First support for Atmel JTAGICE3. Guessed from USB sniffer

traces made by Knut Schwichtenberg, and by similarity to
JTAGICEmkII.

Still quite incomplete, just megaAVR/JTAG is done by now.



git-svn-id: svn://svn.savannah.nongnu.org/avrdude/trunk/avrdude@1109 81a1dc3b-b13d-400b-aceb-764788c761c2
This commit is contained in:
Joerg Wunsch 2012-11-28 22:39:01 +00:00
parent 1af820c0b9
commit 7a9db49e7c
10 changed files with 2389 additions and 1 deletions

View File

@ -1,3 +1,19 @@
2012-11-28 Joerg Wunsch <j.gnu@uriah.heep.sax.de>
First support for Atmel JTAGICE3. Guessed from USB sniffer
traces made by Knut Schwichtenberg, and by similarity to
JTAGICEmkII.
Still quite incomplete, just megaAVR/JTAG is done by now.
* jtag3.c: New file.
* jtag3.h: (Dito.)
* jtag3_private.h: (Dito.)
* pgm_type.c: Add new programmers
* avrdude.conf.in: (Dito.)
* usbdevs.h: Add new parameters
* Makefile.am: Add new files
* usb_libusb.c: Handle separate event endpoint, and larger
(USB 2.0) packet sizes
2012-11-26 Joerg Wunsch <j.gnu@uriah.heep.sax.de>
* jtagmkII.c: Change all the USB details (endpoint numbers,

View File

@ -120,6 +120,9 @@ libavrdude_a_SOURCES = \
jtagmkII.c \
jtagmkII.h \
jtagmkII_private.h \
jtag3.c \
jtag3.h \
jtag3_private.h \
linux_ppdev.h \
lists.c \
lists.h \

2
NEWS
View File

@ -34,6 +34,8 @@ Current:
X3(1), sck = DSR X3(2), mosi = DCD X3(3), reset = RI X3(4))
+ diecimila (alias for arduino-ft232r)
- Atmel JTAGICE3 (megaAVR/JTAG only so far)
* Bugfixes
- bug #34027: avrdude AT90S1200 Problem
- bug #34518: loading intel hex files > 64k using record-type 4

View File

@ -891,6 +891,28 @@ programmer
connection_type = usb;
;
programmer
id = "jtag3";
desc = "Atmel AVR JTAGICE3 in JTAG mode";
type = "jtagice3";
connection_type = usb;
;
programmer
id = "jtag3pdi";
desc = "Atmel AVR JTAGICE3 in PDI mode";
type = "jtagice3_pdi";
connection_type = usb;
;
programmer
id = "jtag3dw";
desc = "Atmel AVR JTAGICE3 in debugWIRE mode";
type = "jtagice3_dw";
connection_type = usb;
;
programmer
id = "pavr";
desc = "Jason Kyle's pAVR Serial Programmer";

1982
jtag3.c Normal file

File diff suppressed because it is too large Load Diff

54
jtag3.h Normal file
View File

@ -0,0 +1,54 @@
/*
* avrdude - A Downloader/Uploader for AVR device programmers
* Copyright (C) 2012 Joerg Wunsch <j@uriah.heep.sax.de>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
/* $Id$ */
#ifndef jtag3_h
#define jtag3_h
#ifdef __cplusplus
extern "C" {
#endif
int jtag3_send(PROGRAMMER * pgm, unsigned char * data, size_t len);
int jtag3_recv(PROGRAMMER * pgm, unsigned char **msg);
void jtag3_close(PROGRAMMER * pgm);
int jtag3_getsync(PROGRAMMER * pgm, int mode);
int jtag3_getparm(PROGRAMMER * pgm, unsigned char scope,
unsigned char section, unsigned char parm,
unsigned char *value, unsigned char length);
extern const char jtag3_desc[];
extern const char jtag3_dw_desc[];
extern const char jtag3_pdi_desc[];
void jtag3_initpgm (PROGRAMMER * pgm);
void jtag3_dw_initpgm (PROGRAMMER * pgm);
void jtag3_pdi_initpgm (PROGRAMMER * pgm);
/*
* These functions are referenced from stk500v2.c for JTAGICE3 in
* one of the STK500v2 modi.
*/
void jtag3_setup(PROGRAMMER * pgm);
void jtag3_teardown(PROGRAMMER * pgm);
#ifdef __cplusplus
}
#endif
#endif

