OpenOCD - Open On-Chip Debugger / Tickets / #270 Kinetis MK22FX512: Error writing FCF Block 0X400

Noel Diviney - 2020-06-23

Hi all

My problem is due to programming all of the flash at once using the following .
A different algorithm is needed for the FCF block at 0x400 - 0x40f

$ openocd -f interface/ftdi/olimex-arm-usb-ocd.cfg
-f interface/ftdi/swd-resistor-hack.cfg
-c "transport select swd"
-f target/kx.cfg
-c "program BlinkTestBlue.ino.elf verify reset"

Could somebody tell me where the tcl proc "program" code is located so that I can write a similar
proc myself to program the different sections.
I am confident that I then should be able to solve my problem.

BTW "Hats off" to all for the great work done in getting Kinetis to work.

Thank you in anticipation and best regards.
Noel Diviney.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Tomas Vanek - 2020-06-23

Looks strange.

Please be aware that code base [https://github.com/sysprogs/openocd] is not same as our "official" source, so it might be a problem of sysprog's changes. Let's hope it's not the case.

I tested programming with our fresh git master code in almost identical setup: FTDI based SWD resistor hack and MK22FX512, just the blink test is not arduino based - and gues what - programming works:

Open On-Chip Debugger 0.10.0+dev-01267-g0b02281-dirty (2020-05-28-18:10)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : FTDI SWD mode enabled
Info : add flash_bank kinetis kx.pflash
Info : clock speed 1000 kHz
Info : SWD DPIDR 0x2ba01477
Info : kx.cpu: hardware has 6 breakpoints, 4 watchpoints
Info : MDM: Chip is unsecured. Continuing.
Info : starting gdb server for kx.cpu on 3333
Info : Listening on port 3333 for gdb connections
Info : MDM: Chip is unsecured. Continuing.
target halted due to debug-request, current mode: Thread
xPSR: 0x01000000 pc: 0x000004e8 msp: 0x20010000
Info : Kinetis MK22FX512xxx12 detected: 2 flash blocks
Info : 1 PFlash banks: 512k total
Info : 1 FlexNVM banks: 128k total, 128k available as data flash, 4096bytes Flex
RAM
Info : Disabling Kinetis watchdog (initial WDOG_STCTRLH = 0x01d3)
Info : WDOG_STCTRLH = 0x01d2
Programming Started
Programming Finished
Verify Started
Verified OK
Resetting Target
Info : MDM: Chip is unsecured. Continuing.
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections

Please first check if FCF field is configured properly in your binary

arm-none-eabi-objdump -h BlinkTestBlue.ino.elf

should look like:

Sections: Idx Name Size VMA LMA File off Algn 0 .interrupts 00000400 00000000 00000000 00008000 2**2 CONTENTS, ALLOC, LOAD, READONLY, DATA 1 .flash_config 00000010 00000400 00000400 00008400 2**0 CONTENTS, ALLOC, LOAD, READONLY, DATA 2 .text 00005068 00000410 00000410 00008410 2**2 CONTENTS, ALLOC, LOAD, READONLY, CODE ...

If not, the check linker ld script.

If FCF is ok, then please re-run programming cmd with -d3 and put the result log somewhere
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Noel Diviney - 2020-06-23

Hi Tom,

Thank you for your response, it has a lot very usefull information.
Looking at your objectdump it is most likely the linker script holds the secret.
I would now like to delve into this some more as it is a great learning experience.

I inherited this project.
It is using Arduino and running a hack of the Teensy3 core, which is where the linker script
is coming from. The version of Arduino is 1.6.11 and Teensy is circa 1.3.0 , so it needs some work.

What build system did you use ?
I would like to duplicate what you have done and then I think we are almost there.
I will post my progress as I go.

Many thanks again for your assistance.

Noel

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Tomas Vanek - 2020-06-23

My code uses Kinetis SDK. It is available for free, you just need to make account @ nxp and request SDK from the generator at https://mcuxpresso.nxp.com
The SDK is far from perfect, but you can at least take some inspiration from it...

BTW if the FCF block is missing from your binary at all then OpenOCD probably saved your MCU from beeing bricked permanently.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Noel Diviney - 2020-06-23

Hi Tom,

Thanks Tom,
I had already started to look at MCUXpresso, so now I wll get on with that.
So far I have not bricked any chips yet so luck has been on my side.

BTW. Are the tomvdb of EduBot fame.
I have been learning all about boards.txt etc for the Stm32 from the arduino_edubot project.

Thanks again,
Noel.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Noel Diviney - 2020-06-24

Hi Tom.

A progress update.
Adjusted the msys2 PKGBUILD script to get the latest version from https://github.com/ntfreak/openocd which should get me on the same wavelength.
see as follows :-

$ openocd --version
Open On-Chip Debugger 0.10.0+dev-01289-g8833c889d-dirty (2020-06-24-10:07)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.h

I am now working on creating a "BlinkLed" build for my kinetis MK22FX512AVLH12 board
to make it possible to compare my results with your's.

stay tuned,

Best regards Noel

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Noel Diviney - 2020-06-27

Hi Tom and the OpenOCD Team

Another progress update.

