1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2008 by Spencer Oliver *
6 * spen@spen-soft.co.uk *
8 * Copyright (C) 2011 Øyvind Harboe *
9 * oyvind.harboe@zylin.com *
11 * This program is free software; you can redistribute it and/or modify *
12 * it under the terms of the GNU General Public License as published by *
13 * the Free Software Foundation; either version 2 of the License, or *
14 * (at your option) any later version. *
16 * This program is distributed in the hope that it will be useful, *
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
19 * GNU General Public License for more details. *
21 * You should have received a copy of the GNU General Public License *
22 * along with this program; if not, write to the *
23 * Free Software Foundation, Inc., *
24 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
25 ***************************************************************************/
31 #include <helper/binarybuffer.h>
32 #include <target/algorithm.h>
33 #include <target/armv7m.h>
35 /* Regarding performance:
37 * Short story - it might be best to leave the performance at
40 * You may see a jump in speed if you change to using
41 * 32bit words for the block programming.
43 * Its a shame you cannot use the double word as its
44 * even faster - but you require external VPP for that mode.
46 * Having said all that 16bit writes give us the widest vdd
47 * operating range, so may be worth adding a note to that effect.
51 /* Danger!!!! The STM32F1x and STM32F2x series actually have
52 * quite different flash controllers.
54 * What's more scary is that the names of the registers and their
55 * addresses are the same, but the actual bits and what they do are
56 * can be very different.
58 * To reduce testing complexity and dangers of regressions,
59 * a seperate file is used for stm32fx2x.
61 * 1mByte part with 4 x 16, 1 x 64, 7 x 128kBytes sectors
63 * What's the protection page size???
65 * Tested with STM3220F-EVAL board.
67 * STM32F21xx series for reference.
70 * http://www.st.com/internet/mcu/product/250192.jsp
73 * www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/PROGRAMMING_MANUAL/CD00233952.pdf
75 * STM32F1x series - notice that this code was copy, pasted and knocked
76 * into a stm32f2x driver, so in case something has been converted or
77 * bugs haven't been fixed, here are the original manuals:
79 * RM0008 - Reference manual
81 * RM0042, the Flash programming manual for low-, medium- high-density and
82 * connectivity line STM32F10x devices
84 * PM0068, the Flash programming manual for XL-density STM32F10x devices.
88 // Erase time can be as high as 1000ms, 10x this and it's toast...
89 #define FLASH_ERASE_TIMEOUT 10000
90 #define FLASH_WRITE_TIMEOUT 5
93 #define STM32_FLASH_BASE 0x40023c00
94 #define STM32_FLASH_ACR 0x40023c00
95 #define STM32_FLASH_KEYR 0x40023c04
96 #define STM32_FLASH_OPTKEYR 0x40023c08
97 #define STM32_FLASH_SR 0x40023c0C
98 #define STM32_FLASH_CR 0x40023c10
99 #define STM32_FLASH_OPTCR 0x40023c14
100 #define STM32_FLASH_OBR 0x40023c1C
104 /* option byte location */
106 #define STM32_OB_RDP 0x1FFFF800
107 #define STM32_OB_USER 0x1FFFF802
108 #define STM32_OB_DATA0 0x1FFFF804
109 #define STM32_OB_DATA1 0x1FFFF806
110 #define STM32_OB_WRP0 0x1FFFF808
111 #define STM32_OB_WRP1 0x1FFFF80A
112 #define STM32_OB_WRP2 0x1FFFF80C
113 #define STM32_OB_WRP3 0x1FFFF80E
115 /* FLASH_CR register bits */
117 #define FLASH_PG (1 << 0)
118 #define FLASH_SER (1 << 1)
119 #define FLASH_MER (1 << 2)
120 #define FLASH_STRT (1 << 16)
121 #define FLASH_PSIZE_8 (0 << 8)
122 #define FLASH_PSIZE_16 (1 << 8)
123 #define FLASH_PSIZE_32 (2 << 8)
124 #define FLASH_PSIZE_64 (3 << 8)
125 #define FLASH_SNB(a) ((a) << 3)
126 #define FLASH_LOCK (1 << 31)
128 /* FLASH_SR register bits */
130 #define FLASH_BSY (1 << 16)
131 #define FLASH_PGSERR (1 << 7) // Programming sequence error
132 #define FLASH_PGPERR (1 << 6) // Programming parallelism error
133 #define FLASH_PGAERR (1 << 5) // Programming alignment error
134 #define FLASH_WRPERR (1 << 4) // Write protection error
135 #define FLASH_OPERR (1 << 1) // Operation error
137 #define FLASH_ERROR (FLASH_PGSERR | FLASH_PGPERR | FLASH_PGAERR| FLASH_WRPERR| FLASH_OPERR)
