1 /***************************************************************************
2 * Copyright (C) 2011 by Mathias Kuester *
5 * Copyright (C) 2011 sleep(5) ltd *
6 * tomas@sleepfive.com *
8 * Copyright (C) 2012 by Christopher D. Kilgour *
9 * techie at whiterocker.com *
11 * Copyright (C) 2013 Nemui Trinomius *
12 * nemuisan_kawausogasuki@live.jp *
14 * This program is free software; you can redistribute it and/or modify *
15 * it under the terms of the GNU General Public License as published by *
16 * the Free Software Foundation; either version 2 of the License, or *
17 * (at your option) any later version. *
19 * This program is distributed in the hope that it will be useful, *
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
22 * GNU General Public License for more details. *
24 * You should have received a copy of the GNU General Public License *
25 * along with this program; if not, write to the *
26 * Free Software Foundation, Inc., *
27 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *
28 ***************************************************************************/
35 #include <helper/binarybuffer.h>
36 #include <target/algorithm.h>
37 #include <target/armv7m.h>
38 #include <target/cortex_m.h>
41 * Implementation Notes
43 * The persistent memories in the Kinetis chip families K10 through
44 * K70 are all manipulated with the Flash Memory Module. Some
45 * variants call this module the FTFE, others call it the FTFL. To
46 * indicate that both are considered here, we use FTFX.
48 * Within the module, according to the chip variant, the persistent
49 * memory is divided into what Freescale terms Program Flash, FlexNVM,
50 * and FlexRAM. All chip variants have Program Flash. Some chip
51 * variants also have FlexNVM and FlexRAM, which always appear
54 * A given Kinetis chip may have 2 or 4 blocks of flash. Here we map
55 * each block to a separate bank. Each block size varies by chip and
56 * may be determined by the read-only SIM_FCFG1 register. The sector
57 * size within each bank/block varies by the chip granularity as
60 * Kinetis offers four different of flash granularities applicable
61 * across the chip families. The granularity is apparently reflected
62 * by at least the reference manual suffix. For example, for chip
63 * MK60FN1M0VLQ12, reference manual K60P144M150SF3RM ends in "SF3RM",
64 * where the "3" indicates there are four flash blocks with 4kiB
65 * sectors. All possible granularities are indicated below.
67 * The first half of the flash (1 or 2 blocks, depending on the
68 * granularity) is always Program Flash and always starts at address
69 * 0x00000000. The "PFLSH" flag, bit 23 of the read-only SIM_FCFG2
70 * register, determines whether the second half of the flash is also
71 * Program Flash or FlexNVM+FlexRAM. When PFLSH is set, the second
72 * half of flash is Program Flash and is contiguous in the memory map
73 * from the first half. When PFLSH is clear, the second half of flash
74 * is FlexNVM and always starts at address 0x10000000. FlexRAM, which
75 * is also present when PFLSH is clear, always starts at address
78 * The Flash Memory Module provides a register set where flash
79 * commands are loaded to perform flash operations like erase and
80 * program. Different commands are available depending on whether
81 * Program Flash or FlexNVM/FlexRAM is being manipulated. Although
82 * the commands used are quite consistent between flash blocks, the
83 * parameters they accept differ according to the flash granularity.
84 * Some Kinetis chips have different granularity between Program Flash
85 * and FlexNVM/FlexRAM, so flash command arguments may differ between
86 * blocks in the same chip.
91 unsigned pflash_sector_size_bytes;
92 unsigned nvm_sector_size_bytes;
94 } kinetis_flash_params[4] = {
102 #define FLEXRAM 0x14000000
103 #define FTFx_FSTAT 0x40020000
104 #define FTFx_FCNFG 0x40020001
105 #define FTFx_FCCOB3 0x40020004
106 #define FTFx_FPROT3 0x40020010
107 #define SIM_SDID 0x40048024
108 #define SIM_FCFG1 0x4004804c
109 #define SIM_FCFG2 0x40048050
112 #define FTFx_CMD_BLOCKSTAT 0x00
113 #define FTFx_CMD_SECTSTAT 0x01
114 #define FTFx_CMD_LWORDPROG 0x06
115 #define FTFx_CMD_SECTERASE 0x09
116 #define FTFx_CMD_SECTWRITE 0x0b
117 #define FTFx_CMD_SETFLEXRAM 0x81
118 #define FTFx_CMD_MASSERASE 0x44
120 /* The Kinetis K series uses the following SDID layout :
127 * The Kinetis KL series uses the following SDID layout :
129 * Bit 27-24 : SUBFAMID
130 * Bit 23-20 : SERIESID
131 * Bit 19-16 : SRAMSIZE
133 * Bit 6-4 : Reserved (0)
136 * SERIESID should be 1 for the KL-series so we assume that if
137 * bits 31-16 are 0 then it's a K-series MCU.
140 #define KINETIS_SDID_K_SERIES_MASK 0x0000FFFF
142 #define KINETIS_SDID_DIEID_MASK 0x00000F80
143 #define KINETIS_SDID_DIEID_K_A 0x00000100
144 #define KINETIS_SDID_DIEID_K_B 0x00000200
145 #define KINETIS_SDID_DIEID_KL 0x00000000
147 /* We can't rely solely on the FAMID field to determine the MCU
148 * type since some FAMID values identify multiple MCUs with
149 * different flash sector sizes (K20 and K22 for instance).