Because I am programming my Flash from absolute zero (ie no linker offset), I am convinced that the Tcl Proc "program" is not able to write the FCF at 0x400 - 0x40f ( it requires a 32 bit double word write instead of the "program sections" used by the "program" command.
I have created a bash script to split my binary image into 3 parts as follows :-
vect,bin 0x000 - 0x3ff
fcf,bin 0x400 - 0x40f
app.bin 0x410 - EOF

I now launch a Msys2 Terminal to erase and program the Flash as follows :-
noel@DESKTOP-0AFLL5T MSYS /w/arduino-1812/portable/sketchbook/BlinkTestBlue
$ openocd -f interface/ftdi/olimex-arm-usb-ocd.cfg -f target/kx.cfg -c "program vect.bin erase verify 0x000000" -c "flash write_image app.bin 0x410;" -c "flash verify_bank 0 app.bin 0x410" -c "reset run" -c "exit"
Open On-Chip Debugger 0.10.0+dev-01289-g8833c889d-dirty (2020-06-24-10:07)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
Info : add flash_bank kinetis kx.pflash
Info : clock speed 1000 kHz
Info : JTAG tap: kx.cpu tap/device found: 0x4ba00477 (mfg: 0x23b (ARM Ltd.), part: 0xba00, ver: 0x4)
Info : kx.cpu: hardware has 6 breakpoints, 4 watchpoints
Info : MDM: Chip is unsecured. Continuing.
Info : starting gdb server for kx.cpu on 3333
Info : Listening on port 3333 for gdb connections
Info : JTAG tap: kx.cpu tap/device found: 0x4ba00477 (mfg: 0x23b (ARM Ltd.), part: 0xba00, ver: 0x4)
Info : MDM: Chip is unsecured. Continuing.
target halted due to debug-request, current mode: Thread
xPSR: 0x01000000 pc: 0x00000188 msp: 0x20010000
Info : Kinetis MK22FX512xxx12 detected: 2 flash blocks
Info : 1 PFlash banks: 512k total
Info : 1 FlexNVM banks: 128k total, 128k available as data flash, 4096bytes FlexRAM
Info : Disabling Kinetis watchdog (initial WDOG_STCTRLH = 0x01d3)
Info : WDOG_STCTRLH = 0x01d2
Programming Started
Info : Device security requested in programmed file!
Info : Expect verify errors at FCF (0x408-0x40f).
Warn : Flash Configuration Field written.
Warn : Reset or power off the device to make settings effective.
Programming Finished
Verify Started
Verified OK
Warn : Flash Configuration Field written.
Warn : Reset or power off the device to make settings effective.
wrote 8388 bytes from file app.bin in 0.234998s (34.857 KiB/s)</transport>

read 8388 bytes from file app.bin and flash bank 0 at offset 0x00000410 in 0.136057s (60.206 KiB/s)
contents match

Info : JTAG tap: kx.cpu tap/device found: 0x4ba00477 (mfg: 0x23b (ARM Ltd.), part: 0xba00, ver: 0x4)
Info : MDM: Chip is unsecured. Continuing.

noel@DESKTOP-0AFLL5T MSYS /w/arduino-1812/portable/sketchbook/BlinkTestBlue
$

This results in a "verified OK" and a "contents match" for the app.bin part.
And I am presented with a "Bright Flashing Blue Led".
By the way the "mass_erase" sets the FCF block to default value so that it will not get bricked.
So I leave that as is for now.

I will put together Github tutorial on this and include the "Bash Script" for creating a nice "OpenOCD Programmer" over the next week.

A big "thank you" to all for the tremendous work in getting the better of Kinetis.

Now How Do i close this ticket???

Best regards.
Noel Diviney.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Tomas Vanek - 2020-06-27

I will put together Github tutorial on this and include the "Bash Script" for creating a nice "OpenOCD Programmer" over the next week.

Please do not. The hackish way works for you but offseting slpitted parts of bin file is error prone and pontentially dangerous for others. Better learn more about gnu linker scripts and also read OpenOCD doc. I strongly reccomend elf file for flashing.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Andreas Fritiofson - 2020-06-28
  
  Sounds like a bug in the flash driver if it works with separate flash write
  operations but not with one contiguous.
  
  Certainly if programming a bin file fails while programming an elf file
  with contiguous sections covering the same range does work. Success/fail
  should not depend on the source format of the data! There is no promise
  that the ELF flashing path will not merge back-to-back sections into larger
  flash writes, in fact it would make sense to do so.
  
  On Sat, Jun 27, 2020 at 4:00 PM Tom via OpenOCD-devel openocd-devel@lists.sourceforge.net wrote:
  
  I will put together Github tutorial on this and include the "Bash Script"
  for creating a nice "OpenOCD Programmer" over the next week.
  