139 /* STM32_FLASH_OBR bit definitions (reading) */
142 #define OPT_READOUT 1
143 #define OPT_RDWDGSW 2
144 #define OPT_RDRSTSTOP 3
145 #define OPT_RDRSTSTDBY 4
146 #define OPT_BFB2 5 /* dual flash bank only */
148 /* register unlock keys */
150 #define KEY1 0x45670123
151 #define KEY2 0xCDEF89AB
153 struct stm32x_flash_bank
155 struct working_area *write_algorithm;
160 /* flash bank stm32x <base> <size> 0 0 <target#>
162 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
164 struct stm32x_flash_bank *stm32x_info;
168 LOG_WARNING("incomplete flash_bank stm32x configuration");
169 return ERROR_FLASH_BANK_INVALID;
172 stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
173 bank->driver_priv = stm32x_info;
175 stm32x_info->write_algorithm = NULL;
176 stm32x_info->probed = 0;
181 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
186 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
188 struct target *target = bank->target;
189 return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
192 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
194 struct target *target = bank->target;
196 int retval = ERROR_OK;
198 /* wait for busy to clear */
201 retval = stm32x_get_flash_status(bank, &status);
202 if (retval != ERROR_OK)
204 LOG_DEBUG("status: 0x%" PRIx32 "", status);
205 if ((status & FLASH_BSY) == 0)
209 LOG_ERROR("timed out waiting for flash");
216 if (status & FLASH_WRPERR)
218 LOG_ERROR("stm32x device protected");
222 /* Clear but report errors */
223 if (status & FLASH_ERROR)
225 /* If this operation fails, we ignore it and report the original
228 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
229 status & FLASH_ERROR);
234 static int stm32x_unlock_reg(struct target *target)
236 /* unlock flash registers */
237 int retval = target_write_u32(target, STM32_FLASH_KEYR, KEY1);
238 if (retval != ERROR_OK)
241 retval = target_write_u32(target, STM32_FLASH_KEYR, KEY2);
242 if (retval != ERROR_OK)
247 static int stm32x_protect_check(struct flash_bank *bank)
252 static int stm32x_erase(struct flash_bank *bank, int first, int last)
254 struct target *target = bank->target;
257 if (bank->target->state != TARGET_HALTED)
259 LOG_ERROR("Target not halted");
260 return ERROR_TARGET_NOT_HALTED;
264 retval = stm32x_unlock_reg(target);
265 if (retval != ERROR_OK)
270 To erase a sector, follow the procedure below:
271 1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
273 2. Set the SER bit and select the sector (out of the 12 sectors in the main memory block)
274 you wish to erase (SNB) in the FLASH_CR register
275 3. Set the STRT bit in the FLASH_CR register
276 4. Wait for the BSY bit to be cleared
279 for (i = first; i <= last; i++)
281 retval = target_write_u32(target,
282 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_SER | FLASH_SNB(i) | FLASH_STRT);
283 if (retval != ERROR_OK)
286 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
287 if (retval != ERROR_OK)
290 bank->sectors[i].is_erased = 1;
293 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
294 if (retval != ERROR_OK)
300 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
305 static int stm32x_write_block(struct flash_bank *bank, uint8_t *buffer,
306 uint32_t offset, uint32_t count)
308 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
309 struct target *target = bank->target;
310 uint32_t buffer_size = 16384;
311 struct working_area *source;
312 uint32_t address = bank->base + offset;
313 struct reg_param reg_params[5];
314 struct armv7m_algorithm armv7m_info;
315 int retval = ERROR_OK;
317 /* see contib/loaders/flash/stm32x.s for src */
319 static const uint16_t stm32x_flash_write_code_16[] = {
321 0x4b07, // ldr r3, [pc, #28] (20 <STM32_PROG16>)
322 0x6123, // str r3, [r4, #16]
323 0xf830, 0x3b02, //ldrh.w r3, [r0], #2
324 0xf821, 0x3b02, //strh.w r3, [r1], #2
327 0x68e3, //ldr r3, [r4, #12]
328 0xf413, 0x3f80, // tst.w r3, #65536 ; 0x10000
329 0xd0fb, //beq.n c <busy>
330 0xf013, 0x0ff0, //tst.w r3, #240 ; 0xf0
331 0xd101, //bne.n 1e <exit>
332 0x3a01, //subs r2, #1
333 0xd1f0, //bne.n 0 <write>
335 0xbe00, // bkpt 0x0000
337 //00000020 <STM32_PROG16>:
338 0x0101, 0x0000, // .word 0x00000101
