1 /***************************************************************************
2 * (c) Copyright 2007, 2008 by Christopher Kilgour *
3 * techie |_at_| whiterocker |_dot_| com *
5 * This program is free software; you can redistribute it and/or modify *
6 * it under the terms of the GNU General Public License as published by *
7 * the Free Software Foundation; either version 2 of the License, or *
8 * (at your option) any later version. *
10 * This program is distributed in the hope that it will be useful, *
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
13 * GNU General Public License for more details. *
15 * You should have received a copy of the GNU General Public License *
16 * along with this program; if not, write to the *
17 * Free Software Foundation, Inc., *
18 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
19 ***************************************************************************/
30 int tms470_register_commands(struct command_context_s
*cmd_ctx
);
31 int tms470_flash_bank_command(struct command_context_s
*cmd_ctx
, char *cmd
, char **args
, int argc
, struct flash_bank_s
*bank
);
32 int tms470_erase(struct flash_bank_s
*bank
, int first
, int last
);
33 int tms470_protect(struct flash_bank_s
*bank
, int set
, int first
, int last
);
34 int tms470_write(struct flash_bank_s
*bank
, u8
* buffer
, u32 offset
, u32 count
);
35 int tms470_probe(struct flash_bank_s
*bank
);
36 int tms470_auto_probe(struct flash_bank_s
*bank
);
37 int tms470_erase_check(struct flash_bank_s
*bank
);
38 int tms470_protect_check(struct flash_bank_s
*bank
);
39 int tms470_info(struct flash_bank_s
*bank
, char *buf
, int buf_size
);
41 flash_driver_t tms470_flash
= {
43 .register_commands
= tms470_register_commands
,
44 .flash_bank_command
= tms470_flash_bank_command
,
45 .erase
= tms470_erase
,
46 .protect
= tms470_protect
,
47 .write
= tms470_write
,
48 .probe
= tms470_probe
,
49 .auto_probe
= tms470_auto_probe
,
50 .erase_check
= tms470_erase_check
,
51 .protect_check
= tms470_protect_check
,
55 /* ----------------------------------------------------------------------
56 Internal Support, Helpers
57 ---------------------------------------------------------------------- */
59 const flash_sector_t TMS470R1A256_SECTORS
[] = {
60 {0x00000000, 0x00002000, -1, -1},
61 {0x00002000, 0x00002000, -1, -1},
62 {0x00004000, 0x00002000, -1, -1},
63 {0x00006000, 0x00002000, -1, -1},
64 {0x00008000, 0x00008000, -1, -1},
65 {0x00010000, 0x00008000, -1, -1},
66 {0x00018000, 0x00008000, -1, -1},
67 {0x00020000, 0x00008000, -1, -1},
68 {0x00028000, 0x00008000, -1, -1},
69 {0x00030000, 0x00008000, -1, -1},
70 {0x00038000, 0x00002000, -1, -1},
71 {0x0003A000, 0x00002000, -1, -1},
72 {0x0003C000, 0x00002000, -1, -1},
73 {0x0003E000, 0x00002000, -1, -1},
76 #define TMS470R1A256_NUM_SECTORS \
77 (sizeof(TMS470R1A256_SECTORS)/sizeof(TMS470R1A256_SECTORS[0]))
79 const flash_sector_t TMS470R1A288_BANK0_SECTORS
[] = {
80 {0x00000000, 0x00002000, -1, -1},
81 {0x00002000, 0x00002000, -1, -1},
82 {0x00004000, 0x00002000, -1, -1},
83 {0x00006000, 0x00002000, -1, -1},
86 #define TMS470R1A288_BANK0_NUM_SECTORS \
87 (sizeof(TMS470R1A288_BANK0_SECTORS)/sizeof(TMS470R1A288_BANK0_SECTORS[0]))
89 const flash_sector_t TMS470R1A288_BANK1_SECTORS
[] = {
90 {0x00040000, 0x00010000, -1, -1},
91 {0x00050000, 0x00010000, -1, -1},
92 {0x00060000, 0x00010000, -1, -1},
93 {0x00070000, 0x00010000, -1, -1},
96 #define TMS470R1A288_BANK1_NUM_SECTORS \
97 (sizeof(TMS470R1A288_BANK1_SECTORS)/sizeof(TMS470R1A288_BANK1_SECTORS[0]))
