1 /***************************************************************************
2 * Copyright (C) 2015 by Ivan Meleca *
5 * Modified from kinetis.c *
7 * Copyright (C) 2011 by Mathias Kuester *
10 * Copyright (C) 2011 sleep(5) ltd *
11 * tomas@sleepfive.com *
13 * Copyright (C) 2012 by Christopher D. Kilgour *
14 * techie at whiterocker.com *
16 * Copyright (C) 2013 Nemui Trinomius *
17 * nemuisan_kawausogasuki@live.jp *
19 * Copyright (C) 2015 Tomas Vanek *
22 * This program is free software; you can redistribute it and/or modify *
23 * it under the terms of the GNU General Public License as published by *
24 * the Free Software Foundation; either version 2 of the License, or *
25 * (at your option) any later version. *
27 * This program is distributed in the hope that it will be useful, *
28 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
29 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
30 * GNU General Public License for more details. *
32 * You should have received a copy of the GNU General Public License *
33 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
34 ***************************************************************************/
40 #include "jtag/interface.h"
42 #include <helper/binarybuffer.h>
43 #include <target/algorithm.h>
44 #include <target/arm_adi_v5.h>
45 #include <target/armv7m.h>
46 #include <target/cortex_m.h>
49 #define SIM_SRSID 0x40048000
50 #define ICS_C1 0x40064000
51 #define ICS_C2 0x40064001
52 #define ICS_C3 0x40064002
53 #define ICS_C4 0x40064003
54 #define ICS_S 0x40064004
55 #define SIM_BUSDIV 0x40048018
56 #define SIM_CLKDIV_KE06 0x40048024
57 #define SIM_CLKDIV_KE04_44_64_80 0x40048024
58 #define SIM_CLKDIV_KE04_16_20_24 0x4004801C
59 #define WDOG_CS1 0x40052000
61 #define ICS_C2_BDIV_MASK 0xE0
62 #define ICS_C2_BDIV_SHIFT 5
63 #define ICS_C2_BDIV(x) (((uint8_t)(((uint8_t)(x))<<ICS_C2_BDIV_SHIFT))&ICS_C2_BDIV_MASK)
64 #define ICS_S_LOCK_MASK 0x40
65 #define ICS_C4_SCFTRIM_MASK 0x1
66 #define SIM_CLKDIV_OUTDIV2_MASK 0x1000000
67 #define FTMRX_FCLKDIV_FDIV_MASK 0x3F
68 #define FTMRX_FCLKDIV_FDIV_SHIFT 0
69 #define FTMRX_FCLKDIV_FDIV(x) (((uint8_t)(((uint8_t)(x))<<FTMRX_FCLKDIV_FDIV_SHIFT))&FTMRX_FCLKDIV_FDIV_MASK)
70 #define FTMRX_FCLKDIV_FDIVLCK_MASK 0x40
71 #define FTMRX_FCLKDIV_FDIVLCK_SHIFT 6
72 #define FTMRX_FCLKDIV_FDIVLD_MASK 0x80
73 #define FTMRX_FCLKDIV_FDIVLD_SHIFT 7
74 #define FTMRX_FSTAT_CCIF_MASK 0x80
75 #define FTMRX_FSTAT_MGSTAT0_MASK 0x01
76 #define FTMRX_FSTAT_MGSTAT1_MASK 0x02
79 #define FTMRX_CMD_ALLERASED 0x01
80 #define FTMRX_CMD_BLOCKERASED 0x02
81 #define FTMRX_CMD_SECTIONERASED 0x03
82 #define FTMRX_CMD_READONCE 0x04
83 #define FTMRX_CMD_PROGFLASH 0x06
84 #define FTMRX_CMD_PROGONCE 0x07
85 #define FTMRX_CMD_ERASEALL 0x08
86 #define FTMRX_CMD_ERASEBLOCK 0x09
87 #define FTMRX_CMD_ERASESECTOR 0x0A
88 #define FTMRX_CMD_UNSECURE 0x0B
89 #define FTMRX_CMD_VERIFYACCESS 0x0C
90 #define FTMRX_CMD_SETMARGINLVL 0x0D
91 #define FTMRX_CMD_SETFACTORYLVL 0x0E
92 #define FTMRX_CMD_CONFIGNVM 0x0F
95 #define FTMRX_ERROR_ACCERR 0x20
96 #define FTMRX_ERROR_FPVIOL 0x10
98 #define KINETIS_KE_SRSID_FAMID(x) ((x >> 28) & 0x0F)
99 #define KINETIS_KE_SRSID_SUBFAMID(x) ((x >> 24) & 0x0F)
100 #define KINETIS_KE_SRSID_PINCOUNT(x) ((x >> 16) & 0x0F)
102 #define KINETIS_KE_SRSID_KEX2 0x02
103 #define KINETIS_KE_SRSID_KEX4 0x04
104 #define KINETIS_KE_SRSID_KEX6 0x06
106 struct kinetis_ke_flash_bank
{
107 uint32_t sector_size
;
108 uint32_t protection_size
;
111 uint32_t ftmrx_fclkdiv_addr
