git.gag.com Git - fw/openocd/blob - src/flash/lpc2900.c

   1 /***************************************************************************\r
   2  *   Copyright (C) 2009 by                                                 *\r
   3  *   Rolf Meeser <rolfm_9dq@yahoo.de>                                      *\r
   4  *                                                                         *\r
   5  *   This program is free software; you can redistribute it and/or modify  *\r
   6  *   it under the terms of the GNU General Public License as published by  *\r
   7  *   the Free Software Foundation; either version 2 of the License, or     *\r
   8  *   (at your option) any later version.                                   *\r
   9  *                                                                         *\r
  10  *   This program is distributed in the hope that it will be useful,       *\r
  11  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *\r
  12  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *\r
  13  *   GNU General Public License for more details.                          *\r
  14  *                                                                         *\r
  15  *   You should have received a copy of the GNU General Public License     *\r
  16  *   along with this program; if not, write to the                         *\r
  17  *   Free Software Foundation, Inc.,                                       *\r
  18  *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *\r
  19  ***************************************************************************/\r
  20 \r
  21 #ifdef HAVE_CONFIG_H\r
  22 #include "config.h"\r
  23 #endif\r
  24 \r
  25 \r
  26 #include "image.h"\r
  27 \r
  28 #include "lpc2900.h"\r
  29 #include "binarybuffer.h"\r
  30 #include "armv4_5.h"\r
  31 \r
  32 \r
  33 /* 1024 bytes */\r
  34 #define KiB                 1024\r
  35 \r
  36 /* Some flash constants */\r
  37 #define FLASH_PAGE_SIZE     512     /* bytes */\r
  38 #define FLASH_ERASE_TIME    100000  /* microseconds */\r
  39 #define FLASH_PROGRAM_TIME  1000    /* microseconds */\r
  40 \r
  41 /* Chip ID / Feature Registers */\r
  42 #define CHIPID          0xE0000000  /* Chip ID */\r
  43 #define FEAT0           0xE0000100  /* Chip feature 0 */\r
  44 #define FEAT1           0xE0000104  /* Chip feature 1 */\r
  45 #define FEAT2           0xE0000108  /* Chip feature 2 (contains flash size indicator) */\r
  46 #define FEAT3           0xE000010C  /* Chip feature 3 */\r
  47 \r
  48 #define EXPECTED_CHIPID 0x209CE02B  /* Chip ID of all LPC2900 devices */\r
  49 \r
  50 /* Flash/EEPROM Control Registers */\r
  51 #define FCTR            0x20200000  /* Flash control */\r
  52 #define FPTR            0x20200008  /* Flash program-time */\r
  53 #define FTCTR           0x2020000C  /* Flash test control */\r
  54 #define FBWST           0x20200010  /* Flash bridge wait-state */\r
  55 #define FCRA            0x2020001C  /* Flash clock divider */\r
  56 #define FMSSTART        0x20200020  /* Flash Built-In Selft Test start address */\r
  57 #define FMSSTOP         0x20200024  /* Flash Built-In Selft Test stop address */\r
  58 #define FMS16           0x20200028  /* Flash 16-bit signature */\r
  59 #define FMSW0           0x2020002C  /* Flash 128-bit signature Word 0 */\r
  60 #define FMSW1           0x20200030  /* Flash 128-bit signature Word 1 */\r
  61 #define FMSW2           0x20200034  /* Flash 128-bit signature Word 2 */\r
  62 #define FMSW3           0x20200038  /* Flash 128-bit signature Word 3 */\r
  63 \r
  64 #define EECMD           0x20200080  /* EEPROM command */\r
  65 #define EEADDR          0x20200084  /* EEPROM address */\r
  66 #define EEWDATA         0x20200088  /* EEPROM write data */\r
  67 #define EERDATA         0x2020008C  /* EEPROM read data */\r
  68 #define EEWSTATE        0x20200090  /* EEPROM wait state */\r
  69 #define EECLKDIV        0x20200094  /* EEPROM clock divider */\r
  70 #define EEPWRDWN        0x20200098  /* EEPROM power-down/start */\r
  71 #define EEMSSTART       0x2020009C  /* EEPROM BIST start address */\r
  72 #define EEMSSTOP        0x202000A0  /* EEPROM BIST stop address */\r
  73 #define EEMSSIG         0x202000A4  /* EEPROM 24-bit BIST signature */\r
  74 \r
  75 #define INT_CLR_ENABLE  0x20200FD8  /* Flash/EEPROM interrupt clear enable */\r
  76 #define INT_SET_ENABLE  0x20200FDC  /* Flash/EEPROM interrupt set enable */\r
  77 #define INT_STATUS      0x20200FE0  /* Flash/EEPROM interrupt status */\r
  78 #define INT_ENABLE      0x20200FE4  /* Flash/EEPROM interrupt enable */\r
  79 #define INT_CLR_STATUS  0x20200FE8  /* Flash/EEPROM interrupt clear status */\r
  80 #define INT_SET_STATUS  0x20200FEC  /* Flash/EEPROM interrupt set status */\r
  81 \r
  82 /* Interrupt sources */\r
  83 #define INTSRC_END_OF_PROG    (1 << 28)\r
  84 #define INTSRC_END_OF_BIST    (1 << 27)\r
  85 #define INTSRC_END_OF_RDWR    (1 << 26)\r
  86 #define INTSRC_END_OF_MISR    (1 << 2)\r
  87 #define INTSRC_END_OF_BURN    (1 << 1)\r
  88 #define INTSRC_END_OF_ERASE   (1 << 0)\r
  89 \r
  90 \r
  91 /* FCTR bits */\r
  92 #define FCTR_FS_LOADREQ       (1 << 15)\r
  93 #define FCTR_FS_CACHECLR      (1 << 14)\r
  94 #define FCTR_FS_CACHEBYP      (1 << 13)\r
  95 #define FCTR_FS_PROGREQ       (1 << 12)\r
  96 #define FCTR_FS_RLS           (1 << 11)\r
  97 #define FCTR_FS_PDL           (1 << 10)\r
  98 #define FCTR_FS_PD            (1 << 9)\r
  99 #define FCTR_FS_WPB           (1 << 7)\r
 100 #define FCTR_FS_ISS           (1 << 6)\r
 101 #define FCTR_FS_RLD           (1 << 5)\r
 102 #define FCTR_FS_DCR           (1 << 4)\r
 103 #define FCTR_FS_WEB           (1 << 2)\r
 104 #define FCTR_FS_WRE           (1 << 1)\r
 105 #define FCTR_FS_CS            (1 << 0)\r
 106 /* FPTR bits */\r
 107 #define FPTR_EN_T             (1 << 15)\r
 108 /* FTCTR bits */\r
 109 #define FTCTR_FS_BYPASS_R     (1 << 29)\r
 110 #define FTCTR_FS_BYPASS_W     (1 << 28)\r
 111 /* FMSSTOP bits */\r
 112 #define FMSSTOP_MISR_START    (1 << 17)\r
 113 /* EEMSSTOP bits */\r
 114 #define EEMSSTOP_STRTBIST     (1 << 31)\r
 115 \r
 116 /* Index sector */\r
 117 #define ISS_CUSTOMER_START1   (0x830)\r
 118 #define ISS_CUSTOMER_END1     (0xA00)\r
 119 #define ISS_CUSTOMER_SIZE1    (ISS_CUSTOMER_END1 - ISS_CUSTOMER_START1)\r
 120 #define ISS_CUSTOMER_NWORDS1  (ISS_CUSTOMER_SIZE1 / 4)\r
 121 #define ISS_CUSTOMER_START2   (0xA40)\r
 122 #define ISS_CUSTOMER_END2     (0xC00)\r
 123 #define ISS_CUSTOMER_SIZE2    (ISS_CUSTOMER_END2 - ISS_CUSTOMER_START2)\r
 124 #define ISS_CUSTOMER_NWORDS2  (ISS_CUSTOMER_SIZE2 / 4)\r
 125 #define ISS_CUSTOMER_SIZE     (ISS_CUSTOMER_SIZE1 + ISS_CUSTOMER_SIZE2)\r
 126 \r
 127 \r
 128 \r
 129 /**\r
 130  * Private data for \c lpc2900 flash driver.\r
 131  */\r
 132 typedef struct lpc2900_flash_bank_s\r
 133 {\r
 134         /**\r
 135          * Holds the value read from CHIPID register.\r
 136          * The driver will not load if the chipid doesn't match the expected\r
 137          * value of 0x209CE02B of the LPC2900 family. A probe will only be done\r
 138          * if the chipid does not yet contain the expected value.\r
 139          */\r
 140         uint32_t chipid;\r
 141 \r
 142         /**\r
 143          * String holding device name.\r
 144          * This string is set by the probe function to the type number of the\r
 145          * device. It takes the form "LPC29xx".\r
 146          */\r
 147         char * target_name;\r
 148 \r
 149         /**\r
 150          * System clock frequency.\r
 151          * Holds the clock frequency in Hz, as passed by the configuration file\r
 152          * to the <tt>flash bank</tt> command.\r
 153          */\r
 154         uint32_t clk_sys_fmc;\r
 155 \r
 156         /**\r
 157          * Flag to indicate that dangerous operations are possible.\r
 158          * This flag can be set by passing the correct password to the\r
 159          * <tt>lpc2900 password</tt> command. If set, other dangerous commands,\r
 160          * which operate on the index sector, can be executed.\r
 161          */\r
 162         uint32_t risky;\r
 163 \r
 164         /**\r
 165          * Maximum contiguous block of internal SRAM (bytes).\r
 166          * Autodetected by the driver. Not the total amount of SRAM, only the\r
 167          * the largest \em contiguous block!\r
 168          */\r
 169         uint32_t max_ram_block;\r
 170 \r
 171 } lpc2900_flash_bank_t;\r
 172 \r
 173 \r
 174 \r
 175 \r
 176 static int lpc2900_register_commands(struct command_context_s *cmd_ctx);\r
 177 static int lpc2900_flash_bank_command(struct command_context_s *cmd_ctx,\r
 178                                       char *cmd, char **args, int argc,\r
 179                                       struct flash_bank_s *bank);\r
 180 static int lpc2900_erase(struct flash_bank_s *bank, int first, int last);\r
 181 static int lpc2900_protect(struct flash_bank_s *bank, int set, int first, int last);\r
 182 static int lpc2900_write(struct flash_bank_s *bank,\r
 183                          uint8_t *buffer, uint32_t offset, uint32_t count);\r
 184 static int lpc2900_probe(struct flash_bank_s *bank);\r
 185 static int lpc2900_erase_check(struct flash_bank_s *bank);\r
 186 static int lpc2900_protect_check(struct flash_bank_s *bank);\r
 187 static int lpc2900_info(struct flash_bank_s *bank, char *buf, int buf_size);\r
 188 \r
 189 static uint32_t lpc2900_wait_status(flash_bank_t *bank, uint32_t mask, int timeout);\r
 190 static void lpc2900_setup(struct flash_bank_s *bank);\r
 191 static uint32_t lpc2900_is_ready(struct flash_bank_s *bank);\r
 192 static uint32_t lpc2900_read_security_status(struct flash_bank_s *bank);\r
 193 static uint32_t lpc2900_run_bist128(struct flash_bank_s *bank,\r
 194                                     uint32_t addr_from, uint32_t addr_to,\r
 195                                     uint32_t (*signature)[4] );\r
 196 static uint32_t lpc2900_address2sector(struct flash_bank_s *bank, uint32_t offset);\r
 197 static uint32_t lpc2900_calc_tr( uint32_t clock, uint32_t time );\r
 198 \r
 199 \r
 200 /***********************  Helper functions  **************************/\r
 201 \r
 202 \r
 203 /**\r
 204  * Wait for an event in mask to occur in INT_STATUS.\r
 205  *\r
 206  * Return when an event occurs, or after a timeout.\r
 207  *\r
 208  * @param[in] bank Pointer to the flash bank descriptor\r
 209  * @param[in] mask Mask to be used for INT_STATUS\r
 210  * @param[in] timeout Timeout in ms\r
