1 /***************************************************************************
2 * Copyright (C) 2007,2008 by Christopher Kilgour *
3 * techie |_at_| whiterocker |_dot_| com *
5 * This program is free software; you can redistribute it and/or modify *
6 * it under the terms of the GNU General Public License as published by *
7 * the Free Software Foundation; either version 2 of the License, or *
8 * (at your option) any later version. *
10 * This program is distributed in the hope that it will be useful, *
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
13 * GNU General Public License for more details. *
15 * You should have received a copy of the GNU General Public License *
16 * along with this program; if not, write to the *
17 * Free Software Foundation, Inc., *
18 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
19 ***************************************************************************/
27 static int tms470_register_commands(struct command_context_s
*cmd_ctx
);
28 static int tms470_flash_bank_command(struct command_context_s
*cmd_ctx
, char *cmd
, char **args
, int argc
, struct flash_bank_s
*bank
);
29 static int tms470_erase(struct flash_bank_s
*bank
, int first
, int last
);
30 static int tms470_protect(struct flash_bank_s
*bank
, int set
, int first
, int last
);
31 static int tms470_write(struct flash_bank_s
*bank
, uint8_t * buffer
, uint32_t offset
, uint32_t count
);
32 static int tms470_probe(struct flash_bank_s
*bank
);
33 static int tms470_auto_probe(struct flash_bank_s
*bank
);
34 static int tms470_erase_check(struct flash_bank_s
*bank
);
35 static int tms470_protect_check(struct flash_bank_s
*bank
);
36 static int tms470_info(struct flash_bank_s
*bank
, char *buf
, int buf_size
);
38 flash_driver_t tms470_flash
= {
40 .register_commands
= tms470_register_commands
,
41 .flash_bank_command
= tms470_flash_bank_command
,
42 .erase
= tms470_erase
,
43 .protect
= tms470_protect
,
44 .write
= tms470_write
,
45 .probe
= tms470_probe
,
46 .auto_probe
= tms470_auto_probe
,
47 .erase_check
= tms470_erase_check
,
48 .protect_check
= tms470_protect_check
,
52 /* ----------------------------------------------------------------------
53 Internal Support, Helpers
54 ---------------------------------------------------------------------- */
56 const flash_sector_t TMS470R1A256_SECTORS
[] = {
57 {0x00000000, 0x00002000, -1, -1},
58 {0x00002000, 0x00002000, -1, -1},
59 {0x00004000, 0x00002000, -1, -1},
60 {0x00006000, 0x00002000, -1, -1},
61 {0x00008000, 0x00008000, -1, -1},
62 {0x00010000, 0x00008000, -1, -1},
63 {0x00018000, 0x00008000, -1, -1},
64 {0x00020000, 0x00008000, -1, -1},
65 {0x00028000, 0x00008000, -1, -1},
66 {0x00030000, 0x00008000, -1, -1},
67 {0x00038000, 0x00002000, -1, -1},
68 {0x0003A000, 0x00002000, -1, -1},
69 {0x0003C000, 0x00002000, -1, -1},
70 {0x0003E000, 0x00002000, -1, -1},
73 #define TMS470R1A256_NUM_SECTORS \
74 (sizeof(TMS470R1A256_SECTORS)/sizeof(TMS470R1A256_SECTORS[0]))
76 const flash_sector_t TMS470R1A288_BANK0_SECTORS
[] = {
77 {0x00000000, 0x00002000, -1, -1},
78 {0x00002000, 0x00002000, -1, -1},
79 {0x00004000, 0x00002000, -1, -1},
80 {0x00006000, 0x00002000, -1, -1},
83 #define TMS470R1A288_BANK0_NUM_SECTORS \
84 (sizeof(TMS470R1A288_BANK0_SECTORS)/sizeof(TMS470R1A288_BANK0_SECTORS[0]))
86 const flash_sector_t TMS470R1A288_BANK1_SECTORS
[] = {
87 {0x00040000, 0x00010000, -1, -1},
88 {0x00050000, 0x00010000, -1, -1},
89 {0x00060000, 0x00010000, -1, -1},
90 {0x00070000, 0x00010000, -1, -1},
93 #define TMS470R1A288_BANK1_NUM_SECTORS \
94 (sizeof(TMS470R1A288_BANK1_SECTORS)/sizeof(TMS470R1A288_BANK1_SECTORS[0]))
96 const flash_sector_t TMS470R1A384_BANK0_SECTORS
[] = {
97 {0x00000000, 0x00002000, -1, -1},
98 {0x00002000, 0x00002000, -1, -1},
99 {0x00004000, 0x00004000, -1, -1},
100 {0x00008000, 0x00004000, -1, -1},
101 {0x0000C000, 0x00004000, -1, -1},
102 {0x00010000, 0x00004000, -1, -1},
103 {0x00014000, 0x00004000, -1, -1},
104 {0x00018000, 0x00002000, -1, -1},
105 {0x0001C000, 0x00002000, -1, -1},
106 {0x0001E000, 0x00002000, -1, -1},
109 #define TMS470R1A384_BANK0_NUM_SECTORS \
110 (sizeof(TMS470R1A384_BANK0_SECTORS)/sizeof(TMS470R1A384_BANK0_SECTORS[0]))
112 const flash_sector_t TMS470R1A384_BANK1_SECTORS
[] = {
113 {0x00020000, 0x00008000, -1, -1},
114 {0x00028000, 0x00008000, -1, -1},
115 {0x00030000, 0x00008000, -1, -1},
116 {0x00038000, 0x00008000, -1, -1},
119 #define TMS470R1A384_BANK1_NUM_SECTORS \
120 (sizeof(TMS470R1A384_BANK1_SECTORS)/sizeof(TMS470R1A384_BANK1_SECTORS[0]))
122 const flash_sector_t TMS470R1A384_BANK2_SECTORS
[] = {
123 {0x00040000, 0x00008000, -1, -1},
124 {0x00048000, 0x00008000, -1, -1},
125 {0x00050000, 0x00008000, -1, -1},
126 {0x00058000, 0x00008000, -1, -1},
129 #define TMS470R1A384_BANK2_NUM_SECTORS \
130 (sizeof(TMS470R1A384_BANK2_SECTORS)/sizeof(TMS470R1A384_BANK2_SECTORS[0]))
132 /* ---------------------------------------------------------------------- */
134 static int tms470_read_part_info(struct flash_bank_s
