1 /***************************************************************************
2 * Copyright (C) 2017 by STMicroelectronics *
4 * This program is free software; you can redistribute it and/or modify *
5 * it under the terms of the GNU General Public License as published by *
6 * the Free Software Foundation; either version 2 of the License, or *
7 * (at your option) any later version. *
9 * This program is distributed in the hope that it will be useful, *
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
12 * GNU General Public License for more details. *
14 * You should have received a copy of the GNU General Public License *
15 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
16 ***************************************************************************/
22 #include <helper/binarybuffer.h>
23 #include <target/algorithm.h>
24 #include <target/armv7m.h>
27 /* Erase time can be as high as 1000ms, 10x this and it's toast... */
28 #define FLASH_ERASE_TIMEOUT 10000
29 #define FLASH_WRITE_TIMEOUT 5
32 /* Same Flash registers for both banks, */
33 /* access depends on Flash Base address */
34 #define FLASH_ACR 0x00
35 #define FLASH_KEYR 0x04
36 #define FLASH_OPTKEYR 0x08
39 #define FLASH_CCR 0x14
40 #define FLASH_OPTCR 0x18
41 #define FLASH_OPTCUR 0x1C
42 #define FLASH_OPTPRG 0x20
43 #define FLASH_OPTCCR 0x24
44 #define FLASH_WPSNCUR 0x38
45 #define FLASH_WPSNPRG 0x3C
48 /* FLASH_CR register bits */
49 #define FLASH_LOCK (1 << 0)
50 #define FLASH_PG (1 << 1)
51 #define FLASH_SER (1 << 2)
52 #define FLASH_BER_CMD (1 << 3)
53 #define FLASH_PSIZE_8 (0 << 4)
54 #define FLASH_PSIZE_16 (1 << 4)
55 #define FLASH_PSIZE_32 (2 << 4)
56 #define FLASH_PSIZE_64 (3 << 4)
57 #define FLASH_FW (1 << 6)
58 #define FLASH_START (1 << 7)
60 #define FLASH_SNB(a) ((a) << 8)
62 /* FLASH_SR register bits */
63 #define FLASH_BSY (1 << 0) /* Operation in progress */
64 #define FLASH_WRPERR (1 << 17) /* Write protection error */
65 #define FLASH_PGSERR (1 << 18) /* Programming sequence error */
66 #define FLASH_STRBERR (1 << 19) /* Strobe error */
67 #define FLASH_INCERR (1 << 21) /* Increment error */
68 #define FLASH_OPERR (1 << 22) /* Operation error */
69 #define FLASH_RDPERR (1 << 23) /* Read Protection error */
70 #define FLASH_RDSERR (1 << 24) /* Secure Protection error */
71 #define FLASH_SNECCERR (1 << 25) /* Single ECC error */
72 #define FLASH_DBECCERR (1 << 26) /* Double ECC error */
74 #define FLASH_ERROR (FLASH_WRPERR | FLASH_PGSERR | FLASH_STRBERR | FLASH_INCERR | FLASH_OPERR | \
75 FLASH_RDPERR | FLASH_RDSERR | FLASH_SNECCERR | FLASH_DBECCERR)
77 /* FLASH_OPTCR register bits */
78 #define OPT_LOCK (1 << 0)
79 #define OPT_START (1 << 1)
81 /* FLASH_OPTCUR bit definitions (reading) */
82 #define IWDG1_HW (1 << 4)
84 /* register unlock keys */
85 #define KEY1 0x45670123
86 #define KEY2 0xCDEF89AB
88 /* option register unlock key */
89 #define OPTKEY1 0x08192A3B
90 #define OPTKEY2 0x4C5D6E7F
92 #define DBGMCU_IDCODE_REGISTER 0x5C001000
93 #define FLASH_BANK0_ADDRESS 0x08000000
94 #define FLASH_BANK1_ADDRESS 0x08100000
95 #define FLASH_REG_BASE_B0 0x52002000
96 #define FLASH_REG_BASE_B1 0x52002100
97 #define FLASH_SIZE_ADDRESS 0x1FF1E880
98 #define FLASH_BLOCK_SIZE 32
100 struct stm32h7x_rev {
105 struct stm32x_options {
107 uint32_t protection; /* bank1 WRP */
108 uint32_t protection2; /* bank2 WRP */
109 uint8_t user_options;
110 uint8_t user2_options;
111 uint8_t user3_options;
112 uint8_t independent_watchdog_selection;
115 struct stm32h7x_part_info {
117 const char *device_str;
118 const struct stm32h7x_rev *revs;
120 unsigned int page_size;
121 unsigned int pages_per_sector;
122 uint16_t max_flash_size_kb;
123 uint8_t has_dual_bank;
124 uint16_t first_bank_size_kb; /* Used when has_dual_bank is true */
125 uint32_t flash_base; /* Flash controller registers location */
