1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2008 by Spencer Oliver *
6 * spen@spen-soft.co.uk *
8 * Copyright (C) 2011 by Andreas Fritiofson *
9 * andreas.fritiofson@gmail.com *
11 * This program is free software; you can redistribute it and/or modify *
12 * it under the terms of the GNU General Public License as published by *
13 * the Free Software Foundation; either version 2 of the License, or *
14 * (at your option) any later version. *
16 * This program is distributed in the hope that it will be useful, *
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
19 * GNU General Public License for more details. *
21 * You should have received a copy of the GNU General Public License *
22 * along with this program; if not, write to the *
23 * Free Software Foundation, Inc., *
24 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
25 ***************************************************************************/
32 #include <helper/binarybuffer.h>
33 #include <target/algorithm.h>
34 #include <target/armv7m.h>
36 /* stm32x register locations */
38 #define FLASH_REG_BASE_B0 0x40022000
39 #define FLASH_REG_BASE_B1 0x40022040
41 #define STM32_FLASH_ACR 0x00
42 #define STM32_FLASH_KEYR 0x04
43 #define STM32_FLASH_OPTKEYR 0x08
44 #define STM32_FLASH_SR 0x0C
45 #define STM32_FLASH_CR 0x10
46 #define STM32_FLASH_AR 0x14
47 #define STM32_FLASH_OBR 0x1C
48 #define STM32_FLASH_WRPR 0x20
50 /* TODO: Check if code using these really should be hard coded to bank 0.
51 * There are valid cases, on dual flash devices the protection of the
52 * second bank is done on the bank0 reg's. */
53 #define STM32_FLASH_ACR_B0 0x40022000
54 #define STM32_FLASH_KEYR_B0 0x40022004
55 #define STM32_FLASH_OPTKEYR_B0 0x40022008
56 #define STM32_FLASH_SR_B0 0x4002200C
57 #define STM32_FLASH_CR_B0 0x40022010
58 #define STM32_FLASH_AR_B0 0x40022014
59 #define STM32_FLASH_OBR_B0 0x4002201C
60 #define STM32_FLASH_WRPR_B0 0x40022020
62 /* option byte location */
64 #define STM32_OB_RDP 0x1FFFF800
65 #define STM32_OB_USER 0x1FFFF802
66 #define STM32_OB_DATA0 0x1FFFF804
67 #define STM32_OB_DATA1 0x1FFFF806
68 #define STM32_OB_WRP0 0x1FFFF808
69 #define STM32_OB_WRP1 0x1FFFF80A
70 #define STM32_OB_WRP2 0x1FFFF80C
71 #define STM32_OB_WRP3 0x1FFFF80E
73 /* FLASH_CR register bits */
75 #define FLASH_PG (1 << 0)
76 #define FLASH_PER (1 << 1)
77 #define FLASH_MER (1 << 2)
78 #define FLASH_OPTPG (1 << 4)
79 #define FLASH_OPTER (1 << 5)
80 #define FLASH_STRT (1 << 6)
81 #define FLASH_LOCK (1 << 7)
82 #define FLASH_OPTWRE (1 << 9)
84 /* FLASH_SR register bits */
86 #define FLASH_BSY (1 << 0)
87 #define FLASH_PGERR (1 << 2)
88 #define FLASH_WRPRTERR (1 << 4)
89 #define FLASH_EOP (1 << 5)
91 /* STM32_FLASH_OBR bit definitions (reading) */
96 #define OPT_RDRSTSTOP 3
97 #define OPT_RDRSTSTDBY 4
98 #define OPT_BFB2 5 /* dual flash bank only */
100 /* register unlock keys */
102 #define KEY1 0x45670123
103 #define KEY2 0xCDEF89AB
107 #define FLASH_WRITE_TIMEOUT 10
108 #define FLASH_ERASE_TIMEOUT 100
110 struct stm32x_options {
112 uint16_t user_options;
113 uint16_t protection[4];
116 struct stm32x_flash_bank {
117 struct stm32x_options option_bytes;
122 /* used to access dual flash bank stm32xl */
123 uint32_t register_base;
126 static int stm32x_mass_erase(struct flash_bank *bank);
127 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id);
128 static int stm32x_write_block(struct flash_bank *bank, uint8_t *buffer,
129 uint32_t offset, uint32_t count);
131 /* flash bank stm32x <base> <size> 0 0 <target#>
133 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
135 struct stm32x_flash_bank *stm32x_info;
138 return ERROR_COMMAND_SYNTAX_ERROR;
140 stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
142 bank->driver_priv = stm32x_info;
143 stm32x_info->probed = 0;
144 stm32x_info->has_dual_banks = false;
145 stm32x_info->register_base = FLASH_REG_BASE_B0;
150 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
152 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
153 return reg + stm32x_info->register_base;
156 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
158 struct target *target = bank->target;
159 return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
162 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
164 struct target *target = bank->target;
166 int retval = ERROR_OK;
168 /* wait for busy to clear */
170 retval = stm32x_get_flash_status(bank, &status);
171 if (retval != ERROR_OK)
173 LOG_DEBUG("status: 0x%" PRIx32 "", status);
174 if ((status & FLASH_BSY) == 0)
176 if (timeout-- <= 0) {
177 LOG_ERROR("timed out waiting for flash");
183 if (status & FLASH_WRPRTERR) {
184 LOG_ERROR("stm32x device protected");
188 if (status & FLASH_PGERR) {
189 LOG_ERROR("stm32x device programming failed");
193 /* Clear but report errors */
