1 /***************************************************************************
2 * Copyright (C) 2017 by STMicroelectronics *
4 * This program is free software; you can redistribute it and/or modify *
5 * it under the terms of the GNU General Public License as published by *
6 * the Free Software Foundation; either version 2 of the License, or *
7 * (at your option) any later version. *
9 * This program is distributed in the hope that it will be useful, *
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
12 * GNU General Public License for more details. *
14 * You should have received a copy of the GNU General Public License *
15 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
16 ***************************************************************************/
22 #include <helper/binarybuffer.h>
23 #include <target/algorithm.h>
24 #include <target/armv7m.h>
27 /* Erase time can be as high as 1000ms, 10x this and it's toast... */
28 #define FLASH_ERASE_TIMEOUT 10000
29 #define FLASH_WRITE_TIMEOUT 5
32 /* Same Flash registers for both banks, */
33 /* access depends on Flash Base address */
34 #define FLASH_ACR 0x00
35 #define FLASH_KEYR 0x04
36 #define FLASH_OPTKEYR 0x08
39 #define FLASH_CCR 0x14
40 #define FLASH_OPTCR 0x18
41 #define FLASH_OPTCUR 0x1C
42 #define FLASH_OPTPRG 0x20
43 #define FLASH_OPTCCR 0x24
44 #define FLASH_WPSNCUR 0x38
45 #define FLASH_WPSNPRG 0x3C
48 /* FLASH_CR register bits */
49 #define FLASH_LOCK (1 << 0)
50 #define FLASH_PG (1 << 1)
51 #define FLASH_SER (1 << 2)
52 #define FLASH_BER_CMD (1 << 3)
53 #define FLASH_PSIZE_8 (0 << 4)
54 #define FLASH_PSIZE_16 (1 << 4)
55 #define FLASH_PSIZE_32 (2 << 4)
56 #define FLASH_PSIZE_64 (3 << 4)
57 #define FLASH_FW (1 << 6)
58 #define FLASH_START (1 << 7)
60 #define FLASH_SNB(a) ((a) << 8)
62 /* FLASH_SR register bits */
63 #define FLASH_BSY (1 << 0) /* Operation in progress */
64 #define FLASH_WRPERR (1 << 17) /* Write protection error */
65 #define FLASH_PGSERR (1 << 18) /* Programming sequence error */
66 #define FLASH_STRBERR (1 << 19) /* Strobe error */
67 #define FLASH_INCERR (1 << 21) /* Increment error */
68 #define FLASH_OPERR (1 << 22) /* Operation error */
69 #define FLASH_RDPERR (1 << 23) /* Read Protection error */
70 #define FLASH_RDSERR (1 << 24) /* Secure Protection error */
71 #define FLASH_SNECCERR (1 << 25) /* Single ECC error */
72 #define FLASH_DBECCERR (1 << 26) /* Double ECC error */
74 #define FLASH_ERROR (FLASH_WRPERR | FLASH_PGSERR | FLASH_STRBERR | FLASH_INCERR | FLASH_OPERR | \
75 FLASH_RDPERR | FLASH_RDSERR | FLASH_SNECCERR | FLASH_DBECCERR)
77 /* FLASH_OPTCR register bits */
78 #define OPT_LOCK (1 << 0)
79 #define OPT_START (1 << 1)
81 /* FLASH_OPTCUR bit definitions (reading) */
82 #define IWDG1_HW (1 << 4)
84 /* register unlock keys */
85 #define KEY1 0x45670123
86 #define KEY2 0xCDEF89AB
88 /* option register unlock key */
89 #define OPTKEY1 0x08192A3B
90 #define OPTKEY2 0x4C5D6E7F
92 #define DBGMCU_IDCODE_REGISTER 0x5C001000
93 #define FLASH_BANK0_ADDRESS 0x08000000
94 #define FLASH_BANK1_ADDRESS 0x08100000
95 #define FLASH_REG_BASE_B0 0x52002000
96 #define FLASH_REG_BASE_B1 0x52002100
97 #define FLASH_SIZE_ADDRESS 0x1FF1E880
98 #define FLASH_BLOCK_SIZE 32
100 struct stm32h7x_rev {
105 struct stm32x_options {
107 uint32_t protection; /* bank1 WRP */
108 uint32_t protection2; /* bank2 WRP */
109 uint8_t user_options;
110 uint8_t user2_options;
111 uint8_t user3_options;
112 uint8_t independent_watchdog_selection;
115 struct stm32h7x_part_info {
117 const char *device_str;
118 const struct stm32h7x_rev *revs;
120 unsigned int page_size;
121 unsigned int pages_per_sector;
122 uint16_t max_flash_size_kb;
123 uint8_t has_dual_bank;
124 uint16_t first_bank_size_kb; /* Used when has_dual_bank is true */
125 uint32_t flash_base; /* Flash controller registers location */
