1 /***************************************************************************
2 * Copyright (C) 2015 by Ivan Meleca *
5 * Modified from kinetis.c *
7 * Copyright (C) 2011 by Mathias Kuester *
10 * Copyright (C) 2011 sleep(5) ltd *
11 * tomas@sleepfive.com *
13 * Copyright (C) 2012 by Christopher D. Kilgour *
14 * techie at whiterocker.com *
16 * Copyright (C) 2013 Nemui Trinomius *
17 * nemuisan_kawausogasuki@live.jp *
19 * Copyright (C) 2015 Tomas Vanek *
22 * This program is free software; you can redistribute it and/or modify *
23 * it under the terms of the GNU General Public License as published by *
24 * the Free Software Foundation; either version 2 of the License, or *
25 * (at your option) any later version. *
27 * This program is distributed in the hope that it will be useful, *
28 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
29 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
30 * GNU General Public License for more details. *
32 * You should have received a copy of the GNU General Public License *
33 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
34 ***************************************************************************/
40 #include "jtag/interface.h"
42 #include <helper/binarybuffer.h>
43 #include <target/algorithm.h>
44 #include <target/armv7m.h>
45 #include <target/cortex_m.h>
48 #define SIM_SRSID 0x40048000
49 #define ICS_C1 0x40064000
50 #define ICS_C2 0x40064001
51 #define ICS_C3 0x40064002
52 #define ICS_C4 0x40064003
53 #define ICS_S 0x40064004
54 #define SIM_BUSDIV 0x40048018
55 #define SIM_CLKDIV_KE06 0x40048024
56 #define SIM_CLKDIV_KE04_44_64_80 0x40048024
57 #define SIM_CLKDIV_KE04_16_20_24 0x4004801C
58 #define WDOG_CS1 0x40052000
60 #define ICS_C2_BDIV_MASK 0xE0
61 #define ICS_C2_BDIV_SHIFT 5
62 #define ICS_C2_BDIV(x) (((uint8_t)(((uint8_t)(x))<<ICS_C2_BDIV_SHIFT))&ICS_C2_BDIV_MASK)
63 #define ICS_S_LOCK_MASK 0x40
64 #define ICS_C4_SCFTRIM_MASK 0x1
65 #define SIM_CLKDIV_OUTDIV2_MASK 0x1000000
66 #define FTMRX_FCLKDIV_FDIV_MASK 0x3F
67 #define FTMRX_FCLKDIV_FDIV_SHIFT 0
68 #define FTMRX_FCLKDIV_FDIV(x) (((uint8_t)(((uint8_t)(x))<<FTMRX_FCLKDIV_FDIV_SHIFT))&FTMRX_FCLKDIV_FDIV_MASK)
69 #define FTMRX_FCLKDIV_FDIVLCK_MASK 0x40
70 #define FTMRX_FCLKDIV_FDIVLCK_SHIFT 6
71 #define FTMRX_FCLKDIV_FDIVLD_MASK 0x80
72 #define FTMRX_FCLKDIV_FDIVLD_SHIFT 7
73 #define FTMRX_FSTAT_CCIF_MASK 0x80
74 #define FTMRX_FSTAT_MGSTAT0_MASK 0x01
75 #define FTMRX_FSTAT_MGSTAT1_MASK 0x02
78 #define FTMRX_CMD_ALLERASED 0x01
79 #define FTMRX_CMD_BLOCKERASED 0x02
80 #define FTMRX_CMD_SECTIONERASED 0x03
81 #define FTMRX_CMD_READONCE 0x04
82 #define FTMRX_CMD_PROGFLASH 0x06
83 #define FTMRX_CMD_PROGONCE 0x07
84 #define FTMRX_CMD_ERASEALL 0x08
85 #define FTMRX_CMD_ERASEBLOCK 0x09
86 #define FTMRX_CMD_ERASESECTOR 0x0A
87 #define FTMRX_CMD_UNSECURE 0x0B
88 #define FTMRX_CMD_VERIFYACCESS 0x0C
89 #define FTMRX_CMD_SETMARGINLVL 0x0D
90 #define FTMRX_CMD_SETFACTORYLVL 0x0E
91 #define FTMRX_CMD_CONFIGNVM 0x0F
94 #define FTMRX_ERROR_ACCERR 0x20
95 #define FTMRX_ERROR_FPVIOL 0x10
97 #define KINETIS_KE_SRSID_FAMID(x) ((x >> 28) & 0x0F)
98 #define KINETIS_KE_SRSID_SUBFAMID(x) ((x >> 24) & 0x0F)
99 #define KINETIS_KE_SRSID_PINCOUNT(x) ((x >> 16) & 0x0F)
101 #define KINETIS_KE_SRSID_KEX2 0x02
102 #define KINETIS_KE_SRSID_KEX4 0x04
103 #define KINETIS_KE_SRSID_KEX6 0x06
105 struct kinetis_ke_flash_bank
{
106 uint32_t sector_size
;
107 uint32_t protection_size
;
110 uint32_t ftmrx_fclkdiv_addr
;
111 uint32_t ftmrx_fccobix_addr
;
112 uint32_t ftmrx_fstat_addr
;
113 uint32_t ftmrx_fprot_addr
;
114 uint32_t ftmrx_fccobhi_addr
;
115 uint32_t ftmrx_fccoblo_addr
;
118 #define MDM_REG_STAT 0x00
119 #define MDM_REG_CTRL 0x04
120 #define MDM_REG_ID 0xfc
122 #define MDM_STAT_FMEACK (1<<0)
123 #define MDM_STAT_FREADY (1<<1)
124 #define MDM_STAT_SYSSEC (1<<2)
125 #define MDM_STAT_SYSRES (1<<3)
126 #define MDM_STAT_FMEEN (1<<5)
127 #define MDM_STAT_BACKDOOREN (1<<6)
128 #define MDM_STAT_LPEN (1<<7)
129 #define MDM_STAT_VLPEN (1<<8)
130 #define MDM_STAT_LLSMODEXIT (1<<9)
131 #define MDM_STAT_VLLSXMODEXIT (1<<10)
132 #define MDM_STAT_CORE_HALTED (1<<16)
133 #define MDM_STAT_CORE_SLEEPDEEP (1<<17)
134 #define MDM_STAT_CORESLEEPING (1<<18)
136 #define MEM_CTRL_FMEIP (1<<0)
137 #define MEM_CTRL_DBG_DIS (1<<1)
138 #define MEM_CTRL_DBG_REQ (1<<2)
139 #define MEM_CTRL_SYS_RES_REQ (1<<3)
140 #define MEM_CTRL_CORE_HOLD_RES (1<<4)
141 #define MEM_CTRL_VLLSX_DBG_REQ (1<<5)