126 uint32_t fsize_base; /* Location of FSIZE register */
129 struct stm32h7x_flash_bank {
132 uint32_t user_bank_size;
133 uint32_t flash_base; /* Address of flash reg controller */
134 struct stm32x_options option_bytes;
135 const struct stm32h7x_part_info *part_info;
138 static const struct stm32h7x_rev stm32_450_revs[] = {
139 { 0x1000, "A" }, { 0x1001, "Z" }, { 0x1003, "Y" },
142 static const struct stm32h7x_part_info stm32h7x_parts[] = {
145 .revs = stm32_450_revs,
146 .num_revs = ARRAY_SIZE(stm32_450_revs),
147 .device_str = "STM32H7xx 2M",
148 .page_size = 128, /* 128 KB */
149 .max_flash_size_kb = 2048,
150 .first_bank_size_kb = 1024,
152 .flash_base = FLASH_REG_BASE_B0,
153 .fsize_base = FLASH_SIZE_ADDRESS,
157 static int stm32x_unlock_reg(struct flash_bank *bank);
158 static int stm32x_lock_reg(struct flash_bank *bank);
159 static int stm32x_probe(struct flash_bank *bank);
161 /* flash bank stm32x <base> <size> 0 0 <target#> */
163 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
165 struct stm32h7x_flash_bank *stm32x_info;
168 return ERROR_COMMAND_SYNTAX_ERROR;
170 stm32x_info = malloc(sizeof(struct stm32h7x_flash_bank));
171 bank->driver_priv = stm32x_info;
173 stm32x_info->probed = 0;
174 stm32x_info->user_bank_size = bank->size;
179 static inline uint32_t stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
181 struct stm32h7x_flash_bank *stm32x_info = bank->driver_priv;
182 return reg + stm32x_info->flash_base;
185 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
187 struct target *target = bank->target;
188 return target_read_u32(target, stm32x_get_flash_reg(bank, FLASH_SR), status);
191 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
193 struct target *target = bank->target;
194 struct stm32h7x_flash_bank *stm32x_info = bank->driver_priv;
198 /* wait for busy to clear */
200 retval = stm32x_get_flash_status(bank, &status);
201 if (retval != ERROR_OK) {
202 LOG_INFO("wait_status_busy, target_read_u32 : error : remote address 0x%x", stm32x_info->flash_base);
206 if ((status & FLASH_BSY) == 0)
209 if (timeout-- <= 0) {
210 LOG_INFO("wait_status_busy, time out expired, status: 0x%" PRIx32 "", status);
216 if (status & FLASH_WRPERR) {
217 LOG_INFO("wait_status_busy, WRPERR : error : remote address 0x%x", stm32x_info->flash_base);
221 /* Clear error + EOP flags but report errors */
222 if (status & FLASH_ERROR) {
223 /* If this operation fails, we ignore it and report the original retval */
224 target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CCR), status);
229 static int stm32x_unlock_reg(struct flash_bank *bank)
232 struct target *target = bank->target;
234 /* first check if not already unlocked
235 * otherwise writing on FLASH_KEYR will fail
237 int retval = target_read_u32(target, stm32x_get_flash_reg(bank, FLASH_CR), &ctrl);
238 if (retval != ERROR_OK)
241 if ((ctrl & FLASH_LOCK) == 0)
244 /* unlock flash registers for bank */
245 retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_KEYR), KEY1);
246 if (retval != ERROR_OK)
249 retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_KEYR), KEY2);
250 if (retval != ERROR_OK)
253 retval = target_read_u32(target, stm32x_get_flash_reg(bank, FLASH_CR), &ctrl);
254 if (retval != ERROR_OK)
257 if (ctrl & FLASH_LOCK) {
258 LOG_ERROR("flash not unlocked STM32_FLASH_CRx: %" PRIx32, ctrl);
259 return ERROR_TARGET_FAILURE;
264 static int stm32x_unlock_option_reg(struct flash_bank *bank)
267 struct target *target = bank->target;
269 int retval = target_read_u32(target, FLASH_REG_BASE_B0 + FLASH_OPTCR, &ctrl);
270 if (retval != ERROR_OK)
273 if ((ctrl & OPT_LOCK) == 0)
276 /* unlock option registers */
277 retval = target_write_u32(target, FLASH_REG_BASE_B0 + FLASH_OPTKEYR, OPTKEY1);
278 if (retval != ERROR_OK)
