1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2008 by Spencer Oliver *
6 * spen@spen-soft.co.uk *
8 * Copyright (C) 2011 by Andreas Fritiofson *
9 * andreas.fritiofson@gmail.com *
11 * This program is free software; you can redistribute it and/or modify *
12 * it under the terms of the GNU General Public License as published by *
13 * the Free Software Foundation; either version 2 of the License, or *
14 * (at your option) any later version. *
16 * This program is distributed in the hope that it will be useful, *
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
19 * GNU General Public License for more details. *
21 * You should have received a copy of the GNU General Public License *
22 * along with this program; if not, write to the *
23 * Free Software Foundation, Inc., *
24 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *
25 ***************************************************************************/
32 #include <helper/binarybuffer.h>
33 #include <target/algorithm.h>
34 #include <target/armv7m.h>
36 /* stm32x register locations */
38 #define FLASH_REG_BASE_B0 0x40022000
39 #define FLASH_REG_BASE_B1 0x40022040
41 #define STM32_FLASH_ACR 0x00
42 #define STM32_FLASH_KEYR 0x04
43 #define STM32_FLASH_OPTKEYR 0x08
44 #define STM32_FLASH_SR 0x0C
45 #define STM32_FLASH_CR 0x10
46 #define STM32_FLASH_AR 0x14
47 #define STM32_FLASH_OBR 0x1C
48 #define STM32_FLASH_WRPR 0x20
50 /* TODO: Check if code using these really should be hard coded to bank 0.
51 * There are valid cases, on dual flash devices the protection of the
52 * second bank is done on the bank0 reg's. */
53 #define STM32_FLASH_ACR_B0 0x40022000
54 #define STM32_FLASH_KEYR_B0 0x40022004
55 #define STM32_FLASH_OPTKEYR_B0 0x40022008
56 #define STM32_FLASH_SR_B0 0x4002200C
57 #define STM32_FLASH_CR_B0 0x40022010
58 #define STM32_FLASH_AR_B0 0x40022014
59 #define STM32_FLASH_OBR_B0 0x4002201C
60 #define STM32_FLASH_WRPR_B0 0x40022020
62 /* option byte location */
64 #define STM32_OB_RDP 0x1FFFF800
65 #define STM32_OB_USER 0x1FFFF802
66 #define STM32_OB_DATA0 0x1FFFF804
67 #define STM32_OB_DATA1 0x1FFFF806
68 #define STM32_OB_WRP0 0x1FFFF808
69 #define STM32_OB_WRP1 0x1FFFF80A
70 #define STM32_OB_WRP2 0x1FFFF80C
71 #define STM32_OB_WRP3 0x1FFFF80E
73 /* FLASH_CR register bits */
75 #define FLASH_PG (1 << 0)
76 #define FLASH_PER (1 << 1)
77 #define FLASH_MER (1 << 2)
78 #define FLASH_OPTPG (1 << 4)
79 #define FLASH_OPTER (1 << 5)
80 #define FLASH_STRT (1 << 6)
81 #define FLASH_LOCK (1 << 7)
82 #define FLASH_OPTWRE (1 << 9)
84 /* FLASH_SR register bits */
86 #define FLASH_BSY (1 << 0)
87 #define FLASH_PGERR (1 << 2)
88 #define FLASH_WRPRTERR (1 << 4)
89 #define FLASH_EOP (1 << 5)
91 /* STM32_FLASH_OBR bit definitions (reading) */
96 #define OPT_RDRSTSTOP 3
97 #define OPT_RDRSTSTDBY 4
98 #define OPT_BFB2 5 /* dual flash bank only */
100 /* register unlock keys */
102 #define KEY1 0x45670123
103 #define KEY2 0xCDEF89AB
107 #define FLASH_WRITE_TIMEOUT 10
108 #define FLASH_ERASE_TIMEOUT 100
110 struct stm32x_options {
112 uint16_t user_options;
114 uint16_t protection[4];
117 struct stm32x_flash_bank {
118 struct stm32x_options option_bytes;
123 /* used to access dual flash bank stm32xl */
124 uint32_t register_base;
125 uint16_t default_rdp;
126 int user_data_offset;
128 uint32_t user_bank_size;
131 static int stm32x_mass_erase(struct flash_bank *bank);
132 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id);
133 static int stm32x_write_block(struct flash_bank *bank, const uint8_t *buffer,
134 uint32_t offset, uint32_t count);
136 /* flash bank stm32x <base> <size> 0 0 <target#>
138 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
140 struct stm32x_flash_bank *stm32x_info;
143 return ERROR_COMMAND_SYNTAX_ERROR;
145 stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
147 bank->driver_priv = stm32x_info;
148 stm32x_info->probed = 0;
149 stm32x_info->has_dual_banks = false;
150 stm32x_info->register_base = FLASH_REG_BASE_B0;
151 stm32x_info->user_bank_size = bank->size;
156 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
158 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
159 return reg + stm32x_info->register_base;
162 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
164 struct target *target = bank->target;
165 return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
168 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
170 struct target *target = bank->target;
172 int retval = ERROR_OK;
174 /* wait for busy to clear */
176 retval = stm32x_get_flash_status(bank, &status);
177 if (retval != ERROR_OK)
179 LOG_DEBUG("status: 0x%" PRIx32 "", status);
180 if ((status & FLASH_BSY) == 0)
182 if (timeout-- <= 0) {
