Skip to content

Instantly share code, notes, and snippets.

@brainstorm

brainstorm/openocd_xpc56_session.md

Last active June 10, 2023 14:32
Show Gist options
  • Save brainstorm/ab2f43b25aea386e002056d1a32a20ad to your computer and use it in GitHub Desktop.
Save brainstorm/ab2f43b25aea386e002056d1a32a20ad to your computer and use it in GitHub Desktop.
Download ZIP
Hyundai CCM OpenOCD
Raw
openocd_xpc56_session.md

First clone this OpenOCD fork which contains patches for our target board:

git clone https://github.com/calandoa/openocd && cd openocd

Then apply some fixes/patch to the code above:

diff --git a/configure.ac b/configure.ac
index 312fda8b..043dbe17 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,6 +1,5 @@
-AC_PREREQ(2.64)
-AC_INIT([openocd], [0.10.0+dev],
-  [OpenOCD Mailing List <[email protected]>])
+AC_PREREQ([2.71])
+AC_INIT([openocd],[0.10.0+dev],[OpenOCD Mailing List <[email protected]>])
 AC_CONFIG_SRCDIR([src/openocd.c])
 
 m4_include([config_subdir.m4])dnl
@@ -22,9 +21,12 @@ AH_BOTTOM([
 #include <helper/replacements.h>
 ])
 
-AC_LANG_C
+AC_LANG([C])
 AC_PROG_CC
-AC_PROG_CC_C99
+m4_warn([obsolete],
+[AC_PROG_CC_C99 is obsolete; use AC_PROG_CC
+])dnl
+AC_REQUIRE(AC_PROG_CC)
 AM_PROG_CC_C_O
 AC_PROG_RANLIB
 PKG_PROG_PKG_CONFIG([0.23])
@@ -34,7 +36,7 @@ m4_defun([_LT_AC_LANG_CXX_CONFIG], [:])
 m4_defun([_LT_AC_LANG_F77_CONFIG], [:])
 m4_defun([_LT_AC_LANG_GCJ_CONFIG], [:])
 AC_DISABLE_SHARED
-AC_PROG_LIBTOOL
+LT_INIT
 AC_SUBST([LIBTOOL_DEPS])
 
 dnl configure checks required for Jim files (these are obsolete w/ C99)
@@ -78,7 +80,20 @@ AC_CHECK_HEADERS([arpa/inet.h ifaddrs.h netinet/in.h netinet/tcp.h net/if.h], []
 
 AC_HEADER_ASSERT
 AC_HEADER_STDBOOL
-AC_HEADER_TIME
+m4_warn([obsolete],
+[Update your code to rely only on HAVE_SYS_TIME_H,
+then remove this warning and the obsolete code below it.
+All current systems provide time.h; it need not be checked for.
+Not all systems provide sys/time.h, but those that do, all allow
+you to include it and time.h simultaneously.])dnl
+AC_CHECK_HEADERS_ONCE([sys/time.h])
+# Obsolete code to be removed.
+if test $ac_cv_header_sys_time_h = yes; then
+  AC_DEFINE([TIME_WITH_SYS_TIME],[1],[Define to 1 if you can safely include both <sys/time.h>
+	     and <time.h>.  This macro is obsolete.])
+fi
+# End of obsolete code.
+
 
 AC_C_BIGENDIAN
 
diff --git a/src/jtag/aice/aice_usb.c b/src/jtag/aice/aice_usb.c
index 50468f37..e0424ca7 100644
--- a/src/jtag/aice/aice_usb.c
+++ b/src/jtag/aice/aice_usb.c
@@ -2813,7 +2813,7 @@ static int aice_issue_reset_hold(uint32_t coreid)
 	/* set no_dbgi_pin to 0 */
 	uint32_t pin_status;
 	aice_read_ctrl(AICE_READ_CTRL_GET_JTAG_PIN_STATUS, &pin_status);
-	if (pin_status | 0x4)
+	if (pin_status)
 		aice_write_ctrl(AICE_WRITE_CTRL_JTAG_PIN_STATUS, pin_status & (~0x4));
 
