1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2008 by Spencer Oliver *
6 * spen@spen-soft.co.uk *
8 * Copyright (C) 2011 Øyvind Harboe *
9 * oyvind.harboe@zylin.com *
11 * This program is free software; you can redistribute it and/or modify *
12 * it under the terms of the GNU General Public License as published by *
13 * the Free Software Foundation; either version 2 of the License, or *
14 * (at your option) any later version. *
16 * This program is distributed in the hope that it will be useful, *
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
19 * GNU General Public License for more details. *
21 * You should have received a copy of the GNU General Public License *
22 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
23 ***************************************************************************/
30 #include <helper/binarybuffer.h>
31 #include <target/algorithm.h>
32 #include <target/armv7m.h>
34 /* Regarding performance:
36 * Short story - it might be best to leave the performance at
39 * You may see a jump in speed if you change to using
40 * 32bit words for the block programming.
42 * Its a shame you cannot use the double word as its
43 * even faster - but you require external VPP for that mode.
45 * Having said all that 16bit writes give us the widest vdd
46 * operating range, so may be worth adding a note to that effect.
50 /* Danger!!!! The STM32F1x and STM32F2x series actually have
51 * quite different flash controllers.
53 * What's more scary is that the names of the registers and their
54 * addresses are the same, but the actual bits and what they do are
55 * can be very different.
57 * To reduce testing complexity and dangers of regressions,
58 * a seperate file is used for stm32fx2x.
60 * Sector sizes in kiBytes:
61 * 1 MiByte part with 4 x 16, 1 x 64, 7 x 128.
62 * 2 MiByte part with 4 x 16, 1 x 64, 7 x 128, 4 x 16, 1 x 64, 7 x 128.
63 * 1 MiByte STM32F42x/43x part with DB1M Option set:
64 * 4 x 16, 1 x 64, 3 x 128, 4 x 16, 1 x 64, 3 x 128.
67 * 1 MiByte part with 4 x 32, 1 x 128, 3 x 256.
70 * 1 MiByte part in single bank mode with 4 x 32, 1 x 128, 3 x 256.
71 * 1 MiByte part in dual-bank mode two banks with 4 x 16, 1 x 64, 3 x 128 each.
72 * 2 MiByte part in single-bank mode with 4 x 32, 1 x 128, 7 x 256.
73 * 2 MiByte part in dual-bank mode two banks with 4 x 16, 1 x 64, 7 x 128 each.
75 * Protection size is sector size.
77 * Tested with STM3220F-EVAL board.
79 * STM32F4xx series for reference.
82 * http://www.st.com/web/en/resource/technical/document/reference_manual/DM00031020.pdf
85 * www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/
86 * PROGRAMMING_MANUAL/CD00233952.pdf
88 * STM32F7xx series for reference.
91 * http://www.st.com/web/en/resource/technical/document/reference_manual/DM00124865.pdf
94 * http://www.st.com/resource/en/reference_manual/dm00224583.pdf
96 * STM32F1x series - notice that this code was copy, pasted and knocked
97 * into a stm32f2x driver, so in case something has been converted or
98 * bugs haven't been fixed, here are the original manuals:
100 * RM0008 - Reference manual
102 * RM0042, the Flash programming manual for low-, medium- high-density and
103 * connectivity line STM32F10x devices
105 * PM0068, the Flash programming manual for XL-density STM32F10x devices.
109 /* Erase time can be as high as 1000ms, 10x this and it's toast... */
110 #define FLASH_ERASE_TIMEOUT 10000
111 #define FLASH_WRITE_TIMEOUT 5
113 /* Mass erase time can be as high as 32 s in x8 mode. */
114 #define FLASH_MASS_ERASE_TIMEOUT 33000
116 #define STM32_FLASH_BASE 0x40023c00
117 #define STM32_FLASH_ACR 0x40023c00
118 #define STM32_FLASH_KEYR 0x40023c04
119 #define STM32_FLASH_OPTKEYR 0x40023c08
120 #define STM32_FLASH_SR 0x40023c0C
121 #define STM32_FLASH_CR 0x40023c10
122 #define STM32_FLASH_OPTCR 0x40023c14
123 #define STM32_FLASH_OPTCR1 0x40023c18
125 /* FLASH_CR register bits */
126 #define FLASH_PG (1 << 0)
127 #define FLASH_SER (1 << 1)
128 #define FLASH_MER (1 << 2) /* MER/MER1 for f76x/77x */
129 #define FLASH_MER1 (1 << 15) /* MER2 for f76x/77x, confusing ... */
130 #define FLASH_STRT (1 << 16)
131 #define FLASH_PSIZE_8 (0 << 8)
132 #define FLASH_PSIZE_16 (1 << 8)
133 #define FLASH_PSIZE_32 (2 << 8)
134 #define FLASH_PSIZE_64 (3 << 8)
135 /* The sector number encoding is not straight binary for dual bank flash.