183 LOG_ERROR("timed out waiting for flash");
189 if (status & FLASH_WRPRTERR) {
190 LOG_ERROR("stm32x device protected");
194 if (status & FLASH_PGERR) {
195 LOG_ERROR("stm32x device programming failed");
199 /* Clear but report errors */
200 if (status & (FLASH_WRPRTERR | FLASH_PGERR)) {
201 /* If this operation fails, we ignore it and report the original
204 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
205 FLASH_WRPRTERR | FLASH_PGERR);
210 static int stm32x_check_operation_supported(struct flash_bank *bank)
212 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
214 /* if we have a dual flash bank device then
215 * we need to perform option byte stuff on bank0 only */
216 if (stm32x_info->register_base != FLASH_REG_BASE_B0) {
217 LOG_ERROR("Option Byte Operation's must use bank0");
218 return ERROR_FLASH_OPERATION_FAILED;
224 static int stm32x_read_options(struct flash_bank *bank)
227 struct stm32x_flash_bank *stm32x_info = NULL;
228 struct target *target = bank->target;
230 stm32x_info = bank->driver_priv;
232 /* read current option bytes */
233 int retval = target_read_u32(target, STM32_FLASH_OBR_B0, &optiondata);
234 if (retval != ERROR_OK)
237 stm32x_info->option_bytes.user_options = (optiondata >> stm32x_info->option_offset >> 2) & 0xffff;
238 stm32x_info->option_bytes.user_data = (optiondata >> stm32x_info->user_data_offset) & 0xffff;
239 stm32x_info->option_bytes.RDP = (optiondata & (1 << OPT_READOUT)) ? 0xFFFF : 0x5AA5;
241 if (optiondata & (1 << OPT_READOUT))
242 LOG_INFO("Device Security Bit Set");
244 /* each bit refers to a 4bank protection */
245 retval = target_read_u32(target, STM32_FLASH_WRPR_B0, &optiondata);
246 if (retval != ERROR_OK)
249 stm32x_info->option_bytes.protection[0] = (uint16_t)optiondata;
250 stm32x_info->option_bytes.protection[1] = (uint16_t)(optiondata >> 8);
251 stm32x_info->option_bytes.protection[2] = (uint16_t)(optiondata >> 16);
252 stm32x_info->option_bytes.protection[3] = (uint16_t)(optiondata >> 24);
257 static int stm32x_erase_options(struct flash_bank *bank)
259 struct stm32x_flash_bank *stm32x_info = NULL;
260 struct target *target = bank->target;
262 stm32x_info = bank->driver_priv;
264 /* read current options */
265 stm32x_read_options(bank);
267 /* unlock flash registers */
268 int retval = target_write_u32(target, STM32_FLASH_KEYR_B0, KEY1);
269 if (retval != ERROR_OK)
272 retval = target_write_u32(target, STM32_FLASH_KEYR_B0, KEY2);
273 if (retval != ERROR_OK)
276 /* unlock option flash registers */
277 retval = target_write_u32(target, STM32_FLASH_OPTKEYR_B0, KEY1);
278 if (retval != ERROR_OK)
280 retval = target_write_u32(target, STM32_FLASH_OPTKEYR_B0, KEY2);
281 if (retval != ERROR_OK)
284 /* erase option bytes */
285 retval = target_write_u32(target, STM32_FLASH_CR_B0, FLASH_OPTER | FLASH_OPTWRE);
286 if (retval != ERROR_OK)
288 retval = target_write_u32(target, STM32_FLASH_CR_B0, FLASH_OPTER | FLASH_STRT | FLASH_OPTWRE);
289 if (retval != ERROR_OK)
292 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
293 if (retval != ERROR_OK)
296 /* clear readout protection and complementary option bytes
297 * this will also force a device unlock if set */
298 stm32x_info->option_bytes.RDP = stm32x_info->default_rdp;
303 static int stm32x_write_options(struct flash_bank *bank)
305 struct stm32x_flash_bank *stm32x_info = NULL;
306 struct target *target = bank->target;
308 stm32x_info = bank->driver_priv;
310 /* unlock flash registers */
311 int retval = target_write_u32(target, STM32_FLASH_KEYR_B0, KEY1);
312 if (retval != ERROR_OK)
314 retval = target_write_u32(target, STM32_FLASH_KEYR_B0, KEY2);
315 if (retval != ERROR_OK)
318 /* unlock option flash registers */
319 retval = target_write_u32(target, STM32_FLASH_OPTKEYR_B0, KEY1);
320 if (retval != ERROR_OK)
322 retval = target_write_u32(target, STM32_FLASH_OPTKEYR_B0, KEY2);
323 if (retval != ERROR_OK)
326 /* program option bytes */
327 retval = target_write_u32(target, STM32_FLASH_CR_B0, FLASH_OPTPG | FLASH_OPTWRE);
328 if (retval != ERROR_OK)
331 uint8_t opt_bytes[16];
333 target_buffer_set_u16(target, opt_bytes, stm32x_info->option_bytes.RDP);
334 target_buffer_set_u16(target, opt_bytes + 2, stm32x_info->option_bytes.user_options);
335 target_buffer_set_u16(target, opt_bytes + 4, stm32x_info->option_bytes.user_data & 0xff);
336 target_buffer_set_u16(target, opt_bytes + 6, (stm32x_info->option_bytes.user_data >> 8) & 0xff);
337 target_buffer_set_u16(target, opt_bytes + 8, stm32x_info->option_bytes.protection[0]);
338 target_buffer_set_u16(target, opt_bytes + 10, stm32x_info->option_bytes.protection[1]);
339 target_buffer_set_u16(target, opt_bytes + 12, stm32x_info->option_bytes.protection[2]);
