git.gag.com Git - fw/openocd/blob - src/flash/cfi.c

   1 /***************************************************************************
   2  *   Copyright (C) 2005, 2007 by Dominic Rath                              *
   3  *   Dominic.Rath@gmx.de                                                   *
   4  *                                                                         *
   5  *   This program is free software; you can redistribute it and/or modify  *
   6  *   it under the terms of the GNU General Public License as published by  *
   7  *   the Free Software Foundation; either version 2 of the License, or     *
   8  *   (at your option) any later version.                                   *
   9  *                                                                         *
  10  *   This program is distributed in the hope that it will be useful,       *
  11  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  12  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  13  *   GNU General Public License for more details.                          *
  14  *                                                                         *
  15  *   You should have received a copy of the GNU General Public License     *
  16  *   along with this program; if not, write to the                         *
  17  *   Free Software Foundation, Inc.,                                       *
  18  *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  19  ***************************************************************************/
  20 #ifdef HAVE_CONFIG_H
  21 #include "config.h"
  22 #endif
  23
  24 #include "replacements.h"
  25
  26 #include "cfi.h"
  27
  28 #include "flash.h"
  29 #include "target.h"
  30 #include "log.h"
  31 #include "armv4_5.h"
  32 #include "algorithm.h"
  33 #include "binarybuffer.h"
  34 #include "types.h"
  35
  36 #include <stdlib.h>
  37 #include <string.h>
  38 #include <unistd.h>
  39
  40 int cfi_register_commands(struct command_context_s *cmd_ctx);
  41 int cfi_flash_bank_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc, struct flash_bank_s *bank);
  42 int cfi_erase(struct flash_bank_s *bank, int first, int last);
  43 int cfi_protect(struct flash_bank_s *bank, int set, int first, int last);
  44 int cfi_write(struct flash_bank_s *bank, u8 *buffer, u32 offset, u32 count);
  45 int cfi_probe(struct flash_bank_s *bank);
  46 int cfi_erase_check(struct flash_bank_s *bank);
  47 int cfi_protect_check(struct flash_bank_s *bank);
  48 int cfi_info(struct flash_bank_s *bank, char *buf, int buf_size);
  49
  50 int cfi_handle_part_id_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
  51
  52 #define CFI_MAX_BUS_WIDTH       4
  53 #define CFI_MAX_CHIP_WIDTH      4
  54
  55 flash_driver_t cfi_flash =
  56 {
  57         .name = "cfi",
  58         .register_commands = cfi_register_commands,
  59         .flash_bank_command = cfi_flash_bank_command,
  60         .erase = cfi_erase,
  61         .protect = cfi_protect,
  62         .write = cfi_write,
  63         .probe = cfi_probe,
  64         .erase_check = cfi_erase_check,
  65         .protect_check = cfi_protect_check,
  66         .info = cfi_info
  67 };
  68
  69 /* CFI fixups foward declarations */
  70 void cfi_fixup_0002_erase_regions(flash_bank_t *flash, void *param);
  71 void cfi_fixup_atmel_reversed_erase_regions(flash_bank_t *flash, void *param);
  72
  73 /* fixup after identifying JEDEC manufactuer and ID */
  74 cfi_fixup_t cfi_jedec_fixups[] = {
  75         {0, 0, NULL, NULL}
  76 };
  77
  78 /* fixup after reading cmdset 0002 primary query table */
  79 cfi_fixup_t cfi_0002_fixups[] = {
  80         {CFI_MFR_ATMEL, 0x00C8, cfi_fixup_atmel_reversed_erase_regions, NULL},
  81         {CFI_MFR_ANY, CFI_ID_ANY, cfi_fixup_0002_erase_regions, NULL},
  82         {0, 0, NULL, NULL}
  83 };
  84
  85 /* fixup after reading cmdset 0001 primary query table */
  86 cfi_fixup_t cfi_0001_fixups[] = {
  87         {0, 0, NULL, NULL}
  88 };
  89
  90 void cfi_fixup(flash_bank_t *bank, cfi_fixup_t *fixups)
  91 {
  92         cfi_flash_bank_t *cfi_info = bank->driver_priv;
  93         cfi_fixup_t *f;
  94
  95         for (f = fixups; f->fixup; f++)
  96         {
  97                 if (((f->mfr == CFI_MFR_ANY) || (f->mfr == cfi_info->manufacturer)) &&
  98                         ((f->id  == CFI_ID_ANY)  || (f->id  == cfi_info->device_id)))
  99                 {
 100                         f->fixup(bank, f->param);
 101                 }
 102         }
 103 }
 104
 105 inline u32 flash_address(flash_bank_t *bank, int sector, u32 offset)
 106 {
 107         /* while the sector list isn't built, only accesses to sector 0 work */
 108         if (sector == 0)
 109                 return bank->base + offset * bank->bus_width;
 110         else
 111         {
 112                 if (!bank->sectors)
 113                 {
 114                         ERROR("BUG: sector list not yet built");
 115                         exit(-1);
 116                 }
 117                 return bank->base + bank->sectors[sector].offset + offset * bank->bus_width;
 118         }
 119
 120 }
 121
 122 void cfi_command(flash_bank_t *bank, u8 cmd, u8 *cmd_buf)
 123 {
 124         cfi_flash_bank_t *cfi_info = bank->driver_priv;
 125         int i;
 126
 127         /* clear whole buffer, to ensure bits that exceed the bus_width
 128          * are set to zero
 129          */
 130         for (i = 0; i < CFI_MAX_BUS_WIDTH; i++)
 131                 cmd_buf[i] = 0;
 132
 133         if (cfi_info->target->endianness == TARGET_LITTLE_ENDIAN)
 134         {
 135                 for (i = bank->bus_width; i > 0; i--)
 136                 {
 137                         *cmd_buf++ = (i & (bank->chip_width - 1)) ? 0x0 : cmd;
 138                 }
 139         }
 140         else
 141         {
 142                 for (i = 1; i <= bank->bus_width; i++)
 143                 {
 144                         *cmd_buf++ = (i & (bank->chip_width - 1)) ? 0x0 : cmd;
 145                 }
 146         }
 147 }
 148
 149 /* read unsigned 8-bit value from the bank
 150  * flash banks are expected to be made of similar chips
 151  * the query result should be the same for all
 152  */
 153 u8 cfi_query_u8(flash_bank_t *bank, int sector, u32 offset)
 154 {
 155         cfi_flash_bank_t *cfi_info = bank->driver_priv;
 156         target_t *target = cfi_info->target;
 157         u8 data[CFI_MAX_BUS_WIDTH];
 158
 159         target->type->read_memory(target, flash_address(bank, sector, offset), bank->bus_width, 1, data);
 160
 161         if (cfi_info->target->endianness == TARGET_LITTLE_ENDIAN)
 162                 return data[0];
 163         else
 164                 return data[bank->bus_width - 1];
 165 }
 166
 167 /* read unsigned 8-bit value from the bank
 168  * in case of a bank made of multiple chips,
 169  * the individual values are ORed
 170  */
 171 u8 cfi_get_u8(flash_bank_t *bank, int sector, u32 offset)
 172 {
 173         cfi_flash_bank_t *cfi_info = bank->driver_priv;
 174         target_t *target = cfi_info->target;
 175         u8 data[CFI_MAX_BUS_WIDTH];
 176         int i;
 177
 178         target->type->read_memory(target, flash_address(bank, sector, offset), bank->bus_width, 1, data);
 179
 180         if (cfi_info->target->endianness == TARGET_LITTLE_ENDIAN)
 181         {
 182                 for (i = 0; i < bank->bus_width / bank->chip_width; i++)
 183                         data[0] |= data[i];
 184
 185                 return data[0];
 186         }
 187         else
 188         {
 189                 u8 value = 0;
 190                 for (i = 0; i < bank->bus_width / bank->chip_width; i++)
 191                         value |= data[bank->bus_width - 1 - i];
 192
 193                 return value;
 194         }
 195 }
 196
 197 u16 cfi_query_u16(flash_bank_t *bank, int sector, u32 offset)
 198 {
 199         cfi_flash_bank_t *cfi_info = bank->driver_priv;
 200         target_t *target = cfi_info->target;
 201         u8 data[CFI_MAX_BUS_WIDTH * 2];
 202
 203         target->type->read_memory(target, flash_address(bank, sector, offset), bank->bus_width, 2, data);
 204
 205         if (cfi_info->target->endianness == TARGET_LITTLE_ENDIAN)
 206                 return data[0] | data[bank->bus_width] << 8;
 207         else
 208                 return data[bank->bus_width - 1] | data[(2 * bank->bus_width) - 1] << 8;
 209 }
 210
 211 u32 cfi_query_u32(flash_bank_t *bank, int sector, u32 offset)
 212 {
 213         cfi_flash_bank_t *cfi_info = bank->driver_priv;
 214         target_t *target = cfi_info->target;
 215         u8 data[CFI_MAX_BUS_WIDTH * 4];
 216
 217         target->type->read_memory(target, flash_address(bank, sector, offset), bank->bus_width, 4, data);
 218
 219         if (cfi_info->target->endianness == TARGET_LITTLE_ENDIAN)
 220                 return data[0] | data[bank->bus_width] << 8 | data[bank->bus_width * 2] << 16 | data[bank->bus_width * 3] << 24;
 221         else
 222                 return data[bank->bus_width - 1] | data[(2* bank->bus_width) - 1] << 8 |
 223                                 data[(3 * bank->bus_width) - 1] << 16 | data[(4 * bank->bus_width) - 1] << 24;
 224 }
 225
 226 void cfi_intel_clear_status_register(flash_bank_t *bank)
 227 {
 228         cfi_flash_bank_t *cfi_info = bank->driver_priv;
 229         target_t *target = cfi_info->target;
 230         u8 command[8];
 231
 232         if (target->state != TARGET_HALTED)
 233         {
 234                 ERROR("BUG: attempted to clear status register while target wasn't halted");
 235                 exit(-1);
 236         }
 237
 238         cfi_command(bank, 0x50, command);
