1 /***************************************************************************
2 * Copyright (C) 2011 by Mathias Kuester *
5 * Copyright (C) 2011 sleep(5) ltd *
6 * tomas@sleepfive.com *
8 * Copyright (C) 2012 by Christopher D. Kilgour *
9 * techie at whiterocker.com *
11 * Copyright (C) 2013 Nemui Trinomius *
12 * nemuisan_kawausogasuki@live.jp *
14 * This program is free software; you can redistribute it and/or modify *
15 * it under the terms of the GNU General Public License as published by *
16 * the Free Software Foundation; either version 2 of the License, or *
17 * (at your option) any later version. *
19 * This program is distributed in the hope that it will be useful, *
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
22 * GNU General Public License for more details. *
24 * You should have received a copy of the GNU General Public License *
25 * along with this program; if not, write to the *
26 * Free Software Foundation, Inc., *
27 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *
28 ***************************************************************************/
35 #include <helper/binarybuffer.h>
36 #include <target/algorithm.h>
37 #include <target/armv7m.h>
38 #include <target/cortex_m.h>
41 * Implementation Notes
43 * The persistent memories in the Kinetis chip families K10 through
44 * K70 are all manipulated with the Flash Memory Module. Some
45 * variants call this module the FTFE, others call it the FTFL. To
46 * indicate that both are considered here, we use FTFX.
48 * Within the module, according to the chip variant, the persistent
49 * memory is divided into what Freescale terms Program Flash, FlexNVM,
50 * and FlexRAM. All chip variants have Program Flash. Some chip
51 * variants also have FlexNVM and FlexRAM, which always appear
54 * A given Kinetis chip may have 2 or 4 blocks of flash. Here we map
55 * each block to a separate bank. Each block size varies by chip and
56 * may be determined by the read-only SIM_FCFG1 register. The sector
57 * size within each bank/block varies by the chip granularity as
60 * Kinetis offers four different of flash granularities applicable
61 * across the chip families. The granularity is apparently reflected
62 * by at least the reference manual suffix. For example, for chip
63 * MK60FN1M0VLQ12, reference manual K60P144M150SF3RM ends in "SF3RM",
64 * where the "3" indicates there are four flash blocks with 4kiB
65 * sectors. All possible granularities are indicated below.
67 * The first half of the flash (1 or 2 blocks, depending on the
68 * granularity) is always Program Flash and always starts at address
69 * 0x00000000. The "PFLSH" flag, bit 23 of the read-only SIM_FCFG2
70 * register, determines whether the second half of the flash is also
71 * Program Flash or FlexNVM+FlexRAM. When PFLSH is set, the second
72 * half of flash is Program Flash and is contiguous in the memory map
73 * from the first half. When PFLSH is clear, the second half of flash
74 * is FlexNVM and always starts at address 0x10000000. FlexRAM, which
75 * is also present when PFLSH is clear, always starts at address
78 * The Flash Memory Module provides a register set where flash
79 * commands are loaded to perform flash operations like erase and
80 * program. Different commands are available depending on whether
81 * Program Flash or FlexNVM/FlexRAM is being manipulated. Although
82 * the commands used are quite consistent between flash blocks, the
83 * parameters they accept differ according to the flash granularity.
84 * Some Kinetis chips have different granularity between Program Flash
85 * and FlexNVM/FlexRAM, so flash command arguments may differ between
86 * blocks in the same chip.
91 unsigned pflash_sector_size_bytes;
92 unsigned nvm_sector_size_bytes;
94 } kinetis_flash_params[4] = {
102 #define FLEXRAM 0x14000000
103 #define FTFx_FSTAT 0x40020000
104 #define FTFx_FCNFG 0x40020001
105 #define FTFx_FCCOB3 0x40020004
106 #define FTFx_FPROT3 0x40020010
107 #define SIM_SDID 0x40048024
108 #define SIM_FCFG1 0x4004804c
109 #define SIM_FCFG2 0x40048050
112 #define FTFx_CMD_BLOCKSTAT 0x00
113 #define FTFx_CMD_SECTSTAT 0x01
114 #define FTFx_CMD_LWORDPROG 0x06
115 #define FTFx_CMD_SECTERASE 0x09
116 #define FTFx_CMD_SECTWRITE 0x0b
117 #define FTFx_CMD_SETFLEXRAM 0x81
118 #define FTFx_CMD_MASSERASE 0x44
120 /* The Kinetis K series uses the following SDID layout :
127 * The Kinetis KL series uses the following SDID layout :
129 * Bit 27-24 : SUBFAMID
130 * Bit 23-20 : SERIESID
131 * Bit 19-16 : SRAMSIZE
133 * Bit 6-4 : Reserved (0)
136 * SERIESID should be 1 for the KL-series so we assume that if
137 * bits 31-16 are 0 then it's a K-series MCU.
140 #define KINETIS_SDID_K_SERIES_MASK 0x0000FFFF
142 #define KINETIS_SDID_DIEID_MASK 0x00000F80
143 #define KINETIS_SDID_DIEID_K_A 0x00000100
144 #define KINETIS_SDID_DIEID_K_B 0x00000200
145 #define KINETIS_SDID_DIEID_KL 0x00000000
147 /* We can't rely solely on the FAMID field to determine the MCU
148 * type since some FAMID values identify multiple MCUs with
149 * different flash sector sizes (K20 and K22 for instance).