340 target_buffer_set_u16(target, opt_bytes + 14, stm32x_info->option_bytes.protection[3]);
342 uint32_t offset = STM32_OB_RDP - bank->base;
343 retval = stm32x_write_block(bank, opt_bytes, offset, sizeof(opt_bytes) / 2);
344 if (retval != ERROR_OK) {
345 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE)
346 LOG_ERROR("working area required to erase options bytes");
350 retval = target_write_u32(target, STM32_FLASH_CR_B0, FLASH_LOCK);
351 if (retval != ERROR_OK)
357 static int stm32x_protect_check(struct flash_bank *bank)
359 struct target *target = bank->target;
360 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
367 int retval = stm32x_check_operation_supported(bank);
368 if (ERROR_OK != retval)
371 /* medium density - each bit refers to a 4bank protection
372 * high density - each bit refers to a 2bank protection */
373 retval = target_read_u32(target, STM32_FLASH_WRPR_B0, &protection);
374 if (retval != ERROR_OK)
377 /* medium density - each protection bit is for 4 * 1K pages
378 * high density - each protection bit is for 2 * 2K pages */
379 num_bits = (bank->num_sectors / stm32x_info->ppage_size);
381 if (stm32x_info->ppage_size == 2) {
382 /* high density flash/connectivity line protection */
386 if (protection & (1 << 31))
389 /* bit 31 controls sector 62 - 255 protection for high density
390 * bit 31 controls sector 62 - 127 protection for connectivity line */
391 for (s = 62; s < bank->num_sectors; s++)
392 bank->sectors[s].is_protected = set;
394 if (bank->num_sectors > 61)
397 for (i = 0; i < num_bits; i++) {
400 if (protection & (1 << i))
403 for (s = 0; s < stm32x_info->ppage_size; s++)
404 bank->sectors[(i * stm32x_info->ppage_size) + s].is_protected = set;
407 /* low/medium density flash protection */
408 for (i = 0; i < num_bits; i++) {
411 if (protection & (1 << i))
414 for (s = 0; s < stm32x_info->ppage_size; s++)
415 bank->sectors[(i * stm32x_info->ppage_size) + s].is_protected = set;
422 static int stm32x_erase(struct flash_bank *bank, int first, int last)
424 struct target *target = bank->target;
427 if (bank->target->state != TARGET_HALTED) {
428 LOG_ERROR("Target not halted");
429 return ERROR_TARGET_NOT_HALTED;
432 if ((first == 0) && (last == (bank->num_sectors - 1)))
433 return stm32x_mass_erase(bank);
435 /* unlock flash registers */
436 int retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_KEYR), KEY1);
437 if (retval != ERROR_OK)
439 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_KEYR), KEY2);
440 if (retval != ERROR_OK)
443 for (i = first; i <= last; i++) {
444 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_PER);
445 if (retval != ERROR_OK)
447 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_AR),
448 bank->base + bank->sectors[i].offset);
449 if (retval != ERROR_OK)
451 retval = target_write_u32(target,
452 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_PER | FLASH_STRT);
453 if (retval != ERROR_OK)
456 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
457 if (retval != ERROR_OK)
460 bank->sectors[i].is_erased = 1;
463 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
464 if (retval != ERROR_OK)
470 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
472 struct stm32x_flash_bank *stm32x_info = NULL;
473 struct target *target = bank->target;
474 uint16_t prot_reg[4] = {0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF};
479 stm32x_info = bank->driver_priv;
481 if (target->state != TARGET_HALTED) {
482 LOG_ERROR("Target not halted");
483 return ERROR_TARGET_NOT_HALTED;
486 int retval = stm32x_check_operation_supported(bank);
487 if (ERROR_OK != retval)
490 if ((first % stm32x_info->ppage_size) != 0) {
491 LOG_WARNING("aligned start protect sector to a %d sector boundary",
492 stm32x_info->ppage_size);
493 first = first - (first % stm32x_info->ppage_size);
495 if (((last + 1) % stm32x_info->ppage_size) != 0) {
496 LOG_WARNING("aligned end protect sector to a %d sector boundary",
497 stm32x_info->ppage_size);
499 last = last - (last % stm32x_info->ppage_size);
503 /* medium density - each bit refers to a 4bank protection
504 * high density - each bit refers to a 2bank protection */
505 retval = target_read_u32(target, STM32_FLASH_WRPR_B0, &protection);
506 if (retval != ERROR_OK)
509 prot_reg[0] = (uint16_t)protection;
510 prot_reg[1] = (uint16_t)(protection >> 8);
511 prot_reg[2] = (uint16_t)(protection >> 16);
512 prot_reg[3] = (uint16_t)(protection >> 24);
514 if (stm32x_info->ppage_size == 2) {
515 /* high density flash */
517 /* bit 7 controls sector 62 - 255 protection */
520 prot_reg[3] &= ~(1 << 7);
522 prot_reg[3] |= (1 << 7);
530 for (i = first; i <= last; i++) {
531 reg = (i / stm32x_info->ppage_size) / 8;
