1 // SPDX-License-Identifier: GPL-2.0-or-later
3 /***************************************************************************
4 * Copyright (C) 2013 by Andrey Yurovsky *
5 * Andrey Yurovsky <yurovsky@gmail.com> *
6 ***************************************************************************/
13 #include "helper/binarybuffer.h"
15 #include <helper/time_support.h>
16 #include <jtag/jtag.h>
17 #include <target/cortex_m.h>
19 #define SAMD_NUM_PROT_BLOCKS 16
20 #define SAMD_PAGE_SIZE_MAX 1024
22 #define SAMD_FLASH ((uint32_t)0x00000000) /* physical Flash memory */
23 #define SAMD_USER_ROW ((uint32_t)0x00804000) /* User Row of Flash */
24 #define SAMD_PAC1 0x41000000 /* Peripheral Access Control 1 */
25 #define SAMD_DSU 0x41002000 /* Device Service Unit */
26 #define SAMD_NVMCTRL 0x41004000 /* Non-volatile memory controller */
28 #define SAMD_DSU_STATUSA 1 /* DSU status register */
29 #define SAMD_DSU_DID 0x18 /* Device ID register */
30 #define SAMD_DSU_CTRL_EXT 0x100 /* CTRL register, external access */
32 #define SAMD_NVMCTRL_CTRLA 0x00 /* NVM control A register */
33 #define SAMD_NVMCTRL_CTRLB 0x04 /* NVM control B register */
34 #define SAMD_NVMCTRL_PARAM 0x08 /* NVM parameters register */
35 #define SAMD_NVMCTRL_INTFLAG 0x14 /* NVM Interrupt Flag Status & Clear */
36 #define SAMD_NVMCTRL_STATUS 0x18 /* NVM status register */
37 #define SAMD_NVMCTRL_ADDR 0x1C /* NVM address register */
38 #define SAMD_NVMCTRL_LOCK 0x20 /* NVM Lock section register */
40 #define SAMD_CMDEX_KEY 0xA5UL
41 #define SAMD_NVM_CMD(n) ((SAMD_CMDEX_KEY << 8) | (n & 0x7F))
43 /* NVMCTRL commands. See Table 20-4 in 42129F–SAM–10/2013 */
44 #define SAMD_NVM_CMD_ER 0x02 /* Erase Row */
45 #define SAMD_NVM_CMD_WP 0x04 /* Write Page */
46 #define SAMD_NVM_CMD_EAR 0x05 /* Erase Auxiliary Row */
47 #define SAMD_NVM_CMD_WAP 0x06 /* Write Auxiliary Page */
48 #define SAMD_NVM_CMD_LR 0x40 /* Lock Region */
49 #define SAMD_NVM_CMD_UR 0x41 /* Unlock Region */
50 #define SAMD_NVM_CMD_SPRM 0x42 /* Set Power Reduction Mode */
51 #define SAMD_NVM_CMD_CPRM 0x43 /* Clear Power Reduction Mode */
52 #define SAMD_NVM_CMD_PBC 0x44 /* Page Buffer Clear */
53 #define SAMD_NVM_CMD_SSB 0x45 /* Set Security Bit */
54 #define SAMD_NVM_CMD_INVALL 0x46 /* Invalidate all caches */
57 #define SAMD_NVM_CTRLB_MANW 0x80
59 /* NVMCTRL_INTFLAG bits */
60 #define SAMD_NVM_INTFLAG_READY 0x01
62 /* Known identifiers */
63 #define SAMD_PROCESSOR_M0 0x01
64 #define SAMD_FAMILY_D 0x00
65 #define SAMD_FAMILY_L 0x01
66 #define SAMD_FAMILY_C 0x02
67 #define SAMD_SERIES_20 0x00
68 #define SAMD_SERIES_21 0x01
69 #define SAMD_SERIES_22 0x02
70 #define SAMD_SERIES_10 0x02
71 #define SAMD_SERIES_11 0x03
72 #define SAMD_SERIES_09 0x04
74 /* Device ID macros */
75 #define SAMD_GET_PROCESSOR(id) (id >> 28)
76 #define SAMD_GET_FAMILY(id) (((id >> 23) & 0x1F))
77 #define SAMD_GET_SERIES(id) (((id >> 16) & 0x3F))
78 #define SAMD_GET_DEVSEL(id) (id & 0xFF)
80 /* Bits to mask out lockbits in user row */
81 #define NVMUSERROW_LOCKBIT_MASK ((uint64_t)0x0000FFFFFFFFFFFF)
90 /* Known SAMD09 parts. DID reset values missing in RM, see
91 * https://github.com/avrxml/asf/blob/master/sam0/utils/cmsis/samd09/include/ */
92 static const struct samd_part samd09_parts
[] = {
93 { 0x0, "SAMD09D14A", 16, 4 },
94 { 0x7, "SAMD09C13A", 8, 4 },
97 /* Known SAMD10 parts */