;
112 uint32_t ftmrx_fccobix_addr
;
113 uint32_t ftmrx_fstat_addr
;
114 uint32_t ftmrx_fprot_addr
;
115 uint32_t ftmrx_fccobhi_addr
;
116 uint32_t ftmrx_fccoblo_addr
;
119 #define MDM_REG_STAT 0x00
120 #define MDM_REG_CTRL 0x04
121 #define MDM_REG_ID 0xfc
123 #define MDM_STAT_FMEACK (1<<0)
124 #define MDM_STAT_FREADY (1<<1)
125 #define MDM_STAT_SYSSEC (1<<2)
126 #define MDM_STAT_SYSRES (1<<3)
127 #define MDM_STAT_FMEEN (1<<5)
128 #define MDM_STAT_BACKDOOREN (1<<6)
129 #define MDM_STAT_LPEN (1<<7)
130 #define MDM_STAT_VLPEN (1<<8)
131 #define MDM_STAT_LLSMODEXIT (1<<9)
132 #define MDM_STAT_VLLSXMODEXIT (1<<10)
133 #define MDM_STAT_CORE_HALTED (1<<16)
134 #define MDM_STAT_CORE_SLEEPDEEP (1<<17)
135 #define MDM_STAT_CORESLEEPING (1<<18)
137 #define MEM_CTRL_FMEIP (1<<0)
138 #define MEM_CTRL_DBG_DIS (1<<1)
139 #define MEM_CTRL_DBG_REQ (1<<2)
140 #define MEM_CTRL_SYS_RES_REQ (1<<3)
141 #define MEM_CTRL_CORE_HOLD_RES (1<<4)
142 #define MEM_CTRL_VLLSX_DBG_REQ (1<<5)
143 #define MEM_CTRL_VLLSX_DBG_ACK (1<<6)
144 #define MEM_CTRL_VLLSX_STAT_ACK (1<<7)
146 #define MDM_ACCESS_TIMEOUT 3000 /* iterations */
148 static int kinetis_ke_mdm_write_register(struct adiv5_dap
*dap
, unsigned reg
, uint32_t value
)
150 LOG_DEBUG("MDM_REG[0x%02x] <- %08" PRIX32
, reg
, value
);
152 struct adiv5_ap
*ap
= dap_get_ap(dap
, 1);
154 LOG_DEBUG("MDM: failed to get AP");
158 int retval
= dap_queue_ap_write(ap
, reg
, value
);
159 if (retval
!= ERROR_OK
) {
160 LOG_DEBUG("MDM: failed to queue a write request");
165 retval
= dap_run(dap
);
167 if (retval
!= ERROR_OK
) {
168 LOG_DEBUG("MDM: dap_run failed");
175 static int kinetis_ke_mdm_read_register(struct adiv5_dap
*dap
, unsigned reg
, uint32_t *result
)
177 struct adiv5_ap
*ap
= dap_get_ap(dap
, 1);
179 LOG_DEBUG("MDM: failed to get AP");
183 int retval
= dap_queue_ap_read(ap
, reg
, result
);
184 if (retval
!= ERROR_OK
) {
185 LOG_DEBUG("MDM: failed to queue a read request");
190 retval
= dap_run(dap
);
192 if (retval
!= ERROR_OK
) {
193 LOG_DEBUG("MDM: dap_run failed");
197 LOG_DEBUG("MDM_REG[0x%02x]: %08" PRIX32
, reg
, *result
);
201 static int kinetis_ke_mdm_poll_register(struct adiv5_dap
*dap
, unsigned reg
, uint32_t mask
, uint32_t value
)
205 int timeout
= MDM_ACCESS_TIMEOUT
;
208 retval
= kinetis_ke_mdm_read_register(dap
, reg
, &val
);
209 if (retval
!= ERROR_OK
|| (val
& mask
) == value
)
215 LOG_DEBUG("MDM: polling timed out");
219 static int kinetis_ke_prepare_flash(struct flash_bank
*bank
)
221 struct target
*target
= bank
->target
;
222 struct kinetis_ke_flash_bank
*kinfo
= bank
->driver_priv
;
223 uint8_t c2
, c3
, c4
, s
= 0;
224 uint16_t trim_value
= 0;
225 uint16_t timeout
= 0;
226 uint32_t bus_clock
= 0;
227 uint32_t bus_reg_val
= 0;
228 uint32_t bus_reg_addr
= 0;
229 uint32_t flash_clk_div
;
234 * The RM states that the flash clock has to be set to 1MHz for writing and
235 * erasing operations (otherwise it can damage the flash).
236 * This function configures the entire clock tree to make sure we
237 * run at the specified clock. We'll set FEI mode running from the ~32KHz
238 * internal clock. So we need to:
239 * - Trim internal clock.
240 * - Configure the divider for ICSOUTCLK (ICS module).
241 * - Configure the divider to get a bus clock (SIM module).
242 * - Configure the flash clock that depends on the bus clock.
244 * For MKE02_40 and MKE02_20 we set ICSOUTCLK = 20MHz and bus clock = 20MHz.
245 * For MKE04 and MKE06 we run at ICSOUTCLK = 48MHz and bus clock = 24MHz.
