e1a2d7255e
crc check was always performed on newly flashed data, now it is optional flash mem can be locked by writing a specific word to a specific address in flash. to verify flash, target must be halted, and this will (when the new halt sequence is implemented) require reseting the chip. if the target is reset after writing the lock words, then it will lock, hence the CRC will fail because it is not possible to read stuff from the target. also added a function that resets the jtag state machine. this is not used yet, but will be soon. it is implemented to allow strict control over JTAG state machine, necessary to implement to halt and unlocking sequences.
296 lines
13 KiB
C
296 lines
13 KiB
C
/***************************************************************************
|
|
* Copyright (C) 2011 by Rodrigo L. Rosa *
|
|
* rodrigorosa.LG@gmail.com *
|
|
* *
|
|
* Based on dsp563xx_once.h written by Mathias Kuester *
|
|
* mkdorg@users.sourceforge.net *
|
|
* *
|
|
* This program is free software; you can redistribute it and/or modify *
|
|
* it under the terms of the GNU General Public License as published by *
|
|
* the Free Software Foundation; either version 2 of the License, or *
|
|
* (at your option) any later version. *
|
|
* *
|
|
* This program is distributed in the hope that it will be useful, *
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of *
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
|
|
* GNU General Public License for more details. *
|
|
* *
|
|
* You should have received a copy of the GNU General Public License *
|
|
* along with this program; if not, write to the *
|
|
* Free Software Foundation, Inc., *
|
|
* 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
|
|
***************************************************************************/
|
|
#ifndef DSP5680XX_H
|
|
#define DSP5680XX_H
|
|
|
|
#include <jtag/jtag.h>
|
|
|
|
/**
|
|
* @file dsp5680xx.h
|
|
* @author Rodrigo Rosa <rodrigorosa.LG@gmail.com>
|
|
* @date Thu Jun 9 18:54:38 2011
|
|
*
|
|
* @brief Basic support for the 5680xx DSP from Freescale.
|
|
* The chip has two taps in the JTAG chain, the Master tap and the Core tap.
|
|
* In this code the Master tap is only used to unlock the flash memory by executing a JTAG instruction.
|
|
*
|
|
*
|
|
*/
|
|
|
|
|
|
#define S_FILE_DATA_OFFSET 0x200000
|
|
|
|
//----------------------------------------------------------------
|
|
// JTAG
|
|
//----------------------------------------------------------------
|
|
#define DSP5680XX_JTAG_CORE_TAP_IRLEN 4
|
|
#define DSP5680XX_JTAG_MASTER_TAP_IRLEN 8
|
|
|
|
#define JTAG_STATUS_MASK 0x03
|
|
|
|
#define JTAG_STATUS_NORMAL 0x01
|
|
#define JTAG_STATUS_STOPWAIT 0x05
|
|
#define JTAG_STATUS_BUSY 0x09
|
|
#define JTAG_STATUS_DEBUG 0x0D
|
|
#define JTAG_STATUS_DEAD 0x0f
|
|
|
|
#define JTAG_INSTR_EXTEST 0x0
|
|
#define JTAG_INSTR_SAMPLE_PRELOAD 0x1
|
|
#define JTAG_INSTR_IDCODE 0x2
|
|
#define JTAG_INSTR_EXTEST_PULLUP 0x3
|
|
#define JTAG_INSTR_HIGHZ 0x4
|
|
#define JTAG_INSTR_CLAMP 0x5
|
|
#define JTAG_INSTR_ENABLE_ONCE 0x6
|
|
#define JTAG_INSTR_DEBUG_REQUEST 0x7
|
|
#define JTAG_INSTR_BYPASS 0xF
|
|
//----------------------------------------------------------------
|
|
|
|
|
|
//----------------------------------------------------------------
|
|
// Master TAP instructions from MC56F8000RM.pdf
|
|
//----------------------------------------------------------------
|
|
#define MASTER_TAP_CMD_BYPASS 0xF
|
|
#define MASTER_TAP_CMD_IDCODE 0x2
|
|
#define MASTER_TAP_CMD_TLM_SEL 0x5
|
|
#define MASTER_TAP_CMD_FLASH_ERASE 0x8
|
|
//----------------------------------------------------------------
|
|
|
|
//----------------------------------------------------------------
|
|
