git.gag.com Git - fw/openocd/blob - src/flash/nor/cfi.c

   1 /***************************************************************************
   2  *   Copyright (C) 2005, 2007 by Dominic Rath                              *
   3  *   Dominic.Rath@gmx.de                                                   *
   4  *   Copyright (C) 2009 Michael Schwingen                                  *
   5  *   michael@schwingen.org                                                 *
   6  *   Copyright (C) 2010 Øyvind Harboe <oyvind.harboe@zylin.com>            *
   7  *   Copyright (C) 2010 by Antonio Borneo <borneo.antonio@gmail.com>       *
   8  *                                                                         *
   9  *   This program is free software; you can redistribute it and/or modify  *
  10  *   it under the terms of the GNU General Public License as published by  *
  11  *   the Free Software Foundation; either version 2 of the License, or     *
  12  *   (at your option) any later version.                                   *
  13  *                                                                         *
  14  *   This program is distributed in the hope that it will be useful,       *
  15  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  16  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  17  *   GNU General Public License for more details.                          *
  18  *                                                                         *
  19  *   You should have received a copy of the GNU General Public License     *
  20  *   along with this program.  If not, see <http://www.gnu.org/licenses/>. *
  21  ***************************************************************************/
  22
  23 #ifdef HAVE_CONFIG_H
  24 #include "config.h"
  25 #endif
  26
  27 #include "imp.h"
  28 #include "cfi.h"
  29 #include "non_cfi.h"
  30 #include <target/arm.h>
  31 #include <target/arm7_9_common.h>
  32 #include <target/armv7m.h>
  33 #include <target/mips32.h>
  34 #include <helper/binarybuffer.h>
  35 #include <target/algorithm.h>
  36
  37 /* defines internal maximum size for code fragment in cfi_intel_write_block() */
  38 #define CFI_MAX_INTEL_CODESIZE 256
  39
  40 /* some id-types with specific handling */
  41 #define AT49BV6416      0x00d6
  42 #define AT49BV6416T     0x00d2
  43
  44 static const struct cfi_unlock_addresses cfi_unlock_addresses[] = {
  45         [CFI_UNLOCK_555_2AA] = { .unlock1 = 0x555, .unlock2 = 0x2aa },
  46         [CFI_UNLOCK_5555_2AAA] = { .unlock1 = 0x5555, .unlock2 = 0x2aaa },
  47 };
  48
  49 static const int cfi_status_poll_mask_dq6_dq7 = CFI_STATUS_POLL_MASK_DQ6_DQ7;
  50
  51 /* CFI fixups forward declarations */
  52 static void cfi_fixup_0002_erase_regions(struct flash_bank *bank, const void *param);
  53 static void cfi_fixup_0002_unlock_addresses(struct flash_bank *bank, const void *param);
  54 static void cfi_fixup_reversed_erase_regions(struct flash_bank *bank, const void *param);
  55 static void cfi_fixup_0002_write_buffer(struct flash_bank *bank, const void *param);
  56 static void cfi_fixup_0002_polling_bits(struct flash_bank *bank, const void *param);
  57
  58 /* fixup after reading cmdset 0002 primary query table */
  59 static const struct cfi_fixup cfi_0002_fixups[] = {
  60         {CFI_MFR_SST, 0x00D4, cfi_fixup_0002_unlock_addresses,
  61          &cfi_unlock_addresses[CFI_UNLOCK_5555_2AAA]},
  62         {CFI_MFR_SST, 0x00D5, cfi_fixup_0002_unlock_addresses,
  63          &cfi_unlock_addresses[CFI_UNLOCK_5555_2AAA]},
  64         {CFI_MFR_SST, 0x00D6, cfi_fixup_0002_unlock_addresses,
  65          &cfi_unlock_addresses[CFI_UNLOCK_5555_2AAA]},
  66         {CFI_MFR_SST, 0x00D7, cfi_fixup_0002_unlock_addresses,
  67          &cfi_unlock_addresses[CFI_UNLOCK_5555_2AAA]},
  68         {CFI_MFR_SST, 0x2780, cfi_fixup_0002_unlock_addresses,
  69          &cfi_unlock_addresses[CFI_UNLOCK_5555_2AAA]},
  70         {CFI_MFR_SST, 0x274b, cfi_fixup_0002_unlock_addresses,
  71          &cfi_unlock_addresses[CFI_UNLOCK_5555_2AAA]},
  72         {CFI_MFR_SST, 0x235f, cfi_fixup_0002_polling_bits,      /* 39VF3201C */
  73          &cfi_status_poll_mask_dq6_dq7},
  74         {CFI_MFR_SST, 0x236d, cfi_fixup_0002_unlock_addresses,
  75          &cfi_unlock_addresses[CFI_UNLOCK_555_2AA]},
  76         {CFI_MFR_ATMEL, 0x00C8, cfi_fixup_reversed_erase_regions, NULL},
  77         {CFI_MFR_ST, 0x22C4, cfi_fixup_reversed_erase_regions, NULL},   /* M29W160ET */
  78         {CFI_MFR_FUJITSU, 0x22ea, cfi_fixup_0002_unlock_addresses,
  79          &cfi_unlock_addresses[CFI_UNLOCK_555_2AA]},
  80         {CFI_MFR_FUJITSU, 0x226b, cfi_fixup_0002_unlock_addresses,
  81          &cfi_unlock_addresses[CFI_UNLOCK_5555_2AAA]},
  82         {CFI_MFR_AMIC, 0xb31a, cfi_fixup_0002_unlock_addresses,
  83          &cfi_unlock_addresses[CFI_UNLOCK_555_2AA]},
  84         {CFI_MFR_MX, 0x225b, cfi_fixup_0002_unlock_addresses,
  85          &cfi_unlock_addresses[CFI_UNLOCK_555_2AA]},
  86         {CFI_MFR_EON, 0x225b, cfi_fixup_0002_unlock_addresses,
  87          &cfi_unlock_addresses[CFI_UNLOCK_555_2AA]},
  88         {CFI_MFR_AMD, 0x225b, cfi_fixup_0002_unlock_addresses,
  89          &cfi_unlock_addresses[CFI_UNLOCK_555_2AA]},
  90         {CFI_MFR_ANY, CFI_ID_ANY, cfi_fixup_0002_erase_regions, NULL},
  91         {CFI_MFR_ST, 0x227E, cfi_fixup_0002_write_buffer, NULL},/* M29W128G */
  92         {0, 0, NULL, NULL}
  93 };
  94
  95 /* fixup after reading cmdset 0001 primary query table */
  96 static const struct cfi_fixup cfi_0001_fixups[] = {
  97         {0, 0, NULL, NULL}
  98 };
  99
 100 static void cfi_fixup(struct flash_bank *bank, const struct cfi_fixup *fixups)
 101 {
 102         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 103
 104         for (const struct cfi_fixup *f = fixups; f->fixup; f++) {
 105                 if (((f->mfr == CFI_MFR_ANY) || (f->mfr == cfi_info->manufacturer)) &&
 106                                 ((f->id  == CFI_ID_ANY)  || (f->id  == cfi_info->device_id)))
 107                         f->fixup(bank, f->param);
 108         }
 109 }
 110
 111 uint32_t cfi_flash_address(struct flash_bank *bank, int sector, uint32_t offset)
 112 {
 113         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 114
 115         if (cfi_info->x16_as_x8)
 116                 offset *= 2;
 117
 118         /* while the sector list isn't built, only accesses to sector 0 work */
 119         if (sector == 0)
 120                 return bank->base + offset * bank->bus_width;
 121         else {
 122                 if (!bank->sectors) {
 123                         LOG_ERROR("BUG: sector list not yet built");
 124                         exit(-1);
 125                 }
 126                 return bank->base + bank->sectors[sector].offset + offset * bank->bus_width;
 127         }
 128 }
 129
 130 static int cfi_target_write_memory(struct flash_bank *bank, target_addr_t addr,
 131                                    uint32_t count, const uint8_t *buffer)
 132 {
 133         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 134         if (cfi_info->write_mem) {
 135                 return cfi_info->write_mem(bank, addr, count, buffer);
 136         } else {
 137                 return target_write_memory(bank->target, addr, bank->bus_width,
 138                                            count, buffer);
 139         }
 140 }
 141
 142 int cfi_target_read_memory(struct flash_bank *bank, target_addr_t addr,
 143                            uint32_t count, uint8_t *buffer)
 144 {
 145         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 146         if (cfi_info->read_mem) {
 147                 return cfi_info->read_mem(bank, addr, count, buffer);
 148         } else {
 149                 return target_read_memory(bank->target, addr, bank->bus_width,
 150                                           count, buffer);
 151         }
 152 }
 153
 154 static void cfi_command(struct flash_bank *bank, uint8_t cmd, uint8_t *cmd_buf)
 155 {
 156         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 157
 158         /* clear whole buffer, to ensure bits that exceed the bus_width
 159          * are set to zero
 160          */
 161         for (size_t i = 0; i < CFI_MAX_BUS_WIDTH; i++)
 162                 cmd_buf[i] = 0;
 163
 164         if (cfi_info->endianness == TARGET_LITTLE_ENDIAN) {
 165                 for (unsigned int i = bank->bus_width; i > 0; i--)
 166                         *cmd_buf++ = (i & (bank->chip_width - 1)) ? 0x0 : cmd;
 167         } else {
 168                 for (unsigned int i = 1; i <= bank->bus_width; i++)
 169                         *cmd_buf++ = (i & (bank->chip_width - 1)) ? 0x0 : cmd;
 170         }
 171 }
 172
 173 int cfi_send_command(struct flash_bank *bank, uint8_t cmd, uint32_t address)
 174 {
 175         uint8_t command[CFI_MAX_BUS_WIDTH];
 176
 177         cfi_command(bank, cmd, command);
 178         return cfi_target_write_memory(bank, address, 1, command);
 179 }
 180
 181 /* read unsigned 8-bit value from the bank
 182  * flash banks are expected to be made of similar chips
 183  * the query result should be the same for all
 184  */
 185 static int cfi_query_u8(struct flash_bank *bank, int sector, uint32_t offset, uint8_t *val)
 186 {
 187         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 188         uint8_t data[CFI_MAX_BUS_WIDTH];
 189
 190         int retval;
 191         retval = cfi_target_read_memory(bank, cfi_flash_address(bank, sector, offset),
 192                                         1, data);
 193         if (retval != ERROR_OK)
 194                 return retval;
 195
 196         if (cfi_info->endianness == TARGET_LITTLE_ENDIAN)
 197                 *val = data[0];
 198         else
 199                 *val = data[bank->bus_width - 1];
 200
 201         return ERROR_OK;
 202 }
 203
 204 /* read unsigned 8-bit value from the bank
 205  * in case of a bank made of multiple chips,
 206  * the individual values are ORed
 207  */
 208 static int cfi_get_u8(struct flash_bank *bank, int sector, uint32_t offset, uint8_t *val)
 209 {
 210         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 211         uint8_t data[CFI_MAX_BUS_WIDTH];
 212
 213         int retval;
 214         retval = cfi_target_read_memory(bank, cfi_flash_address(bank, sector, offset),
 215                                         1, data);
 216         if (retval != ERROR_OK)
 217                 return retval;
 218
 219         if (cfi_info->endianness == TARGET_LITTLE_ENDIAN) {
 220                 for (unsigned int i = 0; i < bank->bus_width / bank->chip_width; i++)
 221                         data[0] |= data[i];
 222
 223                 *val = data[0];
 224         } else {
 225                 uint8_t value = 0;
 226                 for (unsigned int i = 0; i < bank->bus_width / bank->chip_width; i++)
 227                         value |= data[bank->bus_width - 1 - i];
 228
 229                 *val = value;
 230         }
 231         return ERROR_OK;
 232 }
 233
 234 static int cfi_query_u16(struct flash_bank *bank, int sector, uint32_t offset, uint16_t *val)
 235 {
 236         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 237         uint8_t data[CFI_MAX_BUS_WIDTH * 2];
 238         int retval;
 239
 240         if (cfi_info->x16_as_x8) {
 241                 for (uint8_t i = 0; i < 2; i++) {
 242                         retval = cfi_target_read_memory(bank, cfi_flash_address(bank, sector, offset + i),
 243                                                         1, &data[i * bank->bus_width]);
 244                         if (retval != ERROR_OK)
 245                                 return retval;
 246                 }
 247         } else {
 248                 retval = cfi_target_read_memory(bank, cfi_flash_address(bank, sector, offset),
 249                                                 2, data);
 250                 if (retval != ERROR_OK)
 251                         return retval;
 252         }
 253
 254         if (cfi_info->endianness == TARGET_LITTLE_ENDIAN)
 255                 *val = data[0] | data[bank->bus_width] << 8;
 256         else
 257                 *val = data[bank->bus_width - 1] | data[(2 * bank->bus_width) - 1] << 8;
 258
 259         return ERROR_OK;
 260 }
 261
 262 static int cfi_query_u32(struct flash_bank *bank, int sector, uint32_t offset, uint32_t *val)
 263 {
 264         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 265         uint8_t data[CFI_MAX_BUS_WIDTH * 4];
 266         int retval;
 267
 268         if (cfi_info->x16_as_x8) {
 269                 for (uint8_t i = 0; i < 4; i++) {
 270                         retval = cfi_target_read_memory(bank, cfi_flash_address(bank, sector, offset + i),
 271                                                         1, &data[i * bank->bus_width]);
 272                         if (retval != ERROR_OK)
 273                                 return retval;
 274                 }
 275         } else {
 276                 retval = cfi_target_read_memory(bank, cfi_flash_address(bank, sector, offset),
 277                                                 4, data);
 278                 if (retval != ERROR_OK)
 279                         return retval;
 280         }
 281
 282         if (cfi_info->endianness == TARGET_LITTLE_ENDIAN)
 283                 *val = data[0] | data[bank->bus_width] << 8 |
 284                         data[bank->bus_width * 2] << 16 | data[bank->bus_width * 3] << 24;
 285         else
 286                 *val = data[bank->bus_width - 1] | data[(2 * bank->bus_width) - 1] << 8 |
 287                         data[(3 * bank->bus_width) - 1] << 16 |
 288                         data[(4 * bank->bus_width) - 1] << 24;
 289
 290         return ERROR_OK;
 291 }
 292
 293 int cfi_reset(struct flash_bank *bank)
 294 {
 295         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 296         int retval = ERROR_OK;
 297
 298         retval = cfi_send_command(bank, 0xf0, cfi_flash_address(bank, 0, 0x0));
 299         if (retval != ERROR_OK)
 300                 return retval;
 301
 302         retval = cfi_send_command(bank, 0xff, cfi_flash_address(bank, 0, 0x0));
 303         if (retval != ERROR_OK)
 304                 return retval;
 305
 306         if (cfi_info->manufacturer == 0x20 &&
 307                         (cfi_info->device_id == 0x227E || cfi_info->device_id == 0x7E)) {
 308                 /* Numonix M29W128G is cmd 0xFF intolerant - causes internal undefined state
 309                  * so we send an extra 0xF0 reset to fix the bug */
 310                 retval = cfi_send_command(bank, 0xf0, cfi_flash_address(bank, 0, 0x00));
 311                 if (retval != ERROR_OK)
 312                         return retval;
 313         }
 314
 315         return retval;
 316 }
 317
 318 static void cfi_intel_clear_status_register(struct flash_bank *bank)
 319 {
 320         cfi_send_command(bank, 0x50, cfi_flash_address(bank, 0, 0x0));
 321 }
 322
 323 static int cfi_intel_wait_status_busy(struct flash_bank *bank, int timeout, uint8_t *val)
 324 {
 325         uint8_t status;
 326
 327         int retval = ERROR_OK;
 328
 329         for (;; ) {
 330                 if (timeout-- < 0) {
 331                         LOG_ERROR("timeout while waiting for WSM to become ready");
 332                         return ERROR_FAIL;
 333                 }
 334
 335                 retval = cfi_get_u8(bank, 0, 0x0, &status);
 336                 if (retval != ERROR_OK)
 337                         return retval;
 338
 339                 if (status & 0x80)
 340                         break;
 341
 342                 alive_sleep(1);
 343         }
 344
 345         /* mask out bit 0 (reserved) */
 346         status = status & 0xfe;
 347
 348         LOG_DEBUG("status: 0x%x", status);
 349
 350         if (status != 0x80) {
 351                 LOG_ERROR("status register: 0x%x", status);
 352                 if (status & 0x2)
 353                         LOG_ERROR("Block Lock-Bit Detected, Operation Abort");
 354                 if (status & 0x4)
 355                         LOG_ERROR("Program suspended");
 356                 if (status & 0x8)
 357                         LOG_ERROR("Low Programming Voltage Detected, Operation Aborted");
 358                 if (status & 0x10)
 359                         LOG_ERROR("Program Error / Error in Setting Lock-Bit");
 360                 if (status & 0x20)
 361                         LOG_ERROR("Error in Block Erasure or Clear Lock-Bits");
 362                 if (status & 0x40)
 363                         LOG_ERROR("Block Erase Suspended");
 364
 365                 cfi_intel_clear_status_register(bank);
 366
 367                 retval = ERROR_FAIL;
 368         }
 369
 370         *val = status;
 371         return retval;
 372 }
 373
 374 int cfi_spansion_wait_status_busy(struct flash_bank *bank, int timeout)
 375 {
 376         uint8_t status, oldstatus;
 377         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 378         int retval;
 379
 380         retval = cfi_get_u8(bank, 0, 0x0, &oldstatus);
 381         if (retval != ERROR_OK)
 382                 return retval;
 383
 384         do {
 385                 retval = cfi_get_u8(bank, 0, 0x0, &status);
 386
 387                 if (retval != ERROR_OK)
 388                         return retval;
 389
 390                 if ((status ^ oldstatus) & 0x40) {
 391                         if (status & cfi_info->status_poll_mask & 0x20) {
 392                                 retval = cfi_get_u8(bank, 0, 0x0, &oldstatus);
 393                                 if (retval != ERROR_OK)
 394                                         return retval;
 395                                 retval = cfi_get_u8(bank, 0, 0x0, &status);
 396                                 if (retval != ERROR_OK)
 397                                         return retval;
 398                                 if ((status ^ oldstatus) & 0x40) {
 399                                         LOG_ERROR("dq5 timeout, status: 0x%x", status);
 400                                         return ERROR_FLASH_OPERATION_FAILED;
 401                                 } else {
 402                                         LOG_DEBUG("status: 0x%x", status);
 403                                         return ERROR_OK;
