Kinetis: new devices K02, K26, K63, K64, K66, correct K21 and K22 variants
[openocd.git] / src / flash / nor / kinetis.c
1 /***************************************************************************
2 * Copyright (C) 2011 by Mathias Kuester *
3 * kesmtp@freenet.de *
4 * *
5 * Copyright (C) 2011 sleep(5) ltd *
6 * tomas@sleepfive.com *
7 * *
8 * Copyright (C) 2012 by Christopher D. Kilgour *
9 * techie at whiterocker.com *
10 * *
11 * Copyright (C) 2013 Nemui Trinomius *
12 * nemuisan_kawausogasuki@live.jp *
13 * *
14 * This program is free software; you can redistribute it and/or modify *
15 * it under the terms of the GNU General Public License as published by *
16 * the Free Software Foundation; either version 2 of the License, or *
17 * (at your option) any later version. *
18 * *
19 * This program is distributed in the hope that it will be useful, *
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
22 * GNU General Public License for more details. *
23 * *
24 * You should have received a copy of the GNU General Public License *
25 * along with this program; if not, write to the *
26 * Free Software Foundation, Inc., *
27 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *
28 ***************************************************************************/
29
30 #ifdef HAVE_CONFIG_H
31 #include "config.h"
32 #endif
33
34 #include "jtag/interface.h"
35 #include "imp.h"
36 #include <helper/binarybuffer.h>
37 #include <target/algorithm.h>
38 #include <target/armv7m.h>
39 #include <target/cortex_m.h>
40
41 /*
42 * Implementation Notes
43 *
44 * The persistent memories in the Kinetis chip families K10 through
45 * K70 are all manipulated with the Flash Memory Module. Some
46 * variants call this module the FTFE, others call it the FTFL. To
47 * indicate that both are considered here, we use FTFX.
48 *
49 * Within the module, according to the chip variant, the persistent
50 * memory is divided into what Freescale terms Program Flash, FlexNVM,
51 * and FlexRAM. All chip variants have Program Flash. Some chip
52 * variants also have FlexNVM and FlexRAM, which always appear
53 * together.
54 *
55 * A given Kinetis chip may have 1, 2 or 4 blocks of flash. Here we map
56 * each block to a separate bank. Each block size varies by chip and
57 * may be determined by the read-only SIM_FCFG1 register. The sector
58 * size within each bank/block varies by chip, and may be 1, 2 or 4k.
59 * The sector size may be different for flash and FlexNVM.
60 *
61 * The first half of the flash (1 or 2 blocks) is always Program Flash
62 * and always starts at address 0x00000000. The "PFLSH" flag, bit 23
63 * of the read-only SIM_FCFG2 register, determines whether the second
64 * half of the flash is also Program Flash or FlexNVM+FlexRAM. When
65 * PFLSH is set, the second from the first half. When PFLSH is clear,
66 * the second half of flash is FlexNVM and always starts at address
67 * 0x10000000. FlexRAM, which is also present when PFLSH is clear,
68 * always starts at address 0x14000000.
69 *
70 * The Flash Memory Module provides a register set where flash
71 * commands are loaded to perform flash operations like erase and
72 * program. Different commands are available depending on whether
73 * Program Flash or FlexNVM/FlexRAM is being manipulated. Although
74 * the commands used are quite consistent between flash blocks, the
75 * parameters they accept differ according to the flash sector size.
76 *
77 */
78
79 /* Addressess */
80 #define FLEXRAM 0x14000000
81 #define FTFx_FSTAT 0x40020000
82 #define FTFx_FCNFG 0x40020001
83 #define FTFx_FCCOB3 0x40020004
84 #define FTFx_FPROT3 0x40020010
85 #define SIM_SDID 0x40048024
86 #define SIM_SOPT1 0x40047000
87 #define SIM_FCFG1 0x4004804c
88 #define SIM_FCFG2 0x40048050
89
90 /* Commands */
91 #define FTFx_CMD_BLOCKSTAT 0x00
92 #define FTFx_CMD_SECTSTAT 0x01
93 #define FTFx_CMD_LWORDPROG 0x06
94 #define FTFx_CMD_SECTERASE 0x09
95 #define FTFx_CMD_SECTWRITE 0x0b
96 #define FTFx_CMD_SETFLEXRAM 0x81
97 #define FTFx_CMD_MASSERASE 0x44
98
99 /* The older Kinetis K series uses the following SDID layout :
100 * Bit 31-16 : 0
101 * Bit 15-12 : REVID
102 * Bit 11-7 : DIEID
103 * Bit 6-4 : FAMID
104 * Bit 3-0 : PINID
105 *
106 * The newer Kinetis series uses the following SDID layout :
107 * Bit 31-28 : FAMID
108 * Bit 27-24 : SUBFAMID
109 * Bit 23-20 : SERIESID
110 * Bit 19-16 : SRAMSIZE
111 * Bit 15-12 : REVID
112 * Bit 6-4 : Reserved (0)
113 * Bit 3-0 : PINID
114 *
115 * We assume that if bits 31-16 are 0 then it's an older
116 * K-series MCU.
117 */
118
119 #define KINETIS_SOPT1_RAMSIZE_MASK 0x0000F000
120 #define KINETIS_SOPT1_RAMSIZE_K24FN1M 0x0000B000
121
122 #define KINETIS_SDID_K_SERIES_MASK 0x0000FFFF
123
124 #define KINETIS_SDID_DIEID_MASK 0x00000F80
125
126 #define KINETIS_SDID_DIEID_K22FN128 0x00000680 /* smaller pflash with FTFA */
127 #define KINETIS_SDID_DIEID_K22FN256 0x00000A80
128 #define KINETIS_SDID_DIEID_K22FN512 0x00000E80
129 #define KINETIS_SDID_DIEID_K24FN256 0x00000700
130
131 #define KINETIS_SDID_DIEID_K24FN1M 0x00000300 /* Detect Errata 7534 */
132
133 /* We can't rely solely on the FAMID field to determine the MCU
134 * type since some FAMID values identify multiple MCUs with
135 * different flash sector sizes (K20 and K22 for instance).
