1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2008 by Spencer Oliver *
6 * spen@spen-soft.co.uk *
8 * Copyright (C) 2011 Øyvind Harboe *
9 * oyvind.harboe@zylin.com *
11 * This program is free software; you can redistribute it and/or modify *
12 * it under the terms of the GNU General Public License as published by *
13 * the Free Software Foundation; either version 2 of the License, or *
14 * (at your option) any later version. *
16 * This program is distributed in the hope that it will be useful, *
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
19 * GNU General Public License for more details. *
21 * You should have received a copy of the GNU General Public License *
22 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
23 ***************************************************************************/
30 #include <helper/binarybuffer.h>
31 #include <target/algorithm.h>
32 #include <target/armv7m.h>
34 /* Regarding performance:
36 * Short story - it might be best to leave the performance at
39 * You may see a jump in speed if you change to using
40 * 32bit words for the block programming.
42 * Its a shame you cannot use the double word as its
43 * even faster - but you require external VPP for that mode.
45 * Having said all that 16bit writes give us the widest vdd
46 * operating range, so may be worth adding a note to that effect.
50 /* Danger!!!! The STM32F1x and STM32F2x series actually have
51 * quite different flash controllers.
53 * What's more scary is that the names of the registers and their
54 * addresses are the same, but the actual bits and what they do are
55 * can be very different.
57 * To reduce testing complexity and dangers of regressions,
58 * a seperate file is used for stm32fx2x.
60 * Sector sizes in kiBytes:
61 * 1 MiByte part with 4 x 16, 1 x 64, 7 x 128.
62 * 2 MiByte part with 4 x 16, 1 x 64, 7 x 128, 4 x 16, 1 x 64, 7 x 128.
63 * 1 MiByte STM32F42x/43x part with DB1M Option set:
64 * 4 x 16, 1 x 64, 3 x 128, 4 x 16, 1 x 64, 3 x 128.
67 * 1 MiByte part with 4 x 32, 1 x 128, 3 x 256.
70 * 1 MiByte part in single bank mode with 4 x 32, 1 x 128, 3 x 256.
71 * 1 MiByte part in dual-bank mode two banks with 4 x 16, 1 x 64, 3 x 128 each.
72 * 2 MiByte part in single-bank mode with 4 x 32, 1 x 128, 7 x 256.
73 * 2 MiByte part in dual-bank mode two banks with 4 x 16, 1 x 64, 7 x 128 each.
75 * Protection size is sector size.
77 * Tested with STM3220F-EVAL board.
79 * STM32F4xx series for reference.
82 * http://www.st.com/web/en/resource/technical/document/reference_manual/DM00031020.pdf
85 * www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/
86 * PROGRAMMING_MANUAL/CD00233952.pdf
88 * STM32F7xx series for reference.
91 * http://www.st.com/web/en/resource/technical/document/reference_manual/DM00124865.pdf
94 * http://www.st.com/resource/en/reference_manual/dm00224583.pdf
96 * STM32F1x series - notice that this code was copy, pasted and knocked
97 * into a stm32f2x driver, so in case something has been converted or
98 * bugs haven't been fixed, here are the original manuals:
100 * RM0008 - Reference manual
102 * RM0042, the Flash programming manual for low-, medium- high-density and
103 * connectivity line STM32F10x devices
105 * PM0068, the Flash programming manual for XL-density STM32F10x devices.
109 /* Erase time can be as high as 1000ms, 10x this and it's toast... */
110 #define FLASH_ERASE_TIMEOUT 10000
111 #define FLASH_WRITE_TIMEOUT 5
113 #define STM32_FLASH_BASE 0x40023c00
114 #define STM32_FLASH_ACR 0x40023c00
115 #define STM32_FLASH_KEYR 0x40023c04
116 #define STM32_FLASH_OPTKEYR 0x40023c08
117 #define STM32_FLASH_SR 0x40023c0C
118 #define STM32_FLASH_CR 0x40023c10
119 #define STM32_FLASH_OPTCR 0x40023c14
120 #define STM32_FLASH_OPTCR1 0x40023c18
122 /* FLASH_CR register bits */
123 #define FLASH_PG (1 << 0)
124 #define FLASH_SER (1 << 1)
125 #define FLASH_MER (1 << 2) /* MER/MER1 for f76x/77x */
126 #define FLASH_MER1 (1 << 15) /* MER2 for f76x/77x, confusing ... */
127 #define FLASH_STRT (1 << 16)
128 #define FLASH_PSIZE_8 (0 << 8)
129 #define FLASH_PSIZE_16 (1 << 8)
130 #define FLASH_PSIZE_32 (2 << 8)
131 #define FLASH_PSIZE_64 (3 << 8)
132 /* The sector number encoding is not straight binary for dual bank flash.
