Merge commit 'origin/master'
[fw/openocd] / src / flash / lpc2900.c
1 /***************************************************************************
2  *   Copyright (C) 2009 by                                                 *
3  *   Rolf Meeser <rolfm_9dq@yahoo.de>                                      *
4  *                                                                         *
5  *   This program is free software; you can redistribute it and/or modify  *
6  *   it under the terms of the GNU General Public License as published by  *
7  *   the Free Software Foundation; either version 2 of the License, or     *
8  *   (at your option) any later version.                                   *
9  *                                                                         *
10  *   This program is distributed in the hope that it will be useful,       *
11  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
12  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
13  *   GNU General Public License for more details.                          *
14  *                                                                         *
15  *   You should have received a copy of the GNU General Public License     *
16  *   along with this program; if not, write to the                         *
17  *   Free Software Foundation, Inc.,                                       *
18  *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
19  ***************************************************************************/
20
21 #ifdef HAVE_CONFIG_H
22 #include "config.h"
23 #endif
24
25
26 #include "image.h"
27
28 #include "lpc2900.h"
29 #include "binarybuffer.h"
30 #include "armv4_5.h"
31
32
33 /* 1024 bytes */
34 #define KiB                 1024
35
36 /* Some flash constants */
37 #define FLASH_PAGE_SIZE     512     /* bytes */
38 #define FLASH_ERASE_TIME    100000  /* microseconds */
39 #define FLASH_PROGRAM_TIME  1000    /* microseconds */
40
41 /* Chip ID / Feature Registers */
42 #define CHIPID          0xE0000000  /* Chip ID */
43 #define FEAT0           0xE0000100  /* Chip feature 0 */
44 #define FEAT1           0xE0000104  /* Chip feature 1 */
45 #define FEAT2           0xE0000108  /* Chip feature 2 (contains flash size indicator) */
46 #define FEAT3           0xE000010C  /* Chip feature 3 */
47
48 #define EXPECTED_CHIPID 0x209CE02B  /* Chip ID of all LPC2900 devices */
49
50 /* Flash/EEPROM Control Registers */
51 #define FCTR            0x20200000  /* Flash control */
52 #define FPTR            0x20200008  /* Flash program-time */
53 #define FTCTR           0x2020000C  /* Flash test control */
54 #define FBWST           0x20200010  /* Flash bridge wait-state */
55 #define FCRA            0x2020001C  /* Flash clock divider */
56 #define FMSSTART        0x20200020  /* Flash Built-In Selft Test start address */
57 #define FMSSTOP         0x20200024  /* Flash Built-In Selft Test stop address */
58 #define FMS16           0x20200028  /* Flash 16-bit signature */
59 #define FMSW0           0x2020002C  /* Flash 128-bit signature Word 0 */
60 #define FMSW1           0x20200030  /* Flash 128-bit signature Word 1 */
61 #define FMSW2           0x20200034  /* Flash 128-bit signature Word 2 */
62 #define FMSW3           0x20200038  /* Flash 128-bit signature Word 3 */
63
64 #define EECMD           0x20200080  /* EEPROM command */
65 #define EEADDR          0x20200084  /* EEPROM address */
66 #define EEWDATA         0x20200088  /* EEPROM write data */
67 #define EERDATA         0x2020008C  /* EEPROM read data */
68 #define EEWSTATE        0x20200090  /* EEPROM wait state */
69 #define EECLKDIV        0x20200094  /* EEPROM clock divider */
70 #define EEPWRDWN        0x20200098  /* EEPROM power-down/start */
71 #define EEMSSTART       0x2020009C  /* EEPROM BIST start address */
72 #define EEMSSTOP        0x202000A0  /* EEPROM BIST stop address */
73 #define EEMSSIG         0x202000A4  /* EEPROM 24-bit BIST signature */
74
75 #define INT_CLR_ENABLE  0x20200FD8  /* Flash/EEPROM interrupt clear enable */
76 #define INT_SET_ENABLE  0x20200FDC  /* Flash/EEPROM interrupt set enable */
77 #define INT_STATUS      0x20200FE0  /* Flash/EEPROM interrupt status */
78 #define INT_ENABLE      0x20200FE4  /* Flash/EEPROM interrupt enable */
79 #define INT_CLR_STATUS  0x20200FE8  /* Flash/EEPROM interrupt clear status */
80 #define INT_SET_STATUS  0x20200FEC  /* Flash/EEPROM interrupt set status */
81
82 /* Interrupt sources */
83 #define INTSRC_END_OF_PROG    (1 << 28)
84 #define INTSRC_END_OF_BIST    (1 << 27)
85 #define INTSRC_END_OF_RDWR    (1 << 26)
86 #define INTSRC_END_OF_MISR    (1 << 2)
87 #define INTSRC_END_OF_BURN    (1 << 1)
88 #define INTSRC_END_OF_ERASE   (1 << 0)
89
90
91 /* FCTR bits */
92 #define FCTR_FS_LOADREQ       (1 << 15)
93 #define FCTR_FS_CACHECLR      (1 << 14)
94 #define FCTR_FS_CACHEBYP      (1 << 13)
95 #define FCTR_FS_PROGREQ       (1 << 12)
96 #define FCTR_FS_RLS           (1 << 11)
97 #define FCTR_FS_PDL           (1 << 10)
98 #define FCTR_FS_PD            (1 << 9)
99 #define FCTR_FS_WPB           (1 << 7)
100 #define FCTR_FS_ISS           (1 << 6)
101 #define FCTR_FS_RLD           (1 << 5)
102 #define FCTR_FS_DCR           (1 << 4)
103 #define FCTR_FS_WEB           (1 << 2)
104 #define FCTR_FS_WRE           (1 << 1)
105 #define FCTR_FS_CS            (1 << 0)
106 /* FPTR bits */
107 #define FPTR_EN_T             (1 << 15)
108 /* FTCTR bits */
109 #define FTCTR_FS_BYPASS_R     (1 << 29)
110 #define FTCTR_FS_BYPASS_W     (1 << 28)
111 /* FMSSTOP bits */
112 #define FMSSTOP_MISR_START    (1 << 17)
113 /* EEMSSTOP bits */
114 #define EEMSSTOP_STRTBIST     (1 << 31)
115
116 /* Index sector */
117 #define ISS_CUSTOMER_START1   (0x830)
118 #define ISS_CUSTOMER_END1     (0xA00)
119 #define ISS_CUSTOMER_SIZE1    (ISS_CUSTOMER_END1 - ISS_CUSTOMER_START1)
120 #define ISS_CUSTOMER_NWORDS1  (ISS_CUSTOMER_SIZE1 / 4)
121 #define ISS_CUSTOMER_START2   (0xA40)
122 #define ISS_CUSTOMER_END2     (0xC00)
123 #define ISS_CUSTOMER_SIZE2    (ISS_CUSTOMER_END2 - ISS_CUSTOMER_START2)
124 #define ISS_CUSTOMER_NWORDS2  (ISS_CUSTOMER_SIZE2 / 4)
125 #define ISS_CUSTOMER_SIZE     (ISS_CUSTOMER_SIZE1 + ISS_CUSTOMER_SIZE2)
126
127
128
129 /**
130  * Private data for \c lpc2900 flash driver.
131  */
132 typedef struct lpc2900_flash_bank_s
133 {
134         /**
135          * Holds the value read from CHIPID register.
136          * The driver will not load if the chipid doesn't match the expected
137          * value of 0x209CE02B of the LPC2900 family. A probe will only be done
138          * if the chipid does not yet contain the expected value.
139          */
140         uint32_t chipid;
141
142         /**
143          * String holding device name.
144          * This string is set by the probe function to the type number of the
145          * device. It takes the form "LPC29xx".
146          */
147         char * target_name;
148
149         /**
150          * System clock frequency.
151          * Holds the clock frequency in Hz, as passed by the configuration file
152          * to the <tt>flash bank</tt> command.
153          */
154         uint32_t clk_sys_fmc;
155
156         /**
157          * Flag to indicate that dangerous operations are possible.
158          * This flag can be set by passing the correct password to the
159          * <tt>lpc2900 password</tt> command. If set, other dangerous commands,
160          * which operate on the index sector, can be executed.
161          */
162         uint32_t risky;
163
164         /**
165          * Maximum contiguous block of internal SRAM (bytes).
166          * Autodetected by the driver. Not the total amount of SRAM, only the
167          * the largest \em contiguous block!
