1 // SPDX-License-Identifier: GPL-2.0-or-later
3 /**************************************************************************
4 * Copyright (C) 2015 Jeff Ciesielski <jeffciesielski@gmail.com> *
5 ***************************************************************************/
12 #include <helper/binarybuffer.h>
13 #include <target/algorithm.h>
14 #include <target/armv7m.h>
16 /* Maximum number of sectors */
17 #define MAX_XMC_SECTORS 12
19 /* System control unit registers */
20 #define SCU_REG_BASE 0x50004000
22 #define SCU_ID_CHIP 0x04
24 /* Base of the non-cached flash memory */
25 #define PFLASH_BASE 0x0C000000
27 /* User configuration block offsets */
28 #define UCB0_BASE 0x00000000
29 #define UCB1_BASE 0x00000400
30 #define UCB2_BASE 0x00000800
32 /* Flash register base */
33 #define FLASH_REG_BASE 0x58000000
35 /* PMU ID Registers */
36 #define FLASH_REG_PMU_ID (FLASH_REG_BASE | 0x0508)
39 #define PMU_MOD_REV_MASK 0xFF
40 #define PMU_MOD_TYPE_MASK 0xFF00
41 #define PMU_MOD_NO_MASK 0xFFFF0000
44 #define FLASH_REG_PREF_PCON (FLASH_REG_BASE | 0x4000)
47 #define PCON_IBYP (1 << 0)
48 #define PCON_IINV (1 << 1)
50 /* Flash ID Register */
51 #define FLASH_REG_FLASH0_ID (FLASH_REG_BASE | 0x2008)
53 /* Flash Status Register */
54 #define FLASH_REG_FLASH0_FSR (FLASH_REG_BASE | 0x2010)
57 #define FSR_FABUSY (1)
60 #define FSR_PFPAGE (6)
61 #define FSR_PFOPER (8)
63 #define FSR_PROER (11)
64 #define FSR_PFSBER (12)
65 #define FSR_PFDBER (14)
66 #define FSR_PROIN (16)
67 #define FSR_RPROIN (18)
68 #define FSR_RPRODIS (19)
69 #define FSR_WPROIN0 (21)
70 #define FSR_WPROIN1 (22)
71 #define FSR_WPROIN2 (23)
72 #define FSR_WPRODIS0 (25)
73 #define FSR_WPRODIS1 (26)
77 #define FSR_PBUSY_MASK (0x01 << FSR_PBUSY)
78 #define FSR_FABUSY_MASK (0x01 << FSR_FABUSY)
79 #define FSR_PROG_MASK (0x01 << FSR_PROG)
80 #define FSR_ERASE_MASK (0x01 << FSR_ERASE)
81 #define FSR_PFPAGE_MASK (0x01 << FSR_PFPAGE)
82 #define FSR_PFOPER_MASK (0x01 << FSR_PFOPER)
83 #define FSR_SQER_MASK (0x01 << FSR_SQER)
84 #define FSR_PROER_MASK (0x01 << FSR_PROER)
85 #define FSR_PFSBER_MASK (0x01 << FSR_PFSBER)
86 #define FSR_PFDBER_MASK (0x01 << FSR_PFDBER)
87 #define FSR_PROIN_MASK (0x01 << FSR_PROIN)
88 #define FSR_RPROIN_MASK (0x01 << FSR_RPROIN)
89 #define FSR_RPRODIS_MASK (0x01 << FSR_RPRODIS)
90 #define FSR_WPROIN0_MASK (0x01 << FSR_WPROIN0)
91 #define FSR_WPROIN1_MASK (0x01 << FSR_WPROIN1)
92 #define FSR_WPROIN2_MASK (0x01 << FSR_WPROIN2)
93 #define FSR_WPRODIS0_MASK (0x01 << FSR_WPRODIS0)
94 #define FSR_WPRODIS1_MASK (0x01 << FSR_WPRODIS1)
95 #define FSR_SLM_MASK (0x01 << FSR_SLM)
96 #define FSR_VER_MASK (0x01 << FSR_VER)
98 /* Flash Config Register */
99 #define FLASH_REG_FLASH0_FCON (FLASH_REG_BASE | 0x2014)
101 #define FCON_WSPFLASH (0)
102 #define FCON_WSECPF (4)
103 #define FCON_IDLE (13)
104 #define FCON_ESLDIS (14)
105 #define FCON_SLEEP (15)
106 #define FCON_RPA (16)
107 #define FCON_DCF (17)
108 #define FCON_DDF (18)
109 #define FCON_VOPERM (24)
110 #define FCON_SQERM (25)
111 #define FCON_PROERM (26)
112 #define FCON_PFSBERM (27)
113 #define FCON_PFDBERM (29)
114 #define FCON_EOBM (31)
116 #define FCON_WSPFLASH_MASK (0x0f << FCON_WSPFLASH)
117 #define FCON_WSECPF_MASK (0x01 << FCON_WSECPF)
118 #define FCON_IDLE_MASK (0x01 << FCON_IDLE)
119 #define FCON_ESLDIS_MASK (0x01 << FCON_ESLDIS)
120 #define FCON_SLEEP_MASK (0x01 << FCON_SLEEP)
121 #define FCON_RPA_MASK (0x01 << FCON_RPA)
122 #define FCON_DCF_MASK (0x01 << FCON_DCF)
123 #define FCON_DDF_MASK (0x01 << FCON_DDF)
124 #define FCON_VOPERM_MASK (0x01 << FCON_VOPERM)
125 #define FCON_SQERM_MASK (0x01 << FCON_SQERM)
126 #define FCON_PROERM_MASK (0x01 << FCON_PROERM)
127 #define FCON_PFSBERM_MASK (0x01 << FCON_PFSBERM)
128 #define FCON_PFDBERM_MASK (0x01 << FCON_PFDBERM)
129 #define FCON_EOBM_MASK (0x01 << FCON_EOBM)
131 /* Flash Margin Control Register */
132 #define FLASH_REG_FLASH0_MARP (FLASH_REG_BASE | 0x2018)
134 #define MARP_MARGIN (0)
135 #define MARP_TRAPDIS (15)
137 #define MARP_MARGIN_MASK (0x0f << MARP_MARGIN)
138 #define MARP_TRAPDIS_MASK (0x01 << MARP_TRAPDIS)
