git.sur5r.net Git - openocd/blob - src/flash/nor/stm32f2x.c

   1 /***************************************************************************
   2  *   Copyright (C) 2005 by Dominic Rath                                    *
   3  *   Dominic.Rath@gmx.de                                                   *
   4  *                                                                         *
   5  *   Copyright (C) 2008 by Spencer Oliver                                  *
   6  *   spen@spen-soft.co.uk                                                  *
   7  *                                                                         *
   8  *   Copyright (C) 2011 Øyvind Harboe                                      *
   9  *   oyvind.harboe@zylin.com                                               *
  10  *                                                                         *
  11  *   This program is free software; you can redistribute it and/or modify  *
  12  *   it under the terms of the GNU General Public License as published by  *
  13  *   the Free Software Foundation; either version 2 of the License, or     *
  14  *   (at your option) any later version.                                   *
  15  *                                                                         *
  16  *   This program is distributed in the hope that it will be useful,       *
  17  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  18  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  19  *   GNU General Public License for more details.                          *
  20  *                                                                         *
  21  *   You should have received a copy of the GNU General Public License     *
  22  *   along with this program; if not, write to the                         *
  23  *   Free Software Foundation, Inc.,                                       *
  24  *   51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.           *
  25  ***************************************************************************/
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include "imp.h"
  32 #include <helper/binarybuffer.h>
  33 #include <target/algorithm.h>
  34 #include <target/armv7m.h>
  35
  36 /* Regarding performance:
  37  *
  38  * Short story - it might be best to leave the performance at
  39  * current levels.
  40  *
  41  * You may see a jump in speed if you change to using
  42  * 32bit words for the block programming.
  43  *
  44  * Its a shame you cannot use the double word as its
  45  * even faster - but you require external VPP for that mode.
  46  *
  47  * Having said all that 16bit writes give us the widest vdd
  48  * operating range, so may be worth adding a note to that effect.
  49  *
  50  */
  51
  52 /* Danger!!!! The STM32F1x and STM32F2x series actually have
  53  * quite different flash controllers.
  54  *
  55  * What's more scary is that the names of the registers and their
  56  * addresses are the same, but the actual bits and what they do are
  57  * can be very different.
  58  *
  59  * To reduce testing complexity and dangers of regressions,
  60  * a seperate file is used for stm32fx2x.
  61  *
  62  * 1mByte part with 4 x 16, 1 x 64, 7 x 128kBytes sectors
  63  *
  64  * What's the protection page size???
  65  *
  66  * Tested with STM3220F-EVAL board.
  67  *
  68  * STM32F21xx series for reference.
  69  *
  70  * RM0033
  71  * http://www.st.com/internet/mcu/product/250192.jsp
  72  *
  73  * PM0059
  74  * www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/
  75  * PROGRAMMING_MANUAL/CD00233952.pdf
  76  *
  77  * STM32F1x series - notice that this code was copy, pasted and knocked
  78  * into a stm32f2x driver, so in case something has been converted or
  79  * bugs haven't been fixed, here are the original manuals:
  80  *
  81  * RM0008 - Reference manual
  82  *
  83  * RM0042, the Flash programming manual for low-, medium- high-density and
  84  * connectivity line STM32F10x devices
  85  *
  86  * PM0068, the Flash programming manual for XL-density STM32F10x devices.
  87  *
  88  */
  89
  90 /* Erase time can be as high as 1000ms, 10x this and it's toast... */
  91 #define FLASH_ERASE_TIMEOUT 10000
  92 #define FLASH_WRITE_TIMEOUT 5
  93
  94 #define STM32_FLASH_BASE    0x40023c00
  95 #define STM32_FLASH_ACR     0x40023c00
  96 #define STM32_FLASH_KEYR    0x40023c04
  97 #define STM32_FLASH_OPTKEYR 0x40023c08
  98 #define STM32_FLASH_SR      0x40023c0C
  99 #define STM32_FLASH_CR      0x40023c10
 100 #define STM32_FLASH_OPTCR   0x40023c14
 101 #define STM32_FLASH_OPTCR1  0x40023c18
 102
 103 /* FLASH_CR register bits */
 104
 105 #define FLASH_PG       (1 << 0)
 106 #define FLASH_SER      (1 << 1)
 107 #define FLASH_MER      (1 << 2)
 108 #define FLASH_MER1     (1 << 15)
 109 #define FLASH_STRT     (1 << 16)
 110 #define FLASH_PSIZE_8  (0 << 8)
 111 #define FLASH_PSIZE_16 (1 << 8)
 112 #define FLASH_PSIZE_32 (2 << 8)
 113 #define FLASH_PSIZE_64 (3 << 8)
 114 #define FLASH_SNB(a)   ((a) << 3)
 115 #define FLASH_LOCK     (1 << 31)
 116
 117 /* FLASH_SR register bits */
 118
 119 #define FLASH_BSY      (1 << 16)
 120 #define FLASH_PGSERR   (1 << 7) /* Programming sequence error */
 121 #define FLASH_PGPERR   (1 << 6) /* Programming parallelism error */
 122 #define FLASH_PGAERR   (1 << 5) /* Programming alignment error */
 123 #define FLASH_WRPERR   (1 << 4) /* Write protection error */
 124 #define FLASH_OPERR    (1 << 1) /* Operation error */
 125
 126 #define FLASH_ERROR (FLASH_PGSERR | FLASH_PGPERR | FLASH_PGAERR | FLASH_WRPERR | FLASH_OPERR)
 127
 128 /* STM32_FLASH_OPTCR register bits */
 129
 130 #define OPT_LOCK      (1 << 0)
 131 #define OPT_START     (1 << 1)
 132
 133 /* STM32_FLASH_OBR bit definitions (reading) */
 134
 135 #define OPT_ERROR      0
 136 #define OPT_READOUT    1
 137 #define OPT_RDWDGSW    2
 138 #define OPT_RDRSTSTOP  3
 139 #define OPT_RDRSTSTDBY 4
 140 #define OPT_BFB2       5        /* dual flash bank only */