281 retval = target_write_u32(target, FLASH_REG_BASE_B0 + FLASH_OPTKEYR, OPTKEY2);
282 if (retval != ERROR_OK)
285 retval = target_read_u32(target, FLASH_REG_BASE_B0 + FLASH_OPTCR, &ctrl);
286 if (retval != ERROR_OK)
289 if (ctrl & OPT_LOCK) {
290 LOG_ERROR("options not unlocked STM32_FLASH_OPTCR: %" PRIx32, ctrl);
291 return ERROR_TARGET_FAILURE;
297 static int stm32x_lock_reg(struct flash_bank *bank)
299 struct target *target = bank->target;
302 int retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CR), FLASH_LOCK);
303 if (retval != ERROR_OK)
309 static int stm32x_read_options(struct flash_bank *bank)
312 struct stm32h7x_flash_bank *stm32x_info = NULL;
313 struct target *target = bank->target;
315 stm32x_info = bank->driver_priv;
317 /* read current option bytes */
318 int retval = target_read_u32(target, FLASH_REG_BASE_B0 + FLASH_OPTCUR, &optiondata);
319 if (retval != ERROR_OK)
322 /* decode option data */
323 stm32x_info->option_bytes.user_options = optiondata & 0xfc;
324 stm32x_info->option_bytes.RDP = (optiondata >> 8) & 0xff;
325 stm32x_info->option_bytes.user2_options = (optiondata >> 16) & 0xff;
326 stm32x_info->option_bytes.user3_options = (optiondata >> 24) & 0x83;
328 if (optiondata & IWDG1_HW)
329 stm32x_info->option_bytes.independent_watchdog_selection = 1;
331 stm32x_info->option_bytes.independent_watchdog_selection = 0;
333 if (stm32x_info->option_bytes.RDP != 0xAA)
334 LOG_INFO("Device Security Bit Set");
336 /* read current WPSN option bytes */
337 retval = target_read_u32(target, FLASH_REG_BASE_B0 + FLASH_WPSNCUR, &optiondata);
338 if (retval != ERROR_OK)
340 stm32x_info->option_bytes.protection = optiondata & 0xff;
342 /* read current WPSN2 option bytes */
343 retval = target_read_u32(target, FLASH_REG_BASE_B1 + FLASH_WPSNCUR, &optiondata);
344 if (retval != ERROR_OK)
346 stm32x_info->option_bytes.protection2 = optiondata & 0xff;
351 static int stm32x_write_options(struct flash_bank *bank)
353 struct stm32h7x_flash_bank *stm32x_info = NULL;
354 struct target *target = bank->target;
357 stm32x_info = bank->driver_priv;
359 int retval = stm32x_unlock_option_reg(bank);
360 if (retval != ERROR_OK)
363 /* rebuild option data */
364 optiondata = stm32x_info->option_bytes.user_options;
365 optiondata |= (stm32x_info->option_bytes.RDP << 8);
366 optiondata |= (stm32x_info->option_bytes.user2_options & 0xff) << 16;
367 optiondata |= (stm32x_info->option_bytes.user3_options & 0x83) << 24;
369 if (stm32x_info->option_bytes.independent_watchdog_selection)
370 optiondata |= IWDG1_HW;
372 optiondata &= ~IWDG1_HW;
374 /* program options */
375 retval = target_write_u32(target, FLASH_REG_BASE_B0 + FLASH_OPTPRG, optiondata);
376 if (retval != ERROR_OK)
379 optiondata = stm32x_info->option_bytes.protection & 0xff;
380 /* Program protection WPSNPRG */
381 retval = target_write_u32(target, FLASH_REG_BASE_B0 + FLASH_WPSNPRG, optiondata);
382 if (retval != ERROR_OK)
385 optiondata = stm32x_info->option_bytes.protection2 & 0xff;
386 /* Program protection WPSNPRG2 */
387 retval = target_write_u32(target, FLASH_REG_BASE_B1 + FLASH_WPSNPRG, optiondata);
388 if (retval != ERROR_OK)
391 optiondata = 0x40000000;
392 /* Remove OPT error flag before programming */
393 retval = target_write_u32(target, FLASH_REG_BASE_B0 + FLASH_OPTCCR, optiondata);
394 if (retval != ERROR_OK)
397 /* start programming cycle */
398 retval = target_write_u32(target, FLASH_REG_BASE_B0 + FLASH_OPTCR, OPT_START);
399 if (retval != ERROR_OK)
402 /* wait for completion */
403 int timeout = FLASH_ERASE_TIMEOUT;
406 retval = target_read_u32(target, FLASH_REG_BASE_B0 + FLASH_SR, &status);
407 if (retval != ERROR_OK) {
408 LOG_INFO("stm32x_write_options: wait_status_busy : error");
411 if ((status & FLASH_BSY) == 0)
414 if (timeout-- <= 0) {
415 LOG_INFO("wait_status_busy, time out expired, status: 0x%" PRIx32 "", status);
