Code Review / openocd.git / blob
? search:


96a1f515258e01088f2997949fa99b1fb7fdf635
[openocd.git] / src / flash / nor / kinetis.c
1 /***************************************************************************
2 * Copyright (C) 2011 by Mathias Kuester *
3 * kesmtp@freenet.de *
4 * *
5 * Copyright (C) 2011 sleep(5) ltd *
6 * tomas@sleepfive.com *
7 * *
8 * Copyright (C) 2012 by Christopher D. Kilgour *
9 * techie at whiterocker.com *
10 * *
11 * Copyright (C) 2013 Nemui Trinomius *
12 * nemuisan_kawausogasuki@live.jp *
13 * *
14 * Copyright (C) 2015 Tomas Vanek *
15 * vanekt@fbl.cz *
16 * *
17 * This program is free software; you can redistribute it and/or modify *
18 * it under the terms of the GNU General Public License as published by *
19 * the Free Software Foundation; either version 2 of the License, or *
20 * (at your option) any later version. *
21 * *
22 * This program is distributed in the hope that it will be useful, *
23 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
24 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
25 * GNU General Public License for more details. *
26 * *
27 * You should have received a copy of the GNU General Public License *
28 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
29 ***************************************************************************/
30
31 #ifdef HAVE_CONFIG_H
32 #include "config.h"
33 #endif
34
35 #include "jtag/interface.h"
36 #include "imp.h"
37 #include <helper/binarybuffer.h>
38 #include <helper/time_support.h>
39 #include <target/target_type.h>
40 #include <target/algorithm.h>
41 #include <target/armv7m.h>
42 #include <target/cortex_m.h>
43
44 /*
45 * Implementation Notes
46 *
47 * The persistent memories in the Kinetis chip families K10 through
48 * K70 are all manipulated with the Flash Memory Module. Some
49 * variants call this module the FTFE, others call it the FTFL. To
50 * indicate that both are considered here, we use FTFX.
51 *
52 * Within the module, according to the chip variant, the persistent
53 * memory is divided into what Freescale terms Program Flash, FlexNVM,
54 * and FlexRAM. All chip variants have Program Flash. Some chip
55 * variants also have FlexNVM and FlexRAM, which always appear
56 * together.
57 *
58 * A given Kinetis chip may have 1, 2 or 4 blocks of flash. Here we map
59 * each block to a separate bank. Each block size varies by chip and
60 * may be determined by the read-only SIM_FCFG1 register. The sector
61 * size within each bank/block varies by chip, and may be 1, 2 or 4k.
62 * The sector size may be different for flash and FlexNVM.
63 *
64 * The first half of the flash (1 or 2 blocks) is always Program Flash
65 * and always starts at address 0x00000000. The "PFLSH" flag, bit 23
66 * of the read-only SIM_FCFG2 register, determines whether the second
67 * half of the flash is also Program Flash or FlexNVM+FlexRAM. When
68 * PFLSH is set, the second from the first half. When PFLSH is clear,
69 * the second half of flash is FlexNVM and always starts at address
70 * 0x10000000. FlexRAM, which is also present when PFLSH is clear,
71 * always starts at address 0x14000000.
72 *
73 * The Flash Memory Module provides a register set where flash
74 * commands are loaded to perform flash operations like erase and
75 * program. Different commands are available depending on whether
76 * Program Flash or FlexNVM/FlexRAM is being manipulated. Although
77 * the commands used are quite consistent between flash blocks, the
78 * parameters they accept differ according to the flash sector size.
79 *
80 */
81
82 /* Addressess */
83 #define FLEXRAM 0x14000000
84
85 #define FMC_PFB01CR 0x4001f004
86 #define FTFx_FSTAT 0x40020000
87 #define FTFx_FCNFG 0x40020001
88 #define FTFx_FCCOB3 0x40020004
89 #define FTFx_FPROT3 0x40020010
90 #define FTFx_FDPROT 0x40020017
91 #define SIM_SDID 0x40048024
92 #define SIM_SOPT1 0x40047000
93 #define SIM_FCFG1 0x4004804c
94 #define SIM_FCFG2 0x40048050
95 #define WDOG_STCTRH 0x40052000
96 #define SMC_PMCTRL 0x4007E001
97 #define SMC_PMSTAT 0x4007E003
98
99 /* Values */
100 #define PM_STAT_RUN 0x01
101 #define PM_STAT_VLPR 0x04
102 #define PM_CTRL_RUNM_RUN 0x00
103
104 /* Commands */
105 #define FTFx_CMD_BLOCKSTAT 0x00
106 #define FTFx_CMD_SECTSTAT 0x01
107 #define FTFx_CMD_LWORDPROG 0x06
108 #define FTFx_CMD_SECTERASE 0x09
109 #define FTFx_CMD_SECTWRITE 0x0b
110 #define FTFx_CMD_MASSERASE 0x44
111 #define FTFx_CMD_PGMPART 0x80
112 #define FTFx_CMD_SETFLEXRAM 0x81
113
114 /* The older Kinetis K series uses the following SDID layout :
115 * Bit 31-16 : 0
116 * Bit 15-12 : REVID
117 * Bit 11-7 : DIEID
118 * Bit 6-4 : FAMID
119 * Bit 3-0 : PINID
120 *
121 * The newer Kinetis series uses the following SDID layout :
122 * Bit 31-28 : FAMID
123 * Bit 27-24 : SUBFAMID
124 * Bit 23-20 : SERIESID
125 * Bit 19-16 : SRAMSIZE
126 * Bit 15-12 : REVID
127 * Bit 6-4 : Reserved (0)
128 * Bit 3-0 : PINID
129 *
130 * We assume that if bits 31-16 are 0 then it's an older
131 * K-series MCU.
132 */
133
134 #define KINETIS_SOPT1_RAMSIZE_MASK 0x0000F000
135 #define KINETIS_SOPT1_RAMSIZE_K24FN1M 0x0000B000
136
137 #define KINETIS_SDID_K_SERIES_MASK 0x0000FFFF
138
139 #define KINETIS_SDID_DIEID_MASK 0x00000F80
140
141 #define KINETIS_SDID_DIEID_K22FN128 0x00000680 /* smaller pflash with FTFA */
142 #define KINETIS_SDID_DIEID_K22FN256 0x00000A80
143 #define KINETIS_SDID_DIEID_K22FN512 0x00000E80
144 #define KINETIS_SDID_DIEID_K24FN256 0x00000700
145
146 #define KINETIS_SDID_DIEID_K24FN1M 0x00000300 /* Detect Errata 7534 */
147
148 /* We can't rely solely on the FAMID field to determine the MCU
149 * type since some FAMID values identify multiple MCUs with
150 * different flash sector sizes (K20 and K22 for instance).
151 * Therefore we combine it with the DIEID bits which may possibly
152 * break if Freescale bumps the DIEID for a particular MCU. */
153 #define KINETIS_K_SDID_TYPE_MASK 0x00000FF0
154 #define KINETIS_K_SDID_K10_M50 0x00000000
155 #define KINETIS_K_SDID_K10_M72 0x00000080
156 #define KINETIS_K_SDID_K10_M100 0x00000100
157 #define KINETIS_K_SDID_K10_M120 0x00000180
158 #define KINETIS_K_SDID_K11 0x00000220
159 #define KINETIS_K_SDID_K12 0x00000200
160 #define KINETIS_K_SDID_K20_M50 0x00000010
161 #define KINETIS_K_SDID_K20_M72 0x00000090
162 #define KINETIS_K_SDID_K20_M100 0x00000110
163 #define KINETIS_K_SDID_K20_M120 0x00000190
164 #define KINETIS_K_SDID_K21_M50 0x00000230
165 #define KINETIS_K_SDID_K21_M120 0x00000330
166 #define KINETIS_K_SDID_K22_M50 0x00000210
167 #define KINETIS_K_SDID_K22_M120 0x00000310
168 #define KINETIS_K_SDID_K30_M72 0x000000A0
169 #define KINETIS_K_SDID_K30_M100 0x00000120
170 #define KINETIS_K_SDID_K40_M72 0x000000B0
171 #define KINETIS_K_SDID_K40_M100 0x00000130
172 #define KINETIS_K_SDID_K50_M72 0x000000E0
173 #define KINETIS_K_SDID_K51_M72 0x000000F0
174 #define KINETIS_K_SDID_K53 0x00000170
175 #define KINETIS_K_SDID_K60_M100 0x00000140
176 #define KINETIS_K_SDID_K60_M150 0x000001C0
177 #define KINETIS_K_SDID_K70_M150 0x000001D0
178
179 #define KINETIS_SDID_SERIESID_MASK 0x00F00000
180 #define KINETIS_SDID_SERIESID_K 0x00000000
181 #define KINETIS_SDID_SERIESID_KL 0x00100000
182 #define KINETIS_SDID_SERIESID_KW 0x00500000
183 #define KINETIS_SDID_SERIESID_KV 0x00600000
184
185 #define KINETIS_SDID_SUBFAMID_MASK 0x0F000000
186 #define KINETIS_SDID_SUBFAMID_KX0 0x00000000
187 #define KINETIS_SDID_SUBFAMID_KX1 0x01000000
188 #define KINETIS_SDID_SUBFAMID_KX2 0x02000000
189 #define KINETIS_SDID_SUBFAMID_KX3 0x03000000
190 #define KINETIS_SDID_SUBFAMID_KX4 0x04000000
191 #define KINETIS_SDID_SUBFAMID_KX5 0x05000000
192 #define KINETIS_SDID_SUBFAMID_KX6 0x06000000
193
194 #define KINETIS_SDID_FAMILYID_MASK 0xF0000000
195 #define KINETIS_SDID_FAMILYID_K0X 0x00000000
196 #define KINETIS_SDID_FAMILYID_K1X 0x10000000
197 #define KINETIS_SDID_FAMILYID_K2X 0x20000000
198 #define KINETIS_SDID_FAMILYID_K3X 0x30000000
199 #define KINETIS_SDID_FAMILYID_K4X 0x40000000
200 #define KINETIS_SDID_FAMILYID_K6X 0x60000000
201 #define KINETIS_SDID_FAMILYID_K7X 0x70000000
202
203 struct kinetis_flash_bank {
204 bool probed;
205 uint32_t sector_size;
206 uint32_t max_flash_prog_size;
207 uint32_t protection_size;
208 uint32_t prog_base; /* base address for FTFx operations */
209 /* same as bank->base for pflash, differs for FlexNVM */
210 uint32_t protection_block; /* number of first protection block in this bank */
211
212 uint32_t sim_sdid;
213 uint32_t sim_fcfg1;
214 uint32_t sim_fcfg2;
215
216 enum {
217 FC_AUTO = 0,
218 FC_PFLASH,
219 FC_FLEX_NVM,
220 FC_FLEX_RAM,
221 } flash_class;
222
223 enum {
224 FS_PROGRAM_SECTOR = 1,
225 FS_PROGRAM_LONGWORD = 2,
226 FS_PROGRAM_PHRASE = 4, /* Unsupported */
227 FS_INVALIDATE_CACHE = 8,
228 } flash_support;
229 };
230
231 #define MDM_AP 1
232
233 #define MDM_REG_STAT 0x00
234 #define MDM_REG_CTRL 0x04
235 #define MDM_REG_ID 0xfc
236
237 #define MDM_STAT_FMEACK (1<<0)
238 #define MDM_STAT_FREADY (1<<1)
239 #define MDM_STAT_SYSSEC (1<<2)