168          */
169         uint32_t max_ram_block;
170
171 } lpc2900_flash_bank_t;
172
173
174
175
176 static int lpc2900_register_commands(struct command_context_s *cmd_ctx);
177 static int lpc2900_flash_bank_command(struct command_context_s *cmd_ctx,
178                                       char *cmd, char **args, int argc,
179                                       struct flash_bank_s *bank);
180 static int lpc2900_erase(struct flash_bank_s *bank, int first, int last);
181 static int lpc2900_protect(struct flash_bank_s *bank, int set, int first, int last);
182 static int lpc2900_write(struct flash_bank_s *bank,
183                          uint8_t *buffer, uint32_t offset, uint32_t count);
184 static int lpc2900_probe(struct flash_bank_s *bank);
185 static int lpc2900_erase_check(struct flash_bank_s *bank);
186 static int lpc2900_protect_check(struct flash_bank_s *bank);
187 static int lpc2900_info(struct flash_bank_s *bank, char *buf, int buf_size);
188
189 static uint32_t lpc2900_wait_status(flash_bank_t *bank, uint32_t mask, int timeout);
190 static void lpc2900_setup(struct flash_bank_s *bank);
191 static uint32_t lpc2900_is_ready(struct flash_bank_s *bank);
192 static uint32_t lpc2900_read_security_status(struct flash_bank_s *bank);
193 static uint32_t lpc2900_run_bist128(struct flash_bank_s *bank,
194                                     uint32_t addr_from, uint32_t addr_to,
195                                     uint32_t (*signature)[4] );
196 static uint32_t lpc2900_address2sector(struct flash_bank_s *bank, uint32_t offset);
197 static uint32_t lpc2900_calc_tr( uint32_t clock, uint32_t time );
198
199
200 /***********************  Helper functions  **************************/
201
202
203 /**
204  * Wait for an event in mask to occur in INT_STATUS.
205  *
206  * Return when an event occurs, or after a timeout.
207  *
208  * @param[in] bank Pointer to the flash bank descriptor
209  * @param[in] mask Mask to be used for INT_STATUS
210  * @param[in] timeout Timeout in ms
211  */
212 static uint32_t lpc2900_wait_status( flash_bank_t *bank,
213                                      uint32_t mask,
214                                      int timeout )
215 {
216         uint32_t int_status;
217         target_t *target = bank->target;
218
219
220         do
221         {
222                 alive_sleep(1);
223                 timeout--;
224                 target_read_u32(target, INT_STATUS, &int_status);
225         }
226         while( ((int_status & mask) == 0) && (timeout != 0) );
227
228         if (timeout == 0)
229         {
230                 LOG_DEBUG("Timeout!");
231                 return ERROR_FLASH_OPERATION_FAILED;
232         }
233
234         return ERROR_OK;
235 }
236
237
238
239 /**
240  * Set up the flash for erase/program operations.
241  *
242  * Enable the flash, and set the correct CRA clock of 66 kHz.
243  *
244  * @param bank Pointer to the flash bank descriptor
245  */
246 static void lpc2900_setup( struct flash_bank_s *bank )
247 {
248         uint32_t fcra;
249         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
250
251
252         /* Power up the flash block */
253         target_write_u32( bank->target, FCTR, FCTR_FS_WEB | FCTR_FS_CS );
254
255
256         fcra = (lpc2900_info->clk_sys_fmc / (3 * 66000)) - 1;
257         target_write_u32( bank->target, FCRA, fcra );
258 }
259
260
261
262 /**
263  * Check if device is ready.
264  *
265  * Check if device is ready for flash operation:
266  * Must have been successfully probed.
267  * Must be halted.
268  */
269 static uint32_t lpc2900_is_ready( struct flash_bank_s *bank )
270 {
271         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
272
273         if( lpc2900_info->chipid != EXPECTED_CHIPID )
274         {
275                 return ERROR_FLASH_BANK_NOT_PROBED;
276         }
277
278         if( bank->target->state != TARGET_HALTED )
279         {
280                 LOG_ERROR( "Target not halted" );
281                 return ERROR_TARGET_NOT_HALTED;
282         }
283
284         return ERROR_OK;
285 }
286
287
288 /**
289  * Read the status of sector security from the index sector.
290  *
291  * @param bank Pointer to the flash bank descriptor
292  */
293 static uint32_t lpc2900_read_security_status( struct flash_bank_s *bank )
294 {
295         uint32_t status;
296         if( (status = lpc2900_is_ready( bank )) != ERROR_OK )
297         {
298                 return status;
299         }
300
301         target_t *target = bank->target;
302
303         /* Enable ISS access */
304         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB | FCTR_FS_ISS);
305
306         /* Read the relevant block of memory from the ISS sector */
307         uint32_t iss_secured_field[ 0x230/16 ][ 4 ];
308         target_read_memory(target, bank->base + 0xC00, 4, 0x230/4,
309                                    (uint8_t *)iss_secured_field);
310
311         /* Disable ISS access */
312         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
313
314         /* Check status of each sector. Note that the sector numbering in the LPC2900
315          * is different from the logical sector numbers used in OpenOCD!
316          * Refer to the user manual for details.
317          *
318          * All zeros (16x 0x00) are treated as a secured sector (is_protected = 1)
319          * All ones (16x 0xFF) are treated as a non-secured sector (is_protected = 0)
320          * Anything else is undefined (is_protected = -1). This is treated as
321          * a protected sector!
322          */
323         int sector;
324         int index;
325         for( sector = 0; sector < bank->num_sectors; sector++ )
326         {
327                 /* Convert logical sector number to physical sector number */
328                 if( sector <= 4 )
329                 {
330                         index = sector + 11;
331                 }
332                 else if( sector <= 7 )
333                 {
334                         index = sector + 27;
335                 }
336                 else
337                 {
338                         index = sector - 8;
339                 }
340
341                 bank->sectors[sector].is_protected = -1;
342
343                 if (
344                     (iss_secured_field[index][0] == 0x00000000) &&
345                     (iss_secured_field[index][1] == 0x00000000) &&
346                     (iss_secured_field[index][2] == 0x00000000) &&
347                     (iss_secured_field[index][3] == 0x00000000) )
348                 {
349                         bank->sectors[sector].is_protected = 1;
350                 }
351
352                 if (
353                     (iss_secured_field[index][0] == 0xFFFFFFFF) &&
354                     (iss_secured_field[index][1] == 0xFFFFFFFF) &&
355                     (iss_secured_field[index][2] == 0xFFFFFFFF) &&
356                     (iss_secured_field[index][3] == 0xFFFFFFFF) )
357                 {
358                         bank->sectors[sector].is_protected = 0;
359                 }
360         }
361
362         return ERROR_OK;
363 }
364
365
366 /**
367  * Use BIST to calculate a 128-bit hash value over a range of flash.
368  *
369  * @param bank Pointer to the flash bank descriptor
370  * @param addr_from
371  * @param addr_to
372  * @param signature
373  */
374 static uint32_t lpc2900_run_bist128(struct flash_bank_s *bank,
375                                     uint32_t addr_from,
376                                     uint32_t addr_to,
377                                     uint32_t (*signature)[4] )
378 {
379         target_t *target = bank->target;
380
381         /* Clear END_OF_MISR interrupt status */
382         target_write_u32( target, INT_CLR_STATUS, INTSRC_END_OF_MISR );
383
384         /* Start address */
385         target_write_u32( target, FMSSTART, addr_from >> 4);
386         /* End address, and issue start command */
387         target_write_u32( target, FMSSTOP, (addr_to >> 4) | FMSSTOP_MISR_START );
388
389         /* Poll for end of operation. Calculate a reasonable timeout. */
390         if( lpc2900_wait_status( bank, INTSRC_END_OF_MISR, 1000 ) != ERROR_OK )
391         {
392                 return ERROR_FLASH_OPERATION_FAILED;
393         }
394
395         /* Return the signature */
396         target_read_memory( target, FMSW0, 4, 4, (uint8_t *)signature );
397
398         return ERROR_OK;
399 }
400
401
402 /**
403  * Return sector number for given address.
404  *
405  * Return the (logical) sector number for a given relative address.
406  * No sanity check is done. It assumed that the address is valid.
407  *
408  * @param bank Pointer to the flash bank descriptor
409  * @param offset Offset address relative to bank start
410  */
411 static uint32_t lpc2900_address2sector( struct flash_bank_s *bank,
412                                         uint32_t offset )
413 {
414         uint32_t address = bank->base + offset;
415
416
417         /* Run through all sectors of this bank */
418         int sector;
419         for( sector = 0; sector < bank->num_sectors; sector++ )
420         {
421                 /* Return immediately if address is within the current sector */
422                 if( address < (bank->sectors[sector].offset + bank->sectors[sector].size) )
423                 {
424                         return sector;
425                 }
426         }
427
428         /* We should never come here. If we do, return an arbitrary sector number. */
429         return 0;
430 }
431
432
433
434
435 /**
436  * Write one page to the index sector.
