git.sur5r.net Git - openocd/blob - src/flash/nor/xmc4xxx.c

   1 /**************************************************************************
   2 *   Copyright (C) 2015 Jeff Ciesielski <jeffciesielski@gmail.com>         *
   3 *                                                                         *
   4 *   This program is free software; you can redistribute it and/or modify  *
   5 *   it under the terms of the GNU General Public License as published by  *
   6 *   the Free Software Foundation; either version 2 of the License, or     *
   7 *   (at your option) any later version.                                   *
   8 *                                                                         *
   9 *   This program is distributed in the hope that it will be useful,       *
  10 *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  11 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  12 *   GNU General Public License for more details.                          *
  13 *                                                                         *
  14 *   You should have received a copy of the GNU General Public License     *
  15 *   along with this program.  If not, see <http://www.gnu.org/licenses/>. *
  16 ***************************************************************************/
  17
  18 #ifdef HAVE_CONFIG_H
  19 #include "config.h"
  20 #endif
  21
  22 #include "imp.h"
  23 #include <helper/binarybuffer.h>
  24 #include <target/algorithm.h>
  25 #include <target/armv7m.h>
  26
  27 /* Maximum number of sectors */
  28 #define MAX_XMC_SECTORS 12
  29
  30 /* System control unit registers */
  31 #define SCU_REG_BASE 0x50004000
  32
  33 #define SCU_ID_CHIP 0x04
  34
  35 /* Base of the non-cached flash memory */
  36 #define PFLASH_BASE     0x0C000000
  37
  38 /* User configuration block offsets */
  39 #define UCB0_BASE       0x00000000
  40 #define UCB1_BASE       0x00000400
  41 #define UCB2_BASE       0x00000800
  42
  43 /* Flash register base */
  44 #define FLASH_REG_BASE 0x58000000
  45
  46 /* PMU ID Registers */
  47 #define FLASH_REG_PMU_ID        (FLASH_REG_BASE | 0x0508)
  48
  49 /* PMU Fields */
  50 #define PMU_MOD_REV_MASK        0xFF
  51 #define PMU_MOD_TYPE_MASK       0xFF00
  52 #define PMU_MOD_NO_MASK         0xFFFF0000
  53
  54 /* Prefetch Config */
  55 #define FLASH_REG_PREF_PCON     (FLASH_REG_BASE | 0x4000)
  56
  57 /* Prefetch Fields */
  58 #define PCON_IBYP       (1 << 0)
  59 #define PCON_IINV       (1 << 1)
  60
  61 /* Flash ID Register */
  62 #define FLASH_REG_FLASH0_ID     (FLASH_REG_BASE | 0x2008)
  63
  64 /* Flash Status Register */
  65 #define FLASH_REG_FLASH0_FSR    (FLASH_REG_BASE | 0x2010)
  66
  67 #define FSR_PBUSY       (0)
  68 #define FSR_FABUSY      (1)
  69 #define FSR_PROG        (4)
  70 #define FSR_ERASE       (5)
  71 #define FSR_PFPAGE      (6)
  72 #define FSR_PFOPER      (8)
  73 #define FSR_SQER        (10)
  74 #define FSR_PROER       (11)
  75 #define FSR_PFSBER      (12)
  76 #define FSR_PFDBER      (14)
  77 #define FSR_PROIN       (16)
  78 #define FSR_RPROIN      (18)
  79 #define FSR_RPRODIS     (19)
  80 #define FSR_WPROIN0     (21)
  81 #define FSR_WPROIN1     (22)
  82 #define FSR_WPROIN2     (23)
  83 #define FSR_WPRODIS0    (25)
  84 #define FSR_WPRODIS1    (26)
  85 #define FSR_SLM         (28)
  86 #define FSR_VER         (31)
  87
  88 #define FSR_PBUSY_MASK          (0x01 << FSR_PBUSY)
  89 #define FSR_FABUSY_MASK         (0x01 << FSR_FABUSY)
  90 #define FSR_PROG_MASK           (0x01 << FSR_PROG)
  91 #define FSR_ERASE_MASK          (0x01 << FSR_ERASE)
  92 #define FSR_PFPAGE_MASK         (0x01 << FSR_PFPAGE)
  93 #define FSR_PFOPER_MASK         (0x01 << FSR_PFOPER)
  94 #define FSR_SQER_MASK           (0x01 << FSR_SQER)
  95 #define FSR_PROER_MASK          (0x01 << FSR_PROER)
  96 #define FSR_PFSBER_MASK         (0x01 << FSR_PFSBER)
  97 #define FSR_PFDBER_MASK         (0x01 << FSR_PFDBER)
  98 #define FSR_PROIN_MASK          (0x01 << FSR_PROIN)
  99 #define FSR_RPROIN_MASK         (0x01 << FSR_RPROIN)
 100 #define FSR_RPRODIS_MASK        (0x01 << FSR_RPRODIS)
 101 #define FSR_WPROIN0_MASK        (0x01 << FSR_WPROIN0)
 102 #define FSR_WPROIN1_MASK        (0x01 << FSR_WPROIN1)
 103 #define FSR_WPROIN2_MASK        (0x01 << FSR_WPROIN2)
 104 #define FSR_WPRODIS0_MASK       (0x01 << FSR_WPRODIS0)
 105 #define FSR_WPRODIS1_MASK       (0x01 << FSR_WPRODIS1)
 106 #define FSR_SLM_MASK            (0x01 << FSR_SLM)
 107 #define FSR_VER_MASK            (0x01 << FSR_VER)
 108
 109 /* Flash Config Register */
 110 #define FLASH_REG_FLASH0_FCON   (FLASH_REG_BASE | 0x2014)
 111
 112 #define FCON_WSPFLASH           (0)
 113 #define FCON_WSECPF             (4)
 114 #define FCON_IDLE               (13)
 115 #define FCON_ESLDIS             (14)
 116 #define FCON_SLEEP              (15)
 117 #define FCON_RPA                (16)
 118 #define FCON_DCF                (17)
 119 #define FCON_DDF                (18)
 120 #define FCON_VOPERM             (24)
 121 #define FCON_SQERM              (25)
 122 #define FCON_PROERM             (26)
 123 #define FCON_PFSBERM            (27)
 124 #define FCON_PFDBERM            (29)
 125 #define FCON_EOBM               (31)
 126
 127 #define FCON_WSPFLASH_MASK      (0x0f << FCON_WSPFLASH)
 128 #define FCON_WSECPF_MASK        (0x01 << FCON_WSECPF)
 129 #define FCON_IDLE_MASK          (0x01 << FCON_IDLE)
 130 #define FCON_ESLDIS_MASK        (0x01 << FCON_ESLDIS)
 131 #define FCON_SLEEP_MASK         (0x01 << FCON_SLEEP)
 132 #define FCON_RPA_MASK           (0x01 << FCON_RPA)
 133 #define FCON_DCF_MASK           (0x01 << FCON_DCF)
 134 #define FCON_DDF_MASK           (0x01 << FCON_DDF)
 135 #define FCON_VOPERM_MASK        (0x01 << FCON_VOPERM)
 136 #define FCON_SQERM_MASK         (0x01 << FCON_SQERM)
 137 #define FCON_PROERM_MASK        (0x01 << FCON_PROERM)
 138 #define FCON_PFSBERM_MASK       (0x01 << FCON_PFSBERM)
 139 #define FCON_PFDBERM_MASK       (0x01 << FCON_PFDBERM)
 140 #define FCON_EOBM_MASK          (0x01 << FCON_EOBM)
 141
 142 /* Flash Margin Control Register */
 143 #define FLASH_REG_FLASH0_MARP   (FLASH_REG_BASE | 0x2018)
 144
 145 #define MARP_MARGIN             (0)
 146 #define MARP_TRAPDIS            (15)
 147
 148 #define MARP_MARGIN_MASK        (0x0f << MARP_MARGIN)
 149 #define MARP_TRAPDIS_MASK       (0x01 << MARP_TRAPDIS)
 150
 151 /* Flash Protection Registers */
 152 #define FLASH_REG_FLASH0_PROCON0        (FLASH_REG_BASE | 0x2020)
 153 #define FLASH_REG_FLASH0_PROCON1        (FLASH_REG_BASE | 0x2024)
 154 #define FLASH_REG_FLASH0_PROCON2        (FLASH_REG_BASE | 0x2028)
 155
 156 #define PROCON_S0L             (0)
 157 #define PROCON_S1L             (1)
 158 #define PROCON_S2L             (2)
 159 #define PROCON_S3L             (3)
 160 #define PROCON_S4L             (4)
 161 #define PROCON_S5L             (5)
 162 #define PROCON_S6L             (6)
 163 #define PROCON_S7L             (7)
 164 #define PROCON_S8L             (8)
 165 #define PROCON_S9L             (9)
 166 #define PROCON_S10_S11L        (10)
 167 #define PROCON_RPRO            (15)
 168
