1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2008 by Spencer Oliver *
6 * spen@spen-soft.co.uk *
8 * Copyright (C) 2011 Øyvind Harboe *
9 * oyvind.harboe@zylin.com *
11 * This program is free software; you can redistribute it and/or modify *
12 * it under the terms of the GNU General Public License as published by *
13 * the Free Software Foundation; either version 2 of the License, or *
14 * (at your option) any later version. *
16 * This program is distributed in the hope that it will be useful, *
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
19 * GNU General Public License for more details. *
21 * You should have received a copy of the GNU General Public License *
22 * along with this program; if not, write to the *
23 * Free Software Foundation, Inc., *
24 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
25 ***************************************************************************/
31 #include <helper/binarybuffer.h>
32 #include <target/algorithm.h>
33 #include <target/armv7m.h>
35 /* Regarding performance:
37 * Short story - it might be best to leave the performance at
40 * You may see a jump in speed if you change to using
41 * 32bit words for the block programming.
43 * Its a shame you cannot use the double word as its
44 * even faster - but you require external VPP for that mode.
46 * Having said all that 16bit writes give us the widest vdd
47 * operating range, so may be worth adding a note to that effect.
51 /* Danger!!!! The STM32F1x and STM32F2x series actually have
52 * quite different flash controllers.
54 * What's more scary is that the names of the registers and their
55 * addresses are the same, but the actual bits and what they do are
56 * can be very different.
58 * To reduce testing complexity and dangers of regressions,
59 * a seperate file is used for stm32fx2x.
61 * 1mByte part with 4 x 16, 1 x 64, 7 x 128kBytes sectors
63 * What's the protection page size???
65 * Tested with STM3220F-EVAL board.
67 * STM32F21xx series for reference.
70 * http://www.st.com/internet/mcu/product/250192.jsp
73 * www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/PROGRAMMING_MANUAL/CD00233952.pdf
75 * STM32F1x series - notice that this code was copy, pasted and knocked
76 * into a stm32f2x driver, so in case something has been converted or
77 * bugs haven't been fixed, here are the original manuals:
79 * RM0008 - Reference manual
81 * RM0042, the Flash programming manual for low-, medium- high-density and
82 * connectivity line STM32F10x devices
84 * PM0068, the Flash programming manual for XL-density STM32F10x devices.
88 // Erase time can be as high as 1000ms, 10x this and it's toast...
89 #define FLASH_ERASE_TIMEOUT 10000
90 #define FLASH_WRITE_TIMEOUT 5
93 #define STM32_FLASH_BASE 0x40023c00
94 #define STM32_FLASH_ACR 0x40023c00
95 #define STM32_FLASH_KEYR 0x40023c04
96 #define STM32_FLASH_OPTKEYR 0x40023c08
97 #define STM32_FLASH_SR 0x40023c0C
98 #define STM32_FLASH_CR 0x40023c10
99 #define STM32_FLASH_OPTCR 0x40023c14
100 #define STM32_FLASH_OBR 0x40023c1C
104 /* option byte location */
106 #define STM32_OB_RDP 0x1FFFF800
107 #define STM32_OB_USER 0x1FFFF802
108 #define STM32_OB_DATA0 0x1FFFF804
109 #define STM32_OB_DATA1 0x1FFFF806
110 #define STM32_OB_WRP0 0x1FFFF808
111 #define STM32_OB_WRP1 0x1FFFF80A
112 #define STM32_OB_WRP2 0x1FFFF80C
113 #define STM32_OB_WRP3 0x1FFFF80E
115 /* FLASH_CR register bits */
117 #define FLASH_PG (1 << 0)
118 #define FLASH_SER (1 << 1)
119 #define FLASH_MER (1 << 2)
120 #define FLASH_STRT (1 << 16)
121 #define FLASH_PSIZE_8 (0 << 8)
122 #define FLASH_PSIZE_16 (1 << 8)
123 #define FLASH_PSIZE_32 (2 << 8)
124 #define FLASH_PSIZE_64 (3 << 8)
125 #define FLASH_SNB(a) ((a) << 3)
126 #define FLASH_LOCK (1 << 31)
128 /* FLASH_SR register bits */
130 #define FLASH_BSY (1 << 16)
131 #define FLASH_PGSERR (1 << 7) // Programming sequence error
132 #define FLASH_PGPERR (1 << 6) // Programming parallelism error