// EOnCE control register info
|
|
//----------------------------------------------------------------
|
|
#define DSP5680XX_ONCE_OCR_EX (1<<5)
|
|
/* EX Bit Definition
|
|
0 Remain in the Debug Processing State
|
|
1 Leave the Debug Processing State */
|
|
#define DSP5680XX_ONCE_OCR_GO (1<<6)
|
|
/* GO Bit Definition
|
|
0 Inactive—No Action Taken
|
|
1 Execute Controller Instruction */
|
|
#define DSP5680XX_ONCE_OCR_RW (1<<7)
|
|
/* RW Bit Definition
|
|
0 Write To the Register Specified by the RS[4:0] Bits
|
|
1 ReadFrom the Register Specified by the RS[4:0] Bits */
|
|
//----------------------------------------------------------------
|
|
|
|
//----------------------------------------------------------------
|
|
// EOnCE Status Register
|
|
//----------------------------------------------------------------
|
|
#define DSP5680XX_ONCE_OSCR_OS1 (1<<5)
|
|
#define DSP5680XX_ONCE_OSCR_OS0 (1<<4)
|
|
//----------------------------------------------------------------
|
|
|
|
//----------------------------------------------------------------
|
|
// EOnCE Core Status - Describes the operating status of the core controller
|
|
//----------------------------------------------------------------
|
|
#define DSP5680XX_ONCE_OSCR_NORMAL_M (0)
|
|
//00 - Normal - Controller Core Executing Instructions or in Reset
|
|
#define DSP5680XX_ONCE_OSCR_STOPWAIT_M (DSP5680XX_ONCE_OSCR_OS0)
|
|
//01 - Stop/Wait - Controller Core in Stop or Wait Mode
|
|
#define DSP5680XX_ONCE_OSCR_BUSY_M (DSP5680XX_ONCE_OSCR_OS1)
|
|
//10 - Busy - Controller is Performing External or Peripheral Access (Wait States)
|
|
#define DSP5680XX_ONCE_OSCR_DEBUG_M (DSP5680XX_ONCE_OSCR_OS0|DSP5680XX_ONCE_OSCR_OS1)
|
|
//11 - Debug - Controller Core Halted and in Debug Mode
|
|
#define EONCE_STAT_MASK 0x30
|
|
//----------------------------------------------------------------
|
|
|
|
//----------------------------------------------------------------
|
|
// Register Select Encoding (eonce_rev.1.0_0208081.pdf@14)
|
|
//----------------------------------------------------------------
|
|
#define DSP5680XX_ONCE_NOREG 0x00 /* No register selected */
|
|
#define DSP5680XX_ONCE_OCR 0x01 /* OnCE Debug Control Register */
|
|
#define DSP5680XX_ONCE_OCNTR 0x02 /* OnCE Breakpoint and Trace Counter */
|
|
#define DSP5680XX_ONCE_OSR 0x03 /* EOnCE status register */
|
|
#define DSP5680XX_ONCE_OBAR 0x04 /* OnCE Breakpoint Address Register */
|
|
#define DSP5680XX_ONCE_OBASE 0x05 /* EOnCE Peripheral Base Address register */
|
|
#define DSP5680XX_ONCE_OTXRXSR 0x06 /* EOnCE TXRX Status and Control Register (OTXRXSR) */
|
|
#define DSP5680XX_ONCE_OTX 0x07 /* EOnCE Transmit register (OTX) */
|
|
#define DSP5680XX_ONCE_OPDBR 0x08 /* EOnCE Program Data Bus Register (OPDBR) */
|
|
#define DSP5680XX_ONCE_OTX1 0x09 /* EOnCE Upper Transmit register (OTX1) */
|
|
#define DSP5680XX_ONCE_OPABFR 0x0A /* OnCE Program Address Register—Fetch cycle */
|
|
#define DSP5680XX_ONCE_ORX 0x0B /* EOnCE Receive register (ORX) */
|
|
#define DSP5680XX_ONCE_OCNTR_C 0x0C /* Clear OCNTR */
|
|
#define DSP5680XX_ONCE_ORX1 0x0D /* EOnCE Upper Receive register (ORX1) */
|
|
#define DSP5680XX_ONCE_OTBCR 0x0E /* EOnCE Trace Buffer Control Reg (OTBCR) */
|
|
#define DSP5680XX_ONCE_OPABER 0x10 /* OnCE Program Address Register—Execute cycle */
|
|
#define DSP5680XX_ONCE_OPFIFO 0x11 /* OnCE Program address FIFO */
|
|
#define DSP5680XX_ONCE_OBAR1 0x12 /* EOnCE Breakpoint 1 Unit 0 Address Reg.(OBAR1) */
|
|
#define DSP5680XX_ONCE_OPABDR 0x13 /* OnCE Program Address Register—Decode cycle (OPABDR) */
|
|
//----------------------------------------------------------------
|
|
|
|
#define FLUSH_COUNT_READ_WRITE 8192 // This value works, higher values (and lower...) may work as well.
