git.sur5r.net Git - openocd/blob - src/flash/nor/stm32f2x.c

   1 /***************************************************************************
   2  *   Copyright (C) 2005 by Dominic Rath                                    *
   3  *   Dominic.Rath@gmx.de                                                   *
   4  *                                                                         *
   5  *   Copyright (C) 2008 by Spencer Oliver                                  *
   6  *   spen@spen-soft.co.uk                                                  *
   7  *                                                                         *
   8  *   Copyright (C) 2011 Øyvind Harboe                                      *
   9  *   oyvind.harboe@zylin.com                                               *
  10  *                                                                         *
  11  *   This program is free software; you can redistribute it and/or modify  *
  12  *   it under the terms of the GNU General Public License as published by  *
  13  *   the Free Software Foundation; either version 2 of the License, or     *
  14  *   (at your option) any later version.                                   *
  15  *                                                                         *
  16  *   This program is distributed in the hope that it will be useful,       *
  17  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  18  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  19  *   GNU General Public License for more details.                          *
  20  *                                                                         *
  21  *   You should have received a copy of the GNU General Public License     *
  22  *   along with this program; if not, write to the                         *
  23  *   Free Software Foundation, Inc.,                                       *
  24  *   51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.           *
  25  ***************************************************************************/
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include "imp.h"
  32 #include <helper/binarybuffer.h>
  33 #include <target/algorithm.h>
  34 #include <target/armv7m.h>
  35
  36 /* Regarding performance:
  37  *
  38  * Short story - it might be best to leave the performance at
  39  * current levels.
  40  *
  41  * You may see a jump in speed if you change to using
  42  * 32bit words for the block programming.
  43  *
  44  * Its a shame you cannot use the double word as its
  45  * even faster - but you require external VPP for that mode.
  46  *
  47  * Having said all that 16bit writes give us the widest vdd
  48  * operating range, so may be worth adding a note to that effect.
  49  *
  50  */
  51
  52 /* Danger!!!! The STM32F1x and STM32F2x series actually have
  53  * quite different flash controllers.
  54  *
  55  * What's more scary is that the names of the registers and their
  56  * addresses are the same, but the actual bits and what they do are
  57  * can be very different.
  58  *
  59  * To reduce testing complexity and dangers of regressions,
  60  * a seperate file is used for stm32fx2x.
  61  *
  62  * 1mByte part with 4 x 16, 1 x 64, 7 x 128kBytes sectors
  63  *
  64  * What's the protection page size???
  65  *
  66  * Tested with STM3220F-EVAL board.
  67  *
  68  * STM32F21xx series for reference.
  69  *
  70  * RM0033
  71  * http://www.st.com/internet/mcu/product/250192.jsp
  72  *
  73  * PM0059
  74  * www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/
  75  * PROGRAMMING_MANUAL/CD00233952.pdf
  76  *
  77  * STM32F1x series - notice that this code was copy, pasted and knocked
  78  * into a stm32f2x driver, so in case something has been converted or
  79  * bugs haven't been fixed, here are the original manuals:
  80  *
  81  * RM0008 - Reference manual
  82  *
  83  * RM0042, the Flash programming manual for low-, medium- high-density and
  84  * connectivity line STM32F10x devices
  85  *
  86  * PM0068, the Flash programming manual for XL-density STM32F10x devices.
  87  *
  88  */
  89
  90 /* Erase time can be as high as 1000ms, 10x this and it's toast... */
  91 #define FLASH_ERASE_TIMEOUT 10000
  92 #define FLASH_WRITE_TIMEOUT 5
  93
  94 #define STM32_FLASH_BASE    0x40023c00
  95 #define STM32_FLASH_ACR     0x40023c00
  96 #define STM32_FLASH_KEYR    0x40023c04
  97 #define STM32_FLASH_OPTKEYR 0x40023c08
  98 #define STM32_FLASH_SR      0x40023c0C
  99 #define STM32_FLASH_CR      0x40023c10
 100 #define STM32_FLASH_OPTCR   0x40023c14
 101 #define STM32_FLASH_OPTCR1  0x40023c18
 102
 103 /* FLASH_CR register bits */
 104
 105 #define FLASH_PG       (1 << 0)
 106 #define FLASH_SER      (1 << 1)
 107 #define FLASH_MER      (1 << 2)
 108 #define FLASH_MER1     (1 << 15)
 109 #define FLASH_STRT     (1 << 16)
 110 #define FLASH_PSIZE_8  (0 << 8)
 111 #define FLASH_PSIZE_16 (1 << 8)
 112 #define FLASH_PSIZE_32 (2 << 8)
 113 #define FLASH_PSIZE_64 (3 << 8)
 114 /* The sector number encoding is not straight binary for dual bank flash.
