git.gag.com Git - fw/openocd/blob - src/flash/tms470.c

   1 /***************************************************************************
   2  *   (c) Copyright 2007, 2008 by Christopher Kilgour                       *
   3  *   techie |_at_| whiterocker |_dot_| com                                 *
   4  *                                                                         *
   5  *   This program is free software; you can redistribute it and/or modify  *
   6  *   it under the terms of the GNU General Public License as published by  *
   7  *   the Free Software Foundation; either version 2 of the License, or     *
   8  *   (at your option) any later version.                                   *
   9  *                                                                         *
  10  *   This program is distributed in the hope that it will be useful,       *
  11  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  12  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  13  *   GNU General Public License for more details.                          *
  14  *                                                                         *
  15  *   You should have received a copy of the GNU General Public License     *
  16  *   along with this program; if not, write to the                         *
  17  *   Free Software Foundation, Inc.,                                       *
  18  *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  19  ***************************************************************************/
  20
  21 #ifdef HAVE_CONFIG_H
  22 #include "config.h"
  23 #endif
  24
  25 #include "log.h"
  26 #include "tms470.h"
  27 #include <string.h>
  28 #include <unistd.h>
  29
  30 int
  31 tms470_register_commands( struct command_context_s *cmd_ctx );
  32
  33 int
  34 tms470_flash_bank_command( struct command_context_s *cmd_ctx,
  35                            char *cmd,
  36                            char **args,
  37                            int argc,
  38                            struct flash_bank_s *bank );
  39
  40 int
  41 tms470_erase( struct flash_bank_s *bank,
  42               int first,
  43               int last );
  44
  45 int
  46 tms470_protect( struct flash_bank_s *bank,
  47                 int set,
  48                 int first,
  49                 int last );
  50
  51 int
  52 tms470_write( struct flash_bank_s *bank,
  53               u8 *buffer,
  54               u32 offset,
  55               u32 count );
  56
  57 int
  58 tms470_probe( struct flash_bank_s *bank );
  59
  60 int
  61 tms470_auto_probe( struct flash_bank_s *bank );
  62
  63 int
  64 tms470_erase_check( struct flash_bank_s *bank );
  65
  66 int
  67 tms470_protect_check( struct flash_bank_s *bank );
  68
  69 int
  70 tms470_info( struct flash_bank_s *bank,
  71              char *buf,
  72              int buf_size );
  73
  74 flash_driver_t tms470_flash =
  75   {
  76     .name =               "tms470",
  77     .register_commands =  tms470_register_commands,
  78     .flash_bank_command = tms470_flash_bank_command,
  79     .erase =              tms470_erase,
  80     .protect =            tms470_protect,
  81     .write =              tms470_write,
  82     .probe =              tms470_probe,
  83     .auto_probe =         tms470_auto_probe,
  84     .erase_check =        tms470_erase_check,
  85     .protect_check =      tms470_protect_check,
  86     .info =               tms470_info
  87   };
  88
  89 /* ----------------------------------------------------------------------
  90                       Internal Support, Helpers
  91    ---------------------------------------------------------------------- */
  92
  93 const flash_sector_t TMS470R1A256_SECTORS[] =
  94   {
  95     { 0x00000000, 0x00002000, -1, -1 },
  96     { 0x00002000, 0x00002000, -1, -1 },
  97     { 0x00004000, 0x00002000, -1, -1 },
  98     { 0x00006000, 0x00002000, -1, -1 },
  99     { 0x00008000, 0x00008000, -1, -1 },
 100     { 0x00010000, 0x00008000, -1, -1 },
 101     { 0x00018000, 0x00008000, -1, -1 },
 102     { 0x00020000, 0x00008000, -1, -1 },
 103     { 0x00028000, 0x00008000, -1, -1 },
 104     { 0x00030000, 0x00008000, -1, -1 },
 105     { 0x00038000, 0x00002000, -1, -1 },
 106     { 0x0003A000, 0x00002000, -1, -1 },
 107     { 0x0003C000, 0x00002000, -1, -1 },
 108     { 0x0003E000, 0x00002000, -1, -1 },
 109   };
 110
 111 #define TMS470R1A256_NUM_SECTORS \
 112   (sizeof(TMS470R1A256_SECTORS)/sizeof(TMS470R1A256_SECTORS[0]))
 113
 114 const flash_sector_t TMS470R1A288_BANK0_SECTORS[] =
 115   {
 116     { 0x00000000, 0x00002000, -1, -1 },
 117     { 0x00002000, 0x00002000, -1, -1 },
 118     { 0x00004000, 0x00002000, -1, -1 },
 119     { 0x00006000, 0x00002000, -1, -1 },
 120   };
 121
 122 #define TMS470R1A288_BANK0_NUM_SECTORS \
 123   (sizeof(TMS470R1A288_BANK0_SECTORS)/sizeof(TMS470R1A288_BANK0_SECTORS[0]))
 124
 125 const flash_sector_t TMS470R1A288_BANK1_SECTORS[] =
 126   {
 127     { 0x00040000, 0x00010000, -1, -1 },
 128     { 0x00050000, 0x00010000, -1, -1 },
 129     { 0x00060000, 0x00010000, -1, -1 },
 130     { 0x00070000, 0x00010000, -1, -1 },
 131   };
 132
 133 #define TMS470R1A288_BANK1_NUM_SECTORS \
 134   (sizeof(TMS470R1A288_BANK1_SECTORS)/sizeof(TMS470R1A288_BANK1_SECTORS[0]))
 135
 136 /* ---------------------------------------------------------------------- */
 137
 138 int
 139 tms470_read_part_info( struct flash_bank_s *bank )
 140 {
 141   tms470_flash_bank_t *tms470_info = bank->driver_priv;
 142   target_t *target = bank->target;
 143   u32    device_ident_reg;
 144   u32    silicon_version;
 145   u32    technology_family;
 146   u32    rom_flash;
 147   u32    part_number;
 148   char * part_name;
 149
 150   if (target->state != TARGET_HALTED)
 151     {
 152       WARNING( "Cannot communicate... target not halted." );
 153       return ERROR_TARGET_NOT_HALTED;
 154     }
 155
 156   /* read and parse the device identification register */
 157   target_read_u32( target, 0xFFFFFFF0, &device_ident_reg );
 158
 159   INFO( "device_ident_reg=0x%08x", device_ident_reg );
 160
 161   if ((device_ident_reg & 7) == 0)
 162     {
 163       WARNING( "Cannot identify target as a TMS470 family." );
 164       return ERROR_FLASH_OPERATION_FAILED;
 165     }
 166
 167   silicon_version = (device_ident_reg >> 12) & 0xF;
 168   technology_family = (device_ident_reg >> 11) & 1;
 169   rom_flash = (device_ident_reg >> 10) & 1;
 170   part_number = (device_ident_reg >> 3) & 0x7f;
 171
 172   /*
 173    * If the part number is known, determine if the flash bank is valid
 174    * based on the base address being within the known flash bank
 175    * ranges.  Then fixup/complete the remaining fields of the flash
 176    * bank structure.
