1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2008 by Spencer Oliver *
6 * spen@spen-soft.co.uk *
8 * Copyright (C) 2011 Øyvind Harboe *
9 * oyvind.harboe@zylin.com *
11 * This program is free software; you can redistribute it and/or modify *
12 * it under the terms of the GNU General Public License as published by *
13 * the Free Software Foundation; either version 2 of the License, or *
14 * (at your option) any later version. *
16 * This program is distributed in the hope that it will be useful, *
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
19 * GNU General Public License for more details. *
21 * You should have received a copy of the GNU General Public License *
22 * along with this program; if not, write to the *
23 * Free Software Foundation, Inc., *
24 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
25 ***************************************************************************/
31 #include <helper/binarybuffer.h>
32 #include <target/algorithm.h>
33 #include <target/armv7m.h>
35 /* Regarding performance:
37 * Short story - it might be best to leave the performance at
40 * You may see a jump in speed if you change to using
41 * 32bit words for the block programming.
43 * Its a shame you cannot use the double word as its
44 * even faster - but you require external VPP for that mode.
46 * Having said all that 16bit writes give us the widest vdd
47 * operating range, so may be worth adding a note to that effect.
51 /* Danger!!!! The STM32F1x and STM32F2x series actually have
52 * quite different flash controllers.
54 * What's more scary is that the names of the registers and their
55 * addresses are the same, but the actual bits and what they do are
56 * can be very different.
58 * To reduce testing complexity and dangers of regressions,
59 * a seperate file is used for stm32fx2x.
61 * 1mByte part with 4 x 16, 1 x 64, 7 x 128kBytes sectors
63 * What's the protection page size???
65 * Tested with STM3220F-EVAL board.
67 * STM32F21xx series for reference.
70 * http://www.st.com/internet/mcu/product/250192.jsp
73 * www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/PROGRAMMING_MANUAL/CD00233952.pdf
75 * STM32F1x series - notice that this code was copy, pasted and knocked
76 * into a stm32f2x driver, so in case something has been converted or
77 * bugs haven't been fixed, here are the original manuals:
79 * RM0008 - Reference manual
81 * RM0042, the Flash programming manual for low-, medium- high-density and
82 * connectivity line STM32F10x devices
84 * PM0068, the Flash programming manual for XL-density STM32F10x devices.
88 // Erase time can be as high as 1000ms, 10x this and it's toast...
89 #define FLASH_ERASE_TIMEOUT 10000
90 #define FLASH_WRITE_TIMEOUT 5
93 #define STM32_FLASH_BASE 0x40023c00
94 #define STM32_FLASH_ACR 0x40023c00
95 #define STM32_FLASH_KEYR 0x40023c04
96 #define STM32_FLASH_OPTKEYR 0x40023c08
97 #define STM32_FLASH_SR 0x40023c0C
98 #define STM32_FLASH_CR 0x40023c10
99 #define STM32_FLASH_OPTCR 0x40023c14
100 #define STM32_FLASH_OBR 0x40023c1C
104 /* option byte location */
106 #define STM32_OB_RDP 0x1FFFF800
107 #define STM32_OB_USER 0x1FFFF802
108 #define STM32_OB_DATA0 0x1FFFF804
109 #define STM32_OB_DATA1 0x1FFFF806
110 #define STM32_OB_WRP0 0x1FFFF808
111 #define STM32_OB_WRP1 0x1FFFF80A
112 #define STM32_OB_WRP2 0x1FFFF80C
113 #define STM32_OB_WRP3 0x1FFFF80E
115 /* FLASH_CR register bits */
117 #define FLASH_PG (1 << 0)
