You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

1003 lines
35 KiB

  1. /***************************************************************************
  2. * Copyright (C) 2011 by Marc Willam, Holger Wech *
  3. * openOCD.fseu(AT)de.fujitsu.com *
  4. * Copyright (C) 2011 Ronny Strutz *
  5. * *
  6. * Copyright (C) 2013 Nemui Trinomius *
  7. * nemuisan_kawausogasuki@live.jp *
  8. * *
  9. * This program is free software; you can redistribute it and/or modify *
  10. * it under the terms of the GNU General Public License as published by *
  11. * the Free Software Foundation; either version 2 of the License, or *
  12. * (at your option) any later version. *
  13. * *
  14. * This program is distributed in the hope that it will be useful, *
  15. * but WITHOUT ANY WARRANTY; without even the implied warranty of *
  16. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
  17. * GNU General Public License for more details. *
  18. * *
  19. * You should have received a copy of the GNU General Public License *
  20. * along with this program; if not, write to the *
  21. * Free Software Foundation, Inc., *
  22. * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *
  23. ***************************************************************************/
  24. #ifdef HAVE_CONFIG_H
  25. #include "config.h"
  26. #endif
  27. #include "imp.h"
  28. #include <helper/binarybuffer.h>
  29. #include <target/algorithm.h>
  30. #include <target/armv7m.h>
  31. #define FLASH_DQ6 0x40 /* Data toggle flag bit (TOGG) position */
  32. #define FLASH_DQ5 0x20 /* Time limit exceeding flag bit (TLOV) position */
  33. enum fm3_variant {
  34. mb9bfxx1, /* Flash Type '1' */
  35. mb9bfxx2,
  36. mb9bfxx3,
  37. mb9bfxx4,
  38. mb9bfxx5,
  39. mb9bfxx6,
  40. mb9bfxx7,
  41. mb9bfxx8,
  42. mb9afxx1, /* Flash Type '2' */
  43. mb9afxx2,
  44. mb9afxx3,
  45. mb9afxx4,
  46. mb9afxx5,
  47. mb9afxx6,
  48. mb9afxx7,
  49. mb9afxx8,
  50. };
  51. enum fm3_flash_type {
  52. fm3_no_flash_type = 0,
  53. fm3_flash_type1 = 1,
  54. fm3_flash_type2 = 2
  55. };
  56. struct fm3_flash_bank {
  57. enum fm3_variant variant;
  58. enum fm3_flash_type flashtype;
  59. int probed;
  60. };
  61. FLASH_BANK_COMMAND_HANDLER(fm3_flash_bank_command)
  62. {
  63. struct fm3_flash_bank *fm3_info;
  64. if (CMD_ARGC < 6)
  65. return ERROR_COMMAND_SYNTAX_ERROR;
  66. fm3_info = malloc(sizeof(struct fm3_flash_bank));
  67. bank->driver_priv = fm3_info;
  68. /* Flash type '1' */
  69. if (strcmp(CMD_ARGV[5], "mb9bfxx1.cpu") == 0) {
  70. fm3_info->variant = mb9bfxx1;
  71. fm3_info->flashtype = fm3_flash_type1;
  72. } else if (strcmp(CMD_ARGV[5], "mb9bfxx2.cpu") == 0) {
  73. fm3_info->variant = mb9bfxx2;
  74. fm3_info->flashtype = fm3_flash_type1;
  75. } else if (strcmp(CMD_ARGV[5], "mb9bfxx3.cpu") == 0) {
  76. fm3_info->variant = mb9bfxx3;
  77. fm3_info->flashtype = fm3_flash_type1;
  78. } else if (strcmp(CMD_ARGV[5], "mb9bfxx4.cpu") == 0) {
  79. fm3_info->variant = mb9bfxx4;
  80. fm3_info->flashtype = fm3_flash_type1;
  81. } else if (strcmp(CMD_ARGV[5], "mb9bfxx5.cpu") == 0) {
  82. fm3_info->variant = mb9bfxx5;
  83. fm3_info->flashtype = fm3_flash_type1;
  84. } else if (strcmp(CMD_ARGV[5], "mb9bfxx6.cpu") == 0) {
  85. fm3_info->variant = mb9bfxx6;
  86. fm3_info->flashtype = fm3_flash_type1;
  87. } else if (strcmp(CMD_ARGV[5], "mb9bfxx7.cpu") == 0) {
  88. fm3_info->variant = mb9bfxx7;
  89. fm3_info->flashtype = fm3_flash_type1;
  90. } else if (strcmp(CMD_ARGV[5], "mb9bfxx8.cpu") == 0) {
  91. fm3_info->variant = mb9bfxx8;
  92. fm3_info->flashtype = fm3_flash_type1;
  93. } else if (strcmp(CMD_ARGV[5], "mb9afxx1.cpu") == 0) { /* Flash type '2' */
  94. fm3_info->variant = mb9afxx1;
  95. fm3_info->flashtype = fm3_flash_type2;
  96. } else if (strcmp(CMD_ARGV[5], "mb9afxx2.cpu") == 0) {
  97. fm3_info->variant = mb9afxx2;
  98. fm3_info->flashtype = fm3_flash_type2;
  99. } else if (strcmp(CMD_ARGV[5], "mb9afxx3.cpu") == 0) {
  100. fm3_info->variant = mb9afxx3;
  101. fm3_info->flashtype = fm3_flash_type2;
  102. } else if (strcmp(CMD_ARGV[5], "mb9afxx4.cpu") == 0) {
  103. fm3_info->variant = mb9afxx4;
  104. fm3_info->flashtype = fm3_flash_type2;
  105. } else if (strcmp(CMD_ARGV[5], "mb9afxx5.cpu") == 0) {
  106. fm3_info->variant = mb9afxx5;
  107. fm3_info->flashtype = fm3_flash_type2;
  108. } else if (strcmp(CMD_ARGV[5], "mb9afxx6.cpu") == 0) {
  109. fm3_info->variant = mb9afxx6;
  110. fm3_info->flashtype = fm3_flash_type2;
