1 /***************************************************************************
2 * (c) Copyright 2007, 2008 by Christopher Kilgour *
3 * techie |_at_| whiterocker |_dot_| com *
5 * This program is free software; you can redistribute it and/or modify *
6 * it under the terms of the GNU General Public License as published by *
7 * the Free Software Foundation; either version 2 of the License, or *
8 * (at your option) any later version. *
10 * This program is distributed in the hope that it will be useful, *
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
13 * GNU General Public License for more details. *
15 * You should have received a copy of the GNU General Public License *
16 * along with this program; if not, write to the *
17 * Free Software Foundation, Inc., *
18 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
19 ***************************************************************************/
31 tms470_register_commands( struct command_context_s
*cmd_ctx
);
34 tms470_flash_bank_command( struct command_context_s
*cmd_ctx
,
38 struct flash_bank_s
*bank
);
41 tms470_erase( struct flash_bank_s
*bank
,
46 tms470_protect( struct flash_bank_s
*bank
,
52 tms470_write( struct flash_bank_s
*bank
,
58 tms470_probe( struct flash_bank_s
*bank
);
61 tms470_auto_probe( struct flash_bank_s
*bank
);
64 tms470_erase_check( struct flash_bank_s
*bank
);
67 tms470_protect_check( struct flash_bank_s
*bank
);
70 tms470_info( struct flash_bank_s
*bank
,
74 flash_driver_t tms470_flash
=
77 .register_commands
= tms470_register_commands
,
78 .flash_bank_command
= tms470_flash_bank_command
,
79 .erase
= tms470_erase
,
80 .protect
= tms470_protect
,
81 .write
= tms470_write
,
82 .probe
= tms470_probe
,
83 .auto_probe
= tms470_auto_probe
,
84 .erase_check
= tms470_erase_check
,
85 .protect_check
= tms470_protect_check
,
89 /* ----------------------------------------------------------------------
90 Internal Support, Helpers
91 ---------------------------------------------------------------------- */
93 const flash_sector_t TMS470R1A256_SECTORS
[] =
95 { 0x00000000, 0x00002000, -1, -1 },
96 { 0x00002000, 0x00002000, -1, -1 },
97 { 0x00004000, 0x00002000, -1, -1 },
98 { 0x00006000, 0x00002000, -1, -1 },
99 { 0x00008000, 0x00008000, -1, -1 },
100 { 0x00010000, 0x00008000, -1, -1 },
101 { 0x00018000, 0x00008000, -1, -1 },
102 { 0x00020000, 0x00008000, -1, -1 },
103 { 0x00028000, 0x00008000, -1, -1 },
104 { 0x00030000, 0x00008000, -1, -1 },
105 { 0x00038000, 0x00002000, -1, -1 },
106 { 0x0003A000, 0x00002000, -1, -1 },
107 { 0x0003C000, 0x00002000, -1, -1 },
108 { 0x0003E000, 0x00002000, -1, -1 },
111 #define TMS470R1A256_NUM_SECTORS \
112 (sizeof(TMS470R1A256_SECTORS)/sizeof(TMS470R1A256_SECTORS[0]))
114 const flash_sector_t TMS470R1A288_BANK0_SECTORS
[] =
116 { 0x00000000, 0x00002000, -1, -1 },
117 { 0x00002000, 0x00002000, -1, -1 },
118 { 0x00004000, 0x00002000, -1, -1 },
119 { 0x00006000, 0x00002000, -1, -1 },
122 #define TMS470R1A288_BANK0_NUM_SECTORS \
123 (sizeof(TMS470R1A288_BANK0_SECTORS)/sizeof(TMS470R1A288_BANK0_SECTORS[0]))
125 const flash_sector_t TMS470R1A288_BANK1_SECTORS
[] =
127 { 0x00040000, 0x00010000, -1, -1 },
128 { 0x00050000, 0x00010000, -1, -1 },
129 { 0x00060000, 0x00010000, -1, -1 },
130 { 0x00070000, 0x00010000, -1, -1 },
133 #define TMS470R1A288_BANK1_NUM_SECTORS \
134 (sizeof(TMS470R1A288_BANK1_SECTORS)/sizeof(TMS470R1A288_BANK1_SECTORS[0]))
136 /* ---------------------------------------------------------------------- */
