1 /* SPDX-License-Identifier: GPL-2.0-or-later */
3 /***************************************************************************
4 * Copyright (C) 2011 by Rodrigo L. Rosa *
5 * rodrigorosa.LG@gmail.com *
7 * Based on dsp563xx_once.h written by Mathias Kuester *
8 * mkdorg@users.sourceforge.net *
9 ***************************************************************************/
11 #ifndef OPENOCD_TARGET_DSP5680XX_H
12 #define OPENOCD_TARGET_DSP5680XX_H
14 #include <jtag/jtag.h>
18 * @author Rodrigo Rosa <rodrigorosa.LG@gmail.com>
19 * @date Thu Jun 9 18:54:38 2011
21 * @brief Basic support for the 5680xx DSP from Freescale.
22 * The chip has two taps in the JTAG chain, the Master tap and the Core tap.
23 * In this code the Master tap is only used to unlock the flash memory by executing a JTAG instruction.
27 #define S_FILE_DATA_OFFSET 0x200000
28 #define TIME_DIV_FREESCALE 0.3
30 /** ----------------------------------------------------------------
32 *----------------------------------------------------------------
34 #define DSP5680XX_JTAG_CORE_TAP_IRLEN 4
35 #define DSP5680XX_JTAG_MASTER_TAP_IRLEN 8
37 #define JTAG_STATUS_MASK 0x0F
39 #define JTAG_STATUS_NORMAL 0x01
40 #define JTAG_STATUS_STOPWAIT 0x05
41 #define JTAG_STATUS_BUSY 0x09
42 #define JTAG_STATUS_DEBUG 0x0D
43 #define JTAG_STATUS_DEAD 0x0f
45 #define JTAG_INSTR_EXTEST 0x0
46 #define JTAG_INSTR_SAMPLE_PRELOAD 0x1
47 #define JTAG_INSTR_IDCODE 0x2
48 #define JTAG_INSTR_EXTEST_PULLUP 0x3
49 #define JTAG_INSTR_HIGHZ 0x4
50 #define JTAG_INSTR_CLAMP 0x5
51 #define JTAG_INSTR_ENABLE_ONCE 0x6
52 #define JTAG_INSTR_DEBUG_REQUEST 0x7
53 #define JTAG_INSTR_BYPASS 0xF
55 * ----------------------------------------------------------------
58 /** ----------------------------------------------------------------
59 * Master TAP instructions from MC56F8000RM.pdf
60 * ----------------------------------------------------------------
62 #define MASTER_TAP_CMD_BYPASS 0xF
63 #define MASTER_TAP_CMD_IDCODE 0x2
64 #define MASTER_TAP_CMD_TLM_SEL 0x5
65 #define MASTER_TAP_CMD_FLASH_ERASE 0x8
67 * ----------------------------------------------------------------
70 /** ----------------------------------------------------------------
71 * EOnCE control register info
72 * ----------------------------------------------------------------
74 #define DSP5680XX_ONCE_OCR_EX (1<<5)
76 0 Remain in the Debug Processing State
77 1 Leave the Debug Processing State */
78 #define DSP5680XX_ONCE_OCR_GO (1<<6)
80 0 Inactive—No Action Taken
81 1 Execute Controller Instruction */
82 #define DSP5680XX_ONCE_OCR_RW (1<<7)
84 * 0 Write To the Register Specified by the RS[4:0] Bits
85 * 1 ReadFrom the Register Specified by the RS[4:0] Bits
86 * ----------------------------------------------------------------
89 /** ----------------------------------------------------------------
90 * EOnCE Status Register
91 * ----------------------------------------------------------------
93 #define DSP5680XX_ONCE_OSCR_OS1 (1<<5)
94 #define DSP5680XX_ONCE_OSCR_OS0 (1<<4)
96 * ----------------------------------------------------------------
99 /** ----------------------------------------------------------------
100 * EOnCE Core Status - Describes the operating status of the core controller
101 * ----------------------------------------------------------------
103 #define DSP5680XX_ONCE_OSCR_NORMAL_M (0)