126 uint32_t fsize_base; /* Location of FSIZE register */
129 struct stm32h7x_flash_bank {
132 uint32_t user_bank_size;
133 uint32_t flash_base; /* Address of flash reg controller */
134 struct stm32x_options option_bytes;
135 const struct stm32h7x_part_info *part_info;
138 static const struct stm32h7x_rev stm32_450_revs[] = {
139 { 0x1000, "A" }, { 0x1001, "Z" }, { 0x1003, "Y" },
142 static const struct stm32h7x_part_info stm32h7x_parts[] = {
145 .revs = stm32_450_revs,
146 .num_revs = ARRAY_SIZE(stm32_450_revs),
147 .device_str = "STM32H7xx 2M",
148 .page_size = 128, /* 128 KB */
149 .max_flash_size_kb = 2048,
150 .first_bank_size_kb = 1024,
152 .flash_base = FLASH_REG_BASE_B0,
153 .fsize_base = FLASH_SIZE_ADDRESS,
157 static int stm32x_unlock_reg(struct flash_bank *bank);
158 static int stm32x_lock_reg(struct flash_bank *bank);
159 static int stm32x_probe(struct flash_bank *bank);
161 /* flash bank stm32x <base> <size> 0 0 <target#> */
163 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
165 struct stm32h7x_flash_bank *stm32x_info;
168 return ERROR_COMMAND_SYNTAX_ERROR;
170 stm32x_info = malloc(sizeof(struct stm32h7x_flash_bank));
171 bank->driver_priv = stm32x_info;
173 stm32x_info->probed = 0;
174 stm32x_info->user_bank_size = bank->size;
179 static inline uint32_t stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
181 struct stm32h7x_flash_bank *stm32x_info = bank->driver_priv;
182 return reg + stm32x_info->flash_base;
185 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
187 struct target *target = bank->target;
188 return target_read_u32(target, stm32x_get_flash_reg(bank, FLASH_SR), status);
191 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
193 struct target *target = bank->target;
194 struct stm32h7x_flash_bank *stm32x_info = bank->driver_priv;
198 /* wait for busy to clear */
200 retval = stm32x_get_flash_status(bank, &status);
201 if (retval != ERROR_OK) {
202 LOG_INFO("wait_status_busy, target_read_u32 : error : remote address 0x%x", stm32x_info->flash_base);
206 if ((status & FLASH_BSY) == 0)
209 if (timeout-- <= 0) {
210 LOG_INFO("wait_status_busy, time out expired, status: 0x%" PRIx32 "", status);
216 if (status & FLASH_WRPERR) {
217 LOG_INFO("wait_status_busy, WRPERR : error : remote address 0x%x", stm32x_info->flash_base);
221 /* Clear error + EOP flags but report errors */
222 if (status & FLASH_ERROR) {
223 if (retval == ERROR_OK)
225 /* If this operation fails, we ignore it and report the original retval */
226 target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CCR), status);
231 static int stm32x_unlock_reg(struct flash_bank *bank)
234 struct target *target = bank->target;
236 /* first check if not already unlocked
237 * otherwise writing on FLASH_KEYR will fail
239 int retval = target_read_u32(target, stm32x_get_flash_reg(bank, FLASH_CR), &ctrl);
240 if (retval != ERROR_OK)
243 if ((ctrl & FLASH_LOCK) == 0)
246 /* unlock flash registers for bank */
247 retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_KEYR), KEY1);
248 if (retval != ERROR_OK)
251 retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_KEYR), KEY2);
252 if (retval != ERROR_OK)
255 retval = target_read_u32(target, stm32x_get_flash_reg(bank, FLASH_CR), &ctrl);
256 if (retval != ERROR_OK)
259 if (ctrl & FLASH_LOCK) {
260 LOG_ERROR("flash not unlocked STM32_FLASH_CRx: %" PRIx32, ctrl);
261 return ERROR_TARGET_FAILURE;
266 static int stm32x_unlock_option_reg(struct flash_bank *bank)
269 struct target *target = bank->target;
271 int retval = target_read_u32(target, FLASH_REG_BASE_B0 + FLASH_OPTCR, &ctrl);
272 if (retval != ERROR_OK)
275 if ((ctrl & OPT_LOCK) == 0)
278 /* unlock option registers */
279 retval = target_write_u32(target, FLASH_REG_BASE_B0 + FLASH_OPTKEYR, OPTKEY1);
280 if (retval != ERROR_OK)