142 #define MEM_CTRL_VLLSX_DBG_ACK (1<<6)
143 #define MEM_CTRL_VLLSX_STAT_ACK (1<<7)
145 #define MDM_ACCESS_TIMEOUT 3000 /* iterations */
147 static int kinetis_ke_mdm_write_register(struct adiv5_dap
*dap
, unsigned reg
, uint32_t value
)
150 LOG_DEBUG("MDM_REG[0x%02x] <- %08" PRIX32
, reg
, value
);
152 retval
= dap_queue_ap_write(dap_ap(dap
, 1), reg
, value
);
153 if (retval
!= ERROR_OK
) {
154 LOG_DEBUG("MDM: failed to queue a write request");
158 retval
= dap_run(dap
);
159 if (retval
!= ERROR_OK
) {
160 LOG_DEBUG("MDM: dap_run failed");
167 static int kinetis_ke_mdm_read_register(struct adiv5_dap
*dap
, unsigned reg
, uint32_t *result
)
170 retval
= dap_queue_ap_read(dap_ap(dap
, 1), reg
, result
);
171 if (retval
!= ERROR_OK
) {
172 LOG_DEBUG("MDM: failed to queue a read request");
176 retval
= dap_run(dap
);
177 if (retval
!= ERROR_OK
) {
178 LOG_DEBUG("MDM: dap_run failed");
182 LOG_DEBUG("MDM_REG[0x%02x]: %08" PRIX32
, reg
, *result
);
186 static int kinetis_ke_mdm_poll_register(struct adiv5_dap
*dap
, unsigned reg
, uint32_t mask
, uint32_t value
)
190 int timeout
= MDM_ACCESS_TIMEOUT
;
193 retval
= kinetis_ke_mdm_read_register(dap
, reg
, &val
);
194 if (retval
!= ERROR_OK
|| (val
& mask
) == value
)
200 LOG_DEBUG("MDM: polling timed out");
204 static int kinetis_ke_prepare_flash(struct flash_bank
*bank
)
206 struct target
*target
= bank
->target
;
207 struct kinetis_ke_flash_bank
*kinfo
= bank
->driver_priv
;
208 uint8_t c2
, c3
, c4
, s
= 0;
209 uint16_t trim_value
= 0;
210 uint16_t timeout
= 0;
211 uint32_t bus_clock
= 0;
212 uint32_t bus_reg_val
= 0;
213 uint32_t bus_reg_addr
= 0;
214 uint32_t flash_clk_div
;
219 * The RM states that the flash clock has to be set to 1MHz for writing and
220 * erasing operations (otherwise it can damage the flash).
221 * This function configures the entire clock tree to make sure we
222 * run at the specified clock. We'll set FEI mode running from the ~32KHz
223 * internal clock. So we need to:
224 * - Trim internal clock.
225 * - Configure the divider for ICSOUTCLK (ICS module).
226 * - Configure the divider to get a bus clock (SIM module).
227 * - Configure the flash clock that depends on the bus clock.
229 * For MKE02_40 and MKE02_20 we set ICSOUTCLK = 20MHz and bus clock = 20MHz.
230 * For MKE04 and MKE06 we run at ICSOUTCLK = 48MHz and bus clock = 24MHz.
234 * Trim internal clock
236 switch (KINETIS_KE_SRSID_SUBFAMID(kinfo
->sim_srsid
)) {
238 case KINETIS_KE_SRSID_KEX2
:
239 /* Both KE02_20 and KE02_40 should get the same trim value */
243 case KINETIS_KE_SRSID_KEX4
:
247 case KINETIS_KE_SRSID_KEX6
:
252 result
= target_read_u8(target
, ICS_C4
, &c4
);
253 if (result
!= ERROR_OK
)
257 c4
= (c4
& ~(ICS_C4_SCFTRIM_MASK
)) | ((trim_value
>> 8) & 0x01);
259 result
= target_write_u8(target
, ICS_C3
, c3
);
260 if (result
!= ERROR_OK
)
263 result
= target_write_u8(target
, ICS_C4
, c4
);
264 if (result
!= ERROR_OK
)
267 result
= target_read_u8(target
, ICS_S
, &s
);
268 if (result
!= ERROR_OK
)
272 while (!(s
& ICS_S_LOCK_MASK
)) {
274 if (timeout
<= 1000) {
281 result
= target_read_u8(target
, ICS_S
, &s
);
282 if (result
!= ERROR_OK
)
286 /* ... trim done ... */
289 * Configure SIM (bus clock)
291 switch (KINETIS_KE_SRSID_SUBFAMID(kinfo
->sim_srsid
)) {
293 /* KE02 sub-family operates on SIM_BUSDIV */
294 case KINETIS_KE_SRSID_KEX2
:
296 bus_reg_addr
= SIM_BUSDIV
;
297 bus_clock
= 20000000;
300 /* KE04 and KE06 sub-family operates on SIM_CLKDIV
301 * Clocks are divided by:
302 * DIV1 = core clock = 48MHz
303 * DIV2 = bus clock = 24Mhz
304 * DIV3 = timer clocks
305 * So we need to configure SIM_CLKDIV, DIV1 and DIV2 value
307 case KINETIS_KE_SRSID_KEX4
:
308 /* KE04 devices have the SIM_CLKDIV register at a different offset
309 * depending on the pin count. */
310 switch (KINETIS_KE_SRSID_PINCOUNT(kinfo
->sim_srsid
)) {
312 /* 16, 20 and 24 pins */
316 bus_reg_addr
= SIM_CLKDIV_KE04_16_20_24
;
319 /* 44, 64 and 80 pins */
323 bus_reg_addr
= SIM_CLKDIV_KE04_44_64_80
;
327 LOG_ERROR("KE04 - Unknown pin count");
331 bus_reg_val
= SIM_CLKDIV_OUTDIV2_MASK
;
332 bus_clock
= 24000000;
335 case KINETIS_KE_SRSID_KEX6
:
336 bus_reg_val
= SIM_CLKDIV_OUTDIV2_MASK
;
337 bus_reg_addr
= SIM_CLKDIV_KE06
;
338 bus_clock
= 24000000;
342 result
= target_write_u32(target
, bus_reg_addr
, bus_reg_val
);
343 if (result
!= ERROR_OK
)
347 * Configure ICS to FEI (internal source)
349 result
= target_read_u8(target
, ICS_C2
, &c2
);
350 if (result
