Code Review / openocd.git / blob
? search:


f91dda4fca8d731f0ca5bffb76c0d95ae20b08fb
[openocd.git] / src / flash / nor / kinetis.c
1 /***************************************************************************
2 * Copyright (C) 2011 by Mathias Kuester *
3 * kesmtp@freenet.de *
4 * *
5 * Copyright (C) 2011 sleep(5) ltd *
6 * tomas@sleepfive.com *
7 * *
8 * Copyright (C) 2012 by Christopher D. Kilgour *
9 * techie at whiterocker.com *
10 * *
11 * Copyright (C) 2013 Nemui Trinomius *
12 * nemuisan_kawausogasuki@live.jp *
13 * *
14 * Copyright (C) 2015 Tomas Vanek *
15 * vanekt@fbl.cz *
16 * *
17 * This program is free software; you can redistribute it and/or modify *
18 * it under the terms of the GNU General Public License as published by *
19 * the Free Software Foundation; either version 2 of the License, or *
20 * (at your option) any later version. *
21 * *
22 * This program is distributed in the hope that it will be useful, *
23 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
24 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
25 * GNU General Public License for more details. *
26 * *
27 * You should have received a copy of the GNU General Public License *
28 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
29 ***************************************************************************/
30
31 #ifdef HAVE_CONFIG_H
32 #include "config.h"
33 #endif
34
35 #include "jtag/interface.h"
36 #include "imp.h"
37 #include <helper/binarybuffer.h>
38 #include <helper/time_support.h>
39 #include <target/target_type.h>
40 #include <target/algorithm.h>
41 #include <target/armv7m.h>
42 #include <target/cortex_m.h>
43
44 /*
45 * Implementation Notes
46 *
47 * The persistent memories in the Kinetis chip families K10 through
48 * K70 are all manipulated with the Flash Memory Module. Some
49 * variants call this module the FTFE, others call it the FTFL. To
50 * indicate that both are considered here, we use FTFX.
51 *
52 * Within the module, according to the chip variant, the persistent
53 * memory is divided into what Freescale terms Program Flash, FlexNVM,
54 * and FlexRAM. All chip variants have Program Flash. Some chip
55 * variants also have FlexNVM and FlexRAM, which always appear
56 * together.
57 *
58 * A given Kinetis chip may have 1, 2 or 4 blocks of flash. Here we map
59 * each block to a separate bank. Each block size varies by chip and
60 * may be determined by the read-only SIM_FCFG1 register. The sector
61 * size within each bank/block varies by chip, and may be 1, 2 or 4k.
62 * The sector size may be different for flash and FlexNVM.
63 *
64 * The first half of the flash (1 or 2 blocks) is always Program Flash
65 * and always starts at address 0x00000000. The "PFLSH" flag, bit 23
66 * of the read-only SIM_FCFG2 register, determines whether the second
67 * half of the flash is also Program Flash or FlexNVM+FlexRAM. When
68 * PFLSH is set, the second from the first half. When PFLSH is clear,
69 * the second half of flash is FlexNVM and always starts at address
70 * 0x10000000. FlexRAM, which is also present when PFLSH is clear,
71 * always starts at address 0x14000000.
72 *
73 * The Flash Memory Module provides a register set where flash
74 * commands are loaded to perform flash operations like erase and
75 * program. Different commands are available depending on whether
76 * Program Flash or FlexNVM/FlexRAM is being manipulated. Although
77 * the commands used are quite consistent between flash blocks, the
78 * parameters they accept differ according to the flash sector size.
79 *
80 */
81
82 /* Addressess */
83 #define FLEXRAM 0x14000000
84
85 #define FMC_PFB01CR 0x4001f004
86 #define FTFx_FSTAT 0x40020000
87 #define FTFx_FCNFG 0x40020001
88 #define FTFx_FCCOB3 0x40020004
89 #define FTFx_FPROT3 0x40020010
90 #define FTFx_FDPROT 0x40020017
91 #define SIM_SDID 0x40048024
92 #define SIM_SOPT1 0x40047000
93 #define SIM_FCFG1 0x4004804c
94 #define SIM_FCFG2 0x40048050
95 #define WDOG_STCTRH 0x40052000
96 #define SMC_PMCTRL 0x4007E001
97 #define SMC_PMSTAT 0x4007E003
98
99 /* Values */
100 #define PM_STAT_RUN 0x01
101 #define PM_STAT_VLPR 0x04
102 #define PM_CTRL_RUNM_RUN 0x00
103
104 /* Commands */
105 #define FTFx_CMD_BLOCKSTAT 0x00
106 #define FTFx_CMD_SECTSTAT 0x01
107 #define FTFx_CMD_LWORDPROG 0x06
108 #define FTFx_CMD_SECTERASE 0x09
109 #define FTFx_CMD_SECTWRITE 0x0b
110 #define FTFx_CMD_MASSERASE 0x44
111 #define FTFx_CMD_PGMPART 0x80
112 #define FTFx_CMD_SETFLEXRAM 0x81
113
114 /* The older Kinetis K series uses the following SDID layout :
115 * Bit 31-16 : 0
116 * Bit 15-12 : REVID
117 * Bit 11-7 : DIEID
118 * Bit 6-4 : FAMID
119 * Bit 3-0 : PINID
120 *
121 * The newer Kinetis series uses the following SDID layout :
122 * Bit 31-28 : FAMID
123 * Bit 27-24 : SUBFAMID
124 * Bit 23-20 : SERIESID
125 * Bit 19-16 : SRAMSIZE
126 * Bit 15-12 : REVID
127 * Bit 6-4 : Reserved (0)
128 * Bit 3-0 : PINID
129 *
130 * We assume that if bits 31-16 are 0 then it's an older
131 * K-series MCU.
132 */
133
134 #define KINETIS_SOPT1_RAMSIZE_MASK 0x0000F000
135 #define KINETIS_SOPT1_RAMSIZE_K24FN1M 0x0000B000
136
137 #define KINETIS_SDID_K_SERIES_MASK 0x0000FFFF
138
139 #define KINETIS_SDID_DIEID_MASK 0x00000F80
140
141 #define KINETIS_SDID_DIEID_K22FN128 0x00000680 /* smaller pflash with FTFA */
142 #define KINETIS_SDID_DIEID_K22FN256 0x00000A80
143 #define KINETIS_SDID_DIEID_K22FN512 0x00000E80
144 #define KINETIS_SDID_DIEID_K24FN256 0x00000700
145
146 #define KINETIS_SDID_DIEID_K24FN1M 0x00000300 /* Detect Errata 7534 */
147
148 /* We can't rely solely on the FAMID field to determine the MCU
149 * type since some FAMID values identify multiple MCUs with
150 * different flash sector sizes (K20 and K22 for instance).
151 * Therefore we combine it with the DIEID bits which may possibly
152 * break if Freescale bumps the DIEID for a particular MCU. */
153 #define KINETIS_K_SDID_TYPE_MASK 0x00000FF0
154 #define KINETIS_K_SDID_K10_M50 0x00000000
155 #define KINETIS_K_SDID_K10_M72 0x00000080
156 #define KINETIS_K_SDID_K10_M100 0x00000100
157 #define KINETIS_K_SDID_K10_M120 0x00000180
158 #define KINETIS_K_SDID_K11 0x00000220
159 #define KINETIS_K_SDID_K12 0x00000200
160 #define KINETIS_K_SDID_K20_M50 0x00000010
161 #define KINETIS_K_SDID_K20_M72 0x00000090
162 #define KINETIS_K_SDID_K20_M100 0x00000110
163 #define KINETIS_K_SDID_K20_M120 0x00000190
164 #define KINETIS_K_SDID_K21_M50 0x00000230
165 #define KINETIS_K_SDID_K21_M120 0x00000330
166 #define KINETIS_K_SDID_K22_M50 0x00000210
167 #define KINETIS_K_SDID_K22_M120 0x00000310
168 #define KINETIS_K_SDID_K30_M72 0x000000A0
169 #define KINETIS_K_SDID_K30_M100 0x00000120
170 #define KINETIS_K_SDID_K40_M72 0x000000B0
171 #define KINETIS_K_SDID_K40_M100 0x00000130
172 #define KINETIS_K_SDID_K50_M72 0x000000E0
173 #define KINETIS_K_SDID_K51_M72 0x000000F0
174 #define KINETIS_K_SDID_K53 0x00000170
175 #define KINETIS_K_SDID_K60_M100 0x00000140
176 #define KINETIS_K_SDID_K60_M150 0x000001C0
177 #define KINETIS_K_SDID_K70_M150 0x000001D0
178
179 #define KINETIS_SDID_SERIESID_MASK 0x00F00000
180 #define KINETIS_SDID_SERIESID_K 0x00000000
181 #define KINETIS_SDID_SERIESID_KL 0x00100000
182 #define KINETIS_SDID_SERIESID_KW 0x00500000
183 #define KINETIS_SDID_SERIESID_KV 0x00600000
184
185 #define KINETIS_SDID_SUBFAMID_MASK 0x0F000000
186 #define KINETIS_SDID_SUBFAMID_KX0 0x00000000
187 #define KINETIS_SDID_SUBFAMID_KX1 0x01000000
188 #define KINETIS_SDID_SUBFAMID_KX2 0x02000000
189 #define KINETIS_SDID_SUBFAMID_KX3 0x03000000
190 #define KINETIS_SDID_SUBFAMID_KX4 0x04000000
191 #define KINETIS_SDID_SUBFAMID_KX5 0x05000000
192 #define KINETIS_SDID_SUBFAMID_KX6 0x06000000
193
194 #define KINETIS_SDID_FAMILYID_MASK 0xF0000000
195 #define KINETIS_SDID_FAMILYID_K0X 0x00000000
196 #define KINETIS_SDID_FAMILYID_K1X 0x10000000
197 #define KINETIS_SDID_FAMILYID_K2X 0x20000000
198 #define KINETIS_SDID_FAMILYID_K3X 0x30000000
199 #define KINETIS_SDID_FAMILYID_K4X 0x40000000
200 #define KINETIS_SDID_FAMILYID_K6X 0x60000000
201 #define KINETIS_SDID_FAMILYID_K7X 0x70000000
202
203 struct kinetis_flash_bank {
204 bool probed;
205 uint32_t sector_size;
206 uint32_t max_flash_prog_size;
207 uint32_t protection_size;
208 uint32_t prog_base; /* base address for FTFx operations */
209 /* same as bank->base for pflash, differs for FlexNVM */
210 uint32_t protection_block; /* number of first protection block in this bank */
211
212 uint32_t sim_sdid;
213 uint32_t sim_fcfg1;
214 uint32_t sim_fcfg2;
215
216 enum {
217 FC_AUTO = 0,
218 FC_PFLASH,
219 FC_FLEX_NVM,
220 FC_FLEX_RAM,
221 } flash_class;
222
223 enum {
224 FS_PROGRAM_SECTOR = 1,
225 FS_PROGRAM_LONGWORD = 2,
226 FS_PROGRAM_PHRASE = 4, /* Unsupported */
227 FS_INVALIDATE_CACHE = 8,
228 } flash_support;
229 };
230
231 #define MDM_AP 1
232
233 #define MDM_REG_STAT 0x00
234 #define MDM_REG_CTRL 0x04
235 #define MDM_REG_ID 0xfc
236
237 #define MDM_STAT_FMEACK (1<<0)
238 #define MDM_STAT_FREADY (1<<1)
239 #define MDM_STAT_SYSSEC (1<<2)
240 #define MDM_STAT_SYSRES (1<<3)
241 #define MDM_STAT_FMEEN (1<<5)
242 #define MDM_STAT_BACKDOOREN (1<<6)
243 #define MDM_STAT_LPEN (1<<7)
244 #define MDM_STAT_VLPEN (1<<8)
245 #define MDM_STAT_LLSMODEXIT (1<<9)
246 #define MDM_STAT_VLLSXMODEXIT (1<<10)
247 #define MDM_STAT_CORE_HALTED (1<<16)
