You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

1618 lines
49KB

  1. /***************************************************************************
  2. * Copyright (C) 2009 by *
  3. * Rolf Meeser <rolfm_9dq@yahoo.de> *
  4. * *
  5. * This program is free software; you can redistribute it and/or modify *
  6. * it under the terms of the GNU General Public License as published by *
  7. * the Free Software Foundation; either version 2 of the License, or *
  8. * (at your option) any later version. *
  9. * *
  10. * This program is distributed in the hope that it will be useful, *
  11. * but WITHOUT ANY WARRANTY; without even the implied warranty of *
  12. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
  13. * GNU General Public License for more details. *
  14. * *
  15. * You should have received a copy of the GNU General Public License *
  16. * along with this program; if not, write to the *
  17. * Free Software Foundation, Inc., *
  18. * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *
  19. ***************************************************************************/
  20. #ifdef HAVE_CONFIG_H
  21. #include "config.h"
  22. #endif
  23. #include "imp.h"
  24. #include <helper/binarybuffer.h>
  25. #include <target/algorithm.h>
  26. #include <target/arm.h>
  27. #include <target/image.h>
  28. /* 1024 bytes */
  29. #define KiB 1024
  30. /* Some flash constants */
  31. #define FLASH_PAGE_SIZE 512 /* bytes */
  32. #define FLASH_ERASE_TIME 100000 /* microseconds */
  33. #define FLASH_PROGRAM_TIME 1000 /* microseconds */
  34. /* Chip ID / Feature Registers */
  35. #define CHIPID 0xE0000000 /* Chip ID */
  36. #define FEAT0 0xE0000100 /* Chip feature 0 */
  37. #define FEAT1 0xE0000104 /* Chip feature 1 */
  38. #define FEAT2 0xE0000108 /* Chip feature 2 (contains flash size indicator) */
  39. #define FEAT3 0xE000010C /* Chip feature 3 */
  40. #define EXPECTED_CHIPID 0x209CE02B /* Chip ID of all LPC2900 devices */
  41. /* Flash/EEPROM Control Registers */
  42. #define FCTR 0x20200000 /* Flash control */
  43. #define FPTR 0x20200008 /* Flash program-time */
  44. #define FTCTR 0x2020000C /* Flash test control */
  45. #define FBWST 0x20200010 /* Flash bridge wait-state */
  46. #define FCRA 0x2020001C /* Flash clock divider */
  47. #define FMSSTART 0x20200020 /* Flash Built-In Selft Test start address */
  48. #define FMSSTOP 0x20200024 /* Flash Built-In Selft Test stop address */
  49. #define FMS16 0x20200028 /* Flash 16-bit signature */
  50. #define FMSW0 0x2020002C /* Flash 128-bit signature Word 0 */
  51. #define FMSW1 0x20200030 /* Flash 128-bit signature Word 1 */
  52. #define FMSW2 0x20200034 /* Flash 128-bit signature Word 2 */
  53. #define FMSW3 0x20200038 /* Flash 128-bit signature Word 3 */
  54. #define EECMD 0x20200080 /* EEPROM command */
  55. #define EEADDR 0x20200084 /* EEPROM address */
  56. #define EEWDATA 0x20200088 /* EEPROM write data */
  57. #define EERDATA 0x2020008C /* EEPROM read data */
  58. #define EEWSTATE 0x20200090 /* EEPROM wait state */
  59. #define EECLKDIV 0x20200094 /* EEPROM clock divider */
  60. #define EEPWRDWN 0x20200098 /* EEPROM power-down/start */
  61. #define EEMSSTART 0x2020009C /* EEPROM BIST start address */
  62. #define EEMSSTOP 0x202000A0 /* EEPROM BIST stop address */
  63. #define EEMSSIG 0x202000A4 /* EEPROM 24-bit BIST signature */
  64. #define INT_CLR_ENABLE 0x20200FD8 /* Flash/EEPROM interrupt clear enable */
  65. #define INT_SET_ENABLE 0x20200FDC /* Flash/EEPROM interrupt set enable */
  66. #define INT_STATUS 0x20200FE0 /* Flash/EEPROM interrupt status */
  67. #define INT_ENABLE 0x20200FE4 /* Flash/EEPROM interrupt enable */
  68. #define INT_CLR_STATUS 0x20200FE8 /* Flash/EEPROM interrupt clear status */
  69. #define INT_SET_STATUS 0x20200FEC /* Flash/EEPROM interrupt set status */
  70. /* Interrupt sources */
  71. #define INTSRC_END_OF_PROG (1 << 28)
  72. #define INTSRC_END_OF_BIST (1 << 27)
  73. #define INTSRC_END_OF_RDWR (1 << 26)
  74. #define INTSRC_END_OF_MISR (1 << 2)
  75. #define INTSRC_END_OF_BURN (1 << 1)
  76. #define INTSRC_END_OF_ERASE (1 << 0)
  77. /* FCTR bits */
  78. #define FCTR_FS_LOADREQ (1 << 15)
  79. #define FCTR_FS_CACHECLR (1 << 14)
  80. #define FCTR_FS_CACHEBYP (1 << 13)
  81. #define FCTR_FS_PROGREQ (1 << 12)
  82. #define FCTR_FS_RLS (1 << 11)
  83. #define FCTR_FS_PDL (1 << 10)
  84. #define FCTR_FS_PD (1 << 9)
  85. #define FCTR_FS_WPB (1 << 7)
  86. #define FCTR_FS_ISS (1 << 6)
  87. #define FCTR_FS_RLD (1 << 5)
  88. #define FCTR_FS_DCR (1 << 4)
  89. #define FCTR_FS_WEB (1 << 2)
  90. #define FCTR_FS_WRE (1 << 1)
  91. #define FCTR_FS_CS (1 << 0)
  92. /* FPTR bits */
  93. #define FPTR_EN_T (1 << 15)
  94. /* FTCTR bits */
  95. #define FTCTR_FS_BYPASS_R (1 << 29)
  96. #define FTCTR_FS_BYPASS_W (1 << 28)
  97. /* FMSSTOP bits */
  98. #define FMSSTOP_MISR_START (1 << 17)
  99. /* EEMSSTOP bits */
  100. #define EEMSSTOP_STRTBIST (1 << 31)
  101. /* Index sector */
  102. #define ISS_CUSTOMER_START1 (0x830)
  103. #define ISS_CUSTOMER_END1 (0xA00)
  104. #define ISS_CUSTOMER_SIZE1 (ISS_CUSTOMER_END1 - ISS_CUSTOMER_START1)
  105. #define ISS_CUSTOMER_NWORDS1 (ISS_CUSTOMER_SIZE1 / 4)
  106. #define ISS_CUSTOMER_START2 (0xA40)
  107. #define ISS_CUSTOMER_END2 (0xC00)
  108. #define ISS_CUSTOMER_SIZE2 (ISS_CUSTOMER_END2 - ISS_CUSTOMER_START2)
  109. #define ISS_CUSTOMER_NWORDS2 (ISS_CUSTOMER_SIZE2 / 4)
  110. #define ISS_CUSTOMER_SIZE (ISS_CUSTOMER_SIZE1 + ISS_CUSTOMER_SIZE2)
  111. /**
  112. * Private data for \c lpc2900 flash driver.
  113. */
  114. struct lpc2900_flash_bank {
  115. /**
  116. * This flag is set when the device has been successfully probed.
  117. */
  118. bool is_probed;
  119. /**
  120. * Holds the value read from CHIPID register.
  121. * The driver will not load if the chipid doesn't match the expected
  122. * value of 0x209CE02B of the LPC2900 family. A probe will only be done
  123. * if the chipid does not yet contain the expected value.
  124. */
  125. uint32_t chipid;
  126. /**
  127. * String holding device name.
  128. * This string is set by the probe function to the type number of the
  129. * device. It takes the form "LPC29xx".
  130. */
  131. char *target_name;
  132. /**
  133. * System clock frequency.
  134. * Holds the clock frequency in Hz, as passed by the configuration file
  135. * to the <tt>flash bank</tt> command.
  136. */
  137. uint32_t clk_sys_fmc;
  138. /**
  139. * Flag to indicate that dangerous operations are possible.
