Code Review / openocd.git / blob
? search:


c3f3e8ccddd4534b5f23430cc790aba5aa1c2f08
[openocd.git] / src / flash / tms470.c
1 /***************************************************************************
2 * (c) Copyright 2007, 2008 by Christopher Kilgour *
3 * techie |_at_| whiterocker |_dot_| com *
4 * *
5 * This program is free software; you can redistribute it and/or modify *
6 * it under the terms of the GNU General Public License as published by *
7 * the Free Software Foundation; either version 2 of the License, or *
8 * (at your option) any later version. *
9 * *
10 * This program is distributed in the hope that it will be useful, *
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
13 * GNU General Public License for more details. *
14 * *
15 * You should have received a copy of the GNU General Public License *
16 * along with this program; if not, write to the *
17 * Free Software Foundation, Inc., *
18 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
19 ***************************************************************************/
20
21 #ifdef HAVE_CONFIG_H
22 #include "config.h"
23 #endif
24
25 #include "log.h"
26 #include "tms470.h"
27 #include <string.h>
28 #include <unistd.h>
29
30 int
31 tms470_register_commands( struct command_context_s *cmd_ctx );
32
33 int
34 tms470_flash_bank_command( struct command_context_s *cmd_ctx,
35 char *cmd,
36 char **args,
37 int argc,
38 struct flash_bank_s *bank );
39
40 int
41 tms470_erase( struct flash_bank_s *bank,
42 int first,
43 int last );
44
45 int
46 tms470_protect( struct flash_bank_s *bank,
47 int set,
48 int first,
49 int last );
50
51 int
52 tms470_write( struct flash_bank_s *bank,
53 u8 *buffer,
54 u32 offset,
55 u32 count );
56
57 int
58 tms470_probe( struct flash_bank_s *bank );
59
60 int
61 tms470_auto_probe( struct flash_bank_s *bank );
62
63 int
64 tms470_erase_check( struct flash_bank_s *bank );
65
66 int
67 tms470_protect_check( struct flash_bank_s *bank );
68
69 int
70 tms470_info( struct flash_bank_s *bank,
71 char *buf,
72 int buf_size );
73
74 flash_driver_t tms470_flash =
75 {
76 .name = "tms470",
77 .register_commands = tms470_register_commands,
78 .flash_bank_command = tms470_flash_bank_command,
79 .erase = tms470_erase,
80 .protect = tms470_protect,
81 .write = tms470_write,
82 .probe = tms470_probe,
83 .auto_probe = tms470_auto_probe,
84 .erase_check = tms470_erase_check,
85 .protect_check = tms470_protect_check,
86 .info = tms470_info
87 };
88
89 /* ----------------------------------------------------------------------
90 Internal Support, Helpers
91 ---------------------------------------------------------------------- */
92
93 const flash_sector_t TMS470R1A256_SECTORS[] =
94 {
95 { 0x00000000, 0x00002000, -1, -1 },
96 { 0x00002000, 0x00002000, -1, -1 },
97 { 0x00004000, 0x00002000, -1, -1 },
98 { 0x00006000, 0x00002000, -1, -1 },
99 { 0x00008000, 0x00008000, -1, -1 },
100 { 0x00010000, 0x00008000, -1, -1 },
101 { 0x00018000, 0x00008000, -1, -1 },
102 { 0x00020000, 0x00008000, -1, -1 },
103 { 0x00028000, 0x00008000, -1, -1 },
104 { 0x00030000, 0x00008000, -1, -1 },
105 { 0x00038000, 0x00002000, -1, -1 },
106 { 0x0003A000, 0x00002000, -1, -1 },
107 { 0x0003C000, 0x00002000, -1, -1 },
108 { 0x0003E000, 0x00002000, -1, -1 },
109 };
110
111 #define TMS470R1A256_NUM_SECTORS \
112 (sizeof(TMS470R1A256_SECTORS)/sizeof(TMS470R1A256_SECTORS[0]))
113
114 const flash_sector_t TMS470R1A288_BANK0_SECTORS[] =
115 {
116 { 0x00000000, 0x00002000, -1, -1 },
117 { 0x00002000, 0x00002000, -1, -1 },
118 { 0x00004000, 0x00002000, -1, -1 },
119 { 0x00006000, 0x00002000, -1, -1 },
120 };
121
122 #define TMS470R1A288_BANK0_NUM_SECTORS \
123 (sizeof(TMS470R1A288_BANK0_SECTORS)/sizeof(TMS470R1A288_BANK0_SECTORS[0]))
124
125 const flash_sector_t TMS470R1A288_BANK1_SECTORS[] =
126 {
127 { 0x00040000, 0x00010000, -1, -1 },
128 { 0x00050000, 0x00010000, -1, -1 },
129 { 0x00060000, 0x00010000, -1, -1 },
130 { 0x00070000, 0x00010000, -1, -1 },
131 };
132
133 #define TMS470R1A288_BANK1_NUM_SECTORS \
134 (sizeof(TMS470R1A288_BANK1_SECTORS)/sizeof(TMS470R1A288_BANK1_SECTORS[0]))
135
136 /* ---------------------------------------------------------------------- */
137
138 int
139 tms470_read_part_info( struct flash_bank_s *bank )
140 {
141 tms470_flash_bank_t *tms470_info = bank->driver_priv;
142 target_t *target = bank->target;
143 u32 device_ident_reg;
144 u32 silicon_version;
145 u32 technology_family;
146 u32 rom_flash;
147 u32 part_number;
148 char * part_name;
149
150 if (target->state != TARGET_HALTED)
151 {
152 WARNING( "Cannot communicate... target not halted." );
153 return ERROR_TARGET_NOT_HALTED;
154 }
155
156 /* read and parse the device identification register */
157 target_read_u32( target, 0xFFFFFFF0, &device_ident_reg );
158
159 INFO( "device_ident_reg=0x%08x", device_ident_reg );
160
161 if ((device_ident_reg & 7) == 0)
162 {
163 WARNING( "Cannot identify target as a TMS470 family." );
164 return ERROR_FLASH_OPERATION_FAILED;
165 }
166
167 silicon_version = (device_ident_reg >> 12) & 0xF;
168 technology_family = (device_ident_reg >> 11) & 1;
169 rom_flash = (device_ident_reg >> 10) & 1;
170 part_number = (device_ident_reg >> 3) & 0x7f;
171
172 /*
173 * If the part number is known, determine if the flash bank is valid
174 * based on the base address being within the known flash bank
175 * ranges. Then fixup/complete the remaining fields of the flash
176 * bank structure.
