git.gag.com Git - fw/openocd/blob - src/flash/nor/stm32f2x.c

   1 /***************************************************************************
   2  *   Copyright (C) 2005 by Dominic Rath                                    *
   3  *   Dominic.Rath@gmx.de                                                   *
   4  *                                                                         *
   5  *   Copyright (C) 2008 by Spencer Oliver                                  *
   6  *   spen@spen-soft.co.uk                                                  *
   7  *                                                                         *
   8  *   Copyright (C) 2011 Øyvind Harboe                                      *
   9  *   oyvind.harboe@zylin.com                                               *
  10  *                                                                         *
  11  *   This program is free software; you can redistribute it and/or modify  *
  12  *   it under the terms of the GNU General Public License as published by  *
  13  *   the Free Software Foundation; either version 2 of the License, or     *
  14  *   (at your option) any later version.                                   *
  15  *                                                                         *
  16  *   This program is distributed in the hope that it will be useful,       *
  17  *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  18  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  19  *   GNU General Public License for more details.                          *
  20  *                                                                         *
  21  *   You should have received a copy of the GNU General Public License     *
  22  *   along with this program.  If not, see <http://www.gnu.org/licenses/>. *
  23  ***************************************************************************/
  24
  25 #ifdef HAVE_CONFIG_H
  26 #include "config.h"
  27 #endif
  28
  29 #include "imp.h"
  30 #include <helper/binarybuffer.h>
  31 #include <target/algorithm.h>
  32 #include <target/armv7m.h>
  33
  34 /* Regarding performance:
  35  *
  36  * Short story - it might be best to leave the performance at
  37  * current levels.
  38  *
  39  * You may see a jump in speed if you change to using
  40  * 32bit words for the block programming.
  41  *
  42  * Its a shame you cannot use the double word as its
  43  * even faster - but you require external VPP for that mode.
  44  *
  45  * Having said all that 16bit writes give us the widest vdd
  46  * operating range, so may be worth adding a note to that effect.
  47  *
  48  */
  49
  50 /* Danger!!!! The STM32F1x and STM32F2x series actually have
  51  * quite different flash controllers.
  52  *
  53  * What's more scary is that the names of the registers and their
  54  * addresses are the same, but the actual bits and what they do are
  55  * can be very different.
  56  *
  57  * To reduce testing complexity and dangers of regressions,
  58  * a seperate file is used for stm32fx2x.
  59  *
  60  * Sector sizes in kiBytes:
  61  * 1 MiByte part with 4 x 16, 1 x 64, 7 x 128.
  62  * 2 MiByte part with 4 x 16, 1 x 64, 7 x 128, 4 x 16, 1 x 64, 7 x 128.
  63  * 1 MiByte STM32F42x/43x part with DB1M Option set:
  64  *                    4 x 16, 1 x 64, 3 x 128, 4 x 16, 1 x 64, 3 x 128.
  65  *
  66  * STM32F7[4|5]
  67  * 1 MiByte part with 4 x 32, 1 x 128, 3 x 256.
  68  *
  69  * STM32F7[6|7]
  70  * 1 MiByte part in single bank mode with 4 x 32, 1 x 128, 3 x 256.
  71  * 1 MiByte part in dual-bank mode two banks with 4 x 16, 1 x 64, 3 x 128 each.
  72  * 2 MiByte part in single-bank mode with 4 x 32, 1 x 128, 7 x 256.
  73  * 2 MiByte part in dual-bank mode two banks with 4 x 16, 1 x 64, 7 x 128 each.
  74  *
  75  * Protection size is sector size.
  76  *
  77  * Tested with STM3220F-EVAL board.
  78  *
  79  * STM32F4xx series for reference.
  80  *
  81  * RM0090
  82  * http://www.st.com/web/en/resource/technical/document/reference_manual/DM00031020.pdf
  83  *
  84  * PM0059
  85  * www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/
  86  * PROGRAMMING_MANUAL/CD00233952.pdf
  87  *
  88  * STM32F7xx series for reference.
