Serial debug (console) approach...?

[para]

@judb: referencing your post over there, have you seen the locking and encryption feature built into the 8052? I don't think they use the lock (because it might not allow firmware updates) but I'm pretty sure they use the encryption. This would mean we can't get the controller's code without erasing the whole IC...

Para

[judb]

I am going to try and be optimistic about it and say perhaps they didnt take the time to implement that.

Since we are dealing with two diffrent firmware regions (on flash chip for the ARM CPU) and the Winbond microcontroler has an embeded reprogrammabale area for booting I'd guess the winbond portion is not encrypted data, unless we have the boot process completley backwards.

Do we know for sure that the ARM CPU isnt the booting device that boots directly from flash and then straps the 8052 with code from the same flash rom?

I think we should update an assumption thread about the whole loading process given the patent info we saw and the capabiliities of the chips that are listed in the PDF's I posted.

Also who had the board that took pictures of it and posted them?  That thread disappeared.
That board has pretty significant deviation in layout from my board and I'd like to compare the chips on each to see if they are the same or not.

Also anyone have a red box they can open up and read the chip part numbers / post good photos of the boards?  I doubt the design is that drastic.  

In fact, I wouldn't be suprised if there was a way to bypass the encryption / setup diffrences by putting the right chip or resistor on the surface of the board.  (more wishful thinking)

[A543]

Just another thought. It's possible that the Red boxes don't have protected code.  We might be able to extract their boot code and get a general idea of how the newer boxes boot, or even use the Red boot code to program the newer uC.
We need some Red info.

[para]

Do we know for sure that the ARM CPU isnt the booting device that boots directly from flash and then straps the 8052 with code from the same flash rom?

Well, the 8052 has a loader ROM which activates a firmware (application) update if requested. If not it loads the application ROM . That's exactly the procedure being described by Terry Kennedy (see FAQ), isn't it?

Also who had the board that took pictures of it and posted them?  That thread disappeared.

Damn, you're right! I got these images on my HDD but don't have enough allowed traffic to put it on a public server... I hope Paul's taking care of that problem and restores that thread. A few hours ago it was still there!

Para

[judb]

Send them to me, I'll host them.  I have over 60 gigs of bandwidth on my server to burn by the end of march.

[judb]

Heres some photos I took of my board...
http://www.savageguild.com/phatnoise/keg1-02.jpg

http://www.savageguild.com/phatnoise/keg1-03.jpg

Higher rez versions available...

[para]

That looks definitely different compared to the other shots! Is there any model number you could post with the pictures? Just for us to know what model where're looking at...

Para

[judb]

This is from a Keg CX910.  I have two of them and they both have a similar layout.  They are from 2001 2002 timeframe.

the board itself has a silk screened name on the back if you look at the photo.

Also, I think the 710 keg is the same board but with less connectors on the back (power and RCA I think)

[para]

Hm, is there any warranty seal on the Phatbox? I hope  I get mine out of customs tomorrow morning. If there's no seal I'll try to open it and get us some pix.

Para

PS: I'll send you the other shots in the next hours...

Update: Well, we're just too stupid :
http://forum.phathack.com/cgi-bin/yabb/YaBB.cgi?board=faqlist;action=display;num=1111166455
(I wrote it and you should be aware of it)

[judb]

Yeah my photos are of a diffrent rev board and those pictures were posted in a diffrent thread a while back I swear!

[para]

Ok, so we're even more stupid than I thought! Have a look at page 1 from time to time

Going to bed, Para

[judb]

LOL okay im a moron and or the search feature is broken as I searched for those photos and it came up with results that were not the post on page 1.

BAH!

[sbingner]

The pics were mine, should still be accessible... but I have to wait till I get home to get the links again...  I'll go ahead and make links off the http://www.phathack.com page... anybody have high bandwidth?  I have a 384K upstream at the moment, soon to be 768K...

Sam

[judb]

http://www.cirrus.com/en/products/pro/detail/P36.html

The output DAC on my keg... CS4341

Datasheet:
http://www.cirrus.com/en/pubs/proDatasheet/CS4341_F3.pdf

[judb]

Okay, so here's the deal.  Mitch and I sat down tonight and traced the board to find the JTAG connector pins for the xilink chips and the ARM CPU.

JP5 -- XILINX 9572XL - JTAG
Pin 6   > 9572XL Pin 48 - TDO
Pin 8   > 9572XL Pin 83 - TDO
Pin 10 > 9572XL Pin 45 - TDO
Pin 12 > 9572XL Pin 47 - TDO

JP6 -- ARM JTAG (No Connector, just pads)
Pin 3   > 7312 Pin 125 - nTRST
Pin 5   > 7312 Pin 11 - TDI
Pin 7   > 7312 Pin 58 - TMS
Pin 9   > 7312 Pin 90 - TCLK
Pin 11 > 7312 Pin 22 - TDO

JP8 -- ARM UART1 (SERIAL PORT!!!)
Pin 5  > 7312 Pin 32 - TDX[1]
Pin 7  > 7312 Pin 36 - RXD[1]
Pin 9  > 7312 Pin 37 - DCD
Pin 11 > 7312 Pin 38 - DSR
Pin 13 > 7312 Pin 35 - CTS

JP9 -- XILINX 5032C - JTAG
Pin 6   > 5032C Pin 26 - TCLK
Pin 8   > 5032C Pin 32 - TDO
Pin 10 > 5032C Pin 1 - TDI
Pin 12 > 5032C Pin 7 - TMS

You can use either:
Molex 87332-1420
or
DigiKey WM18078-ND

To connect to the 14 pin mini JTAG interface on the boards to get access to all but the ARM JTAG interface as it doesnt have anything on the boards pads.

I think this is how they program the boxes from the factory so this SHOULD be a way for us to get into them and fix em.

I really need my hands on a red box, anyone in central texas got one?  I swear we wont break it.






heres some info i found on the JTAG interface for ARM.
http://www.arm.com/support/faqdev/4511.html

[judb]

Tomorrow we are headed to see if we can get the parts we need to roll our own JTAG interface...

http://www.xilinx.com/support/programr/jtag_cable.pdf should be some help for making your own if you are so inclined.

Ebay has some already made but the pins are too far apart to hook into this connector on the board.

I am mostly interested in starting with the serial port right now.

I bought a KCA-R70FM adaptor so I can test at my desk the Keg.

[shack]

I've got a Red box and would be happy to contribute, though I'm not much of a hardware kind of guy.

[para]

Just in case we need to modify the XILINX chips:

http://www.xilinx.com/xlnx/xebiz/designResources/ip_product_details.jsp?key=DS-ISE-WEBPACK

[judb]

Looks like if bash and profile files exist on the DMS in the root of PHATSYS (/dos) it will launch a shell.. but not otherwise.

I need an ARM complied version of bash... hmmm (wanders over to google)

[judb]

On further inspection, if I read the busy box setup right, the -/bin/sh command SHOULD be putting a shell on /dev/console which is redirected to /dev/ttyS0 so the bash script might be out of date and not used anymore.

I need to keep plugging at getting the console to work.  stupid serial ports! bah!