!= ERROR_OK
)
353 c2
&= ~ICS_C2_BDIV_MASK
;
355 switch (KINETIS_KE_SRSID_SUBFAMID(kinfo
->sim_srsid
)) {
357 case KINETIS_KE_SRSID_KEX2
:
358 /* Note: since there are two KE02 types, the KE02_40 @ 40MHz and the
359 * KE02_20 @ 20MHz, we divide here the ~40MHz ICSFLLCLK down to 20MHz,
362 c2
|= ICS_C2_BDIV(1);
365 case KINETIS_KE_SRSID_KEX4
:
366 case KINETIS_KE_SRSID_KEX6
:
367 /* For KE04 and KE06, the ICSFLLCLK can be 48MHz. */
368 c2
|= ICS_C2_BDIV(0);
372 result
= target_write_u8(target
, ICS_C2
, c2
);
373 if (result
!= ERROR_OK
)
376 /* Internal clock as reference (IREFS = 1) */
377 result
= target_write_u8(target
, ICS_C1
, 4);
378 if (result
!= ERROR_OK
)
381 /* Wait for FLL to lock */
382 result
= target_read_u8(target
, ICS_S
, &s
);
383 if (result
!= ERROR_OK
)
386 while (!(s
& ICS_S_LOCK_MASK
)) {
388 if (timeout
<= 1000) {
392 return ERROR_FLASH_OPERATION_FAILED
;
395 result
= target_read_u8(target
, ICS_S
, &s
);
396 if (result
!= ERROR_OK
)
401 * Configure flash clock to 1MHz.
403 flash_clk_div
= bus_clock
/ 1000000L - 1;
405 /* Check if the FCLKDIV register is locked */
406 result
= target_read_u8(target
, kinfo
->ftmrx_fclkdiv_addr
, &fclkdiv
);
407 if (result
!= ERROR_OK
)
410 if (!(fclkdiv
& FTMRX_FCLKDIV_FDIVLCK_MASK
)) {
411 /* Unlocked. Check if the register was configured, and if so, if it has the right value */
412 if ((fclkdiv
& FTMRX_FCLKDIV_FDIVLD_MASK
) &&
413 ((fclkdiv
& FTMRX_FCLKDIV_FDIV_MASK
) != FTMRX_FCLKDIV_FDIV(flash_clk_div
))) {
414 LOG_WARNING("Flash clock was already set and contains an invalid value.");
415 LOG_WARNING("Please reset the target.");
419 /* Finally, configure the flash clock */
420 fclkdiv
= (fclkdiv
& ~(FTMRX_FCLKDIV_FDIV_MASK
)) | FTMRX_FCLKDIV_FDIV(flash_clk_div
);
421 result
= target_write_u8(target
, kinfo
->ftmrx_fclkdiv_addr
, fclkdiv
);
422 if (result
!= ERROR_OK
)
425 /* Locked. Check if the current value is correct. */
426 if ((fclkdiv
& FTMRX_FCLKDIV_FDIV_MASK
) != FTMRX_FCLKDIV_FDIV(flash_clk_div
)) {
427 LOG_WARNING("Flash clock register is locked and contains an invalid value.");
428 LOG_WARNING("Please reset the target.");
433 LOG_INFO("Flash clock ready");
437 int kinetis_ke_stop_watchdog(struct target
*target
)
439 struct working_area
*watchdog_algorithm
;
440 struct armv7m_algorithm armv7m_info
;
444 static const uint8_t watchdog_code
[] = {
445 #include "../../../contrib/loaders/flash/kinetis_ke/kinetis_ke_watchdog.inc"
448 if (target
->state
!= TARGET_HALTED
) {
449 LOG_ERROR("Target not halted");
450 return ERROR_TARGET_NOT_HALTED
;
453 /* Check if the watchdog is enabled */
454 retval
= target_read_u8(target
, WDOG_CS1
, &cs1
);
455 if (retval
!= ERROR_OK
)
459 /* Already stopped */
463 /* allocate working area with watchdog code */
464 if (target_alloc_working_area(target
, sizeof(watchdog_code
), &watchdog_algorithm
) != ERROR_OK
) {
465 LOG_WARNING("No working area available for watchdog algorithm");
466 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
469 retval
= target_write_buffer(target
, watchdog_algorithm
->address
,
470 sizeof(watchdog_code
), watchdog_code
);
471 if (retval
!= ERROR_OK
)
474 armv7m_info
.common_magic
= ARMV7M_COMMON_MAGIC
;
475 armv7m_info
.core_mode
= ARM_MODE_THREAD
;
477 retval
= target_run_algorithm(target
, 0, NULL
, 0, NULL
,
478 watchdog_algorithm
->address
, 0, 100000, &armv7m_info
);
479 if (retval
!= ERROR_OK
) {
480 LOG_ERROR("Error executing Kinetis KE watchdog algorithm");
482 LOG_INFO("Watchdog stopped");
485 target_free_working_area(target
, watchdog_algorithm
);
490 COMMAND_HANDLER(kinetis_ke_disable_wdog_handler
)
492 struct target
*target
= get_current_target(CMD_CTX
);
495 return ERROR_COMMAND_SYNTAX_ERROR
;
497 return kinetis_ke_stop_watchdog(target
);
500 COMMAND_HANDLER(kinetis_ke_mdm_mass_erase
)
502 struct target
*target
= get_current_target(CMD_CTX
);
503 struct cortex_m_common
*cortex_m
= target_to_cm(target
);
504 struct adiv5_dap
*dap
= cortex_m
->armv7m
.arm
.dap
;
507 LOG_ERROR("Cannot perform mass erase with a high-level adapter");
513 /* According to chapter 18.3.7.2 of the KE02 reference manual */
516 if (jtag_get_reset_config() & RESET_HAS_SRST
)
517 adapter_assert_reset();
520 * 1. Reset the device by asserting RESET pin or DAP_CTRL[3]
522 retval
= kinetis_ke_mdm_write_register(dap
, MDM_REG_CTRL
, MEM_CTRL_SYS_RES_REQ
);
523 if (retval
!= ERROR_OK
)
527 * ... Read the MDM-AP status register until the Flash Ready bit sets...