271
jtag3_private.h Normal file
View File

@ -0,0 +1,271 @@
/*
* avrdude - A Downloader/Uploader for AVR device programmers
* Copyright (C) 2012 Joerg Wunsch <j@uriah.heep.sax.de>
*
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
/* $Id$ */
/*
* JTAGICE3 definitions
* Reverse-engineered from various USB traces.
*/
#if !defined(JTAG3_PRIVATE_EXPORTED)
/*
* Communication with the JTAGICE3 uses three data endpoints:
*
* Endpoint 0x01 (OUT) and 0x82 (IN) are the usual conversation
* endpoints, with a maximal packet size of 512 octets. The
* JTAGICE3 does *not* work on older USB 1.1 hubs that would only
* allow for 64-octet max packet size.
*
* Endpoint 0x83 (IN) is also a bulk endpoint, with a max packetsize
* of 64 octets. This endpoint is used by the ICE to deliver events
* from the ICE.
*
* The request (host -> ICE, EP 0x01) format is:
*
* +---------------------------------------------
* | 0 | 1 | 2 . 3 | 4 | 5 | 6 | ...
* | | | | | | |
* | token |dummy|serial# |scope| cmd |dummy| optional data
* | 0x0e | 0 | NNNN | SS | CC | 0 | ...
* +---------------------------------------------
*
* Both dummy bytes are always 0. The "scope" identifier appears
* to distinguish commands (responses, events, parameters) roughly:
*
* 0x01 - general scope ("hello", "goodbye", firmware info, target
* voltage readout)
* 0x11 - scope for AVR in ISP mode (basically a wrapper around
* the AVRISPmkII commands, as usual)
* 0x12 - scope for AVR (JTAG, PDI, debugWIRE)
*
* The serial number is counted up.
*
*
* The response (ICE -> host, EP 0x82) format is:
*
* +--------------------------------------------------+
* | 0 | 1 . 2 | 3 | 4 | ... | N |
* | | | | | | |
* | token |serial# |scope| rsp | optional data |dummy|
* | 0x0e | NNNN | SS | RR | ... | 0 |
* +--------------------------------------------------+
*
* The response's serial number is mirrored from the request, but the
* dummy byte before the serial number is left out. However, another
* zero dummy byte is always attached to the end of the response data.
* Response codes are similar to the JTAGICEmkII, 0x80 is a generic
* "OK" response, other responses above 0x80 indicate various data
* responses (parameter read, memory read, PC value), and 0xa0 is a
* generic "failure" response. It appears the failure response gets
* another byte appended (probably indicating the reason) after the
* 0 dummy byte, but there's not enough analysis material so far.
*
*
* The event format (EP 0x83) is:
*
* +----------------------------------------
* | 0 | 1 | 2 . 3 | 4 | 5 | ...
* | | | | | |
* | token |dummy|serial# |scope| evt | data
* | 0x0e | 0 | NNNN | SS | EV | ...
* +----------------------------------------
*/
#define TOKEN 0x0e
#endif /* JTAG3_PRIVATE_EXPORTED */
#define SCOPE_INFO 0x00
#define SCOPE_GENERAL 0x01
#define SCOPE_AVR_ISP 0x11
#define SCOPE_AVR 0x12
/* Info scope */
#define CMD3_GET_INFO 0x00
/* byte after GET_INFO is always 0, next is: */
# define CMD3_INFO_NAME 0x80 /* JTAGICE3 */
# define CMD3_INFO_SERIAL 0x81 /* J3xxxxxxxxxx */
/* Generic scope */
#define CMD3_SET_PARAMETER 0x01
