flash Kinetis: Detect RESET/WDOG loop, fix detection of secured MCU
[fw/openocd] / src / flash / nor / kinetis.c
index 4d924ad882e114cb7444f1509a2febc024dae11a..5c3ff0d68d2ed6119f6cc51bb11b3463137159c7 100644 (file)
@@ -25,9 +25,7 @@
  *   GNU General Public License for more details.                          *
  *                                                                         *
  *   You should have received a copy of the GNU General Public License     *
- *   along with this program; if not, write to the                         *
- *   Free Software Foundation, Inc.,                                       *
- *   51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.           *
+ *   along with this program.  If not, see <http://www.gnu.org/licenses/>. *
  ***************************************************************************/
 
 #ifdef HAVE_CONFIG_H
@@ -82,6 +80,8 @@
 
 /* Addressess */
 #define FLEXRAM                0x14000000
+
+#define FMC_PFB01CR    0x4001f004
 #define FTFx_FSTAT     0x40020000
 #define FTFx_FCNFG     0x40020001
 #define FTFx_FCCOB3    0x40020004
 #define SIM_FCFG1      0x4004804c
 #define SIM_FCFG2      0x40048050
 #define WDOG_STCTRH    0x40052000
+#define SMC_PMCTRL     0x4007E001
+#define SMC_PMSTAT     0x4007E003
+
+/* Values */
+#define PM_STAT_RUN            0x01
+#define PM_STAT_VLPR           0x04
+#define PM_CTRL_RUNM_RUN       0x00
 
 /* Commands */
 #define FTFx_CMD_BLOCKSTAT  0x00
@@ -216,9 +223,12 @@ struct kinetis_flash_bank {
                FS_PROGRAM_SECTOR = 1,
                FS_PROGRAM_LONGWORD = 2,
                FS_PROGRAM_PHRASE = 4, /* Unsupported */
+               FS_INVALIDATE_CACHE = 8,
        } flash_support;
 };
 
+#define MDM_AP                 1
+
 #define MDM_REG_STAT           0x00
 #define MDM_REG_CTRL           0x04
 #define MDM_REG_ID             0xfc
@@ -237,14 +247,14 @@ struct kinetis_flash_bank {
 #define MDM_STAT_CORE_SLEEPDEEP        (1<<17)
 #define MDM_STAT_CORESLEEPING  (1<<18)
 
-#define MEM_CTRL_FMEIP         (1<<0)
-#define MEM_CTRL_DBG_DIS       (1<<1)
-#define MEM_CTRL_DBG_REQ       (1<<2)
-#define MEM_CTRL_SYS_RES_REQ   (1<<3)
-#define MEM_CTRL_CORE_HOLD_RES (1<<4)
-#define MEM_CTRL_VLLSX_DBG_REQ (1<<5)
-#define MEM_CTRL_VLLSX_DBG_ACK (1<<6)
-#define MEM_CTRL_VLLSX_STAT_ACK        (1<<7)
+#define MDM_CTRL_FMEIP         (1<<0)
+#define MDM_CTRL_DBG_DIS       (1<<1)
+#define MDM_CTRL_DBG_REQ       (1<<2)
+#define MDM_CTRL_SYS_RES_REQ   (1<<3)
+#define MDM_CTRL_CORE_HOLD_RES (1<<4)
+#define MDM_CTRL_VLLSX_DBG_REQ (1<<5)
+#define MDM_CTRL_VLLSX_DBG_ACK (1<<6)
+#define MDM_CTRL_VLLSX_STAT_ACK        (1<<7)
 
 #define MDM_ACCESS_TIMEOUT     3000 /* iterations */
 
@@ -253,7 +263,7 @@ static int kinetis_mdm_write_register(struct adiv5_dap *dap, unsigned reg, uint3
        int retval;
        LOG_DEBUG("MDM_REG[0x%02x] <- %08" PRIX32, reg, value);
 
-       retval = dap_queue_ap_write(dap_ap(dap, 1), reg, value);
+       retval = dap_queue_ap_write(dap_ap(dap, MDM_AP), reg, value);
        if (retval != ERROR_OK) {
                LOG_DEBUG("MDM: failed to queue a write request");
                return retval;
@@ -273,7 +283,7 @@ static int kinetis_mdm_read_register(struct adiv5_dap *dap, unsigned reg, uint32
 {
        int retval;
 
-       retval = dap_queue_ap_read(dap_ap(dap, 1), reg, result);
+       retval = dap_queue_ap_read(dap_ap(dap, MDM_AP), reg, result);
        if (retval != ERROR_OK) {
                LOG_DEBUG("MDM: failed to queue a read request");
                return retval;
@@ -307,11 +317,114 @@ static int kinetis_mdm_poll_register(struct adiv5_dap *dap, unsigned reg, uint32
        return ERROR_FAIL;
 }
 
