Code Review / openocd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | review | tree
history | raw | HEAD
flash/nor/tcl.c: fix flash bank bounds check in 'flash fill' command handler
[openocd.git] / src / flash / nor / lpc2900.c
1 /***************************************************************************
2 * Copyright (C) 2009 by *
3 * Rolf Meeser <rolfm_9dq@yahoo.de> *
4 * *
5 * This program is free software; you can redistribute it and/or modify *
6 * it under the terms of the GNU General Public License as published by *
7 * the Free Software Foundation; either version 2 of the License, or *
8 * (at your option) any later version. *
9 * *
10 * This program is distributed in the hope that it will be useful, *
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
13 * GNU General Public License for more details. *
14 * *
15 * You should have received a copy of the GNU General Public License *
16 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
17 ***************************************************************************/
18
19 #ifdef HAVE_CONFIG_H
20 #include "config.h"
21 #endif
22
23 #include "imp.h"
24 #include <helper/binarybuffer.h>
25 #include <target/algorithm.h>
26 #include <target/arm.h>
27 #include <target/image.h>
28
29 /* 1024 bytes */
30 #define KiB 1024
31
32 /* Some flash constants */
33 #define FLASH_PAGE_SIZE 512 /* bytes */
34 #define FLASH_ERASE_TIME 100000 /* microseconds */
35 #define FLASH_PROGRAM_TIME 1000 /* microseconds */
36
37 /* Chip ID / Feature Registers */
38 #define CHIPID 0xE0000000 /* Chip ID */
39 #define FEAT0 0xE0000100 /* Chip feature 0 */
40 #define FEAT1 0xE0000104 /* Chip feature 1 */
41 #define FEAT2 0xE0000108 /* Chip feature 2 (contains flash size indicator) */
42 #define FEAT3 0xE000010C /* Chip feature 3 */
43
44 #define EXPECTED_CHIPID 0x209CE02B /* Chip ID of all LPC2900 devices */
45
46 /* Flash/EEPROM Control Registers */
47 #define FCTR 0x20200000 /* Flash control */
48 #define FPTR 0x20200008 /* Flash program-time */
49 #define FTCTR 0x2020000C /* Flash test control */
50 #define FBWST 0x20200010 /* Flash bridge wait-state */
51 #define FCRA 0x2020001C /* Flash clock divider */
52 #define FMSSTART 0x20200020 /* Flash Built-In Selft Test start address */
53 #define FMSSTOP 0x20200024 /* Flash Built-In Selft Test stop address */
54 #define FMS16 0x20200028 /* Flash 16-bit signature */
55 #define FMSW0 0x2020002C /* Flash 128-bit signature Word 0 */
56 #define FMSW1 0x20200030 /* Flash 128-bit signature Word 1 */
57 #define FMSW2 0x20200034 /* Flash 128-bit signature Word 2 */
58 #define FMSW3 0x20200038 /* Flash 128-bit signature Word 3 */
59
60 #define EECMD 0x20200080 /* EEPROM command */
61 #define EEADDR 0x20200084 /* EEPROM address */
62 #define EEWDATA 0x20200088 /* EEPROM write data */
63 #define EERDATA 0x2020008C /* EEPROM read data */
64 #define EEWSTATE 0x20200090 /* EEPROM wait state */
65 #define EECLKDIV 0x20200094 /* EEPROM clock divider */
66 #define EEPWRDWN 0x20200098 /* EEPROM power-down/start */
67 #define EEMSSTART 0x2020009C /* EEPROM BIST start address */
68 #define EEMSSTOP 0x202000A0 /* EEPROM BIST stop address */
69 #define EEMSSIG 0x202000A4 /* EEPROM 24-bit BIST signature */
70
71 #define INT_CLR_ENABLE 0x20200FD8 /* Flash/EEPROM interrupt clear enable */
72 #define INT_SET_ENABLE 0x20200FDC /* Flash/EEPROM interrupt set enable */
73 #define INT_STATUS 0x20200FE0 /* Flash/EEPROM interrupt status */
74 #define INT_ENABLE 0x20200FE4 /* Flash/EEPROM interrupt enable */
75 #define INT_CLR_STATUS 0x20200FE8 /* Flash/EEPROM interrupt clear status */
76 #define INT_SET_STATUS 0x20200FEC /* Flash/EEPROM interrupt set status */
77
78 /* Interrupt sources */
79 #define INTSRC_END_OF_PROG (1 << 28)
80 #define INTSRC_END_OF_BIST (1 << 27)
81 #define INTSRC_END_OF_RDWR (1 << 26)
82 #define INTSRC_END_OF_MISR (1 << 2)
83 #define INTSRC_END_OF_BURN (1 << 1)
84 #define INTSRC_END_OF_ERASE (1 << 0)
85
86 /* FCTR bits */
87 #define FCTR_FS_LOADREQ (1 << 15)
88 #define FCTR_FS_CACHECLR (1 << 14)
89 #define FCTR_FS_CACHEBYP (1 << 13)
90 #define FCTR_FS_PROGREQ (1 << 12)
91 #define FCTR_FS_RLS (1 << 11)
92 #define FCTR_FS_PDL (1 << 10)
93 #define FCTR_FS_PD (1 << 9)
94 #define FCTR_FS_WPB (1 << 7)
95 #define FCTR_FS_ISS (1 << 6)
96 #define FCTR_FS_RLD (1 << 5)
97 #define FCTR_FS_DCR (1 << 4)
98 #define FCTR_FS_WEB (1 << 2)
99 #define FCTR_FS_WRE (1 << 1)
100 #define FCTR_FS_CS (1 << 0)
101 /* FPTR bits */
102 #define FPTR_EN_T (1 << 15)
103 /* FTCTR bits */
104 #define FTCTR_FS_BYPASS_R (1 << 29)
105 #define FTCTR_FS_BYPASS_W (1 << 28)
106 /* FMSSTOP bits */
107 #define FMSSTOP_MISR_START (1 << 17)
108 /* EEMSSTOP bits */
109 #define EEMSSTOP_STRTBIST (1 << 31)
110
111 /* Index sector */
112 #define ISS_CUSTOMER_START1 (0x830)
113 #define ISS_CUSTOMER_END1 (0xA00)
114 #define ISS_CUSTOMER_SIZE1 (ISS_CUSTOMER_END1 - ISS_CUSTOMER_START1)
115 #define ISS_CUSTOMER_NWORDS1 (ISS_CUSTOMER_SIZE1 / 4)
116 #define ISS_CUSTOMER_START2 (0xA40)
117 #define ISS_CUSTOMER_END2 (0xC00)
118 #define ISS_CUSTOMER_SIZE2 (ISS_CUSTOMER_END2 - ISS_CUSTOMER_START2)
119 #define ISS_CUSTOMER_NWORDS2 (ISS_CUSTOMER_SIZE2 / 4)
120 #define ISS_CUSTOMER_SIZE (ISS_CUSTOMER_SIZE1 + ISS_CUSTOMER_SIZE2)
121
122 /**
123 * Private data for \c lpc2900 flash driver.
124 */
125 struct lpc2900_flash_bank {
126 /**
127 * This flag is set when the device has been successfully probed.
128 */
129 bool is_probed;
130
131 /**
132 * Holds the value read from CHIPID register.
133 * The driver will not load if the chipid doesn't match the expected
134 * value of 0x209CE02B of the LPC2900 family. A probe will only be done
135 * if the chipid does not yet contain the expected value.
136 */
137 uint32_t chipid;
138
139 /**
140 * String holding device name.
141 * This string is set by the probe function to the type number of the
142 * device. It takes the form "LPC29xx".
143 */
144 char *target_name;
145
146 /**
147 * System clock frequency.
148 * Holds the clock frequency in Hz, as passed by the configuration file
149 * to the <tt>flash bank</tt> command.
150 */
151 uint32_t clk_sys_fmc;
152
153 /**
154 * Flag to indicate that dangerous operations are possible.