 239         target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
 240 }
 241
 242 u8 cfi_intel_wait_status_busy(flash_bank_t *bank, int timeout)
 243 {
 244         u8 status;
 245
 246         while ((!((status = cfi_get_u8(bank, 0, 0x0)) & 0x80)) && (timeout-- > 0))
 247         {
 248                 DEBUG("status: 0x%x", status);
 249                 usleep(1000);
 250         }
 251
 252         /* mask out bit 0 (reserved) */
 253         status = status & 0xfe;
 254
 255         DEBUG("status: 0x%x", status);
 256
 257         if ((status & 0x80) != 0x80)
 258         {
 259                 ERROR("timeout while waiting for WSM to become ready");
 260         }
 261         else if (status != 0x80)
 262         {
 263                 ERROR("status register: 0x%x", status);
 264                 if (status & 0x2)
 265                         ERROR("Block Lock-Bit Detected, Operation Abort");
 266                 if (status & 0x4)
 267                         ERROR("Program suspended");
 268                 if (status & 0x8)
 269                         ERROR("Low Programming Voltage Detected, Operation Aborted");
 270                 if (status & 0x10)
 271                         ERROR("Program Error / Error in Setting Lock-Bit");
 272                 if (status & 0x20)
 273                         ERROR("Error in Block Erasure or Clear Lock-Bits");
 274                 if (status & 0x40)
 275                         ERROR("Block Erase Suspended");
 276
 277                 cfi_intel_clear_status_register(bank);
 278         }
 279
 280         return status;
 281 }
 282
 283 int cfi_spansion_wait_status_busy(flash_bank_t *bank, int timeout)
 284 {
 285         u8 status, oldstatus;
 286
 287         oldstatus = cfi_get_u8(bank, 0, 0x0);
 288
 289         do {
 290                 status = cfi_get_u8(bank, 0, 0x0);
 291                 if ((status ^ oldstatus) & 0x40) {
 292                         if (status & 0x20) {
 293                                 oldstatus = cfi_get_u8(bank, 0, 0x0);
 294                                 status = cfi_get_u8(bank, 0, 0x0);
 295                                 if ((status ^ oldstatus) & 0x40) {
 296                                         ERROR("dq5 timeout, status: 0x%x", status);
 297                                         return(ERROR_FLASH_OPERATION_FAILED);
 298                                 } else {
 299                                         DEBUG("status: 0x%x", status);
 300                                         return(ERROR_OK);
 301                                 }
 302                         }
 303                 } else {
 304                         DEBUG("status: 0x%x", status);
 305                         return(ERROR_OK);
 306                 }
 307
 308                 oldstatus = status;
 309                 usleep(1000);
 310         } while (timeout-- > 0);
 311
 312         ERROR("timeout, status: 0x%x", status);
 313
 314         return(ERROR_FLASH_BUSY);
 315 }
 316
 317 int cfi_read_intel_pri_ext(flash_bank_t *bank)
 318 {
 319         cfi_flash_bank_t *cfi_info = bank->driver_priv;
 320         cfi_intel_pri_ext_t *pri_ext = malloc(sizeof(cfi_intel_pri_ext_t));
 321         target_t *target = cfi_info->target;
 322         u8 command[8];
 323
 324         cfi_info->pri_ext = pri_ext;
 325
 326         pri_ext->pri[0] = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0);
 327         pri_ext->pri[1] = cfi_query_u8(bank, 0, cfi_info->pri_addr + 1);
 328         pri_ext->pri[2] = cfi_query_u8(bank, 0, cfi_info->pri_addr + 2);
 329
 330         if ((pri_ext->pri[0] != 'P') || (pri_ext->pri[1] != 'R') || (pri_ext->pri[2] != 'I'))
 331         {
 332                 cfi_command(bank, 0xf0, command);
 333                 target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
 334                 cfi_command(bank, 0xff, command);
 335                 target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
 336                 return ERROR_FLASH_BANK_INVALID;
 337         }
 338
 339         pri_ext->major_version = cfi_query_u8(bank, 0, cfi_info->pri_addr + 3);
 340         pri_ext->minor_version = cfi_query_u8(bank, 0, cfi_info->pri_addr + 4);
 341
 342         DEBUG("pri: '%c%c%c', version: %c.%c", pri_ext->pri[0], pri_ext->pri[1], pri_ext->pri[2], pri_ext->major_version, pri_ext->minor_version);
 343
 344         pri_ext->feature_support = cfi_query_u32(bank, 0, cfi_info->pri_addr + 5);
 345         pri_ext->suspend_cmd_support = cfi_query_u8(bank, 0, cfi_info->pri_addr + 9);
 346         pri_ext->blk_status_reg_mask = cfi_query_u16(bank, 0, cfi_info->pri_addr + 0xa);
 347
 348         DEBUG("feature_support: 0x%x, suspend_cmd_support: 0x%x, blk_status_reg_mask: 0x%x", pri_ext->feature_support, pri_ext->suspend_cmd_support, pri_ext->blk_status_reg_mask);
 349
 350         pri_ext->vcc_optimal = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0xc);
 351         pri_ext->vpp_optimal = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0xd);
 352
 353         DEBUG("Vcc opt: %1.1x.%1.1x, Vpp opt: %1.1x.%1.1x",
 354                   (pri_ext->vcc_optimal & 0xf0) >> 4, pri_ext->vcc_optimal & 0x0f,
 355                   (pri_ext->vpp_optimal & 0xf0) >> 4, pri_ext->vpp_optimal & 0x0f);
 356
 357         pri_ext->num_protection_fields = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0xe);
 358         if (pri_ext->num_protection_fields != 1)
 359         {
 360                 WARNING("expected one protection register field, but found %i", pri_ext->num_protection_fields);
 361         }
 362
 363         pri_ext->prot_reg_addr = cfi_query_u16(bank, 0, cfi_info->pri_addr + 0xf);
 364         pri_ext->fact_prot_reg_size = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0x11);
 365         pri_ext->user_prot_reg_size = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0x12);
 366
 367         DEBUG("protection_fields: %i, prot_reg_addr: 0x%x, factory pre-programmed: %i, user programmable: %i", pri_ext->num_protection_fields, pri_ext->prot_reg_addr, 1 << pri_ext->fact_prot_reg_size, 1 << pri_ext->user_prot_reg_size);
 368
 369         return ERROR_OK;
 370 }
 371
 372 int cfi_read_spansion_pri_ext(flash_bank_t *bank)
 373 {
 374         cfi_flash_bank_t *cfi_info = bank->driver_priv;
 375         cfi_spansion_pri_ext_t *pri_ext = malloc(sizeof(cfi_spansion_pri_ext_t));
 376         target_t *target = cfi_info->target;
 377         u8 command[8];
 378
 379         cfi_info->pri_ext = pri_ext;
 380
 381         pri_ext->pri[0] = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0);
 382         pri_ext->pri[1] = cfi_query_u8(bank, 0, cfi_info->pri_addr + 1);
 383         pri_ext->pri[2] = cfi_query_u8(bank, 0, cfi_info->pri_addr + 2);
 384
 385         if ((pri_ext->pri[0] != 'P') || (pri_ext->pri[1] != 'R') || (pri_ext->pri[2] != 'I'))
 386         {
 387                 cfi_command(bank, 0xf0, command);
 388                 target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
 389                 return ERROR_FLASH_BANK_INVALID;
 390         }
 391
 392         pri_ext->major_version = cfi_query_u8(bank, 0, cfi_info->pri_addr + 3);
 393         pri_ext->minor_version = cfi_query_u8(bank, 0, cfi_info->pri_addr + 4);
 394
 395         DEBUG("pri: '%c%c%c', version: %c.%c", pri_ext->pri[0], pri_ext->pri[1], pri_ext->pri[2], pri_ext->major_version, pri_ext->minor_version);
 396
 397         pri_ext->SiliconRevision = cfi_query_u8(bank, 0, cfi_info->pri_addr + 5);
 398         pri_ext->EraseSuspend    = cfi_query_u8(bank, 0, cfi_info->pri_addr + 6);
 399         pri_ext->BlkProt         = cfi_query_u8(bank, 0, cfi_info->pri_addr + 7);
 400         pri_ext->TmpBlkUnprotect = cfi_query_u8(bank, 0, cfi_info->pri_addr + 8);
 401         pri_ext->BlkProtUnprot   = cfi_query_u8(bank, 0, cfi_info->pri_addr + 9);
 402         pri_ext->SimultaneousOps = cfi_query_u8(bank, 0, cfi_info->pri_addr + 10);
 403         pri_ext->BurstMode       = cfi_query_u8(bank, 0, cfi_info->pri_addr + 11);
 404         pri_ext->PageMode        = cfi_query_u8(bank, 0, cfi_info->pri_addr + 12);
 405         pri_ext->VppMin          = cfi_query_u8(bank, 0, cfi_info->pri_addr + 13);
 406         pri_ext->VppMax          = cfi_query_u8(bank, 0, cfi_info->pri_addr + 14);
 407         pri_ext->TopBottom       = cfi_query_u8(bank, 0, cfi_info->pri_addr + 15);
 408
 409         DEBUG("Silicon Revision: 0x%x, Erase Suspend: 0x%x, Block protect: 0x%x", pri_ext->SiliconRevision,
 410               pri_ext->EraseSuspend, pri_ext->BlkProt);
 411
 412         DEBUG("Temporary Unprotect: 0x%x, Block Protect Scheme: 0x%x, Simultaneous Ops: 0x%x", pri_ext->TmpBlkUnprotect,
 413               pri_ext->BlkProtUnprot, pri_ext->SimultaneousOps);
 414
 415         DEBUG("Burst Mode: 0x%x, Page Mode: 0x%x, ", pri_ext->BurstMode, pri_ext->PageMode);
 416
 417
 418         DEBUG("Vpp min: %2.2d.%1.1d, Vpp max: %2.2d.%1.1x",
 419                   (pri_ext->VppMin & 0xf0) >> 4, pri_ext->VppMin & 0x0f,
 420                   (pri_ext->VppMax & 0xf0) >> 4, pri_ext->VppMax & 0x0f);
 421
 422         DEBUG("WP# protection 0x%x", pri_ext->TopBottom);
 423
 424         return ERROR_OK;
 425 }
 426
 427 int cfi_read_atmel_pri_ext(flash_bank_t *bank)
 428 {
 429         cfi_atmel_pri_ext_t atmel_pri_ext;
 430         cfi_flash_bank_t *cfi_info = bank->driver_priv;
 431         cfi_spansion_pri_ext_t *pri_ext = malloc(sizeof(cfi_spansion_pri_ext_t));
 432         target_t *target = cfi_info->target;
 433         u8 command[8];
 434
 435         /* ATMEL devices use the same CFI primary command set (0x2) as AMD/Spansion,
 436          * but a different primary extended query table.
 437          * We read the atmel table, and prepare a valid AMD/Spansion query table.