 404                                 }
 405                         }
 406                 } else {/* no toggle: finished, OK */
 407                         LOG_DEBUG("status: 0x%x", status);
 408                         return ERROR_OK;
 409                 }
 410
 411                 oldstatus = status;
 412                 alive_sleep(1);
 413         } while (timeout-- > 0);
 414
 415         LOG_ERROR("timeout, status: 0x%x", status);
 416
 417         return ERROR_FLASH_BUSY;
 418 }
 419
 420 static int cfi_read_intel_pri_ext(struct flash_bank *bank)
 421 {
 422         int retval;
 423         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 424         struct cfi_intel_pri_ext *pri_ext;
 425
 426         free(cfi_info->pri_ext);
 427
 428         pri_ext = malloc(sizeof(struct cfi_intel_pri_ext));
 429         if (!pri_ext) {
 430                 LOG_ERROR("Out of memory");
 431                 return ERROR_FAIL;
 432         }
 433         cfi_info->pri_ext = pri_ext;
 434
 435         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0, &pri_ext->pri[0]);
 436         if (retval != ERROR_OK)
 437                 return retval;
 438         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 1, &pri_ext->pri[1]);
 439         if (retval != ERROR_OK)
 440                 return retval;
 441         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 2, &pri_ext->pri[2]);
 442         if (retval != ERROR_OK)
 443                 return retval;
 444
 445         if ((pri_ext->pri[0] != 'P') || (pri_ext->pri[1] != 'R') || (pri_ext->pri[2] != 'I')) {
 446                 retval = cfi_reset(bank);
 447                 if (retval != ERROR_OK)
 448                         return retval;
 449                 LOG_ERROR("Could not read bank flash bank information");
 450                 return ERROR_FLASH_BANK_INVALID;
 451         }
 452
 453         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 3, &pri_ext->major_version);
 454         if (retval != ERROR_OK)
 455                 return retval;
 456         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 4, &pri_ext->minor_version);
 457         if (retval != ERROR_OK)
 458                 return retval;
 459
 460         LOG_DEBUG("pri: '%c%c%c', version: %c.%c", pri_ext->pri[0], pri_ext->pri[1],
 461                 pri_ext->pri[2], pri_ext->major_version, pri_ext->minor_version);
 462
 463         retval = cfi_query_u32(bank, 0, cfi_info->pri_addr + 5, &pri_ext->feature_support);
 464         if (retval != ERROR_OK)
 465                 return retval;
 466         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 9, &pri_ext->suspend_cmd_support);
 467         if (retval != ERROR_OK)
 468                 return retval;
 469         retval = cfi_query_u16(bank, 0, cfi_info->pri_addr + 0xa, &pri_ext->blk_status_reg_mask);
 470         if (retval != ERROR_OK)
 471                 return retval;
 472
 473         LOG_DEBUG("feature_support: 0x%" PRIx32 ", suspend_cmd_support: "
 474                 "0x%x, blk_status_reg_mask: 0x%x",
 475                 pri_ext->feature_support,
 476                 pri_ext->suspend_cmd_support,
 477                 pri_ext->blk_status_reg_mask);
 478
 479         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0xc, &pri_ext->vcc_optimal);
 480         if (retval != ERROR_OK)
 481                 return retval;
 482         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0xd, &pri_ext->vpp_optimal);
 483         if (retval != ERROR_OK)
 484                 return retval;
 485
 486         LOG_DEBUG("Vcc opt: %x.%x, Vpp opt: %u.%x",
 487                 (pri_ext->vcc_optimal & 0xf0) >> 4, pri_ext->vcc_optimal & 0x0f,
 488                 (pri_ext->vpp_optimal & 0xf0) >> 4, pri_ext->vpp_optimal & 0x0f);
 489
 490         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0xe, &pri_ext->num_protection_fields);
 491         if (retval != ERROR_OK)
 492                 return retval;
 493         if (pri_ext->num_protection_fields != 1) {
 494                 LOG_WARNING("expected one protection register field, but found %i",
 495                         pri_ext->num_protection_fields);
 496         }
 497
 498         retval = cfi_query_u16(bank, 0, cfi_info->pri_addr + 0xf, &pri_ext->prot_reg_addr);
 499         if (retval != ERROR_OK)
 500                 return retval;
 501         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0x11, &pri_ext->fact_prot_reg_size);
 502         if (retval != ERROR_OK)
 503                 return retval;
 504         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0x12, &pri_ext->user_prot_reg_size);
 505         if (retval != ERROR_OK)
 506                 return retval;
 507
 508         LOG_DEBUG("protection_fields: %i, prot_reg_addr: 0x%x, "
 509                 "factory pre-programmed: %i, user programmable: %i",
 510                 pri_ext->num_protection_fields, pri_ext->prot_reg_addr,
 511                 1 << pri_ext->fact_prot_reg_size, 1 << pri_ext->user_prot_reg_size);
 512
 513         return ERROR_OK;
 514 }
 515
 516 static int cfi_read_spansion_pri_ext(struct flash_bank *bank)
 517 {
 518         int retval;
 519         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 520         struct cfi_spansion_pri_ext *pri_ext;
 521
 522         free(cfi_info->pri_ext);
 523
 524         pri_ext = malloc(sizeof(struct cfi_spansion_pri_ext));
 525         if (!pri_ext) {
 526                 LOG_ERROR("Out of memory");
 527                 return ERROR_FAIL;
 528         }
 529         cfi_info->pri_ext = pri_ext;
 530
 531         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0, &pri_ext->pri[0]);
 532         if (retval != ERROR_OK)
 533                 return retval;
 534         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 1, &pri_ext->pri[1]);
 535         if (retval != ERROR_OK)
 536                 return retval;
 537         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 2, &pri_ext->pri[2]);
 538         if (retval != ERROR_OK)
 539                 return retval;
 540
 541         /* default values for implementation specific workarounds */
 542         pri_ext->_unlock1 = cfi_unlock_addresses[CFI_UNLOCK_555_2AA].unlock1;
 543         pri_ext->_unlock2 = cfi_unlock_addresses[CFI_UNLOCK_555_2AA].unlock2;
 544         pri_ext->_reversed_geometry = 0;
 545
 546         if ((pri_ext->pri[0] != 'P') || (pri_ext->pri[1] != 'R') || (pri_ext->pri[2] != 'I')) {
 547                 retval = cfi_send_command(bank, 0xf0, cfi_flash_address(bank, 0, 0x0));
 548                 if (retval != ERROR_OK)
 549                         return retval;
 550                 LOG_ERROR("Could not read spansion bank information");
 551                 return ERROR_FLASH_BANK_INVALID;
 552         }
 553
 554         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 3, &pri_ext->major_version);
 555         if (retval != ERROR_OK)
 556                 return retval;
 557         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 4, &pri_ext->minor_version);
 558         if (retval != ERROR_OK)
 559                 return retval;
 560
 561         LOG_DEBUG("pri: '%c%c%c', version: %c.%c", pri_ext->pri[0], pri_ext->pri[1],
 562                 pri_ext->pri[2], pri_ext->major_version, pri_ext->minor_version);
 563
 564         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 5, &pri_ext->silicon_revision);
 565         if (retval != ERROR_OK)
 566                 return retval;
 567         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 6, &pri_ext->erase_suspend);
 568         if (retval != ERROR_OK)
 569                 return retval;
 570         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 7, &pri_ext->blk_prot);
 571         if (retval != ERROR_OK)
 572                 return retval;
 573         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 8, &pri_ext->tmp_blk_unprotected);
 574         if (retval != ERROR_OK)
 575                 return retval;
 576         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 9, &pri_ext->blk_prot_unprot);
 577         if (retval != ERROR_OK)
 578                 return retval;
 579         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 10, &pri_ext->simultaneous_ops);
 580         if (retval != ERROR_OK)
 581                 return retval;
 582         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 11, &pri_ext->burst_mode);
 583         if (retval != ERROR_OK)
 584                 return retval;
 585         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 12, &pri_ext->page_mode);
 586         if (retval != ERROR_OK)
 587                 return retval;
 588         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 13, &pri_ext->vpp_min);
 589         if (retval != ERROR_OK)
 590                 return retval;
 591         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 14, &pri_ext->vpp_max);
 592         if (retval != ERROR_OK)
 593                 return retval;
 594         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 15, &pri_ext->top_bottom);
 595         if (retval != ERROR_OK)
 596                 return retval;
 597
 598         LOG_DEBUG("Silicon Revision: 0x%x, Erase Suspend: 0x%x, Block protect: 0x%x",
 599                 pri_ext->silicon_revision, pri_ext->erase_suspend, pri_ext->blk_prot);
 600
 601         LOG_DEBUG("Temporary Unprotect: 0x%x, Block Protect Scheme: 0x%x, "
 602                 "Simultaneous Ops: 0x%x", pri_ext->tmp_blk_unprotected,
 603                 pri_ext->blk_prot_unprot, pri_ext->simultaneous_ops);
 604
 605         LOG_DEBUG("Burst Mode: 0x%x, Page Mode: 0x%x, ", pri_ext->burst_mode, pri_ext->page_mode);
 606
 607
 608         LOG_DEBUG("Vpp min: %u.%x, Vpp max: %u.%x",
 609                 (pri_ext->vpp_min & 0xf0) >> 4, pri_ext->vpp_min & 0x0f,
 610                 (pri_ext->vpp_max & 0xf0) >> 4, pri_ext->vpp_max & 0x0f);
 611
 612         LOG_DEBUG("WP# protection 0x%x", pri_ext->top_bottom);
 613
 614         return ERROR_OK;
 615 }
 616
 617 static int cfi_read_atmel_pri_ext(struct flash_bank *bank)
 618 {
 619         int retval;
 620         struct cfi_atmel_pri_ext atmel_pri_ext;
 621         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 622         struct cfi_spansion_pri_ext *pri_ext;
 623
 624         free(cfi_info->pri_ext);
 625
 626         pri_ext = malloc(sizeof(struct cfi_spansion_pri_ext));
 627         if (!pri_ext) {
 628                 LOG_ERROR("Out of memory");
 629                 return ERROR_FAIL;
 630         }
 631
 632         /* ATMEL devices use the same CFI primary command set (0x2) as AMD/Spansion,
 633          * but a different primary extended query table.
 634          * We read the atmel table, and prepare a valid AMD/Spansion query table.
 635          */
 636
 637         memset(pri_ext, 0, sizeof(struct cfi_spansion_pri_ext));
 638
 639         cfi_info->pri_ext = pri_ext;
 640
 641         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0, &atmel_pri_ext.pri[0]);
 642         if (retval != ERROR_OK)
 643                 return retval;
 644         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 1, &atmel_pri_ext.pri[1]);
 645         if (retval != ERROR_OK)
 646                 return retval;
 647         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 2, &atmel_pri_ext.pri[2]);
 648         if (retval != ERROR_OK)
 649                 return retval;
 650
 651         if ((atmel_pri_ext.pri[0] != 'P') || (atmel_pri_ext.pri[1] != 'R')
 652                         || (atmel_pri_ext.pri[2] != 'I')) {
 653                 retval = cfi_send_command(bank, 0xf0, cfi_flash_address(bank, 0, 0x0));
 654                 if (retval != ERROR_OK)
 655                         return retval;
 656                 LOG_ERROR("Could not read atmel bank information");
 657                 return ERROR_FLASH_BANK_INVALID;
 658         }
 659
 660         pri_ext->pri[0] = atmel_pri_ext.pri[0];
 661         pri_ext->pri[1] = atmel_pri_ext.pri[1];
 662         pri_ext->pri[2] = atmel_pri_ext.pri[2];
 663
 664         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 3, &atmel_pri_ext.major_version);
 665         if (retval != ERROR_OK)
 666                 return retval;
 667         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 4, &atmel_pri_ext.minor_version);
 668         if (retval != ERROR_OK)
 669                 return retval;
 670
 671         LOG_DEBUG("pri: '%c%c%c', version: %c.%c", atmel_pri_ext.pri[0],
 672                 atmel_pri_ext.pri[1], atmel_pri_ext.pri[2],
 673                 atmel_pri_ext.major_version, atmel_pri_ext.minor_version);
 674
 675         pri_ext->major_version = atmel_pri_ext.major_version;
 676         pri_ext->minor_version = atmel_pri_ext.minor_version;
 677
 678         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 5, &atmel_pri_ext.features);
 679         if (retval != ERROR_OK)
 680                 return retval;
 681         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 6, &atmel_pri_ext.bottom_boot);
 682         if (retval != ERROR_OK)
 683                 return retval;
 684         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 7, &atmel_pri_ext.burst_mode);
 685         if (retval != ERROR_OK)
 686                 return retval;
 687         retval = cfi_query_u8(bank, 0, cfi_info->pri_addr + 8, &atmel_pri_ext.page_mode);
 688         if (retval != ERROR_OK)
 689                 return retval;
 690
 691         LOG_DEBUG(
 692                 "features: 0x%2.2x, bottom_boot: 0x%2.2x, burst_mode: 0x%2.2x, page_mode: 0x%2.2x",
 693                 atmel_pri_ext.features,
 694                 atmel_pri_ext.bottom_boot,
 695                 atmel_pri_ext.burst_mode,
 696                 atmel_pri_ext.page_mode);
 697
 698         if (atmel_pri_ext.features & 0x02)
 699                 pri_ext->erase_suspend = 2;
 700
 701         /* some chips got it backwards... */
 702         if (cfi_info->device_id == AT49BV6416 ||
 703                         cfi_info->device_id == AT49BV6416T) {
 704                 if (atmel_pri_ext.bottom_boot)
 705                         pri_ext->top_bottom = 3;
 706                 else
 707                         pri_ext->top_bottom = 2;
 708         } else {
 709                 if (atmel_pri_ext.bottom_boot)
 710                         pri_ext->top_bottom = 2;
 711                 else
 712                         pri_ext->top_bottom = 3;
 713         }
 714
 715         pri_ext->_unlock1 = cfi_unlock_addresses[CFI_UNLOCK_555_2AA].unlock1;
 716         pri_ext->_unlock2 = cfi_unlock_addresses[CFI_UNLOCK_555_2AA].unlock2;
 717
 718         return ERROR_OK;
 719 }
 720
 721 static int cfi_read_0002_pri_ext(struct flash_bank *bank)
 722 {
 723         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 724
 725         if (cfi_info->manufacturer == CFI_MFR_ATMEL)
 726                 return cfi_read_atmel_pri_ext(bank);
 727         else
 728                 return cfi_read_spansion_pri_ext(bank);
 729 }
 730
 731 static int cfi_spansion_info(struct flash_bank *bank, struct command_invocation *cmd)
 732 {
 733         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 734         struct cfi_spansion_pri_ext *pri_ext = cfi_info->pri_ext;
 735
 736         command_print_sameline(cmd, "\nSpansion primary algorithm extend information:\n");
 737
 738         command_print_sameline(cmd, "pri: '%c%c%c', version: %c.%c\n",
 739                         pri_ext->pri[0], pri_ext->pri[1], pri_ext->pri[2],
 740                         pri_ext->major_version, pri_ext->minor_version);
 741
 742         command_print_sameline(cmd, "Silicon Rev.: 0x%x, Address Sensitive unlock: 0x%x\n",
 743                         (pri_ext->silicon_revision) >> 2,
 744                         (pri_ext->silicon_revision) & 0x03);
 745
 746         command_print_sameline(cmd, "Erase Suspend: 0x%x, Sector Protect: 0x%x\n",
 747                         pri_ext->erase_suspend,
 748                         pri_ext->blk_prot);
 749
 750         command_print_sameline(cmd, "VppMin: %u.%x, VppMax: %u.%x\n",
 751                 (pri_ext->vpp_min & 0xf0) >> 4, pri_ext->vpp_min & 0x0f,
 752                 (pri_ext->vpp_max & 0xf0) >> 4, pri_ext->vpp_max & 0x0f);
 753
 754         return ERROR_OK;
 755 }
 756
 757 static int cfi_intel_info(struct flash_bank *bank, struct command_invocation *cmd)
 758 {
 759         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 760         struct cfi_intel_pri_ext *pri_ext = cfi_info->pri_ext;
 761
 762         command_print_sameline(cmd, "\nintel primary algorithm extend information:\n");
 763
 764         command_print_sameline(cmd, "pri: '%c%c%c', version: %c.%c\n",
 765                         pri_ext->pri[0],
 766                         pri_ext->pri[1],
 767                         pri_ext->pri[2],
 768                         pri_ext->major_version,
 769                         pri_ext->minor_version);
 770
 771         command_print_sameline(cmd, "feature_support: 0x%" PRIx32 ", "
 772                         "suspend_cmd_support: 0x%x, blk_status_reg_mask: 0x%x\n",
 773                         pri_ext->feature_support,
 774                         pri_ext->suspend_cmd_support,
 775                         pri_ext->blk_status_reg_mask);
 776
 777         command_print_sameline(cmd, "Vcc opt: %x.%x, Vpp opt: %u.%x\n",
 778                         (pri_ext->vcc_optimal & 0xf0) >> 4, pri_ext->vcc_optimal & 0x0f,
 779                         (pri_ext->vpp_optimal & 0xf0) >> 4, pri_ext->vpp_optimal & 0x0f);
 780
 781         command_print_sameline(cmd, "protection_fields: %i, prot_reg_addr: 0x%x, "
 782                 "factory pre-programmed: %i, user programmable: %i\n",
 783                 pri_ext->num_protection_fields, pri_ext->prot_reg_addr,
 784                 1 << pri_ext->fact_prot_reg_size, 1 << pri_ext->user_prot_reg_size);
 785
 786         return ERROR_OK;
 787 }
 788
 789 int cfi_flash_bank_cmd(struct flash_bank *bank, unsigned int argc, const char **argv)
 790 {
 791         struct cfi_flash_bank *cfi_info;
 792         bool bus_swap = false;
 793
 794         if (argc < 6)
 795                 return ERROR_COMMAND_SYNTAX_ERROR;
 796
 797         /* both widths must:
 798          * - not exceed max value;
 799          * - not be null;
 800          * - be equal to a power of 2.