104 /* 00 - Normal - Controller Core Executing Instructions or in Reset */
105 #define DSP5680XX_ONCE_OSCR_STOPWAIT_M (DSP5680XX_ONCE_OSCR_OS0)
106 /* 01 - Stop/Wait - Controller Core in Stop or Wait Mode */
107 #define DSP5680XX_ONCE_OSCR_BUSY_M (DSP5680XX_ONCE_OSCR_OS1)
108 /* 10 - Busy - Controller is Performing External or Peripheral Access (Wait States) */
109 #define DSP5680XX_ONCE_OSCR_DEBUG_M (DSP5680XX_ONCE_OSCR_OS0|DSP5680XX_ONCE_OSCR_OS1)
110 /* 11 - Debug - Controller Core Halted and in Debug Mode */
111 #define EONCE_STAT_MASK 0x30
113 * ----------------------------------------------------------------
116 /** ----------------------------------------------------------------
117 * Register Select Encoding (eonce_rev.1.0_0208081.pdf:14)
118 * ----------------------------------------------------------------
120 #define DSP5680XX_ONCE_NOREG 0x00 /* No register selected */
121 #define DSP5680XX_ONCE_OCR 0x01 /* OnCE Debug Control Register */
122 #define DSP5680XX_ONCE_OCNTR 0x02 /* OnCE Breakpoint and Trace Counter */
123 #define DSP5680XX_ONCE_OSR 0x03 /* EOnCE status register */
124 #define DSP5680XX_ONCE_OBAR 0x04 /* OnCE Breakpoint Address Register */
125 #define DSP5680XX_ONCE_OBASE 0x05 /* EOnCE Peripheral Base Address register */
126 #define DSP5680XX_ONCE_OTXRXSR 0x06 /* EOnCE TXRX Status and Control Register (OTXRXSR) */
127 #define DSP5680XX_ONCE_OTX 0x07 /* EOnCE Transmit register (OTX) */
128 #define DSP5680XX_ONCE_OPDBR 0x08 /* EOnCE Program Data Bus Register (OPDBR) */
129 #define DSP5680XX_ONCE_OTX1 0x09 /* EOnCE Upper Transmit register (OTX1) */
130 #define DSP5680XX_ONCE_OPABFR 0x0A /* OnCE Program Address Register—Fetch cycle */
131 #define DSP5680XX_ONCE_ORX 0x0B /* EOnCE Receive register (ORX) */
132 #define DSP5680XX_ONCE_OCNTR_C 0x0C /* Clear OCNTR */
133 #define DSP5680XX_ONCE_ORX1 0x0D /* EOnCE Upper Receive register (ORX1) */
134 #define DSP5680XX_ONCE_OTBCR 0x0E /* EOnCE Trace Buffer Control Reg (OTBCR) */
135 #define DSP5680XX_ONCE_OPABER 0x10 /* OnCE Program Address Register—Execute cycle */
136 #define DSP5680XX_ONCE_OPFIFO 0x11 /* OnCE Program address FIFO */
137 #define DSP5680XX_ONCE_OBAR1 0x12 /* EOnCE Breakpoint 1 Unit 0 Address Reg.(OBAR1) */
138 #define DSP5680XX_ONCE_OPABDR 0x13 /* OnCE Program Address Register—Decode cycle (OPABDR) */
140 * ----------------------------------------------------------------
143 #define FLUSH_COUNT_READ_WRITE 8192 /* This value works, higher values (and lower...) may work as well. */
144 #define FLUSH_COUNT_FLASH 8192
145 /** ----------------------------------------------------------------
146 * HFM (flash module) Commands (ref:MC56F801xRM.pdf:159)
147 * ----------------------------------------------------------------
149 #define HFM_ERASE_VERIFY 0x05
150 #define HFM_CALCULATE_DATA_SIGNATURE 0x06
151 #define HFM_WORD_PROGRAM 0x20
152 #define HFM_PAGE_ERASE 0x40
153 #define HFM_MASS_ERASE 0x41
154 #define HFM_CALCULATE_IFR_BLOCK_SIGNATURE 0x66
156 * ----------------------------------------------------------------
159 /** ----------------------------------------------------------------
160 * Flashing (ref:MC56F801xRM.pdf:159)
161 * ----------------------------------------------------------------
163 #define HFM_BASE_ADDR 0x0F400 /** In x: mem. (write to S_FILE_DATA_OFFSET+HFM_BASE_ADDR
164 * to get data into x: mem.)