 141
 142 /* register unlock keys */
 143
 144 #define KEY1           0x45670123
 145 #define KEY2           0xCDEF89AB
 146
 147 /* option register unlock key */
 148 #define OPTKEY1        0x08192A3B
 149 #define OPTKEY2        0x4C5D6E7F
 150
 151 struct stm32x_options {
 152         uint8_t RDP;
 153         uint8_t user_options;
 154         uint32_t protection;
 155 };
 156
 157 struct stm32x_flash_bank {
 158         struct stm32x_options option_bytes;
 159         int probed;
 160         bool has_large_mem;             /* stm32f42x/stm32f43x family */
 161         uint32_t user_bank_size;
 162 };
 163
 164 /* flash bank stm32x <base> <size> 0 0 <target#>
 165  */
 166 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
 167 {
 168         struct stm32x_flash_bank *stm32x_info;
 169
 170         if (CMD_ARGC < 6)
 171                 return ERROR_COMMAND_SYNTAX_ERROR;
 172
 173         stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
 174         bank->driver_priv = stm32x_info;
 175
 176         stm32x_info->probed = 0;
 177         stm32x_info->user_bank_size = bank->size;
 178
 179         return ERROR_OK;
 180 }
 181
 182 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
 183 {
 184         return reg;
 185 }
 186
 187 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
 188 {
 189         struct target *target = bank->target;
 190         return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
 191 }
 192
 193 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
 194 {
 195         struct target *target = bank->target;
 196         uint32_t status;
 197         int retval = ERROR_OK;
 198
 199         /* wait for busy to clear */
 200         for (;;) {
 201                 retval = stm32x_get_flash_status(bank, &status);
 202                 if (retval != ERROR_OK)
 203                         return retval;
 204                 LOG_DEBUG("status: 0x%" PRIx32 "", status);
 205                 if ((status & FLASH_BSY) == 0)
 206                         break;
 207                 if (timeout-- <= 0) {
 208                         LOG_ERROR("timed out waiting for flash");
 209                         return ERROR_FAIL;
 210                 }
 211                 alive_sleep(1);
 212         }
 213
 214
 215         if (status & FLASH_WRPERR) {
 216                 LOG_ERROR("stm32x device protected");
 217                 retval = ERROR_FAIL;
 218         }
 219
 220         /* Clear but report errors */
 221         if (status & FLASH_ERROR) {
 222                 /* If this operation fails, we ignore it and report the original
 223                  * retval
 224                  */
 225                 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
 226                                 status & FLASH_ERROR);
 227         }
 228         return retval;
 229 }
 230
 231 static int stm32x_unlock_reg(struct target *target)
 232 {
 233         uint32_t ctrl;
 234
 235         /* first check if not already unlocked
 236          * otherwise writing on STM32_FLASH_KEYR will fail
 237          */
 238         int retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
 239         if (retval != ERROR_OK)
 240                 return retval;
 241
 242         if ((ctrl & FLASH_LOCK) == 0)
 243                 return ERROR_OK;
 244
 245         /* unlock flash registers */
 246         retval = target_write_u32(target, STM32_FLASH_KEYR, KEY1);
 247         if (retval != ERROR_OK)
 248                 return retval;
 249
 250         retval = target_write_u32(target, STM32_FLASH_KEYR, KEY2);
 251         if (retval != ERROR_OK)
 252                 return retval;
 253
 254         retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
 255         if (retval != ERROR_OK)
 256                 return retval;
 257
 258         if (ctrl & FLASH_LOCK) {
 259                 LOG_ERROR("flash not unlocked STM32_FLASH_CR: %x", ctrl);
 260                 return ERROR_TARGET_FAILURE;
 261         }
 262
 263         return ERROR_OK;
 264 }
 265
 266 static int stm32x_unlock_option_reg(struct target *target)
 267 {
 268         uint32_t ctrl;
 269
 270         int retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
 271         if (retval != ERROR_OK)
 272                 return retval;
 273
 274         if ((ctrl & OPT_LOCK) == 0)
 275                 return ERROR_OK;
 276
 277         /* unlock option registers */
 278         retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY1);
 279         if (retval != ERROR_OK)
 280                 return retval;
 281
 282         retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY2);
 283         if (retval != ERROR_OK)
 284                 return retval;
 285
 286         retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
 287         if (retval != ERROR_OK)
 288                 return retval;
 289
 290         if (ctrl & OPT_LOCK) {
 291                 LOG_ERROR("options not unlocked STM32_FLASH_OPTCR: %x", ctrl);
 292                 return ERROR_TARGET_FAILURE;
 293         }
 294
 295         return ERROR_OK;
 296 }
 297
 298 static int stm32x_read_options(struct flash_bank *bank)
 299 {
 300         uint32_t optiondata;
 301         struct stm32x_flash_bank *stm32x_info = NULL;
 302         struct target *target = bank->target;
 303
 304         stm32x_info = bank->driver_priv;
 305
 306         /* read current option bytes */
 307         int retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
 308         if (retval != ERROR_OK)
 309                 return retval;
 310
 311         stm32x_info->option_bytes.user_options = optiondata & 0xec;
 312         stm32x_info->option_bytes.RDP = (optiondata >> 8) & 0xff;
 313         stm32x_info->option_bytes.protection = (optiondata >> 16) & 0xfff;
 314
 315         if (stm32x_info->has_large_mem) {
 316
 317                 retval = target_read_u32(target, STM32_FLASH_OPTCR1, &optiondata);
 318                 if (retval != ERROR_OK)
 319                         return retval;