 115  * Warning: evaluates the argument multiple times */
 116 #define FLASH_SNB(a)   ((((a) >= 12) ? 0x10 | ((a) - 12) : (a)) << 3)
 117 #define FLASH_LOCK     (1 << 31)
 118
 119 /* FLASH_SR register bits */
 120
 121 #define FLASH_BSY      (1 << 16)
 122 #define FLASH_PGSERR   (1 << 7) /* Programming sequence error */
 123 #define FLASH_PGPERR   (1 << 6) /* Programming parallelism error */
 124 #define FLASH_PGAERR   (1 << 5) /* Programming alignment error */
 125 #define FLASH_WRPERR   (1 << 4) /* Write protection error */
 126 #define FLASH_OPERR    (1 << 1) /* Operation error */
 127
 128 #define FLASH_ERROR (FLASH_PGSERR | FLASH_PGPERR | FLASH_PGAERR | FLASH_WRPERR | FLASH_OPERR)
 129
 130 /* STM32_FLASH_OPTCR register bits */
 131
 132 #define OPT_LOCK      (1 << 0)
 133 #define OPT_START     (1 << 1)
 134
 135 /* STM32_FLASH_OBR bit definitions (reading) */
 136
 137 #define OPT_ERROR      0
 138 #define OPT_READOUT    1
 139 #define OPT_RDWDGSW    2
 140 #define OPT_RDRSTSTOP  3
 141 #define OPT_RDRSTSTDBY 4
 142 #define OPT_BFB2       5        /* dual flash bank only */
 143
 144 /* register unlock keys */
 145
 146 #define KEY1           0x45670123
 147 #define KEY2           0xCDEF89AB
 148
 149 /* option register unlock key */
 150 #define OPTKEY1        0x08192A3B
 151 #define OPTKEY2        0x4C5D6E7F
 152
 153 struct stm32x_options {
 154         uint8_t RDP;
 155         uint8_t user_options;
 156         uint32_t protection;
 157 };
 158
 159 struct stm32x_flash_bank {
 160         struct stm32x_options option_bytes;
 161         int probed;
 162         bool has_large_mem;             /* stm32f42x/stm32f43x family */
 163         uint32_t user_bank_size;
 164 };
 165
 166 /* flash bank stm32x <base> <size> 0 0 <target#>
 167  */
 168 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
 169 {
 170         struct stm32x_flash_bank *stm32x_info;
 171
 172         if (CMD_ARGC < 6)
 173                 return ERROR_COMMAND_SYNTAX_ERROR;
 174
 175         stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
 176         bank->driver_priv = stm32x_info;
 177
 178         stm32x_info->probed = 0;
 179         stm32x_info->user_bank_size = bank->size;
 180
 181         return ERROR_OK;
 182 }
 183
 184 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
 185 {
 186         return reg;
 187 }
 188
 189 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
 190 {
 191         struct target *target = bank->target;
 192         return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
 193 }
 194
 195 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
 196 {
 197         struct target *target = bank->target;
 198         uint32_t status;
 199         int retval = ERROR_OK;
 200
 201         /* wait for busy to clear */
 202         for (;;) {
 203                 retval = stm32x_get_flash_status(bank, &status);
 204                 if (retval != ERROR_OK)
 205                         return retval;
 206                 LOG_DEBUG("status: 0x%" PRIx32 "", status);
 207                 if ((status & FLASH_BSY) == 0)
 208                         break;
 209                 if (timeout-- <= 0) {
 210                         LOG_ERROR("timed out waiting for flash");
 211                         return ERROR_FAIL;
 212                 }
 213                 alive_sleep(1);
 214         }
 215
 216
 217         if (status & FLASH_WRPERR) {
 218                 LOG_ERROR("stm32x device protected");
 219                 retval = ERROR_FAIL;
 220         }
 221
 222         /* Clear but report errors */
 223         if (status & FLASH_ERROR) {
 224                 /* If this operation fails, we ignore it and report the original
 225                  * retval
 226                  */
 227                 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
 228                                 status & FLASH_ERROR);
 229         }
 230         return retval;
 231 }
 232
 233 static int stm32x_unlock_reg(struct target *target)
 234 {
 235         uint32_t ctrl;
 236
 237         /* first check if not already unlocked
 238          * otherwise writing on STM32_FLASH_KEYR will fail
 239          */
 240         int retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
 241         if (retval != ERROR_OK)
 242                 return retval;
 243
 244         if ((ctrl & FLASH_LOCK) == 0)
 245                 return ERROR_OK;
 246
 247         /* unlock flash registers */
 248         retval = target_write_u32(target, STM32_FLASH_KEYR, KEY1);
 249         if (retval != ERROR_OK)
 250                 return retval;
 251
 252         retval = target_write_u32(target, STM32_FLASH_KEYR, KEY2);
 253         if (retval != ERROR_OK)
 254                 return retval;
 255
 256         retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
 257         if (retval != ERROR_OK)
 258                 return retval;
 259
 260         if (ctrl & FLASH_LOCK) {
 261                 LOG_ERROR("flash not unlocked STM32_FLASH_CR: %" PRIx32, ctrl);
 262                 return ERROR_TARGET_FAILURE;
 263         }
 264
 265         return ERROR_OK;
 266 }
 267
 268 static int stm32x_unlock_option_reg(struct target *target)
 269 {
 270         uint32_t ctrl;
 271
 272         int retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
 273         if (retval != ERROR_OK)
 274                 return retval;
 275
 276         if ((ctrl & OPT_LOCK) == 0)
 277                 return ERROR_OK;
 278
 279         /* unlock option registers */
 280         retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY1);
 281         if (retval != ERROR_OK)
 282                 return retval;
 283
 284         retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY2);
