git.gag.com Git - fw/openocd/blob - src/flash/lpc2900.c

   1 /***************************************************************************
   2  *   Copyright (C) 2009 by                                                 *
   3  *   Rolf Meeser <rolfm_9dq@yahoo.de>                                      *
   4  *                                                                         *
   5  *   This program is free software; you can redistribute it and/or modify  *
   6  *   it under the terms of the GNU General Public License as published by  *
   7  *   the Free Software Foundation; either version 2 of the License, or     *
   8  *   (at your option) any later version.                                   *
   9  *                                                                         *
  10  *   This program is distributed in the hope that it will be useful,       *
  11  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  12  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  13  *   GNU General Public License for more details.                          *
  14  *                                                                         *
  15  *   You should have received a copy of the GNU General Public License     *
  16  *   along with this program; if not, write to the                         *
  17  *   Free Software Foundation, Inc.,                                       *
  18  *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  19  ***************************************************************************/
  20
  21 #ifdef HAVE_CONFIG_H
  22 #include "config.h"
  23 #endif
  24
  25
  26 #include "image.h"
  27
  28 #include "lpc2900.h"
  29 #include "binarybuffer.h"
  30 #include "armv4_5.h"
  31
  32
  33 /* 1024 bytes */
  34 #define KiB                 1024
  35
  36 /* Some flash constants */
  37 #define FLASH_PAGE_SIZE     512     /* bytes */
  38 #define FLASH_ERASE_TIME    100000  /* microseconds */
  39 #define FLASH_PROGRAM_TIME  1000    /* microseconds */
  40
  41 /* Chip ID / Feature Registers */
  42 #define CHIPID          0xE0000000  /* Chip ID */
  43 #define FEAT0           0xE0000100  /* Chip feature 0 */
  44 #define FEAT1           0xE0000104  /* Chip feature 1 */
  45 #define FEAT2           0xE0000108  /* Chip feature 2 (contains flash size indicator) */
  46 #define FEAT3           0xE000010C  /* Chip feature 3 */
  47
  48 #define EXPECTED_CHIPID 0x209CE02B  /* Chip ID of all LPC2900 devices */
  49
  50 /* Flash/EEPROM Control Registers */
  51 #define FCTR            0x20200000  /* Flash control */
  52 #define FPTR            0x20200008  /* Flash program-time */
  53 #define FTCTR           0x2020000C  /* Flash test control */
  54 #define FBWST           0x20200010  /* Flash bridge wait-state */
  55 #define FCRA            0x2020001C  /* Flash clock divider */
  56 #define FMSSTART        0x20200020  /* Flash Built-In Selft Test start address */
  57 #define FMSSTOP         0x20200024  /* Flash Built-In Selft Test stop address */
  58 #define FMS16           0x20200028  /* Flash 16-bit signature */
  59 #define FMSW0           0x2020002C  /* Flash 128-bit signature Word 0 */
  60 #define FMSW1           0x20200030  /* Flash 128-bit signature Word 1 */
  61 #define FMSW2           0x20200034  /* Flash 128-bit signature Word 2 */
  62 #define FMSW3           0x20200038  /* Flash 128-bit signature Word 3 */
  63
  64 #define EECMD           0x20200080  /* EEPROM command */
  65 #define EEADDR          0x20200084  /* EEPROM address */
  66 #define EEWDATA         0x20200088  /* EEPROM write data */
  67 #define EERDATA         0x2020008C  /* EEPROM read data */
  68 #define EEWSTATE        0x20200090  /* EEPROM wait state */
  69 #define EECLKDIV        0x20200094  /* EEPROM clock divider */
  70 #define EEPWRDWN        0x20200098  /* EEPROM power-down/start */
  71 #define EEMSSTART       0x2020009C  /* EEPROM BIST start address */
  72 #define EEMSSTOP        0x202000A0  /* EEPROM BIST stop address */
  73 #define EEMSSIG         0x202000A4  /* EEPROM 24-bit BIST signature */
  74
  75 #define INT_CLR_ENABLE  0x20200FD8  /* Flash/EEPROM interrupt clear enable */
  76 #define INT_SET_ENABLE  0x20200FDC  /* Flash/EEPROM interrupt set enable */
  77 #define INT_STATUS      0x20200FE0  /* Flash/EEPROM interrupt status */
  78 #define INT_ENABLE      0x20200FE4  /* Flash/EEPROM interrupt enable */
  79 #define INT_CLR_STATUS  0x20200FE8  /* Flash/EEPROM interrupt clear status */
  80 #define INT_SET_STATUS  0x20200FEC  /* Flash/EEPROM interrupt set status */
  81
  82 /* Interrupt sources */
  83 #define INTSRC_END_OF_PROG    (1 << 28)
  84 #define INTSRC_END_OF_BIST    (1 << 27)
  85 #define INTSRC_END_OF_RDWR    (1 << 26)
  86 #define INTSRC_END_OF_MISR    (1 << 2)
  87 #define INTSRC_END_OF_BURN    (1 << 1)
  88 #define INTSRC_END_OF_ERASE   (1 << 0)
  89
  90
  91 /* FCTR bits */
  92 #define FCTR_FS_LOADREQ       (1 << 15)
  93 #define FCTR_FS_CACHECLR      (1 << 14)
  94 #define FCTR_FS_CACHEBYP      (1 << 13)
  95 #define FCTR_FS_PROGREQ       (1 << 12)
  96 #define FCTR_FS_RLS           (1 << 11)
  97 #define FCTR_FS_PDL           (1 << 10)
  98 #define FCTR_FS_PD            (1 << 9)
  99 #define FCTR_FS_WPB           (1 << 7)
 100 #define FCTR_FS_ISS           (1 << 6)
 101 #define FCTR_FS_RLD           (1 << 5)
 102 #define FCTR_FS_DCR           (1 << 4)
 103 #define FCTR_FS_WEB           (1 << 2)
 104 #define FCTR_FS_WRE           (1 << 1)
 105 #define FCTR_FS_CS            (1 << 0)
 106 /* FPTR bits */
 107 #define FPTR_EN_T             (1 << 15)
 108 /* FTCTR bits */
 109 #define FTCTR_FS_BYPASS_R     (1 << 29)
 110 #define FTCTR_FS_BYPASS_W     (1 << 28)
 111 /* FMSSTOP bits */
 112 #define FMSSTOP_MISR_START    (1 << 17)
 113 /* EEMSSTOP bits */
 114 #define EEMSSTOP_STRTBIST     (1 << 31)
 115
 116 /* Index sector */
 117 #define ISS_CUSTOMER_START1   (0x830)
 118 #define ISS_CUSTOMER_END1     (0xA00)
 119 #define ISS_CUSTOMER_SIZE1    (ISS_CUSTOMER_END1 - ISS_CUSTOMER_START1)
 120 #define ISS_CUSTOMER_NWORDS1  (ISS_CUSTOMER_SIZE1 / 4)
 121 #define ISS_CUSTOMER_START2   (0xA40)
 122 #define ISS_CUSTOMER_END2     (0xC00)
 123 #define ISS_CUSTOMER_SIZE2    (ISS_CUSTOMER_END2 - ISS_CUSTOMER_START2)
 124 #define ISS_CUSTOMER_NWORDS2  (ISS_CUSTOMER_SIZE2 / 4)
 125 #define ISS_CUSTOMER_SIZE     (ISS_CUSTOMER_SIZE1 + ISS_CUSTOMER_SIZE2)
 126
 127
 128
 129 /**
 130  * Private data for \c lpc2900 flash driver.
 131  */
 132 typedef struct lpc2900_flash_bank_s
 133 {
 134         /**
 135          * Holds the value read from CHIPID register.
 136          * The driver will not load if the chipid doesn't match the expected
 137          * value of 0x209CE02B of the LPC2900 family. A probe will only be done
 138          * if the chipid does not yet contain the expected value.
 139          */
 140         uint32_t chipid;
 141
 142         /**
 143          * String holding device name.
 144          * This string is set by the probe function to the type number of the
 145          * device. It takes the form "LPC29xx".
 146          */
 147         char * target_name;
 148
 149         /**
 150          * System clock frequency.
 151          * Holds the clock frequency in Hz, as passed by the configuration file
 152          * to the <tt>flash bank</tt> command.
 153          */
 154         uint32_t clk_sys_fmc;
 155
 156         /**
 157          * Flag to indicate that dangerous operations are possible.
 158          * This flag can be set by passing the correct password to the
 159          * <tt>lpc2900 password</tt> command. If set, other dangerous commands,
 160          * which operate on the index sector, can be executed.
 161          */
 162         uint32_t risky;
 163
 164         /**
 165          * Maximum contiguous block of internal SRAM (bytes).
 166          * Autodetected by the driver. Not the total amount of SRAM, only the
 167          * the largest \em contiguous block!