249 * Trim internal clock
251 switch (KINETIS_KE_SRSID_SUBFAMID(kinfo
->sim_srsid
)) {
253 case KINETIS_KE_SRSID_KEX2
:
254 /* Both KE02_20 and KE02_40 should get the same trim value */
258 case KINETIS_KE_SRSID_KEX4
:
262 case KINETIS_KE_SRSID_KEX6
:
267 result
= target_read_u8(target
, ICS_C4
, &c4
);
268 if (result
!= ERROR_OK
)
272 c4
= (c4
& ~(ICS_C4_SCFTRIM_MASK
)) | ((trim_value
>> 8) & 0x01);
274 result
= target_write_u8(target
, ICS_C3
, c3
);
275 if (result
!= ERROR_OK
)
278 result
= target_write_u8(target
, ICS_C4
, c4
);
279 if (result
!= ERROR_OK
)
282 result
= target_read_u8(target
, ICS_S
, &s
);
283 if (result
!= ERROR_OK
)
287 while (!(s
& ICS_S_LOCK_MASK
)) {
289 if (timeout
<= 1000) {
296 result
= target_read_u8(target
, ICS_S
, &s
);
297 if (result
!= ERROR_OK
)
301 /* ... trim done ... */
304 * Configure SIM (bus clock)
306 switch (KINETIS_KE_SRSID_SUBFAMID(kinfo
->sim_srsid
)) {
308 /* KE02 sub-family operates on SIM_BUSDIV */
309 case KINETIS_KE_SRSID_KEX2
:
311 bus_reg_addr
= SIM_BUSDIV
;
312 bus_clock
= 20000000;
315 /* KE04 and KE06 sub-family operates on SIM_CLKDIV
316 * Clocks are divided by:
317 * DIV1 = core clock = 48MHz
318 * DIV2 = bus clock = 24Mhz
319 * DIV3 = timer clocks
320 * So we need to configure SIM_CLKDIV, DIV1 and DIV2 value
322 case KINETIS_KE_SRSID_KEX4
:
323 /* KE04 devices have the SIM_CLKDIV register at a different offset
324 * depending on the pin count. */
325 switch (KINETIS_KE_SRSID_PINCOUNT(kinfo
->sim_srsid
)) {
327 /* 16, 20 and 24 pins */
331 bus_reg_addr
= SIM_CLKDIV_KE04_16_20_24
;
334 /* 44, 64 and 80 pins */
338 bus_reg_addr
= SIM_CLKDIV_KE04_44_64_80
;
342 LOG_ERROR("KE04 - Unknown pin count");
346 bus_reg_val
= SIM_CLKDIV_OUTDIV2_MASK
;
347 bus_clock
= 24000000;
350 case KINETIS_KE_SRSID_KEX6
:
351 bus_reg_val
= SIM_CLKDIV_OUTDIV2_MASK
;
352 bus_reg_addr
= SIM_CLKDIV_KE06
;
353 bus_clock
= 24000000;
357 result
= target_write_u32(target
, bus_reg_addr
, bus_reg_val
);
358 if (result
!= ERROR_OK
)
362 * Configure ICS to FEI (internal source)
364 result
= target_read_u8(target
, ICS_C2
, &c2
);
365 if (result
!= ERROR_OK
)
368 c2
&= ~ICS_C2_BDIV_MASK
;
370 switch (KINETIS_KE_SRSID_SUBFAMID(kinfo
->sim_srsid
)) {
372 case KINETIS_KE_SRSID_KEX2
:
373 /* Note: since there are two KE02 types, the KE02_40 @ 40MHz and the
374 * KE02_20 @ 20MHz, we divide here the ~40MHz ICSFLLCLK down to 20MHz,
377 c2
|= ICS_C2_BDIV(1);
380 case KINETIS_KE_SRSID_KEX4
:
381 case KINETIS_KE_SRSID_KEX6
:
382 /* For KE04 and KE06, the ICSFLLCLK can be 48MHz. */
383 c2
|= ICS_C2_BDIV(0);
387 result
= target_write_u8(target
, ICS_C2
, c2
);
388 if (result
!= ERROR_OK
)
391 /* Internal clock as reference (IREFS = 1) */
392 result
= target_write_u8(target
, ICS_C1
, 4);
393 if (result
!= ERROR_OK
)
396 /* Wait for FLL to lock */
397 result
= target_read_u8(target
, ICS_S
, &s
);
398 if (result
!= ERROR_OK
)
401 while (!(s
& ICS_S_LOCK_MASK
)) {
403 if (timeout
<= 1000) {
407 return ERROR_FLASH_OPERATION_FAILED
;
410 result
= target_read_u8(target
, ICS_S
, &s
);
411 if (result
!= ERROR_OK
)
416 * Configure flash clock to 1MHz.
418 flash_clk_div
= bus_clock
/ 1000000L - 1;
420 /* Check if the FCLKDIV register is locked */
421 result
= target_read_u8(target
, kinfo
->ftmrx_fclkdiv_addr
, &fclkdiv
);
422 if (result
!= ERROR_OK
)
425 if (!(fclkdiv
& FTMRX_FCLKDIV_FDIVLCK_MASK
)) {
426 /* Unlocked. Check if the register was configured, and if so, if it has the right value */
427 if ((fclkdiv
& FTMRX_FCLKDIV_FDIVLD_MASK
) &&
428 ((fclkdiv
& FTMRX_FCLKDIV_FDIV_MASK
) != FTMRX_FCLKDIV_FDIV(flash_clk_div
))) {
429 LOG_WARNING("Flash clock was already set and contains an invalid value.");
430 LOG_WARNING("Please reset the target.");
434 /* Finally, configure the flash clock */
435 fclkdiv
= (fclkdiv
& ~(FTMRX_FCLKDIV_FDIV_MASK
)) | FTMRX_FCLKDIV_FDIV(flash_clk_div
);
436 result
= target_write_u8(target
, kinfo
->ftmrx_fclkdiv_addr
, fclkdiv
);
437 if (result
!= ERROR_OK
)
440 /* Locked. Check if the current value is correct. */
441 if ((fclkdiv
& FTMRX_FCLKDIV_FDIV_MASK
) != FTMRX_FCLKDIV_FDIV(flash_clk_div
)) {
442 LOG_WARNING("Flash clock register is locked and contains an invalid value.");
443 LOG_WARNING("Please reset the target.");
448 LOG_INFO("Flash clock ready");
452 static int kinetis_ke_stop_watchdog(struct target
*target
)
454 struct working_area
*watchdog_algorithm
;
455 struct armv7m_algorithm armv7m_info
;
459 static const uint8_t watchdog_code
[] = {
460 #include "../../../contrib/loaders/flash/kinetis_ke/kinetis_ke_watchdog.inc"
463 if (target
->state
!= TARGET_HALTED
) {
