git.sur5r.net Git - openocd/blob - src/flash/nor/stm32f2x.c

   1 /***************************************************************************
   2  *   Copyright (C) 2005 by Dominic Rath                                    *
   3  *   Dominic.Rath@gmx.de                                                   *
   4  *                                                                         *
   5  *   Copyright (C) 2008 by Spencer Oliver                                  *
   6  *   spen@spen-soft.co.uk                                                  *
   7  *                                                                         *
   8  *   Copyright (C) 2011 Øyvind Harboe                                      *
   9  *   oyvind.harboe@zylin.com                                               *
  10  *                                                                         *
  11  *   This program is free software; you can redistribute it and/or modify  *
  12  *   it under the terms of the GNU General Public License as published by  *
  13  *   the Free Software Foundation; either version 2 of the License, or     *
  14  *   (at your option) any later version.                                   *
  15  *                                                                         *
  16  *   This program is distributed in the hope that it will be useful,       *
  17  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  18  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  19  *   GNU General Public License for more details.                          *
  20  *                                                                         *
  21  *   You should have received a copy of the GNU General Public License     *
  22  *   along with this program; if not, write to the                         *
  23  *   Free Software Foundation, Inc.,                                       *
  24  *   51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.           *
  25  ***************************************************************************/
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include "imp.h"
  32 #include <helper/binarybuffer.h>
  33 #include <target/algorithm.h>
  34 #include <target/armv7m.h>
  35
  36 /* Regarding performance:
  37  *
  38  * Short story - it might be best to leave the performance at
  39  * current levels.
  40  *
  41  * You may see a jump in speed if you change to using
  42  * 32bit words for the block programming.
  43  *
  44  * Its a shame you cannot use the double word as its
  45  * even faster - but you require external VPP for that mode.
  46  *
  47  * Having said all that 16bit writes give us the widest vdd
  48  * operating range, so may be worth adding a note to that effect.
  49  *
  50  */
  51
  52 /* Danger!!!! The STM32F1x and STM32F2x series actually have
  53  * quite different flash controllers.
  54  *
  55  * What's more scary is that the names of the registers and their
  56  * addresses are the same, but the actual bits and what they do are
  57  * can be very different.
  58  *
  59  * To reduce testing complexity and dangers of regressions,
  60  * a seperate file is used for stm32fx2x.
  61  *
  62  * 1mByte part with 4 x 16, 1 x 64, 7 x 128kBytes sectors
  63  *
  64  * What's the protection page size???
  65  *
  66  * Tested with STM3220F-EVAL board.
  67  *
  68  * STM32F21xx series for reference.
  69  *
  70  * RM0033
  71  * http://www.st.com/internet/mcu/product/250192.jsp
  72  *
  73  * PM0059
  74  * www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/
  75  * PROGRAMMING_MANUAL/CD00233952.pdf
  76  *
  77  * STM32F1x series - notice that this code was copy, pasted and knocked
  78  * into a stm32f2x driver, so in case something has been converted or
  79  * bugs haven't been fixed, here are the original manuals:
  80  *
  81  * RM0008 - Reference manual
  82  *
  83  * RM0042, the Flash programming manual for low-, medium- high-density and
  84  * connectivity line STM32F10x devices
  85  *
  86  * PM0068, the Flash programming manual for XL-density STM32F10x devices.
  87  *
  88  */
  89
  90 /* Erase time can be as high as 1000ms, 10x this and it's toast... */
  91 #define FLASH_ERASE_TIMEOUT 10000
  92 #define FLASH_WRITE_TIMEOUT 5
  93
  94 #define STM32_FLASH_BASE    0x40023c00
  95 #define STM32_FLASH_ACR     0x40023c00
  96 #define STM32_FLASH_KEYR    0x40023c04
  97 #define STM32_FLASH_OPTKEYR 0x40023c08
  98 #define STM32_FLASH_SR      0x40023c0C
  99 #define STM32_FLASH_CR      0x40023c10
 100 #define STM32_FLASH_OPTCR   0x40023c14
 101 #define STM32_FLASH_OPTCR1  0x40023c18
 102
 103 /* FLASH_CR register bits */
 104
 105 #define FLASH_PG       (1 << 0)
 106 #define FLASH_SER      (1 << 1)
 107 #define FLASH_MER      (1 << 2)
 108 #define FLASH_MER1     (1 << 15)
 109 #define FLASH_STRT     (1 << 16)
 110 #define FLASH_PSIZE_8  (0 << 8)
 111 #define FLASH_PSIZE_16 (1 << 8)
 112 #define FLASH_PSIZE_32 (2 << 8)
 113 #define FLASH_PSIZE_64 (3 << 8)
 114 #define FLASH_SNB(a)   ((a) << 3)
 115 #define FLASH_LOCK     (1 << 31)
 116
 117 /* FLASH_SR register bits */
 118
 119 #define FLASH_BSY      (1 << 16)
 120 #define FLASH_PGSERR   (1 << 7) /* Programming sequence error */
 121 #define FLASH_PGPERR   (1 << 6) /* Programming parallelism error */
 122 #define FLASH_PGAERR   (1 << 5) /* Programming alignment error */
 123 #define FLASH_WRPERR   (1 << 4) /* Write protection error */
 124 #define FLASH_OPERR    (1 << 1) /* Operation error */
 125
 126 #define FLASH_ERROR (FLASH_PGSERR | FLASH_PGPERR | FLASH_PGAERR | FLASH_WRPERR | FLASH_OPERR)
