git.gag.com Git - fw/openocd/blob - src/flash/nor/lpc2900.c

   1 /***************************************************************************
   2  *   Copyright (C) 2009 by                                                 *
   3  *   Rolf Meeser <rolfm_9dq@yahoo.de>                                      *
   4  *                                                                         *
   5  *   This program is free software; you can redistribute it and/or modify  *
   6  *   it under the terms of the GNU General Public License as published by  *
   7  *   the Free Software Foundation; either version 2 of the License, or     *
   8  *   (at your option) any later version.                                   *
   9  *                                                                         *
  10  *   This program is distributed in the hope that it will be useful,       *
  11  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  12  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  13  *   GNU General Public License for more details.                          *
  14  *                                                                         *
  15  *   You should have received a copy of the GNU General Public License     *
  16  *   along with this program; if not, write to the                         *
  17  *   Free Software Foundation, Inc.,                                       *
  18  *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  19  ***************************************************************************/
  20
  21 #ifdef HAVE_CONFIG_H
  22 #include "config.h"
  23 #endif
  24
  25
  26 #include "imp.h"
  27 #include <helper/binarybuffer.h>
  28 #include <target/algorithm.h>
  29 #include <target/arm.h>
  30 #include <target/image.h>
  31
  32
  33 /* 1024 bytes */
  34 #define KiB                 1024
  35
  36 /* Some flash constants */
  37 #define FLASH_PAGE_SIZE     512     /* bytes */
  38 #define FLASH_ERASE_TIME    100000  /* microseconds */
  39 #define FLASH_PROGRAM_TIME  1000    /* microseconds */
  40
  41 /* Chip ID / Feature Registers */
  42 #define CHIPID          0xE0000000  /* Chip ID */
  43 #define FEAT0           0xE0000100  /* Chip feature 0 */
  44 #define FEAT1           0xE0000104  /* Chip feature 1 */
  45 #define FEAT2           0xE0000108  /* Chip feature 2 (contains flash size indicator) */
  46 #define FEAT3           0xE000010C  /* Chip feature 3 */
  47
  48 #define EXPECTED_CHIPID 0x209CE02B  /* Chip ID of all LPC2900 devices */
  49
  50 /* Flash/EEPROM Control Registers */
  51 #define FCTR            0x20200000  /* Flash control */
  52 #define FPTR            0x20200008  /* Flash program-time */
  53 #define FTCTR           0x2020000C  /* Flash test control */
  54 #define FBWST           0x20200010  /* Flash bridge wait-state */
  55 #define FCRA            0x2020001C  /* Flash clock divider */
  56 #define FMSSTART        0x20200020  /* Flash Built-In Selft Test start address */
  57 #define FMSSTOP         0x20200024  /* Flash Built-In Selft Test stop address */
  58 #define FMS16           0x20200028  /* Flash 16-bit signature */
  59 #define FMSW0           0x2020002C  /* Flash 128-bit signature Word 0 */
  60 #define FMSW1           0x20200030  /* Flash 128-bit signature Word 1 */
  61 #define FMSW2           0x20200034  /* Flash 128-bit signature Word 2 */
  62 #define FMSW3           0x20200038  /* Flash 128-bit signature Word 3 */
  63
  64 #define EECMD           0x20200080  /* EEPROM command */
  65 #define EEADDR          0x20200084  /* EEPROM address */
  66 #define EEWDATA         0x20200088  /* EEPROM write data */
  67 #define EERDATA         0x2020008C  /* EEPROM read data */
  68 #define EEWSTATE        0x20200090  /* EEPROM wait state */
  69 #define EECLKDIV        0x20200094  /* EEPROM clock divider */
  70 #define EEPWRDWN        0x20200098  /* EEPROM power-down/start */
  71 #define EEMSSTART       0x2020009C  /* EEPROM BIST start address */
  72 #define EEMSSTOP        0x202000A0  /* EEPROM BIST stop address */
  73 #define EEMSSIG         0x202000A4  /* EEPROM 24-bit BIST signature */
  74
  75 #define INT_CLR_ENABLE  0x20200FD8  /* Flash/EEPROM interrupt clear enable */
  76 #define INT_SET_ENABLE  0x20200FDC  /* Flash/EEPROM interrupt set enable */
  77 #define INT_STATUS      0x20200FE0  /* Flash/EEPROM interrupt status */
  78 #define INT_ENABLE      0x20200FE4  /* Flash/EEPROM interrupt enable */
  79 #define INT_CLR_STATUS  0x20200FE8  /* Flash/EEPROM interrupt clear status */
  80 #define INT_SET_STATUS  0x20200FEC  /* Flash/EEPROM interrupt set status */
  81
  82 /* Interrupt sources */
  83 #define INTSRC_END_OF_PROG    (1 << 28)
  84 #define INTSRC_END_OF_BIST    (1 << 27)
  85 #define INTSRC_END_OF_RDWR    (1 << 26)
  86 #define INTSRC_END_OF_MISR    (1 << 2)
  87 #define INTSRC_END_OF_BURN    (1 << 1)
  88 #define INTSRC_END_OF_ERASE   (1 << 0)
  89
  90
  91 /* FCTR bits */
  92 #define FCTR_FS_LOADREQ       (1 << 15)
  93 #define FCTR_FS_CACHECLR      (1 << 14)
  94 #define FCTR_FS_CACHEBYP      (1 << 13)
  95 #define FCTR_FS_PROGREQ       (1 << 12)
  96 #define FCTR_FS_RLS           (1 << 11)
  97 #define FCTR_FS_PDL           (1 << 10)
  98 #define FCTR_FS_PD            (1 << 9)
  99 #define FCTR_FS_WPB           (1 << 7)
 100 #define FCTR_FS_ISS           (1 << 6)
 101 #define FCTR_FS_RLD           (1 << 5)
 102 #define FCTR_FS_DCR           (1 << 4)
 103 #define FCTR_FS_WEB           (1 << 2)
 104 #define FCTR_FS_WRE           (1 << 1)
 105 #define FCTR_FS_CS            (1 << 0)
 106 /* FPTR bits */
 107 #define FPTR_EN_T             (1 << 15)
 108 /* FTCTR bits */
 109 #define FTCTR_FS_BYPASS_R     (1 << 29)
 110 #define FTCTR_FS_BYPASS_W     (1 << 28)
 111 /* FMSSTOP bits */
 112 #define FMSSTOP_MISR_START    (1 << 17)
 113 /* EEMSSTOP bits */
 114 #define EEMSSTOP_STRTBIST     (1 << 31)
 115
 116 /* Index sector */
 117 #define ISS_CUSTOMER_START1   (0x830)
 118 #define ISS_CUSTOMER_END1     (0xA00)
 119 #define ISS_CUSTOMER_SIZE1    (ISS_CUSTOMER_END1 - ISS_CUSTOMER_START1)
 120 #define ISS_CUSTOMER_NWORDS1  (ISS_CUSTOMER_SIZE1 / 4)
 121 #define ISS_CUSTOMER_START2   (0xA40)
 122 #define ISS_CUSTOMER_END2     (0xC00)
 123 #define ISS_CUSTOMER_SIZE2    (ISS_CUSTOMER_END2 - ISS_CUSTOMER_START2)
 124 #define ISS_CUSTOMER_NWORDS2  (ISS_CUSTOMER_SIZE2 / 4)
 125 #define ISS_CUSTOMER_SIZE     (ISS_CUSTOMER_SIZE1 + ISS_CUSTOMER_SIZE2)
 126
 127
 128
 129 /**
 130  * Private data for \c lpc2900 flash driver.
 131  */
 132 struct lpc2900_flash_bank
 133 {
 134         /**
 135          * This flag is set when the device has been successfully probed.
 136          */
 137         bool is_probed;
 138
 139         /**
 140          * Holds the value read from CHIPID register.
 141          * The driver will not load if the chipid doesn't match the expected
 142          * value of 0x209CE02B of the LPC2900 family. A probe will only be done
 143          * if the chipid does not yet contain the expected value.
 144          */
 145         uint32_t chipid;
 146
 147         /**
 148          * String holding device name.
 149          * This string is set by the probe function to the type number of the
 150          * device. It takes the form "LPC29xx".
 151          */
 152         char * target_name;
 153
 154         /**
 155          * System clock frequency.
 156          * Holds the clock frequency in Hz, as passed by the configuration file
 157          * to the <tt>flash bank</tt> command.
 158          */
 159         uint32_t clk_sys_fmc;
 160
 161         /**
 162          * Flag to indicate that dangerous operations are possible.
 163          * This flag can be set by passing the correct password to the
 164          * <tt>lpc2900 password</tt> command. If set, other dangerous commands,
 165          * which operate on the index sector, can be executed.
 166          */
 167         uint32_t risky;
 168
 169         /**
 170          * Maximum contiguous block of internal SRAM (bytes).
 171          * Autodetected by the driver. Not the total amount of SRAM, only the
 172          * the largest \em contiguous block!