|
|
#define FLUSH_COUNT_FLASH 8192
|
|
//----------------------------------------------------------------
|
|
// HFM (flash module) Commands (ref:MC56F801xRM.pdf@159)
|
|
//----------------------------------------------------------------
|
|
#define HFM_ERASE_VERIFY 0x05
|
|
#define HFM_CALCULATE_DATA_SIGNATURE 0x06
|
|
#define HFM_WORD_PROGRAM 0x20
|
|
#define HFM_PAGE_ERASE 0x40
|
|
#define HFM_MASS_ERASE 0x41
|
|
#define HFM_CALCULATE_IFR_BLOCK_SIGNATURE 0x66
|
|
//----------------------------------------------------------------
|
|
|
|
//----------------------------------------------------------------
|
|
// Flashing (ref:MC56F801xRM.pdf@159)
|
|
//----------------------------------------------------------------
|
|
#define HFM_BASE_ADDR 0x0F400 // In x: mem. (write to S_FILE_DATA_OFFSET+HFM_BASE_ADDR to get data into x: mem.)
|
|
// The following are register addresses, not memory addresses (though all registers are memory mapped)
|
|
#define HFM_CLK_DIV 0x00 // r/w
|
|
#define HFM_CNFG 0x01 // r/w
|
|
#define HFM_SECHI 0x03 // r
|
|
#define HFM_SECLO 0x04 // r
|
|
#define HFM_PROT 0x10 // r/w
|
|
#define HFM_PROTB 0x11 // r/w
|
|
#define HFM_USTAT 0x13 // r/w
|
|
#define HFM_CMD 0x14 // r/w
|
|
#define HFM_DATA 0x18 // r
|
|
#define HFM_OPT1 0x1B // r
|
|
#define HFM_TSTSIG 0x1D // r
|
|
|
|
#define HFM_EXEC_COMPLETE 0x40
|
|
|
|
// User status register (USTAT) masks (MC56F80XXRM.pdf@6.7.5)
|
|
#define HFM_USTAT_MASK_BLANK 0x4
|
|
#define HFM_USTAT_MASK_PVIOL_ACCER 0x30
|
|
|
|
/**
|
|
* The value used on for the FM clock is important to prevent flashing errors and to prevent deterioration of the FM.
|
|
* This value was calculated using a spreadsheet tool available on the Freescale website under FAQ 25464.
|
|
*
|
|
*/
|
|
#define HFM_CLK_DEFAULT 0x40
|
|
#define HFM_FLASH_BASE_ADDR 0x0
|
|
#define HFM_SIZE_BYTES 0x4000 // bytes
|
|
#define HFM_SIZE_WORDS 0x2000 // words
|
|
#define HFM_SECTOR_SIZE 0x200 // Size in bytes
|
|
#define HFM_SECTOR_COUNT 0x20
|
|
// A 16K block in pages of 256 words.
|
|
|
|
/**
|
|
* Writing HFM_LOCK_FLASH to HFM_LOCK_ADDR_L and HFM_LOCK_ADDR_H will enable security on flash after the next reset.
|
|
*/
|
|
#define HFM_LOCK_FLASH 0xE70A
|
|
#define HFM_LOCK_ADDR_L 0x1FF7
|
|
#define HFM_LOCK_ADDR_H 0x1FF8
|
|
//----------------------------------------------------------------
|
|
|
|
//----------------------------------------------------------------
|
|
// Register Memory Map (eonce_rev.1.0_0208081.pdf@16)
|
|
//----------------------------------------------------------------
|
|
#define MC568013_EONCE_OBASE_ADDR 0xFF
|
|
// The following are relative to EONCE_OBASE_ADDR (EONCE_OBASE_ADDR<<16 + ...)
