Skip to content

This issue was moved to a discussion.

You can continue the conversation there. Go to discussion →

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Debugging a SuperH4 target (Anritsu MS2721B) #289

Closed
brainstorm opened this issue Nov 20, 2021 · 0 comments
Closed

Debugging a SuperH4 target (Anritsu MS2721B) #289

brainstorm opened this issue Nov 20, 2021 · 0 comments

Comments

@brainstorm
Copy link
Contributor

While attempting repair of an Anritsu MS2721B 6GHz "portable" spectrum analyzer, I mapped out the JTAG pinout of its main SH4 (SH7750R) MCU on the board.

For context, the unit was working before but stopped booting up, so now I'm trying to figure out where exactly is the device halting within the (early) boot sequence.

Then I went for Glasgow to confirm the JTAG pinout and indeed, those pins are well identified:

IMG_1752

(glasgow) rvalls@m1 glasgow % glasgow run jtag-pinout --port A --pins-jtag 1,3,5,6 -f 250 -V 1.8
I: g.device.hardware: building bitstream ID 32f2f979fe52e87384b67000968b34fa
I: g.cli: running handler for applet 'jtag-pinout'
I: g.applet.interface.jtag_pinout: port(s) A voltage set to 1.8 V
I: g.applet.interface.jtag_pinout: detecting pull resistors
I: g.applet.interface.jtag_pinout: pull-H: A1, A3, A5, A6
I: g.applet.interface.jtag_pinout: detecting TCK, TMS, and TDO
I: g.applet.interface.jtag_pinout: shifted 10 out of IR with TCK=A1 TMS=A5 TDO=A3
I: g.applet.interface.jtag_pinout: detecting TDI
I: g.applet.interface.jtag_pinout: shifted 32-bit IR with TCK=A1 TMS=A5 TDI=A6 TDO=A3
I: g.applet.interface.jtag_pinout: JTAG interface without reset detected
I: g.applet.interface.jtag_pinout: use `jtag-probe -V 1.8 --pin-tck 1 --pin-tms 5 --pin-tdi 6 --pin-tdo 3` as arguments

And they also spit some TAP info:

(glasgow) rvalls@m1 glasgow % glasgow run jtag-probe -V 1.8 --pin-tck 1 --pin-tms 5 --pin-tdi 6 --pin-tdo 3 scan
I: g.device.hardware: building bitstream ID a441e52aea68aafca8d02fa0007c27cf
I: g.cli: running handler for applet 'jtag-probe'
I: g.applet.interface.jtag_probe: port(s) A, B voltage set to 1.8 V
I: g.applet.interface.jtag_probe: shifted 1-bit DR=<0>
I: g.applet.interface.jtag_probe: shifted 32-bit IR=<10111111111111111111111111111111>
I: g.applet.interface.jtag_probe: discovered 1 TAPs
I: g.applet.interface.jtag_probe: TAP #0: IR[32] BYPASS

And even attempted to establish some JTAG bitbanged session for OpenOCD, similar to my previous attempts with an ESP32S2:

% glasgow run jtag-openocd -V 1.8 --pin-tck 1 --pin-tms 5 --pin-tdi 6 --pin-tdo 3 -f 100 -V 3.3 tcp:localhost:2222
I: g.device.hardware: building bitstream ID c850b1822f53f5fa7fc5e4ec24e21c87
I: g.cli: running handler for applet 'jtag-openocd'
I: g.applet.interface.jtag_openocd: port(s) A, B voltage set to 3.3 V
I: g.applet.interface.jtag_openocd: socket: listening at tcp:localhost:2222
I: g.applet.interface.jtag_openocd: socket: new connection from [::1]:58608

% openocd -c 'interface remote_bitbang; remote_bitbang_port 2222'
Open On-Chip Debugger 0.11.0+dev-00471-gcaa169813 (2021-11-20-01:35)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
DEPRECATED! use 'adapter driver' not 'interface'
Info : only one transport option; autoselect 'jtag'
DEPRECATED! use 'remote_bitbang port' not 'remote_bitbang_port'
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : Initializing remote_bitbang driver
Info : Connecting to localhost:2222
Info : remote_bitbang driver initialized
Info : This adapter doesn't support configurable speed
Warn : There are no enabled taps.  AUTO PROBING MIGHT NOT WORK!!
Info : TAP auto0.tap does not have valid IDCODE (idcode=0xfffffffe)
Warn : AUTO auto0.tap - use "jtag newtap auto0 tap -irlen 2 -expected-id 0x00000000"
Warn : gdb services need one or more targets defined

But then after scanning OpenOCD for suitable targets, I couldn't find any SuperH4 related ones. So I went back to the datasheet linked above and sections 20 and 21 describe what seems to be a customization (extension?) of JTAG called "H-UDI" (and its debugging support called "UBC").

Also there seem to be some 12-y.o dead end threads on renesasrulz.com regarding BDSL availability for those targets.

Is there somebody experienced with this target within this community? Is there any prior art of OSS tooling for SH4 that somebody can point me to?
@GlasgowEmbedded GlasgowEmbedded locked and limited conversation to collaborators Nov 20, 2021

This issue was moved to a discussion.

You can continue the conversation there. Go to discussion →

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@whitequark @brainstorm