git.sur5r.net Git - openocd/blob - src/flash/nor/stm32f2x.c

   1 /***************************************************************************
   2  *   Copyright (C) 2005 by Dominic Rath                                    *
   3  *   Dominic.Rath@gmx.de                                                   *
   4  *                                                                         *
   5  *   Copyright (C) 2008 by Spencer Oliver                                  *
   6  *   spen@spen-soft.co.uk                                                  *
   7  *                                                                         *
   8  *   Copyright (C) 2011 Øyvind Harboe                                      *
   9  *   oyvind.harboe@zylin.com                                               *
  10  *                                                                         *
  11  *   This program is free software; you can redistribute it and/or modify  *
  12  *   it under the terms of the GNU General Public License as published by  *
  13  *   the Free Software Foundation; either version 2 of the License, or     *
  14  *   (at your option) any later version.                                   *
  15  *                                                                         *
  16  *   This program is distributed in the hope that it will be useful,       *
  17  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  18  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  19  *   GNU General Public License for more details.                          *
  20  *                                                                         *
  21  *   You should have received a copy of the GNU General Public License     *
  22  *   along with this program; if not, write to the                         *
  23  *   Free Software Foundation, Inc.,                                       *
  24  *   51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.           *
  25  ***************************************************************************/
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include "imp.h"
  32 #include <helper/binarybuffer.h>
  33 #include <target/algorithm.h>
  34 #include <target/armv7m.h>
  35
  36 /* Regarding performance:
  37  *
  38  * Short story - it might be best to leave the performance at
  39  * current levels.
  40  *
  41  * You may see a jump in speed if you change to using
  42  * 32bit words for the block programming.
  43  *
  44  * Its a shame you cannot use the double word as its
  45  * even faster - but you require external VPP for that mode.
  46  *
  47  * Having said all that 16bit writes give us the widest vdd
  48  * operating range, so may be worth adding a note to that effect.
  49  *
  50  */
  51
  52 /* Danger!!!! The STM32F1x and STM32F2x series actually have
  53  * quite different flash controllers.
  54  *
  55  * What's more scary is that the names of the registers and their
  56  * addresses are the same, but the actual bits and what they do are
  57  * can be very different.
  58  *
  59  * To reduce testing complexity and dangers of regressions,
  60  * a seperate file is used for stm32fx2x.
  61  *
  62  * 1mByte part with 4 x 16, 1 x 64, 7 x 128kBytes sectors
  63  *
  64  * What's the protection page size???
  65  *
  66  * Tested with STM3220F-EVAL board.
  67  *
  68  * STM32F21xx series for reference.
  69  *
  70  * RM0033
  71  * http://www.st.com/internet/mcu/product/250192.jsp
  72  *
  73  * PM0059
  74  * www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/
  75  * PROGRAMMING_MANUAL/CD00233952.pdf
  76  *
  77  * STM32F1x series - notice that this code was copy, pasted and knocked
  78  * into a stm32f2x driver, so in case something has been converted or
  79  * bugs haven't been fixed, here are the original manuals:
  80  *
  81  * RM0008 - Reference manual
  82  *
  83  * RM0042, the Flash programming manual for low-, medium- high-density and
  84  * connectivity line STM32F10x devices
  85  *
  86  * PM0068, the Flash programming manual for XL-density STM32F10x devices.
  87  *
  88  */
  89
  90 /* Erase time can be as high as 1000ms, 10x this and it's toast... */
  91 #define FLASH_ERASE_TIMEOUT 10000
  92 #define FLASH_WRITE_TIMEOUT 5
  93
  94 #define STM32_FLASH_BASE    0x40023c00
  95 #define STM32_FLASH_ACR     0x40023c00
  96 #define STM32_FLASH_KEYR    0x40023c04
  97 #define STM32_FLASH_OPTKEYR 0x40023c08
  98 #define STM32_FLASH_SR      0x40023c0C
  99 #define STM32_FLASH_CR      0x40023c10
 100 #define STM32_FLASH_OPTCR   0x40023c14
 101 #define STM32_FLASH_OPTCR1  0x40023c18
 102
 103 /* FLASH_CR register bits */
 104
 105 #define FLASH_PG       (1 << 0)
 106 #define FLASH_SER      (1 << 1)
 107 #define FLASH_MER      (1 << 2)
 108 #define FLASH_MER1     (1 << 15)
 109 #define FLASH_STRT     (1 << 16)
 110 #define FLASH_PSIZE_8  (0 << 8)
 111 #define FLASH_PSIZE_16 (1 << 8)
 112 #define FLASH_PSIZE_32 (2 << 8)
 113 #define FLASH_PSIZE_64 (3 << 8)
 114 #define FLASH_SNB(a)   ((a) << 3)
 115 #define FLASH_LOCK     (1 << 31)
 116
 117 /* FLASH_SR register bits */
 118
 119 #define FLASH_BSY      (1 << 16)
 120 #define FLASH_PGSERR   (1 << 7) /* Programming sequence error */
 121 #define FLASH_PGPERR   (1 << 6) /* Programming parallelism error */
 122 #define FLASH_PGAERR   (1 << 5) /* Programming alignment error */
 123 #define FLASH_WRPERR   (1 << 4) /* Write protection error */
 124 #define FLASH_OPERR    (1 << 1) /* Operation error */
 125
