1 /***************************************************************************
2 * Copyright (C) 2009 by *
3 * Rolf Meeser <rolfm_9dq@yahoo.de> *
5 * This program is free software; you can redistribute it and/or modify *
6 * it under the terms of the GNU General Public License as published by *
7 * the Free Software Foundation; either version 2 of the License, or *
8 * (at your option) any later version. *
10 * This program is distributed in the hope that it will be useful, *
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
13 * GNU General Public License for more details. *
15 * You should have received a copy of the GNU General Public License *
16 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
17 ***************************************************************************/
24 #include <helper/binarybuffer.h>
25 #include <target/algorithm.h>
26 #include <target/arm.h>
27 #include <target/image.h>
32 /* Some flash constants */
33 #define FLASH_PAGE_SIZE 512 /* bytes */
34 #define FLASH_ERASE_TIME 100000 /* microseconds */
35 #define FLASH_PROGRAM_TIME 1000 /* microseconds */
37 /* Chip ID / Feature Registers */
38 #define CHIPID 0xE0000000 /* Chip ID */
39 #define FEAT0 0xE0000100 /* Chip feature 0 */
40 #define FEAT1 0xE0000104 /* Chip feature 1 */
41 #define FEAT2 0xE0000108 /* Chip feature 2 (contains flash size indicator) */
42 #define FEAT3 0xE000010C /* Chip feature 3 */
44 #define EXPECTED_CHIPID 0x209CE02B /* Chip ID of all LPC2900 devices */
46 /* Flash/EEPROM Control Registers */
47 #define FCTR 0x20200000 /* Flash control */
48 #define FPTR 0x20200008 /* Flash program-time */
49 #define FTCTR 0x2020000C /* Flash test control */
50 #define FBWST 0x20200010 /* Flash bridge wait-state */
51 #define FCRA 0x2020001C /* Flash clock divider */
52 #define FMSSTART 0x20200020 /* Flash Built-In Self Test start address */
53 #define FMSSTOP 0x20200024 /* Flash Built-In Self Test stop address */
54 #define FMS16 0x20200028 /* Flash 16-bit signature */
55 #define FMSW0 0x2020002C /* Flash 128-bit signature Word 0 */
56 #define FMSW1 0x20200030 /* Flash 128-bit signature Word 1 */
57 #define FMSW2 0x20200034 /* Flash 128-bit signature Word 2 */
58 #define FMSW3 0x20200038 /* Flash 128-bit signature Word 3 */
60 #define EECMD 0x20200080 /* EEPROM command */
61 #define EEADDR 0x20200084 /* EEPROM address */
62 #define EEWDATA 0x20200088 /* EEPROM write data */
63 #define EERDATA 0x2020008C /* EEPROM read data */
64 #define EEWSTATE 0x20200090 /* EEPROM wait state */
65 #define EECLKDIV 0x20200094 /* EEPROM clock divider */
66 #define EEPWRDWN 0x20200098 /* EEPROM power-down/start */
67 #define EEMSSTART 0x2020009C /* EEPROM BIST start address */
68 #define EEMSSTOP 0x202000A0 /* EEPROM BIST stop address */
69 #define EEMSSIG 0x202000A4 /* EEPROM 24-bit BIST signature */
71 #define INT_CLR_ENABLE 0x20200FD8 /* Flash/EEPROM interrupt clear enable */
72 #define INT_SET_ENABLE 0x20200FDC /* Flash/EEPROM interrupt set enable */
73 #define INT_STATUS 0x20200FE0 /* Flash/EEPROM interrupt status */
74 #define INT_ENABLE 0x20200FE4 /* Flash/EEPROM interrupt enable */
75 #define INT_CLR_STATUS 0x20200FE8 /* Flash/EEPROM interrupt clear status */
76 #define INT_SET_STATUS 0x20200FEC /* Flash/EEPROM interrupt set status */
78 /* Interrupt sources */
79 #define INTSRC_END_OF_PROG (1 << 28)
80 #define INTSRC_END_OF_BIST (1 << 27)
81 #define INTSRC_END_OF_RDWR (1 << 26)
82 #define INTSRC_END_OF_MISR (1 << 2)
83 #define INTSRC_END_OF_BURN (1 << 1)
84 #define INTSRC_END_OF_ERASE (1 << 0)
87 #define FCTR_FS_LOADREQ (1 << 15)
88 #define FCTR_FS_CACHECLR (1 << 14)
89 #define FCTR_FS_CACHEBYP (1 << 13)
90 #define FCTR_FS_PROGREQ (1 << 12)
91 #define FCTR_FS_RLS (1 << 11)
92 #define FCTR_FS_PDL (1 << 10)
93 #define FCTR_FS_PD (1 << 9)
94 #define FCTR_FS_WPB (1 << 7)
95 #define FCTR_FS_ISS (1 << 6)
96 #define FCTR_FS_RLD (1 << 5)
97 #define FCTR_FS_DCR (1 << 4)
98 #define FCTR_FS_WEB (1 << 2)
99 #define FCTR_FS_WRE (1 << 1)
100 #define FCTR_FS_CS (1 << 0)
102 #define FPTR_EN_T (1 << 15)
104 #define FTCTR_FS_BYPASS_R (1 << 29)
105 #define FTCTR_FS_BYPASS_W (1 << 28)
107 #define FMSSTOP_MISR_START (1 << 17)
109 #define EEMSSTOP_STRTBIST (1 << 31)
112 #define ISS_CUSTOMER_START1 (0x830)
113 #define ISS_CUSTOMER_END1 (0xA00)
114 #define ISS_CUSTOMER_SIZE1 (ISS_CUSTOMER_END1 - ISS_CUSTOMER_START1)
115 #define ISS_CUSTOMER_NWORDS1 (ISS_CUSTOMER_SIZE1 / 4)
116 #define ISS_CUSTOMER_START2 (0xA40)
117 #define ISS_CUSTOMER_END2 (0xC00)
118 #define ISS_CUSTOMER_SIZE2 (ISS_CUSTOMER_END2 - ISS_CUSTOMER_START2)
119 #define ISS_CUSTOMER_NWORDS2 (ISS_CUSTOMER_SIZE2 / 4)
120 #define ISS_CUSTOMER_SIZE (ISS_CUSTOMER_SIZE1 + ISS_CUSTOMER_SIZE2)
123 * Private data for \c lpc2900 flash driver.
125 struct lpc2900_flash_bank {
127 * This flag is set when the device has been successfully probed.
132 * Holds the value read from CHIPID register.
133 * The driver will not load if the chipid doesn't match the expected
134 * value of 0x209CE02B of the LPC2900 family. A probe will only be done
135 * if the chipid does not yet contain the expected value.
140 * String holding device name.
141 * This string is set by the probe function to the type number of the
142 * device. It takes the form "LPC29xx".
147 * System clock frequency.