133 * Warning: evaluates the argument multiple times */
134 #define FLASH_SNB(a) ((((a) >= 12) ? 0x10 | ((a) - 12) : (a)) << 3)
135 #define FLASH_LOCK (1 << 31)
137 /* FLASH_SR register bits */
138 #define FLASH_BSY (1 << 16)
139 #define FLASH_PGSERR (1 << 7) /* Programming sequence error */
140 #define FLASH_PGPERR (1 << 6) /* Programming parallelism error */
141 #define FLASH_PGAERR (1 << 5) /* Programming alignment error */
142 #define FLASH_WRPERR (1 << 4) /* Write protection error */
143 #define FLASH_OPERR (1 << 1) /* Operation error */
145 #define FLASH_ERROR (FLASH_PGSERR | FLASH_PGPERR | FLASH_PGAERR | FLASH_WRPERR | FLASH_OPERR)
147 /* STM32_FLASH_OPTCR register bits */
148 #define OPTCR_LOCK (1 << 0)
149 #define OPTCR_START (1 << 1)
150 #define OPTCR_NDBANK (1 << 29) /* not dual bank mode */
151 #define OPTCR_DB1M (1 << 30) /* 1 MiB devices dual flash bank option */
153 /* register unlock keys */
154 #define KEY1 0x45670123
155 #define KEY2 0xCDEF89AB
157 /* option register unlock key */
158 #define OPTKEY1 0x08192A3B
159 #define OPTKEY2 0x4C5D6E7F
161 struct stm32x_options {
163 uint16_t user_options; /* bit 0-7 usual options, bit 8-11 extra options */
168 struct stm32x_flash_bank {
169 struct stm32x_options option_bytes;
171 bool has_large_mem; /* F42x/43x/469/479/7xx in dual bank mode */
172 bool has_boot_addr; /* F7xx */
173 bool has_extra_options; /* F42x/43x/469/479/7xx */
174 uint32_t user_bank_size;
177 /* flash bank stm32x <base> <size> 0 0 <target#>
179 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
181 struct stm32x_flash_bank *stm32x_info;
184 return ERROR_COMMAND_SYNTAX_ERROR;
186 stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
187 bank->driver_priv = stm32x_info;
189 stm32x_info->probed = 0;
190 stm32x_info->user_bank_size = bank->size;
195 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
200 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
202 struct target *target = bank->target;
203 return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
206 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
208 struct target *target = bank->target;
210 int retval = ERROR_OK;
212 /* wait for busy to clear */
214 retval = stm32x_get_flash_status(bank, &status);
215 if (retval != ERROR_OK)
217 LOG_DEBUG("status: 0x%" PRIx32 "", status);
218 if ((status & FLASH_BSY) == 0)
220 if (timeout-- <= 0) {
221 LOG_ERROR("timed out waiting for flash");
228 if (status & FLASH_WRPERR) {
229 LOG_ERROR("stm32x device protected");
233 /* Clear but report errors */
234 if (status & FLASH_ERROR) {
235 /* If this operation fails, we ignore it and report the original
238 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
239 status & FLASH_ERROR);
244 static int stm32x_unlock_reg(struct target *target)
248 /* first check if not already unlocked
249 * otherwise writing on STM32_FLASH_KEYR will fail
251 int retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
252 if (retval != ERROR_OK)
255 if ((ctrl & FLASH_LOCK) == 0)
258 /* unlock flash registers */
259 retval = target_write_u32(target, STM32_FLASH_KEYR, KEY1);
260 if (retval != ERROR_OK)
263 retval = target_write_u32(target, STM32_FLASH_KEYR, KEY2);
264 if (retval != ERROR_OK)
267 retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
268 if (retval != ERROR_OK)
271 if (ctrl & FLASH_LOCK) {
272 LOG_ERROR("flash not unlocked STM32_FLASH_CR: %" PRIx32, ctrl);
273 return ERROR_TARGET_FAILURE;
279 static int stm32x_unlock_option_reg(struct target *target)
283 int retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
284 if (retval != ERROR_OK)
287 if ((ctrl & OPTCR_LOCK) == 0)
290 /* unlock option registers */
291 retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY1);
292 if (retval != ERROR_OK)
295 retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY2);
296 if (retval != ERROR_OK)
299 retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
300 if (retval != ERROR_OK)
303 if (ctrl & OPTCR_LOCK) {
304 LOG_ERROR("options not unlocked STM32_FLASH_OPTCR: %" PRIx32, ctrl);
305 return ERROR_TARGET_FAILURE;
311 static int stm32x_read_options(struct flash_bank *bank)
314 struct stm32x_flash_bank *stm32x_info = NULL;
315 struct target *target = bank->target;
317 stm32x_info = bank->driver_priv;
319 /* read current option bytes */
320 int retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
321 if (retval != ERROR_OK)
324 /* caution: F2 implements 5 bits (WDG_SW only)