150 * Therefore we combine it with the DIEID bits which may possibly
151 * break if Freescale bumps the DIEID for a particular MCU. */
152 #define KINETIS_K_SDID_TYPE_MASK 0x00000FF0
153 #define KINETIS_K_SDID_K10_M50 0x00000000
154 #define KINETIS_K_SDID_K10_M72 0x00000080
155 #define KINETIS_K_SDID_K10_M100 0x00000100
156 #define KINETIS_K_SDID_K10_M120 0x00000180
157 #define KINETIS_K_SDID_K11 0x00000220
158 #define KINETIS_K_SDID_K12 0x00000200
159 #define KINETIS_K_SDID_K20_M50 0x00000010
160 #define KINETIS_K_SDID_K20_M72 0x00000090
161 #define KINETIS_K_SDID_K20_M100 0x00000110
162 #define KINETIS_K_SDID_K20_M120 0x00000190
163 #define KINETIS_K_SDID_K21_M50 0x00000230
164 #define KINETIS_K_SDID_K21_M120 0x00000330
165 #define KINETIS_K_SDID_K22_M50 0x00000210
166 #define KINETIS_K_SDID_K22_M120 0x00000310
167 #define KINETIS_K_SDID_K30_M72 0x000000A0
168 #define KINETIS_K_SDID_K30_M100 0x00000120
169 #define KINETIS_K_SDID_K40_M72 0x000000B0
170 #define KINETIS_K_SDID_K40_M100 0x00000130
171 #define KINETIS_K_SDID_K50_M72 0x000000E0
172 #define KINETIS_K_SDID_K51_M72 0x000000F0
173 #define KINETIS_K_SDID_K53 0x00000170
174 #define KINETIS_K_SDID_K60_M100 0x00000140
175 #define KINETIS_K_SDID_K60_M150 0x000001C0
176 #define KINETIS_K_SDID_K70_M150 0x000001D0
178 #define KINETIS_KL_SDID_SERIESID_MASK 0x00F00000
179 #define KINETIS_KL_SDID_SERIESID_KL 0x00100000
181 struct kinetis_flash_bank {
182 unsigned granularity;
183 unsigned bank_ordinal;
184 uint32_t sector_size;
185 uint32_t protection_size;
202 #define MDM_REG_STAT 0x00
203 #define MDM_REG_CTRL 0x04
204 #define MDM_REG_ID 0xfc
206 #define MDM_STAT_FMEACK (1<<0)
207 #define MDM_STAT_FREADY (1<<1)
208 #define MDM_STAT_SYSSEC (1<<2)
209 #define MDM_STAT_SYSRES (1<<3)
210 #define MDM_STAT_FMEEN (1<<5)
211 #define MDM_STAT_BACKDOOREN (1<<6)
212 #define MDM_STAT_LPEN (1<<7)
213 #define MDM_STAT_VLPEN (1<<8)
214 #define MDM_STAT_LLSMODEXIT (1<<9)
215 #define MDM_STAT_VLLSXMODEXIT (1<<10)
216 #define MDM_STAT_CORE_HALTED (1<<16)
217 #define MDM_STAT_CORE_SLEEPDEEP (1<<17)
218 #define MDM_STAT_CORESLEEPING (1<<18)
220 #define MEM_CTRL_FMEIP (1<<0)
221 #define MEM_CTRL_DBG_DIS (1<<1)
222 #define MEM_CTRL_DBG_REQ (1<<2)
223 #define MEM_CTRL_SYS_RES_REQ (1<<3)
224 #define MEM_CTRL_CORE_HOLD_RES (1<<4)
225 #define MEM_CTRL_VLLSX_DBG_REQ (1<<5)
226 #define MEM_CTRL_VLLSX_DBG_ACK (1<<6)
227 #define MEM_CTRL_VLLSX_STAT_ACK (1<<7)
229 #define MDM_ACCESS_TIMEOUT 3000 /* iterations */
231 static int kinetis_mdm_write_register(struct adiv5_dap *dap, unsigned reg, uint32_t value)
234 LOG_DEBUG("MDM_REG[0x%02x] <- %08" PRIX32, reg, value);
236 retval = dap_queue_ap_write(dap, reg, value);
237 if (retval != ERROR_OK) {
238 LOG_DEBUG("MDM: failed to queue a write request");
242 retval = dap_run(dap);
243 if (retval != ERROR_OK) {
244 LOG_DEBUG("MDM: dap_run failed");
252 static int kinetis_mdm_read_register(struct adiv5_dap *dap, unsigned reg, uint32_t *result)
255 retval = dap_queue_ap_read(dap, reg, result);
256 if (retval != ERROR_OK) {
257 LOG_DEBUG("MDM: failed to queue a read request");
261 retval = dap_run(dap);
262 if (retval != ERROR_OK) {
263 LOG_DEBUG("MDM: dap_run failed");
267 LOG_DEBUG("MDM_REG[0x%02x]: %08" PRIX32, reg, *result);
271 static int kinetis_mdm_poll_register(struct adiv5_dap *dap, unsigned reg, uint32_t mask, uint32_t value)
275 int timeout = MDM_ACCESS_TIMEOUT;
278 retval = kinetis_mdm_read_register(dap, reg, &val);
279 if (retval != ERROR_OK || (val & mask) == value)
285 LOG_DEBUG("MDM: polling timed out");
290 * This function implements the procedure to mass erase the flash via
291 * SWD/JTAG on Kinetis K and L series of devices as it is described in
292 * AN4835 "Production Flash Programming Best Practices for Kinetis K-
293 * and L-series MCUs" Section 4.2.1
295 COMMAND_HANDLER(kinetis_mdm_mass_erase)
297 struct target *target = get_current_target(CMD_CTX);
298 struct cortex_m_common *cortex_m = target_to_cm(target);
299 struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
302 LOG_ERROR("Cannot perform mass erase with a high-level adapter");
307 const uint8_t original_ap = dap->ap_current;
310 * ... Power on the processor, or if power has already been
311 * applied, assert the RESET pin to reset the processor. For
312 * devices that do not have a RESET pin, write the System
313 * Reset Request bit in the MDM-AP control register after
314 * establishing communication...
316 dap_ap_select(dap, 1);
318 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, MEM_CTRL_SYS_RES_REQ);
319 if (retval != ERROR_OK)
323 * ... Read the MDM-AP status register until the Flash Ready bit sets...
325 retval = kinetis_mdm_poll_register(dap, MDM_REG_STAT,
326 MDM_STAT_FREADY | MDM_STAT_SYSRES,
328 if (retval != ERROR_OK) {
329 LOG_ERROR("MDM : flash ready timeout");
334 * ... Write the MDM-AP control register to set the Flash Mass
335 * Erase in Progress bit. This will start the mass erase
338 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL,
339 MEM_CTRL_SYS_RES_REQ | MEM_CTRL_FMEIP);
340 if (retval != ERROR_OK)
343 /* As a sanity check make sure that device started mass erase procedure */
344 retval = kinetis_mdm_poll_register(dap, MDM_REG_STAT,
345 MDM_STAT_FMEACK, MDM_STAT_FMEACK);
346 if (retval != ERROR_OK)
350 * ... Read the MDM-AP control register until the Flash Mass
351 * Erase in Progress bit clears...
