1 /***************************************************************************
2 * Copyright (C) 2007,2008 by Christopher Kilgour *
3 * techie |_at_| whiterocker |_dot_| com *
5 * This program is free software; you can redistribute it and/or modify *
6 * it under the terms of the GNU General Public License as published by *
7 * the Free Software Foundation; either version 2 of the License, or *
8 * (at your option) any later version. *
10 * This program is distributed in the hope that it will be useful, *
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
13 * GNU General Public License for more details. *
15 * You should have received a copy of the GNU General Public License *
16 * along with this program; if not, write to the *
17 * Free Software Foundation, Inc., *
18 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
19 ***************************************************************************/
29 int tms470_register_commands(struct command_context_s
*cmd_ctx
);
30 int tms470_flash_bank_command(struct command_context_s
*cmd_ctx
, char *cmd
, char **args
, int argc
, struct flash_bank_s
*bank
);
31 int tms470_erase(struct flash_bank_s
*bank
, int first
, int last
);
32 int tms470_protect(struct flash_bank_s
*bank
, int set
, int first
, int last
);
33 int tms470_write(struct flash_bank_s
*bank
, u8
* buffer
, u32 offset
, u32 count
);
34 int tms470_probe(struct flash_bank_s
*bank
);
35 int tms470_auto_probe(struct flash_bank_s
*bank
);
36 int tms470_erase_check(struct flash_bank_s
*bank
);
37 int tms470_protect_check(struct flash_bank_s
*bank
);
38 int tms470_info(struct flash_bank_s
*bank
, char *buf
, int buf_size
);
40 flash_driver_t tms470_flash
= {
42 .register_commands
= tms470_register_commands
,
43 .flash_bank_command
= tms470_flash_bank_command
,
44 .erase
= tms470_erase
,
45 .protect
= tms470_protect
,
46 .write
= tms470_write
,
47 .probe
= tms470_probe
,
48 .auto_probe
= tms470_auto_probe
,
49 .erase_check
= tms470_erase_check
,
50 .protect_check
= tms470_protect_check
,
54 /* ----------------------------------------------------------------------
55 Internal Support, Helpers
56 ---------------------------------------------------------------------- */
58 const flash_sector_t TMS470R1A256_SECTORS
[] = {
59 {0x00000000, 0x00002000, -1, -1},
60 {0x00002000, 0x00002000, -1, -1},
61 {0x00004000, 0x00002000, -1, -1},
62 {0x00006000, 0x00002000, -1, -1},
63 {0x00008000, 0x00008000, -1, -1},
64 {0x00010000, 0x00008000, -1, -1},
65 {0x00018000, 0x00008000, -1, -1},
66 {0x00020000, 0x00008000, -1, -1},
67 {0x00028000, 0x00008000, -1, -1},
68 {0x00030000, 0x00008000, -1, -1},
69 {0x00038000, 0x00002000, -1, -1},
70 {0x0003A000, 0x00002000, -1, -1},
71 {0x0003C000, 0x00002000, -1, -1},
72 {0x0003E000, 0x00002000, -1, -1},
75 #define TMS470R1A256_NUM_SECTORS \
76 (sizeof(TMS470R1A256_SECTORS)/sizeof(TMS470R1A256_SECTORS[0]))
78 const flash_sector_t TMS470R1A288_BANK0_SECTORS
[] = {
79 {0x00000000, 0x00002000, -1, -1},
80 {0x00002000, 0x00002000, -1, -1},
81 {0x00004000, 0x00002000, -1, -1},
82 {0x00006000, 0x00002000, -1, -1},
85 #define TMS470R1A288_BANK0_NUM_SECTORS \
86 (sizeof(TMS470R1A288_BANK0_SECTORS)/sizeof(TMS470R1A288_BANK0_SECTORS[0]))
88 const flash_sector_t TMS470R1A288_BANK1_SECTORS
[] = {
89 {0x00040000, 0x00010000, -1, -1},
90 {0x00050000, 0x00010000, -1, -1},
91 {0x00060000, 0x00010000, -1, -1},
92 {0x00070000, 0x00010000, -1, -1},
95 #define TMS470R1A288_BANK1_NUM_SECTORS \
96 (sizeof(TMS470R1A288_BANK1_SECTORS)/sizeof(TMS470R1A288_BANK1_SECTORS[0]))
98 /* ---------------------------------------------------------------------- */
