1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2008 by Spencer Oliver *
6 * spen@spen-soft.co.uk *
8 * Copyright (C) 2011 Øyvind Harboe *
9 * oyvind.harboe@zylin.com *
11 * This program is free software; you can redistribute it and/or modify *
12 * it under the terms of the GNU General Public License as published by *
13 * the Free Software Foundation; either version 2 of the License, or *
14 * (at your option) any later version. *
16 * This program is distributed in the hope that it will be useful, *
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
19 * GNU General Public License for more details. *
21 * You should have received a copy of the GNU General Public License *
22 * along with this program; if not, write to the *
23 * Free Software Foundation, Inc., *
24 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *
25 ***************************************************************************/
32 #include <helper/binarybuffer.h>
33 #include <target/algorithm.h>
34 #include <target/armv7m.h>
36 /* Regarding performance:
38 * Short story - it might be best to leave the performance at
41 * You may see a jump in speed if you change to using
42 * 32bit words for the block programming.
44 * Its a shame you cannot use the double word as its
45 * even faster - but you require external VPP for that mode.
47 * Having said all that 16bit writes give us the widest vdd
48 * operating range, so may be worth adding a note to that effect.
52 /* Danger!!!! The STM32F1x and STM32F2x series actually have
53 * quite different flash controllers.
55 * What's more scary is that the names of the registers and their
56 * addresses are the same, but the actual bits and what they do are
57 * can be very different.
59 * To reduce testing complexity and dangers of regressions,
60 * a seperate file is used for stm32fx2x.
62 * 1mByte part with 4 x 16, 1 x 64, 7 x 128kBytes sectors
64 * What's the protection page size???
66 * Tested with STM3220F-EVAL board.
68 * STM32F21xx series for reference.
71 * http://www.st.com/internet/mcu/product/250192.jsp
74 * www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/
75 * PROGRAMMING_MANUAL/CD00233952.pdf
77 * STM32F1x series - notice that this code was copy, pasted and knocked
78 * into a stm32f2x driver, so in case something has been converted or
79 * bugs haven't been fixed, here are the original manuals:
81 * RM0008 - Reference manual
83 * RM0042, the Flash programming manual for low-, medium- high-density and
84 * connectivity line STM32F10x devices
86 * PM0068, the Flash programming manual for XL-density STM32F10x devices.
90 /* Erase time can be as high as 1000ms, 10x this and it's toast... */
91 #define FLASH_ERASE_TIMEOUT 10000
92 #define FLASH_WRITE_TIMEOUT 5
94 #define STM32_FLASH_BASE 0x40023c00
95 #define STM32_FLASH_ACR 0x40023c00
96 #define STM32_FLASH_KEYR 0x40023c04
97 #define STM32_FLASH_OPTKEYR 0x40023c08
98 #define STM32_FLASH_SR 0x40023c0C
99 #define STM32_FLASH_CR 0x40023c10
100 #define STM32_FLASH_OPTCR 0x40023c14
101 #define STM32_FLASH_OPTCR1 0x40023c18
103 /* FLASH_CR register bits */
105 #define FLASH_PG (1 << 0)
106 #define FLASH_SER (1 << 1)
107 #define FLASH_MER (1 << 2)
108 #define FLASH_MER1 (1 << 15)
109 #define FLASH_STRT (1 << 16)
110 #define FLASH_PSIZE_8 (0 << 8)
111 #define FLASH_PSIZE_16 (1 << 8)
112 #define FLASH_PSIZE_32 (2 << 8)
113 #define FLASH_PSIZE_64 (3 << 8)
114 /* The sector number encoding is not straight binary for dual bank flash.