177 */
178 switch( part_number )
179 {
180 case 0x0a:
181 part_name = "TMS470R1A256";
182
183 if (bank->base >= 0x00040000)
184 {
185 ERROR( "No %s flash bank contains base address 0x%08x.",
186 part_name, bank->base );
187 return ERROR_FLASH_OPERATION_FAILED;
188 }
189 tms470_info->ordinal = 0;
190 bank->base = 0x00000000;
191 bank->size = 256*1024;
192 bank->num_sectors = TMS470R1A256_NUM_SECTORS;
193 bank->sectors = malloc( sizeof( TMS470R1A256_SECTORS ) );
194 if (!bank->sectors)
195 {
196 return ERROR_FLASH_OPERATION_FAILED;
197 }
198 (void) memcpy( bank->sectors,
199 TMS470R1A256_SECTORS,
200 sizeof( TMS470R1A256_SECTORS ) );
201 break;
202
203 case 0x2b:
204 part_name = "TMS470R1A288";
205
206 if ((bank->base >= 0x00000000) && (bank->base < 0x00008000))
207 {
208 tms470_info->ordinal = 0;
209 bank->base = 0x00000000;
210 bank->size = 32*1024;
211 bank->num_sectors = TMS470R1A288_BANK0_NUM_SECTORS;
212 bank->sectors = malloc( sizeof( TMS470R1A288_BANK0_SECTORS ) );
213 if (!bank->sectors)
214 {
215 return ERROR_FLASH_OPERATION_FAILED;
216 }
217 (void) memcpy( bank->sectors,
218 TMS470R1A288_BANK0_SECTORS,
219 sizeof( TMS470R1A288_BANK0_SECTORS ) );
220 }
221 else if ((bank->base >= 0x00040000) && (bank->base < 0x00080000))
222 {
223 tms470_info->ordinal = 1;
224 bank->base = 0x00040000;
225 bank->size = 256*1024;
226 bank->num_sectors = TMS470R1A288_BANK1_NUM_SECTORS;
227 bank->sectors = malloc( sizeof( TMS470R1A288_BANK1_SECTORS ) );
228 if (!bank->sectors)
229 {
230 return ERROR_FLASH_OPERATION_FAILED;
231 }
232 (void) memcpy( bank->sectors,
233 TMS470R1A288_BANK1_SECTORS,
234 sizeof( TMS470R1A288_BANK1_SECTORS ) );
235 }
236 else
237 {
238 ERROR( "No %s flash bank contains base address 0x%08x.",
239 part_name, bank->base );
240 return ERROR_FLASH_OPERATION_FAILED;
241 }
242 break;
243
244 default:
245 WARNING( "Could not identify part 0x%02x as a member of the TMS470 family.",
246 part_number );
247 return ERROR_FLASH_OPERATION_FAILED;
248 }
249
250 /* turn off memory selects */
251 target_write_u32( target, 0xFFFFFFE4, 0x00000000 );
252 target_write_u32( target, 0xFFFFFFE0, 0x00000000 );
253
254 bank->chip_width = 32;
255 bank->bus_width = 32;
256
257 INFO( "Identified %s, ver=%d, core=%s, nvmem=%s.",
258 part_name,
259 silicon_version,
260 (technology_family ? "1.8v" : "3.3v"),
261 (rom_flash ? "rom" : "flash") );
262
263 tms470_info->device_ident_reg = device_ident_reg;
264 tms470_info->silicon_version = silicon_version;
265 tms470_info->technology_family = technology_family;
266 tms470_info->rom_flash = rom_flash;
267 tms470_info->part_number = part_number;
268 tms470_info->part_name = part_name;
269
270 /*
271 * Disable reset on address access violation.