148 * Holds the clock frequency in Hz, as passed by the configuration file
149 * to the <tt>flash bank</tt> command.
151 uint32_t clk_sys_fmc;
154 * Flag to indicate that dangerous operations are possible.
155 * This flag can be set by passing the correct password to the
156 * <tt>lpc2900 password</tt> command. If set, other dangerous commands,
157 * which operate on the index sector, can be executed.
162 * Maximum contiguous block of internal SRAM (bytes).
163 * Autodetected by the driver. Not the total amount of SRAM, only
164 * the largest \em contiguous block!
166 uint32_t max_ram_block;
170 static uint32_t lpc2900_wait_status(struct flash_bank *bank, uint32_t mask, int timeout);
171 static void lpc2900_setup(struct flash_bank *bank);
172 static uint32_t lpc2900_is_ready(struct flash_bank *bank);
173 static uint32_t lpc2900_read_security_status(struct flash_bank *bank);
174 static uint32_t lpc2900_run_bist128(struct flash_bank *bank,
175 uint32_t addr_from, uint32_t addr_to,
176 uint32_t signature[4]);
177 static unsigned int lpc2900_address2sector(struct flash_bank *bank, uint32_t offset);
178 static uint32_t lpc2900_calc_tr(uint32_t clock_var, uint32_t time_var);
180 /*********************** Helper functions **************************/
183 * Wait for an event in mask to occur in INT_STATUS.
185 * Return when an event occurs, or after a timeout.
187 * @param[in] bank Pointer to the flash bank descriptor
188 * @param[in] mask Mask to be used for INT_STATUS
189 * @param[in] timeout Timeout in ms
191 static uint32_t lpc2900_wait_status(struct flash_bank *bank,
196 struct target *target = bank->target;
201 target_read_u32(target, INT_STATUS, &int_status);
202 } while (((int_status & mask) == 0) && (timeout != 0));
205 LOG_DEBUG("Timeout!");
206 return ERROR_FLASH_OPERATION_FAILED;
213 * Set up the flash for erase/program operations.
215 * Enable the flash, and set the correct CRA clock of 66 kHz.
217 * @param bank Pointer to the flash bank descriptor
219 static void lpc2900_setup(struct flash_bank *bank)
222 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
224 /* Power up the flash block */
225 target_write_u32(bank->target, FCTR, FCTR_FS_WEB | FCTR_FS_CS);
227 fcra = (lpc2900_info->clk_sys_fmc / (3 * 66000)) - 1;
228 target_write_u32(bank->target, FCRA, fcra);
232 * Check if device is ready.
234 * Check if device is ready for flash operation:
235 * Must have been successfully probed.
238 static uint32_t lpc2900_is_ready(struct flash_bank *bank)
240 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
242 if (!lpc2900_info->is_probed)
243 return ERROR_FLASH_BANK_NOT_PROBED;
245 if (bank->target->state != TARGET_HALTED) {
246 LOG_ERROR("Target not halted");
247 return ERROR_TARGET_NOT_HALTED;
254 * Read the status of sector security from the index sector.
256 * @param bank Pointer to the flash bank descriptor
258 static uint32_t lpc2900_read_security_status(struct flash_bank *bank)
260 uint32_t status = lpc2900_is_ready(bank);
261 if (status != ERROR_OK)
264 struct target *target = bank->target;
266 /* Enable ISS access */
267 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB | FCTR_FS_ISS);
269 /* Read the relevant block of memory from the ISS sector */
270 uint32_t iss_secured_field[0x230/16][4];
271 target_read_memory(target, bank->base + 0xC00, 4, 0x230/4,
272 (uint8_t *)iss_secured_field);
274 /* Disable ISS access */
275 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
277 /* Check status of each sector. Note that the sector numbering in the LPC2900
278 * is different from the logical sector numbers used in OpenOCD!
279 * Refer to the user manual for details.
281 * All zeros (16x 0x00) are treated as a secured sector (is_protected = 1)
282 * All ones (16x 0xFF) are treated as a non-secured sector (is_protected = 0)
283 * Anything else is undefined (is_protected = -1). This is treated as
284 * a protected sector!
286 for (unsigned int sector = 0; sector < bank->num_sectors; sector++) {
287 unsigned int index_t;
289 /* Convert logical sector number to physical sector number */
291 index_t = sector + 11;
292 else if (sector <= 7)
293 index_t = sector + 27;
295 index_t = sector - 8;
297 bank->sectors[sector].is_protected = -1;
299 if ((iss_secured_field[index_t][0] == 0x00000000) &&
300 (iss_secured_field[index_t][1] == 0x00000000) &&
301 (iss_secured_field[index_t][2] == 0x00000000) &&
302 (iss_secured_field[index_t][3] == 0x00000000))
303 bank->sectors[sector].is_protected = 1;
305 if ((iss_secured_field[index_t][0] == 0xFFFFFFFF) &&
306 (iss_secured_field[index_t][1] == 0xFFFFFFFF) &&
307 (iss_secured_field[index_t][2] == 0xFFFFFFFF) &&
308 (iss_secured_field[index_t][3] == 0xFFFFFFFF))
309 bank->sectors[sector].is_protected = 0;
316 * Use BIST to calculate a 128-bit hash value over a range of flash.
318 * @param bank Pointer to the flash bank descriptor
323 static uint32_t lpc2900_run_bist128(struct flash_bank *bank,
326 uint32_t signature[4])
328 struct target *target = bank->target;
330 /* Clear END_OF_MISR interrupt status */
331 target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_MISR);
334 target_write_u32(target, FMSSTART, addr_from >> 4);
335 /* End address, and issue start command */
336 target_write_u32(target, FMSSTOP, (addr_to >> 4) | FMSSTOP_MISR_START);
338 /* Poll for end of operation. Calculate a reasonable timeout. */
339 if (lpc2900_wait_status(bank, INTSRC_END_OF_MISR, 1000) != ERROR_OK)
340 return ERROR_FLASH_OPERATION_FAILED;
342 /* Return the signature */
343 uint8_t sig_buf[4 * 4];
344 target_read_memory(target, FMSW0, 4, 4, sig_buf);
345 target_buffer_get_u32_array(target, sig_buf, 4, signature);
351 * Return sector number for given address.
353 * Return the (logical) sector number for a given relative address.
354 * No sanity check is done. It assumed that the address is valid.
356 * @param bank Pointer to the flash bank descriptor
357 * @param offset Offset address relative to bank start
359 static unsigned int lpc2900_address2sector(struct flash_bank *bank,
362 uint32_t address = bank->base + offset;
364 /* Run through all sectors of this bank */
365 for (unsigned int sector = 0; sector < bank->num_sectors; sector++) {
366 /* Return immediately if address is within the current sector */
367 if (address < (bank->sectors[sector].offset + bank->sectors[sector].size))
371 /* We should never come here. If we do, return an arbitrary sector number. */
376 * Write one page to the index sector.