140 /* Flash Protection Registers */
141 #define FLASH_REG_FLASH0_PROCON0 (FLASH_REG_BASE | 0x2020)
142 #define FLASH_REG_FLASH0_PROCON1 (FLASH_REG_BASE | 0x2024)
143 #define FLASH_REG_FLASH0_PROCON2 (FLASH_REG_BASE | 0x2028)
145 #define PROCON_S0L (0)
146 #define PROCON_S1L (1)
147 #define PROCON_S2L (2)
148 #define PROCON_S3L (3)
149 #define PROCON_S4L (4)
150 #define PROCON_S5L (5)
151 #define PROCON_S6L (6)
152 #define PROCON_S7L (7)
153 #define PROCON_S8L (8)
154 #define PROCON_S9L (9)
155 #define PROCON_S10_S11L (10)
156 #define PROCON_RPRO (15)
158 #define PROCON_S0L_MASK (0x01 << PROCON_S0L)
159 #define PROCON_S1L_MASK (0x01 << PROCON_S1L)
160 #define PROCON_S2L_MASK (0x01 << PROCON_S2L)
161 #define PROCON_S3L_MASK (0x01 << PROCON_S3L)
162 #define PROCON_S4L_MASK (0x01 << PROCON_S4L)
163 #define PROCON_S5L_MASK (0x01 << PROCON_S5L)
164 #define PROCON_S6L_MASK (0x01 << PROCON_S6L)
165 #define PROCON_S7L_MASK (0x01 << PROCON_S7L)
166 #define PROCON_S8L_MASK (0x01 << PROCON_S8L)
167 #define PROCON_S9L_MASK (0x01 << PROCON_S9L)
168 #define PROCON_S10_S11L_MASK (0x01 << PROCON_S10_S11L)
169 #define PROCON_RPRO_MASK (0x01 << PROCON_RPRO)
171 #define FLASH_PROTECT_CONFIRMATION_CODE 0x8AFE15C3
173 /* Flash controller configuration values */
174 #define FLASH_ID_XMC4500 0xA2
175 #define FLASH_ID_XMC4300_XMC4700_4800 0x92
176 #define FLASH_ID_XMC4100_4200 0x9C
177 #define FLASH_ID_XMC4400 0x9F
180 #define FLASH_OP_TIMEOUT 5000
182 /* Flash commands (write/erase/protect) are performed using special
183 * command sequences that are written to magic addresses in the flash controller */
184 /* Command sequence addresses. See reference manual, section 8: Flash Command Sequences */
185 #define FLASH_CMD_ERASE_1 0x0C005554
186 #define FLASH_CMD_ERASE_2 0x0C00AAA8
187 #define FLASH_CMD_ERASE_3 FLASH_CMD_ERASE_1
188 #define FLASH_CMD_ERASE_4 FLASH_CMD_ERASE_1
189 #define FLASH_CMD_ERASE_5 FLASH_CMD_ERASE_2
190 /* ERASE_6 is the sector base address */
192 #define FLASH_CMD_CLEAR_STATUS FLASH_CMD_ERASE_1
194 #define FLASH_CMD_ENTER_PAGEMODE FLASH_CMD_ERASE_1
196 #define FLASH_CMD_LOAD_PAGE_1 0x0C0055F0
197 #define FLASH_CMD_LOAD_PAGE_2 0x0C0055F4
199 #define FLASH_CMD_WRITE_PAGE_1 FLASH_CMD_ERASE_1
200 #define FLASH_CMD_WRITE_PAGE_2 FLASH_CMD_ERASE_2
201 #define FLASH_CMD_WRITE_PAGE_3 FLASH_CMD_ERASE_1
202 /* WRITE_PAGE_4 is the page base address */
204 #define FLASH_CMD_TEMP_UNPROT_1 FLASH_CMD_ERASE_1
205 #define FLASH_CMD_TEMP_UNPROT_2 FLASH_CMD_ERASE_2
206 #define FLASH_CMD_TEMP_UNPROT_3 0x0C00553C
207 #define FLASH_CMD_TEMP_UNPROT_4 FLASH_CMD_ERASE_2
208 #define FLASH_CMD_TEMP_UNPROT_5 FLASH_CMD_ERASE_2
209 #define FLASH_CMD_TEMP_UNPROT_6 0x0C005558
211 struct xmc4xxx_flash_bank
{
214 /* We need the flash controller ID to choose the sector layout */
217 /* Passwords used for protection operations */
222 /* Protection flags */
225 bool write_prot_otp
[MAX_XMC_SECTORS
];
228 struct xmc4xxx_command_seq
{
233 /* Sector capacities. See section 8 of xmc4x00_rm */
234 static const unsigned int sector_capacity_8
[8] = {
235 16, 16, 16, 16, 16, 16, 16, 128
238 static const unsigned int sector_capacity_9
[9] = {
239 16, 16, 16, 16, 16, 16, 16, 128, 256
242 static const unsigned int sector_capacity_12
[12] = {
243 16, 16, 16, 16, 16, 16, 16, 16, 128, 256, 256, 256
246 static const unsigned int sector_capacity_16
[16] = {
247 16, 16, 16, 16, 16, 16, 16, 16, 128, 256, 256, 256, 256, 256, 256, 256
250 static int xmc4xxx_write_command_sequence(struct flash_bank
*bank
,
251 struct xmc4xxx_command_seq
*seq
,
256 for (int i
= 0; i
< seq_len
; i
++) {
257 res
= target_write_u32(bank
->target
, seq
[i
].address
,
266 static int xmc4xxx_load_bank_layout(struct flash_bank
*bank
)
268 const unsigned int *capacity
= NULL
;
270 /* At this point, we know which flash controller ID we're
271 * talking to and simply need to fill out the bank structure accordingly */
272 LOG_DEBUG("%u sectors", bank
->num_sectors
);
274 switch (bank
->num_sectors
) {
276 capacity
= sector_capacity_8
;
279 capacity
= sector_capacity_9
