git.gag.com Git - fw/openocd/blob - src/flash/tms470.c

   1 /***************************************************************************
   2  *   (c) Copyright 2007, 2008 by Christopher Kilgour                       *
   3  *   techie |_at_| whiterocker |_dot_| com                                 *
   4  *                                                                         *
   5  *   This program is free software; you can redistribute it and/or modify  *
   6  *   it under the terms of the GNU General Public License as published by  *
   7  *   the Free Software Foundation; either version 2 of the License, or     *
   8  *   (at your option) any later version.                                   *
   9  *                                                                         *
  10  *   This program is distributed in the hope that it will be useful,       *
  11  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  12  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  13  *   GNU General Public License for more details.                          *
  14  *                                                                         *
  15  *   You should have received a copy of the GNU General Public License     *
  16  *   along with this program; if not, write to the                         *
  17  *   Free Software Foundation, Inc.,                                       *
  18  *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  19  ***************************************************************************/
  20
  21 #ifdef HAVE_CONFIG_H
  22 #include "config.h"
  23 #endif
  24
  25 #include "log.h"
  26 #include "tms470.h"
  27 #include <string.h>
  28 #include <unistd.h>
  29
  30 int
  31 tms470_register_commands( struct command_context_s *cmd_ctx );
  32
  33 int
  34 tms470_flash_bank_command( struct command_context_s *cmd_ctx,
  35                            char *cmd,
  36                            char **args,
  37                            int argc,
  38                            struct flash_bank_s *bank );
  39
  40 int
  41 tms470_erase( struct flash_bank_s *bank,
  42               int first,
  43               int last );
  44
  45 int
  46 tms470_protect( struct flash_bank_s *bank,
  47                 int set,
  48                 int first,
  49                 int last );
  50
  51 int
  52 tms470_write( struct flash_bank_s *bank,
  53               u8 *buffer,
  54               u32 offset,
  55               u32 count );
  56
  57 int
  58 tms470_probe( struct flash_bank_s *bank );
  59
  60 int
  61 tms470_auto_probe( struct flash_bank_s *bank );
  62
  63 int
  64 tms470_erase_check( struct flash_bank_s *bank );
  65
  66 int
  67 tms470_protect_check( struct flash_bank_s *bank );
  68
  69 int
  70 tms470_info( struct flash_bank_s *bank,
  71              char *buf,
  72              int buf_size );
  73
  74 flash_driver_t tms470_flash =
  75   {
  76     .name =               "tms470",
  77     .register_commands =  tms470_register_commands,
  78     .flash_bank_command = tms470_flash_bank_command,
  79     .erase =              tms470_erase,
  80     .protect =            tms470_protect,
  81     .write =              tms470_write,
  82     .probe =              tms470_probe,
  83     .auto_probe =         tms470_auto_probe,
  84     .erase_check =        tms470_erase_check,
  85     .protect_check =      tms470_protect_check,
  86     .info =               tms470_info
  87   };
  88
  89 /* ----------------------------------------------------------------------
  90                       Internal Support, Helpers
  91    ---------------------------------------------------------------------- */
  92
  93 const flash_sector_t TMS470R1A256_SECTORS[] =
  94   {
  95     { 0x00000000, 0x00002000, -1, -1 },
  96     { 0x00002000, 0x00002000, -1, -1 },
  97     { 0x00004000, 0x00002000, -1, -1 },
  98     { 0x00006000, 0x00002000, -1, -1 },
  99     { 0x00008000, 0x00008000, -1, -1 },
 100     { 0x00010000, 0x00008000, -1, -1 },
 101     { 0x00018000, 0x00008000, -1, -1 },
 102     { 0x00020000, 0x00008000, -1, -1 },
 103     { 0x00028000, 0x00008000, -1, -1 },
 104     { 0x00030000, 0x00008000, -1, -1 },
 105     { 0x00038000, 0x00002000, -1, -1 },
 106     { 0x0003A000, 0x00002000, -1, -1 },
 107     { 0x0003C000, 0x00002000, -1, -1 },
 108     { 0x0003E000, 0x00002000, -1, -1 },
 109   };
 110
 111 #define TMS470R1A256_NUM_SECTORS \
 112   (sizeof(TMS470R1A256_SECTORS)/sizeof(TMS470R1A256_SECTORS[0]))
 113
 114 const flash_sector_t TMS470R1A288_BANK0_SECTORS[] =
 115   {
 116     { 0x00000000, 0x00002000, -1, -1 },
 117     { 0x00002000, 0x00002000, -1, -1 },
 118     { 0x00004000, 0x00002000, -1, -1 },
 119     { 0x00006000, 0x00002000, -1, -1 },
 120   };
 121
 122 #define TMS470R1A288_BANK0_NUM_SECTORS \
 123   (sizeof(TMS470R1A288_BANK0_SECTORS)/sizeof(TMS470R1A288_BANK0_SECTORS[0]))
 124
 125 const flash_sector_t TMS470R1A288_BANK1_SECTORS[] =
 126   {
 127     { 0x00040000, 0x00010000, -1, -1 },
 128     { 0x00050000, 0x00010000, -1, -1 },
 129     { 0x00060000, 0x00010000, -1, -1 },
 130     { 0x00070000, 0x00010000, -1, -1 },
 131   };
 132
 133 #define TMS470R1A288_BANK1_NUM_SECTORS \
 134   (sizeof(TMS470R1A288_BANK1_SECTORS)/sizeof(TMS470R1A288_BANK1_SECTORS[0]))
 135
 136 /* ---------------------------------------------------------------------- */
 137
 138 int
 139 tms470_read_part_info( struct flash_bank_s *bank )
 140 {
 141   tms470_flash_bank_t *tms470_info = bank->driver_priv;
 142   target_t *target = bank->target;
 143   u32    device_ident_reg;
 144   u32    silicon_version;
 145   u32    technology_family;
 146   u32    rom_flash;
 147   u32    part_number;
 148   char * part_name;
 149
 150   if (target->state != TARGET_HALTED)
 151     {
 152       WARNING( "Cannot communicate... target not halted." );
 153       return ERROR_TARGET_NOT_HALTED;
 154     }
 155
 156   /* read and parse the device identification register */
 157   target_read_u32( target, 0xFFFFFFF0, &device_ident_reg );
 158
 159   INFO( "device_ident_reg=0x%08x", device_ident_reg );
 160
 161   if ((device_ident_reg & 7) == 0)
 162     {
 163       WARNING( "Cannot identify target as a TMS470 family." );
 164       return ERROR_FLASH_OPERATION_FAILED;
 165     }
 166
 167   silicon_version = (device_ident_reg >> 12) & 0xF;
 168   technology_family = (device_ident_reg >> 11) & 1;
 169   rom_flash = (device_ident_reg >> 10) & 1;
 170   part_number = (device_ident_reg >> 3) & 0x7f;
 171
 172   /*
 173    * If the part number is known, determine if the flash bank is valid
 174    * based on the base address being within the known flash bank
 175    * ranges.  Then fixup/complete the remaining fields of the flash
 176    * bank structure.
