FTAbox ref. 441328 ::: FULL.ABS :::

ALI  JTAG  USER’S  GUIDE

1, install USB driver
    a, release the compressed file “ALIUSB29.rar” to your computer, here we suppose release it to driver D:
b, plug the JTAG tool into your computer USB jack and install the USB driver, the driver(BulkUsb.Inf) file is under the directory “D:\ALIUSB29\DRIVER\”.
2, how to burn a binary file into a STB
a, cut off the STB power supply.
b, connect the STB and computer with JTAG tool,
c, turn the STB to DEBUG mode.
d, put your binary file(suppose the file name is AV.abs) to be burn into the STB under the directory “D:\ALIUSB29\”
e, turn on the STB.
f, run MS-DOS, and enter the directory “D:\ALIUSB29\”
g, enter the burn command “flashwr.bat  AV.abs”
    D: \ALIUSB29> flashwr.bat  AV.abs
Then you can see the information below:

ALi flash writer, version 1.0.1
    Get target setting from "sdram_config.txt"...
    Reset EJTAG...OK
    USB ICE Card Firmware version is 1.0.0
    USB ICE Card Driver version is 1.0.0
    Please reset the RISC...OK
    Init SDRAM with default flow!
    Clear both I/D caches

    Download tool file "flashwr.abs" to ram...Download success!
    Download binary file "AV.abs" to ram...Download success!
    Excecute tool to write flash, length 524288 (0x80000)...

    Binary Length: 0x200000 CRC: FC58DCAB
    00000000 OK
    00004000 OK
    00006000 OK
    00008000 OK
    00010000 OK
    00020000 OK
    00030000 OK
    00040000 OK
    00050000 OK
    00060000 OK
    00070000 OK
    00080000 OK
    00090000 OK
    000A0000 OK
    000B0000 OK
    000C0000 OK
    000D0000 OK
    000E0000 OK
    000F0000 OK
    00100000 OK
    00110000 OK
    00120000 OK
    00130000 OK
    00140000 OK
    00150000 OK
    00160000 OK
    00170000 OK
    00180000 OK
    00190000 OK
    001A0000 OK
    001B0000 OK
    001C0000 OK
    001D0000 OK
    001E0000 OK
    001F0000 OK
    Burn 00200000 OK
ICE closed!

Binary file burn complete, turn the STB to normal mode and reboot it.

Tips:
If there is any bug during the burning process, try to remove the JTAG tool from your computer then plug it in, and, turn on/off the STB, then burn the binary file once again.

nTRST  1  2 GND
TDI    3  4 GND
TDO    5  6 GND
TMS    7  8 GND
TCK    9 10 GND
nSRST 11 12 -key
DINT  13 14 VCC

 EJTAG utilizes 5-pin interface defined in IEEE 1149.1 JTAG specification for off-chip communications. These signals (TDI, TDO, TMS, TCK and nTRST) forms a Test Access Port (TAP).

EJTAG specification 1.5.2 and 2.0 call for dual row male male header with 0.05"x0.05" spacing

EJTAG 2.5 and later defines a dual row 14-pin male header (mechanical connector) with 0.1"x0.1" spacing to attach a JTAG probe. 3M part number 2414-600UB is recommended. 

DINT pin is used to raise Debug Interrupt. Many chips has no this pin.

nTRST is a "TAP Reset" signal and it's active level is "0" (the first "n" indicates negative logic). nSRST is optional. This signal resets TAP controller independently from the CPU logic. To conform to MIPS EJTAG specifications this pin should be pulled to the ground via resistor ~1KOhm to keep TAP in reset state w/o probe attached. If probe does not control this pin, you need just to feed logical "1" to nTRST pin or pull this to the +VCC via ~300Ohm resistor.

nSRST is a "system reset" signal and acts like conventional "Reset' button. Does not reset TAP controller.

Acerca da pinagem esquema oficial:

MIPS – EJTAG 2.5
There are many MIPS OCD headers in use. 
This is the one specified by MTI for EJTAG 2.5

TRST\ i 1 2 p GND
TDI i 3 4 p GND
TDO o 5 6 p GND
TMS i 7 8 p GND
TCK i 9 10 p GND
RESET\ oc 11 12 k key
DINT i 13 14 p TVcc

Pin Specifications:
Pins are identified by number and type.
·  o = output from target processor to OCD interface
·  i = input to target processor from OCD interface
·  p = power pin
·  oc = open collector driven from OCD interface, either floating or actively held
low
·  nc = not connected, ie: not driven nor read by OCD interface
·  k = key, pin is typically missing from the target board

