git.gag.com Git - fw/openocd/blob - src/flash/nor/lpc2900.c

   1 /***************************************************************************
   2  *   Copyright (C) 2009 by                                                 *
   3  *   Rolf Meeser <rolfm_9dq@yahoo.de>                                      *
   4  *                                                                         *
   5  *   This program is free software; you can redistribute it and/or modify  *
   6  *   it under the terms of the GNU General Public License as published by  *
   7  *   the Free Software Foundation; either version 2 of the License, or     *
   8  *   (at your option) any later version.                                   *
   9  *                                                                         *
  10  *   This program is distributed in the hope that it will be useful,       *
  11  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  12  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  13  *   GNU General Public License for more details.                          *
  14  *                                                                         *
  15  *   You should have received a copy of the GNU General Public License     *
  16  *   along with this program; if not, write to the                         *
  17  *   Free Software Foundation, Inc.,                                       *
  18  *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  19  ***************************************************************************/
  20
  21 #ifdef HAVE_CONFIG_H
  22 #include "config.h"
  23 #endif
  24
  25 #include "imp.h"
  26 #include <helper/binarybuffer.h>
  27 #include <target/algorithm.h>
  28 #include <target/arm.h>
  29 #include <target/image.h>
  30
  31 /* 1024 bytes */
  32 #define KiB                 1024
  33
  34 /* Some flash constants */
  35 #define FLASH_PAGE_SIZE     512         /* bytes */
  36 #define FLASH_ERASE_TIME    100000      /* microseconds */
  37 #define FLASH_PROGRAM_TIME  1000        /* microseconds */
  38
  39 /* Chip ID / Feature Registers */
  40 #define CHIPID          0xE0000000      /* Chip ID */
  41 #define FEAT0           0xE0000100      /* Chip feature 0 */
  42 #define FEAT1           0xE0000104      /* Chip feature 1 */
  43 #define FEAT2           0xE0000108      /* Chip feature 2 (contains flash size indicator) */
  44 #define FEAT3           0xE000010C      /* Chip feature 3 */
  45
  46 #define EXPECTED_CHIPID 0x209CE02B      /* Chip ID of all LPC2900 devices */
  47
  48 /* Flash/EEPROM Control Registers */
  49 #define FCTR            0x20200000      /* Flash control */
  50 #define FPTR            0x20200008      /* Flash program-time */
  51 #define FTCTR           0x2020000C      /* Flash test control */
  52 #define FBWST           0x20200010      /* Flash bridge wait-state */
  53 #define FCRA            0x2020001C      /* Flash clock divider */
  54 #define FMSSTART        0x20200020      /* Flash Built-In Selft Test start address */
  55 #define FMSSTOP         0x20200024      /* Flash Built-In Selft Test stop address */
  56 #define FMS16           0x20200028      /* Flash 16-bit signature */
  57 #define FMSW0           0x2020002C      /* Flash 128-bit signature Word 0 */
  58 #define FMSW1           0x20200030      /* Flash 128-bit signature Word 1 */
  59 #define FMSW2           0x20200034      /* Flash 128-bit signature Word 2 */
  60 #define FMSW3           0x20200038      /* Flash 128-bit signature Word 3 */
  61
  62 #define EECMD           0x20200080      /* EEPROM command */
  63 #define EEADDR          0x20200084      /* EEPROM address */
  64 #define EEWDATA         0x20200088      /* EEPROM write data */
  65 #define EERDATA         0x2020008C      /* EEPROM read data */
  66 #define EEWSTATE        0x20200090      /* EEPROM wait state */
  67 #define EECLKDIV        0x20200094      /* EEPROM clock divider */
  68 #define EEPWRDWN        0x20200098      /* EEPROM power-down/start */
  69 #define EEMSSTART       0x2020009C      /* EEPROM BIST start address */
  70 #define EEMSSTOP        0x202000A0      /* EEPROM BIST stop address */
  71 #define EEMSSIG         0x202000A4      /* EEPROM 24-bit BIST signature */
  72
  73 #define INT_CLR_ENABLE  0x20200FD8      /* Flash/EEPROM interrupt clear enable */
  74 #define INT_SET_ENABLE  0x20200FDC      /* Flash/EEPROM interrupt set enable */
  75 #define INT_STATUS      0x20200FE0      /* Flash/EEPROM interrupt status */
  76 #define INT_ENABLE      0x20200FE4      /* Flash/EEPROM interrupt enable */
  77 #define INT_CLR_STATUS  0x20200FE8      /* Flash/EEPROM interrupt clear status */
  78 #define INT_SET_STATUS  0x20200FEC      /* Flash/EEPROM interrupt set status */
  79
  80 /* Interrupt sources */
  81 #define INTSRC_END_OF_PROG    (1 << 28)
  82 #define INTSRC_END_OF_BIST    (1 << 27)
  83 #define INTSRC_END_OF_RDWR    (1 << 26)
  84 #define INTSRC_END_OF_MISR    (1 << 2)
  85 #define INTSRC_END_OF_BURN    (1 << 1)
  86 #define INTSRC_END_OF_ERASE   (1 << 0)
  87
  88 /* FCTR bits */
  89 #define FCTR_FS_LOADREQ       (1 << 15)
  90 #define FCTR_FS_CACHECLR      (1 << 14)
  91 #define FCTR_FS_CACHEBYP      (1 << 13)
  92 #define FCTR_FS_PROGREQ       (1 << 12)
  93 #define FCTR_FS_RLS           (1 << 11)
  94 #define FCTR_FS_PDL           (1 << 10)
  95 #define FCTR_FS_PD            (1 << 9)
  96 #define FCTR_FS_WPB           (1 << 7)
  97 #define FCTR_FS_ISS           (1 << 6)
  98 #define FCTR_FS_RLD           (1 << 5)
  99 #define FCTR_FS_DCR           (1 << 4)
 100 #define FCTR_FS_WEB           (1 << 2)
 101 #define FCTR_FS_WRE           (1 << 1)
 102 #define FCTR_FS_CS            (1 << 0)
 103 /* FPTR bits */
 104 #define FPTR_EN_T             (1 << 15)
 105 /* FTCTR bits */
 106 #define FTCTR_FS_BYPASS_R     (1 << 29)
 107 #define FTCTR_FS_BYPASS_W     (1 << 28)
 108 /* FMSSTOP bits */
 109 #define FMSSTOP_MISR_START    (1 << 17)
 110 /* EEMSSTOP bits */
 111 #define EEMSSTOP_STRTBIST     (1 << 31)
 112
 113 /* Index sector */
 114 #define ISS_CUSTOMER_START1   (0x830)
 115 #define ISS_CUSTOMER_END1     (0xA00)
 116 #define ISS_CUSTOMER_SIZE1    (ISS_CUSTOMER_END1 - ISS_CUSTOMER_START1)
 117 #define ISS_CUSTOMER_NWORDS1  (ISS_CUSTOMER_SIZE1 / 4)
 118 #define ISS_CUSTOMER_START2   (0xA40)
 119 #define ISS_CUSTOMER_END2     (0xC00)
 120 #define ISS_CUSTOMER_SIZE2    (ISS_CUSTOMER_END2 - ISS_CUSTOMER_START2)
 121 #define ISS_CUSTOMER_NWORDS2  (ISS_CUSTOMER_SIZE2 / 4)
 122 #define ISS_CUSTOMER_SIZE     (ISS_CUSTOMER_SIZE1 + ISS_CUSTOMER_SIZE2)
 123
 124 /**
 125  * Private data for \c lpc2900 flash driver.
 126  */
 127 struct lpc2900_flash_bank {
 128         /**
 129          * This flag is set when the device has been successfully probed.
 130          */
 131         bool is_probed;
 132
 133         /**
 134          * Holds the value read from CHIPID register.
 135          * The driver will not load if the chipid doesn't match the expected
 136          * value of 0x209CE02B of the LPC2900 family. A probe will only be done
 137          * if the chipid does not yet contain the expected value.
 138          */
 139         uint32_t chipid;
 140
 141         /**
 142          * String holding device name.
 143          * This string is set by the probe function to the type number of the
 144          * device. It takes the form "LPC29xx".
 145          */
 146         char *target_name;
 147
 148         /**
 149          * System clock frequency.
 150          * Holds the clock frequency in Hz, as passed by the configuration file
 151          * to the <tt>flash bank</tt> command.
 152          */
 153         uint32_t clk_sys_fmc;
 154
 155         /**
 156          * Flag to indicate that dangerous operations are possible.