136 * Therefore we combine it with the DIEID bits which may possibly
137 * break if Freescale bumps the DIEID for a particular MCU. */
138 #define KINETIS_K_SDID_TYPE_MASK 0x00000FF0
139 #define KINETIS_K_SDID_K10_M50 0x00000000
140 #define KINETIS_K_SDID_K10_M72 0x00000080
141 #define KINETIS_K_SDID_K10_M100 0x00000100
142 #define KINETIS_K_SDID_K10_M120 0x00000180
143 #define KINETIS_K_SDID_K11 0x00000220
144 #define KINETIS_K_SDID_K12 0x00000200
145 #define KINETIS_K_SDID_K20_M50 0x00000010
146 #define KINETIS_K_SDID_K20_M72 0x00000090
147 #define KINETIS_K_SDID_K20_M100 0x00000110
148 #define KINETIS_K_SDID_K20_M120 0x00000190
149 #define KINETIS_K_SDID_K21_M50 0x00000230
150 #define KINETIS_K_SDID_K21_M120 0x00000330
151 #define KINETIS_K_SDID_K22_M50 0x00000210
152 #define KINETIS_K_SDID_K22_M120 0x00000310
153 #define KINETIS_K_SDID_K30_M72 0x000000A0
154 #define KINETIS_K_SDID_K30_M100 0x00000120
155 #define KINETIS_K_SDID_K40_M72 0x000000B0
156 #define KINETIS_K_SDID_K40_M100 0x00000130
157 #define KINETIS_K_SDID_K50_M72 0x000000E0
158 #define KINETIS_K_SDID_K51_M72 0x000000F0
159 #define KINETIS_K_SDID_K53 0x00000170
160 #define KINETIS_K_SDID_K60_M100 0x00000140
161 #define KINETIS_K_SDID_K60_M150 0x000001C0
162 #define KINETIS_K_SDID_K70_M150 0x000001D0
163
164 #define KINETIS_SDID_SERIESID_MASK 0x00F00000
165 #define KINETIS_SDID_SERIESID_K 0x00000000
166 #define KINETIS_SDID_SERIESID_KL 0x00100000
167 #define KINETIS_SDID_SERIESID_KW 0x00500000
168 #define KINETIS_SDID_SERIESID_KV 0x00600000
169
170 #define KINETIS_SDID_SUBFAMID_MASK 0x0F000000
171 #define KINETIS_SDID_SUBFAMID_KX0 0x00000000
172 #define KINETIS_SDID_SUBFAMID_KX1 0x01000000
173 #define KINETIS_SDID_SUBFAMID_KX2 0x02000000
174 #define KINETIS_SDID_SUBFAMID_KX3 0x03000000
175 #define KINETIS_SDID_SUBFAMID_KX4 0x04000000
176 #define KINETIS_SDID_SUBFAMID_KX5 0x05000000
177 #define KINETIS_SDID_SUBFAMID_KX6 0x06000000
178
179 #define KINETIS_SDID_FAMILYID_MASK 0xF0000000
180 #define KINETIS_SDID_FAMILYID_K0X 0x00000000
181 #define KINETIS_SDID_FAMILYID_K1X 0x10000000
182 #define KINETIS_SDID_FAMILYID_K2X 0x20000000
183 #define KINETIS_SDID_FAMILYID_K3X 0x30000000
184 #define KINETIS_SDID_FAMILYID_K4X 0x40000000
185 #define KINETIS_SDID_FAMILYID_K6X 0x60000000
186 #define KINETIS_SDID_FAMILYID_K7X 0x70000000
187
188 struct kinetis_flash_bank {
189 unsigned bank_ordinal;
190 uint32_t sector_size;
191 uint32_t max_flash_prog_size;
192 uint32_t protection_size;
193
194 uint32_t sim_sdid;
195 uint32_t sim_fcfg1;
196 uint32_t sim_fcfg2;
197
198 enum {
199 FC_AUTO = 0,
200 FC_PFLASH,
201 FC_FLEX_NVM,
202 FC_FLEX_RAM,
203 } flash_class;
204
205 enum {
206 FS_PROGRAM_SECTOR = 1,
207 FS_PROGRAM_LONGWORD = 2,
208 FS_PROGRAM_PHRASE = 4, /* Unsupported */
209 } flash_support;
210 };
211
212 #define MDM_REG_STAT 0x00
213 #define MDM_REG_CTRL 0x04
214 #define MDM_REG_ID 0xfc
215
216 #define MDM_STAT_FMEACK (1<<0)
217 #define MDM_STAT_FREADY (1<<1)
218 #define MDM_STAT_SYSSEC (1<<2)
219 #define MDM_STAT_SYSRES (1<<3)
220 #define MDM_STAT_FMEEN (1<<5)
221 #define MDM_STAT_BACKDOOREN (1<<6)
222 #define MDM_STAT_LPEN (1<<7)
223 #define MDM_STAT_VLPEN (1<<8)
224 #define MDM_STAT_LLSMODEXIT (1<<9)
225 #define MDM_STAT_VLLSXMODEXIT (1<<10)
226 #define MDM_STAT_CORE_HALTED (1<<16)
227 #define MDM_STAT_CORE_SLEEPDEEP (1<<17)
228 #define MDM_STAT_CORESLEEPING (1<<18)
229
230 #define MEM_CTRL_FMEIP (1<<0)
231 #define MEM_CTRL_DBG_DIS (1<<1)
232 #define MEM_CTRL_DBG_REQ (1<<2)
233 #define MEM_CTRL_SYS_RES_REQ (1<<3)
234 #define MEM_CTRL_CORE_HOLD_RES (1<<4)
235 #define MEM_CTRL_VLLSX_DBG_REQ (1<<5)
236 #define MEM_CTRL_VLLSX_DBG_ACK (1<<6)
237 #define MEM_CTRL_VLLSX_STAT_ACK (1<<7)
238
239 #define MDM_ACCESS_TIMEOUT 3000 /* iterations */
240
241 static int kinetis_mdm_write_register(struct adiv5_dap *dap, unsigned reg, uint32_t value)
242 {
243 int retval;
244 LOG_DEBUG("MDM_REG[0x%02x] <- %08" PRIX32, reg, value);
245
246 retval = dap_queue_ap_write(dap, reg, value);
247 if (retval != ERROR_OK) {
248 LOG_DEBUG("MDM: failed to queue a write request");
249 return retval;
250 }
251
252 retval = dap_run(dap);
253 if (retval != ERROR_OK) {
254 LOG_DEBUG("MDM: dap_run failed");
255 return retval;
256 }
257
258
259 return ERROR_OK;
260 }
261
262 static int kinetis_mdm_read_register(struct adiv5_dap *dap, unsigned reg, uint32_t *result)
263 {
264 int retval;
265 retval = dap_queue_ap_read(dap, reg, result);
266 if (retval != ERROR_OK) {
267 LOG_DEBUG("MDM: failed to queue a read request");
268 return retval;
269 }
270
271 retval = dap_run(dap);
272 if (retval != ERROR_OK) {
273 LOG_DEBUG("MDM: dap_run failed");
274 return retval;
275 }
276
277 LOG_DEBUG("MDM_REG[0x%02x]: %08" PRIX32, reg, *result);
278 return ERROR_OK;
279 }
280
281 static int kinetis_mdm_poll_register(struct adiv5_dap *dap, unsigned reg, uint32_t mask, uint32_t value)
282 {
283 uint32_t val;
284 int retval;
285 int timeout = MDM_ACCESS_TIMEOUT;
286
287 do {
288 retval = kinetis_mdm_read_register(dap, reg, &val);
289 if (retval != ERROR_OK || (val & mask) == value)
290 return retval;
291
292 alive_sleep(1);
293 } while (timeout--);
294
295 LOG_DEBUG("MDM: polling timed out");
296 return ERROR_FAIL;
297 }
298
299 /*
300 * This function implements the procedure to mass erase the flash via
301 * SWD/JTAG on Kinetis K and L series of devices as it is described in
302 * AN4835 "Production Flash Programming Best Practices for Kinetis K-
303 * and L-series MCUs" Section 4.2.1
304 */
305 COMMAND_HANDLER(kinetis_mdm_mass_erase)
306 {
307 struct target *target = get_current_target(CMD_CTX);
308 struct cortex_m_common *cortex_m = target_to_cm(target);
309 struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
310
311 if (!dap) {
312 LOG_ERROR("Cannot perform mass erase with a high-level adapter");
313 return ERROR_FAIL;
314 }
315
316 int retval;
317 const uint8_t original_ap = dap->ap_current;
318
319 /*
320 * ... Power on the processor, or if power has already been
321 * applied, assert the RESET pin to reset the processor. For
322 * devices that do not have a RESET pin, write the System
323 * Reset Request bit in the MDM-AP control register after
324 * establishing communication...
325 */
326
327 /* assert SRST */
328 if (jtag_get_reset_config() & RESET_HAS_SRST)
329 adapter_assert_reset();
330 else
331 LOG_WARNING("Attempting mass erase without hardware reset. This is not reliable; "
332 "it's recommended you connect SRST and use ``reset_config srst_only''.");
333
334 dap_ap_select(dap, 1);
335
336 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, MEM_CTRL_SYS_RES_REQ);
337 if (retval != ERROR_OK)
338 return retval;
339
340 /*
341 * ... Read the MDM-AP status register until the Flash Ready bit sets...
342 */
343 retval = kinetis_mdm_poll_register(dap, MDM_REG_STAT,
344 MDM_STAT_FREADY | MDM_STAT_SYSRES,
345 MDM_STAT_FREADY);
346 if (retval != ERROR_OK) {
347 LOG_ERROR("MDM : flash ready timeout");
348 return retval;
349 }
350
351 /*
352 * ... Write the MDM-AP control register to set the Flash Mass
353 * Erase in Progress bit. This will start the mass erase
354 * process...
355 */
356 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL,
357 MEM_CTRL_SYS_RES_REQ | MEM_CTRL_FMEIP);
358 if (retval != ERROR_OK)
359 return retval;
360
361 /* As a sanity check make sure that device started mass erase procedure */
362 retval = kinetis_mdm_poll_register(dap, MDM_REG_STAT,
363 MDM_STAT_FMEACK, MDM_STAT_FMEACK);
364 if (retval != ERROR_OK)
365 return retval;
366
367 /*
368 * ... Read the MDM-AP control register until the Flash Mass
369 * Erase in Progress bit clears...