  Please do not. The hackish way works for you but offseting slpitted parts
  of bin file is error prone and pontentially dangerous for others. Better
  learn more about gnu linker scripts and also read OpenOCD doc. I strongly
  reccomend elf file for flashing.
  
  [tickets:#270] https://sourceforge.net/p/openocd/tickets/270/ Kinetis
  MK22FX512: Error writing FCF Block 0X400 - 0x40f*
  
  Status: new
  Milestone: 0.9.0
  Created: Sun Jun 14, 2020 06:14 AM UTC by Noel Diviney
  Last Updated: Sat Jun 27, 2020 11:55 AM UTC
  Owner: nobody
  
  Hi nall,
  Error at address 0x400 when programming flash on Kinetis MK22F512xxx12
  However, when I press the reset buuton after programming the Led Blinks
  normally.
  
  Does the FCF block have to be skipped somehow?
  Is the "Error: libusb_open() failed with LIBUSB_ERROR_NOT_SUPPORTED" a
  problem
  given that the program runs.
  
  The terminal output is as follows :-
  noel@DESKTOP-0AFLL5T MSYS
  /w/adgp-1611/portable/sketchbook/BlinkTestBlue/build
  $ openocd -f interface/ftdi/olimex-arm-usb-ocd.cfg
  -f target/kx.cfg
  -c "program BlinkTestBlue.ino.elf verify reset"
  Open On-Chip Debugger 0.10.0 (2020-05-30)
  https://github.com/sysprogs/openocd
  Licensed under GNU GPL v2
  libusb1 09e75e98b4d9ea7909e8837b7a3f00dda4589dc3
  For bug reports, read
  http://openocd.org/doc/doxygen/bugs.html
  Info : auto-selecting first available session transport "jtag". To
  override use 'transport select <transport>'.
  Info : add flash_bank kinetis kx.pflash
  Error: libusb_open() failed with LIBUSB_ERROR_NOT_SUPPORTED
  Info : clock speed 1000 kHz
  Info : JTAG tap: kx.cpu tap/device found: 0x4ba00477 (mfg: 0x23b (ARM
  Ltd.), part: 0xba00, ver: 0x4)
  Info : kx.cpu: hardware has 6 breakpoints, 4 watchpoints
  Info : kx.cpu: external reset detected
  Info : MDM: Chip is unsecured. Continuing.
  Info : starting gdb server for kx.cpu on 3333
  Info : Listening on port 3333 for gdb connections
  Info : JTAG tap: kx.cpu tap/device found: 0x4ba00477 (mfg: 0x23b (ARM
  Ltd.), part: 0xba00, ver: 0x4)
  Info : MDM: Chip is unsecured. Continuing.
  target halted due to debug-request, current mode: Thread
  xPSR: 0x01000000 pc: 0x00000188 msp: 0x20010000
  Info : Kinetis MK22FX512xxx12 detected: 2 flash blocks
  Info : 1 PFlash banks: 512k total
  Info : 1 FlexNVM banks: 128k total, 128k available as data flash,
  4096bytes FlexRAM
  Info : Disabling Kinetis watchdog (initial WDOG_STCTRLH = 0x01d3)
  Info : WDOG_STCTRLH = 0x01d2
  Programming Started
  Error: Flash write error at 0x00000400
  Programming Finished
  Verify Started
  Error: timed out while waiting for target halted
  Error: error executing cortex_m crc algorithm
  Error: JTAG-DP STICKY ERROR
  Error: Failed to read memory at 0x00000404
  embedded:startup.tcl:500: Error: * Verify Failed *
  in procedure 'program'
  in procedure 'program_error' called at file "embedded:startup.tcl", line
  561
  at file "embedded:startup.tcl", line 500</transport>
  
  noel@DESKTOP-0AFLL5T MSYS
  /w/adgp-1611/portable/sketchbook/BlinkTestBlue/build
  $ openocd -f interface/ftdi/olimex-arm-usb-ocd.cfg
  -f interface/ftdi/swd-resistor-hack.cfg
  -c "transport select swd"
  -f target/kx.cfg
  -c "program BlinkTestBlue.ino.elf verify reset"
  Open On-Chip Debugger 0.10.0 (2020-05-30)
  https://github.com/sysprogs/openocd
  Licensed under GNU GPL v2
  libusb1 09e75e98b4d9ea7909e8837b7a3f00dda4589dc3
  For bug reports, read
  http://openocd.org/doc/doxygen/bugs.html
  Info : FTDI SWD mode enabled
  Warn : Transport "swd" was already selected
  swd
  Info : add flash_bank kinetis kx.pflash
  Error: libusb_open() failed with LIBUSB_ERROR_NOT_SUPPORTED
  Info : clock speed 1000 kHz
  Info : SWD DPIDR 0x2ba01477
  Info : kx.cpu: hardware has 6 breakpoints, 4 watchpoints
  Info : kx.cpu: external reset detected
  Info : MDM: Chip is unsecured. Continuing.
  Info : starting gdb server for kx.cpu on 3333
  Info : Listening on port 3333 for gdb connections
  Info : MDM: Chip is unsecured. Continuing.
  target halted due to debug-request, current mode: Thread
  xPSR: 0x01000000 pc: 0x00000188 msp: 0x20010000
  Info : Kinetis MK22FX512xxx12 detected: 2 flash blocks
  Info : 1 PFlash banks: 512k total
  Info : 1 FlexNVM banks: 128k total, 128k available as data flash,
  4096bytes FlexRAM
  Info : Disabling Kinetis watchdog (initial WDOG_STCTRLH = 0x01d3)
  Info : WDOG_STCTRLH = 0x01d2
  Programming Started
  Error: Flash write error at 0x00000400
  Programming Finished
  Verify Started
  Error: timed out while waiting for target halted
  Error: error executing cortex_m crc algorithm
  Info : SWD DPIDR 0x2ba01477
  Error: Failed to read memory at 0x00000404
  embedded:startup.tcl:500: Error: * Verify Failed *
  in procedure 'program'
  in procedure 'program_error' called at file "embedded:startup.tcl", line
  561
  at file "embedded:startup.tcl", line 500
  
