/***************************************************************************
* Copyright (C) 2005, 2007 by Dominic Rath *
* Dominic.Rath@gmx.de *
* Copyright (C) 2009 Michael Schwingen *
* michael@schwingen.org *
* *
* This program is free software; you can redistribute it and/or modify *
* it under the terms of the GNU General Public License as published by *
* the Free Software Foundation; either version 2 of the License, or *
* (at your option) any later version. *
* *
* This program is distributed in the hope that it will be useful, *
* but WITHOUT ANY WARRANTY; without even the implied warranty of *
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
* GNU General Public License for more details. *
* *
* You should have received a copy of the GNU General Public License *
* along with this program; if not, write to the *
* Free Software Foundation, Inc., *
* 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
***************************************************************************/
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
#include "cfi.h"
#include "non_cfi.h"
#include "armv4_5.h"
#include "binarybuffer.h"
static int cfi_register_commands(struct command_context_s *cmd_ctx);
static int cfi_flash_bank_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc, struct flash_bank_s *bank);
static int cfi_erase(struct flash_bank_s *bank, int first, int last);
static int cfi_protect(struct flash_bank_s *bank, int set, int first, int last);
static int cfi_write(struct flash_bank_s *bank, uint8_t *buffer, uint32_t offset, uint32_t count);
static int cfi_probe(struct flash_bank_s *bank);
static int cfi_auto_probe(struct flash_bank_s *bank);
static int cfi_protect_check(struct flash_bank_s *bank);
static int cfi_info(struct flash_bank_s *bank, char *buf, int buf_size);
//static int cfi_handle_part_id_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc);
#define CFI_MAX_BUS_WIDTH 4
#define CFI_MAX_CHIP_WIDTH 4
/* defines internal maximum size for code fragment in cfi_intel_write_block() */
#define CFI_MAX_INTEL_CODESIZE 256
flash_driver_t cfi_flash =
{
.name = "cfi",
.register_commands = cfi_register_commands,
.flash_bank_command = cfi_flash_bank_command,
.erase = cfi_erase,
.protect = cfi_protect,
.write = cfi_write,
.probe = cfi_probe,
.auto_probe = cfi_auto_probe,
.erase_check = default_flash_blank_check,
.protect_check = cfi_protect_check,
.info = cfi_info
};
static cfi_unlock_addresses_t cfi_unlock_addresses[] =
{
[CFI_UNLOCK_555_2AA] = { .unlock1 = 0x555, .unlock2 = 0x2aa },
[CFI_UNLOCK_5555_2AAA] = { .unlock1 = 0x5555, .unlock2 = 0x2aaa },
};
/* CFI fixups foward declarations */
static void cfi_fixup_0002_erase_regions(flash_bank_t *flash, void *param);
static void cfi_fixup_0002_unlock_addresses(flash_bank_t *flash, void *param);
static void cfi_fixup_atmel_reversed_erase_regions(flash_bank_t *flash, void *param);
/* fixup after reading cmdset 0002 primary query table */
static cfi_fixup_t cfi_0002_fixups[] = {
{CFI_MFR_SST, 0x00D4, cfi_fixup_0002_unlock_addresses, &cfi_unlock_addresses[CFI_UNLOCK_5555_2AAA]},
{CFI_MFR_SST, 0x00D5, cfi_fixup_0002_unlock_addresses, &cfi_unlock_addresses[CFI_UNLOCK_5555_2AAA]},
{CFI_MFR_SST, 0x00D6, cfi_fixup_0002_unlock_addresses, &cfi_unlock_addresses[CFI_UNLOCK_5555_2AAA]},
{CFI_MFR_SST, 0x00D7, cfi_fixup_0002_unlock_addresses, &cfi_unlock_addresses[CFI_UNLOCK_5555_2AAA]},
{CFI_MFR_SST, 0x2780, cfi_fixup_0002_unlock_addresses, &cfi_unlock_addresses[CFI_UNLOCK_5555_2AAA]},
{CFI_MFR_ATMEL, 0x00C8, cfi_fixup_atmel_reversed_erase_regions, NULL},
{CFI_MFR_FUJITSU, 0x226b, cfi_fixup_0002_unlock_addresses, &cfi_unlock_addresses[CFI_UNLOCK_5555_2AAA]},
{CFI_MFR_AMIC, 0xb31a, cfi_fixup_0002_unlock_addresses, &cfi_unlock_addresses[CFI_UNLOCK_555_2AA]},
{CFI_MFR_MX, 0x225b, cfi_fixup_0002_unlock_addresses, &cfi_unlock_addresses[CFI_UNLOCK_555_2AA]},
{CFI_MFR_AMD, 0x225b, cfi_fixup_0002_unlock_addresses, &cfi_unlock_addresses[CFI_UNLOCK_555_2AA]},
{CFI_MFR_ANY, CFI_ID_ANY, cfi_fixup_0002_erase_regions, NULL},
{0, 0, NULL, NULL}
};
/* fixup after reading cmdset 0001 primary query table */
static cfi_fixup_t cfi_0001_fixups[] = {
{0, 0, NULL, NULL}
};
static void cfi_fixup(flash_bank_t *bank, cfi_fixup_t *fixups)
{
cfi_flash_bank_t *cfi_info = bank->driver_priv;
cfi_fixup_t *f;
for (f = fixups; f->fixup; f++)
{
if (((f->mfr == CFI_MFR_ANY) || (f->mfr == cfi_info->manufacturer)) &&
((f->id == CFI_ID_ANY) || (f->id == cfi_info->device_id)))
{
f->fixup(bank, f->param);
}
}
}
/* inline uint32_t flash_address(flash_bank_t *bank, int sector, uint32_t offset) */
static __inline__ uint32_t flash_address(flash_bank_t *bank, int sector, uint32_t offset)
{
cfi_flash_bank_t *cfi_info = bank->driver_priv;
if(cfi_info->x16_as_x8) offset*=2;
/* while the sector list isn't built, only accesses to sector 0 work */
if (sector == 0)
return bank->base + offset * bank->bus_width;
else
{
if (!bank->sectors)
{
LOG_ERROR("BUG: sector list not yet built");
exit(-1);
}
return bank->base + bank->sectors[sector].offset + offset * bank->bus_width;
}
}
static void cfi_command(flash_bank_t *bank, uint8_t cmd, uint8_t *cmd_buf)
{
int i;
/* clear whole buffer, to ensure bits that exceed the bus_width
* are set to zero
*/
for (i = 0; i < CFI_MAX_BUS_WIDTH; i++)
cmd_buf[i] = 0;
if (bank->target->endianness == TARGET_LITTLE_ENDIAN)
{
for (i = bank->bus_width; i > 0; i--)
{
*cmd_buf++ = (i & (bank->chip_width - 1)) ? 0x0 : cmd;
}
}
else
{
for (i = 1; i <= bank->bus_width; i++)
{
*cmd_buf++ = (i & (bank->chip_width - 1)) ? 0x0 : cmd;
}
}
}
/* read unsigned 8-bit value from the bank
* flash banks are expected to be made of similar chips
* the query result should be the same for all
*/
static uint8_t cfi_query_u8(flash_bank_t *bank, int sector, uint32_t offset)
{
target_t *target = bank->target;
uint8_t data[CFI_MAX_BUS_WIDTH];
target_read_memory(target, flash_address(bank, sector, offset), bank->bus_width, 1, data);
if (bank->target->endianness == TARGET_LITTLE_ENDIAN)
return data[0];
else
return data[bank->bus_width - 1];
}
/* read unsigned 8-bit value from the bank
* in case of a bank made of multiple chips,
* the individual values are ORed
*/
static uint8_t cfi_get_u8(flash_bank_t *bank, int sector, uint32_t offset)
{
target_t *target = bank->target;
uint8_t data[CFI_MAX_BUS_WIDTH];
int i;
target_read_memory(target, flash_address(bank, sector, offset), bank->bus_width, 1, data);
if (bank->target->endianness == TARGET_LITTLE_ENDIAN)
{
for (i = 0; i < bank->bus_width / bank->chip_width; i++)
data[0] |= data[i];
return data[0];
}
else
{
uint8_t value = 0;
for (i = 0; i < bank->bus_width / bank->chip_width; i++)
value |= data[bank->bus_width - 1 - i];
return value;
}
}
static uint16_t cfi_query_u16(flash_bank_t *bank, int sector, uint32_t offset)
{
target_t *target = bank->target;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
uint8_t data[CFI_MAX_BUS_WIDTH * 2];
if(cfi_info->x16_as_x8)
{
uint8_t i;
for(i=0;i<2;i++)
target_read_memory(target, flash_address(bank, sector, offset+i), bank->bus_width, 1,
&data[i*bank->bus_width] );
}
else
target_read_memory(target, flash_address(bank, sector, offset), bank->bus_width, 2, data);
if (bank->target->endianness == TARGET_LITTLE_ENDIAN)
return data[0] | data[bank->bus_width] << 8;
else
return data[bank->bus_width - 1] | data[(2 * bank->bus_width) - 1] << 8;
}
static uint32_t cfi_query_u32(flash_bank_t *bank, int sector, uint32_t offset)
{
target_t *target = bank->target;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
uint8_t data[CFI_MAX_BUS_WIDTH * 4];
if(cfi_info->x16_as_x8)
{
uint8_t i;
for(i=0;i<4;i++)
target_read_memory(target, flash_address(bank, sector, offset+i), bank->bus_width, 1,
&data[i*bank->bus_width] );
}
else
target_read_memory(target, flash_address(bank, sector, offset), bank->bus_width, 4, data);
if (bank->target->endianness == TARGET_LITTLE_ENDIAN)
return data[0] | data[bank->bus_width] << 8 | data[bank->bus_width * 2] << 16 | data[bank->bus_width * 3] << 24;
else
return data[bank->bus_width - 1] | data[(2* bank->bus_width) - 1] << 8 |
data[(3 * bank->bus_width) - 1] << 16 | data[(4 * bank->bus_width) - 1] << 24;
}
static void cfi_intel_clear_status_register(flash_bank_t *bank)
{
target_t *target = bank->target;
uint8_t command[8];
if (target->state != TARGET_HALTED)
{
LOG_ERROR("BUG: attempted to clear status register while target wasn't halted");
exit(-1);
}
cfi_command(bank, 0x50, command);
target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
}
uint8_t cfi_intel_wait_status_busy(flash_bank_t *bank, int timeout)
{
uint8_t status;
while ((!((status = cfi_get_u8(bank, 0, 0x0)) & 0x80)) && (timeout-- > 0))
{
LOG_DEBUG("status: 0x%x", status);
alive_sleep(1);
}
/* mask out bit 0 (reserved) */
status = status & 0xfe;
LOG_DEBUG("status: 0x%x", status);
if ((status & 0x80) != 0x80)
{
LOG_ERROR("timeout while waiting for WSM to become ready");
}
else if (status != 0x80)
{
LOG_ERROR("status register: 0x%x", status);
if (status & 0x2)
LOG_ERROR("Block Lock-Bit Detected, Operation Abort");
if (status & 0x4)
LOG_ERROR("Program suspended");
if (status & 0x8)
LOG_ERROR("Low Programming Voltage Detected, Operation Aborted");
if (status & 0x10)
LOG_ERROR("Program Error / Error in Setting Lock-Bit");
if (status & 0x20)
LOG_ERROR("Error in Block Erasure or Clear Lock-Bits");
if (status & 0x40)
LOG_ERROR("Block Erase Suspended");
cfi_intel_clear_status_register(bank);
}
return status;
}
int cfi_spansion_wait_status_busy(flash_bank_t *bank, int timeout)
{
uint8_t status, oldstatus;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
oldstatus = cfi_get_u8(bank, 0, 0x0);
do {
status = cfi_get_u8(bank, 0, 0x0);
if ((status ^ oldstatus) & 0x40) {
if (status & cfi_info->status_poll_mask & 0x20) {
oldstatus = cfi_get_u8(bank, 0, 0x0);
