1 /***************************************************************************
2 * Copyright (C) 2013 by Andrey Yurovsky *
3 * Andrey Yurovsky <yurovsky@gmail.com> *
5 * This program is free software; you can redistribute it and/or modify *
6 * it under the terms of the GNU General Public License as published by *
7 * the Free Software Foundation; either version 2 of the License, or *
8 * (at your option) any later version. *
10 * This program is distributed in the hope that it will be useful, *
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
13 * GNU General Public License for more details. *
15 * You should have received a copy of the GNU General Public License *
16 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
17 ***************************************************************************/
24 #include "helper/binarybuffer.h"
26 #include <target/cortex_m.h>
28 #define SAMD_NUM_PROT_BLOCKS 16
29 #define SAMD_PAGE_SIZE_MAX 1024
31 #define SAMD_FLASH ((uint32_t)0x00000000) /* physical Flash memory */
32 #define SAMD_USER_ROW ((uint32_t)0x00804000) /* User Row of Flash */
33 #define SAMD_PAC1 0x41000000 /* Peripheral Access Control 1 */
34 #define SAMD_DSU 0x41002000 /* Device Service Unit */
35 #define SAMD_NVMCTRL 0x41004000 /* Non-volatile memory controller */
37 #define SAMD_DSU_STATUSA 1 /* DSU status register */
38 #define SAMD_DSU_DID 0x18 /* Device ID register */
39 #define SAMD_DSU_CTRL_EXT 0x100 /* CTRL register, external access */
41 #define SAMD_NVMCTRL_CTRLA 0x00 /* NVM control A register */
42 #define SAMD_NVMCTRL_CTRLB 0x04 /* NVM control B register */
43 #define SAMD_NVMCTRL_PARAM 0x08 /* NVM parameters register */
44 #define SAMD_NVMCTRL_INTFLAG 0x18 /* NVM Interupt Flag Status & Clear */
45 #define SAMD_NVMCTRL_STATUS 0x18 /* NVM status register */
46 #define SAMD_NVMCTRL_ADDR 0x1C /* NVM address register */
47 #define SAMD_NVMCTRL_LOCK 0x20 /* NVM Lock section register */
49 #define SAMD_CMDEX_KEY 0xA5UL
50 #define SAMD_NVM_CMD(n) ((SAMD_CMDEX_KEY << 8) | (n & 0x7F))
52 /* NVMCTRL commands. See Table 20-4 in 42129F–SAM–10/2013 */
53 #define SAMD_NVM_CMD_ER 0x02 /* Erase Row */
54 #define SAMD_NVM_CMD_WP 0x04 /* Write Page */
55 #define SAMD_NVM_CMD_EAR 0x05 /* Erase Auxilary Row */
56 #define SAMD_NVM_CMD_WAP 0x06 /* Write Auxilary Page */
57 #define SAMD_NVM_CMD_LR 0x40 /* Lock Region */
58 #define SAMD_NVM_CMD_UR 0x41 /* Unlock Region */
59 #define SAMD_NVM_CMD_SPRM 0x42 /* Set Power Reduction Mode */
60 #define SAMD_NVM_CMD_CPRM 0x43 /* Clear Power Reduction Mode */
61 #define SAMD_NVM_CMD_PBC 0x44 /* Page Buffer Clear */
62 #define SAMD_NVM_CMD_SSB 0x45 /* Set Security Bit */
63 #define SAMD_NVM_CMD_INVALL 0x46 /* Invalidate all caches */
66 #define SAMD_NVM_CTRLB_MANW 0x80
68 /* Known identifiers */
69 #define SAMD_PROCESSOR_M0 0x01
70 #define SAMD_FAMILY_D 0x00
71 #define SAMD_FAMILY_L 0x01
72 #define SAMD_FAMILY_C 0x02
73 #define SAMD_SERIES_20 0x00
74 #define SAMD_SERIES_21 0x01
75 #define SAMD_SERIES_22 0x02
76 #define SAMD_SERIES_10 0x02
77 #define SAMD_SERIES_11 0x03
78 #define SAMD_SERIES_09 0x04
80 /* Device ID macros */
81 #define SAMD_GET_PROCESSOR(id) (id >> 28)
82 #define SAMD_GET_FAMILY(id) (((id >> 23) & 0x1F))
83 #define SAMD_GET_SERIES(id) (((id >> 16) & 0x3F))
84 #define SAMD_GET_DEVSEL(id) (id & 0xFF)
86 /* Bits to mask out lockbits in user row */
87 #define NVMUSERROW_LOCKBIT_MASK ((uint64_t)0x0000FFFFFFFFFFFF)
96 /* Known SAMD09 parts. DID reset values missing in RM, see
