1 /**************************************************************************
2 * Copyright (C) 2015 Jeff Ciesielski <jeffciesielski@gmail.com> *
4 * This program is free software; you can redistribute it and/or modify *
5 * it under the terms of the GNU General Public License as published by *
6 * the Free Software Foundation; either version 2 of the License, or *
7 * (at your option) any later version. *
9 * This program is distributed in the hope that it will be useful, *
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
12 * GNU General Public License for more details. *
14 * You should have received a copy of the GNU General Public License *
15 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
16 ***************************************************************************/
23 #include <helper/binarybuffer.h>
24 #include <target/algorithm.h>
25 #include <target/armv7m.h>
27 /* Maximum number of sectors */
28 #define MAX_XMC_SECTORS 12
30 /* System control unit registers */
31 #define SCU_REG_BASE 0x50004000
33 #define SCU_ID_CHIP 0x04
35 /* Base of the non-cached flash memory */
36 #define PFLASH_BASE 0x0C000000
38 /* User configuration block offsets */
39 #define UCB0_BASE 0x00000000
40 #define UCB1_BASE 0x00000400
41 #define UCB2_BASE 0x00000800
43 /* Flash register base */
44 #define FLASH_REG_BASE 0x58000000
46 /* PMU ID Registers */
47 #define FLASH_REG_PMU_ID (FLASH_REG_BASE | 0x0508)
50 #define PMU_MOD_REV_MASK 0xFF
51 #define PMU_MOD_TYPE_MASK 0xFF00
52 #define PMU_MOD_NO_MASK 0xFFFF0000
55 #define FLASH_REG_PREF_PCON (FLASH_REG_BASE | 0x4000)
58 #define PCON_IBYP (1 << 0)
59 #define PCON_IINV (1 << 1)
61 /* Flash ID Register */
62 #define FLASH_REG_FLASH0_ID (FLASH_REG_BASE | 0x2008)
64 /* Flash Status Register */
65 #define FLASH_REG_FLASH0_FSR (FLASH_REG_BASE | 0x2010)
68 #define FSR_FABUSY (1)
71 #define FSR_PFPAGE (6)
72 #define FSR_PFOPER (8)
74 #define FSR_PROER (11)
75 #define FSR_PFSBER (12)
76 #define FSR_PFDBER (14)
77 #define FSR_PROIN (16)
78 #define FSR_RPROIN (18)
79 #define FSR_RPRODIS (19)
80 #define FSR_WPROIN0 (21)
81 #define FSR_WPROIN1 (22)
82 #define FSR_WPROIN2 (23)
83 #define FSR_WPRODIS0 (25)
84 #define FSR_WPRODIS1 (26)
88 #define FSR_PBUSY_MASK (0x01 << FSR_PBUSY)
89 #define FSR_FABUSY_MASK (0x01 << FSR_FABUSY)
90 #define FSR_PROG_MASK (0x01 << FSR_PROG)
91 #define FSR_ERASE_MASK (0x01 << FSR_ERASE)
92 #define FSR_PFPAGE_MASK (0x01 << FSR_PFPAGE)
93 #define FSR_PFOPER_MASK (0x01 << FSR_PFOPER)
94 #define FSR_SQER_MASK (0x01 << FSR_SQER)
95 #define FSR_PROER_MASK (0x01 << FSR_PROER)
96 #define FSR_PFSBER_MASK (0x01 << FSR_PFSBER)
97 #define FSR_PFDBER_MASK (0x01 << FSR_PFDBER)
98 #define FSR_PROIN_MASK (0x01 << FSR_PROIN)
99 #define FSR_RPROIN_MASK (0x01 << FSR_RPROIN)
100 #define FSR_RPRODIS_MASK (0x01 << FSR_RPRODIS)
101 #define FSR_WPROIN0_MASK (0x01 << FSR_WPROIN0)
102 #define FSR_WPROIN1_MASK (0x01 << FSR_WPROIN1)
103 #define FSR_WPROIN2_MASK (0x01 << FSR_WPROIN2)
104 #define FSR_WPRODIS0_MASK (0x01 << FSR_WPRODIS0)
105 #define FSR_WPRODIS1_MASK (0x01 << FSR_WPRODIS1)
106 #define FSR_SLM_MASK (0x01 << FSR_SLM)
107 #define FSR_VER_MASK (0x01 << FSR_VER)
109 /* Flash Config Register */
110 #define FLASH_REG_FLASH0_FCON (FLASH_REG_BASE | 0x2014)
112 #define FCON_WSPFLASH (0)
113 #define FCON_WSECPF (4)
114 #define FCON_IDLE (13)
115 #define FCON_ESLDIS (14)
116 #define FCON_SLEEP (15)
117 #define FCON_RPA (16)
118 #define FCON_DCF (17)
119 #define FCON_DDF (18)
120 #define FCON_VOPERM (24)
121 #define FCON_SQERM (25)
122 #define FCON_PROERM (26)
123 #define FCON_PFSBERM (27)
124 #define FCON_PFDBERM (29)
125 #define FCON_EOBM (31)
127 #define FCON_WSPFLASH_MASK (0x0f << FCON_WSPFLASH)
128 #define FCON_WSECPF_MASK (0x01 << FCON_WSECPF)
129 #define FCON_IDLE_MASK (0x01 << FCON_IDLE)
130 #define FCON_ESLDIS_MASK (0x01 << FCON_ESLDIS)
131 #define FCON_SLEEP_MASK (0x01 << FCON_SLEEP)
132 #define FCON_RPA_MASK (0x01 << FCON_RPA)
133 #define FCON_DCF_MASK (0x01 << FCON_DCF)
134 #define FCON_DDF_MASK (0x01 << FCON_DDF)
135 #define FCON_VOPERM_MASK (0x01 << FCON_VOPERM)
136 #define FCON_SQERM_MASK (0x01 << FCON_SQERM)
137 #define FCON_PROERM_MASK (0x01 << FCON_PROERM)
138 #define FCON_PFSBERM_MASK (0x01 << FCON_PFSBERM)
139 #define FCON_PFDBERM_MASK (0x01 << FCON_PFDBERM)
140 #define FCON_EOBM_MASK (0x01 << FCON_EOBM)
142 /* Flash Margin Control Register */
143 #define FLASH_REG_FLASH0_MARP (FLASH_REG_BASE | 0x2018)