100 int tms470_read_part_info(struct flash_bank_s
*bank
)
102 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
103 target_t
*target
= bank
->target
;
104 u32 device_ident_reg
;
106 u32 technology_family
;
111 /* we shall not rely on the caller in this test, this function allocates memory,
112 thus and executing the code more than once may cause memory leak */
113 if (tms470_info
->device_ident_reg
)
116 /* read and parse the device identification register */
117 target_read_u32(target
, 0xFFFFFFF0, &device_ident_reg
);
119 LOG_INFO("device_ident_reg=0x%08x", device_ident_reg
);
121 if ((device_ident_reg
& 7) == 0)
123 LOG_WARNING("Cannot identify target as a TMS470 family.");
124 return ERROR_FLASH_OPERATION_FAILED
;
127 silicon_version
= (device_ident_reg
>> 12) & 0xF;
128 technology_family
= (device_ident_reg
>> 11) & 1;
129 rom_flash
= (device_ident_reg
>> 10) & 1;
130 part_number
= (device_ident_reg
>> 3) & 0x7f;
133 * If the part number is known, determine if the flash bank is valid
134 * based on the base address being within the known flash bank
135 * ranges. Then fixup/complete the remaining fields of the flash
141 part_name
= "TMS470R1A256";
143 if (bank
->base
>= 0x00040000)
145 LOG_ERROR("No %s flash bank contains base address 0x%08x.", part_name
, bank
->base
);
146 return ERROR_FLASH_OPERATION_FAILED
;
148 tms470_info
->ordinal
= 0;
149 bank
->base
= 0x00000000;
150 bank
->size
= 256 * 1024;
151 bank
->num_sectors
= TMS470R1A256_NUM_SECTORS
;
152 bank
->sectors
= malloc(sizeof(TMS470R1A256_SECTORS
));
155 return ERROR_FLASH_OPERATION_FAILED
;
157 (void)memcpy(bank
->sectors
, TMS470R1A256_SECTORS
, sizeof(TMS470R1A256_SECTORS
));
161 part_name
= "TMS470R1A288";
163 if ((bank
->base
>= 0x00000000) && (bank
->base
< 0x00008000))
165 tms470_info
->ordinal
= 0;
166 bank
->base
= 0x00000000;
167 bank
->size
= 32 * 1024;
168 bank
->num_sectors
= TMS470R1A288_BANK0_NUM_SECTORS
;
169 bank
->sectors
= malloc(sizeof(TMS470R1A288_BANK0_SECTORS
));
172 return ERROR_FLASH_OPERATION_FAILED
;
174 (void)memcpy(bank
->sectors
, TMS470R1A288_BANK0_SECTORS
, sizeof(TMS470R1A288_BANK0_SECTORS
));
176 else if ((bank
->base
>= 0x00040000) && (bank
->base
< 0x00080000))
178 tms470_info
->ordinal
= 1;
179 bank
->base
= 0x00040000;
180 bank
->size
= 256 * 1024;
181 bank
->num_sectors
= TMS470R1A288_BANK1_NUM_SECTORS
;
182 bank
->sectors
= malloc(sizeof(TMS470R1A288_BANK1_SECTORS
));
185 return ERROR_FLASH_OPERATION_FAILED
;
187 (void)memcpy(bank
->sectors
, TMS470R1A288_BANK1_SECTORS
, sizeof(TMS470R1A288_BANK1_SECTORS
));
191 LOG_ERROR("No %s flash bank contains base address 0x%08x.", part_name
, bank
->base
);
192 return ERROR_FLASH_OPERATION_FAILED
;
197 LOG_WARNING("Could not identify part 0x%02x as a member of the TMS470 family.", part_number
);
198 return ERROR_FLASH_OPERATION_FAILED
;
201 /* turn off memory selects */
202 target_write_u32(target
, 0xFFFFFFE4, 0x00000000);
203 target_write_u32(target
, 0xFFFFFFE0, 0x00000000);
205 bank
->chip_width
= 32;
206 bank
->bus_width
= 32;
208 LOG_INFO("Identified %s, ver=%d, core=%s, nvmem=%s.", part_name
, silicon_version
, (technology_family
? "1.8v" : "3.3v"), (rom_flash
? "rom" : "flash"));
210 tms470_info
->device_ident_reg
= device_ident_reg
;
211 tms470_info
->silicon_version
= silicon_version
;
212 tms470_info
->technology_family
= technology_family
;
213 tms470_info
->rom_flash
= rom_flash
;
214 tms470_info
->part_number
= part_number
;
215 tms470_info
->part_name
= part_name
;
218 * Disable reset on address access violation.