248 #define MDM_STAT_CORE_SLEEPDEEP (1<<17)
249 #define MDM_STAT_CORESLEEPING (1<<18)
250
251 #define MDM_CTRL_FMEIP (1<<0)
252 #define MDM_CTRL_DBG_DIS (1<<1)
253 #define MDM_CTRL_DBG_REQ (1<<2)
254 #define MDM_CTRL_SYS_RES_REQ (1<<3)
255 #define MDM_CTRL_CORE_HOLD_RES (1<<4)
256 #define MDM_CTRL_VLLSX_DBG_REQ (1<<5)
257 #define MDM_CTRL_VLLSX_DBG_ACK (1<<6)
258 #define MDM_CTRL_VLLSX_STAT_ACK (1<<7)
259
260 #define MDM_ACCESS_TIMEOUT 500 /* msec */
261
262 static int kinetis_mdm_write_register(struct adiv5_dap *dap, unsigned reg, uint32_t value)
263 {
264 int retval;
265 LOG_DEBUG("MDM_REG[0x%02x] <- %08" PRIX32, reg, value);
266
267 retval = dap_queue_ap_write(dap_ap(dap, MDM_AP), reg, value);
268 if (retval != ERROR_OK) {
269 LOG_DEBUG("MDM: failed to queue a write request");
270 return retval;
271 }
272
273 retval = dap_run(dap);
274 if (retval != ERROR_OK) {
275 LOG_DEBUG("MDM: dap_run failed");
276 return retval;
277 }
278
279
280 return ERROR_OK;
281 }
282
283 static int kinetis_mdm_read_register(struct adiv5_dap *dap, unsigned reg, uint32_t *result)
284 {
285 int retval;
286
287 retval = dap_queue_ap_read(dap_ap(dap, MDM_AP), reg, result);
288 if (retval != ERROR_OK) {
289 LOG_DEBUG("MDM: failed to queue a read request");
290 return retval;
291 }
292
293 retval = dap_run(dap);
294 if (retval != ERROR_OK) {
295 LOG_DEBUG("MDM: dap_run failed");
296 return retval;
297 }
298
299 LOG_DEBUG("MDM_REG[0x%02x]: %08" PRIX32, reg, *result);
300 return ERROR_OK;
301 }
302
303 static int kinetis_mdm_poll_register(struct adiv5_dap *dap, unsigned reg,
304 uint32_t mask, uint32_t value, uint32_t timeout_ms)
305 {
306 uint32_t val;
307 int retval;
308 int64_t ms_timeout = timeval_ms() + timeout_ms;
309
310 do {
311 retval = kinetis_mdm_read_register(dap, reg, &val);
312 if (retval != ERROR_OK || (val & mask) == value)
313 return retval;
314
315 alive_sleep(1);
316 } while (timeval_ms() < ms_timeout);
317
318 LOG_DEBUG("MDM: polling timed out");
319 return ERROR_FAIL;
320 }
321
322 /*
323 * This command can be used to break a watchdog reset loop when
324 * connecting to an unsecured target. Unlike other commands, halt will
325 * automatically retry as it does not know how far into the boot process
326 * it is when the command is called.
327 */
328 COMMAND_HANDLER(kinetis_mdm_halt)
329 {
330 struct target *target = get_current_target(CMD_CTX);
331 struct cortex_m_common *cortex_m = target_to_cm(target);
332 struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
333 int retval;
334 int tries = 0;
335 uint32_t stat;
336 int64_t ms_timeout = timeval_ms() + MDM_ACCESS_TIMEOUT;
337
338 if (!dap) {
339 LOG_ERROR("Cannot perform halt with a high-level adapter");
340 return ERROR_FAIL;
341 }
342
343 while (true) {
344 tries++;
345
346 kinetis_mdm_write_register(dap, MDM_REG_CTRL, MDM_CTRL_CORE_HOLD_RES);
347
348 alive_sleep(1);
349
350 retval = kinetis_mdm_read_register(dap, MDM_REG_STAT, &stat);
351 if (retval != ERROR_OK) {
352 LOG_DEBUG("MDM: failed to read MDM_REG_STAT");
353 continue;
354 }
355
356 /* Repeat setting MDM_CTRL_CORE_HOLD_RES until system is out of
357 * reset with flash ready and without security
358 */
359 if ((stat & (MDM_STAT_FREADY | MDM_STAT_SYSSEC | MDM_STAT_SYSRES))
360 == (MDM_STAT_FREADY | MDM_STAT_SYSRES))
361 break;
362
363 if (timeval_ms() >= ms_timeout) {
364 LOG_ERROR("MDM: halt timed out");
365 return ERROR_FAIL;
366 }
367 }
368
369 LOG_DEBUG("MDM: halt succeded after %d attempts.", tries);
370
371 target_poll(target);
372 /* enable polling in case kinetis_check_flash_security_status disabled it */
373 jtag_poll_set_enabled(true);
374
375 alive_sleep(100);
376
377 target->reset_halt = true;
378 target->type->assert_reset(target);
379
380 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, 0);
381 if (retval != ERROR_OK) {
382 LOG_ERROR("MDM: failed to clear MDM_REG_CTRL");
383 return retval;
384 }
385
386 target->type->deassert_reset(target);
387
388 return ERROR_OK;
389 }
390
391 COMMAND_HANDLER(kinetis_mdm_reset)
392 {
393 struct target *target = get_current_target(CMD_CTX);
394 struct cortex_m_common *cortex_m = target_to_cm(target);
395 struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
396 int retval;
397
398 if (!dap) {
399 LOG_ERROR("Cannot perform reset with a high-level adapter");
400 return ERROR_FAIL;
401 }
402
403 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, MDM_CTRL_SYS_RES_REQ);
404 if (retval != ERROR_OK) {
405 LOG_ERROR("MDM: failed to write MDM_REG_CTRL");
406 return retval;
407 }
408
409 retval = kinetis_mdm_poll_register(dap, MDM_REG_STAT, MDM_STAT_SYSRES, 0, 500);
410 if (retval != ERROR_OK) {
411 LOG_ERROR("MDM: failed to assert reset");
412 return retval;
413 }
414
415 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, 0);
416 if (retval != ERROR_OK) {
417 LOG_ERROR("MDM: failed to clear MDM_REG_CTRL");
418 return retval;
419 }
420
421 return ERROR_OK;
422 }
423
424 /*
425 * This function implements the procedure to mass erase the flash via
426 * SWD/JTAG on Kinetis K and L series of devices as it is described in
427 * AN4835 "Production Flash Programming Best Practices for Kinetis K-
428 * and L-series MCUs" Section 4.2.1. To prevent a watchdog reset loop,
429 * the core remains halted after this function completes as suggested
430 * by the application note.
431 */
432 COMMAND_HANDLER(kinetis_mdm_mass_erase)
433 {
434 struct target *target = get_current_target(CMD_CTX);
435 struct cortex_m_common *cortex_m = target_to_cm(target);
436 struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
437
438 if (!dap) {
439 LOG_ERROR("Cannot perform mass erase with a high-level adapter");
440 return ERROR_FAIL;
441 }
442
443 int retval;
444
445 /*
446 * ... Power on the processor, or if power has already been
447 * applied, assert the RESET pin to reset the processor. For
448 * devices that do not have a RESET pin, write the System
449 * Reset Request bit in the MDM-AP control register after
450 * establishing communication...
451 */
452
453 /* assert SRST if configured */
454 bool has_srst = jtag_get_reset_config() & RESET_HAS_SRST;
455 if (has_srst)
456 adapter_assert_reset();
457
458 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, MDM_CTRL_SYS_RES_REQ);
459 if (retval != ERROR_OK && !has_srst) {
460 LOG_ERROR("MDM: failed to assert reset");
461 goto deassert_reset_and_exit;
462 }
463
464 /*
465 * ... Read the MDM-AP status register repeatedly and wait for
466 * stable conditions suitable for mass erase:
467 * - mass erase is enabled
468 * - flash is ready
469 * - reset is finished
470 *
471 * Mass erase is started as soon as all conditions are met in 32
472 * subsequent status reads.
473 *
474 * In case of not stable conditions (RESET/WDOG loop in secured device)
475 * the user is asked for manual pressing of RESET button
476 * as a last resort.
477 */
478 int cnt_mass_erase_disabled = 0;
479 int cnt_ready = 0;
480 int64_t ms_start = timeval_ms();
481 bool man_reset_requested = false;
482
483 do {
484 uint32_t stat = 0;
485 int64_t ms_elapsed = timeval_ms() - ms_start;
486
487 if (!man_reset_requested && ms_elapsed > 100) {
488 LOG_INFO("MDM: Press RESET button now if possible.");
489 man_reset_requested = true;
490 }
491
492 if (ms_elapsed > 3000) {
493 LOG_ERROR("MDM: waiting for mass erase conditions timed out.");
494 LOG_INFO("Mass erase of a secured MCU is not possible without hardware reset.");
495 LOG_INFO("Connect SRST, use 'reset_config srst_only' and retry.");
496 goto deassert_reset_and_exit;
497 }
498 retval = kinetis_mdm_read_register(dap, MDM_REG_STAT, &stat);
499 if (retval != ERROR_OK) {
500 cnt_ready = 0;
501 continue;
502 }
503
504 if (!(stat & MDM_STAT_FMEEN)) {
505 cnt_ready = 0;
506 cnt_mass_erase_disabled++;
507 if (cnt_mass_erase_disabled > 10) {
508 LOG_ERROR("MDM: mass erase is disabled");
509 goto deassert_reset_and_exit;
510 }
511 continue;
512 }
513
514 if ((stat & (MDM_STAT_FREADY | MDM_STAT_SYSRES)) == MDM_STAT_FREADY)
515 cnt_ready++;
516 else
517 cnt_ready = 0;
518
519 } while (cnt_ready < 32);
520
521 /*
522 * ... Write the MDM-AP control register to set the Flash Mass
523 * Erase in Progress bit. This will start the mass erase
524 * process...
525 */
526 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, MDM_CTRL_SYS_RES_REQ | MDM_CTRL_FMEIP);
527 if (retval != ERROR_OK) {
528 LOG_ERROR("MDM: failed to start mass erase");
529 goto deassert_reset_and_exit;
530 }
531
532 /*
533 * ... Read the MDM-AP control register until the Flash Mass
534 * Erase in Progress bit clears...
535 * Data sheed defines erase time <3.6 sec/512kB flash block.
536 * The biggest device has 4 pflash blocks => timeout 16 sec.
537 */
538 retval = kinetis_mdm_poll_register(dap, MDM_REG_CTRL, MDM_CTRL_FMEIP, 0, 16000);
539 if (retval != ERROR_OK) {
540 LOG_ERROR("MDM: mass erase timeout");
541 goto deassert_reset_and_exit;
542 }
543
544 target_poll(target);
545 /* enable polling in case kinetis_check_flash_security_status disabled it */
546 jtag_poll_set_enabled(true);
547
548 alive_sleep(100);
549
550 target->reset_halt = true;
551 target->type->assert_reset(target);
552
553 /*
554 * ... Negate the RESET signal or clear the System Reset Request
555 * bit in the MDM-AP control register.
