1 /***************************************************************************
2 * Copyright (C) 2011 by Rodrigo L. Rosa *
3 * rodrigorosa.LG@gmail.com *
5 * Based on dsp563xx_once.h written by Mathias Kuester *
6 * mkdorg@users.sourceforge.net *
8 * This program is free software; you can redistribute it and/or modify *
9 * it under the terms of the GNU General Public License as published by *
10 * the Free Software Foundation; either version 2 of the License, or *
11 * (at your option) any later version. *
13 * This program is distributed in the hope that it will be useful, *
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
16 * GNU General Public License for more details. *
18 * You should have received a copy of the GNU General Public License *
19 * along with this program; if not, write to the *
20 * Free Software Foundation, Inc., *
21 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
22 ***************************************************************************/
26 #include <jtag/jtag.h>
30 * @author Rodrigo Rosa <rodrigorosa.LG@gmail.com>
31 * @date Thu Jun 9 18:54:38 2011
33 * @brief Basic support for the 5680xx DSP from Freescale.
34 * The chip has two taps in the JTAG chain, the Master tap and the Core tap.
35 * In this code the Master tap is only used to unlock the flash memory by executing a JTAG instruction.
41 #define S_FILE_DATA_OFFSET 0x200000
43 //----------------------------------------------------------------
45 //----------------------------------------------------------------
46 #define DSP5680XX_JTAG_CORE_TAP_IRLEN 4
47 #define DSP5680XX_JTAG_MASTER_TAP_IRLEN 8
49 #define JTAG_STATUS_MASK 0x03
51 #define JTAG_STATUS_NORMAL 0x01
52 #define JTAG_STATUS_STOPWAIT 0x05
53 #define JTAG_STATUS_BUSY 0x09
54 #define JTAG_STATUS_DEBUG 0x0D
55 #define JTAG_STATUS_DEAD 0x0f
57 #define JTAG_INSTR_EXTEST 0x0
58 #define JTAG_INSTR_SAMPLE_PRELOAD 0x1
59 #define JTAG_INSTR_IDCODE 0x2
60 #define JTAG_INSTR_EXTEST_PULLUP 0x3
61 #define JTAG_INSTR_HIGHZ 0x4
62 #define JTAG_INSTR_CLAMP 0x5
63 #define JTAG_INSTR_ENABLE_ONCE 0x6
64 #define JTAG_INSTR_DEBUG_REQUEST 0x7
65 #define JTAG_INSTR_BYPASS 0xF
66 //----------------------------------------------------------------
69 //----------------------------------------------------------------
70 // Master TAP instructions from MC56F8000RM.pdf
71 //----------------------------------------------------------------
72 #define MASTER_TAP_CMD_BYPASS 0xFF
73 #define MASTER_TAP_CMD_IDCODE 0x02
74 #define MASTER_TAP_CMD_TLM_SEL 0x05
75 #define MASTER_TAP_CMD_FLASH_ERASE 0x08
76 //----------------------------------------------------------------
78 //----------------------------------------------------------------
79 // EOnCE control register info
80 //----------------------------------------------------------------
81 #define DSP5680XX_ONCE_OCR_EX (1<<5)
83 0 Remain in the Debug Processing State
84 1 Leave the Debug Processing State */
85 #define DSP5680XX_ONCE_OCR_GO (1<<6)
87 0 Inactive—No Action Taken
88 1 Execute Controller Instruction */
89 #define DSP5680XX_ONCE_OCR_RW (1<<7)
91 0 Write To the Register Specified by the RS[4:0] Bits
92 1 ReadFrom the Register Specified by the RS[4:0] Bits */
93 //----------------------------------------------------------------
95 //----------------------------------------------------------------
96 // EOnCE Status Register
97 //----------------------------------------------------------------
98 #define DSP5680XX_ONCE_OSCR_OS1 (1<<5)
99 #define DSP5680XX_ONCE_OSCR_OS0 (1<<4)
100 //----------------------------------------------------------------