status = cfi_get_u8(bank, 0, 0x0);
if ((status ^ oldstatus) & 0x40) {
LOG_ERROR("dq5 timeout, status: 0x%x", status);
return(ERROR_FLASH_OPERATION_FAILED);
} else {
LOG_DEBUG("status: 0x%x", status);
return(ERROR_OK);
}
}
} else { /* no toggle: finished, OK */
LOG_DEBUG("status: 0x%x", status);
return(ERROR_OK);
}
oldstatus = status;
alive_sleep(1);
} while (timeout-- > 0);
LOG_ERROR("timeout, status: 0x%x", status);
return(ERROR_FLASH_BUSY);
}
static int cfi_read_intel_pri_ext(flash_bank_t *bank)
{
int retval;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
cfi_intel_pri_ext_t *pri_ext = malloc(sizeof(cfi_intel_pri_ext_t));
target_t *target = bank->target;
uint8_t command[8];
cfi_info->pri_ext = pri_ext;
pri_ext->pri[0] = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0);
pri_ext->pri[1] = cfi_query_u8(bank, 0, cfi_info->pri_addr + 1);
pri_ext->pri[2] = cfi_query_u8(bank, 0, cfi_info->pri_addr + 2);
if ((pri_ext->pri[0] != 'P') || (pri_ext->pri[1] != 'R') || (pri_ext->pri[2] != 'I'))
{
cfi_command(bank, 0xf0, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0xff, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
LOG_ERROR("Could not read bank flash bank information");
return ERROR_FLASH_BANK_INVALID;
}
pri_ext->major_version = cfi_query_u8(bank, 0, cfi_info->pri_addr + 3);
pri_ext->minor_version = cfi_query_u8(bank, 0, cfi_info->pri_addr + 4);
LOG_DEBUG("pri: '%c%c%c', version: %c.%c", pri_ext->pri[0], pri_ext->pri[1], pri_ext->pri[2], pri_ext->major_version, pri_ext->minor_version);
pri_ext->feature_support = cfi_query_u32(bank, 0, cfi_info->pri_addr + 5);
pri_ext->suspend_cmd_support = cfi_query_u8(bank, 0, cfi_info->pri_addr + 9);
pri_ext->blk_status_reg_mask = cfi_query_u16(bank, 0, cfi_info->pri_addr + 0xa);
LOG_DEBUG("feature_support: 0x%x, suspend_cmd_support: 0x%x, blk_status_reg_mask: 0x%x", pri_ext->feature_support, pri_ext->suspend_cmd_support, pri_ext->blk_status_reg_mask);
pri_ext->vcc_optimal = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0xc);
pri_ext->vpp_optimal = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0xd);
LOG_DEBUG("Vcc opt: %1.1x.%1.1x, Vpp opt: %1.1x.%1.1x",
(pri_ext->vcc_optimal & 0xf0) >> 4, pri_ext->vcc_optimal & 0x0f,
(pri_ext->vpp_optimal & 0xf0) >> 4, pri_ext->vpp_optimal & 0x0f);
pri_ext->num_protection_fields = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0xe);
if (pri_ext->num_protection_fields != 1)
{
LOG_WARNING("expected one protection register field, but found %i", pri_ext->num_protection_fields);
}
pri_ext->prot_reg_addr = cfi_query_u16(bank, 0, cfi_info->pri_addr + 0xf);
pri_ext->fact_prot_reg_size = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0x11);
pri_ext->user_prot_reg_size = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0x12);
LOG_DEBUG("protection_fields: %i, prot_reg_addr: 0x%x, factory pre-programmed: %i, user programmable: %i", pri_ext->num_protection_fields, pri_ext->prot_reg_addr, 1 << pri_ext->fact_prot_reg_size, 1 << pri_ext->user_prot_reg_size);
return ERROR_OK;
}
static int cfi_read_spansion_pri_ext(flash_bank_t *bank)
{
int retval;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
cfi_spansion_pri_ext_t *pri_ext = malloc(sizeof(cfi_spansion_pri_ext_t));
target_t *target = bank->target;
uint8_t command[8];
cfi_info->pri_ext = pri_ext;
pri_ext->pri[0] = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0);
pri_ext->pri[1] = cfi_query_u8(bank, 0, cfi_info->pri_addr + 1);
pri_ext->pri[2] = cfi_query_u8(bank, 0, cfi_info->pri_addr + 2);
if ((pri_ext->pri[0] != 'P') || (pri_ext->pri[1] != 'R') || (pri_ext->pri[2] != 'I'))
{
cfi_command(bank, 0xf0, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
LOG_ERROR("Could not read spansion bank information");
return ERROR_FLASH_BANK_INVALID;
}
pri_ext->major_version = cfi_query_u8(bank, 0, cfi_info->pri_addr + 3);
pri_ext->minor_version = cfi_query_u8(bank, 0, cfi_info->pri_addr + 4);
LOG_DEBUG("pri: '%c%c%c', version: %c.%c", pri_ext->pri[0], pri_ext->pri[1], pri_ext->pri[2], pri_ext->major_version, pri_ext->minor_version);
pri_ext->SiliconRevision = cfi_query_u8(bank, 0, cfi_info->pri_addr + 5);
pri_ext->EraseSuspend = cfi_query_u8(bank, 0, cfi_info->pri_addr + 6);
pri_ext->BlkProt = cfi_query_u8(bank, 0, cfi_info->pri_addr + 7);
pri_ext->TmpBlkUnprotect = cfi_query_u8(bank, 0, cfi_info->pri_addr + 8);
pri_ext->BlkProtUnprot = cfi_query_u8(bank, 0, cfi_info->pri_addr + 9);
pri_ext->SimultaneousOps = cfi_query_u8(bank, 0, cfi_info->pri_addr + 10);
pri_ext->BurstMode = cfi_query_u8(bank, 0, cfi_info->pri_addr + 11);
pri_ext->PageMode = cfi_query_u8(bank, 0, cfi_info->pri_addr + 12);
pri_ext->VppMin = cfi_query_u8(bank, 0, cfi_info->pri_addr + 13);
pri_ext->VppMax = cfi_query_u8(bank, 0, cfi_info->pri_addr + 14);
pri_ext->TopBottom = cfi_query_u8(bank, 0, cfi_info->pri_addr + 15);
LOG_DEBUG("Silicon Revision: 0x%x, Erase Suspend: 0x%x, Block protect: 0x%x", pri_ext->SiliconRevision,
pri_ext->EraseSuspend, pri_ext->BlkProt);
LOG_DEBUG("Temporary Unprotect: 0x%x, Block Protect Scheme: 0x%x, Simultaneous Ops: 0x%x", pri_ext->TmpBlkUnprotect,
pri_ext->BlkProtUnprot, pri_ext->SimultaneousOps);
LOG_DEBUG("Burst Mode: 0x%x, Page Mode: 0x%x, ", pri_ext->BurstMode, pri_ext->PageMode);
LOG_DEBUG("Vpp min: %2.2d.%1.1d, Vpp max: %2.2d.%1.1x",
(pri_ext->VppMin & 0xf0) >> 4, pri_ext->VppMin & 0x0f,
(pri_ext->VppMax & 0xf0) >> 4, pri_ext->VppMax & 0x0f);
LOG_DEBUG("WP# protection 0x%x", pri_ext->TopBottom);
/* default values for implementation specific workarounds */
pri_ext->_unlock1 = cfi_unlock_addresses[CFI_UNLOCK_555_2AA].unlock1;
pri_ext->_unlock2 = cfi_unlock_addresses[CFI_UNLOCK_555_2AA].unlock2;
pri_ext->_reversed_geometry = 0;
return ERROR_OK;
}
static int cfi_read_atmel_pri_ext(flash_bank_t *bank)
{
int retval;
cfi_atmel_pri_ext_t atmel_pri_ext;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
cfi_spansion_pri_ext_t *pri_ext = malloc(sizeof(cfi_spansion_pri_ext_t));
target_t *target = bank->target;
uint8_t command[8];
/* ATMEL devices use the same CFI primary command set (0x2) as AMD/Spansion,
* but a different primary extended query table.
* We read the atmel table, and prepare a valid AMD/Spansion query table.
*/
memset(pri_ext, 0, sizeof(cfi_spansion_pri_ext_t));
cfi_info->pri_ext = pri_ext;
atmel_pri_ext.pri[0] = cfi_query_u8(bank, 0, cfi_info->pri_addr + 0);
atmel_pri_ext.pri[1] = cfi_query_u8(bank, 0, cfi_info->pri_addr + 1);
atmel_pri_ext.pri[2] = cfi_query_u8(bank, 0, cfi_info->pri_addr + 2);
if ((atmel_pri_ext.pri[0] != 'P') || (atmel_pri_ext.pri[1] != 'R') || (atmel_pri_ext.pri[2] != 'I'))
{
cfi_command(bank, 0xf0, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
LOG_ERROR("Could not read atmel bank information");
return ERROR_FLASH_BANK_INVALID;
}
pri_ext->pri[0] = atmel_pri_ext.pri[0];
pri_ext->pri[1] = atmel_pri_ext.pri[1];
pri_ext->pri[2] = atmel_pri_ext.pri[2];
atmel_pri_ext.major_version = cfi_query_u8(bank, 0, cfi_info->pri_addr + 3);
atmel_pri_ext.minor_version = cfi_query_u8(bank, 0, cfi_info->pri_addr + 4);
LOG_DEBUG("pri: '%c%c%c', version: %c.%c", atmel_pri_ext.pri[0], atmel_pri_ext.pri[1], atmel_pri_ext.pri[2], atmel_pri_ext.major_version, atmel_pri_ext.minor_version);
pri_ext->major_version = atmel_pri_ext.major_version;
pri_ext->minor_version = atmel_pri_ext.minor_version;
atmel_pri_ext.features = cfi_query_u8(bank, 0, cfi_info->pri_addr + 5);
atmel_pri_ext.bottom_boot = cfi_query_u8(bank, 0, cfi_info->pri_addr + 6);
atmel_pri_ext.burst_mode = cfi_query_u8(bank, 0, cfi_info->pri_addr + 7);
atmel_pri_ext.page_mode = cfi_query_u8(bank, 0, cfi_info->pri_addr + 8);
LOG_DEBUG("features: 0x%2.2x, bottom_boot: 0x%2.2x, burst_mode: 0x%2.2x, page_mode: 0x%2.2x",
atmel_pri_ext.features, atmel_pri_ext.bottom_boot, atmel_pri_ext.burst_mode, atmel_pri_ext.page_mode);
if (atmel_pri_ext.features & 0x02)
pri_ext->EraseSuspend = 2;
if (atmel_pri_ext.bottom_boot)
pri_ext->TopBottom = 2;
else
pri_ext->TopBottom = 3;
pri_ext->_unlock1 = cfi_unlock_addresses[CFI_UNLOCK_555_2AA].unlock1;
pri_ext->_unlock2 = cfi_unlock_addresses[CFI_UNLOCK_555_2AA].unlock2;
return ERROR_OK;
}
static int cfi_read_0002_pri_ext(flash_bank_t *bank)
{
cfi_flash_bank_t *cfi_info = bank->driver_priv;
if (cfi_info->manufacturer == CFI_MFR_ATMEL)
{
return cfi_read_atmel_pri_ext(bank);
}
else
{
return cfi_read_spansion_pri_ext(bank);
}
}
static int cfi_spansion_info(struct flash_bank_s *bank, char *buf, int buf_size)
{
int printed;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
cfi_spansion_pri_ext_t *pri_ext = cfi_info->pri_ext;
printed = snprintf(buf, buf_size, "\nSpansion primary algorithm extend information:\n");
buf += printed;
buf_size -= printed;
printed = snprintf(buf, buf_size, "pri: '%c%c%c', version: %c.%c\n", pri_ext->pri[0],
pri_ext->pri[1], pri_ext->pri[2],
pri_ext->major_version, pri_ext->minor_version);
buf += printed;
buf_size -= printed;
printed = snprintf(buf, buf_size, "Silicon Rev.: 0x%x, Address Sensitive unlock: 0x%x\n",
(pri_ext->SiliconRevision) >> 2,
(pri_ext->SiliconRevision) & 0x03);
buf += printed;
buf_size -= printed;
printed = snprintf(buf, buf_size, "Erase Suspend: 0x%x, Sector Protect: 0x%x\n",
pri_ext->EraseSuspend,
pri_ext->BlkProt);
buf += printed;
buf_size -= printed;
printed = snprintf(buf, buf_size, "VppMin: %2.2d.%1.1x, VppMax: %2.2d.%1.1x\n",
(pri_ext->VppMin & 0xf0) >> 4, pri_ext->VppMin & 0x0f,
(pri_ext->VppMax & 0xf0) >> 4, pri_ext->VppMax & 0x0f);
return ERROR_OK;
}
static int cfi_intel_info(struct flash_bank_s *bank, char *buf, int buf_size)
{
int printed;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
cfi_intel_pri_ext_t *pri_ext = cfi_info->pri_ext;
printed = snprintf(buf, buf_size, "\nintel primary algorithm extend information:\n");
buf += printed;
buf_size -= printed;
