Embedded Software and Hardware Hack

Wednesday, April 17, 2013

STM32F4 Debug Board v1.0 Rev2

News about latest version STM32F4 Debug v1.0 Rev2 (updated 17 april 2013).

This board is intended to be used as a portable multi-purpose debug/hack tool with very fast peripherals and MCU and use standard Dangerous Prototypes Sick Of Beige DP6037 case format

A full open source firmware is planned using chibios and like Bus Pirate v3/4 user interface through serial terminal using the microUSB connector (the development of firmware will be during 2014 as i'm very busy to finish other projects).
The new revision v1.0 Rev2 fix routing problem and add a new feature a 2nd micro USB connector, which can be used as USB OTG FS DFU (device firmware upgrade) to avoid requirement of a JTAG probe for programming the firmware.

Depending on feedback this board could be connected to any Android phone/tablet (through microUSB connector) for portable usage to debug/hack electronic stuff everywhere.

This board has following features:

Use standard Dangerous Prototypes PCB size DP6037_v1 (see http://dangerousprototypes.com/docs/Sick_of_Beige_basic_case_v1) (very small 60mm x 37mm size).
Specific Top case already designed.
An easy plug and play board is already designed(see photo at bottom) to connect the TRF7970A BreakoutBoard 1.1 with this board (without need of any jumper/wire).
An easy plug and play Arduino board adaptor is planned to be designed for this board (depending on feedback).
MCU STM32F405RGT LQFP64:

MCU ARM 32-bit Cortex M4+FPU.
Frequency up to 168MHz(with power consumption of less than 100mA), memory protection unit, 210 DMIPS/1.25 DMIPS/MHz (Dhrystone 2.1), and DSP instructions.
1MB Flash memory, SRAM 192KB and SRAM Backup 4KB.
DMA for almost all peripherals.
High speed IO and peripherals:

Fast I/O up to 84MHz.
USART up to 10.5Mbits/s.
I2С up to 400KHz.
SPI up to 37.5Mbits/s.
CAN.
SD/SDIO 1bits, 4bits(SD spec v2.0) or MMC up to 8bits (MMC v4.2) and up to 48MHz for 8bits mode.
ADC 12bits up to 7.2MSPS.
DAC 12bits.

Almost all I/O are 5V-tolerant (except PA4/PA5 for DAC_OUT are 3V3 only).
Special features embedded in hardware:

True random number generator.
CRC calculation.
96-bit unique ID.
RTC (quartz not embedded on the board).

STM32F4 Debug v1.0 Rev2 and DP6037 Case (17 April 2013)

Breakout of all pins (except those for USB and PC13 reserved for +5V/VUSB Enable/Disable).

Features of the STM32F4 Debug board:

Debug/Programming through low cost SWD Debug connector (can be programmed/debugged using a low cost STM32F4 Discovery board for less than 20US$).
Programming firmware through USB DFU (without any debugger) with USB0 FS.
Portable (with LiPo) and connection to any Android Phone/Tablet is planned (through USB).
Arduino adaptor board is planned (for less than 5US$).
Reset Button and choice of LiPo Charging Enabled or Disabled (COFF/CON).
Breakout of all 44 I/O.
Real Time Clock (RTC with Quartz 32.768KHz).
LEDs:

USB Led (ON when USB connected or when +5V enabled).
PWR Led (ON when main power +3v3 ON).
LIPO_C Led (ON when LiPo is charging).

USB 2.0 OTG FS Host or Device (Host with up to 500mA depending on LiPo battery).

For Host 5V/VUSB shall be enabled using MCU PC13 pin Enable="0", Disable="1", by default it is disabled with a pull-up resistor.

Power/LiPo battery managment:

Power through USB (micro USB) or LiPo battery with in both case 3.3V and 5V(enabled by software PC13).
Connect any cheap/standard LiPo using a JST 2mm and 2 pin connector (on bottom layer).
LiPo Fast Charge with current Limit up to 400mA.
Input current limit 500mA.
Possibility to Enable or Disable Battery Charging.

