David Hawkins wrote: >> I see you guys talking about BDI3000 and I decided to ask a related >> question. >> >> Those who happen to own MPC8548CDS or something like this know it comes with >> a small box called CodeWarrior USB TAP. >> >> It is supposed to work with their software one has to pay for. I never used >> anything but GCC suite for anything GCC supports and always tried to avoid >> commercial tools like a plague. So I want to ask if somebody knows if there >> are any free tools for that thing... >> >> Not that I really need it for something but it is sitting in the box >> gathering dust and it would be nice ot somehow put it to do something... > > I've wondered the same thing. But didn't manage to find > anything out there. I've got three ... in the boxes > the Freescale MDS boards came in.
Yup, got a handful myself. > The USB-TAP has a PowerPC processor in it ... so even if you > had to blow away the original firmware, I'm sure it wouldn't > be too hard to figure out what code would be required to > make the device look like a USB debugger, and then create > a set of USB commands to generate JTAG transactions. MPC866PVR133A in the one I disassembled. Not a top-of-the-line processor, but plenty for the job. > I think the main problem is getting the JTAG TAP codes > for manipulating JTAG. I've never seen a document relating > to that, so they are obviously NDA. Yup. > That being said, a weekend with a logic analyzer on a > BDI2000 JTAG connection would probably give you all the > info you need to figure out the appropriate JTAG > commands. The problem is that it is going to be different for every processor family and it may even change between processor revisions. There is a risk that, if you send the wrong sequence, you will damage your target processor (JTAG+BSDL can burn up chips too if you set outputs to fighting - DAMHIKT). With a large number of internal registers (many unknown) all hooked together into a single scan chain, it will take quite a bit of effort to hit each register individually to correlate the scan chain to the register. Oh, and you need to purchase a commercial debugger to do this, at which point you've already spent your money, got your functionality, and lost your incentive. > I've wired up the COP connection on my board via an FPGA, > so that I could conceivably use the PowerPC JTAG via > PCI. However, its the lack of open documentation on the > JTAG commands that has limited my interest in pursuing > this. However, it would be simple to use that interface > to log all JTAG transactions, to figure out all the > JTAG TAP instructions. The *JTAG* commands *ARE* documented and you can download the BSDL (Boundary Scan Description Language) files for all chips that I've looked at. This is *NOT* the internal proprietary "COP" scan chain - that just piggybacks on the JTAG/BSDL documented scan chain. The boundary scan allows you to wiggle the external pins on the processor... e.g. you can drive an address + data + CS*, toggle the WR* pin, and viola, you are programming flash (lots of pain glossed over). I've looked at UrJTAG <http://www.urjtag.org/> but have not gone further because I already spent the money for a BDI ;-). I typically use the BDI for debugging for a few hours on board bring up (requires a good board design to start with - thanks, hardware guys!). After that, the only reason I need the BDI is to recover from loading bad bits into flash. The UrJTAG software + JTAG hardware + BSDL file would allow me to reprogram my flash for a lot less than the cost of a full JTAG debugger. This is where the USB-TAP support would be Really Nice. This would also work for the "burn & learn" method - if you are lucky and smart (in that order), it can be effective. Unfortunately, "burn & learn" falls into the CompSci category of halting problems: <http://en.wikipedia.org/wiki/Halting_problem> > Cheers, > Dave Best regards, gvb _______________________________________________ U-Boot mailing list U-Boot@lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot
