USB Blaster download cable design

[4C]

usb blaster

Hi all,

I don't have access to a USB Blaster to be able to have a go at reverse engineering it, but I have found bits and pieces that may be useful to someone!

At:-
**broken link removed**

Contains the file 'Rev_B.epp', it looks like the contents of the EEPROM attached to the FTDI chip, to get the correct VID/PID, etc.


http://www.mesanet.com/software/parallel/jtag.zip

Has some HDL for a USB JTAG programmer for Xilinx, but makes interesting reading. They use commands to setup a byte count and address, then stream the data across.
The 64 possible NOP's in khach's email could indicate a 64 byte max transfer size, and is used to get back to the command state????
Maybe the USB Blaster uses a similar system, it would make sense to use this method as it makes better use of the USB bandwidth, rather that sending entire bytes just to toggle 1 bit.

I also found a Russian site with some info :-
http://njnmnp.narod.ru/usbblaster/usbblaster.html
But I couldn't download some of the files.
And the Russian to English translator I tried did not make much sense?

BR,
4C.

 

[Bingo600]

usb-blaster hacking

Found this (there is a download , but registration needed i guess)
**broken link removed**

Maybe one of the chinese members could tell what it is

There is more here (seems like a clone)
**broken link removed**

/Bingo

 

[kawk]

terasic usb blaster driver

http://www.ixo.de/info/usb_jtag/ uses a very similar "protocol".

K.

 

[coyote~]

ftdi usb blaster signed driver

Hi,

Did anyone try to use Bytblaster or Bytblaster2 with a usb-lpt converter?

cheers

 

[lail247]

usb blaster driver xilinx altera

AS mode?????

 

[atererus]

usbblst.inf

Is this stil hot?

I have made an Atmel USB programmer based on the FTDI chip.
Perhaps I want to help, my design is not based on an FPGA as programming device but an Atmel microcontroller. Perhaps we should colaborate efforts and try to make an public open JTAG tool? Also I have some of these chips FT245B if anyone is interrested.

 

[nooknikz]

usb-blaster drivers

Someone can clone usb blaster ?

 

[kawk]

cyclone fpga usrp failed

Hi, regarding active serial mode:

I've now determined the meaning of all bits, including AS mode, in the simple protocol; it should be easy to add them in the code available from http://www.ixo.de/info/usb_jtag/. I'll do myself if I find the time... Maybe someone else can test AS? I hope there isn't more magic than I assume. I have no devices set up for AS mode here, so I can't actually test... JTAG however HAS been tested, I'm using it every day.

bit 0 in is tdo/conf_done,
bit 1 is dataout/nstatus.

bit 0 out is tck/dclk,
bit 1 out is tms/nconfig,
bit 2 out is nce,
bit 3 out is ncs,
bit 4 out is tdi/asdi/datao,
bit 5 out is led/output enable (has to be set to 1 for proper operation).

The meaning of bit 6 and bit 7 is described in the fx2/usbjtag.c in the zip from the above site. Furthermore I've uploaded experimental USB-Blaster drivers for openwince JTAG tools and OpenOCD there (work in progress).

Kolja

 

[kawk]

cant recognize silicon id

I haven't added the pins in HDL because I can't test it. Maybe you can.

The following is guesswork and untested!

In jtag_logic.vhd (which is in the ZIP available from my site http://www.ixo.de/info/usb_jtag/)

in the ENTITY description add the new pins:

B_TDO  : IN STD_LOGIC; -- JTAG input: TDO, AS/PS input: CONF_DONE
B_ASDO : IN STD_LOGIC; -- AS input: DATAOUT, PS input: nSTATUS
B_TCK  : BUFFER STD_LOGIC; -- JTAG output: TCK to chain, AS/PS DCLK
B_TMS  : BUFFER STD_LOGIC; -- JTAG output: TMS to chain, AS/PS nCONFIG
B_NCE  : BUFFER STD_LOGIC; -- AS output: nCE
B_NCS  : BUFFER STD_LOGIC; -- AS output: nCS
B_TDI  : BUFFER STD_LOGIC; -- JTAG output: TDI to chain, AS: ASDI, PS: DATA0
B_OE   : BUFFER STD_LOGIC; -- LED output/output driver enable

In the PROCESS out_sm, add assignment to and from ASDO/NCE/NCS/OE in
state bits_set_pins_from_data:

IF state = bits_set_pins_from_data THEN
  B_TCK <= ioshifter(0);
  B_TMS <= ioshifter(1);
  B_NCE <= ioshifter(2);
  B_NCS <= ioshifter(3);
  B_TDI <= ioshifter(4);
  B_OE  <= ioshifter(5);
  ioshifter <= "000000" & B_ASDO & B_TDO;
END IF;

If this isn't enough, then you're out of luck; I currently have no setup
to find out what else has to be done to allow AS/PS mode.