Peripherals available in parallel (through connector header):
- SPI1 & SPI2.
- I2C1 (no external pull-up required can be enabled by software).
- USART1 (including clock), USART2.
- ADC1, ADC2 and ADC3.
- DAC1 and DAC2.
- SDIO (1bits and 4bits).
Other peripherals planned:
- Nand Flash 8/16bits, SPIFI (Quad SPI Flash).
- ARM JTAG/SWD Debugger.

Adaptor Board to connect TRF7970A Breakout v1.1 with STM32F4 Debug v1.0

Adaptor Board for TRF7970A BreakoutBoard v1.1 & STM32F4 Debug v1.0

TRF7970A BreakoutBoard v1.1 + Adaptor Board + STM32F4 Debug v1.0

Updated 17 April 2013

Wednesday, May 9, 2012

NFC TI TRF7970A Breakout Board V1.1 and STM32F4 Discovery

TRF7970A Breakout Board v1.1:

It is just a little update on the new board TI TRF7970A Breakout Board v1.1 I have built, I have ordered 20 PCB, it is a minor update/clean-up of the board to be easier to use (especially with SPI+SS mode which can be now selected by using simple Short Circuit Block Cap).

STM32F4 Discovery Firmware (for TRF7970A):

I have also news about progress on TRF7970A and STM32F4 Discovery Firmware:

TI EVM GUI is working fine and is ported to STM32F4 (default mode when STM32F4 is powered).

Basic UID read for Vicinity/ISO15693 work fine too (through shell command).
Basic UID read for Mifare One card work fine (through shell command).

ExampleTerminal output log:
ch> nfm
Test nf ISO14443-A/Mifare read UID(4bytes only) start
Modulator Control Register read=0x31 (shall be 0x31)
ISO Control Register read=0x88 (shall be 0x88)
Test Settings Register(0x1A) read=0x40 (shall be 0x40)
Chip Status Control Register read=0x21
RX data(ATQA): 0x04 0x00
RSSI data: 0x7F (shall be > 0x40)
RX data(UID+BCC): 0xCD 0x81 0x5F 0x76 0x65
RSSI data: 0x7F (shall be > 0x40)
RX data(SAK): 0x08
RSSI data: 0x7F (shall be > 0x40)
Send HALT(No Answer OK)
Chip Status Control Register data: 0x01
nb_irq: 0x09
Test nfm ISO14443-A/Mifare end

The Sniffer mode for ISO14443A work fine(this version does not display Parity error or check CRC_A but it is planned).

Example Terminal output log on a Mifare One card read by Nexus S:
...
    52
TAG 04 00
    93 70 cd 81 5f 76 65 d1 86
TAG 08 b6 dd
    60 00 f5 7b
TAG 2a 81 4c 55
    8c cc db f8 cb 98 1a 6e
TAG a0 ed 29 bd
    b2 ee f9 09
TAG 76 e6 ca 66 cc e6 0b df 7d 69 31 70 08 f3 6c dd eb ca
    3e 3b d5 81
TAG 82 0c df 9e e8 b0 e1 4a c5 9c de 45 27 26 79 41 e7 00
    07 c6 2d 8f
TAG fe c0 83 39 40 cb ea d8 0a cf 18 00 6c 78 97 9b 01 95
    f8 86 46 1c
TAG 34 d7 71 20 99 a1 a3 f9 0c e6 90 8b e6 5e 93 c1 53 23
    ae 87 f6 db
TAG c9 82 dd d5
    90 7c 16 4a 00 26 6c b4
...

Emulator mode is planned and lot of other modes too.

Just a little challenge for readers, try to decode crypted data contained in "Example Terminal output log on a Mifare One card read by Nexus S", I will give the answer and source code tool to do that on next blog message.

If anyone is interested by this new board you can contact me by Email (PCB are limited to 15 for order), I think I will receive the PCB of the new Board the 21 may 2012.