  111. } else if (strcmp(CMD_ARGV[5], "mb9afxx7.cpu") == 0) {
  112. fm3_info->variant = mb9afxx7;
  113. fm3_info->flashtype = fm3_flash_type2;
  114. } else if (strcmp(CMD_ARGV[5], "mb9afxx8.cpu") == 0) {
  115. fm3_info->variant = mb9afxx8;
  116. fm3_info->flashtype = fm3_flash_type2;
  117. }
  118. /* unknown Flash type */
  119. else {
  120. LOG_ERROR("unknown fm3 variant: %s", CMD_ARGV[5]);
  121. free(fm3_info);
  122. return ERROR_FLASH_BANK_INVALID;
  123. }
  124. fm3_info->probed = 0;
  125. return ERROR_OK;
  126. }
  127. /* Data polling algorithm */
  128. static int fm3_busy_wait(struct target *target, uint32_t offset, int timeout_ms)
  129. {
  130. int retval = ERROR_OK;
  131. uint8_t state1, state2;
  132. int ms = 0;
  133. /* While(1) loop exit via "break" and "return" on error */
  134. while (1) {
  135. /* dummy-read - see flash manual */
  136. retval = target_read_u8(target, offset, &state1);
  137. if (retval != ERROR_OK)
  138. return retval;
  139. /* Data polling 1 */
  140. retval = target_read_u8(target, offset, &state1);
  141. if (retval != ERROR_OK)
  142. return retval;
  143. /* Data polling 2 */
  144. retval = target_read_u8(target, offset, &state2);
  145. if (retval != ERROR_OK)
  146. return retval;
  147. /* Flash command finished via polled data equal? */
  148. if ((state1 & FLASH_DQ6) == (state2 & FLASH_DQ6))
  149. break;
  150. /* Timeout Flag? */
  151. else if (state1 & FLASH_DQ5) {
  152. /* Retry data polling */
  153. /* Data polling 1 */
  154. retval = target_read_u8(target, offset, &state1);
  155. if (retval != ERROR_OK)
  156. return retval;
  157. /* Data polling 2 */
  158. retval = target_read_u8(target, offset, &state2);
  159. if (retval != ERROR_OK)
  160. return retval;
  161. /* Flash command finished via polled data equal? */
  162. if ((state1 & FLASH_DQ6) != (state2 & FLASH_DQ6))
  163. return ERROR_FLASH_OPERATION_FAILED;
  164. /* finish anyway */
  165. break;
  166. }
  167. usleep(1000);
  168. ++ms;
  169. /* Polling time exceeded? */
  170. if (ms > timeout_ms) {
  171. LOG_ERROR("Polling data reading timed out!");
  172. return ERROR_FLASH_OPERATION_FAILED;
  173. }
  174. }
  175. if (retval == ERROR_OK)
  176. LOG_DEBUG("fm3_busy_wait(%" PRIx32 ") needs about %d ms", offset, ms);
  177. return retval;
  178. }
  179. static int fm3_erase(struct flash_bank *bank, int first, int last)
  180. {
  181. struct fm3_flash_bank *fm3_info = bank->driver_priv;
  182. struct target *target = bank->target;
  183. int retval = ERROR_OK;
  184. uint32_t u32DummyRead;
  185. int sector, odd;
  186. uint32_t u32FlashType;
  187. uint32_t u32FlashSeqAddress1;
  188. uint32_t u32FlashSeqAddress2;
  189. struct working_area *write_algorithm;
  190. struct reg_param reg_params[3];
  191. struct armv7m_algorithm armv7m_info;
  192. u32FlashType = (uint32_t) fm3_info->flashtype;
  193. if (u32FlashType == fm3_flash_type1) {
  194. u32FlashSeqAddress1 = 0x00001550;
  195. u32FlashSeqAddress2 = 0x00000AA8;
  196. } else if (u32FlashType == fm3_flash_type2) {
  197. u32FlashSeqAddress1 = 0x00000AA8;
  198. u32FlashSeqAddress2 = 0x00000554;
  199. } else {
  200. LOG_ERROR("Flash/Device type unknown!");
  201. return ERROR_FLASH_OPERATION_FAILED;
  202. }
  203. if (target->state != TARGET_HALTED) {
  204. LOG_ERROR("Target not halted");
  205. return ERROR_TARGET_NOT_HALTED;
  206. }
  207. /* RAMCODE used for fm3 Flash sector erase: */
  208. /* R0 keeps Flash Sequence address 1 (u32FlashSeq1) */
  209. /* R1 keeps Flash Sequence address 2 (u32FlashSeq2) */
  210. /* R2 keeps Flash Offset address (ofs) */
  211. static const uint8_t fm3_flash_erase_sector_code[] = {
  212. /* *(uint16_t*)u32FlashSeq1 = 0xAA; */
  213. 0xAA, 0x24, /* MOVS R4, #0xAA */
  214. 0x04, 0x80, /* STRH R4, [R0, #0] */
  215. /* *(uint16_t*)u32FlashSeq2 = 0x55; */
  216. 0x55, 0x23, /* MOVS R3, #0x55 */
  217. 0x0B, 0x80, /* STRH R3, [R1, #0] */
  218. /* *(uint16_t*)u32FlashSeq1 = 0x80; */
  219. 0x80, 0x25, /* MOVS R5, #0x80 */
  220. 0x05, 0x80, /* STRH R5, [R0, #0] */
  221. /* *(uint16_t*)u32FlashSeq1 = 0xAA; */
  222. 0x04, 0x80, /* STRH R4, [R0, #0] */
  223. /* *(uint16_t*)u32FlashSeq2 = 0x55; */
  224. 0x0B, 0x80, /* STRH R3, [R1, #0] */
  225. /* Sector_Erase Command (0x30) */
  226. /* *(uint16_t*)ofs = 0x30; */
  227. 0x30, 0x20, /* MOVS R0, #0x30 */
  228. 0x10, 0x80, /* STRH R0, [R2, #0] */
  229. /* End Code */
  230. 0x00, 0xBE, /* BKPT #0 */
  231. };
  232. LOG_INFO("Fujitsu MB9[A/B]FXXX: Sector Erase ... (%d to %d)", first, last);