+/*
+ * This command can be used to break a watchdog reset loop when
+ * connecting to an unsecured target. Unlike other commands, halt will
+ * automatically retry as it does not know how far into the boot process
+ * it is when the command is called.
+ */
+COMMAND_HANDLER(kinetis_mdm_halt)
+{
+       struct target *target = get_current_target(CMD_CTX);
+       struct cortex_m_common *cortex_m = target_to_cm(target);
+       struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
+       int retval;
+       int tries = 0;
+       uint32_t stat;
+
+       if (!dap) {
+               LOG_ERROR("Cannot perform halt with a high-level adapter");
+               return ERROR_FAIL;
+       }
+
+       while (true) {
+               tries++;
+
+               kinetis_mdm_write_register(dap, MDM_REG_CTRL, MDM_CTRL_CORE_HOLD_RES);
+
+               alive_sleep(1);
+
+               retval = kinetis_mdm_read_register(dap, MDM_REG_STAT, &stat);
+               if (retval != ERROR_OK) {
+                       LOG_DEBUG("MDM: failed to read MDM_REG_STAT");
+                       continue;
+               }
+
+               /* Repeat setting MDM_CTRL_CORE_HOLD_RES until system is out of
+                * reset with flash ready and without security
+                */
+               if ((stat & (MDM_STAT_FREADY | MDM_STAT_SYSSEC | MDM_STAT_SYSRES))
+                               == (MDM_STAT_FREADY | MDM_STAT_SYSRES))
+                       break;
+
+               if (tries > MDM_ACCESS_TIMEOUT) {
+                       LOG_ERROR("MDM: halt timed out");
+                       return ERROR_FAIL;
+               }
+       }
+
+       LOG_DEBUG("MDM: halt succeded after %d attempts.", tries);
+
+       target_poll(target);
+       /* enable polling in case kinetis_check_flash_security_status disabled it */
+       jtag_poll_set_enabled(true);
+
+       alive_sleep(100);
+
+       target->reset_halt = true;
+       target->type->assert_reset(target);
+
+       retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, 0);
+       if (retval != ERROR_OK) {
+               LOG_ERROR("MDM: failed to clear MDM_REG_CTRL");
+               return retval;
+       }
+
+       target->type->deassert_reset(target);
+
+       return ERROR_OK;
+}
+
+COMMAND_HANDLER(kinetis_mdm_reset)
+{
+       struct target *target = get_current_target(CMD_CTX);
+       struct cortex_m_common *cortex_m = target_to_cm(target);
+       struct adiv5_dap *dap = cortex_m->armv7m.arm.dap;
+       int retval;
+
+       if (!dap) {
+               LOG_ERROR("Cannot perform reset with a high-level adapter");
+               return ERROR_FAIL;
+       }
+
+       retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, MDM_CTRL_SYS_RES_REQ);
+       if (retval != ERROR_OK) {
+               LOG_ERROR("MDM: failed to write MDM_REG_CTRL");
+               return retval;
+       }
+
+       retval = kinetis_mdm_poll_register(dap, MDM_REG_STAT, MDM_STAT_SYSRES, 0);
+       if (retval != ERROR_OK) {
+               LOG_ERROR("MDM: failed to assert reset");
+               return retval;
+       }
+
+       retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, 0);
+       if (retval != ERROR_OK) {
+               LOG_ERROR("MDM: failed to clear MDM_REG_CTRL");
+               return retval;
+       }
+
+       return ERROR_OK;
+}
+
 /*
  * This function implements the procedure to mass erase the flash via
  * SWD/JTAG on Kinetis K and L series of devices as it is described in
  * AN4835 "Production Flash Programming Best Practices for Kinetis K-
- * and L-series MCUs" Section 4.2.1
+ * and L-series MCUs" Section 4.2.1. To prevent a watchdog reset loop,
+ * the core remains halted after this function completes as suggested
+ * by the application note.
  */
 COMMAND_HANDLER(kinetis_mdm_mass_erase)
 {
@@ -334,26 +447,53 @@ COMMAND_HANDLER(kinetis_mdm_mass_erase)
         * establishing communication...
         */
 
-       /* assert SRST */
-       if (jtag_get_reset_config() & RESET_HAS_SRST)
+       /* assert SRST if configured */
+       bool has_srst = jtag_get_reset_config() & RESET_HAS_SRST;
+       if (has_srst)
                adapter_assert_reset();
-       else
-               LOG_WARNING("Attempting mass erase without hardware reset. This is not reliable; "
-                           "it's recommended you connect SRST and use ``reset_config srst_only''.");
 
-       retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, MEM_CTRL_SYS_RES_REQ);
-       if (retval != ERROR_OK)
-               return retval;
+       retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, MDM_CTRL_SYS_RES_REQ);
+       if (retval != ERROR_OK && !has_srst) {
+               LOG_ERROR("MDM: failed to assert reset");
+               goto deassert_reset_and_exit;
+       }
+
+       /*
+        * ... Read the MDM-AP status register Mass Erase Enable bit to
+        * determine if the mass erase command is enabled. If Mass Erase
+        * Enable = 0, then mass erase is disabled and the processor
+        * cannot be erased or unsecured. If Mass Erase Enable = 1, then
+        * the mass erase command can be used...
+        */
+       uint32_t stat;
+
+       retval = kinetis_mdm_read_register(dap, MDM_REG_STAT, &stat);
+       if (retval != ERROR_OK) {
+               LOG_ERROR("MDM: failed to read MDM_REG_STAT");
+               goto deassert_reset_and_exit;
+       }
+
+       if (!(stat & MDM_STAT_FMEEN)) {
+               LOG_ERROR("MDM: mass erase is disabled");
+               goto deassert_reset_and_exit;
+       }
+
+       if ((stat & MDM_STAT_SYSSEC) && !(jtag_get_reset_config() & RESET_HAS_SRST)) {
+               LOG_ERROR("Mass erase of a secured MCU is not possible without hardware reset.");
+               LOG_INFO("Connect SRST and use 'reset_config srst_only'.");
+               goto deassert_reset_and_exit;
+       }
 