Best Regards
Benjamin

Wednesday, January 18, 2012

NFC TI TRF7970A Breakout Board V1.0 for BusPirate or any Hardware

Just a news about a new Hardware PCB I have designed with Eagle, it is an NFC Breakout board using latest Texas Instrument NFC chipset the TRF7970A and including 13.56MHz antenna with an option to connect an external SMA NFC antenna (SMA-142-0701-801/806) .
It is also compatible with Input Voltage from 2.7VDC to 5.5VDC and I/O Voltage level programmable from 1.8VDC to 5.5VDC.
It supports Near Field Communication (NFC) Standards NFCIP-1 (ISO/IEC 18092), NFCIP-2 (ISO/IEC 21481) and protocol ISO15693, ISO18000-3, ISO14443A/B, and FeliCa.

Advantage against PN532 chipset/breakout board are:

TRF7970A is cheaper and available.
Documentations including datasheet are public/full and available directly without any registration or NDA.
Support Direct Mode 0 "Raw RF Sub-CarrierData Stream" to encode/decode all 13.56MHz subcarrier data stream.

The final board with all components soldered (using a AOYUE Int 968 Hot Air and Iron Solder):

If anyone is interested by this Breakout board tell it as comment.

If lot of people are interested (at least 100). I could buy a batch of 100 PCBs + Components at SeeedStudio and the price could be less than 30US$ for a Full Board assembled and tested.
For Interested guys I have a batch of 8 PCBs and I can sell 3 PCBs with all components soldered and fully tested.

The next step in progress is TRF7970A Breakout Board connected to a STM32F4 Discovery board (using chibios as RTOS).

Test of TRF7970A Breakout Board V1 with BusPirateV3

Hardware requirement:
BusPirate V3 or V4 (shortcut BP).
TRF7970A BreakOut Board V1 (shortcut TRF).

Hardware Configuration for SPI mode with ChipSelect
Warning Never connect 2 different power Input on both +VCC/3V3.
Only one power supply shall be connected to +VCC or to 3V3. (+VCC and 3V3 are linked together on the same line).
Nota1: 3V3 can be connected to +5V or +3V on BusPirate.
Nota2: 3V3 or +VCC accept input voltage from +2.7V to +5.5V.

TRF7970A BreakOut Board V1 connections:
Connect TRF "IO0_GND" signal to TRF "GND".
Connect TRF "EN", "IO1_NCS_GND" and "IO2_VDD_IO_X" signals to TRF "+VCC".
Connect TRF "MOSI" signal to BP "MOSI".
Connect TRF "CLK" signal to BP "CLK".
Connect TRF "MISO" signal to BP "MISO".
Connect TRF "CS" signal to BP "CS".
Connect TRF "3V3" signal to BP "3V3" or "5V".
Connect TRF "GND" signal to BP "GND".
With this configuration, other signals shall not be connected (except optional TRF "MOD", "IRQ" or "ASK_OOK" signals).

SPI Configuration:
CPOL=0 (Clock is Low when inactive)
CPHA=1(Data is Valid on Clock Trailing Edge)
CS Active Low
BusPirate V3 configuration

HiZ>m 5 3 1 1 1 2 2
SPI (spd ckp ske smp csl hiz)=( 3 0 0 0 1 0 )
Ready
SPI>W
Power supplies ON
SPI>i
SPI>i
Bus Pirate v3b
Firmware v5.10 (r559) Bootloader v4.4
DEVID:0x0447 REVID:0x3043 (24FJ64GA002 B5)
http://dangerousprototypes.com
CFG1:0xFFDF CFG2:0xFF7F
*----------*
Pinstates:
1.(BR) 2.(RD) 3.(OR) 4.(YW) 5.(GN) 6.(BL) 7.(PU) 8.(GR) 9.(WT) 0.(Blk)
GND 3.3V 5.0V ADC VPU AUX CLK MOSI CS MISO
P P P I I I O O O I
GND 2.21V 0.00V 0.00V 0.00V L L L H L
Power supplies OFF, Pull-up resistors OFF, Normal outputs (H=3.3v, L=GND)
MSB set: MOST sig bit first, Number of bits read/write: 8
a/A/@ controls AUX pin
SPI (spd ckp ske smp csl hiz)=( 3 0 0 0 1 0 )
*----------*

