6767 *
6868 * Renesas Flash MCUs have an internal 16 byte read only register that stores
6969 * the part number, the code is stored ascii encoded, starting from the lowest memory address
70- * except for pnrs stored in 'FIXED_PNR1', where the code is stored in reverse order (but the last 3 bytes are still 0x20 aka ' ')
70+ * except for pnrs stored in 'FIXED_PNR1/3/4 ', where the code is stored in reverse order (but the last 3 bytes are still 0x20 aka ' ')
7171 */
7272
7373/* family + series + group no */
@@ -176,21 +176,29 @@ typedef enum {
176176 */
177177
178178/* PNR/UID location by series
179- * newer series have a 'Flash Root Table'
180- * older series have a fixed location in the flash memory
181- *
182- * TODO: UPDATE
179+ * Some series have a 'Flash Root Table'
180+ * Other series have a fixed location in the flash memory
183181 *
182+ * ra0l1 - Fixed location 3
183+ * ra0e1 - Fixed location 3
184+ * ra0e2 - Fixed location 3
184185 * ra2l1 - Fixed location 1
186+ * ra2l2 - Fixed location 4 (?!)
185187 * ra2e1 - Fixed location 1
186188 * ra2e2 - Fixed location 1
187- * ra2a1 - Flash Root Table *undocumented
188- * ra4m1 - Flash Root Table *undocumented
189+ * ra2e3 - Fixed location 1
190+ * ra2a1 - Flash Root Table
191+ * ra2a2 - Fixed location 1
192+ * ra2t1 - Fixed location 1
193+ * ra4m1 - Flash Root Table
189194 * ra4m2 - Fixed location 2 *undocumented
190195 * ra4m3 - Fixed location 2 *undocumented
191196 * ra4e1 - Fixed location 2
192197 * ra4e2 - Fixed location 2
193198 * ra4w1 - Flash Root Table *undocumented
199+ * ra4c1 - Fixed location 2
200+ * ra4t1 - Fixed location 2
201+ * ra4l1 - Fixed location 2
194202 * ra6m1 - Flash Root Table
195203 * ra6m2 - Flash Root Table
196204 * ra6m3 - Flash Root Table
@@ -200,6 +208,16 @@ typedef enum {
200208 * ra6e2 - Fixed location 2
201209 * ra6t1 - Flash Root Table
202210 * ra6t2 - Fixed location 2
211+ * ra6t3 - Fixed location 2
212+ * ra8m1 - Fixed location 5 (!!)
213+ * ra8m2 - Fixed location 6 (!!)
214+ * ra8e1 - Fixed location 5
215+ * ra8e2 - Fixed location 5
216+ * ra8t1 - Fixed location 5
217+ * ra8t2 - Fixed location 6
218+ * ra8d1 - Fixed location 5
219+ * ra8d2 - Fixed location 6
220+ * ra8p1 - Fixed location 6
203221 */
204222#define RENESAS_FIXED1_UID UINT32_C(0x01001c00) /* Unique ID Register */
205223#define RENESAS_FIXED1_PNR UINT32_C(0x01001c10) /* Part Numbering Register */
@@ -209,6 +227,33 @@ typedef enum {
209227#define RENESAS_FIXED2_PNR UINT32_C(0x010080f0) /* Part Numbering Register */
210228#define RENESAS_FIXED2_MCUVER UINT32_C(0x010081b0) /* MCU Version Register */
211229
230+ // R01UH1143EJ0110, Flash Register Descriptions, §29.3.24-26, pg 685
231+ #define RENESAS_FIXED3_UID UINT32_C(0x01011070) /* Unique ID Register */
232+ #define RENESAS_FIXED3_PNR UINT32_C(0x01011080) /* Part Numbering Register */
233+ #define RENESAS_FIXED3_MCUVER UINT32_C(0x01011090) /* MCU Version Register */
234+
235+ // R01UH1080EJ0110, Flash Register Descriptions, §38.3.27-29, pg 1226
236+ #define RENESAS_FIXED4_UID UINT32_C(0x01011110) /* Unique ID Register */
237+ #define RENESAS_FIXED4_PNR UINT32_C(0x01011120) /* Part Numbering Register */
238+ #define RENESAS_FIXED4_MCUVER UINT32_C(0x01011130) /* MCU Version Register */
239+
240+ // R01UH0994EJ0120, Flash Register Descriptions, §52.4.5-6, pg 2416
241+ // This one comes in secure/non-secure flavours, since there is TrustZone in play.
242+ // It seems to be Fixed2 at a different offset.