 157          * This flag can be set by passing the correct password to the
 158          * <tt>lpc2900 password</tt> command. If set, other dangerous commands,
 159          * which operate on the index sector, can be executed.
 160          */
 161         uint32_t risky;
 162
 163         /**
 164          * Maximum contiguous block of internal SRAM (bytes).
 165          * Autodetected by the driver. Not the total amount of SRAM, only the
 166          * the largest \em contiguous block!
 167          */
 168         uint32_t max_ram_block;
 169
 170 };
 171
 172 static uint32_t lpc2900_wait_status(struct flash_bank *bank, uint32_t mask, int timeout);
 173 static void lpc2900_setup(struct flash_bank *bank);
 174 static uint32_t lpc2900_is_ready(struct flash_bank *bank);
 175 static uint32_t lpc2900_read_security_status(struct flash_bank *bank);
 176 static uint32_t lpc2900_run_bist128(struct flash_bank *bank,
 177                 uint32_t addr_from, uint32_t addr_to,
 178                 uint32_t (*signature)[4]);
 179 static uint32_t lpc2900_address2sector(struct flash_bank *bank, uint32_t offset);
 180 static uint32_t lpc2900_calc_tr(uint32_t clock_var, uint32_t time_var);
 181
 182 /***********************  Helper functions  **************************/
 183
 184 /**
 185  * Wait for an event in mask to occur in INT_STATUS.
 186  *
 187  * Return when an event occurs, or after a timeout.
 188  *
 189  * @param[in] bank Pointer to the flash bank descriptor
 190  * @param[in] mask Mask to be used for INT_STATUS
 191  * @param[in] timeout Timeout in ms
 192  */
 193 static uint32_t lpc2900_wait_status(struct flash_bank *bank,
 194         uint32_t mask,
 195         int timeout)
 196 {
 197         uint32_t int_status;
 198         struct target *target = bank->target;
 199
 200         do {
 201                 alive_sleep(1);
 202                 timeout--;
 203                 target_read_u32(target, INT_STATUS, &int_status);
 204         } while (((int_status & mask) == 0) && (timeout != 0));
 205
 206         if (timeout == 0) {
 207                 LOG_DEBUG("Timeout!");
 208                 return ERROR_FLASH_OPERATION_FAILED;
 209         }
 210
 211         return ERROR_OK;
 212 }
 213
 214 /**
 215  * Set up the flash for erase/program operations.
 216  *
 217  * Enable the flash, and set the correct CRA clock of 66 kHz.
 218  *
 219  * @param bank Pointer to the flash bank descriptor
 220  */
 221 static void lpc2900_setup(struct flash_bank *bank)
 222 {
 223         uint32_t fcra;
 224         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
 225
 226         /* Power up the flash block */
 227         target_write_u32(bank->target, FCTR, FCTR_FS_WEB | FCTR_FS_CS);
 228
 229         fcra = (lpc2900_info->clk_sys_fmc / (3 * 66000)) - 1;
 230         target_write_u32(bank->target, FCRA, fcra);
 231 }
 232
 233 /**
 234  * Check if device is ready.
 235  *
 236  * Check if device is ready for flash operation:
 237  * Must have been successfully probed.
 238  * Must be halted.
 239  */
 240 static uint32_t lpc2900_is_ready(struct flash_bank *bank)
 241 {
 242         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
 243
 244         if (!lpc2900_info->is_probed)
 245                 return ERROR_FLASH_BANK_NOT_PROBED;
 246
 247         if (bank->target->state != TARGET_HALTED) {
 248                 LOG_ERROR("Target not halted");
 249                 return ERROR_TARGET_NOT_HALTED;
 250         }
 251
 252         return ERROR_OK;
 253 }
 254
 255 /**
 256  * Read the status of sector security from the index sector.
 257  *
 258  * @param bank Pointer to the flash bank descriptor
 259  */
 260 static uint32_t lpc2900_read_security_status(struct flash_bank *bank)
 261 {
 262         uint32_t status = lpc2900_is_ready(bank);
 263         if (status != ERROR_OK)
 264                 return status;
 265
 266         struct target *target = bank->target;
 267
 268         /* Enable ISS access */
 269         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB | FCTR_FS_ISS);
 270
 271         /* Read the relevant block of memory from the ISS sector */
 272         uint32_t iss_secured_field[0x230/16][4];
 273         target_read_memory(target, bank->base + 0xC00, 4, 0x230/4,
 274                 (uint8_t *)iss_secured_field);
 275
 276         /* Disable ISS access */
 277         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
 278
 279         /* Check status of each sector. Note that the sector numbering in the LPC2900
 280          * is different from the logical sector numbers used in OpenOCD!
 281          * Refer to the user manual for details.
 282          *
 283          * All zeros (16x 0x00) are treated as a secured sector (is_protected = 1)
 284          * All ones (16x 0xFF) are treated as a non-secured sector (is_protected = 0)
 285          * Anything else is undefined (is_protected = -1). This is treated as
 286          * a protected sector!
 287          */
 288         int sector;
 289         int index_t;
 290         for (sector = 0; sector < bank->num_sectors; sector++) {
 291                 /* Convert logical sector number to physical sector number */
 292                 if (sector <= 4)
 293                         index_t = sector + 11;
 294                 else if (sector <= 7)
 295                         index_t = sector + 27;
 296                 else
 297                         index_t = sector - 8;
 298
 299                 bank->sectors[sector].is_protected = -1;
 300
 301                 if ((iss_secured_field[index_t][0] == 0x00000000) &&
 302                         (iss_secured_field[index_t][1] == 0x00000000) &&
 303                         (iss_secured_field[index_t][2] == 0x00000000) &&
 304                         (iss_secured_field[index_t][3] == 0x00000000))
 305                         bank->sectors[sector].is_protected = 1;
 306
 307                 if ((iss_secured_field[index_t][0] == 0xFFFFFFFF) &&
 308                         (iss_secured_field[index_t][1] == 0xFFFFFFFF) &&
 309                         (iss_secured_field[index_t][2] == 0xFFFFFFFF) &&
 310                         (iss_secured_field[index_t][3] == 0xFFFFFFFF))
 311                         bank->sectors[sector].is_protected = 0;
 312         }
 313
 314         return ERROR_OK;
 315 }
 316
 317 /**
 318  * Use BIST to calculate a 128-bit hash value over a range of flash.
 319  *
 320  * @param bank Pointer to the flash bank descriptor
 321  * @param addr_from
 322  * @param addr_to
 323  * @param signature
 324  */
 325 static uint32_t lpc2900_run_bist128(struct flash_bank *bank,
 326         uint32_t addr_from,
 327         uint32_t addr_to,
 328         uint32_t (*signature)[4])
 329 {
 330         struct target *target = bank->target;
 331
 332         /* Clear END_OF_MISR interrupt status */
 333         target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_MISR);
 334
 335         /* Start address */
 336         target_write_u32(target, FMSSTART, addr_from >> 4);
 337         /* End address, and issue start command */
 338         target_write_u32(target, FMSSTOP, (addr_to >> 4) | FMSSTOP_MISR_START);
 339
 340         /* Poll for end of operation. Calculate a reasonable timeout. */
 341         if (lpc2900_wait_status(bank, INTSRC_END_OF_MISR, 1000) != ERROR_OK)
 342                 return ERROR_FLASH_OPERATION_FAILED;
 343
 344         /* Return the signature */
 345         target_read_memory(target, FMSW0, 4, 4, (uint8_t *)signature);
 346
 347         return ERROR_OK;
 348 }
 349
 350 /**
 351  * Return sector number for given address.
 352  *
 353  * Return the (logical) sector number for a given relative address.
 354  * No sanity check is done. It assumed that the address is valid.
 355  *
 356  * @param bank Pointer to the flash bank descriptor
 357  * @param offset Offset address relative to bank start
 358  */
 359 static uint32_t lpc2900_address2sector(struct flash_bank *bank,
 360         uint32_t offset)
 361 {
 362         uint32_t address = bank->base + offset;
 363
 364         /* Run through all sectors of this bank */
 365         int sector;
 366         for (sector = 0; sector < bank->num_sectors; sector++) {
 367                 /* Return immediately if address is within the current sector */
 368                 if (address < (bank->sectors[sector].offset + bank->sectors[sector].size))
 369                         return sector;
 370         }
 371
 372         /* We should never come here. If we do, return an arbitrary sector number. */
 373         return 0;
 374 }
 375
 376 /**
 377  * Write one page to the index sector.