 168          */
 169         uint32_t max_ram_block;
 170
 171 } lpc2900_flash_bank_t;
 172
 173
 174
 175
 176 static int lpc2900_register_commands(struct command_context_s *cmd_ctx);
 177 static int lpc2900_flash_bank_command(struct command_context_s *cmd_ctx,
 178                                       char *cmd, char **args, int argc,
 179                                       struct flash_bank_s *bank);
 180 static int lpc2900_erase(struct flash_bank_s *bank, int first, int last);
 181 static int lpc2900_protect(struct flash_bank_s *bank, int set, int first, int last);
 182 static int lpc2900_write(struct flash_bank_s *bank,
 183                          uint8_t *buffer, uint32_t offset, uint32_t count);
 184 static int lpc2900_probe(struct flash_bank_s *bank);
 185 static int lpc2900_erase_check(struct flash_bank_s *bank);
 186 static int lpc2900_protect_check(struct flash_bank_s *bank);
 187 static int lpc2900_info(struct flash_bank_s *bank, char *buf, int buf_size);
 188
 189 static uint32_t lpc2900_wait_status(flash_bank_t *bank, uint32_t mask, int timeout);
 190 static void lpc2900_setup(struct flash_bank_s *bank);
 191 static uint32_t lpc2900_is_ready(struct flash_bank_s *bank);
 192 static uint32_t lpc2900_read_security_status(struct flash_bank_s *bank);
 193 static uint32_t lpc2900_run_bist128(struct flash_bank_s *bank,
 194                                     uint32_t addr_from, uint32_t addr_to,
 195                                     uint32_t (*signature)[4] );
 196 static uint32_t lpc2900_address2sector(struct flash_bank_s *bank, uint32_t offset);
 197 static uint32_t lpc2900_calc_tr( uint32_t clock, uint32_t time );
 198
 199
 200 /***********************  Helper functions  **************************/
 201
 202
 203 /**
 204  * Wait for an event in mask to occur in INT_STATUS.
 205  *
 206  * Return when an event occurs, or after a timeout.
 207  *
 208  * @param[in] bank Pointer to the flash bank descriptor
 209  * @param[in] mask Mask to be used for INT_STATUS
 210  * @param[in] timeout Timeout in ms
 211  */
 212 static uint32_t lpc2900_wait_status( flash_bank_t *bank,
 213                                      uint32_t mask,
 214                                      int timeout )
 215 {
 216         uint32_t int_status;
 217         target_t *target = bank->target;
 218
 219
 220         do
 221         {
 222                 alive_sleep(1);
 223                 timeout--;
 224                 target_read_u32(target, INT_STATUS, &int_status);
 225         }
 226         while( ((int_status & mask) == 0) && (timeout != 0) );
 227
 228         if (timeout == 0)
 229         {
 230                 LOG_DEBUG("Timeout!");
 231                 return ERROR_FLASH_OPERATION_FAILED;
 232         }
 233
 234         return ERROR_OK;
 235 }
 236
 237
 238
 239 /**
 240  * Set up the flash for erase/program operations.
 241  *
 242  * Enable the flash, and set the correct CRA clock of 66 kHz.
 243  *
 244  * @param bank Pointer to the flash bank descriptor
 245  */
 246 static void lpc2900_setup( struct flash_bank_s *bank )
 247 {
 248         uint32_t fcra;
 249         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
 250
 251
 252         /* Power up the flash block */
 253         target_write_u32( bank->target, FCTR, FCTR_FS_WEB | FCTR_FS_CS );
 254
 255
 256         fcra = (lpc2900_info->clk_sys_fmc / (3 * 66000)) - 1;
 257         target_write_u32( bank->target, FCRA, fcra );
 258 }
 259
 260
 261
 262 /**
 263  * Check if device is ready.
 264  *
 265  * Check if device is ready for flash operation:
 266  * Must have been successfully probed.
 267  * Must be halted.
 268  */
 269 static uint32_t lpc2900_is_ready( struct flash_bank_s *bank )
 270 {
 271         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
 272
 273         if( lpc2900_info->chipid != EXPECTED_CHIPID )
 274         {
 275                 return ERROR_FLASH_BANK_NOT_PROBED;
 276         }
 277
 278         if( bank->target->state != TARGET_HALTED )
 279         {
 280                 LOG_ERROR( "Target not halted" );
 281                 return ERROR_TARGET_NOT_HALTED;
 282         }
 283
 284         return ERROR_OK;
 285 }
 286
 287
 288 /**
 289  * Read the status of sector security from the index sector.
 290  *
 291  * @param bank Pointer to the flash bank descriptor
 292  */
 293 static uint32_t lpc2900_read_security_status( struct flash_bank_s *bank )
 294 {
 295         uint32_t status;
 296         if( (status = lpc2900_is_ready( bank )) != ERROR_OK )
 297         {
 298                 return status;
 299         }
 300
 301         target_t *target = bank->target;
 302
 303         /* Enable ISS access */
 304         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB | FCTR_FS_ISS);
 305
 306         /* Read the relevant block of memory from the ISS sector */
 307         uint32_t iss_secured_field[ 0x230/16 ][ 4 ];
 308         target_read_memory(target, bank->base + 0xC00, 4, 0x230/4,
 309                                    (uint8_t *)iss_secured_field);
 310
 311         /* Disable ISS access */
 312         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
 313
 314         /* Check status of each sector. Note that the sector numbering in the LPC2900
 315          * is different from the logical sector numbers used in OpenOCD!
 316          * Refer to the user manual for details.
 317          *
 318          * All zeros (16x 0x00) are treated as a secured sector (is_protected = 1)
 319          * All ones (16x 0xFF) are treated as a non-secured sector (is_protected = 0)
 320          * Anything else is undefined (is_protected = -1). This is treated as
 321          * a protected sector!
 322          */
 323         int sector;
 324         int index;
 325         for( sector = 0; sector < bank->num_sectors; sector++ )
 326         {
 327                 /* Convert logical sector number to physical sector number */
 328                 if( sector <= 4 )
 329                 {
 330                         index = sector + 11;
 331                 }
 332                 else if( sector <= 7 )
 333                 {
 334                         index = sector + 27;
 335                 }
 336                 else
 337                 {
 338                         index = sector - 8;
 339                 }
 340
 341                 bank->sectors[sector].is_protected = -1;
 342
 343                 if (
 344                     (iss_secured_field[index][0] == 0x00000000) &&
 345                     (iss_secured_field[index][1] == 0x00000000) &&
 346                     (iss_secured_field[index][2] == 0x00000000) &&
 347                     (iss_secured_field[index][3] == 0x00000000) )
 348                 {
 349                         bank->sectors[sector].is_protected = 1;
 350                 }
 351
 352                 if (
 353                     (iss_secured_field[index][0] == 0xFFFFFFFF) &&
 354                     (iss_secured_field[index][1] == 0xFFFFFFFF) &&
 355                     (iss_secured_field[index][2] == 0xFFFFFFFF) &&
 356                     (iss_secured_field[index][3] == 0xFFFFFFFF) )
 357                 {
 358                         bank->sectors[sector].is_protected = 0;
 359                 }
 360         }
 361
 362         return ERROR_OK;
 363 }
 364
 365
 366 /**
 367  * Use BIST to calculate a 128-bit hash value over a range of flash.
 368  *
 369  * @param bank Pointer to the flash bank descriptor
 370  * @param addr_from
 371  * @param addr_to
 372  * @param signature
 373  */
 374 static uint32_t lpc2900_run_bist128(struct flash_bank_s *bank,
 375                                     uint32_t addr_from,
 376                                     uint32_t addr_to,
 377                                     uint32_t (*signature)[4] )
 378 {
 379         target_t *target = bank->target;
 380
 381         /* Clear END_OF_MISR interrupt status */
 382         target_write_u32( target, INT_CLR_STATUS, INTSRC_END_OF_MISR );
 383
 384         /* Start address */
 385         target_write_u32( target, FMSSTART, addr_from >> 4);
 386         /* End address, and issue start command */
 387         target_write_u32( target, FMSSTOP, (addr_to >> 4) | FMSSTOP_MISR_START );
 388
 389         /* Poll for end of operation. Calculate a reasonable timeout. */
 390         if( lpc2900_wait_status( bank, INTSRC_END_OF_MISR, 1000 ) != ERROR_OK )
 391         {
 392                 return ERROR_FLASH_OPERATION_FAILED;
 393         }
 394
 395         /* Return the signature */
 396         target_read_memory( target, FMSW0, 4, 4, (uint8_t *)signature );
 397
 398         return ERROR_OK;
 399 }
 400
 401
 402 /**
 403  * Return sector number for given address.
 404  *
 405  * Return the (logical) sector number for a given relative address.
 406  * No sanity check is done. It assumed that the address is valid.
 407  *
 408  * @param bank Pointer to the flash bank descriptor
 409  * @param offset Offset address relative to bank start
 410  */
 411 static uint32_t lpc2900_address2sector( struct flash_bank_s *bank,
 412                                         uint32_t offset )
 413 {
 414         uint32_t address = bank->base + offset;
 415
 416
 417         /* Run through all sectors of this bank */
 418         int sector;
 419         for( sector = 0; sector < bank->num_sectors; sector++ )
 420         {
 421                 /* Return immediately if address is within the current sector */
 422                 if( address < (bank->sectors[sector].offset + bank->sectors[sector].size) )
 423                 {
 424                         return sector;
 425                 }
 426         }
 427
 428         /* We should never come here. If we do, return an arbitrary sector number. */
 429         return 0;
 430 }
 431
 432
 433
 434
 435 /**
 436  * Write one page to the index sector.
