You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

1137 lines
30 KiB

  1. /***************************************************************************
  2. * Copyright (C) 2014 by Ladislav Bábel *
  3. * ladababel@seznam.cz *
  4. * *
  5. * Copyright (C) 2015 by Andreas Bomholtz *
  6. * andreas@seluxit.com *
  7. * *
  8. * This program is free software; you can redistribute it and/or modify *
  9. * it under the terms of the GNU General Public License as published by *
  10. * the Free Software Foundation; either version 2 of the License, or *
  11. * (at your option) any later version. *
  12. * *
  13. * This program is distributed in the hope that it will be useful, *
  14. * but WITHOUT ANY WARRANTY; without even the implied warranty of *
  15. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
  16. * GNU General Public License for more details. *
  17. ***************************************************************************/
  18. #ifdef HAVE_CONFIG_H
  19. #include "config.h"
  20. #endif
  21. #include "imp.h"
  22. #include <helper/binarybuffer.h>
  23. #include <helper/time_support.h>
  24. #include <target/algorithm.h>
  25. #include <target/cortex_m.h>
  26. /* SI32_DEVICEID0 */
  27. #define DEVICEID0_DEVICEID0 (0x400490C0)
  28. #define DEVICEID0_DEVICEID1 (0x400490D0)
  29. #define DEVICEID0_DEVICEID2 (0x400490E0)
  30. #define DEVICEID0_DEVICEID3 (0x400490F0)
  31. /* cortex_m CPUID */
  32. #define CPUID_CHECK_VALUE (0x410FC230)
  33. #define CPUID_CHECK_VALUE_MASK (0xFF0FFFF0)
  34. /* Flash */
  35. #define FLASH_BASE_ADDRESS (0x00000000)
  36. #define LOCK_WORD_ADDRESS (0x0003FFFC)
  37. #define LOCK_WORD_MCU_UNLOCKED (0xFFFFFFFF)
  38. /* Can't by locked again without erase, because LOCK_WORD is in FLASH */
  39. #define LOCK_WORD_MCU_UNLOCKED_BY_FIRMWARE (0x00000000)
  40. /* SI32_FLASHCTRL_0 */
  41. #define FLASHCTRL0_CONFIG_ALL (0x4002E000)
  42. #define FLASHCTRL0_CONFIG_SET (0x4002E004)
  43. #define FLASHCTRL0_CONFIG_CLR (0x4002E008)
  44. #define FLASHCTRL0_CONFIG_ERASEEN_MASK (0x00040000)
  45. #define FLASHCTRL0_CONFIG_BUSYF_MASK (0x00100000)
  46. #define FLASHCTRL0_WRADDR (0x4002E0A0)
  47. #define FLASHCTRL0_WRDATA (0x4002E0B0)
  48. #define FLASHCTRL0_KEY (0x4002E0C0)
  49. #define FLASHCTRL0_KEY_INITIAL_UNLOCK (0x000000A5)
  50. #define FLASHCTRL0_KEY_SINGLE_UNLOCK (0x000000F1)
  51. #define FLASHCTRL0_KEY_MULTIPLE_UNLOCK (0x000000F2)
  52. #define FLASHCTRL0_KEY_MULTIPLE_LOCK (0x0000005A)
  53. #define FLASH_BUSY_TIMEOUT (100)
  54. /* SI32_RSTSRC_0 */
  55. #define RSTSRC0_RESETEN_ALL (0x4002D060)
  56. #define RSTSRC0_RESETEN_SET (0x4002D064)
  57. #define RSTSRC0_RESETEN_CLR (0x4002D068)
  58. #define RSTSRC0_RESETEN_VMONREN_MASK (0x00000004)
  59. #define RSTSRC0_RESETEN_SWREN_MASK (0x00000040)
  60. /* SI32_VMON_0 */
  61. #define VMON0_CONTROL_ALL (0x4002F000)
  62. #define VMON0_CONTROL_SET (0x4002F004)
  63. #define VMON0_CONTROL_CLR (0x4002F008)
  64. #define VMON0_CONTROL_VMONEN_MASK (0x80000000)
  65. /* SI32_CLKCTRL_0 */
  66. #define CLKCTRL0_APBCLKG0_ALL (0x4002D020)
  67. #define CLKCTRL0_APBCLKG0_SET (0x4002D024)
  68. #define CLKCTRL0_APBCLKG0_CLR (0x4002D028)
  69. #define CLKCTRL0_APBCLKG0_FLCTRLCEN_MASK (0x40000000)
  70. /* SI32_WDTIMER_0 */
  71. #define WDTIMER0_CONTROL_ALL (0x40030000)
  72. #define WDTIMER0_CONTROL_SET (0x40030004)
  73. #define WDTIMER0_CONTROL_CLR (0x40030008)
  74. #define WDTIMER0_CONTROL_DBGMD_MASK (0x00000002)
  75. #define WDTIMER0_STATUS_ALL (0x40030010)
  76. #define WDTIMER0_STATUS_SET (0x40030014)
  77. #define WDTIMER0_STATUS_CLR (0x40030018)
  78. #define WDTIMER0_STATUS_KEYSTS_MASK (0x00000001)
  79. #define WDTIMER0_STATUS_PRIVSTS_MASK (0x00000002)
  80. #define WDTIMER0_THRESHOLD (0x40030020)
  81. #define WDTIMER0_WDTKEY (0x40030030)
  82. #define WDTIMER0_KEY_ATTN (0x000000A5)
  83. #define WDTIMER0_KEY_WRITE (0x000000F1)
  84. #define WDTIMER0_KEY_RESET (0x000000CC)
  85. #define WDTIMER0_KEY_DISABLE (0x000000DD)
  86. #define WDTIMER0_KEY_START (0x000000EE)
  87. #define WDTIMER0_KEY_LOCK (0x000000FF)
  88. /* DAP */
  89. #define SIM3X_AP (0x0A)
  90. #define SIM3X_AP_CTRL1 (0x00)
  91. #define SIM3X_AP_CTRL2 (0x04)
  92. #define SIM3X_AP_LOCK (0x08)
  93. #define SIM3X_AP_CRC (0x0C)