145 #define MARP_MARGIN (0)
146 #define MARP_TRAPDIS (15)
148 #define MARP_MARGIN_MASK (0x0f << MARP_MARGIN)
149 #define MARP_TRAPDIS_MASK (0x01 << MARP_TRAPDIS)
151 /* Flash Protection Registers */
152 #define FLASH_REG_FLASH0_PROCON0 (FLASH_REG_BASE | 0x2020)
153 #define FLASH_REG_FLASH0_PROCON1 (FLASH_REG_BASE | 0x2024)
154 #define FLASH_REG_FLASH0_PROCON2 (FLASH_REG_BASE | 0x2028)
156 #define PROCON_S0L (0)
157 #define PROCON_S1L (1)
158 #define PROCON_S2L (2)
159 #define PROCON_S3L (3)
160 #define PROCON_S4L (4)
161 #define PROCON_S5L (5)
162 #define PROCON_S6L (6)
163 #define PROCON_S7L (7)
164 #define PROCON_S8L (8)
165 #define PROCON_S9L (9)
166 #define PROCON_S10_S11L (10)
167 #define PROCON_RPRO (15)
169 #define PROCON_S0L_MASK (0x01 << PROCON_S0L)
170 #define PROCON_S1L_MASK (0x01 << PROCON_S1L)
171 #define PROCON_S2L_MASK (0x01 << PROCON_S2L)
172 #define PROCON_S3L_MASK (0x01 << PROCON_S3L)
173 #define PROCON_S4L_MASK (0x01 << PROCON_S4L)
174 #define PROCON_S5L_MASK (0x01 << PROCON_S5L)
175 #define PROCON_S6L_MASK (0x01 << PROCON_S6L)
176 #define PROCON_S7L_MASK (0x01 << PROCON_S7L)
177 #define PROCON_S8L_MASK (0x01 << PROCON_S8L)
178 #define PROCON_S9L_MASK (0x01 << PROCON_S9L)
179 #define PROCON_S10_S11L_MASK (0x01 << PROCON_S10_S11L)
180 #define PROCON_RPRO_MASK (0x01 << PROCON_RPRO)
182 #define FLASH_PROTECT_CONFIRMATION_CODE 0x8AFE15C3
184 /* Flash controller configuration values */
185 #define FLASH_ID_XMC4500 0xA2
186 #define FLASH_ID_XMC4700_4800 0x92
187 #define FLASH_ID_XMC4100_4200 0x9C
188 #define FLASH_ID_XMC4400 0x9F
191 #define FLASH_OP_TIMEOUT 5000
193 /* Flash commands (write/erase/protect) are performed using special
194 * command sequences that are written to magic addresses in the flash controller */
195 /* Command sequence addresses. See reference manual, section 8: Flash Command Sequences */
196 #define FLASH_CMD_ERASE_1 0x0C005554
197 #define FLASH_CMD_ERASE_2 0x0C00AAA8
198 #define FLASH_CMD_ERASE_3 FLASH_CMD_ERASE_1
199 #define FLASH_CMD_ERASE_4 FLASH_CMD_ERASE_1
200 #define FLASH_CMD_ERASE_5 FLASH_CMD_ERASE_2
201 /* ERASE_6 is the sector base address */
203 #define FLASH_CMD_CLEAR_STATUS FLASH_CMD_ERASE_1
205 #define FLASH_CMD_ENTER_PAGEMODE FLASH_CMD_ERASE_1
207 #define FLASH_CMD_LOAD_PAGE_1 0x0C0055F0
208 #define FLASH_CMD_LOAD_PAGE_2 0x0C0055F4
210 #define FLASH_CMD_WRITE_PAGE_1 FLASH_CMD_ERASE_1
211 #define FLASH_CMD_WRITE_PAGE_2 FLASH_CMD_ERASE_2
212 #define FLASH_CMD_WRITE_PAGE_3 FLASH_CMD_ERASE_1
213 /* WRITE_PAGE_4 is the page base address */
215 #define FLASH_CMD_TEMP_UNPROT_1 FLASH_CMD_ERASE_1
216 #define FLASH_CMD_TEMP_UNPROT_2 FLASH_CMD_ERASE_2
217 #define FLASH_CMD_TEMP_UNPROT_3 0x0C00553C
218 #define FLASH_CMD_TEMP_UNPROT_4 FLASH_CMD_ERASE_2
219 #define FLASH_CMD_TEMP_UNPROT_5 FLASH_CMD_ERASE_2
220 #define FLASH_CMD_TEMP_UNPROT_6 0x0C005558
222 struct xmc4xxx_flash_bank
{
225 /* We need the flash controller ID to choose the sector layout */
228 /* Passwords used for protection operations */
233 /* Protection flags */
236 bool write_prot_otp
[MAX_XMC_SECTORS
];
239 struct xmc4xxx_command_seq
{
244 /* Sector capacities. See section 8 of xmc4x00_rm */
245 static const unsigned int sector_capacity_8
[8] = {
246 16, 16, 16, 16, 16, 16, 16, 128
249 static const unsigned int sector_capacity_9
[9] = {
250 16, 16, 16, 16, 16, 16, 16, 128, 256
253 static const unsigned int sector_capacity_12
[12] = {
254 16, 16, 16, 16, 16, 16, 16, 16, 128, 256, 256, 256
257 static const unsigned int sector_capacity_16
[16] = {
258 16, 16, 16, 16, 16, 16, 16, 16, 128, 256, 256, 256, 256, 256, 256, 256
261 static int xmc4xxx_write_command_sequence(struct flash_bank
*bank
,
262 struct xmc4xxx_command_seq
*seq
,
267 for (int i
= 0; i
< seq_len
; i
++) {
268 res
= target_write_u32(bank
->target
, seq
[i
].address
,
277 static int xmc4xxx_load_bank_layout(struct flash_bank
*bank
)
279 const unsigned int *capacity
= NULL
;
281 /* At this point, we know which flash controller ID we're
282 * talking to and simply need to fill out the bank structure accordingly */
283 LOG_DEBUG("%d sectors", bank
->num_sectors
);
285 switch (bank
->num_sectors
) {
287 capacity
= sector_capacity_8
;
290 capacity
= sector_capacity_9
;
293 capacity
= sector_capacity_12
;
296 capacity
= sector_capacity_16
;
299 LOG_ERROR("Unexpected number of sectors, %d\n",
304 /* This looks like a bank that we understand, now we know the
