src/target/dsp5680xx.h

   1 /***************************************************************************
   2  *   Copyright (C) 2011 by Rodrigo L. Rosa                                 *
   3  *   rodrigorosa.LG@gmail.com                                              *
   4  *                                                                         *
   5  *   Based on dsp563xx_once.h written by Mathias Kuester                   *
   6  *   mkdorg@users.sourceforge.net                                          *
   7  *                                                                         *
   8  *   This program is free software; you can redistribute it and/or modify  *
   9  *   it under the terms of the GNU General Public License as published by  *
  10  *   the Free Software Foundation; either version 2 of the License, or     *
  11  *   (at your option) any later version.                                   *
  12  *                                                                         *
  13  *   This program is distributed in the hope that it will be useful,       *
  14  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  15  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  16  *   GNU General Public License for more details.                          *
  17  *                                                                         *
  18  *   You should have received a copy of the GNU General Public License     *
  19  *   along with this program; if not, write to the                         *
  20  *   Free Software Foundation, Inc.,                                       *
  21  *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  22  ***************************************************************************/
  23
  24 #ifndef DSP5680XX_H
  25 #define DSP5680XX_H
  26
  27 #include <jtag/jtag.h>
  28
  29 /**
  30  * @file   dsp5680xx.h
  31  * @author Rodrigo Rosa <rodrigorosa.LG@gmail.com>
  32  * @date   Thu Jun  9 18:54:38 2011
  33  *
  34  * @brief  Basic support for the 5680xx DSP from Freescale.
  35  * The chip has two taps in the JTAG chain, the Master tap and the Core tap.
  36  * In this code the Master tap is only used to unlock the flash memory by executing a JTAG instruction.
  37  *
  38  *
  39  */
  40
  41 #define S_FILE_DATA_OFFSET 0x200000
  42 #define TIME_DIV_FREESCALE 0.3
  43
  44 /** ----------------------------------------------------------------
  45  * JTAG
  46  *----------------------------------------------------------------
  47  */
  48 #define DSP5680XX_JTAG_CORE_TAP_IRLEN   4
  49 #define DSP5680XX_JTAG_MASTER_TAP_IRLEN 8
  50
  51 #define JTAG_STATUS_MASK                0x0F
  52
  53 #define JTAG_STATUS_NORMAL              0x01
  54 #define JTAG_STATUS_STOPWAIT            0x05
  55 #define JTAG_STATUS_BUSY                0x09
  56 #define JTAG_STATUS_DEBUG               0x0D
  57 #define JTAG_STATUS_DEAD                0x0f
  58
  59 #define JTAG_INSTR_EXTEST               0x0
  60 #define JTAG_INSTR_SAMPLE_PRELOAD       0x1
  61 #define JTAG_INSTR_IDCODE               0x2
  62 #define JTAG_INSTR_EXTEST_PULLUP        0x3
  63 #define JTAG_INSTR_HIGHZ                0x4
  64 #define JTAG_INSTR_CLAMP                0x5
  65 #define JTAG_INSTR_ENABLE_ONCE          0x6
  66 #define JTAG_INSTR_DEBUG_REQUEST        0x7
  67 #define JTAG_INSTR_BYPASS               0xF
  68  /**
  69  * ----------------------------------------------------------------
  70  */
  71
  72 /** ----------------------------------------------------------------
  73  * Master TAP instructions from MC56F8000RM.pdf
