avrdude/jtag3_private.h

276 lines
12 KiB
C

/*
* avrdude - A Downloader/Uploader for AVR device programmers
* Copyright (C) 2012 Joerg Wunsch <j@uriah.heep.sax.de>
*
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
/* $Id$ */
/*
* JTAGICE3 definitions
* Reverse-engineered from various USB traces.
*/
#if !defined(JTAG3_PRIVATE_EXPORTED)
/*
* Communication with the JTAGICE3 uses three data endpoints:
*
* Endpoint 0x01 (OUT) and 0x82 (IN) are the usual conversation
* endpoints, with a maximal packet size of 512 octets. The
* JTAGICE3 does *not* work on older USB 1.1 hubs that would only
* allow for 64-octet max packet size.
*
* Endpoint 0x83 (IN) is also a bulk endpoint, with a max packetsize
* of 64 octets. This endpoint is used by the ICE to deliver events
* from the ICE.
*
* The request (host -> ICE, EP 0x01) format is:
*
* +---------------------------------------------
* | 0 | 1 | 2 . 3 | 4 | 5 | 6 | ...
* | | | | | | |
* | token |dummy|serial# |scope| cmd |dummy| optional data
* | 0x0e | 0 | NNNN | SS | CC | 0 | ...
* +---------------------------------------------
*
* Both dummy bytes are always 0. The "scope" identifier appears
* to distinguish commands (responses, events, parameters) roughly:
*
* 0x01 - general scope ("hello", "goodbye", firmware info, target
* voltage readout)
* 0x11 - scope for AVR in ISP mode (basically a wrapper around
* the AVRISPmkII commands, as usual)
* 0x12 - scope for AVR (JTAG, PDI, debugWIRE)
*
* The serial number is counted up.
*
*
* The response (ICE -> host, EP 0x82) format is:
*
* +--------------------------------------------------+
* | 0 | 1 . 2 | 3 | 4 | ... | N |
* | | | | | | |
* | token |serial# |scope| rsp | optional data |dummy|
* | 0x0e | NNNN | SS | RR | ... | 0 |
* +--------------------------------------------------+
*
* The response's serial number is mirrored from the request, but the
* dummy byte before the serial number is left out. However, another
* zero dummy byte is always attached to the end of the response data.
* Response codes are similar to the JTAGICEmkII, 0x80 is a generic
* "OK" response, other responses above 0x80 indicate various data
* responses (parameter read, memory read, PC value), and 0xa0 is a
* generic "failure" response. It appears the failure response gets
* another byte appended (probably indicating the reason) after the
* 0 dummy byte, but there's not enough analysis material so far.
*
*
* The event format (EP 0x83) is:
*
* +----------------------------------------
* | 0 | 1 | 2 . 3 | 4 | 5 | ...
* | | | | | |
* | token |dummy|serial# |scope| evt | data
* | 0x0e | 0 | NNNN | SS | EV | ...
