1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2008 by Spencer Oliver *
6 * spen@spen-soft.co.uk *
8 * Copyright (C) 2011 Øyvind Harboe *
9 * oyvind.harboe@zylin.com *
11 * This program is free software; you can redistribute it and/or modify *
12 * it under the terms of the GNU General Public License as published by *
13 * the Free Software Foundation; either version 2 of the License, or *
14 * (at your option) any later version. *
16 * This program is distributed in the hope that it will be useful, *
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
19 * GNU General Public License for more details. *
21 * You should have received a copy of the GNU General Public License *
22 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
23 ***************************************************************************/
30 #include <helper/binarybuffer.h>
31 #include <target/algorithm.h>
32 #include <target/armv7m.h>
34 /* Regarding performance:
36 * Short story - it might be best to leave the performance at
39 * You may see a jump in speed if you change to using
40 * 32bit words for the block programming.
42 * Its a shame you cannot use the double word as its
43 * even faster - but you require external VPP for that mode.
45 * Having said all that 16bit writes give us the widest vdd
46 * operating range, so may be worth adding a note to that effect.
50 /* Danger!!!! The STM32F1x and STM32F2x series actually have
51 * quite different flash controllers.
53 * What's more scary is that the names of the registers and their
54 * addresses are the same, but the actual bits and what they do are
55 * can be very different.
57 * To reduce testing complexity and dangers of regressions,
58 * a seperate file is used for stm32fx2x.
60 * Sector sizes in kiBytes:
61 * 1 MiByte part with 4 x 16, 1 x 64, 7 x 128.
62 * 2 MiByte part with 4 x 16, 1 x 64, 7 x 128, 4 x 16, 1 x 64, 7 x 128.
63 * 1 MiByte STM32F42x/43x part with DB1M Option set:
64 * 4 x 16, 1 x 64, 3 x 128, 4 x 16, 1 x 64, 3 x 128.
67 * 1 MiByte part with 4 x 32, 1 x 128, 3 x 256.
69 * Protection size is sector size.
71 * Tested with STM3220F-EVAL board.
73 * STM32F4xx series for reference.
76 * http://www.st.com/web/en/resource/technical/document/reference_manual/DM00031020.pdf
79 * www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/
80 * PROGRAMMING_MANUAL/CD00233952.pdf
82 * STM32F7xx series for reference.
85 * http://www.st.com/web/en/resource/technical/document/reference_manual/DM00124865.pdf
87 * STM32F1x series - notice that this code was copy, pasted and knocked
88 * into a stm32f2x driver, so in case something has been converted or
89 * bugs haven't been fixed, here are the original manuals:
91 * RM0008 - Reference manual
93 * RM0042, the Flash programming manual for low-, medium- high-density and
94 * connectivity line STM32F10x devices
96 * PM0068, the Flash programming manual for XL-density STM32F10x devices.
100 /* Erase time can be as high as 1000ms, 10x this and it's toast... */
101 #define FLASH_ERASE_TIMEOUT 10000
102 #define FLASH_WRITE_TIMEOUT 5
104 #define STM32_FLASH_BASE 0x40023c00
105 #define STM32_FLASH_ACR 0x40023c00
106 #define STM32_FLASH_KEYR 0x40023c04
107 #define STM32_FLASH_OPTKEYR 0x40023c08
108 #define STM32_FLASH_SR 0x40023c0C
109 #define STM32_FLASH_CR 0x40023c10
110 #define STM32_FLASH_OPTCR 0x40023c14
111 #define STM32_FLASH_OPTCR1 0x40023c18
113 /* FLASH_CR register bits */
115 #define FLASH_PG (1 << 0)
116 #define FLASH_SER (1 << 1)
117 #define FLASH_MER (1 << 2)
118 #define FLASH_MER1 (1 << 15)
119 #define FLASH_STRT (1 << 16)
120 #define FLASH_PSIZE_8 (0 << 8)
121 #define FLASH_PSIZE_16 (1 << 8)
122 #define FLASH_PSIZE_32 (2 << 8)
123 #define FLASH_PSIZE_64 (3 << 8)
124 /* The sector number encoding is not straight binary for dual bank flash.