 127
 128 /* STM32_FLASH_OPTCR register bits */
 129
 130 #define OPT_LOCK      (1 << 0)
 131 #define OPT_START     (1 << 1)
 132
 133 /* STM32_FLASH_OBR bit definitions (reading) */
 134
 135 #define OPT_ERROR      0
 136 #define OPT_READOUT    1
 137 #define OPT_RDWDGSW    2
 138 #define OPT_RDRSTSTOP  3
 139 #define OPT_RDRSTSTDBY 4
 140 #define OPT_BFB2       5        /* dual flash bank only */
 141
 142 /* register unlock keys */
 143
 144 #define KEY1           0x45670123
 145 #define KEY2           0xCDEF89AB
 146
 147 /* option register unlock key */
 148 #define OPTKEY1        0x08192A3B
 149 #define OPTKEY2        0x4C5D6E7F
 150
 151 struct stm32x_options {
 152         uint8_t RDP;
 153         uint8_t user_options;
 154         uint32_t protection;
 155 };
 156
 157 struct stm32x_flash_bank {
 158         struct stm32x_options option_bytes;
 159         int probed;
 160         bool has_large_mem;             /* stm32f42x/stm32f43x family */
 161         uint32_t user_bank_size;
 162 };
 163
 164 /* flash bank stm32x <base> <size> 0 0 <target#>
 165  */
 166 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
 167 {
 168         struct stm32x_flash_bank *stm32x_info;
 169
 170         if (CMD_ARGC < 6)
 171                 return ERROR_COMMAND_SYNTAX_ERROR;
 172
 173         stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
 174         bank->driver_priv = stm32x_info;
 175
 176         stm32x_info->probed = 0;
 177         stm32x_info->user_bank_size = bank->size;
 178
 179         return ERROR_OK;
 180 }
 181
 182 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
 183 {
 184         return reg;
 185 }
 186
 187 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
 188 {
 189         struct target *target = bank->target;
 190         return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
 191 }
 192
 193 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
 194 {
 195         struct target *target = bank->target;
 196         uint32_t status;
 197         int retval = ERROR_OK;
 198
 199         /* wait for busy to clear */
 200         for (;;) {
 201                 retval = stm32x_get_flash_status(bank, &status);
 202                 if (retval != ERROR_OK)
 203                         return retval;
 204                 LOG_DEBUG("status: 0x%" PRIx32 "", status);
 205                 if ((status & FLASH_BSY) == 0)
 206                         break;
 207                 if (timeout-- <= 0) {
 208                         LOG_ERROR("timed out waiting for flash");
 209                         return ERROR_FAIL;
 210                 }
 211                 alive_sleep(1);
 212         }
 213
 214
 215         if (status & FLASH_WRPERR) {
 216                 LOG_ERROR("stm32x device protected");
 217                 retval = ERROR_FAIL;
 218         }
 219
 220         /* Clear but report errors */
 221         if (status & FLASH_ERROR) {
 222                 /* If this operation fails, we ignore it and report the original
 223                  * retval
 224                  */
 225                 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
 226                                 status & FLASH_ERROR);
 227         }
 228         return retval;
 229 }
 230
 231 static int stm32x_unlock_reg(struct target *target)
 232 {
 233         uint32_t ctrl;
 234
 235         /* first check if not already unlocked
 236          * otherwise writing on STM32_FLASH_KEYR will fail
 237          */
 238         int retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
 239         if (retval != ERROR_OK)
 240                 return retval;
 241
 242         if ((ctrl & FLASH_LOCK) == 0)
 243                 return ERROR_OK;
 244
 245         /* unlock flash registers */
 246         retval = target_write_u32(target, STM32_FLASH_KEYR, KEY1);
 247         if (retval != ERROR_OK)
 248                 return retval;
 249
 250         retval = target_write_u32(target, STM32_FLASH_KEYR, KEY2);
 251         if (retval != ERROR_OK)
 252                 return retval;
 253
 254         retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
 255         if (retval != ERROR_OK)
 256                 return retval;
 257
 258         if (ctrl & FLASH_LOCK) {
 259                 LOG_ERROR("flash not unlocked STM32_FLASH_CR: %x", ctrl);
 260                 return ERROR_TARGET_FAILURE;
 261         }
 262
 263         return ERROR_OK;
 264 }
 265
 266 static int stm32x_unlock_option_reg(struct target *target)
 267 {
 268         uint32_t ctrl;
 269
 270         int retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
 271         if (retval != ERROR_OK)
 272                 return retval;
 273
 274         if ((ctrl & OPT_LOCK) == 0)
 275                 return ERROR_OK;
 276
 277         /* unlock option registers */
 278         retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY1);
 279         if (retval != ERROR_OK)
 280                 return retval;
 281
 282         retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY2);
 283         if (retval != ERROR_OK)
 284                 return retval;
 285
 286         retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
 287         if (retval != ERROR_OK)
 288                 return retval;
 289
 290         if (ctrl & OPT_LOCK) {
 291                 LOG_ERROR("options not unlocked STM32_FLASH_OPTCR: %x", ctrl);
 292                 return ERROR_TARGET_FAILURE;
 293         }
 294
 295         return ERROR_OK;
 296 }
 297
 298 static int stm32x_read_options(struct flash_bank *bank)
