kinetis: Revise CPU un-securing code

Old version of the code had several problems, among them are:
 * Located in a generic ADI source file instead of some Kinetis
   specific location
 * Incorrect MCU detection code that would read generic ARM ID
   registers
 * Presence of SRST line was mandatory
 * There didn't seem to be any place where after SRST line assertion
   it would be de-asserted.
 * Reset was asserted after waiting for "Flash Controller Ready" bit
   to be set, which contradicts official programming guide AN4835
 * Mass erase algorithm implemented by that code was very strange:
   ** After mass erase was initiated instead of just polling for the
      state of "Mass Erase Acknowledged" bit the code would repeatedly
      initiate mass erase AND poll the state of the "Mass Erase
      Acknowledged"
   ** Instead of just polling for the state of "Flash Mass Erase in
      Progress"(bit 0 in Control register) to wait for the end of the
      mass erase operation the code would: write 0 to Control
      register, read out Status register ignoring the result and then
      read Control register again and see if it is zero.
 * dap_syssec_kinetis_mdmap assumed that previously selected(before
   it was called) AP was 0.

This commit moves all of the code to kinetis flash driver and
introduces three new commands:

o "kinetis mdm check_security" -- the intent of that function is to be used as
  'examine-end' hook for any Kinetis target that has that kind of
  JTAG/SWD security mechanism.

o "kinetis mdm mass_erase""  -- This function removes secure status from
  MCU be performing special version of flash mass erase.

o "kinetis mdm test_securing" -- Function that allows to test securing
  fucntionality. All it does is erase the page with flash security settings thus
  making MCU 'secured'.

New version of the code implements the algorithms specified in AN4835
"Production Flash Programming Best Practices for Kinetis K-
and L-series MCUs", specifically sections 4.1.1 and 4.2.1.
It also adds KL26 MCU to the list of devices for which this security
check is performed. Implementing that algorithm also allowed to simplify
mass command in kinetis driver, since we no longer need to write security
bytes. The result that the old version of mass erase code can now be
acheived using 'kinetis mdm mass_erase'

Tested on accidentally locked FRDM-KL26Z with KL26 Kinetis MCU.

Change-Id: Ic085195edfd963dda9d3d4d8acd1e40cc366b16b
Signed-off-by: Andrey Smrinov <andrew.smirnov@gmail.com>
Reviewed-on: http://openocd.zylin.com/2034
Tested-by: jenkins
Reviewed-by: Paul Fertser <fercerpav@gmail.com>
Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>

1 files changed, 0 insertions, 182 deletions

diff --git a/src/target/arm_adi_v5.c b/src/target/arm_adi_v5.c
index a1559007..1c80fcc2 100644
--- a/src/target/arm_adi_v5.c
+++ b/src/target/arm_adi_v5.c
@@ -616,186 +616,6 @@ int mem_ap_sel_write_buf_noincr(struct adiv5_dap *swjdp, uint8_t ap,
 	return mem_ap_write(swjdp, buffer, size, count, address, false);
 }
 