 438          */
 439
 440         memset(pri_ext, 0, sizeof(cfi_spansion_pri_ext_t));
 441
 442         cfi_info->pri_ext = pri_ext;
 443
 444         atmel_pri_ext.pri[0] = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0);
 445         atmel_pri_ext.pri[1] = cfi_query_u8(bank, 0, cfi_info->pri_addr + 1);
 446         atmel_pri_ext.pri[2] = cfi_query_u8(bank, 0, cfi_info->pri_addr + 2);
 447
 448         if ((atmel_pri_ext.pri[0] != 'P') || (atmel_pri_ext.pri[1] != 'R') || (atmel_pri_ext.pri[2] != 'I'))
 449         {
 450                 cfi_command(bank, 0xf0, command);
 451                 target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
 452                 return ERROR_FLASH_BANK_INVALID;
 453         }
 454
 455         pri_ext->pri[0] = atmel_pri_ext.pri[0];
 456         pri_ext->pri[1] = atmel_pri_ext.pri[1];
 457         pri_ext->pri[2] = atmel_pri_ext.pri[2];
 458
 459         atmel_pri_ext.major_version = cfi_query_u8(bank, 0, cfi_info->pri_addr + 3);
 460         atmel_pri_ext.minor_version = cfi_query_u8(bank, 0, cfi_info->pri_addr + 4);
 461
 462         DEBUG("pri: '%c%c%c', version: %c.%c", atmel_pri_ext.pri[0], atmel_pri_ext.pri[1], atmel_pri_ext.pri[2], atmel_pri_ext.major_version, atmel_pri_ext.minor_version);
 463
 464         pri_ext->major_version = atmel_pri_ext.major_version;
 465         pri_ext->minor_version = atmel_pri_ext.minor_version;
 466
 467         atmel_pri_ext.features = cfi_query_u8(bank, 0, cfi_info->pri_addr + 5);
 468         atmel_pri_ext.bottom_boot = cfi_query_u8(bank, 0, cfi_info->pri_addr + 6);
 469         atmel_pri_ext.burst_mode = cfi_query_u8(bank, 0, cfi_info->pri_addr + 7);
 470         atmel_pri_ext.page_mode = cfi_query_u8(bank, 0, cfi_info->pri_addr + 8);
 471
 472         DEBUG("features: 0x%2.2x, bottom_boot: 0x%2.2x, burst_mode: 0x%2.2x, page_mode: 0x%2.2x",
 473                 atmel_pri_ext.features, atmel_pri_ext.bottom_boot, atmel_pri_ext.burst_mode, atmel_pri_ext.page_mode);
 474
 475         if (atmel_pri_ext.features & 0x02)
 476                 pri_ext->EraseSuspend = 2;
 477
 478         if (atmel_pri_ext.bottom_boot)
 479                 pri_ext->TopBottom = 2;
 480         else
 481                 pri_ext->TopBottom = 3;
 482
 483         return ERROR_OK;
 484 }
 485
 486 int cfi_read_0002_pri_ext(flash_bank_t *bank)
 487 {
 488         cfi_flash_bank_t *cfi_info = bank->driver_priv;
 489
 490         if (cfi_info->manufacturer == CFI_MFR_ATMEL)
 491         {
 492                 return cfi_read_atmel_pri_ext(bank);
 493         }
 494         else
 495         {
 496                 return cfi_read_spansion_pri_ext(bank);
 497         }
 498 }
 499
 500 int cfi_spansion_info(struct flash_bank_s *bank, char *buf, int buf_size)
 501 {
 502         int printed;
 503         cfi_flash_bank_t *cfi_info = bank->driver_priv;
 504         cfi_spansion_pri_ext_t *pri_ext = cfi_info->pri_ext;
 505
 506         printed = snprintf(buf, buf_size, "\nSpansion primary algorithm extend information:\n");
 507         buf += printed;
 508         buf_size -= printed;
 509
 510         printed = snprintf(buf, buf_size, "pri: '%c%c%c', version: %c.%c\n", pri_ext->pri[0],
 511                            pri_ext->pri[1], pri_ext->pri[2],
 512                            pri_ext->major_version, pri_ext->minor_version);
 513         buf += printed;
 514         buf_size -= printed;
 515
 516         printed = snprintf(buf, buf_size, "Silicon Rev.: 0x%x, Address Sensitive unlock: 0x%x\n",
 517                            (pri_ext->SiliconRevision) >> 2,
 518                            (pri_ext->SiliconRevision) & 0x03);
 519         buf += printed;
 520         buf_size -= printed;
 521
 522         printed = snprintf(buf, buf_size, "Erase Suspend: 0x%x, Sector Protect: 0x%x\n",
 523                            pri_ext->EraseSuspend,
 524                            pri_ext->BlkProt);
 525         buf += printed;
 526         buf_size -= printed;
 527
 528         printed = snprintf(buf, buf_size, "VppMin: %2.2d.%1.1x, VppMax: %2.2d.%1.1x\n",
 529                 (pri_ext->VppMin & 0xf0) >> 4, pri_ext->VppMin & 0x0f,
 530                 (pri_ext->VppMax & 0xf0) >> 4, pri_ext->VppMax & 0x0f);
 531
 532         return ERROR_OK;
 533 }
 534
 535 int cfi_intel_info(struct flash_bank_s *bank, char *buf, int buf_size)
 536 {
 537         int printed;
 538         cfi_flash_bank_t *cfi_info = bank->driver_priv;
 539         cfi_intel_pri_ext_t *pri_ext = cfi_info->pri_ext;
 540
 541         printed = snprintf(buf, buf_size, "\nintel primary algorithm extend information:\n");
 542         buf += printed;
 543         buf_size -= printed;
 544
 545         printed = snprintf(buf, buf_size, "pri: '%c%c%c', version: %c.%c\n", pri_ext->pri[0], pri_ext->pri[1], pri_ext->pri[2], pri_ext->major_version, pri_ext->minor_version);
 546         buf += printed;
 547         buf_size -= printed;
 548
 549         printed = snprintf(buf, buf_size, "feature_support: 0x%x, suspend_cmd_support: 0x%x, blk_status_reg_mask: 0x%x\n", pri_ext->feature_support, pri_ext->suspend_cmd_support, pri_ext->blk_status_reg_mask);
 550         buf += printed;
 551         buf_size -= printed;
 552
 553         printed = snprintf(buf, buf_size, "Vcc opt: %1.1x.%1.1x, Vpp opt: %1.1x.%1.1x\n",
 554                 (pri_ext->vcc_optimal & 0xf0) >> 4, pri_ext->vcc_optimal & 0x0f,
 555                 (pri_ext->vpp_optimal & 0xf0) >> 4, pri_ext->vpp_optimal & 0x0f);
 556         buf += printed;
 557         buf_size -= printed;
 558
 559         printed = snprintf(buf, buf_size, "protection_fields: %i, prot_reg_addr: 0x%x, factory pre-programmed: %i, user programmable: %i\n", pri_ext->num_protection_fields, pri_ext->prot_reg_addr, 1 << pri_ext->fact_prot_reg_size, 1 << pri_ext->user_prot_reg_size);
 560
 561         return ERROR_OK;
 562 }
 563
 564 int cfi_register_commands(struct command_context_s *cmd_ctx)
 565 {
 566         /*command_t *cfi_cmd = */register_command(cmd_ctx, NULL, "cfi", NULL, COMMAND_ANY, NULL);
 567         /*
 568         register_command(cmd_ctx, cfi_cmd, "part_id", cfi_handle_part_id_command, COMMAND_EXEC,
 569                                          "print part id of cfi flash bank <num>");
 570         */
 571         return ERROR_OK;
 572 }
 573
 574 /* flash_bank cfi <base> <size> <chip_width> <bus_width> <target#> [options]
 575  */
 576 int cfi_flash_bank_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc, struct flash_bank_s *bank)
 577 {
 578         cfi_flash_bank_t *cfi_info;
 579         int i;
 580
 581         if (argc < 6)
 582         {
 583                 WARNING("incomplete flash_bank cfi configuration");
 584                 return ERROR_FLASH_BANK_INVALID;
 585         }
 586
 587         if ((strtoul(args[4], NULL, 0) > CFI_MAX_CHIP_WIDTH)
 588                 || (strtoul(args[3], NULL, 0) > CFI_MAX_BUS_WIDTH))
 589         {
 590                 ERROR("chip and bus width have to specified in byte");
 591                 return ERROR_FLASH_BANK_INVALID;
 592         }
 593
 594         cfi_info = malloc(sizeof(cfi_flash_bank_t));
 595         bank->driver_priv = cfi_info;
 596
 597         cfi_info->x16_as_x8 = 1;
 598
 599         cfi_info->target = get_target_by_num(strtoul(args[5], NULL, 0));
 600         if (!cfi_info->target)
 601         {
 602                 ERROR("no target '%s' configured", args[5]);
 603                 exit(-1);
 604         }
 605
 606         for (i = 6; i < argc; i++)
 607         {
 608                 if (strcmp(args[i], "x16_as_x8") != 0)
 609                 {
 610                         cfi_info->x16_as_x8 = 0;
 611                 }
 612         }
 613
 614         cfi_info->write_algorithm = NULL;
 615
 616         /* bank wasn't probed yet */
 617         cfi_info->qry[0] = -1;
 618
 619         return ERROR_OK;
 620 }
 621
 622 int cfi_intel_erase(struct flash_bank_s *bank, int first, int last)
 623 {
 624         cfi_flash_bank_t *cfi_info = bank->driver_priv;
 625         target_t *target = cfi_info->target;
 626         u8 command[8];
 627         int i;
 628
 629         cfi_intel_clear_status_register(bank);
 630
 631         for (i = first; i <= last; i++)
 632         {
 633                 cfi_command(bank, 0x20, command);
 634                 target->type->write_memory(target, flash_address(bank, i, 0x0), bank->bus_width, 1, command);
 635
 636                 cfi_command(bank, 0xd0, command);
 637                 target->type->write_memory(target, flash_address(bank, i, 0x0), bank->bus_width, 1, command);
 638
 639                 if (cfi_intel_wait_status_busy(bank, 1000 * (1 << cfi_info->block_erase_timeout_typ)) == 0x80)
 640                         bank->sectors[i].is_erased = 1;
 641                 else
 642                 {
 643                         cfi_command(bank, 0xff, command);
 644                         target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
 645
 646                         ERROR("couldn't erase block %i of flash bank at base 0x%x", i, bank->base);
 647                         return ERROR_FLASH_OPERATION_FAILED;
 648                 }
 649         }
 650
 651         cfi_command(bank, 0xff, command);
 652         target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
 653
 654         return ERROR_OK;
 655 }
 656
 657 int cfi_spansion_erase(struct flash_bank_s *bank, int first, int last)
 658 {
 659         cfi_flash_bank_t *cfi_info = bank->driver_priv;
 660         cfi_spansion_pri_ext_t *pri_ext = cfi_info->pri_ext;
 661         target_t *target = cfi_info->target;
 662         u8 command[8];
 663         int i;
 664
 665         for (i = first; i <= last; i++)
 666         {
 667                 cfi_command(bank, 0xaa, command);
 668                 target->type->write_memory(target, flash_address(bank, 0, 0x555), bank->bus_width, 1, command);
 669
 670                 cfi_command(bank, 0x55, command);
 671                 target->type->write_memory(target, flash_address(bank, 0, 0x2aa), bank->bus_width, 1, command);
 672
 673                 cfi_command(bank, 0x80, command);
 674                 target->type->write_memory(target, flash_address(bank, 0, 0x555), bank->bus_width, 1, command);
 675
 676                 cfi_command(bank, 0xaa, command);
 677                 target->type->write_memory(target, flash_address(bank, 0, 0x555), bank->bus_width, 1, command);
 678
 679                 cfi_command(bank, 0x55, command);
 680                 target->type->write_memory(target, flash_address(bank, 0, 0x2aa), bank->bus_width, 1, command);
 681
 682                 cfi_command(bank, 0x30, command);
 683                 target->type->write_memory(target, flash_address(bank, i, 0x0), bank->bus_width, 1, command);
 684
 685                 if (cfi_spansion_wait_status_busy(bank, 1000 * (1 << cfi_info->block_erase_timeout_typ)) == ERROR_OK)
 686                         bank->sectors[i].is_erased = 1;
 687                 else
 688                 {
 689                         cfi_command(bank, 0xf0, command);
 690                         target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
 691
 692                         ERROR("couldn't erase block %i of flash bank at base 0x%x", i, bank->base);
 693                         return ERROR_FLASH_OPERATION_FAILED;
 694                 }
 695         }
 696
 697         cfi_command(bank, 0xf0, command);
 698         target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
 699
 700         return ERROR_OK;
 701 }
 702
 703 int cfi_erase(struct flash_bank_s *bank, int first, int last)
 704 {
 705         cfi_flash_bank_t *cfi_info = bank->driver_priv;
 706
 707         if (cfi_info->target->state != TARGET_HALTED)
 708         {
 709                 return ERROR_TARGET_NOT_HALTED;
 710         }
 711
 712         if ((first < 0) || (last < first) || (last >= bank->num_sectors))
 713         {
 714                 return ERROR_FLASH_SECTOR_INVALID;
 715         }
 716
 717         if (cfi_info->qry[0] != 'Q')
 718                 return ERROR_FLASH_BANK_NOT_PROBED;
 719
 720         switch(cfi_info->pri_id)
 721         {
 722                 case 1:
 723                 case 3:
 724                         return cfi_intel_erase(bank, first, last);
 725                         break;
 726                 case 2:
 727                         return cfi_spansion_erase(bank, first, last);
 728                         break;
 729                 default:
 730                         ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
 731                         break;
 732         }
 733
 734         return ERROR_OK;
 735 }
 736
 737 int cfi_intel_protect(struct flash_bank_s *bank, int set, int first, int last)
 738 {
 739         cfi_flash_bank_t *cfi_info = bank->driver_priv;
 740         cfi_intel_pri_ext_t *pri_ext = cfi_info->pri_ext;
 741         target_t *target = cfi_info->target;
 742         u8 command[8];
 743         int retry = 0;
 744         int i;
 745
 746         /* if the device supports neither legacy lock/unlock (bit 3) nor
 747          * instant individual block locking (bit 5).