 320
 321                 /* append protection bits */
 322                 stm32x_info->option_bytes.protection |= (optiondata >> 4) & 0x00fff000;
 323         }
 324
 325         if (stm32x_info->option_bytes.RDP != 0xAA)
 326                 LOG_INFO("Device Security Bit Set");
 327
 328         return ERROR_OK;
 329 }
 330
 331 static int stm32x_write_options(struct flash_bank *bank)
 332 {
 333         struct stm32x_flash_bank *stm32x_info = NULL;
 334         struct target *target = bank->target;
 335         uint32_t optiondata;
 336
 337         stm32x_info = bank->driver_priv;
 338
 339         int retval = stm32x_unlock_option_reg(target);
 340         if (retval != ERROR_OK)
 341                 return retval;
 342
 343         /* rebuild option data */
 344         optiondata = stm32x_info->option_bytes.user_options;
 345         buf_set_u32(&optiondata, 8, 8, stm32x_info->option_bytes.RDP);
 346         buf_set_u32(&optiondata, 16, 12, stm32x_info->option_bytes.protection);
 347
 348         /* program options */
 349         retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata);
 350         if (retval != ERROR_OK)
 351                 return retval;
 352
 353         if (stm32x_info->has_large_mem) {
 354
 355                 uint32_t optiondata2 = 0;
 356                 buf_set_u32(&optiondata2, 16, 12, stm32x_info->option_bytes.protection >> 12);
 357                 retval = target_write_u32(target, STM32_FLASH_OPTCR1, optiondata2);
 358                 if (retval != ERROR_OK)
 359                         return retval;
 360         }
 361
 362         /* start programming cycle */
 363         retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPT_START);
 364         if (retval != ERROR_OK)
 365                 return retval;
 366
 367         /* wait for completion */
 368         retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
 369         if (retval != ERROR_OK)
 370                 return retval;
 371
 372         /* relock registers */
 373         retval = target_write_u32(target, STM32_FLASH_OPTCR, OPT_LOCK);
 374         if (retval != ERROR_OK)
 375                 return retval;
 376
 377         return ERROR_OK;
 378 }
 379
 380 static int stm32x_protect_check(struct flash_bank *bank)
 381 {
 382         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 383
 384         /* read write protection settings */
 385         int retval = stm32x_read_options(bank);
 386         if (retval != ERROR_OK) {
 387                 LOG_DEBUG("unable to read option bytes");
 388                 return retval;
 389         }
 390
 391         for (int i = 0; i < bank->num_sectors; i++) {
 392                 if (stm32x_info->option_bytes.protection & (1 << i))
 393                         bank->sectors[i].is_protected = 0;
 394                 else
 395                         bank->sectors[i].is_protected = 1;
 396         }
 397
 398         return ERROR_OK;
 399 }
 400
 401 static int stm32x_erase(struct flash_bank *bank, int first, int last)
 402 {
 403         struct target *target = bank->target;
 404         int i;
 405
 406         if (bank->target->state != TARGET_HALTED) {
 407                 LOG_ERROR("Target not halted");
 408                 return ERROR_TARGET_NOT_HALTED;
 409         }
 410
 411         int retval;
 412         retval = stm32x_unlock_reg(target);
 413         if (retval != ERROR_OK)
 414                 return retval;
 415
 416         /*
 417         Sector Erase
 418         To erase a sector, follow the procedure below:
 419         1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
 420           FLASH_SR register
 421         2. Set the SER bit and select the sector (out of the 12 sectors in the main memory block)
 422           you wish to erase (SNB) in the FLASH_CR register
 423         3. Set the STRT bit in the FLASH_CR register
 424         4. Wait for the BSY bit to be cleared
 425          */
 426
 427         for (i = first; i <= last; i++) {
 428                 retval = target_write_u32(target,
 429                                 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_SER | FLASH_SNB(i) | FLASH_STRT);
 430                 if (retval != ERROR_OK)
 431                         return retval;
 432
 433                 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
 434                 if (retval != ERROR_OK)
 435                         return retval;
 436
 437                 bank->sectors[i].is_erased = 1;
 438         }
 439
 440         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
 441         if (retval != ERROR_OK)
 442                 return retval;
 443
 444         return ERROR_OK;
 445 }
 446
 447 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
 448 {
 449         struct target *target = bank->target;
 450         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 451
 452         if (target->state != TARGET_HALTED) {
 453                 LOG_ERROR("Target not halted");
 454                 return ERROR_TARGET_NOT_HALTED;
 455         }
 456
 457         /* read protection settings */
 458         int retval = stm32x_read_options(bank);
 459         if (retval != ERROR_OK) {
 460                 LOG_DEBUG("unable to read option bytes");
 461                 return retval;
 462         }
 463
 464         for (int i = first; i <= last; i++) {
 465
 466                 if (set)
 467                         stm32x_info->option_bytes.protection &= ~(1 << i);
 468                 else
 469                         stm32x_info->option_bytes.protection |= (1 << i);
 470         }
 471
 472         retval = stm32x_write_options(bank);
 473         if (retval != ERROR_OK)
 474                 return retval;
 475
 476         return ERROR_OK;
 477 }
 478
 479 static int stm32x_write_block(struct flash_bank *bank, uint8_t *buffer,
 480                 uint32_t offset, uint32_t count)
 481 {
 482         struct target *target = bank->target;
 483         uint32_t buffer_size = 16384;