529 retval
= kinetis_ke_mdm_poll_register(dap
, MDM_REG_STAT
,
530 MDM_STAT_FREADY
| MDM_STAT_SYSRES
,
532 if (retval
!= ERROR_OK
) {
533 LOG_ERROR("MDM : flash ready timeout");
538 * 2. Set DAP_CTRL[0] bit to invoke debug mass erase via SWD
539 * 3. Release reset by deasserting RESET pin or DAP_CTRL[3] bit via SWD.
541 retval
= kinetis_ke_mdm_write_register(dap
, MDM_REG_CTRL
, MEM_CTRL_FMEIP
);
542 if (retval
!= ERROR_OK
)
545 /* As a sanity check make sure that device started mass erase procedure */
546 retval
= kinetis_ke_mdm_poll_register(dap
, MDM_REG_STAT
,
547 MDM_STAT_FMEACK
, MDM_STAT_FMEACK
);
548 if (retval
!= ERROR_OK
)
552 * 4. Wait till DAP_CTRL[0] bit is cleared (after mass erase completes,
553 * DAP_CTRL[0] bit is cleared automatically).
555 retval
= kinetis_ke_mdm_poll_register(dap
, MDM_REG_CTRL
,
558 if (retval
!= ERROR_OK
)
561 if (jtag_get_reset_config() & RESET_HAS_SRST
)
562 adapter_deassert_reset();
567 static const uint32_t kinetis_ke_known_mdm_ids
[] = {
568 0x001C0020, /* Kinetis-L/M/V/E/KE Series */
572 * This function implements the procedure to connect to
573 * SWD/JTAG on Kinetis K and L series of devices as it is described in
574 * AN4835 "Production Flash Programming Best Practices for Kinetis K-
575 * and L-series MCUs" Section 4.1.1
577 COMMAND_HANDLER(kinetis_ke_check_flash_security_status
)
579 struct target
*target
= get_current_target(CMD_CTX
);
580 struct cortex_m_common
*cortex_m
= target_to_cm(target
);
581 struct adiv5_dap
*dap
= cortex_m
->armv7m
.arm
.dap
;
584 LOG_WARNING("Cannot check flash security status with a high-level adapter");
592 * ... The MDM-AP ID register can be read to verify that the
593 * connection is working correctly...
595 retval
= kinetis_ke_mdm_read_register(dap
, MDM_REG_ID
, &val
);
596 if (retval
!= ERROR_OK
) {
597 LOG_ERROR("MDM: failed to read ID register");
602 for (size_t i
= 0; i
< ARRAY_SIZE(kinetis_ke_known_mdm_ids
); i
++) {
603 if (val
== kinetis_ke_known_mdm_ids
[i
]) {
610 LOG_WARNING("MDM: unknown ID %08" PRIX32
, val
);
613 * ... Read the MDM-AP status register until the Flash Ready bit sets...
615 retval
= kinetis_ke_mdm_poll_register(dap
, MDM_REG_STAT
,
618 if (retval
!= ERROR_OK
) {
619 LOG_ERROR("MDM: flash ready timeout");
624 * ... Read the System Security bit to determine if security is enabled.
625 * If System Security = 0, then proceed. If System Security = 1, then
626 * communication with the internals of the processor, including the
627 * flash, will not be possible without issuing a mass erase command or
628 * unsecuring the part through other means (backdoor key unlock)...