133 #define FLASH_PGAERR (1 << 5) // Programming alignment error
134 #define FLASH_WRPERR (1 << 4) // Write protection error
135 #define FLASH_OPERR (1 << 1) // Operation error
137 #define FLASH_ERROR (FLASH_PGSERR | FLASH_PGPERR | FLASH_PGAERR| FLASH_WRPERR| FLASH_OPERR)
139 /* STM32_FLASH_OBR bit definitions (reading) */
142 #define OPT_READOUT 1
143 #define OPT_RDWDGSW 2
144 #define OPT_RDRSTSTOP 3
145 #define OPT_RDRSTSTDBY 4
146 #define OPT_BFB2 5 /* dual flash bank only */
148 /* register unlock keys */
150 #define KEY1 0x45670123
151 #define KEY2 0xCDEF89AB
153 struct stm32x_flash_bank
155 struct working_area *write_algorithm;
160 /* flash bank stm32x <base> <size> 0 0 <target#>
162 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
164 struct stm32x_flash_bank *stm32x_info;
168 return ERROR_COMMAND_SYNTAX_ERROR;
171 stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
172 bank->driver_priv = stm32x_info;
174 stm32x_info->write_algorithm = NULL;
175 stm32x_info->probed = 0;
180 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
185 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
187 struct target *target = bank->target;
188 return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
191 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
193 struct target *target = bank->target;
195 int retval = ERROR_OK;
197 /* wait for busy to clear */
200 retval = stm32x_get_flash_status(bank, &status);
201 if (retval != ERROR_OK)
203 LOG_DEBUG("status: 0x%" PRIx32 "", status);
204 if ((status & FLASH_BSY) == 0)
208 LOG_ERROR("timed out waiting for flash");
215 if (status & FLASH_WRPERR)
217 LOG_ERROR("stm32x device protected");
221 /* Clear but report errors */
222 if (status & FLASH_ERROR)
224 /* If this operation fails, we ignore it and report the original
227 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
228 status & FLASH_ERROR);
233 static int stm32x_unlock_reg(struct target *target)
237 /* unlock flash registers */
238 int retval = target_write_u32(target, STM32_FLASH_KEYR, KEY1);
239 if (retval != ERROR_OK)
242 retval = target_write_u32(target, STM32_FLASH_KEYR, KEY2);
243 if (retval != ERROR_OK)
246 retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
247 if (retval != ERROR_OK)
250 if (ctrl & FLASH_LOCK) {
251 LOG_ERROR("flash not unlocked STM32_FLASH_CR: %x", ctrl);
252 return ERROR_TARGET_FAILURE;
258 static int stm32x_protect_check(struct flash_bank *bank)
263 static int stm32x_erase(struct flash_bank *bank, int first, int last)
265 struct target *target = bank->target;
268 if (bank->target->state != TARGET_HALTED)
270 LOG_ERROR("Target not halted");
271 return ERROR_TARGET_NOT_HALTED;
275 retval = stm32x_unlock_reg(target);
276 if (retval != ERROR_OK)
281 To erase a sector, follow the procedure below:
282 1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
284 2. Set the SER bit and select the sector (out of the 12 sectors in the main memory block)
285 you wish to erase (SNB) in the FLASH_CR register
286 3. Set the STRT bit in the FLASH_CR register
287 4. Wait for the BSY bit to be cleared
290 for (i = first; i <= last; i++)
292 retval = target_write_u32(target,
293 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_SER | FLASH_SNB(i) | FLASH_STRT);
294 if (retval != ERROR_OK)
297 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
298 if (retval != ERROR_OK)
301 bank->sectors[i].is_erased = 1;
304 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
305 if (retval != ERROR_OK)
311 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
316 static int stm32x_write_block(struct flash_bank *bank, uint8_t *buffer,
317 uint32_t offset, uint32_t count)
319 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
320 struct target *target = bank->target;
321 uint32_t buffer_size = 16384;
322 struct working_area *source;
323 uint32_t address = bank->base + offset;
324 struct reg_param reg_params[5];