 177    */
 178   switch( part_number )
 179     {
 180     case 0x0a:
 181       part_name = "TMS470R1A256";
 182
 183       if (bank->base >= 0x00040000)
 184         {
 185           ERROR( "No %s flash bank contains base address 0x%08x.",
 186                  part_name, bank->base );
 187           return ERROR_FLASH_OPERATION_FAILED;
 188         }
 189       tms470_info->ordinal = 0;
 190       bank->base           = 0x00000000;
 191       bank->size           = 256*1024;
 192       bank->num_sectors    = TMS470R1A256_NUM_SECTORS;
 193       bank->sectors = malloc( sizeof( TMS470R1A256_SECTORS ) );
 194       if (!bank->sectors)
 195         {
 196           return ERROR_FLASH_OPERATION_FAILED;
 197         }
 198       (void) memcpy( bank->sectors,
 199                      TMS470R1A256_SECTORS,
 200                      sizeof( TMS470R1A256_SECTORS ) );
 201       break;
 202
 203     case 0x2b:
 204       part_name = "TMS470R1A288";
 205
 206       if ((bank->base >= 0x00000000) && (bank->base < 0x00008000))
 207         {
 208           tms470_info->ordinal = 0;
 209           bank->base           = 0x00000000;
 210           bank->size           = 32*1024;
 211           bank->num_sectors    = TMS470R1A288_BANK0_NUM_SECTORS;
 212           bank->sectors = malloc( sizeof( TMS470R1A288_BANK0_SECTORS ) );
 213           if (!bank->sectors)
 214             {
 215               return ERROR_FLASH_OPERATION_FAILED;
 216             }
 217           (void) memcpy( bank->sectors,
 218                          TMS470R1A288_BANK0_SECTORS,
 219                          sizeof( TMS470R1A288_BANK0_SECTORS ) );
 220         }
 221       else if ((bank->base >= 0x00040000) && (bank->base < 0x00080000))
 222         {
 223           tms470_info->ordinal = 1;
 224           bank->base           = 0x00040000;
 225           bank->size           = 256*1024;
 226           bank->num_sectors    = TMS470R1A288_BANK1_NUM_SECTORS;
 227           bank->sectors = malloc( sizeof( TMS470R1A288_BANK1_SECTORS ) );
 228           if (!bank->sectors)
 229             {
 230               return ERROR_FLASH_OPERATION_FAILED;
 231             }
 232           (void) memcpy( bank->sectors,
 233                          TMS470R1A288_BANK1_SECTORS,
 234                          sizeof( TMS470R1A288_BANK1_SECTORS ) );
 235         }
 236       else
 237         {
 238           ERROR( "No %s flash bank contains base address 0x%08x.",
 239                  part_name, bank->base );
 240           return ERROR_FLASH_OPERATION_FAILED;
 241         }
 242       break;
 243
 244     default:
 245       WARNING( "Could not identify part 0x%02x as a member of the TMS470 family.",
 246                part_number );
 247       return ERROR_FLASH_OPERATION_FAILED;
 248     }
 249
 250   /* turn off memory selects */
 251   target_write_u32( target, 0xFFFFFFE4, 0x00000000 );
 252   target_write_u32( target, 0xFFFFFFE0, 0x00000000 );
 253
 254   bank->chip_width = 32;
 255   bank->bus_width  = 32;
 256
 257   INFO( "Identified %s, ver=%d, core=%s, nvmem=%s.",
 258         part_name,
 259         silicon_version,
 260         (technology_family ? "1.8v" : "3.3v"),
 261         (rom_flash ? "rom" : "flash") );
 262
 263   tms470_info->device_ident_reg  = device_ident_reg;
 264   tms470_info->silicon_version   = silicon_version;
 265   tms470_info->technology_family = technology_family;
 266   tms470_info->rom_flash         = rom_flash;
 267   tms470_info->part_number       = part_number;
 268   tms470_info->part_name         = part_name;
 269
 270   /*
 271    * Disable reset on address access violation.