139 tms470_read_part_info( struct flash_bank_s
*bank
)
141 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
142 target_t
*target
= bank
->target
;
143 u32 device_ident_reg
;
145 u32 technology_family
;
150 if (target
->state
!= TARGET_HALTED
)
152 WARNING( "Cannot communicate... target not halted." );
153 return ERROR_TARGET_NOT_HALTED
;
156 /* read and parse the device identification register */
157 target_read_u32( target
, 0xFFFFFFF0, &device_ident_reg
);
159 INFO( "device_ident_reg=0x%08x", device_ident_reg
);
161 if ((device_ident_reg
& 7) == 0)
163 WARNING( "Cannot identify target as a TMS470 family." );
164 return ERROR_FLASH_OPERATION_FAILED
;
167 silicon_version
= (device_ident_reg
>> 12) & 0xF;
168 technology_family
= (device_ident_reg
>> 11) & 1;
169 rom_flash
= (device_ident_reg
>> 10) & 1;
170 part_number
= (device_ident_reg
>> 3) & 0x7f;
173 * If the part number is known, determine if the flash bank is valid
174 * based on the base address being within the known flash bank
175 * ranges. Then fixup/complete the remaining fields of the flash
178 switch( part_number
)
181 part_name
= "TMS470R1A256";
183 if (bank
->base
>= 0x00040000)
185 ERROR( "No %s flash bank contains base address 0x%08x.",
186 part_name
, bank
->base
);
187 return ERROR_FLASH_OPERATION_FAILED
;
189 tms470_info
->ordinal
= 0;
190 bank
->base
= 0x00000000;
191 bank
->size
= 256*1024;
192 bank
->num_sectors
= TMS470R1A256_NUM_SECTORS
;
193 bank
->sectors
= malloc( sizeof( TMS470R1A256_SECTORS
) );
196 return ERROR_FLASH_OPERATION_FAILED
;
198 (void) memcpy( bank
->sectors
,
199 TMS470R1A256_SECTORS
,
200 sizeof( TMS470R1A256_SECTORS
) );
204 part_name
= "TMS470R1A288";
206 if ((bank
->base
>= 0x00000000) && (bank
->base
< 0x00008000))
208 tms470_info
->ordinal
= 0;
209 bank
->base
= 0x00000000;
210 bank
->size
= 32*1024;
211 bank
->num_sectors
= TMS470R1A288_BANK0_NUM_SECTORS
;
212 bank
->sectors
= malloc( sizeof( TMS470R1A288_BANK0_SECTORS
) );
215 return ERROR_FLASH_OPERATION_FAILED
;
217 (void) memcpy( bank
->sectors
,
218 TMS470R1A288_BANK0_SECTORS
,
219 sizeof( TMS470R1A288_BANK0_SECTORS
) );
221 else if ((bank
->base
>= 0x00040000) && (bank
->base
< 0x00080000))
223 tms470_info
->ordinal
= 1;
224 bank
->base
= 0x00040000;
225 bank
->size
= 256*1024;
226 bank
->num_sectors
= TMS470R1A288_BANK1_NUM_SECTORS
;
227 bank
->sectors
= malloc( sizeof( TMS470R1A288_BANK1_SECTORS
) );
230 return ERROR_FLASH_OPERATION_FAILED
;
232 (void) memcpy( bank
->sectors
,
233 TMS470R1A288_BANK1_SECTORS
,
234 sizeof( TMS470R1A288_BANK1_SECTORS
) );
238 ERROR( "No %s flash bank contains base address 0x%08x.",
239 part_name
, bank
->base
);
240 return ERROR_FLASH_OPERATION_FAILED
;
245 WARNING( "Could not identify part 0x%02x as a member of the TMS470 family.",
247 return ERROR_FLASH_OPERATION_FAILED
;
250 /* turn off memory selects */
251 target_write_u32( target
, 0xFFFFFFE4, 0x00000000 );
252 target_write_u32( target
, 0xFFFFFFE0, 0x00000000 );
254 bank
->chip_width
= 32;
255 bank
->bus_width
= 32;
257 INFO( "Identified %s, ver=%d, core=%s, nvmem=%s.",
260 (technology_family
? "1.8v" : "3.3v"),
261 (rom_flash
? "rom" : "flash") );
263 tms470_info
->device_ident_reg
= device_ident_reg
;
264 tms470_info
->silicon_version
= silicon_version
;
265 tms470_info
->technology_family
= technology_family
;
266 tms470_info
->rom_flash
= rom_flash
;
267 tms470_info
->part_number
= part_number
;
268 tms470_info
->part_name
= part_name
;
271 * Disable reset on address access violation.