 801          * bus must be wide enough to hold one chip */
 802         if ((bank->chip_width > CFI_MAX_CHIP_WIDTH)
 803                         || (bank->bus_width > CFI_MAX_BUS_WIDTH)
 804                         || (bank->chip_width == 0)
 805                         || (bank->bus_width == 0)
 806                         || (bank->chip_width & (bank->chip_width - 1))
 807                         || (bank->bus_width & (bank->bus_width - 1))
 808                         || (bank->chip_width > bank->bus_width)) {
 809                 LOG_ERROR("chip and bus width have to specified in bytes");
 810                 return ERROR_FLASH_BANK_INVALID;
 811         }
 812
 813         cfi_info = calloc(1, sizeof(struct cfi_flash_bank));
 814         if (!cfi_info) {
 815                 LOG_ERROR("No memory for flash bank info");
 816                 return ERROR_FAIL;
 817         }
 818         bank->driver_priv = cfi_info;
 819
 820         for (unsigned i = 6; i < argc; i++) {
 821                 if (strcmp(argv[i], "x16_as_x8") == 0)
 822                         cfi_info->x16_as_x8 = true;
 823                 else if (strcmp(argv[i], "data_swap") == 0)
 824                         cfi_info->data_swap = true;
 825                 else if (strcmp(argv[i], "bus_swap") == 0)
 826                         bus_swap = true;
 827                 else if (strcmp(argv[i], "jedec_probe") == 0)
 828                         cfi_info->jedec_probe = true;
 829         }
 830
 831         if (bus_swap)
 832                 cfi_info->endianness =
 833                         bank->target->endianness == TARGET_LITTLE_ENDIAN ?
 834                         TARGET_BIG_ENDIAN : TARGET_LITTLE_ENDIAN;
 835         else
 836                 cfi_info->endianness = bank->target->endianness;
 837
 838         /* bank wasn't probed yet */
 839         cfi_info->qry[0] = 0xff;
 840
 841         return ERROR_OK;
 842 }
 843
 844 /* flash_bank cfi <base> <size> <chip_width> <bus_width> <target#> [options]
 845  */
 846 FLASH_BANK_COMMAND_HANDLER(cfi_flash_bank_command)
 847 {
 848         return cfi_flash_bank_cmd(bank, CMD_ARGC, CMD_ARGV);
 849 }
 850
 851 static int cfi_intel_erase(struct flash_bank *bank, unsigned int first,
 852                 unsigned int last)
 853 {
 854         int retval;
 855         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 856
 857         cfi_intel_clear_status_register(bank);
 858
 859         for (unsigned int i = first; i <= last; i++) {
 860                 retval = cfi_send_command(bank, 0x20, cfi_flash_address(bank, i, 0x0));
 861                 if (retval != ERROR_OK)
 862                         return retval;
 863
 864                 retval = cfi_send_command(bank, 0xd0, cfi_flash_address(bank, i, 0x0));
 865                 if (retval != ERROR_OK)
 866                         return retval;
 867
 868                 uint8_t status;
 869                 retval = cfi_intel_wait_status_busy(bank, cfi_info->block_erase_timeout, &status);
 870                 if (retval != ERROR_OK)
 871                         return retval;
 872
 873                 if (status != 0x80) {
 874                         retval = cfi_send_command(bank, 0xff, cfi_flash_address(bank, 0, 0x0));
 875                         if (retval != ERROR_OK)
 876                                 return retval;
 877
 878                         LOG_ERROR("couldn't erase block %u of flash bank at base "
 879                                         TARGET_ADDR_FMT, i, bank->base);
 880                         return ERROR_FLASH_OPERATION_FAILED;
 881                 }
 882         }
 883
 884         return cfi_send_command(bank, 0xff, cfi_flash_address(bank, 0, 0x0));
 885 }
 886
 887 int cfi_spansion_unlock_seq(struct flash_bank *bank)
 888 {
 889         int retval;
 890         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 891         struct cfi_spansion_pri_ext *pri_ext = cfi_info->pri_ext;
 892
 893         retval = cfi_send_command(bank, 0xaa, cfi_flash_address(bank, 0, pri_ext->_unlock1));
 894         if (retval != ERROR_OK)
 895                 return retval;
 896
 897         retval = cfi_send_command(bank, 0x55, cfi_flash_address(bank, 0, pri_ext->_unlock2));
 898         if (retval != ERROR_OK)
 899                 return retval;
 900
 901         return ERROR_OK;
 902 }
 903
 904 static int cfi_spansion_erase(struct flash_bank *bank, unsigned int first,
 905                 unsigned int last)
 906 {
 907         int retval;
 908         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 909         struct cfi_spansion_pri_ext *pri_ext = cfi_info->pri_ext;
 910
 911         for (unsigned int i = first; i <= last; i++) {
 912                 retval = cfi_spansion_unlock_seq(bank);
 913                 if (retval != ERROR_OK)
 914                         return retval;
 915
 916                 retval = cfi_send_command(bank, 0x80, cfi_flash_address(bank, 0, pri_ext->_unlock1));
 917                 if (retval != ERROR_OK)
 918                         return retval;
 919
 920                 retval = cfi_spansion_unlock_seq(bank);
 921                 if (retval != ERROR_OK)
 922                         return retval;
 923
 924                 retval = cfi_send_command(bank, 0x30, cfi_flash_address(bank, i, 0x0));
 925                 if (retval != ERROR_OK)
 926                         return retval;
 927
 928                 if (cfi_spansion_wait_status_busy(bank, cfi_info->block_erase_timeout) != ERROR_OK) {
 929                         retval = cfi_send_command(bank, 0xf0, cfi_flash_address(bank, 0, 0x0));
 930                         if (retval != ERROR_OK)
 931                                 return retval;
 932
 933                         LOG_ERROR("couldn't erase block %i of flash bank at base "
 934                                 TARGET_ADDR_FMT, i, bank->base);
 935                         return ERROR_FLASH_OPERATION_FAILED;
 936                 }
 937         }
 938
 939         return cfi_send_command(bank, 0xf0, cfi_flash_address(bank, 0, 0x0));
 940 }
 941
 942 int cfi_erase(struct flash_bank *bank, unsigned int first,
 943                 unsigned int last)
 944 {
 945         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 946
 947         if (bank->target->state != TARGET_HALTED) {
 948                 LOG_ERROR("Target not halted");
 949                 return ERROR_TARGET_NOT_HALTED;
 950         }
 951
 952         if ((last < first) || (last >= bank->num_sectors))
 953                 return ERROR_FLASH_SECTOR_INVALID;
 954
 955         if (cfi_info->qry[0] != 'Q')
 956                 return ERROR_FLASH_BANK_NOT_PROBED;
 957
 958         switch (cfi_info->pri_id) {
 959                 case 1:
 960                 case 3:
 961                         return cfi_intel_erase(bank, first, last);
 962                 case 2:
 963                         return cfi_spansion_erase(bank, first, last);
 964                 default:
 965                         LOG_ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
 966                         break;
 967         }
 968
 969         return ERROR_OK;
 970 }
 971
 972 static int cfi_intel_protect(struct flash_bank *bank, int set,
 973                 unsigned int first, unsigned int last)
 974 {
 975         int retval;
 976         struct cfi_flash_bank *cfi_info = bank->driver_priv;
 977         struct cfi_intel_pri_ext *pri_ext = cfi_info->pri_ext;
 978         int retry = 0;
 979
 980         /* if the device supports neither legacy lock/unlock (bit 3) nor
 981          * instant individual block locking (bit 5).
 982          */
 983         if (!(pri_ext->feature_support & 0x28)) {
 984                 LOG_ERROR("lock/unlock not supported on flash");
 985                 return ERROR_FLASH_OPERATION_FAILED;
 986         }
 987
 988         cfi_intel_clear_status_register(bank);
 989
 990         for (unsigned int i = first; i <= last; i++) {
 991                 retval = cfi_send_command(bank, 0x60, cfi_flash_address(bank, i, 0x0));
 992                 if (retval != ERROR_OK)
 993                         return retval;
 994                 if (set) {
 995                         retval = cfi_send_command(bank, 0x01, cfi_flash_address(bank, i, 0x0));
 996                         if (retval != ERROR_OK)
 997                                 return retval;
 998                         bank->sectors[i].is_protected = 1;
 999                 } else {
1000                         retval = cfi_send_command(bank, 0xd0, cfi_flash_address(bank, i, 0x0));
1001                         if (retval != ERROR_OK)
1002                                 return retval;
1003                         bank->sectors[i].is_protected = 0;
1004                 }
1005
1006                 /* instant individual block locking doesn't require reading of the status register
1007                  **/
1008                 if (!(pri_ext->feature_support & 0x20)) {
1009                         /* Clear lock bits operation may take up to 1.4s */
1010                         uint8_t status;
1011                         retval = cfi_intel_wait_status_busy(bank, 1400, &status);
1012                         if (retval != ERROR_OK)
1013                                 return retval;
1014                 } else {
1015                         uint8_t block_status;
1016                         /* read block lock bit, to verify status */
1017                         retval = cfi_send_command(bank, 0x90, cfi_flash_address(bank, 0, 0x55));
1018                         if (retval != ERROR_OK)
1019                                 return retval;
1020                         retval = cfi_get_u8(bank, i, 0x2, &block_status);
1021                         if (retval != ERROR_OK)
1022                                 return retval;
1023
1024                         if ((block_status & 0x1) != set) {
1025                                 LOG_ERROR(
1026                                         "couldn't change block lock status (set = %i, block_status = 0x%2.2x)",
1027                                         set, block_status);
1028                                 retval = cfi_send_command(bank, 0x70, cfi_flash_address(bank, 0, 0x55));
1029                                 if (retval != ERROR_OK)
1030                                         return retval;
1031                                 uint8_t status;
1032                                 retval = cfi_intel_wait_status_busy(bank, 10, &status);
1033                                 if (retval != ERROR_OK)
1034                                         return retval;
1035
1036                                 if (retry > 10)
1037                                         return ERROR_FLASH_OPERATION_FAILED;
1038                                 else {
1039                                         i--;
1040                                         retry++;
1041                                 }
1042                         }
1043                 }
1044         }
1045
1046         /* if the device doesn't support individual block lock bits set/clear,
1047          * all blocks have been unlocked in parallel, so we set those that should be protected
1048          */
1049         if ((!set) && (!(pri_ext->feature_support & 0x20))) {
1050                 /* FIX!!! this code path is broken!!!
1051                  *
1052                  * The correct approach is:
1053                  *
1054                  * 1. read out current protection status
1055                  *
1056                  * 2. override read out protection status w/unprotected.
1057                  *
1058                  * 3. re-protect what should be protected.
1059                  *
1060                  */
1061                 for (unsigned int i = 0; i < bank->num_sectors; i++) {
1062                         if (bank->sectors[i].is_protected == 1) {
1063                                 cfi_intel_clear_status_register(bank);
1064
1065                                 retval = cfi_send_command(bank, 0x60, cfi_flash_address(bank, i, 0x0));
1066                                 if (retval != ERROR_OK)
1067                                         return retval;
1068
1069                                 retval = cfi_send_command(bank, 0x01, cfi_flash_address(bank, i, 0x0));
1070                                 if (retval != ERROR_OK)
1071                                         return retval;
1072
1073                                 uint8_t status;
1074                                 retval = cfi_intel_wait_status_busy(bank, 100, &status);
1075                                 if (retval != ERROR_OK)
1076                                         return retval;
1077                         }
1078                 }
1079         }
1080
1081         return cfi_send_command(bank, 0xff, cfi_flash_address(bank, 0, 0x0));
1082 }
1083
1084 int cfi_protect(struct flash_bank *bank, int set, unsigned int first,
1085                 unsigned int last)
1086 {
1087         struct cfi_flash_bank *cfi_info = bank->driver_priv;
1088
1089         if (bank->target->state != TARGET_HALTED) {
1090                 LOG_ERROR("Target not halted");
1091                 return ERROR_TARGET_NOT_HALTED;
1092         }
1093
1094         if (cfi_info->qry[0] != 'Q')
1095                 return ERROR_FLASH_BANK_NOT_PROBED;
1096
1097         switch (cfi_info->pri_id) {
1098                 case 1:
1099                 case 3:
1100                         return cfi_intel_protect(bank, set, first, last);
1101                 default:
1102                         LOG_WARNING("protect: cfi primary command set %i unsupported", cfi_info->pri_id);
1103                         return ERROR_OK;
1104         }
1105 }
1106
1107 static uint32_t cfi_command_val(struct flash_bank *bank, uint8_t cmd)
1108 {
1109         struct target *target = bank->target;
1110
1111         uint8_t buf[CFI_MAX_BUS_WIDTH];
1112         cfi_command(bank, cmd, buf);
1113         switch (bank->bus_width) {
1114                 case 1:
1115                         return buf[0];
1116                 case 2:
1117                         return target_buffer_get_u16(target, buf);
1118                 case 4:
1119                         return target_buffer_get_u32(target, buf);
1120                 default:
1121                         LOG_ERROR("Unsupported bank buswidth %u, can't do block memory writes",
1122                                         bank->bus_width);
1123                         return 0;
1124         }
1125 }
1126
1127 static int cfi_intel_write_block(struct flash_bank *bank, const uint8_t *buffer,
1128         uint32_t address, uint32_t count)
1129 {
1130         struct target *target = bank->target;
1131         struct reg_param reg_params[7];
1132         struct arm_algorithm arm_algo;
1133         struct working_area *write_algorithm;
1134         struct working_area *source = NULL;
1135         uint32_t buffer_size = 32768;
1136         uint32_t write_command_val, busy_pattern_val, error_pattern_val;
1137
1138         /* algorithm register usage:
1139          * r0: source address (in RAM)
1140          * r1: target address (in Flash)
1141          * r2: count
1142          * r3: flash write command
1143          * r4: status byte (returned to host)
1144          * r5: busy test pattern
1145          * r6: error test pattern
1146          */
1147
1148         /* see contrib/loaders/flash/armv4_5_cfi_intel_32.s for src */
1149         static const uint32_t word_32_code[] = {
1150                 0xe4904004,     /* loop: ldr r4, [r0], #4 */
1151                 0xe5813000,     /*       str r3, [r1] */
1152                 0xe5814000,     /*       str r4, [r1] */
1153                 0xe5914000,     /* busy: ldr r4, [r1] */
1154                 0xe0047005,     /*        and r7, r4, r5 */
1155                 0xe1570005,     /*       cmp r7, r5 */
1156                 0x1afffffb,     /*       bne busy */
1157                 0xe1140006,     /*       tst r4, r6 */
1158                 0x1a000003,     /*       bne done */
1159                 0xe2522001,     /*       subs r2, r2, #1 */
1160                 0x0a000001,     /*       beq done */
1161                 0xe2811004,     /*       add r1, r1 #4 */
1162                 0xeafffff2,     /*       b loop */
1163                 0xeafffffe      /* done: b -2 */
1164         };
1165
1166         /* see contrib/loaders/flash/armv4_5_cfi_intel_16.s for src */
1167         static const uint32_t word_16_code[] = {
1168                 0xe0d040b2,     /* loop: ldrh r4, [r0], #2 */
1169                 0xe1c130b0,     /*       strh r3, [r1] */
1170                 0xe1c140b0,     /*       strh r4, [r1] */
1171                 0xe1d140b0,     /* busy  ldrh r4, [r1] */
1172                 0xe0047005,     /*       and r7, r4, r5 */
1173                 0xe1570005,     /*       cmp r7, r5 */
1174                 0x1afffffb,     /*       bne busy */
1175                 0xe1140006,     /*       tst r4, r6 */
1176                 0x1a000003,     /*       bne done */
1177                 0xe2522001,     /*       subs r2, r2, #1 */
1178                 0x0a000001,     /*       beq done */
1179                 0xe2811002,     /*       add r1, r1 #2 */
1180                 0xeafffff2,     /*       b loop */
1181                 0xeafffffe      /* done:        b -2 */
1182         };
1183
1184         /* see contrib/loaders/flash/armv4_5_cfi_intel_8.s for src */
1185         static const uint32_t word_8_code[] = {
1186                 0xe4d04001,     /* loop: ldrb r4, [r0], #1 */
1187                 0xe5c13000,     /*       strb r3, [r1] */
1188                 0xe5c14000,     /*       strb r4, [r1] */
1189                 0xe5d14000,     /* busy  ldrb r4, [r1] */
1190                 0xe0047005,     /*       and r7, r4, r5 */
1191                 0xe1570005,     /*       cmp r7, r5 */
1192                 0x1afffffb,     /*       bne busy */
1193                 0xe1140006,     /*       tst r4, r6 */
1194                 0x1a000003,     /*       bne done */
1195                 0xe2522001,     /*       subs r2, r2, #1 */
1196                 0x0a000001,     /*       beq done */
1197                 0xe2811001,     /*       add r1, r1 #1 */
1198                 0xeafffff2,     /*       b loop */
1199                 0xeafffffe      /* done: b -2 */
1200         };
1201         uint8_t target_code[4*CFI_MAX_INTEL_CODESIZE];
1202         const uint32_t *target_code_src;
1203         uint32_t target_code_size;
1204         int retval = ERROR_OK;
1205
1206         /* check we have a supported arch */
1207         if (is_arm(target_to_arm(target))) {
1208                 /* All other ARM CPUs have 32 bit instructions */
1209                 arm_algo.common_magic = ARM_COMMON_MAGIC;
1210                 arm_algo.core_mode = ARM_MODE_SVC;
1211                 arm_algo.core_state = ARM_STATE_ARM;
1212         } else {
1213                 LOG_ERROR("Unknown architecture");
1214                 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
1215         }
1216
1217         cfi_intel_clear_status_register(bank);
1218
1219         /* If we are setting up the write_algorithm, we need target_code_src
1220          * if not we only need target_code_size. */
1221
1222         /* However, we don't want to create multiple code paths, so we
1223          * do the unnecessary evaluation of target_code_src, which the
1224          * compiler will probably nicely optimize away if not needed */
1225
1226         /* prepare algorithm code for target endian */
1227         switch (bank->bus_width) {
1228                 case 1:
1229                         target_code_src = word_8_code;
1230                         target_code_size = sizeof(word_8_code);
1231                         break;
1232                 case 2:
1233                         target_code_src = word_16_code;
1234                         target_code_size = sizeof(word_16_code);
1235                         break;
1236                 case 4:
1237                         target_code_src = word_32_code;
1238                         target_code_size = sizeof(word_32_code);
1239                         break;
1240                 default:
1241                         LOG_ERROR("Unsupported bank buswidth %u, can't do block memory writes",
1242                                         bank->bus_width);
1243                         return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
1244         }
1245
1246         /* flash write code */
1247         if (target_code_size > sizeof(target_code)) {
1248                 LOG_WARNING("Internal error - target code buffer to small. "
1249                                 "Increase CFI_MAX_INTEL_CODESIZE and recompile.");
1250                 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
1251         }
1252
1253         target_buffer_set_u32_array(target, target_code, target_code_size / 4, target_code_src);
1254
1255         /* Get memory for block write handler */
1256         retval = target_alloc_working_area(target,
1257                         target_code_size,
1258                         &write_algorithm);
1259         if (retval != ERROR_OK) {
1260                 LOG_WARNING("No working area available, can't do block memory writes");
1261                 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
1262         }
1263
1264         /* write algorithm code to working area */
1265         retval = target_write_buffer(target, write_algorithm->address,
1266                         target_code_size, target_code);
1267         if (retval != ERROR_OK) {
1268                 LOG_ERROR("Unable to write block write code to target");
1269                 goto cleanup;
1270         }
1271
1272         /* Get a workspace buffer for the data to flash starting with 32k size.
