1 /***************************************************************************
2 * Copyright (C) 2015 by Ivan Meleca *
5 * Modified from kinetis.c *
7 * Copyright (C) 2011 by Mathias Kuester *
10 * Copyright (C) 2011 sleep(5) ltd *
11 * tomas@sleepfive.com *
13 * Copyright (C) 2012 by Christopher D. Kilgour *
14 * techie at whiterocker.com *
16 * Copyright (C) 2013 Nemui Trinomius *
17 * nemuisan_kawausogasuki@live.jp *
19 * Copyright (C) 2015 Tomas Vanek *
22 * This program is free software; you can redistribute it and/or modify *
23 * it under the terms of the GNU General Public License as published by *
24 * the Free Software Foundation; either version 2 of the License, or *
25 * (at your option) any later version. *
27 * This program is distributed in the hope that it will be useful, *
28 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
29 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
30 * GNU General Public License for more details. *
32 * You should have received a copy of the GNU General Public License *
33 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
34 ***************************************************************************/
40 #include "jtag/interface.h"
42 #include <helper/binarybuffer.h>
43 #include <target/algorithm.h>
44 #include <target/arm_adi_v5.h>
45 #include <target/armv7m.h>
46 #include <target/cortex_m.h>
49 #define SIM_SRSID 0x40048000
50 #define ICS_C1 0x40064000
51 #define ICS_C2 0x40064001
52 #define ICS_C3 0x40064002
53 #define ICS_C4 0x40064003
54 #define ICS_S 0x40064004
55 #define SIM_BUSDIV 0x40048018
56 #define SIM_CLKDIV_KE06 0x40048024
57 #define SIM_CLKDIV_KE04_44_64_80 0x40048024
58 #define SIM_CLKDIV_KE04_16_20_24 0x4004801C
59 #define WDOG_CS1 0x40052000
61 #define ICS_C2_BDIV_MASK 0xE0
62 #define ICS_C2_BDIV_SHIFT 5
63 #define ICS_C2_BDIV(x) (((uint8_t)(((uint8_t)(x))<<ICS_C2_BDIV_SHIFT))&ICS_C2_BDIV_MASK)
64 #define ICS_S_LOCK_MASK 0x40
65 #define ICS_C4_SCFTRIM_MASK 0x1
66 #define SIM_CLKDIV_OUTDIV2_MASK 0x1000000
67 #define FTMRX_FCLKDIV_FDIV_MASK 0x3F
68 #define FTMRX_FCLKDIV_FDIV_SHIFT 0
69 #define FTMRX_FCLKDIV_FDIV(x) (((uint8_t)(((uint8_t)(x))<<FTMRX_FCLKDIV_FDIV_SHIFT))&FTMRX_FCLKDIV_FDIV_MASK)
70 #define FTMRX_FCLKDIV_FDIVLCK_MASK 0x40
71 #define FTMRX_FCLKDIV_FDIVLCK_SHIFT 6
72 #define FTMRX_FCLKDIV_FDIVLD_MASK 0x80
73 #define FTMRX_FCLKDIV_FDIVLD_SHIFT 7
74 #define FTMRX_FSTAT_CCIF_MASK 0x80
75 #define FTMRX_FSTAT_MGSTAT0_MASK 0x01
76 #define FTMRX_FSTAT_MGSTAT1_MASK 0x02
79 #define FTMRX_CMD_ALLERASED 0x01
80 #define FTMRX_CMD_BLOCKERASED 0x02
81 #define FTMRX_CMD_SECTIONERASED 0x03
82 #define FTMRX_CMD_READONCE 0x04
83 #define FTMRX_CMD_PROGFLASH 0x06
84 #define FTMRX_CMD_PROGONCE 0x07
85 #define FTMRX_CMD_ERASEALL 0x08
86 #define FTMRX_CMD_ERASEBLOCK 0x09
87 #define FTMRX_CMD_ERASESECTOR 0x0A
88 #define FTMRX_CMD_UNSECURE 0x0B
89 #define FTMRX_CMD_VERIFYACCESS 0x0C
90 #define FTMRX_CMD_SETMARGINLVL 0x0D
91 #define FTMRX_CMD_SETFACTORYLVL 0x0E
92 #define FTMRX_CMD_CONFIGNVM 0x0F
95 #define FTMRX_ERROR_ACCERR 0x20
96 #define FTMRX_ERROR_FPVIOL 0x10
98 #define KINETIS_KE_SRSID_FAMID(x) ((x >> 28) & 0x0F)
99 #define KINETIS_KE_SRSID_SUBFAMID(x) ((x >> 24) & 0x0F)
100 #define KINETIS_KE_SRSID_PINCOUNT(x) ((x >> 16) & 0x0F)
102 #define KINETIS_KE_SRSID_KEX2 0x02
103 #define KINETIS_KE_SRSID_KEX4 0x04
104 #define KINETIS_KE_SRSID_KEX6 0x06
106 struct kinetis_ke_flash_bank
{