155 * This flag can be set by passing the correct password to the
156 * <tt>lpc2900 password</tt> command. If set, other dangerous commands,
157 * which operate on the index sector, can be executed.
158 */
159 uint32_t risky;
160
161 /**
162 * Maximum contiguous block of internal SRAM (bytes).
163 * Autodetected by the driver. Not the total amount of SRAM, only the
164 * the largest \em contiguous block!
165 */
166 uint32_t max_ram_block;
167
168 };
169
170 static uint32_t lpc2900_wait_status(struct flash_bank *bank, uint32_t mask, int timeout);
171 static void lpc2900_setup(struct flash_bank *bank);
172 static uint32_t lpc2900_is_ready(struct flash_bank *bank);
173 static uint32_t lpc2900_read_security_status(struct flash_bank *bank);
174 static uint32_t lpc2900_run_bist128(struct flash_bank *bank,
175 uint32_t addr_from, uint32_t addr_to,
176 uint32_t signature[4]);
177 static uint32_t lpc2900_address2sector(struct flash_bank *bank, uint32_t offset);
178 static uint32_t lpc2900_calc_tr(uint32_t clock_var, uint32_t time_var);
179
180 /*********************** Helper functions **************************/
181
182 /**
183 * Wait for an event in mask to occur in INT_STATUS.
184 *
185 * Return when an event occurs, or after a timeout.
186 *
187 * @param[in] bank Pointer to the flash bank descriptor
188 * @param[in] mask Mask to be used for INT_STATUS
189 * @param[in] timeout Timeout in ms
190 */
191 static uint32_t lpc2900_wait_status(struct flash_bank *bank,
192 uint32_t mask,
193 int timeout)
194 {
195 uint32_t int_status;
196 struct target *target = bank->target;
197
198 do {
199 alive_sleep(1);
200 timeout--;
201 target_read_u32(target, INT_STATUS, &int_status);
202 } while (((int_status & mask) == 0) && (timeout != 0));
203
204 if (timeout == 0) {
205 LOG_DEBUG("Timeout!");
206 return ERROR_FLASH_OPERATION_FAILED;
207 }
208
209 return ERROR_OK;
210 }
211
212 /**
213 * Set up the flash for erase/program operations.
214 *
215 * Enable the flash, and set the correct CRA clock of 66 kHz.
216 *
217 * @param bank Pointer to the flash bank descriptor
218 */
219 static void lpc2900_setup(struct flash_bank *bank)
220 {
221 uint32_t fcra;
222 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
223
224 /* Power up the flash block */
225 target_write_u32(bank->target, FCTR, FCTR_FS_WEB | FCTR_FS_CS);
226
227 fcra = (lpc2900_info->clk_sys_fmc / (3 * 66000)) - 1;
228 target_write_u32(bank->target, FCRA, fcra);
229 }
230
231 /**
232 * Check if device is ready.
233 *
234 * Check if device is ready for flash operation:
235 * Must have been successfully probed.
236 * Must be halted.
237 */
238 static uint32_t lpc2900_is_ready(struct flash_bank *bank)
239 {
240 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
241
242 if (!lpc2900_info->is_probed)
243 return ERROR_FLASH_BANK_NOT_PROBED;
244
245 if (bank->target->state != TARGET_HALTED) {
246 LOG_ERROR("Target not halted");
247 return ERROR_TARGET_NOT_HALTED;
248 }
249
250 return ERROR_OK;
251 }
252
253 /**
254 * Read the status of sector security from the index sector.
255 *
256 * @param bank Pointer to the flash bank descriptor
257 */
258 static uint32_t lpc2900_read_security_status(struct flash_bank *bank)
259 {
260 uint32_t status = lpc2900_is_ready(bank);
261 if (status != ERROR_OK)
262 return status;
263
264 struct target *target = bank->target;
265
266 /* Enable ISS access */
267 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB | FCTR_FS_ISS);
268
269 /* Read the relevant block of memory from the ISS sector */
270 uint32_t iss_secured_field[0x230/16][4];
271 target_read_memory(target, bank->base + 0xC00, 4, 0x230/4,
272 (uint8_t *)iss_secured_field);
273
274 /* Disable ISS access */
275 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
276
277 /* Check status of each sector. Note that the sector numbering in the LPC2900
278 * is different from the logical sector numbers used in OpenOCD!
279 * Refer to the user manual for details.
280 *
281 * All zeros (16x 0x00) are treated as a secured sector (is_protected = 1)
282 * All ones (16x 0xFF) are treated as a non-secured sector (is_protected = 0)
283 * Anything else is undefined (is_protected = -1). This is treated as
284 * a protected sector!
285 */
286 int sector;
287 int index_t;
288 for (sector = 0; sector < bank->num_sectors; sector++) {
289 /* Convert logical sector number to physical sector number */
290 if (sector <= 4)
291 index_t = sector + 11;
292 else if (sector <= 7)
293 index_t = sector + 27;
294 else
295 index_t = sector - 8;
296
297 bank->sectors[sector].is_protected = -1;
298
299 if ((iss_secured_field[index_t][0] == 0x00000000) &&
300 (iss_secured_field[index_t][1] == 0x00000000) &&
301 (iss_secured_field[index_t][2] == 0x00000000) &&
302 (iss_secured_field[index_t][3] == 0x00000000))
303 bank->sectors[sector].is_protected = 1;
304
305 if ((iss_secured_field[index_t][0] == 0xFFFFFFFF) &&
306 (iss_secured_field[index_t][1] == 0xFFFFFFFF) &&
307 (iss_secured_field[index_t][2] == 0xFFFFFFFF) &&
308 (iss_secured_field[index_t][3] == 0xFFFFFFFF))
309 bank->sectors[sector].is_protected = 0;
310 }
311
312 return ERROR_OK;
313 }
314
315 /**
316 * Use BIST to calculate a 128-bit hash value over a range of flash.
317 *
318 * @param bank Pointer to the flash bank descriptor
319 * @param addr_from
320 * @param addr_to
321 * @param signature
322 */
323 static uint32_t lpc2900_run_bist128(struct flash_bank *bank,
324 uint32_t addr_from,
325 uint32_t addr_to,
326 uint32_t signature[4])
327 {
328 struct target *target = bank->target;
329
330 /* Clear END_OF_MISR interrupt status */
331 target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_MISR);
332
333 /* Start address */
334 target_write_u32(target, FMSSTART, addr_from >> 4);
335 /* End address, and issue start command */
336 target_write_u32(target, FMSSTOP, (addr_to >> 4) | FMSSTOP_MISR_START);
337
338 /* Poll for end of operation. Calculate a reasonable timeout. */
339 if (lpc2900_wait_status(bank, INTSRC_END_OF_MISR, 1000) != ERROR_OK)
340 return ERROR_FLASH_OPERATION_FAILED;
341
342 /* Return the signature */
343 uint8_t sig_buf[4 * 4];
344 target_read_memory(target, FMSW0, 4, 4, sig_buf);
345 target_buffer_get_u32_array(target, sig_buf, 4, signature);
346
347 return ERROR_OK;
348 }
349
350 /**
351 * Return sector number for given address.
352 *
353 * Return the (logical) sector number for a given relative address.
354 * No sanity check is done. It assumed that the address is valid.
355 *
356 * @param bank Pointer to the flash bank descriptor
357 * @param offset Offset address relative to bank start
358 */
359 static uint32_t lpc2900_address2sector(struct flash_bank *bank,
360 uint32_t offset)
361 {
362 uint32_t address = bank->base + offset;
363
364 /* Run through all sectors of this bank */
365 int sector;
366 for (sector = 0; sector < bank->num_sectors; sector++) {
367 /* Return immediately if address is within the current sector */
368 if (address < (bank->sectors[sector].offset + bank->sectors[sector].size))
369 return sector;
370 }
371
372 /* We should never come here. If we do, return an arbitrary sector number. */
373 return 0;
374 }
375
376 /**
377 * Write one page to the index sector.
