Re: Question about the SMP8634/SMP8635 MIPS processor

[David Daney <ddaney@caviumnetworks.com>]

Cyril HAENEL wrote:
[...]
> The SMP8635 processor comes from Sigma Design and I found on its FTP 
> site a 2.6.15 kernel with associated patches for the SMP863x processors 
> serie.
> 
> My problem is that they doesn't provide the datasheet alone, visibly 
> they provide it with the SMP8634 developement board 
> (http://www.sigmadesigns.com/public/Products/SMP8630/SMP8630_series.html).
> 

In the past the datasheet was only available under NDA...

> And to begin to developp on this board, I need at least to know where is 
> located the JTAG. It will be the starting point to try to access the NOR 
> flash to backup the original firmware, and play with the board.
> I don't see any SPI eeprom/flash thus I think even the boot loader is 
> located the 16MB nor flash, so I thing at startup the processor directly 
> try to execute code from the NOR, maybe at adress 0x0.
> 

The 8634 has an internal 'security' processor that executes code out of 
on-chip flash/RAM.  This security processor boots the main CPU only 
after verifying that the boot loader's cryptographic signatures are 
valid.    Unless the factory firmware is permissive, there is very 
little you can do with it.

> Is someone has some information on this processor ? Or maybe the 
> datasheet ? With the datasheet I will be have to locate the JTAG pin :)

The JTAG is multiplexed with the second serial port.  Often you have to 
change a strapping pin so that JTAG is enabled when the board is powered 
on.  Different boards have a variety of JTAG connectors, you would have 
to search for it on your board.  Generally it is some form of 14 pin 
dual-inline header.

If you haven't already found it, probably the first thing you want to do 
is find primary serial port.  Most configurations print at least a 
couple of lines indicating DRAM configuration before booting.  If you 
are lucky you may be able to get to a YAMON prompt from the serial port.

The zboot loader may read a character from the serial port. '0', '1', 
'2', and '3' will override the default boot image.


David Daney