118 #define FLASH_SER (1 << 1)
119 #define FLASH_MER (1 << 2)
120 #define FLASH_STRT (1 << 16)
121 #define FLASH_PSIZE_8 (0 << 8)
122 #define FLASH_PSIZE_16 (1 << 8)
123 #define FLASH_PSIZE_32 (2 << 8)
124 #define FLASH_PSIZE_64 (3 << 8)
125 #define FLASH_SNB(a) ((a) << 3)
126 #define FLASH_LOCK (1 << 31)
128 /* FLASH_SR register bits */
130 #define FLASH_BSY (1 << 16)
131 #define FLASH_PGSERR (1 << 7) // Programming sequence error
132 #define FLASH_PGPERR (1 << 6) // Programming parallelism error
133 #define FLASH_PGAERR (1 << 5) // Programming alignment error
134 #define FLASH_WRPERR (1 << 4) // Write protection error
135 #define FLASH_OPERR (1 << 1) // Operation error
137 #define FLASH_ERROR (FLASH_PGSERR | FLASH_PGPERR | FLASH_PGAERR| FLASH_WRPERR| FLASH_OPERR)
139 /* STM32_FLASH_OBR bit definitions (reading) */
142 #define OPT_READOUT 1
143 #define OPT_RDWDGSW 2
144 #define OPT_RDRSTSTOP 3
145 #define OPT_RDRSTSTDBY 4
146 #define OPT_BFB2 5 /* dual flash bank only */
148 /* register unlock keys */
150 #define KEY1 0x45670123
151 #define KEY2 0xCDEF89AB
153 struct stm32x_flash_bank
155 struct working_area *write_algorithm;
160 /* flash bank stm32x <base> <size> 0 0 <target#>
162 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
164 struct stm32x_flash_bank *stm32x_info;
168 LOG_WARNING("incomplete flash_bank stm32x configuration");
169 return ERROR_FLASH_BANK_INVALID;
172 stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
173 bank->driver_priv = stm32x_info;
175 stm32x_info->write_algorithm = NULL;
176 stm32x_info->probed = 0;
181 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
186 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
188 struct target *target = bank->target;
189 return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
192 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
194 struct target *target = bank->target;
196 int retval = ERROR_OK;
198 /* wait for busy to clear */
201 retval = stm32x_get_flash_status(bank, &status);
202 if (retval != ERROR_OK)
204 LOG_DEBUG("status: 0x%" PRIx32 "", status);
205 if ((status & FLASH_BSY) == 0)
209 LOG_ERROR("timed out waiting for flash");
216 if (status & FLASH_WRPERR)
218 LOG_ERROR("stm32x device protected");
222 /* Clear but report errors */
223 if (status & FLASH_ERROR)
225 /* If this operation fails, we ignore it and report the original
228 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
229 status & FLASH_ERROR);
234 static int stm32x_unlock_reg(struct target *target)
238 /* unlock flash registers */
239 int retval = target_write_u32(target, STM32_FLASH_KEYR, KEY1);
240 if (retval != ERROR_OK)
243 retval = target_write_u32(target, STM32_FLASH_KEYR, KEY2);
244 if (retval != ERROR_OK)
247 retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
248 if (retval != ERROR_OK)
251 if (ctrl & FLASH_LOCK) {
252 LOG_ERROR("flash not unlocked STM32_FLASH_CR: %x", ctrl);
253 return ERROR_TARGET_FAILURE;
259 static int stm32x_protect_check(struct flash_bank *bank)
264 static int stm32x_erase(struct flash_bank *bank, int first, int last)
266 struct target *target = bank->target;
269 if (bank->target->state != TARGET_HALTED)
271 LOG_ERROR("Target not halted");
272 return ERROR_TARGET_NOT_HALTED;
276 retval = stm32x_unlock_reg(target);
277 if (retval != ERROR_OK)
282 To erase a sector, follow the procedure below:
283 1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