 169 #define PROCON_S0L_MASK        (0x01 << PROCON_S0L)
 170 #define PROCON_S1L_MASK        (0x01 << PROCON_S1L)
 171 #define PROCON_S2L_MASK        (0x01 << PROCON_S2L)
 172 #define PROCON_S3L_MASK        (0x01 << PROCON_S3L)
 173 #define PROCON_S4L_MASK        (0x01 << PROCON_S4L)
 174 #define PROCON_S5L_MASK        (0x01 << PROCON_S5L)
 175 #define PROCON_S6L_MASK        (0x01 << PROCON_S6L)
 176 #define PROCON_S7L_MASK        (0x01 << PROCON_S7L)
 177 #define PROCON_S8L_MASK        (0x01 << PROCON_S8L)
 178 #define PROCON_S9L_MASK        (0x01 << PROCON_S9L)
 179 #define PROCON_S10_S11L_MASK   (0x01 << PROCON_S10_S11L)
 180 #define PROCON_RPRO_MASK       (0x01 << PROCON_RPRO)
 181
 182 #define FLASH_PROTECT_CONFIRMATION_CODE 0x8AFE15C3
 183
 184 /* Flash controller configuration values */
 185 #define FLASH_ID_XMC4500        0xA2
 186 #define FLASH_ID_XMC4700_4800   0x92
 187 #define FLASH_ID_XMC4100_4200   0x9C
 188 #define FLASH_ID_XMC4400        0x9F
 189
 190 /* Timeouts */
 191 #define FLASH_OP_TIMEOUT 5000
 192
 193 /* Flash commands (write/erase/protect) are performed using special
 194  * command sequences that are written to magic addresses in the flash controller */
 195 /* Command sequence addresses.  See reference manual, section 8: Flash Command Sequences */
 196 #define FLASH_CMD_ERASE_1 0x0C005554
 197 #define FLASH_CMD_ERASE_2 0x0C00AAA8
 198 #define FLASH_CMD_ERASE_3 FLASH_CMD_ERASE_1
 199 #define FLASH_CMD_ERASE_4 FLASH_CMD_ERASE_1
 200 #define FLASH_CMD_ERASE_5 FLASH_CMD_ERASE_2
 201 /* ERASE_6 is the sector base address */
 202
 203 #define FLASH_CMD_CLEAR_STATUS FLASH_CMD_ERASE_1
 204
 205 #define FLASH_CMD_ENTER_PAGEMODE FLASH_CMD_ERASE_1
 206
 207 #define FLASH_CMD_LOAD_PAGE_1 0x0C0055F0
 208 #define FLASH_CMD_LOAD_PAGE_2 0x0C0055F4
 209
 210 #define FLASH_CMD_WRITE_PAGE_1 FLASH_CMD_ERASE_1
 211 #define FLASH_CMD_WRITE_PAGE_2 FLASH_CMD_ERASE_2
 212 #define FLASH_CMD_WRITE_PAGE_3 FLASH_CMD_ERASE_1
 213 /* WRITE_PAGE_4 is the page base address */
 214
 215 #define FLASH_CMD_TEMP_UNPROT_1 FLASH_CMD_ERASE_1
 216 #define FLASH_CMD_TEMP_UNPROT_2 FLASH_CMD_ERASE_2
 217 #define FLASH_CMD_TEMP_UNPROT_3 0x0C00553C
 218 #define FLASH_CMD_TEMP_UNPROT_4 FLASH_CMD_ERASE_2
 219 #define FLASH_CMD_TEMP_UNPROT_5 FLASH_CMD_ERASE_2
 220 #define FLASH_CMD_TEMP_UNPROT_6 0x0C005558
 221
 222 struct xmc4xxx_flash_bank {
 223         bool probed;
 224
 225         /* We need the flash controller ID to choose the sector layout */
 226         uint32_t fcon_id;
 227
 228         /* Passwords used for protection operations */
 229         uint32_t pw1;
 230         uint32_t pw2;
 231         bool pw_set;
 232
 233         /* Protection flags */
 234         bool read_protected;
 235
 236         bool write_prot_otp[MAX_XMC_SECTORS];
 237 };
 238
 239 struct xmc4xxx_command_seq {
 240         uint32_t address;
 241         uint32_t magic;
 242 };
 243
 244 /* Sector capacities.  See section 8 of xmc4x00_rm */
 245 static const unsigned int sector_capacity_8[8] = {
 246         16, 16, 16, 16, 16, 16, 16, 128
 247 };
 248
 249 static const unsigned int sector_capacity_9[9] = {
 250         16, 16, 16, 16, 16, 16, 16, 128, 256
 251 };
 252
 253 static const unsigned int sector_capacity_12[12] = {
 254         16, 16, 16, 16, 16, 16, 16, 16, 128, 256, 256, 256
 255 };
 256
 257 static const unsigned int sector_capacity_16[16] = {
 258         16, 16, 16, 16, 16, 16, 16, 16, 128, 256, 256, 256, 256, 256, 256, 256
 259 };
 260
 261 static int xmc4xxx_write_command_sequence(struct flash_bank *bank,
 262                                          struct xmc4xxx_command_seq *seq,
 263                                          int seq_len)
 264 {
 265         int res = ERROR_OK;
 266
 267         for (int i = 0; i < seq_len; i++) {
 268                 res = target_write_u32(bank->target, seq[i].address,
 269                                        seq[i].magic);
 270                 if (res != ERROR_OK)
 271                         return res;
 272         }
 273
 274         return ERROR_OK;
 275 }
 276
 277 static int xmc4xxx_load_bank_layout(struct flash_bank *bank)
 278 {
 279         const unsigned int *capacity = NULL;
 280
 281         /* At this point, we know which flash controller ID we're
 282          * talking to and simply need to fill out the bank structure accordingly */
 283         LOG_DEBUG("%d sectors", bank->num_sectors);
 284
 285         switch (bank->num_sectors) {
 286         case 8:
 287                 capacity = sector_capacity_8;
 288                 break;
 289         case 9:
 290                 capacity = sector_capacity_9;
 291                 break;
 292         case 12:
 293                 capacity = sector_capacity_12;
 294                 break;
 295         case 16:
 296                 capacity = sector_capacity_16;
 297                 break;
 298         default:
 299                 LOG_ERROR("Unexpected number of sectors, %d\n",
 300                           bank->num_sectors);
 301                 return ERROR_FAIL;
 302         }
 303
 304         /* This looks like a bank that we understand, now we know the
 305          * corresponding sector capacities and we can add those up into the
 306          * bank size. */
 307         uint32_t total_offset = 0;
 308         bank->sectors = calloc(bank->num_sectors,
 309                                sizeof(struct flash_sector));
 310         for (int i = 0; i < bank->num_sectors; i++) {
 311                 bank->sectors[i].size = capacity[i] * 1024;
 312                 bank->sectors[i].offset = total_offset;
 313                 bank->sectors[i].is_erased = -1;
 314                 bank->sectors[i].is_protected = -1;
 315
 316                 bank->size += bank->sectors[i].size;
 317                 LOG_DEBUG("\t%d: %uk", i, capacity[i]);
 318                 total_offset += bank->sectors[i].size;
 319         }
 320
 321         /* This part doesn't follow the typical standard of 0xff
 322          * being the default padding value.*/
 323         bank->default_padded_value = 0x00;
 324
 325         return ERROR_OK;
 326 }
 327
 328 static int xmc4xxx_probe(struct flash_bank *bank)
 329 {
 330         int res;
 331         uint32_t devid, config;
 332         struct xmc4xxx_flash_bank *fb = bank->driver_priv;
 333         uint8_t flash_id;
 334
 335         if (fb->probed)
 336                 return ERROR_OK;
 337
 338         /* It's not possible for the DAP to access the OTP locations needed for
 339          * probing the part info and Flash geometry so we require that the target
 340          * be halted before proceeding. */
 341         if (bank->target->state != TARGET_HALTED) {
 342                 LOG_WARNING("Cannot communicate... target not halted.");
 343                 return ERROR_TARGET_NOT_HALTED;
 344         }
 345
 346         /* The SCU registers contain the ID of the chip */
 347         res = target_read_u32(bank->target, SCU_REG_BASE + SCU_ID_CHIP, &devid);
 348         if (res != ERROR_OK) {
 349                 LOG_ERROR("Cannot read device identification register.");
 350                 return res;