305 * corresponding sector capacities and we can add those up into the
307 uint32_t total_offset
= 0;
308 bank
->sectors
= calloc(bank
->num_sectors
,
309 sizeof(struct flash_sector
));
310 for (int i
= 0; i
< bank
->num_sectors
; i
++) {
311 bank
->sectors
[i
].size
= capacity
[i
] * 1024;
312 bank
->sectors
[i
].offset
= total_offset
;
313 bank
->sectors
[i
].is_erased
= -1;
314 bank
->sectors
[i
].is_protected
= -1;
316 bank
->size
+= bank
->sectors
[i
].size
;
317 LOG_DEBUG("\t%d: %uk", i
, capacity
[i
]);
318 total_offset
+= bank
->sectors
[i
].size
;
321 /* This part doesn't follow the typical standard of 0xff
322 * being the default padding value.*/
323 bank
->default_padded_value
= 0x00;
328 static int xmc4xxx_probe(struct flash_bank
*bank
)
331 uint32_t devid
, config
;
332 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
338 /* It's not possible for the DAP to access the OTP locations needed for
339 * probing the part info and Flash geometry so we require that the target
340 * be halted before proceeding. */
341 if (bank
->target
->state
!= TARGET_HALTED
) {
342 LOG_WARNING("Cannot communicate... target not halted.");
343 return ERROR_TARGET_NOT_HALTED
;
346 /* The SCU registers contain the ID of the chip */
347 res
= target_read_u32(bank
->target
, SCU_REG_BASE
+ SCU_ID_CHIP
, &devid
);
348 if (res
!= ERROR_OK
) {
349 LOG_ERROR("Cannot read device identification register.");
353 /* Make sure this is a XMC4000 family device */
354 if ((devid
& 0xF0000) != 0x40000 && devid
!= 0) {
355 LOG_ERROR("Platform ID doesn't match XMC4xxx: 0x%08" PRIx32
, devid
);
359 LOG_DEBUG("Found XMC4xxx with devid: 0x%08" PRIx32
, devid
);
361 /* Now sanity-check the Flash controller itself. */
362 res
= target_read_u32(bank
->target
, FLASH_REG_FLASH0_ID
,
364 if (res
!= ERROR_OK
) {
365 LOG_ERROR("Cannot read Flash bank configuration.");
368 flash_id
= (config
& 0xff0000) >> 16;
370 /* The Flash configuration register is our only means of
371 * determining the sector layout. We need to make sure that
372 * we understand the type of controller we're dealing with */
374 case FLASH_ID_XMC4100_4200
:
375 bank
->num_sectors
= 8;
376 LOG_DEBUG("XMC4xxx: XMC4100/4200 detected.");
378 case FLASH_ID_XMC4400
:
379 bank
->num_sectors
= 9;
380 LOG_DEBUG("XMC4xxx: XMC4400 detected.");
382 case FLASH_ID_XMC4500
:
383 bank
->num_sectors
= 12;
384 LOG_DEBUG("XMC4xxx: XMC4500 detected.");
386 case FLASH_ID_XMC4700_4800
:
387 bank
->num_sectors
= 16;
388 LOG_DEBUG("XMC4xxx: XMC4700/4800 detected.");
391 LOG_ERROR("XMC4xxx: Unexpected flash ID. got %02" PRIx8
,
396 /* Retrieve information about the particular bank we're probing and fill in
397 * the bank structure accordingly. */
398 res
= xmc4xxx_load_bank_layout(bank
);
399 if (res
== ERROR_OK
) {
403 LOG_ERROR("Unable to load bank information.");
410 static int xmc4xxx_get_sector_start_addr(struct flash_bank
*bank
,
411 int sector
, uint32_t *ret_addr
)
413 /* Make sure we understand this sector */
414 if (sector
> bank
->num_sectors
)
417 *ret_addr
= bank
->base
+ bank
->sectors
[sector
].offset
;
423 static int xmc4xxx_clear_flash_status(struct flash_bank
*bank
)
426 /* TODO: Do we need to check for sequence error? */
427 LOG_INFO("Clearing flash status");
428 res
= target_write_u32(bank
->target
, FLASH_CMD_CLEAR_STATUS
,
430 if (res
!= ERROR_OK
) {
431 LOG_ERROR("Unable to write erase command sequence");
438 static int xmc4xxx_get_flash_status(struct flash_bank
*bank
, uint32_t *status
)
442 res
= target_read_u32(bank
->target
, FLASH_REG_FLASH0_FSR
, status
);
445 LOG_ERROR("Cannot read flash status register.");
450 static int xmc4xxx_wait_status_busy(struct flash_bank
*bank
, int timeout
)
455 res
= xmc4xxx_get_flash_status(bank
, &status
);
459 /* While the flash controller is busy, wait */
460 while (status
& FSR_PBUSY_MASK
) {
461 res
= xmc4xxx_get_flash_status(bank
, &status
);
465 if (timeout
-- <= 0) {
466 LOG_ERROR("Timed out waiting for flash");
473 if (status
& FSR_PROER_MASK
) {
474 LOG_ERROR("XMC4xxx flash protected");
481 static int xmc4xxx_erase_sector(struct flash_bank
*bank
, uint32_t address
,
487 /* See reference manual table 8.4: Command Sequences for Flash Control */
488 struct xmc4xxx_command_seq erase_cmd_seq
[6] = {
489 {FLASH_CMD_ERASE_1
, 0xAA},
490 {FLASH_CMD_ERASE_2
, 0x55},
491 {FLASH_CMD_ERASE_3
, 0x80},
492 {FLASH_CMD_ERASE_4
, 0xAA},
493 {FLASH_CMD_ERASE_5
, 0x55},
494 {0xFF, 0xFF} /* Needs filled in */