printed = snprintf(buf, buf_size, "pri: '%c%c%c', version: %c.%c\n", pri_ext->pri[0], pri_ext->pri[1], pri_ext->pri[2], pri_ext->major_version, pri_ext->minor_version);
buf += printed;
buf_size -= printed;
printed = snprintf(buf, buf_size, "feature_support: 0x%x, suspend_cmd_support: 0x%x, blk_status_reg_mask: 0x%x\n", pri_ext->feature_support, pri_ext->suspend_cmd_support, pri_ext->blk_status_reg_mask);
buf += printed;
buf_size -= printed;
printed = snprintf(buf, buf_size, "Vcc opt: %1.1x.%1.1x, Vpp opt: %1.1x.%1.1x\n",
(pri_ext->vcc_optimal & 0xf0) >> 4, pri_ext->vcc_optimal & 0x0f,
(pri_ext->vpp_optimal & 0xf0) >> 4, pri_ext->vpp_optimal & 0x0f);
buf += printed;
buf_size -= printed;
printed = snprintf(buf, buf_size, "protection_fields: %i, prot_reg_addr: 0x%x, factory pre-programmed: %i, user programmable: %i\n", pri_ext->num_protection_fields, pri_ext->prot_reg_addr, 1 << pri_ext->fact_prot_reg_size, 1 << pri_ext->user_prot_reg_size);
return ERROR_OK;
}
static int cfi_register_commands(struct command_context_s *cmd_ctx)
{
/*command_t *cfi_cmd = */
register_command(cmd_ctx, NULL, "cfi", NULL, COMMAND_ANY, "flash bank cfi [jedec_probe/x16_as_x8]");
/*
register_command(cmd_ctx, cfi_cmd, "part_id", cfi_handle_part_id_command, COMMAND_EXEC,
"print part id of cfi flash bank ");
*/
return ERROR_OK;
}
/* flash_bank cfi [options]
*/
static int cfi_flash_bank_command(struct command_context_s *cmd_ctx, char *cmd, char **args, int argc, struct flash_bank_s *bank)
{
cfi_flash_bank_t *cfi_info;
int i;
(void) cmd_ctx;
(void) cmd;
if (argc < 6)
{
LOG_WARNING("incomplete flash_bank cfi configuration");
return ERROR_FLASH_BANK_INVALID;
}
if ((strtoul(args[4], NULL, 0) > CFI_MAX_CHIP_WIDTH)
|| (strtoul(args[3], NULL, 0) > CFI_MAX_BUS_WIDTH))
{
LOG_ERROR("chip and bus width have to specified in bytes");
return ERROR_FLASH_BANK_INVALID;
}
cfi_info = malloc(sizeof(cfi_flash_bank_t));
cfi_info->probed = 0;
bank->driver_priv = cfi_info;
cfi_info->write_algorithm = NULL;
cfi_info->x16_as_x8 = 0;
cfi_info->jedec_probe = 0;
cfi_info->not_cfi = 0;
for (i = 6; i < argc; i++)
{
if (strcmp(args[i], "x16_as_x8") == 0)
{
cfi_info->x16_as_x8 = 1;
}
else if (strcmp(args[i], "jedec_probe") == 0)
{
cfi_info->jedec_probe = 1;
}
}
cfi_info->write_algorithm = NULL;
/* bank wasn't probed yet */
cfi_info->qry[0] = -1;
return ERROR_OK;
}
static int cfi_intel_erase(struct flash_bank_s *bank, int first, int last)
{
int retval;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
target_t *target = bank->target;
uint8_t command[8];
int i;
cfi_intel_clear_status_register(bank);
for (i = first; i <= last; i++)
{
cfi_command(bank, 0x20, command);
if((retval = target_write_memory(target, flash_address(bank, i, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0xd0, command);
if((retval = target_write_memory(target, flash_address(bank, i, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
if (cfi_intel_wait_status_busy(bank, 1000 * (1 << cfi_info->block_erase_timeout_typ)) == 0x80)
bank->sectors[i].is_erased = 1;
else
{
cfi_command(bank, 0xff, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
LOG_ERROR("couldn't erase block %i of flash bank at base 0x%x", i, bank->base);
return ERROR_FLASH_OPERATION_FAILED;
}
}
cfi_command(bank, 0xff, command);
return target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
}
static int cfi_spansion_erase(struct flash_bank_s *bank, int first, int last)
{
int retval;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
cfi_spansion_pri_ext_t *pri_ext = cfi_info->pri_ext;
target_t *target = bank->target;
uint8_t command[8];
int i;
for (i = first; i <= last; i++)
{
cfi_command(bank, 0xaa, command);
if((retval = target_write_memory(target, flash_address(bank, 0, pri_ext->_unlock1), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0x55, command);
if((retval = target_write_memory(target, flash_address(bank, 0, pri_ext->_unlock2), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0x80, command);
if((retval = target_write_memory(target, flash_address(bank, 0, pri_ext->_unlock1), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0xaa, command);
if((retval = target_write_memory(target, flash_address(bank, 0, pri_ext->_unlock1), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0x55, command);
if((retval = target_write_memory(target, flash_address(bank, 0, pri_ext->_unlock2), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0x30, command);
if((retval = target_write_memory(target, flash_address(bank, i, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
if (cfi_spansion_wait_status_busy(bank, 1000 * (1 << cfi_info->block_erase_timeout_typ)) == ERROR_OK)
bank->sectors[i].is_erased = 1;
else
{
cfi_command(bank, 0xf0, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
LOG_ERROR("couldn't erase block %i of flash bank at base 0x%x", i, bank->base);
return ERROR_FLASH_OPERATION_FAILED;
}
}
cfi_command(bank, 0xf0, command);
return target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
}
static int cfi_erase(struct flash_bank_s *bank, int first, int last)
{
cfi_flash_bank_t *cfi_info = bank->driver_priv;
if (bank->target->state != TARGET_HALTED)
{
LOG_ERROR("Target not halted");
return ERROR_TARGET_NOT_HALTED;
}
if ((first < 0) || (last < first) || (last >= bank->num_sectors))
{
return ERROR_FLASH_SECTOR_INVALID;
}
if (cfi_info->qry[0] != 'Q')
return ERROR_FLASH_BANK_NOT_PROBED;
switch(cfi_info->pri_id)
{
case 1:
case 3:
return cfi_intel_erase(bank, first, last);
break;
case 2:
return cfi_spansion_erase(bank, first, last);
break;
default:
LOG_ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
break;
}
return ERROR_OK;
}
static int cfi_intel_protect(struct flash_bank_s *bank, int set, int first, int last)
{
int retval;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
cfi_intel_pri_ext_t *pri_ext = cfi_info->pri_ext;
target_t *target = bank->target;
uint8_t command[8];
int retry = 0;
int i;
/* if the device supports neither legacy lock/unlock (bit 3) nor
* instant individual block locking (bit 5).
*/
if (!(pri_ext->feature_support & 0x28))
return ERROR_FLASH_OPERATION_FAILED;
cfi_intel_clear_status_register(bank);
for (i = first; i <= last; i++)
{
cfi_command(bank, 0x60, command);
LOG_DEBUG("address: 0x%4.4x, command: 0x%4.4x", flash_address(bank, i, 0x0), target_buffer_get_u32(target, command));
if((retval = target_write_memory(target, flash_address(bank, i, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
if (set)
{
cfi_command(bank, 0x01, command);
LOG_DEBUG("address: 0x%4.4x, command: 0x%4.4x", flash_address(bank, i, 0x0), target_buffer_get_u32(target, command));
if((retval = target_write_memory(target, flash_address(bank, i, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
bank->sectors[i].is_protected = 1;
}
else
{
cfi_command(bank, 0xd0, command);
LOG_DEBUG("address: 0x%4.4x, command: 0x%4.4x", flash_address(bank, i, 0x0), target_buffer_get_u32(target, command));
if((retval = target_write_memory(target, flash_address(bank, i, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
bank->sectors[i].is_protected = 0;
}
/* instant individual block locking doesn't require reading of the status register */
if (!(pri_ext->feature_support & 0x20))
{
/* Clear lock bits operation may take up to 1.4s */
cfi_intel_wait_status_busy(bank, 1400);
}
else
{
uint8_t block_status;
/* read block lock bit, to verify status */
cfi_command(bank, 0x90, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x55), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
block_status = cfi_get_u8(bank, i, 0x2);
if ((block_status & 0x1) != set)
{
LOG_ERROR("couldn't change block lock status (set = %i, block_status = 0x%2.2x)", set, block_status);
cfi_command(bank, 0x70, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x55), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_intel_wait_status_busy(bank, 10);
if (retry > 10)
return ERROR_FLASH_OPERATION_FAILED;
else
{
i--;
retry++;
}
}
}
}
/* if the device doesn't support individual block lock bits set/clear,
* all blocks have been unlocked in parallel, so we set those that should be protected
*/
if ((!set) && (!(pri_ext->feature_support & 0x20)))
{
for (i = 0; i < bank->num_sectors; i++)
{
if (bank->sectors[i].is_protected == 1)
{
cfi_intel_clear_status_register(bank);
cfi_command(bank, 0x60, command);
if((retval = target_write_memory(target, flash_address(bank, i, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0x01, command);
if((retval = target_write_memory(target, flash_address(bank, i, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_intel_wait_status_busy(bank, 100);
}
}
}
cfi_command(bank, 0xff, command);
return target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
}
static int cfi_protect(struct flash_bank_s *bank, int set, int first, int last)
{
cfi_flash_bank_t *cfi_info = bank->driver_priv;
if (bank->target->state != TARGET_HALTED)
{
LOG_ERROR("Target not halted");
return ERROR_TARGET_NOT_HALTED;
}
if ((first < 0) || (last < first) || (last >= bank->num_sectors))
{
return ERROR_FLASH_SECTOR_INVALID;
}
if (cfi_info->qry[0] != 'Q')
return ERROR_FLASH_BANK_NOT_PROBED;
switch(cfi_info->pri_id)
{
case 1:
case 3:
cfi_intel_protect(bank, set, first, last);
break;
default:
LOG_ERROR("protect: cfi primary command set %i unsupported", cfi_info->pri_id);
break;
}
return ERROR_OK;
}
/* FIXME Replace this by a simple memcpy() - still unsure about sideeffects */
static void cfi_add_byte(struct flash_bank_s *bank, uint8_t *word, uint8_t byte)
{
/* target_t *target = bank->target; */
int i;
/* NOTE:
* The data to flash must not be changed in endian! We write a bytestrem in
* target byte order already. Only the control and status byte lane of the flash
* WSM is interpreted by the CPU in different ways, when read a uint16_t or uint32_t
* word (data seems to be in the upper or lower byte lane for uint16_t accesses).