 351         }
 352
 353         /* Make sure this is a XMC4000 family device */
 354         if ((devid & 0xF0000) != 0x40000 && devid != 0) {
 355                 LOG_ERROR("Platform ID doesn't match XMC4xxx: 0x%08" PRIx32, devid);
 356                 return ERROR_FAIL;
 357         }
 358
 359         LOG_DEBUG("Found XMC4xxx with devid: 0x%08" PRIx32, devid);
 360
 361         /* Now sanity-check the Flash controller itself. */
 362         res = target_read_u32(bank->target, FLASH_REG_FLASH0_ID,
 363                         &config);
 364         if (res != ERROR_OK) {
 365                 LOG_ERROR("Cannot read Flash bank configuration.");
 366                 return res;
 367         }
 368         flash_id = (config & 0xff0000) >> 16;
 369
 370         /* The Flash configuration register is our only means of
 371          * determining the sector layout. We need to make sure that
 372          * we understand the type of controller we're dealing with */
 373         switch (flash_id) {
 374         case FLASH_ID_XMC4100_4200:
 375                 bank->num_sectors = 8;
 376                 LOG_DEBUG("XMC4xxx: XMC4100/4200 detected.");
 377                 break;
 378         case FLASH_ID_XMC4400:
 379                 bank->num_sectors = 9;
 380                 LOG_DEBUG("XMC4xxx: XMC4400 detected.");
 381                 break;
 382         case FLASH_ID_XMC4500:
 383                 bank->num_sectors = 12;
 384                 LOG_DEBUG("XMC4xxx: XMC4500 detected.");
 385                 break;
 386         case FLASH_ID_XMC4700_4800:
 387                 bank->num_sectors = 16;
 388                 LOG_DEBUG("XMC4xxx: XMC4700/4800 detected.");
 389                 break;
 390         default:
 391                 LOG_ERROR("XMC4xxx: Unexpected flash ID. got %02" PRIx8,
 392                           flash_id);
 393                 return ERROR_FAIL;
 394         }
 395
 396         /* Retrieve information about the particular bank we're probing and fill in
 397          * the bank structure accordingly. */
 398         res = xmc4xxx_load_bank_layout(bank);
 399         if (res == ERROR_OK) {
 400                 /* We're done */
 401                 fb->probed = true;
 402         } else {
 403                 LOG_ERROR("Unable to load bank information.");
 404                 return ERROR_FAIL;
 405         }
 406
 407         return ERROR_OK;
 408 }
 409
 410 static int xmc4xxx_get_sector_start_addr(struct flash_bank *bank,
 411                                          int sector, uint32_t *ret_addr)
 412 {
 413         /* Make sure we understand this sector */
 414         if (sector > bank->num_sectors)
 415                 return ERROR_FAIL;
 416
 417         *ret_addr = bank->base + bank->sectors[sector].offset;
 418
 419         return ERROR_OK;
 420
 421 }
 422
 423 static int xmc4xxx_clear_flash_status(struct flash_bank *bank)
 424 {
 425         int res;
 426         /* TODO: Do we need to check for sequence error? */
 427         LOG_INFO("Clearing flash status");
 428         res = target_write_u32(bank->target, FLASH_CMD_CLEAR_STATUS,
 429                                0xF5);
 430         if (res != ERROR_OK) {
 431                 LOG_ERROR("Unable to write erase command sequence");
 432                 return res;
 433         }
 434
 435         return ERROR_OK;
 436 }
 437
 438 static int xmc4xxx_get_flash_status(struct flash_bank *bank, uint32_t *status)
 439 {
 440         int res;
 441
 442         res = target_read_u32(bank->target, FLASH_REG_FLASH0_FSR, status);
 443
 444         if (res != ERROR_OK)
 445                 LOG_ERROR("Cannot read flash status register.");
 446
 447         return res;
 448 }
 449
 450 static int xmc4xxx_wait_status_busy(struct flash_bank *bank, int timeout)
 451 {
 452         int res;
 453         uint32_t status;
 454
 455         res = xmc4xxx_get_flash_status(bank, &status);
 456         if (res != ERROR_OK)
 457                 return res;
 458
 459         /* While the flash controller is busy, wait */
 460         while (status & FSR_PBUSY_MASK) {
 461                 res = xmc4xxx_get_flash_status(bank, &status);
 462                 if (res != ERROR_OK)
 463                         return res;
 464
 465                 if (timeout-- <= 0) {
 466                         LOG_ERROR("Timed out waiting for flash");
 467                         return ERROR_FAIL;
 468                 }
 469                 alive_sleep(1);
 470                 keep_alive();
 471         }
 472
 473         if (status & FSR_PROER_MASK) {
 474                 LOG_ERROR("XMC4xxx flash protected");
 475                 res = ERROR_FAIL;
 476         }
 477
 478         return res;
 479 }
 480
 481 static int xmc4xxx_erase_sector(struct flash_bank *bank, uint32_t address,
 482                                 bool user_config)
 483 {
 484         int res;
 485         uint32_t status;
 486
 487         /* See reference manual table 8.4: Command Sequences for Flash Control */
 488         struct xmc4xxx_command_seq erase_cmd_seq[6] = {
 489                 {FLASH_CMD_ERASE_1, 0xAA},
 490                 {FLASH_CMD_ERASE_2, 0x55},
 491                 {FLASH_CMD_ERASE_3, 0x80},
 492                 {FLASH_CMD_ERASE_4, 0xAA},
 493                 {FLASH_CMD_ERASE_5, 0x55},
 494                 {0xFF,              0xFF} /* Needs filled in */
 495         };
 496
 497         /* We need to fill in the base address of the sector we'll be
 498          * erasing, as well as the magic code that determines whether
 499          * this is a standard flash sector or a user configuration block */
 500
 501         erase_cmd_seq[5].address = address;
 502         if (user_config) {
 503                 /* Removing flash protection requires the addition of
 504                  * the base address */
 505                 erase_cmd_seq[5].address += bank->base;
 506                 erase_cmd_seq[5].magic = 0xC0;
 507         } else {
 508                 erase_cmd_seq[5].magic = 0x30;
 509         }
 510
 511         res = xmc4xxx_write_command_sequence(bank, erase_cmd_seq,
 512                                              ARRAY_SIZE(erase_cmd_seq));
 513         if (res != ERROR_OK)
 514                 return res;
 515
 516         /* Read the flash status register */
 517         res = target_read_u32(bank->target, FLASH_REG_FLASH0_FSR, &status);
 518         if (res != ERROR_OK) {
 519                 LOG_ERROR("Cannot read flash status register.");
 520                 return res;
 521         }
 522
 523         /* Check for a sequence error */
 524         if (status & FSR_SQER_MASK) {
 525                 LOG_ERROR("Error with flash erase sequence");
 526                 return ERROR_FAIL;
 527         }
 528
 529         /* Make sure a flash erase was triggered */
 530         if (!(status & FSR_ERASE_MASK)) {
 531                 LOG_ERROR("Flash failed to erase");
 532                 return ERROR_FAIL;
 533         }
 534
 535         /* Now we must wait for the erase operation to end */
 536         res = xmc4xxx_wait_status_busy(bank, FLASH_OP_TIMEOUT);