 126 #define FLASH_ERROR (FLASH_PGSERR | FLASH_PGPERR | FLASH_PGAERR | FLASH_WRPERR | FLASH_OPERR)
 127
 128 /* STM32_FLASH_OPTCR register bits */
 129
 130 #define OPT_LOCK      (1 << 0)
 131 #define OPT_START     (1 << 1)
 132
 133 /* STM32_FLASH_OBR bit definitions (reading) */
 134
 135 #define OPT_ERROR      0
 136 #define OPT_READOUT    1
 137 #define OPT_RDWDGSW    2
 138 #define OPT_RDRSTSTOP  3
 139 #define OPT_RDRSTSTDBY 4
 140 #define OPT_BFB2       5        /* dual flash bank only */
 141
 142 /* register unlock keys */
 143
 144 #define KEY1           0x45670123
 145 #define KEY2           0xCDEF89AB
 146
 147 /* option register unlock key */
 148 #define OPTKEY1        0x08192A3B
 149 #define OPTKEY2        0x4C5D6E7F
 150
 151 struct stm32x_options {
 152         uint8_t RDP;
 153         uint8_t user_options;
 154         uint32_t protection;
 155 };
 156
 157 struct stm32x_flash_bank {
 158         struct stm32x_options option_bytes;
 159         int probed;
 160         bool has_large_mem;             /* stm32f42x/stm32f43x family */
 161         uint32_t user_bank_size;
 162 };
 163
 164 /* flash bank stm32x <base> <size> 0 0 <target#>
 165  */
 166 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
 167 {
 168         struct stm32x_flash_bank *stm32x_info;
 169
 170         if (CMD_ARGC < 6)
 171                 return ERROR_COMMAND_SYNTAX_ERROR;
 172
 173         stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
 174         bank->driver_priv = stm32x_info;
 175
 176         stm32x_info->probed = 0;
 177         stm32x_info->user_bank_size = bank->size;
 178
 179         return ERROR_OK;
 180 }
 181
 182 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
 183 {
 184         return reg;
 185 }
 186
 187 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
 188 {
 189         struct target *target = bank->target;
 190         return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
 191 }
 192
 193 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
 194 {
 195         struct target *target = bank->target;
 196         uint32_t status;
 197         int retval = ERROR_OK;
 198
 199         /* wait for busy to clear */
 200         for (;;) {
 201                 retval = stm32x_get_flash_status(bank, &status);
 202                 if (retval != ERROR_OK)
 203                         return retval;
 204                 LOG_DEBUG("status: 0x%" PRIx32 "", status);
 205                 if ((status & FLASH_BSY) == 0)
 206                         break;
 207                 if (timeout-- <= 0) {
 208                         LOG_ERROR("timed out waiting for flash");
 209                         return ERROR_FAIL;
 210                 }
 211                 alive_sleep(1);
 212         }
 213
 214
 215         if (status & FLASH_WRPERR) {
 216                 LOG_ERROR("stm32x device protected");
 217                 retval = ERROR_FAIL;
 218         }
 219
 220         /* Clear but report errors */
 221         if (status & FLASH_ERROR) {
 222                 /* If this operation fails, we ignore it and report the original
 223                  * retval
 224                  */
 225                 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
 226                                 status & FLASH_ERROR);
 227         }
 228         return retval;
 229 }
 230
 231 static int stm32x_unlock_reg(struct target *target)
 232 {
 233         uint32_t ctrl;
 234
 235         /* first check if not already unlocked
 236          * otherwise writing on STM32_FLASH_KEYR will fail
 237          */
 238         int retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
 239         if (retval != ERROR_OK)
 240                 return retval;
 241
 242         if ((ctrl & FLASH_LOCK) == 0)
 243                 return ERROR_OK;
 244
 245         /* unlock flash registers */
 246         retval = target_write_u32(target, STM32_FLASH_KEYR, KEY1);
 247         if (retval != ERROR_OK)
 248                 return retval;
 249
 250         retval = target_write_u32(target, STM32_FLASH_KEYR, KEY2);
 251         if (retval != ERROR_OK)
 252                 return retval;
 253
 254         retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
 255         if (retval != ERROR_OK)
 256                 return retval;
 257
 258         if (ctrl & FLASH_LOCK) {
 259                 LOG_ERROR("flash not unlocked STM32_FLASH_CR: %x", ctrl);
 260                 return ERROR_TARGET_FAILURE;
 261         }
 262
 263         return ERROR_OK;
 264 }
 265
 266 static int stm32x_unlock_option_reg(struct target *target)
 267 {
 268         uint32_t ctrl;
 269
 270         int retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
 271         if (retval != ERROR_OK)
 272                 return retval;
 273
 274         if ((ctrl & OPT_LOCK) == 0)
 275                 return ERROR_OK;
 276
 277         /* unlock option registers */
 278         retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY1);
 279         if (retval != ERROR_OK)
 280                 return retval;
 281
 282         retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY2);
 283         if (retval != ERROR_OK)
 284                 return retval;
 285
 286         retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
 287         if (retval != ERROR_OK)
 288                 return retval;
 289
 290         if (ctrl & OPT_LOCK) {
 291                 LOG_ERROR("options not unlocked STM32_FLASH_OPTCR: %x", ctrl);
 292                 return ERROR_TARGET_FAILURE;
 293         }
 294
