git.sur5r.net Git - openocd/blob - src/flash/nor/stm32f2x.c

   1 /***************************************************************************
   2  *   Copyright (C) 2005 by Dominic Rath                                    *
   3  *   Dominic.Rath@gmx.de                                                   *
   4  *                                                                         *
   5  *   Copyright (C) 2008 by Spencer Oliver                                  *
   6  *   spen@spen-soft.co.uk                                                  *
   7  *                                                                         *
   8  *   Copyright (C) 2011 Øyvind Harboe                                      *
   9  *   oyvind.harboe@zylin.com                                               *
  10  *                                                                         *
  11  *   This program is free software; you can redistribute it and/or modify  *
  12  *   it under the terms of the GNU General Public License as published by  *
  13  *   the Free Software Foundation; either version 2 of the License, or     *
  14  *   (at your option) any later version.                                   *
  15  *                                                                         *
  16  *   This program is distributed in the hope that it will be useful,       *
  17  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  18  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  19  *   GNU General Public License for more details.                          *
  20  *                                                                         *
  21  *   You should have received a copy of the GNU General Public License     *
  22  *   along with this program; if not, write to the                         *
  23  *   Free Software Foundation, Inc.,                                       *
  24  *   51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.           *
  25  ***************************************************************************/
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include "imp.h"
  32 #include <helper/binarybuffer.h>
  33 #include <target/algorithm.h>
  34 #include <target/armv7m.h>
  35
  36 /* Regarding performance:
  37  *
  38  * Short story - it might be best to leave the performance at
  39  * current levels.
  40  *
  41  * You may see a jump in speed if you change to using
  42  * 32bit words for the block programming.
  43  *
  44  * Its a shame you cannot use the double word as its
  45  * even faster - but you require external VPP for that mode.
  46  *
  47  * Having said all that 16bit writes give us the widest vdd
  48  * operating range, so may be worth adding a note to that effect.
  49  *
  50  */
  51
  52 /* Danger!!!! The STM32F1x and STM32F2x series actually have
  53  * quite different flash controllers.
  54  *
  55  * What's more scary is that the names of the registers and their
  56  * addresses are the same, but the actual bits and what they do are
  57  * can be very different.
  58  *
  59  * To reduce testing complexity and dangers of regressions,
  60  * a seperate file is used for stm32fx2x.
  61  *
  62  * 1mByte part with 4 x 16, 1 x 64, 7 x 128kBytes sectors
  63  *
  64  * What's the protection page size???
  65  *
  66  * Tested with STM3220F-EVAL board.
  67  *
  68  * STM32F21xx series for reference.
  69  *
  70  * RM0033
  71  * http://www.st.com/internet/mcu/product/250192.jsp
  72  *
  73  * PM0059
  74  * www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/
  75  * PROGRAMMING_MANUAL/CD00233952.pdf
  76  *
  77  * STM32F1x series - notice that this code was copy, pasted and knocked
  78  * into a stm32f2x driver, so in case something has been converted or
  79  * bugs haven't been fixed, here are the original manuals:
  80  *
  81  * RM0008 - Reference manual
  82  *
  83  * RM0042, the Flash programming manual for low-, medium- high-density and
  84  * connectivity line STM32F10x devices
  85  *
  86  * PM0068, the Flash programming manual for XL-density STM32F10x devices.
  87  *
  88  */
  89
  90 /* Erase time can be as high as 1000ms, 10x this and it's toast... */
  91 #define FLASH_ERASE_TIMEOUT 10000
  92 #define FLASH_WRITE_TIMEOUT 5
  93
  94 #define STM32_FLASH_BASE    0x40023c00
  95 #define STM32_FLASH_ACR     0x40023c00
  96 #define STM32_FLASH_KEYR    0x40023c04
  97 #define STM32_FLASH_OPTKEYR 0x40023c08
  98 #define STM32_FLASH_SR      0x40023c0C
  99 #define STM32_FLASH_CR      0x40023c10
 100 #define STM32_FLASH_OPTCR   0x40023c14
 101 #define STM32_FLASH_OPTCR1  0x40023c18
 102
 103 /* FLASH_CR register bits */
 104
 105 #define FLASH_PG       (1 << 0)
 106 #define FLASH_SER      (1 << 1)
 107 #define FLASH_MER      (1 << 2)
 108 #define FLASH_MER1     (1 << 15)
 109 #define FLASH_STRT     (1 << 16)
 110 #define FLASH_PSIZE_8  (0 << 8)
 111 #define FLASH_PSIZE_16 (1 << 8)
 112 #define FLASH_PSIZE_32 (2 << 8)
 113 #define FLASH_PSIZE_64 (3 << 8)
 114 #define FLASH_SNB(a)   ((a) << 3)
 115 #define FLASH_LOCK     (1 << 31)
 116
 117 /* FLASH_SR register bits */
 118
 119 #define FLASH_BSY      (1 << 16)
 120 #define FLASH_PGSERR   (1 << 7) /* Programming sequence error */
 121 #define FLASH_PGPERR   (1 << 6) /* Programming parallelism error */
 122 #define FLASH_PGAERR   (1 << 5) /* Programming alignment error */
 123 #define FLASH_WRPERR   (1 << 4) /* Write protection error */
 124 #define FLASH_OPERR    (1 << 1) /* Operation error */
 125