 285         if (retval != ERROR_OK)
 286                 return retval;
 287
 288         retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
 289         if (retval != ERROR_OK)
 290                 return retval;
 291
 292         if (ctrl & OPT_LOCK) {
 293                 LOG_ERROR("options not unlocked STM32_FLASH_OPTCR: %" PRIx32, ctrl);
 294                 return ERROR_TARGET_FAILURE;
 295         }
 296
 297         return ERROR_OK;
 298 }
 299
 300 static int stm32x_read_options(struct flash_bank *bank)
 301 {
 302         uint32_t optiondata;
 303         struct stm32x_flash_bank *stm32x_info = NULL;
 304         struct target *target = bank->target;
 305
 306         stm32x_info = bank->driver_priv;
 307
 308         /* read current option bytes */
 309         int retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
 310         if (retval != ERROR_OK)
 311                 return retval;
 312
 313         stm32x_info->option_bytes.user_options = optiondata & 0xec;
 314         stm32x_info->option_bytes.RDP = (optiondata >> 8) & 0xff;
 315         stm32x_info->option_bytes.protection = (optiondata >> 16) & 0xfff;
 316
 317         if (stm32x_info->has_large_mem) {
 318
 319                 retval = target_read_u32(target, STM32_FLASH_OPTCR1, &optiondata);
 320                 if (retval != ERROR_OK)
 321                         return retval;
 322
 323                 /* append protection bits */
 324                 stm32x_info->option_bytes.protection |= (optiondata >> 4) & 0x00fff000;
 325         }
 326
 327         if (stm32x_info->option_bytes.RDP != 0xAA)
 328                 LOG_INFO("Device Security Bit Set");
 329
 330         return ERROR_OK;
 331 }
 332
 333 static int stm32x_write_options(struct flash_bank *bank)
 334 {
 335         struct stm32x_flash_bank *stm32x_info = NULL;
 336         struct target *target = bank->target;
 337         uint32_t optiondata;
 338
 339         stm32x_info = bank->driver_priv;
 340
 341         int retval = stm32x_unlock_option_reg(target);
 342         if (retval != ERROR_OK)
 343                 return retval;
 344
 345         /* rebuild option data */
 346         optiondata = stm32x_info->option_bytes.user_options;
 347         buf_set_u32(&optiondata, 8, 8, stm32x_info->option_bytes.RDP);
 348         buf_set_u32(&optiondata, 16, 12, stm32x_info->option_bytes.protection);
 349
 350         /* program options */
 351         retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata);
 352         if (retval != ERROR_OK)
 353                 return retval;
 354
 355         if (stm32x_info->has_large_mem) {
 356
 357                 uint32_t optiondata2 = 0;
 358                 buf_set_u32(&optiondata2, 16, 12, stm32x_info->option_bytes.protection >> 12);
 359                 retval = target_write_u32(target, STM32_FLASH_OPTCR1, optiondata2);
 360                 if (retval != ERROR_OK)
 361                         return retval;
 362         }
 363
 364         /* start programming cycle */
 365         retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPT_START);
 366         if (retval != ERROR_OK)
 367                 return retval;
 368
 369         /* wait for completion */
 370         retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
 371         if (retval != ERROR_OK)
 372                 return retval;
 373
 374         /* relock registers */
 375         retval = target_write_u32(target, STM32_FLASH_OPTCR, OPT_LOCK);
 376         if (retval != ERROR_OK)
 377                 return retval;
 378
 379         return ERROR_OK;
 380 }
 381
 382 static int stm32x_protect_check(struct flash_bank *bank)
 383 {
 384         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 385
 386         /* read write protection settings */
 387         int retval = stm32x_read_options(bank);
 388         if (retval != ERROR_OK) {
 389                 LOG_DEBUG("unable to read option bytes");
 390                 return retval;
 391         }
 392
 393         for (int i = 0; i < bank->num_sectors; i++) {
 394                 if (stm32x_info->option_bytes.protection & (1 << i))
 395                         bank->sectors[i].is_protected = 0;
 396                 else
 397                         bank->sectors[i].is_protected = 1;
 398         }
 399
 400         return ERROR_OK;
 401 }
 402
 403 static int stm32x_erase(struct flash_bank *bank, int first, int last)
 404 {
 405         struct target *target = bank->target;
 406         int i;
 407
 408         assert(first < bank->num_sectors);
 409         assert(last < bank->num_sectors);
 410
 411         if (bank->target->state != TARGET_HALTED) {
 412                 LOG_ERROR("Target not halted");
 413                 return ERROR_TARGET_NOT_HALTED;
 414         }
 415
 416         int retval;
 417         retval = stm32x_unlock_reg(target);
 418         if (retval != ERROR_OK)
 419                 return retval;
 420
 421         /*
 422         Sector Erase
 423         To erase a sector, follow the procedure below:
 424         1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
 425           FLASH_SR register
 426         2. Set the SER bit and select the sector
 427           you wish to erase (SNB) in the FLASH_CR register
 428         3. Set the STRT bit in the FLASH_CR register
 429         4. Wait for the BSY bit to be cleared
 430          */
 431
 432         for (i = first; i <= last; i++) {
 433                 retval = target_write_u32(target,
 434                                 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_SER | FLASH_SNB(i) | FLASH_STRT);
 435                 if (retval != ERROR_OK)
