1 // SPDX-License-Identifier: GPL-2.0-or-later
3 /**************************************************************************
4 * Copyright (C) 2015 Jeff Ciesielski <jeffciesielski@gmail.com> *
5 ***************************************************************************/
12 #include <helper/binarybuffer.h>
13 #include <target/algorithm.h>
14 #include <target/armv7m.h>
16 /* Maximum number of sectors */
17 #define MAX_XMC_SECTORS 12
19 /* System control unit registers */
20 #define SCU_REG_BASE 0x50004000
22 #define SCU_ID_CHIP 0x04
24 /* Base of the non-cached flash memory */
25 #define PFLASH_BASE 0x0C000000
27 /* User configuration block offsets */
28 #define UCB0_BASE 0x00000000
29 #define UCB1_BASE 0x00000400
30 #define UCB2_BASE 0x00000800
32 /* Flash register base */
33 #define FLASH_REG_BASE 0x58000000
35 /* PMU ID Registers */
36 #define FLASH_REG_PMU_ID (FLASH_REG_BASE | 0x0508)
39 #define PMU_MOD_REV_MASK 0xFF
40 #define PMU_MOD_TYPE_MASK 0xFF00
41 #define PMU_MOD_NO_MASK 0xFFFF0000
44 #define FLASH_REG_PREF_PCON (FLASH_REG_BASE | 0x4000)
47 #define PCON_IBYP (1 << 0)
48 #define PCON_IINV (1 << 1)
50 /* Flash ID Register */
51 #define FLASH_REG_FLASH0_ID (FLASH_REG_BASE | 0x2008)
53 /* Flash Status Register */
54 #define FLASH_REG_FLASH0_FSR (FLASH_REG_BASE | 0x2010)
57 #define FSR_FABUSY (1)
60 #define FSR_PFPAGE (6)
61 #define FSR_PFOPER (8)
63 #define FSR_PROER (11)
64 #define FSR_PFSBER (12)
65 #define FSR_PFDBER (14)
66 #define FSR_PROIN (16)
67 #define FSR_RPROIN (18)
68 #define FSR_RPRODIS (19)
69 #define FSR_WPROIN0 (21)
70 #define FSR_WPROIN1 (22)
71 #define FSR_WPROIN2 (23)
72 #define FSR_WPRODIS0 (25)
73 #define FSR_WPRODIS1 (26)
77 #define FSR_PBUSY_MASK (0x01 << FSR_PBUSY)
78 #define FSR_FABUSY_MASK (0x01 << FSR_FABUSY)
79 #define FSR_PROG_MASK (0x01 << FSR_PROG)
80 #define FSR_ERASE_MASK (0x01 << FSR_ERASE)
81 #define FSR_PFPAGE_MASK (0x01 << FSR_PFPAGE)
82 #define FSR_PFOPER_MASK (0x01 << FSR_PFOPER)
83 #define FSR_SQER_MASK (0x01 << FSR_SQER)
84 #define FSR_PROER_MASK (0x01 << FSR_PROER)
85 #define FSR_PFSBER_MASK (0x01 << FSR_PFSBER)
86 #define FSR_PFDBER_MASK (0x01 << FSR_PFDBER)
87 #define FSR_PROIN_MASK (0x01 << FSR_PROIN)
88 #define FSR_RPROIN_MASK (0x01 << FSR_RPROIN)
89 #define FSR_RPRODIS_MASK (0x01 << FSR_RPRODIS)
90 #define FSR_WPROIN0_MASK (0x01 << FSR_WPROIN0)
91 #define FSR_WPROIN1_MASK (0x01 << FSR_WPROIN1)
92 #define FSR_WPROIN2_MASK (0x01 << FSR_WPROIN2)
93 #define FSR_WPRODIS0_MASK (0x01 << FSR_WPRODIS0)
94 #define FSR_WPRODIS1_MASK (0x01 << FSR_WPRODIS1)
95 #define FSR_SLM_MASK (0x01 << FSR_SLM)
96 #define FSR_VER_MASK (0x01 << FSR_VER)
98 /* Flash Config Register */
99 #define FLASH_REG_FLASH0_FCON (FLASH_REG_BASE | 0x2014)
101 #define FCON_WSPFLASH (0)
102 #define FCON_WSECPF (4)
103 #define FCON_IDLE (13)
104 #define FCON_ESLDIS (14)
105 #define FCON_SLEEP (15)
106 #define FCON_RPA (16)
107 #define FCON_DCF (17)
108 #define FCON_DDF (18)
109 #define FCON_VOPERM (24)
110 #define FCON_SQERM (25)
111 #define FCON_PROERM (26)
112 #define FCON_PFSBERM (27)
113 #define FCON_PFDBERM (29)
114 #define FCON_EOBM (31)
116 #define FCON_WSPFLASH_MASK (0x0f << FCON_WSPFLASH)
117 #define FCON_WSECPF_MASK (0x01 << FCON_WSECPF)
118 #define FCON_IDLE_MASK (0x01 << FCON_IDLE)
119 #define FCON_ESLDIS_MASK (0x01 << FCON_ESLDIS)
120 #define FCON_SLEEP_MASK (0x01 << FCON_SLEEP)
121 #define FCON_RPA_MASK (0x01 << FCON_RPA)
122 #define FCON_DCF_MASK (0x01 << FCON_DCF)
123 #define FCON_DDF_MASK (0x01 << FCON_DDF)
124 #define FCON_VOPERM_MASK (0x01 << FCON_VOPERM)
125 #define FCON_SQERM_MASK (0x01 << FCON_SQERM)
126 #define FCON_PROERM_MASK (0x01 << FCON_PROERM)
127 #define FCON_PFSBERM_MASK (0x01 << FCON_PFSBERM)
128 #define FCON_PFDBERM_MASK (0x01 << FCON_PFDBERM)
129 #define FCON_EOBM_MASK (0x01 << FCON_EOBM)
131 /* Flash Margin Control Register */
132 #define FLASH_REG_FLASH0_MARP (FLASH_REG_BASE | 0x2018)
134 #define MARP_MARGIN (0)
135 #define MARP_TRAPDIS (15)
137 #define MARP_MARGIN_MASK (0x0f << MARP_MARGIN)
138 #define MARP_TRAPDIS_MASK (0x01 << MARP_TRAPDIS)