243+ #define RENESAS_FIXED5_UID UINT32_C(0x13008190) /* Unique ID Register */
244+ #define RENESAS_FIXED5_PNR UINT32_C(0x130080f0) /* Part Numbering Register */
245+ #define RENESAS_FIXED5_MCUVER UINT32_C(0x130081b0) /* MCU Version Register */
246+ #define RENESAS_FIXED5_SECURE_UID UINT32_C(0x03008190) /* Unique ID Register */
247+ #define RENESAS_FIXED5_SECURE_PNR UINT32_C(0x030080f0) /* Part Numbering Register */
248+ #define RENESAS_FIXED5_SECURE_MCUVER UINT32_C(0x030081b0) /* MCU Version Register */
249+
250+ // R01UH1066EJ0120, Flash Register Descriptions, §59.5.41-43, pg 3537
251+ // Despite the RA8M2 supporting and using TrustZone, these only have one
252+ // address...
253+ #define RENESAS_FIXED6_UID UINT32_C(0x02f07b00) /* Unique ID Register */
254+ #define RENESAS_FIXED6_PNR UINT32_C(0x02c1ec38) /* Part Numbering Register */
255+ #define RENESAS_FIXED6_MCUVER UINT32_C(0x02c1ec48) /* MCU Version Register */
256+
212257/* The FMIFRT is a read-only register that stores the Flash Root Table address */
213258#define RENESAS_FMIFRT UINT32_C(0x407fb19c)
214259#define RENESAS_FMIFRT_UID (frt ) ((frt) + 0x14U) /* UID Register offset from Flash Root Table */
@@ -240,9 +285,15 @@ typedef enum {
240285 * MF3/4 Flash Memory Specifications
241286 * Block Size: Code area: 2 KB (except RA2A1 is 1KB), Data area: 1 KB
242287 * Program/Erase unit Program: Code area: 64 bits, Data area: 8 bits
243- * Erase: 1 block
244- * RA2E1: Program: Code area: 32 bits, Data area: 8 bits
245- * Ref: R01UH0852EJ0170, Flash Memory Overview, §35.1, pg 915
288+ * Erase: 1 block
289+ * RA0xx: Block size: Code area: 2 KB, Data area: 256B
290+ * Program: Code area: 32 bits, Data area: 8 bits
291+ * Erase: 1 block
292+ * Ref: R01UH1143EJ0110, Flash Memory Overview, §29.1, pg 669
293+ * RA2xx*: Program: Code area: 32 bits, Data area: 8 bits
294+ * Ref: R01UH0852EJ0170, Flash Memory Overview, §35.1, pg 915
295+ *
296+ * *Other than RA2A1, evidently. It is listed as 64-bit CF programming units
246297 */
247298#define MF3_CF_BLOCK_SIZE 0x800U
248299#define MF3_RA2A1_CF_BLOCK_SIZE 0x400U // Contradicted by RA2A1 Ref Manual
@@ -352,7 +403,10 @@ typedef enum {
352403 * RV40F Flash Memory Specifications
353404 * Block Size: Code area: 8 KB/32KB Data area: 64 Bytes
354405 * Program/Erase unit Program: Code area: 128 Bytes, Data area: 4/8/16 Bytes
355- * Erase: 1 block
406+ * Erase: 1 block
407+ * RA4[CL]1: Block Size: Code area: 2 KB, Data area: 256 Bytes
408+ * Program: Code area: 8 Bytes, Data area: 1 Byte
409+ * Ref: R01UH1137EJ0110, Flash Memory Overview, §39.1, pg 1404
356410 */
357411#define RV40_CF_REGION0_SIZE 0x10000U
358412#define RV40_CF_REGION0_BLOCK_SIZE 0x2000U
@@ -411,6 +465,21 @@ typedef enum {
411465#define RV40_FCPSR (RV40_BASE + 0xe0U)
412466#define RV40_FCPSR_ESUSPMD 1U
413467
468+ /* Renesas MRAM */
469+ /*
470+ * Some newer chips eschew the traditional RV40 or MF3/4 flash solutions for a
471+ * MRAM based solution (and include an OSPI flash in the device package). The
472+ * MRAM interface appears to be loosely structured on the RV40 flash architecture,
473+ * from a brief glance through the block diagrams
474+ *
475+ * Program buffer: 1/2/4/8 Bytes
476+ * Code MRAM: 32 Bytes
477+ *
478+ * Chips containing: RA8M2, RA8T2, RA8D2, RA8P1
479+ */
480+
481+ //TODO: Implement MRAM
482+
414483static bool renesas_uid (target_s * t , int argc , const char * * argv );
415484
416485const command_s renesas_cmd_list [] = {
@@ -506,18 +575,30 @@ static void renesas_add_flash(target_s *const target, const target_addr_t addr,
506575 renesas_priv_s * priv = (renesas_priv_s * )target -> target_storage ;
507576
508577 /*
509- * Renesas RA MCUs can have one of two kinds of flash memory, MF3/4 and RV40
510- * Flash type by series: (TODO: Update)
578+ * Renesas RA MCUs can have one of two kinds of flash memory, MF3/4 and
579+ * RV40, or MRAM code memory and an external OSPI flash.