 748          */
 749         if (!(pri_ext->feature_support & 0x28))
 750                 return ERROR_FLASH_OPERATION_FAILED;
 751
 752         cfi_intel_clear_status_register(bank);
 753
 754         for (i = first; i <= last; i++)
 755         {
 756                 cfi_command(bank, 0x60, command);
 757                 DEBUG("address: 0x%4.4x, command: 0x%4.4x", flash_address(bank, i, 0x0), target_buffer_get_u32(target, command));
 758                 target->type->write_memory(target, flash_address(bank, i, 0x0), bank->bus_width, 1, command);
 759                 if (set)
 760                 {
 761                         cfi_command(bank, 0x01, command);
 762                         DEBUG("address: 0x%4.4x, command: 0x%4.4x", flash_address(bank, i, 0x0), target_buffer_get_u32(target, command));
 763                         target->type->write_memory(target, flash_address(bank, i, 0x0), bank->bus_width, 1, command);
 764                         bank->sectors[i].is_protected = 1;
 765                 }
 766                 else
 767                 {
 768                         cfi_command(bank, 0xd0, command);
 769                         DEBUG("address: 0x%4.4x, command: 0x%4.4x", flash_address(bank, i, 0x0), target_buffer_get_u32(target, command));
 770                         target->type->write_memory(target, flash_address(bank, i, 0x0), bank->bus_width, 1, command);
 771                         bank->sectors[i].is_protected = 0;
 772                 }
 773
 774                 /* instant individual block locking doesn't require reading of the status register */
 775                 if (!(pri_ext->feature_support & 0x20))
 776                 {
 777                         /* Clear lock bits operation may take up to 1.4s */
 778                         cfi_intel_wait_status_busy(bank, 1400);
 779                 }
 780                 else
 781                 {
 782                         u8 block_status;
 783                         /* read block lock bit, to verify status */
 784                         cfi_command(bank, 0x90, command);
 785                         target->type->write_memory(target, flash_address(bank, 0, 0x55), bank->bus_width, 1, command);
 786                         block_status = cfi_get_u8(bank, i, 0x2);
 787
 788                         if ((block_status & 0x1) != set)
 789                         {
 790                                 ERROR("couldn't change block lock status (set = %i, block_status = 0x%2.2x)", set, block_status);
 791                                 cfi_command(bank, 0x70, command);
 792                                 target->type->write_memory(target, flash_address(bank, 0, 0x55), bank->bus_width, 1, command);
 793                                 cfi_intel_wait_status_busy(bank, 10);
 794
 795                                 if (retry > 10)
 796                                         return ERROR_FLASH_OPERATION_FAILED;
 797                                 else
 798                                 {
 799                                         i--;
 800                                         retry++;
 801                                 }
 802                         }
 803                 }
 804         }
 805
 806         /* if the device doesn't support individual block lock bits set/clear,
 807          * all blocks have been unlocked in parallel, so we set those that should be protected
 808          */
 809         if ((!set) && (!(pri_ext->feature_support & 0x20)))
 810         {
 811                 for (i = 0; i < bank->num_sectors; i++)
 812                 {
 813                         cfi_intel_clear_status_register(bank);
 814                         cfi_command(bank, 0x60, command);
 815                         target->type->write_memory(target, flash_address(bank, i, 0x0), bank->bus_width, 1, command);
 816                         if (bank->sectors[i].is_protected == 1)
 817                         {
 818                                 cfi_command(bank, 0x01, command);
 819                                 target->type->write_memory(target, flash_address(bank, i, 0x0), bank->bus_width, 1, command);
 820                         }
 821
 822                         cfi_intel_wait_status_busy(bank, 100);
 823                 }
 824         }
 825
 826         cfi_command(bank, 0xff, command);
 827         target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
 828
 829         return ERROR_OK;
 830 }
 831
 832 int cfi_protect(struct flash_bank_s *bank, int set, int first, int last)
 833 {
 834         cfi_flash_bank_t *cfi_info = bank->driver_priv;
 835
 836         if (cfi_info->target->state != TARGET_HALTED)
 837         {
 838                 return ERROR_TARGET_NOT_HALTED;
 839         }
 840
 841         if ((first < 0) || (last < first) || (last >= bank->num_sectors))
 842         {
 843                 return ERROR_FLASH_SECTOR_INVALID;
 844         }
 845
 846         if (cfi_info->qry[0] != 'Q')
 847                 return ERROR_FLASH_BANK_NOT_PROBED;
 848
 849         switch(cfi_info->pri_id)
 850         {
 851                 case 1:
 852                 case 3:
 853                         cfi_intel_protect(bank, set, first, last);
 854                         break;
 855                 default:
 856                         ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
 857                         break;
 858         }
 859
 860         return ERROR_OK;
 861 }
 862
 863 void cfi_add_byte(struct flash_bank_s *bank, u8 *word, u8 byte)
 864 {
 865         cfi_flash_bank_t *cfi_info = bank->driver_priv;
 866         target_t *target = cfi_info->target;
 867
 868         int i;
 869
 870         if (target->endianness == TARGET_LITTLE_ENDIAN)
 871         {
 872                 /* shift bytes */
 873                 for (i = 0; i < bank->bus_width - 1; i++)
 874                         word[i] = word[i + 1];
 875                 word[bank->bus_width - 1] = byte;
 876         }
 877         else
 878         {
 879                 /* shift bytes */
 880                 for (i = bank->bus_width - 1; i > 0; i--)
 881                         word[i] = word[i - 1];
 882                 word[0] = byte;
 883         }
 884 }
 885
 886 int cfi_intel_write_block(struct flash_bank_s *bank, u8 *buffer, u32 address, u32 count)
 887 {
 888         cfi_flash_bank_t *cfi_info = bank->driver_priv;
 889         target_t *target = cfi_info->target;
 890         reg_param_t reg_params[7];
 891         armv4_5_algorithm_t armv4_5_info;
 892         working_area_t *source;
 893         u32 buffer_size = 32768;
 894         u8 write_command[CFI_MAX_BUS_WIDTH];
 895         u8 busy_pattern[CFI_MAX_BUS_WIDTH];
 896         u8 error_pattern[CFI_MAX_BUS_WIDTH];
 897         int retval;
 898
 899         /* algorithm register usage:
 900          * r0: source address (in RAM)
 901          * r1: target address (in Flash)
 902          * r2: count
 903          * r3: flash write command
 904          * r4: status byte (returned to host)
 905          * r5: busy test pattern
 906          * r6: error test pattern
 907          */
 908
 909         u32 word_32_code[] = {
 910                 0xe4904004,   /* loop:  ldr r4, [r0], #4 */
 911                 0xe5813000,   /*                str r3, [r1] */
 912                 0xe5814000,   /*                str r4, [r1] */
 913                 0xe5914000,   /* busy:  ldr r4, [r1] */
 914                 0xe0047005,   /*                and r7, r4, r5 */
 915                 0xe1570005,   /*                cmp r7, r5 */
 916                 0x1afffffb,   /*                bne busy */
 917                 0xe1140006,   /*                tst r4, r6 */
 918                 0x1a000003,   /*                bne done */
 919                 0xe2522001,   /*                subs r2, r2, #1 */
 920                 0x0a000001,   /*                beq done */
 921                 0xe2811004,   /*                add r1, r1 #4 */
 922                 0xeafffff2,   /*                b loop */
 923                 0xeafffffe,   /* done:  b -2 */
 924         };
 925
 926         u32 word_16_code[] = {
 927                 0xe0d040b2,   /* loop:  ldrh r4, [r0], #2 */
 928                 0xe1c130b0,   /*                strh r3, [r1] */
 929                 0xe1c140b0,   /*                strh r4, [r1] */
 930                 0xe1d140b0,   /* busy   ldrh r4, [r1] */
 931                 0xe0047005,   /*                and r7, r4, r5 */
 932                 0xe1570005,   /*                cmp r7, r5 */
 933                 0x1afffffb,   /*                bne busy */
 934                 0xe1140006,   /*                tst r4, r6 */
 935                 0x1a000003,   /*                bne done */
 936                 0xe2522001,   /*                subs r2, r2, #1 */
 937                 0x0a000001,   /*                beq done */
 938                 0xe2811002,   /*                add r1, r1 #2 */
 939                 0xeafffff2,   /*                b loop */
 940                 0xeafffffe,   /* done:  b -2 */
 941         };
 942
 943         u32 word_8_code[] = {
 944                 0xe4d04001,   /* loop:  ldrb r4, [r0], #1 */
 945                 0xe5c13000,   /*                strb r3, [r1] */
 946                 0xe5c14000,   /*                strb r4, [r1] */
 947                 0xe5d14000,   /* busy   ldrb r4, [r1] */
 948                 0xe0047005,   /*                and r7, r4, r5 */
 949                 0xe1570005,   /*                cmp r7, r5 */
 950                 0x1afffffb,   /*                bne busy */
 951                 0xe1140006,   /*                tst r4, r6 */
 952                 0x1a000003,   /*                bne done */
 953                 0xe2522001,   /*                subs r2, r2, #1 */
 954                 0x0a000001,   /*                beq done */
 955                 0xe2811001,   /*                add r1, r1 #1 */
 956                 0xeafffff2,   /*                b loop */
 957                 0xeafffffe,   /* done:  b -2 */
 958         };
 959
 960         cfi_intel_clear_status_register(bank);
 961
 962         armv4_5_info.common_magic = ARMV4_5_COMMON_MAGIC;
 963         armv4_5_info.core_mode = ARMV4_5_MODE_SVC;
 964         armv4_5_info.core_state = ARMV4_5_STATE_ARM;
 965
 966         /* flash write code */
 967         if (!cfi_info->write_algorithm)
 968         {
 969                 if (target_alloc_working_area(target, 4 * 14, &cfi_info->write_algorithm) != ERROR_OK)
 970                 {
 971                         WARNING("no working area available, can't do block memory writes");
 972                         return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
 973                 };
 974
 975                 /* write algorithm code to working area */
 976                 if (bank->bus_width == 1)
 977                 {
 978                         target_write_buffer(target, cfi_info->write_algorithm->address, 14 * 4, (u8*)word_8_code);
 979                 }
 980                 else if (bank->bus_width == 2)
 981                 {
 982                         target_write_buffer(target, cfi_info->write_algorithm->address, 14 * 4, (u8*)word_16_code);
 983                 }
 984                 else if (bank->bus_width == 4)
 985                 {
 986                         target_write_buffer(target, cfi_info->write_algorithm->address, 14 * 4, (u8*)word_32_code);
 987                 }
 988                 else
 989                 {
 990                         return ERROR_FLASH_OPERATION_FAILED;
 991                 }
 992         }
 993
 994         while (target_alloc_working_area(target, buffer_size, &source) != ERROR_OK)
 995         {
 996                 buffer_size /= 2;
 997                 if (buffer_size <= 256)
 998                 {
 999                         /* if we already allocated the writing code, but failed to get a buffer, free the algorithm */
1000                         if (cfi_info->write_algorithm)
1001                                 target_free_working_area(target, cfi_info->write_algorithm);
1002
1003                         WARNING("no large enough working area available, can't do block memory writes");
1004                         return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
1005                 }
1006         };
1007
1008         init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT);
1009         init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);
1010         init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);
1011         init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);
1012         init_reg_param(&reg_params[4], "r4", 32, PARAM_IN);
1013         init_reg_param(&reg_params[5], "r5", 32, PARAM_OUT);
1014         init_reg_param(&reg_params[6], "r6", 32, PARAM_OUT);
1015
1016         cfi_command(bank, 0x40, write_command);
1017         cfi_command(bank, 0x80, busy_pattern);
1018         cfi_command(bank, 0x7e, error_pattern);
1019
1020         while (count > 0)
1021         {
1022                 u32 thisrun_count = (count > buffer_size) ? buffer_size : count;
1023
1024                 target_write_buffer(target, source->address, thisrun_count, buffer);
1025
1026                 buf_set_u32(reg_params[0].value, 0, 32, source->address);
1027                 buf_set_u32(reg_params[1].value, 0, 32, address);
1028                 buf_set_u32(reg_params[2].value, 0, 32, thisrun_count / bank->bus_width);
1029                 buf_set_u32(reg_params[3].value, 0, 32, target_buffer_get_u32(target, write_command));
1030                 buf_set_u32(reg_params[5].value, 0, 32, target_buffer_get_u32(target, busy_pattern));
1031                 buf_set_u32(reg_params[6].value, 0, 32, target_buffer_get_u32(target, error_pattern));
1032                 buf_set_u32(reg_params[5].value, 0, 32, buf_get_u32(busy_pattern, 0, 32));
1033                 buf_set_u32(reg_params[6].value, 0, 32, buf_get_u32(error_pattern, 0, 32));
1034
1035                 if ((retval = target->type->run_algorithm(target, 0, NULL, 7, reg_params, cfi_info->write_algorithm->address, cfi_info->write_algorithm->address + (13 * 4), 10000, &armv4_5_info)) != ERROR_OK)
1036                 {