*bank
)
136 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
137 target_t
*target
= bank
->target
;
138 uint32_t device_ident_reg
;
139 uint32_t silicon_version
;
140 uint32_t technology_family
;
142 uint32_t part_number
;
145 /* we shall not rely on the caller in this test, this function allocates memory,
146 thus and executing the code more than once may cause memory leak */
147 if (tms470_info
->device_ident_reg
)
150 /* read and parse the device identification register */
151 target_read_u32(target
, 0xFFFFFFF0, &device_ident_reg
);
153 LOG_INFO("device_ident_reg=0x%08x", device_ident_reg
);
155 if ((device_ident_reg
& 7) == 0)
157 LOG_WARNING("Cannot identify target as a TMS470 family.");
158 return ERROR_FLASH_OPERATION_FAILED
;
161 silicon_version
= (device_ident_reg
>> 12) & 0xF;
162 technology_family
= (device_ident_reg
>> 11) & 1;
163 rom_flash
= (device_ident_reg
>> 10) & 1;
164 part_number
= (device_ident_reg
>> 3) & 0x7f;
167 * If the part number is known, determine if the flash bank is valid
168 * based on the base address being within the known flash bank
169 * ranges. Then fixup/complete the remaining fields of the flash
175 part_name
= "TMS470R1A256";
177 if (bank
->base
>= 0x00040000)
179 LOG_ERROR("No %s flash bank contains base address 0x%08x.", part_name
, bank
->base
);
180 return ERROR_FLASH_OPERATION_FAILED
;
182 tms470_info
->ordinal
= 0;
183 bank
->base
= 0x00000000;
184 bank
->size
= 256 * 1024;
185 bank
->num_sectors
= TMS470R1A256_NUM_SECTORS
;
186 bank
->sectors
= malloc(sizeof(TMS470R1A256_SECTORS
));
189 return ERROR_FLASH_OPERATION_FAILED
;
191 (void)memcpy(bank
->sectors
, TMS470R1A256_SECTORS
, sizeof(TMS470R1A256_SECTORS
));
195 part_name
= "TMS470R1A288";
197 if (bank
->base
< 0x00008000)
199 tms470_info
->ordinal
= 0;
200 bank
->base
= 0x00000000;
201 bank
->size
= 32 * 1024;
202 bank
->num_sectors
= TMS470R1A288_BANK0_NUM_SECTORS
;
203 bank
->sectors
= malloc(sizeof(TMS470R1A288_BANK0_SECTORS
));
206 return ERROR_FLASH_OPERATION_FAILED
;
208 (void)memcpy(bank
->sectors
, TMS470R1A288_BANK0_SECTORS
, sizeof(TMS470R1A288_BANK0_SECTORS
));
210 else if ((bank
->base
>= 0x00040000) && (bank
->base
< 0x00080000))
212 tms470_info
->ordinal
= 1;
213 bank
->base
= 0x00040000;
214 bank
->size
= 256 * 1024;
215 bank
->num_sectors
= TMS470R1A288_BANK1_NUM_SECTORS
;
216 bank
->sectors
= malloc(sizeof(TMS470R1A288_BANK1_SECTORS
));
219 return ERROR_FLASH_OPERATION_FAILED
;
221 (void)memcpy(bank
->sectors
, TMS470R1A288_BANK1_SECTORS
, sizeof(TMS470R1A288_BANK1_SECTORS
));
225 LOG_ERROR("No %s flash bank contains base address 0x%08x.", part_name
, bank
->base
);
226 return ERROR_FLASH_OPERATION_FAILED
;
231 part_name
= "TMS470R1A384";
233 if (bank
->base
< 0x00020000)
235 tms470_info
->ordinal
= 0;
236 bank
->base
= 0x00000000;
237 bank
->size
= 128 * 1024;
238 bank
->num_sectors
= TMS470R1A384_BANK0_NUM_SECTORS
;
239 bank
->sectors
= malloc(sizeof(TMS470R1A384_BANK0_SECTORS
));
242 return ERROR_FLASH_OPERATION_FAILED
;
244 (void)memcpy(bank
->sectors
, TMS470R1A384_BANK0_SECTORS
, sizeof(TMS470R1A384_BANK0_SECTORS
));
246 else if ((bank
->base
>= 0x00020000) && (bank
->base
< 0x00040000))
248 tms470_info
->ordinal
= 1;
249 bank
->base
= 0x00020000;
250 bank
->size
= 128 * 1024;
251 bank
->num_sectors
= TMS470R1A384_BANK1_NUM_SECTORS
;
252 bank
->sectors
= malloc(sizeof(TMS470R1A384_BANK1_SECTORS
));
255 return ERROR_FLASH_OPERATION_FAILED
;
257 (void)memcpy(bank
->sectors
, TMS470R1A384_BANK1_SECTORS
, sizeof(TMS470R1A384_BANK1_SECTORS
));
259 else if ((bank
->base
>= 0x00040000) && (bank
->base
< 0x00060000))
261 tms470_info
->ordinal
= 2;
262 bank
->base
= 0x00040000;
263 bank
->size
= 128 * 1024;
264 bank
->num_sectors
= TMS470R1A384_BANK2_NUM_SECTORS
;
265 bank
->sectors
= malloc(sizeof(TMS470R1A384_BANK2_SECTORS
));
268 return ERROR_FLASH_OPERATION_FAILED
;
270 (void)memcpy(bank
->sectors
, TMS470R1A384_BANK2_SECTORS
, sizeof(TMS470R1A384_BANK2_SECTORS
));
274 LOG_ERROR("No %s flash bank contains base address 0x%08x.", part_name
, bank
->base
);
275 return ERROR_FLASH_OPERATION_FAILED
;
280 LOG_WARNING("Could not identify part 0x%02x as a member of the TMS470 family.", part_number
);
281 return ERROR_FLASH_OPERATION_FAILED
;
284 /* turn off memory selects */
285 target_write_u32(target
, 0xFFFFFFE4, 0x00000000);
286 target_write_u32(target
, 0xFFFFFFE0, 0x00000000);
288 bank
->chip_width
= 32;
289 bank
->bus_width
= 32;
291 LOG_INFO("Identified %s, ver=%d, core=%s, nvmem=%s.", part_name
, silicon_version
, (technology_family
? "1.8v" : "3.3v"), (rom_flash
? "rom" : "flash"));
293 tms470_info
->device_ident_reg
= device_ident_reg
;
294 tms470_info
->silicon_version
= silicon_version
;
295 tms470_info
->technology_family
= technology_family
;
296 tms470_info
->rom_flash
= rom_flash
;
297 tms470_info
->part_number
= part_number
;
298 tms470_info
->part_name
= part_name
;
301 * Disable reset on address access violation.