240 #define MDM_STAT_SYSRES (1<<3)
241 #define MDM_STAT_FMEEN (1<<5)
242 #define MDM_STAT_BACKDOOREN (1<<6)
243 #define MDM_STAT_LPEN (1<<7)
244 #define MDM_STAT_VLPEN (1<<8)
245 #define MDM_STAT_LLSMODEXIT (1<<9)
246 #define MDM_STAT_VLLSXMODEXIT (1<<10)
247 #define MDM_STAT_CORE_HALTED (1<<16)
248 #define MDM_STAT_CORE_SLEEPDEEP (1<<17)
249 #define MDM_STAT_CORESLEEPING (1<<18)
250
251 #define MDM_CTRL_FMEIP (1<<0)
252 #define MDM_CTRL_DBG_DIS (1<<1)
253 #define MDM_CTRL_DBG_REQ (1<<2)
254 #define MDM_CTRL_SYS_RES_REQ (1<<3)
255 #define MDM_CTRL_CORE_HOLD_RES (1<<4)
256 #define MDM_CTRL_VLLSX_DBG_REQ (1<<5)
257 #define MDM_CTRL_VLLSX_DBG_ACK (1<<6)
258 #define MDM_CTRL_VLLSX_STAT_ACK (1<<7)
259
260 #define MDM_ACCESS_TIMEOUT 500 /* msec */
261
262 static int kinetis_mdm_write_register(struct adiv5_dap *dap, unsigned reg, uint32_t value)
263 {
264 int retval;
265 LOG_DEBUG("MDM_REG[0x%02x] <- %08" PRIX32, reg, value);
266
267 retval = dap_queue_ap_write(dap_ap(dap, MDM_AP), reg, value);
268 if (retval != ERROR_OK) {
269 LOG_DEBUG("MDM: failed to queue a write request");
270 return retval;
271 }
272
273 retval = dap_run(dap);
274 if (retval != ERROR_OK) {
275 LOG_DEBUG("MDM: dap_run failed");
276 return retval;
277 }
278
279
280 return ERROR_OK;
281 }
282
283 static int kinetis_mdm_read_register(struct adiv5_dap *dap, unsigned reg, uint32_t *result)
284 {
285 int retval;
286
287 retval = dap_queue_ap_read(dap_ap(dap, MDM_AP), reg, result);
288 if (retval != ERROR_OK) {
289 LOG_DEBUG("MDM: failed to queue a read request");
290 return retval;
291 }
292
293 retval = dap_run(dap);
294 if (retval != ERROR_OK) {
295 LOG_DEBUG("MDM: dap_run failed");
296 return retval;
297 }
298
299 LOG_DEBUG("MDM_REG[0x%02x]: %08" PRIX32, reg, *result);
300 return ERROR_OK;
301 }
302
303 static int kinetis_mdm_poll_register(struct adiv5_dap *dap, unsigned reg,
304 uint32_t mask, uint32_t value, uint32_t timeout_ms)
305 {
306 uint32_t val;
307 int retval;
308 int64_t ms_timeout = timeval_ms() + timeout_ms;
309
310 do {
311 retval = kinetis_mdm_read_register(dap, reg, &val);
312 if (retval != ERROR_OK || (val & mask) == value)
313 return retval;
314
315 alive_sleep(1);
316 } while (timeval_ms() < ms_timeout);
317
318 LOG_DEBUG("MDM: polling timed out");
319 return ERROR_FAIL;
320 }
321
322 /*
323 * This command can be used to break a watchdog reset loop when
324 * connecting to an unsecured target. Unlike other commands, halt will
325 * automatically retry as it does not know how far into the boot process
326 * it is when the command is called.
327 */
328 COMMAND_HANDLER(kinetis_mdm_halt)
329 {
330 struct target *target = get_current_target(CMD_CTX);
331 struct cortex_m_common *cortex_m = target_to_cm(target);
332 struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
333 int retval;
334 int tries = 0;
335 uint32_t stat;
336 int64_t ms_timeout = timeval_ms() + MDM_ACCESS_TIMEOUT;
337
338 if (!dap) {
339 LOG_ERROR("Cannot perform halt with a high-level adapter");
340 return ERROR_FAIL;
341 }
342
343 while (true) {
344 tries++;
345
346 kinetis_mdm_write_register(dap, MDM_REG_CTRL, MDM_CTRL_CORE_HOLD_RES);
347
348 alive_sleep(1);
349
350 retval = kinetis_mdm_read_register(dap, MDM_REG_STAT, &stat);
351 if (retval != ERROR_OK) {
352 LOG_DEBUG("MDM: failed to read MDM_REG_STAT");
353 continue;
354 }
355
356 /* Repeat setting MDM_CTRL_CORE_HOLD_RES until system is out of
357 * reset with flash ready and without security
358 */
359 if ((stat & (MDM_STAT_FREADY | MDM_STAT_SYSSEC | MDM_STAT_SYSRES))
360 == (MDM_STAT_FREADY | MDM_STAT_SYSRES))
361 break;
362
363 if (timeval_ms() >= ms_timeout) {
364 LOG_ERROR("MDM: halt timed out");
365 return ERROR_FAIL;
366 }
367 }
368
369 LOG_DEBUG("MDM: halt succeded after %d attempts.", tries);
370
371 target_poll(target);
372 /* enable polling in case kinetis_check_flash_security_status disabled it */
373 jtag_poll_set_enabled(true);
374
375 alive_sleep(100);
376
377 target->reset_halt = true;
378 target->type->assert_reset(target);
379
380 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, 0);
381 if (retval != ERROR_OK) {
382 LOG_ERROR("MDM: failed to clear MDM_REG_CTRL");
383 return retval;
384 }
385
386 target->type->deassert_reset(target);
387
388 return ERROR_OK;
389 }
390
391 COMMAND_HANDLER(kinetis_mdm_reset)
392 {
393 struct target *target = get_current_target(CMD_CTX);
394 struct cortex_m_common *cortex_m = target_to_cm(target);
395 struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
396 int retval;
397
398 if (!dap) {
399 LOG_ERROR("Cannot perform reset with a high-level adapter");
400 return ERROR_FAIL;
401 }
402
403 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, MDM_CTRL_SYS_RES_REQ);
404 if (retval != ERROR_OK) {
405 LOG_ERROR("MDM: failed to write MDM_REG_CTRL");
406 return retval;
407 }
408
409 retval = kinetis_mdm_poll_register(dap, MDM_REG_STAT, MDM_STAT_SYSRES, 0, 500);
410 if (retval != ERROR_OK) {
411 LOG_ERROR("MDM: failed to assert reset");
412 return retval;
413 }
414
415 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, 0);
416 if (retval != ERROR_OK) {
417 LOG_ERROR("MDM: failed to clear MDM_REG_CTRL");
418 return retval;
419 }
420
421 return ERROR_OK;
422 }
423
424 /*
425 * This function implements the procedure to mass erase the flash via
426 * SWD/JTAG on Kinetis K and L series of devices as it is described in
427 * AN4835 "Production Flash Programming Best Practices for Kinetis K-
428 * and L-series MCUs" Section 4.2.1. To prevent a watchdog reset loop,
429 * the core remains halted after this function completes as suggested
430 * by the application note.
431 */
432 COMMAND_HANDLER(kinetis_mdm_mass_erase)
433 {
434 struct target *target = get_current_target(CMD_CTX);
435 struct cortex_m_common *cortex_m = target_to_cm(target);
436 struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
437
438 if (!dap) {
439 LOG_ERROR("Cannot perform mass erase with a high-level adapter");
440 return ERROR_FAIL;
441 }
442
443 int retval;
444
445 /*
446 * ... Power on the processor, or if power has already been
447 * applied, assert the RESET pin to reset the processor. For
448 * devices that do not have a RESET pin, write the System
449 * Reset Request bit in the MDM-AP control register after
450 * establishing communication...
451 */
452
453 /* assert SRST if configured */
454 bool has_srst = jtag_get_reset_config() & RESET_HAS_SRST;
455 if (has_srst)
456 adapter_assert_reset();
457
458 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, MDM_CTRL_SYS_RES_REQ);
459 if (retval != ERROR_OK && !has_srst) {
460 LOG_ERROR("MDM: failed to assert reset");
461 goto deassert_reset_and_exit;
462 }
463
464 /*
465 * ... Read the MDM-AP status register repeatedly and wait for
466 * stable conditions suitable for mass erase:
467 * - mass erase is enabled
468 * - flash is ready
469 * - reset is finished
470 *
471 * Mass erase is started as soon as all conditions are met in 32
472 * subsequent status reads.
473 *
474 * In case of not stable conditions (RESET/WDOG loop in secured device)
475 * the user is asked for manual pressing of RESET button
476 * as a last resort.
477 */
478 int cnt_mass_erase_disabled = 0;
479 int cnt_ready = 0;
480 int64_t ms_start = timeval_ms();
481 bool man_reset_requested = false;
482
483 do {
484 uint32_t stat = 0;
485 int64_t ms_elapsed = timeval_ms() - ms_start;
486
487 if (!man_reset_requested && ms_elapsed > 100) {
488 LOG_INFO("MDM: Press RESET button now if possible.");
489 man_reset_requested = true;
490 }
491
492 if (ms_elapsed > 3000) {
493 LOG_ERROR("MDM: waiting for mass erase conditions timed out.");
494 LOG_INFO("Mass erase of a secured MCU is not possible without hardware reset.");
495 LOG_INFO("Connect SRST, use 'reset_config srst_only' and retry.");
496 goto deassert_reset_and_exit;
497 }
498 retval = kinetis_mdm_read_register(dap, MDM_REG_STAT, &stat);
499 if (retval != ERROR_OK) {
500 cnt_ready = 0;
501 continue;
502 }
503
504 if (!(stat & MDM_STAT_FMEEN)) {
505 cnt_ready = 0;
506 cnt_mass_erase_disabled++;
507 if (cnt_mass_erase_disabled > 10) {
508 LOG_ERROR("MDM: mass erase is disabled");
509 goto deassert_reset_and_exit;
510 }
511 continue;
512 }
513
514 if ((stat & (MDM_STAT_FREADY | MDM_STAT_SYSRES)) == MDM_STAT_FREADY)
515 cnt_ready++;
516 else
517 cnt_ready = 0;
518
519 } while (cnt_ready < 32);
520
521 /*
522 * ... Write the MDM-AP control register to set the Flash Mass
523 * Erase in Progress bit. This will start the mass erase
524 * process...
525 */
526 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, MDM_CTRL_SYS_RES_REQ | MDM_CTRL_FMEIP);
527 if (retval != ERROR_OK) {
528 LOG_ERROR("MDM: failed to start mass erase");
529 goto deassert_reset_and_exit;
530 }
531
532 /*
533 * ... Read the MDM-AP control register until the Flash Mass
534 * Erase in Progress bit clears...
535 * Data sheed defines erase time <3.6 sec/512kB flash block.
536 * The biggest device has 4 pflash blocks => timeout 16 sec.