        /*
-        * ... Read the MDM-AP status register until the Flash Ready bit sets...
+        * ... Read the MDM-AP status register until the Flash Ready bit sets
+        * and System Reset is asserted...
         */
        retval = kinetis_mdm_poll_register(dap, MDM_REG_STAT,
                                           MDM_STAT_FREADY | MDM_STAT_SYSRES,
                                           MDM_STAT_FREADY);
        if (retval != ERROR_OK) {
-               LOG_ERROR("MDM : flash ready timeout");
-               return retval;
+               LOG_ERROR("MDM: flash ready / system reset timeout");
+               goto deassert_reset_and_exit;
        }
 
        /*
@@ -361,43 +501,48 @@ COMMAND_HANDLER(kinetis_mdm_mass_erase)
         * Erase in Progress bit. This will start the mass erase
         * process...
         */
-       retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL,
-                                           MEM_CTRL_SYS_RES_REQ | MEM_CTRL_FMEIP);
-       if (retval != ERROR_OK)
-               return retval;
-
-       /* As a sanity check make sure that device started mass erase procedure */
-       retval = kinetis_mdm_poll_register(dap, MDM_REG_STAT,
-                                          MDM_STAT_FMEACK, MDM_STAT_FMEACK);
-       if (retval != ERROR_OK)
-               return retval;
+       retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, MDM_CTRL_SYS_RES_REQ | MDM_CTRL_FMEIP);
+       if (retval != ERROR_OK) {
+               LOG_ERROR("MDM: failed to start mass erase");
+               goto deassert_reset_and_exit;
+       }
 
        /*
         * ... Read the MDM-AP control register until the Flash Mass
         * Erase in Progress bit clears...
         */
-       retval = kinetis_mdm_poll_register(dap, MDM_REG_CTRL,
-                                          MEM_CTRL_FMEIP,
-                                          0);
-       if (retval != ERROR_OK)
-               return retval;
+       retval = kinetis_mdm_poll_register(dap, MDM_REG_CTRL, MDM_CTRL_FMEIP, 0);
+       if (retval != ERROR_OK) {
+               LOG_ERROR("MDM: mass erase timeout");
+               goto deassert_reset_and_exit;
+       }
+
+       target_poll(target);
+       /* enable polling in case kinetis_check_flash_security_status disabled it */
+       jtag_poll_set_enabled(true);
+
+       alive_sleep(100);
+
+       target->reset_halt = true;
+       target->type->assert_reset(target);
 
        /*
         * ... Negate the RESET signal or clear the System Reset Request
-        * bit in the MDM-AP control register...
+        * bit in the MDM-AP control register.
         */
        retval = kinetis_mdm_write_register(dap, MDM_REG_CTRL, 0);
        if (retval != ERROR_OK)
-               return retval;
+               LOG_ERROR("MDM: failed to clear MDM_REG_CTRL");
 
-       if (jtag_get_reset_config() & RESET_HAS_SRST) {
-               /* halt MCU otherwise it loops in hard fault - WDOG reset cycle */
-               target->reset_halt = true;
-               target->type->assert_reset(target);
-               target->type->deassert_reset(target);
-       }
+       target->type->deassert_reset(target);
 
-       return ERROR_OK;
+       return retval;
+
+deassert_reset_and_exit:
+       kinetis_mdm_write_register(dap, MDM_REG_CTRL, 0);
+       if (has_srst)
+               adapter_deassert_reset();
+       return retval;
 }
 
 static const uint32_t kinetis_known_mdm_ids[] = {
@@ -432,9 +577,12 @@ COMMAND_HANDLER(kinetis_check_flash_security_status)
        retval = kinetis_mdm_read_register(dap, MDM_REG_ID, &val);
        if (retval != ERROR_OK) {
                LOG_ERROR("MDM: failed to read ID register");
-               goto fail;
+               return ERROR_OK;
        }
 
+       if (val == 0)
+               return ERROR_OK;
+
        bool found = false;
        for (size_t i = 0; i < ARRAY_SIZE(kinetis_known_mdm_ids); i++) {
                if (val == kinetis_known_mdm_ids[i]) {
@@ -446,17 +594,6 @@ COMMAND_HANDLER(kinetis_check_flash_security_status)
        if (!found)
                LOG_WARNING("MDM: unknown ID %08" PRIX32, val);
 
-       /*
-        * ... Read the MDM-AP status register until the Flash Ready bit sets...
-        */
-       retval = kinetis_mdm_poll_register(dap, MDM_REG_STAT,
-                                          MDM_STAT_FREADY,
-                                          MDM_STAT_FREADY);
-       if (retval != ERROR_OK) {
-               LOG_ERROR("MDM: flash ready timeout");
-               goto fail;
-       }
-
        /*
         * ... Read the System Security bit to determine if security is enabled.
         * If System Security = 0, then proceed. If System Security = 1, then
@@ -467,33 +604,40 @@ COMMAND_HANDLER(kinetis_check_flash_security_status)
        retval = kinetis_mdm_read_register(dap, MDM_REG_STAT, &val);
        if (retval != ERROR_OK) {
                LOG_ERROR("MDM: failed to read MDM_REG_STAT");
-               goto fail;
+               return ERROR_OK;
        }
 
-       if ((val & (MDM_STAT_SYSSEC | MDM_STAT_CORE_HALTED)) == MDM_STAT_SYSSEC) {
-               LOG_WARNING("MDM: Secured MCU state detected however it may be a false alarm");
-               LOG_WARNING("MDM: Halting target to detect secured state reliably");
+       /*
+        * System Security bit is also active for short time during reset.
+        * If a MCU has blank flash and runs in RESET/WDOG loop,
+        * System Security bit is active most of time!
+        * We should observe Flash Ready bit and read status several times
+        * to avoid false detection of secured MCU
+        */
+       int secured_score = 0, flash_not_ready_score = 0;
 