325 * whereas F7 6 bits (IWDG_SW and WWDG_SW) in user_options */
326 stm32x_info->option_bytes.user_options = optiondata & 0xfc;
327 stm32x_info->option_bytes.RDP = (optiondata >> 8) & 0xff;
328 stm32x_info->option_bytes.protection = (optiondata >> 16) & 0xfff;
330 if (stm32x_info->has_extra_options) {
331 /* F42x/43x/469/479 and 7xx have up to 4 bits of extra options */
332 stm32x_info->option_bytes.user_options |= (optiondata >> 20) & 0xf00;
335 if (stm32x_info->has_large_mem || stm32x_info->has_boot_addr) {
336 retval = target_read_u32(target, STM32_FLASH_OPTCR1, &optiondata);
337 if (retval != ERROR_OK)
340 /* FLASH_OPTCR1 has quite diffent meanings ... */
341 if (stm32x_info->has_boot_addr) {
342 /* for F7xx it contains boot0 and boot1 */
343 stm32x_info->option_bytes.boot_addr = optiondata;
345 /* for F42x/43x/469/479 it contains 12 additional protection bits */
346 stm32x_info->option_bytes.protection |= (optiondata >> 4) & 0x00fff000;
350 if (stm32x_info->option_bytes.RDP != 0xAA)
351 LOG_INFO("Device Security Bit Set");
356 static int stm32x_write_options(struct flash_bank *bank)
358 struct stm32x_flash_bank *stm32x_info = NULL;
359 struct target *target = bank->target;
360 uint32_t optiondata, optiondata2;
362 stm32x_info = bank->driver_priv;
364 int retval = stm32x_unlock_option_reg(target);
365 if (retval != ERROR_OK)
368 /* rebuild option data */
369 optiondata = stm32x_info->option_bytes.user_options & 0xfc;
370 optiondata |= stm32x_info->option_bytes.RDP << 8;
371 optiondata |= (stm32x_info->option_bytes.protection & 0x0fff) << 16;
373 if (stm32x_info->has_extra_options) {
374 /* F42x/43x/469/479 and 7xx have up to 4 bits of extra options */
375 optiondata |= (stm32x_info->option_bytes.user_options & 0xf00) << 20;
378 if (stm32x_info->has_large_mem || stm32x_info->has_boot_addr) {
379 if (stm32x_info->has_boot_addr) {
380 /* F7xx uses FLASH_OPTCR1 for boot0 and boot1 ... */
381 optiondata2 = stm32x_info->option_bytes.boot_addr;
383 /* F42x/43x/469/479 uses FLASH_OPTCR1 for additional protection bits */
384 optiondata2 = (stm32x_info->option_bytes.protection & 0x00fff000) << 4;
387 retval = target_write_u32(target, STM32_FLASH_OPTCR1, optiondata2);
388 if (retval != ERROR_OK)
392 /* program options */
393 retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata);
394 if (retval != ERROR_OK)
397 /* start programming cycle */
398 retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPTCR_START);
399 if (retval != ERROR_OK)
402 /* wait for completion */
403 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
404 if (retval != ERROR_OK)
407 /* relock registers */
408 retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPTCR_LOCK);
409 if (retval != ERROR_OK)
415 static int stm32x_protect_check(struct flash_bank *bank)
417 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
419 /* read write protection settings */
420 int retval = stm32x_read_options(bank);
421 if (retval != ERROR_OK) {
422 LOG_DEBUG("unable to read option bytes");
426 if (stm32x_info->has_boot_addr && stm32x_info->has_large_mem) {
427 /* F76x/77x: bit k protects sectors 2*k and 2*k+1 */
428 for (int i = 0; i < (bank->num_sectors >> 1); i++) {
429 if (stm32x_info->option_bytes.protection & (1 << i)) {
430 bank->sectors[i << 1].is_protected = 0;
431 bank->sectors[(i << 1) + 1].is_protected = 0;
433 bank->sectors[i << 1].is_protected = 1;
434 bank->sectors[(i << 1) + 1].is_protected = 1;
438 /* one protection bit per sector */
439 for (int i = 0; i < bank->num_sectors; i++) {
440 if (stm32x_info->option_bytes.protection & (1 << i))
441 bank->sectors[i].is_protected = 0;
443 bank->sectors[i].is_protected = 1;
450 static int stm32x_erase(struct flash_bank *bank, int first, int last)
452 struct target *target = bank->target;
455 assert((0 <= first) && (first <= last) && (last < bank->num_sectors));
457 if (bank->target->state != TARGET_HALTED) {
458 LOG_ERROR("Target not halted");
459 return ERROR_TARGET_NOT_HALTED;
463 retval = stm32x_unlock_reg(target);
464 if (retval != ERROR_OK)
469 To erase a sector, follow the procedure below:
470 1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
472 2. Set the SER bit and select the sector
473 you wish to erase (SNB) in the FLASH_CR register
474 3. Set the STRT bit in the FLASH_CR register
475 4. Wait for the BSY bit to be cleared
478 for (i = first; i <= last; i++) {
479 retval = target_write_u32(target,