537 */
538 retval = kinetis_mdm_poll_register(dap, MDM_REG_CTRL, MDM_CTRL_FMEIP, 0, 16000);
539 if (retval != ERROR_OK) {
540 LOG_ERROR("MDM: mass erase timeout");
541 goto deassert_reset_and_exit;
542 }
543
544 target_poll(target);
545 /* enable polling in case kinetis_check_flash_security_status disabled it */
546 jtag_poll_set_enabled(true);
547
548 alive_sleep(100);
549
550 target->reset_halt = true;
551 target->type->assert_reset(target);
552
553 /*
554 * ... Negate the RESET signal or clear the System Reset Request
555 * bit in the MDM-AP control register.
556 */
557 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, 0);
558 if (retval != ERROR_OK)
559 LOG_ERROR("MDM: failed to clear MDM_REG_CTRL");
560
561 target->type->deassert_reset(target);
562
563 return retval;
564
565 deassert_reset_and_exit:
566 kinetis_mdm_write_register(dap, MDM_REG_CTRL, 0);
567 if (has_srst)
568 adapter_deassert_reset();
569 return retval;
570 }
571
572 static const uint32_t kinetis_known_mdm_ids[] = {
573 0x001C0000, /* Kinetis-K Series */
574 0x001C0020, /* Kinetis-L/M/V/E Series */
575 };
576
577 /*
578 * This function implements the procedure to connect to
579 * SWD/JTAG on Kinetis K and L series of devices as it is described in
580 * AN4835 "Production Flash Programming Best Practices for Kinetis K-
581 * and L-series MCUs" Section 4.1.1
582 */
583 COMMAND_HANDLER(kinetis_check_flash_security_status)
584 {
585 struct target *target = get_current_target(CMD_CTX);
586 struct cortex_m_common *cortex_m = target_to_cm(target);
587 struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
588
589 if (!dap) {
590 LOG_WARNING("Cannot check flash security status with a high-level adapter");
591 return ERROR_OK;
592 }
593
594 uint32_t val;
595 int retval;
596
597 /*
598 * ... The MDM-AP ID register can be read to verify that the
599 * connection is working correctly...
600 */
601 retval = kinetis_mdm_read_register(dap, MDM_REG_ID, &val);
602 if (retval != ERROR_OK) {
603 LOG_ERROR("MDM: failed to read ID register");
604 return ERROR_OK;
605 }
606
607 if (val == 0)
608 return ERROR_OK;
609
610 bool found = false;
611 for (size_t i = 0; i < ARRAY_SIZE(kinetis_known_mdm_ids); i++) {
612 if (val == kinetis_known_mdm_ids[i]) {
613 found = true;
614 break;
615 }
616 }
617
618 if (!found)
619 LOG_WARNING("MDM: unknown ID %08" PRIX32, val);
620
621 /*
622 * ... Read the System Security bit to determine if security is enabled.
623 * If System Security = 0, then proceed. If System Security = 1, then
624 * communication with the internals of the processor, including the
625 * flash, will not be possible without issuing a mass erase command or
626 * unsecuring the part through other means (backdoor key unlock)...
627 */
628 retval = kinetis_mdm_read_register(dap, MDM_REG_STAT, &val);
629 if (retval != ERROR_OK) {
630 LOG_ERROR("MDM: failed to read MDM_REG_STAT");
631 return ERROR_OK;
632 }
633
634 /*
635 * System Security bit is also active for short time during reset.
636 * If a MCU has blank flash and runs in RESET/WDOG loop,
637 * System Security bit is active most of time!
638 * We should observe Flash Ready bit and read status several times
639 * to avoid false detection of secured MCU
640 */
641 int secured_score = 0, flash_not_ready_score = 0;
642
643 if ((val & (MDM_STAT_SYSSEC | MDM_STAT_FREADY)) != MDM_STAT_FREADY) {
644 uint32_t stats[32];
645 int i;
646
647 for (i = 0; i < 32; i++) {
648 stats[i] = MDM_STAT_FREADY;
649 dap_queue_ap_read(dap_ap(dap, MDM_AP), MDM_REG_STAT, &stats[i]);
650 }
651 retval = dap_run(dap);
652 if (retval != ERROR_OK) {
653 LOG_DEBUG("MDM: dap_run failed when validating secured state");
654 return ERROR_OK;
655 }
656 for (i = 0; i < 32; i++) {
657 if (stats[i] & MDM_STAT_SYSSEC)
658 secured_score++;
659 if (!(stats[i] & MDM_STAT_FREADY))
660 flash_not_ready_score++;
661 }
662 }
663
664 if (flash_not_ready_score <= 8 && secured_score > 24) {
665 jtag_poll_set_enabled(false);
666
667 LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
668 LOG_WARNING("**** ****");
669 LOG_WARNING("**** Your Kinetis MCU is in secured state, which means that, ****");
670 LOG_WARNING("**** with exception for very basic communication, JTAG/SWD ****");
671 LOG_WARNING("**** interface will NOT work. In order to restore its ****");
672 LOG_WARNING("**** functionality please issue 'kinetis mdm mass_erase' ****");
673 LOG_WARNING("**** command, power cycle the MCU and restart OpenOCD. ****");
674 LOG_WARNING("**** ****");
675 LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
676
677 } else if (flash_not_ready_score > 24) {
678 jtag_poll_set_enabled(false);
679 LOG_WARNING("**** Your Kinetis MCU is probably locked-up in RESET/WDOG loop. ****");
680 LOG_WARNING("**** Common reason is a blank flash (at least a reset vector). ****");
681 LOG_WARNING("**** Issue 'kinetis mdm halt' command or if SRST is connected ****");
682 LOG_WARNING("**** and configured, use 'reset halt' ****");
683 LOG_WARNING("**** If MCU cannot be halted, it is likely secured and running ****");
684 LOG_WARNING("**** in RESET/WDOG loop. Issue 'kinetis mdm mass_erase' ****");
685
686 } else {
687 LOG_INFO("MDM: Chip is unsecured. Continuing.");
688 jtag_poll_set_enabled(true);
689 }
690
691 return ERROR_OK;
692 }
693
694 FLASH_BANK_COMMAND_HANDLER(kinetis_flash_bank_command)
695 {
696 struct kinetis_flash_bank *bank_info;
697
698 if (CMD_ARGC < 6)
699 return ERROR_COMMAND_SYNTAX_ERROR;
700
701 LOG_INFO("add flash_bank kinetis %s", bank->name);
702
703 bank_info = malloc(sizeof(struct kinetis_flash_bank));
704
705 memset(bank_info, 0, sizeof(struct kinetis_flash_bank));
706
707 bank->driver_priv = bank_info;
708
709 return ERROR_OK;
710 }
711
712 /* Disable the watchdog on Kinetis devices */
713 int kinetis_disable_wdog(struct target *target, uint32_t sim_sdid)
714 {
715 struct working_area *wdog_algorithm;
716 struct armv7m_algorithm armv7m_info;
717 uint16_t wdog;
718 int retval;
719
720 static const uint8_t kinetis_unlock_wdog_code[] = {
721 #include "../../../contrib/loaders/watchdog/armv7m_kinetis_wdog.inc"
722 };
723
724 /* Decide whether the connected device needs watchdog disabling.
725 * Disable for all Kx and KVx devices, return if it is a KLx */
726
727 if ((sim_sdid & KINETIS_SDID_SERIESID_MASK) == KINETIS_SDID_SERIESID_KL)
728 return ERROR_OK;
729
730 /* The connected device requires watchdog disabling. */
731 retval = target_read_u16(target, WDOG_STCTRH, &wdog);
732 if (retval != ERROR_OK)
733 return retval;
734
735 if ((wdog & 0x1) == 0) {
736 /* watchdog already disabled */
737 return ERROR_OK;
738 }
739 LOG_INFO("Disabling Kinetis watchdog (initial WDOG_STCTRLH = 0x%x)", wdog);
740
741 if (target->state != TARGET_HALTED) {
742 LOG_ERROR("Target not halted");
743 return ERROR_TARGET_NOT_HALTED;
744 }
745
746 retval = target_alloc_working_area(target, sizeof(kinetis_unlock_wdog_code), &wdog_algorithm);
747 if (retval != ERROR_OK)
748 return retval;
749
750 retval = target_write_buffer(target, wdog_algorithm->address,
751 sizeof(kinetis_unlock_wdog_code), (uint8_t *)kinetis_unlock_wdog_code);
752 if (retval != ERROR_OK) {
753 target_free_working_area(target, wdog_algorithm);
754 return retval;
755 }
756
757 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
758 armv7m_info.core_mode = ARM_MODE_THREAD;
759
760 retval = target_run_algorithm(target, 0, NULL, 0, NULL, wdog_algorithm->address,
761 wdog_algorithm->address + (sizeof(kinetis_unlock_wdog_code) - 2),
762 10000, &armv7m_info);
763
764 if (retval != ERROR_OK)
765 LOG_ERROR("error executing kinetis wdog unlock algorithm");
766
767 retval = target_read_u16(target, WDOG_STCTRH, &wdog);
768 if (retval != ERROR_OK)
769 return retval;
770 LOG_INFO("WDOG_STCTRLH = 0x%x", wdog);
771
772 target_free_working_area(target, wdog_algorithm);
773
774 return retval;
775 }
776
777 COMMAND_HANDLER(kinetis_disable_wdog_handler)
778 {
779 int result;
780 uint32_t sim_sdid;
781 struct target *target = get_current_target(CMD_CTX);
782
783 if (CMD_ARGC > 0)
784 return ERROR_COMMAND_SYNTAX_ERROR;
785
786 result = target_read_u32(target, SIM_SDID, &sim_sdid);
787 if (result != ERROR_OK) {
788 LOG_ERROR("Failed to read SIMSDID");
789 return result;
790 }
791
792 result = kinetis_disable_wdog(target, sim_sdid);
793 return result;
794 }
795
796
797 /* Kinetis Program-LongWord Microcodes */
798 static const uint8_t kinetis_flash_write_code[] = {
799 /* Params:
800 * r0 - workarea buffer
801 * r1 - target address
802 * r2 - wordcount
803 * Clobbered:
804 * r4 - tmp
805 * r5 - tmp
806 * r6 - tmp
807 * r7 - tmp
808 */
809
810 /* .L1: */
811 /* for(register uint32_t i=0;i<wcount;i++){ */
812 0x04, 0x1C, /* mov r4, r0 */
813 0x00, 0x23, /* mov r3, #0 */
814 /* .L2: */
815 0x0E, 0x1A, /* sub r6, r1, r0 */
816 0xA6, 0x19, /* add r6, r4, r6 */
817 0x93, 0x42, /* cmp r3, r2 */
818 0x16, 0xD0, /* beq .L9 */
819 /* .L5: */
820 /* while((FTFx_FSTAT&FTFA_FSTAT_CCIF_MASK) != FTFA_FSTAT_CCIF_MASK){}; */
821 0x0B, 0x4D, /* ldr r5, .L10 */
822 0x2F, 0x78, /* ldrb r7, [r5] */
823 0x7F, 0xB2, /* sxtb r7, r7 */
824 0x00, 0x2F, /* cmp r7, #0 */
825 0xFA, 0xDA, /* bge .L5 */
826 /* FTFx_FSTAT = FTFA_FSTAT_ACCERR_MASK|FTFA_FSTAT_FPVIOL_MASK|FTFA_FSTAT_RDCO */
827 0x70, 0x27, /* mov r7, #112 */
828 0x2F, 0x70, /* strb r7, [r5] */
829 /* FTFx_FCCOB3 = faddr; */
830 0x09, 0x4F, /* ldr r7, .L10+4 */
831 0x3E, 0x60, /* str r6, [r7] */
832 0x06, 0x27, /* mov r7, #6 */
833 /* FTFx_FCCOB0 = 0x06; */
834 0x08, 0x4E, /* ldr r6, .L10+8 */
835 0x37, 0x70, /* strb r7, [r6] */
836 /* FTFx_FCCOB7 = *pLW; */
837 0x80, 0xCC, /* ldmia r4!, {r7} */
838 0x08, 0x4E, /* ldr r6, .L10+12 */
839 0x37, 0x60, /* str r7, [r6] */
840 /* FTFx_FSTAT = FTFA_FSTAT_CCIF_MASK; */
841 0x80, 0x27, /* mov r7, #128 */
842 0x2F, 0x70, /* strb r7, [r5] */
843 /* .L4: */
844 /* while((FTFx_FSTAT&FTFA_FSTAT_CCIF_MASK) != FTFA_FSTAT_CCIF_MASK){}; */
845 0x2E, 0x78, /* ldrb r6, [r5] */
