Glasgow Interface Explorer revD is the last USB-to-digital-protocol adapter you’ll ever need. Right out of the box it comes with more than 40 applets covering the most common embedded interfaces, ready to be used from the command line. For those with more complex needs, Glasgow’s extensible, all-Python software stack lets you quickly combine existing applets or build entirely new cycle-accurate and high-performance protocol engines. Because it relies on Amaranth and YoWASP, you don’t have to worry about linting Verilog code or installing vendor toolchains—all of the tools you’ll need are available.

Our new revD hardware is purpose-built around a Lattice ECP5 FPGA. It brings with it a long list of features, including 4 fully independent I/O banks each with: 8 digital I/Os (1.2 to 5.0 V), 2 analog inputs (single-ended or differential), power source (300 mA), current/voltage sense, fault alerts, and a load switch. Whether you’re reverse-engineering a device to repair it, bringing up a new device for a client, or setting up factory test on a production line, we have you covered. Software isn’t an afterthought but an integral component of the vertically integrated system, and we take reliability very seriously.

Exploration and Play

One day you wake up to your roommate telling you that he found a handheld CB radio buried in the mud in a lake. The device piques your interest, and despite some corrosion, it could still work. Maybe you could even extract its firmware! Thankfully you have your trusty Glasgow Interface Explorer at the ready.

Eyeing the board, you find an ONsemi N24C02 EEPROM. Using a SOIC clip, you can use your Explorer revD to run a voltage scan, revealing a device on the i2c bus, and its address. You run glasgow run memory-24x -V 3.3 -W 1 -A 0b1010001 read 0 256 -f n24c02.bin. The result seems to contain device calibration and settings.

There’s an MCU onboard with lasered-off markings and a Winbond W25Q64FV Flash memory. You connect a SOIC clip to the memory and run glasgow run memory-25q -V 3.3 identify. This displays the SFDP information, confirming that the memory still works. You follow it up with glasgow run memory-25q -V 3.3 --quad-spi read 0 0x800000 -f w25q64fv.bin. The quad mode read command makes short work of the contents, extracting it in about two seconds. It seems to contain audio data, but no machine code.

Using some test pads near the MCU, you can use Glasgow to test for a JTAG port. Glasgow instructs you to run glasgow run jtag-probe -V 3.3 --tck A4 --tms A0 --tdo A1 --tdi A3 --trst A2. You run this and discover that the MCU contains an ARM Cortex core that also supports SWD! With access to the JTAG and SWD pins, you run glasgow run swd-probe -V 3.3 --swclk A4 --swdio A0. This confirms a working SWD port and prints some details about the device. You follow it up with glasgow run swd-probe -V 3.3 --swclk A4 --swdio A0 dump-memory 0 0x100000 -f unknownmcu.bin, making an educated guess about the location of the code in the MCU address space.

In a few seconds, you obtain a firmware dump containing Thumb machine code. Finally, you follow it up with glasgow run probe-rs -V 3.3 --swclk A4 --swdio A0, which lets you debug the Cortex core using https://probe.rs and GDB. Your scenario will likely be different from the one above, but that’s okay: your curiosity will point you towards the solution and Glasgow Interface Explorer will adapt to make it happen.

Features & Specifications

• FX2LP-compatible USB interface IC capable of providing up to 360 Mbps of sustained bandwidth and sub-ms end-to-end latency, subject to OS limitations
• ECP5U-25F FPGA capable of implementing complex, high-speed designs, limited only by the performance of the interface circuitry
• Four fully independent I/O banks, each offering:
  • 20-pin, 0.1" pitch IDC connector
    • All pins are ESD-protected
  • 8 digital I/Os
    • Absolute Maximum Rating of 0 to 5.5 V
    • 1.2V to 5V CMOS I/O standard
    • Sourcing or sinking up to 40 mA per pin for true TTL operation
    • Independent 10k pull-up/down resistors on each pin
    • Approx. 100 MHz bandwidth, subject to protocol limitations and careful RTL design
  • 2 analog input pins
    • Absolute Maximum Rating of -12.5V to +12.5V V
    • Configurable as two single-ended inputs or one differential input
    • Low-pass filtered with 250 kHz @ -3 dB bandwidth
    • 24 bit resolution, 576 kSPS maximum rate (shared across all selected channels)
  • 1 sense pin
    • Absolute Maximum Rating of 0 to +36 V
    • For matching I/O standard, protecting DUT from being powered via ESD diodes, or measuring signals at <1 kHz
    • Hardwired to turn off supply voltage on overvoltage/undervoltage fault, if configured
  • 1 supply output
    • Rated for sourcing up to 300 mA; short circuit current of 1000 mA
    • Protected against back-feeding power from DUT
    • Measures supply current with 10 uA resolution
    • Hardwired to turn off supply voltage on overcurrent fault, if configured
• Two fully independent DRAM channels, each offering:
  • 64 MByte of capacity
  • 8 bit wide, 133 MHz max. (DDR) Octal SPI memory bus
  • Memory controller validated at up to 125 MHz (up to 2000 Mbps of throughput in bursts)
  • 56..112 ns access latency at 125 MHz
• One expansion connector for further customization by the end user

Software

• Python-based software stack built with Amaranth HDL frontend and Yosys/nextpnr toolchain
• Flexible applet system allows interfacing with devices either via the command-line interface or by composing the underlying functionality using approachable Python scripts
• Gradual learning process makes the software approachable for many kinds of end users: the software on-ramp spans from only using the existing functionality via the CLI, to lightly customizing existing functionality without touching the RTL, to writing fully custom RTL for a new application
• Interactive REPL allows experimenting with connected devices without writing any Python code upfront, and the integrated simulator helps implementing complex protocol logic
• Dozens of existing applets solving many common embedded tasks (communication with MCUs, JTAG programming, Flash programming, analyzing and probing busses), often with best-in-class performance
• Interoperability with industry-standard tools like Vivado, flashrom, openocd, or probe-rs
• Vertical integration of the entire hardware/software stack allows for a reliable and streamlined workflow
• All of the dependencies, including the FPGA toolchain, are distributed as Python packages and can be managed using industry-standard tools like pipx, uv, or pdm
• FPGA bitstreams are generated transparently and on-demand without any installation requirements
• The USB driver as well as communication with the FPGA are abstracted by the software stack: applet authors can request a FIFO in the FPGA code and receive a socket-like object that can be used to communicate with the applet
• Works on Linux, Windows, macOS, and FreeBSD with approximately the same USB performance
• Ecosystem is free of generative AI

Interested in This Project?

You can sign up at the top of this page to be notified when the campaign launches and to receive other updates. We only send out relevant content, and you can unsubscribe at any time.