  noel@DESKTOP-0AFLL5T MSYS
  /w/adgp-1611/portable/sketchbook/BlinkTestBlue/build
  $
  I am having difficulty understanding how to manage the FCF flash block.
  Any help would be much appreciated.
  
  Many Thanks Noel Diviney
  
  Sent from sourceforge.net because openocd-devel@lists.sourceforge.net is
  subscribed to https://sourceforge.net/p/openocd/tickets/
  
  To unsubscribe from further messages, a project admin can change settings
  at https://sourceforge.net/p/openocd/admin/tickets/options. Or, if this
  is a mailing list, you can unsubscribe from the mailing list.
  
  OpenOCD-devel mailing list
  OpenOCD-devel@lists.sourceforge.net
  https://lists.sourceforge.net/lists/listinfo/openocd-devel
  
  Related
  
  Tickets: #270
  
  alternate
  
  If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Noel Diviney - 2020-07-01

Hi all.

Update.
I have created two builds of a Blink Led program for test purposes.
The attachment contains the dbug output log.

The first build is linked to start at absolute zero and is programmed with the following results:-

noel@DESKTOP-0AFLL5T MSYS /w/arduino1-1812/portable/sketchbook/BlinkBlue1/build
$ openocd -f interface/ftdi/olimex-arm-usb-ocd.cfg -f target/kx.cfg -c "program BlinkBlue1.ino.bin erase verify 0x0000"
Open On-Chip Debugger 0.10.0+dev-01289-g8833c889d-dirty (2020-06-24-10:07)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
Info : add flash_bank kinetis kx.pflash
Info : clock speed 1000 kHz
Info : JTAG tap: kx.cpu tap/device found: 0x4ba00477 (mfg: 0x23b (ARM Ltd.), part: 0xba00, ver: 0x4)
Info : kx.cpu: hardware has 6 breakpoints, 4 watchpoints
Info : MDM: Chip is unsecured. Continuing.
Info : starting gdb server for kx.cpu on 3333
Info : Listening on port 3333 for gdb connections
Info : JTAG tap: kx.cpu tap/device found: 0x4ba00477 (mfg: 0x23b (ARM Ltd.), part: 0xba00, ver: 0x4)
Info : MDM: Chip is unsecured. Continuing.
target halted due to debug-request, current mode: Thread
xPSR: 0x01000000 pc: 0x00000188 msp: 0x20010000
Info : Kinetis MK22FX512xxx12 detected: 2 flash blocks
Info : 1 PFlash banks: 512k total
Info : 1 FlexNVM banks: 128k total, 128k available as data flash, 4096bytes FlexRAM
Info : Disabling Kinetis watchdog (initial WDOG_STCTRLH = 0x01d3)
Info : WDOG_STCTRLH = 0x01d2
Programming Started
Error: Flash write error at 0x00000400
Programming Finished
Verify Started
Error: timed out while waiting for target halted
Error: error executing cortex_m crc algorithm
Error: JTAG-DP STICKY ERROR
Error: Failed to read memory at 0x00000404
embedded:startup.tcl:521: Error: Verify Failed
in procedure 'program'
in procedure 'program_error' called at file "embedded:startup.tcl", line 582
at file "embedded:startup.tcl", line 521</transport>