 378  *
 379  * @param bank Pointer to the flash bank descriptor
 380  * @param pagenum Page number (0...7)
 381  * @param page Page array (FLASH_PAGE_SIZE bytes)
 382  */
 383 static int lpc2900_write_index_page(struct flash_bank *bank,
 384         int pagenum,
 385         uint8_t (*page)[FLASH_PAGE_SIZE])
 386 {
 387         /* Only pages 4...7 are user writable */
 388         if ((pagenum < 4) || (pagenum > 7)) {
 389                 LOG_ERROR("Refuse to burn index sector page %d", pagenum);
 390                 return ERROR_COMMAND_ARGUMENT_INVALID;
 391         }
 392
 393         /* Get target, and check if it's halted */
 394         struct target *target = bank->target;
 395         if (target->state != TARGET_HALTED) {
 396                 LOG_ERROR("Target not halted");
 397                 return ERROR_TARGET_NOT_HALTED;
 398         }
 399
 400         /* Private info */
 401         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
 402
 403         /* Enable flash block and set the correct CRA clock of 66 kHz */
 404         lpc2900_setup(bank);
 405
 406         /* Un-protect the index sector */
 407         target_write_u32(target, bank->base, 0);
 408         target_write_u32(target, FCTR,
 409                 FCTR_FS_LOADREQ | FCTR_FS_WPB | FCTR_FS_ISS |
 410                 FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
 411
 412         /* Set latch load mode */
 413         target_write_u32(target, FCTR,
 414                 FCTR_FS_ISS | FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
 415
 416         /* Write whole page to flash data latches */
 417         if (target_write_memory(target,
 418                         bank->base + pagenum * FLASH_PAGE_SIZE,
 419                         4, FLASH_PAGE_SIZE / 4, (uint8_t *)page) != ERROR_OK) {
 420                 LOG_ERROR("Index sector write failed @ page %d", pagenum);
 421                 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
 422
 423                 return ERROR_FLASH_OPERATION_FAILED;
 424         }
 425
 426         /* Clear END_OF_BURN interrupt status */
 427         target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_BURN);
 428
 429         /* Set the program/erase time to FLASH_PROGRAM_TIME */
 430         target_write_u32(target, FPTR,
 431                 FPTR_EN_T | lpc2900_calc_tr(lpc2900_info->clk_sys_fmc,
 432                         FLASH_PROGRAM_TIME));
 433
 434         /* Trigger flash write */
 435         target_write_u32(target, FCTR,
 436                 FCTR_FS_PROGREQ | FCTR_FS_ISS |
 437                 FCTR_FS_WPB | FCTR_FS_WRE | FCTR_FS_CS);
 438
 439         /* Wait for the end of the write operation. If it's not over after one
 440          * second, something went dreadfully wrong... :-(
 441          */
 442         if (lpc2900_wait_status(bank, INTSRC_END_OF_BURN, 1000) != ERROR_OK) {
 443                 LOG_ERROR("Index sector write failed @ page %d", pagenum);
 444                 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
 445
 446                 return ERROR_FLASH_OPERATION_FAILED;
 447         }
 448
 449         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
 450
 451         return ERROR_OK;
 452 }
 453
 454 /**
 455  * Calculate FPTR.TR register value for desired program/erase time.
 456  *
 457  * @param clock System clock in Hz
 458  * @param time Program/erase time in µs
 459  */
 460 static uint32_t lpc2900_calc_tr(uint32_t clock_var, uint32_t time_var)
 461 {
 462         /*           ((time[µs]/1e6) * f[Hz]) + 511
 463          * FPTR.TR = -------------------------------
 464          *                         512
 465          */
 466
 467         uint32_t tr_val = (uint32_t)((((time_var / 1e6) * clock_var) + 511.0) / 512.0);
 468
 469         return tr_val;
 470 }
 471
 472 /***********************  Private flash commands  **************************/
 473
 474
 475 /**
 476  * Command to determine the signature of the whole flash.
 477  *
 478  * Uses the Built-In-Self-Test (BIST) to generate a 128-bit hash value
 479  * of the flash content.
 480  */
 481 COMMAND_HANDLER(lpc2900_handle_signature_command)
 482 {
 483         uint32_t status;
 484         uint32_t signature[4];
 485
 486         if (CMD_ARGC < 1)
 487                 return ERROR_COMMAND_SYNTAX_ERROR;
 488
 489         struct flash_bank *bank;
 490         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 491         if (ERROR_OK != retval)
 492                 return retval;
 493
 494         if (bank->target->state != TARGET_HALTED) {
 495                 LOG_ERROR("Target not halted");
 496                 return ERROR_TARGET_NOT_HALTED;
 497         }
 498
 499         /* Run BIST over whole flash range */
 500         status = lpc2900_run_bist128(bank, bank->base, bank->base + (bank->size - 1), &signature);
 501         if (status != ERROR_OK)
 502                 return status;
 503
 504         command_print(CMD_CTX, "signature: 0x%8.8" PRIx32
 505                 ":0x%8.8" PRIx32
 506                 ":0x%8.8" PRIx32
 507                 ":0x%8.8" PRIx32,
 508                 signature[3], signature[2], signature[1], signature[0]);
 509
 510         return ERROR_OK;
 511 }
 512
 513 /**
 514  * Store customer info in file.
 515  *
 516  * Read customer info from index sector, and store that block of data into
 517  * a disk file. The format is binary.
 518  */
 519 COMMAND_HANDLER(lpc2900_handle_read_custom_command)
 520 {
 521         if (CMD_ARGC < 2)
 522                 return ERROR_COMMAND_SYNTAX_ERROR;
 523
 524         struct flash_bank *bank;
 525         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 526         if (ERROR_OK != retval)
 527                 return retval;
 528
 529         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
 530         lpc2900_info->risky = 0;
 531
 532         /* Get target, and check if it's halted */
 533         struct target *target = bank->target;
 534         if (target->state != TARGET_HALTED) {
 535                 LOG_ERROR("Target not halted");
 536                 return ERROR_TARGET_NOT_HALTED;
 537         }
 538
 539         /* Storage for customer info. Read in two parts */
 540         uint32_t customer[ISS_CUSTOMER_NWORDS1 + ISS_CUSTOMER_NWORDS2];
 541
 542         /* Enable access to index sector */
 543         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB | FCTR_FS_ISS);
 544
 545         /* Read two parts */
 546         target_read_memory(target, bank->base+ISS_CUSTOMER_START1, 4,
 547                 ISS_CUSTOMER_NWORDS1,
 548                 (uint8_t *)&customer[0]);
 549         target_read_memory(target, bank->base+ISS_CUSTOMER_START2, 4,
 550                 ISS_CUSTOMER_NWORDS2,
 551                 (uint8_t *)&customer[ISS_CUSTOMER_NWORDS1]);
 552
 553         /* Deactivate access to index sector */
 554         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
 555
 556         /* Try and open the file */
 557         struct fileio fileio;
 558         const char *filename = CMD_ARGV[1];
 559         int ret = fileio_open(&fileio, filename, FILEIO_WRITE, FILEIO_BINARY);
 560         if (ret != ERROR_OK) {
 561                 LOG_WARNING("Could not open file %s", filename);
 562                 return ret;
 563         }
 564
 565         size_t nwritten;
 566         ret = fileio_write(&fileio, sizeof(customer),
 567                         (const uint8_t *)customer, &nwritten);
 568         if (ret != ERROR_OK) {
 569                 LOG_ERROR("Write operation to file %s failed", filename);
 570                 fileio_close(&fileio);
 571                 return ret;
 572         }
 573
 574         fileio_close(&fileio);
 575
 576         return ERROR_OK;
 577 }
 578
 579 /**
 580  * Enter password to enable potentially dangerous options.
 581  */
 582 COMMAND_HANDLER(lpc2900_handle_password_command)
 583 {
 584         if (CMD_ARGC < 2)
 585                 return ERROR_COMMAND_SYNTAX_ERROR;
 586
 587         struct flash_bank *bank;
 588         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 589         if (ERROR_OK != retval)
 590                 return retval;
 591
 592         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
 593
 594 #define ISS_PASSWORD "I_know_what_I_am_doing"
 595
 596         lpc2900_info->risky = !strcmp(CMD_ARGV[1], ISS_PASSWORD);
 597
 598         if (!lpc2900_info->risky) {
 599                 command_print(CMD_CTX, "Wrong password (use '%s')", ISS_PASSWORD);
 600                 return ERROR_COMMAND_ARGUMENT_INVALID;
 601         }
 602
 603         command_print(CMD_CTX,
 604                 "Potentially dangerous operation allowed in next command!");
 605
 606         return ERROR_OK;
 607 }
 608
 609 /**
 610  * Write customer info from file to the index sector.