285 2. Set the SER bit and select the sector (out of the 12 sectors in the main memory block)
286 you wish to erase (SNB) in the FLASH_CR register
287 3. Set the STRT bit in the FLASH_CR register
288 4. Wait for the BSY bit to be cleared
291 for (i = first; i <= last; i++)
293 retval = target_write_u32(target,
294 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_SER | FLASH_SNB(i) | FLASH_STRT);
295 if (retval != ERROR_OK)
298 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
299 if (retval != ERROR_OK)
302 bank->sectors[i].is_erased = 1;
305 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
306 if (retval != ERROR_OK)
312 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
317 static int stm32x_write_block(struct flash_bank *bank, uint8_t *buffer,
318 uint32_t offset, uint32_t count)
320 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
321 struct target *target = bank->target;
322 uint32_t buffer_size = 16384;
323 struct working_area *source;
324 uint32_t address = bank->base + offset;
325 struct reg_param reg_params[5];
326 struct armv7m_algorithm armv7m_info;
327 int retval = ERROR_OK;
329 /* see contrib/loaders/flash/stm32f2x.S for src */
331 static const uint16_t stm32x_flash_write_code_16[] = {
332 /* 00000000 <write>: */
333 0x4b07, /* ldr r3, [pc, #28] (20 <STM32_PROG16>) */
334 0x6123, /* str r3, [r4, #16] */
335 0xf830, 0x3b02, /* ldrh.w r3, [r0], #2 */
336 0xf821, 0x3b02, /* strh.w r3, [r1], #2 */
338 /* 0000000c <busy>: */
339 0x68e3, /* ldr r3, [r4, #12] */
340 0xf413, 0x3f80, /* tst.w r3, #65536 ; 0x10000 */
341 0xd0fb, /* beq.n c <busy> */
342 0xf013, 0x0ff0, /* tst.w r3, #240 ; 0xf0 */
343 0xd101, /* bne.n 1e <exit> */
344 0x3a01, /* subs r2, #1 */
345 0xd1f0, /* bne.n 0 <write> */
346 /* 0000001e <exit>: */
347 0xbe00, /* bkpt 0x0000 */
349 /* 00000020 <STM32_PROG16>: */
350 0x0101, 0x0000, /* .word 0x00000101 */
354 uint8_t stm32x_flash_write_code[sizeof(stm32x_flash_write_code_16)*2];
355 for (unsigned i = 0; i < sizeof(stm32x_flash_write_code_16) / 2; i++)
357 stm32x_flash_write_code[i*2 + 0] = stm32x_flash_write_code_16[i] & 0xff;
358 stm32x_flash_write_code[i*2 + 1] = (stm32x_flash_write_code_16[i] >> 8) & 0xff;
361 if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
362 &stm32x_info->write_algorithm) != ERROR_OK)
364 LOG_WARNING("no working area available, can't do block memory writes");
365 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
368 if ((retval = target_write_buffer(target, stm32x_info->write_algorithm->address,
369 sizeof(stm32x_flash_write_code),
370 (uint8_t*)stm32x_flash_write_code)) != ERROR_OK)
374 while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK)
377 if (buffer_size <= 256)
379 /* if we already allocated the writing code, but failed to get a
380 * buffer, free the algorithm */
381 if (stm32x_info->write_algorithm)
382 target_free_working_area(target, stm32x_info->write_algorithm);
384 LOG_WARNING("no large enough working area available, can't do block memory writes");
385 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
389 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
390 armv7m_info.core_mode = ARMV7M_MODE_ANY;
392 init_reg_param(®_params[0], "r0", 32, PARAM_OUT);
393 init_reg_param(®_params[1], "r1", 32, PARAM_OUT);
394 init_reg_param(®_params[2], "r2", 32, PARAM_OUT);
395 init_reg_param(®_params[3], "r3", 32, PARAM_IN_OUT);
396 init_reg_param(®_params[4], "r4", 32, PARAM_OUT);
400 uint32_t thisrun_count = (count > (buffer_size / 2)) ?