325 struct armv7m_algorithm armv7m_info;
326 int retval = ERROR_OK;
328 /* see contrib/loaders/flash/stm32f2x.S for src */
330 static const uint16_t stm32x_flash_write_code_16[] = {
331 /* 00000000 <write>: */
332 0x4b07, /* ldr r3, [pc, #28] (20 <STM32_PROG16>) */
333 0x6123, /* str r3, [r4, #16] */
334 0xf830, 0x3b02, /* ldrh.w r3, [r0], #2 */
335 0xf821, 0x3b02, /* strh.w r3, [r1], #2 */
337 /* 0000000c <busy>: */
338 0x68e3, /* ldr r3, [r4, #12] */
339 0xf413, 0x3f80, /* tst.w r3, #65536 ; 0x10000 */
340 0xd0fb, /* beq.n c <busy> */
341 0xf013, 0x0ff0, /* tst.w r3, #240 ; 0xf0 */
342 0xd101, /* bne.n 1e <exit> */
343 0x3a01, /* subs r2, #1 */
344 0xd1f0, /* bne.n 0 <write> */
345 /* 0000001e <exit>: */
346 0xbe00, /* bkpt 0x0000 */
348 /* 00000020 <STM32_PROG16>: */
349 0x0101, 0x0000, /* .word 0x00000101 */
353 uint8_t stm32x_flash_write_code[sizeof(stm32x_flash_write_code_16)*2];
354 for (unsigned i = 0; i < sizeof(stm32x_flash_write_code_16) / 2; i++)
356 stm32x_flash_write_code[i*2 + 0] = stm32x_flash_write_code_16[i] & 0xff;
357 stm32x_flash_write_code[i*2 + 1] = (stm32x_flash_write_code_16[i] >> 8) & 0xff;
360 if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
361 &stm32x_info->write_algorithm) != ERROR_OK)
363 LOG_WARNING("no working area available, can't do block memory writes");
364 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
367 if ((retval = target_write_buffer(target, stm32x_info->write_algorithm->address,
368 sizeof(stm32x_flash_write_code),
369 (uint8_t*)stm32x_flash_write_code)) != ERROR_OK)
373 while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK)
376 if (buffer_size <= 256)
378 /* if we already allocated the writing code, but failed to get a
379 * buffer, free the algorithm */
380 if (stm32x_info->write_algorithm)
381 target_free_working_area(target, stm32x_info->write_algorithm);
383 LOG_WARNING("no large enough working area available, can't do block memory writes");
384 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
388 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
389 armv7m_info.core_mode = ARMV7M_MODE_ANY;
391 init_reg_param(®_params[0], "r0", 32, PARAM_OUT);
392 init_reg_param(®_params[1], "r1", 32, PARAM_OUT);
393 init_reg_param(®_params[2], "r2", 32, PARAM_OUT);
394 init_reg_param(®_params[3], "r3", 32, PARAM_IN_OUT);
395 init_reg_param(®_params[4], "r4", 32, PARAM_OUT);
399 uint32_t thisrun_count = (count > (buffer_size / 2)) ?
400 (buffer_size / 2) : count;
402 if ((retval = target_write_buffer(target, source->address,
403 thisrun_count * 2, buffer)) != ERROR_OK)
406 buf_set_u32(reg_params[0].value, 0, 32, source->address);
407 buf_set_u32(reg_params[1].value, 0, 32, address);
408 buf_set_u32(reg_params[2].value, 0, 32, thisrun_count);
409 // R3 is a return value only
410 buf_set_u32(reg_params[4].value, 0, 32, STM32_FLASH_BASE);
412 if ((retval = target_run_algorithm(target, 0, NULL,
413 sizeof(reg_params) / sizeof(*reg_params),
415 stm32x_info->write_algorithm->address,
417 10000, &armv7m_info)) != ERROR_OK)
419 LOG_ERROR("error executing stm32x flash write algorithm");
423 uint32_t error = buf_get_u32(reg_params[3].value, 0, 32) & FLASH_ERROR;
425 if (error & FLASH_WRPERR)
427 LOG_ERROR("flash memory write protected");
432 LOG_ERROR("flash write failed = %08x", error);
433 /* Clear but report errors */
434 target_write_u32(target, STM32_FLASH_SR, error);
439 buffer += thisrun_count * 2;
440 address += thisrun_count * 2;
441 count -= thisrun_count;
444 target_free_working_area(target, source);
445 target_free_working_area(target, stm32x_info->write_algorithm);
447 destroy_reg_param(®_params[0]);
448 destroy_reg_param(®_params[1]);
449 destroy_reg_param(®_params[2]);
450 destroy_reg_param(®_params[3]);
451 destroy_reg_param(®_params[4]);
456 static int stm32x_write(struct flash_bank *bank, uint8_t *buffer,
457 uint32_t offset, uint32_t count)
459 struct target *target = bank->target;