 484         struct working_area *write_algorithm;
 485         struct working_area *source;
 486         uint32_t address = bank->base + offset;
 487         struct reg_param reg_params[5];
 488         struct armv7m_algorithm armv7m_info;
 489         int retval = ERROR_OK;
 490
 491         /* see contrib/loaders/flash/stm32f2x.S for src */
 492
 493         static const uint8_t stm32x_flash_write_code[] = {
 494                                                                         /* wait_fifo: */
 495                 0xD0, 0xF8, 0x00, 0x80,         /* ldr          r8, [r0, #0] */
 496                 0xB8, 0xF1, 0x00, 0x0F,         /* cmp          r8, #0 */
 497                 0x1A, 0xD0,                                     /* beq          exit */
 498                 0x47, 0x68,                                     /* ldr          r7, [r0, #4] */
 499                 0x47, 0x45,                                     /* cmp          r7, r8 */
 500                 0xF7, 0xD0,                                     /* beq          wait_fifo */
 501
 502                 0xDF, 0xF8, 0x30, 0x60,         /* ldr          r6, STM32_PROG16 */
 503                 0x26, 0x61,                                     /* str          r6, [r4, #STM32_FLASH_CR_OFFSET] */
 504                 0x37, 0xF8, 0x02, 0x6B,         /* ldrh         r6, [r7], #0x02 */
 505                 0x22, 0xF8, 0x02, 0x6B,         /* strh         r6, [r2], #0x02 */
 506                                                                         /* busy: */
 507                 0xE6, 0x68,                                     /* ldr          r6, [r4, #STM32_FLASH_SR_OFFSET] */
 508                 0x16, 0xF4, 0x80, 0x3F,         /* tst          r6, #0x10000 */
 509                 0xFB, 0xD1,                                     /* bne          busy */
 510                 0x16, 0xF0, 0xF0, 0x0F,         /* tst          r6, #0xf0 */
 511                 0x07, 0xD1,                                     /* bne          error */
 512
 513                 0x8F, 0x42,                                     /* cmp          r7, r1 */
 514                 0x28, 0xBF,                                     /* it           cs */
 515                 0x00, 0xF1, 0x08, 0x07,         /* addcs        r7, r0, #8 */
 516                 0x47, 0x60,                                     /* str          r7, [r0, #4] */
 517                 0x01, 0x3B,                                     /* subs         r3, r3, #1 */
 518                 0x13, 0xB1,                                     /* cbz          r3, exit */
 519                 0xE1, 0xE7,                                     /* b            wait_fifo */
 520                                                                         /* error: */
 521                 0x00, 0x21,                                     /* movs         r1, #0 */
 522                 0x41, 0x60,                                     /* str          r1, [r0, #4] */
 523                                                                         /* exit: */
 524                 0x30, 0x46,                                     /* mov          r0, r6 */
 525                 0x00, 0xBE,                                     /* bkpt         #0x00 */
 526
 527                 /* <STM32_PROG16>: */
 528                 0x01, 0x01, 0x00, 0x00,         /* .word        0x00000101 */
 529         };
 530
 531         if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
 532                         &write_algorithm) != ERROR_OK) {
 533                 LOG_WARNING("no working area available, can't do block memory writes");
 534                 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
 535         };
 536
 537         retval = target_write_buffer(target, write_algorithm->address,
 538                         sizeof(stm32x_flash_write_code),
 539                         (uint8_t *)stm32x_flash_write_code);
 540         if (retval != ERROR_OK)
 541                 return retval;
 542
 543         /* memory buffer */
 544         while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
 545                 buffer_size /= 2;
 546                 if (buffer_size <= 256) {
 547                         /* we already allocated the writing code, but failed to get a
 548                          * buffer, free the algorithm */
 549                         target_free_working_area(target, write_algorithm);
 550
 551                         LOG_WARNING("no large enough working area available, can't do block memory writes");
 552                         return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
 553                 }
 554         };
 555
 556         armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
 557         armv7m_info.core_mode = ARM_MODE_THREAD;
 558
 559         init_reg_param(&reg_params[0], "r0", 32, PARAM_IN_OUT);         /* buffer start, status (out) */
 560         init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);            /* buffer end */
 561         init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);            /* target address */
 562         init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);            /* count (halfword-16bit) */
 563         init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT);            /* flash base */
 564
 565         buf_set_u32(reg_params[0].value, 0, 32, source->address);
 566         buf_set_u32(reg_params[1].value, 0, 32, source->address + source->size);
 567         buf_set_u32(reg_params[2].value, 0, 32, address);
 568         buf_set_u32(reg_params[3].value, 0, 32, count);
 569         buf_set_u32(reg_params[4].value, 0, 32, STM32_FLASH_BASE);
 570
 571         retval = target_run_flash_async_algorithm(target, buffer, count, 2,
 572                         0, NULL,
 573                         5, reg_params,
 574                         source->address, source->size,
 575                         write_algorithm->address, 0,
 576                         &armv7m_info);