272 */
273 target_write_u32( target, 0xFFFFFFE0, 0x00004007 );
274
275 return ERROR_OK;
276 }
277
278 /* ---------------------------------------------------------------------- */
279
280 u32 keysSet = 0;
281 u32 flashKeys[4];
282
283 int
284 tms470_handle_flash_keyset_command( struct command_context_s * cmd_ctx,
285 char * cmd,
286 char ** args,
287 int argc )
288 {
289 if (argc > 4)
290 {
291 command_print( cmd_ctx, "tms470 flash_keyset <key0> <key1> <key2> <key3>" );
292 return ERROR_INVALID_ARGUMENTS;
293 }
294 else if (argc == 4)
295 {
296 int i;
297
298 for( i=0; i<4; i++ )
299 {
300 int start = (0 == strncmp( args[i], "0x", 2 )) ? 2 : 0;
301 if (1 != sscanf( &args[i][start], "%x", &flashKeys[i] ))
302 {
303 command_print( cmd_ctx, "could not process flash key %s", args[i] );
304 ERROR( "could not process flash key %s", args[i] );
305 return ERROR_INVALID_ARGUMENTS;
306 }
307 }
308
309 keysSet = 1;
310 }
311 else if (argc != 0)
312 {
313 command_print( cmd_ctx, "tms470 flash_keyset <key0> <key1> <key2> <key3>" );
314 return ERROR_INVALID_ARGUMENTS;
315 }
316
317 if (keysSet)
318 {
319 command_print( cmd_ctx, "using flash keys 0x%08x, 0x%08x, 0x%08x, 0x%08x",
320 flashKeys[0], flashKeys[1], flashKeys[2], flashKeys[3] );
321 }
322 else
323 {
324 command_print( cmd_ctx, "flash keys not set" );
325 }
326
327 return ERROR_OK;
328 }
329
330 const u32 FLASH_KEYS_ALL_ONES[] = { 0xFFFFFFFF, 0xFFFFFFFF,
331 0xFFFFFFFF, 0xFFFFFFFF, };
332
333 const u32 FLASH_KEYS_ALL_ZEROS[] = { 0x00000000, 0x00000000,
334 0x00000000, 0x00000000, };
335
336 const u32 FLASH_KEYS_MIX1[] = { 0xf0fff0ff, 0xf0fff0ff,
337 0xf0fff0ff, 0xf0fff0ff };
338
339 const u32 FLASH_KEYS_MIX2[] = { 0x0000ffff, 0x0000ffff,
340 0x0000ffff, 0x0000ffff };
341
342 /* ---------------------------------------------------------------------- */
343
344 int oscMHz = 12;
345
346 int
347 tms470_handle_osc_megahertz_command( struct command_context_s * cmd_ctx,
348 char * cmd,
349 char ** args,
350 int argc )
351 {
352 if (argc > 1)
353 {
354 command_print( cmd_ctx, "tms470 osc_megahertz <MHz>" );
355 return ERROR_INVALID_ARGUMENTS;
356 }
357 else if (argc == 1)
358 {
359 sscanf( args[0], "%d", &oscMHz );
360 }
361
362 if (oscMHz <= 0)
363 {
364 ERROR( "osc_megahertz must be positive and non-zero!" );
365 command_print( cmd_ctx, "osc_megahertz must be positive and non-zero!" );
366 oscMHz = 12;
367 return ERROR_INVALID_ARGUMENTS;
368 }
369
370 command_print( cmd_ctx, "osc_megahertz=%d", oscMHz );
371
372 return ERROR_OK;
373 }
374
375 /* ---------------------------------------------------------------------- */
376
377 int plldis = 0;
378
379 int
380 tms470_handle_plldis_command( struct command_context_s * cmd_ctx,
381 char * cmd,
382 char ** args,
383 int argc )
384 {
385 if (argc > 1)
386 {
387 command_print( cmd_ctx, "tms470 plldis <0|1>" );
388 return ERROR_INVALID_ARGUMENTS;
389 }
390 else if (argc == 1)
391 {
392 sscanf( args[0], "%d", &plldis );
393 plldis = plldis ? 1 : 0;
394 }
395
396 command_print( cmd_ctx, "plldis=%d", plldis );
397
398 return ERROR_OK;
399 }
400
401 /* ---------------------------------------------------------------------- */
402
403 int
404 tms470_check_flash_unlocked( target_t * target )
405 {
406 u32 fmbbusy;
407
408 target_read_u32( target, 0xFFE89C08, &fmbbusy );
409 INFO( "tms470 fmbbusy=0x%08x -> %s",
410 fmbbusy,
411 fmbbusy & 0x8000 ? "unlocked" : "LOCKED" );
412 return fmbbusy & 0x8000 ? ERROR_OK : ERROR_FLASH_OPERATION_FAILED;
413 }
414
415 /* ---------------------------------------------------------------------- */
416
417 int
418 tms470_try_flash_keys( target_t * target,
419 const u32 * key_set )
420 {
421 u32 glbctrl, fmmstat;
422 int retval = ERROR_FLASH_OPERATION_FAILED;
423
424 /* set GLBCTRL.4 */
425 target_read_u32( target, 0xFFFFFFDC, &glbctrl );
426 target_write_u32( target, 0xFFFFFFDC, glbctrl | 0x10 );
427
428 /* only perform the key match when 3VSTAT is clear */
429 target_read_u32( target, 0xFFE8BC0C, &fmmstat );
430 if (!(fmmstat & 0x08))
431 {
432 unsigned i;
433 u32 fmbptr, fmbac2, orig_fmregopt;
434
435 target_write_u32( target, 0xFFE8BC04, fmmstat & ~0x07 );
436
437 /* wait for pump ready */
438 do
439 {
440 target_read_u32( target, 0xFFE8A814, &fmbptr );
441 usleep( 1000 );
442 }
443 while( !(fmbptr & 0x0200) );
444
445 /* force max wait states */
446 target_read_u32( target, 0xFFE88004, &fmbac2 );
447 target_write_u32( target, 0xFFE88004, fmbac2 | 0xff );
448
449 /* save current access mode, force normal read mode */
450 target_read_u32( target, 0xFFE89C00, &orig_fmregopt );
451 target_write_u32( target, 0xFFE89C00, 0x00 );
452
453 for( i=0; i<4; i++ )
454 {
455 u32 tmp;
456
457 /* There is no point displaying the value of tmp, it is
458 * filtered by the chip. The purpose of this read is to
459 * prime the unlocking logic rather than read out the value.
460 */
461 target_read_u32( target, 0x00001FF0+4*i, &tmp );
462
463 INFO( "tms470 writing fmpkey=0x%08x", key_set[i] );
464 target_write_u32( target, 0xFFE89C0C, key_set[i] );
465 }
466
467 if (ERROR_OK == tms470_check_flash_unlocked( target ))
468 {
469 /*
470 * There seems to be a side-effect of reading the FMPKEY
471 * register in that it re-enables the protection. So we
472 * re-enable it.