140 /* Flash Protection Registers */
141 #define FLASH_REG_FLASH0_PROCON0 (FLASH_REG_BASE | 0x2020)
142 #define FLASH_REG_FLASH0_PROCON1 (FLASH_REG_BASE | 0x2024)
143 #define FLASH_REG_FLASH0_PROCON2 (FLASH_REG_BASE | 0x2028)
145 #define PROCON_S0L (0)
146 #define PROCON_S1L (1)
147 #define PROCON_S2L (2)
148 #define PROCON_S3L (3)
149 #define PROCON_S4L (4)
150 #define PROCON_S5L (5)
151 #define PROCON_S6L (6)
152 #define PROCON_S7L (7)
153 #define PROCON_S8L (8)
154 #define PROCON_S9L (9)
155 #define PROCON_S10_S11L (10)
156 #define PROCON_RPRO (15)
158 #define PROCON_S0L_MASK (0x01 << PROCON_S0L)
159 #define PROCON_S1L_MASK (0x01 << PROCON_S1L)
160 #define PROCON_S2L_MASK (0x01 << PROCON_S2L)
161 #define PROCON_S3L_MASK (0x01 << PROCON_S3L)
162 #define PROCON_S4L_MASK (0x01 << PROCON_S4L)
163 #define PROCON_S5L_MASK (0x01 << PROCON_S5L)
164 #define PROCON_S6L_MASK (0x01 << PROCON_S6L)
165 #define PROCON_S7L_MASK (0x01 << PROCON_S7L)
166 #define PROCON_S8L_MASK (0x01 << PROCON_S8L)
167 #define PROCON_S9L_MASK (0x01 << PROCON_S9L)
168 #define PROCON_S10_S11L_MASK (0x01 << PROCON_S10_S11L)
169 #define PROCON_RPRO_MASK (0x01 << PROCON_RPRO)
171 #define FLASH_PROTECT_CONFIRMATION_CODE 0x8AFE15C3
173 /* Flash controller configuration values */
174 #define FLASH_ID_XMC4500 0xA2
175 #define FLASH_ID_XMC4300_XMC4700_4800 0x92
176 #define FLASH_ID_XMC4100_4200 0x9C
177 #define FLASH_ID_XMC4400 0x9F
180 #define FLASH_OP_TIMEOUT 5000
182 /* Flash commands (write/erase/protect) are performed using special
183 * command sequences that are written to magic addresses in the flash controller */
184 /* Command sequence addresses. See reference manual, section 8: Flash Command Sequences */
185 #define FLASH_CMD_ERASE_1 0x0C005554
186 #define FLASH_CMD_ERASE_2 0x0C00AAA8
187 #define FLASH_CMD_ERASE_3 FLASH_CMD_ERASE_1
188 #define FLASH_CMD_ERASE_4 FLASH_CMD_ERASE_1
189 #define FLASH_CMD_ERASE_5 FLASH_CMD_ERASE_2
190 /* ERASE_6 is the sector base address */
192 #define FLASH_CMD_CLEAR_STATUS FLASH_CMD_ERASE_1
194 #define FLASH_CMD_ENTER_PAGEMODE FLASH_CMD_ERASE_1
196 #define FLASH_CMD_LOAD_PAGE_1 0x0C0055F0
197 #define FLASH_CMD_LOAD_PAGE_2 0x0C0055F4
199 #define FLASH_CMD_WRITE_PAGE_1 FLASH_CMD_ERASE_1
200 #define FLASH_CMD_WRITE_PAGE_2 FLASH_CMD_ERASE_2
201 #define FLASH_CMD_WRITE_PAGE_3 FLASH_CMD_ERASE_1
202 /* WRITE_PAGE_4 is the page base address */
204 #define FLASH_CMD_TEMP_UNPROT_1 FLASH_CMD_ERASE_1
205 #define FLASH_CMD_TEMP_UNPROT_2 FLASH_CMD_ERASE_2
206 #define FLASH_CMD_TEMP_UNPROT_3 0x0C00553C
207 #define FLASH_CMD_TEMP_UNPROT_4 FLASH_CMD_ERASE_2
208 #define FLASH_CMD_TEMP_UNPROT_5 FLASH_CMD_ERASE_2
209 #define FLASH_CMD_TEMP_UNPROT_6 0x0C005558
211 struct xmc4xxx_flash_bank
{
214 /* We need the flash controller ID to choose the sector layout */
217 /* Passwords used for protection operations */
222 /* Protection flags */
225 bool write_prot_otp
[MAX_XMC_SECTORS
];
228 struct xmc4xxx_command_seq
{
233 /* Sector capacities. See section 8 of xmc4x00_rm */
234 static const unsigned int sector_capacity_8
[8] = {
235 16, 16, 16, 16, 16, 16, 16, 128
238 static const unsigned int sector_capacity_9
[9] = {
239 16, 16, 16, 16, 16, 16, 16, 128, 256
242 static const unsigned int sector_capacity_12
[12] = {
243 16, 16, 16, 16, 16, 16, 16, 16, 128, 256, 256, 256
246 static const unsigned int sector_capacity_16
[16] = {
247 16, 16, 16, 16, 16, 16, 16, 16, 128, 256, 256, 256, 256, 256, 256, 256
250 static int xmc4xxx_write_command_sequence(struct flash_bank
*bank
,
251 struct xmc4xxx_command_seq
*seq
,
256 for (int i
= 0; i
< seq_len
; i
++) {
257 res
= target_write_u32(bank
->target
, seq
[i
].address
,
266 static int xmc4xxx_load_bank_layout(struct flash_bank
*bank
)
268 const unsigned int *capacity
= NULL
;
270 /* At this point, we know which flash controller ID we're
271 * talking to and simply need to fill out the bank structure accordingly */
272 LOG_DEBUG("%u sectors", bank
->num_sectors
);
274 switch (bank
->num_sectors
) {
276 capacity
= sector_capacity_8
;
279 capacity
= sector_capacity_9
;
