[U-Boot] BDIxxxx and others...

[U-Boot] BDIxxxx and others...

[ksi at koi8.net]

I see you guys talking about BDI3000 and I decided to ask a related
question.

Those who happen to own MPC8548CDS or something like this know it comes with
a small box called CodeWarrior USB TAP.

It is supposed to work with their software one has to pay for. I never used
anything but GCC suite for anything GCC supports and always tried to avoid
commercial tools like a plague. So I want to ask if somebody knows if there
are any free tools for that thing...

Not that I really need it for something but it is sitting in the box
gathering dust and it would be nice ot somehow put it to do something...

---
******************************************************************
*  KSI at home    KOI8 Net  < >  The impossible we do immediately.  *
*  Las Vegas   NV, USA   < >  Miracles require 24-hour notice.   *
******************************************************************

[U-Boot] BDIxxxx and others...

[David Hawkins]

> I see you guys talking about BDI3000 and I decided to ask a related
> question.
> 
> Those who happen to own MPC8548CDS or something like this know it comes with
> a small box called CodeWarrior USB TAP.
> 
> It is supposed to work with their software one has to pay for. I never used
> anything but GCC suite for anything GCC supports and always tried to avoid
> commercial tools like a plague. So I want to ask if somebody knows if there
> are any free tools for that thing...
> 
> Not that I really need it for something but it is sitting in the box
> gathering dust and it would be nice ot somehow put it to do something...

I've wondered the same thing. But didn't manage to find
anything out there. I've got three ... in the boxes
the Freescale MDS boards came in.

The USB-TAP has a PowerPC processor in it ... so even if you
had to blow away the original firmware, I'm sure it wouldn't
be too hard to figure out what code would be required to
make the device look like a USB debugger, and then create
a set of USB commands to generate JTAG transactions.

I think the main problem is getting the JTAG TAP codes
for manipulating JTAG. I've never seen a document relating
to that, so they are obviously NDA.

That being said, a weekend with a logic analyzer on a
BDI2000 JTAG connection would probably give you all the
info you need to figure out the appropriate JTAG
commands.

I've wired up the COP connection on my board via an FPGA,
so that I could conceivably use the PowerPC JTAG via
PCI. However, its the lack of open documentation on the
JTAG commands that has limited my interest in pursuing
this. However, it would be simple to use that interface
to log all JTAG transactions, to figure out all the
JTAG TAP instructions.

Cheers,
Dave

[U-Boot] BDIxxxx and others...

[Leon Woestenberg]

Hello,

On Wed, Jun 17, 2009 at 1:24 AM, David Hawkins<dwh@ovro.caltech.edu> wrote:
>
> I've wired up the COP connection on my board via an FPGA,
> so that I could conceivably use the PowerPC JTAG via
> PCI. However, its the lack of open documentation on the
> JTAG commands that has limited my interest in pursuing
> this. However, it would be simple to use that interface
> to log all JTAG transactions, to figure out all the
> JTAG TAP instructions.
>
There has been shown interest on the OpenOCD mailing list (last week
or so) to reverse engineer the PowerPC COP JTAG commands, so that
OpenOCD could support PowerPC architectures as well.

Regards,
-- 
Leon

[U-Boot] BDIxxxx and others...

[David Hawkins]

Hi,

> There has been shown interest on the OpenOCD mailing list (last week
> or so) to reverse engineer the PowerPC COP JTAG commands, so that
> OpenOCD could support PowerPC architectures as well.

If there is a developer on that list in need of
hardware, give him my email, and I can send one
of the USB-TAP units I have.

Cheers,
Dave

[U-Boot] BDIxxxx and others...

[Wolfgang Denk]

Dear David Hawkins,

In message <4A382998.4010300@ovro.caltech.edu> you wrote:
> 
> The USB-TAP has a PowerPC processor in it ... so even if you
> had to blow away the original firmware, I'm sure it wouldn't
> be too hard to figure out what code would be required to
> make the device look like a USB debugger, and then create
> a set of USB commands to generate JTAG transactions.
> 
> I think the main problem is getting the JTAG TAP codes
> for manipulating JTAG. I've never seen a document relating
> to that, so they are obviously NDA.

Right. Implementing some JTAG access routines is not that  difficult.
Implementing  debug support requires you to sign a NDA which prevents
you from developing any free software from it.

