I've been using various microcontrollers and microprocessors for many, many years now but I seem to be stymied by the Kinetis KE series (specifically the S9KEAZN64AMLC).
Jan 17, 2015 TL;DR:
Freescale confirms that v2.0.0 of their Kinetis Design Studio software does not work with this device (including their own TRK-KEA64 eval board). They recommend using CodeWarrior MCU V10.6 for the time being.
Segger has released v4.96a (the "a" is important, I was using v4.96) which corrects the issue and allows you to use a Segger J-Link Lite CortexM debugger board with KDS and have full program/debug capability.
Before Segger released v4.96a I managed to be able to flash the chip by reprogramming the OpenSDA debugger on Freescale's inexpensive ($15) FRDM-KL25Z eval board by reflashing the OpenSDA firmware it comes with with USBDM (using v4.10.6.240). I then used USBDM's standalone "ARM Programmer" software. I did not spend much time trying to get debugging working, as I am proficient enough at "oldschool" debugging to not need it. Please make sure that you flash a "benign" program into the on-board target KL25 or it may interfere with programming since the on-board target KL25's reset line is still connected to the OpenSDA debugger even with J11 cut (see Keith Wakeham's blog post, linked below).
A big thank you to Erich Styger for very very graciously helping me determine the issue and confirm my findings over email.
Now back to our regularly scheduled question:
I've built a stupid-simple 3.3V breakout board. It's got some LEDs on PTA, a UART connection on PTC and the SWD lines are on their dedicated lines. There's literally nothing fancy or funny about this board.
I'm using a J-Link Lite for Cortex-M (J-Link LITE CortexM-9, see https://www.segger.com/jlink-lite-cortexm.html) and under both OSX and Windows I get the same result: the J-Link Commander utility can identify the chip, I can read and write to SRAM and play around with the peripherals with manual reads and writes to the correct memory-mapped I/O address. When I try to flash the device, though, it fails.
$ JLinkExe
SEGGER J-Link Commander V4.94c ('?' for help)
Compiled Oct 31 2014 20:08:55
DLL version V4.94c, compiled Oct 31 2014 20:08:48
Firmware: J-Link Lite-Cortex-M V8 compiled Jul 17 2014 11:40:12
Hardware: V8.00
S/N: 518107921
Feature(s): GDB
VTarget = 3.332V
Info: Could not measure total IR len. TDO is constant high.
Info: Could not measure total IR len. TDO is constant high.
No devices found on JTAG chain. Trying to find device on SWD.
Info: Found SWD-DP with ID 0x0BC11477
Info: Found Cortex-M0 r0p0, Little endian.
Info: FPUnit: 2 code (BP) slots and 0 literal slots
Cortex-M0 identified.
Target interface speed: 100 kHz
J-Link>device skeazn64xxx2
Info: Device "SKEAZN64XXX2" selected (64 KB flash, 4 KB RAM).
Reconnecting to target...
Info: Found SWD-DP with ID 0x0BC11477
Info: Found SWD-DP with ID 0x0BC11477
Info: Found Cortex-M0 r0p0, Little endian.
Info: FPUnit: 2 code (BP) slots and 0 literal slots
J-Link>r
Reset delay: 0 ms
Reset type NORMAL: Resets core & peripherals via SYSRESETREQ & VECTRESET bit.
J-Link>erase
Erasing device (SKEAZN64xxx2)...
(...several second pause while it communicates with the MCU...)
****** Error: PC of target system has unexpected value after erasing sector. (PC = 0xFFFFFFFE)!
---------------------------------------------------------------------- Registers -------------------------------------------------------------------------------------
PC = FFFFFFFE
Current: R0 = 00F3E3BE, R1 = 00000001, R2 = 4004801C, R3 = 00000001
R4 = 00000000, R5 = 00000000, R6 = 000000F4, R7 = 1FFFFD61
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Info: J-Link: Flash download: Total time needed: 2.174s (Prepare: 0.894s, Compare: 0.000s, Erase: 0.736s, Program: 0.000s, Verify: 0.000s, Restore: 0.542s)
ERROR: Erase returned with error code -5.
The J-Link Lite is perfectly fine (I can read and write to the nRF58122 SoC, another Cortex-M0 processor, with it) and the device seems to otherwise work. I know the Kinetis is unlocked as they're factory fresh stock from DigiKey, but even then the "kinetis unlock" command in JLinkExe times out without any error or useful information.
At this point in time I'm sure I'm doing something stupid, but I'm at a loss for what it could be.
Has anyone worked with these devices before? How are you programming them?
edit to add walkthrough:
Some more information:
I read that the NMI# pin is enabled out of reset (and verified this by reading SIM_SOPT) but also that it has an internal pull-up when enabled. On this particular part PTB4 is on pin 10 which is a no-connect in my design. Disabling the NMI pin makes no difference. RST# is similar; It's connected to a pushbutton that grounds the pin and also goes to the J-Link Lite but there is no external pullup. This shouldn't matter because like NMI#, the RST# pin has an internal pullup that is enabled when PTA5 is configured to be a reset.