 126 #define FLASH_ERROR (FLASH_PGSERR | FLASH_PGPERR | FLASH_PGAERR | FLASH_WRPERR | FLASH_OPERR)
 127
 128 /* STM32_FLASH_OPTCR register bits */
 129
 130 #define OPT_LOCK      (1 << 0)
 131 #define OPT_START     (1 << 1)
 132
 133 /* STM32_FLASH_OBR bit definitions (reading) */
 134
 135 #define OPT_ERROR      0
 136 #define OPT_READOUT    1
 137 #define OPT_RDWDGSW    2
 138 #define OPT_RDRSTSTOP  3
 139 #define OPT_RDRSTSTDBY 4
 140 #define OPT_BFB2       5        /* dual flash bank only */
 141
 142 /* register unlock keys */
 143
 144 #define KEY1           0x45670123
 145 #define KEY2           0xCDEF89AB
 146
 147 /* option register unlock key */
 148 #define OPTKEY1        0x08192A3B
 149 #define OPTKEY2        0x4C5D6E7F
 150
 151 struct stm32x_options {
 152         uint8_t RDP;
 153         uint8_t user_options;
 154         uint32_t protection;
 155 };
 156
 157 struct stm32x_flash_bank {
 158         struct stm32x_options option_bytes;
 159         int probed;
 160         bool has_large_mem;             /* stm32f42x/stm32f43x family */
 161         uint32_t user_bank_size;
 162 };
 163
 164 /* flash bank stm32x <base> <size> 0 0 <target#>
 165  */
 166 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
 167 {
 168         struct stm32x_flash_bank *stm32x_info;
 169
 170         if (CMD_ARGC < 6)
 171                 return ERROR_COMMAND_SYNTAX_ERROR;
 172
 173         stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
 174         bank->driver_priv = stm32x_info;
 175
 176         stm32x_info->probed = 0;
 177         stm32x_info->user_bank_size = bank->size;
 178
 179         return ERROR_OK;
 180 }
 181
 182 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
 183 {
 184         return reg;
 185 }
 186
 187 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
 188 {
 189         struct target *target = bank->target;
 190         return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
 191 }
 192
 193 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
 194 {
 195         struct target *target = bank->target;
 196         uint32_t status;
 197         int retval = ERROR_OK;
 198
 199         /* wait for busy to clear */
 200         for (;;) {
 201                 retval = stm32x_get_flash_status(bank, &status);
 202                 if (retval != ERROR_OK)
 203                         return retval;
 204                 LOG_DEBUG("status: 0x%" PRIx32 "", status);
 205                 if ((status & FLASH_BSY) == 0)
 206                         break;
 207                 if (timeout-- <= 0) {
 208                         LOG_ERROR("timed out waiting for flash");
 209                         return ERROR_FAIL;
 210                 }
 211                 alive_sleep(1);
 212         }
 213
 214
 215         if (status & FLASH_WRPERR) {
 216                 LOG_ERROR("stm32x device protected");
 217                 retval = ERROR_FAIL;
 218         }
 219
 220         /* Clear but report errors */
 221         if (status & FLASH_ERROR) {
 222                 /* If this operation fails, we ignore it and report the original
 223                  * retval
 224                  */
 225                 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
 226                                 status & FLASH_ERROR);
 227         }
 228         return retval;
 229 }
 230
 231 static int stm32x_unlock_reg(struct target *target)
 232 {
 233         uint32_t ctrl;
 234
 235         /* first check if not already unlocked
 236          * otherwise writing on STM32_FLASH_KEYR will fail
 237          */
 238         int retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
 239         if (retval != ERROR_OK)
 240                 return retval;
 241
 242         if ((ctrl & FLASH_LOCK) == 0)
 243                 return ERROR_OK;
 244
 245         /* unlock flash registers */
 246         retval = target_write_u32(target, STM32_FLASH_KEYR, KEY1);
 247         if (retval != ERROR_OK)
 248                 return retval;
 249
 250         retval = target_write_u32(target, STM32_FLASH_KEYR, KEY2);
 251         if (retval != ERROR_OK)
 252                 return retval;
 253
 254         retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
 255         if (retval != ERROR_OK)
 256                 return retval;
 257
 258         if (ctrl & FLASH_LOCK) {
 259                 LOG_ERROR("flash not unlocked STM32_FLASH_CR: %x", ctrl);
 260                 return ERROR_TARGET_FAILURE;
 261         }
 262
 263         return ERROR_OK;
 264 }
 265
 266 static int stm32x_unlock_option_reg(struct target *target)
 267 {
 268         uint32_t ctrl;
 269
 270         int retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
 271         if (retval != ERROR_OK)
 272                 return retval;
 273
 274         if ((ctrl & OPT_LOCK) == 0)
 275                 return ERROR_OK;
 276
 277         /* unlock option registers */
 278         retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY1);
 279         if (retval != ERROR_OK)
 280                 return retval;
 281
 282         retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY2);
 283         if (retval != ERROR_OK)
 284                 return retval;
 285
 286         retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
 287         if (retval != ERROR_OK)
 288                 return retval;
 289
 290         if (ctrl & OPT_LOCK) {
 291                 LOG_ERROR("options not unlocked STM32_FLASH_OPTCR: %x", ctrl);
 292                 return ERROR_TARGET_FAILURE;
 293         }
 294