282 capacity
= sector_capacity_12
;
285 capacity
= sector_capacity_16
;
288 LOG_ERROR("Unexpected number of sectors, %u\n",
293 /* This looks like a bank that we understand, now we know the
294 * corresponding sector capacities and we can add those up into the
296 uint32_t total_offset
= 0;
297 bank
->sectors
= calloc(bank
->num_sectors
,
298 sizeof(struct flash_sector
));
299 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++) {
300 bank
->sectors
[i
].size
= capacity
[i
] * 1024;
301 bank
->sectors
[i
].offset
= total_offset
;
302 bank
->sectors
[i
].is_erased
= -1;
303 bank
->sectors
[i
].is_protected
= -1;
305 bank
->size
+= bank
->sectors
[i
].size
;
306 LOG_DEBUG("\t%d: %uk", i
, capacity
[i
]);
307 total_offset
+= bank
->sectors
[i
].size
;
310 /* This part doesn't follow the typical standard of 0xff
311 * being the erased value.*/
312 bank
->default_padded_value
= bank
->erased_value
= 0x00;
317 static int xmc4xxx_probe(struct flash_bank
*bank
)
320 uint32_t devid
, config
;
321 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
327 /* It's not possible for the DAP to access the OTP locations needed for
328 * probing the part info and Flash geometry so we require that the target
329 * be halted before proceeding. */
330 if (bank
->target
->state
!= TARGET_HALTED
) {
331 LOG_WARNING("Cannot communicate... target not halted.");
332 return ERROR_TARGET_NOT_HALTED
;
335 /* The SCU registers contain the ID of the chip */
336 res
= target_read_u32(bank
->target
, SCU_REG_BASE
+ SCU_ID_CHIP
, &devid
);
337 if (res
!= ERROR_OK
) {
338 LOG_ERROR("Cannot read device identification register.");
342 /* Make sure this is a XMC4000 family device */
343 if ((devid
& 0xF0000) != 0x40000 && devid
!= 0) {
344 LOG_ERROR("Platform ID doesn't match XMC4xxx: 0x%08" PRIx32
, devid
);
348 LOG_DEBUG("Found XMC4xxx with devid: 0x%08" PRIx32
, devid
);
350 /* Now sanity-check the Flash controller itself. */
351 res
= target_read_u32(bank
->target
, FLASH_REG_FLASH0_ID
,
353 if (res
!= ERROR_OK
) {
354 LOG_ERROR("Cannot read Flash bank configuration.");
357 flash_id
= (config
& 0xff0000) >> 16;
359 /* The Flash configuration register is our only means of
360 * determining the sector layout. We need to make sure that
361 * we understand the type of controller we're dealing with */
363 case FLASH_ID_XMC4100_4200
:
364 bank
->num_sectors
= 8;
365 LOG_DEBUG("XMC4xxx: XMC4100/4200 detected.");
367 case FLASH_ID_XMC4400
:
368 bank
->num_sectors
= 9;
369 LOG_DEBUG("XMC4xxx: XMC4400 detected.");
371 case FLASH_ID_XMC4500
:
372 bank
->num_sectors
= 12;
373 LOG_DEBUG("XMC4xxx: XMC4500 detected.");
375 case FLASH_ID_XMC4300_XMC4700_4800
:
376 bank
->num_sectors
= 16;
377 LOG_DEBUG("XMC4xxx: XMC4700/4800 detected.");
380 LOG_ERROR("XMC4xxx: Unexpected flash ID. got %02" PRIx8
,
385 /* Retrieve information about the particular bank we're probing and fill in
386 * the bank structure accordingly. */
387 res
= xmc4xxx_load_bank_layout(bank
);
388 if (res
== ERROR_OK
) {
392 LOG_ERROR("Unable to load bank information.");
399 static int xmc4xxx_get_sector_start_addr(struct flash_bank
*bank
,
400 unsigned int sector
, uint32_t *ret_addr
)
402 /* Make sure we understand this sector */
403 if (sector
> bank
->num_sectors
)
406 *ret_addr
= bank
->base
+ bank
->sectors
[sector
].offset
;
412 static int xmc4xxx_clear_flash_status(struct flash_bank
*bank
)
415 /* TODO: Do we need to check for sequence error? */
416 LOG_INFO("Clearing flash status");
417 res
= target_write_u32(bank
->target
, FLASH_CMD_CLEAR_STATUS
,
419 if (res
!= ERROR_OK
) {
420 LOG_ERROR("Unable to write erase command sequence");
427 static int xmc4xxx_get_flash_status(struct flash_bank
*bank
, uint32_t *status
)
431 res
= target_read_u32(bank
->target
, FLASH_REG_FLASH0_FSR
, status
);
434 LOG_ERROR("Cannot read flash status register.");
439 static int xmc4xxx_wait_status_busy(struct flash_bank
*bank
, int timeout
)
444 res
= xmc4xxx_get_flash_status(bank
, &status
);
448 /* While the flash controller is busy, wait */
449 while (status
& FSR_PBUSY_MASK
) {