378 * @param bank Pointer to the flash bank descriptor
379 * @param pagenum Page number (0...7)
380 * @param page Page array (FLASH_PAGE_SIZE bytes)
382 static int lpc2900_write_index_page(struct flash_bank *bank,
384 uint8_t page[FLASH_PAGE_SIZE])
386 /* Only pages 4...7 are user writable */
387 if ((pagenum < 4) || (pagenum > 7)) {
388 LOG_ERROR("Refuse to burn index sector page %d", pagenum);
389 return ERROR_COMMAND_ARGUMENT_INVALID;
392 /* Get target, and check if it's halted */
393 struct target *target = bank->target;
394 if (target->state != TARGET_HALTED) {
395 LOG_ERROR("Target not halted");
396 return ERROR_TARGET_NOT_HALTED;
400 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
402 /* Enable flash block and set the correct CRA clock of 66 kHz */
405 /* Un-protect the index sector */
406 target_write_u32(target, bank->base, 0);
407 target_write_u32(target, FCTR,
408 FCTR_FS_LOADREQ | FCTR_FS_WPB | FCTR_FS_ISS |
409 FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
411 /* Set latch load mode */
412 target_write_u32(target, FCTR,
413 FCTR_FS_ISS | FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
415 /* Write whole page to flash data latches */
416 if (target_write_memory(target,
417 bank->base + pagenum * FLASH_PAGE_SIZE,
418 4, FLASH_PAGE_SIZE / 4, page) != ERROR_OK) {
419 LOG_ERROR("Index sector write failed @ page %d", pagenum);
420 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
422 return ERROR_FLASH_OPERATION_FAILED;
425 /* Clear END_OF_BURN interrupt status */
426 target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_BURN);
428 /* Set the program/erase time to FLASH_PROGRAM_TIME */
429 target_write_u32(target, FPTR,
430 FPTR_EN_T | lpc2900_calc_tr(lpc2900_info->clk_sys_fmc,
431 FLASH_PROGRAM_TIME));
433 /* Trigger flash write */
434 target_write_u32(target, FCTR,
435 FCTR_FS_PROGREQ | FCTR_FS_ISS |
436 FCTR_FS_WPB | FCTR_FS_WRE | FCTR_FS_CS);
438 /* Wait for the end of the write operation. If it's not over after one
439 * second, something went dreadfully wrong... :-(
441 if (lpc2900_wait_status(bank, INTSRC_END_OF_BURN, 1000) != ERROR_OK) {
442 LOG_ERROR("Index sector write failed @ page %d", pagenum);
443 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
445 return ERROR_FLASH_OPERATION_FAILED;
448 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
454 * Calculate FPTR.TR register value for desired program/erase time.
456 * @param clock_var System clock in Hz
457 * @param time_var Program/erase time in µs
459 static uint32_t lpc2900_calc_tr(uint32_t clock_var, uint32_t time_var)
461 /* ((time[µs]/1e6) * f[Hz]) + 511
462 * FPTR.TR = -------------------------------
466 uint32_t tr_val = (uint32_t)((((time_var / 1e6) * clock_var) + 511.0) / 512.0);
471 /*********************** Private flash commands **************************/
475 * Command to determine the signature of the whole flash.
477 * Uses the Built-In-Self-Test (BIST) to generate a 128-bit hash value
478 * of the flash content.
480 COMMAND_HANDLER(lpc2900_handle_signature_command)
483 uint32_t signature[4];
486 return ERROR_COMMAND_SYNTAX_ERROR;
488 struct flash_bank *bank;
489 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
490 if (retval != ERROR_OK)
493 if (bank->target->state != TARGET_HALTED) {
494 LOG_ERROR("Target not halted");
495 return ERROR_TARGET_NOT_HALTED;
498 /* Run BIST over whole flash range */
499 status = lpc2900_run_bist128(bank, bank->base, bank->base + (bank->size - 1), signature);
500 if (status != ERROR_OK)
503 command_print(CMD, "signature: 0x%8.8" PRIx32
507 signature[3], signature[2], signature[1], signature[0]);
513 * Store customer info in file.
515 * Read customer info from index sector, and store that block of data into
516 * a disk file. The format is binary.
518 COMMAND_HANDLER(lpc2900_handle_read_custom_command)
521 return ERROR_COMMAND_SYNTAX_ERROR;
523 struct flash_bank *bank;
524 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
525 if (retval != ERROR_OK)
528 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
529 lpc2900_info->risky = 0;
531 /* Get target, and check if it's halted */
532 struct target *target = bank->target;
533 if (target->state != TARGET_HALTED) {
534 LOG_ERROR("Target not halted");
535 return ERROR_TARGET_NOT_HALTED;
538 /* Storage for customer info. Read in two parts */
539 uint8_t customer[4 * (ISS_CUSTOMER_NWORDS1 + ISS_CUSTOMER_NWORDS2)];
541 /* Enable access to index sector */
542 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB | FCTR_FS_ISS);
545 target_read_memory(target, bank->base+ISS_CUSTOMER_START1, 4,
546 ISS_CUSTOMER_NWORDS1,
548 target_read_memory(target, bank->base+ISS_CUSTOMER_START2, 4,
549 ISS_CUSTOMER_NWORDS2,
550 &customer[4 * ISS_CUSTOMER_NWORDS1]);
552 /* Deactivate access to index sector */
553 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
555 /* Try and open the file */
556 struct fileio *fileio;
557 const char *filename = CMD_ARGV[1];
558 int ret = fileio_open(&fileio, filename, FILEIO_WRITE, FILEIO_BINARY);
559 if (ret != ERROR_OK) {
560 LOG_WARNING("Could not open file %s", filename);
565 ret = fileio_write(fileio, sizeof(customer), customer, &nwritten);
566 if (ret != ERROR_OK) {
567 LOG_ERROR("Write operation to file %s failed", filename);
568 fileio_close(fileio);
572 fileio_close(fileio);
578 * Enter password to enable potentially dangerous options.
580 COMMAND_HANDLER(lpc2900_handle_password_command)
583 return ERROR_COMMAND_SYNTAX_ERROR;
585 struct flash_bank *bank;
586 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
587 if (retval != ERROR_OK)
590 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
592 #define ISS_PASSWORD "I_know_what_I_am_doing"
594 lpc2900_info->risky = !strcmp(CMD_ARGV[1], ISS_PASSWORD);
596 if (!lpc2900_info->risky) {
597 command_print(CMD, "Wrong password (use '%s')", ISS_PASSWORD);
598 return ERROR_COMMAND_ARGUMENT_INVALID;
602 "Potentially dangerous operation allowed in next command!");
608 * Write customer info from file to the index sector.