  233. /* disable HW watchdog */
  234. retval = target_write_u32(target, 0x40011C00, 0x1ACCE551);
  235. if (retval != ERROR_OK)
  236. return retval;
  237. retval = target_write_u32(target, 0x40011C00, 0xE5331AAE);
  238. if (retval != ERROR_OK)
  239. return retval;
  240. retval = target_write_u32(target, 0x40011008, 0x00000000);
  241. if (retval != ERROR_OK)
  242. return retval;
  243. /* FASZR = 0x01, Enables CPU Programming Mode (16-bit Flash acccess) */
  244. retval = target_write_u32(target, 0x40000000, 0x0001);
  245. if (retval != ERROR_OK)
  246. return retval;
  247. /* dummy read of FASZR */
  248. retval = target_read_u32(target, 0x40000000, &u32DummyRead);
  249. if (retval != ERROR_OK)
  250. return retval;
  251. /* allocate working area with flash sector erase code */
  252. if (target_alloc_working_area(target, sizeof(fm3_flash_erase_sector_code),
  253. &write_algorithm) != ERROR_OK) {
  254. LOG_WARNING("no working area available, can't do block memory writes");
  255. return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
  256. }
  257. retval = target_write_buffer(target, write_algorithm->address,
  258. sizeof(fm3_flash_erase_sector_code), fm3_flash_erase_sector_code);
  259. if (retval != ERROR_OK)
  260. return retval;
  261. armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
  262. armv7m_info.core_mode = ARM_MODE_THREAD;
  263. init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT); /* u32FlashSeqAddress1 */
  264. init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT); /* u32FlashSeqAddress2 */
  265. init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT); /* offset */
  266. /* write code buffer and use Flash sector erase code within fm3 */
  267. for (sector = first ; sector <= last ; sector++) {
  268. uint32_t offset = bank->sectors[sector].offset;
  269. for (odd = 0; odd < 2 ; odd++) {
  270. if (odd)
  271. offset += 4;
  272. buf_set_u32(reg_params[0].value, 0, 32, u32FlashSeqAddress1);
  273. buf_set_u32(reg_params[1].value, 0, 32, u32FlashSeqAddress2);
  274. buf_set_u32(reg_params[2].value, 0, 32, offset);
  275. retval = target_run_algorithm(target, 0, NULL, 3, reg_params,
  276. write_algorithm->address, 0, 100000, &armv7m_info);
  277. if (retval != ERROR_OK) {
  278. LOG_ERROR("Error executing flash erase programming algorithm");
  279. retval = ERROR_FLASH_OPERATION_FAILED;
  280. return retval;
  281. }
  282. retval = fm3_busy_wait(target, offset, 500);
  283. if (retval != ERROR_OK)
  284. return retval;
  285. }
  286. bank->sectors[sector].is_erased = 1;
  287. }
  288. target_free_working_area(target, write_algorithm);
  289. destroy_reg_param(&reg_params[0]);
  290. destroy_reg_param(&reg_params[1]);
  291. destroy_reg_param(&reg_params[2]);
  292. /* FASZR = 0x02, Enables CPU Run Mode (32-bit Flash acccess) */
  293. retval = target_write_u32(target, 0x40000000, 0x0002);
  294. if (retval != ERROR_OK)
  295. return retval;
  296. retval = target_read_u32(target, 0x40000000, &u32DummyRead); /* dummy read of FASZR */
  297. return retval;
  298. }
  299. static int fm3_write_block(struct flash_bank *bank, const uint8_t *buffer,
  300. uint32_t offset, uint32_t count)
  301. {
  302. struct fm3_flash_bank *fm3_info = bank->driver_priv;
  303. struct target *target = bank->target;
  304. uint32_t buffer_size = 2048; /* Default minimum value */
  305. struct working_area *write_algorithm;
  306. struct working_area *source;
  307. uint32_t address = bank->base + offset;
  308. struct reg_param reg_params[6];
  309. struct armv7m_algorithm armv7m_info;
  310. int retval = ERROR_OK;
  311. uint32_t u32FlashType;
  312. uint32_t u32FlashSeqAddress1;
  313. uint32_t u32FlashSeqAddress2;
  314. /* Increase buffer_size if needed */
  315. if (buffer_size < (target->working_area_size / 2))
  316. buffer_size = (target->working_area_size / 2);
  317. u32FlashType = (uint32_t) fm3_info->flashtype;
  318. if (u32FlashType == fm3_flash_type1) {
  319. u32FlashSeqAddress1 = 0x00001550;
  320. u32FlashSeqAddress2 = 0x00000AA8;
  321. } else if (u32FlashType == fm3_flash_type2) {
  322. u32FlashSeqAddress1 = 0x00000AA8;
  323. u32FlashSeqAddress2 = 0x00000554;
  324. } else {
  325. LOG_ERROR("Flash/Device type unknown!");
  326. return ERROR_FLASH_OPERATION_FAILED;
  327. }
  328. /* RAMCODE used for fm3 Flash programming: */
  329. /* R0 keeps source start address (u32Source) */
  330. /* R1 keeps target start address (u32Target) */
  331. /* R2 keeps number of halfwords to write (u32Count) */