303 target_write_u32(target
, 0xFFFFFFE0, 0x00004007);
308 /* ---------------------------------------------------------------------- */
310 static uint32_t keysSet
= 0;
311 static uint32_t flashKeys
[4];
313 static int tms470_handle_flash_keyset_command(struct command_context_s
*cmd_ctx
, char *cmd
, char **args
, int argc
)
317 command_print(cmd_ctx
, "tms470 flash_keyset <key0> <key1> <key2> <key3>");
318 return ERROR_INVALID_ARGUMENTS
;
324 for (i
= 0; i
< 4; i
++)
326 int start
= (0 == strncmp(args
[i
], "0x", 2)) ? 2 : 0;
328 if (1 != sscanf(&args
[i
][start
], "%x", &flashKeys
[i
]))
330 command_print(cmd_ctx
, "could not process flash key %s", args
[i
]);
331 LOG_ERROR("could not process flash key %s", args
[i
]);
332 return ERROR_INVALID_ARGUMENTS
;
340 command_print(cmd_ctx
, "tms470 flash_keyset <key0> <key1> <key2> <key3>");
341 return ERROR_INVALID_ARGUMENTS
;
346 command_print(cmd_ctx
, "using flash keys 0x%08x, 0x%08x, 0x%08x, 0x%08x", flashKeys
[0], flashKeys
[1], flashKeys
[2], flashKeys
[3]);
350 command_print(cmd_ctx
, "flash keys not set");
356 static const uint32_t FLASH_KEYS_ALL_ONES
[] = { 0xFFFFFFFF, 0xFFFFFFFF,
357 0xFFFFFFFF, 0xFFFFFFFF,
360 static const uint32_t FLASH_KEYS_ALL_ZEROS
[] = { 0x00000000, 0x00000000,
361 0x00000000, 0x00000000,
364 static const uint32_t FLASH_KEYS_MIX1
[] = { 0xf0fff0ff, 0xf0fff0ff,
365 0xf0fff0ff, 0xf0fff0ff
368 static const uint32_t FLASH_KEYS_MIX2
[] = { 0x0000ffff, 0x0000ffff,
369 0x0000ffff, 0x0000ffff
372 /* ---------------------------------------------------------------------- */
374 static int oscMHz
= 12;
376 static int tms470_handle_osc_megahertz_command(struct command_context_s
*cmd_ctx
, char *cmd
, char **args
, int argc
)
380 command_print(cmd_ctx
, "tms470 osc_megahertz <MHz>");
381 return ERROR_INVALID_ARGUMENTS
;
385 sscanf(args
[0], "%d", &oscMHz
);
390 LOG_ERROR("osc_megahertz must be positive and non-zero!");
391 command_print(cmd_ctx
, "osc_megahertz must be positive and non-zero!");
393 return ERROR_INVALID_ARGUMENTS
;
396 command_print(cmd_ctx
, "osc_megahertz=%d", oscMHz
);
401 /* ---------------------------------------------------------------------- */
403 static int plldis
= 0;
405 static int tms470_handle_plldis_command(struct command_context_s
*cmd_ctx
, char *cmd
, char **args
, int argc
)
409 command_print(cmd_ctx
, "tms470 plldis <0|1>");
410 return ERROR_INVALID_ARGUMENTS
;
414 sscanf(args
[0], "%d", &plldis
);
415 plldis
= plldis
? 1 : 0;
418 command_print(cmd_ctx
, "plldis=%d", plldis
);
423 /* ---------------------------------------------------------------------- */
425 static int tms470_check_flash_unlocked(target_t
* target
)
429 target_read_u32(target
, 0xFFE89C08, &fmbbusy
);
430 LOG_INFO("tms470 fmbbusy=0x%08x -> %s", fmbbusy
, fmbbusy
& 0x8000 ? "unlocked" : "LOCKED");
431 return fmbbusy
& 0x8000 ? ERROR_OK
: ERROR_FLASH_OPERATION_FAILED
;
434 /* ---------------------------------------------------------------------- */
436 static int tms470_try_flash_keys(target_t
* target
, const uint32_t * key_set
)
438 uint32_t glbctrl
, fmmstat
;
439 int retval
= ERROR_FLASH_OPERATION_FAILED
;
442 target_read_u32(target
, 0xFFFFFFDC, &glbctrl
);
443 target_write_u32(target
, 0xFFFFFFDC, glbctrl
| 0x10);
445 /* only perform the key match when 3VSTAT is clear */
446 target_read_u32(target
, 0xFFE8BC0C, &fmmstat
);
447 if (!(fmmstat
& 0x08))
450 uint32_t fmbptr
, fmbac2
, orig_fmregopt
;
452 target_write_u32(target
, 0xFFE8BC04, fmmstat
& ~0x07);
454 /* wait for pump ready */
457 target_read_u32(target
, 0xFFE8A814, &fmbptr
);
460 while (!(fmbptr
& 0x0200));
462 /* force max wait states */
463 target_read_u32(target
, 0xFFE88004, &fmbac2
);
464 target_write_u32(target
, 0xFFE88004, fmbac2
| 0xff);
466 /* save current access mode, force normal read mode */
467 target_read_u32(target
, 0xFFE89C00, &orig_fmregopt
);
468 target_write_u32(target
, 0xFFE89C00, 0x00);
470 for (i
= 0; i
< 4; i
++)
474 /* There is no point displaying the value of tmp, it is
475 * filtered by the chip. The purpose of this read is to
476 * prime the unlocking logic rather than read out the value.
