git.sur5r.net Git - openocd/blob - src/flash/nor/stm32f2x.c

   1 /***************************************************************************
   2  *   Copyright (C) 2005 by Dominic Rath                                    *
   3  *   Dominic.Rath@gmx.de                                                   *
   4  *                                                                         *
   5  *   Copyright (C) 2008 by Spencer Oliver                                  *
   6  *   spen@spen-soft.co.uk                                                  *
   7  *                                                                         *
   8  *   Copyright (C) 2011 Øyvind Harboe                                      *
   9  *   oyvind.harboe@zylin.com                                               *
  10  *                                                                         *
  11  *   This program is free software; you can redistribute it and/or modify  *
  12  *   it under the terms of the GNU General Public License as published by  *
  13  *   the Free Software Foundation; either version 2 of the License, or     *
  14  *   (at your option) any later version.                                   *
  15  *                                                                         *
  16  *   This program is distributed in the hope that it will be useful,       *
  17  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  18  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  19  *   GNU General Public License for more details.                          *
  20  *                                                                         *
  21  *   You should have received a copy of the GNU General Public License     *
  22  *   along with this program; if not, write to the                         *
  23  *   Free Software Foundation, Inc.,                                       *
  24  *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  25  ***************************************************************************/
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include "imp.h"
  32 #include <helper/binarybuffer.h>
  33 #include <target/algorithm.h>
  34 #include <target/armv7m.h>
  35
  36 /* Regarding performance:
  37  *
  38  * Short story - it might be best to leave the performance at
  39  * current levels.
  40  *
  41  * You may see a jump in speed if you change to using
  42  * 32bit words for the block programming.
  43  *
  44  * Its a shame you cannot use the double word as its
  45  * even faster - but you require external VPP for that mode.
  46  *
  47  * Having said all that 16bit writes give us the widest vdd
  48  * operating range, so may be worth adding a note to that effect.
  49  *
  50  */
  51
  52 /* Danger!!!! The STM32F1x and STM32F2x series actually have
  53  * quite different flash controllers.
  54  *
  55  * What's more scary is that the names of the registers and their
  56  * addresses are the same, but the actual bits and what they do are
  57  * can be very different.
  58  *
  59  * To reduce testing complexity and dangers of regressions,
  60  * a seperate file is used for stm32fx2x.
  61  *
  62  * 1mByte part with 4 x 16, 1 x 64, 7 x 128kBytes sectors
  63  *
  64  * What's the protection page size???
  65  *
  66  * Tested with STM3220F-EVAL board.
  67  *
  68  * STM32F21xx series for reference.
  69  *
  70  * RM0033
  71  * http://www.st.com/internet/mcu/product/250192.jsp
  72  *
  73  * PM0059
  74  * www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/
  75  * PROGRAMMING_MANUAL/CD00233952.pdf
  76  *
  77  * STM32F1x series - notice that this code was copy, pasted and knocked
  78  * into a stm32f2x driver, so in case something has been converted or
  79  * bugs haven't been fixed, here are the original manuals:
  80  *
  81  * RM0008 - Reference manual
  82  *
  83  * RM0042, the Flash programming manual for low-, medium- high-density and
  84  * connectivity line STM32F10x devices
  85  *
  86  * PM0068, the Flash programming manual for XL-density STM32F10x devices.
  87  *
  88  */
  89
  90 /* Erase time can be as high as 1000ms, 10x this and it's toast... */
  91 #define FLASH_ERASE_TIMEOUT 10000
  92 #define FLASH_WRITE_TIMEOUT 5
  93
  94 #define STM32_FLASH_BASE    0x40023c00
  95 #define STM32_FLASH_ACR     0x40023c00
  96 #define STM32_FLASH_KEYR    0x40023c04
  97 #define STM32_FLASH_OPTKEYR 0x40023c08
  98 #define STM32_FLASH_SR      0x40023c0C
  99 #define STM32_FLASH_CR      0x40023c10
 100 #define STM32_FLASH_OPTCR   0x40023c14
 101 #define STM32_FLASH_OPTCR1  0x40023c18
 102
 103 /* FLASH_CR register bits */
 104
 105 #define FLASH_PG       (1 << 0)
 106 #define FLASH_SER      (1 << 1)
 107 #define FLASH_MER      (1 << 2)
 108 #define FLASH_MER1     (1 << 15)
 109 #define FLASH_STRT     (1 << 16)
 110 #define FLASH_PSIZE_8  (0 << 8)
 111 #define FLASH_PSIZE_16 (1 << 8)
 112 #define FLASH_PSIZE_32 (2 << 8)
 113 #define FLASH_PSIZE_64 (3 << 8)
 114 #define FLASH_SNB(a)   ((a) << 3)
 115 #define FLASH_LOCK     (1 << 31)
 116
 117 /* FLASH_SR register bits */
 118
 119 #define FLASH_BSY      (1 << 16)
 120 #define FLASH_PGSERR   (1 << 7) /* Programming sequence error */
 121 #define FLASH_PGPERR   (1 << 6) /* Programming parallelism error */
 122 #define FLASH_PGAERR   (1 << 5) /* Programming alignment error */
 123 #define FLASH_WRPERR   (1 << 4) /* Write protection error */
 124 #define FLASH_OPERR    (1 << 1) /* Operation error */
 125
 126 #define FLASH_ERROR (FLASH_PGSERR | FLASH_PGPERR | FLASH_PGAERR | FLASH_WRPERR | FLASH_OPERR)
 127
 128 /* STM32_FLASH_OPTCR register bits */
 129