 211  */\r
 212 static uint32_t lpc2900_wait_status( flash_bank_t *bank,\r
 213                                      uint32_t mask,\r
 214                                      int timeout )\r
 215 {\r
 216         uint32_t int_status;\r
 217         target_t *target = bank->target;\r
 218 \r
 219 \r
 220         do\r
 221         {\r
 222                 alive_sleep(1);\r
 223                 timeout--;\r
 224                 target_read_u32(target, INT_STATUS, &int_status);\r
 225         }\r
 226         while( ((int_status & mask) == 0) && (timeout != 0) );\r
 227 \r
 228         if (timeout == 0)\r
 229         {\r
 230                 LOG_DEBUG("Timeout!");\r
 231                 return ERROR_FLASH_OPERATION_FAILED;\r
 232         }\r
 233 \r
 234         return ERROR_OK;\r
 235 }\r
 236 \r
 237 \r
 238 \r
 239 /**\r
 240  * Set up the flash for erase/program operations.\r
 241  *\r
 242  * Enable the flash, and set the correct CRA clock of 66 kHz.\r
 243  *\r
 244  * @param bank Pointer to the flash bank descriptor\r
 245  */\r
 246 static void lpc2900_setup( struct flash_bank_s *bank )\r
 247 {\r
 248         uint32_t fcra;\r
 249         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;\r
 250 \r
 251 \r
 252         /* Power up the flash block */\r
 253         target_write_u32( bank->target, FCTR, FCTR_FS_WEB | FCTR_FS_CS );\r
 254 \r
 255 \r
 256         fcra = (lpc2900_info->clk_sys_fmc / (3 * 66000)) - 1;\r
 257         target_write_u32( bank->target, FCRA, fcra );\r
 258 }\r
 259 \r
 260 \r
 261 \r
 262 /**\r
 263  * Check if device is ready.\r
 264  *\r
 265  * Check if device is ready for flash operation:\r
 266  * Must have been successfully probed.\r
 267  * Must be halted.\r
 268  */\r
 269 static uint32_t lpc2900_is_ready( struct flash_bank_s *bank )\r
 270 {\r
 271         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;\r
 272 \r
 273         if( lpc2900_info->chipid != EXPECTED_CHIPID )\r
 274         {\r
 275                 return ERROR_FLASH_BANK_NOT_PROBED;\r
 276         }\r
 277 \r
 278         if( bank->target->state != TARGET_HALTED )\r
 279         {\r
 280                 LOG_ERROR( "Target not halted" );\r
 281                 return ERROR_TARGET_NOT_HALTED;\r
 282         }\r
 283 \r
 284         return ERROR_OK;\r
 285 }\r
 286 \r
 287 \r
 288 /**\r
 289  * Read the status of sector security from the index sector.\r
 290  *\r
 291  * @param bank Pointer to the flash bank descriptor\r
 292  */\r
 293 static uint32_t lpc2900_read_security_status( struct flash_bank_s *bank )\r
 294 {\r
 295         uint32_t status;\r
 296         if( (status = lpc2900_is_ready( bank )) != ERROR_OK )\r
 297         {\r
 298                 return status;\r
 299         }\r
 300 \r
 301         target_t *target = bank->target;\r
 302 \r
 303         /* Enable ISS access */\r
 304         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB | FCTR_FS_ISS);\r
 305 \r
 306         /* Read the relevant block of memory from the ISS sector */\r
 307         uint32_t iss_secured_field[ 0x230/16 ][ 4 ];\r
 308         target_read_memory(target, bank->base + 0xC00, 4, 0x230/4,\r
 309                                    (uint8_t *)iss_secured_field);\r
 310 \r
 311         /* Disable ISS access */\r
 312         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);\r
 313 \r
 314         /* Check status of each sector. Note that the sector numbering in the LPC2900\r
 315          * is different from the logical sector numbers used in OpenOCD!\r
 316          * Refer to the user manual for details.\r
 317          *\r
 318          * All zeros (16x 0x00) are treated as a secured sector (is_protected = 1)\r
 319          * All ones (16x 0xFF) are treated as a non-secured sector (is_protected = 0)\r
 320          * Anything else is undefined (is_protected = -1). This is treated as\r
 321          * a protected sector!\r
 322          */\r
 323         int sector;\r
 324         int index;\r
 325         for( sector = 0; sector < bank->num_sectors; sector++ )\r
 326         {\r
 327                 /* Convert logical sector number to physical sector number */\r
 328                 if( sector <= 4 )\r
 329                 {\r
 330                         index = sector + 11;\r
 331                 }\r
 332                 else if( sector <= 7 )\r
 333                 {\r
 334                         index = sector + 27;\r
 335                 }\r
 336                 else\r
 337                 {\r
 338                         index = sector - 8;\r
 339                 }\r
 340 \r
 341                 bank->sectors[sector].is_protected = -1;\r
 342 \r
 343                 if (\r
 344                     (iss_secured_field[index][0] == 0x00000000) &&\r
 345                     (iss_secured_field[index][1] == 0x00000000) &&\r
 346                     (iss_secured_field[index][2] == 0x00000000) &&\r
 347                     (iss_secured_field[index][3] == 0x00000000) )\r
 348                 {\r
 349                         bank->sectors[sector].is_protected = 1;\r
 350                 }\r
 351 \r
 352                 if (\r
 353                     (iss_secured_field[index][0] == 0xFFFFFFFF) &&\r
 354                     (iss_secured_field[index][1] == 0xFFFFFFFF) &&\r
 355                     (iss_secured_field[index][2] == 0xFFFFFFFF) &&\r
 356                     (iss_secured_field[index][3] == 0xFFFFFFFF) )\r
 357                 {\r
 358                         bank->sectors[sector].is_protected = 0;\r
 359                 }\r
 360         }\r
 361 \r
 362         return ERROR_OK;\r
 363 }\r
 364 \r
 365 \r
 366 /**\r
 367  * Use BIST to calculate a 128-bit hash value over a range of flash.\r
 368  *\r
 369  * @param bank Pointer to the flash bank descriptor\r
 370  * @param addr_from\r
 371  * @param addr_to\r
 372  * @param signature\r
 373  */\r
 374 static uint32_t lpc2900_run_bist128(struct flash_bank_s *bank,\r
 375                                     uint32_t addr_from,\r
 376                                     uint32_t addr_to,\r
 377                                     uint32_t (*signature)[4] )\r
 378 {\r
 379         target_t *target = bank->target;\r
 380 \r
 381         /* Clear END_OF_MISR interrupt status */\r
 382         target_write_u32( target, INT_CLR_STATUS, INTSRC_END_OF_MISR );\r
 383 \r
 384         /* Start address */\r
 385         target_write_u32( target, FMSSTART, addr_from >> 4);\r
 386         /* End address, and issue start command */\r
 387         target_write_u32( target, FMSSTOP, (addr_to >> 4) | FMSSTOP_MISR_START );\r
 388 \r
 389         /* Poll for end of operation. Calculate a reasonable timeout. */\r
 390         if( lpc2900_wait_status( bank, INTSRC_END_OF_MISR, 1000 ) != ERROR_OK )\r
 391         {\r
 392                 return ERROR_FLASH_OPERATION_FAILED;\r
 393         }\r
 394 \r
 395         /* Return the signature */\r
 396         target_read_memory( target, FMSW0, 4, 4, (uint8_t *)signature );\r
 397 \r
 398         return ERROR_OK;\r
 399 }\r
 400 \r
 401 \r
 402 /**\r
 403  * Return sector number for given address.\r
 404  *\r
 405  * Return the (logical) sector number for a given relative address.\r
 406  * No sanity check is done. It assumed that the address is valid.\r
 407  *\r
 408  * @param bank Pointer to the flash bank descriptor\r
 409  * @param offset Offset address relative to bank start\r
 410  */\r
 411 static uint32_t lpc2900_address2sector( struct flash_bank_s *bank,\r
 412                                         uint32_t offset )\r
 413 {\r
 414         uint32_t address = bank->base + offset;\r
 415 \r
 416 \r
 417         /* Run through all sectors of this bank */\r
 418         int sector;\r
 419         for( sector = 0; sector < bank->num_sectors; sector++ )\r
 420         {\r
 421                 /* Return immediately if address is within the current sector */\r
 422                 if( address < (bank->sectors[sector].offset + bank->sectors[sector].size) )\r
 423                 {\r
 424                         return sector;\r
 425                 }\r
 426         }\r
 427 \r
 428         /* We should never come here. If we do, return an arbitrary sector number. */\r
 429         return 0;\r
 430 }\r
 431 \r
 432 \r
 433 \r
 434 \r
 435 /**\r
 436  * Write one page to the index sector.\r
 437  *\r
 438  * @param bank Pointer to the flash bank descriptor\r
 439  * @param pagenum Page number (0...7)\r
 440  * @param page Page array (FLASH_PAGE_SIZE bytes)\r
 441  */\r
 442 static int lpc2900_write_index_page( struct flash_bank_s *bank,\r
 443                                      int pagenum,\r
 444                                      uint8_t (*page)[FLASH_PAGE_SIZE] )\r
 445 {\r
 446         /* Only pages 4...7 are user writable */\r
 447         if( (pagenum < 4) || (pagenum > 7) )\r
 448         {\r
 449                 LOG_ERROR( "Refuse to burn index sector page %" PRIu32, pagenum );\r
 450                 return ERROR_COMMAND_ARGUMENT_INVALID;\r
 451         }\r
 452 \r
 453         /* Get target, and check if it's halted */\r
 454         target_t *target = bank->target;\r
 455         if( target->state != TARGET_HALTED )\r
 456         {\r
 457                 LOG_ERROR( "Target not halted" );\r
 458                 return ERROR_TARGET_NOT_HALTED;\r
 459         }\r
 460 \r
 461         /* Private info */\r
 462         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;\r
 463 \r
 464         /* Enable flash block and set the correct CRA clock of 66 kHz */\r
 465         lpc2900_setup( bank );\r
 466 \r
 467         /* Un-protect the index sector */\r
 468         target_write_u32( target, bank->base, 0 );\r
 469         target_write_u32( target, FCTR,\r
 470                           FCTR_FS_LOADREQ | FCTR_FS_WPB | FCTR_FS_ISS |\r
 471                           FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS );\r
 472 \r
 473         /* Set latch load mode */\r
 474         target_write_u32( target, FCTR,\r
 475                           FCTR_FS_ISS | FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS );\r
 476 \r
 477         /* Write whole page to flash data latches */\r
 478         if( target_write_memory( target,\r
 479                                  bank->base + pagenum * FLASH_PAGE_SIZE,\r
 480                                  4, FLASH_PAGE_SIZE / 4, (uint8_t *)page) != ERROR_OK )\r
 481         {\r
 482                 LOG_ERROR( "Index sector write failed @ page %" PRIu32, pagenum );\r