150 * Therefore we combine it with the DIEID bits which may possibly
151 * break if Freescale bumps the DIEID for a particular MCU. */
152 #define KINETIS_K_SDID_TYPE_MASK 0x00000FF0
153 #define KINETIS_K_SDID_K10_M50 0x00000000
154 #define KINETIS_K_SDID_K10_M72 0x00000080
155 #define KINETIS_K_SDID_K10_M100 0x00000100
156 #define KINETIS_K_SDID_K10_M120 0x00000180
157 #define KINETIS_K_SDID_K11 0x00000220
158 #define KINETIS_K_SDID_K12 0x00000200
159 #define KINETIS_K_SDID_K20_M50 0x00000010
160 #define KINETIS_K_SDID_K20_M72 0x00000090
161 #define KINETIS_K_SDID_K20_M100 0x00000110
162 #define KINETIS_K_SDID_K20_M120 0x00000190
163 #define KINETIS_K_SDID_K21_M50 0x00000230
164 #define KINETIS_K_SDID_K21_M120 0x00000330
165 #define KINETIS_K_SDID_K22_M50 0x00000210
166 #define KINETIS_K_SDID_K22_M120 0x00000310
167 #define KINETIS_K_SDID_K30_M72 0x000000A0
168 #define KINETIS_K_SDID_K30_M100 0x00000120
169 #define KINETIS_K_SDID_K40_M72 0x000000B0
170 #define KINETIS_K_SDID_K40_M100 0x00000130
171 #define KINETIS_K_SDID_K50_M72 0x000000E0
172 #define KINETIS_K_SDID_K51_M72 0x000000F0
173 #define KINETIS_K_SDID_K53 0x00000170
174 #define KINETIS_K_SDID_K60_M100 0x00000140
175 #define KINETIS_K_SDID_K60_M150 0x000001C0
176 #define KINETIS_K_SDID_K70_M150 0x000001D0
178 #define KINETIS_KL_SDID_SERIESID_MASK 0x00F00000
179 #define KINETIS_KL_SDID_SERIESID_KL 0x00100000
181 struct kinetis_flash_bank {
182 unsigned granularity;
183 unsigned bank_ordinal;
184 uint32_t sector_size;
185 uint32_t protection_size;
202 #define MDM_REG_STAT 0x00
203 #define MDM_REG_CTRL 0x04
204 #define MDM_REG_ID 0xfc
206 #define MDM_STAT_FMEACK (1<<0)
207 #define MDM_STAT_FREADY (1<<1)
208 #define MDM_STAT_SYSSEC (1<<2)
209 #define MDM_STAT_SYSRES (1<<3)
210 #define MDM_STAT_FMEEN (1<<5)
211 #define MDM_STAT_BACKDOOREN (1<<6)
212 #define MDM_STAT_LPEN (1<<7)
213 #define MDM_STAT_VLPEN (1<<8)
214 #define MDM_STAT_LLSMODEXIT (1<<9)
215 #define MDM_STAT_VLLSXMODEXIT (1<<10)
216 #define MDM_STAT_CORE_HALTED (1<<16)
217 #define MDM_STAT_CORE_SLEEPDEEP (1<<17)
218 #define MDM_STAT_CORESLEEPING (1<<18)
220 #define MEM_CTRL_FMEIP (1<<0)
221 #define MEM_CTRL_DBG_DIS (1<<1)
222 #define MEM_CTRL_DBG_REQ (1<<2)
223 #define MEM_CTRL_SYS_RES_REQ (1<<3)
224 #define MEM_CTRL_CORE_HOLD_RES (1<<4)
225 #define MEM_CTRL_VLLSX_DBG_REQ (1<<5)
226 #define MEM_CTRL_VLLSX_DBG_ACK (1<<6)
227 #define MEM_CTRL_VLLSX_STAT_ACK (1<<7)
229 #define MDM_ACCESS_TIMEOUT 3000 /* iterations */
231 static int kinetis_mdm_write_register(struct adiv5_dap *dap, unsigned reg, uint32_t value)
234 LOG_DEBUG("MDM_REG[0x%02x] <- %08" PRIX32, reg, value);
236 retval = dap_queue_ap_write(dap, reg, value);
237 if (retval != ERROR_OK) {
238 LOG_DEBUG("MDM: failed to queue a write request");
242 retval = dap_run(dap);
243 if (retval != ERROR_OK) {
244 LOG_DEBUG("MDM: dap_run failed");
252 static int kinetis_mdm_read_register(struct adiv5_dap *dap, unsigned reg, uint32_t *result)
255 retval = dap_queue_ap_read(dap, reg, result);
256 if (retval != ERROR_OK) {
257 LOG_DEBUG("MDM: failed to queue a read request");
261 retval = dap_run(dap);
262 if (retval != ERROR_OK) {
263 LOG_DEBUG("MDM: dap_run failed");
267 LOG_DEBUG("MDM_REG[0x%02x]: %08" PRIX32, reg, *result);
271 static int kinetis_mdm_poll_register(struct adiv5_dap *dap, unsigned reg, uint32_t mask, uint32_t value)
275 int timeout = MDM_ACCESS_TIMEOUT;
278 retval = kinetis_mdm_read_register(dap, reg, &val);
279 if (retval != ERROR_OK || (val & mask) == value)
285 LOG_DEBUG("MDM: polling timed out");
290 * This function implements the procedure to mass erase the flash via
291 * SWD/JTAG on Kinetis K and L series of devices as it is described in
292 * AN4835 "Production Flash Programming Best Practices for Kinetis K-
293 * and L-series MCUs" Section 4.2.1
295 COMMAND_HANDLER(kinetis_mdm_mass_erase)
297 struct target *target = get_current_target(CMD_CTX);
298 struct cortex_m_common *cortex_m = target_to_cm(target);
299 struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
302 LOG_ERROR("Cannot perform mass erase with a high-level adapter");
307 const uint8_t original_ap = dap->ap_current;
310 * ... Power on the processor, or if power has already been
311 * applied, assert the RESET pin to reset the processor. For
312 * devices that do not have a RESET pin, write the System
313 * Reset Request bit in the MDM-AP control register after
314 * establishing communication...
316 dap_ap_select(dap, 1);
318 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, MEM_CTRL_SYS_RES_REQ);
319 if (retval != ERROR_OK)
323 * ... Read the MDM-AP status register until the Flash Ready bit sets...
325 retval = kinetis_mdm_poll_register(dap, MDM_REG_STAT,
326 MDM_STAT_FREADY | MDM_STAT_SYSRES,
328 if (retval != ERROR_OK) {
329 LOG_ERROR("MDM : flash ready timeout");
334 * ... Write the MDM-AP control register to set the Flash Mass
335 * Erase in Progress bit. This will start the mass erase
338 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL,
339 MEM_CTRL_SYS_RES_REQ | MEM_CTRL_FMEIP);
340 if (retval != ERROR_OK)
343 /* As a sanity check make sure that device started mass erase procedure */
344 retval = kinetis_mdm_poll_register(dap, MDM_REG_STAT,
345 MDM_STAT_FMEACK, MDM_STAT_FMEACK);
346 if (retval != ERROR_OK)
350 * ... Read the MDM-AP control register until the Flash Mass
351 * Erase in Progress bit clears...
