src/target/dsp5680xx.h

   1 /***************************************************************************
   2  *   Copyright (C) 2011 by Rodrigo L. Rosa                                 *
   3  *   rodrigorosa.LG@gmail.com                                              *
   4  *                                                                         *
   5  *   Based on dsp563xx_once.h written by Mathias Kuester                   *
   6  *   mkdorg@users.sourceforge.net                                          *
   7  *                                                                         *
   8  *   This program is free software; you can redistribute it and/or modify  *
   9  *   it under the terms of the GNU General Public License as published by  *
  10  *   the Free Software Foundation; either version 2 of the License, or     *
  11  *   (at your option) any later version.                                   *
  12  *                                                                         *
  13  *   This program is distributed in the hope that it will be useful,       *
  14  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  15  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  16  *   GNU General Public License for more details.                          *
  17  *                                                                         *
  18  *   You should have received a copy of the GNU General Public License     *
  19  *   along with this program; if not, write to the                         *
  20  *   Free Software Foundation, Inc.,                                       *
  21  *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  22  ***************************************************************************/
  23 #ifndef DSP5680XX_H
  24 #define DSP5680XX_H
  25
  26 #include <jtag/jtag.h>
  27
  28 /**
  29  * @file   dsp5680xx.h
  30  * @author Rodrigo Rosa <rodrigorosa.LG@gmail.com>
  31  * @date   Thu Jun  9 18:54:38 2011
  32  *
  33  * @brief  Basic support for the 5680xx DSP from Freescale.
  34  * The chip has two taps in the JTAG chain, the Master tap and the Core tap.
  35  * In this code the Master tap is only used to unlock the flash memory by executing a JTAG instruction.
  36  *
  37  *
  38  */
  39
  40
  41 #define S_FILE_DATA_OFFSET 0x200000
  42 #define TIME_DIV_FREESCALE 0.3
  43
  44 //----------------------------------------------------------------
  45 // JTAG
  46 //----------------------------------------------------------------
  47 #define DSP5680XX_JTAG_CORE_TAP_IRLEN   4
  48 #define DSP5680XX_JTAG_MASTER_TAP_IRLEN 8
  49
  50 #define JTAG_STATUS_MASK                0x0F
  51
  52 #define JTAG_STATUS_NORMAL              0x01
  53 #define JTAG_STATUS_STOPWAIT            0x05
  54 #define JTAG_STATUS_BUSY                0x09
  55 #define JTAG_STATUS_DEBUG               0x0D
  56 #define JTAG_STATUS_DEAD                0x0f
  57
  58 #define JTAG_INSTR_EXTEST               0x0
  59 #define JTAG_INSTR_SAMPLE_PRELOAD       0x1
  60 #define JTAG_INSTR_IDCODE               0x2
  61 #define JTAG_INSTR_EXTEST_PULLUP        0x3
  62 #define JTAG_INSTR_HIGHZ                0x4
  63 #define JTAG_INSTR_CLAMP                0x5
  64 #define JTAG_INSTR_ENABLE_ONCE          0x6
  65 #define JTAG_INSTR_DEBUG_REQUEST        0x7
  66 #define JTAG_INSTR_BYPASS               0xF
  67 //----------------------------------------------------------------
  68
  69
  70 //----------------------------------------------------------------
  71 // Master TAP instructions from MC56F8000RM.pdf
  72 //----------------------------------------------------------------
  73 #define MASTER_TAP_CMD_BYPASS      0xF
  74 #define MASTER_TAP_CMD_IDCODE      0x2
  75 #define MASTER_TAP_CMD_TLM_SEL     0x5
  76 #define MASTER_TAP_CMD_FLASH_ERASE 0x8
  77 //----------------------------------------------------------------
  78
  79 //----------------------------------------------------------------
  80 // EOnCE control register info
  81 //----------------------------------------------------------------
  82 #define DSP5680XX_ONCE_OCR_EX   (1<<5)
  83 /* EX Bit Definition
  84         0 Remain in the Debug Processing State
  85         1 Leave the Debug Processing State */
  86 #define DSP5680XX_ONCE_OCR_GO   (1<<6)
  87 /* GO Bit Definition
  88         0 Inactive—No Action Taken
  89         1 Execute Controller Instruction */
  90 #define DSP5680XX_ONCE_OCR_RW   (1<<7)