  332. /* R3 keeps Flash Sequence address 1 (u32FlashSeq1) */
  333. /* R4 keeps Flash Sequence address 2 (u32FlashSeq2) */
  334. /* R5 returns result value (u32FlashResult) */
  335. static const uint8_t fm3_flash_write_code[] = {
  336. /* fm3_FLASH_IF->FASZ &= 0xFFFD; */
  337. 0x5F, 0xF0, 0x80, 0x45, /* MOVS.W R5, #(fm3_FLASH_IF->FASZ) */
  338. 0x2D, 0x68, /* LDR R5, [R5] */
  339. 0x4F, 0xF6, 0xFD, 0x76, /* MOVW R6, #0xFFFD */
  340. 0x35, 0x40, /* ANDS R5, R5, R6 */
  341. 0x5F, 0xF0, 0x80, 0x46, /* MOVS.W R6, #(fm3_FLASH_IF->FASZ) */
  342. 0x35, 0x60, /* STR R5, [R6] */
  343. /* fm3_FLASH_IF->FASZ |= 1; */
  344. 0x5F, 0xF0, 0x80, 0x45, /* MOVS.W R5, #(fm3_FLASH_IF->FASZ) */
  345. 0x2D, 0x68, /* LDR R5, [R3] */
  346. 0x55, 0xF0, 0x01, 0x05, /* ORRS.W R5, R5, #1 */
  347. 0x5F, 0xF0, 0x80, 0x46, /* MOVS.W R6, #(fm3_FLASH_IF->FASZ) */
  348. 0x35, 0x60, /* STR R5, [R6] */
  349. /* u32DummyRead = fm3_FLASH_IF->FASZ; */
  350. 0x28, 0x4D, /* LDR.N R5, ??u32DummyRead */
  351. 0x5F, 0xF0, 0x80, 0x46, /* MOVS.W R6, #(fm3_FLASH_IF->FASZ) */
  352. 0x36, 0x68, /* LDR R6, [R6] */
  353. 0x2E, 0x60, /* STR R6, [R5] */
  354. /* u32FlashResult = FLASH_WRITE_NO_RESULT */
  355. 0x26, 0x4D, /* LDR.N R5, ??u32FlashResult */
  356. 0x00, 0x26, /* MOVS R6, #0 */
  357. 0x2E, 0x60, /* STR R6, [R5] */
  358. /* while ((u32Count > 0 ) */
  359. /* && (u32FlashResult */
  360. /* == FLASH_WRITE_NO_RESULT)) */
  361. 0x01, 0x2A, /* L0: CMP R2, #1 */
  362. 0x2C, 0xDB, /* BLT.N L1 */
  363. 0x24, 0x4D, /* LDR.N R5, ??u32FlashResult */
  364. 0x2D, 0x68, /* LDR R5, [R5] */
  365. 0x00, 0x2D, /* CMP R5, #0 */
  366. 0x28, 0xD1, /* BNE.N L1 */
  367. /* *u32FlashSeq1 = FLASH_WRITE_1; */
  368. 0xAA, 0x25, /* MOVS R5, #0xAA */
  369. 0x1D, 0x60, /* STR R5, [R3] */
  370. /* *u32FlashSeq2 = FLASH_WRITE_2; */
  371. 0x55, 0x25, /* MOVS R5, #0x55 */
  372. 0x25, 0x60, /* STR R5, [R4] */
  373. /* *u32FlashSeq1 = FLASH_WRITE_3; */
  374. 0xA0, 0x25, /* MOVS R5, #0xA0 */
  375. 0x1D, 0x60, /* STRH R5, [R3] */
  376. /* *(volatile uint16_t*)u32Target */
  377. /* = *(volatile uint16_t*)u32Source; */
  378. 0x05, 0x88, /* LDRH R5, [R0] */
  379. 0x0D, 0x80, /* STRH R5, [R1] */
  380. /* while (u32FlashResult */
  381. /* == FLASH_WRITE_NO_RESTULT) */
  382. 0x1E, 0x4D, /* L2: LDR.N R5, ??u32FlashResult */
  383. 0x2D, 0x68, /* LDR R5, [R5] */
  384. 0x00, 0x2D, /* CMP R5, #0 */
  385. 0x11, 0xD1, /* BNE.N L3 */
  386. /* if ((*(volatile uint16_t*)u32Target */
  387. /* & FLASH_DQ5) == FLASH_DQ5) */
  388. 0x0D, 0x88, /* LDRH R5, [R1] */
  389. 0xAD, 0x06, /* LSLS R5, R5, #0x1A */
  390. 0x02, 0xD5, /* BPL.N L4 */
  391. /* u32FlashResult = FLASH_WRITE_TIMEOUT */
  392. 0x1A, 0x4D, /* LDR.N R5, ??u32FlashResult */
  393. 0x02, 0x26, /* MOVS R6, #2 */
  394. 0x2E, 0x60, /* STR R6, [R5] */
  395. /* if ((*(volatile uint16_t *)u32Target */
  396. /* & FLASH_DQ7) */
  397. /* == (*(volatile uint16_t*)u32Source */
  398. /* & FLASH_DQ7)) */
  399. 0x0D, 0x88, /* L4: LDRH R5, [R1] */
  400. 0x15, 0xF0, 0x80, 0x05, /* ANDS.W R5, R5, #0x80 */
  401. 0x06, 0x88, /* LDRH R6, [R0] */
  402. 0x16, 0xF0, 0x80, 0x06, /* ANDS.W R6, R6, #0x80 */
  403. 0xB5, 0x42, /* CMP R5, R6 */
  404. 0xED, 0xD1, /* BNE.N L2 */
  405. /* u32FlashResult = FLASH_WRITE_OKAY */
  406. 0x15, 0x4D, /* LDR.N R5, ??u32FlashResult */
  407. 0x01, 0x26, /* MOVS R6, #1 */
  408. 0x2E, 0x60, /* STR R6, [R5] */
  409. 0xE9, 0xE7, /* B.N L2 */
  410. /* if (u32FlashResult */
  411. /* != FLASH_WRITE_TIMEOUT) */
  412. 0x13, 0x4D, /* LDR.N R5, ??u32FlashResult */
  413. 0x2D, 0x68, /* LDR R5, [R5] */
  414. 0x02, 0x2D, /* CMP R5, #2 */
  415. 0x02, 0xD0, /* BEQ.N L5 */
  416. /* u32FlashResult = FLASH_WRITE_NO_RESULT */
  417. 0x11, 0x4D, /* LDR.N R5, ??u32FlashResult */
  418. 0x00, 0x26, /* MOVS R6, #0 */
  419. 0x2E, 0x60, /* STR R6, [R5] */
  420. /* u32Count--; */
  421. 0x52, 0x1E, /* L5: SUBS R2, R2, #1 */
  422. /* u32Source += 2; */
  423. 0x80, 0x1C, /* ADDS R0, R0, #2 */
  424. /* u32Target += 2; */
  425. 0x89, 0x1C, /* ADDS R1, R1, #2 */
  426. 0xD0, 0xE7, /* B.N L0 */
  427. /* fm3_FLASH_IF->FASZ &= 0xFFFE; */
  428. 0x5F, 0xF0, 0x80, 0x45, /* L1: MOVS.W R5, #(fm3_FLASH_IF->FASZ) */
  429. 0x2D, 0x68, /* LDR R5, [R5] */
  430. 0x4F, 0xF6, 0xFE, 0x76, /* MOVW R6, #0xFFFE */
  431. 0x35, 0x40, /* ANDS R5, R5, R6 */
  432. 0x5F, 0xF0, 0x80, 0x46, /* MOVS.W R6, #(fm3_FLASH_IF->FASZ) */
  433. 0x35, 0x60, /* STR R5, [R6] */
  434. /* fm3_FLASH_IF->FASZ |= 2; */
