N is pulled low, the JTAG interface is enabled for access to the CPU complex. When high, it is in Test/Scan mode. When used in the normal operating mode to access the internal CPUs, in order to reset the Tegra 250 JTAG block, a reset command is used rather than toggling the JTAG_TRST_N pin.

darkspr1te

darkspr1te · Feb 12, 2015

Tom_Perman said:
I am having a similar issue using JTAG on a Tegra 2 device.

Would it possible for you to post the Tegra 2 documentation you have?

I can tell that you will find the most useful docs via baidu
also search for terga2 and terga3, some docs were misspelled.

I will post any documentation i've created if I can find it, i've recently moved a lot of data to archive that i was not working on, the acer stuff was among it .
How far along are you jtag wise? any comms with the chips ?
darkspr1te

protektwar · Jun 9, 2021

Tom_Perman said:
I am having a similar issue using JTAG on a Tegra 2 device.

Would it possible for you to post the Tegra 2 documentation you have?

Do you have a photo with your JTAG connection? which acer is it?

[DEV] Acer JTAG Pin Outs [WIP]

Senior Member

Attachments

Senior Member

Senior Member

Senior Member

Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Attachments

Senior Member

Attachments

Senior Member

Attachments

Inactive Recognized Developer

New member

Senior Member

New member

Similar threads

Top Liked Posts