 483                 target_write_u32( target, FCTR, FCTR_FS_CS | FCTR_FS_WEB );\r
 484 \r
 485                 return ERROR_FLASH_OPERATION_FAILED;\r
 486         }\r
 487 \r
 488         /* Clear END_OF_BURN interrupt status */\r
 489         target_write_u32( target, INT_CLR_STATUS, INTSRC_END_OF_BURN );\r
 490 \r
 491         /* Set the program/erase time to FLASH_PROGRAM_TIME */\r
 492         target_write_u32(target, FPTR,\r
 493                          FPTR_EN_T | lpc2900_calc_tr( lpc2900_info->clk_sys_fmc,\r
 494                                                       FLASH_PROGRAM_TIME ));\r
 495 \r
 496         /* Trigger flash write */\r
 497         target_write_u32( target, FCTR,\r
 498                           FCTR_FS_PROGREQ | FCTR_FS_ISS |\r
 499                           FCTR_FS_WPB | FCTR_FS_WRE | FCTR_FS_CS );\r
 500 \r
 501         /* Wait for the end of the write operation. If it's not over after one\r
 502          * second, something went dreadfully wrong... :-(\r
 503          */\r
 504         if( lpc2900_wait_status( bank, INTSRC_END_OF_BURN, 1000 ) != ERROR_OK )\r
 505         {\r
 506                 LOG_ERROR( "Index sector write failed @ page %" PRIu32, pagenum );\r
 507                 target_write_u32( target, FCTR, FCTR_FS_CS | FCTR_FS_WEB );\r
 508 \r
 509                 return ERROR_FLASH_OPERATION_FAILED;\r
 510         }\r
 511 \r
 512         target_write_u32( target, FCTR, FCTR_FS_CS | FCTR_FS_WEB );\r
 513 \r
 514         return ERROR_OK;\r
 515 }\r
 516 \r
 517 \r
 518 \r
 519 /**\r
 520  * Calculate FPTR.TR register value for desired program/erase time.\r
 521  *\r
 522  * @param clock System clock in Hz\r
 523  * @param time Program/erase time in µs\r
 524  */\r
 525 static uint32_t lpc2900_calc_tr( uint32_t clock, uint32_t time )\r
 526 {\r
 527         /*           ((time[µs]/1e6) * f[Hz]) + 511\r
 528          * FPTR.TR = -------------------------------\r
 529          *                         512\r
 530          *\r
 531          * The result is the \r
 532          */\r
 533 \r
 534         uint32_t tr_val = (uint32_t)((((time / 1e6) * clock) + 511.0) / 512.0);\r
 535 \r
 536         return tr_val;\r
 537 }\r
 538 \r
 539 \r
 540 /***********************  Private flash commands  **************************/\r
 541 \r
 542 \r
 543 /**\r
 544  * Command to determine the signature of the whole flash.\r
 545  *\r
 546  * Uses the Built-In-Self-Test (BIST) to generate a 128-bit hash value\r
 547  * of the flash content.\r
 548  *\r
 549  * @param cmd_ctx\r
 550  * @param cmd\r
 551  * @param args\r
 552  * @param argc\r
 553  */\r
 554 static int lpc2900_handle_signature_command( struct command_context_s *cmd_ctx,\r
 555                                              char *cmd, char **args, int argc )\r
 556 {\r
 557         flash_bank_t *bank;\r
 558         uint32_t status;\r
 559         uint32_t signature[4];\r
 560 \r
 561 \r
 562         if( argc < 1 )\r
 563         {\r
 564                 LOG_WARNING( "Too few arguments. Call: lpc2900 signature <bank#>" );\r
 565                 return ERROR_FLASH_BANK_INVALID;\r
 566         }\r
 567 \r
 568         /* Get the bank descriptor */\r
 569         bank = get_flash_bank_by_num( strtoul(args[0], NULL, 0) );\r
 570         if( !bank )\r
 571         {\r
 572                 command_print( cmd_ctx, "flash bank '#%s' is out of bounds", args[0] );\r
 573                 return ERROR_OK;\r
 574         }\r
 575 \r
 576         if( bank->target->state != TARGET_HALTED )\r
 577         {\r
 578                 LOG_ERROR( "Target not halted" );\r
 579                 return ERROR_TARGET_NOT_HALTED;\r
 580         }\r
 581 \r
 582         /* Run BIST over whole flash range */\r
 583         if( (status = lpc2900_run_bist128( bank,\r
 584                                            bank->base,\r
 585                                            bank->base + (bank->size - 1),\r
 586                                            &signature)\r
 587                                          ) != ERROR_OK )\r
 588         {\r
 589                 return status;\r
 590         }\r
 591 \r
 592         command_print( cmd_ctx, "signature: 0x%8.8" PRIx32\r
 593                                           ":0x%8.8" PRIx32\r
 594                                           ":0x%8.8" PRIx32\r
 595                                           ":0x%8.8" PRIx32,\r
 596                       signature[3], signature[2], signature[1], signature[0] );\r
 597 \r
 598         return ERROR_OK;\r
 599 }\r
 600 \r
 601 \r
 602 \r
 603 /**\r
 604  * Store customer info in file.\r
 605  *\r
 606  * Read customer info from index sector, and store that block of data into\r
 607  * a disk file. The format is binary.\r
 608  *\r
 609  * @param cmd_ctx\r
 610  * @param cmd\r
 611  * @param args\r
 612  * @param argc\r
 613  */\r
 614 static int lpc2900_handle_read_custom_command( struct command_context_s *cmd_ctx,\r
 615                                                char *cmd, char **args, int argc )\r
 616 {\r
 617         flash_bank_t *bank;\r
 618 \r
 619 \r
 620         if( argc < 2 )\r
 621         {\r
 622                 return ERROR_COMMAND_SYNTAX_ERROR;\r
 623         }\r
 624 \r
 625         /* Get the bank descriptor */\r
 626         bank = get_flash_bank_by_num( strtoul(args[0], NULL, 0) );\r
 627         if( !bank )\r
 628         {\r
 629                 command_print( cmd_ctx, "flash bank '#%s' is out of bounds", args[0] );\r
 630                 return ERROR_OK;\r
 631         }\r
 632         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;\r
 633         lpc2900_info->risky = 0;\r
 634 \r
 635         /* Get target, and check if it's halted */\r
 636         target_t *target = bank->target;\r
 637         if( target->state != TARGET_HALTED )\r
 638         {\r
 639                 LOG_ERROR( "Target not halted" );\r
 640                 return ERROR_TARGET_NOT_HALTED;\r
 641         }\r
 642 \r
 643         /* Storage for customer info. Read in two parts */\r
 644         uint32_t customer[ ISS_CUSTOMER_NWORDS1 + ISS_CUSTOMER_NWORDS2 ];\r
 645 \r
 646         /* Enable access to index sector */\r
 647         target_write_u32( target, FCTR, FCTR_FS_CS | FCTR_FS_WEB | FCTR_FS_ISS );\r
 648 \r
 649         /* Read two parts */\r
 650         target_read_memory( target, bank->base+ISS_CUSTOMER_START1, 4,\r
 651                                     ISS_CUSTOMER_NWORDS1,\r
 652                                     (uint8_t *)&customer[0] );\r
 653         target_read_memory( target, bank->base+ISS_CUSTOMER_START2, 4,\r
 654                                     ISS_CUSTOMER_NWORDS2,\r
 655                                     (uint8_t *)&customer[ISS_CUSTOMER_NWORDS1] );\r
 656 \r
 657         /* Deactivate access to index sector */\r
 658         target_write_u32( target, FCTR, FCTR_FS_CS | FCTR_FS_WEB );\r
 659 \r
 660         /* Try and open the file */\r
 661         fileio_t fileio;\r
 662         char *filename = args[1];\r
 663         int ret = fileio_open( &fileio, filename, FILEIO_WRITE, FILEIO_BINARY );\r
 664         if( ret != ERROR_OK )\r
 665         {\r
 666                 LOG_WARNING( "Could not open file %s", filename );\r
 667                 return ret;\r
 668         }\r
 669 \r
 670         uint32_t nwritten;\r
 671         ret = fileio_write( &fileio, sizeof(customer),\r
 672                         (const uint8_t *)customer, &nwritten );\r
 673         if( ret != ERROR_OK )\r
 674         {\r
 675                 LOG_ERROR( "Write operation to file %s failed", filename );\r
 676                 fileio_close( &fileio );\r
 677                 return ret;\r
 678         }\r
 679 \r
 680         fileio_close( &fileio );\r
 681 \r
 682         return ERROR_OK;\r
 683 }\r
 684 \r
 685 \r
 686 \r
 687 \r
 688 /**\r
 689  * Enter password to enable potentially dangerous options.\r
 690  *\r
 691  * @param cmd_ctx\r
 692  * @param cmd\r
 693  * @param args\r
 694  * @param argc\r
 695  */\r
 696 static int lpc2900_handle_password_command(struct command_context_s *cmd_ctx,\r
 697                                            char *cmd, char **args, int argc)\r
 698 {\r
 699         flash_bank_t *bank;\r
 700 \r
 701 \r
 702         if (argc < 2)\r
 703         {\r
 704                 return ERROR_COMMAND_SYNTAX_ERROR;\r
 705         }\r
 706 \r
 707         /* Get the bank descriptor */\r
 708         bank = get_flash_bank_by_num(strtoul(args[0], NULL, 0));\r
 709         if (!bank)\r
 710         {\r
 711                 command_print(cmd_ctx, "flash bank '#%s' is out of bounds", args[0]);\r
 712                 return ERROR_OK;\r
 713         }\r
 714         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;\r
 715 \r
 716 #define ISS_PASSWORD "I_know_what_I_am_doing"\r
 717 \r
 718         lpc2900_info->risky = !strcmp( args[1], ISS_PASSWORD );\r
 719 \r
 720         if( !lpc2900_info->risky )\r
 721         {\r
 722                 command_print(cmd_ctx, "Wrong password (use '%s')", ISS_PASSWORD);\r
 723                 return ERROR_COMMAND_ARGUMENT_INVALID;\r
 724         }\r
 725 \r
 726         command_print(cmd_ctx,\r
 727                   "Potentially dangerous operation allowed in next command!");\r
 728 \r
 729         return ERROR_OK;\r
 730 }\r
 731 \r
 732 \r
 733 \r
 734 /**\r
 735  * Write customer info from file to the index sector.\r
 736  *\r
 737  * @param cmd_ctx\r
 738  * @param cmd\r
 739  * @param args\r
 740  * @param argc\r
 741  */\r
 742 static int lpc2900_handle_write_custom_command( struct command_context_s *cmd_ctx,\r
 743                                                 char *cmd, char **args, int argc )\r
 744 {\r
 745         if (argc < 2)\r
 746         {\r
 747                 return ERROR_COMMAND_SYNTAX_ERROR;\r
 748         }\r
 749 \r
 750         /* Get the bank descriptor */\r
 751         flash_bank_t *bank = get_flash_bank_by_num(strtoul(args[0], NULL, 0));\r
 752         if (!bank)\r
 753         {\r
 754                 command_print(cmd_ctx, "flash bank '#%s' is out of bounds", args[0]);\r
 755                 return ERROR_OK;\r
 756         }\r
 757         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;\r
 758 \r
 759         /* Check if command execution is allowed. */\r
 760         if( !lpc2900_info->risky )\r
 761         {\r
 762                 command_print( cmd_ctx, "Command execution not allowed!" );\r
 763                 return ERROR_COMMAND_ARGUMENT_INVALID;\r