98 static const struct samd_part samd10_parts
[] = {
99 { 0x0, "SAMD10D14AMU", 16, 4 },
100 { 0x1, "SAMD10D13AMU", 8, 4 },
101 { 0x2, "SAMD10D12AMU", 4, 4 },
102 { 0x3, "SAMD10D14ASU", 16, 4 },
103 { 0x4, "SAMD10D13ASU", 8, 4 },
104 { 0x5, "SAMD10D12ASU", 4, 4 },
105 { 0x6, "SAMD10C14A", 16, 4 },
106 { 0x7, "SAMD10C13A", 8, 4 },
107 { 0x8, "SAMD10C12A", 4, 4 },
110 /* Known SAMD11 parts */
111 static const struct samd_part samd11_parts
[] = {
112 { 0x0, "SAMD11D14AM", 16, 4 },
113 { 0x1, "SAMD11D13AMU", 8, 4 },
114 { 0x2, "SAMD11D12AMU", 4, 4 },
115 { 0x3, "SAMD11D14ASS", 16, 4 },
116 { 0x4, "SAMD11D13ASU", 8, 4 },
117 { 0x5, "SAMD11D12ASU", 4, 4 },
118 { 0x6, "SAMD11C14A", 16, 4 },
119 { 0x7, "SAMD11C13A", 8, 4 },
120 { 0x8, "SAMD11C12A", 4, 4 },
121 { 0x9, "SAMD11D14AU", 16, 4 },
124 /* Known SAMD20 parts. See Table 12-8 in 42129F–SAM–10/2013 */
125 static const struct samd_part samd20_parts
[] = {
126 { 0x0, "SAMD20J18A", 256, 32 },
127 { 0x1, "SAMD20J17A", 128, 16 },
128 { 0x2, "SAMD20J16A", 64, 8 },
129 { 0x3, "SAMD20J15A", 32, 4 },
130 { 0x4, "SAMD20J14A", 16, 2 },
131 { 0x5, "SAMD20G18A", 256, 32 },
132 { 0x6, "SAMD20G17A", 128, 16 },
133 { 0x7, "SAMD20G16A", 64, 8 },
134 { 0x8, "SAMD20G15A", 32, 4 },
135 { 0x9, "SAMD20G14A", 16, 2 },
136 { 0xA, "SAMD20E18A", 256, 32 },
137 { 0xB, "SAMD20E17A", 128, 16 },
138 { 0xC, "SAMD20E16A", 64, 8 },
139 { 0xD, "SAMD20E15A", 32, 4 },
140 { 0xE, "SAMD20E14A", 16, 2 },
143 /* Known SAMD21 parts. */
144 static const struct samd_part samd21_parts
[] = {
145 { 0x0, "SAMD21J18A", 256, 32 },
146 { 0x1, "SAMD21J17A", 128, 16 },
147 { 0x2, "SAMD21J16A", 64, 8 },
148 { 0x3, "SAMD21J15A", 32, 4 },
149 { 0x4, "SAMD21J14A", 16, 2 },
150 { 0x5, "SAMD21G18A", 256, 32 },
151 { 0x6, "SAMD21G17A", 128, 16 },
152 { 0x7, "SAMD21G16A", 64, 8 },
153 { 0x8, "SAMD21G15A", 32, 4 },
154 { 0x9, "SAMD21G14A", 16, 2 },
155 { 0xA, "SAMD21E18A", 256, 32 },
156 { 0xB, "SAMD21E17A", 128, 16 },
157 { 0xC, "SAMD21E16A", 64, 8 },
158 { 0xD, "SAMD21E15A", 32, 4 },
159 { 0xE, "SAMD21E14A", 16, 2 },
161 /* SAMR21 parts have integrated SAMD21 with a radio */
162 { 0x18, "SAMR21G19A", 256, 32 }, /* with 512k of serial flash */
163 { 0x19, "SAMR21G18A", 256, 32 },
164 { 0x1A, "SAMR21G17A", 128, 32 },
165 { 0x1B, "SAMR21G16A", 64, 16 },
166 { 0x1C, "SAMR21E18A", 256, 32 },
167 { 0x1D, "SAMR21E17A", 128, 32 },
168 { 0x1E, "SAMR21E16A", 64, 16 },
170 /* SAMD21 B Variants (Table 3-7 from rev I of datasheet) */
171 { 0x20, "SAMD21J16B", 64, 8 },
172 { 0x21, "SAMD21J15B", 32, 4 },
173 { 0x23, "SAMD21G16B", 64, 8 },
174 { 0x24, "SAMD21G15B", 32, 4 },
175 { 0x26, "SAMD21E16B", 64, 8 },
176 { 0x27, "SAMD21E15B", 32, 4 },
178 /* SAMD21 D and L Variants (from Errata)
179 http://ww1.microchip.com/downloads/en/DeviceDoc/
180 SAM-D21-Family-Silicon-Errata-and-DataSheet-Clarification-DS80000760D.pdf */
181 { 0x55, "SAMD21E16BU", 64, 8 },
182 { 0x56, "SAMD21E15BU", 32, 4 },
183 { 0x57, "SAMD21G16L", 64, 8 },
184 { 0x3E, "SAMD21E16L", 64, 8 },
185 { 0x3F, "SAMD21E15L", 32, 4 },
186 { 0x62, "SAMD21E16CU", 64, 8 },
187 { 0x63, "SAMD21E15CU", 32, 4 },
188 { 0x92, "SAMD21J17D", 128, 16 },
189 { 0x93, "SAMD21G17D", 128, 16 },
190 { 0x94, "SAMD21E17D", 128, 16 },
191 { 0x95, "SAMD21E17DU", 128, 16 },
192 { 0x96, "SAMD21G17L", 128, 16 },
193 { 0x97, "SAMD21E17L", 128, 16 },
195 /* Known SAMDA1 parts.