115 * Warning: evaluates the argument multiple times */
116 #define FLASH_SNB(a) ((((a) >= 12) ? 0x10 | ((a) - 12) : (a)) << 3)
117 #define FLASH_LOCK (1 << 31)
119 /* FLASH_SR register bits */
121 #define FLASH_BSY (1 << 16)
122 #define FLASH_PGSERR (1 << 7) /* Programming sequence error */
123 #define FLASH_PGPERR (1 << 6) /* Programming parallelism error */
124 #define FLASH_PGAERR (1 << 5) /* Programming alignment error */
125 #define FLASH_WRPERR (1 << 4) /* Write protection error */
126 #define FLASH_OPERR (1 << 1) /* Operation error */
128 #define FLASH_ERROR (FLASH_PGSERR | FLASH_PGPERR | FLASH_PGAERR | FLASH_WRPERR | FLASH_OPERR)
130 /* STM32_FLASH_OPTCR register bits */
132 #define OPT_LOCK (1 << 0)
133 #define OPT_START (1 << 1)
135 /* STM32_FLASH_OBR bit definitions (reading) */
138 #define OPT_READOUT 1
139 #define OPT_RDWDGSW 2
140 #define OPT_RDRSTSTOP 3
141 #define OPT_RDRSTSTDBY 4
142 #define OPT_BFB2 5 /* dual flash bank only */
144 /* register unlock keys */
146 #define KEY1 0x45670123
147 #define KEY2 0xCDEF89AB
149 /* option register unlock key */
150 #define OPTKEY1 0x08192A3B
151 #define OPTKEY2 0x4C5D6E7F
153 struct stm32x_options {
155 uint8_t user_options;
159 struct stm32x_flash_bank {
160 struct stm32x_options option_bytes;
162 bool has_large_mem; /* stm32f42x/stm32f43x family */
163 uint32_t user_bank_size;
166 /* flash bank stm32x <base> <size> 0 0 <target#>
168 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
170 struct stm32x_flash_bank *stm32x_info;
173 return ERROR_COMMAND_SYNTAX_ERROR;
175 stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
176 bank->driver_priv = stm32x_info;
178 stm32x_info->probed = 0;
179 stm32x_info->user_bank_size = bank->size;
184 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
189 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
191 struct target *target = bank->target;
192 return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
195 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
197 struct target *target = bank->target;
199 int retval = ERROR_OK;
201 /* wait for busy to clear */
203 retval = stm32x_get_flash_status(bank, &status);
204 if (retval != ERROR_OK)
206 LOG_DEBUG("status: 0x%" PRIx32 "", status);
207 if ((status & FLASH_BSY) == 0)
209 if (timeout-- <= 0) {
210 LOG_ERROR("timed out waiting for flash");
217 if (status & FLASH_WRPERR) {
218 LOG_ERROR("stm32x device protected");
222 /* Clear but report errors */
223 if (status & FLASH_ERROR) {
224 /* If this operation fails, we ignore it and report the original
227 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
228 status & FLASH_ERROR);
233 static int stm32x_unlock_reg(struct target *target)
237 /* first check if not already unlocked
238 * otherwise writing on STM32_FLASH_KEYR will fail
240 int retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
241 if (retval != ERROR_OK)
244 if ((ctrl & FLASH_LOCK) == 0)
247 /* unlock flash registers */
248 retval = target_write_u32(target, STM32_FLASH_KEYR, KEY1);
249 if (retval != ERROR_OK)
252 retval = target_write_u32(target, STM32_FLASH_KEYR, KEY2);
253 if (retval != ERROR_OK)
256 retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
257 if (retval != ERROR_OK)
260 if (ctrl & FLASH_LOCK) {
261 LOG_ERROR("flash not unlocked STM32_FLASH_CR: %" PRIx32, ctrl);
262 return ERROR_TARGET_FAILURE;
268 static int stm32x_unlock_option_reg(struct target *target)
272 int retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
273 if (retval != ERROR_OK)
276 if ((ctrl & OPT_LOCK) == 0)
279 /* unlock option registers */
280 retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY1);
281 if (retval != ERROR_OK)
284 retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY2);
285 if (retval != ERROR_OK)
288 retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
289 if (retval != ERROR_OK)
292 if (ctrl & OPT_LOCK) {
293 LOG_ERROR("options not unlocked STM32_FLASH_OPTCR: %" PRIx32, ctrl);
294 return ERROR_TARGET_FAILURE;
300 static int stm32x_read_options(struct flash_bank *bank)