473 */
474 for( i=0; i<4; i++ )
475 {
476 u32 tmp;
477 target_read_u32( target, 0x00001FF0+4*i, &tmp );
478 target_write_u32( target, 0xFFE89C0C, key_set[i] );
479 }
480 retval = ERROR_OK;
481 }
482
483 /* restore settings */
484 target_write_u32( target, 0xFFE89C00, orig_fmregopt );
485 target_write_u32( target, 0xFFE88004, fmbac2 );
486 }
487
488 /* clear config bit */
489 target_write_u32( target, 0xFFFFFFDC, glbctrl );
490
491 return retval;
492 }
493
494 /* ---------------------------------------------------------------------- */
495
496 int
497 tms470_unlock_flash( struct flash_bank_s * bank )
498 {
499 target_t * target = bank->target;
500 const u32 * p_key_sets[5];
501 unsigned i, key_set_count;
502
503 if (keysSet)
504 {
505 p_key_sets[0] = flashKeys;
506 p_key_sets[1] = FLASH_KEYS_ALL_ONES;
507 p_key_sets[2] = FLASH_KEYS_ALL_ZEROS;
508 p_key_sets[3] = FLASH_KEYS_MIX1;
509 p_key_sets[4] = FLASH_KEYS_MIX2;
510 }
511 else
512 {
513 key_set_count = 4;
514 p_key_sets[0] = FLASH_KEYS_ALL_ONES;
515 p_key_sets[1] = FLASH_KEYS_ALL_ZEROS;
516 p_key_sets[2] = FLASH_KEYS_MIX1;
517 p_key_sets[3] = FLASH_KEYS_MIX2;
518 }
519
520 for( i=0; i<key_set_count; i++ )
521 {
522 if (tms470_try_flash_keys( target, p_key_sets[i] ) == ERROR_OK)
523 {
524 INFO( "tms470 flash is unlocked" );
525 return ERROR_OK;
526 }
527 }
528
529 WARNING( "tms470 could not unlock flash memory protection level 2" );
530 return ERROR_FLASH_OPERATION_FAILED;
531 }
532
533 /* ---------------------------------------------------------------------- */
534
535 int
536 tms470_flash_initialize_internal_state_machine( struct flash_bank_s * bank )
537 {
538 u32 fmmac2, fmmac1, fmmaxep, k, delay, glbctrl, sysclk;
539 target_t *target = bank->target;
540 tms470_flash_bank_t * tms470_info = bank->driver_priv;
541 int result = ERROR_OK;
542
543 /*
544 * Select the desired bank to be programmed by writing BANK[2:0] of
545 * FMMAC2.
546 */
547 target_read_u32( target, 0xFFE8BC04, &fmmac2 );
548 fmmac2 &= ~0x0007;
549 fmmac2 |= (tms470_info->ordinal & 7);
550 target_write_u32( target, 0xFFE8BC04, fmmac2 );
551 DEBUG( "set fmmac2=0x%04x", fmmac2 );
552
553 /*
554 * Disable level 1 sector protection by setting bit 15 of FMMAC1.
555 */
556 target_read_u32( target, 0xFFE8BC00, &fmmac1 );
557 fmmac1 |= 0x8000;
558 target_write_u32( target, 0xFFE8BC00, fmmac1 );
559 DEBUG( "set fmmac1=0x%04x", fmmac1 );
560
561 /*
562 * FMTCREG=0x2fc0;
563 */
564 target_write_u32( target, 0xFFE8BC10, 0x2fc0 );
565 DEBUG( "set fmtcreg=0x2fc0" );
566
567 /*
568 * MAXPP=50
569 */
570 target_write_u32( target, 0xFFE8A07C, 50 );
571 DEBUG( "set fmmaxpp=50" );
572
573 /*
574 * MAXCP=0xf000+2000
575 */
576 target_write_u32( target, 0xFFE8A084, 0xf000+2000 );
577 DEBUG( "set fmmaxcp=0x%04x", 0xf000+2000 );
578
579 /*
580 * configure VHV
581 */
582 target_read_u32( target, 0xFFE8A080, &fmmaxep );
583 if (fmmaxep == 0xf000)
584 {
585 fmmaxep = 0xf000+4095;
586 target_write_u32( target, 0xFFE8A80C, 0x9964 );
587 DEBUG( "set fmptr3=0x9964" );
588 }
589 else
590 {
591 fmmaxep = 0xa000+4095;
592 target_write_u32( target, 0xFFE8A80C, 0x9b64 );
593 DEBUG( "set fmptr3=0x9b64" );
594 }
595 target_write_u32( target, 0xFFE8A080, fmmaxep );
596 DEBUG( "set fmmaxep=0x%04x", fmmaxep );
597
598 /*
599 * FMPTR4=0xa000
600 */
601 target_write_u32( target, 0xFFE8A810, 0xa000 );
602 DEBUG( "set fmptr4=0xa000" );
603
604 /*
605 * FMPESETUP, delay parameter selected based on clock frequency.
606 *
607 * According to the TI App Note SPNU257 and flashing code, delay is
608 * int((sysclk(MHz) + 1) / 2), with a minimum of 5. The system
609 * clock is usually derived from the ZPLL module, and selected by
610 * the plldis global.
611 */
612 target_read_u32( target, 0xFFFFFFDC, &glbctrl );
613 sysclk = (plldis ? 1 : (glbctrl & 0x08) ? 4 : 8 ) * oscMHz / (1 + (glbctrl & 7));
614 delay = (sysclk > 10) ? (sysclk + 1) / 2 : 5;
615 target_write_u32( target, 0xFFE8A018, (delay<<4)|(delay<<8) );
616 DEBUG( "set fmpsetup=0x%04x", (delay<<4)|(delay<<8) );
617
618 /*
619 * FMPVEVACCESS, based on delay.
620 */
621 k = delay|(delay<<8);
622 target_write_u32( target, 0xFFE8A05C, k );
623 DEBUG( "set fmpvevaccess=0x%04x", k );
624
625 /*
626 * FMPCHOLD, FMPVEVHOLD, FMPVEVSETUP, based on delay.
627 */
628 k <<= 1;
629 target_write_u32( target, 0xFFE8A034, k );
630 DEBUG( "set fmpchold=0x%04x", k );
631 target_write_u32( target, 0xFFE8A040, k );
632 DEBUG( "set fmpvevhold=0x%04x", k );
633 target_write_u32( target, 0xFFE8A024, k );
634 DEBUG( "set fmpvevsetup=0x%04x", k );
635
636 /*
637 * FMCVACCESS, based on delay.