273 target_write_u32( target
, 0xFFFFFFE0, 0x00004007 );
278 /* ---------------------------------------------------------------------- */
284 tms470_handle_flash_keyset_command( struct command_context_s
* cmd_ctx
,
291 command_print( cmd_ctx
, "tms470 flash_keyset <key0> <key1> <key2> <key3>" );
292 return ERROR_INVALID_ARGUMENTS
;
300 int start
= (0 == strncmp( args
[i
], "0x", 2 )) ? 2 : 0;
301 if (1 != sscanf( &args
[i
][start
], "%x", &flashKeys
[i
] ))
303 command_print( cmd_ctx
, "could not process flash key %s", args
[i
] );
304 ERROR( "could not process flash key %s", args
[i
] );
305 return ERROR_INVALID_ARGUMENTS
;
313 command_print( cmd_ctx
, "tms470 flash_keyset <key0> <key1> <key2> <key3>" );
314 return ERROR_INVALID_ARGUMENTS
;
319 command_print( cmd_ctx
, "using flash keys 0x%08x, 0x%08x, 0x%08x, 0x%08x",
320 flashKeys
[0], flashKeys
[1], flashKeys
[2], flashKeys
[3] );
324 command_print( cmd_ctx
, "flash keys not set" );
330 const u32 FLASH_KEYS_ALL_ONES
[] = { 0xFFFFFFFF, 0xFFFFFFFF,
331 0xFFFFFFFF, 0xFFFFFFFF, };
333 const u32 FLASH_KEYS_ALL_ZEROS
[] = { 0x00000000, 0x00000000,
334 0x00000000, 0x00000000, };
336 const u32 FLASH_KEYS_MIX1
[] = { 0xf0fff0ff, 0xf0fff0ff,
337 0xf0fff0ff, 0xf0fff0ff };
339 const u32 FLASH_KEYS_MIX2
[] = { 0x0000ffff, 0x0000ffff,
340 0x0000ffff, 0x0000ffff };
342 /* ---------------------------------------------------------------------- */
347 tms470_handle_osc_megahertz_command( struct command_context_s
* cmd_ctx
,
354 command_print( cmd_ctx
, "tms470 osc_megahertz <MHz>" );
355 return ERROR_INVALID_ARGUMENTS
;
359 sscanf( args
[0], "%d", &oscMHz
);
364 ERROR( "osc_megahertz must be positive and non-zero!" );
365 command_print( cmd_ctx
, "osc_megahertz must be positive and non-zero!" );
367 return ERROR_INVALID_ARGUMENTS
;
370 command_print( cmd_ctx
, "osc_megahertz=%d", oscMHz
);
375 /* ---------------------------------------------------------------------- */
380 tms470_handle_plldis_command( struct command_context_s
* cmd_ctx
,
387 command_print( cmd_ctx
, "tms470 plldis <0|1>" );
388 return ERROR_INVALID_ARGUMENTS
;
392 sscanf( args
[0], "%d", &plldis
);
393 plldis
= plldis
? 1 : 0;
396 command_print( cmd_ctx
, "plldis=%d", plldis
);
401 /* ---------------------------------------------------------------------- */
404 tms470_check_flash_unlocked( target_t
* target
)
408 target_read_u32( target
, 0xFFE89C08, &fmbbusy
);
409 INFO( "tms470 fmbbusy=0x%08x -> %s",
411 fmbbusy
& 0x8000 ? "unlocked" : "LOCKED" );
412 return fmbbusy
& 0x8000 ? ERROR_OK
: ERROR_FLASH_OPERATION_FAILED
;
415 /* ---------------------------------------------------------------------- */
418 tms470_try_flash_keys( target_t
* target
,
419 const u32
* key_set
)
421 u32 glbctrl
, fmmstat
;
422 int retval
= ERROR_FLASH_OPERATION_FAILED
;
425 target_read_u32( target
, 0xFFFFFFDC, &glbctrl
);
426 target_write_u32( target
, 0xFFFFFFDC, glbctrl
| 0x10 );
428 /* only perform the key match when 3VSTAT is clear */
429 target_read_u32( target
, 0xFFE8BC0C, &fmmstat
);
430 if (!(fmmstat
& 0x08))
433 u32 fmmac2
, fmbptr
, fmbac2
, fmbbusy
, orig_fmregopt
;
435 target_write_u32( target
, 0xFFE8BC04, fmmstat
& ~0x07 );
437 /* wait for pump ready */
440 target_read_u32( target
, 0xFFE8A814, &fmbptr
);
443 while( !(fmbptr
& 0x0200) );
445 /* force max wait states */
446 target_read_u32( target
, 0xFFE88004, &fmbac2
);
447 target_write_u32( target
, 0xFFE88004, fmbac2
| 0xff );
449 /* save current access mode, force normal read mode */
450 target_read_u32( target
, 0xFFE89C00, &orig_fmregopt
);
451 target_write_u32( target
, 0xFFE89C00, 0x00 );
457 /* There is no point displaying the value of tmp, it is
458 * filtered by the chip. The purpose of this read is to
459 * prime the unlocking logic rather than read out the value.