  435. 0x5F, 0xF0, 0x80, 0x45, /* MOVS.W R5, #(fm3_FLASH_IF->FASZ) */
  436. 0x2D, 0x68, /* LDR R5, [R5] */
  437. 0x55, 0xF0, 0x02, 0x05, /* ORRS.W R5, R5, #2 */
  438. 0x5F, 0xF0, 0x80, 0x46, /* MOVS.W R6, #(fm3_FLASH_IF->FASZ) */
  439. 0x35, 0x60, /* STR R5, [R6] */
  440. /* u32DummyRead = fm3_FLASH_IF->FASZ; */
  441. 0x04, 0x4D, /* LDR.N R5, ??u32DummyRead */
  442. 0x5F, 0xF0, 0x80, 0x46, /* MOVS.W R6, #(fm3_FLASH_IF->FASZ) */
  443. 0x36, 0x68, /* LDR R6, [R6] */
  444. 0x2E, 0x60, /* STR R6, [R5] */
  445. /* copy u32FlashResult to R3 for return */
  446. /* value */
  447. 0xDF, 0xF8, 0x08, 0x50, /* LDR.W R5, ??u32FlashResult */
  448. 0x2D, 0x68, /* LDR R5, [R5] */
  449. /* Breakpoint here */
  450. 0x00, 0xBE, /* BKPT #0 */
  451. /* The following address pointers assume, that the code is running from */
  452. /* SRAM basic-address + 8.These address pointers will be patched, if a */
  453. /* different start address in RAM is used (e.g. for Flash type 2)! */
  454. /* Default SRAM basic-address is 0x20000000. */
  455. 0x00, 0x00, 0x00, 0x20, /* u32DummyRead address in RAM (0x20000000) */
  456. 0x04, 0x00, 0x00, 0x20 /* u32FlashResult address in RAM (0x20000004) */
  457. };
  458. LOG_INFO("Fujitsu MB9[A/B]FXXX: FLASH Write ...");
  459. /* disable HW watchdog */
  460. retval = target_write_u32(target, 0x40011C00, 0x1ACCE551);
  461. if (retval != ERROR_OK)
  462. return retval;
  463. retval = target_write_u32(target, 0x40011C00, 0xE5331AAE);
  464. if (retval != ERROR_OK)
  465. return retval;
  466. retval = target_write_u32(target, 0x40011008, 0x00000000);
  467. if (retval != ERROR_OK)
  468. return retval;
  469. count = count / 2; /* number bytes -> number halfwords */
  470. /* check code alignment */
  471. if (offset & 0x1) {
  472. LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
  473. return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
  474. }
  475. /* allocate working area and variables with flash programming code */
  476. if (target_alloc_working_area(target, sizeof(fm3_flash_write_code) + 8,
  477. &write_algorithm) != ERROR_OK) {
  478. LOG_WARNING("no working area available, can't do block memory writes");
  479. return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
  480. }
  481. retval = target_write_buffer(target, write_algorithm->address + 8,
  482. sizeof(fm3_flash_write_code), fm3_flash_write_code);
  483. if (retval != ERROR_OK)
  484. return retval;
  485. /* Patching 'local variable address' */
  486. /* Algorithm: u32DummyRead: */
  487. retval = target_write_u32(target, (write_algorithm->address + 8)
  488. + sizeof(fm3_flash_write_code) - 8, (write_algorithm->address));
  489. if (retval != ERROR_OK)
  490. return retval;
  491. /* Algorithm: u32FlashResult: */
  492. retval = target_write_u32(target, (write_algorithm->address + 8)
  493. + sizeof(fm3_flash_write_code) - 4, (write_algorithm->address) + 4);
  494. if (retval != ERROR_OK)
  495. return retval;
  496. /* memory buffer */
  497. while (target_alloc_working_area(target, buffer_size, &source) != ERROR_OK) {
  498. buffer_size /= 2;
  499. if (buffer_size <= 256) {
  500. /* free working area, write algorithm already allocated */
  501. target_free_working_area(target, write_algorithm);
  502. LOG_WARNING("No large enough working area available, can't do block memory writes");
  503. return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
  504. }
  505. }
  506. armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
  507. armv7m_info.core_mode = ARM_MODE_THREAD;
  508. init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT); /* source start address */
  509. init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT); /* target start address */
  510. init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT); /* number of halfwords to program */
  511. init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT); /* Flash Sequence address 1 */
  512. init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT); /* Flash Sequence address 1 */
  513. init_reg_param(&reg_params[5], "r5", 32, PARAM_IN); /* result */
  514. /* write code buffer and use Flash programming code within fm3 */
  515. /* Set breakpoint to 0 with time-out of 1000 ms */
  516. while (count > 0) {
  517. uint32_t thisrun_count = (count > (buffer_size / 2)) ? (buffer_size / 2) : count;
  518. retval = target_write_buffer(target, source->address, thisrun_count * 2, buffer);
  519. if (retval != ERROR_OK)
  520. break;
  521. buf_set_u32(reg_params[0].value, 0, 32, source->address);
