Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
Beide Seiten der vorigen Revision Vorhergehende Überarbeitung Nächste Überarbeitung | Vorhergehende Überarbeitung | ||
artikel:nav_common:omap5948:start [Thu. 22.08.2019 18:03] – [Technische Daten] go4it | artikel:nav_common:omap5948:start [Wed. 13.12.2023 07:34] (aktuell) – [Memory Map] Go4IT | ||
---|---|---|---|
Zeile 5: | Zeile 5: | ||
===== Hintergrundinfos ===== | ===== Hintergrundinfos ===== | ||
- | Der OMAP5948 | + | The OMAP5948 |
- | Er wurde speziell für Bosch entwickelt und produziert und ist somit nicht auf dem freien Markt verfügbar. Ebensowenig wie Dokumentationen dazu. **Er entspricht jedoch dem OMAP5912**, für den es zahlreiche Unterlagen und Infos im Netz gibt. Alle nachfolgenden Informationen basieren auf dieser These. **Wer mehr darüber weiß, oder gar ein Datenblatt besitzt dem wäre ich sehr dankbar wenn er sich über das [[: | + | **If somebody ever get's his hands on an __real__ OMAP5948 datasheet, please contact me via the [[: |
===== SOC-Aufbau ===== | ===== SOC-Aufbau ===== | ||
Zeile 35: | Zeile 35: | ||
Der DSP ist ein '' | Der DSP ist ein '' | ||
- | ===== Anbindung des Flash-Speicher | + | ===== Memory Map ===== |
- | Über das '' | + | ^ Start (Hex) ^ End (Hex) ^ Size (Hex) ^ Contains |
+ | | '' | ||
+ | | '' | ||
+ | | '' | ||
+ | | '' | ||
+ | | '' | ||
- | CS0 and CS3 address | + | ==== Reset Vectors ==== |
+ | |||
+ | As the OMAP has an usual ARM9 CPU Core, the reset-vectors are defined by this. When a special event occurs, the CPU sets the PC to one of those addresses, where code execution continues. Usually the code is a far-jump to a special handling routine. | ||
+ | |||
+ | < | ||
+ | 0000 0000 = RESET Exception | ||
+ | 0000 0004 = Undefined Instruction Exception | ||
+ | 0000 0008 = Software Interrupt Exception | ||
+ | 0000 000C = Prefetch Abort Exception | ||
+ | 0000 0010 = Data Abort Exception | ||
+ | 0000 0014 = -RESERVED- | ||
+ | 0000 0018 = IRQ Exception | ||
+ | 0000 001C = FIQ Exception | ||
+ | </ | ||
+ | |||
+ | ===== Anbindung des Flash-Speicher (EMIFS) ===== | ||
+ | |||
+ | The external Flash chip (Spansion S29GL...) is connected via the '' | ||
+ | |||
+ | * The address bus signal '' | ||
+ | * The ''/ | ||
+ | * Therefore the BM-Bit (Boot-Mode Bit) of the TC memory mapping | ||
+ | * BW-Bit (Boot Width) is set to 0 if BM-Bit is 1. Thus forces 16-Bit data bus and **external boot**. If the system was bootet from internal ROM or external media could be determined by reading Bit 1 of register '' | ||
+ | * MAD-Bit (data/ | ||
+ | * The EMIFS boot configuration | ||
- | The BM bit is sampled at reset depending on two factors. If MPU_BOOT (ball J20) is 1 and the device type is emulation then BM resets to 1. Otherwise, BM resets to 0. | ||
- | Thus, the boot is executed from CS0 or from CS3 attached memories. During normal execution, BM can be changed dynamically but obvious software precautions are required to prevent system crash. | ||
===== Anbindung des SDRAM ===== | ===== Anbindung des SDRAM ===== | ||
Über das '' | Über das '' | ||
- | ===== Das JTAG-Interface ===== | + | Das SD-RAM liegt dann im Adressbereich '' |
+ | |||
+ | ===== Determine Board-ID and Boot-Parameters ===== | ||
+ | |||