461 target_read_u32( target
, 0x00001FF0+4*i
, &tmp
);
463 INFO( "tms470 writing fmpkey=0x%08x", key_set
[i
] );
464 target_write_u32( target
, 0xFFE89C0C, key_set
[i
] );
467 if (ERROR_OK
== tms470_check_flash_unlocked( target
))
470 * There seems to be a side-effect of reading the FMPKEY
471 * register in that it re-enables the protection. So we
477 target_read_u32( target
, 0x00001FF0+4*i
, &tmp
);
478 target_write_u32( target
, 0xFFE89C0C, key_set
[i
] );
483 /* restore settings */
484 target_write_u32( target
, 0xFFE89C00, orig_fmregopt
);
485 target_write_u32( target
, 0xFFE88004, fmbac2
);
488 /* clear config bit */
489 target_write_u32( target
, 0xFFFFFFDC, glbctrl
);
494 /* ---------------------------------------------------------------------- */
497 tms470_unlock_flash( struct flash_bank_s
* bank
)
499 tms470_flash_bank_t
* tms470_info
= bank
->driver_priv
;
500 target_t
* target
= bank
->target
;
501 const u32
* p_key_sets
[5];
502 unsigned i
, key_set_count
;
506 p_key_sets
[0] = flashKeys
;
507 p_key_sets
[1] = FLASH_KEYS_ALL_ONES
;
508 p_key_sets
[2] = FLASH_KEYS_ALL_ZEROS
;
509 p_key_sets
[3] = FLASH_KEYS_MIX1
;
510 p_key_sets
[4] = FLASH_KEYS_MIX2
;
515 p_key_sets
[0] = FLASH_KEYS_ALL_ONES
;
516 p_key_sets
[1] = FLASH_KEYS_ALL_ZEROS
;
517 p_key_sets
[2] = FLASH_KEYS_MIX1
;
518 p_key_sets
[3] = FLASH_KEYS_MIX2
;
521 for( i
=0; i
<key_set_count
; i
++ )
523 if (tms470_try_flash_keys( target
, p_key_sets
[i
] ) == ERROR_OK
)
525 INFO( "tms470 flash is unlocked" );
530 WARNING( "tms470 could not unlock flash memory protection level 2" );
531 return ERROR_FLASH_OPERATION_FAILED
;
534 /* ---------------------------------------------------------------------- */
537 tms470_flash_initialize_internal_state_machine( struct flash_bank_s
* bank
)
539 u32 fmmac2
, fmmac1
, fmmaxep
, k
, delay
, glbctrl
, sysclk
;
540 target_t
*target
= bank
->target
;
541 tms470_flash_bank_t
* tms470_info
= bank
->driver_priv
;
542 int result
= ERROR_OK
;
545 * Select the desired bank to be programmed by writing BANK[2:0] of
548 target_read_u32( target
, 0xFFE8BC04, &fmmac2
);
550 fmmac2
|= (tms470_info
->ordinal
& 7);
551 target_write_u32( target
, 0xFFE8BC04, fmmac2
);
552 DEBUG( "set fmmac2=0x%04x", fmmac2
);
555 * Disable level 1 sector protection by setting bit 15 of FMMAC1.
557 target_read_u32( target
, 0xFFE8BC00, &fmmac1
);
559 target_write_u32( target
, 0xFFE8BC00, fmmac1
);
560 DEBUG( "set fmmac1=0x%04x", fmmac1
);
565 target_write_u32( target
, 0xFFE8BC10, 0x2fc0 );
566 DEBUG( "set fmtcreg=0x2fc0" );
571 target_write_u32( target
, 0xFFE8A07C, 50 );
572 DEBUG( "set fmmaxpp=50" );
577 target_write_u32( target
, 0xFFE8A084, 0xf000+2000 );
578 DEBUG( "set fmmaxcp=0x%04x", 0xf000+2000 );
583 target_read_u32( target
, 0xFFE8A080, &fmmaxep
);
584 if (fmmaxep
== 0xf000)
586 fmmaxep
= 0xf000+4095;
587 target_write_u32( target
, 0xFFE8A80C, 0x9964 );
588 DEBUG( "set fmptr3=0x9964" );
592 fmmaxep
= 0xa000+4095;
593 target_write_u32( target
, 0xFFE8A80C, 0x9b64 );
594 DEBUG( "set fmptr3=0x9b64" );
596 target_write_u32( target
, 0xFFE8A080, fmmaxep
);
597 DEBUG( "set fmmaxep=0x%04x", fmmaxep
);
602 target_write_u32( target
, 0xFFE8A810, 0xa000 );
603 DEBUG( "set fmptr4=0xa000" );
606 * FMPESETUP, delay parameter selected based on clock frequency.
608 * According to the TI App Note SPNU257 and flashing code, delay is
609 * int((sysclk(MHz) + 1) / 2), with a minimum of 5. The system
610 * clock is usually derived from the ZPLL module, and selected by
613 target_read_u32( target
, 0xFFFFFFDC, &glbctrl
);
614 sysclk
= (plldis
? 1 : (glbctrl
& 0x08) ? 4 : 8 ) * oscMHz
/ (1 + (glbctrl
& 7));
615 delay
= (sysclk
> 10) ? (sysclk
+ 1) / 2 : 5;
616 target_write_u32( target
, 0xFFE8A018, (delay
<<4)|(delay
<<8) );
617 DEBUG( "set fmpsetup=0x%04x", (delay
<<4)|(delay
<<8) );
620 * FMPVEVACCESS, based on delay.
622 k
= delay
|(delay
<<8);
623 target_write_u32( target
, 0xFFE8A05C, k
);
624 DEBUG( "set fmpvevaccess=0x%04x", k
);
627 * FMPCHOLD, FMPVEVHOLD, FMPVEVSETUP, based on delay.
630 target_write_u32( target
, 0xFFE8A034, k
);
631 DEBUG( "set fmpchold=0x%04x", k
);
632 target_write_u32( target
, 0xFFE8A040, k
);
633 DEBUG( "set fmpvevhold=0x%04x", k
);
634 target_write_u32( target
, 0xFFE8A024, k
);
635 DEBUG( "set fmpvevsetup=0x%04x", k
);
638 * FMCVACCESS, based on delay.