 299 {
 300         uint32_t optiondata;
 301         struct stm32x_flash_bank *stm32x_info = NULL;
 302         struct target *target = bank->target;
 303
 304         stm32x_info = bank->driver_priv;
 305
 306         /* read current option bytes */
 307         int retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
 308         if (retval != ERROR_OK)
 309                 return retval;
 310
 311         stm32x_info->option_bytes.user_options = optiondata & 0xec;
 312         stm32x_info->option_bytes.RDP = (optiondata >> 8) & 0xff;
 313         stm32x_info->option_bytes.protection = (optiondata >> 16) & 0xfff;
 314
 315         if (stm32x_info->has_large_mem) {
 316
 317                 retval = target_read_u32(target, STM32_FLASH_OPTCR1, &optiondata);
 318                 if (retval != ERROR_OK)
 319                         return retval;
 320
 321                 /* append protection bits */
 322                 stm32x_info->option_bytes.protection |= (optiondata >> 4) & 0x00fff000;
 323         }
 324
 325         if (stm32x_info->option_bytes.RDP != 0xAA)
 326                 LOG_INFO("Device Security Bit Set");
 327
 328         return ERROR_OK;
 329 }
 330
 331 static int stm32x_write_options(struct flash_bank *bank)
 332 {
 333         struct stm32x_flash_bank *stm32x_info = NULL;
 334         struct target *target = bank->target;
 335         uint32_t optiondata;
 336
 337         stm32x_info = bank->driver_priv;
 338
 339         int retval = stm32x_unlock_option_reg(target);
 340         if (retval != ERROR_OK)
 341                 return retval;
 342
 343         /* rebuild option data */
 344         optiondata = stm32x_info->option_bytes.user_options;
 345         buf_set_u32(&optiondata, 8, 8, stm32x_info->option_bytes.RDP);
 346         buf_set_u32(&optiondata, 16, 12, stm32x_info->option_bytes.protection);
 347
 348         /* program options */
 349         retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata);
 350         if (retval != ERROR_OK)
 351                 return retval;
 352
 353         if (stm32x_info->has_large_mem) {
 354
 355                 uint32_t optiondata2 = 0;
 356                 buf_set_u32(&optiondata2, 16, 12, stm32x_info->option_bytes.protection >> 12);
 357                 retval = target_write_u32(target, STM32_FLASH_OPTCR1, optiondata2);
 358                 if (retval != ERROR_OK)
 359                         return retval;
 360         }
 361
 362         /* start programming cycle */
 363         retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPT_START);
 364         if (retval != ERROR_OK)
 365                 return retval;
 366
 367         /* wait for completion */
 368         retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
 369         if (retval != ERROR_OK)
 370                 return retval;
 371
 372         /* relock registers */
 373         retval = target_write_u32(target, STM32_FLASH_OPTCR, OPT_LOCK);
 374         if (retval != ERROR_OK)
 375                 return retval;
 376
 377         return ERROR_OK;
 378 }
 379
 380 static int stm32x_protect_check(struct flash_bank *bank)
 381 {
 382         struct target *target = bank->target;
 383         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 384
 385         if (target->state != TARGET_HALTED) {
 386                 LOG_ERROR("Target not halted");
 387                 return ERROR_TARGET_NOT_HALTED;
 388         }
 389
 390         /* read write protection settings */
 391         int retval = stm32x_read_options(bank);
 392         if (retval != ERROR_OK) {
 393                 LOG_DEBUG("unable to read option bytes");
 394                 return retval;
 395         }
 396
 397         for (int i = 0; i < bank->num_sectors; i++) {
 398                 if (stm32x_info->option_bytes.protection & (1 << i))
 399                         bank->sectors[i].is_protected = 0;
 400                 else
 401                         bank->sectors[i].is_protected = 1;
 402         }
 403
 404         return ERROR_OK;
 405 }
 406
 407 static int stm32x_erase(struct flash_bank *bank, int first, int last)
 408 {
 409         struct target *target = bank->target;
 410         int i;
 411
 412         if (bank->target->state != TARGET_HALTED) {
 413                 LOG_ERROR("Target not halted");
 414                 return ERROR_TARGET_NOT_HALTED;
 415         }
 416
 417         int retval;
 418         retval = stm32x_unlock_reg(target);
 419         if (retval != ERROR_OK)
 420                 return retval;
 421
 422         /*
 423         Sector Erase
 424         To erase a sector, follow the procedure below:
 425         1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
 426           FLASH_SR register
 427         2. Set the SER bit and select the sector (out of the 12 sectors in the main memory block)
 428           you wish to erase (SNB) in the FLASH_CR register
 429         3. Set the STRT bit in the FLASH_CR register
 430         4. Wait for the BSY bit to be cleared
 431          */
 432
 433         for (i = first; i <= last; i++) {
 434                 retval = target_write_u32(target,
 435                                 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_SER | FLASH_SNB(i) | FLASH_STRT);
 436                 if (retval != ERROR_OK)
 437                         return retval;
 438
 439                 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
 440                 if (retval != ERROR_OK)
 441                         return retval;
 442
 443                 bank->sectors[i].is_erased = 1;