#define CMD3_GET_PARAMETER 0x02
#define CMD3_SIGN_ON 0x10
#define CMD3_SIGN_OFF 0x11 /* takes one parameter? */
/* AVR ISP scope: no commands of its own */
/* AVR scope */
//#define CMD3_SET_PARAMETER 0x01
//#define CMD3_GET_PARAMETER 0x02
//#define CMD3_SIGN_ON 0x10 /* an additional signon/-off pair */
//#define CMD3_SIGN_OFF 0x11
#define CMD3_ENTER_PROGMODE 0x15
#define CMD3_LEAVE_PROGMODE 0x16
#define CMD3_ERASE_MEMORY 0x20
#define CMD3_READ_MEMORY 0x21
#define CMD3_WRITE_MEMORY 0x23
#define CMD3_READ_PC 0x35
/* ICE responses */
#define RSP3_OK 0x80
#define RSP3_INFO 0x81
#define RSP3_PC 0x83
#define RSP3_DATA 0x84
#define RSP3_FAILED 0xA0
#define RSP3_STATUS_MASK 0xE0
/* possible failure codes that could be appended to RSP3_FAILED: */
# define RSP3_FAIL_NO_ANSWER 0x20
# define RSP3_FAIL_NO_TARGET_POWER 0x22
# define RSP3_FAIL_WRONG_MODE 0x32 /* progmode vs. non-prog */
# define RSP3_FAIL_NOT_UNDERSTOOD 0x91
/* ICE events */
#define EVT3_BREAK 0x40 /* AVR scope */
#define EVT3_SLEEP 0x11 /* General scope, also wakeup */
#define EVT3_POWER 0x10 /* General scope */
/* memory types */
#define MTYPE_SRAM 0x20 /* target's SRAM or [ext.] IO registers */
#define MTYPE_EEPROM 0x22 /* EEPROM, what way? */
#define MTYPE_SPM 0xA0 /* flash through LPM/SPM */
#define MTYPE_FLASH_PAGE 0xB0 /* flash in programming mode */
#define MTYPE_EEPROM_PAGE 0xB1 /* EEPROM in programming mode */
#define MTYPE_FUSE_BITS 0xB2 /* fuse bits in programming mode */
#define MTYPE_LOCK_BITS 0xB3 /* lock bits in programming mode */
#define MTYPE_SIGN_JTAG 0xB4 /* signature in programming mode */
#define MTYPE_OSCCAL_BYTE 0xB5 /* osccal cells in programming mode */
#define MTYPE_FLASH 0xc0 /* xmega (app.) flash - undocumented in AVR067 */
#define MTYPE_BOOT_FLASH 0xc1 /* xmega boot flash - undocumented in AVR067 */
#define MTYPE_USERSIG 0xc5 /* xmega user signature - undocumented in AVR067 */
#define MTYPE_PRODSIG 0xc6 /* xmega production signature - undocumented in AVR067 */
/*
* Parameters are divided into sections, where the section number
* precedes each parameter address. There are distinct parameter
* sets for generic and AVR scope.
*/
#define PARM3_HW_VER 0x00 /* section 0, generic scope, 1 byte */
#define PARM3_FW_MAJOR 0x01 /* section 0, generic scope, 1 byte */
#define PARM3_FW_MINOR 0x02 /* section 0, generic scope, 1 byte */
#define PARM3_FW_RELEASE 0x03 /* section 0, generic scope, 1 byte;
* always asked for by Atmel Studio,
* but never displayed there */
#define PARM3_VTARGET 0x00 /* section 1, generic scope, 2 bytes,
* in millivolts */
#define PARM3_DEVICEDESC 0x00 /* section 2, memory etc. configuration,
* 31 bytes for tiny/mega AVR, 47 bytes
* for Xmega; is also used in command
* 0x36 in JTAGICEmkII, starting with
* firmware 7.x */
#define PARM3_ARCH 0x00 /* section 0, AVR scope, 1 byte */
# define PARM3_ARCH_TINY 1 /* also small megaAVR with ISP/DW only */
# define PARM3_ARCH_MEGA 2
# define PARM3_ARCH_XMEGA 3
#define PARM3_SESS_PURPOSE 0x01 /* section 0, AVR scope, 1 byte */
# define PARM3_SESS_PROGRAMMING 1
# define PARM3_SESS_DEBUGGING 2
#define PARM3_CONNECTION 0x00 /* section 1, AVR scope, 1 byte */