The second build is linked to start at 0x4000 ie a offset of 16 Kb
This one is programmed with the same command and produces the following results :-

noel@DESKTOP-0AFLL5T MSYS /w/arduino2-1812/portable/sketchbook/BlinkBlue2/build
$ openocd -f interface/ftdi/olimex-arm-usb-ocd.cfg -f target/kx.cfg -c "program BlinkBlue2.ino.bin erase verify 0x4000"
Open On-Chip Debugger 0.10.0+dev-01289-g8833c889d-dirty (2020-06-24-10:07)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
Info : add flash_bank kinetis kx.pflash
Info : clock speed 1000 kHz
Info : JTAG tap: kx.cpu tap/device found: 0x4ba00477 (mfg: 0x23b (ARM Ltd.), part: 0xba00, ver: 0x4)
Info : kx.cpu: hardware has 6 breakpoints, 4 watchpoints
Info : MDM: Chip is unsecured. Continuing.
Info : starting gdb server for kx.cpu on 3333
Info : Listening on port 3333 for gdb connections
Info : JTAG tap: kx.cpu tap/device found: 0x4ba00477 (mfg: 0x23b (ARM Ltd.), part: 0xba00, ver: 0x4)
Info : MDM: Chip is unsecured. Continuing.
target halted due to debug-request, current mode: Thread
xPSR: 0x01000000 pc: 0x00000188 msp: 0x20010000
Info : Kinetis MK22FX512xxx12 detected: 2 flash blocks
Info : 1 PFlash banks: 512k total
Info : 1 FlexNVM banks: 128k total, 128k available as data flash, 4096bytes FlexRAM
Info : Disabling Kinetis watchdog (initial WDOG_STCTRLH = 0x01d3)
Info : WDOG_STCTRLH = 0x01d2
Programming Started
Programming Finished
Verify Started
Verified OK
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections</transport>

The first one fails at absolute address 0x400, whereas the second one programs and verifies ok.

It is my understanding that the FCF block at 0x400 - 0x40f has to be programmed using 32 bit
long words, whereas the "program" tcl proc programs a section at a time.

I have attached a zip file of the -d3 debug output from both programming attempts.

Now my objective is to create a Production line programmer (0x00 start address) and be able to
program a whole panel of boards containging the k22f512-128 chip.

It is my belief that this is not a bug but a a problem with programming this Kinetis k22f512
Why they put this block as an obstacle to normal programming is beyond belief.

I have attached openocd-drbug.zip which has fulll debug output of both programming attempts.

Best regards Noel Diviney.

openocd-debug.zip

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Tomas Vanek - 2020-07-01

Why they put this block as an obstacle to normal programming is beyond belief.

Sure, Freescale wins the competition for the most stupid flash protection.

From the log I recalled what the flash driver does to protect FCF from bad data.
It looks like there is some difference between the OpenOCD generated FCF (written just after erase) and the FCF in programmed file which is not detected by the driver (probably a bug) but upsets the flash controller during write.
Can you please share also programmed bin and elf files? Thanks

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Noel Diviney - 2020-07-01

Hello Tom,

Nice to hear from you again.
I have attached the files. BlinkBlue1 = 0x0000 start address and BlinkBlue2 = 0x4000 address

Cheers Noel

BlinkBlueFiles.zip

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Tomas Vanek - 2020-07-01

Finally I understand what's causing the problem.

Sector erase does not set FSEC field to unsecure as mass erase does. So if user issue sector erase followed device reset then the device gets locked (not permanently but it's a trouble as well).
To prevent this the OpenOCD kinetis flash driver builds its own FCF and writes it immediately after erase of the sector containing FCF. Ideally the generated FCF is same as FCF data in programmed file.

The FCF data in files you send are correct. I was suspicious as there is no dedicated section in elf but this does not matter for flash programming. So the simplest solution to your problem is to switch off FCF checking in OpenOCD by command "kinetis fcf_source write" - be aware that in this mode incorrect FCF data in programmed file can peramnently lock the device. See http://openocd.org/doc/html/Flash-Commands.html#index-kinetis
for details.

Although the Arduino generated FCF is correct, it differs from one generated by OpenOCD. You should let know OpenOCD about the used FOPT value by command "kinetis fopt". Unfortunately this is not enough. Arduino sets FSEC byte to 0xde. This is ok according to RM but MEEN field is used just in secure modes so there is no point to set it in unsecure state. That's why OpenOCD uses FSEC value 0xfe, same as mass erase sets. So this should be fixed somewhere in the startup code of Arduino.

Kinetis K22 doesn't implement ECC (error check and correction) in the flash module. Based on the flash principle it is possible to program already programmed flash word and the resulted data is "bitwise and". Of course this is not a good practice as it overstress the flash memory cell. RM 29.4.12.8 Program Section command, paragraph CAUTION strictly prohibits this. But if you want to program FOPT to something else than 0xff and the device is mass-erased then reprogramming takes place. That's why the flash driver allows reprogramming of FCF if differs in programmed file. By the time I wrote that code I didn't know how unreliable is reprogramming of the Kinetis flash. You can try it at any flash location (I would recommend to keep out of FCF):

> flash fillw 0x7e000 0xfffffffe 1 wrote 4 bytes to 0x0007e000 in 0.018735s (0.209 KiB/s) > flash fillw 0x7e000 0xfffff9de 1 Flash write error at 0x0007e000 Failed to read memory at 0x0007e004 error reading to flash at address 0x00000000 at offset 0x0007e000

The memory location is unreadable after the second flash programming.
Interesting this fails on newer rev A silicon only, older MK22FN1M0 withstands the same sequence without problem. Anyway the more zeroes in the second write the more likely the word gets unreadable.