-#define MDM_REG_STAT		0x00
-#define MDM_REG_CTRL		0x04
-#define MDM_REG_ID		0xfc
-
-#define MDM_STAT_FMEACK		(1<<0)
-#define MDM_STAT_FREADY		(1<<1)
-#define MDM_STAT_SYSSEC		(1<<2)
-#define MDM_STAT_SYSRES		(1<<3)
-#define MDM_STAT_FMEEN		(1<<5)
-#define MDM_STAT_BACKDOOREN	(1<<6)
-#define MDM_STAT_LPEN		(1<<7)
-#define MDM_STAT_VLPEN		(1<<8)
-#define MDM_STAT_LLSMODEXIT	(1<<9)
-#define MDM_STAT_VLLSXMODEXIT	(1<<10)
-#define MDM_STAT_CORE_HALTED	(1<<16)
-#define MDM_STAT_CORE_SLEEPDEEP	(1<<17)
-#define MDM_STAT_CORESLEEPING	(1<<18)
-
-#define MEM_CTRL_FMEIP		(1<<0)
-#define MEM_CTRL_DBG_DIS	(1<<1)
-#define MEM_CTRL_DBG_REQ	(1<<2)
-#define MEM_CTRL_SYS_RES_REQ	(1<<3)
-#define MEM_CTRL_CORE_HOLD_RES	(1<<4)
-#define MEM_CTRL_VLLSX_DBG_REQ	(1<<5)
-#define MEM_CTRL_VLLSX_DBG_ACK	(1<<6)
-#define MEM_CTRL_VLLSX_STAT_ACK	(1<<7)
-
-#define MDM_ACCESS_TIMEOUT	3000 /* ms */
-
-/**
- *
- */
-int dap_syssec_kinetis_mdmap(struct adiv5_dap *dap)
-{
-	uint32_t val;
-	int retval;
-	int timeout = 0;
-	enum reset_types jtag_reset_config = jtag_get_reset_config();
-
-	dap_ap_select(dap, 1);
-
-	/* first check mdm-ap id register */
-	retval = dap_queue_ap_read(dap, MDM_REG_ID, &val);
-	if (retval != ERROR_OK)
-		return retval;
-	dap_run(dap);
-
-	if (val != 0x001C0000) {
-		LOG_DEBUG("id doesn't match %08" PRIX32 " != 0x001C0000", val);
-		dap_ap_select(dap, 0);
-		return ERROR_FAIL;
-	}
-
-	/* read and parse status register
-	 * it's important that the device is out of
-	 * reset here
-	 */
-	while (1) {
-		if (timeout++ > MDM_ACCESS_TIMEOUT) {
-			LOG_DEBUG("MDMAP : flash ready timeout");
-			return ERROR_FAIL;
-		}
-		retval = dap_queue_ap_read(dap, MDM_REG_STAT, &val);
-		if (retval != ERROR_OK)
-			return retval;
-		dap_run(dap);
-
-		LOG_DEBUG("MDM_REG_STAT %08" PRIX32, val);
-		if (val & MDM_STAT_FREADY)
-			break;
-		alive_sleep(1);
-	}
-
-	if ((val & MDM_STAT_SYSSEC)) {
-		LOG_DEBUG("MDMAP: system is secured, masserase needed");
-
-		if (!(val & MDM_STAT_FMEEN))
-			LOG_DEBUG("MDMAP: masserase is disabled");
-		else {
-			/* we need to assert reset */
-			if (jtag_reset_config & RESET_HAS_SRST) {
-				/* default to asserting srst */
-				adapter_assert_reset();
-			} else {
-				LOG_DEBUG("SRST not configured");
-				dap_ap_select(dap, 0);
-				return ERROR_FAIL;
-			}
-			timeout = 0;
-			while (1) {
-				if (timeout++ > MDM_ACCESS_TIMEOUT) {
-					LOG_DEBUG("MDMAP : flash ready timeout");
-					return ERROR_FAIL;
-				}
-				retval = dap_queue_ap_write(dap, MDM_REG_CTRL, MEM_CTRL_FMEIP);
-				if (retval != ERROR_OK)
-					return retval;
-				dap_run(dap);
-				/* read status register and wait for ready */
-				retval = dap_queue_ap_read(dap, MDM_REG_STAT, &val);
-				if (retval != ERROR_OK)
-					return retval;
-				dap_run(dap);
-				LOG_DEBUG("MDM_REG_STAT %08" PRIX32, val);
-
-				if ((val & 1))
-					break;
-				alive_sleep(1);
-			}
-			timeout = 0;
-			while (1) {
-				if (timeout++ > MDM_ACCESS_TIMEOUT) {
-					LOG_DEBUG("MDMAP : flash ready timeout");
-					return ERROR_FAIL;
-				}
-				retval = dap_queue_ap_write(dap, MDM_REG_CTRL, 0);
-				if (retval != ERROR_OK)
-					return retval;
-				dap_run(dap);
-				/* read status register */
-				retval = dap_queue_ap_read(dap, MDM_REG_STAT, &val);
-				if (retval != ERROR_OK)
-					return retval;
-				dap_run(dap);
-				LOG_DEBUG("MDM_REG_STAT %08" PRIX32, val);
-				/* read control register and wait for ready */
-				retval = dap_queue_ap_read(dap, MDM_REG_CTRL, &val);
-				if (retval != ERROR_OK)
-					return retval;
-				dap_run(dap);
-				LOG_DEBUG("MDM_REG_CTRL %08" PRIX32, val);
-
-				if (val == 0x00)
-					break;
-				alive_sleep(1);
-			}
-		}
-	}
-
-	dap_ap_select(dap, 0);
-
-	return ERROR_OK;
-}
-
-/** */
-struct dap_syssec_filter {
-	/** */
-	uint32_t idcode;
-	/** */
-	int (*dap_init)(struct adiv5_dap *dap);
-};
-
-/** */
-static struct dap_syssec_filter dap_syssec_filter_data[] = {
-	{ 0x4BA00477, dap_syssec_kinetis_mdmap }
-};
-
-/**
- *
- */
-int dap_syssec(struct adiv5_dap *dap)
-{
-	unsigned int i;
-	struct jtag_tap *tap;
-
-	for (i = 0; i < sizeof(dap_syssec_filter_data); i++) {
-		tap = dap->jtag_info->tap;
-
-		while (tap != NULL) {
-			if (tap->hasidcode && (dap_syssec_filter_data[i].idcode == tap->idcode)) {
-				LOG_DEBUG("DAP: mdmap_init for idcode: %08" PRIx32, tap->idcode);
-				dap_syssec_filter_data[i].dap_init(dap);
-			}
-			tap = tap->next_tap;
-		}
-	}
-
-	return ERROR_OK;
-}
-
 /*--------------------------------------------------------------------------*/
 
 
@@ -903,8 +723,6 @@ int ahbap_debugport_init(struct adiv5_dap *dap)
 	if (retval != ERROR_OK)
 		return retval;
 
-	dap_syssec(dap);
-
 	/* check that we support packed transfers */
 	uint32_t csw, cfg;