220 target_write_u32(target
, 0xFFFFFFE0, 0x00004007);
225 /* ---------------------------------------------------------------------- */
230 int tms470_handle_flash_keyset_command(struct command_context_s
*cmd_ctx
, char *cmd
, char **args
, int argc
)
234 command_print(cmd_ctx
, "tms470 flash_keyset <key0> <key1> <key2> <key3>");
235 return ERROR_INVALID_ARGUMENTS
;
241 for (i
= 0; i
< 4; i
++)
243 int start
= (0 == strncmp(args
[i
], "0x", 2)) ? 2 : 0;
245 if (1 != sscanf(&args
[i
][start
], "%x", &flashKeys
[i
]))
247 command_print(cmd_ctx
, "could not process flash key %s", args
[i
]);
248 LOG_ERROR("could not process flash key %s", args
[i
]);
249 return ERROR_INVALID_ARGUMENTS
;
257 command_print(cmd_ctx
, "tms470 flash_keyset <key0> <key1> <key2> <key3>");
258 return ERROR_INVALID_ARGUMENTS
;
263 command_print(cmd_ctx
, "using flash keys 0x%08x, 0x%08x, 0x%08x, 0x%08x", flashKeys
[0], flashKeys
[1], flashKeys
[2], flashKeys
[3]);
267 command_print(cmd_ctx
, "flash keys not set");
273 const u32 FLASH_KEYS_ALL_ONES
[] = { 0xFFFFFFFF, 0xFFFFFFFF,
274 0xFFFFFFFF, 0xFFFFFFFF,
277 const u32 FLASH_KEYS_ALL_ZEROS
[] = { 0x00000000, 0x00000000,
278 0x00000000, 0x00000000,
281 const u32 FLASH_KEYS_MIX1
[] = { 0xf0fff0ff, 0xf0fff0ff,
282 0xf0fff0ff, 0xf0fff0ff
285 const u32 FLASH_KEYS_MIX2
[] = { 0x0000ffff, 0x0000ffff,
286 0x0000ffff, 0x0000ffff
289 /* ---------------------------------------------------------------------- */
293 int tms470_handle_osc_megahertz_command(struct command_context_s
*cmd_ctx
, char *cmd
, char **args
, int argc
)
297 command_print(cmd_ctx
, "tms470 osc_megahertz <MHz>");
298 return ERROR_INVALID_ARGUMENTS
;
302 sscanf(args
[0], "%d", &oscMHz
);
307 LOG_ERROR("osc_megahertz must be positive and non-zero!");
308 command_print(cmd_ctx
, "osc_megahertz must be positive and non-zero!");
310 return ERROR_INVALID_ARGUMENTS
;
313 command_print(cmd_ctx
, "osc_megahertz=%d", oscMHz
);
318 /* ---------------------------------------------------------------------- */
322 int tms470_handle_plldis_command(struct command_context_s
*cmd_ctx
, char *cmd
, char **args
, int argc
)
326 command_print(cmd_ctx
, "tms470 plldis <0|1>");
327 return ERROR_INVALID_ARGUMENTS
;
331 sscanf(args
[0], "%d", &plldis
);
332 plldis
= plldis
? 1 : 0;
335 command_print(cmd_ctx
, "plldis=%d", plldis
);
340 /* ---------------------------------------------------------------------- */
342 int tms470_check_flash_unlocked(target_t
* target
)
346 target_read_u32(target
, 0xFFE89C08, &fmbbusy
);
347 LOG_INFO("tms470 fmbbusy=0x%08x -> %s", fmbbusy
, fmbbusy
& 0x8000 ? "unlocked" : "LOCKED");
348 return fmbbusy
& 0x8000 ? ERROR_OK
: ERROR_FLASH_OPERATION_FAILED
;
351 /* ---------------------------------------------------------------------- */
353 int tms470_try_flash_keys(target_t
* target
, const u32
* key_set
)
355 u32 glbctrl
, fmmstat
;
356 int retval
= ERROR_FLASH_OPERATION_FAILED
;
359 target_read_u32(target
, 0xFFFFFFDC, &glbctrl
);
360 target_write_u32(target
, 0xFFFFFFDC, glbctrl
| 0x10);
362 /* only perform the key match when 3VSTAT is clear */
363 target_read_u32(target
, 0xFFE8BC0C, &fmmstat
);
364 if (!(fmmstat
& 0x08))
367 u32 fmbptr
, fmbac2
, orig_fmregopt
;
369 target_write_u32(target
, 0xFFE8BC04, fmmstat
& ~0x07);
371 /* wait for pump ready */
374 target_read_u32(target
, 0xFFE8A814, &fmbptr
);
377 while (!(fmbptr
& 0x0200));
379 /* force max wait states */
380 target_read_u32(target
, 0xFFE88004, &fmbac2
);
381 target_write_u32(target
, 0xFFE88004, fmbac2
| 0xff);
383 /* save current access mode, force normal read mode */
384 target_read_u32(target
, 0xFFE89C00, &orig_fmregopt
);
385 target_write_u32(target
, 0xFFE89C00, 0x00);
387 for (i
= 0; i
< 4; i
++)
391 /* There is no point displaying the value of tmp, it is
392 * filtered by the chip. The purpose of this read is to
393 * prime the unlocking logic rather than read out the value.