303 struct stm32x_flash_bank *stm32x_info = NULL;
304 struct target *target = bank->target;
306 stm32x_info = bank->driver_priv;
308 /* read current option bytes */
309 int retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
310 if (retval != ERROR_OK)
313 stm32x_info->option_bytes.user_options = optiondata & 0xec;
314 stm32x_info->option_bytes.RDP = (optiondata >> 8) & 0xff;
315 stm32x_info->option_bytes.protection = (optiondata >> 16) & 0xfff;
317 if (stm32x_info->has_large_mem) {
319 retval = target_read_u32(target, STM32_FLASH_OPTCR1, &optiondata);
320 if (retval != ERROR_OK)
323 /* append protection bits */
324 stm32x_info->option_bytes.protection |= (optiondata >> 4) & 0x00fff000;
327 if (stm32x_info->option_bytes.RDP != 0xAA)
328 LOG_INFO("Device Security Bit Set");
333 static int stm32x_write_options(struct flash_bank *bank)
335 struct stm32x_flash_bank *stm32x_info = NULL;
336 struct target *target = bank->target;
339 stm32x_info = bank->driver_priv;
341 int retval = stm32x_unlock_option_reg(target);
342 if (retval != ERROR_OK)
345 /* rebuild option data */
346 optiondata = stm32x_info->option_bytes.user_options;
347 optiondata |= stm32x_info->option_bytes.RDP << 8;
348 optiondata |= (stm32x_info->option_bytes.protection & 0x0fff) << 16;
350 /* program options */
351 retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata);
352 if (retval != ERROR_OK)
355 if (stm32x_info->has_large_mem) {
357 uint32_t optiondata2 = 0;
358 optiondata2 |= (stm32x_info->option_bytes.protection & 0x00fff000) << 4;
359 retval = target_write_u32(target, STM32_FLASH_OPTCR1, optiondata2);
360 if (retval != ERROR_OK)
364 /* start programming cycle */
365 retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPT_START);
366 if (retval != ERROR_OK)
369 /* wait for completion */
370 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
371 if (retval != ERROR_OK)
374 /* relock registers */
375 retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPT_LOCK);
376 if (retval != ERROR_OK)
382 static int stm32x_protect_check(struct flash_bank *bank)
384 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
386 /* read write protection settings */
387 int retval = stm32x_read_options(bank);
388 if (retval != ERROR_OK) {
389 LOG_DEBUG("unable to read option bytes");
393 for (int i = 0; i < bank->num_sectors; i++) {
394 if (stm32x_info->option_bytes.protection & (1 << i))
395 bank->sectors[i].is_protected = 0;
397 bank->sectors[i].is_protected = 1;
403 static int stm32x_erase(struct flash_bank *bank, int first, int last)
405 struct target *target = bank->target;
408 assert(first < bank->num_sectors);
409 assert(last < bank->num_sectors);
411 if (bank->target->state != TARGET_HALTED) {
412 LOG_ERROR("Target not halted");
413 return ERROR_TARGET_NOT_HALTED;
417 retval = stm32x_unlock_reg(target);
418 if (retval != ERROR_OK)
423 To erase a sector, follow the procedure below:
424 1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
426 2. Set the SER bit and select the sector
427 you wish to erase (SNB) in the FLASH_CR register
428 3. Set the STRT bit in the FLASH_CR register
429 4. Wait for the BSY bit to be cleared
432 for (i = first; i <= last; i++) {
433 retval = target_write_u32(target,
434 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_SER | FLASH_SNB(i) | FLASH_STRT);
435 if (retval != ERROR_OK)
438 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
439 if (retval != ERROR_OK)
442 bank->sectors[i].is_erased = 1;
445 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
446 if (retval != ERROR_OK)
452 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
454 struct target *target = bank->target;
455 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
457 if (target->state != TARGET_HALTED) {
458 LOG_ERROR("Target not halted");
459 return ERROR_TARGET_NOT_HALTED;
462 /* read protection settings */
463 int retval = stm32x_read_options(bank);
464 if (retval != ERROR_OK) {
465 LOG_DEBUG("unable to read option bytes");
469 for (int i = first; i <= last; i++) {