532 bit = (i / stm32x_info->ppage_size) - (reg * 8);
535 prot_reg[reg] &= ~(1 << bit);
537 prot_reg[reg] |= (1 << bit);
540 /* medium density flash */
541 for (i = first; i <= last; i++) {
542 reg = (i / stm32x_info->ppage_size) / 8;
543 bit = (i / stm32x_info->ppage_size) - (reg * 8);
546 prot_reg[reg] &= ~(1 << bit);
548 prot_reg[reg] |= (1 << bit);
552 status = stm32x_erase_options(bank);
553 if (status != ERROR_OK)
556 stm32x_info->option_bytes.protection[0] = prot_reg[0];
557 stm32x_info->option_bytes.protection[1] = prot_reg[1];
558 stm32x_info->option_bytes.protection[2] = prot_reg[2];
559 stm32x_info->option_bytes.protection[3] = prot_reg[3];
561 return stm32x_write_options(bank);
564 static int stm32x_write_block(struct flash_bank *bank, const uint8_t *buffer,
565 uint32_t offset, uint32_t count)
567 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
568 struct target *target = bank->target;
569 uint32_t buffer_size = 16384;
570 struct working_area *write_algorithm;
571 struct working_area *source;
572 uint32_t address = bank->base + offset;
573 struct reg_param reg_params[5];
574 struct armv7m_algorithm armv7m_info;
575 int retval = ERROR_OK;
577 /* see contrib/loaders/flash/stm32f1x.S for src */
579 static const uint8_t stm32x_flash_write_code[] = {
580 /* #define STM32_FLASH_SR_OFFSET 0x0C */
582 0x16, 0x68, /* ldr r6, [r2, #0] */
583 0x00, 0x2e, /* cmp r6, #0 */
584 0x18, 0xd0, /* beq exit */
585 0x55, 0x68, /* ldr r5, [r2, #4] */
586 0xb5, 0x42, /* cmp r5, r6 */
587 0xf9, 0xd0, /* beq wait_fifo */
588 0x2e, 0x88, /* ldrh r6, [r5, #0] */
589 0x26, 0x80, /* strh r6, [r4, #0] */
590 0x02, 0x35, /* adds r5, #2 */
591 0x02, 0x34, /* adds r4, #2 */
593 0xc6, 0x68, /* ldr r6, [r0, #STM32_FLASH_SR_OFFSET] */
594 0x01, 0x27, /* movs r7, #1 */
595 0x3e, 0x42, /* tst r6, r7 */
596 0xfb, 0xd1, /* bne busy */
597 0x14, 0x27, /* movs r7, #0x14 */
598 0x3e, 0x42, /* tst r6, r7 */
599 0x08, 0xd1, /* bne error */
600 0x9d, 0x42, /* cmp r5, r3 */
601 0x01, 0xd3, /* bcc no_wrap */
602 0x15, 0x46, /* mov r5, r2 */
603 0x08, 0x35, /* adds r5, #8 */
605 0x55, 0x60, /* str r5, [r2, #4] */
606 0x01, 0x39, /* subs r1, r1, #1 */
607 0x00, 0x29, /* cmp r1, #0 */
608 0x02, 0xd0, /* beq exit */
609 0xe5, 0xe7, /* b wait_fifo */
611 0x00, 0x20, /* movs r0, #0 */
612 0x50, 0x60, /* str r0, [r2, #4] */
614 0x30, 0x46, /* mov r0, r6 */
615 0x00, 0xbe, /* bkpt #0 */
618 /* flash write code */
619 if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
620 &write_algorithm) != ERROR_OK) {
621 LOG_WARNING("no working area available, can't do block memory writes");
622 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
625 retval = target_write_buffer(target, write_algorithm->address,
626 sizeof(stm32x_flash_write_code), stm32x_flash_write_code);
627 if (retval != ERROR_OK)
631 while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
633 buffer_size &= ~3UL; /* Make sure it's 4 byte aligned */
634 if (buffer_size <= 256) {
635 /* we already allocated the writing code, but failed to get a
636 * buffer, free the algorithm */
637 target_free_working_area(target, write_algorithm);
639 LOG_WARNING("no large enough working area available, can't do block memory writes");
640 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
644 init_reg_param(®_params[0], "r0", 32, PARAM_IN_OUT); /* flash base (in), status (out) */
645 init_reg_param(®_params[1], "r1", 32, PARAM_OUT); /* count (halfword-16bit) */
646 init_reg_param(®_params[2], "r2", 32, PARAM_OUT); /* buffer start */
647 init_reg_param(®_params[3], "r3", 32, PARAM_OUT); /* buffer end */
648 init_reg_param(®_params[4], "r4", 32, PARAM_IN_OUT); /* target address */
650 buf_set_u32(reg_params[0].value, 0, 32, stm32x_info->register_base);
651 buf_set_u32(reg_params[1].value, 0, 32, count);
652 buf_set_u32(reg_params[2].value, 0, 32, source->address);
653 buf_set_u32(reg_params[3].value, 0, 32, source->address + source->size);
654 buf_set_u32(reg_params[4].value, 0, 32, address);
656 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
657 armv7m_info.core_mode = ARM_MODE_THREAD;
659 retval = target_run_flash_async_algorithm(target, buffer, count, 2,
662 source->address, source->size,
663 write_algorithm->address, 0,
666 if (retval == ERROR_FLASH_OPERATION_FAILED) {
667 LOG_ERROR("flash write failed at address 0x%"PRIx32,
668 buf_get_u32(reg_params[4].value, 0, 32));
670 if (buf_get_u32(reg_params[0].value, 0, 32) & FLASH_PGERR) {
671 LOG_ERROR("flash memory not erased before writing");
672 /* Clear but report errors */
673 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), FLASH_PGERR);
676 if (buf_get_u32(reg_params[0].value, 0, 32) & FLASH_WRPRTERR) {