107 uint32_t sector_size
;
108 uint32_t protection_size
;
111 uint32_t ftmrx_fclkdiv_addr
;
112 uint32_t ftmrx_fccobix_addr
;
113 uint32_t ftmrx_fstat_addr
;
114 uint32_t ftmrx_fprot_addr
;
115 uint32_t ftmrx_fccobhi_addr
;
116 uint32_t ftmrx_fccoblo_addr
;
119 #define MDM_REG_STAT 0x00
120 #define MDM_REG_CTRL 0x04
121 #define MDM_REG_ID 0xfc
123 #define MDM_STAT_FMEACK (1<<0)
124 #define MDM_STAT_FREADY (1<<1)
125 #define MDM_STAT_SYSSEC (1<<2)
126 #define MDM_STAT_SYSRES (1<<3)
127 #define MDM_STAT_FMEEN (1<<5)
128 #define MDM_STAT_BACKDOOREN (1<<6)
129 #define MDM_STAT_LPEN (1<<7)
130 #define MDM_STAT_VLPEN (1<<8)
131 #define MDM_STAT_LLSMODEXIT (1<<9)
132 #define MDM_STAT_VLLSXMODEXIT (1<<10)
133 #define MDM_STAT_CORE_HALTED (1<<16)
134 #define MDM_STAT_CORE_SLEEPDEEP (1<<17)
135 #define MDM_STAT_CORESLEEPING (1<<18)
137 #define MEM_CTRL_FMEIP (1<<0)
138 #define MEM_CTRL_DBG_DIS (1<<1)
139 #define MEM_CTRL_DBG_REQ (1<<2)
140 #define MEM_CTRL_SYS_RES_REQ (1<<3)
141 #define MEM_CTRL_CORE_HOLD_RES (1<<4)
142 #define MEM_CTRL_VLLSX_DBG_REQ (1<<5)
143 #define MEM_CTRL_VLLSX_DBG_ACK (1<<6)
144 #define MEM_CTRL_VLLSX_STAT_ACK (1<<7)
146 #define MDM_ACCESS_TIMEOUT 3000 /* iterations */
148 static int kinetis_ke_mdm_write_register(struct adiv5_dap
*dap
, unsigned reg
, uint32_t value
)
151 LOG_DEBUG("MDM_REG[0x%02x] <- %08" PRIX32
, reg
, value
);
153 retval
= dap_queue_ap_write(dap_ap(dap
, 1), reg
, value
);
154 if (retval
!= ERROR_OK
) {
155 LOG_DEBUG("MDM: failed to queue a write request");
159 retval
= dap_run(dap
);
160 if (retval
!= ERROR_OK
) {
161 LOG_DEBUG("MDM: dap_run failed");
168 static int kinetis_ke_mdm_read_register(struct adiv5_dap
*dap
, unsigned reg
, uint32_t *result
)
171 retval
= dap_queue_ap_read(dap_ap(dap
, 1), reg
, result
);
172 if (retval
!= ERROR_OK
) {
173 LOG_DEBUG("MDM: failed to queue a read request");
177 retval
= dap_run(dap
);
178 if (retval
!= ERROR_OK
) {
179 LOG_DEBUG("MDM: dap_run failed");
183 LOG_DEBUG("MDM_REG[0x%02x]: %08" PRIX32
, reg
, *result
);
187 static int kinetis_ke_mdm_poll_register(struct adiv5_dap
*dap
, unsigned reg
, uint32_t mask
, uint32_t value
)
191 int timeout
= MDM_ACCESS_TIMEOUT
;
194 retval
= kinetis_ke_mdm_read_register(dap
, reg
, &val
);
195 if (retval
!= ERROR_OK
|| (val
& mask
) == value
)
201 LOG_DEBUG("MDM: polling timed out");
205 static int kinetis_ke_prepare_flash(struct flash_bank
*bank
)
207 struct target
*target
= bank
->target
;
208 struct kinetis_ke_flash_bank
*kinfo
= bank
->driver_priv
;
209 uint8_t c2
, c3
, c4
, s
= 0;
210 uint16_t trim_value
= 0;
211 uint16_t timeout
= 0;
212 uint32_t bus_clock
= 0;
213 uint32_t bus_reg_val
= 0;
214 uint32_t bus_reg_addr
= 0;
215 uint32_t flash_clk_div
;
220 * The RM states that the flash clock has to be set to 1MHz for writing and
221 * erasing operations (otherwise it can damage the flash).
222 * This function configures the entire clock tree to make sure we
223 * run at the specified clock. We'll set FEI mode running from the ~32KHz
224 * internal clock. So we need to:
225 * - Trim internal clock.
226 * - Configure the divider for ICSOUTCLK (ICS module).
227 * - Configure the divider to get a bus clock (SIM module).
228 * - Configure the flash clock that depends on the bus clock.
230 * For MKE02_40 and MKE02_20 we set ICSOUTCLK = 20MHz and bus clock = 20MHz.
231 * For MKE04 and MKE06 we run at ICSOUTCLK = 48MHz and bus clock = 24MHz.