395 target_read_u32(target
, 0x00001FF0 + 4 * i
, &tmp
);
397 LOG_INFO("tms470 writing fmpkey=0x%08x", key_set
[i
]);
398 target_write_u32(target
, 0xFFE89C0C, key_set
[i
]);
401 if (ERROR_OK
== tms470_check_flash_unlocked(target
))
404 * There seems to be a side-effect of reading the FMPKEY
405 * register in that it re-enables the protection. So we
408 for (i
= 0; i
< 4; i
++)
412 target_read_u32(target
, 0x00001FF0 + 4 * i
, &tmp
);
413 target_write_u32(target
, 0xFFE89C0C, key_set
[i
]);
418 /* restore settings */
419 target_write_u32(target
, 0xFFE89C00, orig_fmregopt
);
420 target_write_u32(target
, 0xFFE88004, fmbac2
);
423 /* clear config bit */
424 target_write_u32(target
, 0xFFFFFFDC, glbctrl
);
429 /* ---------------------------------------------------------------------- */
431 int tms470_unlock_flash(struct flash_bank_s
*bank
)
433 target_t
*target
= bank
->target
;
434 const u32
*p_key_sets
[5];
435 unsigned i
, key_set_count
;
440 p_key_sets
[0] = flashKeys
;
441 p_key_sets
[1] = FLASH_KEYS_ALL_ONES
;
442 p_key_sets
[2] = FLASH_KEYS_ALL_ZEROS
;
443 p_key_sets
[3] = FLASH_KEYS_MIX1
;
444 p_key_sets
[4] = FLASH_KEYS_MIX2
;
449 p_key_sets
[0] = FLASH_KEYS_ALL_ONES
;
450 p_key_sets
[1] = FLASH_KEYS_ALL_ZEROS
;
451 p_key_sets
[2] = FLASH_KEYS_MIX1
;
452 p_key_sets
[3] = FLASH_KEYS_MIX2
;
455 for (i
= 0; i
< key_set_count
; i
++)
457 if (tms470_try_flash_keys(target
, p_key_sets
[i
]) == ERROR_OK
)
459 LOG_INFO("tms470 flash is unlocked");
464 LOG_WARNING("tms470 could not unlock flash memory protection level 2");
465 return ERROR_FLASH_OPERATION_FAILED
;
468 /* ---------------------------------------------------------------------- */
470 int tms470_flash_initialize_internal_state_machine(struct flash_bank_s
*bank
)
472 u32 fmmac2
, fmmac1
, fmmaxep
, k
, delay
, glbctrl
, sysclk
;
473 target_t
*target
= bank
->target
;
474 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
475 int result
= ERROR_OK
;
478 * Select the desired bank to be programmed by writing BANK[2:0] of
481 target_read_u32(target
, 0xFFE8BC04, &fmmac2
);
483 fmmac2
|= (tms470_info
->ordinal
& 7);
484 target_write_u32(target
, 0xFFE8BC04, fmmac2
);
485 LOG_DEBUG("set fmmac2=0x%04x", fmmac2
);
488 * Disable level 1 sector protection by setting bit 15 of FMMAC1.
490 target_read_u32(target
, 0xFFE8BC00, &fmmac1
);
492 target_write_u32(target
, 0xFFE8BC00, fmmac1
);
493 LOG_DEBUG("set fmmac1=0x%04x", fmmac1
);
498 target_write_u32(target
, 0xFFE8BC10, 0x2fc0);
499 LOG_DEBUG("set fmtcreg=0x2fc0");
504 target_write_u32(target
, 0xFFE8A07C, 50);
505 LOG_DEBUG("set fmmaxpp=50");
510 target_write_u32(target
, 0xFFE8A084, 0xf000 + 2000);
511 LOG_DEBUG("set fmmaxcp=0x%04x", 0xf000 + 2000);
516 target_read_u32(target
, 0xFFE8A080, &fmmaxep
);
517 if (fmmaxep
== 0xf000)
519 fmmaxep
= 0xf000 + 4095;
520 target_write_u32(target
, 0xFFE8A80C, 0x9964);
521 LOG_DEBUG("set fmptr3=0x9964");
525 fmmaxep
= 0xa000 + 4095;
526 target_write_u32(target
, 0xFFE8A80C, 0x9b64);
527 LOG_DEBUG("set fmptr3=0x9b64");
529 target_write_u32(target
, 0xFFE8A080, fmmaxep
);
530 LOG_DEBUG("set fmmaxep=0x%04x", fmmaxep
);
535 target_write_u32(target
, 0xFFE8A810, 0xa000);
536 LOG_DEBUG("set fmptr4=0xa000");
539 * FMPESETUP, delay parameter selected based on clock frequency.
541 * According to the TI App Note SPNU257 and flashing code, delay is
542 * int((sysclk(MHz) + 1) / 2), with a minimum of 5. The system
543 * clock is usually derived from the ZPLL module, and selected by
546 target_read_u32(target
, 0xFFFFFFDC, &glbctrl
);
547 sysclk
= (plldis
? 1 : (glbctrl
& 0x08) ? 4 : 8) * oscMHz
/ (1 + (glbctrl
& 7));
548 delay
= (sysclk
> 10) ? (sysclk
+ 1) / 2 : 5;
549 target_write_u32(target
, 0xFFE8A018, (delay
<< 4) | (delay
<< 8));
550 LOG_DEBUG("set fmpsetup=0x%04x", (delay
<< 4) | (delay
<< 8));
553 * FMPVEVACCESS, based on delay.
555 k
= delay
| (delay
<< 8);
556 target_write_u32(target
, 0xFFE8A05C, k
);
557 LOG_DEBUG("set fmpvevaccess=0x%04x", k
);
560 * FMPCHOLD, FMPVEVHOLD, FMPVEVSETUP, based on delay.
563 target_write_u32(target
, 0xFFE8A034, k
);
564 LOG_DEBUG("set fmpchold=0x%04x", k
);
565 target_write_u32(target
, 0xFFE8A040, k
);
566 LOG_DEBUG("set fmpvevhold=0x%04x", k
);
567 target_write_u32(target
, 0xFFE8A024, k
);
568 LOG_DEBUG("set fmpvevsetup=0x%04x", k
);
571 * FMCVACCESS, based on delay.
574 target_write_u32(target
, 0xFFE8A060, k
);
575 LOG_DEBUG("set fmcvaccess=0x%04x", k
);
578 * FMCSETUP, based on delay.