638 */
639 k = delay*16;
640 target_write_u32( target, 0xFFE8A060, k );
641 DEBUG( "set fmcvaccess=0x%04x", k );
642
643 /*
644 * FMCSETUP, based on delay.
645 */
646 k = 0x3000 | delay*20;
647 target_write_u32( target, 0xFFE8A020, k );
648 DEBUG( "set fmcsetup=0x%04x", k );
649
650 /*
651 * FMEHOLD, based on delay.
652 */
653 k = (delay*20) << 2;
654 target_write_u32( target, 0xFFE8A038, k );
655 DEBUG( "set fmehold=0x%04x", k );
656
657 /*
658 * PWIDTH, CWIDTH, EWIDTH, based on delay.
659 */
660 target_write_u32( target, 0xFFE8A050, delay*8 );
661 DEBUG( "set fmpwidth=0x%04x", delay*8 );
662 target_write_u32( target, 0xFFE8A058, delay*1000 );
663 DEBUG( "set fmcwidth=0x%04x", delay*1000 );
664 target_write_u32( target, 0xFFE8A054, delay*5400 );
665 DEBUG( "set fmewidth=0x%04x", delay*5400 );
666
667 return result;
668 }
669
670
671 /* ---------------------------------------------------------------------- */
672
673 int
674 tms470_flash_status( struct flash_bank_s * bank )
675 {
676 target_t *target = bank->target;
677 int result = ERROR_OK;
678 u32 fmmstat;
679
680 target_read_u32( target, 0xFFE8BC0C, &fmmstat );
681 DEBUG( "set fmmstat=0x%04x", fmmstat );
682
683 if (fmmstat & 0x0080)
684 {
685 WARNING( "tms470 flash command: erase still active after busy clear." );
686 result = ERROR_FLASH_OPERATION_FAILED;
687 }
688
689 if (fmmstat & 0x0040)
690 {
691 WARNING( "tms470 flash command: program still active after busy clear." );
692 result = ERROR_FLASH_OPERATION_FAILED;
693 }
694
695 if (fmmstat & 0x0020)
696 {
697 WARNING( "tms470 flash command: invalid data command." );
698 result = ERROR_FLASH_OPERATION_FAILED;
699 }
700
701 if (fmmstat & 0x0010)
702 {
703 WARNING( "tms470 flash command: program, erase or validate sector failed." );
704 result = ERROR_FLASH_OPERATION_FAILED;
705 }
706
707 if (fmmstat & 0x0008)
708 {
709 WARNING( "tms470 flash command: voltage instability detected." );
710 result = ERROR_FLASH_OPERATION_FAILED;
711 }
712
713 if (fmmstat & 0x0006)
714 {
715 WARNING( "tms470 flash command: command suspend detected." );
716 result = ERROR_FLASH_OPERATION_FAILED;
717 }
718
719 if (fmmstat & 0x0001)
720 {
721 WARNING( "tms470 flash command: sector was locked." );
722 result = ERROR_FLASH_OPERATION_FAILED;
723 }
724
725 return result;
726 }
727
728 /* ---------------------------------------------------------------------- */
729
730 int
731 tms470_erase_sector( struct flash_bank_s * bank,
732 int sector )
733 {
734 u32 glbctrl, orig_fmregopt, fmbsea, fmbseb, fmmstat;
735 target_t *target = bank->target;
736 u32 flashAddr = bank->base + bank->sectors[sector].offset;
737 int result = ERROR_OK;
738
739 /*
740 * Set the bit GLBCTRL4 of the GLBCTRL register (in the System
741 * module) to enable writing to the flash registers }.
742 */
743 target_read_u32( target, 0xFFFFFFDC, &glbctrl );
744 target_write_u32( target, 0xFFFFFFDC, glbctrl | 0x10 );
745 DEBUG( "set glbctrl=0x%08x", glbctrl | 0x10 );
746
747 /* Force normal read mode. */
748 target_read_u32( target, 0xFFE89C00, &orig_fmregopt );
749 target_write_u32( target, 0xFFE89C00, 0 );
750 DEBUG( "set fmregopt=0x%08x", 0 );
751
752 (void) tms470_flash_initialize_internal_state_machine( bank );
753
754 /*
755 * Select one or more bits in FMBSEA or FMBSEB to disable Level 1
756 * protection for the particular sector to be erased/written.
757 */
758 if (sector < 16)
759 {
760 target_read_u32( target, 0xFFE88008, &fmbsea );
761 target_write_u32( target, 0xFFE88008, fmbsea | (1<<sector) );
762 DEBUG( "set fmbsea=0x%04x", fmbsea | (1<<sector) );
763 }
764 else
765 {
766 target_read_u32( target, 0xFFE8800C, &fmbseb );
767 target_write_u32( target, 0xFFE8800C, fmbseb | (1<<(sector-16)) );
768 DEBUG( "set fmbseb=0x%04x", fmbseb | (1<<(sector-16)) );
769 }
770 bank->sectors[sector].is_protected = 0;
771
772 /*
773 * clear status regiser, sent erase command, kickoff erase
774 */
775 target_write_u16( target, flashAddr, 0x0040 );
776 DEBUG( "write *(u16 *)0x%08x=0x0040", flashAddr );
777 target_write_u16( target, flashAddr, 0x0020 );
778 DEBUG( "write *(u16 *)0x%08x=0x0020", flashAddr );
779 target_write_u16( target, flashAddr, 0xffff );
780 DEBUG( "write *(u16 *)0x%08x=0xffff", flashAddr );
781
782 /*
783 * Monitor FMMSTAT, busy until clear, then check and other flags for
784 * ultimate result of the operation.
