MPC5746C flash programming via JTAG

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

MPC5746C flash programming via JTAG

3,191 Views
ulbed
Contributor I

Hi, Where can I get more information about flash programming via JTAG for MPC5746C controller? Are there any examples? One of our customers want us to add flash support for this controller.

 

I have the Document "MPC5746C Reference Manual, Rev. 1". Although the JTAG Interface and many other debug modules seem to be described, I still do not understand how to program the flash via JTAG.

Can you give me a list of steps to do from for programming / erasing / verifying the flash?

 

Also I have the following questions:

  • Which Debug Modules must be used / enabled?
  • I have a working 3rd party programmer as a reference, which uses following sequence:
    • 10-Bit IR-Shift (0x011)
    • 6-Bit IR-Shift (0x2A)
    • 10-Bit IR-Shift (0x211)
      How comes that the JTAG-IR is 10 Bit and then 6 Bit wide? Also at other times I see 4-Bit IR-Shifts. Do different modules handle different wide IR-Shifts, or is it a chained scan path? Which modules are in the scan path then?
  • How are those Debug Modules related to each other (Nexus Crossbar Multi-Master Client, JTAG Controller, JTAG Data Communication, IEE 1149.7 Compact JTAG Test Access Port Controller, Nexus Port Controller)? Which Modules have to be activated / used (how?) and which can I ignore?
  • What registers do I have to use and how do I access them? (C55FMC)?
  • How to write data to addresses referred in 70.6.1.2 ("Write the first address to be programmed with the program data")

 

Regards

Labels (1)
0 Kudos
4 Replies

906 Views
am8patil
Contributor I

Hi,
I tried to follow the steps mentioned above but it doesnt seem to work. When I read the jtag id using 6bit IR command 0b000001 I get correct value.
However when I try to access with Access_Aux_Core_0 and enable once and try to retrieve jtag id with command 10 bit command 0b0000000010, I get wrong value. 

Please Help!

0 Kudos

2,099 Views
lukaszadrapa
NXP TechSupport
NXP TechSupport

Hi,

There is an updated revision of AN3283 (AN4365) targeted at MPC56XX devices. It is available here:

http://www.nxp.com/files/32bit/doc/app_note/AN4365.pdf

While this is not specifically written for MPC5746C it should be usable as not much has changed. As the MPC5746C is a VLE instruction only device please take care to utilize the VLE instructions detailed in AN4365. Table 9 in AN4365 details which drivers should be used for the MPC56XX devices. Obviously this is different for the MPC5746C device, so you should use the same procedure but with the MPC5746C driver which can be downloaded here:

http://www.nxp.com/files/product/software/C55_JDP_SSD.exe

Regards,

Lukas

0 Kudos

2,099 Views
ulbed
Contributor I

Hi Lukas,

Thanks for you reply. I tried to keep up with AN4365 while considering "minor changes". A difficult task for an outsider. Especially when nomenclature is not consistent between those documents.

I can read the JTAG-ID with JTAGC but that's all. According to AN4365 the next step would be to enable the OnCE TAP by executing the 'ACCESS_AUX_TAP_ONCE' JTAGC instruction. Besides that the JTAGC instructions for MPC57xx devices seem to be 6-bit wide (AN4365: 5-bit), an instruction named like that does not exist.

I tried using 'AUX_TAP_Z4' and 'AUX_TAP_Z2' instead. But with both I will get 0's when trying to read the JTAG-ID (OnCE Register) with that TAP controller respectively. Does it matter which Core-Debug TAP will be used to program the flash?

Am I right that If I perform an AUX_TAP_xxx Shift-IR command, all subsequent JTAG Shift-IR and Shift-DR commands are applied directly to the selected TAP controller until I run through the Pause-DR state? Then I would have to re-perform the AUX_TAP_xxx Shift-IR command?

Is there a possibility to check which TAP is actually selected?

Regards

0 Kudos

2,099 Views
randyd
NXP Employee
NXP Employee

You must use a core that is enabled. By default on the MPC5746C, core 0, the e200z4, is enabled. Otherwise, the other core would have to be enabled via your control.

On many of the n ewer devices (MPC57xx) the JTAG IR was changed from 5-bits to 6-bits to allow more clients on the JTAG bus internal to the device to be selected..

These families implement what is known as TAP sharing. To select the e200z4 core, the command AUX_TAP_Z4 (0b10_1000, 0x28) would be shifted in to the JTAGC.

Once a JTAG TAP has been selected, all shifts will go to that client until you run through the PAUSE-DR state. After the PAUSE-DR/EXIT2-DR/UPDATE-DR, you will be back to the JTAGC  (the device level JTAG controller). You can then select a different client or the same client again.

To determine if you are communicating with the device, you can execute the JTAG ID command to read the identifier of that client (the 10-bit OnCE CMD JTAG ID for the core as you indicated).

regards,

randy.

Johannes Reif wrote:

Hi Lukas,

Thanks for you reply. I tried to keep up with AN4365 while considering "minor changes". A difficult task for an outsider. Especially when nomenclature is not consistent between those documents.

I can read the JTAG-ID with JTAGC but that's all. According to AN4365 the next step would be to enable the OnCE TAP by executing the 'ACCESS_AUX_TAP_ONCE' JTAGC instruction. Besides that the JTAGC instructions for MPC57xx devices seem to be 6-bit wide (AN4365: 5-bit), an instruction named like that does not exist.

I tried using 'AUX_TAP_Z4' and 'AUX_TAP_Z2' instead. But with both I will get 0's when trying to read the JTAG-ID (OnCE Register) with that TAP controller respectively. Does it matter which Core-Debug TAP will be used to program the flash?

Am I right that If I perform an AUX_TAP_xxx Shift-IR command, all subsequent JTAG Shift-IR and Shift-DR commands are applied directly to the selected TAP controller until I run through the Pause-DR state? Then I would have to re-perform the AUX_TAP_xxx Shift-IR command?

Is there a possibility to check which TAP is actually selected?

Regards

0 Kudos