10 - 10 - 11

Texas Instruments Incorporated

Module 10 : Flash Programming C28xModule 10 : Flash Programming C28x

32-Bit-Digital Signal ControllerTMS320F2812

10 - 10 - 22

BIOS Startup Sequence from Flash MemoryBIOS Startup Sequence from Flash Memory

H0 SARAM (8K)H0 SARAM (8K)

0x3F 7FF60x3F 7FF6

0x3D 80000x3D 8000

0x3F 80000x3F 8000

0x3F F0000x3F F000

0x3F FFC00x3F FFC0

Boot ROM (4K)Boot ROM (4K)

BROM vector (32)BROM vector (32)

0x3F FC000x3F FC00

Boot CodeBoot Code

RESETRESET

0x3F FC000x3F FC00

{SCAN GPIO}

FLASH (128K)FLASH (128K)

Passwords (8)_c_int00_c_int00

LBLB

C – start routine

“rts2800_ml.lib”

“user” code sections

_c_int00_c_int00 Boot.asmBoot.asm

main ( )main ( )

{ {

…… ……

return;return;

}}22

33

44

55

11

10 - 10 - 33

TMS320F2812 Flash Memory MapTMS320F2812 Flash Memory MapData & Program SpaceData & Program SpaceAddress RangeAddress Range

0x3D 8000 – 0x3D 9FFF0x3D 8000 – 0x3D 9FFF

0x3D A000 – 0x3D BFFF0x3D A000 – 0x3D BFFF

0x3D C000 – 0x3D FFFF0x3D C000 – 0x3D FFFF

0x3E 0000 – 0x3E 3FFF0x3E 0000 – 0x3E 3FFF

0x3E 4000 – 0x3E 7FFF0x3E 4000 – 0x3E 7FFF

0x3E 8000 – 0x3E BFFF0x3E 8000 – 0x3E BFFF

0x3E C000 – 0x3E FFFF0x3E C000 – 0x3E FFFF

0x3F 0000 – 0x3F 3FFF0x3F 0000 – 0x3F 3FFF

0x3F 4000 – 0x3F 5FFF0x3F 4000 – 0x3F 5FFF

0x3F 6000 – 0x3F 7F7F0x3F 6000 – 0x3F 7F7F

0x3F 7F80 – 0x3F 7FF50x3F 7F80 – 0x3F 7FF5

0x3F 7FF6 – 0x3F 7FF70x3F 7FF6 – 0x3F 7FF7

0x3F 7FF8 – 0x3F 7FFF0x3F 7FF8 – 0x3F 7FFF

Sector J ; 8K x 16Sector J ; 8K x 16

Sector I ; 8K x 16Sector I ; 8K x 16

Sector H : 16K x 16Sector H : 16K x 16

Sector G ; 16K x 16Sector G ; 16K x 16

Sector F ; 16K x 16Sector F ; 16K x 16

Sector E ; 16K x 16Sector E ; 16K x 16

Sector D; 16K x 16Sector D; 16K x 16

Sector C ; 16K x 16Sector C ; 16K x 16

Sector B ; 8K x16Sector B ; 8K x16

Sector A ; (8K-128) x16 Sector A ; (8K-128) x16

Program to 0x0000 when using Program to 0x0000 when using Code Security Mode !Code Security Mode !

Flash Entry Point ; 2 x 16Flash Entry Point ; 2 x 16

Security Password ; 8 x 16Security Password ; 8 x 16

10 - 10 - 44

Basic Flash OperationBasic Flash Operation Flash is arranged in pages of 128 addressesFlash is arranged in pages of 128 addresses Wait states are specified for consecutive accesses within a page, Wait states are specified for consecutive accesses within a page,

and random accesses across pagesand random accesses across pages OTP has random access onlyOTP has random access only Must specify the number of SYSCLKOUT wait-states Must specify the number of SYSCLKOUT wait-states

Reset defaults are maximum values !Reset defaults are maximum values !

Flash configuration code must not run from Flash memory !Flash configuration code must not run from Flash memory !