378 *
379 * @param bank Pointer to the flash bank descriptor
380 * @param pagenum Page number (0...7)
381 * @param page Page array (FLASH_PAGE_SIZE bytes)
382 */
383 static int lpc2900_write_index_page(struct flash_bank *bank,
384 int pagenum,
385 uint8_t page[FLASH_PAGE_SIZE])
386 {
387 /* Only pages 4...7 are user writable */
388 if ((pagenum < 4) || (pagenum > 7)) {
389 LOG_ERROR("Refuse to burn index sector page %d", pagenum);
390 return ERROR_COMMAND_ARGUMENT_INVALID;
391 }
392
393 /* Get target, and check if it's halted */
394 struct target *target = bank->target;
395 if (target->state != TARGET_HALTED) {
396 LOG_ERROR("Target not halted");
397 return ERROR_TARGET_NOT_HALTED;
398 }
399
400 /* Private info */
401 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
402
403 /* Enable flash block and set the correct CRA clock of 66 kHz */
404 lpc2900_setup(bank);
405
406 /* Un-protect the index sector */
407 target_write_u32(target, bank->base, 0);
408 target_write_u32(target, FCTR,
409 FCTR_FS_LOADREQ | FCTR_FS_WPB | FCTR_FS_ISS |
410 FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
411
412 /* Set latch load mode */
413 target_write_u32(target, FCTR,
414 FCTR_FS_ISS | FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
415
416 /* Write whole page to flash data latches */
417 if (target_write_memory(target,
418 bank->base + pagenum * FLASH_PAGE_SIZE,
419 4, FLASH_PAGE_SIZE / 4, page) != ERROR_OK) {
420 LOG_ERROR("Index sector write failed @ page %d", pagenum);
421 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
422
423 return ERROR_FLASH_OPERATION_FAILED;
424 }
425
426 /* Clear END_OF_BURN interrupt status */
427 target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_BURN);
428
429 /* Set the program/erase time to FLASH_PROGRAM_TIME */
430 target_write_u32(target, FPTR,
431 FPTR_EN_T | lpc2900_calc_tr(lpc2900_info->clk_sys_fmc,
432 FLASH_PROGRAM_TIME));
433
434 /* Trigger flash write */
435 target_write_u32(target, FCTR,
436 FCTR_FS_PROGREQ | FCTR_FS_ISS |
437 FCTR_FS_WPB | FCTR_FS_WRE | FCTR_FS_CS);
438
439 /* Wait for the end of the write operation. If it's not over after one
440 * second, something went dreadfully wrong... :-(
441 */
442 if (lpc2900_wait_status(bank, INTSRC_END_OF_BURN, 1000) != ERROR_OK) {
443 LOG_ERROR("Index sector write failed @ page %d", pagenum);
444 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
445
446 return ERROR_FLASH_OPERATION_FAILED;
447 }
448
449 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
450
451 return ERROR_OK;
452 }
453
454 /**
455 * Calculate FPTR.TR register value for desired program/erase time.
456 *
457 * @param clock System clock in Hz
458 * @param time Program/erase time in µs
459 */
460 static uint32_t lpc2900_calc_tr(uint32_t clock_var, uint32_t time_var)
461 {
462 /* ((time[µs]/1e6) * f[Hz]) + 511
463 * FPTR.TR = -------------------------------
464 * 512
465 */
466
467 uint32_t tr_val = (uint32_t)((((time_var / 1e6) * clock_var) + 511.0) / 512.0);
468
469 return tr_val;
470 }
471
472 /*********************** Private flash commands **************************/
473
474
475 /**
476 * Command to determine the signature of the whole flash.
477 *
478 * Uses the Built-In-Self-Test (BIST) to generate a 128-bit hash value
479 * of the flash content.
480 */
481 COMMAND_HANDLER(lpc2900_handle_signature_command)
482 {
483 uint32_t status;
484 uint32_t signature[4];
485
486 if (CMD_ARGC < 1)
487 return ERROR_COMMAND_SYNTAX_ERROR;
488
489 struct flash_bank *bank;
490 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
491 if (ERROR_OK != retval)
492 return retval;
493
494 if (bank->target->state != TARGET_HALTED) {
495 LOG_ERROR("Target not halted");
496 return ERROR_TARGET_NOT_HALTED;
497 }
498
499 /* Run BIST over whole flash range */
500 status = lpc2900_run_bist128(bank, bank->base, bank->base + (bank->size - 1), signature);
501 if (status != ERROR_OK)
502 return status;
503
504 command_print(CMD_CTX, "signature: 0x%8.8" PRIx32
505 ":0x%8.8" PRIx32
506 ":0x%8.8" PRIx32
507 ":0x%8.8" PRIx32,
508 signature[3], signature[2], signature[1], signature[0]);
509
510 return ERROR_OK;
511 }
512
513 /**
514 * Store customer info in file.
515 *
516 * Read customer info from index sector, and store that block of data into
517 * a disk file. The format is binary.
518 */
519 COMMAND_HANDLER(lpc2900_handle_read_custom_command)
520 {
521 if (CMD_ARGC < 2)
522 return ERROR_COMMAND_SYNTAX_ERROR;
523
524 struct flash_bank *bank;
525 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
526 if (ERROR_OK != retval)
527 return retval;
528
529 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
530 lpc2900_info->risky = 0;
531
532 /* Get target, and check if it's halted */
533 struct target *target = bank->target;
534 if (target->state != TARGET_HALTED) {
535 LOG_ERROR("Target not halted");
536 return ERROR_TARGET_NOT_HALTED;
537 }
538
539 /* Storage for customer info. Read in two parts */
540 uint8_t customer[4 * (ISS_CUSTOMER_NWORDS1 + ISS_CUSTOMER_NWORDS2)];
541
542 /* Enable access to index sector */
543 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB | FCTR_FS_ISS);
544
545 /* Read two parts */
546 target_read_memory(target, bank->base+ISS_CUSTOMER_START1, 4,
547 ISS_CUSTOMER_NWORDS1,
548 &customer[0]);
549 target_read_memory(target, bank->base+ISS_CUSTOMER_START2, 4,
550 ISS_CUSTOMER_NWORDS2,
551 &customer[4 * ISS_CUSTOMER_NWORDS1]);
552
553 /* Deactivate access to index sector */
554 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
555
556 /* Try and open the file */
557 struct fileio *fileio;
558 const char *filename = CMD_ARGV[1];
559 int ret = fileio_open(&fileio, filename, FILEIO_WRITE, FILEIO_BINARY);
560 if (ret != ERROR_OK) {
561 LOG_WARNING("Could not open file %s", filename);
562 return ret;
563 }
564
565 size_t nwritten;
566 ret = fileio_write(fileio, sizeof(customer), customer, &nwritten);
567 if (ret != ERROR_OK) {
568 LOG_ERROR("Write operation to file %s failed", filename);
569 fileio_close(fileio);
570 return ret;
571 }
572
573 fileio_close(fileio);
574
575 return ERROR_OK;
576 }
577
578 /**
579 * Enter password to enable potentially dangerous options.
580 */
581 COMMAND_HANDLER(lpc2900_handle_password_command)
582 {
583 if (CMD_ARGC < 2)
584 return ERROR_COMMAND_SYNTAX_ERROR;
585
586 struct flash_bank *bank;
587 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
588 if (ERROR_OK != retval)
589 return retval;
590
591 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
592
593 #define ISS_PASSWORD "I_know_what_I_am_doing"
594
595 lpc2900_info->risky = !strcmp(CMD_ARGV[1], ISS_PASSWORD);
596
597 if (!lpc2900_info->risky) {
598 command_print(CMD_CTX, "Wrong password (use '%s')", ISS_PASSWORD);
599 return ERROR_COMMAND_ARGUMENT_INVALID;
600 }
601
602 command_print(CMD_CTX,
603 "Potentially dangerous operation allowed in next command!");
604
605 return ERROR_OK;
606 }
607
608 /**
609 * Write customer info from file to the index sector.