450 res
= xmc4xxx_get_flash_status(bank
, &status
);
454 if (timeout
-- <= 0) {
455 LOG_ERROR("Timed out waiting for flash");
462 if (status
& FSR_PROER_MASK
) {
463 LOG_ERROR("XMC4xxx flash protected");
470 static int xmc4xxx_erase_sector(struct flash_bank
*bank
, uint32_t address
,
476 /* See reference manual table 8.4: Command Sequences for Flash Control */
477 struct xmc4xxx_command_seq erase_cmd_seq
[6] = {
478 {FLASH_CMD_ERASE_1
, 0xAA},
479 {FLASH_CMD_ERASE_2
, 0x55},
480 {FLASH_CMD_ERASE_3
, 0x80},
481 {FLASH_CMD_ERASE_4
, 0xAA},
482 {FLASH_CMD_ERASE_5
, 0x55},
483 {0xFF, 0xFF} /* Needs filled in */
486 /* We need to fill in the base address of the sector we'll be
487 * erasing, as well as the magic code that determines whether
488 * this is a standard flash sector or a user configuration block */
490 erase_cmd_seq
[5].address
= address
;
492 /* Removing flash protection requires the addition of
493 * the base address */
494 erase_cmd_seq
[5].address
+= bank
->base
;
495 erase_cmd_seq
[5].magic
= 0xC0;
497 erase_cmd_seq
[5].magic
= 0x30;
500 res
= xmc4xxx_write_command_sequence(bank
, erase_cmd_seq
,
501 ARRAY_SIZE(erase_cmd_seq
));
505 /* Read the flash status register */
506 res
= target_read_u32(bank
->target
, FLASH_REG_FLASH0_FSR
, &status
);
507 if (res
!= ERROR_OK
) {
508 LOG_ERROR("Cannot read flash status register.");
512 /* Check for a sequence error */
513 if (status
& FSR_SQER_MASK
) {
514 LOG_ERROR("Error with flash erase sequence");
518 /* Make sure a flash erase was triggered */
519 if (!(status
& FSR_ERASE_MASK
)) {
520 LOG_ERROR("Flash failed to erase");
524 /* Now we must wait for the erase operation to end */
525 res
= xmc4xxx_wait_status_busy(bank
, FLASH_OP_TIMEOUT
);
530 static int xmc4xxx_erase(struct flash_bank
*bank
, unsigned int first
,
533 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
536 if (bank
->target
->state
!= TARGET_HALTED
) {
537 LOG_ERROR("Unable to erase, target is not halted");
538 return ERROR_TARGET_NOT_HALTED
;
542 res
= xmc4xxx_probe(bank
);
548 /* Loop through the sectors and erase each one */
549 for (unsigned int i
= first
; i
<= last
; i
++) {
550 res
= xmc4xxx_get_sector_start_addr(bank
, i
, &tmp_addr
);
551 if (res
!= ERROR_OK
) {
552 LOG_ERROR("Invalid sector %u", i
);
556 LOG_DEBUG("Erasing sector %u @ 0x%08"PRIx32
, i
, tmp_addr
);
558 res
= xmc4xxx_erase_sector(bank
, tmp_addr
, false);
559 if (res
!= ERROR_OK
) {
560 LOG_ERROR("Unable to write erase command sequence");
561 goto clear_status_and_exit
;
564 /* Now we must wait for the erase operation to end */
565 res
= xmc4xxx_wait_status_busy(bank
, FLASH_OP_TIMEOUT
);
568 goto clear_status_and_exit
;
571 clear_status_and_exit
:
572 res
= xmc4xxx_clear_flash_status(bank
);
577 static int xmc4xxx_enter_page_mode(struct flash_bank
*bank
)
582 res
= target_write_u32(bank
->target
, FLASH_CMD_ENTER_PAGEMODE
, 0x50);
583 if (res
!= ERROR_OK
) {
584 LOG_ERROR("Unable to write enter page mode command");
588 res
= xmc4xxx_get_flash_status(bank
, &status
);
593 /* Make sure we're in page mode */
594 if (!(status
& FSR_PFPAGE_MASK
)) {
595 LOG_ERROR("Unable to enter page mode");
599 /* Make sure we didn't encounter a sequence error */
600 if (status
& FSR_SQER_MASK
) {
601 LOG_ERROR("Sequence error while entering page mode");
608 static int xmc4xxx_write_page(struct flash_bank
*bank
, const uint8_t *pg_buf
,
609 uint32_t offset
, bool user_config
)
614 /* Base of the flash write command */
615 struct xmc4xxx_command_seq write_cmd_seq
[4] = {
616 {FLASH_CMD_WRITE_PAGE_1
, 0xAA},
617 {FLASH_CMD_WRITE_PAGE_2
, 0x55},
618 {FLASH_CMD_WRITE_PAGE_3
, 0xFF}, /* Needs filled in */
619 {0xFF, 0xFF} /* Needs filled in */
622 /* The command sequence differs depending on whether this is
623 * being written to standard flash or the user configuration
626 write_cmd_seq
[2].magic
= 0xC0;
628 write_cmd_seq
[2].magic
= 0xA0;
630 /* Finally, we need to add the address that this page will be
632 write_cmd_seq
[3].address
= bank
->base
+ offset
;
633 write_cmd_seq
[3].magic
= 0xAA;