  522. buf_set_u32(reg_params[1].value, 0, 32, address);
  523. buf_set_u32(reg_params[2].value, 0, 32, thisrun_count);
  524. buf_set_u32(reg_params[3].value, 0, 32, u32FlashSeqAddress1);
  525. buf_set_u32(reg_params[4].value, 0, 32, u32FlashSeqAddress2);
  526. retval = target_run_algorithm(target, 0, NULL, 6, reg_params,
  527. (write_algorithm->address + 8), 0, 1000, &armv7m_info);
  528. if (retval != ERROR_OK) {
  529. LOG_ERROR("Error executing fm3 Flash programming algorithm");
  530. retval = ERROR_FLASH_OPERATION_FAILED;
  531. break;
  532. }
  533. if (buf_get_u32(reg_params[5].value, 0, 32) != ERROR_OK) {
  534. LOG_ERROR("Fujitsu MB9[A/B]FXXX: Flash programming ERROR (Timeout) -> Reg R3: %" PRIx32,
  535. buf_get_u32(reg_params[5].value, 0, 32));
  536. retval = ERROR_FLASH_OPERATION_FAILED;
  537. break;
  538. }
  539. buffer += thisrun_count * 2;
  540. address += thisrun_count * 2;
  541. count -= thisrun_count;
  542. }
  543. target_free_working_area(target, source);
  544. target_free_working_area(target, write_algorithm);
  545. destroy_reg_param(&reg_params[0]);
  546. destroy_reg_param(&reg_params[1]);
  547. destroy_reg_param(&reg_params[2]);
  548. destroy_reg_param(&reg_params[3]);
  549. destroy_reg_param(&reg_params[4]);
  550. destroy_reg_param(&reg_params[5]);
  551. return retval;
  552. }
  553. static int fm3_probe(struct flash_bank *bank)
  554. {
  555. struct fm3_flash_bank *fm3_info = bank->driver_priv;
  556. uint16_t num_pages;
  557. if (bank->target->state != TARGET_HALTED) {
  558. LOG_ERROR("Target not halted");
  559. return ERROR_TARGET_NOT_HALTED;
  560. }
  561. /*
  562. -- page-- start -- blocksize - mpu - totalFlash --
  563. page0 0x00000 16k
  564. page1 0x04000 16k
  565. page2 0x08000 96k ___ fxx3 128k Flash
  566. page3 0x20000 128k ___ fxx4 256k Flash
  567. page4 0x40000 128k ___ fxx5 384k Flash
  568. page5 0x60000 128k ___ fxx6 512k Flash
  569. -----------------------
  570. page6 0x80000 128k
  571. page7 0xa0000 128k ___ fxx7 256k Flash
  572. page8 0xc0000 128k
  573. page9 0xe0000 128k ___ fxx8 256k Flash
  574. */
  575. num_pages = 10; /* max number of Flash pages for malloc */
  576. fm3_info->probed = 0;
  577. bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
  578. bank->base = 0x00000000;
  579. bank->size = 32 * 1024; /* bytes */
  580. bank->sectors[0].offset = 0;
  581. bank->sectors[0].size = 16 * 1024;
  582. bank->sectors[0].is_erased = -1;
  583. bank->sectors[0].is_protected = -1;
  584. bank->sectors[1].offset = 0x4000;
  585. bank->sectors[1].size = 16 * 1024;
  586. bank->sectors[1].is_erased = -1;
  587. bank->sectors[1].is_protected = -1;
  588. if ((fm3_info->variant == mb9bfxx1)
  589. || (fm3_info->variant == mb9afxx1)) {
  590. num_pages = 3;
  591. bank->size = 64 * 1024; /* bytes */
  592. bank->num_sectors = num_pages;
  593. bank->sectors[2].offset = 0x8000;
  594. bank->sectors[2].size = 32 * 1024;
  595. bank->sectors[2].is_erased = -1;
  596. bank->sectors[2].is_protected = -1;
  597. }
  598. if ((fm3_info->variant == mb9bfxx2)
  599. || (fm3_info->variant == mb9bfxx4)
  600. || (fm3_info->variant == mb9bfxx5)
  601. || (fm3_info->variant == mb9bfxx6)
  602. || (fm3_info->variant == mb9bfxx7)
  603. || (fm3_info->variant == mb9bfxx8)
  604. || (fm3_info->variant == mb9afxx2)
  605. || (fm3_info->variant == mb9afxx4)
  606. || (fm3_info->variant == mb9afxx5)
  607. || (fm3_info->variant == mb9afxx6)
  608. || (fm3_info->variant == mb9afxx7)
  609. || (fm3_info->variant == mb9afxx8)) {
  610. num_pages = 3;
  611. bank->size = 128 * 1024; /* bytes */
  612. bank->num_sectors = num_pages;
  613. bank->sectors[2].offset = 0x8000;
  614. bank->sectors[2].size = 96 * 1024;
  615. bank->sectors[2].is_erased = -1;
  616. bank->sectors[2].is_protected = -1;
  617. }
  618. if ((fm3_info->variant == mb9bfxx4)
  619. || (fm3_info->variant == mb9bfxx5)
  620. || (fm3_info->variant == mb9bfxx6)
  621. || (fm3_info->variant == mb9bfxx7)
  622. || (fm3_info->variant == mb9bfxx8)
  623. || (fm3_info->variant == mb9afxx4)
  624. || (fm3_info->variant == mb9afxx5)
  625. || (fm3_info->variant == mb9afxx6)
  626. || (fm3_info->variant == mb9afxx7)
  627. || (fm3_info->variant == mb9afxx8)) {
  628. num_pages = 4;
  629. bank->size = 256 * 1024; /* bytes */
  630. bank->num_sectors = num_pages;
  631. bank->sectors[3].offset = 0x20000;
  632. bank->sectors[3].size = 128 * 1024;
  633. bank->sectors[3].is_erased = -1;
  634. bank->sectors[3].is_protected = -1;