370 */
371 retval = kinetis_mdm_poll_register(dap, MDM_REG_CTRL,
372 MEM_CTRL_FMEIP,
373 0);
374 if (retval != ERROR_OK)
375 return retval;
376
377 /*
378 * ... Negate the RESET signal or clear the System Reset Request
379 * bit in the MDM-AP control register...
380 */
381 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, 0);
382 if (retval != ERROR_OK)
383 return retval;
384
385 if (jtag_get_reset_config() & RESET_HAS_SRST)
386 adapter_deassert_reset();
387
388 dap_ap_select(dap, original_ap);
389 return ERROR_OK;
390 }
391
392 static const uint32_t kinetis_known_mdm_ids[] = {
393 0x001C0000, /* Kinetis-K Series */
394 0x001C0020, /* Kinetis-L/M/V/E Series */
395 };
396
397 /*
398 * This function implements the procedure to connect to
399 * SWD/JTAG on Kinetis K and L series of devices as it is described in
400 * AN4835 "Production Flash Programming Best Practices for Kinetis K-
401 * and L-series MCUs" Section 4.1.1
402 */
403 COMMAND_HANDLER(kinetis_check_flash_security_status)
404 {
405 struct target *target = get_current_target(CMD_CTX);
406 struct cortex_m_common *cortex_m = target_to_cm(target);
407 struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
408
409 if (!dap) {
410 LOG_WARNING("Cannot check flash security status with a high-level adapter");
411 return ERROR_OK;
412 }
413
414 uint32_t val;
415 int retval;
416 const uint8_t origninal_ap = dap->ap_current;
417
418 dap_ap_select(dap, 1);
419
420
421 /*
422 * ... The MDM-AP ID register can be read to verify that the
423 * connection is working correctly...
424 */
425 retval = kinetis_mdm_read_register(dap, MDM_REG_ID, &val);
426 if (retval != ERROR_OK) {
427 LOG_ERROR("MDM: failed to read ID register");
428 goto fail;
429 }
430
431 bool found = false;
432 for (size_t i = 0; i < ARRAY_SIZE(kinetis_known_mdm_ids); i++) {
433 if (val == kinetis_known_mdm_ids[i]) {
434 found = true;
435 break;
436 }
437 }
438
439 if (!found)
440 LOG_WARNING("MDM: unknown ID %08" PRIX32, val);
441
442 /*
443 * ... Read the MDM-AP status register until the Flash Ready bit sets...
444 */
445 retval = kinetis_mdm_poll_register(dap, MDM_REG_STAT,
446 MDM_STAT_FREADY,
447 MDM_STAT_FREADY);
448 if (retval != ERROR_OK) {
449 LOG_ERROR("MDM: flash ready timeout");
450 goto fail;
451 }
452
453 /*
454 * ... Read the System Security bit to determine if security is enabled.
455 * If System Security = 0, then proceed. If System Security = 1, then
456 * communication with the internals of the processor, including the
457 * flash, will not be possible without issuing a mass erase command or
458 * unsecuring the part through other means (backdoor key unlock)...
459 */
460 retval = kinetis_mdm_read_register(dap, MDM_REG_STAT, &val);
461 if (retval != ERROR_OK) {
462 LOG_ERROR("MDM: failed to read MDM_REG_STAT");
463 goto fail;
464 }
465
466 if (val & MDM_STAT_SYSSEC) {
467 jtag_poll_set_enabled(false);
468
469 LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
470 LOG_WARNING("**** ****");
471 LOG_WARNING("**** Your Kinetis MCU is in secured state, which means that, ****");
472 LOG_WARNING("**** with exception for very basic communication, JTAG/SWD ****");
473 LOG_WARNING("**** interface will NOT work. In order to restore its ****");
474 LOG_WARNING("**** functionality please issue 'kinetis mdm mass_erase' ****");
475 LOG_WARNING("**** command, power cycle the MCU and restart OpenOCD. ****");
476 LOG_WARNING("**** ****");
477 LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
478 } else {
479 LOG_INFO("MDM: Chip is unsecured. Continuing.");
480 jtag_poll_set_enabled(true);
481 }
482
483 dap_ap_select(dap, origninal_ap);
484
485 return ERROR_OK;
486
487 fail:
488 LOG_ERROR("MDM: Failed to check security status of the MCU. Cannot proceed further");
489 jtag_poll_set_enabled(false);
490 return retval;
491 }
492
493 FLASH_BANK_COMMAND_HANDLER(kinetis_flash_bank_command)
494 {
495 struct kinetis_flash_bank *bank_info;
496
497 if (CMD_ARGC < 6)
498 return ERROR_COMMAND_SYNTAX_ERROR;
499
500 LOG_INFO("add flash_bank kinetis %s", bank->name);
501
502 bank_info = malloc(sizeof(struct kinetis_flash_bank));
503
504 memset(bank_info, 0, sizeof(struct kinetis_flash_bank));
505
506 bank->driver_priv = bank_info;
507
508 return ERROR_OK;
509 }
510
511 /* Kinetis Program-LongWord Microcodes */
512 static const uint8_t kinetis_flash_write_code[] = {
513 /* Params:
514 * r0 - workarea buffer
515 * r1 - target address
516 * r2 - wordcount
517 * Clobbered:
518 * r4 - tmp
519 * r5 - tmp
520 * r6 - tmp
521 * r7 - tmp
522 */
523
524 /* .L1: */
525 /* for(register uint32_t i=0;i<wcount;i++){ */
526 0x04, 0x1C, /* mov r4, r0 */
527 0x00, 0x23, /* mov r3, #0 */
528 /* .L2: */
529 0x0E, 0x1A, /* sub r6, r1, r0 */
530 0xA6, 0x19, /* add r6, r4, r6 */
531 0x93, 0x42, /* cmp r3, r2 */
532 0x16, 0xD0, /* beq .L9 */
533 /* .L5: */
534 /* while((FTFx_FSTAT&FTFA_FSTAT_CCIF_MASK) != FTFA_FSTAT_CCIF_MASK){}; */
535 0x0B, 0x4D, /* ldr r5, .L10 */
536 0x2F, 0x78, /* ldrb r7, [r5] */
537 0x7F, 0xB2, /* sxtb r7, r7 */
538 0x00, 0x2F, /* cmp r7, #0 */
539 0xFA, 0xDA, /* bge .L5 */
540 /* FTFx_FSTAT = FTFA_FSTAT_ACCERR_MASK|FTFA_FSTAT_FPVIOL_MASK|FTFA_FSTAT_RDCO */
541 0x70, 0x27, /* mov r7, #112 */
542 0x2F, 0x70, /* strb r7, [r5] */
543 /* FTFx_FCCOB3 = faddr; */
544 0x09, 0x4F, /* ldr r7, .L10+4 */
545 0x3E, 0x60, /* str r6, [r7] */
546 0x06, 0x27, /* mov r7, #6 */
547 /* FTFx_FCCOB0 = 0x06; */
548 0x08, 0x4E, /* ldr r6, .L10+8 */
549 0x37, 0x70, /* strb r7, [r6] */
550 /* FTFx_FCCOB7 = *pLW; */
551 0x80, 0xCC, /* ldmia r4!, {r7} */
552 0x08, 0x4E, /* ldr r6, .L10+12 */
553 0x37, 0x60, /* str r7, [r6] */
554 /* FTFx_FSTAT = FTFA_FSTAT_CCIF_MASK; */
555 0x80, 0x27, /* mov r7, #128 */
556 0x2F, 0x70, /* strb r7, [r5] */
557 /* .L4: */
558 /* while((FTFx_FSTAT&FTFA_FSTAT_CCIF_MASK) != FTFA_FSTAT_CCIF_MASK){}; */
559 0x2E, 0x78, /* ldrb r6, [r5] */
560 0x77, 0xB2, /* sxtb r7, r6 */
561 0x00, 0x2F, /* cmp r7, #0 */
562 0xFB, 0xDA, /* bge .L4 */
563 0x01, 0x33, /* add r3, r3, #1 */
564 0xE4, 0xE7, /* b .L2 */
565 /* .L9: */
566 0x00, 0xBE, /* bkpt #0 */
567 /* .L10: */
568 0x00, 0x00, 0x02, 0x40, /* .word 1073872896 */
569 0x04, 0x00, 0x02, 0x40, /* .word 1073872900 */
570 0x07, 0x00, 0x02, 0x40, /* .word 1073872903 */
571 0x08, 0x00, 0x02, 0x40, /* .word 1073872904 */
572 };
573
574 /* Program LongWord Block Write */
575 static int kinetis_write_block(struct flash_bank *bank, const uint8_t *buffer,
576 uint32_t offset, uint32_t wcount)
577 {
578 struct target *target = bank->target;
579 uint32_t buffer_size = 2048; /* Default minimum value */
580 struct working_area *write_algorithm;
581 struct working_area *source;
582 uint32_t address = bank->base + offset;
583 struct reg_param reg_params[3];
584 struct armv7m_algorithm armv7m_info;
585 int retval = ERROR_OK;
586
587 /* Params:
588 * r0 - workarea buffer
589 * r1 - target address
590 * r2 - wordcount
591 * Clobbered:
592 * r4 - tmp
593 * r5 - tmp
594 * r6 - tmp
595 * r7 - tmp
596 */
597
598 /* Increase buffer_size if needed */
599 if (buffer_size < (target->working_area_size/2))
600 buffer_size = (target->working_area_size/2);
601
602 LOG_INFO("Kinetis: FLASH Write ...");
603
604 /* check code alignment */
605 if (offset & 0x1) {
606 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
