1 /**************************************************************************
2 * Copyright (C) 2015 Jeff Ciesielski <jeffciesielski@gmail.com> *
4 * This program is free software; you can redistribute it and/or modify *
5 * it under the terms of the GNU General Public License as published by *
6 * the Free Software Foundation; either version 2 of the License, or *
7 * (at your option) any later version. *
9 * This program is distributed in the hope that it will be useful, *
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
12 * GNU General Public License for more details. *
14 ***************************************************************************/
21 #include <helper/binarybuffer.h>
22 #include <target/algorithm.h>
23 #include <target/armv7m.h>
25 /* Maximum number of sectors */
26 #define MAX_XMC_SECTORS 12
28 /* System control unit registers */
29 #define SCU_REG_BASE 0x50004000
31 #define SCU_ID_CHIP 0x04
33 /* Base of the non-cached flash memory */
34 #define PFLASH_BASE 0x0C000000
36 /* User configuration block offsets */
37 #define UCB0_BASE 0x00000000
38 #define UCB1_BASE 0x00000400
39 #define UCB2_BASE 0x00000800
41 /* Flash register base */
42 #define FLASH_REG_BASE 0x58000000
44 /* PMU ID Registers */
45 #define FLASH_REG_PMU_ID (FLASH_REG_BASE | 0x0508)
48 #define PMU_MOD_REV_MASK 0xFF
49 #define PMU_MOD_TYPE_MASK 0xFF00
50 #define PMU_MOD_NO_MASK 0xFFFF0000
53 #define FLASH_REG_PREF_PCON (FLASH_REG_BASE | 0x4000)
56 #define PCON_IBYP (1 << 0)
57 #define PCON_IINV (1 << 1)
59 /* Flash ID Register */
60 #define FLASH_REG_FLASH0_ID (FLASH_REG_BASE | 0x2008)
62 /* Flash Status Register */
63 #define FLASH_REG_FLASH0_FSR (FLASH_REG_BASE | 0x2010)
66 #define FSR_FABUSY (1)
69 #define FSR_PFPAGE (6)
70 #define FSR_PFOPER (8)
72 #define FSR_PROER (11)
73 #define FSR_PFSBER (12)
74 #define FSR_PFDBER (14)
75 #define FSR_PROIN (16)
76 #define FSR_RPROIN (18)
77 #define FSR_RPRODIS (19)
78 #define FSR_WPROIN0 (21)
79 #define FSR_WPROIN1 (22)
80 #define FSR_WPROIN2 (23)
81 #define FSR_WPRODIS0 (25)
82 #define FSR_WPRODIS1 (26)
86 #define FSR_PBUSY_MASK (0x01 << FSR_PBUSY)
87 #define FSR_FABUSY_MASK (0x01 << FSR_FABUSY)
88 #define FSR_PROG_MASK (0x01 << FSR_PROG)
89 #define FSR_ERASE_MASK (0x01 << FSR_ERASE)
90 #define FSR_PFPAGE_MASK (0x01 << FSR_PFPAGE)
91 #define FSR_PFOPER_MASK (0x01 << FSR_PFOPER)
92 #define FSR_SQER_MASK (0x01 << FSR_SQER)
93 #define FSR_PROER_MASK (0x01 << FSR_PROER)
94 #define FSR_PFSBER_MASK (0x01 << FSR_PFSBER)
95 #define FSR_PFDBER_MASK (0x01 << FSR_PFDBER)
96 #define FSR_PROIN_MASK (0x01 << FSR_PROIN)
97 #define FSR_RPROIN_MASK (0x01 << FSR_RPROIN)
98 #define FSR_RPRODIS_MASK (0x01 << FSR_RPRODIS)
99 #define FSR_WPROIN0_MASK (0x01 << FSR_WPROIN0)
100 #define FSR_WPROIN1_MASK (0x01 << FSR_WPROIN1)
101 #define FSR_WPROIN2_MASK (0x01 << FSR_WPROIN2)
102 #define FSR_WPRODIS0_MASK (0x01 << FSR_WPRODIS0)
103 #define FSR_WPRODIS1_MASK (0x01 << FSR_WPRODIS1)
104 #define FSR_SLM_MASK (0x01 << FSR_SLM)
105 #define FSR_VER_MASK (0x01 << FSR_VER)
107 /* Flash Config Register */
108 #define FLASH_REG_FLASH0_FCON (FLASH_REG_BASE | 0x2014)
110 #define FCON_WSPFLASH (0)
111 #define FCON_WSECPF (4)
112 #define FCON_IDLE (13)
113 #define FCON_ESLDIS (14)
114 #define FCON_SLEEP (15)
115 #define FCON_RPA (16)
116 #define FCON_DCF (17)
117 #define FCON_DDF (18)
118 #define FCON_VOPERM (24)
119 #define FCON_SQERM (25)
120 #define FCON_PROERM (26)
121 #define FCON_PFSBERM (27)
122 #define FCON_PFDBERM (29)
123 #define FCON_EOBM (31)
125 #define FCON_WSPFLASH_MASK (0x0f << FCON_WSPFLASH)
126 #define FCON_WSECPF_MASK (0x01 << FCON_WSECPF)
127 #define FCON_IDLE_MASK (0x01 << FCON_IDLE)
128 #define FCON_ESLDIS_MASK (0x01 << FCON_ESLDIS)
129 #define FCON_SLEEP_MASK (0x01 << FCON_SLEEP)
130 #define FCON_RPA_MASK (0x01 << FCON_RPA)
131 #define FCON_DCF_MASK (0x01 << FCON_DCF)
132 #define FCON_DDF_MASK (0x01 << FCON_DDF)
133 #define FCON_VOPERM_MASK (0x01 << FCON_VOPERM)
134 #define FCON_SQERM_MASK (0x01 << FCON_SQERM)
135 #define FCON_PROERM_MASK (0x01 << FCON_PROERM)
136 #define FCON_PFSBERM_MASK (0x01 << FCON_PFSBERM)
137 #define FCON_PFDBERM_MASK (0x01 << FCON_PFDBERM)
138 #define FCON_EOBM_MASK (0x01 << FCON_EOBM)
140 /* Flash Margin Control Register */
141 #define FLASH_REG_FLASH0_MARP (FLASH_REG_BASE | 0x2018)
143 #define MARP_MARGIN (0)
144 #define MARP_TRAPDIS (15)