*/
#if 0
if (target->endianness == TARGET_LITTLE_ENDIAN)
{
#endif
/* shift bytes */
for (i = 0; i < bank->bus_width - 1; i++)
word[i] = word[i + 1];
word[bank->bus_width - 1] = byte;
#if 0
}
else
{
/* shift bytes */
for (i = bank->bus_width - 1; i > 0; i--)
word[i] = word[i - 1];
word[0] = byte;
}
#endif
}
/* Convert code image to target endian */
/* FIXME create general block conversion fcts in target.c?) */
static void cfi_fix_code_endian(target_t *target, uint8_t *dest, const uint32_t *src, uint32_t count)
{
uint32_t i;
for (i=0; i< count; i++)
{
target_buffer_set_u32(target, dest, *src);
dest+=4;
src++;
}
}
static uint32_t cfi_command_val(flash_bank_t *bank, uint8_t cmd)
{
target_t *target = bank->target;
uint8_t buf[CFI_MAX_BUS_WIDTH];
cfi_command(bank, cmd, buf);
switch (bank->bus_width)
{
case 1 :
return buf[0];
break;
case 2 :
return target_buffer_get_u16(target, buf);
break;
case 4 :
return target_buffer_get_u32(target, buf);
break;
default :
LOG_ERROR("Unsupported bank buswidth %d, can't do block memory writes", bank->bus_width);
return 0;
}
}
static int cfi_intel_write_block(struct flash_bank_s *bank, uint8_t *buffer, uint32_t address, uint32_t count)
{
cfi_flash_bank_t *cfi_info = bank->driver_priv;
target_t *target = bank->target;
reg_param_t reg_params[7];
armv4_5_algorithm_t armv4_5_info;
working_area_t *source;
uint32_t buffer_size = 32768;
uint32_t write_command_val, busy_pattern_val, error_pattern_val;
/* algorithm register usage:
* r0: source address (in RAM)
* r1: target address (in Flash)
* r2: count
* r3: flash write command
* r4: status byte (returned to host)
* r5: busy test pattern
* r6: error test pattern
*/
static const uint32_t word_32_code[] = {
0xe4904004, /* loop: ldr r4, [r0], #4 */
0xe5813000, /* str r3, [r1] */
0xe5814000, /* str r4, [r1] */
0xe5914000, /* busy: ldr r4, [r1] */
0xe0047005, /* and r7, r4, r5 */
0xe1570005, /* cmp r7, r5 */
0x1afffffb, /* bne busy */
0xe1140006, /* tst r4, r6 */
0x1a000003, /* bne done */
0xe2522001, /* subs r2, r2, #1 */
0x0a000001, /* beq done */
0xe2811004, /* add r1, r1 #4 */
0xeafffff2, /* b loop */
0xeafffffe /* done: b -2 */
};
static const uint32_t word_16_code[] = {
0xe0d040b2, /* loop: ldrh r4, [r0], #2 */
0xe1c130b0, /* strh r3, [r1] */
0xe1c140b0, /* strh r4, [r1] */
0xe1d140b0, /* busy ldrh r4, [r1] */
0xe0047005, /* and r7, r4, r5 */
0xe1570005, /* cmp r7, r5 */
0x1afffffb, /* bne busy */
0xe1140006, /* tst r4, r6 */
0x1a000003, /* bne done */
0xe2522001, /* subs r2, r2, #1 */
0x0a000001, /* beq done */
0xe2811002, /* add r1, r1 #2 */
0xeafffff2, /* b loop */
0xeafffffe /* done: b -2 */
};
static const uint32_t word_8_code[] = {
0xe4d04001, /* loop: ldrb r4, [r0], #1 */
0xe5c13000, /* strb r3, [r1] */
0xe5c14000, /* strb r4, [r1] */
0xe5d14000, /* busy ldrb r4, [r1] */
0xe0047005, /* and r7, r4, r5 */
0xe1570005, /* cmp r7, r5 */
0x1afffffb, /* bne busy */
0xe1140006, /* tst r4, r6 */
0x1a000003, /* bne done */
0xe2522001, /* subs r2, r2, #1 */
0x0a000001, /* beq done */
0xe2811001, /* add r1, r1 #1 */
0xeafffff2, /* b loop */
0xeafffffe /* done: b -2 */
};
uint8_t target_code[4*CFI_MAX_INTEL_CODESIZE];
const uint32_t *target_code_src;
uint32_t target_code_size;
int retval = ERROR_OK;
cfi_intel_clear_status_register(bank);
armv4_5_info.common_magic = ARMV4_5_COMMON_MAGIC;
armv4_5_info.core_mode = ARMV4_5_MODE_SVC;
armv4_5_info.core_state = ARMV4_5_STATE_ARM;
/* If we are setting up the write_algorith, we need target_code_src */
/* if not we only need target_code_size. */
/* */
/* However, we don't want to create multiple code paths, so we */
/* do the unecessary evaluation of target_code_src, which the */
/* compiler will probably nicely optimize away if not needed */
/* prepare algorithm code for target endian */
switch (bank->bus_width)
{
case 1 :
target_code_src = word_8_code;
target_code_size = sizeof(word_8_code);
break;
case 2 :
target_code_src = word_16_code;
target_code_size = sizeof(word_16_code);
break;
case 4 :
target_code_src = word_32_code;
target_code_size = sizeof(word_32_code);
break;
default:
LOG_ERROR("Unsupported bank buswidth %d, can't do block memory writes", bank->bus_width);
return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
}
/* flash write code */
if (!cfi_info->write_algorithm)
{
if ( target_code_size > sizeof(target_code) )
{
LOG_WARNING("Internal error - target code buffer to small. Increase CFI_MAX_INTEL_CODESIZE and recompile.");
return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
}
cfi_fix_code_endian(target, target_code, target_code_src, target_code_size / 4);
/* Get memory for block write handler */
retval = target_alloc_working_area(target, target_code_size, &cfi_info->write_algorithm);
if (retval != ERROR_OK)
{
LOG_WARNING("No working area available, can't do block memory writes");
return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
};
/* write algorithm code to working area */
retval = target_write_buffer(target, cfi_info->write_algorithm->address, target_code_size, target_code);
if (retval != ERROR_OK)
{
LOG_ERROR("Unable to write block write code to target");
goto cleanup;
}
}
/* Get a workspace buffer for the data to flash starting with 32k size.
Half size until buffer would be smaller 256 Bytem then fail back */
/* FIXME Why 256 bytes, why not 32 bytes (smallest flash write page */
while (target_alloc_working_area(target, buffer_size, &source) != ERROR_OK)
{
buffer_size /= 2;
if (buffer_size <= 256)
{
LOG_WARNING("no large enough working area available, can't do block memory writes");
retval = ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
goto cleanup;
}
};
/* setup algo registers */
init_reg_param(®_params[0], "r0", 32, PARAM_OUT);
init_reg_param(®_params[1], "r1", 32, PARAM_OUT);
init_reg_param(®_params[2], "r2", 32, PARAM_OUT);
init_reg_param(®_params[3], "r3", 32, PARAM_OUT);
init_reg_param(®_params[4], "r4", 32, PARAM_IN);
init_reg_param(®_params[5], "r5", 32, PARAM_OUT);
init_reg_param(®_params[6], "r6", 32, PARAM_OUT);
/* prepare command and status register patterns */
write_command_val = cfi_command_val(bank, 0x40);
busy_pattern_val = cfi_command_val(bank, 0x80);
error_pattern_val = cfi_command_val(bank, 0x7e);
LOG_INFO("Using target buffer at 0x%08x and of size 0x%04x", source->address, buffer_size );
/* Programming main loop */
while (count > 0)
{
uint32_t thisrun_count = (count > buffer_size) ? buffer_size : count;
uint32_t wsm_error;
if((retval = target_write_buffer(target, source->address, thisrun_count, buffer)) != ERROR_OK)
{
goto cleanup;
}
buf_set_u32(reg_params[0].value, 0, 32, source->address);
buf_set_u32(reg_params[1].value, 0, 32, address);
buf_set_u32(reg_params[2].value, 0, 32, thisrun_count / bank->bus_width);
buf_set_u32(reg_params[3].value, 0, 32, write_command_val);
buf_set_u32(reg_params[5].value, 0, 32, busy_pattern_val);
buf_set_u32(reg_params[6].value, 0, 32, error_pattern_val);
LOG_INFO("Write 0x%04x bytes to flash at 0x%08x", thisrun_count, address );
/* Execute algorithm, assume breakpoint for last instruction */
retval = target_run_algorithm(target, 0, NULL, 7, reg_params,
cfi_info->write_algorithm->address,
cfi_info->write_algorithm->address + target_code_size - sizeof(uint32_t),
10000, /* 10s should be enough for max. 32k of data */
&armv4_5_info);
/* On failure try a fall back to direct word writes */
if (retval != ERROR_OK)
{
cfi_intel_clear_status_register(bank);
LOG_ERROR("Execution of flash algorythm failed. Can't fall back. Please report.");
retval = ERROR_FLASH_OPERATION_FAILED;
/* retval = ERROR_TARGET_RESOURCE_NOT_AVAILABLE; */
/* FIXME To allow fall back or recovery, we must save the actual status
somewhere, so that a higher level code can start recovery. */
goto cleanup;
}
/* Check return value from algo code */
wsm_error = buf_get_u32(reg_params[4].value, 0, 32) & error_pattern_val;
if (wsm_error)
{
/* read status register (outputs debug inforation) */
cfi_intel_wait_status_busy(bank, 100);
cfi_intel_clear_status_register(bank);
retval = ERROR_FLASH_OPERATION_FAILED;
goto cleanup;
}
buffer += thisrun_count;
address += thisrun_count;
count -= thisrun_count;
}
/* free up resources */
cleanup:
if (source)
target_free_working_area(target, source);
if (cfi_info->write_algorithm)
{
target_free_working_area(target, cfi_info->write_algorithm);
cfi_info->write_algorithm = NULL;
}
destroy_reg_param(®_params[0]);
destroy_reg_param(®_params[1]);
destroy_reg_param(®_params[2]);
destroy_reg_param(®_params[3]);
destroy_reg_param(®_params[4]);
destroy_reg_param(®_params[5]);
destroy_reg_param(®_params[6]);
return retval;
}
static int cfi_spansion_write_block(struct flash_bank_s *bank, uint8_t *buffer, uint32_t address, uint32_t count)
{
cfi_flash_bank_t *cfi_info = bank->driver_priv;
cfi_spansion_pri_ext_t *pri_ext = cfi_info->pri_ext;
target_t *target = bank->target;
reg_param_t reg_params[10];
armv4_5_algorithm_t armv4_5_info;
working_area_t *source;
uint32_t buffer_size = 32768;
uint32_t status;
int retval, retvaltemp;
int exit_code = ERROR_OK;
/* input parameters - */
/* R0 = source address */
/* R1 = destination address */
/* R2 = number of writes */
/* R3 = flash write command */
/* R4 = constant to mask DQ7 bits (also used for Dq5 with shift) */
/* output parameters - */
/* R5 = 0x80 ok 0x00 bad */
/* temp registers - */
/* R6 = value read from flash to test status */
/* R7 = holding register */
/* unlock registers - */
/* R8 = unlock1_addr */
/* R9 = unlock1_cmd */
/* R10 = unlock2_addr */
/* R11 = unlock2_cmd */
static const uint32_t word_32_code[] = {
/* 00008100 : */
0xe4905004, /* ldr r5, [r0], #4 */
0xe5889000, /* str r9, [r8] */
0xe58ab000, /* str r11, [r10] */
0xe5883000, /* str r3, [r8] */
0xe5815000, /* str r5, [r1] */
0xe1a00000, /* nop */
/* */
/* 00008110 : */
0xe5916000, /* ldr r6, [r1] */
0xe0257006, /* eor r7, r5, r6 */
0xe0147007, /* ands r7, r4, r7 */
0x0a000007, /* beq 8140 ; b if DQ7 == Data7 */
0xe0166124, /* ands r6, r6, r4, lsr #2 */
0x0afffff9, /* beq 8110 ; b if DQ5 low */
0xe5916000, /* ldr r6, [r1] */
0xe0257006, /* eor r7, r5, r6 */
0xe0147007, /* ands r7, r4, r7 */
0x0a000001, /* beq 8140 ; b if DQ7 == Data7 */
0xe3a05000, /* mov r5, #0 ; 0x0 - return 0x00, error */
0x1a000004, /* bne 8154 */
/* */
/* 00008140 : */
0xe2522001, /* subs r2, r2, #1 ; 0x1 */
0x03a05080, /* moveq r5, #128 ; 0x80 */
0x0a000001, /* beq 8154 */
0xe2811004, /* add r1, r1, #4 ; 0x4 */
0xeaffffe8, /* b 8100 */
/* */
/* 00008154 : */
0xeafffffe /* b 8154 */
};
static const uint32_t word_16_code[] = {
/* 00008158 : */
0xe0d050b2, /* ldrh r5, [r0], #2 */
0xe1c890b0, /* strh r9, [r8] */
0xe1cab0b0, /* strh r11, [r10] */
0xe1c830b0, /* strh r3, [r8] */
0xe1c150b0, /* strh r5, [r1] */
0xe1a00000, /* nop (mov r0,r0) */
/* */
/* 00008168 : */
0xe1d160b0, /* ldrh r6, [r1] */
0xe0257006, /* eor r7, r5, r6 */
0xe0147007, /* ands r7, r4, r7 */
0x0a000007, /* beq 8198 */
0xe0166124, /* ands r6, r6, r4, lsr #2 */
0x0afffff9, /* beq 8168 */
0xe1d160b0, /* ldrh r6, [r1] */