235 * Trim internal clock
237 switch (KINETIS_KE_SRSID_SUBFAMID(kinfo
->sim_srsid
)) {
239 case KINETIS_KE_SRSID_KEX2
:
240 /* Both KE02_20 and KE02_40 should get the same trim value */
244 case KINETIS_KE_SRSID_KEX4
:
248 case KINETIS_KE_SRSID_KEX6
:
253 result
= target_read_u8(target
, ICS_C4
, &c4
);
254 if (result
!= ERROR_OK
)
258 c4
= (c4
& ~(ICS_C4_SCFTRIM_MASK
)) | ((trim_value
>> 8) & 0x01);
260 result
= target_write_u8(target
, ICS_C3
, c3
);
261 if (result
!= ERROR_OK
)
264 result
= target_write_u8(target
, ICS_C4
, c4
);
265 if (result
!= ERROR_OK
)
268 result
= target_read_u8(target
, ICS_S
, &s
);
269 if (result
!= ERROR_OK
)
273 while (!(s
& ICS_S_LOCK_MASK
)) {
275 if (timeout
<= 1000) {
282 result
= target_read_u8(target
, ICS_S
, &s
);
283 if (result
!= ERROR_OK
)
287 /* ... trim done ... */
290 * Configure SIM (bus clock)
292 switch (KINETIS_KE_SRSID_SUBFAMID(kinfo
->sim_srsid
)) {
294 /* KE02 sub-family operates on SIM_BUSDIV */
295 case KINETIS_KE_SRSID_KEX2
:
297 bus_reg_addr
= SIM_BUSDIV
;
298 bus_clock
= 20000000;
301 /* KE04 and KE06 sub-family operates on SIM_CLKDIV
302 * Clocks are divided by:
303 * DIV1 = core clock = 48MHz
304 * DIV2 = bus clock = 24Mhz
305 * DIV3 = timer clocks
306 * So we need to configure SIM_CLKDIV, DIV1 and DIV2 value
308 case KINETIS_KE_SRSID_KEX4
:
309 /* KE04 devices have the SIM_CLKDIV register at a different offset
310 * depending on the pin count. */
311 switch (KINETIS_KE_SRSID_PINCOUNT(kinfo
->sim_srsid
)) {
313 /* 16, 20 and 24 pins */
317 bus_reg_addr
= SIM_CLKDIV_KE04_16_20_24
;
320 /* 44, 64 and 80 pins */
324 bus_reg_addr
= SIM_CLKDIV_KE04_44_64_80
;
328 LOG_ERROR("KE04 - Unknown pin count");
332 bus_reg_val
= SIM_CLKDIV_OUTDIV2_MASK
;
333 bus_clock
= 24000000;
336 case KINETIS_KE_SRSID_KEX6
:
337 bus_reg_val
= SIM_CLKDIV_OUTDIV2_MASK
;
338 bus_reg_addr
= SIM_CLKDIV_KE06
;
339 bus_clock
= 24000000;
343 result
= target_write_u32(target
, bus_reg_addr
, bus_reg_val
);
344 if (result
!= ERROR_OK
)
348 * Configure ICS to FEI (internal source)
350 result
= target_read_u8(target
, ICS_C2
, &c2
);
351 if (result
!= ERROR_OK
)
354 c2
&= ~ICS_C2_BDIV_MASK
;
356 switch (KINETIS_KE_SRSID_SUBFAMID(kinfo
->sim_srsid
)) {
358 case KINETIS_KE_SRSID_KEX2
:
359 /* Note: since there are two KE02 types, the KE02_40 @ 40MHz and the
360 * KE02_20 @ 20MHz, we divide here the ~40MHz ICSFLLCLK down to 20MHz,
363 c2
|= ICS_C2_BDIV(1);
366 case KINETIS_KE_SRSID_KEX4
:
367 case KINETIS_KE_SRSID_KEX6
:
368 /* For KE04 and KE06, the ICSFLLCLK can be 48MHz. */
369 c2
|= ICS_C2_BDIV(0);
373 result
= target_write_u8(target
, ICS_C2
, c2
);
374 if (result
!= ERROR_OK
)
377 /* Internal clock as reference (IREFS = 1) */
378 result
= target_write_u8(target
, ICS_C1
, 4);
379 if (result
!= ERROR_OK
)
382 /* Wait for FLL to lock */
383 result
= target_read_u8(target
, ICS_S
, &s
);
384 if (result
!= ERROR_OK
)
387 while (!(s
& ICS_S_LOCK_MASK
)) {
389 if (timeout
<= 1000) {
393 return ERROR_FLASH_OPERATION_FAILED
;
396 result
= target_read_u8(target
, ICS_S
, &s
);
397 if (result
!= ERROR_OK
)
402 * Configure flash clock to 1MHz.
404 flash_clk_div
= bus_clock
/ 1000000L - 1;
406 /* Check if the FCLKDIV register is locked */
407 result
= target_read_u8(target
, kinfo
->ftmrx_fclkdiv_addr
, &fclkdiv
);
408 if (result
!= ERROR_OK
)
411 if (!(fclkdiv
& FTMRX_FCLKDIV_FDIVLCK_MASK
)) {
412 /* Unlocked. Check if the register was configured, and if so, if it has the right value */
413 if ((fclkdiv
& FTMRX_FCLKDIV_FDIVLD_MASK
) &&
414 ((fclkdiv
& FTMRX_FCLKDIV_FDIV_MASK
) != FTMRX_FCLKDIV_FDIV(flash_clk_div
))) {
415 LOG_WARNING("Flash clock was already set and contains an invalid value.");
416 LOG_WARNING("Please reset the target.");
420 /* Finally, configure the flash clock */
421 fclkdiv
= (fclkdiv
& ~(FTMRX_FCLKDIV_FDIV_MASK
)) | FTMRX_FCLKDIV_FDIV(flash_clk_div
);
422 result
= target_write_u8(target
, kinfo
->ftmrx_fclkdiv_addr
, fclkdiv
);
423 if (result
!= ERROR_OK
)
426 /* Locked. Check if the current value is correct. */
427 if ((fclkdiv
& FTMRX_FCLKDIV_FDIV_MASK
) != FTMRX_FCLKDIV_FDIV(flash_clk_div
)) {
428 LOG_WARNING("Flash clock register is locked and contains an invalid value.");
429 LOG_WARNING("Please reset the target.");
434 LOG_INFO("Flash clock ready");
438 static int kinetis_ke_stop_watchdog(struct target
*target
)
440 struct working_area
*watchdog_algorithm
;
441 struct armv7m_algorithm armv7m_info
;
445 static const uint8_t watchdog_code
[] = {
446 #include "../../../contrib/loaders/flash/kinetis_ke/kinetis_ke_watchdog.inc"
449 if (target
->state
!= TARGET_HALTED
) {