580 k
= 0x3000 | delay
* 20;
581 target_write_u32(target
, 0xFFE8A020, k
);
582 LOG_DEBUG("set fmcsetup=0x%04x", k
);
585 * FMEHOLD, based on delay.
587 k
= (delay
* 20) << 2;
588 target_write_u32(target
, 0xFFE8A038, k
);
589 LOG_DEBUG("set fmehold=0x%04x", k
);
592 * PWIDTH, CWIDTH, EWIDTH, based on delay.
594 target_write_u32(target
, 0xFFE8A050, delay
* 8);
595 LOG_DEBUG("set fmpwidth=0x%04x", delay
* 8);
596 target_write_u32(target
, 0xFFE8A058, delay
* 1000);
597 LOG_DEBUG("set fmcwidth=0x%04x", delay
* 1000);
598 target_write_u32(target
, 0xFFE8A054, delay
* 5400);
599 LOG_DEBUG("set fmewidth=0x%04x", delay
* 5400);
604 /* ---------------------------------------------------------------------- */
606 int tms470_flash_status(struct flash_bank_s
*bank
)
608 target_t
*target
= bank
->target
;
609 int result
= ERROR_OK
;
612 target_read_u32(target
, 0xFFE8BC0C, &fmmstat
);
613 LOG_DEBUG("set fmmstat=0x%04x", fmmstat
);
615 if (fmmstat
& 0x0080)
617 LOG_WARNING("tms470 flash command: erase still active after busy clear.");
618 result
= ERROR_FLASH_OPERATION_FAILED
;
621 if (fmmstat
& 0x0040)
623 LOG_WARNING("tms470 flash command: program still active after busy clear.");
624 result
= ERROR_FLASH_OPERATION_FAILED
;
627 if (fmmstat
& 0x0020)
629 LOG_WARNING("tms470 flash command: invalid data command.");
630 result
= ERROR_FLASH_OPERATION_FAILED
;
633 if (fmmstat
& 0x0010)
635 LOG_WARNING("tms470 flash command: program, erase or validate sector failed.");
636 result
= ERROR_FLASH_OPERATION_FAILED
;
639 if (fmmstat
& 0x0008)
641 LOG_WARNING("tms470 flash command: voltage instability detected.");
642 result
= ERROR_FLASH_OPERATION_FAILED
;
645 if (fmmstat
& 0x0006)
647 LOG_WARNING("tms470 flash command: command suspend detected.");
648 result
= ERROR_FLASH_OPERATION_FAILED
;
651 if (fmmstat
& 0x0001)
653 LOG_WARNING("tms470 flash command: sector was locked.");
654 result
= ERROR_FLASH_OPERATION_FAILED
;
660 /* ---------------------------------------------------------------------- */
662 int tms470_erase_sector(struct flash_bank_s
*bank
, int sector
)
664 u32 glbctrl
, orig_fmregopt
, fmbsea
, fmbseb
, fmmstat
;
665 target_t
*target
= bank
->target
;
666 u32 flashAddr
= bank
->base
+ bank
->sectors
[sector
].offset
;
667 int result
= ERROR_OK
;
670 * Set the bit GLBCTRL4 of the GLBCTRL register (in the System
671 * module) to enable writing to the flash registers }.
673 target_read_u32(target
, 0xFFFFFFDC, &glbctrl
);
674 target_write_u32(target
, 0xFFFFFFDC, glbctrl
| 0x10);
675 LOG_DEBUG("set glbctrl=0x%08x", glbctrl
| 0x10);
677 /* Force normal read mode. */
678 target_read_u32(target
, 0xFFE89C00, &orig_fmregopt
);
679 target_write_u32(target
, 0xFFE89C00, 0);
680 LOG_DEBUG("set fmregopt=0x%08x", 0);
682 (void)tms470_flash_initialize_internal_state_machine(bank
);
685 * Select one or more bits in FMBSEA or FMBSEB to disable Level 1
686 * protection for the particular sector to be erased/written.
690 target_read_u32(target
, 0xFFE88008, &fmbsea
);
691 target_write_u32(target
, 0xFFE88008, fmbsea
| (1 << sector
));
692 LOG_DEBUG("set fmbsea=0x%04x", fmbsea
| (1 << sector
));
696 target_read_u32(target
, 0xFFE8800C, &fmbseb
);
697 target_write_u32(target
, 0xFFE8800C, fmbseb
| (1 << (sector
- 16)));
698 LOG_DEBUG("set fmbseb=0x%04x", fmbseb
| (1 << (sector
- 16)));
700 bank
->sectors
[sector
].is_protected
= 0;
703 * clear status regiser, sent erase command, kickoff erase
705 target_write_u16(target
, flashAddr
, 0x0040);
706 LOG_DEBUG("write *(u16 *)0x%08x=0x0040", flashAddr
);
707 target_write_u16(target
, flashAddr
, 0x0020);
708 LOG_DEBUG("write *(u16 *)0x%08x=0x0020", flashAddr
);
709 target_write_u16(target
, flashAddr
, 0xffff);
710 LOG_DEBUG("write *(u16 *)0x%08x=0xffff", flashAddr
);
713 * Monitor FMMSTAT, busy until clear, then check and other flags for
714 * ultimate result of the operation.