 173          */
 174         uint32_t max_ram_block;
 175
 176 };
 177
 178
 179 static uint32_t lpc2900_wait_status(struct flash_bank *bank, uint32_t mask, int timeout);
 180 static void lpc2900_setup(struct flash_bank *bank);
 181 static uint32_t lpc2900_is_ready(struct flash_bank *bank);
 182 static uint32_t lpc2900_read_security_status(struct flash_bank *bank);
 183 static uint32_t lpc2900_run_bist128(struct flash_bank *bank,
 184                                     uint32_t addr_from, uint32_t addr_to,
 185                                     uint32_t (*signature)[4] );
 186 static uint32_t lpc2900_address2sector(struct flash_bank *bank, uint32_t offset);
 187 static uint32_t lpc2900_calc_tr(uint32_t clock_var, uint32_t time_var);
 188
 189
 190 /***********************  Helper functions  **************************/
 191
 192
 193 /**
 194  * Wait for an event in mask to occur in INT_STATUS.
 195  *
 196  * Return when an event occurs, or after a timeout.
 197  *
 198  * @param[in] bank Pointer to the flash bank descriptor
 199  * @param[in] mask Mask to be used for INT_STATUS
 200  * @param[in] timeout Timeout in ms
 201  */
 202 static uint32_t lpc2900_wait_status( struct flash_bank *bank,
 203                                      uint32_t mask,
 204                                      int timeout )
 205 {
 206         uint32_t int_status;
 207         struct target *target = bank->target;
 208
 209
 210         do
 211         {
 212                 alive_sleep(1);
 213                 timeout--;
 214                 target_read_u32(target, INT_STATUS, &int_status);
 215         }
 216         while( ((int_status & mask) == 0) && (timeout != 0) );
 217
 218         if (timeout == 0)
 219         {
 220                 LOG_DEBUG("Timeout!");
 221                 return ERROR_FLASH_OPERATION_FAILED;
 222         }
 223
 224         return ERROR_OK;
 225 }
 226
 227
 228
 229 /**
 230  * Set up the flash for erase/program operations.
 231  *
 232  * Enable the flash, and set the correct CRA clock of 66 kHz.
 233  *
 234  * @param bank Pointer to the flash bank descriptor
 235  */
 236 static void lpc2900_setup( struct flash_bank *bank )
 237 {
 238         uint32_t fcra;
 239         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
 240
 241
 242         /* Power up the flash block */
 243         target_write_u32( bank->target, FCTR, FCTR_FS_WEB | FCTR_FS_CS );
 244
 245
 246         fcra = (lpc2900_info->clk_sys_fmc / (3 * 66000)) - 1;
 247         target_write_u32( bank->target, FCRA, fcra );
 248 }
 249
 250
 251
 252 /**
 253  * Check if device is ready.
 254  *
 255  * Check if device is ready for flash operation:
 256  * Must have been successfully probed.
 257  * Must be halted.
 258  */
 259 static uint32_t lpc2900_is_ready( struct flash_bank *bank )
 260 {
 261         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
 262
 263         if( !lpc2900_info->is_probed )
 264         {
 265                 return ERROR_FLASH_BANK_NOT_PROBED;
 266         }
 267
 268         if( bank->target->state != TARGET_HALTED )
 269         {
 270                 LOG_ERROR( "Target not halted" );
 271                 return ERROR_TARGET_NOT_HALTED;
 272         }
 273
 274         return ERROR_OK;
 275 }
 276
 277
 278 /**
 279  * Read the status of sector security from the index sector.
 280  *
 281  * @param bank Pointer to the flash bank descriptor
 282  */
 283 static uint32_t lpc2900_read_security_status( struct flash_bank *bank )
 284 {
 285         uint32_t status;
 286         if( (status = lpc2900_is_ready( bank )) != ERROR_OK )
 287         {
 288                 return status;
 289         }
 290
 291         struct target *target = bank->target;
 292
 293         /* Enable ISS access */
 294         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB | FCTR_FS_ISS);
 295
 296         /* Read the relevant block of memory from the ISS sector */
 297         uint32_t iss_secured_field[ 0x230/16 ][ 4 ];
 298         target_read_memory(target, bank->base + 0xC00, 4, 0x230/4,
 299                                    (uint8_t *)iss_secured_field);
 300
 301         /* Disable ISS access */
 302         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
 303
 304         /* Check status of each sector. Note that the sector numbering in the LPC2900
 305          * is different from the logical sector numbers used in OpenOCD!
 306          * Refer to the user manual for details.
 307          *
 308          * All zeros (16x 0x00) are treated as a secured sector (is_protected = 1)
 309          * All ones (16x 0xFF) are treated as a non-secured sector (is_protected = 0)
 310          * Anything else is undefined (is_protected = -1). This is treated as
 311          * a protected sector!
 312          */
 313         int sector;
 314         int index_t;
 315         for( sector = 0; sector < bank->num_sectors; sector++ )
 316         {
 317                 /* Convert logical sector number to physical sector number */
 318                 if( sector <= 4 )
 319                 {
 320                         index_t = sector + 11;
 321                 }
 322                 else if( sector <= 7 )
 323                 {
 324                         index_t = sector + 27;
 325                 }
 326                 else
 327                 {
 328                         index_t = sector - 8;
 329                 }
 330
 331                 bank->sectors[sector].is_protected = -1;
 332
 333                 if (
 334                     (iss_secured_field[index_t][0] == 0x00000000) &&
 335                     (iss_secured_field[index_t][1] == 0x00000000) &&
 336                     (iss_secured_field[index_t][2] == 0x00000000) &&
 337                     (iss_secured_field[index_t][3] == 0x00000000) )
 338                 {
 339                         bank->sectors[sector].is_protected = 1;
 340                 }
 341
 342                 if (
 343                     (iss_secured_field[index_t][0] == 0xFFFFFFFF) &&
 344                     (iss_secured_field[index_t][1] == 0xFFFFFFFF) &&
 345                     (iss_secured_field[index_t][2] == 0xFFFFFFFF) &&
 346                     (iss_secured_field[index_t][3] == 0xFFFFFFFF) )
 347                 {
 348                         bank->sectors[sector].is_protected = 0;
 349                 }
 350         }
 351
 352         return ERROR_OK;
 353 }
 354
 355
 356 /**
 357  * Use BIST to calculate a 128-bit hash value over a range of flash.
 358  *
 359  * @param bank Pointer to the flash bank descriptor
 360  * @param addr_from
 361  * @param addr_to
 362  * @param signature
 363  */
 364 static uint32_t lpc2900_run_bist128(struct flash_bank *bank,
 365                                     uint32_t addr_from,
 366                                     uint32_t addr_to,
 367                                     uint32_t (*signature)[4] )
 368 {
 369         struct target *target = bank->target;
 370
 371         /* Clear END_OF_MISR interrupt status */
 372         target_write_u32( target, INT_CLR_STATUS, INTSRC_END_OF_MISR );
 373
 374         /* Start address */
 375         target_write_u32( target, FMSSTART, addr_from >> 4);
 376         /* End address, and issue start command */
 377         target_write_u32( target, FMSSTOP, (addr_to >> 4) | FMSSTOP_MISR_START );
 378
 379         /* Poll for end of operation. Calculate a reasonable timeout. */
 380         if( lpc2900_wait_status( bank, INTSRC_END_OF_MISR, 1000 ) != ERROR_OK )
 381         {
 382                 return ERROR_FLASH_OPERATION_FAILED;
 383         }
 384
 385         /* Return the signature */
 386         target_read_memory( target, FMSW0, 4, 4, (uint8_t *)signature );
 387
 388         return ERROR_OK;
 389 }
 390
 391
 392 /**
 393  * Return sector number for given address.
 394  *
 395  * Return the (logical) sector number for a given relative address.
 396  * No sanity check is done. It assumed that the address is valid.
 397  *
 398  * @param bank Pointer to the flash bank descriptor
 399  * @param offset Offset address relative to bank start
 400  */
 401 static uint32_t lpc2900_address2sector( struct flash_bank *bank,
 402                                         uint32_t offset )
 403 {
 404         uint32_t address = bank->base + offset;
 405
 406
 407         /* Run through all sectors of this bank */
 408         int sector;
 409         for( sector = 0; sector < bank->num_sectors; sector++ )
 410         {
 411                 /* Return immediately if address is within the current sector */
 412                 if( address < (bank->sectors[sector].offset + bank->sectors[sector].size) )
 413                 {
 414                         return sector;
 415                 }
 416         }
 417
 418         /* We should never come here. If we do, return an arbitrary sector number. */
 419         return 0;
 420 }
 421
 422
 423
 424
 425 /**
 426  * Write one page to the index sector.