 177    */
 178   switch( part_number )
 179     {
 180     case 0x0a:
 181       part_name = "TMS470R1A256";
 182
 183       if (bank->base >= 0x00040000)
 184         {
 185           ERROR( "No %s flash bank contains base address 0x%08x.",
 186                  part_name, bank->base );
 187           return ERROR_FLASH_OPERATION_FAILED;
 188         }
 189       tms470_info->ordinal = 0;
 190       bank->base           = 0x00000000;
 191       bank->size           = 256*1024;
 192       bank->num_sectors    = TMS470R1A256_NUM_SECTORS;
 193       bank->sectors = malloc( sizeof( TMS470R1A256_SECTORS ) );
 194       if (!bank->sectors)
 195         {
 196           return ERROR_FLASH_OPERATION_FAILED;
 197         }
 198       (void) memcpy( bank->sectors,
 199                      TMS470R1A256_SECTORS,
 200                      sizeof( TMS470R1A256_SECTORS ) );
 201       break;
 202
 203     case 0x2b:
 204       part_name = "TMS470R1A288";
 205
 206       if ((bank->base >= 0x00000000) && (bank->base < 0x00008000))
 207         {
 208           tms470_info->ordinal = 0;
 209           bank->base           = 0x00000000;
 210           bank->size           = 32*1024;
 211           bank->num_sectors    = TMS470R1A288_BANK0_NUM_SECTORS;
 212           bank->sectors = malloc( sizeof( TMS470R1A288_BANK0_SECTORS ) );
 213           if (!bank->sectors)
 214             {
 215               return ERROR_FLASH_OPERATION_FAILED;
 216             }
 217           (void) memcpy( bank->sectors,
 218                          TMS470R1A288_BANK0_SECTORS,
 219                          sizeof( TMS470R1A288_BANK0_SECTORS ) );
 220         }
 221       else if ((bank->base >= 0x00040000) && (bank->base < 0x00080000))
 222         {
 223           tms470_info->ordinal = 1;
 224           bank->base           = 0x00040000;
 225           bank->size           = 256*1024;
 226           bank->num_sectors    = TMS470R1A288_BANK1_NUM_SECTORS;
 227           bank->sectors = malloc( sizeof( TMS470R1A288_BANK1_SECTORS ) );
 228           if (!bank->sectors)
 229             {
 230               return ERROR_FLASH_OPERATION_FAILED;
 231             }
 232           (void) memcpy( bank->sectors,
 233                          TMS470R1A288_BANK1_SECTORS,
 234                          sizeof( TMS470R1A288_BANK1_SECTORS ) );
 235         }
 236       else
 237         {
 238           ERROR( "No %s flash bank contains base address 0x%08x.",
 239                  part_name, bank->base );
 240           return ERROR_FLASH_OPERATION_FAILED;
 241         }
 242       break;
 243
 244     default:
 245       WARNING( "Could not identify part 0x%02x as a member of the TMS470 family.",
 246                part_number );
 247       return ERROR_FLASH_OPERATION_FAILED;
 248     }
 249
 250   /* turn off memory selects */
 251   target_write_u32( target, 0xFFFFFFE4, 0x00000000 );
 252   target_write_u32( target, 0xFFFFFFE0, 0x00000000 );
 253
 254   bank->chip_width = 32;
 255   bank->bus_width  = 32;
 256
 257   INFO( "Identified %s, ver=%d, core=%s, nvmem=%s.",
 258         part_name,
 259         silicon_version,
 260         (technology_family ? "1.8v" : "3.3v"),
 261         (rom_flash ? "rom" : "flash") );
 262
 263   tms470_info->device_ident_reg  = device_ident_reg;
 264   tms470_info->silicon_version   = silicon_version;
 265   tms470_info->technology_family = technology_family;
 266   tms470_info->rom_flash         = rom_flash;
 267   tms470_info->part_number       = part_number;
 268   tms470_info->part_name         = part_name;
 269
 270   /*
 271    * Disable reset on address access violation.