610 COMMAND_HANDLER(lpc2900_handle_write_custom_command)
613 return ERROR_COMMAND_SYNTAX_ERROR;
615 struct flash_bank *bank;
616 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
617 if (retval != ERROR_OK)
620 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
622 /* Check if command execution is allowed. */
623 if (!lpc2900_info->risky) {
624 command_print(CMD, "Command execution not allowed!");
625 return ERROR_COMMAND_ARGUMENT_INVALID;
627 lpc2900_info->risky = 0;
629 /* Get target, and check if it's halted */
630 struct target *target = bank->target;
631 if (target->state != TARGET_HALTED) {
632 LOG_ERROR("Target not halted");
633 return ERROR_TARGET_NOT_HALTED;
636 /* The image will always start at offset 0 */
638 image.base_address_set = true;
639 image.base_address = 0;
640 image.start_address_set = false;
642 const char *filename = CMD_ARGV[1];
643 const char *type = (CMD_ARGC >= 3) ? CMD_ARGV[2] : NULL;
644 retval = image_open(&image, filename, type);
645 if (retval != ERROR_OK)
648 /* Do a sanity check: The image must be exactly the size of the customer
649 programmable area. Any other size is rejected. */
650 if (image.num_sections != 1) {
651 LOG_ERROR("Only one section allowed in image file.");
652 return ERROR_COMMAND_SYNTAX_ERROR;
654 if ((image.sections[0].base_address != 0) ||
655 (image.sections[0].size != ISS_CUSTOMER_SIZE)) {
656 LOG_ERROR("Incorrect image file size. Expected %d, "
658 ISS_CUSTOMER_SIZE, image.sections[0].size);
659 return ERROR_COMMAND_SYNTAX_ERROR;
662 /* Well boys, I reckon this is it... */
664 /* Customer info is split into two blocks in pages 4 and 5. */
665 uint8_t page[FLASH_PAGE_SIZE];
668 uint32_t offset = ISS_CUSTOMER_START1 % FLASH_PAGE_SIZE;
669 memset(page, 0xff, FLASH_PAGE_SIZE);
671 retval = image_read_section(&image, 0, 0,
672 ISS_CUSTOMER_SIZE1, &page[offset], &size_read);
673 if (retval != ERROR_OK) {
674 LOG_ERROR("couldn't read from file '%s'", filename);
678 retval = lpc2900_write_index_page(bank, 4, page);
679 if (retval != ERROR_OK) {
685 offset = ISS_CUSTOMER_START2 % FLASH_PAGE_SIZE;
686 memset(page, 0xff, FLASH_PAGE_SIZE);
687 retval = image_read_section(&image, 0, ISS_CUSTOMER_SIZE1,
688 ISS_CUSTOMER_SIZE2, &page[offset], &size_read);
689 if (retval != ERROR_OK) {
690 LOG_ERROR("couldn't read from file '%s'", filename);
694 retval = lpc2900_write_index_page(bank, 5, page);
695 if (retval != ERROR_OK) {
706 * Activate 'sector security' for a range of sectors.
708 COMMAND_HANDLER(lpc2900_handle_secure_sector_command)
711 return ERROR_COMMAND_SYNTAX_ERROR;
713 /* Get the bank descriptor */
714 struct flash_bank *bank;
715 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
716 if (retval != ERROR_OK)
719 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
721 /* Check if command execution is allowed. */
722 if (!lpc2900_info->risky) {
723 command_print(CMD, "Command execution not allowed! "
724 "(use 'password' command first)");
725 return ERROR_COMMAND_ARGUMENT_INVALID;
727 lpc2900_info->risky = 0;
729 /* Read sector range, and do a sanity check. */
730 unsigned int first, last;
731 COMMAND_PARSE_NUMBER(uint, CMD_ARGV[1], first);
732 COMMAND_PARSE_NUMBER(uint, CMD_ARGV[2], last);
733 if ((first >= bank->num_sectors) ||
734 (last >= bank->num_sectors) ||
736 command_print(CMD, "Illegal sector range");
737 return ERROR_COMMAND_ARGUMENT_INVALID;
740 uint8_t page[FLASH_PAGE_SIZE];
742 /* Sectors in page 6 */
743 if ((first <= 4) || (last >= 8)) {
744 memset(&page, 0xff, FLASH_PAGE_SIZE);
745 for (unsigned int sector = first; sector <= last; sector++) {
747 memset(&page[0xB0 + 16*sector], 0, 16);
748 else if (sector >= 8)
749 memset(&page[0x00 + 16*(sector - 8)], 0, 16);
752 retval = lpc2900_write_index_page(bank, 6, page);
753 if (retval != ERROR_OK) {
754 LOG_ERROR("failed to update index sector page 6");
759 /* Sectors in page 7 */
760 if ((first <= 7) && (last >= 5)) {
761 memset(&page, 0xff, FLASH_PAGE_SIZE);
762 for (unsigned int sector = first; sector <= last; sector++) {
763 if ((sector >= 5) && (sector <= 7))
764 memset(&page[0x00 + 16*(sector - 5)], 0, 16);
767 retval = lpc2900_write_index_page(bank, 7, page);
768 if (retval != ERROR_OK) {
769 LOG_ERROR("failed to update index sector page 7");
775 "Sectors security will become effective after next power cycle");
777 /* Update the sector security status */
778 if (lpc2900_read_security_status(bank) != ERROR_OK) {
779 LOG_ERROR("Cannot determine sector security status");
780 return ERROR_FLASH_OPERATION_FAILED;
787 * Activate JTAG protection.