125 * Warning: evaluates the argument multiple times */
126 #define FLASH_SNB(a) ((((a) >= 12) ? 0x10 | ((a) - 12) : (a)) << 3)
127 #define FLASH_LOCK (1 << 31)
129 /* FLASH_SR register bits */
131 #define FLASH_BSY (1 << 16)
132 #define FLASH_PGSERR (1 << 7) /* Programming sequence error */
133 #define FLASH_PGPERR (1 << 6) /* Programming parallelism error */
134 #define FLASH_PGAERR (1 << 5) /* Programming alignment error */
135 #define FLASH_WRPERR (1 << 4) /* Write protection error */
136 #define FLASH_OPERR (1 << 1) /* Operation error */
138 #define FLASH_ERROR (FLASH_PGSERR | FLASH_PGPERR | FLASH_PGAERR | FLASH_WRPERR | FLASH_OPERR)
140 /* STM32_FLASH_OPTCR register bits */
142 #define OPT_LOCK (1 << 0)
143 #define OPT_START (1 << 1)
145 /* STM32_FLASH_OBR bit definitions (reading) */
148 #define OPT_READOUT 1
149 #define OPT_RDWDGSW 2
150 #define OPT_RDRSTSTOP 3
151 #define OPT_RDRSTSTDBY 4
152 #define OPT_BFB2 5 /* dual flash bank only */
153 #define OPT_DB1M 14 /* 1 MiB devices dual flash bank option */
155 /* register unlock keys */
157 #define KEY1 0x45670123
158 #define KEY2 0xCDEF89AB
160 /* option register unlock key */
161 #define OPTKEY1 0x08192A3B
162 #define OPTKEY2 0x4C5D6E7F
164 struct stm32x_options {
166 uint8_t user_options;
170 struct stm32x_flash_bank {
171 struct stm32x_options option_bytes;
173 bool has_large_mem; /* stm32f42x/stm32f43x family */
174 uint32_t user_bank_size;
177 /* flash bank stm32x <base> <size> 0 0 <target#>
179 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
181 struct stm32x_flash_bank *stm32x_info;
184 return ERROR_COMMAND_SYNTAX_ERROR;
186 stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
187 bank->driver_priv = stm32x_info;
189 stm32x_info->probed = 0;
190 stm32x_info->user_bank_size = bank->size;
195 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
200 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
202 struct target *target = bank->target;
203 return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
206 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
208 struct target *target = bank->target;
210 int retval = ERROR_OK;
212 /* wait for busy to clear */
214 retval = stm32x_get_flash_status(bank, &status);
215 if (retval != ERROR_OK)
217 LOG_DEBUG("status: 0x%" PRIx32 "", status);
218 if ((status & FLASH_BSY) == 0)
220 if (timeout-- <= 0) {
221 LOG_ERROR("timed out waiting for flash");
228 if (status & FLASH_WRPERR) {
229 LOG_ERROR("stm32x device protected");
233 /* Clear but report errors */
234 if (status & FLASH_ERROR) {
235 /* If this operation fails, we ignore it and report the original
238 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
239 status & FLASH_ERROR);
244 static int stm32x_unlock_reg(struct target *target)
248 /* first check if not already unlocked
249 * otherwise writing on STM32_FLASH_KEYR will fail
251 int retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
252 if (retval != ERROR_OK)
255 if ((ctrl & FLASH_LOCK) == 0)
258 /* unlock flash registers */
259 retval = target_write_u32(target, STM32_FLASH_KEYR, KEY1);
260 if (retval != ERROR_OK)
263 retval = target_write_u32(target, STM32_FLASH_KEYR, KEY2);
264 if (retval != ERROR_OK)
267 retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
268 if (retval != ERROR_OK)
271 if (ctrl & FLASH_LOCK) {
272 LOG_ERROR("flash not unlocked STM32_FLASH_CR: %" PRIx32, ctrl);
273 return ERROR_TARGET_FAILURE;
279 static int stm32x_unlock_option_reg(struct target *target)
283 int retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
284 if (retval != ERROR_OK)
287 if ((ctrl & OPT_LOCK) == 0)
290 /* unlock option registers */
291 retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY1);
292 if (retval != ERROR_OK)
295 retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY2);
296 if (retval != ERROR_OK)