 427  *
 428  * @param bank Pointer to the flash bank descriptor
 429  * @param pagenum Page number (0...7)
 430  * @param page Page array (FLASH_PAGE_SIZE bytes)
 431  */
 432 static int lpc2900_write_index_page( struct flash_bank *bank,
 433                                      int pagenum,
 434                                      uint8_t (*page)[FLASH_PAGE_SIZE] )
 435 {
 436         /* Only pages 4...7 are user writable */
 437         if ((pagenum < 4) || (pagenum > 7))
 438         {
 439                 LOG_ERROR("Refuse to burn index sector page %d", pagenum);
 440                 return ERROR_COMMAND_ARGUMENT_INVALID;
 441         }
 442
 443         /* Get target, and check if it's halted */
 444         struct target *target = bank->target;
 445         if( target->state != TARGET_HALTED )
 446         {
 447                 LOG_ERROR( "Target not halted" );
 448                 return ERROR_TARGET_NOT_HALTED;
 449         }
 450
 451         /* Private info */
 452         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
 453
 454         /* Enable flash block and set the correct CRA clock of 66 kHz */
 455         lpc2900_setup( bank );
 456
 457         /* Un-protect the index sector */
 458         target_write_u32( target, bank->base, 0 );
 459         target_write_u32( target, FCTR,
 460                           FCTR_FS_LOADREQ | FCTR_FS_WPB | FCTR_FS_ISS |
 461                           FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS );
 462
 463         /* Set latch load mode */
 464         target_write_u32( target, FCTR,
 465                           FCTR_FS_ISS | FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS );
 466
 467         /* Write whole page to flash data latches */
 468         if( target_write_memory( target,
 469                                  bank->base + pagenum * FLASH_PAGE_SIZE,
 470                                  4, FLASH_PAGE_SIZE / 4, (uint8_t *)page) != ERROR_OK )
 471         {
 472                 LOG_ERROR("Index sector write failed @ page %d", pagenum);
 473                 target_write_u32( target, FCTR, FCTR_FS_CS | FCTR_FS_WEB );
 474
 475                 return ERROR_FLASH_OPERATION_FAILED;
 476         }
 477
 478         /* Clear END_OF_BURN interrupt status */
 479         target_write_u32( target, INT_CLR_STATUS, INTSRC_END_OF_BURN );
 480
 481         /* Set the program/erase time to FLASH_PROGRAM_TIME */
 482         target_write_u32(target, FPTR,
 483                          FPTR_EN_T | lpc2900_calc_tr( lpc2900_info->clk_sys_fmc,
 484                                                       FLASH_PROGRAM_TIME ));
 485
 486         /* Trigger flash write */
 487         target_write_u32( target, FCTR,
 488                           FCTR_FS_PROGREQ | FCTR_FS_ISS |
 489                           FCTR_FS_WPB | FCTR_FS_WRE | FCTR_FS_CS );
 490
 491         /* Wait for the end of the write operation. If it's not over after one
 492          * second, something went dreadfully wrong... :-(
 493          */
 494         if (lpc2900_wait_status(bank, INTSRC_END_OF_BURN, 1000) != ERROR_OK)
 495         {
 496                 LOG_ERROR("Index sector write failed @ page %d", pagenum);
 497                 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
 498
 499                 return ERROR_FLASH_OPERATION_FAILED;
 500         }
 501
 502         target_write_u32( target, FCTR, FCTR_FS_CS | FCTR_FS_WEB );
 503
 504         return ERROR_OK;
 505 }
 506
 507
 508
 509 /**
 510  * Calculate FPTR.TR register value for desired program/erase time.
 511  *
 512  * @param clock System clock in Hz
 513  * @param time Program/erase time in µs
 514  */
 515 static uint32_t lpc2900_calc_tr( uint32_t clock_var, uint32_t time_var )
 516 {
 517         /*           ((time[µs]/1e6) * f[Hz]) + 511
 518          * FPTR.TR = -------------------------------
 519          *                         512
 520          */
 521
 522         uint32_t tr_val = (uint32_t)((((time_var / 1e6) * clock_var) + 511.0) / 512.0);
 523
 524         return tr_val;
 525 }
 526
 527
 528 /***********************  Private flash commands  **************************/
 529
 530
 531 /**
 532  * Command to determine the signature of the whole flash.
 533  *
 534  * Uses the Built-In-Self-Test (BIST) to generate a 128-bit hash value
 535  * of the flash content.
 536  */
 537 COMMAND_HANDLER(lpc2900_handle_signature_command)
 538 {
 539         uint32_t status;
 540         uint32_t signature[4];
 541
 542
 543         if( CMD_ARGC < 1 )
 544         {
 545                 LOG_WARNING( "Too few arguments. Call: lpc2900 signature <bank#>" );
 546                 return ERROR_FLASH_BANK_INVALID;
 547         }
 548
 549         struct flash_bank *bank;
 550         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 551         if (ERROR_OK != retval)
 552                 return retval;
 553
 554         if( bank->target->state != TARGET_HALTED )
 555         {
 556                 LOG_ERROR( "Target not halted" );
 557                 return ERROR_TARGET_NOT_HALTED;
 558         }
 559
 560         /* Run BIST over whole flash range */
 561         if( (status = lpc2900_run_bist128( bank,
 562                                            bank->base,
 563                                            bank->base + (bank->size - 1),
 564                                            &signature)
 565                                          ) != ERROR_OK )
 566         {
 567                 return status;
 568         }
 569
 570         command_print( CMD_CTX, "signature: 0x%8.8" PRIx32
 571                                           ":0x%8.8" PRIx32
 572                                           ":0x%8.8" PRIx32
 573                                           ":0x%8.8" PRIx32,
 574                       signature[3], signature[2], signature[1], signature[0] );
 575
 576         return ERROR_OK;
 577 }
 578
 579
 580
 581 /**
 582  * Store customer info in file.
 583  *
 584  * Read customer info from index sector, and store that block of data into
 585  * a disk file. The format is binary.
 586  */
 587 COMMAND_HANDLER(lpc2900_handle_read_custom_command)
 588 {
 589         if( CMD_ARGC < 2 )
 590         {
 591                 return ERROR_COMMAND_SYNTAX_ERROR;
 592         }
 593
 594         struct flash_bank *bank;
 595         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 596         if (ERROR_OK != retval)
 597                 return retval;
 598
 599         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
 600         lpc2900_info->risky = 0;
 601
 602         /* Get target, and check if it's halted */
 603         struct target *target = bank->target;
 604         if( target->state != TARGET_HALTED )
 605         {
 606                 LOG_ERROR( "Target not halted" );
 607                 return ERROR_TARGET_NOT_HALTED;
 608         }
 609
 610         /* Storage for customer info. Read in two parts */
 611         uint32_t customer[ ISS_CUSTOMER_NWORDS1 + ISS_CUSTOMER_NWORDS2 ];
 612
 613         /* Enable access to index sector */
 614         target_write_u32( target, FCTR, FCTR_FS_CS | FCTR_FS_WEB | FCTR_FS_ISS );
 615
 616         /* Read two parts */
 617         target_read_memory( target, bank->base+ISS_CUSTOMER_START1, 4,
 618                                     ISS_CUSTOMER_NWORDS1,
 619                                     (uint8_t *)&customer[0] );
 620         target_read_memory( target, bank->base+ISS_CUSTOMER_START2, 4,
 621                                     ISS_CUSTOMER_NWORDS2,
 622                                     (uint8_t *)&customer[ISS_CUSTOMER_NWORDS1] );
 623
 624         /* Deactivate access to index sector */
 625         target_write_u32( target, FCTR, FCTR_FS_CS | FCTR_FS_WEB );
 626
 627         /* Try and open the file */
 628         struct fileio fileio;
 629         const char *filename = CMD_ARGV[1];
 630         int ret = fileio_open( &fileio, filename, FILEIO_WRITE, FILEIO_BINARY );
 631         if( ret != ERROR_OK )
 632         {
 633                 LOG_WARNING( "Could not open file %s", filename );
 634                 return ret;
 635         }
 636
 637         size_t nwritten;
 638         ret = fileio_write( &fileio, sizeof(customer),
 639                         (const uint8_t *)customer, &nwritten );
 640         if( ret != ERROR_OK )
 641         {
 642                 LOG_ERROR( "Write operation to file %s failed", filename );
 643                 fileio_close( &fileio );
 644                 return ret;
 645         }
 646
 647         fileio_close( &fileio );
 648
 649         return ERROR_OK;
 650 }
 651
 652
 653
 654
 655 /**
 656  * Enter password to enable potentially dangerous options.
 657  */
 658 COMMAND_HANDLER(lpc2900_handle_password_command)
 659 {
 660         if (CMD_ARGC < 2)
 661         {
 662                 return ERROR_COMMAND_SYNTAX_ERROR;
 663         }
 664
 665         struct flash_bank *bank;
 666         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 667         if (ERROR_OK != retval)
 668                 return retval;
 669
 670         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
 671
 672 #define ISS_PASSWORD "I_know_what_I_am_doing"
 673
 674         lpc2900_info->risky = !strcmp( CMD_ARGV[1], ISS_PASSWORD );
 675
 676         if( !lpc2900_info->risky )
 677         {
 678                 command_print(CMD_CTX, "Wrong password (use '%s')", ISS_PASSWORD);
 679                 return ERROR_COMMAND_ARGUMENT_INVALID;
 680         }
 681
 682         command_print(CMD_CTX,
 683                   "Potentially dangerous operation allowed in next command!");
 684
 685         return ERROR_OK;
 686 }
 687
 688
 689
 690 /**
 691  * Write customer info from file to the index sector.