460 uint32_t words_remaining = (count / 2);
461 uint32_t bytes_remaining = (count & 0x00000001);
462 uint32_t address = bank->base + offset;
463 uint32_t bytes_written = 0;
466 if (bank->target->state != TARGET_HALTED)
468 LOG_ERROR("Target not halted");
469 return ERROR_TARGET_NOT_HALTED;
474 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
475 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
478 retval = stm32x_unlock_reg(target);
479 if (retval != ERROR_OK)
482 /* multiple half words (2-byte) to be programmed? */
483 if (words_remaining > 0)
485 /* try using a block write */
486 if ((retval = stm32x_write_block(bank, buffer, offset, words_remaining)) != ERROR_OK)
488 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE)
490 /* if block write failed (no sufficient working area),
491 * we use normal (slow) single dword accesses */
492 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
497 buffer += words_remaining * 2;
498 address += words_remaining * 2;
503 if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
508 The Flash memory programming sequence is as follows:
509 1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
511 2. Set the PG bit in the FLASH_CR register
512 3. Perform the data write operation(s) to the desired memory address (inside main
513 memory block or OTP area):
514 – – Half-word access in case of x16 parallelism
515 – Word access in case of x32 parallelism
518 Byte access in case of x8 parallelism
519 Double word access in case of x64 parallelism
520 Wait for the BSY bit to be cleared
522 while (words_remaining > 0)
525 memcpy(&value, buffer + bytes_written, sizeof(uint16_t));
527 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
528 FLASH_PG | FLASH_PSIZE_16);
529 if (retval != ERROR_OK)
532 retval = target_write_u16(target, address, value);
533 if (retval != ERROR_OK)
536 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
537 if (retval != ERROR_OK)
547 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
548 FLASH_PG | FLASH_PSIZE_8);
549 if (retval != ERROR_OK)
551 retval = target_write_u8(target, address, buffer[bytes_written]);
552 if (retval != ERROR_OK)
555 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
556 if (retval != ERROR_OK)
560 return target_write_u32(target, STM32_FLASH_CR, FLASH_LOCK);
563 static void setup_sector(struct flash_bank *bank, int start, int num, int size)
565 for (int i = start; i < (start + num) ; i++)
567 bank->sectors[i].offset = bank->size;
568 bank->sectors[i].size = size;
569 bank->size += bank->sectors[i].size;
573 static int stm32x_probe(struct flash_bank *bank)
575 struct target *target = bank->target;
576 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
578 uint16_t flash_size_in_kb;
580 uint32_t base_address = 0x08000000;
582 stm32x_info->probed = 0;
584 /* read stm32 device id register */
585 int retval = target_read_u32(target, 0xE0042000, &device_id);
586 if (retval != ERROR_OK)
588 LOG_INFO("device id = 0x%08" PRIx32 "", device_id);
590 /* get flash size from target. */
591 retval = target_read_u16(target, 0x1FFF7A10, &flash_size_in_kb);
592 if (retval != ERROR_OK) {
593 LOG_WARNING("failed reading flash size, default to max target family");
594 /* failed reading flash size, default to max target family */
595 flash_size_in_kb = 0xffff;
598 if ((device_id & 0x7ff) == 0x411) {
599 /* check for early silicon */
600 if (flash_size_in_kb == 0xffff) {
601 /* number of sectors may be incorrrect on early silicon */
602 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming 512k flash");
603 flash_size_in_kb = 512;
605 } else if ((device_id & 0x7ff) == 0x413) {
606 /* check for early silicon */
607 if (flash_size_in_kb == 0xffff) {
608 /* number of sectors may be incorrrect on early silicon */
609 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming 512k flash");
610 flash_size_in_kb = 512;
613 LOG_WARNING("Cannot identify target as a STM32 family.");