136 * Warning: evaluates the argument multiple times */
137 #define FLASH_SNB(a) ((((a) >= 12) ? 0x10 | ((a) - 12) : (a)) << 3)
138 #define FLASH_LOCK (1 << 31)
140 /* FLASH_SR register bits */
141 #define FLASH_BSY (1 << 16)
142 #define FLASH_PGSERR (1 << 7) /* Programming sequence error */
143 #define FLASH_PGPERR (1 << 6) /* Programming parallelism error */
144 #define FLASH_PGAERR (1 << 5) /* Programming alignment error */
145 #define FLASH_WRPERR (1 << 4) /* Write protection error */
146 #define FLASH_OPERR (1 << 1) /* Operation error */
148 #define FLASH_ERROR (FLASH_PGSERR | FLASH_PGPERR | FLASH_PGAERR | FLASH_WRPERR | FLASH_OPERR)
150 /* STM32_FLASH_OPTCR register bits */
151 #define OPTCR_LOCK (1 << 0)
152 #define OPTCR_START (1 << 1)
153 #define OPTCR_NDBANK (1 << 29) /* not dual bank mode */
154 #define OPTCR_DB1M (1 << 30) /* 1 MiB devices dual flash bank option */
156 /* register unlock keys */
157 #define KEY1 0x45670123
158 #define KEY2 0xCDEF89AB
160 /* option register unlock key */
161 #define OPTKEY1 0x08192A3B
162 #define OPTKEY2 0x4C5D6E7F
164 struct stm32x_options {
166 uint16_t user_options; /* bit 0-7 usual options, bit 8-11 extra options */
171 struct stm32x_flash_bank {
172 struct stm32x_options option_bytes;
174 bool has_large_mem; /* F42x/43x/469/479/7xx in dual bank mode */
175 bool has_boot_addr; /* F7xx */
176 bool has_extra_options; /* F42x/43x/469/479/7xx */
177 uint32_t user_bank_size;
180 /* flash bank stm32x <base> <size> 0 0 <target#>
182 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
184 struct stm32x_flash_bank *stm32x_info;
187 return ERROR_COMMAND_SYNTAX_ERROR;
189 stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
190 bank->driver_priv = stm32x_info;
192 stm32x_info->probed = 0;
193 stm32x_info->user_bank_size = bank->size;
198 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
203 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
205 struct target *target = bank->target;
206 return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
209 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
211 struct target *target = bank->target;
213 int retval = ERROR_OK;
215 /* wait for busy to clear */
217 retval = stm32x_get_flash_status(bank, &status);
218 if (retval != ERROR_OK)
220 LOG_DEBUG("status: 0x%" PRIx32 "", status);
221 if ((status & FLASH_BSY) == 0)
223 if (timeout-- <= 0) {
224 LOG_ERROR("timed out waiting for flash");
231 if (status & FLASH_WRPERR) {
232 LOG_ERROR("stm32x device protected");
236 /* Clear but report errors */
237 if (status & FLASH_ERROR) {
238 /* If this operation fails, we ignore it and report the original
241 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
242 status & FLASH_ERROR);
247 static int stm32x_unlock_reg(struct target *target)
251 /* first check if not already unlocked
252 * otherwise writing on STM32_FLASH_KEYR will fail
254 int retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
255 if (retval != ERROR_OK)
258 if ((ctrl & FLASH_LOCK) == 0)
261 /* unlock flash registers */
262 retval = target_write_u32(target, STM32_FLASH_KEYR, KEY1);
263 if (retval != ERROR_OK)
266 retval = target_write_u32(target, STM32_FLASH_KEYR, KEY2);
267 if (retval != ERROR_OK)
270 retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
271 if (retval != ERROR_OK)
274 if (ctrl & FLASH_LOCK) {
275 LOG_ERROR("flash not unlocked STM32_FLASH_CR: %" PRIx32, ctrl);
276 return ERROR_TARGET_FAILURE;
282 static int stm32x_unlock_option_reg(struct target *target)
286 int retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
287 if (retval != ERROR_OK)
290 if ((ctrl & OPTCR_LOCK) == 0)
293 /* unlock option registers */
294 retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY1);
295 if (retval != ERROR_OK)
298 retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY2);
299 if (retval != ERROR_OK)
302 retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
303 if (retval != ERROR_OK)
306 if (ctrl & OPTCR_LOCK) {
307 LOG_ERROR("options not unlocked STM32_FLASH_OPTCR: %" PRIx32, ctrl);
308 return ERROR_TARGET_FAILURE;
314 static int stm32x_read_options(struct flash_bank *bank)
317 struct stm32x_flash_bank *stm32x_info = NULL;
318 struct target *target = bank->target;
320 stm32x_info = bank->driver_priv;
322 /* read current option bytes */
323 int retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
324 if (retval != ERROR_OK)
327 /* caution: F2 implements 5 bits (WDG_SW only)