  140. * This flag can be set by passing the correct password to the
  141. * <tt>lpc2900 password</tt> command. If set, other dangerous commands,
  142. * which operate on the index sector, can be executed.
  143. */
  144. uint32_t risky;
  145. /**
  146. * Maximum contiguous block of internal SRAM (bytes).
  147. * Autodetected by the driver. Not the total amount of SRAM, only the
  148. * the largest \em contiguous block!
  149. */
  150. uint32_t max_ram_block;
  151. };
  152. static uint32_t lpc2900_wait_status(struct flash_bank *bank, uint32_t mask, int timeout);
  153. static void lpc2900_setup(struct flash_bank *bank);
  154. static uint32_t lpc2900_is_ready(struct flash_bank *bank);
  155. static uint32_t lpc2900_read_security_status(struct flash_bank *bank);
  156. static uint32_t lpc2900_run_bist128(struct flash_bank *bank,
  157. uint32_t addr_from, uint32_t addr_to,
  158. uint32_t (*signature)[4]);
  159. static uint32_t lpc2900_address2sector(struct flash_bank *bank, uint32_t offset);
  160. static uint32_t lpc2900_calc_tr(uint32_t clock_var, uint32_t time_var);
  161. /*********************** Helper functions **************************/
  162. /**
  163. * Wait for an event in mask to occur in INT_STATUS.
  164. *
  165. * Return when an event occurs, or after a timeout.
  166. *
  167. * @param[in] bank Pointer to the flash bank descriptor
  168. * @param[in] mask Mask to be used for INT_STATUS
  169. * @param[in] timeout Timeout in ms
  170. */
  171. static uint32_t lpc2900_wait_status(struct flash_bank *bank,
  172. uint32_t mask,
  173. int timeout)
  174. {
  175. uint32_t int_status;
  176. struct target *target = bank->target;
  177. do {
  178. alive_sleep(1);
  179. timeout--;
  180. target_read_u32(target, INT_STATUS, &int_status);
  181. } while (((int_status & mask) == 0) && (timeout != 0));
  182. if (timeout == 0) {
  183. LOG_DEBUG("Timeout!");
  184. return ERROR_FLASH_OPERATION_FAILED;
  185. }
  186. return ERROR_OK;
  187. }
  188. /**
  189. * Set up the flash for erase/program operations.
  190. *
  191. * Enable the flash, and set the correct CRA clock of 66 kHz.
  192. *
  193. * @param bank Pointer to the flash bank descriptor
  194. */
  195. static void lpc2900_setup(struct flash_bank *bank)
  196. {
  197. uint32_t fcra;
  198. struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
  199. /* Power up the flash block */
  200. target_write_u32(bank->target, FCTR, FCTR_FS_WEB | FCTR_FS_CS);
  201. fcra = (lpc2900_info->clk_sys_fmc / (3 * 66000)) - 1;
  202. target_write_u32(bank->target, FCRA, fcra);
  203. }
  204. /**
  205. * Check if device is ready.
  206. *
  207. * Check if device is ready for flash operation:
  208. * Must have been successfully probed.
  209. * Must be halted.
  210. */
  211. static uint32_t lpc2900_is_ready(struct flash_bank *bank)
  212. {
  213. struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
  214. if (!lpc2900_info->is_probed)
  215. return ERROR_FLASH_BANK_NOT_PROBED;
  216. if (bank->target->state != TARGET_HALTED) {
  217. LOG_ERROR("Target not halted");
  218. return ERROR_TARGET_NOT_HALTED;
  219. }
  220. return ERROR_OK;
  221. }
  222. /**
  223. * Read the status of sector security from the index sector.
  224. *
  225. * @param bank Pointer to the flash bank descriptor
  226. */
  227. static uint32_t lpc2900_read_security_status(struct flash_bank *bank)
  228. {
  229. uint32_t status = lpc2900_is_ready(bank);
  230. if (status != ERROR_OK)
  231. return status;
  232. struct target *target = bank->target;
  233. /* Enable ISS access */
  234. target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB | FCTR_FS_ISS);
  235. /* Read the relevant block of memory from the ISS sector */
  236. uint32_t iss_secured_field[0x230/16][4];
  237. target_read_memory(target, bank->base + 0xC00, 4, 0x230/4,
  238. (uint8_t *)iss_secured_field);
  239. /* Disable ISS access */
  240. target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
  241. /* Check status of each sector. Note that the sector numbering in the LPC2900
  242. * is different from the logical sector numbers used in OpenOCD!
  243. * Refer to the user manual for details.
  244. *
  245. * All zeros (16x 0x00) are treated as a secured sector (is_protected = 1)
  246. * All ones (16x 0xFF) are treated as a non-secured sector (is_protected = 0)
  247. * Anything else is undefined (is_protected = -1). This is treated as
  248. * a protected sector!
  249. */
  250. int sector;
  251. int index_t;
  252. for (sector = 0; sector < bank->num_sectors; sector++) {
  253. /* Convert logical sector number to physical sector number */
  254. if (sector <= 4)
  255. index_t = sector + 11;
  256. else if (sector <= 7)
  257. index_t = sector + 27;
  258. else
  259. index_t = sector - 8;
  260. bank->sectors[sector].is_protected = -1;
  261. if ((iss_secured_field[index_t][0] == 0x00000000) &&
  262. (iss_secured_field[index_t][1] == 0x00000000) &&
  263. (iss_secured_field[index_t][2] == 0x00000000) &&
  264. (iss_secured_field[index_t][3] == 0x00000000))
  265. bank->sectors[sector].is_protected = 1;
  266. if ((iss_secured_field[index_t][0] == 0xFFFFFFFF) &&
  267. (iss_secured_field[index_t][1] == 0xFFFFFFFF) &&
  268. (iss_secured_field[index_t][2] == 0xFFFFFFFF) &&
  269. (iss_secured_field[index_t][3] == 0xFFFFFFFF))
  270. bank->sectors[sector].is_protected = 0;
  271. }
  272. return ERROR_OK;
  273. }
  274. /**
  275. * Use BIST to calculate a 128-bit hash value over a range of flash.
  276. *
  277. * @param bank Pointer to the flash bank descriptor
  278. * @param addr_from
  279. * @param addr_to
  280. * @param signature
  281. */
  282. static uint32_t lpc2900_run_bist128(struct flash_bank *bank,
  283. uint32_t addr_from,
  284. uint32_t addr_to,
  285. uint32_t (*signature)[4])
  286. {
  287. struct target *target = bank->target;
  288. /* Clear END_OF_MISR interrupt status */
  289. target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_MISR);
  290. /* Start address */
  291. target_write_u32(target, FMSSTART, addr_from >> 4);
  292. /* End address, and issue start command */
  293. target_write_u32(target, FMSSTOP, (addr_to >> 4) | FMSSTOP_MISR_START);
  294. /* Poll for end of operation. Calculate a reasonable timeout. */
  295. if (lpc2900_wait_status(bank, INTSRC_END_OF_MISR, 1000) != ERROR_OK)
  296. return ERROR_FLASH_OPERATION_FAILED;
  297. /* Return the signature */
  298. target_read_memory(target, FMSW0, 4, 4, (uint8_t *)signature);
  299. return ERROR_OK;
  300. }
  301. /**
  302. * Return sector number for given address.
  303. *
  304. * Return the (logical) sector number for a given relative address.
  305. * No sanity check is done. It assumed that the address is valid.
  306. *
  307. * @param bank Pointer to the flash bank descriptor
  308. * @param offset Offset address relative to bank start
  309. */
  310. static uint32_t lpc2900_address2sector(struct flash_bank *bank,
  311. uint32_t offset)
  312. {
  313. uint32_t address = bank->base + offset;
  314. /* Run through all sectors of this bank */
  315. int sector;
  316. for (sector = 0; sector < bank->num_sectors; sector++) {
  317. /* Return immediately if address is within the current sector */
  318. if (address < (bank->sectors[sector].offset + bank->sectors[sector].size))
  319. return sector;
  320. }
  321. /* We should never come here. If we do, return an arbitrary sector number. */
  322. return 0;
  323. }
  324. /**
  325. * Write one page to the index sector.