472 stm32x_info->option_bytes.protection &= ~(1 << i);
474 stm32x_info->option_bytes.protection |= (1 << i);
477 retval = stm32x_write_options(bank);
478 if (retval != ERROR_OK)
484 static int stm32x_write_block(struct flash_bank *bank, const uint8_t *buffer,
485 uint32_t offset, uint32_t count)
487 struct target *target = bank->target;
488 uint32_t buffer_size = 16384;
489 struct working_area *write_algorithm;
490 struct working_area *source;
491 uint32_t address = bank->base + offset;
492 struct reg_param reg_params[5];
493 struct armv7m_algorithm armv7m_info;
494 int retval = ERROR_OK;
496 /* see contrib/loaders/flash/stm32f2x.S for src */
498 static const uint8_t stm32x_flash_write_code[] = {
500 0xD0, 0xF8, 0x00, 0x80, /* ldr r8, [r0, #0] */
501 0xB8, 0xF1, 0x00, 0x0F, /* cmp r8, #0 */
502 0x1A, 0xD0, /* beq exit */
503 0x47, 0x68, /* ldr r7, [r0, #4] */
504 0x47, 0x45, /* cmp r7, r8 */
505 0xF7, 0xD0, /* beq wait_fifo */
507 0xDF, 0xF8, 0x30, 0x60, /* ldr r6, STM32_PROG16 */
508 0x26, 0x61, /* str r6, [r4, #STM32_FLASH_CR_OFFSET] */
509 0x37, 0xF8, 0x02, 0x6B, /* ldrh r6, [r7], #0x02 */
510 0x22, 0xF8, 0x02, 0x6B, /* strh r6, [r2], #0x02 */
512 0xE6, 0x68, /* ldr r6, [r4, #STM32_FLASH_SR_OFFSET] */
513 0x16, 0xF4, 0x80, 0x3F, /* tst r6, #0x10000 */
514 0xFB, 0xD1, /* bne busy */
515 0x16, 0xF0, 0xF0, 0x0F, /* tst r6, #0xf0 */
516 0x07, 0xD1, /* bne error */
518 0x8F, 0x42, /* cmp r7, r1 */
519 0x28, 0xBF, /* it cs */
520 0x00, 0xF1, 0x08, 0x07, /* addcs r7, r0, #8 */
521 0x47, 0x60, /* str r7, [r0, #4] */
522 0x01, 0x3B, /* subs r3, r3, #1 */
523 0x13, 0xB1, /* cbz r3, exit */
524 0xE1, 0xE7, /* b wait_fifo */
526 0x00, 0x21, /* movs r1, #0 */
527 0x41, 0x60, /* str r1, [r0, #4] */
529 0x30, 0x46, /* mov r0, r6 */
530 0x00, 0xBE, /* bkpt #0x00 */
532 /* <STM32_PROG16>: */
533 0x01, 0x01, 0x00, 0x00, /* .word 0x00000101 */
536 if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
537 &write_algorithm) != ERROR_OK) {
538 LOG_WARNING("no working area available, can't do block memory writes");
539 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
542 retval = target_write_buffer(target, write_algorithm->address,
543 sizeof(stm32x_flash_write_code),
544 stm32x_flash_write_code);
545 if (retval != ERROR_OK)
549 while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
551 if (buffer_size <= 256) {
552 /* we already allocated the writing code, but failed to get a
553 * buffer, free the algorithm */
554 target_free_working_area(target, write_algorithm);
556 LOG_WARNING("no large enough working area available, can't do block memory writes");
557 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
561 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
562 armv7m_info.core_mode = ARM_MODE_THREAD;
564 init_reg_param(®_params[0], "r0", 32, PARAM_IN_OUT); /* buffer start, status (out) */
565 init_reg_param(®_params[1], "r1", 32, PARAM_OUT); /* buffer end */
566 init_reg_param(®_params[2], "r2", 32, PARAM_OUT); /* target address */
567 init_reg_param(®_params[3], "r3", 32, PARAM_OUT); /* count (halfword-16bit) */
568 init_reg_param(®_params[4], "r4", 32, PARAM_OUT); /* flash base */
570 buf_set_u32(reg_params[0].value, 0, 32, source->address);
571 buf_set_u32(reg_params[1].value, 0, 32, source->address + source->size);
572 buf_set_u32(reg_params[2].value, 0, 32, address);
573 buf_set_u32(reg_params[3].value, 0, 32, count);
574 buf_set_u32(reg_params[4].value, 0, 32, STM32_FLASH_BASE);
576 retval = target_run_flash_async_algorithm(target, buffer, count, 2,
579 source->address, source->size,
580 write_algorithm->address, 0,
583 if (retval == ERROR_FLASH_OPERATION_FAILED) {
584 LOG_ERROR("error executing stm32x flash write algorithm");
586 uint32_t error = buf_get_u32(reg_params[0].value, 0, 32) & FLASH_ERROR;
588 if (error & FLASH_WRPERR)
589 LOG_ERROR("flash memory write protected");
592 LOG_ERROR("flash write failed = %08" PRIx32, error);
593 /* Clear but report errors */
594 target_write_u32(target, STM32_FLASH_SR, error);