  91 /* RW Bit Definition
  92         0 Write To the Register Specified by the RS[4:0] Bits
  93         1 ReadFrom the Register Specified by the RS[4:0] Bits */
  94 //----------------------------------------------------------------
  95
  96 //----------------------------------------------------------------
  97 // EOnCE Status Register
  98 //----------------------------------------------------------------
  99 #define DSP5680XX_ONCE_OSCR_OS1         (1<<5)
 100 #define DSP5680XX_ONCE_OSCR_OS0         (1<<4)
 101 //----------------------------------------------------------------
 102
 103 //----------------------------------------------------------------
 104 // EOnCE Core Status - Describes the operating status of the core controller
 105 //----------------------------------------------------------------
 106 #define DSP5680XX_ONCE_OSCR_NORMAL_M    (0)
 107 //00  -   Normal      -   Controller Core Executing Instructions or in Reset
 108 #define DSP5680XX_ONCE_OSCR_STOPWAIT_M  (DSP5680XX_ONCE_OSCR_OS0)
 109 //01  -   Stop/Wait   -   Controller Core in Stop or Wait Mode
 110 #define DSP5680XX_ONCE_OSCR_BUSY_M      (DSP5680XX_ONCE_OSCR_OS1)
 111 //10  -   Busy        -   Controller is Performing External or Peripheral Access (Wait States)
 112 #define DSP5680XX_ONCE_OSCR_DEBUG_M     (DSP5680XX_ONCE_OSCR_OS0|DSP5680XX_ONCE_OSCR_OS1)
 113 //11  -   Debug       -   Controller Core Halted and in Debug Mode
 114 #define EONCE_STAT_MASK 0x30
 115 //----------------------------------------------------------------
 116
 117 //----------------------------------------------------------------
 118 // Register Select Encoding (eonce_rev.1.0_0208081.pdf@14)
 119 //----------------------------------------------------------------
 120 #define DSP5680XX_ONCE_NOREG    0x00 /* No register selected */
 121 #define DSP5680XX_ONCE_OCR      0x01 /* OnCE Debug Control Register */
 122 #define DSP5680XX_ONCE_OCNTR    0x02 /* OnCE Breakpoint and Trace Counter */
 123 #define DSP5680XX_ONCE_OSR      0x03 /* EOnCE status register */
 124 #define DSP5680XX_ONCE_OBAR     0x04 /* OnCE Breakpoint Address Register */
 125 #define DSP5680XX_ONCE_OBASE    0x05 /* EOnCE Peripheral Base Address register */
 126 #define DSP5680XX_ONCE_OTXRXSR  0x06 /* EOnCE TXRX Status and Control Register (OTXRXSR)  */
 127 #define DSP5680XX_ONCE_OTX      0x07 /* EOnCE Transmit register (OTX)  */
 128 #define DSP5680XX_ONCE_OPDBR    0x08 /* EOnCE Program Data Bus Register (OPDBR) */
 129 #define DSP5680XX_ONCE_OTX1     0x09 /* EOnCE Upper Transmit register (OTX1) */
 130 #define DSP5680XX_ONCE_OPABFR   0x0A /* OnCE Program Address Register—Fetch cycle */
 131 #define DSP5680XX_ONCE_ORX      0x0B /* EOnCE Receive register (ORX) */
 132 #define DSP5680XX_ONCE_OCNTR_C  0x0C /* Clear OCNTR */
 133 #define DSP5680XX_ONCE_ORX1     0x0D /* EOnCE Upper Receive register (ORX1) */
 134 #define DSP5680XX_ONCE_OTBCR    0x0E /* EOnCE Trace Buffer Control Reg (OTBCR) */
 135 #define DSP5680XX_ONCE_OPABER   0x10 /* OnCE Program Address Register—Execute cycle */
 136 #define DSP5680XX_ONCE_OPFIFO   0x11 /* OnCE Program address FIFO */
 137 #define DSP5680XX_ONCE_OBAR1    0x12 /* EOnCE Breakpoint 1 Unit 0 Address Reg.(OBAR1) */
 138 #define DSP5680XX_ONCE_OPABDR   0x13 /* OnCE Program Address Register—Decode cycle (OPABDR) */
 139 //----------------------------------------------------------------
 140
 141 #define FLUSH_COUNT_READ_WRITE 8192 // This value works, higher values (and lower...) may work as well.
 142 #define FLUSH_COUNT_FLASH 8192
 143 //----------------------------------------------------------------
 144 // HFM (flash module) Commands (ref:MC56F801xRM.pdf@159)
 145 //----------------------------------------------------------------
 146 #define HFM_ERASE_VERIFY                  0x05
 147 #define HFM_CALCULATE_DATA_SIGNATURE      0x06
 148 #define HFM_WORD_PROGRAM                  0x20
 149 #define HFM_PAGE_ERASE                    0x40
 150 #define HFM_MASS_ERASE                    0x41
 151 #define HFM_CALCULATE_IFR_BLOCK_SIGNATURE 0x66
 152 //----------------------------------------------------------------
 153
 154 //----------------------------------------------------------------
 155 // Flashing (ref:MC56F801xRM.pdf@159)
 156 //----------------------------------------------------------------
 157 #define HFM_BASE_ADDR     0x0F400 // In x: mem. (write to S_FILE_DATA_OFFSET+HFM_BASE_ADDR to get data into x: mem.)
