#3 Broadcom BCM3310 (PENDING: signal list wanted)

closed
jtag (10)
5
2011-07-08
2003-07-12
Ramses VI
No

Searching for the Broadcom BCM3310 support.
(inluding Bus definition if it's possible) so we can get access to the
flash memory and the RAM.

Thank you

Discussion

1 2 > >> (Page 1 of 2)
  • Marcel Telka

    Marcel Telka - 2003-07-13
    • labels: 423739 -->
     
  • Marcel Telka

    Marcel Telka - 2003-07-13
    • assigned_to: telka --> nobody
     
  • Marcel Telka

    Marcel Telka - 2003-07-13

    Logged In: YES
    user_id=395402

    Moved to the Feature Requests tracker.

     
  • Marcel Telka

    Marcel Telka - 2003-07-13
    • assigned_to: nobody --> telka
    • labels: --> jtag
     
  • Marcel Telka

    Marcel Telka - 2003-07-23
    • status: open --> pending
     
  • Marcel Telka

    Marcel Telka - 2003-07-23

    Logged In: YES
    user_id=395402

    AFAIK, the required documentation is not available to the
    public.

    I've requested the documentation from Broadcom 10 days ago,
    but still no reply :-(.

    Without documentation (at least something like BSDL file) it
    is hard to add support for new chip into JTAG Tools.

    Note: I've no hardware with BCM3310 so I'm unable to
    discovery...

    If you have required documentation you could write support
    for BCM3310 yourself. Or, please provide link to public
    documentation...

    Thanks.

     
  • Matan Ziv-Av

    Matan Ziv-Av - 2003-07-23

    Logged In: YES
    user_id=786415

    I believe it is possible to reverse engineer the complete
    BSDL file (or at least the parts needed for access to flash
    memory. But it is long and requires hardware support. There
    are a few more details needed, but here is the process in
    general:

    First use discovery to find IR length and DR length for 'all
    0' instruction (assuming it is extest, the register is BSR).

    Then push 1 to all pins of the processor (except for VCC,
    GND and JTAG pins) and read the BSR. Then push 0 to all pins
    and read the BSR. This will tell you which bits of the BSR
    are input bits.

    Now you can start flipping each pin and seeing which bit it
    affects in the BSR.

    The remaining bits are either control or output bits. For
    each pair of remaining bits, you set all 4 possible values,
    and see the output on all pins. If the pair is really a
    control and output of the same pin, you should see the pin
    changing.

     
  • Marcel Telka

    Marcel Telka - 2003-07-23

    Logged In: YES
    user_id=395402

    True. But we need someone with BCM3310 hardware then...

     
  • Marcel Telka

    Marcel Telka - 2003-07-23
    • status: pending --> open
     
  • Marcel Telka

    Marcel Telka - 2003-07-23
    • status: open --> pending
     
  • Ramses VI

    Ramses VI - 2003-07-24

    Logged In: YES
    user_id=821247

    I have the bcm3310 ready with the jtag ! so if anyone could
    contact with me to try the reverse engeniering

     
  • Ramses VI

    Ramses VI - 2003-07-24
    • status: pending --> open
     
  • Marcel Telka

    Marcel Telka - 2003-07-24

    Logged In: YES
    user_id=395402

    Please cut'n'paste output from 'detect' and 'discovery'
    commands for BCM3310 target. Please use current development
    version of the JTAG Tools (from CVS). Thanks.

     
  • Marcel Telka

    Marcel Telka - 2003-07-24
    • status: open --> pending
     
  • Ramses VI

    Ramses VI - 2003-07-25
    • status: pending --> open
     
  • Ramses VI

    Ramses VI - 2003-07-25

    Logged In: YES
    user_id=821247

    I'm having problems compiling the CVS. So with the public version I have:

    Resuming the results we have:

    Device Id: 00000011001100010000000101111111
    JTAG chain length is 1..
    IR length is 5

    DR length for IR 00000 is 397
    DR length for IR 00001 is 32
    DR length for IR 00010 is 397
    DR length for IR 00011 is 32
    DR length for IR 00100 is 1
    DR length for IR 00110 is 1
    DR length for IR 00111 is 1
    DR length for IR 01000 is 32 (think is EJTAG related)
    DR length for IR 01001 is 32 (think is EJTAG related)
    DR length for IR 01010 is 32 (think is EJTAG related)
    DR length for IR 01011 is 96 (think is EJTAG related:in ejtag specs the 3
    previous DR at the same time)
    DR length for IR 11111 is 1