 272    */
 273   target_write_u32( target, 0xFFFFFFE0, 0x00004007 );
 274
 275   return ERROR_OK;
 276 }
 277
 278 /* ---------------------------------------------------------------------- */
 279
 280 u32 keysSet = 0;
 281 u32 flashKeys[4];
 282
 283 int
 284 tms470_handle_flash_keyset_command( struct command_context_s * cmd_ctx,
 285                                     char *                     cmd,
 286                                     char **                    args,
 287                                     int                        argc )
 288 {
 289   if (argc > 4)
 290     {
 291       command_print( cmd_ctx, "tms470 flash_keyset <key0> <key1> <key2> <key3>" );
 292       return ERROR_INVALID_ARGUMENTS;
 293     }
 294   else if (argc == 4)
 295     {
 296       int i;
 297
 298       for( i=0; i<4; i++ )
 299         {
 300           int start = (0 == strncmp( args[i], "0x", 2 )) ? 2 : 0;
 301           if (1 != sscanf( &args[i][start], "%x", &flashKeys[i] ))
 302             {
 303               command_print( cmd_ctx, "could not process flash key %s", args[i] );
 304               ERROR( "could not process flash key %s", args[i] );
 305               return ERROR_INVALID_ARGUMENTS;
 306             }
 307         }
 308
 309       keysSet = 1;
 310     }
 311   else if (argc != 0)
 312     {
 313       command_print( cmd_ctx, "tms470 flash_keyset <key0> <key1> <key2> <key3>" );
 314       return ERROR_INVALID_ARGUMENTS;
 315     }
 316
 317   if (keysSet)
 318     {
 319       command_print( cmd_ctx, "using flash keys 0x%08x, 0x%08x, 0x%08x, 0x%08x",
 320                      flashKeys[0], flashKeys[1], flashKeys[2], flashKeys[3] );
 321     }
 322   else
 323     {
 324       command_print( cmd_ctx, "flash keys not set" );
 325     }
 326
 327   return ERROR_OK;
 328 }
 329
 330 const u32 FLASH_KEYS_ALL_ONES[] = { 0xFFFFFFFF, 0xFFFFFFFF,
 331                                     0xFFFFFFFF, 0xFFFFFFFF, };
 332
 333 const u32 FLASH_KEYS_ALL_ZEROS[] = { 0x00000000, 0x00000000,
 334                                      0x00000000, 0x00000000, };
 335
 336 const u32 FLASH_KEYS_MIX1[] = { 0xf0fff0ff, 0xf0fff0ff,
 337                                 0xf0fff0ff, 0xf0fff0ff };
 338
 339 const u32 FLASH_KEYS_MIX2[] = { 0x0000ffff, 0x0000ffff,
 340                                 0x0000ffff, 0x0000ffff };
 341
 342 /* ---------------------------------------------------------------------- */
 343
 344 int oscMHz = 12;
 345
 346 int
 347 tms470_handle_osc_megahertz_command( struct command_context_s * cmd_ctx,
 348                                      char *                     cmd,
 349                                      char **                    args,
 350                                      int                        argc )
 351 {
 352   if (argc > 1)
 353     {
 354       command_print( cmd_ctx, "tms470 osc_megahertz <MHz>" );
 355       return ERROR_INVALID_ARGUMENTS;
 356     }
 357   else if (argc == 1)
 358     {
 359       sscanf( args[0], "%d", &oscMHz );
 360     }
 361
 362   if (oscMHz <= 0)
 363     {
 364       ERROR( "osc_megahertz must be positive and non-zero!" );
 365       command_print( cmd_ctx, "osc_megahertz must be positive and non-zero!" );
 366       oscMHz = 12;
 367       return ERROR_INVALID_ARGUMENTS;
 368     }
 369
 370   command_print( cmd_ctx, "osc_megahertz=%d", oscMHz );
 371
 372   return ERROR_OK;
 373 }
 374
 375 /* ---------------------------------------------------------------------- */
 376
 377 int plldis = 0;
 378
 379 int
 380 tms470_handle_plldis_command( struct command_context_s * cmd_ctx,
 381                               char *                     cmd,
 382                               char **                    args,
 383                               int                        argc )
 384 {
 385   if (argc > 1)
 386     {
 387       command_print( cmd_ctx, "tms470 plldis <0|1>" );
 388       return ERROR_INVALID_ARGUMENTS;
 389     }
 390   else if (argc == 1)
 391     {
 392       sscanf( args[0], "%d", &plldis );
 393       plldis = plldis ? 1 : 0;
 394     }
 395
 396   command_print( cmd_ctx, "plldis=%d", plldis );
 397
 398   return ERROR_OK;
 399 }
 400
 401 /* ---------------------------------------------------------------------- */
 402
 403 int
 404 tms470_check_flash_unlocked( target_t * target )
 405 {
 406   u32 fmbbusy;
 407
 408   target_read_u32( target, 0xFFE89C08, &fmbbusy );
 409   INFO( "tms470 fmbbusy=0x%08x -> %s",
 410          fmbbusy,
 411          fmbbusy & 0x8000 ? "unlocked" : "LOCKED" );
 412   return fmbbusy & 0x8000 ? ERROR_OK : ERROR_FLASH_OPERATION_FAILED;
 413 }
 414
 415 /* ---------------------------------------------------------------------- */
 416
 417 int
 418 tms470_try_flash_keys( target_t *  target,
 419                        const u32 * key_set )
 420 {
 421   u32 glbctrl, fmmstat;
 422   int retval = ERROR_FLASH_OPERATION_FAILED;
 423
 424   /* set GLBCTRL.4  */
 425   target_read_u32( target, 0xFFFFFFDC, &glbctrl );
 426   target_write_u32( target, 0xFFFFFFDC, glbctrl | 0x10 );
 427
 428   /* only perform the key match when 3VSTAT is clear */
 429   target_read_u32( target, 0xFFE8BC0C, &fmmstat );
 430   if (!(fmmstat & 0x08))
 431     {
 432       unsigned i;
 433       u32 fmbptr, fmbac2, orig_fmregopt;
 434
 435       target_write_u32( target, 0xFFE8BC04, fmmstat & ~0x07 );
 436
 437       /* wait for pump ready */
 438       do
 439         {
 440           target_read_u32( target, 0xFFE8A814, &fmbptr );
 441           usleep( 1000 );
 442         }
 443       while( !(fmbptr & 0x0200) );
 444
 445       /* force max wait states */
 446       target_read_u32( target, 0xFFE88004, &fmbac2 );
 447       target_write_u32( target, 0xFFE88004, fmbac2 | 0xff );
 448
 449       /* save current access mode, force normal read mode */
 450       target_read_u32( target, 0xFFE89C00, &orig_fmregopt );
 451       target_write_u32( target, 0xFFE89C00, 0x00 );
 452
 453       for( i=0; i<4; i++ )
 454         {
 455           u32 tmp;
 456
 457           /* There is no point displaying the value of tmp, it is
 458            * filtered by the chip.  The purpose of this read is to
 459            * prime the unlocking logic rather than read out the value.
 460            */
 461           target_read_u32( target, 0x00001FF0+4*i, &tmp );
 462
 463           INFO( "tms470 writing fmpkey=0x%08x", key_set[i] );
 464           target_write_u32( target, 0xFFE89C0C, key_set[i] );
 465         }
 466
 467       if (ERROR_OK == tms470_check_flash_unlocked( target ))
 468         {
 469           /*
 470            * There seems to be a side-effect of reading the FMPKEY
 471            * register in that it re-enables the protection.  So we
 472            * re-enable it.