1273          * Half size until buffer would be smaller 256 Bytes then fail back */
1274         /* FIXME Why 256 bytes, why not 32 bytes (smallest flash write page */
1275         while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
1276                 buffer_size /= 2;
1277                 if (buffer_size <= 256) {
1278                         LOG_WARNING(
1279                                 "no large enough working area available, can't do block memory writes");
1280                         retval = ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
1281                         goto cleanup;
1282                 }
1283         }
1284
1285         /* setup algo registers */
1286         init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT);
1287         init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);
1288         init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);
1289         init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);
1290         init_reg_param(&reg_params[4], "r4", 32, PARAM_IN);
1291         init_reg_param(&reg_params[5], "r5", 32, PARAM_OUT);
1292         init_reg_param(&reg_params[6], "r6", 32, PARAM_OUT);
1293
1294         /* prepare command and status register patterns */
1295         write_command_val = cfi_command_val(bank, 0x40);
1296         busy_pattern_val  = cfi_command_val(bank, 0x80);
1297         error_pattern_val = cfi_command_val(bank, 0x7e);
1298
1299         LOG_DEBUG("Using target buffer at " TARGET_ADDR_FMT " and of size 0x%04" PRIx32,
1300                 source->address, buffer_size);
1301
1302         /* Programming main loop */
1303         while (count > 0) {
1304                 uint32_t thisrun_count = (count > buffer_size) ? buffer_size : count;
1305                 uint32_t wsm_error;
1306
1307                 retval = target_write_buffer(target, source->address, thisrun_count, buffer);
1308                 if (retval != ERROR_OK)
1309                         goto cleanup;
1310
1311                 buf_set_u32(reg_params[0].value, 0, 32, source->address);
1312                 buf_set_u32(reg_params[1].value, 0, 32, address);
1313                 buf_set_u32(reg_params[2].value, 0, 32, thisrun_count / bank->bus_width);
1314
1315                 buf_set_u32(reg_params[3].value, 0, 32, write_command_val);
1316                 buf_set_u32(reg_params[5].value, 0, 32, busy_pattern_val);
1317                 buf_set_u32(reg_params[6].value, 0, 32, error_pattern_val);
1318
1319                 LOG_DEBUG("Write 0x%04" PRIx32 " bytes to flash at 0x%08" PRIx32,
1320                         thisrun_count, address);
1321
1322                 /* Execute algorithm, assume breakpoint for last instruction */
1323                 retval = target_run_algorithm(target, 0, NULL, 7, reg_params,
1324                                 write_algorithm->address,
1325                                 write_algorithm->address + target_code_size -
1326                                 sizeof(uint32_t),
1327                                 10000,  /* 10s should be enough for max. 32k of data */
1328                                 &arm_algo);
1329
1330                 /* On failure try a fall back to direct word writes */
1331                 if (retval != ERROR_OK) {
1332                         cfi_intel_clear_status_register(bank);
1333                         LOG_ERROR(
1334                                 "Execution of flash algorithm failed. Can't fall back. Please report.");
1335                         retval = ERROR_FLASH_OPERATION_FAILED;
1336                         /* retval = ERROR_TARGET_RESOURCE_NOT_AVAILABLE; */
1337                         /* FIXME To allow fall back or recovery, we must save the actual status
1338                          * somewhere, so that a higher level code can start recovery. */
1339                         goto cleanup;
1340                 }
1341
1342                 /* Check return value from algo code */
1343                 wsm_error = buf_get_u32(reg_params[4].value, 0, 32) & error_pattern_val;
1344                 if (wsm_error) {
1345                         /* read status register (outputs debug information) */
1346                         uint8_t status;
1347                         cfi_intel_wait_status_busy(bank, 100, &status);
1348                         cfi_intel_clear_status_register(bank);
1349                         retval = ERROR_FLASH_OPERATION_FAILED;
1350                         goto cleanup;
1351                 }
1352
1353                 buffer += thisrun_count;
1354                 address += thisrun_count;
1355                 count -= thisrun_count;
1356
1357                 keep_alive();
1358         }
1359
1360         /* free up resources */
1361 cleanup:
1362         target_free_working_area(target, source);
1363         target_free_working_area(target, write_algorithm);
1364
1365         destroy_reg_param(&reg_params[0]);
1366         destroy_reg_param(&reg_params[1]);
1367         destroy_reg_param(&reg_params[2]);
1368         destroy_reg_param(&reg_params[3]);
1369         destroy_reg_param(&reg_params[4]);
1370         destroy_reg_param(&reg_params[5]);
1371         destroy_reg_param(&reg_params[6]);
1372
1373         return retval;
1374 }
1375
1376 static int cfi_spansion_write_block_mips(struct flash_bank *bank, const uint8_t *buffer,
1377         uint32_t address, uint32_t count)
1378 {
1379         struct cfi_flash_bank *cfi_info = bank->driver_priv;
1380         struct cfi_spansion_pri_ext *pri_ext = cfi_info->pri_ext;
1381         struct target *target = bank->target;
1382         struct reg_param reg_params[10];
1383         struct mips32_algorithm mips32_info;
1384         struct working_area *write_algorithm;
1385         struct working_area *source;
1386         uint32_t buffer_size = 32768;
1387         uint32_t status;
1388         int retval = ERROR_OK;
1389
1390         /* input parameters -
1391          *      4  A0 = source address
1392          *      5  A1 = destination address
1393          *      6  A2 = number of writes
1394          *      7  A3 = flash write command
1395          *      8  T0 = constant to mask DQ7 bits (also used for Dq5 with shift)
1396          * output parameters -
1397          *      9  T1 = 0x80 ok 0x00 bad
1398          * temp registers -
1399          *      10 T2 = value read from flash to test status
1400          *      11 T3 = holding register
1401          * unlock registers -
1402          *  12 T4 = unlock1_addr
1403          *  13 T5 = unlock1_cmd
1404          *  14 T6 = unlock2_addr
1405          *  15 T7 = unlock2_cmd */
1406
1407         static const uint32_t mips_word_16_code[] = {
1408                 /* start:       */
1409                 MIPS32_LHU(0, 9, 0, 4),         /* lhu $t1, ($a0)               ; out = &saddr */
1410                 MIPS32_ADDI(0, 4, 4, 2),        /* addi $a0, $a0, 2             ; saddr += 2 */
1411                 MIPS32_SH(0, 13, 0, 12),        /* sh $t5, ($t4)                ; *fl_unl_addr1 = fl_unl_cmd1 */
1412                 MIPS32_SH(0, 15, 0, 14),        /* sh $t7, ($t6)                ; *fl_unl_addr2 = fl_unl_cmd2 */
1413                 MIPS32_SH(0, 7, 0, 12),         /* sh $a3, ($t4)                ; *fl_unl_addr1 = fl_write_cmd */
1414                 MIPS32_SH(0, 9, 0, 5),          /* sh $t1, ($a1)                ; *daddr = out */
1415                 MIPS32_NOP,                                             /* nop */
1416                 /* busy:        */
1417                 MIPS32_LHU(0, 10, 0, 5),                /* lhu $t2, ($a1)               ; temp1 = *daddr */
1418                 MIPS32_XOR(0, 11, 9, 10),               /* xor $t3, $a0, $t2    ; temp2 = out ^ temp1; */
1419                 MIPS32_AND(0, 11, 8, 11),               /* and $t3, $t0, $t3    ; temp2 = temp2 & DQ7mask */
1420                 MIPS32_BNE(0, 11, 8, 13),               /* bne $t3, $t0, cont   ; if (temp2 != DQ7mask) goto cont */
1421                 MIPS32_NOP,                                             /* nop                                  */
1422
1423                 MIPS32_SRL(0, 10, 8, 2),                /* srl $t2,$t0,2                ; temp1 = DQ7mask >> 2 */
1424                 MIPS32_AND(0, 11, 10, 11),                      /* and $t3, $t2, $t3    ; temp2 = temp2 & temp1 */
1425                 MIPS32_BNE(0, 11, 10, NEG16(8)),        /* bne $t3, $t2, busy   ; if (temp2 != temp1) goto busy */
1426                 MIPS32_NOP,                                             /* nop                                  */
1427
1428                 MIPS32_LHU(0, 10, 0, 5),                /* lhu $t2, ($a1)               ; temp1 = *daddr */
1429                 MIPS32_XOR(0, 11, 9, 10),               /* xor $t3, $a0, $t2    ; temp2 = out ^ temp1; */
1430                 MIPS32_AND(0, 11, 8, 11),               /* and $t3, $t0, $t3    ; temp2 = temp2 & DQ7mask */
1431                 MIPS32_BNE(0, 11, 8, 4),                /* bne $t3, $t0, cont   ; if (temp2 != DQ7mask) goto cont */
1432                 MIPS32_NOP,                                             /* nop */
1433
1434                 MIPS32_XOR(0, 9, 9, 9),                 /* xor $t1, $t1, $t1    ; out = 0 */
1435                 MIPS32_BEQ(0, 9, 0, 11),                        /* beq $t1, $zero, done ; if (out == 0) goto done */
1436                 MIPS32_NOP,                                             /* nop */
1437                 /* cont:        */
1438                 MIPS32_ADDI(0, 6, 6, NEG16(1)), /* addi, $a2, $a2, -1   ; numwrites-- */
1439                 MIPS32_BNE(0, 6, 0, 5),         /* bne $a2, $zero, cont2        ; if (numwrite != 0) goto cont2 */
1440                 MIPS32_NOP,                                             /* nop */
1441
1442                 MIPS32_LUI(0, 9, 0),                            /* lui $t1, 0 */
1443                 MIPS32_ORI(0, 9, 9, 0x80),                      /* ori $t1, $t1, 0x80   ; out = 0x80 */
1444
1445                 MIPS32_B(0, 4),                                 /* b done                       ; goto done */
1446                 MIPS32_NOP,                                             /* nop */
1447                 /* cont2:       */
1448                 MIPS32_ADDI(0, 5, 5, 2),                        /* addi $a0, $a0, 2     ; daddr += 2 */
1449                 MIPS32_B(0, NEG16(33)),                 /* b start                      ; goto start */
1450                 MIPS32_NOP,                                             /* nop */
1451                 /* done: */
1452                 MIPS32_SDBBP(0),                                        /* sdbbp                        ; break(); */
1453         };
1454
1455         mips32_info.common_magic = MIPS32_COMMON_MAGIC;
1456         mips32_info.isa_mode = MIPS32_ISA_MIPS32;
1457
1458         int target_code_size = 0;
1459         const uint32_t *target_code_src = NULL;
1460
1461         switch (bank->bus_width) {
1462                 case 2:
1463                         /* Check for DQ5 support */
1464                         if (cfi_info->status_poll_mask & (1 << 5)) {
1465                                 target_code_src = mips_word_16_code;
1466                                 target_code_size = sizeof(mips_word_16_code);
1467                         } else {
1468                                 LOG_ERROR("Need DQ5 support");
1469                                 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
1470                                 /* target_code_src = mips_word_16_code_dq7only; */
1471                                 /* target_code_size = sizeof(mips_word_16_code_dq7only); */
1472                         }
1473                         break;
1474                 default:
1475                         LOG_ERROR("Unsupported bank buswidth %u, can't do block memory writes",
1476                                         bank->bus_width);
1477                         return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
1478         }
1479
1480         /* flash write code */
1481         uint8_t *target_code;
1482
1483         /* convert bus-width dependent algorithm code to correct endianness */
1484         target_code = malloc(target_code_size);
1485         if (!target_code) {
1486                 LOG_ERROR("Out of memory");
1487                 return ERROR_FAIL;
1488         }
1489
1490         target_buffer_set_u32_array(target, target_code, target_code_size / 4, target_code_src);
1491
1492         /* allocate working area */
1493         retval = target_alloc_working_area(target, target_code_size,
1494                         &write_algorithm);
1495         if (retval != ERROR_OK) {
1496                 free(target_code);
1497                 return retval;
1498         }
1499
1500         /* write algorithm code to working area */
1501         retval = target_write_buffer(target, write_algorithm->address,
1502                         target_code_size, target_code);
1503         if (retval != ERROR_OK) {
1504                 free(target_code);
1505                 return retval;
1506         }
1507
1508         free(target_code);
1509
1510         /* the following code still assumes target code is fixed 24*4 bytes */
1511
1512         while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
1513                 buffer_size /= 2;
1514                 if (buffer_size <= 256) {
1515                         /* we already allocated the writing code, but failed to get a
1516                          * buffer, free the algorithm */
1517                         target_free_working_area(target, write_algorithm);
1518
1519                         LOG_WARNING(
1520                                 "not enough working area available, can't do block memory writes");
1521                         return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
1522                 }
1523         }
1524
1525         init_reg_param(&reg_params[0], "r4", 32, PARAM_OUT);
1526         init_reg_param(&reg_params[1], "r5", 32, PARAM_OUT);
1527         init_reg_param(&reg_params[2], "r6", 32, PARAM_OUT);
1528         init_reg_param(&reg_params[3], "r7", 32, PARAM_OUT);
1529         init_reg_param(&reg_params[4], "r8", 32, PARAM_OUT);
1530         init_reg_param(&reg_params[5], "r9", 32, PARAM_IN);
1531         init_reg_param(&reg_params[6], "r12", 32, PARAM_OUT);
1532         init_reg_param(&reg_params[7], "r13", 32, PARAM_OUT);
1533         init_reg_param(&reg_params[8], "r14", 32, PARAM_OUT);
1534         init_reg_param(&reg_params[9], "r15", 32, PARAM_OUT);
1535
1536         while (count > 0) {
1537                 uint32_t thisrun_count = (count > buffer_size) ? buffer_size : count;
1538
1539                 retval = target_write_buffer(target, source->address, thisrun_count, buffer);
1540                 if (retval != ERROR_OK)
1541                         break;
1542
1543                 buf_set_u32(reg_params[0].value, 0, 32, source->address);
1544                 buf_set_u32(reg_params[1].value, 0, 32, address);
1545                 buf_set_u32(reg_params[2].value, 0, 32, thisrun_count / bank->bus_width);
1546                 buf_set_u32(reg_params[3].value, 0, 32, cfi_command_val(bank, 0xA0));
1547                 buf_set_u32(reg_params[4].value, 0, 32, cfi_command_val(bank, 0x80));
1548                 buf_set_u32(reg_params[6].value, 0, 32, cfi_flash_address(bank, 0, pri_ext->_unlock1));
1549                 buf_set_u32(reg_params[7].value, 0, 32, 0xaaaaaaaa);
1550                 buf_set_u32(reg_params[8].value, 0, 32, cfi_flash_address(bank, 0, pri_ext->_unlock2));
1551                 buf_set_u32(reg_params[9].value, 0, 32, 0x55555555);
1552
1553                 retval = target_run_algorithm(target, 0, NULL, 10, reg_params,
1554                                 write_algorithm->address,
1555                                 write_algorithm->address + ((target_code_size) - 4),
1556                                 10000, &mips32_info);
1557                 if (retval != ERROR_OK)
1558                         break;
1559
1560                 status = buf_get_u32(reg_params[5].value, 0, 32);
1561                 if (status != 0x80) {
1562                         LOG_ERROR("flash write block failed status: 0x%" PRIx32, status);
1563                         retval = ERROR_FLASH_OPERATION_FAILED;
1564                         break;
1565                 }
1566
1567                 buffer += thisrun_count;
1568                 address += thisrun_count;
1569                 count -= thisrun_count;
1570         }
1571
1572         target_free_all_working_areas(target);
1573
1574         destroy_reg_param(&reg_params[0]);
1575         destroy_reg_param(&reg_params[1]);
1576         destroy_reg_param(&reg_params[2]);
1577         destroy_reg_param(&reg_params[3]);
1578         destroy_reg_param(&reg_params[4]);
1579         destroy_reg_param(&reg_params[5]);
1580         destroy_reg_param(&reg_params[6]);
1581         destroy_reg_param(&reg_params[7]);
1582         destroy_reg_param(&reg_params[8]);
1583         destroy_reg_param(&reg_params[9]);
1584
1585         return retval;
1586 }
1587
1588 static int cfi_spansion_write_block(struct flash_bank *bank, const uint8_t *buffer,
1589         uint32_t address, uint32_t count)
1590 {
1591         struct cfi_flash_bank *cfi_info = bank->driver_priv;
1592         struct cfi_spansion_pri_ext *pri_ext = cfi_info->pri_ext;