 	/* issue restart */
diff --git a/src/jtag/core.c b/src/jtag/core.c
index 5d9b8101..32f585e4 100644
--- a/src/jtag/core.c
+++ b/src/jtag/core.c
@@ -1689,7 +1689,7 @@ void jtag_set_verify(bool enable)
 	jtag_verify = enable;
 }
 
-bool jtag_will_verify()
+bool jtag_will_verify(void)
 {
 	return jtag_verify;
 }
@@ -1699,7 +1699,7 @@ void jtag_set_verify_capture_ir(bool enable)
 	jtag_verify_capture_ir = enable;
 }
 
-bool jtag_will_verify_capture_ir()
+bool jtag_will_verify_capture_ir(void)
 {
 	return jtag_verify_capture_ir;
 }
diff --git a/src/jtag/interface.c b/src/jtag/interface.c
index 835bb93b..8f472705 100644
--- a/src/jtag/interface.c
+++ b/src/jtag/interface.c
@@ -45,7 +45,7 @@ void tap_set_state_impl(tap_state_t new_state)
 	state_follower = new_state;
 }
 
-tap_state_t tap_get_state()
+tap_state_t tap_get_state(void)
 {
 	return state_follower;
 }
@@ -64,7 +64,7 @@ void tap_set_end_state(tap_state_t new_end_state)
 	end_state_follower = new_end_state;
 }
 
-tap_state_t tap_get_end_state()
+tap_state_t tap_get_end_state(void)
 {
 	return end_state_follower;
 }
diff --git a/tcl/target/xpc56.cfg b/tcl/target/xpc56.cfg
index 2c52f10a..7625fccf 100644
--- a/tcl/target/xpc56.cfg
+++ b/tcl/target/xpc56.cfg
@@ -1,31 +1,4 @@
-
-
-# Jtag signal         | FTDI           | STM 14 pins JTAG connector
-# Clock        TCK/SK | ADBUS0   out   | pin 5
-# Data Out     TDI/DO | ADBUS1   out   | pin 1
-# Data In      TDO/DI | ADBUS2   in    | pin 3
-# Mode Select  TMS/CS | ADBUS3   out   | pin 10
-# Reset        nSRST  | ACBUS1   out   | pin 9
-# Ground       GND    | GND      power | pins 2,4,6,12
-
-interface ftdi
-
-# Original FTDI
-#ftdi_vid_pid 0x0403 0x6014
-
-# FTDI reflashed for STM
-ftdi_vid_pid 0x263d 0x4001
-
-ftdi_layout_signal nSRST -data 0x0200
-#ftdi_layout_signal nTRST -data x
-#ftdi_layout_signal LED -data x
-#ftdi_layout_signal SWDIO_OE -data x
-#ftdi_layout_signal SWD_EN -data x
-#ftdi_layout_init 0x0008 0x000b
-
-ftdi_layout_init 0x0208 0x020b
-
-reset_config srst_only srst_push_pull
+interface remote_bitbang
 
 transport select jtag
 adapter_khz 10000
@@ -34,7 +7,7 @@ set CHIPNAME xpc56
 # big endian, but allow to read memory directly
 set ENDIAN little
 # 560D
-set CPUTAPID 0x3ae44041
+set CPUTAPID 0x06a4401d
 # 560B
 #set CPUTAPID 0x3ae41041
 
@@ -53,12 +26,12 @@ target create $TARGETNAME xpc56 -endian $ENDIAN -chain-position $TARGETNAME
 #$TARGETNAME configure -event reset-end {  test_ram }
 