;
282 capacity
= sector_capacity_12
;
285 capacity
= sector_capacity_16
;
288 LOG_ERROR("Unexpected number of sectors, %u\n",
293 /* This looks like a bank that we understand, now we know the
294 * corresponding sector capacities and we can add those up into the
296 uint32_t total_offset
= 0;
297 bank
->sectors
= calloc(bank
->num_sectors
,
298 sizeof(struct flash_sector
));
299 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++) {
300 bank
->sectors
[i
].size
= capacity
[i
] * 1024;
301 bank
->sectors
[i
].offset
= total_offset
;
302 bank
->sectors
[i
].is_erased
= -1;
303 bank
->sectors
[i
].is_protected
= -1;
305 bank
->size
+= bank
->sectors
[i
].size
;
306 LOG_DEBUG("\t%d: %uk", i
, capacity
[i
]);
307 total_offset
+= bank
->sectors
[i
].size
;
310 /* This part doesn't follow the typical standard of 0xff
311 * being the erased value.*/
312 bank
->default_padded_value
= bank
->erased_value
= 0x00;
317 static int xmc4xxx_probe(struct flash_bank
*bank
)
320 uint32_t devid
, config
;
321 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
327 /* It's not possible for the DAP to access the OTP locations needed for
328 * probing the part info and Flash geometry so we require that the target
329 * be halted before proceeding. */
330 if (bank
->target
->state
!= TARGET_HALTED
) {
331 LOG_WARNING("Cannot communicate... target not halted.");
332 return ERROR_TARGET_NOT_HALTED
;
335 /* The SCU registers contain the ID of the chip */
336 res
= target_read_u32(bank
->target
, SCU_REG_BASE
+ SCU_ID_CHIP
, &devid
);
337 if (res
!= ERROR_OK
) {
338 LOG_ERROR("Cannot read device identification register.");
342 /* Make sure this is a XMC4000 family device */
343 if ((devid
& 0xF0000) != 0x40000 && devid
!= 0) {
344 LOG_ERROR("Platform ID doesn't match XMC4xxx: 0x%08" PRIx32
, devid
);
348 LOG_DEBUG("Found XMC4xxx with devid: 0x%08" PRIx32
, devid
);
350 /* Now sanity-check the Flash controller itself. */
351 res
= target_read_u32(bank
->target
, FLASH_REG_FLASH0_ID
,
353 if (res
!= ERROR_OK
) {
354 LOG_ERROR("Cannot read Flash bank configuration.");
357 flash_id
= (config
& 0xff0000) >> 16;
359 /* The Flash configuration register is our only means of
360 * determining the sector layout. We need to make sure that
361 * we understand the type of controller we're dealing with */
363 case FLASH_ID_XMC4100_4200
:
364 bank
->num_sectors
= 8;
365 LOG_DEBUG("XMC4xxx: XMC4100/4200 detected.");
367 case FLASH_ID_XMC4400
:
368 bank
->num_sectors
= 9;
369 LOG_DEBUG("XMC4xxx: XMC4400 detected.");
371 case FLASH_ID_XMC4500
:
372 bank
->num_sectors
= 12;
373 LOG_DEBUG("XMC4xxx: XMC4500 detected.");
375 case FLASH_ID_XMC4300_XMC4700_4800
:
376 bank
->num_sectors
= 16;
377 LOG_DEBUG("XMC4xxx: XMC4700/4800 detected.");
380 LOG_ERROR("XMC4xxx: Unexpected flash ID. got %02" PRIx8
,
385 /* Retrieve information about the particular bank we're probing and fill in
386 * the bank structure accordingly. */
387 res
= xmc4xxx_load_bank_layout(bank
);
388 if (res
== ERROR_OK
) {
392 LOG_ERROR("Unable to load bank information.");
399 static int xmc4xxx_get_sector_start_addr(struct flash_bank
*bank
,
400 unsigned int sector
, uint32_t *ret_addr
)
402 /* Make sure we understand this sector */
403 if (sector
> bank
->num_sectors
)
406 *ret_addr
= bank
->base
+ bank
->sectors
[sector
].offset
;
412 static int xmc4xxx_clear_flash_status(struct flash_bank
*bank
)
415 /* TODO: Do we need to check for sequence error? */
416 LOG_INFO("Clearing flash status");
417 res
= target_write_u32(bank
->target
, FLASH_CMD_CLEAR_STATUS
,
419 if (res
!= ERROR_OK
) {
420 LOG_ERROR("Unable to write erase command sequence");
427 static int xmc4xxx_get_flash_status(struct flash_bank
*bank
, uint32_t *status
)
431 res
= target_read_u32(bank
->target
, FLASH_REG_FLASH0_FSR
, status
);
434 LOG_ERROR("Cannot read flash status register.");
439 static int xmc4xxx_wait_status_busy(struct flash_bank
*bank
, int timeout
)
444 res
= xmc4xxx_get_flash_status(bank
, &status
);
448 /* While the flash controller is busy, wait */
449 while (status