641 target_write_u32( target
, 0xFFE8A060, k
);
642 DEBUG( "set fmcvaccess=0x%04x", k
);
645 * FMCSETUP, based on delay.
647 k
= 0x3000 | delay
*20;
648 target_write_u32( target
, 0xFFE8A020, k
);
649 DEBUG( "set fmcsetup=0x%04x", k
);
652 * FMEHOLD, based on delay.
655 target_write_u32( target
, 0xFFE8A038, k
);
656 DEBUG( "set fmehold=0x%04x", k
);
659 * PWIDTH, CWIDTH, EWIDTH, based on delay.
661 target_write_u32( target
, 0xFFE8A050, delay
*8 );
662 DEBUG( "set fmpwidth=0x%04x", delay
*8 );
663 target_write_u32( target
, 0xFFE8A058, delay
*1000 );
664 DEBUG( "set fmcwidth=0x%04x", delay
*1000 );
665 target_write_u32( target
, 0xFFE8A054, delay
*5400 );
666 DEBUG( "set fmewidth=0x%04x", delay
*5400 );
672 /* ---------------------------------------------------------------------- */
675 tms470_flash_status( struct flash_bank_s
* bank
)
677 target_t
*target
= bank
->target
;
678 int result
= ERROR_OK
;
681 target_read_u32( target
, 0xFFE8BC0C, &fmmstat
);
682 DEBUG( "set fmmstat=0x%04x", fmmstat
);
684 if (fmmstat
& 0x0080)
686 WARNING( "tms470 flash command: erase still active after busy clear." );
687 result
= ERROR_FLASH_OPERATION_FAILED
;
690 if (fmmstat
& 0x0040)
692 WARNING( "tms470 flash command: program still active after busy clear." );
693 result
= ERROR_FLASH_OPERATION_FAILED
;
696 if (fmmstat
& 0x0020)
698 WARNING( "tms470 flash command: invalid data command." );
699 result
= ERROR_FLASH_OPERATION_FAILED
;
702 if (fmmstat
& 0x0010)
704 WARNING( "tms470 flash command: program, erase or validate sector failed." );
705 result
= ERROR_FLASH_OPERATION_FAILED
;
708 if (fmmstat
& 0x0008)
710 WARNING( "tms470 flash command: voltage instability detected." );
711 result
= ERROR_FLASH_OPERATION_FAILED
;
714 if (fmmstat
& 0x0006)
716 WARNING( "tms470 flash command: command suspend detected." );
717 result
= ERROR_FLASH_OPERATION_FAILED
;
720 if (fmmstat
& 0x0001)
722 WARNING( "tms470 flash command: sector was locked." );
723 result
= ERROR_FLASH_OPERATION_FAILED
;
729 /* ---------------------------------------------------------------------- */
732 tms470_erase_sector( struct flash_bank_s
* bank
,
735 u32 glbctrl
, orig_fmregopt
, fmbsea
, fmbseb
, fmmstat
;
736 target_t
*target
= bank
->target
;
737 u32 flashAddr
= bank
->base
+ bank
->sectors
[sector
].offset
;
738 int result
= ERROR_OK
;
741 * Set the bit GLBCTRL4 of the GLBCTRL register (in the System
742 * module) to enable writing to the flash registers }.
744 target_read_u32( target
, 0xFFFFFFDC, &glbctrl
);
745 target_write_u32( target
, 0xFFFFFFDC, glbctrl
| 0x10 );
746 DEBUG( "set glbctrl=0x%08x", glbctrl
| 0x10 );
748 /* Force normal read mode. */
749 target_read_u32( target
, 0xFFE89C00, &orig_fmregopt
);
750 target_write_u32( target
, 0xFFE89C00, 0 );
751 DEBUG( "set fmregopt=0x%08x", 0 );
753 (void) tms470_flash_initialize_internal_state_machine( bank
);
756 * Select one or more bits in FMBSEA or FMBSEB to disable Level 1
757 * protection for the particular sector to be erased/written.
761 target_read_u32( target
, 0xFFE88008, &fmbsea
);
762 target_write_u32( target
, 0xFFE88008, fmbsea
| (1<<sector
) );
763 DEBUG( "set fmbsea=0x%04x", fmbsea
| (1<<sector
) );
767 target_read_u32( target
, 0xFFE8800C, &fmbseb
);
768 target_write_u32( target
, 0xFFE8800C, fmbseb
| (1<<(sector
-16)) );
769 DEBUG( "set fmbseb=0x%04x", fmbseb
| (1<<(sector
-16)) );
771 bank
->sectors
[sector
].is_protected
= 0;
774 * clear status regiser, sent erase command, kickoff erase
776 target_write_u16( target
, flashAddr
, 0x0040 );
777 DEBUG( "write *(u16 *)0x%08x=0x0040", flashAddr
);
778 target_write_u16( target
, flashAddr
, 0x0020 );
779 DEBUG( "write *(u16 *)0x%08x=0x0020", flashAddr
);
780 target_write_u16( target
, flashAddr
, 0xffff );
781 DEBUG( "write *(u16 *)0x%08x=0xffff", flashAddr
);
784 * Monitor FMMSTAT, busy until clear, then check and other flags for
785 * ultimate result of the operation.