353 retval = kinetis_mdm_poll_register(dap, MDM_REG_CTRL,
356 if (retval != ERROR_OK)
360 * ... Negate the RESET signal or clear the System Reset Request
361 * bit in the MDM-AP control register...
363 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, 0);
364 if (retval != ERROR_OK)
367 dap_ap_select(dap, original_ap);
371 static const uint32_t kinetis_known_mdm_ids[] = {
372 0x001C0020, /* KL26Z */
376 * This function implements the procedure to connect to
377 * SWD/JTAG on Kinetis K and L series of devices as it is described in
378 * AN4835 "Production Flash Programming Best Practices for Kinetis K-
379 * and L-series MCUs" Section 4.1.1
381 COMMAND_HANDLER(kinetis_check_flash_security_status)
383 struct target *target = get_current_target(CMD_CTX);
384 struct cortex_m_common *cortex_m = target_to_cm(target);
385 struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
388 LOG_WARNING("Cannot check flash security status with a high-level adapter");
394 const uint8_t origninal_ap = dap->ap_current;
396 dap_ap_select(dap, 1);
400 * ... The MDM-AP ID register can be read to verify that the
401 * connection is working correctly...
403 retval = kinetis_mdm_read_register(dap, MDM_REG_ID, &val);
404 if (retval != ERROR_OK) {
405 LOG_ERROR("MDM: failed to read ID register");
410 for (size_t i = 0; i < ARRAY_SIZE(kinetis_known_mdm_ids); i++) {
411 if (val == kinetis_known_mdm_ids[i]) {
418 LOG_WARNING("MDM: unknown ID %08" PRIX32, val);
421 * ... Read the MDM-AP status register until the Flash Ready bit sets...
423 retval = kinetis_mdm_poll_register(dap, MDM_REG_STAT,
426 if (retval != ERROR_OK) {
427 LOG_ERROR("MDM: flash ready timeout");
432 * ... Read the System Security bit to determine if security is enabled.
433 * If System Security = 0, then proceed. If System Security = 1, then
434 * communication with the internals of the processor, including the
435 * flash, will not be possible without issuing a mass erase command or
436 * unsecuring the part through other means (backdoor key unlock)...
438 retval = kinetis_mdm_read_register(dap, MDM_REG_STAT, &val);
439 if (retval != ERROR_OK) {
440 LOG_ERROR("MDM: failed to read MDM_REG_STAT");
444 if (val & MDM_STAT_SYSSEC) {
445 jtag_poll_set_enabled(false);
447 LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
448 LOG_WARNING("**** ****");
449 LOG_WARNING("**** Your Kinetis MCU is in secured state, which means that, ****");
450 LOG_WARNING("**** with exeption for very basic communication, JTAG/SWD ****");
451 LOG_WARNING("**** interface will NOT work. In order to restore its ****");
452 LOG_WARNING("**** functionality please issue 'kinetis mdm mass_erase' ****");
453 LOG_WARNING("**** command, power cycle the MCU and restart openocd. ****");
454 LOG_WARNING("**** ****");
455 LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
457 LOG_INFO("MDM: Chip is unsecured. Continuing.");
458 jtag_poll_set_enabled(true);
461 dap_ap_select(dap, origninal_ap);
466 LOG_ERROR("MDM: Failed to check security status of the MCU. Cannot proceed further");
467 jtag_poll_set_enabled(false);
471 FLASH_BANK_COMMAND_HANDLER(kinetis_flash_bank_command)
473 struct kinetis_flash_bank *bank_info;
476 return ERROR_COMMAND_SYNTAX_ERROR;
478 LOG_INFO("add flash_bank kinetis %s", bank->name);
480 bank_info = malloc(sizeof(struct kinetis_flash_bank));
482 memset(bank_info, 0, sizeof(struct kinetis_flash_bank));
484 bank->driver_priv = bank_info;
489 /* Kinetis Program-LongWord Microcodes */
490 static const uint8_t kinetis_flash_write_code[] = {
492 * r0 - workarea buffer
493 * r1 - target address
503 /* for(register uint32_t i=0;i<wcount;i++){ */
504 0x04, 0x1C, /* mov r4, r0 */
505 0x00, 0x23, /* mov r3, #0 */
507 0x0E, 0x1A, /* sub r6, r1, r0 */
508 0xA6, 0x19, /* add r6, r4, r6 */
509 0x93, 0x42, /* cmp r3, r2 */
510 0x16, 0xD0, /* beq .L9 */
512 /* while((FTFx_FSTAT&FTFA_FSTAT_CCIF_MASK) != FTFA_FSTAT_CCIF_MASK){}; */
513 0x0B, 0x4D, /* ldr r5, .L10 */
514 0x2F, 0x78, /* ldrb r7, [r5] */
515 0x7F, 0xB2, /* sxtb r7, r7 */
516 0x00, 0x2F, /* cmp r7, #0 */
517 0xFA, 0xDA, /* bge .L5 */
518 /* FTFx_FSTAT = FTFA_FSTAT_ACCERR_MASK|FTFA_FSTAT_FPVIOL_MASK|FTFA_FSTAT_RDCO */
519 0x70, 0x27, /* mov r7, #112 */
520 0x2F, 0x70, /* strb r7, [r5] */
521 /* FTFx_FCCOB3 = faddr; */
522 0x09, 0x4F, /* ldr r7, .L10+4 */
523 0x3E, 0x60, /* str r6, [r7] */
524 0x06, 0x27, /* mov r7, #6 */
525 /* FTFx_FCCOB0 = 0x06; */
526 0x08, 0x4E, /* ldr r6, .L10+8 */
527 0x37, 0x70, /* strb r7, [r6] */
528 /* FTFx_FCCOB7 = *pLW; */
529 0x80, 0xCC, /* ldmia r4!, {r7} */
530 0x08, 0x4E, /* ldr r6, .L10+12 */
531 0x37, 0x60, /* str r7, [r6] */
532 /* FTFx_FSTAT = FTFA_FSTAT_CCIF_MASK; */