  326. *
  327. * @param bank Pointer to the flash bank descriptor
  328. * @param pagenum Page number (0...7)
  329. * @param page Page array (FLASH_PAGE_SIZE bytes)
  330. */
  331. static int lpc2900_write_index_page(struct flash_bank *bank,
  332. int pagenum,
  333. uint8_t (*page)[FLASH_PAGE_SIZE])
  334. {
  335. /* Only pages 4...7 are user writable */
  336. if ((pagenum < 4) || (pagenum > 7)) {
  337. LOG_ERROR("Refuse to burn index sector page %d", pagenum);
  338. return ERROR_COMMAND_ARGUMENT_INVALID;
  339. }
  340. /* Get target, and check if it's halted */
  341. struct target *target = bank->target;
  342. if (target->state != TARGET_HALTED) {
  343. LOG_ERROR("Target not halted");
  344. return ERROR_TARGET_NOT_HALTED;
  345. }
  346. /* Private info */
  347. struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
  348. /* Enable flash block and set the correct CRA clock of 66 kHz */
  349. lpc2900_setup(bank);
  350. /* Un-protect the index sector */
  351. target_write_u32(target, bank->base, 0);
  352. target_write_u32(target, FCTR,
  353. FCTR_FS_LOADREQ | FCTR_FS_WPB | FCTR_FS_ISS |
  354. FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
  355. /* Set latch load mode */
  356. target_write_u32(target, FCTR,
  357. FCTR_FS_ISS | FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
  358. /* Write whole page to flash data latches */
  359. if (target_write_memory(target,
  360. bank->base + pagenum * FLASH_PAGE_SIZE,
  361. 4, FLASH_PAGE_SIZE / 4, (uint8_t *)page) != ERROR_OK) {
  362. LOG_ERROR("Index sector write failed @ page %d", pagenum);
  363. target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
  364. return ERROR_FLASH_OPERATION_FAILED;
  365. }
  366. /* Clear END_OF_BURN interrupt status */
  367. target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_BURN);
  368. /* Set the program/erase time to FLASH_PROGRAM_TIME */
  369. target_write_u32(target, FPTR,
  370. FPTR_EN_T | lpc2900_calc_tr(lpc2900_info->clk_sys_fmc,
  371. FLASH_PROGRAM_TIME));
  372. /* Trigger flash write */
  373. target_write_u32(target, FCTR,
  374. FCTR_FS_PROGREQ | FCTR_FS_ISS |
  375. FCTR_FS_WPB | FCTR_FS_WRE | FCTR_FS_CS);
  376. /* Wait for the end of the write operation. If it's not over after one
  377. * second, something went dreadfully wrong... :-(
  378. */
  379. if (lpc2900_wait_status(bank, INTSRC_END_OF_BURN, 1000) != ERROR_OK) {
  380. LOG_ERROR("Index sector write failed @ page %d", pagenum);
  381. target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
  382. return ERROR_FLASH_OPERATION_FAILED;
  383. }
  384. target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
  385. return ERROR_OK;
  386. }
  387. /**
  388. * Calculate FPTR.TR register value for desired program/erase time.
  389. *
  390. * @param clock System clock in Hz
  391. * @param time Program/erase time in µs
  392. */
  393. static uint32_t lpc2900_calc_tr(uint32_t clock_var, uint32_t time_var)
  394. {
  395. /* ((time[µs]/1e6) * f[Hz]) + 511
  396. * FPTR.TR = -------------------------------
  397. * 512
  398. */
  399. uint32_t tr_val = (uint32_t)((((time_var / 1e6) * clock_var) + 511.0) / 512.0);
  400. return tr_val;
  401. }
  402. /*********************** Private flash commands **************************/
  403. /**
  404. * Command to determine the signature of the whole flash.
  405. *
  406. * Uses the Built-In-Self-Test (BIST) to generate a 128-bit hash value
  407. * of the flash content.
  408. */
  409. COMMAND_HANDLER(lpc2900_handle_signature_command)
  410. {
  411. uint32_t status;
  412. uint32_t signature[4];
  413. if (CMD_ARGC < 1)
  414. return ERROR_COMMAND_SYNTAX_ERROR;
  415. struct flash_bank *bank;
  416. int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
  417. if (ERROR_OK != retval)
  418. return retval;
  419. if (bank->target->state != TARGET_HALTED) {
  420. LOG_ERROR("Target not halted");
  421. return ERROR_TARGET_NOT_HALTED;
  422. }
  423. /* Run BIST over whole flash range */
  424. status = lpc2900_run_bist128(bank, bank->base, bank->base + (bank->size - 1), &signature);
  425. if (status != ERROR_OK)
  426. return status;
  427. command_print(CMD_CTX, "signature: 0x%8.8" PRIx32
  428. ":0x%8.8" PRIx32
  429. ":0x%8.8" PRIx32
  430. ":0x%8.8" PRIx32,
  431. signature[3], signature[2], signature[1], signature[0]);
  432. return ERROR_OK;
  433. }
  434. /**
  435. * Store customer info in file.
  436. *
  437. * Read customer info from index sector, and store that block of data into
  438. * a disk file. The format is binary.
  439. */
  440. COMMAND_HANDLER(lpc2900_handle_read_custom_command)
  441. {
  442. if (CMD_ARGC < 2)
  443. return ERROR_COMMAND_SYNTAX_ERROR;
  444. struct flash_bank *bank;
  445. int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
  446. if (ERROR_OK != retval)
  447. return retval;
  448. struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
  449. lpc2900_info->risky = 0;
  450. /* Get target, and check if it's halted */
  451. struct target *target = bank->target;
  452. if (target->state != TARGET_HALTED) {
  453. LOG_ERROR("Target not halted");
  454. return ERROR_TARGET_NOT_HALTED;
  455. }
  456. /* Storage for customer info. Read in two parts */
  457. uint32_t customer[ISS_CUSTOMER_NWORDS1 + ISS_CUSTOMER_NWORDS2];
  458. /* Enable access to index sector */
  459. target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB | FCTR_FS_ISS);
  460. /* Read two parts */
  461. target_read_memory(target, bank->base+ISS_CUSTOMER_START1, 4,
  462. ISS_CUSTOMER_NWORDS1,
  463. (uint8_t *)&customer[0]);
  464. target_read_memory(target, bank->base+ISS_CUSTOMER_START2, 4,
  465. ISS_CUSTOMER_NWORDS2,
  466. (uint8_t *)&customer[ISS_CUSTOMER_NWORDS1]);
  467. /* Deactivate access to index sector */
  468. target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
  469. /* Try and open the file */
  470. struct fileio fileio;
  471. const char *filename = CMD_ARGV[1];
  472. int ret = fileio_open(&fileio, filename, FILEIO_WRITE, FILEIO_BINARY);
  473. if (ret != ERROR_OK) {
  474. LOG_WARNING("Could not open file %s", filename);
  475. return ret;
  476. }
  477. size_t nwritten;
  478. ret = fileio_write(&fileio, sizeof(customer),
  479. (const uint8_t *)customer, &nwritten);
  480. if (ret != ERROR_OK) {
  481. LOG_ERROR("Write operation to file %s failed", filename);
  482. fileio_close(&fileio);
  483. return ret;
  484. }
  485. fileio_close(&fileio);
  486. return ERROR_OK;
  487. }
  488. /**
  489. * Enter password to enable potentially dangerous options.
  490. */
  491. COMMAND_HANDLER(lpc2900_handle_password_command)
  492. {
  493. if (CMD_ARGC < 2)
  494. return ERROR_COMMAND_SYNTAX_ERROR;
  495. struct flash_bank *bank;
  496. int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
  497. if (ERROR_OK != retval)
  498. return retval;
  499. struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
  500. #define ISS_PASSWORD "I_know_what_I_am_doing"
  501. lpc2900_info->risky = !strcmp(CMD_ARGV[1], ISS_PASSWORD);
  502. if (!lpc2900_info->risky) {
  503. command_print(CMD_CTX, "Wrong password (use '%s')", ISS_PASSWORD);
  504. return ERROR_COMMAND_ARGUMENT_INVALID;
  505. }
  506. command_print(CMD_CTX,
  507. "Potentially dangerous operation allowed in next command!");
  508. return ERROR_OK;
  509. }
  510. /**
  511. * Write customer info from file to the index sector.