478 target_read_u32(target
, 0x00001FF0 + 4 * i
, &tmp
);
480 LOG_INFO("tms470 writing fmpkey=0x%08x", key_set
[i
]);
481 target_write_u32(target
, 0xFFE89C0C, key_set
[i
]);
484 if (ERROR_OK
== tms470_check_flash_unlocked(target
))
487 * There seems to be a side-effect of reading the FMPKEY
488 * register in that it re-enables the protection. So we
491 for (i
= 0; i
< 4; i
++)
495 target_read_u32(target
, 0x00001FF0 + 4 * i
, &tmp
);
496 target_write_u32(target
, 0xFFE89C0C, key_set
[i
]);
501 /* restore settings */
502 target_write_u32(target
, 0xFFE89C00, orig_fmregopt
);
503 target_write_u32(target
, 0xFFE88004, fmbac2
);
506 /* clear config bit */
507 target_write_u32(target
, 0xFFFFFFDC, glbctrl
);
512 /* ---------------------------------------------------------------------- */
514 static int tms470_unlock_flash(struct flash_bank_s
*bank
)
516 target_t
*target
= bank
->target
;
517 const uint32_t *p_key_sets
[5];
518 unsigned i
, key_set_count
;
523 p_key_sets
[0] = flashKeys
;
524 p_key_sets
[1] = FLASH_KEYS_ALL_ONES
;
525 p_key_sets
[2] = FLASH_KEYS_ALL_ZEROS
;
526 p_key_sets
[3] = FLASH_KEYS_MIX1
;
527 p_key_sets
[4] = FLASH_KEYS_MIX2
;
532 p_key_sets
[0] = FLASH_KEYS_ALL_ONES
;
533 p_key_sets
[1] = FLASH_KEYS_ALL_ZEROS
;
534 p_key_sets
[2] = FLASH_KEYS_MIX1
;
535 p_key_sets
[3] = FLASH_KEYS_MIX2
;
538 for (i
= 0; i
< key_set_count
; i
++)
540 if (tms470_try_flash_keys(target
, p_key_sets
[i
]) == ERROR_OK
)
542 LOG_INFO("tms470 flash is unlocked");
547 LOG_WARNING("tms470 could not unlock flash memory protection level 2");
548 return ERROR_FLASH_OPERATION_FAILED
;
551 /* ---------------------------------------------------------------------- */
553 static int tms470_flash_initialize_internal_state_machine(struct flash_bank_s
*bank
)
555 uint32_t fmmac2
, fmmac1
, fmmaxep
, k
, delay
, glbctrl
, sysclk
;
556 target_t
*target
= bank
->target
;
557 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
558 int result
= ERROR_OK
;
561 * Select the desired bank to be programmed by writing BANK[2:0] of
564 target_read_u32(target
, 0xFFE8BC04, &fmmac2
);
566 fmmac2
|= (tms470_info
->ordinal
& 7);
567 target_write_u32(target
, 0xFFE8BC04, fmmac2
);
568 LOG_DEBUG("set fmmac2=0x%04x", fmmac2
);
571 * Disable level 1 sector protection by setting bit 15 of FMMAC1.
573 target_read_u32(target
, 0xFFE8BC00, &fmmac1
);
575 target_write_u32(target
, 0xFFE8BC00, fmmac1
);
576 LOG_DEBUG("set fmmac1=0x%04x", fmmac1
);
581 target_write_u32(target
, 0xFFE8BC10, 0x2fc0);
582 LOG_DEBUG("set fmtcreg=0x2fc0");
587 target_write_u32(target
, 0xFFE8A07C, 50);
588 LOG_DEBUG("set fmmaxpp=50");
593 target_write_u32(target
, 0xFFE8A084, 0xf000 + 2000);
594 LOG_DEBUG("set fmmaxcp=0x%04x", 0xf000 + 2000);
599 target_read_u32(target
, 0xFFE8A080, &fmmaxep
);
600 if (fmmaxep
== 0xf000)
602 fmmaxep
= 0xf000 + 4095;
603 target_write_u32(target
, 0xFFE8A80C, 0x9964);
604 LOG_DEBUG("set fmptr3=0x9964");
608 fmmaxep
= 0xa000 + 4095;
609 target_write_u32(target
, 0xFFE8A80C, 0x9b64);
610 LOG_DEBUG("set fmptr3=0x9b64");
612 target_write_u32(target
, 0xFFE8A080, fmmaxep
);
613 LOG_DEBUG("set fmmaxep=0x%04x", fmmaxep
);
618 target_write_u32(target
, 0xFFE8A810, 0xa000);
619 LOG_DEBUG("set fmptr4=0xa000");
622 * FMPESETUP, delay parameter selected based on clock frequency.