480 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_SER | FLASH_SNB(i) | FLASH_STRT);
481 if (retval != ERROR_OK)
484 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
485 if (retval != ERROR_OK)
488 bank->sectors[i].is_erased = 1;
491 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
492 if (retval != ERROR_OK)
498 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
500 struct target *target = bank->target;
501 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
503 if (target->state != TARGET_HALTED) {
504 LOG_ERROR("Target not halted");
505 return ERROR_TARGET_NOT_HALTED;
508 /* read protection settings */
509 int retval = stm32x_read_options(bank);
510 if (retval != ERROR_OK) {
511 LOG_DEBUG("unable to read option bytes");
515 if (stm32x_info->has_boot_addr && stm32x_info->has_large_mem) {
516 /* F76x/77x: bit k protects sectors 2*k and 2*k+1 */
517 if ((first & 1) != 0 || (last & 1) != 1) {
518 LOG_ERROR("sector protection must be double sector aligned");
526 for (int i = first; i <= last; i++) {
528 stm32x_info->option_bytes.protection &= ~(1 << i);
530 stm32x_info->option_bytes.protection |= (1 << i);
533 retval = stm32x_write_options(bank);
534 if (retval != ERROR_OK)
540 static int stm32x_write_block(struct flash_bank *bank, const uint8_t *buffer,
541 uint32_t offset, uint32_t count)
543 struct target *target = bank->target;
544 uint32_t buffer_size = 16384;
545 struct working_area *write_algorithm;
546 struct working_area *source;
547 uint32_t address = bank->base + offset;
548 struct reg_param reg_params[5];
549 struct armv7m_algorithm armv7m_info;
550 int retval = ERROR_OK;
552 /* see contrib/loaders/flash/stm32f2x.S for src */
554 static const uint8_t stm32x_flash_write_code[] = {
556 0xD0, 0xF8, 0x00, 0x80, /* ldr r8, [r0, #0] */
557 0xB8, 0xF1, 0x00, 0x0F, /* cmp r8, #0 */
558 0x1A, 0xD0, /* beq exit */
559 0x47, 0x68, /* ldr r7, [r0, #4] */
560 0x47, 0x45, /* cmp r7, r8 */
561 0xF7, 0xD0, /* beq wait_fifo */
563 0xDF, 0xF8, 0x34, 0x60, /* ldr r6, STM32_PROG16 */
564 0x26, 0x61, /* str r6, [r4, #STM32_FLASH_CR_OFFSET] */
565 0x37, 0xF8, 0x02, 0x6B, /* ldrh r6, [r7], #0x02 */
566 0x22, 0xF8, 0x02, 0x6B, /* strh r6, [r2], #0x02 */
567 0xBF, 0xF3, 0x4F, 0x8F, /* dsb sy */
569 0xE6, 0x68, /* ldr r6, [r4, #STM32_FLASH_SR_OFFSET] */
570 0x16, 0xF4, 0x80, 0x3F, /* tst r6, #0x10000 */
571 0xFB, 0xD1, /* bne busy */
572 0x16, 0xF0, 0xF0, 0x0F, /* tst r6, #0xf0 */
573 0x07, 0xD1, /* bne error */
575 0x8F, 0x42, /* cmp r7, r1 */
576 0x28, 0xBF, /* it cs */
577 0x00, 0xF1, 0x08, 0x07, /* addcs r7, r0, #8 */
578 0x47, 0x60, /* str r7, [r0, #4] */
579 0x01, 0x3B, /* subs r3, r3, #1 */
580 0x13, 0xB1, /* cbz r3, exit */
581 0xDF, 0xE7, /* b wait_fifo */
583 0x00, 0x21, /* movs r1, #0 */
584 0x41, 0x60, /* str r1, [r0, #4] */
586 0x30, 0x46, /* mov r0, r6 */
587 0x00, 0xBE, /* bkpt #0x00 */
589 /* <STM32_PROG16>: */
590 0x01, 0x01, 0x00, 0x00, /* .word 0x00000101 */
593 if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
594 &write_algorithm) != ERROR_OK) {
595 LOG_WARNING("no working area available, can't do block memory writes");
596 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
599 retval = target_write_buffer(target, write_algorithm->address,
600 sizeof(stm32x_flash_write_code),
601 stm32x_flash_write_code);
602 if (retval != ERROR_OK)
606 while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
608 if (buffer_size <= 256) {
609 /* we already allocated the writing code, but failed to get a
610 * buffer, free the algorithm */
611 target_free_working_area(target, write_algorithm);
613 LOG_WARNING("no large enough working area available, can't do block memory writes");
614 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
618 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
619 armv7m_info.core_mode = ARM_MODE_THREAD;
621 init_reg_param(®_params[0], "r0", 32, PARAM_IN_OUT); /* buffer start, status (out) */
622 init_reg_param(®_params[1], "r1", 32, PARAM_OUT); /* buffer end */
623 init_reg_param(®_params[2], "r2", 32, PARAM_OUT); /* target address */
624 init_reg_param(®_params[3], "r3", 32, PARAM_OUT); /* count (halfword-16bit) */
625 init_reg_param(®_params[4], "r4", 32, PARAM_OUT); /* flash base */
627 buf_set_u32(reg_params[0].value, 0, 32, source->address);
628 buf_set_u32(reg_params[1].value, 0, 32, source->address + source->size);
629 buf_set_u32(reg_params[2].value, 0, 32, address);
630 buf_set_u32(reg_params[3].value, 0, 32, count);