 473            */
 474           for( i=0; i<4; i++ )
 475             {
 476               u32 tmp;
 477               target_read_u32( target, 0x00001FF0+4*i, &tmp );
 478               target_write_u32( target, 0xFFE89C0C, key_set[i] );
 479             }
 480           retval = ERROR_OK;
 481         }
 482
 483       /* restore settings */
 484       target_write_u32( target, 0xFFE89C00, orig_fmregopt );
 485       target_write_u32( target, 0xFFE88004, fmbac2 );
 486     }
 487
 488   /* clear config bit */
 489   target_write_u32( target, 0xFFFFFFDC, glbctrl );
 490
 491   return retval;
 492 }
 493
 494 /* ---------------------------------------------------------------------- */
 495
 496 int
 497 tms470_unlock_flash( struct flash_bank_s * bank )
 498 {
 499   target_t *            target =      bank->target;
 500   const u32 *           p_key_sets[5];
 501   unsigned              i, key_set_count;
 502
 503   if (keysSet)
 504     {
 505       p_key_sets[0] = flashKeys;
 506       p_key_sets[1] = FLASH_KEYS_ALL_ONES;
 507       p_key_sets[2] = FLASH_KEYS_ALL_ZEROS;
 508       p_key_sets[3] = FLASH_KEYS_MIX1;
 509       p_key_sets[4] = FLASH_KEYS_MIX2;
 510     }
 511   else
 512     {
 513       key_set_count = 4;
 514       p_key_sets[0] = FLASH_KEYS_ALL_ONES;
 515       p_key_sets[1] = FLASH_KEYS_ALL_ZEROS;
 516       p_key_sets[2] = FLASH_KEYS_MIX1;
 517       p_key_sets[3] = FLASH_KEYS_MIX2;
 518     }
 519
 520   for( i=0; i<key_set_count; i++ )
 521     {
 522       if (tms470_try_flash_keys( target, p_key_sets[i] ) == ERROR_OK)
 523         {
 524           INFO( "tms470 flash is unlocked" );
 525           return ERROR_OK;
 526         }
 527     }
 528
 529   WARNING( "tms470 could not unlock flash memory protection level 2" );
 530   return ERROR_FLASH_OPERATION_FAILED;
 531 }
 532
 533 /* ---------------------------------------------------------------------- */
 534
 535 int
 536 tms470_flash_initialize_internal_state_machine( struct flash_bank_s * bank )
 537 {
 538   u32 fmmac2, fmmac1, fmmaxep, k, delay, glbctrl, sysclk;
 539   target_t *target = bank->target;
 540   tms470_flash_bank_t * tms470_info = bank->driver_priv;
 541   int result = ERROR_OK;
 542
 543   /*
 544    * Select the desired bank to be programmed by writing BANK[2:0] of
 545    * FMMAC2.
 546    */
 547   target_read_u32( target, 0xFFE8BC04, &fmmac2 );
 548   fmmac2 &= ~0x0007;
 549   fmmac2 |= (tms470_info->ordinal & 7);
 550   target_write_u32( target, 0xFFE8BC04, fmmac2 );
 551   DEBUG( "set fmmac2=0x%04x", fmmac2 );
 552
 553   /*
 554    * Disable level 1 sector protection by setting bit 15 of FMMAC1.
 555    */
 556   target_read_u32( target, 0xFFE8BC00, &fmmac1 );
 557   fmmac1 |= 0x8000;
 558   target_write_u32( target, 0xFFE8BC00, fmmac1 );
 559   DEBUG( "set fmmac1=0x%04x", fmmac1 );
 560
 561   /*
 562    * FMTCREG=0x2fc0;
 563    */
 564   target_write_u32( target, 0xFFE8BC10, 0x2fc0 );
 565   DEBUG( "set fmtcreg=0x2fc0" );
 566
 567   /*
 568    * MAXPP=50
 569    */
 570   target_write_u32( target, 0xFFE8A07C, 50 );
 571   DEBUG( "set fmmaxpp=50" );
 572
 573   /*
 574    * MAXCP=0xf000+2000
 575    */
 576   target_write_u32( target, 0xFFE8A084, 0xf000+2000 );
 577   DEBUG( "set fmmaxcp=0x%04x", 0xf000+2000 );
 578
 579     /*
 580    * configure VHV
 581    */
 582   target_read_u32( target, 0xFFE8A080, &fmmaxep );
 583   if (fmmaxep == 0xf000)
 584     {
 585       fmmaxep = 0xf000+4095;
 586       target_write_u32( target, 0xFFE8A80C, 0x9964 );
 587       DEBUG( "set fmptr3=0x9964" );
 588     }
 589   else
 590     {
 591       fmmaxep = 0xa000+4095;
 592       target_write_u32( target, 0xFFE8A80C, 0x9b64 );
 593       DEBUG( "set fmptr3=0x9b64" );
 594     }
 595   target_write_u32( target, 0xFFE8A080, fmmaxep );
 596   DEBUG( "set fmmaxep=0x%04x", fmmaxep );
 597
 598   /*
 599    * FMPTR4=0xa000
 600    */
 601   target_write_u32( target, 0xFFE8A810, 0xa000 );
 602   DEBUG( "set fmptr4=0xa000" );
 603
 604   /*
 605    * FMPESETUP, delay parameter selected based on clock frequency.
 606    *
 607    * According to the TI App Note SPNU257 and flashing code, delay is
 608    * int((sysclk(MHz) + 1) / 2), with a minimum of 5.  The system
 609    * clock is usually derived from the ZPLL module, and selected by
 610    * the plldis global.
 611    */
 612   target_read_u32( target, 0xFFFFFFDC, &glbctrl );
 613   sysclk = (plldis ? 1 : (glbctrl & 0x08) ? 4 : 8 ) * oscMHz / (1 + (glbctrl & 7));
 614   delay = (sysclk > 10) ? (sysclk + 1) / 2 : 5;
 615   target_write_u32( target, 0xFFE8A018, (delay<<4)|(delay<<8) );
 616   DEBUG( "set fmpsetup=0x%04x", (delay<<4)|(delay<<8) );
 617
 618   /*
 619    * FMPVEVACCESS, based on delay.
 620    */
 621   k = delay|(delay<<8);
 622   target_write_u32( target, 0xFFE8A05C, k );
 623   DEBUG( "set fmpvevaccess=0x%04x", k );
 624
 625   /*
 626    * FMPCHOLD, FMPVEVHOLD, FMPVEVSETUP, based on delay.