437  *
438  * @param bank Pointer to the flash bank descriptor
439  * @param pagenum Page number (0...7)
440  * @param page Page array (FLASH_PAGE_SIZE bytes)
441  */
442 static int lpc2900_write_index_page( struct flash_bank_s *bank,
443                                      int pagenum,
444                                      uint8_t (*page)[FLASH_PAGE_SIZE] )
445 {
446         /* Only pages 4...7 are user writable */
447         if ((pagenum < 4) || (pagenum > 7))
448         {
449                 LOG_ERROR("Refuse to burn index sector page %d", pagenum);
450                 return ERROR_COMMAND_ARGUMENT_INVALID;
451         }
452
453         /* Get target, and check if it's halted */
454         target_t *target = bank->target;
455         if( target->state != TARGET_HALTED )
456         {
457                 LOG_ERROR( "Target not halted" );
458                 return ERROR_TARGET_NOT_HALTED;
459         }
460
461         /* Private info */
462         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
463
464         /* Enable flash block and set the correct CRA clock of 66 kHz */
465         lpc2900_setup( bank );
466
467         /* Un-protect the index sector */
468         target_write_u32( target, bank->base, 0 );
469         target_write_u32( target, FCTR,
470                           FCTR_FS_LOADREQ | FCTR_FS_WPB | FCTR_FS_ISS |
471                           FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS );
472
473         /* Set latch load mode */
474         target_write_u32( target, FCTR,
475                           FCTR_FS_ISS | FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS );
476
477         /* Write whole page to flash data latches */
478         if( target_write_memory( target,
479                                  bank->base + pagenum * FLASH_PAGE_SIZE,
480                                  4, FLASH_PAGE_SIZE / 4, (uint8_t *)page) != ERROR_OK )
481         {
482                 LOG_ERROR("Index sector write failed @ page %d", pagenum);
483                 target_write_u32( target, FCTR, FCTR_FS_CS | FCTR_FS_WEB );
484
485                 return ERROR_FLASH_OPERATION_FAILED;
486         }
487
488         /* Clear END_OF_BURN interrupt status */
489         target_write_u32( target, INT_CLR_STATUS, INTSRC_END_OF_BURN );
490
491         /* Set the program/erase time to FLASH_PROGRAM_TIME */
492         target_write_u32(target, FPTR,
493                          FPTR_EN_T | lpc2900_calc_tr( lpc2900_info->clk_sys_fmc,
494                                                       FLASH_PROGRAM_TIME ));
495
496         /* Trigger flash write */
497         target_write_u32( target, FCTR,
498                           FCTR_FS_PROGREQ | FCTR_FS_ISS |
499                           FCTR_FS_WPB | FCTR_FS_WRE | FCTR_FS_CS );
500
501         /* Wait for the end of the write operation. If it's not over after one
502          * second, something went dreadfully wrong... :-(
503          */
504         if (lpc2900_wait_status(bank, INTSRC_END_OF_BURN, 1000) != ERROR_OK)
505         {
506                 LOG_ERROR("Index sector write failed @ page %d", pagenum);
507                 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
508
509                 return ERROR_FLASH_OPERATION_FAILED;
510         }
511
512         target_write_u32( target, FCTR, FCTR_FS_CS | FCTR_FS_WEB );
513
514         return ERROR_OK;
515 }
516
517
518
519 /**
520  * Calculate FPTR.TR register value for desired program/erase time.
521  *
522  * @param clock System clock in Hz
523  * @param time Program/erase time in Âµs
524  */
525 static uint32_t lpc2900_calc_tr( uint32_t clock, uint32_t time )
526 {
527         /*           ((time[µs]/1e6) * f[Hz]) + 511
528          * FPTR.TR = -------------------------------
529          *                         512
530          *
531          * The result is the 
532          */
533
534         uint32_t tr_val = (uint32_t)((((time / 1e6) * clock) + 511.0) / 512.0);
535
536         return tr_val;
537 }
538
539
540 /***********************  Private flash commands  **************************/
541
542
543 /**
544  * Command to determine the signature of the whole flash.
545  *
546  * Uses the Built-In-Self-Test (BIST) to generate a 128-bit hash value
547  * of the flash content.
548  *
549  * @param cmd_ctx
550  * @param cmd
551  * @param args
552  * @param argc
553  */
554 static int lpc2900_handle_signature_command( struct command_context_s *cmd_ctx,
555                                              char *cmd, char **args, int argc )
556 {
557         flash_bank_t *bank;
558         uint32_t status;
559         uint32_t signature[4];
560
561
562         if( argc < 1 )
563         {
564                 LOG_WARNING( "Too few arguments. Call: lpc2900 signature <bank#>" );
565                 return ERROR_FLASH_BANK_INVALID;
566         }
567
568         /* Get the bank descriptor */
569         bank = get_flash_bank_by_num( strtoul(args[0], NULL, 0) );
570         if( !bank )
571         {
572                 command_print( cmd_ctx, "flash bank '#%s' is out of bounds", args[0] );
573                 return ERROR_OK;
574         }
575
576         if( bank->target->state != TARGET_HALTED )
577         {
578                 LOG_ERROR( "Target not halted" );
579                 return ERROR_TARGET_NOT_HALTED;
580         }
581
582         /* Run BIST over whole flash range */
583         if( (status = lpc2900_run_bist128( bank,
584                                            bank->base,
585                                            bank->base + (bank->size - 1),
586                                            &signature)
587                                          ) != ERROR_OK )
588         {
589                 return status;
590         }
591
592         command_print( cmd_ctx, "signature: 0x%8.8" PRIx32
593                                           ":0x%8.8" PRIx32
594                                           ":0x%8.8" PRIx32
595                                           ":0x%8.8" PRIx32,
596                       signature[3], signature[2], signature[1], signature[0] );
597
598         return ERROR_OK;
599 }
600
601
602
603 /**
604  * Store customer info in file.
605  *
606  * Read customer info from index sector, and store that block of data into
607  * a disk file. The format is binary.
608  *
609  * @param cmd_ctx
610  * @param cmd
611  * @param args
612  * @param argc
613  */
614 static int lpc2900_handle_read_custom_command( struct command_context_s *cmd_ctx,
615                                                char *cmd, char **args, int argc )
616 {
617         flash_bank_t *bank;
618
619
620         if( argc < 2 )
621         {
622                 return ERROR_COMMAND_SYNTAX_ERROR;
623         }
624
625         /* Get the bank descriptor */
626         bank = get_flash_bank_by_num( strtoul(args[0], NULL, 0) );
627         if( !bank )
628         {
629                 command_print( cmd_ctx, "flash bank '#%s' is out of bounds", args[0] );
630                 return ERROR_OK;
631         }
632         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
633         lpc2900_info->risky = 0;
634
635         /* Get target, and check if it's halted */
636         target_t *target = bank->target;
637         if( target->state != TARGET_HALTED )
638         {
639                 LOG_ERROR( "Target not halted" );
640                 return ERROR_TARGET_NOT_HALTED;
641         }
642
643         /* Storage for customer info. Read in two parts */
644         uint32_t customer[ ISS_CUSTOMER_NWORDS1 + ISS_CUSTOMER_NWORDS2 ];
645
646         /* Enable access to index sector */
647         target_write_u32( target, FCTR, FCTR_FS_CS | FCTR_FS_WEB | FCTR_FS_ISS );
648
649         /* Read two parts */
650         target_read_memory( target, bank->base+ISS_CUSTOMER_START1, 4,
651                                     ISS_CUSTOMER_NWORDS1,
652                                     (uint8_t *)&customer[0] );
653         target_read_memory( target, bank->base+ISS_CUSTOMER_START2, 4,
654                                     ISS_CUSTOMER_NWORDS2,
655                                     (uint8_t *)&customer[ISS_CUSTOMER_NWORDS1] );
656
657         /* Deactivate access to index sector */
658         target_write_u32( target, FCTR, FCTR_FS_CS | FCTR_FS_WEB );
659
660         /* Try and open the file */
661         fileio_t fileio;
662         char *filename = args[1];
663         int ret = fileio_open( &fileio, filename, FILEIO_WRITE, FILEIO_BINARY );
664         if( ret != ERROR_OK )
665         {
666                 LOG_WARNING( "Could not open file %s", filename );
667                 return ret;
668         }
669
670         uint32_t nwritten;
671         ret = fileio_write( &fileio, sizeof(customer),
672                         (const uint8_t *)customer, &nwritten );
673         if( ret != ERROR_OK )
674         {
675                 LOG_ERROR( "Write operation to file %s failed", filename );
676                 fileio_close( &fileio );
677                 return ret;
678         }
679
680         fileio_close( &fileio );
681
682         return ERROR_OK;
683 }
684
685
686
687
688 /**
689  * Enter password to enable potentially dangerous options.
690  *
691  * @param cmd_ctx
692  * @param cmd
693  * @param args
694  * @param argc
695  */
696 static int lpc2900_handle_password_command(struct command_context_s *cmd_ctx,
697                                            char *cmd, char **args, int argc)
698 {
699         flash_bank_t *bank;
700
701
702         if (argc < 2)
703         {
704                 return ERROR_COMMAND_SYNTAX_ERROR;
705         }
706
707         /* Get the bank descriptor */
708         bank = get_flash_bank_by_num(strtoul(args[0], NULL, 0));
709         if (!bank)
710         {
711                 command_print(cmd_ctx, "flash bank '#%s' is out of bounds", args[0]);
712                 return ERROR_OK;
713         }
714         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
715
716 #define ISS_PASSWORD "I_know_what_I_am_doing"
717
718         lpc2900_info->risky = !strcmp( args[1], ISS_PASSWORD );
719
720         if( !lpc2900_info->risky )
721         {
722                 command_print(cmd_ctx, "Wrong password (use '%s')", ISS_PASSWORD);
723                 return ERROR_COMMAND_ARGUMENT_INVALID;
724         }
725
726         command_print(cmd_ctx,
727                   "Potentially dangerous operation allowed in next command!");
728
729         return ERROR_OK;
730 }
731
732
733
734 /**
735  * Write customer info from file to the index sector.
