(SOLVED!) How to read and write mainboard Flash (Spansion S29GL)

ACM - Ford FX, NX and MCA headunits
Post Reply
Go4IT
Pro
Posts: 828
Joined: 08 Feb 2019, 12:25

Re: The OMAP5912 boot process

Post by Go4IT »

I tried to dig deepr into this watchdog problem. Clear for me is, that something resets the OMAP from "within" the chip, when doing some special functions. I can explain this myself by stopping a routine, which normally runs and prevents the timer from underrun and issue a reset. This routine is loaded if the OMAP boots, regardless of the /SEL-mode, because this is only to prevent the RU (V850) from resetting the OMAP from outside. So whether or not in this mode, there will be software executed by the OMAP. Also the RU is running a software and may shut down the entire system (remember, it is the V850 which has control over all internal powerswitches) if he is unsatisfied.

If we now HALT the CPU, the internal clocks runs further, and so the WD-timers decrease until they reach 0x0000 (all timers are 16 Bit) and issue a warm-start reset. Same if we program the flash. The software loaded into the internal SRAM of the OMAP does not reset the WD timers, nor did they stop them, so a reset is issued. What is curious is, that on reading it does not seem to have this problem, but on writing... maybe different RAMcodes are used by Segger and one has a bug?

You may also read this doc from TI, where i get valuable information from: "OMAP5910/5912 Applications Processor Timers Reference Guide (SPRU891)".
Now, let me quote some interesting parts of this doc and add my comments ;-)

"The OMAP5912 has one MPU watchdog timer, one DSP watchdog timer, and one reserved 32-KHz watchdog timer. The watchdog timers reset or generate an interrupt to MPU or DSP when they reach timeout"
Timeout means, the counter value of the WD register reaches 0x0000

"They can be used to detect user programs stuck in an infinite loop, loss of program control, or a runaway condition"
e.g. if we Flash the unit ;-)

"The 32-KHz OS timer is able to generate periodical interrupts to the OS. This is used to keep track of the current time to control the operation of the device drivers, and also for OS scheduling purposes. If the OMAP chip is in deep sleep mode, it can also be used to wake up the system."

"Using the reserved 32-KHz watchdog timer is not supported. It needs to be disabled upon reset."
Now, what does that mean? Hope they will describe how to disabled those useless shit. If you read further the document, there is a GOTCHA:

"There are three watchdog timers inside the OMAP5912: one MPU watchdog timer, one DSP watchdog timer, and one reserved 32-KHz watchdog timer. Using the 32-KHz watchdog is not supported. Upon system reset, it needs to be disabled before it expires (in approximately 19s) via the following procedure:"

Hey, 19 seconds? This may be the thing we are looking after!! Let's see how they disable it:

Code: Select all

(*(volatile int*)0xFFFEB048) = 0xAAAA;
// wait until the write operation is completed
while ( ((*(volatile int *)0xFFFEB034) & 0x10) == 0x10 );
(*(volatile int*)0xFFFEB048) = 0x5555;
// wait until the write operation is completed
while ( ((*(volatile int *)0xFFFEB034) & 0x10) == 0x10 );
I will try this later... now read on

"The MPU watchdog timer also has the wakeup capability, as it resets both the MPU and DSP upon timeout. The DSP watchdog timer only resets the DSP when its counter expires."
Good to now...

"The features of the MPU/DSP private timers are as follows:
* 32-bit down count
* Interrupt to MPU/DSP when the timer expires
* Programmable timer period
* Auto-reload mode and one-shot mode
* On-the-fly read capability"

The MPU and DSP WDs are feed from the system-clock (CK_REF), which is produced from the external 12 MHz oscillator on the board:


The time a WD fires depends on this criterias:
1.) The frequency of the timer reference clock for the MPU/DSP private timer:

2.) The value of the prescaler bit field (PTV) in the MPU_/DSP_CNTL_TIMER register. The input reference clock to the timer is divided by 2(PTV+1). The PTV value is in the range from 0 to 7:

3.) The values of the load registers: MPU_LOAD_TIMER and DSP_LOAD_TIMER_HI/_LO.

Equation to determine the timer interrupt period for the MPU private timer: TMPU_Timeout = TMPU_ref_clk * (<MPU_LOAD_TIMER>+1) * 2(PTV+1)
For the DSP private timer: TDSP_Timeout = TDSP_ref_clk * (<DSP_LOAD_TIMER_HI, LO>+1) * 2(PTV+1)
Where TMPU_ref_clk and TDSP_ref_clk are the periods of the input reference clocks for the MPU and DSP private timers.