401 (buffer_size / 2) : count;
403 if ((retval = target_write_buffer(target, source->address,
404 thisrun_count * 2, buffer)) != ERROR_OK)
407 buf_set_u32(reg_params[0].value, 0, 32, source->address);
408 buf_set_u32(reg_params[1].value, 0, 32, address);
409 buf_set_u32(reg_params[2].value, 0, 32, thisrun_count);
410 // R3 is a return value only
411 buf_set_u32(reg_params[4].value, 0, 32, STM32_FLASH_BASE);
413 if ((retval = target_run_algorithm(target, 0, NULL,
414 sizeof(reg_params) / sizeof(*reg_params),
416 stm32x_info->write_algorithm->address,
418 10000, &armv7m_info)) != ERROR_OK)
420 LOG_ERROR("error executing stm32x flash write algorithm");
424 uint32_t error = buf_get_u32(reg_params[3].value, 0, 32) & FLASH_ERROR;
426 if (error & FLASH_WRPERR)
428 LOG_ERROR("flash memory write protected");
433 LOG_ERROR("flash write failed = %08x", error);
434 /* Clear but report errors */
435 target_write_u32(target, STM32_FLASH_SR, error);
440 buffer += thisrun_count * 2;
441 address += thisrun_count * 2;
442 count -= thisrun_count;
445 target_free_working_area(target, source);
446 target_free_working_area(target, stm32x_info->write_algorithm);
448 destroy_reg_param(®_params[0]);
449 destroy_reg_param(®_params[1]);
450 destroy_reg_param(®_params[2]);
451 destroy_reg_param(®_params[3]);
452 destroy_reg_param(®_params[4]);
457 static int stm32x_write(struct flash_bank *bank, uint8_t *buffer,
458 uint32_t offset, uint32_t count)
460 struct target *target = bank->target;
461 uint32_t words_remaining = (count / 2);
462 uint32_t bytes_remaining = (count & 0x00000001);
463 uint32_t address = bank->base + offset;
464 uint32_t bytes_written = 0;
467 if (bank->target->state != TARGET_HALTED)
469 LOG_ERROR("Target not halted");
470 return ERROR_TARGET_NOT_HALTED;
475 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
476 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
479 retval = stm32x_unlock_reg(target);
480 if (retval != ERROR_OK)
483 /* multiple half words (2-byte) to be programmed? */
484 if (words_remaining > 0)
486 /* try using a block write */
487 if ((retval = stm32x_write_block(bank, buffer, offset, words_remaining)) != ERROR_OK)
489 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE)
491 /* if block write failed (no sufficient working area),
492 * we use normal (slow) single dword accesses */
493 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
498 buffer += words_remaining * 2;
499 address += words_remaining * 2;
504 if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
509 The Flash memory programming sequence is as follows:
510 1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
512 2. Set the PG bit in the FLASH_CR register
513 3. Perform the data write operation(s) to the desired memory address (inside main
514 memory block or OTP area):
515 – – Half-word access in case of x16 parallelism
516 – Word access in case of x32 parallelism
519 Byte access in case of x8 parallelism
520 Double word access in case of x64 parallelism
521 Wait for the BSY bit to be cleared
523 while (words_remaining > 0)
526 memcpy(&value, buffer + bytes_written, sizeof(uint16_t));
528 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
529 FLASH_PG | FLASH_PSIZE_16);
530 if (retval != ERROR_OK)
533 retval = target_write_u16(target, address, value);
534 if (retval != ERROR_OK)
537 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
538 if (retval != ERROR_OK)
548 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
549 FLASH_PG | FLASH_PSIZE_8);
550 if (retval != ERROR_OK)
552 retval = target_write_u8(target, address, buffer[bytes_written]);
553 if (retval != ERROR_OK)
556 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
557 if (retval != ERROR_OK)
561 return target_write_u32(target, STM32_FLASH_CR, FLASH_LOCK);
564 static void setup_sector(struct flash_bank *bank, int start, int num, int size)
566 for (int i = start; i < (start + num) ; i++)
568 bank->sectors[i].offset = bank->size;
569 bank->sectors[i].size = size;
570 bank->size += bank->sectors[i].size;
574 static int stm32x_probe(struct flash_bank *bank)
576 struct target *target = bank->target;
577 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
581 uint32_t base_address = 0x08000000;
583 stm32x_info->probed = 0;
585 /* read stm32 device id register */
586 int retval = target_read_u32(target, 0xE0042000, &device_id);
587 if (retval != ERROR_OK)
589 LOG_INFO("device id = 0x%08" PRIx32 "", device_id);
591 if ((device_id & 0x7ff) != 0x411)
593 LOG_WARNING("Cannot identify target as a STM32 family, try the other STM32 drivers.");
597 /* sectors sizes vary, handle this in a different code path
600 // Uhhh.... what to use here?