283 retval = target_write_u32(target, FLASH_REG_BASE_B0 + FLASH_OPTKEYR, OPTKEY2);
284 if (retval != ERROR_OK)
287 retval = target_read_u32(target, FLASH_REG_BASE_B0 + FLASH_OPTCR, &ctrl);
288 if (retval != ERROR_OK)
291 if (ctrl & OPT_LOCK) {
292 LOG_ERROR("options not unlocked STM32_FLASH_OPTCR: %" PRIx32, ctrl);
293 return ERROR_TARGET_FAILURE;
299 static int stm32x_lock_reg(struct flash_bank *bank)
301 struct target *target = bank->target;
304 int retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CR), FLASH_LOCK);
305 if (retval != ERROR_OK)
311 static int stm32x_read_options(struct flash_bank *bank)
314 struct stm32h7x_flash_bank *stm32x_info = NULL;
315 struct target *target = bank->target;
317 stm32x_info = bank->driver_priv;
319 /* read current option bytes */
320 int retval = target_read_u32(target, FLASH_REG_BASE_B0 + FLASH_OPTCUR, &optiondata);
321 if (retval != ERROR_OK)
324 /* decode option data */
325 stm32x_info->option_bytes.user_options = optiondata & 0xfc;
326 stm32x_info->option_bytes.RDP = (optiondata >> 8) & 0xff;
327 stm32x_info->option_bytes.user2_options = (optiondata >> 16) & 0xff;
328 stm32x_info->option_bytes.user3_options = (optiondata >> 24) & 0x83;
330 if (optiondata & IWDG1_HW)
331 stm32x_info->option_bytes.independent_watchdog_selection = 1;
333 stm32x_info->option_bytes.independent_watchdog_selection = 0;
335 if (stm32x_info->option_bytes.RDP != 0xAA)
336 LOG_INFO("Device Security Bit Set");
338 /* read current WPSN option bytes */
339 retval = target_read_u32(target, FLASH_REG_BASE_B0 + FLASH_WPSNCUR, &optiondata);
340 if (retval != ERROR_OK)
342 stm32x_info->option_bytes.protection = optiondata & 0xff;
344 /* read current WPSN2 option bytes */
345 retval = target_read_u32(target, FLASH_REG_BASE_B1 + FLASH_WPSNCUR, &optiondata);
346 if (retval != ERROR_OK)
348 stm32x_info->option_bytes.protection2 = optiondata & 0xff;
353 static int stm32x_write_options(struct flash_bank *bank)
355 struct stm32h7x_flash_bank *stm32x_info = NULL;
356 struct target *target = bank->target;
359 stm32x_info = bank->driver_priv;
361 int retval = stm32x_unlock_option_reg(bank);
362 if (retval != ERROR_OK)
365 /* rebuild option data */
366 optiondata = stm32x_info->option_bytes.user_options;
367 optiondata |= (stm32x_info->option_bytes.RDP << 8);
368 optiondata |= (stm32x_info->option_bytes.user2_options & 0xff) << 16;
369 optiondata |= (stm32x_info->option_bytes.user3_options & 0x83) << 24;
371 if (stm32x_info->option_bytes.independent_watchdog_selection)
372 optiondata |= IWDG1_HW;
374 optiondata &= ~IWDG1_HW;
376 /* program options */
377 retval = target_write_u32(target, FLASH_REG_BASE_B0 + FLASH_OPTPRG, optiondata);
378 if (retval != ERROR_OK)
381 optiondata = stm32x_info->option_bytes.protection & 0xff;
382 /* Program protection WPSNPRG */
383 retval = target_write_u32(target, FLASH_REG_BASE_B0 + FLASH_WPSNPRG, optiondata);
384 if (retval != ERROR_OK)
387 optiondata = stm32x_info->option_bytes.protection2 & 0xff;
388 /* Program protection WPSNPRG2 */
389 retval = target_write_u32(target, FLASH_REG_BASE_B1 + FLASH_WPSNPRG, optiondata);
390 if (retval != ERROR_OK)
393 optiondata = 0x40000000;
394 /* Remove OPT error flag before programming */
395 retval = target_write_u32(target, FLASH_REG_BASE_B0 + FLASH_OPTCCR, optiondata);
396 if (retval != ERROR_OK)
399 /* start programming cycle */
400 retval = target_write_u32(target, FLASH_REG_BASE_B0 + FLASH_OPTCR, OPT_START);
401 if (retval != ERROR_OK)
404 /* wait for completion */
405 int timeout = FLASH_ERASE_TIMEOUT;
408 retval = target_read_u32(target, FLASH_REG_BASE_B0 + FLASH_SR, &status);
409 if (retval != ERROR_OK) {
410 LOG_INFO("stm32x_write_options: wait_status_busy : error");
413 if ((status & FLASH_BSY) == 0)
416 if (timeout-- <= 0) {