 627    */
 628   k <<= 1;
 629   target_write_u32( target, 0xFFE8A034, k );
 630   DEBUG( "set fmpchold=0x%04x", k );
 631   target_write_u32( target, 0xFFE8A040, k );
 632   DEBUG( "set fmpvevhold=0x%04x", k );
 633   target_write_u32( target, 0xFFE8A024, k );
 634   DEBUG( "set fmpvevsetup=0x%04x", k );
 635
 636   /*
 637    * FMCVACCESS, based on delay.
 638    */
 639   k = delay*16;
 640   target_write_u32( target, 0xFFE8A060, k );
 641   DEBUG( "set fmcvaccess=0x%04x", k );
 642
 643   /*
 644    * FMCSETUP, based on delay.
 645    */
 646   k = 0x3000 | delay*20;
 647   target_write_u32( target, 0xFFE8A020, k );
 648   DEBUG( "set fmcsetup=0x%04x", k );
 649
 650   /*
 651    * FMEHOLD, based on delay.
 652    */
 653   k = (delay*20) << 2;
 654   target_write_u32( target, 0xFFE8A038, k );
 655   DEBUG( "set fmehold=0x%04x", k );
 656
 657   /*
 658    * PWIDTH, CWIDTH, EWIDTH, based on delay.
 659    */
 660   target_write_u32( target, 0xFFE8A050, delay*8 );
 661   DEBUG( "set fmpwidth=0x%04x", delay*8 );
 662   target_write_u32( target, 0xFFE8A058, delay*1000 );
 663   DEBUG( "set fmcwidth=0x%04x", delay*1000 );
 664   target_write_u32( target, 0xFFE8A054, delay*5400 );
 665   DEBUG( "set fmewidth=0x%04x", delay*5400 );
 666
 667   return result;
 668 }
 669
 670
 671 /* ---------------------------------------------------------------------- */
 672
 673 int
 674 tms470_flash_status( struct flash_bank_s * bank )
 675 {
 676   target_t *target = bank->target;
 677   int result = ERROR_OK;
 678   u32 fmmstat;
 679
 680   target_read_u32( target, 0xFFE8BC0C, &fmmstat );
 681   DEBUG( "set fmmstat=0x%04x", fmmstat );
 682
 683   if (fmmstat & 0x0080)
 684     {
 685       WARNING( "tms470 flash command: erase still active after busy clear." );
 686       result = ERROR_FLASH_OPERATION_FAILED;
 687     }
 688
 689   if (fmmstat & 0x0040)
 690     {
 691       WARNING( "tms470 flash command: program still active after busy clear." );
 692       result = ERROR_FLASH_OPERATION_FAILED;
 693     }
 694
 695   if (fmmstat & 0x0020)
 696     {
 697       WARNING( "tms470 flash command: invalid data command." );
 698       result = ERROR_FLASH_OPERATION_FAILED;
 699     }
 700
 701   if (fmmstat & 0x0010)
 702     {
 703       WARNING( "tms470 flash command: program, erase or validate sector failed." );
 704       result = ERROR_FLASH_OPERATION_FAILED;
 705     }
 706
 707   if (fmmstat & 0x0008)
 708     {
 709       WARNING( "tms470 flash command: voltage instability detected." );
 710       result = ERROR_FLASH_OPERATION_FAILED;
 711     }
 712
 713   if (fmmstat & 0x0006)
 714     {
 715       WARNING( "tms470 flash command: command suspend detected." );
 716       result = ERROR_FLASH_OPERATION_FAILED;
 717     }
 718
 719   if (fmmstat & 0x0001)
 720     {
 721       WARNING( "tms470 flash command: sector was locked." );
 722       result = ERROR_FLASH_OPERATION_FAILED;
 723     }
 724
 725   return result;
 726 }
 727
 728 /* ---------------------------------------------------------------------- */
 729
 730 int
 731 tms470_erase_sector( struct flash_bank_s * bank,
 732                      int                   sector )
 733 {
 734   u32 glbctrl, orig_fmregopt, fmbsea, fmbseb, fmmstat;
 735   target_t *target = bank->target;
 736   u32 flashAddr = bank->base + bank->sectors[sector].offset;
 737   int result = ERROR_OK;
 738
 739   /*
 740    * Set the bit GLBCTRL4 of the GLBCTRL register (in the System
 741    * module) to enable writing to the flash registers }.
 742    */
 743   target_read_u32( target, 0xFFFFFFDC, &glbctrl );
 744   target_write_u32( target, 0xFFFFFFDC, glbctrl | 0x10 );
 745   DEBUG( "set glbctrl=0x%08x", glbctrl | 0x10 );
 746
 747   /* Force normal read mode. */
 748   target_read_u32( target, 0xFFE89C00, &orig_fmregopt );
 749   target_write_u32( target, 0xFFE89C00, 0 );
 750   DEBUG( "set fmregopt=0x%08x", 0 );
 751
 752   (void) tms470_flash_initialize_internal_state_machine( bank );
 753
 754   /*
 755    * Select one or more bits in FMBSEA or FMBSEB to disable Level 1
 756    * protection for the particular sector to be erased/written.
 757    */
 758   if (sector < 16)
 759     {
 760       target_read_u32( target, 0xFFE88008, &fmbsea );
 761       target_write_u32( target, 0xFFE88008, fmbsea | (1<<sector) );
 762       DEBUG( "set fmbsea=0x%04x", fmbsea | (1<<sector) );
 763     }
 764   else
 765     {
 766       target_read_u32( target, 0xFFE8800C, &fmbseb );
 767       target_write_u32( target, 0xFFE8800C, fmbseb | (1<<(sector-16)) );
 768       DEBUG( "set fmbseb=0x%04x", fmbseb | (1<<(sector-16)) );
 769     }
 770   bank->sectors[sector].is_protected = 0;
 771
 772   /*
 773    * clear status regiser, sent erase command, kickoff erase
 774    */
 775   target_write_u16( target, flashAddr, 0x0040 );
 776   DEBUG( "write *(u16 *)0x%08x=0x0040", flashAddr );
 777   target_write_u16( target, flashAddr, 0x0020 );
 778   DEBUG( "write *(u16 *)0x%08x=0x0020", flashAddr );
 779   target_write_u16( target, flashAddr, 0xffff );
 780   DEBUG( "write *(u16 *)0x%08x=0xffff", flashAddr );
 781
 782   /*
 783    * Monitor FMMSTAT, busy until clear, then check and other flags for
 784    * ultimate result of the operation.