736  *
737  * @param cmd_ctx
738  * @param cmd
739  * @param args
740  * @param argc
741  */
742 static int lpc2900_handle_write_custom_command( struct command_context_s *cmd_ctx,
743                                                 char *cmd, char **args, int argc )
744 {
745         if (argc < 2)
746         {
747                 return ERROR_COMMAND_SYNTAX_ERROR;
748         }
749
750         /* Get the bank descriptor */
751         flash_bank_t *bank = get_flash_bank_by_num(strtoul(args[0], NULL, 0));
752         if (!bank)
753         {
754                 command_print(cmd_ctx, "flash bank '#%s' is out of bounds", args[0]);
755                 return ERROR_OK;
756         }
757         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
758
759         /* Check if command execution is allowed. */
760         if( !lpc2900_info->risky )
761         {
762                 command_print( cmd_ctx, "Command execution not allowed!" );
763                 return ERROR_COMMAND_ARGUMENT_INVALID;
764         }
765         lpc2900_info->risky = 0;
766
767         /* Get target, and check if it's halted */
768         target_t *target = bank->target;
769         if (target->state != TARGET_HALTED)
770         {
771                 LOG_ERROR("Target not halted");
772                 return ERROR_TARGET_NOT_HALTED;
773         }
774
775         /* The image will always start at offset 0 */
776         image_t image;
777         image.base_address_set = 1;
778         image.base_address = 0;
779         image.start_address_set = 0;
780
781         char *filename = args[1];
782         char *type = (argc >= 3) ? args[2] : NULL;
783         int retval = image_open(&image, filename, type);
784         if (retval != ERROR_OK)
785         {
786                 return retval;
787         }
788
789         /* Do a sanity check: The image must be exactly the size of the customer
790            programmable area. Any other size is rejected. */
791         if( image.num_sections != 1 )
792         {
793                 LOG_ERROR("Only one section allowed in image file.");
794                 return ERROR_COMMAND_SYNTAX_ERROR;
795         }
796         if( (image.sections[0].base_address != 0) ||
797         (image.sections[0].size != ISS_CUSTOMER_SIZE) )
798         {
799                 LOG_ERROR("Incorrect image file size. Expected %d, "
800                         "got %" PRIu32,
801                    ISS_CUSTOMER_SIZE, image.sections[0].size);
802                 return ERROR_COMMAND_SYNTAX_ERROR;
803         }
804
805         /* Well boys, I reckon this is it... */
806
807         /* Customer info is split into two blocks in pages 4 and 5. */
808         uint8_t page[FLASH_PAGE_SIZE];
809
810         /* Page 4 */
811         uint32_t offset = ISS_CUSTOMER_START1 % FLASH_PAGE_SIZE;
812         memset( page, 0xff, FLASH_PAGE_SIZE );
813         uint32_t size_read;
814         retval = image_read_section( &image, 0, 0,
815                                      ISS_CUSTOMER_SIZE1, &page[offset], &size_read);
816         if( retval != ERROR_OK )
817         {
818                 LOG_ERROR("couldn't read from file '%s'", filename);
819                 image_close(&image);
820                 return retval;
821         }
822         if( (retval = lpc2900_write_index_page( bank, 4, &page )) != ERROR_OK )
823         {
824                 image_close(&image);
825                 return retval;
826         }
827
828         /* Page 5 */
829         offset = ISS_CUSTOMER_START2 % FLASH_PAGE_SIZE;
830         memset( page, 0xff, FLASH_PAGE_SIZE );
831         retval = image_read_section( &image, 0, ISS_CUSTOMER_SIZE1,
832                                      ISS_CUSTOMER_SIZE2, &page[offset], &size_read);
833         if( retval != ERROR_OK )
834         {
835                 LOG_ERROR("couldn't read from file '%s'", filename);
836                 image_close(&image);
837                 return retval;
838         }
839         if( (retval = lpc2900_write_index_page( bank, 5, &page )) != ERROR_OK )
840         {
841                 image_close(&image);
842                 return retval;
843         }
844
845         image_close(&image);
846
847         return ERROR_OK;
848 }
849
850
851
852 /**
853  * Activate 'sector security' for a range of sectors.
854  *
855  * @param cmd_ctx
856  * @param cmd
857  * @param args
858  * @param argc
859  */
860 static int lpc2900_handle_secure_sector_command(struct command_context_s *cmd_ctx,
861                                                 char *cmd, char **args, int argc)
862 {
863         if (argc < 3)
864         {
865                 return ERROR_COMMAND_SYNTAX_ERROR;
866         }
867
868         /* Get the bank descriptor */
869         flash_bank_t *bank = get_flash_bank_by_num(strtoul(args[0], NULL, 0));
870         if (!bank)
871         {
872                 command_print(cmd_ctx, "flash bank '#%s' is out of bounds", args[0]);
873                 return ERROR_OK;
874         }
875         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
876
877         /* Check if command execution is allowed. */
878         if( !lpc2900_info->risky )
879         {
880                 command_print( cmd_ctx, "Command execution not allowed! "
881                 "(use 'password' command first)");
882                 return ERROR_COMMAND_ARGUMENT_INVALID;
883         }
884         lpc2900_info->risky = 0;
885
886         /* Read sector range, and do a sanity check. */
887         int first = strtoul(args[1], NULL, 0);
888         int last = strtoul(args[2], NULL, 0);
889         if( (first >= bank->num_sectors) ||
890             (last >= bank->num_sectors) ||
891             (first > last) )
892         {
893                 command_print( cmd_ctx, "Illegal sector range" );
894                 return ERROR_COMMAND_ARGUMENT_INVALID;
895         }
896
897         uint8_t page[FLASH_PAGE_SIZE];
898         int sector;
899         int retval;
900
901         /* Sectors in page 6 */
902         if( (first <= 4) || (last >= 8) )
903         {
904                 memset( &page, 0xff, FLASH_PAGE_SIZE );
905                 for( sector = first; sector <= last; sector++ )
906                 {
907                         if( sector <= 4 )
908                         {
909                                 memset( &page[0xB0 + 16*sector], 0, 16 );
910                         }
911                         else if( sector >= 8 )
912                         {
913                                 memset( &page[0x00 + 16*(sector - 8)], 0, 16 );
914                         }
915                 }
916
917                 if( (retval = lpc2900_write_index_page( bank, 6, &page )) != ERROR_OK )
918                 {
919                         LOG_ERROR("failed to update index sector page 6");
920                         return retval;
921                 }
922         }
923
924         /* Sectors in page 7 */
925         if( (first <= 7) && (last >= 5) )
926         {
927                 memset( &page, 0xff, FLASH_PAGE_SIZE );
928                 for( sector = first; sector <= last; sector++ )
929                 {
930                         if( (sector >= 5) && (sector <= 7) )
931                         {
932                                 memset( &page[0x00 + 16*(sector - 5)], 0, 16 );
933                         }
934                 }
935
936                 if( (retval = lpc2900_write_index_page( bank, 7, &page )) != ERROR_OK )
937                 {
938                         LOG_ERROR("failed to update index sector page 7");
939                         return retval;
940                 }
941         }
942
943         command_print( cmd_ctx,
944                 "Sectors security will become effective after next power cycle");
945
946         /* Update the sector security status */
947         if ( lpc2900_read_security_status(bank) != ERROR_OK )
948         {
949                 LOG_ERROR( "Cannot determine sector security status" );
950                 return ERROR_FLASH_OPERATION_FAILED;
951         }
952
953         return ERROR_OK;
954 }
955
956
957
958 /**
959  * Activate JTAG protection.