& FSR_PBUSY_MASK
) {
450 res
= xmc4xxx_get_flash_status(bank
, &status
);
454 if (timeout
-- <= 0) {
455 LOG_ERROR("Timed out waiting for flash");
462 if (status
& FSR_PROER_MASK
) {
463 LOG_ERROR("XMC4xxx flash protected");
470 static int xmc4xxx_erase_sector(struct flash_bank
*bank
, uint32_t address
,
476 /* See reference manual table 8.4: Command Sequences for Flash Control */
477 struct xmc4xxx_command_seq erase_cmd_seq
[6] = {
478 {FLASH_CMD_ERASE_1
, 0xAA},
479 {FLASH_CMD_ERASE_2
, 0x55},
480 {FLASH_CMD_ERASE_3
, 0x80},
481 {FLASH_CMD_ERASE_4
, 0xAA},
482 {FLASH_CMD_ERASE_5
, 0x55},
483 {0xFF, 0xFF} /* Needs filled in */
486 /* We need to fill in the base address of the sector we'll be
487 * erasing, as well as the magic code that determines whether
488 * this is a standard flash sector or a user configuration block */
490 erase_cmd_seq
[5].address
= address
;
492 /* Removing flash protection requires the addition of
493 * the base address */
494 erase_cmd_seq
[5].address
+= bank
->base
;
495 erase_cmd_seq
[5].magic
= 0xC0;
497 erase_cmd_seq
[5].magic
= 0x30;
500 res
= xmc4xxx_write_command_sequence(bank
, erase_cmd_seq
,
501 ARRAY_SIZE(erase_cmd_seq
));
505 /* Read the flash status register */
506 res
= target_read_u32(bank
->target
, FLASH_REG_FLASH0_FSR
, &status
);
507 if (res
!= ERROR_OK
) {
508 LOG_ERROR("Cannot read flash status register.");
512 /* Check for a sequence error */
513 if (status
& FSR_SQER_MASK
) {
514 LOG_ERROR("Error with flash erase sequence");
518 /* Make sure a flash erase was triggered */
519 if (!(status
& FSR_ERASE_MASK
)) {
520 LOG_ERROR("Flash failed to erase");
524 /* Now we must wait for the erase operation to end */
525 res
= xmc4xxx_wait_status_busy(bank
, FLASH_OP_TIMEOUT
);
530 static int xmc4xxx_erase(struct flash_bank
*bank
, unsigned int first
,
533 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
536 if (bank
->target
->state
!= TARGET_HALTED
) {
537 LOG_ERROR("Unable to erase, target is not halted");
538 return ERROR_TARGET_NOT_HALTED
;
542 res
= xmc4xxx_probe(bank
);
548 /* Loop through the sectors and erase each one */
549 for (unsigned int i
= first
; i
<= last
; i
++) {
550 res
= xmc4xxx_get_sector_start_addr(bank
, i
, &tmp_addr
);
551 if (res
!= ERROR_OK
) {
552 LOG_ERROR("Invalid sector %u", i
);
556 LOG_DEBUG("Erasing sector %u @ 0x%08"PRIx32
, i
, tmp_addr
);
558 res
= xmc4xxx_erase_sector(bank
, tmp_addr
, false);
559 if (res
!= ERROR_OK
) {
560 LOG_ERROR("Unable to write erase command sequence");
561 goto clear_status_and_exit
;
564 /* Now we must wait for the erase operation to end */
565 res
= xmc4xxx_wait_status_busy(bank
, FLASH_OP_TIMEOUT
);
568 goto clear_status_and_exit
;
571 clear_status_and_exit
:
572 res
= xmc4xxx_clear_flash_status(bank
);
577 static int xmc4xxx_enter_page_mode(struct flash_bank
*bank
)
582 res
= target_write_u32(bank
->target
, FLASH_CMD_ENTER_PAGEMODE
, 0x50);
583 if (res
!= ERROR_OK
) {
584 LOG_ERROR("Unable to write enter page mode command");
588 res
= xmc4xxx_get_flash_status(bank
, &status
);
593 /* Make sure we're in page mode */
594 if (!(status
& FSR_PFPAGE_MASK
)) {
595 LOG_ERROR("Unable to enter page mode");
599 /* Make sure we didn't encounter a sequence error */
600 if (status
& FSR_SQER_MASK
) {
601 LOG_ERROR("Sequence error while entering page mode");
608 static int xmc4xxx_write_page(struct flash_bank
*bank
, const uint8_t *pg_buf
,
609 uint32_t offset
, bool user_config
)
614 /* Base of the flash write command */
615 struct xmc4xxx_command_seq write_cmd_seq
[4] = {
616 {FLASH_CMD_WRITE_PAGE_1
, 0xAA},
617 {FLASH_CMD_WRITE_PAGE_2
, 0x55},
618 {FLASH_CMD_WRITE_PAGE_3
, 0xFF}, /* Needs filled in */
619 {0xFF, 0xFF} /* Needs filled in */
622 /* The command sequence differs depending on whether this is
623 * being written to standard flash or the user configuration
626 write_cmd_seq
[2].magic
= 0xC0;
628 write_cmd_seq
[2].magic
= 0xA0;
630 /* Finally, we need to add the address that this page will be
632 write_cmd_seq
[3].address
= bank
->base
+ offset
;
633 write_cmd_seq
[3].magic