194 if (status & (FLASH_WRPRTERR | FLASH_PGERR)) {
195 /* If this operation fails, we ignore it and report the original
198 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
199 FLASH_WRPRTERR | FLASH_PGERR);
204 int stm32x_check_operation_supported(struct flash_bank *bank)
206 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
208 /* if we have a dual flash bank device then
209 * we need to perform option byte stuff on bank0 only */
210 if (stm32x_info->register_base != FLASH_REG_BASE_B0) {
211 LOG_ERROR("Option Byte Operation's must use bank0");
212 return ERROR_FLASH_OPERATION_FAILED;
218 static int stm32x_read_options(struct flash_bank *bank)
221 struct stm32x_flash_bank *stm32x_info = NULL;
222 struct target *target = bank->target;
224 stm32x_info = bank->driver_priv;
226 /* read current option bytes */
227 int retval = target_read_u32(target, STM32_FLASH_OBR_B0, &optiondata);
228 if (retval != ERROR_OK)
231 stm32x_info->option_bytes.user_options = (uint16_t)0xFFF8 | ((optiondata >> 2) & 0x07);
232 stm32x_info->option_bytes.RDP = (optiondata & (1 << OPT_READOUT)) ? 0xFFFF : 0x5AA5;
234 if (optiondata & (1 << OPT_READOUT))
235 LOG_INFO("Device Security Bit Set");
237 /* each bit refers to a 4bank protection */
238 retval = target_read_u32(target, STM32_FLASH_WRPR_B0, &optiondata);
239 if (retval != ERROR_OK)
242 stm32x_info->option_bytes.protection[0] = (uint16_t)optiondata;
243 stm32x_info->option_bytes.protection[1] = (uint16_t)(optiondata >> 8);
244 stm32x_info->option_bytes.protection[2] = (uint16_t)(optiondata >> 16);
245 stm32x_info->option_bytes.protection[3] = (uint16_t)(optiondata >> 24);
250 static int stm32x_erase_options(struct flash_bank *bank)
252 struct stm32x_flash_bank *stm32x_info = NULL;
253 struct target *target = bank->target;
255 stm32x_info = bank->driver_priv;
257 /* read current options */
258 stm32x_read_options(bank);
260 /* unlock flash registers */
261 int retval = target_write_u32(target, STM32_FLASH_KEYR_B0, KEY1);
262 if (retval != ERROR_OK)
265 retval = target_write_u32(target, STM32_FLASH_KEYR_B0, KEY2);
266 if (retval != ERROR_OK)
269 /* unlock option flash registers */
270 retval = target_write_u32(target, STM32_FLASH_OPTKEYR_B0, KEY1);
271 if (retval != ERROR_OK)
273 retval = target_write_u32(target, STM32_FLASH_OPTKEYR_B0, KEY2);
274 if (retval != ERROR_OK)
277 /* erase option bytes */
278 retval = target_write_u32(target, STM32_FLASH_CR_B0, FLASH_OPTER | FLASH_OPTWRE);
279 if (retval != ERROR_OK)
281 retval = target_write_u32(target, STM32_FLASH_CR_B0, FLASH_OPTER | FLASH_STRT | FLASH_OPTWRE);
282 if (retval != ERROR_OK)
285 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
286 if (retval != ERROR_OK)
289 /* clear readout protection and complementary option bytes
290 * this will also force a device unlock if set */
291 stm32x_info->option_bytes.RDP = 0x5AA5;
296 static int stm32x_write_options(struct flash_bank *bank)
298 struct stm32x_flash_bank *stm32x_info = NULL;
299 struct target *target = bank->target;
301 stm32x_info = bank->driver_priv;
303 /* unlock flash registers */
304 int retval = target_write_u32(target, STM32_FLASH_KEYR_B0, KEY1);
305 if (retval != ERROR_OK)
307 retval = target_write_u32(target, STM32_FLASH_KEYR_B0, KEY2);
308 if (retval != ERROR_OK)
311 /* unlock option flash registers */
312 retval = target_write_u32(target, STM32_FLASH_OPTKEYR_B0, KEY1);
313 if (retval != ERROR_OK)
315 retval = target_write_u32(target, STM32_FLASH_OPTKEYR_B0, KEY2);
316 if (retval != ERROR_OK)
319 /* program option bytes */
320 retval = target_write_u32(target, STM32_FLASH_CR_B0, FLASH_OPTPG | FLASH_OPTWRE);
321 if (retval != ERROR_OK)
324 uint8_t opt_bytes[16];
326 target_buffer_set_u16(target, opt_bytes, stm32x_info->option_bytes.RDP);
327 target_buffer_set_u16(target, opt_bytes + 2, stm32x_info->option_bytes.user_options);
328 target_buffer_set_u16(target, opt_bytes + 4, 0x00FF);
329 target_buffer_set_u16(target, opt_bytes + 6, 0x00FF);
330 target_buffer_set_u16(target, opt_bytes + 8, stm32x_info->option_bytes.protection[0]);
331 target_buffer_set_u16(target, opt_bytes + 10, stm32x_info->option_bytes.protection[1]);
332 target_buffer_set_u16(target, opt_bytes + 12, stm32x_info->option_bytes.protection[2]);
333 target_buffer_set_u16(target, opt_bytes + 14, stm32x_info->option_bytes.protection[3]);
335 uint32_t offset = STM32_OB_RDP - bank->base;
336 retval = stm32x_write_block(bank, opt_bytes, offset, sizeof(opt_bytes) / 2);
337 if (retval != ERROR_OK) {
338 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE)
339 LOG_ERROR("working area required to erase options bytes");
343 retval = target_write_u32(target, STM32_FLASH_CR_B0, FLASH_LOCK);
344 if (retval != ERROR_OK)
350 static int stm32x_protect_check(struct flash_bank *bank)
352 struct target *target = bank->target;