421 /* relock option registers */
422 retval = target_write_u32(target, FLASH_REG_BASE_B0 + FLASH_OPTCR, OPT_LOCK);
423 if (retval != ERROR_OK)
429 static int stm32x_protect_check(struct flash_bank *bank)
431 struct stm32h7x_flash_bank *stm32x_info = bank->driver_priv;
433 /* read 'write protection' settings */
434 int retval = stm32x_read_options(bank);
435 if (retval != ERROR_OK) {
436 LOG_DEBUG("unable to read option bytes");
440 for (int i = 0; i < bank->num_sectors; i++) {
441 if (stm32x_info->flash_base == FLASH_REG_BASE_B0) {
442 if (stm32x_info->option_bytes.protection & (1 << i))
443 bank->sectors[i].is_protected = 0;
445 bank->sectors[i].is_protected = 1;
447 if (stm32x_info->option_bytes.protection2 & (1 << i))
448 bank->sectors[i].is_protected = 0;
450 bank->sectors[i].is_protected = 1;
456 static int stm32x_erase(struct flash_bank *bank, int first, int last)
458 struct target *target = bank->target;
461 assert(first < bank->num_sectors);
462 assert(last < bank->num_sectors);
464 if (bank->target->state != TARGET_HALTED)
465 return ERROR_TARGET_NOT_HALTED;
467 retval = stm32x_unlock_reg(bank);
468 if (retval != ERROR_OK)
473 To erase a sector, follow the procedure below:
474 1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
476 2. Set the SER bit and select the sector
477 you wish to erase (SNB) in the FLASH_CR register
478 3. Set the STRT bit in the FLASH_CR register
479 4. Wait for the BSY bit to be cleared
481 for (int i = first; i <= last; i++) {
482 LOG_DEBUG("erase sector %d", i);
483 retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CR),
484 FLASH_SER | FLASH_SNB(i) | FLASH_PSIZE_64);
485 if (retval != ERROR_OK) {
486 LOG_ERROR("Error erase sector %d", i);
489 retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CR),
490 FLASH_SER | FLASH_SNB(i) | FLASH_PSIZE_64 | FLASH_START);
491 if (retval != ERROR_OK) {
492 LOG_ERROR("Error erase sector %d", i);
495 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
497 if (retval != ERROR_OK) {
498 LOG_ERROR("erase time-out error sector %d", i);
501 bank->sectors[i].is_erased = 1;
504 retval = stm32x_lock_reg(bank);
505 if (retval != ERROR_OK) {
506 LOG_ERROR("error during the lock of flash");
513 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
515 struct target *target = bank->target;
516 struct stm32h7x_flash_bank *stm32x_info = bank->driver_priv;
518 if (target->state != TARGET_HALTED) {
519 LOG_ERROR("Target not halted");
520 return ERROR_TARGET_NOT_HALTED;
522 /* read protection settings */
523 int retval = stm32x_read_options(bank);
524 if (retval != ERROR_OK) {
525 LOG_DEBUG("unable to read option bytes");
529 for (int i = first; i <= last; i++) {
530 if (stm32x_info->flash_base == FLASH_REG_BASE_B0) {
532 stm32x_info->option_bytes.protection &= ~(1 << i);
534 stm32x_info->option_bytes.protection |= (1 << i);
537 stm32x_info->option_bytes.protection2 &= ~(1 << i);
539 stm32x_info->option_bytes.protection2 |= (1 << i);
543 LOG_INFO("stm32x_protect, option_bytes written WRP1 0x%x , WRP2 0x%x",
544 (stm32x_info->option_bytes.protection & 0xff), (stm32x_info->option_bytes.protection2 & 0xff));
546 retval = stm32x_write_options(bank);
547 if (retval != ERROR_OK)
553 static int stm32x_write_block(struct flash_bank *bank, const uint8_t *buffer,
554 uint32_t offset, uint32_t count)
556 struct target *target = bank->target;
558 * If the size of the data part of the buffer is not a multiple of FLASH_BLOCK_SIZE, we get
559 * "corrupted fifo read" pointer in target_run_flash_async_algorithm()
561 uint32_t data_size = 512 * FLASH_BLOCK_SIZE; /* 16384 */
562 uint32_t buffer_size = 8 + data_size;
563 struct working_area *write_algorithm;
564 struct working_area *source;
565 uint32_t address = bank->base + offset;
566 struct reg_param reg_params[5];