 295         return ERROR_OK;
 296 }
 297
 298 static int stm32x_read_options(struct flash_bank *bank)
 299 {
 300         uint32_t optiondata;
 301         struct stm32x_flash_bank *stm32x_info = NULL;
 302         struct target *target = bank->target;
 303
 304         stm32x_info = bank->driver_priv;
 305
 306         /* read current option bytes */
 307         int retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
 308         if (retval != ERROR_OK)
 309                 return retval;
 310
 311         stm32x_info->option_bytes.user_options = optiondata & 0xec;
 312         stm32x_info->option_bytes.RDP = (optiondata >> 8) & 0xff;
 313         stm32x_info->option_bytes.protection = (optiondata >> 16) & 0xfff;
 314
 315         if (stm32x_info->has_large_mem) {
 316
 317                 retval = target_read_u32(target, STM32_FLASH_OPTCR1, &optiondata);
 318                 if (retval != ERROR_OK)
 319                         return retval;
 320
 321                 /* append protection bits */
 322                 stm32x_info->option_bytes.protection |= (optiondata >> 4) & 0x00fff000;
 323         }
 324
 325         if (stm32x_info->option_bytes.RDP != 0xAA)
 326                 LOG_INFO("Device Security Bit Set");
 327
 328         return ERROR_OK;
 329 }
 330
 331 static int stm32x_write_options(struct flash_bank *bank)
 332 {
 333         struct stm32x_flash_bank *stm32x_info = NULL;
 334         struct target *target = bank->target;
 335         uint32_t optiondata;
 336
 337         stm32x_info = bank->driver_priv;
 338
 339         int retval = stm32x_unlock_option_reg(target);
 340         if (retval != ERROR_OK)
 341                 return retval;
 342
 343         /* rebuild option data */
 344         optiondata = stm32x_info->option_bytes.user_options;
 345         buf_set_u32(&optiondata, 8, 8, stm32x_info->option_bytes.RDP);
 346         buf_set_u32(&optiondata, 16, 12, stm32x_info->option_bytes.protection);
 347
 348         /* program options */
 349         retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata);
 350         if (retval != ERROR_OK)
 351                 return retval;
 352
 353         if (stm32x_info->has_large_mem) {
 354
 355                 uint32_t optiondata2 = 0;
 356                 buf_set_u32(&optiondata2, 16, 12, stm32x_info->option_bytes.protection >> 12);
 357                 retval = target_write_u32(target, STM32_FLASH_OPTCR1, optiondata2);
 358                 if (retval != ERROR_OK)
 359                         return retval;
 360         }
 361
 362         /* start programming cycle */
 363         retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPT_START);
 364         if (retval != ERROR_OK)
 365                 return retval;
 366
 367         /* wait for completion */
 368         retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
 369         if (retval != ERROR_OK)
 370                 return retval;
 371
 372         /* relock registers */
 373         retval = target_write_u32(target, STM32_FLASH_OPTCR, OPT_LOCK);
 374         if (retval != ERROR_OK)
 375                 return retval;
 376
 377         return ERROR_OK;
 378 }
 379
 380 static int stm32x_protect_check(struct flash_bank *bank)
 381 {
 382         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 383
 384         /* read write protection settings */
 385         int retval = stm32x_read_options(bank);
 386         if (retval != ERROR_OK) {
 387                 LOG_DEBUG("unable to read option bytes");
 388                 return retval;
 389         }
 390
 391         for (int i = 0; i < bank->num_sectors; i++) {
 392                 if (stm32x_info->option_bytes.protection & (1 << i))
 393                         bank->sectors[i].is_protected = 0;
 394                 else
 395                         bank->sectors[i].is_protected = 1;
 396         }
 397
 398         return ERROR_OK;
 399 }
 400
 401 static int stm32x_erase(struct flash_bank *bank, int first, int last)
 402 {
 403         struct target *target = bank->target;
 404         int i;
 405
 406         if (bank->target->state != TARGET_HALTED) {
 407                 LOG_ERROR("Target not halted");
 408                 return ERROR_TARGET_NOT_HALTED;
 409         }
 410
 411         int retval;
 412         retval = stm32x_unlock_reg(target);
 413         if (retval != ERROR_OK)
 414                 return retval;
 415
 416         /*
 417         Sector Erase
 418         To erase a sector, follow the procedure below:
 419         1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
 420           FLASH_SR register
 421         2. Set the SER bit and select the sector (out of the 12 sectors in the main memory block)
 422           you wish to erase (SNB) in the FLASH_CR register
 423         3. Set the STRT bit in the FLASH_CR register
 424         4. Wait for the BSY bit to be cleared
 425          */
 426
 427         for (i = first; i <= last; i++) {
 428                 retval = target_write_u32(target,
 429                                 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_SER | FLASH_SNB(i) | FLASH_STRT);
 430                 if (retval != ERROR_OK)
 431                         return retval;
 432
 433                 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
 434                 if (retval != ERROR_OK)
 435                         return retval;
 436
 437                 bank->sectors[i].is_erased = 1;
 438         }
 439
 440         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