 
-flash bank $CHIPNAME.cflash0 xpc56 0x00000000 0 0 0 $TARGETNAME
-flash bank $CHIPNAME.dflash0 xpc56 0x00800000 0 0 0 $TARGETNAME
+#flash bank $CHIPNAME.cflash0 xpc56 0x00000000 0 0 0 $TARGETNAME
+#flash bank $CHIPNAME.dflash0 xpc56 0x00800000 0 0 0 $TARGETNAME
 
 flash banks
 
-#flash list
+flash list
 
 #proc fp {idx} {
 #        flash list
@@ -70,5 +43,5 @@ flash banks
 #flash probe 2
 
 init
-#reset halt
+reset halt
 #halt

After the patches are applied, bootstrap and configure without the (many) deprecation warnings that turn into errors:

./bootstrap
CFLAGS="-g -O2 -Wno-deprecated -Wno-error" ./configure --enable-remote-bitbang --enable-ftdi --enable-stlink
make -j10

And finally run your probe (in my case a bit banged Glasgow Rev 2C):

$ glasgow run jtag-openocd --port A -V 3.3 --pin-tck 5 --pin-tms 6 --pin-tdi 3 --pin-tdo 4 tcp:localhost:5555
./src/openocd -f ./tcl/interface/remote_bitbang.cfg -f tcl/target/xpc56.cfg

If everything went well, you should see the following:

(glasgow) rvalls@m1 openocd-xPC56 % ./src/openocd -f ./tcl/interface/remote_bitbang.cfg -f tcl/target/xpc56.cfg
Warn : Adapter driver 'remote_bitbang' did not declare which transports it allows; assuming legacy JTAG-only
Info : only one transport option; autoselect 'jtag'
Warn : Interface already configured, ignoring
Warn : Transport "jtag" was already selected
adapter speed: 10000 kHz
__xpc56_target_create__204__
__xpc56_init_target__254__
Info : Initializing remote_bitbang driver
Info : Connecting to localhost:5555
Info : remote_bitbang driver initialized
Info : This adapter doesn't support configurable speed
Info : JTAG tap: xpc56.cpu tap/device found: 0x06a4401d (mfg: 0x00e (Freescale (Motorola)), part: 0x6a44, ver: 0x0)
========================== start exam ============================ 1
=== DBG ENTER ===
--- DBG EXIT ---
osr: 201
osr: 201   dbcr0: 80000000  dbsr: 10000000
osr: 201   dbcr0: 80000000  dbsr: 10000000
osr: 205   dbcr0: 80000000  dbsr: 10000000
osr: 205   dbcr0: 80000000  dbsr: 10000000
Info : Listening on port 3333 for gdb connections
osr: 205   dbcr0: 80000000  dbsr: 10000000
Info : JTAG tap: xpc56.cpu tap/device found: 0x06a4401d (mfg: 0x00e (Freescale (Motorola)), part: 0x6a44, ver: 0x0)
__xpc56_assert_reset__724__ 1
=== DBG ENTER ===
__xpc56_deassert_reset__739__ 1
osr: 209   dbcr0: 80000000  dbsr: 10000000  pc:0003532c  ctl:00010002
osr: 209   dbcr0: 80000000  dbsr: 10000000  pc:0003532c  ctl:00010002
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
osr: 209   dbcr0: 80000000  dbsr: 10000000  pc:0003532c  ctl:00010002
osr: 209   dbcr0: 80000000  dbsr: 10000000  pc:0003532c  ctl:00010002
osr: 209   dbcr0: 80000000  dbsr: 10000000  pc:0003532c  ctl:00010002
osr: 209   dbcr0: 80000000  dbsr: 10000000  pc:0003532c  ctl:00010002
osr: 209   dbcr0: 80000000  dbsr: 10000000  pc:0003532c  ctl:00010002
osr: 209   dbcr0: 80000000  dbsr: 10000000  pc:0003532c  ctl:00010002
osr: 241   dbcr0: 80000000  dbsr: 10000000  pc:0003532c  ctl:00010002
osr: 209   dbcr0: 80000000  dbsr: 10000000  pc:0003532c  ctl:00010002
osr: 209   dbcr0: 80000000  dbsr: 10000000  pc:0003532c  ctl:00010002
osr: 209   dbcr0: 80000000  dbsr: 10000000  pc:0003532c  ctl:00010002
(...)