450 LOG_ERROR("Target not halted");
451 return ERROR_TARGET_NOT_HALTED
;
454 /* Check if the watchdog is enabled */
455 retval
= target_read_u8(target
, WDOG_CS1
, &cs1
);
456 if (retval
!= ERROR_OK
)
460 /* Already stopped */
464 /* allocate working area with watchdog code */
465 if (target_alloc_working_area(target
, sizeof(watchdog_code
), &watchdog_algorithm
) != ERROR_OK
) {
466 LOG_WARNING("No working area available for watchdog algorithm");
467 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
470 retval
= target_write_buffer(target
, watchdog_algorithm
->address
,
471 sizeof(watchdog_code
), watchdog_code
);
472 if (retval
!= ERROR_OK
)
475 armv7m_info
.common_magic
= ARMV7M_COMMON_MAGIC
;
476 armv7m_info
.core_mode
= ARM_MODE_THREAD
;
478 retval
= target_run_algorithm(target
, 0, NULL
, 0, NULL
,
479 watchdog_algorithm
->address
, 0, 100000, &armv7m_info
);
480 if (retval
!= ERROR_OK
) {
481 LOG_ERROR("Error executing Kinetis KE watchdog algorithm");
483 LOG_INFO("Watchdog stopped");
486 target_free_working_area(target
, watchdog_algorithm
);
491 COMMAND_HANDLER(kinetis_ke_disable_wdog_handler
)
493 struct target
*target
= get_current_target(CMD_CTX
);
496 return ERROR_COMMAND_SYNTAX_ERROR
;
498 return kinetis_ke_stop_watchdog(target
);
501 COMMAND_HANDLER(kinetis_ke_mdm_mass_erase
)
503 struct target
*target
= get_current_target(CMD_CTX
);
504 struct cortex_m_common
*cortex_m
= target_to_cm(target
);
505 struct adiv5_dap
*dap
= cortex_m
->armv7m
.arm
.dap
;
508 LOG_ERROR("Cannot perform mass erase with a high-level adapter");
514 /* According to chapter 18.3.7.2 of the KE02 reference manual */
517 if (jtag_get_reset_config() & RESET_HAS_SRST
)
518 adapter_assert_reset();
521 * 1. Reset the device by asserting RESET pin or DAP_CTRL[3]
523 retval
= kinetis_ke_mdm_write_register(dap
, MDM_REG_CTRL
, MEM_CTRL_SYS_RES_REQ
);
524 if (retval
!= ERROR_OK
)
528 * ... Read the MDM-AP status register until the Flash Ready bit sets...
530 retval
= kinetis_ke_mdm_poll_register(dap
, MDM_REG_STAT
,
531 MDM_STAT_FREADY
| MDM_STAT_SYSRES
,
533 if (retval
!= ERROR_OK
) {
534 LOG_ERROR("MDM : flash ready timeout");
539 * 2. Set DAP_CTRL[0] bit to invoke debug mass erase via SWD
540 * 3. Release reset by deasserting RESET pin or DAP_CTRL[3] bit via SWD.
542 retval
= kinetis_ke_mdm_write_register(dap
, MDM_REG_CTRL
, MEM_CTRL_FMEIP
);
543 if (retval
!= ERROR_OK
)
546 /* As a sanity check make sure that device started mass erase procedure */
547 retval
= kinetis_ke_mdm_poll_register(dap
, MDM_REG_STAT
,
548 MDM_STAT_FMEACK
, MDM_STAT_FMEACK
);
549 if (retval
!= ERROR_OK
)
553 * 4. Wait till DAP_CTRL[0] bit is cleared (after mass erase completes,
554 * DAP_CTRL[0] bit is cleared automatically).
556 retval
= kinetis_ke_mdm_poll_register(dap
, MDM_REG_CTRL
,
559 if (retval
!= ERROR_OK
)
562 if (jtag_get_reset_config() & RESET_HAS_SRST
)
563 adapter_deassert_reset();
568 static const uint32_t kinetis_ke_known_mdm_ids
[] = {
569 0x001C0020, /* Kinetis-L/M/V/E/KE Series */
573 * This function implements the procedure to connect to
574 * SWD/JTAG on Kinetis K and L series of devices as it is described in
575 * AN4835 "Production Flash Programming Best Practices for Kinetis K-
576 * and L-series MCUs" Section 4.1.1
578 COMMAND_HANDLER(kinetis_ke_check_flash_security_status
)
580 struct target
*target
= get_current_target(CMD_CTX
);
581 struct cortex_m_common
*cortex_m
= target_to_cm(target
);
582 struct adiv5_dap
*dap
= cortex_m
->armv7m
.arm
.dap
;
585 LOG_WARNING("Cannot check flash security status with a high-level adapter");
593 * ... The MDM-AP ID register can be read to verify that the
594 * connection is working correctly...
596 retval
= kinetis_ke_mdm_read_register(dap
, MDM_REG_ID
, &val
);
597 if (retval
!= ERROR_OK
) {
598 LOG_ERROR("MDM: failed to read ID register");
603 for (size_t i
= 0; i
< ARRAY_SIZE(kinetis_ke_known_mdm_ids
); i
++) {
604 if (val
== kinetis_ke_known_mdm_ids
[i
]) {
611 LOG_WARNING("MDM: unknown ID %08" PRIX32
, val
);
614 * ... Read the MDM-AP status register until the Flash Ready bit sets...
616 retval
= kinetis_ke_mdm_poll_register(dap
, MDM_REG_STAT
,
619 if (retval
!= ERROR_OK
) {
620 LOG_ERROR("MDM: flash ready timeout");
625 * ... Read the System Security bit to determine if security is enabled.
626 * If System Security = 0, then proceed. If System Security = 1, then
627 * communication with the internals of the processor, including the
628 * flash, will not be possible without issuing a mass erase command or
629 * unsecuring the part through other means (backdoor key unlock)...