 272    */
 273   target_write_u32( target, 0xFFFFFFE0, 0x00004007 );
 274
 275   return ERROR_OK;
 276 }
 277
 278 /* ---------------------------------------------------------------------- */
 279
 280 u32 keysSet = 0;
 281 u32 flashKeys[4];
 282
 283 int
 284 tms470_handle_flash_keyset_command( struct command_context_s * cmd_ctx,
 285                                     char *                     cmd,
 286                                     char **                    args,
 287                                     int                        argc )
 288 {
 289   if (argc > 4)
 290     {
 291       command_print( cmd_ctx, "tms470 flash_keyset <key0> <key1> <key2> <key3>" );
 292       return ERROR_INVALID_ARGUMENTS;
 293     }
 294   else if (argc == 4)
 295     {
 296       int i;
 297
 298       for( i=0; i<4; i++ )
 299         {
 300           int start = (0 == strncmp( args[i], "0x", 2 )) ? 2 : 0;
 301           if (1 != sscanf( &args[i][start], "%x", &flashKeys[i] ))
 302             {
 303               command_print( cmd_ctx, "could not process flash key %s", args[i] );
 304               ERROR( "could not process flash key %s", args[i] );
 305               return ERROR_INVALID_ARGUMENTS;
 306             }
 307         }
 308
 309       keysSet = 1;
 310     }
 311   else if (argc != 0)
 312     {
 313       command_print( cmd_ctx, "tms470 flash_keyset <key0> <key1> <key2> <key3>" );
 314       return ERROR_INVALID_ARGUMENTS;
 315     }
 316
 317   if (keysSet)
 318     {
 319       command_print( cmd_ctx, "using flash keys 0x%08x, 0x%08x, 0x%08x, 0x%08x",
 320                      flashKeys[0], flashKeys[1], flashKeys[2], flashKeys[3] );
 321     }
 322   else
 323     {
 324       command_print( cmd_ctx, "flash keys not set" );
 325     }
 326
 327   return ERROR_OK;
 328 }
 329
 330 const u32 FLASH_KEYS_ALL_ONES[] = { 0xFFFFFFFF, 0xFFFFFFFF,
 331                                     0xFFFFFFFF, 0xFFFFFFFF, };
 332
 333 const u32 FLASH_KEYS_ALL_ZEROS[] = { 0x00000000, 0x00000000,
 334                                      0x00000000, 0x00000000, };
 335
 336 const u32 FLASH_KEYS_MIX1[] = { 0xf0fff0ff, 0xf0fff0ff,
 337                                 0xf0fff0ff, 0xf0fff0ff };
 338
 339 const u32 FLASH_KEYS_MIX2[] = { 0x0000ffff, 0x0000ffff,
 340                                 0x0000ffff, 0x0000ffff };
 341
 342 /* ---------------------------------------------------------------------- */
 343
 344 int oscMHz = 12;
 345
 346 int
 347 tms470_handle_osc_megahertz_command( struct command_context_s * cmd_ctx,
 348                                      char *                     cmd,
 349                                      char **                    args,
 350                                      int                        argc )
 351 {
 352   if (argc > 1)
 353     {
 354       command_print( cmd_ctx, "tms470 osc_megahertz <MHz>" );
 355       return ERROR_INVALID_ARGUMENTS;
 356     }
 357   else if (argc == 1)
 358     {
 359       sscanf( args[0], "%d", &oscMHz );
 360     }
 361
 362   if (oscMHz <= 0)
 363     {
 364       ERROR( "osc_megahertz must be positive and non-zero!" );
 365       command_print( cmd_ctx, "osc_megahertz must be positive and non-zero!" );
 366       oscMHz = 12;
 367       return ERROR_INVALID_ARGUMENTS;
 368     }
 369
 370   command_print( cmd_ctx, "osc_megahertz=%d", oscMHz );
 371
 372   return ERROR_OK;
 373 }
 374
 375 /* ---------------------------------------------------------------------- */
 376
 377 int plldis = 0;
 378
 379 int
 380 tms470_handle_plldis_command( struct command_context_s * cmd_ctx,
 381                               char *                     cmd,
 382                               char **                    args,
 383                               int                        argc )
 384 {
 385   if (argc > 1)
 386     {
 387       command_print( cmd_ctx, "tms470 plldis <0|1>" );
 388       return ERROR_INVALID_ARGUMENTS;
 389     }
 390   else if (argc == 1)
 391     {
 392       sscanf( args[0], "%d", &plldis );
 393       plldis = plldis ? 1 : 0;
 394     }
 395
 396   command_print( cmd_ctx, "plldis=%d", plldis );
 397
 398   return ERROR_OK;
 399 }
 400
 401 /* ---------------------------------------------------------------------- */
 402
 403 int
 404 tms470_check_flash_unlocked( target_t * target )
 405 {
 406   u32 fmbbusy;
 407
 408   target_read_u32( target, 0xFFE89C08, &fmbbusy );
 409   INFO( "tms470 fmbbusy=0x%08x -> %s",
 410          fmbbusy,
 411          fmbbusy & 0x8000 ? "unlocked" : "LOCKED" );
 412   return fmbbusy & 0x8000 ? ERROR_OK : ERROR_FLASH_OPERATION_FAILED;
 413 }
 414
 415 /* ---------------------------------------------------------------------- */
 416
 417 int
 418 tms470_try_flash_keys( target_t *  target,
 419                        const u32 * key_set )
 420 {
 421   u32 glbctrl, fmmstat;
 422   int retval = ERROR_FLASH_OPERATION_FAILED;
 423
 424   /* set GLBCTRL.4  */
 425   target_read_u32( target, 0xFFFFFFDC, &glbctrl );
 426   target_write_u32( target, 0xFFFFFFDC, glbctrl | 0x10 );
 427
 428   /* only perform the key match when 3VSTAT is clear */
 429   target_read_u32( target, 0xFFE8BC0C, &fmmstat );
 430   if (!(fmmstat & 0x08))
 431     {
 432       unsigned i;
 433       u32 fmmac2, fmbptr, fmbac2, fmbbusy, orig_fmregopt;
 434
 435       target_write_u32( target, 0xFFE8BC04, fmmstat & ~0x07 );
 436
 437       /* wait for pump ready */
 438       do
 439         {
 440           target_read_u32( target, 0xFFE8A814, &fmbptr );
 441           usleep( 1000 );
 442         }
 443       while( !(fmbptr & 0x0200) );
 444
 445       /* force max wait states */
 446       target_read_u32( target, 0xFFE88004, &fmbac2 );
 447       target_write_u32( target, 0xFFE88004, fmbac2 | 0xff );
 448
 449       /* save current access mode, force normal read mode */
 450       target_read_u32( target, 0xFFE89C00, &orig_fmregopt );
 451       target_write_u32( target, 0xFFE89C00, 0x00 );
 452
 453       for( i=0; i<4; i++ )
 454         {
 455           u32 tmp;
 456
 457           /* There is no point displaying the value of tmp, it is
 458            * filtered by the chip.  The purpose of this read is to
 459            * prime the unlocking logic rather than read out the value.
 460            */
 461           target_read_u32( target, 0x00001FF0+4*i, &tmp );
 462
 463           INFO( "tms470 writing fmpkey=0x%08x", key_set[i] );
 464           target_write_u32( target, 0xFFE89C0C, key_set[i] );
 465         }
 466
 467       if (ERROR_OK == tms470_check_flash_unlocked( target ))
 468         {
 469           /*
 470            * There seems to be a side-effect of reading the FMPKEY
 471            * register in that it re-enables the protection.  So we
 472            * re-enable it.