789 COMMAND_HANDLER(lpc2900_handle_secure_jtag_command)
792 return ERROR_COMMAND_SYNTAX_ERROR;
794 /* Get the bank descriptor */
795 struct flash_bank *bank;
796 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
797 if (retval != ERROR_OK)
800 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
802 /* Check if command execution is allowed. */
803 if (!lpc2900_info->risky) {
804 command_print(CMD, "Command execution not allowed! "
805 "(use 'password' command first)");
806 return ERROR_COMMAND_ARGUMENT_INVALID;
808 lpc2900_info->risky = 0;
811 uint8_t page[FLASH_PAGE_SIZE];
812 memset(&page, 0xff, FLASH_PAGE_SIZE);
815 /* Insert "soft" protection word */
816 page[0x30 + 15] = 0x7F;
817 page[0x30 + 11] = 0x7F;
818 page[0x30 + 7] = 0x7F;
819 page[0x30 + 3] = 0x7F;
821 /* Write to page 5 */
822 retval = lpc2900_write_index_page(bank, 5, page);
823 if (retval != ERROR_OK) {
824 LOG_ERROR("failed to update index sector page 5");
828 LOG_INFO("JTAG security set. Good bye!");
833 /*********************** Flash interface functions **************************/
835 static const struct command_registration lpc2900_exec_command_handlers[] = {
839 .handler = lpc2900_handle_signature_command,
840 .mode = COMMAND_EXEC,
841 .help = "Calculate and display signature of flash bank.",
844 .name = "read_custom",
845 .handler = lpc2900_handle_read_custom_command,
846 .mode = COMMAND_EXEC,
847 .usage = "bank_id filename",
848 .help = "Copies 912 bytes of customer information "
849 "from index sector into file.",
853 .handler = lpc2900_handle_password_command,
854 .mode = COMMAND_EXEC,
855 .usage = "bank_id password",
856 .help = "Enter fixed password to enable 'dangerous' options.",
859 .name = "write_custom",
860 .handler = lpc2900_handle_write_custom_command,
861 .mode = COMMAND_EXEC,
862 .usage = "bank_id filename ('bin'|'ihex'|'elf'|'s19')",
863 .help = "Copies 912 bytes of customer info from file "
867 .name = "secure_sector",
868 .handler = lpc2900_handle_secure_sector_command,
869 .mode = COMMAND_EXEC,
870 .usage = "bank_id first_sector last_sector",
871 .help = "Activate sector security for a range of sectors. "
872 "It will be effective after a power cycle.",
875 .name = "secure_jtag",
876 .handler = lpc2900_handle_secure_jtag_command,
877 .mode = COMMAND_EXEC,
879 .help = "Disable the JTAG port. "
880 "It will be effective after a power cycle.",
882 COMMAND_REGISTRATION_DONE
885 static const struct command_registration lpc2900_command_handlers[] = {
889 .help = "LPC2900 flash command group",
891 .chain = lpc2900_exec_command_handlers,
893 COMMAND_REGISTRATION_DONE
896 /** Evaluate flash bank command. */
897 FLASH_BANK_COMMAND_HANDLER(lpc2900_flash_bank_command)
899 struct lpc2900_flash_bank *lpc2900_info;
902 return ERROR_COMMAND_SYNTAX_ERROR;
904 lpc2900_info = malloc(sizeof(struct lpc2900_flash_bank));
905 bank->driver_priv = lpc2900_info;
908 * Reject it if we can't meet the requirements for program time
909 * (if clock too slow), or for erase time (clock too fast).
911 uint32_t clk_sys_fmc;
912 COMMAND_PARSE_NUMBER(u32, CMD_ARGV[6], clk_sys_fmc);
913 lpc2900_info->clk_sys_fmc = clk_sys_fmc * 1000;
915 uint32_t clock_limit;
916 /* Check program time limit */
917 clock_limit = 512000000l / FLASH_PROGRAM_TIME;
918 if (lpc2900_info->clk_sys_fmc < clock_limit) {
919 LOG_WARNING("flash clock must be at least %" PRIu32 " kHz",
920 (clock_limit / 1000));
921 return ERROR_FLASH_BANK_INVALID;
924 /* Check erase time limit */
925 clock_limit = (uint32_t)((32767.0 * 512.0 * 1e6) / FLASH_ERASE_TIME);
926 if (lpc2900_info->clk_sys_fmc > clock_limit) {
927 LOG_WARNING("flash clock must be a maximum of %" PRIu32 " kHz",
928 (clock_limit / 1000));
929 return ERROR_FLASH_BANK_INVALID;
932 /* Chip ID will be obtained by probing the device later */
933 lpc2900_info->chipid = 0;
934 lpc2900_info->is_probed = false;
942 * @param bank Pointer to the flash bank descriptor
943 * @param first First sector to be erased
944 * @param last Last sector (including) to be erased
946 static int lpc2900_erase(struct flash_bank *bank, unsigned int first,
950 unsigned int last_unsecured_sector;
951 bool has_unsecured_sector;
952 struct target *target = bank->target;
953 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
956 status = lpc2900_is_ready(bank);
957 if (status != ERROR_OK)
960 /* Sanity check on sector range */
961 if ((last < first) || (last >= bank->num_sectors)) {
962 LOG_INFO("Bad sector range");
963 return ERROR_FLASH_SECTOR_INVALID;
966 /* Update the info about secured sectors */
967 lpc2900_read_security_status(bank);
969 /* The selected sector range might include secured sectors. An attempt
970 * to erase such a sector will cause the erase to fail also for unsecured
971 * sectors. It is necessary to determine the last unsecured sector now,
972 * because we have to treat the last relevant sector in the list in
975 last_unsecured_sector = -1;
976 has_unsecured_sector = false;
977 for (unsigned int sector = first; sector <= last; sector++) {
978 if (!bank->sectors[sector].is_protected) {
979 last_unsecured_sector = sector;
980 has_unsecured_sector = true;
984 /* Exit now, in case of the rare constellation where all sectors in range
985 * are secured. This is regarded a success, since erasing/programming of
986 * secured sectors shall be handled transparently.
988 if (!has_unsecured_sector)
991 /* Enable flash block and set the correct CRA clock of 66 kHz */
994 /* Clear END_OF_ERASE interrupt status */
995 target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_ERASE);
997 /* Set the program/erase timer to FLASH_ERASE_TIME */
998 target_write_u32(target, FPTR,
999 FPTR_EN_T | lpc2900_calc_tr(lpc2900_info->clk_sys_fmc,
1002 /* Sectors are marked for erasure, then erased all together */
1003 for (unsigned int sector = first; sector <= last_unsecured_sector; sector++) {
1004 /* Only mark sectors that aren't secured. Any attempt to erase a group
1005 * of sectors will fail if any single one of them is secured!
1007 if (!bank->sectors[sector].is_protected) {
1008 /* Unprotect the sector */
1009 target_write_u32(target, bank->sectors[sector].offset, 0);
1010 target_write_u32(target, FCTR,
1011 FCTR_FS_LOADREQ | FCTR_FS_WPB |
1012 FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
1014 /* Mark the sector for erasure. The last sector in the list
1015 triggers the erasure. */
1016 target_write_u32(target, bank->sectors[sector].offset, 0);
1017 if (sector == last_unsecured_sector) {
1018 target_write_u32(target, FCTR,
1019 FCTR_FS_PROGREQ | FCTR_FS_WPB | FCTR_FS_CS);
1021 target_write_u32(target, FCTR,
1022 FCTR_FS_LOADREQ | FCTR_FS_WPB |
1023 FCTR_FS_WEB | FCTR_FS_CS);
1028 /* Wait for the end of the erase operation. If it's not over after two seconds,
1029 * something went dreadfully wrong... :-(
1031 if (lpc2900_wait_status(bank, INTSRC_END_OF_ERASE, 2000) != ERROR_OK)
1032 return ERROR_FLASH_OPERATION_FAILED;
1034 /* Normal flash operating mode */
1035 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1040 /* lpc2900_protect command is not supported.
1041 * "Protection" in LPC2900 terms is handled transparently. Sectors will
1042 * automatically be unprotected as needed.
1043 * Instead we use the concept of sector security. A secured sector is shown
1044 * as "protected" in OpenOCD. Sector security is a permanent feature, and
1045 * cannot be disabled once activated.