 130 #define OPT_LOCK      (1 << 0)
 131 #define OPT_START     (1 << 1)
 132
 133 /* STM32_FLASH_OBR bit definitions (reading) */
 134
 135 #define OPT_ERROR      0
 136 #define OPT_READOUT    1
 137 #define OPT_RDWDGSW    2
 138 #define OPT_RDRSTSTOP  3
 139 #define OPT_RDRSTSTDBY 4
 140 #define OPT_BFB2       5        /* dual flash bank only */
 141
 142 /* register unlock keys */
 143
 144 #define KEY1           0x45670123
 145 #define KEY2           0xCDEF89AB
 146
 147 /* option register unlock key */
 148 #define OPTKEY1        0x08192A3B
 149 #define OPTKEY2        0x4C5D6E7F
 150
 151 struct stm32x_options {
 152         uint8_t RDP;
 153         uint8_t user_options;
 154         uint32_t protection;
 155 };
 156
 157 struct stm32x_flash_bank {
 158         struct stm32x_options option_bytes;
 159         int probed;
 160         bool has_large_mem;             /* stm32f42x/stm32f43x family */
 161 };
 162
 163 /* flash bank stm32x <base> <size> 0 0 <target#>
 164  */
 165 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
 166 {
 167         struct stm32x_flash_bank *stm32x_info;
 168
 169         if (CMD_ARGC < 6)
 170                 return ERROR_COMMAND_SYNTAX_ERROR;
 171
 172         stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
 173         bank->driver_priv = stm32x_info;
 174
 175         stm32x_info->probed = 0;
 176
 177         return ERROR_OK;
 178 }
 179
 180 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
 181 {
 182         return reg;
 183 }
 184
 185 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
 186 {
 187         struct target *target = bank->target;
 188         return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
 189 }
 190
 191 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
 192 {
 193         struct target *target = bank->target;
 194         uint32_t status;
 195         int retval = ERROR_OK;
 196
 197         /* wait for busy to clear */
 198         for (;;) {
 199                 retval = stm32x_get_flash_status(bank, &status);
 200                 if (retval != ERROR_OK)
 201                         return retval;
 202                 LOG_DEBUG("status: 0x%" PRIx32 "", status);
 203                 if ((status & FLASH_BSY) == 0)
 204                         break;
 205                 if (timeout-- <= 0) {
 206                         LOG_ERROR("timed out waiting for flash");
 207                         return ERROR_FAIL;
 208                 }
 209                 alive_sleep(1);
 210         }
 211
 212
 213         if (status & FLASH_WRPERR) {
 214                 LOG_ERROR("stm32x device protected");
 215                 retval = ERROR_FAIL;
 216         }
 217
 218         /* Clear but report errors */
 219         if (status & FLASH_ERROR) {
 220                 /* If this operation fails, we ignore it and report the original
 221                  * retval
 222                  */
 223                 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
 224                                 status & FLASH_ERROR);
 225         }
 226         return retval;
 227 }
 228
 229 static int stm32x_unlock_reg(struct target *target)
 230 {
 231         uint32_t ctrl;
 232
 233         /* first check if not already unlocked
 234          * otherwise writing on STM32_FLASH_KEYR will fail
 235          */
 236         int retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
 237         if (retval != ERROR_OK)
 238                 return retval;
 239
 240         if ((ctrl & FLASH_LOCK) == 0)
 241                 return ERROR_OK;
 242
 243         /* unlock flash registers */
 244         retval = target_write_u32(target, STM32_FLASH_KEYR, KEY1);
 245         if (retval != ERROR_OK)
 246                 return retval;
 247
 248         retval = target_write_u32(target, STM32_FLASH_KEYR, KEY2);
 249         if (retval != ERROR_OK)
 250                 return retval;
 251
 252         retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
 253         if (retval != ERROR_OK)
 254                 return retval;
 255
 256         if (ctrl & FLASH_LOCK) {
 257                 LOG_ERROR("flash not unlocked STM32_FLASH_CR: %x", ctrl);
 258                 return ERROR_TARGET_FAILURE;
 259         }
 260
 261         return ERROR_OK;
 262 }
 263
 264 static int stm32x_unlock_option_reg(struct target *target)
 265 {
 266         uint32_t ctrl;
 267
 268         int retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
 269         if (retval != ERROR_OK)
 270                 return retval;
 271
 272         if ((ctrl & OPT_LOCK) == 0)
 273                 return ERROR_OK;
 274
 275         /* unlock option registers */
 276         retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY1);
 277         if (retval != ERROR_OK)
 278                 return retval;
 279
 280         retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY2);
 281         if (retval != ERROR_OK)
 282                 return retval;
 283
 284         retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
 285         if (retval != ERROR_OK)
 286                 return retval;
 287
 288         if (ctrl & OPT_LOCK) {
 289                 LOG_ERROR("options not unlocked STM32_FLASH_OPTCR: %x", ctrl);
 290                 return ERROR_TARGET_FAILURE;
 291         }
 292
 293         return ERROR_OK;
 294 }
 295
 296 static int stm32x_read_options(struct flash_bank *bank)
 297 {
 298         uint32_t optiondata;
 299         struct stm32x_flash_bank *stm32x_info = NULL;
 300         struct target *target = bank->target;
 301
 302         stm32x_info = bank->driver_priv;
 303
 304         /* read current option bytes */