  74  * ----------------------------------------------------------------
  75  */
  76 #define MASTER_TAP_CMD_BYPASS      0xF
  77 #define MASTER_TAP_CMD_IDCODE      0x2
  78 #define MASTER_TAP_CMD_TLM_SEL     0x5
  79 #define MASTER_TAP_CMD_FLASH_ERASE 0x8
  80  /**
  81  * ----------------------------------------------------------------
  82  */
  83
  84  /** ----------------------------------------------------------------
  85  * EOnCE control register info
  86  * ----------------------------------------------------------------
  87  */
  88 #define DSP5680XX_ONCE_OCR_EX   (1<<5)
  89 /* EX Bit Definition
  90    0 Remain in the Debug Processing State
  91    1 Leave the Debug Processing State */
  92 #define DSP5680XX_ONCE_OCR_GO   (1<<6)
  93 /* GO Bit Definition
  94    0 Inactive—No Action Taken
  95    1 Execute Controller Instruction */
  96 #define DSP5680XX_ONCE_OCR_RW   (1<<7)
  97 /** RW Bit Definition
  98  * 0 Write To the Register Specified by the RS[4:0] Bits
  99  * 1 ReadFrom the Register Specified by the RS[4:0] Bits
 100  * ----------------------------------------------------------------
 101  */
 102
 103  /** ----------------------------------------------------------------
 104  * EOnCE Status Register
 105  * ----------------------------------------------------------------
 106  */
 107 #define DSP5680XX_ONCE_OSCR_OS1  (1<<5)
 108 #define DSP5680XX_ONCE_OSCR_OS0  (1<<4)
 109  /**
 110  * ----------------------------------------------------------------
 111  */
 112
 113  /** ----------------------------------------------------------------
 114  * EOnCE Core Status - Describes the operating status of the core controller
 115  * ----------------------------------------------------------------
 116  */
 117 #define DSP5680XX_ONCE_OSCR_NORMAL_M    (0)
 118 /* 00  -   Normal      -   Controller Core Executing Instructions or in Reset */
 119 #define DSP5680XX_ONCE_OSCR_STOPWAIT_M  (DSP5680XX_ONCE_OSCR_OS0)
 120 /* 01  -   Stop/Wait   -   Controller Core in Stop or Wait Mode */
 121 #define DSP5680XX_ONCE_OSCR_BUSY_M      (DSP5680XX_ONCE_OSCR_OS1)
 122 /* 10  -   Busy -   Controller is Performing External or Peripheral Access (Wait States) */
 123 #define DSP5680XX_ONCE_OSCR_DEBUG_M     (DSP5680XX_ONCE_OSCR_OS0|DSP5680XX_ONCE_OSCR_OS1)
 124 /* 11  -   Debug       -   Controller Core Halted and in Debug Mode */
 125 #define EONCE_STAT_MASK 0x30
 126  /**
 127  * ----------------------------------------------------------------
 128  */
 129
 130  /** ----------------------------------------------------------------
 131  * Register Select Encoding (eonce_rev.1.0_0208081.pdf@14)
 132  * ----------------------------------------------------------------
 133  */
 134 #define DSP5680XX_ONCE_NOREG    0x00    /* No register selected */
 135 #define DSP5680XX_ONCE_OCR      0x01    /* OnCE Debug Control Register */
 136 #define DSP5680XX_ONCE_OCNTR    0x02    /* OnCE Breakpoint and Trace Counter */
 137 #define DSP5680XX_ONCE_OSR      0x03    /* EOnCE status register */
 138 #define DSP5680XX_ONCE_OBAR     0x04    /* OnCE Breakpoint Address Register */
 139 #define DSP5680XX_ONCE_OBASE    0x05    /* EOnCE Peripheral Base Address register */
 140 #define DSP5680XX_ONCE_OTXRXSR  0x06    /* EOnCE TXRX Status and Control Register (OTXRXSR)  */
 141 #define DSP5680XX_ONCE_OTX      0x07    /* EOnCE Transmit register (OTX)  */
 142 #define DSP5680XX_ONCE_OPDBR    0x08    /* EOnCE Program Data Bus Register (OPDBR) */
 143 #define DSP5680XX_ONCE_OTX1     0x09    /* EOnCE Upper Transmit register (OTX1) */
 144 #define DSP5680XX_ONCE_OPABFR   0x0A    /* OnCE Program Address Register—Fetch cycle */