417 LOG_INFO("wait_status_busy, time out expired, status: 0x%" PRIx32 "", status);
423 /* relock option registers */
424 retval = target_write_u32(target, FLASH_REG_BASE_B0 + FLASH_OPTCR, OPT_LOCK);
425 if (retval != ERROR_OK)
431 static int stm32x_protect_check(struct flash_bank *bank)
433 struct stm32h7x_flash_bank *stm32x_info = bank->driver_priv;
435 /* read 'write protection' settings */
436 int retval = stm32x_read_options(bank);
437 if (retval != ERROR_OK) {
438 LOG_DEBUG("unable to read option bytes");
442 for (int i = 0; i < bank->num_sectors; i++) {
443 if (stm32x_info->flash_base == FLASH_REG_BASE_B0) {
444 if (stm32x_info->option_bytes.protection & (1 << i))
445 bank->sectors[i].is_protected = 0;
447 bank->sectors[i].is_protected = 1;
449 if (stm32x_info->option_bytes.protection2 & (1 << i))
450 bank->sectors[i].is_protected = 0;
452 bank->sectors[i].is_protected = 1;
458 static int stm32x_erase(struct flash_bank *bank, int first, int last)
460 struct target *target = bank->target;
463 assert(first < bank->num_sectors);
464 assert(last < bank->num_sectors);
466 if (bank->target->state != TARGET_HALTED)
467 return ERROR_TARGET_NOT_HALTED;
469 retval = stm32x_unlock_reg(bank);
470 if (retval != ERROR_OK)
475 To erase a sector, follow the procedure below:
476 1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
478 2. Set the SER bit and select the sector
479 you wish to erase (SNB) in the FLASH_CR register
480 3. Set the STRT bit in the FLASH_CR register
481 4. Wait for the BSY bit to be cleared
483 for (int i = first; i <= last; i++) {
484 LOG_DEBUG("erase sector %d", i);
485 retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CR),
486 FLASH_SER | FLASH_SNB(i) | FLASH_PSIZE_64);
487 if (retval != ERROR_OK) {
488 LOG_ERROR("Error erase sector %d", i);
491 retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CR),
492 FLASH_SER | FLASH_SNB(i) | FLASH_PSIZE_64 | FLASH_START);
493 if (retval != ERROR_OK) {
494 LOG_ERROR("Error erase sector %d", i);
497 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
499 if (retval != ERROR_OK) {
500 LOG_ERROR("erase time-out or operation error sector %d", i);
503 bank->sectors[i].is_erased = 1;
506 retval = stm32x_lock_reg(bank);
507 if (retval != ERROR_OK) {
508 LOG_ERROR("error during the lock of flash");
515 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
517 struct target *target = bank->target;
518 struct stm32h7x_flash_bank *stm32x_info = bank->driver_priv;
520 if (target->state != TARGET_HALTED) {
521 LOG_ERROR("Target not halted");
522 return ERROR_TARGET_NOT_HALTED;
524 /* read protection settings */
525 int retval = stm32x_read_options(bank);
526 if (retval != ERROR_OK) {
527 LOG_DEBUG("unable to read option bytes");
531 for (int i = first; i <= last; i++) {
532 if (stm32x_info->flash_base == FLASH_REG_BASE_B0) {
534 stm32x_info->option_bytes.protection &= ~(1 << i);
536 stm32x_info->option_bytes.protection |= (1 << i);
539 stm32x_info->option_bytes.protection2 &= ~(1 << i);
541 stm32x_info->option_bytes.protection2 |= (1 << i);
545 LOG_INFO("stm32x_protect, option_bytes written WRP1 0x%x , WRP2 0x%x",
546 (stm32x_info->option_bytes.protection & 0xff), (stm32x_info->option_bytes.protection2 & 0xff));
548 retval = stm32x_write_options(bank);
549 if (retval != ERROR_OK)
555 static int stm32x_write_block(struct flash_bank *bank, const uint8_t *buffer,
556 uint32_t offset, uint32_t count)
558 struct target *target = bank->target;
560 * If the size of the data part of the buffer is not a multiple of FLASH_BLOCK_SIZE, we get
561 * "corrupted fifo read" pointer in target_run_flash_async_algorithm()
563 uint32_t data_size = 512 * FLASH_BLOCK_SIZE; /* 16384 */
564 uint32_t buffer_size = 8 + data_size;
565 struct working_area *write_algorithm;
566 struct working_area *source;
567 uint32_t address = bank->base + offset;