353 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
360 if (target->state != TARGET_HALTED) {
361 LOG_ERROR("Target not halted");
362 return ERROR_TARGET_NOT_HALTED;
365 int retval = stm32x_check_operation_supported(bank);
366 if (ERROR_OK != retval)
369 /* medium density - each bit refers to a 4bank protection
370 * high density - each bit refers to a 2bank protection */
371 retval = target_read_u32(target, STM32_FLASH_WRPR_B0, &protection);
372 if (retval != ERROR_OK)
375 /* medium density - each protection bit is for 4 * 1K pages
376 * high density - each protection bit is for 2 * 2K pages */
377 num_bits = (bank->num_sectors / stm32x_info->ppage_size);
379 if (stm32x_info->ppage_size == 2) {
380 /* high density flash/connectivity line protection */
384 if (protection & (1 << 31))
387 /* bit 31 controls sector 62 - 255 protection for high density
388 * bit 31 controls sector 62 - 127 protection for connectivity line */
389 for (s = 62; s < bank->num_sectors; s++)
390 bank->sectors[s].is_protected = set;
392 if (bank->num_sectors > 61)
395 for (i = 0; i < num_bits; i++) {
398 if (protection & (1 << i))
401 for (s = 0; s < stm32x_info->ppage_size; s++)
402 bank->sectors[(i * stm32x_info->ppage_size) + s].is_protected = set;
405 /* low/medium density flash protection */
406 for (i = 0; i < num_bits; i++) {
409 if (protection & (1 << i))
412 for (s = 0; s < stm32x_info->ppage_size; s++)
413 bank->sectors[(i * stm32x_info->ppage_size) + s].is_protected = set;
420 static int stm32x_erase(struct flash_bank *bank, int first, int last)
422 struct target *target = bank->target;
425 if (bank->target->state != TARGET_HALTED) {
426 LOG_ERROR("Target not halted");
427 return ERROR_TARGET_NOT_HALTED;
430 if ((first == 0) && (last == (bank->num_sectors - 1)))
431 return stm32x_mass_erase(bank);
433 /* unlock flash registers */
434 int retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_KEYR), KEY1);
435 if (retval != ERROR_OK)
437 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_KEYR), KEY2);
438 if (retval != ERROR_OK)
441 for (i = first; i <= last; i++) {
442 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_PER);
443 if (retval != ERROR_OK)
445 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_AR),
446 bank->base + bank->sectors[i].offset);
447 if (retval != ERROR_OK)
449 retval = target_write_u32(target,
450 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_PER | FLASH_STRT);
451 if (retval != ERROR_OK)
454 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
455 if (retval != ERROR_OK)
458 bank->sectors[i].is_erased = 1;
461 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
462 if (retval != ERROR_OK)
468 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
470 struct stm32x_flash_bank *stm32x_info = NULL;
471 struct target *target = bank->target;
472 uint16_t prot_reg[4] = {0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF};
477 stm32x_info = bank->driver_priv;
479 if (target->state != TARGET_HALTED) {
480 LOG_ERROR("Target not halted");
481 return ERROR_TARGET_NOT_HALTED;
484 int retval = stm32x_check_operation_supported(bank);
485 if (ERROR_OK != retval)
488 if ((first % stm32x_info->ppage_size) != 0) {
489 LOG_WARNING("aligned start protect sector to a %d sector boundary",
490 stm32x_info->ppage_size);
491 first = first - (first % stm32x_info->ppage_size);
493 if (((last + 1) % stm32x_info->ppage_size) != 0) {
494 LOG_WARNING("aligned end protect sector to a %d sector boundary",
495 stm32x_info->ppage_size);
497 last = last - (last % stm32x_info->ppage_size);
501 /* medium density - each bit refers to a 4bank protection
502 * high density - each bit refers to a 2bank protection */
503 retval = target_read_u32(target, STM32_FLASH_WRPR_B0, &protection);
504 if (retval != ERROR_OK)
507 prot_reg[0] = (uint16_t)protection;
508 prot_reg[1] = (uint16_t)(protection >> 8);
509 prot_reg[2] = (uint16_t)(protection >> 16);
510 prot_reg[3] = (uint16_t)(protection >> 24);
512 if (stm32x_info->ppage_size == 2) {
513 /* high density flash */
515 /* bit 7 controls sector 62 - 255 protection */
518 prot_reg[3] &= ~(1 << 7);
520 prot_reg[3] |= (1 << 7);
528 for (i = first; i <= last; i++) {
529 reg = (i / stm32x_info->ppage_size) / 8;
530 bit = (i / stm32x_info->ppage_size) - (reg * 8);
533 prot_reg[reg] &= ~(1 << bit);
535 prot_reg[reg] |= (1 << bit);
538 /* medium density flash */
539 for (i = first; i <= last; i++) {
540 reg = (i / stm32x_info->ppage_size) / 8;
541 bit = (i / stm32x_info->ppage_size) - (reg * 8);
544 prot_reg[reg] &= ~(1 << bit);
546 prot_reg[reg] |= (1 << bit);
550 status = stm32x_erase_options(bank);
551 if (status != ERROR_OK)
554 stm32x_info->option_bytes.protection[0] = prot_reg[0];
555 stm32x_info->option_bytes.protection[1] = prot_reg[1];