-               retval = target_halt(target);
-               if (retval == ERROR_OK)
-                       retval = target_wait_state(target, TARGET_HALTED, 100);
+       if ((val & (MDM_STAT_SYSSEC | MDM_STAT_FREADY)) != MDM_STAT_FREADY) {
+               uint32_t stats[32];
+               int i;
 
-               if (retval != ERROR_OK) {
-                       LOG_WARNING("MDM: Target not halted, trying reset halt");
-                       target->reset_halt = true;
-                       target->type->assert_reset(target);
-                       target->type->deassert_reset(target);
+               for (i = 0; i < 32; i++) {
+                       stats[i] = MDM_STAT_FREADY;
+                       dap_queue_ap_read(dap_ap(dap, MDM_AP), MDM_REG_STAT, &stats[i]);
                }
-
-               /* re-read status */
-               retval = kinetis_mdm_read_register(dap, MDM_REG_STAT, &val);
+               retval = dap_run(dap);
                if (retval != ERROR_OK) {
-                       LOG_ERROR("MDM: failed to read MDM_REG_STAT");
-                       goto fail;
+                       LOG_DEBUG("MDM: dap_run failed when validating secured state");
+                       return ERROR_OK;
+               }
+               for (i = 0; i < 32; i++) {
+                       if (stats[i] & MDM_STAT_SYSSEC)
+                               secured_score++;
+                       if (!(stats[i] & MDM_STAT_FREADY))
+                               flash_not_ready_score++;
                }
        }
 
-       if (val & MDM_STAT_SYSSEC) {
+       if (flash_not_ready_score <= 8 && secured_score > 24) {
                jtag_poll_set_enabled(false);
 
                LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
@@ -505,17 +649,22 @@ COMMAND_HANDLER(kinetis_check_flash_security_status)
                LOG_WARNING("**** command, power cycle the MCU and restart OpenOCD.        ****");
                LOG_WARNING("****                                                          ****");
                LOG_WARNING("*********** ATTENTION! ATTENTION! ATTENTION! ATTENTION! **********");
+
+       } else if (flash_not_ready_score > 24) {
+               jtag_poll_set_enabled(false);
+               LOG_WARNING("**** Your Kinetis MCU is probably locked-up in RESET/WDOG loop. ****");
+               LOG_WARNING("**** Common reason is a blank flash (at least a reset vector).  ****");
+               LOG_WARNING("**** Issue 'kinetis mdm halt' command or if SRST is connected   ****");
+               LOG_WARNING("**** and configured, use 'reset halt'                           ****");
+               LOG_WARNING("**** If MCU cannot be halted, it is likely secured and running  ****");
+               LOG_WARNING("**** in RESET/WDOG loop. Issue 'kinetis mdm mass_erase'         ****");
+
        } else {
                LOG_INFO("MDM: Chip is unsecured. Continuing.");
                jtag_poll_set_enabled(true);
        }
 
        return ERROR_OK;
-
-fail:
-       LOG_ERROR("MDM: Failed to check security status of the MCU. Cannot proceed further");
-       jtag_poll_set_enabled(false);
-       return retval;
 }
 
 FLASH_BANK_COMMAND_HANDLER(kinetis_flash_bank_command)
@@ -545,30 +694,11 @@ int kinetis_disable_wdog(struct target *target, uint32_t sim_sdid)
        int retval;
 
        static const uint8_t kinetis_unlock_wdog_code[] = {
-               /* WDOG_UNLOCK = 0xC520 */
-               0x4f, 0xf4, 0x00, 0x53,    /* mov.w   r3, #8192     ; 0x2000  */
-               0xc4, 0xf2, 0x05, 0x03,    /* movt    r3, #16389    ; 0x4005  */
-               0x4c, 0xf2, 0x20, 0x52,   /* movw    r2, #50464    ; 0xc520  */
-               0xda, 0x81,               /* strh    r2, [r3, #14]  */
-
-               /* WDOG_UNLOCK = 0xD928 */
-               0x4f, 0xf4, 0x00, 0x53,   /* mov.w   r3, #8192     ; 0x2000  */
-               0xc4, 0xf2, 0x05, 0x03,   /* movt    r3, #16389    ; 0x4005  */
-               0x4d, 0xf6, 0x28, 0x12,   /* movw    r2, #55592    ; 0xd928  */
-               0xda, 0x81,               /* strh    r2, [r3, #14]  */
-
-               /* WDOG_SCR = 0x1d2 */
-               0x4f, 0xf4, 0x00, 0x53,   /* mov.w   r3, #8192     ; 0x2000  */
-               0xc4, 0xf2, 0x05, 0x03,   /* movt    r3, #16389    ; 0x4005  */
-               0x4f, 0xf4, 0xe9, 0x72,   /* mov.w   r2, #466      ; 0x1d2  */
-               0x1a, 0x80,               /* strh    r2, [r3, #0]  */
-
-               /* END */
-               0x00, 0xBE,               /* bkpt #0 */
+#include "../../../contrib/loaders/watchdog/armv7m_kinetis_wdog.inc"
        };
 