567 struct armv7m_algorithm armv7m_info;
568 struct stm32h7x_flash_bank *stm32x_info = bank->driver_priv;
569 int retval = ERROR_OK;
571 static const uint8_t stm32x_flash_write_code[] = {
572 #include "../../../contrib/loaders/flash/stm32/stm32h7x.inc"
575 if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
576 &write_algorithm) != ERROR_OK) {
577 LOG_WARNING("no working area available, can't do block memory writes");
578 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
581 retval = target_write_buffer(target, write_algorithm->address,
582 sizeof(stm32x_flash_write_code),
583 stm32x_flash_write_code);
584 if (retval != ERROR_OK)
588 while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
590 buffer_size = 8 + data_size;
591 if (data_size <= 256) {
592 /* we already allocated the writing code, but failed to get a
593 * buffer, free the algorithm */
594 target_free_working_area(target, write_algorithm);
596 LOG_WARNING("no large enough working area available, can't do block memory writes");
597 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
601 LOG_DEBUG("target_alloc_working_area_try : buffer_size -> 0x%x", buffer_size);
603 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
604 armv7m_info.core_mode = ARM_MODE_THREAD;
606 init_reg_param(®_params[0], "r0", 32, PARAM_IN_OUT); /* buffer start, status (out) */
607 init_reg_param(®_params[1], "r1", 32, PARAM_OUT); /* buffer end */
608 init_reg_param(®_params[2], "r2", 32, PARAM_OUT); /* target address */
609 init_reg_param(®_params[3], "r3", 32, PARAM_OUT); /* count (word-256 bits) */
610 init_reg_param(®_params[4], "r4", 32, PARAM_OUT); /* flash reg base */
612 buf_set_u32(reg_params[0].value, 0, 32, source->address);
613 buf_set_u32(reg_params[1].value, 0, 32, source->address + source->size);
614 buf_set_u32(reg_params[2].value, 0, 32, address);
615 buf_set_u32(reg_params[3].value, 0, 32, count);
616 buf_set_u32(reg_params[4].value, 0, 32, stm32x_info->flash_base);
618 retval = target_run_flash_async_algorithm(target,
624 source->address, source->size,
625 write_algorithm->address, 0,
628 if (retval == ERROR_FLASH_OPERATION_FAILED) {
629 LOG_INFO("error executing stm32h7x flash write algorithm");
631 uint32_t flash_sr = buf_get_u32(reg_params[0].value, 0, 32);
633 if (flash_sr & FLASH_WRPERR)
634 LOG_ERROR("flash memory write protected");
636 if ((flash_sr & FLASH_ERROR) != 0) {
637 LOG_ERROR("flash write failed, FLASH_SR = %08" PRIx32, flash_sr);
638 /* Clear error + EOP flags but report errors */
639 target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CCR), flash_sr);
644 target_free_working_area(target, source);
645 target_free_working_area(target, write_algorithm);
647 destroy_reg_param(®_params[0]);
648 destroy_reg_param(®_params[1]);
649 destroy_reg_param(®_params[2]);
650 destroy_reg_param(®_params[3]);
651 destroy_reg_param(®_params[4]);
655 static int stm32x_write(struct flash_bank *bank, const uint8_t *buffer,
656 uint32_t offset, uint32_t count)
658 struct target *target = bank->target;
659 uint32_t address = bank->base + offset;
662 if (bank->target->state != TARGET_HALTED) {
663 LOG_ERROR("Target not halted");
664 return ERROR_TARGET_NOT_HALTED;
667 if (offset % FLASH_BLOCK_SIZE) {
668 LOG_WARNING("offset 0x%" PRIx32 " breaks required 32-byte alignment", offset);
669 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
672 retval = stm32x_unlock_reg(bank);
673 if (retval != ERROR_OK)
676 uint32_t blocks_remaining = count / FLASH_BLOCK_SIZE;
677 uint32_t bytes_remaining = count % FLASH_BLOCK_SIZE;
679 /* multiple words (32-bytes) to be programmed in block */
680 if (blocks_remaining) {
681 retval = stm32x_write_block(bank, buffer, offset, blocks_remaining);
682 if (retval != ERROR_OK) {
683 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
