This is an automated email from Gerrit. Al Dyrius ([email protected]) just uploaded a new patch set to Gerrit, which you can find at http://openocd.zylin.com/5307
-- gerrit commit 9657c822345ea251e23a1430540d3196cbc1b5de Author: Al Dyrius <[email protected]> Date: Wed Sep 25 23:39:05 2019 -0600 Update FTDI C232HM cfg, and add two new cfgs from cable modem research Change-Id: Idbeffcd5ff4380b1e7c9fd5ef6ba3ca77cc22d99 Signed-off-by: Al Dyrius <[email protected]> diff --git a/tcl/board/kc100.cfg b/tcl/board/kc100.cfg new file mode 100644 index 0000000..865e681 --- /dev/null +++ b/tcl/board/kc100.cfg @@ -0,0 +1,39 @@ +# boards/kc100.cfg +# Knovative KC-100 cable modem, ancient board used in research. + +# TNETC4401PYP, 208-QFP U3 +source [find target/tnetc4401.cfg] + +# 14-pin EJTAG on JP1. Standard pinout, 1-3-5-7-9-11 = nTRST-TDI-TDO-TMS-TCK-nSRST. Use 2 for GND. +# Was initially disabled in hardware; had to add a solder bridge reenabling R124, R125 on back. +reset_config trst_and_srst separate + +# 16Mb Intel CFI flash. Note this CPU has an internal ROM at 0x1FC0000 (phys) for cold boot. +# All that really does is some minimal checks before jumping to external flash at 0x00000000 phys. +# That is remapped to 0xB0000000 uncached, 0x90000000 cached. +flash bank intel cfi 0xB0000000 0x200000 2 2 $_TARGETNAME + +# Dumping the 2MB will takes about 10 mins w/FTDI FT232H at 4MHz; faster errs out in testing... +# Perform this after a clean reboot, halt, and reset init (which should also leave it halted). +proc kc100_dump_flash {} { + echo "Probing 48 TSOP Intel CFI flash chip (2MB)..." + flash probe intel + echo "Dumping 0x2000 of 2MB chip to flashdump.bin. + # Whole 2MB flash takes about 10 minutes w/FT232H at adapter_khz 4000..." + c232hm_LED_on + flash read_bank 0 flashdump.bin 0 0x2000 + c232hm_LED_off +} + +#TODO figure out memory init sequence to be able to dump from cached segment instead + +# There is also a serial console on JP2, 3-5-6 = TX-RX-GND. 9600/8/N/1. + +# Possibly of note, this modem's ancient ethernet port does not support Auto-MDIX. + +# This modem in many ways appears to be essentially a clone of the SB5120. See usbjtag.com. +# The firmware/OS is also susceptible to many of the same procedures in "Hacking the Cable Modem" +# by DerEngel (Ryan Harris), available from No Starch Press. + +# end boards/kc100.cfg + diff --git a/tcl/interface/ftdi/c232hm.cfg b/tcl/interface/ftdi/c232hm.cfg index 387abbb..3caf199 100644 --- a/tcl/interface/ftdi/c232hm.cfg +++ b/tcl/interface/ftdi/c232hm.cfg @@ -1,3 +1,4 @@ +# interface/ftdi/c232hm.cfg # # FTDI USB Hi-Speed to MPSSE Cable # @@ -6,10 +7,65 @@ # C232HM-DDHSL-0 and C232HM-EDSL-0 provide 3.3V and 5V on pin 1 (Red), # respectively. # +# Adapter: http://www.ftdichip.com/Support/Documents/DataSheets/Cables/DS_C232HM_MPSSE_CABLE.PDF +# Chip: http://www.ftdichip.com/Support/Documents/DataSheets/ICs/DS_FT232H.pdf +# See pinout/colors at end of this file. +# +# Tech notes: +# http://www.ftdichip.com/Support/Documents/AppNotes/AN_135_MPSSE_Basics.pdf +# http://www.ftdichip.com/Support/Documents/AppNotes/AN_129_FTDI_Hi_Speed_USB_To_JTAG_Example.pdf +# +# This was tested with the 3.3V version adapter (FTDI part number C232HM-DDHSL-0). It should also +# work with the 5V version (C232HM-EDHSL-0), but this has not been tested. +# +# In testing, with adapter_khz at 26000 or 30000 MHz, read speed topped out around 2.2 KiB/s. +# This allowed dumping a 4MB flash chip in about 30 minutes, for example. interface ftdi #ftdi_device_desc "C232HM-DDHSL-0" #ftdi_device_desc "C232HM-EDHSL-0" + +# Common PID for FT232H ftdi_vid_pid 0x0403 0x6014 -ftdi_layout_init 0x0008 0x000b +# Layout +# High data 0xff makes ACBUS (which includes LED on ACBUS6) initially high (off). +# Low data byte 0xf8 makes TRST (AD4) and SRST (AD5) initially high (unasserted). +# High direction 0x40 makes only ACBUS6 output (connected to red LED) +# Low direction 0xfb makes GPIOL0/1 output; used for T/SRST signals below. Only TDO is input (low). +ftdi_layout_init 0xfff8 0x40fb + +# Optional Signals (Comment out ftdi_layout_signal line(s) below if board doesn't have T/SRST.) +# ---A*BUS-------CCCCCCCC|DDDDDDDD +# --------\______76543210|76543210 +# nTRST 0x0010 = 00000000|00010000 = ADBUS4 (gray) +# nSRST 0x0020 = 00000000|00100000 = ADBUS5 (purple) +# LED 0x4000 = 01000000|00000000 = ACBUS6 +ftdi_layout_signal nTRST -data 0x0010 -oe 0x0010 +ftdi_layout_signal nSRST -data 0x0020 -oe 0x0020 +ftdi_layout_signal LED -data 0x4000 -noe 0x4000 + +# LED toggle procedures +proc c232hm_LED_on {} { + ftdi_layout_signal LED -data 0x4000 -oe 0x4000 +} + +proc c232hm_LED_off {} { + ftdi_layout_signal LED -data 0x4000 -noe 0x4000 +} + +# C232HM FT232H JTAG +# Num Color Name Func +# 1 Red VCC N/A - Do not connect +# 2 Orange ADBUS0 TCK +# 3 Yellow ADBUS1 TDI +# 4 Green ADBUS2 TDO +# 5 Brown ADBUS3 TMS +# 6 Grey ADBUS4 (GPIOL0)/nTRST +# 7 Purple ADBUS5 (GPIOL1)/nSRST +# 8 White ADBUS6 (GPIOL2) - not used +# 9 Blue ADBUS7 (GPIOL3) - not used +# 10 Black GND Connect to ground + +# end interface/ftdi/c232hm.cfg + diff --git a/tcl/target/tnetc4401.cfg b/tcl/target/tnetc4401.cfg new file mode 100644 index 0000000..d9eaf87 --- /dev/null +++ b/tcl/target/tnetc4401.cfg @@ -0,0 +1,25 @@ +# targets/tnetc4401.cfg + +# Texas Instruments (TI) TNETC4401, MIPS32 DOCSIS-tailored SoC (4Kc-based) +# First found TNETC4401PYP on KC-100 CM used in research. Also used on Motorola Surfboard SB5120. +# See https://brezn.muc.ccc.de/~mazzoo/DOCSIS/tnetc4401.pdf +transport select jtag +set _TARGETNAME tnetc4401 +set _CPUTAPID 0x0000100f +jtag newtap $_TARGETNAME tap -irlen 5 -ircapture 0x01 -irmask 0x1f -expected-id $_CPUTAPID +target create $_TARGETNAME mips_m4k -chain-position $_TARGETNAME.tap -endian big +# end targets/tnetc4401.cfg + +# May need to halt manually before calling reset init +$_TARGETNAME configure -event reset-init { + #reset_config trst_and_srst separate + halt + echo "reset-init: disabling watchdog..." + mwb phys 0xa8610b00 0 256 + halt + wait_halt + echo "Done, check with:" + echo "targets" +} + +# end targets/tnetc4401.cfg -- _______________________________________________ OpenOCD-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openocd-devel