FBANKWAITFBANKWAIT

@ 0x00 0A86 @ 0x00 0A86 RANDWAITRANDWAITreserved

1515 004 34 38 78 7

PAGEWAITPAGEWAIT reserved

12 1112 11

FOTPWAITFOTPWAIT

@ 0x00 0A87 @ 0x00 0A87 OTPWAITOTPWAITreserved

1515 004 34 3

*** Refer to the F281x datasheet for detailed numbers ****** Refer to the F281x datasheet for detailed numbers ***

For 150 MHz, PAGEWAIT = 5, RANDWAIT = 5, OTPWAIT = 8For 150 MHz, PAGEWAIT = 5, RANDWAIT = 5, OTPWAIT = 8

For 135 MHz, PAGEWAIT = 4, RANDWAIT = 4, OTPWAIT = 8For 135 MHz, PAGEWAIT = 4, RANDWAIT = 4, OTPWAIT = 8

10 - 10 - 55

16 or 32 16 or 32 dispatcheddispatched

1616

6464

Aligned Aligned 64-bit 64-bit fetchfetch

2-level deep 2-level deep fetch bufferfetch buffer

6464

C28x Core C28x Core decoder unitdecoder unit

Speeding Up Code Execution in Flash:Speeding Up Code Execution in Flash:Flash Pipelining (for code fetch only)Flash Pipelining (for code fetch only)

Flash Pipeline EnableFlash Pipeline Enable0 = disable (default)0 = disable (default)1 = enable1 = enable

ENPIPEENPIPEreserved

1515 0011

FOPT @ 0x00 0A80 FOPT @ 0x00 0A80

10 - 10 - 66

Other Flash Configuration Registers Other Flash Configuration Registers AddressAddress NameName DescriptionDescription0x00 0A800x00 0A80 FOPTFOPT Flash option registerFlash option register0x00 0A820x00 0A82 FPWRFPWR Flash power modes registersFlash power modes registers0x00 0A830x00 0A83 FSTATUSFSTATUS Flash status registerFlash status register0x00 0A840x00 0A84 FSTDBYWAITFSTDBYWAIT Flash sleep to standby wait registerFlash sleep to standby wait register0x00 0A850x00 0A85 FACTIVEWAITFACTIVEWAIT Flash standby to active wait registerFlash standby to active wait register0x00 0A860x00 0A86 FBANKWAITFBANKWAIT Flash read access wait state registerFlash read access wait state register0x00 0A870x00 0A87 FOTPWAITFOTPWAIT OTP read access wait state registerOTP read access wait state register

FPWR:FPWR: Save power by putting Flash/OTP to ‘Sleep’ or ‘Standby’ Save power by putting Flash/OTP to ‘Sleep’ or ‘Standby’ mode; Flash will automatically enter active mode if a Flash/OTP mode; Flash will automatically enter active mode if a Flash/OTP access is made access is made

FSTATUS:FSTATUS: Various status bits (e.g. PWR mode) Various status bits (e.g. PWR mode) FSTDBYWAIT:FSTDBYWAIT: Specify number of cycles to wait during wake-up Specify number of cycles to wait during wake-up

from sleep to standbyfrom sleep to standby FACTIVEWAIT:FACTIVEWAIT: Specify number of cycles to wait during wake-up Specify number of cycles to wait during wake-up

from standby to activefrom standby to active

Defaults for these registers are often sufficient – See “TMS320F28x DSPSystem Control and Interrupts Reference Guide,” SPRU078, for more information

10 - 10 - 77

F28x DSPF28x DSP

FLASHFLASH CPUCPU

RAMRAM

Flash Programming BasicsFlash Programming Basics The DSP CPU itself performs the flash programmingThe DSP CPU itself performs the flash programming The CPU executes Flash utility code from RAM that reads the Flash The CPU executes Flash utility code from RAM that reads the Flash

data and writes it into the Flashdata and writes it into the Flash We need to get the We need to get the Flash utility codeFlash utility code and the and the Flash dataFlash data into RAM into RAM

JTAGJTAGEmulatorEmulator

SPISPI

GPIOGPIO

SCISCIRS232RS232

RO

MR

OM

Bo

otl

oad

erB

oo

tlo

ader

Flash Flash utility utility codecode

Flash Flash DataData

10 - 10 - 88

Flash Programming BasicsFlash Programming Basics Sequence of steps for Flash programming:Sequence of steps for Flash programming:

Minimum Minimum EraseErase size is a sector size is a sector Minimum Minimum ProgramProgram size is a bit! size is a bit! Important not to lose power during erase step: If Important not to lose power during erase step: If

CSM passwords happen to be all zeros, the CSM will CSM passwords happen to be all zeros, the CSM will be permanently locked!be permanently locked!