0xe0257006, /* eor r7, r5, r6 */
0xe0147007, /* ands r7, r4, r7 */
0x0a000001, /* beq 8198 */
0xe3a05000, /* mov r5, #0 ; 0x0 */
0x1a000004, /* bne 81ac */
/* */
/* 00008198 : */
0xe2522001, /* subs r2, r2, #1 ; 0x1 */
0x03a05080, /* moveq r5, #128 ; 0x80 */
0x0a000001, /* beq 81ac */
0xe2811002, /* add r1, r1, #2 ; 0x2 */
0xeaffffe8, /* b 8158 */
/* */
/* 000081ac : */
0xeafffffe /* b 81ac */
};
static const uint32_t word_8_code[] = {
/* 000081b0 : */
0xe4d05001, /* ldrb r5, [r0], #1 */
0xe5c89000, /* strb r9, [r8] */
0xe5cab000, /* strb r11, [r10] */
0xe5c83000, /* strb r3, [r8] */
0xe5c15000, /* strb r5, [r1] */
0xe1a00000, /* nop (mov r0,r0) */
/* */
/* 000081c0 : */
0xe5d16000, /* ldrb r6, [r1] */
0xe0257006, /* eor r7, r5, r6 */
0xe0147007, /* ands r7, r4, r7 */
0x0a000007, /* beq 81f0 */
0xe0166124, /* ands r6, r6, r4, lsr #2 */
0x0afffff9, /* beq 81c0 */
0xe5d16000, /* ldrb r6, [r1] */
0xe0257006, /* eor r7, r5, r6 */
0xe0147007, /* ands r7, r4, r7 */
0x0a000001, /* beq 81f0 */
0xe3a05000, /* mov r5, #0 ; 0x0 */
0x1a000004, /* bne 8204 */
/* */
/* 000081f0 : */
0xe2522001, /* subs r2, r2, #1 ; 0x1 */
0x03a05080, /* moveq r5, #128 ; 0x80 */
0x0a000001, /* beq 8204 */
0xe2811001, /* add r1, r1, #1 ; 0x1 */
0xeaffffe8, /* b 81b0 */
/* */
/* 00008204 : */
0xeafffffe /* b 8204 */
};
armv4_5_info.common_magic = ARMV4_5_COMMON_MAGIC;
armv4_5_info.core_mode = ARMV4_5_MODE_SVC;
armv4_5_info.core_state = ARMV4_5_STATE_ARM;
/* flash write code */
if (!cfi_info->write_algorithm)
{
uint8_t *target_code;
int target_code_size;
const uint32_t *src;
/* convert bus-width dependent algorithm code to correct endiannes */
switch (bank->bus_width)
{
case 1:
src = word_8_code;
target_code_size = sizeof(word_8_code);
break;
case 2:
src = word_16_code;
target_code_size = sizeof(word_16_code);
break;
case 4:
src = word_32_code;
target_code_size = sizeof(word_32_code);
break;
default:
LOG_ERROR("Unsupported bank buswidth %d, can't do block memory writes", bank->bus_width);
return ERROR_FLASH_OPERATION_FAILED;
}
target_code = malloc(target_code_size);
cfi_fix_code_endian(target, target_code, src, target_code_size / 4);
/* allocate working area */
retval=target_alloc_working_area(target, target_code_size,
&cfi_info->write_algorithm);
if (retval != ERROR_OK)
{
free(target_code);
return retval;
}
/* write algorithm code to working area */
if((retval = target_write_buffer(target, cfi_info->write_algorithm->address,
target_code_size, target_code)) != ERROR_OK)
{
free(target_code);
return retval;
}
free(target_code);
}
/* the following code still assumes target code is fixed 24*4 bytes */
while (target_alloc_working_area(target, buffer_size, &source) != ERROR_OK)
{
buffer_size /= 2;
if (buffer_size <= 256)
{
/* if we already allocated the writing code, but failed to get a buffer, free the algorithm */
if (cfi_info->write_algorithm)
target_free_working_area(target, cfi_info->write_algorithm);
LOG_WARNING("not enough working area available, can't do block memory writes");
return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
}
};
init_reg_param(®_params[0], "r0", 32, PARAM_OUT);
init_reg_param(®_params[1], "r1", 32, PARAM_OUT);
init_reg_param(®_params[2], "r2", 32, PARAM_OUT);
init_reg_param(®_params[3], "r3", 32, PARAM_OUT);
init_reg_param(®_params[4], "r4", 32, PARAM_OUT);
init_reg_param(®_params[5], "r5", 32, PARAM_IN);
init_reg_param(®_params[6], "r8", 32, PARAM_OUT);
init_reg_param(®_params[7], "r9", 32, PARAM_OUT);
init_reg_param(®_params[8], "r10", 32, PARAM_OUT);
init_reg_param(®_params[9], "r11", 32, PARAM_OUT);
while (count > 0)
{
uint32_t thisrun_count = (count > buffer_size) ? buffer_size : count;
retvaltemp = target_write_buffer(target, source->address, thisrun_count, buffer);
buf_set_u32(reg_params[0].value, 0, 32, source->address);
buf_set_u32(reg_params[1].value, 0, 32, address);
buf_set_u32(reg_params[2].value, 0, 32, thisrun_count / bank->bus_width);
buf_set_u32(reg_params[3].value, 0, 32, cfi_command_val(bank, 0xA0));
buf_set_u32(reg_params[4].value, 0, 32, cfi_command_val(bank, 0x80));
buf_set_u32(reg_params[6].value, 0, 32, flash_address(bank, 0, pri_ext->_unlock1));
buf_set_u32(reg_params[7].value, 0, 32, 0xaaaaaaaa);
buf_set_u32(reg_params[8].value, 0, 32, flash_address(bank, 0, pri_ext->_unlock2));
buf_set_u32(reg_params[9].value, 0, 32, 0x55555555);
retval = target_run_algorithm(target, 0, NULL, 10, reg_params,
cfi_info->write_algorithm->address,
cfi_info->write_algorithm->address + ((24 * 4) - 4),
10000, &armv4_5_info);
status = buf_get_u32(reg_params[5].value, 0, 32);
if ((retval != ERROR_OK) || (retvaltemp != ERROR_OK) || status != 0x80)
{
LOG_DEBUG("status: 0x%x", status);
exit_code = ERROR_FLASH_OPERATION_FAILED;
break;
}
buffer += thisrun_count;
address += thisrun_count;
count -= thisrun_count;
}
target_free_working_area(target, source);
destroy_reg_param(®_params[0]);
destroy_reg_param(®_params[1]);
destroy_reg_param(®_params[2]);
destroy_reg_param(®_params[3]);
destroy_reg_param(®_params[4]);
destroy_reg_param(®_params[5]);
destroy_reg_param(®_params[6]);
destroy_reg_param(®_params[7]);
destroy_reg_param(®_params[8]);
destroy_reg_param(®_params[9]);
return exit_code;
}
static int cfi_intel_write_word(struct flash_bank_s *bank, uint8_t *word, uint32_t address)
{
int retval;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
target_t *target = bank->target;
uint8_t command[8];
cfi_intel_clear_status_register(bank);
cfi_command(bank, 0x40, command);
if((retval = target_write_memory(target, address, bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
if((retval = target_write_memory(target, address, bank->bus_width, 1, word)) != ERROR_OK)
{
return retval;
}
if (cfi_intel_wait_status_busy(bank, 1000 * (1 << cfi_info->word_write_timeout_max)) != 0x80)
{
cfi_command(bank, 0xff, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
LOG_ERROR("couldn't write word at base 0x%x, address %x", bank->base, address);
return ERROR_FLASH_OPERATION_FAILED;
}
return ERROR_OK;
}
static int cfi_intel_write_words(struct flash_bank_s *bank, uint8_t *word, uint32_t wordcount, uint32_t address)
{
int retval;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
target_t *target = bank->target;
uint8_t command[8];
/* Calculate buffer size and boundary mask */
uint32_t buffersize = (1UL << cfi_info->max_buf_write_size) * (bank->bus_width / bank->chip_width);
uint32_t buffermask = buffersize-1;
uint32_t bufferwsize;
/* Check for valid range */
if (address & buffermask)
{
LOG_ERROR("Write address at base 0x%x, address %x not aligned to 2^%d boundary", bank->base, address, cfi_info->max_buf_write_size);
return ERROR_FLASH_OPERATION_FAILED;
}
switch(bank->chip_width)
{
case 4 : bufferwsize = buffersize / 4; break;
case 2 : bufferwsize = buffersize / 2; break;
case 1 : bufferwsize = buffersize; break;
default:
LOG_ERROR("Unsupported chip width %d", bank->chip_width);
return ERROR_FLASH_OPERATION_FAILED;
}
bufferwsize/=(bank->bus_width / bank->chip_width);
/* Check for valid size */
if (wordcount > bufferwsize)
{
LOG_ERROR("Number of data words %d exceeds available buffersize %d", wordcount, buffersize);
return ERROR_FLASH_OPERATION_FAILED;
}
/* Write to flash buffer */
cfi_intel_clear_status_register(bank);
/* Initiate buffer operation _*/
cfi_command(bank, 0xE8, command);
if((retval = target_write_memory(target, address, bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
if (cfi_intel_wait_status_busy(bank, 1000 * (1 << cfi_info->buf_write_timeout_max)) != 0x80)
{
cfi_command(bank, 0xff, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
LOG_ERROR("couldn't start buffer write operation at base 0x%x, address %x", bank->base, address);
return ERROR_FLASH_OPERATION_FAILED;
}
/* Write buffer wordcount-1 and data words */
cfi_command(bank, bufferwsize-1, command);
if((retval = target_write_memory(target, address, bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
if((retval = target_write_memory(target, address, bank->bus_width, bufferwsize, word)) != ERROR_OK)
{
return retval;
}
/* Commit write operation */
cfi_command(bank, 0xd0, command);
if((retval = target_write_memory(target, address, bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
if (cfi_intel_wait_status_busy(bank, 1000 * (1 << cfi_info->buf_write_timeout_max)) != 0x80)
{
cfi_command(bank, 0xff, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
LOG_ERROR("Buffer write at base 0x%x, address %x failed.", bank->base, address);
return ERROR_FLASH_OPERATION_FAILED;
}
return ERROR_OK;
}
static int cfi_spansion_write_word(struct flash_bank_s *bank, uint8_t *word, uint32_t address)
{
int retval;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
cfi_spansion_pri_ext_t *pri_ext = cfi_info->pri_ext;
target_t *target = bank->target;
uint8_t command[8];
cfi_command(bank, 0xaa, command);
if((retval = target_write_memory(target, flash_address(bank, 0, pri_ext->_unlock1), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0x55, command);
if((retval = target_write_memory(target, flash_address(bank, 0, pri_ext->_unlock2), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0xa0, command);
if((retval = target_write_memory(target, flash_address(bank, 0, pri_ext->_unlock1), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
if((retval = target_write_memory(target, address, bank->bus_width, 1, word)) != ERROR_OK)
{
return retval;
}
if (cfi_spansion_wait_status_busy(bank, 1000 * (1 << cfi_info->word_write_timeout_max)) != ERROR_OK)
{
cfi_command(bank, 0xf0, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
LOG_ERROR("couldn't write word at base 0x%x, address %x", bank->base, address);
return ERROR_FLASH_OPERATION_FAILED;
}
return ERROR_OK;
}
static int cfi_spansion_write_words(struct flash_bank_s *bank, uint8_t *word, uint32_t wordcount, uint32_t address)
{
int retval;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
target_t *target = bank->target;
uint8_t command[8];
cfi_spansion_pri_ext_t *pri_ext = cfi_info->pri_ext;
/* Calculate buffer size and boundary mask */
uint32_t buffersize = (1UL << cfi_info->max_buf_write_size) * (bank->bus_width / bank->chip_width);
uint32_t buffermask = buffersize-1;
uint32_t bufferwsize;
/* Check for valid range */
if (address & buffermask)
{
LOG_ERROR("Write address at base 0x%x, address %x not aligned to 2^%d boundary", bank->base, address, cfi_info->max_buf_write_size);
return ERROR_FLASH_OPERATION_FAILED;
}
switch(bank->chip_width)
{
case 4 : bufferwsize = buffersize / 4; break;
case 2 : bufferwsize = buffersize / 2; break;
case 1 : bufferwsize = buffersize; break;
default:
LOG_ERROR("Unsupported chip width %d", bank->chip_width);
return ERROR_FLASH_OPERATION_FAILED;
}
bufferwsize/=(bank->bus_width / bank->chip_width);
/* Check for valid size */
if (wordcount > bufferwsize)
{
LOG_ERROR("Number of data words %d exceeds available buffersize %d", wordcount, buffersize);
return ERROR_FLASH_OPERATION_FAILED;
}
// Unlock
cfi_command(bank, 0xaa, command);