99 /* ---------------------------------------------------------------------- */
101 int tms470_read_part_info(struct flash_bank_s
*bank
)
103 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
104 target_t
*target
= bank
->target
;
105 u32 device_ident_reg
;
107 u32 technology_family
;
112 /* we shall not rely on the caller in this test, this function allocates memory,
113 thus and executing the code more than once may cause memory leak */
114 if (tms470_info
->device_ident_reg
)
117 /* read and parse the device identification register */
118 target_read_u32(target
, 0xFFFFFFF0, &device_ident_reg
);
120 INFO("device_ident_reg=0x%08x", device_ident_reg
);
122 if ((device_ident_reg
& 7) == 0)
124 WARNING("Cannot identify target as a TMS470 family.");
125 return ERROR_FLASH_OPERATION_FAILED
;
128 silicon_version
= (device_ident_reg
>> 12) & 0xF;
129 technology_family
= (device_ident_reg
>> 11) & 1;
130 rom_flash
= (device_ident_reg
>> 10) & 1;
131 part_number
= (device_ident_reg
>> 3) & 0x7f;
134 * If the part number is known, determine if the flash bank is valid
135 * based on the base address being within the known flash bank
136 * ranges. Then fixup/complete the remaining fields of the flash
142 part_name
= "TMS470R1A256";
144 if (bank
->base
>= 0x00040000)
146 ERROR("No %s flash bank contains base address 0x%08x.", part_name
, bank
->base
);
147 return ERROR_FLASH_OPERATION_FAILED
;
149 tms470_info
->ordinal
= 0;
150 bank
->base
= 0x00000000;
151 bank
->size
= 256 * 1024;
152 bank
->num_sectors
= TMS470R1A256_NUM_SECTORS
;
153 bank
->sectors
= malloc(sizeof(TMS470R1A256_SECTORS
));
156 return ERROR_FLASH_OPERATION_FAILED
;
158 (void)memcpy(bank
->sectors
, TMS470R1A256_SECTORS
, sizeof(TMS470R1A256_SECTORS
));
162 part_name
= "TMS470R1A288";
164 if ((bank
->base
>= 0x00000000) && (bank
->base
< 0x00008000))
166 tms470_info
->ordinal
= 0;
167 bank
->base
= 0x00000000;
168 bank
->size
= 32 * 1024;
169 bank
->num_sectors
= TMS470R1A288_BANK0_NUM_SECTORS
;
170 bank
->sectors
= malloc(sizeof(TMS470R1A288_BANK0_SECTORS
));
173 return ERROR_FLASH_OPERATION_FAILED
;
175 (void)memcpy(bank
->sectors
, TMS470R1A288_BANK0_SECTORS
, sizeof(TMS470R1A288_BANK0_SECTORS
));
177 else if ((bank
->base
>= 0x00040000) && (bank
->base
< 0x00080000))
179 tms470_info
->ordinal
= 1;
180 bank
->base
= 0x00040000;
181 bank
->size
= 256 * 1024;
182 bank
->num_sectors
= TMS470R1A288_BANK1_NUM_SECTORS
;
183 bank
->sectors
= malloc(sizeof(TMS470R1A288_BANK1_SECTORS
));
186 return ERROR_FLASH_OPERATION_FAILED
;
188 (void)memcpy(bank
->sectors
, TMS470R1A288_BANK1_SECTORS
, sizeof(TMS470R1A288_BANK1_SECTORS
));
192 ERROR("No %s flash bank contains base address 0x%08x.", part_name
, bank
->base
);
193 return ERROR_FLASH_OPERATION_FAILED
;
198 WARNING("Could not identify part 0x%02x as a member of the TMS470 family.", part_number
);
199 return ERROR_FLASH_OPERATION_FAILED
;
202 /* turn off memory selects */
203 target_write_u32(target
, 0xFFFFFFE4, 0x00000000);
204 target_write_u32(target
, 0xFFFFFFE0, 0x00000000);
206 bank
->chip_width
= 32;
207 bank
->bus_width
= 32;
209 INFO("Identified %s, ver=%d, core=%s, nvmem=%s.", part_name
, silicon_version
, (technology_family
? "1.8v" : "3.3v"), (rom_flash
? "rom" : "flash"));
211 tms470_info
->device_ident_reg
= device_ident_reg
;
212 tms470_info
->silicon_version
= silicon_version
;
213 tms470_info
->technology_family
= technology_family
;
214 tms470_info
->rom_flash
= rom_flash
;
215 tms470_info
->part_number
= part_number
;
216 tms470_info
->part_name
= part_name
;
219 * Disable reset on address access violation.