 611  */
 612 COMMAND_HANDLER(lpc2900_handle_write_custom_command)
 613 {
 614         if (CMD_ARGC < 2)
 615                 return ERROR_COMMAND_SYNTAX_ERROR;
 616
 617         struct flash_bank *bank;
 618         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 619         if (ERROR_OK != retval)
 620                 return retval;
 621
 622         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
 623
 624         /* Check if command execution is allowed. */
 625         if (!lpc2900_info->risky) {
 626                 command_print(CMD_CTX, "Command execution not allowed!");
 627                 return ERROR_COMMAND_ARGUMENT_INVALID;
 628         }
 629         lpc2900_info->risky = 0;
 630
 631         /* Get target, and check if it's halted */
 632         struct target *target = bank->target;
 633         if (target->state != TARGET_HALTED) {
 634                 LOG_ERROR("Target not halted");
 635                 return ERROR_TARGET_NOT_HALTED;
 636         }
 637
 638         /* The image will always start at offset 0 */
 639         struct image image;
 640         image.base_address_set = 1;
 641         image.base_address = 0;
 642         image.start_address_set = 0;
 643
 644         const char *filename = CMD_ARGV[1];
 645         const char *type = (CMD_ARGC >= 3) ? CMD_ARGV[2] : NULL;
 646         retval = image_open(&image, filename, type);
 647         if (retval != ERROR_OK)
 648                 return retval;
 649
 650         /* Do a sanity check: The image must be exactly the size of the customer
 651            programmable area. Any other size is rejected. */
 652         if (image.num_sections != 1) {
 653                 LOG_ERROR("Only one section allowed in image file.");
 654                 return ERROR_COMMAND_SYNTAX_ERROR;
 655         }
 656         if ((image.sections[0].base_address != 0) ||
 657                         (image.sections[0].size != ISS_CUSTOMER_SIZE)) {
 658                 LOG_ERROR("Incorrect image file size. Expected %d, "
 659                         "got %" PRIu32,
 660                         ISS_CUSTOMER_SIZE, image.sections[0].size);
 661                 return ERROR_COMMAND_SYNTAX_ERROR;
 662         }
 663
 664         /* Well boys, I reckon this is it... */
 665
 666         /* Customer info is split into two blocks in pages 4 and 5. */
 667         uint8_t page[FLASH_PAGE_SIZE];
 668
 669         /* Page 4 */
 670         uint32_t offset = ISS_CUSTOMER_START1 % FLASH_PAGE_SIZE;
 671         memset(page, 0xff, FLASH_PAGE_SIZE);
 672         size_t size_read;
 673         retval = image_read_section(&image, 0, 0,
 674                         ISS_CUSTOMER_SIZE1, &page[offset], &size_read);
 675         if (retval != ERROR_OK) {
 676                 LOG_ERROR("couldn't read from file '%s'", filename);
 677                 image_close(&image);
 678                 return retval;
 679         }
 680         retval = lpc2900_write_index_page(bank, 4, &page);
 681         if (retval != ERROR_OK) {
 682                 image_close(&image);
 683                 return retval;
 684         }
 685
 686         /* Page 5 */
 687         offset = ISS_CUSTOMER_START2 % FLASH_PAGE_SIZE;
 688         memset(page, 0xff, FLASH_PAGE_SIZE);
 689         retval = image_read_section(&image, 0, ISS_CUSTOMER_SIZE1,
 690                         ISS_CUSTOMER_SIZE2, &page[offset], &size_read);
 691         if (retval != ERROR_OK) {
 692                 LOG_ERROR("couldn't read from file '%s'", filename);
 693                 image_close(&image);
 694                 return retval;
 695         }
 696         retval = lpc2900_write_index_page(bank, 5, &page);
 697         if (retval != ERROR_OK) {
 698                 image_close(&image);
 699                 return retval;
 700         }
 701
 702         image_close(&image);
 703
 704         return ERROR_OK;
 705 }
 706
 707 /**
 708  * Activate 'sector security' for a range of sectors.
 709  */
 710 COMMAND_HANDLER(lpc2900_handle_secure_sector_command)
 711 {
 712         if (CMD_ARGC < 3)
 713                 return ERROR_COMMAND_SYNTAX_ERROR;
 714
 715         /* Get the bank descriptor */
 716         struct flash_bank *bank;
 717         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 718         if (ERROR_OK != retval)
 719                 return retval;
 720
 721         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
 722
 723         /* Check if command execution is allowed. */
 724         if (!lpc2900_info->risky) {
 725                 command_print(CMD_CTX, "Command execution not allowed! "
 726                         "(use 'password' command first)");
 727                 return ERROR_COMMAND_ARGUMENT_INVALID;
 728         }
 729         lpc2900_info->risky = 0;
 730
 731         /* Read sector range, and do a sanity check. */
 732         int first, last;
 733         COMMAND_PARSE_NUMBER(int, CMD_ARGV[1], first);
 734         COMMAND_PARSE_NUMBER(int, CMD_ARGV[2], last);
 735         if ((first >= bank->num_sectors) ||
 736                         (last >= bank->num_sectors) ||
 737                         (first > last)) {
 738                 command_print(CMD_CTX, "Illegal sector range");
 739                 return ERROR_COMMAND_ARGUMENT_INVALID;
 740         }
 741
 742         uint8_t page[FLASH_PAGE_SIZE];
 743         int sector;
 744
 745         /* Sectors in page 6 */
 746         if ((first <= 4) || (last >= 8)) {
 747                 memset(&page, 0xff, FLASH_PAGE_SIZE);
 748                 for (sector = first; sector <= last; sector++) {
 749                         if (sector <= 4)
 750                                 memset(&page[0xB0 + 16*sector], 0, 16);
 751                         else if (sector >= 8)
 752                                 memset(&page[0x00 + 16*(sector - 8)], 0, 16);
 753                 }
 754
 755                 retval = lpc2900_write_index_page(bank, 6, &page);
 756                 if (retval != ERROR_OK) {
 757                         LOG_ERROR("failed to update index sector page 6");
 758                         return retval;
 759                 }
 760         }
 761
 762         /* Sectors in page 7 */
 763         if ((first <= 7) && (last >= 5)) {
 764                 memset(&page, 0xff, FLASH_PAGE_SIZE);
 765                 for (sector = first; sector <= last; sector++) {
 766                         if ((sector >= 5) && (sector <= 7))
 767                                 memset(&page[0x00 + 16*(sector - 5)], 0, 16);
 768                 }
 769
 770                 retval = lpc2900_write_index_page(bank, 7, &page);
 771                 if (retval != ERROR_OK) {
 772                         LOG_ERROR("failed to update index sector page 7");
 773                         return retval;
 774                 }
 775         }
 776
 777         command_print(CMD_CTX,
 778                 "Sectors security will become effective after next power cycle");
 779
 780         /* Update the sector security status */
 781         if (lpc2900_read_security_status(bank) != ERROR_OK) {
 782                 LOG_ERROR("Cannot determine sector security status");
 783                 return ERROR_FLASH_OPERATION_FAILED;
 784         }
 785
 786         return ERROR_OK;
 787 }
 788
 789 /**
 790  * Activate JTAG protection.