 295         return ERROR_OK;
 296 }
 297
 298 static int stm32x_read_options(struct flash_bank *bank)
 299 {
 300         uint32_t optiondata;
 301         struct stm32x_flash_bank *stm32x_info = NULL;
 302         struct target *target = bank->target;
 303
 304         stm32x_info = bank->driver_priv;
 305
 306         /* read current option bytes */
 307         int retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
 308         if (retval != ERROR_OK)
 309                 return retval;
 310
 311         stm32x_info->option_bytes.user_options = optiondata & 0xec;
 312         stm32x_info->option_bytes.RDP = (optiondata >> 8) & 0xff;
 313         stm32x_info->option_bytes.protection = (optiondata >> 16) & 0xfff;
 314
 315         if (stm32x_info->has_large_mem) {
 316
 317                 retval = target_read_u32(target, STM32_FLASH_OPTCR1, &optiondata);
 318                 if (retval != ERROR_OK)
 319                         return retval;
 320
 321                 /* append protection bits */
 322                 stm32x_info->option_bytes.protection |= (optiondata >> 4) & 0x00fff000;
 323         }
 324
 325         if (stm32x_info->option_bytes.RDP != 0xAA)
 326                 LOG_INFO("Device Security Bit Set");
 327
 328         return ERROR_OK;
 329 }
 330
 331 static int stm32x_write_options(struct flash_bank *bank)
 332 {
 333         struct stm32x_flash_bank *stm32x_info = NULL;
 334         struct target *target = bank->target;
 335         uint32_t optiondata;
 336
 337         stm32x_info = bank->driver_priv;
 338
 339         int retval = stm32x_unlock_option_reg(target);
 340         if (retval != ERROR_OK)
 341                 return retval;
 342
 343         /* rebuild option data */
 344         optiondata = stm32x_info->option_bytes.user_options;
 345         buf_set_u32(&optiondata, 8, 8, stm32x_info->option_bytes.RDP);
 346         buf_set_u32(&optiondata, 16, 12, stm32x_info->option_bytes.protection);
 347
 348         /* program options */
 349         retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata);
 350         if (retval != ERROR_OK)
 351                 return retval;
 352
 353         if (stm32x_info->has_large_mem) {
 354
 355                 uint32_t optiondata2 = 0;
 356                 buf_set_u32(&optiondata2, 16, 12, stm32x_info->option_bytes.protection >> 12);
 357                 retval = target_write_u32(target, STM32_FLASH_OPTCR1, optiondata2);
 358                 if (retval != ERROR_OK)
 359                         return retval;
 360         }
 361
 362         /* start programming cycle */
 363         retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPT_START);
 364         if (retval != ERROR_OK)
 365                 return retval;
 366
 367         /* wait for completion */
 368         retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
 369         if (retval != ERROR_OK)
 370                 return retval;
 371
 372         /* relock registers */
 373         retval = target_write_u32(target, STM32_FLASH_OPTCR, OPT_LOCK);
 374         if (retval != ERROR_OK)
 375                 return retval;
 376
 377         return ERROR_OK;
 378 }
 379
 380 static int stm32x_protect_check(struct flash_bank *bank)
 381 {
 382         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 383
 384         /* read write protection settings */
 385         int retval = stm32x_read_options(bank);
 386         if (retval != ERROR_OK) {
 387                 LOG_DEBUG("unable to read option bytes");
 388                 return retval;
 389         }
 390
 391         for (int i = 0; i < bank->num_sectors; i++) {
 392                 if (stm32x_info->option_bytes.protection & (1 << i))
 393                         bank->sectors[i].is_protected = 0;
 394                 else
 395                         bank->sectors[i].is_protected = 1;
 396         }
 397
 398         return ERROR_OK;
 399 }
 400
 401 static int stm32x_erase(struct flash_bank *bank, int first, int last)
 402 {
 403         struct target *target = bank->target;
 404         int i;
 405
 406         if (bank->target->state != TARGET_HALTED) {
 407                 LOG_ERROR("Target not halted");
 408                 return ERROR_TARGET_NOT_HALTED;
 409         }
 410
 411         int retval;
 412         retval = stm32x_unlock_reg(target);
 413         if (retval != ERROR_OK)
 414                 return retval;
 415
 416         /*
 417         Sector Erase
 418         To erase a sector, follow the procedure below:
 419         1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
 420           FLASH_SR register
 421         2. Set the SER bit and select the sector (out of the 12 sectors in the main memory block)
 422           you wish to erase (SNB) in the FLASH_CR register
 423         3. Set the STRT bit in the FLASH_CR register
 424         4. Wait for the BSY bit to be cleared
 425          */
 426
 427         for (i = first; i <= last; i++) {
 428                 retval = target_write_u32(target,
 429                                 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_SER | FLASH_SNB(i) | FLASH_STRT);
 430                 if (retval != ERROR_OK)
 431                         return retval;
 432
 433                 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
 434                 if (retval != ERROR_OK)
 435                         return retval;
 436
 437                 bank->sectors[i].is_erased = 1;
 438         }
 439
 440         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