684 /* if block write failed (no sufficient working area),
685 * we use normal (slow) dword accesses */
686 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
689 buffer += blocks_remaining * FLASH_BLOCK_SIZE;
690 address += blocks_remaining * FLASH_BLOCK_SIZE;
691 blocks_remaining = 0;
693 if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
699 The Flash memory programming sequence is as follows:
700 1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
702 2. Set the PG bit in the FLASH_CR register
703 3. 8 x Word access (or Force Write FW)
704 4. Wait for the BSY bit to be cleared
706 while (blocks_remaining > 0) {
707 retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CR), FLASH_PG | FLASH_PSIZE_64);
708 if (retval != ERROR_OK)
711 retval = target_write_buffer(target, address, FLASH_BLOCK_SIZE, buffer);
712 if (retval != ERROR_OK)
715 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
716 if (retval != ERROR_OK)
719 buffer += FLASH_BLOCK_SIZE;
720 address += FLASH_BLOCK_SIZE;
724 if (bytes_remaining) {
725 retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CR), FLASH_PG | FLASH_PSIZE_64);
726 if (retval != ERROR_OK)
729 retval = target_write_buffer(target, address, bytes_remaining, buffer);
730 if (retval != ERROR_OK)
733 /* Force Write buffer of FLASH_BLOCK_SIZE = 32 bytes */
734 retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CR), FLASH_PG | FLASH_PSIZE_64 | FLASH_FW);
735 if (retval != ERROR_OK)
738 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
739 if (retval != ERROR_OK)
744 retval2 = stm32x_lock_reg(bank);
745 if (retval2 != ERROR_OK)
746 LOG_ERROR("error during the lock of flash");
748 if (retval == ERROR_OK)
754 static void setup_sector(struct flash_bank *bank, int start, int num, int size)
756 for (int i = start; i < (start + num) ; i++) {
757 assert(i < bank->num_sectors);
758 bank->sectors[i].offset = bank->size;
759 bank->sectors[i].size = size;
760 bank->size += bank->sectors[i].size;
764 static int stm32x_read_id_code(struct flash_bank *bank, uint32_t *id)
766 /* read stm32 device id register */
767 int retval = target_read_u32(bank->target, DBGMCU_IDCODE_REGISTER, id);
768 if (retval != ERROR_OK)
773 static int stm32x_probe(struct flash_bank *bank)
775 struct target *target = bank->target;
776 struct stm32h7x_flash_bank *stm32x_info = bank->driver_priv;
778 uint16_t flash_size_in_kb;
780 uint32_t base_address = FLASH_BANK0_ADDRESS;
781 uint32_t second_bank_base;
783 stm32x_info->probed = 0;
784 stm32x_info->part_info = NULL;
786 int retval = stm32x_read_id_code(bank, &stm32x_info->idcode);
787 if (retval != ERROR_OK)
790 LOG_DEBUG("device id = 0x%08" PRIx32 "", stm32x_info->idcode);
792 device_id = stm32x_info->idcode & 0xfff;
794 for (unsigned int n = 0; n < ARRAY_SIZE(stm32h7x_parts); n++) {
795 if (device_id == stm32h7x_parts[n].id)
796 stm32x_info->part_info = &stm32h7x_parts[n];
798 if (!stm32x_info->part_info) {
799 LOG_WARNING("Cannot identify target as a STM32H7xx family.");
802 LOG_INFO("Device: %s", stm32x_info->part_info->device_str);
805 /* update the address of controller from data base */
806 stm32x_info->flash_base = stm32x_info->part_info->flash_base;
808 /* get flash size from target */
809 retval = target_read_u16(target, stm32x_info->part_info->fsize_base, &flash_size_in_kb);
810 if (retval != ERROR_OK) {
811 /* read error when device has invalid value, set max flash size */
812 flash_size_in_kb = stm32x_info->part_info->max_flash_size_kb;
814 LOG_INFO("flash size probed value %d", flash_size_in_kb);
816 /* Lower flash size devices are single bank */
817 if (stm32x_info->part_info->has_dual_bank && (flash_size_in_kb > stm32x_info->part_info->first_bank_size_kb)) {
818 /* Use the configured base address to determine if this is the first or second flash bank.