624 * According to the TI App Note SPNU257 and flashing code, delay is
625 * int((sysclk(MHz) + 1) / 2), with a minimum of 5. The system
626 * clock is usually derived from the ZPLL module, and selected by
629 target_read_u32(target
, 0xFFFFFFDC, &glbctrl
);
630 sysclk
= (plldis
? 1 : (glbctrl
& 0x08) ? 4 : 8) * oscMHz
/ (1 + (glbctrl
& 7));
631 delay
= (sysclk
> 10) ? (sysclk
+ 1) / 2 : 5;
632 target_write_u32(target
, 0xFFE8A018, (delay
<< 4) | (delay
<< 8));
633 LOG_DEBUG("set fmpsetup=0x%04x", (delay
<< 4) | (delay
<< 8));
636 * FMPVEVACCESS, based on delay.
638 k
= delay
| (delay
<< 8);
639 target_write_u32(target
, 0xFFE8A05C, k
);
640 LOG_DEBUG("set fmpvevaccess=0x%04x", k
);
643 * FMPCHOLD, FMPVEVHOLD, FMPVEVSETUP, based on delay.
646 target_write_u32(target
, 0xFFE8A034, k
);
647 LOG_DEBUG("set fmpchold=0x%04x", k
);
648 target_write_u32(target
, 0xFFE8A040, k
);
649 LOG_DEBUG("set fmpvevhold=0x%04x", k
);
650 target_write_u32(target
, 0xFFE8A024, k
);
651 LOG_DEBUG("set fmpvevsetup=0x%04x", k
);
654 * FMCVACCESS, based on delay.
657 target_write_u32(target
, 0xFFE8A060, k
);
658 LOG_DEBUG("set fmcvaccess=0x%04x", k
);
661 * FMCSETUP, based on delay.
663 k
= 0x3000 | delay
* 20;
664 target_write_u32(target
, 0xFFE8A020, k
);
665 LOG_DEBUG("set fmcsetup=0x%04x", k
);
668 * FMEHOLD, based on delay.
670 k
= (delay
* 20) << 2;
671 target_write_u32(target
, 0xFFE8A038, k
);
672 LOG_DEBUG("set fmehold=0x%04x", k
);
675 * PWIDTH, CWIDTH, EWIDTH, based on delay.
677 target_write_u32(target
, 0xFFE8A050, delay
* 8);
678 LOG_DEBUG("set fmpwidth=0x%04x", delay
* 8);
679 target_write_u32(target
, 0xFFE8A058, delay
* 1000);
680 LOG_DEBUG("set fmcwidth=0x%04x", delay
* 1000);
681 target_write_u32(target
, 0xFFE8A054, delay
* 5400);
682 LOG_DEBUG("set fmewidth=0x%04x", delay
* 5400);
687 /* ---------------------------------------------------------------------- */
689 int tms470_flash_status(struct flash_bank_s
*bank
)
691 target_t
*target
= bank
->target
;
692 int result
= ERROR_OK
;
695 target_read_u32(target
, 0xFFE8BC0C, &fmmstat
);
696 LOG_DEBUG("set fmmstat=0x%04x", fmmstat
);
698 if (fmmstat
& 0x0080)
700 LOG_WARNING("tms470 flash command: erase still active after busy clear.");
701 result
= ERROR_FLASH_OPERATION_FAILED
;
704 if (fmmstat
& 0x0040)
706 LOG_WARNING("tms470 flash command: program still active after busy clear.");
707 result
= ERROR_FLASH_OPERATION_FAILED
;
710 if (fmmstat
& 0x0020)
712 LOG_WARNING("tms470 flash command: invalid data command.");
713 result
= ERROR_FLASH_OPERATION_FAILED
;
716 if (fmmstat
& 0x0010)
718 LOG_WARNING("tms470 flash command: program, erase or validate sector failed.");
719 result
= ERROR_FLASH_OPERATION_FAILED
;
722 if (fmmstat
& 0x0008)
724 LOG_WARNING("tms470 flash command: voltage instability detected.");
725 result
= ERROR_FLASH_OPERATION_FAILED
;
728 if (fmmstat
& 0x0006)
730 LOG_WARNING("tms470 flash command: command suspend detected.");
731 result
= ERROR_FLASH_OPERATION_FAILED
;
734 if (fmmstat
& 0x0001)
736 LOG_WARNING("tms470 flash command: sector was locked.");
737 result
= ERROR_FLASH_OPERATION_FAILED
;
743 /* ---------------------------------------------------------------------- */
745 static int tms470_erase_sector(struct flash_bank_s
*bank
, int sector
)
747 uint32_t glbctrl
, orig_fmregopt
, fmbsea
, fmbseb
, fmmstat
;
748 target_t
*target
= bank
->target
;
749 uint32_t flashAddr
= bank
->base
+ bank
->sectors
[sector
].offset
;
750 int result
= ERROR_OK
;
753 * Set the bit GLBCTRL4 of the GLBCTRL register (in the System
754 * module) to enable writing to the flash registers }.
756 target_read_u32(target
, 0xFFFFFFDC, &glbctrl
);
757 target_write_u32(target
, 0xFFFFFFDC, glbctrl
| 0x10);
758 LOG_DEBUG("set glbctrl=0x%08x", glbctrl
| 0x10);
760 /* Force normal read mode. */
761 target_read_u32(target
, 0xFFE89C00, &orig_fmregopt
);
762 target_write_u32(target
, 0xFFE89C00, 0);
763 LOG_DEBUG("set fmregopt=0x%08x", 0);
765 (void)tms470_flash_initialize_internal_state_machine(bank
);
768 * Select one or more bits in FMBSEA or FMBSEB to disable Level 1
769 * protection for the particular sector to be erased/written.