353 retval = kinetis_mdm_poll_register(dap, MDM_REG_CTRL,
356 if (retval != ERROR_OK)
360 * ... Negate the RESET signal or clear the System Reset Request
361 * bit in the MDM-AP control register...
363 retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, 0);
364 if (retval != ERROR_OK)
367 dap_ap_select(dap, original_ap);
371 static const uint32_t kinetis_known_mdm_ids[] = {
372 0x001C0000, /* Kinetis-K Series */
373 0x001C0020, /* Kinetis-L/M/V/E Series */
377 * This function implements the procedure to connect to
378 * SWD/JTAG on Kinetis K and L series of devices as it is described in
379 * AN4835 "Production Flash Programming Best Practices for Kinetis K-
380 * and L-series MCUs" Section 4.1.1
382 COMMAND_HANDLER(kinetis_check_flash_security_status)
384 struct target *target = get_current_target(CMD_CTX);
385 struct cortex_m_common *cortex_m = target_to_cm(target);
386 struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
389 LOG_WARNING("Cannot check flash security status with a high-level adapter");
395 const uint8_t origninal_ap = dap->ap_current;
397 dap_ap_select(dap, 1);
401 * ... The MDM-AP ID register can be read to verify that the
402 * connection is working correctly...
404 retval = kinetis_mdm_read_register(dap, MDM_REG_ID, &val);
405 if (retval != ERROR_OK) {
406 LOG_ERROR("MDM: failed to read ID register");
411 for (size_t i = 0; i < ARRAY_SIZE(kinetis_known_mdm_ids); i++) {
412 if (val == kinetis_known_mdm_ids[i]) {
419 LOG_WARNING("MDM: unknown ID %08" PRIX32, val);
422 * ... Read the MDM-AP status register until the Flash Ready bit sets...
424 retval = kinetis_mdm_poll_register(dap, MDM_REG_STAT,
427 if (retval != ERROR_OK) {
428 LOG_ERROR("MDM: flash ready timeout");
433 * ... Read the System Security bit to determine if security is enabled.
434 * If System Security = 0, then proceed. If System Security = 1, then
435 * communication with the internals of the processor, including the
436 * flash, will not be possible without issuing a mass erase command or
437 * unsecuring the part through other means (backdoor key unlock)...
439 retval = kinetis_mdm_read_register(dap, MDM_REG_STAT, &val);
440 if (retval != ERROR_OK) {
441 LOG_ERROR("MDM: failed to read MDM_REG_STAT");
445 if (val & MDM_STAT_SYSSEC) {
446 jtag_poll_set_enabled(false);
448 LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
449 LOG_WARNING("**** ****");
450 LOG_WARNING("**** Your Kinetis MCU is in secured state, which means that, ****");
451 LOG_WARNING("**** with exception for very basic communication, JTAG/SWD ****");
452 LOG_WARNING("**** interface will NOT work. In order to restore its ****");
453 LOG_WARNING("**** functionality please issue 'kinetis mdm mass_erase' ****");
454 LOG_WARNING("**** command, power cycle the MCU and restart OpenOCD. ****");
455 LOG_WARNING("**** ****");
456 LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
458 LOG_INFO("MDM: Chip is unsecured. Continuing.");
459 jtag_poll_set_enabled(true);
462 dap_ap_select(dap, origninal_ap);
467 LOG_ERROR("MDM: Failed to check security status of the MCU. Cannot proceed further");
468 jtag_poll_set_enabled(false);
472 FLASH_BANK_COMMAND_HANDLER(kinetis_flash_bank_command)
474 struct kinetis_flash_bank *bank_info;
477 return ERROR_COMMAND_SYNTAX_ERROR;
479 LOG_INFO("add flash_bank kinetis %s", bank->name);
481 bank_info = malloc(sizeof(struct kinetis_flash_bank));
483 memset(bank_info, 0, sizeof(struct kinetis_flash_bank));
485 bank->driver_priv = bank_info;
490 /* Kinetis Program-LongWord Microcodes */
491 static const uint8_t kinetis_flash_write_code[] = {
493 * r0 - workarea buffer
494 * r1 - target address
504 /* for(register uint32_t i=0;i<wcount;i++){ */
505 0x04, 0x1C, /* mov r4, r0 */
506 0x00, 0x23, /* mov r3, #0 */
508 0x0E, 0x1A, /* sub r6, r1, r0 */
509 0xA6, 0x19, /* add r6, r4, r6 */
510 0x93, 0x42, /* cmp r3, r2 */
511 0x16, 0xD0, /* beq .L9 */
513 /* while((FTFx_FSTAT&FTFA_FSTAT_CCIF_MASK) != FTFA_FSTAT_CCIF_MASK){}; */
514 0x0B, 0x4D, /* ldr r5, .L10 */
515 0x2F, 0x78, /* ldrb r7, [r5] */
516 0x7F, 0xB2, /* sxtb r7, r7 */
517 0x00, 0x2F, /* cmp r7, #0 */
518 0xFA, 0xDA, /* bge .L5 */
519 /* FTFx_FSTAT = FTFA_FSTAT_ACCERR_MASK|FTFA_FSTAT_FPVIOL_MASK|FTFA_FSTAT_RDCO */
520 0x70, 0x27, /* mov r7, #112 */
521 0x2F, 0x70, /* strb r7, [r5] */
522 /* FTFx_FCCOB3 = faddr; */
523 0x09, 0x4F, /* ldr r7, .L10+4 */
524 0x3E, 0x60, /* str r6, [r7] */
525 0x06, 0x27, /* mov r7, #6 */
526 /* FTFx_FCCOB0 = 0x06; */
527 0x08, 0x4E, /* ldr r6, .L10+8 */
528 0x37, 0x70, /* strb r7, [r6] */
529 /* FTFx_FCCOB7 = *pLW; */
530 0x80, 0xCC, /* ldmia r4!, {r7} */
531 0x08, 0x4E, /* ldr r6, .L10+12 */
532 0x37, 0x60, /* str r7, [r6] */