 145 #define DSP5680XX_ONCE_ORX      0x0B    /* EOnCE Receive register (ORX) */
 146 #define DSP5680XX_ONCE_OCNTR_C  0x0C    /* Clear OCNTR */
 147 #define DSP5680XX_ONCE_ORX1     0x0D    /* EOnCE Upper Receive register (ORX1) */
 148 #define DSP5680XX_ONCE_OTBCR    0x0E    /* EOnCE Trace Buffer Control Reg (OTBCR) */
 149 #define DSP5680XX_ONCE_OPABER   0x10    /* OnCE Program Address Register—Execute cycle */
 150 #define DSP5680XX_ONCE_OPFIFO   0x11    /* OnCE Program address FIFO */
 151 #define DSP5680XX_ONCE_OBAR1    0x12    /* EOnCE Breakpoint 1 Unit 0 Address Reg.(OBAR1) */
 152 #define DSP5680XX_ONCE_OPABDR   0x13    /* OnCE Program Address Register—Decode cycle (OPABDR) */
 153  /**
 154  * ----------------------------------------------------------------
 155  */
 156
 157 #define FLUSH_COUNT_READ_WRITE 8192 /* This value works, higher values (and lower...) may work as well. */
 158 #define FLUSH_COUNT_FLASH 8192
 159 /** ----------------------------------------------------------------
 160  * HFM (flash module) Commands (ref:MC56F801xRM.pdf@159)
 161  * ----------------------------------------------------------------
 162  */
 163 #define HFM_ERASE_VERIFY                  0x05
 164 #define HFM_CALCULATE_DATA_SIGNATURE      0x06
 165 #define HFM_WORD_PROGRAM                  0x20
 166 #define HFM_PAGE_ERASE              0x40
 167 #define HFM_MASS_ERASE              0x41
 168 #define HFM_CALCULATE_IFR_BLOCK_SIGNATURE 0x66
 169  /**
 170  * ----------------------------------------------------------------
 171  */
 172
 173 /** ----------------------------------------------------------------
 174  * Flashing (ref:MC56F801xRM.pdf@159)
 175  * ----------------------------------------------------------------
 176  */
 177 #define HFM_BASE_ADDR     0x0F400   /** In x: mem. (write to S_FILE_DATA_OFFSET+HFM_BASE_ADDR
 178                                      * to get data into x: mem.)
 179                                      */
 180 /**
 181  * The following are register addresses, not memory
 182  * addresses (though all registers are memory mapped)
 183  */
 184 #define HFM_CLK_DIV       0x00  /* r/w */
 185 #define HFM_CNFG          0x01  /* r/w */
 186 #define HFM_SECHI        0x03  /* r */
 187 #define HFM_SECLO        0x04  /* r */
 188 #define HFM_PROT          0x10  /* r/w */
 189 #define HFM_PROTB        0x11  /* r/w */
 190 #define HFM_USTAT        0x13  /* r/w */
 191 #define HFM_CMD    0x14  /* r/w */
 192 #define HFM_DATA          0x18  /* r */
 193 #define HFM_OPT1          0x1B  /* r */
 194 #define HFM_TSTSIG      0x1D  /* r */
 195
 196 #define HFM_EXEC_COMPLETE  0x40
 197
 198 /* User status register (USTAT) masks (MC56F80XXRM.pdf@6.7.5) */
 199 #define HFM_USTAT_MASK_BLANK 0x4
 200 #define HFM_USTAT_MASK_PVIOL_ACCER 0x30
 201
 202 /**
 203  * The value used on for the FM clock is important to prevent flashing errors and to prevent deterioration of the FM.
 204  * This value was calculated using a spreadsheet tool available on the Freescale website under FAQ 25464.
 205  *
 206  */
 207 #define HFM_CLK_DEFAULT 0x27
 208 /* 0x27 according to freescale cfg, but 0x40 according to freescale spreadsheet... */
 209 #define HFM_FLASH_BASE_ADDR 0x0
 210 #define HFM_SIZE_BYTES 0x4000   /* bytes */
 211 #define HFM_SIZE_WORDS 0x2000   /* words */
 212 #define HFM_SECTOR_SIZE 0x200   /* Size in bytes */
 213 #define HFM_SECTOR_COUNT 0x20
 214 /* A 16K block in pages of 256 words. */
 215
 216 /**
 217  * Writing HFM_LOCK_FLASH to HFM_LOCK_ADDR_L and HFM_LOCK_ADDR_H will enable security on flash after the next reset.
