src/target/dsp5680xx.h

   1 /***************************************************************************
   2  *   Copyright (C) 2011 by Rodrigo L. Rosa                                 *
   3  *   rodrigorosa.LG@gmail.com                                              *
   4  *                                                                         *
   5  *   Based on dsp563xx_once.h written by Mathias Kuester                   *
   6  *   mkdorg@users.sourceforge.net                                          *
   7  *                                                                         *
   8  *   This program is free software; you can redistribute it and/or modify  *
   9  *   it under the terms of the GNU General Public License as published by  *
  10  *   the Free Software Foundation; either version 2 of the License, or     *
  11  *   (at your option) any later version.                                   *
  12  *                                                                         *
  13  *   This program is distributed in the hope that it will be useful,       *
  14  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  15  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  16  *   GNU General Public License for more details.                          *
  17  *                                                                         *
  18  *   You should have received a copy of the GNU General Public License     *
  19  *   along with this program; if not, write to the                         *
  20  *   Free Software Foundation, Inc.,                                       *
  21  *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  22  ***************************************************************************/
  23 #ifndef DSP5680XX_H
  24 #define DSP5680XX_H
  25
  26 #include <jtag/jtag.h>
  27
  28 /**
  29  * @file   dsp5680xx.h
  30  * @author Rodrigo Rosa <rodrigorosa.LG@gmail.com>
  31  * @date   Thu Jun  9 18:54:38 2011
  32  *
  33  * @brief  Basic support for the 5680xx DSP from Freescale.
  34  * The chip has two taps in the JTAG chain, the Master tap and the Core tap.
  35  * In this code the Master tap is only used to unlock the flash memory by executing a JTAG instruction.
  36  *
  37  *
  38  */
  39
  40
  41 #define S_FILE_DATA_OFFSET 0x200000
  42
  43 //----------------------------------------------------------------
  44 // JTAG
  45 //----------------------------------------------------------------
  46 #define DSP5680XX_JTAG_CORE_TAP_IRLEN   4
  47 #define DSP5680XX_JTAG_MASTER_TAP_IRLEN 8
  48
  49 #define JTAG_STATUS_MASK                0x03
  50
  51 #define JTAG_STATUS_NORMAL              0x01
  52 #define JTAG_STATUS_STOPWAIT            0x05
  53 #define JTAG_STATUS_BUSY                0x09
  54 #define JTAG_STATUS_DEBUG               0x0D
  55 #define JTAG_STATUS_DEAD                0x0f
  56
  57 #define JTAG_INSTR_EXTEST               0x0
  58 #define JTAG_INSTR_SAMPLE_PRELOAD       0x1
  59 #define JTAG_INSTR_IDCODE               0x2
  60 #define JTAG_INSTR_EXTEST_PULLUP        0x3
  61 #define JTAG_INSTR_HIGHZ                0x4
  62 #define JTAG_INSTR_CLAMP                0x5
  63 #define JTAG_INSTR_ENABLE_ONCE          0x6
  64 #define JTAG_INSTR_DEBUG_REQUEST        0x7
  65 #define JTAG_INSTR_BYPASS               0xF
  66 //----------------------------------------------------------------
  67
  68
  69 //----------------------------------------------------------------
  70 // Master TAP instructions from MC56F8000RM.pdf
  71 //----------------------------------------------------------------
  72 #define MASTER_TAP_CMD_BYPASS      0xFF
  73 #define MASTER_TAP_CMD_IDCODE      0x02
  74 #define MASTER_TAP_CMD_TLM_SEL     0x05
  75 #define MASTER_TAP_CMD_FLASH_ERASE 0x08
  76 //----------------------------------------------------------------
  77
  78 //----------------------------------------------------------------
  79 // EOnCE control register info