196 SAMD-A1 series uses the same series identifier like the SAMD21
197 taken from http://ww1.microchip.com/downloads/en/DeviceDoc/40001895A.pdf (pages 14-17) */
198 { 0x29, "SAMDA1J16A", 64, 8 },
199 { 0x2A, "SAMDA1J15A", 32, 4 },
200 { 0x2B, "SAMDA1J14A", 16, 4 },
201 { 0x2C, "SAMDA1G16A", 64, 8 },
202 { 0x2D, "SAMDA1G15A", 32, 4 },
203 { 0x2E, "SAMDA1G14A", 16, 4 },
204 { 0x2F, "SAMDA1E16A", 64, 8 },
205 { 0x30, "SAMDA1E15A", 32, 4 },
206 { 0x31, "SAMDA1E14A", 16, 4 },
207 { 0x64, "SAMDA1J16B", 64, 8 },
208 { 0x65, "SAMDA1J15B", 32, 4 },
209 { 0x66, "SAMDA1J14B", 16, 4 },
210 { 0x67, "SAMDA1G16B", 64, 8 },
211 { 0x68, "SAMDA1G15B", 32, 4 },
212 { 0x69, "SAMDA1G14B", 16, 4 },
213 { 0x6A, "SAMDA1E16B", 64, 8 },
214 { 0x6B, "SAMDA1E15B", 32, 4 },
215 { 0x6C, "SAMDA1E14B", 16, 4 },
218 /* Known SAML21 parts. */
219 static const struct samd_part saml21_parts
[] = {
220 { 0x00, "SAML21J18A", 256, 32 },
221 { 0x01, "SAML21J17A", 128, 16 },
222 { 0x02, "SAML21J16A", 64, 8 },
223 { 0x05, "SAML21G18A", 256, 32 },
224 { 0x06, "SAML21G17A", 128, 16 },
225 { 0x07, "SAML21G16A", 64, 8 },
226 { 0x0A, "SAML21E18A", 256, 32 },
227 { 0x0B, "SAML21E17A", 128, 16 },
228 { 0x0C, "SAML21E16A", 64, 8 },
229 { 0x0D, "SAML21E15A", 32, 4 },
230 { 0x0F, "SAML21J18B", 256, 32 },
231 { 0x10, "SAML21J17B", 128, 16 },
232 { 0x11, "SAML21J16B", 64, 8 },
233 { 0x14, "SAML21G18B", 256, 32 },
234 { 0x15, "SAML21G17B", 128, 16 },
235 { 0x16, "SAML21G16B", 64, 8 },
236 { 0x19, "SAML21E18B", 256, 32 },
237 { 0x1A, "SAML21E17B", 128, 16 },
238 { 0x1B, "SAML21E16B", 64, 8 },
239 { 0x1C, "SAML21E15B", 32, 4 },
241 /* SAMR30 parts have integrated SAML21 with a radio */
242 { 0x1E, "SAMR30G18A", 256, 32 },
243 { 0x1F, "SAMR30E18A", 256, 32 },
245 /* SAMR34/R35 parts have integrated SAML21 with a lora radio */
246 { 0x28, "SAMR34J18", 256, 40 },
247 { 0x2B, "SAMR35J18", 256, 40 },
250 /* Known SAML22 parts. */
251 static const struct samd_part saml22_parts
[] = {
252 { 0x00, "SAML22N18A", 256, 32 },
253 { 0x01, "SAML22N17A", 128, 16 },
254 { 0x02, "SAML22N16A", 64, 8 },
255 { 0x05, "SAML22J18A", 256, 32 },
256 { 0x06, "SAML22J17A", 128, 16 },
257 { 0x07, "SAML22J16A", 64, 8 },
258 { 0x0A, "SAML22G18A", 256, 32 },
259 { 0x0B, "SAML22G17A", 128, 16 },
260 { 0x0C, "SAML22G16A", 64, 8 },
263 /* Known SAMC20 parts. */
264 static const struct samd_part samc20_parts
[] = {
265 { 0x00, "SAMC20J18A", 256, 32 },
266 { 0x01, "SAMC20J17A", 128, 16 },
267 { 0x02, "SAMC20J16A", 64, 8 },
268 { 0x03, "SAMC20J15A", 32, 4 },
269 { 0x05, "SAMC20G18A", 256, 32 },
270 { 0x06, "SAMC20G17A", 128, 16 },
271 { 0x07, "SAMC20G16A", 64, 8 },
272 { 0x08, "SAMC20G15A", 32, 4 },
273 { 0x0A, "SAMC20E18A", 256, 32 },
274 { 0x0B, "SAMC20E17A", 128, 16 },
275 { 0x0C, "SAMC20E16A", 64, 8 },
276 { 0x0D, "SAMC20E15A", 32, 4 },
277 { 0x20, "SAMC20N18A", 256, 32 },
278 { 0x21, "SAMC20N17A", 128, 16 },
281 /* Known SAMC21 parts. */
282 static const struct samd_part samc21_parts
[] = {
283 { 0x00, "SAMC21J18A", 256, 32 },
284 { 0x01, "SAMC21J17A", 128, 16 },
285 { 0x02, "SAMC21J16A", 64, 8 },
286 { 0x03, "SAMC21J15A", 32, 4 },
287 { 0x05, "SAMC21G18A", 256, 32 },
288 { 0x06, "SAMC21G17A", 128, 16 },
289 { 0x07, "SAMC21G16A", 64, 8 },
290 { 0x08, "SAMC21G15A", 32, 4 },
291 { 0x0A, "SAMC21E18A", 256, 32 },
292 { 0x0B, "SAMC21E17A", 128, 16 },
293 { 0x0C, "SAMC21E16A", 64, 8 },
294 { 0x0D, "SAMC21E15A", 32, 4 },
295 { 0x20, "SAMC21N18A", 256, 32 },
296 { 0x21, "SAMC21N17A", 128, 16 },
299 /* Each family of parts contains a parts table in the DEVSEL field of DID. The
300 * processor ID, family ID, and series ID are used to determine which exact
301 * family this is and then we can use the corresponding table. */
306 const struct samd_part
*parts
;
308 uint64_t nvm_userrow_res_mask
; /* protect bits which are reserved, 0 -> protect */
311 /* Known SAMD families */
312 static const struct samd_family samd_families
[] = {
313 { SAMD_PROCESSOR_M0
, SAMD_FAMILY_D
, SAMD_SERIES_20
,
314 samd20_parts
, ARRAY_SIZE(samd20_parts
),
315 (uint64_t)0xFFFF01FFFE01FF77 },
316 { SAMD_PROCESSOR_M0
, SAMD_FAMILY_D
, SAMD_SERIES_21
,
317 samd21_parts
, ARRAY_SIZE(samd21_parts
),
318 (uint64_t)0xFFFF01FFFE01FF77 },
319 { SAMD_PROCESSOR_M0
, SAMD_FAMILY_D
, SAMD_SERIES_09
,
320 samd09_parts
, ARRAY_SIZE(samd09_parts
),
321 (uint64_t)0xFFFF01FFFE01FF77 },
322 { SAMD_PROCESSOR_M0
, SAMD_FAMILY_D
, SAMD_SERIES_10
,
323 samd10_parts
, ARRAY_SIZE(samd10_parts
),
324 (uint64_t)0xFFFF01FFFE01FF77 },
325 { SAMD_PROCESSOR_M0
, SAMD_FAMILY_D
, SAMD_SERIES_11
,
326 samd11_parts
, ARRAY_SIZE(samd11_parts
),
327 (uint64_t)0xFFFF01FFFE01FF77 },
328 { SAMD_PROCESSOR_M0
, SAMD_FAMILY_L
, SAMD_SERIES_21
,
329 saml21_parts
, ARRAY_SIZE(saml21_parts
),
330 (uint64_t)0xFFFF03FFFC01FF77 },
331 { SAMD_PROCESSOR_M0
, SAMD_FAMILY_L
, SAMD_SERIES_22
,
332 saml22_parts
, ARRAY_SIZE(saml22_parts
),
333 (uint64_t)0xFFFF03FFFC01FF77 },
334 { SAMD_PROCESSOR_M0
, SAMD_FAMILY_C
, SAMD_SERIES_20
,
335 samc20_parts
, ARRAY_SIZE(samc20_parts
),
336 (uint64_t)0xFFFF03FFFC01FF77 },
337 { SAMD_PROCESSOR_M0
, SAMD_FAMILY_C
, SAMD_SERIES_21
,
338 samc21_parts
, ARRAY_SIZE(samc21_parts
),
339 (uint64_t)0xFFFF03FFFC01FF77 },
349 struct target
*target
;
354 * Gives the family structure to specific device id.