 444         }
 445
 446         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
 447         if (retval != ERROR_OK)
 448                 return retval;
 449
 450         return ERROR_OK;
 451 }
 452
 453 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
 454 {
 455         struct target *target = bank->target;
 456         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 457
 458         if (target->state != TARGET_HALTED) {
 459                 LOG_ERROR("Target not halted");
 460                 return ERROR_TARGET_NOT_HALTED;
 461         }
 462
 463         /* read protection settings */
 464         int retval = stm32x_read_options(bank);
 465         if (retval != ERROR_OK) {
 466                 LOG_DEBUG("unable to read option bytes");
 467                 return retval;
 468         }
 469
 470         for (int i = first; i <= last; i++) {
 471
 472                 if (set)
 473                         stm32x_info->option_bytes.protection &= ~(1 << i);
 474                 else
 475                         stm32x_info->option_bytes.protection |= (1 << i);
 476         }
 477
 478         retval = stm32x_write_options(bank);
 479         if (retval != ERROR_OK)
 480                 return retval;
 481
 482         return ERROR_OK;
 483 }
 484
 485 static int stm32x_write_block(struct flash_bank *bank, uint8_t *buffer,
 486                 uint32_t offset, uint32_t count)
 487 {
 488         struct target *target = bank->target;
 489         uint32_t buffer_size = 16384;
 490         struct working_area *write_algorithm;
 491         struct working_area *source;
 492         uint32_t address = bank->base + offset;
 493         struct reg_param reg_params[5];
 494         struct armv7m_algorithm armv7m_info;
 495         int retval = ERROR_OK;
 496
 497         /* see contrib/loaders/flash/stm32f2x.S for src */
 498
 499         static const uint8_t stm32x_flash_write_code[] = {
 500                                                                         /* wait_fifo: */
 501                 0xD0, 0xF8, 0x00, 0x80,         /* ldr          r8, [r0, #0] */
 502                 0xB8, 0xF1, 0x00, 0x0F,         /* cmp          r8, #0 */
 503                 0x1A, 0xD0,                                     /* beq          exit */
 504                 0x47, 0x68,                                     /* ldr          r7, [r0, #4] */
 505                 0x47, 0x45,                                     /* cmp          r7, r8 */
 506                 0xF7, 0xD0,                                     /* beq          wait_fifo */
 507
 508                 0xDF, 0xF8, 0x30, 0x60,         /* ldr          r6, STM32_PROG16 */
 509                 0x26, 0x61,                                     /* str          r6, [r4, #STM32_FLASH_CR_OFFSET] */
 510                 0x37, 0xF8, 0x02, 0x6B,         /* ldrh         r6, [r7], #0x02 */
 511                 0x22, 0xF8, 0x02, 0x6B,         /* strh         r6, [r2], #0x02 */
 512                                                                         /* busy: */
 513                 0xE6, 0x68,                                     /* ldr          r6, [r4, #STM32_FLASH_SR_OFFSET] */
 514                 0x16, 0xF4, 0x80, 0x3F,         /* tst          r6, #0x10000 */
 515                 0xFB, 0xD1,                                     /* bne          busy */
 516                 0x16, 0xF0, 0xF0, 0x0F,         /* tst          r6, #0xf0 */
 517                 0x07, 0xD1,                                     /* bne          error */
 518
 519                 0x8F, 0x42,                                     /* cmp          r7, r1 */
 520                 0x28, 0xBF,                                     /* it           cs */
 521                 0x00, 0xF1, 0x08, 0x07,         /* addcs        r7, r0, #8 */
 522                 0x47, 0x60,                                     /* str          r7, [r0, #4] */
 523                 0x01, 0x3B,                                     /* subs         r3, r3, #1 */
 524                 0x13, 0xB1,                                     /* cbz          r3, exit */
 525                 0xE1, 0xE7,                                     /* b            wait_fifo */
 526                                                                         /* error: */
 527                 0x00, 0x21,                                     /* movs         r1, #0 */
 528                 0x41, 0x60,                                     /* str          r1, [r0, #4] */
 529                                                                         /* exit: */
 530                 0x30, 0x46,                                     /* mov          r0, r6 */
 531                 0x00, 0xBE,                                     /* bkpt         #0x00 */
 532
 533                 /* <STM32_PROG16>: */
 534                 0x01, 0x01, 0x00, 0x00,         /* .word        0x00000101 */
 535         };
 536
 537         if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
 538                         &write_algorithm) != ERROR_OK) {
 539                 LOG_WARNING("no working area available, can't do block memory writes");
 540                 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
 541         };
 542
 543         retval = target_write_buffer(target, write_algorithm->address,
 544                         sizeof(stm32x_flash_write_code),
 545                         (uint8_t *)stm32x_flash_write_code);
 546         if (retval != ERROR_OK)
 547                 return retval;
 548
 549         /* memory buffer */
 550         while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