 764         }\r
 765         lpc2900_info->risky = 0;\r
 766 \r
 767         /* Get target, and check if it's halted */\r
 768         target_t *target = bank->target;\r
 769         if (target->state != TARGET_HALTED)\r
 770         {\r
 771                 LOG_ERROR("Target not halted");\r
 772                 return ERROR_TARGET_NOT_HALTED;\r
 773         }\r
 774 \r
 775         /* The image will always start at offset 0 */\r
 776         image_t image;\r
 777         image.base_address_set = 1;\r
 778         image.base_address = 0;\r
 779         image.start_address_set = 0;\r
 780 \r
 781         char *filename = args[1];\r
 782         char *type = (argc >= 3) ? args[2] : NULL;\r
 783         int retval = image_open(&image, filename, type);\r
 784         if (retval != ERROR_OK)\r
 785         {\r
 786                 return retval;\r
 787         }\r
 788 \r
 789         /* Do a sanity check: The image must be exactly the size of the customer\r
 790            programmable area. Any other size is rejected. */\r
 791         if( image.num_sections != 1 )\r
 792         {\r
 793                 LOG_ERROR("Only one section allowed in image file.");\r
 794                 return ERROR_COMMAND_SYNTAX_ERROR;\r
 795         }\r
 796         if( (image.sections[0].base_address != 0) ||\r
 797         (image.sections[0].size != ISS_CUSTOMER_SIZE) )\r
 798         {\r
 799                 LOG_ERROR("Incorrect image file size. Expected %" PRIu32 ", got %" PRIu32,\r
 800                    ISS_CUSTOMER_SIZE, image.sections[0].size);\r
 801                 return ERROR_COMMAND_SYNTAX_ERROR;\r
 802         }\r
 803 \r
 804         /* Well boys, I reckon this is it... */\r
 805 \r
 806         /* Customer info is split into two blocks in pages 4 and 5. */\r
 807         uint8_t page[FLASH_PAGE_SIZE];\r
 808 \r
 809         /* Page 4 */\r
 810         uint32_t offset = ISS_CUSTOMER_START1 % FLASH_PAGE_SIZE;\r
 811         memset( page, 0xff, FLASH_PAGE_SIZE );\r
 812         uint32_t size_read;\r
 813         retval = image_read_section( &image, 0, 0,\r
 814                                      ISS_CUSTOMER_SIZE1, &page[offset], &size_read);\r
 815         if( retval != ERROR_OK )\r
 816         {\r
 817                 LOG_ERROR("couldn't read from file '%s'", filename);\r
 818                 image_close(&image);\r
 819                 return retval;\r
 820         }\r
 821         if( (retval = lpc2900_write_index_page( bank, 4, &page )) != ERROR_OK )\r
 822         {\r
 823                 image_close(&image);\r
 824                 return retval;\r
 825         }\r
 826 \r
 827         /* Page 5 */\r
 828         offset = ISS_CUSTOMER_START2 % FLASH_PAGE_SIZE;\r
 829         memset( page, 0xff, FLASH_PAGE_SIZE );\r
 830         retval = image_read_section( &image, 0, ISS_CUSTOMER_SIZE1,\r
 831                                      ISS_CUSTOMER_SIZE2, &page[offset], &size_read);\r
 832         if( retval != ERROR_OK )\r
 833         {\r
 834                 LOG_ERROR("couldn't read from file '%s'", filename);\r
 835                 image_close(&image);\r
 836                 return retval;\r
 837         }\r
 838         if( (retval = lpc2900_write_index_page( bank, 5, &page )) != ERROR_OK )\r
 839         {\r
 840                 image_close(&image);\r
 841                 return retval;\r
 842         }\r
 843 \r
 844         image_close(&image);\r
 845 \r
 846         return ERROR_OK;\r
 847 }\r
 848 \r
 849 \r
 850 \r
 851 /**\r
 852  * Activate 'sector security' for a range of sectors.\r
 853  *\r
 854  * @param cmd_ctx\r
 855  * @param cmd\r
 856  * @param args\r
 857  * @param argc\r
 858  */\r
 859 static int lpc2900_handle_secure_sector_command(struct command_context_s *cmd_ctx,\r
 860                                                 char *cmd, char **args, int argc)\r
 861 {\r
 862         if (argc < 3)\r
 863         {\r
 864                 return ERROR_COMMAND_SYNTAX_ERROR;\r
 865         }\r
 866 \r
 867         /* Get the bank descriptor */\r
 868         flash_bank_t *bank = get_flash_bank_by_num(strtoul(args[0], NULL, 0));\r
 869         if (!bank)\r
 870         {\r
 871                 command_print(cmd_ctx, "flash bank '#%s' is out of bounds", args[0]);\r
 872                 return ERROR_OK;\r
 873         }\r
 874         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;\r
 875 \r
 876         /* Check if command execution is allowed. */\r
 877         if( !lpc2900_info->risky )\r
 878         {\r
 879                 command_print( cmd_ctx, "Command execution not allowed! "\r
 880                 "(use 'password' command first)");\r
 881                 return ERROR_COMMAND_ARGUMENT_INVALID;\r
 882         }\r
 883         lpc2900_info->risky = 0;\r
 884 \r
 885         /* Read sector range, and do a sanity check. */\r
 886         int first = strtoul(args[1], NULL, 0);\r
 887         int last = strtoul(args[2], NULL, 0);\r
 888         if( (first >= bank->num_sectors) ||\r
 889             (last >= bank->num_sectors) ||\r
 890             (first > last) )\r
 891         {\r
 892                 command_print( cmd_ctx, "Illegal sector range" );\r
 893                 return ERROR_COMMAND_ARGUMENT_INVALID;\r
 894         }\r
 895 \r
 896         uint8_t page[FLASH_PAGE_SIZE];\r
 897         int sector;\r
 898         int retval;\r
 899 \r
 900         /* Sectors in page 6 */\r
 901         if( (first <= 4) || (last >= 8) )\r
 902         {\r
 903                 memset( &page, 0xff, FLASH_PAGE_SIZE );\r
 904                 for( sector = first; sector <= last; sector++ )\r
 905                 {\r
 906                         if( sector <= 4 )\r
 907                         {\r
 908                                 memset( &page[0xB0 + 16*sector], 0, 16 );\r
 909                         }\r
 910                         else if( sector >= 8 )\r
 911                         {\r
 912                                 memset( &page[0x00 + 16*(sector - 8)], 0, 16 );\r
 913                         }\r
 914                 }\r
 915 \r
 916                 if( (retval = lpc2900_write_index_page( bank, 6, &page )) != ERROR_OK )\r
 917                 {\r
 918                         LOG_ERROR("failed to update index sector page 6");\r
 919                         return retval;\r
 920                 }\r
 921         }\r
 922 \r
 923         /* Sectors in page 7 */\r
 924         if( (first <= 7) && (last >= 5) )\r
 925         {\r
 926                 memset( &page, 0xff, FLASH_PAGE_SIZE );\r
 927                 for( sector = first; sector <= last; sector++ )\r
 928                 {\r
 929                         if( (sector >= 5) && (sector <= 7) )\r
 930                         {\r
 931                                 memset( &page[0x00 + 16*(sector - 5)], 0, 16 );\r
 932                         }\r
 933                 }\r
 934 \r
 935                 if( (retval = lpc2900_write_index_page( bank, 7, &page )) != ERROR_OK )\r
 936                 {\r
 937                         LOG_ERROR("failed to update index sector page 7");\r
 938                         return retval;\r
 939                 }\r
 940         }\r
 941 \r
 942         command_print( cmd_ctx,\r
 943                 "Sectors security will become effective after next power cycle");\r
 944 \r
 945         /* Update the sector security status */\r
 946         if ( lpc2900_read_security_status(bank) != ERROR_OK )\r
 947         {\r
 948                 LOG_ERROR( "Cannot determine sector security status" );\r
 949                 return ERROR_FLASH_OPERATION_FAILED;\r
 950         }\r
 951 \r
 952         return ERROR_OK;\r
 953 }\r
 954 \r
 955 \r
 956 \r
 957 /**\r
 958  * Activate JTAG protection.\r
 959  *\r
 960  * @param cmd_ctx\r
 961  * @param cmd\r
 962  * @param args\r
 963  * @param argc\r
 964  */\r
 965 static int lpc2900_handle_secure_jtag_command(struct command_context_s *cmd_ctx,\r
 966                                               char *cmd, char **args, int argc)\r
 967 {\r
 968         if (argc < 1)\r
 969         {\r
 970                 return ERROR_COMMAND_SYNTAX_ERROR;\r
 971         }\r
 972 \r
 973         /* Get the bank descriptor */\r
 974         flash_bank_t *bank = get_flash_bank_by_num(strtoul(args[0], NULL, 0));\r
 975         if (!bank)\r
 976         {\r
 977                 command_print(cmd_ctx, "flash bank '#%s' is out of bounds", args[0]);\r
 978                 return ERROR_OK;\r
 979         }\r
 980         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;\r
 981 \r
 982         /* Check if command execution is allowed. */\r
 983         if( !lpc2900_info->risky )\r
 984         {\r
 985                 command_print( cmd_ctx, "Command execution not allowed! "\r
 986                                         "(use 'password' command first)");\r
 987                 return ERROR_COMMAND_ARGUMENT_INVALID;\r
 988         }\r
 989         lpc2900_info->risky = 0;\r
 990 \r
 991         /* Prepare page */\r
 992         uint8_t page[FLASH_PAGE_SIZE];\r
 993         memset( &page, 0xff, FLASH_PAGE_SIZE );\r
 994 \r
 995 \r
 996         /* Insert "soft" protection word */\r
 997         page[0x30 + 15] = 0x7F;\r
 998         page[0x30 + 11] = 0x7F;\r
 999         page[0x30 +  7] = 0x7F;\r
1000         page[0x30 +  3] = 0x7F;\r
1001 \r
1002         /* Write to page 5 */\r
1003         int retval;\r
1004         if( (retval = lpc2900_write_index_page( bank, 5, &page ))\r
1005                         != ERROR_OK )\r
1006         {\r
1007                 LOG_ERROR("failed to update index sector page 5");\r
1008                 return retval;\r
1009         }\r
1010 \r
1011         LOG_INFO("JTAG security set. Good bye!");\r
1012 \r
1013         return ERROR_OK;\r
1014 }\r
1015 \r
1016 \r
1017 \r
1018 /***********************  Flash interface functions  **************************/\r
1019 \r
1020 \r
1021 /**\r
1022  * Register private command handlers.\r
1023  *\r
1024  * @param cmd_ctx\r
1025  */\r
1026 static int lpc2900_register_commands(struct command_context_s *cmd_ctx)\r
1027 {\r
1028         command_t *lpc2900_cmd = register_command(cmd_ctx, NULL, "lpc2900",\r
1029                                                   NULL, COMMAND_ANY, NULL);\r
1030 \r
1031         register_command(\r
1032             cmd_ctx,\r
1033             lpc2900_cmd,\r
1034             "signature",\r
1035             lpc2900_handle_signature_command,\r
1036             COMMAND_EXEC,\r
1037             "<bank> | "\r