 577
 578         if (retval == ERROR_FLASH_OPERATION_FAILED) {
 579                 LOG_ERROR("error executing stm32x flash write algorithm");
 580
 581                 uint32_t error = buf_get_u32(reg_params[0].value, 0, 32) & FLASH_ERROR;
 582
 583                 if (error & FLASH_WRPERR)
 584                         LOG_ERROR("flash memory write protected");
 585
 586                 if (error != 0) {
 587                         LOG_ERROR("flash write failed = %08x", error);
 588                         /* Clear but report errors */
 589                         target_write_u32(target, STM32_FLASH_SR, error);
 590                         retval = ERROR_FAIL;
 591                 }
 592         }
 593
 594         target_free_working_area(target, source);
 595         target_free_working_area(target, write_algorithm);
 596
 597         destroy_reg_param(&reg_params[0]);
 598         destroy_reg_param(&reg_params[1]);
 599         destroy_reg_param(&reg_params[2]);
 600         destroy_reg_param(&reg_params[3]);
 601         destroy_reg_param(&reg_params[4]);
 602
 603         return retval;
 604 }
 605
 606 static int stm32x_write(struct flash_bank *bank, uint8_t *buffer,
 607                 uint32_t offset, uint32_t count)
 608 {
 609         struct target *target = bank->target;
 610         uint32_t words_remaining = (count / 2);
 611         uint32_t bytes_remaining = (count & 0x00000001);
 612         uint32_t address = bank->base + offset;
 613         uint32_t bytes_written = 0;
 614         int retval;
 615
 616         if (bank->target->state != TARGET_HALTED) {
 617                 LOG_ERROR("Target not halted");
 618                 return ERROR_TARGET_NOT_HALTED;
 619         }
 620
 621         if (offset & 0x1) {
 622                 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
 623                 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
 624         }
 625
 626         retval = stm32x_unlock_reg(target);
 627         if (retval != ERROR_OK)
 628                 return retval;
 629
 630         /* multiple half words (2-byte) to be programmed? */
 631         if (words_remaining > 0) {
 632                 /* try using a block write */
 633                 retval = stm32x_write_block(bank, buffer, offset, words_remaining);
 634                 if (retval != ERROR_OK) {
 635                         if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
 636                                 /* if block write failed (no sufficient working area),
 637                                  * we use normal (slow) single dword accesses */
 638                                 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
 639                         }
 640                 } else {
 641                         buffer += words_remaining * 2;
 642                         address += words_remaining * 2;
 643                         words_remaining = 0;
 644                 }
 645         }
 646
 647         if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
 648                 return retval;
 649
 650         /*
 651         Standard programming
 652         The Flash memory programming sequence is as follows:
 653         1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
 654           FLASH_SR register.
 655         2. Set the PG bit in the FLASH_CR register
 656         3. Perform the data write operation(s) to the desired memory address (inside main
 657           memory block or OTP area):
 658         – – Half-word access in case of x16 parallelism
 659         – Word access in case of x32 parallelism
 660         –
 661         4.
 662         Byte access in case of x8 parallelism
 663         Double word access in case of x64 parallelism
 664         Wait for the BSY bit to be cleared
 665         */
 666         while (words_remaining > 0) {
 667                 uint16_t value;
 668                 memcpy(&value, buffer + bytes_written, sizeof(uint16_t));
 669
 670                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
 671                                 FLASH_PG | FLASH_PSIZE_16);
 672                 if (retval != ERROR_OK)
 673                         return retval;
 674
 675                 retval = target_write_u16(target, address, value);
 676                 if (retval != ERROR_OK)
 677                         return retval;
 678
 679                 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
 680                 if (retval != ERROR_OK)
 681                         return retval;
 682
 683                 bytes_written += 2;
 684                 words_remaining--;
 685                 address += 2;
 686         }
 687
 688         if (bytes_remaining) {
 689                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
 690                                 FLASH_PG | FLASH_PSIZE_8);
 691                 if (retval != ERROR_OK)
 692                         return retval;
 693                 retval = target_write_u8(target, address, buffer[bytes_written]);
 694                 if (retval != ERROR_OK)
 695                         return retval;
 696
 697                 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
 698                 if (retval != ERROR_OK)
 699                         return retval;
 700         }
 701
 702         return target_write_u32(target, STM32_FLASH_CR, FLASH_LOCK);
 703 }
 704
 705 static void setup_sector(struct flash_bank *bank, int start, int num, int size)
 706 {
 707         for (int i = start; i < (start + num) ; i++) {
 708                 assert(i < bank->num_sectors);
 709                 bank->sectors[i].offset = bank->size;
 710                 bank->sectors[i].size = size;
 711                 bank->size += bank->sectors[i].size;
 712         }
 713 }
 714
 715 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
 716 {
 717         /* this checks for a stm32f4x errata issue where a
 718          * stm32f2x DBGMCU_IDCODE is incorrectly returned.