846 0x77, 0xB2, /* sxtb r7, r6 */
847 0x00, 0x2F, /* cmp r7, #0 */
848 0xFB, 0xDA, /* bge .L4 */
849 0x01, 0x33, /* add r3, r3, #1 */
850 0xE4, 0xE7, /* b .L2 */
851 /* .L9: */
852 0x00, 0xBE, /* bkpt #0 */
853 /* .L10: */
854 0x00, 0x00, 0x02, 0x40, /* .word 1073872896 */
855 0x04, 0x00, 0x02, 0x40, /* .word 1073872900 */
856 0x07, 0x00, 0x02, 0x40, /* .word 1073872903 */
857 0x08, 0x00, 0x02, 0x40, /* .word 1073872904 */
858 };
859
860 /* Program LongWord Block Write */
861 static int kinetis_write_block(struct flash_bank *bank, const uint8_t *buffer,
862 uint32_t offset, uint32_t wcount)
863 {
864 struct target *target = bank->target;
865 uint32_t buffer_size = 2048; /* Default minimum value */
866 struct working_area *write_algorithm;
867 struct working_area *source;
868 struct kinetis_flash_bank *kinfo = bank->driver_priv;
869 uint32_t address = kinfo->prog_base + offset;
870 struct reg_param reg_params[3];
871 struct armv7m_algorithm armv7m_info;
872 int retval = ERROR_OK;
873
874 /* Params:
875 * r0 - workarea buffer
876 * r1 - target address
877 * r2 - wordcount
878 * Clobbered:
879 * r4 - tmp
880 * r5 - tmp
881 * r6 - tmp
882 * r7 - tmp
883 */
884
885 /* Increase buffer_size if needed */
886 if (buffer_size < (target->working_area_size/2))
887 buffer_size = (target->working_area_size/2);
888
889 LOG_INFO("Kinetis: FLASH Write ...");
890
891 /* check code alignment */
892 if (offset & 0x1) {
893 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
894 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
895 }
896
897 /* allocate working area with flash programming code */
898 if (target_alloc_working_area(target, sizeof(kinetis_flash_write_code),
899 &write_algorithm) != ERROR_OK) {
900 LOG_WARNING("no working area available, can't do block memory writes");
901 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
902 }
903
904 retval = target_write_buffer(target, write_algorithm->address,
905 sizeof(kinetis_flash_write_code), kinetis_flash_write_code);
906 if (retval != ERROR_OK)
907 return retval;
908
909 /* memory buffer */
910 while (target_alloc_working_area(target, buffer_size, &source) != ERROR_OK) {
911 buffer_size /= 4;
912 if (buffer_size <= 256) {
913 /* free working area, write algorithm already allocated */
914 target_free_working_area(target, write_algorithm);
915
916 LOG_WARNING("No large enough working area available, can't do block memory writes");
917 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
918 }
919 }
920
921 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
922 armv7m_info.core_mode = ARM_MODE_THREAD;
923
924 init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT); /* *pLW (*buffer) */
925 init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT); /* faddr */
926 init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT); /* number of words to program */
927
928 /* write code buffer and use Flash programming code within kinetis */
929 /* Set breakpoint to 0 with time-out of 1000 ms */
930 while (wcount > 0) {
931 uint32_t thisrun_count = (wcount > (buffer_size / 4)) ? (buffer_size / 4) : wcount;
932
933 retval = target_write_buffer(target, source->address, thisrun_count * 4, buffer);
934 if (retval != ERROR_OK)
935 break;
936
937 buf_set_u32(reg_params[0].value, 0, 32, source->address);
938 buf_set_u32(reg_params[1].value, 0, 32, address);
939 buf_set_u32(reg_params[2].value, 0, 32, thisrun_count);
940
941 retval = target_run_algorithm(target, 0, NULL, 3, reg_params,
942 write_algorithm->address, 0, 100000, &armv7m_info);
943 if (retval != ERROR_OK) {
944 LOG_ERROR("Error executing kinetis Flash programming algorithm");
945 retval = ERROR_FLASH_OPERATION_FAILED;
946 break;
947 }
948
949 buffer += thisrun_count * 4;
950 address += thisrun_count * 4;
951 wcount -= thisrun_count;
952 }
953
954 target_free_working_area(target, source);
955 target_free_working_area(target, write_algorithm);
956
957 destroy_reg_param(&reg_params[0]);
958 destroy_reg_param(&reg_params[1]);
959 destroy_reg_param(&reg_params[2]);
960
961 return retval;
962 }
963
964 static int kinetis_protect(struct flash_bank *bank, int set, int first, int last)
965 {
966 LOG_WARNING("kinetis_protect not supported yet");
967 /* FIXME: TODO */
968
969 if (bank->target->state != TARGET_HALTED) {
970 LOG_ERROR("Target not halted");
971 return ERROR_TARGET_NOT_HALTED;
972 }
973
974 return ERROR_FLASH_BANK_INVALID;
975 }
976
977 static int kinetis_protect_check(struct flash_bank *bank)
978 {
979 struct kinetis_flash_bank *kinfo = bank->driver_priv;
980 int result;
981 int i, b;
982 uint32_t fprot, psec;
983
984 if (bank->target->state != TARGET_HALTED) {
985 LOG_ERROR("Target not halted");
986 return ERROR_TARGET_NOT_HALTED;
987 }
988
989 if (kinfo->flash_class == FC_PFLASH) {
990 uint8_t buffer[4];
991
992 /* read protection register */
993 result = target_read_memory(bank->target, FTFx_FPROT3, 1, 4, buffer);
994
995 if (result != ERROR_OK)
996 return result;
997
998 fprot = target_buffer_get_u32(bank->target, buffer);
999 /* Every bit protects 1/32 of the full flash (not necessarily just this bank) */
1000
1001 } else if (kinfo->flash_class == FC_FLEX_NVM) {
1002 uint8_t fdprot;
1003
1004 /* read protection register */
1005 result = target_read_memory(bank->target, FTFx_FDPROT, 1, 1, &fdprot);
1006
1007 if (result != ERROR_OK)
1008 return result;
1009
1010 fprot = fdprot;
1011
1012 } else {
1013 LOG_ERROR("Protection checks for FlexRAM not supported");
1014 return ERROR_FLASH_BANK_INVALID;
1015 }
1016
1017 b = kinfo->protection_block;
1018 for (psec = 0, i = 0; i < bank->num_sectors; i++) {
1019 if ((fprot >> b) & 1)
1020 bank->sectors[i].is_protected = 0;
1021 else
1022 bank->sectors[i].is_protected = 1;
1023
1024 psec += bank->sectors[i].size;
1025
1026 if (psec >= kinfo->protection_size) {
1027 psec = 0;
1028 b++;
1029 }
1030 }
1031
1032 return ERROR_OK;
1033 }
1034
1035 static int kinetis_ftfx_command(struct target *target, uint8_t fcmd, uint32_t faddr,
1036 uint8_t fccob4, uint8_t fccob5, uint8_t fccob6, uint8_t fccob7,
1037 uint8_t fccob8, uint8_t fccob9, uint8_t fccoba, uint8_t fccobb,
1038 uint8_t *ftfx_fstat)
1039 {
1040 uint8_t command[12] = {faddr & 0xff, (faddr >> 8) & 0xff, (faddr >> 16) & 0xff, fcmd,
1041 fccob7, fccob6, fccob5, fccob4,
1042 fccobb, fccoba, fccob9, fccob8};
1043 int result, i;
1044 uint8_t buffer;
1045 int64_t ms_timeout = timeval_ms() + 250;
1046
1047 /* wait for done */
1048 for (i = 0; i < 50; i++) {
1049 result =
1050 target_read_memory(target, FTFx_FSTAT, 1, 1, &buffer);
1051
1052 if (result != ERROR_OK)
1053 return result;
1054
1055 if (buffer & 0x80)
1056 break;
1057
1058 buffer = 0x00;
1059 }
1060
1061 if (buffer != 0x80) {
1062 /* reset error flags */
1063 buffer = 0x30;
1064 result =
1065 target_write_memory(target, FTFx_FSTAT, 1, 1, &buffer);
1066 if (result != ERROR_OK)
1067 return result;
1068 }
1069
1070 result = target_write_memory(target, FTFx_FCCOB3, 4, 3, command);
1071
1072 if (result != ERROR_OK)
1073 return result;
1074
1075 /* start command */
1076 buffer = 0x80;
1077 result = target_write_memory(target, FTFx_FSTAT, 1, 1, &buffer);
1078 if (result != ERROR_OK)
1079 return result;
1080
1081 /* wait for done */
1082 do {
1083 result =
1084 target_read_memory(target, FTFx_FSTAT, 1, 1, ftfx_fstat);
1085
1086 if (result != ERROR_OK)
1087 return result;
1088
1089 if (*ftfx_fstat & 0x80)
1090 break;
1091
1092 } while (timeval_ms() < ms_timeout);
1093
1094 if ((*ftfx_fstat & 0xf0) != 0x80) {
1095 LOG_ERROR
1096 ("ftfx command failed FSTAT: %02X FCCOB: %02X%02X%02X%02X %02X%02X%02X%02X %02X%02X%02X%02X",
1097 *ftfx_fstat, command[3], command[2], command[1], command[0],
1098 command[7], command[6], command[5], command[4],
1099 command[11], command[10], command[9], command[8]);
1100 return ERROR_FLASH_OPERATION_FAILED;
1101 }
1102
1103 return ERROR_OK;
1104 }
1105
1106
1107 static int kinetis_check_run_mode(struct target *target)
1108 {
1109 int result, i;
1110 uint8_t pmctrl, pmstat;
1111
1112 if (target->state != TARGET_HALTED) {
1113 LOG_ERROR("Target not halted");
1114 return ERROR_TARGET_NOT_HALTED;
1115 }
1116
1117 result = target_read_u8(target, SMC_PMSTAT, &pmstat);
1118 if (result != ERROR_OK)
1119 return result;
1120
1121 if (pmstat == PM_STAT_RUN)
1122 return ERROR_OK;
1123
1124 if (pmstat == PM_STAT_VLPR) {
1125 /* It is safe to switch from VLPR to RUN mode without changing clock */
1126 LOG_INFO("Switching from VLPR to RUN mode.");
1127 pmctrl = PM_CTRL_RUNM_RUN;
1128 result = target_write_u8(target, SMC_PMCTRL, pmctrl);
1129 if (result != ERROR_OK)
1130 return result;
1131
1132 for (i = 100; i; i--) {
1133 result = target_read_u8(target, SMC_PMSTAT, &pmstat);
1134 if (result != ERROR_OK)
1135 return result;
1136
1137 if (pmstat == PM_STAT_RUN)
1138 return ERROR_OK;
1139 }
1140 }
1141
1142 LOG_ERROR("Flash operation not possible in current run mode: SMC_PMSTAT: 0x%x", pmstat);
1143 LOG_ERROR("Issue a 'reset init' command.");
1144 return ERROR_TARGET_NOT_HALTED;
1145 }
1146
1147
1148 static void kinetis_invalidate_flash_cache(struct flash_bank *bank)
1149 {
1150 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1151 uint8_t pfb01cr_byte2 = 0xf0;
1152
1153 if (!(kinfo->flash_support & FS_INVALIDATE_CACHE))
1154 return;
1155
1156 target_write_memory(bank->target, FMC_PFB01CR + 2, 1, 1, &pfb01cr_byte2);
1157 return;
1158 }
1159
1160
1161 static int kinetis_erase(struct flash_bank *bank, int first, int last)
1162 {
1163 int result, i;
1164 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1165
1166 result = kinetis_check_run_mode(bank->target);
1167 if (result != ERROR_OK)
1168 return result;
1169
1170 if ((first > bank->num_sectors) || (last > bank->num_sectors))
1171 return ERROR_FLASH_OPERATION_FAILED;
1172
1173 /*
1174 * FIXME: TODO: use the 'Erase Flash Block' command if the
1175 * requested erase is PFlash or NVM and encompasses the entire
1176 * block. Should be quicker.