 441         if (retval != ERROR_OK)
 442                 return retval;
 443
 444         return ERROR_OK;
 445 }
 446
 447 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
 448 {
 449         struct target *target = bank->target;
 450         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 451
 452         if (target->state != TARGET_HALTED) {
 453                 LOG_ERROR("Target not halted");
 454                 return ERROR_TARGET_NOT_HALTED;
 455         }
 456
 457         /* read protection settings */
 458         int retval = stm32x_read_options(bank);
 459         if (retval != ERROR_OK) {
 460                 LOG_DEBUG("unable to read option bytes");
 461                 return retval;
 462         }
 463
 464         for (int i = first; i <= last; i++) {
 465
 466                 if (set)
 467                         stm32x_info->option_bytes.protection &= ~(1 << i);
 468                 else
 469                         stm32x_info->option_bytes.protection |= (1 << i);
 470         }
 471
 472         retval = stm32x_write_options(bank);
 473         if (retval != ERROR_OK)
 474                 return retval;
 475
 476         return ERROR_OK;
 477 }
 478
 479 static int stm32x_write_block(struct flash_bank *bank, uint8_t *buffer,
 480                 uint32_t offset, uint32_t count)
 481 {
 482         struct target *target = bank->target;
 483         uint32_t buffer_size = 16384;
 484         struct working_area *write_algorithm;
 485         struct working_area *source;
 486         uint32_t address = bank->base + offset;
 487         struct reg_param reg_params[5];
 488         struct armv7m_algorithm armv7m_info;
 489         int retval = ERROR_OK;
 490
 491         /* see contrib/loaders/flash/stm32f2x.S for src */
 492
 493         static const uint8_t stm32x_flash_write_code[] = {
 494                                                                         /* wait_fifo: */
 495                 0xD0, 0xF8, 0x00, 0x80,         /* ldr          r8, [r0, #0] */
 496                 0xB8, 0xF1, 0x00, 0x0F,         /* cmp          r8, #0 */
 497                 0x1A, 0xD0,                                     /* beq          exit */
 498                 0x47, 0x68,                                     /* ldr          r7, [r0, #4] */
 499                 0x47, 0x45,                                     /* cmp          r7, r8 */
 500                 0xF7, 0xD0,                                     /* beq          wait_fifo */
 501
 502                 0xDF, 0xF8, 0x30, 0x60,         /* ldr          r6, STM32_PROG16 */
 503                 0x26, 0x61,                                     /* str          r6, [r4, #STM32_FLASH_CR_OFFSET] */
 504                 0x37, 0xF8, 0x02, 0x6B,         /* ldrh         r6, [r7], #0x02 */
 505                 0x22, 0xF8, 0x02, 0x6B,         /* strh         r6, [r2], #0x02 */
 506                                                                         /* busy: */
 507                 0xE6, 0x68,                                     /* ldr          r6, [r4, #STM32_FLASH_SR_OFFSET] */
 508                 0x16, 0xF4, 0x80, 0x3F,         /* tst          r6, #0x10000 */
 509                 0xFB, 0xD1,                                     /* bne          busy */
 510                 0x16, 0xF0, 0xF0, 0x0F,         /* tst          r6, #0xf0 */
 511                 0x07, 0xD1,                                     /* bne          error */
 512
 513                 0x8F, 0x42,                                     /* cmp          r7, r1 */
 514                 0x28, 0xBF,                                     /* it           cs */
 515                 0x00, 0xF1, 0x08, 0x07,         /* addcs        r7, r0, #8 */
 516                 0x47, 0x60,                                     /* str          r7, [r0, #4] */
 517                 0x01, 0x3B,                                     /* subs         r3, r3, #1 */
 518                 0x13, 0xB1,                                     /* cbz          r3, exit */
 519                 0xE1, 0xE7,                                     /* b            wait_fifo */
 520                                                                         /* error: */
 521                 0x00, 0x21,                                     /* movs         r1, #0 */
 522                 0x41, 0x60,                                     /* str          r1, [r0, #4] */
 523                                                                         /* exit: */
 524                 0x30, 0x46,                                     /* mov          r0, r6 */
 525                 0x00, 0xBE,                                     /* bkpt         #0x00 */
 526
 527                 /* <STM32_PROG16>: */
 528                 0x01, 0x01, 0x00, 0x00,         /* .word        0x00000101 */
 529         };
 530
 531         if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
 532                         &write_algorithm) != ERROR_OK) {
 533                 LOG_WARNING("no working area available, can't do block memory writes");
 534                 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
 535         };
 536
 537         retval = target_write_buffer(target, write_algorithm->address,
 538                         sizeof(stm32x_flash_write_code),
 539                         (uint8_t *)stm32x_flash_write_code);
 540         if (retval != ERROR_OK)
 541                 return retval;
 542
 543         /* memory buffer */
 544         while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