 537
 538         return res;
 539 }
 540
 541 static int xmc4xxx_erase(struct flash_bank *bank, int first, int last)
 542 {
 543         struct xmc4xxx_flash_bank *fb = bank->driver_priv;
 544         int res;
 545
 546         if (bank->target->state != TARGET_HALTED) {
 547                 LOG_ERROR("Unable to erase, target is not halted");
 548                 return ERROR_TARGET_NOT_HALTED;
 549         }
 550
 551         if (!fb->probed) {
 552                 res = xmc4xxx_probe(bank);
 553                 if (res != ERROR_OK)
 554                         return res;
 555         }
 556
 557         uint32_t tmp_addr;
 558         /* Loop through the sectors and erase each one */
 559         for (int i = first; i <= last; i++) {
 560                 res = xmc4xxx_get_sector_start_addr(bank, i, &tmp_addr);
 561                 if (res != ERROR_OK) {
 562                         LOG_ERROR("Invalid sector %d", i);
 563                         return res;
 564                 }
 565
 566                 LOG_DEBUG("Erasing sector %d @ 0x%08"PRIx32, i, tmp_addr);
 567
 568                 res = xmc4xxx_erase_sector(bank, tmp_addr, false);
 569                 if (res != ERROR_OK) {
 570                         LOG_ERROR("Unable to write erase command sequence");
 571                         goto clear_status_and_exit;
 572                 }
 573
 574                 /* Now we must wait for the erase operation to end */
 575                 res = xmc4xxx_wait_status_busy(bank, FLASH_OP_TIMEOUT);
 576
 577                 if (res != ERROR_OK)
 578                         goto clear_status_and_exit;
 579
 580                 bank->sectors[i].is_erased = 1;
 581         }
 582
 583 clear_status_and_exit:
 584         res = xmc4xxx_clear_flash_status(bank);
 585         return res;
 586
 587 }
 588
 589 static int xmc4xxx_enter_page_mode(struct flash_bank *bank)
 590 {
 591         int res;
 592         uint32_t status;
 593
 594         res = target_write_u32(bank->target, FLASH_CMD_ENTER_PAGEMODE, 0x50);
 595         if (res != ERROR_OK) {
 596                 LOG_ERROR("Unable to write enter page mode command");
 597                 return ERROR_FAIL;
 598         }
 599
 600         res = xmc4xxx_get_flash_status(bank, &status);
 601
 602         if (res != ERROR_OK)
 603                 return res;
 604
 605         /* Make sure we're in page mode */
 606         if (!(status & FSR_PFPAGE_MASK)) {
 607                 LOG_ERROR("Unable to enter page mode");
 608                 return ERROR_FAIL;
 609         }
 610
 611         /* Make sure we didn't encounter a sequence error */
 612         if (status & FSR_SQER_MASK) {
 613                 LOG_ERROR("Sequence error while entering page mode");
 614                 return ERROR_FAIL;
 615         }
 616
 617         return res;
 618 }
 619
 620 /* The logical erase value of an xmc4xxx memory cell is 0x00,
 621  * therefore, we cannot use the built in flash blank check and must
 622  * implement our own */
 623
 624 /** Checks whether a memory region is zeroed. */
 625 static int xmc4xxx_blank_check_memory(struct target *target,
 626         uint32_t address, uint32_t count, uint32_t *blank)
 627 {
 628         struct working_area *erase_check_algorithm;
 629         struct reg_param reg_params[3];
 630         struct armv7m_algorithm armv7m_info;
 631         int retval;
 632
 633         static const uint8_t erase_check_code[] = {
 634 #include "../../../contrib/loaders/erase_check/armv7m_0_erase_check.inc"
 635         };
 636
 637         /* make sure we have a working area */
 638         if (target_alloc_working_area(target, sizeof(erase_check_code),
 639                 &erase_check_algorithm) != ERROR_OK)
 640                 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
 641
 642         retval = target_write_buffer(target, erase_check_algorithm->address,
 643                         sizeof(erase_check_code), (uint8_t *)erase_check_code);
 644         if (retval != ERROR_OK)
 645                 goto cleanup;
 646
 647         armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
 648         armv7m_info.core_mode = ARM_MODE_THREAD;
 649
 650         init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT);
 651         buf_set_u32(reg_params[0].value, 0, 32, address);
 652
 653         init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);
 654         buf_set_u32(reg_params[1].value, 0, 32, count);
 655
 656         init_reg_param(&reg_params[2], "r2", 32, PARAM_IN_OUT);
 657         buf_set_u32(reg_params[2].value, 0, 32, 0x00);
 658
 659         retval = target_run_algorithm(target,
 660                                       0,
 661                                       NULL,
 662                                       3,
 663                                       reg_params,
 664                                       erase_check_algorithm->address,
 665                                       erase_check_algorithm->address + (sizeof(erase_check_code) - 2),
 666                                       10000,
 667                                       &armv7m_info);
 668
 669         if (retval == ERROR_OK)
 670                 *blank = buf_get_u32(reg_params[2].value, 0, 32);
 671
 672         destroy_reg_param(&reg_params[0]);
 673         destroy_reg_param(&reg_params[1]);
 674         destroy_reg_param(&reg_params[2]);
 675
 676 cleanup:
 677         target_free_working_area(target, erase_check_algorithm);
 678
 679         return retval;
 680 }
 681
 682 static int xmc4xxx_flash_blank_check(struct flash_bank *bank)
 683 {
 684         struct target *target = bank->target;
 685         int i;
 686         int retval = ERROR_OK;
 687         uint32_t blank;
 688
 689         if (bank->target->state != TARGET_HALTED) {
 690                 LOG_ERROR("Target not halted");
 691                 return ERROR_TARGET_NOT_HALTED;
 692         }
 693
 694         for (i = 0; i < bank->num_sectors; i++) {
 695                 uint32_t address = bank->base + bank->sectors[i].offset;
 696                 uint32_t size = bank->sectors[i].size;
 697
 698                 LOG_DEBUG("Erase checking 0x%08"PRIx32, address);
 699                 retval = xmc4xxx_blank_check_memory(target, address, size, &blank);
 700
 701                 if (retval != ERROR_OK)
 702                         break;
 703
 704                 if (blank == 0x00)
 705                         bank->sectors[i].is_erased = 1;
 706                 else
 707                         bank->sectors[i].is_erased = 0;
 708         }
 709
 710         return retval;
 711 }
 712
 713 static int xmc4xxx_write_page(struct flash_bank *bank, const uint8_t *pg_buf,
 714                               uint32_t offset, bool user_config)
 715 {
 716         int res;
 717         uint32_t status;
 718
 719         /* Base of the flash write command */
 720         struct xmc4xxx_command_seq write_cmd_seq[4] = {
 721                 {FLASH_CMD_WRITE_PAGE_1, 0xAA},
 722                 {FLASH_CMD_WRITE_PAGE_2, 0x55},