599 target_free_working_area(target, source);
600 target_free_working_area(target, write_algorithm);
602 destroy_reg_param(®_params[0]);
603 destroy_reg_param(®_params[1]);
604 destroy_reg_param(®_params[2]);
605 destroy_reg_param(®_params[3]);
606 destroy_reg_param(®_params[4]);
611 static int stm32x_write(struct flash_bank *bank, const uint8_t *buffer,
612 uint32_t offset, uint32_t count)
614 struct target *target = bank->target;
615 uint32_t words_remaining = (count / 2);
616 uint32_t bytes_remaining = (count & 0x00000001);
617 uint32_t address = bank->base + offset;
618 uint32_t bytes_written = 0;
621 if (bank->target->state != TARGET_HALTED) {
622 LOG_ERROR("Target not halted");
623 return ERROR_TARGET_NOT_HALTED;
627 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
628 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
631 retval = stm32x_unlock_reg(target);
632 if (retval != ERROR_OK)
635 /* multiple half words (2-byte) to be programmed? */
636 if (words_remaining > 0) {
637 /* try using a block write */
638 retval = stm32x_write_block(bank, buffer, offset, words_remaining);
639 if (retval != ERROR_OK) {
640 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
641 /* if block write failed (no sufficient working area),
642 * we use normal (slow) single dword accesses */
643 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
646 buffer += words_remaining * 2;
647 address += words_remaining * 2;
652 if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
657 The Flash memory programming sequence is as follows:
658 1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
660 2. Set the PG bit in the FLASH_CR register
661 3. Perform the data write operation(s) to the desired memory address (inside main
662 memory block or OTP area):
663 – – Half-word access in case of x16 parallelism
664 – Word access in case of x32 parallelism
667 Byte access in case of x8 parallelism
668 Double word access in case of x64 parallelism
669 Wait for the BSY bit to be cleared
671 while (words_remaining > 0) {
673 memcpy(&value, buffer + bytes_written, sizeof(uint16_t));
675 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
676 FLASH_PG | FLASH_PSIZE_16);
677 if (retval != ERROR_OK)
680 retval = target_write_u16(target, address, value);
681 if (retval != ERROR_OK)
684 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
685 if (retval != ERROR_OK)
693 if (bytes_remaining) {
694 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
695 FLASH_PG | FLASH_PSIZE_8);
696 if (retval != ERROR_OK)
698 retval = target_write_u8(target, address, buffer[bytes_written]);
699 if (retval != ERROR_OK)
702 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
703 if (retval != ERROR_OK)
707 return target_write_u32(target, STM32_FLASH_CR, FLASH_LOCK);
710 static void setup_sector(struct flash_bank *bank, int start, int num, int size)
712 for (int i = start; i < (start + num) ; i++) {
713 assert(i < bank->num_sectors);
714 bank->sectors[i].offset = bank->size;
715 bank->sectors[i].size = size;
716 bank->size += bank->sectors[i].size;
720 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
722 /* this checks for a stm32f4x errata issue where a
723 * stm32f2x DBGMCU_IDCODE is incorrectly returned.
724 * If the issue is detected target is forced to stm32f4x Rev A.
725 * Only effects Rev A silicon */
727 struct target *target = bank->target;
730 /* read stm32 device id register */
731 int retval = target_read_u32(target, 0xE0042000, device_id);
732 if (retval != ERROR_OK)
735 if ((*device_id & 0xfff) == 0x411) {
736 /* read CPUID reg to check core type */
737 retval = target_read_u32(target, 0xE000ED00, &cpuid);
738 if (retval != ERROR_OK)
741 /* check for cortex_m4 */
742 if (((cpuid >> 4) & 0xFFF) == 0xC24) {
743 *device_id &= ~((0xFFFF << 16) | 0xfff);
744 *device_id |= (0x1000 << 16) | 0x413;
745 LOG_INFO("stm32f4x errata detected - fixing incorrect MCU_IDCODE");
751 static int stm32x_probe(struct flash_bank *bank)
753 struct target *target = bank->target;
754 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