 437  *
 438  * @param bank Pointer to the flash bank descriptor
 439  * @param pagenum Page number (0...7)
 440  * @param page Page array (FLASH_PAGE_SIZE bytes)
 441  */
 442 static int lpc2900_write_index_page( struct flash_bank_s *bank,
 443                                      int pagenum,
 444                                      uint8_t (*page)[FLASH_PAGE_SIZE] )
 445 {
 446         /* Only pages 4...7 are user writable */
 447         if ((pagenum < 4) || (pagenum > 7))
 448         {
 449                 LOG_ERROR("Refuse to burn index sector page %d", pagenum);
 450                 return ERROR_COMMAND_ARGUMENT_INVALID;
 451         }
 452
 453         /* Get target, and check if it's halted */
 454         target_t *target = bank->target;
 455         if( target->state != TARGET_HALTED )
 456         {
 457                 LOG_ERROR( "Target not halted" );
 458                 return ERROR_TARGET_NOT_HALTED;
 459         }
 460
 461         /* Private info */
 462         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
 463
 464         /* Enable flash block and set the correct CRA clock of 66 kHz */
 465         lpc2900_setup( bank );
 466
 467         /* Un-protect the index sector */
 468         target_write_u32( target, bank->base, 0 );
 469         target_write_u32( target, FCTR,
 470                           FCTR_FS_LOADREQ | FCTR_FS_WPB | FCTR_FS_ISS |
 471                           FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS );
 472
 473         /* Set latch load mode */
 474         target_write_u32( target, FCTR,
 475                           FCTR_FS_ISS | FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS );
 476
 477         /* Write whole page to flash data latches */
 478         if( target_write_memory( target,
 479                                  bank->base + pagenum * FLASH_PAGE_SIZE,
 480                                  4, FLASH_PAGE_SIZE / 4, (uint8_t *)page) != ERROR_OK )
 481         {
 482                 LOG_ERROR("Index sector write failed @ page %d", pagenum);
 483                 target_write_u32( target, FCTR, FCTR_FS_CS | FCTR_FS_WEB );
 484
 485                 return ERROR_FLASH_OPERATION_FAILED;
 486         }
 487
 488         /* Clear END_OF_BURN interrupt status */
 489         target_write_u32( target, INT_CLR_STATUS, INTSRC_END_OF_BURN );
 490
 491         /* Set the program/erase time to FLASH_PROGRAM_TIME */
 492         target_write_u32(target, FPTR,
 493                          FPTR_EN_T | lpc2900_calc_tr( lpc2900_info->clk_sys_fmc,
 494                                                       FLASH_PROGRAM_TIME ));
 495
 496         /* Trigger flash write */
 497         target_write_u32( target, FCTR,
 498                           FCTR_FS_PROGREQ | FCTR_FS_ISS |
 499                           FCTR_FS_WPB | FCTR_FS_WRE | FCTR_FS_CS );
 500
 501         /* Wait for the end of the write operation. If it's not over after one
 502          * second, something went dreadfully wrong... :-(
 503          */
 504         if (lpc2900_wait_status(bank, INTSRC_END_OF_BURN, 1000) != ERROR_OK)
 505         {
 506                 LOG_ERROR("Index sector write failed @ page %d", pagenum);
 507                 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
 508
 509                 return ERROR_FLASH_OPERATION_FAILED;
 510         }
 511
 512         target_write_u32( target, FCTR, FCTR_FS_CS | FCTR_FS_WEB );
 513
 514         return ERROR_OK;
 515 }
 516
 517
 518
 519 /**
 520  * Calculate FPTR.TR register value for desired program/erase time.
 521  *
 522  * @param clock System clock in Hz
 523  * @param time Program/erase time in µs
 524  */
 525 static uint32_t lpc2900_calc_tr( uint32_t clock, uint32_t time )
 526 {
 527         /*           ((time[µs]/1e6) * f[Hz]) + 511
 528          * FPTR.TR = -------------------------------
 529          *                         512
 530          *
 531          * The result is the
 532          */
 533
 534         uint32_t tr_val = (uint32_t)((((time / 1e6) * clock) + 511.0) / 512.0);
 535
 536         return tr_val;
 537 }
 538
 539
 540 /***********************  Private flash commands  **************************/
 541
 542
 543 /**
 544  * Command to determine the signature of the whole flash.
 545  *
 546  * Uses the Built-In-Self-Test (BIST) to generate a 128-bit hash value
 547  * of the flash content.
 548  *
 549  * @param cmd_ctx
 550  * @param cmd
 551  * @param args
 552  * @param argc
 553  */
 554 static int lpc2900_handle_signature_command( struct command_context_s *cmd_ctx,
 555                                              char *cmd, char **args, int argc )
 556 {
 557         uint32_t status;
 558         uint32_t signature[4];
 559
 560
 561         if( argc < 1 )
 562         {
 563                 LOG_WARNING( "Too few arguments. Call: lpc2900 signature <bank#>" );
 564                 return ERROR_FLASH_BANK_INVALID;
 565         }
 566
 567         flash_bank_t *bank;
 568         int retval = flash_command_get_bank_by_num(cmd_ctx, args[0], &bank);
 569         if (ERROR_OK != retval)
 570                 return retval;
 571
 572         if( bank->target->state != TARGET_HALTED )
 573         {
 574                 LOG_ERROR( "Target not halted" );
 575                 return ERROR_TARGET_NOT_HALTED;
 576         }
 577
 578         /* Run BIST over whole flash range */
 579         if( (status = lpc2900_run_bist128( bank,
 580                                            bank->base,
 581                                            bank->base + (bank->size - 1),
 582                                            &signature)
 583                                          ) != ERROR_OK )
 584         {
 585                 return status;
 586         }
 587
 588         command_print( cmd_ctx, "signature: 0x%8.8" PRIx32
 589                                           ":0x%8.8" PRIx32
 590                                           ":0x%8.8" PRIx32
 591                                           ":0x%8.8" PRIx32,
 592                       signature[3], signature[2], signature[1], signature[0] );
 593
 594         return ERROR_OK;
 595 }
 596
 597
 598
 599 /**
 600  * Store customer info in file.
 601  *
 602  * Read customer info from index sector, and store that block of data into
 603  * a disk file. The format is binary.
 604  *
 605  * @param cmd_ctx
 606  * @param cmd
 607  * @param args
 608  * @param argc
 609  */
 610 static int lpc2900_handle_read_custom_command( struct command_context_s *cmd_ctx,
 611                                                char *cmd, char **args, int argc )
 612 {
 613         if( argc < 2 )
 614         {
 615                 return ERROR_COMMAND_SYNTAX_ERROR;
 616         }
 617
 618         flash_bank_t *bank;
 619         int retval = flash_command_get_bank_by_num(cmd_ctx, args[0], &bank);
 620         if (ERROR_OK != retval)
 621                 return retval;
 622
 623         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
 624         lpc2900_info->risky = 0;
 625
 626         /* Get target, and check if it's halted */
 627         target_t *target = bank->target;
 628         if( target->state != TARGET_HALTED )
 629         {
 630                 LOG_ERROR( "Target not halted" );
 631                 return ERROR_TARGET_NOT_HALTED;
 632         }
 633
 634         /* Storage for customer info. Read in two parts */
 635         uint32_t customer[ ISS_CUSTOMER_NWORDS1 + ISS_CUSTOMER_NWORDS2 ];
 636
 637         /* Enable access to index sector */
 638         target_write_u32( target, FCTR, FCTR_FS_CS | FCTR_FS_WEB | FCTR_FS_ISS );
 639
 640         /* Read two parts */
 641         target_read_memory( target, bank->base+ISS_CUSTOMER_START1, 4,
 642                                     ISS_CUSTOMER_NWORDS1,
 643                                     (uint8_t *)&customer[0] );
 644         target_read_memory( target, bank->base+ISS_CUSTOMER_START2, 4,
 645                                     ISS_CUSTOMER_NWORDS2,
 646                                     (uint8_t *)&customer[ISS_CUSTOMER_NWORDS1] );
 647
 648         /* Deactivate access to index sector */
 649         target_write_u32( target, FCTR, FCTR_FS_CS | FCTR_FS_WEB );
 650
 651         /* Try and open the file */
 652         fileio_t fileio;
 653         char *filename = args[1];
 654         int ret = fileio_open( &fileio, filename, FILEIO_WRITE, FILEIO_BINARY );
 655         if( ret != ERROR_OK )
 656         {
 657                 LOG_WARNING( "Could not open file %s", filename );
 658                 return ret;
 659         }
 660
 661         uint32_t nwritten;
 662         ret = fileio_write( &fileio, sizeof(customer),
 663                         (const uint8_t *)customer, &nwritten );
 664         if( ret != ERROR_OK )
 665         {
 666                 LOG_ERROR( "Write operation to file %s failed", filename );
 667                 fileio_close( &fileio );
 668                 return ret;
 669         }
 670
 671         fileio_close( &fileio );
 672
 673         return ERROR_OK;
 674 }
 675
 676
 677
 678
 679 /**
 680  * Enter password to enable potentially dangerous options.