464 LOG_ERROR("Target not halted");
465 return ERROR_TARGET_NOT_HALTED
;
468 /* Check if the watchdog is enabled */
469 retval
= target_read_u8(target
, WDOG_CS1
, &cs1
);
470 if (retval
!= ERROR_OK
)
474 /* Already stopped */
478 /* allocate working area with watchdog code */
479 if (target_alloc_working_area(target
, sizeof(watchdog_code
), &watchdog_algorithm
) != ERROR_OK
) {
480 LOG_WARNING("No working area available for watchdog algorithm");
481 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
484 retval
= target_write_buffer(target
, watchdog_algorithm
->address
,
485 sizeof(watchdog_code
), watchdog_code
);
486 if (retval
!= ERROR_OK
)
489 armv7m_info
.common_magic
= ARMV7M_COMMON_MAGIC
;
490 armv7m_info
.core_mode
= ARM_MODE_THREAD
;
492 retval
= target_run_algorithm(target
, 0, NULL
, 0, NULL
,
493 watchdog_algorithm
->address
, 0, 100000, &armv7m_info
);
494 if (retval
!= ERROR_OK
) {
495 LOG_ERROR("Error executing Kinetis KE watchdog algorithm");
497 LOG_INFO("Watchdog stopped");
500 target_free_working_area(target
, watchdog_algorithm
);
505 COMMAND_HANDLER(kinetis_ke_disable_wdog_handler
)
507 struct target
*target
= get_current_target(CMD_CTX
);
510 return ERROR_COMMAND_SYNTAX_ERROR
;
512 return kinetis_ke_stop_watchdog(target
);
515 COMMAND_HANDLER(kinetis_ke_mdm_mass_erase
)
517 struct target
*target
= get_current_target(CMD_CTX
);
518 struct cortex_m_common
*cortex_m
= target_to_cm(target
);
519 struct adiv5_dap
*dap
= cortex_m
->armv7m
.arm
.dap
;
522 LOG_ERROR("Cannot perform mass erase with a high-level adapter");
528 /* According to chapter 18.3.7.2 of the KE02 reference manual */
531 if (jtag_get_reset_config() & RESET_HAS_SRST
)
532 adapter_assert_reset();
535 * 1. Reset the device by asserting RESET pin or DAP_CTRL[3]
537 retval
= kinetis_ke_mdm_write_register(dap
, MDM_REG_CTRL
, MEM_CTRL_SYS_RES_REQ
);
538 if (retval
!= ERROR_OK
)
542 * ... Read the MDM-AP status register until the Flash Ready bit sets...
544 retval
= kinetis_ke_mdm_poll_register(dap
, MDM_REG_STAT
,
545 MDM_STAT_FREADY
| MDM_STAT_SYSRES
,
547 if (retval
!= ERROR_OK
) {
548 LOG_ERROR("MDM : flash ready timeout");
553 * 2. Set DAP_CTRL[0] bit to invoke debug mass erase via SWD
554 * 3. Release reset by deasserting RESET pin or DAP_CTRL[3] bit via SWD.
556 retval
= kinetis_ke_mdm_write_register(dap
, MDM_REG_CTRL
, MEM_CTRL_FMEIP
);
557 if (retval
!= ERROR_OK
)
560 /* As a sanity check make sure that device started mass erase procedure */
561 retval
= kinetis_ke_mdm_poll_register(dap
, MDM_REG_STAT
,
562 MDM_STAT_FMEACK
, MDM_STAT_FMEACK
);
563 if (retval
!= ERROR_OK
)
567 * 4. Wait till DAP_CTRL[0] bit is cleared (after mass erase completes,
568 * DAP_CTRL[0] bit is cleared automatically).
570 retval
= kinetis_ke_mdm_poll_register(dap
, MDM_REG_CTRL
,
573 if (retval
!= ERROR_OK
)
576 if (jtag_get_reset_config() & RESET_HAS_SRST
)
577 adapter_deassert_reset();
582 static const uint32_t kinetis_ke_known_mdm_ids
[] = {
583 0x001C0020, /* Kinetis-L/M/V/E/KE Series */
587 * This function implements the procedure to connect to
588 * SWD/JTAG on Kinetis K and L series of devices as it is described in
589 * AN4835 "Production Flash Programming Best Practices for Kinetis K-
590 * and L-series MCUs" Section 4.1.1
592 COMMAND_HANDLER(kinetis_ke_check_flash_security_status
)
594 struct target
*target
= get_current_target(CMD_CTX
);
595 struct cortex_m_common
*cortex_m
= target_to_cm(target
);
596 struct adiv5_dap
*dap
= cortex_m
->armv7m
.arm
.dap
;
599 LOG_WARNING("Cannot check flash security status with a high-level adapter");
607 * ... The MDM-AP ID register can be read to verify that the
608 * connection is working correctly...
610 retval
= kinetis_ke_mdm_read_register(dap
, MDM_REG_ID
, &val
);
611 if (retval
!= ERROR_OK
) {
612 LOG_ERROR("MDM: failed to read ID register");
617 for (size_t i
= 0; i
< ARRAY_SIZE(kinetis_ke_known_mdm_ids
); i
++) {
618 if (val
== kinetis_ke_known_mdm_ids
[i
]) {
625 LOG_WARNING("MDM: unknown ID %08" PRIX32
, val
);
628 * ... Read the MDM-AP status register until the Flash Ready bit sets...
630 retval
= kinetis_ke_mdm_poll_register(dap
, MDM_REG_STAT
,
633 if (retval
!= ERROR_OK
) {
634 LOG_ERROR("MDM: flash ready timeout");
639 * ... Read the System Security bit to determine if security is enabled.
640 * If System Security = 0, then proceed. If System Security = 1, then
641 * communication with the internals of the processor, including the
642 * flash, will not be possible without issuing a mass erase command or
643 * unsecuring the part through other means (backdoor key unlock)...