607 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
608 }
609
610 /* allocate working area with flash programming code */
611 if (target_alloc_working_area(target, sizeof(kinetis_flash_write_code),
612 &write_algorithm) != ERROR_OK) {
613 LOG_WARNING("no working area available, can't do block memory writes");
614 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
615 }
616
617 retval = target_write_buffer(target, write_algorithm->address,
618 sizeof(kinetis_flash_write_code), kinetis_flash_write_code);
619 if (retval != ERROR_OK)
620 return retval;
621
622 /* memory buffer */
623 while (target_alloc_working_area(target, buffer_size, &source) != ERROR_OK) {
624 buffer_size /= 4;
625 if (buffer_size <= 256) {
626 /* free working area, write algorithm already allocated */
627 target_free_working_area(target, write_algorithm);
628
629 LOG_WARNING("No large enough working area available, can't do block memory writes");
630 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
631 }
632 }
633
634 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
635 armv7m_info.core_mode = ARM_MODE_THREAD;
636
637 init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT); /* *pLW (*buffer) */
638 init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT); /* faddr */
639 init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT); /* number of words to program */
640
641 /* write code buffer and use Flash programming code within kinetis */
642 /* Set breakpoint to 0 with time-out of 1000 ms */
643 while (wcount > 0) {
644 uint32_t thisrun_count = (wcount > (buffer_size / 4)) ? (buffer_size / 4) : wcount;
645
646 retval = target_write_buffer(target, source->address, thisrun_count * 4, buffer);
647 if (retval != ERROR_OK)
648 break;
649
650 buf_set_u32(reg_params[0].value, 0, 32, source->address);
651 buf_set_u32(reg_params[1].value, 0, 32, address);
652 buf_set_u32(reg_params[2].value, 0, 32, thisrun_count);
653
654 retval = target_run_algorithm(target, 0, NULL, 3, reg_params,
655 write_algorithm->address, 0, 100000, &armv7m_info);
656 if (retval != ERROR_OK) {
657 LOG_ERROR("Error executing kinetis Flash programming algorithm");
658 retval = ERROR_FLASH_OPERATION_FAILED;
659 break;
660 }
661
662 buffer += thisrun_count * 4;
663 address += thisrun_count * 4;
664 wcount -= thisrun_count;
665 }
666
667 target_free_working_area(target, source);
668 target_free_working_area(target, write_algorithm);
669
670 destroy_reg_param(&reg_params[0]);
671 destroy_reg_param(&reg_params[1]);
672 destroy_reg_param(&reg_params[2]);
673
674 return retval;
675 }
676
677 static int kinetis_protect(struct flash_bank *bank, int set, int first, int last)
678 {
679 LOG_WARNING("kinetis_protect not supported yet");
680 /* FIXME: TODO */
681
682 if (bank->target->state != TARGET_HALTED) {
683 LOG_ERROR("Target not halted");
684 return ERROR_TARGET_NOT_HALTED;
685 }
686
687 return ERROR_FLASH_BANK_INVALID;
688 }
689
690 static int kinetis_protect_check(struct flash_bank *bank)
691 {
692 struct kinetis_flash_bank *kinfo = bank->driver_priv;
693
694 if (bank->target->state != TARGET_HALTED) {
695 LOG_ERROR("Target not halted");
696 return ERROR_TARGET_NOT_HALTED;
697 }
698
699 if (kinfo->flash_class == FC_PFLASH) {
700 int result;
701 uint8_t buffer[4];
702 uint32_t fprot, psec;
703 int i, b;
704
705 /* read protection register */
706 result = target_read_memory(bank->target, FTFx_FPROT3, 1, 4, buffer);
707
708 if (result != ERROR_OK)
709 return result;
710
711 fprot = target_buffer_get_u32(bank->target, buffer);
712
713 /*
714 * Every bit protects 1/32 of the full flash (not necessarily
715 * just this bank), but we enforce the bank ordinals for
716 * PFlash to start at zero.
717 */
718 b = kinfo->bank_ordinal * (bank->size / kinfo->protection_size);
719 for (psec = 0, i = 0; i < bank->num_sectors; i++) {
720 if ((fprot >> b) & 1)
721 bank->sectors[i].is_protected = 0;
722 else
723 bank->sectors[i].is_protected = 1;
724
725 psec += bank->sectors[i].size;
726
727 if (psec >= kinfo->protection_size) {
728 psec = 0;
729 b++;
730 }
731 }
732 } else {
733 LOG_ERROR("Protection checks for FlexNVM not yet supported");
734 return ERROR_FLASH_BANK_INVALID;
735 }
736
737 return ERROR_OK;
738 }
739
740 static int kinetis_ftfx_command(struct flash_bank *bank, uint8_t fcmd, uint32_t faddr,
741 uint8_t fccob4, uint8_t fccob5, uint8_t fccob6, uint8_t fccob7,
742 uint8_t fccob8, uint8_t fccob9, uint8_t fccoba, uint8_t fccobb,
743 uint8_t *ftfx_fstat)
744 {
745 uint8_t command[12] = {faddr & 0xff, (faddr >> 8) & 0xff, (faddr >> 16) & 0xff, fcmd,
746 fccob7, fccob6, fccob5, fccob4,
747 fccobb, fccoba, fccob9, fccob8};
748 int result, i;
749 uint8_t buffer;
750
751 /* wait for done */
752 for (i = 0; i < 50; i++) {
753 result =
754 target_read_memory(bank->target, FTFx_FSTAT, 1, 1, &buffer);
755
756 if (result != ERROR_OK)
757 return result;
758
759 if (buffer & 0x80)
760 break;
761
762 buffer = 0x00;
763 }
764
765 if (buffer != 0x80) {
766 /* reset error flags */
767 buffer = 0x30;
768 result =
769 target_write_memory(bank->target, FTFx_FSTAT, 1, 1, &buffer);
770 if (result != ERROR_OK)
771 return result;
772 }
773
774 result = target_write_memory(bank->target, FTFx_FCCOB3, 4, 3, command);
775
776 if (result != ERROR_OK)
777 return result;
778
779 /* start command */
780 buffer = 0x80;
781 result = target_write_memory(bank->target, FTFx_FSTAT, 1, 1, &buffer);
782 if (result != ERROR_OK)
783 return result;
784
785 /* wait for done */
786 for (i = 0; i < 240; i++) { /* Need longtime for "Mass Erase" Command Nemui Changed */
787 result =
788 target_read_memory(bank->target, FTFx_FSTAT, 1, 1, ftfx_fstat);
789
790 if (result != ERROR_OK)
791 return result;
792
793 if (*ftfx_fstat & 0x80)
794 break;
795 }
796
797 if ((*ftfx_fstat & 0xf0) != 0x80) {
798 LOG_ERROR
799 ("ftfx command failed FSTAT: %02X FCCOB: %02X%02X%02X%02X %02X%02X%02X%02X %02X%02X%02X%02X",
800 *ftfx_fstat, command[3], command[2], command[1], command[0],
801 command[7], command[6], command[5], command[4],
802 command[11], command[10], command[9], command[8]);
803 return ERROR_FLASH_OPERATION_FAILED;
804 }
805
806 return ERROR_OK;
807 }
808
809 COMMAND_HANDLER(kinetis_securing_test)
810 {
811 int result;
812 uint8_t ftfx_fstat;
813 struct target *target = get_current_target(CMD_CTX);
814 struct flash_bank *bank = NULL;
815
816 result = get_flash_bank_by_addr(target, 0x00000000, true, &bank);
817 if (result != ERROR_OK)
818 return result;
819
820 assert(bank != NULL);
821
822 if (target->state != TARGET_HALTED) {
823 LOG_ERROR("Target not halted");
824 return ERROR_TARGET_NOT_HALTED;
825 }
826
827 return kinetis_ftfx_command(bank, FTFx_CMD_SECTERASE, bank->base + 0x00000400,
828 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
829 }
830
831 static int kinetis_erase(struct flash_bank *bank, int first, int last)
832 {
833 int result, i;
834
835 if (bank->target->state != TARGET_HALTED) {
836 LOG_ERROR("Target not halted");
837 return ERROR_TARGET_NOT_HALTED;
838 }
839
840 if ((first > bank->num_sectors) || (last > bank->num_sectors))
841 return ERROR_FLASH_OPERATION_FAILED;
842
843 /*
844 * FIXME: TODO: use the 'Erase Flash Block' command if the
845 * requested erase is PFlash or NVM and encompasses the entire
846 * block. Should be quicker.