556 stm32x_info->option_bytes.protection[2] = prot_reg[2];
557 stm32x_info->option_bytes.protection[3] = prot_reg[3];
559 return stm32x_write_options(bank);
562 static int stm32x_write_block(struct flash_bank *bank, uint8_t *buffer,
563 uint32_t offset, uint32_t count)
565 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
566 struct target *target = bank->target;
567 uint32_t buffer_size = 16384;
568 struct working_area *write_algorithm;
569 struct working_area *source;
570 uint32_t address = bank->base + offset;
571 struct reg_param reg_params[5];
572 struct armv7m_algorithm armv7m_info;
573 int retval = ERROR_OK;
575 /* see contrib/loaders/flash/stm32f1x.S for src */
577 static const uint8_t stm32x_flash_write_code[] = {
578 /* #define STM32_FLASH_SR_OFFSET 0x0C */
580 0x16, 0x68, /* ldr r6, [r2, #0] */
581 0x00, 0x2e, /* cmp r6, #0 */
582 0x18, 0xd0, /* beq exit */
583 0x55, 0x68, /* ldr r5, [r2, #4] */
584 0xb5, 0x42, /* cmp r5, r6 */
585 0xf9, 0xd0, /* beq wait_fifo */
586 0x2e, 0x88, /* ldrh r6, [r5, #0] */
587 0x26, 0x80, /* strh r6, [r4, #0] */
588 0x02, 0x35, /* adds r5, #2 */
589 0x02, 0x34, /* adds r4, #2 */
591 0xc6, 0x68, /* ldr r6, [r0, #STM32_FLASH_SR_OFFSET] */
592 0x01, 0x27, /* movs r7, #1 */
593 0x3e, 0x42, /* tst r6, r7 */
594 0xfb, 0xd1, /* bne busy */
595 0x14, 0x27, /* movs r7, #0x14 */
596 0x3e, 0x42, /* tst r6, r7 */
597 0x08, 0xd1, /* bne error */
598 0x9d, 0x42, /* cmp r5, r3 */
599 0x01, 0xd3, /* bcc no_wrap */
600 0x15, 0x46, /* mov r5, r2 */
601 0x08, 0x35, /* adds r5, #8 */
603 0x55, 0x60, /* str r5, [r2, #4] */
604 0x01, 0x39, /* subs r1, r1, #1 */
605 0x00, 0x29, /* cmp r1, #0 */
606 0x02, 0xd0, /* beq exit */
607 0xe5, 0xe7, /* b wait_fifo */
609 0x00, 0x20, /* movs r0, #0 */
610 0x50, 0x60, /* str r0, [r2, #4] */
612 0x30, 0x46, /* mov r0, r6 */
613 0x00, 0xbe, /* bkpt #0 */
616 /* flash write code */
617 if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
618 &write_algorithm) != ERROR_OK) {
619 LOG_WARNING("no working area available, can't do block memory writes");
620 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
623 retval = target_write_buffer(target, write_algorithm->address,
624 sizeof(stm32x_flash_write_code), (uint8_t *)stm32x_flash_write_code);
625 if (retval != ERROR_OK)
629 while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
631 buffer_size &= ~3UL; /* Make sure it's 4 byte aligned */
632 if (buffer_size <= 256) {
633 /* we already allocated the writing code, but failed to get a
634 * buffer, free the algorithm */
635 target_free_working_area(target, write_algorithm);
637 LOG_WARNING("no large enough working area available, can't do block memory writes");
638 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
642 init_reg_param(®_params[0], "r0", 32, PARAM_IN_OUT); /* flash base (in), status (out) */
643 init_reg_param(®_params[1], "r1", 32, PARAM_OUT); /* count (halfword-16bit) */
644 init_reg_param(®_params[2], "r2", 32, PARAM_OUT); /* buffer start */
645 init_reg_param(®_params[3], "r3", 32, PARAM_OUT); /* buffer end */
646 init_reg_param(®_params[4], "r4", 32, PARAM_IN_OUT); /* target address */
648 buf_set_u32(reg_params[0].value, 0, 32, stm32x_info->register_base);
649 buf_set_u32(reg_params[1].value, 0, 32, count);
650 buf_set_u32(reg_params[2].value, 0, 32, source->address);
651 buf_set_u32(reg_params[3].value, 0, 32, source->address + source->size);
652 buf_set_u32(reg_params[4].value, 0, 32, address);
654 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
655 armv7m_info.core_mode = ARMV7M_MODE_ANY;
657 retval = target_run_flash_async_algorithm(target, buffer, count, 2,
660 source->address, source->size,
661 write_algorithm->address, 0,
664 if (retval == ERROR_FLASH_OPERATION_FAILED) {
665 LOG_ERROR("flash write failed at address 0x%"PRIx32,
666 buf_get_u32(reg_params[4].value, 0, 32));
668 if (buf_get_u32(reg_params[0].value, 0, 32) & FLASH_PGERR) {
669 LOG_ERROR("flash memory not erased before writing");
670 /* Clear but report errors */
671 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), FLASH_PGERR);
674 if (buf_get_u32(reg_params[0].value, 0, 32) & FLASH_WRPRTERR) {
675 LOG_ERROR("flash memory write protected");
676 /* Clear but report errors */
677 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), FLASH_WRPRTERR);
681 target_free_working_area(target, source);
682 target_free_working_area(target, write_algorithm);
684 destroy_reg_param(®_params[0]);
685 destroy_reg_param(®_params[1]);
686 destroy_reg_param(®_params[2]);
687 destroy_reg_param(®_params[3]);
688 destroy_reg_param(®_params[4]);
693 static int stm32x_write(struct flash_bank *bank, uint8_t *buffer,
694 uint32_t offset, uint32_t count)
696 struct target *target = bank->target;
697 uint8_t *new_buffer = NULL;
699 if (bank->target->state != TARGET_HALTED) {