533 0x80, 0x27, /* mov r7, #128 */
534 0x2F, 0x70, /* strb r7, [r5] */
536 /* while((FTFx_FSTAT&FTFA_FSTAT_CCIF_MASK) != FTFA_FSTAT_CCIF_MASK){}; */
537 0x2E, 0x78, /* ldrb r6, [r5] */
538 0x77, 0xB2, /* sxtb r7, r6 */
539 0x00, 0x2F, /* cmp r7, #0 */
540 0xFB, 0xDA, /* bge .L4 */
541 0x01, 0x33, /* add r3, r3, #1 */
542 0xE4, 0xE7, /* b .L2 */
544 0x00, 0xBE, /* bkpt #0 */
546 0x00, 0x00, 0x02, 0x40, /* .word 1073872896 */
547 0x04, 0x00, 0x02, 0x40, /* .word 1073872900 */
548 0x07, 0x00, 0x02, 0x40, /* .word 1073872903 */
549 0x08, 0x00, 0x02, 0x40, /* .word 1073872904 */
552 /* Program LongWord Block Write */
553 static int kinetis_write_block(struct flash_bank *bank, const uint8_t *buffer,
554 uint32_t offset, uint32_t wcount)
556 struct target *target = bank->target;
557 uint32_t buffer_size = 2048; /* Default minimum value */
558 struct working_area *write_algorithm;
559 struct working_area *source;
560 uint32_t address = bank->base + offset;
561 struct reg_param reg_params[3];
562 struct armv7m_algorithm armv7m_info;
563 int retval = ERROR_OK;
566 * r0 - workarea buffer
567 * r1 - target address
576 /* Increase buffer_size if needed */
577 if (buffer_size < (target->working_area_size/2))
578 buffer_size = (target->working_area_size/2);
580 LOG_INFO("Kinetis: FLASH Write ...");
582 /* check code alignment */
584 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
585 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
588 /* allocate working area with flash programming code */
589 if (target_alloc_working_area(target, sizeof(kinetis_flash_write_code),
590 &write_algorithm) != ERROR_OK) {
591 LOG_WARNING("no working area available, can't do block memory writes");
592 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
595 retval = target_write_buffer(target, write_algorithm->address,
596 sizeof(kinetis_flash_write_code), kinetis_flash_write_code);
597 if (retval != ERROR_OK)
601 while (target_alloc_working_area(target, buffer_size, &source) != ERROR_OK) {
603 if (buffer_size <= 256) {
604 /* free working area, write algorithm already allocated */
605 target_free_working_area(target, write_algorithm);
607 LOG_WARNING("No large enough working area available, can't do block memory writes");
608 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
612 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
613 armv7m_info.core_mode = ARM_MODE_THREAD;
615 init_reg_param(®_params[0], "r0", 32, PARAM_OUT); /* *pLW (*buffer) */
616 init_reg_param(®_params[1], "r1", 32, PARAM_OUT); /* faddr */
617 init_reg_param(®_params[2], "r2", 32, PARAM_OUT); /* number of words to program */
619 /* write code buffer and use Flash programming code within kinetis */
620 /* Set breakpoint to 0 with time-out of 1000 ms */
622 uint32_t thisrun_count = (wcount > (buffer_size / 4)) ? (buffer_size / 4) : wcount;
624 retval = target_write_buffer(target, source->address, thisrun_count * 4, buffer);
625 if (retval != ERROR_OK)
628 buf_set_u32(reg_params[0].value, 0, 32, source->address);
629 buf_set_u32(reg_params[1].value, 0, 32, address);
630 buf_set_u32(reg_params[2].value, 0, 32, thisrun_count);
632 retval = target_run_algorithm(target, 0, NULL, 3, reg_params,
633 write_algorithm->address, 0, 100000, &armv7m_info);
634 if (retval != ERROR_OK) {
635 LOG_ERROR("Error executing kinetis Flash programming algorithm");
636 retval = ERROR_FLASH_OPERATION_FAILED;
640 buffer += thisrun_count * 4;
641 address += thisrun_count * 4;
642 wcount -= thisrun_count;
645 target_free_working_area(target, source);
646 target_free_working_area(target, write_algorithm);
648 destroy_reg_param(®_params[0]);
649 destroy_reg_param(®_params[1]);
650 destroy_reg_param(®_params[2]);
655 static int kinetis_protect(struct flash_bank *bank, int set, int first, int last)
657 LOG_WARNING("kinetis_protect not supported yet");
660 if (bank->target->state != TARGET_HALTED) {
661 LOG_ERROR("Target not halted");
662 return ERROR_TARGET_NOT_HALTED;
665 return ERROR_FLASH_BANK_INVALID;
668 static int kinetis_protect_check(struct flash_bank *bank)
670 struct kinetis_flash_bank *kinfo = bank->driver_priv;
672 if (bank->target->state != TARGET_HALTED) {
673 LOG_ERROR("Target not halted");
674 return ERROR_TARGET_NOT_HALTED;
677 if (kinfo->flash_class == FC_PFLASH) {
680 uint32_t fprot, psec;
683 /* read protection register */
684 result = target_read_memory(bank->target, FTFx_FPROT3, 1, 4, buffer);
686 if (result != ERROR_OK)
689 fprot = target_buffer_get_u32(bank->target, buffer);
692 * Every bit protects 1/32 of the full flash (not necessarily
693 * just this bank), but we enforce the bank ordinals for
694 * PFlash to start at zero.