355 * @param id The id of the device.
356 * @return On failure NULL, otherwise a pointer to the structure.
358 static const struct samd_family
*samd_find_family(uint32_t id
)
360 uint8_t processor
= SAMD_GET_PROCESSOR(id
);
361 uint8_t family
= SAMD_GET_FAMILY(id
);
362 uint8_t series
= SAMD_GET_SERIES(id
);
364 for (unsigned i
= 0; i
< ARRAY_SIZE(samd_families
); i
++) {
365 if (samd_families
[i
].processor
== processor
&&
366 samd_families
[i
].series
== series
&&
367 samd_families
[i
].family
== family
)
368 return &samd_families
[i
];
375 * Gives the part structure to specific device id.
376 * @param id The id of the device.
377 * @return On failure NULL, otherwise a pointer to the structure.
379 static const struct samd_part
*samd_find_part(uint32_t id
)
381 uint8_t devsel
= SAMD_GET_DEVSEL(id
);
382 const struct samd_family
*family
= samd_find_family(id
);
386 for (unsigned i
= 0; i
< family
->num_parts
; i
++) {
387 if (family
->parts
[i
].id
== devsel
)
388 return &family
->parts
[i
];
394 static int samd_protect_check(struct flash_bank
*bank
)
399 res
= target_read_u16(bank
->target
,
400 SAMD_NVMCTRL
+ SAMD_NVMCTRL_LOCK
, &lock
);
404 /* Lock bits are active-low */
405 for (unsigned int prot_block
= 0; prot_block
< bank
->num_prot_blocks
; prot_block
++)
406 bank
->prot_blocks
[prot_block
].is_protected
= !(lock
& (1u<<prot_block
));
411 static int samd_get_flash_page_info(struct target
*target
,
412 uint32_t *sizep
, int *nump
)
417 res
= target_read_u32(target
, SAMD_NVMCTRL
+ SAMD_NVMCTRL_PARAM
, ¶m
);
418 if (res
== ERROR_OK
) {
419 /* The PSZ field (bits 18:16) indicate the page size bytes as 2^(3+n)
420 * so 0 is 8KB and 7 is 1024KB. */
422 *sizep
= (8 << ((param
>> 16) & 0x7));
423 /* The NVMP field (bits 15:0) indicates the total number of pages */
425 *nump
= param
& 0xFFFF;
427 LOG_ERROR("Couldn't read NVM Parameters register");
433 static int samd_probe(struct flash_bank
*bank
)
437 struct samd_info
*chip
= (struct samd_info
*)bank
->driver_priv
;
438 const struct samd_part
*part
;
443 res
= target_read_u32(bank
->target
, SAMD_DSU
+ SAMD_DSU_DID
, &id
);
444 if (res
!= ERROR_OK
) {
445 LOG_ERROR("Couldn't read Device ID register");
449 part
= samd_find_part(id
);
451 LOG_ERROR("Couldn't find part corresponding to DID %08" PRIx32
, id
);
455 bank
->size
= part
->flash_kb
* 1024;
457 res
= samd_get_flash_page_info(bank
->target
, &chip
->page_size
,
459 if (res
!= ERROR_OK
) {
460 LOG_ERROR("Couldn't determine Flash page size");
464 /* Sanity check: the total flash size in the DSU should match the page size
465 * multiplied by the number of pages. */
466 if (bank
->size
!= chip
->num_pages
* chip
->page_size
) {
467 LOG_WARNING("SAMD: bank size doesn't match NVM parameters. "
468 "Identified %" PRIu32
"KB Flash but NVMCTRL reports %u %" PRIu32
"B pages",
469 part
->flash_kb
, chip
->num_pages
, chip
->page_size
);
472 /* Erase granularity = 1 row = 4 pages */
473 chip
->sector_size
= chip
->page_size
* 4;
475 /* Allocate the sector table */
476 bank
->num_sectors
= chip
->num_pages
/ 4;
477 bank
->sectors
= alloc_block_array(0, chip
->sector_size
, bank
->num_sectors
);
481 /* 16 protection blocks per device */
482 chip
->prot_block_size
= bank
->size
/ SAMD_NUM_PROT_BLOCKS
;
484 /* Allocate the table of protection blocks */
485 bank
->num_prot_blocks
= SAMD_NUM_PROT_BLOCKS
;
486 bank
->prot_blocks
= alloc_block_array(0, chip
->prot_block_size
, bank
->num_prot_blocks
);
487 if (!bank
->prot_blocks
)
490 samd_protect_check(bank
);
495 LOG_INFO("SAMD MCU: %s (%" PRIu32
"KB Flash, %" PRIu32
"KB RAM)", part
->name
,
496 part
->flash_kb
, part
->ram_kb
);
501 static int samd_check_error(struct target
*target
)
506 int timeout_ms
= 1000;
507 int64_t ts_start
= timeval_ms();
510 ret
= target_read_u8(target
,
511 SAMD_NVMCTRL
+ SAMD_NVMCTRL_INTFLAG
, &intflag
);
512 if (ret
!= ERROR_OK
) {
513 LOG_ERROR("Can't read NVM intflag");
516 if (intflag
& SAMD_NVM_INTFLAG_READY
)
519 } while (timeval_ms() - ts_start
< timeout_ms
);
521 if (!(intflag
& SAMD_NVM_INTFLAG_READY
)) {
522 LOG_ERROR("SAMD: NVM programming timed out");
523 return ERROR_FLASH_OPERATION_FAILED
;
526 ret
= target_read_u16(target
,
527 SAMD_NVMCTRL
+ SAMD_NVMCTRL_STATUS
, &status
);
528 if (ret
!= ERROR_OK
) {
529 LOG_ERROR("Can't read NVM status");
533 if ((status
& 0x001C) == 0)
536 if (status
& (1 << 4)) { /* NVME */
537 LOG_ERROR("SAMD: NVM Error");
538 ret
= ERROR_FLASH_OPERATION_FAILED
;
541 if (status
& (1 << 3)) { /* LOCKE */
542 LOG_ERROR("SAMD: NVM lock error");
543 ret
= ERROR_FLASH_PROTECTED
;
546 if (status
& (1 << 2)) { /* PROGE */
547 LOG_ERROR("SAMD: NVM programming error");