  512. */
  513. COMMAND_HANDLER(lpc2900_handle_write_custom_command)
  514. {
  515. if (CMD_ARGC < 2)
  516. return ERROR_COMMAND_SYNTAX_ERROR;
  517. struct flash_bank *bank;
  518. int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
  519. if (ERROR_OK != retval)
  520. return retval;
  521. struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
  522. /* Check if command execution is allowed. */
  523. if (!lpc2900_info->risky) {
  524. command_print(CMD_CTX, "Command execution not allowed!");
  525. return ERROR_COMMAND_ARGUMENT_INVALID;
  526. }
  527. lpc2900_info->risky = 0;
  528. /* Get target, and check if it's halted */
  529. struct target *target = bank->target;
  530. if (target->state != TARGET_HALTED) {
  531. LOG_ERROR("Target not halted");
  532. return ERROR_TARGET_NOT_HALTED;
  533. }
  534. /* The image will always start at offset 0 */
  535. struct image image;
  536. image.base_address_set = 1;
  537. image.base_address = 0;
  538. image.start_address_set = 0;
  539. const char *filename = CMD_ARGV[1];
  540. const char *type = (CMD_ARGC >= 3) ? CMD_ARGV[2] : NULL;
  541. retval = image_open(&image, filename, type);
  542. if (retval != ERROR_OK)
  543. return retval;
  544. /* Do a sanity check: The image must be exactly the size of the customer
  545. programmable area. Any other size is rejected. */
  546. if (image.num_sections != 1) {
  547. LOG_ERROR("Only one section allowed in image file.");
  548. return ERROR_COMMAND_SYNTAX_ERROR;
  549. }
  550. if ((image.sections[0].base_address != 0) ||
  551. (image.sections[0].size != ISS_CUSTOMER_SIZE)) {
  552. LOG_ERROR("Incorrect image file size. Expected %d, "
  553. "got %" PRIu32,
  554. ISS_CUSTOMER_SIZE, image.sections[0].size);
  555. return ERROR_COMMAND_SYNTAX_ERROR;
  556. }
  557. /* Well boys, I reckon this is it... */
  558. /* Customer info is split into two blocks in pages 4 and 5. */
  559. uint8_t page[FLASH_PAGE_SIZE];
  560. /* Page 4 */
  561. uint32_t offset = ISS_CUSTOMER_START1 % FLASH_PAGE_SIZE;
  562. memset(page, 0xff, FLASH_PAGE_SIZE);
  563. size_t size_read;
  564. retval = image_read_section(&image, 0, 0,
  565. ISS_CUSTOMER_SIZE1, &page[offset], &size_read);
  566. if (retval != ERROR_OK) {
  567. LOG_ERROR("couldn't read from file '%s'", filename);
  568. image_close(&image);
  569. return retval;
  570. }
  571. retval = lpc2900_write_index_page(bank, 4, &page);
  572. if (retval != ERROR_OK) {
  573. image_close(&image);
  574. return retval;
  575. }
  576. /* Page 5 */
  577. offset = ISS_CUSTOMER_START2 % FLASH_PAGE_SIZE;
  578. memset(page, 0xff, FLASH_PAGE_SIZE);
  579. retval = image_read_section(&image, 0, ISS_CUSTOMER_SIZE1,
  580. ISS_CUSTOMER_SIZE2, &page[offset], &size_read);
  581. if (retval != ERROR_OK) {
  582. LOG_ERROR("couldn't read from file '%s'", filename);
  583. image_close(&image);
  584. return retval;
  585. }
  586. retval = lpc2900_write_index_page(bank, 5, &page);
  587. if (retval != ERROR_OK) {
  588. image_close(&image);
  589. return retval;
  590. }
  591. image_close(&image);
  592. return ERROR_OK;
  593. }
  594. /**
  595. * Activate 'sector security' for a range of sectors.
  596. */
  597. COMMAND_HANDLER(lpc2900_handle_secure_sector_command)
  598. {
  599. if (CMD_ARGC < 3)
  600. return ERROR_COMMAND_SYNTAX_ERROR;
  601. /* Get the bank descriptor */
  602. struct flash_bank *bank;
  603. int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
  604. if (ERROR_OK != retval)
  605. return retval;
  606. struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
  607. /* Check if command execution is allowed. */
  608. if (!lpc2900_info->risky) {
  609. command_print(CMD_CTX, "Command execution not allowed! "
  610. "(use 'password' command first)");
  611. return ERROR_COMMAND_ARGUMENT_INVALID;
  612. }
  613. lpc2900_info->risky = 0;
  614. /* Read sector range, and do a sanity check. */
  615. int first, last;
  616. COMMAND_PARSE_NUMBER(int, CMD_ARGV[1], first);
  617. COMMAND_PARSE_NUMBER(int, CMD_ARGV[2], last);
  618. if ((first >= bank->num_sectors) ||
  619. (last >= bank->num_sectors) ||
  620. (first > last)) {
  621. command_print(CMD_CTX, "Illegal sector range");
  622. return ERROR_COMMAND_ARGUMENT_INVALID;
  623. }
  624. uint8_t page[FLASH_PAGE_SIZE];
  625. int sector;
  626. /* Sectors in page 6 */
  627. if ((first <= 4) || (last >= 8)) {
  628. memset(&page, 0xff, FLASH_PAGE_SIZE);
  629. for (sector = first; sector <= last; sector++) {
  630. if (sector <= 4)
  631. memset(&page[0xB0 + 16*sector], 0, 16);
  632. else if (sector >= 8)
  633. memset(&page[0x00 + 16*(sector - 8)], 0, 16);
  634. }
  635. retval = lpc2900_write_index_page(bank, 6, &page);
  636. if (retval != ERROR_OK) {
  637. LOG_ERROR("failed to update index sector page 6");
  638. return retval;
  639. }
  640. }
  641. /* Sectors in page 7 */
  642. if ((first <= 7) && (last >= 5)) {
  643. memset(&page, 0xff, FLASH_PAGE_SIZE);
  644. for (sector = first; sector <= last; sector++) {
  645. if ((sector >= 5) && (sector <= 7))
  646. memset(&page[0x00 + 16*(sector - 5)], 0, 16);
  647. }
  648. retval = lpc2900_write_index_page(bank, 7, &page);
  649. if (retval != ERROR_OK) {
  650. LOG_ERROR("failed to update index sector page 7");
  651. return retval;
  652. }
  653. }
  654. command_print(CMD_CTX,
  655. "Sectors security will become effective after next power cycle");
  656. /* Update the sector security status */
  657. if (lpc2900_read_security_status(bank) != ERROR_OK) {
  658. LOG_ERROR("Cannot determine sector security status");
  659. return ERROR_FLASH_OPERATION_FAILED;
  660. }
  661. return ERROR_OK;
  662. }
  663. /**
  664. * Activate JTAG protection.