Interesting part:
"Before the MPU/DSP subsystem can enter any of the low power states, the MPU/DSP timer reference clock must be stopped in the following two ways:
1.) Set the EN_TIMCK bit in the MPU_/DSP_IDLECT2 register to 0 to force the clock to stop.
2.) Leave the EN_TIMCK bit in the MPU_/DSP_IDLECT2 register as 1, but stop all the MPU/DSP private timers by configuring the ST bit in the
MPU_/DSP_CNTL_TIMER register and set the IDLTIM_ARM/_DSP bit to 1. Setting the IDLTIM_ARM/_DSP bit to 1 causes the input reference clock to be stopped in conjunction with MPU/DSP clock when the idle mode is entered."
I wonder if we disable the clock source for the timers, if they would also halt the WD timers? :-)

"Upon reset, the MPU/DSP timer module is in the following state:
1.) The input reference clock is from DPLL1 (ARM_CKCTL[ARM_TIMXO]/DSP_CKCTL[DSP_TIMXO] = 1).
2.) The input reference clock is stopped (EN_TIMCK bit is 0 in the ARM_/DSP_IDLECT2 register).
3.) The input clock is not enabled inside timer module (CLOCK_ENABLE bit is 0 in the MPU_/DSP_CNTL_TIMER register).
4.) The timer is in one-shot mode.
5.) The timer is stopped (ST bit is 0 in the MPU_/DSP_CNTL_TIMER register)."
Good to now.

... to be continued ...
You do not have the required permissions to view the files attached to this post.
Go4IT
Pro
Posts: 828
Joined: 08 Feb 2019, 12:25

Re: The OMAP5912 boot process

Post by Go4IT »

HEY GUYS! I DID IT! FOUND THE KEY AND NOW I CAN ERASE AND PROGRAM IN ONE GO!!! :D :D :D

Here, after the erase with "F4" (note the time used :) )
nx_flash_erased.png
And here, after programming an image:
nx_flash_programmed.png
Now, i go to bed and explain to you tomorrow, promise! :-)
You do not have the required permissions to view the files attached to this post.
Go4IT
Pro
Posts: 828
Joined: 08 Feb 2019, 12:25

Re: The OMAP5912 boot process

Post by Go4IT »

Now, here is the solution and how i found it:

In the TI doc (SPRU891) from page 26 there is a chapter about Watchdog Timers. In the introducion they tell about the "not supported" 32-KHz watchdog and that it will be load on reset with a value that resets the chip after 19 seconds. This caused my attraction :). They also give an example how to disable it, and that's what i supposed to do also. It is a special sequence written into the "Watchdog Start/Stop Register (WSPR)" at 0xFFFE B048 (you find more about it in TI SPRU742, page 1022). One need to write 0xAAAA, followed by 0x5555 to this address in order to disable the WD, and 0xBBBB followed by 0x4444 to enable it. A read on this register returns the last data written in WSPR.

The code fragment they provide to disable it is:

Code: Select all

(*(volatile int*)0xFFFEB048) = 0xAAAA;

// wait until the write operation is completed
while ( ((*(volatile int *)0xFFFEB034) & 0x10) == 0x10 );

(*(volatile int*)0xFFFEB048) = 0x5555;

// wait until the write operation is completed
while ( ((*(volatile int *)0xFFFEB034) & 0x10) == 0x10 );
As you see they poke and read the "Watchdog Write Pending Register (WWPS)" at 0xFFFE B034 to see if the WD timer has taken the value before writing the other one. They check if Bit 4 (equals 0x10) of this register is reset until continue to set the next value. The docs say "Bit 4 = W_PEND_WSPR -> When equal to one, a write is pending to the WSPR register.". If found this is not neccessary because JTAG is to slow but it may not be a bad idea to insert a slight delay (1ms) or try to do this within the J-Flash init sequence also.