1037                         cfi_intel_clear_status_register(bank);
1038                         return ERROR_FLASH_OPERATION_FAILED;
1039                 }
1040
1041                 if (buf_get_u32(reg_params[4].value, 0, 32) & target_buffer_get_u32(target, error_pattern))
1042                 {
1043                         /* read status register (outputs debug inforation) */
1044                         cfi_intel_wait_status_busy(bank, 100);
1045                         cfi_intel_clear_status_register(bank);
1046                         return ERROR_FLASH_OPERATION_FAILED;
1047                 }
1048
1049                 buffer += thisrun_count;
1050                 address += thisrun_count;
1051                 count -= thisrun_count;
1052         }
1053
1054         target_free_working_area(target, source);
1055
1056         destroy_reg_param(&reg_params[0]);
1057         destroy_reg_param(&reg_params[1]);
1058         destroy_reg_param(&reg_params[2]);
1059         destroy_reg_param(&reg_params[3]);
1060         destroy_reg_param(&reg_params[4]);
1061         destroy_reg_param(&reg_params[5]);
1062         destroy_reg_param(&reg_params[6]);
1063
1064         return ERROR_OK;
1065 }
1066
1067 int cfi_spansion_write_block(struct flash_bank_s *bank, u8 *buffer, u32 address, u32 count)
1068 {
1069         cfi_flash_bank_t *cfi_info = bank->driver_priv;
1070         cfi_spansion_pri_ext_t *pri_ext = cfi_info->pri_ext;
1071         target_t *target = cfi_info->target;
1072         reg_param_t reg_params[10];
1073         armv4_5_algorithm_t armv4_5_info;
1074         working_area_t *source;
1075         u32 buffer_size = 32768;
1076         u8 write_command[CFI_MAX_BUS_WIDTH];
1077         u32 status;
1078         int i;
1079         int retval;
1080         int exit_code = ERROR_OK;
1081         int code_size;
1082         void *code_p;
1083
1084         /* input parameters - */
1085         /*      R0 = source address */
1086         /*      R1 = destination address */
1087         /*      R2 = number of writes */
1088         /*      R3 = flash write command */
1089         /*      R4 = constant to mask DQ7 bits (also used for Dq5 with shift) */
1090         /* output parameters - */
1091         /*      R5 = 0x80 ok 0x00 bad */
1092         /* temp registers - */
1093         /*      R6 = value read from flash to test status */
1094         /*      R7 = holding register */
1095         /* unlock registers - */
1096         /*  R8 = unlock1_addr */
1097         /*  R9 = unlock1_cmd */
1098         /*  R10 = unlock1_addr */
1099         /*  R11 = unlock1_cmd */
1100
1101         u32 word_32_code[] = {
1102                                                 /* 00008100 <sp_32_code>:               */
1103                 0xe4905004,             /* ldr  r5, [r0], #4                    */
1104                 0xe5889000,     /* str  r9, [r8]                                */
1105                 0xe58ab000,     /* str  r11, [r10]                              */
1106                 0xe5883000,     /* str  r3, [r8]                                */
1107                 0xe5815000,     /* str  r5, [r1]                                */
1108                 0xe1a00000,     /* nop                                                  */
1109                                                 /*                                                              */
1110                                                 /* 00008110 <sp_32_busy>:               */
1111                 0xe5916000,     /* ldr  r6, [r1]                                */
1112                 0xe0257006,     /* eor  r7, r5, r6                              */
1113                 0xe0147007,     /* ands r7, r4, r7                              */
1114                 0x0a000007,     /* beq  8140 <sp_32_cont> ; b if DQ7 == Data7 */
1115                 0xe0166124,     /* ands r6, r6, r4, lsr #2              */
1116                 0x0afffff9,     /* beq  8110 <sp_32_busy> ;     b if DQ5 low */
1117                 0xe5916000,     /* ldr  r6, [r1]                                */
1118                 0xe0257006,     /* eor  r7, r5, r6                              */
1119                 0xe0147007,     /* ands r7, r4, r7                              */
1120                 0x0a000001,     /* beq  8140 <sp_32_cont> ; b if DQ7 == Data7 */
1121                 0xe3a05000,     /* mov  r5, #0  ; 0x0 - return 0x00, error */
1122                 0x1a000004,     /* bne  8154 <sp_32_done>               */
1123                                                 /*                                                              */
1124                                 /* 00008140 <sp_32_cont>:                               */
1125                 0xe2522001,     /* subs r2, r2, #1      ; 0x1           */
1126                 0x03a05080,     /* moveq        r5, #128        ; 0x80  */
1127                 0x0a000001,     /* beq  8154 <sp_32_done>               */
1128                 0xe2811004,     /* add  r1, r1, #4      ; 0x4           */
1129                 0xeaffffe8,     /* b    8100 <sp_32_code>               */
1130                                                 /*                                                              */
1131                                                 /* 00008154 <sp_32_done>:               */
1132                 0xeafffffe              /* b    8154 <sp_32_done>               */
1133         };
1134
1135         u32 word_16_code[] = {
1136                                 /* 00008158 <sp_16_code>:              */
1137                 0xe0d050b2,     /* ldrh r5, [r0], #2               */
1138                 0xe1c890b0,     /* strh r9, [r8]                                */
1139                 0xe1cab0b0,     /* strh r11, [r10]                              */
1140                 0xe1c830b0,     /* strh r3, [r8]                                */
1141                 0xe1c150b0,     /* strh r5, [r1]                       */
1142                 0xe1a00000,     /* nop                  (mov r0,r0)    */
1143                                 /*                                     */
1144                                 /* 00008168 <sp_16_busy>:              */
1145                 0xe1d160b0,     /* ldrh r6, [r1]                       */
1146                 0xe0257006,     /* eor  r7, r5, r6                     */
1147                 0xe0147007,     /* ands r7, r4, r7                     */
1148                 0x0a000007,     /* beq  8198 <sp_16_cont>              */
1149                 0xe0166124,     /* ands r6, r6, r4, lsr #2             */
1150                 0x0afffff9,     /* beq  8168 <sp_16_busy>              */
1151                 0xe1d160b0,     /* ldrh r6, [r1]                       */
1152                 0xe0257006,     /* eor  r7, r5, r6                     */
1153                 0xe0147007,     /* ands r7, r4, r7                     */
1154                 0x0a000001,     /* beq  8198 <sp_16_cont>              */
1155                 0xe3a05000,     /* mov  r5, #0  ; 0x0                  */
1156                 0x1a000004,     /* bne  81ac <sp_16_done>              */
1157                                 /*                                     */
1158                                 /* 00008198 <sp_16_cont>:              */
1159                 0xe2522001,     /* subs r2, r2, #1      ; 0x1          */
1160                 0x03a05080,     /* moveq        r5, #128        ; 0x80 */
1161                 0x0a000001,     /* beq  81ac <sp_16_done>              */
1162                 0xe2811002,     /* add  r1, r1, #2      ; 0x2          */
1163                 0xeaffffe8,     /* b    8158 <sp_16_code>              */
1164                                 /*                                     */
1165                                 /* 000081ac <sp_16_done>:              */
1166                 0xeafffffe      /* b    81ac <sp_16_done>              */
1167         };
1168
1169         u32 word_8_code[] = {
1170                                 /* 000081b0 <sp_16_code_end>:          */
1171                 0xe4d05001,     /* ldrb r5, [r0], #1                   */
1172                 0xe5c89000,     /* strb r9, [r8]                                */
1173                 0xe5cab000,     /* strb r11, [r10]                              */
1174                 0xe5c83000,     /* strb r3, [r8]                                */
1175                 0xe5c15000,     /* strb r5, [r1]                       */
1176                 0xe1a00000,     /* nop                  (mov r0,r0)    */
1177                                 /*                                     */
1178                                 /* 000081c0 <sp_8_busy>:               */
1179                 0xe5d16000,     /* ldrb r6, [r1]                       */
1180                 0xe0257006,     /* eor  r7, r5, r6                     */
1181                 0xe0147007,     /* ands r7, r4, r7                     */
1182                 0x0a000007,     /* beq  81f0 <sp_8_cont>               */
1183                 0xe0166124,     /* ands r6, r6, r4, lsr #2             */
1184                 0x0afffff9,     /* beq  81c0 <sp_8_busy>               */
1185                 0xe5d16000,     /* ldrb r6, [r1]                       */
1186                 0xe0257006,     /* eor  r7, r5, r6                     */
1187                 0xe0147007,     /* ands r7, r4, r7                     */
1188                 0x0a000001,     /* beq  81f0 <sp_8_cont>               */
1189                 0xe3a05000,     /* mov  r5, #0  ; 0x0                  */
1190                 0x1a000004,     /* bne  8204 <sp_8_done>               */
1191                                 /*                                     */
1192                                 /* 000081f0 <sp_8_cont>:               */
1193                 0xe2522001,     /* subs r2, r2, #1      ; 0x1          */
1194                 0x03a05080,     /* moveq        r5, #128        ; 0x80 */
1195                 0x0a000001,     /* beq  8204 <sp_8_done>               */
1196                 0xe2811001,     /* add  r1, r1, #1      ; 0x1          */
1197                 0xeaffffe8,     /* b    81b0 <sp_16_code_end>          */
1198                                 /*                                     */
1199                                 /* 00008204 <sp_8_done>:               */
1200                 0xeafffffe      /* b    8204 <sp_8_done>               */
1201         };
1202
1203         armv4_5_info.common_magic = ARMV4_5_COMMON_MAGIC;
1204         armv4_5_info.core_mode = ARMV4_5_MODE_SVC;
1205         armv4_5_info.core_state = ARMV4_5_STATE_ARM;
1206
1207         /* flash write code */
1208         if (!cfi_info->write_algorithm)
1209         {
1210                 /* write algorithm code to working area */
1211                 if (bank->bus_width == 1)
1212                 {
1213                         code_size = sizeof(word_8_code);
1214                         code_p = word_8_code;
1215                 }
1216                 else if (bank->bus_width == 2)
1217                 {
1218                         code_size = sizeof(word_16_code);
1219                         code_p = word_16_code;
1220                 }
1221                 else if (bank->bus_width == 4)
1222                 {
1223                         code_size = sizeof(word_32_code);
1224                         code_p = word_32_code;
1225                 }
1226                 else
1227                 {
1228                         return ERROR_FLASH_OPERATION_FAILED;
1229                 }
1230
1231                 if (target_alloc_working_area(target, code_size,
1232                                                       &cfi_info->write_algorithm) != ERROR_OK)
1233                 {
1234                         WARNING("no working area available, can't do block memory writes");
1235                         return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
1236                 }
1237
1238                 target_write_buffer(target, cfi_info->write_algorithm->address,
1239                                     code_size, code_p);
1240         }
1241
1242         while (target_alloc_working_area(target, buffer_size, &source) != ERROR_OK)
1243         {
1244                 buffer_size /= 2;
1245                 if (buffer_size <= 256)
1246                 {
1247                         /* if we already allocated the writing code, but failed to get a buffer, free the algorithm */
1248                         if (cfi_info->write_algorithm)
1249                                 target_free_working_area(target, cfi_info->write_algorithm);
1250
1251                         WARNING("not enough working area available, can't do block memory writes");
1252                         return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
1253                 }
1254         };
1255
1256         init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT);
1257         init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);
1258         init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);
1259         init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);
1260         init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT);
1261         init_reg_param(&reg_params[5], "r5", 32, PARAM_IN);
1262         init_reg_param(&reg_params[6], "r8", 32, PARAM_OUT);
1263         init_reg_param(&reg_params[7], "r9", 32, PARAM_OUT);
1264         init_reg_param(&reg_params[8], "r10", 32, PARAM_OUT);
1265         init_reg_param(&reg_params[9], "r11", 32, PARAM_OUT);
1266
1267         while (count > 0)
1268         {
1269                 u32 thisrun_count = (count > buffer_size) ? buffer_size : count;
1270
1271                 target_write_buffer(target, source->address, thisrun_count, buffer);
1272
1273                 buf_set_u32(reg_params[0].value, 0, 32, source->address);
1274                 buf_set_u32(reg_params[1].value, 0, 32, address);
1275                 buf_set_u32(reg_params[2].value, 0, 32, thisrun_count / bank->bus_width);
1276                 cfi_command(bank, 0xA0, write_command);
1277                 buf_set_u32(reg_params[3].value, 0, 32, buf_get_u32(write_command, 0, 32));