556 */
557 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, 0);
558 if (retval != ERROR_OK)
559 LOG_ERROR("MDM: failed to clear MDM_REG_CTRL");
560
561 target->type->deassert_reset(target);
562
563 return retval;
564
565 deassert_reset_and_exit:
566 kinetis_mdm_write_register(dap, MDM_REG_CTRL, 0);
567 if (has_srst)
568 adapter_deassert_reset();
569 return retval;
570 }
571
572 static const uint32_t kinetis_known_mdm_ids[] = {
573 0x001C0000, /* Kinetis-K Series */
574 0x001C0020, /* Kinetis-L/M/V/E Series */
575 };
576
577 /*
578 * This function implements the procedure to connect to
579 * SWD/JTAG on Kinetis K and L series of devices as it is described in
580 * AN4835 "Production Flash Programming Best Practices for Kinetis K-
581 * and L-series MCUs" Section 4.1.1
582 */
583 COMMAND_HANDLER(kinetis_check_flash_security_status)
584 {
585 struct target *target = get_current_target(CMD_CTX);
586 struct cortex_m_common *cortex_m = target_to_cm(target);
587 struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
588
589 if (!dap) {
590 LOG_WARNING("Cannot check flash security status with a high-level adapter");
591 return ERROR_OK;
592 }
593
594 uint32_t val;
595 int retval;
596
597 /*
598 * ... The MDM-AP ID register can be read to verify that the
599 * connection is working correctly...
600 */
601 retval = kinetis_mdm_read_register(dap, MDM_REG_ID, &val);
602 if (retval != ERROR_OK) {
603 LOG_ERROR("MDM: failed to read ID register");
604 return ERROR_OK;
605 }
606
607 if (val == 0)
608 return ERROR_OK;
609
610 bool found = false;
611 for (size_t i = 0; i < ARRAY_SIZE(kinetis_known_mdm_ids); i++) {
612 if (val == kinetis_known_mdm_ids[i]) {
613 found = true;
614 break;
615 }
616 }
617
618 if (!found)
619 LOG_WARNING("MDM: unknown ID %08" PRIX32, val);
620
621 /*
622 * ... Read the System Security bit to determine if security is enabled.
623 * If System Security = 0, then proceed. If System Security = 1, then
624 * communication with the internals of the processor, including the
625 * flash, will not be possible without issuing a mass erase command or
626 * unsecuring the part through other means (backdoor key unlock)...
627 */
628 retval = kinetis_mdm_read_register(dap, MDM_REG_STAT, &val);
629 if (retval != ERROR_OK) {
630 LOG_ERROR("MDM: failed to read MDM_REG_STAT");
631 return ERROR_OK;
632 }
633
634 /*
635 * System Security bit is also active for short time during reset.
636 * If a MCU has blank flash and runs in RESET/WDOG loop,
637 * System Security bit is active most of time!
638 * We should observe Flash Ready bit and read status several times
639 * to avoid false detection of secured MCU
640 */
641 int secured_score = 0, flash_not_ready_score = 0;
642
643 if ((val & (MDM_STAT_SYSSEC | MDM_STAT_FREADY)) != MDM_STAT_FREADY) {
644 uint32_t stats[32];
645 int i;
646
647 for (i = 0; i < 32; i++) {
648 stats[i] = MDM_STAT_FREADY;
649 dap_queue_ap_read(dap_ap(dap, MDM_AP), MDM_REG_STAT, &stats[i]);
650 }
651 retval = dap_run(dap);
652 if (retval != ERROR_OK) {
653 LOG_DEBUG("MDM: dap_run failed when validating secured state");
654 return ERROR_OK;
655 }
656 for (i = 0; i < 32; i++) {
657 if (stats[i] & MDM_STAT_SYSSEC)
658 secured_score++;
659 if (!(stats[i] & MDM_STAT_FREADY))
660 flash_not_ready_score++;
661 }
662 }
663
664 if (flash_not_ready_score <= 8 && secured_score > 24) {
665 jtag_poll_set_enabled(false);
666
667 LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
668 LOG_WARNING("**** ****");
669 LOG_WARNING("**** Your Kinetis MCU is in secured state, which means that, ****");
670 LOG_WARNING("**** with exception for very basic communication, JTAG/SWD ****");
671 LOG_WARNING("**** interface will NOT work. In order to restore its ****");
672 LOG_WARNING("**** functionality please issue 'kinetis mdm mass_erase' ****");
673 LOG_WARNING("**** command, power cycle the MCU and restart OpenOCD. ****");
674 LOG_WARNING("**** ****");
675 LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
676
677 } else if (flash_not_ready_score > 24) {
678 jtag_poll_set_enabled(false);
679 LOG_WARNING("**** Your Kinetis MCU is probably locked-up in RESET/WDOG loop. ****");
680 LOG_WARNING("**** Common reason is a blank flash (at least a reset vector). ****");
681 LOG_WARNING("**** Issue 'kinetis mdm halt' command or if SRST is connected ****");
682 LOG_WARNING("**** and configured, use 'reset halt' ****");
683 LOG_WARNING("**** If MCU cannot be halted, it is likely secured and running ****");
684 LOG_WARNING("**** in RESET/WDOG loop. Issue 'kinetis mdm mass_erase' ****");
685
686 } else {
687 LOG_INFO("MDM: Chip is unsecured. Continuing.");
688 jtag_poll_set_enabled(true);
689 }
690
691 return ERROR_OK;
692 }
693
694 FLASH_BANK_COMMAND_HANDLER(kinetis_flash_bank_command)
695 {
696 struct kinetis_flash_bank *bank_info;
697
698 if (CMD_ARGC < 6)
699 return ERROR_COMMAND_SYNTAX_ERROR;
700
701 LOG_INFO("add flash_bank kinetis %s", bank->name);
702
703 bank_info = malloc(sizeof(struct kinetis_flash_bank));
704
705 memset(bank_info, 0, sizeof(struct kinetis_flash_bank));
706
707 bank->driver_priv = bank_info;
708
709 return ERROR_OK;
710 }
711
712 /* Disable the watchdog on Kinetis devices */
713 int kinetis_disable_wdog(struct target *target, uint32_t sim_sdid)
714 {
715 struct working_area *wdog_algorithm;
716 struct armv7m_algorithm armv7m_info;
717 uint16_t wdog;
718 int retval;
719
720 static const uint8_t kinetis_unlock_wdog_code[] = {
721 #include "../../../contrib/loaders/watchdog/armv7m_kinetis_wdog.inc"
722 };
723
724 /* Decide whether the connected device needs watchdog disabling.
725 * Disable for all Kx and KVx devices, return if it is a KLx */
726
727 if ((sim_sdid & KINETIS_SDID_SERIESID_MASK) == KINETIS_SDID_SERIESID_KL)
728 return ERROR_OK;
729
730 /* The connected device requires watchdog disabling. */
731 retval = target_read_u16(target, WDOG_STCTRH, &wdog);
732 if (retval != ERROR_OK)
733 return retval;
734
735 if ((wdog & 0x1) == 0) {
736 /* watchdog already disabled */
737 return ERROR_OK;
738 }
739 LOG_INFO("Disabling Kinetis watchdog (initial WDOG_STCTRLH = 0x%x)", wdog);
740
741 if (target->state != TARGET_HALTED) {
742 LOG_ERROR("Target not halted");
743 return ERROR_TARGET_NOT_HALTED;
744 }
745
746 retval = target_alloc_working_area(target, sizeof(kinetis_unlock_wdog_code), &wdog_algorithm);
747 if (retval != ERROR_OK)
748 return retval;
749
750 retval = target_write_buffer(target, wdog_algorithm->address,
751 sizeof(kinetis_unlock_wdog_code), (uint8_t *)kinetis_unlock_wdog_code);
752 if (retval != ERROR_OK) {
753 target_free_working_area(target, wdog_algorithm);
754 return retval;
755 }
756
757 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
758 armv7m_info.core_mode = ARM_MODE_THREAD;
759
760 retval = target_run_algorithm(target, 0, NULL, 0, NULL, wdog_algorithm->address,
761 wdog_algorithm->address + (sizeof(kinetis_unlock_wdog_code) - 2),
762 10000, &armv7m_info);
763
764 if (retval != ERROR_OK)
765 LOG_ERROR("error executing kinetis wdog unlock algorithm");
766
767 retval = target_read_u16(target, WDOG_STCTRH, &wdog);
768 if (retval != ERROR_OK)
769 return retval;
770 LOG_INFO("WDOG_STCTRLH = 0x%x", wdog);
771
772 target_free_working_area(target, wdog_algorithm);
773
774 return retval;
775 }
776
777 COMMAND_HANDLER(kinetis_disable_wdog_handler)
778 {
779 int result;
780 uint32_t sim_sdid;
781 struct target *target = get_current_target(CMD_CTX);
782
783 if (CMD_ARGC > 0)
784 return ERROR_COMMAND_SYNTAX_ERROR;
785
786 result = target_read_u32(target, SIM_SDID, &sim_sdid);
787 if (result != ERROR_OK) {
788 LOG_ERROR("Failed to read SIMSDID");
789 return result;
790 }
791
792 result = kinetis_disable_wdog(target, sim_sdid);
793 return result;
794 }
795
796
797 static int kinetis_ftfx_decode_error(uint8_t fstat)
798 {
799 if (fstat & 0x20) {
800 LOG_ERROR("Flash operation failed, illegal command");
801 return ERROR_FLASH_OPER_UNSUPPORTED;
802
803 } else if (fstat & 0x10)
804 LOG_ERROR("Flash operation failed, protection violated");
805
806 else if (fstat & 0x40)
807 LOG_ERROR("Flash operation failed, read collision");
808
809 else if (fstat & 0x80)
810 return ERROR_OK;
811
812 else
813 LOG_ERROR("Flash operation timed out");
814
815 return ERROR_FLASH_OPERATION_FAILED;
816 }
817
818
819 static int kinetis_ftfx_prepare(struct target *target)
820 {
821 int result, i;
822 uint8_t fstat;
823
824 /* wait until busy */
825 for (i = 0; i < 50; i++) {
826 result = target_read_u8(target, FTFx_FSTAT, &fstat);
827 if (result != ERROR_OK)
828 return result;
829
830 if (fstat & 0x80)
831 break;
832 }
833
834 if ((fstat & 0x80) == 0) {
835 LOG_ERROR("Flash controller is busy");
836 return ERROR_FLASH_OPERATION_FAILED;
837 }
838 if (fstat != 0x80) {
839 /* reset error flags */
840 result = target_write_u8(target, FTFx_FSTAT, 0x70);
841 }
842 return result;
843 }
844
845 /* Kinetis Program-LongWord Microcodes */
846 static const uint8_t kinetis_flash_write_code[] = {
847 /* Params:
848 * r0 - workarea buffer
849 * r1 - target address
850 * r2 - wordcount
851 * Clobbered:
852 * r4 - tmp
853 * r5 - tmp
854 * r6 - tmp
855 * r7 - tmp
856 */
857
858 /* .L1: */
859 /* for(register uint32_t i=0;i<wcount;i++){ */
860 0x04, 0x1C, /* mov r4, r0 */
861 0x00, 0x23, /* mov r3, #0 */
862 /* .L2: */
863 0x0E, 0x1A, /* sub r6, r1, r0 */
864 0xA6, 0x19, /* add r6, r4, r6 */
865 0x93, 0x42, /* cmp r3, r2 */
866 0x16, 0xD0, /* beq .L9 */
867 /* .L5: */
868 /* while((FTFx_FSTAT&FTFA_FSTAT_CCIF_MASK) != FTFA_FSTAT_CCIF_MASK){}; */
869 0x0B, 0x4D, /* ldr r5, .L10 */
870 0x2F, 0x78, /* ldrb r7, [r5] */
871 0x7F, 0xB2, /* sxtb r7, r7 */
872 0x00, 0x2F, /* cmp r7, #0 */
873 0xFA, 0xDA, /* bge .L5 */
874 /* FTFx_FSTAT = FTFA_FSTAT_ACCERR_MASK|FTFA_FSTAT_FPVIOL_MASK|FTFA_FSTAT_RDCO */
875 0x70, 0x27, /* mov r7, #112 */
876 0x2F, 0x70, /* strb r7, [r5] */
877 /* FTFx_FCCOB3 = faddr; */