696 b = kinfo->bank_ordinal * (bank->size / kinfo->protection_size);
697 for (psec = 0, i = 0; i < bank->num_sectors; i++) {
698 if ((fprot >> b) & 1)
699 bank->sectors[i].is_protected = 0;
701 bank->sectors[i].is_protected = 1;
703 psec += bank->sectors[i].size;
705 if (psec >= kinfo->protection_size) {
711 LOG_ERROR("Protection checks for FlexNVM not yet supported");
712 return ERROR_FLASH_BANK_INVALID;
718 static int kinetis_ftfx_command(struct flash_bank *bank, uint8_t fcmd, uint32_t faddr,
719 uint8_t fccob4, uint8_t fccob5, uint8_t fccob6, uint8_t fccob7,
720 uint8_t fccob8, uint8_t fccob9, uint8_t fccoba, uint8_t fccobb,
723 uint8_t command[12] = {faddr & 0xff, (faddr >> 8) & 0xff, (faddr >> 16) & 0xff, fcmd,
724 fccob7, fccob6, fccob5, fccob4,
725 fccobb, fccoba, fccob9, fccob8};
730 for (i = 0; i < 50; i++) {
732 target_read_memory(bank->target, FTFx_FSTAT, 1, 1, &buffer);
734 if (result != ERROR_OK)
743 if (buffer != 0x80) {
744 /* reset error flags */
747 target_write_memory(bank->target, FTFx_FSTAT, 1, 1, &buffer);
748 if (result != ERROR_OK)
752 result = target_write_memory(bank->target, FTFx_FCCOB3, 4, 3, command);
754 if (result != ERROR_OK)
759 result = target_write_memory(bank->target, FTFx_FSTAT, 1, 1, &buffer);
760 if (result != ERROR_OK)
764 for (i = 0; i < 240; i++) { /* Need longtime for "Mass Erase" Command Nemui Changed */
766 target_read_memory(bank->target, FTFx_FSTAT, 1, 1, ftfx_fstat);
768 if (result != ERROR_OK)
771 if (*ftfx_fstat & 0x80)
775 if ((*ftfx_fstat & 0xf0) != 0x80) {
777 ("ftfx command failed FSTAT: %02X FCCOB: %02X%02X%02X%02X %02X%02X%02X%02X %02X%02X%02X%02X",
778 *ftfx_fstat, command[3], command[2], command[1], command[0],
779 command[7], command[6], command[5], command[4],
780 command[11], command[10], command[9], command[8]);
781 return ERROR_FLASH_OPERATION_FAILED;
787 static int kinetis_mass_erase(struct flash_bank *bank)
791 if (bank->target->state != TARGET_HALTED) {
792 LOG_ERROR("Target not halted");
793 return ERROR_TARGET_NOT_HALTED;
796 LOG_INFO("Execute Erase All Blocks");
797 return kinetis_ftfx_command(bank, FTFx_CMD_MASSERASE, 0,
798 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
801 COMMAND_HANDLER(kinetis_securing_test)
805 struct target *target = get_current_target(CMD_CTX);
806 struct flash_bank *bank = NULL;
808 result = get_flash_bank_by_addr(target, 0x00000000, true, &bank);
809 if (result != ERROR_OK)
812 assert(bank != NULL);
814 if (target->state != TARGET_HALTED) {
815 LOG_ERROR("Target not halted");
816 return ERROR_TARGET_NOT_HALTED;
819 return kinetis_ftfx_command(bank, FTFx_CMD_SECTERASE, bank->base + 0x00000400,
820 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
823 static int kinetis_erase(struct flash_bank *bank, int first, int last)
827 if (bank->target->state != TARGET_HALTED) {
828 LOG_ERROR("Target not halted");
829 return ERROR_TARGET_NOT_HALTED;
832 if ((first > bank->num_sectors) || (last > bank->num_sectors))
833 return ERROR_FLASH_OPERATION_FAILED;
835 if ((first == 0) && (last == (bank->num_sectors - 1)))
836 return kinetis_mass_erase(bank);
839 * FIXME: TODO: use the 'Erase Flash Block' command if the
840 * requested erase is PFlash or NVM and encompasses the entire
841 * block. Should be quicker.
843 for (i = first; i <= last; i++) {
845 /* set command and sector address */
846 result = kinetis_ftfx_command(bank, FTFx_CMD_SECTERASE, bank->base + bank->sectors[i].offset,
847 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
849 if (result != ERROR_OK) {
850 LOG_WARNING("erase sector %d failed", i);
851 return ERROR_FLASH_OPERATION_FAILED;
854 bank->sectors[i].is_erased = 1;
859 ("flash configuration field erased, please reset the device");
865 static int kinetis_write(struct flash_bank *bank, const uint8_t *buffer,
866 uint32_t offset, uint32_t count)
868 unsigned int i, result, fallback = 0;
871 struct kinetis_flash_bank *kinfo = bank->driver_priv;
872 uint8_t *new_buffer = NULL;
874 if (bank->target->state != TARGET_HALTED) {
875 LOG_ERROR("Target not halted");
876 return ERROR_TARGET_NOT_HALTED;
880 /* fallback to longword write */
882 LOG_WARNING("Kinetis L Series supports Program Longword execution only.");
883 LOG_DEBUG("flash write into PFLASH @08%" PRIX32, offset);
885 } else if (kinfo->flash_class == FC_FLEX_NVM) {
888 LOG_DEBUG("flash write into FlexNVM @%08" PRIX32, offset);
890 /* make flex ram available */
891 result = kinetis_ftfx_command(bank, FTFx_CMD_SETFLEXRAM, 0x00ff0000, 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
893 if (result != ERROR_OK)
894 return ERROR_FLASH_OPERATION_FAILED;
896 /* check if ram ready */
897 result = target_read_memory(bank->target, FTFx_FCNFG, 1, 1, buf);
899 if (result != ERROR_OK)
902 if (!(buf[0] & (1 << 1))) {
903 /* fallback to longword write */
906 LOG_WARNING("ram not ready, fallback to slow longword write (FCNFG: %02X)", buf[0]);
909 LOG_DEBUG("flash write into PFLASH @08%" PRIX32, offset);
913 /* program section command */
916 * Kinetis uses different terms for the granularity of
917 * sector writes, e.g. "phrase" or "128 bits". We use
918 * the generic term "chunk". The largest possible
919 * Kinetis "chunk" is 16 bytes (128 bits).