146 #define MARP_MARGIN_MASK (0x0f << MARP_MARGIN)
147 #define MARP_TRAPDIS_MASK (0x01 << MARP_TRAPDIS)
149 /* Flash Protection Registers */
150 #define FLASH_REG_FLASH0_PROCON0 (FLASH_REG_BASE | 0x2020)
151 #define FLASH_REG_FLASH0_PROCON1 (FLASH_REG_BASE | 0x2024)
152 #define FLASH_REG_FLASH0_PROCON2 (FLASH_REG_BASE | 0x2028)
154 #define PROCON_S0L (0)
155 #define PROCON_S1L (1)
156 #define PROCON_S2L (2)
157 #define PROCON_S3L (3)
158 #define PROCON_S4L (4)
159 #define PROCON_S5L (5)
160 #define PROCON_S6L (6)
161 #define PROCON_S7L (7)
162 #define PROCON_S8L (8)
163 #define PROCON_S9L (9)
164 #define PROCON_S10_S11L (10)
165 #define PROCON_RPRO (15)
167 #define PROCON_S0L_MASK (0x01 << PROCON_S0L)
168 #define PROCON_S1L_MASK (0x01 << PROCON_S1L)
169 #define PROCON_S2L_MASK (0x01 << PROCON_S2L)
170 #define PROCON_S3L_MASK (0x01 << PROCON_S3L)
171 #define PROCON_S4L_MASK (0x01 << PROCON_S4L)
172 #define PROCON_S5L_MASK (0x01 << PROCON_S5L)
173 #define PROCON_S6L_MASK (0x01 << PROCON_S6L)
174 #define PROCON_S7L_MASK (0x01 << PROCON_S7L)
175 #define PROCON_S8L_MASK (0x01 << PROCON_S8L)
176 #define PROCON_S9L_MASK (0x01 << PROCON_S9L)
177 #define PROCON_S10_S11L_MASK (0x01 << PROCON_S10_S11L)
178 #define PROCON_RPRO_MASK (0x01 << PROCON_RPRO)
180 #define FLASH_PROTECT_CONFIRMATION_CODE 0x8AFE15C3
182 /* Flash controller configuration values */
183 #define FLASH_ID_XMC4500 0xA2
184 #define FLASH_ID_XMC4800 0x92
185 #define FLASH_ID_XMC4100_4200 0x9C
186 #define FLASH_ID_XMC4400 0x9F
189 #define FLASH_OP_TIMEOUT 5000
191 /* Flash commands (write/erase/protect) are performed using special
192 * command sequences that are written to magic addresses in the flash controller */
193 /* Command sequence addresses. See reference manual, section 8: Flash Command Sequences */
194 #define FLASH_CMD_ERASE_1 0x0C005554
195 #define FLASH_CMD_ERASE_2 0x0C00AAA8
196 #define FLASH_CMD_ERASE_3 FLASH_CMD_ERASE_1
197 #define FLASH_CMD_ERASE_4 FLASH_CMD_ERASE_1
198 #define FLASH_CMD_ERASE_5 FLASH_CMD_ERASE_2
199 /* ERASE_6 is the sector base address */
201 #define FLASH_CMD_CLEAR_STATUS FLASH_CMD_ERASE_1
203 #define FLASH_CMD_ENTER_PAGEMODE FLASH_CMD_ERASE_1
205 #define FLASH_CMD_LOAD_PAGE_1 0x0C0055F0
206 #define FLASH_CMD_LOAD_PAGE_2 0x0C0055F4
208 #define FLASH_CMD_WRITE_PAGE_1 FLASH_CMD_ERASE_1
209 #define FLASH_CMD_WRITE_PAGE_2 FLASH_CMD_ERASE_2
210 #define FLASH_CMD_WRITE_PAGE_3 FLASH_CMD_ERASE_1
211 /* WRITE_PAGE_4 is the page base address */
213 #define FLASH_CMD_TEMP_UNPROT_1 FLASH_CMD_ERASE_1
214 #define FLASH_CMD_TEMP_UNPROT_2 FLASH_CMD_ERASE_2
215 #define FLASH_CMD_TEMP_UNPROT_3 0x0C00553C
216 #define FLASH_CMD_TEMP_UNPROT_4 FLASH_CMD_ERASE_2
217 #define FLASH_CMD_TEMP_UNPROT_5 FLASH_CMD_ERASE_2
218 #define FLASH_CMD_TEMP_UNPROT_6 0x0C005558
220 struct xmc4xxx_flash_bank {
223 /* We need the flash controller ID to choose the sector layout */
226 /* Passwords used for protection operations */
231 /* Protection flags */
234 bool write_prot_otp[MAX_XMC_SECTORS];
237 struct xmc4xxx_command_seq {
242 /* Sector capacities. See section 8 of xmc4x00_rm */
243 static const unsigned int sector_capacity_8[8] = {
244 16, 16, 16, 16, 16, 16, 16, 128
247 static const unsigned int sector_capacity_9[9] = {
248 16, 16, 16, 16, 16, 16, 16, 128, 256
251 static const unsigned int sector_capacity_12[12] = {
252 16, 16, 16, 16, 16, 16, 16, 16, 128, 256, 256, 256
255 static const unsigned int sector_capacity_16[16] = {
256 16, 16, 16, 16, 16, 16, 16, 16, 128, 256, 256, 256, 256, 256, 256, 256
259 static int xmc4xxx_write_command_sequence(struct flash_bank *bank,
260 struct xmc4xxx_command_seq *seq,
265 for (int i = 0; i < seq_len; i++) {
266 res = target_write_u32(bank->target, seq[i].address,
275 static int xmc4xxx_load_bank_layout(struct flash_bank *bank)
277 const unsigned int *capacity = NULL;
279 /* At this point, we know which flash controller ID we're
280 * talking to and simply need to fill out the bank structure accordingly */
281 LOG_DEBUG("%d sectors", bank->num_sectors);
283 switch (bank->num_sectors) {
285 capacity = sector_capacity_8;
288 capacity = sector_capacity_9;
291 capacity = sector_capacity_12;
294 capacity = sector_capacity_16;
297 LOG_ERROR("Unexpected number of sectors, %d\n",
302 /* This looks like a bank that we understand, now we know the