878 0x09, 0x4F, /* ldr r7, .L10+4 */
879 0x3E, 0x60, /* str r6, [r7] */
880 0x06, 0x27, /* mov r7, #6 */
881 /* FTFx_FCCOB0 = 0x06; */
882 0x08, 0x4E, /* ldr r6, .L10+8 */
883 0x37, 0x70, /* strb r7, [r6] */
884 /* FTFx_FCCOB7 = *pLW; */
885 0x80, 0xCC, /* ldmia r4!, {r7} */
886 0x08, 0x4E, /* ldr r6, .L10+12 */
887 0x37, 0x60, /* str r7, [r6] */
888 /* FTFx_FSTAT = FTFA_FSTAT_CCIF_MASK; */
889 0x80, 0x27, /* mov r7, #128 */
890 0x2F, 0x70, /* strb r7, [r5] */
891 /* .L4: */
892 /* while((FTFx_FSTAT&FTFA_FSTAT_CCIF_MASK) != FTFA_FSTAT_CCIF_MASK){}; */
893 0x2E, 0x78, /* ldrb r6, [r5] */
894 0x77, 0xB2, /* sxtb r7, r6 */
895 0x00, 0x2F, /* cmp r7, #0 */
896 0xFB, 0xDA, /* bge .L4 */
897 0x01, 0x33, /* add r3, r3, #1 */
898 0xE4, 0xE7, /* b .L2 */
899 /* .L9: */
900 0x00, 0xBE, /* bkpt #0 */
901 /* .L10: */
902 0x00, 0x00, 0x02, 0x40, /* .word 1073872896 */
903 0x04, 0x00, 0x02, 0x40, /* .word 1073872900 */
904 0x07, 0x00, 0x02, 0x40, /* .word 1073872903 */
905 0x08, 0x00, 0x02, 0x40, /* .word 1073872904 */
906 };
907
908 /* Program LongWord Block Write */
909 static int kinetis_write_block(struct flash_bank *bank, const uint8_t *buffer,
910 uint32_t offset, uint32_t wcount)
911 {
912 struct target *target = bank->target;
913 uint32_t buffer_size = 2048; /* Default minimum value */
914 struct working_area *write_algorithm;
915 struct working_area *source;
916 struct kinetis_flash_bank *kinfo = bank->driver_priv;
917 uint32_t address = kinfo->prog_base + offset;
918 struct reg_param reg_params[3];
919 struct armv7m_algorithm armv7m_info;
920 int retval = ERROR_OK;
921
922 /* Params:
923 * r0 - workarea buffer
924 * r1 - target address
925 * r2 - wordcount
926 * Clobbered:
927 * r4 - tmp
928 * r5 - tmp
929 * r6 - tmp
930 * r7 - tmp
931 */
932
933 /* Increase buffer_size if needed */
934 if (buffer_size < (target->working_area_size/2))
935 buffer_size = (target->working_area_size/2);
936
937 /* allocate working area with flash programming code */
938 if (target_alloc_working_area(target, sizeof(kinetis_flash_write_code),
939 &write_algorithm) != ERROR_OK) {
940 LOG_WARNING("no working area available, can't do block memory writes");
941 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
942 }
943
944 retval = target_write_buffer(target, write_algorithm->address,
945 sizeof(kinetis_flash_write_code), kinetis_flash_write_code);
946 if (retval != ERROR_OK)
947 return retval;
948
949 /* memory buffer */
950 while (target_alloc_working_area(target, buffer_size, &source) != ERROR_OK) {
951 buffer_size /= 4;
952 if (buffer_size <= 256) {
953 /* free working area, write algorithm already allocated */
954 target_free_working_area(target, write_algorithm);
955
956 LOG_WARNING("No large enough working area available, can't do block memory writes");
957 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
958 }
959 }
960
961 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
962 armv7m_info.core_mode = ARM_MODE_THREAD;
963
964 init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT); /* *pLW (*buffer) */
965 init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT); /* faddr */
966 init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT); /* number of words to program */
967
968 /* write code buffer and use Flash programming code within kinetis */
969 /* Set breakpoint to 0 with time-out of 1000 ms */
970 while (wcount > 0) {
971 uint32_t thisrun_count = (wcount > (buffer_size / 4)) ? (buffer_size / 4) : wcount;
972
973 retval = target_write_buffer(target, source->address, thisrun_count * 4, buffer);
974 if (retval != ERROR_OK)
975 break;
976
977 buf_set_u32(reg_params[0].value, 0, 32, source->address);
978 buf_set_u32(reg_params[1].value, 0, 32, address);
979 buf_set_u32(reg_params[2].value, 0, 32, thisrun_count);
980
981 retval = target_run_algorithm(target, 0, NULL, 3, reg_params,
982 write_algorithm->address, 0, 100000, &armv7m_info);
983 if (retval != ERROR_OK) {
984 LOG_ERROR("Error executing kinetis Flash programming algorithm");
985 retval = ERROR_FLASH_OPERATION_FAILED;
986 break;
987 }
988
989 buffer += thisrun_count * 4;
990 address += thisrun_count * 4;
991 wcount -= thisrun_count;
992 }
993
994 target_free_working_area(target, source);
995 target_free_working_area(target, write_algorithm);
996
997 destroy_reg_param(&reg_params[0]);
998 destroy_reg_param(&reg_params[1]);
999 destroy_reg_param(&reg_params[2]);
1000
1001 return retval;
1002 }
1003
1004 static int kinetis_protect(struct flash_bank *bank, int set, int first, int last)
1005 {
1006 LOG_WARNING("kinetis_protect not supported yet");
1007 /* FIXME: TODO */
1008
1009 if (bank->target->state != TARGET_HALTED) {
1010 LOG_ERROR("Target not halted");
1011 return ERROR_TARGET_NOT_HALTED;
1012 }
1013
1014 return ERROR_FLASH_BANK_INVALID;
1015 }
1016
1017 static int kinetis_protect_check(struct flash_bank *bank)
1018 {
1019 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1020 int result;
1021 int i, b;
1022 uint32_t fprot, psec;
1023
1024 if (bank->target->state != TARGET_HALTED) {
1025 LOG_ERROR("Target not halted");
1026 return ERROR_TARGET_NOT_HALTED;
1027 }
1028
1029 if (kinfo->flash_class == FC_PFLASH) {
1030
1031 /* read protection register */
1032 result = target_read_u32(bank->target, FTFx_FPROT3, &fprot);
1033 if (result != ERROR_OK)
1034 return result;
1035
1036 /* Every bit protects 1/32 of the full flash (not necessarily just this bank) */
1037
1038 } else if (kinfo->flash_class == FC_FLEX_NVM) {
1039 uint8_t fdprot;
1040
1041 /* read protection register */
1042 result = target_read_u8(bank->target, FTFx_FDPROT, &fdprot);
1043 if (result != ERROR_OK)
1044 return result;
1045
1046 fprot = fdprot;
1047
1048 } else {
1049 LOG_ERROR("Protection checks for FlexRAM not supported");
1050 return ERROR_FLASH_BANK_INVALID;
1051 }
1052
1053 b = kinfo->protection_block;
1054 for (psec = 0, i = 0; i < bank->num_sectors; i++) {
1055 if ((fprot >> b) & 1)
1056 bank->sectors[i].is_protected = 0;
1057 else
1058 bank->sectors[i].is_protected = 1;
1059
1060 psec += bank->sectors[i].size;
1061
1062 if (psec >= kinfo->protection_size) {
1063 psec = 0;
1064 b++;
1065 }
1066 }
1067
1068 return ERROR_OK;
1069 }
1070
1071 static int kinetis_ftfx_command(struct target *target, uint8_t fcmd, uint32_t faddr,
1072 uint8_t fccob4, uint8_t fccob5, uint8_t fccob6, uint8_t fccob7,
1073 uint8_t fccob8, uint8_t fccob9, uint8_t fccoba, uint8_t fccobb,
1074 uint8_t *ftfx_fstat)
1075 {
1076 uint8_t command[12] = {faddr & 0xff, (faddr >> 8) & 0xff, (faddr >> 16) & 0xff, fcmd,
1077 fccob7, fccob6, fccob5, fccob4,
1078 fccobb, fccoba, fccob9, fccob8};
1079 int result;
1080 uint8_t fstat;
1081 int64_t ms_timeout = timeval_ms() + 250;
1082
1083 result = target_write_memory(target, FTFx_FCCOB3, 4, 3, command);
1084 if (result != ERROR_OK)
1085 return result;
1086
1087 /* start command */
1088 result = target_write_u8(target, FTFx_FSTAT, 0x80);
1089 if (result != ERROR_OK)
1090 return result;
1091
1092 /* wait for done */
1093 do {
1094 result = target_read_u8(target, FTFx_FSTAT, &fstat);
1095
1096 if (result != ERROR_OK)
1097 return result;
1098
1099 if (fstat & 0x80)
1100 break;
1101
1102 } while (timeval_ms() < ms_timeout);
1103
1104 if (ftfx_fstat)
1105 *ftfx_fstat = fstat;
1106
1107 if ((fstat & 0xf0) != 0x80) {
1108 LOG_DEBUG("ftfx command failed FSTAT: %02X FCCOB: %02X%02X%02X%02X %02X%02X%02X%02X %02X%02X%02X%02X",
1109 fstat, command[3], command[2], command[1], command[0],
1110 command[7], command[6], command[5], command[4],
1111 command[11], command[10], command[9], command[8]);
1112
1113 return kinetis_ftfx_decode_error(fstat);
1114 }
1115
1116 return ERROR_OK;
1117 }
1118
1119
1120 static int kinetis_check_run_mode(struct target *target)
1121 {
1122 int result, i;
1123 uint8_t pmctrl, pmstat;
1124
1125 if (target->state != TARGET_HALTED) {
1126 LOG_ERROR("Target not halted");
1127 return ERROR_TARGET_NOT_HALTED;
1128 }
1129
1130 result = target_read_u8(target, SMC_PMSTAT, &pmstat);
1131 if (result != ERROR_OK)
1132 return result;
1133
1134 if (pmstat == PM_STAT_RUN)
1135 return ERROR_OK;
1136
1137 if (pmstat == PM_STAT_VLPR) {
1138 /* It is safe to switch from VLPR to RUN mode without changing clock */
1139 LOG_INFO("Switching from VLPR to RUN mode.");
1140 pmctrl = PM_CTRL_RUNM_RUN;
1141 result = target_write_u8(target, SMC_PMCTRL, pmctrl);
1142 if (result != ERROR_OK)
1143 return result;
1144
1145 for (i = 100; i; i--) {
1146 result = target_read_u8(target, SMC_PMSTAT, &pmstat);
1147 if (result != ERROR_OK)
1148 return result;
1149
1150 if (pmstat == PM_STAT_RUN)
1151 return ERROR_OK;
1152 }
1153 }
1154
1155 LOG_ERROR("Flash operation not possible in current run mode: SMC_PMSTAT: 0x%x", pmstat);
1156 LOG_ERROR("Issue a 'reset init' command.");
1157 return ERROR_TARGET_NOT_HALTED;
1158 }
1159
1160
1161 static void kinetis_invalidate_flash_cache(struct flash_bank *bank)
1162 {
1163 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1164 uint8_t pfb01cr_byte2 = 0xf0;
1165
1166 if (!(kinfo->flash_support & FS_INVALIDATE_CACHE))
1167 return;
1168
1169 target_write_memory(bank->target, FMC_PFB01CR + 2, 1, 1, &pfb01cr_byte2);
1170 return;
1171 }
1172
1173
1174 static int kinetis_erase(struct flash_bank *bank, int first, int last)
1175 {
1176 int result, i;
1177 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1178
1179 result = kinetis_check_run_mode(bank->target);
1180 if (result != ERROR_OK)
1181 return result;
1182
1183 /* reset error flags */
1184 result = kinetis_ftfx_prepare(bank->target);
1185 if (result != ERROR_OK)
1186 return result;
1187
1188 if ((first > bank->num_sectors) || (last > bank->num_sectors))
1189 return ERROR_FLASH_OPERATION_FAILED;
1190
1191 /*
1192 * FIXME: TODO: use the 'Erase Flash Block' command if the
1193 * requested erase is PFlash or NVM and encompasses the entire
1194 * block. Should be quicker.