328 * whereas F7 6 bits (IWDG_SW and WWDG_SW) in user_options */
329 stm32x_info->option_bytes.user_options = optiondata & 0xfc;
330 stm32x_info->option_bytes.RDP = (optiondata >> 8) & 0xff;
331 stm32x_info->option_bytes.protection = (optiondata >> 16) & 0xfff;
333 if (stm32x_info->has_extra_options) {
334 /* F42x/43x/469/479 and 7xx have up to 4 bits of extra options */
335 stm32x_info->option_bytes.user_options |= (optiondata >> 20) & 0xf00;
338 if (stm32x_info->has_large_mem || stm32x_info->has_boot_addr) {
339 retval = target_read_u32(target, STM32_FLASH_OPTCR1, &optiondata);
340 if (retval != ERROR_OK)
343 /* FLASH_OPTCR1 has quite diffent meanings ... */
344 if (stm32x_info->has_boot_addr) {
345 /* for F7xx it contains boot0 and boot1 */
346 stm32x_info->option_bytes.boot_addr = optiondata;
348 /* for F42x/43x/469/479 it contains 12 additional protection bits */
349 stm32x_info->option_bytes.protection |= (optiondata >> 4) & 0x00fff000;
353 if (stm32x_info->option_bytes.RDP != 0xAA)
354 LOG_INFO("Device Security Bit Set");
359 static int stm32x_write_options(struct flash_bank *bank)
361 struct stm32x_flash_bank *stm32x_info = NULL;
362 struct target *target = bank->target;
363 uint32_t optiondata, optiondata2;
365 stm32x_info = bank->driver_priv;
367 int retval = stm32x_unlock_option_reg(target);
368 if (retval != ERROR_OK)
371 /* rebuild option data */
372 optiondata = stm32x_info->option_bytes.user_options & 0xfc;
373 optiondata |= stm32x_info->option_bytes.RDP << 8;
374 optiondata |= (stm32x_info->option_bytes.protection & 0x0fff) << 16;
376 if (stm32x_info->has_extra_options) {
377 /* F42x/43x/469/479 and 7xx have up to 4 bits of extra options */
378 optiondata |= (stm32x_info->option_bytes.user_options & 0xf00) << 20;
381 if (stm32x_info->has_large_mem || stm32x_info->has_boot_addr) {
382 if (stm32x_info->has_boot_addr) {
383 /* F7xx uses FLASH_OPTCR1 for boot0 and boot1 ... */
384 optiondata2 = stm32x_info->option_bytes.boot_addr;
386 /* F42x/43x/469/479 uses FLASH_OPTCR1 for additional protection bits */
387 optiondata2 = (stm32x_info->option_bytes.protection & 0x00fff000) << 4;
390 retval = target_write_u32(target, STM32_FLASH_OPTCR1, optiondata2);
391 if (retval != ERROR_OK)
395 /* program options */
396 retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata);
397 if (retval != ERROR_OK)
400 /* start programming cycle */
401 retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPTCR_START);
402 if (retval != ERROR_OK)
405 /* wait for completion, this might trigger a security erase and take a while */
406 retval = stm32x_wait_status_busy(bank, FLASH_MASS_ERASE_TIMEOUT);
407 if (retval != ERROR_OK)
410 /* relock registers */
411 retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPTCR_LOCK);
412 if (retval != ERROR_OK)
418 static int stm32x_protect_check(struct flash_bank *bank)
420 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
422 /* read write protection settings */
423 int retval = stm32x_read_options(bank);
424 if (retval != ERROR_OK) {
425 LOG_DEBUG("unable to read option bytes");
429 if (stm32x_info->has_boot_addr && stm32x_info->has_large_mem) {
430 /* F76x/77x: bit k protects sectors 2*k and 2*k+1 */
431 for (int i = 0; i < (bank->num_sectors >> 1); i++) {
432 if (stm32x_info->option_bytes.protection & (1 << i)) {
433 bank->sectors[i << 1].is_protected = 0;
434 bank->sectors[(i << 1) + 1].is_protected = 0;
436 bank->sectors[i << 1].is_protected = 1;
437 bank->sectors[(i << 1) + 1].is_protected = 1;
441 /* one protection bit per sector */
442 for (int i = 0; i < bank->num_sectors; i++) {
443 if (stm32x_info->option_bytes.protection & (1 << i))
444 bank->sectors[i].is_protected = 0;
446 bank->sectors[i].is_protected = 1;
453 static int stm32x_erase(struct flash_bank *bank, int first, int last)
455 struct target *target = bank->target;
458 assert((0 <= first) && (first <= last) && (last < bank->num_sectors));
460 if (bank->target->state != TARGET_HALTED) {
461 LOG_ERROR("Target not halted");
462 return ERROR_TARGET_NOT_HALTED;
466 retval = stm32x_unlock_reg(target);
467 if (retval != ERROR_OK)
472 To erase a sector, follow the procedure below:
473 1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
475 2. Set the SER bit and select the sector
476 you wish to erase (SNB) in the FLASH_CR register
477 3. Set the STRT bit in the FLASH_CR register
478 4. Wait for the BSY bit to be cleared
481 for (i = first; i <= last; i++) {
482 retval = target_write_u32(target,