 692  */
 693 COMMAND_HANDLER(lpc2900_handle_write_custom_command)
 694 {
 695         if (CMD_ARGC < 2)
 696         {
 697                 return ERROR_COMMAND_SYNTAX_ERROR;
 698         }
 699
 700         struct flash_bank *bank;
 701         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 702         if (ERROR_OK != retval)
 703                 return retval;
 704
 705         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
 706
 707         /* Check if command execution is allowed. */
 708         if( !lpc2900_info->risky )
 709         {
 710                 command_print( CMD_CTX, "Command execution not allowed!" );
 711                 return ERROR_COMMAND_ARGUMENT_INVALID;
 712         }
 713         lpc2900_info->risky = 0;
 714
 715         /* Get target, and check if it's halted */
 716         struct target *target = bank->target;
 717         if (target->state != TARGET_HALTED)
 718         {
 719                 LOG_ERROR("Target not halted");
 720                 return ERROR_TARGET_NOT_HALTED;
 721         }
 722
 723         /* The image will always start at offset 0 */
 724         struct image image;
 725         image.base_address_set = 1;
 726         image.base_address = 0;
 727         image.start_address_set = 0;
 728
 729         const char *filename = CMD_ARGV[1];
 730         const char *type = (CMD_ARGC >= 3) ? CMD_ARGV[2] : NULL;
 731         retval = image_open(&image, filename, type);
 732         if (retval != ERROR_OK)
 733         {
 734                 return retval;
 735         }
 736
 737         /* Do a sanity check: The image must be exactly the size of the customer
 738            programmable area. Any other size is rejected. */
 739         if( image.num_sections != 1 )
 740         {
 741                 LOG_ERROR("Only one section allowed in image file.");
 742                 return ERROR_COMMAND_SYNTAX_ERROR;
 743         }
 744         if( (image.sections[0].base_address != 0) ||
 745         (image.sections[0].size != ISS_CUSTOMER_SIZE) )
 746         {
 747                 LOG_ERROR("Incorrect image file size. Expected %d, "
 748                         "got %" PRIu32,
 749                    ISS_CUSTOMER_SIZE, image.sections[0].size);
 750                 return ERROR_COMMAND_SYNTAX_ERROR;
 751         }
 752
 753         /* Well boys, I reckon this is it... */
 754
 755         /* Customer info is split into two blocks in pages 4 and 5. */
 756         uint8_t page[FLASH_PAGE_SIZE];
 757
 758         /* Page 4 */
 759         uint32_t offset = ISS_CUSTOMER_START1 % FLASH_PAGE_SIZE;
 760         memset( page, 0xff, FLASH_PAGE_SIZE );
 761         size_t size_read;
 762         retval = image_read_section( &image, 0, 0,
 763                                      ISS_CUSTOMER_SIZE1, &page[offset], &size_read);
 764         if( retval != ERROR_OK )
 765         {
 766                 LOG_ERROR("couldn't read from file '%s'", filename);
 767                 image_close(&image);
 768                 return retval;
 769         }
 770         if( (retval = lpc2900_write_index_page( bank, 4, &page )) != ERROR_OK )
 771         {
 772                 image_close(&image);
 773                 return retval;
 774         }
 775
 776         /* Page 5 */
 777         offset = ISS_CUSTOMER_START2 % FLASH_PAGE_SIZE;
 778         memset( page, 0xff, FLASH_PAGE_SIZE );
 779         retval = image_read_section( &image, 0, ISS_CUSTOMER_SIZE1,
 780                                      ISS_CUSTOMER_SIZE2, &page[offset], &size_read);
 781         if( retval != ERROR_OK )
 782         {
 783                 LOG_ERROR("couldn't read from file '%s'", filename);
 784                 image_close(&image);
 785                 return retval;
 786         }
 787         if( (retval = lpc2900_write_index_page( bank, 5, &page )) != ERROR_OK )
 788         {
 789                 image_close(&image);
 790                 return retval;
 791         }
 792
 793         image_close(&image);
 794
 795         return ERROR_OK;
 796 }
 797
 798
 799
 800 /**
 801  * Activate 'sector security' for a range of sectors.
 802  */
 803 COMMAND_HANDLER(lpc2900_handle_secure_sector_command)
 804 {
 805         if (CMD_ARGC < 3)
 806         {
 807                 return ERROR_COMMAND_SYNTAX_ERROR;
 808         }
 809
 810         /* Get the bank descriptor */
 811         struct flash_bank *bank;
 812         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 813         if (ERROR_OK != retval)
 814                 return retval;
 815
 816         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
 817
 818         /* Check if command execution is allowed. */
 819         if( !lpc2900_info->risky )
 820         {
 821                 command_print( CMD_CTX, "Command execution not allowed! "
 822                 "(use 'password' command first)");
 823                 return ERROR_COMMAND_ARGUMENT_INVALID;
 824         }
 825         lpc2900_info->risky = 0;
 826
 827         /* Read sector range, and do a sanity check. */
 828         int first, last;
 829         COMMAND_PARSE_NUMBER(int, CMD_ARGV[1], first);
 830         COMMAND_PARSE_NUMBER(int, CMD_ARGV[2], last);
 831         if( (first >= bank->num_sectors) ||
 832             (last >= bank->num_sectors) ||
 833             (first > last) )
 834         {
 835                 command_print( CMD_CTX, "Illegal sector range" );
 836                 return ERROR_COMMAND_ARGUMENT_INVALID;
 837         }
 838
 839         uint8_t page[FLASH_PAGE_SIZE];
 840         int sector;
 841
 842         /* Sectors in page 6 */
 843         if( (first <= 4) || (last >= 8) )
 844         {
 845                 memset( &page, 0xff, FLASH_PAGE_SIZE );
 846                 for( sector = first; sector <= last; sector++ )
 847                 {
 848                         if( sector <= 4 )
 849                         {
 850                                 memset( &page[0xB0 + 16*sector], 0, 16 );
 851                         }
 852                         else if( sector >= 8 )
 853                         {
 854                                 memset( &page[0x00 + 16*(sector - 8)], 0, 16 );
 855                         }
 856                 }
 857
 858                 if( (retval = lpc2900_write_index_page( bank, 6, &page )) != ERROR_OK )
 859                 {
 860                         LOG_ERROR("failed to update index sector page 6");
 861                         return retval;
 862                 }
 863         }
 864
 865         /* Sectors in page 7 */
 866         if( (first <= 7) && (last >= 5) )
 867         {
 868                 memset( &page, 0xff, FLASH_PAGE_SIZE );
 869                 for( sector = first; sector <= last; sector++ )
 870                 {
 871                         if( (sector >= 5) && (sector <= 7) )
 872                         {
 873                                 memset( &page[0x00 + 16*(sector - 5)], 0, 16 );
 874                         }
 875                 }
 876
 877                 if( (retval = lpc2900_write_index_page( bank, 7, &page )) != ERROR_OK )
 878                 {
 879                         LOG_ERROR("failed to update index sector page 7");
 880                         return retval;
 881                 }
 882         }
 883
 884         command_print( CMD_CTX,
 885                 "Sectors security will become effective after next power cycle");
 886
 887         /* Update the sector security status */
 888         if ( lpc2900_read_security_status(bank) != ERROR_OK )
 889         {
 890                 LOG_ERROR( "Cannot determine sector security status" );
 891                 return ERROR_FLASH_OPERATION_FAILED;
 892         }
 893
 894         return ERROR_OK;
 895 }
 896
 897
 898
 899 /**
 900  * Activate JTAG protection.