1177 */
1178 for (i = first; i <= last; i++) {
1179 uint8_t ftfx_fstat;
1180 /* set command and sector address */
1181 result = kinetis_ftfx_command(bank->target, FTFx_CMD_SECTERASE, kinfo->prog_base + bank->sectors[i].offset,
1182 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
1183
1184 if (result != ERROR_OK) {
1185 LOG_WARNING("erase sector %d failed", i);
1186 return ERROR_FLASH_OPERATION_FAILED;
1187 }
1188
1189 bank->sectors[i].is_erased = 1;
1190 }
1191
1192 kinetis_invalidate_flash_cache(bank);
1193
1194 if (first == 0) {
1195 LOG_WARNING
1196 ("flash configuration field erased, please reset the device");
1197 }
1198
1199 return ERROR_OK;
1200 }
1201
1202 static int kinetis_make_ram_ready(struct target *target)
1203 {
1204 int result;
1205 uint8_t ftfx_fstat;
1206 uint8_t ftfx_fcnfg;
1207
1208 /* check if ram ready */
1209 result = target_read_memory(target, FTFx_FCNFG, 1, 1, &ftfx_fcnfg);
1210 if (result != ERROR_OK)
1211 return result;
1212
1213 if (ftfx_fcnfg & (1 << 1))
1214 return ERROR_OK; /* ram ready */
1215
1216 /* make flex ram available */
1217 result = kinetis_ftfx_command(target, FTFx_CMD_SETFLEXRAM, 0x00ff0000,
1218 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
1219 if (result != ERROR_OK)
1220 return ERROR_FLASH_OPERATION_FAILED;
1221
1222 /* check again */
1223 result = target_read_memory(target, FTFx_FCNFG, 1, 1, &ftfx_fcnfg);
1224 if (result != ERROR_OK)
1225 return result;
1226
1227 if (ftfx_fcnfg & (1 << 1))
1228 return ERROR_OK; /* ram ready */
1229
1230 return ERROR_FLASH_OPERATION_FAILED;
1231 }
1232
1233 static int kinetis_write(struct flash_bank *bank, const uint8_t *buffer,
1234 uint32_t offset, uint32_t count)
1235 {
1236 unsigned int i, result, fallback = 0;
1237 uint32_t wc;
1238 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1239 uint8_t *new_buffer = NULL;
1240
1241 result = kinetis_check_run_mode(bank->target);
1242 if (result != ERROR_OK)
1243 return result;
1244
1245 if (!(kinfo->flash_support & FS_PROGRAM_SECTOR)) {
1246 /* fallback to longword write */
1247 fallback = 1;
1248 LOG_WARNING("This device supports Program Longword execution only.");
1249 } else {
1250 result = kinetis_make_ram_ready(bank->target);
1251 if (result != ERROR_OK) {
1252 fallback = 1;
1253 LOG_WARNING("FlexRAM not ready, fallback to slow longword write.");
1254 }
1255 }
1256
1257 LOG_DEBUG("flash write @08%" PRIX32, offset);
1258
1259
1260 /* program section command */
1261 if (fallback == 0) {
1262 /*
1263 * Kinetis uses different terms for the granularity of
1264 * sector writes, e.g. "phrase" or "128 bits". We use
1265 * the generic term "chunk". The largest possible
1266 * Kinetis "chunk" is 16 bytes (128 bits).
1267 */
1268 unsigned prog_section_chunk_bytes = kinfo->sector_size >> 8;
1269 unsigned prog_size_bytes = kinfo->max_flash_prog_size;
1270 for (i = 0; i < count; i += prog_size_bytes) {
1271 uint8_t residual_buffer[16];
1272 uint8_t ftfx_fstat;
1273 uint32_t section_count = prog_size_bytes / prog_section_chunk_bytes;
1274 uint32_t residual_wc = 0;
1275
1276 /*
1277 * Assume the word count covers an entire
1278 * sector.
1279 */
1280 wc = prog_size_bytes / 4;
1281
1282 /*
1283 * If bytes to be programmed are less than the
1284 * full sector, then determine the number of
1285 * full-words to program, and put together the
1286 * residual buffer so that a full "section"
1287 * may always be programmed.
1288 */
1289 if ((count - i) < prog_size_bytes) {
1290 /* number of bytes to program beyond full section */
1291 unsigned residual_bc = (count-i) % prog_section_chunk_bytes;
1292
1293 /* number of complete words to copy directly from buffer */
1294 wc = (count - i - residual_bc) / 4;
1295
1296 /* number of total sections to write, including residual */
1297 section_count = DIV_ROUND_UP((count-i), prog_section_chunk_bytes);
1298
1299 /* any residual bytes delivers a whole residual section */
1300 residual_wc = (residual_bc ? prog_section_chunk_bytes : 0)/4;
1301
1302 /* clear residual buffer then populate residual bytes */
1303 (void) memset(residual_buffer, 0xff, prog_section_chunk_bytes);
1304 (void) memcpy(residual_buffer, &buffer[i+4*wc], residual_bc);
1305 }
1306
1307 LOG_DEBUG("write section @ %08" PRIX32 " with length %" PRIu32 " bytes",
1308 offset + i, (uint32_t)wc*4);
1309
1310 /* write data to flexram as whole-words */
1311 result = target_write_memory(bank->target, FLEXRAM, 4, wc,
1312 buffer + i);
1313
1314 if (result != ERROR_OK) {
1315 LOG_ERROR("target_write_memory failed");
1316 return result;
1317 }
1318
1319 /* write the residual words to the flexram */
1320 if (residual_wc) {
1321 result = target_write_memory(bank->target,
1322 FLEXRAM+4*wc,
1323 4, residual_wc,
1324 residual_buffer);
1325
1326 if (result != ERROR_OK) {
1327 LOG_ERROR("target_write_memory failed");
1328 return result;
1329 }
1330 }
1331
1332 /* execute section-write command */
1333 result = kinetis_ftfx_command(bank->target, FTFx_CMD_SECTWRITE, kinfo->prog_base + offset + i,
1334 section_count>>8, section_count, 0, 0,
1335 0, 0, 0, 0, &ftfx_fstat);
1336
1337 if (result != ERROR_OK)
1338 return ERROR_FLASH_OPERATION_FAILED;
1339 }
1340 }
1341 /* program longword command, not supported in "SF3" devices */
1342 else if (kinfo->flash_support & FS_PROGRAM_LONGWORD) {
1343 if (count & 0x3) {
1344 uint32_t old_count = count;
1345 count = (old_count | 3) + 1;
1346 new_buffer = malloc(count);
1347 if (new_buffer == NULL) {
1348 LOG_ERROR("odd number of bytes to write and no memory "
1349 "for padding buffer");
1350 return ERROR_FAIL;
1351 }
1352 LOG_INFO("odd number of bytes to write (%" PRIu32 "), extending to %" PRIu32 " "
1353 "and padding with 0xff", old_count, count);
1354 memset(new_buffer, 0xff, count);
1355 buffer = memcpy(new_buffer, buffer, old_count);
1356 }
1357
1358 uint32_t words_remaining = count / 4;
1359
1360 kinetis_disable_wdog(bank->target, kinfo->sim_sdid);
1361
1362 /* try using a block write */
1363 int retval = kinetis_write_block(bank, buffer, offset, words_remaining);
1364
1365 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
1366 /* if block write failed (no sufficient working area),
1367 * we use normal (slow) single word accesses */
1368 LOG_WARNING("couldn't use block writes, falling back to single "
1369 "memory accesses");
1370
1371 for (i = 0; i < count; i += 4) {
1372 uint8_t ftfx_fstat;
1373
1374 LOG_DEBUG("write longword @ %08" PRIX32, (uint32_t)(offset + i));
1375
1376 uint8_t padding[4] = {0xff, 0xff, 0xff, 0xff};
1377 memcpy(padding, buffer + i, MIN(4, count-i));
1378
1379 result = kinetis_ftfx_command(bank->target, FTFx_CMD_LWORDPROG, kinfo->prog_base + offset + i,
1380 padding[3], padding[2], padding[1], padding[0],
1381 0, 0, 0, 0, &ftfx_fstat);
1382
1383 if (result != ERROR_OK)
1384 return ERROR_FLASH_OPERATION_FAILED;
1385 }
1386 }
1387 } else {
1388 LOG_ERROR("Flash write strategy not implemented");
1389 return ERROR_FLASH_OPERATION_FAILED;
1390 }
1391
1392 kinetis_invalidate_flash_cache(bank);
1393 return ERROR_OK;
1394 }
1395
1396 static int kinetis_probe(struct flash_bank *bank)
1397 {
1398 int result, i;
1399 uint32_t offset = 0;
1400 uint8_t fcfg1_nvmsize, fcfg1_pfsize, fcfg1_eesize, fcfg1_depart;
1401 uint8_t fcfg2_maxaddr0, fcfg2_pflsh, fcfg2_maxaddr1;
1402 uint32_t nvm_size = 0, pf_size = 0, df_size = 0, ee_size = 0;
1403 unsigned num_blocks = 0, num_pflash_blocks = 0, num_nvm_blocks = 0, first_nvm_bank = 0,
1404 pflash_sector_size_bytes = 0, nvm_sector_size_bytes = 0;
1405 struct target *target = bank->target;
1406 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1407
1408 kinfo->probed = false;
1409
1410 result = target_read_u32(target, SIM_SDID, &kinfo->sim_sdid);
1411 if (result != ERROR_OK)
1412 return result;
1413
1414 if ((kinfo->sim_sdid & (~KINETIS_SDID_K_SERIES_MASK)) == 0) {
1415 /* older K-series MCU */
1416 uint32_t mcu_type = kinfo->sim_sdid & KINETIS_K_SDID_TYPE_MASK;
1417
1418 switch (mcu_type) {
1419 case KINETIS_K_SDID_K10_M50:
1420 case KINETIS_K_SDID_K20_M50:
1421 /* 1kB sectors */
1422 pflash_sector_size_bytes = 1<<10;
1423 nvm_sector_size_bytes = 1<<10;
1424 num_blocks = 2;
1425 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