343 uint8_t stm32x_flash_write_code[sizeof(stm32x_flash_write_code_16)*2];
344 for (unsigned i = 0; i < sizeof(stm32x_flash_write_code_16) / 2; i++)
346 stm32x_flash_write_code[i*2 + 0] = stm32x_flash_write_code_16[i] & 0xff;
347 stm32x_flash_write_code[i*2 + 1] = (stm32x_flash_write_code_16[i] >> 8) & 0xff;
350 if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
351 &stm32x_info->write_algorithm) != ERROR_OK)
353 LOG_WARNING("no working area available, can't do block memory writes");
354 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
357 if ((retval = target_write_buffer(target, stm32x_info->write_algorithm->address,
358 sizeof(stm32x_flash_write_code),
359 (uint8_t*)stm32x_flash_write_code)) != ERROR_OK)
363 while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK)
366 if (buffer_size <= 256)
368 /* if we already allocated the writing code, but failed to get a
369 * buffer, free the algorithm */
370 if (stm32x_info->write_algorithm)
371 target_free_working_area(target, stm32x_info->write_algorithm);
373 LOG_WARNING("no large enough working area available, can't do block memory writes");
374 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
378 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
379 armv7m_info.core_mode = ARMV7M_MODE_ANY;
381 init_reg_param(®_params[0], "r0", 32, PARAM_OUT);
382 init_reg_param(®_params[1], "r1", 32, PARAM_OUT);
383 init_reg_param(®_params[2], "r2", 32, PARAM_OUT);
384 init_reg_param(®_params[3], "r3", 32, PARAM_IN_OUT);
385 init_reg_param(®_params[4], "r4", 32, PARAM_OUT);
389 uint32_t thisrun_count = (count > (buffer_size / 2)) ?
390 (buffer_size / 2) : count;
392 if ((retval = target_write_buffer(target, source->address,
393 thisrun_count * 2, buffer)) != ERROR_OK)
396 buf_set_u32(reg_params[0].value, 0, 32, source->address);
397 buf_set_u32(reg_params[1].value, 0, 32, address);
398 buf_set_u32(reg_params[2].value, 0, 32, thisrun_count);
399 // R3 is a return value only
400 buf_set_u32(reg_params[4].value, 0, 32, STM32_FLASH_BASE);
402 if ((retval = target_run_algorithm(target, 0, NULL,
403 sizeof(reg_params) / sizeof(*reg_params),
405 stm32x_info->write_algorithm->address,
407 10000, &armv7m_info)) != ERROR_OK)
409 LOG_ERROR("error executing stm32x flash write algorithm");
413 uint32_t error = buf_get_u32(reg_params[3].value, 0, 32) & FLASH_ERROR;
415 if (error & FLASH_WRPERR)
417 LOG_ERROR("flash memory write protected");
422 LOG_ERROR("flash write failed = %08x", error);
423 /* Clear but report errors */
424 target_write_u32(target, STM32_FLASH_SR, error);
429 buffer += thisrun_count * 2;
430 address += thisrun_count * 2;
431 count -= thisrun_count;
434 target_free_working_area(target, source);
435 target_free_working_area(target, stm32x_info->write_algorithm);
437 destroy_reg_param(®_params[0]);
438 destroy_reg_param(®_params[1]);
439 destroy_reg_param(®_params[2]);
440 destroy_reg_param(®_params[3]);
441 destroy_reg_param(®_params[4]);
446 static int stm32x_write(struct flash_bank *bank, uint8_t *buffer,
447 uint32_t offset, uint32_t count)
449 struct target *target = bank->target;
450 uint32_t words_remaining = (count / 2);
451 uint32_t bytes_remaining = (count & 0x00000001);
452 uint32_t address = bank->base + offset;
453 uint32_t bytes_written = 0;
456 if (bank->target->state != TARGET_HALTED)
458 LOG_ERROR("Target not halted");
459 return ERROR_TARGET_NOT_HALTED;
464 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
465 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
468 retval = stm32x_unlock_reg(target);
469 if (retval != ERROR_OK)
472 /* multiple half words (2-byte) to be programmed? */
473 if (words_remaining > 0)
475 /* try using a block write */
476 if ((retval = stm32x_write_block(bank, buffer, offset, words_remaining)) != ERROR_OK)
478 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE)
480 /* if block write failed (no sufficient working area),
481 * we use normal (slow) single dword accesses */
482 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
487 buffer += words_remaining * 2;
488 address += words_remaining * 2;
493 if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
498 The Flash memory programming sequence is as follows:
