diff options
Diffstat (limited to 'tcl')
21 files changed, 803 insertions, 16 deletions
diff --git a/tcl/board/esp32c2-ftdi.cfg b/tcl/board/esp32c2-ftdi.cfg new file mode 100644 index 0000000..bc2b82f --- /dev/null +++ b/tcl/board/esp32c2-ftdi.cfg @@ -0,0 +1,21 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# +# Example OpenOCD configuration file for ESP32-C2 connected via ESP-Prog. +# +# For example, OpenOCD can be started for ESP32-C2 debugging on +# +# openocd -f board/esp32c2-ftdi.cfg +# + +# Source the JTAG interface configuration file +source [find interface/ftdi/esp32_devkitj_v1.cfg] +# Source the ESP32-C2 configuration file +source [find target/esp32c2.cfg] + +# The speed of the JTAG interface, in kHz. If you get DSR/DIR errors (and they +# do not relate to OpenOCD trying to read from a memory range without physical +# memory being present there), you can try lowering this. +# +# On DevKit-J, this can go as high as 20MHz if CPU frequency is 80MHz, or 26MHz +# if CPU frequency is 160MHz or 240MHz. +adapter speed 20000 diff --git a/tcl/board/esp32c3-builtin.cfg b/tcl/board/esp32c3-builtin.cfg new file mode 100644 index 0000000..9e19b1b --- /dev/null +++ b/tcl/board/esp32c3-builtin.cfg @@ -0,0 +1,15 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# +# Example OpenOCD configuration file for ESP32-C3 connected via builtin USB-JTAG adapter. +# +# For example, OpenOCD can be started for ESP32-C3 debugging on +# +# openocd -f board/esp32c3-builtin.cfg +# + +# Source the JTAG interface configuration file +source [find interface/esp_usb_jtag.cfg] +# Source the ESP32-C3 configuration file +source [find target/esp32c3.cfg] + +adapter speed 40000 diff --git a/tcl/board/esp32c3-ftdi.cfg b/tcl/board/esp32c3-ftdi.cfg new file mode 100644 index 0000000..5595374 --- /dev/null +++ b/tcl/board/esp32c3-ftdi.cfg @@ -0,0 +1,21 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# +# Example OpenOCD configuration file for ESP32-C3 connected via ESP-Prog. +# +# For example, OpenOCD can be started for ESP32-C3 debugging on +# +# openocd -f board/esp32c3-ftdi.cfg +# + +# Source the JTAG interface configuration file +source [find interface/ftdi/esp32_devkitj_v1.cfg] +# Source the ESP32-C3 configuration file +source [find target/esp32c3.cfg] + +# The speed of the JTAG interface, in kHz. If you get DSR/DIR errors (and they +# do not relate to OpenOCD trying to read from a memory range without physical +# memory being present there), you can try lowering this. +# +# On DevKit-J, this can go as high as 20MHz if CPU frequency is 80MHz, or 26MHz +# if CPU frequency is 160MHz or 240MHz. +adapter speed 20000 diff --git a/tcl/board/esp32c6-builtin.cfg b/tcl/board/esp32c6-builtin.cfg new file mode 100644 index 0000000..abc96b2 --- /dev/null +++ b/tcl/board/esp32c6-builtin.cfg @@ -0,0 +1,15 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# +# Example OpenOCD configuration file for ESP32-C6 connected via builtin USB-JTAG adapter. +# +# For example, OpenOCD can be started for ESP32-C6 debugging on +# +# openocd -f board/esp32c6-builtin.cfg +# + +# Source the JTAG interface configuration file +source [find interface/esp_usb_jtag.cfg] +# Source the ESP32-C6 configuration file +source [find target/esp32c6.cfg] + +adapter speed 40000 diff --git a/tcl/board/esp32h2-builtin.cfg b/tcl/board/esp32h2-builtin.cfg new file mode 100644 index 0000000..1ce5961 --- /dev/null +++ b/tcl/board/esp32h2-builtin.cfg @@ -0,0 +1,15 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# +# Example OpenOCD configuration file for ESP32-C3 connected via builtin USB-JTAG adapter. +# +# For example, OpenOCD can be started for ESP32-C3 debugging on +# +# openocd -f board/esp32c3-builtin.cfg +# + +# Source the JTAG interface configuration file +source [find interface/esp_usb_jtag.cfg] +# Source the ESP32-C3 configuration file +source [find target/esp32h2.cfg] + +adapter speed 40000 diff --git a/tcl/board/sifive-e31arty-cjtag.cfg b/tcl/board/sifive-e31arty-cjtag.cfg new file mode 100644 index 0000000..58ba23a --- /dev/null +++ b/tcl/board/sifive-e31arty-cjtag.cfg @@ -0,0 +1,23 @@ +# +# Be sure you include the speed and interface before this file +# Example: +# -c "adapter_khz 5000" -f "interface/ftdi/olimex-arm-usb-tiny-h.cfg" -f "board/sifive-e31arty-cjtag.cfg" + +set _CHIPNAME riscv +jtag newtap $_CHIPNAME cpu -irlen 5 -expected-id 0x20000913 + + +set _TARGETNAME $_CHIPNAME.cpu + +target create $_TARGETNAME.0 riscv -chain-position $_TARGETNAME +$_TARGETNAME.0 configure -work-area-phys 0x80000000 -work-area-size 10000 -work-area-backup 1 + +flash bank spi0 fespi 0x40000000 0 0 0 $_TARGETNAME.0 0x20004000 +init +if {[ info exists pulse_srst]} { + oscan1_ftdi_set_signal nSRST 0 + oscan1_ftdi_set_signal nSRST z +} +halt +flash protect 0 64 last off +echo "Ready for Remote Connections" diff --git a/tcl/board/sifive-e31arty-onboard-ftdi.cfg b/tcl/board/sifive-e31arty-onboard-ftdi.cfg new file mode 100644 index 0000000..3d40cfa --- /dev/null +++ b/tcl/board/sifive-e31arty-onboard-ftdi.cfg @@ -0,0 +1,25 @@ +# +# Be sure you include the speed and interface before this file +# Example: +# -c "adapter_khz 5000" -f "interface/ftdi/arty-onboard-ftdi.cfg" -f "board/sifive-e31arty-onboard-ftdi.cfg" + +set _CHIPNAME riscv +jtag newtap $_CHIPNAME cpu -irlen 6; # -expected-id 0x0362d093 + +set _TARGETNAME $_CHIPNAME.cpu + +target create $_TARGETNAME.0 riscv -chain-position $_TARGETNAME +$_TARGETNAME.0 configure -work-area-phys 0x80000000 -work-area-size 10000 -work-area-backup 1 +riscv use_bscan_tunnel 5 + +# Uncomment if hardware has flash +# flash bank spi0 fespi 0x40000000 0 0 0 $_TARGETNAME.0 0x20004000 +init +if {[ info exists pulse_srst]} { + ftdi_set_signal nSRST 0 + ftdi_set_signal nSRST z +} +halt +# Uncomment if hardware has flash +# flash protect 0 64 last off +echo "Ready for Remote Connections" diff --git a/tcl/board/sifive-hifive1-revb.cfg b/tcl/board/sifive-hifive1-revb.cfg index e5fe104..7fcab0c 100644 --- a/tcl/board/sifive-hifive1-revb.cfg +++ b/tcl/board/sifive-hifive1-revb.cfg @@ -12,6 +12,9 @@ set _TARGETNAME $_CHIPNAME.cpu target create $_TARGETNAME.0 riscv -chain-position $_TARGETNAME $_TARGETNAME.0 configure -work-area-phys 0x80000000 -work-area-size 0x4000 -work-area-backup 0 +riscv set_enable_virt2phys off +riscv set_enable_virtual off + flash bank onboard_spi_flash fespi 0x20000000 0 0 0 $_TARGETNAME.0 init diff --git a/tcl/interface/ftdi/arty-onboard-ftdi.cfg b/tcl/interface/ftdi/arty-onboard-ftdi.cfg new file mode 100644 index 0000000..0edc615 --- /dev/null +++ b/tcl/interface/ftdi/arty-onboard-ftdi.cfg @@ -0,0 +1,7 @@ +interface ftdi +# ftdi_device_desc "Arty On-board FTDI interface" +ftdi vid_pid 0x0403 0x6010 +ftdi channel 0 +ftdi layout_init 0x0088 0x008b +reset_config none + diff --git a/tcl/interface/ftdi/digilent-hs2-cjtag.cfg b/tcl/interface/ftdi/digilent-hs2-cjtag.cfg new file mode 100644 index 0000000..3daf461 --- /dev/null +++ b/tcl/interface/ftdi/digilent-hs2-cjtag.cfg @@ -0,0 +1,17 @@ +adapter driver ftdi +ftdi device_desc "Digilent Adept USB Device" +ftdi vid_pid 0x0403 0x6014 + +ftdi channel 0 +ftdi layout_init 0x60e8 0x60eb + +reset_config none + +# These signals are used for cJTAG escape sequence on initialization only +ftdi layout_signal TCK -data 0x0001 +ftdi layout_signal TDI -data 0x0002 +ftdi layout_signal TDO -input 0x0004 +ftdi layout_signal TMS -data 0x0008 +ftdi layout_signal JTAG_SEL -ndata 0x6000 -oe 0x6000 + +ftdi layout_signal TMSC_EN -data 0x0020 -oe 0x0020 diff --git a/tcl/interface/ftdi/olimex-arm-jtag-cjtag.cfg b/tcl/interface/ftdi/olimex-arm-jtag-cjtag.cfg new file mode 100644 index 0000000..6939d00 --- /dev/null +++ b/tcl/interface/ftdi/olimex-arm-jtag-cjtag.cfg @@ -0,0 +1,27 @@ +# +# Olimex ARM JTAG SWD adapter +# https://www.olimex.com/Products/ARM/JTAG/ARM-JTAG-SWD/ +# + +# +# Olimex ARM-USB-TINY-H +# +# http://www.olimex.com/dev/arm-usb-tiny-h.html +# + +interface ftdi +ftdi oscan1_mode on +ftdi device_desc "Olimex OpenOCD JTAG ARM-USB-TINY-H" +ftdi vid_pid 0x15ba 0x002a + +ftdi layout_init 0x0808 0x0a1b +ftdi layout_signal nSRST -oe 0x0200 +# oscan1_ftdi_layout_signal nTRST -data 0x0100 -oe 0x0100 +ftdi layout_signal LED -data 0x0800 + +# These signals are used for cJTAG escape sequence on initialization only +ftdi layout_signal TCK -data 0x0001 +ftdi layout_signal TDI -data 0x0002 +ftdi layout_signal TDO -input 0x0004 +ftdi layout_signal TMS -data 0x0008 +ftdi layout_signal JTAG_SEL -data 0x0100 -oe 0x0100 diff --git a/tcl/interface/ftdi/olimex-arm-usb-ocd-h-cjtag.cfg b/tcl/interface/ftdi/olimex-arm-usb-ocd-h-cjtag.cfg new file mode 100644 index 0000000..36ac587 --- /dev/null +++ b/tcl/interface/ftdi/olimex-arm-usb-ocd-h-cjtag.cfg @@ -0,0 +1,22 @@ +# +# Olimex ARM-USB-OCD-H (using cJTAG) +# +# http://www.olimex.com/dev/arm-usb-ocd-h.html +# + +interface ftdi +ftdi oscan1_mode on +ftdi device_desc "Olimex OpenOCD JTAG ARM-USB-OCD-H" +ftdi vid_pid 0x15ba 0x002b + +ftdi layout_init 0x0808 0x0a1b +ftdi layout_signal nSRST -oe 0x0200 +# oscan1_ftdi_layout_signal nTRST -data 0x0100 -oe 0x0100 +ftdi layout_signal LED -data 0x0800 + +# These signals are used for cJTAG escape sequence on initialization only +ftdi layout_signal TCK -data 0x0001 +ftdi layout_signal TDI -data 0x0002 +ftdi layout_signal TDO -input 0x0004 +ftdi layout_signal TMS -data 0x0008 +ftdi layout_signal JTAG_SEL -data 0x0100 -oe 0x0100 diff --git a/tcl/interface/ftdi/olimex-arm-usb-tiny-h-cjtag.cfg b/tcl/interface/ftdi/olimex-arm-usb-tiny-h-cjtag.cfg new file mode 100644 index 0000000..13378b3 --- /dev/null +++ b/tcl/interface/ftdi/olimex-arm-usb-tiny-h-cjtag.cfg @@ -0,0 +1,27 @@ +# +# Olimex ARM JTAG SWD adapter +# https://www.olimex.com/Products/ARM/JTAG/ARM-JTAG-SWD/ +# + +# +# Olimex ARM-USB-TINY-H (using cJTAG) +# +# http://www.olimex.com/dev/arm-usb-tiny-h.html +# + +interface ftdi +ftdi oscan1_mode on +ftdi device_desc "Olimex OpenOCD JTAG ARM-USB-TINY-H" +ftdi vid_pid 0x15ba 0x002a + +ftdi layout_init 0x0808 0x0a1b +ftdi layout_signal nSRST -oe 0x0200 +# oscan1_ftdi_layout_signal nTRST -data 0x0100 -oe 0x0100 +ftdi layout_signal LED -data 0x0800 + +# These signals are used for cJTAG escape sequence on initialization only +ftdi layout_signal TCK -data 0x0001 +ftdi layout_signal TDI -data 0x0002 +ftdi layout_signal TDO -input 0x0004 +ftdi layout_signal TMS -data 0x0008 +ftdi layout_signal JTAG_SEL -data 0x0100 -oe 0x0100 diff --git a/tcl/target/1986ве1т.cfg b/tcl/target/1986Be1T.cfg index a3172cc..a3172cc 100644 --- a/tcl/target/1986ве1т.cfg +++ b/tcl/target/1986Be1T.cfg diff --git a/tcl/target/к1879xб1я.cfg b/tcl/target/K1879x61R.cfg index 8dd330d..8dd330d 100644 --- a/tcl/target/к1879xб1я.cfg +++ b/tcl/target/K1879x61R.cfg diff --git a/tcl/target/esp32c2.cfg b/tcl/target/esp32c2.cfg new file mode 100644 index 0000000..42aeb0a --- /dev/null +++ b/tcl/target/esp32c2.cfg @@ -0,0 +1,117 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# + +# Source the ESP common configuration file. +source [find target/esp_common.cfg] + +# Target specific global variables +set _CHIPNAME "riscv" +set _CPUTAPID 0x0000cc25 +set _ESP_ARCH "riscv" +set _ONLYCPU 1 +set _ESP_SMP_TARGET 0 +set _ESP_SMP_BREAK 0 +set _ESP_EFUSE_MAC_ADDR_REG 0x60008840 + +# Target specific functions should be implemented for each riscv chips. +proc riscv_wdt_disable { } { + # Halt event can occur during config phase (before "init" is done). + # Ignore it since mww commands don't work at that time. + if { [string compare [command mode] config] == 0 } { + return + } + + # Timer Group 0 WDT + mww 0x6001f064 0x50D83AA1 + mww 0x6001F048 0 + # RTC WDT + mww 0x6000809C 0x50D83AA1 + mww 0x60008084 0 + # SWD + mww 0x600080A4 0x8F1D312A + mww 0x600080A0 0x84B00000 +} + +proc riscv_soc_reset { } { + global _RISCV_DMCONTROL + + # This procedure does "digital system reset", i.e. resets + # all the peripherals except for the RTC block. + # It is called from reset-assert-post target event callback, + # after assert_reset procedure was called. + # Since we need the hart to to execute a write to RTC_CNTL_SW_SYS_RST, + # temporarily take it out of reset. Save the dmcontrol state before + # doing so. + riscv