1426 break;
1427 case KINETIS_K_SDID_K10_M72:
1428 case KINETIS_K_SDID_K20_M72:
1429 case KINETIS_K_SDID_K30_M72:
1430 case KINETIS_K_SDID_K30_M100:
1431 case KINETIS_K_SDID_K40_M72:
1432 case KINETIS_K_SDID_K40_M100:
1433 case KINETIS_K_SDID_K50_M72:
1434 /* 2kB sectors, 1kB FlexNVM sectors */
1435 pflash_sector_size_bytes = 2<<10;
1436 nvm_sector_size_bytes = 1<<10;
1437 num_blocks = 2;
1438 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
1439 kinfo->max_flash_prog_size = 1<<10;
1440 break;
1441 case KINETIS_K_SDID_K10_M100:
1442 case KINETIS_K_SDID_K20_M100:
1443 case KINETIS_K_SDID_K11:
1444 case KINETIS_K_SDID_K12:
1445 case KINETIS_K_SDID_K21_M50:
1446 case KINETIS_K_SDID_K22_M50:
1447 case KINETIS_K_SDID_K51_M72:
1448 case KINETIS_K_SDID_K53:
1449 case KINETIS_K_SDID_K60_M100:
1450 /* 2kB sectors */
1451 pflash_sector_size_bytes = 2<<10;
1452 nvm_sector_size_bytes = 2<<10;
1453 num_blocks = 2;
1454 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
1455 break;
1456 case KINETIS_K_SDID_K21_M120:
1457 case KINETIS_K_SDID_K22_M120:
1458 /* 4kB sectors (MK21FN1M0, MK21FX512, MK22FN1M0, MK22FX512) */
1459 pflash_sector_size_bytes = 4<<10;
1460 kinfo->max_flash_prog_size = 1<<10;
1461 nvm_sector_size_bytes = 4<<10;
1462 num_blocks = 2;
1463 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
1464 break;
1465 case KINETIS_K_SDID_K10_M120:
1466 case KINETIS_K_SDID_K20_M120:
1467 case KINETIS_K_SDID_K60_M150:
1468 case KINETIS_K_SDID_K70_M150:
1469 /* 4kB sectors */
1470 pflash_sector_size_bytes = 4<<10;
1471 nvm_sector_size_bytes = 4<<10;
1472 num_blocks = 4;
1473 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
1474 break;
1475 default:
1476 LOG_ERROR("Unsupported K-family FAMID");
1477 }
1478 } else {
1479 /* Newer K-series or KL series MCU */
1480 switch (kinfo->sim_sdid & KINETIS_SDID_SERIESID_MASK) {
1481 case KINETIS_SDID_SERIESID_K:
1482 switch (kinfo->sim_sdid & (KINETIS_SDID_FAMILYID_MASK | KINETIS_SDID_SUBFAMID_MASK)) {
1483 case KINETIS_SDID_FAMILYID_K0X | KINETIS_SDID_SUBFAMID_KX2:
1484 /* K02FN64, K02FN128: FTFA, 2kB sectors */
1485 pflash_sector_size_bytes = 2<<10;
1486 num_blocks = 1;
1487 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_INVALIDATE_CACHE;
1488 break;
1489
1490 case KINETIS_SDID_FAMILYID_K2X | KINETIS_SDID_SUBFAMID_KX2: {
1491 /* MK24FN1M reports as K22, this should detect it (according to errata note 1N83J) */
1492 uint32_t sopt1;
1493 result = target_read_u32(target, SIM_SOPT1, &sopt1);
1494 if (result != ERROR_OK)
1495 return result;
1496
1497 if (((kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K24FN1M) &&
1498 ((sopt1 & KINETIS_SOPT1_RAMSIZE_MASK) == KINETIS_SOPT1_RAMSIZE_K24FN1M)) {
1499 /* MK24FN1M */
1500 pflash_sector_size_bytes = 4<<10;
1501 num_blocks = 2;
1502 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
1503 kinfo->max_flash_prog_size = 1<<10;
1504 break;
1505 }
1506 if ((kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K22FN128
1507 || (kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K22FN256
1508 || (kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K22FN512) {
1509 /* K22 with new-style SDID - smaller pflash with FTFA, 2kB sectors */
1510 pflash_sector_size_bytes = 2<<10;
1511 /* autodetect 1 or 2 blocks */
1512 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_INVALIDATE_CACHE;
1513 break;
1514 }
1515 LOG_ERROR("Unsupported Kinetis K22 DIEID");
1516 break;
1517 }
1518 case KINETIS_SDID_FAMILYID_K2X | KINETIS_SDID_SUBFAMID_KX4:
1519 pflash_sector_size_bytes = 4<<10;
1520 if ((kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K24FN256) {
1521 /* K24FN256 - smaller pflash with FTFA */
1522 num_blocks = 1;
1523 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_INVALIDATE_CACHE;
1524 break;
1525 }
1526 /* K24FN1M without errata 7534 */
1527 num_blocks = 2;
1528 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
1529 kinfo->max_flash_prog_size = 1<<10;
1530 break;
1531
1532 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX3:
1533 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX1: /* errata 7534 - should be K63 */
1534 /* K63FN1M0 */
1535 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX4:
1536 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX2: /* errata 7534 - should be K64 */
1537 /* K64FN1M0, K64FX512 */
1538 pflash_sector_size_bytes = 4<<10;
1539 nvm_sector_size_bytes = 4<<10;
1540 kinfo->max_flash_prog_size = 1<<10;
1541 num_blocks = 2;
1542 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
1543 break;
1544
1545 case KINETIS_SDID_FAMILYID_K2X | KINETIS_SDID_SUBFAMID_KX6:
1546 /* K26FN2M0 */
1547 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX6:
1548 /* K66FN2M0, K66FX1M0 */
1549 pflash_sector_size_bytes = 4<<10;
1550 nvm_sector_size_bytes = 4<<10;
1551 kinfo->max_flash_prog_size = 1<<10;
1552 num_blocks = 4;
1553 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
1554 break;
1555 default:
1556 LOG_ERROR("Unsupported Kinetis FAMILYID SUBFAMID");
1557 }
1558 break;
1559
1560 case KINETIS_SDID_SERIESID_KL:
1561 /* KL-series */
1562 pflash_sector_size_bytes = 1<<10;
1563 nvm_sector_size_bytes = 1<<10;
1564 /* autodetect 1 or 2 blocks */
1565 kinfo->flash_support = FS_PROGRAM_LONGWORD;
1566 break;
1567
1568 case KINETIS_SDID_SERIESID_KV:
1569 /* KV-series */
1570 switch (kinfo->sim_sdid & (KINETIS_SDID_FAMILYID_MASK | KINETIS_SDID_SUBFAMID_MASK)) {
1571 case KINETIS_SDID_FAMILYID_K1X | KINETIS_SDID_SUBFAMID_KX0:
1572 /* KV10: FTFA, 1kB sectors */
1573 pflash_sector_size_bytes = 1<<10;
1574 num_blocks = 1;
1575 kinfo->flash_support = FS_PROGRAM_LONGWORD;
1576 break;
1577
1578 case KINETIS_SDID_FAMILYID_K1X | KINETIS_SDID_SUBFAMID_KX1:
1579 /* KV11: FTFA, 2kB sectors */
1580 pflash_sector_size_bytes = 2<<10;
1581 num_blocks = 1;
1582 kinfo->flash_support = FS_PROGRAM_LONGWORD;
1583 break;
1584
1585 case KINETIS_SDID_FAMILYID_K3X | KINETIS_SDID_SUBFAMID_KX0:
1586 /* KV30: FTFA, 2kB sectors, 1 block */
1587 case KINETIS_SDID_FAMILYID_K3X | KINETIS_SDID_SUBFAMID_KX1:
1588 /* KV31: FTFA, 2kB sectors, 2 blocks */
1589 pflash_sector_size_bytes = 2<<10;
1590 /* autodetect 1 or 2 blocks */
1591 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_INVALIDATE_CACHE;
1592 break;
1593
1594 case KINETIS_SDID_FAMILYID_K4X | KINETIS_SDID_SUBFAMID_KX2:
1595 case KINETIS_SDID_FAMILYID_K4X | KINETIS_SDID_SUBFAMID_KX4:
1596 case KINETIS_SDID_FAMILYID_K4X | KINETIS_SDID_SUBFAMID_KX6:
1597 /* KV4x: FTFA, 4kB sectors */
1598 pflash_sector_size_bytes = 4<<10;
1599 num_blocks = 1;
1600 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_INVALIDATE_CACHE;
1601 break;
1602
1603 default:
1604 LOG_ERROR("Unsupported KV FAMILYID SUBFAMID");
1605 }
1606 break;
1607
1608 default:
1609 LOG_ERROR("Unsupported K-series");
1610 }
1611 }
1612
1613 if (pflash_sector_size_bytes == 0) {
1614 LOG_ERROR("MCU is unsupported, SDID 0x%08" PRIx32, kinfo->sim_sdid);
1615 return ERROR_FLASH_OPER_UNSUPPORTED;
1616 }
1617
1618 result = target_read_u32(target, SIM_FCFG1, &kinfo->sim_fcfg1);
1619 if (result != ERROR_OK)
1620 return result;
1621
1622 result = target_read_u32(target, SIM_FCFG2, &kinfo->sim_fcfg2);
1623 if (result != ERROR_OK)
1624 return result;
1625
1626 LOG_DEBUG("SDID: 0x%08" PRIX32 " FCFG1: 0x%08" PRIX32 " FCFG2: 0x%08" PRIX32, kinfo->sim_sdid,
1627 kinfo->sim_fcfg1, kinfo->sim_fcfg2);
1628
1629 fcfg1_nvmsize = (uint8_t)((kinfo->sim_fcfg1 >> 28) & 0x0f);
1630 fcfg1_pfsize = (uint8_t)((kinfo->sim_fcfg1 >> 24) & 0x0f);
1631 fcfg1_eesize = (uint8_t)((kinfo->sim_fcfg1 >> 16) & 0x0f);
1632 fcfg1_depart = (uint8_t)((kinfo->sim_fcfg1 >> 8) & 0x0f);
1633
1634 fcfg2_pflsh = (uint8_t)((kinfo->sim_fcfg2 >> 23) & 0x01);
1635 fcfg2_maxaddr0 = (uint8_t)((kinfo->sim_fcfg2 >> 24) & 0x7f);
1636 fcfg2_maxaddr1 = (uint8_t)((kinfo->sim_fcfg2 >> 16) & 0x7f);
1637
1638 if (num_blocks == 0)
1639 num_blocks = fcfg2_maxaddr1 ? 2 : 1;
1640 else if (fcfg2_maxaddr1 == 0 && num_blocks >= 2) {
1641 num_blocks = 1;
1642 LOG_WARNING("MAXADDR1 is zero, number of flash banks adjusted to 1");
1643 } else if (fcfg2_maxaddr1 != 0 && num_blocks == 1) {
1644 num_blocks = 2;
1645 LOG_WARNING("MAXADDR1 is non zero, number of flash banks adjusted to 2");