 436                         return retval;
 437
 438                 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
 439                 if (retval != ERROR_OK)
 440                         return retval;
 441
 442                 bank->sectors[i].is_erased = 1;
 443         }
 444
 445         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
 446         if (retval != ERROR_OK)
 447                 return retval;
 448
 449         return ERROR_OK;
 450 }
 451
 452 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
 453 {
 454         struct target *target = bank->target;
 455         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 456
 457         if (target->state != TARGET_HALTED) {
 458                 LOG_ERROR("Target not halted");
 459                 return ERROR_TARGET_NOT_HALTED;
 460         }
 461
 462         /* read protection settings */
 463         int retval = stm32x_read_options(bank);
 464         if (retval != ERROR_OK) {
 465                 LOG_DEBUG("unable to read option bytes");
 466                 return retval;
 467         }
 468
 469         for (int i = first; i <= last; i++) {
 470
 471                 if (set)
 472                         stm32x_info->option_bytes.protection &= ~(1 << i);
 473                 else
 474                         stm32x_info->option_bytes.protection |= (1 << i);
 475         }
 476
 477         retval = stm32x_write_options(bank);
 478         if (retval != ERROR_OK)
 479                 return retval;
 480
 481         return ERROR_OK;
 482 }
 483
 484 static int stm32x_write_block(struct flash_bank *bank, uint8_t *buffer,
 485                 uint32_t offset, uint32_t count)
 486 {
 487         struct target *target = bank->target;
 488         uint32_t buffer_size = 16384;
 489         struct working_area *write_algorithm;
 490         struct working_area *source;
 491         uint32_t address = bank->base + offset;
 492         struct reg_param reg_params[5];
 493         struct armv7m_algorithm armv7m_info;
 494         int retval = ERROR_OK;
 495
 496         /* see contrib/loaders/flash/stm32f2x.S for src */
 497
 498         static const uint8_t stm32x_flash_write_code[] = {
 499                                                                         /* wait_fifo: */
 500                 0xD0, 0xF8, 0x00, 0x80,         /* ldr          r8, [r0, #0] */
 501                 0xB8, 0xF1, 0x00, 0x0F,         /* cmp          r8, #0 */
 502                 0x1A, 0xD0,                                     /* beq          exit */
 503                 0x47, 0x68,                                     /* ldr          r7, [r0, #4] */
 504                 0x47, 0x45,                                     /* cmp          r7, r8 */
 505                 0xF7, 0xD0,                                     /* beq          wait_fifo */
 506
 507                 0xDF, 0xF8, 0x30, 0x60,         /* ldr          r6, STM32_PROG16 */
 508                 0x26, 0x61,                                     /* str          r6, [r4, #STM32_FLASH_CR_OFFSET] */
 509                 0x37, 0xF8, 0x02, 0x6B,         /* ldrh         r6, [r7], #0x02 */
 510                 0x22, 0xF8, 0x02, 0x6B,         /* strh         r6, [r2], #0x02 */
 511                                                                         /* busy: */
 512                 0xE6, 0x68,                                     /* ldr          r6, [r4, #STM32_FLASH_SR_OFFSET] */
 513                 0x16, 0xF4, 0x80, 0x3F,         /* tst          r6, #0x10000 */
 514                 0xFB, 0xD1,                                     /* bne          busy */
 515                 0x16, 0xF0, 0xF0, 0x0F,         /* tst          r6, #0xf0 */
 516                 0x07, 0xD1,                                     /* bne          error */
 517
 518                 0x8F, 0x42,                                     /* cmp          r7, r1 */
 519                 0x28, 0xBF,                                     /* it           cs */
 520                 0x00, 0xF1, 0x08, 0x07,         /* addcs        r7, r0, #8 */
 521                 0x47, 0x60,                                     /* str          r7, [r0, #4] */
 522                 0x01, 0x3B,                                     /* subs         r3, r3, #1 */
 523                 0x13, 0xB1,                                     /* cbz          r3, exit */
 524                 0xE1, 0xE7,                                     /* b            wait_fifo */
 525                                                                         /* error: */
 526                 0x00, 0x21,                                     /* movs         r1, #0 */
 527                 0x41, 0x60,                                     /* str          r1, [r0, #4] */
 528                                                                         /* exit: */
 529                 0x30, 0x46,                                     /* mov          r0, r6 */
 530                 0x00, 0xBE,                                     /* bkpt         #0x00 */
 531
 532                 /* <STM32_PROG16>: */
 533                 0x01, 0x01, 0x00, 0x00,         /* .word        0x00000101 */
 534         };
 535
 536         if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
 537                         &write_algorithm) != ERROR_OK) {
 538                 LOG_WARNING("no working area available, can't do block memory writes");
 539                 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
 540         };
 541
 542         retval = target_write_buffer(target, write_algorithm->address,
 543                         sizeof(stm32x_flash_write_code),
 544                         stm32x_flash_write_code);
 545         if (retval != ERROR_OK)