Please let me know if this works or not?

 

[lail247]

nios ii evaluation kit 1c12 pdf

i test it ,but it can not work in as/ps mode

 

[kawk]

making usb blaster

Hm, I REALLY should build a test system myself.

What is your target for testing - an EPCSx serial config device? Was it detected somehow or does "my" cable behave as if there is no target connected at all?

There aren't so many unused logic cells in the CPLD, it can't be very complicated.

Maybe ...
* there is just some additional mechanism for driving nCS automatically in byte shift mode,
* or input (from target) to the internal byte shift register can be tied alternatively to JTAG TDO or AS DATAOUT (maybe dependent on nCS???)

We'll see

 

[standardon]

altera usb blaster schematic

HI what about your usb master blaster?

 

[hoenny]

cblsrv platform cable usb is not detected.

ok. now i tested ps in ACEX deivce.
it's fabulous. good~
but, i don't know as.

 

[qpsk]

ft2232d.inf xp

I tested the Kawk's design, but it did not work successfully. The Quartus meant that the configration was successful, but the FPGA did not work rightly.

 

[qpsk]

driver usb blaster rev c

I think the register should be fed not by TDO but B_ASDO.

 

[kawk]

usb blaster protocol

Good idea, maybe it would be wise to make it dependent on nCS? Otherwise it would break JTAG. Try the following: In the jtag_logic.vhdl in PROCESS out_sm change the action in "bytes_get_tdo_set_tdi" state:

  IF state = bytes_get_tdo_set_tdi THEN
    IF B_NCS = '1' THEN -- new
      carry <= B_TDO; -- old, JTAG mode
    ELSE -- new
      carry <= B_ASDO; -- new, AS mode
    END IF; -- new
    B_TDI <= ioshifter(0);
    bitcount <= bitcount - 1;
  END IF;

(referring again to the jtag_logic.vhdl in the zip available from http://www.ixo.de/info/usb_jtag/ with all my previously posted changes applied)

 

[leacom]

usb blaster circuit diagram

there is not a RESET signal in the jtag_logic.vhd, so the state machine does not have a initial state.
will it be ok?

 

[kawk]

homemade usb-blaster

Regarding RESET: The driver always begins with transmission of 64 zeroes so that the state machine is actually reset by the host.

And BTW regarding AS mode: I've got a report by mail that my idea of selecting ASDO instead of TDO as outlined above does not work, there must be something else to do.

Anyone here with a logic analyzer who can provide me with a screenshot where signals of original USB Blaster and my design differ (and software reports transmission failure)? I'll get one in a few days... Please be patient...

 

[janlee]

altera usb blaster driver download

kawk's last modification was pretty good.

I think a power on reset is needed in the statemachine,then statemachine can goto default state waiting commands from usb.

 

[kawk]

usb2lpt ft245

janlee, you're right, under certain circumstances the design may be synthesized in a way that allows the state machine to start in undefined state, from where it never can switch to defined state. I thought the WHEN OTHER clause would prevent this, but obviously it doesn't?!

Fortunately, as there are exactly 16 states, the state machine can be encoded so that every state representable with 4 bits is a defined state and thus no "undefined" state ever may exist. Then, IMHO no reset is needed because the 64 zeroes from the host can move the state machine into a known state in any case.

The following code update will make the design start more reliable for JTAG as well. I'll soon integrate it in the ZIP available from my site, but for now you'll have to integrate it manually.

Either configure your software to encode the state machine with "Minimal Bits" or try the following extra code in jtag_logic.vhd (just after the TYPE STATES() definition):

  ATTRIBUTE ENUM_ENCODING: STRING;
  ATTRIBUTE ENUM_ENCODING OF states: TYPE IS 
    "0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111";

After these changes (and all those changes I previously mentioned in this thread) I can write to an EPCS4 using Active Serial Mode, and reading and verification works as well!

Info: Started Programmer operation at Tue Nov 21 09:37:14 2006
Info: Device 1 silicon ID is 0x12
Info: Erasing ASP configuration device(s)
Info: Programming device 1
Info: Performing verification of type standard on device 1
Info: Device 1 silicon ID is 0x12
Info: Successfully performed operation(s)
Info: Ended Programmer operation at Tue Nov 21 09:37:33 2006

Please let me know if it works for you! I don't have many targets to test with.

Kolja