  89  *
  90  * RM0385
  91  * http://www.st.com/web/en/resource/technical/document/reference_manual/DM00124865.pdf
  92  *
  93  * RM0410
  94  * http://www.st.com/resource/en/reference_manual/dm00224583.pdf
  95  *
  96  * STM32F1x series - notice that this code was copy, pasted and knocked
  97  * into a stm32f2x driver, so in case something has been converted or
  98  * bugs haven't been fixed, here are the original manuals:
  99  *
 100  * RM0008 - Reference manual
 101  *
 102  * RM0042, the Flash programming manual for low-, medium- high-density and
 103  * connectivity line STM32F10x devices
 104  *
 105  * PM0068, the Flash programming manual for XL-density STM32F10x devices.
 106  *
 107  */
 108
 109 /* Erase time can be as high as 1000ms, 10x this and it's toast... */
 110 #define FLASH_ERASE_TIMEOUT 10000
 111 #define FLASH_WRITE_TIMEOUT 5
 112
 113 /* Mass erase time can be as high as 32 s in x8 mode. */
 114 #define FLASH_MASS_ERASE_TIMEOUT 33000
 115
 116 #define STM32_FLASH_BASE    0x40023c00
 117 #define STM32_FLASH_ACR     0x40023c00
 118 #define STM32_FLASH_KEYR    0x40023c04
 119 #define STM32_FLASH_OPTKEYR 0x40023c08
 120 #define STM32_FLASH_SR      0x40023c0C
 121 #define STM32_FLASH_CR      0x40023c10
 122 #define STM32_FLASH_OPTCR   0x40023c14
 123 #define STM32_FLASH_OPTCR1  0x40023c18
 124
 125 /* FLASH_CR register bits */
 126 #define FLASH_PG       (1 << 0)
 127 #define FLASH_SER      (1 << 1)
 128 #define FLASH_MER      (1 << 2)         /* MER/MER1 for f76x/77x */
 129 #define FLASH_MER1     (1 << 15)        /* MER2 for f76x/77x, confusing ... */
 130 #define FLASH_STRT     (1 << 16)
 131 #define FLASH_PSIZE_8  (0 << 8)
 132 #define FLASH_PSIZE_16 (1 << 8)
 133 #define FLASH_PSIZE_32 (2 << 8)
 134 #define FLASH_PSIZE_64 (3 << 8)
 135 /* The sector number encoding is not straight binary for dual bank flash.
 136  * Warning: evaluates the argument multiple times */
 137 #define FLASH_SNB(a)   ((((a) >= 12) ? 0x10 | ((a) - 12) : (a)) << 3)
 138 #define FLASH_LOCK     (1 << 31)
 139
 140 /* FLASH_SR register bits */
 141 #define FLASH_BSY      (1 << 16)
 142 #define FLASH_PGSERR   (1 << 7) /* Programming sequence error */
 143 #define FLASH_PGPERR   (1 << 6) /* Programming parallelism error */
 144 #define FLASH_PGAERR   (1 << 5) /* Programming alignment error */
 145 #define FLASH_WRPERR   (1 << 4) /* Write protection error */
 146 #define FLASH_OPERR    (1 << 1) /* Operation error */
 147
 148 #define FLASH_ERROR (FLASH_PGSERR | FLASH_PGPERR | FLASH_PGAERR | FLASH_WRPERR | FLASH_OPERR)
 149
 150 /* STM32_FLASH_OPTCR register bits */
 151 #define OPTCR_LOCK     (1 << 0)
 152 #define OPTCR_START    (1 << 1)
 153 #define OPTCR_NDBANK   (1 << 29)        /* not dual bank mode */
 154 #define OPTCR_DB1M     (1 << 30)        /* 1 MiB devices dual flash bank option */
 155
 156 /* register unlock keys */
 157 #define KEY1           0x45670123
 158 #define KEY2           0xCDEF89AB
 159
 160 /* option register unlock key */
 161 #define OPTKEY1        0x08192A3B
 162 #define OPTKEY2        0x4C5D6E7F
 163
 164 struct stm32x_options {
 165         uint8_t RDP;
 166         uint16_t user_options;  /* bit 0-7 usual options, bit 8-11 extra options */
 167         uint32_t protection;
 168         uint32_t boot_addr;
 169 };
 170
 171 struct stm32x_flash_bank {
 172         struct stm32x_options option_bytes;
 173         int probed;
 174         bool has_large_mem;             /* F42x/43x/469/479/7xx in dual bank mode */
 175         bool has_boot_addr;     /* F7xx */
 176         bool has_extra_options; /* F42x/43x/469/479/7xx */
 177         uint32_t user_bank_size;
 178 };
 179
 180 /* flash bank stm32x <base> <size> 0 0 <target#>
 181  */
 182 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
 183 {
 184         struct stm32x_flash_bank *stm32x_info;
 185
 186         if (CMD_ARGC < 6)
 187                 return ERROR_COMMAND_SYNTAX_ERROR;
 188
 189         stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
 190         bank->driver_priv = stm32x_info;
 191
 192         stm32x_info->probed = 0;
 193         stm32x_info->user_bank_size = bank->size;
 194
 195         return ERROR_OK;
 196 }
 197
 198 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
 199 {