  635. }
  636. if ((fm3_info->variant == mb9bfxx5)
  637. || (fm3_info->variant == mb9bfxx6)
  638. || (fm3_info->variant == mb9bfxx7)
  639. || (fm3_info->variant == mb9bfxx8)
  640. || (fm3_info->variant == mb9afxx5)
  641. || (fm3_info->variant == mb9afxx6)
  642. || (fm3_info->variant == mb9afxx7)
  643. || (fm3_info->variant == mb9afxx8)) {
  644. num_pages = 5;
  645. bank->size = 384 * 1024; /* bytes */
  646. bank->num_sectors = num_pages;
  647. bank->sectors[4].offset = 0x40000;
  648. bank->sectors[4].size = 128 * 1024;
  649. bank->sectors[4].is_erased = -1;
  650. bank->sectors[4].is_protected = -1;
  651. }
  652. if ((fm3_info->variant == mb9bfxx6)
  653. || (fm3_info->variant == mb9bfxx7)
  654. || (fm3_info->variant == mb9bfxx8)
  655. || (fm3_info->variant == mb9afxx6)
  656. || (fm3_info->variant == mb9afxx7)
  657. || (fm3_info->variant == mb9afxx8)) {
  658. num_pages = 6;
  659. bank->size = 512 * 1024; /* bytes */
  660. bank->num_sectors = num_pages;
  661. bank->sectors[5].offset = 0x60000;
  662. bank->sectors[5].size = 128 * 1024;
  663. bank->sectors[5].is_erased = -1;
  664. bank->sectors[5].is_protected = -1;
  665. }
  666. if ((fm3_info->variant == mb9bfxx7)
  667. || (fm3_info->variant == mb9bfxx8)
  668. || (fm3_info->variant == mb9afxx7)
  669. || (fm3_info->variant == mb9afxx8)) {
  670. num_pages = 8;
  671. bank->size = 768 * 1024; /* bytes */
  672. bank->num_sectors = num_pages;
  673. bank->sectors[6].offset = 0x80000;
  674. bank->sectors[6].size = 128 * 1024;
  675. bank->sectors[6].is_erased = -1;
  676. bank->sectors[6].is_protected = -1;
  677. bank->sectors[7].offset = 0xa0000;
  678. bank->sectors[7].size = 128 * 1024;
  679. bank->sectors[7].is_erased = -1;
  680. bank->sectors[7].is_protected = -1;
  681. }
  682. if ((fm3_info->variant == mb9bfxx8)
  683. || (fm3_info->variant == mb9afxx8)) {
  684. num_pages = 10;
  685. bank->size = 1024 * 1024; /* bytes */
  686. bank->num_sectors = num_pages;
  687. bank->sectors[8].offset = 0xc0000;
  688. bank->sectors[8].size = 128 * 1024;
  689. bank->sectors[8].is_erased = -1;
  690. bank->sectors[8].is_protected = -1;
  691. bank->sectors[9].offset = 0xe0000;
  692. bank->sectors[9].size = 128 * 1024;
  693. bank->sectors[9].is_erased = -1;
  694. bank->sectors[9].is_protected = -1;
  695. }
  696. fm3_info->probed = 1;
  697. return ERROR_OK;
  698. }
  699. static int fm3_auto_probe(struct flash_bank *bank)
  700. {
  701. struct fm3_flash_bank *fm3_info = bank->driver_priv;
  702. if (fm3_info->probed)
  703. return ERROR_OK;
  704. return fm3_probe(bank);
  705. }
  706. /* Chip erase */
  707. static int fm3_chip_erase(struct flash_bank *bank)
  708. {
  709. struct target *target = bank->target;
  710. struct fm3_flash_bank *fm3_info2 = bank->driver_priv;
  711. int retval = ERROR_OK;
  712. uint32_t u32DummyRead;
  713. uint32_t u32FlashType;
  714. uint32_t u32FlashSeqAddress1;
  715. uint32_t u32FlashSeqAddress2;
  716. struct working_area *write_algorithm;
  717. struct reg_param reg_params[3];
  718. struct armv7m_algorithm armv7m_info;
  719. u32FlashType = (uint32_t) fm3_info2->flashtype;
  720. if (u32FlashType == fm3_flash_type1) {
  721. LOG_INFO("*** Erasing mb9bfxxx type");
  722. u32FlashSeqAddress1 = 0x00001550;
  723. u32FlashSeqAddress2 = 0x00000AA8;
  724. } else if (u32FlashType == fm3_flash_type2) {
  725. LOG_INFO("*** Erasing mb9afxxx type");
  726. u32FlashSeqAddress1 = 0x00000AA8;
  727. u32FlashSeqAddress2 = 0x00000554;
  728. } else {
  729. LOG_ERROR("Flash/Device type unknown!");
  730. return ERROR_FLASH_OPERATION_FAILED;
  731. }
  732. if (target->state != TARGET_HALTED) {
  733. LOG_ERROR("Target not halted");
  734. return ERROR_TARGET_NOT_HALTED;
  735. }
  736. /* RAMCODE used for fm3 Flash chip erase: */
  737. /* R0 keeps Flash Sequence address 1 (u32FlashSeq1) */
  738. /* R1 keeps Flash Sequence address 2 (u32FlashSeq2) */
  739. static const uint8_t fm3_flash_erase_chip_code[] = {
  740. /* *(uint16_t*)u32FlashSeq1 = 0xAA; */
  741. 0xAA, 0x22, /* MOVS R2, #0xAA */
  742. 0x02, 0x80, /* STRH R2, [R0, #0] */
  743. /* *(uint16_t*)u32FlashSeq2 = 0x55; */
  744. 0x55, 0x23, /* MOVS R3, #0x55 */
  745. 0x0B, 0x80, /* STRH R3, [R1, #0] */
  746. /* *(uint16_t*)u32FlashSeq1 = 0x80; */
  747. 0x80, 0x24, /* MOVS R4, #0x80 */
  748. 0x04, 0x80, /* STRH R4, [R0, #0] */
  749. /* *(uint16_t*)u32FlashSeq1 = 0xAA; */
  750. 0x02, 0x80, /* STRH R2, [R0, #0] */
  751. /* *(uint16_t*)u32FlashSeq2 = 0x55; */