533 /* FTFx_FSTAT = FTFA_FSTAT_CCIF_MASK; */
534 0x80, 0x27, /* mov r7, #128 */
535 0x2F, 0x70, /* strb r7, [r5] */
537 /* while((FTFx_FSTAT&FTFA_FSTAT_CCIF_MASK) != FTFA_FSTAT_CCIF_MASK){}; */
538 0x2E, 0x78, /* ldrb r6, [r5] */
539 0x77, 0xB2, /* sxtb r7, r6 */
540 0x00, 0x2F, /* cmp r7, #0 */
541 0xFB, 0xDA, /* bge .L4 */
542 0x01, 0x33, /* add r3, r3, #1 */
543 0xE4, 0xE7, /* b .L2 */
545 0x00, 0xBE, /* bkpt #0 */
547 0x00, 0x00, 0x02, 0x40, /* .word 1073872896 */
548 0x04, 0x00, 0x02, 0x40, /* .word 1073872900 */
549 0x07, 0x00, 0x02, 0x40, /* .word 1073872903 */
550 0x08, 0x00, 0x02, 0x40, /* .word 1073872904 */
553 /* Program LongWord Block Write */
554 static int kinetis_write_block(struct flash_bank *bank, const uint8_t *buffer,
555 uint32_t offset, uint32_t wcount)
557 struct target *target = bank->target;
558 uint32_t buffer_size = 2048; /* Default minimum value */
559 struct working_area *write_algorithm;
560 struct working_area *source;
561 uint32_t address = bank->base + offset;
562 struct reg_param reg_params[3];
563 struct armv7m_algorithm armv7m_info;
564 int retval = ERROR_OK;
567 * r0 - workarea buffer
568 * r1 - target address
577 /* Increase buffer_size if needed */
578 if (buffer_size < (target->working_area_size/2))
579 buffer_size = (target->working_area_size/2);
581 LOG_INFO("Kinetis: FLASH Write ...");
583 /* check code alignment */
585 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
586 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
589 /* allocate working area with flash programming code */
590 if (target_alloc_working_area(target, sizeof(kinetis_flash_write_code),
591 &write_algorithm) != ERROR_OK) {
592 LOG_WARNING("no working area available, can't do block memory writes");
593 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
596 retval = target_write_buffer(target, write_algorithm->address,
597 sizeof(kinetis_flash_write_code), kinetis_flash_write_code);
598 if (retval != ERROR_OK)
602 while (target_alloc_working_area(target, buffer_size, &source) != ERROR_OK) {
604 if (buffer_size <= 256) {
605 /* free working area, write algorithm already allocated */
606 target_free_working_area(target, write_algorithm);
608 LOG_WARNING("No large enough working area available, can't do block memory writes");
609 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
613 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
614 armv7m_info.core_mode = ARM_MODE_THREAD;
616 init_reg_param(®_params[0], "r0", 32, PARAM_OUT); /* *pLW (*buffer) */
617 init_reg_param(®_params[1], "r1", 32, PARAM_OUT); /* faddr */
618 init_reg_param(®_params[2], "r2", 32, PARAM_OUT); /* number of words to program */
620 /* write code buffer and use Flash programming code within kinetis */
621 /* Set breakpoint to 0 with time-out of 1000 ms */
623 uint32_t thisrun_count = (wcount > (buffer_size / 4)) ? (buffer_size / 4) : wcount;
625 retval = target_write_buffer(target, source->address, thisrun_count * 4, buffer);
626 if (retval != ERROR_OK)
629 buf_set_u32(reg_params[0].value, 0, 32, source->address);
630 buf_set_u32(reg_params[1].value, 0, 32, address);
631 buf_set_u32(reg_params[2].value, 0, 32, thisrun_count);
633 retval = target_run_algorithm(target, 0, NULL, 3, reg_params,
634 write_algorithm->address, 0, 100000, &armv7m_info);
635 if (retval != ERROR_OK) {
636 LOG_ERROR("Error executing kinetis Flash programming algorithm");
637 retval = ERROR_FLASH_OPERATION_FAILED;
641 buffer += thisrun_count * 4;
642 address += thisrun_count * 4;
643 wcount -= thisrun_count;
646 target_free_working_area(target, source);
647 target_free_working_area(target, write_algorithm);
649 destroy_reg_param(®_params[0]);
650 destroy_reg_param(®_params[1]);
651 destroy_reg_param(®_params[2]);
656 static int kinetis_protect(struct flash_bank *bank, int set, int first, int last)
658 LOG_WARNING("kinetis_protect not supported yet");
661 if (bank->target->state != TARGET_HALTED) {
662 LOG_ERROR("Target not halted");
663 return ERROR_TARGET_NOT_HALTED;
666 return ERROR_FLASH_BANK_INVALID;
669 static int kinetis_protect_check(struct flash_bank *bank)
671 struct kinetis_flash_bank *kinfo = bank->driver_priv;
673 if (bank->target->state != TARGET_HALTED) {
674 LOG_ERROR("Target not halted");
675 return ERROR_TARGET_NOT_HALTED;
678 if (kinfo->flash_class == FC_PFLASH) {
681 uint32_t fprot, psec;
684 /* read protection register */
685 result = target_read_memory(bank->target, FTFx_FPROT3, 1, 4, buffer);
687 if (result != ERROR_OK)
690 fprot = target_buffer_get_u32(bank->target, buffer);
693 * Every bit protects 1/32 of the full flash (not necessarily
694 * just this bank), but we enforce the bank ordinals for
695 * PFlash to start at zero.