921 unsigned prog_section_chunk_bytes = kinfo->sector_size >> 8;
922 /* assume the NVM sector size is half the FlexRAM size */
923 unsigned prog_size_bytes = MIN(kinfo->sector_size,
924 kinetis_flash_params[kinfo->granularity].nvm_sector_size_bytes);
925 for (i = 0; i < count; i += prog_size_bytes) {
926 uint8_t residual_buffer[16];
928 uint32_t section_count = prog_size_bytes / prog_section_chunk_bytes;
929 uint32_t residual_wc = 0;
932 * Assume the word count covers an entire
935 wc = prog_size_bytes / 4;
938 * If bytes to be programmed are less than the
939 * full sector, then determine the number of
940 * full-words to program, and put together the
941 * residual buffer so that a full "section"
942 * may always be programmed.
944 if ((count - i) < prog_size_bytes) {
945 /* number of bytes to program beyond full section */
946 unsigned residual_bc = (count-i) % prog_section_chunk_bytes;
948 /* number of complete words to copy directly from buffer */
949 wc = (count - i) / 4;
951 /* number of total sections to write, including residual */
952 section_count = DIV_ROUND_UP((count-i), prog_section_chunk_bytes);
954 /* any residual bytes delivers a whole residual section */
955 residual_wc = (residual_bc ? prog_section_chunk_bytes : 0)/4;
957 /* clear residual buffer then populate residual bytes */
958 (void) memset(residual_buffer, 0xff, prog_section_chunk_bytes);
959 (void) memcpy(residual_buffer, &buffer[i+4*wc], residual_bc);
962 LOG_DEBUG("write section @ %08" PRIX32 " with length %" PRIu32 " bytes",
963 offset + i, (uint32_t)wc*4);
965 /* write data to flexram as whole-words */
966 result = target_write_memory(bank->target, FLEXRAM, 4, wc,
969 if (result != ERROR_OK) {
970 LOG_ERROR("target_write_memory failed");
974 /* write the residual words to the flexram */
976 result = target_write_memory(bank->target,
981 if (result != ERROR_OK) {
982 LOG_ERROR("target_write_memory failed");
987 /* execute section-write command */
988 result = kinetis_ftfx_command(bank, FTFx_CMD_SECTWRITE, bank->base + offset + i,
989 section_count>>8, section_count, 0, 0,
990 0, 0, 0, 0, &ftfx_fstat);
992 if (result != ERROR_OK)
993 return ERROR_FLASH_OPERATION_FAILED;
996 /* program longword command, not supported in "SF3" devices */
997 else if ((kinfo->granularity != 3) || (kinfo->klxx)) {
1000 uint32_t old_count = count;
1001 count = (old_count | 3) + 1;
1002 new_buffer = malloc(count);
1003 if (new_buffer == NULL) {
1004 LOG_ERROR("odd number of bytes to write and no memory "
1005 "for padding buffer");
1008 LOG_INFO("odd number of bytes to write (%" PRIu32 "), extending to %" PRIu32 " "
1009 "and padding with 0xff", old_count, count);
1010 memset(new_buffer, 0xff, count);
1011 buffer = memcpy(new_buffer, buffer, old_count);
1014 uint32_t words_remaining = count / 4;
1016 /* try using a block write */
1017 int retval = kinetis_write_block(bank, buffer, offset, words_remaining);
1019 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
1020 /* if block write failed (no sufficient working area),
1021 * we use normal (slow) single word accesses */
1022 LOG_WARNING("couldn't use block writes, falling back to single "
1025 for (i = 0; i < count; i += 4) {
1028 LOG_DEBUG("write longword @ %08" PRIX32, (uint32_t)(offset + i));
1030 uint8_t padding[4] = {0xff, 0xff, 0xff, 0xff};
1031 memcpy(padding, buffer + i, MIN(4, count-i));
1033 result = kinetis_ftfx_command(bank, FTFx_CMD_LWORDPROG, bank->base + offset + i,
1034 padding[3], padding[2], padding[1], padding[0],
1035 0, 0, 0, 0, &ftfx_fstat);
1037 if (result != ERROR_OK)
1038 return ERROR_FLASH_OPERATION_FAILED;
1043 LOG_ERROR("Flash write strategy not implemented");
1044 return ERROR_FLASH_OPERATION_FAILED;
1050 static int kinetis_read_part_info(struct flash_bank *bank)
1053 uint32_t offset = 0;
1054 uint8_t fcfg1_nvmsize, fcfg1_pfsize, fcfg1_eesize, fcfg2_pflsh;
1055 uint32_t nvm_size = 0, pf_size = 0, ee_size = 0;
1056 unsigned granularity, num_blocks = 0, num_pflash_blocks = 0, num_nvm_blocks = 0,
1057 first_nvm_bank = 0, reassign = 0;
1058 struct target *target = bank->target;
1059 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1061 result = target_read_u32(target, SIM_SDID, &kinfo->sim_sdid);
1062 if (result != ERROR_OK)
1068 if ((kinfo->sim_sdid & (~KINETIS_SDID_K_SERIES_MASK)) == 0) {
1069 uint32_t mcu_type = kinfo->sim_sdid & KINETIS_K_SDID_TYPE_MASK;
1072 case KINETIS_K_SDID_K10_M50:
1073 case KINETIS_K_SDID_K20_M50:
1077 case KINETIS_K_SDID_K10_M72:
1078 case KINETIS_K_SDID_K20_M72:
1079 case KINETIS_K_SDID_K30_M72:
1080 case KINETIS_K_SDID_K30_M100:
1081 case KINETIS_K_SDID_K40_M72:
1082 case KINETIS_K_SDID_K40_M100:
1083 case KINETIS_K_SDID_K50_M72:
1084 /* 2kB sectors, 1kB FlexNVM sectors */