 681  *
 682  * @param cmd_ctx
 683  * @param cmd
 684  * @param args
 685  * @param argc
 686  */
 687 static int lpc2900_handle_password_command(struct command_context_s *cmd_ctx,
 688                                            char *cmd, char **args, int argc)
 689 {
 690         if (argc < 2)
 691         {
 692                 return ERROR_COMMAND_SYNTAX_ERROR;
 693         }
 694
 695         flash_bank_t *bank;
 696         int retval = flash_command_get_bank_by_num(cmd_ctx, args[0], &bank);
 697         if (ERROR_OK != retval)
 698                 return retval;
 699
 700         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
 701
 702 #define ISS_PASSWORD "I_know_what_I_am_doing"
 703
 704         lpc2900_info->risky = !strcmp( args[1], ISS_PASSWORD );
 705
 706         if( !lpc2900_info->risky )
 707         {
 708                 command_print(cmd_ctx, "Wrong password (use '%s')", ISS_PASSWORD);
 709                 return ERROR_COMMAND_ARGUMENT_INVALID;
 710         }
 711
 712         command_print(cmd_ctx,
 713                   "Potentially dangerous operation allowed in next command!");
 714
 715         return ERROR_OK;
 716 }
 717
 718
 719
 720 /**
 721  * Write customer info from file to the index sector.
 722  *
 723  * @param cmd_ctx
 724  * @param cmd
 725  * @param args
 726  * @param argc
 727  */
 728 static int lpc2900_handle_write_custom_command( struct command_context_s *cmd_ctx,
 729                                                 char *cmd, char **args, int argc )
 730 {
 731         if (argc < 2)
 732         {
 733                 return ERROR_COMMAND_SYNTAX_ERROR;
 734         }
 735
 736         flash_bank_t *bank;
 737         int retval = flash_command_get_bank_by_num(cmd_ctx, args[0], &bank);
 738         if (ERROR_OK != retval)
 739                 return retval;
 740
 741         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
 742
 743         /* Check if command execution is allowed. */
 744         if( !lpc2900_info->risky )
 745         {
 746                 command_print( cmd_ctx, "Command execution not allowed!" );
 747                 return ERROR_COMMAND_ARGUMENT_INVALID;
 748         }
 749         lpc2900_info->risky = 0;
 750
 751         /* Get target, and check if it's halted */
 752         target_t *target = bank->target;
 753         if (target->state != TARGET_HALTED)
 754         {
 755                 LOG_ERROR("Target not halted");
 756                 return ERROR_TARGET_NOT_HALTED;
 757         }
 758
 759         /* The image will always start at offset 0 */
 760         image_t image;
 761         image.base_address_set = 1;
 762         image.base_address = 0;
 763         image.start_address_set = 0;
 764
 765         char *filename = args[1];
 766         char *type = (argc >= 3) ? args[2] : NULL;
 767         retval = image_open(&image, filename, type);
 768         if (retval != ERROR_OK)
 769         {
 770                 return retval;
 771         }
 772
 773         /* Do a sanity check: The image must be exactly the size of the customer
 774            programmable area. Any other size is rejected. */
 775         if( image.num_sections != 1 )
 776         {
 777                 LOG_ERROR("Only one section allowed in image file.");
 778                 return ERROR_COMMAND_SYNTAX_ERROR;
 779         }
 780         if( (image.sections[0].base_address != 0) ||
 781         (image.sections[0].size != ISS_CUSTOMER_SIZE) )
 782         {
 783                 LOG_ERROR("Incorrect image file size. Expected %d, "
 784                         "got %" PRIu32,
 785                    ISS_CUSTOMER_SIZE, image.sections[0].size);
 786                 return ERROR_COMMAND_SYNTAX_ERROR;
 787         }
 788
 789         /* Well boys, I reckon this is it... */
 790
 791         /* Customer info is split into two blocks in pages 4 and 5. */
 792         uint8_t page[FLASH_PAGE_SIZE];
 793
 794         /* Page 4 */
 795         uint32_t offset = ISS_CUSTOMER_START1 % FLASH_PAGE_SIZE;
 796         memset( page, 0xff, FLASH_PAGE_SIZE );
 797         uint32_t size_read;
 798         retval = image_read_section( &image, 0, 0,
 799                                      ISS_CUSTOMER_SIZE1, &page[offset], &size_read);
 800         if( retval != ERROR_OK )
 801         {
 802                 LOG_ERROR("couldn't read from file '%s'", filename);
 803                 image_close(&image);
 804                 return retval;
 805         }
 806         if( (retval = lpc2900_write_index_page( bank, 4, &page )) != ERROR_OK )
 807         {
 808                 image_close(&image);
 809                 return retval;
 810         }
 811
 812         /* Page 5 */
 813         offset = ISS_CUSTOMER_START2 % FLASH_PAGE_SIZE;
 814         memset( page, 0xff, FLASH_PAGE_SIZE );
 815         retval = image_read_section( &image, 0, ISS_CUSTOMER_SIZE1,
 816                                      ISS_CUSTOMER_SIZE2, &page[offset], &size_read);
 817         if( retval != ERROR_OK )
 818         {
 819                 LOG_ERROR("couldn't read from file '%s'", filename);
 820                 image_close(&image);
 821                 return retval;
 822         }
 823         if( (retval = lpc2900_write_index_page( bank, 5, &page )) != ERROR_OK )
 824         {
 825                 image_close(&image);
 826                 return retval;
 827         }
 828
 829         image_close(&image);
 830
 831         return ERROR_OK;
 832 }
 833
 834
 835
 836 /**
 837  * Activate 'sector security' for a range of sectors.
 838  *
 839  * @param cmd_ctx
 840  * @param cmd
 841  * @param args
 842  * @param argc
 843  */
 844 static int lpc2900_handle_secure_sector_command(struct command_context_s *cmd_ctx,
 845                                                 char *cmd, char **args, int argc)
 846 {
 847         if (argc < 3)
 848         {
 849                 return ERROR_COMMAND_SYNTAX_ERROR;
 850         }
 851
 852         /* Get the bank descriptor */
 853         flash_bank_t *bank;
 854         int retval = flash_command_get_bank_by_num(cmd_ctx, args[0], &bank);
 855         if (ERROR_OK != retval)
 856                 return retval;
 857
 858         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
 859
 860         /* Check if command execution is allowed. */
 861         if( !lpc2900_info->risky )
 862         {
 863                 command_print( cmd_ctx, "Command execution not allowed! "
 864                 "(use 'password' command first)");
 865                 return ERROR_COMMAND_ARGUMENT_INVALID;
 866         }
 867         lpc2900_info->risky = 0;
 868
 869         /* Read sector range, and do a sanity check. */
 870         int first, last;
 871         COMMAND_PARSE_NUMBER(int, args[1], first);
 872         COMMAND_PARSE_NUMBER(int, args[2], last);
 873         if( (first >= bank->num_sectors) ||
 874             (last >= bank->num_sectors) ||
 875             (first > last) )
 876         {
 877                 command_print( cmd_ctx, "Illegal sector range" );
 878                 return ERROR_COMMAND_ARGUMENT_INVALID;
 879         }
 880
 881         uint8_t page[FLASH_PAGE_SIZE];
 882         int sector;
 883
 884         /* Sectors in page 6 */
 885         if( (first <= 4) || (last >= 8) )
 886         {
 887                 memset( &page, 0xff, FLASH_PAGE_SIZE );
 888                 for( sector = first; sector <= last; sector++ )
 889                 {
 890                         if( sector <= 4 )
 891                         {
 892                                 memset( &page[0xB0 + 16*sector], 0, 16 );
 893                         }
 894                         else if( sector >= 8 )
 895                         {
 896                                 memset( &page[0x00 + 16*(sector - 8)], 0, 16 );
 897                         }
 898                 }
 899
 900                 if( (retval = lpc2900_write_index_page( bank, 6, &page )) != ERROR_OK )
 901                 {
 902                         LOG_ERROR("failed to update index sector page 6");
 903                         return retval;
 904                 }
 905         }
 906
 907         /* Sectors in page 7 */
 908         if( (first <= 7) && (last >= 5) )
 909         {
 910                 memset( &page, 0xff, FLASH_PAGE_SIZE );
 911                 for( sector = first; sector <= last; sector++ )
 912                 {
 913                         if( (sector >= 5) && (sector <= 7) )
 914                         {
 915                                 memset( &page[0x00 + 16*(sector - 5)], 0, 16 );
 916                         }
 917                 }
 918
 919                 if( (retval = lpc2900_write_index_page( bank, 7, &page )) != ERROR_OK )
 920                 {
 921                         LOG_ERROR("failed to update index sector page 7");
 922                         return retval;
 923                 }
 924         }
 925
 926         command_print( cmd_ctx,
 927                 "Sectors security will become effective after next power cycle");
 928
 929         /* Update the sector security status */
 930         if ( lpc2900_read_security_status(bank) != ERROR_OK )
 931         {
 932                 LOG_ERROR( "Cannot determine sector security status" );
 933                 return ERROR_FLASH_OPERATION_FAILED;
 934         }
 935
 936         return ERROR_OK;
 937 }
 938
 939
 940
 941 /**
 942  * Activate JTAG protection.