The fillw command sequence simulates what happens during programming:
Generated FCF is succesfully written

Debug: 750 1049 kinetis.c:1825 kinetis_write_inner(): flash write @ 0x00000400 Debug: 751 1049 kinetis.c:1760 kinetis_write_sections(): write section @ 0x00000400 with length 16 bytes Debug: 752 1049 target.c:2523 target_write_u8(): address: 0x40020000, value: 0x80

and reprogramming fails:

Debug: 775 1134 kinetis.c:1760 kinetis_write_sections(): write section @ 0x00000400 with length 1024 bytes Debug: 776 1134 target.c:2523 target_write_u8(): address: 0x40020000, value: 0x80 Debug: 777 1134 target.c:2440 target_read_u8(): address: 0x40020000, value: 0x00 Debug: 778 1134 target.c:2440 target_read_u8(): address: 0x40020000, value: 0x00 Debug: 779 1149 target.c:2440 target_read_u8(): address: 0x40020000, value: 0x81 Error: 780 1149 kinetis.c:1782 kinetis_write_sections(): Flash write error at 0x00000400

The OpenOCD driver should check if FCF is going to be reprogrammed and at least warn in this case.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Noel Diviney - 2020-07-02

Hi Tom.

I have just switched on my Lockdown lab set up on the dining room table and saw this great
news from you. This is a lifesavour as I was in danger of going totally mental.
I have read the Kinetis documentation many times over and my only conclusion is that the guy
that wrote the manual needs to go back and have some lessons in Technical Writing.

You have provided a lot of detailed information so now I will go off and learn more about programming the FCF Block. I have noted your suggestion to experiment away from the address range 0x400 - 0x40f and I will move it to 0x500 to try things out. I have reasonable experience in Bootloaders, having written my first one at the Adelaide University for the Control Data 6400 back in 1967, however the K22FX512 is another story all together.

I work with http://eicon.xyz/ and I am under pressure to get the production programming of a Digital Preamp board sorted out to do a whole panel of boards together. We currently use a Teensy as a single EzPort Programmer. We bought a programmer that claimed to do the K22FX series but it did not work so I am now making my own using the FT2232H/Ft4232H chip and Openocd. I would also like to port the Kinetis SDK to Arduino as I am a bit of a fan of Arduino,
however, I want to use CMake and the CodeLite Ide as the IDE and Build System.

I will now see how I go programming the K22FX512 but I may need to defer to your superior knowlege on Kinetis if that is Ok.

Many thanks again for spending the time to help me with this

Best regards.
Noel.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Tomas Vanek - 2020-07-02

Noel, thanks for warm words!
Please test http://openocd.zylin.com/5753
The change does not fix the problem itself but improves verbosity so that an user should know what's wrong.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Noel Diviney - 2020-07-02

Hi Tom.

Ok. I am about to have dinner and a break.
I will try it out and report back the results tonight (Melb Time).
Thanks again for your efforts.

Noel.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Noel Diviney - 2020-07-02

Hi Tom,

Finished dinner and back again.
I have done a clean build of the latest sources from https://git.code.sf.net/p/openocd/code

The log now says :-
noel@DESKTOP-0AFLL5T MSYS /w/arduino1-1812/portable/sketchbook/BlinkBlue1/build
$ openocd -f interface/ftdi/olimex-arm-usb-ocd.cfg -f target/kx.cfg -c "program BlinkBlue1.ino.bin erase verify 0x0000"
Open On-Chip Debugger 0.10.0+dev-01293-g7c88e76a7-dirty (2020-07-02-20:47)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
Info : add flash_bank kinetis kx.pflash
Info : clock speed 1000 kHz
Info : JTAG tap: kx.cpu tap/device found: 0x4ba00477 (mfg: 0x23b (ARM Ltd.), part: 0xba00, ver: 0x4)
Info : kx.cpu: hardware has 6 breakpoints, 4 watchpoints
Info : MDM: Chip is unsecured. Continuing.
Info : starting gdb server for kx.cpu on 3333
Info : Listening on port 3333 for gdb connections
Info : JTAG tap: kx.cpu tap/device found: 0x4ba00477 (mfg: 0x23b (ARM Ltd.), part: 0xba00, ver: 0x4)
Info : MDM: Chip is unsecured. Continuing.
target halted due to debug-request, current mode: Thread
xPSR: 0x01000000 pc: 0x00000188 msp: 0x20010000
Info : Kinetis MK22FX512xxx12 detected: 2 flash blocks
Info : 1 PFlash banks: 512k total
Info : 1 FlexNVM banks: 128k total, 128k available as data flash, 4096bytes FlexRAM
Info : Disabling Kinetis watchdog (initial WDOG_STCTRLH = 0x01d3)
Info : WDOG_STCTRLH = 0x01d2
Programming Started
Error: Flash write error at 0x00000400
Programming Finished
Verify Started
Error: timed out while waiting for target halted
Error: error executing cortex_m crc algorithm
Error: JTAG-DP STICKY ERROR
Error: Failed to read memory at 0x00000404
embedded:startup.tcl:521: Error: Verify Failed
in procedure 'program'
in procedure 'program_error' called at file "embedded:startup.tcl", line 582
at file "embedded:startup.tcl", line 521</transport>

noel@DESKTOP-0AFLL5T MSYS /w/arduino1-1812/portable/sketchbook/BlinkBlue1/build

I have not applied patches to openocd build before so can you please show me whats involved.
I am using a Msys64 commandline terminal as inicated above.