  752. 0x0B, 0x80, /* STRH R3, [R1, #0] */
  753. /* Chip_Erase Command 0x10 */
  754. /* *(uint16_t*)u32FlashSeq1 = 0x10; */
  755. 0x10, 0x21, /* MOVS R1, #0x10 */
  756. 0x01, 0x80, /* STRH R1, [R0, #0] */
  757. /* End Code */
  758. 0x00, 0xBE, /* BKPT #0 */
  759. };
  760. LOG_INFO("Fujitsu MB9[A/B]xxx: Chip Erase ... (may take several seconds)");
  761. /* disable HW watchdog */
  762. retval = target_write_u32(target, 0x40011C00, 0x1ACCE551);
  763. if (retval != ERROR_OK)
  764. return retval;
  765. retval = target_write_u32(target, 0x40011C00, 0xE5331AAE);
  766. if (retval != ERROR_OK)
  767. return retval;
  768. retval = target_write_u32(target, 0x40011008, 0x00000000);
  769. if (retval != ERROR_OK)
  770. return retval;
  771. /* FASZR = 0x01, Enables CPU Programming Mode (16-bit Flash access) */
  772. retval = target_write_u32(target, 0x40000000, 0x0001);
  773. if (retval != ERROR_OK)
  774. return retval;
  775. /* dummy read of FASZR */
  776. retval = target_read_u32(target, 0x40000000, &u32DummyRead);
  777. if (retval != ERROR_OK)
  778. return retval;
  779. /* allocate working area with flash chip erase code */
  780. if (target_alloc_working_area(target, sizeof(fm3_flash_erase_chip_code),
  781. &write_algorithm) != ERROR_OK) {
  782. LOG_WARNING("no working area available, can't do block memory writes");
  783. return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
  784. }
  785. retval = target_write_buffer(target, write_algorithm->address,
  786. sizeof(fm3_flash_erase_chip_code), fm3_flash_erase_chip_code);
  787. if (retval != ERROR_OK)
  788. return retval;
  789. armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
  790. armv7m_info.core_mode = ARM_MODE_THREAD;
  791. init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT); /* u32FlashSeqAddress1 */
  792. init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT); /* u32FlashSeqAddress2 */
  793. buf_set_u32(reg_params[0].value, 0, 32, u32FlashSeqAddress1);
  794. buf_set_u32(reg_params[1].value, 0, 32, u32FlashSeqAddress2);
  795. retval = target_run_algorithm(target, 0, NULL, 2, reg_params,
  796. write_algorithm->address, 0, 100000, &armv7m_info);
  797. if (retval != ERROR_OK) {
  798. LOG_ERROR("Error executing flash erase programming algorithm");
  799. retval = ERROR_FLASH_OPERATION_FAILED;
  800. return retval;
  801. }
  802. target_free_working_area(target, write_algorithm);
  803. destroy_reg_param(&reg_params[0]);
  804. destroy_reg_param(&reg_params[1]);
  805. retval = fm3_busy_wait(target, u32FlashSeqAddress2, 20000); /* 20s timeout */
  806. if (retval != ERROR_OK)
  807. return retval;
  808. /* FASZR = 0x02, Re-enables CPU Run Mode (32-bit Flash access) */
  809. retval = target_write_u32(target, 0x40000000, 0x0002);
  810. if (retval != ERROR_OK)
  811. return retval;
  812. retval = target_read_u32(target, 0x40000000, &u32DummyRead); /* dummy read of FASZR */
  813. return retval;
  814. }
  815. COMMAND_HANDLER(fm3_handle_chip_erase_command)
  816. {
  817. int i;
  818. if (CMD_ARGC < 1)
  819. return ERROR_COMMAND_SYNTAX_ERROR;
  820. struct flash_bank *bank;
  821. int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
  822. if (ERROR_OK != retval)
  823. return retval;
  824. if (fm3_chip_erase(bank) == ERROR_OK) {
  825. /* set all sectors as erased */
  826. for (i = 0; i < bank->num_sectors; i++)
  827. bank->sectors[i].is_erased = 1;
  828. command_print(CMD_CTX, "fm3 chip erase complete");
  829. } else {
  830. command_print(CMD_CTX, "fm3 chip erase failed");
  831. }
  832. return ERROR_OK;
  833. }
  834. static const struct command_registration fm3_exec_command_handlers[] = {
  835. {
  836. .name = "chip_erase",
  837. .usage = "<bank>",
  838. .handler = fm3_handle_chip_erase_command,
  839. .mode = COMMAND_EXEC,
  840. .help = "Erase entire Flash device.",
  841. },
  842. COMMAND_REGISTRATION_DONE
  843. };
  844. static const struct command_registration fm3_command_handlers[] = {
  845. {
  846. .name = "fm3",
  847. .mode = COMMAND_ANY,
  848. .help = "fm3 Flash command group",
  849. .usage = "",
  850. .chain = fm3_exec_command_handlers,
  851. },
  852. COMMAND_REGISTRATION_DONE
  853. };
  854. struct flash_driver fm3_flash = {
  855. .name = "fm3",
  856. .commands = fm3_command_handlers,
  857. .flash_bank_command = fm3_flash_bank_command,
  858. .erase = fm3_erase,
  859. .write = fm3_write_block,
  860. .probe = fm3_probe,
  861. .auto_probe = fm3_auto_probe,
  862. .erase_check = default_flash_blank_check,
  863. };