1038             "print device signature of flash bank");\r
1039 \r
1040         register_command(\r
1041             cmd_ctx,\r
1042             lpc2900_cmd,\r
1043             "read_custom",\r
1044             lpc2900_handle_read_custom_command,\r
1045             COMMAND_EXEC,\r
1046             "<bank> <filename> | "\r
1047             "read customer information from index sector to file");\r
1048 \r
1049         register_command(\r
1050             cmd_ctx,\r
1051             lpc2900_cmd,\r
1052             "password",\r
1053             lpc2900_handle_password_command,\r
1054             COMMAND_EXEC,\r
1055             "<bank> <password> | "\r
1056             "enter password to enable 'dangerous' options");\r
1057 \r
1058         register_command(\r
1059             cmd_ctx,\r
1060             lpc2900_cmd,\r
1061             "write_custom",\r
1062             lpc2900_handle_write_custom_command,\r
1063             COMMAND_EXEC,\r
1064             "<bank> <filename> [<type>] | "\r
1065             "write customer info from file to index sector");\r
1066 \r
1067         register_command(\r
1068             cmd_ctx,\r
1069             lpc2900_cmd,\r
1070             "secure_sector",\r
1071             lpc2900_handle_secure_sector_command,\r
1072             COMMAND_EXEC,\r
1073             "<bank> <first> <last> | "\r
1074             "activate sector security for a range of sectors");\r
1075 \r
1076         register_command(\r
1077             cmd_ctx,\r
1078             lpc2900_cmd,\r
1079             "secure_jtag",\r
1080             lpc2900_handle_secure_jtag_command,\r
1081             COMMAND_EXEC,\r
1082             "<bank> <level> | "\r
1083             "activate JTAG security");\r
1084 \r
1085         return ERROR_OK;\r
1086 }\r
1087 \r
1088 \r
1089 /**\r
1090  * Evaluate flash bank command.\r
1091  *\r
1092  * Syntax: flash bank lpc2900 0 0 0 0 target# system_base_clock\r
1093  *\r
1094  * @param cmd_ctx\r
1095  * @param cmd\r
1096  * @param args\r
1097  * @param argc\r
1098  * @param bank Pointer to the flash bank descriptor\r
1099  */\r
1100 static int lpc2900_flash_bank_command(struct command_context_s *cmd_ctx,\r
1101                                       char *cmd, char **args, int argc,\r
1102                                       struct flash_bank_s *bank)\r
1103 {\r
1104         lpc2900_flash_bank_t *lpc2900_info;\r
1105 \r
1106         if (argc < 6)\r
1107         {\r
1108                 LOG_WARNING("incomplete flash_bank LPC2900 configuration");\r
1109                 return ERROR_FLASH_BANK_INVALID;\r
1110         }\r
1111 \r
1112         lpc2900_info = malloc(sizeof(lpc2900_flash_bank_t));\r
1113         bank->driver_priv = lpc2900_info;\r
1114 \r
1115         /* Get flash clock.\r
1116          * Reject it if we can't meet the requirements for program time\r
1117          * (if clock too slow), or for erase time (clock too fast).\r
1118          */\r
1119         lpc2900_info->clk_sys_fmc = strtoul(args[6], NULL, 0) * 1000;\r
1120 \r
1121         uint32_t clock_limit;\r
1122         /* Check program time limit */\r
1123         clock_limit = 512000000l / FLASH_PROGRAM_TIME;\r
1124         if (lpc2900_info->clk_sys_fmc < clock_limit)\r
1125         {\r
1126                 LOG_WARNING("flash clock must be at least %" PRIu32 " kHz",\r
1127                     (clock_limit / 1000));\r
1128                 return ERROR_FLASH_BANK_INVALID;\r
1129         }\r
1130 \r
1131         /* Check erase time limit */\r
1132         clock_limit = (uint32_t)((32767.0 * 512.0 * 1e6) / FLASH_ERASE_TIME);\r
1133         if (lpc2900_info->clk_sys_fmc > clock_limit)\r
1134         {\r
1135                 LOG_WARNING("flash clock must be a maximum of %" PRIu32" kHz",\r
1136                     (clock_limit / 1000));\r
1137                 return ERROR_FLASH_BANK_INVALID;\r
1138         }\r
1139 \r
1140         /* Chip ID will be obtained by probing the device later */\r
1141         lpc2900_info->chipid = 0;\r
1142 \r
1143         return ERROR_OK;\r
1144 }\r
1145 \r
1146 \r
1147 /**\r
1148  * Erase sector(s).\r
1149  *\r
1150  * @param bank Pointer to the flash bank descriptor\r
1151  * @param first First sector to be erased\r
1152  * @param last Last sector (including) to be erased\r
1153  */\r
1154 static int lpc2900_erase(struct flash_bank_s *bank, int first, int last)\r
1155 {\r
1156         uint32_t status;\r
1157         int sector;\r
1158         int last_unsecured_sector;\r
1159         target_t *target = bank->target;\r
1160         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;\r
1161 \r
1162 \r
1163         status = lpc2900_is_ready(bank);\r
1164         if (status != ERROR_OK)\r
1165         {\r
1166                 return status;\r
1167         }\r
1168 \r
1169         /* Sanity check on sector range */\r
1170         if ((first < 0) || (last < first) || (last >= bank->num_sectors))\r
1171         {\r
1172                 LOG_INFO("Bad sector range");\r
1173                 return ERROR_FLASH_SECTOR_INVALID;\r
1174         }\r
1175 \r
1176         /* Update the info about secured sectors */\r
1177         lpc2900_read_security_status( bank );\r
1178 \r
1179         /* The selected sector range might include secured sectors. An attempt\r
1180          * to erase such a sector will cause the erase to fail also for unsecured\r
1181          * sectors. It is necessary to determine the last unsecured sector now,\r
1182          * because we have to treat the last relevant sector in the list in\r
1183          * a special way.\r
1184          */\r
1185         last_unsecured_sector = -1;\r
1186         for (sector = first; sector <= last; sector++)\r
1187         {\r
1188                 if ( !bank->sectors[sector].is_protected )\r
1189                 {\r
1190                         last_unsecured_sector = sector;\r
1191                 }\r
1192         }\r
1193 \r
1194         /* Exit now, in case of the rare constellation where all sectors in range\r
1195          * are secured. This is regarded a success, since erasing/programming of\r
1196          * secured sectors shall be handled transparently.\r
1197          */\r
1198         if ( last_unsecured_sector == -1 )\r
1199         {\r
1200                 return ERROR_OK;\r
1201         }\r
1202 \r
1203         /* Enable flash block and set the correct CRA clock of 66 kHz */\r
1204         lpc2900_setup(bank);\r
1205 \r
1206         /* Clear END_OF_ERASE interrupt status */\r
1207         target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_ERASE);\r
1208 \r
1209         /* Set the program/erase timer to FLASH_ERASE_TIME */\r
1210         target_write_u32(target, FPTR,\r
1211                          FPTR_EN_T | lpc2900_calc_tr( lpc2900_info->clk_sys_fmc,\r
1212                                                       FLASH_ERASE_TIME ));\r
1213 \r
1214         /* Sectors are marked for erasure, then erased all together */\r
1215         for (sector = first; sector <= last_unsecured_sector; sector++)\r
1216         {\r
1217                 /* Only mark sectors that aren't secured. Any attempt to erase a group\r
1218                  * of sectors will fail if any single one of them is secured!\r
1219                  */\r
1220                 if ( !bank->sectors[sector].is_protected )\r
1221                 {\r
1222                         /* Unprotect the sector */\r
1223                         target_write_u32(target, bank->sectors[sector].offset, 0);\r
1224                         target_write_u32(target, FCTR,\r
1225                                          FCTR_FS_LOADREQ | FCTR_FS_WPB |\r
1226                                          FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);\r
1227 \r
1228                         /* Mark the sector for erasure. The last sector in the list\r
1229                            triggers the erasure. */\r
1230                         target_write_u32(target, bank->sectors[sector].offset, 0);\r
1231                         if ( sector == last_unsecured_sector )\r
1232                         {\r
1233                                 target_write_u32(target, FCTR,\r
1234                                                  FCTR_FS_PROGREQ | FCTR_FS_WPB | FCTR_FS_CS);\r
1235                         }\r
1236                         else\r
1237                         {\r
1238                                 target_write_u32(target, FCTR,\r
1239                                                  FCTR_FS_LOADREQ | FCTR_FS_WPB |\r
1240                                                  FCTR_FS_WEB | FCTR_FS_CS);\r
1241                         }\r
1242                 }\r
1243         }\r
1244 \r
1245         /* Wait for the end of the erase operation. If it's not over after two seconds,\r
1246          * something went dreadfully wrong... :-(\r
1247          */\r
1248         if( lpc2900_wait_status(bank, INTSRC_END_OF_ERASE, 2000) != ERROR_OK )\r
1249         {\r
1250                 return ERROR_FLASH_OPERATION_FAILED;\r
1251         }\r
1252 \r
1253         /* Normal flash operating mode */\r
1254         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);\r
1255 \r
1256         return ERROR_OK;\r
1257 }\r
1258 \r
1259 \r
1260 \r
1261 static int lpc2900_protect(struct flash_bank_s *bank, int set, int first, int last)\r
1262 {\r
1263         /* This command is not supported.\r
1264      * "Protection" in LPC2900 terms is handled transparently. Sectors will\r
1265      * automatically be unprotected as needed.\r
1266      * Instead we use the concept of sector security. A secured sector is shown\r
1267      * as "protected" in OpenOCD. Sector security is a permanent feature, and\r
1268      * cannot be disabled once activated.\r
1269      */\r
1270 \r
1271         return ERROR_OK;\r
1272 }\r
1273 \r
1274 \r
1275 /**\r
1276  * Write data to flash.\r
1277  *\r
1278  * @param bank Pointer to the flash bank descriptor\r
1279  * @param buffer Buffer with data\r
1280  * @param offset Start address (relative to bank start)\r
1281  * @param count Number of bytes to be programmed\r
1282  */\r
1283 static int lpc2900_write(struct flash_bank_s *bank, uint8_t *buffer,\r
1284                          uint32_t offset, uint32_t count)\r
1285 {\r
1286         uint8_t page[FLASH_PAGE_SIZE];\r
1287         uint32_t status;\r
1288         uint32_t num_bytes;\r
1289         target_t *target = bank->target;\r
1290         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;\r
1291         int sector;\r