499 1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
501 2. Set the PG bit in the FLASH_CR register
502 3. Perform the data write operation(s) to the desired memory address (inside main
503 memory block or OTP area):
504 – – Half-word access in case of x16 parallelism
505 – Word access in case of x32 parallelism
508 Byte access in case of x8 parallelism
509 Double word access in case of x64 parallelism
510 Wait for the BSY bit to be cleared
512 while (words_remaining > 0)
515 memcpy(&value, buffer + bytes_written, sizeof(uint16_t));
517 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
518 FLASH_PG | FLASH_PSIZE_16);
519 if (retval != ERROR_OK)
522 retval = target_write_u16(target, address, value);
523 if (retval != ERROR_OK)
526 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
527 if (retval != ERROR_OK)
537 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
538 FLASH_PG | FLASH_PSIZE_8);
539 if (retval != ERROR_OK)
541 retval = target_write_u8(target, address, buffer[bytes_written]);
542 if (retval != ERROR_OK)
545 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
546 if (retval != ERROR_OK)
550 return target_write_u32(target, STM32_FLASH_CR, FLASH_LOCK);
553 static void setup_sector(struct flash_bank *bank, int start, int num, int size)
555 for (int i = start; i < (start + num) ; i++)
557 bank->sectors[i].offset = bank->size;
558 bank->sectors[i].size = size;
559 bank->size += bank->sectors[i].size;
563 static int stm32x_probe(struct flash_bank *bank)
565 struct target *target = bank->target;
566 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
570 uint32_t base_address = 0x08000000;
572 stm32x_info->probed = 0;
574 /* read stm32 device id register */
575 int retval = target_read_u32(target, 0xE0042000, &device_id);
576 if (retval != ERROR_OK)
578 LOG_INFO("device id = 0x%08" PRIx32 "", device_id);
580 if ((device_id & 0x7ff) != 0x411)
582 LOG_WARNING("Cannot identify target as a STM32 family, try the other STM32 drivers.");
586 /* sectors sizes vary, handle this in a different code path
589 // Uhhh.... what to use here?
591 /* calculate numbers of pages*/
592 num_pages = 4 + 1 + 7;
597 bank->sectors = NULL;
600 bank->base = base_address;
601 bank->num_sectors = num_pages;
602 bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
605 setup_sector(bank, 0, 4, 16 * 1024);
606 setup_sector(bank, 4, 1, 64 * 1024);
607 setup_sector(bank, 4+1, 7, 128 * 1024);
609 for (i = 0; i < num_pages; i++)
611 bank->sectors[i].is_erased = -1;
612 bank->sectors[i].is_protected = 0;
615 LOG_INFO("flash size = %dkBytes", bank->size / 1024);
617 stm32x_info->probed = 1;
622 static int stm32x_auto_probe(struct flash_bank *bank)
624 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
625 if (stm32x_info->probed)
627 return stm32x_probe(bank);
630 static int get_stm32x_info(struct flash_bank *bank, char *buf, int buf_size)
632 struct target *target = bank->target;
636 /* read stm32 device id register */
637 int retval = target_read_u32(target, 0xE0042000, &device_id);
638 if (retval != ERROR_OK)
641 if ((device_id & 0x7ff) == 0x411)
643 printed = snprintf(buf, buf_size, "stm32x (1mByte part) - Rev: ");
647 switch (device_id >> 16)
650 snprintf(buf, buf_size, "A");
654 snprintf(buf, buf_size, "B");
658 snprintf(buf, buf_size, "Z");
662 snprintf(buf, buf_size, "Y");
666 snprintf(buf, buf_size, "unknown");
672 snprintf(buf, buf_size, "Cannot identify target as a stm32x\n");
679 static const struct command_registration stm32x_exec_command_handlers[] = {
680 COMMAND_REGISTRATION_DONE
683 static const struct command_registration stm32x_command_handlers[] = {
687 .help = "stm32f2x flash command group",
688 .chain = stm32x_exec_command_handlers,
690 COMMAND_REGISTRATION_DONE
693 struct flash_driver stm32f2x_flash = {
695 .commands = stm32x_command_handlers,
696 .flash_bank_command = stm32x_flash_bank_command,
697 .erase = stm32x_erase,
698 .protect = stm32x_protect,
699 .write = stm32x_write,
700 .read = default_flash_read,
701 .probe = stm32x_probe,
702 .auto_probe = stm32x_auto_probe,
703 .erase_check = default_flash_mem_blank_check,
704 .protect_check = stm32x_protect_check,
705 .info = get_stm32x_info,