 901  */
 902 COMMAND_HANDLER(lpc2900_handle_secure_jtag_command)
 903 {
 904         if (CMD_ARGC < 1)
 905         {
 906                 return ERROR_COMMAND_SYNTAX_ERROR;
 907         }
 908
 909         /* Get the bank descriptor */
 910         struct flash_bank *bank;
 911         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 912         if (ERROR_OK != retval)
 913                 return retval;
 914
 915         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
 916
 917         /* Check if command execution is allowed. */
 918         if( !lpc2900_info->risky )
 919         {
 920                 command_print( CMD_CTX, "Command execution not allowed! "
 921                                         "(use 'password' command first)");
 922                 return ERROR_COMMAND_ARGUMENT_INVALID;
 923         }
 924         lpc2900_info->risky = 0;
 925
 926         /* Prepare page */
 927         uint8_t page[FLASH_PAGE_SIZE];
 928         memset( &page, 0xff, FLASH_PAGE_SIZE );
 929
 930
 931         /* Insert "soft" protection word */
 932         page[0x30 + 15] = 0x7F;
 933         page[0x30 + 11] = 0x7F;
 934         page[0x30 +  7] = 0x7F;
 935         page[0x30 +  3] = 0x7F;
 936
 937         /* Write to page 5 */
 938         if( (retval = lpc2900_write_index_page( bank, 5, &page ))
 939                         != ERROR_OK )
 940         {
 941                 LOG_ERROR("failed to update index sector page 5");
 942                 return retval;
 943         }
 944
 945         LOG_INFO("JTAG security set. Good bye!");
 946
 947         return ERROR_OK;
 948 }
 949
 950
 951
 952 /***********************  Flash interface functions  **************************/
 953
 954 static const struct command_registration lpc2900_exec_command_handlers[] = {
 955         {
 956                 .name = "signature",
 957                 .handler = lpc2900_handle_signature_command,
 958                 .mode = COMMAND_EXEC,
 959                 .usage = "bank_id",
 960                 .help = "Calculate and display signature of flash bank.",
 961         },
 962         {
 963                 .name = "read_custom",
 964                 .handler = lpc2900_handle_read_custom_command,
 965                 .mode = COMMAND_EXEC,
 966                 .usage = "bank_id filename",
 967                 .help = "Copies 912 bytes of customer information "
 968                         "from index sector into file.",
 969         },
 970         {
 971                 .name = "password",
 972                 .handler = lpc2900_handle_password_command,
 973                 .mode = COMMAND_EXEC,
 974                 .usage = "bank_id password",
 975                 .help = "Enter fixed password to enable 'dangerous' options.",
 976         },
 977         {
 978                 .name = "write_custom",
 979                 .handler = lpc2900_handle_write_custom_command,
 980                 .mode = COMMAND_EXEC,
 981                 .usage = "bank_id filename ('bin'|'ihex'|'elf'|'s19')",
 982                 .help = "Copies 912 bytes of customer info from file "
 983                         "to index sector.",
 984         },
 985         {
 986                 .name = "secure_sector",
 987                 .handler = lpc2900_handle_secure_sector_command,
 988                 .mode = COMMAND_EXEC,
 989                 .usage = "bank_id first_sector last_sector",
 990                 .help = "Activate sector security for a range of sectors.  "
 991                         "It will be effective after a power cycle.",
 992         },
 993         {
 994                 .name = "secure_jtag",
 995                 .handler = lpc2900_handle_secure_jtag_command,
 996                 .mode = COMMAND_EXEC,
 997                 .usage = "bank_id",
 998                 .help = "Disable the JTAG port.  "
 999                         "It will be effective after a power cycle.",
1000         },
1001         COMMAND_REGISTRATION_DONE
1002 };
1003 static const struct command_registration lpc2900_command_handlers[] = {
1004         {
1005                 .name = "lpc2900",
1006                 .mode = COMMAND_ANY,
1007                 .help = "LPC2900 flash command group",
1008                 .chain = lpc2900_exec_command_handlers,
1009         },
1010         COMMAND_REGISTRATION_DONE
1011 };
1012
1013 /// Evaluate flash bank command.
1014 FLASH_BANK_COMMAND_HANDLER(lpc2900_flash_bank_command)
1015 {
1016         struct lpc2900_flash_bank *lpc2900_info;
1017
1018         if (CMD_ARGC < 6)
1019         {
1020                 LOG_WARNING("incomplete flash_bank LPC2900 configuration");
1021                 return ERROR_FLASH_BANK_INVALID;
1022         }
1023
1024         lpc2900_info = malloc(sizeof(struct lpc2900_flash_bank));
1025         bank->driver_priv = lpc2900_info;
1026
1027         /* Get flash clock.
1028          * Reject it if we can't meet the requirements for program time
1029          * (if clock too slow), or for erase time (clock too fast).
1030          */
1031         uint32_t clk_sys_fmc;
1032         COMMAND_PARSE_NUMBER(u32, CMD_ARGV[6], clk_sys_fmc);
1033         lpc2900_info->clk_sys_fmc = clk_sys_fmc * 1000;
1034
1035         uint32_t clock_limit;
1036         /* Check program time limit */
1037         clock_limit = 512000000l / FLASH_PROGRAM_TIME;
1038         if (lpc2900_info->clk_sys_fmc < clock_limit)
1039         {
1040                 LOG_WARNING("flash clock must be at least %" PRIu32 " kHz",
1041                     (clock_limit / 1000));
1042                 return ERROR_FLASH_BANK_INVALID;
1043         }
1044
1045         /* Check erase time limit */
1046         clock_limit = (uint32_t)((32767.0 * 512.0 * 1e6) / FLASH_ERASE_TIME);
1047         if (lpc2900_info->clk_sys_fmc > clock_limit)
1048         {
1049                 LOG_WARNING("flash clock must be a maximum of %" PRIu32" kHz",
1050                     (clock_limit / 1000));
1051                 return ERROR_FLASH_BANK_INVALID;
1052         }
1053
1054         /* Chip ID will be obtained by probing the device later */
1055         lpc2900_info->chipid = 0;
1056         lpc2900_info->is_probed = false;
1057
1058         return ERROR_OK;
1059 }
1060
1061
1062 /**
1063  * Erase sector(s).
1064  *
1065  * @param bank Pointer to the flash bank descriptor
1066  * @param first First sector to be erased
1067  * @param last Last sector (including) to be erased
1068  */
1069 static int lpc2900_erase(struct flash_bank *bank, int first, int last)
1070 {
1071         uint32_t status;
1072         int sector;
1073         int last_unsecured_sector;
1074         struct target *target = bank->target;
1075         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
1076
1077
1078         status = lpc2900_is_ready(bank);
1079         if (status != ERROR_OK)
1080         {
1081                 return status;
1082         }
1083
1084         /* Sanity check on sector range */
1085         if ((first < 0) || (last < first) || (last >= bank->num_sectors))
1086         {
1087                 LOG_INFO("Bad sector range");
1088                 return ERROR_FLASH_SECTOR_INVALID;
1089         }
1090
1091         /* Update the info about secured sectors */
1092         lpc2900_read_security_status( bank );
1093
1094         /* The selected sector range might include secured sectors. An attempt
1095          * to erase such a sector will cause the erase to fail also for unsecured
1096          * sectors. It is necessary to determine the last unsecured sector now,
1097          * because we have to treat the last relevant sector in the list in
1098          * a special way.
1099          */
1100         last_unsecured_sector = -1;
1101         for (sector = first; sector <= last; sector++)
1102         {
1103                 if ( !bank->sectors[sector].is_protected )
1104                 {
1105                         last_unsecured_sector = sector;
1106                 }
1107         }
1108
1109         /* Exit now, in case of the rare constellation where all sectors in range
1110          * are secured. This is regarded a success, since erasing/programming of
1111          * secured sectors shall be handled transparently.
1112          */
1113         if ( last_unsecured_sector == -1 )
1114         {
1115                 return ERROR_OK;
1116         }
1117
1118         /* Enable flash block and set the correct CRA clock of 66 kHz */
1119         lpc2900_setup(bank);
1120
1121         /* Clear END_OF_ERASE interrupt status */
1122         target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_ERASE);
1123
1124         /* Set the program/erase timer to FLASH_ERASE_TIME */
1125         target_write_u32(target, FPTR,
1126                          FPTR_EN_T | lpc2900_calc_tr( lpc2900_info->clk_sys_fmc,
1127                                                       FLASH_ERASE_TIME ));
1128
1129         /* Sectors are marked for erasure, then erased all together */
1130         for (sector = first; sector <= last_unsecured_sector; sector++)
1131         {
1132                 /* Only mark sectors that aren't secured. Any attempt to erase a group
1133                  * of sectors will fail if any single one of them is secured!
1134                  */
1135                 if ( !bank->sectors[sector].is_protected )
1136                 {
1137                         /* Unprotect the sector */
1138                         target_write_u32(target, bank->sectors[sector].offset, 0);
1139                         target_write_u32(target, FCTR,
1140                                          FCTR_FS_LOADREQ | FCTR_FS_WPB |
1141                                          FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
1142
1143                         /* Mark the sector for erasure. The last sector in the list
1144                            triggers the erasure. */
1145                         target_write_u32(target, bank->sectors[sector].offset, 0);
1146                         if ( sector == last_unsecured_sector )
1147                         {
1148                                 target_write_u32(target, FCTR,
1149                                                  FCTR_FS_PROGREQ | FCTR_FS_WPB | FCTR_FS_CS);
1150                         }
1151                         else
1152                         {
1153                                 target_write_u32(target, FCTR,
1154                                                  FCTR_FS_LOADREQ | FCTR_FS_WPB |
1155                                                  FCTR_FS_WEB | FCTR_FS_CS);
1156                         }
1157                 }
1158         }
1159
1160         /* Wait for the end of the erase operation. If it's not over after two seconds,
1161          * something went dreadfully wrong... :-(
1162          */
1163         if( lpc2900_wait_status(bank, INTSRC_END_OF_ERASE, 2000) != ERROR_OK )
1164         {
1165                 return ERROR_FLASH_OPERATION_FAILED;
1166         }
1167
1168         /* Normal flash operating mode */
1169         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1170
1171         return ERROR_OK;
1172 }
1173
1174
1175
1176 static int lpc2900_protect(struct flash_bank *bank, int set, int first, int last)
1177 {
1178         /* This command is not supported.