 305         int retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
 306         if (retval != ERROR_OK)
 307                 return retval;
 308
 309         stm32x_info->option_bytes.user_options = optiondata & 0xec;
 310         stm32x_info->option_bytes.RDP = (optiondata >> 8) & 0xff;
 311         stm32x_info->option_bytes.protection = (optiondata >> 16) & 0xfff;
 312
 313         if (stm32x_info->has_large_mem) {
 314
 315                 retval = target_read_u32(target, STM32_FLASH_OPTCR1, &optiondata);
 316                 if (retval != ERROR_OK)
 317                         return retval;
 318
 319                 /* append protection bits */
 320                 stm32x_info->option_bytes.protection |= (optiondata >> 4) & 0x00fff000;
 321         }
 322
 323         if (stm32x_info->option_bytes.RDP != 0xAA)
 324                 LOG_INFO("Device Security Bit Set");
 325
 326         return ERROR_OK;
 327 }
 328
 329 static int stm32x_write_options(struct flash_bank *bank)
 330 {
 331         struct stm32x_flash_bank *stm32x_info = NULL;
 332         struct target *target = bank->target;
 333         uint32_t optiondata;
 334
 335         stm32x_info = bank->driver_priv;
 336
 337         int retval = stm32x_unlock_option_reg(target);
 338         if (retval != ERROR_OK)
 339                 return retval;
 340
 341         /* rebuild option data */
 342         optiondata = stm32x_info->option_bytes.user_options;
 343         buf_set_u32(&optiondata, 8, 8, stm32x_info->option_bytes.RDP);
 344         buf_set_u32(&optiondata, 16, 12, stm32x_info->option_bytes.protection);
 345
 346         /* program options */
 347         retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata);
 348         if (retval != ERROR_OK)
 349                 return retval;
 350
 351         if (stm32x_info->has_large_mem) {
 352
 353                 uint32_t optiondata2 = 0;
 354                 buf_set_u32(&optiondata2, 16, 12, stm32x_info->option_bytes.protection >> 12);
 355                 retval = target_write_u32(target, STM32_FLASH_OPTCR1, optiondata2);
 356                 if (retval != ERROR_OK)
 357                         return retval;
 358         }
 359
 360         /* start programming cycle */
 361         retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPT_START);
 362         if (retval != ERROR_OK)
 363                 return retval;
 364
 365         /* wait for completion */
 366         retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
 367         if (retval != ERROR_OK)
 368                 return retval;
 369
 370         /* relock registers */
 371         retval = target_write_u32(target, STM32_FLASH_OPTCR, OPT_LOCK);
 372         if (retval != ERROR_OK)
 373                 return retval;
 374
 375         return ERROR_OK;
 376 }
 377
 378 static int stm32x_protect_check(struct flash_bank *bank)
 379 {
 380         return ERROR_OK;
 381 }
 382
 383 static int stm32x_erase(struct flash_bank *bank, int first, int last)
 384 {
 385         struct target *target = bank->target;
 386         int i;
 387
 388         if (bank->target->state != TARGET_HALTED) {
 389                 LOG_ERROR("Target not halted");
 390                 return ERROR_TARGET_NOT_HALTED;
 391         }
 392
 393         int retval;
 394         retval = stm32x_unlock_reg(target);
 395         if (retval != ERROR_OK)
 396                 return retval;
 397
 398         /*
 399         Sector Erase
 400         To erase a sector, follow the procedure below:
 401         1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
 402           FLASH_SR register
 403         2. Set the SER bit and select the sector (out of the 12 sectors in the main memory block)
 404           you wish to erase (SNB) in the FLASH_CR register
 405         3. Set the STRT bit in the FLASH_CR register
 406         4. Wait for the BSY bit to be cleared
 407          */
 408
 409         for (i = first; i <= last; i++) {
 410                 retval = target_write_u32(target,
 411                                 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_SER | FLASH_SNB(i) | FLASH_STRT);
 412                 if (retval != ERROR_OK)
 413                         return retval;
 414
 415                 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
 416                 if (retval != ERROR_OK)
 417                         return retval;
 418
 419                 bank->sectors[i].is_erased = 1;
 420         }
 421
 422         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
 423         if (retval != ERROR_OK)
 424                 return retval;
 425
 426         return ERROR_OK;
 427 }
 428
 429 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
 430 {
 431         return ERROR_OK;
 432 }
 433
 434 static int stm32x_write_block(struct flash_bank *bank, uint8_t *buffer,
 435                 uint32_t offset, uint32_t count)
 436 {
 437         struct target *target = bank->target;
 438         uint32_t buffer_size = 16384;
 439         struct working_area *write_algorithm;
 440         struct working_area *source;
 441         uint32_t address = bank->base + offset;
 442         struct reg_param reg_params[5];
 443         struct armv7m_algorithm armv7m_info;
 444         int retval = ERROR_OK;
 445
 446         /* see contrib/loaders/flash/stm32f2x.S for src */
 447
 448         static const uint8_t stm32x_flash_write_code[] = {
 449                                                                         /* wait_fifo: */
 450                 0xD0, 0xF8, 0x00, 0x80,         /* ldr          r8, [r0, #0] */
 451                 0xB8, 0xF1, 0x00, 0x0F,         /* cmp          r8, #0 */