630 retval
= kinetis_ke_mdm_read_register(dap
, MDM_REG_STAT
, &val
);
631 if (retval
!= ERROR_OK
) {
632 LOG_ERROR("MDM: failed to read MDM_REG_STAT");
636 if (val
& MDM_STAT_SYSSEC
) {
637 jtag_poll_set_enabled(false);
639 LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
640 LOG_WARNING("**** ****");
641 LOG_WARNING("**** Your Kinetis MCU is in secured state, which means that, ****");
642 LOG_WARNING("**** with exception for very basic communication, JTAG/SWD ****");
643 LOG_WARNING("**** interface will NOT work. In order to restore its ****");
644 LOG_WARNING("**** functionality please issue 'kinetis_ke mdm mass_erase' ****");
645 LOG_WARNING("**** command, power cycle the MCU and restart OpenOCD. ****");
646 LOG_WARNING("**** ****");
647 LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
649 LOG_INFO("MDM: Chip is unsecured. Continuing.");
650 jtag_poll_set_enabled(true);
656 LOG_ERROR("MDM: Failed to check security status of the MCU. Cannot proceed further");
657 jtag_poll_set_enabled(false);
661 FLASH_BANK_COMMAND_HANDLER(kinetis_ke_flash_bank_command
)
663 struct kinetis_ke_flash_bank
*bank_info
;
666 return ERROR_COMMAND_SYNTAX_ERROR
;
668 LOG_INFO("add flash_bank kinetis_ke %s", bank
->name
);
670 bank_info
= malloc(sizeof(struct kinetis_ke_flash_bank
));
672 memset(bank_info
, 0, sizeof(struct kinetis_ke_flash_bank
));
674 bank
->driver_priv
= bank_info
;
679 /* Kinetis Program-LongWord Microcodes */
680 static uint8_t kinetis_ke_flash_write_code
[] = {
681 #include "../../../contrib/loaders/flash/kinetis_ke/kinetis_ke_flash.inc"
684 static int kinetis_ke_write_words(struct flash_bank
*bank
, const uint8_t *buffer
,
685 uint32_t offset
, uint32_t words
)
687 struct kinetis_ke_flash_bank
*kinfo
= bank
->driver_priv
;
688 struct target
*target
= bank
->target
;
689 uint32_t ram_buffer_size
= 512 + 16;
690 struct working_area
*write_algorithm
;
691 struct working_area
*source
;
692 uint32_t address
= bank
->base
+ offset
;
693 struct reg_param reg_params
[4];
694 struct armv7m_algorithm armv7m_info
;
695 int retval
= ERROR_OK
;
696 uint32_t flash_code_size
;
698 LOG_INFO("Kinetis KE: FLASH Write ...");
700 /* allocate working area with flash programming code */
701 if (target_alloc_working_area(target
, sizeof(kinetis_ke_flash_write_code
),
702 &write_algorithm
) != ERROR_OK
) {
703 LOG_WARNING("no working area available, can't do block memory writes");
704 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
707 /* Patch the FTMRx registers addresses */
708 flash_code_size
= sizeof(kinetis_ke_flash_write_code
);
709 buf_set_u32(&kinetis_ke_flash_write_code
[flash_code_size
-16], 0, 32, kinfo
->ftmrx_fstat_addr
);
710 buf_set_u32(&kinetis_ke_flash_write_code
[flash_code_size
-12], 0, 32, kinfo
->ftmrx_fccobix_addr
);
711 buf_set_u32(&kinetis_ke_flash_write_code
[flash_code_size
-8], 0, 32, kinfo
->ftmrx_fccobhi_addr
);
712 buf_set_u32(&kinetis_ke_flash_write_code
[flash_code_size
-4], 0, 32, kinfo
->ftmrx_fccoblo_addr
);
714 retval
= target_write_buffer(target
, write_algorithm
->address
,
715 sizeof(kinetis_ke_flash_write_code
), kinetis_ke_flash_write_code
);
716 if (retval
!= ERROR_OK
)
720 if (target_alloc_working_area(target
, ram_buffer_size
, &source
) != ERROR_OK
) {
721 /* free working area, write algorithm already allocated */
722 target_free_working_area(target
, write_algorithm
);
724 LOG_WARNING("No large enough working area available, can't do block memory writes");
725 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
728 armv7m_info
.common_magic
= ARMV7M_COMMON_MAGIC
;
729 armv7m_info
.core_mode
= ARM_MODE_THREAD
;
731 init_reg_param(®_params
[0], "r0", 32, PARAM_IN_OUT
);
732 init_reg_param(®_params
[1], "r1", 32, PARAM_OUT
);
733 init_reg_param(®_params
[2], "r2", 32, PARAM_OUT
);
734 init_reg_param(®_params
[3], "r3", 32, PARAM_OUT
);
736 buf_set_u32(reg_params
[0].value
, 0, 32, address
);
737 buf_set_u32(reg_params
[1].value
, 0, 32, words
);
738 buf_set_u32(reg_params
[2].value
, 0, 32, source
->address
);
739 buf_set_u32(reg_params
[3].value
, 0, 32, source
->address
+ source
->size
);
741 retval
= target_run_flash_async_algorithm(target
, buffer
, words
, 4,
744 source
->address
, source
->size
,
745 write_algorithm
->address
, 0,
748 if (retval
== ERROR_FLASH_OPERATION_FAILED
) {
749 if (buf_get_u32(reg_params
[0].value
, 0, 32) & FTMRX_ERROR_ACCERR
)
750 LOG_ERROR("flash access error");
752 if (buf_get_u32(reg_params
[0].value
, 0, 32) & FTMRX_ERROR_FPVIOL
)
753 LOG_ERROR("flash protection violation");
756 target_free_working_area(target
, source
);
757 target_free_working_area(target
, write_algorithm
