This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

[FAQ] TMS320F28377D: Standalone Flash Programmer

Part Number: TMS320F28377D

We manufacture IC programmers and working to support JTAG programming of this device . Is it possible for you or end customer to send us  JTAG spec programming document for this chip? 

  • Aelee,
    I'm looking into this with our emulation/tools teams. Should have a complete answer by end of day worst case.
    Best,
    Matthew
  • Aelee,spruf82_c28x.pdf

    Attached is the emulation guide that will walk through the steps to send commands to the device.  Below I have also listed some frequently asked questions regarding this document.

    After this is implemented you'll then want to check out the Flash API guide for the F2837x device.  Note that not all C2000 MCUs have the same API; there is a different API for the F2802x/3x/5x/6x devices.  I believe that the F28004x device shares the API with the F2837x/F2807x devices.  

    http://www.ti.com/lit/spnu629

    FAQ Portion

    “The document spruf82_c28x seems to contain some inaccurate information. “

    That is true.  At best, some of the instructions are confusing.  And there is at least one section that is wrong.  This FAQ should help answer many of the questions regarding the document.

    “Figure 3-1 on page 20 seems not to be in line with JTAG as it seems to show DR and IR as same.”

    Yes, that is a confusing diagram. What it should state clearer is that the C28x debug does not use the JTAG DR scan path.  Every scan is through the IR path and includes both 6 bits that work as a traditional IR scan value and 32 bits that work like a DR payload. You don’t scan in a value into the IR and then scan through the DR like you would for most JTAG devices. Instead, both are combined into a single IR scan every time. (There are DR scans for standard JTAG registers like IDCODE, and there is a DR scan supported that always returns the C28x SSR.)

    "How do we setup JTAG debug mode?"

    The general steps would be:

       Put the target into Test-Logic-Reset (either pull TRST low, or hold TMS high will toggling TCK for at least 7 cycles)

       Execute an IR path scan to write a value of 0x000000aa into DC_STRBS

    "How do we read/write program memory ,data memory, cpu register?"

    For program memory, see spruf82_c28x, section 3.2.4.1.  Also refer to Appendix B.

    Data memory and registers work similarly, but the info in section 3.2.4.2 is incorrect.  Use the following instead.

    Address Fields:

    26:24 MUCYC[2:0] Indicates the type of DT-DMA cycle to perform:

        0 = Program Memory

        1 = Data Memory

        2 = Register (see table of register indexes)

        ...

    23:0 ADDR[23:0] 24-bit address.

    C28x Register indexes:

       0    XAR0    (32-bit)

       1    XAR1    (32-bit)

       2    XAR2    (32-bit)

       3    XAR3    (32-bit)

       4    XAR4    (32-bit)

       5    XAR5    (32-bit)

       6    XAR6    (32-bit)

       7    XAR7    (32-bit)

       14   SP      (22-bit)

       320  IC      (22-bit)

       6    RPC     (22-bit)

       224  ACC     (32-bit)

       256  P       (32-bit)

       160  XT      (32-bit)

       192  ST0     (16-bit)

       11   ST1     (16-bit)

       12   IER     (16-bit)

       13   IFR     (16-bit)

       9    DBGIER  (16-bit)

       10   DP      (16-bit)

       8    ORIFR   (16-bit)

       (indexes are decimal values)

    “What exactly is register ORIFR?”

    I do not know.  The register is not implemented in our debug driver and doesn’t seem to be accessible from CCS.   It’s probably safe to ignore it.

    "How do we run application code in ram?"

    Control execution via the Run State Machine Control bits (EXE_DIR) in the MF_REG_0 register.  See section 3.2.7 and Appendix B.

    "What is the protocol of C2000 JTAG interface?"

    JTAG 1149.1

    "Why do I have to retry some debug steps for them to work?"

    The debug logic in the C28x is driven by the TCK clock.  If your JTAG probe does not have a free-running TCK, then it necessary to run some extra TCK cycles at the end of each scan to ensure the debug logic remains active to act on your last command.  Make sure you execute an additional 16 cycles of TCK at the end of each scan.  Also, you should run TCK some while TRST is low and after releasing TRST to ensure the debug logic is fully initialized.

    "How do you do a system reset?"

    That depends on what you mean by system reset.  You can reset the debug logic via TLR.  You may be able to do a CPU reset.  You may be able to do a device level reset if the device has an ICEPick router.  But you cannot do something like a board level reset or power on reset.

    To do a CPU reset on the C28x, you follow this basic procedure:

       Set the reset bit in MF1

       Execute a single step on the core (required to actually do the reset)

       Check SSR until you see the reset acknowledged

       Clear the reset bit in MF1

    "Why isn’t my target responding to memory requests?"

    Your target may not be allowing debug requests.  This is controlled by the DBGM bit of the ST1 register.  You can override this by setting additional bits in MF0:

    #define MF0_QUAL_LD        ((UINT32)0x00000080) /*  7 Load QUAL fields(6:0) */

    #define MF0_IGN_HPI        ((UINT32)0x00000040) /*  6 1=Ignore HPI          */

    #define MF0_IGN_DBG        ((UINT32)0x00000020) /*  5 1=Ignore DBGM         */

    #define MF0_IGN_ALL        ((UINT32)0x00000060) /*  6:5  Ignore HPI & DBGM  */

    #define MF0_DFR_MASK       ((UINT32)0x0000001F) /*  4:0  DFR                */

    Setting the QUAL fields allows you to force debug access.  Set MF0_QUAL_LD to set these bits.  Ignore HPI tells the debug logic to let you halt while the application is executing a “high priority interrupt”.  Ignore DBGM tells the debug logic to ignore the state of the DGBM bit in ST1.  And you should set the DFR, Debug Frame, to -1 initially.  So the value loaded into MF0 to halt the core should be:  0x00080FF.

    "Why can’t I connect to one of my boards?"

    If the CSM is locked, you cannot debug the target.  You’ll need some way other than the debugger to unlock the board.  (Some boards use pins on the chip to configure specific boot modes to let you flash the chip to recover.)