631 buf_set_u32(reg_params[4].value, 0, 32, STM32_FLASH_BASE);
633 retval = target_run_flash_async_algorithm(target, buffer, count, 2,
636 source->address, source->size,
637 write_algorithm->address, 0,
640 if (retval == ERROR_FLASH_OPERATION_FAILED) {
641 LOG_ERROR("error executing stm32x flash write algorithm");
643 uint32_t error = buf_get_u32(reg_params[0].value, 0, 32) & FLASH_ERROR;
645 if (error & FLASH_WRPERR)
646 LOG_ERROR("flash memory write protected");
649 LOG_ERROR("flash write failed = %08" PRIx32, error);
650 /* Clear but report errors */
651 target_write_u32(target, STM32_FLASH_SR, error);
656 target_free_working_area(target, source);
657 target_free_working_area(target, write_algorithm);
659 destroy_reg_param(®_params[0]);
660 destroy_reg_param(®_params[1]);
661 destroy_reg_param(®_params[2]);
662 destroy_reg_param(®_params[3]);
663 destroy_reg_param(®_params[4]);
668 static int stm32x_write(struct flash_bank *bank, const uint8_t *buffer,
669 uint32_t offset, uint32_t count)
671 struct target *target = bank->target;
672 uint32_t words_remaining = (count / 2);
673 uint32_t bytes_remaining = (count & 0x00000001);
674 uint32_t address = bank->base + offset;
675 uint32_t bytes_written = 0;
678 if (bank->target->state != TARGET_HALTED) {
679 LOG_ERROR("Target not halted");
680 return ERROR_TARGET_NOT_HALTED;
684 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
685 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
688 retval = stm32x_unlock_reg(target);
689 if (retval != ERROR_OK)
692 /* multiple half words (2-byte) to be programmed? */
693 if (words_remaining > 0) {
694 /* try using a block write */
695 retval = stm32x_write_block(bank, buffer, offset, words_remaining);
696 if (retval != ERROR_OK) {
697 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
698 /* if block write failed (no sufficient working area),
699 * we use normal (slow) single dword accesses */
700 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
703 buffer += words_remaining * 2;
704 address += words_remaining * 2;
709 if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
714 The Flash memory programming sequence is as follows:
715 1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
717 2. Set the PG bit in the FLASH_CR register
718 3. Perform the data write operation(s) to the desired memory address (inside main
719 memory block or OTP area):
720 – – Half-word access in case of x16 parallelism
721 – Word access in case of x32 parallelism
724 Byte access in case of x8 parallelism
725 Double word access in case of x64 parallelism
726 Wait for the BSY bit to be cleared
728 while (words_remaining > 0) {
730 memcpy(&value, buffer + bytes_written, sizeof(uint16_t));
732 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
733 FLASH_PG | FLASH_PSIZE_16);
734 if (retval != ERROR_OK)
737 retval = target_write_u16(target, address, value);
738 if (retval != ERROR_OK)
741 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
742 if (retval != ERROR_OK)
750 if (bytes_remaining) {
751 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
752 FLASH_PG | FLASH_PSIZE_8);
753 if (retval != ERROR_OK)
755 retval = target_write_u8(target, address, buffer[bytes_written]);
756 if (retval != ERROR_OK)
759 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
760 if (retval != ERROR_OK)
764 return target_write_u32(target, STM32_FLASH_CR, FLASH_LOCK);
767 static int setup_sector(struct flash_bank *bank, int start, int num, int size)
770 for (int i = start; i < (start + num) ; i++) {
771 assert(i < bank->num_sectors);
772 bank->sectors[i].offset = bank->size;
773 bank->sectors[i].size = size;
774 bank->size += bank->sectors[i].size;
775 LOG_DEBUG("sector %d: %dkBytes", i, size >> 10);
781 static void setup_bank(struct flash_bank *bank, int start,
782 uint16_t flash_size_in_kb, uint16_t max_sector_size_in_kb)
786 start = setup_sector(bank, start, 4, (max_sector_size_in_kb / 8) * 1024);
787 start = setup_sector(bank, start, 1, (max_sector_size_in_kb / 2) * 1024);
789 /* remaining sectors all of size max_sector_size_in_kb */
790 remain = (flash_size_in_kb / max_sector_size_in_kb) - 1;
791 start = setup_sector(bank, start, remain, max_sector_size_in_kb * 1024);
794 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
796 /* this checks for a stm32f4x errata issue where a
797 * stm32f2x DBGMCU_IDCODE is incorrectly returned.
798 * If the issue is detected target is forced to stm32f4x Rev A.