610 */
611 COMMAND_HANDLER(lpc2900_handle_write_custom_command)
612 {
613 if (CMD_ARGC < 2)
614 return ERROR_COMMAND_SYNTAX_ERROR;
615
616 struct flash_bank *bank;
617 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
618 if (ERROR_OK != retval)
619 return retval;
620
621 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
622
623 /* Check if command execution is allowed. */
624 if (!lpc2900_info->risky) {
625 command_print(CMD_CTX, "Command execution not allowed!");
626 return ERROR_COMMAND_ARGUMENT_INVALID;
627 }
628 lpc2900_info->risky = 0;
629
630 /* Get target, and check if it's halted */
631 struct target *target = bank->target;
632 if (target->state != TARGET_HALTED) {
633 LOG_ERROR("Target not halted");
634 return ERROR_TARGET_NOT_HALTED;
635 }
636
637 /* The image will always start at offset 0 */
638 struct image image;
639 image.base_address_set = 1;
640 image.base_address = 0;
641 image.start_address_set = 0;
642
643 const char *filename = CMD_ARGV[1];
644 const char *type = (CMD_ARGC >= 3) ? CMD_ARGV[2] : NULL;
645 retval = image_open(&image, filename, type);
646 if (retval != ERROR_OK)
647 return retval;
648
649 /* Do a sanity check: The image must be exactly the size of the customer
650 programmable area. Any other size is rejected. */
651 if (image.num_sections != 1) {
652 LOG_ERROR("Only one section allowed in image file.");
653 return ERROR_COMMAND_SYNTAX_ERROR;
654 }
655 if ((image.sections[0].base_address != 0) ||
656 (image.sections[0].size != ISS_CUSTOMER_SIZE)) {
657 LOG_ERROR("Incorrect image file size. Expected %d, "
658 "got %" PRIu32,
659 ISS_CUSTOMER_SIZE, image.sections[0].size);
660 return ERROR_COMMAND_SYNTAX_ERROR;
661 }
662
663 /* Well boys, I reckon this is it... */
664
665 /* Customer info is split into two blocks in pages 4 and 5. */
666 uint8_t page[FLASH_PAGE_SIZE];
667
668 /* Page 4 */
669 uint32_t offset = ISS_CUSTOMER_START1 % FLASH_PAGE_SIZE;
670 memset(page, 0xff, FLASH_PAGE_SIZE);
671 size_t size_read;
672 retval = image_read_section(&image, 0, 0,
673 ISS_CUSTOMER_SIZE1, &page[offset], &size_read);
674 if (retval != ERROR_OK) {
675 LOG_ERROR("couldn't read from file '%s'", filename);
676 image_close(&image);
677 return retval;
678 }
679 retval = lpc2900_write_index_page(bank, 4, page);
680 if (retval != ERROR_OK) {
681 image_close(&image);
682 return retval;
683 }
684
685 /* Page 5 */
686 offset = ISS_CUSTOMER_START2 % FLASH_PAGE_SIZE;
687 memset(page, 0xff, FLASH_PAGE_SIZE);
688 retval = image_read_section(&image, 0, ISS_CUSTOMER_SIZE1,
689 ISS_CUSTOMER_SIZE2, &page[offset], &size_read);
690 if (retval != ERROR_OK) {
691 LOG_ERROR("couldn't read from file '%s'", filename);
692 image_close(&image);
693 return retval;
694 }
695 retval = lpc2900_write_index_page(bank, 5, page);
696 if (retval != ERROR_OK) {
697 image_close(&image);
698 return retval;
699 }
700
701 image_close(&image);
702
703 return ERROR_OK;
704 }
705
706 /**
707 * Activate 'sector security' for a range of sectors.
708 */
709 COMMAND_HANDLER(lpc2900_handle_secure_sector_command)
710 {
711 if (CMD_ARGC < 3)
712 return ERROR_COMMAND_SYNTAX_ERROR;
713
714 /* Get the bank descriptor */
715 struct flash_bank *bank;
716 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
717 if (ERROR_OK != retval)
718 return retval;
719
720 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
721
722 /* Check if command execution is allowed. */
723 if (!lpc2900_info->risky) {
724 command_print(CMD_CTX, "Command execution not allowed! "
725 "(use 'password' command first)");
726 return ERROR_COMMAND_ARGUMENT_INVALID;
727 }
728 lpc2900_info->risky = 0;
729
730 /* Read sector range, and do a sanity check. */
731 int first, last;
732 COMMAND_PARSE_NUMBER(int, CMD_ARGV[1], first);
733 COMMAND_PARSE_NUMBER(int, CMD_ARGV[2], last);
734 if ((first >= bank->num_sectors) ||
735 (last >= bank->num_sectors) ||
736 (first > last)) {
737 command_print(CMD_CTX, "Illegal sector range");
738 return ERROR_COMMAND_ARGUMENT_INVALID;
739 }
740
741 uint8_t page[FLASH_PAGE_SIZE];
742 int sector;
743
744 /* Sectors in page 6 */
745 if ((first <= 4) || (last >= 8)) {
746 memset(&page, 0xff, FLASH_PAGE_SIZE);
747 for (sector = first; sector <= last; sector++) {
748 if (sector <= 4)
749 memset(&page[0xB0 + 16*sector], 0, 16);
750 else if (sector >= 8)
751 memset(&page[0x00 + 16*(sector - 8)], 0, 16);
752 }
753
754 retval = lpc2900_write_index_page(bank, 6, page);
755 if (retval != ERROR_OK) {
756 LOG_ERROR("failed to update index sector page 6");
757 return retval;
758 }
759 }
760
761 /* Sectors in page 7 */
762 if ((first <= 7) && (last >= 5)) {
763 memset(&page, 0xff, FLASH_PAGE_SIZE);
764 for (sector = first; sector <= last; sector++) {
765 if ((sector >= 5) && (sector <= 7))
766 memset(&page[0x00 + 16*(sector - 5)], 0, 16);
767 }
768
769 retval = lpc2900_write_index_page(bank, 7, page);
770 if (retval != ERROR_OK) {
771 LOG_ERROR("failed to update index sector page 7");
772 return retval;
773 }
774 }
775
776 command_print(CMD_CTX,
777 "Sectors security will become effective after next power cycle");
778
779 /* Update the sector security status */
780 if (lpc2900_read_security_status(bank) != ERROR_OK) {
781 LOG_ERROR("Cannot determine sector security status");
782 return ERROR_FLASH_OPERATION_FAILED;
783 }
784
785 return ERROR_OK;
786 }
787
788 /**
789 * Activate JTAG protection.