960  *
961  * @param cmd_ctx
962  * @param cmd
963  * @param args
964  * @param argc
965  */
966 static int lpc2900_handle_secure_jtag_command(struct command_context_s *cmd_ctx,
967                                               char *cmd, char **args, int argc)
968 {
969         if (argc < 1)
970         {
971                 return ERROR_COMMAND_SYNTAX_ERROR;
972         }
973
974         /* Get the bank descriptor */
975         flash_bank_t *bank = get_flash_bank_by_num(strtoul(args[0], NULL, 0));
976         if (!bank)
977         {
978                 command_print(cmd_ctx, "flash bank '#%s' is out of bounds", args[0]);
979                 return ERROR_OK;
980         }
981         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
982
983         /* Check if command execution is allowed. */
984         if( !lpc2900_info->risky )
985         {
986                 command_print( cmd_ctx, "Command execution not allowed! "
987                                         "(use 'password' command first)");
988                 return ERROR_COMMAND_ARGUMENT_INVALID;
989         }
990         lpc2900_info->risky = 0;
991
992         /* Prepare page */
993         uint8_t page[FLASH_PAGE_SIZE];
994         memset( &page, 0xff, FLASH_PAGE_SIZE );
995
996
997         /* Insert "soft" protection word */
998         page[0x30 + 15] = 0x7F;
999         page[0x30 + 11] = 0x7F;
1000         page[0x30 +  7] = 0x7F;
1001         page[0x30 +  3] = 0x7F;
1002
1003         /* Write to page 5 */
1004         int retval;
1005         if( (retval = lpc2900_write_index_page( bank, 5, &page ))
1006                         != ERROR_OK )
1007         {
1008                 LOG_ERROR("failed to update index sector page 5");
1009                 return retval;
1010         }
1011
1012         LOG_INFO("JTAG security set. Good bye!");
1013
1014         return ERROR_OK;
1015 }
1016
1017
1018
1019 /***********************  Flash interface functions  **************************/
1020
1021
1022 /**
1023  * Register private command handlers.
1024  *
1025  * @param cmd_ctx
1026  */
1027 static int lpc2900_register_commands(struct command_context_s *cmd_ctx)
1028 {
1029         command_t *lpc2900_cmd = register_command(cmd_ctx, NULL, "lpc2900",
1030                                                   NULL, COMMAND_ANY, NULL);
1031
1032         register_command(
1033             cmd_ctx,
1034             lpc2900_cmd,
1035             "signature",
1036             lpc2900_handle_signature_command,
1037             COMMAND_EXEC,
1038             "<bank> | "
1039             "print device signature of flash bank");
1040
1041         register_command(
1042             cmd_ctx,
1043             lpc2900_cmd,
1044             "read_custom",
1045             lpc2900_handle_read_custom_command,
1046             COMMAND_EXEC,
1047             "<bank> <filename> | "
1048             "read customer information from index sector to file");
1049
1050         register_command(
1051             cmd_ctx,
1052             lpc2900_cmd,
1053             "password",
1054             lpc2900_handle_password_command,
1055             COMMAND_EXEC,
1056             "<bank> <password> | "
1057             "enter password to enable 'dangerous' options");
1058
1059         register_command(
1060             cmd_ctx,
1061             lpc2900_cmd,
1062             "write_custom",
1063             lpc2900_handle_write_custom_command,
1064             COMMAND_EXEC,
1065             "<bank> <filename> [<type>] | "
1066             "write customer info from file to index sector");
1067
1068         register_command(
1069             cmd_ctx,
1070             lpc2900_cmd,
1071             "secure_sector",
1072             lpc2900_handle_secure_sector_command,
1073             COMMAND_EXEC,
1074             "<bank> <first> <last> | "
1075             "activate sector security for a range of sectors");
1076
1077         register_command(
1078             cmd_ctx,
1079             lpc2900_cmd,
1080             "secure_jtag",
1081             lpc2900_handle_secure_jtag_command,
1082             COMMAND_EXEC,
1083             "<bank> <level> | "
1084             "activate JTAG security");
1085
1086         return ERROR_OK;
1087 }
1088
1089
1090 /**
1091  * Evaluate flash bank command.
1092  *
1093  * Syntax: flash bank lpc2900 0 0 0 0 target# system_base_clock
1094  *
1095  * @param cmd_ctx
1096  * @param cmd
1097  * @param args
1098  * @param argc
1099  * @param bank Pointer to the flash bank descriptor
1100  */
1101 static int lpc2900_flash_bank_command(struct command_context_s *cmd_ctx,
1102                                       char *cmd, char **args, int argc,
1103                                       struct flash_bank_s *bank)
1104 {
1105         lpc2900_flash_bank_t *lpc2900_info;
1106
1107         if (argc < 6)
1108         {
1109                 LOG_WARNING("incomplete flash_bank LPC2900 configuration");
1110                 return ERROR_FLASH_BANK_INVALID;
1111         }
1112
1113         lpc2900_info = malloc(sizeof(lpc2900_flash_bank_t));
1114         bank->driver_priv = lpc2900_info;
1115
1116         /* Get flash clock.
1117          * Reject it if we can't meet the requirements for program time
1118          * (if clock too slow), or for erase time (clock too fast).
1119          */
1120         lpc2900_info->clk_sys_fmc = strtoul(args[6], NULL, 0) * 1000;
1121
1122         uint32_t clock_limit;
1123         /* Check program time limit */
1124         clock_limit = 512000000l / FLASH_PROGRAM_TIME;
1125         if (lpc2900_info->clk_sys_fmc < clock_limit)
1126         {
1127                 LOG_WARNING("flash clock must be at least %" PRIu32 " kHz",
1128                     (clock_limit / 1000));
1129                 return ERROR_FLASH_BANK_INVALID;
1130         }
1131
1132         /* Check erase time limit */
1133         clock_limit = (uint32_t)((32767.0 * 512.0 * 1e6) / FLASH_ERASE_TIME);
1134         if (lpc2900_info->clk_sys_fmc > clock_limit)
1135         {
1136                 LOG_WARNING("flash clock must be a maximum of %" PRIu32" kHz",
1137                     (clock_limit / 1000));
1138                 return ERROR_FLASH_BANK_INVALID;
1139         }
1140
1141         /* Chip ID will be obtained by probing the device later */
1142         lpc2900_info->chipid = 0;
1143
1144         return ERROR_OK;
1145 }
1146
1147
1148 /**
1149  * Erase sector(s).
1150  *
1151  * @param bank Pointer to the flash bank descriptor
1152  * @param first First sector to be erased
1153  * @param last Last sector (including) to be erased
1154  */
1155 static int lpc2900_erase(struct flash_bank_s *bank, int first, int last)
1156 {
1157         uint32_t status;
1158         int sector;
1159         int last_unsecured_sector;
1160         target_t *target = bank->target;
1161         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
1162
1163
1164         status = lpc2900_is_ready(bank);
1165         if (status != ERROR_OK)
1166         {
1167                 return status;
1168         }
1169
1170         /* Sanity check on sector range */
1171         if ((first < 0) || (last < first) || (last >= bank->num_sectors))
1172         {
1173                 LOG_INFO("Bad sector range");
1174                 return ERROR_FLASH_SECTOR_INVALID;
1175         }
1176
1177         /* Update the info about secured sectors */
1178         lpc2900_read_security_status( bank );
1179
1180         /* The selected sector range might include secured sectors. An attempt
1181          * to erase such a sector will cause the erase to fail also for unsecured
1182          * sectors. It is necessary to determine the last unsecured sector now,
1183          * because we have to treat the last relevant sector in the list in
1184          * a special way.
1185          */
1186         last_unsecured_sector = -1;
1187         for (sector = first; sector <= last; sector++)
1188         {
1189                 if ( !bank->sectors[sector].is_protected )
1190                 {
1191                         last_unsecured_sector = sector;
1192                 }
1193         }
1194
1195         /* Exit now, in case of the rare constellation where all sectors in range
1196          * are secured. This is regarded a success, since erasing/programming of
1197          * secured sectors shall be handled transparently.
1198          */
1199         if ( last_unsecured_sector == -1 )
1200         {
1201                 return ERROR_OK;
1202         }
1203
1204         /* Enable flash block and set the correct CRA clock of 66 kHz */
1205         lpc2900_setup(bank);
1206
1207         /* Clear END_OF_ERASE interrupt status */
1208         target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_ERASE);
1209
1210         /* Set the program/erase timer to FLASH_ERASE_TIME */
1211         target_write_u32(target, FPTR,
1212                          FPTR_EN_T | lpc2900_calc_tr( lpc2900_info->clk_sys_fmc,
1213                                                       FLASH_ERASE_TIME ));
1214
1215         /* Sectors are marked for erasure, then erased all together */
1216         for (sector = first; sector <= last_unsecured_sector; sector++)
1217         {
1218                 /* Only mark sectors that aren't secured. Any attempt to erase a group
1219                  * of sectors will fail if any single one of them is secured!