  94. #define SIM3X_AP_INIT_STAT (0x10)
  95. #define SIM3X_AP_DAP_IN (0x14)
  96. #define SIM3X_AP_DAP_OUT (0x18)
  97. #define SIM3X_AP_ID (0xFC)
  98. /* DAP register values */
  99. #define SIM3X_AP_CTRL1_MASS_ERASE_REQ (0x00000001)
  100. #define SIM3X_AP_CTRL1_RESET_REQ (0x00000008)
  101. /* this bit is set if MCU is locked */
  102. #define SIM3X_AP_INIT_STAT_LOCK (0x00000004)
  103. /* expected value inside SIM3X_AP_ID */
  104. #define SIM3X_AP_ID_VALUE (0x2430002)
  105. #define SIM3X_FLASH_PAGE_SIZE 1024
  106. struct sim3x_info {
  107. uint16_t flash_size_kb;
  108. uint16_t part_number;
  109. char part_family;
  110. uint8_t device_revision;
  111. char device_package[4];
  112. bool probed;
  113. bool need_init;
  114. bool flash_locked;
  115. };
  116. /* flash bank sim3x 0 0 0 0 <target#> */
  117. FLASH_BANK_COMMAND_HANDLER(sim3x_flash_bank_command)
  118. {
  119. struct sim3x_info *sim3x_info;
  120. if (CMD_ARGC < 6)
  121. return ERROR_COMMAND_SYNTAX_ERROR;
  122. /* Init sim3x_info struct */
  123. sim3x_info = malloc(sizeof(struct sim3x_info));
  124. sim3x_info->probed = false;
  125. sim3x_info->need_init = true;
  126. sim3x_info->device_revision = 0;
  127. memset(sim3x_info->device_package, 0, 4);
  128. bank->driver_priv = sim3x_info;
  129. return ERROR_OK;
  130. }
  131. static int sim3x_init(struct flash_bank *bank)
  132. {
  133. int ret;
  134. struct target *target;
  135. struct sim3x_info *sim3x_info;
  136. target = bank->target;
  137. /* Disable watchdog timer */
  138. ret = target_write_u32(target, WDTIMER0_WDTKEY, WDTIMER0_KEY_ATTN);
  139. if (ret != ERROR_OK)
  140. return ret;
  141. ret = target_write_u32(target, WDTIMER0_WDTKEY, WDTIMER0_KEY_DISABLE);
  142. if (ret != ERROR_OK)
  143. return ret;
  144. /* Enable one write command */
  145. ret = target_write_u32(target, WDTIMER0_WDTKEY, WDTIMER0_KEY_ATTN);
  146. if (ret != ERROR_OK)
  147. return ret;
  148. ret = target_write_u32(target, WDTIMER0_WDTKEY, WDTIMER0_KEY_WRITE);
  149. if (ret != ERROR_OK)
  150. return ret;
  151. /* Watchdog Timer Debug Mode */
  152. ret = target_write_u32(target, WDTIMER0_CONTROL_SET,
  153. WDTIMER0_CONTROL_DBGMD_MASK);
  154. if (ret != ERROR_OK)
  155. return ret;
  156. /* Enable VDD Supply Monitor */
  157. ret = target_write_u32(target, VMON0_CONTROL_SET,
  158. VMON0_CONTROL_VMONEN_MASK);
  159. if (ret != ERROR_OK)
  160. return ret;
  161. /* Set VDD Supply Monitor as a reset source */
  162. ret = target_write_u32(target, RSTSRC0_RESETEN_SET,
  163. RSTSRC0_RESETEN_VMONREN_MASK);
  164. if (ret != ERROR_OK)
  165. return ret;
  166. /* Flash Controller Clock Enable */
  167. ret = target_write_u32(target, CLKCTRL0_APBCLKG0_SET,
  168. CLKCTRL0_APBCLKG0_FLCTRLCEN_MASK);
  169. if (ret != ERROR_OK)
  170. return ret;
  171. /* Disable Flash Erase Mode */
  172. ret = target_write_u32(target, FLASHCTRL0_CONFIG_CLR,
  173. FLASHCTRL0_CONFIG_ERASEEN_MASK);
  174. if (ret != ERROR_OK)
  175. return ret;
  176. sim3x_info = bank->driver_priv;
  177. sim3x_info->need_init = 0;
  178. return ERROR_OK;
  179. }
  180. static int sim3x_erase_page(struct flash_bank *bank, uint32_t addr)
  181. {
  182. int ret, i;
  183. uint32_t temp;
  184. struct target *target;
  185. target = bank->target;
  186. for (i = 0; i < FLASH_BUSY_TIMEOUT; i++) {
  187. ret = target_read_u32(target, FLASHCTRL0_CONFIG_ALL, &temp);
  188. if (ret != ERROR_OK)
  189. return ret;
  190. /* If is not busy */
  191. if ((temp & FLASHCTRL0_CONFIG_BUSYF_MASK) == 0) {
  192. /* If erase is not enabled */
  193. if ((temp & FLASHCTRL0_CONFIG_ERASEEN_MASK) == 0) {
  194. /* Enter Flash Erase Mode */
  195. ret = target_write_u32(target, FLASHCTRL0_CONFIG_SET,
  196. FLASHCTRL0_CONFIG_ERASEEN_MASK);
  197. if (ret != ERROR_OK)
  198. return ret;
  199. }
  200. /* Write the address of the Flash page to WRADDR */
  201. ret = target_write_u32(target, FLASHCTRL0_WRADDR, addr);
  202. if (ret != ERROR_OK)
  203. return ret;
  204. /* Write the inital unlock value to KEY */
  205. ret = target_write_u32(target, FLASHCTRL0_KEY,
  206. FLASHCTRL0_KEY_INITIAL_UNLOCK);
  207. if (ret != ERROR_OK)
  208. return ret;
  209. /* Write the single unlock value to KEY */
  210. ret = target_write_u32(target, FLASHCTRL0_KEY,