1593         struct target *target = bank->target;
1594         struct reg_param reg_params[10];
1595         void *arm_algo;
1596         struct arm_algorithm armv4_5_algo;
1597         struct armv7m_algorithm armv7m_algo;
1598         struct working_area *write_algorithm;
1599         struct working_area *source;
1600         uint32_t buffer_size = 32768;
1601         uint32_t status;
1602         int retval = ERROR_OK;
1603
1604         /* input parameters -
1605          *      R0 = source address
1606          *      R1 = destination address
1607          *      R2 = number of writes
1608          *      R3 = flash write command
1609          *      R4 = constant to mask DQ7 bits (also used for Dq5 with shift)
1610          * output parameters -
1611          *      R5 = 0x80 ok 0x00 bad
1612          * temp registers -
1613          *      R6 = value read from flash to test status
1614          *      R7 = holding register
1615          * unlock registers -
1616          *  R8 = unlock1_addr
1617          *  R9 = unlock1_cmd
1618          *  R10 = unlock2_addr
1619          *  R11 = unlock2_cmd */
1620
1621         /* see contrib/loaders/flash/armv4_5_cfi_span_32.s for src */
1622         static const uint32_t armv4_5_word_32_code[] = {
1623                 /* 00008100 <sp_32_code>:               */
1624                 0xe4905004,             /* ldr  r5, [r0], #4                    */
1625                 0xe5889000,             /* str  r9, [r8]                                */
1626                 0xe58ab000,             /* str  r11, [r10]                              */
1627                 0xe5883000,             /* str  r3, [r8]                                */
1628                 0xe5815000,             /* str  r5, [r1]                                */
1629                 0xe1a00000,             /* nop                                                  */
1630                 /* 00008110 <sp_32_busy>:               */
1631                 0xe5916000,             /* ldr  r6, [r1]                                */
1632                 0xe0257006,             /* eor  r7, r5, r6                              */
1633                 0xe0147007,             /* ands r7, r4, r7                              */
1634                 0x0a000007,             /* beq  8140 <sp_32_cont> ; b if DQ7 == Data7 */
1635                 0xe0166124,             /* ands r6, r6, r4, lsr #2              */
1636                 0x0afffff9,             /* beq  8110 <sp_32_busy> ;     b if DQ5 low */
1637                 0xe5916000,             /* ldr  r6, [r1]                                */
1638                 0xe0257006,             /* eor  r7, r5, r6                              */
1639                 0xe0147007,             /* ands r7, r4, r7                              */
1640                 0x0a000001,             /* beq  8140 <sp_32_cont> ; b if DQ7 == Data7 */
1641                 0xe3a05000,             /* mov  r5, #0  ; 0x0 - return 0x00, error */
1642                 0x1a000004,             /* bne  8154 <sp_32_done>               */
1643                 /* 00008140 <sp_32_cont>:               */
1644                 0xe2522001,             /* subs r2, r2, #1      ; 0x1           */
1645                 0x03a05080,             /* moveq        r5, #128        ; 0x80  */
1646                 0x0a000001,             /* beq  8154 <sp_32_done>               */
1647                 0xe2811004,             /* add  r1, r1, #4      ; 0x4           */
1648                 0xeaffffe8,             /* b    8100 <sp_32_code>               */
1649                 /* 00008154 <sp_32_done>:               */
1650                 0xeafffffe              /* b    8154 <sp_32_done>               */
1651         };
1652
1653         /* see contrib/loaders/flash/armv4_5_cfi_span_16.s for src */
1654         static const uint32_t armv4_5_word_16_code[] = {
1655                 /* 00008158 <sp_16_code>:               */
1656                 0xe0d050b2,             /* ldrh r5, [r0], #2                    */
1657                 0xe1c890b0,             /* strh r9, [r8]                                */
1658                 0xe1cab0b0,             /* strh r11, [r10]                              */
1659                 0xe1c830b0,             /* strh r3, [r8]                                */
1660                 0xe1c150b0,             /* strh r5, [r1]                                */
1661                 0xe1a00000,             /* nop                  (mov r0,r0)             */
1662                 /* 00008168 <sp_16_busy>:               */
1663                 0xe1d160b0,             /* ldrh r6, [r1]                                */
1664                 0xe0257006,             /* eor  r7, r5, r6                              */
1665                 0xe0147007,             /* ands r7, r4, r7                              */
1666                 0x0a000007,             /* beq  8198 <sp_16_cont>               */
1667                 0xe0166124,             /* ands r6, r6, r4, lsr #2              */
1668                 0x0afffff9,             /* beq  8168 <sp_16_busy>               */
1669                 0xe1d160b0,             /* ldrh r6, [r1]                                */
1670                 0xe0257006,             /* eor  r7, r5, r6                              */
1671                 0xe0147007,             /* ands r7, r4, r7                              */
1672                 0x0a000001,             /* beq  8198 <sp_16_cont>               */
1673                 0xe3a05000,             /* mov  r5, #0  ; 0x0                   */
1674                 0x1a000004,             /* bne  81ac <sp_16_done>               */
1675                 /* 00008198 <sp_16_cont>:               */
1676                 0xe2522001,     /* subs r2, r2, #1      ; 0x1           */
1677                 0x03a05080,     /* moveq        r5, #128        ; 0x80  */
1678                 0x0a000001,     /* beq  81ac <sp_16_done>               */
1679                 0xe2811002,     /* add  r1, r1, #2      ; 0x2           */
1680                 0xeaffffe8,     /* b    8158 <sp_16_code>               */
1681                 /* 000081ac <sp_16_done>:               */
1682                 0xeafffffe              /* b    81ac <sp_16_done>               */
1683         };
1684
1685         /* see contrib/loaders/flash/armv7m_cfi_span_16.s for src */
1686         static const uint32_t armv7m_word_16_code[] = {
1687                 0x5B02F830,
1688                 0x9000F8A8,
1689                 0xB000F8AA,
1690                 0x3000F8A8,
1691                 0xBF00800D,
1692                 0xEA85880E,
1693                 0x40270706,
1694                 0xEA16D00A,
1695                 0xD0F70694,
1696                 0xEA85880E,
1697                 0x40270706,
1698                 0xF04FD002,
1699                 0xD1070500,
1700                 0xD0023A01,
1701                 0x0102F101,
1702                 0xF04FE7E0,
1703                 0xE7FF0580,
1704                 0x0000BE00
1705         };
1706
1707         /* see contrib/loaders/flash/armv7m_cfi_span_16_dq7.s for src */
1708         static const uint32_t armv7m_word_16_code_dq7only[] = {
1709                 /* 00000000 <code>: */
1710                 0x5B02F830,             /* ldrh.w       r5, [r0], #2    */
1711                 0x9000F8A8,             /* strh.w       r9, [r8]                */
1712                 0xB000F8AA,             /* strh.w       fp, [sl]                */
1713                 0x3000F8A8,             /* strh.w       r3, [r8]                */
1714                 0xBF00800D,             /* strh r5, [r1, #0]            */
1715                                                 /* nop                                          */
1716
1717                 /* 00000014 <busy>: */
1718                 0xEA85880E,             /* ldrh r6, [r1, #0]            */
1719                                                 /* eor.w        r7, r5, r6              */
1720                 0x40270706,             /* ands         r7, r4                  */
1721                 0x3A01D1FA,             /* bne.n        14 <busy>               */
1722                                                 /* subs r2, #1                          */
1723                 0xF101D002,             /* beq.n        28 <success>    */
1724                 0xE7EB0102,             /* add.w        r1, r1, #2              */
1725                                                 /* b.n  0 <code>                        */
1726
1727                 /* 00000028 <success>: */
1728                 0x0580F04F,             /* mov.w        r5, #128                */
1729                 0xBF00E7FF,             /* b.n  30 <done>                       */
1730                                                 /* nop (for alignment purposes) */
1731
1732                 /* 00000030 <done>: */
1733                 0x0000BE00              /* bkpt 0x0000                          */
1734         };
1735
1736         /* see contrib/loaders/flash/armv4_5_cfi_span_16_dq7.s for src */
1737         static const uint32_t armv4_5_word_16_code_dq7only[] = {
1738                 /* <sp_16_code>:                                */
1739                 0xe0d050b2,             /* ldrh r5, [r0], #2                    */
1740                 0xe1c890b0,             /* strh r9, [r8]                                */
1741                 0xe1cab0b0,             /* strh r11, [r10]                              */
1742                 0xe1c830b0,             /* strh r3, [r8]                                */
1743                 0xe1c150b0,             /* strh r5, [r1]                                */
1744                 0xe1a00000,             /* nop                  (mov r0,r0)             */
1745                 /* <sp_16_busy>:                                */
1746                 0xe1d160b0,             /* ldrh r6, [r1]                                */
1747                 0xe0257006,             /* eor  r7, r5, r6                              */
1748                 0xe2177080,             /* ands r7, #0x80                               */
1749                 0x1afffffb,             /* bne  8168 <sp_16_busy>               */
1750                 /*                                                              */
1751                 0xe2522001,             /* subs r2, r2, #1      ; 0x1           */
1752                 0x03a05080,             /* moveq        r5, #128        ; 0x80  */
1753                 0x0a000001,             /* beq  81ac <sp_16_done>               */
1754                 0xe2811002,             /* add  r1, r1, #2      ; 0x2           */
1755                 0xeafffff0,             /* b    8158 <sp_16_code>               */
1756                 /* 000081ac <sp_16_done>:               */
1757                 0xeafffffe              /* b    81ac <sp_16_done>               */
1758         };
1759
1760         /* see contrib/loaders/flash/armv4_5_cfi_span_8.s for src */
1761         static const uint32_t armv4_5_word_8_code[] = {
1762                 /* 000081b0 <sp_16_code_end>:   */
1763                 0xe4d05001,             /* ldrb r5, [r0], #1                    */
1764                 0xe5c89000,             /* strb r9, [r8]                                */
1765                 0xe5cab000,             /* strb r11, [r10]                              */
1766                 0xe5c83000,             /* strb r3, [r8]                                */
1767                 0xe5c15000,             /* strb r5, [r1]                                */
1768                 0xe1a00000,             /* nop                  (mov r0,r0)             */
1769                 /* 000081c0 <sp_8_busy>:                */
1770                 0xe5d16000,             /* ldrb r6, [r1]                                */
1771                 0xe0257006,             /* eor  r7, r5, r6                              */
1772                 0xe0147007,             /* ands r7, r4, r7                              */
1773                 0x0a000007,             /* beq  81f0 <sp_8_cont>                */
1774                 0xe0166124,             /* ands r6, r6, r4, lsr #2              */
1775                 0x0afffff9,             /* beq  81c0 <sp_8_busy>                */
1776                 0xe5d16000,             /* ldrb r6, [r1]                                */
1777                 0xe0257006,             /* eor  r7, r5, r6                              */
1778                 0xe0147007,             /* ands r7, r4, r7                              */
1779                 0x0a000001,             /* beq  81f0 <sp_8_cont>                */
1780                 0xe3a05000,             /* mov  r5, #0  ; 0x0                   */
1781                 0x1a000004,             /* bne  8204 <sp_8_done>                */
1782                 /* 000081f0 <sp_8_cont>:                */
1783                 0xe2522001,             /* subs r2, r2, #1      ; 0x1           */
1784                 0x03a05080,             /* moveq        r5, #128        ; 0x80  */
1785                 0x0a000001,             /* beq  8204 <sp_8_done>                */
1786                 0xe2811001,             /* add  r1, r1, #1      ; 0x1           */
1787                 0xeaffffe8,             /* b    81b0 <sp_16_code_end>   */
1788                 /* 00008204 <sp_8_done>:                */
1789                 0xeafffffe              /* b    8204 <sp_8_done>                */
1790         };
1791
1792         if (strncmp(target_type_name(target), "mips_m4k", 8) == 0)
1793                 return cfi_spansion_write_block_mips(bank, buffer, address, count);
1794
1795         if (is_armv7m(target_to_armv7m(target))) {      /* armv7m target */
1796                 armv7m_algo.common_magic = ARMV7M_COMMON_MAGIC;
1797                 armv7m_algo.core_mode = ARM_MODE_THREAD;
1798                 arm_algo = &armv7m_algo;
1799         } else if (is_arm(target_to_arm(target))) {
1800                 /* All other ARM CPUs have 32 bit instructions */
1801                 armv4_5_algo.common_magic = ARM_COMMON_MAGIC;
1802                 armv4_5_algo.core_mode = ARM_MODE_SVC;
1803                 armv4_5_algo.core_state = ARM_STATE_ARM;
1804                 arm_algo = &armv4_5_algo;
1805         } else {
1806                 LOG_ERROR("Unknown architecture");
1807                 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
1808         }
1809
1810         int target_code_size = 0;
1811         const uint32_t *target_code_src = NULL;
1812
1813         switch (bank->bus_width) {
1814                 case 1:
1815                         if (is_armv7m(target_to_armv7m(target))) {
1816                                 LOG_ERROR("Unknown ARM architecture");
1817                                 return ERROR_FAIL;
1818                         }
1819                         target_code_src = armv4_5_word_8_code;
1820                         target_code_size = sizeof(armv4_5_word_8_code);
1821                         break;
1822                 case 2:
1823                         /* Check for DQ5 support */
1824                         if (cfi_info->status_poll_mask & (1 << 5)) {
1825                                 if (is_armv7m(target_to_armv7m(target))) {
1826                                         /* armv7m target */
1827                                         target_code_src = armv7m_word_16_code;
1828                                         target_code_size = sizeof(armv7m_word_16_code);
1829                                 } else { /* armv4_5 target */
1830                                         target_code_src = armv4_5_word_16_code;
1831                                         target_code_size = sizeof(armv4_5_word_16_code);
1832                                 }
1833                         } else {
1834                                 /* No DQ5 support. Use DQ7 DATA# polling only. */
1835                                 if (is_armv7m(target_to_armv7m(target))) {
1836                                         /* armv7m target */
1837                                         target_code_src = armv7m_word_16_code_dq7only;
1838                                         target_code_size = sizeof(armv7m_word_16_code_dq7only);
1839                                 } else { /* armv4_5 target */
1840                                         target_code_src = armv4_5_word_16_code_dq7only;
1841                                         target_code_size = sizeof(armv4_5_word_16_code_dq7only);
1842                                 }
1843                         }
1844                         break;
1845                 case 4:
1846                         if (is_armv7m(target_to_armv7m(target))) {
1847                                 LOG_ERROR("Unknown ARM architecture");
1848                                 return ERROR_FAIL;
1849                         }
1850                         target_code_src = armv4_5_word_32_code;
1851                         target_code_size = sizeof(armv4_5_word_32_code);
1852                         break;
1853                 default:
1854                         LOG_ERROR("Unsupported bank buswidth %u, can't do block memory writes",
1855                                         bank->bus_width);
1856                         return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
1857         }