1220                  */
1221                 if ( !bank->sectors[sector].is_protected )
1222                 {
1223                         /* Unprotect the sector */
1224                         target_write_u32(target, bank->sectors[sector].offset, 0);
1225                         target_write_u32(target, FCTR,
1226                                          FCTR_FS_LOADREQ | FCTR_FS_WPB |
1227                                          FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
1228
1229                         /* Mark the sector for erasure. The last sector in the list
1230                            triggers the erasure. */
1231                         target_write_u32(target, bank->sectors[sector].offset, 0);
1232                         if ( sector == last_unsecured_sector )
1233                         {
1234                                 target_write_u32(target, FCTR,
1235                                                  FCTR_FS_PROGREQ | FCTR_FS_WPB | FCTR_FS_CS);
1236                         }
1237                         else
1238                         {
1239                                 target_write_u32(target, FCTR,
1240                                                  FCTR_FS_LOADREQ | FCTR_FS_WPB |
1241                                                  FCTR_FS_WEB | FCTR_FS_CS);
1242                         }
1243                 }
1244         }
1245
1246         /* Wait for the end of the erase operation. If it's not over after two seconds,
1247          * something went dreadfully wrong... :-(
1248          */
1249         if( lpc2900_wait_status(bank, INTSRC_END_OF_ERASE, 2000) != ERROR_OK )
1250         {
1251                 return ERROR_FLASH_OPERATION_FAILED;
1252         }
1253
1254         /* Normal flash operating mode */
1255         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1256
1257         return ERROR_OK;
1258 }
1259
1260
1261
1262 static int lpc2900_protect(struct flash_bank_s *bank, int set, int first, int last)
1263 {
1264         /* This command is not supported.
1265      * "Protection" in LPC2900 terms is handled transparently. Sectors will
1266      * automatically be unprotected as needed.
1267      * Instead we use the concept of sector security. A secured sector is shown
1268      * as "protected" in OpenOCD. Sector security is a permanent feature, and
1269      * cannot be disabled once activated.
1270      */
1271
1272         return ERROR_OK;
1273 }
1274
1275
1276 /**
1277  * Write data to flash.
1278  *
1279  * @param bank Pointer to the flash bank descriptor
1280  * @param buffer Buffer with data
1281  * @param offset Start address (relative to bank start)
1282  * @param count Number of bytes to be programmed
1283  */
1284 static int lpc2900_write(struct flash_bank_s *bank, uint8_t *buffer,
1285                          uint32_t offset, uint32_t count)
1286 {
1287         uint8_t page[FLASH_PAGE_SIZE];
1288         uint32_t status;
1289         uint32_t num_bytes;
1290         target_t *target = bank->target;
1291         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
1292         int sector;
1293         int retval;
1294
1295         static const uint32_t write_target_code[] = {
1296                 /* Set auto latch mode: FCTR=CS|WRE|WEB */
1297                 0xe3a0a007,   /* loop       mov r10, #0x007 */
1298                 0xe583a000,   /*            str r10,[r3,#0] */
1299
1300                 /* Load complete page into latches */
1301                 0xe3a06020,   /*            mov r6,#(512/16) */
1302                 0xe8b00f00,   /* next       ldmia r0!,{r8-r11} */
1303                 0xe8a10f00,   /*            stmia r1!,{r8-r11} */
1304                 0xe2566001,   /*            subs r6,#1 */
1305                 0x1afffffb,   /*            bne next */
1306
1307                 /* Clear END_OF_BURN interrupt status */
1308                 0xe3a0a002,   /*            mov r10,#(1 << 1) */
1309                 0xe583afe8,   /*            str r10,[r3,#0xfe8] */
1310
1311                 /* Set the erase time to FLASH_PROGRAM_TIME */
1312                 0xe5834008,   /*            str r4,[r3,#8] */
1313
1314                 /* Trigger flash write
1315                         FCTR = CS | WRE | WPB | PROGREQ */
1316                 0xe3a0a083,   /*            mov r10,#0x83 */
1317                 0xe38aaa01,   /*            orr r10,#0x1000 */
1318                 0xe583a000,   /*            str r10,[r3,#0] */
1319
1320                 /* Wait for end of burn */
1321                 0xe593afe0,   /* wait       ldr r10,[r3,#0xfe0] */
1322                 0xe21aa002,   /*            ands r10,#(1 << 1) */
1323                 0x0afffffc,   /*            beq wait */
1324
1325                 /* End? */
1326                 0xe2522001,   /*            subs r2,#1 */
1327                 0x1affffed,   /*            bne loop */
1328
1329                 0xeafffffe    /* done       b done */
1330         };
1331
1332
1333         status = lpc2900_is_ready(bank);
1334         if (status != ERROR_OK)
1335         {
1336                 return status;
1337         }
1338
1339         /* Enable flash block and set the correct CRA clock of 66 kHz */
1340         lpc2900_setup(bank);
1341
1342         /* Update the info about secured sectors */
1343         lpc2900_read_security_status( bank );
1344
1345         /* Unprotect all involved sectors */
1346         for (sector = 0; sector < bank->num_sectors; sector++)
1347         {
1348                 /* Start address in or before this sector? */
1349                 /* End address in or behind this sector? */
1350                 if ( ((bank->base + offset) <
1351                           (bank->sectors[sector].offset + bank->sectors[sector].size)) &&
1352                      ((bank->base + (offset + count - 1)) >= bank->sectors[sector].offset) )
1353                 {
1354                         /* This sector is involved and needs to be unprotected.
1355                                 * Don't do it for secured sectors.
1356                                 */
1357                         if ( !bank->sectors[sector].is_protected )
1358                         {
1359                                 target_write_u32(target, bank->sectors[sector].offset, 0);
1360                                 target_write_u32(target, FCTR,
1361                                                  FCTR_FS_LOADREQ | FCTR_FS_WPB |
1362                                                  FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
1363                         }
1364                 }
1365         }
1366
1367         /* Set the program/erase time to FLASH_PROGRAM_TIME */
1368         uint32_t prog_time = FPTR_EN_T | lpc2900_calc_tr( lpc2900_info->clk_sys_fmc,
1369                                                           FLASH_PROGRAM_TIME );
1370
1371         /* If there is a working area of reasonable size, use it to program via
1372            a target algorithm. If not, fall back to host programming. */
1373
1374         /* We need some room for target code. */
1375         uint32_t target_code_size = sizeof(write_target_code);
1376
1377         /* Try working area allocation. Start with a large buffer, and try with
1378            reduced size if that fails. */
1379         working_area_t *warea;
1380         uint32_t buffer_size = lpc2900_info->max_ram_block - 1 * KiB;
1381         while( (retval = target_alloc_working_area(target,
1382                                                    buffer_size + target_code_size,
1383                                                    &warea)) != ERROR_OK )
1384         {
1385                 /* Try a smaller buffer now, and stop if it's too small. */
1386                 buffer_size -= 1 * KiB;
1387                 if (buffer_size < 2 * KiB)
1388                 {
1389                         LOG_INFO( "no (large enough) working area"
1390                                   ", falling back to host mode" );
1391                         warea = NULL;
1392                         break;
1393                 }
1394         };
1395
1396         if( warea )
1397         {
1398                 reg_param_t reg_params[5];
1399                 armv4_5_algorithm_t armv4_5_info;
1400
1401                 /* We can use target mode. Download the algorithm. */
1402                 retval = target_write_buffer( target,
1403                                               (warea->address)+buffer_size,
1404                                               target_code_size,
1405                                               (uint8_t *)write_target_code);
1406                 if (retval != ERROR_OK)
1407                 {
1408                         LOG_ERROR("Unable to write block write code to target");
1409                         target_free_all_working_areas(target);
1410                         return ERROR_FLASH_OPERATION_FAILED;
1411                 }
1412
1413                 init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT);
1414                 init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);
1415                 init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);
1416                 init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);
1417                 init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT);
1418
1419                 /* Write to flash in large blocks */
1420                 while ( count != 0 )
1421                 {
1422                         uint32_t this_npages;
1423                         uint8_t *this_buffer;
1424                         int start_sector = lpc2900_address2sector( bank, offset );
1425
1426                         /* First page / last page / rest */
1427                         if( offset % FLASH_PAGE_SIZE )
1428                         {
1429                                 /* Block doesn't start on page boundary.
1430                                    Burn first partial page separately. */
1431                                 memset( &page, 0xff, sizeof(page) );
1432                                 memcpy( &page[offset % FLASH_PAGE_SIZE],
1433                                         buffer,
1434                                         FLASH_PAGE_SIZE - (offset % FLASH_PAGE_SIZE) );
1435                                 this_npages = 1;
1436                                 this_buffer = &page[0];
1437                                 count = count + (offset % FLASH_PAGE_SIZE);
1438                                 offset = offset - (offset % FLASH_PAGE_SIZE);
1439                         }
1440                         else if( count < FLASH_PAGE_SIZE )
1441                         {
1442                                 /* Download last incomplete page separately. */
1443                                 memset( &page, 0xff, sizeof(page) );
1444                                 memcpy( &page, buffer, count );
1445                                 this_npages = 1;
1446                                 this_buffer = &page[0];
1447                                 count = FLASH_PAGE_SIZE;
1448                         }
1449                         else
1450                         {
1451                                 /* Download as many full pages as possible */
1452                                 this_npages = (count < buffer_size) ?