  211. FLASHCTRL0_KEY_SINGLE_UNLOCK);
  212. if (ret != ERROR_OK)
  213. return ret;
  214. /* Write any value to WRDATA to initiate the page erase */
  215. ret = target_write_u32(target, FLASHCTRL0_WRDATA, 0);
  216. if (ret != ERROR_OK)
  217. return ret;
  218. return ERROR_OK;
  219. }
  220. alive_sleep(1);
  221. }
  222. LOG_ERROR("timed out waiting for FLASHCTRL0_CONFIG_BUSYF");
  223. return ERROR_FAIL;
  224. }
  225. static int sim3x_flash_erase(struct flash_bank *bank, int first, int last)
  226. {
  227. int ret, i;
  228. uint32_t temp;
  229. struct sim3x_info *sim3x_info;
  230. struct target *target;
  231. /* Check if target is halted */
  232. if (bank->target->state != TARGET_HALTED) {
  233. LOG_ERROR("Target not halted");
  234. return ERROR_TARGET_NOT_HALTED;
  235. }
  236. sim3x_info = bank->driver_priv;
  237. /* Init MCU after reset */
  238. if (sim3x_info->need_init) {
  239. ret = sim3x_init(bank);
  240. if (ret != ERROR_OK) {
  241. LOG_ERROR("Failed to init MCU");
  242. return ret;
  243. }
  244. }
  245. /* erase pages */
  246. for (i = first; i <= last; i++) {
  247. ret = sim3x_erase_page(bank, bank->sectors[i].offset);
  248. if (ret != ERROR_OK)
  249. return ret;
  250. }
  251. target = bank->target;
  252. /* Wait until busy */
  253. for (i = 0; i < FLASH_BUSY_TIMEOUT; i++) {
  254. ret = target_read_u32(target, FLASHCTRL0_CONFIG_ALL, &temp);
  255. if (ret != ERROR_OK)
  256. return ret;
  257. if ((temp & FLASHCTRL0_CONFIG_BUSYF_MASK) == 0) { /* If is not busy */
  258. if ((temp & FLASHCTRL0_CONFIG_ERASEEN_MASK) != 0) { /* If erase is enabled */
  259. /* Disable Flash Erase Mode */
  260. ret = target_write_u32(target, FLASHCTRL0_CONFIG_CLR,
  261. FLASHCTRL0_CONFIG_ERASEEN_MASK);
  262. if (ret != ERROR_OK)
  263. return ret;
  264. }
  265. return ERROR_OK;
  266. }
  267. alive_sleep(1);
  268. }
  269. LOG_ERROR("timed out waiting for FLASHCTRL0_CONFIG_BUSYF");
  270. return ERROR_FAIL;
  271. }
  272. static int sim3x_write_block(struct flash_bank *bank, const uint8_t *buf,
  273. uint32_t offset, uint32_t count) /* count is count of half words (2 bytes)! */
  274. {
  275. struct target *target = bank->target;
  276. uint32_t buffer_size = 16384;
  277. struct working_area *write_algorithm;
  278. struct working_area *source;
  279. uint32_t address = bank->base + offset;
  280. struct reg_param reg_params[5];
  281. struct armv7m_algorithm armv7m_info;
  282. int ret = ERROR_OK;
  283. /* see contrib/loaders/flash/sim3x.s for src */
  284. static const uint8_t sim3x_flash_write_code[] = {
  285. /* Write the initial unlock value to KEY (0xA5) */
  286. 0xA5, 0x26, /* movs r6, #INITIAL_UNLOCK */
  287. 0xC0, 0xF8, 0xC0, 0x60, /* str r6, [r0, #FLASHCTRL_KEY] */
  288. /* Write the multiple unlock value to KEY (0xF2) */
  289. 0xF2, 0x26, /* movs r6, #MULTIPLE_UNLOCK */
  290. 0xC0, 0xF8, 0xC0, 0x60, /* str r6, [r0, #FLASHCTRL_KEY] */
  291. /* wait_fifo: */
  292. 0x16, 0x68, /* ldr r6, [r2, #0] */
  293. 0x00, 0x2E, /* cmp r6, #0 */
  294. 0x16, 0xD0, /* beq exit */
  295. 0x55, 0x68, /* ldr r5, [r2, #4] */
  296. 0xB5, 0x42, /* cmp r5, r6 */
  297. 0xF9, 0xD0, /* beq wait_fifo */
  298. /* wait for BUSYF flag */
  299. /* wait_busy1: */
  300. 0x06, 0x68, /* ldr r6, [r0, #FLASHCTRL_CONFIG] */
  301. 0x16, 0xF4, 0x80, 0x1F, /* tst r6, #BUSYF */
  302. 0xFB, 0xD1, /* bne wait_busy1 */
  303. /* Write the destination address to WRADDR */
  304. 0xC0, 0xF8, 0xA0, 0x40, /* str r4, [r0, #FLASHCTRL_WRADDR] */
  305. /* Write the data half-word to WRDATA in right-justified format */
  306. 0x2E, 0x88, /* ldrh r6, [r5] */
  307. 0xC0, 0xF8, 0xB0, 0x60, /* str r6, [r0, #FLASHCTRL_WRDATA] */
  308. 0x02, 0x35, /* adds r5, #2 */
  309. 0x02, 0x34, /* adds r4, #2 */
  310. /* wrap rp at end of buffer */
  311. 0x9D, 0x42, /* cmp r5, r3 */
  312. 0x01, 0xD3, /* bcc no_wrap */
  313. 0x15, 0x46, /* mov r5, r2 */
  314. 0x08, 0x35, /* adds r5, #8 */
  315. /* no_wrap: */
  316. 0x55, 0x60, /* str r5, [r2, #4] */
  317. 0x49, 0x1E, /* subs r1, r1, #1 */
  318. 0x00, 0x29, /* cmp r1, #0 */
  319. 0x00, 0xD0, /* beq exit */
  320. 0xE5, 0xE7, /* b wait_fifo */
  321. /* exit: */
  322. 0x5A, 0x26, /* movs r6, #MULTIPLE_LOCK */
  323. 0xC0, 0xF8, 0xC0, 0x60, /* str r6, [r0, #FLASHCTRL_KEY] */