 785    */
 786   do
 787     {
 788       target_read_u32( target, 0xFFE8BC0C, &fmmstat );
 789       if (fmmstat & 0x0100)
 790         {
 791           usleep( 1000 );
 792         }
 793     }
 794   while( fmmstat & 0x0100 );
 795
 796   result = tms470_flash_status( bank );
 797
 798   if (sector < 16)
 799     {
 800       target_write_u32( target, 0xFFE88008, fmbsea );
 801       DEBUG( "set fmbsea=0x%04x", fmbsea );
 802       bank->sectors[sector].is_protected =
 803         fmbsea & (1<<sector) ? 0 : 1;
 804     }
 805   else
 806     {
 807       target_write_u32( target, 0xFFE8800C, fmbseb );
 808       DEBUG( "set fmbseb=0x%04x", fmbseb );
 809       bank->sectors[sector].is_protected =
 810         fmbseb & (1<<(sector-16)) ? 0 : 1;
 811     }
 812   target_write_u32( target, 0xFFE89C00, orig_fmregopt );
 813   DEBUG( "set fmregopt=0x%08x", orig_fmregopt );
 814   target_write_u32( target, 0xFFFFFFDC, glbctrl );
 815   DEBUG( "set glbctrl=0x%08x", glbctrl );
 816
 817   if (result == ERROR_OK)
 818     {
 819       bank->sectors[sector].is_erased = 1;
 820     }
 821
 822   return result;
 823 }
 824
 825 /* ----------------------------------------------------------------------
 826               Implementation of Flash Driver Interfaces
 827    ---------------------------------------------------------------------- */
 828
 829 int
 830 tms470_register_commands( struct command_context_s *cmd_ctx )
 831 {
 832   command_t *tms470_cmd = register_command( cmd_ctx,
 833                                             NULL,
 834                                             "tms470",
 835                                             NULL,
 836                                             COMMAND_ANY,
 837                                             "applies to TI tms470 family" );
 838
 839   register_command( cmd_ctx,
 840                     tms470_cmd,
 841                     "flash_keyset",
 842                     tms470_handle_flash_keyset_command,
 843                     COMMAND_ANY,
 844                    "tms470 flash_keyset <key0> <key1> <key2> <key3>" );
 845
 846   register_command( cmd_ctx,
 847                     tms470_cmd,
 848                     "osc_megahertz",
 849                     tms470_handle_osc_megahertz_command,
 850                     COMMAND_ANY,
 851                     "tms470 osc_megahertz <MHz>" );
 852
 853   register_command( cmd_ctx,
 854                     tms470_cmd,
 855                     "plldis",
 856                     tms470_handle_plldis_command,
 857                     COMMAND_ANY,
 858                     "tms470 plldis <0/1>" );
 859
 860   return ERROR_OK;
 861 }
 862
 863 /* ---------------------------------------------------------------------- */
 864
 865 int
 866 tms470_erase( struct flash_bank_s * bank,
 867               int                   first,
 868               int                   last )
 869 {
 870   tms470_flash_bank_t *tms470_info = bank->driver_priv;
 871   int sector, result = ERROR_OK;
 872
 873   if (!tms470_info->device_ident_reg)
 874     {
 875       tms470_read_part_info( bank );
 876     }
 877
 878   if ((first < 0) ||
 879       (first >= bank->num_sectors) ||
 880       (last < 0) ||
 881       (last >= bank->num_sectors) ||
 882       (first > last))
 883     {
 884       ERROR( "Sector range %d to %d invalid.", first, last );
 885       return ERROR_FLASH_SECTOR_INVALID;
 886     }
 887
 888   result = tms470_unlock_flash( bank );
 889   if (result != ERROR_OK)
 890     {
 891       return result;
 892     }
 893
 894   for( sector=first; sector<=last; sector++ )
 895     {
 896       INFO( "Erasing tms470 bank %d sector %d...",
 897             tms470_info->ordinal, sector );
 898
 899       result = tms470_erase_sector( bank, sector );
 900
 901       if (result != ERROR_OK)
 902         {
 903           ERROR( "tms470 could not erase flash sector." );
 904           break;
 905         }
 906       else
 907         {
 908           INFO( "sector erased successfully." );
 909         }
 910     }
 911
 912   return result;
 913 }
 914
 915 /* ---------------------------------------------------------------------- */
 916
 917 int
 918 tms470_protect( struct flash_bank_s * bank,
 919                 int                   set,
 920                 int                   first,
 921                 int                   last )
 922 {
 923   tms470_flash_bank_t *tms470_info = bank->driver_priv;
 924   target_t *target = bank->target;
 925   u32 fmmac2, fmbsea, fmbseb;
 926   int sector;
 927
 928   if (!tms470_info->device_ident_reg)
 929     {
 930       tms470_read_part_info( bank );
 931     }
 932
 933   if ((first < 0) ||
 934       (first >= bank->num_sectors) ||
 935       (last < 0) ||
 936       (last >= bank->num_sectors) ||
 937       (first > last))
 938     {
 939       ERROR( "Sector range %d to %d invalid.", first, last );
 940       return ERROR_FLASH_SECTOR_INVALID;
 941     }
 942
 943   /* enable the appropriate bank */
 944   target_read_u32( target, 0xFFE8BC04, &fmmac2 );
 945   target_write_u32( target, 0xFFE8BC04,
 946                     (fmmac2 & ~7) | tms470_info->ordinal );
 947
 948   /* get the original sector proection flags for this bank */
 949   target_read_u32( target, 0xFFE88008, &fmbsea );
 950   target_read_u32( target, 0xFFE8800C, &fmbseb );
 951
 952   for( sector=0; sector<bank->num_sectors; sector++ )
 953     {
 954       if (sector < 16)
 955         {
 956           fmbsea = set ? fmbsea & ~(1<<sector) :
 957                          fmbsea | (1<<sector);
 958           bank->sectors[sector].is_protected = set ? 1 : 0;
 959         }
 960       else
 961         {
 962           fmbseb = set ? fmbseb & ~(1<<(sector-16)) :
 963                          fmbseb | (1<<(sector-16));
 964           bank->sectors[sector].is_protected = set ? 1 : 0;
 965         }
 966     }
 967
 968   /* update the protection bits */
 969   target_write_u32( target, 0xFFE88008, fmbsea );