= 0xAA;
636 /* Flash pages are written 256 bytes at a time. For each 256
637 * byte chunk, we need to:
638 * 1. Enter page mode. This activates the flash write buffer
639 * 2. Load the page buffer with data (2x 32 bit words at a time)
640 * 3. Burn the page buffer into its intended location
641 * If the starting offset is not on a 256 byte boundary, we
642 * will need to pad the beginning of the write buffer
643 * accordingly. Likewise, if the last page does not fill the
644 * buffer, we should pad it to avoid leftover data from being
647 res
= xmc4xxx_enter_page_mode(bank
);
651 /* Copy the data into the page buffer*/
652 for (int i
= 0; i
< 256; i
+= 8) {
653 uint32_t w_lo
= target_buffer_get_u32(bank
->target
, &pg_buf
[i
]);
654 uint32_t w_hi
= target_buffer_get_u32(bank
->target
, &pg_buf
[i
+ 4]);
655 LOG_DEBUG("WLO: %08"PRIx32
, w_lo
);
656 LOG_DEBUG("WHI: %08"PRIx32
, w_hi
);
658 /* Data is loaded 2x 32 bit words at a time */
659 res
= target_write_u32(bank
->target
, FLASH_CMD_LOAD_PAGE_1
, w_lo
);
663 res
= target_write_u32(bank
->target
, FLASH_CMD_LOAD_PAGE_2
, w_hi
);
667 /* Check for an error */
668 res
= xmc4xxx_get_flash_status(bank
, &status
);
672 if (status
& FSR_SQER_MASK
) {
673 LOG_ERROR("Error loading page buffer");
678 /* The page buffer is now full, time to commit it to flash */
680 res
= xmc4xxx_write_command_sequence(bank
, write_cmd_seq
, ARRAY_SIZE(write_cmd_seq
));
681 if (res
!= ERROR_OK
) {
682 LOG_ERROR("Unable to enter write command sequence");
686 /* Read the flash status register */
687 res
= xmc4xxx_get_flash_status(bank
, &status
);
691 /* Check for a sequence error */
692 if (status
& FSR_SQER_MASK
) {
693 LOG_ERROR("Error with flash write sequence");
697 /* Make sure a flash write was triggered */
698 if (!(status
& FSR_PROG_MASK
)) {
699 LOG_ERROR("Failed to write flash page");
703 /* Wait for the write operation to end */
704 res
= xmc4xxx_wait_status_busy(bank
, FLASH_OP_TIMEOUT
);
708 /* TODO: Verify that page was written without error */
712 static int xmc4xxx_write(struct flash_bank
*bank
, const uint8_t *buffer
,
713 uint32_t offset
, uint32_t count
)
715 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
718 if (bank
->target
->state
!= TARGET_HALTED
) {
719 LOG_ERROR("Unable to erase, target is not halted");
720 return ERROR_TARGET_NOT_HALTED
;
724 res
= xmc4xxx_probe(bank
);
729 /* Make sure we won't run off the end of the flash bank */
730 if ((offset
+ count
) > (bank
->size
)) {
731 LOG_ERROR("Attempting to write past the end of flash");
736 /* Attempt to write the passed in buffer to flash */
737 /* Pages are written 256 bytes at a time, we need to handle
738 * scenarios where padding is required at the beginning and
741 /* page working area */
742 uint8_t tmp_buf
[256] = {0};
744 /* Amount of data we'll be writing to this page */
748 remaining
= MIN(count
, sizeof(tmp_buf
));
749 end_pad
= sizeof(tmp_buf
) - remaining
;
751 /* Make sure we're starting on a page boundary */
752 int start_pad
= offset
% 256;
754 LOG_INFO("Write does not start on a 256 byte boundary. "
755 "Padding by %d bytes", start_pad
);
756 memset(tmp_buf
, 0xff, start_pad
);
757 /* Subtract the amount of start offset from
758 * the amount of data we'll need to write */
759 remaining
-= start_pad
;
762 /* Remove the amount we'll be writing from the total count */
765 /* Now copy in the remaining data */
766 memcpy(&tmp_buf
[start_pad
], buffer
, remaining
);
769 LOG_INFO("Padding end of page @" TARGET_ADDR_FMT
" by %d bytes",
770 bank
->base
+ offset
, end_pad
);
771 memset(&tmp_buf
[256 - end_pad
], 0xff, end_pad
);
774 /* Now commit this page to flash, if there was start
775 * padding, we should subtract that from the target offset */
776 res
= xmc4xxx_write_page(bank
, tmp_buf
, (offset
- start_pad
), false);
777 if (res
!= ERROR_OK
) {
778 LOG_ERROR("Unable to write flash page");
779 goto abort_write_and_exit
;
782 /* Advance the buffer pointer */
785 /* Advance the offset */
789 abort_write_and_exit
:
790 xmc4xxx_clear_flash_status(bank
);