 545                 buffer_size /= 2;
 546                 if (buffer_size <= 256) {
 547                         /* we already allocated the writing code, but failed to get a
 548                          * buffer, free the algorithm */
 549                         target_free_working_area(target, write_algorithm);
 550
 551                         LOG_WARNING("no large enough working area available, can't do block memory writes");
 552                         return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
 553                 }
 554         };
 555
 556         armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
 557         armv7m_info.core_mode = ARM_MODE_THREAD;
 558
 559         init_reg_param(&reg_params[0], "r0", 32, PARAM_IN_OUT);         /* buffer start, status (out) */
 560         init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);            /* buffer end */
 561         init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);            /* target address */
 562         init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);            /* count (halfword-16bit) */
 563         init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT);            /* flash base */
 564
 565         buf_set_u32(reg_params[0].value, 0, 32, source->address);
 566         buf_set_u32(reg_params[1].value, 0, 32, source->address + source->size);
 567         buf_set_u32(reg_params[2].value, 0, 32, address);
 568         buf_set_u32(reg_params[3].value, 0, 32, count);
 569         buf_set_u32(reg_params[4].value, 0, 32, STM32_FLASH_BASE);
 570
 571         retval = target_run_flash_async_algorithm(target, buffer, count, 2,
 572                         0, NULL,
 573                         5, reg_params,
 574                         source->address, source->size,
 575                         write_algorithm->address, 0,
 576                         &armv7m_info);
 577
 578         if (retval == ERROR_FLASH_OPERATION_FAILED) {
 579                 LOG_ERROR("error executing stm32x flash write algorithm");
 580
 581                 uint32_t error = buf_get_u32(reg_params[0].value, 0, 32) & FLASH_ERROR;
 582
 583                 if (error & FLASH_WRPERR)
 584                         LOG_ERROR("flash memory write protected");
 585
 586                 if (error != 0) {
 587                         LOG_ERROR("flash write failed = %08x", error);
 588                         /* Clear but report errors */
 589                         target_write_u32(target, STM32_FLASH_SR, error);
 590                         retval = ERROR_FAIL;
 591                 }
 592         }
 593
 594         target_free_working_area(target, source);
 595         target_free_working_area(target, write_algorithm);
 596
 597         destroy_reg_param(&reg_params[0]);
 598         destroy_reg_param(&reg_params[1]);
 599         destroy_reg_param(&reg_params[2]);
 600         destroy_reg_param(&reg_params[3]);
 601         destroy_reg_param(&reg_params[4]);
 602
 603         return retval;
 604 }
 605
 606 static int stm32x_write(struct flash_bank *bank, uint8_t *buffer,
 607                 uint32_t offset, uint32_t count)
 608 {
 609         struct target *target = bank->target;
 610         uint32_t words_remaining = (count / 2);
 611         uint32_t bytes_remaining = (count & 0x00000001);
 612         uint32_t address = bank->base + offset;
 613         uint32_t bytes_written = 0;
 614         int retval;
 615
 616         if (bank->target->state != TARGET_HALTED) {
 617                 LOG_ERROR("Target not halted");
 618                 return ERROR_TARGET_NOT_HALTED;
 619         }
 620
 621         if (offset & 0x1) {
 622                 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
 623                 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
 624         }
 625
 626         retval = stm32x_unlock_reg(target);
 627         if (retval != ERROR_OK)
 628                 return retval;
 629
 630         /* multiple half words (2-byte) to be programmed? */
 631         if (words_remaining > 0) {
 632                 /* try using a block write */
 633                 retval = stm32x_write_block(bank, buffer, offset, words_remaining);
 634                 if (retval != ERROR_OK) {
 635                         if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
 636                                 /* if block write failed (no sufficient working area),
 637                                  * we use normal (slow) single dword accesses */
 638                                 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
 639                         }
 640                 } else {
 641                         buffer += words_remaining * 2;
 642                         address += words_remaining * 2;
 643                         words_remaining = 0;
 644                 }
 645         }
 646
 647         if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
 648                 return retval;
 649
 650         /*
 651         Standard programming
 652         The Flash memory programming sequence is as follows:
 653         1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
 654           FLASH_SR register.
 655         2. Set the PG bit in the FLASH_CR register
 656         3. Perform the data write operation(s) to the desired memory address (inside main
 657           memory block or OTP area):
 658         – – Half-word access in case of x16 parallelism
 659         – Word access in case of x32 parallelism
 660         –
 661         4.