697 b = kinfo->bank_ordinal * (bank->size / kinfo->protection_size);
698 for (psec = 0, i = 0; i < bank->num_sectors; i++) {
699 if ((fprot >> b) & 1)
700 bank->sectors[i].is_protected = 0;
702 bank->sectors[i].is_protected = 1;
704 psec += bank->sectors[i].size;
706 if (psec >= kinfo->protection_size) {
712 LOG_ERROR("Protection checks for FlexNVM not yet supported");
713 return ERROR_FLASH_BANK_INVALID;
719 static int kinetis_ftfx_command(struct flash_bank *bank, uint8_t fcmd, uint32_t faddr,
720 uint8_t fccob4, uint8_t fccob5, uint8_t fccob6, uint8_t fccob7,
721 uint8_t fccob8, uint8_t fccob9, uint8_t fccoba, uint8_t fccobb,
724 uint8_t command[12] = {faddr & 0xff, (faddr >> 8) & 0xff, (faddr >> 16) & 0xff, fcmd,
725 fccob7, fccob6, fccob5, fccob4,
726 fccobb, fccoba, fccob9, fccob8};
731 for (i = 0; i < 50; i++) {
733 target_read_memory(bank->target, FTFx_FSTAT, 1, 1, &buffer);
735 if (result != ERROR_OK)
744 if (buffer != 0x80) {
745 /* reset error flags */
748 target_write_memory(bank->target, FTFx_FSTAT, 1, 1, &buffer);
749 if (result != ERROR_OK)
753 result = target_write_memory(bank->target, FTFx_FCCOB3, 4, 3, command);
755 if (result != ERROR_OK)
760 result = target_write_memory(bank->target, FTFx_FSTAT, 1, 1, &buffer);
761 if (result != ERROR_OK)
765 for (i = 0; i < 240; i++) { /* Need longtime for "Mass Erase" Command Nemui Changed */
767 target_read_memory(bank->target, FTFx_FSTAT, 1, 1, ftfx_fstat);
769 if (result != ERROR_OK)
772 if (*ftfx_fstat & 0x80)
776 if ((*ftfx_fstat & 0xf0) != 0x80) {
778 ("ftfx command failed FSTAT: %02X FCCOB: %02X%02X%02X%02X %02X%02X%02X%02X %02X%02X%02X%02X",
779 *ftfx_fstat, command[3], command[2], command[1], command[0],
780 command[7], command[6], command[5], command[4],
781 command[11], command[10], command[9], command[8]);
782 return ERROR_FLASH_OPERATION_FAILED;
788 static int kinetis_mass_erase(struct flash_bank *bank)
792 if (bank->target->state != TARGET_HALTED) {
793 LOG_ERROR("Target not halted");
794 return ERROR_TARGET_NOT_HALTED;
797 LOG_INFO("Execute Erase All Blocks");
798 return kinetis_ftfx_command(bank, FTFx_CMD_MASSERASE, 0,
799 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
802 COMMAND_HANDLER(kinetis_securing_test)
806 struct target *target = get_current_target(CMD_CTX);
807 struct flash_bank *bank = NULL;
809 result = get_flash_bank_by_addr(target, 0x00000000, true, &bank);
810 if (result != ERROR_OK)
813 assert(bank != NULL);
815 if (target->state != TARGET_HALTED) {
816 LOG_ERROR("Target not halted");
817 return ERROR_TARGET_NOT_HALTED;
820 return kinetis_ftfx_command(bank, FTFx_CMD_SECTERASE, bank->base + 0x00000400,
821 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
824 static int kinetis_erase(struct flash_bank *bank, int first, int last)
828 if (bank->target->state != TARGET_HALTED) {
829 LOG_ERROR("Target not halted");
830 return ERROR_TARGET_NOT_HALTED;
833 if ((first > bank->num_sectors) || (last > bank->num_sectors))
834 return ERROR_FLASH_OPERATION_FAILED;
836 if ((first == 0) && (last == (bank->num_sectors - 1)))
837 return kinetis_mass_erase(bank);
840 * FIXME: TODO: use the 'Erase Flash Block' command if the
841 * requested erase is PFlash or NVM and encompasses the entire
842 * block. Should be quicker.
844 for (i = first; i <= last; i++) {
846 /* set command and sector address */
847 result = kinetis_ftfx_command(bank, FTFx_CMD_SECTERASE, bank->base + bank->sectors[i].offset,
848 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
850 if (result != ERROR_OK) {
851 LOG_WARNING("erase sector %d failed", i);
852 return ERROR_FLASH_OPERATION_FAILED;
855 bank->sectors[i].is_erased = 1;
860 ("flash configuration field erased, please reset the device");
866 static int kinetis_write(struct flash_bank *bank, const uint8_t *buffer,
867 uint32_t offset, uint32_t count)
869 unsigned int i, result, fallback = 0;
872 struct kinetis_flash_bank *kinfo = bank->driver_priv;
873 uint8_t *new_buffer = NULL;
875 if (bank->target->state != TARGET_HALTED) {
876 LOG_ERROR("Target not halted");
877 return ERROR_TARGET_NOT_HALTED;
881 /* fallback to longword write */
883 LOG_WARNING("Kinetis L Series supports Program Longword execution only.");
884 LOG_DEBUG("flash write into PFLASH @08%" PRIX32, offset);
886 } else if (kinfo->flash_class == FC_FLEX_NVM) {
889 LOG_DEBUG("flash write into FlexNVM @%08" PRIX32, offset);
891 /* make flex ram available */
892 result = kinetis_ftfx_command(bank, FTFx_CMD_SETFLEXRAM, 0x00ff0000, 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
894 if (result != ERROR_OK)
895 return ERROR_FLASH_OPERATION_FAILED;
897 /* check if ram ready */
898 result = target_read_memory(bank->target, FTFx_FCNFG, 1, 1, buf);
900 if (result != ERROR_OK)
903 if (!(buf[0] & (1 << 1))) {
904 /* fallback to longword write */
907 LOG_WARNING("ram not ready, fallback to slow longword write (FCNFG: %02X)", buf[0]);
910 LOG_DEBUG("flash write into PFLASH @08%" PRIX32, offset);
914 /* program section command */
917 * Kinetis uses different terms for the granularity of
918 * sector writes, e.g. "phrase" or "128 bits". We use
919 * the generic term "chunk". The largest possible
920 * Kinetis "chunk" is 16 bytes (128 bits).
