Anritsu MS2721B component level repair

[brainstorm]

This is a continuation/new thread on the work carried on from another thread which starts in this message:

https://www.eevblog.com/forum/testgear/anritsu-ms2721b-internal-cf-card-missing/msg2638362/#msg2638362

I decided to open this new thread as the original topic title (Anritsu MS2721B internal CF card missing) has diverged quite significantly from the investigation that has been going on for a while.

At present I'm trying to interact with the unit via JTAG, see:

https://github.com/GlasgowEmbedded/glasgow/discussions/290

I also removed the LAN IC which was taking around 3-4W of power while (apparently) doing nothing since the unit has an early boot loop (as described in the old aforementioned thread):





Still no luck though, the unit's display seems to turn all pixels black and:

1) The bootloop persists as described in the previous thread: the WAIT signal on the on-board flash ICs goes on repeat.
2) The power consumption is similar, so the LAN IC removal most probably was not the culprit?

I'll keep investigating, but please do suggest areas to test and I will try to dig deeper when and if I have hobby time

[fenugrec]

Please do tell me more about that AUD support you worked with, sounds you have experience with SuperH4 targets (and possibly debug probes/equipment I could borrow?

I'll be level with you, I have no SH4 experience beyond reading a few datasheets. What I have worked on a fair bit is SH2 automotive stuff , mostly SH7055/SH7058.
On those, there's the 8-pin "AUD" interface, luckily not soft-disabled. It has two modes, the most interesting being Branch mode : every bra/jsr/b**/interrupt, the destination PC (or at least the changed bits) is output on AUD.
So I made a crappy board to keep the AUD port in the correct mode, then hooked up a logic analyzer to capture the branches. Even wrote a sigrok PD for it ( https://sigrok.org/wiki/Protocol_decoder:Aud ).

Interesting as this is, it won't help you I'm afraid...
For JTAG, you seem to be in good hands with that Glasgow ticket you filed. I was going to suggest permutations of holding/releasing nRST, asserting NMI, etc... I find it strange that you couldn't get at least an IDCODE.

UBC isn't relevant here unless you can reflash a modified firmware. I've used that to trace reads/writes to certain RAM vars that I could just not find with static analysis : UBC gives you a hardware breakpoint that triggers your interrupt code, in which you can log stuff etc.

Very interesting what the Glasgow folks said about HUDI. I thought it depended entirely on debug helpers compiled in the firmware (a kind of semihosting perhaps, where the debug hooks write to SDIR/etc and the JTAG probe interacts with that).

Have you looked at this ? https://www.lauterbach.com/adaud.html

Hold on... this 7750, it doesn't  have onboard flash, does it ? Couldn't you just watch the external address + bus and follow along ... (sorry if this was covered earlier, details are fuzzy)

[EDIT -  more links]
This guy seems to have it figured out, with a parallel (!) interface :
https://renesasrulz.com/older-tools/hew_target_server/f/hew-target-server---forum/3486/eclipse-hts-hew-target-mcu
couldn't see his link / attachment though.

Maybe relevant... the ST40 (some popular set-topbox thing) has an SH4 core with the probably-same UDI peripheral; maybe another lead. e.g.
https://project-magpie.github.io/2014/06/15/sti7111-st40-jtag-preparations/