1858
1859         /* flash write code */
1860         uint8_t *target_code;
1861
1862         /* convert bus-width dependent algorithm code to correct endianness */
1863         target_code = malloc(target_code_size);
1864         if (!target_code) {
1865                 LOG_ERROR("Out of memory");
1866                 return ERROR_FAIL;
1867         }
1868
1869         target_buffer_set_u32_array(target, target_code, target_code_size / 4, target_code_src);
1870
1871         /* allocate working area */
1872         retval = target_alloc_working_area(target, target_code_size,
1873                         &write_algorithm);
1874         if (retval != ERROR_OK) {
1875                 free(target_code);
1876                 return retval;
1877         }
1878
1879         /* write algorithm code to working area */
1880         retval = target_write_buffer(target, write_algorithm->address,
1881                         target_code_size, target_code);
1882         if (retval != ERROR_OK) {
1883                 free(target_code);
1884                 return retval;
1885         }
1886
1887         free(target_code);
1888
1889         /* the following code still assumes target code is fixed 24*4 bytes */
1890
1891         while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
1892                 buffer_size /= 2;
1893                 if (buffer_size <= 256) {
1894                         /* we already allocated the writing code, but failed to get a
1895                          * buffer, free the algorithm */
1896                         target_free_working_area(target, write_algorithm);
1897
1898                         LOG_WARNING(
1899                                 "not enough working area available, can't do block memory writes");
1900                         return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
1901                 }
1902         }
1903
1904         init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT);
1905         init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);
1906         init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);
1907         init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);
1908         init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT);
1909         init_reg_param(&reg_params[5], "r5", 32, PARAM_IN);
1910         init_reg_param(&reg_params[6], "r8", 32, PARAM_OUT);
1911         init_reg_param(&reg_params[7], "r9", 32, PARAM_OUT);
1912         init_reg_param(&reg_params[8], "r10", 32, PARAM_OUT);
1913         init_reg_param(&reg_params[9], "r11", 32, PARAM_OUT);
1914
1915         while (count > 0) {
1916                 uint32_t thisrun_count = (count > buffer_size) ? buffer_size : count;
1917
1918                 retval = target_write_buffer(target, source->address, thisrun_count, buffer);
1919                 if (retval != ERROR_OK)
1920                         break;
1921
1922                 buf_set_u32(reg_params[0].value, 0, 32, source->address);
1923                 buf_set_u32(reg_params[1].value, 0, 32, address);
1924                 buf_set_u32(reg_params[2].value, 0, 32, thisrun_count / bank->bus_width);
1925                 buf_set_u32(reg_params[3].value, 0, 32, cfi_command_val(bank, 0xA0));
1926                 buf_set_u32(reg_params[4].value, 0, 32, cfi_command_val(bank, 0x80));
1927                 buf_set_u32(reg_params[6].value, 0, 32, cfi_flash_address(bank, 0, pri_ext->_unlock1));
1928                 buf_set_u32(reg_params[7].value, 0, 32, 0xaaaaaaaa);
1929                 buf_set_u32(reg_params[8].value, 0, 32, cfi_flash_address(bank, 0, pri_ext->_unlock2));
1930                 buf_set_u32(reg_params[9].value, 0, 32, 0x55555555);
1931
1932                 retval = target_run_algorithm(target, 0, NULL, 10, reg_params,
1933                                 write_algorithm->address,
1934                                 write_algorithm->address + ((target_code_size) - 4),
1935                                 10000, arm_algo);
1936                 if (retval != ERROR_OK)
1937                         break;
1938
1939                 status = buf_get_u32(reg_params[5].value, 0, 32);
1940                 if (status != 0x80) {
1941                         LOG_ERROR("flash write block failed status: 0x%" PRIx32, status);
1942                         retval = ERROR_FLASH_OPERATION_FAILED;
1943                         break;
1944                 }
1945
1946                 buffer += thisrun_count;
1947                 address += thisrun_count;
1948                 count -= thisrun_count;
1949         }
1950
1951         target_free_all_working_areas(target);
1952
1953         destroy_reg_param(&reg_params[0]);
1954         destroy_reg_param(&reg_params[1]);
1955         destroy_reg_param(&reg_params[2]);
1956         destroy_reg_param(&reg_params[3]);
1957         destroy_reg_param(&reg_params[4]);
1958         destroy_reg_param(&reg_params[5]);
1959         destroy_reg_param(&reg_params[6]);
1960         destroy_reg_param(&reg_params[7]);
1961         destroy_reg_param(&reg_params[8]);
1962         destroy_reg_param(&reg_params[9]);
1963
1964         return retval;
1965 }
1966
1967 static int cfi_intel_write_word(struct flash_bank *bank, uint8_t *word, uint32_t address)
1968 {
1969         int retval;
1970         struct cfi_flash_bank *cfi_info = bank->driver_priv;
1971
1972         cfi_intel_clear_status_register(bank);
1973         retval = cfi_send_command(bank, 0x40, address);
1974         if (retval != ERROR_OK)
1975                 return retval;
1976
1977         retval = cfi_target_write_memory(bank, address, 1, word);
1978         if (retval != ERROR_OK)
1979                 return retval;
1980
1981         uint8_t status;
1982         retval = cfi_intel_wait_status_busy(bank, cfi_info->word_write_timeout, &status);
1983         if (retval != ERROR_OK)
1984                 return retval;
1985         if (status != 0x80) {
1986                 retval = cfi_send_command(bank, 0xff, cfi_flash_address(bank, 0, 0x0));
1987                 if (retval != ERROR_OK)
1988                         return retval;
1989
1990                 LOG_ERROR("couldn't write word at base " TARGET_ADDR_FMT
1991                                 ", address 0x%" PRIx32,
1992                                 bank->base, address);
1993                 return ERROR_FLASH_OPERATION_FAILED;
1994         }
1995
1996         return ERROR_OK;
1997 }
1998
1999 static int cfi_intel_write_words(struct flash_bank *bank, const uint8_t *word,
2000         uint32_t wordcount, uint32_t address)
2001 {
2002         int retval;
2003         struct cfi_flash_bank *cfi_info = bank->driver_priv;
2004
2005         /* Calculate buffer size and boundary mask
2006          * buffersize is (buffer size per chip) * (number of chips)
2007          * bufferwsize is buffersize in words */
2008         uint32_t buffersize =
2009                 (1UL << cfi_info->max_buf_write_size) * (bank->bus_width / bank->chip_width);
2010         uint32_t buffermask = buffersize-1;
2011         uint32_t bufferwsize = buffersize / bank->bus_width;
2012
2013         /* Check for valid range */
2014         if (address & buffermask) {
2015                 LOG_ERROR("Write address at base " TARGET_ADDR_FMT ", address 0x%"
2016                                 PRIx32 " not aligned to 2^%d boundary",
2017                                 bank->base, address, cfi_info->max_buf_write_size);
2018                 return ERROR_FLASH_OPERATION_FAILED;
2019         }
2020
2021         /* Check for valid size */
2022         if (wordcount > bufferwsize) {
2023                 LOG_ERROR("Number of data words %" PRIu32 " exceeds available buffersize %" PRIu32,
2024                         wordcount, buffersize);
2025                 return ERROR_FLASH_OPERATION_FAILED;
2026         }
2027
2028         /* Write to flash buffer */
2029         cfi_intel_clear_status_register(bank);
2030
2031         /* Initiate buffer operation _*/
2032         retval = cfi_send_command(bank, 0xe8, address);
2033         if (retval != ERROR_OK)
2034                 return retval;
2035         uint8_t status;
2036         retval = cfi_intel_wait_status_busy(bank, cfi_info->buf_write_timeout, &status);
2037         if (retval != ERROR_OK)
2038                 return retval;
2039         if (status != 0x80) {
2040                 retval = cfi_send_command(bank, 0xff, cfi_flash_address(bank, 0, 0x0));
2041                 if (retval != ERROR_OK)
2042                         return retval;
2043
2044                 LOG_ERROR(
2045                         "couldn't start buffer write operation at base " TARGET_ADDR_FMT
2046                         ", address 0x%" PRIx32,
2047                         bank->base,
2048                         address);
2049                 return ERROR_FLASH_OPERATION_FAILED;
2050         }
2051
2052         /* Write buffer wordcount-1 and data words */
2053         retval = cfi_send_command(bank, bufferwsize-1, address);
2054         if (retval != ERROR_OK)
2055                 return retval;
2056
2057         retval = cfi_target_write_memory(bank, address, bufferwsize, word);
2058         if (retval != ERROR_OK)
2059                 return retval;
2060
2061         /* Commit write operation */
2062         retval = cfi_send_command(bank, 0xd0, address);
2063         if (retval != ERROR_OK)
2064                 return retval;
2065
2066         retval = cfi_intel_wait_status_busy(bank, cfi_info->buf_write_timeout, &status);
2067         if (retval != ERROR_OK)
2068                 return retval;
2069
2070         if (status != 0x80) {
2071                 retval = cfi_send_command(bank, 0xff, cfi_flash_address(bank, 0, 0x0));
2072                 if (retval != ERROR_OK)
2073                         return retval;
2074
2075                 LOG_ERROR("Buffer write at base " TARGET_ADDR_FMT
2076                         ", address 0x%" PRIx32 " failed.", bank->base, address);
2077                 return ERROR_FLASH_OPERATION_FAILED;
2078         }
2079
2080         return ERROR_OK;
2081 }
2082
2083 static int cfi_spansion_write_word(struct flash_bank *bank, uint8_t *word, uint32_t address)
2084 {
2085         int retval;
2086         struct cfi_flash_bank *cfi_info = bank->driver_priv;
2087         struct cfi_spansion_pri_ext *pri_ext = cfi_info->pri_ext;
2088
2089         retval = cfi_spansion_unlock_seq(bank);
2090         if (retval != ERROR_OK)
2091                 return retval;
2092
2093         retval = cfi_send_command(bank, 0xa0, cfi_flash_address(bank, 0, pri_ext->_unlock1));
2094         if (retval != ERROR_OK)
2095                 return retval;
2096
2097         retval = cfi_target_write_memory(bank, address, 1, word);
2098         if (retval != ERROR_OK)
2099                 return retval;
2100
2101         if (cfi_spansion_wait_status_busy(bank, cfi_info->word_write_timeout) != ERROR_OK) {
2102                 retval = cfi_send_command(bank, 0xf0, cfi_flash_address(bank, 0, 0x0));
2103                 if (retval != ERROR_OK)
2104                         return retval;
2105
2106                 LOG_ERROR("couldn't write word at base " TARGET_ADDR_FMT
2107                         ", address 0x%" PRIx32, bank->base, address);
2108                 return ERROR_FLASH_OPERATION_FAILED;
2109         }
2110
2111         return ERROR_OK;
2112 }
2113
2114 static int cfi_spansion_write_words(struct flash_bank *bank, const uint8_t *word,
2115         uint32_t wordcount, uint32_t address)
2116 {
2117         int retval;
2118         struct cfi_flash_bank *cfi_info = bank->driver_priv;
2119
2120         /* Calculate buffer size and boundary mask
2121          * buffersize is (buffer size per chip) * (number of chips)
2122          * bufferwsize is buffersize in words */
2123         uint32_t buffersize =
2124                 (1UL << cfi_info->max_buf_write_size) * (bank->bus_width / bank->chip_width);
2125         uint32_t buffermask = buffersize-1;
2126         uint32_t bufferwsize = buffersize / bank->bus_width;
2127
2128         /* Check for valid range */
2129         if (address & buffermask) {
2130                 LOG_ERROR("Write address at base " TARGET_ADDR_FMT
2131                         ", address 0x%" PRIx32 " not aligned to 2^%d boundary",
2132                         bank->base, address, cfi_info->max_buf_write_size);
2133                 return ERROR_FLASH_OPERATION_FAILED;
2134         }
2135
2136         /* Check for valid size */
2137         if (wordcount > bufferwsize) {
2138                 LOG_ERROR("Number of data words %" PRIu32 " exceeds available buffersize %"
2139                         PRIu32, wordcount, buffersize);
2140                 return ERROR_FLASH_OPERATION_FAILED;
2141         }
2142
2143         /* Unlock */
2144         retval = cfi_spansion_unlock_seq(bank);
2145         if (retval != ERROR_OK)
2146                 return retval;
2147
2148         /* Buffer load command */
2149         retval = cfi_send_command(bank, 0x25, address);
2150         if (retval != ERROR_OK)
2151                 return retval;
2152
2153         /* Write buffer wordcount-1 and data words */
2154         retval = cfi_send_command(bank, bufferwsize-1, address);
2155         if (retval != ERROR_OK)
2156                 return retval;
2157
2158         retval = cfi_target_write_memory(bank, address, bufferwsize, word);
2159         if (retval != ERROR_OK)
2160                 return retval;
2161
2162         /* Commit write operation */
2163         retval = cfi_send_command(bank, 0x29, address);
2164         if (retval != ERROR_OK)
2165                 return retval;
2166
2167         if (cfi_spansion_wait_status_busy(bank, cfi_info->buf_write_timeout) != ERROR_OK) {
2168                 retval = cfi_send_command(bank, 0xf0, cfi_flash_address(bank, 0, 0x0));
2169                 if (retval != ERROR_OK)
2170                         return retval;
2171
2172                 LOG_ERROR("couldn't write block at base " TARGET_ADDR_FMT
2173                         ", address 0x%" PRIx32 ", size 0x%" PRIx32, bank->base, address,
2174                         bufferwsize);
2175                 return ERROR_FLASH_OPERATION_FAILED;
2176         }
2177
2178         return ERROR_OK;
2179 }
2180
2181 int cfi_write_word(struct flash_bank *bank, uint8_t *word, uint32_t address)
2182 {
2183         struct cfi_flash_bank *cfi_info = bank->driver_priv;
2184
2185         switch (cfi_info->pri_id) {
2186                 case 1:
2187                 case 3:
2188                         return cfi_intel_write_word(bank, word, address);
2189                 case 2:
2190                         return cfi_spansion_write_word(bank, word, address);
2191                 default:
2192                         LOG_ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
2193                         break;
2194         }
2195
2196         return ERROR_FLASH_OPERATION_FAILED;
2197 }
2198
2199 static int cfi_write_words(struct flash_bank *bank, const uint8_t *word,
2200         uint32_t wordcount, uint32_t address)
2201 {
2202         struct cfi_flash_bank *cfi_info = bank->driver_priv;
2203
2204         if (cfi_info->buf_write_timeout_typ == 0) {
2205                 /* buffer writes are not supported */
2206                 LOG_DEBUG("Buffer Writes Not Supported");
2207                 return ERROR_FLASH_OPER_UNSUPPORTED;
2208         }
2209
2210         switch (cfi_info->pri_id) {
2211                 case 1:
2212                 case 3:
2213                         return cfi_intel_write_words(bank, word, wordcount, address);
2214                 case 2:
2215                         return cfi_spansion_write_words(bank, word, wordcount, address);
2216                 default:
2217                         LOG_ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
2218                         break;
2219         }
2220
2221         return ERROR_FLASH_OPERATION_FAILED;
2222 }
2223
2224 static int cfi_read(struct flash_bank *bank, uint8_t *buffer, uint32_t offset, uint32_t count)
2225 {
2226         struct cfi_flash_bank *cfi_info = bank->driver_priv;
2227         uint32_t address = bank->base + offset;
2228         uint32_t read_p;
2229         int align;      /* number of unaligned bytes */
2230         uint8_t current_word[CFI_MAX_BUS_WIDTH];
2231         int retval;
2232
2233         LOG_DEBUG("reading buffer of %i byte at 0x%8.8x",
2234                 (int)count, (unsigned)offset);
2235
2236         if (bank->target->state != TARGET_HALTED) {
2237                 LOG_ERROR("Target not halted");
2238                 return ERROR_TARGET_NOT_HALTED;
2239         }
2240
2241         if (offset + count > bank->size)
2242                 return ERROR_FLASH_DST_OUT_OF_BANK;
2243
2244         if (cfi_info->qry[0] != 'Q')
2245                 return ERROR_FLASH_BANK_NOT_PROBED;
2246
2247         /* start at the first byte of the first word (bus_width size) */
2248         read_p = address & ~(bank->bus_width - 1);
2249         align = address - read_p;
2250         if (align != 0) {
2251                 LOG_INFO("Fixup %d unaligned read head bytes", align);
2252
2253                 /* read a complete word from flash */
2254                 retval = cfi_target_read_memory(bank, read_p, 1, current_word);
2255                 if (retval != ERROR_OK)
2256                         return retval;
2257
2258                 /* take only bytes we need */