 970   target_write_u32( target, 0xFFE8800C, fmbseb );
 971
 972   return ERROR_OK;
 973 }
 974
 975 /* ---------------------------------------------------------------------- */
 976
 977 int
 978 tms470_write( struct flash_bank_s * bank,
 979               u8 *                  buffer,
 980               u32                   offset,
 981               u32                   count )
 982 {
 983   target_t *target = bank->target;
 984   tms470_flash_bank_t *tms470_info = bank->driver_priv;
 985   u32 glbctrl, fmbac2, orig_fmregopt, fmbsea, fmbseb, fmmaxpp, fmmstat;
 986   int i, result = ERROR_OK;
 987
 988   if (!tms470_info->device_ident_reg)
 989     {
 990       tms470_read_part_info( bank );
 991     }
 992
 993   INFO( "Writing %d bytes starting at 0x%08x",
 994         count, bank->base + offset );
 995
 996   /* set GLBCTRL.4  */
 997   target_read_u32( target, 0xFFFFFFDC, &glbctrl );
 998   target_write_u32( target, 0xFFFFFFDC, glbctrl | 0x10 );
 999
1000   (void) tms470_flash_initialize_internal_state_machine( bank );
1001
1002   /* force max wait states */
1003   target_read_u32( target, 0xFFE88004, &fmbac2 );
1004   target_write_u32( target, 0xFFE88004, fmbac2 | 0xff );
1005
1006   /* save current access mode, force normal read mode */
1007   target_read_u32( target, 0xFFE89C00, &orig_fmregopt );
1008   target_write_u32( target, 0xFFE89C00, 0x00 );
1009
1010   /*
1011    * Disable Level 1 protection for all sectors to be erased/written.
1012    */
1013   target_read_u32( target, 0xFFE88008, &fmbsea );
1014   target_write_u32( target, 0xFFE88008, 0xffff );
1015   target_read_u32( target, 0xFFE8800C, &fmbseb );
1016   target_write_u32( target, 0xFFE8800C, 0xffff );
1017
1018   /* read MAXPP */
1019   target_read_u32( target, 0xFFE8A07C, &fmmaxpp );
1020
1021   for( i=0; i<count; i+=2 )
1022     {
1023       u32 addr = bank->base + offset + i;
1024       u16 word = (((u16) buffer[i]) << 8) | (u16) buffer[i+1];
1025
1026       if (word != 0xffff)
1027         {
1028           INFO( "writing 0x%04x at 0x%08x", word, addr );
1029
1030           /* clear status register */
1031           target_write_u16( target, addr, 0x0040 );
1032           /* program flash command */
1033           target_write_u16( target, addr, 0x0010 );
1034           /* burn the 16-bit word (big-endian) */
1035           target_write_u16( target, addr, word );
1036
1037           /*
1038            * Monitor FMMSTAT, busy until clear, then check and other flags
1039            * for ultimate result of the operation.
1040            */
1041           do
1042             {
1043               target_read_u32( target, 0xFFE8BC0C, &fmmstat );
1044               if (fmmstat & 0x0100)
1045                 {
1046                   usleep( 1000 );
1047                 }
1048             }
1049           while( fmmstat & 0x0100 );
1050
1051           if (fmmstat & 0x3ff)
1052             {
1053               ERROR( "fmstat=0x%04x", fmmstat );
1054               ERROR( "Could not program word 0x%04x at address 0x%08x.",
1055                      word, addr );
1056               result = ERROR_FLASH_OPERATION_FAILED;
1057               break;
1058             }
1059         }
1060       else
1061         {
1062           INFO( "skipping 0xffff at 0x%08x", addr );
1063         }
1064     }
1065
1066   /* restore */
1067   target_write_u32( target, 0xFFE88008, fmbsea );
1068   target_write_u32( target, 0xFFE8800C, fmbseb );
1069   target_write_u32( target, 0xFFE88004, fmbac2 );
1070   target_write_u32( target, 0xFFE89C00, orig_fmregopt );
1071   target_write_u32( target, 0xFFFFFFDC, glbctrl );
1072
1073   return result;
1074 }
1075
1076 /* ---------------------------------------------------------------------- */
1077
1078 int
1079 tms470_probe( struct flash_bank_s * bank )
1080 {
1081   tms470_flash_bank_t * tms470_info = bank->driver_priv;
1082
1083   tms470_info->probed = 0;
1084
1085   if (!tms470_info->device_ident_reg)
1086     {
1087       tms470_read_part_info( bank );
1088     }
1089
1090   tms470_info->probed = 1;
1091
1092   return ERROR_OK;
1093 }
1094
1095 int
1096 tms470_auto_probe( struct flash_bank_s * bank )
1097 {
1098         tms470_flash_bank_t * tms470_info = bank->driver_priv;
1099         if (tms470_info->probed)
1100                 return ERROR_OK;
1101         return tms470_probe(bank);
1102 }
1103 /* ---------------------------------------------------------------------- */
1104
1105 int
1106 tms470_erase_check( struct flash_bank_s * bank )
1107 {
1108   target_t *target = bank->target;
1109   tms470_flash_bank_t * tms470_info = bank->driver_priv;
1110   int sector, result = ERROR_OK;
1111   u32 fmmac2, fmbac2, glbctrl, orig_fmregopt;
1112   static u8 buffer[64*1024];
1113
1114   if (!tms470_info->device_ident_reg)
1115     {
1116       tms470_read_part_info( bank );
1117     }
1118
1119   /* set GLBCTRL.4  */
1120   target_read_u32( target, 0xFFFFFFDC, &glbctrl );
1121   target_write_u32( target, 0xFFFFFFDC, glbctrl | 0x10 );
1122
1123   /* save current access mode, force normal read mode */
1124   target_read_u32( target, 0xFFE89C00, &orig_fmregopt );
1125   target_write_u32( target, 0xFFE89C00, 0x00 );
1126
1127   /* enable the appropriate bank */
1128   target_read_u32( target, 0xFFE8BC04, &fmmac2 );
1129   target_write_u32( target, 0xFFE8BC04,
1130                     (fmmac2 & ~7) | tms470_info->ordinal );
1131
1132   /* TCR=0 */
1133   target_write_u32( target, 0xFFE8BC10, 0x2fc0 );
1134
1135   /* clear TEZ in fmbrdy */
1136   target_write_u32( target, 0xFFE88010, 0x0b );
1137
1138   /* save current wait states, force max */
1139   target_read_u32( target, 0xFFE88004, &fmbac2 );
1140   target_write_u32( target, 0xFFE88004, fmbac2 | 0xff );
1141
1142   /*
1143    * The TI primitives inspect the flash memory by reading one 32-bit
1144    * word at a time.  Here we read an entire sector and inspect it in
1145    * an attempt to reduce the JTAG overhead.