497 /* We need to fill in the base address of the sector we'll be
498 * erasing, as well as the magic code that determines whether
499 * this is a standard flash sector or a user configuration block */
501 erase_cmd_seq
[5].address
= address
;
503 /* Removing flash protection requires the addition of
504 * the base address */
505 erase_cmd_seq
[5].address
+= bank
->base
;
506 erase_cmd_seq
[5].magic
= 0xC0;
508 erase_cmd_seq
[5].magic
= 0x30;
511 res
= xmc4xxx_write_command_sequence(bank
, erase_cmd_seq
,
512 ARRAY_SIZE(erase_cmd_seq
));
516 /* Read the flash status register */
517 res
= target_read_u32(bank
->target
, FLASH_REG_FLASH0_FSR
, &status
);
518 if (res
!= ERROR_OK
) {
519 LOG_ERROR("Cannot read flash status register.");
523 /* Check for a sequence error */
524 if (status
& FSR_SQER_MASK
) {
525 LOG_ERROR("Error with flash erase sequence");
529 /* Make sure a flash erase was triggered */
530 if (!(status
& FSR_ERASE_MASK
)) {
531 LOG_ERROR("Flash failed to erase");
535 /* Now we must wait for the erase operation to end */
536 res
= xmc4xxx_wait_status_busy(bank
, FLASH_OP_TIMEOUT
);
541 static int xmc4xxx_erase(struct flash_bank
*bank
, int first
, int last
)
543 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
546 if (bank
->target
->state
!= TARGET_HALTED
) {
547 LOG_ERROR("Unable to erase, target is not halted");
548 return ERROR_TARGET_NOT_HALTED
;
552 res
= xmc4xxx_probe(bank
);
558 /* Loop through the sectors and erase each one */
559 for (int i
= first
; i
<= last
; i
++) {
560 res
= xmc4xxx_get_sector_start_addr(bank
, i
, &tmp_addr
);
561 if (res
!= ERROR_OK
) {
562 LOG_ERROR("Invalid sector %d", i
);
566 LOG_DEBUG("Erasing sector %d @ 0x%08"PRIx32
, i
, tmp_addr
);
568 res
= xmc4xxx_erase_sector(bank
, tmp_addr
, false);
569 if (res
!= ERROR_OK
) {
570 LOG_ERROR("Unable to write erase command sequence");
571 goto clear_status_and_exit
;
574 /* Now we must wait for the erase operation to end */
575 res
= xmc4xxx_wait_status_busy(bank
, FLASH_OP_TIMEOUT
);
578 goto clear_status_and_exit
;
580 bank
->sectors
[i
].is_erased
= 1;
583 clear_status_and_exit
:
584 res
= xmc4xxx_clear_flash_status(bank
);
589 static int xmc4xxx_enter_page_mode(struct flash_bank
*bank
)
594 res
= target_write_u32(bank
->target
, FLASH_CMD_ENTER_PAGEMODE
, 0x50);
595 if (res
!= ERROR_OK
) {
596 LOG_ERROR("Unable to write enter page mode command");
600 res
= xmc4xxx_get_flash_status(bank
, &status
);
605 /* Make sure we're in page mode */
606 if (!(status
& FSR_PFPAGE_MASK
)) {
607 LOG_ERROR("Unable to enter page mode");
611 /* Make sure we didn't encounter a sequence error */
612 if (status
& FSR_SQER_MASK
) {
613 LOG_ERROR("Sequence error while entering page mode");
620 /* The logical erase value of an xmc4xxx memory cell is 0x00,
621 * therefore, we cannot use the built in flash blank check and must
622 * implement our own */
624 /** Checks whether a memory region is zeroed. */
625 static int xmc4xxx_blank_check_memory(struct target
*target
,
626 uint32_t address
, uint32_t count
, uint32_t *blank
)
628 struct working_area
*erase_check_algorithm
;
629 struct reg_param reg_params
[3];
630 struct armv7m_algorithm armv7m_info
;
633 static const uint8_t erase_check_code
[] = {
634 #include "../../../contrib/loaders/erase_check/armv7m_0_erase_check.inc"
637 /* make sure we have a working area */
638 if (target_alloc_working_area(target
, sizeof(erase_check_code
),
639 &erase_check_algorithm
) != ERROR_OK
)
640 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
642 retval
= target_write_buffer(target
, erase_check_algorithm
->address
,
643 sizeof(erase_check_code
), (uint8_t *)erase_check_code
);
644 if (retval
!= ERROR_OK
)
647 armv7m_info
.common_magic
= ARMV7M_COMMON_MAGIC
;
648 armv7m_info
.core_mode
= ARM_MODE_THREAD
;
650 init_reg_param(®_params
[0], "r0", 32, PARAM_OUT
);
651 buf_set_u32(reg_params
[0].value
, 0, 32, address
);
653 init_reg_param(®_params
[1], "r1", 32, PARAM_OUT
);
654 buf_set_u32(reg_params
[1].value
, 0, 32, count
);
656 init_reg_param(®_params
[2], "r2", 32, PARAM_IN_OUT
);
657 buf_set_u32(reg_params
[2].value
, 0, 32, 0x00);
659 retval
= target_run_algorithm(target
,
664 erase_check_algorithm
->address
,
665 erase_check_algorithm
->address
+ (sizeof(erase_check_code
) - 2),
669 if (retval
== ERROR_OK
)
670 *blank
= buf_get_u32(reg_params
[2].value
, 0, 32);
672 destroy_reg_param(®_params
[0]);
673 destroy_reg_param(®_params