677 LOG_ERROR("flash memory write protected");
678 /* Clear but report errors */
679 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), FLASH_WRPRTERR);
683 target_free_working_area(target, source);
684 target_free_working_area(target, write_algorithm);
686 destroy_reg_param(®_params[0]);
687 destroy_reg_param(®_params[1]);
688 destroy_reg_param(®_params[2]);
689 destroy_reg_param(®_params[3]);
690 destroy_reg_param(®_params[4]);
695 static int stm32x_write(struct flash_bank *bank, const uint8_t *buffer,
696 uint32_t offset, uint32_t count)
698 struct target *target = bank->target;
699 uint8_t *new_buffer = NULL;
701 if (bank->target->state != TARGET_HALTED) {
702 LOG_ERROR("Target not halted");
703 return ERROR_TARGET_NOT_HALTED;
707 LOG_ERROR("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
708 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
711 /* If there's an odd number of bytes, the data has to be padded. Duplicate
712 * the buffer and use the normal code path with a single block write since
713 * it's probably cheaper than to special case the last odd write using
714 * discrete accesses. */
716 new_buffer = malloc(count + 1);
717 if (new_buffer == NULL) {
718 LOG_ERROR("odd number of bytes to write and no memory for padding buffer");
721 LOG_INFO("odd number of bytes to write, padding with 0xff");
722 buffer = memcpy(new_buffer, buffer, count);
723 new_buffer[count++] = 0xff;
726 uint32_t words_remaining = count / 2;
729 /* unlock flash registers */
730 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_KEYR), KEY1);
731 if (retval != ERROR_OK)
733 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_KEYR), KEY2);
734 if (retval != ERROR_OK)
737 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_PG);
738 if (retval != ERROR_OK)
741 /* try using a block write */
742 retval = stm32x_write_block(bank, buffer, offset, words_remaining);
744 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
745 /* if block write failed (no sufficient working area),
746 * we use normal (slow) single halfword accesses */
747 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
749 while (words_remaining > 0) {
751 memcpy(&value, buffer, sizeof(uint16_t));
753 retval = target_write_u16(target, bank->base + offset, value);
754 if (retval != ERROR_OK)
755 goto reset_pg_and_lock;
757 retval = stm32x_wait_status_busy(bank, 5);
758 if (retval != ERROR_OK)
759 goto reset_pg_and_lock;
768 retval2 = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
769 if (retval == ERROR_OK)
779 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
781 /* This check the device CPUID core register to detect
782 * the M0 from the M3 devices. */
784 struct target *target = bank->target;
785 uint32_t cpuid, device_id_register = 0;
787 /* Get the CPUID from the ARM Core
788 * http://infocenter.arm.com/help/topic/com.arm.doc.ddi0432c/DDI0432C_cortex_m0_r0p0_trm.pdf 4.2.1 */
789 int retval = target_read_u32(target, 0xE000ED00, &cpuid);
790 if (retval != ERROR_OK)
793 if (((cpuid >> 4) & 0xFFF) == 0xC20) {
794 /* 0xC20 is M0 devices */
795 device_id_register = 0x40015800;
796 } else if (((cpuid >> 4) & 0xFFF) == 0xC23) {
797 /* 0xC23 is M3 devices */
798 device_id_register = 0xE0042000;
799 } else if (((cpuid >> 4) & 0xFFF) == 0xC24) {
800 /* 0xC24 is M4 devices */
801 device_id_register = 0xE0042000;
803 LOG_ERROR("Cannot identify target as a stm32x");
807 /* read stm32 device id register */
808 retval = target_read_u32(target, device_id_register, device_id);
809 if (retval != ERROR_OK)
815 static int stm32x_get_flash_size(struct flash_bank *bank, uint16_t *flash_size_in_kb)
817 struct target *target = bank->target;
818 uint32_t cpuid, flash_size_reg;
820 int retval = target_read_u32(target, 0xE000ED00, &cpuid);
821 if (retval != ERROR_OK)
824 if (((cpuid >> 4) & 0xFFF) == 0xC20) {
825 /* 0xC20 is M0 devices */
826 flash_size_reg = 0x1FFFF7CC;
827 } else if (((cpuid >> 4) & 0xFFF) == 0xC23) {
828 /* 0xC23 is M3 devices */
829 flash_size_reg = 0x1FFFF7E0;
830 } else if (((cpuid >> 4) & 0xFFF) == 0xC24) {
831 /* 0xC24 is M4 devices */
832 flash_size_reg = 0x1FFFF7CC;
834 LOG_ERROR("Cannot identify target as a stm32x");
838 retval = target_read_u16(target, flash_size_reg, flash_size_in_kb);
839 if (retval != ERROR_OK)
845 static int stm32x_probe(struct flash_bank *bank)
847 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
849 uint16_t flash_size_in_kb;
850 uint16_t max_flash_size_in_kb;
853 uint32_t base_address = 0x08000000;
855 stm32x_info->probed = 0;
856 stm32x_info->register_base = FLASH_REG_BASE_B0;
857 stm32x_info->user_data_offset = 10;
858 stm32x_info->option_offset = 0;
860 /* default factory protection level */