 441         if (retval != ERROR_OK)
 442                 return retval;
 443
 444         return ERROR_OK;
 445 }
 446
 447 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
 448 {
 449         struct target *target = bank->target;
 450         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 451
 452         if (target->state != TARGET_HALTED) {
 453                 LOG_ERROR("Target not halted");
 454                 return ERROR_TARGET_NOT_HALTED;
 455         }
 456
 457         /* read protection settings */
 458         int retval = stm32x_read_options(bank);
 459         if (retval != ERROR_OK) {
 460                 LOG_DEBUG("unable to read option bytes");
 461                 return retval;
 462         }
 463
 464         for (int i = first; i <= last; i++) {
 465
 466                 if (set)
 467                         stm32x_info->option_bytes.protection &= ~(1 << i);
 468                 else
 469                         stm32x_info->option_bytes.protection |= (1 << i);
 470         }
 471
 472         retval = stm32x_write_options(bank);
 473         if (retval != ERROR_OK)
 474                 return retval;
 475
 476         return ERROR_OK;
 477 }
 478
 479 static int stm32x_write_block(struct flash_bank *bank, uint8_t *buffer,
 480                 uint32_t offset, uint32_t count)
 481 {
 482         struct target *target = bank->target;
 483         uint32_t buffer_size = 16384;
 484         struct working_area *write_algorithm;
 485         struct working_area *source;
 486         uint32_t address = bank->base + offset;
 487         struct reg_param reg_params[5];
 488         struct armv7m_algorithm armv7m_info;
 489         int retval = ERROR_OK;
 490
 491         /* see contrib/loaders/flash/stm32f2x.S for src */
 492
 493         static const uint8_t stm32x_flash_write_code[] = {
 494                                                                         /* wait_fifo: */
 495                 0xD0, 0xF8, 0x00, 0x80,         /* ldr          r8, [r0, #0] */
 496                 0xB8, 0xF1, 0x00, 0x0F,         /* cmp          r8, #0 */
 497                 0x1A, 0xD0,                                     /* beq          exit */
 498                 0x47, 0x68,                                     /* ldr          r7, [r0, #4] */
 499                 0x47, 0x45,                                     /* cmp          r7, r8 */
 500                 0xF7, 0xD0,                                     /* beq          wait_fifo */
 501
 502                 0xDF, 0xF8, 0x30, 0x60,         /* ldr          r6, STM32_PROG16 */
 503                 0x26, 0x61,                                     /* str          r6, [r4, #STM32_FLASH_CR_OFFSET] */
 504                 0x37, 0xF8, 0x02, 0x6B,         /* ldrh         r6, [r7], #0x02 */
 505                 0x22, 0xF8, 0x02, 0x6B,         /* strh         r6, [r2], #0x02 */
 506                                                                         /* busy: */
 507                 0xE6, 0x68,                                     /* ldr          r6, [r4, #STM32_FLASH_SR_OFFSET] */
 508                 0x16, 0xF4, 0x80, 0x3F,         /* tst          r6, #0x10000 */
 509                 0xFB, 0xD1,                                     /* bne          busy */
 510                 0x16, 0xF0, 0xF0, 0x0F,         /* tst          r6, #0xf0 */
 511                 0x07, 0xD1,                                     /* bne          error */
 512
 513                 0x8F, 0x42,                                     /* cmp          r7, r1 */
 514                 0x28, 0xBF,                                     /* it           cs */
 515                 0x00, 0xF1, 0x08, 0x07,         /* addcs        r7, r0, #8 */
 516                 0x47, 0x60,                                     /* str          r7, [r0, #4] */
 517                 0x01, 0x3B,                                     /* subs         r3, r3, #1 */
 518                 0x13, 0xB1,                                     /* cbz          r3, exit */
 519                 0xE1, 0xE7,                                     /* b            wait_fifo */
 520                                                                         /* error: */
 521                 0x00, 0x21,                                     /* movs         r1, #0 */
 522                 0x41, 0x60,                                     /* str          r1, [r0, #4] */
 523                                                                         /* exit: */
 524                 0x30, 0x46,                                     /* mov          r0, r6 */
 525                 0x00, 0xBE,                                     /* bkpt         #0x00 */
 526
 527                 /* <STM32_PROG16>: */
 528                 0x01, 0x01, 0x00, 0x00,         /* .word        0x00000101 */
 529         };
 530
 531         if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
 532                         &write_algorithm) != ERROR_OK) {
 533                 LOG_WARNING("no working area available, can't do block memory writes");
 534                 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
 535         };
 536
 537         retval = target_write_buffer(target, write_algorithm->address,
 538                         sizeof(stm32x_flash_write_code),
 539                         (uint8_t *)stm32x_flash_write_code);
 540         if (retval != ERROR_OK)
 541                 return retval;
 542
 543         /* memory buffer */
 544         while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