922 unsigned prog_section_chunk_bytes = kinfo->sector_size >> 8;
923 /* assume the NVM sector size is half the FlexRAM size */
924 unsigned prog_size_bytes = MIN(kinfo->sector_size,
925 kinetis_flash_params[kinfo->granularity].nvm_sector_size_bytes);
926 for (i = 0; i < count; i += prog_size_bytes) {
927 uint8_t residual_buffer[16];
929 uint32_t section_count = prog_size_bytes / prog_section_chunk_bytes;
930 uint32_t residual_wc = 0;
933 * Assume the word count covers an entire
936 wc = prog_size_bytes / 4;
939 * If bytes to be programmed are less than the
940 * full sector, then determine the number of
941 * full-words to program, and put together the
942 * residual buffer so that a full "section"
943 * may always be programmed.
945 if ((count - i) < prog_size_bytes) {
946 /* number of bytes to program beyond full section */
947 unsigned residual_bc = (count-i) % prog_section_chunk_bytes;
949 /* number of complete words to copy directly from buffer */
950 wc = (count - i) / 4;
952 /* number of total sections to write, including residual */
953 section_count = DIV_ROUND_UP((count-i), prog_section_chunk_bytes);
955 /* any residual bytes delivers a whole residual section */
956 residual_wc = (residual_bc ? prog_section_chunk_bytes : 0)/4;
958 /* clear residual buffer then populate residual bytes */
959 (void) memset(residual_buffer, 0xff, prog_section_chunk_bytes);
960 (void) memcpy(residual_buffer, &buffer[i+4*wc], residual_bc);
963 LOG_DEBUG("write section @ %08" PRIX32 " with length %" PRIu32 " bytes",
964 offset + i, (uint32_t)wc*4);
966 /* write data to flexram as whole-words */
967 result = target_write_memory(bank->target, FLEXRAM, 4, wc,
970 if (result != ERROR_OK) {
971 LOG_ERROR("target_write_memory failed");
975 /* write the residual words to the flexram */
977 result = target_write_memory(bank->target,
982 if (result != ERROR_OK) {
983 LOG_ERROR("target_write_memory failed");
988 /* execute section-write command */
989 result = kinetis_ftfx_command(bank, FTFx_CMD_SECTWRITE, bank->base + offset + i,
990 section_count>>8, section_count, 0, 0,
991 0, 0, 0, 0, &ftfx_fstat);
993 if (result != ERROR_OK)
994 return ERROR_FLASH_OPERATION_FAILED;
997 /* program longword command, not supported in "SF3" devices */
998 else if ((kinfo->granularity != 3) || (kinfo->klxx)) {
1001 uint32_t old_count = count;
1002 count = (old_count | 3) + 1;
1003 new_buffer = malloc(count);
1004 if (new_buffer == NULL) {
1005 LOG_ERROR("odd number of bytes to write and no memory "
1006 "for padding buffer");
1009 LOG_INFO("odd number of bytes to write (%" PRIu32 "), extending to %" PRIu32 " "
1010 "and padding with 0xff", old_count, count);
1011 memset(new_buffer, 0xff, count);
1012 buffer = memcpy(new_buffer, buffer, old_count);
1015 uint32_t words_remaining = count / 4;
1017 /* try using a block write */
1018 int retval = kinetis_write_block(bank, buffer, offset, words_remaining);
1020 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
1021 /* if block write failed (no sufficient working area),
1022 * we use normal (slow) single word accesses */
1023 LOG_WARNING("couldn't use block writes, falling back to single "
1026 for (i = 0; i < count; i += 4) {
1029 LOG_DEBUG("write longword @ %08" PRIX32, (uint32_t)(offset + i));
1031 uint8_t padding[4] = {0xff, 0xff, 0xff, 0xff};
1032 memcpy(padding, buffer + i, MIN(4, count-i));
1034 result = kinetis_ftfx_command(bank, FTFx_CMD_LWORDPROG, bank->base + offset + i,
1035 padding[3], padding[2], padding[1], padding[0],
1036 0, 0, 0, 0, &ftfx_fstat);
1038 if (result != ERROR_OK)
1039 return ERROR_FLASH_OPERATION_FAILED;
1044 LOG_ERROR("Flash write strategy not implemented");
1045 return ERROR_FLASH_OPERATION_FAILED;
1051 static int kinetis_read_part_info(struct flash_bank *bank)
1054 uint32_t offset = 0;
1055 uint8_t fcfg1_nvmsize, fcfg1_pfsize, fcfg1_eesize, fcfg2_pflsh;
1056 uint32_t nvm_size = 0, pf_size = 0, ee_size = 0;
1057 unsigned granularity, num_blocks = 0, num_pflash_blocks = 0, num_nvm_blocks = 0,
1058 first_nvm_bank = 0, reassign = 0;
1059 struct target *target = bank->target;
1060 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1062 result = target_read_u32(target, SIM_SDID, &kinfo->sim_sdid);
1063 if (result != ERROR_OK)
1069 if ((kinfo->sim_sdid & (~KINETIS_SDID_K_SERIES_MASK)) == 0) {
1070 uint32_t mcu_type = kinfo->sim_sdid & KINETIS_K_SDID_TYPE_MASK;
1073 case KINETIS_K_SDID_K10_M50:
1074 case KINETIS_K_SDID_K20_M50:
1078 case KINETIS_K_SDID_K10_M72:
1079 case KINETIS_K_SDID_K20_M72:
1080 case KINETIS_K_SDID_K30_M72:
1081 case KINETIS_K_SDID_K30_M100:
1082 case KINETIS_K_SDID_K40_M72:
1083 case KINETIS_K_SDID_K40_M100:
1084 case KINETIS_K_SDID_K50_M72:
1085 /* 2kB sectors, 1kB FlexNVM sectors */