        /* Decide whether the connected device needs watchdog disabling.
-        * Disable for all Kx devices, i.e., return if it is a KLx */
+        * Disable for all Kx and KVx devices, return if it is a KLx */
 
        if ((sim_sdid & KINETIS_SDID_SERIESID_MASK) == KINETIS_SDID_SERIESID_KL)
                return ERROR_OK;
@@ -948,16 +1078,69 @@ static int kinetis_ftfx_command(struct target *target, uint8_t fcmd, uint32_t fa
 }
 
 
-static int kinetis_erase(struct flash_bank *bank, int first, int last)
+static int kinetis_check_run_mode(struct target *target)
 {
        int result, i;
-       struct kinetis_flash_bank *kinfo = bank->driver_priv;
+       uint8_t pmctrl, pmstat;
 
-       if (bank->target->state != TARGET_HALTED) {
+       if (target->state != TARGET_HALTED) {
                LOG_ERROR("Target not halted");
                return ERROR_TARGET_NOT_HALTED;
        }
 
+       result = target_read_u8(target, SMC_PMSTAT, &pmstat);
+       if (result != ERROR_OK)
+               return result;
+
+       if (pmstat == PM_STAT_RUN)
+               return ERROR_OK;
+
+       if (pmstat == PM_STAT_VLPR) {
+               /* It is safe to switch from VLPR to RUN mode without changing clock */
+               LOG_INFO("Switching from VLPR to RUN mode.");
+               pmctrl = PM_CTRL_RUNM_RUN;
+               result = target_write_u8(target, SMC_PMCTRL, pmctrl);
+               if (result != ERROR_OK)
+                       return result;
+
+               for (i = 100; i; i--) {
+                       result = target_read_u8(target, SMC_PMSTAT, &pmstat);
+                       if (result != ERROR_OK)
+                               return result;
+
+                       if (pmstat == PM_STAT_RUN)
+                               return ERROR_OK;
+               }
+       }
+
+       LOG_ERROR("Flash operation not possible in current run mode: SMC_PMSTAT: 0x%x", pmstat);
+       LOG_ERROR("Issue a 'reset init' command.");
+       return ERROR_TARGET_NOT_HALTED;
+}
+
+
+static void kinetis_invalidate_flash_cache(struct flash_bank *bank)
+{
+       struct kinetis_flash_bank *kinfo = bank->driver_priv;
+       uint8_t pfb01cr_byte2 = 0xf0;
+
+       if (!(kinfo->flash_support & FS_INVALIDATE_CACHE))
+               return;
+
+       target_write_memory(bank->target, FMC_PFB01CR + 2, 1, 1, &pfb01cr_byte2);
+       return;
+}
+
+
+static int kinetis_erase(struct flash_bank *bank, int first, int last)
+{
+       int result, i;
+       struct kinetis_flash_bank *kinfo = bank->driver_priv;
+
+       result = kinetis_check_run_mode(bank->target);
+       if (result != ERROR_OK)
+               return result;
+
        if ((first > bank->num_sectors) || (last > bank->num_sectors))
                return ERROR_FLASH_OPERATION_FAILED;
 
@@ -980,6 +1163,8 @@ static int kinetis_erase(struct flash_bank *bank, int first, int last)
                bank->sectors[i].is_erased = 1;
        }
 
+       kinetis_invalidate_flash_cache(bank);
+
        if (first == 0) {
                LOG_WARNING
                        ("flash configuration field erased, please reset the device");
@@ -1027,10 +1212,9 @@ static int kinetis_write(struct flash_bank *bank, const uint8_t *buffer,
        struct kinetis_flash_bank *kinfo = bank->driver_priv;
        uint8_t *new_buffer = NULL;
 
-       if (bank->target->state != TARGET_HALTED) {
-               LOG_ERROR("Target not halted");
-               return ERROR_TARGET_NOT_HALTED;
-       }
+       result = kinetis_check_run_mode(bank->target);
+       if (result != ERROR_OK)
+               return result;
 
        if (!(kinfo->flash_support & FS_PROGRAM_SECTOR)) {
                /* fallback to longword write */
@@ -1179,15 +1363,16 @@ static int kinetis_write(struct flash_bank *bank, const uint8_t *buffer,
                return ERROR_FLASH_OPERATION_FAILED;
        }
 