TRF7970A command (Table 5-10. Address/Command Word Bit Distribution):
Bit Description Bit Function Address Command
B7 Command control bit 0 = address 0 1 1 = command
B6 Read/Write 0 = write R/W 0 1 = read
B5 Continuous address mode 1 = Continuous mode R/W 0
B4 Address/Command bit 4 Adr 4 Cmd 4
B3 Address/Command bit 3 Adr 3 Cmd 3
B2 Address/Command bit 2 Adr 2 Cmd 2
B1 Address/Command bit 1 Adr 1 Cmd 1
B0 Address/Command bit 0 Adr 0 Cmd 0

Example commands:
SpiDirectCommand:
1stByte = ((0x80 | CommandCode)) & 0x9f
Software Initialization (0x03):
1stByte = 0x83
[0x83]
Reset 0x09 (Reset FIFO):
[0x89]

SpiReadSingle (Read Register Addr):
RegisterAddr=0x1A (TestRegister R/W)
1stByte = AddressCommand (0x40|RegisterAddr) | (0x5F&RegisterAddr) = 0x5A

SpiWriteSingle (Write Register Addr):
RegisterAddr=0x1A (TestRegister R/W)
1stByte = AddressCommand (0x1F&RegisterAddr) = 0x1A

Read Register 0x1A:
[0x5A r]
Write Register 0x1A with value 0x12:
1stByte = AddressCommand (0x40|RegisterAddr) | (0x5F&RegisterAddr) = 0x5A
[0x1A 0x12]

Read Register 0x1B:
[0x5B r]
Write Register 0x1B with value 0x13:
1stByte = AddressCommand (0x40|RegisterAddr) | (0x5F&RegisterAddr) = 0x5A
[0x1B 0x13]

Read Chip Status Control Register (0x00)(Default Value 0x01):
[0x40 r]

Read ISO Control Register (0x01)(Default Value 0x02):
[0x41 r]

Read Modulator and SYS_CLK Control Register (0x09):
[0x49 r]

Write Modulator and SYS_CLK Control Register (0x09) (13.56Mhz SYS_CLK and default Clock 13.56Mhz)):
[0x09 0x31]

Read Regulator and I/O Control Register (0x0B):
[0x4B r]

Write Regulator and I/O Control Register (0x0B):
[0x0B 0x00]

Read FIFO Status Register (0x1C)
[0x5C r]

RSSI levels and oscillator status (0x0F)
[0x4F r]

Continuous Read and Clear IRQ Status (0x0C) (required a dummy read)
[0x6C r:2]

Continuous Read from Addr 0x00 to addr 0x05:
[0x60 r:6]

Continuous Read from Fifo Addr 0x1F:
[0x7F r:9]

Send Data in Fifo:
[0x8F 0x91 0x3D 0x00 0x30 0x26 0x01 0x00]
0x8F = Reset FIFO
0x91 = Send With CRC
0x3D = Write Continuous (Start at 0x1D => TX Length Byte1 & Byte2)
0x00 0x30 = Number of Bytes to be sent (0x30 = 3bytes @0x1D & 0x1E)
0x26 = Request Flags (FIFO TX 1st Data @0x1F)
0x01 = Inventory Command (FIFO TX 2nd Data @0x20)
0x00 = Mask (FIFO TX 3rd Data @0x21)

For more details on TRF7970A chipset see datasheet http://www.ti.com/litv/pdf/slos743

Before to initialize chipset to ISO15693 or ISO14443A, you should launch BusPirate V3 configuration "m 5 3 1 1 1 2 2" then "W" then put the NFC card(depending on example ISO15693 or ISO14443A card) on the antenna and execute step 1) to 5) of the chosen example.