 546                 return retval;
 547
 548         /* memory buffer */
 549         while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
 550                 buffer_size /= 2;
 551                 if (buffer_size <= 256) {
 552                         /* we already allocated the writing code, but failed to get a
 553                          * buffer, free the algorithm */
 554                         target_free_working_area(target, write_algorithm);
 555
 556                         LOG_WARNING("no large enough working area available, can't do block memory writes");
 557                         return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
 558                 }
 559         };
 560
 561         armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
 562         armv7m_info.core_mode = ARM_MODE_THREAD;
 563
 564         init_reg_param(&reg_params[0], "r0", 32, PARAM_IN_OUT);         /* buffer start, status (out) */
 565         init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);            /* buffer end */
 566         init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);            /* target address */
 567         init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);            /* count (halfword-16bit) */
 568         init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT);            /* flash base */
 569
 570         buf_set_u32(reg_params[0].value, 0, 32, source->address);
 571         buf_set_u32(reg_params[1].value, 0, 32, source->address + source->size);
 572         buf_set_u32(reg_params[2].value, 0, 32, address);
 573         buf_set_u32(reg_params[3].value, 0, 32, count);
 574         buf_set_u32(reg_params[4].value, 0, 32, STM32_FLASH_BASE);
 575
 576         retval = target_run_flash_async_algorithm(target, buffer, count, 2,
 577                         0, NULL,
 578                         5, reg_params,
 579                         source->address, source->size,
 580                         write_algorithm->address, 0,
 581                         &armv7m_info);
 582
 583         if (retval == ERROR_FLASH_OPERATION_FAILED) {
 584                 LOG_ERROR("error executing stm32x flash write algorithm");
 585
 586                 uint32_t error = buf_get_u32(reg_params[0].value, 0, 32) & FLASH_ERROR;
 587
 588                 if (error & FLASH_WRPERR)
 589                         LOG_ERROR("flash memory write protected");
 590
 591                 if (error != 0) {
 592                         LOG_ERROR("flash write failed = %08" PRIx32, error);
 593                         /* Clear but report errors */
 594                         target_write_u32(target, STM32_FLASH_SR, error);
 595                         retval = ERROR_FAIL;
 596                 }
 597         }
 598
 599         target_free_working_area(target, source);
 600         target_free_working_area(target, write_algorithm);
 601
 602         destroy_reg_param(&reg_params[0]);
 603         destroy_reg_param(&reg_params[1]);
 604         destroy_reg_param(&reg_params[2]);
 605         destroy_reg_param(&reg_params[3]);
 606         destroy_reg_param(&reg_params[4]);
 607
 608         return retval;
 609 }
 610
 611 static int stm32x_write(struct flash_bank *bank, uint8_t *buffer,
 612                 uint32_t offset, uint32_t count)
 613 {
 614         struct target *target = bank->target;
 615         uint32_t words_remaining = (count / 2);
 616         uint32_t bytes_remaining = (count & 0x00000001);
 617         uint32_t address = bank->base + offset;
 618         uint32_t bytes_written = 0;
 619         int retval;
 620
 621         if (bank->target->state != TARGET_HALTED) {
 622                 LOG_ERROR("Target not halted");
 623                 return ERROR_TARGET_NOT_HALTED;
 624         }
 625
 626         if (offset & 0x1) {
 627                 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
 628                 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
 629         }
 630
 631         retval = stm32x_unlock_reg(target);
 632         if (retval != ERROR_OK)
 633                 return retval;
 634
 635         /* multiple half words (2-byte) to be programmed? */
 636         if (words_remaining > 0) {
 637                 /* try using a block write */
 638                 retval = stm32x_write_block(bank, buffer, offset, words_remaining);
 639                 if (retval != ERROR_OK) {
 640                         if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
 641                                 /* if block write failed (no sufficient working area),
 642                                  * we use normal (slow) single dword accesses */
 643                                 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
 644                         }
 645                 } else {
 646                         buffer += words_remaining * 2;
 647                         address += words_remaining * 2;
 648                         words_remaining = 0;
 649                 }
 650         }
 651
 652         if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
 653                 return retval;
 654
 655         /*
 656         Standard programming
 657         The Flash memory programming sequence is as follows:
 658         1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
 659           FLASH_SR register.
 660         2. Set the PG bit in the FLASH_CR register
 661         3. Perform the data write operation(s) to the desired memory address (inside main
 662           memory block or OTP area):
 663         – – Half-word access in case of x16 parallelism
 664         – Word access in case of x32 parallelism
 665         –
 666         4.