773 target_read_u32(target
, 0xFFE88008, &fmbsea
);
774 target_write_u32(target
, 0xFFE88008, fmbsea
| (1 << sector
));
775 LOG_DEBUG("set fmbsea=0x%04x", fmbsea
| (1 << sector
));
779 target_read_u32(target
, 0xFFE8800C, &fmbseb
);
780 target_write_u32(target
, 0xFFE8800C, fmbseb
| (1 << (sector
- 16)));
781 LOG_DEBUG("set fmbseb=0x%04x", fmbseb
| (1 << (sector
- 16)));
783 bank
->sectors
[sector
].is_protected
= 0;
786 * clear status regiser, sent erase command, kickoff erase
788 target_write_u16(target
, flashAddr
, 0x0040);
789 LOG_DEBUG("write *(uint16_t *)0x%08x=0x0040", flashAddr
);
790 target_write_u16(target
, flashAddr
, 0x0020);
791 LOG_DEBUG("write *(uint16_t *)0x%08x=0x0020", flashAddr
);
792 target_write_u16(target
, flashAddr
, 0xffff);
793 LOG_DEBUG("write *(uint16_t *)0x%08x=0xffff", flashAddr
);
796 * Monitor FMMSTAT, busy until clear, then check and other flags for
797 * ultimate result of the operation.
801 target_read_u32(target
, 0xFFE8BC0C, &fmmstat
);
802 if (fmmstat
& 0x0100)
807 while (fmmstat
& 0x0100);
809 result
= tms470_flash_status(bank
);
813 target_write_u32(target
, 0xFFE88008, fmbsea
);
814 LOG_DEBUG("set fmbsea=0x%04x", fmbsea
);
815 bank
->sectors
[sector
].is_protected
= fmbsea
& (1 << sector
) ? 0 : 1;
819 target_write_u32(target
, 0xFFE8800C, fmbseb
);
820 LOG_DEBUG("set fmbseb=0x%04x", fmbseb
);
821 bank
->sectors
[sector
].is_protected
= fmbseb
& (1 << (sector
- 16)) ? 0 : 1;
823 target_write_u32(target
, 0xFFE89C00, orig_fmregopt
);
824 LOG_DEBUG("set fmregopt=0x%08x", orig_fmregopt
);
825 target_write_u32(target
, 0xFFFFFFDC, glbctrl
);
826 LOG_DEBUG("set glbctrl=0x%08x", glbctrl
);
828 if (result
== ERROR_OK
)
830 bank
->sectors
[sector
].is_erased
= 1;
836 /* ----------------------------------------------------------------------
837 Implementation of Flash Driver Interfaces
838 ---------------------------------------------------------------------- */
840 static int tms470_register_commands(struct command_context_s
*cmd_ctx
)
842 command_t
*tms470_cmd
= register_command(cmd_ctx
, NULL
, "tms470", NULL
, COMMAND_ANY
, "applies to TI tms470 family");
844 register_command(cmd_ctx
, tms470_cmd
, "flash_keyset", tms470_handle_flash_keyset_command
, COMMAND_ANY
, "tms470 flash_keyset <key0> <key1> <key2> <key3>");
845 register_command(cmd_ctx
, tms470_cmd
, "osc_megahertz", tms470_handle_osc_megahertz_command
, COMMAND_ANY
, "tms470 osc_megahertz <MHz>");
846 register_command(cmd_ctx
, tms470_cmd
, "plldis", tms470_handle_plldis_command
, COMMAND_ANY
, "tms470 plldis <0/1>");
851 /* ---------------------------------------------------------------------- */
853 static int tms470_erase(struct flash_bank_s
*bank
, int first
, int last
)
855 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
856 int sector
, result
= ERROR_OK
;
858 if (bank
->target
->state
!= TARGET_HALTED
)
860 LOG_ERROR("Target not halted");
861 return ERROR_TARGET_NOT_HALTED
;
864 tms470_read_part_info(bank
);
866 if ((first
< 0) || (first
>= bank
->num_sectors
) || (last
< 0) || (last
>= bank
->num_sectors
) || (first
> last
))
868 LOG_ERROR("Sector range %d to %d invalid.", first
, last
);
869 return ERROR_FLASH_SECTOR_INVALID
;
872 result
= tms470_unlock_flash(bank
);
873 if (result
!= ERROR_OK
)
878 for (sector
= first
; sector
<= last
; sector
++)
880 LOG_INFO("Erasing tms470 bank %d sector %d...", tms470_info
->ordinal
, sector
);
882 result
= tms470_erase_sector(bank
, sector
);
884 if (result
!= ERROR_OK
)
886 LOG_ERROR("tms470 could not erase flash sector.");
891 LOG_INFO("sector erased successfully.");
898 /* ---------------------------------------------------------------------- */
900 static int tms470_protect(struct flash_bank_s
*bank
, int set
, int first
, int last
)
902 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
903 target_t
*target
= bank
->target
;
904 uint32_t fmmac2
, fmbsea
, fmbseb
;
907 if (target
->state
!= TARGET_HALTED
)
909 LOG_ERROR("Target not halted");
910 return ERROR_TARGET_NOT_HALTED
;
913 tms470_read_part_info(bank
);
915 if ((first
< 0) || (first
>= bank
->num_sectors
) || (last
< 0) || (last
>= bank
->num_sectors
) || (first
> last
))
917 LOG_ERROR("Sector range %d to %d invalid.", first
, last
);
918 return ERROR_FLASH_SECTOR_INVALID
;
921 /* enable the appropriate bank */
922 target_read_u32(target
, 0xFFE8BC04, &fmmac2
);
923 target_write_u32(target
, 0xFFE8BC04, (fmmac2
& ~7) | tms470_info
->ordinal
);
925 /* get the original sector proection flags for this bank */
926 target_read_u32(target
, 0xFFE88008, &fmbsea
);
927 target_read_u32(target
, 0xFFE8800C, &fmbseb
);
929 for (sector
= 0; sector
< bank
->num_sectors
; sector
++)
933 fmbsea
= set
? fmbsea
& ~(1 << sector
) : fmbsea
| (1 << sector
);
934 bank
->sectors
[sector
].is_protected
= set
? 1 : 0;
938 fmbseb
= set
? fmbseb
& ~(1 << (sector
- 16)) : fmbseb
| (1 << (sector