[1]);
674 destroy_reg_param(®_params
[2]);
677 target_free_working_area(target
, erase_check_algorithm
);
682 static int xmc4xxx_flash_blank_check(struct flash_bank
*bank
)
684 struct target
*target
= bank
->target
;
686 int retval
= ERROR_OK
;
689 if (bank
->target
->state
!= TARGET_HALTED
) {
690 LOG_ERROR("Target not halted");
691 return ERROR_TARGET_NOT_HALTED
;
694 for (i
= 0; i
< bank
->num_sectors
; i
++) {
695 uint32_t address
= bank
->base
+ bank
->sectors
[i
].offset
;
696 uint32_t size
= bank
->sectors
[i
].size
;
698 LOG_DEBUG("Erase checking 0x%08"PRIx32
, address
);
699 retval
= xmc4xxx_blank_check_memory(target
, address
, size
, &blank
);
701 if (retval
!= ERROR_OK
)
705 bank
->sectors
[i
].is_erased
= 1;
707 bank
->sectors
[i
].is_erased
= 0;
713 static int xmc4xxx_write_page(struct flash_bank
*bank
, const uint8_t *pg_buf
,
714 uint32_t offset
, bool user_config
)
719 /* Base of the flash write command */
720 struct xmc4xxx_command_seq write_cmd_seq
[4] = {
721 {FLASH_CMD_WRITE_PAGE_1
, 0xAA},
722 {FLASH_CMD_WRITE_PAGE_2
, 0x55},
723 {FLASH_CMD_WRITE_PAGE_3
, 0xFF}, /* Needs filled in */
724 {0xFF, 0xFF} /* Needs filled in */
727 /* The command sequence differs depending on whether this is
728 * being written to standard flash or the user configuration
731 write_cmd_seq
[2].magic
= 0xC0;
733 write_cmd_seq
[2].magic
= 0xA0;
735 /* Finally, we need to add the address that this page will be
737 write_cmd_seq
[3].address
= bank
->base
+ offset
;
738 write_cmd_seq
[3].magic
= 0xAA;
741 /* Flash pages are written 256 bytes at a time. For each 256
742 * byte chunk, we need to:
743 * 1. Enter page mode. This activates the flash write buffer
744 * 2. Load the page buffer with data (2x 32 bit words at a time)
745 * 3. Burn the page buffer into its intended location
746 * If the starting offset is not on a 256 byte boundary, we
747 * will need to pad the beginning of the write buffer
748 * accordingly. Likewise, if the last page does not fill the
749 * buffer, we should pad it to avoid leftover data from being
752 res
= xmc4xxx_enter_page_mode(bank
);
756 /* Copy the data into the page buffer*/
757 for (int i
= 0; i
< 256; i
+= 8) {
758 uint32_t w_lo
= target_buffer_get_u32(bank
->target
, &pg_buf
[i
]);
759 uint32_t w_hi
= target_buffer_get_u32(bank
->target
, &pg_buf
[i
+ 4]);
760 LOG_DEBUG("WLO: %08"PRIx32
, w_lo
);
761 LOG_DEBUG("WHI: %08"PRIx32
, w_hi
);
763 /* Data is loaded 2x 32 bit words at a time */
764 res
= target_write_u32(bank
->target
, FLASH_CMD_LOAD_PAGE_1
, w_lo
);
768 res
= target_write_u32(bank
->target
, FLASH_CMD_LOAD_PAGE_2
, w_hi
);
772 /* Check for an error */
773 res
= xmc4xxx_get_flash_status(bank
, &status
);
777 if (status
& FSR_SQER_MASK
) {
778 LOG_ERROR("Error loading page buffer");
783 /* The page buffer is now full, time to commit it to flash */
785 res
= xmc4xxx_write_command_sequence(bank
, write_cmd_seq
, ARRAY_SIZE(write_cmd_seq
));
786 if (res
!= ERROR_OK
) {
787 LOG_ERROR("Unable to enter write command sequence");
791 /* Read the flash status register */
792 res
= xmc4xxx_get_flash_status(bank
, &status
);
796 /* Check for a sequence error */
797 if (status
& FSR_SQER_MASK
) {
798 LOG_ERROR("Error with flash write sequence");
802 /* Make sure a flash write was triggered */
803 if (!(status
& FSR_PROG_MASK
)) {
804 LOG_ERROR("Failed to write flash page");
808 /* Wait for the write operation to end */
809 res
= xmc4xxx_wait_status_busy(bank
, FLASH_OP_TIMEOUT
);
813 /* TODO: Verify that page was written without error */
817 static int xmc4xxx_write(struct flash_bank
*bank
, const uint8_t *buffer
,
818 uint32_t offset
, uint32_t count
)
820 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
823 if (bank
->target
->state
!= TARGET_HALTED
) {
824 LOG_ERROR("Unable to erase, target is not halted");
825 return ERROR_TARGET_NOT_HALTED
;
829 res
= xmc4xxx_probe(bank
);
834 /* Make sure we won't run off the end of the flash bank */
835 if ((offset
+ count
) > (bank
->size
)) {
836 LOG_ERROR("Attempting to write past the end of flash");
841 /* Attempt to write the passed in buffer to flash */
842 /* Pages are written 256 bytes at a time, we need to handle
843 * scenarios where padding is required at the beginning and
846 /* page working area */
847 uint8_t tmp_buf
[256] = {0};
849 /* Amount of data we'll be writing to this page */
853 remaining
= MIN(count
, sizeof(tmp_buf
));
854 end_pad
= sizeof(tmp_buf