  324. /* wait for BUSYF flag */
  325. /* wait_busy2: */
  326. 0x06, 0x68, /* ldr r6, [r0, #FLASHCTRL_CONFIG] */
  327. 0x16, 0xF4, 0x80, 0x1F, /* tst r6, #BUSYF */
  328. 0xFB, 0xD1, /* bne wait_busy2 */
  329. 0x00, 0xBE /* bkpt #0 */
  330. };
  331. /* flash write code */
  332. if (target_alloc_working_area(target, sizeof(sim3x_flash_write_code),
  333. &write_algorithm) != ERROR_OK) {
  334. LOG_WARNING("no working area available, can't do block memory writes");
  335. return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
  336. }
  337. ret = target_write_buffer(target, write_algorithm->address,
  338. sizeof(sim3x_flash_write_code), sim3x_flash_write_code);
  339. if (ret != ERROR_OK)
  340. return ret;
  341. /* memory buffer */
  342. while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
  343. buffer_size /= 2;
  344. buffer_size &= ~1UL; /* Make sure it's 2 byte aligned */
  345. if (buffer_size <= 256) {
  346. /* we already allocated the writing code, but failed to get a
  347. * buffer, free the algorithm
  348. */
  349. target_free_working_area(target, write_algorithm);
  350. LOG_WARNING("no large enough working area available, can't do block memory writes");
  351. return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
  352. }
  353. }
  354. init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT); /* flash base */
  355. init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT); /* count */
  356. init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT); /* buffer start */
  357. init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT); /* buffer end */
  358. init_reg_param(&reg_params[4], "r4", 32, PARAM_IN_OUT); /* target address */
  359. buf_set_u32(reg_params[0].value, 0, 32, FLASHCTRL0_CONFIG_ALL);
  360. buf_set_u32(reg_params[1].value, 0, 32, count);
  361. buf_set_u32(reg_params[2].value, 0, 32, source->address);
  362. buf_set_u32(reg_params[3].value, 0, 32, source->address + source->size);
  363. buf_set_u32(reg_params[4].value, 0, 32, address);
  364. armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
  365. armv7m_info.core_mode = ARM_MODE_THREAD;
  366. ret = target_run_flash_async_algorithm(target, buf, count, 2, 0, NULL, 5,
  367. reg_params, source->address, source->size, write_algorithm->address,
  368. 0, &armv7m_info);
  369. if (ret == ERROR_FLASH_OPERATION_FAILED) {
  370. LOG_ERROR("flash write failed at address 0x%"PRIx32,
  371. buf_get_u32(reg_params[4].value, 0, 32));
  372. }
  373. target_free_working_area(target, source);
  374. target_free_working_area(target, write_algorithm);
  375. destroy_reg_param(&reg_params[0]);
  376. destroy_reg_param(&reg_params[1]);
  377. destroy_reg_param(&reg_params[2]);
  378. destroy_reg_param(&reg_params[3]);
  379. destroy_reg_param(&reg_params[4]);
  380. return ret;
  381. }
  382. static int sim3x_flash_write(struct flash_bank *bank, const uint8_t * buffer, uint32_t offset, uint32_t count)
  383. {
  384. int ret;
  385. struct target *target;
  386. struct sim3x_info *sim3x_info;
  387. uint8_t *new_buffer = NULL;
  388. target = bank->target;
  389. /* Check if target is halted */
  390. if (target->state != TARGET_HALTED) {
  391. LOG_ERROR("Target not halted");
  392. return ERROR_TARGET_NOT_HALTED;
  393. }
  394. sim3x_info = bank->driver_priv;
  395. if (sim3x_info->flash_locked) {
  396. LOG_ERROR("Falsh is locked");
  397. return ERROR_FAIL;
  398. }
  399. /* Init MCU after reset */
  400. if (sim3x_info->need_init) {
  401. ret = sim3x_init(bank);
  402. if (ret != ERROR_OK)
  403. return ret;
  404. }
  405. if (offset & 0x1) {
  406. LOG_ERROR("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
  407. return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
  408. }
  409. if (count & 0x1) {
  410. uint32_t old_count = count;
  411. count++;
  412. new_buffer = malloc(count);
  413. if (new_buffer == NULL) {
  414. LOG_ERROR("odd number of bytes to write and no memory "
  415. "for padding buffer");
  416. return ERROR_FAIL;
  417. }
  418. LOG_INFO("odd number of bytes to write (%" PRIu32 "), extending to %" PRIu32
  419. " and padding with 0xff", old_count, count);
  420. new_buffer[count - 1] = 0xff;
  421. buffer = memcpy(new_buffer, buffer, old_count);
  422. }