+ | Usually the address-bus lines of the EMIFS-interface (EMIFS_A1..A25) are output only from the OMAP side. But they can be programmed as inputs, as any other GPIO. In first, this makes no sense, but the Bosch developers uses this functionality to do some external coding. Some address lines are pulled up to 3.3V (1) by 4,7 kOhm resistors. Depending on what resistors are placed on the board, it could have a different Board-ID. | ||
+ | |||
+ | ^ Address-Line | ||
+ | | EMIFS_A1 | ID11 | Switched to 1 if ''/ | ||
+ | | EMIFS_A2 | ID10 | Switched to 1 if ''/ | ||
+ | | EMIFS_A3 | ID9 | | | ||
+ | | EMIFS_A4 | ID8 | | | ||
+ | | EMIFS_A5 | ID7 | | | ||
+ | | EMIFS_A6 | ID6 | | | ||
+ | | EMIFS_A7 | ID5 | | | ||
+ | | EMIFS_A8 | ID4 | | | ||
+ | | EMIFS_A9 | ID3 | | | ||
+ | | EMIFS_A10 | ID2 | | | ||
+ | | EMIFS_A11 | ID1 | | | ||
+ | | EMIFS_A12 | ID0 | | | ||
+ | |||
+ | ^ Address-Line | ||
+ | | EMIFS_A13 | | -Not used- | | ||
+ | | EMIFS_A14 | | -Not used- | | ||
+ | | EMIFS_A15 | BSTRAP0 | 1=dual, 0=single crystal mode | | ||
+ | | EMIFS_A16 | BSTRAP1 | 1=external, 0=internal 12 MHz osc. | | ||
+ | | EMIFS_A17 | BSTRAP2 | 1=external, 0=internal 32 KHz osc. | | ||
+ | | EMIFS_A18 | EXT_BOOT | Switched to 1 if ''/ | ||
+ | | EMIFS_A19 | | Always low (resistor not equiped) | | ||
+ | | EMIFS_A20 | | Switched as negated signal of EMIFS_A18 | | ||
+ | |||
+ | ===== The bootstrap process ===== | ||
+ | |||
+ | In a short, after powerup the OMAP executes internal ROM code to enable the chip to boot from external, direct attached media like NOR-Flash and also be able to boot from remote media like UART (serial, USB) or SD/ | ||
+ | |||
+ | ==== Reset ==== | ||
+ | |||
+ | The reset operation is determined by the level of the external pin '' | ||
+ | |||
+ | The OMAP has three external reset pins: | ||
+ | |||
+ | ^ Pin ^ Action | ||
+ | | ''/ | ||
+ | | ''/ | ||
+ | | '' | ||
+ | |||
+ | By default the Watchdog will issue an warm reset after 32 second timeout has reached. | ||
+ | |||
+ | ==== Boot ROM ==== | ||
+ | |||
+ | The OMAP starts by executing it's internal Boot ROM code. The Boot ROM is 64 kbyte in size and only accessible for the ARM MPU. (Part of it can be accessed in " | ||
+ | ==== Summary ==== | ||
+ | |||
+ | ^ Pin ^ Value ^ Selected mode ^ | ||
+ | | RESET_MODE | 0 | Reset-Mode 0 | | ||
+ | |||
+ | ===== Memory Map ===== | ||
+ | |||
+ | As the OMAP is highly configureable, | ||
+ | |||
+ | The external S29GL Flash device is connected to CS3 pin of the OMAP. | ||
+ | |||
+ | which is mapped to address 0x0C00 0000. | ||
+ | |||
+ | The internal boot-rom on the device is mapped to address 0x0000 0000. When the device starts up it always starts running code from the internal boot-rom. However, one of the first things the boot-rom does is read port GPIO13. If it is LOW then the boot-rom will jump to CS3 and execute | ||
+ | whatever is in the flash device when the device starts up. | ||
+ | |||
+ | read address 0xfffecc0c on the device using CCS. This is the address of the EMIFS_CONFIG register. Bit 1 in this register allows you to swap the physical mapping of CS0 and CS3. If bit 1 is 0 then CS0 is mapped to address 0x0 and CS3 is mapped to address 0x0c000000. Otherwise, if this bit is 1 then, CS0 is mapped to address 0x0c000000 and CS3 is mapped to address 0x0. If this is set to 1 then you could manually try clearing this bit before you download and run u-boot. | ||
+ | |||
+ | Boot Device Configuration | ||