 719          * If the issue is detected target is forced to stm32f4x Rev A.
 720          * Only effects Rev A silicon */
 721
 722         struct target *target = bank->target;
 723         uint32_t cpuid;
 724
 725         /* read stm32 device id register */
 726         int retval = target_read_u32(target, 0xE0042000, device_id);
 727         if (retval != ERROR_OK)
 728                 return retval;
 729
 730         if ((*device_id & 0xfff) == 0x411) {
 731                 /* read CPUID reg to check core type */
 732                 retval = target_read_u32(target, 0xE000ED00, &cpuid);
 733                 if (retval != ERROR_OK)
 734                         return retval;
 735
 736                 /* check for cortex_m4 */
 737                 if (((cpuid >> 4) & 0xFFF) == 0xC24) {
 738                         *device_id &= ~((0xFFFF << 16) | 0xfff);
 739                         *device_id |= (0x1000 << 16) | 0x413;
 740                         LOG_INFO("stm32f4x errata detected - fixing incorrect MCU_IDCODE");
 741                 }
 742         }
 743         return retval;
 744 }
 745
 746 static int stm32x_probe(struct flash_bank *bank)
 747 {
 748         struct target *target = bank->target;
 749         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 750         int i;
 751         uint16_t flash_size_in_kb;
 752         uint16_t max_flash_size_in_kb;
 753         uint32_t device_id;
 754         uint32_t base_address = 0x08000000;
 755
 756         stm32x_info->probed = 0;
 757         stm32x_info->has_large_mem = false;
 758
 759         /* read stm32 device id register */
 760         int retval = stm32x_get_device_id(bank, &device_id);
 761         if (retval != ERROR_OK)
 762                 return retval;
 763         LOG_INFO("device id = 0x%08" PRIx32 "", device_id);
 764
 765         /* set max flash size depending on family */
 766         switch (device_id & 0xfff) {
 767         case 0x411:
 768         case 0x413:
 769                 max_flash_size_in_kb = 1024;
 770                 break;
 771         case 0x419:
 772                 max_flash_size_in_kb = 2048;
 773                 break;
 774         case 0x423:
 775                 max_flash_size_in_kb = 256;
 776                 break;
 777         default:
 778                 LOG_WARNING("Cannot identify target as a STM32 family.");
 779                 return ERROR_FAIL;
 780         }
 781
 782         /* get flash size from target. */
 783         retval = target_read_u16(target, 0x1FFF7A22, &flash_size_in_kb);
 784
 785         /* failed reading flash size or flash size invalid (early silicon),
 786          * default to max target family */
 787         if (retval != ERROR_OK || flash_size_in_kb == 0xffff || flash_size_in_kb == 0) {
 788                 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming %dk flash",
 789                         max_flash_size_in_kb);
 790                 flash_size_in_kb = max_flash_size_in_kb;
 791         }
 792
 793         /* if the user sets the size manually then ignore the probed value
 794          * this allows us to work around devices that have a invalid flash size register value */
 795         if (stm32x_info->user_bank_size) {
 796                 LOG_INFO("ignoring flash probed value, using configured bank size");
 797                 flash_size_in_kb = stm32x_info->user_bank_size / 1024;
 798         }
 799
 800         /* only devices with > 1024kB have dual banks */
 801         if (flash_size_in_kb > 1024)
 802                 stm32x_info->has_large_mem = true;
 803
 804         LOG_INFO("flash size = %dkbytes", flash_size_in_kb);
 805
 806         /* did we assign flash size? */
 807         assert(flash_size_in_kb != 0xffff);
 808
 809         /* calculate numbers of pages */
 810         int num_pages = (flash_size_in_kb / 128) + 4;
 811
 812         /* check for larger 2048 bytes devices */
 813         if (stm32x_info->has_large_mem)
 814                 num_pages += 4;
 815
 816         /* check that calculation result makes sense */
 817         assert(num_pages > 0);
 818
 819         if (bank->sectors) {
 820                 free(bank->sectors);
 821                 bank->sectors = NULL;
 822         }
 823
 824         bank->base = base_address;
 825         bank->num_sectors = num_pages;
 826         bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
 827         bank->size = 0;
 828
 829         /* fixed memory */
 830         setup_sector(bank, 0, 4, 16 * 1024);
 831         setup_sector(bank, 4, 1, 64 * 1024);
 832
 833         /* dynamic memory */
 834         setup_sector(bank, 4 + 1, MIN(12, num_pages) - 5, 128 * 1024);
 835
 836         if (stm32x_info->has_large_mem) {
 837
 838                 /* fixed memory for larger devices */
 839                 setup_sector(bank, 12, 4, 16 * 1024);
 840                 setup_sector(bank, 16, 1, 64 * 1024);
 841
 842                 /* dynamic memory for larger devices */
 843                 setup_sector(bank, 16 + 1, num_pages - 5 - 12, 128 * 1024);
 844         }
 845
 846         for (i = 0; i < num_pages; i++) {
 847                 bank->sectors[i].is_erased = -1;