1278                 cfi_command(bank, 0x80, write_command);
1279                 buf_set_u32(reg_params[4].value, 0, 32, buf_get_u32(write_command, 0, 32));
1280                 buf_set_u32(reg_params[6].value, 0, 32, flash_address(bank, 0, 0x555));
1281                 buf_set_u32(reg_params[7].value, 0, 32, 0xaa);
1282                 buf_set_u32(reg_params[8].value, 0, 32, flash_address(bank, 0, 0xaaa));
1283                 buf_set_u32(reg_params[9].value, 0, 32, 0x55);
1284
1285                 retval = target->type->run_algorithm(target, 0, NULL, 10, reg_params,
1286                                                      cfi_info->write_algorithm->address,
1287                                                      cfi_info->write_algorithm->address + (code_size - 4),
1288                                                      10000, &armv4_5_info);
1289
1290                 status = buf_get_u32(reg_params[5].value, 0, 32);
1291
1292                 if ((retval != ERROR_OK) || status != 0x80)
1293                 {
1294                         DEBUG("status: 0x%x", status);
1295                         exit_code = ERROR_FLASH_OPERATION_FAILED;
1296                         break;
1297                 }
1298
1299                 buffer += thisrun_count;
1300                 address += thisrun_count;
1301                 count -= thisrun_count;
1302         }
1303
1304         destroy_reg_param(&reg_params[0]);
1305         destroy_reg_param(&reg_params[1]);
1306         destroy_reg_param(&reg_params[2]);
1307         destroy_reg_param(&reg_params[3]);
1308         destroy_reg_param(&reg_params[4]);
1309         destroy_reg_param(&reg_params[5]);
1310         destroy_reg_param(&reg_params[6]);
1311         destroy_reg_param(&reg_params[7]);
1312         destroy_reg_param(&reg_params[8]);
1313         destroy_reg_param(&reg_params[9]);
1314
1315         return exit_code;
1316 }
1317
1318 int cfi_intel_write_word(struct flash_bank_s *bank, u8 *word, u32 address)
1319 {
1320         cfi_flash_bank_t *cfi_info = bank->driver_priv;
1321         target_t *target = cfi_info->target;
1322         u8 command[8];
1323
1324         cfi_intel_clear_status_register(bank);
1325         cfi_command(bank, 0x40, command);
1326         target->type->write_memory(target, address, bank->bus_width, 1, command);
1327
1328         target->type->write_memory(target, address, bank->bus_width, 1, word);
1329
1330         if (cfi_intel_wait_status_busy(bank, 1000 * (1 << cfi_info->word_write_timeout_max)) != 0x80)
1331         {
1332                 cfi_command(bank, 0xff, command);
1333                 target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
1334
1335                 ERROR("couldn't write word at base 0x%x, address %x", bank->base, address);
1336                 return ERROR_FLASH_OPERATION_FAILED;
1337         }
1338
1339         return ERROR_OK;
1340 }
1341
1342 int cfi_spansion_write_word(struct flash_bank_s *bank, u8 *word, u32 address)
1343 {
1344         cfi_flash_bank_t *cfi_info = bank->driver_priv;
1345         cfi_spansion_pri_ext_t *pri_ext = cfi_info->pri_ext;
1346         target_t *target = cfi_info->target;
1347         u8 command[8];
1348
1349         cfi_command(bank, 0xaa, command);
1350         target->type->write_memory(target, flash_address(bank, 0, 0x555), bank->bus_width, 1, command);
1351
1352         cfi_command(bank, 0x55, command);
1353         target->type->write_memory(target, flash_address(bank, 0, 0x2aa), bank->bus_width, 1, command);
1354
1355         cfi_command(bank, 0xa0, command);
1356         target->type->write_memory(target, flash_address(bank, 0, 0x555), bank->bus_width, 1, command);
1357
1358         target->type->write_memory(target, address, bank->bus_width, 1, word);
1359
1360         if (cfi_spansion_wait_status_busy(bank, 1000 * (1 << cfi_info->word_write_timeout_max)) != ERROR_OK)
1361         {
1362                 cfi_command(bank, 0xf0, command);
1363                 target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
1364
1365                 ERROR("couldn't write word at base 0x%x, address %x", bank->base, address);
1366                 return ERROR_FLASH_OPERATION_FAILED;
1367         }
1368
1369         return ERROR_OK;
1370 }
1371
1372 int cfi_write_word(struct flash_bank_s *bank, u8 *word, u32 address)
1373 {
1374         cfi_flash_bank_t *cfi_info = bank->driver_priv;
1375
1376         switch(cfi_info->pri_id)
1377         {
1378                 case 1:
1379                 case 3:
1380                         return cfi_intel_write_word(bank, word, address);
1381                         break;
1382                 case 2:
1383                         return cfi_spansion_write_word(bank, word, address);
1384                         break;
1385                 default:
1386                         ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
1387                         break;
1388         }
1389
1390         return ERROR_FLASH_OPERATION_FAILED;
1391 }
1392
1393 int cfi_write(struct flash_bank_s *bank, u8 *buffer, u32 offset, u32 count)
1394 {
1395         cfi_flash_bank_t *cfi_info = bank->driver_priv;
1396         target_t *target = cfi_info->target;
1397         u32 address = bank->base + offset;      /* address of first byte to be programmed */
1398         u32 write_p, copy_p;
1399         int align;      /* number of unaligned bytes */
1400         u8 current_word[CFI_MAX_BUS_WIDTH * 4]; /* word (bus_width size) currently being programmed */
1401         int i;
1402         int retval;
1403
1404         if (cfi_info->target->state != TARGET_HALTED)
1405         {
1406                 return ERROR_TARGET_NOT_HALTED;
1407         }
1408
1409         if (offset + count > bank->size)
1410                 return ERROR_FLASH_DST_OUT_OF_BANK;
1411
1412         if (cfi_info->qry[0] != 'Q')
1413                 return ERROR_FLASH_BANK_NOT_PROBED;
1414
1415         /* start at the first byte of the first word (bus_width size) */
1416         write_p = address & ~(bank->bus_width - 1);
1417         if ((align = address - write_p) != 0)
1418         {
1419                 for (i = 0; i < bank->bus_width; i++)
1420                         current_word[i] = 0;
1421                 copy_p = write_p;
1422
1423                 /* copy bytes before the first write address */
1424                 for (i = 0; i < align; ++i, ++copy_p)
1425                 {
1426                         u8 byte;
1427                         target->type->read_memory(target, copy_p, 1, 1, &byte);
1428                         cfi_add_byte(bank, current_word, byte);
1429                 }
1430
1431                 /* add bytes from the buffer */
1432                 for (; (i < bank->bus_width) && (count > 0); i++)
1433                 {
1434                         cfi_add_byte(bank, current_word, *buffer++);
1435                         count--;
1436                         copy_p++;
1437                 }
1438
1439                 /* if the buffer is already finished, copy bytes after the last write address */
1440                 for (; (count == 0) && (i < bank->bus_width); ++i, ++copy_p)
1441                 {
1442                         u8 byte;
1443                         target->type->read_memory(target, copy_p, 1, 1, &byte);
1444                         cfi_add_byte(bank, current_word, byte);
1445                 }
1446
1447                 retval = cfi_write_word(bank, current_word, write_p);
1448                 if (retval != ERROR_OK)
1449                         return retval;
1450                 write_p = copy_p;
1451         }
1452
1453         /* handle blocks of bus_size aligned bytes */
1454         switch(cfi_info->pri_id)
1455         {
1456                 /* try block writes (fails without working area) */
1457                 case 1:
1458                 case 3:
1459                         retval = cfi_intel_write_block(bank, buffer, write_p, count);
1460                         break;
1461                 case 2:
1462                         retval = cfi_spansion_write_block(bank, buffer, write_p, count);
1463                         break;
1464                 default:
1465                         ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
1466       retval = ERROR_FLASH_OPERATION_FAILED;
1467                         break;
1468         }
1469         if (retval != ERROR_OK)
1470         {
1471                 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE)
1472                 {
1473                         /* fall back to memory writes */
1474                         while (count > bank->bus_width)
1475                         {
1476                                 for (i = 0; i < bank->bus_width; i++)
1477                                         current_word[i] = 0;
1478
1479                                 for (i = 0; i < bank->bus_width; i++)
1480                                 {
1481                                         cfi_add_byte(bank, current_word, *buffer++);
1482                                 }
1483
1484                                 retval = cfi_write_word(bank, current_word, write_p);
1485                                 if (retval != ERROR_OK)
1486                                         return retval;
1487                                 write_p += bank->bus_width;
1488                                 count -= bank->bus_width;
1489                         }
1490                 }
1491                 else
1492                         return retval;
1493         }
1494
1495         /* handle unaligned tail bytes */
1496         if (count > 0)
1497         {
1498                 copy_p = write_p;
1499                 for (i = 0; i < bank->bus_width; i++)
1500                         current_word[i] = 0;
1501
1502                 for (i = 0; (i < bank->bus_width) && (count > 0); ++i, ++copy_p)
1503                 {
1504                         cfi_add_byte(bank, current_word, *buffer++);
1505                         count--;
1506                 }
1507                 for (; i < bank->bus_width; ++i, ++copy_p)
1508                 {
1509                         u8 byte;
1510                         target->type->read_memory(target, copy_p, 1, 1, &byte);
1511                         cfi_add_byte(bank, current_word, byte);
1512                 }
1513                 retval = cfi_write_word(bank, current_word, write_p);
1514                 if (retval != ERROR_OK)
1515                         return retval;
1516         }
1517
1518         /* return to read array mode */
1519         cfi_command(bank, 0xf0, current_word);
1520         target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, current_word);
1521         cfi_command(bank, 0xff, current_word);
1522         target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, current_word);
1523
1524         return ERROR_OK;
1525 }
1526
1527 void cfi_fixup_atmel_reversed_erase_regions(flash_bank_t *bank, void *param)
1528 {
1529         cfi_flash_bank_t *cfi_info = bank->driver_priv;
1530         cfi_spansion_pri_ext_t *pri_ext = cfi_info->pri_ext;
1531
1532         pri_ext->_reversed_geometry = 1;
1533 }
1534
1535 void cfi_fixup_0002_erase_regions(flash_bank_t *bank, void *param)
1536 {
1537         int i;
1538         cfi_flash_bank_t *cfi_info = bank->driver_priv;
1539         cfi_spansion_pri_ext_t *pri_ext = cfi_info->pri_ext;
1540
1541         if ((pri_ext->_reversed_geometry) || (pri_ext->TopBottom == 3))
1542         {
1543                 DEBUG("swapping reversed erase region information on cmdset 0002 device");
1544
1545                 for (i = 0; i < cfi_info->num_erase_regions / 2; i++)
1546                 {
1547                         int j = (cfi_info->num_erase_regions - 1) - i;
1548                         u32 swap;
1549
1550                         swap = cfi_info->erase_region_info[i];
1551                         cfi_info->erase_region_info[i] = cfi_info->erase_region_info[j];
1552                         cfi_info->erase_region_info[j] = swap;
1553                 }
1554         }
1555 }
1556
1557 int cfi_probe(struct flash_bank_s *bank)
1558 {
1559         cfi_flash_bank_t *cfi_info = bank->driver_priv;
1560         target_t *target = cfi_info->target;
1561         u8 command[8];
1562         int num_sectors = 0;
1563         int i;
1564         int sector = 0;
1565         u32 offset = 0;
1566
1567         /* switch to read identifier codes mode ("AUTOSELECT") */
1568         cfi_command(bank, 0xaa, command);
1569         target->type->write_memory(target, flash_address(bank, 0, 0x555), bank->bus_width, 1, command);
1570         cfi_command(bank, 0x55, command);
1571         target->type->write_memory(target, flash_address(bank, 0, 0x2aa), bank->bus_width, 1, command);
1572         cfi_command(bank, 0x90, command);
1573         target->type->write_memory(target, flash_address(bank, 0, 0x555), bank->bus_width, 1, command);
1574
1575         if (bank->chip_width == 1)
1576         {
1577                 u8 manufacturer, device_id;
1578                 target_read_u8(target, bank->base + 0x0, &manufacturer);
1579                 target_read_u8(target, bank->base + 0x1, &device_id);
1580                 cfi_info->manufacturer = manufacturer;
1581                 cfi_info->device_id = device_id;
1582         }
1583         else if (bank->chip_width == 2)
1584         {
1585                 target_read_u16(target, bank->base + 0x0, &cfi_info->manufacturer);
1586                 target_read_u16(target, bank->base + 0x2, &cfi_info->device_id);
1587         }
1588
1589         /* switch back to read array mode */
1590         cfi_command(bank, 0xf0, command);
1591         target->type->write_memory(target, flash_address(bank, 0, 0x00), bank->bus_width, 1, command);
1592         cfi_command(bank, 0xff, command);
1593         target->type->write_memory(target, flash_address(bank, 0, 0x00), bank->bus_width, 1, command);
1594
1595         cfi_fixup(bank, cfi_jedec_fixups);
1596
1597         /* enter CFI query mode
1598          * according to JEDEC Standard No. 68.01,
1599          * a single bus sequence with address = 0x55, data = 0x98 should put
1600          * the device into CFI query mode.