1646 }
1647
1648 /* when the PFLSH bit is set, there is no FlexNVM/FlexRAM */
1649 if (!fcfg2_pflsh) {
1650 switch (fcfg1_nvmsize) {
1651 case 0x03:
1652 case 0x05:
1653 case 0x07:
1654 case 0x09:
1655 case 0x0b:
1656 nvm_size = 1 << (14 + (fcfg1_nvmsize >> 1));
1657 break;
1658 case 0x0f:
1659 if (pflash_sector_size_bytes >= 4<<10)
1660 nvm_size = 512<<10;
1661 else
1662 /* K20_100 */
1663 nvm_size = 256<<10;
1664 break;
1665 default:
1666 nvm_size = 0;
1667 break;
1668 }
1669
1670 switch (fcfg1_eesize) {
1671 case 0x00:
1672 case 0x01:
1673 case 0x02:
1674 case 0x03:
1675 case 0x04:
1676 case 0x05:
1677 case 0x06:
1678 case 0x07:
1679 case 0x08:
1680 case 0x09:
1681 ee_size = (16 << (10 - fcfg1_eesize));
1682 break;
1683 default:
1684 ee_size = 0;
1685 break;
1686 }
1687
1688 switch (fcfg1_depart) {
1689 case 0x01:
1690 case 0x02:
1691 case 0x03:
1692 case 0x04:
1693 case 0x05:
1694 case 0x06:
1695 df_size = nvm_size - (4096 << fcfg1_depart);
1696 break;
1697 case 0x08:
1698 df_size = 0;
1699 break;
1700 case 0x09:
1701 case 0x0a:
1702 case 0x0b:
1703 case 0x0c:
1704 case 0x0d:
1705 df_size = 4096 << (fcfg1_depart & 0x7);
1706 break;
1707 default:
1708 df_size = nvm_size;
1709 break;
1710 }
1711 }
1712
1713 switch (fcfg1_pfsize) {
1714 case 0x03:
1715 case 0x05:
1716 case 0x07:
1717 case 0x09:
1718 case 0x0b:
1719 case 0x0d:
1720 pf_size = 1 << (14 + (fcfg1_pfsize >> 1));
1721 break;
1722 case 0x0f:
1723 /* a peculiar case: Freescale states different sizes for 0xf
1724 * K02P64M100SFARM 128 KB ... duplicate of code 0x7
1725 * K22P121M120SF8RM 256 KB ... duplicate of code 0x9
1726 * K22P121M120SF7RM 512 KB ... duplicate of code 0xb
1727 * K22P100M120SF5RM 1024 KB ... duplicate of code 0xd
1728 * K26P169M180SF5RM 2048 KB ... the only unique value
1729 * fcfg2_maxaddr0 seems to be the only clue to pf_size
1730 * Checking fcfg2_maxaddr0 later in this routine is pointless then
1731 */
1732 if (fcfg2_pflsh)
1733 pf_size = ((uint32_t)fcfg2_maxaddr0 << 13) * num_blocks;
1734 else
1735 pf_size = ((uint32_t)fcfg2_maxaddr0 << 13) * num_blocks / 2;
1736 if (pf_size != 2048<<10)
1737 LOG_WARNING("SIM_FCFG1 PFSIZE = 0xf: please check if pflash is %u KB", pf_size>>10);
1738
1739 break;
1740 default:
1741 pf_size = 0;
1742 break;
1743 }
1744
1745 LOG_DEBUG("FlexNVM: %" PRIu32 " PFlash: %" PRIu32 " FlexRAM: %" PRIu32 " PFLSH: %d",
1746 nvm_size, pf_size, ee_size, fcfg2_pflsh);
1747
1748 num_pflash_blocks = num_blocks / (2 - fcfg2_pflsh);
1749 first_nvm_bank = num_pflash_blocks;
1750 num_nvm_blocks = num_blocks - num_pflash_blocks;
1751
1752 LOG_DEBUG("%d blocks total: %d PFlash, %d FlexNVM",
1753 num_blocks, num_pflash_blocks, num_nvm_blocks);
1754
1755 LOG_INFO("Probing flash info for bank %d", bank->bank_number);
1756
1757 if ((unsigned)bank->bank_number < num_pflash_blocks) {
1758 /* pflash, banks start at address zero */
1759 kinfo->flash_class = FC_PFLASH;
1760 bank->size = (pf_size / num_pflash_blocks);
1761 bank->base = 0x00000000 + bank->size * bank->bank_number;
1762 kinfo->prog_base = bank->base;
1763 kinfo->sector_size = pflash_sector_size_bytes;
1764 /* pflash is divided into 32 protection areas for
1765 * parts with more than 32K of PFlash. For parts with
1766 * less the protection unit is set to 1024 bytes */
1767 kinfo->protection_size = MAX(pf_size / 32, 1024);
1768 kinfo->protection_block = (32 / num_pflash_blocks) * bank->bank_number;
1769
1770 } else if ((unsigned)bank->bank_number < num_blocks) {
1771 /* nvm, banks start at address 0x10000000 */
1772 unsigned nvm_ord = bank->bank_number - first_nvm_bank;
1773 uint32_t limit;
1774
1775 kinfo->flash_class = FC_FLEX_NVM;
1776 bank->size = (nvm_size / num_nvm_blocks);
1777 bank->base = 0x10000000 + bank->size * nvm_ord;
1778 kinfo->prog_base = 0x00800000 + bank->size * nvm_ord;
1779 kinfo->sector_size = nvm_sector_size_bytes;
1780 if (df_size == 0) {
1781 kinfo->protection_size = 0;
1782 } else {
1783 for (i = df_size; ~i & 1; i >>= 1)
1784 ;
1785 if (i == 1)
1786 kinfo->protection_size = df_size / 8; /* data flash size = 2^^n */
1787 else
1788 kinfo->protection_size = nvm_size / 8; /* TODO: verify on SF1, not documented in RM */
1789 }
1790 kinfo->protection_block = (8 / num_nvm_blocks) * nvm_ord;
1791
1792 /* EEPROM backup part of FlexNVM is not accessible, use df_size as a limit */
1793 if (df_size > bank->size * nvm_ord)
1794 limit = df_size - bank->size * nvm_ord;
1795 else
1796 limit = 0;
1797
1798 if (bank->size > limit) {
1799 bank->size = limit;
1800 LOG_DEBUG("FlexNVM bank %d limited to 0x%08" PRIx32 " due to active EEPROM backup",
1801 bank->bank_number, limit);
1802 }
1803
1804 } else if ((unsigned)bank->bank_number == num_blocks) {
1805 LOG_ERROR("FlexRAM support not yet implemented");
1806 return ERROR_FLASH_OPER_UNSUPPORTED;
1807 } else {
1808 LOG_ERROR("Cannot determine parameters for bank %d, only %d banks on device",
1809 bank->bank_number, num_blocks);
1810 return ERROR_FLASH_BANK_INVALID;
1811 }
1812
1813 if (bank->bank_number == 0 && ((uint32_t)fcfg2_maxaddr0 << 13) != bank->size)
1814 LOG_WARNING("MAXADDR0 0x%02" PRIx8 " check failed,"
1815 " please report to OpenOCD mailing list", fcfg2_maxaddr0);
1816 if (fcfg2_pflsh) {
1817 if (bank->bank_number == 1 && ((uint32_t)fcfg2_maxaddr1 << 13) != bank->size)
1818 LOG_WARNING("MAXADDR1 0x%02" PRIx8 " check failed,"
1819 " please report to OpenOCD mailing list", fcfg2_maxaddr1);
1820 } else {
1821 if ((unsigned)bank->bank_number == first_nvm_bank
1822 && ((uint32_t)fcfg2_maxaddr1 << 13) != df_size)
1823 LOG_WARNING("FlexNVM MAXADDR1 0x%02" PRIx8 " check failed,"
1824 " please report to OpenOCD mailing list", fcfg2_maxaddr1);
1825 }
1826
1827 if (bank->sectors) {
1828 free(bank->sectors);
1829 bank->sectors = NULL;
1830 }
1831
1832 if (kinfo->sector_size == 0) {
1833 LOG_ERROR("Unknown sector size for bank %d", bank->bank_number);
1834 return ERROR_FLASH_BANK_INVALID;
1835 }
1836
1837 if (kinfo->flash_support & FS_PROGRAM_SECTOR
1838 && kinfo->max_flash_prog_size == 0) {
1839 kinfo->max_flash_prog_size = kinfo->sector_size;
1840 /* Program section size is equal to sector size by default */
1841 }
1842
1843 bank->num_sectors = bank->size / kinfo->sector_size;
1844
1845 if (bank->num_sectors > 0) {
1846 /* FlexNVM bank can be used for EEPROM backup therefore zero sized */
1847 bank->sectors = malloc(sizeof(struct flash_sector) * bank->num_sectors);
1848
1849 for (i = 0; i < bank->num_sectors; i++) {
1850 bank->sectors[i].offset = offset;
1851 bank->sectors[i].size = kinfo->sector_size;
1852 offset += kinfo->sector_size;
1853 bank->sectors[i].is_erased = -1;
1854 bank->sectors[i].is_protected = 1;
1855 }
1856 }
1857
1858 kinfo->probed = true;
1859
1860 return ERROR_OK;
1861 }
1862
1863 static int kinetis_auto_probe(struct flash_bank *bank)
1864 {
1865 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1866
1867 if (kinfo && kinfo->probed)
1868 return ERROR_OK;
1869
1870 return kinetis_probe(bank);
1871 }
1872
1873 static int kinetis_info(struct flash_bank *bank, char *buf, int buf_size)
1874 {
1875 const char *bank_class_names[] = {
1876 "(ANY)", "PFlash", "FlexNVM", "FlexRAM"
1877 };
1878
1879 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1880
1881 (void) snprintf(buf, buf_size,
1882 "%s driver for %s flash bank %s at 0x%8.8" PRIx32 "",
1883 bank->driver->name, bank_class_names[kinfo->flash_class],
1884 bank->name, bank->base);
1885
1886 return ERROR_OK;
1887 }
1888
1889 static int kinetis_blank_check(struct flash_bank *bank)
1890 {
1891 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1892 int result;
1893
1894 /* suprisingly blank check does not work in VLPR and HSRUN modes */
1895 result = kinetis_check_run_mode(bank->target);
1896 if (result != ERROR_OK)
1897 return result;
1898
1899 if (kinfo->flash_class == FC_PFLASH || kinfo->flash_class == FC_FLEX_NVM) {
1900 bool block_dirty = false;
1901 uint8_t ftfx_fstat;
1902
1903 if (kinfo->flash_class == FC_FLEX_NVM) {
1904 uint8_t fcfg1_depart = (uint8_t)((kinfo->sim_fcfg1 >> 8) & 0x0f);
1905 /* block operation cannot be used on FlexNVM when EEPROM backup partition is set */
1906 if (fcfg1_depart != 0xf && fcfg1_depart != 0)