548 ret
= ERROR_FLASH_OPER_UNSUPPORTED
;
551 /* Clear the error conditions by writing a one to them */
552 ret2
= target_write_u16(target
,
553 SAMD_NVMCTRL
+ SAMD_NVMCTRL_STATUS
, status
);
554 if (ret2
!= ERROR_OK
)
555 LOG_ERROR("Can't clear NVM error conditions");
560 static int samd_issue_nvmctrl_command(struct target
*target
, uint16_t cmd
)
564 if (target
->state
!= TARGET_HALTED
) {
565 LOG_ERROR("Target not halted");
566 return ERROR_TARGET_NOT_HALTED
;
569 /* Issue the NVM command */
570 /* 32-bit write is used to ensure atomic operation on ST-Link */
571 res
= target_write_u32(target
,
572 SAMD_NVMCTRL
+ SAMD_NVMCTRL_CTRLA
, SAMD_NVM_CMD(cmd
));
576 /* Check to see if the NVM command resulted in an error condition. */
577 return samd_check_error(target
);
581 * Erases a flash-row at the given address.
582 * @param target Pointer to the target structure.
583 * @param address The address of the row.
584 * @return On success ERROR_OK, on failure an errorcode.
586 static int samd_erase_row(struct target
*target
, uint32_t address
)
590 /* Set an address contained in the row to be erased */
591 res
= target_write_u32(target
,
592 SAMD_NVMCTRL
+ SAMD_NVMCTRL_ADDR
, address
>> 1);
594 /* Issue the Erase Row command to erase that row. */
596 res
= samd_issue_nvmctrl_command(target
,
597 address
== SAMD_USER_ROW
? SAMD_NVM_CMD_EAR
: SAMD_NVM_CMD_ER
);
599 if (res
!= ERROR_OK
) {
600 LOG_ERROR("Failed to erase row containing %08" PRIx32
, address
);
608 * Returns the bitmask of reserved bits in register.
609 * @param target Pointer to the target structure.
610 * @param mask Bitmask, 0 -> value stays untouched.
611 * @return On success ERROR_OK, on failure an errorcode.
613 static int samd_get_reservedmask(struct target
*target
, uint64_t *mask
)
616 /* Get the devicetype */
618 res
= target_read_u32(target
, SAMD_DSU
+ SAMD_DSU_DID
, &id
);
619 if (res
!= ERROR_OK
) {
620 LOG_ERROR("Couldn't read Device ID register");
623 const struct samd_family
*family
;
624 family
= samd_find_family(id
);
626 LOG_ERROR("Couldn't determine device family");
629 *mask
= family
->nvm_userrow_res_mask
;
633 static int read_userrow(struct target
*target
, uint64_t *userrow
)
638 res
= target_read_memory(target
, SAMD_USER_ROW
, 4, 2, buffer
);
642 *userrow
= target_buffer_get_u64(target
, buffer
);
647 * Modify the contents of the User Row in Flash. The User Row itself
648 * has a size of one page and contains a combination of "fuses" and
649 * calibration data. Bits which have a value of zero in the mask will
650 * not be changed. Up to now devices only use the first 64 bits.
651 * @param target Pointer to the target structure.
652 * @param value_input The value to write.
653 * @param value_mask Bitmask, 0 -> value stays untouched.
654 * @return On success ERROR_OK, on failure an errorcode.
656 static int samd_modify_user_row_masked(struct target
*target
,
657 uint64_t value_input
, uint64_t value_mask
)
661 bool manual_wp
= true;
663 /* Retrieve the MCU's page size, in bytes. This is also the size of the
664 * entire User Row. */
666 res
= samd_get_flash_page_info(target
, &page_size
, NULL
);
667 if (res
!= ERROR_OK
) {
668 LOG_ERROR("Couldn't determine Flash page size");
672 /* Make sure the size is sane. */
673 assert(page_size
<= SAMD_PAGE_SIZE_MAX
&&
674 page_size
>= sizeof(value_input
));
676 uint8_t buf
[SAMD_PAGE_SIZE_MAX
];
677 /* Read the user row (comprising one page) by words. */
678 res
= target_read_memory(target
, SAMD_USER_ROW
, 4, page_size
/ 4, buf
);
682 uint64_t value_device
;
683 res
= read_userrow(target
, &value_device
);
686 uint64_t value_new
= (value_input
& value_mask
) | (value_device
& ~value_mask
);
688 /* We will need to erase before writing if the new value needs a '1' in any
689 * position for which the current value had a '0'. Otherwise we can avoid
691 if ((~value_device
) & value_new
) {
692 res
= samd_erase_row(target
, SAMD_USER_ROW
);
693 if (res
!= ERROR_OK
) {
694 LOG_ERROR("Couldn't erase user row");
700 target_buffer_set_u64(target
, buf
, value_new
);
702 /* Write the page buffer back out to the target. */
703 res
= target_write_memory(target
, SAMD_USER_ROW
, 4, page_size
/ 4, buf
);
707 /* Check if we need to do manual page write commands */
708 res
= target_read_u32(target
, SAMD_NVMCTRL
+ SAMD_NVMCTRL_CTRLB
, &nvm_ctrlb
);
710 manual_wp
= (nvm_ctrlb
& SAMD_NVM_CTRLB_MANW
) != 0;
712 LOG_ERROR("Read of NVM register CTRKB failed.");
716 /* Trigger flash write */
717 res
= samd_issue_nvmctrl_command(target
, SAMD_NVM_CMD_WAP
);
719 res
= samd_check_error(target
);
726 * Modifies the user row register to the given value.