645 retval
= kinetis_ke_mdm_read_register(dap
, MDM_REG_STAT
, &val
);
646 if (retval
!= ERROR_OK
) {
647 LOG_ERROR("MDM: failed to read MDM_REG_STAT");
651 if (val
& MDM_STAT_SYSSEC
) {
652 jtag_poll_set_enabled(false);
654 LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
655 LOG_WARNING("**** ****");
656 LOG_WARNING("**** Your Kinetis MCU is in secured state, which means that, ****");
657 LOG_WARNING("**** with exception for very basic communication, JTAG/SWD ****");
658 LOG_WARNING("**** interface will NOT work. In order to restore its ****");
659 LOG_WARNING("**** functionality please issue 'kinetis_ke mdm mass_erase' ****");
660 LOG_WARNING("**** command, power cycle the MCU and restart OpenOCD. ****");
661 LOG_WARNING("**** ****");
662 LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
664 LOG_INFO("MDM: Chip is unsecured. Continuing.");
665 jtag_poll_set_enabled(true);
671 LOG_ERROR("MDM: Failed to check security status of the MCU. Cannot proceed further");
672 jtag_poll_set_enabled(false);
676 FLASH_BANK_COMMAND_HANDLER(kinetis_ke_flash_bank_command
)
678 struct kinetis_ke_flash_bank
*bank_info
;
681 return ERROR_COMMAND_SYNTAX_ERROR
;
683 LOG_INFO("add flash_bank kinetis_ke %s", bank
->name
);
685 bank_info
= malloc(sizeof(struct kinetis_ke_flash_bank
));
687 memset(bank_info
, 0, sizeof(struct kinetis_ke_flash_bank
));
689 bank
->driver_priv
= bank_info
;
694 /* Kinetis Program-LongWord Microcodes */
695 static uint8_t kinetis_ke_flash_write_code
[] = {
696 #include "../../../contrib/loaders/flash/kinetis_ke/kinetis_ke_flash.inc"
699 static int kinetis_ke_write_words(struct flash_bank
*bank
, const uint8_t *buffer
,
700 uint32_t offset
, uint32_t words
)
702 struct kinetis_ke_flash_bank
*kinfo
= bank
->driver_priv
;
703 struct target
*target
= bank
->target
;
704 uint32_t ram_buffer_size
= 512 + 16;
705 struct working_area
*write_algorithm
;
706 struct working_area
*source
;
707 uint32_t address
= bank
->base
+ offset
;
708 struct reg_param reg_params
[4];
709 struct armv7m_algorithm armv7m_info
;
710 int retval
= ERROR_OK
;
711 uint32_t flash_code_size
;
713 LOG_INFO("Kinetis KE: FLASH Write ...");
715 /* allocate working area with flash programming code */
716 if (target_alloc_working_area(target
, sizeof(kinetis_ke_flash_write_code
),
717 &write_algorithm
) != ERROR_OK
) {
718 LOG_WARNING("no working area available, can't do block memory writes");
719 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
722 /* Patch the FTMRx registers addresses */
723 flash_code_size
= sizeof(kinetis_ke_flash_write_code
);
724 buf_set_u32(&kinetis_ke_flash_write_code
[flash_code_size
-16], 0, 32, kinfo
->ftmrx_fstat_addr
);
725 buf_set_u32(&kinetis_ke_flash_write_code
[flash_code_size
-12], 0, 32, kinfo
->ftmrx_fccobix_addr
);
726 buf_set_u32(&kinetis_ke_flash_write_code
[flash_code_size
-8], 0, 32, kinfo
->ftmrx_fccobhi_addr
);
727 buf_set_u32(&kinetis_ke_flash_write_code
[flash_code_size
-4], 0, 32, kinfo
->ftmrx_fccoblo_addr
);
729 retval
= target_write_buffer(target
, write_algorithm
->address
,
730 sizeof(kinetis_ke_flash_write_code
), kinetis_ke_flash_write_code
);
731 if (retval
!= ERROR_OK
)
735 if (target_alloc_working_area(target
, ram_buffer_size
, &source
) != ERROR_OK
) {
736 /* free working area, write algorithm already allocated */
737 target_free_working_area(target
, write_algorithm
);
739 LOG_WARNING("No large enough working area available, can't do block memory writes");
740 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
743 armv7m_info
.common_magic
= ARMV7M_COMMON_MAGIC
;
744 armv7m_info
.core_mode
= ARM_MODE_THREAD
;
746 init_reg_param(®_params
[0], "r0", 32, PARAM_IN_OUT
);
747 init_reg_param(®_params
[1], "r1", 32, PARAM_OUT
);
748 init_reg_param(®_params
[2], "r2", 32, PARAM_OUT
);
749 init_reg_param(®_params
[3], "r3", 32, PARAM_OUT
);
751 buf_set_u32(reg_params
[0].value
, 0, 32, address
);
752 buf_set_u32(reg_params
[1].value
, 0, 32, words
);
753 buf_set_u32(reg_params
[2].value
, 0, 32, source
->address
);
754 buf_set_u32(reg_params
[3].value
, 0, 32, source
->address
+ source
->size
);
756 retval
= target_run_flash_async_algorithm(target
, buffer
, words
, 4,
759 source
->address
, source
->size
,
760 write_algorithm
->address
, 0,
763 if (retval
== ERROR_FLASH_OPERATION_FAILED
) {
764 if (buf_get_u32(reg_params
[0].value
, 0, 32) & FTMRX_ERROR_ACCERR