861 stm32x_info->default_rdp = 0x5AA5;
863 /* read stm32 device id register */
864 int retval = stm32x_get_device_id(bank, &device_id);
865 if (retval != ERROR_OK)
868 LOG_INFO("device id = 0x%08" PRIx32 "", device_id);
870 /* set page size, protection granularity and max flash size depending on family */
871 switch (device_id & 0xfff) {
872 case 0x410: /* medium density */
874 stm32x_info->ppage_size = 4;
875 max_flash_size_in_kb = 128;
877 case 0x412: /* low density */
879 stm32x_info->ppage_size = 4;
880 max_flash_size_in_kb = 32;
882 case 0x414: /* high density */
884 stm32x_info->ppage_size = 2;
885 max_flash_size_in_kb = 512;
887 case 0x418: /* connectivity line density */
889 stm32x_info->ppage_size = 2;
890 max_flash_size_in_kb = 256;
892 case 0x420: /* value line density */
894 stm32x_info->ppage_size = 4;
895 max_flash_size_in_kb = 128;
897 case 0x422: /* stm32f30x */
899 stm32x_info->ppage_size = 2;
900 max_flash_size_in_kb = 256;
901 stm32x_info->user_data_offset = 16;
902 stm32x_info->option_offset = 6;
903 stm32x_info->default_rdp = 0x55AA;
905 case 0x428: /* value line High density */
907 stm32x_info->ppage_size = 4;
908 max_flash_size_in_kb = 128;
910 case 0x430: /* xl line density (dual flash banks) */
912 stm32x_info->ppage_size = 2;
913 max_flash_size_in_kb = 1024;
914 stm32x_info->has_dual_banks = true;
916 case 0x432: /* stm32f37x */
918 stm32x_info->ppage_size = 2;
919 max_flash_size_in_kb = 256;
920 stm32x_info->user_data_offset = 16;
921 stm32x_info->option_offset = 6;
922 stm32x_info->default_rdp = 0x55AA;
924 case 0x440: /* stm32f05x */
925 case 0x444: /* stm32f03x */
927 stm32x_info->ppage_size = 4;
928 max_flash_size_in_kb = 64;
929 stm32x_info->user_data_offset = 16;
930 stm32x_info->option_offset = 6;
931 stm32x_info->default_rdp = 0x55AA;
933 case 0x448: /* stm32f07x */
935 stm32x_info->ppage_size = 4;
936 max_flash_size_in_kb = 128;
937 stm32x_info->user_data_offset = 16;
938 stm32x_info->option_offset = 6;
939 stm32x_info->default_rdp = 0x55AA;
942 LOG_WARNING("Cannot identify target as a STM32 family.");
946 /* get flash size from target. */
947 retval = stm32x_get_flash_size(bank, &flash_size_in_kb);
949 /* failed reading flash size or flash size invalid (early silicon),
950 * default to max target family */
951 if (retval != ERROR_OK || flash_size_in_kb == 0xffff || flash_size_in_kb == 0) {
952 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming %dk flash",
953 max_flash_size_in_kb);
954 flash_size_in_kb = max_flash_size_in_kb;
957 if (stm32x_info->has_dual_banks) {
958 /* split reported size into matching bank */
959 if (bank->base != 0x08080000) {
960 /* bank 0 will be fixed 512k */
961 flash_size_in_kb = 512;
963 flash_size_in_kb -= 512;
964 /* bank1 also uses a register offset */
965 stm32x_info->register_base = FLASH_REG_BASE_B1;
966 base_address = 0x08080000;
970 /* if the user sets the size manually then ignore the probed value
971 * this allows us to work around devices that have a invalid flash size register value */
972 if (stm32x_info->user_bank_size) {
973 LOG_INFO("ignoring flash probed value, using configured bank size");
974 flash_size_in_kb = stm32x_info->user_bank_size / 1024;
977 LOG_INFO("flash size = %dkbytes", flash_size_in_kb);
979 /* did we assign flash size? */
980 assert(flash_size_in_kb != 0xffff);
982 /* calculate numbers of pages */
983 int num_pages = flash_size_in_kb * 1024 / page_size;
985 /* check that calculation result makes sense */
986 assert(num_pages > 0);
990 bank->sectors = NULL;
993 bank->base = base_address;
994 bank->size = (num_pages * page_size);
995 bank->num_sectors = num_pages;
996 bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
998 for (i = 0; i < num_pages; i++) {
999 bank->sectors[i].offset = i * page_size;
1000 bank->sectors[i].size = page_size;
1001 bank->sectors[i].is_erased = -1;
1002 bank->sectors[i].is_protected = 1;
1005 stm32x_info->probed = 1;
1010 static int stm32x_auto_probe(struct flash_bank *bank)
1012 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
1013 if (stm32x_info->probed)
1015 return stm32x_probe(bank);
1019 COMMAND_HANDLER(stm32x_handle_part_id_command)
1025 static int get_stm32x_info(struct flash_bank *bank, char *buf, int buf_size)
1027 uint32_t dbgmcu_idcode;
1029 /* read stm32 device id register */
1030 int retval = stm32x_get_device_id(bank, &dbgmcu_idcode);
1031 if (retval != ERROR_OK)
1034 uint16_t device_id = dbgmcu_idcode & 0xfff;
1035 uint16_t rev_id = dbgmcu_idcode >> 16;
1036 const char *device_str;
1037 const char *rev_str = NULL;
1039 switch (device_id) {
1041 device_str = "STM32F10x (Medium Density)";
1063 device_str = "STM32F10x (Low Density)";
1073 device_str = "STM32F10x (High Density)";