617 LOG_INFO("flash size = %dkbytes", flash_size_in_kb);
619 /* did we assign flash size? */
620 assert(flash_size_in_kb != 0xffff);
622 /* calculate numbers of pages */
623 int num_pages = (flash_size_in_kb / 128) + 4;
625 /* check that calculation result makes sense */
626 assert(num_pages > 0);
630 bank->sectors = NULL;
633 bank->base = base_address;
634 bank->num_sectors = num_pages;
635 bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
639 setup_sector(bank, 0, 4, 16 * 1024);
640 setup_sector(bank, 4, 1, 64 * 1024);
643 setup_sector(bank, 4 + 1, num_pages - 5, 128 * 1024);
645 for (i = 0; i < num_pages; i++) {
646 bank->sectors[i].is_erased = -1;
647 bank->sectors[i].is_protected = 0;
650 stm32x_info->probed = 1;
655 static int stm32x_auto_probe(struct flash_bank *bank)
657 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
658 if (stm32x_info->probed)
660 return stm32x_probe(bank);
663 static int get_stm32x_info(struct flash_bank *bank, char *buf, int buf_size)
665 struct target *target = bank->target;
669 /* read stm32 device id register */
670 int retval = target_read_u32(target, 0xE0042000, &device_id);
671 if (retval != ERROR_OK)
674 if ((device_id & 0x7ff) == 0x411) {
675 printed = snprintf(buf, buf_size, "stm32f2x - Rev: ");
679 switch (device_id >> 16) {
681 snprintf(buf, buf_size, "A");
685 snprintf(buf, buf_size, "B");
689 snprintf(buf, buf_size, "Z");
693 snprintf(buf, buf_size, "Y");
697 snprintf(buf, buf_size, "unknown");
700 } else if ((device_id & 0x7ff) == 0x413) {
701 printed = snprintf(buf, buf_size, "stm32f4x - Rev: ");
705 switch (device_id >> 16) {
707 snprintf(buf, buf_size, "A");
711 snprintf(buf, buf_size, "unknown");
715 snprintf(buf, buf_size, "Cannot identify target as a stm32x\n");
722 static int stm32x_mass_erase(struct flash_bank *bank)
725 struct target *target = bank->target;
727 if (target->state != TARGET_HALTED) {
728 LOG_ERROR("Target not halted");
729 return ERROR_TARGET_NOT_HALTED;
732 retval = stm32x_unlock_reg(target);
733 if (retval != ERROR_OK)
736 /* mass erase flash memory */
737 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER);
738 if (retval != ERROR_OK)
740 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
741 FLASH_MER | FLASH_STRT);
742 if (retval != ERROR_OK)
745 retval = stm32x_wait_status_busy(bank, 30000);
746 if (retval != ERROR_OK)
749 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
750 if (retval != ERROR_OK)
756 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
761 command_print(CMD_CTX, "stm32x mass_erase <bank>");
762 return ERROR_COMMAND_SYNTAX_ERROR;
765 struct flash_bank *bank;
766 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
767 if (ERROR_OK != retval)
770 retval = stm32x_mass_erase(bank);
771 if (retval == ERROR_OK) {
772 /* set all sectors as erased */
773 for (i = 0; i < bank->num_sectors; i++)
774 bank->sectors[i].is_erased = 1;
776 command_print(CMD_CTX, "stm32x mass erase complete");
778 command_print(CMD_CTX, "stm32x mass erase failed");
784 static const struct command_registration stm32x_exec_command_handlers[] = {
786 .name = "mass_erase",
787 .handler = stm32x_handle_mass_erase_command,
788 .mode = COMMAND_EXEC,
790 .help = "Erase entire flash device.",
792 COMMAND_REGISTRATION_DONE
795 static const struct command_registration stm32x_command_handlers[] = {
799 .help = "stm32f2x flash command group",
800 .chain = stm32x_exec_command_handlers,
802 COMMAND_REGISTRATION_DONE
805 struct flash_driver stm32f2x_flash = {
807 .commands = stm32x_command_handlers,
808 .flash_bank_command = stm32x_flash_bank_command,
809 .erase = stm32x_erase,
810 .protect = stm32x_protect,
811 .write = stm32x_write,
812 .read = default_flash_read,
813 .probe = stm32x_probe,
814 .auto_probe = stm32x_auto_probe,
815 .erase_check = default_flash_mem_blank_check,
816 .protect_check = stm32x_protect_check,
817 .info = get_stm32x_info,