  665. */
  666. COMMAND_HANDLER(lpc2900_handle_secure_jtag_command)
  667. {
  668. if (CMD_ARGC < 1)
  669. return ERROR_COMMAND_SYNTAX_ERROR;
  670. /* Get the bank descriptor */
  671. struct flash_bank *bank;
  672. int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
  673. if (ERROR_OK != retval)
  674. return retval;
  675. struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
  676. /* Check if command execution is allowed. */
  677. if (!lpc2900_info->risky) {
  678. command_print(CMD_CTX, "Command execution not allowed! "
  679. "(use 'password' command first)");
  680. return ERROR_COMMAND_ARGUMENT_INVALID;
  681. }
  682. lpc2900_info->risky = 0;
  683. /* Prepare page */
  684. uint8_t page[FLASH_PAGE_SIZE];
  685. memset(&page, 0xff, FLASH_PAGE_SIZE);
  686. /* Insert "soft" protection word */
  687. page[0x30 + 15] = 0x7F;
  688. page[0x30 + 11] = 0x7F;
  689. page[0x30 + 7] = 0x7F;
  690. page[0x30 + 3] = 0x7F;
  691. /* Write to page 5 */
  692. retval = lpc2900_write_index_page(bank, 5, &page);
  693. if (retval != ERROR_OK) {
  694. LOG_ERROR("failed to update index sector page 5");
  695. return retval;
  696. }
  697. LOG_INFO("JTAG security set. Good bye!");
  698. return ERROR_OK;
  699. }
  700. /*********************** Flash interface functions **************************/
  701. static const struct command_registration lpc2900_exec_command_handlers[] = {
  702. {
  703. .name = "signature",
  704. .usage = "<bank>",
  705. .handler = lpc2900_handle_signature_command,
  706. .mode = COMMAND_EXEC,
  707. .help = "Calculate and display signature of flash bank.",
  708. },
  709. {
  710. .name = "read_custom",
  711. .handler = lpc2900_handle_read_custom_command,
  712. .mode = COMMAND_EXEC,
  713. .usage = "bank_id filename",
  714. .help = "Copies 912 bytes of customer information "
  715. "from index sector into file.",
  716. },
  717. {
  718. .name = "password",
  719. .handler = lpc2900_handle_password_command,
  720. .mode = COMMAND_EXEC,
  721. .usage = "bank_id password",
  722. .help = "Enter fixed password to enable 'dangerous' options.",
  723. },
  724. {
  725. .name = "write_custom",
  726. .handler = lpc2900_handle_write_custom_command,
  727. .mode = COMMAND_EXEC,
  728. .usage = "bank_id filename ('bin'|'ihex'|'elf'|'s19')",
  729. .help = "Copies 912 bytes of customer info from file "
  730. "to index sector.",
  731. },
  732. {
  733. .name = "secure_sector",
  734. .handler = lpc2900_handle_secure_sector_command,
  735. .mode = COMMAND_EXEC,
  736. .usage = "bank_id first_sector last_sector",
  737. .help = "Activate sector security for a range of sectors. "
  738. "It will be effective after a power cycle.",
  739. },
  740. {
  741. .name = "secure_jtag",
  742. .handler = lpc2900_handle_secure_jtag_command,
  743. .mode = COMMAND_EXEC,
  744. .usage = "bank_id",
  745. .help = "Disable the JTAG port. "
  746. "It will be effective after a power cycle.",
  747. },
  748. COMMAND_REGISTRATION_DONE
  749. };
  750. static const struct command_registration lpc2900_command_handlers[] = {
  751. {
  752. .name = "lpc2900",
  753. .mode = COMMAND_ANY,
  754. .help = "LPC2900 flash command group",
  755. .usage = "",
  756. .chain = lpc2900_exec_command_handlers,
  757. },
  758. COMMAND_REGISTRATION_DONE
  759. };
  760. /** Evaluate flash bank command. */
  761. FLASH_BANK_COMMAND_HANDLER(lpc2900_flash_bank_command)
  762. {
  763. struct lpc2900_flash_bank *lpc2900_info;
  764. if (CMD_ARGC < 6)
  765. return ERROR_COMMAND_SYNTAX_ERROR;
  766. lpc2900_info = malloc(sizeof(struct lpc2900_flash_bank));
  767. bank->driver_priv = lpc2900_info;
  768. /* Get flash clock.
  769. * Reject it if we can't meet the requirements for program time
  770. * (if clock too slow), or for erase time (clock too fast).
  771. */
  772. uint32_t clk_sys_fmc;
  773. COMMAND_PARSE_NUMBER(u32, CMD_ARGV[6], clk_sys_fmc);
  774. lpc2900_info->clk_sys_fmc = clk_sys_fmc * 1000;
  775. uint32_t clock_limit;
  776. /* Check program time limit */
  777. clock_limit = 512000000l / FLASH_PROGRAM_TIME;
  778. if (lpc2900_info->clk_sys_fmc < clock_limit) {
  779. LOG_WARNING("flash clock must be at least %" PRIu32 " kHz",
  780. (clock_limit / 1000));
  781. return ERROR_FLASH_BANK_INVALID;
  782. }
  783. /* Check erase time limit */
  784. clock_limit = (uint32_t)((32767.0 * 512.0 * 1e6) / FLASH_ERASE_TIME);
  785. if (lpc2900_info->clk_sys_fmc > clock_limit) {
  786. LOG_WARNING("flash clock must be a maximum of %" PRIu32 " kHz",
  787. (clock_limit / 1000));
  788. return ERROR_FLASH_BANK_INVALID;
  789. }
  790. /* Chip ID will be obtained by probing the device later */
  791. lpc2900_info->chipid = 0;
  792. lpc2900_info->is_probed = false;
  793. return ERROR_OK;
  794. }
  795. /**
  796. * Erase sector(s).
  797. *
  798. * @param bank Pointer to the flash bank descriptor
  799. * @param first First sector to be erased
  800. * @param last Last sector (including) to be erased
  801. */
  802. static int lpc2900_erase(struct flash_bank *bank, int first, int last)
  803. {
  804. uint32_t status;
  805. int sector;
  806. int last_unsecured_sector;
  807. struct target *target = bank->target;
  808. struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
  809. status = lpc2900_is_ready(bank);
  810. if (status != ERROR_OK)
  811. return status;
  812. /* Sanity check on sector range */
  813. if ((first < 0) || (last < first) || (last >= bank->num_sectors)) {
  814. LOG_INFO("Bad sector range");
  815. return ERROR_FLASH_SECTOR_INVALID;
  816. }
  817. /* Update the info about secured sectors */
  818. lpc2900_read_security_status(bank);
  819. /* The selected sector range might include secured sectors. An attempt
  820. * to erase such a sector will cause the erase to fail also for unsecured
  821. * sectors. It is necessary to determine the last unsecured sector now,
  822. * because we have to treat the last relevant sector in the list in
  823. * a special way.
  824. */
  825. last_unsecured_sector = -1;
  826. for (sector = first; sector <= last; sector++) {
  827. if (!bank->sectors[sector].is_protected)
  828. last_unsecured_sector = sector;
  829. }
  830. /* Exit now, in case of the rare constellation where all sectors in range
  831. * are secured. This is regarded a success, since erasing/programming of
  832. * secured sectors shall be handled transparently.
  833. */
  834. if (last_unsecured_sector == -1)
  835. return ERROR_OK;
  836. /* Enable flash block and set the correct CRA clock of 66 kHz */
  837. lpc2900_setup(bank);
  838. /* Clear END_OF_ERASE interrupt status */
  839. target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_ERASE);
  840. /* Set the program/erase timer to FLASH_ERASE_TIME */
  841. target_write_u32(target, FPTR,
  842. FPTR_EN_T | lpc2900_calc_tr(lpc2900_info->clk_sys_fmc,
  843. FLASH_ERASE_TIME));
  844. /* Sectors are marked for erasure, then erased all together */
  845. for (sector = first; sector <= last_unsecured_sector; sector++) {
  846. /* Only mark sectors that aren't secured. Any attempt to erase a group
  847. * of sectors will fail if any single one of them is secured!
  848. */
  849. if (!bank->sectors[sector].is_protected) {
  850. /* Unprotect the sector */
  851. target_write_u32(target, bank->sectors[sector].offset, 0);
  852. target_write_u32(target, FCTR,
  853. FCTR_FS_LOADREQ | FCTR_FS_WPB |
  854. FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
  855. /* Mark the sector for erasure. The last sector in the list
  856. triggers the erasure. */
  857. target_write_u32(target, bank->sectors[sector].offset, 0);
  858. if (sector == last_unsecured_sector) {
  859. target_write_u32(target, FCTR,
  860. FCTR_FS_PROGREQ | FCTR_FS_WPB | FCTR_FS_CS);
  861. } else {
  862. target_write_u32(target, FCTR,
  863. FCTR_FS_LOADREQ | FCTR_FS_WPB |
  864. FCTR_FS_WEB | FCTR_FS_CS);
  865. }
  866. }
  867. }
  868. /* Wait for the end of the erase operation. If it's not over after two seconds,
  869. * something went dreadfully wrong... :-(
  870. */
  871. if (lpc2900_wait_status(bank, INTSRC_END_OF_ERASE, 2000) != ERROR_OK)
  872. return ERROR_FLASH_OPERATION_FAILED;
  873. /* Normal flash operating mode */
  874. target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
  875. return ERROR_OK;
  876. }
  877. static int lpc2900_protect(struct flash_bank *bank, int set, int first, int last)
  878. {
  879. /* This command is not supported.