1049 * Write data to flash.
1051 * @param bank Pointer to the flash bank descriptor
1052 * @param buffer Buffer with data
1053 * @param offset Start address (relative to bank start)
1054 * @param count Number of bytes to be programmed
1056 static int lpc2900_write(struct flash_bank *bank, const uint8_t *buffer,
1057 uint32_t offset, uint32_t count)
1059 uint8_t page[FLASH_PAGE_SIZE];
1062 struct target *target = bank->target;
1063 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
1066 static const uint32_t write_target_code[] = {
1067 /* Set auto latch mode: FCTR=CS|WRE|WEB */
1068 0xe3a0a007, /* loop mov r10, #0x007 */
1069 0xe583a000, /* str r10,[r3,#0] */
1071 /* Load complete page into latches */
1072 0xe3a06020, /* mov r6,#(512/16) */
1073 0xe8b00f00, /* next ldmia r0!,{r8-r11} */
1074 0xe8a10f00, /* stmia r1!,{r8-r11} */
1075 0xe2566001, /* subs r6,#1 */
1076 0x1afffffb, /* bne next */
1078 /* Clear END_OF_BURN interrupt status */
1079 0xe3a0a002, /* mov r10,#(1 << 1) */
1080 0xe583afe8, /* str r10,[r3,#0xfe8] */
1082 /* Set the erase time to FLASH_PROGRAM_TIME */
1083 0xe5834008, /* str r4,[r3,#8] */
1085 /* Trigger flash write
1086 * FCTR = CS | WRE | WPB | PROGREQ */
1087 0xe3a0a083, /* mov r10,#0x83 */
1088 0xe38aaa01, /* orr r10,#0x1000 */
1089 0xe583a000, /* str r10,[r3,#0] */
1091 /* Wait for end of burn */
1092 0xe593afe0, /* wait ldr r10,[r3,#0xfe0] */
1093 0xe21aa002, /* ands r10,#(1 << 1) */
1094 0x0afffffc, /* beq wait */
1097 0xe2522001, /* subs r2,#1 */
1098 0x1affffed, /* bne loop */
1100 0xeafffffe /* done b done */
1104 status = lpc2900_is_ready(bank);
1105 if (status != ERROR_OK)
1108 /* Enable flash block and set the correct CRA clock of 66 kHz */
1109 lpc2900_setup(bank);
1111 /* Update the info about secured sectors */
1112 lpc2900_read_security_status(bank);
1114 /* Unprotect all involved sectors */
1115 for (unsigned int sector = 0; sector < bank->num_sectors; sector++) {
1116 /* Start address in or before this sector?
1117 * End address in or behind this sector? */
1118 if (((bank->base + offset) <
1119 (bank->sectors[sector].offset + bank->sectors[sector].size)) &&
1120 ((bank->base + (offset + count - 1)) >= bank->sectors[sector].offset)) {
1121 /* This sector is involved and needs to be unprotected.
1122 * Don't do it for secured sectors.
1124 if (!bank->sectors[sector].is_protected) {
1125 target_write_u32(target, bank->sectors[sector].offset, 0);
1126 target_write_u32(target, FCTR,
1127 FCTR_FS_LOADREQ | FCTR_FS_WPB |
1128 FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
1133 /* Set the program/erase time to FLASH_PROGRAM_TIME */
1134 uint32_t prog_time = FPTR_EN_T | lpc2900_calc_tr(lpc2900_info->clk_sys_fmc, FLASH_PROGRAM_TIME);
1136 /* If there is a working area of reasonable size, use it to program via
1137 * a target algorithm. If not, fall back to host programming. */
1139 /* We need some room for target code. */
1140 const uint32_t target_code_size = sizeof(write_target_code);
1142 /* Try working area allocation. Start with a large buffer, and try with
1143 * reduced size if that fails. */
1144 struct working_area *warea;
1145 uint32_t buffer_size = lpc2900_info->max_ram_block - 1 * KiB;
1146 while ((retval = target_alloc_working_area_try(target,
1147 buffer_size + target_code_size,
1148 &warea)) != ERROR_OK) {
1149 /* Try a smaller buffer now, and stop if it's too small. */
1150 buffer_size -= 1 * KiB;
1151 if (buffer_size < 2 * KiB) {
1152 LOG_INFO("no (large enough) working area, falling back to host mode");
1159 struct reg_param reg_params[5];
1160 struct arm_algorithm arm_algo;
1162 /* We can use target mode. Download the algorithm. */
1163 uint8_t code[sizeof(write_target_code)];
1164 target_buffer_set_u32_array(target, code, ARRAY_SIZE(write_target_code),
1166 retval = target_write_buffer(target, (warea->address) + buffer_size, sizeof(code), code);
1167 if (retval != ERROR_OK) {
1168 LOG_ERROR("Unable to write block write code to target");
1169 target_free_all_working_areas(target);
1170 return ERROR_FLASH_OPERATION_FAILED;
1173 init_reg_param(®_params[0], "r0", 32, PARAM_OUT);
1174 init_reg_param(®_params[1], "r1", 32, PARAM_OUT);
1175 init_reg_param(®_params[2], "r2", 32, PARAM_OUT);
1176 init_reg_param(®_params[3], "r3", 32, PARAM_OUT);
1177 init_reg_param(®_params[4], "r4", 32, PARAM_OUT);
1179 /* Write to flash in large blocks */
1180 while (count != 0) {
1181 uint32_t this_npages;
1182 const uint8_t *this_buffer;
1183 unsigned int start_sector = lpc2900_address2sector(bank, offset);
1185 /* First page / last page / rest */
1186 if (offset % FLASH_PAGE_SIZE) {
1187 /* Block doesn't start on page boundary.
1188 * Burn first partial page separately. */
1189 memset(&page, 0xff, sizeof(page));
1190 memcpy(&page[offset % FLASH_PAGE_SIZE],
1192 FLASH_PAGE_SIZE - (offset % FLASH_PAGE_SIZE));
1194 this_buffer = &page[0];
1195 count = count + (offset % FLASH_PAGE_SIZE);
1196 offset = offset - (offset % FLASH_PAGE_SIZE);
1197 } else if (count < FLASH_PAGE_SIZE) {
1198 /* Download last incomplete page separately. */
1199 memset(&page, 0xff, sizeof(page));
1200 memcpy(&page, buffer, count);
1202 this_buffer = &page[0];
1203 count = FLASH_PAGE_SIZE;
1205 /* Download as many full pages as possible */
1206 this_npages = (count < buffer_size) ?