1195 */
1196 for (i = first; i <= last; i++) {
1197 /* set command and sector address */
1198 result = kinetis_ftfx_command(bank->target, FTFx_CMD_SECTERASE, kinfo->prog_base + bank->sectors[i].offset,
1199 0, 0, 0, 0, 0, 0, 0, 0, NULL);
1200
1201 if (result != ERROR_OK) {
1202 LOG_WARNING("erase sector %d failed", i);
1203 return ERROR_FLASH_OPERATION_FAILED;
1204 }
1205
1206 bank->sectors[i].is_erased = 1;
1207 }
1208
1209 kinetis_invalidate_flash_cache(bank);
1210
1211 if (first == 0) {
1212 LOG_WARNING
1213 ("flash configuration field erased, please reset the device");
1214 }
1215
1216 return ERROR_OK;
1217 }
1218
1219 static int kinetis_make_ram_ready(struct target *target)
1220 {
1221 int result;
1222 uint8_t ftfx_fcnfg;
1223
1224 /* check if ram ready */
1225 result = target_read_u8(target, FTFx_FCNFG, &ftfx_fcnfg);
1226 if (result != ERROR_OK)
1227 return result;
1228
1229 if (ftfx_fcnfg & (1 << 1))
1230 return ERROR_OK; /* ram ready */
1231
1232 /* make flex ram available */
1233 result = kinetis_ftfx_command(target, FTFx_CMD_SETFLEXRAM, 0x00ff0000,
1234 0, 0, 0, 0, 0, 0, 0, 0, NULL);
1235 if (result != ERROR_OK)
1236 return ERROR_FLASH_OPERATION_FAILED;
1237
1238 /* check again */
1239 result = target_read_u8(target, FTFx_FCNFG, &ftfx_fcnfg);
1240 if (result != ERROR_OK)
1241 return result;
1242
1243 if (ftfx_fcnfg & (1 << 1))
1244 return ERROR_OK; /* ram ready */
1245
1246 return ERROR_FLASH_OPERATION_FAILED;
1247 }
1248
1249 static int kinetis_write(struct flash_bank *bank, const uint8_t *buffer,
1250 uint32_t offset, uint32_t count)
1251 {
1252 unsigned int i;
1253 int result, fallback = 0;
1254 uint32_t wc;
1255 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1256
1257 result = kinetis_check_run_mode(bank->target);
1258 if (result != ERROR_OK)
1259 return result;
1260
1261 /* reset error flags */
1262 result = kinetis_ftfx_prepare(bank->target);
1263 if (result != ERROR_OK)
1264 return result;
1265
1266 if (!(kinfo->flash_support & FS_PROGRAM_SECTOR)) {
1267 /* fallback to longword write */
1268 fallback = 1;
1269 LOG_WARNING("This device supports Program Longword execution only.");
1270 } else {
1271 result = kinetis_make_ram_ready(bank->target);
1272 if (result != ERROR_OK) {
1273 fallback = 1;
1274 LOG_WARNING("FlexRAM not ready, fallback to slow longword write.");
1275 }
1276 }
1277
1278 LOG_DEBUG("flash write @08%" PRIx32, bank->base + offset);
1279
1280
1281 /* program section command */
1282 if (fallback == 0) {
1283 /*
1284 * Kinetis uses different terms for the granularity of
1285 * sector writes, e.g. "phrase" or "128 bits". We use
1286 * the generic term "chunk". The largest possible
1287 * Kinetis "chunk" is 16 bytes (128 bits).
1288 */
1289 unsigned prog_section_chunk_bytes = kinfo->sector_size >> 8;
1290 unsigned prog_size_bytes = kinfo->max_flash_prog_size;
1291 for (i = 0; i < count; i += prog_size_bytes) {
1292 uint8_t residual_buffer[16];
1293 uint8_t ftfx_fstat;
1294 uint32_t section_count = prog_size_bytes / prog_section_chunk_bytes;
1295 uint32_t residual_wc = 0;
1296
1297 /*
1298 * Assume the word count covers an entire
1299 * sector.
1300 */
1301 wc = prog_size_bytes / 4;
1302
1303 /*
1304 * If bytes to be programmed are less than the
1305 * full sector, then determine the number of
1306 * full-words to program, and put together the
1307 * residual buffer so that a full "section"
1308 * may always be programmed.
1309 */
1310 if ((count - i) < prog_size_bytes) {
1311 /* number of bytes to program beyond full section */
1312 unsigned residual_bc = (count-i) % prog_section_chunk_bytes;
1313
1314 /* number of complete words to copy directly from buffer */
1315 wc = (count - i - residual_bc) / 4;
1316
1317 /* number of total sections to write, including residual */
1318 section_count = DIV_ROUND_UP((count-i), prog_section_chunk_bytes);
1319
1320 /* any residual bytes delivers a whole residual section */
1321 residual_wc = (residual_bc ? prog_section_chunk_bytes : 0)/4;
1322
1323 /* clear residual buffer then populate residual bytes */
1324 (void) memset(residual_buffer, 0xff, prog_section_chunk_bytes);
1325 (void) memcpy(residual_buffer, &buffer[i+4*wc], residual_bc);
1326 }
1327
1328 LOG_DEBUG("write section @ %08" PRIX32 " with length %" PRIu32 " bytes",
1329 offset + i, (uint32_t)wc*4);
1330
1331 /* write data to flexram as whole-words */
1332 result = target_write_memory(bank->target, FLEXRAM, 4, wc,
1333 buffer + i);
1334
1335 if (result != ERROR_OK) {
1336 LOG_ERROR("target_write_memory failed");
1337 return result;
1338 }
1339
1340 /* write the residual words to the flexram */
1341 if (residual_wc) {
1342 result = target_write_memory(bank->target,
1343 FLEXRAM+4*wc,
1344 4, residual_wc,
1345 residual_buffer);
1346
1347 if (result != ERROR_OK) {
1348 LOG_ERROR("target_write_memory failed");
1349 return result;
1350 }
1351 }
1352
1353 /* execute section-write command */
1354 result = kinetis_ftfx_command(bank->target, FTFx_CMD_SECTWRITE, kinfo->prog_base + offset + i,
1355 section_count>>8, section_count, 0, 0,
1356 0, 0, 0, 0, &ftfx_fstat);
1357
1358 if (result != ERROR_OK)
1359 return ERROR_FLASH_OPERATION_FAILED;
1360 }
1361 }
1362 else if (kinfo->flash_support & FS_PROGRAM_LONGWORD) {
1363 /* program longword command, not supported in FTFE */
1364 uint8_t *new_buffer = NULL;
1365
1366 /* check word alignment */
1367 if (offset & 0x3) {
1368 LOG_ERROR("offset 0x%" PRIx32 " breaks the required alignment", offset);
1369 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
1370 }
1371
1372 if (count & 0x3) {
1373 uint32_t old_count = count;
1374 count = (old_count | 3) + 1;
1375 new_buffer = malloc(count);
1376 if (new_buffer == NULL) {
1377 LOG_ERROR("odd number of bytes to write and no memory "
1378 "for padding buffer");
1379 return ERROR_FAIL;
1380 }
1381 LOG_INFO("odd number of bytes to write (%" PRIu32 "), extending to %" PRIu32 " "
1382 "and padding with 0xff", old_count, count);
1383 memset(new_buffer + old_count, 0xff, count - old_count);
1384 buffer = memcpy(new_buffer, buffer, old_count);
1385 }
1386
1387 uint32_t words_remaining = count / 4;
1388
1389 kinetis_disable_wdog(bank->target, kinfo->sim_sdid);
1390
1391 /* try using a block write */
1392 result = kinetis_write_block(bank, buffer, offset, words_remaining);
1393
1394 if (result == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
1395 /* if block write failed (no sufficient working area),
1396 * we use normal (slow) single word accesses */
1397 LOG_WARNING("couldn't use block writes, falling back to single "
1398 "memory accesses");
1399
1400 while (words_remaining) {
1401 uint8_t ftfx_fstat;
1402
1403 LOG_DEBUG("write longword @ %08" PRIx32, (uint32_t)(bank->base + offset));
1404
1405 result = kinetis_ftfx_command(bank->target, FTFx_CMD_LWORDPROG, kinfo->prog_base + offset,
1406 buffer[3], buffer[2], buffer[1], buffer[0],
1407 0, 0, 0, 0, &ftfx_fstat);
1408
1409 if (result != ERROR_OK) {
1410 LOG_ERROR("Error writing longword at %08" PRIx32, bank->base + offset);
1411 break;
1412 }
1413
1414 if (ftfx_fstat & 0x01)
1415 LOG_ERROR("Flash write error at %08" PRIx32, bank->base + offset);
1416
1417 buffer += 4;
1418 offset += 4;
1419 words_remaining--;
1420 }
1421 }
1422 free(new_buffer);
1423 } else {
1424 LOG_ERROR("Flash write strategy not implemented");
1425 return ERROR_FLASH_OPERATION_FAILED;
1426 }
1427
1428 kinetis_invalidate_flash_cache(bank);
1429 return result;
1430 }
1431
1432
1433 static int kinetis_probe(struct flash_bank *bank)
1434 {
1435 int result, i;
1436 uint32_t offset = 0;
1437 uint8_t fcfg1_nvmsize, fcfg1_pfsize, fcfg1_eesize, fcfg1_depart;
1438 uint8_t fcfg2_maxaddr0, fcfg2_pflsh, fcfg2_maxaddr1;
1439 uint32_t nvm_size = 0, pf_size = 0, df_size = 0, ee_size = 0;
1440 unsigned num_blocks = 0, num_pflash_blocks = 0, num_nvm_blocks = 0, first_nvm_bank = 0,
1441 pflash_sector_size_bytes = 0, nvm_sector_size_bytes = 0;
1442 struct target *target = bank->target;
1443 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1444
1445 kinfo->probed = false;
1446
1447 result = target_read_u32(target, SIM_SDID, &kinfo->sim_sdid);
1448 if (result != ERROR_OK)
1449 return result;
1450
1451 if ((kinfo->sim_sdid & (~KINETIS_SDID_K_SERIES_MASK)) == 0) {
1452 /* older K-series MCU */
1453 uint32_t mcu_type = kinfo->sim_sdid & KINETIS_K_SDID_TYPE_MASK;
1454
