Flash Programming F28x
Download as PPT, PDF2 likes2,698 views
The document describes the flash programming process for the TMS320F2812 digital signal controller, detailing its boot sequence, flash memory map, and configuration registers. It outlines basic flash operation and programming steps, emphasizing the importance of maintaining power during the process to avoid locking the device. Additionally, it discusses the code security module for access control and provides guidance on unlocking and securing the memory.
Flash Programming F28x
- 1. Chapter 10 : Flash Programming C28x Digital Signal Controller TMS320F2812 Technology beyond the Dreams™ Copyright © 2006 Pantech Solutions Pvt
- 2. BIOS Startup Sequence from Flash Memory C – start routine 0x3D 8000 _c_int00 Boot.asm FLASH (128K) “rts2800_ml.lib” 4 0x3F 7FF6 LB _c_int00 Passwords (8) 5 0x3F 8000 H0 SARAM (8K) 3 “user” code sections main ( ) 0x3F F000 Boot ROM (4K) { Boot Code …… 0x3F FC00 return; {SCAN GPIO} 2 } BROM vector (32) 0x3F FFC0 0x3F FC00 1 RESET Technology beyond the Dreams™ Copyright © 2006 Pantech Solutions Pvt
- 3. TMS320F2812 Flash Memory Map Address Range Data & Program Space 0x3D 8000 – 0x3D 9FFF Sector J ; 8K x 16 0x3D A000 – 0x3D BFFF Sector I ; 8K x 16 0x3D C000 – 0x3D FFFF Sector H : 16K x 16 0x3E 0000 – 0x3E 3FFF Sector G ; 16K x 16 0x3E 4000 – 0x3E 7FFF Sector F ; 16K x 16 0x3E 8000 – 0x3E BFFF Sector E ; 16K x 16 0x3E C000 – 0x3E FFFF Sector D; 16K x 16 0x3F 0000 – 0x3F 3FFF Sector C ; 16K x 16 0x3F 4000 – 0x3F 5FFF Sector B ; 8K x16 0x3F 6000 – 0x3F 7F7F Sector A ; (8K-128) x16 0x3F 7F80 – 0x3F 7FF5 Program to 0x0000 when using Code Security Mode ! 0x3F 7FF6 – 0x3F 7FF7 Flash Entry Point ; 2 x 16 0x3F 7FF8 – 0x3F 7FFF Security Password ; 8 x 16 Technology beyond the Dreams™ Copyright © 2006 Pantech Solutions Pvt
- 4. Basic Flash Operation Flash is arranged in pages of 128 addresses Wait states are specified for consecutive accesses within a page, and random accesses across pages OTP has random access only Must specify the number of SYSCLKOUT wait-states Reset defaults are maximum values ! Flash configuration code must not run from Flash memory ! 4 3 0 FBANKWAIT 15 12 11 8 7 @ 0x00 0A86 reserved PAGEWAIT reserved RANDWAIT FOTPWAIT 15 4 3 0 @ 0x00 0A87 reserved OTPWAIT *** Refer to the F281x datasheet for detailed numbers *** For 150 MHz, PAGEWAIT = 5, RANDWAIT = 5, OTPWAIT = 8 For 135 MHz, PAGEWAIT = 4, RANDWAIT = 4,©OTPWAIT = 8 Pvt Technology beyond the Dreams™ Copyright 2006 Pantech Solutions
- 5. Speeding Up Code Execution in 16 Flash: Flash Pipelining (for code fetch only) 16 or 32 64 dispatched 64 C28x Core decoder unit Aligned 2-level deep 64-bit fetch buffer fetch Flash Pipeline Enable 0 = disable (default) 1 = enable FOPT @ 0x00 0A80 15 1 0 reserved ENPIPE Technology beyond the Dreams™ Copyright © 2006 Pantech Solutions Pvt
- 6. Other Flash Configuration Registers Address Name Description 0x00 0A80 FOPT Flash option register 0x00 0A82 FPWR Flash power modes registers 0x00 0A83 FSTATUS Flash status register 0x00 0A84 FSTDBYWAIT Flash sleep to standby wait register 0x00 0A85 FACTIVEWAIT Flash standby to active wait register 0x00 0A86 FBANKWAIT Flash read access wait state register 0x00 0A87 FOTPWAIT OTP read access wait state register FPWR: Save power by putting Flash/OTP to ‘Sleep’ or ‘Standby’ mode; Flash will automatically enter active mode if a Flash/OTP access is made FSTATUS: Various status bits (e.g. PWR mode) FSTDBYWAIT: Specify number of cycles to wait during wake-up from sleep to standby FACTIVEWAIT: Specify number of cycles to wait during wake-up from standby to active Defaults for these registers are often sufficient – See “TMS320F28x DSP System Control and Interrupts Reference Guide,” SPRU078, for more information Technology beyond the Dreams™ Copyright © 2006 Pantech Solutions Pvt