1453                                                count / FLASH_PAGE_SIZE :
1454                                                buffer_size / FLASH_PAGE_SIZE;
1455                                 this_buffer = buffer;
1456
1457                                 /* Make sure we stop at the next secured sector */
1458                                 int sector = start_sector + 1;
1459                                 while( sector < bank->num_sectors )
1460                                 {
1461                                         /* Secured? */
1462                                         if( bank->sectors[sector].is_protected )
1463                                         {
1464                                                 /* Is that next sector within the current block? */
1465                                                 if( (bank->sectors[sector].offset - bank->base) <
1466                                                         (offset + (this_npages * FLASH_PAGE_SIZE)) )
1467                                                 {
1468                                                         /* Yes! Split the block */
1469                                                         this_npages =
1470                                                           (bank->sectors[sector].offset - bank->base - offset)
1471                                                               / FLASH_PAGE_SIZE;
1472                                                         break;
1473                                                 }
1474                                         }
1475
1476                                         sector++;
1477                                 }
1478                         }
1479
1480                         /* Skip the current sector if it is secured */
1481                         if (bank->sectors[start_sector].is_protected)
1482                         {
1483                                 LOG_DEBUG("Skip secured sector %d",
1484                                                 start_sector);
1485
1486                                 /* Stop if this is the last sector */
1487                                 if (start_sector == bank->num_sectors - 1)
1488                                 {
1489                                         break;
1490                                 }
1491
1492                                 /* Skip */
1493                                 uint32_t nskip = bank->sectors[start_sector].size -
1494                                                  (offset % bank->sectors[start_sector].size);
1495                                 offset += nskip;
1496                                 buffer += nskip;
1497                                 count = (count >= nskip) ? (count - nskip) : 0;
1498                                 continue;
1499                         }
1500
1501                         /* Execute buffer download */
1502                         if ((retval = target_write_buffer(target,
1503                                                           warea->address,
1504                                                           this_npages * FLASH_PAGE_SIZE,
1505                                                           this_buffer)) != ERROR_OK)
1506                         {
1507                                 LOG_ERROR("Unable to write data to target");
1508                                 target_free_all_working_areas(target);
1509                                 return ERROR_FLASH_OPERATION_FAILED;
1510                         }
1511
1512                         /* Prepare registers */
1513                         buf_set_u32(reg_params[0].value, 0, 32, warea->address);
1514                         buf_set_u32(reg_params[1].value, 0, 32, offset);
1515                         buf_set_u32(reg_params[2].value, 0, 32, this_npages);
1516                         buf_set_u32(reg_params[3].value, 0, 32, FCTR);
1517                         buf_set_u32(reg_params[4].value, 0, 32, FPTR_EN_T | prog_time);
1518
1519                         /* Execute algorithm, assume breakpoint for last instruction */
1520                         armv4_5_info.common_magic = ARMV4_5_COMMON_MAGIC;
1521                         armv4_5_info.core_mode = ARMV4_5_MODE_SVC;
1522                         armv4_5_info.core_state = ARMV4_5_STATE_ARM;
1523
1524                         retval = target_run_algorithm(target, 0, NULL, 5, reg_params,
1525                                 (warea->address) + buffer_size,
1526                                 (warea->address) + buffer_size + target_code_size - 4,
1527                                 10000, /* 10s should be enough for max. 16 KiB of data */
1528                                 &armv4_5_info);
1529
1530                         if (retval != ERROR_OK)
1531                         {
1532                                 LOG_ERROR("Execution of flash algorithm failed.");
1533                                 target_free_all_working_areas(target);
1534                                 retval = ERROR_FLASH_OPERATION_FAILED;
1535                                 break;
1536                         }
1537
1538                         count -= this_npages * FLASH_PAGE_SIZE;
1539                         buffer += this_npages * FLASH_PAGE_SIZE;
1540                         offset += this_npages * FLASH_PAGE_SIZE;
1541                 }
1542
1543                 /* Free all resources */
1544                 destroy_reg_param(&reg_params[0]);
1545                 destroy_reg_param(&reg_params[1]);
1546                 destroy_reg_param(&reg_params[2]);
1547                 destroy_reg_param(&reg_params[3]);
1548                 destroy_reg_param(&reg_params[4]);
1549                 target_free_all_working_areas(target);
1550         }
1551         else
1552         {
1553                 /* Write to flash memory page-wise */
1554                 while ( count != 0 )
1555                 {
1556                         /* How many bytes do we copy this time? */
1557                         num_bytes = (count >= FLASH_PAGE_SIZE) ?
1558                                     FLASH_PAGE_SIZE - (offset % FLASH_PAGE_SIZE) :
1559                                     count;
1560
1561                         /* Don't do anything with it if the page is in a secured sector. */
1562                         if ( !bank->sectors[lpc2900_address2sector(bank, offset)].is_protected )
1563                         {
1564                                 /* Set latch load mode */
1565                                 target_write_u32(target, FCTR,
1566                                                  FCTR_FS_CS | FCTR_FS_WRE | FCTR_FS_WEB);
1567
1568                                 /* Always clear the buffer (a little overhead, but who cares) */
1569                                 memset(page, 0xFF, FLASH_PAGE_SIZE);
1570
1571                                 /* Copy them to the buffer */
1572                                 memcpy( &page[offset % FLASH_PAGE_SIZE],
1573                                         &buffer[offset % FLASH_PAGE_SIZE],
1574                                         num_bytes );
1575
1576                                 /* Write whole page to flash data latches */
1577                                 if (target_write_memory(
1578                                                  target,
1579                                                  bank->base + (offset - (offset % FLASH_PAGE_SIZE)),
1580                                                  4, FLASH_PAGE_SIZE / 4, page) != ERROR_OK)
1581                                 {
1582                                         LOG_ERROR("Write failed @ 0x%8.8" PRIx32, offset);
1583                                         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1584
1585                                         return ERROR_FLASH_OPERATION_FAILED;
1586                                 }
1587
1588                                 /* Clear END_OF_BURN interrupt status */
1589                                 target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_BURN);
1590
1591                                 /* Set the programming time */
1592                                 target_write_u32(target, FPTR, FPTR_EN_T | prog_time);
1593
1594                                 /* Trigger flash write */
1595                                 target_write_u32(target, FCTR,
1596                                     FCTR_FS_CS | FCTR_FS_WRE | FCTR_FS_WPB | FCTR_FS_PROGREQ);
1597
1598                                 /* Wait for the end of the write operation. If it's not over
1599                                  * after one second, something went dreadfully wrong... :-(
1600                                  */
1601                                 if (lpc2900_wait_status(bank, INTSRC_END_OF_BURN, 1000) != ERROR_OK)
1602                                 {
1603                                         LOG_ERROR("Write failed @ 0x%8.8" PRIx32, offset);
1604                                         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1605
1606                                         return ERROR_FLASH_OPERATION_FAILED;
1607                                 }
1608                         }
1609
1610                         /* Update pointers and counters */
1611                         offset += num_bytes;
1612                         buffer += num_bytes;
1613                         count -= num_bytes;
1614                 }
1615
1616                 retval = ERROR_OK;
1617         }
1618
1619         /* Normal flash operating mode */
1620         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1621
1622         return retval;
1623 }
1624
1625
1626 /**
1627  * Try and identify the device.
1628  *
1629  * Determine type number and its memory layout.
1630  *
1631  * @param bank Pointer to the flash bank descriptor
1632  */
1633 static int lpc2900_probe(struct flash_bank_s *bank)
1634 {
1635         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
1636         target_t *target = bank->target;
1637         int i = 0;
1638         uint32_t offset;
1639
1640
1641         if (target->state != TARGET_HALTED)
1642         {
1643                 LOG_ERROR("Target not halted");
1644                 return ERROR_TARGET_NOT_HALTED;
1645         }
1646
1647         /* We want to do this only once. Check if we already have a valid CHIPID,
1648          * because then we will have already successfully probed the device.
1649          */
1650         if (lpc2900_info->chipid == EXPECTED_CHIPID)
1651         {
1652                 return ERROR_OK;
1653         }
1654
1655         /* Probing starts with reading the CHIPID register. We will continue only
1656          * if this identifies as an LPC2900 device.