636 /* Flash pages are written 256 bytes at a time. For each 256
637 * byte chunk, we need to:
638 * 1. Enter page mode. This activates the flash write buffer
639 * 2. Load the page buffer with data (2x 32 bit words at a time)
640 * 3. Burn the page buffer into its intended location
641 * If the starting offset is not on a 256 byte boundary, we
642 * will need to pad the beginning of the write buffer
643 * accordingly. Likewise, if the last page does not fill the
644 * buffer, we should pad it to avoid leftover data from being
647 res
= xmc4xxx_enter_page_mode(bank
);
651 /* Copy the data into the page buffer*/
652 for (int i
= 0; i
< 256; i
+= 8) {
653 uint32_t w_lo
= target_buffer_get_u32(bank
->target
, &pg_buf
[i
]);
654 uint32_t w_hi
= target_buffer_get_u32(bank
->target
, &pg_buf
[i
+ 4]);
655 LOG_DEBUG("WLO: %08"PRIx32
, w_lo
);
656 LOG_DEBUG("WHI: %08"PRIx32
, w_hi
);
658 /* Data is loaded 2x 32 bit words at a time */
659 res
= target_write_u32(bank
->target
, FLASH_CMD_LOAD_PAGE_1
, w_lo
);
663 res
= target_write_u32(bank
->target
, FLASH_CMD_LOAD_PAGE_2
, w_hi
);
667 /* Check for an error */
668 res
= xmc4xxx_get_flash_status(bank
, &status
);
672 if (status
& FSR_SQER_MASK
) {
673 LOG_ERROR("Error loading page buffer");
678 /* The page buffer is now full, time to commit it to flash */
680 res
= xmc4xxx_write_command_sequence(bank
, write_cmd_seq
, ARRAY_SIZE(write_cmd_seq
));
681 if (res
!= ERROR_OK
) {
682 LOG_ERROR("Unable to enter write command sequence");
686 /* Read the flash status register */
687 res
= xmc4xxx_get_flash_status(bank
, &status
);
691 /* Check for a sequence error */
692 if (status
& FSR_SQER_MASK
) {
693 LOG_ERROR("Error with flash write sequence");
697 /* Make sure a flash write was triggered */
698 if (!(status
& FSR_PROG_MASK
)) {
699 LOG_ERROR("Failed to write flash page");
703 /* Wait for the write operation to end */
704 res
= xmc4xxx_wait_status_busy(bank
, FLASH_OP_TIMEOUT
);
708 /* TODO: Verify that page was written without error */
712 static int xmc4xxx_write(struct flash_bank
*bank
, const uint8_t *buffer
,
713 uint32_t offset
, uint32_t count
)
715 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
718 if (bank
->target
->state
!= TARGET_HALTED
) {
719 LOG_ERROR("Unable to erase, target is not halted");
720 return ERROR_TARGET_NOT_HALTED
;
724 res
= xmc4xxx_probe(bank
);
729 /* Make sure we won't run off the end of the flash bank */
730 if ((offset
+ count
) > (bank
->size
)) {
731 LOG_ERROR("Attempting to write past the end of flash");
736 /* Attempt to write the passed in buffer to flash */
737 /* Pages are written 256 bytes at a time, we need to handle
738 * scenarios where padding is required at the beginning and
741 /* page working area */
742 uint8_t tmp_buf
[256] = {0};
744 /* Amount of data we'll be writing to this page */
748 remaining
= MIN(count
, sizeof(tmp_buf
));
749 end_pad
= sizeof(tmp_buf
) - remaining
;
751 /* Make sure we're starting on a page boundary */
752 int start_pad
= offset
% 256;
754 LOG_INFO("Write does not start on a 256 byte boundary. "
755 "Padding by %d bytes", start_pad
);
756 memset(tmp_buf
, 0xff, start_pad
);
757 /* Subtract the amount of start offset from
758 * the amount of data we'll need to write */
759 remaining
-= start_pad
;
762 /* Remove the amount we'll be writing from the total count */
765 /* Now copy in the remaining data */
766 memcpy(&tmp_buf
[start_pad
], buffer
, remaining
);
769 LOG_INFO("Padding end of page @" TARGET_ADDR_FMT
" by %d bytes",
770 bank
->base
+ offset
, end_pad
);
771 memset(&tmp_buf
[256 - end_pad
], 0xff, end_pad
);
774 /* Now commit this page to flash, if there was start
775 * padding, we should subtract that from the target offset */
776 res
= xmc4xxx_write_page(bank
, tmp_buf
, (offset
- start_pad
), false);
777 if (res
!= ERROR_OK
) {
778 LOG_ERROR("Unable to write flash page");
779 goto abort_write_and_exit
;
782 /* Advance the buffer pointer */
785 /* Advance the offset */
789 abort_write_and_exit
:
790 xmc4xxx_clear_flash_status(bank
);
795 static int xmc4xxx_get_info_command(struct flash_bank