602 /* calculate numbers of pages*/
603 num_pages = 4 + 1 + 7;
608 bank->sectors = NULL;
611 bank->base = base_address;
612 bank->num_sectors = num_pages;
613 bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
616 setup_sector(bank, 0, 4, 16 * 1024);
617 setup_sector(bank, 4, 1, 64 * 1024);
618 setup_sector(bank, 4+1, 7, 128 * 1024);
620 for (i = 0; i < num_pages; i++)
622 bank->sectors[i].is_erased = -1;
623 bank->sectors[i].is_protected = 0;
626 LOG_INFO("flash size = %dkBytes", bank->size / 1024);
628 stm32x_info->probed = 1;
633 static int stm32x_auto_probe(struct flash_bank *bank)
635 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
636 if (stm32x_info->probed)
638 return stm32x_probe(bank);
641 static int get_stm32x_info(struct flash_bank *bank, char *buf, int buf_size)
643 struct target *target = bank->target;
647 /* read stm32 device id register */
648 int retval = target_read_u32(target, 0xE0042000, &device_id);
649 if (retval != ERROR_OK)
652 if ((device_id & 0x7ff) == 0x411)
654 printed = snprintf(buf, buf_size, "stm32x (1mByte part) - Rev: ");
658 switch (device_id >> 16)
661 snprintf(buf, buf_size, "A");
665 snprintf(buf, buf_size, "B");
669 snprintf(buf, buf_size, "Z");
673 snprintf(buf, buf_size, "Y");
677 snprintf(buf, buf_size, "unknown");
683 snprintf(buf, buf_size, "Cannot identify target as a stm32x\n");
690 static int stm32x_mass_erase(struct flash_bank *bank)
693 struct target *target = bank->target;
695 if (target->state != TARGET_HALTED) {
696 LOG_ERROR("Target not halted");
697 return ERROR_TARGET_NOT_HALTED;
700 retval = stm32x_unlock_reg(target);
701 if (retval != ERROR_OK)
704 /* mass erase flash memory */
705 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER);
706 if (retval != ERROR_OK)
708 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
709 FLASH_MER | FLASH_STRT);
710 if (retval != ERROR_OK)
713 retval = stm32x_wait_status_busy(bank, 30000);
714 if (retval != ERROR_OK)
717 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
718 if (retval != ERROR_OK)
724 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
729 command_print(CMD_CTX, "stm32x mass_erase <bank>");
730 return ERROR_COMMAND_SYNTAX_ERROR;
733 struct flash_bank *bank;
734 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
735 if (ERROR_OK != retval)
738 retval = stm32x_mass_erase(bank);
739 if (retval == ERROR_OK) {
740 /* set all sectors as erased */
741 for (i = 0; i < bank->num_sectors; i++)
742 bank->sectors[i].is_erased = 1;
744 command_print(CMD_CTX, "stm32x mass erase complete");
746 command_print(CMD_CTX, "stm32x mass erase failed");
752 static const struct command_registration stm32x_exec_command_handlers[] = {
754 .name = "mass_erase",
755 .handler = stm32x_handle_mass_erase_command,
756 .mode = COMMAND_EXEC,
758 .help = "Erase entire flash device.",
760 COMMAND_REGISTRATION_DONE
763 static const struct command_registration stm32x_command_handlers[] = {
767 .help = "stm32f2x flash command group",
768 .chain = stm32x_exec_command_handlers,
770 COMMAND_REGISTRATION_DONE
773 struct flash_driver stm32f2x_flash = {
775 .commands = stm32x_command_handlers,
776 .flash_bank_command = stm32x_flash_bank_command,
777 .erase = stm32x_erase,
778 .protect = stm32x_protect,
779 .write = stm32x_write,
780 .read = default_flash_read,
781 .probe = stm32x_probe,
782 .auto_probe = stm32x_auto_probe,
783 .erase_check = default_flash_mem_blank_check,
784 .protect_check = stm32x_protect_check,
785 .info = get_stm32x_info,