1179      * "Protection" in LPC2900 terms is handled transparently. Sectors will
1180      * automatically be unprotected as needed.
1181      * Instead we use the concept of sector security. A secured sector is shown
1182      * as "protected" in OpenOCD. Sector security is a permanent feature, and
1183      * cannot be disabled once activated.
1184      */
1185
1186         return ERROR_OK;
1187 }
1188
1189
1190 /**
1191  * Write data to flash.
1192  *
1193  * @param bank Pointer to the flash bank descriptor
1194  * @param buffer Buffer with data
1195  * @param offset Start address (relative to bank start)
1196  * @param count Number of bytes to be programmed
1197  */
1198 static int lpc2900_write(struct flash_bank *bank, uint8_t *buffer,
1199                          uint32_t offset, uint32_t count)
1200 {
1201         uint8_t page[FLASH_PAGE_SIZE];
1202         uint32_t status;
1203         uint32_t num_bytes;
1204         struct target *target = bank->target;
1205         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
1206         int sector;
1207         int retval;
1208
1209         static const uint32_t write_target_code[] = {
1210                 /* Set auto latch mode: FCTR=CS|WRE|WEB */
1211                 0xe3a0a007,   /* loop       mov r10, #0x007 */
1212                 0xe583a000,   /*            str r10,[r3,#0] */
1213
1214                 /* Load complete page into latches */
1215                 0xe3a06020,   /*            mov r6,#(512/16) */
1216                 0xe8b00f00,   /* next       ldmia r0!,{r8-r11} */
1217                 0xe8a10f00,   /*            stmia r1!,{r8-r11} */
1218                 0xe2566001,   /*            subs r6,#1 */
1219                 0x1afffffb,   /*            bne next */
1220
1221                 /* Clear END_OF_BURN interrupt status */
1222                 0xe3a0a002,   /*            mov r10,#(1 << 1) */
1223                 0xe583afe8,   /*            str r10,[r3,#0xfe8] */
1224
1225                 /* Set the erase time to FLASH_PROGRAM_TIME */
1226                 0xe5834008,   /*            str r4,[r3,#8] */
1227
1228                 /* Trigger flash write
1229                         FCTR = CS | WRE | WPB | PROGREQ */
1230                 0xe3a0a083,   /*            mov r10,#0x83 */
1231                 0xe38aaa01,   /*            orr r10,#0x1000 */
1232                 0xe583a000,   /*            str r10,[r3,#0] */
1233
1234                 /* Wait for end of burn */
1235                 0xe593afe0,   /* wait       ldr r10,[r3,#0xfe0] */
1236                 0xe21aa002,   /*            ands r10,#(1 << 1) */
1237                 0x0afffffc,   /*            beq wait */
1238
1239                 /* End? */
1240                 0xe2522001,   /*            subs r2,#1 */
1241                 0x1affffed,   /*            bne loop */
1242
1243                 0xeafffffe    /* done       b done */
1244         };
1245
1246
1247         status = lpc2900_is_ready(bank);
1248         if (status != ERROR_OK)
1249         {
1250                 return status;
1251         }
1252
1253         /* Enable flash block and set the correct CRA clock of 66 kHz */
1254         lpc2900_setup(bank);
1255
1256         /* Update the info about secured sectors */
1257         lpc2900_read_security_status( bank );
1258
1259         /* Unprotect all involved sectors */
1260         for (sector = 0; sector < bank->num_sectors; sector++)
1261         {
1262                 /* Start address in or before this sector? */
1263                 /* End address in or behind this sector? */
1264                 if ( ((bank->base + offset) <
1265                           (bank->sectors[sector].offset + bank->sectors[sector].size)) &&
1266                      ((bank->base + (offset + count - 1)) >= bank->sectors[sector].offset) )
1267                 {
1268                         /* This sector is involved and needs to be unprotected.
1269                                 * Don't do it for secured sectors.
1270                                 */
1271                         if ( !bank->sectors[sector].is_protected )
1272                         {
1273                                 target_write_u32(target, bank->sectors[sector].offset, 0);
1274                                 target_write_u32(target, FCTR,
1275                                                  FCTR_FS_LOADREQ | FCTR_FS_WPB |
1276                                                  FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
1277                         }
1278                 }
1279         }
1280
1281         /* Set the program/erase time to FLASH_PROGRAM_TIME */
1282         uint32_t prog_time = FPTR_EN_T | lpc2900_calc_tr( lpc2900_info->clk_sys_fmc,
1283                                                           FLASH_PROGRAM_TIME );
1284
1285         /* If there is a working area of reasonable size, use it to program via
1286            a target algorithm. If not, fall back to host programming. */
1287
1288         /* We need some room for target code. */
1289         uint32_t target_code_size = sizeof(write_target_code);
1290
1291         /* Try working area allocation. Start with a large buffer, and try with
1292            reduced size if that fails. */
1293         struct working_area *warea;
1294         uint32_t buffer_size = lpc2900_info->max_ram_block - 1 * KiB;
1295         while( (retval = target_alloc_working_area_try(target,
1296                                                    buffer_size + target_code_size,
1297                                                    &warea)) != ERROR_OK )
1298         {
1299                 /* Try a smaller buffer now, and stop if it's too small. */
1300                 buffer_size -= 1 * KiB;
1301                 if (buffer_size < 2 * KiB)
1302                 {
1303                         LOG_INFO( "no (large enough) working area"
1304                                   ", falling back to host mode" );
1305                         warea = NULL;
1306                         break;
1307                 }
1308         };
1309
1310         if( warea )
1311         {
1312                 struct reg_param reg_params[5];
1313                 struct arm_algorithm armv4_5_info;
1314
1315                 /* We can use target mode. Download the algorithm. */
1316                 retval = target_write_buffer( target,
1317                                               (warea->address)+buffer_size,
1318                                               target_code_size,
1319                                               (uint8_t *)write_target_code);
1320                 if (retval != ERROR_OK)
1321                 {
1322                         LOG_ERROR("Unable to write block write code to target");
1323                         target_free_all_working_areas(target);
1324                         return ERROR_FLASH_OPERATION_FAILED;
1325                 }
1326
1327                 init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT);
1328                 init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);
1329                 init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);
1330                 init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);
1331                 init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT);
1332
1333                 /* Write to flash in large blocks */
1334                 while ( count != 0 )
1335                 {
1336                         uint32_t this_npages;
1337                         uint8_t *this_buffer;
1338                         int start_sector = lpc2900_address2sector( bank, offset );
1339
1340                         /* First page / last page / rest */
1341                         if( offset % FLASH_PAGE_SIZE )
1342                         {
1343                                 /* Block doesn't start on page boundary.
1344                                    Burn first partial page separately. */
1345                                 memset( &page, 0xff, sizeof(page) );
1346                                 memcpy( &page[offset % FLASH_PAGE_SIZE],
1347                                         buffer,
1348                                         FLASH_PAGE_SIZE - (offset % FLASH_PAGE_SIZE) );
1349                                 this_npages = 1;
1350                                 this_buffer = &page[0];
1351                                 count = count + (offset % FLASH_PAGE_SIZE);
1352                                 offset = offset - (offset % FLASH_PAGE_SIZE);
1353                         }
1354                         else if( count < FLASH_PAGE_SIZE )
1355                         {
1356                                 /* Download last incomplete page separately. */
1357                                 memset( &page, 0xff, sizeof(page) );
1358                                 memcpy( &page, buffer, count );
1359                                 this_npages = 1;
1360                                 this_buffer = &page[0];
1361                                 count = FLASH_PAGE_SIZE;
1362                         }
1363                         else
1364                         {
1365                                 /* Download as many full pages as possible */
1366                                 this_npages = (count < buffer_size) ?
