Access external Flash of an TI OMAP5948

[jaggernaut]

Hello! I'm recently received my Olimex ARM-USB-OCD-H probe. My goal was to use it to download/upload Firmware of a radiosystem. The firmware resides there in an Flash memory chip (Spansion S29GL256N, BGA) which is connected to the main processor, an OMAP5948. There are also two external RAM-Chips (Micron 46V64M8) connected to it. The bootloader inside the OMAP's own flash will copy the content of the external Flash to the external memory on powerup and executes the software from there. The external Flash contents seem to be violated/erased somehow and i'm looking for a way to reprogramm it.

The OMAP5948 contains an ARM9 CPU (ARM926EJ-S) and an JTAG-TAP (besides of an Coprocessor, CP15 and an DSP). I've managed to find the correct JTAG-Signals and connect them to the Olimex. As for the software i'm using OpenOCD. Because there is no native support for OMAP5948 with OpenOCD, i've created the following config:

openocd.cfg:

Code Select Expand


# source interface config
source [find scripts/interface/ftdi/olimex-arm-usb-ocd-h.cfg]

# source target config
source [find scripts/target/omap5948.cfg]

jtag_rclk 4
init
reset


The file ftdi/olimex-arm-usb-ocd-h.cfg is already supplied by OpenOCD for the Olimex.
The target config file target/omap5948.cfg i have created myself with the following inside:

Code Select Expand


# TI OMAP5948 (ARM926E + DSP)
adapter_nsrst_delay 100

# TotalIRLen = 50, IRPrint = 0x001444031F3D81
# JTAG chain contains 3 devices:
#  #0 Id: 0x031F3D81, IRLen: 34, DSP
#  #1 Id: 0x0692602F, IRLen: 04, ARM9TDMI Core
#  #2 Id: 0x00000001, IRLen: 12, Unknown device (ICE)
# CP15.0.0: 0x41069263: ARM, Architecure 5TEJ
# CP15.0.1: 0x1D112152: ICache: 16kB (4*128*32), DCache: 8kB (4*64*32)
# Cache type: Separate, Write-back, Format C (WT supported)
# Adaptive clocking not supported for selected CPU core. Only supported for -S cores.
# Auto JTAG speed: 8000 kHz
# JTAG Id: 0x0692602F  Version: 0x0 Part no: 0x6926 Man. Id: 0017

#jtag scan chain
jtag newtap omap5948 dsp -irlen 34 -expected-id 0x031f3d81
jtag newtap omap5948 arm -irlen 4  -expected-id 0x0692602F
jtag newtap omap5948 ice -irlen 12 -expected-id 0x2008f02f

set _TARGETNAME omap5948.arm
target create $_TARGETNAME arm926ejs -chain-position $_TARGETNAME


This seems to be able to connect to the TAP, but wenn trying to access something with it, i get an error that the CPU is not halted.

First, do this look okay so far? Or am i completely wrong somewhere?
What can i do to halt the CPU?
How can i access the external Flash contents to transfer it to the PC or vice versa?
Is this also possible for the content of the external RAMs?
Can i read internal registers of the CPU and how (SFR..., Special function registers)?

Sorry, but i'm just beginning using JTAG. So if my questions are stupid, errorprone or misleading, please be gracious :-)

Uh, btw.: How can i attached files in this forum?