Best regards,

Wolfgang Denk

-- 
DENX Software Engineering GmbH,     MD: Wolfgang Denk & Detlev Zundel
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
In any group of employed individuals the only naturally  early  riser
is  _always_  the office manager, who will _always_ leave reproachful
little notes ... on the desks of their subordinates.
                                - Terry Pratchett, _Lords and Ladies_

[U-Boot] BDIxxxx and others...

[ksi at koi8.net]

On Wed, 17 Jun 2009, Wolfgang Denk wrote:

> Dear David Hawkins,
> 
> In message <4A382998.4010300@ovro.caltech.edu> you wrote:
> > 
> > The USB-TAP has a PowerPC processor in it ... so even if you
> > had to blow away the original firmware, I'm sure it wouldn't
> > be too hard to figure out what code would be required to
> > make the device look like a USB debugger, and then create
> > a set of USB commands to generate JTAG transactions.
> > 
> > I think the main problem is getting the JTAG TAP codes
> > for manipulating JTAG. I've never seen a document relating
> > to that, so they are obviously NDA.
> 
> Right. Implementing some JTAG access routines is not that  difficult.
> Implementing  debug support requires you to sign a NDA which prevents
> you from developing any free software from it.

OK, so it is going to be a door stop :)

---
******************************************************************
*  KSI at home    KOI8 Net  < >  The impossible we do immediately.  *
*  Las Vegas   NV, USA   < >  Miracles require 24-hour notice.   *
******************************************************************

[U-Boot] BDIxxxx and others...

[Jerry Van Baren]

David Hawkins wrote:
>> I see you guys talking about BDI3000 and I decided to ask a related
>> question.
>>
>> Those who happen to own MPC8548CDS or something like this know it comes with
>> a small box called CodeWarrior USB TAP.
>>
>> It is supposed to work with their software one has to pay for. I never used
>> anything but GCC suite for anything GCC supports and always tried to avoid
>> commercial tools like a plague. So I want to ask if somebody knows if there
>> are any free tools for that thing...
>>
>> Not that I really need it for something but it is sitting in the box
>> gathering dust and it would be nice ot somehow put it to do something...
> 
> I've wondered the same thing. But didn't manage to find
> anything out there. I've got three ... in the boxes
> the Freescale MDS boards came in.

Yup, got a handful myself.

> The USB-TAP has a PowerPC processor in it ... so even if you
> had to blow away the original firmware, I'm sure it wouldn't
> be too hard to figure out what code would be required to
> make the device look like a USB debugger, and then create
> a set of USB commands to generate JTAG transactions.

MPC866PVR133A in the one I disassembled.  Not a top-of-the-line 
processor, but plenty for the job.

> I think the main problem is getting the JTAG TAP codes
> for manipulating JTAG. I've never seen a document relating
> to that, so they are obviously NDA.

Yup.

> That being said, a weekend with a logic analyzer on a
> BDI2000 JTAG connection would probably give you all the
> info you need to figure out the appropriate JTAG
> commands.

The problem is that it is going to be different for every processor 
family and it may even change between processor revisions.  There is a 
risk that, if you send the wrong sequence, you will damage your target 
processor (JTAG+BSDL can burn up chips too if you set outputs to 
fighting - DAMHIKT).

With a large number of internal registers (many unknown) all hooked 
together into a single scan chain, it will take quite a bit of effort to 
hit each register individually to correlate the scan chain to the register.

Oh, and you need to purchase a commercial debugger to do this, at which 
point you've already spent your money, got your functionality, and lost 
your incentive.

> I've wired up the COP connection on my board via an FPGA,
> so that I could conceivably use the PowerPC JTAG via
> PCI. However, its the lack of open documentation on the
> JTAG commands that has limited my interest in pursuing
> this. However, it would be simple to use that interface
> to log all JTAG transactions, to figure out all the
> JTAG TAP instructions.

The *JTAG* commands *ARE* documented and you can download the BSDL 
(Boundary Scan Description Language) files for all chips that I've 
looked at.  This is *NOT* the internal proprietary "COP" scan chain - 
that just piggybacks on the JTAG/BSDL documented scan chain.  The 
boundary scan allows you to wiggle the external pins on the processor... 
e.g. you can drive an address + data + CS*, toggle the WR* pin, and 
viola, you are programming flash (lots of pain glossed over).