631 retval
= kinetis_ke_mdm_read_register(dap
, MDM_REG_STAT
, &val
);
632 if (retval
!= ERROR_OK
) {
633 LOG_ERROR("MDM: failed to read MDM_REG_STAT");
637 if (val
& MDM_STAT_SYSSEC
) {
638 jtag_poll_set_enabled(false);
640 LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
641 LOG_WARNING("**** ****");
642 LOG_WARNING("**** Your Kinetis MCU is in secured state, which means that, ****");
643 LOG_WARNING("**** with exception for very basic communication, JTAG/SWD ****");
644 LOG_WARNING("**** interface will NOT work. In order to restore its ****");
645 LOG_WARNING("**** functionality please issue 'kinetis_ke mdm mass_erase' ****");
646 LOG_WARNING("**** command, power cycle the MCU and restart OpenOCD. ****");
647 LOG_WARNING("**** ****");
648 LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
650 LOG_INFO("MDM: Chip is unsecured. Continuing.");
651 jtag_poll_set_enabled(true);
657 LOG_ERROR("MDM: Failed to check security status of the MCU. Cannot proceed further");
658 jtag_poll_set_enabled(false);
662 FLASH_BANK_COMMAND_HANDLER(kinetis_ke_flash_bank_command
)
664 struct kinetis_ke_flash_bank
*bank_info
;
667 return ERROR_COMMAND_SYNTAX_ERROR
;
669 LOG_INFO("add flash_bank kinetis_ke %s", bank
->name
);
671 bank_info
= malloc(sizeof(struct kinetis_ke_flash_bank
));
673 memset(bank_info
, 0, sizeof(struct kinetis_ke_flash_bank
));
675 bank
->driver_priv
= bank_info
;
680 /* Kinetis Program-LongWord Microcodes */
681 static uint8_t kinetis_ke_flash_write_code
[] = {
682 #include "../../../contrib/loaders/flash/kinetis_ke/kinetis_ke_flash.inc"
685 static int kinetis_ke_write_words(struct flash_bank
*bank
, const uint8_t *buffer
,
686 uint32_t offset
, uint32_t words
)
688 struct kinetis_ke_flash_bank
*kinfo
= bank
->driver_priv
;
689 struct target
*target
= bank
->target
;
690 uint32_t ram_buffer_size
= 512 + 16;
691 struct working_area
*write_algorithm
;
692 struct working_area
*source
;
693 uint32_t address
= bank
->base
+ offset
;
694 struct reg_param reg_params
[4];
695 struct armv7m_algorithm armv7m_info
;
696 int retval
= ERROR_OK
;
697 uint32_t flash_code_size
;
699 LOG_INFO("Kinetis KE: FLASH Write ...");
701 /* allocate working area with flash programming code */
702 if (target_alloc_working_area(target
, sizeof(kinetis_ke_flash_write_code
),
703 &write_algorithm
) != ERROR_OK
) {
704 LOG_WARNING("no working area available, can't do block memory writes");
705 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
708 /* Patch the FTMRx registers addresses */
709 flash_code_size
= sizeof(kinetis_ke_flash_write_code
);
710 buf_set_u32(&kinetis_ke_flash_write_code
[flash_code_size
-16], 0, 32, kinfo
->ftmrx_fstat_addr
);
711 buf_set_u32(&kinetis_ke_flash_write_code
[flash_code_size
-12], 0, 32, kinfo
->ftmrx_fccobix_addr
);
712 buf_set_u32(&kinetis_ke_flash_write_code
[flash_code_size
-8], 0, 32, kinfo
->ftmrx_fccobhi_addr
);
713 buf_set_u32(&kinetis_ke_flash_write_code
[flash_code_size
-4], 0, 32, kinfo
->ftmrx_fccoblo_addr
);
715 retval
= target_write_buffer(target
, write_algorithm
->address
,
716 sizeof(kinetis_ke_flash_write_code
), kinetis_ke_flash_write_code
);
717 if (retval
!= ERROR_OK
)
721 if (target_alloc_working_area(target
, ram_buffer_size
, &source
) != ERROR_OK
) {
722 /* free working area, write algorithm already allocated */
723 target_free_working_area(target
, write_algorithm
);
725 LOG_WARNING("No large enough working area available, can't do block memory writes");
726 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
729 armv7m_info
.common_magic
= ARMV7M_COMMON_MAGIC
;
730 armv7m_info
.core_mode
= ARM_MODE_THREAD
;
732 init_reg_param(®_params
[0], "r0", 32, PARAM_IN_OUT
);
733 init_reg_param(®_params
[1], "r1", 32, PARAM_OUT
);
734 init_reg_param(®_params
[2], "r2", 32, PARAM_OUT
);
735 init_reg_param(®_params
[3], "r3", 32, PARAM_OUT
);
737 buf_set_u32(reg_params
[0].value
, 0, 32, address
);
738 buf_set_u32(reg_params
[1].value
, 0, 32, words
);
739 buf_set_u32(reg_params
[2].value
, 0, 32, source
->address
);
740 buf_set_u32(reg_params
[3].value
, 0, 32, source
->address
+ source
->size
);
742 retval
= target_run_flash_async_algorithm(target
, buffer
, words
, 4,
745 source
->address
, source
->size
,
746 write_algorithm
->address
, 0,
749 if (retval
== ERROR_FLASH_OPERATION_FAILED
) {
750 if (buf_get_u32(reg_params
[0].value
, 0, 32) & FTMRX_ERROR_ACCERR