1657          */
1658         target_read_u32(target, CHIPID, &lpc2900_info->chipid);
1659
1660         if (lpc2900_info->chipid != EXPECTED_CHIPID)
1661         {
1662                 LOG_WARNING("Device is not an LPC29xx");
1663                 return ERROR_FLASH_OPERATION_FAILED;
1664         }
1665
1666         /* It's an LPC29xx device. Now read the feature register FEAT0...FEAT3. */
1667         uint32_t feat0, feat1, feat2, feat3;
1668         target_read_u32(target, FEAT0, &feat0);
1669         target_read_u32(target, FEAT1, &feat1);
1670         target_read_u32(target, FEAT2, &feat2);
1671         target_read_u32(target, FEAT3, &feat3);
1672
1673         /* Base address */
1674         bank->base = 0x20000000;
1675
1676         /* Determine flash layout from FEAT2 register */
1677         uint32_t num_64k_sectors = (feat2 >> 16) & 0xFF;
1678         uint32_t num_8k_sectors = (feat2 >> 0) & 0xFF;
1679         bank->num_sectors = num_64k_sectors + num_8k_sectors;
1680         bank->size = KiB * (64 * num_64k_sectors + 8 * num_8k_sectors);
1681
1682         /* Determine maximum contiguous RAM block */
1683         lpc2900_info->max_ram_block = 16 * KiB;
1684         if( (feat1 & 0x30) == 0x30 )
1685         {
1686                 lpc2900_info->max_ram_block = 32 * KiB;
1687                 if( (feat1 & 0x0C) == 0x0C )
1688                 {
1689                         lpc2900_info->max_ram_block = 48 * KiB;
1690                 }
1691         }
1692
1693         /* Determine package code and ITCM size */
1694         uint32_t package_code = feat0 & 0x0F;
1695         uint32_t itcm_code = (feat1 >> 16) & 0x1F;
1696
1697         /* Determine the exact type number. */
1698         uint32_t found = 1;
1699         if ( (package_code == 4) && (itcm_code == 5) )
1700         {
1701                 /* Old LPC2917 or LPC2919 (non-/01 devices) */
1702                 lpc2900_info->target_name = (bank->size == 768*KiB) ? "LPC2919" : "LPC2917";
1703         }
1704         else
1705         {
1706                 if ( package_code == 2 )
1707                 {
1708                         /* 100-pin package */
1709                         if ( bank->size == 128*KiB )
1710                         {
1711                                 lpc2900_info->target_name = "LPC2921";
1712                         }
1713                         else if ( bank->size == 256*KiB )
1714                         {
1715                                 lpc2900_info->target_name = "LPC2923";
1716                         }
1717                         else if ( bank->size == 512*KiB )
1718                         {
1719                                 lpc2900_info->target_name = "LPC2925";
1720                         }
1721                         else
1722                         {
1723                                 found = 0;
1724                         }
1725                 }
1726                 else if ( package_code == 4 )
1727                 {
1728                         /* 144-pin package */
1729                         if ( (bank->size == 512*KiB) && (feat3 == 0xFFFFFCF0) )
1730                         {
1731                                 lpc2900_info->target_name = "LPC2917/01";
1732                         }
1733                         else if ( (bank->size == 512*KiB) && (feat3 == 0xFFFFFFF1) )
1734                         {
1735                                 lpc2900_info->target_name = "LPC2927";
1736                         }
1737                         else if ( (bank->size == 768*KiB) && (feat3 == 0xFFFFFCF8) )
1738                         {
1739                                 lpc2900_info->target_name = "LPC2919/01";
1740                         }
1741                         else if ( (bank->size == 768*KiB) && (feat3 == 0xFFFFFFF9) )
1742                         {
1743                                 lpc2900_info->target_name = "LPC2929";
1744                         }
1745                         else
1746                         {
1747                                 found = 0;
1748                         }
1749                 }
1750                 else if ( package_code == 5 )
1751                 {
1752                         /* 208-pin package */
1753                         lpc2900_info->target_name = (bank->size == 0) ? "LPC2930" : "LPC2939";
1754                 }
1755                 else
1756                 {
1757                         found = 0;
1758                 }
1759         }
1760
1761         if ( !found )
1762         {
1763                 LOG_WARNING("Unknown LPC29xx derivative");
1764                 return ERROR_FLASH_OPERATION_FAILED;
1765         }
1766
1767         /* Show detected device */
1768         LOG_INFO("Flash bank %d"
1769                  ": Device %s, %" PRIu32
1770                  " KiB in %d sectors",
1771                  bank->bank_number,
1772                  lpc2900_info->target_name, bank->size / KiB,
1773                  bank->num_sectors);
1774
1775         /* Flashless devices cannot be handled */
1776         if ( bank->num_sectors == 0 )
1777         {
1778                 LOG_WARNING("Flashless device cannot be handled");
1779                 return ERROR_FLASH_OPERATION_FAILED;
1780         }
1781
1782         /* Sector layout.
1783          * These are logical sector numbers. When doing real flash operations,
1784          * the logical flash number are translated into the physical flash numbers
1785          * of the device.
1786          */
1787         bank->sectors = malloc(sizeof(flash_sector_t) * bank->num_sectors);
1788
1789         offset = 0;
1790         for (i = 0; i < bank->num_sectors; i++)
1791         {
1792                 bank->sectors[i].offset = offset;
1793                 bank->sectors[i].is_erased = -1;
1794                 bank->sectors[i].is_protected = -1;
1795
1796                 if ( i <= 7 )
1797                 {
1798                         bank->sectors[i].size = 8 * KiB;
1799                 }
1800                 else if ( i <= 18 )
1801                 {
1802                         bank->sectors[i].size = 64 * KiB;
1803                 }
1804                 else
1805                 {
1806                         /* We shouldn't come here. But there might be a new part out there
1807                          * that has more than 19 sectors. Politely ask for a fix then.
1808                          */
1809                         bank->sectors[i].size = 0;
1810                         LOG_ERROR("Never heard about sector %d", i);
1811                 }
1812
1813                 offset += bank->sectors[i].size;
1814         }
1815
1816         /* Read sector security status */
1817         if ( lpc2900_read_security_status(bank) != ERROR_OK )
1818         {
1819                 LOG_ERROR("Cannot determine sector security status");
1820                 return ERROR_FLASH_OPERATION_FAILED;
1821         }
1822
1823         return ERROR_OK;
1824 }
1825
1826
1827 /**
1828  * Run a blank check for each sector.
1829  *
1830  * For speed reasons, the device isn't read word by word.
1831  * A hash value is calculated by the hardware ("BIST") for each sector.
1832  * This value is then compared against the known hash of an empty sector.
1833  *
1834  * @param bank Pointer to the flash bank descriptor
1835  */
1836 static int lpc2900_erase_check(struct flash_bank_s *bank)
1837 {
1838         uint32_t status = lpc2900_is_ready(bank);
1839         if (status != ERROR_OK)
1840         {
1841                 LOG_INFO("Processor not halted/not probed");
1842                 return status;
1843         }
1844
1845         /* Use the BIST (Built-In Selft Test) to generate a signature of each flash
1846          * sector. Compare against the expected signature of an empty sector.
1847          */
1848         int sector;
1849         for ( sector = 0; sector < bank->num_sectors; sector++ )
1850         {
1851                 uint32_t signature[4];
1852                 if ( (status = lpc2900_run_bist128( bank,
1853                                                     bank->sectors[sector].offset,
1854                                                     bank->sectors[sector].offset +
1855                                                        (bank->sectors[sector].size - 1),
1856                                                     &signature)) != ERROR_OK )
1857                 {
1858                         return status;
1859                 }
1860
1861                 /* The expected signatures for an empty sector are different
1862                  * for 8 KiB and 64 KiB sectors.
1863                  */
1864                 if ( bank->sectors[sector].size == 8*KiB )
1865                 {
1866                         bank->sectors[sector].is_erased =
1867                             (signature[3] == 0x01ABAAAA) &&
1868                             (signature[2] == 0xAAAAAAAA) &&
1869                             (signature[1] == 0xAAAAAAAA) &&
1870                             (signature[0] == 0xAAA00AAA);
1871                 }
1872                 if ( bank->sectors[sector].size == 64*KiB )
1873                 {
1874                         bank->sectors[sector].is_erased =
1875                             (signature[3] == 0x11801222) &&
1876                             (signature[2] == 0xB88844FF) &&
1877                             (signature[1] == 0x11A22008) &&
1878                             (signature[0] == 0x2B1BFE44);
1879                 }
1880         }
1881
1882         return ERROR_OK;
1883 }
1884
1885
1886 /**
1887  * Get protection (sector security) status.
1888  *
1889  * Determine the status of "sector security" for each sector.
1890  * A secured sector is one that can never be erased/programmed again.
1891  *
1892  * @param bank Pointer to the flash bank descriptor
1893  */
1894 static int lpc2900_protect_check(struct flash_bank_s *bank)
1895 {
1896         return lpc2900_read_security_status(bank);
1897 }
1898
1899
1900 /**
1901  * Print info about the driver (not the device).
1902  *
1903  * @param bank Pointer to the flash bank descriptor
1904  * @param buf Buffer to take the string
1905  * @param buf_size Maximum number of characters that the buffer can take
1906  */
1907 static int lpc2900_info(struct flash_bank_s *bank, char *buf, int buf_size)
1908 {
1909         snprintf(buf, buf_size, "lpc2900 flash driver");
1910
1911         return ERROR_OK;
1912 }
1913
1914
1915 flash_driver_t lpc2900_flash =
1916 {
1917         .name               = "lpc2900",
1918         .register_commands  = lpc2900_register_commands,
1919         .flash_bank_command = lpc2900_flash_bank_command,
1920         .erase              = lpc2900_erase,
1921         .protect            = lpc2900_protect,
1922         .write              = lpc2900_write,
1923         .probe              = lpc2900_probe,
1924         .auto_probe         = lpc2900_probe,
1925         .erase_check        = lpc2900_erase_check,
1926         .protect_check      = lpc2900_protect_check,
1927         .info               = lpc2900_info
1928 };