1455 switch (mcu_type) {
1456 case KINETIS_K_SDID_K10_M50:
1457 case KINETIS_K_SDID_K20_M50:
1458 /* 1kB sectors */
1459 pflash_sector_size_bytes = 1<<10;
1460 nvm_sector_size_bytes = 1<<10;
1461 num_blocks = 2;
1462 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
1463 break;
1464 case KINETIS_K_SDID_K10_M72:
1465 case KINETIS_K_SDID_K20_M72:
1466 case KINETIS_K_SDID_K30_M72:
1467 case KINETIS_K_SDID_K30_M100:
1468 case KINETIS_K_SDID_K40_M72:
1469 case KINETIS_K_SDID_K40_M100:
1470 case KINETIS_K_SDID_K50_M72:
1471 /* 2kB sectors, 1kB FlexNVM sectors */
1472 pflash_sector_size_bytes = 2<<10;
1473 nvm_sector_size_bytes = 1<<10;
1474 num_blocks = 2;
1475 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
1476 kinfo->max_flash_prog_size = 1<<10;
1477 break;
1478 case KINETIS_K_SDID_K10_M100:
1479 case KINETIS_K_SDID_K20_M100:
1480 case KINETIS_K_SDID_K11:
1481 case KINETIS_K_SDID_K12:
1482 case KINETIS_K_SDID_K21_M50:
1483 case KINETIS_K_SDID_K22_M50:
1484 case KINETIS_K_SDID_K51_M72:
1485 case KINETIS_K_SDID_K53:
1486 case KINETIS_K_SDID_K60_M100:
1487 /* 2kB sectors */
1488 pflash_sector_size_bytes = 2<<10;
1489 nvm_sector_size_bytes = 2<<10;
1490 num_blocks = 2;
1491 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
1492 break;
1493 case KINETIS_K_SDID_K21_M120:
1494 case KINETIS_K_SDID_K22_M120:
1495 /* 4kB sectors (MK21FN1M0, MK21FX512, MK22FN1M0, MK22FX512) */
1496 pflash_sector_size_bytes = 4<<10;
1497 kinfo->max_flash_prog_size = 1<<10;
1498 nvm_sector_size_bytes = 4<<10;
1499 num_blocks = 2;
1500 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
1501 break;
1502 case KINETIS_K_SDID_K10_M120:
1503 case KINETIS_K_SDID_K20_M120:
1504 case KINETIS_K_SDID_K60_M150:
1505 case KINETIS_K_SDID_K70_M150:
1506 /* 4kB sectors */
1507 pflash_sector_size_bytes = 4<<10;
1508 nvm_sector_size_bytes = 4<<10;
1509 num_blocks = 4;
1510 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
1511 break;
1512 default:
1513 LOG_ERROR("Unsupported K-family FAMID");
1514 }
1515 } else {
1516 /* Newer K-series or KL series MCU */
1517 switch (kinfo->sim_sdid & KINETIS_SDID_SERIESID_MASK) {
1518 case KINETIS_SDID_SERIESID_K:
1519 switch (kinfo->sim_sdid & (KINETIS_SDID_FAMILYID_MASK | KINETIS_SDID_SUBFAMID_MASK)) {
1520 case KINETIS_SDID_FAMILYID_K0X | KINETIS_SDID_SUBFAMID_KX2:
1521 /* K02FN64, K02FN128: FTFA, 2kB sectors */
1522 pflash_sector_size_bytes = 2<<10;
1523 num_blocks = 1;
1524 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_INVALIDATE_CACHE;
1525 break;
1526
1527 case KINETIS_SDID_FAMILYID_K2X | KINETIS_SDID_SUBFAMID_KX2: {
1528 /* MK24FN1M reports as K22, this should detect it (according to errata note 1N83J) */
1529 uint32_t sopt1;
1530 result = target_read_u32(target, SIM_SOPT1, &sopt1);
1531 if (result != ERROR_OK)
1532 return result;
1533
1534 if (((kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K24FN1M) &&
1535 ((sopt1 & KINETIS_SOPT1_RAMSIZE_MASK) == KINETIS_SOPT1_RAMSIZE_K24FN1M)) {
1536 /* MK24FN1M */
1537 pflash_sector_size_bytes = 4<<10;
1538 num_blocks = 2;
1539 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
1540 kinfo->max_flash_prog_size = 1<<10;
1541 break;
1542 }
1543 if ((kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K22FN128
1544 || (kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K22FN256
1545 || (kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K22FN512) {
1546 /* K22 with new-style SDID - smaller pflash with FTFA, 2kB sectors */
1547 pflash_sector_size_bytes = 2<<10;
1548 /* autodetect 1 or 2 blocks */
1549 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_INVALIDATE_CACHE;
1550 break;
1551 }
1552 LOG_ERROR("Unsupported Kinetis K22 DIEID");
1553 break;
1554 }
1555 case KINETIS_SDID_FAMILYID_K2X | KINETIS_SDID_SUBFAMID_KX4:
1556 pflash_sector_size_bytes = 4<<10;
1557 if ((kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K24FN256) {
1558 /* K24FN256 - smaller pflash with FTFA */
1559 num_blocks = 1;
1560 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_INVALIDATE_CACHE;
1561 break;
1562 }
1563 /* K24FN1M without errata 7534 */
1564 num_blocks = 2;
1565 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
1566 kinfo->max_flash_prog_size = 1<<10;
1567 break;
1568
1569 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX3:
1570 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX1: /* errata 7534 - should be K63 */
1571 /* K63FN1M0 */
1572 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX4:
1573 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX2: /* errata 7534 - should be K64 */
1574 /* K64FN1M0, K64FX512 */
1575 pflash_sector_size_bytes = 4<<10;
1576 nvm_sector_size_bytes = 4<<10;
1577 kinfo->max_flash_prog_size = 1<<10;
1578 num_blocks = 2;
1579 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
1580 break;
1581
1582 case KINETIS_SDID_FAMILYID_K2X | KINETIS_SDID_SUBFAMID_KX6:
1583 /* K26FN2M0 */
1584 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX6:
1585 /* K66FN2M0, K66FX1M0 */
1586 pflash_sector_size_bytes = 4<<10;
1587 nvm_sector_size_bytes = 4<<10;
1588 kinfo->max_flash_prog_size = 1<<10;
1589 num_blocks = 4;
1590 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
1591 break;
1592 default:
1593 LOG_ERROR("Unsupported Kinetis FAMILYID SUBFAMID");
1594 }
1595 break;
1596
1597 case KINETIS_SDID_SERIESID_KL:
1598 /* KL-series */
1599 pflash_sector_size_bytes = 1<<10;
1600 nvm_sector_size_bytes = 1<<10;
1601 /* autodetect 1 or 2 blocks */
1602 kinfo->flash_support = FS_PROGRAM_LONGWORD;
1603 break;
1604
1605 case KINETIS_SDID_SERIESID_KV:
1606 /* KV-series */
1607 switch (kinfo->sim_sdid & (KINETIS_SDID_FAMILYID_MASK | KINETIS_SDID_SUBFAMID_MASK)) {
1608 case KINETIS_SDID_FAMILYID_K1X | KINETIS_SDID_SUBFAMID_KX0:
1609 /* KV10: FTFA, 1kB sectors */
1610 pflash_sector_size_bytes = 1<<10;
1611 num_blocks = 1;
1612 kinfo->flash_support = FS_PROGRAM_LONGWORD;
1613 break;
1614
1615 case KINETIS_SDID_FAMILYID_K1X | KINETIS_SDID_SUBFAMID_KX1:
1616 /* KV11: FTFA, 2kB sectors */
1617 pflash_sector_size_bytes = 2<<10;
1618 num_blocks = 1;
1619 kinfo->flash_support = FS_PROGRAM_LONGWORD;
1620 break;
1621
1622 case KINETIS_SDID_FAMILYID_K3X | KINETIS_SDID_SUBFAMID_KX0:
1623 /* KV30: FTFA, 2kB sectors, 1 block */
1624 case KINETIS_SDID_FAMILYID_K3X | KINETIS_SDID_SUBFAMID_KX1:
1625 /* KV31: FTFA, 2kB sectors, 2 blocks */
1626 pflash_sector_size_bytes = 2<<10;
1627 /* autodetect 1 or 2 blocks */
1628 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_INVALIDATE_CACHE;
1629 break;
1630
1631 case KINETIS_SDID_FAMILYID_K4X | KINETIS_SDID_SUBFAMID_KX2:
1632 case KINETIS_SDID_FAMILYID_K4X | KINETIS_SDID_SUBFAMID_KX4:
1633 case KINETIS_SDID_FAMILYID_K4X | KINETIS_SDID_SUBFAMID_KX6:
1634 /* KV4x: FTFA, 4kB sectors */
1635 pflash_sector_size_bytes = 4<<10;
1636 num_blocks = 1;
1637 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_INVALIDATE_CACHE;
1638 break;
1639
1640 default:
1641 LOG_ERROR("Unsupported KV FAMILYID SUBFAMID");
1642 }
1643 break;
1644
1645 default:
1646 LOG_ERROR("Unsupported K-series");
1647 }
1648 }
1649
1650 if (pflash_sector_size_bytes == 0) {
1651 LOG_ERROR("MCU is unsupported, SDID 0x%08" PRIx32, kinfo->sim_sdid);
1652 return ERROR_FLASH_OPER_UNSUPPORTED;
1653 }
1654
1655 result = target_read_u32(target, SIM_FCFG1, &kinfo->sim_fcfg1);
1656 if (result != ERROR_OK)
1657 return result;
1658
1659 result = target_read_u32(target, SIM_FCFG2, &kinfo->sim_fcfg2);
1660 if (result != ERROR_OK)
1661 return result;
1662
1663 LOG_DEBUG("SDID: 0x%08" PRIX32 " FCFG1: 0x%08" PRIX32 " FCFG2: 0x%08" PRIX32, kinfo->sim_sdid,
1664 kinfo->sim_fcfg1, kinfo->sim_fcfg2);
1665
1666 fcfg1_nvmsize = (uint8_t)((kinfo->sim_fcfg1 >> 28) & 0x0f);
1667 fcfg1_pfsize = (uint8_t)((kinfo->sim_fcfg1 >> 24) & 0x0f);
1668 fcfg1_eesize = (uint8_t)((kinfo->sim_fcfg1 >> 16) & 0x0f);
1669 fcfg1_depart = (uint8_t)((kinfo->sim_fcfg1 >> 8) & 0x0f);
1670
1671 fcfg2_pflsh = (uint8_t)((kinfo->sim_fcfg2 >> 23) & 0x01);
1672 fcfg2_maxaddr0 = (uint8_t)((kinfo->sim_fcfg2 >> 24) & 0x7f);
1673 fcfg2_maxaddr1 = (uint8_t)((kinfo->sim_fcfg2 >> 16) & 0x7f);
1674
1675 if (num_blocks == 0)
1676 num_blocks = fcfg2_maxaddr1 ? 2 : 1;
1677 else if (fcfg2_maxaddr1 == 0 && num_blocks >= 2) {
1678 num_blocks = 1;
1679 LOG_WARNING("MAXADDR1 is zero, number of flash banks adjusted to 1");
1680 } else if (fcfg2_maxaddr1 != 0 && num_blocks == 1) {