1207 count / FLASH_PAGE_SIZE :
1208 buffer_size / FLASH_PAGE_SIZE;
1209 this_buffer = buffer;
1211 /* Make sure we stop at the next secured sector */
1212 unsigned int sector = start_sector + 1;
1213 while (sector < bank->num_sectors) {
1215 if (bank->sectors[sector].is_protected) {
1216 /* Is that next sector within the current block? */
1217 if ((bank->sectors[sector].offset - bank->base) <
1218 (offset + (this_npages * FLASH_PAGE_SIZE))) {
1219 /* Yes! Split the block */
1221 (bank->sectors[sector].offset -
1222 bank->base - offset)
1232 /* Skip the current sector if it is secured */
1233 if (bank->sectors[start_sector].is_protected) {
1234 LOG_DEBUG("Skip secured sector %u",
1237 /* Stop if this is the last sector */
1238 if (start_sector == bank->num_sectors - 1)
1242 uint32_t nskip = bank->sectors[start_sector].size -
1243 (offset % bank->sectors[start_sector].size);
1246 count = (count >= nskip) ? (count - nskip) : 0;
1250 /* Execute buffer download */
1251 retval = target_write_buffer(target, warea->address,
1252 this_npages * FLASH_PAGE_SIZE, this_buffer);
1253 if (retval != ERROR_OK) {
1254 LOG_ERROR("Unable to write data to target");
1255 target_free_all_working_areas(target);
1256 return ERROR_FLASH_OPERATION_FAILED;
1259 /* Prepare registers */
1260 buf_set_u32(reg_params[0].value, 0, 32, warea->address);
1261 buf_set_u32(reg_params[1].value, 0, 32, offset);
1262 buf_set_u32(reg_params[2].value, 0, 32, this_npages);
1263 buf_set_u32(reg_params[3].value, 0, 32, FCTR);
1264 buf_set_u32(reg_params[4].value, 0, 32, FPTR_EN_T | prog_time);
1266 /* Execute algorithm, assume breakpoint for last instruction */
1267 arm_algo.common_magic = ARM_COMMON_MAGIC;
1268 arm_algo.core_mode = ARM_MODE_SVC;
1269 arm_algo.core_state = ARM_STATE_ARM;
1271 retval = target_run_algorithm(target, 0, NULL, 5, reg_params,
1272 (warea->address) + buffer_size,
1273 (warea->address) + buffer_size + target_code_size - 4,
1274 10000, /* 10s should be enough for max. 16 KiB of data */
1277 if (retval != ERROR_OK) {
1278 LOG_ERROR("Execution of flash algorithm failed.");
1279 target_free_all_working_areas(target);
1280 retval = ERROR_FLASH_OPERATION_FAILED;
1284 count -= this_npages * FLASH_PAGE_SIZE;
1285 buffer += this_npages * FLASH_PAGE_SIZE;
1286 offset += this_npages * FLASH_PAGE_SIZE;
1289 /* Free all resources */
1290 destroy_reg_param(®_params[0]);
1291 destroy_reg_param(®_params[1]);
1292 destroy_reg_param(®_params[2]);
1293 destroy_reg_param(®_params[3]);
1294 destroy_reg_param(®_params[4]);
1295 target_free_all_working_areas(target);
1297 /* Write to flash memory page-wise */
1298 while (count != 0) {
1299 /* How many bytes do we copy this time? */
1300 num_bytes = (count >= FLASH_PAGE_SIZE) ?
1301 FLASH_PAGE_SIZE - (offset % FLASH_PAGE_SIZE) :
1304 /* Don't do anything with it if the page is in a secured sector. */
1305 if (!bank->sectors[lpc2900_address2sector(bank, offset)].is_protected) {
1306 /* Set latch load mode */
1307 target_write_u32(target, FCTR,
1308 FCTR_FS_CS | FCTR_FS_WRE | FCTR_FS_WEB);
1310 /* Always clear the buffer (a little overhead, but who cares) */
1311 memset(page, 0xFF, FLASH_PAGE_SIZE);
1313 /* Copy them to the buffer */
1314 memcpy(&page[offset % FLASH_PAGE_SIZE],
1315 &buffer[offset % FLASH_PAGE_SIZE],
1318 /* Write whole page to flash data latches */
1319 if (target_write_memory(target,
1320 bank->base + (offset - (offset % FLASH_PAGE_SIZE)),
1321 4, FLASH_PAGE_SIZE / 4, page) != ERROR_OK) {
1322 LOG_ERROR("Write failed @ 0x%8.8" PRIx32, offset);
1323 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1325 return ERROR_FLASH_OPERATION_FAILED;
1328 /* Clear END_OF_BURN interrupt status */
1329 target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_BURN);
1331 /* Set the programming time */
1332 target_write_u32(target, FPTR, FPTR_EN_T | prog_time);
1334 /* Trigger flash write */
1335 target_write_u32(target, FCTR,
1336 FCTR_FS_CS | FCTR_FS_WRE | FCTR_FS_WPB | FCTR_FS_PROGREQ);
1338 /* Wait for the end of the write operation. If it's not over
1339 * after one second, something went dreadfully wrong... :-(
1341 if (lpc2900_wait_status(bank, INTSRC_END_OF_BURN, 1000) != ERROR_OK) {
1342 LOG_ERROR("Write failed @ 0x%8.8" PRIx32, offset);
1343 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1345 return ERROR_FLASH_OPERATION_FAILED;
1349 /* Update pointers and counters */
1350 offset += num_bytes;
1351 buffer += num_bytes;
1358 /* Normal flash operating mode */
1359 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1365 * Try and identify the device.
1367 * Determine type number and its memory layout.
1369 * @param bank Pointer to the flash bank descriptor
1371 static int lpc2900_probe(struct flash_bank *bank)
1373 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
1374 struct target *target = bank->target;
1378 if (target->state != TARGET_HALTED) {
1379 LOG_ERROR("Target not halted");
1380 return ERROR_TARGET_NOT_HALTED;
1383 /* We want to do this only once. */
1384 if (lpc2900_info->is_probed)
1387 /* Probing starts with reading the CHIPID register. We will continue only
1388 * if this identifies as an LPC2900 device.