221 target_write_u32(target
, 0xFFFFFFE0, 0x00004007);
226 /* ---------------------------------------------------------------------- */
231 int tms470_handle_flash_keyset_command(struct command_context_s
*cmd_ctx
, char *cmd
, char **args
, int argc
)
235 command_print(cmd_ctx
, "tms470 flash_keyset <key0> <key1> <key2> <key3>");
236 return ERROR_INVALID_ARGUMENTS
;
242 for (i
= 0; i
< 4; i
++)
244 int start
= (0 == strncmp(args
[i
], "0x", 2)) ? 2 : 0;
246 if (1 != sscanf(&args
[i
][start
], "%x", &flashKeys
[i
]))
248 command_print(cmd_ctx
, "could not process flash key %s", args
[i
]);
249 ERROR("could not process flash key %s", args
[i
]);
250 return ERROR_INVALID_ARGUMENTS
;
258 command_print(cmd_ctx
, "tms470 flash_keyset <key0> <key1> <key2> <key3>");
259 return ERROR_INVALID_ARGUMENTS
;
264 command_print(cmd_ctx
, "using flash keys 0x%08x, 0x%08x, 0x%08x, 0x%08x", flashKeys
[0], flashKeys
[1], flashKeys
[2], flashKeys
[3]);
268 command_print(cmd_ctx
, "flash keys not set");
274 const u32 FLASH_KEYS_ALL_ONES
[] = { 0xFFFFFFFF, 0xFFFFFFFF,
275 0xFFFFFFFF, 0xFFFFFFFF,
278 const u32 FLASH_KEYS_ALL_ZEROS
[] = { 0x00000000, 0x00000000,
279 0x00000000, 0x00000000,
282 const u32 FLASH_KEYS_MIX1
[] = { 0xf0fff0ff, 0xf0fff0ff,
283 0xf0fff0ff, 0xf0fff0ff
286 const u32 FLASH_KEYS_MIX2
[] = { 0x0000ffff, 0x0000ffff,
287 0x0000ffff, 0x0000ffff
290 /* ---------------------------------------------------------------------- */
294 int tms470_handle_osc_megahertz_command(struct command_context_s
*cmd_ctx
, char *cmd
, char **args
, int argc
)
298 command_print(cmd_ctx
, "tms470 osc_megahertz <MHz>");
299 return ERROR_INVALID_ARGUMENTS
;
303 sscanf(args
[0], "%d", &oscMHz
);
308 ERROR("osc_megahertz must be positive and non-zero!");
309 command_print(cmd_ctx
, "osc_megahertz must be positive and non-zero!");
311 return ERROR_INVALID_ARGUMENTS
;
314 command_print(cmd_ctx
, "osc_megahertz=%d", oscMHz
);
319 /* ---------------------------------------------------------------------- */
323 int tms470_handle_plldis_command(struct command_context_s
*cmd_ctx
, char *cmd
, char **args
, int argc
)
327 command_print(cmd_ctx
, "tms470 plldis <0|1>");
328 return ERROR_INVALID_ARGUMENTS
;
332 sscanf(args
[0], "%d", &plldis
);
333 plldis
= plldis
? 1 : 0;
336 command_print(cmd_ctx
, "plldis=%d", plldis
);
341 /* ---------------------------------------------------------------------- */
343 int tms470_check_flash_unlocked(target_t
* target
)
347 target_read_u32(target
, 0xFFE89C08, &fmbbusy
);
348 INFO("tms470 fmbbusy=0x%08x -> %s", fmbbusy
, fmbbusy
& 0x8000 ? "unlocked" : "LOCKED");
349 return fmbbusy
& 0x8000 ? ERROR_OK
: ERROR_FLASH_OPERATION_FAILED
;
352 /* ---------------------------------------------------------------------- */
354 int tms470_try_flash_keys(target_t
* target
, const u32
* key_set
)
356 u32 glbctrl
, fmmstat
;
357 int retval
= ERROR_FLASH_OPERATION_FAILED
;
360 target_read_u32(target
, 0xFFFFFFDC, &glbctrl
);
361 target_write_u32(target
, 0xFFFFFFDC, glbctrl
| 0x10);
363 /* only perform the key match when 3VSTAT is clear */
364 target_read_u32(target
, 0xFFE8BC0C, &fmmstat
);
365 if (!(fmmstat
& 0x08))
368 u32 fmbptr
, fmbac2
, orig_fmregopt
;
370 target_write_u32(target
, 0xFFE8BC04, fmmstat
& ~0x07);
372 /* wait for pump ready */
375 target_read_u32(target
, 0xFFE8A814, &fmbptr
);
378 while (!(fmbptr
& 0x0200));
380 /* force max wait states */
381 target_read_u32(target
, 0xFFE88004, &fmbac2
);
382 target_write_u32(target
, 0xFFE88004, fmbac2
| 0xff);
384 /* save current access mode, force normal read mode */
385 target_read_u32(target
, 0xFFE89C00, &orig_fmregopt
);
386 target_write_u32(target
, 0xFFE89C00, 0x00);
388 for (i
= 0; i
< 4; i
++)
392 /* There is no point displaying the value of tmp, it is
393 * filtered by the chip. The purpose of this read is to
394 * prime the unlocking logic rather than read out the value.