 723                 {FLASH_CMD_WRITE_PAGE_3, 0xFF}, /* Needs filled in */
 724                 {0xFF,                   0xFF}  /* Needs filled in */
 725         };
 726
 727         /* The command sequence differs depending on whether this is
 728          * being written to standard flash or the user configuration
 729          * area */
 730         if (user_config)
 731                 write_cmd_seq[2].magic = 0xC0;
 732         else
 733                 write_cmd_seq[2].magic = 0xA0;
 734
 735         /* Finally, we need to add the address that this page will be
 736          * written to */
 737         write_cmd_seq[3].address = bank->base + offset;
 738         write_cmd_seq[3].magic = 0xAA;
 739
 740
 741         /* Flash pages are written 256 bytes at a time.  For each 256
 742          * byte chunk, we need to:
 743          * 1. Enter page mode. This activates the flash write buffer
 744          * 2. Load the page buffer with data (2x 32 bit words at a time)
 745          * 3. Burn the page buffer into its intended location
 746          * If the starting offset is not on a 256 byte boundary, we
 747          * will need to pad the beginning of the write buffer
 748          * accordingly. Likewise, if the last page does not fill the
 749          * buffer, we should pad it to avoid leftover data from being
 750          * written to flash
 751          */
 752         res = xmc4xxx_enter_page_mode(bank);
 753         if (res != ERROR_OK)
 754                 return res;
 755
 756         /* Copy the data into the page buffer*/
 757         for (int i = 0; i < 256; i += 8) {
 758                 uint32_t w_lo = target_buffer_get_u32(bank->target, &pg_buf[i]);
 759                 uint32_t w_hi = target_buffer_get_u32(bank->target, &pg_buf[i + 4]);
 760                 LOG_DEBUG("WLO: %08"PRIx32, w_lo);
 761                 LOG_DEBUG("WHI: %08"PRIx32, w_hi);
 762
 763                 /* Data is loaded 2x 32 bit words at a time */
 764                 res = target_write_u32(bank->target, FLASH_CMD_LOAD_PAGE_1, w_lo);
 765                 if (res != ERROR_OK)
 766                         return res;
 767
 768                 res = target_write_u32(bank->target, FLASH_CMD_LOAD_PAGE_2, w_hi);
 769                 if (res != ERROR_OK)
 770                         return res;
 771
 772                 /* Check for an error */
 773                 res = xmc4xxx_get_flash_status(bank, &status);
 774                 if (res != ERROR_OK)
 775                         return res;
 776
 777                 if (status & FSR_SQER_MASK) {
 778                         LOG_ERROR("Error loading page buffer");
 779                         return ERROR_FAIL;
 780                 }
 781         }
 782
 783         /* The page buffer is now full, time to commit it to flash */
 784
 785         res = xmc4xxx_write_command_sequence(bank, write_cmd_seq, ARRAY_SIZE(write_cmd_seq));
 786         if (res != ERROR_OK) {
 787                 LOG_ERROR("Unable to enter write command sequence");
 788                 return res;
 789         }
 790
 791         /* Read the flash status register */
 792         res = xmc4xxx_get_flash_status(bank, &status);
 793         if (res != ERROR_OK)
 794                 return res;
 795
 796         /* Check for a sequence error */
 797         if (status & FSR_SQER_MASK) {
 798                 LOG_ERROR("Error with flash write sequence");
 799                 return ERROR_FAIL;
 800         }
 801
 802         /* Make sure a flash write was triggered */
 803         if (!(status & FSR_PROG_MASK)) {
 804                 LOG_ERROR("Failed to write flash page");
 805                 return ERROR_FAIL;
 806         }
 807
 808         /* Wait for the write operation to end */
 809         res = xmc4xxx_wait_status_busy(bank, FLASH_OP_TIMEOUT);
 810         if (res != ERROR_OK)
 811                 return res;
 812
 813         /* TODO: Verify that page was written without error */
 814         return res;
 815 }
 816
 817 static int xmc4xxx_write(struct flash_bank *bank, const uint8_t *buffer,
 818                          uint32_t offset, uint32_t count)
 819 {
 820         struct xmc4xxx_flash_bank *fb = bank->driver_priv;
 821         int res = ERROR_OK;
 822
 823         if (bank->target->state != TARGET_HALTED) {
 824                 LOG_ERROR("Unable to erase, target is not halted");
 825                 return ERROR_TARGET_NOT_HALTED;
 826         }
 827
 828         if (!fb->probed) {
 829                 res = xmc4xxx_probe(bank);
 830                 if (res != ERROR_OK)
 831                         return res;
 832         }
 833
 834         /* Make sure we won't run off the end of the flash bank */
 835         if ((offset + count) > (bank->size)) {
 836                 LOG_ERROR("Attempting to write past the end of flash");
 837                 return ERROR_FAIL;
 838         }
 839
 840
 841         /* Attempt to write the passed in buffer to flash */
 842         /* Pages are written 256 bytes at a time, we need to handle
 843          * scenarios where padding is required at the beginning and
 844          * end of a page */
 845         while (count) {
 846                 /* page working area */
 847                 uint8_t tmp_buf[256] = {0};
 848
 849                 /* Amount of data we'll be writing to this page */
 850                 int remaining;
 851                 int end_pad;
 852
 853                 remaining = MIN(count, sizeof(tmp_buf));
 854                 end_pad   = sizeof(tmp_buf) - remaining;
 855
 856                 /* Make sure we're starting on a page boundary */
 857                 int start_pad = offset % 256;
 858                 if (start_pad) {
 859                         LOG_INFO("Write does not start on a 256 byte boundary. "
 860                                  "Padding by %d bytes", start_pad);
 861                         memset(tmp_buf, 0xff, start_pad);
 862                         /* Subtract the amount of start offset from
 863                          * the amount of data we'll need to write */
 864                         remaining -= start_pad;
 865                 }
 866
 867                 /* Remove the amount we'll be writing from the total count */
 868                 count -= remaining;
 869
 870                 /* Now copy in the remaining data */
 871                 memcpy(&tmp_buf[start_pad], buffer, remaining);
 872
 873                 if (end_pad) {
 874                         LOG_INFO("Padding end of page @%08"PRIx32" by %d bytes",
 875                                  bank->base + offset, end_pad);
 876                         memset(&tmp_buf[256 - end_pad], 0xff, end_pad);
 877                 }
 878
 879                 /* Now commit this page to flash, if there was start
 880                  * padding, we should subtract that from the target offset */
 881                 res = xmc4xxx_write_page(bank, tmp_buf, (offset - start_pad), false);
 882                 if (res != ERROR_OK) {
 883                         LOG_ERROR("Unable to write flash page");
 884                         goto abort_write_and_exit;
 885                 }