 452                 0x1A, 0xD0,                                     /* beq          exit */
 453                 0x47, 0x68,                                     /* ldr          r7, [r0, #4] */
 454                 0x47, 0x45,                                     /* cmp          r7, r8 */
 455                 0xF7, 0xD0,                                     /* beq          wait_fifo */
 456
 457                 0xDF, 0xF8, 0x30, 0x60,         /* ldr          r6, STM32_PROG16 */
 458                 0x26, 0x61,                                     /* str          r6, [r4, #STM32_FLASH_CR_OFFSET] */
 459                 0x37, 0xF8, 0x02, 0x6B,         /* ldrh         r6, [r7], #0x02 */
 460                 0x22, 0xF8, 0x02, 0x6B,         /* strh         r6, [r2], #0x02 */
 461                                                                         /* busy: */
 462                 0xE6, 0x68,                                     /* ldr          r6, [r4, #STM32_FLASH_SR_OFFSET] */
 463                 0x16, 0xF4, 0x80, 0x3F,         /* tst          r6, #0x10000 */
 464                 0xFB, 0xD1,                                     /* bne          busy */
 465                 0x16, 0xF0, 0xF0, 0x0F,         /* tst          r6, #0xf0 */
 466                 0x07, 0xD1,                                     /* bne          error */
 467
 468                 0x8F, 0x42,                                     /* cmp          r7, r1 */
 469                 0x28, 0xBF,                                     /* it           cs */
 470                 0x00, 0xF1, 0x08, 0x07,         /* addcs        r7, r0, #8 */
 471                 0x47, 0x60,                                     /* str          r7, [r0, #4] */
 472                 0x01, 0x3B,                                     /* subs         r3, r3, #1 */
 473                 0x13, 0xB1,                                     /* cbz          r3, exit */
 474                 0xE1, 0xE7,                                     /* b            wait_fifo */
 475                                                                         /* error: */
 476                 0x00, 0x21,                                     /* movs         r1, #0 */
 477                 0x41, 0x60,                                     /* str          r1, [r0, #4] */
 478                                                                         /* exit: */
 479                 0x30, 0x46,                                     /* mov          r0, r6 */
 480                 0x00, 0xBE,                                     /* bkpt         #0x00 */
 481
 482                 /* <STM32_PROG16>: */
 483                 0x01, 0x01, 0x00, 0x00,         /* .word        0x00000101 */
 484         };
 485
 486         if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
 487                         &write_algorithm) != ERROR_OK) {
 488                 LOG_WARNING("no working area available, can't do block memory writes");
 489                 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
 490         };
 491
 492         retval = target_write_buffer(target, write_algorithm->address,
 493                         sizeof(stm32x_flash_write_code),
 494                         (uint8_t *)stm32x_flash_write_code);
 495         if (retval != ERROR_OK)
 496                 return retval;
 497
 498         /* memory buffer */
 499         while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
 500                 buffer_size /= 2;
 501                 if (buffer_size <= 256) {
 502                         /* we already allocated the writing code, but failed to get a
 503                          * buffer, free the algorithm */
 504                         target_free_working_area(target, write_algorithm);
 505
 506                         LOG_WARNING("no large enough working area available, can't do block memory writes");
 507                         return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
 508                 }
 509         };
 510
 511         armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
 512         armv7m_info.core_mode = ARMV7M_MODE_ANY;
 513
 514         init_reg_param(&reg_params[0], "r0", 32, PARAM_IN_OUT);         /* buffer start, status (out) */
 515         init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);            /* buffer end */
 516         init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);            /* target address */
 517         init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);            /* count (halfword-16bit) */
 518         init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT);            /* flash base */
 519
 520         buf_set_u32(reg_params[0].value, 0, 32, source->address);
 521         buf_set_u32(reg_params[1].value, 0, 32, source->address + source->size);
 522         buf_set_u32(reg_params[2].value, 0, 32, address);
 523         buf_set_u32(reg_params[3].value, 0, 32, count);
 524         buf_set_u32(reg_params[4].value, 0, 32, STM32_FLASH_BASE);
 525
 526         retval = target_run_flash_async_algorithm(target, buffer, count, 2,
 527                         0, NULL,
 528                         5, reg_params,
 529                         source->address, source->size,
 530                         write_algorithm->address, 0,
 531                         &armv7m_info);
 532
 533         if (retval == ERROR_FLASH_OPERATION_FAILED) {
 534                 LOG_ERROR("error executing stm32x flash write algorithm");
 535
 536                 uint32_t error = buf_get_u32(reg_params[0].value, 0, 32) & FLASH_ERROR;
 537
 538                 if (error & FLASH_WRPERR)