  423. ret = sim3x_write_block(bank, buffer, offset, count / 2);
  424. free(new_buffer);
  425. return ret;
  426. }
  427. static int sim3x_flash_lock_check(struct flash_bank *bank)
  428. {
  429. int ret;
  430. uint32_t lock_word;
  431. struct sim3x_info *sim3x_info;
  432. ret = target_read_u32(bank->target, LOCK_WORD_ADDRESS, &lock_word);
  433. if (ret != ERROR_OK) {
  434. LOG_ERROR("Can not read Lock Word");
  435. return ret;
  436. }
  437. sim3x_info = bank->driver_priv;
  438. sim3x_info->flash_locked = (lock_word != 0xFFFFFFFF);
  439. return ERROR_OK;
  440. }
  441. static int sim3x_flash_protect_check(struct flash_bank *bank)
  442. {
  443. int ret, i;
  444. struct sim3x_info *sim3x_info;
  445. /* Check if target is halted */
  446. if (bank->target->state != TARGET_HALTED) {
  447. LOG_ERROR("Target not halted");
  448. return ERROR_TARGET_NOT_HALTED;
  449. }
  450. ret = sim3x_flash_lock_check(bank);
  451. if (ret != ERROR_OK)
  452. return ret;
  453. sim3x_info = bank->driver_priv;
  454. for (i = 0; i < bank->num_sectors; i++)
  455. bank->sectors[i].is_protected = sim3x_info->flash_locked;
  456. return ERROR_OK;
  457. }
  458. static int sim3x_flash_protect(struct flash_bank *bank, int set, int first, int last)
  459. {
  460. int ret;
  461. uint8_t lock_word[4];
  462. struct sim3x_info *sim3x_info;
  463. struct target *target;
  464. target = bank->target;
  465. /* Check if target is halted */
  466. if (target->state != TARGET_HALTED) {
  467. LOG_ERROR("Target not halted");
  468. return ERROR_TARGET_NOT_HALTED;
  469. }
  470. if (first != 0 || last != bank->num_sectors - 1) {
  471. LOG_ERROR("Flash does not support finer granularity");
  472. return ERROR_FAIL;
  473. }
  474. sim3x_info = bank->driver_priv;
  475. if (set) {
  476. if (sim3x_info->flash_locked) {
  477. LOG_INFO("Flash is already locked");
  478. return ERROR_OK;
  479. }
  480. /* Lock Flash */
  481. target_buffer_set_u32(target, lock_word, 0xFFFFFFFE);
  482. ret = sim3x_flash_write(bank, lock_word, LOCK_WORD_ADDRESS, 4);
  483. if (ret != ERROR_OK)
  484. return ret;
  485. } else {
  486. /* Flash is unlocked by an erase operation */
  487. ret = sim3x_flash_erase(bank, 0, 0);
  488. if (ret != ERROR_OK)
  489. return ret;
  490. }
  491. ret = sim3x_flash_protect_check(bank);
  492. if (ret != ERROR_OK)
  493. return ret;
  494. if (set) {
  495. if (sim3x_info->flash_locked) {
  496. LOG_INFO("Flash locked");
  497. return ERROR_OK;
  498. } else {
  499. LOG_ERROR("Flash lock error");
  500. return ERROR_FAIL;
  501. }
  502. } else {
  503. if (sim3x_info->flash_locked) {
  504. LOG_ERROR("Flash unlock error");
  505. return ERROR_FAIL;
  506. } else {
  507. LOG_INFO("Flash unlocked");
  508. return ERROR_OK;
  509. }
  510. }
  511. }
  512. static int sim3x_read_deviceid(struct flash_bank *bank)
  513. {
  514. int ret;
  515. struct sim3x_info *sim3x_info;
  516. uint32_t device_id;
  517. int part_number;
  518. char part_num_string[4];
  519. sim3x_info = bank->driver_priv;
  520. /* MCU check */
  521. ret = target_read_u32(bank->target, DEVICEID0_DEVICEID2, &device_id);
  522. if (ret != ERROR_OK)
  523. return ret;
  524. /* Device ID should be 'M3' */
  525. if (device_id != 0x00004D33)
  526. return ERROR_FAIL;
  527. /* Family and Part number */
  528. ret = target_read_u32(bank->target, DEVICEID0_DEVICEID1, &device_id);
  529. if (ret != ERROR_OK)
  530. return ret;
  531. part_num_string[0] = device_id >> 16;
  532. part_num_string[1] = device_id >> 8;
  533. part_num_string[2] = device_id;
  534. part_num_string[3] = 0;
  535. part_number = atoi(part_num_string);
  536. /* Part Number should be between 100 and 999 */
  537. if (!isalpha(device_id >> 24) || part_number < 100 || part_number > 999)
  538. return ERROR_FAIL;
  539. sim3x_info->part_family = device_id >> 24;
  540. sim3x_info->part_number = part_number;
  541. /* Package and Revision */
  542. ret = target_read_u32(bank->target, DEVICEID0_DEVICEID0, &device_id);
  543. if (ret != ERROR_OK)
  544. return ret;
  545. sim3x_info->device_package[0] = device_id >> 24;
  546. sim3x_info->device_package[1] = device_id >> 16;
  547. sim3x_info->device_package[2] = device_id >> 8;
  548. sim3x_info->device_package[3] = 0;