847 */
848 for (i = first; i <= last; i++) {
849 uint8_t ftfx_fstat;
850 /* set command and sector address */
851 result = kinetis_ftfx_command(bank, FTFx_CMD_SECTERASE, bank->base + bank->sectors[i].offset,
852 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
853
854 if (result != ERROR_OK) {
855 LOG_WARNING("erase sector %d failed", i);
856 return ERROR_FLASH_OPERATION_FAILED;
857 }
858
859 bank->sectors[i].is_erased = 1;
860 }
861
862 if (first == 0) {
863 LOG_WARNING
864 ("flash configuration field erased, please reset the device");
865 }
866
867 return ERROR_OK;
868 }
869
870 static int kinetis_write(struct flash_bank *bank, const uint8_t *buffer,
871 uint32_t offset, uint32_t count)
872 {
873 unsigned int i, result, fallback = 0;
874 uint8_t buf[8];
875 uint32_t wc;
876 struct kinetis_flash_bank *kinfo = bank->driver_priv;
877 uint8_t *new_buffer = NULL;
878
879 if (bank->target->state != TARGET_HALTED) {
880 LOG_ERROR("Target not halted");
881 return ERROR_TARGET_NOT_HALTED;
882 }
883
884 if (!(kinfo->flash_support & FS_PROGRAM_SECTOR)) {
885 /* fallback to longword write */
886 fallback = 1;
887 LOG_WARNING("This device supports Program Longword execution only.");
888 LOG_DEBUG("flash write into PFLASH @08%" PRIX32, offset);
889
890 } else if (kinfo->flash_class == FC_FLEX_NVM) {
891 uint8_t ftfx_fstat;
892
893 LOG_DEBUG("flash write into FlexNVM @%08" PRIX32, offset);
894
895 /* make flex ram available */
896 result = kinetis_ftfx_command(bank, FTFx_CMD_SETFLEXRAM, 0x00ff0000, 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
897
898 if (result != ERROR_OK)
899 return ERROR_FLASH_OPERATION_FAILED;
900
901 /* check if ram ready */
902 result = target_read_memory(bank->target, FTFx_FCNFG, 1, 1, buf);
903
904 if (result != ERROR_OK)
905 return result;
906
907 if (!(buf[0] & (1 << 1))) {
908 /* fallback to longword write */
909 fallback = 1;
910
911 LOG_WARNING("ram not ready, fallback to slow longword write (FCNFG: %02X)", buf[0]);
912 }
913 } else {
914 LOG_DEBUG("flash write into PFLASH @08%" PRIX32, offset);
915 }
916
917
918 /* program section command */
919 if (fallback == 0) {
920 /*
921 * Kinetis uses different terms for the granularity of
922 * sector writes, e.g. "phrase" or "128 bits". We use
923 * the generic term "chunk". The largest possible
924 * Kinetis "chunk" is 16 bytes (128 bits).
925 */
926 unsigned prog_section_chunk_bytes = kinfo->sector_size >> 8;
927 unsigned prog_size_bytes = kinfo->max_flash_prog_size;
928 for (i = 0; i < count; i += prog_size_bytes) {
929 uint8_t residual_buffer[16];
930 uint8_t ftfx_fstat;
931 uint32_t section_count = prog_size_bytes / prog_section_chunk_bytes;
932 uint32_t residual_wc = 0;
933
934 /*
935 * Assume the word count covers an entire
936 * sector.
937 */
938 wc = prog_size_bytes / 4;
939
940 /*
941 * If bytes to be programmed are less than the
942 * full sector, then determine the number of
943 * full-words to program, and put together the
944 * residual buffer so that a full "section"
945 * may always be programmed.
946 */
947 if ((count - i) < prog_size_bytes) {
948 /* number of bytes to program beyond full section */
949 unsigned residual_bc = (count-i) % prog_section_chunk_bytes;
950
951 /* number of complete words to copy directly from buffer */
952 wc = (count - i) / 4;
953
954 /* number of total sections to write, including residual */
955 section_count = DIV_ROUND_UP((count-i), prog_section_chunk_bytes);
956
957 /* any residual bytes delivers a whole residual section */
958 residual_wc = (residual_bc ? prog_section_chunk_bytes : 0)/4;
959
960 /* clear residual buffer then populate residual bytes */
961 (void) memset(residual_buffer, 0xff, prog_section_chunk_bytes);
962 (void) memcpy(residual_buffer, &buffer[i+4*wc], residual_bc);
963 }
964
965 LOG_DEBUG("write section @ %08" PRIX32 " with length %" PRIu32 " bytes",
966 offset + i, (uint32_t)wc*4);
967
968 /* write data to flexram as whole-words */
969 result = target_write_memory(bank->target, FLEXRAM, 4, wc,
970 buffer + i);
971
972 if (result != ERROR_OK) {
973 LOG_ERROR("target_write_memory failed");
974 return result;
975 }
976
977 /* write the residual words to the flexram */
978 if (residual_wc) {
979 result = target_write_memory(bank->target,
980 FLEXRAM+4*wc,
981 4, residual_wc,
982 residual_buffer);
983
984 if (result != ERROR_OK) {
985 LOG_ERROR("target_write_memory failed");
986 return result;
987 }
988 }
989
990 /* execute section-write command */
991 result = kinetis_ftfx_command(bank, FTFx_CMD_SECTWRITE, bank->base + offset + i,
992 section_count>>8, section_count, 0, 0,
993 0, 0, 0, 0, &ftfx_fstat);
994
995 if (result != ERROR_OK)
996 return ERROR_FLASH_OPERATION_FAILED;
997 }
998 }
999 /* program longword command, not supported in "SF3" devices */
1000 else if (kinfo->flash_support & FS_PROGRAM_LONGWORD) {
1001 if (count & 0x3) {
1002 uint32_t old_count = count;
1003 count = (old_count | 3) + 1;
1004 new_buffer = malloc(count);
1005 if (new_buffer == NULL) {
1006 LOG_ERROR("odd number of bytes to write and no memory "
1007 "for padding buffer");
1008 return ERROR_FAIL;
1009 }
1010 LOG_INFO("odd number of bytes to write (%" PRIu32 "), extending to %" PRIu32 " "
1011 "and padding with 0xff", old_count, count);
1012 memset(new_buffer, 0xff, count);
1013 buffer = memcpy(new_buffer, buffer, old_count);
1014 }
1015
1016 uint32_t words_remaining = count / 4;
1017
1018 /* try using a block write */
1019 int retval = kinetis_write_block(bank, buffer, offset, words_remaining);
1020
1021 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
1022 /* if block write failed (no sufficient working area),
1023 * we use normal (slow) single word accesses */
1024 LOG_WARNING("couldn't use block writes, falling back to single "
1025 "memory accesses");
1026
1027 for (i = 0; i < count; i += 4) {
1028 uint8_t ftfx_fstat;
1029
1030 LOG_DEBUG("write longword @ %08" PRIX32, (uint32_t)(offset + i));
1031
1032 uint8_t padding[4] = {0xff, 0xff, 0xff, 0xff};