    (all the others are -1)

    (attached the discovery log)

     
  • Ramses VI

    Ramses VI - 2003-07-25

    Logged In: YES
    user_id=821247

    I'm having problems compiling the CVS. So with the public version I have:

    Resuming the results we have:

    Device Id: 00000011001100010000000101111111
    JTAG chain length is 1..
    IR length is 5

    DR length for IR 00000 is 397
    DR length for IR 00001 is 32
    DR length for IR 00010 is 397
    DR length for IR 00011 is 32
    DR length for IR 00100 is 1
    DR length for IR 00110 is 1
    DR length for IR 00111 is 1
    DR length for IR 01000 is 32 (think is EJTAG related)
    DR length for IR 01001 is 32 (think is EJTAG related)
    DR length for IR 01010 is 32 (think is EJTAG related)
    DR length for IR 01011 is 96 (think is EJTAG related:in ejtag specs the 3
    previous DR at the same time)
    DR length for IR 11111 is 1

    (all the others are -1)

    (attached the discovery log)

     
  • Ramses VI

    Ramses VI - 2003-07-25
    • status: open --> pending
     
  • Ramses VI

    Ramses VI - 2003-07-25

    Discovery Output

     
  • Marcel Telka

    Marcel Telka - 2003-07-25
    • status: pending --> open
     
  • Marcel Telka

    Marcel Telka - 2003-07-25

    Logged In: YES
    user_id=395402

    Thanks.

    I've added discovered things into CVS tree (see directory
    'data'). Please test it and confirm instruction values for
    IDCODE, EXTEST and SAMPLE/PRELOAD (please, test all possible
    combinations for the instruction values).

    Now we need signal list (pin list) for the part, then yould
    could start to discovery the BSR as suggested in followup
    from Matan.

     
  • Ramses VI

    Ramses VI - 2003-07-25

    Logged In: YES
    user_id=821247

    Thank you.

    I can't find any changes on the CVS tree but i wonder what were the
    chages:

    register BSR 397
    register BR 1
    register DIR 32

    instruction EXTEST 00000 BSR
    instruction IDCODE 00001 DIR
    instruction SAMPLE/PRELOAD 00010 BSR

    --------------------------------

    jtag> instruction 0 IDCODE
    jtag> shift ir
    jtag> shift dr
    jtag> dr 0
    00000011001100010000000101111111
    jtag> instruction 0 SAMPLE/PRELOAD
    jtag> shift ir
    jtag> shift dr
    jtag> dr 0
    100000100000000100000000100000000100000011111111010000000000
    000000000000000000001010011011011101111111111111111110100111
    111111111111111101111111111111111111111011111111111111111101
    111111111111111100110110000000000000000000000000011110000111
    111110000100000000100000000110000000100000011101111111100001
    111111111101111011011011010011010010011011011011011011011011
    0110111010011000100000000000000110100
    jtag> instruction 0 EXTEST
    jtag> shift ir
    jtag> shift dr
    jtag> dr 0
    100000100000000100000000100000000100000011111101010000000000
    000000000000000000001010010010010100110101010101010100100101
    101010101010101000110110110110110110110001101010101010101000
    110101010101010100010010100010101000001000100010000000100000
    001000000100000000100000000100000000100000000100101010100000
    101101010100101010011010010011010010010011010010010010010010
    0100111000011001100000000000000100100

    -------------------------------------------------------------

    But i don't know where we can find the signal list ...

     
  • Marcel Telka

    Marcel Telka - 2003-08-11

    Logged In: YES
    user_id=395402

    Sorry for late reply.

    CVS changes are propagated into anonymous CVS server at SF
    with some delay (about 24 hours). That is reason why you
    were unable to see the CVS changes.

    Ad signal list: Sorry, no idea. I've zero experience with
    BCM3310 :-(.

     
  • Marcel Telka

    Marcel Telka - 2003-08-13
    • summary: Broadcom BCM3310 --> Broadcom BCM3310 (PENDING: signal list required)
     
  • Marcel Telka

    Marcel Telka - 2003-08-13
    • summary: Broadcom BCM3310 (PENDING: signal list required) --> Broadcom BCM3310 (PENDING: signal list wanted)
     
1 2 > >> (Page 1 of 2)

Log in to post a comment.