718 target_read_u32(target
, 0xFFE8BC0C, &fmmstat
);
719 if (fmmstat
& 0x0100)
724 while (fmmstat
& 0x0100);
726 result
= tms470_flash_status(bank
);
730 target_write_u32(target
, 0xFFE88008, fmbsea
);
731 LOG_DEBUG("set fmbsea=0x%04x", fmbsea
);
732 bank
->sectors
[sector
].is_protected
= fmbsea
& (1 << sector
) ? 0 : 1;
736 target_write_u32(target
, 0xFFE8800C, fmbseb
);
737 LOG_DEBUG("set fmbseb=0x%04x", fmbseb
);
738 bank
->sectors
[sector
].is_protected
= fmbseb
& (1 << (sector
- 16)) ? 0 : 1;
740 target_write_u32(target
, 0xFFE89C00, orig_fmregopt
);
741 LOG_DEBUG("set fmregopt=0x%08x", orig_fmregopt
);
742 target_write_u32(target
, 0xFFFFFFDC, glbctrl
);
743 LOG_DEBUG("set glbctrl=0x%08x", glbctrl
);
745 if (result
== ERROR_OK
)
747 bank
->sectors
[sector
].is_erased
= 1;
753 /* ----------------------------------------------------------------------
754 Implementation of Flash Driver Interfaces
755 ---------------------------------------------------------------------- */
757 int tms470_register_commands(struct command_context_s
*cmd_ctx
)
759 command_t
*tms470_cmd
= register_command(cmd_ctx
, NULL
, "tms470", NULL
, COMMAND_ANY
, "applies to TI tms470 family");
761 register_command(cmd_ctx
, tms470_cmd
, "flash_keyset", tms470_handle_flash_keyset_command
, COMMAND_ANY
, "tms470 flash_keyset <key0> <key1> <key2> <key3>");
762 register_command(cmd_ctx
, tms470_cmd
, "osc_megahertz", tms470_handle_osc_megahertz_command
, COMMAND_ANY
, "tms470 osc_megahertz <MHz>");
763 register_command(cmd_ctx
, tms470_cmd
, "plldis", tms470_handle_plldis_command
, COMMAND_ANY
, "tms470 plldis <0/1>");
768 /* ---------------------------------------------------------------------- */
770 int tms470_erase(struct flash_bank_s
*bank
, int first
, int last
)
772 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
773 int sector
, result
= ERROR_OK
;
775 if (bank
->target
->state
!= TARGET_HALTED
)
777 return ERROR_TARGET_NOT_HALTED
;
780 tms470_read_part_info(bank
);
782 if ((first
< 0) || (first
>= bank
->num_sectors
) || (last
< 0) || (last
>= bank
->num_sectors
) || (first
> last
))
784 LOG_ERROR("Sector range %d to %d invalid.", first
, last
);
785 return ERROR_FLASH_SECTOR_INVALID
;
788 result
= tms470_unlock_flash(bank
);
789 if (result
!= ERROR_OK
)
794 for (sector
= first
; sector
<= last
; sector
++)
796 LOG_INFO("Erasing tms470 bank %d sector %d...", tms470_info
->ordinal
, sector
);
798 result
= tms470_erase_sector(bank
, sector
);
800 if (result
!= ERROR_OK
)
802 LOG_ERROR("tms470 could not erase flash sector.");
807 LOG_INFO("sector erased successfully.");
814 /* ---------------------------------------------------------------------- */
816 int tms470_protect(struct flash_bank_s
*bank
, int set
, int first
, int last
)
818 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
819 target_t
*target
= bank
->target
;
820 u32 fmmac2
, fmbsea
, fmbseb
;
823 if (target
->state
!= TARGET_HALTED
)
825 return ERROR_TARGET_NOT_HALTED
;
828 tms470_read_part_info(bank
);
830 if ((first
< 0) || (first
>= bank
->num_sectors
) || (last
< 0) || (last
>= bank
->num_sectors
) || (first
> last
))
832 LOG_ERROR("Sector range %d to %d invalid.", first
, last
);
833 return ERROR_FLASH_SECTOR_INVALID
;
836 /* enable the appropriate bank */
837 target_read_u32(target
, 0xFFE8BC04, &fmmac2
);
838 target_write_u32(target
, 0xFFE8BC04, (fmmac2
& ~7) | tms470_info
->ordinal
);
840 /* get the original sector proection flags for this bank */
841 target_read_u32(target
, 0xFFE88008, &fmbsea
);
842 target_read_u32(target
, 0xFFE8800C, &fmbseb
);
844 for (sector
= 0; sector
< bank
->num_sectors
; sector
++)
848 fmbsea
= set
? fmbsea
& ~(1 << sector
) : fmbsea
| (1 << sector
);
849 bank
->sectors
[sector
].is_protected
= set
? 1 : 0;
853 fmbseb
= set
? fmbseb
& ~(1 << (sector
- 16)) : fmbseb
| (1 << (sector
- 16));
854 bank
->sectors
[sector
].is_protected
= set
? 1 : 0;
858 /* update the protection bits */
859 target_write_u32(target
, 0xFFE88008, fmbsea
);
860 target_write_u32(target
, 0xFFE8800C, fmbseb
);
865 /* ---------------------------------------------------------------------- */
867 int tms470_write(struct flash_bank_s
*bank
, u8
* buffer
, u32 offset
, u32 count
)
869 target_t
*target
= bank
->target
;
870 u32 glbctrl
, fmbac2
, orig_fmregopt
, fmbsea
, fmbseb
, fmmaxpp
, fmmstat
;
871 int i
, result
= ERROR_OK
;
873 if (target
->state
!= TARGET_HALTED
)
875 return ERROR_TARGET_NOT_HALTED
;
878 tms470_read_part_info(bank
);
880 LOG_INFO("Writing %d bytes starting at 0x%08x", count
, bank
->base
+ offset
);
883 target_read_u32(target
, 0xFFFFFFDC, &glbctrl
);
884 target_write_u32(target
, 0xFFFFFFDC, glbctrl
| 0x10);
886 (void)tms470_flash_initialize_internal_state_machine(bank
);
888 /* force max wait states */
889 target_read_u32(target
, 0xFFE88004, &fmbac2
);
890 target_write_u32(target
, 0xFFE88004, fmbac2
| 0xff);
892 /* save current access mode, force normal read mode */
893 target_read_u32(target
, 0xFFE89C00, &orig_fmregopt
);
894 target_write_u32(target
, 0xFFE89C00, 0x00);
897 * Disable Level 1 protection for all sectors to be erased/written.