Looking at clocking now... Out of reset, ICS is the clock source to the FLL and BDIV in ICS_C2 is set to 001 (the reset default). If I understand correctly, this means that the 32kHz internal oscillator is multiplied by 1024 by the FLL and then divided by 2, making ICSOUTCLK 32kHz * 1024 / 2 or 16.8MHz. I can verify through the J-Link CLI that the FLL is locked by reading ICS_S:
J-Link>mem8 40064004 1
40064004 = 50
(LOCK and IREFST are set, this is correct.)
I then move on to verify that the SIM has the clock enabled for the flash controller by reading SIM_SCGC. I can also quickly check to make sure that BUSDIV in SIM_BUSDIV is set to zero which means that the BUSCLK is the same frequency as ICSOUTCLK (i.e. it's not being divided down):
J-Link>mem32 4004800c 1
4004800C = 00003000
J-Link>mem32 40048018 1
40048018 = 00000000
So far, everything looks fine. BUSCLK is 16.8MHz and the flash controller clock isn't gated.
Now let's move on to the flash controller. Out of reset FCLKDIV is zero, and we need a 1MHz clock. Table 18-2 in KEA64RM shows that FDIV should be set to 0x10.
Out of reset:
J-Link>mem8 40020000 1
40020000 = 00
Setting up the divider and verifying things are good:
J-Link>w1 40020000 10
Writing 10 -> 40020000
J-Link>mem8 40020000 1
40020000 = 90
FDIVLD is set and the correct value in FDIV is shown.
Before going too far ahead, let's make sure that the flash isn't protected:
J-Link>mem8 40020001 1
40020001 = FE
KEYEN = 11 (disabled) and SEC=10 (unsecured). Ok. Let's try to verify the device is blank:
J-Link>mem8 40020006 1
40020006 = 80
J-Link>w1 40020002 0
Writing 00 -> 40020002
J-Link>w1 4002000a 1
Writing 01 -> 4002000A
J-Link>mem8 40020006
J-Link>w1 40020006 80
Writing 80 -> 40020006
J-Link>mem8 40020006 1
40020006 = 83
Here we see that the MGSTAT bits in FSTAT indicate that blank check has failed and also that non-correctable errors were found. Odd. Let's try erasing it ourselves:
J-Link>w1 40020002 0
Writing 00 -> 40020002
J-Link>w1 4002000a 8
Writing 08 -> 4002000A
J-Link>w1 40020006 80
Writing 80 -> 40020006
J-Link>mem8 40020006 1
40020006 = 80
The erase all command succeeded. Now let's try a blank check:
J-Link>w1 40020002 0
Writing 00 -> 40020002
J-Link>w1 4002000a 1
Writing 01 -> 4002000A
J-Link>w1 40020006 80
Writing 80 -> 40020006
J-Link>mem8 40020006 1
40020006 = 80
Now the blank check is fine?
At this point I'm about ready to give up, eat the loss on these prototypes and go with a processor from ST where I've never had these kinds of issues before. The Kinetis documentation is thorough enough but it is very dense and I'm finding it very difficult to get started. I can wiggle I/O through memory reads and access other peripherals but I can't for the life of me figure out what's wrong with the flash controller. I've been working with micros for over 20 years and this kind of difficulty is something I have never encountered before.
20150102 edit:
So still no go here. I have actually bought a FRDM-KL25Z eval board ($15 from DigiKey) and modified it by putting the generic CMSIS-DAP software on the OpenSDA debugger and cutting J11 as per Keith Wakeham's blog. I've got the on-board target (the KL25Z) running a simple program so it doesn't interfere with the reset line and I can see my SKEAZN64 with OpenOCD and play with it, but unfortunately it can't program it either. The Kinetis Design Studio (KDS) software won't flash my Kinetis because it says it's protected and I need to do a mass erase, but OpenOCD (as part of KDS) doesn't seem to know how to do this. The git master version of OpenOCD I built on my Mac understands Kinetis, but not the specific KEA series, so I'm back to square one.
Going back to the J-Link...
@AdamHaun had a really good clue, and if I set the J-Link reset type (rsettype command) to type '6' (Kinetis) J-Link is supposed to disable the watchdog after resetting the core. Looking at the WDOG_CS1 register (0x40052000) it does appear that that is the case, but still no dice. An erase operation seems to go off the rails with PC at 0xfffffffe and error code -5, and an "unlock kinetis" command only works if I disable the reset pin using SIM_SOPT (by writing the 32-bit value 0x00000008 to 0x40048004). Unfortunately if I do that the CPU cannot ever be halted again, presumably because the SWD interface can't use the reset line to force the SWD DAP into a known state.
20150103 edit:
I HAVE BLINKING LED
REPEAT
I HAVE BLINKING LED
TL;DR version: put the USBDM image on the FRDM-KL25Z board (a story all on its own), use the ARM Programmer standalone app to send the test .elf over to the board. Power cycle and voilà.
Long version will come later. I now have less than 48h to write and debug software for this KEAZN64 board, finish modifying/testing other software that goes with it, and work on some documentation for another client. I promise I will update this question with a detailed answer. I just wanted to share my success. Thank you EVERYONE for your assistance. I might have to speak with the mods because I would really like to give the bounty to a couple of you in particular.