MPC5746R JTAG

[am8patil]

Hi All,

Can anyone please explain how to get JTAG connection set up with MPC5746R via Once Command Register (OCR) ? 


Thank you!

[am8patil]

Hello,
I want to create my own JTAG Flash programmer. I had come across the mentioned pdf (https://www.nxp.com/docs/en/application-note/AN4365.pdf). Here are the steps and the results of each steps. 

1) Set to Test Logic Reset State with 5 consecutive TMS pulses.
2)  Read devie ID in DR-Shift . Reads 0x1834601d.
3) Write 000001 (JTAGC ID CODE Instruction) to Shift IR
4) Read DR-Shift again. Reads 0x1834601d again (expected).
5) Write ACCESS_AUX_CORE_1 (101001) to Shift-IR.
6) Write ENABLE_ONCE (000 111 1110) to Shift-IR (10 bit command).
7) Assert Reset 
Write 0b000 001 0010 (Once Control Register). 
9) Write 0b101 (32-Bit Command)  to Shift DR to set OCR [DR and WK as 1]
10)  Deassert Reset. 
11) Wait 10 ms
12)  At this stage I would like to read backk the once status register to see if the debug bit is set on. So I write bypass command 0b1000010001 in Shift IR and read back the tdo parallely. The register reads 0x201. (debug bit is 0). 

Please help me with knowing what went wrong in the above steps. 

Thanks!!

[lukaszadrapa]

I forgot to mention that I wrote this script as an addendum to the application note:

https://community.nxp.com/t5/MPC5xxx-Knowledge-Base/Example-JTAG-access-Addendum-to-application-note...

And I have also version for MPC5748G - attached.

I believe this script will help to make it working.

Regards,

Lukas

[lukaszadrapa]

Hi @am8patil 
what is your intention? Do you want to develop own JTAG flash programmer or is it a question related to some specific debug tools?

If you want to develop own JTAG flash programmer, we provide this application note:
https://www.nxp.com/docs/en/application-note/AN4365.pdf
It's written for MPC56xx devices but it can be used also for MPC57xx as not much has changed.

If it is related to some debug tools - do you already have anything? Or are you looking for some recommendations what to use? I can see that most of customer usually use tools from Pemicro which can be used with debugger in-built in S32 Design Studio IDE:
https://www.pemicro.com/products/product_viewDetails.cfm?product_id=15320180&productTab=5051
If we are talking about advanced debuggers, you can take a look at www.lauterbach.com

Regards,
Lukas

[am8patil]

I got access to the memory via Once. However I am facing an issue with one memory address. When I try to write it I am getting erronous value back. Is this register reserved?

Reg Addr: 0x400081e4
Write Val to Addr: 0x400081e4 (same as address)
Read Back Value from reg addr: 0x400(1)81e4
The bracket includes wrong value.

Thanks

[lukaszadrapa]

0x400081e4 is SRAM address. The SRAM needs to be initialized after reset due to ECC. If it is not initialized, read or write access will cause machine check exception, most likely, due to double bit ECC error. This is a screenshot from AN4365:

And this is from the reference manual:

 I guess that this is the source of your problem.

Regards,

Lukas

[am8patil]

Hello, 
I am trying to Initialize ECC as below. However OSR returns error bit as 1. Here is how I am trying to initialize it 


Write IR to select OCMD -> CPU SCAN Reg

Write to DR-SHIFT
WBRRLOW  =  ADDR ( from 0x40000000 - 0x40200000)
WBRRHIGH =  0x00000000
MSR = 0x00000000
PC = 0x40000000
IR = 0x181F0900 e_stmw r0,0(r31)
CTL = 0x00000402

JtagSingleStep();

Check Once Status Register (OSR) 
OSR = 0x309 (0b1100001001)
Indicating Error bit is 1

(Repeat this above step to for ADDR from 0x40000000 to 0x40200000)

Is there anything that I did wrong or missed?

[lukaszadrapa]

I can see no problem in this procedure. This should work.