 551                 buffer_size /= 2;
 552                 if (buffer_size <= 256) {
 553                         /* we already allocated the writing code, but failed to get a
 554                          * buffer, free the algorithm */
 555                         target_free_working_area(target, write_algorithm);
 556
 557                         LOG_WARNING("no large enough working area available, can't do block memory writes");
 558                         return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
 559                 }
 560         };
 561
 562         armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
 563         armv7m_info.core_mode = ARM_MODE_THREAD;
 564
 565         init_reg_param(&reg_params[0], "r0", 32, PARAM_IN_OUT);         /* buffer start, status (out) */
 566         init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);            /* buffer end */
 567         init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);            /* target address */
 568         init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);            /* count (halfword-16bit) */
 569         init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT);            /* flash base */
 570
 571         buf_set_u32(reg_params[0].value, 0, 32, source->address);
 572         buf_set_u32(reg_params[1].value, 0, 32, source->address + source->size);
 573         buf_set_u32(reg_params[2].value, 0, 32, address);
 574         buf_set_u32(reg_params[3].value, 0, 32, count);
 575         buf_set_u32(reg_params[4].value, 0, 32, STM32_FLASH_BASE);
 576
 577         retval = target_run_flash_async_algorithm(target, buffer, count, 2,
 578                         0, NULL,
 579                         5, reg_params,
 580                         source->address, source->size,
 581                         write_algorithm->address, 0,
 582                         &armv7m_info);
 583
 584         if (retval == ERROR_FLASH_OPERATION_FAILED) {
 585                 LOG_ERROR("error executing stm32x flash write algorithm");
 586
 587                 uint32_t error = buf_get_u32(reg_params[0].value, 0, 32) & FLASH_ERROR;
 588
 589                 if (error & FLASH_WRPERR)
 590                         LOG_ERROR("flash memory write protected");
 591
 592                 if (error != 0) {
 593                         LOG_ERROR("flash write failed = %08x", error);
 594                         /* Clear but report errors */
 595                         target_write_u32(target, STM32_FLASH_SR, error);
 596                         retval = ERROR_FAIL;
 597                 }
 598         }
 599
 600         target_free_working_area(target, source);
 601         target_free_working_area(target, write_algorithm);
 602
 603         destroy_reg_param(&reg_params[0]);
 604         destroy_reg_param(&reg_params[1]);
 605         destroy_reg_param(&reg_params[2]);
 606         destroy_reg_param(&reg_params[3]);
 607         destroy_reg_param(&reg_params[4]);
 608
 609         return retval;
 610 }
 611
 612 static int stm32x_write(struct flash_bank *bank, uint8_t *buffer,
 613                 uint32_t offset, uint32_t count)
 614 {
 615         struct target *target = bank->target;
 616         uint32_t words_remaining = (count / 2);
 617         uint32_t bytes_remaining = (count & 0x00000001);
 618         uint32_t address = bank->base + offset;
 619         uint32_t bytes_written = 0;
 620         int retval;
 621
 622         if (bank->target->state != TARGET_HALTED) {
 623                 LOG_ERROR("Target not halted");
 624                 return ERROR_TARGET_NOT_HALTED;
 625         }
 626
 627         if (offset & 0x1) {
 628                 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
 629                 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
 630         }
 631
 632         retval = stm32x_unlock_reg(target);
 633         if (retval != ERROR_OK)
 634                 return retval;
 635
 636         /* multiple half words (2-byte) to be programmed? */
 637         if (words_remaining > 0) {
 638                 /* try using a block write */
 639                 retval = stm32x_write_block(bank, buffer, offset, words_remaining);
 640                 if (retval != ERROR_OK) {
 641                         if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
 642                                 /* if block write failed (no sufficient working area),
 643                                  * we use normal (slow) single dword accesses */
 644                                 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
 645                         }
 646                 } else {
 647                         buffer += words_remaining * 2;
 648                         address += words_remaining * 2;
 649                         words_remaining = 0;
 650                 }
 651         }
 652
 653         if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
 654                 return retval;
 655
 656         /*
 657         Standard programming
 658         The Flash memory programming sequence is as follows:
 659         1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
 660           FLASH_SR register.
 661         2. Set the PG bit in the FLASH_CR register
 662         3. Perform the data write operation(s) to the desired memory address (inside main
 663           memory block or OTP area):
 664         – – Half-word access in case of x16 parallelism
 665         – Word access in case of x32 parallelism
 666         –
 667         4.