- 7. Flash Programming Basics • The DSP CPU itself performs the flash programming • The CPU executes Flash utility code from RAM that reads the Flash data and writes it into the Flash • We need to get the Flash utility code and the Flash data into RAM FLASH FLASH Flash utility code Emulator JTAG RS232 SCI Bootloader F28x DSP F28x DSP Flash RAM RAM CPU CPU Data SPI ROM GPIO Technology beyond the Dreams™ Copyright © 2006 Pantech Solutions Pvt
- 8. • Sequence of steps for Flash programming: Algorithm Function 1. Erase - Set all bits to zero, then to one 2. Program - Program selected bits with zero 3. Verify - Verify flash contents • Minimum Erase size is a sector • Minimum Program size is a bit! • Important not to lose power during erase step: If CSM passwords happen to be all zeros, the CSM will be permanently locked! • Chance of this happening is quite small! (Erase step is performed sector by sector) Technology beyond the Dreams™ Copyright © 2006 Pantech Solutions Pvt
- 9. Flash Programming Utilities • Code Composer Studio Plug-in (uses JTAG) * • Serial Flash loader from TI (uses SCI boot) * • Gang Programmers (use GPIO boot) – BP Micro programmer – Data I/O programmer • Build your own custom utility – Use a different ROM bootloader method than SCI – Embed flash programming into your application – Flash API algorithms provided by TI * Available from TI web at www.ti.com Technology beyond the Dreams™ Copyright © 2006 Pantech Solutions Pvt
- 10. Code Composer Studio Flash Plug-In Technology beyond the Dreams™ Copyright © 2006 Pantech Solutions Pvt
- 11. Code Security Module (CSM) Access to the following on-chip memory is restricted: 0x00 8000 LO SARAM (4K) 0x00 9000 L1 SARAM (4K) 0x00 A000 reserved 0x3D 7800 OTP (1K) 0x3D 7C00 reserved 0x3D 8000 FLASH (128K) • Data reads and writes from restricted memory are only allowed for code running from restricted memory • All other data read/write accesses are blocked: JTAG emulator/debugger, ROM bootloader, code running in external memory or unrestricted internal memory Technology beyond the Dreams™ Copyright © 2006 Pantech Solutions Pvt
- 12. CSM Password 0x00 8000 LO SARAM (4K) 0x00 9000 0x00 A000 L1 SARAM (4K) reserved 0x3D 7800 CSM Password 0x3D 7C00 OTP (1K) Locations (PWL) reserved 0x3F 7FF8 - 0x3F 7FFF 0x3D 8000 FLASH (128K) 128-Bit Password • 128-bit user defined password is stored in Flash • 128-bit Key Register used to lock and unlock the device – Mapped in memory space 0x00 0AE0 – 0x00 0AE7 – Register “EALLOW” protected Technology beyond the Dreams™ Copyright © 2006 Pantech Solutions Pvt
- 13. Key Registers – accessible by user; EALLOW protected Address Name Reset Value Description 0x00 0AE0 KEY0 0x00 0AE1 KEY1 CSM Registers 0xFFFF 0xFFFF Low word of 128-bit Key register 2nd word of 128-bit Key register 0x00 0AE2 KEY2 0xFFFF 3rd word of 128-bit Key register 0x00 0AE3 KEY3 0xFFFF 4th word of 128-bit Key register 0x00 0AE4 KEY4 0xFFFF 5th word of 128-bit Key register 0x00 0AE5 KEY5 0xFFFF 6th word of 128-bit Key register 0x00 0AE6 KEY6 0xFFFF 7th word of 128-bit Key register 0x00 0AE7 KEY7 0xFFFF High word of 128-bit Key register 0x00 0AEF