102 //----------------------------------------------------------------
103 // EOnCE Core Status - Describes the operating status of the core controller
104 //----------------------------------------------------------------
105 #define DSP5680XX_ONCE_OSCR_NORMAL_M (0)
106 //00 - Normal - Controller Core Executing Instructions or in Reset
107 #define DSP5680XX_ONCE_OSCR_STOPWAIT_M (DSP5680XX_ONCE_OSCR_OS0)
108 //01 - Stop/Wait - Controller Core in Stop or Wait Mode
109 #define DSP5680XX_ONCE_OSCR_BUSY_M (DSP5680XX_ONCE_OSCR_OS1)
110 //10 - Busy - Controller is Performing External or Peripheral Access (Wait States)
111 #define DSP5680XX_ONCE_OSCR_DEBUG_M (DSP5680XX_ONCE_OSCR_OS0|DSP5680XX_ONCE_OSCR_OS1)
112 //11 - Debug - Controller Core Halted and in Debug Mode
113 #define EONCE_STAT_MASK 0x30
114 //----------------------------------------------------------------
116 //----------------------------------------------------------------
117 // Register Select Encoding (eonce_rev.1.0_0208081.pdf@14)
118 //----------------------------------------------------------------
119 #define DSP5680XX_ONCE_NOREG 0x00 /* No register selected */
120 #define DSP5680XX_ONCE_OCR 0x01 /* OnCE Debug Control Register */
121 #define DSP5680XX_ONCE_OCNTR 0x02 /* OnCE Breakpoint and Trace Counter */
122 #define DSP5680XX_ONCE_OSR 0x03 /* EOnCE status register */
123 #define DSP5680XX_ONCE_OBAR 0x04 /* OnCE Breakpoint Address Register */
124 #define DSP5680XX_ONCE_OBASE 0x05 /* EOnCE Peripheral Base Address register */
125 #define DSP5680XX_ONCE_OTXRXSR 0x06 /* EOnCE TXRX Status and Control Register (OTXRXSR) */
126 #define DSP5680XX_ONCE_OTX 0x07 /* EOnCE Transmit register (OTX) */
127 #define DSP5680XX_ONCE_OPDBR 0x08 /* EOnCE Program Data Bus Register (OPDBR) */
128 #define DSP5680XX_ONCE_OTX1 0x09 /* EOnCE Upper Transmit register (OTX1) */
129 #define DSP5680XX_ONCE_OPABFR 0x0A /* OnCE Program Address Register—Fetch cycle */
130 #define DSP5680XX_ONCE_ORX 0x0B /* EOnCE Receive register (ORX) */
131 #define DSP5680XX_ONCE_OCNTR_C 0x0C /* Clear OCNTR */
132 #define DSP5680XX_ONCE_ORX1 0x0D /* EOnCE Upper Receive register (ORX1) */
133 #define DSP5680XX_ONCE_OTBCR 0x0E /* EOnCE Trace Buffer Control Reg (OTBCR) */
134 #define DSP5680XX_ONCE_OPABER 0x10 /* OnCE Program Address Register—Execute cycle */
135 #define DSP5680XX_ONCE_OPFIFO 0x11 /* OnCE Program address FIFO */
136 #define DSP5680XX_ONCE_OBAR1 0x12 /* EOnCE Breakpoint 1 Unit 0 Address Reg.(OBAR1) */
137 #define DSP5680XX_ONCE_OPABDR 0x13 /* OnCE Program Address Register—Decode cycle (OPABDR) */
138 //----------------------------------------------------------------
140 #define FLUSH_COUNT_READ_WRITE 8192 // This value works, higher values (and lower...) may work as well.
141 #define FLUSH_COUNT_FLASH 8192
142 //----------------------------------------------------------------
143 // HFM (flash module) Commands (ref:MC56F801xRM.pdf@159)
144 //----------------------------------------------------------------
145 #define HFM_ERASE_VERIFY 0x05
146 #define HFM_CALCULATE_DATA_SIGNATURE 0x06
147 #define HFM_WORD_PROGRAM 0x20
148 #define HFM_PAGE_ERASE 0x40
149 #define HFM_MASS_ERASE 0x41
150 #define HFM_CALCULATE_IFR_BLOCK_SIGNATURE 0x66
151 //----------------------------------------------------------------
153 //----------------------------------------------------------------
154 // Flashing (ref:MC56F801xRM.pdf@159)
155 //----------------------------------------------------------------
156 #define HFM_BASE_ADDR 0x0F400 // In x: mem. (write to S_FILE_DATA_OFFSET+HFM_BASE_ADDR to get data into x: mem.)