756 uint16_t flash_size_in_kb;
757 uint16_t max_flash_size_in_kb;
759 uint32_t base_address = 0x08000000;
761 stm32x_info->probed = 0;
762 stm32x_info->has_large_mem = false;
764 /* read stm32 device id register */
765 int retval = stm32x_get_device_id(bank, &device_id);
766 if (retval != ERROR_OK)
768 LOG_INFO("device id = 0x%08" PRIx32 "", device_id);
770 /* set max flash size depending on family */
771 switch (device_id & 0xfff) {
774 max_flash_size_in_kb = 1024;
777 max_flash_size_in_kb = 2048;
780 max_flash_size_in_kb = 256;
784 max_flash_size_in_kb = 512;
787 LOG_WARNING("Cannot identify target as a STM32 family.");
791 /* get flash size from target. */
792 retval = target_read_u16(target, 0x1FFF7A22, &flash_size_in_kb);
794 /* failed reading flash size or flash size invalid (early silicon),
795 * default to max target family */
796 if (retval != ERROR_OK || flash_size_in_kb == 0xffff || flash_size_in_kb == 0) {
797 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming %dk flash",
798 max_flash_size_in_kb);
799 flash_size_in_kb = max_flash_size_in_kb;
802 /* if the user sets the size manually then ignore the probed value
803 * this allows us to work around devices that have a invalid flash size register value */
804 if (stm32x_info->user_bank_size) {
805 LOG_INFO("ignoring flash probed value, using configured bank size");
806 flash_size_in_kb = stm32x_info->user_bank_size / 1024;
809 /* only devices with > 1024kB have dual banks */
810 if (flash_size_in_kb > 1024)
811 stm32x_info->has_large_mem = true;
813 LOG_INFO("flash size = %dkbytes", flash_size_in_kb);
815 /* did we assign flash size? */
816 assert(flash_size_in_kb != 0xffff);
818 /* calculate numbers of pages */
819 int num_pages = (flash_size_in_kb / 128) + 4;
821 /* check for larger 2048 bytes devices */
822 if (stm32x_info->has_large_mem)
825 /* check that calculation result makes sense */
826 assert(num_pages > 0);
830 bank->sectors = NULL;
833 bank->base = base_address;
834 bank->num_sectors = num_pages;
835 bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
839 setup_sector(bank, 0, 4, 16 * 1024);
840 setup_sector(bank, 4, 1, 64 * 1024);
843 setup_sector(bank, 4 + 1, MIN(12, num_pages) - 5, 128 * 1024);
845 if (stm32x_info->has_large_mem) {
847 /* fixed memory for larger devices */
848 setup_sector(bank, 12, 4, 16 * 1024);
849 setup_sector(bank, 16, 1, 64 * 1024);
851 /* dynamic memory for larger devices */
852 setup_sector(bank, 16 + 1, num_pages - 5 - 12, 128 * 1024);
855 for (i = 0; i < num_pages; i++) {
856 bank->sectors[i].is_erased = -1;
857 bank->sectors[i].is_protected = 0;
860 stm32x_info->probed = 1;
865 static int stm32x_auto_probe(struct flash_bank *bank)
867 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
868 if (stm32x_info->probed)
870 return stm32x_probe(bank);
873 static int get_stm32x_info(struct flash_bank *bank, char *buf, int buf_size)
875 uint32_t dbgmcu_idcode;
877 /* read stm32 device id register */
878 int retval = stm32x_get_device_id(bank, &dbgmcu_idcode);
879 if (retval != ERROR_OK)
882 uint16_t device_id = dbgmcu_idcode & 0xfff;
883 uint16_t rev_id = dbgmcu_idcode >> 16;
884 const char *device_str;
885 const char *rev_str = NULL;
889 device_str = "STM32F2xx";
916 device_str = "STM32F4xx";
936 device_str = "STM32F4xx (Low Power)";
950 snprintf(buf, buf_size, "Cannot identify target as a STM32F2/4\n");
955 snprintf(buf, buf_size, "%s - Rev: %s", device_str, rev_str);
957 snprintf(buf, buf_size, "%s - Rev: unknown (0x%04x)", device_str, rev_id);
962 COMMAND_HANDLER(stm32x_handle_lock_command)
964 struct target *target = NULL;
965 struct stm32x_flash_bank *stm32x_info = NULL;
968 return ERROR_COMMAND_SYNTAX_ERROR;
970 struct flash_bank *bank;
971 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
972 if (ERROR_OK != retval)
975 stm32x_info = bank->driver_priv;
976 target = bank->target;
978 if (target->state != TARGET_HALTED) {
979 LOG_ERROR("Target not halted");
980 return ERROR_TARGET_NOT_HALTED;
983 if (stm32x_read_options(bank) != ERROR_OK) {