1292         int retval;\r
1293 \r
1294         static const uint32_t write_target_code[] = {\r
1295                 /* Set auto latch mode: FCTR=CS|WRE|WEB */\r
1296                 0xe3a0a007,   /* loop       mov r10, #0x007 */\r
1297                 0xe583a000,   /*            str r10,[r3,#0] */\r
1298 \r
1299                 /* Load complete page into latches */\r
1300                 0xe3a06020,   /*            mov r6,#(512/16) */\r
1301                 0xe8b00f00,   /* next       ldmia r0!,{r8-r11} */\r
1302                 0xe8a10f00,   /*            stmia r1!,{r8-r11} */\r
1303                 0xe2566001,   /*            subs r6,#1 */\r
1304                 0x1afffffb,   /*            bne next */\r
1305 \r
1306                 /* Clear END_OF_BURN interrupt status */\r
1307                 0xe3a0a002,   /*            mov r10,#(1 << 1) */\r
1308                 0xe583afe8,   /*            str r10,[r3,#0xfe8] */\r
1309 \r
1310                 /* Set the erase time to FLASH_PROGRAM_TIME */\r
1311                 0xe5834008,   /*            str r4,[r3,#8] */\r
1312 \r
1313                 /* Trigger flash write\r
1314                         FCTR = CS | WRE | WPB | PROGREQ */\r
1315                 0xe3a0a083,   /*            mov r10,#0x83 */\r
1316                 0xe38aaa01,   /*            orr r10,#0x1000 */\r
1317                 0xe583a000,   /*            str r10,[r3,#0] */\r
1318 \r
1319                 /* Wait for end of burn */\r
1320                 0xe593afe0,   /* wait       ldr r10,[r3,#0xfe0] */\r
1321                 0xe21aa002,   /*            ands r10,#(1 << 1) */\r
1322                 0x0afffffc,   /*            beq wait */\r
1323 \r
1324                 /* End? */\r
1325                 0xe2522001,   /*            subs r2,#1 */\r
1326                 0x1affffed,   /*            bne loop */\r
1327 \r
1328                 0xeafffffe    /* done       b done */\r
1329         };\r
1330 \r
1331 \r
1332         status = lpc2900_is_ready(bank);\r
1333         if (status != ERROR_OK)\r
1334         {\r
1335                 return status;\r
1336         }\r
1337 \r
1338         /* Enable flash block and set the correct CRA clock of 66 kHz */\r
1339         lpc2900_setup(bank);\r
1340 \r
1341         /* Update the info about secured sectors */\r
1342         lpc2900_read_security_status( bank );\r
1343 \r
1344         /* Unprotect all involved sectors */\r
1345         for (sector = 0; sector < bank->num_sectors; sector++)\r
1346         {\r
1347                 /* Start address in or before this sector? */\r
1348                 /* End address in or behind this sector? */\r
1349                 if ( ((bank->base + offset) <\r
1350                           (bank->sectors[sector].offset + bank->sectors[sector].size)) &&\r
1351                      ((bank->base + (offset + count - 1)) >= bank->sectors[sector].offset) )\r
1352                 {\r
1353                         /* This sector is involved and needs to be unprotected.\r
1354                                 * Don't do it for secured sectors.\r
1355                                 */\r
1356                         if ( !bank->sectors[sector].is_protected )\r
1357                         {\r
1358                                 target_write_u32(target, bank->sectors[sector].offset, 0);\r
1359                                 target_write_u32(target, FCTR,\r
1360                                                  FCTR_FS_LOADREQ | FCTR_FS_WPB |\r
1361                                                  FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);\r
1362                         }\r
1363                 }\r
1364         }\r
1365 \r
1366         /* Set the program/erase time to FLASH_PROGRAM_TIME */\r
1367         uint32_t prog_time = FPTR_EN_T | lpc2900_calc_tr( lpc2900_info->clk_sys_fmc,\r
1368                                                           FLASH_PROGRAM_TIME );\r
1369 \r
1370         /* If there is a working area of reasonable size, use it to program via\r
1371            a target algorithm. If not, fall back to host programming. */\r
1372 \r
1373         /* We need some room for target code. */\r
1374         uint32_t target_code_size = sizeof(write_target_code);\r
1375 \r
1376         /* Try working area allocation. Start with a large buffer, and try with\r
1377            reduced size if that fails. */\r
1378         working_area_t *warea;\r
1379         uint32_t buffer_size = lpc2900_info->max_ram_block - 1 * KiB;\r
1380         while( (retval = target_alloc_working_area(target,\r
1381                                                    buffer_size + target_code_size,\r
1382                                                    &warea)) != ERROR_OK )\r
1383         {\r
1384                 /* Try a smaller buffer now, and stop if it's too small. */\r
1385                 buffer_size -= 1 * KiB;\r
1386                 if (buffer_size < 2 * KiB)\r
1387                 {\r
1388                         LOG_INFO( "no (large enough) working area"\r
1389                                   ", falling back to host mode" );\r
1390                         warea = NULL;\r
1391                         break;\r
1392                 }\r
1393         };\r
1394 \r
1395         if( warea )\r
1396         {\r
1397                 reg_param_t reg_params[5];\r
1398                 armv4_5_algorithm_t armv4_5_info;\r
1399 \r
1400                 /* We can use target mode. Download the algorithm. */\r
1401                 retval = target_write_buffer( target,\r
1402                                               (warea->address)+buffer_size,\r
1403                                               target_code_size,\r
1404                                               (uint8_t *)write_target_code);\r
1405                 if (retval != ERROR_OK)\r
1406                 {\r
1407                         LOG_ERROR("Unable to write block write code to target");\r
1408                         target_free_all_working_areas(target);\r
1409                         return ERROR_FLASH_OPERATION_FAILED;\r
1410                 }\r
1411 \r
1412                 init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT);\r
1413                 init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);\r
1414                 init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);\r
1415                 init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);\r
1416                 init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT);\r
1417 \r
1418                 /* Write to flash in large blocks */\r
1419                 while ( count != 0 )\r
1420                 {\r
1421                         uint32_t this_npages;\r
1422                         uint8_t *this_buffer;\r
1423                         int start_sector = lpc2900_address2sector( bank, offset );\r
1424 \r
1425                         /* First page / last page / rest */\r
1426                         if( offset % FLASH_PAGE_SIZE )\r
1427                         {\r
1428                                 /* Block doesn't start on page boundary.\r
1429                                    Burn first partial page separately. */\r
1430                                 memset( &page, 0xff, sizeof(page) );\r
1431                                 memcpy( &page[offset % FLASH_PAGE_SIZE],\r
1432                                         buffer,\r
1433                                         FLASH_PAGE_SIZE - (offset % FLASH_PAGE_SIZE) );\r
1434                                 this_npages = 1;\r
1435                                 this_buffer = &page[0];\r
1436                                 count = count + (offset % FLASH_PAGE_SIZE);\r
1437                                 offset = offset - (offset % FLASH_PAGE_SIZE);\r
1438                         }\r
1439                         else if( count < FLASH_PAGE_SIZE )\r
1440                         {\r
1441                                 /* Download last incomplete page separately. */\r
1442                                 memset( &page, 0xff, sizeof(page) );\r
1443                                 memcpy( &page, buffer, count );\r
1444                                 this_npages = 1;\r
1445                                 this_buffer = &page[0];\r
1446                                 count = FLASH_PAGE_SIZE;\r
1447                         }\r
1448                         else\r
1449                         {\r
1450                                 /* Download as many full pages as possible */\r
1451                                 this_npages = (count < buffer_size) ?\r
1452                                                count / FLASH_PAGE_SIZE :\r
1453                                                buffer_size / FLASH_PAGE_SIZE;\r
1454                                 this_buffer = buffer;\r
1455 \r
1456                                 /* Make sure we stop at the next secured sector */\r
1457                                 int sector = start_sector + 1;\r
1458                                 while( sector < bank->num_sectors )\r
1459                                 {\r
1460                                         /* Secured? */\r
1461                                         if( bank->sectors[sector].is_protected )\r
1462                                         {\r
1463                                                 /* Is that next sector within the current block? */\r
1464                                                 if( (bank->sectors[sector].offset - bank->base) <\r
1465                                                         (offset + (this_npages * FLASH_PAGE_SIZE)) )\r
1466                                                 {\r
1467                                                         /* Yes! Split the block */\r
1468                                                         this_npages =\r
1469                                                           (bank->sectors[sector].offset - bank->base - offset)\r
1470                                                               / FLASH_PAGE_SIZE;\r
1471                                                         break;\r
1472                                                 }\r
1473                                         }\r
1474 \r
1475                                         sector++;\r
1476                                 }\r
1477                         }\r
1478 \r
1479                         /* Skip the current sector if it is secured */\r
1480                         if( bank->sectors[start_sector].is_protected )\r