*bank
, struct command_invocation
*cmd
)
797 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
800 if (bank
->target
->state
!= TARGET_HALTED
) {
801 LOG_WARNING("Cannot communicate... target not halted.");
802 return ERROR_TARGET_NOT_HALTED
;
805 /* The SCU registers contain the ID of the chip */
806 int res
= target_read_u32(bank
->target
, SCU_REG_BASE
+ SCU_ID_CHIP
, &scu_idcode
);
807 if (res
!= ERROR_OK
) {
808 LOG_ERROR("Cannot read device identification register.");
812 uint16_t dev_id
= (scu_idcode
& 0xfff0) >> 4;
813 uint16_t rev_id
= scu_idcode
& 0xf;
815 const char *rev_str
= NULL
;
863 /* XMC4500 EES AA13 with date codes before GE212
864 * had zero SCU_IDCHIP
866 dev_str
= "XMC4500 EES";
904 command_print_sameline(cmd
, "Cannot identify target as an XMC4xxx. SCU_ID: %"PRIx32
"\n", scu_idcode
);
908 /* String to declare protection data held in the private driver */
909 char prot_str
[512] = {0};
910 if (fb
->read_protected
)
911 snprintf(prot_str
, sizeof(prot_str
), "\nFlash is read protected");
913 bool otp_enabled
= false;
914 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++)
915 if (fb
->write_prot_otp
[i
])
918 /* If OTP Write protection is enabled (User 2), list each
919 * sector that has it enabled */
922 strcat(prot_str
, "\nOTP Protection is enabled for sectors:\n");
923 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++) {
924 if (fb
->write_prot_otp
[i
]) {
925 snprintf(otp_str
, sizeof(otp_str
), "- %d\n", i
);
926 strncat(prot_str
, otp_str
, sizeof(prot_str
) - strlen(prot_str
) - 1);
932 command_print_sameline(cmd
, "%s - Rev: %s%s", dev_str
, rev_str
, prot_str
);
934 command_print_sameline(cmd
, "%s - Rev: unknown (0x%01x)%s", dev_str
, rev_id
, prot_str
);
939 static int xmc4xxx_temp_unprotect(struct flash_bank
*bank
, int user_level
)
941 struct xmc4xxx_flash_bank
*fb
;
945 struct xmc4xxx_command_seq temp_unprot_seq
[6] = {
946 {FLASH_CMD_TEMP_UNPROT_1
, 0xAA},
947 {FLASH_CMD_TEMP_UNPROT_2
, 0x55},
948 {FLASH_CMD_TEMP_UNPROT_3
, 0xFF}, /* Needs filled in */
949 {FLASH_CMD_TEMP_UNPROT_4
, 0xFF}, /* Needs filled in */
950 {FLASH_CMD_TEMP_UNPROT_5
, 0xFF}, /* Needs filled in */
951 {FLASH_CMD_TEMP_UNPROT_6
, 0x05}
954 if (user_level
< 0 || user_level
> 2) {
955 LOG_ERROR("Invalid user level, must be 0-2");
959 fb
= bank
->driver_priv
;
961 /* Fill in the user level and passwords */
962 temp_unprot_seq
[2].magic
= user_level
;
963 temp_unprot_seq
[3].magic
= fb
->pw1
;
964 temp_unprot_seq
[4].magic
= fb
->pw2
;
966 res
= xmc4xxx_write_command_sequence(bank
, temp_unprot_seq
,
967 ARRAY_SIZE(temp_unprot_seq
));
968 if (res
!= ERROR_OK
) {
969 LOG_ERROR("Unable to write temp unprotect sequence");
973 res
= xmc4xxx_get_flash_status(bank
, &status
);
977 if (status
& FSR_WPRODIS0
) {
978 LOG_INFO("Flash is temporarily unprotected");
980 LOG_INFO("Unable to disable flash protection");
988 static int xmc4xxx_flash_unprotect(struct flash_bank
*bank
, int32_t level
)
1001 LOG_ERROR("Invalid user level. Must be 0-1");
1005 res
= xmc4xxx_erase_sector(bank
, addr
, true);
1007 if (res
!= ERROR_OK
)
1008 LOG_ERROR("Error erasing user configuration block");
1013 /* Reference: "XMC4500 Flash Protection.pptx" app note */
1014 static int xmc4xxx_flash_protect(struct flash_bank
*bank
, int level
, bool read_protect
,
1015 unsigned int first
, unsigned int last
)
1017 /* User configuration block buffers */
1018 uint8_t ucp0_buf
[8 * sizeof(uint32_t)] = {0};
1019 uint32_t ucb_base
= 0;
1020 uint32_t procon
= 0;
1022 uint32_t status
= 0;
1025 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
1027 /* Read protect only works for user 0, make sure we don't try
1028 * to do something silly */
1029 if (level
!= 0 && read_protect
) {
1030 LOG_ERROR("Read protection is for user level 0 only!");
1034 /* Check to see if protection is already installed for the
1035 * specified user level. If it is, the user configuration
1036 * block will need to be erased before we can continue */
1038 /* Grab the flash status register*/
1039 res
= xmc4xxx_get_flash_status(bank
