17:09 <cyrozap> Matt144: Looking at those photos you posted, it looks a lot like the Intel flash is connected to the SHARC, and the SHARC is connected to the FPGA via its parallel memory interface. If the external serial port is connected to the FPGA, then I'm almost certain that the FPGA just contains a MAC for that serial interface, exposed as an MMIO device to the SHARC, and the SHARC is what loads the bitstream from

17:10 <cyrozap> flash into the FPGA.

17:11 <cyrozap> Your best bet is to dump that flash, get someone to write a SHARC disassembler (or do it yourself--it's not too difficult to write a Ghidra processor module), and then try and figure out where the SHARC handles the serial comms in its code.

17:16 <cyrozap> btw, I highly encourage you to post your reverse-engineering findings (PCB photos, connector pinout, serial protocol, hardware details, etc.) online somewhere, whether it's on a personal website, GitHub/GitLab/etc., hackaday.io, or anywhere else that'll get indexed by a search engine. That way, if someone else happens to have one of those same devices, or acquire one in the future, they won't have to

17:16 <cyrozap> start reverse engneering it from scratch like you did.

21:56 <Guest83> Hello all. I'm trying to use openocd to start debugging a chip, and I'm struggling with "Error: Invalid ACK (6) in DAP response." If i use the d3 tag, it looks like this is coming from jtagdp_overrun_check(). What would cause this? My target is a qualcomm chip so I don't know much about it, and I've just started poking at it after finding the JTAG

21:56 <Guest83> pins with a jtagulator.

21:57 <PaulFertser> Guest83: you can share your -d3 log on some pastebin, probably someone here has an idea

22:09 <Guest83> Sure, put up paste with d3 output and the .cfg file I was using. https://pastebin.com/xkpKQjbA

22:20 <PaulFertser> Guest83: hm, if it's arm9 shouldn't you be creating an arm9<something> target rather than a dap?

22:20 <PaulFertser> I think this DAP is Cortex-specific.

23:18 <Guest83> PaulFertser - you're the best, I modified my .cfg file to create the tap and then create a target like: target create $_TARGETNAME arm926ejs -chain-position $_TARGETNAME and it appears to be working now (I can at least halt the target and get the pc). Thanks for the insight.

23:19 <PaulFertser> Guest83: good luck with your REing!