97 * https://github.com/avrxml/asf/blob/master/sam0/utils/cmsis/samd09/include/ */
98 static const struct samd_part samd09_parts[] = {
99 { 0x0, "SAMD09D14A", 16, 4 },
100 { 0x7, "SAMD09C13A", 8, 4 },
103 /* Known SAMD10 parts */
104 static const struct samd_part samd10_parts[] = {
105 { 0x0, "SAMD10D14AMU", 16, 4 },
106 { 0x1, "SAMD10D13AMU", 8, 4 },
107 { 0x2, "SAMD10D12AMU", 4, 4 },
108 { 0x3, "SAMD10D14ASU", 16, 4 },
109 { 0x4, "SAMD10D13ASU", 8, 4 },
110 { 0x5, "SAMD10D12ASU", 4, 4 },
111 { 0x6, "SAMD10C14A", 16, 4 },
112 { 0x7, "SAMD10C13A", 8, 4 },
113 { 0x8, "SAMD10C12A", 4, 4 },
116 /* Known SAMD11 parts */
117 static const struct samd_part samd11_parts[] = {
118 { 0x0, "SAMD11D14AM", 16, 4 },
119 { 0x1, "SAMD11D13AMU", 8, 4 },
120 { 0x2, "SAMD11D12AMU", 4, 4 },
121 { 0x3, "SAMD11D14ASS", 16, 4 },
122 { 0x4, "SAMD11D13ASU", 8, 4 },
123 { 0x5, "SAMD11D12ASU", 4, 4 },
124 { 0x6, "SAMD11C14A", 16, 4 },
125 { 0x7, "SAMD11C13A", 8, 4 },
126 { 0x8, "SAMD11C12A", 4, 4 },
127 { 0x9, "SAMD11D14AU", 16, 4 },
130 /* Known SAMD20 parts. See Table 12-8 in 42129F–SAM–10/2013 */
131 static const struct samd_part samd20_parts[] = {
132 { 0x0, "SAMD20J18A", 256, 32 },
133 { 0x1, "SAMD20J17A", 128, 16 },
134 { 0x2, "SAMD20J16A", 64, 8 },
135 { 0x3, "SAMD20J15A", 32, 4 },
136 { 0x4, "SAMD20J14A", 16, 2 },
137 { 0x5, "SAMD20G18A", 256, 32 },
138 { 0x6, "SAMD20G17A", 128, 16 },
139 { 0x7, "SAMD20G16A", 64, 8 },
140 { 0x8, "SAMD20G15A", 32, 4 },
141 { 0x9, "SAMD20G14A", 16, 2 },
142 { 0xA, "SAMD20E18A", 256, 32 },
143 { 0xB, "SAMD20E17A", 128, 16 },
144 { 0xC, "SAMD20E16A", 64, 8 },
145 { 0xD, "SAMD20E15A", 32, 4 },
146 { 0xE, "SAMD20E14A", 16, 2 },
149 /* Known SAMD21 parts. */
150 static const struct samd_part samd21_parts[] = {
151 { 0x0, "SAMD21J18A", 256, 32 },
152 { 0x1, "SAMD21J17A", 128, 16 },
153 { 0x2, "SAMD21J16A", 64, 8 },
154 { 0x3, "SAMD21J15A", 32, 4 },
155 { 0x4, "SAMD21J14A", 16, 2 },
156 { 0x5, "SAMD21G18A", 256, 32 },
157 { 0x6, "SAMD21G17A", 128, 16 },
158 { 0x7, "SAMD21G16A", 64, 8 },
159 { 0x8, "SAMD21G15A", 32, 4 },
160 { 0x9, "SAMD21G14A", 16, 2 },
161 { 0xA, "SAMD21E18A", 256, 32 },
162 { 0xB, "SAMD21E17A", 128, 16 },
163 { 0xC, "SAMD21E16A", 64, 8 },
164 { 0xD, "SAMD21E15A", 32, 4 },
165 { 0xE, "SAMD21E14A", 16, 2 },
167 /* SAMR21 parts have integrated SAMD21 with a radio */
168 { 0x18, "SAMR21G19A", 256, 32 }, /* with 512k of serial flash */
169 { 0x19, "SAMR21G18A", 256, 32 },
170 { 0x1A, "SAMR21G17A", 128, 32 },
171 { 0x1B, "SAMR21G16A", 64, 16 },
172 { 0x1C, "SAMR21E18A", 256, 32 },
173 { 0x1D, "SAMR21E17A", 128, 32 },
174 { 0x1E, "SAMR21E16A", 64, 16 },
176 /* SAMD21 B Variants (Table 3-7 from rev I of datasheet) */
177 { 0x20, "SAMD21J16B", 64, 8 },
178 { 0x21, "SAMD21J15B", 32, 4 },
179 { 0x23, "SAMD21G16B", 64, 8 },
180 { 0x24, "SAMD21G15B", 32, 4 },
181 { 0x26, "SAMD21E16B", 64, 8 },
182 { 0x27, "SAMD21E15B", 32, 4 },
184 /* SAMD21 D and L Variants (from Errata)
185 http://ww1.microchip.com/downloads/en/DeviceDoc/
186 SAM-D21-Family-Silicon-Errata-and-DataSheet-Clarification-DS80000760D.pdf */
187 { 0x55, "SAMD21E16BU", 64, 8 },
188 { 0x56, "SAMD21E15BU", 32, 4 },
189 { 0x57, "SAMD21G16L", 64, 8 },
190 { 0x3E, "SAMD21E16L", 64, 8 },
191 { 0x3F, "SAMD21E15L", 32, 4 },
192 { 0x62, "SAMD21E16CU", 64, 8 },
193 { 0x63, "SAMD21E15CU", 32, 4 },
194 { 0x92, "SAMD21J17D", 128, 16 },
195 { 0x93, "SAMD21G17D", 128, 16 },
196 { 0x94, "SAMD21E17D", 128, 16 },
197 { 0x95, "SAMD21E17DU", 128, 16 },
198 { 0x96, "SAMD21G17L", 128, 16 },
199 { 0x97, "SAMD21E17L", 128, 16 },
201 /* Known SAMDA1 parts.