 218  */
 219 #define HFM_LOCK_FLASH 0xE70A
 220 #define HFM_LOCK_ADDR_L 0x1FF7
 221 #define HFM_LOCK_ADDR_H 0x1FF8
 222  /**
 223  * ----------------------------------------------------------------
 224  */
 225
 226 /** ----------------------------------------------------------------
 227  * Register Memory Map (eonce_rev.1.0_0208081.pdf@16)
 228  * ----------------------------------------------------------------
 229  */
 230 #define MC568013_EONCE_OBASE_ADDR 0xFF
 231 /* The following are relative to EONCE_OBASE_ADDR (EONCE_OBASE_ADDR<<16 + ...) */
 232 #define MC568013_EONCE_TX_RX_ADDR    0xFFFE
 233 #define MC568013_EONCE_TX1_RX1_HIGH_ADDR  0xFFFF /* Relative to EONCE_OBASE_ADDR */
 234 #define MC568013_EONCE_OCR 0xFFA0   /* Relative to EONCE_OBASE_ADDR */
 235  /**
 236  * ----------------------------------------------------------------
 237  */
 238
 239 /** ----------------------------------------------------------------
 240  * SIM addresses & commands (MC56F80xx.h from freescale)
 241  * ----------------------------------------------------------------
 242  */
 243 #define MC568013_SIM_BASE_ADDR 0xF140
 244 #define MC56803x_2x_SIM_BASE_ADDR 0xF100
 245
 246 #define SIM_CMD_RESET 0x10
 247  /**
 248  * ----------------------------------------------------------------
 249  */
 250
 251 /**
 252  * ----------------------------------------------------------------
 253  * ERROR codes - enable automatic parsing of output
 254  * ----------------------------------------------------------------
 255  */
 256 #define DSP5680XX_ERROR_UNKNOWN_OR_ERROR_OPENOCD -100
 257 #define DSP5680XX_ERROR_JTAG_COMM -1
 258 #define DSP5680XX_ERROR_JTAG_RESET -2
 259 #define DSP5680XX_ERROR_JTAG_INVALID_TAP -3
 260 #define DSP5680XX_ERROR_JTAG_DR_LEN_OVERFLOW -4
 261 #define DSP5680XX_ERROR_INVALID_IR_LEN -5
 262 #define DSP5680XX_ERROR_JTAG_TAP_ENABLE_MASTER -6
 263 #define DSP5680XX_ERROR_JTAG_TAP_ENABLE_CORE -7
 264 #define DSP5680XX_ERROR_JTAG_TAP_FIND_MASTER -8
 265 #define DSP5680XX_ERROR_JTAG_TAP_FIND_CORE -9
 266 #define DSP5680XX_ERROR_JTAG_DRSCAN -10
 267 #define DSP5680XX_ERROR_JTAG_IRSCAN -11
 268 #define DSP5680XX_ERROR_ENTER_DEBUG_MODE -12
 269 #define DSP5680XX_ERROR_RESUME -13
 270 #define DSP5680XX_ERROR_WRITE_WITH_TARGET_RUNNING -14
 271 #define DSP5680XX_ERROR_INVALID_DATA_SIZE_UNIT -15
 272 #define DSP5680XX_ERROR_PROTECT_CHECK_INVALID_ARGS -16
 273 #define DSP5680XX_ERROR_FM_BUSY -17
 274 #define DSP5680XX_ERROR_FM_CMD_TIMED_OUT -18
 275 #define DSP5680XX_ERROR_FM_EXEC -19
 276 #define DSP5680XX_ERROR_FM_SET_CLK -20
 277 #define DSP5680XX_ERROR_FLASHING_INVALID_WORD_COUNT -21
 278 #define DSP5680XX_ERROR_FLASHING_CRC -22
 279 #define DSP5680XX_ERROR_FLASHING -23
 280 #define DSP5680XX_ERROR_NOT_IMPLEMENTED_STEP -24
 281 #define DSP5680XX_ERROR_HALT -25
 282 #define DSP5680XX_ERROR_EXIT_DEBUG_MODE -26
 283 #define DSP5680XX_ERROR_TARGET_RUNNING -27
 284 #define DSP5680XX_ERROR_NOT_IN_DEBUG -28
 285 /**
 286  * ----------------------------------------------------------------
 287  */
 288
 289 struct dsp5680xx_common {
 290         uint32_t stored_pc;
 291         int flush;
 292         bool debug_mode_enabled;
 293 };
 294
 295 extern struct dsp5680xx_common dsp5680xx_context;
 296
 297 static inline struct dsp5680xx_common *target_to_dsp5680xx(struct target
 298                                                            *target)
 299 {
 300         return target->arch_info;
 301 }
 302
 303 /**
 304  * Writes to flash memory.