396 target_read_u32(target
, 0x00001FF0 + 4 * i
, &tmp
);
398 INFO("tms470 writing fmpkey=0x%08x", key_set
[i
]);
399 target_write_u32(target
, 0xFFE89C0C, key_set
[i
]);
402 if (ERROR_OK
== tms470_check_flash_unlocked(target
))
405 * There seems to be a side-effect of reading the FMPKEY
406 * register in that it re-enables the protection. So we
409 for (i
= 0; i
< 4; i
++)
413 target_read_u32(target
, 0x00001FF0 + 4 * i
, &tmp
);
414 target_write_u32(target
, 0xFFE89C0C, key_set
[i
]);
419 /* restore settings */
420 target_write_u32(target
, 0xFFE89C00, orig_fmregopt
);
421 target_write_u32(target
, 0xFFE88004, fmbac2
);
424 /* clear config bit */
425 target_write_u32(target
, 0xFFFFFFDC, glbctrl
);
430 /* ---------------------------------------------------------------------- */
432 int tms470_unlock_flash(struct flash_bank_s
*bank
)
434 target_t
*target
= bank
->target
;
435 const u32
*p_key_sets
[5];
436 unsigned i
, key_set_count
;
440 p_key_sets
[0] = flashKeys
;
441 p_key_sets
[1] = FLASH_KEYS_ALL_ONES
;
442 p_key_sets
[2] = FLASH_KEYS_ALL_ZEROS
;
443 p_key_sets
[3] = FLASH_KEYS_MIX1
;
444 p_key_sets
[4] = FLASH_KEYS_MIX2
;
449 p_key_sets
[0] = FLASH_KEYS_ALL_ONES
;
450 p_key_sets
[1] = FLASH_KEYS_ALL_ZEROS
;
451 p_key_sets
[2] = FLASH_KEYS_MIX1
;
452 p_key_sets
[3] = FLASH_KEYS_MIX2
;
455 for (i
= 0; i
< key_set_count
; i
++)
457 if (tms470_try_flash_keys(target
, p_key_sets
[i
]) == ERROR_OK
)
459 INFO("tms470 flash is unlocked");
464 WARNING("tms470 could not unlock flash memory protection level 2");
465 return ERROR_FLASH_OPERATION_FAILED
;
468 /* ---------------------------------------------------------------------- */
470 int tms470_flash_initialize_internal_state_machine(struct flash_bank_s
*bank
)
472 u32 fmmac2
, fmmac1
, fmmaxep
, k
, delay
, glbctrl
, sysclk
;
473 target_t
*target
= bank
->target
;
474 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
475 int result
= ERROR_OK
;
478 * Select the desired bank to be programmed by writing BANK[2:0] of
481 target_read_u32(target
, 0xFFE8BC04, &fmmac2
);
483 fmmac2
|= (tms470_info
->ordinal
& 7);
484 target_write_u32(target
, 0xFFE8BC04, fmmac2
);
485 DEBUG("set fmmac2=0x%04x", fmmac2
);
488 * Disable level 1 sector protection by setting bit 15 of FMMAC1.
490 target_read_u32(target
, 0xFFE8BC00, &fmmac1
);
492 target_write_u32(target
, 0xFFE8BC00, fmmac1
);
493 DEBUG("set fmmac1=0x%04x", fmmac1
);
498 target_write_u32(target
, 0xFFE8BC10, 0x2fc0);
499 DEBUG("set fmtcreg=0x2fc0");
504 target_write_u32(target
, 0xFFE8A07C, 50);
505 DEBUG("set fmmaxpp=50");
510 target_write_u32(target
, 0xFFE8A084, 0xf000 + 2000);
511 DEBUG("set fmmaxcp=0x%04x", 0xf000 + 2000);
516 target_read_u32(target
, 0xFFE8A080, &fmmaxep
);
517 if (fmmaxep
== 0xf000)
519 fmmaxep
= 0xf000 + 4095;
520 target_write_u32(target
, 0xFFE8A80C, 0x9964);
521 DEBUG("set fmptr3=0x9964");
525 fmmaxep
= 0xa000 + 4095;
526 target_write_u32(target
, 0xFFE8A80C, 0x9b64);
527 DEBUG("set fmptr3=0x9b64");
529 target_write_u32(target
, 0xFFE8A080, fmmaxep
);
530 DEBUG("set fmmaxep=0x%04x", fmmaxep
);
535 target_write_u32(target
, 0xFFE8A810, 0xa000);
536 DEBUG("set fmptr4=0xa000");
539 * FMPESETUP, delay parameter selected based on clock frequency.
541 * According to the TI App Note SPNU257 and flashing code, delay is
542 * int((sysclk(MHz) + 1) / 2), with a minimum of 5. The system
543 * clock is usually derived from the ZPLL module, and selected by
546 target_read_u32(target
, 0xFFFFFFDC, &glbctrl
);
547 sysclk
= (plldis
? 1 : (glbctrl
& 0x08) ? 4 : 8) * oscMHz
/ (1 + (glbctrl
& 7));
548 delay
= (sysclk
> 10) ? (sysclk
+ 1) / 2 : 5;
549 target_write_u32(target
, 0xFFE8A018, (delay
<< 4) | (delay
<< 8));
550 DEBUG("set fmpsetup=0x%04x", (delay
<< 4) | (delay
<< 8));
553 * FMPVEVACCESS, based on delay.
555 k
= delay
| (delay
<< 8);
556 target_write_u32(target
, 0xFFE8A05C, k
);
557 DEBUG("set fmpvevaccess=0x%04x", k
);
560 * FMPCHOLD, FMPVEVHOLD, FMPVEVSETUP, based on delay.
563 target_write_u32(target
, 0xFFE8A034, k
);
564 DEBUG("set fmpchold=0x%04x", k
);
565 target_write_u32(target
, 0xFFE8A040, k
);
566 DEBUG("set fmpvevhold=0x%04x", k
);
567 target_write_u32(target
, 0xFFE8A024, k
);
568 DEBUG("set fmpvevsetup=0x%04x", k
);
571 * FMCVACCESS, based on delay.