 667         Byte access in case of x8 parallelism
 668         Double word access in case of x64 parallelism
 669         Wait for the BSY bit to be cleared
 670         */
 671         while (words_remaining > 0) {
 672                 uint16_t value;
 673                 memcpy(&value, buffer + bytes_written, sizeof(uint16_t));
 674
 675                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
 676                                 FLASH_PG | FLASH_PSIZE_16);
 677                 if (retval != ERROR_OK)
 678                         return retval;
 679
 680                 retval = target_write_u16(target, address, value);
 681                 if (retval != ERROR_OK)
 682                         return retval;
 683
 684                 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
 685                 if (retval != ERROR_OK)
 686                         return retval;
 687
 688                 bytes_written += 2;
 689                 words_remaining--;
 690                 address += 2;
 691         }
 692
 693         if (bytes_remaining) {
 694                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
 695                                 FLASH_PG | FLASH_PSIZE_8);
 696                 if (retval != ERROR_OK)
 697                         return retval;
 698                 retval = target_write_u8(target, address, buffer[bytes_written]);
 699                 if (retval != ERROR_OK)
 700                         return retval;
 701
 702                 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
 703                 if (retval != ERROR_OK)
 704                         return retval;
 705         }
 706
 707         return target_write_u32(target, STM32_FLASH_CR, FLASH_LOCK);
 708 }
 709
 710 static void setup_sector(struct flash_bank *bank, int start, int num, int size)
 711 {
 712         for (int i = start; i < (start + num) ; i++) {
 713                 assert(i < bank->num_sectors);
 714                 bank->sectors[i].offset = bank->size;
 715                 bank->sectors[i].size = size;
 716                 bank->size += bank->sectors[i].size;
 717         }
 718 }
 719
 720 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
 721 {
 722         /* this checks for a stm32f4x errata issue where a
 723          * stm32f2x DBGMCU_IDCODE is incorrectly returned.
 724          * If the issue is detected target is forced to stm32f4x Rev A.
 725          * Only effects Rev A silicon */
 726
 727         struct target *target = bank->target;
 728         uint32_t cpuid;
 729
 730         /* read stm32 device id register */
 731         int retval = target_read_u32(target, 0xE0042000, device_id);
 732         if (retval != ERROR_OK)
 733                 return retval;
 734
 735         if ((*device_id & 0xfff) == 0x411) {
 736                 /* read CPUID reg to check core type */
 737                 retval = target_read_u32(target, 0xE000ED00, &cpuid);
 738                 if (retval != ERROR_OK)
 739                         return retval;
 740
 741                 /* check for cortex_m4 */
 742                 if (((cpuid >> 4) & 0xFFF) == 0xC24) {
 743                         *device_id &= ~((0xFFFF << 16) | 0xfff);
 744                         *device_id |= (0x1000 << 16) | 0x413;
 745                         LOG_INFO("stm32f4x errata detected - fixing incorrect MCU_IDCODE");
 746                 }
 747         }
 748         return retval;
 749 }
 750
 751 static int stm32x_probe(struct flash_bank *bank)
 752 {
 753         struct target *target = bank->target;
 754         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 755         int i;
 756         uint16_t flash_size_in_kb;
 757         uint16_t max_flash_size_in_kb;
 758         uint32_t device_id;
 759         uint32_t base_address = 0x08000000;
 760
 761         stm32x_info->probed = 0;
 762         stm32x_info->has_large_mem = false;
 763
 764         /* read stm32 device id register */
 765         int retval = stm32x_get_device_id(bank, &device_id);
 766         if (retval != ERROR_OK)
 767                 return retval;
 768         LOG_INFO("device id = 0x%08" PRIx32 "", device_id);
 769
 770         /* set max flash size depending on family */
 771         switch (device_id & 0xfff) {
 772         case 0x411:
 773         case 0x413:
 774                 max_flash_size_in_kb = 1024;
 775                 break;
 776         case 0x419:
 777                 max_flash_size_in_kb = 2048;
 778                 break;
 779         case 0x423:
 780                 max_flash_size_in_kb = 256;
 781                 break;
 782         default:
 783                 LOG_WARNING("Cannot identify target as a STM32 family.");
 784                 return ERROR_FAIL;
 785         }
 786
 787         /* get flash size from target. */
 788         retval = target_read_u16(target, 0x1FFF7A22, &flash_size_in_kb);
 789
 790         /* failed reading flash size or flash size invalid (early silicon),
 791          * default to max target family */
 792         if (retval != ERROR_OK || flash_size_in_kb == 0xffff || flash_size_in_kb == 0) {
 793                 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming %dk flash",
 794                         max_flash_size_in_kb);
 795                 flash_size_in_kb = max_flash_size_in_kb;
 796         }
 797
 798         /* if the user sets the size manually then ignore the probed value
 799          * this allows us to work around devices that have a invalid flash size register value */
 800         if (stm32x_info->user_bank_size) {
 801                 LOG_INFO("ignoring flash probed value, using configured bank size");
 802                 flash_size_in_kb = stm32x_info->user_bank_size / 1024;
 803         }
 804
 805         /* only devices with > 1024kB have dual banks */
 806         if (flash_size_in_kb > 1024)
 807                 stm32x_info->has_large_mem = true;
 808