790 */
791 COMMAND_HANDLER(lpc2900_handle_secure_jtag_command)
792 {
793 if (CMD_ARGC < 1)
794 return ERROR_COMMAND_SYNTAX_ERROR;
795
796 /* Get the bank descriptor */
797 struct flash_bank *bank;
798 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
799 if (ERROR_OK != retval)
800 return retval;
801
802 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
803
804 /* Check if command execution is allowed. */
805 if (!lpc2900_info->risky) {
806 command_print(CMD_CTX, "Command execution not allowed! "
807 "(use 'password' command first)");
808 return ERROR_COMMAND_ARGUMENT_INVALID;
809 }
810 lpc2900_info->risky = 0;
811
812 /* Prepare page */
813 uint8_t page[FLASH_PAGE_SIZE];
814 memset(&page, 0xff, FLASH_PAGE_SIZE);
815
816
817 /* Insert "soft" protection word */
818 page[0x30 + 15] = 0x7F;
819 page[0x30 + 11] = 0x7F;
820 page[0x30 + 7] = 0x7F;
821 page[0x30 + 3] = 0x7F;
822
823 /* Write to page 5 */
824 retval = lpc2900_write_index_page(bank, 5, page);
825 if (retval != ERROR_OK) {
826 LOG_ERROR("failed to update index sector page 5");
827 return retval;
828 }
829
830 LOG_INFO("JTAG security set. Good bye!");
831
832 return ERROR_OK;
833 }
834
835 /*********************** Flash interface functions **************************/
836
837 static const struct command_registration lpc2900_exec_command_handlers[] = {
838 {
839 .name = "signature",
840 .usage = "<bank>",
841 .handler = lpc2900_handle_signature_command,
842 .mode = COMMAND_EXEC,
843 .help = "Calculate and display signature of flash bank.",
844 },
845 {
846 .name = "read_custom",
847 .handler = lpc2900_handle_read_custom_command,
848 .mode = COMMAND_EXEC,
849 .usage = "bank_id filename",
850 .help = "Copies 912 bytes of customer information "
851 "from index sector into file.",
852 },
853 {
854 .name = "password",
855 .handler = lpc2900_handle_password_command,
856 .mode = COMMAND_EXEC,
857 .usage = "bank_id password",
858 .help = "Enter fixed password to enable 'dangerous' options.",
859 },
860 {
861 .name = "write_custom",
862 .handler = lpc2900_handle_write_custom_command,
863 .mode = COMMAND_EXEC,
864 .usage = "bank_id filename ('bin'|'ihex'|'elf'|'s19')",
865 .help = "Copies 912 bytes of customer info from file "
866 "to index sector.",
867 },
868 {
869 .name = "secure_sector",
870 .handler = lpc2900_handle_secure_sector_command,
871 .mode = COMMAND_EXEC,
872 .usage = "bank_id first_sector last_sector",
873 .help = "Activate sector security for a range of sectors. "
874 "It will be effective after a power cycle.",
875 },
876 {
877 .name = "secure_jtag",
878 .handler = lpc2900_handle_secure_jtag_command,
879 .mode = COMMAND_EXEC,
880 .usage = "bank_id",
881 .help = "Disable the JTAG port. "
882 "It will be effective after a power cycle.",
883 },
884 COMMAND_REGISTRATION_DONE
885 };
886
887 static const struct command_registration lpc2900_command_handlers[] = {
888 {
889 .name = "lpc2900",
890 .mode = COMMAND_ANY,
891 .help = "LPC2900 flash command group",
892 .usage = "",
893 .chain = lpc2900_exec_command_handlers,
894 },
895 COMMAND_REGISTRATION_DONE
896 };
897
898 /** Evaluate flash bank command. */
899 FLASH_BANK_COMMAND_HANDLER(lpc2900_flash_bank_command)
900 {
901 struct lpc2900_flash_bank *lpc2900_info;
902
903 if (CMD_ARGC < 6)
904 return ERROR_COMMAND_SYNTAX_ERROR;
905
906 lpc2900_info = malloc(sizeof(struct lpc2900_flash_bank));
907 bank->driver_priv = lpc2900_info;
908
909 /* Get flash clock.
910 * Reject it if we can't meet the requirements for program time
911 * (if clock too slow), or for erase time (clock too fast).
912 */
913 uint32_t clk_sys_fmc;
914 COMMAND_PARSE_NUMBER(u32, CMD_ARGV[6], clk_sys_fmc);
915 lpc2900_info->clk_sys_fmc = clk_sys_fmc * 1000;
916
917 uint32_t clock_limit;
918 /* Check program time limit */
919 clock_limit = 512000000l / FLASH_PROGRAM_TIME;
920 if (lpc2900_info->clk_sys_fmc < clock_limit) {
921 LOG_WARNING("flash clock must be at least %" PRIu32 " kHz",
922 (clock_limit / 1000));
923 return ERROR_FLASH_BANK_INVALID;
924 }
925
926 /* Check erase time limit */
927 clock_limit = (uint32_t)((32767.0 * 512.0 * 1e6) / FLASH_ERASE_TIME);
928 if (lpc2900_info->clk_sys_fmc > clock_limit) {
929 LOG_WARNING("flash clock must be a maximum of %" PRIu32 " kHz",
930 (clock_limit / 1000));
931 return ERROR_FLASH_BANK_INVALID;
932 }
933
934 /* Chip ID will be obtained by probing the device later */
935 lpc2900_info->chipid = 0;
936 lpc2900_info->is_probed = false;
937
938 return ERROR_OK;
939 }
940
941 /**
942 * Erase sector(s).
943 *
944 * @param bank Pointer to the flash bank descriptor
945 * @param first First sector to be erased
946 * @param last Last sector (including) to be erased
947 */
948 static int lpc2900_erase(struct flash_bank *bank, int first, int last)
949 {
950 uint32_t status;
951 int sector;
952 int last_unsecured_sector;
953 struct target *target = bank->target;
954 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
955
956
957 status = lpc2900_is_ready(bank);
958 if (status != ERROR_OK)
959 return status;
960
961 /* Sanity check on sector range */
962 if ((first < 0) || (last < first) || (last >= bank->num_sectors)) {
963 LOG_INFO("Bad sector range");
964 return ERROR_FLASH_SECTOR_INVALID;
965 }
966
967 /* Update the info about secured sectors */
968 lpc2900_read_security_status(bank);
969
970 /* The selected sector range might include secured sectors. An attempt
971 * to erase such a sector will cause the erase to fail also for unsecured
972 * sectors. It is necessary to determine the last unsecured sector now,
973 * because we have to treat the last relevant sector in the list in
974 * a special way.
975 */
976 last_unsecured_sector = -1;
977 for (sector = first; sector <= last; sector++) {
978 if (!bank->sectors[sector].is_protected)
979 last_unsecured_sector = sector;
980 }
981
982 /* Exit now, in case of the rare constellation where all sectors in range
983 * are secured. This is regarded a success, since erasing/programming of
984 * secured sectors shall be handled transparently.
985 */
986 if (last_unsecured_sector == -1)
987 return ERROR_OK;
988
989 /* Enable flash block and set the correct CRA clock of 66 kHz */
990 lpc2900_setup(bank);
991
992 /* Clear END_OF_ERASE interrupt status */
993 target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_ERASE);
994
995 /* Set the program/erase timer to FLASH_ERASE_TIME */
996 target_write_u32(target, FPTR,
997 FPTR_EN_T | lpc2900_calc_tr(lpc2900_info->clk_sys_fmc,
998 FLASH_ERASE_TIME));
999
1000 /* Sectors are marked for erasure, then erased all together */
1001 for (sector = first; sector <= last_unsecured_sector; sector++) {
1002 /* Only mark sectors that aren't secured. Any attempt to erase a group
1003 * of sectors will fail if any single one of them is secured!
1004 */
1005 if (!bank->sectors[sector].is_protected) {
1006 /* Unprotect the sector */
1007 target_write_u32(target, bank->sectors[sector].offset, 0);
1008 target_write_u32(target, FCTR,
1009 FCTR_FS_LOADREQ | FCTR_FS_WPB |
1010 FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
1011
1012 /* Mark the sector for erasure. The last sector in the list
1013 triggers the erasure. */
1014 target_write_u32(target, bank->sectors[sector].offset, 0);
1015 if (sector == last_unsecured_sector) {
1016 target_write_u32(target, FCTR,
1017 FCTR_FS_PROGREQ | FCTR_FS_WPB | FCTR_FS_CS);
1018 } else {
1019 target_write_u32(target, FCTR,
1020 FCTR_FS_LOADREQ | FCTR_FS_WPB |
1021 FCTR_FS_WEB | FCTR_FS_CS);
1022 }
1023 }
1024 }
1025
1026 /* Wait for the end of the erase operation. If it's not over after two seconds,
1027 * something went dreadfully wrong... :-(
1028 */
1029 if (lpc2900_wait_status(bank, INTSRC_END_OF_ERASE, 2000) != ERROR_OK)
1030 return ERROR_FLASH_OPERATION_FAILED;
1031
1032 /* Normal flash operating mode */
1033 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1034
1035 return ERROR_OK;
1036 }
1037
1038 static int lpc2900_protect(struct flash_bank *bank, int set, int first, int last)
1039 {
1040 /* This command is not supported.
1041 * "Protection" in LPC2900 terms is handled transparently. Sectors will
1042 * automatically be unprotected as needed.
1043 * Instead we use the concept of sector security. A secured sector is shown
1044 * as "protected" in OpenOCD. Sector security is a permanent feature, and
1045 * cannot be disabled once activated.
