JTAG(ish) access to IPC V850

Disassembly, Reassembly, Tools and devleopment. Going deep with Hardware and Software.
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: JTAG(ish) access to IPC V850

Post by antus »

very well done. good solution!
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
bbmike
Posts: 45
Joined: Thu Apr 02, 2015 1:10 pm
cars: Too many!!

Re: JTAG(ish) access to IPC V850

Post by bbmike »

Gatecrasher wrote:Decided to make this a little less ghetto. I took some measurements and 3D printed a pogo pin jig that fits into the back of the cluster housing. I'm pretty sure this is how Visteon would have programmed these during manufacture. I was really lucky that the PCB contacts used exactly the same spacing as generic perfboard.

It was tedious as hell getting this thing assembled without breaking the pogo pins. I'm even worse at CAD than I am at writing code, and there's enough slop in my printer that everything was a really right fit. But somehow, miraculously, it actually works. I dumped another cluster without opening it. I've also got the serial console for the IMX chip hooked up and working. If I can get flash access to the IMX, this thing will be completely jailbroken.
IPC_Pogo2.jpg
IPC_Pogo4.jpg

Any chance you would be willing to share your 3D printer files and pinout? I'm wanting to start messing around with a similar cluster.
User avatar
Gatecrasher
Posts: 272
Joined: Sat Apr 25, 2020 6:09 am

Re: JTAG(ish) access to IPC V850

Post by Gatecrasher »

I'll try to get it posted this weekend. I've got to admit...I'm kind of embarrassed at how bad it is. I've got a friend who might be able to clean it up a bit for me.
bbmike
Posts: 45
Joined: Thu Apr 02, 2015 1:10 pm
cars: Too many!!

Re: JTAG(ish) access to IPC V850

Post by bbmike »

That would be great. No worries about quality. I still need to learn all the steps to design my own prints.
kostia111
Posts: 47
Joined: Mon Oct 21, 2019 4:58 am

Re: JTAG(ish) access to IPC V850

Post by kostia111 »

Gatecrasher wrote:The V850 does CAN, power control, backlighting, and the analog gauges and indicators. The IMX handles the LCD, MOST, LIN bus, and HUD.

The Dx4 series has been close enough to the Fx4 series that I've been able to find all the registers I need. But obviously "close enough" won't cut it when you're trying to write something like a kernel.

CS+ ships with definition files for 77 different V850s. They're not in plain text, but they're close. It has register locations, along with a ton of other stuff I haven't figured out. I only just got it loaded up today, and I've barely glanced at this stuff. It was just dumb luck that I saw a reference to the file in the UI and decided to check it out.

Here's an example from DF3524.800. There's the register name in plain text FCN0GMCSPRE (FlexCAN0 global clock selection register) and then the register address a little later. FF480008.
ChipDef.jpg
These are installed at C:\Program Files (x86)\Renesas Electronics\CS+\CACX\Device\V850E2\Devicefile.

It might be worth figuring out how to parse those definition files and translate them into Ghidra scripts to label the registers.

I'm currently learning IPC UDD
please share the definition file
for 3524 processor
It is not possible to download from the site from my country
User avatar
Gatecrasher
Posts: 272
Joined: Sat Apr 25, 2020 6:09 am

Re: JTAG(ish) access to IPC V850

Post by Gatecrasher »

Good luck. Please share some information about what you're working on.
Attachments
DF3524.bin
(1.49 MiB) Downloaded 32 times
kostia111
Posts: 47
Joined: Mon Oct 21, 2019 4:58 am

Re: JTAG(ish) access to IPC V850

Post by kostia111 »

On this type of panel, the processor is not readable
I have software and calibration files
task to change the software file (23 functions)
to read the boot area

I'll try to disassemble
and sort this out
Thank you for the definition file
Attachments
flash.bin
(939.75 KiB) Downloaded 32 times
udd.7z
(3.88 MiB) Downloaded 28 times
User avatar
Gatecrasher
Posts: 272
Joined: Sat Apr 25, 2020 6:09 am

Re: JTAG(ish) access to IPC V850

Post by Gatecrasher »

Cool. Thank you for the pictures. I haven't worked on one of those, but it can't be all that different from the Visteon and Aptiv clusters I've played with. The XML files are compatible across different types of clusters too. I've also found similar V850 code structures in the Continental BCMs, so it seems like the suppliers may be working from a common OS framework or something. I'll try to help where I can.
Post Reply