 473            */
 474           for( i=0; i<4; i++ )
 475             {
 476               u32 tmp;
 477               target_read_u32( target, 0x00001FF0+4*i, &tmp );
 478               target_write_u32( target, 0xFFE89C0C, key_set[i] );
 479             }
 480           retval = ERROR_OK;
 481         }
 482
 483       /* restore settings */
 484       target_write_u32( target, 0xFFE89C00, orig_fmregopt );
 485       target_write_u32( target, 0xFFE88004, fmbac2 );
 486     }
 487
 488   /* clear config bit */
 489   target_write_u32( target, 0xFFFFFFDC, glbctrl );
 490
 491   return retval;
 492 }
 493
 494 /* ---------------------------------------------------------------------- */
 495
 496 int
 497 tms470_unlock_flash( struct flash_bank_s * bank )
 498 {
 499   tms470_flash_bank_t * tms470_info = bank->driver_priv;
 500   target_t *            target =      bank->target;
 501   const u32 *           p_key_sets[5];
 502   unsigned              i, key_set_count;
 503
 504   if (keysSet)
 505     {
 506       p_key_sets[0] = flashKeys;
 507       p_key_sets[1] = FLASH_KEYS_ALL_ONES;
 508       p_key_sets[2] = FLASH_KEYS_ALL_ZEROS;
 509       p_key_sets[3] = FLASH_KEYS_MIX1;
 510       p_key_sets[4] = FLASH_KEYS_MIX2;
 511     }
 512   else
 513     {
 514       key_set_count = 4;
 515       p_key_sets[0] = FLASH_KEYS_ALL_ONES;
 516       p_key_sets[1] = FLASH_KEYS_ALL_ZEROS;
 517       p_key_sets[2] = FLASH_KEYS_MIX1;
 518       p_key_sets[3] = FLASH_KEYS_MIX2;
 519     }
 520
 521   for( i=0; i<key_set_count; i++ )
 522     {
 523       if (tms470_try_flash_keys( target, p_key_sets[i] ) == ERROR_OK)
 524         {
 525           INFO( "tms470 flash is unlocked" );
 526           return ERROR_OK;
 527         }
 528     }
 529
 530   WARNING( "tms470 could not unlock flash memory protection level 2" );
 531   return ERROR_FLASH_OPERATION_FAILED;
 532 }
 533
 534 /* ---------------------------------------------------------------------- */
 535
 536 int
 537 tms470_flash_initialize_internal_state_machine( struct flash_bank_s * bank )
 538 {
 539   u32 fmmac2, fmmac1, fmmaxep, k, delay, glbctrl, sysclk;
 540   target_t *target = bank->target;
 541   tms470_flash_bank_t * tms470_info = bank->driver_priv;
 542   int result = ERROR_OK;
 543
 544   /*
 545    * Select the desired bank to be programmed by writing BANK[2:0] of
 546    * FMMAC2.
 547    */
 548   target_read_u32( target, 0xFFE8BC04, &fmmac2 );
 549   fmmac2 &= ~0x0007;
 550   fmmac2 |= (tms470_info->ordinal & 7);
 551   target_write_u32( target, 0xFFE8BC04, fmmac2 );
 552   DEBUG( "set fmmac2=0x%04x", fmmac2 );
 553
 554   /*
 555    * Disable level 1 sector protection by setting bit 15 of FMMAC1.
 556    */
 557   target_read_u32( target, 0xFFE8BC00, &fmmac1 );
 558   fmmac1 |= 0x8000;
 559   target_write_u32( target, 0xFFE8BC00, fmmac1 );
 560   DEBUG( "set fmmac1=0x%04x", fmmac1 );
 561
 562   /*
 563    * FMTCREG=0x2fc0;
 564    */
 565   target_write_u32( target, 0xFFE8BC10, 0x2fc0 );
 566   DEBUG( "set fmtcreg=0x2fc0" );
 567
 568   /*
 569    * MAXPP=50
 570    */
 571   target_write_u32( target, 0xFFE8A07C, 50 );
 572   DEBUG( "set fmmaxpp=50" );
 573
 574   /*
 575    * MAXCP=0xf000+2000
 576    */
 577   target_write_u32( target, 0xFFE8A084, 0xf000+2000 );
 578   DEBUG( "set fmmaxcp=0x%04x", 0xf000+2000 );
 579
 580     /*
 581    * configure VHV
 582    */
 583   target_read_u32( target, 0xFFE8A080, &fmmaxep );
 584   if (fmmaxep == 0xf000)
 585     {
 586       fmmaxep = 0xf000+4095;
 587       target_write_u32( target, 0xFFE8A80C, 0x9964 );
 588       DEBUG( "set fmptr3=0x9964" );
 589     }
 590   else
 591     {
 592       fmmaxep = 0xa000+4095;
 593       target_write_u32( target, 0xFFE8A80C, 0x9b64 );
 594       DEBUG( "set fmptr3=0x9b64" );
 595     }
 596   target_write_u32( target, 0xFFE8A080, fmmaxep );
 597   DEBUG( "set fmmaxep=0x%04x", fmmaxep );
 598
 599   /*
 600    * FMPTR4=0xa000
 601    */
 602   target_write_u32( target, 0xFFE8A810, 0xa000 );
 603   DEBUG( "set fmptr4=0xa000" );
 604
 605   /*
 606    * FMPESETUP, delay parameter selected based on clock frequency.
 607    *
 608    * According to the TI App Note SPNU257 and flashing code, delay is
 609    * int((sysclk(MHz) + 1) / 2), with a minimum of 5.  The system
 610    * clock is usually derived from the ZPLL module, and selected by
 611    * the plldis global.
 612    */
 613   target_read_u32( target, 0xFFFFFFDC, &glbctrl );
 614   sysclk = (plldis ? 1 : (glbctrl & 0x08) ? 4 : 8 ) * oscMHz / (1 + (glbctrl & 7));
 615   delay = (sysclk > 10) ? (sysclk + 1) / 2 : 5;
 616   target_write_u32( target, 0xFFE8A018, (delay<<4)|(delay<<8) );
 617   DEBUG( "set fmpsetup=0x%04x", (delay<<4)|(delay<<8) );
 618
 619   /*
 620    * FMPVEVACCESS, based on delay.
 621    */
 622   k = delay|(delay<<8);
 623   target_write_u32( target, 0xFFE8A05C, k );
 624   DEBUG( "set fmpvevaccess=0x%04x", k );
 625
 626   /*
 627    * FMPCHOLD, FMPVEVHOLD, FMPVEVSETUP, based on delay.