568 struct reg_param reg_params[5];
569 struct armv7m_algorithm armv7m_info;
570 struct stm32h7x_flash_bank *stm32x_info = bank->driver_priv;
571 int retval = ERROR_OK;
573 static const uint8_t stm32x_flash_write_code[] = {
574 #include "../../../contrib/loaders/flash/stm32/stm32h7x.inc"
577 if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
578 &write_algorithm) != ERROR_OK) {
579 LOG_WARNING("no working area available, can't do block memory writes");
580 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
583 retval = target_write_buffer(target, write_algorithm->address,
584 sizeof(stm32x_flash_write_code),
585 stm32x_flash_write_code);
586 if (retval != ERROR_OK)
590 while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
592 buffer_size = 8 + data_size;
593 if (data_size <= 256) {
594 /* we already allocated the writing code, but failed to get a
595 * buffer, free the algorithm */
596 target_free_working_area(target, write_algorithm);
598 LOG_WARNING("no large enough working area available, can't do block memory writes");
599 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
603 LOG_DEBUG("target_alloc_working_area_try : buffer_size -> 0x%x", buffer_size);
605 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
606 armv7m_info.core_mode = ARM_MODE_THREAD;
608 init_reg_param(®_params[0], "r0", 32, PARAM_IN_OUT); /* buffer start, status (out) */
609 init_reg_param(®_params[1], "r1", 32, PARAM_OUT); /* buffer end */
610 init_reg_param(®_params[2], "r2", 32, PARAM_OUT); /* target address */
611 init_reg_param(®_params[3], "r3", 32, PARAM_OUT); /* count (word-256 bits) */
612 init_reg_param(®_params[4], "r4", 32, PARAM_OUT); /* flash reg base */
614 buf_set_u32(reg_params[0].value, 0, 32, source->address);
615 buf_set_u32(reg_params[1].value, 0, 32, source->address + source->size);
616 buf_set_u32(reg_params[2].value, 0, 32, address);
617 buf_set_u32(reg_params[3].value, 0, 32, count);
618 buf_set_u32(reg_params[4].value, 0, 32, stm32x_info->flash_base);
620 retval = target_run_flash_async_algorithm(target,
626 source->address, source->size,
627 write_algorithm->address, 0,
630 if (retval == ERROR_FLASH_OPERATION_FAILED) {
631 LOG_INFO("error executing stm32h7x flash write algorithm");
633 uint32_t flash_sr = buf_get_u32(reg_params[0].value, 0, 32);
635 if (flash_sr & FLASH_WRPERR)
636 LOG_ERROR("flash memory write protected");
638 if ((flash_sr & FLASH_ERROR) != 0) {
639 LOG_ERROR("flash write failed, FLASH_SR = %08" PRIx32, flash_sr);
640 /* Clear error + EOP flags but report errors */
641 target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CCR), flash_sr);
646 target_free_working_area(target, source);
647 target_free_working_area(target, write_algorithm);
649 destroy_reg_param(®_params[0]);
650 destroy_reg_param(®_params[1]);
651 destroy_reg_param(®_params[2]);
652 destroy_reg_param(®_params[3]);
653 destroy_reg_param(®_params[4]);
657 static int stm32x_write(struct flash_bank *bank, const uint8_t *buffer,
658 uint32_t offset, uint32_t count)
660 struct target *target = bank->target;
661 uint32_t address = bank->base + offset;
664 if (bank->target->state != TARGET_HALTED) {
665 LOG_ERROR("Target not halted");
666 return ERROR_TARGET_NOT_HALTED;
669 if (offset % FLASH_BLOCK_SIZE) {
670 LOG_WARNING("offset 0x%" PRIx32 " breaks required 32-byte alignment", offset);
671 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
674 retval = stm32x_unlock_reg(bank);
675 if (retval != ERROR_OK)
678 uint32_t blocks_remaining = count / FLASH_BLOCK_SIZE;
679 uint32_t bytes_remaining = count % FLASH_BLOCK_SIZE;
681 /* multiple words (32-bytes) to be programmed in block */
682 if (blocks_remaining) {
683 retval = stm32x_write_block(bank, buffer, offset, blocks_remaining);
684 if (retval != ERROR_OK) {
685 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