1046 */
1047
1048 return ERROR_OK;
1049 }
1050
1051 /**
1052 * Write data to flash.
1053 *
1054 * @param bank Pointer to the flash bank descriptor
1055 * @param buffer Buffer with data
1056 * @param offset Start address (relative to bank start)
1057 * @param count Number of bytes to be programmed
1058 */
1059 static int lpc2900_write(struct flash_bank *bank, const uint8_t *buffer,
1060 uint32_t offset, uint32_t count)
1061 {
1062 uint8_t page[FLASH_PAGE_SIZE];
1063 uint32_t status;
1064 uint32_t num_bytes;
1065 struct target *target = bank->target;
1066 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
1067 int sector;
1068 int retval;
1069
1070 static const uint32_t write_target_code[] = {
1071 /* Set auto latch mode: FCTR=CS|WRE|WEB */
1072 0xe3a0a007, /* loop mov r10, #0x007 */
1073 0xe583a000, /* str r10,[r3,#0] */
1074
1075 /* Load complete page into latches */
1076 0xe3a06020, /* mov r6,#(512/16) */
1077 0xe8b00f00, /* next ldmia r0!,{r8-r11} */
1078 0xe8a10f00, /* stmia r1!,{r8-r11} */
1079 0xe2566001, /* subs r6,#1 */
1080 0x1afffffb, /* bne next */
1081
1082 /* Clear END_OF_BURN interrupt status */
1083 0xe3a0a002, /* mov r10,#(1 << 1) */
1084 0xe583afe8, /* str r10,[r3,#0xfe8] */
1085
1086 /* Set the erase time to FLASH_PROGRAM_TIME */
1087 0xe5834008, /* str r4,[r3,#8] */
1088
1089 /* Trigger flash write
1090 * FCTR = CS | WRE | WPB | PROGREQ */
1091 0xe3a0a083, /* mov r10,#0x83 */
1092 0xe38aaa01, /* orr r10,#0x1000 */
1093 0xe583a000, /* str r10,[r3,#0] */
1094
1095 /* Wait for end of burn */
1096 0xe593afe0, /* wait ldr r10,[r3,#0xfe0] */
1097 0xe21aa002, /* ands r10,#(1 << 1) */
1098 0x0afffffc, /* beq wait */
1099
1100 /* End? */
1101 0xe2522001, /* subs r2,#1 */
1102 0x1affffed, /* bne loop */
1103
1104 0xeafffffe /* done b done */
1105 };
1106
1107
1108 status = lpc2900_is_ready(bank);
1109 if (status != ERROR_OK)
1110 return status;
1111
1112 /* Enable flash block and set the correct CRA clock of 66 kHz */
1113 lpc2900_setup(bank);
1114
1115 /* Update the info about secured sectors */
1116 lpc2900_read_security_status(bank);
1117
1118 /* Unprotect all involved sectors */
1119 for (sector = 0; sector < bank->num_sectors; sector++) {
1120 /* Start address in or before this sector?
1121 * End address in or behind this sector? */
1122 if (((bank->base + offset) <
1123 (bank->sectors[sector].offset + bank->sectors[sector].size)) &&
1124 ((bank->base + (offset + count - 1)) >= bank->sectors[sector].offset)) {
1125 /* This sector is involved and needs to be unprotected.
1126 * Don't do it for secured sectors.
1127 */
1128 if (!bank->sectors[sector].is_protected) {
1129 target_write_u32(target, bank->sectors[sector].offset, 0);
1130 target_write_u32(target, FCTR,
1131 FCTR_FS_LOADREQ | FCTR_FS_WPB |
1132 FCTR_FS_WEB | FCTR_FS_WRE | FCTR_FS_CS);
1133 }
1134 }
1135 }
1136
1137 /* Set the program/erase time to FLASH_PROGRAM_TIME */
1138 uint32_t prog_time = FPTR_EN_T | lpc2900_calc_tr(lpc2900_info->clk_sys_fmc, FLASH_PROGRAM_TIME);
1139
1140 /* If there is a working area of reasonable size, use it to program via
1141 * a target algorithm. If not, fall back to host programming. */
1142
1143 /* We need some room for target code. */
1144 const uint32_t target_code_size = sizeof(write_target_code);
1145
1146 /* Try working area allocation. Start with a large buffer, and try with
1147 * reduced size if that fails. */
1148 struct working_area *warea;
1149 uint32_t buffer_size = lpc2900_info->max_ram_block - 1 * KiB;
1150 while ((retval = target_alloc_working_area_try(target,
1151 buffer_size + target_code_size,
1152 &warea)) != ERROR_OK) {
1153 /* Try a smaller buffer now, and stop if it's too small. */
1154 buffer_size -= 1 * KiB;
1155 if (buffer_size < 2 * KiB) {
1156 LOG_INFO("no (large enough) working area, falling back to host mode");
1157 warea = NULL;
1158 break;
1159 }
1160 }
1161
1162 if (warea) {
1163 struct reg_param reg_params[5];
1164 struct arm_algorithm arm_algo;
1165
1166 /* We can use target mode. Download the algorithm. */
1167 uint8_t code[sizeof(write_target_code)];
1168 target_buffer_set_u32_array(target, code, ARRAY_SIZE(write_target_code),
1169 write_target_code);
1170 retval = target_write_buffer(target, (warea->address) + buffer_size, sizeof(code), code);
1171 if (retval != ERROR_OK) {
1172 LOG_ERROR("Unable to write block write code to target");
1173 target_free_all_working_areas(target);
1174 return ERROR_FLASH_OPERATION_FAILED;
1175 }
1176
1177 init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT);
1178 init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);
1179 init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);
1180 init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);
1181 init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT);
1182
1183 /* Write to flash in large blocks */
1184 while (count != 0) {
1185 uint32_t this_npages;
1186 const uint8_t *this_buffer;
1187 int start_sector = lpc2900_address2sector(bank, offset);
1188
1189 /* First page / last page / rest */
1190 if (offset % FLASH_PAGE_SIZE) {
1191 /* Block doesn't start on page boundary.
1192 * Burn first partial page separately. */
1193 memset(&page, 0xff, sizeof(page));
1194 memcpy(&page[offset % FLASH_PAGE_SIZE],
1195 buffer,
1196 FLASH_PAGE_SIZE - (offset % FLASH_PAGE_SIZE));
1197 this_npages = 1;
1198 this_buffer = &page[0];
1199 count = count + (offset % FLASH_PAGE_SIZE);
1200 offset = offset - (offset % FLASH_PAGE_SIZE);
1201 } else if (count < FLASH_PAGE_SIZE) {
1202 /* Download last incomplete page separately. */
1203 memset(&page, 0xff, sizeof(page));
1204 memcpy(&page, buffer, count);
1205 this_npages = 1;
1206 this_buffer = &page[0];
1207 count = FLASH_PAGE_SIZE;
1208 } else {
1209 /* Download as many full pages as possible */
1210 this_npages = (count < buffer_size) ?