1088 case KINETIS_K_SDID_K10_M100:
1089 case KINETIS_K_SDID_K20_M100:
1090 case KINETIS_K_SDID_K11:
1091 case KINETIS_K_SDID_K12:
1092 case KINETIS_K_SDID_K21_M50:
1093 case KINETIS_K_SDID_K22_M50:
1094 case KINETIS_K_SDID_K51_M72:
1095 case KINETIS_K_SDID_K53:
1096 case KINETIS_K_SDID_K60_M100:
1100 case KINETIS_K_SDID_K10_M120:
1101 case KINETIS_K_SDID_K20_M120:
1102 case KINETIS_K_SDID_K21_M120:
1103 case KINETIS_K_SDID_K22_M120:
1104 case KINETIS_K_SDID_K60_M150:
1105 case KINETIS_K_SDID_K70_M150:
1110 LOG_ERROR("Unsupported K-family FAMID");
1111 return ERROR_FLASH_OPER_UNSUPPORTED;
1115 else if ((kinfo->sim_sdid & KINETIS_KL_SDID_SERIESID_MASK) == KINETIS_KL_SDID_SERIESID_KL) {
1119 LOG_ERROR("MCU is unsupported");
1120 return ERROR_FLASH_OPER_UNSUPPORTED;
1123 result = target_read_u32(target, SIM_FCFG1, &kinfo->sim_fcfg1);
1124 if (result != ERROR_OK)
1127 result = target_read_u32(target, SIM_FCFG2, &kinfo->sim_fcfg2);
1128 if (result != ERROR_OK)
1130 fcfg2_pflsh = (kinfo->sim_fcfg2 >> 23) & 0x01;
1132 LOG_DEBUG("SDID: 0x%08" PRIX32 " FCFG1: 0x%08" PRIX32 " FCFG2: 0x%08" PRIX32, kinfo->sim_sdid,
1133 kinfo->sim_fcfg1, kinfo->sim_fcfg2);
1135 fcfg1_nvmsize = (uint8_t)((kinfo->sim_fcfg1 >> 28) & 0x0f);
1136 fcfg1_pfsize = (uint8_t)((kinfo->sim_fcfg1 >> 24) & 0x0f);
1137 fcfg1_eesize = (uint8_t)((kinfo->sim_fcfg1 >> 16) & 0x0f);
1139 /* when the PFLSH bit is set, there is no FlexNVM/FlexRAM */
1141 switch (fcfg1_nvmsize) {
1146 nvm_size = 1 << (14 + (fcfg1_nvmsize >> 1));
1149 if (granularity == 3)
1159 switch (fcfg1_eesize) {
1170 ee_size = (16 << (10 - fcfg1_eesize));
1178 switch (fcfg1_pfsize) {
1185 pf_size = 1 << (14 + (fcfg1_pfsize >> 1));
1188 if (granularity == 3)
1190 else if (fcfg2_pflsh)
1200 LOG_DEBUG("FlexNVM: %" PRIu32 " PFlash: %" PRIu32 " FlexRAM: %" PRIu32 " PFLSH: %d",
1201 nvm_size, pf_size, ee_size, fcfg2_pflsh);
1205 num_blocks = kinetis_flash_params[granularity].num_blocks;
1207 num_pflash_blocks = num_blocks / (2 - fcfg2_pflsh);
1208 first_nvm_bank = num_pflash_blocks;
1209 num_nvm_blocks = num_blocks - num_pflash_blocks;
1211 LOG_DEBUG("%d blocks total: %d PFlash, %d FlexNVM",
1212 num_blocks, num_pflash_blocks, num_nvm_blocks);
1215 * If the flash class is already assigned, verify the
1218 if (kinfo->flash_class != FC_AUTO) {
1219 if (kinfo->bank_ordinal != (unsigned) bank->bank_number) {
1220 LOG_WARNING("Flash ordinal/bank number mismatch");
1222 } else if (kinfo->granularity != granularity) {
1223 LOG_WARNING("Flash granularity mismatch");
1226 switch (kinfo->flash_class) {
1228 if (kinfo->bank_ordinal >= first_nvm_bank) {
1229 LOG_WARNING("Class mismatch, bank %d is not PFlash", bank->bank_number);
1231 } else if (bank->size != (pf_size / num_pflash_blocks)) {
1232 LOG_WARNING("PFlash size mismatch");
1234 } else if (bank->base !=
1235 (0x00000000 + bank->size * kinfo->bank_ordinal)) {
1236 LOG_WARNING("PFlash address range mismatch");
1238 } else if (kinfo->sector_size !=
1239 kinetis_flash_params[granularity].pflash_sector_size_bytes) {
1240 LOG_WARNING("PFlash sector size mismatch");
1243 LOG_DEBUG("PFlash bank %d already configured okay",
1244 kinfo->bank_ordinal);
1248 if ((kinfo->bank_ordinal >= num_blocks) ||
1249 (kinfo->bank_ordinal < first_nvm_bank)) {
1250 LOG_WARNING("Class mismatch, bank %d is not FlexNVM", bank->bank_number);
1252 } else if (bank->size != (nvm_size / num_nvm_blocks)) {
1253 LOG_WARNING("FlexNVM size mismatch");
1255 } else if (bank->base !=
1256 (0x10000000 + bank->size * kinfo->bank_ordinal)) {
1257 LOG_WARNING("FlexNVM address range mismatch");
1259 } else if (kinfo->sector_size !=
1260 kinetis_flash_params[granularity].nvm_sector_size_bytes) {
1261 LOG_WARNING("FlexNVM sector size mismatch");
1264 LOG_DEBUG("FlexNVM bank %d already configured okay",
1265 kinfo->bank_ordinal);
1269 if (kinfo->bank_ordinal != num_blocks) {
1270 LOG_WARNING("Class mismatch, bank %d is not FlexRAM", bank->bank_number);
1272 } else if (bank->size != ee_size) {
1273 LOG_WARNING("FlexRAM size mismatch");
1275 } else if (bank->base != FLEXRAM) {
1276 LOG_WARNING("FlexRAM address mismatch");
1278 } else if (kinfo->sector_size !=
1279 kinetis_flash_params[granularity].nvm_sector_size_bytes) {
1280 LOG_WARNING("FlexRAM sector size mismatch");
1283 LOG_DEBUG("FlexRAM bank %d already configured okay", kinfo->bank_ordinal);
1288 LOG_WARNING("Unknown or inconsistent flash class");
1294 LOG_INFO("Probing flash info for bank %d", bank->bank_number);
1301 kinfo->granularity = granularity;
1303 if ((unsigned)bank->bank_number < num_pflash_blocks) {
1304 /* pflash, banks start at address zero */
1305 kinfo->flash_class = FC_PFLASH;
1306 bank->size = (pf_size / num_pflash_blocks);
1307 bank->base = 0x00000000 + bank->size * bank->bank_number;