1087 case KINETIS_K_SDID_K10_M100:
1088 case KINETIS_K_SDID_K20_M100:
1089 case KINETIS_K_SDID_K11:
1090 case KINETIS_K_SDID_K12:
1091 case KINETIS_K_SDID_K21_M50:
1092 case KINETIS_K_SDID_K22_M50:
1093 case KINETIS_K_SDID_K51_M72:
1094 case KINETIS_K_SDID_K53:
1095 case KINETIS_K_SDID_K60_M100:
1099 case KINETIS_K_SDID_K10_M120:
1100 case KINETIS_K_SDID_K20_M120:
1101 case KINETIS_K_SDID_K21_M120:
1102 case KINETIS_K_SDID_K22_M120:
1103 case KINETIS_K_SDID_K60_M150:
1104 case KINETIS_K_SDID_K70_M150:
1109 LOG_ERROR("Unsupported K-family FAMID");
1110 return ERROR_FLASH_OPER_UNSUPPORTED;
1114 else if ((kinfo->sim_sdid & KINETIS_KL_SDID_SERIESID_MASK) == KINETIS_KL_SDID_SERIESID_KL) {
1118 LOG_ERROR("MCU is unsupported");
1119 return ERROR_FLASH_OPER_UNSUPPORTED;
1122 result = target_read_u32(target, SIM_FCFG1, &kinfo->sim_fcfg1);
1123 if (result != ERROR_OK)
1126 result = target_read_u32(target, SIM_FCFG2, &kinfo->sim_fcfg2);
1127 if (result != ERROR_OK)
1129 fcfg2_pflsh = (kinfo->sim_fcfg2 >> 23) & 0x01;
1131 LOG_DEBUG("SDID: 0x%08" PRIX32 " FCFG1: 0x%08" PRIX32 " FCFG2: 0x%08" PRIX32, kinfo->sim_sdid,
1132 kinfo->sim_fcfg1, kinfo->sim_fcfg2);
1134 fcfg1_nvmsize = (uint8_t)((kinfo->sim_fcfg1 >> 28) & 0x0f);
1135 fcfg1_pfsize = (uint8_t)((kinfo->sim_fcfg1 >> 24) & 0x0f);
1136 fcfg1_eesize = (uint8_t)((kinfo->sim_fcfg1 >> 16) & 0x0f);
1138 /* when the PFLSH bit is set, there is no FlexNVM/FlexRAM */
1140 switch (fcfg1_nvmsize) {
1145 nvm_size = 1 << (14 + (fcfg1_nvmsize >> 1));
1148 if (granularity == 3)
1158 switch (fcfg1_eesize) {
1169 ee_size = (16 << (10 - fcfg1_eesize));
1177 switch (fcfg1_pfsize) {
1184 pf_size = 1 << (14 + (fcfg1_pfsize >> 1));
1187 if (granularity == 3)
1189 else if (fcfg2_pflsh)
1199 LOG_DEBUG("FlexNVM: %" PRIu32 " PFlash: %" PRIu32 " FlexRAM: %" PRIu32 " PFLSH: %d",
1200 nvm_size, pf_size, ee_size, fcfg2_pflsh);
1204 num_blocks = kinetis_flash_params[granularity].num_blocks;
1206 num_pflash_blocks = num_blocks / (2 - fcfg2_pflsh);
1207 first_nvm_bank = num_pflash_blocks;
1208 num_nvm_blocks = num_blocks - num_pflash_blocks;
1210 LOG_DEBUG("%d blocks total: %d PFlash, %d FlexNVM",
1211 num_blocks, num_pflash_blocks, num_nvm_blocks);
1214 * If the flash class is already assigned, verify the
1217 if (kinfo->flash_class != FC_AUTO) {
1218 if (kinfo->bank_ordinal != (unsigned) bank->bank_number) {
1219 LOG_WARNING("Flash ordinal/bank number mismatch");
1221 } else if (kinfo->granularity != granularity) {
1222 LOG_WARNING("Flash granularity mismatch");
1225 switch (kinfo->flash_class) {
1227 if (kinfo->bank_ordinal >= first_nvm_bank) {
1228 LOG_WARNING("Class mismatch, bank %d is not PFlash", bank->bank_number);
1230 } else if (bank->size != (pf_size / num_pflash_blocks)) {
1231 LOG_WARNING("PFlash size mismatch");
1233 } else if (bank->base !=
1234 (0x00000000 + bank->size * kinfo->bank_ordinal)) {
1235 LOG_WARNING("PFlash address range mismatch");
1237 } else if (kinfo->sector_size !=
1238 kinetis_flash_params[granularity].pflash_sector_size_bytes) {
1239 LOG_WARNING("PFlash sector size mismatch");
1242 LOG_DEBUG("PFlash bank %d already configured okay",
1243 kinfo->bank_ordinal);
1247 if ((kinfo->bank_ordinal >= num_blocks) ||
1248 (kinfo->bank_ordinal < first_nvm_bank)) {
1249 LOG_WARNING("Class mismatch, bank %d is not FlexNVM", bank->bank_number);
1251 } else if (bank->size != (nvm_size / num_nvm_blocks)) {
1252 LOG_WARNING("FlexNVM size mismatch");
1254 } else if (bank->base !=
1255 (0x10000000 + bank->size * kinfo->bank_ordinal)) {
1256 LOG_WARNING("FlexNVM address range mismatch");
1258 } else if (kinfo->sector_size !=
1259 kinetis_flash_params[granularity].nvm_sector_size_bytes) {
1260 LOG_WARNING("FlexNVM sector size mismatch");
1263 LOG_DEBUG("FlexNVM bank %d already configured okay",
1264 kinfo->bank_ordinal);
1268 if (kinfo->bank_ordinal != num_blocks) {
1269 LOG_WARNING("Class mismatch, bank %d is not FlexRAM", bank->bank_number);
1271 } else if (bank->size != ee_size) {
1272 LOG_WARNING("FlexRAM size mismatch");
1274 } else if (bank->base != FLEXRAM) {
1275 LOG_WARNING("FlexRAM address mismatch");
1277 } else if (kinfo->sector_size !=
1278 kinetis_flash_params[granularity].nvm_sector_size_bytes) {
1279 LOG_WARNING("FlexRAM sector size mismatch");
1282 LOG_DEBUG("FlexRAM bank %d already configured okay", kinfo->bank_ordinal);
1287 LOG_WARNING("Unknown or inconsistent flash class");
1293 LOG_INFO("Probing flash info for bank %d", bank->bank_number);
1300 kinfo->granularity = granularity;
1302 if ((unsigned)bank->bank_number < num_pflash_blocks) {
1303 /* pflash, banks start at address zero */
1304 kinfo->flash_class = FC_PFLASH;
1305 bank->size = (pf_size / num_pflash_blocks);
1306 bank->base = 0x00000000 + bank->size * bank->bank_number;