  880. * "Protection" in LPC2900 terms is handled transparently. Sectors will
  881. * automatically be unprotected as needed.
  882. * Instead we use the concept of sector security. A secured sector is shown
  883. * as "protected" in OpenOCD. Sector security is a permanent feature, and
  884. * cannot be disabled once activated.
  885. */
  886. return ERROR_OK;
  887. }
  888. /**
  889. * Write data to flash.
  890. *
  891. * @param bank Pointer to the flash bank descriptor
  892. * @param buffer Buffer with data
  893. * @param offset Start address (relative to bank start)
  894. * @param count Number of bytes to be programmed
  895. */
  896. static int lpc2900_write(struct flash_bank *bank, uint8_t *buffer,
  897. uint32_t offset, uint32_t count)
  898. {
  899. uint8_t page[FLASH_PAGE_SIZE];
  900. uint32_t status;
  901. uint32_t num_bytes;
  902. struct target *target = bank->target;
  903. struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
  904. int sector;
  905. int retval;
  906. static const uint32_t write_target_code[] = {
  907. /* Set auto latch mode: FCTR=CS|WRE|WEB */
  908. 0xe3a0a007, /* loop mov r10, #0x007 */
  909. 0xe583a000, /* str r10,[r3,#0] */
  910. /* Load complete page into latches */
  911. 0xe3a06020, /* mov r6,#(512/16) */
  912. 0xe8b00f00, /* next ldmia r0!,{r8-r11} */
  913. 0xe8a10f00, /* stmia r1!,{r8-r11} */
  914. 0xe2566001, /* subs r6,#1 */
  915. 0x1afffffb, /* bne next */
  916. /* Clear END_OF_BURN interrupt status */
  917. 0xe3a0a002, /* mov r10,#(1 << 1) */
  918. 0xe583afe8, /* str r10,[r3,#0xfe8] */
  919. /* Set the erase time to FLASH_PROGRAM_TIME */
  920. 0xe5834008, /* str r4,[r3,#8] */
  921. /* Trigger flash write
  922. * FCTR = CS | WRE | WPB | PROGREQ */
  923. 0xe3a0a083, /* mov r10,#0x83 */
  924. 0xe38aaa01, /* orr r10,#0x1000 */
  925. 0xe583a000, /* str r10,[r3,#0] */
  926. /* Wait for end of burn */
  927. 0xe593afe0, /* wait ldr r10,[r3,#0xfe0] */
  928. 0xe21aa002, /* ands r10,#(1 << 1) */
  929. 0x0afffffc, /* beq wait */
  930. /* End? */
  931. 0xe2522001, /* subs r2,#1 */
  932. 0x1affffed, /* bne loop */
  933. 0xeafffffe /* done b done */
  934. };
  935. status = lpc2900_is_ready(bank);
  936. if (status != ERROR_OK)
  937. return status;
  938. /* Enable flash block and set the correct CRA clock of 66 kHz */
  939. lpc2900_setup(bank);
  940. /* Update the info about secured sectors */
  941. lpc2900_read_security_status(bank);
  942. /* Unprotect all involved sectors */
  943. for (sector = 0; sector < bank->num_sectors; sector++) {
  944. /* Start address in or before this sector?
  945. * End address in or behind this sector? */
  946. if (((bank->base + offset) <
  947. (bank->sectors[sector].offset + bank->sectors[sector].size)) &&
  948. ((bank->base + (offset + count - 1)) >= bank->sectors[sector].offset)) {
  949. /* This sector is involved and needs to be unprotected.
  950. * Don't do it for secured sectors.
  951. */
  952. if (!bank->sectors[sector].is_protected) {
  953. target_write_u32(target, bank->sectors[sector].offset, 0);
  954. target_write_u32(target, FCTR,
  955. FCTR_FS_LOADREQ | FCTR_FS_WPB |
  956. FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
  957. }
  958. }
  959. }
  960. /* Set the program/erase time to FLASH_PROGRAM_TIME */
  961. uint32_t prog_time = FPTR_EN_T | lpc2900_calc_tr(lpc2900_info->clk_sys_fmc, FLASH_PROGRAM_TIME);
  962. /* If there is a working area of reasonable size, use it to program via
  963. * a target algorithm. If not, fall back to host programming. */
  964. /* We need some room for target code. */
  965. uint32_t target_code_size = sizeof(write_target_code);
  966. /* Try working area allocation. Start with a large buffer, and try with
  967. * reduced size if that fails. */
  968. struct working_area *warea;
  969. uint32_t buffer_size = lpc2900_info->max_ram_block - 1 * KiB;
  970. while ((retval = target_alloc_working_area_try(target,
  971. buffer_size + target_code_size,
  972. &warea)) != ERROR_OK) {
  973. /* Try a smaller buffer now, and stop if it's too small. */
  974. buffer_size -= 1 * KiB;
  975. if (buffer_size < 2 * KiB) {
  976. LOG_INFO("no (large enough) working area, falling back to host mode");
  977. warea = NULL;
  978. break;
  979. }
  980. }
  981. ;
  982. if (warea) {
  983. struct reg_param reg_params[5];
  984. struct arm_algorithm arm_algo;
  985. /* We can use target mode. Download the algorithm. */
  986. retval = target_write_buffer(target,
  987. (warea->address)+buffer_size,
  988. target_code_size,
  989. (uint8_t *)write_target_code);
  990. if (retval != ERROR_OK) {
  991. LOG_ERROR("Unable to write block write code to target");
  992. target_free_all_working_areas(target);
  993. return ERROR_FLASH_OPERATION_FAILED;
  994. }
  995. init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT);
  996. init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);
  997. init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);
  998. init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);
  999. init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT);
  1000. /* Write to flash in large blocks */
  1001. while (count != 0) {
  1002. uint32_t this_npages;
  1003. uint8_t *this_buffer;
  1004. int start_sector = lpc2900_address2sector(bank, offset);
  1005. /* First page / last page / rest */
  1006. if (offset % FLASH_PAGE_SIZE) {
  1007. /* Block doesn't start on page boundary.
  1008. * Burn first partial page separately. */
  1009. memset(&page, 0xff, sizeof(page));
  1010. memcpy(&page[offset % FLASH_PAGE_SIZE],
  1011. buffer,
  1012. FLASH_PAGE_SIZE - (offset % FLASH_PAGE_SIZE));
  1013. this_npages = 1;
  1014. this_buffer = &page[0];
  1015. count = count + (offset % FLASH_PAGE_SIZE);
  1016. offset = offset - (offset % FLASH_PAGE_SIZE);
  1017. } else if (count < FLASH_PAGE_SIZE) {
  1018. /* Download last incomplete page separately. */
  1019. memset(&page, 0xff, sizeof(page));
  1020. memcpy(&page, buffer, count);
  1021. this_npages = 1;
  1022. this_buffer = &page[0];
  1023. count = FLASH_PAGE_SIZE;
  1024. } else {
  1025. /* Download as many full pages as possible */
  1026. this_npages = (count < buffer_size) ?