 668         Byte access in case of x8 parallelism
 669         Double word access in case of x64 parallelism
 670         Wait for the BSY bit to be cleared
 671         */
 672         while (words_remaining > 0) {
 673                 uint16_t value;
 674                 memcpy(&value, buffer + bytes_written, sizeof(uint16_t));
 675
 676                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
 677                                 FLASH_PG | FLASH_PSIZE_16);
 678                 if (retval != ERROR_OK)
 679                         return retval;
 680
 681                 retval = target_write_u16(target, address, value);
 682                 if (retval != ERROR_OK)
 683                         return retval;
 684
 685                 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
 686                 if (retval != ERROR_OK)
 687                         return retval;
 688
 689                 bytes_written += 2;
 690                 words_remaining--;
 691                 address += 2;
 692         }
 693
 694         if (bytes_remaining) {
 695                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
 696                                 FLASH_PG | FLASH_PSIZE_8);
 697                 if (retval != ERROR_OK)
 698                         return retval;
 699                 retval = target_write_u8(target, address, buffer[bytes_written]);
 700                 if (retval != ERROR_OK)
 701                         return retval;
 702
 703                 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
 704                 if (retval != ERROR_OK)
 705                         return retval;
 706         }
 707
 708         return target_write_u32(target, STM32_FLASH_CR, FLASH_LOCK);
 709 }
 710
 711 static void setup_sector(struct flash_bank *bank, int start, int num, int size)
 712 {
 713         for (int i = start; i < (start + num) ; i++) {
 714                 bank->sectors[i].offset = bank->size;
 715                 bank->sectors[i].size = size;
 716                 bank->size += bank->sectors[i].size;
 717         }
 718 }
 719
 720 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
 721 {
 722         /* this checks for a stm32f4x errata issue where a
 723          * stm32f2x DBGMCU_IDCODE is incorrectly returned.
 724          * If the issue is detected target is forced to stm32f4x Rev A.
 725          * Only effects Rev A silicon */
 726
 727         struct target *target = bank->target;
 728         uint32_t cpuid;
 729
 730         /* read stm32 device id register */
 731         int retval = target_read_u32(target, 0xE0042000, device_id);
 732         if (retval != ERROR_OK)
 733                 return retval;
 734
 735         if ((*device_id & 0xfff) == 0x411) {
 736                 /* read CPUID reg to check core type */
 737                 retval = target_read_u32(target, 0xE000ED00, &cpuid);
 738                 if (retval != ERROR_OK)
 739                         return retval;
 740
 741                 /* check for cortex_m4 */
 742                 if (((cpuid >> 4) & 0xFFF) == 0xC24) {
 743                         *device_id &= ~((0xFFFF << 16) | 0xfff);
 744                         *device_id |= (0x1000 << 16) | 0x413;
 745                         LOG_INFO("stm32f4x errata detected - fixing incorrect MCU_IDCODE");
 746                 }
 747         }
 748         return retval;
 749 }
 750
 751 static int stm32x_probe(struct flash_bank *bank)
 752 {
 753         struct target *target = bank->target;
 754         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 755         int i;
 756         uint16_t flash_size_in_kb;
 757         uint16_t max_flash_size_in_kb;
 758         uint32_t device_id;
 759         uint32_t base_address = 0x08000000;
 760
 761         stm32x_info->probed = 0;
 762         stm32x_info->has_large_mem = false;
 763
 764         /* read stm32 device id register */
 765         int retval = stm32x_get_device_id(bank, &device_id);
 766         if (retval != ERROR_OK)
 767                 return retval;
 768         LOG_INFO("device id = 0x%08" PRIx32 "", device_id);
 769
 770         /* set max flash size depending on family */
 771         switch (device_id & 0xfff) {
 772         case 0x411:
 773         case 0x413:
 774                 max_flash_size_in_kb = 1024;
 775                 break;
 776         case 0x419:
 777                 max_flash_size_in_kb = 2048;
 778                 stm32x_info->has_large_mem = true;
 779                 break;
 780         default:
 781                 LOG_WARNING("Cannot identify target as a STM32 family.");
 782                 return ERROR_FAIL;
 783         }
 784
 785         /* get flash size from target. */
 786         retval = target_read_u16(target, 0x1FFF7A22, &flash_size_in_kb);
 787
 788         /* failed reading flash size or flash size invalid (early silicon),
 789          * default to max target family */
 790         if (retval != ERROR_OK || flash_size_in_kb == 0xffff || flash_size_in_kb == 0) {
 791                 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming %dk flash",
 792                         max_flash_size_in_kb);
 793                 flash_size_in_kb = max_flash_size_in_kb;
 794         }
 795
 796         /* if the user sets the size manually then ignore the probed value
 797          * this allows us to work around devices that have a invalid flash size register value */
 798         if (stm32x_info->user_bank_size) {
 799                 LOG_INFO("ignoring flash probed value, using configured bank size");
 800                 flash_size_in_kb = stm32x_info->user_bank_size / 1024;
 801         }
 802
 803         LOG_INFO("flash size = %dkbytes", flash_size_in_kb);
 804
 805         /* did we assign flash size? */
 806         assert(flash_size_in_kb != 0xffff);