202 SAMD-A1 series uses the same series identifier like the SAMD21
203 taken from http://ww1.microchip.com/downloads/en/DeviceDoc/40001895A.pdf (pages 14-17) */
204 { 0x29, "SAMDA1J16A", 64, 8 },
205 { 0x2A, "SAMDA1J15A", 32, 4 },
206 { 0x2B, "SAMDA1J14A", 16, 4 },
207 { 0x2C, "SAMDA1G16A", 64, 8 },
208 { 0x2D, "SAMDA1G15A", 32, 4 },
209 { 0x2E, "SAMDA1G14A", 16, 4 },
210 { 0x2F, "SAMDA1E16A", 64, 8 },
211 { 0x30, "SAMDA1E15A", 32, 4 },
212 { 0x31, "SAMDA1E14A", 16, 4 },
213 { 0x64, "SAMDA1J16B", 64, 8 },
214 { 0x65, "SAMDA1J15B", 32, 4 },
215 { 0x66, "SAMDA1J14B", 16, 4 },
216 { 0x67, "SAMDA1G16B", 64, 8 },
217 { 0x68, "SAMDA1G15B", 32, 4 },
218 { 0x69, "SAMDA1G14B", 16, 4 },
219 { 0x6A, "SAMDA1E16B", 64, 8 },
220 { 0x6B, "SAMDA1E15B", 32, 4 },
221 { 0x6C, "SAMDA1E14B", 16, 4 },
224 /* Known SAML21 parts. */
225 static const struct samd_part saml21_parts[] = {
226 { 0x00, "SAML21J18A", 256, 32 },
227 { 0x01, "SAML21J17A", 128, 16 },
228 { 0x02, "SAML21J16A", 64, 8 },
229 { 0x05, "SAML21G18A", 256, 32 },
230 { 0x06, "SAML21G17A", 128, 16 },
231 { 0x07, "SAML21G16A", 64, 8 },
232 { 0x0A, "SAML21E18A", 256, 32 },
233 { 0x0B, "SAML21E17A", 128, 16 },
234 { 0x0C, "SAML21E16A", 64, 8 },
235 { 0x0D, "SAML21E15A", 32, 4 },
236 { 0x0F, "SAML21J18B", 256, 32 },
237 { 0x10, "SAML21J17B", 128, 16 },
238 { 0x11, "SAML21J16B", 64, 8 },
239 { 0x14, "SAML21G18B", 256, 32 },
240 { 0x15, "SAML21G17B", 128, 16 },
241 { 0x16, "SAML21G16B", 64, 8 },
242 { 0x19, "SAML21E18B", 256, 32 },
243 { 0x1A, "SAML21E17B", 128, 16 },
244 { 0x1B, "SAML21E16B", 64, 8 },
245 { 0x1C, "SAML21E15B", 32, 4 },
247 /* SAMR30 parts have integrated SAML21 with a radio */
248 { 0x1E, "SAMR30G18A", 256, 32 },
249 { 0x1F, "SAMR30E18A", 256, 32 },
251 /* SAMR34/R35 parts have integrated SAML21 with a lora radio */
252 { 0x28, "SAMR34J18", 256, 32 },
255 /* Known SAML22 parts. */
256 static const struct samd_part saml22_parts[] = {
257 { 0x00, "SAML22N18A", 256, 32 },
258 { 0x01, "SAML22N17A", 128, 16 },
259 { 0x02, "SAML22N16A", 64, 8 },
260 { 0x05, "SAML22J18A", 256, 32 },
261 { 0x06, "SAML22J17A", 128, 16 },
262 { 0x07, "SAML22J16A", 64, 8 },
263 { 0x0A, "SAML22G18A", 256, 32 },
264 { 0x0B, "SAML22G17A", 128, 16 },
265 { 0x0C, "SAML22G16A", 64, 8 },
268 /* Known SAMC20 parts. */
269 static const struct samd_part samc20_parts[] = {
270 { 0x00, "SAMC20J18A", 256, 32 },
271 { 0x01, "SAMC20J17A", 128, 16 },
272 { 0x02, "SAMC20J16A", 64, 8 },
273 { 0x03, "SAMC20J15A", 32, 4 },
274 { 0x05, "SAMC20G18A", 256, 32 },
275 { 0x06, "SAMC20G17A", 128, 16 },
276 { 0x07, "SAMC20G16A", 64, 8 },
277 { 0x08, "SAMC20G15A", 32, 4 },
278 { 0x0A, "SAMC20E18A", 256, 32 },
279 { 0x0B, "SAMC20E17A", 128, 16 },
280 { 0x0C, "SAMC20E16A", 64, 8 },
281 { 0x0D, "SAMC20E15A", 32, 4 },
282 { 0x20, "SAMC20N18A", 256, 32 },
283 { 0x21, "SAMC20N17A", 128, 16 },
286 /* Known SAMC21 parts. */
287 static const struct samd_part samc21_parts[] = {
288 { 0x00, "SAMC21J18A", 256, 32 },
289 { 0x01, "SAMC21J17A", 128, 16 },
290 { 0x02, "SAMC21J16A", 64, 8 },
291 { 0x03, "SAMC21J15A", 32, 4 },
292 { 0x05, "SAMC21G18A", 256, 32 },
293 { 0x06, "SAMC21G17A", 128, 16 },
294 { 0x07, "SAMC21G16A", 64, 8 },
295 { 0x08, "SAMC21G15A", 32, 4 },
296 { 0x0A, "SAMC21E18A", 256, 32 },
297 { 0x0B, "SAMC21E17A", 128, 16 },
298 { 0x0C, "SAMC21E16A", 64, 8 },
299 { 0x0D, "SAMC21E15A", 32, 4 },
300 { 0x20, "SAMC21N18A", 256, 32 },
301 { 0x21, "SAMC21N17A", 128, 16 },
304 /* Each family of parts contains a parts table in the DEVSEL field of DID. The
305 * processor ID, family ID, and series ID are used to determine which exact
306 * family this is and then we can use the corresponding table. */
311 const struct samd_part *parts;
313 uint64_t nvm_userrow_res_mask; /* protect bits which are reserved, 0 -> protect */
316 /* Known SAMD families */
317 static const struct samd_family samd_families[] = {
318 { SAMD_PROCESSOR_M0, SAMD_FAMILY_D, SAMD_SERIES_20,
319 samd20_parts, ARRAY_SIZE(samd20_parts),
320 (uint64_t)0xFFFF01FFFE01FF77 },
321 { SAMD_PROCESSOR_M0, SAMD_FAMILY_D, SAMD_SERIES_21,
322 samd21_parts, ARRAY_SIZE(samd21_parts),
323 (uint64_t)0xFFFF01FFFE01FF77 },
324 { SAMD_PROCESSOR_M0, SAMD_FAMILY_D, SAMD_SERIES_09,
325 samd09_parts, ARRAY_SIZE(samd09_parts),
326 (uint64_t)0xFFFF01FFFE01FF77 },
327 { SAMD_PROCESSOR_M0, SAMD_FAMILY_D, SAMD_SERIES_10,
328 samd10_parts, ARRAY_SIZE(samd10_parts),
329 (uint64_t)0xFFFF01FFFE01FF77 },
330 { SAMD_PROCESSOR_M0, SAMD_FAMILY_D, SAMD_SERIES_11,
331 samd11_parts, ARRAY_SIZE(samd11_parts),
332 (uint64_t)0xFFFF01FFFE01FF77 },
333 { SAMD_PROCESSOR_M0, SAMD_FAMILY_L, SAMD_SERIES_21,
334 saml21_parts, ARRAY_SIZE(saml21_parts),
335 (uint64_t)0xFFFF03FFFC01FF77 },
336 { SAMD_PROCESSOR_M0, SAMD_FAMILY_L, SAMD_SERIES_22,
337 saml22_parts, ARRAY_SIZE(saml22_parts),
338 (uint64_t)0xFFFF03FFFC01FF77 },
339 { SAMD_PROCESSOR_M0, SAMD_FAMILY_C, SAMD_SERIES_20,
340 samc20_parts, ARRAY_SIZE(samc20_parts),
341 (uint64_t)0xFFFF03FFFC01FF77 },
342 { SAMD_PROCESSOR_M0, SAMD_FAMILY_C, SAMD_SERIES_21,
343 samc21_parts, ARRAY_SIZE(samc21_parts),
344 (uint64_t)0xFFFF03FFFC01FF77 },
354 struct target *target;
359 * Gives the family structure to specific device id.