785 */
786 do
787 {
788 target_read_u32( target, 0xFFE8BC0C, &fmmstat );
789 if (fmmstat & 0x0100)
790 {
791 usleep( 1000 );
792 }
793 }
794 while( fmmstat & 0x0100 );
795
796 result = tms470_flash_status( bank );
797
798 if (sector < 16)
799 {
800 target_write_u32( target, 0xFFE88008, fmbsea );
801 DEBUG( "set fmbsea=0x%04x", fmbsea );
802 bank->sectors[sector].is_protected =
803 fmbsea & (1<<sector) ? 0 : 1;
804 }
805 else
806 {
807 target_write_u32( target, 0xFFE8800C, fmbseb );
808 DEBUG( "set fmbseb=0x%04x", fmbseb );
809 bank->sectors[sector].is_protected =
810 fmbseb & (1<<(sector-16)) ? 0 : 1;
811 }
812 target_write_u32( target, 0xFFE89C00, orig_fmregopt );
813 DEBUG( "set fmregopt=0x%08x", orig_fmregopt );
814 target_write_u32( target, 0xFFFFFFDC, glbctrl );
815 DEBUG( "set glbctrl=0x%08x", glbctrl );
816
817 if (result == ERROR_OK)
818 {
819 bank->sectors[sector].is_erased = 1;
820 }
821
822 return result;
823 }
824
825 /* ----------------------------------------------------------------------
826 Implementation of Flash Driver Interfaces
827 ---------------------------------------------------------------------- */
828
829 int
830 tms470_register_commands( struct command_context_s *cmd_ctx )
831 {
832 command_t *tms470_cmd = register_command( cmd_ctx,
833 NULL,
834 "tms470",
835 NULL,
836 COMMAND_ANY,
837 "applies to TI tms470 family" );
838
839 register_command( cmd_ctx,
840 tms470_cmd,
841 "flash_keyset",
842 tms470_handle_flash_keyset_command,
843 COMMAND_ANY,
844 "tms470 flash_keyset <key0> <key1> <key2> <key3>" );
845
846 register_command( cmd_ctx,
847 tms470_cmd,
848 "osc_megahertz",
849 tms470_handle_osc_megahertz_command,
850 COMMAND_ANY,
851 "tms470 osc_megahertz <MHz>" );
852
853 register_command( cmd_ctx,
854 tms470_cmd,
855 "plldis",
856 tms470_handle_plldis_command,
857 COMMAND_ANY,
858 "tms470 plldis <0/1>" );
859
860 return ERROR_OK;
861 }
862
863 /* ---------------------------------------------------------------------- */
864
865 int
866 tms470_erase( struct flash_bank_s * bank,
867 int first,
868 int last )
869 {
870 tms470_flash_bank_t *tms470_info = bank->driver_priv;
871 int sector, result = ERROR_OK;
872
873 if (!tms470_info->device_ident_reg)
874 {
875 tms470_read_part_info( bank );
876 }
877
878 if ((first < 0) ||
879 (first >= bank->num_sectors) ||
880 (last < 0) ||
881 (last >= bank->num_sectors) ||
882 (first > last))
883 {
884 ERROR( "Sector range %d to %d invalid.", first, last );
885 return ERROR_FLASH_SECTOR_INVALID;
886 }
887
888 result = tms470_unlock_flash( bank );
889 if (result != ERROR_OK)
890 {
891 return result;
892 }
893
894 for( sector=first; sector<=last; sector++ )
895 {
896 INFO( "Erasing tms470 bank %d sector %d...",
897 tms470_info->ordinal, sector );
898
899 result = tms470_erase_sector( bank, sector );
900
901 if (result != ERROR_OK)
902 {
903 ERROR( "tms470 could not erase flash sector." );
904 break;
905 }
906 else
907 {
908 INFO( "sector erased successfully." );
909 }
910 }
911
912 return result;
913 }
914
915 /* ---------------------------------------------------------------------- */
916
917 int
918 tms470_protect( struct flash_bank_s * bank,
919 int set,
920 int first,
921 int last )
922 {
923 tms470_flash_bank_t *tms470_info = bank->driver_priv;
924 target_t *target = bank->target;
925 u32 fmmac2, fmbsea, fmbseb;
926 int sector;
927
928 if (!tms470_info->device_ident_reg)
929 {
930 tms470_read_part_info( bank );
931 }
932
933 if ((first < 0) ||
934 (first >= bank->num_sectors) ||
935 (last < 0) ||
936 (last >= bank->num_sectors) ||
937 (first > last))
938 {
939 ERROR( "Sector range %d to %d invalid.", first, last );
940 return ERROR_FLASH_SECTOR_INVALID;
941 }
942
943 /* enable the appropriate bank */
944 target_read_u32( target, 0xFFE8BC04, &fmmac2 );
945 target_write_u32( target, 0xFFE8BC04,
946 (fmmac2 & ~7) | tms470_info->ordinal );
947
948 /* get the original sector proection flags for this bank */
949 target_read_u32( target, 0xFFE88008, &fmbsea );
950 target_read_u32( target, 0xFFE8800C, &fmbseb );
951
952 for( sector=0; sector<bank->num_sectors; sector++ )
953 {
954 if (sector < 16)
955 {
956 fmbsea = set ? fmbsea & ~(1<<sector) :
957 fmbsea | (1<<sector);
958 bank->sectors[sector].is_protected = set ? 1 : 0;
959 }
960 else
961 {
962 fmbseb = set ? fmbseb & ~(1<<(sector-16)) :
963 fmbseb | (1<<(sector-16));
964 bank->sectors[sector].is_protected = set ? 1 : 0;
965 }
966 }
967
968 /* update the protection bits */
969 target_write_u32( target, 0xFFE88008, fmbsea );
970 target_write_u32( target, 0xFFE8800C, fmbseb );
971
972 return ERROR_OK;
973 }
974
975 /* ---------------------------------------------------------------------- */
976
977 int
978 tms470_write( struct flash_bank_s * bank,
979 u8 * buffer,
980 u32 offset,
981 u32 count )
982 {
983 target_t *target = bank->target;
984 tms470_flash_bank_t *tms470_info = bank->driver_priv;
985 u32 glbctrl, fmbac2, orig_fmregopt, fmbsea, fmbseb, fmmaxpp, fmmstat;
986 int i, result = ERROR_OK;
987
988 if (!tms470_info->device_ident_reg)
989 {
990 tms470_read_part_info( bank );
991 }
992
993 INFO( "Writing %d bytes starting at 0x%08x",
994 count, bank->base + offset );
995
996 /* set GLBCTRL.4 */
997 target_read_u32( target, 0xFFFFFFDC, &glbctrl );
998 target_write_u32( target, 0xFFFFFFDC, glbctrl | 0x10 );
999
1000 (void) tms470_flash_initialize_internal_state_machine( bank );
1001
1002 /* force max wait states */
1003 target_read_u32( target, 0xFFE88004, &fmbac2 );
1004 target_write_u32( target, 0xFFE88004, fmbac2 | 0xff );
1005
1006 /* save current access mode, force normal read mode */
1007 target_read_u32( target, 0xFFE89C00, &orig_fmregopt );
1008 target_write_u32( target, 0xFFE89C00, 0x00 );
1009
1010 /*
1011 * Disable Level 1 protection for all sectors to be erased/written.