)
765 LOG_ERROR("flash access error");
767 if (buf_get_u32(reg_params
[0].value
, 0, 32) & FTMRX_ERROR_FPVIOL
)
768 LOG_ERROR("flash protection violation");
771 target_free_working_area(target
, source
);
772 target_free_working_area(target
, write_algorithm
);
774 destroy_reg_param(®_params
[0]);
775 destroy_reg_param(®_params
[1]);
776 destroy_reg_param(®_params
[2]);
777 destroy_reg_param(®_params
[3]);
782 static int kinetis_ke_protect(struct flash_bank
*bank
, int set
,
783 unsigned int first
, unsigned int last
)
785 LOG_WARNING("kinetis_ke_protect not supported yet");
788 if (bank
->target
->state
!= TARGET_HALTED
) {
789 LOG_ERROR("Target not halted");
790 return ERROR_TARGET_NOT_HALTED
;
793 return ERROR_FLASH_BANK_INVALID
;
796 static int kinetis_ke_protect_check(struct flash_bank
*bank
)
798 struct kinetis_ke_flash_bank
*kinfo
= bank
->driver_priv
;
800 if (bank
->target
->state
!= TARGET_HALTED
) {
801 LOG_ERROR("Target not halted");
802 return ERROR_TARGET_NOT_HALTED
;
807 uint8_t fpopen
, fpldis
, fphdis
;
809 uint32_t lprot_size
= 0, hprot_size
= 0;
810 uint32_t lprot_to
= 0, hprot_from
= 0;
812 /* read protection register */
813 result
= target_read_u8(bank
->target
, kinfo
->ftmrx_fprot_addr
, &fprot
);
815 if (result
!= ERROR_OK
)
818 fpopen
= fprot
& 0x80;
819 fpldis
= fprot
& 0x04;
820 fphdis
= fprot
& 0x20;
821 fphs
= (fprot
>> 3) & 0x03;
824 /* Fully unprotected? */
825 if (fpopen
&& fpldis
&& fphdis
) {
826 LOG_WARNING("No flash protection found.");
828 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++)
829 bank
->sectors
[i
].is_protected
= 0;
831 kinfo
->protection_size
= 0;
833 LOG_WARNING("Flash protected. FPOPEN=%i FPLDIS=%i FPHDIS=%i FPLS=%i FPHS=%i",
834 fpopen
? 1 : 0, fpldis
? 1 : 0, fphdis
? 1 : 0, fpls
, fphs
);
836 /* Retrieve which region is protected and how much */
839 lprot_size
= (kinfo
->sector_size
* 4) << fpls
;
842 hprot_size
= (kinfo
->sector_size
* 2) << fphs
;
845 lprot_size
= (kinfo
->sector_size
* 4) << fpls
;
848 hprot_size
= (kinfo
->sector_size
* 2) << fphs
;
851 kinfo
->protection_size
= lprot_size
+ hprot_size
;
853 /* lprot_to indicates up to where the lower region is protected */
854 lprot_to
= lprot_size
/ kinfo
->sector_size
;
856 /* hprot_from indicates from where the upper region is protected */
857 hprot_from
= (0x8000 - hprot_size
) / kinfo
->sector_size
;
859 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++) {
861 /* Check if the sector is in the lower region */
862 if (bank
->sectors
[i
].offset
< 0x4000) {
863 /* Compare the sector start address against lprot_to */
864 if (lprot_to
&& (i
< lprot_to
))
865 bank
->sectors
[i
].is_protected
= 1;
867 bank
->sectors
[i
].is_protected
= 0;
869 /* Check if the sector is between the lower and upper region
870 * OR after the upper region */
871 } else if (bank
->sectors
[i
].offset
< 0x6000 || bank
->sectors
[i
].offset
>= 0x8000) {
872 /* If fpopen is 1 then these regions are protected */
874 bank
->sectors
[i
].is_protected
= 0;
876 bank
->sectors
[i
].is_protected
= 1;
878 /* Check if the sector is in the upper region */
879 } else if (bank
->sectors
[i
].offset
< 0x8000) {
880 if (hprot_from
&& (i
> hprot_from
))
881 bank
->sectors
[i
].is_protected
= 1;
883 bank
->sectors
[i
].is_protected
= 0;
891 static int kinetis_ke_ftmrx_command(struct flash_bank
*bank
, uint8_t count
,
892 uint8_t *FCCOBIX
, uint8_t *FCCOBHI
, uint8_t *FCCOBLO
, uint8_t *fstat
)
896 struct target
*target
= bank
->target
;
897 struct kinetis_ke_flash_bank
*kinfo
= bank
->driver_priv
;
898 uint32_t timeout
= 0;
900 /* Clear error flags */
901 result
= target_write_u8(target
, kinfo
->ftmrx_fstat_addr
, 0x30);
902 if (result
!= ERROR_OK
)
905 for (i
= 0; i
< count
; i
++) {
907 result
= target_write_u8(target
, kinfo
->ftmrx_fccobix_addr
, FCCOBIX
[i
]);
908 if (result
!= ERROR_OK
)
911 /* Write high part */
912 result
= target_write_u8(target
, kinfo
->ftmrx_fccobhi_addr
, FCCOBHI
[i
]);
913 if (result
!= ERROR_OK
)
916 /* Write low part (that is not always required) */
918 result
= target_write_u8(target
, kinfo
->ftmrx_fccoblo_addr
, FCCOBLO
[i
]);
919 if (result
!= ERROR_OK
)
924 /* Launch the command */
925 result
= target_write_u8(target
, kinfo
->ftmrx_fstat_addr
, 0x80);
926 if (result
!= ERROR_OK
)
929 /* Wait for it to finish */
930 result
= target_read_u8(target
, kinfo