 943  *
 944  * @param cmd_ctx
 945  * @param cmd
 946  * @param args
 947  * @param argc
 948  */
 949 static int lpc2900_handle_secure_jtag_command(struct command_context_s *cmd_ctx,
 950                                               char *cmd, char **args, int argc)
 951 {
 952         if (argc < 1)
 953         {
 954                 return ERROR_COMMAND_SYNTAX_ERROR;
 955         }
 956
 957         /* Get the bank descriptor */
 958         flash_bank_t *bank;
 959         int retval = flash_command_get_bank_by_num(cmd_ctx, args[0], &bank);
 960         if (ERROR_OK != retval)
 961                 return retval;
 962
 963         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
 964
 965         /* Check if command execution is allowed. */
 966         if( !lpc2900_info->risky )
 967         {
 968                 command_print( cmd_ctx, "Command execution not allowed! "
 969                                         "(use 'password' command first)");
 970                 return ERROR_COMMAND_ARGUMENT_INVALID;
 971         }
 972         lpc2900_info->risky = 0;
 973
 974         /* Prepare page */
 975         uint8_t page[FLASH_PAGE_SIZE];
 976         memset( &page, 0xff, FLASH_PAGE_SIZE );
 977
 978
 979         /* Insert "soft" protection word */
 980         page[0x30 + 15] = 0x7F;
 981         page[0x30 + 11] = 0x7F;
 982         page[0x30 +  7] = 0x7F;
 983         page[0x30 +  3] = 0x7F;
 984
 985         /* Write to page 5 */
 986         if( (retval = lpc2900_write_index_page( bank, 5, &page ))
 987                         != ERROR_OK )
 988         {
 989                 LOG_ERROR("failed to update index sector page 5");
 990                 return retval;
 991         }
 992
 993         LOG_INFO("JTAG security set. Good bye!");
 994
 995         return ERROR_OK;
 996 }
 997
 998
 999
1000 /***********************  Flash interface functions  **************************/
1001
1002
1003 /**
1004  * Register private command handlers.
1005  *
1006  * @param cmd_ctx
1007  */
1008 static int lpc2900_register_commands(struct command_context_s *cmd_ctx)
1009 {
1010         command_t *lpc2900_cmd = register_command(cmd_ctx, NULL, "lpc2900",
1011                                                   NULL, COMMAND_ANY, NULL);
1012
1013         register_command(
1014             cmd_ctx,
1015             lpc2900_cmd,
1016             "signature",
1017             lpc2900_handle_signature_command,
1018             COMMAND_EXEC,
1019             "<bank> | "
1020             "print device signature of flash bank");
1021
1022         register_command(
1023             cmd_ctx,
1024             lpc2900_cmd,
1025             "read_custom",
1026             lpc2900_handle_read_custom_command,
1027             COMMAND_EXEC,
1028             "<bank> <filename> | "
1029             "read customer information from index sector to file");
1030
1031         register_command(
1032             cmd_ctx,
1033             lpc2900_cmd,
1034             "password",
1035             lpc2900_handle_password_command,
1036             COMMAND_EXEC,
1037             "<bank> <password> | "
1038             "enter password to enable 'dangerous' options");
1039
1040         register_command(
1041             cmd_ctx,
1042             lpc2900_cmd,
1043             "write_custom",
1044             lpc2900_handle_write_custom_command,
1045             COMMAND_EXEC,
1046             "<bank> <filename> [<type>] | "
1047             "write customer info from file to index sector");
1048
1049         register_command(
1050             cmd_ctx,
1051             lpc2900_cmd,
1052             "secure_sector",
1053             lpc2900_handle_secure_sector_command,
1054             COMMAND_EXEC,
1055             "<bank> <first> <last> | "
1056             "activate sector security for a range of sectors");
1057
1058         register_command(
1059             cmd_ctx,
1060             lpc2900_cmd,
1061             "secure_jtag",
1062             lpc2900_handle_secure_jtag_command,
1063             COMMAND_EXEC,
1064             "<bank> <level> | "
1065             "activate JTAG security");
1066
1067         return ERROR_OK;
1068 }
1069
1070
1071 /**
1072  * Evaluate flash bank command.
1073  *
1074  * Syntax: flash bank lpc2900 0 0 0 0 target# system_base_clock
1075  *
1076  * @param cmd_ctx
1077  * @param cmd
1078  * @param args
1079  * @param argc
1080  * @param bank Pointer to the flash bank descriptor
1081  */
1082 static int lpc2900_flash_bank_command(struct command_context_s *cmd_ctx,
1083                                       char *cmd, char **args, int argc,
1084                                       struct flash_bank_s *bank)
1085 {
1086         lpc2900_flash_bank_t *lpc2900_info;
1087
1088         if (argc < 6)
1089         {
1090                 LOG_WARNING("incomplete flash_bank LPC2900 configuration");
1091                 return ERROR_FLASH_BANK_INVALID;
1092         }
1093
1094         lpc2900_info = malloc(sizeof(lpc2900_flash_bank_t));
1095         bank->driver_priv = lpc2900_info;
1096
1097         /* Get flash clock.
1098          * Reject it if we can't meet the requirements for program time
1099          * (if clock too slow), or for erase time (clock too fast).
1100          */
1101         uint32_t clk_sys_fmc;
1102         COMMAND_PARSE_NUMBER(u32, args[6], clk_sys_fmc);
1103         lpc2900_info->clk_sys_fmc = clk_sys_fmc * 1000;
1104
1105         uint32_t clock_limit;
1106         /* Check program time limit */
1107         clock_limit = 512000000l / FLASH_PROGRAM_TIME;
1108         if (lpc2900_info->clk_sys_fmc < clock_limit)
1109         {
1110                 LOG_WARNING("flash clock must be at least %" PRIu32 " kHz",
1111                     (clock_limit / 1000));
1112                 return ERROR_FLASH_BANK_INVALID;
1113         }
1114
1115         /* Check erase time limit */
1116         clock_limit = (uint32_t)((32767.0 * 512.0 * 1e6) / FLASH_ERASE_TIME);
1117         if (lpc2900_info->clk_sys_fmc > clock_limit)
1118         {
1119                 LOG_WARNING("flash clock must be a maximum of %" PRIu32" kHz",
1120                     (clock_limit / 1000));
1121                 return ERROR_FLASH_BANK_INVALID;
1122         }
1123
1124         /* Chip ID will be obtained by probing the device later */
1125         lpc2900_info->chipid = 0;
1126
1127         return ERROR_OK;
1128 }
1129
1130
1131 /**
1132  * Erase sector(s).
1133  *
1134  * @param bank Pointer to the flash bank descriptor
1135  * @param first First sector to be erased
1136  * @param last Last sector (including) to be erased
1137  */
1138 static int lpc2900_erase(struct flash_bank_s *bank, int first, int last)
1139 {
1140         uint32_t status;
1141         int sector;
1142         int last_unsecured_sector;
1143         target_t *target = bank->target;
1144         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
1145
1146
1147         status = lpc2900_is_ready(bank);
1148         if (status != ERROR_OK)
1149         {
1150                 return status;
1151         }
1152
1153         /* Sanity check on sector range */
1154         if ((first < 0) || (last < first) || (last >= bank->num_sectors))
1155         {
1156                 LOG_INFO("Bad sector range");
1157                 return ERROR_FLASH_SECTOR_INVALID;
1158         }
1159
1160         /* Update the info about secured sectors */
1161         lpc2900_read_security_status( bank );
1162
1163         /* The selected sector range might include secured sectors. An attempt
1164          * to erase such a sector will cause the erase to fail also for unsecured
1165          * sectors. It is necessary to determine the last unsecured sector now,
1166          * because we have to treat the last relevant sector in the list in
1167          * a special way.
1168          */
1169         last_unsecured_sector = -1;
1170         for (sector = first; sector <= last; sector++)
1171         {
1172                 if ( !bank->sectors[sector].is_protected )
1173                 {
1174                         last_unsecured_sector = sector;
1175                 }
1176         }
1177
1178         /* Exit now, in case of the rare constellation where all sectors in range
1179          * are secured. This is regarded a success, since erasing/programming of
1180          * secured sectors shall be handled transparently.
1181          */
1182         if ( last_unsecured_sector == -1 )
1183         {
1184                 return ERROR_OK;
1185         }
1186
1187         /* Enable flash block and set the correct CRA clock of 66 kHz */
1188         lpc2900_setup(bank);
1189
1190         /* Clear END_OF_ERASE interrupt status */
1191         target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_ERASE);
1192
1193         /* Set the program/erase timer to FLASH_ERASE_TIME */
1194         target_write_u32(target, FPTR,
1195                          FPTR_EN_T | lpc2900_calc_tr( lpc2900_info->clk_sys_fmc,
1196                                                       FLASH_ERASE_TIME ));
1197
1198         /* Sectors are marked for erasure, then erased all together */
1199         for (sector = first; sector <= last_unsecured_sector; sector++)
1200         {
1201                 /* Only mark sectors that aren't secured. Any attempt to erase a group
1202                  * of sectors will fail if any single one of them is secured!