 545                 buffer_size /= 2;
 546                 if (buffer_size <= 256) {
 547                         /* we already allocated the writing code, but failed to get a
 548                          * buffer, free the algorithm */
 549                         target_free_working_area(target, write_algorithm);
 550
 551                         LOG_WARNING("no large enough working area available, can't do block memory writes");
 552                         return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
 553                 }
 554         };
 555
 556         armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
 557         armv7m_info.core_mode = ARM_MODE_THREAD;
 558
 559         init_reg_param(&reg_params[0], "r0", 32, PARAM_IN_OUT);         /* buffer start, status (out) */
 560         init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);            /* buffer end */
 561         init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);            /* target address */
 562         init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);            /* count (halfword-16bit) */
 563         init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT);            /* flash base */
 564
 565         buf_set_u32(reg_params[0].value, 0, 32, source->address);
 566         buf_set_u32(reg_params[1].value, 0, 32, source->address + source->size);
 567         buf_set_u32(reg_params[2].value, 0, 32, address);
 568         buf_set_u32(reg_params[3].value, 0, 32, count);
 569         buf_set_u32(reg_params[4].value, 0, 32, STM32_FLASH_BASE);
 570
 571         retval = target_run_flash_async_algorithm(target, buffer, count, 2,
 572                         0, NULL,
 573                         5, reg_params,
 574                         source->address, source->size,
 575                         write_algorithm->address, 0,
 576                         &armv7m_info);
 577
 578         if (retval == ERROR_FLASH_OPERATION_FAILED) {
 579                 LOG_ERROR("error executing stm32x flash write algorithm");
 580
 581                 uint32_t error = buf_get_u32(reg_params[0].value, 0, 32) & FLASH_ERROR;
 582
 583                 if (error & FLASH_WRPERR)
 584                         LOG_ERROR("flash memory write protected");
 585
 586                 if (error != 0) {
 587                         LOG_ERROR("flash write failed = %08x", error);
 588                         /* Clear but report errors */
 589                         target_write_u32(target, STM32_FLASH_SR, error);
 590                         retval = ERROR_FAIL;
 591                 }
 592         }
 593
 594         target_free_working_area(target, source);
 595         target_free_working_area(target, write_algorithm);
 596
 597         destroy_reg_param(&reg_params[0]);
 598         destroy_reg_param(&reg_params[1]);
 599         destroy_reg_param(&reg_params[2]);
 600         destroy_reg_param(&reg_params[3]);
 601         destroy_reg_param(&reg_params[4]);
 602
 603         return retval;
 604 }
 605
 606 static int stm32x_write(struct flash_bank *bank, uint8_t *buffer,
 607                 uint32_t offset, uint32_t count)
 608 {
 609         struct target *target = bank->target;
 610         uint32_t words_remaining = (count / 2);
 611         uint32_t bytes_remaining = (count & 0x00000001);
 612         uint32_t address = bank->base + offset;
 613         uint32_t bytes_written = 0;
 614         int retval;
 615
 616         if (bank->target->state != TARGET_HALTED) {
 617                 LOG_ERROR("Target not halted");
 618                 return ERROR_TARGET_NOT_HALTED;
 619         }
 620
 621         if (offset & 0x1) {
 622                 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
 623                 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
 624         }
 625
 626         retval = stm32x_unlock_reg(target);
 627         if (retval != ERROR_OK)
 628                 return retval;
 629
 630         /* multiple half words (2-byte) to be programmed? */
 631         if (words_remaining > 0) {
 632                 /* try using a block write */
 633                 retval = stm32x_write_block(bank, buffer, offset, words_remaining);
 634                 if (retval != ERROR_OK) {
 635                         if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
 636                                 /* if block write failed (no sufficient working area),
 637                                  * we use normal (slow) single dword accesses */
 638                                 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
 639                         }
 640                 } else {
 641                         buffer += words_remaining * 2;
 642                         address += words_remaining * 2;
 643                         words_remaining = 0;
 644                 }
 645         }
 646
 647         if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
 648                 return retval;
 649
 650         /*
 651         Standard programming
 652         The Flash memory programming sequence is as follows:
 653         1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
 654           FLASH_SR register.
 655         2. Set the PG bit in the FLASH_CR register
 656         3. Perform the data write operation(s) to the desired memory address (inside main
 657           memory block or OTP area):
 658         – – Half-word access in case of x16 parallelism
 659         – Word access in case of x32 parallelism
 660         –
 661         4.