483 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_SER | FLASH_SNB(i) | FLASH_STRT);
484 if (retval != ERROR_OK)
487 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
488 if (retval != ERROR_OK)
491 bank->sectors[i].is_erased = 1;
494 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
495 if (retval != ERROR_OK)
501 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
503 struct target *target = bank->target;
504 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
506 if (target->state != TARGET_HALTED) {
507 LOG_ERROR("Target not halted");
508 return ERROR_TARGET_NOT_HALTED;
511 /* read protection settings */
512 int retval = stm32x_read_options(bank);
513 if (retval != ERROR_OK) {
514 LOG_DEBUG("unable to read option bytes");
518 if (stm32x_info->has_boot_addr && stm32x_info->has_large_mem) {
519 /* F76x/77x: bit k protects sectors 2*k and 2*k+1 */
520 if ((first & 1) != 0 || (last & 1) != 1) {
521 LOG_ERROR("sector protection must be double sector aligned");
529 for (int i = first; i <= last; i++) {
531 stm32x_info->option_bytes.protection &= ~(1 << i);
533 stm32x_info->option_bytes.protection |= (1 << i);
536 retval = stm32x_write_options(bank);
537 if (retval != ERROR_OK)
543 static int stm32x_write_block(struct flash_bank *bank, const uint8_t *buffer,
544 uint32_t offset, uint32_t count)
546 struct target *target = bank->target;
547 uint32_t buffer_size = 16384;
548 struct working_area *write_algorithm;
549 struct working_area *source;
550 uint32_t address = bank->base + offset;
551 struct reg_param reg_params[5];
552 struct armv7m_algorithm armv7m_info;
553 int retval = ERROR_OK;
555 /* see contrib/loaders/flash/stm32f2x.S for src */
557 static const uint8_t stm32x_flash_write_code[] = {
559 0xD0, 0xF8, 0x00, 0x80, /* ldr r8, [r0, #0] */
560 0xB8, 0xF1, 0x00, 0x0F, /* cmp r8, #0 */
561 0x1A, 0xD0, /* beq exit */
562 0x47, 0x68, /* ldr r7, [r0, #4] */
563 0x47, 0x45, /* cmp r7, r8 */
564 0xF7, 0xD0, /* beq wait_fifo */
566 0xDF, 0xF8, 0x34, 0x60, /* ldr r6, STM32_PROG16 */
567 0x26, 0x61, /* str r6, [r4, #STM32_FLASH_CR_OFFSET] */
568 0x37, 0xF8, 0x02, 0x6B, /* ldrh r6, [r7], #0x02 */
569 0x22, 0xF8, 0x02, 0x6B, /* strh r6, [r2], #0x02 */
570 0xBF, 0xF3, 0x4F, 0x8F, /* dsb sy */
572 0xE6, 0x68, /* ldr r6, [r4, #STM32_FLASH_SR_OFFSET] */
573 0x16, 0xF4, 0x80, 0x3F, /* tst r6, #0x10000 */
574 0xFB, 0xD1, /* bne busy */
575 0x16, 0xF0, 0xF0, 0x0F, /* tst r6, #0xf0 */
576 0x07, 0xD1, /* bne error */
578 0x8F, 0x42, /* cmp r7, r1 */
579 0x28, 0xBF, /* it cs */
580 0x00, 0xF1, 0x08, 0x07, /* addcs r7, r0, #8 */
581 0x47, 0x60, /* str r7, [r0, #4] */
582 0x01, 0x3B, /* subs r3, r3, #1 */
583 0x13, 0xB1, /* cbz r3, exit */
584 0xDF, 0xE7, /* b wait_fifo */
586 0x00, 0x21, /* movs r1, #0 */
587 0x41, 0x60, /* str r1, [r0, #4] */
589 0x30, 0x46, /* mov r0, r6 */
590 0x00, 0xBE, /* bkpt #0x00 */
592 /* <STM32_PROG16>: */
593 0x01, 0x01, 0x00, 0x00, /* .word 0x00000101 */
596 if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
597 &write_algorithm) != ERROR_OK) {
598 LOG_WARNING("no working area available, can't do block memory writes");
599 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
602 retval = target_write_buffer(target, write_algorithm->address,
603 sizeof(stm32x_flash_write_code),
604 stm32x_flash_write_code);
605 if (retval != ERROR_OK)
609 while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
611 if (buffer_size <= 256) {
612 /* we already allocated the writing code, but failed to get a
613 * buffer, free the algorithm */
614 target_free_working_area(target, write_algorithm);
616 LOG_WARNING("no large enough working area available, can't do block memory writes");
617 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
621 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
622 armv7m_info.core_mode = ARM_MODE_THREAD;
624 init_reg_param(®_params[0], "r0", 32, PARAM_IN_OUT); /* buffer start, status (out) */
625 init_reg_param(®_params[1], "r1", 32, PARAM_OUT); /* buffer end */
626 init_reg_param(®_params[2], "r2", 32, PARAM_OUT); /* target address */
627 init_reg_param(®_params[3], "r3", 32, PARAM_OUT); /* count (halfword-16bit) */
628 init_reg_param(®_params[4], "r4", 32, PARAM_OUT); /* flash base */
630 buf_set_u32(reg_params[0].value, 0, 32, source->address);
631 buf_set_u32(reg_params[1].value, 0, 32, source->address + source->size);
632 buf_set_u32(reg_params[2].value, 0, 32, address);
633 buf_set_u32(reg_params[3].value, 0, 32, count);