Chance of this happening is quite small! (Erase step is Chance of this happening is quite small! (Erase step is performed sector by sector)performed sector by sector)

1. Erase1. Erase - Set all bits to zero, then to one- Set all bits to zero, then to one

2.2. ProgramProgram - Program selected bits with zero- Program selected bits with zero

3.3. VerifyVerify - Verify flash contents- Verify flash contents

AlgorithmAlgorithm Function Function

10 - 10 - 99

Flash Programming UtilitiesFlash Programming Utilities

Code Composer Studio Plug-in (uses JTAG) Code Composer Studio Plug-in (uses JTAG) ** Serial Flash loader from TI (uses SCI boot) Serial Flash loader from TI (uses SCI boot) ** Gang Programmers (use GPIO boot)Gang Programmers (use GPIO boot)

BP Micro programmerBP Micro programmer Data I/O programmerData I/O programmer

Build your own custom utilityBuild your own custom utility Use a different ROM bootloader method than SCIUse a different ROM bootloader method than SCI Embed flash programming into your applicationEmbed flash programming into your application Flash API algorithms provided by TIFlash API algorithms provided by TI

** Available from TI web at www.ti.com Available from TI web at www.ti.com

10 - 10 - 1010

Code Composer Studio Flash Plug-InCode Composer Studio Flash Plug-In

10 - 10 - 1111

Code Security Module (CSM)Code Security Module (CSM)

Data reads and writes from restricted memory are Data reads and writes from restricted memory are only allowed for code running from restricted only allowed for code running from restricted memorymemory

All other data read/write accesses are blocked:All other data read/write accesses are blocked:JTAG emulator/debugger, ROM bootloader, code running in external JTAG emulator/debugger, ROM bootloader, code running in external memory or unrestricted internal memorymemory or unrestricted internal memory

Access to the following on-chip memory is Access to the following on-chip memory is restricted:restricted:

LO SARAM (4K)LO SARAM (4K)

L1 SARAM (4K)L1 SARAM (4K)

OTP (1K)OTP (1K)

FLASH (128K)FLASH (128K)

reserved

0x00 80000x00 8000

0x00 90000x00 9000

0x3D 78000x3D 7800

0x3D 80000x3D 8000reserved

0x00 A0000x00 A000

0x3D 7C000x3D 7C00

10 - 10 - 1212

CSM PasswordCSM Password

128-bit user defined password is stored in Flash128-bit user defined password is stored in Flash

128-bit Key Register used to lock and unlock the device128-bit Key Register used to lock and unlock the device Mapped in memory space 0x00 0AE0 – 0x00 0AE7Mapped in memory space 0x00 0AE0 – 0x00 0AE7 Register “EALLOW” protectedRegister “EALLOW” protected

0x3F 7FF8 - 0x3F 7FFF0x3F 7FF8 - 0x3F 7FFF

CSM PasswordCSM PasswordLocations (PWL)Locations (PWL)

LO SARAM (4K)LO SARAM (4K)

L1 SARAM (4K)L1 SARAM (4K)

OTP (1K)OTP (1K)