 662         Byte access in case of x8 parallelism
 663         Double word access in case of x64 parallelism
 664         Wait for the BSY bit to be cleared
 665         */
 666         while (words_remaining > 0) {
 667                 uint16_t value;
 668                 memcpy(&value, buffer + bytes_written, sizeof(uint16_t));
 669
 670                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
 671                                 FLASH_PG | FLASH_PSIZE_16);
 672                 if (retval != ERROR_OK)
 673                         return retval;
 674
 675                 retval = target_write_u16(target, address, value);
 676                 if (retval != ERROR_OK)
 677                         return retval;
 678
 679                 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
 680                 if (retval != ERROR_OK)
 681                         return retval;
 682
 683                 bytes_written += 2;
 684                 words_remaining--;
 685                 address += 2;
 686         }
 687
 688         if (bytes_remaining) {
 689                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
 690                                 FLASH_PG | FLASH_PSIZE_8);
 691                 if (retval != ERROR_OK)
 692                         return retval;
 693                 retval = target_write_u8(target, address, buffer[bytes_written]);
 694                 if (retval != ERROR_OK)
 695                         return retval;
 696
 697                 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
 698                 if (retval != ERROR_OK)
 699                         return retval;
 700         }
 701
 702         return target_write_u32(target, STM32_FLASH_CR, FLASH_LOCK);
 703 }
 704
 705 static void setup_sector(struct flash_bank *bank, int start, int num, int size)
 706 {
 707         for (int i = start; i < (start + num) ; i++) {
 708                 assert(i < bank->num_sectors);
 709                 bank->sectors[i].offset = bank->size;
 710                 bank->sectors[i].size = size;
 711                 bank->size += bank->sectors[i].size;
 712         }
 713 }
 714
 715 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
 716 {
 717         /* this checks for a stm32f4x errata issue where a
 718          * stm32f2x DBGMCU_IDCODE is incorrectly returned.
 719          * If the issue is detected target is forced to stm32f4x Rev A.
 720          * Only effects Rev A silicon */
 721
 722         struct target *target = bank->target;
 723         uint32_t cpuid;
 724
 725         /* read stm32 device id register */
 726         int retval = target_read_u32(target, 0xE0042000, device_id);
 727         if (retval != ERROR_OK)
 728                 return retval;
 729
 730         if ((*device_id & 0xfff) == 0x411) {
 731                 /* read CPUID reg to check core type */
 732                 retval = target_read_u32(target, 0xE000ED00, &cpuid);
 733                 if (retval != ERROR_OK)
 734                         return retval;
 735
 736                 /* check for cortex_m4 */
 737                 if (((cpuid >> 4) & 0xFFF) == 0xC24) {
 738                         *device_id &= ~((0xFFFF << 16) | 0xfff);
 739                         *device_id |= (0x1000 << 16) | 0x413;
 740                         LOG_INFO("stm32f4x errata detected - fixing incorrect MCU_IDCODE");
 741                 }
 742         }
 743         return retval;
 744 }
 745
 746 static int stm32x_probe(struct flash_bank *bank)
 747 {
 748         struct target *target = bank->target;
 749         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 750         int i;
 751         uint16_t flash_size_in_kb;
 752         uint16_t max_flash_size_in_kb;
 753         uint32_t device_id;
 754         uint32_t base_address = 0x08000000;
 755
 756         stm32x_info->probed = 0;
 757         stm32x_info->has_large_mem = false;
 758
 759         /* read stm32 device id register */
 760         int retval = stm32x_get_device_id(bank, &device_id);
 761         if (retval != ERROR_OK)
 762                 return retval;
 763         LOG_INFO("device id = 0x%08" PRIx32 "", device_id);
 764
 765         /* set max flash size depending on family */
 766         switch (device_id & 0xfff) {
 767         case 0x411:
 768         case 0x413:
 769                 max_flash_size_in_kb = 1024;
 770                 break;
 771         case 0x419:
 772                 max_flash_size_in_kb = 2048;
 773                 stm32x_info->has_large_mem = true;
 774                 break;
 775         default:
 776                 LOG_WARNING("Cannot identify target as a STM32 family.");
 777                 return ERROR_FAIL;
 778         }
 779
 780         /* get flash size from target. */
 781         retval = target_read_u16(target, 0x1FFF7A22, &flash_size_in_kb);
 782
 783         /* failed reading flash size or flash size invalid (early silicon),
 784          * default to max target family */
 785         if (retval != ERROR_OK || flash_size_in_kb == 0xffff || flash_size_in_kb == 0) {
 786                 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming %dk flash",
 787                         max_flash_size_in_kb);
 788                 flash_size_in_kb = max_flash_size_in_kb;
 789         }
 790
 791         /* if the user sets the size manually then ignore the probed value
 792          * this allows us to work around devices that have a invalid flash size register value */
 793         if (stm32x_info->user_bank_size) {
 794                 LOG_INFO("ignoring flash probed value, using configured bank size");
 795                 flash_size_in_kb = stm32x_info->user_bank_size / 1024;