634 buf_set_u32(reg_params[4].value, 0, 32, STM32_FLASH_BASE);
636 retval = target_run_flash_async_algorithm(target, buffer, count, 2,
639 source->address, source->size,
640 write_algorithm->address, 0,
643 if (retval == ERROR_FLASH_OPERATION_FAILED) {
644 LOG_ERROR("error executing stm32x flash write algorithm");
646 uint32_t error = buf_get_u32(reg_params[0].value, 0, 32) & FLASH_ERROR;
648 if (error & FLASH_WRPERR)
649 LOG_ERROR("flash memory write protected");
652 LOG_ERROR("flash write failed = %08" PRIx32, error);
653 /* Clear but report errors */
654 target_write_u32(target, STM32_FLASH_SR, error);
659 target_free_working_area(target, source);
660 target_free_working_area(target, write_algorithm);
662 destroy_reg_param(®_params[0]);
663 destroy_reg_param(®_params[1]);
664 destroy_reg_param(®_params[2]);
665 destroy_reg_param(®_params[3]);
666 destroy_reg_param(®_params[4]);
671 static int stm32x_write(struct flash_bank *bank, const uint8_t *buffer,
672 uint32_t offset, uint32_t count)
674 struct target *target = bank->target;
675 uint32_t words_remaining = (count / 2);
676 uint32_t bytes_remaining = (count & 0x00000001);
677 uint32_t address = bank->base + offset;
678 uint32_t bytes_written = 0;
681 if (bank->target->state != TARGET_HALTED) {
682 LOG_ERROR("Target not halted");
683 return ERROR_TARGET_NOT_HALTED;
687 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
688 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
691 retval = stm32x_unlock_reg(target);
692 if (retval != ERROR_OK)
695 /* multiple half words (2-byte) to be programmed? */
696 if (words_remaining > 0) {
697 /* try using a block write */
698 retval = stm32x_write_block(bank, buffer, offset, words_remaining);
699 if (retval != ERROR_OK) {
700 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
701 /* if block write failed (no sufficient working area),
702 * we use normal (slow) single dword accesses */
703 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
706 buffer += words_remaining * 2;
707 address += words_remaining * 2;
712 if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
717 The Flash memory programming sequence is as follows:
718 1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
720 2. Set the PG bit in the FLASH_CR register
721 3. Perform the data write operation(s) to the desired memory address (inside main
722 memory block or OTP area):
723 – – Half-word access in case of x16 parallelism
724 – Word access in case of x32 parallelism
727 Byte access in case of x8 parallelism
728 Double word access in case of x64 parallelism
729 Wait for the BSY bit to be cleared
731 while (words_remaining > 0) {
733 memcpy(&value, buffer + bytes_written, sizeof(uint16_t));
735 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
736 FLASH_PG | FLASH_PSIZE_16);
737 if (retval != ERROR_OK)
740 retval = target_write_u16(target, address, value);
741 if (retval != ERROR_OK)
744 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
745 if (retval != ERROR_OK)
753 if (bytes_remaining) {
754 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
755 FLASH_PG | FLASH_PSIZE_8);
756 if (retval != ERROR_OK)
758 retval = target_write_u8(target, address, buffer[bytes_written]);
759 if (retval != ERROR_OK)
762 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
763 if (retval != ERROR_OK)
767 return target_write_u32(target, STM32_FLASH_CR, FLASH_LOCK);
770 static int setup_sector(struct flash_bank *bank, int start, int num, int size)
773 for (int i = start; i < (start + num) ; i++) {
774 assert(i < bank->num_sectors);
775 bank->sectors[i].offset = bank->size;
776 bank->sectors[i].size = size;
777 bank->size += bank->sectors[i].size;
778 LOG_DEBUG("sector %d: %dkBytes", i, size >> 10);
784 static void setup_bank(struct flash_bank *bank, int start,
785 uint16_t flash_size_in_kb, uint16_t max_sector_size_in_kb)
789 start = setup_sector(bank, start, 4, (max_sector_size_in_kb / 8) * 1024);
790 start = setup_sector(bank, start, 1, (max_sector_size_in_kb / 2) * 1024);
792 /* remaining sectors all of size max_sector_size_in_kb */
793 remain = (flash_size_in_kb / max_sector_size_in_kb) - 1;
794 start = setup_sector(bank, start, remain, max_sector_size_in_kb * 1024);
797 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
799 /* this checks for a stm32f4x errata issue where a
800 * stm32f2x DBGMCU_IDCODE is incorrectly returned.
801 * If the issue is detected target is forced to stm32f4x Rev A.