)
751 LOG_ERROR("flash access error");
753 if (buf_get_u32(reg_params
[0].value
, 0, 32) & FTMRX_ERROR_FPVIOL
)
754 LOG_ERROR("flash protection violation");
757 target_free_working_area(target
, source
);
758 target_free_working_area(target
, write_algorithm
);
760 destroy_reg_param(®_params
[0]);
761 destroy_reg_param(®_params
[1]);
762 destroy_reg_param(®_params
[2]);
763 destroy_reg_param(®_params
[3]);
768 static int kinetis_ke_protect(struct flash_bank
*bank
, int set
,
769 unsigned int first
, unsigned int last
)
771 LOG_WARNING("kinetis_ke_protect not supported yet");
774 if (bank
->target
->state
!= TARGET_HALTED
) {
775 LOG_ERROR("Target not halted");
776 return ERROR_TARGET_NOT_HALTED
;
779 return ERROR_FLASH_BANK_INVALID
;
782 static int kinetis_ke_protect_check(struct flash_bank
*bank
)
784 struct kinetis_ke_flash_bank
*kinfo
= bank
->driver_priv
;
786 if (bank
->target
->state
!= TARGET_HALTED
) {
787 LOG_ERROR("Target not halted");
788 return ERROR_TARGET_NOT_HALTED
;
793 uint8_t fpopen
, fpldis
, fphdis
;
795 uint32_t lprot_size
= 0, hprot_size
= 0;
796 uint32_t lprot_to
= 0, hprot_from
= 0;
798 /* read protection register */
799 result
= target_read_u8(bank
->target
, kinfo
->ftmrx_fprot_addr
, &fprot
);
801 if (result
!= ERROR_OK
)
804 fpopen
= fprot
& 0x80;
805 fpldis
= fprot
& 0x04;
806 fphdis
= fprot
& 0x20;
807 fphs
= (fprot
>> 3) & 0x03;
810 /* Fully unprotected? */
811 if (fpopen
&& fpldis
&& fphdis
) {
812 LOG_WARNING("No flash protection found.");
814 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++)
815 bank
->sectors
[i
].is_protected
= 0;
817 kinfo
->protection_size
= 0;
819 LOG_WARNING("Flash protected. FPOPEN=%i FPLDIS=%i FPHDIS=%i FPLS=%i FPHS=%i",
820 fpopen
? 1 : 0, fpldis
? 1 : 0, fphdis
? 1 : 0, fpls
, fphs
);
822 /* Retrieve which region is protected and how much */
825 lprot_size
= (kinfo
->sector_size
* 4) << fpls
;
828 hprot_size
= (kinfo
->sector_size
* 2) << fphs
;
831 lprot_size
= (kinfo
->sector_size
* 4) << fpls
;
834 hprot_size
= (kinfo
->sector_size
* 2) << fphs
;
837 kinfo
->protection_size
= lprot_size
+ hprot_size
;
839 /* lprot_to indicates up to where the lower region is protected */
840 lprot_to
= lprot_size
/ kinfo
->sector_size
;
842 /* hprot_from indicates from where the upper region is protected */
843 hprot_from
= (0x8000 - hprot_size
) / kinfo
->sector_size
;
845 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++) {
847 /* Check if the sector is in the lower region */
848 if (bank
->sectors
[i
].offset
< 0x4000) {
849 /* Compare the sector start address against lprot_to */
850 if (lprot_to
&& (i
< lprot_to
))
851 bank
->sectors
[i
].is_protected
= 1;
853 bank
->sectors
[i
].is_protected
= 0;
855 /* Check if the sector is between the lower and upper region
856 * OR after the upper region */
857 } else if (bank
->sectors
[i
].offset
< 0x6000 || bank
->sectors
[i
].offset
>= 0x8000) {
858 /* If fpopen is 1 then these regions are protected */
860 bank
->sectors
[i
].is_protected
= 0;
862 bank
->sectors
[i
].is_protected
= 1;
864 /* Check if the sector is in the upper region */
865 } else if (bank
->sectors
[i
].offset
< 0x8000) {
866 if (hprot_from
&& (i
> hprot_from
))
867 bank
->sectors
[i
].is_protected
= 1;
869 bank
->sectors
[i
].is_protected
= 0;
877 static int kinetis_ke_ftmrx_command(struct flash_bank
*bank
, uint8_t count
,
878 uint8_t *FCCOBIX
, uint8_t *FCCOBHI
, uint8_t *FCCOBLO
, uint8_t *fstat
)
882 struct target
*target
= bank
->target
;
883 struct kinetis_ke_flash_bank
*kinfo
= bank
->driver_priv
;
884 uint32_t timeout
= 0;
886 /* Clear error flags */
887 result
= target_write_u8(target
, kinfo
->ftmrx_fstat_addr
, 0x30);
888 if (result
!= ERROR_OK
)
891 for (i
= 0; i
< count
; i
++) {
893 result
= target_write_u8(target
, kinfo
->ftmrx_fccobix_addr
, FCCOBIX
[i
]);
894 if (result
!= ERROR_OK
)
897 /* Write high part */
898 result
= target_write_u8(target
, kinfo
->ftmrx_fccobhi_addr
, FCCOBHI
[i
]);
899 if (result
!= ERROR_OK
)
902 /* Write low part (that is not always required) */
904 result
= target_write_u8(target
, kinfo
->ftmrx_fccoblo_addr
, FCCOBLO
[i
]);
905 if (result
!= ERROR_OK
)
910 /* Launch the command */
911 result
= target_write_u8(target
, kinfo
->ftmrx_fstat_addr
, 0x80);
912 if (result
!= ERROR_OK
)
915 /* Wait for it to finish */
916 result
= target_read_u8(target
, kinfo