 200         return reg;
 201 }
 202
 203 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
 204 {
 205         struct target *target = bank->target;
 206         return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
 207 }
 208
 209 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
 210 {
 211         struct target *target = bank->target;
 212         uint32_t status;
 213         int retval = ERROR_OK;
 214
 215         /* wait for busy to clear */
 216         for (;;) {
 217                 retval = stm32x_get_flash_status(bank, &status);
 218                 if (retval != ERROR_OK)
 219                         return retval;
 220                 LOG_DEBUG("status: 0x%" PRIx32 "", status);
 221                 if ((status & FLASH_BSY) == 0)
 222                         break;
 223                 if (timeout-- <= 0) {
 224                         LOG_ERROR("timed out waiting for flash");
 225                         return ERROR_FAIL;
 226                 }
 227                 alive_sleep(1);
 228         }
 229
 230
 231         if (status & FLASH_WRPERR) {
 232                 LOG_ERROR("stm32x device protected");
 233                 retval = ERROR_FAIL;
 234         }
 235
 236         /* Clear but report errors */
 237         if (status & FLASH_ERROR) {
 238                 /* If this operation fails, we ignore it and report the original
 239                  * retval
 240                  */
 241                 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
 242                                 status & FLASH_ERROR);
 243         }
 244         return retval;
 245 }
 246
 247 static int stm32x_unlock_reg(struct target *target)
 248 {
 249         uint32_t ctrl;
 250
 251         /* first check if not already unlocked
 252          * otherwise writing on STM32_FLASH_KEYR will fail
 253          */
 254         int retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
 255         if (retval != ERROR_OK)
 256                 return retval;
 257
 258         if ((ctrl & FLASH_LOCK) == 0)
 259                 return ERROR_OK;
 260
 261         /* unlock flash registers */
 262         retval = target_write_u32(target, STM32_FLASH_KEYR, KEY1);
 263         if (retval != ERROR_OK)
 264                 return retval;
 265
 266         retval = target_write_u32(target, STM32_FLASH_KEYR, KEY2);
 267         if (retval != ERROR_OK)
 268                 return retval;
 269
 270         retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
 271         if (retval != ERROR_OK)
 272                 return retval;
 273
 274         if (ctrl & FLASH_LOCK) {
 275                 LOG_ERROR("flash not unlocked STM32_FLASH_CR: %" PRIx32, ctrl);
 276                 return ERROR_TARGET_FAILURE;
 277         }
 278
 279         return ERROR_OK;
 280 }
 281
 282 static int stm32x_unlock_option_reg(struct target *target)
 283 {
 284         uint32_t ctrl;
 285
 286         int retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
 287         if (retval != ERROR_OK)
 288                 return retval;
 289
 290         if ((ctrl & OPTCR_LOCK) == 0)
 291                 return ERROR_OK;
 292
 293         /* unlock option registers */
 294         retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY1);
 295         if (retval != ERROR_OK)
 296                 return retval;
 297
 298         retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY2);
 299         if (retval != ERROR_OK)
 300                 return retval;
 301
 302         retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
 303         if (retval != ERROR_OK)
 304                 return retval;
 305
 306         if (ctrl & OPTCR_LOCK) {
 307                 LOG_ERROR("options not unlocked STM32_FLASH_OPTCR: %" PRIx32, ctrl);
 308                 return ERROR_TARGET_FAILURE;
 309         }
 310
 311         return ERROR_OK;
 312 }
 313
 314 static int stm32x_read_options(struct flash_bank *bank)
 315 {
 316         uint32_t optiondata;
 317         struct stm32x_flash_bank *stm32x_info = NULL;
 318         struct target *target = bank->target;
 319
 320         stm32x_info = bank->driver_priv;
 321
 322         /* read current option bytes */
 323         int retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