# define PARM3_CONN_ISP 1
# define PARM3_CONN_JTAG 4
# define PARM3_CONN_DW 5
# define PARM3_CONN_PDI 6
#define PARM3_JTAGCHAIN 0x01 /* JTAG chain info, AVR scope (units
* before/after, bits before/after), 4
* bytes */
#define PARM3_CLK_MEGA_PROG 0x20 /* section 1, AVR scope, 2 bytes (kHz) */
#define PARM3_CLK_MEGA_DEBUG 0x21 /* section 1, AVR scope, 2 bytes (kHz) */
#define PARM3_CLK_XMEGA_JTAG 0x30 /* section 1, AVR scope, 2 bytes (kHz) */
#define PARM3_CLK_XMEGA_PDI 0x31 /* section 1, AVR scope, 2 bytes (kHz) */
/* Xmega erase memory types, for CMND_XMEGA_ERASE */
#define XMEGA_ERASE_CHIP 0x00
#define XMEGA_ERASE_APP 0x01
#define XMEGA_ERASE_BOOT 0x02
#define XMEGA_ERASE_EEPROM 0x03
#define XMEGA_ERASE_APP_PAGE 0x04
#define XMEGA_ERASE_BOOT_PAGE 0x05
#define XMEGA_ERASE_EEPROM_PAGE 0x06
#define XMEGA_ERASE_USERSIG 0x07
#if !defined(JTAG3_PRIVATE_EXPORTED)
struct mega_device_desc {
unsigned char flash_page_size[2]; // in bytes
unsigned char flash_size[4]; // in bytes
unsigned char dummy1[4]; // always 0
unsigned char boot_address[4]; // maximal (BOOTSZ = 3) bootloader
// address, in 16-bit words (!)
unsigned char sram_offset[2]; // pointing behind IO registers
unsigned char eeprom_size[2];
unsigned char eeprom_page_size;
unsigned char ocd_revision; // see XML; basically:
// t13*, t2313*, t4313: 0
// all other DW devices: 1
// ATmega128(A): 1 (!)
// ATmega16*,162,169*,32*,64*: 2
// ATmega2560/2561: 4
// all other megaAVR devices: 3
unsigned char always_one; // always = 1
unsigned char allow_full_page_bitstream; // old AVRs, see XML
unsigned char dummy2[2]; // always 0
// all IO addresses below are given
// in IO number space (without
// offset 0x20), even though e.g.
// OSCCAL always resides outside
unsigned char idr_address; // IDR, aka. OCDR
unsigned char eearh_address; // EEPROM access
unsigned char eearl_address;
unsigned char eecr_address;
unsigned char eedr_address;
unsigned char spmcr_address;
unsigned char osccal_address;
};
/* Xmega device descriptor */
struct xmega_device_desc {
unsigned char nvm_app_offset[4]; // NVM offset for application flash
unsigned char nvm_boot_offset[4]; // NVM offset for boot flash
unsigned char nvm_eeprom_offset[4]; // NVM offset for EEPROM
unsigned char nvm_fuse_offset[4]; // NVM offset for fuses
unsigned char nvm_lock_offset[4]; // NVM offset for lock bits
unsigned char nvm_user_sig_offset[4]; // NVM offset for user signature row
unsigned char nvm_prod_sig_offset[4]; // NVM offset for production sign. row
unsigned char nvm_data_offset[4]; // NVM offset for data memory (SRAM + IO)
unsigned char app_size[4]; // size of application flash
unsigned char boot_size[2]; // size of boot flash
unsigned char flash_page_size[2]; // flash page size
unsigned char eeprom_size[2]; // size of EEPROM
unsigned char eeprom_page_size; // EEPROM page size
unsigned char nvm_base_addr[2]; // IO space base address of NVM controller
unsigned char mcu_base_addr[2]; // IO space base address of MCU control
};
#endif /* JTAG3_PRIVATE_EXPORTED */