802 * Only effects Rev A silicon */
804 struct target *target = bank->target;
807 /* read stm32 device id register */
808 int retval = target_read_u32(target, 0xE0042000, device_id);
809 if (retval != ERROR_OK)
812 if ((*device_id & 0xfff) == 0x411) {
813 /* read CPUID reg to check core type */
814 retval = target_read_u32(target, 0xE000ED00, &cpuid);
815 if (retval != ERROR_OK)
818 /* check for cortex_m4 */
819 if (((cpuid >> 4) & 0xFFF) == 0xC24) {
820 *device_id &= ~((0xFFFF << 16) | 0xfff);
821 *device_id |= (0x1000 << 16) | 0x413;
822 LOG_INFO("stm32f4x errata detected - fixing incorrect MCU_IDCODE");
828 static int stm32x_probe(struct flash_bank *bank)
830 struct target *target = bank->target;
831 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
833 uint16_t flash_size_in_kb;
834 uint32_t flash_size_reg = 0x1FFF7A22;
835 uint16_t max_sector_size_in_kb = 128;
836 uint16_t max_flash_size_in_kb;
838 uint32_t base_address = 0x08000000;
840 stm32x_info->probed = 0;
841 stm32x_info->has_large_mem = false;
842 stm32x_info->has_boot_addr = false;
843 stm32x_info->has_extra_options = false;
845 /* read stm32 device id register */
846 int retval = stm32x_get_device_id(bank, &device_id);
847 if (retval != ERROR_OK)
849 LOG_INFO("device id = 0x%08" PRIx32 "", device_id);
851 /* set max flash size depending on family, id taken from AN2606 */
852 switch (device_id & 0xfff) {
853 case 0x411: /* F20x/21x */
854 case 0x413: /* F40x/41x */
855 max_flash_size_in_kb = 1024;
858 case 0x419: /* F42x/43x */
859 case 0x434: /* F469/479 */
860 stm32x_info->has_extra_options = true;
861 max_flash_size_in_kb = 2048;
864 case 0x423: /* F401xB/C */
865 max_flash_size_in_kb = 256;
868 case 0x421: /* F446 */
869 case 0x431: /* F411 */
870 case 0x433: /* F401xD/E */
871 case 0x441: /* F412 */
872 max_flash_size_in_kb = 512;
875 case 0x458: /* F410 */
876 max_flash_size_in_kb = 128;
879 case 0x449: /* F74x/75x */
880 max_flash_size_in_kb = 1024;
881 max_sector_size_in_kb = 256;
882 flash_size_reg = 0x1FF0F442;
883 stm32x_info->has_extra_options = true;
884 stm32x_info->has_boot_addr = true;
887 case 0x451: /* F76x/77x */
888 max_flash_size_in_kb = 2048;
889 max_sector_size_in_kb = 256;
890 flash_size_reg = 0x1FF0F442;
891 stm32x_info->has_extra_options = true;
892 stm32x_info->has_boot_addr = true;
896 LOG_WARNING("Cannot identify target as a STM32 family.");
900 /* get flash size from target. */
901 retval = target_read_u16(target, flash_size_reg, &flash_size_in_kb);
903 /* failed reading flash size or flash size invalid (early silicon),
904 * default to max target family */
905 if (retval != ERROR_OK || flash_size_in_kb == 0xffff || flash_size_in_kb == 0) {
906 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming %dk flash",
907 max_flash_size_in_kb);
908 flash_size_in_kb = max_flash_size_in_kb;
911 /* if the user sets the size manually then ignore the probed value
912 * this allows us to work around devices that have a invalid flash size register value */
913 if (stm32x_info->user_bank_size) {
914 LOG_INFO("ignoring flash probed value, using configured bank size");
915 flash_size_in_kb = stm32x_info->user_bank_size / 1024;
918 LOG_INFO("flash size = %dkbytes", flash_size_in_kb);
920 /* did we assign flash size? */
921 assert(flash_size_in_kb != 0xffff);
923 /* Devices with > 1024 kiByte always are dual-banked */
924 if (flash_size_in_kb > 1024)
925 stm32x_info->has_large_mem = true;
927 /* F42x/43x/469/479 1024 kiByte devices have a dual bank option */
928 if ((device_id & 0xfff) == 0x419 || (device_id & 0xfff) == 0x434) {
930 retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
931 if (retval != ERROR_OK) {
932 LOG_DEBUG("unable to read option bytes");
935 if ((flash_size_in_kb > 1024) || (optiondata & OPTCR_DB1M)) {
936 stm32x_info->has_large_mem = true;
937 LOG_INFO("Dual Bank %d kiB STM32F42x/43x/469/479 found", flash_size_in_kb);
939 stm32x_info->has_large_mem = false;
940 LOG_INFO("Single Bank %d kiB STM32F42x/43x/469/479 found", flash_size_in_kb);
944 /* F76x/77x devices have a dual bank option */
945 if ((device_id & 0xfff) == 0x451) {
947 retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
948 if (retval != ERROR_OK) {
949 LOG_DEBUG("unable to read option bytes");
952 if (optiondata & OPTCR_NDBANK) {
953 stm32x_info->has_large_mem = false;
954 LOG_INFO("Single Bank %d kiB STM32F76x/77x found", flash_size_in_kb);
956 stm32x_info->has_large_mem = true;
957 max_sector_size_in_kb >>= 1; /* sector size divided by 2 in dual-bank mode */
958 LOG_INFO("Dual Bank %d kiB STM32F76x/77x found", flash_size_in_kb);
962 /* calculate numbers of pages */
963 int num_pages = flash_size_in_kb / max_sector_size_in_kb
964 + (stm32x_info->has_large_mem ? 8 : 4);