 158 // The following are register addresses, not memory addresses (though all registers are memory mapped)
 159 #define HFM_CLK_DIV       0x00 // r/w
 160 #define HFM_CNFG          0x01 // r/w
 161 #define HFM_SECHI         0x03 // r
 162 #define HFM_SECLO         0x04 // r
 163 #define HFM_PROT          0x10 // r/w
 164 #define HFM_PROTB         0x11 // r/w
 165 #define HFM_USTAT         0x13 // r/w
 166 #define HFM_CMD           0x14 // r/w
 167 #define HFM_DATA          0x18 // r
 168 #define HFM_OPT1          0x1B // r
 169 #define HFM_TSTSIG        0x1D // r
 170
 171 #define HFM_EXEC_COMPLETE  0x40
 172
 173 // User status register (USTAT) masks (MC56F80XXRM.pdf@6.7.5)
 174 #define HFM_USTAT_MASK_BLANK 0x4
 175 #define HFM_USTAT_MASK_PVIOL_ACCER 0x30
 176
 177 /**
 178  * The value used on for the FM clock is important to prevent flashing errors and to prevent deterioration of the FM.
 179  * This value was calculated using a spreadsheet tool available on the Freescale website under FAQ 25464.
 180  *
 181  */
 182 #define HFM_CLK_DEFAULT 0x27
 183 /* 0x27 according to freescale cfg, but 0x40 according to freescale spreadsheet... */
 184 #define HFM_FLASH_BASE_ADDR 0x0
 185 #define HFM_SIZE_BYTES 0x4000 // bytes
 186 #define HFM_SIZE_WORDS 0x2000 // words
 187 #define HFM_SECTOR_SIZE 0x200 // Size in bytes
 188 #define HFM_SECTOR_COUNT 0x20
 189 // A 16K block in pages of 256 words.
 190
 191 /**
 192  * Writing HFM_LOCK_FLASH to HFM_LOCK_ADDR_L and HFM_LOCK_ADDR_H will enable security on flash after the next reset.
 193  */
 194 #define HFM_LOCK_FLASH 0xE70A
 195 #define HFM_LOCK_ADDR_L 0x1FF7
 196 #define HFM_LOCK_ADDR_H 0x1FF8
 197 //----------------------------------------------------------------
 198
 199 //----------------------------------------------------------------
 200 // Register Memory Map (eonce_rev.1.0_0208081.pdf@16)
 201 //----------------------------------------------------------------
 202 #define MC568013_EONCE_OBASE_ADDR 0xFF
 203 // The following are relative to EONCE_OBASE_ADDR (EONCE_OBASE_ADDR<<16 + ...)
 204 #define MC568013_EONCE_TX_RX_ADDR    0xFFFE //
 205 #define MC568013_EONCE_TX1_RX1_HIGH_ADDR  0xFFFF // Relative to EONCE_OBASE_ADDR
 206 #define MC568013_EONCE_OCR 0xFFA0 // Relative to EONCE_OBASE_ADDR
 207 //----------------------------------------------------------------
 208
 209 //----------------------------------------------------------------
 210 // SIM addresses & commands (MC56F80xx.h from freescale)
 211 //----------------------------------------------------------------
 212 #define MC568013_SIM_BASE_ADDR 0xF140
 213 #define MC56803x_2x_SIM_BASE_ADDR 0xF100
 214
 215 #define SIM_CMD_RESET 0x10
 216 //----------------------------------------------------------------
 217
 218 /**
 219  * ----------------------------------------------------------------
 220  * ERROR codes - enable automatic parsing of output
 221  * ----------------------------------------------------------------
 222  */
 223 #define DSP5680XX_ERROR_UNKNOWN_OR_ERROR_OPENOCD -100
 224 #define DSP5680XX_ERROR_JTAG_COMM -1
 225 #define DSP5680XX_ERROR_JTAG_RESET -2
 226 #define DSP5680XX_ERROR_JTAG_INVALID_TAP -3
 227 #define DSP5680XX_ERROR_JTAG_DR_LEN_OVERFLOW -4
 228 #define DSP5680XX_ERROR_INVALID_IR_LEN -5
 229 #define DSP5680XX_ERROR_JTAG_TAP_ENABLE_MASTER -6
 230 #define DSP5680XX_ERROR_JTAG_TAP_ENABLE_CORE -7
 231 #define DSP5680XX_ERROR_JTAG_TAP_FIND_MASTER -8
 232 #define DSP5680XX_ERROR_JTAG_TAP_FIND_CORE -9
 233 #define DSP5680XX_ERROR_JTAG_DRSCAN -10
 234 #define DSP5680XX_ERROR_JTAG_IRSCAN -11
 235 #define DSP5680XX_ERROR_ENTER_DEBUG_MODE -12
 236 #define DSP5680XX_ERROR_RESUME -13
 237 #define DSP5680XX_ERROR_WRITE_WITH_TARGET_RUNNING -14
 238 #define DSP5680XX_ERROR_INVALID_DATA_SIZE_UNIT -15
 239 #define DSP5680XX_ERROR_PROTECT_CHECK_INVALID_ARGS -16