580+ *
581+ * Flash type by series:
582+ * ra0l1 - MF3/4
583+ * ra0e1 - MF3/4
584+ * ra0e2 - MF3/4
511585 * ra2l1 - MF4
586+ * ra2l2 - MF3/4
512587 * ra2e1 - MF4
513588 * ra2e2 - MF4
589+ * ra2e3 - MF3/4
514590 * ra2a1 - MF3
591+ * ra2a2 - MF3/4
592+ * ra2t1 - MF3/4
515593 * ra4m1 - MF3
516594 * ra4m2 - RV40
517595 * ra4m3 - RV40
518596 * ra4e1 - RV40
519597 * ra4e2 - RV40
520598 * ra4w1 - MF3
599+ * ra4c1 - RV40
600+ * ra4t1 - RV40
601+ * ra4l1 - RV40
521602 * ra6m1 - RV40
522603 * ra6m2 - RV40
523604 * ra6m3 - RV40
@@ -527,13 +608,33 @@ static void renesas_add_flash(target_s *const target, const target_addr_t addr,
527608 * ra6e2 - RV40
528609 * ra6t1 - RV40
529610 * ra6t2 - RV40
611+ * ra6t3 - RV40
612+ * ra8m1 - RV40
613+ * ra8m2 - MRAM + OSPI Flash
614+ * ra8e1 - RV40
615+ * ra8e2 - RV40
616+ * ra8t1 - RV40
617+ * ra8t2 - MRAM + OSPI Flash
618+ * ra8d1 - RV40
619+ * ra8d2 - MRAM + OSPI Flash
620+ * ra8p1 - MRAM + OSPI Flash
621+ *
622+ * This needs to be adjusted as the RA8 parts tend to be dual-bank flash or
623+ * other fancier memory configurations
530624 */
531625
532626 switch (priv -> series ) {
627+ case PNR_SERIES_RA0L1 :
628+ case PNR_SERIES_RA0E1 :
629+ case PNR_SERIES_RA0E2 :
533630 case PNR_SERIES_RA2L1 :
631+ case PNR_SERIES_RA2L2 :
534632 case PNR_SERIES_RA2E1 :
535633 case PNR_SERIES_RA2E2 :
634+ case PNR_SERIES_RA2E3 :
536635 case PNR_SERIES_RA2A1 :
636+ case PNR_SERIES_RA2A2 :
637+ case PNR_SERIES_RA2T1 :
537638 case PNR_SERIES_RA4M1 :
538639 case PNR_SERIES_RA4W1 :
539640 /*
@@ -550,6 +651,9 @@ static void renesas_add_flash(target_s *const target, const target_addr_t addr,
550651 case PNR_SERIES_RA4M3 :
551652 case PNR_SERIES_RA4E1 :
552653 case PNR_SERIES_RA4E2 :
654+ case PNR_SERIES_RA4T1 :
655+ case PNR_SERIES_RA4L1 :
656+ case PNR_SERIES_RA4C1 :
553657 case PNR_SERIES_RA6M1 :
554658 case PNR_SERIES_RA6M2 :
555659 case PNR_SERIES_RA6M3 :
@@ -559,10 +663,24 @@ static void renesas_add_flash(target_s *const target, const target_addr_t addr,
559663 case PNR_SERIES_RA6E2 :
560664 case PNR_SERIES_RA6T1 :
561665 case PNR_SERIES_RA6T2 :
666+ case PNR_SERIES_RA6T3 :
667+ case PNR_SERIES_RA8M1 :
668+ case PNR_SERIES_RA8E1 :
669+ case PNR_SERIES_RA8E2 :
670+ case PNR_SERIES_RA8T1 :
671+ case PNR_SERIES_RA8D1 :
672+ /* TODO: Support the parts with dual-bank flash properly */
562673 target -> enter_flash_mode = renesas_enter_flash_mode ;
563674 renesas_add_rv40_flash (target , addr , length );
564675 return ;
565676
677+ case PNR_SERIES_RA8M2 :
678+ case PNR_SERIES_RA8T2 :
679+ case PNR_SERIES_RA8D2 :
680+ case PNR_SERIES_RA8P1 :
681+ /* FIXME: MRAM/OSPI flashing not implemented currently */
682+ return ;
683+
566684 default :
567685 return ;
568686 }
@@ -628,6 +746,8 @@ bool renesas_ra_probe(target_s *const target)
628746 *
629747 * try the fixed address RENESAS_FIXED2_PNR first, as it should lead to less illegal/erroneous
630748 * memory accesses in case of failure, and is the most common case
749+ *
750+ * TODO: Update with the new known locations
631751 */
632752
633753 if (renesas_pnr_read (target , RENESAS_FIXED2_PNR , pnr )) {
0 commit comments