 886
 887                 /* Advance the buffer pointer */
 888                 buffer += remaining;
 889
 890                 /* Advance the offset */
 891                 offset += remaining;
 892         }
 893
 894 abort_write_and_exit:
 895         xmc4xxx_clear_flash_status(bank);
 896         return res;
 897
 898 }
 899
 900 static int xmc4xxx_get_info_command(struct flash_bank *bank, char *buf, int buf_size)
 901 {
 902         struct xmc4xxx_flash_bank *fb = bank->driver_priv;
 903         uint32_t scu_idcode;
 904
 905         if (bank->target->state != TARGET_HALTED) {
 906                 LOG_WARNING("Cannot communicate... target not halted.");
 907                 return ERROR_TARGET_NOT_HALTED;
 908         }
 909
 910         /* The SCU registers contain the ID of the chip */
 911         int res = target_read_u32(bank->target, SCU_REG_BASE + SCU_ID_CHIP, &scu_idcode);
 912         if (res != ERROR_OK) {
 913                 LOG_ERROR("Cannot read device identification register.");
 914                 return res;
 915         }
 916
 917         uint16_t dev_id = (scu_idcode & 0xfff0) >> 4;
 918         uint16_t rev_id = scu_idcode & 0xf;
 919         const char *dev_str;
 920         const char *rev_str = NULL;
 921
 922         switch (dev_id) {
 923         case 0x100:
 924                 dev_str = "XMC4100";
 925
 926                 switch (rev_id) {
 927                 case 0x1:
 928                         rev_str = "AA";
 929                         break;
 930                 case 0x2:
 931                         rev_str = "AB";
 932                         break;
 933                 }
 934                 break;
 935         case 0x200:
 936                 dev_str = "XMC4200";
 937
 938                 switch (rev_id) {
 939                 case 0x1:
 940                         rev_str = "AA";
 941                         break;
 942                 case 0x2:
 943                         rev_str = "AB";
 944                         break;
 945                 }
 946                 break;
 947         case 0x400:
 948                 dev_str = "XMC4400";
 949
 950                 switch (rev_id) {
 951                 case 0x1:
 952                         rev_str = "AA";
 953                         break;
 954                 case 0x2:
 955                         rev_str = "AB";
 956                         break;
 957                 }
 958                 break;
 959         case 0:
 960                 /* XMC4500 EES AA13 with date codes before GE212
 961                  * had zero SCU_IDCHIP
 962                  */
 963                 dev_str = "XMC4500 EES";
 964                 rev_str = "AA13";
 965                 break;
 966         case 0x500:
 967                 dev_str = "XMC4500";
 968
 969                 switch (rev_id) {
 970                 case 0x2:
 971                         rev_str = "AA";
 972                         break;
 973                 case 0x3:
 974                         rev_str = "AB";
 975                         break;
 976                 case 0x4:
 977                         rev_str = "AC";
 978                         break;
 979                 }
 980                 break;
 981         case 0x700:
 982                 dev_str = "XMC4700";
 983
 984                 switch (rev_id) {
 985                 case 0x1:
 986                         rev_str = "EES-AA";
 987                         break;
 988                 }
 989                 break;
 990         case 0x800:
 991                 dev_str = "XMC4800";
 992
 993                 switch (rev_id) {
 994                 case 0x1:
 995                         rev_str = "EES-AA";
 996                         break;
 997                 }
 998                 break;
 999
1000         default:
1001                 snprintf(buf, buf_size,
1002                          "Cannot identify target as an XMC4xxx. SCU_ID: %"PRIx32"\n",
1003                          scu_idcode);
1004                 return ERROR_OK;
1005         }
1006
1007         /* String to declare protection data held in the private driver */
1008         char prot_str[512] = {0};
1009         if (fb->read_protected)
1010                 snprintf(prot_str, sizeof(prot_str), "\nFlash is read protected");
1011
1012         bool otp_enabled = false;
1013         for (int i = 0; i < bank->num_sectors; i++)
1014                 if (fb->write_prot_otp[i])
1015                         otp_enabled = true;
1016
1017         /* If OTP Write protection is enabled (User 2), list each
1018          * sector that has it enabled */
1019         char otp_str[8];
1020         if (otp_enabled) {
1021                 strcat(prot_str, "\nOTP Protection is enabled for sectors:\n");
1022                 for (int i = 0; i < bank->num_sectors; i++) {
1023                         if (fb->write_prot_otp[i]) {
1024                                 snprintf(otp_str, sizeof(otp_str), "- %d\n", i);
1025                                 strncat(prot_str, otp_str, ARRAY_SIZE(otp_str));
1026                         }
1027                 }
1028         }
1029
1030         if (rev_str != NULL)
1031                 snprintf(buf, buf_size, "%s - Rev: %s%s",
1032                          dev_str, rev_str, prot_str);
1033         else
1034                 snprintf(buf, buf_size, "%s - Rev: unknown (0x%01x)%s",
1035                          dev_str, rev_id, prot_str);
1036
1037         return ERROR_OK;
1038 }
1039
1040 static int xmc4xxx_temp_unprotect(struct flash_bank *bank, int user_level)
1041 {
1042         struct xmc4xxx_flash_bank *fb;
1043         int res = ERROR_OK;
1044         uint32_t status = 0;
1045
1046         struct xmc4xxx_command_seq temp_unprot_seq[6] = {
1047                 {FLASH_CMD_TEMP_UNPROT_1, 0xAA},
1048                 {FLASH_CMD_TEMP_UNPROT_2, 0x55},
1049                 {FLASH_CMD_TEMP_UNPROT_3, 0xFF}, /* Needs filled in */
1050                 {FLASH_CMD_TEMP_UNPROT_4, 0xFF}, /* Needs filled in */
1051                 {FLASH_CMD_TEMP_UNPROT_5, 0xFF}, /* Needs filled in */
1052                 {FLASH_CMD_TEMP_UNPROT_6, 0x05}
1053         };
1054
1055         if (user_level < 0 || user_level > 2) {
1056                 LOG_ERROR("Invalid user level, must be 0-2");
1057                 return ERROR_FAIL;
1058         }
1059
1060         fb = bank->driver_priv;
1061
1062         /* Fill in the user level and passwords */
1063         temp_unprot_seq[2].magic = user_level;
1064         temp_unprot_seq[3].magic = fb->pw1;
1065         temp_unprot_seq[4].magic = fb->pw2;
1066
1067         res = xmc4xxx_write_command_sequence(bank, temp_unprot_seq,
1068                                              ARRAY_SIZE(temp_unprot_seq));
1069         if (res != ERROR_OK) {
1070                 LOG_ERROR("Unable to write temp unprotect sequence");
1071                 return res;
1072         }
1073
1074         res = xmc4xxx_get_flash_status(bank, &status);
1075         if (res != ERROR_OK)
1076                 return res;
1077
1078         if (status & FSR_WPRODIS0) {
1079                 LOG_INFO("Flash is temporarily unprotected");