 791  */
 792 COMMAND_HANDLER(lpc2900_handle_secure_jtag_command)
 793 {
 794         if (CMD_ARGC < 1)
 795                 return ERROR_COMMAND_SYNTAX_ERROR;
 796
 797         /* Get the bank descriptor */
 798         struct flash_bank *bank;
 799         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 800         if (ERROR_OK != retval)
 801                 return retval;
 802
 803         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
 804
 805         /* Check if command execution is allowed. */
 806         if (!lpc2900_info->risky) {
 807                 command_print(CMD_CTX, "Command execution not allowed! "
 808                         "(use 'password' command first)");
 809                 return ERROR_COMMAND_ARGUMENT_INVALID;
 810         }
 811         lpc2900_info->risky = 0;
 812
 813         /* Prepare page */
 814         uint8_t page[FLASH_PAGE_SIZE];
 815         memset(&page, 0xff, FLASH_PAGE_SIZE);
 816
 817
 818         /* Insert "soft" protection word */
 819         page[0x30 + 15] = 0x7F;
 820         page[0x30 + 11] = 0x7F;
 821         page[0x30 +  7] = 0x7F;
 822         page[0x30 +  3] = 0x7F;
 823
 824         /* Write to page 5 */
 825         retval = lpc2900_write_index_page(bank, 5, &page);
 826         if (retval != ERROR_OK) {
 827                 LOG_ERROR("failed to update index sector page 5");
 828                 return retval;
 829         }
 830
 831         LOG_INFO("JTAG security set. Good bye!");
 832
 833         return ERROR_OK;
 834 }
 835
 836 /***********************  Flash interface functions  **************************/
 837
 838 static const struct command_registration lpc2900_exec_command_handlers[] = {
 839         {
 840                 .name = "signature",
 841                 .usage = "<bank>",
 842                 .handler = lpc2900_handle_signature_command,
 843                 .mode = COMMAND_EXEC,
 844                 .help = "Calculate and display signature of flash bank.",
 845         },
 846         {
 847                 .name = "read_custom",
 848                 .handler = lpc2900_handle_read_custom_command,
 849                 .mode = COMMAND_EXEC,
 850                 .usage = "bank_id filename",
 851                 .help = "Copies 912 bytes of customer information "
 852                         "from index sector into file.",
 853         },
 854         {
 855                 .name = "password",
 856                 .handler = lpc2900_handle_password_command,
 857                 .mode = COMMAND_EXEC,
 858                 .usage = "bank_id password",
 859                 .help = "Enter fixed password to enable 'dangerous' options.",
 860         },
 861         {
 862                 .name = "write_custom",
 863                 .handler = lpc2900_handle_write_custom_command,
 864                 .mode = COMMAND_EXEC,
 865                 .usage = "bank_id filename ('bin'|'ihex'|'elf'|'s19')",
 866                 .help = "Copies 912 bytes of customer info from file "
 867                         "to index sector.",
 868         },
 869         {
 870                 .name = "secure_sector",
 871                 .handler = lpc2900_handle_secure_sector_command,
 872                 .mode = COMMAND_EXEC,
 873                 .usage = "bank_id first_sector last_sector",
 874                 .help = "Activate sector security for a range of sectors.  "
 875                         "It will be effective after a power cycle.",
 876         },
 877         {
 878                 .name = "secure_jtag",
 879                 .handler = lpc2900_handle_secure_jtag_command,
 880                 .mode = COMMAND_EXEC,
 881                 .usage = "bank_id",
 882                 .help = "Disable the JTAG port.  "
 883                         "It will be effective after a power cycle.",
 884         },
 885         COMMAND_REGISTRATION_DONE
 886 };
 887
 888 static const struct command_registration lpc2900_command_handlers[] = {
 889         {
 890                 .name = "lpc2900",
 891                 .mode = COMMAND_ANY,
 892                 .help = "LPC2900 flash command group",
 893                 .usage = "",
 894                 .chain = lpc2900_exec_command_handlers,
 895         },
 896         COMMAND_REGISTRATION_DONE
 897 };
 898
 899 /* / Evaluate flash bank command. */
 900 FLASH_BANK_COMMAND_HANDLER(lpc2900_flash_bank_command)
 901 {
 902         struct lpc2900_flash_bank *lpc2900_info;
 903
 904         if (CMD_ARGC < 6)
 905                 return ERROR_COMMAND_SYNTAX_ERROR;
 906
 907         lpc2900_info = malloc(sizeof(struct lpc2900_flash_bank));
 908         bank->driver_priv = lpc2900_info;
 909
 910         /* Get flash clock.
 911          * Reject it if we can't meet the requirements for program time
 912          * (if clock too slow), or for erase time (clock too fast).
 913          */
 914         uint32_t clk_sys_fmc;
 915         COMMAND_PARSE_NUMBER(u32, CMD_ARGV[6], clk_sys_fmc);
 916         lpc2900_info->clk_sys_fmc = clk_sys_fmc * 1000;
 917
 918         uint32_t clock_limit;
 919         /* Check program time limit */
 920         clock_limit = 512000000l / FLASH_PROGRAM_TIME;
 921         if (lpc2900_info->clk_sys_fmc < clock_limit) {
 922                 LOG_WARNING("flash clock must be at least %" PRIu32 " kHz",
 923                         (clock_limit / 1000));
 924                 return ERROR_FLASH_BANK_INVALID;
 925         }
 926
 927         /* Check erase time limit */
 928         clock_limit = (uint32_t)((32767.0 * 512.0 * 1e6) / FLASH_ERASE_TIME);
 929         if (lpc2900_info->clk_sys_fmc > clock_limit) {
 930                 LOG_WARNING("flash clock must be a maximum of %" PRIu32 " kHz",
 931                         (clock_limit / 1000));
 932                 return ERROR_FLASH_BANK_INVALID;
 933         }
 934
 935         /* Chip ID will be obtained by probing the device later */
 936         lpc2900_info->chipid = 0;
 937         lpc2900_info->is_probed = false;
 938
 939         return ERROR_OK;
 940 }
 941
 942 /**
 943  * Erase sector(s).
 944  *
 945  * @param bank Pointer to the flash bank descriptor
 946  * @param first First sector to be erased
 947  * @param last Last sector (including) to be erased
 948  */
 949 static int lpc2900_erase(struct flash_bank *bank, int first, int last)
 950 {
 951         uint32_t status;
 952         int sector;
 953         int last_unsecured_sector;
 954         struct target *target = bank->target;
 955         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
 956
 957
 958         status = lpc2900_is_ready(bank);
 959         if (status != ERROR_OK)
 960                 return status;
 961
 962         /* Sanity check on sector range */
 963         if ((first < 0) || (last < first) || (last >= bank->num_sectors)) {
 964                 LOG_INFO("Bad sector range");
 965                 return ERROR_FLASH_SECTOR_INVALID;
 966         }
 967
 968         /* Update the info about secured sectors */
 969         lpc2900_read_security_status(bank);
 970
 971         /* The selected sector range might include secured sectors. An attempt
 972          * to erase such a sector will cause the erase to fail also for unsecured
 973          * sectors. It is necessary to determine the last unsecured sector now,
 974          * because we have to treat the last relevant sector in the list in
 975          * a special way.
 976          */
 977         last_unsecured_sector = -1;
 978         for (sector = first; sector <= last; sector++) {
 979                 if (!bank->sectors[sector].is_protected)
 980                         last_unsecured_sector = sector;
 981         }
 982
 983         /* Exit now, in case of the rare constellation where all sectors in range
 984          * are secured. This is regarded a success, since erasing/programming of
 985          * secured sectors shall be handled transparently.
 986          */
 987         if (last_unsecured_sector == -1)
 988                 return ERROR_OK;
 989
 990         /* Enable flash block and set the correct CRA clock of 66 kHz */
 991         lpc2900_setup(bank);
 992
 993         /* Clear END_OF_ERASE interrupt status */
 994         target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_ERASE);
 995
 996         /* Set the program/erase timer to FLASH_ERASE_TIME */
 997         target_write_u32(target, FPTR,
 998                 FPTR_EN_T | lpc2900_calc_tr(lpc2900_info->clk_sys_fmc,
 999                         FLASH_ERASE_TIME));
1000
1001         /* Sectors are marked for erasure, then erased all together */
1002         for (sector = first; sector <= last_unsecured_sector; sector++) {
1003                 /* Only mark sectors that aren't secured. Any attempt to erase a group
1004                  * of sectors will fail if any single one of them is secured!
1005                  */
1006                 if (!bank->sectors[sector].is_protected) {
1007                         /* Unprotect the sector */
1008                         target_write_u32(target, bank->sectors[sector].offset, 0);
1009                         target_write_u32(target, FCTR,
1010                                 FCTR_FS_LOADREQ | FCTR_FS_WPB |
1011                                 FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
1012
1013                         /* Mark the sector for erasure. The last sector in the list
1014                            triggers the erasure. */
1015                         target_write_u32(target, bank->sectors[sector].offset, 0);
1016                         if (sector == last_unsecured_sector) {
1017                                 target_write_u32(target, FCTR,
1018                                         FCTR_FS_PROGREQ | FCTR_FS_WPB | FCTR_FS_CS);
1019                         } else {
1020                                 target_write_u32(target, FCTR,
1021                                         FCTR_FS_LOADREQ | FCTR_FS_WPB |
1022                                         FCTR_FS_WEB | FCTR_FS_CS);
1023                         }
1024                 }
1025         }
1026
1027         /* Wait for the end of the erase operation. If it's not over after two seconds,
1028          * something went dreadfully wrong... :-(
1029          */
1030         if (lpc2900_wait_status(bank, INTSRC_END_OF_ERASE, 2000) != ERROR_OK)
1031                 return ERROR_FLASH_OPERATION_FAILED;
1032
1033         /* Normal flash operating mode */
1034         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1035
1036         return ERROR_OK;
1037 }
1038
1039 static int lpc2900_protect(struct flash_bank *bank, int set, int first, int last)
1040 {
1041         /* This command is not supported.