686 /* if block write failed (no sufficient working area),
687 * we use normal (slow) dword accesses */
688 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
691 buffer += blocks_remaining * FLASH_BLOCK_SIZE;
692 address += blocks_remaining * FLASH_BLOCK_SIZE;
693 blocks_remaining = 0;
695 if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
701 The Flash memory programming sequence is as follows:
702 1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
704 2. Set the PG bit in the FLASH_CR register
705 3. 8 x Word access (or Force Write FW)
706 4. Wait for the BSY bit to be cleared
708 while (blocks_remaining > 0) {
709 retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CR), FLASH_PG | FLASH_PSIZE_64);
710 if (retval != ERROR_OK)
713 retval = target_write_buffer(target, address, FLASH_BLOCK_SIZE, buffer);
714 if (retval != ERROR_OK)
717 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
718 if (retval != ERROR_OK)
721 buffer += FLASH_BLOCK_SIZE;
722 address += FLASH_BLOCK_SIZE;
726 if (bytes_remaining) {
727 retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CR), FLASH_PG | FLASH_PSIZE_64);
728 if (retval != ERROR_OK)
731 retval = target_write_buffer(target, address, bytes_remaining, buffer);
732 if (retval != ERROR_OK)
735 /* Force Write buffer of FLASH_BLOCK_SIZE = 32 bytes */
736 retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CR), FLASH_PG | FLASH_PSIZE_64 | FLASH_FW);
737 if (retval != ERROR_OK)
740 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
741 if (retval != ERROR_OK)
746 retval2 = stm32x_lock_reg(bank);
747 if (retval2 != ERROR_OK)
748 LOG_ERROR("error during the lock of flash");
750 if (retval == ERROR_OK)
756 static void setup_sector(struct flash_bank *bank, int start, int num, int size)
758 for (int i = start; i < (start + num) ; i++) {
759 assert(i < bank->num_sectors);
760 bank->sectors[i].offset = bank->size;
761 bank->sectors[i].size = size;
762 bank->size += bank->sectors[i].size;
766 static int stm32x_read_id_code(struct flash_bank *bank, uint32_t *id)
768 /* read stm32 device id register */
769 int retval = target_read_u32(bank->target, DBGMCU_IDCODE_REGISTER, id);
770 if (retval != ERROR_OK)
775 static int stm32x_probe(struct flash_bank *bank)
777 struct target *target = bank->target;
778 struct stm32h7x_flash_bank *stm32x_info = bank->driver_priv;
780 uint16_t flash_size_in_kb;
782 uint32_t base_address = FLASH_BANK0_ADDRESS;
783 uint32_t second_bank_base;
785 stm32x_info->probed = 0;
786 stm32x_info->part_info = NULL;
788 int retval = stm32x_read_id_code(bank, &stm32x_info->idcode);
789 if (retval != ERROR_OK)
792 LOG_DEBUG("device id = 0x%08" PRIx32 "", stm32x_info->idcode);
794 device_id = stm32x_info->idcode & 0xfff;
796 for (unsigned int n = 0; n < ARRAY_SIZE(stm32h7x_parts); n++) {
797 if (device_id == stm32h7x_parts[n].id)
798 stm32x_info->part_info = &stm32h7x_parts[n];
800 if (!stm32x_info->part_info) {
801 LOG_WARNING("Cannot identify target as a STM32H7xx family.");
804 LOG_INFO("Device: %s", stm32x_info->part_info->device_str);
807 /* update the address of controller from data base */
808 stm32x_info->flash_base = stm32x_info->part_info->flash_base;
810 /* get flash size from target */
811 retval = target_read_u16(target, stm32x_info->part_info->fsize_base, &flash_size_in_kb);
812 if (retval != ERROR_OK) {
813 /* read error when device has invalid value, set max flash size */
814 flash_size_in_kb = stm32x_info->part_info->max_flash_size_kb;
816 LOG_INFO("flash size probed value %d", flash_size_in_kb);
818 /* Lower flash size devices are single bank */
819 if (stm32x_info->part_info->has_dual_bank && (flash_size_in_kb > stm32x_info->part_info->first_bank_size_kb)) {
820 /* Use the configured base address to determine if this is the first or second flash bank.