Could you tell me what's the content of CPUSCR  after this single step?

Regards,

Lukas

[am8patil]

I Read back CPUSCAN REG as soon as I Single step and before reading OSR.

WBRRLOW = 0x00000000
WBRRHIGH = 0x00000000
MSR = 0x00000000
PC = 0x10
IR = 0x00000000
CTL = 0x206

[lukaszadrapa]

PC = 0x10 means that Machine Check exception was triggered. Could you read also core register MCSR? It's SPR number 572.

Or when loading e_stmw instruction to CPUSCR - could you try to set PC to some flash address instead of 0x40000000? I'm wondering if late-write feature on RAM could cause fetching of next instruction from 0x40000000 before it is written by e_stmw (i.e. fetching instruction from corrupted/uninitialized RAM). I didn't test it on this device.

Regards,

Lukas

[am8patil]

Hello ,
I tried changing PC to flash address to 0x01000000 the ECC init seems to work without any problem. I initialize ECC as below.

Write IR to select OCMD -> CPU SCAN Reg

Write to DR-SHIFT
WBRRLOW = ADDR ( from 0x40000000 - 0x40200000)
WBRRHIGH = 0x00000000
MSR = 0x00000000
PC = 0x01000000
IR = 0x181F0900 e_stmw r0,0(r31)
CTL = 0x00000402

JtagSingleStep();

Check Once Status Register (OSR)
OSR = 0x209 (0b1000001001)
Indicating Error bit is 0.

However in the steps ahead I want to write memory in SRAM and read it. Here is how I do it:

/* Write Address */
1) Write to r31 register
Write IR to select OCMD -> CPU SCAN Reg

Write to DR-SHIFT
WBRRLOW = Data To Write(32 bit)
WBRRHIGH = 0x00000000
MSR = 0x00000000
PC = 0x01000000
IR = 0x181FD000
CTL = 0x00000402

JtagSingleStep();
OSR = 0x209 Inidicating (err bit = 0)

2) Write r31 value to the address
Write IR to select OCMD -> CPU SCAN Reg

Write to DR-SHIFT
WBRRLOW = ADDRESS(SRAM-0x40010000)
WBRRHIGH = 0x00000000
MSR = 0x00000000
PC = 0x01000000
IR = 0x57E00000
CTL = 0x00000402

JtagSingleStep();
OSR = 0x209 Indicating (err bit = 0) (Good until here)


I try to readback the value written to the same address as above and the OSR returns 0x309 (Problem). Here is how I do it:

1)store value from address to r31;
Write IR to select OCMD -> CPU SCAN Reg

Write to DR-SHIFT
WBRRLOW = ADDRESS(SRAM-0x40010000)
WBRRHIGH = 0x00000000
MSR = 0x00000000
PC = 0x01000000
IR = 0x53E00000
CTL = 0x00000402

JtagSingleStep();
OSR = 0x309 Indicating (err bit = 0) (Bad Hence forth)
(Refer the end Note (A) for more analysis at this step)
2) WRITE IR With OCMD-> CPU_SCAN_REG with Read Bit = 1
OSR = 0x309 Indicating (err bit = 0) (Bad)

Note A:
As instructed I read the CPU SCAN REG when OSR returns error bit = 1 first time and It reads as follows:
WBRRLOW = 0x00000000
WBRRHIGH = 0x00000000
MSR = 0x00000000
PC = 0x10
IR = 0x00000000
CTL = 0x206


and the MCSR (SPR572) =0x808800c;

Please help

[lukaszadrapa]

I can see no problem there, it pretty much follows the JTAG.cmm script.

The only discrepancy I can see is right at the beginning:

WBRRLOW = ADDR ( from 0x40000000 - 0x40200000)

There's 256KB RAM, so it should be 0x40000000 - 0x4003FFFF.

But you should get error bit set if you write somewhere behind the RAM.

It's probably not the root cause but could you check it? I can see nothing else.

Regards,

Lukas