1907 block_dirty = true;
1908 }
1909
1910 if (!block_dirty) {
1911 /* check if whole bank is blank */
1912 result = kinetis_ftfx_command(bank->target, FTFx_CMD_BLOCKSTAT, kinfo->prog_base,
1913 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
1914
1915 if (result != ERROR_OK || (ftfx_fstat & 0x01))
1916 block_dirty = true;
1917 }
1918
1919 if (block_dirty) {
1920 /* the whole bank is not erased, check sector-by-sector */
1921 int i;
1922 for (i = 0; i < bank->num_sectors; i++) {
1923 /* normal margin */
1924 result = kinetis_ftfx_command(bank->target, FTFx_CMD_SECTSTAT,
1925 kinfo->prog_base + bank->sectors[i].offset,
1926 1, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
1927
1928 if (result == ERROR_OK) {
1929 bank->sectors[i].is_erased = !(ftfx_fstat & 0x01);
1930 } else {
1931 LOG_DEBUG("Ignoring errored PFlash sector blank-check");
1932 bank->sectors[i].is_erased = -1;
1933 }
1934 }
1935 } else {
1936 /* the whole bank is erased, update all sectors */
1937 int i;
1938 for (i = 0; i < bank->num_sectors; i++)
1939 bank->sectors[i].is_erased = 1;
1940 }
1941 } else {
1942 LOG_WARNING("kinetis_blank_check not supported yet for FlexRAM");
1943 return ERROR_FLASH_OPERATION_FAILED;
1944 }
1945
1946 return ERROR_OK;
1947 }
1948
1949
1950 COMMAND_HANDLER(kinetis_nvm_partition)
1951 {
1952 int result, i;
1953 unsigned long par, log2 = 0, ee1 = 0, ee2 = 0;
1954 enum { SHOW_INFO, DF_SIZE, EEBKP_SIZE } sz_type = SHOW_INFO;
1955 bool enable;
1956 uint8_t ftfx_fstat;
1957 uint8_t load_flex_ram = 1;
1958 uint8_t ee_size_code = 0x3f;
1959 uint8_t flex_nvm_partition_code = 0;
1960 uint8_t ee_split = 3;
1961 struct target *target = get_current_target(CMD_CTX);
1962 struct flash_bank *bank;
1963 struct kinetis_flash_bank *kinfo;
1964 uint32_t sim_fcfg1;
1965
1966 if (CMD_ARGC >= 2) {
1967 if (strcmp(CMD_ARGV[0], "dataflash") == 0)
1968 sz_type = DF_SIZE;
1969 else if (strcmp(CMD_ARGV[0], "eebkp") == 0)
1970 sz_type = EEBKP_SIZE;
1971
1972 par = strtoul(CMD_ARGV[1], NULL, 10);
1973 while (par >> (log2 + 3))
1974 log2++;
1975 }
1976 switch (sz_type) {
1977 case SHOW_INFO:
1978 result = target_read_u32(target, SIM_FCFG1, &sim_fcfg1);
1979 if (result != ERROR_OK)
1980 return result;
1981
1982 flex_nvm_partition_code = (uint8_t)((sim_fcfg1 >> 8) & 0x0f);
1983 switch (flex_nvm_partition_code) {
1984 case 0:
1985 command_print(CMD_CTX, "No EEPROM backup, data flash only");
1986 break;
1987 case 1:
1988 case 2:
1989 case 3:
1990 case 4:
1991 case 5:
1992 case 6:
1993 command_print(CMD_CTX, "EEPROM backup %d KB", 4 << flex_nvm_partition_code);
1994 break;
1995 case 8:
1996 command_print(CMD_CTX, "No data flash, EEPROM backup only");
1997 break;
1998 case 0x9:
1999 case 0xA:
2000 case 0xB:
2001 case 0xC:
2002 case 0xD:
2003 case 0xE:
2004 command_print(CMD_CTX, "data flash %d KB", 4 << (flex_nvm_partition_code & 7));
2005 break;
2006 case 0xf:
2007 command_print(CMD_CTX, "No EEPROM backup, data flash only (DEPART not set)");
2008 break;
2009 default:
2010 command_print(CMD_CTX, "Unsupported EEPROM backup size code 0x%02" PRIx8, flex_nvm_partition_code);
2011 }
2012 return ERROR_OK;
2013
2014 case DF_SIZE:
2015 flex_nvm_partition_code = 0x8 | log2;
2016 break;
2017
2018 case EEBKP_SIZE:
2019 flex_nvm_partition_code = log2;
2020 break;
2021 }
2022
2023 if (CMD_ARGC == 3)
2024 ee1 = ee2 = strtoul(CMD_ARGV[2], NULL, 10) / 2;
2025 else if (CMD_ARGC >= 4) {
2026 ee1 = strtoul(CMD_ARGV[2], NULL, 10);
2027 ee2 = strtoul(CMD_ARGV[3], NULL, 10);
2028 }
2029
2030 enable = ee1 + ee2 > 0;
2031 if (enable) {
2032 for (log2 = 2; ; log2++) {
2033 if (ee1 + ee2 == (16u << 10) >> log2)
2034 break;
2035 if (ee1 + ee2 > (16u << 10) >> log2 || log2 >= 9) {
2036 LOG_ERROR("Unsupported EEPROM size");
2037 return ERROR_FLASH_OPERATION_FAILED;
2038 }
2039 }
2040
2041 if (ee1 * 3 == ee2)
2042 ee_split = 1;
2043 else if (ee1 * 7 == ee2)
2044 ee_split = 0;
2045 else if (ee1 != ee2) {
2046 LOG_ERROR("Unsupported EEPROM sizes ratio");
2047 return ERROR_FLASH_OPERATION_FAILED;
2048 }
2049
2050 ee_size_code = log2 | ee_split << 4;
2051 }
2052
2053 if (CMD_ARGC >= 5)
2054 COMMAND_PARSE_ON_OFF(CMD_ARGV[4], enable);
2055 if (enable)
2056 load_flex_ram = 0;
2057
2058 LOG_INFO("DEPART 0x%" PRIx8 ", EEPROM size code 0x%" PRIx8,
2059 flex_nvm_partition_code, ee_size_code);
2060
2061 result = kinetis_check_run_mode(target);
2062 if (result != ERROR_OK)
2063 return result;
2064
2065 result = kinetis_ftfx_command(target, FTFx_CMD_PGMPART, load_flex_ram,
2066 ee_size_code, flex_nvm_partition_code, 0, 0,
2067 0, 0, 0, 0, &ftfx_fstat);
2068 if (result != ERROR_OK)
2069 return result;
2070
2071 command_print(CMD_CTX, "FlexNVM partition set. Please reset MCU.");
2072
2073 for (i = 1; i < 4; i++) {
2074 bank = get_flash_bank_by_num_noprobe(i);
2075 if (bank == NULL)
2076 break;
2077
2078 kinfo = bank->driver_priv;
2079 if (kinfo && kinfo->flash_class == FC_FLEX_NVM)
2080 kinfo->probed = false; /* re-probe before next use */
2081 }
2082
2083 command_print(CMD_CTX, "FlexNVM banks will be re-probed to set new data flash size.");
2084 return ERROR_OK;
2085 }
2086
2087
2088 static const struct command_registration kinetis_security_command_handlers[] = {
2089 {
2090 .name = "check_security",
2091 .mode = COMMAND_EXEC,
2092 .help = "Check status of device security lock",
2093 .usage = "",
2094 .handler = kinetis_check_flash_security_status,
2095 },
2096 {
2097 .name = "halt",
2098 .mode = COMMAND_EXEC,
2099 .help = "Issue a halt via the MDM-AP",
2100 .usage = "",
2101 .handler = kinetis_mdm_halt,
2102 },
2103 {
2104 .name = "mass_erase",
2105 .mode = COMMAND_EXEC,
2106 .help = "Issue a complete flash erase via the MDM-AP",
2107 .usage = "",
2108 .handler = kinetis_mdm_mass_erase,
2109 },
2110 { .name = "reset",
2111 .mode = COMMAND_EXEC,
2112 .help = "Issue a reset via the MDM-AP",
2113 .usage = "",
2114 .handler = kinetis_mdm_reset,
2115 },
2116 COMMAND_REGISTRATION_DONE
2117 };
2118
2119 static const struct command_registration kinetis_exec_command_handlers[] = {
2120 {
2121 .name = "mdm",
2122 .mode = COMMAND_ANY,
2123 .help = "MDM-AP command group",
2124 .usage = "",
2125 .chain = kinetis_security_command_handlers,
2126 },
2127 {
2128 .name = "disable_wdog",
2129 .mode = COMMAND_EXEC,
2130 .help = "Disable the watchdog timer",
2131 .usage = "",
2132 .handler = kinetis_disable_wdog_handler,
2133 },
2134 {
2135 .name = "nvm_partition",
2136 .mode = COMMAND_EXEC,
2137 .help = "Show/set data flash or EEPROM backup size in kilobytes,"
2138 " set two EEPROM sizes in bytes and FlexRAM loading during reset",
2139 .usage = "('info'|'dataflash' size|'eebkp' size) [eesize1 eesize2] ['on'|'off']",
2140 .handler = kinetis_nvm_partition,
2141 },
2142 COMMAND_REGISTRATION_DONE
2143 };
2144
2145 static const struct command_registration kinetis_command_handler[] = {
2146 {
2147 .name = "kinetis",
2148 .mode = COMMAND_ANY,
2149 .help = "Kinetis flash controller commands",
2150 .usage = "",
2151 .chain = kinetis_exec_command_handlers,
2152 },
2153 COMMAND_REGISTRATION_DONE
2154 };
2155
2156
2157
2158 struct flash_driver kinetis_flash = {
2159 .name = "kinetis",
2160 .commands = kinetis_command_handler,
2161 .flash_bank_command = kinetis_flash_bank_command,
2162 .erase = kinetis_erase,
2163 .protect = kinetis_protect,
2164 .write = kinetis_write,
2165 .read = default_flash_read,
2166 .probe = kinetis_probe,
2167 .auto_probe = kinetis_auto_probe,
2168 .erase_check = kinetis_blank_check,
2169 .protect_check = kinetis_protect_check,
2170 .info = kinetis_info,
2171 };
Open On-Chip Debugger

Linking to existing account procedure

If you already have an account and want to add another login method you MUST first sign in with your existing account and then change URL to read https://review.openocd.org/login/?link to get to this page again but this time it'll work for linking. Thank you.

SSH host keys fingerprints

1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=..              |
|+o..   .         |
|*.o   . .        |
|+B . . .         |
|Bo. = o S        |
|Oo.+ + =         |
|oB=.* = . o      |
| =+=.+   + E     |
|. .=o   . o      |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)