360 * @param id The id of the device.
361 * @return On failure NULL, otherwise a pointer to the structure.
363 static const struct samd_family *samd_find_family(uint32_t id)
365 uint8_t processor = SAMD_GET_PROCESSOR(id);
366 uint8_t family = SAMD_GET_FAMILY(id);
367 uint8_t series = SAMD_GET_SERIES(id);
369 for (unsigned i = 0; i < ARRAY_SIZE(samd_families); i++) {
370 if (samd_families[i].processor == processor &&
371 samd_families[i].series == series &&
372 samd_families[i].family == family)
373 return &samd_families[i];
380 * Gives the part structure to specific device id.
381 * @param id The id of the device.
382 * @return On failure NULL, otherwise a pointer to the structure.
384 static const struct samd_part *samd_find_part(uint32_t id)
386 uint8_t devsel = SAMD_GET_DEVSEL(id);
387 const struct samd_family *family = samd_find_family(id);
391 for (unsigned i = 0; i < family->num_parts; i++) {
392 if (family->parts[i].id == devsel)
393 return &family->parts[i];
399 static int samd_protect_check(struct flash_bank *bank)
404 res = target_read_u16(bank->target,
405 SAMD_NVMCTRL + SAMD_NVMCTRL_LOCK, &lock);
409 /* Lock bits are active-low */
410 for (prot_block = 0; prot_block < bank->num_prot_blocks; prot_block++)
411 bank->prot_blocks[prot_block].is_protected = !(lock & (1u<<prot_block));
416 static int samd_get_flash_page_info(struct target *target,
417 uint32_t *sizep, int *nump)
422 res = target_read_u32(target, SAMD_NVMCTRL + SAMD_NVMCTRL_PARAM, ¶m);
423 if (res == ERROR_OK) {
424 /* The PSZ field (bits 18:16) indicate the page size bytes as 2^(3+n)
425 * so 0 is 8KB and 7 is 1024KB. */
427 *sizep = (8 << ((param >> 16) & 0x7));
428 /* The NVMP field (bits 15:0) indicates the total number of pages */
430 *nump = param & 0xFFFF;
432 LOG_ERROR("Couldn't read NVM Parameters register");
438 static int samd_probe(struct flash_bank *bank)
442 struct samd_info *chip = (struct samd_info *)bank->driver_priv;
443 const struct samd_part *part;
448 res = target_read_u32(bank->target, SAMD_DSU + SAMD_DSU_DID, &id);
449 if (res != ERROR_OK) {
450 LOG_ERROR("Couldn't read Device ID register");
454 part = samd_find_part(id);
456 LOG_ERROR("Couldn't find part corresponding to DID %08" PRIx32, id);
460 bank->size = part->flash_kb * 1024;
462 res = samd_get_flash_page_info(bank->target, &chip->page_size,
464 if (res != ERROR_OK) {
465 LOG_ERROR("Couldn't determine Flash page size");
469 /* Sanity check: the total flash size in the DSU should match the page size
470 * multiplied by the number of pages. */
471 if (bank->size != chip->num_pages * chip->page_size) {
472 LOG_WARNING("SAMD: bank size doesn't match NVM parameters. "
473 "Identified %" PRIu32 "KB Flash but NVMCTRL reports %u %" PRIu32 "B pages",
474 part->flash_kb, chip->num_pages, chip->page_size);
477 /* Erase granularity = 1 row = 4 pages */
478 chip->sector_size = chip->page_size * 4;
480 /* Allocate the sector table */
481 bank->num_sectors = chip->num_pages / 4;
482 bank->sectors = alloc_block_array(0, chip->sector_size, bank->num_sectors);
486 /* 16 protection blocks per device */
487 chip->prot_block_size = bank->size / SAMD_NUM_PROT_BLOCKS;
489 /* Allocate the table of protection blocks */
490 bank->num_prot_blocks = SAMD_NUM_PROT_BLOCKS;
491 bank->prot_blocks = alloc_block_array(0, chip->prot_block_size, bank->num_prot_blocks);
492 if (!bank->prot_blocks)
495 samd_protect_check(bank);
500 LOG_INFO("SAMD MCU: %s (%" PRIu32 "KB Flash, %" PRIu32 "KB RAM)", part->name,
501 part->flash_kb, part->ram_kb);
506 static int samd_check_error(struct target *target)
511 ret = target_read_u16(target,
512 SAMD_NVMCTRL + SAMD_NVMCTRL_STATUS, &status);
513 if (ret != ERROR_OK) {
514 LOG_ERROR("Can't read NVM status");
518 if ((status & 0x001C) == 0)
521 if (status & (1 << 4)) { /* NVME */
522 LOG_ERROR("SAMD: NVM Error");
523 ret = ERROR_FLASH_OPERATION_FAILED;
526 if (status & (1 << 3)) { /* LOCKE */
527 LOG_ERROR("SAMD: NVM lock error");
528 ret = ERROR_FLASH_PROTECTED;
531 if (status & (1 << 2)) { /* PROGE */
532 LOG_ERROR("SAMD: NVM programming error");
533 ret = ERROR_FLASH_OPER_UNSUPPORTED;
536 /* Clear the error conditions by writing a one to them */
537 ret2 = target_write_u16(target,
538 SAMD_NVMCTRL + SAMD_NVMCTRL_STATUS, status);
539 if (ret2 != ERROR_OK)
540 LOG_ERROR("Can't clear NVM error conditions");
545 static int samd_issue_nvmctrl_command(struct target *target, uint16_t cmd)
549 if (target->state != TARGET_HALTED) {
550 LOG_ERROR("Target not halted");
551 return ERROR_TARGET_NOT_HALTED;
554 /* Issue the NVM command */
555 res = target_write_u16(target,
556 SAMD_NVMCTRL + SAMD_NVMCTRL_CTRLA, SAMD_NVM_CMD(cmd));
560 /* Check to see if the NVM command resulted in an error condition. */
561 return samd_check_error(target);
565 * Erases a flash-row at the given address.
566 * @param target Pointer to the target structure.
567 * @param address The address of the row.
568 * @return On success ERROR_OK, on failure an errorcode.
570 static int samd_erase_row(struct target *target, uint32_t address)
574 /* Set an address contained in the row to be erased */
575 res = target_write_u32(target,
576 SAMD_NVMCTRL + SAMD_NVMCTRL_ADDR, address >> 1);
578 /* Issue the Erase Row command to erase that row. */
580 res = samd_issue_nvmctrl_command(target,
581 address == SAMD_USER_ROW ? SAMD_NVM_CMD_EAR : SAMD_NVM_CMD_ER);
583 if (res != ERROR_OK) {
584 LOG_ERROR("Failed to erase row containing %08" PRIx32, address);
592 * Returns the bitmask of reserved bits in register.
593 * @param target Pointer to the target structure.
594 * @param mask Bitmask, 0 -> value stays untouched.
595 * @return On success ERROR_OK, on failure an errorcode.
597 static int samd_get_reservedmask(struct target *target, uint64_t *mask)
600 /* Get the devicetype */
602 res = target_read_u32(target, SAMD_DSU + SAMD_DSU_DID, &id);
603 if (res != ERROR_OK) {
604 LOG_ERROR("Couldn't read Device ID register");
607 const struct samd_family *family;
608 family = samd_find_family(id);
609 if (family == NULL) {
610 LOG_ERROR("Couldn't determine device family");
613 *mask = family->nvm_userrow_res_mask;
617 static int read_userrow(struct target *target, uint64_t *userrow)
622 res = target_read_memory(target, SAMD_USER_ROW, 4, 2, buffer);
626 *userrow = target_buffer_get_u64(target, buffer);
631 * Modify the contents of the User Row in Flash. The User Row itself
632 * has a size of one page and contains a combination of "fuses" and
633 * calibration data. Bits which have a value of zero in the mask will
634 * not be changed. Up to now devices only use the first 64 bits.
635 * @param target Pointer to the target structure.
636 * @param value_input The value to write.
637 * @param value_mask Bitmask, 0 -> value stays untouched.
638 * @return On success ERROR_OK, on failure an errorcode.
640 static int samd_modify_user_row_masked(struct target *target,
641 uint64_t value_input, uint64_t value_mask)
645 bool manual_wp = true;
647 /* Retrieve the MCU's page size, in bytes. This is also the size of the
648 * entire User Row. */
650 res = samd_get_flash_page_info(target, &page_size, NULL);
651 if (res != ERROR_OK) {
652 LOG_ERROR("Couldn't determine Flash page size");
656 /* Make sure the size is sane. */
657 assert(page_size <= SAMD_PAGE_SIZE_MAX &&
658 page_size >= sizeof(value_input));
660 uint8_t buf[SAMD_PAGE_SIZE_MAX];
661 /* Read the user row (comprising one page) by words. */
662 res = target_read_memory(target, SAMD_USER_ROW, 4, page_size / 4, buf);
666 uint64_t value_device;
667 res = read_userrow(target, &value_device);
670 uint64_t value_new = (value_input & value_mask) | (value_device & ~value_mask);
672 /* We will need to erase before writing if the new value needs a '1' in any
673 * position for which the current value had a '0'. Otherwise we can avoid
675 if ((~value_device) & value_new) {
676 res = samd_erase_row(target, SAMD_USER_ROW);
677 if (res != ERROR_OK) {
678 LOG_ERROR("Couldn't erase user row");
684 target_buffer_set_u64(target, buf, value_new);
686 /* Write the page buffer back out to the target. */
687 res = target_write_memory(target, SAMD_USER_ROW, 4, page_size / 4, buf);
691 /* Check if we need to do manual page write commands */
692 res = target_read_u32(target, SAMD_NVMCTRL + SAMD_NVMCTRL_CTRLB, &nvm_ctrlb);
694 manual_wp = (nvm_ctrlb & SAMD_NVM_CTRLB_MANW) != 0;
696 LOG_ERROR("Read of NVM register CTRKB failed.");
700 /* Trigger flash write */
701 res = samd_issue_nvmctrl_command(target, SAMD_NVM_CMD_WAP);
703 res = samd_check_error(target);
710 * Modifies the user row register to the given value.
711 * @param target Pointer to the target structure.
712 * @param value The value to write.
713 * @param startb The bit-offset by which the given value is shifted.
714 * @param endb The bit-offset of the last bit in value to write.
715 * @return On success ERROR_OK, on failure an errorcode.
717 static int samd_modify_user_row(struct target *target, uint64_t value,
718 uint8_t startb, uint8_t endb)
722 for (i = startb ; i <= endb ; i++)
723 mask |= ((uint64_t)1) << i;
725 return samd_modify_user_row_masked(target, value << startb, mask);
728 static int samd_protect(struct flash_bank *bank, int set, int first_prot_bl, int last_prot_bl)
733 /* We can issue lock/unlock region commands with the target running but
734 * the settings won't persist unless we're able to modify the LOCK regions
735 * and that requires the target to be halted. */
736 if (bank->target->state != TARGET_HALTED) {
737 LOG_ERROR("Target not halted");
738 return ERROR_TARGET_NOT_HALTED;
741 for (prot_block = first_prot_bl; prot_block <= last_prot_bl; prot_block++) {
742 if (set != bank->prot_blocks[prot_block].is_protected) {
743 /* Load an address that is within this protection block (we use offset 0) */
744 res = target_write_u32(bank->target,
745 SAMD_NVMCTRL + SAMD_NVMCTRL_ADDR,
746 bank->prot_blocks[prot_block].offset >> 1);
750 /* Tell the controller to lock that block */
751 res = samd_issue_nvmctrl_command(bank->target,
752 set ? SAMD_NVM_CMD_LR : SAMD_NVM_CMD_UR);
758 /* We've now applied our changes, however they will be undone by the next
759 * reset unless we also apply them to the LOCK bits in the User Page. The
760 * LOCK bits start at bit 48, corresponding to Sector 0 and end with bit 63,
761 * corresponding to Sector 15. A '1' means unlocked and a '0' means
762 * locked. See Table 9-3 in the SAMD20 datasheet for more details. */
764 res = samd_modify_user_row(bank->target,
765 set ? (uint64_t)0 : (uint64_t)UINT64_MAX,
766 48 + first_prot_bl, 48 + last_prot_bl);
768 LOG_WARNING("SAMD: protect settings were not made persistent!");
773 samd_protect_check(bank);
778 static int samd_erase(struct flash_bank *bank, int first_sect, int last_sect)
781 struct samd_info *chip = (struct samd_info *)bank->driver_priv;
783 if (bank->target->state != TARGET_HALTED) {
784 LOG_ERROR("Target not halted");
786 return ERROR_TARGET_NOT_HALTED;
790 if (samd_probe(bank) != ERROR_OK)
791 return ERROR_FLASH_BANK_NOT_PROBED;
794 /* For each sector to be erased */
795 for (s = first_sect; s <= last_sect; s++) {
796 res = samd_erase_row(bank->target, bank->sectors[s].offset);
797 if (res != ERROR_OK) {
798 LOG_ERROR("SAMD: failed to erase sector %d at 0x%08" PRIx32, s, bank->sectors[s].offset);
807 static int samd_write(struct flash_bank *bank, const uint8_t *buffer,
808 uint32_t offset, uint32_t count)
816 struct samd_info *chip = (struct samd_info *)bank->driver_priv;
820 if (bank->target->state != TARGET_HALTED) {
821 LOG_ERROR("Target not halted");
822 return ERROR_TARGET_NOT_HALTED;
826 if (samd_probe(bank) != ERROR_OK)
827 return ERROR_FLASH_BANK_NOT_PROBED;
830 /* Check if we need to do manual page write commands */
831 res = target_read_u32(bank->target, SAMD_NVMCTRL + SAMD_NVMCTRL_CTRLB, &nvm_ctrlb);
836 if (nvm_ctrlb & SAMD_NVM_CTRLB_MANW)
841 res = samd_issue_nvmctrl_command(bank->target, SAMD_NVM_CMD_PBC);
842 if (res != ERROR_OK) {
843 LOG_ERROR("%s: %d", __func__, __LINE__);
848 nb = chip->page_size - offset % chip->page_size;
852 address = bank->base + offset;
853 pg_offset = offset % chip->page_size;
855 if (offset % 4 || (offset + nb) % 4) {
856 /* Either start or end of write is not word aligned */
858 pb = malloc(chip->page_size);
863 /* Set temporary page buffer to 0xff and overwrite the relevant part */
864 memset(pb, 0xff, chip->page_size);
865 memcpy(pb + pg_offset, buffer, nb);
867 /* Align start address to a word boundary */
868 address -= offset % 4;
869 pg_offset -= offset % 4;
870 assert(pg_offset % 4 == 0);
872 /* Extend length to whole words */
873 nw = (nb + offset % 4 + 3) / 4;
874 assert(pg_offset + 4 * nw <= chip->page_size);
876 /* Now we have original data extended by 0xff bytes
877 * to the nearest word boundary on both start and end */
878 res = target_write_memory(bank->target, address, 4, nw, pb + pg_offset);
882 assert(pg_offset + 4 * nw <= chip->page_size);
884 /* Word aligned data, use direct write from buffer */
885 res = target_write_memory(bank->target, address, 4, nw, buffer);
887 if (res != ERROR_OK) {
888 LOG_ERROR("%s: %d", __func__, __LINE__);
892 /* Devices with errata 13134 have automatic page write enabled by default
893 * For other devices issue a write page CMD to the NVM
894 * If the page has not been written up to the last word
895 * then issue CMD_WP always */
896 if (manual_wp || pg_offset + 4 * nw < chip->page_size) {
897 res = samd_issue_nvmctrl_command(bank->target, SAMD_NVM_CMD_WP);
899 /* Access through AHB is stalled while flash is being programmed */
902 res = samd_check_error(bank->target);
905 if (res != ERROR_OK) {
906 LOG_ERROR("%s: write failed at address 0x%08" PRIx32, __func__, address);
910 /* We're done with the page contents */
923 FLASH_BANK_COMMAND_HANDLER(samd_flash_bank_command)
925 if (bank->base != SAMD_FLASH) {
926 LOG_ERROR("Address " TARGET_ADDR_FMT
927 " invalid bank address (try 0x%08" PRIx32
928 "[at91samd series] )",
929 bank->base, SAMD_FLASH);
933 struct samd_info *chip;
934 chip = calloc(1, sizeof(*chip));
936 LOG_ERROR("No memory for flash bank chip info");
940 chip->target = bank->target;
941 chip->probed = false;
943 bank->driver_priv = chip;
948 COMMAND_HANDLER(samd_handle_info_command)
953 COMMAND_HANDLER(samd_handle_chip_erase_command)
955 struct target *target = get_current_target(CMD_CTX);
956 int res = ERROR_FAIL;
959 /* Enable access to the DSU by disabling the write protect bit */
960 target_write_u32(target, SAMD_PAC1, (1<<1));
961 /* intentionally without error checking - not accessible on secured chip */
963 /* Tell the DSU to perform a full chip erase. It takes about 240ms to
964 * perform the erase. */
965 res = target_write_u8(target, SAMD_DSU + SAMD_DSU_CTRL_EXT, (1<<4));
967 command_print(CMD, "chip erase started");
969 command_print(CMD, "write to DSU CTRL failed");
975 COMMAND_HANDLER(samd_handle_set_security_command)
978 struct target *target = get_current_target(CMD_CTX);
980 if (CMD_ARGC < 1 || (CMD_ARGC >= 1 && (strcmp(CMD_ARGV[0], "enable")))) {
981 command_print(CMD, "supply the \"enable\" argument to proceed.");
982 return ERROR_COMMAND_SYNTAX_ERROR;
986 if (target->state != TARGET_HALTED) {
987 LOG_ERROR("Target not halted");
988 return ERROR_TARGET_NOT_HALTED;
991 res = samd_issue_nvmctrl_command(target, SAMD_NVM_CMD_SSB);
993 /* Check (and clear) error conditions */
995 command_print(CMD, "chip secured on next power-cycle");
997 command_print(CMD, "failed to secure chip");
1003 COMMAND_HANDLER(samd_handle_eeprom_command)
1006 struct target *target = get_current_target(CMD_CTX);
1009 if (target->state != TARGET_HALTED) {
1010 LOG_ERROR("Target not halted");
1011 return ERROR_TARGET_NOT_HALTED;
1014 if (CMD_ARGC >= 1) {
1015 int val = atoi(CMD_ARGV[0]);
1021 /* Try to match size in bytes with corresponding size code */
1022 for (code = 0; code <= 6; code++) {
1023 if (val == (2 << (13 - code)))
1028 command_print(CMD, "Invalid EEPROM size. Please see "
1029 "datasheet for a list valid sizes.");
1030 return ERROR_COMMAND_SYNTAX_ERROR;
1034 res = samd_modify_user_row(target, code, 4, 6);
1037 res = target_read_u16(target, SAMD_USER_ROW, &val);
1038 if (res == ERROR_OK) {
1039 uint32_t size = ((val >> 4) & 0x7); /* grab size code */
1042 command_print(CMD, "EEPROM is disabled");
1044 /* Otherwise, 6 is 256B, 0 is 16KB */
1045 command_print(CMD, "EEPROM size is %u bytes",
1046 (2 << (13 - size)));
1055 static COMMAND_HELPER(get_u64_from_hexarg, unsigned int num, uint64_t *value)
1057 if (num >= CMD_ARGC) {
1058 command_print(CMD, "Too few Arguments.");
1059 return ERROR_COMMAND_SYNTAX_ERROR;
1062 if (strlen(CMD_ARGV[num]) >= 3 &&
1063 CMD_ARGV[num][0] == '0' &&
1064 CMD_ARGV[num][1] == 'x') {
1066 *value = strtoull(&(CMD_ARGV[num][2]), &check, 16);
1067 if ((value == 0 && errno == ERANGE) ||
1068 check == NULL || *check != 0) {
1069 command_print(CMD, "Invalid 64-bit hex value in argument %d.",
1071 return ERROR_COMMAND_SYNTAX_ERROR;
1074 command_print(CMD, "Argument %d needs to be a hex value.", num + 1);
1075 return ERROR_COMMAND_SYNTAX_ERROR;
1080 COMMAND_HANDLER(samd_handle_nvmuserrow_command)
1083 struct target *target = get_current_target(CMD_CTX);
1087 command_print(CMD, "Too much Arguments given.");
1088 return ERROR_COMMAND_SYNTAX_ERROR;
1092 if (target->state != TARGET_HALTED) {
1093 LOG_ERROR("Target not halted.");
1094 return ERROR_TARGET_NOT_HALTED;
1098 res = samd_get_reservedmask(target, &mask);
1099 if (res != ERROR_OK) {
1100 LOG_ERROR("Couldn't determine the mask for reserved bits.");
1103 mask &= NVMUSERROW_LOCKBIT_MASK;
1106 res = CALL_COMMAND_HANDLER(get_u64_from_hexarg, 0, &value);
1107 if (res != ERROR_OK)
1109 if (CMD_ARGC == 2) {
1111 res = CALL_COMMAND_HANDLER(get_u64_from_hexarg, 1, &mask_temp);
1112 if (res != ERROR_OK)
1116 res = samd_modify_user_row_masked(target, value, mask);
1117 if (res != ERROR_OK)
1123 res = read_userrow(target, &value);
1124 if (res == ERROR_OK)
1125 command_print(CMD, "NVMUSERROW: 0x%016"PRIX64, value);
1127 LOG_ERROR("NVMUSERROW could not be read.");
1132 COMMAND_HANDLER(samd_handle_bootloader_command)
1135 struct target *target = get_current_target(CMD_CTX);
1138 if (target->state != TARGET_HALTED) {
1139 LOG_ERROR("Target not halted");
1140 return ERROR_TARGET_NOT_HALTED;
1143 /* Retrieve the MCU's page size, in bytes. */
1145 res = samd_get_flash_page_info(target, &page_size, NULL);
1146 if (res != ERROR_OK) {
1147 LOG_ERROR("Couldn't determine Flash page size");
1151 if (CMD_ARGC >= 1) {
1152 int val = atoi(CMD_ARGV[0]);
1158 /* Try to match size in bytes with corresponding size code */
1159 for (code = 0; code <= 6; code++) {
1160 if ((unsigned int)val == (2UL << (8UL - code)) * page_size)
1165 command_print(CMD, "Invalid bootloader size. Please "
1166 "see datasheet for a list valid sizes.");
1167 return ERROR_COMMAND_SYNTAX_ERROR;
1172 res = samd_modify_user_row(target, code, 0, 2);
1175 res = target_read_u16(target, SAMD_USER_ROW, &val);
1176 if (res == ERROR_OK) {
1177 uint32_t size = (val & 0x7); /* grab size code */
1183 nb = (2 << (8 - size)) * page_size;
1185 /* There are 4 pages per row */
1186 command_print(CMD, "Bootloader size is %" PRIu32 " bytes (%" PRIu32 " rows)",
1187 nb, (uint32_t)(nb / (page_size * 4)));
1197 COMMAND_HANDLER(samd_handle_reset_deassert)
1199 struct target *target = get_current_target(CMD_CTX);
1200 int retval = ERROR_OK;
1201 enum reset_types jtag_reset_config = jtag_get_reset_config();
1203 /* If the target has been unresponsive before, try to re-establish
1204 * communication now - CPU is held in reset by DSU, DAP is working */
1205 if (!target_was_examined(target))
1206 target_examine_one(target);
1207 target_poll(target);
1209 /* In case of sysresetreq, debug retains state set in cortex_m_assert_reset()
1210 * so we just release reset held by DSU
1212 * n_RESET (srst) clears the DP, so reenable debug and set vector catch here
1214 * After vectreset DSU release is not needed however makes no harm
1216 if (target->reset_halt && (jtag_reset_config & RESET_HAS_SRST)) {
1217 retval = target_write_u32(target, DCB_DHCSR, DBGKEY | C_HALT | C_DEBUGEN);
1218 if (retval == ERROR_OK)
1219 retval = target_write_u32(target, DCB_DEMCR,
1220 TRCENA | VC_HARDERR | VC_BUSERR | VC_CORERESET);
1221 /* do not return on error here, releasing DSU reset is more important */
1224 /* clear CPU Reset Phase Extension bit */
1225 int retval2 = target_write_u8(target, SAMD_DSU + SAMD_DSU_STATUSA, (1<<1));
1226 if (retval2 != ERROR_OK)
1232 static const struct command_registration at91samd_exec_command_handlers[] = {
1234 .name = "dsu_reset_deassert",
1235 .handler = samd_handle_reset_deassert,
1236 .mode = COMMAND_EXEC,
1237 .help = "Deassert internal reset held by DSU.",
1242 .handler = samd_handle_info_command,
1243 .mode = COMMAND_EXEC,
1244 .help = "Print information about the current at91samd chip "
1245 "and its flash configuration.",
1249 .name = "chip-erase",
1250 .handler = samd_handle_chip_erase_command,
1251 .mode = COMMAND_EXEC,
1252 .help = "Erase the entire Flash by using the Chip-"
1253 "Erase feature in the Device Service Unit (DSU).",
1257 .name = "set-security",
1258 .handler = samd_handle_set_security_command,
1259 .mode = COMMAND_EXEC,
1260 .help = "Secure the chip's Flash by setting the Security Bit. "
1261 "This makes it impossible to read the Flash contents. "
1262 "The only way to undo this is to issue the chip-erase "
1264 .usage = "'enable'",
1268 .usage = "[size_in_bytes]",
1269 .handler = samd_handle_eeprom_command,
1270 .mode = COMMAND_EXEC,
1271 .help = "Show or set the EEPROM size setting, stored in the User Row. "
1272 "Please see Table 20-3 of the SAMD20 datasheet for allowed values. "
1273 "Changes are stored immediately but take affect after the MCU is "
1277 .name = "bootloader",
1278 .usage = "[size_in_bytes]",
1279 .handler = samd_handle_bootloader_command,
1280 .mode = COMMAND_EXEC,
1281 .help = "Show or set the bootloader size, stored in the User Row. "
1282 "Please see Table 20-2 of the SAMD20 datasheet for allowed values. "
1283 "Changes are stored immediately but take affect after the MCU is "
1287 .name = "nvmuserrow",
1288 .usage = "[value] [mask]",
1289 .handler = samd_handle_nvmuserrow_command,
1290 .mode = COMMAND_EXEC,
1291 .help = "Show or set the nvmuserrow register. It is 64 bit wide "
1292 "and located at address 0x804000. Use the optional mask argument "
1293 "to prevent changes at positions where the bitvalue is zero. "
1294 "For security reasons the lock- and reserved-bits are masked out "
1295 "in background and therefore cannot be changed.",
1297 COMMAND_REGISTRATION_DONE
1300 static const struct command_registration at91samd_command_handlers[] = {
1303 .mode = COMMAND_ANY,
1304 .help = "at91samd flash command group",
1306 .chain = at91samd_exec_command_handlers,
1308 COMMAND_REGISTRATION_DONE
1311 const struct flash_driver at91samd_flash = {
1313 .commands = at91samd_command_handlers,
1314 .flash_bank_command = samd_flash_bank_command,
1315 .erase = samd_erase,
1316 .protect = samd_protect,
1317 .write = samd_write,
1318 .read = default_flash_read,
1319 .probe = samd_probe,
1320 .auto_probe = samd_probe,
1321 .erase_check = default_flash_blank_check,
1322 .protect_check = samd_protect_check,
1323 .free_driver_priv = default_flash_free_driver_priv,