1033 memcpy(padding, buffer + i, MIN(4, count-i));
1034
1035 result = kinetis_ftfx_command(bank, FTFx_CMD_LWORDPROG, bank->base + offset + i,
1036 padding[3], padding[2], padding[1], padding[0],
1037 0, 0, 0, 0, &ftfx_fstat);
1038
1039 if (result != ERROR_OK)
1040 return ERROR_FLASH_OPERATION_FAILED;
1041 }
1042 }
1043 } else {
1044 LOG_ERROR("Flash write strategy not implemented");
1045 return ERROR_FLASH_OPERATION_FAILED;
1046 }
1047
1048 return ERROR_OK;
1049 }
1050
1051 static int kinetis_read_part_info(struct flash_bank *bank)
1052 {
1053 int result, i;
1054 uint32_t offset = 0;
1055 uint8_t fcfg1_nvmsize, fcfg1_pfsize, fcfg1_eesize, fcfg2_pflsh;
1056 uint32_t nvm_size = 0, pf_size = 0, ee_size = 0;
1057 unsigned num_blocks = 0, num_pflash_blocks = 0, num_nvm_blocks = 0, first_nvm_bank = 0,
1058 reassign = 0, pflash_sector_size_bytes = 0, nvm_sector_size_bytes = 0;
1059 struct target *target = bank->target;
1060 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1061
1062 result = target_read_u32(target, SIM_SDID, &kinfo->sim_sdid);
1063 if (result != ERROR_OK)
1064 return result;
1065
1066 if ((kinfo->sim_sdid & (~KINETIS_SDID_K_SERIES_MASK)) == 0) {
1067 /* older K-series MCU */
1068 uint32_t mcu_type = kinfo->sim_sdid & KINETIS_K_SDID_TYPE_MASK;
1069
1070 switch (mcu_type) {
1071 case KINETIS_K_SDID_K10_M50:
1072 case KINETIS_K_SDID_K20_M50:
1073 /* 1kB sectors */
1074 pflash_sector_size_bytes = 1<<10;
1075 nvm_sector_size_bytes = 1<<10;
1076 num_blocks = 2;
1077 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_PROGRAM_SECTOR;
1078 break;
1079 case KINETIS_K_SDID_K10_M72:
1080 case KINETIS_K_SDID_K20_M72:
1081 case KINETIS_K_SDID_K30_M72:
1082 case KINETIS_K_SDID_K30_M100:
1083 case KINETIS_K_SDID_K40_M72:
1084 case KINETIS_K_SDID_K40_M100:
1085 case KINETIS_K_SDID_K50_M72:
1086 /* 2kB sectors, 1kB FlexNVM sectors */
1087 pflash_sector_size_bytes = 2<<10;
1088 nvm_sector_size_bytes = 1<<10;
1089 num_blocks = 2;
1090 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_PROGRAM_SECTOR;
1091 kinfo->max_flash_prog_size = 1<<10;
1092 break;
1093 case KINETIS_K_SDID_K10_M100:
1094 case KINETIS_K_SDID_K20_M100:
1095 case KINETIS_K_SDID_K11:
1096 case KINETIS_K_SDID_K12:
1097 case KINETIS_K_SDID_K21_M50:
1098 case KINETIS_K_SDID_K22_M50:
1099 case KINETIS_K_SDID_K51_M72:
1100 case KINETIS_K_SDID_K53:
1101 case KINETIS_K_SDID_K60_M100:
1102 /* 2kB sectors */
1103 pflash_sector_size_bytes = 2<<10;
1104 nvm_sector_size_bytes = 2<<10;
1105 num_blocks = 2;
1106 kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_PROGRAM_SECTOR;
1107 break;
1108 case KINETIS_K_SDID_K21_M120:
1109 case KINETIS_K_SDID_K22_M120:
1110 /* 4kB sectors (MK21FN1M0, MK21FX512, MK22FN1M0, MK22FX512) */
1111 pflash_sector_size_bytes = 4<<10;
1112 kinfo->max_flash_prog_size = 1<<10;
1113 nvm_sector_size_bytes = 4<<10;
1114 num_blocks = 2;
1115 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR;
1116 break;
1117 case KINETIS_K_SDID_K10_M120:
1118 case KINETIS_K_SDID_K20_M120:
1119 case KINETIS_K_SDID_K60_M150:
1120 case KINETIS_K_SDID_K70_M150:
1121 /* 4kB sectors */
1122 pflash_sector_size_bytes = 4<<10;
1123 nvm_sector_size_bytes = 4<<10;
1124 num_blocks = 4;
1125 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR;
1126 break;
1127 default:
1128 LOG_ERROR("Unsupported K-family FAMID");
1129 }
1130 } else {
1131 /* Newer K-series or KL series MCU */
1132 switch (kinfo->sim_sdid & KINETIS_SDID_SERIESID_MASK) {
1133 case KINETIS_SDID_SERIESID_K:
1134 switch (kinfo->sim_sdid & (KINETIS_SDID_FAMILYID_MASK | KINETIS_SDID_SUBFAMID_MASK)) {
1135 case KINETIS_SDID_FAMILYID_K0X | KINETIS_SDID_SUBFAMID_KX2:
1136 /* K02FN64, K02FN128: FTFA, 2kB sectors */
1137 pflash_sector_size_bytes = 2<<10;
1138 num_blocks = 1;
1139 kinfo->flash_support = FS_PROGRAM_LONGWORD;
1140 break;
1141
1142 case KINETIS_SDID_FAMILYID_K2X | KINETIS_SDID_SUBFAMID_KX2: {
1143 /* MK24FN1M reports as K22, this should detect it (according to errata note 1N83J) */
1144 uint32_t sopt1;
1145 result = target_read_u32(target, SIM_SOPT1, &sopt1);
1146 if (result != ERROR_OK)
1147 return result;
1148
1149 if (((kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K24FN1M) &&
1150 ((sopt1 & KINETIS_SOPT1_RAMSIZE_MASK) == KINETIS_SOPT1_RAMSIZE_K24FN1M)) {
1151 /* MK24FN1M */
1152 pflash_sector_size_bytes = 4<<10;
1153 num_blocks = 2;
1154 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR;
1155 kinfo->max_flash_prog_size = 1<<10;
1156 break;
1157 }
1158 if ((kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K22FN128
1159 || (kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K22FN256
1160 || (kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K22FN512) {
1161 /* K22 with new-style SDID - smaller pflash with FTFA, 2kB sectors */
1162 pflash_sector_size_bytes = 2<<10;
1163 num_blocks = 2; /* 1 or 2 blocks */
1164 kinfo->flash_support = FS_PROGRAM_LONGWORD;
1165 break;
1166 }
1167 LOG_ERROR("Unsupported Kinetis K22 DIEID");
1168 break;
1169 }
1170 case KINETIS_SDID_FAMILYID_K2X | KINETIS_SDID_SUBFAMID_KX4:
1171 pflash_sector_size_bytes = 4<<10;
1172 if ((kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K24FN256) {
1173 /* K24FN256 - smaller pflash with FTFA */
1174 num_blocks = 1;
1175 kinfo->flash_support = FS_PROGRAM_LONGWORD;
1176 break;
1177 }
1178 /* K24FN1M without errata 7534 */
1179 num_blocks = 2;
1180 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR;
1181 kinfo->max_flash_prog_size = 1<<10;
1182 break;
1183
1184 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX3:
1185 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX1: /* errata 7534 - should be K63 */
1186 /* K63FN1M0 */
1187 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX4:
1188 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX2: /* errata 7534 - should be K64 */
1189 /* K64FN1M0, K64FX512 */
1190 pflash_sector_size_bytes = 4<<10;
1191 nvm_sector_size_bytes = 4<<10;
1192 kinfo->max_flash_prog_size = 1<<10;
1193 num_blocks = 2;
1194 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR;