 305  * Does not check if flash is erased, it's up to the user to erase the flash before running
 306  * this function.
 307  * The flashing algorithm runs from RAM, reading from a register to which this function
 308  * writes to. The algorithm is open loop, there is no control to verify that the FM read
 309  * the register before writing the next data. A closed loop approach was much slower,
 310  * and the current implementation does not fail, and if it did the crc check would detect it,
 311  * allowing to flash again.
 312  *
 313  * @param target
 314  * @param buffer
 315  * @param address Word addressing.
 316  * @param count In bytes.
 317  * @param verify_flash Execute a CRC check after flashing.
 318  *
 319  * @return
 320  */
 321 int dsp5680xx_f_wr(struct target *target, uint8_t * buffer, uint32_t address,
 322                 uint32_t count, int is_flash_lock);
 323
 324 /**
 325  * The FM has the funcionality of checking if the flash array is erased. This function
 326  * executes it. It does not support individual sector analysis.
 327  *
 328  * @param target
 329  * @param erased
 330  * @param sector This parameter is ignored because the FM does not support checking if
 331  * individual sectors are erased.
 332  *
 333  * @return
 334  */
 335 int dsp5680xx_f_erase_check(struct target *target, uint8_t * erased,
 336                 uint32_t sector);
 337
 338 /**
 339  * Erases either a sector or the complete flash array. If either the range first-last covers
 340  * the complete array or if @first == 0 and @last == 0 then a mass erase command is executed
 341  * on the FM. If not, then individual sectors are erased.
 342  *
 343  * @param target
 344  * @param first
 345  * @param last
 346  *
 347  * @return
 348  */
 349 int dsp5680xx_f_erase(struct target *target, int first, int last);
 350
 351 /**
 352  * Reads the memory mapped protection register. A 1 implies the sector is protected,
 353  * a 0 implies the sector is not protected.
 354  *
 355  * @param target
 356  * @param protected Data read from the protection register.
 357  *
 358  * @return
 359  */
 360 int dsp5680xx_f_protect_check(struct target *target, uint16_t * protected);
 361
 362 /**
 363  * Writes the flash security words with a specific value. The chip's security will be
 364  * enabled after the first reset following the execution of this function.
 365  *
 366  * @param target
 367  *
 368  * @return
 369  */
 370 int dsp5680xx_f_lock(struct target *target);
 371
 372 /**
 373  * Executes a mass erase command. The must be done from the Master tap.
 374  * It is up to the user to select the master tap (jtag tapenable dsp5680xx.chp)
 375  * before running this function.
 376  * The flash array will be unsecured (and erased) after the first reset following
 377  * the execution of this function.
 378  *
 379  * @param target
 380  *
 381  * @return
 382  */
 383 int dsp5680xx_f_unlock(struct target *target);
 384
 385 #endif /* dsp5680xx.h */