799 * Only effects Rev A silicon */
801 struct target *target = bank->target;
804 /* read stm32 device id register */
805 int retval = target_read_u32(target, 0xE0042000, device_id);
806 if (retval != ERROR_OK)
809 if ((*device_id & 0xfff) == 0x411) {
810 /* read CPUID reg to check core type */
811 retval = target_read_u32(target, 0xE000ED00, &cpuid);
812 if (retval != ERROR_OK)
815 /* check for cortex_m4 */
816 if (((cpuid >> 4) & 0xFFF) == 0xC24) {
817 *device_id &= ~((0xFFFF << 16) | 0xfff);
818 *device_id |= (0x1000 << 16) | 0x413;
819 LOG_INFO("stm32f4x errata detected - fixing incorrect MCU_IDCODE");
825 static int stm32x_probe(struct flash_bank *bank)
827 struct target *target = bank->target;
828 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
830 uint16_t flash_size_in_kb;
831 uint32_t flash_size_reg = 0x1FFF7A22;
832 uint16_t max_sector_size_in_kb = 128;
833 uint16_t max_flash_size_in_kb;
835 uint32_t base_address = 0x08000000;
837 stm32x_info->probed = 0;
838 stm32x_info->has_large_mem = false;
839 stm32x_info->has_boot_addr = false;
840 stm32x_info->has_extra_options = false;
842 /* read stm32 device id register */
843 int retval = stm32x_get_device_id(bank, &device_id);
844 if (retval != ERROR_OK)
846 LOG_INFO("device id = 0x%08" PRIx32 "", device_id);
848 /* set max flash size depending on family, id taken from AN2606 */
849 switch (device_id & 0xfff) {
850 case 0x411: /* F20x/21x */
851 case 0x413: /* F40x/41x */
852 max_flash_size_in_kb = 1024;
855 case 0x419: /* F42x/43x */
856 case 0x434: /* F469/479 */
857 stm32x_info->has_extra_options = true;
858 max_flash_size_in_kb = 2048;
861 case 0x423: /* F401xB/C */
862 max_flash_size_in_kb = 256;
865 case 0x421: /* F446 */
866 case 0x431: /* F411 */
867 case 0x433: /* F401xD/E */
868 case 0x441: /* F412 */
869 max_flash_size_in_kb = 512;
872 case 0x458: /* F410 */
873 max_flash_size_in_kb = 128;
876 case 0x449: /* F74x/75x */
877 max_flash_size_in_kb = 1024;
878 max_sector_size_in_kb = 256;
879 flash_size_reg = 0x1FF0F442;
880 stm32x_info->has_extra_options = true;
881 stm32x_info->has_boot_addr = true;
884 case 0x451: /* F76x/77x */
885 max_flash_size_in_kb = 2048;
886 max_sector_size_in_kb = 256;
887 flash_size_reg = 0x1FF0F442;
888 stm32x_info->has_extra_options = true;
889 stm32x_info->has_boot_addr = true;
893 LOG_WARNING("Cannot identify target as a STM32 family.");
897 /* get flash size from target. */
898 retval = target_read_u16(target, flash_size_reg, &flash_size_in_kb);
900 /* failed reading flash size or flash size invalid (early silicon),
901 * default to max target family */
902 if (retval != ERROR_OK || flash_size_in_kb == 0xffff || flash_size_in_kb == 0) {
903 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming %dk flash",
904 max_flash_size_in_kb);
905 flash_size_in_kb = max_flash_size_in_kb;
908 /* if the user sets the size manually then ignore the probed value
909 * this allows us to work around devices that have a invalid flash size register value */
910 if (stm32x_info->user_bank_size) {
911 LOG_INFO("ignoring flash probed value, using configured bank size");
912 flash_size_in_kb = stm32x_info->user_bank_size / 1024;
915 LOG_INFO("flash size = %dkbytes", flash_size_in_kb);
917 /* did we assign flash size? */
918 assert(flash_size_in_kb != 0xffff);
920 /* Devices with > 1024 kiByte always are dual-banked */
921 if (flash_size_in_kb > 1024)
922 stm32x_info->has_large_mem = true;
924 /* F42x/43x/469/479 1024 kiByte devices have a dual bank option */
925 if ((device_id & 0xfff) == 0x419 || (device_id & 0xfff) == 0x434) {
927 retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
928 if (retval != ERROR_OK) {
929 LOG_DEBUG("unable to read option bytes");
932 if ((flash_size_in_kb > 1024) || (optiondata & OPTCR_DB1M)) {
933 stm32x_info->has_large_mem = true;
934 LOG_INFO("Dual Bank %d kiB STM32F42x/43x/469/479 found", flash_size_in_kb);
936 stm32x_info->has_large_mem = false;
937 LOG_INFO("Single Bank %d kiB STM32F42x/43x/469/479 found", flash_size_in_kb);
941 /* F76x/77x devices have a dual bank option */
942 if ((device_id & 0xfff) == 0x451) {
944 retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
945 if (retval != ERROR_OK) {
946 LOG_DEBUG("unable to read option bytes");
949 if (optiondata & OPTCR_NDBANK) {
950 stm32x_info->has_large_mem = false;
951 LOG_INFO("Single Bank %d kiB STM32F76x/77x found", flash_size_in_kb);
953 stm32x_info->has_large_mem = true;
954 max_sector_size_in_kb >>= 1; /* sector size divided by 2 in dual-bank mode */
955 LOG_INFO("Dual Bank %d kiB STM32F76x/77x found", flash_size_in_kb);
959 /* calculate numbers of pages */
960 int num_pages = flash_size_in_kb / max_sector_size_in_kb
961 + (stm32x_info->has_large_mem ? 8 : 4);