+       kinetis_invalidate_flash_cache(bank);
        return ERROR_OK;
 }
 
-static int kinetis_read_part_info(struct flash_bank *bank)
+static int kinetis_probe(struct flash_bank *bank)
 {
        int result, i;
        uint32_t offset = 0;
        uint8_t fcfg1_nvmsize, fcfg1_pfsize, fcfg1_eesize, fcfg1_depart;
-       uint8_t fcfg2_pflsh;
+       uint8_t fcfg2_maxaddr0, fcfg2_pflsh, fcfg2_maxaddr1;
        uint32_t nvm_size = 0, pf_size = 0, df_size = 0, ee_size = 0;
        unsigned num_blocks = 0, num_pflash_blocks = 0, num_nvm_blocks = 0, first_nvm_bank = 0,
                        pflash_sector_size_bytes = 0, nvm_sector_size_bytes = 0;
@@ -1211,7 +1396,7 @@ static int kinetis_read_part_info(struct flash_bank *bank)
                        pflash_sector_size_bytes = 1<<10;
                        nvm_sector_size_bytes = 1<<10;
                        num_blocks = 2;
-                       kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_PROGRAM_SECTOR;
+                       kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
                        break;
                case KINETIS_K_SDID_K10_M72:
                case KINETIS_K_SDID_K20_M72:
@@ -1224,7 +1409,7 @@ static int kinetis_read_part_info(struct flash_bank *bank)
                        pflash_sector_size_bytes = 2<<10;
                        nvm_sector_size_bytes = 1<<10;
                        num_blocks = 2;
-                       kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_PROGRAM_SECTOR;
+                       kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
                        kinfo->max_flash_prog_size = 1<<10;
                        break;
                case KINETIS_K_SDID_K10_M100:
@@ -1240,7 +1425,7 @@ static int kinetis_read_part_info(struct flash_bank *bank)
                        pflash_sector_size_bytes = 2<<10;
                        nvm_sector_size_bytes = 2<<10;
                        num_blocks = 2;
-                       kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_PROGRAM_SECTOR;
+                       kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
                        break;
                case KINETIS_K_SDID_K21_M120:
                case KINETIS_K_SDID_K22_M120:
@@ -1249,7 +1434,7 @@ static int kinetis_read_part_info(struct flash_bank *bank)
                        kinfo->max_flash_prog_size = 1<<10;
                        nvm_sector_size_bytes = 4<<10;
                        num_blocks = 2;
-                       kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR;
+                       kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
                        break;
                case KINETIS_K_SDID_K10_M120:
                case KINETIS_K_SDID_K20_M120:
@@ -1259,7 +1444,7 @@ static int kinetis_read_part_info(struct flash_bank *bank)
                        pflash_sector_size_bytes = 4<<10;
                        nvm_sector_size_bytes = 4<<10;
                        num_blocks = 4;
-                       kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR;
+                       kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
                        break;
                default:
                        LOG_ERROR("Unsupported K-family FAMID");
@@ -1273,7 +1458,7 @@ static int kinetis_read_part_info(struct flash_bank *bank)
                                /* K02FN64, K02FN128: FTFA, 2kB sectors */
                                pflash_sector_size_bytes = 2<<10;
                                num_blocks = 1;
-                               kinfo->flash_support = FS_PROGRAM_LONGWORD;
+                               kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_INVALIDATE_CACHE;
                                break;
 
                        case KINETIS_SDID_FAMILYID_K2X | KINETIS_SDID_SUBFAMID_KX2: {
@@ -1288,7 +1473,7 @@ static int kinetis_read_part_info(struct flash_bank *bank)
                                        /* MK24FN1M */
                                        pflash_sector_size_bytes = 4<<10;
                                        num_blocks = 2;
-                                       kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR;
+                                       kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
                                        kinfo->max_flash_prog_size = 1<<10;
                                        break;
                                }
@@ -1297,8 +1482,8 @@ static int kinetis_read_part_info(struct flash_bank *bank)
                                        || (kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K22FN512) {
                                        /* K22 with new-style SDID - smaller pflash with FTFA, 2kB sectors */
                                        pflash_sector_size_bytes = 2<<10;
-                                       num_blocks = 2;         /* 1 or 2 blocks */
-                                       kinfo->flash_support = FS_PROGRAM_LONGWORD;
+                                       /* autodetect 1 or 2 blocks */
+                                       kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_INVALIDATE_CACHE;
                                        break;
                                }
                                LOG_ERROR("Unsupported Kinetis K22 DIEID");
@@ -1309,12 +1494,12 @@ static int kinetis_read_part_info(struct flash_bank *bank)
                                if ((kinfo->sim_sdid & (KINETIS_SDID_DIEID_MASK)) == KINETIS_SDID_DIEID_K24FN256) {
                                        /* K24FN256 - smaller pflash with FTFA */
                                        num_blocks = 1;
-                                       kinfo->flash_support = FS_PROGRAM_LONGWORD;
+                                       kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_INVALIDATE_CACHE;
                                        break;
                                }
                                /* K24FN1M without errata 7534 */
                                num_blocks = 2;
-                               kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR;
+                               kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
                                kinfo->max_flash_prog_size = 1<<10;
                                break;
 
@@ -1328,7 +1513,7 @@ static int kinetis_read_part_info(struct flash_bank *bank)
                                nvm_sector_size_bytes = 4<<10;
                                kinfo->max_flash_prog_size = 1<<10;
                                num_blocks = 2;
-                               kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR;
+                               kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
                                break;
 