Initialize the chipset ISO15693 and read UID:
1) Reset
[0x83]
2) Write Modulator and SYS_CLK Control Register (0x09) (13.56Mhz SYS_CLK and default Clock 13.56Mhz))
[0x09 0x31]
3) Configure Mode ISO Control Register (0x01) to 0x02 (ISO15693 high bit rate, one subcarrier, 1 out of 4)
[0x01 0x02]
4) Turn RF ON (Chip Status Control Register (0x00))
[0x40 r] [0x00 0x20] [0x40 r]
5) Inventory Command (see Figure 5-20. Inventory Command Sent From MCU to TRF7970A)
5-1) Send Inventory(8B), Wait 2ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C), Read Continuous FIFO from 0x1F to 0x1F+0x0A(0x1F/0x7F), Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C), Reset FIFO(0x0F/0x8F), Read RSSI levels and oscillator status(0x0F/0x4F)
[0x8F 0x91 0x3D 0x00 0x30 0x26 0x01 0x00] %:2 [0x6C r:2] [0x5C r] [0x7F r:10] %:10 [0x6C r:2] [0x5C r] [0x8F] [0x4F r]

Result example:
/CS ENABLED
WRITE: 0x8F
WRITE: 0x91
WRITE: 0x3D
WRITE: 0x00
WRITE: 0x30
WRITE: 0x26
WRITE: 0x01
WRITE: 0x00
/CS DISABLED
DELAY 2ms
/CS ENABLED
WRITE: 0x6C
READ: 0x00 0x3E
/CS DISABLED
/CS ENABLED
WRITE: 0x5C
READ: 0x0A
/CS DISABLED
/CS ENABLED
WRITE: 0x7F
READ: 0x00 0x00 0x88 0x77 0x66 0x55 0x44 0x01 0x04 0xE0
/CS DISABLED
DELAY 10ms
/CS ENABLED
WRITE: 0x6C
READ: 0x00 0x3E
/CS DISABLED
/CS ENABLED
WRITE: 0x5C
READ: 0x00
/CS DISABLED
/CS ENABLED
WRITE: 0x8F
/CS DISABLED
/CS ENABLED
WRITE: 0x4F
READ: 0x7F
/CS DISABLED

In this example UID is: 0xE0 0x04 0x01 0x44 0x55 0x66 0x77 0x88 (the first 2 bytes shall be always 0x00 0x00)
The last data READ: 0x7F correspond to RSSI levels.
For more details on ISO15693 (especially Inventory, Read/Write block ...) see document ISO/IEC FCD 15693-3

Initialize the chipset ISO14443A (Mifare One) and read UID:
1) Reset
[0x83]
2) Write&Read Modulator and SYS_CLK Control Register (0x09) (13.56Mhz SYS_CLK and default Clock 13.56Mhz))
[0x09 0x31] [0x49 r]
3) Configure&Read Mode ISO Control Register (0x01) to 0x88 (ISO14443A RX bit rate, 106 kbps) and no RX CRC (CRC is not present in the response))
[0x01 0x88] [0x41 r]
4) Turn RF ON (Chip Status Control Register (0x00)) and Read It
[0x00 0x20] [0x40 r]
5) REQA & WUPA command (Anticollision)
5-1) Disable CRC Calc(0x01), Send Raw REQA no CRC(1B), wait 10ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C), Read Continuous FIFO from 0x1F to 0x1F+1(0x1F/0x7F) Read ATQA, Reset FIFO(0x0F/0x8F), Read RSSI levels and oscillator status(0x0F/0x4F), wait 20ms, Send Raw AntiColl(2B), wait 5ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C), Read Continuous FIFO from 0x1F to 0x1F+0x05(0x1F/0x7F), wait 10ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Reset FIFO(0x0F/0x8F), Read RSSI levels and oscillator status(0x0F/0x4F)
[0x01 0x88] [0x8F 0x90 0x3D 0x00 0x0F 0x26] %:10 [0x6C r:2] [0x5C r] [0x7F r:2] [0x8F] [0x4F r] %:20 [0x8F 0x90 0x3D 0x00 0x20 0x93 0x20] %:5 [0x6C r:2] [0x5C r] [0x7F r:5] %:10 [0x6C r:2] [0x8F] [0x4F r]