1091 device_str = "STM32F10x (Connectivity)";
1105 device_str = "STM32F100 (Low/Medium Density)";
1119 device_str = "STM32F30x";
1141 device_str = "STM32F100 (High Density)";
1155 device_str = "STM32F10x (XL Density)";
1165 device_str = "STM32F37x";
1179 device_str = "STM32F03x";
1193 device_str = "STM32F05x";
1207 device_str = "STM32F07x";
1221 snprintf(buf, buf_size, "Cannot identify target as a STM32F0/1/3\n");
1225 if (rev_str != NULL)
1226 snprintf(buf, buf_size, "%s - Rev: %s", device_str, rev_str);
1228 snprintf(buf, buf_size, "%s - Rev: unknown (0x%04x)", device_str, rev_id);
1233 COMMAND_HANDLER(stm32x_handle_lock_command)
1235 struct target *target = NULL;
1236 struct stm32x_flash_bank *stm32x_info = NULL;
1239 return ERROR_COMMAND_SYNTAX_ERROR;
1241 struct flash_bank *bank;
1242 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1243 if (ERROR_OK != retval)
1246 stm32x_info = bank->driver_priv;
1248 target = bank->target;
1250 if (target->state != TARGET_HALTED) {
1251 LOG_ERROR("Target not halted");
1252 return ERROR_TARGET_NOT_HALTED;
1255 retval = stm32x_check_operation_supported(bank);
1256 if (ERROR_OK != retval)
1259 if (stm32x_erase_options(bank) != ERROR_OK) {
1260 command_print(CMD_CTX, "stm32x failed to erase options");
1264 /* set readout protection */
1265 stm32x_info->option_bytes.RDP = 0;
1267 if (stm32x_write_options(bank) != ERROR_OK) {
1268 command_print(CMD_CTX, "stm32x failed to lock device");
1272 command_print(CMD_CTX, "stm32x locked");
1277 COMMAND_HANDLER(stm32x_handle_unlock_command)
1279 struct target *target = NULL;
1282 return ERROR_COMMAND_SYNTAX_ERROR;
1284 struct flash_bank *bank;
1285 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1286 if (ERROR_OK != retval)
1289 target = bank->target;
1291 if (target->state != TARGET_HALTED) {
1292 LOG_ERROR("Target not halted");
1293 return ERROR_TARGET_NOT_HALTED;
1296 retval = stm32x_check_operation_supported(bank);
1297 if (ERROR_OK != retval)
1300 if (stm32x_erase_options(bank) != ERROR_OK) {
1301 command_print(CMD_CTX, "stm32x failed to unlock device");
1305 if (stm32x_write_options(bank) != ERROR_OK) {
1306 command_print(CMD_CTX, "stm32x failed to lock device");
1310 command_print(CMD_CTX, "stm32x unlocked.\n"
1311 "INFO: a reset or power cycle is required "
1312 "for the new settings to take effect.");
1317 COMMAND_HANDLER(stm32x_handle_options_read_command)
1319 uint32_t optionbyte;
1320 struct target *target = NULL;
1321 struct stm32x_flash_bank *stm32x_info = NULL;
1324 return ERROR_COMMAND_SYNTAX_ERROR;
1326 struct flash_bank *bank;
1327 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1328 if (ERROR_OK != retval)
1331 stm32x_info = bank->driver_priv;
1333 target = bank->target;
1335 if (target->state != TARGET_HALTED) {
1336 LOG_ERROR("Target not halted");
1337 return ERROR_TARGET_NOT_HALTED;
1340 retval = stm32x_check_operation_supported(bank);
1341 if (ERROR_OK != retval)
1344 retval = target_read_u32(target, STM32_FLASH_OBR_B0, &optionbyte);
1345 if (retval != ERROR_OK)
1347 command_print(CMD_CTX, "Option Byte: 0x%" PRIx32 "", optionbyte);
1349 int user_data = optionbyte;
1351 if (optionbyte >> OPT_ERROR & 1)
1352 command_print(CMD_CTX, "Option Byte Complement Error");
1354 if (optionbyte >> OPT_READOUT & 1)
1355 command_print(CMD_CTX, "Readout Protection On");
1357 command_print(CMD_CTX, "Readout Protection Off");
1359 /* user option bytes are offset depending on variant */
1360 optionbyte >>= stm32x_info->option_offset;
1362 if (optionbyte >> OPT_RDWDGSW & 1)
1363 command_print(CMD_CTX, "Software Watchdog");
1365 command_print(CMD_CTX, "Hardware Watchdog");
1367 if (optionbyte >> OPT_RDRSTSTOP & 1)
1368 command_print(CMD_CTX, "Stop: No reset generated");
1370 command_print(CMD_CTX, "Stop: Reset generated");
1372 if (optionbyte >> OPT_RDRSTSTDBY & 1)
1373 command_print(CMD_CTX, "Standby: No reset generated");
1375 command_print(CMD_CTX, "Standby: Reset generated");
1377 if (stm32x_info->has_dual_banks) {
1378 if (optionbyte >> OPT_BFB2 & 1)
1379 command_print(CMD_CTX, "Boot: Bank 0");
1381 command_print(CMD_CTX, "Boot: Bank 1");
1384 command_print(CMD_CTX, "User Option0: 0x%02" PRIx8,
1385 (uint8_t)((user_data >> stm32x_info->user_data_offset) & 0xff));
1386 command_print(CMD_CTX, "User Option1: 0x%02" PRIx8,
1387 (uint8_t)((user_data >> (stm32x_info->user_data_offset + 8)) & 0xff));
1392 COMMAND_HANDLER(stm32x_handle_options_write_command)
1394 struct target *target = NULL;
1395 struct stm32x_flash_bank *stm32x_info = NULL;
1396 uint16_t optionbyte;
1399 return ERROR_COMMAND_SYNTAX_ERROR;
1401 struct flash_bank *bank;
1402 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1403 if (ERROR_OK != retval)