1080         } else {
1081                 LOG_INFO("Unable to disable flash protection");
1082                 res = ERROR_FAIL;
1083         }
1084
1085
1086         return res;
1087 }
1088
1089 static int xmc4xxx_flash_unprotect(struct flash_bank *bank, int32_t level)
1090 {
1091         uint32_t addr;
1092         int res;
1093
1094         if ((level < 0) || (level > 1)) {
1095                 LOG_ERROR("Invalid user level. Must be 0-1");
1096                 return ERROR_FAIL;
1097         }
1098
1099         switch (level) {
1100         case 0:
1101                 addr = UCB0_BASE;
1102                 break;
1103         case 1:
1104                 addr = UCB1_BASE;
1105                 break;
1106         }
1107
1108         res = xmc4xxx_erase_sector(bank, addr, true);
1109
1110         if (res != ERROR_OK)
1111                 LOG_ERROR("Error erasing user configuration block");
1112
1113         return res;
1114 }
1115
1116 /* Reference: "XMC4500 Flash Protection.pptx" app note */
1117 static int xmc4xxx_flash_protect(struct flash_bank *bank, int level, bool read_protect,
1118                                  int first, int last)
1119 {
1120         /* User configuration block buffers */
1121         uint8_t ucp0_buf[8 * sizeof(uint32_t)] = {0};
1122         uint32_t ucb_base = 0;
1123         uint32_t procon = 0;
1124         int res = ERROR_OK;
1125         uint32_t status = 0;
1126         bool proin = false;
1127
1128         struct xmc4xxx_flash_bank *fb = bank->driver_priv;
1129
1130         /* Read protect only works for user 0, make sure we don't try
1131          * to do something silly */
1132         if (level != 0 && read_protect) {
1133                 LOG_ERROR("Read protection is for user level 0 only!");
1134                 return ERROR_FAIL;
1135         }
1136
1137         /* Check to see if protection is already installed for the
1138          * specified user level.  If it is, the user configuration
1139          * block will need to be erased before we can continue */
1140
1141         /* Grab the flash status register*/
1142         res = xmc4xxx_get_flash_status(bank, &status);
1143         if (res != ERROR_OK)
1144                 return res;
1145
1146         switch (level) {
1147         case 0:
1148                 if ((status & FSR_RPROIN_MASK) || (status & FSR_WPROIN0_MASK))
1149                         proin = true;
1150                 break;
1151         case 1:
1152                 if (status & FSR_WPROIN1_MASK)
1153                         proin = true;
1154                 break;
1155         case 2:
1156                 if (status & FSR_WPROIN2_MASK)
1157                         proin = true;
1158                 break;
1159         }
1160
1161         if (proin) {
1162                 LOG_ERROR("Flash protection is installed for user %d"
1163                           " and must be removed before continuing", level);
1164                 return ERROR_FAIL;
1165         }
1166
1167         /* If this device has 12 flash sectors, protection for
1168          * sectors 10 & 11 are handled jointly. If we are trying to
1169          * write all sectors, we should decrement
1170          * last to ensure we don't write to a register bit that
1171          * doesn't exist*/
1172         if ((bank->num_sectors == 12) && (last == 12))
1173                 last--;
1174
1175         /*  We need to fill out the procon register representation
1176          *   that we will be writing to the device */
1177         for (int i = first; i <= last; i++)
1178                 procon |= 1 << i;
1179
1180         /* If read protection is requested, set the appropriate bit
1181          * (we checked that this is allowed above) */
1182         if (read_protect)
1183                 procon |= PROCON_RPRO_MASK;
1184
1185         LOG_DEBUG("Setting flash protection with procon:");
1186         LOG_DEBUG("PROCON: %"PRIx32, procon);
1187
1188         /* First we need to copy in the procon register to the buffer
1189          * we're going to attempt to write.  This is written twice */
1190         target_buffer_set_u32(bank->target, &ucp0_buf[0 * 4], procon);
1191         target_buffer_set_u32(bank->target, &ucp0_buf[2 * 4], procon);
1192
1193         /* Now we must copy in both flash passwords.  As with the
1194          * procon data, this must be written twice (4 total words
1195          * worth of data) */
1196         target_buffer_set_u32(bank->target, &ucp0_buf[4 * 4], fb->pw1);
1197         target_buffer_set_u32(bank->target, &ucp0_buf[5 * 4], fb->pw2);
1198         target_buffer_set_u32(bank->target, &ucp0_buf[6 * 4], fb->pw1);
1199         target_buffer_set_u32(bank->target, &ucp0_buf[7 * 4], fb->pw2);
1200
1201         /* Finally, (if requested) we copy in the confirmation
1202          * code so that the protection is permanent and will
1203          * require a password to undo. */
1204         target_buffer_set_u32(bank->target, &ucp0_buf[0 * 4], FLASH_PROTECT_CONFIRMATION_CODE);
1205         target_buffer_set_u32(bank->target, &ucp0_buf[2 * 4], FLASH_PROTECT_CONFIRMATION_CODE);
1206
1207         /* Now that the data is copied into place, we must write
1208          * these pages into flash */
1209
1210         /* The user configuration block base depends on what level of
1211          * protection we're trying to install, select the proper one */
1212         switch (level) {
1213         case 0:
1214                 ucb_base = UCB0_BASE;
1215                 break;
1216         case 1:
1217                 ucb_base = UCB1_BASE;
1218                 break;
1219         case 2:
1220                 ucb_base = UCB2_BASE;
1221                 break;
1222         }
1223
1224         /* Write the user config pages */
1225         res = xmc4xxx_write_page(bank, ucp0_buf, ucb_base, true);
1226         if (res != ERROR_OK) {
1227                 LOG_ERROR("Error writing user configuration block 0");
1228                 return res;
1229         }
1230
1231         return ERROR_OK;
1232 }
1233
1234 static int xmc4xxx_protect(struct flash_bank *bank, int set, int first, int last)
1235 {
1236         int ret;
1237         struct xmc4xxx_flash_bank *fb = bank->driver_priv;
1238
1239         /* Check for flash passwords */
1240         if (!fb->pw_set) {
1241                 LOG_ERROR("Flash passwords not set, use xmc4xxx flash_password to set them");
1242                 return ERROR_FAIL;
1243         }
1244
1245         /* We want to clear flash protection temporarily*/
1246         if (set == 0) {
1247                 LOG_WARNING("Flash protection will be temporarily disabled"
1248                             " for all pages (User 0 only)!");
1249                 ret = xmc4xxx_temp_unprotect(bank, 0);
1250                 return ret;
1251         }
1252
1253         /* Install write protection for user 0 on the specified pages */
1254         ret = xmc4xxx_flash_protect(bank, 0, false, first, last);
1255
1256         return ret;
1257 }
1258
1259 static int xmc4xxx_protect_check(struct flash_bank *bank)
1260 {
1261         int ret;