CSMSCR 0xFFFF CSM status and control register PWL in memory – reserved for passwords only Address Name Reset Value Description 0x3F 7FF8 PWL0 user defined Low word of 128-bit password 0x3F 7FF9 PWL1 user defined 2nd word of 128-bit password 0x3F 7FFA PWL2 user defined 3rd word of 128-bit password 0x3F 7FFB PWL3 user defined 4th word of 128-bit password 0x3F 7FFC PWL4 user defined 5th word of 128-bit password 0x3F 7FFD PWL5 user defined 6th word of 128-bit password 0x3F 7FFE PWL6 user defined 7th word of 128-bit password 0x3F 7FFF PWL7 user defined High word of 128-bit password Technology beyond the Dreams™ Copyright © 2006 Pantech Solutions Pvt
- 14. Locking and Unlocking the CSM • The CSM is locked at power-up and reset • To unlock the CSM: – Perform a dummy read of each password in the Flash – Write the correct passwords to the key registers • New Flash Devices (PWL are all 0xFFFF): – When all passwords are 0xFFFF – only a read of the PWL is required to bring the device into unlocked mode Technology beyond the Dreams™ Copyright © 2006 Pantech Solutions Pvt
- 15. CSM Caveats • Never program all the PWL’s as 0x0000 – Doing so will permanently lock the CSM • Flash addresses 0x3F7F80 to 0x3F7FF5, inclusive, must be programmed to 0x0000 to securely lock the CSM • Remember that code running in unsecured RAM cannot access data in secured memory – Don’t link the stack to secured RAM if you have any code that runs from unsecured RAM • Do not embed the passwords in your code! – Generally, the CSM is unlocked only for debug – Code Composer Studio can do the unlocking Technology beyond the Dreams™ Copyright © 2006 Pantech Solutions Pvt
- 16. CSM Password Match Flow Device permanently locked Start Is PWL = Yes CPU access is limited – all 0s? device cannot be debugged or reprogrammed No Flash device secure after Yes reset or runtime Is PWL = all Fs? No Do dummy read of PWL Write password to KEY registers 0x3F 7FF8 – 0x3F 7FFF 0x00 0AE0 – 0x00 0AE7 (EALLOW) protected Device unlocked Correct Yes password? User can access on- chip secure memory No Technology beyond the Dreams™ Copyright © 2006 Pantech Solutions Pvt
- 17. Unlocking the CSM: CSM C-Code Examples volatile int *PWL = &CsmPwl.PSWD0; volatile int i, tmp; //Pointer to PWL register file for (i = 0; i<8; i++) tmp = *PWL++; //Dummy reads of PWL locations asm (” EALLOW”); //KEY regs are EALLOW protected CsmRegs.KEY0 = PASSWORD0; //Write the passwords CsmRegs.KEY1 = PASSWORD0; //to the Key registers CsmRegs.KEY2 = PASSWORD2; CsmRegs.KEY3 = PASSWORD3; CsmRegs.KEY4 = PASSWORD4; CsmRegs.KEY5 = PASSWORD5; CsmRegs.KEY6 = PASSWORD6; CsmRegs.KEY7 = PASSWORD7; asm (” EDIS”); Locking the CSM: asm(” EALLOW”); //CSMSCR reg is EALLOW protected CsmRegs.CSMSCR.bit.FORCESEC = 1; //Set FORCESEC bit asm (”EDIS”); Technology beyond the Dreams™ Copyright © 2006 Pantech Solutions Pvt
- 18. Lab 11: Load an application into Flash Use Solution for Lab4 to begin with Modify the project to use internal Flash for code Add “DSP281x_CodeStartBranch.asm” to branch from Flash entry point ( 0x3F 7FF6) to C - library function “_c_int00” Add TI - code to set up the speed of Flash Add a function to move the speed-up code from Flash to SARAM Adjust Linker Command File Use CCS plug-in tool to perform the Flash download Disconnect emulator, set eZdsp into MC-mode (JP1) and re-power the board! Code should be executed out of Flash For details see procedure in textbook! Technology beyond the Dreams™ Copyright © 2006 Pantech Solutions Pvt