* +----------------------------------------
*/
#define TOKEN 0x0e
#endif /* JTAG3_PRIVATE_EXPORTED */
#define SCOPE_INFO 0x00
#define SCOPE_GENERAL 0x01
#define SCOPE_AVR_ISP 0x11
#define SCOPE_AVR 0x12
/* Info scope */
#define CMD3_GET_INFO 0x00
/* byte after GET_INFO is always 0, next is: */
# define CMD3_INFO_NAME 0x80 /* JTAGICE3 */
# define CMD3_INFO_SERIAL 0x81 /* J3xxxxxxxxxx */
/* Generic scope */
#define CMD3_SET_PARAMETER 0x01
#define CMD3_GET_PARAMETER 0x02
#define CMD3_SIGN_ON 0x10
#define CMD3_SIGN_OFF 0x11 /* takes one parameter? */
/* AVR ISP scope: no commands of its own */
/* AVR scope */
//#define CMD3_SET_PARAMETER 0x01
//#define CMD3_GET_PARAMETER 0x02
//#define CMD3_SIGN_ON 0x10 /* an additional signon/-off pair */
//#define CMD3_SIGN_OFF 0x11
#define CMD3_ENTER_PROGMODE 0x15
#define CMD3_LEAVE_PROGMODE 0x16
#define CMD3_ERASE_MEMORY 0x20
#define CMD3_READ_MEMORY 0x21
#define CMD3_WRITE_MEMORY 0x23
#define CMD3_READ_PC 0x35
/* ICE responses */
#define RSP3_OK 0x80
#define RSP3_INFO 0x81
#define RSP3_PC 0x83
#define RSP3_DATA 0x84
#define RSP3_FAILED 0xA0
#define RSP3_STATUS_MASK 0xE0
/* possible failure codes that could be appended to RSP3_FAILED: */
# define RSP3_FAIL_DEBUGWIRE 0x10
# define RSP3_FAIL_PDI 0x1B
# define RSP3_FAIL_NO_ANSWER 0x20
# define RSP3_FAIL_NO_TARGET_POWER 0x22
# define RSP3_FAIL_WRONG_MODE 0x32 /* progmode vs. non-prog */
# define RSP3_FAIL_UNSUPP_MEMORY 0x34 /* unsupported memory type */
# define RSP3_FAIL_WRONG_LENGTH 0x35 /* wrong lenth for mem access */
# define RSP3_FAIL_NOT_UNDERSTOOD 0x91
/* ICE events */
#define EVT3_BREAK 0x40 /* AVR scope */
#define EVT3_SLEEP 0x11 /* General scope, also wakeup */
#define EVT3_POWER 0x10 /* General scope */
/* memory types */
#define MTYPE_SRAM 0x20 /* target's SRAM or [ext.] IO registers */
#define MTYPE_EEPROM 0x22 /* EEPROM, what way? */
#define MTYPE_SPM 0xA0 /* flash through LPM/SPM */
#define MTYPE_FLASH_PAGE 0xB0 /* flash in programming mode */
#define MTYPE_EEPROM_PAGE 0xB1 /* EEPROM in programming mode */
#define MTYPE_FUSE_BITS 0xB2 /* fuse bits in programming mode */
#define MTYPE_LOCK_BITS 0xB3 /* lock bits in programming mode */
#define MTYPE_SIGN_JTAG 0xB4 /* signature in programming mode */
#define MTYPE_OSCCAL_BYTE 0xB5 /* osccal cells in programming mode */
#define MTYPE_FLASH 0xc0 /* xmega (app.) flash - undocumented in AVR067 */
#define MTYPE_BOOT_FLASH 0xc1 /* xmega boot flash - undocumented in AVR067 */
#define MTYPE_USERSIG 0xc5 /* xmega user signature - undocumented in AVR067 */
#define MTYPE_PRODSIG 0xc6 /* xmega production signature - undocumented in AVR067 */
/*
* Parameters are divided into sections, where the section number
* precedes each parameter address. There are distinct parameter
* sets for generic and AVR scope.