303 * corresponding sector capacities and we can add those up into the
305 uint32_t total_offset = 0;
306 bank->sectors = calloc(bank->num_sectors,
307 sizeof(struct flash_sector));
308 for (int i = 0; i < bank->num_sectors; i++) {
309 bank->sectors[i].size = capacity[i] * 1024;
310 bank->sectors[i].offset = total_offset;
311 bank->sectors[i].is_erased = -1;
312 bank->sectors[i].is_protected = -1;
314 bank->size += bank->sectors[i].size;
315 LOG_DEBUG("\t%d: %uk", i, capacity[i]);
316 total_offset += bank->sectors[i].size;
319 /* This part doesn't follow the typical standard of 0xff
320 * being the default padding value.*/
321 bank->default_padded_value = 0x00;
326 static int xmc4xxx_probe(struct flash_bank *bank)
329 uint32_t devid, config;
330 struct xmc4xxx_flash_bank *fb = bank->driver_priv;
336 /* It's not possible for the DAP to access the OTP locations needed for
337 * probing the part info and Flash geometry so we require that the target
338 * be halted before proceeding. */
339 if (bank->target->state != TARGET_HALTED) {
340 LOG_WARNING("Cannot communicate... target not halted.");
341 return ERROR_TARGET_NOT_HALTED;
344 /* The SCU registers contain the ID of the chip */
345 res = target_read_u32(bank->target, SCU_REG_BASE + SCU_ID_CHIP, &devid);
346 if (res != ERROR_OK) {
347 LOG_ERROR("Cannot read device identification register.");
351 /* Make sure this is a XMC4000 family device */
352 if ((devid & 0xF0000) != 0x40000 && devid != 0) {
353 LOG_ERROR("Platform ID doesn't match XMC4xxx: 0x%08" PRIx32, devid);
357 LOG_DEBUG("Found XMC4xxx with devid: 0x%08" PRIx32, devid);
359 /* Now sanity-check the Flash controller itself. */
360 res = target_read_u32(bank->target, FLASH_REG_FLASH0_ID,
362 if (res != ERROR_OK) {
363 LOG_ERROR("Cannot read Flash bank configuration.");
366 flash_id = (config & 0xff0000) >> 16;
368 /* The Flash configuration register is our only means of
369 * determining the sector layout. We need to make sure that
370 * we understand the type of controller we're dealing with */
372 case FLASH_ID_XMC4100_4200:
373 bank->num_sectors = 8;
374 LOG_DEBUG("XMC4xxx: XMC4100/4200 detected.");
376 case FLASH_ID_XMC4400:
377 bank->num_sectors = 9;
378 LOG_DEBUG("XMC4xxx: XMC4400 detected.");
380 case FLASH_ID_XMC4500:
381 bank->num_sectors = 12;
382 LOG_DEBUG("XMC4xxx: XMC4500 detected.");
384 case FLASH_ID_XMC4800:
385 bank->num_sectors = 16;
386 LOG_DEBUG("XMC4xxx: XMC4800 detected.");
389 LOG_ERROR("XMC4xxx: Unexpected flash ID. got %02" PRIx8,
394 /* Retrieve information about the particular bank we're probing and fill in
395 * the bank structure accordingly. */
396 res = xmc4xxx_load_bank_layout(bank);
397 if (res == ERROR_OK) {
401 LOG_ERROR("Unable to load bank information.");
408 static int xmc4xxx_get_sector_start_addr(struct flash_bank *bank,
409 int sector, uint32_t *ret_addr)
411 /* Make sure we understand this sector */
412 if (sector > bank->num_sectors)
415 *ret_addr = bank->base + bank->sectors[sector].offset;
421 static int xmc4xxx_clear_flash_status(struct flash_bank *bank)
424 /* TODO: Do we need to check for sequence error? */
425 LOG_INFO("Clearing flash status");
426 res = target_write_u32(bank->target, FLASH_CMD_CLEAR_STATUS,
428 if (res != ERROR_OK) {
429 LOG_ERROR("Unable to write erase command sequence");
436 static int xmc4xxx_get_flash_status(struct flash_bank *bank, uint32_t *status)
440 res = target_read_u32(bank->target, FLASH_REG_FLASH0_FSR, status);
443 LOG_ERROR("Cannot read flash status register.");
448 static int xmc4xxx_wait_status_busy(struct flash_bank *bank, int timeout)
453 res = xmc4xxx_get_flash_status(bank, &status);
457 /* While the flash controller is busy, wait */
458 while (status & FSR_PBUSY_MASK) {
459 res = xmc4xxx_get_flash_status(bank, &status);
463 if (timeout-- <= 0) {
464 LOG_ERROR("Timed out waiting for flash");
471 if (status & FSR_PROER_MASK) {
472 LOG_ERROR("XMC4xxx flash protected");
479 static int xmc4xxx_erase_sector(struct flash_bank *bank, uint32_t address,
485 /* See reference manual table 8.4: Command Sequences for Flash Control */
486 struct xmc4xxx_command_seq erase_cmd_seq[6] = {
487 {FLASH_CMD_ERASE_1, 0xAA},
488 {FLASH_CMD_ERASE_2, 0x55},
489 {FLASH_CMD_ERASE_3, 0x80},
490 {FLASH_CMD_ERASE_4, 0xAA},
491 {FLASH_CMD_ERASE_5, 0x55},
492 {0xFF, 0xFF} /* Needs filled in */
495 /* We need to fill in the base address of the sector we'll be