1203                  */
1204                 if ( !bank->sectors[sector].is_protected )
1205                 {
1206                         /* Unprotect the sector */
1207                         target_write_u32(target, bank->sectors[sector].offset, 0);
1208                         target_write_u32(target, FCTR,
1209                                          FCTR_FS_LOADREQ | FCTR_FS_WPB |
1210                                          FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
1211
1212                         /* Mark the sector for erasure. The last sector in the list
1213                            triggers the erasure. */
1214                         target_write_u32(target, bank->sectors[sector].offset, 0);
1215                         if ( sector == last_unsecured_sector )
1216                         {
1217                                 target_write_u32(target, FCTR,
1218                                                  FCTR_FS_PROGREQ | FCTR_FS_WPB | FCTR_FS_CS);
1219                         }
1220                         else
1221                         {
1222                                 target_write_u32(target, FCTR,
1223                                                  FCTR_FS_LOADREQ | FCTR_FS_WPB |
1224                                                  FCTR_FS_WEB | FCTR_FS_CS);
1225                         }
1226                 }
1227         }
1228
1229         /* Wait for the end of the erase operation. If it's not over after two seconds,
1230          * something went dreadfully wrong... :-(
1231          */
1232         if( lpc2900_wait_status(bank, INTSRC_END_OF_ERASE, 2000) != ERROR_OK )
1233         {
1234                 return ERROR_FLASH_OPERATION_FAILED;
1235         }
1236
1237         /* Normal flash operating mode */
1238         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1239
1240         return ERROR_OK;
1241 }
1242
1243
1244
1245 static int lpc2900_protect(struct flash_bank_s *bank, int set, int first, int last)
1246 {
1247         /* This command is not supported.
1248      * "Protection" in LPC2900 terms is handled transparently. Sectors will
1249      * automatically be unprotected as needed.
1250      * Instead we use the concept of sector security. A secured sector is shown
1251      * as "protected" in OpenOCD. Sector security is a permanent feature, and
1252      * cannot be disabled once activated.
1253      */
1254
1255         return ERROR_OK;
1256 }
1257
1258
1259 /**
1260  * Write data to flash.
1261  *
1262  * @param bank Pointer to the flash bank descriptor
1263  * @param buffer Buffer with data
1264  * @param offset Start address (relative to bank start)
1265  * @param count Number of bytes to be programmed
1266  */
1267 static int lpc2900_write(struct flash_bank_s *bank, uint8_t *buffer,
1268                          uint32_t offset, uint32_t count)
1269 {
1270         uint8_t page[FLASH_PAGE_SIZE];
1271         uint32_t status;
1272         uint32_t num_bytes;
1273         target_t *target = bank->target;
1274         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
1275         int sector;
1276         int retval;
1277
1278         static const uint32_t write_target_code[] = {
1279                 /* Set auto latch mode: FCTR=CS|WRE|WEB */
1280                 0xe3a0a007,   /* loop       mov r10, #0x007 */
1281                 0xe583a000,   /*            str r10,[r3,#0] */
1282
1283                 /* Load complete page into latches */
1284                 0xe3a06020,   /*            mov r6,#(512/16) */
1285                 0xe8b00f00,   /* next       ldmia r0!,{r8-r11} */
1286                 0xe8a10f00,   /*            stmia r1!,{r8-r11} */
1287                 0xe2566001,   /*            subs r6,#1 */
1288                 0x1afffffb,   /*            bne next */
1289
1290                 /* Clear END_OF_BURN interrupt status */
1291                 0xe3a0a002,   /*            mov r10,#(1 << 1) */
1292                 0xe583afe8,   /*            str r10,[r3,#0xfe8] */
1293
1294                 /* Set the erase time to FLASH_PROGRAM_TIME */
1295                 0xe5834008,   /*            str r4,[r3,#8] */
1296
1297                 /* Trigger flash write
1298                         FCTR = CS | WRE | WPB | PROGREQ */
1299                 0xe3a0a083,   /*            mov r10,#0x83 */
1300                 0xe38aaa01,   /*            orr r10,#0x1000 */
1301                 0xe583a000,   /*            str r10,[r3,#0] */
1302
1303                 /* Wait for end of burn */
1304                 0xe593afe0,   /* wait       ldr r10,[r3,#0xfe0] */
1305                 0xe21aa002,   /*            ands r10,#(1 << 1) */
1306                 0x0afffffc,   /*            beq wait */
1307
1308                 /* End? */
1309                 0xe2522001,   /*            subs r2,#1 */
1310                 0x1affffed,   /*            bne loop */
1311
1312                 0xeafffffe    /* done       b done */
1313         };
1314
1315
1316         status = lpc2900_is_ready(bank);
1317         if (status != ERROR_OK)
1318         {
1319                 return status;
1320         }
1321
1322         /* Enable flash block and set the correct CRA clock of 66 kHz */
1323         lpc2900_setup(bank);
1324
1325         /* Update the info about secured sectors */
1326         lpc2900_read_security_status( bank );
1327
1328         /* Unprotect all involved sectors */
1329         for (sector = 0; sector < bank->num_sectors; sector++)
1330         {
1331                 /* Start address in or before this sector? */
1332                 /* End address in or behind this sector? */
1333                 if ( ((bank->base + offset) <
1334                           (bank->sectors[sector].offset + bank->sectors[sector].size)) &&
1335                      ((bank->base + (offset + count - 1)) >= bank->sectors[sector].offset) )
1336                 {
1337                         /* This sector is involved and needs to be unprotected.
1338                                 * Don't do it for secured sectors.
1339                                 */
1340                         if ( !bank->sectors[sector].is_protected )
1341                         {
1342                                 target_write_u32(target, bank->sectors[sector].offset, 0);
1343                                 target_write_u32(target, FCTR,
1344                                                  FCTR_FS_LOADREQ | FCTR_FS_WPB |
1345                                                  FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
1346                         }
1347                 }
1348         }
1349
1350         /* Set the program/erase time to FLASH_PROGRAM_TIME */
1351         uint32_t prog_time = FPTR_EN_T | lpc2900_calc_tr( lpc2900_info->clk_sys_fmc,
1352                                                           FLASH_PROGRAM_TIME );
1353
1354         /* If there is a working area of reasonable size, use it to program via
1355            a target algorithm. If not, fall back to host programming. */
1356
1357         /* We need some room for target code. */
1358         uint32_t target_code_size = sizeof(write_target_code);
1359
1360         /* Try working area allocation. Start with a large buffer, and try with
1361            reduced size if that fails. */
1362         working_area_t *warea;
1363         uint32_t buffer_size = lpc2900_info->max_ram_block - 1 * KiB;
1364         while( (retval = target_alloc_working_area(target,
1365                                                    buffer_size + target_code_size,
1366                                                    &warea)) != ERROR_OK )
1367         {
1368                 /* Try a smaller buffer now, and stop if it's too small. */
1369                 buffer_size -= 1 * KiB;
1370                 if (buffer_size < 2 * KiB)
1371                 {
1372                         LOG_INFO( "no (large enough) working area"
1373                                   ", falling back to host mode" );
1374                         warea = NULL;
1375                         break;
1376                 }
1377         };
1378
1379         if( warea )
1380         {
1381                 reg_param_t reg_params[5];
1382                 armv4_5_algorithm_t armv4_5_info;
1383
1384                 /* We can use target mode. Download the algorithm. */
1385                 retval = target_write_buffer( target,
1386                                               (warea->address)+buffer_size,
1387                                               target_code_size,
1388                                               (uint8_t *)write_target_code);
1389                 if (retval != ERROR_OK)
1390                 {
1391                         LOG_ERROR("Unable to write block write code to target");
1392                         target_free_all_working_areas(target);
1393                         return ERROR_FLASH_OPERATION_FAILED;
1394                 }
1395
1396                 init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT);
1397                 init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);
1398                 init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);
1399                 init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);
1400                 init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT);
1401
1402                 /* Write to flash in large blocks */
1403                 while ( count != 0 )
1404                 {
1405                         uint32_t this_npages;
1406                         uint8_t *this_buffer;
1407                         int start_sector = lpc2900_address2sector( bank, offset );
1408
1409                         /* First page / last page / rest */
1410                         if( offset % FLASH_PAGE_SIZE )
1411                         {
1412                                 /* Block doesn't start on page boundary.
1413                                    Burn first partial page separately. */
1414                                 memset( &page, 0xff, sizeof(page) );
1415                                 memcpy( &page[offset % FLASH_PAGE_SIZE],
1416                                         buffer,
1417                                         FLASH_PAGE_SIZE - (offset % FLASH_PAGE_SIZE) );
1418                                 this_npages = 1;
1419                                 this_buffer = &page[0];
1420                                 count = count + (offset % FLASH_PAGE_SIZE);
1421                                 offset = offset - (offset % FLASH_PAGE_SIZE);
1422                         }
1423                         else if( count < FLASH_PAGE_SIZE )
1424                         {
1425                                 /* Download last incomplete page separately. */
1426                                 memset( &page, 0xff, sizeof(page) );
1427                                 memcpy( &page, buffer, count );
1428                                 this_npages = 1;
1429                                 this_buffer = &page[0];
1430                                 count = FLASH_PAGE_SIZE;
1431                         }
1432                         else
1433                         {
1434                                 /* Download as many full pages as possible */
1435                                 this_npages = (count < buffer_size) ?