  80 //----------------------------------------------------------------
  81 #define DSP5680XX_ONCE_OCR_EX   (1<<5)
  82 /* EX Bit Definition
  83         0 Remain in the Debug Processing State
  84         1 Leave the Debug Processing State */
  85 #define DSP5680XX_ONCE_OCR_GO   (1<<6)
  86 /* GO Bit Definition
  87         0 Inactive—No Action Taken
  88         1 Execute Controller Instruction */
  89 #define DSP5680XX_ONCE_OCR_RW   (1<<7)
  90 /* RW Bit Definition
  91         0 Write To the Register Specified by the RS[4:0] Bits
  92         1 ReadFrom the Register Specified by the RS[4:0] Bits */
  93 //----------------------------------------------------------------
  94
  95 //----------------------------------------------------------------
  96 // EOnCE Status Register
  97 //----------------------------------------------------------------
  98 #define DSP5680XX_ONCE_OSCR_OS1         (1<<5)
  99 #define DSP5680XX_ONCE_OSCR_OS0         (1<<4)
 100 //----------------------------------------------------------------
 101
 102 //----------------------------------------------------------------
 103 // EOnCE Core Status - Describes the operating status of the core controller
 104 //----------------------------------------------------------------
 105 #define DSP5680XX_ONCE_OSCR_NORMAL_M    (0)
 106 //00  -   Normal      -   Controller Core Executing Instructions or in Reset
 107 #define DSP5680XX_ONCE_OSCR_STOPWAIT_M  (DSP5680XX_ONCE_OSCR_OS0)
 108 //01  -   Stop/Wait   -   Controller Core in Stop or Wait Mode
 109 #define DSP5680XX_ONCE_OSCR_BUSY_M      (DSP5680XX_ONCE_OSCR_OS1)
 110 //10  -   Busy        -   Controller is Performing External or Peripheral Access (Wait States)
 111 #define DSP5680XX_ONCE_OSCR_DEBUG_M     (DSP5680XX_ONCE_OSCR_OS0|DSP5680XX_ONCE_OSCR_OS1)
 112 //11  -   Debug       -   Controller Core Halted and in Debug Mode
 113 #define EONCE_STAT_MASK 0x30
 114 //----------------------------------------------------------------
 115
 116 //----------------------------------------------------------------
 117 // Register Select Encoding (eonce_rev.1.0_0208081.pdf@14)
 118 //----------------------------------------------------------------
 119 #define DSP5680XX_ONCE_NOREG    0x00 /* No register selected */
 120 #define DSP5680XX_ONCE_OCR      0x01 /* OnCE Debug Control Register */
 121 #define DSP5680XX_ONCE_OCNTR    0x02 /* OnCE Breakpoint and Trace Counter */
 122 #define DSP5680XX_ONCE_OSR      0x03 /* EOnCE status register */
 123 #define DSP5680XX_ONCE_OBAR     0x04 /* OnCE Breakpoint Address Register */
 124 #define DSP5680XX_ONCE_OBASE    0x05 /* EOnCE Peripheral Base Address register */
 125 #define DSP5680XX_ONCE_OTXRXSR  0x06 /* EOnCE TXRX Status and Control Register (OTXRXSR)  */
 126 #define DSP5680XX_ONCE_OTX      0x07 /* EOnCE Transmit register (OTX)  */
 127 #define DSP5680XX_ONCE_OPDBR    0x08 /* EOnCE Program Data Bus Register (OPDBR) */
 128 #define DSP5680XX_ONCE_OTX1     0x09 /* EOnCE Upper Transmit register (OTX1) */
 129 #define DSP5680XX_ONCE_OPABFR   0x0A /* OnCE Program Address Register—Fetch cycle */
 130 #define DSP5680XX_ONCE_ORX      0x0B /* EOnCE Receive register (ORX) */
 131 #define DSP5680XX_ONCE_OCNTR_C  0x0C /* Clear OCNTR */
 132 #define DSP5680XX_ONCE_ORX1     0x0D /* EOnCE Upper Receive register (ORX1) */
 133 #define DSP5680XX_ONCE_OTBCR    0x0E /* EOnCE Trace Buffer Control Reg (OTBCR) */
 134 #define DSP5680XX_ONCE_OPABER   0x10 /* OnCE Program Address Register—Execute cycle */
 135 #define DSP5680XX_ONCE_OPFIFO   0x11 /* OnCE Program address FIFO */
 136 #define DSP5680XX_ONCE_OBAR1    0x12 /* EOnCE Breakpoint 1 Unit 0 Address Reg.(OBAR1) */
 137 #define DSP5680XX_ONCE_OPABDR   0x13 /* OnCE Program Address Register—Decode cycle (OPABDR) */
 138 //----------------------------------------------------------------
 139
 140 #define FLUSH_COUNT_READ_WRITE 8192 // This value works, higher values (and lower...) may work as well.