496 * erasing, as well as the magic code that determines whether
497 * this is a standard flash sector or a user configuration block */
499 erase_cmd_seq[5].address = address;
501 /* Removing flash protection requires the addition of
502 * the base address */
503 erase_cmd_seq[5].address += bank->base;
504 erase_cmd_seq[5].magic = 0xC0;
506 erase_cmd_seq[5].magic = 0x30;
509 res = xmc4xxx_write_command_sequence(bank, erase_cmd_seq,
510 ARRAY_SIZE(erase_cmd_seq));
514 /* Read the flash status register */
515 res = target_read_u32(bank->target, FLASH_REG_FLASH0_FSR, &status);
516 if (res != ERROR_OK) {
517 LOG_ERROR("Cannot read flash status register.");
521 /* Check for a sequence error */
522 if (status & FSR_SQER_MASK) {
523 LOG_ERROR("Error with flash erase sequence");
527 /* Make sure a flash erase was triggered */
528 if (!(status & FSR_ERASE_MASK)) {
529 LOG_ERROR("Flash failed to erase");
533 /* Now we must wait for the erase operation to end */
534 res = xmc4xxx_wait_status_busy(bank, FLASH_OP_TIMEOUT);
539 static int xmc4xxx_erase(struct flash_bank *bank, int first, int last)
541 struct xmc4xxx_flash_bank *fb = bank->driver_priv;
544 if (bank->target->state != TARGET_HALTED) {
545 LOG_ERROR("Unable to erase, target is not halted");
546 return ERROR_TARGET_NOT_HALTED;
550 res = xmc4xxx_probe(bank);
556 /* Loop through the sectors and erase each one */
557 for (int i = first; i <= last; i++) {
558 res = xmc4xxx_get_sector_start_addr(bank, i, &tmp_addr);
559 if (res != ERROR_OK) {
560 LOG_ERROR("Invalid sector %d", i);
564 LOG_DEBUG("Erasing sector %d @ 0x%08"PRIx32, i, tmp_addr);
566 res = xmc4xxx_erase_sector(bank, tmp_addr, false);
567 if (res != ERROR_OK) {
568 LOG_ERROR("Unable to write erase command sequence");
569 goto clear_status_and_exit;
572 /* Now we must wait for the erase operation to end */
573 res = xmc4xxx_wait_status_busy(bank, FLASH_OP_TIMEOUT);
576 goto clear_status_and_exit;
578 bank->sectors[i].is_erased = 1;
581 clear_status_and_exit:
582 res = xmc4xxx_clear_flash_status(bank);
587 static int xmc4xxx_enter_page_mode(struct flash_bank *bank)
592 res = target_write_u32(bank->target, FLASH_CMD_ENTER_PAGEMODE, 0x50);
593 if (res != ERROR_OK) {
594 LOG_ERROR("Unable to write enter page mode command");
598 res = xmc4xxx_get_flash_status(bank, &status);
603 /* Make sure we're in page mode */
604 if (!(status & FSR_PFPAGE_MASK)) {
605 LOG_ERROR("Unable to enter page mode");
609 /* Make sure we didn't encounter a sequence error */
610 if (status & FSR_SQER_MASK) {
611 LOG_ERROR("Sequence error while entering page mode");
618 /* The logical erase value of an xmc4xxx memory cell is 0x00,
619 * therefore, we cannot use the built in flash blank check and must
620 * implement our own */
622 /** Checks whether a memory region is zeroed. */
623 int xmc4xxx_blank_check_memory(struct target *target,
624 uint32_t address, uint32_t count, uint32_t *blank)
626 struct working_area *erase_check_algorithm;
627 struct reg_param reg_params[3];
628 struct armv7m_algorithm armv7m_info;
631 /* see contrib/loaders/erase_check/armv7m_0_erase_check.s for src */
633 static const uint8_t erase_check_code[] = {
635 0x03, 0x78, /* ldrb r3, [r0] */
636 0x01, 0x30, /* adds r0, #1 */
637 0x1A, 0x43, /* orrs r2, r2, r3 */
638 0x01, 0x39, /* subs r1, r1, #1 */
639 0xFA, 0xD1, /* bne loop */
640 0x00, 0xBE /* bkpt #0 */
643 /* make sure we have a working area */
644 if (target_alloc_working_area(target, sizeof(erase_check_code),
645 &erase_check_algorithm) != ERROR_OK)
646 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
648 retval = target_write_buffer(target, erase_check_algorithm->address,
649 sizeof(erase_check_code), (uint8_t *)erase_check_code);
650 if (retval != ERROR_OK)
653 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
654 armv7m_info.core_mode = ARM_MODE_THREAD;
656 init_reg_param(®_params[0], "r0", 32, PARAM_OUT);
657 buf_set_u32(reg_params[0].value, 0, 32, address);
659 init_reg_param(®_params[1], "r1", 32, PARAM_OUT);
660 buf_set_u32(reg_params[1].value, 0, 32, count);
662 init_reg_param(®_params[2], "r2", 32, PARAM_IN_OUT);
663 buf_set_u32(reg_params[2].value, 0, 32, 0x00);
665 retval = target_run_algorithm(target,
670 erase_check_algorithm->address,
671 erase_check_algorithm->address + (sizeof(erase_check_code) - 2),
675 if (retval == ERROR_OK)