Result example:
/CS ENABLED
WRITE: 0x01
WRITE: 0x88
/CS DISABLED
/CS ENABLED
WRITE: 0x8F
WRITE: 0x90
WRITE: 0x3D
WRITE: 0x00
WRITE: 0x0F
WRITE: 0x26
/CS DISABLED
DELAY 10ms
/CS ENABLED
WRITE: 0x6C
READ: 0xC0 0x3E
/CS DISABLED
/CS ENABLED
WRITE: 0x5C
READ: 0x02
/CS DISABLED
/CS ENABLED
WRITE: 0x7F
READ: 0x04 0x00
/CS DISABLED
/CS ENABLED
WRITE: 0x8F
/CS DISABLED
/CS ENABLED
WRITE: 0x4F
READ: 0x7F
/CS DISABLED
DELAY 20ms
/CS ENABLED
WRITE: 0x8F
WRITE: 0x90
WRITE: 0x3D
WRITE: 0x00
WRITE: 0x20
WRITE: 0x93
WRITE: 0x20
/CS DISABLED
DELAY 5ms
/CS ENABLED
WRITE: 0x6C
READ: 0xC0 0x3E
/CS DISABLED
/CS ENABLED
WRITE: 0x5C
READ: 0x05
/CS DISABLED
/CS ENABLED
WRITE: 0x7F
READ: 0xCD 0x88 0x77 0x66 0x00
/CS DISABLED
DELAY 10ms
/CS ENABLED
WRITE: 0x6C
READ: 0x00 0x3E
/CS DISABLED
/CS ENABLED
WRITE: 0x8F
/CS DISABLED
/CS ENABLED
WRITE: 0x4F
READ: 0x7F
/CS DISABLED

In this example UID is: 0xCD 0x88 0x77 0x66 (The last Byte "0x00" (intentionally wrong in is example) is BCC calculated as exclusive-or over the 4 previous bytes which is wrong this example)
The last data READ: 0x7F correspond to RSSI levels.

Nota: This example is very basic and for basic test purpose and do not respect the anticollision mechanism which requires additional data after UID is received.

For more details on ISO14443 (especially Initialization and anticollision) see document ISO/IEC FCD 14443-3.

Sunday, October 9, 2011

EvalBot and Android Open Accessory Dev Kit source code under GPL v2

It is now official the EvalBotADK code is available like promised on GitHub and it is open source using GPL v2.

It is the public release of USB Host Driver for Android Open Accessory on EvalBot (it should work also with any other Stellaris ARM chipset supporting USB OTG with minor changes).

About Hardware Hack:
The EvalBot USB Host Power Supply has been hacked because by default it does not work with Usb Host which require more than 100/150mA (due to limitation of hardware) and so I have modified USB Power supply to use external power in order to connect any USB Host compliant with USB specification which allow current until 500mA.
This Hack also work with any hardware because it's done on a Usb Extension and a BreadBoard with External PowerSupply.

Hardware hack schematic details:

Hardware Hack USB Extension External Power

About Software:
For Android software I have used DemoKit which is just a rebuild of sample in official Android NDK package see http://developer.android.com/guide/topics/usb/adk.html and download package here https://dl-ssl.google.com/android/adk/adk_release_0512.zip.
Later we could develop our own Android Application but for this release i just used existing DemoKit.

For EvalBot I have developed the Usb Host driver for Open Accessory and an example which communicate with DemoKit.
In order to build the code you should download and install following Texas Instrument packages (requires registration which is free):

The code requires TI Code Composer v4 (I use Version: 4.2.4.00033) see http://www.ti.com/tool/ccstudio or directly http://processors.wiki.ti.com/index.php/Download_CCS#Download_latest_production_CCSv4_DVD_image and choose "Download latest production CCSv4 DVD image" for the Licence see "Getting a License:" just after, it is totally free and there is no limitation in time or removed options. See http://processors.wiki.ti.com/index.php/Licensing_-_CCSv4#Free_Licenses_bundle
Usb Library: http://www.ti.com/tool/sw-usbl => I use SW-USBL-8049.exe which is installed in my example in F:/TI_EvalBot/SW-USBL-8049 3)
EvalBot Firmare: http://www.ti.com/tool/sw-ek-evalbot => I use SW-EK-EVALBOT-7611.exe which is installed in my example in F:/TI_EvalBot/SW-EK-EVALBOT-7611

It is maybe possible to rebuild all under a gcc version for ARM M3 with minor changes but I have not tried it and Code Composer is very cool for that with a complete IDE+Compiler and all is free for personal use.