795 static int xmc4xxx_get_info_command(struct flash_bank
*bank
, struct command_invocation
*cmd
)
797 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
800 if (bank
->target
->state
!= TARGET_HALTED
) {
801 LOG_WARNING("Cannot communicate... target not halted.");
802 return ERROR_TARGET_NOT_HALTED
;
805 /* The SCU registers contain the ID of the chip */
806 int res
= target_read_u32(bank
->target
, SCU_REG_BASE
+ SCU_ID_CHIP
, &scu_idcode
);
807 if (res
!= ERROR_OK
) {
808 LOG_ERROR("Cannot read device identification register.");
812 uint16_t dev_id
= (scu_idcode
& 0xfff0) >> 4;
813 uint16_t rev_id
= scu_idcode
& 0xf;
815 const char *rev_str
= NULL
;
863 /* XMC4500 EES AA13 with date codes before GE212
864 * had zero SCU_IDCHIP
866 dev_str
= "XMC4500 EES";
904 command_print_sameline(cmd
, "Cannot identify target as an XMC4xxx. SCU_ID: %"PRIx32
"\n", scu_idcode
);
908 /* String to declare protection data held in the private driver */
909 char prot_str
[512] = {0};
910 if (fb
->read_protected
)
911 snprintf(prot_str
, sizeof(prot_str
), "\nFlash is read protected");
913 bool otp_enabled
= false;
914 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++)
915 if (fb
->write_prot_otp
[i
])
918 /* If OTP Write protection is enabled (User 2), list each
919 * sector that has it enabled */
922 strcat(prot_str
, "\nOTP Protection is enabled for sectors:\n");
923 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++) {
924 if (fb
->write_prot_otp
[i
]) {
925 snprintf(otp_str
, sizeof(otp_str
), "- %d\n", i
);
926 strncat(prot_str
, otp_str
, sizeof(prot_str
) - strlen(prot_str
) - 1);
932 command_print_sameline(cmd
, "%s - Rev: %s%s", dev_str
, rev_str
, prot_str
);
934 command_print_sameline(cmd
, "%s - Rev: unknown (0x%01x)%s", dev_str
, rev_id
, prot_str
);
939 static int xmc4xxx_temp_unprotect(struct flash_bank
*bank
, int user_level
)
941 struct xmc4xxx_flash_bank
*fb
;
945 struct xmc4xxx_command_seq temp_unprot_seq
[6] = {
946 {FLASH_CMD_TEMP_UNPROT_1
, 0xAA},
947 {FLASH_CMD_TEMP_UNPROT_2
, 0x55},
948 {FLASH_CMD_TEMP_UNPROT_3
, 0xFF}, /* Needs filled in */
949 {FLASH_CMD_TEMP_UNPROT_4
, 0xFF}, /* Needs filled in */
950 {FLASH_CMD_TEMP_UNPROT_5
, 0xFF}, /* Needs filled in */
951 {FLASH_CMD_TEMP_UNPROT_6
, 0x05}
954 if (user_level
< 0 || user_level
> 2) {
955 LOG_ERROR("Invalid user level, must be 0-2");
959 fb
= bank
->driver_priv
;
961 /* Fill in the user level and passwords */
962 temp_unprot_seq
[2].magic
= user_level
;
963 temp_unprot_seq
[3].magic
= fb
->pw1
;
964 temp_unprot_seq
[4].magic
= fb
->pw2
;
966 res
= xmc4xxx_write_command_sequence(bank
, temp_unprot_seq
,
967 ARRAY_SIZE(temp_unprot_seq
));
968 if (res
!= ERROR_OK
) {
969 LOG_ERROR("Unable to write temp unprotect sequence");
973 res
= xmc4xxx_get_flash_status(bank
, &status
);
977 if (status
& FSR_WPRODIS0
) {
978 LOG_INFO("Flash is temporarily unprotected");
980 LOG_INFO("Unable to disable flash protection");
988 static int xmc4xxx_flash_unprotect(struct flash_bank
*bank
, int32_t level
)
1001 LOG_ERROR("Invalid user level. Must be 0-1");
1005 res
= xmc4xxx_erase_sector(bank
, addr
, true);
1007 if (res
!= ERROR_OK
)
1008 LOG_ERROR("Error erasing user configuration block");
1013 /* Reference: "XMC4500 Flash Protection.pptx" app note */
1014 static int xmc4xxx_flash_protect(struct flash_bank
*bank
, int level
, bool read_protect
,
1015 unsigned int first
, unsigned int last
)
1017 /* User configuration block buffers */
1018 uint8_t ucp0_buf
[8 * sizeof(uint32_t)] = {0};
1019 uint32_t ucb_base
= 0;
1020 uint32_t procon
= 0;
1022 uint32_t status
= 0;
1025 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
1027 /* Read protect only works for user 0, make sure we don't try
1028 * to do something silly */
1029 if (level
!= 0 && read_protect
) {
1030 LOG_ERROR("Read protection is for user level 0 only!");
1034 /* Check to see if protection is already installed for the
1035 * specified user level. If it is, the user configuration
1036 * block will need to be erased before we can continue */
1038 /* Grab the flash status register*/