574 target_write_u32(target
, 0xFFE8A060, k
);
575 DEBUG("set fmcvaccess=0x%04x", k
);
578 * FMCSETUP, based on delay.
580 k
= 0x3000 | delay
* 20;
581 target_write_u32(target
, 0xFFE8A020, k
);
582 DEBUG("set fmcsetup=0x%04x", k
);
585 * FMEHOLD, based on delay.
587 k
= (delay
* 20) << 2;
588 target_write_u32(target
, 0xFFE8A038, k
);
589 DEBUG("set fmehold=0x%04x", k
);
592 * PWIDTH, CWIDTH, EWIDTH, based on delay.
594 target_write_u32(target
, 0xFFE8A050, delay
* 8);
595 DEBUG("set fmpwidth=0x%04x", delay
* 8);
596 target_write_u32(target
, 0xFFE8A058, delay
* 1000);
597 DEBUG("set fmcwidth=0x%04x", delay
* 1000);
598 target_write_u32(target
, 0xFFE8A054, delay
* 5400);
599 DEBUG("set fmewidth=0x%04x", delay
* 5400);
604 /* ---------------------------------------------------------------------- */
606 int tms470_flash_status(struct flash_bank_s
*bank
)
608 target_t
*target
= bank
->target
;
609 int result
= ERROR_OK
;
612 target_read_u32(target
, 0xFFE8BC0C, &fmmstat
);
613 DEBUG("set fmmstat=0x%04x", fmmstat
);
615 if (fmmstat
& 0x0080)
617 WARNING("tms470 flash command: erase still active after busy clear.");
618 result
= ERROR_FLASH_OPERATION_FAILED
;
621 if (fmmstat
& 0x0040)
623 WARNING("tms470 flash command: program still active after busy clear.");
624 result
= ERROR_FLASH_OPERATION_FAILED
;
627 if (fmmstat
& 0x0020)
629 WARNING("tms470 flash command: invalid data command.");
630 result
= ERROR_FLASH_OPERATION_FAILED
;
633 if (fmmstat
& 0x0010)
635 WARNING("tms470 flash command: program, erase or validate sector failed.");
636 result
= ERROR_FLASH_OPERATION_FAILED
;
639 if (fmmstat
& 0x0008)
641 WARNING("tms470 flash command: voltage instability detected.");
642 result
= ERROR_FLASH_OPERATION_FAILED
;
645 if (fmmstat
& 0x0006)
647 WARNING("tms470 flash command: command suspend detected.");
648 result
= ERROR_FLASH_OPERATION_FAILED
;
651 if (fmmstat
& 0x0001)
653 WARNING("tms470 flash command: sector was locked.");
654 result
= ERROR_FLASH_OPERATION_FAILED
;
660 /* ---------------------------------------------------------------------- */
662 int tms470_erase_sector(struct flash_bank_s
*bank
, int sector
)
664 u32 glbctrl
, orig_fmregopt
, fmbsea
, fmbseb
, fmmstat
;
665 target_t
*target
= bank
->target
;
666 u32 flashAddr
= bank
->base
+ bank
->sectors
[sector
].offset
;
667 int result
= ERROR_OK
;
670 * Set the bit GLBCTRL4 of the GLBCTRL register (in the System
671 * module) to enable writing to the flash registers }.
673 target_read_u32(target
, 0xFFFFFFDC, &glbctrl
);
674 target_write_u32(target
, 0xFFFFFFDC, glbctrl
| 0x10);
675 DEBUG("set glbctrl=0x%08x", glbctrl
| 0x10);
677 /* Force normal read mode. */
678 target_read_u32(target
, 0xFFE89C00, &orig_fmregopt
);
679 target_write_u32(target
, 0xFFE89C00, 0);
680 DEBUG("set fmregopt=0x%08x", 0);
682 (void)tms470_flash_initialize_internal_state_machine(bank
);
685 * Select one or more bits in FMBSEA or FMBSEB to disable Level 1
686 * protection for the particular sector to be erased/written.
690 target_read_u32(target
, 0xFFE88008, &fmbsea
);
691 target_write_u32(target
, 0xFFE88008, fmbsea
| (1 << sector
));
692 DEBUG("set fmbsea=0x%04x", fmbsea
| (1 << sector
));
696 target_read_u32(target
, 0xFFE8800C, &fmbseb
);
697 target_write_u32(target
, 0xFFE8800C, fmbseb
| (1 << (sector
- 16)));
698 DEBUG("set fmbseb=0x%04x", fmbseb
| (1 << (sector
- 16)));
700 bank
->sectors
[sector
].is_protected
= 0;
703 * clear status regiser, sent erase command, kickoff erase
705 target_write_u16(target
, flashAddr
, 0x0040);
706 DEBUG("write *(u16 *)0x%08x=0x0040", flashAddr
);
707 target_write_u16(target
, flashAddr
, 0x0020);
708 DEBUG("write *(u16 *)0x%08x=0x0020", flashAddr
);
709 target_write_u16(target
, flashAddr
, 0xffff);
710 DEBUG("write *(u16 *)0x%08x=0xffff", flashAddr
);
713 * Monitor FMMSTAT, busy until clear, then check and other flags for
714 * ultimate result of the operation.