To simplify the development you can mount a virtual drive to F:\ using subst F:\ yourdrive\ or you will need to change paths defined hereafter.

Following Linked resource are required in Code Composer Project(file .project):
F:/TI_EvalBot/SW-USBL-8049/usblib
F:/TI_EvalBot/SW-EK-EVALBOT-7611/driverlib
F:/TI_EvalBot/SW-EK-EVALBOT-7611/inc
F:/TI_EvalBot/SW-EK-EVALBOT-7611/boards/ek-evalbot/drivers
F:/TI_EvalBot/SW-EK-EVALBOT-7611/utils

Following Include Options are required in Code Composer Project(file .cdtbuild):
F:\TI_EvalBot\SW-EK-EVALBOT-7611
F:\TI_EvalBot\SW-EK-EVALBOT-7611\boards\ek-evalbot
F:\TI_EvalBot\SW-USBL-8049

What feature included for this new demo:

With EvalBot if you press Button Switch1, 2 or Bumper Left/Right it send the button/bumper state to DemoKit.
With DemoKit you can send command (Relay1 or 2) to switch On/Off EvalBot Leds(Led1 & 2).
With DemoKit Servo1=Speed for MotorLeft and Relay1=MotorLeft ON/OFF.
With DemoKit Servo2=Speed for MotorRight and Relay2=MotorRight ON/OFF.

All the code is under GPLv2 and available on GitHub: See WebPage https://github.com/TitanMKD/EvalBotADK

Saturday, August 27, 2011

Debug TI PandaBoard with JTAG using BusBlaster V2 and OpenOCD

Before to start, you need to download OpenOCD 0.5.0 and built it with libftdi support, tested on windows XP SP3 & Ubuntu 10.10. For information default BusBlasterV2 JTAG Key v1.3 buffer logic just work fine.

Step 1) Download & Build OpenOCD 0.5.0 for windows/linux:

Step2) OpenOCD configuration for BusBlaster v2

busblaster.cfg file or OpenOCD 0.5.0 (to be copied in openocd interface directory):

#
# Bus Blaster
#
# http://dangerousprototypes.com/docs/Bus_Blaster
#

interface ft2232
ft2232_device_desc "Dual RS232-HS"
ft2232_layout jtagkey
ft2232_vid_pid 0x0403 0x6010

Step3) Connect JTAG BusBlaster v2 to PandaBoard:

Pandaboard JTAG connected to BusBlaster v2

Pandaboard JTAG & BusBlaster v2 Pinout:

Bus Blaster v2 vs Panda Board
BusBlasterV2 JTAG	PandaBoard JTAG
VTG	VIO_1V8 (Pin 5)
GND	DGND (Pin 4)
TRST	H_JTAG_NTRST (Pin 2)
TDI	H_JTAG_TDI (Pin 3)
TMS	H_JTAG_TMS (Pin 1)
TCK	H_JTAG_TCK (Pin 11)
RTCK	H_JTAG_RTCK (Pin 9)
TDO	H_JTAG_TDO (Pin 7)

Other JTAG pins are not connected.

Extract of PandaBoard JTAG pinout from OMAP(TM) 4 PandaBoard System Reference Manual Revision 0.4 September 22, 2010 DOC-21010

Step4) Start OpenOCD 0.5.0:

Power ON PandaBoard (without SD Card) & BusBlaster V2.
Launch mintty or standard cygwin shell.
Launch openocd

openocd -f interface\busblaster.cfg -f board\ti_pandaboard.cfg

Example error if libftdi is not installed with libusb:

openocd -f interface/busblaster.cfg -f board/ti_pandaboard.cfg
Open On-Chip Debugger 0.5.0 (2011-08-13-19:03)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.berlios.de/doc/doxygen/bugs.html
Info : only one transport option; autoselect 'jtag'
RCLK - adaptive
Using dbgbase = 0x80000000
force hard breakpoints
trst_only separate trst_push_pull
Error: unable to open ftdi device: device not found
in procedure 'init'