if((retval = target_write_memory(target, flash_address(bank, 0, pri_ext->_unlock1), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0x55, command);
if((retval = target_write_memory(target, flash_address(bank, 0, pri_ext->_unlock2), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
// Buffer load command
cfi_command(bank, 0x25, command);
if((retval = target_write_memory(target, address, bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
/* Write buffer wordcount-1 and data words */
cfi_command(bank, bufferwsize-1, command);
if((retval = target_write_memory(target, address, bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
if((retval = target_write_memory(target, address, bank->bus_width, bufferwsize, word)) != ERROR_OK)
{
return retval;
}
/* Commit write operation */
cfi_command(bank, 0x29, command);
if((retval = target_write_memory(target, address, bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
if (cfi_spansion_wait_status_busy(bank, 1000 * (1 << cfi_info->word_write_timeout_max)) != ERROR_OK)
{
cfi_command(bank, 0xf0, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
LOG_ERROR("couldn't write block at base 0x%x, address %x, size %x", bank->base, address, bufferwsize);
return ERROR_FLASH_OPERATION_FAILED;
}
return ERROR_OK;
}
static int cfi_write_word(struct flash_bank_s *bank, uint8_t *word, uint32_t address)
{
cfi_flash_bank_t *cfi_info = bank->driver_priv;
switch(cfi_info->pri_id)
{
case 1:
case 3:
return cfi_intel_write_word(bank, word, address);
break;
case 2:
return cfi_spansion_write_word(bank, word, address);
break;
default:
LOG_ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
break;
}
return ERROR_FLASH_OPERATION_FAILED;
}
static int cfi_write_words(struct flash_bank_s *bank, uint8_t *word, uint32_t wordcount, uint32_t address)
{
cfi_flash_bank_t *cfi_info = bank->driver_priv;
switch(cfi_info->pri_id)
{
case 1:
case 3:
return cfi_intel_write_words(bank, word, wordcount, address);
break;
case 2:
return cfi_spansion_write_words(bank, word, wordcount, address);
break;
default:
LOG_ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
break;
}
return ERROR_FLASH_OPERATION_FAILED;
}
int cfi_write(struct flash_bank_s *bank, uint8_t *buffer, uint32_t offset, uint32_t count)
{
cfi_flash_bank_t *cfi_info = bank->driver_priv;
target_t *target = bank->target;
uint32_t address = bank->base + offset; /* address of first byte to be programmed */
uint32_t write_p, copy_p;
int align; /* number of unaligned bytes */
int blk_count; /* number of bus_width bytes for block copy */
uint8_t current_word[CFI_MAX_BUS_WIDTH * 4]; /* word (bus_width size) currently being programmed */
int i;
int retval;
if (bank->target->state != TARGET_HALTED)
{
LOG_ERROR("Target not halted");
return ERROR_TARGET_NOT_HALTED;
}
if (offset + count > bank->size)
return ERROR_FLASH_DST_OUT_OF_BANK;
if (cfi_info->qry[0] != 'Q')
return ERROR_FLASH_BANK_NOT_PROBED;
/* start at the first byte of the first word (bus_width size) */
write_p = address & ~(bank->bus_width - 1);
if ((align = address - write_p) != 0)
{
LOG_INFO("Fixup %d unaligned head bytes", align );
for (i = 0; i < bank->bus_width; i++)
current_word[i] = 0;
copy_p = write_p;
/* copy bytes before the first write address */
for (i = 0; i < align; ++i, ++copy_p)
{
uint8_t byte;
if((retval = target_read_memory(target, copy_p, 1, 1, &byte)) != ERROR_OK)
{
return retval;
}
cfi_add_byte(bank, current_word, byte);
}
/* add bytes from the buffer */
for (; (i < bank->bus_width) && (count > 0); i++)
{
cfi_add_byte(bank, current_word, *buffer++);
count--;
copy_p++;
}
/* if the buffer is already finished, copy bytes after the last write address */
for (; (count == 0) && (i < bank->bus_width); ++i, ++copy_p)
{
uint8_t byte;
if((retval = target_read_memory(target, copy_p, 1, 1, &byte)) != ERROR_OK)
{
return retval;
}
cfi_add_byte(bank, current_word, byte);
}
retval = cfi_write_word(bank, current_word, write_p);
if (retval != ERROR_OK)
return retval;
write_p = copy_p;
}
/* handle blocks of bus_size aligned bytes */
blk_count = count & ~(bank->bus_width - 1); /* round down, leave tail bytes */
switch(cfi_info->pri_id)
{
/* try block writes (fails without working area) */
case 1:
case 3:
retval = cfi_intel_write_block(bank, buffer, write_p, blk_count);
break;
case 2:
retval = cfi_spansion_write_block(bank, buffer, write_p, blk_count);
break;
default:
LOG_ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
retval = ERROR_FLASH_OPERATION_FAILED;
break;
}
if (retval == ERROR_OK)
{
/* Increment pointers and decrease count on succesful block write */
buffer += blk_count;
write_p += blk_count;
count -= blk_count;
}
else
{
if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE)
{
//adjust buffersize for chip width
uint32_t buffersize = (1UL << cfi_info->max_buf_write_size) * (bank->bus_width / bank->chip_width);
uint32_t buffermask = buffersize-1;
uint32_t bufferwsize;
switch(bank->chip_width)
{
case 4 : bufferwsize = buffersize / 4; break;
case 2 : bufferwsize = buffersize / 2; break;
case 1 : bufferwsize = buffersize; break;
default:
LOG_ERROR("Unsupported chip width %d", bank->chip_width);
return ERROR_FLASH_OPERATION_FAILED;
}
bufferwsize/=(bank->bus_width / bank->chip_width);
/* fall back to memory writes */
while (count >= (uint32_t)bank->bus_width)
{
int fallback;
if ((write_p & 0xff) == 0)
{
LOG_INFO("Programming at %08x, count %08x bytes remaining", write_p, count);
}
fallback = 1;
if ((bufferwsize > 0) && (count >= buffersize) && !(write_p & buffermask))
{
retval = cfi_write_words(bank, buffer, bufferwsize, write_p);
if (retval == ERROR_OK)
{
buffer += buffersize;
write_p += buffersize;
count -= buffersize;
fallback=0;
}
}
/* try the slow way? */
if (fallback)
{
for (i = 0; i < bank->bus_width; i++)
current_word[i] = 0;
for (i = 0; i < bank->bus_width; i++)
{
cfi_add_byte(bank, current_word, *buffer++);
}
retval = cfi_write_word(bank, current_word, write_p);
if (retval != ERROR_OK)
return retval;
write_p += bank->bus_width;
count -= bank->bus_width;
}
}
}
else
return retval;
}
/* return to read array mode, so we can read from flash again for padding */
cfi_command(bank, 0xf0, current_word);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, current_word)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0xff, current_word);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, current_word)) != ERROR_OK)
{
return retval;
}
/* handle unaligned tail bytes */
if (count > 0)
{
LOG_INFO("Fixup %d unaligned tail bytes", count );
copy_p = write_p;
for (i = 0; i < bank->bus_width; i++)
current_word[i] = 0;
for (i = 0; (i < bank->bus_width) && (count > 0); ++i, ++copy_p)
{
cfi_add_byte(bank, current_word, *buffer++);
count--;
}
for (; i < bank->bus_width; ++i, ++copy_p)
{
uint8_t byte;
if((retval = target_read_memory(target, copy_p, 1, 1, &byte)) != ERROR_OK)
{
return retval;
}
cfi_add_byte(bank, current_word, byte);
}
retval = cfi_write_word(bank, current_word, write_p);
if (retval != ERROR_OK)
return retval;
}
/* return to read array mode */
cfi_command(bank, 0xf0, current_word);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, current_word)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0xff, current_word);
return target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, current_word);
}
static void cfi_fixup_atmel_reversed_erase_regions(flash_bank_t *bank, void *param)
{
(void) param;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
cfi_spansion_pri_ext_t *pri_ext = cfi_info->pri_ext;
pri_ext->_reversed_geometry = 1;
}
static void cfi_fixup_0002_erase_regions(flash_bank_t *bank, void *param)
{
int i;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
cfi_spansion_pri_ext_t *pri_ext = cfi_info->pri_ext;
(void) param;
if ((pri_ext->_reversed_geometry) || (pri_ext->TopBottom == 3))
{
LOG_DEBUG("swapping reversed erase region information on cmdset 0002 device");
for (i = 0; i < cfi_info->num_erase_regions / 2; i++)
{
int j = (cfi_info->num_erase_regions - 1) - i;
uint32_t swap;
swap = cfi_info->erase_region_info[i];
cfi_info->erase_region_info[i] = cfi_info->erase_region_info[j];
cfi_info->erase_region_info[j] = swap;
}
}
}
static void cfi_fixup_0002_unlock_addresses(flash_bank_t *bank, void *param)
{
cfi_flash_bank_t *cfi_info = bank->driver_priv;
cfi_spansion_pri_ext_t *pri_ext = cfi_info->pri_ext;
cfi_unlock_addresses_t *unlock_addresses = param;
pri_ext->_unlock1 = unlock_addresses->unlock1;
pri_ext->_unlock2 = unlock_addresses->unlock2;
}
static int cfi_probe(struct flash_bank_s *bank)
{
cfi_flash_bank_t *cfi_info = bank->driver_priv;
target_t *target = bank->target;
uint8_t command[8];
int num_sectors = 0;
int i;
int sector = 0;
uint32_t unlock1 = 0x555;
uint32_t unlock2 = 0x2aa;
int retval;
if (bank->target->state != TARGET_HALTED)
{
LOG_ERROR("Target not halted");
return ERROR_TARGET_NOT_HALTED;
}
cfi_info->probed = 0;
/* JEDEC standard JESD21C uses 0x5555 and 0x2aaa as unlock addresses,
* while CFI compatible AMD/Spansion flashes use 0x555 and 0x2aa
*/
if (cfi_info->jedec_probe)
{
unlock1 = 0x5555;
unlock2 = 0x2aaa;
}
/* switch to read identifier codes mode ("AUTOSELECT") */
cfi_command(bank, 0xaa, command);
if((retval = target_write_memory(target, flash_address(bank, 0, unlock1), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0x55, command);
if((retval = target_write_memory(target, flash_address(bank, 0, unlock2), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0x90, command);
if((retval = target_write_memory(target, flash_address(bank, 0, unlock1), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
if (bank->chip_width == 1)
{
uint8_t manufacturer, device_id;
if((retval = target_read_u8(target, flash_address(bank, 0, 0x00), &manufacturer)) != ERROR_OK)
{
return retval;
}
if((retval = target_read_u8(target, flash_address(bank, 0, 0x01), &device_id)) != ERROR_OK)
{
return retval;
}
cfi_info->manufacturer = manufacturer;
cfi_info->device_id = device_id;
}
else if (bank->chip_width == 2)
{
if((retval = target_read_u16(target, flash_address(bank, 0, 0x00), &cfi_info->manufacturer)) != ERROR_OK)
{
return retval;
}
if((retval = target_read_u16(target, flash_address(bank, 0, 0x02), &cfi_info->device_id)) != ERROR_OK)
{
return retval;
}
}
LOG_INFO("Flash Manufacturer/Device: 0x%04x 0x%04x", cfi_info->manufacturer, cfi_info->device_id);
/* switch back to read array mode */
cfi_command(bank, 0xf0, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x00), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0xff, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x00), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
/* check device/manufacturer ID for known non-CFI flashes. */
cfi_fixup_non_cfi(bank);
/* query only if this is a CFI compatible flash,
* otherwise the relevant info has already been filled in
*/
if (cfi_info->not_cfi == 0)
{
/* enter CFI query mode
* according to JEDEC Standard No. 68.01,
* a single bus sequence with address = 0x55, data = 0x98 should put
* the device into CFI query mode.