789 target_read_u32( target
, 0xFFE8BC0C, &fmmstat
);
790 if (fmmstat
& 0x0100)
795 while( fmmstat
& 0x0100 );
797 result
= tms470_flash_status( bank
);
801 target_write_u32( target
, 0xFFE88008, fmbsea
);
802 DEBUG( "set fmbsea=0x%04x", fmbsea
);
803 bank
->sectors
[sector
].is_protected
=
804 fmbsea
& (1<<sector
) ? 0 : 1;
808 target_write_u32( target
, 0xFFE8800C, fmbseb
);
809 DEBUG( "set fmbseb=0x%04x", fmbseb
);
810 bank
->sectors
[sector
].is_protected
=
811 fmbseb
& (1<<(sector
-16)) ? 0 : 1;
813 target_write_u32( target
, 0xFFE89C00, orig_fmregopt
);
814 DEBUG( "set fmregopt=0x%08x", orig_fmregopt
);
815 target_write_u32( target
, 0xFFFFFFDC, glbctrl
);
816 DEBUG( "set glbctrl=0x%08x", glbctrl
);
818 if (result
== ERROR_OK
)
820 bank
->sectors
[sector
].is_erased
= 1;
826 /* ----------------------------------------------------------------------
827 Implementation of Flash Driver Interfaces
828 ---------------------------------------------------------------------- */
831 tms470_register_commands( struct command_context_s
*cmd_ctx
)
833 command_t
*tms470_cmd
= register_command( cmd_ctx
,
838 "applies to TI tms470 family" );
840 register_command( cmd_ctx
,
843 tms470_handle_flash_keyset_command
,
845 "tms470 flash_keyset <key0> <key1> <key2> <key3>" );
847 register_command( cmd_ctx
,
850 tms470_handle_osc_megahertz_command
,
852 "tms470 osc_megahertz <MHz>" );
854 register_command( cmd_ctx
,
857 tms470_handle_plldis_command
,
859 "tms470 plldis <0/1>" );
864 /* ---------------------------------------------------------------------- */
867 tms470_erase( struct flash_bank_s
* bank
,
871 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
872 target_t
*target
= bank
->target
;
873 int sector
, result
= ERROR_OK
;
875 if (!tms470_info
->device_ident_reg
)
877 tms470_read_part_info( bank
);
881 (first
>= bank
->num_sectors
) ||
883 (last
>= bank
->num_sectors
) ||
886 ERROR( "Sector range %d to %d invalid.", first
, last
);
887 return ERROR_FLASH_SECTOR_INVALID
;
890 result
= tms470_unlock_flash( bank
);
891 if (result
!= ERROR_OK
)
896 for( sector
=first
; sector
<=last
; sector
++ )
898 INFO( "Erasing tms470 bank %d sector %d...",
899 tms470_info
->ordinal
, sector
);
901 result
= tms470_erase_sector( bank
, sector
);
903 if (result
!= ERROR_OK
)
905 ERROR( "tms470 could not erase flash sector." );
910 INFO( "sector erased successfully." );
917 /* ---------------------------------------------------------------------- */
920 tms470_protect( struct flash_bank_s
* bank
,
925 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
926 target_t
*target
= bank
->target
;
927 u32 fmmac2
, fmbsea
, fmbseb
;
930 if (!tms470_info
->device_ident_reg
)
932 tms470_read_part_info( bank
);
936 (first
>= bank
->num_sectors
) ||
938 (last
>= bank
->num_sectors
) ||
941 ERROR( "Sector range %d to %d invalid.", first
, last
);
942 return ERROR_FLASH_SECTOR_INVALID
;
945 /* enable the appropriate bank */
946 target_read_u32( target
, 0xFFE8BC04, &fmmac2
);
947 target_write_u32( target
, 0xFFE8BC04,
948 (fmmac2
& ~7) | tms470_info
->ordinal
);
950 /* get the original sector proection flags for this bank */
951 target_read_u32( target
, 0xFFE88008, &fmbsea
);
952 target_read_u32( target
, 0xFFE8800C, &fmbseb
);
954 for( sector
=0; sector
<bank
->num_sectors
; sector
++ )
958 fmbsea
= set
? fmbsea
& ~(1<<sector
) :
959 fmbsea
| (1<<sector
);
960 bank
->sectors
[sector
].is_protected
= set
? 1 : 0;
964 fmbseb
= set
? fmbseb
& ~(1<<(sector
-16)) :
965 fmbseb
| (1<<(sector
-16));
966 bank
->sectors
[sector
].is_protected
= set
? 1 : 0;
970 /* update the protection bits */
971 target_write_u32( target
, 0xFFE88008, fmbsea
);
972 target_write_u32( target
, 0xFFE8800C, fmbseb
);
977 /* ---------------------------------------------------------------------- */
980 tms470_write( struct flash_bank_s
* bank
,
985 target_t
*target
= bank
->target
;
986 tms470_flash_bank_t
*tms470_info
= bank
->driver_priv
;
987 u32 glbctrl
, fmbac2
, orig_fmregopt
, fmbsea
, fmbseb
, fmmaxpp
, fmmstat
;
988 int i
, result
= ERROR_OK
;
990 if (!tms470_info
->device_ident_reg
)
992 tms470_read_part_info( bank
);
995 INFO( "Writing %d bytes starting at 0x%08x",
996 count
, bank
->base
+ offset
);
999 target_read_u32( target
, 0xFFFFFFDC, &glbctrl
);
1000 target_write_u32( target
, 0xFFFFFFDC, glbctrl
| 0x10 );
1002 (void) tms470_flash_initialize_internal_state_machine( bank
);
1004 /* force max wait states */
1005 target_read_u32( target
, 0xFFE88004, &fmbac2
);
1006 target_write_u32( target
, 0xFFE88004, fmbac2
| 0xff );
1008 /* save current access mode, force normal read mode */
1009 target_read_u32( target
, 0xFFE89C00, &orig_fmregopt
);
1010 target_write_u32( target
, 0xFFE89C00, 0x00 );
1013 * Disable Level 1 protection for all sectors to be erased/written.