Next steps are examining the src/target/xpc56.c implementation a bit more carefully and eventually dump some (internal flash) memory, assuming that he device is not locked up.

To be continued in the comments below 👇 ;)

@brainstorm
Copy link
Author

Thanks @calandoa for your OpenOCD fork for E200 family processors!

@brainstorm
Copy link
Author

brainstorm commented Jun 10, 2023 •
edited
Loading

After @uhi22's JTAG traces release on https://github.com/uhi22/Ioniq28Investigations/tree/main/CCM_ChargeControlModule_PLC_CCS/JtagAnalysis, I poked at the OpenOCD's xpc56_examine function introducing the following code, which makes use of the Nexus flash memory reading approach:

(...)
#if 1
»·······uint8_t buffer[256];
»·······memset(buffer, 0, sizeof(buffer));
»·······uint32_t buf[32]; (void) buf;
»·······memset(buf, 0, sizeof(buf));
»·······xpc56_read_memory(target, 0x00000000, 4, 8, (uint8_t*)buf);
//»·····xpc56_read_memory(target, 0x00008000, 4, 8, (uint8_t*)buf);
»·······printf("mem %08x %08x %08x %08x\n", buf[0], buf[1], buf[2], buf[3]);
»·······printf("mem %08x %08x %08x %08x\n", buf[0+4], buf[1+4], buf[2+4], buf[3+4]);
»·······printf("----\n");
#endif
(...)

Which yielded the following mem lines, that unfortunately yield non-stable values on each openocd run:

(glasgow) rvalls@m1 ~ % glasgow run jtag-openocd --port A -V 3.3 --pin-tck 5 --pin-tms 6 --pin-tdi 3 --pin-tdo 4 tcp:localhost:5555 &
(glasgow) rvalls@m1 openocd-xPC56 % ./src/openocd -f ./tcl/interface/remote_bitbang.cfg -f tcl/target/xpc56.cfg
Warn : Adapter driver 'remote_bitbang' did not declare which transports it allows; assuming legacy JTAG-only
Info : only one transport option; autoselect 'jtag'
Warn : Interface already configured, ignoring
Warn : Transport "jtag" was already selected
adapter speed: 10000 kHz
__xpc56_target_create__204__
__xpc56_init_target__254__
Info : Initializing remote_bitbang driver
Info : Connecting to localhost:5555
Info : remote_bitbang driver initialized
Info : This adapter doesn't support configurable speed
Info : JTAG tap: xpc56.cpu tap/device found: 0x06a4401d (mfg: 0x00e (Freescale (Motorola)), part: 0x6a44, ver: 0x0)
mem 00000000 00000000 00000000 00000000
mem 01012015 00000000 00000000 00000000
----
osr: 201
osr: 201   dbcr0: 00000000  dbsr: 10000000
osr: 205   dbcr0: 00000000  dbsr: 10000000
osr: 205   dbcr0: 00000000  dbsr: 10000000
osr: 205   dbcr0: 00000000  dbsr: 10000000
Info : Listening on port 3333 for gdb connections
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
osr: 205   dbcr0: 00000000  dbsr: 10000000
osr: 205   dbcr0: 00000000  dbsr: 10000000
osr: 205   dbcr0: 00000000  dbsr: 10000000
osr: 205   dbcr0: 00000000  dbsr: 10000000
osr: 205   dbcr0: 00000000  dbsr: 10000000
osr: 205   dbcr0: 00000000  dbsr: 10000000
osr: 205   dbcr0: 00000000  dbsr: 10000000
osr: 205   dbcr0: 00000000  dbsr: 10000000
osr: 205   dbcr0: 00000000  dbsr: 10000000
osr: 205   dbcr0: 00000000  dbsr: 10000000

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment