Code Review / openocd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | review | tree
history | raw | HEAD
Kinetis: new devices K02, K26, K63, K64, K66, correct K21 and K22 variants
[openocd.git] / src / flash / nor / kinetis.c
1 /***************************************************************************
2 * Copyright (C) 2011 by Mathias Kuester *
3 * kesmtp@freenet.de *
4 * *
5 * Copyright (C) 2011 sleep(5) ltd *
6 * tomas@sleepfive.com *
7 * *
8 * Copyright (C) 2012 by Christopher D. Kilgour *
9 * techie at whiterocker.com *
10 * *
11 * Copyright (C) 2013 Nemui Trinomius *
12 * nemuisan_kawausogasuki@live.jp *
13 * *
14 * This program is free software; you can redistribute it and/or modify *
15 * it under the terms of the GNU General Public License as published by *
16 * the Free Software Foundation; either version 2 of the License, or *
17 * (at your option) any later version. *
18 * *
19 * This program is distributed in the hope that it will be useful, *
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
22 * GNU General Public License for more details. *
23 * *
24 * You should have received a copy of the GNU General Public License *
25 * along with this program; if not, write to the *
26 * Free Software Foundation, Inc., *
27 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *
28 ***************************************************************************/
29
30 #ifdef HAVE_CONFIG_H
31 #include "config.h"
32 #endif
33
34 #include "jtag/interface.h"
35 #include "imp.h"
36 #include <helper/binarybuffer.h>
37 #include <target/algorithm.h>
38 #include <target/armv7m.h>
39 #include <target/cortex_m.h>
40
41 /*
42 * Implementation Notes
43 *
44 * The persistent memories in the Kinetis chip families K10 through
45 * K70 are all manipulated with the Flash Memory Module. Some
46 * variants call this module the FTFE, others call it the FTFL. To
47 * indicate that both are considered here, we use FTFX.
48 *
49 * Within the module, according to the chip variant, the persistent
50 * memory is divided into what Freescale terms Program Flash, FlexNVM,
51 * and FlexRAM. All chip variants have Program Flash. Some chip
52 * variants also have FlexNVM and FlexRAM, which always appear
53 * together.
54 *
55 * A given Kinetis chip may have 1, 2 or 4 blocks of flash. Here we map
56 * each block to a separate bank. Each block size varies by chip and
57 * may be determined by the read-only SIM_FCFG1 register. The sector
58 * size within each bank/block varies by chip, and may be 1, 2 or 4k.
59 * The sector size may be different for flash and FlexNVM.
60 *
61 * The first half of the flash (1 or 2 blocks) is always Program Flash
62 * and always starts at address 0x00000000. The "PFLSH" flag, bit 23
63 * of the read-only SIM_FCFG2 register, determines whether the second
64 * half of the flash is also Program Flash or FlexNVM+FlexRAM. When
65 * PFLSH is set, the second from the first half. When PFLSH is clear,
66 * the second half of flash is FlexNVM and always starts at address
67 * 0x10000000. FlexRAM, which is also present when PFLSH is clear,
68 * always starts at address 0x14000000.
69 *
70 * The Flash Memory Module provides a register set where flash
71 * commands are loaded to perform flash operations like erase and
72 * program. Different commands are available depending on whether
73 * Program Flash or FlexNVM/FlexRAM is being manipulated. Although
74 * the commands used are quite consistent between flash blocks, the
75 * parameters they accept differ according to the flash sector size.
76 *
77 */
78
79 /* Addressess */
80 #define FLEXRAM 0x14000000
81 #define FTFx_FSTAT 0x40020000
82 #define FTFx_FCNFG 0x40020001
83 #define FTFx_FCCOB3 0x40020004
84 #define FTFx_FPROT3 0x40020010
85 #define SIM_SDID 0x40048024
86 #define SIM_SOPT1 0x40047000
87 #define SIM_FCFG1 0x4004804c
88 #define SIM_FCFG2 0x40048050
89
90 /* Commands */
91 #define FTFx_CMD_BLOCKSTAT 0x00
92 #define FTFx_CMD_SECTSTAT 0x01
93 #define FTFx_CMD_LWORDPROG 0x06
94 #define FTFx_CMD_SECTERASE 0x09
95 #define FTFx_CMD_SECTWRITE 0x0b
96 #define FTFx_CMD_SETFLEXRAM 0x81
97 #define FTFx_CMD_MASSERASE 0x44
98
99 /* The older Kinetis K series uses the following SDID layout :
100 * Bit 31-16 : 0
101 * Bit 15-12 : REVID
102 * Bit 11-7 : DIEID
103 * Bit 6-4 : FAMID
104 * Bit 3-0 : PINID
105 *
106 * The newer Kinetis series uses the following SDID layout :
107 * Bit 31-28 : FAMID
108 * Bit 27-24 : SUBFAMID
109 * Bit 23-20 : SERIESID
110 * Bit 19-16 : SRAMSIZE
111 * Bit 15-12 : REVID
112 * Bit 6-4 : Reserved (0)
113 * Bit 3-0 : PINID
114 *
115 * We assume that if bits 31-16 are 0 then it's an older
116 * K-series MCU.
117 */
118
119 #define KINETIS_SOPT1_RAMSIZE_MASK 0x0000F000
120 #define KINETIS_SOPT1_RAMSIZE_K24FN1M 0x0000B000
121
122 #define KINETIS_SDID_K_SERIES_MASK 0x0000FFFF
123
124 #define KINETIS_SDID_DIEID_MASK 0x00000F80
125
126 #define KINETIS_SDID_DIEID_K22FN128 0x00000680 /* smaller pflash with FTFA */
127 #define KINETIS_SDID_DIEID_K22FN256 0x00000A80
128 #define KINETIS_SDID_DIEID_K22FN512 0x00000E80
129 #define KINETIS_SDID_DIEID_K24FN256 0x00000700
130
131 #define KINETIS_SDID_DIEID_K24FN1M 0x00000300 /* Detect Errata 7534 */
132
133 /* We can't rely solely on the FAMID field to determine the MCU
134 * type since some FAMID values identify multiple MCUs with
135 * different flash sector sizes (K20 and K22 for instance).
136 * Therefore we combine it with the DIEID bits which may possibly
137 * break if Freescale bumps the DIEID for a particular MCU. */
138 #define KINETIS_K_SDID_TYPE_MASK 0x00000FF0
139 #define KINETIS_K_SDID_K10_M50 0x00000000
140 #define KINETIS_K_SDID_K10_M72 0x00000080
141 #define KINETIS_K_SDID_K10_M100 0x00000100
142 #define KINETIS_K_SDID_K10_M120 0x00000180
143 #define KINETIS_K_SDID_K11 0x00000220
144 #define KINETIS_K_SDID_K12 0x00000200
145 #define KINETIS_K_SDID_K20_M50 0x00000010
146 #define KINETIS_K_SDID_K20_M72 0x00000090
147 #define KINETIS_K_SDID_K20_M100 0x00000110
148 #define KINETIS_K_SDID_K20_M120 0x00000190
149 #define KINETIS_K_SDID_K21_M50 0x00000230
150 #define KINETIS_K_SDID_K21_M120 0x00000330
151 #define KINETIS_K_SDID_K22_M50 0x00000210
152 #define KINETIS_K_SDID_K22_M120 0x00000310
153 #define KINETIS_K_SDID_K30_M72 0x000000A0
154 #define KINETIS_K_SDID_K30_M100 0x00000120
155 #define KINETIS_K_SDID_K40_M72 0x000000B0
156 #define KINETIS_K_SDID_K40_M100 0x00000130
157 #define KINETIS_K_SDID_K50_M72 0x000000E0
158 #define KINETIS_K_SDID_K51_M72 0x000000F0
159 #define KINETIS_K_SDID_K53 0x00000170
160 #define KINETIS_K_SDID_K60_M100 0x00000140
161 #define KINETIS_K_SDID_K60_M150 0x000001C0
162 #define KINETIS_K_SDID_K70_M150 0x000001D0
163
164 #define KINETIS_SDID_SERIESID_MASK 0x00F00000
165 #define KINETIS_SDID_SERIESID_K 0x00000000
166 #define KINETIS_SDID_SERIESID_KL 0x00100000
167 #define KINETIS_SDID_SERIESID_KW 0x00500000
168 #define KINETIS_SDID_SERIESID_KV 0x00600000
169
170 #define KINETIS_SDID_SUBFAMID_MASK 0x0F000000
171 #define KINETIS_SDID_SUBFAMID_KX0 0x00000000
172 #define KINETIS_SDID_SUBFAMID_KX1 0x01000000
173 #define KINETIS_SDID_SUBFAMID_KX2 0x02000000
174 #define KINETIS_SDID_SUBFAMID_KX3 0x03000000
175 #define KINETIS_SDID_SUBFAMID_KX4 0x04000000
176 #define KINETIS_SDID_SUBFAMID_KX5 0x05000000
177 #define KINETIS_SDID_SUBFAMID_KX6 0x06000000
178
179 #define KINETIS_SDID_FAMILYID_MASK 0xF0000000
180 #define KINETIS_SDID_FAMILYID_K0X 0x00000000
181 #define KINETIS_SDID_FAMILYID_K1X 0x10000000
182 #define KINETIS_SDID_FAMILYID_K2X 0x20000000
183 #define KINETIS_SDID_FAMILYID_K3X 0x30000000
184 #define KINETIS_SDID_FAMILYID_K4X 0x40000000
185 #define KINETIS_SDID_FAMILYID_K6X 0x60000000
186 #define KINETIS_SDID_FAMILYID_K7X 0x70000000
187
188 struct kinetis_flash_bank {
189 unsigned bank_ordinal;
190 uint32_t sector_size;
191 uint32_t max_flash_prog_size;
192 uint32_t protection_size;
193
194 uint32_t sim_sdid;
195 uint32_t sim_fcfg1;
196 uint32_t sim_fcfg2;
197
198 enum {
199 FC_AUTO = 0,
200 FC_PFLASH,
201 FC_FLEX_NVM,
202 FC_FLEX_RAM,
203 } flash_class;
204
205 enum {
206 FS_PROGRAM_SECTOR = 1,
207 FS_PROGRAM_LONGWORD = 2,
208 FS_PROGRAM_PHRASE = 4, /* Unsupported */
209 } flash_support;
210 };
211
212 #define MDM_REG_STAT 0x00
213 #define MDM_REG_CTRL 0x04
214 #define MDM_REG_ID 0xfc
215
216 #define MDM_STAT_FMEACK (1<<0)
217 #define MDM_STAT_FREADY (1<<1)
218 #define MDM_STAT_SYSSEC (1<<2)
219 #define MDM_STAT_SYSRES (1<<3)
220 #define MDM_STAT_FMEEN (1<<5)
221 #define MDM_STAT_BACKDOOREN (1<<6)
222 #define MDM_STAT_LPEN (1<<7)
223 #define MDM_STAT_VLPEN (1<<8)
224 #define MDM_STAT_LLSMODEXIT (1<<9)
225 #define MDM_STAT_VLLSXMODEXIT (1<<10)
226 #define MDM_STAT_CORE_HALTED (1<<16)
227 #define MDM_STAT_CORE_SLEEPDEEP (1<<17)
228 #define MDM_STAT_CORESLEEPING (1<<18)
229
230 #define MEM_CTRL_FMEIP (1<<0)
231 #define MEM_CTRL_DBG_DIS (1<<1)
232 #define MEM_CTRL_DBG_REQ (1<<2)
233 #define MEM_CTRL_SYS_RES_REQ (1<<3)
234 #define MEM_CTRL_CORE_HOLD_RES (1<<4)
235 #define MEM_CTRL_VLLSX_DBG_REQ (1<<5)
236 #define MEM_CTRL_VLLSX_DBG_ACK (1<<6)
237 #define MEM_CTRL_VLLSX_STAT_ACK (1<<7)
238
239 #define MDM_ACCESS_TIMEOUT 3000 /* iterations */
240
241 static int kinetis_mdm_write_register(struct adiv5_dap *dap, unsigned reg, uint32_t value)
242 {
243 int retval;
244 LOG_DEBUG("MDM_REG[0x%02x] <- %08" PRIX32, reg, value);
245
246 retval = dap_queue_ap_write(dap, reg, value);
247 if (retval != ERROR_OK) {
248 LOG_DEBUG("MDM: failed to queue a write request");
249 return retval;
250 }
251
252 retval = dap_run(dap);
253 if (retval != ERROR_OK) {
254 LOG_DEBUG("MDM: dap_run failed");
255 return retval;
256 }
257
258
259 return ERROR_OK;
260 }
261
262 static int kinetis_mdm_read_register(struct adiv5_dap *dap, unsigned reg, uint32_t *result)
263 {
264 int retval;
265 retval = dap_queue_ap_read(dap, reg, result);
266 if (retval != ERROR_OK) {
267 LOG_DEBUG("MDM: failed to queue a read request");
268 return retval;
269 }
270
271 retval = dap_run(dap);
272 if (retval != ERROR_OK) {
273 LOG_DEBUG("MDM: dap_run failed");
274 return retval;
275 }
276
277 LOG_DEBUG("MDM_REG[0x%02x]: %08" PRIX32, reg, *result);
278 return ERROR_OK;
279 }
280
281 static int kinetis_mdm_poll_register(struct adiv5_dap *dap, unsigned reg, uint32_t mask, uint32_t value)
282 {
283 uint32_t val;
284 int retval;
285 int timeout = MDM_ACCESS_TIMEOUT;
286
287 do {
288 retval = kinetis_mdm_read_register(dap, reg, &val);
289 if (retval != ERROR_OK || (val & mask) == value)
290 return retval;
291
292 alive_sleep(1);
293 } while (timeout--);
294
295 LOG_DEBUG("MDM: polling timed out");
296 return ERROR_FAIL;
297 }
298
299 /*
300 * This function implements the procedure to mass erase the flash via
301 * SWD/JTAG on Kinetis K and L series of devices as it is described in
302 * AN4835 "Production Flash Programming Best Practices for Kinetis K-
303 * and L-series MCUs" Section 4.2.1
304 */
305 COMMAND_HANDLER(kinetis_mdm_mass_erase)
306 {
307 struct target *target = get_current_target(CMD_CTX);
308 struct cortex_m_common *cortex_m = target_to_cm(target);
309 struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
310
311 if (!dap) {
312 LOG_ERROR("Cannot perform mass erase with a high-level adapter");
313 return ERROR_FAIL;
314 }
315
316 int retval;
317 const uint8_t original_ap = dap->ap_current;
318
319 /*
320 * ... Power on the processor, or if power has already been
321 * applied, assert the RESET pin to reset the processor. For
322 * devices that do not have a RESET pin, write the System
323 * Reset Request bit in the MDM-AP control register after
324 * establishing communication...
325 */
326
327 /* assert SRST */
328 if (jtag_get_reset_config() & RESET_HAS_SRST)
329 adapter_assert_reset();
330 else
331 LOG_WARNING("Attempting mass erase without hardware reset. This is not reliable; "
332 "it's recommended you connect SRST and use ``reset_config srst_only''.");
333
334 dap_ap_select(dap, 1);
335
336 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, MEM_CTRL_SYS_RES_REQ);
337 if (retval != ERROR_OK)
338 return retval;
339
340 /*
341 * ... Read the MDM-AP status register until the Flash Ready bit sets...
342 */
343 retval = kinetis_mdm_poll_register(dap, MDM_REG_STAT,
344 MDM_STAT_FREADY | MDM_STAT_SYSRES,
345 MDM_STAT_FREADY);
346 if (retval != ERROR_OK) {
347 LOG_ERROR("MDM : flash ready timeout");
348 return retval;
349 }
350
351 /*
352 * ... Write the MDM-AP control register to set the Flash Mass
353 * Erase in Progress bit. This will start the mass erase
354 * process...
355 */
356 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL,
357 MEM_CTRL_SYS_RES_REQ | MEM_CTRL_FMEIP);
358 if (retval != ERROR_OK)
359 return retval;
360
361 /* As a sanity check make sure that device started mass erase procedure */
362 retval = kinetis_mdm_poll_register(dap, MDM_REG_STAT,
363 MDM_STAT_FMEACK, MDM_STAT_FMEACK);
364 if (retval != ERROR_OK)
365 return retval;
366
367 /*
368 * ... Read the MDM-AP control register until the Flash Mass
369 * Erase in Progress bit clears...
370 */
371 retval = kinetis_mdm_poll_register(dap, MDM_REG_CTRL,
372 MEM_CTRL_FMEIP,
373 0);
374 if (retval != ERROR_OK)
375 return retval;
376
377 /*
378 * ... Negate the RESET signal or clear the System Reset Request
379 * bit in the MDM-AP control register...
380 */
381 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, 0);
382 if (retval != ERROR_OK)
383 return retval;
384
385 if (jtag_get_reset_config() & RESET_HAS_SRST)
386 adapter_deassert_reset();
387
388 dap_ap_select(dap, original_ap);
389 return ERROR_OK;
390 }
391
392 static const uint32_t kinetis_known_mdm_ids[] = {
393 0x001C0000, /* Kinetis-K Series */
394 0x001C0020, /* Kinetis-L/M/V/E Series */
395 };
396
397 /*
398 * This function implements the procedure to connect to
399 * SWD/JTAG on Kinetis K and L series of devices as it is described in
400 * AN4835 "Production Flash Programming Best Practices for Kinetis K-
401 * and L-series MCUs" Section 4.1.1
402 */
403 COMMAND_HANDLER(kinetis_check_flash_security_status)
404 {
405 struct target *target = get_current_target(CMD_CTX);
406 struct cortex_m_common *cortex_m = target_to_cm(target);
407 struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
408
409 if (!dap) {
410 LOG_WARNING("Cannot check flash security status with a high-level adapter");
411 return ERROR_OK;
412 }
413
414 uint32_t val;
415 int retval;
416 const uint8_t origninal_ap = dap->ap_current;
417
418 dap_ap_select(dap, 1);
419
420
421 /*
422 * ... The MDM-AP ID register can be read to verify that the
423 * connection is working correctly...
424 */
425 retval = kinetis_mdm_read_register(dap, MDM_REG_ID, &val);
426 if (retval != ERROR_OK) {
427 LOG_ERROR("MDM: failed to read ID register");
428 goto fail;
429 }
430
431 bool found = false;
432 for (size_t i = 0; i < ARRAY_SIZE(kinetis_known_mdm_ids); i++) {
433 if (val == kinetis_known_mdm_ids[i]) {
434 found = true;
435 break;
436 }
437 }
438
439 if (!found)
440 LOG_WARNING("MDM: unknown ID %08" PRIX32, val);
441
442 /*
443 * ... Read the MDM-AP status register until the Flash Ready bit sets...
444 */
445 retval = kinetis_mdm_poll_register(dap, MDM_REG_STAT,
446 MDM_STAT_FREADY,
447 MDM_STAT_FREADY);
448 if (retval != ERROR_OK) {
449 LOG_ERROR("MDM: flash ready timeout");
450 goto fail;
451 }
452
453 /*
454 * ... Read the System Security bit to determine if security is enabled.
455 * If System Security = 0, then proceed. If System Security = 1, then
456 * communication with the internals of the processor, including the
457 * flash, will not be possible without issuing a mass erase command or
458 * unsecuring the part through other means (backdoor key unlock)...
459 */
460 retval = kinetis_mdm_read_register(dap, MDM_REG_STAT, &val);
461 if (retval != ERROR_OK) {
462 LOG_ERROR("MDM: failed to read MDM_REG_STAT");
463 goto fail;
464 }
465
466 if (val & MDM_STAT_SYSSEC) {
467 jtag_poll_set_enabled(false);
468
469 LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
470 LOG_WARNING("**** ****");
471 LOG_WARNING("**** Your Kinetis MCU is in secured state, which means that, ****");
472 LOG_WARNING("**** with exception for very basic communication, JTAG/SWD ****");
473 LOG_WARNING("**** interface will NOT work. In order to restore its ****");
474 LOG_WARNING("**** functionality please issue 'kinetis mdm mass_erase' ****");
475 LOG_WARNING("**** command, power cycle the MCU and restart OpenOCD. ****");
476 LOG_WARNING("**** ****");
477 LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
478 } else {
479 LOG_INFO("MDM: Chip is unsecured. Continuing.");
480 jtag_poll_set_enabled(true);
481 }
482
483 dap_ap_select(dap, origninal_ap);
484
485 return ERROR_OK;
486
487 fail:
488 LOG_ERROR("MDM: Failed to check security status of the MCU. Cannot proceed further");
489 jtag_poll_set_enabled(false);
490 return retval;
491 }
492
493 FLASH_BANK_COMMAND_HANDLER(kinetis_flash_bank_command)
494 {
495 struct kinetis_flash_bank *bank_info;
496
497 if (CMD_ARGC < 6)
498 return ERROR_COMMAND_SYNTAX_ERROR;
499
500 LOG_INFO("add flash_bank kinetis %s", bank->name);
501
502 bank_info = malloc(sizeof(struct kinetis_flash_bank));
503
504 memset(bank_info, 0, sizeof(struct kinetis_flash_bank));
505
506 bank->driver_priv = bank_info;
507
508 return ERROR_OK;
509 }
510
511 /* Kinetis Program-LongWord Microcodes */
512 static const uint8_t kinetis_flash_write_code[] = {
513 /* Params:
514 * r0 - workarea buffer
515 * r1 - target address
516 * r2 - wordcount
517 * Clobbered:
518 * r4 - tmp
519 * r5 - tmp
520 * r6 - tmp
521 * r7 - tmp
522 */
523
524 /* .L1: */
525 /* for(register uint32_t i=0;i<wcount;i++){ */
526 0x04, 0x1C, /* mov r4, r0 */
527 0x00, 0x23, /* mov r3, #0 */
528 /* .L2: */
529 0x0E, 0x1A, /* sub r6, r1, r0 */
530 0xA6, 0x19, /* add r6, r4, r6 */
531 0x93, 0x42, /* cmp r3, r2 */
532 0x16, 0xD0, /* beq .L9 */
533 /* .L5: */
534 /* while((FTFx_FSTAT&FTFA_FSTAT_CCIF_MASK) != FTFA_FSTAT_CCIF_MASK){}; */
535 0x0B, 0x4D, /* ldr r5, .L10 */
536 0x2F, 0x78, /* ldrb r7, [r5] */
537 0x7F, 0xB2, /* sxtb r7, r7 */
538 0x00, 0x2F, /* cmp r7, #0 */
539 0xFA, 0xDA, /* bge .L5 */
540 /* FTFx_FSTAT = FTFA_FSTAT_ACCERR_MASK|FTFA_FSTAT_FPVIOL_MASK|FTFA_FSTAT_RDCO */
541 0x70, 0x27, /* mov r7, #112 */
542 0x2F, 0x70, /* strb r7, [r5] */
543 /* FTFx_FCCOB3 = faddr; */
544 0x09, 0x4F, /* ldr r7, .L10+4 */
545 0x3E, 0x60, /* str r6, [r7] */
546 0x06, 0x27, /* mov r7, #6 */
547 /* FTFx_FCCOB0 = 0x06; */
548 0x08, 0x4E, /* ldr r6, .L10+8 */
549 0x37, 0x70, /* strb r7, [r6] */
550 /* FTFx_FCCOB7 = *pLW; */
551 0x80, 0xCC, /* ldmia r4!, {r7} */
552 0x08, 0x4E, /* ldr r6, .L10+12 */
553 0x37, 0x60, /* str r7, [r6] */
554 /* FTFx_FSTAT = FTFA_FSTAT_CCIF_MASK; */
555 0x80, 0x27, /* mov r7, #128 */
556 0x2F, 0x70, /* strb r7, [r5] */
557 /* .L4: */
558 /* while((FTFx_FSTAT&FTFA_FSTAT_CCIF_MASK) != FTFA_FSTAT_CCIF_MASK){}; */
559 0x2E, 0x78, /* ldrb r6, [r5] */
560 0x77, 0xB2, /* sxtb r7, r6 */
561 0x00, 0x2F, /* cmp r7, #0 */
562 0xFB, 0xDA, /* bge .L4 */
563 0x01, 0x33, /* add r3, r3, #1 */
564 0xE4, 0xE7, /* b .L2 */
565 /* .L9: */
566 0x00, 0xBE, /* bkpt #0 */
567 /* .L10: */
568 0x00, 0x00, 0x02, 0x40, /* .word 1073872896 */
569 0x04, 0x00, 0x02, 0x40, /* .word 1073872900 */
570 0x07, 0x00, 0x02, 0x40, /* .word 1073872903 */
571 0x08, 0x00, 0x02, 0x40, /* .word 1073872904 */
572 };
573
574 /* Program LongWord Block Write */
575 static int kinetis_write_block(struct flash_bank *bank, const uint8_t *buffer,
576 uint32_t offset, uint32_t wcount)
577 {
578 struct target *target = bank->target;
579 uint32_t buffer_size = 2048; /* Default minimum value */
580 struct working_area *write_algorithm;
581 struct working_area *source;
582 uint32_t address = bank->base + offset;
583 struct reg_param reg_params[3];
584 struct armv7m_algorithm armv7m_info;
585 int retval = ERROR_OK;
586
587 /* Params:
588 * r0 - workarea buffer
589 * r1 - target address
590 * r2 - wordcount
591 * Clobbered:
592 * r4 - tmp
593 * r5 - tmp
594 * r6 - tmp
595 * r7 - tmp
596 */
597
598 /* Increase buffer_size if needed */
599 if (buffer_size < (target->working_area_size/2))
600 buffer_size = (target->working_area_size/2);
601
602 LOG_INFO("Kinetis: FLASH Write ...");
603
604 /* check code alignment */
605 if (offset & 0x1) {
606 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
607 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
608 }
609
610 /* allocate working area with flash programming code */
611 if (target_alloc_working_area(target, sizeof(kinetis_flash_write_code),
612 &write_algorithm) != ERROR_OK) {
613 LOG_WARNING("no working area available, can't do block memory writes");
614 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
615 }
616
617 retval = target_write_buffer(target, write_algorithm->address,
618 sizeof(kinetis_flash_write_code), kinetis_flash_write_code);
619 if (retval != ERROR_OK)
620 return retval;
621
622 /* memory buffer */
623 while (target_alloc_working_area(target, buffer_size, &source) != ERROR_OK) {
624 buffer_size /= 4;
625 if (buffer_size <= 256) {
626 /* free working area, write algorithm already allocated */
627 target_free_working_area(target, write_algorithm);
628
629 LOG_WARNING("No large enough working area available, can't do block memory writes");
630 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
631 }
632 }
633
634 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
635 armv7m_info.core_mode = ARM_MODE_THREAD;
636
637 init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT); /* *pLW (*buffer) */
638 init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT); /* faddr */
639 init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT); /* number of words to program */
640
641 /* write code buffer and use Flash programming code within kinetis */
642 /* Set breakpoint to 0 with time-out of 1000 ms */
643 while (wcount > 0) {
644 uint32_t thisrun_count = (wcount > (buffer_size / 4)) ? (buffer_size / 4) : wcount;
645
646 retval = target_write_buffer(target, source->address, thisrun_count * 4, buffer);
647 if (retval != ERROR_OK)
648 break;
649
650 buf_set_u32(reg_params[0].value, 0, 32, source->address);
651 buf_set_u32(reg_params[1].value, 0, 32, address);
652 buf_set_u32(reg_params[2].value, 0, 32, thisrun_count);
653
654 retval = target_run_algorithm(target, 0, NULL, 3, reg_params,
655 write_algorithm->address, 0, 100000, &armv7m_info);
656 if (retval != ERROR_OK) {
657 LOG_ERROR("Error executing kinetis Flash programming algorithm");
658 retval = ERROR_FLASH_OPERATION_FAILED;
659 break;
660 }
661
662 buffer += thisrun_count * 4;
663 address += thisrun_count * 4;
664 wcount -= thisrun_count;
665 }
666
667 target_free_working_area(target, source);
668 target_free_working_area(target, write_algorithm);
669
670 destroy_reg_param(&reg_params[0]);
671 destroy_reg_param(&reg_params[1]);
672 destroy_reg_param(&reg_params[2]);
673
674 return retval;
675 }
676
677 static int kinetis_protect(struct flash_bank *bank, int set, int first, int last)
678 {
679 LOG_WARNING("kinetis_protect not supported yet");
680 /* FIXME: TODO */
681
682 if (bank->target->state != TARGET_HALTED) {
683 LOG_ERROR("Target not halted");
684 return ERROR_TARGET_NOT_HALTED;
685 }
686
687 return ERROR_FLASH_BANK_INVALID;
688 }
689
690 static int kinetis_protect_check(struct flash_bank *bank)
691 {
692 struct kinetis_flash_bank *kinfo = bank->driver_priv;
693
694 if (bank->target->state != TARGET_HALTED) {
695 LOG_ERROR("Target not halted");
696 return ERROR_TARGET_NOT_HALTED;
697 }
698
699 if (kinfo->flash_class == FC_PFLASH) {
700 int result;
701 uint8_t buffer[4];
702 uint32_t fprot, psec;
703 int i, b;
704
705 /* read protection register */
706 result = target_read_memory(bank->target, FTFx_FPROT3, 1, 4, buffer);
707
708 if (result != ERROR_OK)
709 return result;
710
711 fprot = target_buffer_get_u32(bank->target, buffer);
712
713 /*
714 * Every bit protects 1/32 of the full flash (not necessarily
715 * just this bank), but we enforce the bank ordinals for
716 * PFlash to start at zero.
717 */
718 b = kinfo->bank_ordinal * (bank->size / kinfo->protection_size);
719 for (psec = 0, i = 0; i < bank->num_sectors; i++) {
720 if ((fprot >> b) & 1)
721 bank->sectors[i].is_protected = 0;
722 else
723 bank->sectors[i].is_protected = 1;
724
725 psec += bank->sectors[i].size;
726
727 if (psec >= kinfo->protection_size) {
728 psec = 0;
729 b++;
730 }
731 }
732 } else {
733 LOG_ERROR("Protection checks for FlexNVM not yet supported");
734 return ERROR_FLASH_BANK_INVALID;
735 }
736
737 return ERROR_OK;
738 }
739
740 static int kinetis_ftfx_command(struct flash_bank *bank, uint8_t fcmd, uint32_t faddr,
741 uint8_t fccob4, uint8_t fccob5, uint8_t fccob6, uint8_t fccob7,
742 uint8_t fccob8, uint8_t fccob9, uint8_t fccoba, uint8_t fccobb,
743 uint8_t *ftfx_fstat)
744 {
745 uint8_t command[12] = {faddr & 0xff, (faddr >> 8) & 0xff, (faddr >> 16) & 0xff, fcmd,
746 fccob7, fccob6, fccob5, fccob4,
747 fccobb, fccoba, fccob9, fccob8};
748 int result, i;
749 uint8_t buffer;
750
751 /* wait for done */
752 for (i = 0; i < 50; i++) {
753 result =
754 target_read_memory(bank->target, FTFx_FSTAT, 1, 1, &buffer);
755
756 if (result != ERROR_OK)
757 return result;
758
759 if (buffer & 0x80)
760 break;
761
762 buffer = 0x00;
763 }
764
765 if (buffer != 0x80) {
766 /* reset error flags */
767 buffer = 0x30;
768 result =
769 target_write_memory(bank->target, FTFx_FSTAT, 1, 1, &buffer);
770 if (result != ERROR_OK)
771 return result;
772 }
773
774 result = target_write_memory(bank->target, FTFx_FCCOB3, 4, 3, command);
775
776 if (result != ERROR_OK)
777 return result;
778
779 /* start command */
780 buffer = 0x80;
781 result = target_write_memory(bank->target, FTFx_FSTAT, 1, 1, &buffer);
782 if (result != ERROR_OK)
783 return result;
784
785 /* wait for done */
786 for (i = 0; i < 240; i++) { /* Need longtime for "Mass Erase" Command Nemui Changed */
787 result =
788 target_read_memory(bank->target, FTFx_FSTAT, 1, 1, ftfx_fstat);
789
790 if (result != ERROR_OK)
791 return result;
792
793 if (*ftfx_fstat & 0x80)
794 break;
795 }
796
797 if ((*ftfx_fstat & 0xf0) != 0x80) {
798 LOG_ERROR
799 ("ftfx command failed FSTAT: %02X FCCOB: %02X%02X%02X%02X %02X%02X%02X%02X %02X%02X%02X%02X",
800 *ftfx_fstat, command[3], command[2], command[1], command[0],
801 command[7], command[6], command[5], command[4],
802 command[11], command[10], command[9], command[8]);
803 return ERROR_FLASH_OPERATION_FAILED;
804 }
805
806 return ERROR_OK;
807 }
808
809 COMMAND_HANDLER(kinetis_securing_test)
810 {
811 int result;
812 uint8_t ftfx_fstat;
813 struct target *target = get_current_target(CMD_CTX);
814 struct flash_bank *bank = NULL;
815
816 result = get_flash_bank_by_addr(target, 0x00000000, true, &bank);
817 if (result != ERROR_OK)
818 return result;
819
820 assert(bank != NULL);
821
822 if (target->state != TARGET_HALTED) {
823 LOG_ERROR("Target not halted");
824 return ERROR_TARGET_NOT_HALTED;
825 }
826
827 return kinetis_ftfx_command(bank, FTFx_CMD_SECTERASE, bank->base + 0x00000400,
828 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
829 }
830
831 static int kinetis_erase(struct flash_bank *bank, int first, int last)
832 {
833 int result, i;
834
835 if (bank->target->state != TARGET_HALTED) {
836 LOG_ERROR("Target not halted");
837 return ERROR_TARGET_NOT_HALTED;
838 }
839
840 if ((first > bank->num_sectors) || (last > bank->num_sectors))
841 return ERROR_FLASH_OPERATION_FAILED;
842
843 /*
844 * FIXME: TODO: use the 'Erase Flash Block' command if the
845 * requested erase is PFlash or NVM and encompasses the entire
846 * block. Should be quicker.
847 */
848 for (i = first; i <= last; i++) {
849 uint8_t ftfx_fstat;
850 /* set command and sector address */
851 result = kinetis_ftfx_command(bank, FTFx_CMD_SECTERASE, bank->base + bank->sectors[i].offset,
852 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
853
854 if (result != ERROR_OK) {
855 LOG_WARNING("erase sector %d failed", i);
856 return ERROR_FLASH_OPERATION_FAILED;
857 }
858
859 bank->sectors[i].is_erased = 1;
860 }
861
862 if (first == 0) {
863 LOG_WARNING
864 ("flash configuration field erased, please reset the device");
865 }
866
867 return ERROR_OK;
868 }
869
870 static int kinetis_write(struct flash_bank *bank, const uint8_t *buffer,
871 uint32_t offset, uint32_t count)
872 {
873 unsigned int i, result, fallback = 0;
874 uint8_t buf[8];
875 uint32_t wc;
876 struct kinetis_flash_bank *kinfo = bank->driver_priv;
877 uint8_t *new_buffer = NULL;
878
879 if (bank->target->state != TARGET_HALTED) {
880 LOG_ERROR("Target not halted");
881 return ERROR_TARGET_NOT_HALTED;
882 }
883
884 if (!(kinfo->flash_support & FS_PROGRAM_SECTOR)) {
885 /* fallback to longword write */
886 fallback = 1;
887 LOG_WARNING("This device supports Program Longword execution only.");
888 LOG_DEBUG("flash write into PFLASH @08%" PRIX32, offset);
889
890 } else if (kinfo->flash_class == FC_FLEX_NVM) {
891 uint8_t ftfx_fstat;
892
893 LOG_DEBUG("flash write into FlexNVM @%08" PRIX32, offset);
894
895 /* make flex ram available */
896 result = kinetis_ftfx_command(bank, FTFx_CMD_SETFLEXRAM, 0x00ff0000, 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
897
898 if (result != ERROR_OK)
899 return ERROR_FLASH_OPERATION_FAILED;
900
901 /* check if ram ready */
902 result = target_read_memory(bank->target, FTFx_FCNFG, 1, 1, buf);
903
904 if (result != ERROR_OK)
905 return result;
906
907 if (!(buf[0] & (1 << 1))) {
908 /* fallback to longword write */
909 fallback = 1;
910
911 LOG_WARNING("ram not ready, fallback to slow longword write (FCNFG: %02X)", buf[0]);
912 }
913 } else {
914 LOG_DEBUG("flash write into PFLASH @08%" PRIX32, offset);
915 }
916
917
918 /* program section command */
919 if (fallback == 0) {
920 /*
921 * Kinetis uses different terms for the granularity of
922 * sector writes, e.g. "phrase" or "128 bits". We use
923 * the generic term "chunk". The largest possible
924 * Kinetis "chunk" is 16 bytes (128 bits).
925 */
926 unsigned prog_section_chunk_bytes = kinfo->sector_size >> 8;
927 unsigned prog_size_bytes = kinfo->max_flash_prog_size;
928 for (i = 0; i < count; i += prog_size_bytes) {
929 uint8_t residual_buffer[16];
930 uint8_t ftfx_fstat;
931 uint32_t section_count = prog_size_bytes / prog_section_chunk_bytes;
932 uint32_t residual_wc = 0;
933
934 /*
935 * Assume the word count covers an entire
936 * sector.
937 */
938 wc = prog_size_bytes / 4;
939
940 /*
941 * If bytes to be programmed are less than the
942 * full sector, then determine the number of
943 * full-words to program, and put together the
944 * residual buffer so that a full "section"
945 * may always be programmed.
946 */
947 if ((count - i) < prog_size_bytes) {
948 /* number of bytes to program beyond full section */
949 unsigned residual_bc = (count-i) % prog_section_chunk_bytes;
950
951 /* number of complete words to copy directly from buffer */
952 wc = (count - i) / 4;
953
954 /* number of total sections to write, including residual */
955 section_count = DIV_ROUND_UP((count-i), prog_section_chunk_bytes);
956
957 /* any residual bytes delivers a whole residual section */
958 residual_wc = (residual_bc ? prog_section_chunk_bytes : 0)/4;
959
960 /* clear residual buffer then populate residual bytes */
961 (void) memset(residual_buffer, 0xff, prog_section_chunk_bytes);
962 (void) memcpy(residual_buffer, &buffer[i+4*wc], residual_bc);
963 }
964
965 LOG_DEBUG("write section @ %08" PRIX32 " with length %" PRIu32 " bytes",
966 offset + i, (uint32_t)wc*4);
967
968 /* write data to flexram as whole-words */
969 result = target_write_memory(bank->target, FLEXRAM, 4, wc,
970 buffer + i);
971
972 if (result != ERROR_OK) {
973 LOG_ERROR("target_write_memory failed");
974 return result;
975 }
976
977 /* write the residual words to the flexram */
978 if (residual_wc) {
979 result = target_write_memory(bank->target,
980 FLEXRAM+4*wc,
981 4, residual_wc,
982 residual_buffer);
983
984 if (result != ERROR_OK) {
985 LOG_ERROR("target_write_memory failed");
986 return result;
987 }
988 }
989
990 /* execute section-write command */
991 result = kinetis_ftfx_command(bank, FTFx_CMD_SECTWRITE, bank->base + offset + i,
992 section_count>>8, section_count, 0, 0,
993 0, 0, 0, 0, &ftfx_fstat);
994
995 if (result != ERROR_OK)
996 return ERROR_FLASH_OPERATION_FAILED;
997 }
998 }
999 /* program longword command, not supported in "SF3" devices */
1000 else if (kinfo->flash_support & FS_PROGRAM_LONGWORD) {
1001 if (count & 0x3) {
1002 uint32_t old_count = count;
1003 count = (old_count | 3) + 1;
1004 new_buffer = malloc(count);
1005 if (new_buffer == NULL) {
1006 LOG_ERROR("odd number of bytes to write and no memory "
1007 "for padding buffer");
1008 return ERROR_FAIL;
1009 }
1010 LOG_INFO("odd number of bytes to write (%" PRIu32 "), extending to %" PRIu32 " "
1011 "and padding with 0xff", old_count, count);
1012 memset(new_buffer, 0xff, count);
1013 buffer = memcpy(new_buffer, buffer, old_count);
1014 }
1015
1016 uint32_t words_remaining = count / 4;
1017
1018 /* try using a block write */
1019 int retval = kinetis_write_block(bank, buffer, offset, words_remaining);
1020
1021 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
1022 /* if block write failed (no sufficient working area),
1023 * we use normal (slow) single word accesses */
1024 LOG_WARNING("couldn't use block writes, falling back to single "
1025 "memory accesses");
1026
1027 for (i = 0; i < count; i += 4) {
1028 uint8_t ftfx_fstat;
1029
1030 LOG_DEBUG("write longword @ %08" PRIX32, (uint32_t)(offset + i));
1031
1032 uint8_t padding[4] = {0xff, 0xff, 0xff, 0xff};
1033 memcpy(padding, buffer + i, MIN(4, count-i));
1034
1035 result = kinetis_ftfx_command(bank, FTFx_CMD_LWORDPROG, bank->base + offset + i,
1036 padding[3], padding[2], padding[1], padding[0],
1037 0, 0, 0, 0, &ftfx_fstat);
1038
1039 if (result != ERROR_OK)
1040 return ERROR_FLASH_OPERATION_FAILED;
1041 }
1042 }
1043 } else {
1044 LOG_ERROR("Flash write strategy not implemented");
1045 return ERROR_FLASH_OPERATION_FAILED;
1046 }
1047
1048 return ERROR_OK;
1049 }
1050
1051 static int kinetis_read_part_info(struct flash_bank *bank)
1052 {
1053 int result, i;
1054 uint32_t offset = 0;
1055 uint8_t fcfg1_nvmsize, fcfg1_pfsize, fcfg1_eesize, fcfg2_pflsh;
1056 uint32_t nvm_size = 0, pf_size = 0, ee_size = 0;
1057 unsigned num_blocks = 0, num_pflash_blocks = 0, num_nvm_blocks = 0, first_nvm_bank = 0,
1058 reassign = 0, pflash_sector_size_bytes = 0, nvm_sector_size_bytes = 0;
1059 struct target *target = bank->target;
1060 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1061
1062 result = target_read_u32(target, SIM_SDID, &kinfo->sim_sdid);
1063 if (result != ERROR_OK)
1064 return result;
1065
1066 if ((kinfo->sim_sdid & (~KINETIS_SDID_K_SERIES_MASK)) == 0) {
1067 /* older K-series MCU */
1068 uint32_t mcu_type = kinfo->sim_sdid & KINETIS_K_SDID_TYPE_MASK;
1069
1070 switch (mcu_type) {
1071 case KINETIS_K_SDID_K10_M50:
1072 case KINETIS_K_SDID_K20_M50:
1073 /* 1kB sectors */
1074 pflash_sector_size_bytes = 1<<10;
1075 nvm_sector_size_bytes = 1<<10;
1076 num_blocks = 2;
1077 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_PROGRAM_SECTOR;
1078 break;
1079 case KINETIS_K_SDID_K10_M72:
1080 case KINETIS_K_SDID_K20_M72:
1081 case KINETIS_K_SDID_K30_M72:
1082 case KINETIS_K_SDID_K30_M100:
1083 case KINETIS_K_SDID_K40_M72:
1084 case KINETIS_K_SDID_K40_M100:
1085 case KINETIS_K_SDID_K50_M72:
1086 /* 2kB sectors, 1kB FlexNVM sectors */
1087 pflash_sector_size_bytes = 2<<10;
1088 nvm_sector_size_bytes = 1<<10;
1089 num_blocks = 2;
1090 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_PROGRAM_SECTOR;
1091 kinfo->max_flash_prog_size = 1<<10;
1092 break;
1093 case KINETIS_K_SDID_K10_M100:
1094 case KINETIS_K_SDID_K20_M100:
1095 case KINETIS_K_SDID_K11:
1096 case KINETIS_K_SDID_K12:
1097 case KINETIS_K_SDID_K21_M50:
1098 case KINETIS_K_SDID_K22_M50:
1099 case KINETIS_K_SDID_K51_M72:
1100 case KINETIS_K_SDID_K53:
1101 case KINETIS_K_SDID_K60_M100:
1102 /* 2kB sectors */
1103 pflash_sector_size_bytes = 2<<10;
1104 nvm_sector_size_bytes = 2<<10;
1105 num_blocks = 2;
1106 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_PROGRAM_SECTOR;
1107 break;
1108 case KINETIS_K_SDID_K21_M120:
1109 case KINETIS_K_SDID_K22_M120:
1110 /* 4kB sectors (MK21FN1M0, MK21FX512, MK22FN1M0, MK22FX512) */
1111 pflash_sector_size_bytes = 4<<10;
1112 kinfo->max_flash_prog_size = 1<<10;
1113 nvm_sector_size_bytes = 4<<10;
1114 num_blocks = 2;
1115 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR;
1116 break;
1117 case KINETIS_K_SDID_K10_M120:
1118 case KINETIS_K_SDID_K20_M120:
1119 case KINETIS_K_SDID_K60_M150:
1120 case KINETIS_K_SDID_K70_M150:
1121 /* 4kB sectors */
1122 pflash_sector_size_bytes = 4<<10;
1123 nvm_sector_size_bytes = 4<<10;
1124 num_blocks = 4;
1125 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR;
1126 break;
1127 default:
1128 LOG_ERROR("Unsupported K-family FAMID");
1129 }
1130 } else {
1131 /* Newer K-series or KL series MCU */
1132 switch (kinfo->sim_sdid & KINETIS_SDID_SERIESID_MASK) {
1133 case KINETIS_SDID_SERIESID_K:
1134 switch (kinfo->sim_sdid & (KINETIS_SDID_FAMILYID_MASK | KINETIS_SDID_SUBFAMID_MASK)) {
1135 case KINETIS_SDID_FAMILYID_K0X | KINETIS_SDID_SUBFAMID_KX2:
1136 /* K02FN64, K02FN128: FTFA, 2kB sectors */
1137 pflash_sector_size_bytes = 2<<10;
1138 num_blocks = 1;
1139 kinfo->flash_support = FS_PROGRAM_LONGWORD;
1140 break;
1141
1142 case KINETIS_SDID_FAMILYID_K2X | KINETIS_SDID_SUBFAMID_KX2: {
1143 /* MK24FN1M reports as K22, this should detect it (according to errata note 1N83J) */
1144 uint32_t sopt1;
1145 result = target_read_u32(target, SIM_SOPT1, &sopt1);
1146 if (result != ERROR_OK)
1147 return result;
1148
1149 if (((kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K24FN1M) &&
1150 ((sopt1 & KINETIS_SOPT1_RAMSIZE_MASK) == KINETIS_SOPT1_RAMSIZE_K24FN1M)) {
1151 /* MK24FN1M */
1152 pflash_sector_size_bytes = 4<<10;
1153 num_blocks = 2;
1154 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR;
1155 kinfo->max_flash_prog_size = 1<<10;
1156 break;
1157 }
1158 if ((kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K22FN128
1159 || (kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K22FN256
1160 || (kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K22FN512) {
1161 /* K22 with new-style SDID - smaller pflash with FTFA, 2kB sectors */
1162 pflash_sector_size_bytes = 2<<10;
1163 num_blocks = 2; /* 1 or 2 blocks */
1164 kinfo->flash_support = FS_PROGRAM_LONGWORD;
1165 break;
1166 }
1167 LOG_ERROR("Unsupported Kinetis K22 DIEID");
1168 break;
1169 }
1170 case KINETIS_SDID_FAMILYID_K2X | KINETIS_SDID_SUBFAMID_KX4:
1171 pflash_sector_size_bytes = 4<<10;
1172 if ((kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K24FN256) {
1173 /* K24FN256 - smaller pflash with FTFA */
1174 num_blocks = 1;
1175 kinfo->flash_support = FS_PROGRAM_LONGWORD;
1176 break;
1177 }
1178 /* K24FN1M without errata 7534 */
1179 num_blocks = 2;
1180 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR;
1181 kinfo->max_flash_prog_size = 1<<10;
1182 break;
1183
1184 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX3:
1185 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX1: /* errata 7534 - should be K63 */
1186 /* K63FN1M0 */
1187 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX4:
1188 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX2: /* errata 7534 - should be K64 */
1189 /* K64FN1M0, K64FX512 */
1190 pflash_sector_size_bytes = 4<<10;
1191 nvm_sector_size_bytes = 4<<10;
1192 kinfo->max_flash_prog_size = 1<<10;
1193 num_blocks = 2;
1194 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR;
1195 break;
1196
1197 case KINETIS_SDID_FAMILYID_K2X | KINETIS_SDID_SUBFAMID_KX6:
1198 /* K26FN2M0 */
1199 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX6:
1200 /* K66FN2M0, K66FX1M0 */
1201 pflash_sector_size_bytes = 4<<10;
1202 nvm_sector_size_bytes = 4<<10;
1203 kinfo->max_flash_prog_size = 1<<10;
1204 num_blocks = 4;
1205 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR;
1206 break;
1207 default:
1208 LOG_ERROR("Unsupported Kinetis FAMILYID SUBFAMID");
1209 }
1210 break;
1211 case KINETIS_SDID_SERIESID_KL:
1212 /* KL-series */
1213 pflash_sector_size_bytes = 1<<10;
1214 nvm_sector_size_bytes = 1<<10;
1215 num_blocks = 1;
1216 kinfo->flash_support = FS_PROGRAM_LONGWORD;
1217 break;
1218 default:
1219 LOG_ERROR("Unsupported K-series");
1220 }
1221 }
1222
1223 if (pflash_sector_size_bytes == 0) {
1224 LOG_ERROR("MCU is unsupported, SDID 0x%08" PRIx32, kinfo->sim_sdid);
1225 return ERROR_FLASH_OPER_UNSUPPORTED;
1226 }
1227
1228 result = target_read_u32(target, SIM_FCFG1, &kinfo->sim_fcfg1);
1229 if (result != ERROR_OK)
1230 return result;
1231
1232 result = target_read_u32(target, SIM_FCFG2, &kinfo->sim_fcfg2);
1233 if (result != ERROR_OK)
1234 return result;
1235 fcfg2_pflsh = (kinfo->sim_fcfg2 >> 23) & 0x01;
1236
1237 LOG_DEBUG("SDID: 0x%08" PRIX32 " FCFG1: 0x%08" PRIX32 " FCFG2: 0x%08" PRIX32, kinfo->sim_sdid,
1238 kinfo->sim_fcfg1, kinfo->sim_fcfg2);
1239
1240 fcfg1_nvmsize = (uint8_t)((kinfo->sim_fcfg1 >> 28) & 0x0f);
1241 fcfg1_pfsize = (uint8_t)((kinfo->sim_fcfg1 >> 24) & 0x0f);
1242 fcfg1_eesize = (uint8_t)((kinfo->sim_fcfg1 >> 16) & 0x0f);
1243
1244 /* when the PFLSH bit is set, there is no FlexNVM/FlexRAM */
1245 if (!fcfg2_pflsh) {
1246 switch (fcfg1_nvmsize) {
1247 case 0x03:
1248 case 0x07:
1249 case 0x09:
1250 case 0x0b:
1251 nvm_size = 1 << (14 + (fcfg1_nvmsize >> 1));
1252 break;
1253 case 0x0f:
1254 if (pflash_sector_size_bytes >= 4<<10)
1255 nvm_size = 512<<10;
1256 else
1257 /* K20_100 */
1258 nvm_size = 256<<10;
1259 break;
1260 default:
1261 nvm_size = 0;
1262 break;
1263 }
1264
1265 switch (fcfg1_eesize) {
1266 case 0x00:
1267 case 0x01:
1268 case 0x02:
1269 case 0x03:
1270 case 0x04:
1271 case 0x05:
1272 case 0x06:
1273 case 0x07:
1274 case 0x08:
1275 case 0x09:
1276 ee_size = (16 << (10 - fcfg1_eesize));
1277 break;
1278 default:
1279 ee_size = 0;
1280 break;
1281 }
1282 }
1283
1284 switch (fcfg1_pfsize) {
1285 case 0x03:
1286 case 0x05:
1287 case 0x07:
1288 case 0x09:
1289 case 0x0b:
1290 case 0x0d:
1291 pf_size = 1 << (14 + (fcfg1_pfsize >> 1));
1292 break;
1293 case 0x0f:
1294 if (pflash_sector_size_bytes >= 4<<10)
1295 pf_size = 1024<<10;
1296 else if (fcfg2_pflsh)
1297 pf_size = 512<<10;
1298 else
1299 pf_size = 256<<10;
1300 break;
1301 default:
1302 pf_size = 0;
1303 break;
1304 }
1305
1306 LOG_DEBUG("FlexNVM: %" PRIu32 " PFlash: %" PRIu32 " FlexRAM: %" PRIu32 " PFLSH: %d",
1307 nvm_size, pf_size, ee_size, fcfg2_pflsh);
1308
1309 num_pflash_blocks = num_blocks / (2 - fcfg2_pflsh);
1310 first_nvm_bank = num_pflash_blocks;
1311 num_nvm_blocks = num_blocks - num_pflash_blocks;
1312
1313 LOG_DEBUG("%d blocks total: %d PFlash, %d FlexNVM",
1314 num_blocks, num_pflash_blocks, num_nvm_blocks);
1315
1316 /*
1317 * If the flash class is already assigned, verify the
1318 * parameters.
1319 */
1320 if (kinfo->flash_class != FC_AUTO) {
1321 if (kinfo->bank_ordinal != (unsigned) bank->bank_number) {
1322 LOG_WARNING("Flash ordinal/bank number mismatch");
1323 reassign = 1;
1324 } else {
1325 switch (kinfo->flash_class) {
1326 case FC_PFLASH:
1327 if (kinfo->bank_ordinal >= first_nvm_bank) {
1328 LOG_WARNING("Class mismatch, bank %d is not PFlash", bank->bank_number);
1329 reassign = 1;
1330 } else if (bank->size != (pf_size / num_pflash_blocks)) {
1331 LOG_WARNING("PFlash size mismatch");
1332 reassign = 1;
1333 } else if (bank->base !=
1334 (0x00000000 + bank->size * kinfo->bank_ordinal)) {
1335 LOG_WARNING("PFlash address range mismatch");
1336 reassign = 1;
1337 } else if (kinfo->sector_size != pflash_sector_size_bytes) {
1338 LOG_WARNING("PFlash sector size mismatch");
1339 reassign = 1;
1340 } else {
1341 LOG_DEBUG("PFlash bank %d already configured okay",
1342 kinfo->bank_ordinal);
1343 }
1344 break;
1345 case FC_FLEX_NVM:
1346 if ((kinfo->bank_ordinal >= num_blocks) ||
1347 (kinfo->bank_ordinal < first_nvm_bank)) {
1348 LOG_WARNING("Class mismatch, bank %d is not FlexNVM", bank->bank_number);
1349 reassign = 1;
1350 } else if (bank->size != (nvm_size / num_nvm_blocks)) {
1351 LOG_WARNING("FlexNVM size mismatch");
1352 reassign = 1;
1353 } else if (bank->base !=
1354 (0x10000000 + bank->size * kinfo->bank_ordinal)) {
1355 LOG_WARNING("FlexNVM address range mismatch");
1356 reassign = 1;
1357 } else if (kinfo->sector_size != nvm_sector_size_bytes) {
1358 LOG_WARNING("FlexNVM sector size mismatch");
1359 reassign = 1;
1360 } else {
1361 LOG_DEBUG("FlexNVM bank %d already configured okay",
1362 kinfo->bank_ordinal);
1363 }
1364 break;
1365 case FC_FLEX_RAM:
1366 if (kinfo->bank_ordinal != num_blocks) {
1367 LOG_WARNING("Class mismatch, bank %d is not FlexRAM", bank->bank_number);
1368 reassign = 1;
1369 } else if (bank->size != ee_size) {
1370 LOG_WARNING("FlexRAM size mismatch");
1371 reassign = 1;
1372 } else if (bank->base != FLEXRAM) {
1373 LOG_WARNING("FlexRAM address mismatch");
1374 reassign = 1;
1375 } else if (kinfo->sector_size != nvm_sector_size_bytes) {
1376 LOG_WARNING("FlexRAM sector size mismatch");
1377 reassign = 1;
1378 } else {
1379 LOG_DEBUG("FlexRAM bank %d already configured okay", kinfo->bank_ordinal);
1380 }
1381 break;
1382
1383 default:
1384 LOG_WARNING("Unknown or inconsistent flash class");
1385 reassign = 1;
1386 break;
1387 }
1388 }
1389 } else {
1390 LOG_INFO("Probing flash info for bank %d", bank->bank_number);
1391 reassign = 1;
1392 }
1393
1394 if (!reassign)
1395 return ERROR_OK;
1396
1397 if ((unsigned)bank->bank_number < num_pflash_blocks) {
1398 /* pflash, banks start at address zero */
1399 kinfo->flash_class = FC_PFLASH;
1400 bank->size = (pf_size / num_pflash_blocks);
1401 bank->base = 0x00000000 + bank->size * bank->bank_number;
1402 kinfo->sector_size = pflash_sector_size_bytes;
1403 kinfo->protection_size = pf_size / 32;
1404 } else if ((unsigned)bank->bank_number < num_blocks) {
1405 /* nvm, banks start at address 0x10000000 */
1406 kinfo->flash_class = FC_FLEX_NVM;
1407 bank->size = (nvm_size / num_nvm_blocks);
1408 bank->base = 0x10000000 + bank->size * (bank->bank_number - first_nvm_bank);
1409 kinfo->sector_size = nvm_sector_size_bytes;
1410 kinfo->protection_size = 0; /* FIXME: TODO: depends on DEPART bits, chip */
1411 } else if ((unsigned)bank->bank_number == num_blocks) {
1412 LOG_ERROR("FlexRAM support not yet implemented");
1413 return ERROR_FLASH_OPER_UNSUPPORTED;
1414 } else {
1415 LOG_ERROR("Cannot determine parameters for bank %d, only %d banks on device",
1416 bank->bank_number, num_blocks);
1417 return ERROR_FLASH_BANK_INVALID;
1418 }
1419
1420 if (bank->sectors) {
1421 free(bank->sectors);
1422 bank->sectors = NULL;
1423 }
1424
1425 if (kinfo->sector_size == 0) {
1426 LOG_ERROR("Unknown sector size for bank %d", bank->bank_number);
1427 return ERROR_FLASH_BANK_INVALID;
1428 }
1429
1430 if (kinfo->flash_support & FS_PROGRAM_SECTOR
1431 && kinfo->max_flash_prog_size == 0) {
1432 kinfo->max_flash_prog_size = kinfo->sector_size;
1433 /* Program section size is equal to sector size by default */
1434 }
1435
1436 bank->num_sectors = bank->size / kinfo->sector_size;
1437 assert(bank->num_sectors > 0);
1438 bank->sectors = malloc(sizeof(struct flash_sector) * bank->num_sectors);
1439
1440 for (i = 0; i < bank->num_sectors; i++) {
1441 bank->sectors[i].offset = offset;
1442 bank->sectors[i].size = kinfo->sector_size;
1443 offset += kinfo->sector_size;
1444 bank->sectors[i].is_erased = -1;
1445 bank->sectors[i].is_protected = 1;
1446 }
1447
1448 return ERROR_OK;
1449 }
1450
1451 static int kinetis_probe(struct flash_bank *bank)
1452 {
1453 if (bank->target->state != TARGET_HALTED) {
1454 LOG_WARNING("Cannot communicate... target not halted.");
1455 return ERROR_TARGET_NOT_HALTED;
1456 }
1457
1458 return kinetis_read_part_info(bank);
1459 }
1460
1461 static int kinetis_auto_probe(struct flash_bank *bank)
1462 {
1463 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1464
1465 if (kinfo->sim_sdid)
1466 return ERROR_OK;
1467
1468 return kinetis_probe(bank);
1469 }
1470
1471 static int kinetis_info(struct flash_bank *bank, char *buf, int buf_size)
1472 {
1473 const char *bank_class_names[] = {
1474 "(ANY)", "PFlash", "FlexNVM", "FlexRAM"
1475 };
1476
1477 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1478
1479 (void) snprintf(buf, buf_size,
1480 "%s driver for %s flash bank %s at 0x%8.8" PRIx32 "",
1481 bank->driver->name, bank_class_names[kinfo->flash_class],
1482 bank->name, bank->base);
1483
1484 return ERROR_OK;
1485 }
1486
1487 static int kinetis_blank_check(struct flash_bank *bank)
1488 {
1489 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1490
1491 if (bank->target->state != TARGET_HALTED) {
1492 LOG_ERROR("Target not halted");
1493 return ERROR_TARGET_NOT_HALTED;
1494 }
1495
1496 if (kinfo->flash_class == FC_PFLASH) {
1497 int result;
1498 uint8_t ftfx_fstat;
1499
1500 /* check if whole bank is blank */
1501 result = kinetis_ftfx_command(bank, FTFx_CMD_BLOCKSTAT, bank->base, 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
1502
1503 if (result != ERROR_OK)
1504 return result;
1505
1506 if (ftfx_fstat & 0x01) {
1507 /* the whole bank is not erased, check sector-by-sector */
1508 int i;
1509 for (i = 0; i < bank->num_sectors; i++) {
1510 /* normal margin */
1511 result = kinetis_ftfx_command(bank, FTFx_CMD_SECTSTAT, bank->base + bank->sectors[i].offset,
1512 1, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
1513
1514 if (result == ERROR_OK) {
1515 bank->sectors[i].is_erased = !(ftfx_fstat & 0x01);
1516 } else {
1517 LOG_DEBUG("Ignoring errored PFlash sector blank-check");
1518 bank->sectors[i].is_erased = -1;
1519 }
1520 }
1521 } else {
1522 /* the whole bank is erased, update all sectors */
1523 int i;
1524 for (i = 0; i < bank->num_sectors; i++)
1525 bank->sectors[i].is_erased = 1;
1526 }
1527 } else {
1528 LOG_WARNING("kinetis_blank_check not supported yet for FlexNVM");
1529 return ERROR_FLASH_OPERATION_FAILED;
1530 }
1531
1532 return ERROR_OK;
1533 }
1534
1535 static const struct command_registration kinetis_securtiy_command_handlers[] = {
1536 {
1537 .name = "check_security",
1538 .mode = COMMAND_EXEC,
1539 .help = "",
1540 .usage = "",
1541 .handler = kinetis_check_flash_security_status,
1542 },
1543 {
1544 .name = "mass_erase",
1545 .mode = COMMAND_EXEC,
1546 .help = "",
1547 .usage = "",
1548 .handler = kinetis_mdm_mass_erase,
1549 },
1550 {
1551 .name = "test_securing",
1552 .mode = COMMAND_EXEC,
1553 .help = "",
1554 .usage = "",
1555 .handler = kinetis_securing_test,
1556 },
1557 COMMAND_REGISTRATION_DONE
1558 };
1559
1560 static const struct command_registration kinetis_exec_command_handlers[] = {
1561 {
1562 .name = "mdm",
1563 .mode = COMMAND_ANY,
1564 .help = "",
1565 .usage = "",
1566 .chain = kinetis_securtiy_command_handlers,
1567 },
1568 COMMAND_REGISTRATION_DONE
1569 };
1570
1571 static const struct command_registration kinetis_command_handler[] = {
1572 {
1573 .name = "kinetis",
1574 .mode = COMMAND_ANY,
1575 .help = "kinetis NAND flash controller commands",
1576 .usage = "",
1577 .chain = kinetis_exec_command_handlers,
1578 },
1579 COMMAND_REGISTRATION_DONE
1580 };
1581
1582
1583
1584 struct flash_driver kinetis_flash = {
1585 .name = "kinetis",
1586 .commands = kinetis_command_handler,
1587 .flash_bank_command = kinetis_flash_bank_command,
1588 .erase = kinetis_erase,
1589 .protect = kinetis_protect,
1590 .write = kinetis_write,
1591 .read = default_flash_read,
1592 .probe = kinetis_probe,
1593 .auto_probe = kinetis_auto_probe,
1594 .erase_check = kinetis_blank_check,
1595 .protect_check = kinetis_protect_check,
1596 .info = kinetis_info,
1597 };
Open On-Chip Debugger

Linking to existing account procedure

If you already have an account and want to add another login method you MUST first sign in with your existing account and then change URL to read https://review.openocd.org/login/?link to get to this page again but this time it'll work for linking. Thank you.

SSH host keys fingerprints

1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=..              |
|+o..   .         |
|*.o   . .        |
|+B . . .         |
|Bo. = o S        |
|Oo.+ + =         |
|oB=.* = . o      |
| =+=.+   + E     |
|. .=o   . o      |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)