1262         uint32_t protection[3] = {0};
1263         struct xmc4xxx_flash_bank *fb = bank->driver_priv;
1264
1265         ret = target_read_u32(bank->target, FLASH_REG_FLASH0_PROCON0, &protection[0]);
1266         if (ret != ERROR_OK) {
1267                 LOG_ERROR("Unable to read flash User0 protection register");
1268                 return ret;
1269         }
1270
1271         ret = target_read_u32(bank->target, FLASH_REG_FLASH0_PROCON1, &protection[1]);
1272         if (ret != ERROR_OK) {
1273                 LOG_ERROR("Unable to read flash User1 protection register");
1274                 return ret;
1275         }
1276
1277         ret = target_read_u32(bank->target, FLASH_REG_FLASH0_PROCON2, &protection[2]);
1278         if (ret != ERROR_OK) {
1279                 LOG_ERROR("Unable to read flash User2 protection register");
1280                 return ret;
1281         }
1282
1283         int sectors = bank->num_sectors;
1284
1285         /* On devices with 12 sectors, sectors 10 & 11 are ptected
1286          * together instead of individually */
1287         if (sectors == 12)
1288                 sectors--;
1289
1290         /* Clear the protection status */
1291         for (int i = 0; i < bank->num_sectors; i++) {
1292                 bank->sectors[i].is_protected = 0;
1293                 fb->write_prot_otp[i] = false;
1294         }
1295         fb->read_protected = false;
1296
1297         /* The xmc4xxx series supports 3 levels of user protection
1298          * (User0, User1 (low priority), and User 2(OTP), we need to
1299          * check all 3 */
1300         for (unsigned int i = 0; i < ARRAY_SIZE(protection); i++) {
1301
1302                 /* Check for write protection on every available
1303                 *  sector */
1304                 for (int j = 0; j < sectors; j++) {
1305                         int set = (protection[i] & (1 << j)) ? 1 : 0;
1306                         bank->sectors[j].is_protected |= set;
1307
1308                         /* Handle sector 11 */
1309                         if (j == 10)
1310                                 bank->sectors[j + 1].is_protected |= set;
1311
1312                         /* User 2 indicates this protection is
1313                          * permanent, make note in the private driver structure */
1314                         if (i == 2 && set) {
1315                                 fb->write_prot_otp[j] = true;
1316
1317                                 /* Handle sector 11 */
1318                                 if (j == 10)
1319                                         fb->write_prot_otp[j + 1] = true;
1320                         }
1321
1322                 }
1323         }
1324
1325         /* XMC4xxx also supports read proptection, make a note
1326          * in the private driver structure */
1327         if (protection[0] & PROCON_RPRO_MASK)
1328                 fb->read_protected = true;
1329
1330         return ERROR_OK;
1331 }
1332
1333 FLASH_BANK_COMMAND_HANDLER(xmc4xxx_flash_bank_command)
1334 {
1335         bank->driver_priv = malloc(sizeof(struct xmc4xxx_flash_bank));
1336
1337         if (!bank->driver_priv)
1338                 return ERROR_FLASH_OPERATION_FAILED;
1339
1340         (void)memset(bank->driver_priv, 0, sizeof(struct xmc4xxx_flash_bank));
1341
1342         return ERROR_OK;
1343 }
1344
1345 COMMAND_HANDLER(xmc4xxx_handle_flash_password_command)
1346 {
1347         int res;
1348         struct flash_bank *bank;
1349
1350         if (CMD_ARGC < 3)
1351                 return ERROR_COMMAND_SYNTAX_ERROR;
1352
1353         res = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1354         if (res != ERROR_OK)
1355                 return res;
1356
1357         struct xmc4xxx_flash_bank *fb = bank->driver_priv;
1358
1359         errno = 0;
1360
1361         /* We skip over the flash bank */
1362         fb->pw1 = strtol(CMD_ARGV[1], NULL, 16);
1363
1364         if (errno)
1365                 return ERROR_COMMAND_SYNTAX_ERROR;
1366
1367         fb->pw2 = strtol(CMD_ARGV[2], NULL, 16);
1368
1369         if (errno)
1370                 return ERROR_COMMAND_SYNTAX_ERROR;
1371
1372         fb->pw_set = true;
1373
1374         command_print(CMD_CTX, "XMC4xxx flash passwords set to:\n");
1375         command_print(CMD_CTX, "-0x%08"PRIx32"\n", fb->pw1);
1376         command_print(CMD_CTX, "-0x%08"PRIx32"\n", fb->pw2);
1377         return ERROR_OK;
1378 }
1379
1380 COMMAND_HANDLER(xmc4xxx_handle_flash_unprotect_command)
1381 {
1382         struct flash_bank *bank;
1383         int res;
1384         int32_t level;
1385
1386         if (CMD_ARGC < 2)
1387                 return ERROR_COMMAND_SYNTAX_ERROR;
1388
1389         res = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1390         if (res != ERROR_OK)
1391                 return res;
1392
1393         COMMAND_PARSE_NUMBER(s32, CMD_ARGV[1], level);
1394
1395         res = xmc4xxx_flash_unprotect(bank, level);
1396
1397         return res;
1398 }
1399
1400 static const struct command_registration xmc4xxx_exec_command_handlers[] = {
1401         {
1402                 .name = "flash_password",
1403                 .handler = xmc4xxx_handle_flash_password_command,
1404                 .mode = COMMAND_EXEC,
1405                 .usage = "bank_id password1 password2",
1406                 .help = "Set the flash passwords used for protect operations. "
1407                 "Passwords should be in standard hex form (0x00000000). "
1408                 "(You must call this before any other protect commands) "
1409                 "NOTE: The xmc4xxx's UCB area only allows for FOUR cycles. "
1410                 "Please use protection carefully!",
1411         },
1412         {
1413                 .name = "flash_unprotect",
1414                 .handler = xmc4xxx_handle_flash_unprotect_command,
1415                 .mode = COMMAND_EXEC,
1416                 .usage = "bank_id user_level[0-1]",
1417                 .help = "Permanently Removes flash protection (read and write) "
1418                 "for the specified user level",
1419         },      COMMAND_REGISTRATION_DONE
1420 };
1421
1422 static const struct command_registration xmc4xxx_command_handlers[] = {
1423         {
1424                 .name = "xmc4xxx",
1425                 .mode = COMMAND_ANY,
1426                 .help = "xmc4xxx flash command group",
1427                 .usage = "",
1428                 .chain = xmc4xxx_exec_command_handlers,
1429         },
1430         COMMAND_REGISTRATION_DONE
1431 };
1432
1433 struct flash_driver xmc4xxx_flash = {
1434         .name = "xmc4xxx",
1435         .commands = xmc4xxx_command_handlers,
1436         .flash_bank_command = xmc4xxx_flash_bank_command,
1437         .erase = xmc4xxx_erase,
1438         .write = xmc4xxx_write,
1439         .read = default_flash_read,
1440         .probe = xmc4xxx_probe,
1441         .auto_probe = xmc4xxx_probe,
1442         .erase_check = xmc4xxx_flash_blank_check,
1443         .info = xmc4xxx_get_info_command,
1444         .protect_check = xmc4xxx_protect_check,
1445         .protect = xmc4xxx_protect,
1446 };