299 retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
300 if (retval != ERROR_OK)
303 if (ctrl & OPT_LOCK) {
304 LOG_ERROR("options not unlocked STM32_FLASH_OPTCR: %" PRIx32, ctrl);
305 return ERROR_TARGET_FAILURE;
311 static int stm32x_read_options(struct flash_bank *bank)
314 struct stm32x_flash_bank *stm32x_info = NULL;
315 struct target *target = bank->target;
317 stm32x_info = bank->driver_priv;
319 /* read current option bytes */
320 int retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
321 if (retval != ERROR_OK)
324 stm32x_info->option_bytes.user_options = optiondata & 0xec;
325 stm32x_info->option_bytes.RDP = (optiondata >> 8) & 0xff;
326 stm32x_info->option_bytes.protection = (optiondata >> 16) & 0xfff;
328 if (stm32x_info->has_large_mem) {
330 retval = target_read_u32(target, STM32_FLASH_OPTCR1, &optiondata);
331 if (retval != ERROR_OK)
334 /* append protection bits */
335 stm32x_info->option_bytes.protection |= (optiondata >> 4) & 0x00fff000;
338 if (stm32x_info->option_bytes.RDP != 0xAA)
339 LOG_INFO("Device Security Bit Set");
344 static int stm32x_write_options(struct flash_bank *bank)
346 struct stm32x_flash_bank *stm32x_info = NULL;
347 struct target *target = bank->target;
350 stm32x_info = bank->driver_priv;
352 int retval = stm32x_unlock_option_reg(target);
353 if (retval != ERROR_OK)
356 /* rebuild option data */
357 optiondata = stm32x_info->option_bytes.user_options;
358 optiondata |= stm32x_info->option_bytes.RDP << 8;
359 optiondata |= (stm32x_info->option_bytes.protection & 0x0fff) << 16;
361 /* program options */
362 retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata);
363 if (retval != ERROR_OK)
366 if (stm32x_info->has_large_mem) {
368 uint32_t optiondata2 = 0;
369 optiondata2 |= (stm32x_info->option_bytes.protection & 0x00fff000) << 4;
370 retval = target_write_u32(target, STM32_FLASH_OPTCR1, optiondata2);
371 if (retval != ERROR_OK)
375 /* start programming cycle */
376 retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPT_START);
377 if (retval != ERROR_OK)
380 /* wait for completion */
381 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
382 if (retval != ERROR_OK)
385 /* relock registers */
386 retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPT_LOCK);
387 if (retval != ERROR_OK)
393 static int stm32x_protect_check(struct flash_bank *bank)
395 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
397 /* read write protection settings */
398 int retval = stm32x_read_options(bank);
399 if (retval != ERROR_OK) {
400 LOG_DEBUG("unable to read option bytes");
404 for (int i = 0; i < bank->num_sectors; i++) {
405 if (stm32x_info->option_bytes.protection & (1 << i))
406 bank->sectors[i].is_protected = 0;
408 bank->sectors[i].is_protected = 1;
414 static int stm32x_erase(struct flash_bank *bank, int first, int last)
416 struct target *target = bank->target;
419 assert(first < bank->num_sectors);
420 assert(last < bank->num_sectors);
422 if (bank->target->state != TARGET_HALTED) {
423 LOG_ERROR("Target not halted");
424 return ERROR_TARGET_NOT_HALTED;
428 retval = stm32x_unlock_reg(target);
429 if (retval != ERROR_OK)
434 To erase a sector, follow the procedure below:
435 1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
437 2. Set the SER bit and select the sector
438 you wish to erase (SNB) in the FLASH_CR register
439 3. Set the STRT bit in the FLASH_CR register
440 4. Wait for the BSY bit to be cleared
443 for (i = first; i <= last; i++) {
444 retval = target_write_u32(target,
445 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_SER | FLASH_SNB(i) | FLASH_STRT);
446 if (retval != ERROR_OK)
449 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
450 if (retval != ERROR_OK)
453 bank->sectors[i].is_erased = 1;
456 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
457 if (retval != ERROR_OK)
463 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