1211 count / FLASH_PAGE_SIZE :
1212 buffer_size / FLASH_PAGE_SIZE;
1213 this_buffer = buffer;
1214
1215 /* Make sure we stop at the next secured sector */
1216 sector = start_sector + 1;
1217 while (sector < bank->num_sectors) {
1218 /* Secured? */
1219 if (bank->sectors[sector].is_protected) {
1220 /* Is that next sector within the current block? */
1221 if ((bank->sectors[sector].offset - bank->base) <
1222 (offset + (this_npages * FLASH_PAGE_SIZE))) {
1223 /* Yes! Split the block */
1224 this_npages =
1225 (bank->sectors[sector].offset -
1226 bank->base - offset)
1227 / FLASH_PAGE_SIZE;
1228 break;
1229 }
1230 }
1231
1232 sector++;
1233 }
1234 }
1235
1236 /* Skip the current sector if it is secured */
1237 if (bank->sectors[start_sector].is_protected) {
1238 LOG_DEBUG("Skip secured sector %d",
1239 start_sector);
1240
1241 /* Stop if this is the last sector */
1242 if (start_sector == bank->num_sectors - 1)
1243 break;
1244
1245 /* Skip */
1246 uint32_t nskip = bank->sectors[start_sector].size -
1247 (offset % bank->sectors[start_sector].size);
1248 offset += nskip;
1249 buffer += nskip;
1250 count = (count >= nskip) ? (count - nskip) : 0;
1251 continue;
1252 }
1253
1254 /* Execute buffer download */
1255 retval = target_write_buffer(target, warea->address,
1256 this_npages * FLASH_PAGE_SIZE, this_buffer);
1257 if (retval != ERROR_OK) {
1258 LOG_ERROR("Unable to write data to target");
1259 target_free_all_working_areas(target);
1260 return ERROR_FLASH_OPERATION_FAILED;
1261 }
1262
1263 /* Prepare registers */
1264 buf_set_u32(reg_params[0].value, 0, 32, warea->address);
1265 buf_set_u32(reg_params[1].value, 0, 32, offset);
1266 buf_set_u32(reg_params[2].value, 0, 32, this_npages);
1267 buf_set_u32(reg_params[3].value, 0, 32, FCTR);
1268 buf_set_u32(reg_params[4].value, 0, 32, FPTR_EN_T | prog_time);
1269
1270 /* Execute algorithm, assume breakpoint for last instruction */
1271 arm_algo.common_magic = ARM_COMMON_MAGIC;
1272 arm_algo.core_mode = ARM_MODE_SVC;
1273 arm_algo.core_state = ARM_STATE_ARM;
1274
1275 retval = target_run_algorithm(target, 0, NULL, 5, reg_params,
1276 (warea->address) + buffer_size,
1277 (warea->address) + buffer_size + target_code_size - 4,
1278 10000, /* 10s should be enough for max. 16 KiB of data */
1279 &arm_algo);
1280
1281 if (retval != ERROR_OK) {
1282 LOG_ERROR("Execution of flash algorithm failed.");
1283 target_free_all_working_areas(target);
1284 retval = ERROR_FLASH_OPERATION_FAILED;
1285 break;
1286 }
1287
1288 count -= this_npages * FLASH_PAGE_SIZE;
1289 buffer += this_npages * FLASH_PAGE_SIZE;
1290 offset += this_npages * FLASH_PAGE_SIZE;
1291 }
1292
1293 /* Free all resources */
1294 destroy_reg_param(&reg_params[0]);
1295 destroy_reg_param(&reg_params[1]);
1296 destroy_reg_param(&reg_params[2]);
1297 destroy_reg_param(&reg_params[3]);
1298 destroy_reg_param(&reg_params[4]);
1299 target_free_all_working_areas(target);
1300 } else {
1301 /* Write to flash memory page-wise */
1302 while (count != 0) {
1303 /* How many bytes do we copy this time? */
1304 num_bytes = (count >= FLASH_PAGE_SIZE) ?
1305 FLASH_PAGE_SIZE - (offset % FLASH_PAGE_SIZE) :
1306 count;
1307
1308 /* Don't do anything with it if the page is in a secured sector. */
1309 if (!bank->sectors[lpc2900_address2sector(bank, offset)].is_protected) {
1310 /* Set latch load mode */
1311 target_write_u32(target, FCTR,
1312 FCTR_FS_CS | FCTR_FS_WRE | FCTR_FS_WEB);
1313
1314 /* Always clear the buffer (a little overhead, but who cares) */
1315 memset(page, 0xFF, FLASH_PAGE_SIZE);
1316
1317 /* Copy them to the buffer */
1318 memcpy(&page[offset % FLASH_PAGE_SIZE],
1319 &buffer[offset % FLASH_PAGE_SIZE],
1320 num_bytes);
1321
1322 /* Write whole page to flash data latches */
1323 if (target_write_memory(target,
1324 bank->base + (offset - (offset % FLASH_PAGE_SIZE)),
1325 4, FLASH_PAGE_SIZE / 4, page) != ERROR_OK) {
1326 LOG_ERROR("Write failed @ 0x%8.8" PRIx32, offset);
1327 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1328
1329 return ERROR_FLASH_OPERATION_FAILED;
1330 }
1331
1332 /* Clear END_OF_BURN interrupt status */
1333 target_write_u32(target, INT_CLR_STATUS, INTSRC_END_OF_BURN);
1334
1335 /* Set the programming time */
1336 target_write_u32(target, FPTR, FPTR_EN_T | prog_time);
1337
1338 /* Trigger flash write */
1339 target_write_u32(target, FCTR,
1340 FCTR_FS_CS | FCTR_FS_WRE | FCTR_FS_WPB | FCTR_FS_PROGREQ);
1341
1342 /* Wait for the end of the write operation. If it's not over
1343 * after one second, something went dreadfully wrong... :-(
1344 */
1345 if (lpc2900_wait_status(bank, INTSRC_END_OF_BURN, 1000) != ERROR_OK) {
1346 LOG_ERROR("Write failed @ 0x%8.8" PRIx32, offset);
1347 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1348
1349 return ERROR_FLASH_OPERATION_FAILED;
1350 }
1351 }
1352
1353 /* Update pointers and counters */
1354 offset += num_bytes;
1355 buffer += num_bytes;
1356 count -= num_bytes;
1357 }
1358
1359 retval = ERROR_OK;
1360 }
1361
1362 /* Normal flash operating mode */
1363 target_write_u32(target, FCTR, FCTR_FS_CS | FCTR_FS_WEB);
1364
1365 return retval;
1366 }
1367
1368 /**
1369 * Try and identify the device.
1370 *
1371 * Determine type number and its memory layout.
1372 *
1373 * @param bank Pointer to the flash bank descriptor
1374 */
1375 static int lpc2900_probe(struct flash_bank *bank)
1376 {
1377 struct lpc2900_flash_bank *lpc2900_info = bank->driver_priv;
1378 struct target *target = bank->target;
1379 int i = 0;
1380 uint32_t offset;
1381
1382
1383 if (target->state != TARGET_HALTED) {
1384 LOG_ERROR("Target not halted");
1385 return ERROR_TARGET_NOT_HALTED;
1386 }
1387
1388 /* We want to do this only once. */
1389 if (lpc2900_info->is_probed)
1390 return ERROR_OK;
1391
1392 /* Probing starts with reading the CHIPID register. We will continue only
1393 * if this identifies as an LPC2900 device.