157 // The following are register addresses, not memory addresses (though all registers are memory mapped)
158 #define HFM_CLK_DIV 0x00 // r/w
159 #define HFM_CNFG 0x01 // r/w
160 #define HFM_SECHI 0x03 // r
161 #define HFM_SECLO 0x04 // r
162 #define HFM_PROT 0x10 // r/w
163 #define HFM_PROTB 0x11 // r/w
164 #define HFM_USTAT 0x13 // r/w
165 #define HFM_CMD 0x14 // r/w
166 #define HFM_DATA 0x18 // r
167 #define HFM_OPT1 0x1B // r
168 #define HFM_TSTSIG 0x1D // r
170 #define HFM_EXEC_COMPLETE 0x40
172 // User status register (USTAT) masks (MC56F80XXRM.pdf@6.7.5)
173 #define HFM_USTAT_MASK_BLANK 0x4
174 #define HFM_USTAT_MASK_PVIOL_ACCER 0x30
177 * The value used on for the FM clock is important to prevent flashing errors and to prevent deterioration of the FM.
178 * This value was calculated using a spreadsheet tool available on the Freescale website under FAQ 25464.
181 #define HFM_CLK_DEFAULT 0x40
182 #define HFM_FLASH_BASE_ADDR 0x0
183 #define HFM_SIZE_BYTES 0x4000 // bytes
184 #define HFM_SIZE_WORDS 0x2000 // words
185 #define HFM_SECTOR_SIZE 0x200 // Size in bytes
186 #define HFM_SECTOR_COUNT 0x20
187 // A 16K block in pages of 256 words.
190 * Writing HFM_LOCK_FLASH to HFM_LOCK_ADDR_L and HFM_LOCK_ADDR_H will enable security on flash after the next reset.
192 #define HFM_LOCK_FLASH 0xE70A
193 #define HFM_LOCK_ADDR_L 0x1FF7
194 #define HFM_LOCK_ADDR_H 0x1FF8
195 //----------------------------------------------------------------
197 //----------------------------------------------------------------
198 // Register Memory Map (eonce_rev.1.0_0208081.pdf@16)
199 //----------------------------------------------------------------
200 #define MC568013_EONCE_OBASE_ADDR 0xFF
201 // The following are relative to EONCE_OBASE_ADDR (EONCE_OBASE_ADDR<<16 + ...)
202 #define MC568013_EONCE_TX_RX_ADDR 0xFFFE //
203 #define MC568013_EONCE_TX1_RX1_HIGH_ADDR 0xFFFF // Relative to EONCE_OBASE_ADDR
204 #define MC568013_EONCE_OCR 0xFFA0 // Relative to EONCE_OBASE_ADDR
205 //----------------------------------------------------------------
207 //----------------------------------------------------------------
208 // SIM addresses & commands (MC56F80xx.h from freescale)
209 //----------------------------------------------------------------
210 #define MC568013_SIM_BASE_ADDR 0xF140
211 #define MC56803x_2x_SIM_BASE_ADDR 0xF100
213 #define SIM_CMD_RESET 0x10
214 //----------------------------------------------------------------
216 struct dsp5680xx_common{
222 static inline struct dsp5680xx_common *target_to_dsp5680xx(struct target *target){
223 return target->arch_info;
227 * Writes to flash memory.
228 * Does not check if flash is erased, it's up to the user to erase the flash before running this function.
233 * @param count In bytes.
237 int dsp5680xx_f_wr(struct target * target, uint8_t *buffer, uint32_t address, uint32_t count);
240 * The FM has the funcionality of checking if the flash array is erased. This function executes it. It does not support individual sector analysis.
244 * @param sector This parameter is ignored because the FM does not support checking if individual sectors are erased.
248 int dsp5680xx_f_erase_check(struct target * target,uint8_t * erased, uint32_t sector);
251 * Erases either a sector or the complete flash array. If either the range first-last covers the complete array or if @first == 0 and @last == 0 then a mass erase command is executed on the FM. If not, then individual sectors are erased.
259 int dsp5680xx_f_erase(struct target * target, int first, int last);
262 * Reads the memory mapped protection register.
265 * @param protected Data read from the protection register.
269 int dsp5680xx_f_protect_check(struct target * target, uint16_t * protected);
272 * Writes the flash security words with a specific value. The chip's security will be enabled after the first reset following the execution of this function.
278 int dsp5680xx_f_lock(struct target * target);
281 * Executes a mass erase command. The must be done from the Master tap.
282 * It is up to the user to select the master tap (jtag tapenable dsp5680xx.chp) before running this function.
283 * The flash array will be unsecured (and erased) after the first reset following the execution of this function.
289 int dsp5680xx_f_unlock(struct target * target);
291 #endif // dsp5680xx.h