1015 target_read_u32( target
, 0xFFE88008, &fmbsea
);
1016 target_write_u32( target
, 0xFFE88008, 0xffff );
1017 target_read_u32( target
, 0xFFE8800C, &fmbseb
);
1018 target_write_u32( target
, 0xFFE8800C, 0xffff );
1021 target_read_u32( target
, 0xFFE8A07C, &fmmaxpp
);
1023 for( i
=0; i
<count
; i
+=2 )
1025 u32 addr
= bank
->base
+ offset
+ i
;
1026 u16 word
= (((u16
) buffer
[i
]) << 8) | (u16
) buffer
[i
+1];
1030 INFO( "writing 0x%04x at 0x%08x", word
, addr
);
1032 /* clear status register */
1033 target_write_u16( target
, addr
, 0x0040 );
1034 /* program flash command */
1035 target_write_u16( target
, addr
, 0x0010 );
1036 /* burn the 16-bit word (big-endian) */
1037 target_write_u16( target
, addr
, word
);
1040 * Monitor FMMSTAT, busy until clear, then check and other flags
1041 * for ultimate result of the operation.
1045 target_read_u32( target
, 0xFFE8BC0C, &fmmstat
);
1046 if (fmmstat
& 0x0100)
1051 while( fmmstat
& 0x0100 );
1053 if (fmmstat
& 0x3ff)
1055 ERROR( "fmstat=0x%04x", fmmstat
);
1056 ERROR( "Could not program word 0x%04x at address 0x%08x.",
1058 result
= ERROR_FLASH_OPERATION_FAILED
;
1064 INFO( "skipping 0xffff at 0x%08x", addr
);
1069 target_write_u32( target
, 0xFFE88008, fmbsea
);
1070 target_write_u32( target
, 0xFFE8800C, fmbseb
);
1071 target_write_u32( target
, 0xFFE88004, fmbac2
);
1072 target_write_u32( target
, 0xFFE89C00, orig_fmregopt
);
1073 target_write_u32( target
, 0xFFFFFFDC, glbctrl
);
1078 /* ---------------------------------------------------------------------- */
1081 tms470_probe( struct flash_bank_s
* bank
)
1083 tms470_flash_bank_t
* tms470_info
= bank
->driver_priv
;
1085 tms470_info
->probed
= 0;
1087 if (!tms470_info
->device_ident_reg
)
1089 tms470_read_part_info( bank
);
1092 tms470_info
->probed
= 1;
1098 tms470_auto_probe( struct flash_bank_s
* bank
)
1100 tms470_flash_bank_t
* tms470_info
= bank
->driver_priv
;
1101 if (tms470_info
->probed
)
1103 return tms470_probe(bank
);
1105 /* ---------------------------------------------------------------------- */
1108 tms470_erase_check( struct flash_bank_s
* bank
)
1110 target_t
*target
= bank
->target
;
1111 tms470_flash_bank_t
* tms470_info
= bank
->driver_priv
;
1112 int sector
, result
= ERROR_OK
;
1113 u32 fmmac2
, fmbac2
, glbctrl
, orig_fmregopt
;
1114 static u8 buffer
[64*1024];
1116 if (!tms470_info
->device_ident_reg
)
1118 tms470_read_part_info( bank
);
1122 target_read_u32( target
, 0xFFFFFFDC, &glbctrl
);
1123 target_write_u32( target
, 0xFFFFFFDC, glbctrl
| 0x10 );
1125 /* save current access mode, force normal read mode */
1126 target_read_u32( target
, 0xFFE89C00, &orig_fmregopt
);
1127 target_write_u32( target
, 0xFFE89C00, 0x00 );
1129 /* enable the appropriate bank */
1130 target_read_u32( target
, 0xFFE8BC04, &fmmac2
);
1131 target_write_u32( target
, 0xFFE8BC04,
1132 (fmmac2
& ~7) | tms470_info
->ordinal
);
1135 target_write_u32( target
, 0xFFE8BC10, 0x2fc0 );
1137 /* clear TEZ in fmbrdy */
1138 target_write_u32( target
, 0xFFE88010, 0x0b );
1140 /* save current wait states, force max */
1141 target_read_u32( target
, 0xFFE88004, &fmbac2
);
1142 target_write_u32( target
, 0xFFE88004, fmbac2
| 0xff );
1145 * The TI primitives inspect the flash memory by reading one 32-bit
1146 * word at a time. Here we read an entire sector and inspect it in
1147 * an attempt to reduce the JTAG overhead.