727 * @param target Pointer to the target structure.
728 * @param value The value to write.
729 * @param startb The bit-offset by which the given value is shifted.
730 * @param endb The bit-offset of the last bit in value to write.
731 * @return On success ERROR_OK, on failure an errorcode.
733 static int samd_modify_user_row(struct target
*target
, uint64_t value
,
734 uint8_t startb
, uint8_t endb
)
738 for (i
= startb
; i
<= endb
; i
++)
739 mask
|= ((uint64_t)1) << i
;
741 return samd_modify_user_row_masked(target
, value
<< startb
, mask
);
744 static int samd_protect(struct flash_bank
*bank
, int set
,
745 unsigned int first
, unsigned int last
)
749 /* We can issue lock/unlock region commands with the target running but
750 * the settings won't persist unless we're able to modify the LOCK regions
751 * and that requires the target to be halted. */
752 if (bank
->target
->state
!= TARGET_HALTED
) {
753 LOG_ERROR("Target not halted");
754 return ERROR_TARGET_NOT_HALTED
;
757 for (unsigned int prot_block
= first
; prot_block
<= last
; prot_block
++) {
758 if (set
!= bank
->prot_blocks
[prot_block
].is_protected
) {
759 /* Load an address that is within this protection block (we use offset 0) */
760 res
= target_write_u32(bank
->target
,
761 SAMD_NVMCTRL
+ SAMD_NVMCTRL_ADDR
,
762 bank
->prot_blocks
[prot_block
].offset
>> 1);
766 /* Tell the controller to lock that block */
767 res
= samd_issue_nvmctrl_command(bank
->target
,
768 set
? SAMD_NVM_CMD_LR
: SAMD_NVM_CMD_UR
);
774 /* We've now applied our changes, however they will be undone by the next
775 * reset unless we also apply them to the LOCK bits in the User Page. The
776 * LOCK bits start at bit 48, corresponding to Sector 0 and end with bit 63,
777 * corresponding to Sector 15. A '1' means unlocked and a '0' means
778 * locked. See Table 9-3 in the SAMD20 datasheet for more details. */
780 res
= samd_modify_user_row(bank
->target
,
781 set
? (uint64_t)0 : (uint64_t)UINT64_MAX
,
782 48 + first
, 48 + last
);
784 LOG_WARNING("SAMD: protect settings were not made persistent!");
789 samd_protect_check(bank
);
794 static int samd_erase(struct flash_bank
*bank
, unsigned int first
,
798 struct samd_info
*chip
= (struct samd_info
*)bank
->driver_priv
;
800 if (bank
->target
->state
!= TARGET_HALTED
) {
801 LOG_ERROR("Target not halted");
803 return ERROR_TARGET_NOT_HALTED
;
807 if (samd_probe(bank
) != ERROR_OK
)
808 return ERROR_FLASH_BANK_NOT_PROBED
;
811 /* For each sector to be erased */
812 for (unsigned int s
= first
; s
<= last
; s
++) {
813 res
= samd_erase_row(bank
->target
, bank
->sectors
[s
].offset
);
814 if (res
!= ERROR_OK
) {
815 LOG_ERROR("SAMD: failed to erase sector %d at 0x%08" PRIx32
, s
, bank
->sectors
[s
].offset
);
824 static int samd_write(struct flash_bank
*bank
, const uint8_t *buffer
,
825 uint32_t offset
, uint32_t count
)
833 struct samd_info
*chip
= (struct samd_info
*)bank
->driver_priv
;
837 if (bank
->target
->state
!= TARGET_HALTED
) {
838 LOG_ERROR("Target not halted");
839 return ERROR_TARGET_NOT_HALTED
;
843 if (samd_probe(bank
) != ERROR_OK
)
844 return ERROR_FLASH_BANK_NOT_PROBED
;
847 /* Check if we need to do manual page write commands */
848 res
= target_read_u32(bank
->target
, SAMD_NVMCTRL
+ SAMD_NVMCTRL_CTRLB
, &nvm_ctrlb
);
853 if (nvm_ctrlb
& SAMD_NVM_CTRLB_MANW
)
858 res
= samd_issue_nvmctrl_command(bank
->target
, SAMD_NVM_CMD_PBC
);
859 if (res
!= ERROR_OK
) {
860 LOG_ERROR("%s: %d", __func__
, __LINE__
);
865 nb
= chip
->page_size
- offset
% chip
->page_size
;
869 address
= bank
->base
+ offset
;
870 pg_offset
= offset
% chip
->page_size
;
872 if (offset
% 4 || (offset
+ nb
) % 4) {
873 /* Either start or end of write is not word aligned */
875 pb
= malloc(chip
->page_size
);
880 /* Set temporary page buffer to 0xff and overwrite the relevant part */
881 memset(pb
, 0xff, chip
->page_size
);
882 memcpy(pb
+ pg_offset
, buffer
, nb
);
884 /* Align start address to a word boundary */
885 address
-= offset
% 4;
886 pg_offset
-= offset
% 4;
887 assert(pg_offset
% 4 == 0);
889 /* Extend length to whole words */
890 nw
= (nb
+ offset
% 4 + 3) / 4;
891 assert(pg_offset
+ 4 * nw
<= chip
->page_size
);
893 /* Now we have original data extended by 0xff bytes
894 * to the nearest word boundary on both start and end */
895 res
= target_write_memory(bank
->target
, address
, 4, nw
, pb
+ pg_offset
);
899 assert(pg_offset
+ 4 * nw
<= chip
->page_size
);
901 /* Word aligned data, use direct write from buffer */
902 res
= target_write_memory(bank
->target
, address
, 4, nw
, buffer
);
904 if (res
!= ERROR_OK
) {
905 LOG_ERROR("%s: %d", __func__
, __LINE__
);
909 /* Devices with errata 13134 have automatic page write enabled by default