->ftmrx_fstat_addr
, fstat
);
931 if (result
!= ERROR_OK
)
934 while (!(*fstat
& FTMRX_FSTAT_CCIF_MASK
)) {
935 if (timeout
<= 1000) {
939 return ERROR_FLASH_OPERATION_FAILED
;
942 result
= target_read_u8(target
, kinfo
->ftmrx_fstat_addr
, fstat
);
943 if (result
!= ERROR_OK
)
950 static int kinetis_ke_erase(struct flash_bank
*bank
, unsigned int first
,
954 uint8_t FCCOBIX
[2], FCCOBHI
[2], FCCOBLO
[2], fstat
;
955 bool fcf_erased
= false;
957 if (bank
->target
->state
!= TARGET_HALTED
) {
958 LOG_ERROR("Target not halted");
959 return ERROR_TARGET_NOT_HALTED
;
962 if ((first
> bank
->num_sectors
) || (last
> bank
->num_sectors
))
963 return ERROR_FLASH_OPERATION_FAILED
;
965 result
= kinetis_ke_prepare_flash(bank
);
966 if (result
!= ERROR_OK
)
969 for (unsigned int i
= first
; i
<= last
; i
++) {
971 FCCOBHI
[0] = FTMRX_CMD_ERASESECTOR
;
972 FCCOBLO
[0] = (bank
->base
+ bank
->sectors
[i
].offset
) >> 16;
975 FCCOBHI
[1] = (bank
->base
+ bank
->sectors
[i
].offset
) >> 8;
976 FCCOBLO
[1] = (bank
->base
+ bank
->sectors
[i
].offset
);
978 result
= kinetis_ke_ftmrx_command(bank
, 2, FCCOBIX
, FCCOBHI
, FCCOBLO
, &fstat
);
980 if (result
!= ERROR_OK
) {
981 LOG_WARNING("erase sector %u failed", i
);
982 return ERROR_FLASH_OPERATION_FAILED
;
991 ("flash configuration field erased, please reset the device");
997 static int kinetis_ke_write(struct flash_bank
*bank
, const uint8_t *buffer
,
998 uint32_t offset
, uint32_t count
)
1001 uint8_t *new_buffer
= NULL
;
1002 uint32_t words
= count
/ 4;
1004 if (bank
->target
->state
!= TARGET_HALTED
) {
1005 LOG_ERROR("Target not halted");
1006 return ERROR_TARGET_NOT_HALTED
;
1009 if (offset
> bank
->size
)
1010 return ERROR_FLASH_BANK_INVALID
;
1013 LOG_WARNING("offset 0x%" PRIx32
" breaks the required alignment", offset
);
1014 return ERROR_FLASH_DST_BREAKS_ALIGNMENT
;
1017 result
= kinetis_ke_stop_watchdog(bank
->target
);
1018 if (result
!= ERROR_OK
)
1021 result
= kinetis_ke_prepare_flash(bank
);
1022 if (result
!= ERROR_OK
)
1026 uint32_t old_count
= count
;
1027 count
= (old_count
| 3) + 1;
1028 new_buffer
= malloc(count
);
1030 LOG_ERROR("odd number of bytes to write and no memory "
1031 "for padding buffer");
1035 LOG_INFO("odd number of bytes to write (%" PRIu32
"), extending to %" PRIu32
" "
1036 "and padding with 0xff", old_count
, count
);
1038 memset(new_buffer
, 0xff, count
);
1039 buffer
= memcpy(new_buffer
, buffer
, old_count
);
1043 result
= kinetis_ke_write_words(bank
, buffer
, offset
, words
);
1049 static int kinetis_ke_probe(struct flash_bank
*bank
)
1052 uint32_t offset
= 0;
1053 struct target
*target
= bank
->target
;
1054 struct kinetis_ke_flash_bank
*kinfo
= bank
->driver_priv
;
1056 result
= target_read_u32(target
, SIM_SRSID
, &kinfo
->sim_srsid
);
1057 if (result
!= ERROR_OK
)
1060 if (KINETIS_KE_SRSID_FAMID(kinfo
->sim_srsid
) != 0x00) {
1061 LOG_ERROR("Unsupported KE family");
1062 return ERROR_FLASH_OPER_UNSUPPORTED
;
1065 switch (KINETIS_KE_SRSID_SUBFAMID(kinfo
->sim_srsid
)) {
1066 case KINETIS_KE_SRSID_KEX2
:
1067 LOG_INFO("KE02 sub-family");
1070 case KINETIS_KE_SRSID_KEX4
:
1071 LOG_INFO("KE04 sub-family");
1074 case KINETIS_KE_SRSID_KEX6
:
1075 LOG_INFO("KE06 sub-family");
1079 LOG_ERROR("Unsupported KE sub-family");
1080 return ERROR_FLASH_OPER_UNSUPPORTED
;
1083 /* We can only retrieve the ke0x part, but there is no way to know
1084 * the flash size, so assume the maximum flash size for the entire
1087 bank
->base
= 0x00000000;
1088 kinfo
->sector_size
= 512;
1090 switch (KINETIS_KE_SRSID_SUBFAMID(kinfo
->sim_srsid
)) {
1092 case KINETIS_KE_SRSID_KEX2
:
1094 bank
->size
= 0x00010000;
1095 bank
->num_sectors
= 128;
1097 /* KE02 uses the FTMRH flash controller,
1098 * and registers have a different offset from the
1099 * FTMRE flash controller. Sort this out here.
1101 kinfo
->ftmrx_fclkdiv_addr
= 0x40020000;
1102 kinfo
->ftmrx_fccobix_addr
= 0x40020002;
1103 kinfo
->ftmrx_fstat_addr
= 0x40020006;
1104 kinfo
->ftmrx_fprot_addr
= 0x40020008;
1105 kinfo
->ftmrx_fccobhi_addr
= 0x4002000A;
1106 kinfo
->ftmrx_fccoblo_addr
= 0x4002000B;
1109 case KINETIS_KE_SRSID_KEX6
:
1110 case KINETIS_KE_SRSID_KEX4
:
1112 bank
->size
= 0x00020000;
1113 bank
->num_sectors
= 256;
1115 /* KE04 and KE06 use the FTMRE flash controller,
1116 * and registers have a different offset from the
1117 * FTMRH flash controller. Sort this out here.