Thanks Noel.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Paul Fertser - 2020-07-02
  
  Hi Noel,
  
  On Thu, Jul 02, 2020 at 11:12:37AM -0000, Noel Diviney wrote:
  
  I have not applied patches to openocd build before so can you please show me
  whats involved.
  I am using a Msys64 commandline terminal as inicated above.
  
  Basically, you have ready-made commands in the "Download" drop-down
  menu on Gerrit change page. In this specific case I'd do
  
  git fetch http://openocd.zylin.com/openocd refs/changes/53/5753/1 &&
  git cherry-pick FETCH_HEAD
  
  git fetch http://openocd.zylin.com/openocd refs/changes/52/5752/1 &&
  git cherry-pick FETCH_HEAD
  
  (for the two patches Tomas just sent) and run "make" again.
  
  HTH
  
  Be free, use free (http://www.gnu.org/philosophy/free-sw.html) software!
  mailto:fercerpav@gmail.com
  
  If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
  - Paul Fertser - 2020-07-02
    
    On Thu, Jul 02, 2020 at 02:16:17PM +0300, Paul Fertser wrote:
    
    Basically, you have ready-made commands in the "Download" drop-down
    menu on Gerrit change page. In this specific case I'd do
    ...
    
    That said, in this particular case of two patches, the second having
    the first as its parent (in other words, they are a new branch having
    two commit in series on top of the current master, and that's exactly
    what you're after, using current master and no additional code on top
    of it) this would work as well:
    
    git fetch http://openocd.zylin.com/openocd refs/changes/53/5753/1 &&
    git checkout FETCH_HEAD
    
    --
    Be free, use free (http://www.gnu.org/philosophy/free-sw.html) software!
    mailto:fercerpav@gmail.com
    
    If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Noel Diviney - 2020-07-02

Hi Paul,

Thank you for the instructions. This is proving to be a great learning exercise for me,

I have carried out the git fetches and done a MAKEPKG-mingw PKGBUILD on the results.
I now get the following when I program the flash :-

noel@DESKTOP-0AFLL5T MSYS /w/arduino1-1812/portable/sketchbook/BlinkBlue1/build
$ openocd -f interface/ftdi/olimex-arm-usb-ocd.cfg -f target/kx.cfg -c "program BlinkBlue1.ino.bin erase verify 0x0000"
Open On-Chip Debugger 0.10.0+dev-01293-g7c88e76a7-dirty (2020-07-02-20:47)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
Info : add flash_bank kinetis kx.pflash
Info : clock speed 1000 kHz
Info : JTAG tap: kx.cpu tap/device found: 0x4ba00477 (mfg: 0x23b (ARM Ltd.), part: 0xba00, ver: 0x4)
Info : kx.cpu: hardware has 6 breakpoints, 4 watchpoints
Info : MDM: Chip is unsecured. Continuing.
Info : starting gdb server for kx.cpu on 3333
Info : Listening on port 3333 for gdb connections
Info : JTAG tap: kx.cpu tap/device found: 0x4ba00477 (mfg: 0x23b (ARM Ltd.), part: 0xba00, ver: 0x4)
Info : MDM: Chip is unsecured. Continuing.
target halted due to debug-request, current mode: Thread
xPSR: 0x01000000 pc: 0x00000188 msp: 0x20010000
Info : Kinetis MK22FX512xxx12 detected: 2 flash blocks
Info : 1 PFlash banks: 512k total
Info : 1 FlexNVM banks: 128k total, 128k available as data flash, 4096bytes FlexRAM
Info : Disabling Kinetis watchdog (initial WDOG_STCTRLH = 0x01d3)
Info : WDOG_STCTRLH = 0x01d2
Programming Started
Info : Strange unsecure mode 0xde requested in the programmed file, set FSEC = 0xfe in the startup code!
Info : FOPT requested in the programmed file differs from current setting, set 'kinetis fopt 0xf9'.
Info : Trying to re-prorgam FCF.
Info : Flash re-programming may fail on this device!
Error: Flash write error at 0x00000400
Programming Finished
Verify Started
Error: timed out while waiting for target halted
Error: error executing cortex_m crc algorithm
Error: JTAG-DP STICKY ERROR
Error: Failed to read memory at 0x00000404
embedded:startup.tcl:521: Error: Verify Failed
in procedure 'program'
in procedure 'program_error' called at file "embedded:startup.tcl", line 582
at file "embedded:startup.tcl", line 521</transport>

noel@DESKTOP-0AFLL5T MSYS /w/arduino1-1812/portable/sketchbook/BlinkBlue1/build

Tomorrow I will do some more reading ref the Kinetis FCF block.