 796         }
 797
 798         LOG_INFO("flash size = %dkbytes", flash_size_in_kb);
 799
 800         /* did we assign flash size? */
 801         assert(flash_size_in_kb != 0xffff);
 802
 803         /* calculate numbers of pages */
 804         int num_pages = (flash_size_in_kb / 128) + 4;
 805
 806         /* check for larger 2048 bytes devices */
 807         if (stm32x_info->has_large_mem)
 808                 num_pages += 4;
 809
 810         /* check that calculation result makes sense */
 811         assert(num_pages > 0);
 812
 813         if (bank->sectors) {
 814                 free(bank->sectors);
 815                 bank->sectors = NULL;
 816         }
 817
 818         bank->base = base_address;
 819         bank->num_sectors = num_pages;
 820         bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
 821         bank->size = 0;
 822
 823         /* fixed memory */
 824         setup_sector(bank, 0, 4, 16 * 1024);
 825         setup_sector(bank, 4, 1, 64 * 1024);
 826
 827         /* dynamic memory */
 828         setup_sector(bank, 4 + 1, MIN(12, num_pages) - 5, 128 * 1024);
 829
 830         if (stm32x_info->has_large_mem) {
 831
 832                 /* fixed memory for larger devices */
 833                 setup_sector(bank, 12, 4, 16 * 1024);
 834                 setup_sector(bank, 16, 1, 64 * 1024);
 835
 836                 /* dynamic memory for larger devices */
 837                 setup_sector(bank, 16 + 1, num_pages - 5 - 12, 128 * 1024);
 838         }
 839
 840         for (i = 0; i < num_pages; i++) {
 841                 bank->sectors[i].is_erased = -1;
 842                 bank->sectors[i].is_protected = 0;
 843         }
 844
 845         stm32x_info->probed = 1;
 846
 847         return ERROR_OK;
 848 }
 849
 850 static int stm32x_auto_probe(struct flash_bank *bank)
 851 {
 852         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 853         if (stm32x_info->probed)
 854                 return ERROR_OK;
 855         return stm32x_probe(bank);
 856 }
 857
 858 static int get_stm32x_info(struct flash_bank *bank, char *buf, int buf_size)
 859 {
 860         uint32_t dbgmcu_idcode;
 861
 862         /* read stm32 device id register */
 863         int retval = stm32x_get_device_id(bank, &dbgmcu_idcode);
 864         if (retval != ERROR_OK)
 865                 return retval;
 866
 867         uint16_t device_id = dbgmcu_idcode & 0xfff;
 868         uint16_t rev_id = dbgmcu_idcode >> 16;
 869         const char *device_str;
 870         const char *rev_str = NULL;
 871
 872         switch (device_id) {
 873         case 0x411:
 874                 device_str = "STM32F2xx";
 875
 876                 switch (rev_id) {
 877                 case 0x1000:
 878                         rev_str = "A";
 879                         break;
 880
 881                 case 0x2000:
 882                         rev_str = "B";
 883                         break;
 884
 885                 case 0x1001:
 886                         rev_str = "Z";
 887                         break;
 888
 889                 case 0x2001:
 890                         rev_str = "Y";
 891                         break;
 892
 893                 case 0x2003:
 894                         rev_str = "X";
 895                         break;
 896                 }
 897                 break;
 898
 899         case 0x413:
 900         case 0x419:
 901                 device_str = "STM32F4xx";
 902
 903                 switch (rev_id) {
 904                 case 0x1000:
 905                         rev_str = "A";
 906                         break;
 907
 908                 case 0x1001:
 909                         rev_str = "Z";
 910                         break;
 911                 }
 912                 break;
 913
 914         default:
 915                 snprintf(buf, buf_size, "Cannot identify target as a STM32F2/4\n");
 916                 return ERROR_FAIL;
 917         }
 918
 919         if (rev_str != NULL)
 920                 snprintf(buf, buf_size, "%s - Rev: %s", device_str, rev_str);
 921         else
 922                 snprintf(buf, buf_size, "%s - Rev: unknown (0x%04x)", device_str, rev_id);
 923
 924         return ERROR_OK;
 925 }
 926
 927 COMMAND_HANDLER(stm32x_handle_lock_command)
 928 {
 929         struct target *target = NULL;
 930         struct stm32x_flash_bank *stm32x_info = NULL;
 931
 932         if (CMD_ARGC < 1)
 933                 return ERROR_COMMAND_SYNTAX_ERROR;
 934
 935         struct flash_bank *bank;
 936         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 937         if (ERROR_OK != retval)
 938                 return retval;
 939
 940         stm32x_info = bank->driver_priv;
 941         target = bank->target;
 942
 943         if (target->state != TARGET_HALTED) {
 944                 LOG_ERROR("Target not halted");
 945                 return ERROR_TARGET_NOT_HALTED;
 946         }
 947
 948         if (stm32x_read_options(bank) != ERROR_OK) {
 949                 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
 950                 return ERROR_OK;
 951         }
 952
 953         /* set readout protection */
 954         stm32x_info->option_bytes.RDP = 0;
 955
 956         if (stm32x_write_options(bank) != ERROR_OK) {
 957                 command_print(CMD_CTX, "%s failed to lock device", bank->driver->name);
 958                 return ERROR_OK;
 959         }
 960
 961         command_print(CMD_CTX, "%s locked", bank->driver->name);
 962
 963         return ERROR_OK;
 964 }
 965
 966 COMMAND_HANDLER(stm32x_handle_unlock_command)
 967 {
 968         struct target *target = NULL;
 969         struct stm32x_flash_bank *stm32x_info = NULL;
 970