) - remaining
;
856 /* Make sure we're starting on a page boundary */
857 int start_pad
= offset
% 256;
859 LOG_INFO("Write does not start on a 256 byte boundary. "
860 "Padding by %d bytes", start_pad
);
861 memset(tmp_buf
, 0xff, start_pad
);
862 /* Subtract the amount of start offset from
863 * the amount of data we'll need to write */
864 remaining
-= start_pad
;
867 /* Remove the amount we'll be writing from the total count */
870 /* Now copy in the remaining data */
871 memcpy(&tmp_buf
[start_pad
], buffer
, remaining
);
874 LOG_INFO("Padding end of page @%08"PRIx32
" by %d bytes",
875 bank
->base
+ offset
, end_pad
);
876 memset(&tmp_buf
[256 - end_pad
], 0xff, end_pad
);
879 /* Now commit this page to flash, if there was start
880 * padding, we should subtract that from the target offset */
881 res
= xmc4xxx_write_page(bank
, tmp_buf
, (offset
- start_pad
), false);
882 if (res
!= ERROR_OK
) {
883 LOG_ERROR("Unable to write flash page");
884 goto abort_write_and_exit
;
887 /* Advance the buffer pointer */
890 /* Advance the offset */
894 abort_write_and_exit
:
895 xmc4xxx_clear_flash_status(bank
);
900 static int xmc4xxx_get_info_command(struct flash_bank
*bank
, char *buf
, int buf_size
)
902 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
905 if (bank
->target
->state
!= TARGET_HALTED
) {
906 LOG_WARNING("Cannot communicate... target not halted.");
907 return ERROR_TARGET_NOT_HALTED
;
910 /* The SCU registers contain the ID of the chip */
911 int res
= target_read_u32(bank
->target
, SCU_REG_BASE
+ SCU_ID_CHIP
, &scu_idcode
);
912 if (res
!= ERROR_OK
) {
913 LOG_ERROR("Cannot read device identification register.");
917 uint16_t dev_id
= (scu_idcode
& 0xfff0) >> 4;
918 uint16_t rev_id
= scu_idcode
& 0xf;
920 const char *rev_str
= NULL
;
960 /* XMC4500 EES AA13 with date codes before GE212
961 * had zero SCU_IDCHIP
963 dev_str
= "XMC4500 EES";
1001 snprintf(buf
, buf_size
,
1002 "Cannot identify target as an XMC4xxx. SCU_ID: %"PRIx32
"\n",
1007 /* String to declare protection data held in the private driver */
1008 char prot_str
[512] = {0};
1009 if (fb
->read_protected
)
1010 snprintf(prot_str
, sizeof(prot_str
), "\nFlash is read protected");
1012 bool otp_enabled
= false;
1013 for (int i
= 0; i
< bank
->num_sectors
; i
++)
1014 if (fb
->write_prot_otp
[i
])
1017 /* If OTP Write protection is enabled (User 2), list each
1018 * sector that has it enabled */
1021 strcat(prot_str
, "\nOTP Protection is enabled for sectors:\n");
1022 for (int i
= 0; i
< bank
->num_sectors
; i
++) {
1023 if (fb
->write_prot_otp
[i
]) {
1024 snprintf(otp_str
, sizeof(otp_str
), "- %d\n", i
);
1025 strncat(prot_str
, otp_str
, ARRAY_SIZE(otp_str
));
1030 if (rev_str
!= NULL
)
1031 snprintf(buf
, buf_size
, "%s - Rev: %s%s",
1032 dev_str
, rev_str
, prot_str
);
1034 snprintf(buf
, buf_size
, "%s - Rev: unknown (0x%01x)%s",
1035 dev_str
, rev_id
, prot_str
);
1040 static int xmc4xxx_temp_unprotect(struct flash_bank
*bank
, int user_level
)
1042 struct xmc4xxx_flash_bank
*fb
;
1044 uint32_t status
= 0;
1046 struct xmc4xxx_command_seq temp_unprot_seq
[6] = {
1047 {FLASH_CMD_TEMP_UNPROT_1
, 0xAA},
1048 {FLASH_CMD_TEMP_UNPROT_2
, 0x55},
1049 {FLASH_CMD_TEMP_UNPROT_3
, 0xFF}, /* Needs filled in */
1050 {FLASH_CMD_TEMP_UNPROT_4
, 0xFF}, /* Needs filled in */
1051 {FLASH_CMD_TEMP_UNPROT_5
, 0xFF}, /* Needs filled in */
1052 {FLASH_CMD_TEMP_UNPROT_6
, 0x05}
1055 if (user_level
< 0 || user_level
> 2) {
1056 LOG_ERROR("Invalid user level, must be 0-2");
1060 fb
= bank
->driver_priv
;
1062 /* Fill in the user level and passwords */
1063 temp_unprot_seq
[2].magic
= user_level
;
1064 temp_unprot_seq
[3].magic
= fb
->pw1
;
1065 temp_unprot_seq
[4].magic
= fb
->pw2
;
1067 res
= xmc4xxx_write_command_sequence(bank
, temp_unprot_seq
,
1068 ARRAY_SIZE(temp_unprot_seq
));
1069 if (res
!= ERROR_OK
) {
1070 LOG_ERROR("Unable to write temp unprotect sequence");
1074 res
= xmc4xxx_get_flash_status(bank
, &status
);
1075 if (res
!= ERROR_OK
)
1078 if (status
& FSR_WPRODIS0
) {
1079 LOG_INFO("Flash is temporarily unprotected");
1081 LOG_INFO("Unable to disable flash protection");
1089 static int xmc4xxx_flash_unprotect(struct flash_bank
*bank
, int32_t level
)
1094 if ((level
< 0) || (level
> 1)) {
1095 LOG_ERROR("Invalid user level. Must be 0-1");
1108 res
= xmc4xxx_erase_sector(bank
, addr
, true);
1110 if (res
!= ERROR_OK
)
1111 LOG_ERROR("Error erasing user configuration block");