 539                         LOG_ERROR("flash memory write protected");
 540
 541                 if (error != 0) {
 542                         LOG_ERROR("flash write failed = %08x", error);
 543                         /* Clear but report errors */
 544                         target_write_u32(target, STM32_FLASH_SR, error);
 545                         retval = ERROR_FAIL;
 546                 }
 547         }
 548
 549         target_free_working_area(target, source);
 550         target_free_working_area(target, write_algorithm);
 551
 552         destroy_reg_param(&reg_params[0]);
 553         destroy_reg_param(&reg_params[1]);
 554         destroy_reg_param(&reg_params[2]);
 555         destroy_reg_param(&reg_params[3]);
 556         destroy_reg_param(&reg_params[4]);
 557
 558         return retval;
 559 }
 560
 561 static int stm32x_write(struct flash_bank *bank, uint8_t *buffer,
 562                 uint32_t offset, uint32_t count)
 563 {
 564         struct target *target = bank->target;
 565         uint32_t words_remaining = (count / 2);
 566         uint32_t bytes_remaining = (count & 0x00000001);
 567         uint32_t address = bank->base + offset;
 568         uint32_t bytes_written = 0;
 569         int retval;
 570
 571         if (bank->target->state != TARGET_HALTED) {
 572                 LOG_ERROR("Target not halted");
 573                 return ERROR_TARGET_NOT_HALTED;
 574         }
 575
 576         if (offset & 0x1) {
 577                 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
 578                 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
 579         }
 580
 581         retval = stm32x_unlock_reg(target);
 582         if (retval != ERROR_OK)
 583                 return retval;
 584
 585         /* multiple half words (2-byte) to be programmed? */
 586         if (words_remaining > 0) {
 587                 /* try using a block write */
 588                 retval = stm32x_write_block(bank, buffer, offset, words_remaining);
 589                 if (retval != ERROR_OK) {
 590                         if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
 591                                 /* if block write failed (no sufficient working area),
 592                                  * we use normal (slow) single dword accesses */
 593                                 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
 594                         }
 595                 } else {
 596                         buffer += words_remaining * 2;
 597                         address += words_remaining * 2;
 598                         words_remaining = 0;
 599                 }
 600         }
 601
 602         if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
 603                 return retval;
 604
 605         /*
 606         Standard programming
 607         The Flash memory programming sequence is as follows:
 608         1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
 609           FLASH_SR register.
 610         2. Set the PG bit in the FLASH_CR register
 611         3. Perform the data write operation(s) to the desired memory address (inside main
 612           memory block or OTP area):
 613         – – Half-word access in case of x16 parallelism
 614         – Word access in case of x32 parallelism
 615         –
 616         4.
 617         Byte access in case of x8 parallelism
 618         Double word access in case of x64 parallelism
 619         Wait for the BSY bit to be cleared
 620         */
 621         while (words_remaining > 0) {
 622                 uint16_t value;
 623                 memcpy(&value, buffer + bytes_written, sizeof(uint16_t));
 624
 625                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
 626                                 FLASH_PG | FLASH_PSIZE_16);
 627                 if (retval != ERROR_OK)
 628                         return retval;
 629
 630                 retval = target_write_u16(target, address, value);
 631                 if (retval != ERROR_OK)
 632                         return retval;
 633
 634                 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
 635                 if (retval != ERROR_OK)
 636                         return retval;
 637
 638                 bytes_written += 2;
 639                 words_remaining--;
 640                 address += 2;
 641         }
 642
 643         if (bytes_remaining) {
 644                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
 645                                 FLASH_PG | FLASH_PSIZE_8);
 646                 if (retval != ERROR_OK)
 647                         return retval;
 648                 retval = target_write_u8(target, address, buffer[bytes_written]);
 649                 if (retval != ERROR_OK)
 650                         return retval;
 651
 652                 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
 653                 if (retval != ERROR_OK)
 654                         return retval;
 655         }
 656
 657         return target_write_u32(target, STM32_FLASH_CR, FLASH_LOCK);
 658 }
 659
 660 static void setup_sector(struct flash_bank *bank, int start, int num, int size)
 661 {
 662         for (int i = start; i < (start + num) ; i++) {
 663                 bank->sectors[i].offset = bank->size;
 664                 bank->sectors[i].size = size;
 665                 bank->size += bank->sectors[i].size;
 666         }
 667 }
 668
 669 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
 670 {
 671         /* this checks for a stm32f4x errata issue where a
 672          * stm32f2x DBGMCU_IDCODE is incorrectly returned.