  1027. count / FLASH_PAGE_SIZE :
  1028. buffer_size / FLASH_PAGE_SIZE;
  1029. this_buffer = buffer;
  1030. /* Make sure we stop at the next secured sector */
  1031. sector = start_sector + 1;
  1032. while (sector < bank->num_sectors) {
  1033. /* Secured? */
  1034. if (bank->sectors[sector].is_protected) {
  1035. /* Is that next sector within the current block? */
  1036. if ((bank->sectors[sector].offset - bank->base) <
  1037. (offset + (this_npages * FLASH_PAGE_SIZE))) {
  1038. /* Yes! Split the block */
  1039. this_npages =
  1040. (bank->sectors[sector].offset -
  1041. bank->base - offset)
  1042. / FLASH_PAGE_SIZE;
  1043. break;
  1044. }
  1045. }
  1046. sector++;
  1047. }
  1048. }
  1049. /* Skip the current sector if it is secured */
  1050. if (bank->sectors[start_sector].is_protected) {
  1051. LOG_DEBUG("Skip secured sector %d",
  1052. start_sector);
  1053. /* Stop if this is the last sector */
  1054. if (start_sector == bank->num_sectors - 1)
  1055. break;
  1056. /* Skip */
  1057. uint32_t nskip = bank->sectors[start_sector].size -
  1058. (offset % bank->sectors[start_sector].size);
  1059. offset += nskip;
  1060. buffer += nskip;
  1061. count = (count >= nskip) ? (count - nskip) : 0;
  1062. continue;
  1063. }
  1064. /* Execute buffer download */
  1065. retval = target_write_buffer(target, warea->address,
  1066. this_npages * FLASH_PAGE_SIZE, this_buffer);
  1067. if (retval != ERROR_OK) {
  1068. LOG_ERROR("Unable to write data to target");
  1069. target_free_all_working_areas(target);
  1070. return ERROR_FLASH_OPERATION_FAILED;
  1071. }
  1072. /* Prepare registers */
  1073. buf_set_u32(reg_params[0].value, 0, 32, warea->address);
  1074. buf_set_u32(reg_params[1].value, 0, 32, offset);
  1075. buf_set_u32(reg_params[2].value, 0, 32, this_npages);
  1076. buf_set_u32(reg_params[3].value, 0, 32, FCTR);
  1077. buf_set_u32(reg_params[4].value, 0, 32, FPTR_EN_T | prog_time);
  1078. /* Execute algorithm, assume breakpoint for last instruction */
  1079. arm_algo.common_magic = ARM_COMMON_MAGIC;
  1080. arm_algo.core_mode = ARM_MODE_SVC;
  1081. arm_algo.core_state = ARM_STATE_ARM;
  1082. retval = target_run_algorithm(target, 0, NULL, 5, reg_params,
  1083. (warea->address) + buffer_size,
  1084. (warea->address) + buffer_size + target_code_size - 4,
  1085. 10000, /* 10s should be enough for max. 16 KiB of data */
  1086. &arm_algo);
  1087. if (retval != ERROR_OK) {
  1088. LOG_ERROR("Execution of flash algorithm failed.");
  1089. target_free_all_working_areas(target);
  1090. retval = ERROR_FLASH_OPERATION_FAILED;
  1091. break;
  1092. }
  1093. count -= this_npages * FLASH_PAGE_SIZE;
  1094. buffer += this_npages * FLASH_PAGE_SIZE;
  1095. offset += this_npages * FLASH_PAGE_SIZE;
  1096. }
  1097. /* Free all resources */
  1098. destroy_reg_param(&reg_params[0]);
  1099. destroy_reg_param(&reg_params[1]);
  1100. destroy_reg_param(&reg_params[2]);
  1101. destroy_reg_param(&reg_params[3]);
  1102. destroy_reg_param(&reg_params[4]);
  1103. target_free_all_working_areas(target);
  1104. } else {
  1105. /* Write to flash memory page-wise */
  1106. while (count != 0) {
  1107. /* How many bytes do we copy this time? */
  1108. num_bytes = (count >= FLASH_PAGE_SIZE) ?
  1109. FLASH_PAGE_SIZE - (offset % FLASH_PAGE_SIZE) :
  1110. count;
  1111. /* Don't do anything with it if the page is in a secured sector. */
  1112. if (!bank->sectors[lpc2900_address2sector(bank, offset)].is_protected) {
  1113. /* Set latch load mode */
  1114. target_write_u32(target, FCTR,
  1115. FCTR_FS_CS | FCTR_FS_WRE | FCTR_FS_WEB);
  1116. /* Always clear the buffer (a little overhead, but who cares) */
  1117. memset(page, 0xFF, FLASH_PAGE_SIZE);
  1118. /* Copy them to the buffer */
  1119. memcpy(&page[offset % FLASH_PAGE_SIZE],
  1120. &buffer[offset % FLASH_PAGE_SIZE],
  1121. num_bytes);
  1122. /* Write whole page to flash data latches */
  1123. if (target_write_memory(target,
  1124. bank->base + (offset - (offset % FLASH_PAGE_SIZE)),
  1125. 4, FLASH_PAGE_SIZE / 4, page) != ERROR_OK) {
  1126. LOG_ERROR("Write failed @ 0x%8.8" PRIx32, offset);
  1127. target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
  1128. return ERROR_FLASH_OPERATION_FAILED;
  1129. }
  1130. /* Clear END_OF_BURN interrupt status */
  1131. target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_BURN);
  1132. /* Set the programming time */
  1133. target_write_u32(target, FPTR, FPTR_EN_T | prog_time);
  1134. /* Trigger flash write */
  1135. target_write_u32(target, FCTR,
  1136. FCTR_FS_CS | FCTR_FS_WRE | FCTR_FS_WPB | FCTR_FS_PROGREQ);
  1137. /* Wait for the end of the write operation. If it's not over
  1138. * after one second, something went dreadfully wrong... :-(
  1139. */
  1140. if (lpc2900_wait_status(bank, INTSRC_END_OF_BURN, 1000) != ERROR_OK) {
  1141. LOG_ERROR("Write failed @ 0x%8.8" PRIx32, offset);
  1142. target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
  1143. return ERROR_FLASH_OPERATION_FAILED;
  1144. }
  1145. }
  1146. /* Update pointers and counters */
  1147. offset += num_bytes;
  1148. buffer += num_bytes;
  1149. count -= num_bytes;
  1150. }
  1151. retval = ERROR_OK;
  1152. }
  1153. /* Normal flash operating mode */
  1154. target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
  1155. return retval;
  1156. }
  1157. /**
  1158. * Try and identify the device.
  1159. *
  1160. * Determine type number and its memory layout.
  1161. *
  1162. * @param bank Pointer to the flash bank descriptor
  1163. */
  1164. static int lpc2900_probe(struct flash_bank *bank)
  1165. {
  1166. struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
  1167. struct target *target = bank->target;
  1168. int i = 0;
  1169. uint32_t offset;
  1170. if (target->state != TARGET_HALTED) {
  1171. LOG_ERROR("Target not halted");
  1172. return ERROR_TARGET_NOT_HALTED;
  1173. }
  1174. /* We want to do this only once. */
  1175. if (lpc2900_info->is_probed)
  1176. return ERROR_OK;
  1177. /* Probing starts with reading the CHIPID register. We will continue only
  1178. * if this identifies as an LPC2900 device.