 662         Byte access in case of x8 parallelism
 663         Double word access in case of x64 parallelism
 664         Wait for the BSY bit to be cleared
 665         */
 666         while (words_remaining > 0) {
 667                 uint16_t value;
 668                 memcpy(&value, buffer + bytes_written, sizeof(uint16_t));
 669
 670                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
 671                                 FLASH_PG | FLASH_PSIZE_16);
 672                 if (retval != ERROR_OK)
 673                         return retval;
 674
 675                 retval = target_write_u16(target, address, value);
 676                 if (retval != ERROR_OK)
 677                         return retval;
 678
 679                 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
 680                 if (retval != ERROR_OK)
 681                         return retval;
 682
 683                 bytes_written += 2;
 684                 words_remaining--;
 685                 address += 2;
 686         }
 687
 688         if (bytes_remaining) {
 689                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
 690                                 FLASH_PG | FLASH_PSIZE_8);
 691                 if (retval != ERROR_OK)
 692                         return retval;
 693                 retval = target_write_u8(target, address, buffer[bytes_written]);
 694                 if (retval != ERROR_OK)
 695                         return retval;
 696
 697                 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
 698                 if (retval != ERROR_OK)
 699                         return retval;
 700         }
 701
 702         return target_write_u32(target, STM32_FLASH_CR, FLASH_LOCK);
 703 }
 704
 705 static void setup_sector(struct flash_bank *bank, int start, int num, int size)
 706 {
 707         for (int i = start; i < (start + num) ; i++) {
 708                 assert(i < bank->num_sectors);
 709                 bank->sectors[i].offset = bank->size;
 710                 bank->sectors[i].size = size;
 711                 bank->size += bank->sectors[i].size;
 712         }
 713 }
 714
 715 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
 716 {
 717         /* this checks for a stm32f4x errata issue where a
 718          * stm32f2x DBGMCU_IDCODE is incorrectly returned.
 719          * If the issue is detected target is forced to stm32f4x Rev A.
 720          * Only effects Rev A silicon */
 721
 722         struct target *target = bank->target;
 723         uint32_t cpuid;
 724
 725         /* read stm32 device id register */
 726         int retval = target_read_u32(target, 0xE0042000, device_id);
 727         if (retval != ERROR_OK)
 728                 return retval;
 729
 730         if ((*device_id & 0xfff) == 0x411) {
 731                 /* read CPUID reg to check core type */
 732                 retval = target_read_u32(target, 0xE000ED00, &cpuid);
 733                 if (retval != ERROR_OK)
 734                         return retval;
 735
 736                 /* check for cortex_m4 */
 737                 if (((cpuid >> 4) & 0xFFF) == 0xC24) {
 738                         *device_id &= ~((0xFFFF << 16) | 0xfff);
 739                         *device_id |= (0x1000 << 16) | 0x413;
 740                         LOG_INFO("stm32f4x errata detected - fixing incorrect MCU_IDCODE");
 741                 }
 742         }
 743         return retval;
 744 }
 745
 746 static int stm32x_probe(struct flash_bank *bank)
 747 {
 748         struct target *target = bank->target;
 749         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 750         int i;
 751         uint16_t flash_size_in_kb;
 752         uint16_t max_flash_size_in_kb;
 753         uint32_t device_id;
 754         uint32_t base_address = 0x08000000;
 755
 756         stm32x_info->probed = 0;
 757         stm32x_info->has_large_mem = false;
 758
 759         /* read stm32 device id register */
 760         int retval = stm32x_get_device_id(bank, &device_id);
 761         if (retval != ERROR_OK)
 762                 return retval;
 763         LOG_INFO("device id = 0x%08" PRIx32 "", device_id);
 764
 765         /* set max flash size depending on family */
 766         switch (device_id & 0xfff) {
 767         case 0x411:
 768         case 0x413:
 769                 max_flash_size_in_kb = 1024;
 770                 break;
 771         case 0x419:
 772                 max_flash_size_in_kb = 2048;
 773                 stm32x_info->has_large_mem = true;
 774                 break;
 775         case 0x423:
 776                 max_flash_size_in_kb = 256;
 777                 break;
 778         default:
 779                 LOG_WARNING("Cannot identify target as a STM32 family.");
 780                 return ERROR_FAIL;
 781         }
 782
 783         /* get flash size from target. */
 784         retval = target_read_u16(target, 0x1FFF7A22, &flash_size_in_kb);
 785
 786         /* failed reading flash size or flash size invalid (early silicon),
 787          * default to max target family */
 788         if (retval != ERROR_OK || flash_size_in_kb == 0xffff || flash_size_in_kb == 0) {
 789                 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming %dk flash",
 790                         max_flash_size_in_kb);
 791                 flash_size_in_kb = max_flash_size_in_kb;
 792         }
 793
 794         /* if the user sets the size manually then ignore the probed value
 795          * this allows us to work around devices that have a invalid flash size register value */
 796         if (stm32x_info->user_bank_size) {
 797                 LOG_INFO("ignoring flash probed value, using configured bank size");
 798                 flash_size_in_kb = stm32x_info->user_bank_size / 1024;
 799         }
 800
 801         LOG_INFO("flash size = %dkbytes", flash_size_in_kb);