 807
 808         /* calculate numbers of pages */
 809         int num_pages = (flash_size_in_kb / 128) + 4;
 810
 811         /* check for larger 2048 bytes devices */
 812         if (stm32x_info->has_large_mem)
 813                 num_pages += 4;
 814
 815         /* check that calculation result makes sense */
 816         assert(num_pages > 0);
 817
 818         if (bank->sectors) {
 819                 free(bank->sectors);
 820                 bank->sectors = NULL;
 821         }
 822
 823         bank->base = base_address;
 824         bank->num_sectors = num_pages;
 825         bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
 826         bank->size = 0;
 827
 828         /* fixed memory */
 829         setup_sector(bank, 0, 4, 16 * 1024);
 830         setup_sector(bank, 4, 1, 64 * 1024);
 831
 832         /* dynamic memory */
 833         setup_sector(bank, 4 + 1, MAX(12, num_pages) - 5, 128 * 1024);
 834
 835         if (stm32x_info->has_large_mem) {
 836
 837                 /* fixed memory for larger devices */
 838                 setup_sector(bank, 12, 4, 16 * 1024);
 839                 setup_sector(bank, 16, 1, 64 * 1024);
 840
 841                 /* dynamic memory for larger devices */
 842                 setup_sector(bank, 16 + 1, num_pages - 5 - 12, 128 * 1024);
 843         }
 844
 845         for (i = 0; i < num_pages; i++) {
 846                 bank->sectors[i].is_erased = -1;
 847                 bank->sectors[i].is_protected = 0;
 848         }
 849
 850         stm32x_info->probed = 1;
 851
 852         return ERROR_OK;
 853 }
 854
 855 static int stm32x_auto_probe(struct flash_bank *bank)
 856 {
 857         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 858         if (stm32x_info->probed)
 859                 return ERROR_OK;
 860         return stm32x_probe(bank);
 861 }
 862
 863 static int get_stm32x_info(struct flash_bank *bank, char *buf, int buf_size)
 864 {
 865         uint32_t device_id;
 866         int printed;
 867
 868         /* read stm32 device id register */
 869         int retval = stm32x_get_device_id(bank, &device_id);
 870         if (retval != ERROR_OK)
 871                 return retval;
 872
 873         if ((device_id & 0xfff) == 0x411) {
 874                 printed = snprintf(buf, buf_size, "stm32f2x - Rev: ");
 875                 buf += printed;
 876                 buf_size -= printed;
 877
 878                 switch (device_id >> 16) {
 879                         case 0x1000:
 880                                 snprintf(buf, buf_size, "A");
 881                                 break;
 882
 883                         case 0x2000:
 884                                 snprintf(buf, buf_size, "B");
 885                                 break;
 886
 887                         case 0x1001:
 888                                 snprintf(buf, buf_size, "Z");
 889                                 break;
 890
 891                         case 0x2001:
 892                                 snprintf(buf, buf_size, "Y");
 893                                 break;
 894
 895                         case 0x2003:
 896                                 snprintf(buf, buf_size, "X");
 897                                 break;
 898
 899                         default:
 900                                 snprintf(buf, buf_size, "unknown");
 901                                 break;
 902                 }
 903         } else if (((device_id & 0xfff) == 0x413) ||
 904                         ((device_id & 0xfff) == 0x419)) {
 905                 printed = snprintf(buf, buf_size, "stm32f4x - Rev: ");
 906                 buf += printed;
 907                 buf_size -= printed;
 908
 909                 switch (device_id >> 16) {
 910                         case 0x1000:
 911                                 snprintf(buf, buf_size, "A");
 912                                 break;
 913
 914                         case 0x1001:
 915                                 snprintf(buf, buf_size, "Z");
 916                                 break;
 917
 918                         default:
 919                                 snprintf(buf, buf_size, "unknown");
 920                                 break;
 921                 }
 922         } else {
 923                 snprintf(buf, buf_size, "Cannot identify target as a stm32x\n");
 924                 return ERROR_FAIL;
 925         }
 926
 927         return ERROR_OK;
 928 }
 929
 930 COMMAND_HANDLER(stm32x_handle_lock_command)
 931 {
 932         struct target *target = NULL;
 933         struct stm32x_flash_bank *stm32x_info = NULL;
 934
 935         if (CMD_ARGC < 1)
 936                 return ERROR_COMMAND_SYNTAX_ERROR;
 937
 938         struct flash_bank *bank;
 939         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 940         if (ERROR_OK != retval)
 941                 return retval;
 942
 943         stm32x_info = bank->driver_priv;
 944         target = bank->target;
 945
 946         if (target->state != TARGET_HALTED) {
 947                 LOG_ERROR("Target not halted");
 948                 return ERROR_TARGET_NOT_HALTED;
 949         }
 950
 951         if (stm32x_read_options(bank) != ERROR_OK) {
 952                 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
 953                 return ERROR_OK;
 954         }
 955
 956         /* set readout protection */
 957         stm32x_info->option_bytes.RDP = 0;
 958
 959         if (stm32x_write_options(bank) != ERROR_OK) {
 960                 command_print(CMD_CTX, "%s failed to lock device", bank->driver->name);
 961                 return ERROR_OK;
 962         }
 963
 964         command_print(CMD_CTX, "%s locked", bank->driver->name);
 965
 966         return ERROR_OK;
 967 }
 968
 969 COMMAND_HANDLER(stm32x_handle_unlock_command)