718 target_read_u32(target
, 0xFFE8BC0C, &fmmstat
);
719 if (fmmstat
& 0x0100)
724 while (fmmstat
& 0x0100);
726 result
= tms470_flash_status(bank
);
730 target_write_u32(target
, 0xFFE88008, fmbsea
);
731 DEBUG("set fmbsea=0x%04x", fmbsea
);
732 bank
->sectors
[sector
].is_protected
= fmbsea
& (1 << sector
) ? 0 : 1;
736 target_write_u32(target
, 0xFFE8800C, fmbseb
);
737 DEBUG("set fmbseb=0x%04x", fmbseb
);
738 bank
->sectors
[sector
].is_protected
= fmbseb
& (1 << (sector
- 16)) ? 0 : 1;
740 target_write_u32(target
, 0xFFE89C00, orig_fmregopt
);
741 DEBUG("set fmregopt=0x%08x", orig_fmregopt
);
742 target_write_u32(target
, 0xFFFFFFDC, glbctrl
);
743 DEBUG("set glbctrl=0x%08x", glbctrl
);
745 if (result
== ERROR_OK
)
747 bank
->sectors
[sector
].is_erased
= 1;
753 /* ----------------------------------------------------------------------
754 Implementation of Flash Driver Interfaces
755 ---------------------------------------------------------------------- */
757 int tms470_register_commands(struct command_context_s
*cmd_ctx
)
759 command_t
*tms470_cmd
= register_command(cmd_ctx
, NULL
, "tms470", NULL
, COMMAND_ANY
, "applies to TI tms470 family");
761 register_command(cmd_ctx
, tms470_cmd
, "flash_keyset", tms470_handle_flash_keyset_command
, COMMAND_ANY
, "tms470 flash_keyset <key0> <key1> <key2> <key3>");
762 register_command(cmd_ctx
, tms470_cmd
, "osc_megahertz", tms470_handle_osc_megahertz_command
, COMMAND_ANY
, "tms470 osc_megahertz <MHz>");
763 register_command(cmd_ctx
, tms470_cmd
, "plldis", tms470_handle_plldis_command
, COMMAND_ANY
, "tms470 plldis <0/1>");
768 /* ---------------------------------------------------------------------- */
770 int tms470_erase(struct flash_bank_s
*bank
, int first
, int last
)
772 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
773 int sector
, result
= ERROR_OK
;
775 if (bank
->target
->state
!= TARGET_HALTED
)
777 return ERROR_TARGET_NOT_HALTED
;
780 tms470_read_part_info(bank
);
782 if ((first
< 0) || (first
>= bank
->num_sectors
) || (last
< 0) || (last
>= bank
->num_sectors
) || (first
> last
))
784 ERROR("Sector range %d to %d invalid.", first
, last
);
785 return ERROR_FLASH_SECTOR_INVALID
;
788 result
= tms470_unlock_flash(bank
);
789 if (result
!= ERROR_OK
)
794 for (sector
= first
; sector
<= last
; sector
++)
796 INFO("Erasing tms470 bank %d sector %d...", tms470_info
->ordinal
, sector
);
798 result
= tms470_erase_sector(bank
, sector
);
800 if (result
!= ERROR_OK
)
802 ERROR("tms470 could not erase flash sector.");
807 INFO("sector erased successfully.");
814 /* ---------------------------------------------------------------------- */
816 int tms470_protect(struct flash_bank_s
*bank
, int set
, int first
, int last
)
818 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
819 target_t
*target
= bank
->target
;
820 u32 fmmac2
, fmbsea
, fmbseb
;
823 if (target
->state
!= TARGET_HALTED
)
825 return ERROR_TARGET_NOT_HALTED
;
828 tms470_read_part_info(bank
);
830 if ((first
< 0) || (first
>= bank
->num_sectors
) || (last
< 0) || (last
>= bank
->num_sectors
) || (first
> last
))
832 ERROR("Sector range %d to %d invalid.", first
, last
);
833 return ERROR_FLASH_SECTOR_INVALID
;
836 /* enable the appropriate bank */
837 target_read_u32(target
, 0xFFE8BC04, &fmmac2
);
838 target_write_u32(target
, 0xFFE8BC04, (fmmac2
& ~7) | tms470_info
->ordinal
);
840 /* get the original sector proection flags for this bank */
841 target_read_u32(target
, 0xFFE88008, &fmbsea
);
842 target_read_u32(target
, 0xFFE8800C, &fmbseb
);
844 for (sector
= 0; sector
< bank
->num_sectors
; sector
++)
848 fmbsea
= set
? fmbsea
& ~(1 << sector
) : fmbsea
| (1 << sector
);
849 bank
->sectors
[sector
].is_protected
= set
? 1 : 0;
853 fmbseb
= set
? fmbseb
& ~(1 << (sector
- 16)) : fmbseb
| (1 << (sector
- 16));
854 bank
->sectors
[sector
].is_protected
= set
? 1 : 0;
858 /* update the protection bits */
859 target_write_u32(target
, 0xFFE88008, fmbsea
);
860 target_write_u32(target
, 0xFFE8800C, fmbseb
);
865 /* ---------------------------------------------------------------------- */
867 int tms470_write(struct flash_bank_s
*bank
, u8
* buffer
, u32 offset
, u32 count
)
869 target_t
*target
= bank
->target
;
870 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
871 u32 glbctrl
, fmbac2
, orig_fmregopt
, fmbsea
, fmbseb
, fmmaxpp
, fmmstat
;
872 int i
, result
= ERROR_OK
;
874 if (target
->state
!= TARGET_HALTED
)
876 return ERROR_TARGET_NOT_HALTED
;
879 tms470_read_part_info(bank
);
881 INFO("Writing %d bytes starting at 0x%08x", count
, bank
->base
+ offset
);
884 target_read_u32(target
, 0xFFFFFFDC, &glbctrl
);
885 target_write_u32(target
, 0xFFFFFFDC, glbctrl
| 0x10);
887 (void)tms470_flash_initialize_internal_state_machine(bank
);
889 /* force max wait states */
890 target_read_u32(target
, 0xFFE88004, &fmbac2
);
891 target_write_u32(target
, 0xFFE88004, fmbac2
| 0xff);
893 /* save current access mode, force normal read mode */
894 target_read_u32(target
, 0xFFE89C00, &orig_fmregopt
);
895 target_write_u32(target
, 0xFFE89C00, 0x00);
898 * Disable Level 1 protection for all sectors to be erased/written.