1436                                                count / FLASH_PAGE_SIZE :
1437                                                buffer_size / FLASH_PAGE_SIZE;
1438                                 this_buffer = buffer;
1439
1440                                 /* Make sure we stop at the next secured sector */
1441                                 int sector = start_sector + 1;
1442                                 while( sector < bank->num_sectors )
1443                                 {
1444                                         /* Secured? */
1445                                         if( bank->sectors[sector].is_protected )
1446                                         {
1447                                                 /* Is that next sector within the current block? */
1448                                                 if( (bank->sectors[sector].offset - bank->base) <
1449                                                         (offset + (this_npages * FLASH_PAGE_SIZE)) )
1450                                                 {
1451                                                         /* Yes! Split the block */
1452                                                         this_npages =
1453                                                           (bank->sectors[sector].offset - bank->base - offset)
1454                                                               / FLASH_PAGE_SIZE;
1455                                                         break;
1456                                                 }
1457                                         }
1458
1459                                         sector++;
1460                                 }
1461                         }
1462
1463                         /* Skip the current sector if it is secured */
1464                         if (bank->sectors[start_sector].is_protected)
1465                         {
1466                                 LOG_DEBUG("Skip secured sector %d",
1467                                                 start_sector);
1468
1469                                 /* Stop if this is the last sector */
1470                                 if (start_sector == bank->num_sectors - 1)
1471                                 {
1472                                         break;
1473                                 }
1474
1475                                 /* Skip */
1476                                 uint32_t nskip = bank->sectors[start_sector].size -
1477                                                  (offset % bank->sectors[start_sector].size);
1478                                 offset += nskip;
1479                                 buffer += nskip;
1480                                 count = (count >= nskip) ? (count - nskip) : 0;
1481                                 continue;
1482                         }
1483
1484                         /* Execute buffer download */
1485                         if ((retval = target_write_buffer(target,
1486                                                           warea->address,
1487                                                           this_npages * FLASH_PAGE_SIZE,
1488                                                           this_buffer)) != ERROR_OK)
1489                         {
1490                                 LOG_ERROR("Unable to write data to target");
1491                                 target_free_all_working_areas(target);
1492                                 return ERROR_FLASH_OPERATION_FAILED;
1493                         }
1494
1495                         /* Prepare registers */
1496                         buf_set_u32(reg_params[0].value, 0, 32, warea->address);
1497                         buf_set_u32(reg_params[1].value, 0, 32, offset);
1498                         buf_set_u32(reg_params[2].value, 0, 32, this_npages);
1499                         buf_set_u32(reg_params[3].value, 0, 32, FCTR);
1500                         buf_set_u32(reg_params[4].value, 0, 32, FPTR_EN_T | prog_time);
1501
1502                         /* Execute algorithm, assume breakpoint for last instruction */
1503                         armv4_5_info.common_magic = ARMV4_5_COMMON_MAGIC;
1504                         armv4_5_info.core_mode = ARMV4_5_MODE_SVC;
1505                         armv4_5_info.core_state = ARMV4_5_STATE_ARM;
1506
1507                         retval = target_run_algorithm(target, 0, NULL, 5, reg_params,
1508                                 (warea->address) + buffer_size,
1509                                 (warea->address) + buffer_size + target_code_size - 4,
1510                                 10000, /* 10s should be enough for max. 16 KiB of data */
1511                                 &armv4_5_info);
1512
1513                         if (retval != ERROR_OK)
1514                         {
1515                                 LOG_ERROR("Execution of flash algorithm failed.");
1516                                 target_free_all_working_areas(target);
1517                                 retval = ERROR_FLASH_OPERATION_FAILED;
1518                                 break;
1519                         }
1520
1521                         count -= this_npages * FLASH_PAGE_SIZE;
1522                         buffer += this_npages * FLASH_PAGE_SIZE;
1523                         offset += this_npages * FLASH_PAGE_SIZE;
1524                 }
1525
1526                 /* Free all resources */
1527                 destroy_reg_param(&reg_params[0]);
1528                 destroy_reg_param(&reg_params[1]);
1529                 destroy_reg_param(&reg_params[2]);
1530                 destroy_reg_param(&reg_params[3]);
1531                 destroy_reg_param(&reg_params[4]);
1532                 target_free_all_working_areas(target);
1533         }
1534         else
1535         {
1536                 /* Write to flash memory page-wise */
1537                 while ( count != 0 )
1538                 {
1539                         /* How many bytes do we copy this time? */
1540                         num_bytes = (count >= FLASH_PAGE_SIZE) ?
1541                                     FLASH_PAGE_SIZE - (offset % FLASH_PAGE_SIZE) :
1542                                     count;
1543
1544                         /* Don't do anything with it if the page is in a secured sector. */
1545                         if ( !bank->sectors[lpc2900_address2sector(bank, offset)].is_protected )
1546                         {
1547                                 /* Set latch load mode */
1548                                 target_write_u32(target, FCTR,
1549                                                  FCTR_FS_CS | FCTR_FS_WRE | FCTR_FS_WEB);
1550
1551                                 /* Always clear the buffer (a little overhead, but who cares) */
1552                                 memset(page, 0xFF, FLASH_PAGE_SIZE);
1553
1554                                 /* Copy them to the buffer */
1555                                 memcpy( &page[offset % FLASH_PAGE_SIZE],
1556                                         &buffer[offset % FLASH_PAGE_SIZE],
1557                                         num_bytes );
1558
1559                                 /* Write whole page to flash data latches */
1560                                 if (target_write_memory(
1561                                                  target,
1562                                                  bank->base + (offset - (offset % FLASH_PAGE_SIZE)),
1563                                                  4, FLASH_PAGE_SIZE / 4, page) != ERROR_OK)
1564                                 {
1565                                         LOG_ERROR("Write failed @ 0x%8.8" PRIx32, offset);
1566                                         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1567
1568                                         return ERROR_FLASH_OPERATION_FAILED;
1569                                 }
1570
1571                                 /* Clear END_OF_BURN interrupt status */
1572                                 target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_BURN);
1573
1574                                 /* Set the programming time */
1575                                 target_write_u32(target, FPTR, FPTR_EN_T | prog_time);
1576
1577                                 /* Trigger flash write */
1578                                 target_write_u32(target, FCTR,
1579                                     FCTR_FS_CS | FCTR_FS_WRE | FCTR_FS_WPB | FCTR_FS_PROGREQ);
1580
1581                                 /* Wait for the end of the write operation. If it's not over
1582                                  * after one second, something went dreadfully wrong... :-(
1583                                  */
1584                                 if (lpc2900_wait_status(bank, INTSRC_END_OF_BURN, 1000) != ERROR_OK)
1585                                 {
1586                                         LOG_ERROR("Write failed @ 0x%8.8" PRIx32, offset);
1587                                         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1588
1589                                         return ERROR_FLASH_OPERATION_FAILED;
1590                                 }
1591                         }
1592
1593                         /* Update pointers and counters */
1594                         offset += num_bytes;
1595                         buffer += num_bytes;
1596                         count -= num_bytes;
1597                 }
1598
1599                 retval = ERROR_OK;
1600         }
1601
1602         /* Normal flash operating mode */
1603         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1604
1605         return retval;
1606 }
1607
1608
1609 /**
1610  * Try and identify the device.
1611  *
1612  * Determine type number and its memory layout.
1613  *
1614  * @param bank Pointer to the flash bank descriptor
1615  */
1616 static int lpc2900_probe(struct flash_bank_s *bank)
1617 {
1618         lpc2900_flash_bank_t *lpc2900_info = bank->driver_priv;
1619         target_t *target = bank->target;
1620         int i = 0;
1621         uint32_t offset;
1622
1623
1624         if (target->state != TARGET_HALTED)
1625         {
1626                 LOG_ERROR("Target not halted");
1627                 return ERROR_TARGET_NOT_HALTED;
1628         }
1629
1630         /* We want to do this only once. Check if we already have a valid CHIPID,
1631          * because then we will have already successfully probed the device.
1632          */
1633         if (lpc2900_info->chipid == EXPECTED_CHIPID)
1634         {
1635                 return ERROR_OK;
1636         }
1637
1638         /* Probing starts with reading the CHIPID register. We will continue only
1639          * if this identifies as an LPC2900 device.
