Progress with IFC Flash testing

Author: dgarske

config/examples/nxp-t2080.config

@@ -1,8 +1,4 @@
 # NXP T2080 wolfBoot Configuration Template
-#
-# Stock (default): Compact layout, NOR base 0xEFFE0000
-# NAII 68PPC2 (alternate): Larger app partition, NOR base 0xE8000000
-#   Uncomment the "# NAII 68PPC2:" lines and comment the stock lines to use.
 
 ARCH=PPC
 TARGET=nxp_t2080
@@ -59,3 +55,6 @@ WOLFBOOT_DTS_BOOT_ADDRESS?=0xE8040000
 WOLFBOOT_DTS_UPDATE_ADDRESS?=0xE8050000
 # DTS Load to RAM Address
 WOLFBOOT_LOAD_DTS_ADDRESS?=0x200000
+
+# Optional QSPI flash test (erase/write/read on update partition)
+#CFLAGS_EXTRA+=-DTEST_FLASH

hal/nxp_t2080.c

@@ -217,9 +217,10 @@ static void hal_flash_init(void)
     wolfBoot_printf("IFC CSPR0: 0x%x%s\n", cspr,
         (cspr & IFC_CSPR_WP) ? " (WP set)" : "");
 #endif
-    if (cspr & IFC_CSPR_WP) {
-        set32(IFC_CSPR(0), cspr & ~IFC_CSPR_WP);
-    }
+    /* WP clearing is done in hal_flash_clear_wp() from RAMFUNCTION code.
+     * T2080RM requires V=0 before modifying IFC_CSPR, which is not safe
+     * during XIP. The RAMFUNCTION code runs from DDR with flash TLB
+     * guarded, so it can safely toggle V=0 -> modify -> V=1. */
 
     /* Note: hal_flash_getid() is disabled because AMD Autoselect mode
      * affects the entire flash bank. Since wolfBoot runs XIP from the same
@@ -715,6 +716,25 @@ static void RAMFUNCTION hal_flash_cache_enable(void)
     invalidate_icache();
 }
 
+/* Clear IFC write-protect. T2080RM says IFC_CSPR should only be written
+ * when V=0. Must be called from RAMFUNCTION (DDR) with flash TLB set to
+ * guarded (MAS2_G) so no speculative access occurs while V is briefly 0. */
+static void RAMFUNCTION hal_flash_clear_wp(void)
+{
+    uint32_t cspr = get32(IFC_CSPR(0));
+    if (cspr & IFC_CSPR_WP) {
+        /* Clear V first, then modify WP, then re-enable V */
+        set32(IFC_CSPR(0), cspr & ~(IFC_CSPR_WP | IFC_CSPR_V));
+        __asm__ __volatile__("sync; isync");
+        set32(IFC_CSPR(0), (cspr & ~IFC_CSPR_WP) | IFC_CSPR_V);
+        __asm__ __volatile__("sync; isync");
+        /* Verify WP cleared */
+        cspr = get32(IFC_CSPR(0));
+        wolfBoot_printf("WP clear: CSPR0=0x%x%s\n", cspr,
+            (cspr & IFC_CSPR_WP) ? " (FAILED)" : " (OK)");
+    }
+}
+
 static void RAMFUNCTION hal_flash_unlock_sector(uint32_t sector)
 {
     /* AMD unlock sequence */
@@ -773,6 +793,12 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
 
     /* Disable flash caching — AMD commands must reach the chip directly */
     hal_flash_cache_disable();
+    hal_flash_clear_wp();
+
+    /* Reset flash to read-array mode in case previous operation left it
+     * in command mode (e.g. after a timeout or incomplete operation) */
+    FLASH_IO8_WRITE(0, 0, AMD_CMD_RESET);
+    ram_udelay(50);
 
     pos = 0;
     while (len > 0) {
@@ -792,18 +818,15 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
 
         hal_flash_unlock_sector(sector);
         FLASH_IO8_WRITE(sector, offset, AMD_CMD_WRITE_TO_BUFFER);
-    #if FLASH_CFI_WIDTH == 16
-        FLASH_IO16_WRITE(sector, offset, (nwords-1));
-    #else
+        /* Word count (N-1) must be replicated to both chips */
         FLASH_IO8_WRITE(sector, offset, (nwords-1));
-    #endif
 
         for (i=0; i<nwords; i++) {
             const uint8_t* ptr = &data[pos];
         #if FLASH_CFI_WIDTH == 16
-            FLASH_IO16_WRITE(sector, i, *((const uint16_t*)ptr));
+            FLASH_IO16_WRITE(sector, offset + i, *((const uint16_t*)ptr));
         #else
-            FLASH_IO8_WRITE(sector, i, *ptr);
+            FLASH_IO8_WRITE(sector, offset + i, *ptr);
         #endif
             pos += (FLASH_CFI_WIDTH/8);
         }
@@ -814,6 +837,7 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
         ret = hal_flash_status_wait(sector, 0x44, 200*1000);
         if (ret != 0) {
             wolfBoot_printf("Flash Write: Timeout at sector %d\n", sector);
+            FLASH_IO8_WRITE(sector, 0, AMD_CMD_RESET);
             break;
         }
 
@@ -837,6 +861,12 @@ int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
 
     /* Disable flash caching — AMD commands must reach the chip directly */
     hal_flash_cache_disable();
+    hal_flash_clear_wp();
+
+    /* Reset flash to read-array mode in case previous operation left it
+     * in command mode (e.g. after a timeout or incomplete operation) */
+    FLASH_IO8_WRITE(0, 0, AMD_CMD_RESET);
+    ram_udelay(50);
 
     while (len > 0) {
         /* determine sector address */
@@ -854,10 +884,21 @@ int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
         /* block erase timeout = 50us - for additional sectors */
         /* Typical is 200ms (max 1100ms) */
 
+        /* Debug: check if flash entered erase mode (DQ6 should toggle) */
+        {
+            uint16_t r1 = FLASH_IO8_READ(sector, 0);
+            uint16_t r2 = FLASH_IO8_READ(sector, 0);
+            wolfBoot_printf("Erase cmd sent: read 0x%x, 0x%x %s\n",
+                r1, r2, (r1 != r2) ? "(toggling)" : "(NOT toggling)");
+        }
+
         /* poll for erase completion - max 1.1 sec */
         ret = hal_flash_status_wait(sector, 0x4C, 1100*1000);
         if (ret != 0) {
-            wolfBoot_printf("Flash Erase: Timeout at sector %d\n", sector);
+            uint16_t r1 = FLASH_IO8_READ(sector, 0);
+            wolfBoot_printf("Flash Erase: Timeout at sector %d (status 0x%x)\n",
+                sector, r1);
+            FLASH_IO8_WRITE(sector, 0, AMD_CMD_RESET);
             break;
         }
 

hal/nxp_t2080.h

@@ -131,7 +131,7 @@ enum ifc_amask_sizes {
 
 /* ---- NOR Flash ---- */
 #define FLASH_BANK_SIZE   (128*1024*1024)
-#define FLASH_PAGE_SIZE   (1024) /* program buffer */
+#define FLASH_PAGE_SIZE   (512) /* program buffer (256 bytes per chip x 2 chips) */
 #define FLASH_SECTOR_SIZE (128*1024)
 #define FLASH_SECTORS     (FLASH_BANK_SIZE / FLASH_SECTOR_SIZE)
 #define FLASH_CFI_WIDTH   16 /* 8 or 16 */