1042         * "Protection" in LPC2900 terms is handled transparently. Sectors will
1043         * automatically be unprotected as needed.
1044         * Instead we use the concept of sector security. A secured sector is shown
1045         * as "protected" in OpenOCD. Sector security is a permanent feature, and
1046         * cannot be disabled once activated.
1047         */
1048
1049         return ERROR_OK;
1050 }
1051
1052 /**
1053  * Write data to flash.
1054  *
1055  * @param bank Pointer to the flash bank descriptor
1056  * @param buffer Buffer with data
1057  * @param offset Start address (relative to bank start)
1058  * @param count Number of bytes to be programmed
1059  */
1060 static int lpc2900_write(struct flash_bank *bank, uint8_t *buffer,
1061         uint32_t offset, uint32_t count)
1062 {
1063         uint8_t page[FLASH_PAGE_SIZE];
1064         uint32_t status;
1065         uint32_t num_bytes;
1066         struct target *target = bank->target;
1067         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
1068         int sector;
1069         int retval;
1070
1071         static const uint32_t write_target_code[] = {
1072                 /* Set auto latch mode: FCTR=CS|WRE|WEB */
1073                 0xe3a0a007,     /* loop       mov r10, #0x007 */
1074                 0xe583a000,     /*            str r10,[r3,#0] */
1075
1076                 /* Load complete page into latches */
1077                 0xe3a06020,     /*            mov r6,#(512/16) */
1078                 0xe8b00f00,     /* next       ldmia r0!,{r8-r11} */
1079                 0xe8a10f00,     /*            stmia r1!,{r8-r11} */
1080                 0xe2566001,     /*            subs r6,#1 */
1081                 0x1afffffb,     /*            bne next */
1082
1083                 /* Clear END_OF_BURN interrupt status */
1084                 0xe3a0a002,     /*            mov r10,#(1 << 1) */
1085                 0xe583afe8,     /*            str r10,[r3,#0xfe8] */
1086
1087                 /* Set the erase time to FLASH_PROGRAM_TIME */
1088                 0xe5834008,     /*            str r4,[r3,#8] */
1089
1090                 /* Trigger flash write
1091                  * FCTR = CS | WRE | WPB | PROGREQ */
1092                 0xe3a0a083,     /*            mov r10,#0x83 */
1093                 0xe38aaa01,     /*            orr r10,#0x1000 */
1094                 0xe583a000,     /*            str r10,[r3,#0] */
1095
1096                 /* Wait for end of burn */
1097                 0xe593afe0,     /* wait       ldr r10,[r3,#0xfe0] */
1098                 0xe21aa002,     /*            ands r10,#(1 << 1) */
1099                 0x0afffffc,     /*            beq wait */
1100
1101                 /* End? */
1102                 0xe2522001,     /*            subs r2,#1 */
1103                 0x1affffed,     /*            bne loop */
1104
1105                 0xeafffffe      /* done       b done */
1106         };
1107
1108
1109         status = lpc2900_is_ready(bank);
1110         if (status != ERROR_OK)
1111                 return status;
1112
1113         /* Enable flash block and set the correct CRA clock of 66 kHz */
1114         lpc2900_setup(bank);
1115
1116         /* Update the info about secured sectors */
1117         lpc2900_read_security_status(bank);
1118
1119         /* Unprotect all involved sectors */
1120         for (sector = 0; sector < bank->num_sectors; sector++) {
1121                 /* Start address in or before this sector?
1122                  * End address in or behind this sector? */
1123                 if (((bank->base + offset) <
1124                                 (bank->sectors[sector].offset + bank->sectors[sector].size)) &&
1125                                 ((bank->base + (offset + count - 1)) >= bank->sectors[sector].offset)) {
1126                         /* This sector is involved and needs to be unprotected.
1127                          * Don't do it for secured sectors.
1128                          */
1129                         if (!bank->sectors[sector].is_protected) {
1130                                 target_write_u32(target, bank->sectors[sector].offset, 0);
1131                                 target_write_u32(target, FCTR,
1132                                         FCTR_FS_LOADREQ | FCTR_FS_WPB |
1133                                         FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
1134                         }
1135                 }
1136         }
1137
1138         /* Set the program/erase time to FLASH_PROGRAM_TIME */
1139         uint32_t prog_time = FPTR_EN_T | lpc2900_calc_tr(lpc2900_info->clk_sys_fmc, FLASH_PROGRAM_TIME);
1140
1141         /* If there is a working area of reasonable size, use it to program via
1142          * a target algorithm. If not, fall back to host programming. */
1143
1144         /* We need some room for target code. */
1145         uint32_t target_code_size = sizeof(write_target_code);
1146
1147         /* Try working area allocation. Start with a large buffer, and try with
1148          * reduced size if that fails. */
1149         struct working_area *warea;
1150         uint32_t buffer_size = lpc2900_info->max_ram_block - 1 * KiB;
1151         while ((retval = target_alloc_working_area_try(target,
1152                                  buffer_size + target_code_size,
1153                                  &warea)) != ERROR_OK) {
1154                 /* Try a smaller buffer now, and stop if it's too small. */
1155                 buffer_size -= 1 * KiB;
1156                 if (buffer_size < 2 * KiB) {
1157                         LOG_INFO("no (large enough) working area, falling back to host mode");
1158                         warea = NULL;
1159                         break;
1160                 }
1161         }
1162         ;
1163
1164         if (warea) {
1165                 struct reg_param reg_params[5];
1166                 struct arm_algorithm armv4_5_info;
1167
1168                 /* We can use target mode. Download the algorithm. */
1169                 retval = target_write_buffer(target,
1170                                 (warea->address)+buffer_size,
1171                                 target_code_size,
1172                                 (uint8_t *)write_target_code);
1173                 if (retval != ERROR_OK) {
1174                         LOG_ERROR("Unable to write block write code to target");
1175                         target_free_all_working_areas(target);
1176                         return ERROR_FLASH_OPERATION_FAILED;
1177                 }
1178
1179                 init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT);
1180                 init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);
1181                 init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);
1182                 init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);
1183                 init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT);
1184
1185                 /* Write to flash in large blocks */
1186                 while (count != 0) {
1187                         uint32_t this_npages;
1188                         uint8_t *this_buffer;
1189                         int start_sector = lpc2900_address2sector(bank, offset);
1190
1191                         /* First page / last page / rest */
1192                         if (offset % FLASH_PAGE_SIZE) {
1193                                 /* Block doesn't start on page boundary.
1194                                  * Burn first partial page separately. */
1195                                 memset(&page, 0xff, sizeof(page));
1196                                 memcpy(&page[offset % FLASH_PAGE_SIZE],
1197                                         buffer,
1198                                         FLASH_PAGE_SIZE - (offset % FLASH_PAGE_SIZE));
1199                                 this_npages = 1;
1200                                 this_buffer = &page[0];
1201                                 count = count + (offset % FLASH_PAGE_SIZE);
1202                                 offset = offset - (offset % FLASH_PAGE_SIZE);
1203                         } else if (count < FLASH_PAGE_SIZE) {
1204                                 /* Download last incomplete page separately. */
1205                                 memset(&page, 0xff, sizeof(page));
1206                                 memcpy(&page, buffer, count);
1207                                 this_npages = 1;
1208                                 this_buffer = &page[0];
1209                                 count = FLASH_PAGE_SIZE;
1210                         } else {
1211                                 /* Download as many full pages as possible */
1212                                 this_npages = (count < buffer_size) ?