1640          */
1641         target_read_u32(target, CHIPID, &lpc2900_info->chipid);
1642
1643         if (lpc2900_info->chipid != EXPECTED_CHIPID)
1644         {
1645                 LOG_WARNING("Device is not an LPC29xx");
1646                 return ERROR_FLASH_OPERATION_FAILED;
1647         }
1648
1649         /* It's an LPC29xx device. Now read the feature register FEAT0...FEAT3. */
1650         uint32_t feat0, feat1, feat2, feat3;
1651         target_read_u32(target, FEAT0, &feat0);
1652         target_read_u32(target, FEAT1, &feat1);
1653         target_read_u32(target, FEAT2, &feat2);
1654         target_read_u32(target, FEAT3, &feat3);
1655
1656         /* Base address */
1657         bank->base = 0x20000000;
1658
1659         /* Determine flash layout from FEAT2 register */
1660         uint32_t num_64k_sectors = (feat2 >> 16) & 0xFF;
1661         uint32_t num_8k_sectors = (feat2 >> 0) & 0xFF;
1662         bank->num_sectors = num_64k_sectors + num_8k_sectors;
1663         bank->size = KiB * (64 * num_64k_sectors + 8 * num_8k_sectors);
1664
1665         /* Determine maximum contiguous RAM block */
1666         lpc2900_info->max_ram_block = 16 * KiB;
1667         if( (feat1 & 0x30) == 0x30 )
1668         {
1669                 lpc2900_info->max_ram_block = 32 * KiB;
1670                 if( (feat1 & 0x0C) == 0x0C )
1671                 {
1672                         lpc2900_info->max_ram_block = 48 * KiB;
1673                 }
1674         }
1675
1676         /* Determine package code and ITCM size */
1677         uint32_t package_code = feat0 & 0x0F;
1678         uint32_t itcm_code = (feat1 >> 16) & 0x1F;
1679
1680         /* Determine the exact type number. */
1681         uint32_t found = 1;
1682         if ( (package_code == 4) && (itcm_code == 5) )
1683         {
1684                 /* Old LPC2917 or LPC2919 (non-/01 devices) */
1685                 lpc2900_info->target_name = (bank->size == 768*KiB) ? "LPC2919" : "LPC2917";
1686         }
1687         else
1688         {
1689                 if ( package_code == 2 )
1690                 {
1691                         /* 100-pin package */
1692                         if ( bank->size == 128*KiB )
1693                         {
1694                                 lpc2900_info->target_name = "LPC2921";
1695                         }
1696                         else if ( bank->size == 256*KiB )
1697                         {
1698                                 lpc2900_info->target_name = "LPC2923";
1699                         }
1700                         else if ( bank->size == 512*KiB )
1701                         {
1702                                 lpc2900_info->target_name = "LPC2925";
1703                         }
1704                         else
1705                         {
1706                                 found = 0;
1707                         }
1708                 }
1709                 else if ( package_code == 4 )
1710                 {
1711                         /* 144-pin package */
1712                         if ( (bank->size == 512*KiB) && (feat3 == 0xFFFFFCF0) )
1713                         {
1714                                 lpc2900_info->target_name = "LPC2917/01";
1715                         }
1716                         else if ( (bank->size == 512*KiB) && (feat3 == 0xFFFFFFF1) )
1717                         {
1718                                 lpc2900_info->target_name = "LPC2927";
1719                         }
1720                         else if ( (bank->size == 768*KiB) && (feat3 == 0xFFFFFCF8) )
1721                         {
1722                                 lpc2900_info->target_name = "LPC2919/01";
1723                         }
1724                         else if ( (bank->size == 768*KiB) && (feat3 == 0xFFFFFFF9) )
1725                         {
1726                                 lpc2900_info->target_name = "LPC2929";
1727                         }
1728                         else
1729                         {
1730                                 found = 0;
1731                         }
1732                 }
1733                 else if ( package_code == 5 )
1734                 {
1735                         /* 208-pin package */
1736                         lpc2900_info->target_name = (bank->size == 0) ? "LPC2930" : "LPC2939";
1737                 }
1738                 else
1739                 {
1740                         found = 0;
1741                 }
1742         }
1743
1744         if ( !found )
1745         {
1746                 LOG_WARNING("Unknown LPC29xx derivative");
1747                 return ERROR_FLASH_OPERATION_FAILED;
1748         }
1749
1750         /* Show detected device */
1751         LOG_INFO("Flash bank %d"
1752                  ": Device %s, %" PRIu32
1753                  " KiB in %d sectors",
1754                  bank->bank_number,
1755                  lpc2900_info->target_name, bank->size / KiB,
1756                  bank->num_sectors);
1757
1758         /* Flashless devices cannot be handled */
1759         if ( bank->num_sectors == 0 )
1760         {
1761                 LOG_WARNING("Flashless device cannot be handled");
1762                 return ERROR_FLASH_OPERATION_FAILED;
1763         }
1764
1765         /* Sector layout.
1766          * These are logical sector numbers. When doing real flash operations,
1767          * the logical flash number are translated into the physical flash numbers
1768          * of the device.
1769          */
1770         bank->sectors = malloc(sizeof(flash_sector_t) * bank->num_sectors);
1771
1772         offset = 0;
1773         for (i = 0; i < bank->num_sectors; i++)
1774         {
1775                 bank->sectors[i].offset = offset;
1776                 bank->sectors[i].is_erased = -1;
1777                 bank->sectors[i].is_protected = -1;
1778
1779                 if ( i <= 7 )
1780                 {
1781                         bank->sectors[i].size = 8 * KiB;
1782                 }
1783                 else if ( i <= 18 )
1784                 {
1785                         bank->sectors[i].size = 64 * KiB;
1786                 }
1787                 else
1788                 {
1789                         /* We shouldn't come here. But there might be a new part out there
1790                          * that has more than 19 sectors. Politely ask for a fix then.
1791                          */
1792                         bank->sectors[i].size = 0;
1793                         LOG_ERROR("Never heard about sector %d", i);
1794                 }
1795
1796                 offset += bank->sectors[i].size;
1797         }
1798
1799         /* Read sector security status */
1800         if ( lpc2900_read_security_status(bank) != ERROR_OK )
1801         {
1802                 LOG_ERROR("Cannot determine sector security status");
1803                 return ERROR_FLASH_OPERATION_FAILED;
1804         }
1805
1806         return ERROR_OK;
1807 }
1808
1809
1810 /**
1811  * Run a blank check for each sector.
1812  *
1813  * For speed reasons, the device isn't read word by word.
1814  * A hash value is calculated by the hardware ("BIST") for each sector.
1815  * This value is then compared against the known hash of an empty sector.
1816  *
1817  * @param bank Pointer to the flash bank descriptor
1818  */
1819 static int lpc2900_erase_check(struct flash_bank_s *bank)
1820 {
1821         uint32_t status = lpc2900_is_ready(bank);
1822         if (status != ERROR_OK)
1823         {
1824                 LOG_INFO("Processor not halted/not probed");
1825                 return status;
1826         }
1827
1828         /* Use the BIST (Built-In Selft Test) to generate a signature of each flash
1829          * sector. Compare against the expected signature of an empty sector.
1830          */
1831         int sector;
1832         for ( sector = 0; sector < bank->num_sectors; sector++ )
1833         {
1834                 uint32_t signature[4];
1835                 if ( (status = lpc2900_run_bist128( bank,
1836                                                     bank->sectors[sector].offset,
1837                                                     bank->sectors[sector].offset +
1838                                                        (bank->sectors[sector].size - 1),
1839                                                     &signature)) != ERROR_OK )
1840                 {
1841                         return status;
1842                 }
1843
1844                 /* The expected signatures for an empty sector are different
1845                  * for 8 KiB and 64 KiB sectors.
1846                  */
1847                 if ( bank->sectors[sector].size == 8*KiB )
1848                 {
1849                         bank->sectors[sector].is_erased =
1850                             (signature[3] == 0x01ABAAAA) &&
1851                             (signature[2] == 0xAAAAAAAA) &&
1852                             (signature[1] == 0xAAAAAAAA) &&
1853                             (signature[0] == 0xAAA00AAA);
1854                 }
1855                 if ( bank->sectors[sector].size == 64*KiB )
1856                 {
1857                         bank->sectors[sector].is_erased =
1858                             (signature[3] == 0x11801222) &&
1859                             (signature[2] == 0xB88844FF) &&
1860                             (signature[1] == 0x11A22008) &&
1861                             (signature[0] == 0x2B1BFE44);
1862                 }
1863         }
1864
1865         return ERROR_OK;
1866 }
1867
1868
1869 /**
1870  * Get protection (sector security) status.
1871  *
1872  * Determine the status of "sector security" for each sector.
1873  * A secured sector is one that can never be erased/programmed again.
1874  *
1875  * @param bank Pointer to the flash bank descriptor
1876  */
1877 static int lpc2900_protect_check(struct flash_bank_s *bank)
1878 {
1879         return lpc2900_read_security_status(bank);
1880 }
1881
1882
1883 /**
1884  * Print info about the driver (not the device).
1885  *
1886  * @param bank Pointer to the flash bank descriptor
1887  * @param buf Buffer to take the string
1888  * @param buf_size Maximum number of characters that the buffer can take
1889  */
1890 static int lpc2900_info(struct flash_bank_s *bank, char *buf, int buf_size)
1891 {
1892         snprintf(buf, buf_size, "lpc2900 flash driver");
1893
1894         return ERROR_OK;
1895 }
1896
1897
1898 flash_driver_t lpc2900_flash =
1899 {
1900         .name               = "lpc2900",
1901         .register_commands  = lpc2900_register_commands,
1902         .flash_bank_command = lpc2900_flash_bank_command,
1903         .erase              = lpc2900_erase,
1904         .protect            = lpc2900_protect,
1905         .write              = lpc2900_write,
1906         .probe              = lpc2900_probe,
1907         .auto_probe         = lpc2900_probe,
1908         .erase_check        = lpc2900_erase_check,
1909         .protect_check      = lpc2900_protect_check,
1910         .info               = lpc2900_info
1911 };