If you have such type of error go in libusb-win32-bin-1.2.5.0\bin Launch inf-wizard.exe and attach all devices with VendorID=0x0403 & ProductID=0x6010.
You should obtain such log when all work fine:

openocd -f interface/busblaster.cfg -f board/ti_pandaboard.cfg
Open On-Chip Debugger 0.5.0 (2011-08-13-19:03)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.berlios.de/doc/doxygen/bugs.html
Info : only one transport option; autoselect 'jtag'
RCLK - adaptive
Using dbgbase = 0x80000000
force hard breakpoints
trst_only separate trst_push_pull
Info : max TCK change to: 30000 kHz
Info : RCLK (adaptive clock speed)
Info : JTAG tap: omap4430.jrc tap/device found: 0x3b95c02f (mfg: 0x017, part: 0xb95c, ver: 0x3)
Info : JTAG tap: omap4430.dap enabled
Polling target failed, GDB will be halted. Polling again in 100ms
Polling target failed, GDB will be halted. Polling again in 300ms
Info : JTAG tap: omap4430.m30_dap enabled
Polling target failed, GDB will be halted. Polling again in 700ms
Info : JTAG tap: omap4430.m31_dap enabled
Info : omap4430.cpu: hardware has 6 breakpoints, 4 watchpoints
Info : omap4430.m30: hardware has 6 breakpoints, 4 watchpoints
Info : omap4430.m31: hardware has 6 breakpoints, 4 watchpoints
Polling succeeded again

Now you can start to debug you PandaBoard with ARM GDB commands(using Yagarto or other):

arm-none-eabi-gdb.exe
target remote localhost:3333
monitor halt

You should obtain such log if all work fine:

GNU gdb (GDB) 7.2
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses /gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show  copying" and "show warranty" for details.
This GDB was configured as "--host=i686-pc-mingw32 --target=arm- none-eabi".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
(gdb) target remote localhost:3333
Remote debugging using localhost:3333
0x00000000 in ?? ()
(gdb) monitor halt
target state: halted
target halted in Thumb state due to debug-request, current mode:  Supervisor
cpsr: 0x60000173 pc: 0x0002dc92
MMU: disabled, D-Cache: disabled, I-Cache: enabled

For other gdb commands type help. For openocd commands help type monitor help.

For other details on BusBlaster v2 see

http://dangerousprototypes.com/docs/Bus_Blaster

EvalBot (Stellaris) and Android Open Accessory Development Kit (ADK) Demo

EvalBot and Android Open Accessory (ADK) Hack

I have just finished to develop an USB Host Driver for Android Open Accessory on EvalBot (it should work also with any other Stellaris ARM chipset supporting USB OTG).

The video demo with link below show how it's easy and fun to communicate with EvalBot with a modern Android Phone (with Android version 2.3.4 or more) like my Samsung Google Nexus S.

About Hardware Hack:

The EvalBot USB Host Power Supply has been hacked in this demo because by default it does not work with Usb Host which require more than 100/150mA (due to limitation of hardware) and so I have modified USB Power supply to use external power in order to connect any USB Host compliant with USB specification which allow current until 500mA.

This Hack also work with any hardware because it's done on a Usb Extension and a BreadBoard with External PowerSupply.

About Software:

For Android software I have used DemoKit which is just a rebuild of sample in official Android NDK package.

For EvalBot I have developed the Usb Host driver for Open Accessory and an example which communicate with DemoKit, the code use Texas Instrument UsbLib and is built under CodeComposer v4.2.4.

What feature included for this demo:

With EvalBot if you press Button Switch1 or 2 it send the button state to DemoKit.
With DemoKit you can send command (Relay1 or 2) to switch On/Off EvalBot Leds(Led1 & 2).

PS:I plan to cleanup the whole driver and source and push the source code on a GitHub for free and fun.

Video: