1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2008 by Spencer Oliver *
6 * spen@spen-soft.co.uk *
8 * Copyright (C) 2011 by Andreas Fritiofson *
9 * andreas.fritiofson@gmail.com *
11 * This program is free software; you can redistribute it and/or modify *
12 * it under the terms of the GNU General Public License as published by *
13 * the Free Software Foundation; either version 2 of the License, or *
14 * (at your option) any later version. *
16 * This program is distributed in the hope that it will be useful, *
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
19 * GNU General Public License for more details. *
21 * You should have received a copy of the GNU General Public License *
22 * along with this program; if not, write to the *
23 * Free Software Foundation, Inc., *
24 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *
25 ***************************************************************************/
32 #include <helper/binarybuffer.h>
33 #include <target/algorithm.h>
34 #include <target/armv7m.h>
36 /* stm32x register locations */
38 #define FLASH_REG_BASE_B0 0x40022000
39 #define FLASH_REG_BASE_B1 0x40022040
41 #define STM32_FLASH_ACR 0x00
42 #define STM32_FLASH_KEYR 0x04
43 #define STM32_FLASH_OPTKEYR 0x08
44 #define STM32_FLASH_SR 0x0C
45 #define STM32_FLASH_CR 0x10
46 #define STM32_FLASH_AR 0x14
47 #define STM32_FLASH_OBR 0x1C
48 #define STM32_FLASH_WRPR 0x20
50 /* TODO: Check if code using these really should be hard coded to bank 0.
51 * There are valid cases, on dual flash devices the protection of the
52 * second bank is done on the bank0 reg's. */
53 #define STM32_FLASH_ACR_B0 0x40022000
54 #define STM32_FLASH_KEYR_B0 0x40022004
55 #define STM32_FLASH_OPTKEYR_B0 0x40022008
56 #define STM32_FLASH_SR_B0 0x4002200C
57 #define STM32_FLASH_CR_B0 0x40022010
58 #define STM32_FLASH_AR_B0 0x40022014
59 #define STM32_FLASH_OBR_B0 0x4002201C
60 #define STM32_FLASH_WRPR_B0 0x40022020
62 /* option byte location */
64 #define STM32_OB_RDP 0x1FFFF800
65 #define STM32_OB_USER 0x1FFFF802
66 #define STM32_OB_DATA0 0x1FFFF804
67 #define STM32_OB_DATA1 0x1FFFF806
68 #define STM32_OB_WRP0 0x1FFFF808
69 #define STM32_OB_WRP1 0x1FFFF80A
70 #define STM32_OB_WRP2 0x1FFFF80C
71 #define STM32_OB_WRP3 0x1FFFF80E
73 /* FLASH_CR register bits */
75 #define FLASH_PG (1 << 0)
76 #define FLASH_PER (1 << 1)
77 #define FLASH_MER (1 << 2)
78 #define FLASH_OPTPG (1 << 4)
79 #define FLASH_OPTER (1 << 5)
80 #define FLASH_STRT (1 << 6)
81 #define FLASH_LOCK (1 << 7)
82 #define FLASH_OPTWRE (1 << 9)
84 /* FLASH_SR register bits */
86 #define FLASH_BSY (1 << 0)
87 #define FLASH_PGERR (1 << 2)
88 #define FLASH_WRPRTERR (1 << 4)
89 #define FLASH_EOP (1 << 5)
91 /* STM32_FLASH_OBR bit definitions (reading) */
96 #define OPT_RDRSTSTOP 3
97 #define OPT_RDRSTSTDBY 4
98 #define OPT_BFB2 5 /* dual flash bank only */
100 /* register unlock keys */
102 #define KEY1 0x45670123
103 #define KEY2 0xCDEF89AB
107 #define FLASH_WRITE_TIMEOUT 10
108 #define FLASH_ERASE_TIMEOUT 100
110 struct stm32x_options {
112 uint16_t user_options;
114 uint16_t protection[4];
117 struct stm32x_flash_bank {
118 struct stm32x_options option_bytes;
123 /* used to access dual flash bank stm32xl */
124 uint32_t register_base;
125 uint16_t default_rdp;
126 int user_data_offset;
128 uint32_t user_bank_size;
131 static int stm32x_mass_erase(struct flash_bank *bank);
132 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id);
133 static int stm32x_write_block(struct flash_bank *bank, uint8_t *buffer,
134 uint32_t offset, uint32_t count);
136 /* flash bank stm32x <base> <size> 0 0 <target#>
138 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
140 struct stm32x_flash_bank *stm32x_info;
143 return ERROR_COMMAND_SYNTAX_ERROR;
145 stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
147 bank->driver_priv = stm32x_info;
148 stm32x_info->probed = 0;
149 stm32x_info->has_dual_banks = false;
150 stm32x_info->register_base = FLASH_REG_BASE_B0;
151 stm32x_info->user_bank_size = bank->size;
153 /* the stm32l erased value is 0x00 */
154 bank->default_padded_value = 0x00;
159 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
161 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
162 return reg + stm32x_info->register_base;
165 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
167 struct target *target = bank->target;
168 return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
171 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
173 struct target *target = bank->target;
175 int retval = ERROR_OK;
177 /* wait for busy to clear */
179 retval = stm32x_get_flash_status(bank, &status);
180 if (retval != ERROR_OK)
182 LOG_DEBUG("status: 0x%" PRIx32 "", status);
183 if ((status & FLASH_BSY) == 0)
185 if (timeout-- <= 0) {
186 LOG_ERROR("timed out waiting for flash");
192 if (status & FLASH_WRPRTERR) {
193 LOG_ERROR("stm32x device protected");
197 if (status & FLASH_PGERR) {
198 LOG_ERROR("stm32x device programming failed");
202 /* Clear but report errors */
203 if (status & (FLASH_WRPRTERR | FLASH_PGERR)) {
204 /* If this operation fails, we ignore it and report the original
207 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
208 FLASH_WRPRTERR | FLASH_PGERR);
213 static int stm32x_check_operation_supported(struct flash_bank *bank)
215 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
217 /* if we have a dual flash bank device then
218 * we need to perform option byte stuff on bank0 only */
219 if (stm32x_info->register_base != FLASH_REG_BASE_B0) {
220 LOG_ERROR("Option Byte Operation's must use bank0");
221 return ERROR_FLASH_OPERATION_FAILED;
227 static int stm32x_read_options(struct flash_bank *bank)
230 struct stm32x_flash_bank *stm32x_info = NULL;
231 struct target *target = bank->target;
233 stm32x_info = bank->driver_priv;
235 /* read current option bytes */
236 int retval = target_read_u32(target, STM32_FLASH_OBR_B0, &optiondata);
237 if (retval != ERROR_OK)
240 stm32x_info->option_bytes.user_options = (optiondata >> stm32x_info->option_offset >> 2) & 0xffff;
241 stm32x_info->option_bytes.user_data = (optiondata >> stm32x_info->user_data_offset) & 0xffff;
242 stm32x_info->option_bytes.RDP = (optiondata & (1 << OPT_READOUT)) ? 0xFFFF : 0x5AA5;
244 if (optiondata & (1 << OPT_READOUT))
245 LOG_INFO("Device Security Bit Set");
247 /* each bit refers to a 4bank protection */
248 retval = target_read_u32(target, STM32_FLASH_WRPR_B0, &optiondata);
249 if (retval != ERROR_OK)
252 stm32x_info->option_bytes.protection[0] = (uint16_t)optiondata;
253 stm32x_info->option_bytes.protection[1] = (uint16_t)(optiondata >> 8);
254 stm32x_info->option_bytes.protection[2] = (uint16_t)(optiondata >> 16);
255 stm32x_info->option_bytes.protection[3] = (uint16_t)(optiondata >> 24);
260 static int stm32x_erase_options(struct flash_bank *bank)
262 struct stm32x_flash_bank *stm32x_info = NULL;
263 struct target *target = bank->target;
265 stm32x_info = bank->driver_priv;
267 /* read current options */
268 stm32x_read_options(bank);
270 /* unlock flash registers */
271 int retval = target_write_u32(target, STM32_FLASH_KEYR_B0, KEY1);
272 if (retval != ERROR_OK)
275 retval = target_write_u32(target, STM32_FLASH_KEYR_B0, KEY2);
276 if (retval != ERROR_OK)
279 /* unlock option flash registers */
280 retval = target_write_u32(target, STM32_FLASH_OPTKEYR_B0, KEY1);
281 if (retval != ERROR_OK)
283 retval = target_write_u32(target, STM32_FLASH_OPTKEYR_B0, KEY2);
284 if (retval != ERROR_OK)
287 /* erase option bytes */
288 retval = target_write_u32(target, STM32_FLASH_CR_B0, FLASH_OPTER | FLASH_OPTWRE);
289 if (retval != ERROR_OK)
291 retval = target_write_u32(target, STM32_FLASH_CR_B0, FLASH_OPTER | FLASH_STRT | FLASH_OPTWRE);
292 if (retval != ERROR_OK)
295 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
296 if (retval != ERROR_OK)
299 /* clear readout protection and complementary option bytes
300 * this will also force a device unlock if set */
301 stm32x_info->option_bytes.RDP = stm32x_info->default_rdp;
306 static int stm32x_write_options(struct flash_bank *bank)
308 struct stm32x_flash_bank *stm32x_info = NULL;
309 struct target *target = bank->target;
311 stm32x_info = bank->driver_priv;
313 /* unlock flash registers */
314 int retval = target_write_u32(target, STM32_FLASH_KEYR_B0, KEY1);
315 if (retval != ERROR_OK)
317 retval = target_write_u32(target, STM32_FLASH_KEYR_B0, KEY2);
318 if (retval != ERROR_OK)
321 /* unlock option flash registers */
322 retval = target_write_u32(target, STM32_FLASH_OPTKEYR_B0, KEY1);
323 if (retval != ERROR_OK)
325 retval = target_write_u32(target, STM32_FLASH_OPTKEYR_B0, KEY2);
326 if (retval != ERROR_OK)
329 /* program option bytes */
330 retval = target_write_u32(target, STM32_FLASH_CR_B0, FLASH_OPTPG | FLASH_OPTWRE);
331 if (retval != ERROR_OK)
334 uint8_t opt_bytes[16];
336 target_buffer_set_u16(target, opt_bytes, stm32x_info->option_bytes.RDP);
337 target_buffer_set_u16(target, opt_bytes + 2, stm32x_info->option_bytes.user_options);
338 target_buffer_set_u16(target, opt_bytes + 4, stm32x_info->option_bytes.user_data & 0xff);
339 target_buffer_set_u16(target, opt_bytes + 6, (stm32x_info->option_bytes.user_data >> 8) & 0xff);
340 target_buffer_set_u16(target, opt_bytes + 8, stm32x_info->option_bytes.protection[0]);
341 target_buffer_set_u16(target, opt_bytes + 10, stm32x_info->option_bytes.protection[1]);
342 target_buffer_set_u16(target, opt_bytes + 12, stm32x_info->option_bytes.protection[2]);
343 target_buffer_set_u16(target, opt_bytes + 14, stm32x_info->option_bytes.protection[3]);
345 uint32_t offset = STM32_OB_RDP - bank->base;
346 retval = stm32x_write_block(bank, opt_bytes, offset, sizeof(opt_bytes) / 2);
347 if (retval != ERROR_OK) {
348 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE)
349 LOG_ERROR("working area required to erase options bytes");
353 retval = target_write_u32(target, STM32_FLASH_CR_B0, FLASH_LOCK);
354 if (retval != ERROR_OK)
360 static int stm32x_protect_check(struct flash_bank *bank)
362 struct target *target = bank->target;
363 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
370 int retval = stm32x_check_operation_supported(bank);
371 if (ERROR_OK != retval)
374 /* medium density - each bit refers to a 4bank protection
375 * high density - each bit refers to a 2bank protection */
376 retval = target_read_u32(target, STM32_FLASH_WRPR_B0, &protection);
377 if (retval != ERROR_OK)
380 /* medium density - each protection bit is for 4 * 1K pages
381 * high density - each protection bit is for 2 * 2K pages */
382 num_bits = (bank->num_sectors / stm32x_info->ppage_size);
384 if (stm32x_info->ppage_size == 2) {
385 /* high density flash/connectivity line protection */
389 if (protection & (1 << 31))
392 /* bit 31 controls sector 62 - 255 protection for high density
393 * bit 31 controls sector 62 - 127 protection for connectivity line */
394 for (s = 62; s < bank->num_sectors; s++)
395 bank->sectors[s].is_protected = set;
397 if (bank->num_sectors > 61)
400 for (i = 0; i < num_bits; i++) {
403 if (protection & (1 << i))
406 for (s = 0; s < stm32x_info->ppage_size; s++)
407 bank->sectors[(i * stm32x_info->ppage_size) + s].is_protected = set;
410 /* low/medium density flash protection */
411 for (i = 0; i < num_bits; i++) {
414 if (protection & (1 << i))
417 for (s = 0; s < stm32x_info->ppage_size; s++)
418 bank->sectors[(i * stm32x_info->ppage_size) + s].is_protected = set;
425 static int stm32x_erase(struct flash_bank *bank, int first, int last)
427 struct target *target = bank->target;
430 if (bank->target->state != TARGET_HALTED) {
431 LOG_ERROR("Target not halted");
432 return ERROR_TARGET_NOT_HALTED;
435 if ((first == 0) && (last == (bank->num_sectors - 1)))
436 return stm32x_mass_erase(bank);
438 /* unlock flash registers */
439 int retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_KEYR), KEY1);
440 if (retval != ERROR_OK)
442 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_KEYR), KEY2);
443 if (retval != ERROR_OK)
446 for (i = first; i <= last; i++) {
447 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_PER);
448 if (retval != ERROR_OK)
450 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_AR),
451 bank->base + bank->sectors[i].offset);
452 if (retval != ERROR_OK)
454 retval = target_write_u32(target,
455 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_PER | FLASH_STRT);
456 if (retval != ERROR_OK)
459 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
460 if (retval != ERROR_OK)
463 bank->sectors[i].is_erased = 1;
466 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
467 if (retval != ERROR_OK)
473 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
475 struct stm32x_flash_bank *stm32x_info = NULL;
476 struct target *target = bank->target;
477 uint16_t prot_reg[4] = {0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF};
482 stm32x_info = bank->driver_priv;
484 if (target->state != TARGET_HALTED) {
485 LOG_ERROR("Target not halted");
486 return ERROR_TARGET_NOT_HALTED;
489 int retval = stm32x_check_operation_supported(bank);
490 if (ERROR_OK != retval)
493 if ((first % stm32x_info->ppage_size) != 0) {
494 LOG_WARNING("aligned start protect sector to a %d sector boundary",
495 stm32x_info->ppage_size);
496 first = first - (first % stm32x_info->ppage_size);
498 if (((last + 1) % stm32x_info->ppage_size) != 0) {
499 LOG_WARNING("aligned end protect sector to a %d sector boundary",
500 stm32x_info->ppage_size);
502 last = last - (last % stm32x_info->ppage_size);
506 /* medium density - each bit refers to a 4bank protection
507 * high density - each bit refers to a 2bank protection */
508 retval = target_read_u32(target, STM32_FLASH_WRPR_B0, &protection);
509 if (retval != ERROR_OK)
512 prot_reg[0] = (uint16_t)protection;
513 prot_reg[1] = (uint16_t)(protection >> 8);
514 prot_reg[2] = (uint16_t)(protection >> 16);
515 prot_reg[3] = (uint16_t)(protection >> 24);
517 if (stm32x_info->ppage_size == 2) {
518 /* high density flash */
520 /* bit 7 controls sector 62 - 255 protection */
523 prot_reg[3] &= ~(1 << 7);
525 prot_reg[3] |= (1 << 7);
533 for (i = first; i <= last; i++) {
534 reg = (i / stm32x_info->ppage_size) / 8;
535 bit = (i / stm32x_info->ppage_size) - (reg * 8);
538 prot_reg[reg] &= ~(1 << bit);
540 prot_reg[reg] |= (1 << bit);
543 /* medium density flash */
544 for (i = first; i <= last; i++) {
545 reg = (i / stm32x_info->ppage_size) / 8;
546 bit = (i / stm32x_info->ppage_size) - (reg * 8);
549 prot_reg[reg] &= ~(1 << bit);
551 prot_reg[reg] |= (1 << bit);
555 status = stm32x_erase_options(bank);
556 if (status != ERROR_OK)
559 stm32x_info->option_bytes.protection[0] = prot_reg[0];
560 stm32x_info->option_bytes.protection[1] = prot_reg[1];
561 stm32x_info->option_bytes.protection[2] = prot_reg[2];
562 stm32x_info->option_bytes.protection[3] = prot_reg[3];
564 return stm32x_write_options(bank);
567 static int stm32x_write_block(struct flash_bank *bank, uint8_t *buffer,
568 uint32_t offset, uint32_t count)
570 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
571 struct target *target = bank->target;
572 uint32_t buffer_size = 16384;
573 struct working_area *write_algorithm;
574 struct working_area *source;
575 uint32_t address = bank->base + offset;
576 struct reg_param reg_params[5];
577 struct armv7m_algorithm armv7m_info;
578 int retval = ERROR_OK;
580 /* see contrib/loaders/flash/stm32f1x.S for src */
582 static const uint8_t stm32x_flash_write_code[] = {
583 /* #define STM32_FLASH_SR_OFFSET 0x0C */
585 0x16, 0x68, /* ldr r6, [r2, #0] */
586 0x00, 0x2e, /* cmp r6, #0 */
587 0x18, 0xd0, /* beq exit */
588 0x55, 0x68, /* ldr r5, [r2, #4] */
589 0xb5, 0x42, /* cmp r5, r6 */
590 0xf9, 0xd0, /* beq wait_fifo */
591 0x2e, 0x88, /* ldrh r6, [r5, #0] */
592 0x26, 0x80, /* strh r6, [r4, #0] */
593 0x02, 0x35, /* adds r5, #2 */
594 0x02, 0x34, /* adds r4, #2 */
596 0xc6, 0x68, /* ldr r6, [r0, #STM32_FLASH_SR_OFFSET] */
597 0x01, 0x27, /* movs r7, #1 */
598 0x3e, 0x42, /* tst r6, r7 */
599 0xfb, 0xd1, /* bne busy */
600 0x14, 0x27, /* movs r7, #0x14 */
601 0x3e, 0x42, /* tst r6, r7 */
602 0x08, 0xd1, /* bne error */
603 0x9d, 0x42, /* cmp r5, r3 */
604 0x01, 0xd3, /* bcc no_wrap */
605 0x15, 0x46, /* mov r5, r2 */
606 0x08, 0x35, /* adds r5, #8 */
608 0x55, 0x60, /* str r5, [r2, #4] */
609 0x01, 0x39, /* subs r1, r1, #1 */
610 0x00, 0x29, /* cmp r1, #0 */
611 0x02, 0xd0, /* beq exit */
612 0xe5, 0xe7, /* b wait_fifo */
614 0x00, 0x20, /* movs r0, #0 */
615 0x50, 0x60, /* str r0, [r2, #4] */
617 0x30, 0x46, /* mov r0, r6 */
618 0x00, 0xbe, /* bkpt #0 */
621 /* flash write code */
622 if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
623 &write_algorithm) != ERROR_OK) {
624 LOG_WARNING("no working area available, can't do block memory writes");
625 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
628 retval = target_write_buffer(target, write_algorithm->address,
629 sizeof(stm32x_flash_write_code), (uint8_t *)stm32x_flash_write_code);
630 if (retval != ERROR_OK)
634 while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
636 buffer_size &= ~3UL; /* Make sure it's 4 byte aligned */
637 if (buffer_size <= 256) {
638 /* we already allocated the writing code, but failed to get a
639 * buffer, free the algorithm */
640 target_free_working_area(target, write_algorithm);
642 LOG_WARNING("no large enough working area available, can't do block memory writes");
643 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
647 init_reg_param(®_params[0], "r0", 32, PARAM_IN_OUT); /* flash base (in), status (out) */
648 init_reg_param(®_params[1], "r1", 32, PARAM_OUT); /* count (halfword-16bit) */
649 init_reg_param(®_params[2], "r2", 32, PARAM_OUT); /* buffer start */
650 init_reg_param(®_params[3], "r3", 32, PARAM_OUT); /* buffer end */
651 init_reg_param(®_params[4], "r4", 32, PARAM_IN_OUT); /* target address */
653 buf_set_u32(reg_params[0].value, 0, 32, stm32x_info->register_base);
654 buf_set_u32(reg_params[1].value, 0, 32, count);
655 buf_set_u32(reg_params[2].value, 0, 32, source->address);
656 buf_set_u32(reg_params[3].value, 0, 32, source->address + source->size);
657 buf_set_u32(reg_params[4].value, 0, 32, address);
659 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
660 armv7m_info.core_mode = ARM_MODE_THREAD;
662 retval = target_run_flash_async_algorithm(target, buffer, count, 2,
665 source->address, source->size,
666 write_algorithm->address, 0,
669 if (retval == ERROR_FLASH_OPERATION_FAILED) {
670 LOG_ERROR("flash write failed at address 0x%"PRIx32,
671 buf_get_u32(reg_params[4].value, 0, 32));
673 if (buf_get_u32(reg_params[0].value, 0, 32) & FLASH_PGERR) {
674 LOG_ERROR("flash memory not erased before writing");
675 /* Clear but report errors */
676 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), FLASH_PGERR);
679 if (buf_get_u32(reg_params[0].value, 0, 32) & FLASH_WRPRTERR) {
680 LOG_ERROR("flash memory write protected");
681 /* Clear but report errors */
682 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), FLASH_WRPRTERR);
686 target_free_working_area(target, source);
687 target_free_working_area(target, write_algorithm);
689 destroy_reg_param(®_params[0]);
690 destroy_reg_param(®_params[1]);
691 destroy_reg_param(®_params[2]);
692 destroy_reg_param(®_params[3]);
693 destroy_reg_param(®_params[4]);
698 static int stm32x_write(struct flash_bank *bank, uint8_t *buffer,
699 uint32_t offset, uint32_t count)
701 struct target *target = bank->target;
702 uint8_t *new_buffer = NULL;
704 if (bank->target->state != TARGET_HALTED) {
705 LOG_ERROR("Target not halted");
706 return ERROR_TARGET_NOT_HALTED;
710 LOG_ERROR("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
711 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
714 /* If there's an odd number of bytes, the data has to be padded. Duplicate
715 * the buffer and use the normal code path with a single block write since
716 * it's probably cheaper than to special case the last odd write using
717 * discrete accesses. */
719 new_buffer = malloc(count + 1);
720 if (new_buffer == NULL) {
721 LOG_ERROR("odd number of bytes to write and no memory for padding buffer");
724 LOG_INFO("odd number of bytes to write, padding with 0xff");
725 buffer = memcpy(new_buffer, buffer, count);
726 buffer[count++] = 0xff;
729 uint32_t words_remaining = count / 2;
732 /* unlock flash registers */
733 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_KEYR), KEY1);
734 if (retval != ERROR_OK)
736 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_KEYR), KEY2);
737 if (retval != ERROR_OK)
740 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_PG);
741 if (retval != ERROR_OK)
744 /* try using a block write */
745 retval = stm32x_write_block(bank, buffer, offset, words_remaining);
747 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
748 /* if block write failed (no sufficient working area),
749 * we use normal (slow) single halfword accesses */
750 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
752 while (words_remaining > 0) {
754 memcpy(&value, buffer, sizeof(uint16_t));
756 retval = target_write_u16(target, bank->base + offset, value);
757 if (retval != ERROR_OK)
758 goto reset_pg_and_lock;
760 retval = stm32x_wait_status_busy(bank, 5);
761 if (retval != ERROR_OK)
762 goto reset_pg_and_lock;
771 retval2 = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
772 if (retval == ERROR_OK)
782 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
784 /* This check the device CPUID core register to detect
785 * the M0 from the M3 devices. */
787 struct target *target = bank->target;
788 uint32_t cpuid, device_id_register = 0;
790 /* Get the CPUID from the ARM Core
791 * http://infocenter.arm.com/help/topic/com.arm.doc.ddi0432c/DDI0432C_cortex_m0_r0p0_trm.pdf 4.2.1 */
792 int retval = target_read_u32(target, 0xE000ED00, &cpuid);
793 if (retval != ERROR_OK)
796 if (((cpuid >> 4) & 0xFFF) == 0xC20) {
797 /* 0xC20 is M0 devices */
798 device_id_register = 0x40015800;
799 } else if (((cpuid >> 4) & 0xFFF) == 0xC23) {
800 /* 0xC23 is M3 devices */
801 device_id_register = 0xE0042000;
802 } else if (((cpuid >> 4) & 0xFFF) == 0xC24) {
803 /* 0xC24 is M4 devices */
804 device_id_register = 0xE0042000;
806 LOG_ERROR("Cannot identify target as a stm32x");
810 /* read stm32 device id register */
811 retval = target_read_u32(target, device_id_register, device_id);
812 if (retval != ERROR_OK)
818 static int stm32x_get_flash_size(struct flash_bank *bank, uint16_t *flash_size_in_kb)
820 struct target *target = bank->target;
821 uint32_t cpuid, flash_size_reg;
823 int retval = target_read_u32(target, 0xE000ED00, &cpuid);
824 if (retval != ERROR_OK)
827 if (((cpuid >> 4) & 0xFFF) == 0xC20) {
828 /* 0xC20 is M0 devices */
829 flash_size_reg = 0x1FFFF7CC;
830 } else if (((cpuid >> 4) & 0xFFF) == 0xC23) {
831 /* 0xC23 is M3 devices */
832 flash_size_reg = 0x1FFFF7E0;
833 } else if (((cpuid >> 4) & 0xFFF) == 0xC24) {
834 /* 0xC24 is M4 devices */
835 flash_size_reg = 0x1FFFF7CC;
837 LOG_ERROR("Cannot identify target as a stm32x");
841 retval = target_read_u16(target, flash_size_reg, flash_size_in_kb);
842 if (retval != ERROR_OK)
848 static int stm32x_probe(struct flash_bank *bank)
850 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
852 uint16_t flash_size_in_kb;
853 uint16_t max_flash_size_in_kb;
856 uint32_t base_address = 0x08000000;
858 stm32x_info->probed = 0;
859 stm32x_info->register_base = FLASH_REG_BASE_B0;
860 stm32x_info->user_data_offset = 10;
861 stm32x_info->option_offset = 0;
863 /* default factory protection level */
864 stm32x_info->default_rdp = 0x5AA5;
866 /* read stm32 device id register */
867 int retval = stm32x_get_device_id(bank, &device_id);
868 if (retval != ERROR_OK)
871 LOG_INFO("device id = 0x%08" PRIx32 "", device_id);
873 /* set page size, protection granularity and max flash size depending on family */
874 switch (device_id & 0xfff) {
875 case 0x410: /* medium density */
877 stm32x_info->ppage_size = 4;
878 max_flash_size_in_kb = 128;
880 case 0x412: /* low density */
882 stm32x_info->ppage_size = 4;
883 max_flash_size_in_kb = 32;
885 case 0x414: /* high density */
887 stm32x_info->ppage_size = 2;
888 max_flash_size_in_kb = 512;
890 case 0x418: /* connectivity line density */
892 stm32x_info->ppage_size = 2;
893 max_flash_size_in_kb = 256;
895 case 0x420: /* value line density */
897 stm32x_info->ppage_size = 4;
898 max_flash_size_in_kb = 128;
900 case 0x422: /* stm32f30x */
902 stm32x_info->ppage_size = 2;
903 max_flash_size_in_kb = 256;
904 stm32x_info->user_data_offset = 16;
905 stm32x_info->option_offset = 6;
906 stm32x_info->default_rdp = 0x55AA;
908 case 0x428: /* value line High density */
910 stm32x_info->ppage_size = 4;
911 max_flash_size_in_kb = 128;
913 case 0x430: /* xl line density (dual flash banks) */
915 stm32x_info->ppage_size = 2;
916 max_flash_size_in_kb = 1024;
917 stm32x_info->has_dual_banks = true;
919 case 0x432: /* stm32f37x */
921 stm32x_info->ppage_size = 2;
922 max_flash_size_in_kb = 256;
923 stm32x_info->user_data_offset = 16;
924 stm32x_info->option_offset = 6;
925 stm32x_info->default_rdp = 0x55AA;
927 case 0x440: /* stm32f0x */
930 stm32x_info->ppage_size = 4;
931 max_flash_size_in_kb = 64;
932 stm32x_info->user_data_offset = 16;
933 stm32x_info->option_offset = 6;
934 stm32x_info->default_rdp = 0x55AA;
937 LOG_WARNING("Cannot identify target as a STM32 family.");
941 /* get flash size from target. */
942 retval = stm32x_get_flash_size(bank, &flash_size_in_kb);
944 /* failed reading flash size or flash size invalid (early silicon),
945 * default to max target family */
946 if (retval != ERROR_OK || flash_size_in_kb == 0xffff || flash_size_in_kb == 0) {
947 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming %dk flash",
948 max_flash_size_in_kb);
949 flash_size_in_kb = max_flash_size_in_kb;
952 if (stm32x_info->has_dual_banks) {
953 /* split reported size into matching bank */
954 if (bank->base != 0x08080000) {
955 /* bank 0 will be fixed 512k */
956 flash_size_in_kb = 512;
958 flash_size_in_kb -= 512;
959 /* bank1 also uses a register offset */
960 stm32x_info->register_base = FLASH_REG_BASE_B1;
961 base_address = 0x08080000;
965 /* if the user sets the size manually then ignore the probed value
966 * this allows us to work around devices that have a invalid flash size register value */
967 if (stm32x_info->user_bank_size) {
968 LOG_INFO("ignoring flash probed value, using configured bank size");
969 flash_size_in_kb = stm32x_info->user_bank_size / 1024;
972 LOG_INFO("flash size = %dkbytes", flash_size_in_kb);
974 /* did we assign flash size? */
975 assert(flash_size_in_kb != 0xffff);
977 /* calculate numbers of pages */
978 int num_pages = flash_size_in_kb * 1024 / page_size;
980 /* check that calculation result makes sense */
981 assert(num_pages > 0);
985 bank->sectors = NULL;
988 bank->base = base_address;
989 bank->size = (num_pages * page_size);
990 bank->num_sectors = num_pages;
991 bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
993 for (i = 0; i < num_pages; i++) {
994 bank->sectors[i].offset = i * page_size;
995 bank->sectors[i].size = page_size;
996 bank->sectors[i].is_erased = -1;
997 bank->sectors[i].is_protected = 1;
1000 stm32x_info->probed = 1;
1005 static int stm32x_auto_probe(struct flash_bank *bank)
1007 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
1008 if (stm32x_info->probed)
1010 return stm32x_probe(bank);
1014 COMMAND_HANDLER(stm32x_handle_part_id_command)
1020 static int get_stm32x_info(struct flash_bank *bank, char *buf, int buf_size)
1022 uint32_t dbgmcu_idcode;
1024 /* read stm32 device id register */
1025 int retval = stm32x_get_device_id(bank, &dbgmcu_idcode);
1026 if (retval != ERROR_OK)
1029 uint16_t device_id = dbgmcu_idcode & 0xfff;
1030 uint16_t rev_id = dbgmcu_idcode >> 16;
1031 const char *device_str;
1032 const char *rev_str = NULL;
1034 switch (device_id) {
1036 device_str = "STM32F10x (Medium Density)";
1058 device_str = "STM32F10x (Low Density)";
1068 device_str = "STM32F10x (High Density)";
1086 device_str = "STM32F10x (Connectivity)";
1100 device_str = "STM32F100 (Low/Medium Density)";
