S1ice/Research

From S1MP3 Wiki

Contents 1 Status 2 The S1ice Team 2.1 Team members 2.2 Team helpers 2.3 Contributors 3 Road to s1ice 4 ICE considerations 5 The point of the situation 6 Research status 7 Related pages

Status

Since the original producers have not made public the ICE specifications, we cannot yet use s1ice for its main purpose

A lot of research is still needed, join the s1ice team!

The S1ice Team

Team members

• Legolas558 - programmer, wiki editor, researcher
• JohnDoe - electronical engineer, researcher
• Ali1234 - ICE testing, researcher++

Team helpers

• wiRe
• Aaron
• Wladston - organization, translation, ICE testing, researcher++
• met
• Codertux
• Sprite_tm
• Tincho

Contributors

• ilMastro from KTD - special research++++
• htelephones - hardware: samsung memories and dead s1mp3 devices

Road to s1ice

These documents should be read before getting involved:

• ICE, specific ATJ20xx ICE informations
• JD-ICE interface, the creation of a JD-ICE interface

ICE considerations

JTAG is never mentioned in the original ATJ20xx docs. We definitevely assert that JTAG is not used in our ICE.

JohnDoe has verified the incorrect output status of pins 43 and 45 of the ATJ2085 (that should be input ports in ICE MODE) with a pull-up resistor: ...ports are in ICE MODE when ICEEN- is set, otherwise they are just output ports

Our current ICE reset does not actually reset the internal bitstream. It does not work, or it works in another way.

See also ICE#Facts

The point of the situation

This is our current situation with our ATJ2085 ICE research.

• we know that ICE is supported on ATJ2085, but we do not know anything more specifical about it
• we know that s1mp3 brands do have a PCI interface to use ICE (via a PC) to re-program/debug ATJ2085 and also the previous ATJ2073
• we have asserted that ATJ2085 does not use Z80 JTAG

We have

• built up a JD-ICE interface
• interfaced each ICE to parallel pin correctly via the s1ice software
• asserted that our chip is not burned (no short-circuits found)
• we tried (with irrelevant results) Z80 JTAG protocol
• we get ICE MODE through ICEEN-
• we are making bit stream tests to individuate the SPI behind our device

Help needed! If you build a JD-ICE, please contact us and we will better explain how to perform the correct tests.

Research status

We have experienced constant results using 96bit pseudo-instructions. That is, patterns are repetitive only if grouped in blocks of 96bit. The strange thing is that the ICE is somewhat feeded in blocks of 48bits. Here is an example:

1. inital status, ICE ready and no serial data yet sent
2. a block of 48bits is sent. Such block is one of the constant response blocks, since we have experienced a constant response in previous tests
3. the expected answer is not received, but garbage is returned
4. another block of 48 bits is sent
5. the constant response relative to the before-last block of 48 bits is received
6. looping to (4) enters a 96bit matching loop

Related pages

• S1ice the main article