I translated this to Segger J-Flash MPU init sequence commands:
j-flash_mpu-init_disable32khz-wdt_step1.png
j-flash_mpu-init_disable32khz-wdt_delay_step2.png
j-flash_mpu-init_disable32khz-wdt_step3.png

Then, i know there is at least one more watchdog to disable, the one from the MPU. I found the essential parts to read in TI SPRU891 on page 34. There are some registeres related to the MPU-Watchdog, and again i find a "magic sequence" to disable it on page 36. If one wirte 0xF5, followed by 0xA0 into the "MPU Watchdog Timer Mode Register (MPU_WDT_TIMER_MODE)" at address 0xFFFE C808, the timer mode is changed from watchdog to housekeeping. The later one will only trigger an interrupt, which only is of any use if there is a interrupt service routine, ISR, defined somewhere and interrupts are enabled. Another funny thing is, if you write some different value then 0xA0 after 0xF5, the MPU and the DSP is reset. Maybe this is used somewhere in the NX code to do a warm reset. So watch out if we ever find this sequence...

Coded into J-Flash init logic this looks like:
j-flash_mpu-init_disable-mpu-wdt_step1.png
j-flash_mpu-init_disable-mpu-wdt_step2.png
Now that's all it needs. The full init sequence the worked for me, right from the very first try (i'm totally happy, didn't expect to get a "first strike") looks like this:
j-flash_mpu-init_sequence.png
That's all it needs folks, go ahead and try it yourself!

From now on you could use productional programming in J-Flash (mean, it will erase, program and verify in one step) and must not fear that aborts will cause a reset, which will in turn cause the incomplete flashed code to run and to something weird.

Now, after this challenge has been done, let's head over to new horizons! :D
You do not have the required permissions to view the files attached to this post.
User avatar
Stevebe
Pro
Posts: 259
Joined: 08 Feb 2019, 12:28

Re: (SOLVED!) How to read and write mainboard Flash (Spansion S29GL)

Post by Stevebe »

Awesome work Oliver I will try and see how we go
Digimod
oscarboiro
Active member
Posts: 123
Joined: 19 Feb 2019, 21:50

Re: (SOLVED!) How to read and write mainboard Flash (Spansion S29GL)

Post by oscarboiro »

Good morning.
After a long time, I have returned.
Now I return to the activity where I was, I remember that the last time I had a problem updating the firmware from my NX's DVD, I remember that I run out of power at the beginning of the process, when it starts to erase. now I try to recover it again with J-tag, but something must be broken, since now I can not connect J-Tag, and I have the following error:
NX Memory fail screenshot.jpg
Any ideas to solve it?
regards!!
You do not have the required permissions to view the files attached to this post.
Kuga MK1 owner
Go4IT
Pro
Posts: 828
Joined: 08 Feb 2019, 12:25

Re: (SOLVED!) How to read and write mainboard Flash (Spansion S29GL)

Post by Go4IT »

Yeah, it seem to refuse to halt MMU prior to upload the RAMcode. Did you set the device to Touareg-Mode (/SEL low)?
Did you remove the front panel to reduce error sources?
Could you please attach jflash project file and the complete log here as ZIP?
oscarboiro
Active member
Posts: 123
Joined: 19 Feb 2019, 21:50

Re: (SOLVED!) How to read and write mainboard Flash (Spansion S29GL)

Post by oscarboiro »

Go4IT wrote: 02 Apr 2019, 13:11 Yeah, it seem to refuse to halt MMU prior to upload the RAMcode. Did you set the device to Touareg-Mode (/SEL low)?
I don't know "Touareg-Mode (/SEL low)" What do I need to review?
Go4IT wrote: 02 Apr 2019, 13:11 Did you remove the front panel to reduce error sources?
Yes, the front pannel is removed
Go4IT wrote: 02 Apr 2019, 13:11 Could you please attach jflash project file and the complete log here as ZIP?
here:
Oscarboiro.rar
regards!!
You do not have the required permissions to view the files attached to this post.
Kuga MK1 owner
Go4IT
Pro
Posts: 828
Joined: 08 Feb 2019, 12:25

Re: (SOLVED!) How to read and write mainboard Flash (Spansion S29GL)

Post by Go4IT »

Settings looks got, but as from the logfile inside your .rar it looks like an hardware error to me:

Code: Select all

TotalIRLen = ?, IRPrint = 0x..FFF01FFF80000000001FC000
Could not measure total IR len. TDO is constant high.
Check the cabling from the Segger to the orange connector. Void using cables longer than 10 cm and also use quality cables, not those cheap china dupont wires! I used them myselfs and also got problems with them.
User avatar
Stevebe
Pro
Posts: 259
Joined: 08 Feb 2019, 12:28

Re: (SOLVED!) How to read and write mainboard Flash (Spansion S29GL)

Post by Stevebe »

Oscar are you using the clone to program NX with, I tried using one but wouldn’t work I used my EDU which worked ok.
It’s just a thought
Digimod
Post Reply