  549. sim3x_info->device_revision = device_id;
  550. return ERROR_OK;
  551. }
  552. static int sim3x_parse_part_info(struct sim3x_info *sim3x_info)
  553. {
  554. switch (sim3x_info->part_number) {
  555. case 134:
  556. case 136:
  557. sim3x_info->flash_size_kb = 32;
  558. break;
  559. case 144:
  560. case 146:
  561. sim3x_info->flash_size_kb = 64;
  562. break;
  563. case 154:
  564. case 156:
  565. case 157:
  566. sim3x_info->flash_size_kb = 128;
  567. break;
  568. case 164:
  569. case 166:
  570. case 167:
  571. sim3x_info->flash_size_kb = 256;
  572. break;
  573. default:
  574. LOG_ERROR("Unknown Part number %d", sim3x_info->part_number);
  575. sim3x_info->part_number = 0;
  576. return ERROR_FAIL;
  577. }
  578. switch (sim3x_info->part_family) {
  579. case 'c':
  580. case 'C':
  581. LOG_INFO("SiM3C%d detected", sim3x_info->part_number);
  582. break;
  583. case 'u':
  584. case 'U':
  585. LOG_INFO("SiM3U%d detected", sim3x_info->part_number);
  586. break;
  587. case 'l':
  588. case 'L':
  589. LOG_INFO("SiM3L%d detected", sim3x_info->part_number);
  590. break;
  591. default:
  592. LOG_ERROR("Unsupported MCU family %c", sim3x_info->part_family);
  593. sim3x_info->part_family = 0;
  594. return ERROR_FAIL;
  595. }
  596. return ERROR_OK;
  597. }
  598. static int sim3x_read_info(struct flash_bank *bank)
  599. {
  600. int ret;
  601. struct sim3x_info *sim3x_info;
  602. uint32_t cpuid;
  603. sim3x_info = bank->driver_priv;
  604. /* Core check */
  605. ret = target_read_u32(bank->target, CPUID, &cpuid);
  606. if (ret != ERROR_OK) {
  607. LOG_ERROR("Failed to read CPU ID");
  608. return ret;
  609. }
  610. if (((cpuid >> 4) & 0xfff) != 0xc23) {
  611. LOG_ERROR("Target is not CortexM3");
  612. return ERROR_FAIL;
  613. }
  614. /* Read info from chip */
  615. ret = sim3x_read_deviceid(bank);
  616. if (ret == ERROR_OK) {
  617. ret = sim3x_parse_part_info(sim3x_info);
  618. if (ret != ERROR_OK) {
  619. LOG_ERROR("Failed to parse info from MCU");
  620. return ERROR_FAIL;
  621. }
  622. } else {
  623. LOG_WARNING("Failed to read info from MCU, using info from flash bank parameters");
  624. /* Check if flash size is given in flash bank command */
  625. if (!bank->size) {
  626. LOG_ERROR("Flash size not set in the flash bank command");
  627. return ERROR_FAIL;
  628. }
  629. /* Convert bank size to kb */
  630. sim3x_info->flash_size_kb = bank->size / 1024;
  631. }
  632. LOG_INFO("Flash size = %dKB", sim3x_info->flash_size_kb);
  633. return ERROR_OK;
  634. }
  635. static int sim3x_probe(struct flash_bank *bank)
  636. {
  637. int ret, i;
  638. struct sim3x_info *sim3x_info;
  639. sim3x_info = bank->driver_priv;
  640. sim3x_info->probed = false;
  641. sim3x_info->need_init = true;
  642. /* Read info from chip */
  643. ret = sim3x_read_info(bank);
  644. if (ret != ERROR_OK)
  645. return ret;
  646. ret = sim3x_flash_lock_check(bank);
  647. if (ret != ERROR_OK)
  648. return ret;
  649. if (bank->sectors) {
  650. free(bank->sectors);
  651. bank->sectors = NULL;
  652. }
  653. bank->base = FLASH_BASE_ADDRESS;
  654. bank->size = sim3x_info->flash_size_kb * SIM3X_FLASH_PAGE_SIZE;
  655. bank->num_sectors = SIM3X_FLASH_PAGE_SIZE;
  656. bank->sectors = malloc(sizeof(struct flash_sector) * sim3x_info->flash_size_kb);
  657. for (i = 0; i < sim3x_info->flash_size_kb; i++) {
  658. bank->sectors[i].offset = i * SIM3X_FLASH_PAGE_SIZE;
  659. bank->sectors[i].size = SIM3X_FLASH_PAGE_SIZE;
  660. bank->sectors[i].is_erased = -1;
  661. bank->sectors[i].is_protected = sim3x_info->flash_locked;
  662. }
  663. sim3x_info->probed = true;
  664. return ERROR_OK;
  665. }
  666. static int sim3x_auto_probe(struct flash_bank *bank)
  667. {
  668. struct sim3x_info *sim3x_info;
  669. sim3x_info = bank->driver_priv;
  670. if (sim3x_info->probed) {
  671. sim3x_info->need_init = true;
  672. return ERROR_OK;
  673. } else {
  674. return sim3x_probe(bank);
  675. }
  676. }
  677. static int sim3x_flash_info(struct flash_bank *bank, char *buf, int buf_size)
  678. {
  679. int ret;
  680. int printed = 0;
  681. struct sim3x_info *sim3x_info;
  682. sim3x_info = bank->driver_priv;
  683. /* Read info about chip */
  684. ret = sim3x_read_info(bank);
  685. if (ret != ERROR_OK)