                        case KINETIS_SDID_FAMILYID_K2X | KINETIS_SDID_SUBFAMID_KX6:
@@ -1339,19 +1524,61 @@ static int kinetis_read_part_info(struct flash_bank *bank)
                                nvm_sector_size_bytes = 4<<10;
                                kinfo->max_flash_prog_size = 1<<10;
                                num_blocks = 4;
-                               kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR;
+                               kinfo->flash_support = FS_PROGRAM_PHRASE | FS_PROGRAM_SECTOR | FS_INVALIDATE_CACHE;
                                break;
                        default:
                                LOG_ERROR("Unsupported Kinetis FAMILYID SUBFAMID");
                        }
                        break;
+
                case KINETIS_SDID_SERIESID_KL:
                        /* KL-series */
                        pflash_sector_size_bytes = 1<<10;
                        nvm_sector_size_bytes = 1<<10;
-                       num_blocks = 1;
+                       /* autodetect 1 or 2 blocks */
                        kinfo->flash_support = FS_PROGRAM_LONGWORD;
                        break;
+
+               case KINETIS_SDID_SERIESID_KV:
+                       /* KV-series */
+                       switch (kinfo->sim_sdid & (KINETIS_SDID_FAMILYID_MASK | KINETIS_SDID_SUBFAMID_MASK)) {
+                       case KINETIS_SDID_FAMILYID_K1X | KINETIS_SDID_SUBFAMID_KX0:
+                               /* KV10: FTFA, 1kB sectors */
+                               pflash_sector_size_bytes = 1<<10;
+                               num_blocks = 1;
+                               kinfo->flash_support = FS_PROGRAM_LONGWORD;
+                               break;
+
+                       case KINETIS_SDID_FAMILYID_K1X | KINETIS_SDID_SUBFAMID_KX1:
+                               /* KV11: FTFA, 2kB sectors */
+                               pflash_sector_size_bytes = 2<<10;
+                               num_blocks = 1;
+                               kinfo->flash_support = FS_PROGRAM_LONGWORD;
+                               break;
+
+                       case KINETIS_SDID_FAMILYID_K3X | KINETIS_SDID_SUBFAMID_KX0:
+                               /* KV30: FTFA, 2kB sectors, 1 block */
+                       case KINETIS_SDID_FAMILYID_K3X | KINETIS_SDID_SUBFAMID_KX1:
+                               /* KV31: FTFA, 2kB sectors, 2 blocks */
+                               pflash_sector_size_bytes = 2<<10;
+                               /* autodetect 1 or 2 blocks */
+                               kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_INVALIDATE_CACHE;
+                               break;
+
+                       case KINETIS_SDID_FAMILYID_K4X | KINETIS_SDID_SUBFAMID_KX2:
+                       case KINETIS_SDID_FAMILYID_K4X | KINETIS_SDID_SUBFAMID_KX4:
+                       case KINETIS_SDID_FAMILYID_K4X | KINETIS_SDID_SUBFAMID_KX6:
+                               /* KV4x: FTFA, 4kB sectors */
+                               pflash_sector_size_bytes = 4<<10;
+                               num_blocks = 1;
+                               kinfo->flash_support = FS_PROGRAM_LONGWORD | FS_INVALIDATE_CACHE;
+                               break;
+
+                       default:
+                               LOG_ERROR("Unsupported KV FAMILYID SUBFAMID");
+                       }
+                       break;
+
                default:
                        LOG_ERROR("Unsupported K-series");
                }
@@ -1379,6 +1606,18 @@ static int kinetis_read_part_info(struct flash_bank *bank)
        fcfg1_depart = (uint8_t)((kinfo->sim_fcfg1 >> 8) & 0x0f);
 
        fcfg2_pflsh = (uint8_t)((kinfo->sim_fcfg2 >> 23) & 0x01);
+       fcfg2_maxaddr0 = (uint8_t)((kinfo->sim_fcfg2 >> 24) & 0x7f);
+       fcfg2_maxaddr1 = (uint8_t)((kinfo->sim_fcfg2 >> 16) & 0x7f);
+
+       if (num_blocks == 0)
+               num_blocks = fcfg2_maxaddr1 ? 2 : 1;
+       else if (fcfg2_maxaddr1 == 0 && num_blocks >= 2) {
+               num_blocks = 1;
+               LOG_WARNING("MAXADDR1 is zero, number of flash banks adjusted to 1");
+       } else if (fcfg2_maxaddr1 != 0 && num_blocks == 1) {
+               num_blocks = 2;
+               LOG_WARNING("MAXADDR1 is non zero, number of flash banks adjusted to 2");
+       }
 
        /* when the PFLSH bit is set, there is no FlexNVM/FlexRAM */
        if (!fcfg2_pflsh) {
@@ -1455,12 +1694,22 @@ static int kinetis_read_part_info(struct flash_bank *bank)
                pf_size = 1 << (14 + (fcfg1_pfsize >> 1));
                break;
        case 0x0f:
-               if (pflash_sector_size_bytes >= 4<<10)
-                       pf_size = 1024<<10;
-               else if (fcfg2_pflsh)
-                       pf_size = 512<<10;
+               /* a peculiar case: Freescale states different sizes for 0xf
+                * K02P64M100SFARM      128 KB ... duplicate of code 0x7
+                * K22P121M120SF8RM     256 KB ... duplicate of code 0x9
+                * K22P121M120SF7RM     512 KB ... duplicate of code 0xb
+                * K22P100M120SF5RM     1024 KB ... duplicate of code 0xd
+                * K26P169M180SF5RM     2048 KB ... the only unique value
+                * fcfg2_maxaddr0 seems to be the only clue to pf_size
+                * Checking fcfg2_maxaddr0 later in this routine is pointless then
+                */
+               if (fcfg2_pflsh)
+                       pf_size = ((uint32_t)fcfg2_maxaddr0 << 13) * num_blocks;
                else
-                       pf_size = 256<<10;
+                       pf_size = ((uint32_t)fcfg2_maxaddr0 << 13) * num_blocks / 2;
+               if (pf_size != 2048<<10)
+                       LOG_WARNING("SIM_FCFG1 PFSIZE = 0xf: please check if pflash is %u KB", pf_size>>10);
+
                break;
        default:
                pf_size = 0;
@@ -1486,7 +1735,10 @@ static int kinetis_read_part_info(struct flash_bank *bank)
                bank->base = 0x00000000 + bank->size * bank->bank_number;
                kinfo->prog_base = bank->base;
                kinfo->sector_size = pflash_sector_size_bytes;
-               kinfo->protection_size = pf_size / 32;
+               /* pflash is divided into 32 protection areas for
+                * parts with more than 32K of PFlash. For parts with
+                * less the protection unit is set to 1024 bytes */
+               kinfo->protection_size = MAX(pf_size / 32, 1024);
                kinfo->protection_block = (32 / num_pflash_blocks) * bank->bank_number;
 