 802
 803         /* did we assign flash size? */
 804         assert(flash_size_in_kb != 0xffff);
 805
 806         /* calculate numbers of pages */
 807         int num_pages = (flash_size_in_kb / 128) + 4;
 808
 809         /* check for larger 2048 bytes devices */
 810         if (stm32x_info->has_large_mem)
 811                 num_pages += 4;
 812
 813         /* check that calculation result makes sense */
 814         assert(num_pages > 0);
 815
 816         if (bank->sectors) {
 817                 free(bank->sectors);
 818                 bank->sectors = NULL;
 819         }
 820
 821         bank->base = base_address;
 822         bank->num_sectors = num_pages;
 823         bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
 824         bank->size = 0;
 825
 826         /* fixed memory */
 827         setup_sector(bank, 0, 4, 16 * 1024);
 828         setup_sector(bank, 4, 1, 64 * 1024);
 829
 830         /* dynamic memory */
 831         setup_sector(bank, 4 + 1, MIN(12, num_pages) - 5, 128 * 1024);
 832
 833         if (stm32x_info->has_large_mem) {
 834
 835                 /* fixed memory for larger devices */
 836                 setup_sector(bank, 12, 4, 16 * 1024);
 837                 setup_sector(bank, 16, 1, 64 * 1024);
 838
 839                 /* dynamic memory for larger devices */
 840                 setup_sector(bank, 16 + 1, num_pages - 5 - 12, 128 * 1024);
 841         }
 842
 843         for (i = 0; i < num_pages; i++) {
 844                 bank->sectors[i].is_erased = -1;
 845                 bank->sectors[i].is_protected = 0;
 846         }
 847
 848         stm32x_info->probed = 1;
 849
 850         return ERROR_OK;
 851 }
 852
 853 static int stm32x_auto_probe(struct flash_bank *bank)
 854 {
 855         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 856         if (stm32x_info->probed)
 857                 return ERROR_OK;
 858         return stm32x_probe(bank);
 859 }
 860
 861 static int get_stm32x_info(struct flash_bank *bank, char *buf, int buf_size)
 862 {
 863         uint32_t dbgmcu_idcode;
 864
 865         /* read stm32 device id register */
 866         int retval = stm32x_get_device_id(bank, &dbgmcu_idcode);
 867         if (retval != ERROR_OK)
 868                 return retval;
 869
 870         uint16_t device_id = dbgmcu_idcode & 0xfff;
 871         uint16_t rev_id = dbgmcu_idcode >> 16;
 872         const char *device_str;
 873         const char *rev_str = NULL;
 874
 875         switch (device_id) {
 876         case 0x411:
 877                 device_str = "STM32F2xx";
 878
 879                 switch (rev_id) {
 880                 case 0x1000:
 881                         rev_str = "A";
 882                         break;
 883
 884                 case 0x2000:
 885                         rev_str = "B";
 886                         break;
 887
 888                 case 0x1001:
 889                         rev_str = "Z";
 890                         break;
 891
 892                 case 0x2001:
 893                         rev_str = "Y";
 894                         break;
 895
 896                 case 0x2003:
 897                         rev_str = "X";
 898                         break;
 899                 }
 900                 break;
 901
 902         case 0x413:
 903         case 0x419:
 904                 device_str = "STM32F4xx";
 905
 906                 switch (rev_id) {
 907                 case 0x1000:
 908                         rev_str = "A";
 909                         break;
 910
 911                 case 0x1001:
 912                         rev_str = "Z";
 913                         break;
 914                 }
 915                 break;
 916
 917         case 0x423:
 918                 device_str = "STM32F4xx (Low Power)";
 919
 920                 switch (rev_id) {
 921                 case 0x1000:
 922                         rev_str = "A";
 923                         break;
 924
 925                 case 0x1001:
 926                         rev_str = "Z";
 927                         break;
 928                 }
 929                 break;
 930
 931         default:
 932                 snprintf(buf, buf_size, "Cannot identify target as a STM32F2/4\n");
 933                 return ERROR_FAIL;
 934         }
 935
 936         if (rev_str != NULL)
 937                 snprintf(buf, buf_size, "%s - Rev: %s", device_str, rev_str);
 938         else
 939                 snprintf(buf, buf_size, "%s - Rev: unknown (0x%04x)", device_str, rev_id);
 940
 941         return ERROR_OK;
 942 }
 943
 944 COMMAND_HANDLER(stm32x_handle_lock_command)
 945 {
 946         struct target *target = NULL;
 947         struct stm32x_flash_bank *stm32x_info = NULL;
 948
 949         if (CMD_ARGC < 1)
 950                 return ERROR_COMMAND_SYNTAX_ERROR;
 951
 952         struct flash_bank *bank;
 953         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 954         if (ERROR_OK != retval)
 955                 return retval;
 956
 957         stm32x_info = bank->driver_priv;
 958         target = bank->target;
 959
 960         if (target->state != TARGET_HALTED) {
 961                 LOG_ERROR("Target not halted");
 962                 return ERROR_TARGET_NOT_HALTED;
 963         }
 964
 965         if (stm32x_read_options(bank) != ERROR_OK) {
 966                 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
 967                 return ERROR_OK;
 968         }
 969
 970         /* set readout protection */
 971         stm32x_info->option_bytes.RDP = 0;
 972
 973         if (stm32x_write_options(bank) != ERROR_OK) {
 974                 command_print(CMD_CTX, "%s failed to lock device", bank->driver->name);
 975                 return ERROR_OK;
 976         }
 977
 978         command_print(CMD_CTX, "%s locked", bank->driver->name);
 979
 980         return ERROR_OK;
 981 }