910 * For other devices issue a write page CMD to the NVM
911 * If the page has not been written up to the last word
912 * then issue CMD_WP always */
913 if (manual_wp
|| pg_offset
+ 4 * nw
< chip
->page_size
) {
914 res
= samd_issue_nvmctrl_command(bank
->target
, SAMD_NVM_CMD_WP
);
916 /* Access through AHB is stalled while flash is being programmed */
919 res
= samd_check_error(bank
->target
);
922 if (res
!= ERROR_OK
) {
923 LOG_ERROR("%s: write failed at address 0x%08" PRIx32
, __func__
, address
);
927 /* We're done with the page contents */
938 FLASH_BANK_COMMAND_HANDLER(samd_flash_bank_command
)
940 if (bank
->base
!= SAMD_FLASH
) {
941 LOG_ERROR("Address " TARGET_ADDR_FMT
942 " invalid bank address (try 0x%08" PRIx32
943 "[at91samd series] )",
944 bank
->base
, SAMD_FLASH
);
948 struct samd_info
*chip
;
949 chip
= calloc(1, sizeof(*chip
));
951 LOG_ERROR("No memory for flash bank chip info");
955 chip
->target
= bank
->target
;
956 chip
->probed
= false;
958 bank
->driver_priv
= chip
;
963 COMMAND_HANDLER(samd_handle_chip_erase_command
)
965 struct target
*target
= get_current_target(CMD_CTX
);
966 int res
= ERROR_FAIL
;
969 /* Enable access to the DSU by disabling the write protect bit */
970 target_write_u32(target
, SAMD_PAC1
, (1<<1));
971 /* intentionally without error checking - not accessible on secured chip */
973 /* Tell the DSU to perform a full chip erase. It takes about 240ms to
974 * perform the erase. */
975 res
= target_write_u8(target
, SAMD_DSU
+ SAMD_DSU_CTRL_EXT
, (1<<4));
977 command_print(CMD
, "chip erase started");
979 command_print(CMD
, "write to DSU CTRL failed");
985 COMMAND_HANDLER(samd_handle_set_security_command
)
988 struct target
*target
= get_current_target(CMD_CTX
);
990 if (CMD_ARGC
< 1 || (CMD_ARGC
>= 1 && (strcmp(CMD_ARGV
[0], "enable")))) {
991 command_print(CMD
, "supply the \"enable\" argument to proceed.");
992 return ERROR_COMMAND_SYNTAX_ERROR
;
996 if (target
->state
!= TARGET_HALTED
) {
997 LOG_ERROR("Target not halted");
998 return ERROR_TARGET_NOT_HALTED
;
1001 res
= samd_issue_nvmctrl_command(target
, SAMD_NVM_CMD_SSB
);
1003 /* Check (and clear) error conditions */
1004 if (res
== ERROR_OK
)
1005 command_print(CMD
, "chip secured on next power-cycle");
1007 command_print(CMD
, "failed to secure chip");
1013 COMMAND_HANDLER(samd_handle_eeprom_command
)
1016 struct target
*target
= get_current_target(CMD_CTX
);
1019 if (target
->state
!= TARGET_HALTED
) {
1020 LOG_ERROR("Target not halted");
1021 return ERROR_TARGET_NOT_HALTED
;
1024 if (CMD_ARGC
>= 1) {
1025 int val
= atoi(CMD_ARGV
[0]);
1031 /* Try to match size in bytes with corresponding size code */
1032 for (code
= 0; code
<= 6; code
++) {
1033 if (val
== (2 << (13 - code
)))
1038 command_print(CMD
, "Invalid EEPROM size. Please see "
1039 "datasheet for a list valid sizes.");
1040 return ERROR_COMMAND_SYNTAX_ERROR
;
1044 res
= samd_modify_user_row(target
, code
, 4, 6);
1047 res
= target_read_u16(target
, SAMD_USER_ROW
, &val
);
1048 if (res
== ERROR_OK
) {
1049 uint32_t size
= ((val
>> 4) & 0x7); /* grab size code */
1052 command_print(CMD
, "EEPROM is disabled");
1054 /* Otherwise, 6 is 256B, 0 is 16KB */
1055 command_print(CMD
, "EEPROM size is %u bytes",
1056 (2 << (13 - size
)));
1065 COMMAND_HANDLER(samd_handle_nvmuserrow_command
)
1068 struct target
*target
= get_current_target(CMD_CTX
);
1072 command_print(CMD
, "Too much Arguments given.");
1073 return ERROR_COMMAND_SYNTAX_ERROR
;
1077 if (target
->state
!= TARGET_HALTED
) {
1078 LOG_ERROR("Target not halted.");
1079 return ERROR_TARGET_NOT_HALTED
;
1083 res
= samd_get_reservedmask(target
, &mask
);
1084 if (res
!= ERROR_OK
) {
1085 LOG_ERROR("Couldn't determine the mask for reserved bits.");
1088 mask
&= NVMUSERROW_LOCKBIT_MASK
;
1091 COMMAND_PARSE_NUMBER(u64
, CMD_ARGV
[0], value
);
1093 if (CMD_ARGC
== 2) {
1095 COMMAND_PARSE_NUMBER(u64
, CMD_ARGV
[1], mask_temp
);
1099 res
= samd_modify_user_row_masked(target
, value
, mask
);
1100 if (res
!= ERROR_OK
)
1106 res
= read_userrow(target
, &value
);
1107 if (res
== ERROR_OK
)
1108 command_print(CMD
, "NVMUSERROW: 0x%016"PRIX64
, value
);
1110 LOG_ERROR("NVMUSERROW could not be read.");
1115 COMMAND_HANDLER(samd_handle_bootloader_command
)
1118 struct target
*target
= get_current_target(CMD_CTX
);
1121 if (target
->state
!= TARGET_HALTED
) {
1122 LOG_ERROR("Target not halted");
1123 return ERROR_TARGET_NOT_HALTED
;
1126 /* Retrieve the MCU's page size, in bytes. */
1128 res
= samd_get_flash_page_info(target
, &page_size
, NULL
);
1129 if (res
!= ERROR_OK
) {
1130 LOG_ERROR("Couldn't determine Flash page size");
1134 if (CMD_ARGC
>= 1) {
1135 int val
= atoi(CMD_ARGV