676 *blank = buf_get_u32(reg_params[2].value, 0, 32);
678 destroy_reg_param(®_params[0]);
679 destroy_reg_param(®_params[1]);
680 destroy_reg_param(®_params[2]);
682 target_free_working_area(target, erase_check_algorithm);
687 static int xmc4xxx_flash_blank_check(struct flash_bank *bank)
689 struct target *target = bank->target;
694 if (bank->target->state != TARGET_HALTED) {
695 LOG_ERROR("Target not halted");
696 return ERROR_TARGET_NOT_HALTED;
699 for (i = 0; i < bank->num_sectors; i++) {
700 uint32_t address = bank->base + bank->sectors[i].offset;
701 uint32_t size = bank->sectors[i].size;
703 LOG_DEBUG("Erase checking 0x%08"PRIx32, address);
704 retval = xmc4xxx_blank_check_memory(target, address, size, &blank);
706 if (retval != ERROR_OK)
710 bank->sectors[i].is_erased = 1;
712 bank->sectors[i].is_erased = 0;
718 static int xmc4xxx_write_page(struct flash_bank *bank, const uint8_t *pg_buf,
719 uint32_t offset, bool user_config)
724 /* Base of the flash write command */
725 struct xmc4xxx_command_seq write_cmd_seq[4] = {
726 {FLASH_CMD_WRITE_PAGE_1, 0xAA},
727 {FLASH_CMD_WRITE_PAGE_2, 0x55},
728 {FLASH_CMD_WRITE_PAGE_3, 0xFF}, /* Needs filled in */
729 {0xFF, 0xFF} /* Needs filled in */
732 /* The command sequence differs depending on whether this is
733 * being written to standard flash or the user configuration
736 write_cmd_seq[2].magic = 0xC0;
738 write_cmd_seq[2].magic = 0xA0;
740 /* Finally, we need to add the address that this page will be
742 write_cmd_seq[3].address = bank->base + offset;
743 write_cmd_seq[3].magic = 0xAA;
746 /* Flash pages are written 256 bytes at a time. For each 256
747 * byte chunk, we need to:
748 * 1. Enter page mode. This activates the flash write buffer
749 * 2. Load the page buffer with data (2x 32 bit words at a time)
750 * 3. Burn the page buffer into its intended location
751 * If the starting offset is not on a 256 byte boundary, we
752 * will need to pad the beginning of the write buffer
753 * accordingly. Likewise, if the last page does not fill the
754 * buffer, we should pad it to avoid leftover data from being
757 res = xmc4xxx_enter_page_mode(bank);
761 /* Copy the data into the page buffer*/
762 for (int i = 0; i < 256; i += 8) {
763 uint32_t w_lo = target_buffer_get_u32(bank->target, &pg_buf[i]);
764 uint32_t w_hi = target_buffer_get_u32(bank->target, &pg_buf[i + 4]);
765 LOG_DEBUG("WLO: %08"PRIx32, w_lo);
766 LOG_DEBUG("WHI: %08"PRIx32, w_hi);
768 /* Data is loaded 2x 32 bit words at a time */
769 res = target_write_u32(bank->target, FLASH_CMD_LOAD_PAGE_1, w_lo);
773 res = target_write_u32(bank->target, FLASH_CMD_LOAD_PAGE_2, w_hi);
777 /* Check for an error */
778 res = xmc4xxx_get_flash_status(bank, &status);
782 if (status & FSR_SQER_MASK) {
783 LOG_ERROR("Error loading page buffer");
788 /* The page buffer is now full, time to commit it to flash */
790 res = xmc4xxx_write_command_sequence(bank, write_cmd_seq, ARRAY_SIZE(write_cmd_seq));
791 if (res != ERROR_OK) {
792 LOG_ERROR("Unable to enter write command sequence");
796 /* Read the flash status register */
797 res = xmc4xxx_get_flash_status(bank, &status);
801 /* Check for a sequence error */
802 if (status & FSR_SQER_MASK) {
803 LOG_ERROR("Error with flash write sequence");
807 /* Make sure a flash write was triggered */
808 if (!(status & FSR_PROG_MASK)) {
809 LOG_ERROR("Failed to write flash page");
813 /* Wait for the write operation to end */
814 res = xmc4xxx_wait_status_busy(bank, FLASH_OP_TIMEOUT);
818 /* TODO: Verify that page was written without error */
822 static int xmc4xxx_write(struct flash_bank *bank, const uint8_t *buffer,
823 uint32_t offset, uint32_t count)
825 struct xmc4xxx_flash_bank *fb = bank->driver_priv;
828 if (bank->target->state != TARGET_HALTED) {
829 LOG_ERROR("Unable to erase, target is not halted");
830 return ERROR_TARGET_NOT_HALTED;
834 res = xmc4xxx_probe(bank);
839 /* Make sure we won't run off the end of the flash bank */
840 if ((offset + count) > (bank->size)) {
841 LOG_ERROR("Attempting to write past the end of flash");
846 /* Attempt to write the passed in buffer to flash */
847 /* Pages are written 256 bytes at a time, we need to handle
848 * scenarios where padding is required at the beginning and
851 /* page working area */
852 uint8_t tmp_buf[256] = {0};
854 /* Amount of data we'll be writing to this page */