- 16));
939 bank
->sectors
[sector
].is_protected
= set
? 1 : 0;
943 /* update the protection bits */
944 target_write_u32(target
, 0xFFE88008, fmbsea
);
945 target_write_u32(target
, 0xFFE8800C, fmbseb
);
950 /* ---------------------------------------------------------------------- */
952 static int tms470_write(struct flash_bank_s
*bank
, uint8_t * buffer
, uint32_t offset
, uint32_t count
)
954 target_t
*target
= bank
->target
;
955 uint32_t glbctrl
, fmbac2
, orig_fmregopt
, fmbsea
, fmbseb
, fmmaxpp
, fmmstat
;
956 int result
= ERROR_OK
;
959 if (target
->state
!= TARGET_HALTED
)
961 LOG_ERROR("Target not halted");
962 return ERROR_TARGET_NOT_HALTED
;
965 tms470_read_part_info(bank
);
967 LOG_INFO("Writing %d bytes starting at 0x%08x", count
, bank
->base
+ offset
);
970 target_read_u32(target
, 0xFFFFFFDC, &glbctrl
);
971 target_write_u32(target
, 0xFFFFFFDC, glbctrl
| 0x10);
973 (void)tms470_flash_initialize_internal_state_machine(bank
);
975 /* force max wait states */
976 target_read_u32(target
, 0xFFE88004, &fmbac2
);
977 target_write_u32(target
, 0xFFE88004, fmbac2
| 0xff);
979 /* save current access mode, force normal read mode */
980 target_read_u32(target
, 0xFFE89C00, &orig_fmregopt
);
981 target_write_u32(target
, 0xFFE89C00, 0x00);
984 * Disable Level 1 protection for all sectors to be erased/written.
986 target_read_u32(target
, 0xFFE88008, &fmbsea
);
987 target_write_u32(target
, 0xFFE88008, 0xffff);
988 target_read_u32(target
, 0xFFE8800C, &fmbseb
);
989 target_write_u32(target
, 0xFFE8800C, 0xffff);
992 target_read_u32(target
, 0xFFE8A07C, &fmmaxpp
);
994 for (i
= 0; i
< count
; i
+= 2)
996 uint32_t addr
= bank
->base
+ offset
+ i
;
997 uint16_t word
= (((uint16_t) buffer
[i
]) << 8) | (uint16_t) buffer
[i
+ 1];
1001 LOG_INFO("writing 0x%04x at 0x%08x", word
, addr
);
1003 /* clear status register */
1004 target_write_u16(target
, addr
, 0x0040);
1005 /* program flash command */
1006 target_write_u16(target
, addr
, 0x0010);
1007 /* burn the 16-bit word (big-endian) */
1008 target_write_u16(target
, addr
, word
);
1011 * Monitor FMMSTAT, busy until clear, then check and other flags
1012 * for ultimate result of the operation.
1016 target_read_u32(target
, 0xFFE8BC0C, &fmmstat
);
1017 if (fmmstat
& 0x0100)
1022 while (fmmstat
& 0x0100);
1024 if (fmmstat
& 0x3ff)
1026 LOG_ERROR("fmstat=0x%04x", fmmstat
);
1027 LOG_ERROR("Could not program word 0x%04x at address 0x%08x.", word
, addr
);
1028 result
= ERROR_FLASH_OPERATION_FAILED
;
1034 LOG_INFO("skipping 0xffff at 0x%08x", addr
);
1039 target_write_u32(target
, 0xFFE88008, fmbsea
);
1040 target_write_u32(target
, 0xFFE8800C, fmbseb
);
1041 target_write_u32(target
, 0xFFE88004, fmbac2
);
1042 target_write_u32(target
, 0xFFE89C00, orig_fmregopt
);
1043 target_write_u32(target
, 0xFFFFFFDC, glbctrl
);
1048 /* ---------------------------------------------------------------------- */
1050 static int tms470_probe(struct flash_bank_s
*bank
)
1052 if (bank
->target
->state
!= TARGET_HALTED
)
1054 LOG_WARNING("Cannot communicate... target not halted.");
1055 return ERROR_TARGET_NOT_HALTED
;
1058 return tms470_read_part_info(bank
);
1061 static int tms470_auto_probe(struct flash_bank_s
*bank
)
1063 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
1065 if (tms470_info
->device_ident_reg
)
1067 return tms470_probe(bank
);
1070 /* ---------------------------------------------------------------------- */
1072 static int tms470_erase_check(struct flash_bank_s
*bank
)
1074 target_t
*target
= bank
->target
;
1075 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
1076 int sector
, result
= ERROR_OK
;
1077 uint32_t fmmac2
, fmbac2
, glbctrl
, orig_fmregopt
;
1078 static uint8_t buffer
[64 * 1024];
1080 if (target
->state
!= TARGET_HALTED
)
1082 LOG_ERROR("Target not halted");
1083 return ERROR_TARGET_NOT_HALTED
;
1086 if (!tms470_info
->device_ident_reg
)
1088 tms470_read_part_info(bank
);
1092 target_read_u32(target
, 0xFFFFFFDC, &glbctrl
);
1093 target_write_u32(target
, 0xFFFFFFDC, glbctrl
| 0x10);
1095 /* save current access mode, force normal read mode */
1096 target_read_u32(target
, 0xFFE89C00, &orig_fmregopt
);
1097 target_write_u32(target
, 0xFFE89C00, 0x00);
1099 /* enable the appropriate bank */
1100 target_read_u32(target
, 0xFFE8BC04, &fmmac2
);
1101 target_write_u32(target
, 0xFFE8BC04, (fmmac2
& ~7) | tms470_info
->ordinal
);
1104 target_write_u32(target
, 0xFFE8BC10, 0x2fc0);
1106 /* clear TEZ in fmbrdy */
1107 target_write_u32(target
, 0xFFE88010, 0x0b);
1109 /* save current wait states, force max */
1110 target_read_u32(target
, 0xFFE88004, &fmbac2
);
1111 target_write_u32(target
, 0xFFE88004, fmbac2
| 0xff);
1114 * The TI primitives inspect the flash memory by reading one 32-bit
1115 * word at a time. Here we read an entire sector and inspect it in
1116 * an attempt to reduce the JTAG overhead.