 324         if (retval != ERROR_OK)
 325                 return retval;
 326
 327     /* caution: F2 implements 5 bits (WDG_SW only)
 328      * whereas F7 6 bits (IWDG_SW and WWDG_SW) in user_options */
 329         stm32x_info->option_bytes.user_options = optiondata & 0xfc;
 330         stm32x_info->option_bytes.RDP = (optiondata >> 8) & 0xff;
 331         stm32x_info->option_bytes.protection = (optiondata >> 16) & 0xfff;
 332
 333         if (stm32x_info->has_extra_options) {
 334                 /* F42x/43x/469/479 and 7xx have up to 4 bits of extra options */
 335                 stm32x_info->option_bytes.user_options |= (optiondata >> 20) & 0xf00;
 336         }
 337
 338         if (stm32x_info->has_large_mem || stm32x_info->has_boot_addr) {
 339                 retval = target_read_u32(target, STM32_FLASH_OPTCR1, &optiondata);
 340                 if (retval != ERROR_OK)
 341                         return retval;
 342
 343                 /* FLASH_OPTCR1 has quite diffent meanings ... */
 344                 if (stm32x_info->has_boot_addr) {
 345                         /* for F7xx it contains boot0 and boot1 */
 346                         stm32x_info->option_bytes.boot_addr = optiondata;
 347                 } else {
 348                         /* for F42x/43x/469/479 it contains 12 additional protection bits */
 349                         stm32x_info->option_bytes.protection |= (optiondata >> 4) & 0x00fff000;
 350                 }
 351         }
 352
 353         if (stm32x_info->option_bytes.RDP != 0xAA)
 354                 LOG_INFO("Device Security Bit Set");
 355
 356         return ERROR_OK;
 357 }
 358
 359 static int stm32x_write_options(struct flash_bank *bank)
 360 {
 361         struct stm32x_flash_bank *stm32x_info = NULL;
 362         struct target *target = bank->target;
 363         uint32_t optiondata, optiondata2;
 364
 365         stm32x_info = bank->driver_priv;
 366
 367         int retval = stm32x_unlock_option_reg(target);
 368         if (retval != ERROR_OK)
 369                 return retval;
 370
 371         /* rebuild option data */
 372         optiondata = stm32x_info->option_bytes.user_options & 0xfc;
 373         optiondata |= stm32x_info->option_bytes.RDP << 8;
 374         optiondata |= (stm32x_info->option_bytes.protection & 0x0fff) << 16;
 375
 376         if (stm32x_info->has_extra_options) {
 377                 /* F42x/43x/469/479 and 7xx have up to 4 bits of extra options */
 378                 optiondata |= (stm32x_info->option_bytes.user_options & 0xf00) << 20;
 379         }
 380
 381         if (stm32x_info->has_large_mem || stm32x_info->has_boot_addr) {
 382                 if (stm32x_info->has_boot_addr) {
 383                         /* F7xx uses FLASH_OPTCR1 for boot0 and boot1 ... */
 384                         optiondata2 = stm32x_info->option_bytes.boot_addr;
 385                 } else {
 386                         /* F42x/43x/469/479 uses FLASH_OPTCR1 for additional protection bits */
 387                         optiondata2 = (stm32x_info->option_bytes.protection & 0x00fff000) << 4;
 388                 }
 389
 390                 retval = target_write_u32(target, STM32_FLASH_OPTCR1, optiondata2);
 391                 if (retval != ERROR_OK)
 392                         return retval;
 393         }
 394
 395         /* program options */
 396         retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata);
 397         if (retval != ERROR_OK)
 398                 return retval;
 399
 400         /* start programming cycle */
 401         retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPTCR_START);
 402         if (retval != ERROR_OK)
 403                 return retval;
 404
 405         /* wait for completion, this might trigger a security erase and take a while */
 406         retval = stm32x_wait_status_busy(bank, FLASH_MASS_ERASE_TIMEOUT);
 407         if (retval != ERROR_OK)
 408                 return retval;
 409
 410         /* relock registers */
 411         retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPTCR_LOCK);
 412         if (retval != ERROR_OK)
 413                 return retval;
 414
 415         return ERROR_OK;
 416 }
 417
 418 static int stm32x_protect_check(struct flash_bank *bank)
