Project/HR Hackn Crack DSP56858
From CCHS
Contents |
[edit] HR Hack'n Crack (DSP56858)
[edit] Overview
Hack into a DSP56858 based embedded controller board. [Insert picture here]
[edit] Description
What we're dealing with here is actually a Virbiage 3010 VoIP ATA (analog telephone adapter), without its case. There are three connectors on the board - power supply (5V, regulated down to 3.3V for most of the silicon on the board), ethernet and the telephone handset.
The board contains the Freescale 56858 DSP, a Realtek RTL8019 ethernet controller, the termination/isolation magnetics block for the Ethernet port, a bit of RAM and flash memory (I think), a 3.3 V voltage regulator, and a couple of other bits and pieces.
[edit] Status
- As of 2010-04
Richard abandoned this project due to difficulties in acquiring a toolchain and required information on the components. The cumulative unknowns made the chance of success very slim.
- As of 2009-11-17
Project started ... several boards have been left at the HackerSpace for members to have-a-go at.
[edit] Resources
Here's the link to the datasheet from Freescale: DSP56858 datasheet
Also: The chip User Guide.
Here's the link to the DSP56858EVM evaluation module user's manual. The DSP56858EVM board has a 14-pin JTAG header... is its pinout the same as the 14-pin header on the Virbiage board? Could we get the pinout that was traced out for that header uploaded?
For the moment, let's assume that it's JTAG, and it has the same pinout as the Freescale DSP56858 evaluation board.
We might be able to get the code that runs on the development board, and burn it to the Virbiage boards. Would that be helpful?
Traditionally, JTAG is interfaced to a PC by essentially bit-banging it on a parallel port... one can just copy the parallel port interface schematic from the DSP56858EVM schematics in the back of the manual.
This is possibly the development environment: Code Warrior Development Studio for Freescale 56800/E Digital Signal Controllers: DSP56F80x/DSP56F82x Family Targeting Manual
This might be where to get it from: CodeWarrior for 56800/E Digital Signal Controllers
Lots of good stuff here: https://sourceforge.net/projects/dsp56800/.
The binutils patch advertised on the front page is just the start. There is also a patch on gcc-3.3.2 (C core) which builds on the binutils. There is also what looks like a JTAG over parallel implementation for flash programming and running in debug mode.
[edit] UPDATE
Schematics for the board, including pin-outs for the JTAG port can be found here.
[edit] Programming
Working through the schematics provided and the DSP User Guide shows the various ways to boot the device.
J2 (3 bit switches) allows the MODA, MODB and MODC pins to be asserted to control the boot mode. The pins are normally pulled to ground. Mode 6 is interesting for initial development as this mode loads a bootloader via serial (SC1). The RxD1 and TxD1 pins are exposed on J1: Rx by DSP = J1p6, Tx from DSP = J1p4.
The UserGuide describes the serial port setup for transfering the bootloader program code as 8N1 at either 38400 (4MHz crystal) or 19200 (2 MHz crystal). Schematics indicate the crystal runs at 4MHz (Q1 scan0005.gif).
MODA=SIMC14 MODB=SIMC13 MODC=SIMC12
Boot mode 6 should require asserting MODA and MODB = J2p2 and J2p4.
- 2010-03-02 Update
Rich toasted one board by trusting the wiring in the schematics instead of checking the board power layout first. A faulty switch mode supply did not help.
Luke soldered a 3-pin header to the boot-mode selectors on one board. With boot mode 6 selected the board no longer runs the normal application from boot ROM. We'll assume this is a good thing for now.
Rich has a GNU binutils port for dsp56800 built and running under Linux. Seems to generate sensible ELF files. Next step is to see if the gcc port can be built on top of that.
Next meeting will try to experiment with serial I/O on the programming header. Need a RS232 to 3.3V level shifter.