->ftmrx_fstat_addr
, fstat
);
917 if (result
!= ERROR_OK
)
920 while (!(*fstat
& FTMRX_FSTAT_CCIF_MASK
)) {
921 if (timeout
<= 1000) {
925 return ERROR_FLASH_OPERATION_FAILED
;
928 result
= target_read_u8(target
, kinfo
->ftmrx_fstat_addr
, fstat
);
929 if (result
!= ERROR_OK
)
936 static int kinetis_ke_erase(struct flash_bank
*bank
, unsigned int first
,
940 uint8_t FCCOBIX
[2], FCCOBHI
[2], FCCOBLO
[2], fstat
;
941 bool fcf_erased
= false;
943 if (bank
->target
->state
!= TARGET_HALTED
) {
944 LOG_ERROR("Target not halted");
945 return ERROR_TARGET_NOT_HALTED
;
948 if ((first
> bank
->num_sectors
) || (last
> bank
->num_sectors
))
949 return ERROR_FLASH_OPERATION_FAILED
;
951 result
= kinetis_ke_prepare_flash(bank
);
952 if (result
!= ERROR_OK
)
955 for (unsigned int i
= first
; i
<= last
; i
++) {
957 FCCOBHI
[0] = FTMRX_CMD_ERASESECTOR
;
958 FCCOBLO
[0] = (bank
->base
+ bank
->sectors
[i
].offset
) >> 16;
961 FCCOBHI
[1] = (bank
->base
+ bank
->sectors
[i
].offset
) >> 8;
962 FCCOBLO
[1] = (bank
->base
+ bank
->sectors
[i
].offset
);
964 result
= kinetis_ke_ftmrx_command(bank
, 2, FCCOBIX
, FCCOBHI
, FCCOBLO
, &fstat
);
966 if (result
!= ERROR_OK
) {
967 LOG_WARNING("erase sector %u failed", i
);
968 return ERROR_FLASH_OPERATION_FAILED
;
977 ("flash configuration field erased, please reset the device");
983 static int kinetis_ke_write(struct flash_bank
*bank
, const uint8_t *buffer
,
984 uint32_t offset
, uint32_t count
)
987 uint8_t *new_buffer
= NULL
;
988 uint32_t words
= count
/ 4;
990 if (bank
->target
->state
!= TARGET_HALTED
) {
991 LOG_ERROR("Target not halted");
992 return ERROR_TARGET_NOT_HALTED
;
995 if (offset
> bank
->size
)
996 return ERROR_FLASH_BANK_INVALID
;
999 LOG_WARNING("offset 0x%" PRIx32
" breaks the required alignment", offset
);
1000 return ERROR_FLASH_DST_BREAKS_ALIGNMENT
;
1003 result
= kinetis_ke_stop_watchdog(bank
->target
);
1004 if (result
!= ERROR_OK
)
1007 result
= kinetis_ke_prepare_flash(bank
);
1008 if (result
!= ERROR_OK
)
1012 uint32_t old_count
= count
;
1013 count
= (old_count
| 3) + 1;
1014 new_buffer
= malloc(count
);
1016 LOG_ERROR("odd number of bytes to write and no memory "
1017 "for padding buffer");
1021 LOG_INFO("odd number of bytes to write (%" PRIu32
"), extending to %" PRIu32
" "
1022 "and padding with 0xff", old_count
, count
);
1024 memset(new_buffer
, 0xff, count
);
1025 buffer
= memcpy(new_buffer
, buffer
, old_count
);
1029 result
= kinetis_ke_write_words(bank
, buffer
, offset
, words
);
1035 static int kinetis_ke_probe(struct flash_bank
*bank
)
1038 uint32_t offset
= 0;
1039 struct target
*target
= bank
->target
;
1040 struct kinetis_ke_flash_bank
*kinfo
= bank
->driver_priv
;
1042 result
= target_read_u32(target
, SIM_SRSID
, &kinfo
->sim_srsid
);
1043 if (result
!= ERROR_OK
)
1046 if (KINETIS_KE_SRSID_FAMID(kinfo
->sim_srsid
) != 0x00) {
1047 LOG_ERROR("Unsupported KE family");
1048 return ERROR_FLASH_OPER_UNSUPPORTED
;
1051 switch (KINETIS_KE_SRSID_SUBFAMID(kinfo
->sim_srsid
)) {
1052 case KINETIS_KE_SRSID_KEX2
:
1053 LOG_INFO("KE02 sub-family");
1056 case KINETIS_KE_SRSID_KEX4
:
1057 LOG_INFO("KE04 sub-family");
1060 case KINETIS_KE_SRSID_KEX6
:
1061 LOG_INFO("KE06 sub-family");
1065 LOG_ERROR("Unsupported KE sub-family");
1066 return ERROR_FLASH_OPER_UNSUPPORTED
;
1069 /* We can only retrieve the ke0x part, but there is no way to know
1070 * the flash size, so assume the maximum flash size for the entire
1073 bank
->base
= 0x00000000;
1074 kinfo
->sector_size
= 512;
1076 switch (KINETIS_KE_SRSID_SUBFAMID(kinfo
->sim_srsid
)) {
1078 case KINETIS_KE_SRSID_KEX2
:
1080 bank
->size
= 0x00010000;
1081 bank
->num_sectors
= 128;
1083 /* KE02 uses the FTMRH flash controller,
1084 * and registers have a different offset from the
1085 * FTMRE flash controller. Sort this out here.
1087 kinfo
->ftmrx_fclkdiv_addr
= 0x40020000;
1088 kinfo
->ftmrx_fccobix_addr
= 0x40020002;
1089 kinfo
->ftmrx_fstat_addr
= 0x40020006;
1090 kinfo
->ftmrx_fprot_addr
= 0x40020008;
1091 kinfo
->ftmrx_fccobhi_addr
= 0x4002000A;
1092 kinfo
->ftmrx_fccoblo_addr
= 0x4002000B;
1095 case KINETIS_KE_SRSID_KEX6
:
1096 case KINETIS_KE_SRSID_KEX4
:
1098 bank
->size
= 0x00020000;
1099 bank
->num_sectors
= 256;
1101 /* KE04 and KE06 use the FTMRE flash controller,
1102 * and registers have a different offset from the
1103 * FTMRH flash controller. Sort this out here.