[0]);
1141 /* Try to match size in bytes with corresponding size code */
1142 for (code
= 0; code
<= 6; code
++) {
1143 if ((unsigned int)val
== (2UL << (8UL - code
)) * page_size
)
1148 command_print(CMD
, "Invalid bootloader size. Please "
1149 "see datasheet for a list valid sizes.");
1150 return ERROR_COMMAND_SYNTAX_ERROR
;
1155 res
= samd_modify_user_row(target
, code
, 0, 2);
1158 res
= target_read_u16(target
, SAMD_USER_ROW
, &val
);
1159 if (res
== ERROR_OK
) {
1160 uint32_t size
= (val
& 0x7); /* grab size code */
1166 nb
= (2 << (8 - size
)) * page_size
;
1168 /* There are 4 pages per row */
1169 command_print(CMD
, "Bootloader size is %" PRIu32
" bytes (%" PRIu32
" rows)",
1170 nb
, (uint32_t)(nb
/ (page_size
* 4)));
1180 COMMAND_HANDLER(samd_handle_reset_deassert
)
1182 struct target
*target
= get_current_target(CMD_CTX
);
1183 int retval
= ERROR_OK
;
1184 enum reset_types jtag_reset_config
= jtag_get_reset_config();
1186 /* If the target has been unresponsive before, try to re-establish
1187 * communication now - CPU is held in reset by DSU, DAP is working */
1188 if (!target_was_examined(target
))
1189 target_examine_one(target
);
1190 target_poll(target
);
1192 /* In case of sysresetreq, debug retains state set in cortex_m_assert_reset()
1193 * so we just release reset held by DSU
1195 * n_RESET (srst) clears the DP, so reenable debug and set vector catch here
1197 * After vectreset DSU release is not needed however makes no harm
1199 if (target
->reset_halt
&& (jtag_reset_config
& RESET_HAS_SRST
)) {
1200 retval
= target_write_u32(target
, DCB_DHCSR
, DBGKEY
| C_HALT
| C_DEBUGEN
);
1201 if (retval
== ERROR_OK
)
1202 retval
= target_write_u32(target
, DCB_DEMCR
,
1203 TRCENA
| VC_HARDERR
| VC_BUSERR
| VC_CORERESET
);
1204 /* do not return on error here, releasing DSU reset is more important */
1207 /* clear CPU Reset Phase Extension bit */
1208 int retval2
= target_write_u8(target
, SAMD_DSU
+ SAMD_DSU_STATUSA
, (1<<1));
1209 if (retval2
!= ERROR_OK
)
1215 static const struct command_registration at91samd_exec_command_handlers
[] = {
1217 .name
= "dsu_reset_deassert",
1218 .handler
= samd_handle_reset_deassert
,
1219 .mode
= COMMAND_EXEC
,
1220 .help
= "Deassert internal reset held by DSU.",
1224 .name
= "chip-erase",
1225 .handler
= samd_handle_chip_erase_command
,
1226 .mode
= COMMAND_EXEC
,
1227 .help
= "Erase the entire Flash by using the Chip-"
1228 "Erase feature in the Device Service Unit (DSU).",
1232 .name
= "set-security",
1233 .handler
= samd_handle_set_security_command
,
1234 .mode
= COMMAND_EXEC
,
1235 .help
= "Secure the chip's Flash by setting the Security Bit. "
1236 "This makes it impossible to read the Flash contents. "
1237 "The only way to undo this is to issue the chip-erase "
1239 .usage
= "'enable'",
1243 .usage
= "[size_in_bytes]",
1244 .handler
= samd_handle_eeprom_command
,
1245 .mode
= COMMAND_EXEC
,
1246 .help
= "Show or set the EEPROM size setting, stored in the User Row. "
1247 "Please see Table 20-3 of the SAMD20 datasheet for allowed values. "
1248 "Changes are stored immediately but take affect after the MCU is "
1252 .name
= "bootloader",
1253 .usage
= "[size_in_bytes]",
1254 .handler
= samd_handle_bootloader_command
,
1255 .mode
= COMMAND_EXEC
,
1256 .help
= "Show or set the bootloader size, stored in the User Row. "
1257 "Please see Table 20-2 of the SAMD20 datasheet for allowed values. "
1258 "Changes are stored immediately but take affect after the MCU is "
1262 .name
= "nvmuserrow",
1263 .usage
= "[value] [mask]",
1264 .handler
= samd_handle_nvmuserrow_command
,
1265 .mode
= COMMAND_EXEC
,
1266 .help
= "Show or set the nvmuserrow register. It is 64 bit wide "
1267 "and located at address 0x804000. Use the optional mask argument "
1268 "to prevent changes at positions where the bitvalue is zero. "
1269 "For security reasons the lock- and reserved-bits are masked out "
1270 "in background and therefore cannot be changed.",
1272 COMMAND_REGISTRATION_DONE
1275 static const struct command_registration at91samd_command_handlers
[] = {
1278 .mode
= COMMAND_ANY
,
1279 .help
= "at91samd flash command group",
1281 .chain
= at91samd_exec_command_handlers
,
1283 COMMAND_REGISTRATION_DONE
1286 const struct flash_driver at91samd_flash
= {
1288 .commands
= at91samd_command_handlers
,
1289 .flash_bank_command
= samd_flash_bank_command
,
1290 .erase
= samd_erase
,
1291 .protect
= samd_protect
,
1292 .write
= samd_write
,
1293 .read
= default_flash_read
,
1294 .probe
= samd_probe
,
1295 .auto_probe
= samd_probe
,
1296 .erase_check
= default_flash_blank_check
,
1297 .protect_check
= samd_protect_check
,
1298 .free_driver_priv
= default_flash_free_driver_priv
,