 982
 983 COMMAND_HANDLER(stm32x_handle_unlock_command)
 984 {
 985         struct target *target = NULL;
 986         struct stm32x_flash_bank *stm32x_info = NULL;
 987
 988         if (CMD_ARGC < 1)
 989                 return ERROR_COMMAND_SYNTAX_ERROR;
 990
 991         struct flash_bank *bank;
 992         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 993         if (ERROR_OK != retval)
 994                 return retval;
 995
 996         stm32x_info = bank->driver_priv;
 997         target = bank->target;
 998
 999         if (target->state != TARGET_HALTED) {
1000                 LOG_ERROR("Target not halted");
1001                 return ERROR_TARGET_NOT_HALTED;
1002         }
1003
1004         if (stm32x_read_options(bank) != ERROR_OK) {
1005                 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
1006                 return ERROR_OK;
1007         }
1008
1009         /* clear readout protection and complementary option bytes
1010          * this will also force a device unlock if set */
1011         stm32x_info->option_bytes.RDP = 0xAA;
1012
1013         if (stm32x_write_options(bank) != ERROR_OK) {
1014                 command_print(CMD_CTX, "%s failed to unlock device", bank->driver->name);
1015                 return ERROR_OK;
1016         }
1017
1018         command_print(CMD_CTX, "%s unlocked.\n"
1019                         "INFO: a reset or power cycle is required "
1020                         "for the new settings to take effect.", bank->driver->name);
1021
1022         return ERROR_OK;
1023 }
1024
1025 static int stm32x_mass_erase(struct flash_bank *bank)
1026 {
1027         int retval;
1028         struct target *target = bank->target;
1029         struct stm32x_flash_bank *stm32x_info = NULL;
1030
1031         if (target->state != TARGET_HALTED) {
1032                 LOG_ERROR("Target not halted");
1033                 return ERROR_TARGET_NOT_HALTED;
1034         }
1035
1036         stm32x_info = bank->driver_priv;
1037
1038         retval = stm32x_unlock_reg(target);
1039         if (retval != ERROR_OK)
1040                 return retval;
1041
1042         /* mass erase flash memory */
1043         if (stm32x_info->has_large_mem)
1044                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER | FLASH_MER1);
1045         else
1046                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER);
1047         if (retval != ERROR_OK)
1048                 return retval;
1049         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
1050                 FLASH_MER | FLASH_STRT);
1051         if (retval != ERROR_OK)
1052                 return retval;
1053
1054         retval = stm32x_wait_status_busy(bank, 30000);
1055         if (retval != ERROR_OK)
1056                 return retval;
1057
1058         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
1059         if (retval != ERROR_OK)
1060                 return retval;
1061
1062         return ERROR_OK;
1063 }
1064
1065 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
1066 {
1067         int i;
1068
1069         if (CMD_ARGC < 1) {
1070                 command_print(CMD_CTX, "stm32x mass_erase <bank>");
1071                 return ERROR_COMMAND_SYNTAX_ERROR;
1072         }
1073
1074         struct flash_bank *bank;
1075         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1076         if (ERROR_OK != retval)
1077                 return retval;
1078
1079         retval = stm32x_mass_erase(bank);
1080         if (retval == ERROR_OK) {
1081                 /* set all sectors as erased */
1082                 for (i = 0; i < bank->num_sectors; i++)
1083                         bank->sectors[i].is_erased = 1;
1084
1085                 command_print(CMD_CTX, "stm32x mass erase complete");
1086         } else {
1087                 command_print(CMD_CTX, "stm32x mass erase failed");
1088         }
1089
1090         return retval;
1091 }
1092
1093 static const struct command_registration stm32x_exec_command_handlers[] = {
1094         {
1095                 .name = "lock",
1096                 .handler = stm32x_handle_lock_command,
1097                 .mode = COMMAND_EXEC,
1098                 .usage = "bank_id",
1099                 .help = "Lock entire flash device.",
1100         },
1101         {
1102                 .name = "unlock",
1103                 .handler = stm32x_handle_unlock_command,
1104                 .mode = COMMAND_EXEC,
1105                 .usage = "bank_id",
1106                 .help = "Unlock entire protected flash device.",
1107         },
1108         {
1109                 .name = "mass_erase",
1110                 .handler = stm32x_handle_mass_erase_command,
1111                 .mode = COMMAND_EXEC,
1112                 .usage = "bank_id",
1113                 .help = "Erase entire flash device.",
1114         },
1115         COMMAND_REGISTRATION_DONE
1116 };
1117
1118 static const struct command_registration stm32x_command_handlers[] = {
1119         {
1120                 .name = "stm32f2x",
1121                 .mode = COMMAND_ANY,
1122                 .help = "stm32f2x flash command group",
1123                 .usage = "",
1124                 .chain = stm32x_exec_command_handlers,
1125         },
1126         COMMAND_REGISTRATION_DONE
1127 };
1128
1129 struct flash_driver stm32f2x_flash = {
1130         .name = "stm32f2x",
1131         .commands = stm32x_command_handlers,
1132         .flash_bank_command = stm32x_flash_bank_command,
1133         .erase = stm32x_erase,
1134         .protect = stm32x_protect,
1135         .write = stm32x_write,
1136         .read = default_flash_read,
1137         .probe = stm32x_probe,
1138         .auto_probe = stm32x_auto_probe,
1139         .erase_check = default_flash_blank_check,
1140         .protect_check = stm32x_protect_check,
1141         .info = get_stm32x_info,
1142 };