465 struct target *target = bank->target;
466 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
468 if (target->state != TARGET_HALTED) {
469 LOG_ERROR("Target not halted");
470 return ERROR_TARGET_NOT_HALTED;
473 /* read protection settings */
474 int retval = stm32x_read_options(bank);
475 if (retval != ERROR_OK) {
476 LOG_DEBUG("unable to read option bytes");
480 for (int i = first; i <= last; i++) {
483 stm32x_info->option_bytes.protection &= ~(1 << i);
485 stm32x_info->option_bytes.protection |= (1 << i);
488 retval = stm32x_write_options(bank);
489 if (retval != ERROR_OK)
495 static int stm32x_write_block(struct flash_bank *bank, const uint8_t *buffer,
496 uint32_t offset, uint32_t count)
498 struct target *target = bank->target;
499 uint32_t buffer_size = 16384;
500 struct working_area *write_algorithm;
501 struct working_area *source;
502 uint32_t address = bank->base + offset;
503 struct reg_param reg_params[5];
504 struct armv7m_algorithm armv7m_info;
505 int retval = ERROR_OK;
507 /* see contrib/loaders/flash/stm32f2x.S for src */
509 static const uint8_t stm32x_flash_write_code[] = {
511 0xD0, 0xF8, 0x00, 0x80, /* ldr r8, [r0, #0] */
512 0xB8, 0xF1, 0x00, 0x0F, /* cmp r8, #0 */
513 0x1A, 0xD0, /* beq exit */
514 0x47, 0x68, /* ldr r7, [r0, #4] */
515 0x47, 0x45, /* cmp r7, r8 */
516 0xF7, 0xD0, /* beq wait_fifo */
518 0xDF, 0xF8, 0x34, 0x60, /* ldr r6, STM32_PROG16 */
519 0x26, 0x61, /* str r6, [r4, #STM32_FLASH_CR_OFFSET] */
520 0x37, 0xF8, 0x02, 0x6B, /* ldrh r6, [r7], #0x02 */
521 0x22, 0xF8, 0x02, 0x6B, /* strh r6, [r2], #0x02 */
522 0xBF, 0xF3, 0x4F, 0x8F, /* dsb sy */
524 0xE6, 0x68, /* ldr r6, [r4, #STM32_FLASH_SR_OFFSET] */
525 0x16, 0xF4, 0x80, 0x3F, /* tst r6, #0x10000 */
526 0xFB, 0xD1, /* bne busy */
527 0x16, 0xF0, 0xF0, 0x0F, /* tst r6, #0xf0 */
528 0x07, 0xD1, /* bne error */
530 0x8F, 0x42, /* cmp r7, r1 */
531 0x28, 0xBF, /* it cs */
532 0x00, 0xF1, 0x08, 0x07, /* addcs r7, r0, #8 */
533 0x47, 0x60, /* str r7, [r0, #4] */
534 0x01, 0x3B, /* subs r3, r3, #1 */
535 0x13, 0xB1, /* cbz r3, exit */
536 0xDF, 0xE7, /* b wait_fifo */
538 0x00, 0x21, /* movs r1, #0 */
539 0x41, 0x60, /* str r1, [r0, #4] */
541 0x30, 0x46, /* mov r0, r6 */
542 0x00, 0xBE, /* bkpt #0x00 */
544 /* <STM32_PROG16>: */
545 0x01, 0x01, 0x00, 0x00, /* .word 0x00000101 */
548 if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
549 &write_algorithm) != ERROR_OK) {
550 LOG_WARNING("no working area available, can't do block memory writes");
551 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
554 retval = target_write_buffer(target, write_algorithm->address,
555 sizeof(stm32x_flash_write_code),
556 stm32x_flash_write_code);
557 if (retval != ERROR_OK)
561 while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
563 if (buffer_size <= 256) {
564 /* we already allocated the writing code, but failed to get a
565 * buffer, free the algorithm */
566 target_free_working_area(target, write_algorithm);
568 LOG_WARNING("no large enough working area available, can't do block memory writes");
569 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
573 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
574 armv7m_info.core_mode = ARM_MODE_THREAD;
576 init_reg_param(®_params[0], "r0", 32, PARAM_IN_OUT); /* buffer start, status (out) */
577 init_reg_param(®_params[1], "r1", 32, PARAM_OUT); /* buffer end */
578 init_reg_param(®_params[2], "r2", 32, PARAM_OUT); /* target address */
579 init_reg_param(®_params[3], "r3", 32, PARAM_OUT); /* count (halfword-16bit) */
580 init_reg_param(®_params[4], "r4", 32, PARAM_OUT); /* flash base */
582 buf_set_u32(reg_params[0].value, 0, 32, source->address);
583 buf_set_u32(reg_params[1].value, 0, 32, source->address + source->size);
584 buf_set_u32(reg_params[2].value, 0, 32, address);
585 buf_set_u32(reg_params[3].value, 0, 32, count);