1119 kinfo
->ftmrx_fclkdiv_addr
= 0x40020003;
1120 kinfo
->ftmrx_fccobix_addr
= 0x40020001;
1121 kinfo
->ftmrx_fstat_addr
= 0x40020005;
1122 kinfo
->ftmrx_fprot_addr
= 0x4002000B;
1123 kinfo
->ftmrx_fccobhi_addr
= 0x40020009;
1124 kinfo
->ftmrx_fccoblo_addr
= 0x40020008;
1128 free(bank
->sectors
);
1130 assert(bank
->num_sectors
> 0);
1131 bank
->sectors
= malloc(sizeof(struct flash_sector
) * bank
->num_sectors
);
1133 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++) {
1134 bank
->sectors
[i
].offset
= offset
;
1135 bank
->sectors
[i
].size
= kinfo
->sector_size
;
1136 offset
+= kinfo
->sector_size
;
1137 bank
->sectors
[i
].is_erased
= -1;
1138 bank
->sectors
[i
].is_protected
= 1;
1144 static int kinetis_ke_auto_probe(struct flash_bank
*bank
)
1146 struct kinetis_ke_flash_bank
*kinfo
= bank
->driver_priv
;
1148 if (kinfo
->sim_srsid
)
1151 return kinetis_ke_probe(bank
);
1154 static int kinetis_ke_info(struct flash_bank
*bank
, struct command_invocation
*cmd
)
1156 command_print_sameline(cmd
, "%s driver for flash bank %s at " TARGET_ADDR_FMT
,
1157 bank
->driver
->name
, bank
->name
, bank
->base
);
1162 static int kinetis_ke_blank_check(struct flash_bank
*bank
)
1164 uint8_t FCCOBIX
[3], FCCOBHI
[3], FCCOBLO
[3], fstat
;
1165 uint16_t longwords
= 0;
1168 if (bank
->target
->state
!= TARGET_HALTED
) {
1169 LOG_ERROR("Target not halted");
1170 return ERROR_TARGET_NOT_HALTED
;
1173 result
= kinetis_ke_prepare_flash(bank
);
1174 if (result
!= ERROR_OK
)
1177 /* check if whole bank is blank */
1179 FCCOBHI
[0] = FTMRX_CMD_ALLERASED
;
1181 result
= kinetis_ke_ftmrx_command(bank
, 1, FCCOBIX
, FCCOBHI
, NULL
, &fstat
);
1183 if (result
!= ERROR_OK
)
1186 if (fstat
& (FTMRX_FSTAT_MGSTAT0_MASK
| FTMRX_FSTAT_MGSTAT1_MASK
)) {
1187 /* the whole bank is not erased, check sector-by-sector */
1188 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++) {
1190 FCCOBHI
[0] = FTMRX_CMD_SECTIONERASED
;
1191 FCCOBLO
[0] = (bank
->base
+ bank
->sectors
[i
].offset
) >> 16;
1194 FCCOBHI
[1] = (bank
->base
+ bank
->sectors
[i
].offset
) >> 8;
1195 FCCOBLO
[1] = (bank
->base
+ bank
->sectors
[i
].offset
);
1200 FCCOBHI
[2] = longwords
>> 8;
1201 FCCOBLO
[2] = longwords
;
1203 result
= kinetis_ke_ftmrx_command(bank
, 3, FCCOBIX
, FCCOBHI
, FCCOBLO
, &fstat
);
1205 if (result
== ERROR_OK
) {
1206 bank
->sectors
[i
].is_erased
= !(fstat
& (FTMRX_FSTAT_MGSTAT0_MASK
| FTMRX_FSTAT_MGSTAT1_MASK
));
1208 LOG_DEBUG("Ignoring error on PFlash sector blank-check");
1209 bank
->sectors
[i
].is_erased
= -1;
1213 /* the whole bank is erased, update all sectors */
1214 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++)
1215 bank
->sectors
[i
].is_erased
= 1;
1221 static const struct command_registration kinetis_ke_security_command_handlers
[] = {
1223 .name
= "check_security",
1224 .mode
= COMMAND_EXEC
,
1225 .help
= "Check status of device security lock",
1227 .handler
= kinetis_ke_check_flash_security_status
,
1230 .name
= "mass_erase",
1231 .mode
= COMMAND_EXEC
,
1232 .help
= "Issue a complete flash erase via the MDM-AP",
1234 .handler
= kinetis_ke_mdm_mass_erase
,
1236 COMMAND_REGISTRATION_DONE
1239 static const struct command_registration kinetis_ke_exec_command_handlers
[] = {
1242 .mode
= COMMAND_ANY
,
1243 .help
= "MDM-AP command group",
1245 .chain
= kinetis_ke_security_command_handlers
,
1248 .name
= "disable_wdog",
1249 .mode
= COMMAND_EXEC
,
1250 .help
= "Disable the watchdog timer",
1252 .handler
= kinetis_ke_disable_wdog_handler
,
1254 COMMAND_REGISTRATION_DONE
1257 static const struct command_registration kinetis_ke_command_handler
[] = {
1259 .name
= "kinetis_ke",
1260 .mode
= COMMAND_ANY
,
1261 .help
= "Kinetis KE flash controller commands",
1263 .chain
= kinetis_ke_exec_command_handlers
,
1265 COMMAND_REGISTRATION_DONE
1268 const struct flash_driver kinetis_ke_flash
= {
1269 .name
= "kinetis_ke",
1270 .commands
= kinetis_ke_command_handler
,
1271 .flash_bank_command
= kinetis_ke_flash_bank_command
,
1272 .erase
= kinetis_ke_erase
,
1273 .protect
= kinetis_ke_protect
,
1274 .write
= kinetis_ke_write
,
1275 .read
= default_flash_read
,
1276 .probe
= kinetis_ke_probe
,
1277 .auto_probe
= kinetis_ke_auto_probe
,
1278 .erase_check
= kinetis_ke_blank_check
,
1279 .protect_check
= kinetis_ke_protect_check
,
1280 .info
= kinetis_ke_info
,
1281 .free_driver_priv
= default_flash_free_driver_priv
,
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)