 809         LOG_INFO("flash size = %dkbytes", flash_size_in_kb);
 810
 811         /* did we assign flash size? */
 812         assert(flash_size_in_kb != 0xffff);
 813
 814         /* calculate numbers of pages */
 815         int num_pages = (flash_size_in_kb / 128) + 4;
 816
 817         /* check for larger 2048 bytes devices */
 818         if (stm32x_info->has_large_mem)
 819                 num_pages += 4;
 820
 821         /* check that calculation result makes sense */
 822         assert(num_pages > 0);
 823
 824         if (bank->sectors) {
 825                 free(bank->sectors);
 826                 bank->sectors = NULL;
 827         }
 828
 829         bank->base = base_address;
 830         bank->num_sectors = num_pages;
 831         bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
 832         bank->size = 0;
 833
 834         /* fixed memory */
 835         setup_sector(bank, 0, 4, 16 * 1024);
 836         setup_sector(bank, 4, 1, 64 * 1024);
 837
 838         /* dynamic memory */
 839         setup_sector(bank, 4 + 1, MIN(12, num_pages) - 5, 128 * 1024);
 840
 841         if (stm32x_info->has_large_mem) {
 842
 843                 /* fixed memory for larger devices */
 844                 setup_sector(bank, 12, 4, 16 * 1024);
 845                 setup_sector(bank, 16, 1, 64 * 1024);
 846
 847                 /* dynamic memory for larger devices */
 848                 setup_sector(bank, 16 + 1, num_pages - 5 - 12, 128 * 1024);
 849         }
 850
 851         for (i = 0; i < num_pages; i++) {
 852                 bank->sectors[i].is_erased = -1;
 853                 bank->sectors[i].is_protected = 0;
 854         }
 855
 856         stm32x_info->probed = 1;
 857
 858         return ERROR_OK;
 859 }
 860
 861 static int stm32x_auto_probe(struct flash_bank *bank)
 862 {
 863         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 864         if (stm32x_info->probed)
 865                 return ERROR_OK;
 866         return stm32x_probe(bank);
 867 }
 868
 869 static int get_stm32x_info(struct flash_bank *bank, char *buf, int buf_size)
 870 {
 871         uint32_t dbgmcu_idcode;
 872
 873         /* read stm32 device id register */
 874         int retval = stm32x_get_device_id(bank, &dbgmcu_idcode);
 875         if (retval != ERROR_OK)
 876                 return retval;
 877
 878         uint16_t device_id = dbgmcu_idcode & 0xfff;
 879         uint16_t rev_id = dbgmcu_idcode >> 16;
 880         const char *device_str;
 881         const char *rev_str = NULL;
 882
 883         switch (device_id) {
 884         case 0x411:
 885                 device_str = "STM32F2xx";
 886
 887                 switch (rev_id) {
 888                 case 0x1000:
 889                         rev_str = "A";
 890                         break;
 891
 892                 case 0x2000:
 893                         rev_str = "B";
 894                         break;
 895
 896                 case 0x1001:
 897                         rev_str = "Z";
 898                         break;
 899
 900                 case 0x2001:
 901                         rev_str = "Y";
 902                         break;
 903
 904                 case 0x2003:
 905                         rev_str = "X";
 906                         break;
 907                 }
 908                 break;
 909
 910         case 0x413:
 911         case 0x419:
 912                 device_str = "STM32F4xx";
 913
 914                 switch (rev_id) {
 915                 case 0x1000:
 916                         rev_str = "A";
 917                         break;
 918
 919                 case 0x1001:
 920                         rev_str = "Z";
 921                         break;
 922
 923                 case 0x1003:
 924                         rev_str = "Y";
 925                         break;
 926                 }
 927                 break;
 928
 929         case 0x423:
 930                 device_str = "STM32F4xx (Low Power)";
 931
 932                 switch (rev_id) {
 933                 case 0x1000:
 934                         rev_str = "A";
 935                         break;
 936
 937                 case 0x1001:
 938                         rev_str = "Z";
 939                         break;
 940                 }
 941                 break;
 942
 943         default:
 944                 snprintf(buf, buf_size, "Cannot identify target as a STM32F2/4\n");
 945                 return ERROR_FAIL;
 946         }
 947
 948         if (rev_str != NULL)
 949                 snprintf(buf, buf_size, "%s - Rev: %s", device_str, rev_str);
 950         else
 951                 snprintf(buf, buf_size, "%s - Rev: unknown (0x%04x)", device_str, rev_id);
 952
 953         return ERROR_OK;
 954 }
 955
 956 COMMAND_HANDLER(stm32x_handle_lock_command)
 957 {
 958         struct target *target = NULL;
 959         struct stm32x_flash_bank *stm32x_info = NULL;
 960
 961         if (CMD_ARGC < 1)
 962                 return ERROR_COMMAND_SYNTAX_ERROR;
 963
 964         struct flash_bank *bank;
 965         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 966         if (ERROR_OK != retval)
 967                 return retval;
 968
 969         stm32x_info = bank->driver_priv;
 970         target = bank->target;
 971
 972         if (target->state != TARGET_HALTED) {
 973                 LOG_ERROR("Target not halted");
 974                 return ERROR_TARGET_NOT_HALTED;
 975         }
 976
 977         if (stm32x_read_options(bank) != ERROR_OK) {
 978                 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
 979                 return ERROR_OK;
 980         }
 981
 982         /* set readout protection */
 983         stm32x_info->option_bytes.RDP = 0;
 984
 985         if (stm32x_write_options(bank) != ERROR_OK) {
 986                 command_print(CMD_CTX, "%s failed to lock device", bank->driver->name);
 987                 return ERROR_OK;
 988         }
 989
 990         command_print(CMD_CTX, "%s locked", bank->driver->name);