  686. return ret;
  687. /* Part */
  688. if (sim3x_info->part_family && sim3x_info->part_number) {
  689. printed = snprintf(buf, buf_size, "SiM3%c%d", sim3x_info->part_family, sim3x_info->part_number);
  690. buf += printed;
  691. buf_size -= printed;
  692. if (buf_size <= 0)
  693. return ERROR_BUF_TOO_SMALL;
  694. /* Revision */
  695. if (sim3x_info->device_revision && sim3x_info->device_revision <= 'Z' - 'A') {
  696. printed = snprintf(buf, buf_size, "-%c", sim3x_info->device_revision + 'A');
  697. buf += printed;
  698. buf_size -= printed;
  699. if (buf_size <= 0)
  700. return ERROR_BUF_TOO_SMALL;
  701. /* Package */
  702. if (sim3x_info->device_package) {
  703. printed = snprintf(buf, buf_size, "-G%s", sim3x_info->device_package);
  704. buf += printed;
  705. buf_size -= printed;
  706. if (buf_size <= 0)
  707. return ERROR_BUF_TOO_SMALL;
  708. }
  709. }
  710. }
  711. /* Print flash size */
  712. printed = snprintf(buf, buf_size, " flash_size = %dKB", sim3x_info->flash_size_kb);
  713. buf_size -= printed;
  714. if (buf_size <= 0)
  715. return ERROR_BUF_TOO_SMALL;
  716. return ERROR_OK;
  717. }
  718. /**
  719. * reg 31:8 - no effect
  720. * reg 7:4 - bank
  721. * reg 3:2 - register
  722. * reg 1:0 - no effect
  723. */
  724. static int ap_write_register(struct adiv5_dap *dap, unsigned reg, uint32_t value)
  725. {
  726. int retval;
  727. LOG_DEBUG("DAP_REG[0x%02x] <- %08" PRIX32, reg, value);
  728. retval = dap_queue_ap_write(dap, reg, value);
  729. if (retval != ERROR_OK) {
  730. LOG_DEBUG("DAP: failed to queue a write request");
  731. return retval;
  732. }
  733. retval = dap_run(dap);
  734. if (retval != ERROR_OK) {
  735. LOG_DEBUG("DAP: dap_run failed");
  736. return retval;
  737. }
  738. return ERROR_OK;
  739. }
  740. static int ap_read_register(struct adiv5_dap *dap, unsigned reg, uint32_t *result)
  741. {
  742. int retval;
  743. retval = dap_queue_ap_read(dap, reg, result);
  744. if (retval != ERROR_OK) {
  745. LOG_DEBUG("DAP: failed to queue a read request");
  746. return retval;
  747. }
  748. retval = dap_run(dap);
  749. if (retval != ERROR_OK) {
  750. LOG_DEBUG("DAP: dap_run failed");
  751. return retval;
  752. }
  753. LOG_DEBUG("DAP_REG[0x%02x]: %08" PRIX32, reg, *result);
  754. return ERROR_OK;
  755. }
  756. static int ap_poll_register(struct adiv5_dap *dap, unsigned reg, uint32_t mask, uint32_t value, int timeout)
  757. {
  758. uint32_t val;
  759. int retval;
  760. do {
  761. retval = ap_read_register(dap, reg, &val);
  762. if (retval != ERROR_OK || (val & mask) == value)
  763. return retval;
  764. alive_sleep(1);
  765. } while (timeout--);
  766. LOG_DEBUG("DAP: polling timed out");
  767. return ERROR_FAIL;
  768. }
  769. COMMAND_HANDLER(sim3x_mass_erase)
  770. {
  771. uint32_t val;
  772. int ret;
  773. struct target *target = get_current_target(CMD_CTX);
  774. struct cortex_m_common *cortex_m = target_to_cm(target);
  775. struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
  776. if (dap == NULL) {
  777. /* Used debug interface doesn't support direct DAP access */
  778. LOG_ERROR("mass_erase can't be used by this debug interface");
  779. return ERROR_FAIL;
  780. }
  781. const uint8_t origninal_ap = dap->ap_current >> 24;
  782. dap_ap_select(dap, SIM3X_AP);
  783. ret = ap_read_register(dap, SIM3X_AP_ID, &val);
  784. if (ret != ERROR_OK)
  785. return ret;
  786. if (val != SIM3X_AP_ID_VALUE) {
  787. LOG_ERROR("Wrong SIM3X_AP_ID");
  788. return ERROR_FAIL;
  789. }
  790. /* Mass erase sequence */
  791. ret = ap_write_register(dap, SIM3X_AP_CTRL1, SIM3X_AP_CTRL1_RESET_REQ);
  792. if (ret != ERROR_OK)
  793. return ret;
  794. ret = ap_write_register(dap, SIM3X_AP_CTRL1, SIM3X_AP_CTRL1_RESET_REQ | SIM3X_AP_CTRL1_MASS_ERASE_REQ);
  795. if (ret != ERROR_OK)
  796. return ret;
  797. ret = ap_poll_register(dap, SIM3X_AP_CTRL1, SIM3X_AP_CTRL1_MASS_ERASE_REQ, 0x00000000, FLASH_BUSY_TIMEOUT);
  798. if (ret != ERROR_OK)
  799. return ret;
  800. ret = ap_write_register(dap, SIM3X_AP_CTRL1, 0x00000000); /* clear SIM3X_AP_CTRL1_RESET_REQ */
  801. if (ret != ERROR_OK)
  802. return ret;
  803. dap_ap_select(dap, origninal_ap);
  804. LOG_INFO("Mass erase success");
  805. return ERROR_OK;
  806. }