1118 for (sector
= 0; sector
< bank
->num_sectors
; sector
++)
1120 if (bank
->sectors
[sector
].is_erased
!= 1)
1122 uint32_t i
, addr
= bank
->base
+ bank
->sectors
[sector
].offset
;
1124 LOG_INFO("checking flash bank %d sector %d", tms470_info
->ordinal
, sector
);
1126 target_read_buffer(target
, addr
, bank
->sectors
[sector
].size
, buffer
);
1128 bank
->sectors
[sector
].is_erased
= 1;
1129 for (i
= 0; i
< bank
->sectors
[sector
].size
; i
++)
1131 if (buffer
[i
] != 0xff)
1133 LOG_WARNING("tms470 bank %d, sector %d, not erased.", tms470_info
->ordinal
, sector
);
1134 LOG_WARNING("at location 0x%08x: flash data is 0x%02x.", addr
+ i
, buffer
[i
]);
1136 bank
->sectors
[sector
].is_erased
= 0;
1141 if (bank
->sectors
[sector
].is_erased
!= 1)
1143 result
= ERROR_FLASH_SECTOR_NOT_ERASED
;
1148 LOG_INFO("sector erased");
1152 /* reset TEZ, wait states, read mode, GLBCTRL.4 */
1153 target_write_u32(target
, 0xFFE88010, 0x0f);
1154 target_write_u32(target
, 0xFFE88004, fmbac2
);
1155 target_write_u32(target
, 0xFFE89C00, orig_fmregopt
);
1156 target_write_u32(target
, 0xFFFFFFDC, glbctrl
);
1161 /* ---------------------------------------------------------------------- */
1163 static int tms470_protect_check(struct flash_bank_s
*bank
)
1165 target_t
*target
= bank
->target
;
1166 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
1167 int sector
, result
= ERROR_OK
;
1168 uint32_t fmmac2
, fmbsea
, fmbseb
;
1170 if (target
->state
!= TARGET_HALTED
)
1172 LOG_ERROR("Target not halted");
1173 return ERROR_TARGET_NOT_HALTED
;
1176 if (!tms470_info
->device_ident_reg
)
1178 tms470_read_part_info(bank
);
1181 /* enable the appropriate bank */
1182 target_read_u32(target
, 0xFFE8BC04, &fmmac2
);
1183 target_write_u32(target
, 0xFFE8BC04, (fmmac2
& ~7) | tms470_info
->ordinal
);
1185 target_read_u32(target
, 0xFFE88008, &fmbsea
);
1186 target_read_u32(target
, 0xFFE8800C, &fmbseb
);
1188 for (sector
= 0; sector
< bank
->num_sectors
; sector
++)
1194 protected = fmbsea
& (1 << sector
) ? 0 : 1;
1195 bank
->sectors
[sector
].is_protected
= protected;
1199 protected = fmbseb
& (1 << (sector
- 16)) ? 0 : 1;
1200 bank
->sectors
[sector
].is_protected
= protected;
1203 LOG_DEBUG("bank %d sector %d is %s", tms470_info
->ordinal
, sector
, protected ? "protected" : "not protected");
1209 /* ---------------------------------------------------------------------- */
1211 static int tms470_info(struct flash_bank_s
*bank
, char *buf
, int buf_size
)
1214 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
1216 if (!tms470_info
->device_ident_reg
)
1218 tms470_read_part_info(bank
);
1221 if (!tms470_info
->device_ident_reg
)
1223 (void)snprintf(buf
, buf_size
, "Cannot identify target as a TMS470\n");
1224 return ERROR_FLASH_OPERATION_FAILED
;
1227 used
+= snprintf(buf
, buf_size
, "\ntms470 information: Chip is %s\n", tms470_info
->part_name
);
1231 used
+= snprintf(buf
, buf_size
, "Flash protection level 2 is %s\n", tms470_check_flash_unlocked(bank
->target
) == ERROR_OK
? "disabled" : "enabled");
1238 /* ---------------------------------------------------------------------- */
1241 * flash bank tms470 <base> <size> <chip_width> <bus_width> <target>
1245 static int tms470_flash_bank_command(struct command_context_s
*cmd_ctx
, char *cmd
, char **args
, int argc
, struct flash_bank_s
*bank
)
1247 bank
->driver_priv
= malloc(sizeof(tms470_flash_bank_t
));
1249 if (!bank
->driver_priv
)
1251 return ERROR_FLASH_OPERATION_FAILED
;
1254 (void)memset(bank
->driver_priv
, 0, sizeof(tms470_flash_bank_t
));
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)