1601          *
1602          * SST flashes clearly violate this, and we will consider them incompatbile for now
1603          */
1604         cfi_command(bank, 0x98, command);
1605         target->type->write_memory(target, flash_address(bank, 0, 0x55), bank->bus_width, 1, command);
1606
1607         cfi_info->qry[0] = cfi_query_u8(bank, 0, 0x10);
1608         cfi_info->qry[1] = cfi_query_u8(bank, 0, 0x11);
1609         cfi_info->qry[2] = cfi_query_u8(bank, 0, 0x12);
1610
1611         DEBUG("CFI qry returned: 0x%2.2x 0x%2.2x 0x%2.2x", cfi_info->qry[0], cfi_info->qry[1], cfi_info->qry[2]);
1612
1613         if ((cfi_info->qry[0] != 'Q') || (cfi_info->qry[1] != 'R') || (cfi_info->qry[2] != 'Y'))
1614         {
1615                 cfi_command(bank, 0xf0, command);
1616                 target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
1617                 cfi_command(bank, 0xff, command);
1618                 target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
1619                 return ERROR_FLASH_BANK_INVALID;
1620         }
1621
1622         cfi_info->pri_id = cfi_query_u16(bank, 0, 0x13);
1623         cfi_info->pri_addr = cfi_query_u16(bank, 0, 0x15);
1624         cfi_info->alt_id = cfi_query_u16(bank, 0, 0x17);
1625         cfi_info->alt_addr = cfi_query_u16(bank, 0, 0x19);
1626
1627         DEBUG("qry: '%c%c%c', pri_id: 0x%4.4x, pri_addr: 0x%4.4x, alt_id: 0x%4.4x, alt_addr: 0x%4.4x", cfi_info->qry[0], cfi_info->qry[1], cfi_info->qry[2], cfi_info->pri_id, cfi_info->pri_addr, cfi_info->alt_id, cfi_info->alt_addr);
1628
1629         cfi_info->vcc_min = cfi_query_u8(bank, 0, 0x1b);
1630         cfi_info->vcc_max = cfi_query_u8(bank, 0, 0x1c);
1631         cfi_info->vpp_min = cfi_query_u8(bank, 0, 0x1d);
1632         cfi_info->vpp_max = cfi_query_u8(bank, 0, 0x1e);
1633         cfi_info->word_write_timeout_typ = cfi_query_u8(bank, 0, 0x1f);
1634         cfi_info->buf_write_timeout_typ = cfi_query_u8(bank, 0, 0x20);
1635         cfi_info->block_erase_timeout_typ = cfi_query_u8(bank, 0, 0x21);
1636         cfi_info->chip_erase_timeout_typ = cfi_query_u8(bank, 0, 0x22);
1637         cfi_info->word_write_timeout_max = cfi_query_u8(bank, 0, 0x23);
1638         cfi_info->buf_write_timeout_max = cfi_query_u8(bank, 0, 0x24);
1639         cfi_info->block_erase_timeout_max = cfi_query_u8(bank, 0, 0x25);
1640         cfi_info->chip_erase_timeout_max = cfi_query_u8(bank, 0, 0x26);
1641
1642         DEBUG("Vcc min: %1.1x.%1.1x, Vcc max: %1.1x.%1.1x, Vpp min: %1.1x.%1.1x, Vpp max: %1.1x.%1.1x",
1643                 (cfi_info->vcc_min & 0xf0) >> 4, cfi_info->vcc_min & 0x0f,
1644                 (cfi_info->vcc_max & 0xf0) >> 4, cfi_info->vcc_max & 0x0f,
1645                 (cfi_info->vpp_min & 0xf0) >> 4, cfi_info->vpp_min & 0x0f,
1646                 (cfi_info->vpp_max & 0xf0) >> 4, cfi_info->vpp_max & 0x0f);
1647         DEBUG("typ. word write timeout: %u, typ. buf write timeout: %u, typ. block erase timeout: %u, typ. chip erase timeout: %u", 1 << cfi_info->word_write_timeout_typ, 1 << cfi_info->buf_write_timeout_typ,
1648                 1 << cfi_info->block_erase_timeout_typ, 1 << cfi_info->chip_erase_timeout_typ);
1649         DEBUG("max. word write timeout: %u, max. buf write timeout: %u, max. block erase timeout: %u, max. chip erase timeout: %u", (1 << cfi_info->word_write_timeout_max) * (1 << cfi_info->word_write_timeout_typ),
1650                 (1 << cfi_info->buf_write_timeout_max) * (1 << cfi_info->buf_write_timeout_typ),
1651                 (1 << cfi_info->block_erase_timeout_max) * (1 << cfi_info->block_erase_timeout_typ),
1652                 (1 << cfi_info->chip_erase_timeout_max) * (1 << cfi_info->chip_erase_timeout_typ));
1653
1654         cfi_info->dev_size = cfi_query_u8(bank, 0, 0x27);
1655         cfi_info->interface_desc = cfi_query_u16(bank, 0, 0x28);
1656         cfi_info->max_buf_write_size = cfi_query_u16(bank, 0, 0x2a);
1657         cfi_info->num_erase_regions = cfi_query_u8(bank, 0, 0x2c);
1658
1659         DEBUG("size: 0x%x, interface desc: %i, max buffer write size: %x", 1 << cfi_info->dev_size, cfi_info->interface_desc, (1 << cfi_info->max_buf_write_size));
1660
1661         if (((1 << cfi_info->dev_size) * bank->bus_width / bank->chip_width) != bank->size)
1662         {
1663                 WARNING("configuration specifies 0x%x size, but a 0x%x size flash was found", bank->size, 1 << cfi_info->dev_size);
1664         }
1665
1666         if (cfi_info->num_erase_regions)
1667         {
1668                 cfi_info->erase_region_info = malloc(4 * cfi_info->num_erase_regions);
1669                 for (i = 0; i < cfi_info->num_erase_regions; i++)
1670                 {
1671                         cfi_info->erase_region_info[i] = cfi_query_u32(bank, 0, 0x2d + (4 * i));
1672                         DEBUG("erase region[%i]: %i blocks of size 0x%x", i, (cfi_info->erase_region_info[i] & 0xffff) + 1, (cfi_info->erase_region_info[i] >> 16) * 256);
1673
1674                         num_sectors += (cfi_info->erase_region_info[i] & 0xffff) + 1;
1675                 }
1676         }
1677         else
1678         {
1679                 cfi_info->erase_region_info = NULL;
1680         }
1681
1682         /* We need to read the primary algorithm extended query table before calculating
1683          * the sector layout to be able to apply fixups
1684          */
1685         switch(cfi_info->pri_id)
1686         {
1687                 /* Intel command set (standard and extended) */
1688                 case 0x0001:
1689                 case 0x0003:
1690                         cfi_read_intel_pri_ext(bank);
1691                         cfi_fixup(bank, cfi_0001_fixups);
1692                         break;
1693                 /* AMD/Spansion, Atmel, ... command set */
1694         case 0x0002:
1695                         cfi_read_0002_pri_ext(bank);
1696                         cfi_fixup(bank, cfi_0002_fixups);
1697                         break;
1698                 default:
1699                         ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
1700                         break;
1701         }
1702
1703         if (cfi_info->num_erase_regions == 0)
1704         {
1705                 /* a device might have only one erase block, spanning the whole device */
1706                 bank->num_sectors = 1;
1707                 bank->sectors = malloc(sizeof(flash_sector_t));
1708
1709                 bank->sectors[sector].offset = 0x0;
1710                 bank->sectors[sector].size = bank->size;
1711                 bank->sectors[sector].is_erased = -1;
1712                 bank->sectors[sector].is_protected = -1;
1713         }
1714         else
1715         {
1716                 bank->num_sectors = num_sectors;
1717                 bank->sectors = malloc(sizeof(flash_sector_t) * num_sectors);
1718
1719                 for (i = 0; i < cfi_info->num_erase_regions; i++)
1720                 {
1721                         int j;
1722                         for (j = 0; j < (cfi_info->erase_region_info[i] & 0xffff) + 1; j++)
1723                         {
1724                                 bank->sectors[sector].offset = offset;
1725                                 bank->sectors[sector].size = ((cfi_info->erase_region_info[i] >> 16) * 256) * bank->bus_width / bank->chip_width;
1726                                 offset += bank->sectors[sector].size;
1727                                 bank->sectors[sector].is_erased = -1;
1728                                 bank->sectors[sector].is_protected = -1;
1729                                 sector++;
1730                         }
1731                 }
1732         }
1733
1734         /* return to read array mode
1735          * we use both reset commands, as some Intel flashes fail to recognize the 0xF0 command
1736          */
1737         cfi_command(bank, 0xf0, command);
1738         target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
1739         cfi_command(bank, 0xff, command);
1740         target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
1741
1742         return ERROR_OK;
1743 }
1744
1745 int cfi_erase_check(struct flash_bank_s *bank)
1746 {
1747         cfi_flash_bank_t *cfi_info = bank->driver_priv;
1748         target_t *target = cfi_info->target;
1749         int i;
1750         int retval;
1751
1752         if (!cfi_info->erase_check_algorithm)
1753         {
1754                 u32 erase_check_code[] =
1755                 {
1756                         0xe4d03001,     /* ldrb r3, [r0], #1    */
1757                         0xe0022003, /* and r2, r2, r3           */
1758                         0xe2511001, /* subs r1, r1, #1          */
1759                         0x1afffffb,     /* b -4                                 */
1760                         0xeafffffe      /* b 0                                  */
1761                 };
1762
1763                 /* make sure we have a working area */
1764                 if (target_alloc_working_area(target, 20, &cfi_info->erase_check_algorithm) != ERROR_OK)
1765                 {
1766                         WARNING("no working area available, falling back to slow memory reads");
1767                 }
1768                 else
1769                 {
1770                         u8 erase_check_code_buf[5 * 4];
1771
1772                         for (i = 0; i < 5; i++)
1773                                 target_buffer_set_u32(target, erase_check_code_buf + (i*4), erase_check_code[i]);
1774
1775                         /* write algorithm code to working area */
1776                         target->type->write_memory(target, cfi_info->erase_check_algorithm->address, 4, 5, erase_check_code_buf);
1777                 }
1778         }
1779
1780         if (!cfi_info->erase_check_algorithm)
1781         {
1782                 u32 *buffer = malloc(4096);
1783
1784                 for (i = 0; i < bank->num_sectors; i++)
1785                 {