965 bank->sectors = NULL;
968 bank->base = base_address;
969 bank->num_sectors = num_pages;
970 bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
971 for (i = 0; i < num_pages; i++) {
972 bank->sectors[i].is_erased = -1;
973 bank->sectors[i].is_protected = 0;
976 LOG_DEBUG("allocated %d sectors", num_pages);
978 if (stm32x_info->has_large_mem) {
980 setup_bank(bank, 0, flash_size_in_kb >> 1, max_sector_size_in_kb);
981 setup_bank(bank, num_pages >> 1, flash_size_in_kb >> 1,
982 max_sector_size_in_kb);
985 setup_bank(bank, 0, flash_size_in_kb, max_sector_size_in_kb);
987 assert((bank->size >> 10) == flash_size_in_kb);
989 stm32x_info->probed = 1;
993 static int stm32x_auto_probe(struct flash_bank *bank)
995 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
996 if (stm32x_info->probed)
998 return stm32x_probe(bank);
1001 static int get_stm32x_info(struct flash_bank *bank, char *buf, int buf_size)
1003 uint32_t dbgmcu_idcode;
1005 /* read stm32 device id register */
1006 int retval = stm32x_get_device_id(bank, &dbgmcu_idcode);
1007 if (retval != ERROR_OK)
1010 uint16_t device_id = dbgmcu_idcode & 0xfff;
1011 uint16_t rev_id = dbgmcu_idcode >> 16;
1012 const char *device_str;
1013 const char *rev_str = NULL;
1015 switch (device_id) {
1017 device_str = "STM32F2xx";
1057 device_str = "STM32F4xx";
1083 device_str = "STM32F446";
1097 device_str = "STM32F4xx (Low Power)";
1111 device_str = "STM32F7[4|5]x";
1125 device_str = "STM32F7[6|7]x";
1135 snprintf(buf, buf_size, "Cannot identify target as a STM32F2/4/7\n");
1139 if (rev_str != NULL)
1140 snprintf(buf, buf_size, "%s - Rev: %s", device_str, rev_str);
1142 snprintf(buf, buf_size, "%s - Rev: unknown (0x%04x)", device_str, rev_id);
1147 COMMAND_HANDLER(stm32x_handle_lock_command)
1149 struct target *target = NULL;
1150 struct stm32x_flash_bank *stm32x_info = NULL;
1153 return ERROR_COMMAND_SYNTAX_ERROR;
1155 struct flash_bank *bank;
1156 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1157 if (ERROR_OK != retval)
1160 stm32x_info = bank->driver_priv;
1161 target = bank->target;
1163 if (target->state != TARGET_HALTED) {
1164 LOG_ERROR("Target not halted");
1165 return ERROR_TARGET_NOT_HALTED;
1168 if (stm32x_read_options(bank) != ERROR_OK) {
1169 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
1173 /* set readout protection */
1174 stm32x_info->option_bytes.RDP = 0;
1176 if (stm32x_write_options(bank) != ERROR_OK) {
1177 command_print(CMD_CTX, "%s failed to lock device", bank->driver->name);
1181 command_print(CMD_CTX, "%s locked", bank->driver->name);
1186 COMMAND_HANDLER(stm32x_handle_unlock_command)
1188 struct target *target = NULL;
1189 struct stm32x_flash_bank *stm32x_info = NULL;
1192 return ERROR_COMMAND_SYNTAX_ERROR;
1194 struct flash_bank *bank;
1195 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1196 if (ERROR_OK != retval)
1199 stm32x_info = bank->driver_priv;
1200 target = bank->target;
1202 if (target->state != TARGET_HALTED) {
1203 LOG_ERROR("Target not halted");
1204 return ERROR_TARGET_NOT_HALTED;
1207 if (stm32x_read_options(bank) != ERROR_OK) {
1208 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
1212 /* clear readout protection and complementary option bytes
1213 * this will also force a device unlock if set */
1214 stm32x_info->option_bytes.RDP = 0xAA;
1216 if (stm32x_write_options(bank) != ERROR_OK) {
1217 command_print(CMD_CTX, "%s failed to unlock device", bank->driver->name);
1221 command_print(CMD_CTX, "%s unlocked.\n"
1222 "INFO: a reset or power cycle is required "
1223 "for the new settings to take effect.", bank->driver->name);
1228 static int stm32x_mass_erase(struct flash_bank *bank)
1232 struct target *target = bank->target;
1233 struct stm32x_flash_bank *stm32x_info = NULL;
1235 if (target->state != TARGET_HALTED) {
1236 LOG_ERROR("Target not halted");
1237 return ERROR_TARGET_NOT_HALTED;
1240 stm32x_info = bank->driver_priv;
1242 retval = stm32x_unlock_reg(target);
1243 if (retval != ERROR_OK)
1246 /* mass erase flash memory */
1247 if (stm32x_info->has_large_mem)
1248 flash_mer = FLASH_MER | FLASH_MER1;
1250 flash_mer = FLASH_MER;
1252 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), flash_mer);
1253 if (retval != ERROR_OK)
1255 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
1256 flash_mer | FLASH_STRT);
1257 if (retval != ERROR_OK)
1260 retval = stm32x_wait_status_busy(bank, 30000);
1261 if (retval != ERROR_OK)
1264 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
1265 if (retval != ERROR_OK)
1271 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
1276 command_print(CMD_CTX, "stm32x mass_erase <bank>");
1277 return ERROR_COMMAND_SYNTAX_ERROR;
1280 struct flash_bank *bank;