1195 break;
1196
1197 case KINETIS_SDID_FAMILYID_K2X | KINETIS_SDID_SUBFAMID_KX6:
1198 /* K26FN2M0 */
1199 case KINETIS_SDID_FAMILYID_K6X | KINETIS_SDID_SUBFAMID_KX6:
1200 /* K66FN2M0, K66FX1M0 */
1201 pflash_sector_size_bytes = 4<<10;
1202 nvm_sector_size_bytes = 4<<10;
1203 kinfo->max_flash_prog_size = 1<<10;
1204 num_blocks = 4;
1205 kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR;
1206 break;
1207 default:
1208 LOG_ERROR("Unsupported Kinetis FAMILYID SUBFAMID");
1209 }
1210 break;
1211 case KINETIS_SDID_SERIESID_KL:
1212 /* KL-series */
1213 pflash_sector_size_bytes = 1<<10;
1214 nvm_sector_size_bytes = 1<<10;
1215 num_blocks = 1;
1216 kinfo->flash_support = FS_PROGRAM_LONGWORD;
1217 break;
1218 default:
1219 LOG_ERROR("Unsupported K-series");
1220 }
1221 }
1222
1223 if (pflash_sector_size_bytes == 0) {
1224 LOG_ERROR("MCU is unsupported, SDID 0x%08" PRIx32, kinfo->sim_sdid);
1225 return ERROR_FLASH_OPER_UNSUPPORTED;
1226 }
1227
1228 result = target_read_u32(target, SIM_FCFG1, &kinfo->sim_fcfg1);
1229 if (result != ERROR_OK)
1230 return result;
1231
1232 result = target_read_u32(target, SIM_FCFG2, &kinfo->sim_fcfg2);
1233 if (result != ERROR_OK)
1234 return result;
1235 fcfg2_pflsh = (kinfo->sim_fcfg2 >> 23) & 0x01;
1236
1237 LOG_DEBUG("SDID: 0x%08" PRIX32 " FCFG1: 0x%08" PRIX32 " FCFG2: 0x%08" PRIX32, kinfo->sim_sdid,
1238 kinfo->sim_fcfg1, kinfo->sim_fcfg2);
1239
1240 fcfg1_nvmsize = (uint8_t)((kinfo->sim_fcfg1 >> 28) & 0x0f);
1241 fcfg1_pfsize = (uint8_t)((kinfo->sim_fcfg1 >> 24) & 0x0f);
1242 fcfg1_eesize = (uint8_t)((kinfo->sim_fcfg1 >> 16) & 0x0f);
1243
1244 /* when the PFLSH bit is set, there is no FlexNVM/FlexRAM */
1245 if (!fcfg2_pflsh) {
1246 switch (fcfg1_nvmsize) {
1247 case 0x03:
1248 case 0x07:
1249 case 0x09:
1250 case 0x0b:
1251 nvm_size = 1 << (14 + (fcfg1_nvmsize >> 1));
1252 break;
1253 case 0x0f:
1254 if (pflash_sector_size_bytes >= 4<<10)
1255 nvm_size = 512<<10;
1256 else
1257 /* K20_100 */
1258 nvm_size = 256<<10;
1259 break;
1260 default:
1261 nvm_size = 0;
1262 break;
1263 }
1264
1265 switch (fcfg1_eesize) {
1266 case 0x00:
1267 case 0x01:
1268 case 0x02:
1269 case 0x03:
1270 case 0x04:
1271 case 0x05:
1272 case 0x06:
1273 case 0x07:
1274 case 0x08:
1275 case 0x09:
1276 ee_size = (16 << (10 - fcfg1_eesize));
1277 break;
1278 default:
1279 ee_size = 0;
1280 break;
1281 }
1282 }
1283
1284 switch (fcfg1_pfsize) {
1285 case 0x03:
1286 case 0x05:
1287 case 0x07:
1288 case 0x09:
1289 case 0x0b:
1290 case 0x0d:
1291 pf_size = 1 << (14 + (fcfg1_pfsize >> 1));
1292 break;
1293 case 0x0f:
1294 if (pflash_sector_size_bytes >= 4<<10)
1295 pf_size = 1024<<10;
1296 else if (fcfg2_pflsh)
1297 pf_size = 512<<10;
1298 else
1299 pf_size = 256<<10;
1300 break;
1301 default:
1302 pf_size = 0;
1303 break;
1304 }
1305
1306 LOG_DEBUG("FlexNVM: %" PRIu32 " PFlash: %" PRIu32 " FlexRAM: %" PRIu32 " PFLSH: %d",
1307 nvm_size, pf_size, ee_size, fcfg2_pflsh);
1308
1309 num_pflash_blocks = num_blocks / (2 - fcfg2_pflsh);
1310 first_nvm_bank = num_pflash_blocks;
1311 num_nvm_blocks = num_blocks - num_pflash_blocks;
1312
1313 LOG_DEBUG("%d blocks total: %d PFlash, %d FlexNVM",
1314 num_blocks, num_pflash_blocks, num_nvm_blocks);
1315
1316 /*
1317 * If the flash class is already assigned, verify the
1318 * parameters.
1319 */
1320 if (kinfo->flash_class != FC_AUTO) {
1321 if (kinfo->bank_ordinal != (unsigned) bank->bank_number) {
1322 LOG_WARNING("Flash ordinal/bank number mismatch");
1323 reassign = 1;
1324 } else {
1325 switch (kinfo->flash_class) {
1326 case FC_PFLASH:
1327 if (kinfo->bank_ordinal >= first_nvm_bank) {
1328 LOG_WARNING("Class mismatch, bank %d is not PFlash", bank->bank_number);
1329 reassign = 1;
1330 } else if (bank->size != (pf_size / num_pflash_blocks)) {
1331 LOG_WARNING("PFlash size mismatch");
1332 reassign = 1;
1333 } else if (bank->base !=
1334 (0x00000000 + bank->size * kinfo->bank_ordinal)) {
1335 LOG_WARNING("PFlash address range mismatch");
1336 reassign = 1;
1337 } else if (kinfo->sector_size != pflash_sector_size_bytes) {
1338 LOG_WARNING("PFlash sector size mismatch");
1339 reassign = 1;
1340 } else {
1341 LOG_DEBUG("PFlash bank %d already configured okay",
1342 kinfo->bank_ordinal);
1343 }
1344 break;
1345 case FC_FLEX_NVM:
1346 if ((kinfo->bank_ordinal >= num_blocks) ||
1347 (kinfo->bank_ordinal < first_nvm_bank)) {
1348 LOG_WARNING("Class mismatch, bank %d is not FlexNVM", bank->bank_number);
1349 reassign = 1;
1350 } else if (bank->size != (nvm_size / num_nvm_blocks)) {
1351 LOG_WARNING("FlexNVM size mismatch");
1352 reassign = 1;
1353 } else if (bank->base !=
1354 (0x10000000 + bank->size * kinfo->bank_ordinal)) {
1355 LOG_WARNING("FlexNVM address range mismatch");
1356 reassign = 1;
1357 } else if (kinfo->sector_size != nvm_sector_size_bytes) {
1358 LOG_WARNING("FlexNVM sector size mismatch");
1359 reassign = 1;
1360 } else {
1361 LOG_DEBUG("FlexNVM bank %d already configured okay",
1362 kinfo->bank_ordinal);
1363 }
1364 break;
1365 case FC_FLEX_RAM:
1366 if (kinfo->bank_ordinal != num_blocks) {
1367 LOG_WARNING("Class mismatch, bank %d is not FlexRAM", bank->bank_number);
1368 reassign = 1;
1369 } else if (bank->size != ee_size) {
1370 LOG_WARNING("FlexRAM size mismatch");
1371 reassign = 1;
1372 } else if (bank->base != FLEXRAM) {
1373 LOG_WARNING("FlexRAM address mismatch");
1374 reassign = 1;
1375 } else if (kinfo->sector_size != nvm_sector_size_bytes) {
1376 LOG_WARNING("FlexRAM sector size mismatch");
1377 reassign = 1;
1378 } else {
1379 LOG_DEBUG("FlexRAM bank %d already configured okay", kinfo->bank_ordinal);
1380 }
1381 break;
1382
1383 default:
1384 LOG_WARNING("Unknown or inconsistent flash class");
1385 reassign = 1;
1386 break;
1387 }
1388 }
1389 } else {
1390 LOG_INFO("Probing flash info for bank %d", bank->bank_number);
1391 reassign = 1;
1392 }
1393
1394 if (!reassign)
1395 return ERROR_OK;
1396
1397 if ((unsigned)bank->bank_number < num_pflash_blocks) {
1398 /* pflash, banks start at address zero */
1399 kinfo->flash_class = FC_PFLASH;