1116 /* Reference: "XMC4500 Flash Protection.pptx" app note */
1117 static int xmc4xxx_flash_protect(struct flash_bank
*bank
, int level
, bool read_protect
,
1118 int first
, int last
)
1120 /* User configuration block buffers */
1121 uint8_t ucp0_buf
[8 * sizeof(uint32_t)] = {0};
1122 uint32_t ucb_base
= 0;
1123 uint32_t procon
= 0;
1125 uint32_t status
= 0;
1128 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
1130 /* Read protect only works for user 0, make sure we don't try
1131 * to do something silly */
1132 if (level
!= 0 && read_protect
) {
1133 LOG_ERROR("Read protection is for user level 0 only!");
1137 /* Check to see if protection is already installed for the
1138 * specified user level. If it is, the user configuration
1139 * block will need to be erased before we can continue */
1141 /* Grab the flash status register*/
1142 res
= xmc4xxx_get_flash_status(bank
, &status
);
1143 if (res
!= ERROR_OK
)
1148 if ((status
& FSR_RPROIN_MASK
) || (status
& FSR_WPROIN0_MASK
))
1152 if (status
& FSR_WPROIN1_MASK
)
1156 if (status
& FSR_WPROIN2_MASK
)
1162 LOG_ERROR("Flash protection is installed for user %d"
1163 " and must be removed before continuing", level
);
1167 /* If this device has 12 flash sectors, protection for
1168 * sectors 10 & 11 are handled jointly. If we are trying to
1169 * write all sectors, we should decrement
1170 * last to ensure we don't write to a register bit that
1172 if ((bank
->num_sectors
== 12) && (last
== 12))
1175 /* We need to fill out the procon register representation
1176 * that we will be writing to the device */
1177 for (int i
= first
; i
<= last
; i
++)
1180 /* If read protection is requested, set the appropriate bit
1181 * (we checked that this is allowed above) */
1183 procon
|= PROCON_RPRO_MASK
;
1185 LOG_DEBUG("Setting flash protection with procon:");
1186 LOG_DEBUG("PROCON: %"PRIx32
, procon
);
1188 /* First we need to copy in the procon register to the buffer
1189 * we're going to attempt to write. This is written twice */
1190 target_buffer_set_u32(bank
->target
, &ucp0_buf
[0 * 4], procon
);
1191 target_buffer_set_u32(bank
->target
, &ucp0_buf
[2 * 4], procon
);
1193 /* Now we must copy in both flash passwords. As with the
1194 * procon data, this must be written twice (4 total words
1196 target_buffer_set_u32(bank
->target
, &ucp0_buf
[4 * 4], fb
->pw1
);
1197 target_buffer_set_u32(bank
->target
, &ucp0_buf
[5 * 4], fb
->pw2
);
1198 target_buffer_set_u32(bank
->target
, &ucp0_buf
[6 * 4], fb
->pw1
);
1199 target_buffer_set_u32(bank
->target
, &ucp0_buf
[7 * 4], fb
->pw2
);
1201 /* Finally, (if requested) we copy in the confirmation
1202 * code so that the protection is permanent and will
1203 * require a password to undo. */
1204 target_buffer_set_u32(bank
->target
, &ucp0_buf
[0 * 4], FLASH_PROTECT_CONFIRMATION_CODE
);
1205 target_buffer_set_u32(bank
->target
, &ucp0_buf
[2 * 4], FLASH_PROTECT_CONFIRMATION_CODE
);
1207 /* Now that the data is copied into place, we must write
1208 * these pages into flash */
1210 /* The user configuration block base depends on what level of
1211 * protection we're trying to install, select the proper one */
1214 ucb_base
= UCB0_BASE
;
1217 ucb_base
= UCB1_BASE
;
1220 ucb_base
= UCB2_BASE
;
1224 /* Write the user config pages */
1225 res
= xmc4xxx_write_page(bank
, ucp0_buf
, ucb_base
, true);
1226 if (res
!= ERROR_OK
) {
1227 LOG_ERROR("Error writing user configuration block 0");
1234 static int xmc4xxx_protect(struct flash_bank
*bank
, int set
, int first
, int last
)
1237 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
1239 /* Check for flash passwords */
1241 LOG_ERROR("Flash passwords not set, use xmc4xxx flash_password to set them");
1245 /* We want to clear flash protection temporarily*/
1247 LOG_WARNING("Flash protection will be temporarily disabled"
1248 " for all pages (User 0 only)!");
1249 ret
= xmc4xxx_temp_unprotect(bank
, 0);
1253 /* Install write protection for user 0 on the specified pages */
1254 ret
= xmc4xxx_flash_protect(bank
, 0, false, first
, last
);
1259 static int xmc4xxx_protect_check(struct flash_bank
*bank
)
1262 uint32_t protection
[3] = {0};
1263 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
1265 ret
= target_read_u32(bank
->target
, FLASH_REG_FLASH0_PROCON0
, &protection
[0]);
1266 if (ret
!= ERROR_OK
) {
1267 LOG_ERROR("Unable to read flash User0 protection register");
1271 ret
= target_read_u32(bank
->target