700 LOG_ERROR("Target not halted");
701 return ERROR_TARGET_NOT_HALTED;
705 LOG_ERROR("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
706 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
709 /* If there's an odd number of bytes, the data has to be padded. Duplicate
710 * the buffer and use the normal code path with a single block write since
711 * it's probably cheaper than to special case the last odd write using
712 * discrete accesses. */
714 new_buffer = malloc(count + 1);
715 if (new_buffer == NULL) {
716 LOG_ERROR("odd number of bytes to write and no memory for padding buffer");
719 LOG_INFO("odd number of bytes to write, padding with 0xff");
720 buffer = memcpy(new_buffer, buffer, count);
721 buffer[count++] = 0xff;
724 uint32_t words_remaining = count / 2;
727 /* unlock flash registers */
728 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_KEYR), KEY1);
729 if (retval != ERROR_OK)
731 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_KEYR), KEY2);
732 if (retval != ERROR_OK)
735 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_PG);
736 if (retval != ERROR_OK)
739 /* try using a block write */
740 retval = stm32x_write_block(bank, buffer, offset, words_remaining);
742 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
743 /* if block write failed (no sufficient working area),
744 * we use normal (slow) single halfword accesses */
745 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
747 while (words_remaining > 0) {
749 memcpy(&value, buffer, sizeof(uint16_t));
751 retval = target_write_u16(target, bank->base + offset, value);
752 if (retval != ERROR_OK)
753 goto reset_pg_and_lock;
755 retval = stm32x_wait_status_busy(bank, 5);
756 if (retval != ERROR_OK)
757 goto reset_pg_and_lock;
766 retval2 = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
767 if (retval == ERROR_OK)
777 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
779 /* This check the device CPUID core register to detect
780 * the M0 from the M3 devices. */
782 struct target *target = bank->target;
783 uint32_t cpuid, device_id_register = 0;
785 /* Get the CPUID from the ARM Core
786 * http://infocenter.arm.com/help/topic/com.arm.doc.ddi0432c/DDI0432C_cortex_m0_r0p0_trm.pdf 4.2.1 */
787 int retval = target_read_u32(target, 0xE000ED00, &cpuid);
788 if (retval != ERROR_OK)
791 if (((cpuid >> 4) & 0xFFF) == 0xC20) {
792 /* 0xC20 is M0 devices */
793 device_id_register = 0x40015800;
794 } else if (((cpuid >> 4) & 0xFFF) == 0xC23) {
795 /* 0xC23 is M3 devices */
796 device_id_register = 0xE0042000;
797 } else if (((cpuid >> 4) & 0xFFF) == 0xC24) {
798 /* 0xC24 is M4 devices */
799 device_id_register = 0xE0042000;
801 LOG_ERROR("Cannot identify target as a stm32x");
805 /* read stm32 device id register */
806 retval = target_read_u32(target, device_id_register, device_id);
807 if (retval != ERROR_OK)
813 static int stm32x_get_flash_size(struct flash_bank *bank, uint16_t *flash_size_in_kb)
815 struct target *target = bank->target;
816 uint32_t cpuid, flash_size_reg;
818 int retval = target_read_u32(target, 0xE000ED00, &cpuid);
819 if (retval != ERROR_OK)
822 if (((cpuid >> 4) & 0xFFF) == 0xC20) {
823 /* 0xC20 is M0 devices */
824 flash_size_reg = 0x1FFFF7CC;
825 } else if (((cpuid >> 4) & 0xFFF) == 0xC23) {
826 /* 0xC23 is M3 devices */
827 flash_size_reg = 0x1FFFF7E0;
828 } else if (((cpuid >> 4) & 0xFFF) == 0xC24) {
829 /* 0xC24 is M4 devices */
830 flash_size_reg = 0x1FFFF7CC;
832 LOG_ERROR("Cannot identify target as a stm32x");
836 retval = target_read_u16(target, flash_size_reg, flash_size_in_kb);
837 if (retval != ERROR_OK)
843 static int stm32x_probe(struct flash_bank *bank)
845 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
847 uint16_t flash_size_in_kb;
848 uint16_t max_flash_size_in_kb;
851 uint32_t base_address = 0x08000000;
853 stm32x_info->probed = 0;
854 stm32x_info->register_base = FLASH_REG_BASE_B0;
856 /* read stm32 device id register */
857 int retval = stm32x_get_device_id(bank, &device_id);
858 if (retval != ERROR_OK)
861 LOG_INFO("device id = 0x%08" PRIx32 "", device_id);
863 /* set page size, protection granularity and max flash size depending on family */
864 switch (device_id & 0xfff) {
865 case 0x410: /* medium density */
867 stm32x_info->ppage_size = 4;
868 max_flash_size_in_kb = 128;
870 case 0x412: /* low density */
872 stm32x_info->ppage_size = 4;
873 max_flash_size_in_kb = 32;
875 case 0x414: /* high density */
877 stm32x_info->ppage_size = 2;
878 max_flash_size_in_kb = 512;
880 case 0x418: /* connectivity line density */
882 stm32x_info->ppage_size = 2;
883 max_flash_size_in_kb = 256;
885 case 0x420: /* value line density */
887 stm32x_info->ppage_size = 4;
888 max_flash_size_in_kb = 128;
890 case 0x422: /* stm32f30x */
892 stm32x_info->ppage_size = 2;
893 max_flash_size_in_kb = 256;
