83
edits
Changes
Jump to navigation
Jump to search
→JTAG/Programming/Firmware
[https://www.roland.com/br/products/dif-at24/ Roland's page on the DIF-AT]
[[File:DIFAT 24.jpg|thumb|rolands Roland publicity image (still online)|alt=]]
===Brief outline -===
===PCB Photos -===
<gallery>
File:DIF-AT MAIN.JPG|'''Main board'''File:H8 3005 CPU.JPG|'''Cpu (not mcu!)'''File:Main Board Side On.JPG|'''Main board, alt'''File:SRAM + NOR FLASH.JPG|'''SRAM + NOR Flash (512kb)'''File:ALESIS OTP CPLD.JPG|alt=Custom Alesis chip OTP? GAL?|'''Custom Alesis chip OTP CPLD? GAL?'''File:TDIF-BOARD.JPG|alt=TDIF daughter board|'''TDIF daughter board'''File:5v conditioning circuit.jpeg|alt=5v power conditioning|'''5v power conditioning'''File:Sync section optocouplers.JPG|alt=sync circuitry with optocouplers|sync '''Sync circuitry with optocouplers'''File:Reset circuit.jpg|alt=Reset IC and switch|'''Reset IC and switch'''File:Xilinx CPLD.jpg|alt=Xilinx CPLD with JTAG pads visible (pin 50, 81 silkscreen)|'''Xilinx CPLD with JTAG pads visible (pin 50, 81 silkscreen)'''
</gallery>
A 50 pin header provides easy access to most address lines and relevant (to operation) CPU/RAM/Flash lines. This will be convenient to run a logic capture during boot and operation later. I beeped out the 50 pin connector - Many pins have multiple connections. Happily; the vias were not tented - this was a long endeavour even with continuity through the vias : ) Below, the findings and some general notes: <gallery>
File:DIFat 50 pin header1 .png|alt=dif at pin header pins 1 - 16|header '''Header pins 1 - 16'''File:DIFat 50 pin header2.png|alt=header pins 16 - 24|header '''Header pins 16 - 24'''File:DIFat 50 pin header3.png|alt=header pins 15 to 38|header '''Header pins 15 to 38'''File:DIFat 50 pin header4.png|alt=header pins 38 to 50|header '''Header pins 38 to 50 '''File:DIFAT PIN HEADER GENERAL NOTES.png|alt=general notes about CPU SRAM, inferred operation|general '''General notes about CPU SRAM, inferred operation'''
</gallery>
Perhaps Roland just had a load of these in house already and it was cheaper to use them than get a smaller device. Or maybe it was the only suitable device in that range?
JTAG pads are exposed on the PCB as seen in the image above. I could connect to these to read the CPLD. Pretty soon they were pulled off the board, and I had to solder a pin to the leg temporarily to continue reading data. (before I discovered the tiny IC clips!)
I connected using Bluetag, OpenOCD and XC3SPROG (open source Xilinx CLI) and was eventually able to read back ID codes and find IR Len etc. I was happy it was still alive! responding. It was fun, confusing and difficult to set up all these tools. I set most of them up on a Raspberry Pi as dedicated hacking server so I can connect remotely to the hot mess setup with my laptop, somewhere more comfortable : )
<gallery>
File:XC3SPROG id read.png|alt=XC3SPROG id read|'''XC3SPROG id read'''
File:Pullup info.png|alt=Pullup info from Xilinx|'''Pullup info from Xilinx'''
File:Bluetag pin read.png|alt=BlueTag correctly reads pins|'''BlueTag correctly reads pins'''
File:Open OCD.png|alt=OpenOCD and BlueTag (in BusPirate Mode)|'''OpenOCD and BlueTag (in BusPirate Mode)'''
</gallery>
=== BSDL Scan ===
After initial ID code read, I used a [https://github.com/viveris/jtag-boundary-scanner BSDL GUI] to determine whether the CPLD was actually passing data throughput. Whilst easy to use when running, this tool took a while to set up (I mistakenly compiled it from source in Windows 7 32 bit - somehow missing the fact there there was a package release) After downloading the BSDL language file from Xilinx and setting up the tool with info from the Xilinx datasheet (super confusing naming convention, cells vs physical pins). Scanner could only run with this set up in Sample mode (OS not present nor running).
It was satisfying to see my logic probe light up on the outputs during BSDL scanning.
Xilinx CPLD confirmed working - big achievement!
At some point I will get a Xilinx Platform Cable to attempt to read the bitstream for archival purposes. However at this stage I'd had to get a few probes etc and didn't really want to get a Xilinx only device. I've had great luck with unlocked devices so far though, everything I've looked at has been open or level 1 : )
[[File:VIVERIS BOUNDARY SCANNER.png|thumb|Viveris JTAG Boundary Scanner]]