, FLASH_REG_FLASH0_PROCON1
, &protection
[1]);
1272 if (ret
!= ERROR_OK
) {
1273 LOG_ERROR("Unable to read flash User1 protection register");
1277 ret
= target_read_u32(bank
->target
, FLASH_REG_FLASH0_PROCON2
, &protection
[2]);
1278 if (ret
!= ERROR_OK
) {
1279 LOG_ERROR("Unable to read flash User2 protection register");
1283 int sectors
= bank
->num_sectors
;
1285 /* On devices with 12 sectors, sectors 10 & 11 are ptected
1286 * together instead of individually */
1290 /* Clear the protection status */
1291 for (int i
= 0; i
< bank
->num_sectors
; i
++) {
1292 bank
->sectors
[i
].is_protected
= 0;
1293 fb
->write_prot_otp
[i
] = false;
1295 fb
->read_protected
= false;
1297 /* The xmc4xxx series supports 3 levels of user protection
1298 * (User0, User1 (low priority), and User 2(OTP), we need to
1300 for (unsigned int i
= 0; i
< ARRAY_SIZE(protection
); i
++) {
1302 /* Check for write protection on every available
1304 for (int j
= 0; j
< sectors
; j
++) {
1305 int set
= (protection
[i
] & (1 << j
)) ? 1 : 0;
1306 bank
->sectors
[j
].is_protected
|= set
;
1308 /* Handle sector 11 */
1310 bank
->sectors
[j
+ 1].is_protected
|= set
;
1312 /* User 2 indicates this protection is
1313 * permanent, make note in the private driver structure */
1314 if (i
== 2 && set
) {
1315 fb
->write_prot_otp
[j
] = true;
1317 /* Handle sector 11 */
1319 fb
->write_prot_otp
[j
+ 1] = true;
1325 /* XMC4xxx also supports read proptection, make a note
1326 * in the private driver structure */
1327 if (protection
[0] & PROCON_RPRO_MASK
)
1328 fb
->read_protected
= true;
1333 FLASH_BANK_COMMAND_HANDLER(xmc4xxx_flash_bank_command
)
1335 bank
->driver_priv
= malloc(sizeof(struct xmc4xxx_flash_bank
));
1337 if (!bank
->driver_priv
)
1338 return ERROR_FLASH_OPERATION_FAILED
;
1340 (void)memset(bank
->driver_priv
, 0, sizeof(struct xmc4xxx_flash_bank
));
1345 COMMAND_HANDLER(xmc4xxx_handle_flash_password_command
)
1348 struct flash_bank
*bank
;
1351 return ERROR_COMMAND_SYNTAX_ERROR
;
1353 res
= CALL_COMMAND_HANDLER(flash_command_get_bank
, 0, &bank
);
1354 if (res
!= ERROR_OK
)
1357 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
1361 /* We skip over the flash bank */
1362 fb
->pw1
= strtol(CMD_ARGV
[1], NULL
, 16);
1365 return ERROR_COMMAND_SYNTAX_ERROR
;
1367 fb
->pw2
= strtol(CMD_ARGV
[2], NULL
, 16);
1370 return ERROR_COMMAND_SYNTAX_ERROR
;
1374 command_print(CMD_CTX
, "XMC4xxx flash passwords set to:\n");
1375 command_print(CMD_CTX
, "-0x%08"PRIx32
"\n", fb
->pw1
);
1376 command_print(CMD_CTX
, "-0x%08"PRIx32
"\n", fb
->pw2
);
1380 COMMAND_HANDLER(xmc4xxx_handle_flash_unprotect_command
)
1382 struct flash_bank
*bank
;
1387 return ERROR_COMMAND_SYNTAX_ERROR
;
1389 res
= CALL_COMMAND_HANDLER(flash_command_get_bank
, 0, &bank
);
1390 if (res
!= ERROR_OK
)
1393 COMMAND_PARSE_NUMBER(s32
, CMD_ARGV
[1], level
);
1395 res
= xmc4xxx_flash_unprotect(bank
, level
);
1400 static const struct command_registration xmc4xxx_exec_command_handlers
[] = {
1402 .name
= "flash_password",
1403 .handler
= xmc4xxx_handle_flash_password_command
,
1404 .mode
= COMMAND_EXEC
,
1405 .usage
= "bank_id password1 password2",
1406 .help
= "Set the flash passwords used for protect operations. "
1407 "Passwords should be in standard hex form (0x00000000). "
1408 "(You must call this before any other protect commands) "
1409 "NOTE: The xmc4xxx's UCB area only allows for FOUR cycles. "
1410 "Please use protection carefully!",
1413 .name
= "flash_unprotect",
1414 .handler
= xmc4xxx_handle_flash_unprotect_command
,
1415 .mode
= COMMAND_EXEC
,
1416 .usage
= "bank_id user_level[0-1]",
1417 .help
= "Permanently Removes flash protection (read and write) "
1418 "for the specified user level",
1419 }, COMMAND_REGISTRATION_DONE
1422 static const struct command_registration xmc4xxx_command_handlers
[] = {
1425 .mode
= COMMAND_ANY
,
1426 .help
= "xmc4xxx flash command group",
1428 .chain
= xmc4xxx_exec_command_handlers
,
1430 COMMAND_REGISTRATION_DONE
1433 struct flash_driver xmc4xxx_flash
= {
1435 .commands
= xmc4xxx_command_handlers
,
1436 .flash_bank_command
= xmc4xxx_flash_bank_command
,
1437 .erase
= xmc4xxx_erase
,
1438 .write
= xmc4xxx_write
,
1439 .read
= default_flash_read
,
1440 .probe
= xmc4xxx_probe
,
1441 .auto_probe
= xmc4xxx_probe
,
1442 .erase_check
= xmc4xxx_flash_blank_check
,
1443 .info
= xmc4xxx_get_info_command
,
1444 .protect_check
= xmc4xxx_protect_check
,
1445 .protect
= xmc4xxx_protect
,