895 case 0x428: /* value line High density */
897 stm32x_info->ppage_size = 4;
898 max_flash_size_in_kb = 128;
900 case 0x430: /* xl line density (dual flash banks) */
902 stm32x_info->ppage_size = 2;
903 max_flash_size_in_kb = 1024;
904 stm32x_info->has_dual_banks = true;
906 case 0x432: /* stm32f37x */
908 stm32x_info->ppage_size = 2;
909 max_flash_size_in_kb = 256;
911 case 0x440: /* stm32f0x */
913 stm32x_info->ppage_size = 4;
914 max_flash_size_in_kb = 64;
917 LOG_WARNING("Cannot identify target as a STM32 family.");
921 /* get flash size from target. */
922 retval = stm32x_get_flash_size(bank, &flash_size_in_kb);
924 /* failed reading flash size or flash size invalid (early silicon),
925 * default to max target family */
926 if (retval != ERROR_OK || flash_size_in_kb == 0xffff || flash_size_in_kb == 0) {
927 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming %dk flash",
928 max_flash_size_in_kb);
929 flash_size_in_kb = max_flash_size_in_kb;
932 if (stm32x_info->has_dual_banks) {
933 /* split reported size into matching bank */
934 if (bank->base != 0x08080000) {
935 /* bank 0 will be fixed 512k */
936 flash_size_in_kb = 512;
938 flash_size_in_kb -= 512;
939 /* bank1 also uses a register offset */
940 stm32x_info->register_base = FLASH_REG_BASE_B1;
941 base_address = 0x08080000;
945 LOG_INFO("flash size = %dkbytes", flash_size_in_kb);
947 /* did we assign flash size? */
948 assert(flash_size_in_kb != 0xffff);
950 /* calculate numbers of pages */
951 int num_pages = flash_size_in_kb * 1024 / page_size;
953 /* check that calculation result makes sense */
954 assert(num_pages > 0);
958 bank->sectors = NULL;
961 bank->base = base_address;
962 bank->size = (num_pages * page_size);
963 bank->num_sectors = num_pages;
964 bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
966 for (i = 0; i < num_pages; i++) {
967 bank->sectors[i].offset = i * page_size;
968 bank->sectors[i].size = page_size;
969 bank->sectors[i].is_erased = -1;
970 bank->sectors[i].is_protected = 1;
973 stm32x_info->probed = 1;
978 static int stm32x_auto_probe(struct flash_bank *bank)
980 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
981 if (stm32x_info->probed)
983 return stm32x_probe(bank);
987 COMMAND_HANDLER(stm32x_handle_part_id_command)
993 static int get_stm32x_info(struct flash_bank *bank, char *buf, int buf_size)
998 /* read stm32 device id register */
999 int retval = stm32x_get_device_id(bank, &device_id);
1000 if (retval != ERROR_OK)
1003 if ((device_id & 0xfff) == 0x410) {
1004 printed = snprintf(buf, buf_size, "stm32x (Medium Density) - Rev: ");
1006 buf_size -= printed;
1008 switch (device_id >> 16) {
1010 snprintf(buf, buf_size, "A");
1014 snprintf(buf, buf_size, "B");
1018 snprintf(buf, buf_size, "Z");
1022 snprintf(buf, buf_size, "Y");
1026 snprintf(buf, buf_size, "unknown");
1029 } else if ((device_id & 0xfff) == 0x412) {
1030 printed = snprintf(buf, buf_size, "stm32x (Low Density) - Rev: ");
1032 buf_size -= printed;
1034 switch (device_id >> 16) {
1036 snprintf(buf, buf_size, "A");
1040 snprintf(buf, buf_size, "unknown");
1043 } else if ((device_id & 0xfff) == 0x414) {
1044 printed = snprintf(buf, buf_size, "stm32x (High Density) - Rev: ");
1046 buf_size -= printed;
1048 switch (device_id >> 16) {
1050 snprintf(buf, buf_size, "A");
1054 snprintf(buf, buf_size, "Z");
1058 snprintf(buf, buf_size, "unknown");
1061 } else if ((device_id & 0xfff) == 0x418) {
1062 printed = snprintf(buf, buf_size, "stm32x (Connectivity) - Rev: ");
1064 buf_size -= printed;
1066 switch (device_id >> 16) {
1068 snprintf(buf, buf_size, "A");
1072 snprintf(buf, buf_size, "Z");
1076 snprintf(buf, buf_size, "unknown");
1079 } else if ((device_id & 0xfff) == 0x420) {
1080 printed = snprintf(buf, buf_size, "stm32x (Value) - Rev: ");
1082 buf_size -= printed;
1084 switch (device_id >> 16) {
1086 snprintf(buf, buf_size, "A");
1090 snprintf(buf, buf_size, "Z");
1094 snprintf(buf, buf_size, "unknown");
1097 } else if ((device_id & 0xfff) == 0x422) {
1098 printed = snprintf(buf, buf_size, "stm32f30x - Rev: ");
1100 buf_size -= printed;
1102 switch (device_id >> 16) {
1104 snprintf(buf, buf_size, "A");
1108 snprintf(buf, buf_size, "Z");
1112 snprintf(buf, buf_size, "B");
1116 snprintf(buf, buf_size, "unknown");
1119 } else if ((device_id & 0xfff) == 0x428) {
1120 printed = snprintf(buf, buf_size, "stm32x (Value HD) - Rev: ");
1122 buf_size -= printed;
1124 switch (device_id >> 16) {
1126 snprintf(buf, buf_size, "A");
1130 snprintf(buf, buf_size, "Z");
1134 snprintf(buf, buf_size, "unknown");
1137 } else if ((device_id & 0xfff) == 0x430) {
1138 printed = snprintf(buf, buf_size, "stm32x (XL) - Rev: ");
1140 buf_size -= printed;
1142 switch (device_id >> 16) {
1144 snprintf(buf, buf_size, "A");
1148 snprintf(buf, buf_size, "unknown");