2259                 for (unsigned int i = align; (i < bank->bus_width) && (count > 0); i++, count--)
2260                         *buffer++ = current_word[i];
2261
2262                 read_p += bank->bus_width;
2263         }
2264
2265         align = count / bank->bus_width;
2266         if (align) {
2267                 retval = cfi_target_read_memory(bank, read_p, align, buffer);
2268                 if (retval != ERROR_OK)
2269                         return retval;
2270
2271                 read_p += align * bank->bus_width;
2272                 buffer += align * bank->bus_width;
2273                 count -= align * bank->bus_width;
2274         }
2275
2276         if (count) {
2277                 LOG_INFO("Fixup %" PRIu32 " unaligned read tail bytes", count);
2278
2279                 /* read a complete word from flash */
2280                 retval = cfi_target_read_memory(bank, read_p, 1, current_word);
2281                 if (retval != ERROR_OK)
2282                         return retval;
2283
2284                 /* take only bytes we need */
2285                 for (unsigned int i = 0; (i < bank->bus_width) && (count > 0); i++, count--)
2286                         *buffer++ = current_word[i];
2287         }
2288
2289         return ERROR_OK;
2290 }
2291
2292 static int cfi_write(struct flash_bank *bank, const uint8_t *buffer, uint32_t offset, uint32_t count)
2293 {
2294         struct cfi_flash_bank *cfi_info = bank->driver_priv;
2295         uint32_t address = bank->base + offset; /* address of first byte to be programmed */
2296         uint32_t write_p;
2297         int align;      /* number of unaligned bytes */
2298         int blk_count;  /* number of bus_width bytes for block copy */
2299         uint8_t current_word[CFI_MAX_BUS_WIDTH * 4];    /* word (bus_width size) currently being
2300                                                          *programmed */
2301         uint8_t *swapped_buffer = NULL;
2302         const uint8_t *real_buffer = NULL;
2303         int retval;
2304
2305         if (bank->target->state != TARGET_HALTED) {
2306                 LOG_ERROR("Target not halted");
2307                 return ERROR_TARGET_NOT_HALTED;
2308         }
2309
2310         if (offset + count > bank->size)
2311                 return ERROR_FLASH_DST_OUT_OF_BANK;
2312
2313         if (cfi_info->qry[0] != 'Q')
2314                 return ERROR_FLASH_BANK_NOT_PROBED;
2315
2316         /* start at the first byte of the first word (bus_width size) */
2317         write_p = address & ~(bank->bus_width - 1);
2318         align = address - write_p;
2319         if (align != 0) {
2320                 LOG_INFO("Fixup %d unaligned head bytes", align);
2321
2322                 /* read a complete word from flash */
2323                 retval = cfi_target_read_memory(bank, write_p, 1, current_word);
2324                 if (retval != ERROR_OK)
2325                         return retval;
2326
2327                 /* replace only bytes that must be written */
2328                 for (unsigned int i = align; (i < bank->bus_width) && (count > 0); i++, count--)
2329                         if (cfi_info->data_swap)
2330                                 /* data bytes are swapped (reverse endianness) */
2331                                 current_word[bank->bus_width - i] = *buffer++;
2332                         else
2333                                 current_word[i] = *buffer++;
2334
2335                 retval = cfi_write_word(bank, current_word, write_p);
2336                 if (retval != ERROR_OK)
2337                         return retval;
2338                 write_p += bank->bus_width;
2339         }
2340
2341         if (cfi_info->data_swap && count) {
2342                 swapped_buffer = malloc(count & ~(bank->bus_width - 1));
2343                 switch (bank->bus_width) {
2344                 case 2:
2345                         buf_bswap16(swapped_buffer, buffer,
2346                                     count & ~(bank->bus_width - 1));
2347                         break;
2348                 case 4:
2349                         buf_bswap32(swapped_buffer, buffer,
2350                                     count & ~(bank->bus_width - 1));
2351                         break;
2352                 }
2353                 real_buffer = buffer;
2354                 buffer = swapped_buffer;
2355         }
2356
2357         /* handle blocks of bus_size aligned bytes */
2358         blk_count = count & ~(bank->bus_width - 1);     /* round down, leave tail bytes */
2359         switch (cfi_info->pri_id) {
2360                 /* try block writes (fails without working area) */
2361                 case 1:
2362                 case 3:
2363                         retval = cfi_intel_write_block(bank, buffer, write_p, blk_count);
2364                         break;
2365                 case 2:
2366                         retval = cfi_spansion_write_block(bank, buffer, write_p, blk_count);
2367                         break;
2368                 default:
2369                         LOG_ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
2370                         retval = ERROR_FLASH_OPERATION_FAILED;
2371                         break;
2372         }
2373         if (retval == ERROR_OK) {
2374                 /* Increment pointers and decrease count on successful block write */
2375                 buffer += blk_count;
2376                 write_p += blk_count;
2377                 count -= blk_count;
2378         } else {
2379                 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
2380                         /* Calculate buffer size and boundary mask
2381                          * buffersize is (buffer size per chip) * (number of chips)
2382                          * bufferwsize is buffersize in words */
2383                         uint32_t buffersize =
2384                                 (1UL <<
2385                                  cfi_info->max_buf_write_size) *
2386                                 (bank->bus_width / bank->chip_width);
2387                         uint32_t buffermask = buffersize-1;
2388                         uint32_t bufferwsize = buffersize / bank->bus_width;
2389
2390                         /* fall back to memory writes */
2391                         while (count >= (uint32_t)bank->bus_width) {
2392                                 bool fallback;
2393                                 if ((write_p & 0xff) == 0) {
2394                                         LOG_INFO("Programming at 0x%08" PRIx32 ", count 0x%08"
2395                                                 PRIx32 " bytes remaining", write_p, count);
2396                                 }
2397                                 fallback = true;
2398                                 if ((bufferwsize > 0) && (count >= buffersize) &&
2399                                                 !(write_p & buffermask)) {
2400                                         retval = cfi_write_words(bank, buffer, bufferwsize, write_p);
2401                                         if (retval == ERROR_OK) {
2402                                                 buffer += buffersize;
2403                                                 write_p += buffersize;
2404                                                 count -= buffersize;
2405                                                 fallback = false;
2406                                         } else if (retval != ERROR_FLASH_OPER_UNSUPPORTED)
2407                                                 return retval;
2408                                 }
2409                                 /* try the slow way? */
2410                                 if (fallback) {
2411                                         for (unsigned int i = 0; i < bank->bus_width; i++)
2412                                                 current_word[i] = *buffer++;
2413
2414                                         retval = cfi_write_word(bank, current_word, write_p);
2415                                         if (retval != ERROR_OK)
2416                                                 return retval;
2417
2418                                         write_p += bank->bus_width;
2419                                         count -= bank->bus_width;
2420                                 }
2421                         }
2422                 } else
2423                         return retval;
2424         }
2425
2426         if (swapped_buffer) {
2427                 buffer = real_buffer + (buffer - swapped_buffer);
2428                 free(swapped_buffer);
2429         }
2430
2431         /* return to read array mode, so we can read from flash again for padding */
2432         retval = cfi_reset(bank);
2433         if (retval != ERROR_OK)
2434                 return retval;
2435
2436         /* handle unaligned tail bytes */
2437         if (count > 0) {
2438                 LOG_INFO("Fixup %" PRIu32 " unaligned tail bytes", count);
2439
2440                 /* read a complete word from flash */
2441                 retval = cfi_target_read_memory(bank, write_p, 1, current_word);
2442                 if (retval != ERROR_OK)
2443                         return retval;
2444
2445                 /* replace only bytes that must be written */
2446                 for (unsigned int i = 0; (i < bank->bus_width) && (count > 0); i++, count--)
2447                         if (cfi_info->data_swap)
2448                                 /* data bytes are swapped (reverse endianness) */
2449                                 current_word[bank->bus_width - i] = *buffer++;
2450                         else
2451                                 current_word[i] = *buffer++;
2452
2453                 retval = cfi_write_word(bank, current_word, write_p);
2454                 if (retval != ERROR_OK)
2455                         return retval;
2456         }
2457
2458         /* return to read array mode */
2459         return cfi_reset(bank);
2460 }
2461
2462 static void cfi_fixup_reversed_erase_regions(struct flash_bank *bank, const void *param)
2463 {
2464         (void) param;
2465         struct cfi_flash_bank *cfi_info = bank->driver_priv;
2466         struct cfi_spansion_pri_ext *pri_ext = cfi_info->pri_ext;
2467
2468         pri_ext->_reversed_geometry = 1;
2469 }
2470
2471 static void cfi_fixup_0002_erase_regions(struct flash_bank *bank, const void *param)
2472 {
2473         struct cfi_flash_bank *cfi_info = bank->driver_priv;
2474         struct cfi_spansion_pri_ext *pri_ext = cfi_info->pri_ext;
2475         (void) param;
2476
2477         if ((pri_ext->_reversed_geometry) || (pri_ext->top_bottom == 3)) {
2478                 LOG_DEBUG("swapping reversed erase region information on cmdset 0002 device");
2479
2480                 for (unsigned int i = 0; i < cfi_info->num_erase_regions / 2; i++) {
2481                         int j = (cfi_info->num_erase_regions - 1) - i;
2482                         uint32_t swap;
2483
2484                         swap = cfi_info->erase_region_info[i];
2485                         cfi_info->erase_region_info[i] = cfi_info->erase_region_info[j];
2486                         cfi_info->erase_region_info[j] = swap;
2487                 }
2488         }
2489 }
2490
2491 static void cfi_fixup_0002_unlock_addresses(struct flash_bank *bank, const void *param)
2492 {
2493         struct cfi_flash_bank *cfi_info = bank->driver_priv;
2494         struct cfi_spansion_pri_ext *pri_ext = cfi_info->pri_ext;
2495         const struct cfi_unlock_addresses *unlock_addresses = param;
2496
2497         pri_ext->_unlock1 = unlock_addresses->unlock1;
2498         pri_ext->_unlock2 = unlock_addresses->unlock2;
2499 }
2500
2501 static void cfi_fixup_0002_polling_bits(struct flash_bank *bank, const void *param)
2502 {
2503         struct cfi_flash_bank *cfi_info = bank->driver_priv;
2504         const int *status_poll_mask = param;
2505
2506         cfi_info->status_poll_mask = *status_poll_mask;
2507 }
2508
2509
2510 static int cfi_query_string(struct flash_bank *bank, int address)
2511 {
2512         struct cfi_flash_bank *cfi_info = bank->driver_priv;
2513         int retval;
2514
2515         retval = cfi_send_command(bank, 0x98, cfi_flash_address(bank, 0, address));
2516         if (retval != ERROR_OK)
2517                 return retval;
2518
2519         retval = cfi_query_u8(bank, 0, 0x10, &cfi_info->qry[0]);
2520         if (retval != ERROR_OK)
2521                 return retval;
2522         retval = cfi_query_u8(bank, 0, 0x11, &cfi_info->qry[1]);
2523         if (retval != ERROR_OK)
2524                 return retval;
2525         retval = cfi_query_u8(bank, 0, 0x12, &cfi_info->qry[2]);
2526         if (retval != ERROR_OK)
2527                 return retval;
2528
2529         LOG_DEBUG("CFI qry returned: 0x%2.2x 0x%2.2x 0x%2.2x",
2530                 cfi_info->qry[0], cfi_info->qry[1], cfi_info->qry[2]);
2531
2532         if ((cfi_info->qry[0] != 'Q') || (cfi_info->qry[1] != 'R') || (cfi_info->qry[2] != 'Y')) {
2533                 retval = cfi_reset(bank);
2534                 if (retval != ERROR_OK)
2535                         return retval;
2536                 LOG_ERROR("Could not probe bank: no QRY");
2537                 return ERROR_FLASH_BANK_INVALID;
2538         }
2539
2540         return ERROR_OK;
2541 }
2542
2543 int cfi_probe(struct flash_bank *bank)
2544 {
2545         struct cfi_flash_bank *cfi_info = bank->driver_priv;
2546         struct target *target = bank->target;
2547         unsigned int num_sectors = 0;
2548         int sector = 0;
2549         uint32_t unlock1 = 0x555;
2550         uint32_t unlock2 = 0x2aa;
2551         int retval;
2552         uint8_t value_buf0[CFI_MAX_BUS_WIDTH], value_buf1[CFI_MAX_BUS_WIDTH];
2553
2554         if (bank->target->state != TARGET_HALTED) {
2555                 LOG_ERROR("Target not halted");
2556                 return ERROR_TARGET_NOT_HALTED;
2557         }
2558
2559         cfi_info->probed = false;
2560         cfi_info->num_erase_regions = 0;
2561
2562         free(bank->sectors);
2563         bank->sectors = NULL;
2564
2565         free(cfi_info->erase_region_info);
2566         cfi_info->erase_region_info = NULL;
2567
2568         /* JEDEC standard JESD21C uses 0x5555 and 0x2aaa as unlock addresses,
2569          * while CFI compatible AMD/Spansion flashes use 0x555 and 0x2aa
2570          */
2571         if (cfi_info->jedec_probe) {
2572                 unlock1 = 0x5555;
2573                 unlock2 = 0x2aaa;
2574         }
2575
2576         /* switch to read identifier codes mode ("AUTOSELECT") */
2577         retval = cfi_send_command(bank, 0xaa, cfi_flash_address(bank, 0, unlock1));
2578         if (retval != ERROR_OK)
2579                 return retval;
2580         retval = cfi_send_command(bank, 0x55, cfi_flash_address(bank, 0, unlock2));
2581         if (retval != ERROR_OK)
2582                 return retval;
2583         retval = cfi_send_command(bank, 0x90, cfi_flash_address(bank, 0, unlock1));
2584         if (retval != ERROR_OK)
2585                 return retval;
2586
2587         retval = cfi_target_read_memory(bank, cfi_flash_address(bank, 0, 0x00),
2588                                         1, value_buf0);
2589         if (retval != ERROR_OK)
2590                 return retval;
2591         retval = cfi_target_read_memory(bank, cfi_flash_address(bank, 0, 0x01),
2592                                         1, value_buf1);
2593         if (retval != ERROR_OK)
2594                 return retval;
2595         switch (bank->chip_width) {
2596                 case 1:
2597                         cfi_info->manufacturer = *value_buf0;
2598                         cfi_info->device_id = *value_buf1;
2599                         break;
2600                 case 2:
2601                         cfi_info->manufacturer = target_buffer_get_u16(target, value_buf0);
2602                         cfi_info->device_id = target_buffer_get_u16(target, value_buf1);
2603                         break;
2604                 case 4:
2605                         cfi_info->manufacturer = target_buffer_get_u32(target, value_buf0);
2606                         cfi_info->device_id = target_buffer_get_u32(target, value_buf1);
2607                         break;
2608                 default:
2609                         LOG_ERROR("Unsupported bank chipwidth %u, can't probe memory",
2610                                         bank->chip_width);
2611                         return ERROR_FLASH_OPERATION_FAILED;
2612         }
2613
2614         LOG_INFO("Flash Manufacturer/Device: 0x%04x 0x%04x",
2615                 cfi_info->manufacturer, cfi_info->device_id);
2616         /* switch back to read array mode */
2617         retval = cfi_reset(bank);
2618         if (retval != ERROR_OK)
2619                 return retval;
2620
2621         /* check device/manufacturer ID for known non-CFI flashes. */
2622         cfi_fixup_non_cfi(bank);
2623
2624         /* query only if this is a CFI compatible flash,
2625          * otherwise the relevant info has already been filled in
2626          */
2627         if (!cfi_info->not_cfi) {
2628                 /* enter CFI query mode
2629                  * according to JEDEC Standard No. 68.01,
2630                  * a single bus sequence with address = 0x55, data = 0x98 should put
2631                  * the device into CFI query mode.