View File

@ -37,6 +37,7 @@
#include "ft245r.h"
#include "jtagmkI.h"
#include "jtagmkII.h"
#include "jtag3.h"
#include "par.h"
#include "pickit2.h"
#include "ppi.h"
@ -69,6 +70,9 @@ const PROGRAMMER_TYPE const programmers_types[] = {
{"jtagmkii_dw", jtagmkII_dw_initpgm, jtagmkII_dw_desc},
{"jtagmkii_isp", stk500v2_jtagmkII_initpgm, stk500v2_jtagmkII_desc},
{"jtagmkii_pdi", jtagmkII_pdi_initpgm, jtagmkII_pdi_desc},
{"jtagice3", jtag3_initpgm, jtag3_desc},
{"jtagice3_pdi", jtag3_pdi_initpgm, jtag3_pdi_desc},
{"jtagice3_dw", jtag3_dw_initpgm, jtag3_dw_desc},
{"par", par_initpgm, par_desc},
{"pickit2", pickit2_initpgm, pickit2_desc},
{"serbb", serbb_initpgm, serbb_desc},

View File

@ -52,7 +52,7 @@
# undef interface
#endif
static char usbbuf[USBDEV_MAX_XFER_MKII];
static char usbbuf[USBDEV_MAX_XFER_3];
static int buflen = -1, bufptr;
static int usb_interface;
@ -399,6 +399,32 @@ static int usbdev_recv_frame(union filedescriptor *fd, unsigned char *buf, size_
int i;
unsigned char * p = buf;
/* If there's an event EP, and it has data pending, return it first. */
if (fd->usb.eep != 0)
{
rv = usb_bulk_read(udev, fd->usb.eep, usbbuf,
fd->usb.max_xfer, 1);
if (rv > 4)
{
if (verbose >= 3)
{
unsigned short evtserial = (usbbuf[3] << 8) | usbbuf[2];
fprintf(stderr, "Event serial # 0x%04x, replaced by 0xffff\n",
evtserial);
}
usbbuf[3] = usbbuf[2] = 0xff;
memcpy(buf, usbbuf + 2, rv - 2);
n = rv - 2;
goto printout;
}
else if (rv > 0)
{
fprintf(stderr, "Short event len = %d, ignored.\n", rv);
n = rv;
goto printout;
}
}
n = 0;
do
{
@ -426,6 +452,7 @@ static int usbdev_recv_frame(union filedescriptor *fd, unsigned char *buf, size_
if (nbytes < 0)
return -1;
printout:
if (verbose > 3)
{
i = n;

View File

@ -30,10 +30,17 @@
#define USB_DEVICE_AVRISPMKII 0x2104
#define USB_DEVICE_STK600 0x2106
#define USB_DEVICE_AVRDRAGON 0x2107
#define USB_DEVICE_JTAGICE3 0x2110
/* JTAGICEmkII */
#define USBDEV_BULK_EP_WRITE_MKII 0x02
#define USBDEV_BULK_EP_READ_MKII 0x82
#define USBDEV_MAX_XFER_MKII 64
/* JTAGICE3 */
#define USBDEV_BULK_EP_WRITE_3 0x01
#define USBDEV_BULK_EP_READ_3 0x82
#define USBDEV_EVT_EP_READ_3 0x83
#define USBDEV_MAX_XFER_3 512
#endif /* usbdevs_h */