|
|
#define MC568013_EONCE_TX_RX_ADDR 0xFFFE //
|
|
#define MC568013_EONCE_TX1_RX1_HIGH_ADDR 0xFFFF // Relative to EONCE_OBASE_ADDR
|
|
#define MC568013_EONCE_OCR 0xFFA0 // Relative to EONCE_OBASE_ADDR
|
|
//----------------------------------------------------------------
|
|
|
|
//----------------------------------------------------------------
|
|
// SIM addresses & commands (MC56F80xx.h from freescale)
|
|
//----------------------------------------------------------------
|
|
#define MC568013_SIM_BASE_ADDR 0xF140
|
|
#define MC56803x_2x_SIM_BASE_ADDR 0xF100
|
|
|
|
#define SIM_CMD_RESET 0x10
|
|
//----------------------------------------------------------------
|
|
|
|
struct dsp5680xx_common{
|
|
//TODO
|
|
uint32_t stored_pc;
|
|
int flush;
|
|
};
|
|
|
|
extern struct dsp5680xx_common dsp5680xx_context;
|
|
|
|
static inline struct dsp5680xx_common *target_to_dsp5680xx(struct target *target){
|
|
return target->arch_info;
|
|
}
|
|
|
|
/**
|
|
* Writes to flash memory.
|
|
* Does not check if flash is erased, it's up to the user to erase the flash before running this function.
|
|
* The flashing algorithm runs from RAM, reading from a register to which this function writes to. The algorithm is open loop, there is no control to verify that the FM read the register before writing the next data. A closed loop approach was much slower, and the current implementation does not fail, and if it did the crc check would detect it, allowing to flash again.
|
|
*
|
|
* @param target
|
|
* @param buffer
|
|
* @param address Word addressing.
|
|
* @param count In bytes.
|
|
* @param verify_flash Execute a CRC check after flashing.
|
|
*
|
|
* @return
|
|
*/
|
|
int dsp5680xx_f_wr(struct target * target, uint8_t *buffer, uint32_t address, uint32_t count, int is_flash_lock);
|
|
|
|
/**
|
|
* The FM has the funcionality of checking if the flash array is erased. This function executes it. It does not support individual sector analysis.
|
|
*
|
|
* @param target
|
|
* @param erased
|
|
* @param sector This parameter is ignored because the FM does not support checking if individual sectors are erased.
|
|
*
|
|
* @return
|
|
*/
|
|
int dsp5680xx_f_erase_check(struct target * target,uint8_t * erased, uint32_t sector);
|
|
|
|
/**
|
|
* Erases either a sector or the complete flash array. If either the range first-last covers the complete array or if @first == 0 and @last == 0 then a mass erase command is executed on the FM. If not, then individual sectors are erased.
|
|
*
|
|
* @param target
|
|
* @param first
|
|
* @param last
|
|
*
|
|
* @return
|
|
*/
|
|
int dsp5680xx_f_erase(struct target * target, int first, int last);
|
|
|
|
/**
|
|
* Reads the memory mapped protection register. A 1 implies the sector is protected, a 0 implies the sector is not protected.
|
|
*
|
|
* @param target
|
|
* @param protected Data read from the protection register.
|
|
*
|
|
* @return
|
|
*/
|
|
int dsp5680xx_f_protect_check(struct target * target, uint16_t * protected);
|
|
|
|
/**
|
|
* Writes the flash security words with a specific value. The chip's security will be enabled after the first reset following the execution of this function.
|
|
*
|
|
* @param target
|
|
*
|
|
* @return
|
|
*/
|
|
int dsp5680xx_f_lock(struct target * target);
|
|
|
|
/**
|
|
* Executes a mass erase command. The must be done from the Master tap.
|
|
* It is up to the user to select the master tap (jtag tapenable dsp5680xx.chp) before running this function.
|
|
* The flash array will be unsecured (and erased) after the first reset following the execution of this function.
|
|
*
|
|
* @param target
|
|
*
|
|
* @return
|
|
*/
|
|
int dsp5680xx_f_unlock(struct target * target);
|
|
|
|
#endif // dsp5680xx.h
|