1394 */
1395 target_read_u32(target, CHIPID, &lpc2900_info->chipid);
1396
1397 if (lpc2900_info->chipid != EXPECTED_CHIPID) {
1398 LOG_WARNING("Device is not an LPC29xx");
1399 return ERROR_FLASH_OPERATION_FAILED;
1400 }
1401
1402 /* It's an LPC29xx device. Now read the feature register FEAT0...FEAT3. */
1403 uint32_t feat0, feat1, feat2, feat3;
1404 target_read_u32(target, FEAT0, &feat0);
1405 target_read_u32(target, FEAT1, &feat1);
1406 target_read_u32(target, FEAT2, &feat2);
1407 target_read_u32(target, FEAT3, &feat3);
1408
1409 /* Base address */
1410 bank->base = 0x20000000;
1411
1412 /* Determine flash layout from FEAT2 register */
1413 uint32_t num_64k_sectors = (feat2 >> 16) & 0xFF;
1414 uint32_t num_8k_sectors = (feat2 >> 0) & 0xFF;
1415 bank->num_sectors = num_64k_sectors + num_8k_sectors;
1416 bank->size = KiB * (64 * num_64k_sectors + 8 * num_8k_sectors);
1417
1418 /* Determine maximum contiguous RAM block */
1419 lpc2900_info->max_ram_block = 16 * KiB;
1420 if ((feat1 & 0x30) == 0x30) {
1421 lpc2900_info->max_ram_block = 32 * KiB;
1422 if ((feat1 & 0x0C) == 0x0C)
1423 lpc2900_info->max_ram_block = 48 * KiB;
1424 }
1425
1426 /* Determine package code and ITCM size */
1427 uint32_t package_code = feat0 & 0x0F;
1428 uint32_t itcm_code = (feat1 >> 16) & 0x1F;
1429
1430 /* Determine the exact type number. */
1431 uint32_t found = 1;
1432 if ((package_code == 4) && (itcm_code == 5)) {
1433 /* Old LPC2917 or LPC2919 (non-/01 devices) */
1434 lpc2900_info->target_name = (bank->size == 768*KiB) ? "LPC2919" : "LPC2917";
1435 } else {
1436 if (package_code == 2) {
1437 /* 100-pin package */
1438 if (bank->size == 128*KiB)
1439 lpc2900_info->target_name = "LPC2921";
1440 else if (bank->size == 256*KiB)
1441 lpc2900_info->target_name = "LPC2923";
1442 else if (bank->size == 512*KiB)
1443 lpc2900_info->target_name = "LPC2925";
1444 else
1445 found = 0;
1446 } else if (package_code == 4) {
1447 /* 144-pin package */
1448 if ((bank->size == 256*KiB) && (feat3 == 0xFFFFFFE9))
1449 lpc2900_info->target_name = "LPC2926";
1450 else if ((bank->size == 512*KiB) && (feat3 == 0xFFFFFCF0))
1451 lpc2900_info->target_name = "LPC2917/01";
1452 else if ((bank->size == 512*KiB) && (feat3 == 0xFFFFFFF1))
1453 lpc2900_info->target_name = "LPC2927";
1454 else if ((bank->size == 768*KiB) && (feat3 == 0xFFFFFCF8))
1455 lpc2900_info->target_name = "LPC2919/01";
1456 else if ((bank->size == 768*KiB) && (feat3 == 0xFFFFFFF9))
1457 lpc2900_info->target_name = "LPC2929";
1458 else
1459 found = 0;
1460 } else if (package_code == 5) {
1461 /* 208-pin package */
1462 lpc2900_info->target_name = (bank->size == 0) ? "LPC2930" : "LPC2939";
1463 } else
1464 found = 0;
1465 }
1466
1467 if (!found) {
1468 LOG_WARNING("Unknown LPC29xx derivative (FEATx="
1469 "%08" PRIx32 ":%08" PRIx32 ":%08" PRIx32 ":%08" PRIx32 ")",
1470 feat0, feat1, feat2, feat3);
1471 return ERROR_FLASH_OPERATION_FAILED;
1472 }
1473
1474 /* Show detected device */
1475 LOG_INFO("Flash bank %d: Device %s, %" PRIu32
1476 " KiB in %d sectors",
1477 bank->bank_number,
1478 lpc2900_info->target_name, bank->size / KiB,
1479 bank->num_sectors);
1480
1481 /* Flashless devices cannot be handled */
1482 if (bank->num_sectors == 0) {
1483 LOG_WARNING("Flashless device cannot be handled");
1484 return ERROR_FLASH_OPERATION_FAILED;
1485 }
1486
1487 /* Sector layout.
1488 * These are logical sector numbers. When doing real flash operations,
1489 * the logical flash number are translated into the physical flash numbers
1490 * of the device.
1491 */
1492 bank->sectors = malloc(sizeof(struct flash_sector) * bank->num_sectors);
1493
1494 offset = 0;
1495 for (i = 0; i < bank->num_sectors; i++) {
1496 bank->sectors[i].offset = offset;
1497 bank->sectors[i].is_erased = -1;
1498 bank->sectors[i].is_protected = -1;
1499
1500 if (i <= 7)
1501 bank->sectors[i].size = 8 * KiB;
1502 else if (i <= 18)
1503 bank->sectors[i].size = 64 * KiB;
1504 else {
1505 /* We shouldn't come here. But there might be a new part out there
1506 * that has more than 19 sectors. Politely ask for a fix then.
1507 */
1508 bank->sectors[i].size = 0;
1509 LOG_ERROR("Never heard about sector %d", i);
1510 }
1511
1512 offset += bank->sectors[i].size;
1513 }
1514
1515 lpc2900_info->is_probed = true;
1516
1517 /* Read sector security status */
1518 if (lpc2900_read_security_status(bank) != ERROR_OK) {
1519 LOG_ERROR("Cannot determine sector security status");
1520 return ERROR_FLASH_OPERATION_FAILED;
1521 }
1522
1523 return ERROR_OK;
1524 }
1525
1526 /**
1527 * Run a blank check for each sector.
1528 *
1529 * For speed reasons, the device isn't read word by word.
1530 * A hash value is calculated by the hardware ("BIST") for each sector.
1531 * This value is then compared against the known hash of an empty sector.
1532 *
1533 * @param bank Pointer to the flash bank descriptor
1534 */
1535 static int lpc2900_erase_check(struct flash_bank *bank)
1536 {
1537 uint32_t status = lpc2900_is_ready(bank);
1538 if (status != ERROR_OK) {
1539 LOG_INFO("Processor not halted/not probed");
1540 return status;
1541 }
1542
1543 /* Use the BIST (Built-In Selft Test) to generate a signature of each flash
1544 * sector. Compare against the expected signature of an empty sector.
1545 */
1546 int sector;
1547 for (sector = 0; sector < bank->num_sectors; sector++) {
1548 uint32_t signature[4];
1549 status = lpc2900_run_bist128(bank, bank->sectors[sector].offset,
1550 bank->sectors[sector].offset + (bank->sectors[sector].size - 1), signature);
1551 if (status != ERROR_OK)
1552 return status;
1553
1554 /* The expected signatures for an empty sector are different
1555 * for 8 KiB and 64 KiB sectors.
1556 */
1557 if (bank->sectors[sector].size == 8*KiB) {
1558 bank->sectors[sector].is_erased =
1559 (signature[3] == 0x01ABAAAA) &&
1560 (signature[2] == 0xAAAAAAAA) &&
1561 (signature[1] == 0xAAAAAAAA) &&
1562 (signature[0] == 0xAAA00AAA);
1563 }
1564 if (bank->sectors[sector].size == 64*KiB) {
1565 bank->sectors[sector].is_erased =
1566 (signature[3] == 0x11801222) &&
1567 (signature[2] == 0xB88844FF) &&
1568 (signature[1] == 0x11A22008) &&
1569 (signature[0] == 0x2B1BFE44);
1570 }
1571 }
1572
1573 return ERROR_OK;
1574 }
1575
1576 /**
1577 * Get protection (sector security) status.
1578 *
1579 * Determine the status of "sector security" for each sector.
1580 * A secured sector is one that can never be erased/programmed again.
1581 *
1582 * @param bank Pointer to the flash bank descriptor
1583 */
1584 static int lpc2900_protect_check(struct flash_bank *bank)
1585 {
1586 return lpc2900_read_security_status(bank);
1587 }
1588
1589 struct flash_driver lpc2900_flash = {
1590 .name = "lpc2900",
1591 .commands = lpc2900_command_handlers,
1592 .flash_bank_command = lpc2900_flash_bank_command,
1593 .erase = lpc2900_erase,
1594 .protect = lpc2900_protect,
1595 .write = lpc2900_write,
1596 .read = default_flash_read,
1597 .probe = lpc2900_probe,
1598 .auto_probe = lpc2900_probe,
1599 .erase_check = lpc2900_erase_check,
1600 .protect_check = lpc2900_protect_check,
1601 .free_driver_priv = default_flash_free_driver_priv,
1602 };
Open On-Chip Debugger

Linking to existing account procedure

If you already have an account and want to add another login method you MUST first sign in with your existing account and then change URL to read https://review.openocd.org/login/?link to get to this page again but this time it'll work for linking. Thank you.

SSH host keys fingerprints

1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=..              |
|+o..   .         |
|*.o   . .        |
|+B . . .         |
|Bo. = o S        |
|Oo.+ + =         |
|oB=.* = . o      |
| =+=.+   + E     |
|. .=o   . o      |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)