This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

Accessing core registers through JTAG controller

Hi,

We are developing a programmer for TMS320F28x series used for inline production. We use our own programmer (containing an FPGA) to directly access the chip through the JTAG port.
To be clear, this means we will only use our own tooling, so not Code Composer or any TI programming POD (such as XDS510USB or any related devices).
What we plan to do is to write a firmware image to the RAM via JTAG, and then set the Program Counter and Stack Pointer through JTAG to execute the uploaded firmware image.
This uploaded image will then further take care of programming the flash.
After signing an NDA, we have received the JTAG emulation information from TI.
However there is still some information unclear after studying the datasheets we received.

We are now able to access the RAM through JTAG and read and write it, using or own hardware as mentioned.
However, it seems reading or writing to Core Registers (like Status Register and Program Counter) is still not possible, because we don’t know to which address these registers are memory mapped.
These addresses seem not be mentioned in documents spruf82_c28 and sprue64. Therefore we still can't access to CPU registers. I can't find any useful information in other public documents.

Could you tell us where we can find the addresses of memory mapped Core registers, such as Program Counter, Stack pointer, etc.?
Do we have to apply for another document containing this information?

Thanks in advance

Wouter

  • Hello Wouter,

    I am going to move this thread to the code composer studio forum.  Someone with the emulation network should get back to you from there.

    I believe this is a related post from your company as well?  I know someone is working on answering.

    http://e2e.ti.com/support/development_tools/code_composer_studio/f/81/t/280026.aspx

    Thank you

    Lori

  • The CPU registers in the C28x are not memory mapped, but they are scanned out via the same ICEMaker commands as memory accesses.  When building the address to scan, you use a flag for Register instead of one for Data or Program memory.  

    Address Fields:

    26:24 MUCYC[2:0] Indicates the type of DT-DMA cycle to perform:

      0 = Program Memory

      1 = Data Memory

      2 = Register (see table of register indexes)

    ...

    23:0 ADDR[23:0] 24-bit address.


    C28x Register addresses:
    0   XAR0   (32-bit)
    1   XAR1   (32-bit)
    2   XAR2   (32-bit)
    3   XAR3   (32-bit)
    4   XAR4   (32-bit)
    5   XAR5   (32-bit)
    6   XAR6   (32-bit)
    7   XAR7   (32-bit)
    14  SP     (22-bit)
    320 IC     (22-bit)
    6   RPC    (22-bit)
    224 ACC    (32-bit)
    256 P      (32-bit)
    160 XT     (32-bit)
    192 ST0    (16-bit)
    11  ST1    (16-bit)
    12  IER    (16-bit)
    13  IFR    (16-bit)
    9   DBGIER (16-bit)
    10  DP     (16-bit)
    8   ORIFR  (16-bit)