 848                 bank->sectors[i].is_protected = 0;
 849         }
 850
 851         stm32x_info->probed = 1;
 852
 853         return ERROR_OK;
 854 }
 855
 856 static int stm32x_auto_probe(struct flash_bank *bank)
 857 {
 858         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 859         if (stm32x_info->probed)
 860                 return ERROR_OK;
 861         return stm32x_probe(bank);
 862 }
 863
 864 static int get_stm32x_info(struct flash_bank *bank, char *buf, int buf_size)
 865 {
 866         uint32_t dbgmcu_idcode;
 867
 868         /* read stm32 device id register */
 869         int retval = stm32x_get_device_id(bank, &dbgmcu_idcode);
 870         if (retval != ERROR_OK)
 871                 return retval;
 872
 873         uint16_t device_id = dbgmcu_idcode & 0xfff;
 874         uint16_t rev_id = dbgmcu_idcode >> 16;
 875         const char *device_str;
 876         const char *rev_str = NULL;
 877
 878         switch (device_id) {
 879         case 0x411:
 880                 device_str = "STM32F2xx";
 881
 882                 switch (rev_id) {
 883                 case 0x1000:
 884                         rev_str = "A";
 885                         break;
 886
 887                 case 0x2000:
 888                         rev_str = "B";
 889                         break;
 890
 891                 case 0x1001:
 892                         rev_str = "Z";
 893                         break;
 894
 895                 case 0x2001:
 896                         rev_str = "Y";
 897                         break;
 898
 899                 case 0x2003:
 900                         rev_str = "X";
 901                         break;
 902                 }
 903                 break;
 904
 905         case 0x413:
 906         case 0x419:
 907                 device_str = "STM32F4xx";
 908
 909                 switch (rev_id) {
 910                 case 0x1000:
 911                         rev_str = "A";
 912                         break;
 913
 914                 case 0x1001:
 915                         rev_str = "Z";
 916                         break;
 917
 918                 case 0x1003:
 919                         rev_str = "Y";
 920                         break;
 921                 }
 922                 break;
 923
 924         case 0x423:
 925                 device_str = "STM32F4xx (Low Power)";
 926
 927                 switch (rev_id) {
 928                 case 0x1000:
 929                         rev_str = "A";
 930                         break;
 931
 932                 case 0x1001:
 933                         rev_str = "Z";
 934                         break;
 935                 }
 936                 break;
 937
 938         default:
 939                 snprintf(buf, buf_size, "Cannot identify target as a STM32F2/4\n");
 940                 return ERROR_FAIL;
 941         }
 942
 943         if (rev_str != NULL)
 944                 snprintf(buf, buf_size, "%s - Rev: %s", device_str, rev_str);
 945         else
 946                 snprintf(buf, buf_size, "%s - Rev: unknown (0x%04x)", device_str, rev_id);
 947
 948         return ERROR_OK;
 949 }
 950
 951 COMMAND_HANDLER(stm32x_handle_lock_command)
 952 {
 953         struct target *target = NULL;
 954         struct stm32x_flash_bank *stm32x_info = NULL;
 955
 956         if (CMD_ARGC < 1)
 957                 return ERROR_COMMAND_SYNTAX_ERROR;
 958
 959         struct flash_bank *bank;
 960         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 961         if (ERROR_OK != retval)
 962                 return retval;
 963
 964         stm32x_info = bank->driver_priv;
 965         target = bank->target;
 966
 967         if (target->state != TARGET_HALTED) {
 968                 LOG_ERROR("Target not halted");
 969                 return ERROR_TARGET_NOT_HALTED;
 970         }
 971
 972         if (stm32x_read_options(bank) != ERROR_OK) {
 973                 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
 974                 return ERROR_OK;
 975         }
 976
 977         /* set readout protection */
 978         stm32x_info->option_bytes.RDP = 0;
 979
 980         if (stm32x_write_options(bank) != ERROR_OK) {
 981                 command_print(CMD_CTX, "%s failed to lock device", bank->driver->name);
 982                 return ERROR_OK;
 983         }
 984
 985         command_print(CMD_CTX, "%s locked", bank->driver->name);
 986
 987         return ERROR_OK;
 988 }
 989
 990 COMMAND_HANDLER(stm32x_handle_unlock_command)
 991 {
 992         struct target *target = NULL;
 993         struct stm32x_flash_bank *stm32x_info = NULL;
 994
 995         if (CMD_ARGC < 1)
 996                 return ERROR_COMMAND_SYNTAX_ERROR;
 997
 998         struct flash_bank *bank;
 999         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1000         if (ERROR_OK != retval)
1001                 return retval;
1002
1003         stm32x_info = bank->driver_priv;
1004         target = bank->target;
1005
1006         if (target->state != TARGET_HALTED) {
1007                 LOG_ERROR("Target not halted");
1008                 return ERROR_TARGET_NOT_HALTED;
1009         }
1010