586 buf_set_u32(reg_params[4].value, 0, 32, STM32_FLASH_BASE);
588 retval = target_run_flash_async_algorithm(target, buffer, count, 2,
591 source->address, source->size,
592 write_algorithm->address, 0,
595 if (retval == ERROR_FLASH_OPERATION_FAILED) {
596 LOG_ERROR("error executing stm32x flash write algorithm");
598 uint32_t error = buf_get_u32(reg_params[0].value, 0, 32) & FLASH_ERROR;
600 if (error & FLASH_WRPERR)
601 LOG_ERROR("flash memory write protected");
604 LOG_ERROR("flash write failed = %08" PRIx32, error);
605 /* Clear but report errors */
606 target_write_u32(target, STM32_FLASH_SR, error);
611 target_free_working_area(target, source);
612 target_free_working_area(target, write_algorithm);
614 destroy_reg_param(®_params[0]);
615 destroy_reg_param(®_params[1]);
616 destroy_reg_param(®_params[2]);
617 destroy_reg_param(®_params[3]);
618 destroy_reg_param(®_params[4]);
623 static int stm32x_write(struct flash_bank *bank, const uint8_t *buffer,
624 uint32_t offset, uint32_t count)
626 struct target *target = bank->target;
627 uint32_t words_remaining = (count / 2);
628 uint32_t bytes_remaining = (count & 0x00000001);
629 uint32_t address = bank->base + offset;
630 uint32_t bytes_written = 0;
633 if (bank->target->state != TARGET_HALTED) {
634 LOG_ERROR("Target not halted");
635 return ERROR_TARGET_NOT_HALTED;
639 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
640 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
643 retval = stm32x_unlock_reg(target);
644 if (retval != ERROR_OK)
647 /* multiple half words (2-byte) to be programmed? */
648 if (words_remaining > 0) {
649 /* try using a block write */
650 retval = stm32x_write_block(bank, buffer, offset, words_remaining);
651 if (retval != ERROR_OK) {
652 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
653 /* if block write failed (no sufficient working area),
654 * we use normal (slow) single dword accesses */
655 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
658 buffer += words_remaining * 2;
659 address += words_remaining * 2;
664 if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
669 The Flash memory programming sequence is as follows:
670 1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
672 2. Set the PG bit in the FLASH_CR register
673 3. Perform the data write operation(s) to the desired memory address (inside main
674 memory block or OTP area):
675 – – Half-word access in case of x16 parallelism
676 – Word access in case of x32 parallelism
679 Byte access in case of x8 parallelism
680 Double word access in case of x64 parallelism
681 Wait for the BSY bit to be cleared
683 while (words_remaining > 0) {
685 memcpy(&value, buffer + bytes_written, sizeof(uint16_t));
687 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
688 FLASH_PG | FLASH_PSIZE_16);
689 if (retval != ERROR_OK)
692 retval = target_write_u16(target, address, value);
693 if (retval != ERROR_OK)
696 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
697 if (retval != ERROR_OK)
705 if (bytes_remaining) {
706 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
707 FLASH_PG | FLASH_PSIZE_8);
708 if (retval != ERROR_OK)
710 retval = target_write_u8(target, address, buffer[bytes_written]);
711 if (retval != ERROR_OK)
714 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
715 if (retval != ERROR_OK)
719 return target_write_u32(target, STM32_FLASH_CR, FLASH_LOCK);
722 static void setup_sector(struct flash_bank *bank, int start, int num, int size)
724 for (int i = start; i < (start + num) ; i++) {
725 assert(i < bank->num_sectors);
726 bank->sectors[i].offset = bank->size;
727 bank->sectors[i].size = size;
728 bank->size += bank->sectors[i].size;
732 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
734 /* this checks for a stm32f4x errata issue where a
735 * stm32f2x DBGMCU_IDCODE is incorrectly returned.