dmi_write $_RISCV_DMCONTROL 0x80000001 + # Trigger the reset + mww 0x60008000 0x9c00a000 + # Workaround for stuck in cpu start during calibration. + # By writing zero to TIMG_RTCCALICFG_REG, we are disabling calibration + mww 0x6001F068 0 + # Wait for the reset to happen + sleep 10 + poll + # Disable the watchdogs again + riscv_wdt_disable + + # Here debugger reads allresumeack and allhalted bits as set (0x330a2) + # We will clean allhalted state by resuming the core. + riscv dmi_write $_RISCV_DMCONTROL 0x40000001 + + # Put the hart back into reset state. Note that we need to keep haltreq set. + riscv dmi_write $_RISCV_DMCONTROL 0x80000003 +} + +proc riscv_memprot_is_enabled { } { + global _RISCV_ABS_CMD _RISCV_ABS_DATA0 + + # PMPADDR 0-1 covers entire valid IRAM range and PMPADDR 2-3 covers entire DRAM region + # pmpcfg0 holds the configuration for the PMP 0-3 address registers + + # read pmpcfg0 and extract into 8-bit variables. + riscv dmi_write $_RISCV_ABS_CMD 0x2203a0 + set pmpcfg0 [riscv dmi_read $_RISCV_ABS_DATA0] + + set pmp0cfg [expr {($pmpcfg0 >> (8 * 0)) & 0xFF}] + set pmp1cfg [expr {($pmpcfg0 >> (8 * 1)) & 0xFF}] + set pmp2cfg [expr {($pmpcfg0 >> (8 * 2)) & 0xFF}] + set pmp3cfg [expr {($pmpcfg0 >> (8 * 3)) & 0xFF}] + + # read PMPADDR 0-3 + riscv dmi_write $_RISCV_ABS_CMD 0x2203b0 + set pmpaddr0 [expr {[riscv dmi_read $_RISCV_ABS_DATA0] << 2}] + riscv dmi_write $_RISCV_ABS_CMD 0x2203b1 + set pmpaddr1 [expr {[riscv dmi_read $_RISCV_ABS_DATA0] << 2}] + riscv dmi_write $_RISCV_ABS_CMD 0x2203b2 + set pmpaddr2 [expr {[riscv dmi_read $_RISCV_ABS_DATA0] << 2}] + riscv dmi_write $_RISCV_ABS_CMD 0x2203b3 + set pmpaddr3 [expr {[riscv dmi_read $_RISCV_ABS_DATA0] << 2}] + + set IRAM_LOW 0x40380000 + set IRAM_HIGH 0x403C0000 + set DRAM_LOW 0x3FCA0000 + set DRAM_HIGH 0x3FCE0000 + set PMP_RWX 0x07 + set PMP_RW 0x03 + + # The lock bit remains unset during the execution of the 2nd stage bootloader. + # Thus we do not perform a lock bit check for IRAM and DRAM regions. + + # Check OpenOCD can write and execute from IRAM. + if {$pmpaddr0 >= $IRAM_LOW && $pmpaddr1 <= $IRAM_HIGH} { + if {($pmp0cfg & $PMP_RWX) != 0 || ($pmp1cfg & $PMP_RWX) != $PMP_RWX} { + return 1 + } + } + + # Check OpenOCD can read/write entire DRAM region. + if {$pmpaddr2 >= $DRAM_LOW && $pmpaddr3 <= $DRAM_HIGH} { + if {($pmp2cfg & $PMP_RW) != 0 && ($pmp3cfg & $PMP_RW) != $PMP_RW} { + return 1 + } + } + + return 0 +} + +create_esp_target $_ESP_ARCH diff --git a/tcl/target/esp32c3.cfg b/tcl/target/esp32c3.cfg new file mode 100644 index 0000000..d266ad5 --- /dev/null +++ b/tcl/target/esp32c3.cfg @@ -0,0 +1,81 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# + +# Source the ESP common configuration file. +source [find target/esp_common.cfg] + +# Target specific global variables +set _CHIPNAME "riscv" +set _CPUTAPID 0x00005c25 +set _ESP_ARCH "riscv" +set _ONLYCPU 1 +set _ESP_SMP_TARGET 0 +set _ESP_SMP_BREAK 0 +set _ESP_EFUSE_MAC_ADDR_REG 0x60008844 + +# Target specific functions should be implemented for each riscv chips. +proc riscv_wdt_disable { } { + # Halt event can occur during config phase (before "init" is done). + # Ignore it since mww commands don't work at that time. + if { [string compare [command mode] config] == 0 } { + return + } + + # Timer Group 0 & 1 WDTs + mww 0x6001f064 0x50D83AA1 + mww 0x6001F048 0 + mww 0x60020064 0x50D83AA1 + mww 0x60020048 0 + # RTC WDT + mww 0x600080a8 0x50D83AA1 + mww 0x60008090 0 + # SWD + mww 0x600080b0 0x8F1D312A + mww 0x600080ac 0x84B00000 +} + +# This is almost identical with the esp32c2_soc_reset. +# Will be refactored with the other common settings. +proc riscv_soc_reset { } { + global _RISCV_DMCONTROL + + # This procedure does "digital system reset", i.e. resets + # all the peripherals except for the RTC block. + # It is called from reset-assert-post target event callback, + # after assert_reset procedure was called. + # Since we need the hart to to execute a write to RTC_CNTL_SW_SYS_RST, + # temporarily take it out of reset. Save the dmcontrol state before + # doing so. + riscv dmi_write $_RISCV_DMCONTROL 0x80000001 + # Trigger the reset + mww 0x60008000 0x9c00a000 + # Workaround for stuck in cpu start during calibration. + # By writing zero to TIMG_RTCCALICFG_REG, we are disabling calibration + mww 0x6001F068 0 + # Wait for the reset to happen + sleep 10 + poll + # Disable the watchdogs again + riscv_wdt_disable + + # Here debugger reads allresumeack and allhalted bits as set (0x330a2) + # We will clean allhalted state by resuming the core. + riscv dmi_write $_RISCV_DMCONTROL 0x40000001 + + # Put the hart back into reset state. Note that we need to keep haltreq set. + riscv dmi_write $_RISCV_DMCONTROL 0x80000003 +} + +proc riscv_memprot_is_enabled { } { + # IRAM0 PMS lock, SENSITIVE_CORE_X_IRAM0_PMS_CONSTRAIN_0_REG + if { [get_mmr_bit 0x600C10A8 0] != 0 } { + return 1 + } + # DRAM0 PMS lock, SENSITIVE_CORE_X_DRAM0_PMS_CONSTRAIN_0_REG + if { [get_mmr_bit 0x600C10C0 0] != 0 } { + return 1 + } + return 0 +} + +create_esp_target $_ESP_ARCH diff --git a/tcl/target/esp32c6.cfg b/tcl/target/esp32c6.cfg new file mode 100644 index 0000000..e1ef10a --- /dev/null +++ b/tcl/target/esp32c6.cfg @@ -0,0 +1,142 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# + +# Source the ESP common configuration file. +source [find target/esp_common.cfg] + +# Target specific global variables +set _CHIPNAME "riscv" +set _CPUTAPID 0x0000dc25 +set _ESP_ARCH "riscv" +set _ONLYCPU 1 +set _ESP_SMP_TARGET 0 +set _ESP_SMP_BREAK 0 +set _ESP_EFUSE_MAC_ADDR_REG 0x600B0844 + +# Target specific functions should be implemented for each riscv chips. +proc riscv_wdt_disable { } { + # Halt event can occur during config phase (before "init" is done). + # Ignore it since mww commands don't work at that time. + if { [string compare [command mode] config] == 0 } { + return + } + + # Timer Group 0 & 1 WDTs + mww 0x60008064 0x50D83AA1 + mww 0x60008048 0 + mww 0x60009064 0x50D83AA1 + mww 0x60009048 0 + # LP_WDT_RTC + mww 0x600b1c18 0x50D83AA1 + mww 0x600B1C00 0 + # LP_WDT_SWD + mww 0x600b1c20 0x50D83AA1 + mww 0x600b1c1c 0x40000000 +} + +proc riscv_soc_reset { } { + global _RISCV_DMCONTROL _RISCV_SB_CS _RISCV_SB_ADDR0 _RISCV_SB_DATA0 + + riscv dmi_write $_RISCV_DMCONTROL 0x80000001 + riscv dmi_write $_RISCV_SB_CS 0x48000 + riscv dmi_write $_RISCV_SB_ADDR0 0x600b1034 + riscv dmi_write $_RISCV_SB_DATA0 0x80000000 + # clear dmactive to clear sbbusy otherwise debug module gets stuck + riscv dmi_write $_RISCV_DMCONTROL 0 + + riscv dmi_write $_RISCV_SB_CS 0x48000 + riscv dmi_write $_RISCV_SB_ADDR0 0x600b1038 + riscv dmi_write $_RISCV_SB_DATA0 0x10000000 + + # clear dmactive to clear sbbusy otherwise debug module gets stuck + riscv dmi_write $_RISCV_DMCONTROL 0 + riscv dmi_write $_RISCV_DMCONTROL 0x40000001 + # Here debugger reads dmstatus as 0xc03a2 + + # Wait for the reset to happen + sleep 10 + poll + # Here debugger reads dmstatus as 0x3a2 + + # Disable the watchdogs again + riscv_wdt_disable + + # Here debugger reads anyhalted and allhalted bits as set (0x3a2) + # We will clean allhalted state by resuming the core. + riscv dmi_write $_RISCV_DMCONTROL 0x40000001 + + # Put the hart back into reset state. Note that we need to keep haltreq set. + riscv dmi_write $_RISCV_DMCONTROL 0x80000003 +} + +proc riscv_memprot_is_enabled { } { + global _RISCV_ABS_CMD _RISCV_ABS_DATA0 + + # If IRAM/DRAM split is enabled TOR address match mode is used. + # If IRAM/DRAM split is disabled NAPOT mode is used. + # In order to determine if the IRAM/DRAM regions are protected against RWX/RW, + # it is necessary to first read the mode and then apply the appropriate method for checking. + # We can understand the mode reading pmp5cfg in pmpcfg1 register. + # If it is none we know that pmp6cfg and pmp7cfg is in TOR mode. + + # Read pmpcfg1 and extract into 8-bit variables. + riscv dmi_write $_RISCV_ABS_CMD 0x2203a1 + set pmpcfg1 [riscv dmi_read $_RISCV_ABS_DATA0] + + set pmp5cfg [expr {($pmpcfg1 >> (8 * 1)) & 0xFF}] + set pmp6cfg [expr {($pmpcfg1 >> (8 * 2)) & 0xFF}] + set pmp7cfg [expr {($pmpcfg1 >> (8 * 3)) & 0xFF}] + + set IRAM_LOW 0x40800000 + set IRAM_HIGH 0x40880000 + set DRAM_LOW 0x40800000 + set DRAM_HIGH 0x40880000 + set PMP_RWX 0x07 + set PMP_RW 0x03 + set PMP_A [expr {($pmp5cfg >> 3) & 0x03}] + + if {$PMP_A == 0} { + # TOR mode used to protect valid address space. + + # Read PMPADDR 5-7 + riscv dmi_write $_RISCV_ABS_CMD 0x2203b5 + set pmpaddr5 [expr {[riscv dmi_read $_RISCV_ABS_DATA0] << 2}] + riscv dmi_write $_RISCV_ABS_CMD 0x2203b6 + set pmpaddr6 [expr {[riscv dmi_read $_RISCV_ABS_DATA0] << 2}] + riscv dmi_write $_RISCV_ABS_CMD 0x2203b7 + set pmpaddr7 [expr {[riscv dmi_read $_RISCV_ABS_DATA0] << 2}] + + # The lock bit remains unset during the execution of the 2nd stage bootloader. + # Thus we do not perform a lock bit check for IRAM and DRAM regions. + + # Check OpenOCD can write and execute from IRAM. + if {$pmpaddr5 >= $IRAM_LOW && $pmpaddr6 <= $IRAM_HIGH} { + if {($pmp5cfg & $PMP_RWX) != 0 || ($pmp6cfg & $PMP_RWX) != $PMP_RWX} { + return 1 + } + } + + # Check OpenOCD can read/write entire DRAM region. + if {$pmpaddr7 >= $DRAM_LOW && $pmpaddr7 <= $DRAM_HIGH} { + if {($pmp7cfg & $PMP_RW) != $PMP_RW} { + return 1 + } + } + } elseif {$PMP_A == 3} { + # NAPOT mode used to protect valid address space. + + # Read PMPADDR 5 + riscv dmi_write $_RISCV_ABS_CMD 0x2203b5 + set pmpaddr5 [expr {[riscv dmi_read $_RISCV_ABS_DATA0]}] + + # Expected value written to the pmpaddr5 + set pmpaddr_napot [expr {($IRAM_LOW | (($IRAM_HIGH - $IRAM_LOW - 1) >> 1)) >> 2}] + if {($pmpaddr_napot != $pmpaddr5) || ($pmp5cfg & $PMP_RWX) != $PMP_RWX} { + return 1 + } + } + + return 0 +} + +create_esp_target $_ESP_ARCH diff --git a/tcl/target/esp32h2.cfg b/tcl/target/esp32h2.cfg new file mode 100644 index 0000000..45f598f --- /dev/null +++ b/tcl/target/esp32h2.cfg @@ -0,0 +1,122 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# + +# Source the ESP common configuration file. +source [find target/esp_common.cfg] + +# Target specific global variables +set _CHIPNAME "riscv" +set _CPUTAPID 0x00010c25 +set _ESP_ARCH "riscv" +set _ONLYCPU 1 +set _ESP_SMP_TARGET 0 +set _ESP_SMP_BREAK 0 +set _ESP_EFUSE_MAC_ADDR_REG 0x600B0844 + +# Target specific functions should be implemented for each riscv chips. +proc riscv_wdt_disable { } { + # Halt event can occur during config phase (before "init" is done). + # Ignore it since mww commands don't work at that time. + if { [string compare [command mode] config] == 0 } { + return + } + + # Timer Group 0 & 1 WDTs + mww 0x60009064 0x50D83AA1 + mww 0x60009048 0 + mww 0x6000A064 0x50D83AA1 + mww 0x6000A048 0 + # WDT_RTC + #mww 0x600b1c18 0x50D83AA1 + #mww 0x600B1C00 0 + # WDT_SWD + #mww 0x600b1c20 0x8F1D312A + #mww 0x600b1c1c 0x84B00000 +} + +proc riscv_soc_reset { } { + global _RISCV_DMCONTROL _RISCV_SB_CS _RISCV_SB_ADDR0 _RISCV_SB_DATA0 + + riscv dmi_write $_RISCV_DMCONTROL 0x80000001 + riscv dmi_write $_RISCV_SB_CS 0x48000 + riscv dmi_write $_RISCV_SB_ADDR0 0x600b1034 + riscv dmi_write $_RISCV_SB_DATA0 0x80000000 + # clear dmactive to clear sbbusy otherwise debug module gets stuck + riscv dmi_write $_RISCV_DMCONTROL 0 + + riscv dmi_write $_RISCV_SB_CS 0x48000 + riscv dmi_write $_RISCV_SB_ADDR0 0x600b1038 + riscv dmi_write $_RISCV_SB_DATA0 0x10000000 + + # clear dmactive to clear sbbusy otherwise debug module gets stuck + riscv dmi_write $_RISCV_DMCONTROL 0 + riscv dmi_write $_RISCV_DMCONTROL 0x40000001 + # Here debugger reads dmstatus as 0xc03a2 + + # Wait for the reset to happen + sleep 10 + poll + # Here debugger reads dmstatus as 0x3a2 + + # Disable the watchdogs again + riscv_wdt_disable + + # Here debugger reads anyhalted and allhalted bits as set (0x3a2) + # We will clean allhalted state by resuming the core. + riscv dmi_write $_RISCV_DMCONTROL 0x40000001 + + # Put the hart back into reset state. Note that we need to keep haltreq set. + riscv dmi_write $_RISCV_DMCONTROL 0x80000003 +} + +proc riscv_memprot_is_enabled { } { + global _RISCV_ABS_CMD _RISCV_ABS_DATA0 + # If IRAM/DRAM split is enabled, PMPADDR 5-6 will cover valid IRAM region and PMPADDR 7 will