*/
#define PARM3_HW_VER 0x00 /* section 0, generic scope, 1 byte */
#define PARM3_FW_MAJOR 0x01 /* section 0, generic scope, 1 byte */
#define PARM3_FW_MINOR 0x02 /* section 0, generic scope, 1 byte */
#define PARM3_FW_RELEASE 0x03 /* section 0, generic scope, 1 byte;
* always asked for by Atmel Studio,
* but never displayed there */
#define PARM3_VTARGET 0x00 /* section 1, generic scope, 2 bytes,
* in millivolts */
#define PARM3_DEVICEDESC 0x00 /* section 2, memory etc. configuration,
* 31 bytes for tiny/mega AVR, 47 bytes
* for Xmega; is also used in command
* 0x36 in JTAGICEmkII, starting with
* firmware 7.x */
#define PARM3_ARCH 0x00 /* section 0, AVR scope, 1 byte */
# define PARM3_ARCH_TINY 1 /* also small megaAVR with ISP/DW only */
# define PARM3_ARCH_MEGA 2
# define PARM3_ARCH_XMEGA 3
#define PARM3_SESS_PURPOSE 0x01 /* section 0, AVR scope, 1 byte */
# define PARM3_SESS_PROGRAMMING 1
# define PARM3_SESS_DEBUGGING 2
#define PARM3_CONNECTION 0x00 /* section 1, AVR scope, 1 byte */
# define PARM3_CONN_ISP 1
# define PARM3_CONN_JTAG 4
# define PARM3_CONN_DW 5
# define PARM3_CONN_PDI 6
#define PARM3_JTAGCHAIN 0x01 /* JTAG chain info, AVR scope (units
* before/after, bits before/after), 4
* bytes */
#define PARM3_CLK_MEGA_PROG 0x20 /* section 1, AVR scope, 2 bytes (kHz) */
#define PARM3_CLK_MEGA_DEBUG 0x21 /* section 1, AVR scope, 2 bytes (kHz) */
#define PARM3_CLK_XMEGA_JTAG 0x30 /* section 1, AVR scope, 2 bytes (kHz) */
#define PARM3_CLK_XMEGA_PDI 0x31 /* section 1, AVR scope, 2 bytes (kHz) */
/* Xmega erase memory types, for CMND_XMEGA_ERASE */
#define XMEGA_ERASE_CHIP 0x00
#define XMEGA_ERASE_APP 0x01
#define XMEGA_ERASE_BOOT 0x02
#define XMEGA_ERASE_EEPROM 0x03
#define XMEGA_ERASE_APP_PAGE 0x04
#define XMEGA_ERASE_BOOT_PAGE 0x05
#define XMEGA_ERASE_EEPROM_PAGE 0x06
#define XMEGA_ERASE_USERSIG 0x07
#if !defined(JTAG3_PRIVATE_EXPORTED)
struct mega_device_desc {
unsigned char flash_page_size[2]; // in bytes
unsigned char flash_size[4]; // in bytes
unsigned char dummy1[4]; // always 0
unsigned char boot_address[4]; // maximal (BOOTSZ = 3) bootloader
// address, in 16-bit words (!)
unsigned char sram_offset[2]; // pointing behind IO registers
unsigned char eeprom_size[2];
unsigned char eeprom_page_size;
unsigned char ocd_revision; // see XML; basically:
// t13*, t2313*, t4313: 0
// all other DW devices: 1
// ATmega128(A): 1 (!)
// ATmega16*,162,169*,32*,64*: 2
// ATmega2560/2561: 4
// all other megaAVR devices: 3
unsigned char always_one; // always = 1
unsigned char allow_full_page_bitstream; // old AVRs, see XML
unsigned char dummy2[2]; // always 0
// all IO addresses below are given
// in IO number space (without
// offset 0x20), even though e.g.
// OSCCAL always resides outside
unsigned char idr_address; // IDR, aka. OCDR
unsigned char eearh_address; // EEPROM access
unsigned char eearl_address;
unsigned char eecr_address;
unsigned char eedr_address;
unsigned char spmcr_address;
unsigned char osccal_address;
};
/* Xmega device descriptor */
struct xmega_device_desc {
unsigned char nvm_app_offset[4]; // NVM offset for application flash
unsigned char nvm_boot_offset[4]; // NVM offset for boot flash
unsigned char nvm_eeprom_offset[4]; // NVM offset for EEPROM
unsigned char nvm_fuse_offset[4]; // NVM offset for fuses
unsigned char nvm_lock_offset[4]; // NVM offset for lock bits
unsigned char nvm_user_sig_offset[4]; // NVM offset for user signature row
unsigned char nvm_prod_sig_offset[4]; // NVM offset for production sign. row
unsigned char nvm_data_offset[4]; // NVM offset for data memory (SRAM + IO)
unsigned char app_size[4]; // size of application flash
unsigned char boot_size[2]; // size of boot flash
unsigned char flash_page_size[2]; // flash page size
unsigned char eeprom_size[2]; // size of EEPROM
unsigned char eeprom_page_size; // EEPROM page size
unsigned char nvm_base_addr[2]; // IO space base address of NVM controller
unsigned char mcu_base_addr[2]; // IO space base address of MCU control
};
#endif /* JTAG3_PRIVATE_EXPORTED */