);
759 destroy_reg_param(®_params
[0]);
760 destroy_reg_param(®_params
[1]);
761 destroy_reg_param(®_params
[2]);
762 destroy_reg_param(®_params
[3]);
767 static int kinetis_ke_protect(struct flash_bank
*bank
, int set
,
768 unsigned int first
, unsigned int last
)
770 LOG_WARNING("kinetis_ke_protect not supported yet");
773 if (bank
->target
->state
!= TARGET_HALTED
) {
774 LOG_ERROR("Target not halted");
775 return ERROR_TARGET_NOT_HALTED
;
778 return ERROR_FLASH_BANK_INVALID
;
781 static int kinetis_ke_protect_check(struct flash_bank
*bank
)
783 struct kinetis_ke_flash_bank
*kinfo
= bank
->driver_priv
;
785 if (bank
->target
->state
!= TARGET_HALTED
) {
786 LOG_ERROR("Target not halted");
787 return ERROR_TARGET_NOT_HALTED
;
792 uint8_t fpopen
, fpldis
, fphdis
;
794 uint32_t lprot_size
= 0, hprot_size
= 0;
795 uint32_t lprot_to
= 0, hprot_from
= 0;
797 /* read protection register */
798 result
= target_read_u8(bank
->target
, kinfo
->ftmrx_fprot_addr
, &fprot
);
800 if (result
!= ERROR_OK
)
803 fpopen
= fprot
& 0x80;
804 fpldis
= fprot
& 0x04;
805 fphdis
= fprot
& 0x20;
806 fphs
= (fprot
>> 3) & 0x03;
809 /* Fully unprotected? */
810 if (fpopen
&& fpldis
&& fphdis
) {
811 LOG_WARNING("No flash protection found.");
813 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++)
814 bank
->sectors
[i
].is_protected
= 0;
816 kinfo
->protection_size
= 0;
818 LOG_WARNING("Flash protected. FPOPEN=%i FPLDIS=%i FPHDIS=%i FPLS=%i FPHS=%i",
819 fpopen
? 1 : 0, fpldis
? 1 : 0, fphdis
? 1 : 0, fpls
, fphs
);
821 /* Retrieve which region is protected and how much */
824 lprot_size
= (kinfo
->sector_size
* 4) << fpls
;
827 hprot_size
= (kinfo
->sector_size
* 2) << fphs
;
830 lprot_size
= (kinfo
->sector_size
* 4) << fpls
;
833 hprot_size
= (kinfo
->sector_size
* 2) << fphs
;
836 kinfo
->protection_size
= lprot_size
+ hprot_size
;
838 /* lprot_to indicates up to where the lower region is protected */
839 lprot_to
= lprot_size
/ kinfo
->sector_size
;
841 /* hprot_from indicates from where the upper region is protected */
842 hprot_from
= (0x8000 - hprot_size
) / kinfo
->sector_size
;
844 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++) {
846 /* Check if the sector is in the lower region */
847 if (bank
->sectors
[i
].offset
< 0x4000) {
848 /* Compare the sector start address against lprot_to */
849 if (lprot_to
&& (i
< lprot_to
))
850 bank
->sectors
[i
].is_protected
= 1;
852 bank
->sectors
[i
].is_protected
= 0;
854 /* Check if the sector is between the lower and upper region
855 * OR after the upper region */
856 } else if (bank
->sectors
[i
].offset
< 0x6000 || bank
->sectors
[i
].offset
>= 0x8000) {
857 /* If fpopen is 1 then these regions are protected */
859 bank
->sectors
[i
].is_protected
= 0;
861 bank
->sectors
[i
].is_protected
= 1;
863 /* Check if the sector is in the upper region */
864 } else if (bank
->sectors
[i
].offset
< 0x8000) {
865 if (hprot_from
&& (i
> hprot_from
))
866 bank
->sectors
[i
].is_protected
= 1;
868 bank
->sectors
[i
].is_protected
= 0;
876 static int kinetis_ke_ftmrx_command(struct flash_bank
*bank
, uint8_t count
,
877 uint8_t *FCCOBIX
, uint8_t *FCCOBHI
, uint8_t *FCCOBLO
, uint8_t *fstat
)
881 struct target
*target
= bank
->target
;
882 struct kinetis_ke_flash_bank
*kinfo
= bank
->driver_priv
;
883 uint32_t timeout
= 0;
885 /* Clear error flags */
886 result
= target_write_u8(target
, kinfo
->ftmrx_fstat_addr
, 0x30);
887 if (result
!= ERROR_OK
)
890 for (i
= 0; i
< count
; i
++) {
892 result
= target_write_u8(target
, kinfo
->ftmrx_fccobix_addr
, FCCOBIX
[i
]);
893 if (result
!= ERROR_OK
)
896 /* Write high part */
897 result
= target_write_u8(target
, kinfo
->ftmrx_fccobhi_addr
, FCCOBHI
[i
]);
898 if (result
!= ERROR_OK
)
901 /* Write low part (that is not always required) */
903 result
= target_write_u8(target
, kinfo
->ftmrx_fccoblo_addr
, FCCOBLO
[i
]);
904 if (result
!= ERROR_OK
)
909 /* Launch the command */
910 result
= target_write_u8(target
, kinfo
->ftmrx_fstat_addr
, 0x80);
911 if (result
!= ERROR_OK
)
914 /* Wait for it to finish */
915 result
= target_read_u8(target
, kinfo
->ftmrx_fstat_addr
, fstat
);
916 if (result
!= ERROR_OK
)
919 while (!(*fstat
& FTMRX_FSTAT_CCIF_MASK
)) {
920 if (timeout
<= 1000) {
924 return ERROR_FLASH_OPERATION_FAILED
;
927 result
= target_read_u8(target
, kinfo
->ftmrx_fstat_addr
, fstat
);
928 if (result
!= ERROR_OK
)
935 COMMAND_HANDLER(kinetis_ke_securing_test
)
938 struct target
*target
= get_current_target(CMD_CTX
);
939 struct flash_bank
*bank
= NULL
;
942 uint8_t FCCOBIX
[2], FCCOBHI
[2], FCCOBLO
[2], fstat
;
944 result
= get_flash_bank_by_addr(target