1213                                         count / FLASH_PAGE_SIZE :
1214                                         buffer_size / FLASH_PAGE_SIZE;
1215                                 this_buffer = buffer;
1216
1217                                 /* Make sure we stop at the next secured sector */
1218                                 sector = start_sector + 1;
1219                                 while (sector < bank->num_sectors) {
1220                                         /* Secured? */
1221                                         if (bank->sectors[sector].is_protected) {
1222                                                 /* Is that next sector within the current block? */
1223                                                 if ((bank->sectors[sector].offset - bank->base) <
1224                                                                 (offset + (this_npages * FLASH_PAGE_SIZE))) {
1225                                                         /* Yes! Split the block */
1226                                                         this_npages =
1227                                                                 (bank->sectors[sector].offset -
1228                                                                  bank->base - offset)
1229                                                                 / FLASH_PAGE_SIZE;
1230                                                         break;
1231                                                 }
1232                                         }
1233
1234                                         sector++;
1235                                 }
1236                         }
1237
1238                         /* Skip the current sector if it is secured */
1239                         if (bank->sectors[start_sector].is_protected) {
1240                                 LOG_DEBUG("Skip secured sector %d",
1241                                         start_sector);
1242
1243                                 /* Stop if this is the last sector */
1244                                 if (start_sector == bank->num_sectors - 1)
1245                                         break;
1246
1247                                 /* Skip */
1248                                 uint32_t nskip = bank->sectors[start_sector].size -
1249                                         (offset % bank->sectors[start_sector].size);
1250                                 offset += nskip;
1251                                 buffer += nskip;
1252                                 count = (count >= nskip) ? (count - nskip) : 0;
1253                                 continue;
1254                         }
1255
1256                         /* Execute buffer download */
1257                         retval = target_write_buffer(target, warea->address,
1258                                         this_npages * FLASH_PAGE_SIZE, this_buffer);
1259                         if (retval != ERROR_OK) {
1260                                 LOG_ERROR("Unable to write data to target");
1261                                 target_free_all_working_areas(target);
1262                                 return ERROR_FLASH_OPERATION_FAILED;
1263                         }
1264
1265                         /* Prepare registers */
1266                         buf_set_u32(reg_params[0].value, 0, 32, warea->address);
1267                         buf_set_u32(reg_params[1].value, 0, 32, offset);
1268                         buf_set_u32(reg_params[2].value, 0, 32, this_npages);
1269                         buf_set_u32(reg_params[3].value, 0, 32, FCTR);
1270                         buf_set_u32(reg_params[4].value, 0, 32, FPTR_EN_T | prog_time);
1271
1272                         /* Execute algorithm, assume breakpoint for last instruction */
1273                         armv4_5_info.common_magic = ARM_COMMON_MAGIC;
1274                         armv4_5_info.core_mode = ARM_MODE_SVC;
1275                         armv4_5_info.core_state = ARM_STATE_ARM;
1276
1277                         retval = target_run_algorithm(target, 0, NULL, 5, reg_params,
1278                                         (warea->address) + buffer_size,
1279                                         (warea->address) + buffer_size + target_code_size - 4,
1280                                         10000,  /* 10s should be enough for max. 16 KiB of data */
1281                                         &armv4_5_info);
1282
1283                         if (retval != ERROR_OK) {
1284                                 LOG_ERROR("Execution of flash algorithm failed.");
1285                                 target_free_all_working_areas(target);
1286                                 retval = ERROR_FLASH_OPERATION_FAILED;
1287                                 break;
1288                         }
1289
1290                         count -= this_npages * FLASH_PAGE_SIZE;
1291                         buffer += this_npages * FLASH_PAGE_SIZE;
1292                         offset += this_npages * FLASH_PAGE_SIZE;
1293                 }
1294
1295                 /* Free all resources */
1296                 destroy_reg_param(&reg_params[0]);
1297                 destroy_reg_param(&reg_params[1]);
1298                 destroy_reg_param(&reg_params[2]);
1299                 destroy_reg_param(&reg_params[3]);
1300                 destroy_reg_param(&reg_params[4]);
1301                 target_free_all_working_areas(target);
1302         } else {
1303                 /* Write to flash memory page-wise */
1304                 while (count != 0) {
1305                         /* How many bytes do we copy this time? */
1306                         num_bytes = (count >= FLASH_PAGE_SIZE) ?
1307                                 FLASH_PAGE_SIZE - (offset % FLASH_PAGE_SIZE) :
1308                                 count;
1309
1310                         /* Don't do anything with it if the page is in a secured sector. */
1311                         if (!bank->sectors[lpc2900_address2sector(bank, offset)].is_protected) {
1312                                 /* Set latch load mode */
1313                                 target_write_u32(target, FCTR,
1314                                         FCTR_FS_CS | FCTR_FS_WRE | FCTR_FS_WEB);
1315
1316                                 /* Always clear the buffer (a little overhead, but who cares) */
1317                                 memset(page, 0xFF, FLASH_PAGE_SIZE);
1318
1319                                 /* Copy them to the buffer */
1320                                 memcpy(&page[offset % FLASH_PAGE_SIZE],
1321                                         &buffer[offset % FLASH_PAGE_SIZE],
1322                                         num_bytes);
1323
1324                                 /* Write whole page to flash data latches */
1325                                 if (target_write_memory(target,
1326                                                 bank->base + (offset - (offset % FLASH_PAGE_SIZE)),
1327                                                 4, FLASH_PAGE_SIZE / 4, page) != ERROR_OK) {
1328                                         LOG_ERROR("Write failed @ 0x%8.8" PRIx32, offset);
1329                                         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1330
1331                                         return ERROR_FLASH_OPERATION_FAILED;
1332                                 }
1333
1334                                 /* Clear END_OF_BURN interrupt status */
1335                                 target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_BURN);
1336
1337                                 /* Set the programming time */
1338                                 target_write_u32(target, FPTR, FPTR_EN_T | prog_time);
1339
1340                                 /* Trigger flash write */
1341                                 target_write_u32(target, FCTR,
1342                                         FCTR_FS_CS | FCTR_FS_WRE | FCTR_FS_WPB | FCTR_FS_PROGREQ);
1343
1344                                 /* Wait for the end of the write operation. If it's not over
1345                                  * after one second, something went dreadfully wrong... :-(
1346                                  */
1347                                 if (lpc2900_wait_status(bank, INTSRC_END_OF_BURN, 1000) != ERROR_OK) {
1348                                         LOG_ERROR("Write failed @ 0x%8.8" PRIx32, offset);
1349                                         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1350
1351                                         return ERROR_FLASH_OPERATION_FAILED;
1352                                 }
1353                         }
1354
1355                         /* Update pointers and counters */
1356                         offset += num_bytes;
1357                         buffer += num_bytes;
1358                         count -= num_bytes;
1359                 }
1360
1361                 retval = ERROR_OK;
1362         }
1363
1364         /* Normal flash operating mode */
1365         target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1366
1367         return retval;
1368 }
1369
1370 /**
1371  * Try and identify the device.
1372  *
1373  * Determine type number and its memory layout.
1374  *
1375  * @param bank Pointer to the flash bank descriptor
1376  */
1377 static int lpc2900_probe(struct flash_bank *bank)
1378 {
1379         struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
1380         struct target *target = bank->target;
1381         int i = 0;
1382         uint32_t offset;
1383
1384
1385         if (target->state != TARGET_HALTED) {
1386                 LOG_ERROR("Target not halted");
1387                 return ERROR_TARGET_NOT_HALTED;
1388         }
1389
1390         /* We want to do this only once. */
1391         if (lpc2900_info->is_probed)
1392                 return ERROR_OK;
1393
1394         /* Probing starts with reading the CHIPID register. We will continue only
1395          * if this identifies as an LPC2900 device.