 673          * If the issue is detected target is forced to stm32f4x Rev A.
 674          * Only effects Rev A silicon */
 675
 676         struct target *target = bank->target;
 677         uint32_t cpuid;
 678
 679         /* read stm32 device id register */
 680         int retval = target_read_u32(target, 0xE0042000, device_id);
 681         if (retval != ERROR_OK)
 682                 return retval;
 683
 684         if ((*device_id & 0xfff) == 0x411) {
 685                 /* read CPUID reg to check core type */
 686                 retval = target_read_u32(target, 0xE000ED00, &cpuid);
 687                 if (retval != ERROR_OK)
 688                         return retval;
 689
 690                 /* check for cortex_m4 */
 691                 if (((cpuid >> 4) & 0xFFF) == 0xC24) {
 692                         *device_id &= ~((0xFFFF << 16) | 0xfff);
 693                         *device_id |= (0x1000 << 16) | 0x413;
 694                         LOG_INFO("stm32f4x errata detected - fixing incorrect MCU_IDCODE");
 695                 }
 696         }
 697         return retval;
 698 }
 699
 700 static int stm32x_probe(struct flash_bank *bank)
 701 {
 702         struct target *target = bank->target;
 703         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 704         int i;
 705         uint16_t flash_size_in_kb;
 706         uint16_t max_flash_size_in_kb;
 707         uint32_t device_id;
 708         uint32_t base_address = 0x08000000;
 709
 710         stm32x_info->probed = 0;
 711         stm32x_info->has_large_mem = false;
 712
 713         /* read stm32 device id register */
 714         int retval = stm32x_get_device_id(bank, &device_id);
 715         if (retval != ERROR_OK)
 716                 return retval;
 717         LOG_INFO("device id = 0x%08" PRIx32 "", device_id);
 718
 719         /* set max flash size depending on family */
 720         switch (device_id & 0xfff) {
 721         case 0x411:
 722         case 0x413:
 723                 max_flash_size_in_kb = 1024;
 724                 break;
 725         case 0x419:
 726                 max_flash_size_in_kb = 2048;
 727                 stm32x_info->has_large_mem = true;
 728                 break;
 729         default:
 730                 LOG_WARNING("Cannot identify target as a STM32 family.");
 731                 return ERROR_FAIL;
 732         }
 733
 734         /* get flash size from target. */
 735         retval = target_read_u16(target, 0x1FFF7A22, &flash_size_in_kb);
 736
 737         /* failed reading flash size or flash size invalid (early silicon),
 738          * default to max target family */
 739         if (retval != ERROR_OK || flash_size_in_kb == 0xffff || flash_size_in_kb == 0) {
 740                 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming %dk flash",
 741                         max_flash_size_in_kb);
 742                 flash_size_in_kb = max_flash_size_in_kb;
 743         }
 744
 745         LOG_INFO("flash size = %dkbytes", flash_size_in_kb);
 746
 747         /* did we assign flash size? */
 748         assert(flash_size_in_kb != 0xffff);
 749
 750         /* calculate numbers of pages */
 751         int num_pages = (flash_size_in_kb / 128) + 4;
 752
 753         /* check for larger 2048 bytes devices */
 754         if (stm32x_info->has_large_mem)
 755                 num_pages += 4;
 756
 757         /* check that calculation result makes sense */
 758         assert(num_pages > 0);
 759
 760         if (bank->sectors) {
 761                 free(bank->sectors);
 762                 bank->sectors = NULL;
 763         }
 764
 765         bank->base = base_address;
 766         bank->num_sectors = num_pages;
 767         bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
 768         bank->size = 0;
 769
 770         /* fixed memory */
 771         setup_sector(bank, 0, 4, 16 * 1024);
 772         setup_sector(bank, 4, 1, 64 * 1024);
 773
 774         /* dynamic memory */
 775         setup_sector(bank, 4 + 1, MAX(12, num_pages) - 5, 128 * 1024);
 776
 777         if (stm32x_info->has_large_mem) {
 778
 779                 /* fixed memory for larger devices */
 780                 setup_sector(bank, 12, 4, 16 * 1024);
 781                 setup_sector(bank, 16, 1, 64 * 1024);
 782
 783                 /* dynamic memory for larger devices */
 784                 setup_sector(bank, 16 + 1, num_pages - 5 - 12, 128 * 1024);
 785         }
 786
 787         for (i = 0; i < num_pages; i++) {
 788                 bank->sectors[i].is_erased = -1;
 789                 bank->sectors[i].is_protected = 0;
 790         }
 791
 792         stm32x_info->probed = 1;
 793
 794         return ERROR_OK;
 795 }
 796
 797 static int stm32x_auto_probe(struct flash_bank *bank)
 798 {
 799         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 800         if (stm32x_info->probed)
 801                 return ERROR_OK;