+ | |||
+ | Depending on the " | ||
+ | |||
+ | Upon the deassertion of the reset input pin (cold reset exit) ARM926EJS traps to its reset vector, while the C55x DSP is held in reset. | ||
+ | |||
+ | It is read from the first sector of the Flash memory, which is write-protected in normal operation mode to prevent self-bricking if software fails. | ||
+ | |||
+ | The bootloader performs basic system initialization like memory setup, clock setup, pin muxing, Board ID evaluation, MMU configuration etc. It also copies the Nucleus RTOS image from Flash into SDRAM memory. It then jumps to the copied image and system goes on running from there. | ||
+ | |||
+ | You can find a copy of the bootloader on the Servicepack Update CD image in dnl/ | ||
+ | |||
+ | |||
+ | //For security-enabled devices, TI’s Basic Secure Boot lets users protect proprietary intellectual property and prevents external entities from modifying user-developed algorithms. By starting from a hardwarebased | ||
+ | " | ||
+ | can be enabled during the secure boot process during application development. The boot modules are encrypted while sitting in external nonvolatile memory, such as flash or EEPROM, and are decrypted and | ||
+ | authenticated when loaded during secure boot. Encryption and decryption protects the users' IP and lets them securely set up the system and begin device operation with known, trusted code. | ||
+ | |||
+ | Basic Secure Boot uses either SHA-1 or SHA-256, and AES-128 for boot image validation. Basic Secure Boot also uses AES-128 for boot image encryption. The secure boot flow employs a multilayer encryption | ||
+ | scheme which not only protects the boot process but also offers the ability to securely upgrade boot and application software code. A 128-bit device-specific cipher key, known only to the device and generated | ||
+ | using a NIST-800-22 certified random number generator, is used to protect user encryption keys. When an update is needed, the customer uses the encryption keys to create a new encrypted image. Then the | ||
+ | device can acquire the image through an external interface, such as Ethernet, and overwrite the existing code. For more details on the supported security features or TI’s Basic Secure Boot, see the ...// | ||
+ | |||
+ | ===== The JTAG-Interface ===== | ||
+ | |||
+ | The OMAP provides an IEEE 1149.1 compatible JTAG-Interface. | ||
+ | |||
+ | === Scan-Chain | ||
- | Der OMAP bietet ein IEEE 1149.1 konformes | + | '' |
- | JTAG_CHAIN | + | < |
+ | - TotalIRLen | ||
+ | - JTAG chain detection found 3 devices: | ||
+ | | ||
+ | | ||
+ | | ||
+ | </ | ||
- | ===== Technische Daten ===== | + | ===== Technical data ===== |
- | * Aufdruck: '' | + | * Label: '' |
- | * Gehäuseform: BGA-289 | + | * Package: '' |
- | * Hersteller: TI (Texas Instruments) | + | * Vendor: TI (Texas Instruments) |
- | * [[http:// | + | * Series: |
- | * Praktisch baugleich mit OMAP5912 | + | * Praktisch baugleich mit OMAP5912 |
- | * MCU-Familie: OMAP 1 (OMAP171x, OPAP162x, OMAP161x, OMAP1510, OMAP5910, | + | * Datasheet and ressources: [[http:// |
+ | * SRAM: 16 kbyte | ||
+ | * Boot ROM: 64 kbyte | ||
* Erscheinungsjahr: | * Erscheinungsjahr: | ||
- | * CPU: ARM926EJ-S | ||
* DSP: C55x | * DSP: C55x | ||
+ | * CPU (Core): '' | ||
+ | * ARM Family: '' | ||
+ | * ARM Arch: '' | ||
+ | * Endianess: '' | ||