1307 kinfo->sector_size = kinetis_flash_params[granularity].pflash_sector_size_bytes;
1308 kinfo->protection_size = pf_size / 32;
1309 } else if ((unsigned)bank->bank_number < num_blocks) {
1310 /* nvm, banks start at address 0x10000000 */
1311 kinfo->flash_class = FC_FLEX_NVM;
1312 bank->size = (nvm_size / num_nvm_blocks);
1313 bank->base = 0x10000000 + bank->size * (bank->bank_number - first_nvm_bank);
1314 kinfo->sector_size = kinetis_flash_params[granularity].nvm_sector_size_bytes;
1315 kinfo->protection_size = 0; /* FIXME: TODO: depends on DEPART bits, chip */
1316 } else if ((unsigned)bank->bank_number == num_blocks) {
1317 LOG_ERROR("FlexRAM support not yet implemented");
1318 return ERROR_FLASH_OPER_UNSUPPORTED;
1320 LOG_ERROR("Cannot determine parameters for bank %d, only %d banks on device",
1321 bank->bank_number, num_blocks);
1322 return ERROR_FLASH_BANK_INVALID;
1325 if (bank->sectors) {
1326 free(bank->sectors);
1327 bank->sectors = NULL;
1330 bank->num_sectors = bank->size / kinfo->sector_size;
1331 assert(bank->num_sectors > 0);
1332 bank->sectors = malloc(sizeof(struct flash_sector) * bank->num_sectors);
1334 for (i = 0; i < bank->num_sectors; i++) {
1335 bank->sectors[i].offset = offset;
1336 bank->sectors[i].size = kinfo->sector_size;
1337 offset += kinfo->sector_size;
1338 bank->sectors[i].is_erased = -1;
1339 bank->sectors[i].is_protected = 1;
1345 static int kinetis_probe(struct flash_bank *bank)
1347 if (bank->target->state != TARGET_HALTED) {
1348 LOG_WARNING("Cannot communicate... target not halted.");
1349 return ERROR_TARGET_NOT_HALTED;
1352 return kinetis_read_part_info(bank);
1355 static int kinetis_auto_probe(struct flash_bank *bank)
1357 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1359 if (kinfo->sim_sdid)
1362 return kinetis_probe(bank);
1365 static int kinetis_info(struct flash_bank *bank, char *buf, int buf_size)
1367 const char *bank_class_names[] = {
1368 "(ANY)", "PFlash", "FlexNVM", "FlexRAM"
1371 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1373 (void) snprintf(buf, buf_size,
1374 "%s driver for %s flash bank %s at 0x%8.8" PRIx32 "",
1375 bank->driver->name, bank_class_names[kinfo->flash_class],
1376 bank->name, bank->base);
1381 static int kinetis_blank_check(struct flash_bank *bank)
1383 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1385 if (bank->target->state != TARGET_HALTED) {
1386 LOG_ERROR("Target not halted");
1387 return ERROR_TARGET_NOT_HALTED;
1390 if (kinfo->flash_class == FC_PFLASH) {
1394 /* check if whole bank is blank */
1395 result = kinetis_ftfx_command(bank, FTFx_CMD_BLOCKSTAT, bank->base, 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
1397 if (result != ERROR_OK)
1400 if (ftfx_fstat & 0x01) {
1401 /* the whole bank is not erased, check sector-by-sector */
1403 for (i = 0; i < bank->num_sectors; i++) {
1405 result = kinetis_ftfx_command(bank, FTFx_CMD_SECTSTAT, bank->base + bank->sectors[i].offset,
1406 1, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
1408 if (result == ERROR_OK) {
1409 bank->sectors[i].is_erased = !(ftfx_fstat & 0x01);
1411 LOG_DEBUG("Ignoring errored PFlash sector blank-check");
1412 bank->sectors[i].is_erased = -1;
1416 /* the whole bank is erased, update all sectors */
1418 for (i = 0; i < bank->num_sectors; i++)
1419 bank->sectors[i].is_erased = 1;
1422 LOG_WARNING("kinetis_blank_check not supported yet for FlexNVM");
1423 return ERROR_FLASH_OPERATION_FAILED;
1429 static const struct command_registration kinetis_securtiy_command_handlers[] = {
1431 .name = "check_security",
1432 .mode = COMMAND_EXEC,
1435 .handler = kinetis_check_flash_security_status,
1438 .name = "mass_erase",
1439 .mode = COMMAND_EXEC,
1442 .handler = kinetis_mdm_mass_erase,
1445 .name = "test_securing",
1446 .mode = COMMAND_EXEC,
1449 .handler = kinetis_securing_test,
1451 COMMAND_REGISTRATION_DONE
1454 static const struct command_registration kinetis_exec_command_handlers[] = {
1457 .mode = COMMAND_ANY,
1460 .chain = kinetis_securtiy_command_handlers,
1462 COMMAND_REGISTRATION_DONE
1465 static const struct command_registration kinetis_command_handler[] = {
1468 .mode = COMMAND_ANY,
1469 .help = "kinetis NAND flash controller commands",
1471 .chain = kinetis_exec_command_handlers,
1473 COMMAND_REGISTRATION_DONE
1478 struct flash_driver kinetis_flash = {
1480 .commands = kinetis_command_handler,
1481 .flash_bank_command = kinetis_flash_bank_command,
1482 .erase = kinetis_erase,
1483 .protect = kinetis_protect,
1484 .write = kinetis_write,
1485 .read = default_flash_read,
1486 .probe = kinetis_probe,
1487 .auto_probe = kinetis_auto_probe,
1488 .erase_check = kinetis_blank_check,
1489 .protect_check = kinetis_protect_check,
1490 .info = kinetis_info,