968 bank->sectors = NULL;
971 bank->base = base_address;
972 bank->num_sectors = num_pages;
973 bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
974 for (i = 0; i < num_pages; i++) {
975 bank->sectors[i].is_erased = -1;
976 bank->sectors[i].is_protected = 0;
979 LOG_DEBUG("allocated %d sectors", num_pages);
981 if (stm32x_info->has_large_mem) {
983 setup_bank(bank, 0, flash_size_in_kb >> 1, max_sector_size_in_kb);
984 setup_bank(bank, num_pages >> 1, flash_size_in_kb >> 1,
985 max_sector_size_in_kb);
988 setup_bank(bank, 0, flash_size_in_kb, max_sector_size_in_kb);
990 assert((bank->size >> 10) == flash_size_in_kb);
992 stm32x_info->probed = 1;
996 static int stm32x_auto_probe(struct flash_bank *bank)
998 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
999 if (stm32x_info->probed)
1001 return stm32x_probe(bank);
1004 static int get_stm32x_info(struct flash_bank *bank, char *buf, int buf_size)
1006 uint32_t dbgmcu_idcode;
1008 /* read stm32 device id register */
1009 int retval = stm32x_get_device_id(bank, &dbgmcu_idcode);
1010 if (retval != ERROR_OK)
1013 uint16_t device_id = dbgmcu_idcode & 0xfff;
1014 uint16_t rev_id = dbgmcu_idcode >> 16;
1015 const char *device_str;
1016 const char *rev_str = NULL;
1018 switch (device_id) {
1020 device_str = "STM32F2xx";
1060 device_str = "STM32F4xx";
1086 device_str = "STM32F446";
1100 device_str = "STM32F4xx (Low Power)";
1114 device_str = "STM32F7[4|5]x";
1128 device_str = "STM32F7[6|7]x";
1138 snprintf(buf, buf_size, "Cannot identify target as a STM32F2/4/7\n");
1142 if (rev_str != NULL)
1143 snprintf(buf, buf_size, "%s - Rev: %s", device_str, rev_str);
1145 snprintf(buf, buf_size, "%s - Rev: unknown (0x%04x)", device_str, rev_id);
1150 COMMAND_HANDLER(stm32x_handle_lock_command)
1152 struct target *target = NULL;
1153 struct stm32x_flash_bank *stm32x_info = NULL;
1156 return ERROR_COMMAND_SYNTAX_ERROR;
1158 struct flash_bank *bank;
1159 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1160 if (ERROR_OK != retval)
1163 stm32x_info = bank->driver_priv;
1164 target = bank->target;
1166 if (target->state != TARGET_HALTED) {
1167 LOG_ERROR("Target not halted");
1168 return ERROR_TARGET_NOT_HALTED;
1171 if (stm32x_read_options(bank) != ERROR_OK) {
1172 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
1176 /* set readout protection */
1177 stm32x_info->option_bytes.RDP = 0;
1179 if (stm32x_write_options(bank) != ERROR_OK) {
1180 command_print(CMD_CTX, "%s failed to lock device", bank->driver->name);
1184 command_print(CMD_CTX, "%s locked", bank->driver->name);
1189 COMMAND_HANDLER(stm32x_handle_unlock_command)
1191 struct target *target = NULL;
1192 struct stm32x_flash_bank *stm32x_info = NULL;
1195 return ERROR_COMMAND_SYNTAX_ERROR;
1197 struct flash_bank *bank;
1198 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1199 if (ERROR_OK != retval)
1202 stm32x_info = bank->driver_priv;
1203 target = bank->target;
1205 if (target->state != TARGET_HALTED) {
1206 LOG_ERROR("Target not halted");
1207 return ERROR_TARGET_NOT_HALTED;
1210 if (stm32x_read_options(bank) != ERROR_OK) {
1211 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
1215 /* clear readout protection and complementary option bytes
1216 * this will also force a device unlock if set */
1217 stm32x_info->option_bytes.RDP = 0xAA;
1219 if (stm32x_write_options(bank) != ERROR_OK) {
1220 command_print(CMD_CTX, "%s failed to unlock device", bank->driver->name);
1224 command_print(CMD_CTX, "%s unlocked.\n"
1225 "INFO: a reset or power cycle is required "
1226 "for the new settings to take effect.", bank->driver->name);
1231 static int stm32x_mass_erase(struct flash_bank *bank)
1235 struct target *target = bank->target;
1236 struct stm32x_flash_bank *stm32x_info = NULL;
1238 if (target->state != TARGET_HALTED) {
1239 LOG_ERROR("Target not halted");
1240 return ERROR_TARGET_NOT_HALTED;
1243 stm32x_info = bank->driver_priv;
1245 retval = stm32x_unlock_reg(target);
1246 if (retval != ERROR_OK)
1249 /* mass erase flash memory */
1250 if (stm32x_info->has_large_mem)
1251 flash_mer = FLASH_MER | FLASH_MER1;
1253 flash_mer = FLASH_MER;
1255 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), flash_mer);
1256 if (retval != ERROR_OK)
1258 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
1259 flash_mer | FLASH_STRT);
1260 if (retval != ERROR_OK)
1263 retval = stm32x_wait_status_busy(bank, FLASH_MASS_ERASE_TIMEOUT);
1264 if (retval != ERROR_OK)
1267 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
1268 if (retval != ERROR_OK)
1274 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
1279 command_print(CMD_CTX, "stm32x mass_erase <bank>");
1280 return ERROR_COMMAND_SYNTAX_ERROR;
1283 struct flash_bank *bank;