1281 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1282 if (ERROR_OK != retval)
1285 retval = stm32x_mass_erase(bank);
1286 if (retval == ERROR_OK) {
1287 /* set all sectors as erased */
1288 for (i = 0; i < bank->num_sectors; i++)
1289 bank->sectors[i].is_erased = 1;
1291 command_print(CMD_CTX, "stm32x mass erase complete");
1293 command_print(CMD_CTX, "stm32x mass erase failed");
1299 COMMAND_HANDLER(stm32f2x_handle_options_read_command)
1302 struct flash_bank *bank;
1303 struct stm32x_flash_bank *stm32x_info = NULL;
1305 if (CMD_ARGC != 1) {
1306 command_print(CMD_CTX, "stm32f2x options_read <bank>");
1307 return ERROR_COMMAND_SYNTAX_ERROR;
1310 retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1311 if (ERROR_OK != retval)
1314 retval = stm32x_read_options(bank);
1315 if (ERROR_OK != retval)
1318 stm32x_info = bank->driver_priv;
1319 if (stm32x_info->has_extra_options) {
1320 if (stm32x_info->has_boot_addr) {
1321 uint32_t boot_addr = stm32x_info->option_bytes.boot_addr;
1323 command_print(CMD_CTX, "stm32f2x user_options 0x%03X,"
1324 " boot_add0 0x%04X, boot_add1 0x%04X",
1325 stm32x_info->option_bytes.user_options,
1326 boot_addr & 0xffff, (boot_addr & 0xffff0000) >> 16);
1328 command_print(CMD_CTX, "stm32f2x user_options 0x%03X,",
1329 stm32x_info->option_bytes.user_options);
1332 command_print(CMD_CTX, "stm32f2x user_options 0x%02X",
1333 stm32x_info->option_bytes.user_options);
1340 COMMAND_HANDLER(stm32f2x_handle_options_write_command)
1343 struct flash_bank *bank;
1344 struct stm32x_flash_bank *stm32x_info = NULL;
1345 uint16_t user_options, boot_addr0, boot_addr1;
1348 command_print(CMD_CTX, "stm32f2x options_write <bank> ...");
1349 return ERROR_COMMAND_SYNTAX_ERROR;
1352 retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1353 if (ERROR_OK != retval)
1356 retval = stm32x_read_options(bank);
1357 if (ERROR_OK != retval)
1360 stm32x_info = bank->driver_priv;
1361 if (stm32x_info->has_boot_addr) {
1362 if (CMD_ARGC != 4) {
1363 command_print(CMD_CTX, "stm32f2x options_write <bank> <user_options>"
1364 " <boot_addr0> <boot_addr1>");
1365 return ERROR_COMMAND_SYNTAX_ERROR;
1367 COMMAND_PARSE_NUMBER(u16, CMD_ARGV[2], boot_addr0);
1368 COMMAND_PARSE_NUMBER(u16, CMD_ARGV[3], boot_addr1);
1369 stm32x_info->option_bytes.boot_addr = boot_addr0 | (((uint32_t) boot_addr1) << 16);
1371 if (CMD_ARGC != 2) {
1372 command_print(CMD_CTX, "stm32f2x options_write <bank> <user_options>");
1373 return ERROR_COMMAND_SYNTAX_ERROR;
1377 COMMAND_PARSE_NUMBER(u16, CMD_ARGV[1], user_options);
1378 if (user_options & (stm32x_info->has_extra_options ? ~0xffc : ~0xfc)) {
1379 command_print(CMD_CTX, "stm32f2x invalid user_options");
1380 return ERROR_COMMAND_SYNTAX_ERROR;
1383 stm32x_info->option_bytes.user_options = user_options;
1385 if (stm32x_write_options(bank) != ERROR_OK) {
1386 command_print(CMD_CTX, "stm32f2x failed to write options");
1390 /* switching between single- and dual-bank modes requires re-probe */
1391 /* ... and reprogramming of whole flash */
1392 stm32x_info->probed = 0;
1394 command_print(CMD_CTX, "stm32f2x write options complete.\n"
1395 "INFO: a reset or power cycle is required "
1396 "for the new settings to take effect.");
1400 static const struct command_registration stm32x_exec_command_handlers[] = {
1403 .handler = stm32x_handle_lock_command,
1404 .mode = COMMAND_EXEC,
1406 .help = "Lock entire flash device.",
1410 .handler = stm32x_handle_unlock_command,
1411 .mode = COMMAND_EXEC,
1413 .help = "Unlock entire protected flash device.",
1416 .name = "mass_erase",
1417 .handler = stm32x_handle_mass_erase_command,
1418 .mode = COMMAND_EXEC,
1420 .help = "Erase entire flash device.",
1423 .name = "options_read",
1424 .handler = stm32f2x_handle_options_read_command,
1425 .mode = COMMAND_EXEC,
1427 .help = "Read and display device option bytes.",
1430 .name = "options_write",
1431 .handler = stm32f2x_handle_options_write_command,
1432 .mode = COMMAND_EXEC,
1433 .usage = "bank_id user_options [ boot_add0 boot_add1]",
1434 .help = "Write option bytes",
1436 COMMAND_REGISTRATION_DONE
1439 static const struct command_registration stm32x_command_handlers[] = {
1442 .mode = COMMAND_ANY,
1443 .help = "stm32f2x flash command group",
1445 .chain = stm32x_exec_command_handlers,
1447 COMMAND_REGISTRATION_DONE
1450 struct flash_driver stm32f2x_flash = {
1452 .commands = stm32x_command_handlers,
1453 .flash_bank_command = stm32x_flash_bank_command,
1454 .erase = stm32x_erase,
1455 .protect = stm32x_protect,
1456 .write = stm32x_write,
1457 .read = default_flash_read,
1458 .probe = stm32x_probe,
1459 .auto_probe = stm32x_auto_probe,
1460 .erase_check = default_flash_blank_check,
1461 .protect_check = stm32x_protect_check,
1462 .info = get_stm32x_info,