Chipcon Application

This application allows for the debugging of Chipcon radios with embedded 8051 cores, such as the CC2430 and CC2530. The protocol is SPI-like, but with a bi-directional data line.

GoodFET Chipcon pinout

Clients

chipcon.cc is an actively maintained client application.

Development

Prior to any transactions, the SETUP (0x10) verb should be sent to the Chipcon application to properly set the I/O pin directions. After that, the START (0x20) and STOP (0x21) verbs may be used to enter and exit the debugger.

The Chipcon protocol is similar to SPI, but with the difference that a single data line is used. Rather than exchanging register values, the transfer is one-way. Use the WRITE (0x01) instruction only for debugging commands which do not result in a reply. READ (0x00) will write its data to the target, then accept a return byte in reply.

Verbs

While standard verbs are supported on this platform, they are inadequate for full debugging. Verbs 0x80 to 0x8F are debugging primitives, while verbs 0x90 to 0x9F are used for more complicated macro commands.

Hex#defineDescription
0x00READWrite any data, return 1-byte reply.
0x01WRITEWrite data.
0x02PEEKRead from IRAM.
0x03POKEWrite to IRAM.
0x10SETUPConfigure I/O pins.
0x20STARTStart a transaction.
0x21STOPStop a transaction.
0x80CC_CHIP_ERASE
0x81CC_WR_CONFIG
0x82CC_RD_CONFIG
0x83CC_GET_PC
0x84CC_READ_STATUS
0x85CC_SET_HW_BRKPNT
0x86CC_HALT
0x87CC_RESUME
0x88CC_DEBUG_INSTR
0x89CC_STEP_INSTR
0x8ACC_STEP_REPLACE
0x8BCC_GET_CHIP_ID
0x90CC_READ_CODE_MEMORY
0x91CC_READ_XDATA_MEMORY
0x92CC_WRITE_XDATA_MEMORY
0x93CC_SET_PC
0x94CC_CLOCK_INIT
0x95CC_WRITE_FLASH_PAGE
0x96CC_READ_FLASH_PAGE
0x97CC_MASS_ERASE_FLASH
0x98CC_PROGRAM_FLASHCopy 2kB to Flash.
0x99CC_WIPEFLASHBUFFERWipe 2kB buffer to 0xFF.
0x9ACC_LOCKCHIPSet security bits.

Thanks

Thanks, and a beer, are due to Peter Kuhar, both for authoring the first open source Chipcon debugger and for the neighborly contribution of hardware.