cover valid DRAM region + # Only TOR mode is used for IRAM and DRAM protections. + + # Read pmpcfg1 and extract into 8-bit variables. + riscv dmi_write $_RISCV_ABS_CMD 0x2203a1 + set pmpcfg1 [riscv dmi_read $_RISCV_ABS_DATA0] + + set pmp5cfg [expr {($pmpcfg1 >> (8 * 1)) & 0xFF}] + set pmp6cfg [expr {($pmpcfg1 >> (8 * 2)) & 0xFF}] + set pmp7cfg [expr {($pmpcfg1 >> (8 * 3)) & 0xFF}] + + # Read PMPADDR 5-7 + riscv dmi_write $_RISCV_ABS_CMD 0x2203b5 + set pmpaddr5 [expr {[riscv dmi_read $_RISCV_ABS_DATA0] << 2}] + riscv dmi_write $_RISCV_ABS_CMD 0x2203b6 + set pmpaddr6 [expr {[riscv dmi_read $_RISCV_ABS_DATA0] << 2}] + riscv dmi_write $_RISCV_ABS_CMD 0x2203b7 + set pmpaddr7 [expr {[riscv dmi_read $_RISCV_ABS_DATA0] << 2}] + + set IRAM_LOW 0x40800000 + set IRAM_HIGH 0x40850000 + set DRAM_LOW 0x40800000 + set DRAM_HIGH 0x40850000 + + set PMP_RWX 0x07 + set PMP_RW 0x03 + + # The lock bit remains unset during the execution of the 2nd stage bootloader. + # Thus, we do not perform a lock bit check for IRAM and DRAM regions. + + # Check OpenOCD can write and execute from IRAM. + if {$pmpaddr5 >= $IRAM_LOW && $pmpaddr6 <= $IRAM_HIGH} { + if {($pmp5cfg & $PMP_RWX) != 0 || ($pmp6cfg & $PMP_RWX) != $PMP_RWX} { + return 1 + } + } + + # Check OpenOCD can read/write entire DRAM region. + # If IRAM/DRAM split is disabled, pmpaddr7 will be zero, checking only IRAM region is enough. + if {$pmpaddr7 != 0 && $pmpaddr7 >= $DRAM_LOW && $pmpaddr7 <= $DRAM_HIGH} { + if {($pmp7cfg & $PMP_RW) != $PMP_RW} { + return 1 + } + } + + return 0 +} + +create_esp_target $_ESP_ARCH diff --git a/tcl/target/esp_common.cfg b/tcl/target/esp_common.cfg index ac8cd6a..af2f6ad 100644 --- a/tcl/target/esp_common.cfg +++ b/tcl/target/esp_common.cfg @@ -6,6 +6,14 @@ source [find bitsbytes.tcl] source [find memory.tcl] source [find mmr_helpers.tcl] +# Riscv Debug Module Registers which are used around esp configuration files. +set _RISCV_ABS_DATA0 0x04 +set _RISCV_DMCONTROL 0x10 +set _RISCV_ABS_CMD 0x17 +set _RISCV_SB_CS 0x38 +set _RISCV_SB_ADDR0 0x39 +set _RISCV_SB_DATA0 0x3C + # Common ESP chips definitions # Espressif supports only NuttX in the upstream. @@ -69,13 +77,12 @@ proc create_esp_target { ARCH } { set_esp_common_variables create_esp_jtag create_openocd_targets - configure_openocd_events + configure_openocd_events $ARCH if { $ARCH == "xtensa"} { configure_esp_xtensa_default_settings } else { - # riscv targets are not upstreamed yet. - # they can be found at the official Espressif fork. + configure_esp_riscv_default_settings } } @@ -131,7 +138,6 @@ proc configure_event_halted { } { $_TARGETNAME_0 configure -event halted { global _ESP_WDT_DISABLE $_ESP_WDT_DISABLE - esp halted_event_handler } } @@ -167,12 +173,25 @@ proc configure_event_gdb_attach { } { } } -proc configure_openocd_events { } { +proc configure_openocd_events { ARCH } { + if { $ARCH == "riscv" } { + configure_event_halted + } configure_event_examine_end configure_event_reset_assert_post configure_event_gdb_attach } +proc configure_esp_riscv_default_settings { } { + gdb_breakpoint_override hard + riscv set_reset_timeout_sec 2 + riscv set_command_timeout_sec 5 + riscv set_mem_access sysbus progbuf abstract + riscv set_ebreakm on + riscv set_ebreaks on + riscv set_ebreaku on +} + proc configure_esp_xtensa_default_settings { } { global _TARGETNAME_0 _ESP_SMP_BREAK _FLASH_VOLTAGE _CHIPNAME diff --git a/tcl/target/gd32vf103.cfg b/tcl/target/gd32vf103.cfg index 54a74e8..77fdff7 100644 --- a/tcl/target/gd32vf103.cfg +++ b/tcl/target/gd32vf103.cfg @@ -6,15 +6,12 @@ # https://www.gigadevice.com/products/microcontrollers/gd32/risc-v/ # +adapter speed 1000 source [find mem_helper.tcl] transport select jtag -if { [info exists CHIPNAME] } { - set _CHIPNAME $CHIPNAME -} else { - set _CHIPNAME gd32vf103 -} +reset_config srst_nogate # The smallest RAM size 6kB (GD32VF103C4/T4/R4) if { [info exists WORKAREASIZE] } { @@ -23,10 +20,15 @@ if { [info exists WORKAREASIZE] } { set _WORKAREASIZE 0x1800 } +set _CHIPNAME gd32vf103 +# The vendor's configuration expects an ID of 