1151 } else if ((device_id & 0xfff) == 0x432) {
1152 printed = snprintf(buf, buf_size, "stm32f37x - Rev: ");
1154 buf_size -= printed;
1156 switch (device_id >> 16) {
1158 snprintf(buf, buf_size, "A");
1162 snprintf(buf, buf_size, "B");
1166 snprintf(buf, buf_size, "unknown");
1169 } else if ((device_id & 0xfff) == 0x440) {
1170 printed = snprintf(buf, buf_size, "stm32f0x - Rev: ");
1172 buf_size -= printed;
1174 switch (device_id >> 16) {
1176 snprintf(buf, buf_size, "1.0");
1180 snprintf(buf, buf_size, "2.0");
1184 snprintf(buf, buf_size, "unknown");
1188 snprintf(buf, buf_size, "Cannot identify target as a stm32x\n");
1195 COMMAND_HANDLER(stm32x_handle_lock_command)
1197 struct target *target = NULL;
1198 struct stm32x_flash_bank *stm32x_info = NULL;
1201 return ERROR_COMMAND_SYNTAX_ERROR;
1203 struct flash_bank *bank;
1204 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1205 if (ERROR_OK != retval)
1208 stm32x_info = bank->driver_priv;
1210 target = bank->target;
1212 if (target->state != TARGET_HALTED) {
1213 LOG_ERROR("Target not halted");
1214 return ERROR_TARGET_NOT_HALTED;
1217 retval = stm32x_check_operation_supported(bank);
1218 if (ERROR_OK != retval)
1221 if (stm32x_erase_options(bank) != ERROR_OK) {
1222 command_print(CMD_CTX, "stm32x failed to erase options");
1226 /* set readout protection */
1227 stm32x_info->option_bytes.RDP = 0;
1229 if (stm32x_write_options(bank) != ERROR_OK) {
1230 command_print(CMD_CTX, "stm32x failed to lock device");
1234 command_print(CMD_CTX, "stm32x locked");
1239 COMMAND_HANDLER(stm32x_handle_unlock_command)
1241 struct target *target = NULL;
1244 return ERROR_COMMAND_SYNTAX_ERROR;
1246 struct flash_bank *bank;
1247 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1248 if (ERROR_OK != retval)
1251 target = bank->target;
1253 if (target->state != TARGET_HALTED) {
1254 LOG_ERROR("Target not halted");
1255 return ERROR_TARGET_NOT_HALTED;
1258 retval = stm32x_check_operation_supported(bank);
1259 if (ERROR_OK != retval)
1262 if (stm32x_erase_options(bank) != ERROR_OK) {
1263 command_print(CMD_CTX, "stm32x failed to unlock device");
1267 if (stm32x_write_options(bank) != ERROR_OK) {
1268 command_print(CMD_CTX, "stm32x failed to lock device");
1272 command_print(CMD_CTX, "stm32x unlocked.\n"
1273 "INFO: a reset or power cycle is required "
1274 "for the new settings to take effect.");
1279 COMMAND_HANDLER(stm32x_handle_options_read_command)
1281 uint32_t optionbyte;
1282 struct target *target = NULL;
1283 struct stm32x_flash_bank *stm32x_info = NULL;
1286 return ERROR_COMMAND_SYNTAX_ERROR;
1288 struct flash_bank *bank;
1289 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1290 if (ERROR_OK != retval)
1293 stm32x_info = bank->driver_priv;
1295 target = bank->target;
1297 if (target->state != TARGET_HALTED) {
1298 LOG_ERROR("Target not halted");
1299 return ERROR_TARGET_NOT_HALTED;
1302 retval = stm32x_check_operation_supported(bank);
1303 if (ERROR_OK != retval)
1306 retval = target_read_u32(target, STM32_FLASH_OBR_B0, &optionbyte);
1307 if (retval != ERROR_OK)
1309 command_print(CMD_CTX, "Option Byte: 0x%" PRIx32 "", optionbyte);
1311 if (buf_get_u32((uint8_t *)&optionbyte, OPT_ERROR, 1))
1312 command_print(CMD_CTX, "Option Byte Complement Error");
1314 if (buf_get_u32((uint8_t *)&optionbyte, OPT_READOUT, 1))
1315 command_print(CMD_CTX, "Readout Protection On");
1317 command_print(CMD_CTX, "Readout Protection Off");
1319 if (buf_get_u32((uint8_t *)&optionbyte, OPT_RDWDGSW, 1))
1320 command_print(CMD_CTX, "Software Watchdog");
1322 command_print(CMD_CTX, "Hardware Watchdog");
1324 if (buf_get_u32((uint8_t *)&optionbyte, OPT_RDRSTSTOP, 1))
1325 command_print(CMD_CTX, "Stop: No reset generated");
1327 command_print(CMD_CTX, "Stop: Reset generated");
1329 if (buf_get_u32((uint8_t *)&optionbyte, OPT_RDRSTSTDBY, 1))
1330 command_print(CMD_CTX, "Standby: No reset generated");
1332 command_print(CMD_CTX, "Standby: Reset generated");
1334 if (stm32x_info->has_dual_banks) {
1335 if (buf_get_u32((uint8_t *)&optionbyte, OPT_BFB2, 1))
1336 command_print(CMD_CTX, "Boot: Bank 0");
1338 command_print(CMD_CTX, "Boot: Bank 1");
1344 COMMAND_HANDLER(stm32x_handle_options_write_command)
1346 struct target *target = NULL;
1347 struct stm32x_flash_bank *stm32x_info = NULL;
1348 uint16_t optionbyte = 0xF8;
1351 return ERROR_COMMAND_SYNTAX_ERROR;
1353 struct flash_bank *bank;
1354 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1355 if (ERROR_OK != retval)
1358 stm32x_info = bank->driver_priv;
1360 target = bank->target;
1362 if (target->state != TARGET_HALTED) {
1363 LOG_ERROR("Target not halted");
1364 return ERROR_TARGET_NOT_HALTED;
1367 retval = stm32x_check_operation_supported(bank);
1368 if (ERROR_OK != retval)
1371 /* REVISIT: ignores some options which we will display...