1012 */
1013 target_read_u32( target, 0xFFE88008, &fmbsea );
1014 target_write_u32( target, 0xFFE88008, 0xffff );
1015 target_read_u32( target, 0xFFE8800C, &fmbseb );
1016 target_write_u32( target, 0xFFE8800C, 0xffff );
1017
1018 /* read MAXPP */
1019 target_read_u32( target, 0xFFE8A07C, &fmmaxpp );
1020
1021 for( i=0; i<count; i+=2 )
1022 {
1023 u32 addr = bank->base + offset + i;
1024 u16 word = (((u16) buffer[i]) << 8) | (u16) buffer[i+1];
1025
1026 if (word != 0xffff)
1027 {
1028 INFO( "writing 0x%04x at 0x%08x", word, addr );
1029
1030 /* clear status register */
1031 target_write_u16( target, addr, 0x0040 );
1032 /* program flash command */
1033 target_write_u16( target, addr, 0x0010 );
1034 /* burn the 16-bit word (big-endian) */
1035 target_write_u16( target, addr, word );
1036
1037 /*
1038 * Monitor FMMSTAT, busy until clear, then check and other flags
1039 * for ultimate result of the operation.
1040 */
1041 do
1042 {
1043 target_read_u32( target, 0xFFE8BC0C, &fmmstat );
1044 if (fmmstat & 0x0100)
1045 {
1046 usleep( 1000 );
1047 }
1048 }
1049 while( fmmstat & 0x0100 );
1050
1051 if (fmmstat & 0x3ff)
1052 {
1053 ERROR( "fmstat=0x%04x", fmmstat );
1054 ERROR( "Could not program word 0x%04x at address 0x%08x.",
1055 word, addr );
1056 result = ERROR_FLASH_OPERATION_FAILED;
1057 break;
1058 }
1059 }
1060 else
1061 {
1062 INFO( "skipping 0xffff at 0x%08x", addr );
1063 }
1064 }
1065
1066 /* restore */
1067 target_write_u32( target, 0xFFE88008, fmbsea );
1068 target_write_u32( target, 0xFFE8800C, fmbseb );
1069 target_write_u32( target, 0xFFE88004, fmbac2 );
1070 target_write_u32( target, 0xFFE89C00, orig_fmregopt );
1071 target_write_u32( target, 0xFFFFFFDC, glbctrl );
1072
1073 return result;
1074 }
1075
1076 /* ---------------------------------------------------------------------- */
1077
1078 int
1079 tms470_probe( struct flash_bank_s * bank )
1080 {
1081 tms470_flash_bank_t * tms470_info = bank->driver_priv;
1082
1083 tms470_info->probed = 0;
1084
1085 if (!tms470_info->device_ident_reg)
1086 {
1087 tms470_read_part_info( bank );
1088 }
1089
1090 tms470_info->probed = 1;
1091
1092 return ERROR_OK;
1093 }
1094
1095 int
1096 tms470_auto_probe( struct flash_bank_s * bank )
1097 {
1098 tms470_flash_bank_t * tms470_info = bank->driver_priv;
1099 if (tms470_info->probed)
1100 return ERROR_OK;
1101 return tms470_probe(bank);
1102 }
1103 /* ---------------------------------------------------------------------- */
1104
1105 int
1106 tms470_erase_check( struct flash_bank_s * bank )
1107 {
1108 target_t *target = bank->target;
1109 tms470_flash_bank_t * tms470_info = bank->driver_priv;
1110 int sector, result = ERROR_OK;
1111 u32 fmmac2, fmbac2, glbctrl, orig_fmregopt;
1112 static u8 buffer[64*1024];
1113
1114 if (!tms470_info->device_ident_reg)
1115 {
1116 tms470_read_part_info( bank );
1117 }
1118
1119 /* set GLBCTRL.4 */
1120 target_read_u32( target, 0xFFFFFFDC, &glbctrl );
1121 target_write_u32( target, 0xFFFFFFDC, glbctrl | 0x10 );
1122
1123 /* save current access mode, force normal read mode */
1124 target_read_u32( target, 0xFFE89C00, &orig_fmregopt );
1125 target_write_u32( target, 0xFFE89C00, 0x00 );
1126
1127 /* enable the appropriate bank */
1128 target_read_u32( target, 0xFFE8BC04, &fmmac2 );
1129 target_write_u32( target, 0xFFE8BC04,
1130 (fmmac2 & ~7) | tms470_info->ordinal );
1131
1132 /* TCR=0 */
1133 target_write_u32( target, 0xFFE8BC10, 0x2fc0 );
1134
1135 /* clear TEZ in fmbrdy */
1136 target_write_u32( target, 0xFFE88010, 0x0b );
1137
1138 /* save current wait states, force max */
1139 target_read_u32( target, 0xFFE88004, &fmbac2 );
1140 target_write_u32( target, 0xFFE88004, fmbac2 | 0xff );
1141
1142 /*
1143 * The TI primitives inspect the flash memory by reading one 32-bit
1144 * word at a time. Here we read an entire sector and inspect it in
1145 * an attempt to reduce the JTAG overhead.