1681 num_blocks = 2;
1682 LOG_WARNING("MAXADDR1 is non zero, number of flash banks adjusted to 2");
1683 }
1684
1685 /* when the PFLSH bit is set, there is no FlexNVM/FlexRAM */
1686 if (!fcfg2_pflsh) {
1687 switch (fcfg1_nvmsize) {
1688 case 0x03:
1689 case 0x05:
1690 case 0x07:
1691 case 0x09:
1692 case 0x0b:
1693 nvm_size = 1 << (14 + (fcfg1_nvmsize >> 1));
1694 break;
1695 case 0x0f:
1696 if (pflash_sector_size_bytes >= 4<<10)
1697 nvm_size = 512<<10;
1698 else
1699 /* K20_100 */
1700 nvm_size = 256<<10;
1701 break;
1702 default:
1703 nvm_size = 0;
1704 break;
1705 }
1706
1707 switch (fcfg1_eesize) {
1708 case 0x00:
1709 case 0x01:
1710 case 0x02:
1711 case 0x03:
1712 case 0x04:
1713 case 0x05:
1714 case 0x06:
1715 case 0x07:
1716 case 0x08:
1717 case 0x09:
1718 ee_size = (16 << (10 - fcfg1_eesize));
1719 break;
1720 default:
1721 ee_size = 0;
1722 break;
1723 }
1724
1725 switch (fcfg1_depart) {
1726 case 0x01:
1727 case 0x02:
1728 case 0x03:
1729 case 0x04:
1730 case 0x05:
1731 case 0x06:
1732 df_size = nvm_size - (4096 << fcfg1_depart);
1733 break;
1734 case 0x08:
1735 df_size = 0;
1736 break;
1737 case 0x09:
1738 case 0x0a:
1739 case 0x0b:
1740 case 0x0c:
1741 case 0x0d:
1742 df_size = 4096 << (fcfg1_depart & 0x7);
1743 break;
1744 default:
1745 df_size = nvm_size;
1746 break;
1747 }
1748 }
1749
1750 switch (fcfg1_pfsize) {
1751 case 0x03:
1752 case 0x05:
1753 case 0x07:
1754 case 0x09:
1755 case 0x0b:
1756 case 0x0d:
1757 pf_size = 1 << (14 + (fcfg1_pfsize >> 1));
1758 break;
1759 case 0x0f:
1760 /* a peculiar case: Freescale states different sizes for 0xf
1761 * K02P64M100SFARM 128 KB ... duplicate of code 0x7
1762 * K22P121M120SF8RM 256 KB ... duplicate of code 0x9
1763 * K22P121M120SF7RM 512 KB ... duplicate of code 0xb
1764 * K22P100M120SF5RM 1024 KB ... duplicate of code 0xd
1765 * K26P169M180SF5RM 2048 KB ... the only unique value
1766 * fcfg2_maxaddr0 seems to be the only clue to pf_size
1767 * Checking fcfg2_maxaddr0 later in this routine is pointless then
1768 */
1769 if (fcfg2_pflsh)
1770 pf_size = ((uint32_t)fcfg2_maxaddr0 << 13) * num_blocks;
1771 else
1772 pf_size = ((uint32_t)fcfg2_maxaddr0 << 13) * num_blocks / 2;
1773 if (pf_size != 2048<<10)
1774 LOG_WARNING("SIM_FCFG1 PFSIZE = 0xf: please check if pflash is %u KB", pf_size>>10);
1775
1776 break;
1777 default:
1778 pf_size = 0;
1779 break;
1780 }
1781
1782 LOG_DEBUG("FlexNVM: %" PRIu32 " PFlash: %" PRIu32 " FlexRAM: %" PRIu32 " PFLSH: %d",
1783 nvm_size, pf_size, ee_size, fcfg2_pflsh);
1784
1785 num_pflash_blocks = num_blocks / (2 - fcfg2_pflsh);
1786 first_nvm_bank = num_pflash_blocks;
1787 num_nvm_blocks = num_blocks - num_pflash_blocks;
1788
1789 LOG_DEBUG("%d blocks total: %d PFlash, %d FlexNVM",
1790 num_blocks, num_pflash_blocks, num_nvm_blocks);
1791
1792 LOG_INFO("Probing flash info for bank %d", bank->bank_number);
1793
1794 if ((unsigned)bank->bank_number < num_pflash_blocks) {
1795 /* pflash, banks start at address zero */
1796 kinfo->flash_class = FC_PFLASH;
1797 bank->size = (pf_size / num_pflash_blocks);
1798 bank->base = 0x00000000 + bank->size * bank->bank_number;
1799 kinfo->prog_base = bank->base;
1800 kinfo->sector_size = pflash_sector_size_bytes;
1801 /* pflash is divided into 32 protection areas for
1802 * parts with more than 32K of PFlash. For parts with
1803 * less the protection unit is set to 1024 bytes */
1804 kinfo->protection_size = MAX(pf_size / 32, 1024);
1805 kinfo->protection_block = (32 / num_pflash_blocks) * bank->bank_number;
1806
1807 } else if ((unsigned)bank->bank_number < num_blocks) {
1808 /* nvm, banks start at address 0x10000000 */
1809 unsigned nvm_ord = bank->bank_number - first_nvm_bank;
1810 uint32_t limit;
1811
1812 kinfo->flash_class = FC_FLEX_NVM;
1813 bank->size = (nvm_size / num_nvm_blocks);
1814 bank->base = 0x10000000 + bank->size * nvm_ord;
1815 kinfo->prog_base = 0x00800000 + bank->size * nvm_ord;
1816 kinfo->sector_size = nvm_sector_size_bytes;
1817 if (df_size == 0) {
1818 kinfo->protection_size = 0;
1819 } else {
1820 for (i = df_size; ~i & 1; i >>= 1)
1821 ;
1822 if (i == 1)
1823 kinfo->protection_size = df_size / 8; /* data flash size = 2^^n */
1824 else
1825 kinfo->protection_size = nvm_size / 8; /* TODO: verify on SF1, not documented in RM */
1826 }
1827 kinfo->protection_block = (8 / num_nvm_blocks) * nvm_ord;
1828
1829 /* EEPROM backup part of FlexNVM is not accessible, use df_size as a limit */
1830 if (df_size > bank->size * nvm_ord)
1831 limit = df_size - bank->size * nvm_ord;
1832 else
1833 limit = 0;
1834
1835 if (bank->size > limit) {
1836 bank->size = limit;
1837 LOG_DEBUG("FlexNVM bank %d limited to 0x%08" PRIx32 " due to active EEPROM backup",
1838 bank->bank_number, limit);
1839 }
1840
1841 } else if ((unsigned)bank->bank_number == num_blocks) {
1842 LOG_ERROR("FlexRAM support not yet implemented");
1843 return ERROR_FLASH_OPER_UNSUPPORTED;
1844 } else {
1845 LOG_ERROR("Cannot determine parameters for bank %d, only %d banks on device",
1846 bank->bank_number, num_blocks);
1847 return ERROR_FLASH_BANK_INVALID;
1848 }
1849
1850 if (bank->bank_number == 0 && ((uint32_t)fcfg2_maxaddr0 << 13) != bank->size)
1851 LOG_WARNING("MAXADDR0 0x%02" PRIx8 " check failed,"
1852 " please report to OpenOCD mailing list", fcfg2_maxaddr0);
1853 if (fcfg2_pflsh) {
1854 if (bank->bank_number == 1 && ((uint32_t)fcfg2_maxaddr1 << 13) != bank->size)
1855 LOG_WARNING("MAXADDR1 0x%02" PRIx8 " check failed,"
1856 " please report to OpenOCD mailing list", fcfg2_maxaddr1);
1857 } else {
1858 if ((unsigned)bank->bank_number == first_nvm_bank
1859 && ((uint32_t)fcfg2_maxaddr1 << 13) != df_size)
1860 LOG_WARNING("FlexNVM MAXADDR1 0x%02" PRIx8 " check failed,"
1861 " please report to OpenOCD mailing list", fcfg2_maxaddr1);
1862 }
1863
1864 if (bank->sectors) {
1865 free(bank->sectors);
1866 bank->sectors = NULL;
1867 }
1868
1869 if (kinfo->sector_size == 0) {
1870 LOG_ERROR("Unknown sector size for bank %d", bank->bank_number);
1871 return ERROR_FLASH_BANK_INVALID;
1872 }
1873
1874 if (kinfo->flash_support & FS_PROGRAM_SECTOR
1875 && kinfo->max_flash_prog_size == 0) {
1876 kinfo->max_flash_prog_size = kinfo->sector_size;
1877 /* Program section size is equal to sector size by default */
1878 }
1879
1880 bank->num_sectors = bank->size / kinfo->sector_size;
1881
1882 if (bank->num_sectors > 0) {
1883 /* FlexNVM bank can be used for EEPROM backup therefore zero sized */
1884 bank->sectors = malloc(sizeof(struct flash_sector) * bank->num_sectors);
1885
1886 for (i = 0; i < bank->num_sectors; i++) {
1887 bank->sectors[i].offset = offset;
1888 bank->sectors[i].size = kinfo->sector_size;
1889 offset += kinfo->sector_size;
1890 bank->sectors[i].is_erased = -1;
1891 bank->sectors[i].is_protected = 1;
1892 }
1893 }
1894
1895 kinfo->probed = true;
1896
1897 return ERROR_OK;
1898 }
1899
1900 static int kinetis_auto_probe(struct flash_bank *bank)
1901 {
1902 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1903
1904 if (kinfo && kinfo->probed)
1905 return ERROR_OK;
1906
1907 return kinetis_probe(bank);
1908 }
1909
1910 static int kinetis_info(struct flash_bank *bank, char *buf, int buf_size)
1911 {
1912 const char *bank_class_names[] = {
1913 "(ANY)", "PFlash", "FlexNVM", "FlexRAM"
1914 };
1915
1916 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1917
1918 (void) snprintf(buf, buf_size,
1919 "%s driver for %s flash bank %s at 0x%8.8" PRIx32 "",
1920 bank->driver->name, bank_class_names[kinfo->flash_class],
1921 bank->name, bank->base);
1922
1923 return ERROR_OK;
1924 }
1925
1926 static int kinetis_blank_check(struct flash_bank *bank)
1927 {
1928 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1929 int result;
1930
1931 /* suprisingly blank check does not work in VLPR and HSRUN modes */
1932 result = kinetis_check_run_mode(bank->target);
1933 if (result != ERROR_OK)
1934 return result;
1935
1936 /* reset error flags */
1937 result = kinetis_ftfx_prepare(bank->target);
1938 if (result != ERROR_OK)
1939 return result;
1940
1941 if (kinfo->flash_class == FC_PFLASH || kinfo->flash_class == FC_FLEX_NVM) {
1942 bool block_dirty = false;
1943 uint8_t ftfx_fstat;
1944
1945 if (kinfo->flash_class == FC_FLEX_NVM) {
1946 uint8_t fcfg1_depart = (uint8_t)((kinfo->sim_fcfg1 >> 8) & 0x0f);
1947 /* block operation cannot be used on FlexNVM when EEPROM backup partition is set */
