Update FTDI C232HM cfg, and add two new cfgs from cable modem research

Change-Id: Idbeffcd5ff4380b1e7c9fd5ef6ba3ca77cc22d99
Signed-off-by: Al Dyrius <aldyrius42@gmail.com>
Reviewed-on: http://openocd.zylin.com/5307
Tested-by: jenkins
Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>

1 files changed, 31 insertions, 0 deletions

diff --git a/tcl/board/kc100.cfg b/tcl/board/kc100.cfg
new file mode 100644
index 0000000..1d383be
--- /dev/null
+++ b/tcl/board/kc100.cfg
@@ -0,0 +1,31 @@
+# Knovative KC-100 cable modem
+
+# TNETC4401PYP, 208-QFP U3
+source [find target/tnetc4401.cfg]
+
+# 14-pin EJTAG on JP1. Standard pinout, 1-3-5-7-9-11 = nTRST-TDI-TDO-TMS-TCK-nSRST. Use 2 for GND.
+# Was initially disabled in hardware; had to add a solder bridge reenabling R124, R125 on back.
+reset_config trst_and_srst separate
+
+# 16Mb Intel CFI flash. Note this CPU has an internal ROM at 0x1FC0000 (phys) for cold boot.
+# All that really does is some minimal checks before jumping to external flash at 0x00000000 phys.
+# That is remapped to 0xB0000000 uncached, 0x90000000 cached.
+flash bank intel cfi 0xB0000000 0x200000 2 2 $_TARGETNAME
+
+# Perform this after a clean reboot, halt, and reset init (which should also leave it halted).
+proc kc100_dump_flash {} {
+	echo "Probing 48 TSOP Intel CFI flash chip (2MB)..."
+	flash probe intel
+	echo "Dumping 2MB flash chip to flashdump.bin.
+	flash read_bank 0 flashdump.bin 0 0x200000
+}
+
+#TODO figure out memory init sequence to be able to dump from cached segment instead
+
+# There is also a serial console on JP2, 3-5-6 = TX-RX-GND. 9600/8/N/1.
+
+# Possibly of note, this modem's ancient ethernet port does not support Auto-MDIX.
+
+# This modem in many ways appears to be essentially a clone of the SB5120. See usbjtag.com.
+# The firmware/OS is also susceptible to many of the same procedures in "Hacking the Cable Modem"
+# by DerEngel (Ryan Harris), available from No Starch Press.