 628    */
 629   k <<= 1;
 630   target_write_u32( target, 0xFFE8A034, k );
 631   DEBUG( "set fmpchold=0x%04x", k );
 632   target_write_u32( target, 0xFFE8A040, k );
 633   DEBUG( "set fmpvevhold=0x%04x", k );
 634   target_write_u32( target, 0xFFE8A024, k );
 635   DEBUG( "set fmpvevsetup=0x%04x", k );
 636
 637   /*
 638    * FMCVACCESS, based on delay.
 639    */
 640   k = delay*16;
 641   target_write_u32( target, 0xFFE8A060, k );
 642   DEBUG( "set fmcvaccess=0x%04x", k );
 643
 644   /*
 645    * FMCSETUP, based on delay.
 646    */
 647   k = 0x3000 | delay*20;
 648   target_write_u32( target, 0xFFE8A020, k );
 649   DEBUG( "set fmcsetup=0x%04x", k );
 650
 651   /*
 652    * FMEHOLD, based on delay.
 653    */
 654   k = (delay*20) << 2;
 655   target_write_u32( target, 0xFFE8A038, k );
 656   DEBUG( "set fmehold=0x%04x", k );
 657
 658   /*
 659    * PWIDTH, CWIDTH, EWIDTH, based on delay.
 660    */
 661   target_write_u32( target, 0xFFE8A050, delay*8 );
 662   DEBUG( "set fmpwidth=0x%04x", delay*8 );
 663   target_write_u32( target, 0xFFE8A058, delay*1000 );
 664   DEBUG( "set fmcwidth=0x%04x", delay*1000 );
 665   target_write_u32( target, 0xFFE8A054, delay*5400 );
 666   DEBUG( "set fmewidth=0x%04x", delay*5400 );
 667
 668   return result;
 669 }
 670
 671
 672 /* ---------------------------------------------------------------------- */
 673
 674 int
 675 tms470_flash_status( struct flash_bank_s * bank )
 676 {
 677   target_t *target = bank->target;
 678   int result = ERROR_OK;
 679   u32 fmmstat;
 680
 681   target_read_u32( target, 0xFFE8BC0C, &fmmstat );
 682   DEBUG( "set fmmstat=0x%04x", fmmstat );
 683
 684   if (fmmstat & 0x0080)
 685     {
 686       WARNING( "tms470 flash command: erase still active after busy clear." );
 687       result = ERROR_FLASH_OPERATION_FAILED;
 688     }
 689
 690   if (fmmstat & 0x0040)
 691     {
 692       WARNING( "tms470 flash command: program still active after busy clear." );
 693       result = ERROR_FLASH_OPERATION_FAILED;
 694     }
 695
 696   if (fmmstat & 0x0020)
 697     {
 698       WARNING( "tms470 flash command: invalid data command." );
 699       result = ERROR_FLASH_OPERATION_FAILED;
 700     }
 701
 702   if (fmmstat & 0x0010)
 703     {
 704       WARNING( "tms470 flash command: program, erase or validate sector failed." );
 705       result = ERROR_FLASH_OPERATION_FAILED;
 706     }
 707
 708   if (fmmstat & 0x0008)
 709     {
 710       WARNING( "tms470 flash command: voltage instability detected." );
 711       result = ERROR_FLASH_OPERATION_FAILED;
 712     }
 713
 714   if (fmmstat & 0x0006)
 715     {
 716       WARNING( "tms470 flash command: command suspend detected." );
 717       result = ERROR_FLASH_OPERATION_FAILED;
 718     }
 719
 720   if (fmmstat & 0x0001)
 721     {
 722       WARNING( "tms470 flash command: sector was locked." );
 723       result = ERROR_FLASH_OPERATION_FAILED;
 724     }
 725
 726   return result;
 727 }
 728
 729 /* ---------------------------------------------------------------------- */
 730
 731 int
 732 tms470_erase_sector( struct flash_bank_s * bank,
 733                      int                   sector )
 734 {
 735   u32 glbctrl, orig_fmregopt, fmbsea, fmbseb, fmmstat;
 736   target_t *target = bank->target;
 737   u32 flashAddr = bank->base + bank->sectors[sector].offset;
 738   int result = ERROR_OK;
 739
 740   /*
 741    * Set the bit GLBCTRL4 of the GLBCTRL register (in the System
 742    * module) to enable writing to the flash registers }.
 743    */
 744   target_read_u32( target, 0xFFFFFFDC, &glbctrl );
 745   target_write_u32( target, 0xFFFFFFDC, glbctrl | 0x10 );
 746   DEBUG( "set glbctrl=0x%08x", glbctrl | 0x10 );
 747
 748   /* Force normal read mode. */
 749   target_read_u32( target, 0xFFE89C00, &orig_fmregopt );
 750   target_write_u32( target, 0xFFE89C00, 0 );
 751   DEBUG( "set fmregopt=0x%08x", 0 );
 752
 753   (void) tms470_flash_initialize_internal_state_machine( bank );
 754
 755   /*
 756    * Select one or more bits in FMBSEA or FMBSEB to disable Level 1
 757    * protection for the particular sector to be erased/written.
 758    */
 759   if (sector < 16)
 760     {
 761       target_read_u32( target, 0xFFE88008, &fmbsea );
 762       target_write_u32( target, 0xFFE88008, fmbsea | (1<<sector) );
 763       DEBUG( "set fmbsea=0x%04x", fmbsea | (1<<sector) );
 764     }
 765   else
 766     {
 767       target_read_u32( target, 0xFFE8800C, &fmbseb );
 768       target_write_u32( target, 0xFFE8800C, fmbseb | (1<<(sector-16)) );
 769       DEBUG( "set fmbseb=0x%04x", fmbseb | (1<<(sector-16)) );
 770     }
 771   bank->sectors[sector].is_protected = 0;
 772
 773   /*
 774    * clear status regiser, sent erase command, kickoff erase
 775    */
 776   target_write_u16( target, flashAddr, 0x0040 );
 777   DEBUG( "write *(u16 *)0x%08x=0x0040", flashAddr );
 778   target_write_u16( target, flashAddr, 0x0020 );
 779   DEBUG( "write *(u16 *)0x%08x=0x0020", flashAddr );
 780   target_write_u16( target, flashAddr, 0xffff );
 781   DEBUG( "write *(u16 *)0x%08x=0xffff", flashAddr );
 782
 783   /*
 784    * Monitor FMMSTAT, busy until clear, then check and other flags for
 785    * ultimate result of the operation.