858 remaining = MIN(count, sizeof(tmp_buf));
859 end_pad = sizeof(tmp_buf) - remaining;
861 /* Make sure we're starting on a page boundary */
862 int start_pad = offset % 256;
864 LOG_INFO("Write does not start on a 256 byte boundary. "
865 "Padding by %d bytes", start_pad);
866 memset(tmp_buf, 0xff, start_pad);
867 /* Subtract the amount of start offset from
868 * the amount of data we'll need to write */
869 remaining -= start_pad;
872 /* Remove the amount we'll be writing from the total count */
875 /* Now copy in the remaining data */
876 memcpy(&tmp_buf[start_pad], buffer, remaining);
879 LOG_INFO("Padding end of page @%08"PRIx32" by %d bytes",
880 bank->base + offset, end_pad);
881 memset(&tmp_buf[256 - end_pad], 0xff, end_pad);
884 /* Now commit this page to flash, if there was start
885 * padding, we should subtract that from the target offset */
886 res = xmc4xxx_write_page(bank, tmp_buf, (offset - start_pad), false);
887 if (res != ERROR_OK) {
888 LOG_ERROR("Unable to write flash page");
889 goto abort_write_and_exit;
892 /* Advance the buffer pointer */
895 /* Advance the offset */
899 abort_write_and_exit:
900 xmc4xxx_clear_flash_status(bank);
905 static int xmc4xxx_get_info_command(struct flash_bank *bank, char *buf, int buf_size)
907 struct xmc4xxx_flash_bank *fb = bank->driver_priv;
910 if (bank->target->state != TARGET_HALTED) {
911 LOG_WARNING("Cannot communicate... target not halted.");
912 return ERROR_TARGET_NOT_HALTED;
915 /* The SCU registers contain the ID of the chip */
916 int res = target_read_u32(bank->target, SCU_REG_BASE + SCU_ID_CHIP, &scu_idcode);
917 if (res != ERROR_OK) {
918 LOG_ERROR("Cannot read device identification register.");
922 uint16_t dev_id = (scu_idcode & 0xfff0) >> 4;
923 uint16_t rev_id = scu_idcode & 0xf;
925 const char *rev_str = NULL;
965 /* XMC4500 EES AA13 with date codes before GE212
966 * had zero SCU_IDCHIP
968 dev_str = "XMC4500 EES";
997 snprintf(buf, buf_size,
998 "Cannot identify target as an XMC4xxx. SCU_ID: %"PRIx32"\n",
1003 /* String to declare protection data held in the private driver */
1004 char prot_str[512] = {0};
1005 if (fb->read_protected)
1006 snprintf(prot_str, sizeof(prot_str), "\nFlash is read protected");
1008 bool otp_enabled = false;
1009 for (int i = 0; i < bank->num_sectors; i++)
1010 if (fb->write_prot_otp[i])
1013 /* If OTP Write protection is enabled (User 2), list each
1014 * sector that has it enabled */
1017 strcat(prot_str, "\nOTP Protection is enabled for sectors:\n");
1018 for (int i = 0; i < bank->num_sectors; i++) {
1019 if (fb->write_prot_otp[i]) {
1020 snprintf(otp_str, sizeof(otp_str), "- %d\n", i);
1021 strncat(prot_str, otp_str, ARRAY_SIZE(otp_str));
1026 if (rev_str != NULL)
1027 snprintf(buf, buf_size, "%s - Rev: %s%s",
1028 dev_str, rev_str, prot_str);
1030 snprintf(buf, buf_size, "%s - Rev: unknown (0x%01x)%s",
1031 dev_str, rev_id, prot_str);
1036 static int xmc4xxx_temp_unprotect(struct flash_bank *bank, int user_level)
1038 struct xmc4xxx_flash_bank *fb;
1040 uint32_t status = 0;
1042 struct xmc4xxx_command_seq temp_unprot_seq[6] = {
1043 {FLASH_CMD_TEMP_UNPROT_1, 0xAA},
1044 {FLASH_CMD_TEMP_UNPROT_2, 0x55},
1045 {FLASH_CMD_TEMP_UNPROT_3, 0xFF}, /* Needs filled in */
1046 {FLASH_CMD_TEMP_UNPROT_4, 0xFF}, /* Needs filled in */
1047 {FLASH_CMD_TEMP_UNPROT_5, 0xFF}, /* Needs filled in */
1048 {FLASH_CMD_TEMP_UNPROT_6, 0x05}
1051 if (user_level < 0 || user_level > 2) {
1052 LOG_ERROR("Invalid user level, must be 0-2");
1056 fb = bank->driver_priv;
1058 /* Fill in the user level and passwords */
1059 temp_unprot_seq[2].magic = user_level;
1060 temp_unprot_seq[3].magic = fb->pw1;
1061 temp_unprot_seq[4].magic = fb->pw2;
1063 res = xmc4xxx_write_command_sequence(bank, temp_unprot_seq,
1064 ARRAY_SIZE(temp_unprot_seq));
1065 if (res != ERROR_OK) {
1066 LOG_ERROR("Unable to write temp unprotect sequence");
1070 res = xmc4xxx_get_flash_status(bank, &status);
1071 if (res != ERROR_OK)
1074 if (status & FSR_WPRODIS0) {
1075 LOG_INFO("Flash is temporarily unprotected");
1077 LOG_INFO("Unable to disable flash protection");
1085 static int xmc4xxx_flash_unprotect(struct flash_bank *bank, int32_t level)
1090 if ((level < 0) || (level > 1)) {
1091 LOG_ERROR("Invalid user level. Must be 0-1");
1104 res = xmc4xxx_erase_sector(bank, addr, true);
1106 if (res != ERROR_OK)