*
* SST flashes clearly violate this, and we will consider them incompatbile for now
*/
cfi_command(bank, 0x98, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x55), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_info->qry[0] = cfi_query_u8(bank, 0, 0x10);
cfi_info->qry[1] = cfi_query_u8(bank, 0, 0x11);
cfi_info->qry[2] = cfi_query_u8(bank, 0, 0x12);
LOG_DEBUG("CFI qry returned: 0x%2.2x 0x%2.2x 0x%2.2x", cfi_info->qry[0], cfi_info->qry[1], cfi_info->qry[2]);
if ((cfi_info->qry[0] != 'Q') || (cfi_info->qry[1] != 'R') || (cfi_info->qry[2] != 'Y'))
{
cfi_command(bank, 0xf0, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0xff, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
LOG_ERROR("Could not probe bank: no QRY");
return ERROR_FLASH_BANK_INVALID;
}
cfi_info->pri_id = cfi_query_u16(bank, 0, 0x13);
cfi_info->pri_addr = cfi_query_u16(bank, 0, 0x15);
cfi_info->alt_id = cfi_query_u16(bank, 0, 0x17);
cfi_info->alt_addr = cfi_query_u16(bank, 0, 0x19);
LOG_DEBUG("qry: '%c%c%c', pri_id: 0x%4.4x, pri_addr: 0x%4.4x, alt_id: 0x%4.4x, alt_addr: 0x%4.4x", cfi_info->qry[0], cfi_info->qry[1], cfi_info->qry[2], cfi_info->pri_id, cfi_info->pri_addr, cfi_info->alt_id, cfi_info->alt_addr);
cfi_info->vcc_min = cfi_query_u8(bank, 0, 0x1b);
cfi_info->vcc_max = cfi_query_u8(bank, 0, 0x1c);
cfi_info->vpp_min = cfi_query_u8(bank, 0, 0x1d);
cfi_info->vpp_max = cfi_query_u8(bank, 0, 0x1e);
cfi_info->word_write_timeout_typ = cfi_query_u8(bank, 0, 0x1f);
cfi_info->buf_write_timeout_typ = cfi_query_u8(bank, 0, 0x20);
cfi_info->block_erase_timeout_typ = cfi_query_u8(bank, 0, 0x21);
cfi_info->chip_erase_timeout_typ = cfi_query_u8(bank, 0, 0x22);
cfi_info->word_write_timeout_max = cfi_query_u8(bank, 0, 0x23);
cfi_info->buf_write_timeout_max = cfi_query_u8(bank, 0, 0x24);
cfi_info->block_erase_timeout_max = cfi_query_u8(bank, 0, 0x25);
cfi_info->chip_erase_timeout_max = cfi_query_u8(bank, 0, 0x26);
LOG_DEBUG("Vcc min: %1.1x.%1.1x, Vcc max: %1.1x.%1.1x, Vpp min: %1.1x.%1.1x, Vpp max: %1.1x.%1.1x",
(cfi_info->vcc_min & 0xf0) >> 4, cfi_info->vcc_min & 0x0f,
(cfi_info->vcc_max & 0xf0) >> 4, cfi_info->vcc_max & 0x0f,
(cfi_info->vpp_min & 0xf0) >> 4, cfi_info->vpp_min & 0x0f,
(cfi_info->vpp_max & 0xf0) >> 4, cfi_info->vpp_max & 0x0f);
LOG_DEBUG("typ. word write timeout: %u, typ. buf write timeout: %u, typ. block erase timeout: %u, typ. chip erase timeout: %u", 1 << cfi_info->word_write_timeout_typ, 1 << cfi_info->buf_write_timeout_typ,
1 << cfi_info->block_erase_timeout_typ, 1 << cfi_info->chip_erase_timeout_typ);
LOG_DEBUG("max. word write timeout: %u, max. buf write timeout: %u, max. block erase timeout: %u, max. chip erase timeout: %u", (1 << cfi_info->word_write_timeout_max) * (1 << cfi_info->word_write_timeout_typ),
(1 << cfi_info->buf_write_timeout_max) * (1 << cfi_info->buf_write_timeout_typ),
(1 << cfi_info->block_erase_timeout_max) * (1 << cfi_info->block_erase_timeout_typ),
(1 << cfi_info->chip_erase_timeout_max) * (1 << cfi_info->chip_erase_timeout_typ));
cfi_info->dev_size = 1<interface_desc = cfi_query_u16(bank, 0, 0x28);
cfi_info->max_buf_write_size = cfi_query_u16(bank, 0, 0x2a);
cfi_info->num_erase_regions = cfi_query_u8(bank, 0, 0x2c);
LOG_DEBUG("size: 0x%x, interface desc: %i, max buffer write size: %x", cfi_info->dev_size, cfi_info->interface_desc, (1 << cfi_info->max_buf_write_size));
if (cfi_info->num_erase_regions)
{
cfi_info->erase_region_info = malloc(4 * cfi_info->num_erase_regions);
for (i = 0; i < cfi_info->num_erase_regions; i++)
{
cfi_info->erase_region_info[i] = cfi_query_u32(bank, 0, 0x2d + (4 * i));
LOG_DEBUG("erase region[%i]: %i blocks of size 0x%x", i, (cfi_info->erase_region_info[i] & 0xffff) + 1, (cfi_info->erase_region_info[i] >> 16) * 256);
}
}
else
{
cfi_info->erase_region_info = NULL;
}
/* We need to read the primary algorithm extended query table before calculating
* the sector layout to be able to apply fixups
*/
switch(cfi_info->pri_id)
{
/* Intel command set (standard and extended) */
case 0x0001:
case 0x0003:
cfi_read_intel_pri_ext(bank);
break;
/* AMD/Spansion, Atmel, ... command set */
case 0x0002:
cfi_info->status_poll_mask = CFI_STATUS_POLL_MASK_DQ5_DQ6_DQ7; /* default for all CFI flashs */
cfi_read_0002_pri_ext(bank);
break;
default:
LOG_ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
break;
}
/* return to read array mode
* we use both reset commands, as some Intel flashes fail to recognize the 0xF0 command
*/
cfi_command(bank, 0xf0, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0xff, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
} /* end CFI case */
/* apply fixups depending on the primary command set */
switch(cfi_info->pri_id)
{
/* Intel command set (standard and extended) */
case 0x0001:
case 0x0003:
cfi_fixup(bank, cfi_0001_fixups);
break;
/* AMD/Spansion, Atmel, ... command set */
case 0x0002:
cfi_fixup(bank, cfi_0002_fixups);
break;
default:
LOG_ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
break;
}
if ((cfi_info->dev_size * bank->bus_width / bank->chip_width) != bank->size)
{
LOG_WARNING("configuration specifies 0x%x size, but a 0x%x size flash was found", bank->size, cfi_info->dev_size);
}
if (cfi_info->num_erase_regions == 0)
{
/* a device might have only one erase block, spanning the whole device */
bank->num_sectors = 1;
bank->sectors = malloc(sizeof(flash_sector_t));
bank->sectors[sector].offset = 0x0;
bank->sectors[sector].size = bank->size;
bank->sectors[sector].is_erased = -1;
bank->sectors[sector].is_protected = -1;
}
else
{
uint32_t offset = 0;
for (i = 0; i < cfi_info->num_erase_regions; i++)
{
num_sectors += (cfi_info->erase_region_info[i] & 0xffff) + 1;
}
bank->num_sectors = num_sectors;
bank->sectors = malloc(sizeof(flash_sector_t) * num_sectors);
for (i = 0; i < cfi_info->num_erase_regions; i++)
{
uint32_t j;
for (j = 0; j < (cfi_info->erase_region_info[i] & 0xffff) + 1; j++)
{
bank->sectors[sector].offset = offset;
bank->sectors[sector].size = ((cfi_info->erase_region_info[i] >> 16) * 256) * bank->bus_width / bank->chip_width;
offset += bank->sectors[sector].size;
bank->sectors[sector].is_erased = -1;
bank->sectors[sector].is_protected = -1;
sector++;
}
}
if (offset != cfi_info->dev_size)
{
LOG_WARNING("CFI size is 0x%x, but total sector size is 0x%x", cfi_info->dev_size, offset);
}
}
cfi_info->probed = 1;
return ERROR_OK;
}
static int cfi_auto_probe(struct flash_bank_s *bank)
{
cfi_flash_bank_t *cfi_info = bank->driver_priv;
if (cfi_info->probed)
return ERROR_OK;
return cfi_probe(bank);
}
static int cfi_intel_protect_check(struct flash_bank_s *bank)
{
int retval;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
cfi_intel_pri_ext_t *pri_ext = cfi_info->pri_ext;
target_t *target = bank->target;
uint8_t command[CFI_MAX_BUS_WIDTH];
int i;
/* check if block lock bits are supported on this device */
if (!(pri_ext->blk_status_reg_mask & 0x1))
return ERROR_FLASH_OPERATION_FAILED;
cfi_command(bank, 0x90, command);
if((retval = target_write_memory(target, flash_address(bank, 0, 0x55), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
for (i = 0; i < bank->num_sectors; i++)
{
uint8_t block_status = cfi_get_u8(bank, i, 0x2);
if (block_status & 1)
bank->sectors[i].is_protected = 1;
else
bank->sectors[i].is_protected = 0;
}
cfi_command(bank, 0xff, command);
return target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
}
static int cfi_spansion_protect_check(struct flash_bank_s *bank)
{
int retval;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
cfi_spansion_pri_ext_t *pri_ext = cfi_info->pri_ext;
target_t *target = bank->target;
uint8_t command[8];
int i;
cfi_command(bank, 0xaa, command);
if((retval = target_write_memory(target, flash_address(bank, 0, pri_ext->_unlock1), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0x55, command);
if((retval = target_write_memory(target, flash_address(bank, 0, pri_ext->_unlock2), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
cfi_command(bank, 0x90, command);
if((retval = target_write_memory(target, flash_address(bank, 0, pri_ext->_unlock1), bank->bus_width, 1, command)) != ERROR_OK)
{
return retval;
}
for (i = 0; i < bank->num_sectors; i++)
{
uint8_t block_status = cfi_get_u8(bank, i, 0x2);
if (block_status & 1)
bank->sectors[i].is_protected = 1;
else
bank->sectors[i].is_protected = 0;
}
cfi_command(bank, 0xf0, command);
return target_write_memory(target, flash_address(bank, 0, 0x0), bank->bus_width, 1, command);
}
static int cfi_protect_check(struct flash_bank_s *bank)
{
cfi_flash_bank_t *cfi_info = bank->driver_priv;
if (bank->target->state != TARGET_HALTED)
{
LOG_ERROR("Target not halted");
return ERROR_TARGET_NOT_HALTED;
}
if (cfi_info->qry[0] != 'Q')
return ERROR_FLASH_BANK_NOT_PROBED;
switch(cfi_info->pri_id)
{
case 1:
case 3:
return cfi_intel_protect_check(bank);
break;
case 2:
return cfi_spansion_protect_check(bank);
break;
default:
LOG_ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
break;
}
return ERROR_OK;
}
static int cfi_info(struct flash_bank_s *bank, char *buf, int buf_size)
{
int printed;
cfi_flash_bank_t *cfi_info = bank->driver_priv;
if (cfi_info->qry[0] == (char)-1)
{
printed = snprintf(buf, buf_size, "\ncfi flash bank not probed yet\n");
return ERROR_OK;
}
if (cfi_info->not_cfi == 0)
printed = snprintf(buf, buf_size, "\ncfi information:\n");
else
printed = snprintf(buf, buf_size, "\nnon-cfi flash:\n");
buf += printed;
buf_size -= printed;
printed = snprintf(buf, buf_size, "\nmfr: 0x%4.4x, id:0x%4.4x\n",
cfi_info->manufacturer, cfi_info->device_id);
buf += printed;
buf_size -= printed;
if (cfi_info->not_cfi == 0)
{
printed = snprintf(buf, buf_size, "qry: '%c%c%c', pri_id: 0x%4.4x, pri_addr: 0x%4.4x, alt_id: 0x%4.4x, alt_addr: 0x%4.4x\n", cfi_info->qry[0], cfi_info->qry[1], cfi_info->qry[2], cfi_info->pri_id, cfi_info->pri_addr, cfi_info->alt_id, cfi_info->alt_addr);
buf += printed;
buf_size -= printed;
printed = snprintf(buf, buf_size, "Vcc min: %1.1x.%1.1x, Vcc max: %1.1x.%1.1x, Vpp min: %1.1x.%1.1x, Vpp max: %1.1x.%1.1x\n",
(cfi_info->vcc_min & 0xf0) >> 4, cfi_info->vcc_min & 0x0f,
(cfi_info->vcc_max & 0xf0) >> 4, cfi_info->vcc_max & 0x0f,
(cfi_info->vpp_min & 0xf0) >> 4, cfi_info->vpp_min & 0x0f,
(cfi_info->vpp_max & 0xf0) >> 4, cfi_info->vpp_max & 0x0f);
buf += printed;
buf_size -= printed;
printed = snprintf(buf, buf_size, "typ. word write timeout: %u, typ. buf write timeout: %u, typ. block erase timeout: %u, typ. chip erase timeout: %u\n",
1 << cfi_info->word_write_timeout_typ,
1 << cfi_info->buf_write_timeout_typ,