 786    */
 787   do
 788     {
 789       target_read_u32( target, 0xFFE8BC0C, &fmmstat );
 790       if (fmmstat & 0x0100)
 791         {
 792           usleep( 1000 );
 793         }
 794     }
 795   while( fmmstat & 0x0100 );
 796
 797   result = tms470_flash_status( bank );
 798
 799   if (sector < 16)
 800     {
 801       target_write_u32( target, 0xFFE88008, fmbsea );
 802       DEBUG( "set fmbsea=0x%04x", fmbsea );
 803       bank->sectors[sector].is_protected =
 804         fmbsea & (1<<sector) ? 0 : 1;
 805     }
 806   else
 807     {
 808       target_write_u32( target, 0xFFE8800C, fmbseb );
 809       DEBUG( "set fmbseb=0x%04x", fmbseb );
 810       bank->sectors[sector].is_protected =
 811         fmbseb & (1<<(sector-16)) ? 0 : 1;
 812     }
 813   target_write_u32( target, 0xFFE89C00, orig_fmregopt );
 814   DEBUG( "set fmregopt=0x%08x", orig_fmregopt );
 815   target_write_u32( target, 0xFFFFFFDC, glbctrl );
 816   DEBUG( "set glbctrl=0x%08x", glbctrl );
 817
 818   if (result == ERROR_OK)
 819     {
 820       bank->sectors[sector].is_erased = 1;
 821     }
 822
 823   return result;
 824 }
 825
 826 /* ----------------------------------------------------------------------
 827               Implementation of Flash Driver Interfaces
 828    ---------------------------------------------------------------------- */
 829
 830 int
 831 tms470_register_commands( struct command_context_s *cmd_ctx )
 832 {
 833   command_t *tms470_cmd = register_command( cmd_ctx,
 834                                             NULL,
 835                                             "tms470",
 836                                             NULL,
 837                                             COMMAND_ANY,
 838                                             "applies to TI tms470 family" );
 839
 840   register_command( cmd_ctx,
 841                     tms470_cmd,
 842                     "flash_keyset",
 843                     tms470_handle_flash_keyset_command,
 844                     COMMAND_ANY,
 845                    "tms470 flash_keyset <key0> <key1> <key2> <key3>" );
 846
 847   register_command( cmd_ctx,
 848                     tms470_cmd,
 849                     "osc_megahertz",
 850                     tms470_handle_osc_megahertz_command,
 851                     COMMAND_ANY,
 852                     "tms470 osc_megahertz <MHz>" );
 853
 854   register_command( cmd_ctx,
 855                     tms470_cmd,
 856                     "plldis",
 857                     tms470_handle_plldis_command,
 858                     COMMAND_ANY,
 859                     "tms470 plldis <0/1>" );
 860
 861   return ERROR_OK;
 862 }
 863
 864 /* ---------------------------------------------------------------------- */
 865
 866 int
 867 tms470_erase( struct flash_bank_s * bank,
 868               int                   first,
 869               int                   last )
 870 {
 871   tms470_flash_bank_t *tms470_info = bank->driver_priv;
 872   target_t *target = bank->target;
 873   int sector, result = ERROR_OK;
 874
 875   if (!tms470_info->device_ident_reg)
 876     {
 877       tms470_read_part_info( bank );
 878     }
 879
 880   if ((first < 0) ||
 881       (first >= bank->num_sectors) ||
 882       (last < 0) ||
 883       (last >= bank->num_sectors) ||
 884       (first > last))
 885     {
 886       ERROR( "Sector range %d to %d invalid.", first, last );
 887       return ERROR_FLASH_SECTOR_INVALID;
 888     }
 889
 890   result = tms470_unlock_flash( bank );
 891   if (result != ERROR_OK)
 892     {
 893       return result;
 894     }
 895
 896   for( sector=first; sector<=last; sector++ )
 897     {
 898       INFO( "Erasing tms470 bank %d sector %d...",
 899             tms470_info->ordinal, sector );
 900
 901       result = tms470_erase_sector( bank, sector );
 902
 903       if (result != ERROR_OK)
 904         {
 905           ERROR( "tms470 could not erase flash sector." );
 906           break;
 907         }
 908       else
 909         {
 910           INFO( "sector erased successfully." );
 911         }
 912     }
 913
 914   return result;
 915 }
 916
 917 /* ---------------------------------------------------------------------- */
 918
 919 int
 920 tms470_protect( struct flash_bank_s * bank,
 921                 int                   set,
 922                 int                   first,
 923                 int                   last )
 924 {
 925   tms470_flash_bank_t *tms470_info = bank->driver_priv;
 926   target_t *target = bank->target;
 927   u32 fmmac2, fmbsea, fmbseb;
 928   int sector;
 929
 930   if (!tms470_info->device_ident_reg)
 931     {
 932       tms470_read_part_info( bank );
 933     }
 934
 935   if ((first < 0) ||
 936       (first >= bank->num_sectors) ||
 937       (last < 0) ||
 938       (last >= bank->num_sectors) ||
 939       (first > last))
 940     {
 941       ERROR( "Sector range %d to %d invalid.", first, last );
 942       return ERROR_FLASH_SECTOR_INVALID;
 943     }
 944
 945   /* enable the appropriate bank */
 946   target_read_u32( target, 0xFFE8BC04, &fmmac2 );
 947   target_write_u32( target, 0xFFE8BC04,
 948                     (fmmac2 & ~7) | tms470_info->ordinal );
 949
 950   /* get the original sector proection flags for this bank */
 951   target_read_u32( target, 0xFFE88008, &fmbsea );
 952   target_read_u32( target, 0xFFE8800C, &fmbseb );
 953
 954   for( sector=0; sector<bank->num_sectors; sector++ )
 955     {
 956       if (sector < 16)
 957         {
 958           fmbsea = set ? fmbsea & ~(1<<sector) :
 959                          fmbsea | (1<<sector);
 960           bank->sectors[sector].is_protected = set ? 1 : 0;
 961         }
 962       else
 963         {
 964           fmbseb = set ? fmbseb & ~(1<<(sector-16)) :
 965                          fmbseb | (1<<(sector-16));
 966           bank->sectors[sector].is_protected = set ? 1 : 0;
 967         }
 968     }
 969
 970   /* update the protection bits */