1107 LOG_ERROR("Error erasing user configuration block");
1112 /* Reference: "XMC4500 Flash Protection.pptx" app note */
1113 static int xmc4xxx_flash_protect(struct flash_bank *bank, int level, bool read_protect,
1114 int first, int last)
1116 /* User configuration block buffers */
1117 uint8_t ucp0_buf[8 * sizeof(uint32_t)] = {0};
1118 uint32_t ucb_base = 0;
1119 uint32_t procon = 0;
1121 uint32_t status = 0;
1124 struct xmc4xxx_flash_bank *fb = bank->driver_priv;
1126 /* Read protect only works for user 0, make sure we don't try
1127 * to do something silly */
1128 if (level != 0 && read_protect) {
1129 LOG_ERROR("Read protection is for user level 0 only!");
1133 /* Check to see if protection is already installed for the
1134 * specified user level. If it is, the user configuration
1135 * block will need to be erased before we can continue */
1137 /* Grab the flash status register*/
1138 res = xmc4xxx_get_flash_status(bank, &status);
1139 if (res != ERROR_OK)
1144 if ((status & FSR_RPROIN_MASK) || (status & FSR_WPROIN0_MASK))
1148 if (status & FSR_WPROIN1_MASK)
1152 if (status & FSR_WPROIN2_MASK)
1158 LOG_ERROR("Flash protection is installed for user %d"
1159 " and must be removed before continuing", level);
1163 /* If this device has 12 flash sectors, protection for
1164 * sectors 10 & 11 are handled jointly. If we are trying to
1165 * write all sectors, we should decrement
1166 * last to ensure we don't write to a register bit that
1168 if ((bank->num_sectors == 12) && (last == 12))
1171 /* We need to fill out the procon register representation
1172 * that we will be writing to the device */
1173 for (int i = first; i <= last; i++)
1176 /* If read protection is requested, set the appropriate bit
1177 * (we checked that this is allowed above) */
1179 procon |= PROCON_RPRO_MASK;
1181 LOG_DEBUG("Setting flash protection with procon:");
1182 LOG_DEBUG("PROCON: %"PRIx32, procon);
1184 /* First we need to copy in the procon register to the buffer
1185 * we're going to attempt to write. This is written twice */
1186 target_buffer_set_u32(bank->target, &ucp0_buf[0 * 4], procon);
1187 target_buffer_set_u32(bank->target, &ucp0_buf[2 * 4], procon);
1189 /* Now we must copy in both flash passwords. As with the
1190 * procon data, this must be written twice (4 total words
1192 target_buffer_set_u32(bank->target, &ucp0_buf[4 * 4], fb->pw1);
1193 target_buffer_set_u32(bank->target, &ucp0_buf[5 * 4], fb->pw2);
1194 target_buffer_set_u32(bank->target, &ucp0_buf[6 * 4], fb->pw1);
1195 target_buffer_set_u32(bank->target, &ucp0_buf[7 * 4], fb->pw2);
1197 /* Finally, (if requested) we copy in the confirmation
1198 * code so that the protection is permanent and will
1199 * require a password to undo. */
1200 target_buffer_set_u32(bank->target, &ucp0_buf[0 * 4], FLASH_PROTECT_CONFIRMATION_CODE);
1201 target_buffer_set_u32(bank->target, &ucp0_buf[2 * 4], FLASH_PROTECT_CONFIRMATION_CODE);
1203 /* Now that the data is copied into place, we must write
1204 * these pages into flash */
1206 /* The user configuration block base depends on what level of
1207 * protection we're trying to install, select the proper one */
1210 ucb_base = UCB0_BASE;
1213 ucb_base = UCB1_BASE;
1216 ucb_base = UCB2_BASE;
1220 /* Write the user config pages */
1221 res = xmc4xxx_write_page(bank, ucp0_buf, ucb_base, true);
1222 if (res != ERROR_OK) {
1223 LOG_ERROR("Error writing user configuration block 0");
1230 static int xmc4xxx_protect(struct flash_bank *bank, int set, int first, int last)
1233 struct xmc4xxx_flash_bank *fb = bank->driver_priv;
1235 /* Check for flash passwords */
1237 LOG_ERROR("Flash passwords not set, use xmc4xxx flash_password to set them");
1241 /* We want to clear flash protection temporarily*/
1243 LOG_WARNING("Flash protection will be temporarily disabled"
1244 " for all pages (User 0 only)!");
1245 ret = xmc4xxx_temp_unprotect(bank, 0);
1249 /* Install write protection for user 0 on the specified pages */
1250 ret = xmc4xxx_flash_protect(bank, 0, false, first, last);
1255 static int xmc4xxx_protect_check(struct flash_bank *bank)
1258 uint32_t protection[3] = {0};
1259 struct xmc4xxx_flash_bank *fb = bank->driver_priv;
1261 ret = target_read_u32(bank->target, FLASH_REG_FLASH0_PROCON0, &protection[0]);
1262 if (ret != ERROR_OK) {
1263 LOG_ERROR("Unable to read flash User0 protection register");