1146 */
1147 for( sector=0; sector<bank->num_sectors; sector++ )
1148 {
1149 if (bank->sectors[sector].is_erased != 1)
1150 {
1151 u32 i, addr = bank->base + bank->sectors[sector].offset;
1152
1153 INFO( "checking flash bank %d sector %d",
1154 tms470_info->ordinal,
1155 sector );
1156
1157 target_read_buffer( target,
1158 addr,
1159 bank->sectors[sector].size,
1160 buffer );
1161
1162 bank->sectors[sector].is_erased = 1;
1163 for( i=0; i<bank->sectors[sector].size; i++ )
1164 {
1165 if (buffer[i] != 0xff)
1166 {
1167 WARNING( "tms470 bank %d, sector %d, not erased.",
1168 tms470_info->ordinal,
1169 sector );
1170 WARNING( "at location 0x%08x: flash data is 0x%02x.",
1171 addr+i,
1172 buffer[i] );
1173
1174 bank->sectors[sector].is_erased = 0;
1175 break;
1176 }
1177 }
1178 }
1179 if (bank->sectors[sector].is_erased != 1)
1180 {
1181 result = ERROR_FLASH_SECTOR_NOT_ERASED;
1182 break;
1183 }
1184 else
1185 {
1186 INFO( "sector erased" );
1187 }
1188 }
1189
1190 /* reset TEZ, wait states, read mode, GLBCTRL.4 */
1191 target_write_u32( target, 0xFFE88010, 0x0f );
1192 target_write_u32( target, 0xFFE88004, fmbac2 );
1193 target_write_u32( target, 0xFFE89C00, orig_fmregopt );
1194 target_write_u32( target, 0xFFFFFFDC, glbctrl );
1195
1196 return result;
1197 }
1198
1199 /* ---------------------------------------------------------------------- */
1200
1201 int
1202 tms470_protect_check( struct flash_bank_s * bank )
1203 {
1204 target_t *target = bank->target;
1205 tms470_flash_bank_t * tms470_info = bank->driver_priv;
1206 int sector, result = ERROR_OK;
1207 u32 fmmac2, fmbsea, fmbseb;
1208
1209 if (!tms470_info->device_ident_reg)
1210 {
1211 tms470_read_part_info( bank );
1212 }
1213
1214 /* enable the appropriate bank */
1215 target_read_u32( target, 0xFFE8BC04, &fmmac2 );
1216 target_write_u32( target, 0xFFE8BC04,
1217 (fmmac2 & ~7) | tms470_info->ordinal );
1218
1219 target_read_u32( target, 0xFFE88008, &fmbsea );
1220 target_read_u32( target, 0xFFE8800C, &fmbseb );
1221
1222 for( sector=0; sector<bank->num_sectors; sector++ )
1223 {
1224 int protected;
1225
1226 if (sector < 16)
1227 {
1228 protected = fmbsea & (1<<sector) ? 0 : 1;
1229 bank->sectors[sector].is_protected = protected;
1230 }
1231 else
1232 {
1233 protected = fmbseb & (1<<(sector-16)) ? 0 : 1;
1234 bank->sectors[sector].is_protected = protected;
1235 }
1236
1237 DEBUG( "bank %d sector %d is %s",
1238 tms470_info->ordinal,
1239 sector,
1240 protected ? "protected" : "not protected" );
1241 }
1242
1243 return result;
1244 }
1245
1246 /* ---------------------------------------------------------------------- */
1247
1248 int
1249 tms470_info( struct flash_bank_s * bank,
1250 char * buf,
1251 int buf_size )
1252 {
1253 int used = 0;
1254 tms470_flash_bank_t * tms470_info = bank->driver_priv;
1255
1256 if (!tms470_info->device_ident_reg)
1257 {
1258 tms470_read_part_info( bank );
1259 }
1260
1261 if (!tms470_info->device_ident_reg)
1262 {
1263 (void) snprintf(buf, buf_size, "Cannot identify target as a TMS470\n");
1264 return ERROR_FLASH_OPERATION_FAILED;
1265 }
1266
1267 used += snprintf( buf, buf_size,
1268 "\ntms470 information: Chip is %s\n",
1269 tms470_info->part_name );
1270 buf += used;
1271 buf_size -= used;
1272
1273 used += snprintf( buf, buf_size,
1274 "Flash protection level 2 is %s\n",
1275 tms470_check_flash_unlocked( bank->target ) == ERROR_OK ? "disabled" : "enabled" );
1276 buf += used;
1277 buf_size -= used;
1278
1279 return ERROR_OK;
1280 }
1281
1282 /* ---------------------------------------------------------------------- */
1283
1284 /*
1285 * flash bank tms470 <base> <size> <chip_width> <bus_width> <target>
1286 * [options...]
1287 */
1288
1289 int
1290 tms470_flash_bank_command( struct command_context_s *cmd_ctx,
1291 char *cmd,
1292 char **args,
1293 int argc,
1294 struct flash_bank_s *bank )
1295 {
1296 bank->driver_priv = malloc( sizeof( tms470_flash_bank_t ) );
1297
1298 if (!bank->driver_priv)
1299 {
1300 return ERROR_FLASH_OPERATION_FAILED;
1301 }
1302
1303 (void) memset( bank->driver_priv, 0, sizeof( tms470_flash_bank_t ) );
1304
1305 return ERROR_OK;
1306 }
Open On-Chip Debugger

Linking to existing account procedure

If you already have an account and want to add another login method you MUST first sign in with your existing account and then change URL to read https://review.openocd.org/login/?link to get to this page again but this time it'll work for linking. Thank you.

SSH host keys fingerprints

1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=..              |
|+o..   .         |
|*.o   . .        |
|+B . . .         |
|Bo. = o S        |
|Oo.+ + =         |
|oB=.* = . o      |
| =+=.+   + E     |
|. .=o   . o      |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)