 141 #define FLUSH_COUNT_FLASH 8192
 142 //----------------------------------------------------------------
 143 // HFM (flash module) Commands (ref:MC56F801xRM.pdf@159)
 144 //----------------------------------------------------------------
 145 #define HFM_ERASE_VERIFY                  0x05
 146 #define HFM_CALCULATE_DATA_SIGNATURE      0x06
 147 #define HFM_WORD_PROGRAM                  0x20
 148 #define HFM_PAGE_ERASE                    0x40
 149 #define HFM_MASS_ERASE                    0x41
 150 #define HFM_CALCULATE_IFR_BLOCK_SIGNATURE 0x66
 151 //----------------------------------------------------------------
 152
 153 //----------------------------------------------------------------
 154 // Flashing (ref:MC56F801xRM.pdf@159)
 155 //----------------------------------------------------------------
 156 #define HFM_BASE_ADDR     0x0F400 // In x: mem. (write to S_FILE_DATA_OFFSET+HFM_BASE_ADDR to get data into x: mem.)
 157 // The following are register addresses, not memory addresses (though all registers are memory mapped)
 158 #define HFM_CLK_DIV       0x00 // r/w
 159 #define HFM_CNFG          0x01 // r/w
 160 #define HFM_SECHI         0x03 // r
 161 #define HFM_SECLO         0x04 // r
 162 #define HFM_PROT          0x10 // r/w
 163 #define HFM_PROTB         0x11 // r/w
 164 #define HFM_USTAT         0x13 // r/w
 165 #define HFM_CMD           0x14 // r/w
 166 #define HFM_DATA          0x18 // r
 167 #define HFM_OPT1          0x1B // r
 168 #define HFM_TSTSIG        0x1D // r
 169
 170 #define HFM_EXEC_COMPLETE  0x40
 171
 172 // User status register (USTAT) masks (MC56F80XXRM.pdf@6.7.5)
 173 #define HFM_USTAT_MASK_BLANK 0x4
 174 #define HFM_USTAT_MASK_PVIOL_ACCER 0x30
 175
 176 /**
 177  * The value used on for the FM clock is important to prevent flashing errors and to prevent deterioration of the FM.
 178  * This value was calculated using a spreadsheet tool available on the Freescale website under FAQ 25464.
 179  *
 180  */
 181 #define HFM_CLK_DEFAULT 0x40
 182 #define HFM_FLASH_BASE_ADDR 0x0
 183 #define HFM_SIZE_BYTES 0x4000 // bytes
 184 #define HFM_SIZE_WORDS 0x2000 // words
 185 #define HFM_SECTOR_SIZE 0x200 // Size in bytes
 186 #define HFM_SECTOR_COUNT 0x20
 187 // A 16K block in pages of 256 words.
 188
 189 /**
 190  * Writing HFM_LOCK_FLASH to HFM_LOCK_ADDR_L and HFM_LOCK_ADDR_H will enable security on flash after the next reset.
 191  */
 192 #define HFM_LOCK_FLASH 0xE70A
 193 #define HFM_LOCK_ADDR_L 0x1FF7
 194 #define HFM_LOCK_ADDR_H 0x1FF8
 195 //----------------------------------------------------------------
 196
 197 //----------------------------------------------------------------
 198 // Register Memory Map (eonce_rev.1.0_0208081.pdf@16)
 199 //----------------------------------------------------------------
 200 #define MC568013_EONCE_OBASE_ADDR 0xFF
 201 // The following are relative to EONCE_OBASE_ADDR (EONCE_OBASE_ADDR<<16 + ...)