1039 res
= xmc4xxx_get_flash_status(bank
, &status
);
1040 if (res
!= ERROR_OK
)
1045 if ((status
& FSR_RPROIN_MASK
) || (status
& FSR_WPROIN0_MASK
))
1049 if (status
& FSR_WPROIN1_MASK
)
1053 if (status
& FSR_WPROIN2_MASK
)
1059 LOG_ERROR("Flash protection is installed for user %d"
1060 " and must be removed before continuing", level
);
1064 /* If this device has 12 flash sectors, protection for
1065 * sectors 10 & 11 are handled jointly. If we are trying to
1066 * write all sectors, we should decrement
1067 * last to ensure we don't write to a register bit that
1069 if ((bank
->num_sectors
== 12) && (last
== 12))
1072 /* We need to fill out the procon register representation
1073 * that we will be writing to the device */
1074 for (unsigned int i
= first
; i
<= last
; i
++)
1077 /* If read protection is requested, set the appropriate bit
1078 * (we checked that this is allowed above) */
1080 procon
|= PROCON_RPRO_MASK
;
1082 LOG_DEBUG("Setting flash protection with procon:");
1083 LOG_DEBUG("PROCON: %"PRIx32
, procon
);
1085 /* First we need to copy in the procon register to the buffer
1086 * we're going to attempt to write. This is written twice */
1087 target_buffer_set_u32(bank
->target
, &ucp0_buf
[0 * 4], procon
);
1088 target_buffer_set_u32(bank
->target
, &ucp0_buf
[2 * 4], procon
);
1090 /* Now we must copy in both flash passwords. As with the
1091 * procon data, this must be written twice (4 total words
1093 target_buffer_set_u32(bank
->target
, &ucp0_buf
[4 * 4], fb
->pw1
);
1094 target_buffer_set_u32(bank
->target
, &ucp0_buf
[5 * 4], fb
->pw2
);
1095 target_buffer_set_u32(bank
->target
, &ucp0_buf
[6 * 4], fb
->pw1
);
1096 target_buffer_set_u32(bank
->target
, &ucp0_buf
[7 * 4], fb
->pw2
);
1098 /* Finally, (if requested) we copy in the confirmation
1099 * code so that the protection is permanent and will
1100 * require a password to undo. */
1101 target_buffer_set_u32(bank
->target
, &ucp0_buf
[0 * 4], FLASH_PROTECT_CONFIRMATION_CODE
);
1102 target_buffer_set_u32(bank
->target
, &ucp0_buf
[2 * 4], FLASH_PROTECT_CONFIRMATION_CODE
);
1104 /* Now that the data is copied into place, we must write
1105 * these pages into flash */
1107 /* The user configuration block base depends on what level of
1108 * protection we're trying to install, select the proper one */
1111 ucb_base
= UCB0_BASE
;
1114 ucb_base
= UCB1_BASE
;
1117 ucb_base
= UCB2_BASE
;
1121 /* Write the user config pages */
1122 res
= xmc4xxx_write_page(bank
, ucp0_buf
, ucb_base
, true);
1123 if (res
!= ERROR_OK
) {
1124 LOG_ERROR("Error writing user configuration block 0");
1131 static int xmc4xxx_protect(struct flash_bank
*bank
, int set
, unsigned int first
,
1135 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
1137 /* Check for flash passwords */
1139 LOG_ERROR("Flash passwords not set, use xmc4xxx flash_password to set them");
1143 /* We want to clear flash protection temporarily*/
1145 LOG_WARNING("Flash protection will be temporarily disabled"
1146 " for all pages (User 0 only)!");
1147 ret
= xmc4xxx_temp_unprotect(bank
, 0);
1151 /* Install write protection for user 0 on the specified pages */
1152 ret
= xmc4xxx_flash_protect(bank
, 0, false, first
, last
);
1157 static int xmc4xxx_protect_check(struct flash_bank
*bank
)
1160 uint32_t protection
[3] = {0};
1161 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
1163 ret
= target_read_u32(bank
->target
, FLASH_REG_FLASH0_PROCON0
, &protection
[0]);
1164 if (ret
!= ERROR_OK
) {
1165 LOG_ERROR("Unable to read flash User0 protection register");
1169 ret
= target_read_u32(bank
->target
, FLASH_REG_FLASH0_PROCON1
, &protection
[1]);
1170 if (ret
!= ERROR_OK
) {
1171 LOG_ERROR("Unable to read flash User1 protection register");
1175 ret
= target_read_u32(bank
->target
, FLASH_REG_FLASH0_PROCON2
, &protection
[2]);
1176 if (ret
!= ERROR_OK
) {
1177 LOG_ERROR("Unable to read flash User2 protection register");
1181 unsigned int sectors
= bank
->num_sectors
;
1183 /* On devices with 12 sectors, sectors 10 & 11 are protected
1184 * together instead of individually */