 991
 992         return ERROR_OK;
 993 }
 994
 995 COMMAND_HANDLER(stm32x_handle_unlock_command)
 996 {
 997         struct target *target = NULL;
 998         struct stm32x_flash_bank *stm32x_info = NULL;
 999
1000         if (CMD_ARGC < 1)
1001                 return ERROR_COMMAND_SYNTAX_ERROR;
1002
1003         struct flash_bank *bank;
1004         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1005         if (ERROR_OK != retval)
1006                 return retval;
1007
1008         stm32x_info = bank->driver_priv;
1009         target = bank->target;
1010
1011         if (target->state != TARGET_HALTED) {
1012                 LOG_ERROR("Target not halted");
1013                 return ERROR_TARGET_NOT_HALTED;
1014         }
1015
1016         if (stm32x_read_options(bank) != ERROR_OK) {
1017                 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
1018                 return ERROR_OK;
1019         }
1020
1021         /* clear readout protection and complementary option bytes
1022          * this will also force a device unlock if set */
1023         stm32x_info->option_bytes.RDP = 0xAA;
1024
1025         if (stm32x_write_options(bank) != ERROR_OK) {
1026                 command_print(CMD_CTX, "%s failed to unlock device", bank->driver->name);
1027                 return ERROR_OK;
1028         }
1029
1030         command_print(CMD_CTX, "%s unlocked.\n"
1031                         "INFO: a reset or power cycle is required "
1032                         "for the new settings to take effect.", bank->driver->name);
1033
1034         return ERROR_OK;
1035 }
1036
1037 static int stm32x_mass_erase(struct flash_bank *bank)
1038 {
1039         int retval;
1040         struct target *target = bank->target;
1041         struct stm32x_flash_bank *stm32x_info = NULL;
1042
1043         if (target->state != TARGET_HALTED) {
1044                 LOG_ERROR("Target not halted");
1045                 return ERROR_TARGET_NOT_HALTED;
1046         }
1047
1048         stm32x_info = bank->driver_priv;
1049
1050         retval = stm32x_unlock_reg(target);
1051         if (retval != ERROR_OK)
1052                 return retval;
1053
1054         /* mass erase flash memory */
1055         if (stm32x_info->has_large_mem)
1056                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER | FLASH_MER1);
1057         else
1058                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER);
1059         if (retval != ERROR_OK)
1060                 return retval;
1061         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
1062                 FLASH_MER | FLASH_STRT);
1063         if (retval != ERROR_OK)
1064                 return retval;
1065
1066         retval = stm32x_wait_status_busy(bank, 30000);
1067         if (retval != ERROR_OK)
1068                 return retval;
1069
1070         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
1071         if (retval != ERROR_OK)
1072                 return retval;
1073
1074         return ERROR_OK;
1075 }
1076
1077 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
1078 {
1079         int i;
1080
1081         if (CMD_ARGC < 1) {
1082                 command_print(CMD_CTX, "stm32x mass_erase <bank>");
1083                 return ERROR_COMMAND_SYNTAX_ERROR;
1084         }
1085
1086         struct flash_bank *bank;
1087         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1088         if (ERROR_OK != retval)
1089                 return retval;
1090
1091         retval = stm32x_mass_erase(bank);
1092         if (retval == ERROR_OK) {
1093                 /* set all sectors as erased */
1094                 for (i = 0; i < bank->num_sectors; i++)
1095                         bank->sectors[i].is_erased = 1;
1096
1097                 command_print(CMD_CTX, "stm32x mass erase complete");
1098         } else {
1099                 command_print(CMD_CTX, "stm32x mass erase failed");
1100         }
1101
1102         return retval;
1103 }
1104
1105 static const struct command_registration stm32x_exec_command_handlers[] = {
1106         {
1107                 .name = "lock",
1108                 .handler = stm32x_handle_lock_command,
1109                 .mode = COMMAND_EXEC,
1110                 .usage = "bank_id",
1111                 .help = "Lock entire flash device.",
1112         },
1113         {
1114                 .name = "unlock",
1115                 .handler = stm32x_handle_unlock_command,
1116                 .mode = COMMAND_EXEC,
1117                 .usage = "bank_id",
1118                 .help = "Unlock entire protected flash device.",
1119         },
1120         {
1121                 .name = "mass_erase",
1122                 .handler = stm32x_handle_mass_erase_command,
1123                 .mode = COMMAND_EXEC,
1124                 .usage = "bank_id",
1125                 .help = "Erase entire flash device.",
1126         },
1127         COMMAND_REGISTRATION_DONE
1128 };
1129
1130 static const struct command_registration stm32x_command_handlers[] = {
1131         {
1132                 .name = "stm32f2x",
1133                 .mode = COMMAND_ANY,
1134                 .help = "stm32f2x flash command group",
1135                 .usage = "",
1136                 .chain = stm32x_exec_command_handlers,
1137         },
1138         COMMAND_REGISTRATION_DONE
1139 };
1140
1141 struct flash_driver stm32f2x_flash = {
1142         .name = "stm32f2x",
1143         .commands = stm32x_command_handlers,
1144         .flash_bank_command = stm32x_flash_bank_command,
1145         .erase = stm32x_erase,
1146         .protect = stm32x_protect,
1147         .write = stm32x_write,
1148         .read = default_flash_read,
1149         .probe = stm32x_probe,
1150         .auto_probe = stm32x_auto_probe,
1151         .erase_check = default_flash_blank_check,
1152         .protect_check = stm32x_protect_check,
1153         .info = get_stm32x_info,
1154 };