Thanks for all the help it is most appreciated.

Noel.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Paul Fertser - 2020-07-02
  
  Hi Noel,
  
  On Thu, Jul 02, 2020 at 12:59:09PM -0000, Noel Diviney wrote:
  
  Info : Strange unsecure mode 0xde requested in the programmed file, set FSEC = 0xfe in the startup code!
  Info : FOPT requested in the programmed file differs from current setting, set 'kinetis fopt 0xf9'.
  Info : Trying to re-prorgam FCF.
  Info : Flash re-programming may fail on this device!
  Error: Flash write error at 0x00000400
  
  So now you get the essential debug info, just as planned, nice. I
  guess it's clear now what exactly is wrong.
  
  Tomas, there's a typo in "re-prorgam".
  
  --
  Be free, use free (http://www.gnu.org/philosophy/free-sw.html) software!
  mailto:fercerpav@gmail.com
  
  If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Noel Diviney - 2020-07-02

Hi all,

I am going to have a rest now as it is after 11PM and I started at 8AM today.
I shall attack this with renewed gusto in the morning.

Thanks and regards.
Noel.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Noel Diviney - 2020-07-03

Hi All.

I have had a successfull day.
Did a lot of reading and found the flashconfig code
attribute ((section(".flashconfig"), used))
const uint8_t flashconfigbytes[16] = {
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, FSEC, FOPT, 0xFF, 0xFF
};
I set FSEC to 0xFE and FOPT to oxFF and rebuilt the BlinkBlue2 to verify all was in order.
I then built BlinkBlue1 (start addr 0x000) and programmed tje flash with the following results :-

noel@DESKTOP-0AFLL5T MSYS /w/arduino1-1812/portable/sketchbook/BlinkBlue1/build
$ openocd -f interface/ftdi/olimex-arm-usb-ocd.cfg -f target/kx.cfg -c "program BlinkBlue1.ino.bin erase verify 0x0000"
Open On-Chip Debugger 0.10.0+dev-01293-g7c88e76a7-dirty (2020-07-02-20:47)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
Info : add flash_bank kinetis kx.pflash
Info : clock speed 1000 kHz
Info : JTAG tap: kx.cpu tap/device found: 0x4ba00477 (mfg: 0x23b (ARM Ltd.), part: 0xba00, ver: 0x4)
Info : kx.cpu: hardware has 6 breakpoints, 4 watchpoints
Info : MDM: Chip is unsecured. Continuing.
Info : starting gdb server for kx.cpu on 3333
Info : Listening on port 3333 for gdb connections
Info : JTAG tap: kx.cpu tap/device found: 0x4ba00477 (mfg: 0x23b (ARM Ltd.), part: 0xba00, ver: 0x4)
Info : MDM: Chip is unsecured. Continuing.
target halted due to debug-request, current mode: Thread
xPSR: 0x01000000 pc: 0xfffffffe msp: 0xfffffffc
Info : Kinetis MK22FX512xxx12 detected: 2 flash blocks
Info : 1 PFlash banks: 512k total
Info : 1 FlexNVM banks: 128k total, 128k available as data flash, 4096bytes FlexRAM
Info : Disabling Kinetis watchdog (initial WDOG_STCTRLH = 0x01d3)
Info : WDOG_STCTRLH = 0x01d2
Programming Started
Programming Finished
Verify Started
Verified OK
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : kx.cpu: external reset detected</transport>

You are my heroes, your help has been tremendous.
Now back to creating a production line panel programmer using openocd.
I am using the FTDI FT2232H for the USB jtag probe.

Cheers for now.
Noel.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Tomas Vanek - 2020-07-03

BTW FOPT = 0xf9 might be set for a good reason. Check NMI pin in your board.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Noel Diviney - 2020-07-04

Hi Tom,

You are right and I will be looking into that and a whole raft of other issues on the K22FX512 Preamp Project. The Low Power operation in particular is not working at all.
I inherited this project which is based on Arduino and more specifically on a hack of Teensy.
The K22FX512 is not covered by Teensy so I have a bit of work to do. Previously a Teensy board was used as an EzPort programmer but of course this results in a lack of debug capability,
Whilst I will continue to use the Arduino Framework I will be moving to a CMake Build System to
give me debug support. All of this of course will be based on the current NXP K22F512 SDK build.

Thanks to you and the Openocd Team am now happily moving forward.

Best regards to all.

Noel.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Kinetis MK22FX512: Error writing FCF Block 0X400 - 0x40f

The Open On-Chip Debugger

Milestone

Searches

Help

#270 Kinetis MK22FX512: Error writing FCF Block 0X400 - 0x40f

Related

Discussion

Many Thanks Noel Diviney

Related

The first build is linked to start at absolute zero and is programmed with the following results:-

HTH