I've looked at UrJTAG
   <http://www.urjtag.org/>
but have not gone further because I already spent the money for a BDI 
;-).  I typically use the BDI for debugging for a few hours on board 
bring up (requires a good board design to start with - thanks, hardware 
guys!).  After that, the only reason I need the BDI is to recover from 
loading bad bits into flash.

The UrJTAG software + JTAG hardware + BSDL file would allow me to 
reprogram my flash for a lot less than the cost of a full JTAG debugger. 
  This is where the USB-TAP support would be Really Nice.

This would also work for the "burn & learn" method - if you are lucky 
and smart (in that order), it can be effective.  Unfortunately, "burn & 
learn" falls into the CompSci category of halting problems:
   <http://en.wikipedia.org/wiki/Halting_problem>

> Cheers,
> Dave

Best regards,
gvb

[U-Boot] BDIxxxx and others...

[David Hawkins]

Hi Jerry,

>> That being said, a weekend with a logic analyzer on a
>> BDI2000 JTAG connection would probably give you all the
>> info you need to figure out the appropriate JTAG
>> commands.
> 
> The problem is that it is going to be different for every processor 
> family and it may even change between processor revisions.  There is a 
> risk that, if you send the wrong sequence, you will damage your target 
> processor (JTAG+BSDL can burn up chips too if you set outputs to 
> fighting - DAMHIKT).

Yeah, that doesn't sound like something I'd want to do ... again.

> With a large number of internal registers (many unknown) all hooked 
> together into a single scan chain, it will take quite a bit of effort to 
> hit each register individually to correlate the scan chain to the register.
> 
> Oh, and you need to purchase a commercial debugger to do this, at which 
> point you've already spent your money, got your functionality, and lost 
> your incentive.

Indeed - my case exactly.

>> I've wired up the COP connection on my board via an FPGA,
>> so that I could conceivably use the PowerPC JTAG via
>> PCI. However, its the lack of open documentation on the
>> JTAG commands that has limited my interest in pursuing
>> this. However, it would be simple to use that interface
>> to log all JTAG transactions, to figure out all the
>> JTAG TAP instructions.
> 
> The *JTAG* commands *ARE* documented and you can download the BSDL 
> (Boundary Scan Description Language) files for all chips that I've 
> looked at.  This is *NOT* the internal proprietary "COP" scan chain - 
> that just piggybacks on the JTAG/BSDL documented scan chain.  The 
> boundary scan allows you to wiggle the external pins on the processor... 
> e.g. you can drive an address + data + CS*, toggle the WR* pin, and 
> viola, you are programming flash (lots of pain glossed over).

Yeah, I was really referring to COP commands ... so many
acronyms ...

> I've looked at UrJTAG
>   <http://www.urjtag.org/>
> but have not gone further because I already spent the money for a BDI 
> ;-).  I typically use the BDI for debugging for a few hours on board 
> bring up (requires a good board design to start with - thanks, hardware 
> guys!).  After that, the only reason I need the BDI is to recover from 
> loading bad bits into flash.

Yep, same here. Once I figure out how to brick the hardware,
I tend to avoid repeating the same mistake - however I
can generally find more than one way to do it.

> The UrJTAG software + JTAG hardware + BSDL file would allow me to 
> reprogram my flash for a lot less than the cost of a full JTAG debugger. 
>  This is where the USB-TAP support would be Really Nice.

Right. I have the Flash hanging off an FPGA, so can use
the FPGA JTAG to program it too.

Ah well, if some intrepid soul wants to reverse engineer,
and possibly scorch their hardware, they're welcome to
ask here for a USB-TAP, and they can have one of mine :)

Cheers,
Dave

[U-Boot] BDIxxxx and others...

[Wolfgang Denk]

Dear ksi at koi8.net,

In message <Pine.LNX.4.64ksi.0906161532580.9552@home-gw.koi8.net> you wrote:
> 
> Those who happen to own MPC8548CDS or something like this know it comes with
> a small box called CodeWarrior USB TAP.

You can try and use the USB tap as a door stop - but even for this
purpose it is not optimal.

For any real work you better get a BDI3000.

Best regards,

Wolfgang Denk

-- 
DENX Software Engineering GmbH,     MD: Wolfgang Denk & Detlev Zundel
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
Lack of skill dictates economy of style.                - Joey Ramone