 971   target_write_u32( target, 0xFFE88008, fmbsea );
 972   target_write_u32( target, 0xFFE8800C, fmbseb );
 973
 974   return ERROR_OK;
 975 }
 976
 977 /* ---------------------------------------------------------------------- */
 978
 979 int
 980 tms470_write( struct flash_bank_s * bank,
 981               u8 *                  buffer,
 982               u32                   offset,
 983               u32                   count )
 984 {
 985   target_t *target = bank->target;
 986   tms470_flash_bank_t *tms470_info = bank->driver_priv;
 987   u32 glbctrl, fmbac2, orig_fmregopt, fmbsea, fmbseb, fmmaxpp, fmmstat;
 988   int i, result = ERROR_OK;
 989
 990   if (!tms470_info->device_ident_reg)
 991     {
 992       tms470_read_part_info( bank );
 993     }
 994
 995   INFO( "Writing %d bytes starting at 0x%08x",
 996         count, bank->base + offset );
 997
 998   /* set GLBCTRL.4  */
 999   target_read_u32( target, 0xFFFFFFDC, &glbctrl );
1000   target_write_u32( target, 0xFFFFFFDC, glbctrl | 0x10 );
1001
1002   (void) tms470_flash_initialize_internal_state_machine( bank );
1003
1004   /* force max wait states */
1005   target_read_u32( target, 0xFFE88004, &fmbac2 );
1006   target_write_u32( target, 0xFFE88004, fmbac2 | 0xff );
1007
1008   /* save current access mode, force normal read mode */
1009   target_read_u32( target, 0xFFE89C00, &orig_fmregopt );
1010   target_write_u32( target, 0xFFE89C00, 0x00 );
1011
1012   /*
1013    * Disable Level 1 protection for all sectors to be erased/written.
1014    */
1015   target_read_u32( target, 0xFFE88008, &fmbsea );
1016   target_write_u32( target, 0xFFE88008, 0xffff );
1017   target_read_u32( target, 0xFFE8800C, &fmbseb );
1018   target_write_u32( target, 0xFFE8800C, 0xffff );
1019
1020   /* read MAXPP */
1021   target_read_u32( target, 0xFFE8A07C, &fmmaxpp );
1022
1023   for( i=0; i<count; i+=2 )
1024     {
1025       u32 addr = bank->base + offset + i;
1026       u16 word = (((u16) buffer[i]) << 8) | (u16) buffer[i+1];
1027
1028       if (word != 0xffff)
1029         {
1030           INFO( "writing 0x%04x at 0x%08x", word, addr );
1031
1032           /* clear status register */
1033           target_write_u16( target, addr, 0x0040 );
1034           /* program flash command */
1035           target_write_u16( target, addr, 0x0010 );
1036           /* burn the 16-bit word (big-endian) */
1037           target_write_u16( target, addr, word );
1038
1039           /*
1040            * Monitor FMMSTAT, busy until clear, then check and other flags
1041            * for ultimate result of the operation.
1042            */
1043           do
1044             {
1045               target_read_u32( target, 0xFFE8BC0C, &fmmstat );
1046               if (fmmstat & 0x0100)
1047                 {
1048                   usleep( 1000 );
1049                 }
1050             }
1051           while( fmmstat & 0x0100 );
1052
1053           if (fmmstat & 0x3ff)
1054             {
1055               ERROR( "fmstat=0x%04x", fmmstat );
1056               ERROR( "Could not program word 0x%04x at address 0x%08x.",
1057                      word, addr );
1058               result = ERROR_FLASH_OPERATION_FAILED;
1059               break;
1060             }
1061         }
1062       else
1063         {
1064           INFO( "skipping 0xffff at 0x%08x", addr );
1065         }
1066     }
1067
1068   /* restore */
1069   target_write_u32( target, 0xFFE88008, fmbsea );
1070   target_write_u32( target, 0xFFE8800C, fmbseb );
1071   target_write_u32( target, 0xFFE88004, fmbac2 );
1072   target_write_u32( target, 0xFFE89C00, orig_fmregopt );
1073   target_write_u32( target, 0xFFFFFFDC, glbctrl );
1074
1075   return result;
1076 }
1077
1078 /* ---------------------------------------------------------------------- */
1079
1080 int
1081 tms470_probe( struct flash_bank_s * bank )
1082 {
1083   tms470_flash_bank_t * tms470_info = bank->driver_priv;
1084
1085   tms470_info->probed = 0;
1086
1087   if (!tms470_info->device_ident_reg)
1088     {
1089       tms470_read_part_info( bank );
1090     }
1091
1092   tms470_info->probed = 1;
1093
1094   return ERROR_OK;
1095 }
1096
1097 int
1098 tms470_auto_probe( struct flash_bank_s * bank )
1099 {
1100         tms470_flash_bank_t * tms470_info = bank->driver_priv;
1101         if (tms470_info->probed)
1102                 return ERROR_OK;
1103         return tms470_probe(bank);
1104 }
1105 /* ---------------------------------------------------------------------- */
1106
1107 int
1108 tms470_erase_check( struct flash_bank_s * bank )
1109 {
1110   target_t *target = bank->target;
1111   tms470_flash_bank_t * tms470_info = bank->driver_priv;
1112   int sector, result = ERROR_OK;
1113   u32 fmmac2, fmbac2, glbctrl, orig_fmregopt;
1114   static u8 buffer[64*1024];
1115
1116   if (!tms470_info->device_ident_reg)
1117     {
1118       tms470_read_part_info( bank );
1119     }
1120
1121   /* set GLBCTRL.4  */
1122   target_read_u32( target, 0xFFFFFFDC, &glbctrl );
1123   target_write_u32( target, 0xFFFFFFDC, glbctrl | 0x10 );
1124
1125   /* save current access mode, force normal read mode */
1126   target_read_u32( target, 0xFFE89C00, &orig_fmregopt );
1127   target_write_u32( target, 0xFFE89C00, 0x00 );
1128
1129   /* enable the appropriate bank */
1130   target_read_u32( target, 0xFFE8BC04, &fmmac2 );
1131   target_write_u32( target, 0xFFE8BC04,
1132                     (fmmac2 & ~7) | tms470_info->ordinal );
1133
1134   /* TCR=0 */
1135   target_write_u32( target, 0xFFE8BC10, 0x2fc0 );
1136
1137   /* clear TEZ in fmbrdy */
1138   target_write_u32( target, 0xFFE88010, 0x0b );
1139
1140   /* save current wait states, force max */
1141   target_read_u32( target, 0xFFE88004, &fmbac2 );
1142   target_write_u32( target, 0xFFE88004, fmbac2 | 0xff );
1143
1144   /*
1145    * The TI primitives inspect the flash memory by reading one 32-bit
1146    * word at a time.  Here we read an entire sector and inspect it in
1147    * an attempt to reduce the JTAG overhead.