1372 * and doesn't insist on the specified syntax.
1376 if (strcmp(CMD_ARGV[1], "SWWDG") == 0)
1377 optionbyte |= (1 << 0);
1378 else /* REVISIT must be "HWWDG" then ... */
1379 optionbyte &= ~(1 << 0);
1382 if (strcmp(CMD_ARGV[2], "NORSTSTOP") == 0)
1383 optionbyte |= (1 << 1);
1384 else /* REVISIT must be "RSTSTNDBY" then ... */
1385 optionbyte &= ~(1 << 1);
1387 /* OPT_RDRSTSTDBY */
1388 if (strcmp(CMD_ARGV[3], "NORSTSTNDBY") == 0)
1389 optionbyte |= (1 << 2);
1390 else /* REVISIT must be "RSTSTOP" then ... */
1391 optionbyte &= ~(1 << 2);
1393 if (CMD_ARGC > 4 && stm32x_info->has_dual_banks) {
1395 if (strcmp(CMD_ARGV[4], "BOOT0") == 0)
1396 optionbyte |= (1 << 3);
1398 optionbyte &= ~(1 << 3);
1401 if (stm32x_erase_options(bank) != ERROR_OK) {
1402 command_print(CMD_CTX, "stm32x failed to erase options");
1406 stm32x_info->option_bytes.user_options = optionbyte;
1408 if (stm32x_write_options(bank) != ERROR_OK) {
1409 command_print(CMD_CTX, "stm32x failed to write options");
1413 command_print(CMD_CTX, "stm32x write options complete.\n"
1414 "INFO: a reset or power cycle is required "
1415 "for the new settings to take effect.");
1420 static int stm32x_mass_erase(struct flash_bank *bank)
1422 struct target *target = bank->target;
1424 if (target->state != TARGET_HALTED) {
1425 LOG_ERROR("Target not halted");
1426 return ERROR_TARGET_NOT_HALTED;
1429 /* unlock option flash registers */
1430 int retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_KEYR), KEY1);
1431 if (retval != ERROR_OK)
1433 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_KEYR), KEY2);
1434 if (retval != ERROR_OK)
1437 /* mass erase flash memory */
1438 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER);
1439 if (retval != ERROR_OK)
1441 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
1442 FLASH_MER | FLASH_STRT);
1443 if (retval != ERROR_OK)
1446 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
1447 if (retval != ERROR_OK)
1450 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
1451 if (retval != ERROR_OK)
1457 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
1462 return ERROR_COMMAND_SYNTAX_ERROR;
1464 struct flash_bank *bank;
1465 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1466 if (ERROR_OK != retval)
1469 retval = stm32x_mass_erase(bank);
1470 if (retval == ERROR_OK) {
1471 /* set all sectors as erased */
1472 for (i = 0; i < bank->num_sectors; i++)
1473 bank->sectors[i].is_erased = 1;
1475 command_print(CMD_CTX, "stm32x mass erase complete");
1477 command_print(CMD_CTX, "stm32x mass erase failed");
1482 static const struct command_registration stm32x_exec_command_handlers[] = {
1485 .handler = stm32x_handle_lock_command,
1486 .mode = COMMAND_EXEC,
1488 .help = "Lock entire flash device.",
1492 .handler = stm32x_handle_unlock_command,
1493 .mode = COMMAND_EXEC,
1495 .help = "Unlock entire protected flash device.",
1498 .name = "mass_erase",
1499 .handler = stm32x_handle_mass_erase_command,
1500 .mode = COMMAND_EXEC,
1502 .help = "Erase entire flash device.",
1505 .name = "options_read",
1506 .handler = stm32x_handle_options_read_command,
1507 .mode = COMMAND_EXEC,
1509 .help = "Read and display device option byte.",
1512 .name = "options_write",
1513 .handler = stm32x_handle_options_write_command,
1514 .mode = COMMAND_EXEC,
1515 .usage = "bank_id ('SWWDG'|'HWWDG') "
1516 "('RSTSTNDBY'|'NORSTSTNDBY') "
1517 "('RSTSTOP'|'NORSTSTOP')",
1518 .help = "Replace bits in device option byte.",
1520 COMMAND_REGISTRATION_DONE
1523 static const struct command_registration stm32x_command_handlers[] = {
1526 .mode = COMMAND_ANY,
1527 .help = "stm32f1x flash command group",
1529 .chain = stm32x_exec_command_handlers,
1531 COMMAND_REGISTRATION_DONE
1534 struct flash_driver stm32f1x_flash = {
1536 .commands = stm32x_command_handlers,
1537 .flash_bank_command = stm32x_flash_bank_command,
1538 .erase = stm32x_erase,
1539 .protect = stm32x_protect,
1540 .write = stm32x_write,
1541 .read = default_flash_read,
1542 .probe = stm32x_probe,
1543 .auto_probe = stm32x_auto_probe,
1544 .erase_check = default_flash_blank_check,
1545 .protect_check = stm32x_protect_check,
1546 .info = get_stm32x_info,