1114 device_str = "STM32F30x";
1136 device_str = "STM32F100 (High Density)";
1150 device_str = "STM32F10x (XL Density)";
1160 device_str = "STM32F37x";
1175 device_str = "STM32F0xx";
1189 snprintf(buf, buf_size, "Cannot identify target as a STM32F0/1/3\n");
1193 if (rev_str != NULL)
1194 snprintf(buf, buf_size, "%s - Rev: %s", device_str, rev_str);
1196 snprintf(buf, buf_size, "%s - Rev: unknown (0x%04x)", device_str, rev_id);
1201 COMMAND_HANDLER(stm32x_handle_lock_command)
1203 struct target *target = NULL;
1204 struct stm32x_flash_bank *stm32x_info = NULL;
1207 return ERROR_COMMAND_SYNTAX_ERROR;
1209 struct flash_bank *bank;
1210 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1211 if (ERROR_OK != retval)
1214 stm32x_info = bank->driver_priv;
1216 target = bank->target;
1218 if (target->state != TARGET_HALTED) {
1219 LOG_ERROR("Target not halted");
1220 return ERROR_TARGET_NOT_HALTED;
1223 retval = stm32x_check_operation_supported(bank);
1224 if (ERROR_OK != retval)
1227 if (stm32x_erase_options(bank) != ERROR_OK) {
1228 command_print(CMD_CTX, "stm32x failed to erase options");
1232 /* set readout protection */
1233 stm32x_info->option_bytes.RDP = 0;
1235 if (stm32x_write_options(bank) != ERROR_OK) {
1236 command_print(CMD_CTX, "stm32x failed to lock device");
1240 command_print(CMD_CTX, "stm32x locked");
1245 COMMAND_HANDLER(stm32x_handle_unlock_command)
1247 struct target *target = NULL;
1250 return ERROR_COMMAND_SYNTAX_ERROR;
1252 struct flash_bank *bank;
1253 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1254 if (ERROR_OK != retval)
1257 target = bank->target;
1259 if (target->state != TARGET_HALTED) {
1260 LOG_ERROR("Target not halted");
1261 return ERROR_TARGET_NOT_HALTED;
1264 retval = stm32x_check_operation_supported(bank);
1265 if (ERROR_OK != retval)
1268 if (stm32x_erase_options(bank) != ERROR_OK) {
1269 command_print(CMD_CTX, "stm32x failed to unlock device");
1273 if (stm32x_write_options(bank) != ERROR_OK) {
1274 command_print(CMD_CTX, "stm32x failed to lock device");
1278 command_print(CMD_CTX, "stm32x unlocked.\n"
1279 "INFO: a reset or power cycle is required "
1280 "for the new settings to take effect.");
1285 COMMAND_HANDLER(stm32x_handle_options_read_command)
1287 uint32_t optionbyte;
1288 struct target *target = NULL;
1289 struct stm32x_flash_bank *stm32x_info = NULL;
1292 return ERROR_COMMAND_SYNTAX_ERROR;
1294 struct flash_bank *bank;
1295 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1296 if (ERROR_OK != retval)
1299 stm32x_info = bank->driver_priv;
1301 target = bank->target;
1303 if (target->state != TARGET_HALTED) {
1304 LOG_ERROR("Target not halted");
1305 return ERROR_TARGET_NOT_HALTED;
1308 retval = stm32x_check_operation_supported(bank);
1309 if (ERROR_OK != retval)
1312 retval = target_read_u32(target, STM32_FLASH_OBR_B0, &optionbyte);
1313 if (retval != ERROR_OK)
1315 command_print(CMD_CTX, "Option Byte: 0x%" PRIx32 "", optionbyte);
1317 int user_data = optionbyte;
1319 if (buf_get_u32((uint8_t *)&optionbyte, OPT_ERROR, 1))
1320 command_print(CMD_CTX, "Option Byte Complement Error");
1322 if (buf_get_u32((uint8_t *)&optionbyte, OPT_READOUT, 1))
1323 command_print(CMD_CTX, "Readout Protection On");
1325 command_print(CMD_CTX, "Readout Protection Off");
1327 /* user option bytes are offset depending on variant */
1328 optionbyte >>= stm32x_info->option_offset;
1330 if (buf_get_u32((uint8_t *)&optionbyte, OPT_RDWDGSW, 1))
1331 command_print(CMD_CTX, "Software Watchdog");
1333 command_print(CMD_CTX, "Hardware Watchdog");
1335 if (buf_get_u32((uint8_t *)&optionbyte, OPT_RDRSTSTOP, 1))
1336 command_print(CMD_CTX, "Stop: No reset generated");
1338 command_print(CMD_CTX, "Stop: Reset generated");
1340 if (buf_get_u32((uint8_t *)&optionbyte, OPT_RDRSTSTDBY, 1))
1341 command_print(CMD_CTX, "Standby: No reset generated");
1343 command_print(CMD_CTX, "Standby: Reset generated");
1345 if (stm32x_info->has_dual_banks) {
1346 if (buf_get_u32((uint8_t *)&optionbyte, OPT_BFB2, 1))
1347 command_print(CMD_CTX, "Boot: Bank 0");
1349 command_print(CMD_CTX, "Boot: Bank 1");
1352 command_print(CMD_CTX, "User Option0: 0x%02" PRIx8,
1353 (user_data >> stm32x_info->user_data_offset) & 0xff);
1354 command_print(CMD_CTX, "User Option1: 0x%02" PRIx8,
1355 (user_data >> (stm32x_info->user_data_offset + 8)) & 0xff);
1360 COMMAND_HANDLER(stm32x_handle_options_write_command)
1362 struct target *target = NULL;
1363 struct stm32x_flash_bank *stm32x_info = NULL;
1364 uint16_t optionbyte;
1367 return ERROR_COMMAND_SYNTAX_ERROR;
1369 struct flash_bank *bank;
1370 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1371 if (ERROR_OK != retval)
1374 stm32x_info = bank->driver_priv;
1376 target = bank->target;
1378 if (target->state != TARGET_HALTED) {
1379 LOG_ERROR("Target not halted");
1380 return ERROR_TARGET_NOT_HALTED;
1383 retval = stm32x_check_operation_supported(bank);
1384 if (ERROR_OK != retval)
1387 retval = stm32x_read_options(bank);
1388 if (ERROR_OK != retval)
1391 /* start with current options */
1392 optionbyte = stm32x_info->option_bytes.user_options;
1394 /* skip over flash bank */
1399 if (strcmp("SWWDG", CMD_ARGV[0]) == 0)
1400 optionbyte |= (1 << 0);
1401 else if (strcmp("HWWDG", CMD_ARGV[0]) == 0)
1402 optionbyte &= ~(1 << 0);
1403 else if (strcmp("NORSTSTOP", CMD_ARGV[0]) == 0)
1404 optionbyte &= ~(1 << 1);
1405 else if (strcmp("RSTSTNDBY", CMD_ARGV[0]) == 0)
1406 optionbyte &= ~(1 << 1);
1407 else if (strcmp("NORSTSTNDBY", CMD_ARGV[0]) == 0)
1408 optionbyte &= ~(1 << 2);
1409 else if (strcmp("RSTSTOP", CMD_ARGV[0]) == 0)
1410 optionbyte &= ~(1 << 2);
1411 else if (stm32x_info->has_dual_banks) {
1412 if (strcmp("BOOT0", CMD_ARGV[0]) == 0)
1413 optionbyte |= (1 << 3);
1414 else if (strcmp("BOOT1", CMD_ARGV[0]) == 0)
1415 optionbyte &= ~(1 << 3);
1417 return ERROR_COMMAND_SYNTAX_ERROR;
1419 return ERROR_COMMAND_SYNTAX_ERROR;
1424 if (stm32x_erase_options(bank) != ERROR_OK) {
1425 command_print(CMD_CTX, "stm32x failed to erase options");
1429 stm32x_info->option_bytes.user_options = optionbyte;
1431 if (stm32x_write_options(bank) != ERROR_OK) {
1432 command_print(CMD_CTX, "stm32x failed to write options");
1436 command_print(CMD_CTX, "stm32x write options complete.\n"
1437 "INFO: a reset or power cycle is required "
1438 "for the new settings to take effect.");
1443 static int stm32x_mass_erase(struct flash_bank *bank)
1445 struct target *target = bank->target;
1447 if (target->state != TARGET_HALTED) {
1448 LOG_ERROR("Target not halted");
1449 return ERROR_TARGET_NOT_HALTED;
1452 /* unlock option flash registers */
1453 int retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_KEYR), KEY1);
1454 if (retval != ERROR_OK)
1456 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_KEYR), KEY2);
1457 if (retval != ERROR_OK)
1460 /* mass erase flash memory */
1461 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER);
1462 if (retval != ERROR_OK)
1464 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
1465 FLASH_MER | FLASH_STRT);
1466 if (retval != ERROR_OK)
1469 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
1470 if (retval != ERROR_OK)
1473 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
1474 if (retval != ERROR_OK)
1480 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
1485 return ERROR_COMMAND_SYNTAX_ERROR;
1487 struct flash_bank *bank;
1488 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1489 if (ERROR_OK != retval)
1492 retval = stm32x_mass_erase(bank);
1493 if (retval == ERROR_OK) {
1494 /* set all sectors as erased */
1495 for (i = 0; i < bank->num_sectors; i++)
1496 bank->sectors[i].is_erased = 1;
1498 command_print(CMD_CTX, "stm32x mass erase complete");
1500 command_print(CMD_CTX, "stm32x mass erase failed");
1505 static const struct command_registration stm32x_exec_command_handlers[] = {
1508 .handler = stm32x_handle_lock_command,
1509 .mode = COMMAND_EXEC,
1511 .help = "Lock entire flash device.",
1515 .handler = stm32x_handle_unlock_command,
1516 .mode = COMMAND_EXEC,
1518 .help = "Unlock entire protected flash device.",
1521 .name = "mass_erase",
1522 .handler = stm32x_handle_mass_erase_command,
1523 .mode = COMMAND_EXEC,
1525 .help = "Erase entire flash device.",
1528 .name = "options_read",
1529 .handler = stm32x_handle_options_read_command,
1530 .mode = COMMAND_EXEC,
1532 .help = "Read and display device option byte.",
1535 .name = "options_write",
1536 .handler = stm32x_handle_options_write_command,
1537 .mode = COMMAND_EXEC,
1538 .usage = "bank_id ('SWWDG'|'HWWDG') "
1539 "('RSTSTNDBY'|'NORSTSTNDBY') "
1540 "('RSTSTOP'|'NORSTSTOP')",
1541 .help = "Replace bits in device option byte.",
1543 COMMAND_REGISTRATION_DONE
1546 static const struct command_registration stm32x_command_handlers[] = {
1549 .mode = COMMAND_ANY,
1550 .help = "stm32f1x flash command group",
1552 .chain = stm32x_exec_command_handlers,
1554 COMMAND_REGISTRATION_DONE
1557 struct flash_driver stm32f1x_flash = {
1559 .commands = stm32x_command_handlers,
1560 .flash_bank_command = stm32x_flash_bank_command,
1561 .erase = stm32x_erase,
1562 .protect = stm32x_protect,
1563 .write = stm32x_write,
1564 .read = default_flash_read,
1565 .probe = stm32x_probe,
1566 .auto_probe = stm32x_auto_probe,
1567 .erase_check = default_flash_blank_check,
1568 .protect_check = stm32x_protect_check,
1569 .info = get_stm32x_info,