1105 kinfo
->ftmrx_fclkdiv_addr
= 0x40020003;
1106 kinfo
->ftmrx_fccobix_addr
= 0x40020001;
1107 kinfo
->ftmrx_fstat_addr
= 0x40020005;
1108 kinfo
->ftmrx_fprot_addr
= 0x4002000B;
1109 kinfo
->ftmrx_fccobhi_addr
= 0x40020009;
1110 kinfo
->ftmrx_fccoblo_addr
= 0x40020008;
1114 free(bank
->sectors
);
1116 assert(bank
->num_sectors
> 0);
1117 bank
->sectors
= malloc(sizeof(struct flash_sector
) * bank
->num_sectors
);
1119 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++) {
1120 bank
->sectors
[i
].offset
= offset
;
1121 bank
->sectors
[i
].size
= kinfo
->sector_size
;
1122 offset
+= kinfo
->sector_size
;
1123 bank
->sectors
[i
].is_erased
= -1;
1124 bank
->sectors
[i
].is_protected
= 1;
1130 static int kinetis_ke_auto_probe(struct flash_bank
*bank
)
1132 struct kinetis_ke_flash_bank
*kinfo
= bank
->driver_priv
;
1134 if (kinfo
->sim_srsid
)
1137 return kinetis_ke_probe(bank
);
1140 static int kinetis_ke_info(struct flash_bank
*bank
, struct command_invocation
*cmd
)
1142 command_print_sameline(cmd
, "%s driver for flash bank %s at " TARGET_ADDR_FMT
,
1143 bank
->driver
->name
, bank
->name
, bank
->base
);
1148 static int kinetis_ke_blank_check(struct flash_bank
*bank
)
1150 uint8_t FCCOBIX
[3], FCCOBHI
[3], FCCOBLO
[3], fstat
;
1151 uint16_t longwords
= 0;
1154 if (bank
->target
->state
!= TARGET_HALTED
) {
1155 LOG_ERROR("Target not halted");
1156 return ERROR_TARGET_NOT_HALTED
;
1159 result
= kinetis_ke_prepare_flash(bank
);
1160 if (result
!= ERROR_OK
)
1163 /* check if whole bank is blank */
1165 FCCOBHI
[0] = FTMRX_CMD_ALLERASED
;
1167 result
= kinetis_ke_ftmrx_command(bank
, 1, FCCOBIX
, FCCOBHI
, NULL
, &fstat
);
1169 if (result
!= ERROR_OK
)
1172 if (fstat
& (FTMRX_FSTAT_MGSTAT0_MASK
| FTMRX_FSTAT_MGSTAT1_MASK
)) {
1173 /* the whole bank is not erased, check sector-by-sector */
1174 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++) {
1176 FCCOBHI
[0] = FTMRX_CMD_SECTIONERASED
;
1177 FCCOBLO
[0] = (bank
->base
+ bank
->sectors
[i
].offset
) >> 16;
1180 FCCOBHI
[1] = (bank
->base
+ bank
->sectors
[i
].offset
) >> 8;
1181 FCCOBLO
[1] = (bank
->base
+ bank
->sectors
[i
].offset
);
1186 FCCOBHI
[2] = longwords
>> 8;
1187 FCCOBLO
[2] = longwords
;
1189 result
= kinetis_ke_ftmrx_command(bank
, 3, FCCOBIX
, FCCOBHI
, FCCOBLO
, &fstat
);
1191 if (result
== ERROR_OK
) {
1192 bank
->sectors
[i
].is_erased
= !(fstat
& (FTMRX_FSTAT_MGSTAT0_MASK
| FTMRX_FSTAT_MGSTAT1_MASK
));
1194 LOG_DEBUG("Ignoring error on PFlash sector blank-check");
1195 bank
->sectors
[i
].is_erased
= -1;
1199 /* the whole bank is erased, update all sectors */
1200 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++)
1201 bank
->sectors
[i
].is_erased
= 1;
1207 static const struct command_registration kinetis_ke_security_command_handlers
[] = {
1209 .name
= "check_security",
1210 .mode
= COMMAND_EXEC
,
1211 .help
= "Check status of device security lock",
1213 .handler
= kinetis_ke_check_flash_security_status
,
1216 .name
= "mass_erase",
1217 .mode
= COMMAND_EXEC
,
1218 .help
= "Issue a complete flash erase via the MDM-AP",
1220 .handler
= kinetis_ke_mdm_mass_erase
,
1222 COMMAND_REGISTRATION_DONE
1225 static const struct command_registration kinetis_ke_exec_command_handlers
[] = {
1228 .mode
= COMMAND_ANY
,
1229 .help
= "MDM-AP command group",
1231 .chain
= kinetis_ke_security_command_handlers
,
1234 .name
= "disable_wdog",
1235 .mode
= COMMAND_EXEC
,
1236 .help
= "Disable the watchdog timer",
1238 .handler
= kinetis_ke_disable_wdog_handler
,
1240 COMMAND_REGISTRATION_DONE
1243 static const struct command_registration kinetis_ke_command_handler
[] = {
1245 .name
= "kinetis_ke",
1246 .mode
= COMMAND_ANY
,
1247 .help
= "Kinetis KE flash controller commands",
1249 .chain
= kinetis_ke_exec_command_handlers
,
1251 COMMAND_REGISTRATION_DONE
1254 const struct flash_driver kinetis_ke_flash
= {
1255 .name
= "kinetis_ke",
1256 .commands
= kinetis_ke_command_handler
,
1257 .flash_bank_command
= kinetis_ke_flash_bank_command
,
1258 .erase
= kinetis_ke_erase
,
1259 .protect
= kinetis_ke_protect
,
1260 .write
= kinetis_ke_write
,
1261 .read
= default_flash_read
,
1262 .probe
= kinetis_ke_probe
,
1263 .auto_probe
= kinetis_ke_auto_probe
,
1264 .erase_check
= kinetis_ke_blank_check
,
1265 .protect_check
= kinetis_ke_protect_check
,
1266 .info
= kinetis_ke_info
,
1267 .free_driver_priv
= default_flash_free_driver_priv
,
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)