, &status
);
1040 if (res
!= ERROR_OK
)
1045 if ((status
& FSR_RPROIN_MASK
) || (status
& FSR_WPROIN0_MASK
))
1049 if (status
& FSR_WPROIN1_MASK
)
1053 if (status
& FSR_WPROIN2_MASK
)
1059 LOG_ERROR("Flash protection is installed for user %d"
1060 " and must be removed before continuing", level
);
1064 /* If this device has 12 flash sectors, protection for
1065 * sectors 10 & 11 are handled jointly. If we are trying to
1066 * write all sectors, we should decrement
1067 * last to ensure we don't write to a register bit that
1069 if ((bank
->num_sectors
== 12) && (last
== 12))
1072 /* We need to fill out the procon register representation
1073 * that we will be writing to the device */
1074 for (unsigned int i
= first
; i
<= last
; i
++)
1077 /* If read protection is requested, set the appropriate bit
1078 * (we checked that this is allowed above) */
1080 procon
|= PROCON_RPRO_MASK
;
1082 LOG_DEBUG("Setting flash protection with procon:");
1083 LOG_DEBUG("PROCON: %"PRIx32
, procon
);
1085 /* First we need to copy in the procon register to the buffer
1086 * we're going to attempt to write. This is written twice */
1087 target_buffer_set_u32(bank
->target
, &ucp0_buf
[0 * 4], procon
);
1088 target_buffer_set_u32(bank
->target
, &ucp0_buf
[2 * 4], procon
);
1090 /* Now we must copy in both flash passwords. As with the
1091 * procon data, this must be written twice (4 total words
1093 target_buffer_set_u32(bank
->target
, &ucp0_buf
[4 * 4], fb
->pw1
);
1094 target_buffer_set_u32(bank
->target
, &ucp0_buf
[5 * 4], fb
->pw2
);
1095 target_buffer_set_u32(bank
->target
, &ucp0_buf
[6 * 4], fb
->pw1
);
1096 target_buffer_set_u32(bank
->target
, &ucp0_buf
[7 * 4], fb
->pw2
);
1098 /* Finally, (if requested) we copy in the confirmation
1099 * code so that the protection is permanent and will
1100 * require a password to undo. */
1101 target_buffer_set_u32(bank
->target
, &ucp0_buf
[0 * 4], FLASH_PROTECT_CONFIRMATION_CODE
);
1102 target_buffer_set_u32(bank
->target
, &ucp0_buf
[2 * 4], FLASH_PROTECT_CONFIRMATION_CODE
);
1104 /* Now that the data is copied into place, we must write
1105 * these pages into flash */
1107 /* The user configuration block base depends on what level of
1108 * protection we're trying to install, select the proper one */
1111 ucb_base
= UCB0_BASE
;
1114 ucb_base
= UCB1_BASE
;
1117 ucb_base
= UCB2_BASE
;
1121 /* Write the user config pages */
1122 res
= xmc4xxx_write_page(bank
, ucp0_buf
, ucb_base
, true);
1123 if (res
!= ERROR_OK
) {
1124 LOG_ERROR("Error writing user configuration block 0");
1131 static int xmc4xxx_protect(struct flash_bank
*bank
, int set
, unsigned int first
,
1135 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
1137 /* Check for flash passwords */
1139 LOG_ERROR("Flash passwords not set, use xmc4xxx flash_password to set them");
1143 /* We want to clear flash protection temporarily*/
1145 LOG_WARNING("Flash protection will be temporarily disabled"
1146 " for all pages (User 0 only)!");
1147 ret
= xmc4xxx_temp_unprotect(bank
, 0);
1151 /* Install write protection for user 0 on the specified pages */
1152 ret
= xmc4xxx_flash_protect(bank
, 0, false, first
, last
);
1157 static int xmc4xxx_protect_check(struct flash_bank
*bank
)
1160 uint32_t protection
[3] = {0};
1161 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
1163 ret
= target_read_u32(bank
->target
, FLASH_REG_FLASH0_PROCON0
, &protection
[0]);
1164 if (ret
!= ERROR_OK
) {
1165 LOG_ERROR("Unable to read flash User0 protection register");
1169 ret
= target_read_u32(bank
->target
, FLASH_REG_FLASH0_PROCON1
, &protection
[1]);
1170 if (ret
!= ERROR_OK
) {
1171 LOG_ERROR("Unable to read flash User1 protection register");
1175 ret
= target_read_u32(bank
->target
, FLASH_REG_FLASH0_PROCON2
, &protection
[2]);
1176 if (ret
!= ERROR_OK
) {
1177 LOG_ERROR("Unable to read flash User2 protection register");
1181 unsigned int sectors
= bank
->num_sectors
;
1183 /* On devices with 12 sectors, sectors 10 & 11 are protected
1184 * together instead of individually */
1188 /* Clear the protection status */