736 * If the issue is detected target is forced to stm32f4x Rev A.
737 * Only effects Rev A silicon */
739 struct target *target = bank->target;
742 /* read stm32 device id register */
743 int retval = target_read_u32(target, 0xE0042000, device_id);
744 if (retval != ERROR_OK)
747 if ((*device_id & 0xfff) == 0x411) {
748 /* read CPUID reg to check core type */
749 retval = target_read_u32(target, 0xE000ED00, &cpuid);
750 if (retval != ERROR_OK)
753 /* check for cortex_m4 */
754 if (((cpuid >> 4) & 0xFFF) == 0xC24) {
755 *device_id &= ~((0xFFFF << 16) | 0xfff);
756 *device_id |= (0x1000 << 16) | 0x413;
757 LOG_INFO("stm32f4x errata detected - fixing incorrect MCU_IDCODE");
763 static int stm32x_probe(struct flash_bank *bank)
765 struct target *target = bank->target;
766 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
768 uint16_t flash_size_in_kb;
769 uint32_t flash_size_reg = 0x1FFF7A22;
770 uint16_t max_sector_size_in_kb = 128;
771 uint16_t max_flash_size_in_kb;
773 uint32_t base_address = 0x08000000;
775 stm32x_info->probed = 0;
776 stm32x_info->has_large_mem = false;
778 /* read stm32 device id register */
779 int retval = stm32x_get_device_id(bank, &device_id);
780 if (retval != ERROR_OK)
782 LOG_INFO("device id = 0x%08" PRIx32 "", device_id);
784 /* set max flash size depending on family */
785 switch (device_id & 0xfff) {
789 max_flash_size_in_kb = 1024;
793 max_flash_size_in_kb = 2048;
796 max_flash_size_in_kb = 256;
801 max_flash_size_in_kb = 512;
804 max_flash_size_in_kb = 128;
807 max_flash_size_in_kb = 1024;
808 max_sector_size_in_kb = 256;
809 flash_size_reg = 0x1FF0F442;
812 LOG_WARNING("Cannot identify target as a STM32 family.");
816 /* get flash size from target. */
817 retval = target_read_u16(target, flash_size_reg, &flash_size_in_kb);
819 /* failed reading flash size or flash size invalid (early silicon),
820 * default to max target family */
821 if (retval != ERROR_OK || flash_size_in_kb == 0xffff || flash_size_in_kb == 0) {
822 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming %dk flash",
823 max_flash_size_in_kb);
824 flash_size_in_kb = max_flash_size_in_kb;
827 /* if the user sets the size manually then ignore the probed value
828 * this allows us to work around devices that have a invalid flash size register value */
829 if (stm32x_info->user_bank_size) {
830 LOG_INFO("ignoring flash probed value, using configured bank size");
831 flash_size_in_kb = stm32x_info->user_bank_size / 1024;
834 LOG_INFO("flash size = %dkbytes", flash_size_in_kb);
836 /* did we assign flash size? */
837 assert(flash_size_in_kb != 0xffff);
839 /* calculate numbers of pages */
840 int num_pages = (flash_size_in_kb / max_sector_size_in_kb) + 4;
842 /* Devices with > 1024 kiByte always are dual-banked */
843 if (flash_size_in_kb > 1024)
844 stm32x_info->has_large_mem = true;
846 /* F42x/43x 1024 kiByte devices have a dual bank option */
847 if ((device_id & 0xfff) == 0x419 && (flash_size_in_kb == 1024)) {
849 retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
850 if (retval != ERROR_OK) {
851 LOG_DEBUG("unable to read option bytes");
854 if (optiondata & (1 << OPT_DB1M)) {
855 stm32x_info->has_large_mem = true;
856 LOG_INFO("Dual Bank 1024 kiB STM32F42x/43x found");
860 /* check for dual-banked devices */