1390 target_read_u32(target, CHIPID, &lpc2900_info->chipid);
1392 if (lpc2900_info->chipid != EXPECTED_CHIPID) {
1393 LOG_WARNING("Device is not an LPC29xx");
1394 return ERROR_FLASH_OPERATION_FAILED;
1397 /* It's an LPC29xx device. Now read the feature register FEAT0...FEAT3. */
1398 uint32_t feat0, feat1, feat2, feat3;
1399 target_read_u32(target, FEAT0, &feat0);
1400 target_read_u32(target, FEAT1, &feat1);
1401 target_read_u32(target, FEAT2, &feat2);
1402 target_read_u32(target, FEAT3, &feat3);
1405 bank->base = 0x20000000;
1407 /* Determine flash layout from FEAT2 register */
1408 uint32_t num_64k_sectors = (feat2 >> 16) & 0xFF;
1409 uint32_t num_8k_sectors = (feat2 >> 0) & 0xFF;
1410 bank->num_sectors = num_64k_sectors + num_8k_sectors;
1411 bank->size = KiB * (64 * num_64k_sectors + 8 * num_8k_sectors);
1413 /* Determine maximum contiguous RAM block */
1414 lpc2900_info->max_ram_block = 16 * KiB;
1415 if ((feat1 & 0x30) == 0x30) {
1416 lpc2900_info->max_ram_block = 32 * KiB;
1417 if ((feat1 & 0x0C) == 0x0C)
1418 lpc2900_info->max_ram_block = 48 * KiB;
1421 /* Determine package code and ITCM size */
1422 uint32_t package_code = feat0 & 0x0F;
1423 uint32_t itcm_code = (feat1 >> 16) & 0x1F;
1425 /* Determine the exact type number. */
1427 if ((package_code == 4) && (itcm_code == 5)) {
1428 /* Old LPC2917 or LPC2919 (non-/01 devices) */
1429 lpc2900_info->target_name = (bank->size == 768*KiB) ? "LPC2919" : "LPC2917";
1431 if (package_code == 2) {
1432 /* 100-pin package */
1433 if (bank->size == 128*KiB)
1434 lpc2900_info->target_name = "LPC2921";
1435 else if (bank->size == 256*KiB)
1436 lpc2900_info->target_name = "LPC2923";
1437 else if (bank->size == 512*KiB)
1438 lpc2900_info->target_name = "LPC2925";
1441 } else if (package_code == 4) {
1442 /* 144-pin package */
1443 if ((bank->size == 256*KiB) && (feat3 == 0xFFFFFFE9))
1444 lpc2900_info->target_name = "LPC2926";
1445 else if ((bank->size == 512*KiB) && (feat3 == 0xFFFFFCF0))
1446 lpc2900_info->target_name = "LPC2917/01";
1447 else if ((bank->size == 512*KiB) && (feat3 == 0xFFFFFFF1))
1448 lpc2900_info->target_name = "LPC2927";
1449 else if ((bank->size == 768*KiB) && (feat3 == 0xFFFFFCF8))
1450 lpc2900_info->target_name = "LPC2919/01";
1451 else if ((bank->size == 768*KiB) && (feat3 == 0xFFFFFFF9))
1452 lpc2900_info->target_name = "LPC2929";
1455 } else if (package_code == 5) {
1456 /* 208-pin package */
1457 lpc2900_info->target_name = (bank->size == 0) ? "LPC2930" : "LPC2939";
1463 LOG_WARNING("Unknown LPC29xx derivative (FEATx="
1464 "%08" PRIx32 ":%08" PRIx32 ":%08" PRIx32 ":%08" PRIx32 ")",
1465 feat0, feat1, feat2, feat3);
1466 return ERROR_FLASH_OPERATION_FAILED;
1469 /* Show detected device */
1470 LOG_INFO("Flash bank %u: Device %s, %" PRIu32
1471 " KiB in %u sectors",
1473 lpc2900_info->target_name, bank->size / KiB,
1476 /* Flashless devices cannot be handled */
1477 if (bank->num_sectors == 0) {
1478 LOG_WARNING("Flashless device cannot be handled");
1479 return ERROR_FLASH_OPERATION_FAILED;
1483 * These are logical sector numbers. When doing real flash operations,
1484 * the logical flash number are translated into the physical flash numbers
1487 bank->sectors = malloc(sizeof(struct flash_sector) * bank->num_sectors);
1490 for (unsigned int i = 0; i < bank->num_sectors; i++) {
1491 bank->sectors[i].offset = offset;
1492 bank->sectors[i].is_erased = -1;
1493 bank->sectors[i].is_protected = -1;
1496 bank->sectors[i].size = 8 * KiB;
1498 bank->sectors[i].size = 64 * KiB;
1500 /* We shouldn't come here. But there might be a new part out there
1501 * that has more than 19 sectors. Politely ask for a fix then.
1503 bank->sectors[i].size = 0;
1504 LOG_ERROR("Never heard about sector %u", i);
1507 offset += bank->sectors[i].size;
1510 lpc2900_info->is_probed = true;
1512 /* Read sector security status */
1513 if (lpc2900_read_security_status(bank) != ERROR_OK) {
1514 LOG_ERROR("Cannot determine sector security status");
1515 return ERROR_FLASH_OPERATION_FAILED;
1522 * Run a blank check for each sector.
1524 * For speed reasons, the device isn't read word by word.
1525 * A hash value is calculated by the hardware ("BIST") for each sector.
1526 * This value is then compared against the known hash of an empty sector.
1528 * @param bank Pointer to the flash bank descriptor
1530 static int lpc2900_erase_check(struct flash_bank *bank)
1532 uint32_t status = lpc2900_is_ready(bank);
1533 if (status != ERROR_OK) {
1534 LOG_INFO("Processor not halted/not probed");
1538 /* Use the BIST (Built-In Self Test) to generate a signature of each flash
1539 * sector. Compare against the expected signature of an empty sector.
1541 for (unsigned int sector = 0; sector < bank->num_sectors; sector++) {
1542 uint32_t signature[4];
1543 status = lpc2900_run_bist128(bank, bank->sectors[sector].offset,
1544 bank->sectors[sector].offset + (bank->sectors[sector].size - 1), signature);
1545 if (status != ERROR_OK)
1548 /* The expected signatures for an empty sector are different
1549 * for 8 KiB and 64 KiB sectors.
1551 if (bank->sectors[sector].size == 8*KiB) {
1552 bank->sectors[sector].is_erased =
1553 (signature[3] == 0x01ABAAAA) &&
1554 (signature[2] == 0xAAAAAAAA) &&
1555 (signature[1] == 0xAAAAAAAA) &&
1556 (signature[0] == 0xAAA00AAA);
1558 if (bank->sectors[sector].size == 64*KiB) {
1559 bank->sectors[sector].is_erased =
1560 (signature[3] == 0x11801222) &&
1561 (signature[2] == 0xB88844FF) &&
1562 (signature[1] == 0x11A22008) &&
1563 (signature[0] == 0x2B1BFE44);
1571 * Get protection (sector security) status.
1573 * Determine the status of "sector security" for each sector.
1574 * A secured sector is one that can never be erased/programmed again.
1576 * @param bank Pointer to the flash bank descriptor
1578 static int lpc2900_protect_check(struct flash_bank *bank)
1580 return lpc2900_read_security_status(bank);
1583 const struct flash_driver lpc2900_flash = {
1585 .commands = lpc2900_command_handlers,
1586 .flash_bank_command = lpc2900_flash_bank_command,
1587 .erase = lpc2900_erase,
1588 .write = lpc2900_write,
1589 .read = default_flash_read,
1590 .probe = lpc2900_probe,
1591 .auto_probe = lpc2900_probe,
1592 .erase_check = lpc2900_erase_check,
1593 .protect_check = lpc2900_protect_check,
1594 .free_driver_priv = default_flash_free_driver_priv,