899 target_read_u32(target
, 0xFFE88008, &fmbsea
);
900 target_write_u32(target
, 0xFFE88008, 0xffff);
901 target_read_u32(target
, 0xFFE8800C, &fmbseb
);
902 target_write_u32(target
, 0xFFE8800C, 0xffff);
905 target_read_u32(target
, 0xFFE8A07C, &fmmaxpp
);
907 for (i
= 0; i
< count
; i
+= 2)
909 u32 addr
= bank
->base
+ offset
+ i
;
910 u16 word
= (((u16
) buffer
[i
]) << 8) | (u16
) buffer
[i
+ 1];
914 LOG_INFO("writing 0x%04x at 0x%08x", word
, addr
);
916 /* clear status register */
917 target_write_u16(target
, addr
, 0x0040);
918 /* program flash command */
919 target_write_u16(target
, addr
, 0x0010);
920 /* burn the 16-bit word (big-endian) */
921 target_write_u16(target
, addr
, word
);
924 * Monitor FMMSTAT, busy until clear, then check and other flags
925 * for ultimate result of the operation.
929 target_read_u32(target
, 0xFFE8BC0C, &fmmstat
);
930 if (fmmstat
& 0x0100)
935 while (fmmstat
& 0x0100);
939 LOG_ERROR("fmstat=0x%04x", fmmstat
);
940 LOG_ERROR("Could not program word 0x%04x at address 0x%08x.", word
, addr
);
941 result
= ERROR_FLASH_OPERATION_FAILED
;
947 LOG_INFO("skipping 0xffff at 0x%08x", addr
);
952 target_write_u32(target
, 0xFFE88008, fmbsea
);
953 target_write_u32(target
, 0xFFE8800C, fmbseb
);
954 target_write_u32(target
, 0xFFE88004, fmbac2
);
955 target_write_u32(target
, 0xFFE89C00, orig_fmregopt
);
956 target_write_u32(target
, 0xFFFFFFDC, glbctrl
);
961 /* ---------------------------------------------------------------------- */
963 int tms470_probe(struct flash_bank_s
*bank
)
965 if (bank
->target
->state
!= TARGET_HALTED
)
967 LOG_WARNING("Cannot communicate... target not halted.");
968 return ERROR_TARGET_NOT_HALTED
;
971 return tms470_read_part_info(bank
);
974 int tms470_auto_probe(struct flash_bank_s
*bank
)
976 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
978 if (tms470_info
->device_ident_reg
)
980 return tms470_probe(bank
);
983 /* ---------------------------------------------------------------------- */
985 int tms470_erase_check(struct flash_bank_s
*bank
)
987 target_t
*target
= bank
->target
;
988 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
989 int sector
, result
= ERROR_OK
;
990 u32 fmmac2
, fmbac2
, glbctrl
, orig_fmregopt
;
991 static u8 buffer
[64 * 1024];
993 if (target
->state
!= TARGET_HALTED
)
995 return ERROR_TARGET_NOT_HALTED
;
998 if (!tms470_info
->device_ident_reg
)
1000 tms470_read_part_info(bank
);
1004 target_read_u32(target
, 0xFFFFFFDC, &glbctrl
);
1005 target_write_u32(target
, 0xFFFFFFDC, glbctrl
| 0x10);
1007 /* save current access mode, force normal read mode */
1008 target_read_u32(target
, 0xFFE89C00, &orig_fmregopt
);
1009 target_write_u32(target
, 0xFFE89C00, 0x00);
1011 /* enable the appropriate bank */
1012 target_read_u32(target
, 0xFFE8BC04, &fmmac2
);
1013 target_write_u32(target
, 0xFFE8BC04, (fmmac2
& ~7) | tms470_info
->ordinal
);
1016 target_write_u32(target
, 0xFFE8BC10, 0x2fc0);
1018 /* clear TEZ in fmbrdy */
1019 target_write_u32(target
, 0xFFE88010, 0x0b);
1021 /* save current wait states, force max */
1022 target_read_u32(target
, 0xFFE88004, &fmbac2
);
1023 target_write_u32(target
, 0xFFE88004, fmbac2
| 0xff);
1026 * The TI primitives inspect the flash memory by reading one 32-bit
1027 * word at a time. Here we read an entire sector and inspect it in
1028 * an attempt to reduce the JTAG overhead.