 802         return stm32x_probe(bank);
 803 }
 804
 805 static int get_stm32x_info(struct flash_bank *bank, char *buf, int buf_size)
 806 {
 807         uint32_t device_id;
 808         int printed;
 809
 810         /* read stm32 device id register */
 811         int retval = stm32x_get_device_id(bank, &device_id);
 812         if (retval != ERROR_OK)
 813                 return retval;
 814
 815         if ((device_id & 0xfff) == 0x411) {
 816                 printed = snprintf(buf, buf_size, "stm32f2x - Rev: ");
 817                 buf += printed;
 818                 buf_size -= printed;
 819
 820                 switch (device_id >> 16) {
 821                         case 0x1000:
 822                                 snprintf(buf, buf_size, "A");
 823                                 break;
 824
 825                         case 0x2000:
 826                                 snprintf(buf, buf_size, "B");
 827                                 break;
 828
 829                         case 0x1001:
 830                                 snprintf(buf, buf_size, "Z");
 831                                 break;
 832
 833                         case 0x2001:
 834                                 snprintf(buf, buf_size, "Y");
 835                                 break;
 836
 837                         case 0x2003:
 838                                 snprintf(buf, buf_size, "X");
 839                                 break;
 840
 841                         default:
 842                                 snprintf(buf, buf_size, "unknown");
 843                                 break;
 844                 }
 845         } else if (((device_id & 0xfff) == 0x413) ||
 846                         ((device_id & 0xfff) == 0x419)) {
 847                 printed = snprintf(buf, buf_size, "stm32f4x - Rev: ");
 848                 buf += printed;
 849                 buf_size -= printed;
 850
 851                 switch (device_id >> 16) {
 852                         case 0x1000:
 853                                 snprintf(buf, buf_size, "A");
 854                                 break;
 855
 856                         case 0x1001:
 857                                 snprintf(buf, buf_size, "Z");
 858                                 break;
 859
 860                         default:
 861                                 snprintf(buf, buf_size, "unknown");
 862                                 break;
 863                 }
 864         } else {
 865                 snprintf(buf, buf_size, "Cannot identify target as a stm32x\n");
 866                 return ERROR_FAIL;
 867         }
 868
 869         return ERROR_OK;
 870 }
 871
 872 COMMAND_HANDLER(stm32x_handle_lock_command)
 873 {
 874         struct target *target = NULL;
 875         struct stm32x_flash_bank *stm32x_info = NULL;
 876
 877         if (CMD_ARGC < 1)
 878                 return ERROR_COMMAND_SYNTAX_ERROR;
 879
 880         struct flash_bank *bank;
 881         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 882         if (ERROR_OK != retval)
 883                 return retval;
 884
 885         stm32x_info = bank->driver_priv;
 886         target = bank->target;
 887
 888         if (target->state != TARGET_HALTED) {
 889                 LOG_ERROR("Target not halted");
 890                 return ERROR_TARGET_NOT_HALTED;
 891         }
 892
 893         if (stm32x_read_options(bank) != ERROR_OK) {
 894                 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
 895                 return ERROR_OK;
 896         }
 897
 898         /* set readout protection */
 899         stm32x_info->option_bytes.RDP = 0;
 900
 901         if (stm32x_write_options(bank) != ERROR_OK) {
 902                 command_print(CMD_CTX, "%s failed to lock device", bank->driver->name);
 903                 return ERROR_OK;
 904         }
 905
 906         command_print(CMD_CTX, "%s locked", bank->driver->name);
 907
 908         return ERROR_OK;
 909 }
 910
 911 COMMAND_HANDLER(stm32x_handle_unlock_command)
 912 {
 913         struct target *target = NULL;
 914         struct stm32x_flash_bank *stm32x_info = NULL;
 915
 916         if (CMD_ARGC < 1)
 917                 return ERROR_COMMAND_SYNTAX_ERROR;
 918
 919         struct flash_bank *bank;
 920         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 921         if (ERROR_OK != retval)
 922                 return retval;
 923
 924         stm32x_info = bank->driver_priv;
 925         target = bank->target;
 926
 927         if (target->state != TARGET_HALTED) {
 928                 LOG_ERROR("Target not halted");
 929                 return ERROR_TARGET_NOT_HALTED;
 930         }
 931
 932         if (stm32x_read_options(bank) != ERROR_OK) {
 933                 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
 934                 return ERROR_OK;
 935         }
 936
 937         /* clear readout protection and complementary option bytes