1284 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1285 if (ERROR_OK != retval)
1288 retval = stm32x_mass_erase(bank);
1289 if (retval == ERROR_OK) {
1290 /* set all sectors as erased */
1291 for (i = 0; i < bank->num_sectors; i++)
1292 bank->sectors[i].is_erased = 1;
1294 command_print(CMD_CTX, "stm32x mass erase complete");
1296 command_print(CMD_CTX, "stm32x mass erase failed");
1302 COMMAND_HANDLER(stm32f2x_handle_options_read_command)
1305 struct flash_bank *bank;
1306 struct stm32x_flash_bank *stm32x_info = NULL;
1308 if (CMD_ARGC != 1) {
1309 command_print(CMD_CTX, "stm32f2x options_read <bank>");
1310 return ERROR_COMMAND_SYNTAX_ERROR;
1313 retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1314 if (ERROR_OK != retval)
1317 retval = stm32x_read_options(bank);
1318 if (ERROR_OK != retval)
1321 stm32x_info = bank->driver_priv;
1322 if (stm32x_info->has_extra_options) {
1323 if (stm32x_info->has_boot_addr) {
1324 uint32_t boot_addr = stm32x_info->option_bytes.boot_addr;
1326 command_print(CMD_CTX, "stm32f2x user_options 0x%03X,"
1327 " boot_add0 0x%04X, boot_add1 0x%04X",
1328 stm32x_info->option_bytes.user_options,
1329 boot_addr & 0xffff, (boot_addr & 0xffff0000) >> 16);
1331 command_print(CMD_CTX, "stm32f2x user_options 0x%03X,",
1332 stm32x_info->option_bytes.user_options);
1335 command_print(CMD_CTX, "stm32f2x user_options 0x%02X",
1336 stm32x_info->option_bytes.user_options);
1343 COMMAND_HANDLER(stm32f2x_handle_options_write_command)
1346 struct flash_bank *bank;
1347 struct stm32x_flash_bank *stm32x_info = NULL;
1348 uint16_t user_options, boot_addr0, boot_addr1;
1351 command_print(CMD_CTX, "stm32f2x options_write <bank> ...");
1352 return ERROR_COMMAND_SYNTAX_ERROR;
1355 retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1356 if (ERROR_OK != retval)
1359 retval = stm32x_read_options(bank);
1360 if (ERROR_OK != retval)
1363 stm32x_info = bank->driver_priv;
1364 if (stm32x_info->has_boot_addr) {
1365 if (CMD_ARGC != 4) {
1366 command_print(CMD_CTX, "stm32f2x options_write <bank> <user_options>"
1367 " <boot_addr0> <boot_addr1>");
1368 return ERROR_COMMAND_SYNTAX_ERROR;
1370 COMMAND_PARSE_NUMBER(u16, CMD_ARGV[2], boot_addr0);
1371 COMMAND_PARSE_NUMBER(u16, CMD_ARGV[3], boot_addr1);
1372 stm32x_info->option_bytes.boot_addr = boot_addr0 | (((uint32_t) boot_addr1) << 16);
1374 if (CMD_ARGC != 2) {
1375 command_print(CMD_CTX, "stm32f2x options_write <bank> <user_options>");
1376 return ERROR_COMMAND_SYNTAX_ERROR;
1380 COMMAND_PARSE_NUMBER(u16, CMD_ARGV[1], user_options);
1381 if (user_options & (stm32x_info->has_extra_options ? ~0xffc : ~0xfc)) {
1382 command_print(CMD_CTX, "stm32f2x invalid user_options");
1383 return ERROR_COMMAND_SYNTAX_ERROR;
1386 stm32x_info->option_bytes.user_options = user_options;
1388 if (stm32x_write_options(bank) != ERROR_OK) {
1389 command_print(CMD_CTX, "stm32f2x failed to write options");
1393 /* switching between single- and dual-bank modes requires re-probe */
1394 /* ... and reprogramming of whole flash */
1395 stm32x_info->probed = 0;
1397 command_print(CMD_CTX, "stm32f2x write options complete.\n"
1398 "INFO: a reset or power cycle is required "
1399 "for the new settings to take effect.");
1403 static const struct command_registration stm32x_exec_command_handlers[] = {
1406 .handler = stm32x_handle_lock_command,
1407 .mode = COMMAND_EXEC,
1409 .help = "Lock entire flash device.",
1413 .handler = stm32x_handle_unlock_command,
1414 .mode = COMMAND_EXEC,
1416 .help = "Unlock entire protected flash device.",
1419 .name = "mass_erase",
1420 .handler = stm32x_handle_mass_erase_command,
1421 .mode = COMMAND_EXEC,
1423 .help = "Erase entire flash device.",
1426 .name = "options_read",
1427 .handler = stm32f2x_handle_options_read_command,
1428 .mode = COMMAND_EXEC,
1430 .help = "Read and display device option bytes.",
1433 .name = "options_write",
1434 .handler = stm32f2x_handle_options_write_command,
1435 .mode = COMMAND_EXEC,
1436 .usage = "bank_id user_options [ boot_add0 boot_add1]",
1437 .help = "Write option bytes",
1439 COMMAND_REGISTRATION_DONE
1442 static const struct command_registration stm32x_command_handlers[] = {
1445 .mode = COMMAND_ANY,
1446 .help = "stm32f2x flash command group",
1448 .chain = stm32x_exec_command_handlers,
1450 COMMAND_REGISTRATION_DONE
1453 struct flash_driver stm32f2x_flash = {
1455 .commands = stm32x_command_handlers,
1456 .flash_bank_command = stm32x_flash_bank_command,
1457 .erase = stm32x_erase,
1458 .protect = stm32x_protect,
1459 .write = stm32x_write,
1460 .read = default_flash_read,
1461 .probe = stm32x_probe,
1462 .auto_probe = stm32x_auto_probe,
1463 .erase_check = default_flash_blank_check,
1464 .protect_check = stm32x_protect_check,
1465 .info = get_stm32x_info,