 419 {
 420         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 421
 422         /* read write protection settings */
 423         int retval = stm32x_read_options(bank);
 424         if (retval != ERROR_OK) {
 425                 LOG_DEBUG("unable to read option bytes");
 426                 return retval;
 427         }
 428
 429         if (stm32x_info->has_boot_addr && stm32x_info->has_large_mem) {
 430                 /* F76x/77x: bit k protects sectors 2*k and 2*k+1 */
 431                 for (int i = 0; i < (bank->num_sectors >> 1); i++) {
 432                         if (stm32x_info->option_bytes.protection & (1 << i)) {
 433                                 bank->sectors[i << 1].is_protected = 0;
 434                                 bank->sectors[(i << 1) + 1].is_protected = 0;
 435                         } else {
 436                                 bank->sectors[i << 1].is_protected = 1;
 437                                 bank->sectors[(i << 1) + 1].is_protected = 1;
 438                         }
 439                 }
 440         } else {
 441                 /* one protection bit per sector */
 442                 for (int i = 0; i < bank->num_sectors; i++) {
 443                         if (stm32x_info->option_bytes.protection & (1 << i))
 444                                 bank->sectors[i].is_protected = 0;
 445                         else
 446                                 bank->sectors[i].is_protected = 1;
 447                 }
 448         }
 449
 450         return ERROR_OK;
 451 }
 452
 453 static int stm32x_erase(struct flash_bank *bank, int first, int last)
 454 {
 455         struct target *target = bank->target;
 456         int i;
 457
 458         assert((0 <= first) && (first <= last) && (last < bank->num_sectors));
 459
 460         if (bank->target->state != TARGET_HALTED) {
 461                 LOG_ERROR("Target not halted");
 462                 return ERROR_TARGET_NOT_HALTED;
 463         }
 464
 465         int retval;
 466         retval = stm32x_unlock_reg(target);
 467         if (retval != ERROR_OK)
 468                 return retval;
 469
 470         /*
 471         Sector Erase
 472         To erase a sector, follow the procedure below:
 473         1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
 474           FLASH_SR register
 475         2. Set the SER bit and select the sector
 476           you wish to erase (SNB) in the FLASH_CR register
 477         3. Set the STRT bit in the FLASH_CR register
 478         4. Wait for the BSY bit to be cleared
 479          */
 480
 481         for (i = first; i <= last; i++) {
 482                 retval = target_write_u32(target,
 483                                 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_SER | FLASH_SNB(i) | FLASH_STRT);
 484                 if (retval != ERROR_OK)
 485                         return retval;
 486
 487                 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
 488                 if (retval != ERROR_OK)
 489                         return retval;
 490
 491                 bank->sectors[i].is_erased = 1;
 492         }
 493
 494         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
 495         if (retval != ERROR_OK)
 496                 return retval;
 497
 498         return ERROR_OK;
 499 }
 500
 501 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
 502 {
 503         struct target *target = bank->target;
 504         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 505
 506         if (target->state != TARGET_HALTED) {
 507                 LOG_ERROR("Target not halted");
 508                 return ERROR_TARGET_NOT_HALTED;
 509         }
 510
 511         /* read protection settings */
 512         int retval = stm32x_read_options(bank);
 513         if (retval != ERROR_OK) {
 514                 LOG_DEBUG("unable to read option bytes");
 515                 return retval;
 516         }
 517
 518         if (stm32x_info->has_boot_addr && stm32x_info->has_large_mem) {
 519                 /* F76x/77x: bit k protects sectors 2*k and 2*k+1 */
 520                 if ((first & 1) != 0 || (last & 1) != 1) {
 521                         LOG_ERROR("sector protection must be double sector aligned");