1267 ret = target_read_u32(bank->target, FLASH_REG_FLASH0_PROCON1, &protection[1]);
1268 if (ret != ERROR_OK) {
1269 LOG_ERROR("Unable to read flash User1 protection register");
1273 ret = target_read_u32(bank->target, FLASH_REG_FLASH0_PROCON2, &protection[2]);
1274 if (ret != ERROR_OK) {
1275 LOG_ERROR("Unable to read flash User2 protection register");
1279 int sectors = bank->num_sectors;
1281 /* On devices with 12 sectors, sectors 10 & 11 are ptected
1282 * together instead of individually */
1286 /* Clear the protection status */
1287 for (int i = 0; i < bank->num_sectors; i++) {
1288 bank->sectors[i].is_protected = 0;
1289 fb->write_prot_otp[i] = false;
1291 fb->read_protected = false;
1293 /* The xmc4xxx series supports 3 levels of user protection
1294 * (User0, User1 (low priority), and User 2(OTP), we need to
1296 for (unsigned int i = 0; i < ARRAY_SIZE(protection); i++) {
1298 /* Check for write protection on every available
1300 for (int j = 0; j < sectors; j++) {
1301 int set = (protection[i] & (1 << j)) ? 1 : 0;
1302 bank->sectors[j].is_protected |= set;
1304 /* Handle sector 11 */
1306 bank->sectors[j + 1].is_protected |= set;
1308 /* User 2 indicates this protection is
1309 * permanent, make note in the private driver structure */
1310 if (i == 2 && set) {
1311 fb->write_prot_otp[j] = true;
1313 /* Handle sector 11 */
1315 fb->write_prot_otp[j + 1] = true;
1321 /* XMC4xxx also supports read proptection, make a note
1322 * in the private driver structure */
1323 if (protection[0] & PROCON_RPRO_MASK)
1324 fb->read_protected = true;
1329 FLASH_BANK_COMMAND_HANDLER(xmc4xxx_flash_bank_command)
1331 bank->driver_priv = malloc(sizeof(struct xmc4xxx_flash_bank));
1333 if (!bank->driver_priv)
1334 return ERROR_FLASH_OPERATION_FAILED;
1336 (void)memset(bank->driver_priv, 0, sizeof(struct xmc4xxx_flash_bank));
1341 COMMAND_HANDLER(xmc4xxx_handle_flash_password_command)
1344 struct flash_bank *bank;
1347 return ERROR_COMMAND_SYNTAX_ERROR;
1349 res = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1350 if (res != ERROR_OK)
1353 struct xmc4xxx_flash_bank *fb = bank->driver_priv;
1357 /* We skip over the flash bank */
1358 fb->pw1 = strtol(CMD_ARGV[1], NULL, 16);
1361 return ERROR_COMMAND_SYNTAX_ERROR;
1363 fb->pw2 = strtol(CMD_ARGV[2], NULL, 16);
1366 return ERROR_COMMAND_SYNTAX_ERROR;
1370 command_print(CMD_CTX, "XMC4xxx flash passwords set to:\n");
1371 command_print(CMD_CTX, "-0x%08"PRIx32"\n", fb->pw1);
1372 command_print(CMD_CTX, "-0x%08"PRIx32"\n", fb->pw2);
1376 COMMAND_HANDLER(xmc4xxx_handle_flash_unprotect_command)
1378 struct flash_bank *bank;
1383 return ERROR_COMMAND_SYNTAX_ERROR;
1385 res = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1386 if (res != ERROR_OK)
1389 COMMAND_PARSE_NUMBER(s32, CMD_ARGV[1], level);
1391 res = xmc4xxx_flash_unprotect(bank, level);
1396 static const struct command_registration xmc4xxx_exec_command_handlers[] = {
1398 .name = "flash_password",
1399 .handler = xmc4xxx_handle_flash_password_command,
1400 .mode = COMMAND_EXEC,
1401 .usage = "bank_id password1 password2",
1402 .help = "Set the flash passwords used for protect operations. "
1403 "Passwords should be in standard hex form (0x00000000). "
1404 "(You must call this before any other protect commands) "
1405 "NOTE: The xmc4xxx's UCB area only allows for FOUR cycles. "
1406 "Please use protection carefully!",
1409 .name = "flash_unprotect",
1410 .handler = xmc4xxx_handle_flash_unprotect_command,
1411 .mode = COMMAND_EXEC,
1412 .usage = "bank_id user_level[0-1]",
1413 .help = "Permanently Removes flash protection (read and write) "
1414 "for the specified user level",
1415 }, COMMAND_REGISTRATION_DONE
1418 static const struct command_registration xmc4xxx_command_handlers[] = {
1421 .mode = COMMAND_ANY,
1422 .help = "xmc4xxx flash command group",
1424 .chain = xmc4xxx_exec_command_handlers,
1426 COMMAND_REGISTRATION_DONE
1429 struct flash_driver xmc4xxx_flash = {
1431 .commands = xmc4xxx_command_handlers,
1432 .flash_bank_command = xmc4xxx_flash_bank_command,
1433 .erase = xmc4xxx_erase,
1434 .write = xmc4xxx_write,
1435 .read = default_flash_read,
1436 .probe = xmc4xxx_probe,
1437 .auto_probe = xmc4xxx_probe,
1438 .erase_check = xmc4xxx_flash_blank_check,
1439 .info = xmc4xxx_get_info_command,
1440 .protect_check = xmc4xxx_protect_check,
1441 .protect = xmc4xxx_protect,