Nexus3 Burst Read/Write access on MPC5566

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Nexus3 Burst Read/Write access on MPC5566

1,066 Views
rebecca_l_oostd
Contributor I

Hi all,

Thanks for taking the time to read my question. I'm attempting to create a JTAG programmer for an MPC5566 on the MPC5566 eval board. I've successfully connected to the 5566 through OnCE as outlined in AN3283. I can single step through instructions, and I'm ready to move on to loading the NXP-provided H7F SSD flash driver into the MPC5566's RAM. I am able to write a single RAM address through the Nexus interface and read it back to verify the write, but I can't perform a burst read or write. I think I'm missing a step in the documentation. Here's my basic process for the burst write:

1. Write the OCMD with the Nexus3 access instruction

2. Pass through the DR path of the OnCE TAP controller, shifting in the Nexus RWA code and indicating write access.

3. Pass through the DR path of the OnCE TAP controller, shifting in the RAM address to write to.

4. Pass through the DR path of the OnCE TAP controller, shifting in the Nexus RWCS code and indicating write access.

5. Pass through the DR path of the OnCE TAP controller, shifting in the configuration code for start access, write access, 64-bit, burst mode (0xD8200000).

6. Pass through the DR path of the OnCE TAP controller, shifting in the Nexus RWD code and indicating write access.

7. Pass through the DR path of the OnCE TAP controller, shifting in the bits to write to the memory specified in RWA.

The burst read process is almost identical except in step 6, RWD is specified for read access, and I shift out the bits into a variable in step 7.

I think the problem is step 7; the documentation doesn't specify how to shift in/out the bits using the TAP controller. The documentation only says that the data is latched from the Nexus register during a read when passing through the CAPTURE-DR state, and that data is shifted in during a write access when passing through the UPDATE-DR state. Should I shift in all the bits before I go through the UPDATE-DR state and then back to RUN-TEST-IDLE, or should I shift in 32 bits, or 64 bits, at a time, go through the UPDATE-DR, and then go back to SELECT-DR-SCAN for the next 32 or 64 bits? Or should I follow a completely different process? I've tried both the strategies outlined here, but I don't read back the correct values in RAM using my Nexus3 single access function after the burst write completes. Any clarification would be much appreciated.

Thanks!

0 Kudos
5 Replies

894 Views
lukaszadrapa
NXP TechSupport
NXP TechSupport

Hi Rebecca,

it's necessary to:

1. configure CNT in RWCS to higher value

2. select RWD each time before writing to it

Here is script for Lauterbach debugger which works on my side:

;scan in OCMD - select Nexus3 Access register
  JTAG.SHIFTTMS 1 1 0 0          ;enter Shift-IR
  JTAG.SHIFTREG 0 0 1 1 1 1 1 0 0 0    ;Nexus3 Access register (Register Select 0b111_1100, least significant bit first)
  JTAG.SHIFTTMS 1 0              ;return to run-test/idle


;select Nexus register to be accessed - first pass through DR path
  JTAG.SHIFTTMS 1 0 0            ;enter Shift-DR
  JTAG.SHIFTREG %byte 0x13     ;shift in 8 bits (Nexus Register Index 0x9, RW = 1)
  JTAG.SHIFTTMS 1 0              ;return to run-test/idle

;write selected Nexus register - second pass through DR path  
  JTAG.SHIFTTMS 1 0 0            ;enter Shift-DR
  JTAG.SHIFTREG %Long 0x40000080 ;shift in 32 bits (RWA - set address)
  JTAG.SHIFTTMS 1 0              ;return to run-test/idle


;select Nexus register to be accessed - first pass through DR path
  JTAG.SHIFTTMS 1 0 0            ;enter Shift-DR
  JTAG.SHIFTREG %byte 0x0F     ;shift in 8 bits (Nexus Register Index 0x7, RW = 1)
  JTAG.SHIFTTMS 1 0              ;return to run-test/idle

;write selected Nexus register - second pass through DR path  
  JTAG.SHIFTTMS 1 0 0            ;enter Shift-DR
  JTAG.SHIFTREG %Long 0xD8000010 ;shift in 32 bits (RWCS - configure type of access)
  JTAG.SHIFTTMS 1 0              ;return to run-test/idle


;select Nexus register to be accessed - first pass through DR path
  JTAG.SHIFTTMS 1 0 0            ;enter Shift-DR
  JTAG.SHIFTREG %byte 0x15     ;shift in 8 bits (Nexus Register Index 0xA, RW = 1)
  JTAG.SHIFTTMS 1 0              ;return to run-test/idle

;write selected Nexus register - second pass through DR path  
  JTAG.SHIFTTMS 1 0 0            ;enter Shift-DR
  JTAG.SHIFTREG %Long 0x11223344 ;shift in 32 bits (RWD - write 0x11223344 )
  JTAG.SHIFTTMS 1 0              ;return to run-test/idle