 522                         return ERROR_FAIL;
 523                 } else {
 524                         first >>= 1;
 525                         last >>= 1;
 526                 }
 527         }
 528
 529         for (int i = first; i <= last; i++) {
 530                 if (set)
 531                         stm32x_info->option_bytes.protection &= ~(1 << i);
 532                 else
 533                         stm32x_info->option_bytes.protection |= (1 << i);
 534         }
 535
 536         retval = stm32x_write_options(bank);
 537         if (retval != ERROR_OK)
 538                 return retval;
 539
 540         return ERROR_OK;
 541 }
 542
 543 static int stm32x_write_block(struct flash_bank *bank, const uint8_t *buffer,
 544                 uint32_t offset, uint32_t count)
 545 {
 546         struct target *target = bank->target;
 547         uint32_t buffer_size = 16384;
 548         struct working_area *write_algorithm;
 549         struct working_area *source;
 550         uint32_t address = bank->base + offset;
 551         struct reg_param reg_params[5];
 552         struct armv7m_algorithm armv7m_info;
 553         int retval = ERROR_OK;
 554
 555         /* see contrib/loaders/flash/stm32f2x.S for src */
 556
 557         static const uint8_t stm32x_flash_write_code[] = {
 558                                                                         /* wait_fifo: */
 559                 0xD0, 0xF8, 0x00, 0x80,         /* ldr          r8, [r0, #0] */
 560                 0xB8, 0xF1, 0x00, 0x0F,         /* cmp          r8, #0 */
 561                 0x1A, 0xD0,                                     /* beq          exit */
 562                 0x47, 0x68,                                     /* ldr          r7, [r0, #4] */
 563                 0x47, 0x45,                                     /* cmp          r7, r8 */
 564                 0xF7, 0xD0,                                     /* beq          wait_fifo */
 565
 566                 0xDF, 0xF8, 0x34, 0x60,         /* ldr          r6, STM32_PROG16 */
 567                 0x26, 0x61,                                     /* str          r6, [r4, #STM32_FLASH_CR_OFFSET] */
 568                 0x37, 0xF8, 0x02, 0x6B,         /* ldrh         r6, [r7], #0x02 */
 569                 0x22, 0xF8, 0x02, 0x6B,         /* strh         r6, [r2], #0x02 */
 570                 0xBF, 0xF3, 0x4F, 0x8F,         /* dsb          sy */
 571                                                                         /* busy: */
 572                 0xE6, 0x68,                                     /* ldr          r6, [r4, #STM32_FLASH_SR_OFFSET] */
 573                 0x16, 0xF4, 0x80, 0x3F,         /* tst          r6, #0x10000 */
 574                 0xFB, 0xD1,                                     /* bne          busy */
 575                 0x16, 0xF0, 0xF0, 0x0F,         /* tst          r6, #0xf0 */
 576                 0x07, 0xD1,                                     /* bne          error */
 577
 578                 0x8F, 0x42,                                     /* cmp          r7, r1 */
 579                 0x28, 0xBF,                                     /* it           cs */
 580                 0x00, 0xF1, 0x08, 0x07,         /* addcs        r7, r0, #8 */
 581                 0x47, 0x60,                                     /* str          r7, [r0, #4] */
 582                 0x01, 0x3B,                                     /* subs         r3, r3, #1 */
 583                 0x13, 0xB1,                                     /* cbz          r3, exit */
 584                 0xDF, 0xE7,                                     /* b            wait_fifo */
 585                                                                         /* error: */
 586                 0x00, 0x21,                                     /* movs         r1, #0 */
 587                 0x41, 0x60,                                     /* str          r1, [r0, #4] */
 588                                                                         /* exit: */
 589                 0x30, 0x46,                                     /* mov          r0, r6 */
 590                 0x00, 0xBE,                                     /* bkpt         #0x00 */
 591
 592                 /* <STM32_PROG16>: */