1786                         u32 address = bank->base + bank->sectors[i].offset;
1787                         u32 size = bank->sectors[i].size;
1788                         u32 check = 0xffffffffU;
1789                         int erased = 1;
1790
1791                         while (size > 0)
1792                         {
1793                                 u32 thisrun_size = (size > 4096) ? 4096 : size;
1794                                 int j;
1795
1796                                 target->type->read_memory(target, address, 4, thisrun_size / 4, (u8*)buffer);
1797
1798                                 for (j = 0; j < thisrun_size / 4; j++)
1799                                         check &= buffer[j];
1800
1801                                 if (check != 0xffffffff)
1802                                 {
1803                                         erased = 0;
1804                                         break;
1805                                 }
1806
1807                                 size -= thisrun_size;
1808                                 address += thisrun_size;
1809                         }
1810
1811                         bank->sectors[i].is_erased = erased;
1812                 }
1813
1814                 free(buffer);
1815         }
1816         else
1817         {
1818                 for (i = 0; i < bank->num_sectors; i++)
1819                 {
1820                         u32 address = bank->base + bank->sectors[i].offset;
1821                         u32 size = bank->sectors[i].size;
1822
1823                         reg_param_t reg_params[3];
1824                         armv4_5_algorithm_t armv4_5_info;
1825
1826                         armv4_5_info.common_magic = ARMV4_5_COMMON_MAGIC;
1827                         armv4_5_info.core_mode = ARMV4_5_MODE_SVC;
1828                         armv4_5_info.core_state = ARMV4_5_STATE_ARM;
1829
1830                         init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT);
1831                         buf_set_u32(reg_params[0].value, 0, 32, address);
1832
1833                         init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);
1834                         buf_set_u32(reg_params[1].value, 0, 32, size);
1835
1836                         init_reg_param(&reg_params[2], "r2", 32, PARAM_IN_OUT);
1837                         buf_set_u32(reg_params[2].value, 0, 32, 0xff);
1838
1839                         if ((retval = target->type->run_algorithm(target, 0, NULL, 3, reg_params, cfi_info->erase_check_algorithm->address, cfi_info->erase_check_algorithm->address + 0x10, 10000, &armv4_5_info)) != ERROR_OK)
1840                                 return ERROR_FLASH_OPERATION_FAILED;
1841
1842                         if (buf_get_u32(reg_params[2].value, 0, 32) == 0xff)
1843                                 bank->sectors[i].is_erased = 1;
1844                         else
1845                                 bank->sectors[i].is_erased = 0;
1846
1847                         destroy_reg_param(&reg_params[0]);
1848                         destroy_reg_param(&reg_params[1]);
1849                         destroy_reg_param(&reg_params[2]);
1850                 }
1851         }
1852
1853         return ERROR_OK;
1854 }
1855
1856 int cfi_intel_protect_check(struct flash_bank_s *bank)
1857 {
1858         cfi_flash_bank_t *cfi_info = bank->driver_priv;
1859         cfi_intel_pri_ext_t *pri_ext = cfi_info->pri_ext;
1860         target_t *target = cfi_info->target;
1861         u8 command[CFI_MAX_BUS_WIDTH];
1862         int i;
1863
1864         /* check if block lock bits are supported on this device */
1865         if (!(pri_ext->blk_status_reg_mask & 0x1))
1866                 return ERROR_FLASH_OPERATION_FAILED;
1867
1868         cfi_command(bank, 0x90, command);
1869         target->type->write_memory(target, flash_address(bank, 0, 0x55), bank->bus_width, 1, command);
1870
1871         for (i = 0; i < bank->num_sectors; i++)
1872         {
1873                 u8 block_status = cfi_get_u8(bank, i, 0x2);
1874
1875                 if (block_status & 1)
1876                         bank->sectors[i].is_protected = 1;
1877                 else
1878                         bank->sectors[i].is_protected = 0;
1879         }
1880
1881         cfi_command(bank, 0xff, command);
1882         target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
1883
1884         return ERROR_OK;
1885 }
1886
1887 int cfi_spansion_protect_check(struct flash_bank_s *bank)
1888 {
1889         cfi_flash_bank_t *cfi_info = bank->driver_priv;
1890         cfi_spansion_pri_ext_t *pri_ext = cfi_info->pri_ext;
1891         target_t *target = cfi_info->target;
1892         u8 command[8];
1893         int i;
1894
1895         cfi_command(bank, 0xaa, command);
1896         target->type->write_memory(target, flash_address(bank, 0, 0x555), bank->bus_width, 1, command);
1897
1898         cfi_command(bank, 0x55, command);
1899         target->type->write_memory(target, flash_address(bank, 0, 0x2aa), bank->bus_width, 1, command);
1900
1901         cfi_command(bank, 0x90, command);
1902         target->type->write_memory(target, flash_address(bank, 0, 0x555), bank->bus_width, 1, command);
1903
1904         for (i = 0; i < bank->num_sectors; i++)
1905         {
1906                 u8 block_status = cfi_get_u8(bank, i, 0x2);
1907
1908                 if (block_status & 1)
1909                         bank->sectors[i].is_protected = 1;
1910                 else
1911                         bank->sectors[i].is_protected = 0;
1912         }
1913
1914         cfi_command(bank, 0xf0, command);
1915         target->type->write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
1916
1917         return ERROR_OK;
1918 }
1919
1920 int cfi_protect_check(struct flash_bank_s *bank)
1921 {
1922         cfi_flash_bank_t *cfi_info = bank->driver_priv;
1923
1924         if (cfi_info->qry[0] != 'Q')
1925                 return ERROR_FLASH_BANK_NOT_PROBED;
1926
1927         switch(cfi_info->pri_id)
1928         {
1929                 case 1:
1930                 case 3:
1931                         return cfi_intel_protect_check(bank);
1932                         break;
1933                 case 2:
1934                         return cfi_spansion_protect_check(bank);
1935                         break;
1936                 default:
1937                         ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
1938                         break;
1939         }
1940
1941         return ERROR_OK;
1942 }
1943
1944 int cfi_info(struct flash_bank_s *bank, char *buf, int buf_size)
1945 {
1946         int printed;
1947         cfi_flash_bank_t *cfi_info = bank->driver_priv;
1948
1949         if (cfi_info->qry[0] == -1)
1950         {
1951                 printed = snprintf(buf, buf_size, "\ncfi flash bank not probed yet\n");
1952                 return ERROR_OK;
1953         }
1954
1955         printed = snprintf(buf, buf_size, "\ncfi information:\n");
1956         buf += printed;
1957         buf_size -= printed;
1958
1959         printed = snprintf(buf, buf_size, "\nmfr: 0x%4.4x, id:0x%4.4x\n",
1960                 cfi_info->manufacturer, cfi_info->device_id);
1961         buf += printed;
1962         buf_size -= printed;
1963
1964         printed = snprintf(buf, buf_size, "qry: '%c%c%c', pri_id: 0x%4.4x, pri_addr: 0x%4.4x, alt_id: 0x%4.4x, alt_addr: 0x%4.4x\n", cfi_info->qry[0], cfi_info->qry[1], cfi_info->qry[2], cfi_info->pri_id, cfi_info->pri_addr, cfi_info->alt_id, cfi_info->alt_addr);
1965         buf += printed;
1966         buf_size -= printed;
1967
1968         printed = snprintf(buf, buf_size, "Vcc min: %1.1x.%1.1x, Vcc max: %1.1x.%1.1x, Vpp min: %1.1x.%1.1x, Vpp max: %1.1x.%1.1x\n", (cfi_info->vcc_min & 0xf0) >> 4, cfi_info->vcc_min & 0x0f,
1969         (cfi_info->vcc_max & 0xf0) >> 4, cfi_info->vcc_max & 0x0f,
1970         (cfi_info->vpp_min & 0xf0) >> 4, cfi_info->vpp_min & 0x0f,
1971         (cfi_info->vpp_max & 0xf0) >> 4, cfi_info->vpp_max & 0x0f);
1972         buf += printed;
1973         buf_size -= printed;
1974
1975         printed = snprintf(buf, buf_size, "typ. word write timeout: %u, typ. buf write timeout: %u, typ. block erase timeout: %u, typ. chip erase timeout: %u\n", 1 << cfi_info->word_write_timeout_typ, 1 << cfi_info->buf_write_timeout_typ,
1976                   1 << cfi_info->block_erase_timeout_typ, 1 << cfi_info->chip_erase_timeout_typ);
1977         buf += printed;
1978         buf_size -= printed;
1979
1980         printed = snprintf(buf, buf_size, "max. word write timeout: %u, max. buf write timeout: %u, max. block erase timeout: %u, max. chip erase timeout: %u\n", (1 << cfi_info->word_write_timeout_max) * (1 << cfi_info->word_write_timeout_typ),
1981                   (1 << cfi_info->buf_write_timeout_max) * (1 << cfi_info->buf_write_timeout_typ),
1982                   (1 << cfi_info->block_erase_timeout_max) * (1 << cfi_info->block_erase_timeout_typ),
1983                   (1 << cfi_info->chip_erase_timeout_max) * (1 << cfi_info->chip_erase_timeout_typ));
1984         buf += printed;
1985         buf_size -= printed;
1986
1987         printed = snprintf(buf, buf_size, "size: 0x%x, interface desc: %i, max buffer write size: %x\n", 1 << cfi_info->dev_size, cfi_info->interface_desc, cfi_info->max_buf_write_size);
1988         buf += printed;
1989         buf_size -= printed;
1990
1991         switch(cfi_info->pri_id)
1992         {
1993                 case 1:
1994                 case 3:
1995                         cfi_intel_info(bank, buf, buf_size);
1996                         break;
1997                 case 2:
1998                         cfi_spansion_info(bank, buf, buf_size);
1999                         break;
2000                 default:
2001                         ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
2002                         break;
2003         }
2004
2005         return ERROR_OK;
2006 }