  807. COMMAND_HANDLER(sim3x_lock)
  808. {
  809. uint32_t val;
  810. int ret;
  811. struct target *target = get_current_target(CMD_CTX);
  812. struct cortex_m_common *cortex_m = target_to_cm(target);
  813. struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
  814. if (dap == NULL) {
  815. /* Used debug interface doesn't support direct DAP access */
  816. LOG_INFO("Target can't by unlocked by this debug interface");
  817. /* Core check */
  818. ret = target_read_u32(target, CPUID, &val);
  819. if (ret != ERROR_OK)
  820. return ret;
  821. if ((val & CPUID_CHECK_VALUE_MASK) != CPUID_CHECK_VALUE) {
  822. LOG_ERROR("Target is not ARM CortexM3 or is already locked");
  823. return ERROR_FAIL;
  824. }
  825. } else {
  826. const uint8_t origninal_ap = dap->ap_current >> 24;
  827. dap_ap_select(dap, SIM3X_AP);
  828. /* check SIM3X_AP_ID */
  829. ret = ap_read_register(dap, SIM3X_AP_ID, &val);
  830. if (ret != ERROR_OK)
  831. return ret;
  832. if (val != SIM3X_AP_ID_VALUE) {
  833. LOG_ERROR("Wrong SIM3X_AP_ID");
  834. return ERROR_FAIL;
  835. }
  836. /* check if locked */
  837. ret = target_read_u32(target, CPUID, &val);
  838. /* if correct value is read, then it will continue */
  839. if (ret != ERROR_OK || (val & CPUID_CHECK_VALUE_MASK) != CPUID_CHECK_VALUE) {
  840. /* if correct value is'n read, then it will check SIM3X_AP_INIT_STAT register */
  841. ret = ap_read_register(dap, SIM3X_AP_INIT_STAT, &val);
  842. if (ret != ERROR_OK)
  843. return ret;
  844. dap_ap_select(dap, origninal_ap);
  845. if (val & SIM3X_AP_INIT_STAT_LOCK) {
  846. LOG_INFO("Target is already locked");
  847. return ERROR_OK;
  848. } else {
  849. LOG_ERROR("Target doesn't seem to be locked but memory was not read correct");
  850. return ERROR_FAIL;
  851. }
  852. }
  853. dap_ap_select(dap, origninal_ap);
  854. }
  855. ret = target_read_u32(target, LOCK_WORD_ADDRESS, &val);
  856. if (ret != ERROR_OK)
  857. return ret;
  858. if (val == LOCK_WORD_MCU_UNLOCKED) {
  859. /* Lock Flash */
  860. uint8_t lock_word[4];
  861. target_buffer_set_u32(target, lock_word, 0xFFFFFFFE);
  862. /* Get Flash Bank */
  863. struct flash_bank *bank;
  864. int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
  865. if (retval != ERROR_OK)
  866. return retval;
  867. ret = sim3x_flash_write(bank, lock_word, LOCK_WORD_ADDRESS, 4);
  868. if (ERROR_OK != ret)
  869. return ret;
  870. LOG_INFO("Target is successfully locked");
  871. return ERROR_OK;
  872. } else if (val == LOCK_WORD_MCU_UNLOCKED_BY_FIRMWARE) {
  873. /* Can't by locked again without erase, because LOCK_WORD is in FLASH */
  874. LOG_ERROR("Target is unlocked by firmware and can't by locked again without the lock page erase or mass erase");
  875. return ERROR_FAIL;
  876. } else {
  877. LOG_ERROR("Unexpected lock word value");
  878. /* SIM3X_AP_ID_VALUE is not checked */
  879. if (dap == NULL)
  880. LOG_INFO("Maybe this isn't a SiM3x MCU");
  881. return ERROR_FAIL;
  882. }
  883. }
  884. static const struct command_registration sim3x_exec_command_handlers[] = {
  885. {
  886. .name = "mass_erase",
  887. .mode = COMMAND_EXEC,
  888. .help = "Erase the complete flash",
  889. .usage = "",
  890. .handler = sim3x_mass_erase,
  891. },
  892. {
  893. .name = "lock",
  894. .mode = COMMAND_EXEC,
  895. .help = "Locks the flash. Unlock by mass erase",
  896. .usage = "",
  897. .handler = sim3x_lock,
  898. },
  899. COMMAND_REGISTRATION_DONE
  900. };
  901. static const struct command_registration sim3x_command_handlers[] = {
  902. {
  903. .name = "sim3x",
  904. .mode = COMMAND_ANY,
  905. .help = "sim3x flash command group",
  906. .usage = "",
  907. .chain = sim3x_exec_command_handlers,
  908. },
  909. COMMAND_REGISTRATION_DONE
  910. };
  911. struct flash_driver sim3x_flash = {
  912. .name = "sim3x",
  913. .commands = sim3x_command_handlers,
  914. .flash_bank_command = sim3x_flash_bank_command,
  915. .erase = sim3x_flash_erase,
  916. .protect = sim3x_flash_protect,
  917. .write = sim3x_flash_write,
  918. .read = default_flash_read,
  919. .probe = sim3x_probe,
  920. .auto_probe = sim3x_auto_probe,
  921. .erase_check = default_flash_blank_check,
  922. .protect_check = sim3x_flash_protect_check,
  923. .info = sim3x_flash_info
  924. };