1149 for( sector
=0; sector
<bank
->num_sectors
; sector
++ )
1151 if (bank
->sectors
[sector
].is_erased
!= 1)
1153 u32 i
, addr
= bank
->base
+ bank
->sectors
[sector
].offset
;
1155 INFO( "checking flash bank %d sector %d",
1156 tms470_info
->ordinal
,
1159 target_read_buffer( target
,
1161 bank
->sectors
[sector
].size
,
1164 bank
->sectors
[sector
].is_erased
= 1;
1165 for( i
=0; i
<bank
->sectors
[sector
].size
; i
++ )
1167 if (buffer
[i
] != 0xff)
1169 WARNING( "tms470 bank %d, sector %d, not erased.",
1170 tms470_info
->ordinal
,
1172 WARNING( "at location 0x%08x: flash data is 0x%02x.",
1176 bank
->sectors
[sector
].is_erased
= 0;
1181 if (bank
->sectors
[sector
].is_erased
!= 1)
1183 result
= ERROR_FLASH_SECTOR_NOT_ERASED
;
1188 INFO( "sector erased" );
1192 /* reset TEZ, wait states, read mode, GLBCTRL.4 */
1193 target_write_u32( target
, 0xFFE88010, 0x0f );
1194 target_write_u32( target
, 0xFFE88004, fmbac2
);
1195 target_write_u32( target
, 0xFFE89C00, orig_fmregopt
);
1196 target_write_u32( target
, 0xFFFFFFDC, glbctrl
);
1201 /* ---------------------------------------------------------------------- */
1204 tms470_protect_check( struct flash_bank_s
* bank
)
1206 target_t
*target
= bank
->target
;
1207 tms470_flash_bank_t
* tms470_info
= bank
->driver_priv
;
1208 int sector
, result
= ERROR_OK
;
1209 u32 fmmac2
, fmbsea
, fmbseb
;
1211 if (!tms470_info
->device_ident_reg
)
1213 tms470_read_part_info( bank
);
1216 /* enable the appropriate bank */
1217 target_read_u32( target
, 0xFFE8BC04, &fmmac2
);
1218 target_write_u32( target
, 0xFFE8BC04,
1219 (fmmac2
& ~7) | tms470_info
->ordinal
);
1221 target_read_u32( target
, 0xFFE88008, &fmbsea
);
1222 target_read_u32( target
, 0xFFE8800C, &fmbseb
);
1224 for( sector
=0; sector
<bank
->num_sectors
; sector
++ )
1230 protected = fmbsea
& (1<<sector
) ? 0 : 1;
1231 bank
->sectors
[sector
].is_protected
= protected;
1235 protected = fmbseb
& (1<<(sector
-16)) ? 0 : 1;
1236 bank
->sectors
[sector
].is_protected
= protected;
1239 DEBUG( "bank %d sector %d is %s",
1240 tms470_info
->ordinal
,
1242 protected ? "protected" : "not protected" );
1248 /* ---------------------------------------------------------------------- */
1251 tms470_info( struct flash_bank_s
* bank
,
1256 tms470_flash_bank_t
* tms470_info
= bank
->driver_priv
;
1258 if (!tms470_info
->device_ident_reg
)
1260 tms470_read_part_info( bank
);
1263 if (!tms470_info
->device_ident_reg
)
1265 (void) snprintf(buf
, buf_size
, "Cannot identify target as a TMS470\n");
1266 return ERROR_FLASH_OPERATION_FAILED
;
1269 used
+= snprintf( buf
, buf_size
,
1270 "\ntms470 information: Chip is %s\n",
1271 tms470_info
->part_name
);
1275 used
+= snprintf( buf
, buf_size
,
1276 "Flash protection level 2 is %s\n",
1277 tms470_check_flash_unlocked( bank
->target
) == ERROR_OK
? "disabled" : "enabled" );
1284 /* ---------------------------------------------------------------------- */
1287 * flash bank tms470 <base> <size> <chip_width> <bus_width> <target>
1292 tms470_flash_bank_command( struct command_context_s
*cmd_ctx
,
1296 struct flash_bank_s
*bank
)
1298 bank
->driver_priv
= malloc( sizeof( tms470_flash_bank_t
) );
1300 if (!bank
->driver_priv
)
1302 return ERROR_FLASH_OPERATION_FAILED
;
1305 (void) memset( bank
->driver_priv
, 0, sizeof( tms470_flash_bank_t
) );