1148    */
1149   for( sector=0; sector<bank->num_sectors; sector++ )
1150     {
1151       if (bank->sectors[sector].is_erased != 1)
1152         {
1153           u32 i, addr = bank->base + bank->sectors[sector].offset;
1154
1155           INFO( "checking flash bank %d sector %d",
1156                 tms470_info->ordinal,
1157                 sector );
1158
1159           target_read_buffer( target,
1160                               addr,
1161                               bank->sectors[sector].size,
1162                               buffer );
1163
1164           bank->sectors[sector].is_erased = 1;
1165           for( i=0; i<bank->sectors[sector].size; i++ )
1166             {
1167               if (buffer[i] != 0xff)
1168                 {
1169                   WARNING( "tms470 bank %d, sector %d, not erased.",
1170                            tms470_info->ordinal,
1171                            sector );
1172                   WARNING( "at location 0x%08x: flash data is 0x%02x.",
1173                            addr+i,
1174                            buffer[i] );
1175
1176                   bank->sectors[sector].is_erased = 0;
1177                   break;
1178                 }
1179             }
1180         }
1181       if (bank->sectors[sector].is_erased != 1)
1182         {
1183           result = ERROR_FLASH_SECTOR_NOT_ERASED;
1184           break;
1185         }
1186       else
1187         {
1188           INFO( "sector erased" );
1189         }
1190     }
1191
1192   /* reset TEZ, wait states, read mode, GLBCTRL.4 */
1193   target_write_u32( target, 0xFFE88010, 0x0f );
1194   target_write_u32( target, 0xFFE88004, fmbac2 );
1195   target_write_u32( target, 0xFFE89C00, orig_fmregopt );
1196   target_write_u32( target, 0xFFFFFFDC, glbctrl );
1197
1198   return result;
1199 }
1200
1201 /* ---------------------------------------------------------------------- */
1202
1203 int
1204 tms470_protect_check( struct flash_bank_s * bank )
1205 {
1206   target_t *target = bank->target;
1207   tms470_flash_bank_t * tms470_info = bank->driver_priv;
1208   int sector, result = ERROR_OK;
1209   u32 fmmac2, fmbsea, fmbseb;
1210
1211   if (!tms470_info->device_ident_reg)
1212     {
1213       tms470_read_part_info( bank );
1214     }
1215
1216   /* enable the appropriate bank */
1217   target_read_u32( target, 0xFFE8BC04, &fmmac2 );
1218   target_write_u32( target, 0xFFE8BC04,
1219                     (fmmac2 & ~7) | tms470_info->ordinal );
1220
1221   target_read_u32( target, 0xFFE88008, &fmbsea );
1222   target_read_u32( target, 0xFFE8800C, &fmbseb );
1223
1224   for( sector=0; sector<bank->num_sectors; sector++ )
1225     {
1226       int protected;
1227
1228       if (sector < 16)
1229         {
1230           protected = fmbsea & (1<<sector) ? 0 : 1;
1231           bank->sectors[sector].is_protected = protected;
1232         }
1233       else
1234         {
1235           protected = fmbseb & (1<<(sector-16)) ? 0 : 1;
1236           bank->sectors[sector].is_protected = protected;
1237         }
1238
1239       DEBUG( "bank %d sector %d is %s",
1240              tms470_info->ordinal,
1241              sector,
1242              protected ? "protected" : "not protected" );
1243     }
1244
1245   return result;
1246 }
1247
1248 /* ---------------------------------------------------------------------- */
1249
1250 int
1251 tms470_info( struct flash_bank_s * bank,
1252              char *                buf,
1253              int                   buf_size )
1254 {
1255   int used = 0;
1256   tms470_flash_bank_t * tms470_info = bank->driver_priv;
1257
1258   if (!tms470_info->device_ident_reg)
1259     {
1260       tms470_read_part_info( bank );
1261     }
1262
1263   if (!tms470_info->device_ident_reg)
1264     {
1265       (void) snprintf(buf, buf_size, "Cannot identify target as a TMS470\n");
1266       return ERROR_FLASH_OPERATION_FAILED;
1267     }
1268
1269   used += snprintf( buf, buf_size,
1270                     "\ntms470 information: Chip is %s\n",
1271                     tms470_info->part_name );
1272   buf += used;
1273   buf_size -= used;
1274
1275   used += snprintf( buf, buf_size,
1276                     "Flash protection level 2 is %s\n",
1277                     tms470_check_flash_unlocked( bank->target ) == ERROR_OK ? "disabled" : "enabled" );
1278   buf += used;
1279   buf_size -= used;
1280
1281   return ERROR_OK;
1282 }
1283
1284 /* ---------------------------------------------------------------------- */
1285
1286 /*
1287  * flash bank tms470 <base> <size> <chip_width> <bus_width> <target>
1288  * [options...]
1289  */
1290
1291 int
1292 tms470_flash_bank_command( struct command_context_s *cmd_ctx,
1293                            char *cmd,
1294                            char **args,
1295                            int argc,
1296                            struct flash_bank_s *bank )
1297 {
1298   bank->driver_priv = malloc( sizeof( tms470_flash_bank_t ) );
1299
1300   if (!bank->driver_priv)
1301     {
1302       return ERROR_FLASH_OPERATION_FAILED;
1303     }
1304
1305   (void) memset( bank->driver_priv, 0, sizeof( tms470_flash_bank_t ) );
1306
1307   return ERROR_OK;
1308 }