1481                         {\r
1482                                 LOG_DEBUG( "Skip secured sector %" PRIu32, start_sector );\r
1483 \r
1484                                 /* Stop if this is the last sector */\r
1485                                 if( start_sector == bank->num_sectors - 1 )\r
1486                                 {\r
1487                                         break;\r
1488                                 }\r
1489 \r
1490                                 /* Skip */\r
1491                                 uint32_t nskip = bank->sectors[start_sector].size -\r
1492                                                  (offset % bank->sectors[start_sector].size);\r
1493                                 offset += nskip;\r
1494                                 buffer += nskip;\r
1495                                 count = (count >= nskip) ? (count - nskip) : 0;\r
1496                                 continue;\r
1497                         }\r
1498 \r
1499                         /* Execute buffer download */\r
1500                         if ((retval = target_write_buffer(target,\r
1501                                                           warea->address,\r
1502                                                           this_npages * FLASH_PAGE_SIZE,\r
1503                                                           this_buffer)) != ERROR_OK)\r
1504                         {\r
1505                                 LOG_ERROR("Unable to write data to target");\r
1506                                 target_free_all_working_areas(target);\r
1507                                 return ERROR_FLASH_OPERATION_FAILED;\r
1508                         }\r
1509 \r
1510                         /* Prepare registers */\r
1511                         buf_set_u32(reg_params[0].value, 0, 32, warea->address);\r
1512                         buf_set_u32(reg_params[1].value, 0, 32, offset);\r
1513                         buf_set_u32(reg_params[2].value, 0, 32, this_npages);\r
1514                         buf_set_u32(reg_params[3].value, 0, 32, FCTR);\r
1515                         buf_set_u32(reg_params[4].value, 0, 32, FPTR_EN_T | prog_time);\r
1516 \r
1517                         /* Execute algorithm, assume breakpoint for last instruction */\r
1518                         armv4_5_info.common_magic = ARMV4_5_COMMON_MAGIC;\r
1519                         armv4_5_info.core_mode = ARMV4_5_MODE_SVC;\r
1520                         armv4_5_info.core_state = ARMV4_5_STATE_ARM;\r
1521 \r
1522                         retval = target_run_algorithm(target, 0, NULL, 5, reg_params,\r
1523                                 (warea->address) + buffer_size,\r
1524                                 (warea->address) + buffer_size + target_code_size - 4,\r
1525                                 10000, /* 10s should be enough for max. 16 KiB of data */\r
1526                                 &armv4_5_info);\r
1527 \r
1528                         if (retval != ERROR_OK)\r
1529                         {\r
1530                                 LOG_ERROR("Execution of flash algorithm failed.");\r
1531                                 target_free_all_working_areas(target);\r
1532                                 retval = ERROR_FLASH_OPERATION_FAILED;\r
1533                                 break;\r
1534                         }\r
1535 \r
1536                         count -= this_npages * FLASH_PAGE_SIZE;\r
1537                         buffer += this_npages * FLASH_PAGE_SIZE;\r
1538                         offset += this_npages * FLASH_PAGE_SIZE;\r
1539                 }\r
1540 \r
1541                 /* Free all resources */\r
1542                 destroy_reg_param(&reg_params[0]);\r
1543                 destroy_reg_param(&reg_params[1]);\r
1544                 destroy_reg_param(&reg_params[2]);\r
1545                 destroy_reg_param(&reg_params[3]);\r
1546                 destroy_reg_param(&reg_params[4]);\r
1547                 target_free_all_working_areas(target);\r
1548         }\r
1549         else\r
1550         {\r
1551                 /* Write to flash memory page-wise */\r
1552                 while ( count != 0 )\r
1553                 {\r
1554                         /* How many bytes do we copy this time? */\r
1555                         num_bytes = (count >= FLASH_PAGE_SIZE) ?\r
1556                                     FLASH_PAGE_SIZE - (offset % FLASH_PAGE_SIZE) :\r
1557                                     count;\r
1558 \r
1559                         /* Don't do anything with it if the page is in a secured sector. */\r
1560                         if ( !bank->sectors[lpc2900_address2sector(bank, offset)].is_protected )\r
1561                         {\r
1562                                 /* Set latch load mode */\r
1563                                 target_write_u32(target, FCTR,\r
1564                                                  FCTR_FS_CS | FCTR_FS_WRE | FCTR_FS_WEB);\r
1565 \r
1566                                 /* Always clear the buffer (a little overhead, but who cares) */\r
1567                                 memset(page, 0xFF, FLASH_PAGE_SIZE);\r
1568 \r
1569                                 /* Copy them to the buffer */\r
1570                                 memcpy( &page[offset % FLASH_PAGE_SIZE],\r
1571                                         &buffer[offset % FLASH_PAGE_SIZE],\r
1572                                         num_bytes );\r
1573 \r
1574                                 /* Write whole page to flash data latches */\r
1575                                 if (target_write_memory(\r
1576                                                  target,\r
1577                                                  bank->base + (offset - (offset % FLASH_PAGE_SIZE)),\r
1578                                                  4, FLASH_PAGE_SIZE / 4, page) != ERROR_OK)\r
1579                                 {\r
1580                                         LOG_ERROR("Write failed @ 0x%8.8" PRIx32, offset);\r
1581                                         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);\r
1582 \r
1583                                         return ERROR_FLASH_OPERATION_FAILED;\r
1584                                 }\r
1585 \r
1586                                 /* Clear END_OF_BURN interrupt status */\r
1587                                 target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_BURN);\r
1588 \r
1589                                 /* Set the programming time */\r
1590                                 target_write_u32(target, FPTR, FPTR_EN_T | prog_time);\r
1591 \r
1592                                 /* Trigger flash write */\r
1593                                 target_write_u32(target, FCTR,\r
1594                                     FCTR_FS_CS | FCTR_FS_WRE | FCTR_FS_WPB | FCTR_FS_PROGREQ);\r
1595 \r
1596                                 /* Wait for the end of the write operation. If it's not over\r
1597                                  * after one second, something went dreadfully wrong... :-(\r
1598                                  */\r
1599                                 if (lpc2900_wait_status(bank, INTSRC_END_OF_BURN, 1000) != ERROR_OK)\r
1600                                 {\r
1601                                         LOG_ERROR("Write failed @ 0x%8.8" PRIx32, offset);\r
1602                                         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);\r
1603 \r
1604                                         return ERROR_FLASH_OPERATION_FAILED;\r
1605                                 }\r
1606                         }\r
1607 \r
1608                         /* Update pointers and counters */\r
1609                         offset += num_bytes;\r
1610                         buffer += num_bytes;\r
1611                         count -= num_bytes;\r
1612                 }\r
1613 \r
1614                 retval = ERROR_OK;\r
1615         }\r
1616 \r
1617         /* Normal flash operating mode */\r
1618         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);\r
1619 \r
1620         return retval;\r
1621 }\r
1622 \r
1623 \r
1624 /**\r
1625  * Try and identify the device.\r
1626  *\r
1627  * Determine type number and its memory layout.\r
1628  *\r
1629  * @param bank Pointer to the flash bank descriptor\r
1630  */\r
1631 static int lpc2900_probe(struct flash_bank_s *bank)\r
1632 {\r
1633         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;\r
1634         target_t *target = bank->target;\r
1635         int i = 0;\r
1636         uint32_t offset;\r
1637 \r
1638 \r
1639         if (target->state != TARGET_HALTED)\r
1640         {\r
1641                 LOG_ERROR("Target not halted");\r
1642                 return ERROR_TARGET_NOT_HALTED;\r
1643         }\r
1644 \r
1645         /* We want to do this only once. Check if we already have a valid CHIPID,\r
1646          * because then we will have already successfully probed the device.\r
1647          */\r
1648         if (lpc2900_info->chipid == EXPECTED_CHIPID)\r
1649         {\r
1650                 return ERROR_OK;\r
1651         }\r
1652 \r
1653         /* Probing starts with reading the CHIPID register. We will continue only\r
1654          * if this identifies as an LPC2900 device.\r
1655          */\r
1656         target_read_u32(target, CHIPID, &lpc2900_info->chipid);\r
1657 \r
1658         if (lpc2900_info->chipid != EXPECTED_CHIPID)\r
1659         {\r
1660                 LOG_WARNING("Device is not an LPC29xx");\r
1661                 return ERROR_FLASH_OPERATION_FAILED;\r
1662         }\r
1663 \r
1664         /* It's an LPC29xx device. Now read the feature register FEAT0...FEAT3. */\r
1665         uint32_t feat0, feat1, feat2, feat3;\r
1666         target_read_u32(target, FEAT0, &feat0);\r
1667         target_read_u32(target, FEAT1, &feat1);\r
1668         target_read_u32(target, FEAT2, &feat2);\r
1669         target_read_u32(target, FEAT3, &feat3);\r
1670 \r
1671         /* Base address */\r
1672         bank->base = 0x20000000;\r
1673 \r
1674         /* Determine flash layout from FEAT2 register */\r
1675         uint32_t num_64k_sectors = (feat2 >> 16) & 0xFF;\r
1676         uint32_t num_8k_sectors = (feat2 >> 0) & 0xFF;\r
1677         bank->num_sectors = num_64k_sectors + num_8k_sectors;\r
1678         bank->size = KiB * (64 * num_64k_sectors + 8 * num_8k_sectors);\r
1679 \r
1680         /* Determine maximum contiguous RAM block */\r
1681         lpc2900_info->max_ram_block = 16 * KiB;\r