1188 /* Clear the protection status */
1189 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++) {
1190 bank
->sectors
[i
].is_protected
= 0;
1191 fb
->write_prot_otp
[i
] = false;
1193 fb
->read_protected
= false;
1195 /* The xmc4xxx series supports 3 levels of user protection
1196 * (User0, User1 (low priority), and User 2(OTP), we need to
1198 for (unsigned int i
= 0; i
< ARRAY_SIZE(protection
); i
++) {
1200 /* Check for write protection on every available
1202 for (unsigned int j
= 0; j
< sectors
; j
++) {
1203 int set
= (protection
[i
] & (1 << j
)) ? 1 : 0;
1204 bank
->sectors
[j
].is_protected
|= set
;
1206 /* Handle sector 11 */
1208 bank
->sectors
[j
+ 1].is_protected
|= set
;
1210 /* User 2 indicates this protection is
1211 * permanent, make note in the private driver structure */
1212 if (i
== 2 && set
) {
1213 fb
->write_prot_otp
[j
] = true;
1215 /* Handle sector 11 */
1217 fb
->write_prot_otp
[j
+ 1] = true;
1223 /* XMC4xxx also supports read protection, make a note
1224 * in the private driver structure */
1225 if (protection
[0] & PROCON_RPRO_MASK
)
1226 fb
->read_protected
= true;
1231 FLASH_BANK_COMMAND_HANDLER(xmc4xxx_flash_bank_command
)
1233 bank
->driver_priv
= malloc(sizeof(struct xmc4xxx_flash_bank
));
1235 if (!bank
->driver_priv
)
1236 return ERROR_FLASH_OPERATION_FAILED
;
1238 (void)memset(bank
->driver_priv
, 0, sizeof(struct xmc4xxx_flash_bank
));
1243 COMMAND_HANDLER(xmc4xxx_handle_flash_password_command
)
1246 struct flash_bank
*bank
;
1249 return ERROR_COMMAND_SYNTAX_ERROR
;
1251 res
= CALL_COMMAND_HANDLER(flash_command_get_bank
, 0, &bank
);
1252 if (res
!= ERROR_OK
)
1255 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
1259 /* We skip over the flash bank */
1260 COMMAND_PARSE_NUMBER(u32
, CMD_ARGV
[1], fb
->pw1
);
1263 return ERROR_COMMAND_SYNTAX_ERROR
;
1265 COMMAND_PARSE_NUMBER(u32
, CMD_ARGV
[2], fb
->pw2
);
1268 return ERROR_COMMAND_SYNTAX_ERROR
;
1272 command_print(CMD
, "XMC4xxx flash passwords set to:\n");
1273 command_print(CMD
, "-0x%08"PRIx32
"\n", fb
->pw1
);
1274 command_print(CMD
, "-0x%08"PRIx32
"\n", fb
->pw2
);
1278 COMMAND_HANDLER(xmc4xxx_handle_flash_unprotect_command
)
1280 struct flash_bank
*bank
;
1285 return ERROR_COMMAND_SYNTAX_ERROR
;
1287 res
= CALL_COMMAND_HANDLER(flash_command_get_bank
, 0, &bank
);
1288 if (res
!= ERROR_OK
)
1291 COMMAND_PARSE_NUMBER(s32
, CMD_ARGV
[1], level
);
1293 res
= xmc4xxx_flash_unprotect(bank
, level
);
1298 static const struct command_registration xmc4xxx_exec_command_handlers
[] = {
1300 .name
= "flash_password",
1301 .handler
= xmc4xxx_handle_flash_password_command
,
1302 .mode
= COMMAND_EXEC
,
1303 .usage
= "bank_id password1 password2",
1304 .help
= "Set the flash passwords used for protect operations. "
1305 "Passwords should be in standard hex form (0x00000000). "
1306 "(You must call this before any other protect commands) "
1307 "NOTE: The xmc4xxx's UCB area only allows for FOUR cycles. "
1308 "Please use protection carefully!",
1311 .name
= "flash_unprotect",
1312 .handler
= xmc4xxx_handle_flash_unprotect_command
,
1313 .mode
= COMMAND_EXEC
,
1314 .usage
= "bank_id user_level[0-1]",
1315 .help
= "Permanently Removes flash protection (read and write) "
1316 "for the specified user level",
1318 COMMAND_REGISTRATION_DONE
1321 static const struct command_registration xmc4xxx_command_handlers
[] = {
1324 .mode
= COMMAND_ANY
,
1325 .help
= "xmc4xxx flash command group",
1327 .chain
= xmc4xxx_exec_command_handlers
,
1329 COMMAND_REGISTRATION_DONE
1332 const struct flash_driver xmc4xxx_flash
= {
1334 .commands
= xmc4xxx_command_handlers
,
1335 .flash_bank_command
= xmc4xxx_flash_bank_command
,
1336 .erase
= xmc4xxx_erase
,
1337 .write
= xmc4xxx_write
,
1338 .read
= default_flash_read
,
1339 .probe
= xmc4xxx_probe
,
1340 .auto_probe
= xmc4xxx_probe
,
1341 .erase_check
= default_flash_blank_check
,
1342 .info
= xmc4xxx_get_info_command
,
1343 .protect_check
= xmc4xxx_protect_check
,
1344 .protect
= xmc4xxx_protect
,
1345 .free_driver_priv
= default_flash_free_driver_priv
,