0x1e200a6d, but this one is what +# I have on my board (Sipeed Longan Nano, GD32VF103CBT6). jtag newtap $_CHIPNAME cpu -irlen 5 -expected-id 0x1000563d +jtag newtap $_CHIPNAME bs -irlen 5 -expected-id 0x790007a3 set _TARGETNAME $_CHIPNAME.cpu target create $_TARGETNAME riscv -chain-position $_TARGETNAME +$_TARGETNAME riscv set_enable_virt2phys off proc default_mem_access {} { riscv set_mem_access progbuf @@ -39,12 +41,78 @@ $_TARGETNAME configure -work-area-phys 0x20000000 -work-area-size $_WORKAREASIZE set _FLASHNAME $_CHIPNAME.flash flash bank $_FLASHNAME stm32f1x 0x08000000 0 0 0 $_TARGETNAME -# DBGMCU_CR register cannot be set in examine-end event as the running RISC-V CPU -# does not allow the debugger to access memory. -# Stop watchdogs at least before flash programming. -$_TARGETNAME configure -event reset-init { - # DBGMCU_CR |= DBG_WWDG_STOP | DBG_IWDG_STOP - mmw 0xE0042004 0x00000300 0 +# Address 0 is only aliased to main flash when the chip is not running its +# built-in bootloader. When it is, it's instead aliased to a read only section +# of flash at 0x1fffb000. However, we can't detect or dynamically switch this, +# so just pretend it's always aliased to main flash. We need to tell OpenOCD +# about this alias because otherwise we'll try to use software breakpoints on +# code in flash, which don't work because flash mappings are read-only. +flash bank $_CHIPNAME.flashalias virtual 0x0 0 0 0 $_TARGETNAME $_FLASHNAME + +# On this chip, ndmreset (the debug module bit that triggers a software reset) +# doesn't work. So for JTAG connections without an SRST, we need to trigger a +# reset manually. This is an undocumented reset sequence that's used by the +# JTAG flashing script in the vendor-supplied GD32VF103 PlatformIO plugin: +# +# https://github.com/sipeed/platform-gd32v/commit/f9cbb44819bc05dd2010cc815c32be0486800cc2 +# +$_TARGETNAME configure -event reset-assert { + set dmcontrol 0x10 + set dmcontrol_dmactive [expr 1 << 0] + set dmcontrol_haltreq [expr 1 << 31] + + global _RESETMODE + global _TARGETNAME + + # Halt the core so that we can write to memory. We do this first so + # that it doesn't clobber our dmcontrol configuration. + halt + + # Set haltreq appropriately for the type of reset we're doing. This + # replicates what the generic RISC-V reset_assert() function would + # do if we weren't overriding it. The $_RESETMODE hack sucks, but + # it's the least invasive way to determine whether we need to halt, + # and psoc6.cfg already uses the same trick. (reset_deassert(), which + # does run, also does this, but at that point it may be too late: the + # reset has already been triggered, so there's a race between it and + # the haltreq write.) + # + # If we didn't override the generic handler, we'd actually still have + # to do this: the default handler sets ndmreset, which prevents memory + # access even though it doesn't actually trigger a reset on this chip. + # So we'd need to unset it here, which involves a write to dmcontrol, + # Since haltreq is write-only and there's no way to leave it unchanged, + # we'd have to figure out its proper value anyway. + set val $dmcontrol_dmactive + if {$_RESETMODE ne "run"} { + set val [expr $val | $dmcontrol_haltreq] + } + $_TARGETNAME riscv dmi_write $dmcontrol $val + + # Unlock 0xe0042008 so that the next write triggers a reset + $_TARGETNAME mww 0xe004200c 0x4b5a6978 + + # We need to trigger the reset using abstract memory access, since + # progbuf access tries to read a status code out of a core register + # after the write happens, which fails when the core is in reset. + riscv set_mem_access abstract + + # Go! + $_TARGETNAME mww 0xe0042008 0x1 + + # Put the memory access mode back to what it was. + default_mem_access +} + +# Capture the mode of a given reset so that we can use it later in the +# reset-assert handler. +proc init_reset { mode } { + global _RESETMODE + set _RESETMODE $mode + + if {[using_jtag]} { + jtag arp_init-reset + } } # On this chip, ndmreset (the debug module bit that triggers a software reset) |