Conversation

Notices

1. Embed this notice
   ✧✦Catherine✦✧ (whitequark@mastodon.social)'s status on Tuesday, 06-May-2025 17:22:24 JST ✧✦Catherine✦✧

   hardware folks: here's how you could drive an ARM7TDMI core with the new #GlasgowInterfaceExplorer debug probe

   anything else you're interested in?

   • Embed this notice
     ✧✦Catherine✦✧ (whitequark@mastodon.social)'s status on Tuesday, 06-May-2025 17:27:17 JST ✧✦Catherine✦✧

     in reply to

     you can, of course, still execute arbitrary debug macrocell transactions; if you wanted to feed the core instructions one by one, you can do that too

     plus given that it uses an FPGA, it would not be difficult to extend the core to also control some external logic at the same time

   • Embed this notice
     ✧✦Catherine✦✧ (whitequark@mastodon.social)'s status on Tuesday, 06-May-2025 17:52:19 JST ✧✦Catherine✦✧

     in reply to

     • jn RA, RB (primary opcode 31)

     @jn for glasgow or otherwise?

   • Embed this notice
     jn RA, RB (primary opcode 31) (jn@boopsnoot.de)'s status on Tuesday, 06-May-2025 17:52:20 JST jn RA, RB (primary opcode 31)

     in reply to

     @whitequark this is pretty cool to have, i will use it for inspiration when i get around to writing my own JTAG-based debug probe for a different processor

   • Embed this notice
     ✧✦Catherine✦✧ (whitequark@mastodon.social)'s status on Tuesday, 06-May-2025 17:53:39 JST ✧✦Catherine✦✧

     in reply to

     • jn RA, RB (primary opcode 31)

     @jn nice!! the ARM7TDMI probe is explicitly designed to be used as a pattern for other devices, so the code is very polished and follows what i consider current best practices

     if you write your own in a similar manner i would be very happy to have it upstream

     which CPU are you interested in?

   • Embed this notice
     jn RA, RB (primary opcode 31) (jn@boopsnoot.de)'s status on Tuesday, 06-May-2025 17:53:40 JST jn RA, RB (primary opcode 31)

     in reply to

     @whitequark yes, for glasgow

   • Embed this notice
     ✧✦Catherine✦✧ (whitequark@mastodon.social)'s status on Tuesday, 06-May-2025 18:00:18 JST ✧✦Catherine✦✧

     in reply to

     • jn RA, RB (primary opcode 31)

     @jn that would be really cool! I have only one PPC device (maybe not anymore), it was a set-top box with JTAG fused off sadly

   • Embed this notice
     jn RA, RB (primary opcode 31) (jn@boopsnoot.de)'s status on Tuesday, 06-May-2025 18:00:20 JST jn RA, RB (primary opcode 31)

     in reply to

     @whitequark PowerPC 603/603e/e300. I have some unpublished research on how the (undocumented) JTAG interface works there, implementing a probe will let me check and clean up my assumptions.

   • Embed this notice
     ✧✦Catherine✦✧ (whitequark@mastodon.social)'s status on Tuesday, 06-May-2025 20:19:03 JST ✧✦Catherine✦✧

     in reply to

     • jn RA, RB (primary opcode 31)

     @jn also, i'm wondering if a glasgow flash emulator might be in order at some point...

   • Embed this notice
     jn RA, RB (primary opcode 31) (jn@boopsnoot.de)'s status on Tuesday, 06-May-2025 20:19:08 JST jn RA, RB (primary opcode 31)

     in reply to

     @whitequark i have a pile of them, they have inconvenient TSOP-48 flash and i managed to brick one while porting U-Boot --- which is what inspired me to research their JTAG :)

     A set-top box with PPC, curious! the last one i opened had an ST40 CPU (SuperH but from ST Micro)

   • Embed this notice
     ✧✦Catherine✦✧ (whitequark@mastodon.social)'s status on Tuesday, 06-May-2025 20:26:34 JST ✧✦Catherine✦✧

     in reply to

     • Trammell Hudson
     • jn RA, RB (primary opcode 31)

     @jn @th 25-series SPI should be very viable with the RAM-Pak addon, although you'd only be able to serve it from RAM. I actually want to prototype that whenever I have HyperRAM finally working properly

   • Embed this notice
     jn RA, RB (primary opcode 31) (jn@boopsnoot.de)'s status on Tuesday, 06-May-2025 20:26:35 JST jn RA, RB (primary opcode 31)

     in reply to

     • Trammell Hudson

     @whitequark 25-series SPI (like @th 's spispy) sounds difficult due to the tight timing.
     Not sure about ONFI.
     SD/MMC/SDIO emulation sounds very possible, as it would be possible to do the timing-critical parts in the FPGA and delegate everything else to the host, which allows for some interesting usecases such as exploiting TOCTOUs in eMMC access, or emulating SDIO WiFi (and the enormous driver attack surface that comes with it)