FLASH (128K)FLASH (128K)

reserved

0x00 80000x00 8000

0x00 90000x00 9000

0x3D 78000x3D 7800

0x3D 80000x3D 8000reserved

128-Bit Password128-Bit Password

0x00 A0000x00 A000

0x3D 7C000x3D 7C00

10 - 10 - 1313

CSM RegistersCSM RegistersAddress Name Reset ValueAddress Name Reset Value DescriptionDescription0x00 0AE0 KEY0 0xFFFF0x00 0AE0 KEY0 0xFFFF Low word of 128-bit Key registerLow word of 128-bit Key register0x00 0AE1 KEY1 0xFFFF0x00 0AE1 KEY1 0xFFFF 22ndnd word of 128-bit Key register word of 128-bit Key register0x00 0AE2 KEY2 0xFFFF0x00 0AE2 KEY2 0xFFFF 33rdrd word of 128-bit Key register word of 128-bit Key register0x00 0AE3 KEY3 0xFFFF0x00 0AE3 KEY3 0xFFFF 44thth word of 128-bit Key register word of 128-bit Key register0x00 0AE4 KEY4 0xFFFF0x00 0AE4 KEY4 0xFFFF 55thth word of 128-bit Key register word of 128-bit Key register0x00 0AE5 KEY5 0xFFFF0x00 0AE5 KEY5 0xFFFF 66thth word of 128-bit Key register word of 128-bit Key register0x00 0AE6 KEY6 0xFFFF0x00 0AE6 KEY6 0xFFFF 77thth word of 128-bit Key register word of 128-bit Key register0x00 0AE7 KEY7 0xFFFF0x00 0AE7 KEY7 0xFFFF High word of 128-bit Key registerHigh word of 128-bit Key register0x00 0AEF CSMSCR 0xFFFF0x00 0AEF CSMSCR 0xFFFF CSM status and control registerCSM status and control register

Key Registers – accessible by user; EALLOW protectedKey Registers – accessible by user; EALLOW protected

Address Name Reset ValueAddress Name Reset Value DescriptionDescription0x3F 7FF8 PWL0 user defined0x3F 7FF8 PWL0 user defined Low word of 128-bit passwordLow word of 128-bit password0x3F 7FF9 PWL1 user defined0x3F 7FF9 PWL1 user defined 22ndnd word of 128-bit password word of 128-bit password0x3F 7FFA PWL2 user defined 0x3F 7FFA PWL2 user defined 33rdrd word of 128-bit password word of 128-bit password0x3F 7FFB PWL3 user defined 0x3F 7FFB PWL3 user defined 44thth word of 128-bit password word of 128-bit password0x3F 7FFC PWL4 user defined0x3F 7FFC PWL4 user defined 55thth word of 128-bit password word of 128-bit password0x3F 7FFD PWL5 user defined0x3F 7FFD PWL5 user defined 66thth word of 128-bit password word of 128-bit password0x3F 7FFE PWL6 user defined 0x3F 7FFE PWL6 user defined 77thth word of 128-bit password word of 128-bit password0x3F 7FFF PWL7 user defined0x3F 7FFF PWL7 user defined High word of 128-bit passwordHigh word of 128-bit password

PWL in memory – reserved for passwords onlyPWL in memory – reserved for passwords only

10 - 10 - 1414

Locking and Unlocking the CSMLocking and Unlocking the CSM

The CSM is locked at power-up and resetThe CSM is locked at power-up and reset To unlock the CSM:To unlock the CSM:

Perform a dummy read of each password in the Perform a dummy read of each password in the FlashFlash

Write the correct passwords to the key registersWrite the correct passwords to the key registers New Flash Devices (PWL are all 0xFFFF):New Flash Devices (PWL are all 0xFFFF):

When all passwords are 0xFFFF – only a read of When all passwords are 0xFFFF – only a read of the PWL is required to bring the device into the PWL is required to bring the device into unlocked modeunlocked mode

10 - 10 - 1515

CSM CaveatsCSM Caveats

Never program all the PWL’s as 0x0000Never program all the PWL’s as 0x0000 Doing so will permanently lock the CSMDoing so will permanently lock the CSM

Flash addresses 0x3F7F80 to 0x3F7FF5, inclusive, Flash addresses 0x3F7F80 to 0x3F7FF5, inclusive, must be programmed to 0x0000 to securely lock the must be programmed to 0x0000 to securely lock the CSM CSM