1146    */
1147   for( sector=0; sector<bank->num_sectors; sector++ )
1148     {
1149       if (bank->sectors[sector].is_erased != 1)
1150         {
1151           u32 i, addr = bank->base + bank->sectors[sector].offset;
1152
1153           INFO( "checking flash bank %d sector %d",
1154                 tms470_info->ordinal,
1155                 sector );
1156
1157           target_read_buffer( target,
1158                               addr,
1159                               bank->sectors[sector].size,
1160                               buffer );
1161
1162           bank->sectors[sector].is_erased = 1;
1163           for( i=0; i<bank->sectors[sector].size; i++ )
1164             {
1165               if (buffer[i] != 0xff)
1166                 {
1167                   WARNING( "tms470 bank %d, sector %d, not erased.",
1168                            tms470_info->ordinal,
1169                            sector );
1170                   WARNING( "at location 0x%08x: flash data is 0x%02x.",
1171                            addr+i,
1172                            buffer[i] );
1173
1174                   bank->sectors[sector].is_erased = 0;
1175                   break;
1176                 }
1177             }
1178         }
1179       if (bank->sectors[sector].is_erased != 1)
1180         {
1181           result = ERROR_FLASH_SECTOR_NOT_ERASED;
1182           break;
1183         }
1184       else
1185         {
1186           INFO( "sector erased" );
1187         }
1188     }
1189
1190   /* reset TEZ, wait states, read mode, GLBCTRL.4 */
1191   target_write_u32( target, 0xFFE88010, 0x0f );
1192   target_write_u32( target, 0xFFE88004, fmbac2 );
1193   target_write_u32( target, 0xFFE89C00, orig_fmregopt );
1194   target_write_u32( target, 0xFFFFFFDC, glbctrl );
1195
1196   return result;
1197 }
1198
1199 /* ---------------------------------------------------------------------- */
1200
1201 int
1202 tms470_protect_check( struct flash_bank_s * bank )
1203 {
1204   target_t *target = bank->target;
1205   tms470_flash_bank_t * tms470_info = bank->driver_priv;
1206   int sector, result = ERROR_OK;
1207   u32 fmmac2, fmbsea, fmbseb;
1208
1209   if (!tms470_info->device_ident_reg)
1210     {
1211       tms470_read_part_info( bank );
1212     }
1213
1214   /* enable the appropriate bank */
1215   target_read_u32( target, 0xFFE8BC04, &fmmac2 );
1216   target_write_u32( target, 0xFFE8BC04,
1217                     (fmmac2 & ~7) | tms470_info->ordinal );
1218
1219   target_read_u32( target, 0xFFE88008, &fmbsea );
1220   target_read_u32( target, 0xFFE8800C, &fmbseb );
1221
1222   for( sector=0; sector<bank->num_sectors; sector++ )
1223     {
1224       int protected;
1225
1226       if (sector < 16)
1227         {
1228           protected = fmbsea & (1<<sector) ? 0 : 1;
1229           bank->sectors[sector].is_protected = protected;
1230         }
1231       else
1232         {
1233           protected = fmbseb & (1<<(sector-16)) ? 0 : 1;
1234           bank->sectors[sector].is_protected = protected;
1235         }
1236
1237       DEBUG( "bank %d sector %d is %s",
1238              tms470_info->ordinal,
1239              sector,
1240              protected ? "protected" : "not protected" );
1241     }
1242
1243   return result;
1244 }
1245
1246 /* ---------------------------------------------------------------------- */
1247
1248 int
1249 tms470_info( struct flash_bank_s * bank,
1250              char *                buf,
1251              int                   buf_size )
1252 {
1253   int used = 0;
1254   tms470_flash_bank_t * tms470_info = bank->driver_priv;
1255
1256   if (!tms470_info->device_ident_reg)
1257     {
1258       tms470_read_part_info( bank );
1259     }
1260
1261   if (!tms470_info->device_ident_reg)
1262     {
1263       (void) snprintf(buf, buf_size, "Cannot identify target as a TMS470\n");
1264       return ERROR_FLASH_OPERATION_FAILED;
1265     }
1266
1267   used += snprintf( buf, buf_size,
1268                     "\ntms470 information: Chip is %s\n",
1269                     tms470_info->part_name );
1270   buf += used;
1271   buf_size -= used;
1272
1273   used += snprintf( buf, buf_size,
1274                     "Flash protection level 2 is %s\n",
1275                     tms470_check_flash_unlocked( bank->target ) == ERROR_OK ? "disabled" : "enabled" );
1276   buf += used;
1277   buf_size -= used;
1278
1279   return ERROR_OK;
1280 }
1281
1282 /* ---------------------------------------------------------------------- */
1283
1284 /*
1285  * flash bank tms470 <base> <size> <chip_width> <bus_width> <target>
1286  * [options...]
1287  */
1288
1289 int
1290 tms470_flash_bank_command( struct command_context_s *cmd_ctx,
1291                            char *cmd,
1292                            char **args,
1293                            int argc,
1294                            struct flash_bank_s *bank )
1295 {
1296   bank->driver_priv = malloc( sizeof( tms470_flash_bank_t ) );
1297
1298   if (!bank->driver_priv)
1299     {
1300       return ERROR_FLASH_OPERATION_FAILED;
1301     }
1302
1303   (void) memset( bank->driver_priv, 0, sizeof( tms470_flash_bank_t ) );
1304
1305   return ERROR_OK;
1306 }