1011         if (stm32x_read_options(bank) != ERROR_OK) {
1012                 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
1013                 return ERROR_OK;
1014         }
1015
1016         /* clear readout protection and complementary option bytes
1017          * this will also force a device unlock if set */
1018         stm32x_info->option_bytes.RDP = 0xAA;
1019
1020         if (stm32x_write_options(bank) != ERROR_OK) {
1021                 command_print(CMD_CTX, "%s failed to unlock device", bank->driver->name);
1022                 return ERROR_OK;
1023         }
1024
1025         command_print(CMD_CTX, "%s unlocked.\n"
1026                         "INFO: a reset or power cycle is required "
1027                         "for the new settings to take effect.", bank->driver->name);
1028
1029         return ERROR_OK;
1030 }
1031
1032 static int stm32x_mass_erase(struct flash_bank *bank)
1033 {
1034         int retval;
1035         struct target *target = bank->target;
1036         struct stm32x_flash_bank *stm32x_info = NULL;
1037
1038         if (target->state != TARGET_HALTED) {
1039                 LOG_ERROR("Target not halted");
1040                 return ERROR_TARGET_NOT_HALTED;
1041         }
1042
1043         stm32x_info = bank->driver_priv;
1044
1045         retval = stm32x_unlock_reg(target);
1046         if (retval != ERROR_OK)
1047                 return retval;
1048
1049         /* mass erase flash memory */
1050         if (stm32x_info->has_large_mem)
1051                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER | FLASH_MER1);
1052         else
1053                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER);
1054         if (retval != ERROR_OK)
1055                 return retval;
1056         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
1057                 FLASH_MER | FLASH_STRT);
1058         if (retval != ERROR_OK)
1059                 return retval;
1060
1061         retval = stm32x_wait_status_busy(bank, 30000);
1062         if (retval != ERROR_OK)
1063                 return retval;
1064
1065         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
1066         if (retval != ERROR_OK)
1067                 return retval;
1068
1069         return ERROR_OK;
1070 }
1071
1072 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
1073 {
1074         int i;
1075
1076         if (CMD_ARGC < 1) {
1077                 command_print(CMD_CTX, "stm32x mass_erase <bank>");
1078                 return ERROR_COMMAND_SYNTAX_ERROR;
1079         }
1080
1081         struct flash_bank *bank;
1082         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1083         if (ERROR_OK != retval)
1084                 return retval;
1085
1086         retval = stm32x_mass_erase(bank);
1087         if (retval == ERROR_OK) {
1088                 /* set all sectors as erased */
1089                 for (i = 0; i < bank->num_sectors; i++)
1090                         bank->sectors[i].is_erased = 1;
1091
1092                 command_print(CMD_CTX, "stm32x mass erase complete");
1093         } else {
1094                 command_print(CMD_CTX, "stm32x mass erase failed");
1095         }
1096
1097         return retval;
1098 }
1099
1100 static const struct command_registration stm32x_exec_command_handlers[] = {
1101         {
1102                 .name = "lock",
1103                 .handler = stm32x_handle_lock_command,
1104                 .mode = COMMAND_EXEC,
1105                 .usage = "bank_id",
1106                 .help = "Lock entire flash device.",
1107         },
1108         {
1109                 .name = "unlock",
1110                 .handler = stm32x_handle_unlock_command,
1111                 .mode = COMMAND_EXEC,
1112                 .usage = "bank_id",
1113                 .help = "Unlock entire protected flash device.",
1114         },
1115         {
1116                 .name = "mass_erase",
1117                 .handler = stm32x_handle_mass_erase_command,
1118                 .mode = COMMAND_EXEC,
1119                 .usage = "bank_id",
1120                 .help = "Erase entire flash device.",
1121         },
1122         COMMAND_REGISTRATION_DONE
1123 };
1124
1125 static const struct command_registration stm32x_command_handlers[] = {
1126         {
1127                 .name = "stm32f2x",
1128                 .mode = COMMAND_ANY,
1129                 .help = "stm32f2x flash command group",
1130                 .usage = "",
1131                 .chain = stm32x_exec_command_handlers,
1132         },
1133         COMMAND_REGISTRATION_DONE
1134 };
1135
1136 struct flash_driver stm32f2x_flash = {
1137         .name = "stm32f2x",
1138         .commands = stm32x_command_handlers,
1139         .flash_bank_command = stm32x_flash_bank_command,
1140         .erase = stm32x_erase,
1141         .protect = stm32x_protect,
1142         .write = stm32x_write,
1143         .read = default_flash_read,
1144         .probe = stm32x_probe,
1145         .auto_probe = stm32x_auto_probe,
1146         .erase_check = default_flash_blank_check,
1147         .protect_check = stm32x_protect_check,
1148         .info = get_stm32x_info,
1149 };