2632                  *
2633                  * SST flashes clearly violate this, and we will consider them incompatible for now
2634                  */
2635
2636                 retval = cfi_query_string(bank, 0x55);
2637                 if (retval != ERROR_OK) {
2638                         /*
2639                          * Spansion S29WS-N CFI query fix is to try 0x555 if 0x55 fails. Should
2640                          * be harmless enough:
2641                          *
2642                          * http://www.infradead.org/pipermail/linux-mtd/2005-September/013618.html
2643                          */
2644                         LOG_USER("Try workaround w/0x555 instead of 0x55 to get QRY.");
2645                         retval = cfi_query_string(bank, 0x555);
2646                 }
2647                 if (retval != ERROR_OK)
2648                         return retval;
2649
2650                 retval = cfi_query_u16(bank, 0, 0x13, &cfi_info->pri_id);
2651                 if (retval != ERROR_OK)
2652                         return retval;
2653                 retval = cfi_query_u16(bank, 0, 0x15, &cfi_info->pri_addr);
2654                 if (retval != ERROR_OK)
2655                         return retval;
2656                 retval = cfi_query_u16(bank, 0, 0x17, &cfi_info->alt_id);
2657                 if (retval != ERROR_OK)
2658                         return retval;
2659                 retval = cfi_query_u16(bank, 0, 0x19, &cfi_info->alt_addr);
2660                 if (retval != ERROR_OK)
2661                         return retval;
2662
2663                 LOG_DEBUG("qry: '%c%c%c', pri_id: 0x%4.4x, pri_addr: 0x%4.4x, alt_id: "
2664                         "0x%4.4x, alt_addr: 0x%4.4x", cfi_info->qry[0], cfi_info->qry[1],
2665                         cfi_info->qry[2], cfi_info->pri_id, cfi_info->pri_addr,
2666                         cfi_info->alt_id, cfi_info->alt_addr);
2667
2668                 retval = cfi_query_u8(bank, 0, 0x1b, &cfi_info->vcc_min);
2669                 if (retval != ERROR_OK)
2670                         return retval;
2671                 retval = cfi_query_u8(bank, 0, 0x1c, &cfi_info->vcc_max);
2672                 if (retval != ERROR_OK)
2673                         return retval;
2674                 retval = cfi_query_u8(bank, 0, 0x1d, &cfi_info->vpp_min);
2675                 if (retval != ERROR_OK)
2676                         return retval;
2677                 retval = cfi_query_u8(bank, 0, 0x1e, &cfi_info->vpp_max);
2678                 if (retval != ERROR_OK)
2679                         return retval;
2680
2681                 retval = cfi_query_u8(bank, 0, 0x1f, &cfi_info->word_write_timeout_typ);
2682                 if (retval != ERROR_OK)
2683                         return retval;
2684                 retval = cfi_query_u8(bank, 0, 0x20, &cfi_info->buf_write_timeout_typ);
2685                 if (retval != ERROR_OK)
2686                         return retval;
2687                 retval = cfi_query_u8(bank, 0, 0x21, &cfi_info->block_erase_timeout_typ);
2688                 if (retval != ERROR_OK)
2689                         return retval;
2690                 retval = cfi_query_u8(bank, 0, 0x22, &cfi_info->chip_erase_timeout_typ);
2691                 if (retval != ERROR_OK)
2692                         return retval;
2693                 retval = cfi_query_u8(bank, 0, 0x23, &cfi_info->word_write_timeout_max);
2694                 if (retval != ERROR_OK)
2695                         return retval;
2696                 retval = cfi_query_u8(bank, 0, 0x24, &cfi_info->buf_write_timeout_max);
2697                 if (retval != ERROR_OK)
2698                         return retval;
2699                 retval = cfi_query_u8(bank, 0, 0x25, &cfi_info->block_erase_timeout_max);
2700                 if (retval != ERROR_OK)
2701                         return retval;
2702                 retval = cfi_query_u8(bank, 0, 0x26, &cfi_info->chip_erase_timeout_max);
2703                 if (retval != ERROR_OK)
2704                         return retval;
2705
2706                 uint8_t data;
2707                 retval = cfi_query_u8(bank, 0, 0x27, &data);
2708                 if (retval != ERROR_OK)
2709                         return retval;
2710                 cfi_info->dev_size = 1 << data;
2711
2712                 retval = cfi_query_u16(bank, 0, 0x28, &cfi_info->interface_desc);
2713                 if (retval != ERROR_OK)
2714                         return retval;
2715                 retval = cfi_query_u16(bank, 0, 0x2a, &cfi_info->max_buf_write_size);
2716                 if (retval != ERROR_OK)
2717                         return retval;
2718                 retval = cfi_query_u8(bank, 0, 0x2c, &cfi_info->num_erase_regions);
2719                 if (retval != ERROR_OK)
2720                         return retval;
2721
2722                 LOG_DEBUG("size: 0x%" PRIx32 ", interface desc: %i, max buffer write size: 0x%x",
2723                         cfi_info->dev_size, cfi_info->interface_desc,
2724                         (1 << cfi_info->max_buf_write_size));
2725
2726                 if (cfi_info->num_erase_regions) {
2727                         cfi_info->erase_region_info = malloc(sizeof(*cfi_info->erase_region_info)
2728                                         * cfi_info->num_erase_regions);
2729                         for (unsigned int i = 0; i < cfi_info->num_erase_regions; i++) {
2730                                 retval = cfi_query_u32(bank,
2731                                                 0,
2732                                                 0x2d + (4 * i),
2733                                                 &cfi_info->erase_region_info[i]);
2734                                 if (retval != ERROR_OK)
2735                                         return retval;
2736                                 LOG_DEBUG(
2737                                         "erase region[%i]: %" PRIu32 " blocks of size 0x%" PRIx32 "",
2738                                         i,
2739                                         (cfi_info->erase_region_info[i] & 0xffff) + 1,
2740                                         (cfi_info->erase_region_info[i] >> 16) * 256);
2741                         }
2742                 } else
2743                         cfi_info->erase_region_info = NULL;
2744
2745                 /* We need to read the primary algorithm extended query table before calculating
2746                  * the sector layout to be able to apply fixups
2747                  */
2748                 switch (cfi_info->pri_id) {
2749                         /* Intel command set (standard and extended) */
2750                         case 0x0001:
2751                         case 0x0003:
2752                                 cfi_read_intel_pri_ext(bank);
2753                                 break;
2754                         /* AMD/Spansion, Atmel, ... command set */
2755                         case 0x0002:
2756                                 cfi_info->status_poll_mask = CFI_STATUS_POLL_MASK_DQ5_DQ6_DQ7;  /*
2757                                                                                                  *default
2758                                                                                                  *for
2759                                                                                                  *all
2760                                                                                                  *CFI
2761                                                                                                  *flashes
2762                                                                                                  **/
2763                                 cfi_read_0002_pri_ext(bank);
2764                                 break;
2765                         default:
2766                                 LOG_ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
2767                                 break;
2768                 }
2769
2770                 /* return to read array mode
2771                  * we use both reset commands, as some Intel flashes fail to recognize the 0xF0 command
2772                  */
2773                 retval = cfi_reset(bank);
2774                 if (retval != ERROR_OK)
2775                         return retval;
2776         }       /* end CFI case */
2777
2778         LOG_DEBUG("Vcc min: %x.%x, Vcc max: %x.%x, Vpp min: %u.%x, Vpp max: %u.%x",
2779                 (cfi_info->vcc_min & 0xf0) >> 4, cfi_info->vcc_min & 0x0f,
2780                 (cfi_info->vcc_max & 0xf0) >> 4, cfi_info->vcc_max & 0x0f,
2781                 (cfi_info->vpp_min & 0xf0) >> 4, cfi_info->vpp_min & 0x0f,
2782                 (cfi_info->vpp_max & 0xf0) >> 4, cfi_info->vpp_max & 0x0f);
2783
2784         LOG_DEBUG("typ. word write timeout: %u us, typ. buf write timeout: %u us, "
2785                 "typ. block erase timeout: %u ms, typ. chip erase timeout: %u ms",
2786                 1 << cfi_info->word_write_timeout_typ, 1 << cfi_info->buf_write_timeout_typ,
2787                 1 << cfi_info->block_erase_timeout_typ, 1 << cfi_info->chip_erase_timeout_typ);
2788
2789         LOG_DEBUG("max. word write timeout: %u us, max. buf write timeout: %u us, "
2790                 "max. block erase timeout: %u ms, max. chip erase timeout: %u ms",
2791                 (1 << cfi_info->word_write_timeout_max) * (1 << cfi_info->word_write_timeout_typ),
2792                 (1 << cfi_info->buf_write_timeout_max) * (1 << cfi_info->buf_write_timeout_typ),
2793                 (1 << cfi_info->block_erase_timeout_max) * (1 << cfi_info->block_erase_timeout_typ),
2794                 (1 << cfi_info->chip_erase_timeout_max) * (1 << cfi_info->chip_erase_timeout_typ));
2795
2796         /* convert timeouts to real values in ms */
2797         cfi_info->word_write_timeout = DIV_ROUND_UP((1L << cfi_info->word_write_timeout_typ) *
2798                         (1L << cfi_info->word_write_timeout_max), 1000);
2799         cfi_info->buf_write_timeout = DIV_ROUND_UP((1L << cfi_info->buf_write_timeout_typ) *
2800                         (1L << cfi_info->buf_write_timeout_max), 1000);
2801         cfi_info->block_erase_timeout = (1L << cfi_info->block_erase_timeout_typ) *
2802                 (1L << cfi_info->block_erase_timeout_max);
2803         cfi_info->chip_erase_timeout = (1L << cfi_info->chip_erase_timeout_typ) *
2804                 (1L << cfi_info->chip_erase_timeout_max);
2805
2806         LOG_DEBUG("calculated word write timeout: %u ms, buf write timeout: %u ms, "
2807                 "block erase timeout: %u ms, chip erase timeout: %u ms",
2808                 cfi_info->word_write_timeout, cfi_info->buf_write_timeout,
2809                 cfi_info->block_erase_timeout, cfi_info->chip_erase_timeout);
2810
2811         /* apply fixups depending on the primary command set */
2812         switch (cfi_info->pri_id) {
2813                 /* Intel command set (standard and extended) */
2814                 case 0x0001:
2815                 case 0x0003:
2816                         cfi_fixup(bank, cfi_0001_fixups);
2817                         break;
2818                 /* AMD/Spansion, Atmel, ... command set */
2819                 case 0x0002:
2820                         cfi_fixup(bank, cfi_0002_fixups);
2821                         break;
2822                 default:
2823                         LOG_ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
2824                         break;
2825         }
2826
2827         if ((cfi_info->dev_size * bank->bus_width / bank->chip_width) != bank->size) {
2828                 LOG_WARNING("configuration specifies 0x%" PRIx32 " size, but a 0x%" PRIx32
2829                         " size flash was found", bank->size, cfi_info->dev_size);
2830         }
2831
2832         if (cfi_info->num_erase_regions == 0) {
2833                 /* a device might have only one erase block, spanning the whole device */
2834                 bank->num_sectors = 1;
2835                 bank->sectors = malloc(sizeof(struct flash_sector));
2836
2837                 bank->sectors[sector].offset = 0x0;
2838                 bank->sectors[sector].size = bank->size;
2839                 bank->sectors[sector].is_erased = -1;
2840                 bank->sectors[sector].is_protected = -1;
2841         } else {
2842                 uint32_t offset = 0;
2843
2844                 for (unsigned int i = 0; i < cfi_info->num_erase_regions; i++)
2845                         num_sectors += (cfi_info->erase_region_info[i] & 0xffff) + 1;
2846
2847                 bank->num_sectors = num_sectors;
2848                 bank->sectors = malloc(sizeof(struct flash_sector) * num_sectors);
2849
2850                 for (unsigned int i = 0; i < cfi_info->num_erase_regions; i++) {
2851                         for (uint32_t j = 0; j < (cfi_info->erase_region_info[i] & 0xffff) + 1; j++) {
2852                                 bank->sectors[sector].offset = offset;
2853                                 bank->sectors[sector].size =
2854                                         ((cfi_info->erase_region_info[i] >> 16) * 256)
2855                                         * bank->bus_width / bank->chip_width;
2856                                 offset += bank->sectors[sector].size;
2857                                 bank->sectors[sector].is_erased = -1;
2858                                 bank->sectors[sector].is_protected = -1;
2859                                 sector++;
2860                         }
2861                 }
2862                 if (offset != (cfi_info->dev_size * bank->bus_width / bank->chip_width)) {
2863                         LOG_WARNING(
2864                                 "CFI size is 0x%" PRIx32 ", but total sector size is 0x%" PRIx32 "",
2865                                 (cfi_info->dev_size * bank->bus_width / bank->chip_width),
2866                                 offset);
2867                 }
2868         }
2869
2870         cfi_info->probed = true;
2871
2872         return ERROR_OK;
2873 }
2874
2875 int cfi_auto_probe(struct flash_bank *bank)
2876 {
2877         struct cfi_flash_bank *cfi_info = bank->driver_priv;
2878         if (cfi_info->probed)
2879                 return ERROR_OK;
2880         return cfi_probe(bank);
2881 }
2882
2883 static int cfi_intel_protect_check(struct flash_bank *bank)
2884 {
2885         int retval;
2886         struct cfi_flash_bank *cfi_info = bank->driver_priv;
2887         struct cfi_intel_pri_ext *pri_ext = cfi_info->pri_ext;
2888
2889         /* check if block lock bits are supported on this device */
2890         if (!(pri_ext->blk_status_reg_mask & 0x1))
2891                 return ERROR_FLASH_OPERATION_FAILED;
2892
2893         retval = cfi_send_command(bank, 0x90, cfi_flash_address(bank, 0, 0x55));
2894         if (retval != ERROR_OK)
2895                 return retval;
2896
2897         for (unsigned int i = 0; i < bank->num_sectors; i++) {
2898                 uint8_t block_status;
2899                 retval = cfi_get_u8(bank, i, 0x2, &block_status);
2900                 if (retval != ERROR_OK)
2901                         return retval;
2902
2903                 if (block_status & 1)
2904                         bank->sectors[i].is_protected = 1;
2905                 else
2906                         bank->sectors[i].is_protected = 0;
2907         }
2908
2909         return cfi_send_command(bank, 0xff, cfi_flash_address(bank, 0, 0x0));
2910 }
2911
2912 static int cfi_spansion_protect_check(struct flash_bank *bank)
2913 {
2914         int retval;
2915         struct cfi_flash_bank *cfi_info = bank->driver_priv;
2916         struct cfi_spansion_pri_ext *pri_ext = cfi_info->pri_ext;
2917
2918         retval = cfi_spansion_unlock_seq(bank);
2919         if (retval != ERROR_OK)
2920                 return retval;
2921
2922         retval = cfi_send_command(bank, 0x90, cfi_flash_address(bank, 0, pri_ext->_unlock1));
2923         if (retval != ERROR_OK)
2924                 return retval;
2925
2926         for (unsigned int i = 0; i < bank->num_sectors; i++) {
2927                 uint8_t block_status;
2928                 retval = cfi_get_u8(bank, i, 0x2, &block_status);
2929                 if (retval != ERROR_OK)
2930                         return retval;
2931
2932                 if (block_status & 1)
2933                         bank->sectors[i].is_protected = 1;
2934                 else
2935                         bank->sectors[i].is_protected = 0;
2936         }
2937
2938         return cfi_send_command(bank, 0xf0, cfi_flash_address(bank, 0, 0x0));
2939 }
2940
2941 int cfi_protect_check(struct flash_bank *bank)
2942 {
2943         struct cfi_flash_bank *cfi_info = bank->driver_priv;
2944
2945         if (bank->target->state != TARGET_HALTED) {
2946                 LOG_ERROR("Target not halted");
2947                 return ERROR_TARGET_NOT_HALTED;
2948         }
2949
2950         if (cfi_info->qry[0] != 'Q')
2951                 return ERROR_FLASH_BANK_NOT_PROBED;
2952
2953         switch (cfi_info->pri_id) {
2954                 case 1:
2955                 case 3:
2956                         return cfi_intel_protect_check(bank);
2957                 case 2:
2958                         return cfi_spansion_protect_check(bank);
2959                 default:
2960                         LOG_ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
2961                         break;
2962         }
2963
2964         return ERROR_OK;
2965 }
2966
2967 int cfi_get_info(struct flash_bank *bank, struct command_invocation *cmd)
2968 {
2969         struct cfi_flash_bank *cfi_info = bank->driver_priv;
2970
2971         if (cfi_info->qry[0] == 0xff) {
2972                 command_print_sameline(cmd, "\ncfi flash bank not probed yet\n");
2973                 return ERROR_OK;
2974         }
2975
2976         if (!cfi_info->not_cfi)
2977                 command_print_sameline(cmd, "\nCFI flash: ");
2978         else
2979                 command_print_sameline(cmd, "\nnon-CFI flash: ");
2980
2981         command_print_sameline(cmd, "mfr: 0x%4.4x, id:0x%4.4x\n",
2982                         cfi_info->manufacturer, cfi_info->device_id);
2983
2984         command_print_sameline(cmd, "qry: '%c%c%c', pri_id: 0x%4.4x, pri_addr: "
2985                         "0x%4.4x, alt_id: 0x%4.4x, alt_addr: 0x%4.4x\n",
2986                         cfi_info->qry[0], cfi_info->qry[1], cfi_info->qry[2],
2987                         cfi_info->pri_id, cfi_info->pri_addr, cfi_info->alt_id, cfi_info->alt_addr);
2988
2989         command_print_sameline(cmd, "Vcc min: %x.%x, Vcc max: %x.%x, "
2990                         "Vpp min: %u.%x, Vpp max: %u.%x\n",
2991                         (cfi_info->vcc_min & 0xf0) >> 4, cfi_info->vcc_min & 0x0f,
2992                         (cfi_info->vcc_max & 0xf0) >> 4, cfi_info->vcc_max & 0x0f,
2993                         (cfi_info->vpp_min & 0xf0) >> 4, cfi_info->vpp_min & 0x0f,
2994                         (cfi_info->vpp_max & 0xf0) >> 4, cfi_info->vpp_max & 0x0f);
2995
2996         command_print_sameline(cmd, "typ. word write timeout: %u us, "
2997                         "typ. buf write timeout: %u us, "
2998                         "typ. block erase timeout: %u ms, "
2999                         "typ. chip erase timeout: %u ms\n",
3000                         1 << cfi_info->word_write_timeout_typ,
3001                         1 << cfi_info->buf_write_timeout_typ,
3002                         1 << cfi_info->block_erase_timeout_typ,
3003                         1 << cfi_info->chip_erase_timeout_typ);
3004
3005         command_print_sameline(cmd, "max. word write timeout: %u us, "
3006                         "max. buf write timeout: %u us, max. "
3007                         "block erase timeout: %u ms, max. chip erase timeout: %u ms\n",
3008                         (1 <<
3009                          cfi_info->word_write_timeout_max) * (1 << cfi_info->word_write_timeout_typ),
3010                         (1 <<
3011                          cfi_info->buf_write_timeout_max) * (1 << cfi_info->buf_write_timeout_typ),
3012                         (1 <<
3013                          cfi_info->block_erase_timeout_max) *
3014                         (1 << cfi_info->block_erase_timeout_typ),
3015                         (1 <<
3016                          cfi_info->chip_erase_timeout_max) *
3017                         (1 << cfi_info->chip_erase_timeout_typ));
3018
3019         command_print_sameline(cmd, "size: 0x%" PRIx32 ", interface desc: %i, "
3020                         "max buffer write size: 0x%x\n",
3021                         cfi_info->dev_size,
3022                         cfi_info->interface_desc,
3023                         1 << cfi_info->max_buf_write_size);
3024
3025         switch (cfi_info->pri_id) {
3026             case 1:
3027             case 3:
3028                     cfi_intel_info(bank, cmd);
3029                     break;
3030             case 2:
3031                     cfi_spansion_info(bank, cmd);
3032                     break;
3033             default:
3034                     LOG_ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
3035                     break;
3036         }
3037
3038         return ERROR_OK;
3039 }
3040
3041 static void cfi_fixup_0002_write_buffer(struct flash_bank *bank, const void *param)
3042 {
3043         struct cfi_flash_bank *cfi_info = bank->driver_priv;
3044
3045         /* disable write buffer for M29W128G */
3046         cfi_info->buf_write_timeout_typ = 0;
3047 }
3048
3049 const struct flash_driver cfi_flash = {
3050         .name = "cfi",
3051         .flash_bank_command = cfi_flash_bank_command,
3052         .erase = cfi_erase,
3053         .protect = cfi_protect,
3054         .write = cfi_write,
3055         .read = cfi_read,
3056         .probe = cfi_probe,
3057         .auto_probe = cfi_auto_probe,
3058         /* FIXME: access flash at bus_width size */
3059         .erase_check = default_flash_blank_check,
3060         .protect_check = cfi_protect_check,
3061         .info = cfi_get_info,
3062         .free_driver_priv = default_flash_free_driver_priv,
3063 };