167 * The following are register addresses, not memory
168 * addresses (though all registers are memory mapped)
170 #define HFM_CLK_DIV 0x00 /* r/w */
171 #define HFM_CNFG 0x01 /* r/w */
172 #define HFM_SECHI 0x03 /* r */
173 #define HFM_SECLO 0x04 /* r */
174 #define HFM_PROT 0x10 /* r/w */
175 #define HFM_PROTB 0x11 /* r/w */
176 #define HFM_USTAT 0x13 /* r/w */
177 #define HFM_CMD 0x14 /* r/w */
178 #define HFM_DATA 0x18 /* r */
179 #define HFM_OPT1 0x1B /* r */
180 #define HFM_TSTSIG 0x1D /* r */
182 #define HFM_EXEC_COMPLETE 0x40
184 /* User status register (USTAT) masks (MC56F80XXRM.pdf:6.7.5) */
185 #define HFM_USTAT_MASK_BLANK 0x4
186 #define HFM_USTAT_MASK_PVIOL_ACCER 0x30
189 * The value used on for the FM clock is important to prevent flashing errors and to prevent deterioration of the FM.
190 * This value was calculated using a spreadsheet tool available on the Freescale website under FAQ 25464.
193 #define HFM_CLK_DEFAULT 0x27
194 /* 0x27 according to freescale cfg, but 0x40 according to freescale spreadsheet... */
195 #define HFM_FLASH_BASE_ADDR 0x0
196 #define HFM_SIZE_BYTES 0x4000 /* bytes */
197 #define HFM_SIZE_WORDS 0x2000 /* words */
198 #define HFM_SECTOR_SIZE 0x200 /* Size in bytes */
199 #define HFM_SECTOR_COUNT 0x20
200 /* A 16K block in pages of 256 words. */
203 * Writing HFM_LOCK_FLASH to HFM_LOCK_ADDR_L and HFM_LOCK_ADDR_H will enable security on flash after the next reset.
205 #define HFM_LOCK_FLASH 0xE70A
206 #define HFM_LOCK_ADDR_L 0x1FF7
207 #define HFM_LOCK_ADDR_H 0x1FF8
209 * ----------------------------------------------------------------
212 /** ----------------------------------------------------------------
213 * Register Memory Map (eonce_rev.1.0_0208081.pdf:16)
214 * ----------------------------------------------------------------
216 #define MC568013_EONCE_OBASE_ADDR 0xFF
217 /* The following are relative to EONCE_OBASE_ADDR (EONCE_OBASE_ADDR<<16 + ...) */
218 #define MC568013_EONCE_TX_RX_ADDR 0xFFFE
219 #define MC568013_EONCE_TX1_RX1_HIGH_ADDR 0xFFFF /* Relative to EONCE_OBASE_ADDR */
220 #define MC568013_EONCE_OCR 0xFFA0 /* Relative to EONCE_OBASE_ADDR */
222 * ----------------------------------------------------------------
225 /** ----------------------------------------------------------------
226 * SIM addresses & commands (MC56F80xx.h from freescale)
227 * ----------------------------------------------------------------
229 #define MC568013_SIM_BASE_ADDR 0xF140
230 #define MC56803X_2X_SIM_BASE_ADDR 0xF100
232 #define SIM_CMD_RESET 0x10
234 * ----------------------------------------------------------------
238 * ----------------------------------------------------------------
239 * ERROR codes - enable automatic parsing of output
240 * ----------------------------------------------------------------
242 #define DSP5680XX_ERROR_UNKNOWN_OR_ERROR_OPENOCD -100
243 #define DSP5680XX_ERROR_JTAG_COMM -1
244 #define DSP5680XX_ERROR_JTAG_RESET -2
245 #define DSP5680XX_ERROR_JTAG_INVALID_TAP -3
246 #define DSP5680XX_ERROR_JTAG_DR_LEN_OVERFLOW -4
247 #define DSP5680XX_ERROR_INVALID_IR_LEN -5
248 #define DSP5680XX_ERROR_JTAG_TAP_ENABLE_MASTER -6
249 #define DSP5680XX_ERROR_JTAG_TAP_ENABLE_CORE -7
250 #define DSP5680XX_ERROR_JTAG_TAP_FIND_MASTER -8
251 #define DSP5680XX_ERROR_JTAG_TAP_FIND_CORE -9
252 #define DSP5680XX_ERROR_JTAG_DRSCAN -10
253 #define DSP5680XX_ERROR_JTAG_IRSCAN -11
254 #define DSP5680XX_ERROR_ENTER_DEBUG_MODE -12
255 #define DSP5680XX_ERROR_RESUME -13
256 #define DSP5680XX_ERROR_WRITE_WITH_TARGET_RUNNING -14
257 #define DSP5680XX_ERROR_INVALID_DATA_SIZE_UNIT -15
258 #define DSP5680XX_ERROR_PROTECT_CHECK_INVALID_ARGS -16
259 #define DSP5680XX_ERROR_FM_BUSY -17
260 #define DSP5680XX_ERROR_FM_CMD_TIMED_OUT -18
261 #define DSP5680XX_ERROR_FM_EXEC -19
262 #define DSP5680XX_ERROR_FM_SET_CLK -20
263 #define DSP5680XX_ERROR_FLASHING_INVALID_WORD_COUNT -21
264 #define DSP5680XX_ERROR_FLASHING_CRC -22
265 #define DSP5680XX_ERROR_FLASHING -23
266 #define DSP5680XX_ERROR_NOT_IMPLEMENTED_STEP -24
267 #define DSP5680XX_ERROR_HALT -25
268 #define DSP5680XX_ERROR_EXIT_DEBUG_MODE -26
269 #define DSP5680XX_ERROR_TARGET_RUNNING -27
270 #define DSP5680XX_ERROR_NOT_IN_DEBUG -28
272 * ----------------------------------------------------------------
275 struct dsp5680xx_common {
278 bool debug_mode_enabled;
281 extern struct dsp5680xx_common dsp5680xx_context;
283 static inline struct dsp5680xx_common *target_to_dsp5680xx(struct target
286 return target->arch_info;
290 * Writes to flash memory.
291 * Does not check if flash is erased, it's up to the user to erase the flash before running
293 * The flashing algorithm runs from RAM, reading from a register to which this function
294 * writes to. The algorithm is open loop, there is no control to verify that the FM read
295 * the register before writing the next data. A closed loop approach was much slower,
296 * and the current implementation does not fail, and if it did the crc check would detect it,
297 * allowing to flash again.
301 * @param address Word addressing.
302 * @param count In bytes.
303 * @param is_flash_lock
307 int dsp5680xx_f_wr(struct target *target, const uint8_t *buffer, uint32_t address,
308 uint32_t count, int is_flash_lock);
311 * The FM has the functionality of checking if the flash array is erased. This function
312 * executes it. It does not support individual sector analysis.
316 * @param sector This parameter is ignored because the FM does not support checking if
317 * individual sectors are erased.
321 int dsp5680xx_f_erase_check(struct target *target, uint8_t *erased,
325 * Erases either a sector or the complete flash array. If either the range first-last covers
326 * the complete array or if first == 0 and last == 0 then a mass erase command is executed
327 * on the FM. If not, then individual sectors are erased.
335 int dsp5680xx_f_erase(struct target *target, int first, int last);
338 * Reads the memory mapped protection register. A 1 implies the sector is protected,
339 * a 0 implies the sector is not protected.
342 * @param protected Data read from the protection register.
346 int dsp5680xx_f_protect_check(struct target *target, uint16_t *protected);
349 * Writes the flash security words with a specific value. The chip's security will be
350 * enabled after the first reset following the execution of this function.
356 int dsp5680xx_f_lock(struct target *target);
359 * Executes a mass erase command. The must be done from the Master tap.
360 * It is up to the user to select the master tap (jtag tapenable dsp5680xx.chp)
361 * before running this function.
362 * The flash array will be unsecured (and erased) after the first reset following
363 * the execution of this function.
369 int dsp5680xx_f_unlock(struct target *target);
371 #endif /* OPENOCD_TARGET_DSP5680XX_H */