1367                                                count / FLASH_PAGE_SIZE :
1368                                                buffer_size / FLASH_PAGE_SIZE;
1369                                 this_buffer = buffer;
1370
1371                                 /* Make sure we stop at the next secured sector */
1372                                 sector = start_sector + 1;
1373                                 while( sector < bank->num_sectors )
1374                                 {
1375                                         /* Secured? */
1376                                         if( bank->sectors[sector].is_protected )
1377                                         {
1378                                                 /* Is that next sector within the current block? */
1379                                                 if( (bank->sectors[sector].offset - bank->base) <
1380                                                         (offset + (this_npages * FLASH_PAGE_SIZE)) )
1381                                                 {
1382                                                         /* Yes! Split the block */
1383                                                         this_npages =
1384                                                           (bank->sectors[sector].offset - bank->base - offset)
1385                                                               / FLASH_PAGE_SIZE;
1386                                                         break;
1387                                                 }
1388                                         }
1389
1390                                         sector++;
1391                                 }
1392                         }
1393
1394                         /* Skip the current sector if it is secured */
1395                         if (bank->sectors[start_sector].is_protected)
1396                         {
1397                                 LOG_DEBUG("Skip secured sector %d",
1398                                                 start_sector);
1399
1400                                 /* Stop if this is the last sector */
1401                                 if (start_sector == bank->num_sectors - 1)
1402                                 {
1403                                         break;
1404                                 }
1405
1406                                 /* Skip */
1407                                 uint32_t nskip = bank->sectors[start_sector].size -
1408                                                  (offset % bank->sectors[start_sector].size);
1409                                 offset += nskip;
1410                                 buffer += nskip;
1411                                 count = (count >= nskip) ? (count - nskip) : 0;
1412                                 continue;
1413                         }
1414
1415                         /* Execute buffer download */
1416                         if ((retval = target_write_buffer(target,
1417                                                           warea->address,
1418                                                           this_npages * FLASH_PAGE_SIZE,
1419                                                           this_buffer)) != ERROR_OK)
1420                         {
1421                                 LOG_ERROR("Unable to write data to target");
1422                                 target_free_all_working_areas(target);
1423                                 return ERROR_FLASH_OPERATION_FAILED;
1424                         }
1425
1426                         /* Prepare registers */
1427                         buf_set_u32(reg_params[0].value, 0, 32, warea->address);
1428                         buf_set_u32(reg_params[1].value, 0, 32, offset);
1429                         buf_set_u32(reg_params[2].value, 0, 32, this_npages);
1430                         buf_set_u32(reg_params[3].value, 0, 32, FCTR);
1431                         buf_set_u32(reg_params[4].value, 0, 32, FPTR_EN_T | prog_time);
1432
1433                         /* Execute algorithm, assume breakpoint for last instruction */
1434                         armv4_5_info.common_magic = ARM_COMMON_MAGIC;
1435                         armv4_5_info.core_mode = ARM_MODE_SVC;
1436                         armv4_5_info.core_state = ARM_STATE_ARM;
1437
1438                         retval = target_run_algorithm(target, 0, NULL, 5, reg_params,
1439                                 (warea->address) + buffer_size,
1440                                 (warea->address) + buffer_size + target_code_size - 4,
1441                                 10000, /* 10s should be enough for max. 16 KiB of data */
1442                                 &armv4_5_info);
1443
1444                         if (retval != ERROR_OK)
1445                         {
1446                                 LOG_ERROR("Execution of flash algorithm failed.");
1447                                 target_free_all_working_areas(target);
1448                                 retval = ERROR_FLASH_OPERATION_FAILED;
1449                                 break;
1450                         }
1451
1452                         count -= this_npages * FLASH_PAGE_SIZE;
1453                         buffer += this_npages * FLASH_PAGE_SIZE;
1454                         offset += this_npages * FLASH_PAGE_SIZE;
1455                 }
1456
1457                 /* Free all resources */
1458                 destroy_reg_param(&reg_params[0]);
1459                 destroy_reg_param(&reg_params[1]);
1460                 destroy_reg_param(&reg_params[2]);
1461                 destroy_reg_param(&reg_params[3]);
1462                 destroy_reg_param(&reg_params[4]);
1463                 target_free_all_working_areas(target);
1464         }
1465         else
1466         {
1467                 /* Write to flash memory page-wise */
1468                 while ( count != 0 )
1469                 {
1470                         /* How many bytes do we copy this time? */
1471                         num_bytes = (count >= FLASH_PAGE_SIZE) ?
1472                                     FLASH_PAGE_SIZE - (offset % FLASH_PAGE_SIZE) :
1473                                     count;
1474
1475                         /* Don't do anything with it if the page is in a secured sector. */
1476                         if ( !bank->sectors[lpc2900_address2sector(bank, offset)].is_protected )
1477                         {
1478                                 /* Set latch load mode */
1479                                 target_write_u32(target, FCTR,
1480                                                  FCTR_FS_CS | FCTR_FS_WRE | FCTR_FS_WEB);
1481
1482                                 /* Always clear the buffer (a little overhead, but who cares) */
1483                                 memset(page, 0xFF, FLASH_PAGE_SIZE);
1484
1485                                 /* Copy them to the buffer */
1486                                 memcpy( &page[offset % FLASH_PAGE_SIZE],
1487                                         &buffer[offset % FLASH_PAGE_SIZE],
1488                                         num_bytes );
1489
1490                                 /* Write whole page to flash data latches */
1491                                 if (target_write_memory(
1492                                                  target,
1493                                                  bank->base + (offset - (offset % FLASH_PAGE_SIZE)),
1494                                                  4, FLASH_PAGE_SIZE / 4, page) != ERROR_OK)
1495                                 {
1496                                         LOG_ERROR("Write failed @ 0x%8.8" PRIx32, offset);
1497                                         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1498
1499                                         return ERROR_FLASH_OPERATION_FAILED;
1500                                 }
1501
1502                                 /* Clear END_OF_BURN interrupt status */
1503                                 target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_BURN);
1504
1505                                 /* Set the programming time */
1506                                 target_write_u32(target, FPTR, FPTR_EN_T | prog_time);
1507
1508                                 /* Trigger flash write */
1509                                 target_write_u32(target, FCTR,
1510                                     FCTR_FS_CS | FCTR_FS_WRE | FCTR_FS_WPB | FCTR_FS_PROGREQ);
1511
1512                                 /* Wait for the end of the write operation. If it's not over
1513                                  * after one second, something went dreadfully wrong... :-(
1514                                  */
1515                                 if (lpc2900_wait_status(bank, INTSRC_END_OF_BURN, 1000) != ERROR_OK)
1516                                 {
1517                                         LOG_ERROR("Write failed @ 0x%8.8" PRIx32, offset);
1518                                         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1519
1520                                         return ERROR_FLASH_OPERATION_FAILED;
1521                                 }
1522                         }
1523
1524                         /* Update pointers and counters */
1525                         offset += num_bytes;
1526                         buffer += num_bytes;
1527                         count -= num_bytes;
1528                 }
1529
1530                 retval = ERROR_OK;
1531         }
1532
1533         /* Normal flash operating mode */
1534         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1535
1536         return retval;
1537 }
1538
1539
1540 /**
1541  * Try and identify the device.
1542  *
1543  * Determine type number and its memory layout.
1544  *
1545  * @param bank Pointer to the flash bank descriptor
1546  */
1547 static int lpc2900_probe(struct flash_bank *bank)
1548 {
1549         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
1550         struct target *target = bank->target;
1551         int i = 0;
1552         uint32_t offset;
1553
1554
1555         if (target->state != TARGET_HALTED)
1556         {
1557                 LOG_ERROR("Target not halted");
1558                 return ERROR_TARGET_NOT_HALTED;
1559         }
1560
1561         /* We want to do this only once. */
1562         if (lpc2900_info->is_probed)
1563         {
1564                 return ERROR_OK;
1565         }
1566
1567         /* Probing starts with reading the CHIPID register. We will continue only
1568          * if this identifies as an LPC2900 device.