, 0x00000000, true, &bank
);
945 if (result
!= ERROR_OK
)
948 assert(bank
!= NULL
);
950 if (target
->state
!= TARGET_HALTED
) {
951 LOG_ERROR("Target not halted");
952 return ERROR_TARGET_NOT_HALTED
;
955 address
= bank
->base
+ 0x00000400;
958 FCCOBHI
[0] = FTMRX_CMD_ERASESECTOR
;
959 FCCOBLO
[0] = address
>> 16;
962 FCCOBHI
[1] = address
>> 8;
963 FCCOBLO
[1] = address
;
965 return kinetis_ke_ftmrx_command(bank
, 2, FCCOBIX
, FCCOBHI
, FCCOBLO
, &fstat
);
968 static int kinetis_ke_erase(struct flash_bank
*bank
, unsigned int first
,
972 uint8_t FCCOBIX
[2], FCCOBHI
[2], FCCOBLO
[2], fstat
;
973 bool fcf_erased
= false;
975 if (bank
->target
->state
!= TARGET_HALTED
) {
976 LOG_ERROR("Target not halted");
977 return ERROR_TARGET_NOT_HALTED
;
980 if ((first
> bank
->num_sectors
) || (last
> bank
->num_sectors
))
981 return ERROR_FLASH_OPERATION_FAILED
;
983 result
= kinetis_ke_prepare_flash(bank
);
984 if (result
!= ERROR_OK
)
987 for (unsigned int i
= first
; i
<= last
; i
++) {
989 FCCOBHI
[0] = FTMRX_CMD_ERASESECTOR
;
990 FCCOBLO
[0] = (bank
->base
+ bank
->sectors
[i
].offset
) >> 16;
993 FCCOBHI
[1] = (bank
->base
+ bank
->sectors
[i
].offset
) >> 8;
994 FCCOBLO
[1] = (bank
->base
+ bank
->sectors
[i
].offset
);
996 result
= kinetis_ke_ftmrx_command(bank
, 2, FCCOBIX
, FCCOBHI
, FCCOBLO
, &fstat
);
998 if (result
!= ERROR_OK
) {
999 LOG_WARNING("erase sector %u failed", i
);
1000 return ERROR_FLASH_OPERATION_FAILED
;
1003 bank
->sectors
[i
].is_erased
= 1;
1011 ("flash configuration field erased, please reset the device");
1017 static int kinetis_ke_write(struct flash_bank
*bank
, const uint8_t *buffer
,
1018 uint32_t offset
, uint32_t count
)
1021 uint8_t *new_buffer
= NULL
;
1022 uint32_t words
= count
/ 4;
1024 if (bank
->target
->state
!= TARGET_HALTED
) {
1025 LOG_ERROR("Target not halted");
1026 return ERROR_TARGET_NOT_HALTED
;
1029 if (offset
> bank
->size
)
1030 return ERROR_FLASH_BANK_INVALID
;
1033 LOG_WARNING("offset 0x%" PRIx32
" breaks the required alignment", offset
);
1034 return ERROR_FLASH_DST_BREAKS_ALIGNMENT
;
1037 result
= kinetis_ke_stop_watchdog(bank
->target
);
1038 if (result
!= ERROR_OK
)
1041 result
= kinetis_ke_prepare_flash(bank
);
1042 if (result
!= ERROR_OK
)
1046 uint32_t old_count
= count
;
1047 count
= (old_count
| 3) + 1;
1048 new_buffer
= malloc(count
);
1049 if (new_buffer
== NULL
) {
1050 LOG_ERROR("odd number of bytes to write and no memory "
1051 "for padding buffer");
1055 LOG_INFO("odd number of bytes to write (%" PRIu32
"), extending to %" PRIu32
" "
1056 "and padding with 0xff", old_count
, count
);
1058 memset(new_buffer
, 0xff, count
);
1059 buffer
= memcpy(new_buffer
, buffer
, old_count
);
1063 result
= kinetis_ke_write_words(bank
, buffer
, offset
, words
);
1069 static int kinetis_ke_probe(struct flash_bank
*bank
)
1072 uint32_t offset
= 0;
1073 struct target
*target
= bank
->target
;
1074 struct kinetis_ke_flash_bank
*kinfo
= bank
->driver_priv
;
1076 result
= target_read_u32(target
, SIM_SRSID
, &kinfo
->sim_srsid
);
1077 if (result
!= ERROR_OK
)
1080 if (KINETIS_KE_SRSID_FAMID(kinfo
->sim_srsid
) != 0x00) {
1081 LOG_ERROR("Unsupported KE family");
1082 return ERROR_FLASH_OPER_UNSUPPORTED
;
1085 switch (KINETIS_KE_SRSID_SUBFAMID(kinfo
->sim_srsid
)) {
1086 case KINETIS_KE_SRSID_KEX2
:
1087 LOG_INFO("KE02 sub-family");
1090 case KINETIS_KE_SRSID_KEX4
:
1091 LOG_INFO("KE04 sub-family");
1094 case KINETIS_KE_SRSID_KEX6
:
1095 LOG_INFO("KE06 sub-family");
1099 LOG_ERROR("Unsupported KE sub-family");
1100 return ERROR_FLASH_OPER_UNSUPPORTED
;
1103 /* We can only retrieve the ke0x part, but there is no way to know
1104 * the flash size, so assume the maximum flash size for the entire
1107 bank
->base
= 0x00000000;
1108 kinfo
->sector_size
= 512;
1110 switch (KINETIS_KE_SRSID_SUBFAMID(kinfo
->sim_srsid
)) {
1112 case KINETIS_KE_SRSID_KEX2
:
1114 bank
->size
= 0x00010000;
1115 bank
->num_sectors
= 128;
1117 /* KE02 uses the FTMRH flash controller,
1118 * and registers have a different offset from the
1119 * FTMRE flash controller. Sort this out here.
1121 kinfo
->ftmrx_fclkdiv_addr
= 0x40020000;
1122 kinfo
->ftmrx_fccobix_addr
= 0x40020002;
1123 kinfo
->ftmrx_fstat_addr
= 0x40020006;
1124 kinfo
->ftmrx_fprot_addr
= 0x40020008;
1125 kinfo
->ftmrx_fccobhi_addr
= 0x4002000A;
1126 kinfo
->ftmrx_fccoblo_addr
= 0x4002000B;
1129 case KINETIS_KE_SRSID_KEX6
:
1130 case KINETIS_KE_SRSID_KEX4
:
1132 bank
->size
= 0x00020000;
1133 bank
->num_sectors
= 256;
1135 /* KE04 and KE06 use the FTMRE flash controller,
1136 * and registers have a different offset from the
1137 * FTMRH flash controller. Sort this out here.