/*
 * The followint table shows the pin assignment of 25-pin  Parallel Printer Port.
 * please refer to IEEE 1284 standard for detailed description.
 * data port (Out)                  status port (In)
 * bit[7] -- pin9 (Out)         bit[7] -- pin11 (In), busy (Hardware Inverted)
 * bit[6] -- pin8 (Out)         bit[6] -- pin10 (In), Ack
 * bit[5] -- pin7 (Out)         bit[5] -- pin12 (In), Paper out
 * bit[4] -- pin6 (Out)         bit[4] -- pin13 (In), Select
 * bit[3] -- pin5 (Out)         bit[3] -- pin15 (In), Error
 * bit[2] -- pin4 (Out)         bit[2] -- IRQ(Not)
 * bit[1] -- pin3 (Out)         bit[1] -- Reserved
 * bit[0] -- pin2 (Out)         bit[0] -- Reserved
 */

// --- Xilinx Type Cable ---
#define TDI     0  // Pin2
#define TCK     1  // Pin3
#define TMS     2  // Pin4
#define TDO     4  // Pin13

// --- Wiggler Type Cable ---
#define WTDI      3  // Pin5
#define WTCK      2  // Pin4
#define WTMS      1  // Pin3
#define WTDO      7  // Pin11
#define WTRST_N   4  // Pin6

// **************************************************************************
//
//  FLAPS.C - MIPS EJTAG Flash Utility  v1.2
//
//  Note:
//  This program is for programming Flash chips connected to MIPS CPU's with EJTAG support.
//
//  Spider's STB edition. Fork of HairyDairyMaid's wrt54g debricker
//  renamed to FLAPS  (FLAsh-miPS).
//
//  New for v1.2 -  Added the following New Switch Options
//                     - /xeloa ...... ... use xeloa non standar cable.
//                     - /port ........... in Windows select lpt port
//                - Miscellaneous code cleanups.
//                - Display more info in "-probeonly"
//
//  New for v1.1 - Added 2 new Flash Chip Parts to the list:
//                     - SST39VF1681  2Mx8 BotB     (2MB)
//                     - Fixed manual select flash.
//                     - Added "-probeonly:custom" custom window of flash.
//

#define FLASHTYPE_400B          1
#define FLASHTYPE_400T          2
#define FLASHTYPE_800B          3
#define FLASHTYPE_800T          4
#define FLASHTYPE_160B          5
#define FLASHTYPE_160T          6
#define FLASHTYPE_040           7
#define FLASHTYPE_802           8
#define FLASHTYPE_802T          9
#define FLASHTYPE_39040         10
#define FLASHTYPE_39080         11
#define FLASHTYPE_39016         12
#define FLASHTYPE_39088         13
#define FLASHTYPE_39168         14
#define FLASHTYPE_K8D1716B      15
#define FLASHTYPE_K8D1716T      16
#define FLASHTYPE_S29AL032D_00  17
#define FLASHTYPE_S29AL032D_03  18
#define FLASHTYPE_S29AL032D_04  19
#define FLASHTYPE_SF_SST25VF016B 0x81

/* Used to define flash speed, length is 1 byte
 * size:					bit 7~6		0:512K / 1: 1M / 2: 2M / 3: 4M
 * speed:					bit 5~0
 */
#define HW_SET_FLASHSPEED		0x40
#define FLASH_SIZE_MASK			0xc0
#define FLASH_SPEED_MASK		0x3f


/* Storage */
#define	SST39016                (LLD_DEV_TYPE_STO + 1)
#define	SST39080                (LLD_DEV_TYPE_STO + 2)
#define	SST39040                (LLD_DEV_TYPE_STO + 3)
#define AM29160B				(LLD_DEV_TYPE_STO + 4)
#define AM29160T				(LLD_DEV_TYPE_STO + 5)
#define AM29800B				(LLD_DEV_TYPE_STO + 6)
#define AM29800T				(LLD_DEV_TYPE_STO + 7)
#define AM29400B				(LLD_DEV_TYPE_STO + 8)
#define AM29400T				(LLD_DEV_TYPE_STO + 9)
#define AM29016					(LLD_DEV_TYPE_STO + 10)
#define AM29080					(LLD_DEV_TYPE_STO + 11)
#define AM29040					(LLD_DEV_TYPE_STO + 12)
#define	AT24C16                 (LLD_DEV_TYPE_STO + 13)

#define FLASH_FAST_READ_EN()	*((volatile UINT8 *)(0xb8000099)) = (0x4D)
#define FLASH_FAST_READ_DIS()	*((volatile UINT8 *)(0xb8000099)) = (0x0D)

#define UART_SPEED_NORMAL   115200	
#define UART_HIGH_SPEED_2M  0x200000
#define UART_HIGH_SPEED_6M  0x600000

#define INT_IP2_MASK     0x00000400      /* IP(2) IR */
#define INT_IP3_MASK     0x00000800      /* IP(3) Decoder(M3323) */
#define INT_IP4_MASK     0x00001000      /* IP(4) Servo(M3355), SCI(M3325) */
#define INT_IP5_MASK     0x00002000      /* IP(5) CSCI */
#define INT_IP6_MASK     0x00004000      /* IP(6) DMA(M3355), Watch-dog(M3325) */
#define INT_IP7_MASK     0x00008000      /* IP(7) Timer */