900 target_read_u32(target
, 0xFFE88008, &fmbsea
);
901 target_write_u32(target
, 0xFFE88008, 0xffff);
902 target_read_u32(target
, 0xFFE8800C, &fmbseb
);
903 target_write_u32(target
, 0xFFE8800C, 0xffff);
906 target_read_u32(target
, 0xFFE8A07C, &fmmaxpp
);
908 for (i
= 0; i
< count
; i
+= 2)
910 u32 addr
= bank
->base
+ offset
+ i
;
911 u16 word
= (((u16
) buffer
[i
]) << 8) | (u16
) buffer
[i
+ 1];
915 INFO("writing 0x%04x at 0x%08x", word
, addr
);
917 /* clear status register */
918 target_write_u16(target
, addr
, 0x0040);
919 /* program flash command */
920 target_write_u16(target
, addr
, 0x0010);
921 /* burn the 16-bit word (big-endian) */
922 target_write_u16(target
, addr
, word
);
925 * Monitor FMMSTAT, busy until clear, then check and other flags
926 * for ultimate result of the operation.
930 target_read_u32(target
, 0xFFE8BC0C, &fmmstat
);
931 if (fmmstat
& 0x0100)
936 while (fmmstat
& 0x0100);
940 ERROR("fmstat=0x%04x", fmmstat
);
941 ERROR("Could not program word 0x%04x at address 0x%08x.", word
, addr
);
942 result
= ERROR_FLASH_OPERATION_FAILED
;
948 INFO("skipping 0xffff at 0x%08x", addr
);
953 target_write_u32(target
, 0xFFE88008, fmbsea
);
954 target_write_u32(target
, 0xFFE8800C, fmbseb
);
955 target_write_u32(target
, 0xFFE88004, fmbac2
);
956 target_write_u32(target
, 0xFFE89C00, orig_fmregopt
);
957 target_write_u32(target
, 0xFFFFFFDC, glbctrl
);
962 /* ---------------------------------------------------------------------- */
964 int tms470_probe(struct flash_bank_s
*bank
)
966 if (bank
->target
->state
!= TARGET_HALTED
)
968 WARNING("Cannot communicate... target not halted.");
969 return ERROR_TARGET_NOT_HALTED
;
972 return tms470_read_part_info(bank
);
975 int tms470_auto_probe(struct flash_bank_s
*bank
)
977 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
979 if (tms470_info
->device_ident_reg
)
981 return tms470_probe(bank
);
984 /* ---------------------------------------------------------------------- */
986 int tms470_erase_check(struct flash_bank_s
*bank
)
988 target_t
*target
= bank
->target
;
989 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
990 int sector
, result
= ERROR_OK
;
991 u32 fmmac2
, fmbac2
, glbctrl
, orig_fmregopt
;
992 static u8 buffer
[64 * 1024];
994 if (target
->state
!= TARGET_HALTED
)
996 return ERROR_TARGET_NOT_HALTED
;
999 if (!tms470_info
->device_ident_reg
)
1001 tms470_read_part_info(bank
);
1005 target_read_u32(target
, 0xFFFFFFDC, &glbctrl
);
1006 target_write_u32(target
, 0xFFFFFFDC, glbctrl
| 0x10);
1008 /* save current access mode, force normal read mode */
1009 target_read_u32(target
, 0xFFE89C00, &orig_fmregopt
);
1010 target_write_u32(target
, 0xFFE89C00, 0x00);
1012 /* enable the appropriate bank */
1013 target_read_u32(target
, 0xFFE8BC04, &fmmac2
);
1014 target_write_u32(target
, 0xFFE8BC04, (fmmac2
& ~7) | tms470_info
->ordinal
);
1017 target_write_u32(target
, 0xFFE8BC10, 0x2fc0);
1019 /* clear TEZ in fmbrdy */
1020 target_write_u32(target
, 0xFFE88010, 0x0b);
1022 /* save current wait states, force max */
1023 target_read_u32(target
, 0xFFE88004, &fmbac2
);
1024 target_write_u32(target
, 0xFFE88004, fmbac2
| 0xff);
1027 * The TI primitives inspect the flash memory by reading one 32-bit
1028 * word at a time. Here we read an entire sector and inspect it in
1029 * an attempt to reduce the JTAG overhead.