1189 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++) {
1190 bank
->sectors
[i
].is_protected
= 0;
1191 fb
->write_prot_otp
[i
] = false;
1193 fb
->read_protected
= false;
1195 /* The xmc4xxx series supports 3 levels of user protection
1196 * (User0, User1 (low priority), and User 2(OTP), we need to
1198 for (unsigned int i
= 0; i
< ARRAY_SIZE(protection
); i
++) {
1200 /* Check for write protection on every available
1202 for (unsigned int j
= 0; j
< sectors
; j
++) {
1203 int set
= (protection
[i
] & (1 << j
)) ? 1 : 0;
1204 bank
->sectors
[j
].is_protected
|= set
;
1206 /* Handle sector 11 */
1208 bank
->sectors
[j
+ 1].is_protected
|= set
;
1210 /* User 2 indicates this protection is
1211 * permanent, make note in the private driver structure */
1212 if (i
== 2 && set
) {
1213 fb
->write_prot_otp
[j
] = true;
1215 /* Handle sector 11 */
1217 fb
->write_prot_otp
[j
+ 1] = true;
1223 /* XMC4xxx also supports read protection, make a note
1224 * in the private driver structure */
1225 if (protection
[0] & PROCON_RPRO_MASK
)
1226 fb
->read_protected
= true;
1231 FLASH_BANK_COMMAND_HANDLER(xmc4xxx_flash_bank_command
)
1233 bank
->driver_priv
= malloc(sizeof(struct xmc4xxx_flash_bank
));
1235 if (!bank
->driver_priv
)
1236 return ERROR_FLASH_OPERATION_FAILED
;
1238 (void)memset(bank
->driver_priv
, 0, sizeof(struct xmc4xxx_flash_bank
));
1243 COMMAND_HANDLER(xmc4xxx_handle_flash_password_command
)
1246 struct flash_bank
*bank
;
1249 return ERROR_COMMAND_SYNTAX_ERROR
;
1251 res
= CALL_COMMAND_HANDLER(flash_command_get_bank
, 0, &bank
);
1252 if (res
!= ERROR_OK
)
1255 struct xmc4xxx_flash_bank
*fb
= bank
->driver_priv
;
1259 /* We skip over the flash bank */
1260 COMMAND_PARSE_NUMBER(u32
, CMD_ARGV
[1], fb
->pw1
);
1263 return ERROR_COMMAND_SYNTAX_ERROR
;
1265 COMMAND_PARSE_NUMBER(u32
, CMD_ARGV
[2], fb
->pw2
);
1268 return ERROR_COMMAND_SYNTAX_ERROR
;
1272 command_print(CMD
, "XMC4xxx flash passwords set to:\n");
1273 command_print(CMD
, "-0x%08"PRIx32
"\n", fb
->pw1
);
1274 command_print(CMD
, "-0x%08"PRIx32
"\n", fb
->pw2
);
1278 COMMAND_HANDLER(xmc4xxx_handle_flash_unprotect_command
)
1280 struct flash_bank
*bank
;
1285 return ERROR_COMMAND_SYNTAX_ERROR
;
1287 res
= CALL_COMMAND_HANDLER(flash_command_get_bank
, 0, &bank
);
1288 if (res
!= ERROR_OK
)
1291 COMMAND_PARSE_NUMBER(s32
, CMD_ARGV
[1], level
);
1293 res
= xmc4xxx_flash_unprotect(bank
, level
);
1298 static const struct command_registration xmc4xxx_exec_command_handlers
[] = {
1300 .name
= "flash_password",
1301 .handler
= xmc4xxx_handle_flash_password_command
,
1302 .mode
= COMMAND_EXEC
,
1303 .usage
= "bank_id password1 password2",
1304 .help
= "Set the flash passwords used for protect operations. "
1305 "Passwords should be in standard hex form (0x00000000). "
1306 "(You must call this before any other protect commands) "
1307 "NOTE: The xmc4xxx's UCB area only allows for FOUR cycles. "
1308 "Please use protection carefully!",
1311 .name
= "flash_unprotect",
1312 .handler
= xmc4xxx_handle_flash_unprotect_command
,
1313 .mode
= COMMAND_EXEC
,
1314 .usage
= "bank_id user_level[0-1]",
1315 .help
= "Permanently Removes flash protection (read and write) "
1316 "for the specified user level",
1318 COMMAND_REGISTRATION_DONE
1321 static const struct command_registration xmc4xxx_command_handlers
[] = {
1324 .mode
= COMMAND_ANY
,
1325 .help
= "xmc4xxx flash command group",
1327 .chain
= xmc4xxx_exec_command_handlers
,
1329 COMMAND_REGISTRATION_DONE
1332 const struct flash_driver xmc4xxx_flash
= {
1334 .commands
= xmc4xxx_command_handlers
,
1335 .flash_bank_command
= xmc4xxx_flash_bank_command
,
1336 .erase
= xmc4xxx_erase
,
1337 .write
= xmc4xxx_write
,
1338 .read
= default_flash_read
,
1339 .probe
= xmc4xxx_probe
,
1340 .auto_probe
= xmc4xxx_probe
,
1341 .erase_check
= default_flash_blank_check
,
1342 .info
= xmc4xxx_get_info_command
,
1343 .protect_check
= xmc4xxx_protect_check
,
1344 .protect
= xmc4xxx_protect
,
1345 .free_driver_priv
= default_flash_free_driver_priv
,
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)