1308 kinfo->sector_size = kinetis_flash_params[granularity].pflash_sector_size_bytes;
1309 kinfo->protection_size = pf_size / 32;
1310 } else if ((unsigned)bank->bank_number < num_blocks) {
1311 /* nvm, banks start at address 0x10000000 */
1312 kinfo->flash_class = FC_FLEX_NVM;
1313 bank->size = (nvm_size / num_nvm_blocks);
1314 bank->base = 0x10000000 + bank->size * (bank->bank_number - first_nvm_bank);
1315 kinfo->sector_size = kinetis_flash_params[granularity].nvm_sector_size_bytes;
1316 kinfo->protection_size = 0; /* FIXME: TODO: depends on DEPART bits, chip */
1317 } else if ((unsigned)bank->bank_number == num_blocks) {
1318 LOG_ERROR("FlexRAM support not yet implemented");
1319 return ERROR_FLASH_OPER_UNSUPPORTED;
1321 LOG_ERROR("Cannot determine parameters for bank %d, only %d banks on device",
1322 bank->bank_number, num_blocks);
1323 return ERROR_FLASH_BANK_INVALID;
1326 if (bank->sectors) {
1327 free(bank->sectors);
1328 bank->sectors = NULL;
1331 bank->num_sectors = bank->size / kinfo->sector_size;
1332 assert(bank->num_sectors > 0);
1333 bank->sectors = malloc(sizeof(struct flash_sector) * bank->num_sectors);
1335 for (i = 0; i < bank->num_sectors; i++) {
1336 bank->sectors[i].offset = offset;
1337 bank->sectors[i].size = kinfo->sector_size;
1338 offset += kinfo->sector_size;
1339 bank->sectors[i].is_erased = -1;
1340 bank->sectors[i].is_protected = 1;
1346 static int kinetis_probe(struct flash_bank *bank)
1348 if (bank->target->state != TARGET_HALTED) {
1349 LOG_WARNING("Cannot communicate... target not halted.");
1350 return ERROR_TARGET_NOT_HALTED;
1353 return kinetis_read_part_info(bank);
1356 static int kinetis_auto_probe(struct flash_bank *bank)
1358 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1360 if (kinfo->sim_sdid)
1363 return kinetis_probe(bank);
1366 static int kinetis_info(struct flash_bank *bank, char *buf, int buf_size)
1368 const char *bank_class_names[] = {
1369 "(ANY)", "PFlash", "FlexNVM", "FlexRAM"
1372 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1374 (void) snprintf(buf, buf_size,
1375 "%s driver for %s flash bank %s at 0x%8.8" PRIx32 "",
1376 bank->driver->name, bank_class_names[kinfo->flash_class],
1377 bank->name, bank->base);
1382 static int kinetis_blank_check(struct flash_bank *bank)
1384 struct kinetis_flash_bank *kinfo = bank->driver_priv;
1386 if (bank->target->state != TARGET_HALTED) {
1387 LOG_ERROR("Target not halted");
1388 return ERROR_TARGET_NOT_HALTED;
1391 if (kinfo->flash_class == FC_PFLASH) {
1395 /* check if whole bank is blank */
1396 result = kinetis_ftfx_command(bank, FTFx_CMD_BLOCKSTAT, bank->base, 0, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
1398 if (result != ERROR_OK)
1401 if (ftfx_fstat & 0x01) {
1402 /* the whole bank is not erased, check sector-by-sector */
1404 for (i = 0; i < bank->num_sectors; i++) {
1406 result = kinetis_ftfx_command(bank, FTFx_CMD_SECTSTAT, bank->base + bank->sectors[i].offset,
1407 1, 0, 0, 0, 0, 0, 0, 0, &ftfx_fstat);
1409 if (result == ERROR_OK) {
1410 bank->sectors[i].is_erased = !(ftfx_fstat & 0x01);
1412 LOG_DEBUG("Ignoring errored PFlash sector blank-check");
1413 bank->sectors[i].is_erased = -1;
1417 /* the whole bank is erased, update all sectors */
1419 for (i = 0; i < bank->num_sectors; i++)
1420 bank->sectors[i].is_erased = 1;
1423 LOG_WARNING("kinetis_blank_check not supported yet for FlexNVM");
1424 return ERROR_FLASH_OPERATION_FAILED;
1430 static const struct command_registration kinetis_securtiy_command_handlers[] = {
1432 .name = "check_security",
1433 .mode = COMMAND_EXEC,
1436 .handler = kinetis_check_flash_security_status,
1439 .name = "mass_erase",
1440 .mode = COMMAND_EXEC,
1443 .handler = kinetis_mdm_mass_erase,
1446 .name = "test_securing",
1447 .mode = COMMAND_EXEC,
1450 .handler = kinetis_securing_test,
1452 COMMAND_REGISTRATION_DONE
1455 static const struct command_registration kinetis_exec_command_handlers[] = {
1458 .mode = COMMAND_ANY,
1461 .chain = kinetis_securtiy_command_handlers,
1463 COMMAND_REGISTRATION_DONE
1466 static const struct command_registration kinetis_command_handler[] = {
1469 .mode = COMMAND_ANY,
1470 .help = "kinetis NAND flash controller commands",
1472 .chain = kinetis_exec_command_handlers,
1474 COMMAND_REGISTRATION_DONE
1479 struct flash_driver kinetis_flash = {
1481 .commands = kinetis_command_handler,
1482 .flash_bank_command = kinetis_flash_bank_command,
1483 .erase = kinetis_erase,
1484 .protect = kinetis_protect,
1485 .write = kinetis_write,
1486 .read = default_flash_read,
1487 .probe = kinetis_probe,
1488 .auto_probe = kinetis_auto_probe,
1489 .erase_check = kinetis_blank_check,
1490 .protect_check = kinetis_protect_check,
1491 .info = kinetis_info,