 970 {
 971         struct target *target = NULL;
 972         struct stm32x_flash_bank *stm32x_info = NULL;
 973
 974         if (CMD_ARGC < 1)
 975                 return ERROR_COMMAND_SYNTAX_ERROR;
 976
 977         struct flash_bank *bank;
 978         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 979         if (ERROR_OK != retval)
 980                 return retval;
 981
 982         stm32x_info = bank->driver_priv;
 983         target = bank->target;
 984
 985         if (target->state != TARGET_HALTED) {
 986                 LOG_ERROR("Target not halted");
 987                 return ERROR_TARGET_NOT_HALTED;
 988         }
 989
 990         if (stm32x_read_options(bank) != ERROR_OK) {
 991                 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
 992                 return ERROR_OK;
 993         }
 994
 995         /* clear readout protection and complementary option bytes
 996          * this will also force a device unlock if set */
 997         stm32x_info->option_bytes.RDP = 0xAA;
 998
 999         if (stm32x_write_options(bank) != ERROR_OK) {
1000                 command_print(CMD_CTX, "%s failed to unlock device", bank->driver->name);
1001                 return ERROR_OK;
1002         }
1003
1004         command_print(CMD_CTX, "%s unlocked.\n"
1005                         "INFO: a reset or power cycle is required "
1006                         "for the new settings to take effect.", bank->driver->name);
1007
1008         return ERROR_OK;
1009 }
1010
1011 static int stm32x_mass_erase(struct flash_bank *bank)
1012 {
1013         int retval;
1014         struct target *target = bank->target;
1015         struct stm32x_flash_bank *stm32x_info = NULL;
1016
1017         if (target->state != TARGET_HALTED) {
1018                 LOG_ERROR("Target not halted");
1019                 return ERROR_TARGET_NOT_HALTED;
1020         }
1021
1022         stm32x_info = bank->driver_priv;
1023
1024         retval = stm32x_unlock_reg(target);
1025         if (retval != ERROR_OK)
1026                 return retval;
1027
1028         /* mass erase flash memory */
1029         if (stm32x_info->has_large_mem)
1030                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER | FLASH_MER1);
1031         else
1032                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER);
1033         if (retval != ERROR_OK)
1034                 return retval;
1035         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
1036                 FLASH_MER | FLASH_STRT);
1037         if (retval != ERROR_OK)
1038                 return retval;
1039
1040         retval = stm32x_wait_status_busy(bank, 30000);
1041         if (retval != ERROR_OK)
1042                 return retval;
1043
1044         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
1045         if (retval != ERROR_OK)
1046                 return retval;
1047
1048         return ERROR_OK;
1049 }
1050
1051 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
1052 {
1053         int i;
1054
1055         if (CMD_ARGC < 1) {
1056                 command_print(CMD_CTX, "stm32x mass_erase <bank>");
1057                 return ERROR_COMMAND_SYNTAX_ERROR;
1058         }
1059
1060         struct flash_bank *bank;
1061         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1062         if (ERROR_OK != retval)
1063                 return retval;
1064
1065         retval = stm32x_mass_erase(bank);
1066         if (retval == ERROR_OK) {
1067                 /* set all sectors as erased */
1068                 for (i = 0; i < bank->num_sectors; i++)
1069                         bank->sectors[i].is_erased = 1;
1070
1071                 command_print(CMD_CTX, "stm32x mass erase complete");
1072         } else {
1073                 command_print(CMD_CTX, "stm32x mass erase failed");
1074         }
1075
1076         return retval;
1077 }
1078
1079 static const struct command_registration stm32x_exec_command_handlers[] = {
1080         {
1081                 .name = "lock",
1082                 .handler = stm32x_handle_lock_command,
1083                 .mode = COMMAND_EXEC,
1084                 .usage = "bank_id",
1085                 .help = "Lock entire flash device.",
1086         },
1087         {
1088                 .name = "unlock",
1089                 .handler = stm32x_handle_unlock_command,
1090                 .mode = COMMAND_EXEC,
1091                 .usage = "bank_id",
1092                 .help = "Unlock entire protected flash device.",
1093         },
1094         {
1095                 .name = "mass_erase",
1096                 .handler = stm32x_handle_mass_erase_command,
1097                 .mode = COMMAND_EXEC,
1098                 .usage = "bank_id",
1099                 .help = "Erase entire flash device.",
1100         },
1101         COMMAND_REGISTRATION_DONE
1102 };
1103
1104 static const struct command_registration stm32x_command_handlers[] = {
1105         {
1106                 .name = "stm32f2x",
1107                 .mode = COMMAND_ANY,
1108                 .help = "stm32f2x flash command group",
1109                 .usage = "",
1110                 .chain = stm32x_exec_command_handlers,
1111         },
1112         COMMAND_REGISTRATION_DONE
1113 };
1114
1115 struct flash_driver stm32f2x_flash = {
1116         .name = "stm32f2x",
1117         .commands = stm32x_command_handlers,
1118         .flash_bank_command = stm32x_flash_bank_command,
1119         .erase = stm32x_erase,
1120         .protect = stm32x_protect,
1121         .write = stm32x_write,
1122         .read = default_flash_read,
1123         .probe = stm32x_probe,
1124         .auto_probe = stm32x_auto_probe,
1125         .erase_check = default_flash_blank_check,
1126         .protect_check = stm32x_protect_check,
1127         .info = get_stm32x_info,
1128 };