984 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
988 /* set readout protection */
989 stm32x_info->option_bytes.RDP = 0;
991 if (stm32x_write_options(bank) != ERROR_OK) {
992 command_print(CMD_CTX, "%s failed to lock device", bank->driver->name);
996 command_print(CMD_CTX, "%s locked", bank->driver->name);
1001 COMMAND_HANDLER(stm32x_handle_unlock_command)
1003 struct target *target = NULL;
1004 struct stm32x_flash_bank *stm32x_info = NULL;
1007 return ERROR_COMMAND_SYNTAX_ERROR;
1009 struct flash_bank *bank;
1010 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1011 if (ERROR_OK != retval)
1014 stm32x_info = bank->driver_priv;
1015 target = bank->target;
1017 if (target->state != TARGET_HALTED) {
1018 LOG_ERROR("Target not halted");
1019 return ERROR_TARGET_NOT_HALTED;
1022 if (stm32x_read_options(bank) != ERROR_OK) {
1023 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
1027 /* clear readout protection and complementary option bytes
1028 * this will also force a device unlock if set */
1029 stm32x_info->option_bytes.RDP = 0xAA;
1031 if (stm32x_write_options(bank) != ERROR_OK) {
1032 command_print(CMD_CTX, "%s failed to unlock device", bank->driver->name);
1036 command_print(CMD_CTX, "%s unlocked.\n"
1037 "INFO: a reset or power cycle is required "
1038 "for the new settings to take effect.", bank->driver->name);
1043 static int stm32x_mass_erase(struct flash_bank *bank)
1046 struct target *target = bank->target;
1047 struct stm32x_flash_bank *stm32x_info = NULL;
1049 if (target->state != TARGET_HALTED) {
1050 LOG_ERROR("Target not halted");
1051 return ERROR_TARGET_NOT_HALTED;
1054 stm32x_info = bank->driver_priv;
1056 retval = stm32x_unlock_reg(target);
1057 if (retval != ERROR_OK)
1060 /* mass erase flash memory */
1061 if (stm32x_info->has_large_mem)
1062 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER | FLASH_MER1);
1064 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER);
1065 if (retval != ERROR_OK)
1067 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
1068 FLASH_MER | FLASH_STRT);
1069 if (retval != ERROR_OK)
1072 retval = stm32x_wait_status_busy(bank, 30000);
1073 if (retval != ERROR_OK)
1076 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
1077 if (retval != ERROR_OK)
1083 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
1088 command_print(CMD_CTX, "stm32x mass_erase <bank>");
1089 return ERROR_COMMAND_SYNTAX_ERROR;
1092 struct flash_bank *bank;
1093 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1094 if (ERROR_OK != retval)
1097 retval = stm32x_mass_erase(bank);
1098 if (retval == ERROR_OK) {
1099 /* set all sectors as erased */
1100 for (i = 0; i < bank->num_sectors; i++)
1101 bank->sectors[i].is_erased = 1;
1103 command_print(CMD_CTX, "stm32x mass erase complete");
1105 command_print(CMD_CTX, "stm32x mass erase failed");
1111 static const struct command_registration stm32x_exec_command_handlers[] = {
1114 .handler = stm32x_handle_lock_command,
1115 .mode = COMMAND_EXEC,
1117 .help = "Lock entire flash device.",
1121 .handler = stm32x_handle_unlock_command,
1122 .mode = COMMAND_EXEC,
1124 .help = "Unlock entire protected flash device.",
1127 .name = "mass_erase",
1128 .handler = stm32x_handle_mass_erase_command,
1129 .mode = COMMAND_EXEC,
1131 .help = "Erase entire flash device.",
1133 COMMAND_REGISTRATION_DONE
1136 static const struct command_registration stm32x_command_handlers[] = {
1139 .mode = COMMAND_ANY,
1140 .help = "stm32f2x flash command group",
1142 .chain = stm32x_exec_command_handlers,
1144 COMMAND_REGISTRATION_DONE
1147 struct flash_driver stm32f2x_flash = {
1149 .commands = stm32x_command_handlers,
1150 .flash_bank_command = stm32x_flash_bank_command,
1151 .erase = stm32x_erase,
1152 .protect = stm32x_protect,
1153 .write = stm32x_write,
1154 .read = default_flash_read,
1155 .probe = stm32x_probe,
1156 .auto_probe = stm32x_auto_probe,
1157 .erase_check = default_flash_blank_check,
1158 .protect_check = stm32x_protect_check,
1159 .info = get_stm32x_info,