1400 bank->size = (pf_size / num_pflash_blocks);
1401 bank->base = 0x00000000 + bank->size * bank->bank_number;
1402 kinfo->sector_size = pflash_sector_size_bytes;
1403 kinfo->protection_size = pf_size / 32;
1404 } else if ((unsigned)bank->bank_number < num_blocks) {
1405 /* nvm, banks start at address 0x10000000 */
1406 kinfo->flash_class = FC_FLEX_NVM;
1407 bank->size = (nvm_size / num_nvm_blocks);
1408 bank->base = 0x10000000 + bank->size * (bank->bank_number - first_nvm_bank);
1409 kinfo->sector_size = nvm_sector_size_bytes;
1410 kinfo->protection_size = 0; /* FIXME: TODO: depends on DEPART bits, chip */
1411 } else if ((unsigned)bank->bank_number == num_blocks) {
1412 LOG_ERROR("FlexRAM support not yet implemented");
1413 return ERROR_FLASH_OPER_UNSUPPORTED;
1414 } else {
1415 LOG_ERROR("Cannot determine parameters for bank %d, only %d banks on device",
1416 bank->bank_number, num_blocks);
1417 return ERROR_FLASH_BANK_INVALID;
1418 }
1419
1420 if (bank->sectors) {
1421 free(bank->sectors);
1422 bank->sectors = NULL;
1423 }
1424
1425 if (kinfo->sector_size == 0) {
1426 LOG_ERROR("Unknown sector size for bank %d", bank->bank_number);
1427 return ERROR_FLASH_BANK_INVALID;
1428 }
1429
1430 if (kinfo->flash_support & FS_PROGRAM_SECTOR
1431 && kinfo->max_flash_prog_size == 0) {
1432 kinfo->max_flash_prog_size = kinfo->sector_size;
1433 /* Program section size is equal to sector size by default */
1434 }
1435
1436 bank->num_sectors = bank->size / kinfo->sector_size;
1437 assert(bank->num_sectors > 0);
1438 bank->sectors = malloc(sizeof(struct flash_sector) * bank->num_sectors);
1439
1440 for (i = 0; i < bank->num_sectors; i++) {
1441 bank->sectors[i].offset = offset;
1442 bank->sectors[i].size = kinfo->sector_size;
1443 offset += kinfo->sector_size;
1444 bank->sectors[i].is_erased = -1;
1445 bank->sectors[i].is_protected = 1;
1446 }
1447
1448 return ERROR_OK;
1449 }
1450
1451 static int kinetis_probe(struct flash_bank *bank)
1452 {
1453 if (bank->target->state != TARGET_HALTED) {
1454 LOG_WARNING("Cannot communicate... target not halted.");
1455 return ERROR_TARGET_NOT_HALTED;
1456 }
1457
1458 return kinetis_read_part_info(bank);
1459 }
1460
1461 static int kinetis_auto_probe(struct flash_bank *bank)
1462 {
1463 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1464
1465 if (kinfo->sim_sdid)
1466 return ERROR_OK;
1467
1468 return kinetis_probe(bank);
1469 }
1470
1471 static int kinetis_info(struct flash_bank *bank, char *buf, int buf_size)
1472 {
1473 const char *bank_class_names[] = {
1474 "(ANY)", "PFlash", "FlexNVM", "FlexRAM"
1475 };
1476
1477 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1478
1479 (void) snprintf(buf, buf_size,
1480 "%s driver for %s flash bank %s at 0x%8.8" PRIx32 "",
1481 bank->driver->name, bank_class_names[kinfo->flash_class],
1482 bank->name, bank->base);
1483
1484 return ERROR_OK;
1485 }
1486
1487 static int kinetis_blank_check(struct flash_bank *bank)
1488 {
1489 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1490
1491 if (bank->target->state != TARGET_HALTED) {
1492 LOG_ERROR("Target not halted");
1493 return ERROR_TARGET_NOT_HALTED;
1494 }
1495
1496 if (kinfo->flash_class == FC_PFLASH) {
1497 int result;
1498 uint8_t ftfx_fstat;
1499
1500 /* check if whole bank is blank */
1501 result = kinetis_ftfx_command(bank, FTFx_CMD_BLOCKSTAT, bank->base, 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
1502
1503 if (result != ERROR_OK)
1504 return result;
1505
1506 if (ftfx_fstat & 0x01) {
1507 /* the whole bank is not erased, check sector-by-sector */
1508 int i;
1509 for (i = 0; i < bank->num_sectors; i++) {
1510 /* normal margin */
1511 result = kinetis_ftfx_command(bank, FTFx_CMD_SECTSTAT, bank->base + bank->sectors[i].offset,
1512 1, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
1513
1514 if (result == ERROR_OK) {
1515 bank->sectors[i].is_erased = !(ftfx_fstat & 0x01);
1516 } else {
1517 LOG_DEBUG("Ignoring errored PFlash sector blank-check");
1518 bank->sectors[i].is_erased = -1;
1519 }
1520 }
1521 } else {
1522 /* the whole bank is erased, update all sectors */
1523 int i;
1524 for (i = 0; i < bank->num_sectors; i++)
1525 bank->sectors[i].is_erased = 1;
1526 }
1527 } else {
1528 LOG_WARNING("kinetis_blank_check not supported yet for FlexNVM");
1529 return ERROR_FLASH_OPERATION_FAILED;
1530 }
1531
1532 return ERROR_OK;
1533 }
1534
1535 static const struct command_registration kinetis_securtiy_command_handlers[] = {
1536 {
1537 .name = "check_security",
1538 .mode = COMMAND_EXEC,
1539 .help = "",
1540 .usage = "",
1541 .handler = kinetis_check_flash_security_status,
1542 },
1543 {
1544 .name = "mass_erase",
1545 .mode = COMMAND_EXEC,
1546 .help = "",
1547 .usage = "",
1548 .handler = kinetis_mdm_mass_erase,
1549 },
1550 {
1551 .name = "test_securing",
1552 .mode = COMMAND_EXEC,
1553 .help = "",
1554 .usage = "",
1555 .handler = kinetis_securing_test,
1556 },
1557 COMMAND_REGISTRATION_DONE
1558 };
1559
1560 static const struct command_registration kinetis_exec_command_handlers[] = {
1561 {
1562 .name = "mdm",
1563 .mode = COMMAND_ANY,
1564 .help = "",
1565 .usage = "",
1566 .chain = kinetis_securtiy_command_handlers,
1567 },
1568 COMMAND_REGISTRATION_DONE
1569 };
1570
1571 static const struct command_registration kinetis_command_handler[] = {
1572 {
1573 .name = "kinetis",
1574 .mode = COMMAND_ANY,
1575 .help = "kinetis NAND flash controller commands",
1576 .usage = "",
1577 .chain = kinetis_exec_command_handlers,
1578 },
1579 COMMAND_REGISTRATION_DONE
1580 };
1581
1582
1583
1584 struct flash_driver kinetis_flash = {
1585 .name = "kinetis",
1586 .commands = kinetis_command_handler,
1587 .flash_bank_command = kinetis_flash_bank_command,
1588 .erase = kinetis_erase,
1589 .protect = kinetis_protect,
1590 .write = kinetis_write,
1591 .read = default_flash_read,
1592 .probe = kinetis_probe,
1593 .auto_probe = kinetis_auto_probe,
1594 .erase_check = kinetis_blank_check,
1595 .protect_check = kinetis_protect_check,
1596 .info = kinetis_info,
1597 };