1682         if( (feat1 & 0x30) == 0x30 )\r
1683         {\r
1684                 lpc2900_info->max_ram_block = 32 * KiB;\r
1685                 if( (feat1 & 0x0C) == 0x0C )\r
1686                 {\r
1687                         lpc2900_info->max_ram_block = 48 * KiB;\r
1688                 }\r
1689         }\r
1690 \r
1691         /* Determine package code and ITCM size */\r
1692         uint32_t package_code = feat0 & 0x0F;\r
1693         uint32_t itcm_code = (feat1 >> 16) & 0x1F;\r
1694 \r
1695         /* Determine the exact type number. */\r
1696         uint32_t found = 1;\r
1697         if ( (package_code == 4) && (itcm_code == 5) )\r
1698         {\r
1699                 /* Old LPC2917 or LPC2919 (non-/01 devices) */\r
1700                 lpc2900_info->target_name = (bank->size == 768*KiB) ? "LPC2919" : "LPC2917";\r
1701         }\r
1702         else\r
1703         {\r
1704                 if ( package_code == 2 )\r
1705                 {\r
1706                         /* 100-pin package */\r
1707                         if ( bank->size == 128*KiB )\r
1708                         {\r
1709                                 lpc2900_info->target_name = "LPC2921";\r
1710                         }\r
1711                         else if ( bank->size == 256*KiB )\r
1712                         {\r
1713                                 lpc2900_info->target_name = "LPC2923";\r
1714                         }\r
1715                         else if ( bank->size == 512*KiB )\r
1716                         {\r
1717                                 lpc2900_info->target_name = "LPC2925";\r
1718                         }\r
1719                         else\r
1720                         {\r
1721                                 found = 0;\r
1722                         }\r
1723                 }\r
1724                 else if ( package_code == 4 )\r
1725                 {\r
1726                         /* 144-pin package */\r
1727                         if ( (bank->size == 512*KiB) && (feat3 == 0xFFFFFCF0) )\r
1728                         {\r
1729                                 lpc2900_info->target_name = "LPC2917/01";\r
1730                         }\r
1731                         else if ( (bank->size == 512*KiB) && (feat3 == 0xFFFFFFF1) )\r
1732                         {\r
1733                                 lpc2900_info->target_name = "LPC2927";\r
1734                         }\r
1735                         else if ( (bank->size == 768*KiB) && (feat3 == 0xFFFFFCF8) )\r
1736                         {\r
1737                                 lpc2900_info->target_name = "LPC2919/01";\r
1738                         }\r
1739                         else if ( (bank->size == 768*KiB) && (feat3 == 0xFFFFFFF9) )\r
1740                         {\r
1741                                 lpc2900_info->target_name = "LPC2929";\r
1742                         }\r
1743                         else\r
1744                         {\r
1745                                 found = 0;\r
1746                         }\r
1747                 }\r
1748                 else if ( package_code == 5 )\r
1749                 {\r
1750                         /* 208-pin package */\r
1751                         lpc2900_info->target_name = (bank->size == 0) ? "LPC2930" : "LPC2939";\r
1752                 }\r
1753                 else\r
1754                 {\r
1755                         found = 0;\r
1756                 }\r
1757         }\r
1758 \r
1759         if ( !found )\r
1760         {\r
1761                 LOG_WARNING("Unknown LPC29xx derivative");\r
1762                 return ERROR_FLASH_OPERATION_FAILED;\r
1763         }\r
1764 \r
1765         /* Show detected device */\r
1766         LOG_INFO("Flash bank %" PRIu32\r
1767                  ": Device %s, %" PRIu32\r
1768                  " KiB in %" PRIu32 " sectors",\r
1769                  bank->bank_number,\r
1770                  lpc2900_info->target_name, bank->size / KiB,\r
1771                  bank->num_sectors);\r
1772 \r
1773         /* Flashless devices cannot be handled */\r
1774         if ( bank->num_sectors == 0 )\r
1775         {\r
1776                 LOG_WARNING("Flashless device cannot be handled");\r
1777                 return ERROR_FLASH_OPERATION_FAILED;\r
1778         }\r
1779 \r
1780         /* Sector layout.\r
1781          * These are logical sector numbers. When doing real flash operations,\r
1782          * the logical flash number are translated into the physical flash numbers\r
1783          * of the device.\r
1784          */\r
1785         bank->sectors = malloc(sizeof(flash_sector_t) * bank->num_sectors);\r
1786 \r
1787         offset = 0;\r
1788         for (i = 0; i < bank->num_sectors; i++)\r
1789         {\r
1790                 bank->sectors[i].offset = offset;\r
1791                 bank->sectors[i].is_erased = -1;\r
1792                 bank->sectors[i].is_protected = -1;\r
1793 \r
1794                 if ( i <= 7 )\r
1795                 {\r
1796                         bank->sectors[i].size = 8 * KiB;\r
1797                 }\r
1798                 else if ( i <= 18 )\r
1799                 {\r
1800                         bank->sectors[i].size = 64 * KiB;\r
1801                 }\r
1802                 else\r
1803                 {\r
1804                         /* We shouldn't come here. But there might be a new part out there\r
1805                          * that has more than 19 sectors. Politely ask for a fix then.\r
1806                          */\r
1807                         bank->sectors[i].size = 0;\r
1808                         LOG_ERROR("Never heard about sector %" PRIu32 " (FIXME please)", i);\r
1809                 }\r
1810 \r
1811                 offset += bank->sectors[i].size;\r
1812         }\r
1813 \r
1814         /* Read sector security status */\r
1815         if ( lpc2900_read_security_status(bank) != ERROR_OK )\r
1816         {\r
1817                 LOG_ERROR("Cannot determine sector security status");\r
1818                 return ERROR_FLASH_OPERATION_FAILED;\r
1819         }\r
1820 \r
1821         return ERROR_OK;\r
1822 }\r
1823 \r
1824 \r
1825 /**\r
1826  * Run a blank check for each sector.\r
1827  *\r
1828  * For speed reasons, the device isn't read word by word.\r
1829  * A hash value is calculated by the hardware ("BIST") for each sector.\r
1830  * This value is then compared against the known hash of an empty sector.\r
1831  *\r
1832  * @param bank Pointer to the flash bank descriptor\r
1833  */\r
1834 static int lpc2900_erase_check(struct flash_bank_s *bank)\r
1835 {\r
1836         uint32_t status = lpc2900_is_ready(bank);\r
1837         if (status != ERROR_OK)\r
1838         {\r
1839                 LOG_INFO("Processor not halted/not probed");\r
1840                 return status;\r
1841         }\r
1842 \r
1843         /* Use the BIST (Built-In Selft Test) to generate a signature of each flash\r
1844          * sector. Compare against the expected signature of an empty sector.\r
1845          */\r
1846         int sector;\r
1847         for ( sector = 0; sector < bank->num_sectors; sector++ )\r
1848         {\r
1849                 uint32_t signature[4];\r
1850                 if ( (status = lpc2900_run_bist128( bank,\r
1851                                                     bank->sectors[sector].offset,\r
1852                                                     bank->sectors[sector].offset +\r
1853                                                        (bank->sectors[sector].size - 1),\r
1854                                                     &signature)) != ERROR_OK )\r
1855                 {\r
1856                         return status;\r
1857                 }\r
1858 \r
1859                 /* The expected signatures for an empty sector are different\r
1860                  * for 8 KiB and 64 KiB sectors.\r
1861                  */\r
1862                 if ( bank->sectors[sector].size == 8*KiB )\r
1863                 {\r
1864                         bank->sectors[sector].is_erased =\r
1865                             (signature[3] == 0x01ABAAAA) &&\r
1866                             (signature[2] == 0xAAAAAAAA) &&\r
1867                             (signature[1] == 0xAAAAAAAA) &&\r
1868                             (signature[0] == 0xAAA00AAA);\r
1869                 }\r
1870                 if ( bank->sectors[sector].size == 64*KiB )\r
1871                 {\r
1872                         bank->sectors[sector].is_erased =\r
1873                             (signature[3] == 0x11801222) &&\r
1874                             (signature[2] == 0xB88844FF) &&\r
1875                             (signature[1] == 0x11A22008) &&\r
1876                             (signature[0] == 0x2B1BFE44);\r
1877                 }\r
1878         }\r
1879 \r
1880         return ERROR_OK;\r
1881 }\r
1882 \r
1883 \r
1884 /**\r
1885  * Get protection (sector security) status.\r
1886  *\r
1887  * Determine the status of "sector security" for each sector.\r
1888  * A secured sector is one that can never be erased/programmed again.\r
1889  *\r
1890  * @param bank Pointer to the flash bank descriptor\r
1891  */\r
1892 static int lpc2900_protect_check(struct flash_bank_s *bank)\r
1893 {\r
1894         return lpc2900_read_security_status(bank);\r
1895 }\r
1896 \r
1897 \r
1898 /**\r
1899  * Print info about the driver (not the device).\r
1900  *\r
1901  * @param bank Pointer to the flash bank descriptor\r
1902  * @param buf Buffer to take the string\r
1903  * @param buf_size Maximum number of characters that the buffer can take\r
1904  */\r
1905 static int lpc2900_info(struct flash_bank_s *bank, char *buf, int buf_size)\r
1906 {\r
1907         snprintf(buf, buf_size, "lpc2900 flash driver");\r
1908 \r
1909         return ERROR_OK;\r
1910 }\r
1911 \r
1912 \r
1913 flash_driver_t lpc2900_flash =\r
1914 {\r
1915         .name               = "lpc2900",\r
1916         .register_commands  = lpc2900_register_commands,\r
1917         .flash_bank_command = lpc2900_flash_bank_command,\r
1918         .erase              = lpc2900_erase,\r
1919         .protect            = lpc2900_protect,\r
1920         .write              = lpc2900_write,\r
1921         .probe              = lpc2900_probe,\r
1922         .auto_probe         = lpc2900_probe,\r
1923         .erase_check        = lpc2900_erase_check,\r
1924         .protect_check      = lpc2900_protect_check,\r
1925         .info               = lpc2900_info\r
1926 };\r