 593                 0x01, 0x01, 0x00, 0x00,         /* .word        0x00000101 */
 594         };
 595
 596         if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
 597                         &write_algorithm) != ERROR_OK) {
 598                 LOG_WARNING("no working area available, can't do block memory writes");
 599                 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
 600         }
 601
 602         retval = target_write_buffer(target, write_algorithm->address,
 603                         sizeof(stm32x_flash_write_code),
 604                         stm32x_flash_write_code);
 605         if (retval != ERROR_OK)
 606                 return retval;
 607
 608         /* memory buffer */
 609         while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
 610                 buffer_size /= 2;
 611                 if (buffer_size <= 256) {
 612                         /* we already allocated the writing code, but failed to get a
 613                          * buffer, free the algorithm */
 614                         target_free_working_area(target, write_algorithm);
 615
 616                         LOG_WARNING("no large enough working area available, can't do block memory writes");
 617                         return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
 618                 }
 619         }
 620
 621         armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
 622         armv7m_info.core_mode = ARM_MODE_THREAD;
 623
 624         init_reg_param(&reg_params[0], "r0", 32, PARAM_IN_OUT);         /* buffer start, status (out) */
 625         init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);            /* buffer end */
 626         init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);            /* target address */
 627         init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);            /* count (halfword-16bit) */
 628         init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT);            /* flash base */
 629
 630         buf_set_u32(reg_params[0].value, 0, 32, source->address);
 631         buf_set_u32(reg_params[1].value, 0, 32, source->address + source->size);
 632         buf_set_u32(reg_params[2].value, 0, 32, address);
 633         buf_set_u32(reg_params[3].value, 0, 32, count);
 634         buf_set_u32(reg_params[4].value, 0, 32, STM32_FLASH_BASE);
 635
 636         retval = target_run_flash_async_algorithm(target, buffer, count, 2,
 637                         0, NULL,
 638                         5, reg_params,
 639                         source->address, source->size,
 640                         write_algorithm->address, 0,
 641                         &armv7m_info);
 642
 643         if (retval == ERROR_FLASH_OPERATION_FAILED) {
 644                 LOG_ERROR("error executing stm32x flash write algorithm");
 645
 646                 uint32_t error = buf_get_u32(reg_params[0].value, 0, 32) & FLASH_ERROR;
 647
 648                 if (error & FLASH_WRPERR)
 649                         LOG_ERROR("flash memory write protected");
 650
 651                 if (error != 0) {
 652                         LOG_ERROR("flash write failed = %08" PRIx32, error);
 653                         /* Clear but report errors */
 654                         target_write_u32(target, STM32_FLASH_SR, error);
 655                         retval = ERROR_FAIL;
 656                 }
 657         }
 658
 659         target_free_working_area(target, source);
 660         target_free_working_area(target, write_algorithm);
 661
 662         destroy_reg_param(&reg_params[0]);
 663         destroy_reg_param(&reg_params[1]);
 664         destroy_reg_param(&reg_params[2]);
 665         destroy_reg_param(&reg_params[3]);
 666         destroy_reg_param(&reg_params[4]);
 667
 668         return retval;
 669 }
 670
 671 static int stm32x_write(struct flash_bank *bank, const uint8_t *buffer,
 672                 uint32_t offset, uint32_t count)
 673 {
 674         struct target *target = bank->target;
 675         uint32_t words_remaining = (count / 2);
 676         uint32_t bytes_remaining = (count & 0x00000001);
 677         uint32_t address = bank->base + offset;
 678         uint32_t bytes_written = 0;
 679         int retval;
 680