1030 for (sector
= 0; sector
< bank
->num_sectors
; sector
++)
1032 if (bank
->sectors
[sector
].is_erased
!= 1)
1034 u32 i
, addr
= bank
->base
+ bank
->sectors
[sector
].offset
;
1036 LOG_INFO("checking flash bank %d sector %d", tms470_info
->ordinal
, sector
);
1038 target_read_buffer(target
, addr
, bank
->sectors
[sector
].size
, buffer
);
1040 bank
->sectors
[sector
].is_erased
= 1;
1041 for (i
= 0; i
< bank
->sectors
[sector
].size
; i
++)
1043 if (buffer
[i
] != 0xff)
1045 LOG_WARNING("tms470 bank %d, sector %d, not erased.", tms470_info
->ordinal
, sector
);
1046 LOG_WARNING("at location 0x%08x: flash data is 0x%02x.", addr
+ i
, buffer
[i
]);
1048 bank
->sectors
[sector
].is_erased
= 0;
1053 if (bank
->sectors
[sector
].is_erased
!= 1)
1055 result
= ERROR_FLASH_SECTOR_NOT_ERASED
;
1060 LOG_INFO("sector erased");
1064 /* reset TEZ, wait states, read mode, GLBCTRL.4 */
1065 target_write_u32(target
, 0xFFE88010, 0x0f);
1066 target_write_u32(target
, 0xFFE88004, fmbac2
);
1067 target_write_u32(target
, 0xFFE89C00, orig_fmregopt
);
1068 target_write_u32(target
, 0xFFFFFFDC, glbctrl
);
1073 /* ---------------------------------------------------------------------- */
1075 int tms470_protect_check(struct flash_bank_s
*bank
)
1077 target_t
*target
= bank
->target
;
1078 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
1079 int sector
, result
= ERROR_OK
;
1080 u32 fmmac2
, fmbsea
, fmbseb
;
1082 if (target
->state
!= TARGET_HALTED
)
1084 return ERROR_TARGET_NOT_HALTED
;
1087 if (!tms470_info
->device_ident_reg
)
1089 tms470_read_part_info(bank
);
1092 /* enable the appropriate bank */
1093 target_read_u32(target
, 0xFFE8BC04, &fmmac2
);
1094 target_write_u32(target
, 0xFFE8BC04, (fmmac2
& ~7) | tms470_info
->ordinal
);
1096 target_read_u32(target
, 0xFFE88008, &fmbsea
);
1097 target_read_u32(target
, 0xFFE8800C, &fmbseb
);
1099 for (sector
= 0; sector
< bank
->num_sectors
; sector
++)
1105 protected = fmbsea
& (1 << sector
) ? 0 : 1;
1106 bank
->sectors
[sector
].is_protected
= protected;
1110 protected = fmbseb
& (1 << (sector
- 16)) ? 0 : 1;
1111 bank
->sectors
[sector
].is_protected
= protected;
1114 LOG_DEBUG("bank %d sector %d is %s", tms470_info
->ordinal
, sector
, protected ? "protected" : "not protected");
1120 /* ---------------------------------------------------------------------- */
1122 int tms470_info(struct flash_bank_s
*bank
, char *buf
, int buf_size
)
1125 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
1127 if (!tms470_info
->device_ident_reg
)
1129 tms470_read_part_info(bank
);
1132 if (!tms470_info
->device_ident_reg
)
1134 (void)snprintf(buf
, buf_size
, "Cannot identify target as a TMS470\n");
1135 return ERROR_FLASH_OPERATION_FAILED
;
1138 used
+= snprintf(buf
, buf_size
, "\ntms470 information: Chip is %s\n", tms470_info
->part_name
);
1142 used
+= snprintf(buf
, buf_size
, "Flash protection level 2 is %s\n", tms470_check_flash_unlocked(bank
->target
) == ERROR_OK
? "disabled" : "enabled");
1149 /* ---------------------------------------------------------------------- */
1152 * flash bank tms470 <base> <size> <chip_width> <bus_width> <target>
1156 int tms470_flash_bank_command(struct command_context_s
*cmd_ctx
, char *cmd
, char **args
, int argc
, struct flash_bank_s
*bank
)
1158 bank
->driver_priv
= malloc(sizeof(tms470_flash_bank_t
));
1160 if (!bank
->driver_priv
)
1162 return ERROR_FLASH_OPERATION_FAILED
;
1165 (void)memset(bank
->driver_priv
, 0, sizeof(tms470_flash_bank_t
));
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)