819 * Verify that the base address is reasonably correct and determine the flash bank size
821 second_bank_base = base_address + stm32x_info->part_info->first_bank_size_kb * 1024;
822 if (bank->base == second_bank_base) {
823 /* This is the second bank */
824 base_address = second_bank_base;
825 flash_size_in_kb = flash_size_in_kb - stm32x_info->part_info->first_bank_size_kb;
826 /* bank1 also uses a register offset */
827 stm32x_info->flash_base = FLASH_REG_BASE_B1;
828 } else if (bank->base == base_address) {
829 /* This is the first bank */
830 flash_size_in_kb = stm32x_info->part_info->first_bank_size_kb;
832 LOG_WARNING("STM32H flash bank base address config is incorrect."
833 " 0x%" PRIx32 " but should rather be 0x%" PRIx32 " or 0x%" PRIx32,
834 bank->base, base_address, second_bank_base);
837 LOG_INFO("STM32H flash has dual banks. Bank (%d) size is %dkb, base address is 0x%" PRIx32,
838 bank->bank_number, flash_size_in_kb, base_address);
840 LOG_INFO("STM32H flash size is %dkb, base address is 0x%" PRIx32, flash_size_in_kb, base_address);
843 /* if the user sets the size manually then ignore the probed value
844 * this allows us to work around devices that have an invalid flash size register value */
845 if (stm32x_info->user_bank_size) {
846 LOG_INFO("ignoring flash probed value, using configured bank size");
847 flash_size_in_kb = stm32x_info->user_bank_size / 1024;
848 } else if (flash_size_in_kb == 0xffff) {
850 flash_size_in_kb = stm32x_info->part_info->max_flash_size_kb;
853 /* did we assign flash size? */
854 assert(flash_size_in_kb != 0xffff);
856 /* calculate numbers of pages */
857 int num_pages = flash_size_in_kb / stm32x_info->part_info->page_size;
859 /* check that calculation result makes sense */
860 assert(num_pages > 0);
864 bank->sectors = NULL;
867 bank->base = base_address;
868 bank->num_sectors = num_pages;
869 bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
870 if (bank->sectors == NULL) {
871 LOG_ERROR("failed to allocate bank sectors");
877 setup_sector(bank, 0, num_pages, stm32x_info->part_info->page_size * 1024);
879 for (i = 0; i < num_pages; i++) {
880 bank->sectors[i].is_erased = -1;
881 bank->sectors[i].is_protected = 0;
884 stm32x_info->probed = 1;
888 static int stm32x_auto_probe(struct flash_bank *bank)
890 struct stm32h7x_flash_bank *stm32x_info = bank->driver_priv;
892 if (stm32x_info->probed)
895 return stm32x_probe(bank);
898 /* This method must return a string displaying information about the bank */
899 static int stm32x_get_info(struct flash_bank *bank, char *buf, int buf_size)
901 struct stm32h7x_flash_bank *stm32x_info = bank->driver_priv;
902 const struct stm32h7x_part_info *info = stm32x_info->part_info;
904 if (!stm32x_info->probed) {
905 int retval = stm32x_probe(bank);
906 if (retval != ERROR_OK) {
907 snprintf(buf, buf_size, "Unable to find bank information.");
913 const char *rev_str = NULL;
914 uint16_t rev_id = stm32x_info->idcode >> 16;
916 for (unsigned int i = 0; i < info->num_revs; i++)
917 if (rev_id == info->revs[i].rev)
918 rev_str = info->revs[i].str;
920 if (rev_str != NULL) {
921 snprintf(buf, buf_size, "%s - Rev: %s",
922 stm32x_info->part_info->device_str, rev_str);
924 snprintf(buf, buf_size,
925 "%s - Rev: unknown (0x%04x)",
926 stm32x_info->part_info->device_str, rev_id);
929 snprintf(buf, buf_size, "Cannot identify target as a STM32H7x");
935 COMMAND_HANDLER(stm32x_handle_lock_command)
937 struct target *target = NULL;
938 struct stm32h7x_flash_bank *stm32x_info = NULL;
941 return ERROR_COMMAND_SYNTAX_ERROR;
943 struct flash_bank *bank;
944 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
945 if (ERROR_OK != retval)
948 stm32x_info = bank->driver_priv;
949 target = bank->target;
951 /* if we have a dual flash bank device then
952 * we need to perform option byte lock on bank0 only */
953 if (stm32x_info->flash_base != FLASH_REG_BASE_B0) {
954 LOG_ERROR("Option Byte Lock Operation must use bank0");
955 return ERROR_FLASH_OPERATION_FAILED;
958 if (target->state != TARGET_HALTED) {
959 LOG_ERROR("Target not halted");
960 return ERROR_TARGET_NOT_HALTED;