861 if (stm32x_info->has_large_mem)
864 /* check that calculation result makes sense */
865 assert(num_pages > 0);
869 bank->sectors = NULL;
872 bank->base = base_address;
873 bank->num_sectors = num_pages;
874 bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
878 setup_sector(bank, 0, 4, (max_sector_size_in_kb / 8) * 1024);
879 setup_sector(bank, 4, 1, (max_sector_size_in_kb / 2) * 1024);
881 if (stm32x_info->has_large_mem) {
882 if (flash_size_in_kb == 1024) {
883 setup_sector(bank, 5, 3, 128 * 1024);
884 setup_sector(bank, 12, 4, 16 * 1024);
885 setup_sector(bank, 16, 1, 64 * 1024);
886 setup_sector(bank, 17, 3, 128 * 1024);
888 setup_sector(bank, 5, 7, 128 * 1024);
889 setup_sector(bank, 12, 4, 16 * 1024);
890 setup_sector(bank, 16, 1, 64 * 1024);
891 setup_sector(bank, 17, 7, 128 * 1024);
894 setup_sector(bank, 4 + 1, MIN(12, num_pages) - 5,
895 max_sector_size_in_kb * 1024);
897 for (i = 0; i < num_pages; i++) {
898 bank->sectors[i].is_erased = -1;
899 bank->sectors[i].is_protected = 0;
902 stm32x_info->probed = 1;
907 static int stm32x_auto_probe(struct flash_bank *bank)
909 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
910 if (stm32x_info->probed)
912 return stm32x_probe(bank);
915 static int get_stm32x_info(struct flash_bank *bank, char *buf, int buf_size)
917 uint32_t dbgmcu_idcode;
919 /* read stm32 device id register */
920 int retval = stm32x_get_device_id(bank, &dbgmcu_idcode);
921 if (retval != ERROR_OK)
924 uint16_t device_id = dbgmcu_idcode & 0xfff;
925 uint16_t rev_id = dbgmcu_idcode >> 16;
926 const char *device_str;
927 const char *rev_str = NULL;
931 device_str = "STM32F2xx";
958 device_str = "STM32F4xx";
983 device_str = "STM32F446";
996 device_str = "STM32F4xx (Low Power)";
1010 device_str = "STM32F7[4|5]x";
1023 device_str = "STM32F46x/F47x";
1033 snprintf(buf, buf_size, "Cannot identify target as a STM32F2/4/7\n");
1037 if (rev_str != NULL)
1038 snprintf(buf, buf_size, "%s - Rev: %s", device_str, rev_str);
1040 snprintf(buf, buf_size, "%s - Rev: unknown (0x%04x)", device_str, rev_id);
1045 COMMAND_HANDLER(stm32x_handle_lock_command)
1047 struct target *target = NULL;
1048 struct stm32x_flash_bank *stm32x_info = NULL;
1051 return ERROR_COMMAND_SYNTAX_ERROR;
1053 struct flash_bank *bank;
1054 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1055 if (ERROR_OK != retval)
1058 stm32x_info = bank->driver_priv;
1059 target = bank->target;
1061 if (target->state != TARGET_HALTED) {
1062 LOG_ERROR("Target not halted");
1063 return ERROR_TARGET_NOT_HALTED;
1066 if (stm32x_read_options(bank) != ERROR_OK) {
1067 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
1071 /* set readout protection */
1072 stm32x_info->option_bytes.RDP = 0;
1074 if (stm32x_write_options(bank) != ERROR_OK) {
1075 command_print(CMD_CTX, "%s failed to lock device", bank->driver->name);
1079 command_print(CMD_CTX, "%s locked", bank->driver->name);
1084 COMMAND_HANDLER(stm32x_handle_unlock_command)
1086 struct target *target = NULL;
1087 struct stm32x_flash_bank *stm32x_info = NULL;
1090 return ERROR_COMMAND_SYNTAX_ERROR;
1092 struct flash_bank *bank;
1093 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1094 if (ERROR_OK != retval)
1097 stm32x_info = bank->driver_priv;
1098 target = bank->target;
1100 if (target->state != TARGET_HALTED) {