1948 if (fcfg1_depart != 0xf && fcfg1_depart != 0)
1949 block_dirty = true;
1950 }
1951
1952 if (!block_dirty) {
1953 /* check if whole bank is blank */
1954 result = kinetis_ftfx_command(bank->target, FTFx_CMD_BLOCKSTAT, kinfo->prog_base,
1955 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
1956
1957 if (result != ERROR_OK || (ftfx_fstat & 0x01))
1958 block_dirty = true;
1959 }
1960
1961 if (block_dirty) {
1962 /* the whole bank is not erased, check sector-by-sector */
1963 int i;
1964 for (i = 0; i < bank->num_sectors; i++) {
1965 /* normal margin */
1966 result = kinetis_ftfx_command(bank->target, FTFx_CMD_SECTSTAT,
1967 kinfo->prog_base + bank->sectors[i].offset,
1968 1, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
1969
1970 if (result == ERROR_OK) {
1971 bank->sectors[i].is_erased = !(ftfx_fstat & 0x01);
1972 } else {
1973 LOG_DEBUG("Ignoring errored PFlash sector blank-check");
1974 bank->sectors[i].is_erased = -1;
1975 }
1976 }
1977 } else {
1978 /* the whole bank is erased, update all sectors */
1979 int i;
1980 for (i = 0; i < bank->num_sectors; i++)
1981 bank->sectors[i].is_erased = 1;
1982 }
1983 } else {
1984 LOG_WARNING("kinetis_blank_check not supported yet for FlexRAM");
1985 return ERROR_FLASH_OPERATION_FAILED;
1986 }
1987
1988 return ERROR_OK;
1989 }
1990
1991
1992 COMMAND_HANDLER(kinetis_nvm_partition)
1993 {
1994 int result, i;
1995 unsigned long par, log2 = 0, ee1 = 0, ee2 = 0;
1996 enum { SHOW_INFO, DF_SIZE, EEBKP_SIZE } sz_type = SHOW_INFO;
1997 bool enable;
1998 uint8_t load_flex_ram = 1;
1999 uint8_t ee_size_code = 0x3f;
2000 uint8_t flex_nvm_partition_code = 0;
2001 uint8_t ee_split = 3;
2002 struct target *target = get_current_target(CMD_CTX);
2003 struct flash_bank *bank;
2004 struct kinetis_flash_bank *kinfo;
2005 uint32_t sim_fcfg1;
2006
2007 if (CMD_ARGC >= 2) {
2008 if (strcmp(CMD_ARGV[0], "dataflash") == 0)
2009 sz_type = DF_SIZE;
2010 else if (strcmp(CMD_ARGV[0], "eebkp") == 0)
2011 sz_type = EEBKP_SIZE;
2012
2013 par = strtoul(CMD_ARGV[1], NULL, 10);
2014 while (par >> (log2 + 3))
2015 log2++;
2016 }
2017 switch (sz_type) {
2018 case SHOW_INFO:
2019 result = target_read_u32(target, SIM_FCFG1, &sim_fcfg1);
2020 if (result != ERROR_OK)
2021 return result;
2022
2023 flex_nvm_partition_code = (uint8_t)((sim_fcfg1 >> 8) & 0x0f);
2024 switch (flex_nvm_partition_code) {
2025 case 0:
2026 command_print(CMD_CTX, "No EEPROM backup, data flash only");
2027 break;
2028 case 1:
2029 case 2:
2030 case 3:
2031 case 4:
2032 case 5:
2033 case 6:
2034 command_print(CMD_CTX, "EEPROM backup %d KB", 4 << flex_nvm_partition_code);
2035 break;
2036 case 8:
2037 command_print(CMD_CTX, "No data flash, EEPROM backup only");
2038 break;
2039 case 0x9:
2040 case 0xA:
2041 case 0xB:
2042 case 0xC:
2043 case 0xD:
2044 case 0xE:
2045 command_print(CMD_CTX, "data flash %d KB", 4 << (flex_nvm_partition_code & 7));
2046 break;
2047 case 0xf:
2048 command_print(CMD_CTX, "No EEPROM backup, data flash only (DEPART not set)");
2049 break;
2050 default:
2051 command_print(CMD_CTX, "Unsupported EEPROM backup size code 0x%02" PRIx8, flex_nvm_partition_code);
2052 }
2053 return ERROR_OK;
2054
2055 case DF_SIZE:
2056 flex_nvm_partition_code = 0x8 | log2;
2057 break;
2058
2059 case EEBKP_SIZE:
2060 flex_nvm_partition_code = log2;
2061 break;
2062 }
2063
2064 if (CMD_ARGC == 3)
2065 ee1 = ee2 = strtoul(CMD_ARGV[2], NULL, 10) / 2;
2066 else if (CMD_ARGC >= 4) {
2067 ee1 = strtoul(CMD_ARGV[2], NULL, 10);
2068 ee2 = strtoul(CMD_ARGV[3], NULL, 10);
2069 }
2070
2071 enable = ee1 + ee2 > 0;
2072 if (enable) {
2073 for (log2 = 2; ; log2++) {
2074 if (ee1 + ee2 == (16u << 10) >> log2)
2075 break;
2076 if (ee1 + ee2 > (16u << 10) >> log2 || log2 >= 9) {
2077 LOG_ERROR("Unsupported EEPROM size");
2078 return ERROR_FLASH_OPERATION_FAILED;
2079 }
2080 }
2081
2082 if (ee1 * 3 == ee2)
2083 ee_split = 1;
2084 else if (ee1 * 7 == ee2)
2085 ee_split = 0;
2086 else if (ee1 != ee2) {
2087 LOG_ERROR("Unsupported EEPROM sizes ratio");
2088 return ERROR_FLASH_OPERATION_FAILED;
2089 }
2090
2091 ee_size_code = log2 | ee_split << 4;
2092 }
2093
2094 if (CMD_ARGC >= 5)
2095 COMMAND_PARSE_ON_OFF(CMD_ARGV[4], enable);
2096 if (enable)
2097 load_flex_ram = 0;
2098
2099 LOG_INFO("DEPART 0x%" PRIx8 ", EEPROM size code 0x%" PRIx8,
2100 flex_nvm_partition_code, ee_size_code);
2101
2102 result = kinetis_check_run_mode(target);
2103 if (result != ERROR_OK)
2104 return result;
2105
2106 /* reset error flags */
2107 result = kinetis_ftfx_prepare(target);
2108 if (result != ERROR_OK)
2109 return result;
2110
2111 result = kinetis_ftfx_command(target, FTFx_CMD_PGMPART, load_flex_ram,
2112 ee_size_code, flex_nvm_partition_code, 0, 0,
2113 0, 0, 0, 0, NULL);
2114 if (result != ERROR_OK)
2115 return result;
2116
2117 command_print(CMD_CTX, "FlexNVM partition set. Please reset MCU.");
2118
2119 for (i = 1; i < 4; i++) {
2120 bank = get_flash_bank_by_num_noprobe(i);
2121 if (bank == NULL)
2122 break;
2123
2124 kinfo = bank->driver_priv;
2125 if (kinfo && kinfo->flash_class == FC_FLEX_NVM)
2126 kinfo->probed = false; /* re-probe before next use */
2127 }
2128
2129 command_print(CMD_CTX, "FlexNVM banks will be re-probed to set new data flash size.");
2130 return ERROR_OK;
2131 }
2132
2133
2134 static const struct command_registration kinetis_security_command_handlers[] = {
2135 {
2136 .name = "check_security",
2137 .mode = COMMAND_EXEC,
2138 .help = "Check status of device security lock",
2139 .usage = "",
2140 .handler = kinetis_check_flash_security_status,
2141 },
2142 {
2143 .name = "halt",
2144 .mode = COMMAND_EXEC,
2145 .help = "Issue a halt via the MDM-AP",
2146 .usage = "",
2147 .handler = kinetis_mdm_halt,
2148 },
2149 {
2150 .name = "mass_erase",
2151 .mode = COMMAND_EXEC,
2152 .help = "Issue a complete flash erase via the MDM-AP",
2153 .usage = "",
2154 .handler = kinetis_mdm_mass_erase,
2155 },
2156 { .name = "reset",
2157 .mode = COMMAND_EXEC,
2158 .help = "Issue a reset via the MDM-AP",
2159 .usage = "",
2160 .handler = kinetis_mdm_reset,
2161 },
2162 COMMAND_REGISTRATION_DONE
2163 };
2164
2165 static const struct command_registration kinetis_exec_command_handlers[] = {
2166 {
2167 .name = "mdm",
2168 .mode = COMMAND_ANY,
2169 .help = "MDM-AP command group",
2170 .usage = "",
2171 .chain = kinetis_security_command_handlers,
2172 },
2173 {
2174 .name = "disable_wdog",
2175 .mode = COMMAND_EXEC,
2176 .help = "Disable the watchdog timer",
2177 .usage = "",
2178 .handler = kinetis_disable_wdog_handler,
2179 },
2180 {
2181 .name = "nvm_partition",
2182 .mode = COMMAND_EXEC,
2183 .help = "Show/set data flash or EEPROM backup size in kilobytes,"
2184 " set two EEPROM sizes in bytes and FlexRAM loading during reset",
2185 .usage = "('info'|'dataflash' size|'eebkp' size) [eesize1 eesize2] ['on'|'off']",
2186 .handler = kinetis_nvm_partition,
2187 },
2188 COMMAND_REGISTRATION_DONE
2189 };
2190
2191 static const struct command_registration kinetis_command_handler[] = {
2192 {
2193 .name = "kinetis",
2194 .mode = COMMAND_ANY,
2195 .help = "Kinetis flash controller commands",
2196 .usage = "",
2197 .chain = kinetis_exec_command_handlers,
2198 },
2199 COMMAND_REGISTRATION_DONE
2200 };
2201
2202
2203
2204 struct flash_driver kinetis_flash = {
2205 .name = "kinetis",
2206 .commands = kinetis_command_handler,
2207 .flash_bank_command = kinetis_flash_bank_command,
2208 .erase = kinetis_erase,
2209 .protect = kinetis_protect,
2210 .write = kinetis_write,
2211 .read = default_flash_read,
2212 .probe = kinetis_probe,
2213 .auto_probe = kinetis_auto_probe,
2214 .erase_check = kinetis_blank_check,
2215 .protect_check = kinetis_protect_check,
2216 .info = kinetis_info,
2217 };
Open On-Chip Debugger

Linking to existing account procedure

If you already have an account and want to add another login method you MUST first sign in with your existing account and then change URL to read https://review.openocd.org/login/?link to get to this page again but this time it'll work for linking. Thank you.

SSH host keys fingerprints

1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=..              |
|+o..   .         |
|*.o   . .        |
|+B . . .         |
|Bo. = o S        |
|Oo.+ + =         |
|oB=.* = . o      |
| =+=.+   + E     |
|. .=o   . o      |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)