1139 kinfo
->ftmrx_fclkdiv_addr
= 0x40020003;
1140 kinfo
->ftmrx_fccobix_addr
= 0x40020001;
1141 kinfo
->ftmrx_fstat_addr
= 0x40020005;
1142 kinfo
->ftmrx_fprot_addr
= 0x4002000B;
1143 kinfo
->ftmrx_fccobhi_addr
= 0x40020009;
1144 kinfo
->ftmrx_fccoblo_addr
= 0x40020008;
1148 if (bank
->sectors
) {
1149 free(bank
->sectors
);
1150 bank
->sectors
= NULL
;
1153 assert(bank
->num_sectors
> 0);
1154 bank
->sectors
= malloc(sizeof(struct flash_sector
) * bank
->num_sectors
);
1156 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++) {
1157 bank
->sectors
[i
].offset
= offset
;
1158 bank
->sectors
[i
].size
= kinfo
->sector_size
;
1159 offset
+= kinfo
->sector_size
;
1160 bank
->sectors
[i
].is_erased
= -1;
1161 bank
->sectors
[i
].is_protected
= 1;
1167 static int kinetis_ke_auto_probe(struct flash_bank
*bank
)
1169 struct kinetis_ke_flash_bank
*kinfo
= bank
->driver_priv
;
1171 if (kinfo
->sim_srsid
)
1174 return kinetis_ke_probe(bank
);
1177 static int kinetis_ke_info(struct flash_bank
*bank
, char *buf
, int buf_size
)
1179 (void) snprintf(buf
, buf_size
,
1180 "%s driver for flash bank %s at " TARGET_ADDR_FMT
,
1181 bank
->driver
->name
, bank
->name
, bank
->base
);
1186 static int kinetis_ke_blank_check(struct flash_bank
*bank
)
1188 uint8_t FCCOBIX
[3], FCCOBHI
[3], FCCOBLO
[3], fstat
;
1189 uint16_t longwords
= 0;
1192 if (bank
->target
->state
!= TARGET_HALTED
) {
1193 LOG_ERROR("Target not halted");
1194 return ERROR_TARGET_NOT_HALTED
;
1197 result
= kinetis_ke_prepare_flash(bank
);
1198 if (result
!= ERROR_OK
)
1201 /* check if whole bank is blank */
1203 FCCOBHI
[0] = FTMRX_CMD_ALLERASED
;
1205 result
= kinetis_ke_ftmrx_command(bank
, 1, FCCOBIX
, FCCOBHI
, NULL
, &fstat
);
1207 if (result
!= ERROR_OK
)
1210 if (fstat
& (FTMRX_FSTAT_MGSTAT0_MASK
| FTMRX_FSTAT_MGSTAT1_MASK
)) {
1211 /* the whole bank is not erased, check sector-by-sector */
1212 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++) {
1214 FCCOBHI
[0] = FTMRX_CMD_SECTIONERASED
;
1215 FCCOBLO
[0] = (bank
->base
+ bank
->sectors
[i
].offset
) >> 16;
1218 FCCOBHI
[1] = (bank
->base
+ bank
->sectors
[i
].offset
) >> 8;
1219 FCCOBLO
[1] = (bank
->base
+ bank
->sectors
[i
].offset
);
1224 FCCOBHI
[2] = longwords
>> 8;
1225 FCCOBLO
[2] = longwords
;
1227 result
= kinetis_ke_ftmrx_command(bank
, 3, FCCOBIX
, FCCOBHI
, FCCOBLO
, &fstat
);
1229 if (result
== ERROR_OK
) {
1230 bank
->sectors
[i
].is_erased
= !(fstat
& (FTMRX_FSTAT_MGSTAT0_MASK
| FTMRX_FSTAT_MGSTAT1_MASK
));
1232 LOG_DEBUG("Ignoring errored PFlash sector blank-check");
1233 bank
->sectors
[i
].is_erased
= -1;
1237 /* the whole bank is erased, update all sectors */
1238 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++)
1239 bank
->sectors
[i
].is_erased
= 1;
1245 static const struct command_registration kinetis_ke_security_command_handlers
[] = {
1247 .name
= "check_security",
1248 .mode
= COMMAND_EXEC
,
1251 .handler
= kinetis_ke_check_flash_security_status
,
1254 .name
= "mass_erase",
1255 .mode
= COMMAND_EXEC
,
1258 .handler
= kinetis_ke_mdm_mass_erase
,
1261 .name
= "test_securing",
1262 .mode
= COMMAND_EXEC
,
1265 .handler
= kinetis_ke_securing_test
,
1267 COMMAND_REGISTRATION_DONE
1270 static const struct command_registration kinetis_ke_exec_command_handlers
[] = {
1273 .mode
= COMMAND_ANY
,
1276 .chain
= kinetis_ke_security_command_handlers
,
1279 .name
= "disable_wdog",
1280 .mode
= COMMAND_EXEC
,
1281 .help
= "Disable the watchdog timer",
1283 .handler
= kinetis_ke_disable_wdog_handler
,
1285 COMMAND_REGISTRATION_DONE
1288 static const struct command_registration kinetis_ke_command_handler
[] = {
1290 .name
= "kinetis_ke",
1291 .mode
= COMMAND_ANY
,
1292 .help
= "Kinetis KE NAND flash controller commands",
1294 .chain
= kinetis_ke_exec_command_handlers
,
1296 COMMAND_REGISTRATION_DONE
1299 const struct flash_driver kinetis_ke_flash
= {
1300 .name
= "kinetis_ke",
1301 .commands
= kinetis_ke_command_handler
,
1302 .flash_bank_command
= kinetis_ke_flash_bank_command
,
1303 .erase
= kinetis_ke_erase
,
1304 .protect
= kinetis_ke_protect
,
1305 .write
= kinetis_ke_write
,
1306 .read
= default_flash_read
,
1307 .probe
= kinetis_ke_probe
,
1308 .auto_probe
= kinetis_ke_auto_probe
,
1309 .erase_check
= kinetis_ke_blank_check
,
1310 .protect_check
= kinetis_ke_protect_check
,
1311 .info
= kinetis_ke_info
,
1312 .free_driver_priv
= default_flash_free_driver_priv
,
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)