        } else if ((unsigned)bank->bank_number < num_blocks) {
@@ -1532,6 +1784,20 @@ static int kinetis_read_part_info(struct flash_bank *bank)
                return ERROR_FLASH_BANK_INVALID;
        }
 
+       if (bank->bank_number == 0 && ((uint32_t)fcfg2_maxaddr0 << 13) != bank->size)
+               LOG_WARNING("MAXADDR0 0x%02" PRIx8 " check failed,"
+                               " please report to OpenOCD mailing list", fcfg2_maxaddr0);
+       if (fcfg2_pflsh) {
+               if (bank->bank_number == 1 && ((uint32_t)fcfg2_maxaddr1 << 13) != bank->size)
+                       LOG_WARNING("MAXADDR1 0x%02" PRIx8 " check failed,"
+                               " please report to OpenOCD mailing list", fcfg2_maxaddr1);
+       } else {
+               if ((unsigned)bank->bank_number == first_nvm_bank
+                               && ((uint32_t)fcfg2_maxaddr1 << 13) != df_size)
+                       LOG_WARNING("FlexNVM MAXADDR1 0x%02" PRIx8 " check failed,"
+                               " please report to OpenOCD mailing list", fcfg2_maxaddr1);
+       }
+
        if (bank->sectors) {
                free(bank->sectors);
                bank->sectors = NULL;
@@ -1568,16 +1834,6 @@ static int kinetis_read_part_info(struct flash_bank *bank)
        return ERROR_OK;
 }
 
-static int kinetis_probe(struct flash_bank *bank)
-{
-       if (bank->target->state != TARGET_HALTED) {
-               LOG_WARNING("Cannot communicate... target not halted.");
-               return ERROR_TARGET_NOT_HALTED;
-       }
-
-       return kinetis_read_part_info(bank);
-}
-
 static int kinetis_auto_probe(struct flash_bank *bank)
 {
        struct kinetis_flash_bank *kinfo = bank->driver_priv;
@@ -1607,14 +1863,14 @@ static int kinetis_info(struct flash_bank *bank, char *buf, int buf_size)
 static int kinetis_blank_check(struct flash_bank *bank)
 {
        struct kinetis_flash_bank *kinfo = bank->driver_priv;
+       int result;
 
-       if (bank->target->state != TARGET_HALTED) {
-               LOG_ERROR("Target not halted");
-               return ERROR_TARGET_NOT_HALTED;
-       }
+       /* suprisingly blank check does not work in VLPR and HSRUN modes */
+       result = kinetis_check_run_mode(bank->target);
+       if (result != ERROR_OK)
+               return result;
 
        if (kinfo->flash_class == FC_PFLASH || kinfo->flash_class == FC_FLEX_NVM) {
-               int result;
                bool block_dirty = false;
                uint8_t ftfx_fstat;
 
@@ -1776,10 +2032,9 @@ COMMAND_HANDLER(kinetis_nvm_partition)
        LOG_INFO("DEPART 0x%" PRIx8 ", EEPROM size code 0x%" PRIx8,
                 flex_nvm_partition_code, ee_size_code);
 
-       if (target->state != TARGET_HALTED) {
-               LOG_ERROR("Target not halted");
-               return ERROR_TARGET_NOT_HALTED;
-       }
+       result = kinetis_check_run_mode(target);
+       if (result != ERROR_OK)
+               return result;
 
        result = kinetis_ftfx_command(target, FTFx_CMD_PGMPART, load_flex_ram,
                                      ee_size_code, flex_nvm_partition_code, 0, 0,
@@ -1804,21 +2059,34 @@ COMMAND_HANDLER(kinetis_nvm_partition)
 }
 
 
-static const struct command_registration kinetis_securtiy_command_handlers[] = {
+static const struct command_registration kinetis_security_command_handlers[] = {
        {
                .name = "check_security",
                .mode = COMMAND_EXEC,
-               .help = "",
+               .help = "Check status of device security lock",
                .usage = "",
                .handler = kinetis_check_flash_security_status,
        },
+       {
+               .name = "halt",
+               .mode = COMMAND_EXEC,
+               .help = "Issue a halt via the MDM-AP",
+               .usage = "",
+               .handler = kinetis_mdm_halt,
+       },
        {
                .name = "mass_erase",
                .mode = COMMAND_EXEC,
-               .help = "",
+               .help = "Issue a complete flash erase via the MDM-AP",
                .usage = "",
                .handler = kinetis_mdm_mass_erase,
        },
+       {       .name = "reset",
+               .mode = COMMAND_EXEC,
+               .help = "Issue a reset via the MDM-AP",
+               .usage = "",
+               .handler = kinetis_mdm_reset,
+       },
        COMMAND_REGISTRATION_DONE
 };
 
@@ -1826,9 +2094,9 @@ static const struct command_registration kinetis_exec_command_handlers[] = {
        {
                .name = "mdm",
                .mode = COMMAND_ANY,
-               .help = "",
+               .help = "MDM-AP command group",
                .usage = "",
-               .chain = kinetis_securtiy_command_handlers,
+               .chain = kinetis_security_command_handlers,
        },
        {
                .name = "disable_wdog",
@@ -1852,7 +2120,7 @@ static const struct command_registration kinetis_command_handler[] = {
        {
                .name = "kinetis",
                .mode = COMMAND_ANY,
-               .help = "kinetis flash controller commands",
+               .help = "Kinetis flash controller commands",
                .usage = "",
                .chain = kinetis_exec_command_handlers,
        },