1569          */
1570         target_read_u32(target, CHIPID, &lpc2900_info->chipid);
1571
1572         if (lpc2900_info->chipid != EXPECTED_CHIPID)
1573         {
1574                 LOG_WARNING("Device is not an LPC29xx");
1575                 return ERROR_FLASH_OPERATION_FAILED;
1576         }
1577
1578         /* It's an LPC29xx device. Now read the feature register FEAT0...FEAT3. */
1579         uint32_t feat0, feat1, feat2, feat3;
1580         target_read_u32(target, FEAT0, &feat0);
1581         target_read_u32(target, FEAT1, &feat1);
1582         target_read_u32(target, FEAT2, &feat2);
1583         target_read_u32(target, FEAT3, &feat3);
1584
1585         /* Base address */
1586         bank->base = 0x20000000;
1587
1588         /* Determine flash layout from FEAT2 register */
1589         uint32_t num_64k_sectors = (feat2 >> 16) & 0xFF;
1590         uint32_t num_8k_sectors = (feat2 >> 0) & 0xFF;
1591         bank->num_sectors = num_64k_sectors + num_8k_sectors;
1592         bank->size = KiB * (64 * num_64k_sectors + 8 * num_8k_sectors);
1593
1594         /* Determine maximum contiguous RAM block */
1595         lpc2900_info->max_ram_block = 16 * KiB;
1596         if( (feat1 & 0x30) == 0x30 )
1597         {
1598                 lpc2900_info->max_ram_block = 32 * KiB;
1599                 if( (feat1 & 0x0C) == 0x0C )
1600                 {
1601                         lpc2900_info->max_ram_block = 48 * KiB;
1602                 }
1603         }
1604
1605         /* Determine package code and ITCM size */
1606         uint32_t package_code = feat0 & 0x0F;
1607         uint32_t itcm_code = (feat1 >> 16) & 0x1F;
1608
1609         /* Determine the exact type number. */
1610         uint32_t found = 1;
1611         if ( (package_code == 4) && (itcm_code == 5) )
1612         {
1613                 /* Old LPC2917 or LPC2919 (non-/01 devices) */
1614                 lpc2900_info->target_name = (bank->size == 768*KiB) ? "LPC2919" : "LPC2917";
1615         }
1616         else
1617         {
1618                 if ( package_code == 2 )
1619                 {
1620                         /* 100-pin package */
1621                         if ( bank->size == 128*KiB )
1622                         {
1623                                 lpc2900_info->target_name = "LPC2921";
1624                         }
1625                         else if ( bank->size == 256*KiB )
1626                         {
1627                                 lpc2900_info->target_name = "LPC2923";
1628                         }
1629                         else if ( bank->size == 512*KiB )
1630                         {
1631                                 lpc2900_info->target_name = "LPC2925";
1632                         }
1633                         else
1634                         {
1635                                 found = 0;
1636                         }
1637                 }
1638                 else if ( package_code == 4 )
1639                 {
1640                         /* 144-pin package */
1641                         if ( (bank->size == 256*KiB) && (feat3 == 0xFFFFFFE9) )
1642                         {
1643                                 lpc2900_info->target_name = "LPC2926";
1644                         }
1645                         else if ( (bank->size == 512*KiB) && (feat3 == 0xFFFFFCF0) )
1646                         {
1647                                 lpc2900_info->target_name = "LPC2917/01";
1648                         }
1649                         else if ( (bank->size == 512*KiB) && (feat3 == 0xFFFFFFF1) )
1650                         {
1651                                 lpc2900_info->target_name = "LPC2927";
1652                         }
1653                         else if ( (bank->size == 768*KiB) && (feat3 == 0xFFFFFCF8) )
1654                         {
1655                                 lpc2900_info->target_name = "LPC2919/01";
1656                         }
1657                         else if ( (bank->size == 768*KiB) && (feat3 == 0xFFFFFFF9) )
1658                         {
1659                                 lpc2900_info->target_name = "LPC2929";
1660                         }
1661                         else
1662                         {
1663                                 found = 0;
1664                         }
1665                 }
1666                 else if ( package_code == 5 )
1667                 {
1668                         /* 208-pin package */
1669                         lpc2900_info->target_name = (bank->size == 0) ? "LPC2930" : "LPC2939";
1670                 }
1671                 else
1672                 {
1673                         found = 0;
1674                 }
1675         }
1676
1677         if ( !found )
1678         {
1679                 LOG_WARNING("Unknown LPC29xx derivative"
1680                             " (FEATx="
1681                             "%08" PRIx32 ":%08" PRIx32 ":%08" PRIx32 ":%08" PRIx32 ")",
1682                                         feat0, feat1, feat2, feat3
1683                                         );
1684                 return ERROR_FLASH_OPERATION_FAILED;
1685         }
1686
1687         /* Show detected device */
1688         LOG_INFO("Flash bank %d"
1689                  ": Device %s, %" PRIu32
1690                  " KiB in %d sectors",
1691                  bank->bank_number,
1692                  lpc2900_info->target_name, bank->size / KiB,
1693                  bank->num_sectors);
1694
1695         /* Flashless devices cannot be handled */
1696         if ( bank->num_sectors == 0 )
1697         {
1698                 LOG_WARNING("Flashless device cannot be handled");
1699                 return ERROR_FLASH_OPERATION_FAILED;
1700         }
1701
1702         /* Sector layout.
1703          * These are logical sector numbers. When doing real flash operations,
1704          * the logical flash number are translated into the physical flash numbers
1705          * of the device.
1706          */
1707         bank->sectors = malloc(sizeof(struct flash_sector) * bank->num_sectors);
1708
1709         offset = 0;
1710         for (i = 0; i < bank->num_sectors; i++)
1711         {
1712                 bank->sectors[i].offset = offset;
1713                 bank->sectors[i].is_erased = -1;
1714                 bank->sectors[i].is_protected = -1;
1715
1716                 if ( i <= 7 )
1717                 {
1718                         bank->sectors[i].size = 8 * KiB;
1719                 }
1720                 else if ( i <= 18 )
1721                 {
1722                         bank->sectors[i].size = 64 * KiB;
1723                 }
1724                 else
1725                 {
1726                         /* We shouldn't come here. But there might be a new part out there
1727                          * that has more than 19 sectors. Politely ask for a fix then.
1728                          */
1729                         bank->sectors[i].size = 0;
1730                         LOG_ERROR("Never heard about sector %d", i);
1731                 }
1732
1733                 offset += bank->sectors[i].size;
1734         }
1735
1736         lpc2900_info->is_probed = true;
1737
1738         /* Read sector security status */
1739         if ( lpc2900_read_security_status(bank) != ERROR_OK )
1740         {
1741                 LOG_ERROR("Cannot determine sector security status");
1742                 return ERROR_FLASH_OPERATION_FAILED;
1743         }
1744
1745         return ERROR_OK;
1746 }
1747
1748
1749 /**
1750  * Run a blank check for each sector.
1751  *
1752  * For speed reasons, the device isn't read word by word.
1753  * A hash value is calculated by the hardware ("BIST") for each sector.
1754  * This value is then compared against the known hash of an empty sector.
1755  *
1756  * @param bank Pointer to the flash bank descriptor
1757  */
1758 static int lpc2900_erase_check(struct flash_bank *bank)
1759 {
1760         uint32_t status = lpc2900_is_ready(bank);
1761         if (status != ERROR_OK)
1762         {
1763                 LOG_INFO("Processor not halted/not probed");
1764                 return status;
1765         }
1766
1767         /* Use the BIST (Built-In Selft Test) to generate a signature of each flash
1768          * sector. Compare against the expected signature of an empty sector.
1769          */
1770         int sector;
1771         for ( sector = 0; sector < bank->num_sectors; sector++ )
1772         {
1773                 uint32_t signature[4];
1774                 if ( (status = lpc2900_run_bist128( bank,
1775                                                     bank->sectors[sector].offset,
1776                                                     bank->sectors[sector].offset +
1777                                                        (bank->sectors[sector].size - 1),
1778                                                     &signature)) != ERROR_OK )
1779                 {
1780                         return status;
1781                 }
1782
1783                 /* The expected signatures for an empty sector are different
1784                  * for 8 KiB and 64 KiB sectors.
1785                  */
1786                 if ( bank->sectors[sector].size == 8*KiB )
1787                 {
1788                         bank->sectors[sector].is_erased =
1789                             (signature[3] == 0x01ABAAAA) &&
1790                             (signature[2] == 0xAAAAAAAA) &&
1791                             (signature[1] == 0xAAAAAAAA) &&
1792                             (signature[0] == 0xAAA00AAA);
1793                 }
1794                 if ( bank->sectors[sector].size == 64*KiB )
1795                 {
1796                         bank->sectors[sector].is_erased =
1797                             (signature[3] == 0x11801222) &&
1798                             (signature[2] == 0xB88844FF) &&
1799                             (signature[1] == 0x11A22008) &&
1800                             (signature[0] == 0x2B1BFE44);
1801                 }
1802         }
1803
1804         return ERROR_OK;
1805 }
1806
1807
1808 /**
1809  * Get protection (sector security) status.
1810  *
1811  * Determine the status of "sector security" for each sector.
1812  * A secured sector is one that can never be erased/programmed again.
1813  *
1814  * @param bank Pointer to the flash bank descriptor
1815  */
1816 static int lpc2900_protect_check(struct flash_bank *bank)
1817 {
1818         return lpc2900_read_security_status(bank);
1819 }
1820
1821
1822 /**
1823  * Print info about the driver (not the device).
1824  *
1825  * @param bank Pointer to the flash bank descriptor
1826  * @param buf Buffer to take the string
1827  * @param buf_size Maximum number of characters that the buffer can take
1828  */
1829 static int lpc2900_info(struct flash_bank *bank, char *buf, int buf_size)
1830 {
1831         snprintf(buf, buf_size, "lpc2900 flash driver");
1832
1833         return ERROR_OK;
1834 }
1835
1836
1837 struct flash_driver lpc2900_flash =
1838 {
1839         .name               = "lpc2900",
1840         .commands           = lpc2900_command_handlers,
1841         .flash_bank_command = lpc2900_flash_bank_command,
1842         .erase              = lpc2900_erase,
1843         .protect            = lpc2900_protect,
1844         .write              = lpc2900_write,
1845         .read               = default_flash_read,
1846         .probe              = lpc2900_probe,
1847         .auto_probe         = lpc2900_probe,
1848         .erase_check        = lpc2900_erase_check,
1849         .protect_check      = lpc2900_protect_check,
1850         .info               = lpc2900_info
1851 };