 240 #define DSP5680XX_ERROR_FM_BUSY -17
 241 #define DSP5680XX_ERROR_FM_CMD_TIMED_OUT -18
 242 #define DSP5680XX_ERROR_FM_EXEC -19
 243 #define DSP5680XX_ERROR_FM_SET_CLK -20
 244 #define DSP5680XX_ERROR_FLASHING_INVALID_WORD_COUNT -21
 245 #define DSP5680XX_ERROR_FLASHING_CRC -22
 246 #define DSP5680XX_ERROR_FLASHING -23
 247 #define DSP5680XX_ERROR_NOT_IMPLEMENTED_STEP -24
 248 #define DSP5680XX_ERROR_HALT -25
 249 #define DSP5680XX_ERROR_EXIT_DEBUG_MODE -26
 250 #define DSP5680XX_ERROR_TARGET_RUNNING -27
 251 #define DSP5680XX_ERROR_NOT_IN_DEBUG -28
 252 /**
 253  * ----------------------------------------------------------------
 254  */
 255
 256 struct dsp5680xx_common{
 257   //TODO
 258   uint32_t stored_pc;
 259   int flush;
 260 bool debug_mode_enabled;
 261 };
 262
 263 extern struct dsp5680xx_common dsp5680xx_context;
 264
 265 static inline struct dsp5680xx_common *target_to_dsp5680xx(struct target *target){
 266   return target->arch_info;
 267 }
 268
 269 /**
 270  * Writes to flash memory.
 271  * Does not check if flash is erased, it's up to the user to erase the flash before running this function.
 272  * The flashing algorithm runs from RAM, reading from a register to which this function writes to. The algorithm is open loop, there is no control to verify that the FM read the register before writing the next data. A closed loop approach was much slower, and the current implementation does not fail, and if it did the crc check would detect it, allowing to flash again.
 273  *
 274  * @param target
 275  * @param buffer
 276  * @param address Word addressing.
 277  * @param count In bytes.
 278  * @param verify_flash Execute a CRC check after flashing.
 279  *
 280  * @return
 281  */
 282 int dsp5680xx_f_wr(struct target * target, uint8_t *buffer, uint32_t address, uint32_t count, int is_flash_lock);
 283
 284 /**
 285  * The FM has the funcionality of checking if the flash array is erased. This function executes it. It does not support individual sector analysis.
 286  *
 287  * @param target
 288  * @param erased
 289  * @param sector This parameter is ignored because the FM does not support checking if individual sectors are erased.
 290  *
 291  * @return
 292  */
 293 int dsp5680xx_f_erase_check(struct target * target,uint8_t * erased, uint32_t sector);
 294
 295 /**
 296  * Erases either a sector or the complete flash array. If either the range first-last covers the complete array or if @first == 0 and @last == 0 then a mass erase command is executed on the FM. If not, then individual sectors are erased.
 297  *
 298  * @param target
 299  * @param first
 300  * @param last
 301  *
 302  * @return
 303  */
 304 int dsp5680xx_f_erase(struct target * target, int first, int last);
 305
 306 /**
 307  * Reads the memory mapped protection register. A 1 implies the sector is protected, a 0 implies the sector is not protected.
 308  *
 309  * @param target
 310  * @param protected Data read from the protection register.
 311  *
 312  * @return
 313  */
 314 int dsp5680xx_f_protect_check(struct target * target, uint16_t * protected);
 315
 316 /**
 317  * Writes the flash security words with a specific value. The chip's security will be enabled after the first reset following the execution of this function.
 318  *
 319  * @param target
 320  *
 321  * @return
 322  */
 323 int dsp5680xx_f_lock(struct target * target);
 324
 325 /**
 326  * Executes a mass erase command. The must be done from the Master tap.
 327  * It is up to the user to select the master tap (jtag tapenable dsp5680xx.chp) before running this function.
 328  * The flash array will be unsecured (and erased) after the first reset following the execution of this function.
 329  *
 330  * @param target
 331  *
 332  * @return
 333  */
 334 int dsp5680xx_f_unlock(struct target * target);
 335
 336 #endif // dsp5680xx.h