;select Nexus register to be accessed - first pass through DR path
  JTAG.SHIFTTMS 1 0 0            ;enter Shift-DR
  JTAG.SHIFTREG %byte 0x15     ;shift in 8 bits (Nexus Register Index 0xA, RW = 1)
  JTAG.SHIFTTMS 1 0              ;return to run-test/idle

;write selected Nexus register - second pass through DR path  
  JTAG.SHIFTTMS 1 0 0            ;enter Shift-DR
  JTAG.SHIFTREG %Long 0x11223344 ;shift in 32 bits (RWD - write 0x11223344 )
  JTAG.SHIFTTMS 1 0              ;return to run-test/idle

;select Nexus register to be accessed - first pass through DR path
  JTAG.SHIFTTMS 1 0 0            ;enter Shift-DR
  JTAG.SHIFTREG %byte 0x15     ;shift in 8 bits (Nexus Register Index 0xA, RW = 1)
  JTAG.SHIFTTMS 1 0              ;return to run-test/idle


;write selected Nexus register - second pass through DR path  
  JTAG.SHIFTTMS 1 0 0            ;enter Shift-DR
  JTAG.SHIFTREG %Long 0x11223344 ;shift in 32 bits (RWD - write 0x11223344 )
  JTAG.SHIFTTMS 1 0              ;return to run-test/idle

;select Nexus register to be accessed - first pass through DR path
  JTAG.SHIFTTMS 1 0 0            ;enter Shift-DR
  JTAG.SHIFTREG %byte 0x15     ;shift in 8 bits (Nexus Register Index 0xA, RW = 1)
  JTAG.SHIFTTMS 1 0              ;return to run-test/idle


;write selected Nexus register - second pass through DR path  
  JTAG.SHIFTTMS 1 0 0            ;enter Shift-DR
  JTAG.SHIFTREG %Long 0x11223344 ;shift in 32 bits (RWD - write 0x11223344 )
  JTAG.SHIFTTMS 1 0              ;return to run-test/idle

I reused my old script for test shared here: Example JTAG access – Addendum to application notes AN3283 and AN4365 

I followed "25.14.8.3 Block Write Access (Burst Mode)" from MPC5566RM without modification.

I hope there are no mistakes, I'm running out of time, I will be out of office next two or three weeks.

Hope this helps.

Regards,

Lukas

0 Kudos

893 Views
rebecca_l_oostd
Contributor I

Thank you so much for the example and for the reference to the MPC5566RM. I've implemented my burst write as close as possible to your example using another microcontroller, making sure to access RWD before each write and made sure that the RWCS[CNT] matches the number of words I'm writing, but I'm still not able to read back the correct values. RWCS[DV] = 0 and RWCS[ERR] = 0 after the burst write, so I *assume* something is happening, but when I try to read the memory back using either the single read or burst read, I get junk values (the single read returns all 0s, the burst read returns the same value for all memory locations, and the value is not one that I've written). Not that it matters a lot, but I do have one question about your example; for the RWCS[CNT], it looks like you have specified 0x100 as the CNT, but you only write RWD 4 times instead of 256. When I do this, my RWCS[DV] never goes to zero. I have set my CNT to 4 and get RWCS[DV] = 0 at the end of the 4 writes.

In the meantime, I'm moving forward in my code using just single writes and reads.

0 Kudos

894 Views
lukaszadrapa
NXP TechSupport
NXP TechSupport

Hi,

I set CNT to 0b100 (4 in decimal), not to 0x100. I didn't read the values back using the script, I just established normal debug session by Lauterbach debugger and displayed the memory. But it doesn't matter. 

I could send you screenshots from logic analyzer to see the signals. But I will be back in the office in week after 8th July. Is that ok for you?

Regards,

Lukas

0 Kudos

894 Views
rebecca_l_oostd
Contributor I

Ah yes...of course it's 0b100 instead of 0x100. My code was actually doing this correctly with a math function to calculate the number of bytes and a bit shift to the correct location in RWCS. I just mixed up my hex and binary.

I would appreciate the screenshots from an LA to check my signals against when you have the time to take them. Thank you again for your help!

0 Kudos

894 Views
lukaszadrapa
NXP TechSupport
NXP TechSupport

Hi Rebecca,

I found some time to capture the signals. I used logic analyzer from Saleae. It's not easy to take just one screenshot because there are a lot of events. So, I exported it to attached file. Install the SW below and then just double click on the attached file.

https://downloads.saleae.com/logic/1.2.18/Logic%20Setup%201.2.18.exe 

This is sequence generated by the script which I shared above (I used channel 4 as a trigger - I asserted/deasserted it right before/after running this part of script):

pastedImage_2.png

You can zoom it in the viewer from Saleae as needed.

Hope this helps.

Regards,

Lukas

0 Kudos