Remember that code running in unsecured RAM Remember that code running in unsecured RAM cannot access data in secured memorycannot access data in secured memory Don’t link the stack to secured RAM if you have any Don’t link the stack to secured RAM if you have any

code that runs from unsecured RAMcode that runs from unsecured RAM

Do not embed the passwords in your code!Do not embed the passwords in your code! Generally, the CSM is unlocked only for debugGenerally, the CSM is unlocked only for debug Code Composer Studio can do the unlockingCode Composer Studio can do the unlocking

10 - 10 - 1616

CSM Password Match FlowCSM Password Match Flow

Flash device Flash device secure after secure after

reset or runtimereset or runtime

Do dummy read of PWL Do dummy read of PWL 0x3F 7FF8 – 0x3F 7FFF0x3F 7FF8 – 0x3F 7FFF

StartStart

Device permanently lockedDevice permanently locked

CPU access is limited – CPU access is limited – device cannot be debugged device cannot be debugged

or reprogrammedor reprogrammed

Device unlockedDevice unlocked

User can access on-User can access on-chip secure memorychip secure memory

Write password to KEY registers Write password to KEY registers 0x00 0AE0 – 0x00 0AE70x00 0AE0 – 0x00 0AE7

(EALLOW) protected(EALLOW) protected

Correct Correct password?password?

Is PWL = Is PWL = all Fs?all Fs?

Is PWL = Is PWL = all 0s?all 0s?

YesYes

YesYes

YesYes

NoNo

NoNo

NoNo

10 - 10 - 1717

CSM C-Code ExamplesCSM C-Code Examples

volatile int *PWL = &CsmPwl.PSWD0; //Pointer to PWL register filevolatile int *PWL = &CsmPwl.PSWD0; //Pointer to PWL register filevolatile int i, tmp;volatile int i, tmp;

for (i = 0; i<8; i++) tmp = *PWL++; //Dummy reads of PWL locationsfor (i = 0; i<8; i++) tmp = *PWL++; //Dummy reads of PWL locations

asm (” EALLOW”); //KEY regs are EALLOW protectedasm (” EALLOW”); //KEY regs are EALLOW protectedCsmRegs.KEY0 = PASSWORD0; //Write the passwordsCsmRegs.KEY0 = PASSWORD0; //Write the passwordsCsmRegs.KEY1 = PASSWORD0; //to the Key registersCsmRegs.KEY1 = PASSWORD0; //to the Key registersCsmRegs.KEY2 = PASSWORD2;CsmRegs.KEY2 = PASSWORD2;CsmRegs.KEY3 = PASSWORD3;CsmRegs.KEY3 = PASSWORD3;CsmRegs.KEY4 = PASSWORD4;CsmRegs.KEY4 = PASSWORD4;CsmRegs.KEY5 = PASSWORD5;CsmRegs.KEY5 = PASSWORD5;CsmRegs.KEY6 = PASSWORD6;CsmRegs.KEY6 = PASSWORD6;CsmRegs.KEY7 = PASSWORD7;CsmRegs.KEY7 = PASSWORD7;asm (” EDIS”);asm (” EDIS”);

asm(” EALLOW”); //CSMSCR reg is EALLOW protectedasm(” EALLOW”); //CSMSCR reg is EALLOW protectedCsmRegs.CSMSCR.bit.FORCESEC = 1; //Set FORCESEC bitCsmRegs.CSMSCR.bit.FORCESEC = 1; //Set FORCESEC bitasm (”EDIS”);asm (”EDIS”);

Unlocking the CSM:Unlocking the CSM:

Locking the CSM:Locking the CSM:

10 - 10 - 1818

Lab 11: Load an application into FlashLab 11: Load an application into Flash Use Solution for Lab4 to begin with Modify the project to use internal Flash for code Add “DSP281x_CodeStartBranch.asm” to branch

from Flash entry point ( 0x3F 7FF6) to C - library function “_c_int00”

Add TI - code to set up the speed of Flash Add a function to move the speed-up code from

Flash to SARAM Adjust Linker Command File Use CCS plug-in tool to perform the Flash

download Disconnect emulator, set eZdsp into MC-mode

(JP1) and re-power the board! Code should be executed out of Flash For details see procedure in textbook!