1 << cfi_info->block_erase_timeout_typ,
1 << cfi_info->chip_erase_timeout_typ);
buf += printed;
buf_size -= printed;
printed = snprintf(buf, buf_size, "max. word write timeout: %u, max. buf write timeout: %u, max. block erase timeout: %u, max. chip erase timeout: %u\n",
(1 << cfi_info->word_write_timeout_max) * (1 << cfi_info->word_write_timeout_typ),
(1 << cfi_info->buf_write_timeout_max) * (1 << cfi_info->buf_write_timeout_typ),
(1 << cfi_info->block_erase_timeout_max) * (1 << cfi_info->block_erase_timeout_typ),
(1 << cfi_info->chip_erase_timeout_max) * (1 << cfi_info->chip_erase_timeout_typ));
buf += printed;
buf_size -= printed;
printed = snprintf(buf, buf_size, "size: 0x%x, interface desc: %i, max buffer write size: %x\n",
cfi_info->dev_size,
cfi_info->interface_desc,
1 << cfi_info->max_buf_write_size);
buf += printed;
buf_size -= printed;
switch(cfi_info->pri_id)
{
case 1:
case 3:
cfi_intel_info(bank, buf, buf_size);
break;
case 2:
cfi_spansion_info(bank, buf, buf_size);
break;
default:
LOG_ERROR("cfi primary command set %i unsupported", cfi_info->pri_id);
break;
}
}
return ERROR_OK;
}
229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287
2288
2289
2290
2291
2292
2293
2294
2295
2296
2297
2298
2299
2300
2301
2302
2303
2304
2305
2306
2307
2308
2309
2310
2311
2312
2313
2314
2315
2316
2317
2318
2319
2320
2321
2322
2323
2324
2325
2326
2327
2328
2329
2330
2331
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
2342
2343
2344
2345
2346
2347
2348
2349
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361
2362
2363
2364
2365
2366
2367
2368
2369
2370
2371
2372
2373
2374
2375
2376
2377
2378
2379
2380
2381
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423
2424
2425
2426
2427
2428
2429
2430
2431
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
2447
2448
2449
2450
2451
2452
2453
2454
2455
2456
2457
2458
2459
2460
2461
2462
2463
2464
2465
2466
2467
2468
2469
2470
2471
2472
2473
2474
2475
2476
2477
2478
2479
2480
2481
2482
2483
2484
2485
2486
2487
2488
2489
2490
2491
2492
2493
2494
2495
2496
2497
2498
2499
2500
2501
2502
2503
2504
2505
2506
2507
2508
2509
2510
2511
2512
2513
2514
2515
2516
2517
2518
2519
2520
2521
2522
2523
2524
2525
2526
2527
2528
2529
2530
2531
2532
2533
2534
2535
2536
2537
2538
2539
2540
2541
2542
2543
2544
2545
2546
2547
2548
2549
2550
2551
2552
2553
2554
2555
2556
2557
2558
2559
2560
2561
2562
2563
2564
2565
2566
2567
2568
2569
2570
2571
2572
2573
2574
2575
2576
2577
2578
2579
2580
2581
2582
2583
2584
2585
2586
2587
2588
2589
2590
2591
2592
2593
2594
2595
2596
2597
2598
2599
2600
2601
2602
2603
2604
2605
2606
2607
2608
2609
2610
2611
2612
2613
2614
2615
2616
2617
2618
2619
2620
2621
2622
2623
2624
2625
2626
2627
2628
2629
2630
2631
2632
2633
2634
2635
2636
2637
2638
2639
2640
2641
2642
2643
2644
2645
2646
2647
2648
2649
2650
2651
2652
2653
2654
2655
2656
2657
2658
2659
2660
2661
2662
2663
2664
2665
2666
2667
2668
2669
2670
2671
2672
2673
2674
2675
2676
2677
2678
2679
2680
2681
2682
2683
2684
2685
2686
2687
2688
2689
2690
2691
2692
2693
2694
2695
2696
2697
2698
2699
2700
2701
2702
2703
2704
2705
2706
2707
2708
2709
2710
2711
2712
2713
2714
2715
2716
2717
2718
2719
2720
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
2731
2732
2733
2734
2735
2736
2737
2738
2739
2740
2741
2742
2743
2744
2745
2746
2747
2748
2749
2750
2751
2752
2753
2754
2755
2756
2757
2758
2759
2760
2761
2762
2763
2764
2765
2766
2767
2768
2769
2770
2771
2772
2773
2774
2775
2776
2777
2778
2779
2780
2781
2782
2783
2784
2785
2786
2787
2788
2789
2790
2791
2792
2793
2794
2795
2796
2797
2798
2799
2800
2801
2802
2803
2804
2805
2806
2807
2808
2809
2810
2811
2812
2813
2814
2815
2816
2817
2818
2819
2820
2821
2822
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832
2833
2834
2835
2836
2837
2838
2839
2840
2841
2842
2843
2844
2845
2846
2847
2848
2849
2850
2851
2852
2853
2854
2855
2856
2857
2858
2859
2860
2861
2862
2863
2864
2865
2866
2867
2868
2869
2870
2871
2872
2873
2874
2875
2876
2877
2878
2879
2880
2881
2882
2883
2884
2885
2886
2887
2888
2889
2890
2891
2892
2893
2894
2895
2896
2897
2898
2899
2900
2901
2902
2903
2904
2905
2906
2907
2908
2909
2910
2911
2912
2913
2914
2915
2916
2917
2918
2919
2920
2921
2922
2923
2924
2925
2926
2927
2928
2929
2930
2931
2932
2933
2934
2935
2936
2937
2938
2939
2940
2941
2942
2943
2944
2945
2946
2947
2948
2949
2950
2951
2952
2953
2954
2955
2956
2957
2958
2959
2960
2961
2962
2963
2964
2965
2966
2967
2968
2969
2970
2971
2972
2973
2974
2975
2976
2977
2978
2979
2980
2981
2982
2983
2984
2985
2986
2987
2988
2989
2990
2991
2992
2993
2994
2995
2996
2997
2998
2999
3000
3001
3002
3003
3004
3005
3006
3007
3008
3009
3010
3011
3012
3013
3014
3015
3016
3017
3018
3019
3020
3021
3022
3023
3024
3025
3026
3027
3028
3029
3030
3031
3032
3033
3034
3035
3036
3037
3038
3039
3040
3041
3042
3043
3044
3045
3046
3047
3048
3049
3050
3051
3052
3053
3054
3055
3056
3057
3058
3059
3060
3061
3062
3063
3064
3065
3066
3067
3068
3069
3070
3071
3072
3073
3074
3075
3076
3077
3078
3079
3080
3081
3082
3083
3084
3085
3086
3087
3088
3089
3090
3091
3092
3093
3094
3095
3096
3097
3098
3099
3100
3101
3102
3103
3104
3105
3106
3107
3108
3109
3110
3111
3112
3113
3114
3115
3116
3117
3118
3119
3120
3121
3122
3123
3124
3125
3126
3127
3128
3129
3130
3131
3132
3133
3134
3135
3136
3137
3138
3139
3140
3141
3142
3143
3144
3145
3146
3147
3148
3149
3150
3151
3152
3153
3154
3155
3156
3157
3158
3159
3160
3161
3162
3163
3164
3165
3166
3167
3168
3169
3170
3171
3172
3173
3174
3175
3176
3177
3178
3179
3180
3181
3182
3183
3184
3185
3186
3187
3188
3189
3190
3191
3192
3193
3194
3195
3196
3197
3198
3199
3200
3201
3202
3203
3204
3205
3206
3207
3208
3209
3210
3211
3212
3213
3214
3215
3216
3217
3218
3219
3220
3221
3222
3223
3224
3225
3226
3227
3228
3229
3230
3231
3232
3233
3234
3235
3236
3237
3238
3239
3240
3241
3242
3243
3244
3245
3246
3247
3248
3249
3250
3251
3252
3253
3254
3255
3256
3257
3258
3259
3260
3261
3262
3263
3264
3265
3266
3267
3268
3269
3270
3271
3272
3273
3274
3275
3276
3277
3278
3279
3280
3281
3282
3283
3284
3285
3286
3287
3288
3289
3290
3291
3292
3293
3294
3295
3296
3297
3298
3299
3300
3301
3302
3303
3304
3305
3306
3307
3308
3309
3310
3311
3312
3313
3314
3315
3316
3317
3318
3319
3320
3321
3322
3323
3324
3325
3326
3327
3328
3329
3330
3331
3332
3333
3334
3335
3336
3337
3338
3339
3340
3341
3342
3343
3344
3345
3346
3347
3348
3349
3350
3351
3352
3353
3354
3355
3356
3357
3358
3359
3360
3361
3362
3363
3364
3365
3366
3367
3368
3369
3370
3371
3372
3373
3374
3375
3376
3377
3378
3379
3380
3381
3382
3383
3384
3385
3386
3387
3388
3389
3390
3391
3392
3393
3394
3395
3396
3397
3398
3399
3400
3401
3402
3403
3404
3405
3406
3407
3408
3409
3410
3411
3412
3413
3414
3415
3416
3417
3418
3419
3420
3421
3422
3423
3424
3425
3426
3427
3428
3429
3430
3431
3432
3433
3434
3435
3436
3437
3438
3439
3440
3441
3442
3443
3444
3445
3446
3447
3448
3449
3450
3451
3452
3453
3454
3455
3456
3457
3458
3459
3460
3461
3462
3463
3464
3465
3466
3467
3468
3469
3470
3471
3472
3473
3474
3475
3476
3477
3478
3479
3480
3481
3482
3483
3484
3485
3486
3487
3488
3489
3490
3491
3492
3493
3494
3495
3496
3497
3498
3499
3500
3501
3502
3503
3504
3505
3506
3507
3508
3509
3510
3511
3512
3513
3514
3515
3516
3517
3518
3519
3520
3521
3522
3523
3524
3525
3526
3527
3528
3529
3530
3531
3532
3533
3534
3535
3536
3537
3538
3539
3540
3541
3542
3543
3544
3545
3546
3547
3548
3549
3550
3551
3552
3553
3554
3555
3556
3557
3558
3559
3560
3561
3562
3563
3564
3565
3566
3567
3568
3569
3570
3571
3572
3573
3574
3575
3576
3577
3578
3579
3580
3581
3582
3583
3584
3585
3586
3587
3588
3589
3590
3591
3592
3593
3594
3595
3596
3597
3598
3599
3600
3601
3602
3603
3604
3605
3606
3607
3608
3609
3610
3611
3612
3613
3614
3615
3616
3617
3618
3619
3620
3621
3622
3623
3624
3625
3626
3627
3628
3629
3630
3631
3632
3633
3634
3635
3636
3637
3638
3639
3640
3641
3642
3643
3644
3645
3646
3647
3648
3649
3650
3651
3652
3653
3654
3655
3656
3657
3658
3659
3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
3670
3671
3672
3673
3674
3675
3676
3677
3678
3679
3680
3681
3682
3683
3684
3685
3686
3687
3688
3689
3690
3691
3692
3693
3694
3695
3696
3697
3698
3699
3700
3701
3702
3703
3704
3705
3706
3707
3708
3709
3710
3711
3712
3713
3714
3715
3716
3717
3718
3719
3720
3721
3722
3723
3724
3725
3726
3727
3728
3729
3730
3731
3732
3733
3734
3735
3736
3737
3738
3739
3740
3741
3742
3743
3744
3745
3746
3747
3748
3749
3750
3751
3752
3753
3754
3755
3756
3757
3758
3759
3760
3761
3762
3763
3764
3765
3766
3767
3768
3769
3770
3771
3772
3773
3774
3775
3776
3777
3778
3779
3780
3781
3782
3783
3784
3785
3786
3787
3788
3789
3790
3791
3792
3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
3815
3816
3817
3818
3819
3820
3821
3822
3823
3824
3825
3826
3827
3828
3829
3830
3831
3832
3833
3834
3835
3836
3837
3838
3839
3840
3841
3842
3843
3844
3845
3846
3847
3848
3849
3850
3851
3852
3853
3854
3855
3856
3857
3858
3859
3860
3861
3862
3863
3864
3865
3866
3867
3868
3869
3870
3871
3872
3873
3874
3875
3876
3877
3878
3879
3880
3881
3882
3883
3884
3885
3886
3887
3888
3889
3890
3891
3892
3893
3894
3895
3896
3897
3898
3899
3900
3901
3902
3903
3904
3905
3906
3907
3908
3909
3910
3911
3912
3913
3914
3915
3916
3917
3918
3919
3920
3921
3922
3923
3924
3925
3926
3927
3928
3929
3930
3931
3932
3933
3934
3935
3936
3937
3938
3939
3940
3941
3942
3943
3944
3945
3946
3947
3948
3949
3950
3951
3952
3953
3954
3955
3956
3957
3958
3959
3960
3961
3962
3963
3964
3965
3966
3967
3968
3969
3970
3971
3972
3973
3974
3975
3976
3977
3978
3979
3980
3981
3982
3983
3984
3985
3986
3987
3988
3989
3990
3991
3992
3993
3994
3995
3996
3997
3998
3999
4000
4001
4002
4003
4004
4005
4006
4007
4008
4009
4010
4011
4012
4013
4014
4015
4016
4017
4018
4019
4020
4021
4022
4023
4024
4025
4026
4027
4028
4029
4030
4031
4032
4033
4034
4035
4036
4037
4038
4039
4040
4041
4042
4043
4044
4045
4046
4047
4048
4049
4050
4051
4052
4053
4054
4055
4056
4057
4058
4059
4060
4061
4062
4063
4064
4065
4066
4067
4068
4069
4070
4071
4072
4073
4074
4075
4076
4077
4078
4079
4080
4081
4082
4083
4084
4085
4086
4087
4088
4089
4090
4091
4092
4093
4094
4095
4096
4097
4098
4099
4100
4101
4102
4103
4104
4105
4106
4107
4108
4109
4110
4111
4112
4113
4114
4115
4116
4117
4118
4119
4120
4121
4122
4123
4124
4125
4126
4127
4128
4129
4130
4131
4132
4133
4134
4135
4136
4137
4138
4139
4140
4141
4142
4143
4144
4145
4146
4147
4148
4149
4150
4151
4152
4153
4154
4155
4156
4157
4158
4159
4160
4161
4162
4163
4164
4165
4166
4167
4168
4169
4170
4171
4172
4173
4174
4175
4176
4177
4178
4179
4180
4181
4182
4183
4184
4185
4186
4187
4188
4189
4190
4191
4192
4193
4194
4195
4196
|