 971         if (CMD_ARGC < 1)
 972                 return ERROR_COMMAND_SYNTAX_ERROR;
 973
 974         struct flash_bank *bank;
 975         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
 976         if (ERROR_OK != retval)
 977                 return retval;
 978
 979         stm32x_info = bank->driver_priv;
 980         target = bank->target;
 981
 982         if (target->state != TARGET_HALTED) {
 983                 LOG_ERROR("Target not halted");
 984                 return ERROR_TARGET_NOT_HALTED;
 985         }
 986
 987         if (stm32x_read_options(bank) != ERROR_OK) {
 988                 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
 989                 return ERROR_OK;
 990         }
 991
 992         /* clear readout protection and complementary option bytes
 993          * this will also force a device unlock if set */
 994         stm32x_info->option_bytes.RDP = 0xAA;
 995
 996         if (stm32x_write_options(bank) != ERROR_OK) {
 997                 command_print(CMD_CTX, "%s failed to unlock device", bank->driver->name);
 998                 return ERROR_OK;
 999         }
1000
1001         command_print(CMD_CTX, "%s unlocked.\n"
1002                         "INFO: a reset or power cycle is required "
1003                         "for the new settings to take effect.", bank->driver->name);
1004
1005         return ERROR_OK;
1006 }
1007
1008 static int stm32x_mass_erase(struct flash_bank *bank)
1009 {
1010         int retval;
1011         struct target *target = bank->target;
1012         struct stm32x_flash_bank *stm32x_info = NULL;
1013
1014         if (target->state != TARGET_HALTED) {
1015                 LOG_ERROR("Target not halted");
1016                 return ERROR_TARGET_NOT_HALTED;
1017         }
1018
1019         stm32x_info = bank->driver_priv;
1020
1021         retval = stm32x_unlock_reg(target);
1022         if (retval != ERROR_OK)
1023                 return retval;
1024
1025         /* mass erase flash memory */
1026         if (stm32x_info->has_large_mem)
1027                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER | FLASH_MER1);
1028         else
1029                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER);
1030         if (retval != ERROR_OK)
1031                 return retval;
1032         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
1033                 FLASH_MER | FLASH_STRT);
1034         if (retval != ERROR_OK)
1035                 return retval;
1036
1037         retval = stm32x_wait_status_busy(bank, 30000);
1038         if (retval != ERROR_OK)
1039                 return retval;
1040
1041         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
1042         if (retval != ERROR_OK)
1043                 return retval;
1044
1045         return ERROR_OK;
1046 }
1047
1048 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
1049 {
1050         int i;
1051
1052         if (CMD_ARGC < 1) {
1053                 command_print(CMD_CTX, "stm32x mass_erase <bank>");
1054                 return ERROR_COMMAND_SYNTAX_ERROR;
1055         }
1056
1057         struct flash_bank *bank;
1058         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1059         if (ERROR_OK != retval)
1060                 return retval;
1061
1062         retval = stm32x_mass_erase(bank);
1063         if (retval == ERROR_OK) {
1064                 /* set all sectors as erased */
1065                 for (i = 0; i < bank->num_sectors; i++)
1066                         bank->sectors[i].is_erased = 1;
1067
1068                 command_print(CMD_CTX, "stm32x mass erase complete");
1069         } else {
1070                 command_print(CMD_CTX, "stm32x mass erase failed");
1071         }
1072
1073         return retval;
1074 }
1075
1076 static const struct command_registration stm32x_exec_command_handlers[] = {
1077         {
1078                 .name = "lock",
1079                 .handler = stm32x_handle_lock_command,
1080                 .mode = COMMAND_EXEC,
1081                 .usage = "bank_id",
1082                 .help = "Lock entire flash device.",
1083         },
1084         {
1085                 .name = "unlock",
1086                 .handler = stm32x_handle_unlock_command,
1087                 .mode = COMMAND_EXEC,
1088                 .usage = "bank_id",
1089                 .help = "Unlock entire protected flash device.",
1090         },
1091         {
1092                 .name = "mass_erase",
1093                 .handler = stm32x_handle_mass_erase_command,
1094                 .mode = COMMAND_EXEC,
1095                 .usage = "bank_id",
1096                 .help = "Erase entire flash device.",
1097         },
1098         COMMAND_REGISTRATION_DONE
1099 };
1100
1101 static const struct command_registration stm32x_command_handlers[] = {
1102         {
1103                 .name = "stm32f2x",
1104                 .mode = COMMAND_ANY,
1105                 .help = "stm32f2x flash command group",
1106                 .usage = "",
1107                 .chain = stm32x_exec_command_handlers,
1108         },
1109         COMMAND_REGISTRATION_DONE
1110 };
1111
1112 struct flash_driver stm32f2x_flash = {
1113         .name = "stm32f2x",
1114         .commands = stm32x_command_handlers,
1115         .flash_bank_command = stm32x_flash_bank_command,
1116         .erase = stm32x_erase,
1117         .protect = stm32x_protect,
1118         .write = stm32x_write,
1119         .read = default_flash_read,
1120         .probe = stm32x_probe,
1121         .auto_probe = stm32x_auto_probe,
1122         .erase_check = default_flash_blank_check,
1123         .protect_check = stm32x_protect_check,
1124         .info = get_stm32x_info,
1125 };