1031 for (sector
= 0; sector
< bank
->num_sectors
; sector
++)
1033 if (bank
->sectors
[sector
].is_erased
!= 1)
1035 u32 i
, addr
= bank
->base
+ bank
->sectors
[sector
].offset
;
1037 INFO("checking flash bank %d sector %d", tms470_info
->ordinal
, sector
);
1039 target_read_buffer(target
, addr
, bank
->sectors
[sector
].size
, buffer
);
1041 bank
->sectors
[sector
].is_erased
= 1;
1042 for (i
= 0; i
< bank
->sectors
[sector
].size
; i
++)
1044 if (buffer
[i
] != 0xff)
1046 WARNING("tms470 bank %d, sector %d, not erased.", tms470_info
->ordinal
, sector
);
1047 WARNING("at location 0x%08x: flash data is 0x%02x.", addr
+ i
, buffer
[i
]);
1049 bank
->sectors
[sector
].is_erased
= 0;
1054 if (bank
->sectors
[sector
].is_erased
!= 1)
1056 result
= ERROR_FLASH_SECTOR_NOT_ERASED
;
1061 INFO("sector erased");
1065 /* reset TEZ, wait states, read mode, GLBCTRL.4 */
1066 target_write_u32(target
, 0xFFE88010, 0x0f);
1067 target_write_u32(target
, 0xFFE88004, fmbac2
);
1068 target_write_u32(target
, 0xFFE89C00, orig_fmregopt
);
1069 target_write_u32(target
, 0xFFFFFFDC, glbctrl
);
1074 /* ---------------------------------------------------------------------- */
1076 int tms470_protect_check(struct flash_bank_s
*bank
)
1078 target_t
*target
= bank
->target
;
1079 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
1080 int sector
, result
= ERROR_OK
;
1081 u32 fmmac2
, fmbsea
, fmbseb
;
1083 if (target
->state
!= TARGET_HALTED
)
1085 return ERROR_TARGET_NOT_HALTED
;
1088 if (!tms470_info
->device_ident_reg
)
1090 tms470_read_part_info(bank
);
1093 /* enable the appropriate bank */
1094 target_read_u32(target
, 0xFFE8BC04, &fmmac2
);
1095 target_write_u32(target
, 0xFFE8BC04, (fmmac2
& ~7) | tms470_info
->ordinal
);
1097 target_read_u32(target
, 0xFFE88008, &fmbsea
);
1098 target_read_u32(target
, 0xFFE8800C, &fmbseb
);
1100 for (sector
= 0; sector
< bank
->num_sectors
; sector
++)
1106 protected = fmbsea
& (1 << sector
) ? 0 : 1;
1107 bank
->sectors
[sector
].is_protected
= protected;
1111 protected = fmbseb
& (1 << (sector
- 16)) ? 0 : 1;
1112 bank
->sectors
[sector
].is_protected
= protected;
1115 DEBUG("bank %d sector %d is %s", tms470_info
->ordinal
, sector
, protected ? "protected" : "not protected");
1121 /* ---------------------------------------------------------------------- */
1123 int tms470_info(struct flash_bank_s
*bank
, char *buf
, int buf_size
)
1126 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
1128 if (!tms470_info
->device_ident_reg
)
1130 tms470_read_part_info(bank
);
1133 if (!tms470_info
->device_ident_reg
)
1135 (void)snprintf(buf
, buf_size
, "Cannot identify target as a TMS470\n");
1136 return ERROR_FLASH_OPERATION_FAILED
;
1139 used
+= snprintf(buf
, buf_size
, "\ntms470 information: Chip is %s\n", tms470_info
->part_name
);
1143 used
+= snprintf(buf
, buf_size
, "Flash protection level 2 is %s\n", tms470_check_flash_unlocked(bank
->target
) == ERROR_OK
? "disabled" : "enabled");
1150 /* ---------------------------------------------------------------------- */
1153 * flash bank tms470 <base> <size> <chip_width> <bus_width> <target>
1157 int tms470_flash_bank_command(struct command_context_s
*cmd_ctx
, char *cmd
, char **args
, int argc
, struct flash_bank_s
*bank
)
1159 bank
->driver_priv
= malloc(sizeof(tms470_flash_bank_t
));
1161 if (!bank
->driver_priv
)
1163 return ERROR_FLASH_OPERATION_FAILED
;
1166 (void)memset(bank
->driver_priv
, 0, sizeof(tms470_flash_bank_t
));
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)