1101 LOG_ERROR("Target not halted");
1102 return ERROR_TARGET_NOT_HALTED;
1105 if (stm32x_read_options(bank) != ERROR_OK) {
1106 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
1110 /* clear readout protection and complementary option bytes
1111 * this will also force a device unlock if set */
1112 stm32x_info->option_bytes.RDP = 0xAA;
1114 if (stm32x_write_options(bank) != ERROR_OK) {
1115 command_print(CMD_CTX, "%s failed to unlock device", bank->driver->name);
1119 command_print(CMD_CTX, "%s unlocked.\n"
1120 "INFO: a reset or power cycle is required "
1121 "for the new settings to take effect.", bank->driver->name);
1126 static int stm32x_mass_erase(struct flash_bank *bank)
1130 struct target *target = bank->target;
1131 struct stm32x_flash_bank *stm32x_info = NULL;
1133 if (target->state != TARGET_HALTED) {
1134 LOG_ERROR("Target not halted");
1135 return ERROR_TARGET_NOT_HALTED;
1138 stm32x_info = bank->driver_priv;
1140 retval = stm32x_unlock_reg(target);
1141 if (retval != ERROR_OK)
1144 /* mass erase flash memory */
1145 if (stm32x_info->has_large_mem)
1146 flash_mer = FLASH_MER | FLASH_MER1;
1148 flash_mer = FLASH_MER;
1149 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), flash_mer);
1150 if (retval != ERROR_OK)
1152 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
1153 flash_mer | FLASH_STRT);
1154 if (retval != ERROR_OK)
1157 retval = stm32x_wait_status_busy(bank, 30000);
1158 if (retval != ERROR_OK)
1161 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
1162 if (retval != ERROR_OK)
1168 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
1173 command_print(CMD_CTX, "stm32x mass_erase <bank>");
1174 return ERROR_COMMAND_SYNTAX_ERROR;
1177 struct flash_bank *bank;
1178 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1179 if (ERROR_OK != retval)
1182 retval = stm32x_mass_erase(bank);
1183 if (retval == ERROR_OK) {
1184 /* set all sectors as erased */
1185 for (i = 0; i < bank->num_sectors; i++)
1186 bank->sectors[i].is_erased = 1;
1188 command_print(CMD_CTX, "stm32x mass erase complete");
1190 command_print(CMD_CTX, "stm32x mass erase failed");
1196 static const struct command_registration stm32x_exec_command_handlers[] = {
1199 .handler = stm32x_handle_lock_command,
1200 .mode = COMMAND_EXEC,
1202 .help = "Lock entire flash device.",
1206 .handler = stm32x_handle_unlock_command,
1207 .mode = COMMAND_EXEC,
1209 .help = "Unlock entire protected flash device.",
1212 .name = "mass_erase",
1213 .handler = stm32x_handle_mass_erase_command,
1214 .mode = COMMAND_EXEC,
1216 .help = "Erase entire flash device.",
1218 COMMAND_REGISTRATION_DONE
1221 static const struct command_registration stm32x_command_handlers[] = {
1224 .mode = COMMAND_ANY,
1225 .help = "stm32f2x flash command group",
1227 .chain = stm32x_exec_command_handlers,
1229 COMMAND_REGISTRATION_DONE
1232 struct flash_driver stm32f2x_flash = {
1234 .commands = stm32x_command_handlers,
1235 .flash_bank_command = stm32x_flash_bank_command,
1236 .erase = stm32x_erase,
1237 .protect = stm32x_protect,
1238 .write = stm32x_write,
1239 .read = default_flash_read,
1240 .probe = stm32x_probe,
1241 .auto_probe = stm32x_auto_probe,
1242 .erase_check = default_flash_blank_check,
1243 .protect_check = stm32x_protect_check,
1244 .info = get_stm32x_info,