 938          * this will also force a device unlock if set */
 939         stm32x_info->option_bytes.RDP = 0xAA;
 940
 941         if (stm32x_write_options(bank) != ERROR_OK) {
 942                 command_print(CMD_CTX, "%s failed to unlock device", bank->driver->name);
 943                 return ERROR_OK;
 944         }
 945
 946         command_print(CMD_CTX, "%s unlocked.\n"
 947                         "INFO: a reset or power cycle is required "
 948                         "for the new settings to take effect.", bank->driver->name);
 949
 950         return ERROR_OK;
 951 }
 952
 953 static int stm32x_mass_erase(struct flash_bank *bank)
 954 {
 955         int retval;
 956         struct target *target = bank->target;
 957         struct stm32x_flash_bank *stm32x_info = NULL;
 958
 959         if (target->state != TARGET_HALTED) {
 960                 LOG_ERROR("Target not halted");
 961                 return ERROR_TARGET_NOT_HALTED;
 962         }
 963
 964         stm32x_info = bank->driver_priv;
 965
 966         retval = stm32x_unlock_reg(target);
 967         if (retval != ERROR_OK)
 968                 return retval;
 969
 970         /* mass erase flash memory */
 971         if (stm32x_info->has_large_mem)
 972                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER | FLASH_MER1);
 973         else
 974                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER);
 975         if (retval != ERROR_OK)
 976                 return retval;
 977         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
 978                 FLASH_MER | FLASH_STRT);
 979         if (retval != ERROR_OK)
 980                 return retval;
 981
 982         retval = stm32x_wait_status_busy(bank, 30000);
 983         if (retval != ERROR_OK)
 984                 return retval;
 985
 986         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
 987         if (retval != ERROR_OK)
 988                 return retval;
 989
 990         return ERROR_OK;
 991 }
 992
 993 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
 994 {
 995         int i;
 996
 997         if (CMD_ARGC < 1) {
 998                 command_print(CMD_CTX, "stm32x mass_erase <bank>");
 999                 return ERROR_COMMAND_SYNTAX_ERROR;
1000         }
1001
1002         struct flash_bank *bank;
1003         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1004         if (ERROR_OK != retval)
1005                 return retval;
1006
1007         retval = stm32x_mass_erase(bank);
1008         if (retval == ERROR_OK) {
1009                 /* set all sectors as erased */
1010                 for (i = 0; i < bank->num_sectors; i++)
1011                         bank->sectors[i].is_erased = 1;
1012
1013                 command_print(CMD_CTX, "stm32x mass erase complete");
1014         } else {
1015                 command_print(CMD_CTX, "stm32x mass erase failed");
1016         }
1017
1018         return retval;
1019 }
1020
1021 static const struct command_registration stm32x_exec_command_handlers[] = {
1022         {
1023                 .name = "lock",
1024                 .handler = stm32x_handle_lock_command,
1025                 .mode = COMMAND_EXEC,
1026                 .usage = "bank_id",
1027                 .help = "Lock entire flash device.",
1028         },
1029         {
1030                 .name = "unlock",
1031                 .handler = stm32x_handle_unlock_command,
1032                 .mode = COMMAND_EXEC,
1033                 .usage = "bank_id",
1034                 .help = "Unlock entire protected flash device.",
1035         },
1036         {
1037                 .name = "mass_erase",
1038                 .handler = stm32x_handle_mass_erase_command,
1039                 .mode = COMMAND_EXEC,
1040                 .usage = "bank_id",
1041                 .help = "Erase entire flash device.",
1042         },
1043         COMMAND_REGISTRATION_DONE
1044 };
1045
1046 static const struct command_registration stm32x_command_handlers[] = {
1047         {
1048                 .name = "stm32f2x",
1049                 .mode = COMMAND_ANY,
1050                 .help = "stm32f2x flash command group",
1051                 .usage = "",
1052                 .chain = stm32x_exec_command_handlers,
1053         },
1054         COMMAND_REGISTRATION_DONE
1055 };
1056
1057 struct flash_driver stm32f2x_flash = {
1058         .name = "stm32f2x",
1059         .commands = stm32x_command_handlers,
1060         .flash_bank_command = stm32x_flash_bank_command,
1061         .erase = stm32x_erase,
1062         .protect = stm32x_protect,
1063         .write = stm32x_write,
1064         .read = default_flash_read,
1065         .probe = stm32x_probe,
1066         .auto_probe = stm32x_auto_probe,
1067         .erase_check = default_flash_blank_check,
1068         .protect_check = stm32x_protect_check,
1069         .info = get_stm32x_info,
1070 };