821 * Verify that the base address is reasonably correct and determine the flash bank size
823 second_bank_base = base_address + stm32x_info->part_info->first_bank_size_kb * 1024;
824 if (bank->base == second_bank_base) {
825 /* This is the second bank */
826 base_address = second_bank_base;
827 flash_size_in_kb = flash_size_in_kb - stm32x_info->part_info->first_bank_size_kb;
828 /* bank1 also uses a register offset */
829 stm32x_info->flash_base = FLASH_REG_BASE_B1;
830 } else if (bank->base == base_address) {
831 /* This is the first bank */
832 flash_size_in_kb = stm32x_info->part_info->first_bank_size_kb;
834 LOG_WARNING("STM32H flash bank base address config is incorrect."
835 " 0x%" PRIx32 " but should rather be 0x%" PRIx32 " or 0x%" PRIx32,
836 bank->base, base_address, second_bank_base);
839 LOG_INFO("STM32H flash has dual banks. Bank (%d) size is %dkb, base address is 0x%" PRIx32,
840 bank->bank_number, flash_size_in_kb, base_address);
842 LOG_INFO("STM32H flash size is %dkb, base address is 0x%" PRIx32, flash_size_in_kb, base_address);
845 /* if the user sets the size manually then ignore the probed value
846 * this allows us to work around devices that have an invalid flash size register value */
847 if (stm32x_info->user_bank_size) {
848 LOG_INFO("ignoring flash probed value, using configured bank size");
849 flash_size_in_kb = stm32x_info->user_bank_size / 1024;
850 } else if (flash_size_in_kb == 0xffff) {
852 flash_size_in_kb = stm32x_info->part_info->max_flash_size_kb;
855 /* did we assign flash size? */
856 assert(flash_size_in_kb != 0xffff);
858 /* calculate numbers of pages */
859 int num_pages = flash_size_in_kb / stm32x_info->part_info->page_size;
861 /* check that calculation result makes sense */
862 assert(num_pages > 0);
866 bank->sectors = NULL;
869 bank->base = base_address;
870 bank->num_sectors = num_pages;
871 bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
872 if (bank->sectors == NULL) {
873 LOG_ERROR("failed to allocate bank sectors");
879 setup_sector(bank, 0, num_pages, stm32x_info->part_info->page_size * 1024);
881 for (i = 0; i < num_pages; i++) {
882 bank->sectors[i].is_erased = -1;
883 bank->sectors[i].is_protected = 0;
886 stm32x_info->probed = 1;
890 static int stm32x_auto_probe(struct flash_bank *bank)
892 struct stm32h7x_flash_bank *stm32x_info = bank->driver_priv;
894 if (stm32x_info->probed)
897 return stm32x_probe(bank);
900 /* This method must return a string displaying information about the bank */
901 static int stm32x_get_info(struct flash_bank *bank, char *buf, int buf_size)
903 struct stm32h7x_flash_bank *stm32x_info = bank->driver_priv;
904 const struct stm32h7x_part_info *info = stm32x_info->part_info;
906 if (!stm32x_info->probed) {
907 int retval = stm32x_probe(bank);
908 if (retval != ERROR_OK) {
909 snprintf(buf, buf_size, "Unable to find bank information.");
915 const char *rev_str = NULL;
916 uint16_t rev_id = stm32x_info->idcode >> 16;
918 for (unsigned int i = 0; i < info->num_revs; i++)
919 if (rev_id == info->revs[i].rev)
920 rev_str = info->revs[i].str;
922 if (rev_str != NULL) {
923 snprintf(buf, buf_size, "%s - Rev: %s",
924 stm32x_info->part_info->device_str, rev_str);
926 snprintf(buf, buf_size,
927 "%s - Rev: unknown (0x%04x)",
928 stm32x_info->part_info->device_str, rev_id);
931 snprintf(buf, buf_size, "Cannot identify target as a STM32H7x");
937 COMMAND_HANDLER(stm32x_handle_lock_command)
939 struct target *target = NULL;
940 struct stm32h7x_flash_bank *stm32x_info = NULL;
943 return ERROR_COMMAND_SYNTAX_ERROR;
945 struct flash_bank *bank;
946 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
947 if (ERROR_OK != retval)
950 stm32x_info = bank->driver_priv;
951 target = bank->target;
953 /* if we have a dual flash bank device then
954 * we need to perform option byte lock on bank0 only */
955 if (stm32x_info->flash_base != FLASH_REG_BASE_B0) {
956 LOG_ERROR("Option Byte Lock Operation must use bank0");
957 return ERROR_FLASH_OPERATION_FAILED;
960 if (target->state != TARGET_HALTED) {
961 LOG_ERROR("Target not halted");
962 return ERROR_TARGET_NOT_HALTED;