1406 stm32x_info = bank->driver_priv;
1408 target = bank->target;
1410 if (target->state != TARGET_HALTED) {
1411 LOG_ERROR("Target not halted");
1412 return ERROR_TARGET_NOT_HALTED;
1415 retval = stm32x_check_operation_supported(bank);
1416 if (ERROR_OK != retval)
1419 retval = stm32x_read_options(bank);
1420 if (ERROR_OK != retval)
1423 /* start with current options */
1424 optionbyte = stm32x_info->option_bytes.user_options;
1426 /* skip over flash bank */
1431 if (strcmp("SWWDG", CMD_ARGV[0]) == 0)
1432 optionbyte |= (1 << 0);
1433 else if (strcmp("HWWDG", CMD_ARGV[0]) == 0)
1434 optionbyte &= ~(1 << 0);
1435 else if (strcmp("NORSTSTOP", CMD_ARGV[0]) == 0)
1436 optionbyte |= (1 << 1);
1437 else if (strcmp("RSTSTOP", CMD_ARGV[0]) == 0)
1438 optionbyte &= ~(1 << 1);
1439 else if (strcmp("NORSTSTNDBY", CMD_ARGV[0]) == 0)
1440 optionbyte |= (1 << 2);
1441 else if (strcmp("RSTSTNDBY", CMD_ARGV[0]) == 0)
1442 optionbyte &= ~(1 << 2);
1443 else if (stm32x_info->has_dual_banks) {
1444 if (strcmp("BOOT0", CMD_ARGV[0]) == 0)
1445 optionbyte |= (1 << 3);
1446 else if (strcmp("BOOT1", CMD_ARGV[0]) == 0)
1447 optionbyte &= ~(1 << 3);
1449 return ERROR_COMMAND_SYNTAX_ERROR;
1451 return ERROR_COMMAND_SYNTAX_ERROR;
1456 if (stm32x_erase_options(bank) != ERROR_OK) {
1457 command_print(CMD_CTX, "stm32x failed to erase options");
1461 stm32x_info->option_bytes.user_options = optionbyte;
1463 if (stm32x_write_options(bank) != ERROR_OK) {
1464 command_print(CMD_CTX, "stm32x failed to write options");
1468 command_print(CMD_CTX, "stm32x write options complete.\n"
1469 "INFO: a reset or power cycle is required "
1470 "for the new settings to take effect.");
1475 static int stm32x_mass_erase(struct flash_bank *bank)
1477 struct target *target = bank->target;
1479 if (target->state != TARGET_HALTED) {
1480 LOG_ERROR("Target not halted");
1481 return ERROR_TARGET_NOT_HALTED;
1484 /* unlock option flash registers */
1485 int retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_KEYR), KEY1);
1486 if (retval != ERROR_OK)
1488 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_KEYR), KEY2);
1489 if (retval != ERROR_OK)
1492 /* mass erase flash memory */
1493 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER);
1494 if (retval != ERROR_OK)
1496 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
1497 FLASH_MER | FLASH_STRT);
1498 if (retval != ERROR_OK)
1501 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
1502 if (retval != ERROR_OK)
1505 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
1506 if (retval != ERROR_OK)
1512 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
1517 return ERROR_COMMAND_SYNTAX_ERROR;
1519 struct flash_bank *bank;
1520 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1521 if (ERROR_OK != retval)
1524 retval = stm32x_mass_erase(bank);
1525 if (retval == ERROR_OK) {
1526 /* set all sectors as erased */
1527 for (i = 0; i < bank->num_sectors; i++)
1528 bank->sectors[i].is_erased = 1;
1530 command_print(CMD_CTX, "stm32x mass erase complete");
1532 command_print(CMD_CTX, "stm32x mass erase failed");
1537 static const struct command_registration stm32x_exec_command_handlers[] = {
1540 .handler = stm32x_handle_lock_command,
1541 .mode = COMMAND_EXEC,
1543 .help = "Lock entire flash device.",
1547 .handler = stm32x_handle_unlock_command,
1548 .mode = COMMAND_EXEC,
1550 .help = "Unlock entire protected flash device.",
1553 .name = "mass_erase",
1554 .handler = stm32x_handle_mass_erase_command,
1555 .mode = COMMAND_EXEC,
1557 .help = "Erase entire flash device.",
1560 .name = "options_read",
1561 .handler = stm32x_handle_options_read_command,
1562 .mode = COMMAND_EXEC,
1564 .help = "Read and display device option byte.",
1567 .name = "options_write",
1568 .handler = stm32x_handle_options_write_command,
1569 .mode = COMMAND_EXEC,
1570 .usage = "bank_id ('SWWDG'|'HWWDG') "
1571 "('RSTSTNDBY'|'NORSTSTNDBY') "
1572 "('RSTSTOP'|'NORSTSTOP')",
1573 .help = "Replace bits in device option byte.",
1575 COMMAND_REGISTRATION_DONE
1578 static const struct command_registration stm32x_command_handlers[] = {
1581 .mode = COMMAND_ANY,
1582 .help = "stm32f1x flash command group",
1584 .chain = stm32x_exec_command_handlers,
1586 COMMAND_REGISTRATION_DONE
1589 struct flash_driver stm32f1x_flash = {
1591 .commands = stm32x_command_handlers,
1592 .flash_bank_command = stm32x_flash_bank_command,
1593 .erase = stm32x_erase,
1594 .protect = stm32x_protect,
1595 .write = stm32x_write,
1596 .read = default_flash_read,
1597 .probe = stm32x_probe,
1598 .auto_probe = stm32x_auto_probe,
1599 .erase_check = default_flash_blank_check,
1600 .protect_check = stm32x_protect_check,
1601 .info = get_stm32x_info,