  1179. */
  1180. target_read_u32(target, CHIPID, &lpc2900_info->chipid);
  1181. if (lpc2900_info->chipid != EXPECTED_CHIPID) {
  1182. LOG_WARNING("Device is not an LPC29xx");
  1183. return ERROR_FLASH_OPERATION_FAILED;
  1184. }
  1185. /* It's an LPC29xx device. Now read the feature register FEAT0...FEAT3. */
  1186. uint32_t feat0, feat1, feat2, feat3;
  1187. target_read_u32(target, FEAT0, &feat0);
  1188. target_read_u32(target, FEAT1, &feat1);
  1189. target_read_u32(target, FEAT2, &feat2);
  1190. target_read_u32(target, FEAT3, &feat3);
  1191. /* Base address */
  1192. bank->base = 0x20000000;
  1193. /* Determine flash layout from FEAT2 register */
  1194. uint32_t num_64k_sectors = (feat2 >> 16) & 0xFF;
  1195. uint32_t num_8k_sectors = (feat2 >> 0) & 0xFF;
  1196. bank->num_sectors = num_64k_sectors + num_8k_sectors;
  1197. bank->size = KiB * (64 * num_64k_sectors + 8 * num_8k_sectors);
  1198. /* Determine maximum contiguous RAM block */
  1199. lpc2900_info->max_ram_block = 16 * KiB;
  1200. if ((feat1 & 0x30) == 0x30) {
  1201. lpc2900_info->max_ram_block = 32 * KiB;
  1202. if ((feat1 & 0x0C) == 0x0C)
  1203. lpc2900_info->max_ram_block = 48 * KiB;
  1204. }
  1205. /* Determine package code and ITCM size */
  1206. uint32_t package_code = feat0 & 0x0F;
  1207. uint32_t itcm_code = (feat1 >> 16) & 0x1F;
  1208. /* Determine the exact type number. */
  1209. uint32_t found = 1;
  1210. if ((package_code == 4) && (itcm_code == 5)) {
  1211. /* Old LPC2917 or LPC2919 (non-/01 devices) */
  1212. lpc2900_info->target_name = (bank->size == 768*KiB) ? "LPC2919" : "LPC2917";
  1213. } else {
  1214. if (package_code == 2) {
  1215. /* 100-pin package */
  1216. if (bank->size == 128*KiB)
  1217. lpc2900_info->target_name = "LPC2921";
  1218. else if (bank->size == 256*KiB)
  1219. lpc2900_info->target_name = "LPC2923";
  1220. else if (bank->size == 512*KiB)
  1221. lpc2900_info->target_name = "LPC2925";
  1222. else
  1223. found = 0;
  1224. } else if (package_code == 4) {
  1225. /* 144-pin package */
  1226. if ((bank->size == 256*KiB) && (feat3 == 0xFFFFFFE9))
  1227. lpc2900_info->target_name = "LPC2926";
  1228. else if ((bank->size == 512*KiB) && (feat3 == 0xFFFFFCF0))
  1229. lpc2900_info->target_name = "LPC2917/01";
  1230. else if ((bank->size == 512*KiB) && (feat3 == 0xFFFFFFF1))
  1231. lpc2900_info->target_name = "LPC2927";
  1232. else if ((bank->size == 768*KiB) && (feat3 == 0xFFFFFCF8))
  1233. lpc2900_info->target_name = "LPC2919/01";
  1234. else if ((bank->size == 768*KiB) && (feat3 == 0xFFFFFFF9))
  1235. lpc2900_info->target_name = "LPC2929";
  1236. else
  1237. found = 0;
  1238. } else if (package_code == 5) {
  1239. /* 208-pin package */
  1240. lpc2900_info->target_name = (bank->size == 0) ? "LPC2930" : "LPC2939";
  1241. } else
  1242. found = 0;
  1243. }
  1244. if (!found) {
  1245. LOG_WARNING("Unknown LPC29xx derivative (FEATx="
  1246. "%08" PRIx32 ":%08" PRIx32 ":%08" PRIx32 ":%08" PRIx32 ")",
  1247. feat0, feat1, feat2, feat3);
  1248. return ERROR_FLASH_OPERATION_FAILED;
  1249. }
  1250. /* Show detected device */
  1251. LOG_INFO("Flash bank %d: Device %s, %" PRIu32
  1252. " KiB in %d sectors",
  1253. bank->bank_number,
  1254. lpc2900_info->target_name, bank->size / KiB,
  1255. bank->num_sectors);
  1256. /* Flashless devices cannot be handled */
  1257. if (bank->num_sectors == 0) {
  1258. LOG_WARNING("Flashless device cannot be handled");
  1259. return ERROR_FLASH_OPERATION_FAILED;
  1260. }
  1261. /* Sector layout.
  1262. * These are logical sector numbers. When doing real flash operations,
  1263. * the logical flash number are translated into the physical flash numbers
  1264. * of the device.
  1265. */
  1266. bank->sectors = malloc(sizeof(struct flash_sector) * bank->num_sectors);
  1267. offset = 0;
  1268. for (i = 0; i < bank->num_sectors; i++) {
  1269. bank->sectors[i].offset = offset;
  1270. bank->sectors[i].is_erased = -1;
  1271. bank->sectors[i].is_protected = -1;
  1272. if (i <= 7)
  1273. bank->sectors[i].size = 8 * KiB;
  1274. else if (i <= 18)
  1275. bank->sectors[i].size = 64 * KiB;
  1276. else {
  1277. /* We shouldn't come here. But there might be a new part out there
  1278. * that has more than 19 sectors. Politely ask for a fix then.
  1279. */
  1280. bank->sectors[i].size = 0;
  1281. LOG_ERROR("Never heard about sector %d", i);
  1282. }
  1283. offset += bank->sectors[i].size;
  1284. }
  1285. lpc2900_info->is_probed = true;
  1286. /* Read sector security status */
  1287. if (lpc2900_read_security_status(bank) != ERROR_OK) {
  1288. LOG_ERROR("Cannot determine sector security status");
  1289. return ERROR_FLASH_OPERATION_FAILED;
  1290. }
  1291. return ERROR_OK;
  1292. }
  1293. /**
  1294. * Run a blank check for each sector.
  1295. *
  1296. * For speed reasons, the device isn't read word by word.
  1297. * A hash value is calculated by the hardware ("BIST") for each sector.
  1298. * This value is then compared against the known hash of an empty sector.
  1299. *
  1300. * @param bank Pointer to the flash bank descriptor
  1301. */
  1302. static int lpc2900_erase_check(struct flash_bank *bank)
  1303. {
  1304. uint32_t status = lpc2900_is_ready(bank);
  1305. if (status != ERROR_OK) {
  1306. LOG_INFO("Processor not halted/not probed");
  1307. return status;
  1308. }
  1309. /* Use the BIST (Built-In Selft Test) to generate a signature of each flash
  1310. * sector. Compare against the expected signature of an empty sector.
  1311. */
  1312. int sector;
  1313. for (sector = 0; sector < bank->num_sectors; sector++) {
  1314. uint32_t signature[4];
  1315. status = lpc2900_run_bist128(bank, bank->sectors[sector].offset,
  1316. bank->sectors[sector].offset + (bank->sectors[sector].size - 1), &signature);
  1317. if (status != ERROR_OK)
  1318. return status;
  1319. /* The expected signatures for an empty sector are different
  1320. * for 8 KiB and 64 KiB sectors.
  1321. */
  1322. if (bank->sectors[sector].size == 8*KiB) {
  1323. bank->sectors[sector].is_erased =
  1324. (signature[3] == 0x01ABAAAA) &&
  1325. (signature[2] == 0xAAAAAAAA) &&
  1326. (signature[1] == 0xAAAAAAAA) &&
  1327. (signature[0] == 0xAAA00AAA);
  1328. }
  1329. if (bank->sectors[sector].size == 64*KiB) {
  1330. bank->sectors[sector].is_erased =
  1331. (signature[3] == 0x11801222) &&
  1332. (signature[2] == 0xB88844FF) &&
  1333. (signature[1] == 0x11A22008) &&
  1334. (signature[0] == 0x2B1BFE44);
  1335. }
  1336. }
  1337. return ERROR_OK;
  1338. }
  1339. /**
  1340. * Get protection (sector security) status.
  1341. *
  1342. * Determine the status of "sector security" for each sector.
  1343. * A secured sector is one that can never be erased/programmed again.
  1344. *
  1345. * @param bank Pointer to the flash bank descriptor
  1346. */
  1347. static int lpc2900_protect_check(struct flash_bank *bank)
  1348. {
  1349. return lpc2900_read_security_status(bank);
  1350. }
  1351. /**
  1352. * Print info about the driver (not the device).
  1353. *
  1354. * @param bank Pointer to the flash bank descriptor
  1355. * @param buf Buffer to take the string
  1356. * @param buf_size Maximum number of characters that the buffer can take
  1357. */
  1358. static int lpc2900_info(struct flash_bank *bank, char *buf, int buf_size)
  1359. {
  1360. snprintf(buf, buf_size, "lpc2900 flash driver");
  1361. return ERROR_OK;
  1362. }
  1363. struct flash_driver lpc2900_flash = {
  1364. .name = "lpc2900",
  1365. .commands = lpc2900_command_handlers,
  1366. .flash_bank_command = lpc2900_flash_bank_command,
  1367. .erase = lpc2900_erase,
  1368. .protect = lpc2900_protect,
  1369. .write = lpc2900_write,
  1370. .read = default_flash_read,
  1371. .probe = lpc2900_probe,
  1372. .auto_probe = lpc2900_probe,
  1373. .erase_check = lpc2900_erase_check,
  1374. .protect_check = lpc2900_protect_check,
  1375. .info = lpc2900_info
  1376. };