963 if (stm32x_read_options(bank) != ERROR_OK) {
964 command_print(CMD_CTX, "%s failed to read options",
968 /* set readout protection */
969 stm32x_info->option_bytes.RDP = 0;
971 if (stm32x_write_options(bank) != ERROR_OK) {
972 command_print(CMD_CTX, "%s failed to lock device",
976 command_print(CMD_CTX, "%s locked", bank->driver->name);
981 COMMAND_HANDLER(stm32x_handle_unlock_command)
983 struct target *target = NULL;
984 struct stm32h7x_flash_bank *stm32x_info = NULL;
987 return ERROR_COMMAND_SYNTAX_ERROR;
989 struct flash_bank *bank;
990 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
991 if (ERROR_OK != retval)
994 stm32x_info = bank->driver_priv;
995 target = bank->target;
997 /* if we have a dual flash bank device then
998 * we need to perform option byte unlock on bank0 only */
999 if (stm32x_info->flash_base != FLASH_REG_BASE_B0) {
1000 LOG_ERROR("Option Byte Unlock Operation must use bank0");
1001 return ERROR_FLASH_OPERATION_FAILED;
1004 if (target->state != TARGET_HALTED) {
1005 LOG_ERROR("Target not halted");
1006 return ERROR_TARGET_NOT_HALTED;
1009 if (stm32x_read_options(bank) != ERROR_OK) {
1010 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
1014 /* clear readout protection option byte
1015 * this will also force a device unlock if set */
1016 stm32x_info->option_bytes.RDP = 0xAA;
1018 if (stm32x_write_options(bank) != ERROR_OK) {
1019 command_print(CMD_CTX, "%s failed to unlock device", bank->driver->name);
1022 command_print(CMD_CTX, "%s unlocked.\n", bank->driver->name);
1027 static int stm32x_mass_erase(struct flash_bank *bank)
1030 struct target *target = bank->target;
1032 if (target->state != TARGET_HALTED) {
1033 LOG_ERROR("Target not halted");
1034 return ERROR_TARGET_NOT_HALTED;
1037 retval = stm32x_unlock_reg(bank);
1038 if (retval != ERROR_OK)
1041 /* mass erase flash memory bank */
1042 retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CR), FLASH_BER_CMD | FLASH_PSIZE_64);
1043 if (retval != ERROR_OK)
1046 retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CR),
1047 FLASH_BER_CMD | FLASH_PSIZE_64 | FLASH_START);
1048 if (retval != ERROR_OK)
1051 retval = stm32x_wait_status_busy(bank, 30000);
1052 if (retval != ERROR_OK)
1055 retval = stm32x_lock_reg(bank);
1056 if (retval != ERROR_OK) {
1057 LOG_ERROR("error during the lock of flash");
1063 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
1068 command_print(CMD_CTX, "stm32h7x mass_erase <bank>");
1069 return ERROR_COMMAND_SYNTAX_ERROR;
1072 struct flash_bank *bank;
1073 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1074 if (ERROR_OK != retval)
1077 retval = stm32x_mass_erase(bank);
1078 if (retval == ERROR_OK) {
1079 /* set all sectors as erased */
1080 for (i = 0; i < bank->num_sectors; i++)
1081 bank->sectors[i].is_erased = 1;
1083 command_print(CMD_CTX, "stm32h7x mass erase complete");
1085 command_print(CMD_CTX, "stm32h7x mass erase failed");
1091 static const struct command_registration stm32x_exec_command_handlers[] = {
1094 .handler = stm32x_handle_lock_command,
1095 .mode = COMMAND_EXEC,
1097 .help = "Lock entire flash device.",
1101 .handler = stm32x_handle_unlock_command,
1102 .mode = COMMAND_EXEC,
1104 .help = "Unlock entire protected flash device.",
1107 .name = "mass_erase",
1108 .handler = stm32x_handle_mass_erase_command,
1109 .mode = COMMAND_EXEC,
1111 .help = "Erase entire flash device.",
1113 COMMAND_REGISTRATION_DONE
1116 static const struct command_registration stm32x_command_handlers[] = {
1119 .mode = COMMAND_ANY,
1120 .help = "stm32h7x flash command group",
1122 .chain = stm32x_exec_command_handlers,
1124 COMMAND_REGISTRATION_DONE
1127 struct flash_driver stm32h7x_flash = {
1129 .commands = stm32x_command_handlers,
1130 .flash_bank_command = stm32x_flash_bank_command,
1131 .erase = stm32x_erase,
1132 .protect = stm32x_protect,
1133 .write = stm32x_write,
1134 .read = default_flash_read,
1135 .probe = stm32x_probe,
1136 .auto_probe = stm32x_auto_probe,
1137 .erase_check = default_flash_blank_check,
1138 .protect_check = stm32x_protect_check,
1139 .info = stm32x_get_info,
1140 .free_driver_priv = default_flash_free_driver_priv,