1396          */
1397         target_read_u32(target, CHIPID, &lpc2900_info->chipid);
1398
1399         if (lpc2900_info->chipid != EXPECTED_CHIPID) {
1400                 LOG_WARNING("Device is not an LPC29xx");
1401                 return ERROR_FLASH_OPERATION_FAILED;
1402         }
1403
1404         /* It's an LPC29xx device. Now read the feature register FEAT0...FEAT3. */
1405         uint32_t feat0, feat1, feat2, feat3;
1406         target_read_u32(target, FEAT0, &feat0);
1407         target_read_u32(target, FEAT1, &feat1);
1408         target_read_u32(target, FEAT2, &feat2);
1409         target_read_u32(target, FEAT3, &feat3);
1410
1411         /* Base address */
1412         bank->base = 0x20000000;
1413
1414         /* Determine flash layout from FEAT2 register */
1415         uint32_t num_64k_sectors = (feat2 >> 16) & 0xFF;
1416         uint32_t num_8k_sectors = (feat2 >> 0) & 0xFF;
1417         bank->num_sectors = num_64k_sectors + num_8k_sectors;
1418         bank->size = KiB * (64 * num_64k_sectors + 8 * num_8k_sectors);
1419
1420         /* Determine maximum contiguous RAM block */
1421         lpc2900_info->max_ram_block = 16 * KiB;
1422         if ((feat1 & 0x30) == 0x30) {
1423                 lpc2900_info->max_ram_block = 32 * KiB;
1424                 if ((feat1 & 0x0C) == 0x0C)
1425                         lpc2900_info->max_ram_block = 48 * KiB;
1426         }
1427
1428         /* Determine package code and ITCM size */
1429         uint32_t package_code = feat0 & 0x0F;
1430         uint32_t itcm_code = (feat1 >> 16) & 0x1F;
1431
1432         /* Determine the exact type number. */
1433         uint32_t found = 1;
1434         if ((package_code == 4) && (itcm_code == 5)) {
1435                 /* Old LPC2917 or LPC2919 (non-/01 devices) */
1436                 lpc2900_info->target_name = (bank->size == 768*KiB) ? "LPC2919" : "LPC2917";
1437         } else {
1438                 if (package_code == 2) {
1439                         /* 100-pin package */
1440                         if (bank->size == 128*KiB)
1441                                 lpc2900_info->target_name = "LPC2921";
1442                         else if (bank->size == 256*KiB)
1443                                 lpc2900_info->target_name = "LPC2923";
1444                         else if (bank->size == 512*KiB)
1445                                 lpc2900_info->target_name = "LPC2925";
1446                         else
1447                                 found = 0;
1448                 } else if (package_code == 4) {
1449                         /* 144-pin package */
1450                         if ((bank->size == 256*KiB) && (feat3 == 0xFFFFFFE9))
1451                                 lpc2900_info->target_name = "LPC2926";
1452                         else if ((bank->size == 512*KiB) && (feat3 == 0xFFFFFCF0))
1453                                 lpc2900_info->target_name = "LPC2917/01";
1454                         else if ((bank->size == 512*KiB) && (feat3 == 0xFFFFFFF1))
1455                                 lpc2900_info->target_name = "LPC2927";
1456                         else if ((bank->size == 768*KiB) && (feat3 == 0xFFFFFCF8))
1457                                 lpc2900_info->target_name = "LPC2919/01";
1458                         else if ((bank->size == 768*KiB) && (feat3 == 0xFFFFFFF9))
1459                                 lpc2900_info->target_name = "LPC2929";
1460                         else
1461                                 found = 0;
1462                 } else if (package_code == 5) {
1463                         /* 208-pin package */
1464                         lpc2900_info->target_name = (bank->size == 0) ? "LPC2930" : "LPC2939";
1465                 } else
1466                         found = 0;
1467         }
1468
1469         if (!found) {
1470                 LOG_WARNING("Unknown LPC29xx derivative (FEATx="
1471                         "%08" PRIx32 ":%08" PRIx32 ":%08" PRIx32 ":%08" PRIx32 ")",
1472                         feat0, feat1, feat2, feat3);
1473                 return ERROR_FLASH_OPERATION_FAILED;
1474         }
1475
1476         /* Show detected device */
1477         LOG_INFO("Flash bank %d: Device %s, %" PRIu32
1478                 " KiB in %d sectors",
1479                 bank->bank_number,
1480                 lpc2900_info->target_name, bank->size / KiB,
1481                 bank->num_sectors);
1482
1483         /* Flashless devices cannot be handled */
1484         if (bank->num_sectors == 0) {
1485                 LOG_WARNING("Flashless device cannot be handled");
1486                 return ERROR_FLASH_OPERATION_FAILED;
1487         }
1488
1489         /* Sector layout.
1490          * These are logical sector numbers. When doing real flash operations,
1491          * the logical flash number are translated into the physical flash numbers
1492          * of the device.
1493          */
1494         bank->sectors = malloc(sizeof(struct flash_sector) * bank->num_sectors);
1495
1496         offset = 0;
1497         for (i = 0; i < bank->num_sectors; i++) {
1498                 bank->sectors[i].offset = offset;
1499                 bank->sectors[i].is_erased = -1;
1500                 bank->sectors[i].is_protected = -1;
1501
1502                 if (i <= 7)
1503                         bank->sectors[i].size = 8 * KiB;
1504                 else if (i <= 18)
1505                         bank->sectors[i].size = 64 * KiB;
1506                 else {
1507                         /* We shouldn't come here. But there might be a new part out there
1508                          * that has more than 19 sectors. Politely ask for a fix then.
1509                          */
1510                         bank->sectors[i].size = 0;
1511                         LOG_ERROR("Never heard about sector %d", i);
1512                 }
1513
1514                 offset += bank->sectors[i].size;
1515         }
1516
1517         lpc2900_info->is_probed = true;
1518
1519         /* Read sector security status */
1520         if (lpc2900_read_security_status(bank) != ERROR_OK) {
1521                 LOG_ERROR("Cannot determine sector security status");
1522                 return ERROR_FLASH_OPERATION_FAILED;
1523         }
1524
1525         return ERROR_OK;
1526 }
1527
1528 /**
1529  * Run a blank check for each sector.
1530  *
1531  * For speed reasons, the device isn't read word by word.
1532  * A hash value is calculated by the hardware ("BIST") for each sector.
1533  * This value is then compared against the known hash of an empty sector.
1534  *
1535  * @param bank Pointer to the flash bank descriptor
1536  */
1537 static int lpc2900_erase_check(struct flash_bank *bank)
1538 {
1539         uint32_t status = lpc2900_is_ready(bank);
1540         if (status != ERROR_OK) {
1541                 LOG_INFO("Processor not halted/not probed");
1542                 return status;
1543         }
1544
1545         /* Use the BIST (Built-In Selft Test) to generate a signature of each flash
1546          * sector. Compare against the expected signature of an empty sector.
1547          */
1548         int sector;
1549         for (sector = 0; sector < bank->num_sectors; sector++) {
1550                 uint32_t signature[4];
1551                 status = lpc2900_run_bist128(bank, bank->sectors[sector].offset,
1552                                 bank->sectors[sector].offset + (bank->sectors[sector].size - 1), &signature);
1553                 if (status != ERROR_OK)
1554                         return status;
1555
1556                 /* The expected signatures for an empty sector are different
1557                  * for 8 KiB and 64 KiB sectors.
1558                  */
1559                 if (bank->sectors[sector].size == 8*KiB) {
1560                         bank->sectors[sector].is_erased =
1561                                 (signature[3] == 0x01ABAAAA) &&
1562                                 (signature[2] == 0xAAAAAAAA) &&
1563                                 (signature[1] == 0xAAAAAAAA) &&
1564                                 (signature[0] == 0xAAA00AAA);
1565                 }
1566                 if (bank->sectors[sector].size == 64*KiB) {
1567                         bank->sectors[sector].is_erased =
1568                                 (signature[3] == 0x11801222) &&
1569                                 (signature[2] == 0xB88844FF) &&
1570                                 (signature[1] == 0x11A22008) &&
1571                                 (signature[0] == 0x2B1BFE44);
1572                 }
1573         }
1574
1575         return ERROR_OK;
1576 }
1577
1578 /**
1579  * Get protection (sector security) status.
1580  *
1581  * Determine the status of "sector security" for each sector.
1582  * A secured sector is one that can never be erased/programmed again.
1583  *
1584  * @param bank Pointer to the flash bank descriptor
1585  */
1586 static int lpc2900_protect_check(struct flash_bank *bank)
1587 {
1588         return lpc2900_read_security_status(bank);
1589 }
1590
1591 /**
1592  * Print info about the driver (not the device).
1593  *
1594  * @param bank Pointer to the flash bank descriptor
1595  * @param buf Buffer to take the string
1596  * @param buf_size Maximum number of characters that the buffer can take
1597  */
1598 static int lpc2900_info(struct flash_bank *bank, char *buf, int buf_size)
1599 {
1600         snprintf(buf, buf_size, "lpc2900 flash driver");
1601         return ERROR_OK;
1602 }
1603
1604 struct flash_driver lpc2900_flash = {
1605         .name = "lpc2900",
1606         .commands = lpc2900_command_handlers,
1607         .flash_bank_command = lpc2900_flash_bank_command,
1608         .erase = lpc2900_erase,
1609         .protect = lpc2900_protect,
1610         .write = lpc2900_write,
1611         .read = default_flash_read,
1612         .probe = lpc2900_probe,
1613         .auto_probe = lpc2900_probe,
1614         .erase_check = lpc2900_erase_check,
1615         .protect_check = lpc2900_protect_check,
1616         .info = lpc2900_info
1617 };