965 if (stm32x_read_options(bank) != ERROR_OK) {
966 command_print(CMD_CTX, "%s failed to read options",
970 /* set readout protection */
971 stm32x_info->option_bytes.RDP = 0;
973 if (stm32x_write_options(bank) != ERROR_OK) {
974 command_print(CMD_CTX, "%s failed to lock device",
978 command_print(CMD_CTX, "%s locked", bank->driver->name);
983 COMMAND_HANDLER(stm32x_handle_unlock_command)
985 struct target *target = NULL;
986 struct stm32h7x_flash_bank *stm32x_info = NULL;
989 return ERROR_COMMAND_SYNTAX_ERROR;
991 struct flash_bank *bank;
992 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
993 if (ERROR_OK != retval)
996 stm32x_info = bank->driver_priv;
997 target = bank->target;
999 /* if we have a dual flash bank device then
1000 * we need to perform option byte unlock on bank0 only */
1001 if (stm32x_info->flash_base != FLASH_REG_BASE_B0) {
1002 LOG_ERROR("Option Byte Unlock Operation must use bank0");
1003 return ERROR_FLASH_OPERATION_FAILED;
1006 if (target->state != TARGET_HALTED) {
1007 LOG_ERROR("Target not halted");
1008 return ERROR_TARGET_NOT_HALTED;
1011 if (stm32x_read_options(bank) != ERROR_OK) {
1012 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
1016 /* clear readout protection option byte
1017 * this will also force a device unlock if set */
1018 stm32x_info->option_bytes.RDP = 0xAA;
1020 if (stm32x_write_options(bank) != ERROR_OK) {
1021 command_print(CMD_CTX, "%s failed to unlock device", bank->driver->name);
1024 command_print(CMD_CTX, "%s unlocked.\n", bank->driver->name);
1029 static int stm32x_mass_erase(struct flash_bank *bank)
1032 struct target *target = bank->target;
1034 if (target->state != TARGET_HALTED) {
1035 LOG_ERROR("Target not halted");
1036 return ERROR_TARGET_NOT_HALTED;
1039 retval = stm32x_unlock_reg(bank);
1040 if (retval != ERROR_OK)
1043 /* mass erase flash memory bank */
1044 retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CR), FLASH_BER_CMD | FLASH_PSIZE_64);
1045 if (retval != ERROR_OK)
1048 retval = target_write_u32(target, stm32x_get_flash_reg(bank, FLASH_CR),
1049 FLASH_BER_CMD | FLASH_PSIZE_64 | FLASH_START);
1050 if (retval != ERROR_OK)
1053 retval = stm32x_wait_status_busy(bank, 30000);
1054 if (retval != ERROR_OK)
1057 retval = stm32x_lock_reg(bank);
1058 if (retval != ERROR_OK) {
1059 LOG_ERROR("error during the lock of flash");
1065 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
1070 command_print(CMD_CTX, "stm32h7x mass_erase <bank>");
1071 return ERROR_COMMAND_SYNTAX_ERROR;
1074 struct flash_bank *bank;
1075 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1076 if (ERROR_OK != retval)
1079 retval = stm32x_mass_erase(bank);
1080 if (retval == ERROR_OK) {
1081 /* set all sectors as erased */
1082 for (i = 0; i < bank->num_sectors; i++)
1083 bank->sectors[i].is_erased = 1;
1085 command_print(CMD_CTX, "stm32h7x mass erase complete");
1087 command_print(CMD_CTX, "stm32h7x mass erase failed");
1093 static const struct command_registration stm32x_exec_command_handlers[] = {
1096 .handler = stm32x_handle_lock_command,
1097 .mode = COMMAND_EXEC,
1099 .help = "Lock entire flash device.",
1103 .handler = stm32x_handle_unlock_command,
1104 .mode = COMMAND_EXEC,
1106 .help = "Unlock entire protected flash device.",
1109 .name = "mass_erase",
1110 .handler = stm32x_handle_mass_erase_command,
1111 .mode = COMMAND_EXEC,
1113 .help = "Erase entire flash device.",
1115 COMMAND_REGISTRATION_DONE
1118 static const struct command_registration stm32x_command_handlers[] = {
1121 .mode = COMMAND_ANY,
1122 .help = "stm32h7x flash command group",
1124 .chain = stm32x_exec_command_handlers,
1126 COMMAND_REGISTRATION_DONE
1129 struct flash_driver stm32h7x_flash = {
1131 .commands = stm32x_command_handlers,
1132 .flash_bank_command = stm32x_flash_bank_command,
1133 .erase = stm32x_erase,
1134 .protect = stm32x_protect,
1135 .write = stm32x_write,
1136 .read = default_flash_read,
1137 .probe = stm32x_probe,
1138 .auto_probe = stm32x_auto_probe,
1139 .erase_check = default_flash_blank_check,
1140 .protect_check = stm32x_protect_check,
1141 .info = stm32x_get_info,
1142 .free_driver_priv = default_flash_free_driver_priv,