 202 #define MC568013_EONCE_TX_RX_ADDR    0xFFFE //
 203 #define MC568013_EONCE_TX1_RX1_HIGH_ADDR  0xFFFF // Relative to EONCE_OBASE_ADDR
 204 #define MC568013_EONCE_OCR 0xFFA0 // Relative to EONCE_OBASE_ADDR
 205 //----------------------------------------------------------------
 206
 207 //----------------------------------------------------------------
 208 // SIM addresses & commands (MC56F80xx.h from freescale)
 209 //----------------------------------------------------------------
 210 #define MC568013_SIM_BASE_ADDR 0xF140
 211 #define MC56803x_2x_SIM_BASE_ADDR 0xF100
 212
 213 #define SIM_CMD_RESET 0x10
 214 //----------------------------------------------------------------
 215
 216 struct dsp5680xx_common{
 217   //TODO
 218   uint32_t stored_pc;
 219   int flush;
 220 };
 221
 222 extern struct dsp5680xx_common dsp5680xx_context;
 223
 224 static inline struct dsp5680xx_common *target_to_dsp5680xx(struct target *target){
 225   return target->arch_info;
 226 }
 227
 228 /**
 229  * Writes to flash memory.
 230  * Does not check if flash is erased, it's up to the user to erase the flash before running this function.
 231  * The flashing algorithm runs from RAM, reading from a register to which this function writes to. The algorithm is open loop, there is no control to verify that the FM read the register before writing the next data. A closed loop approach was much slower, and the current implementation does not fail, and if it did the crc check would detect it, allowing to flash again.
 232  *
 233  * @param target
 234  * @param buffer
 235  * @param address Word addressing.
 236  * @param count In bytes.
 237  *
 238  * @return
 239  */
 240 int dsp5680xx_f_wr(struct target * target, uint8_t *buffer, uint32_t address, uint32_t count);
 241
 242 /**
 243  * The FM has the funcionality of checking if the flash array is erased. This function executes it. It does not support individual sector analysis.
 244  *
 245  * @param target
 246  * @param erased
 247  * @param sector This parameter is ignored because the FM does not support checking if individual sectors are erased.
 248  *
 249  * @return
 250  */
 251 int dsp5680xx_f_erase_check(struct target * target,uint8_t * erased, uint32_t sector);
 252
 253 /**
 254  * Erases either a sector or the complete flash array. If either the range first-last covers the complete array or if @first == 0 and @last == 0 then a mass erase command is executed on the FM. If not, then individual sectors are erased.
 255  *
 256  * @param target
 257  * @param first
 258  * @param last
 259  *
 260  * @return
 261  */
 262 int dsp5680xx_f_erase(struct target * target, int first, int last);
 263
 264 /**
 265  * Reads the memory mapped protection register. A 1 implies the sector is protected, a 0 implies the sector is not protected.
 266  *
 267  * @param target
 268  * @param protected Data read from the protection register.
 269  *
 270  * @return
 271  */
 272 int dsp5680xx_f_protect_check(struct target * target, uint16_t * protected);
 273
 274 /**
 275  * Writes the flash security words with a specific value. The chip's security will be enabled after the first reset following the execution of this function.
 276  *
 277  * @param target
 278  *
 279  * @return
 280  */
 281 int dsp5680xx_f_lock(struct target * target);
 282
 283 /**
 284  * Executes a mass erase command. The must be done from the Master tap.
 285  * It is up to the user to select the master tap (jtag tapenable dsp5680xx.chp) before running this function.
 286  * The flash array will be unsecured (and erased) after the first reset following the execution of this function.
 287  *
 288  * @param target
 289  *
 290  * @return
 291  */
 292 int dsp5680xx_f_unlock(struct target * target);
 293
 294 #endif // dsp5680xx.h