 681         if (bank->target->state != TARGET_HALTED) {
 682                 LOG_ERROR("Target not halted");
 683                 return ERROR_TARGET_NOT_HALTED;
 684         }
 685
 686         if (offset & 0x1) {
 687                 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
 688                 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
 689         }
 690
 691         retval = stm32x_unlock_reg(target);
 692         if (retval != ERROR_OK)
 693                 return retval;
 694
 695         /* multiple half words (2-byte) to be programmed? */
 696         if (words_remaining > 0) {
 697                 /* try using a block write */
 698                 retval = stm32x_write_block(bank, buffer, offset, words_remaining);
 699                 if (retval != ERROR_OK) {
 700                         if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
 701                                 /* if block write failed (no sufficient working area),
 702                                  * we use normal (slow) single dword accesses */
 703                                 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
 704                         }
 705                 } else {
 706                         buffer += words_remaining * 2;
 707                         address += words_remaining * 2;
 708                         words_remaining = 0;
 709                 }
 710         }
 711
 712         if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
 713                 return retval;
 714
 715         /*
 716         Standard programming
 717         The Flash memory programming sequence is as follows:
 718         1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
 719           FLASH_SR register.
 720         2. Set the PG bit in the FLASH_CR register
 721         3. Perform the data write operation(s) to the desired memory address (inside main
 722           memory block or OTP area):
 723         – – Half-word access in case of x16 parallelism
 724         – Word access in case of x32 parallelism
 725         –
 726         4.
 727         Byte access in case of x8 parallelism
 728         Double word access in case of x64 parallelism
 729         Wait for the BSY bit to be cleared
 730         */
 731         while (words_remaining > 0) {
 732                 uint16_t value;
 733                 memcpy(&value, buffer + bytes_written, sizeof(uint16_t));
 734
 735                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
 736                                 FLASH_PG | FLASH_PSIZE_16);
 737                 if (retval != ERROR_OK)
 738                         return retval;
 739
 740                 retval = target_write_u16(target, address, value);
 741                 if (retval != ERROR_OK)
 742                         return retval;
 743
 744                 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
 745                 if (retval != ERROR_OK)
 746                         return retval;
 747
 748                 bytes_written += 2;
 749                 words_remaining--;
 750                 address += 2;
 751         }
 752
 753         if (bytes_remaining) {
 754                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
 755                                 FLASH_PG | FLASH_PSIZE_8);
 756                 if (retval != ERROR_OK)
 757                         return retval;
 758                 retval = target_write_u8(target, address, buffer[bytes_written]);
 759                 if (retval != ERROR_OK)
 760                         return retval;
 761
 762                 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
 763                 if (retval != ERROR_OK)
 764                         return retval;
 765         }
 766
 767         return target_write_u32(target, STM32_FLASH_CR, FLASH_LOCK);
 768 }
 769
 770 static int setup_sector(struct flash_bank *bank, int start, int num, int size)
 771 {
 772
 773         for (int i = start; i < (start + num) ; i++) {
 774                 assert(i < bank->num_sectors);
 775                 bank->sectors[i].offset = bank->size;
 776                 bank->sectors[i].size = size;
 777                 bank->size += bank->sectors[i].size;
 778             LOG_DEBUG("sector %d: %dkBytes", i, size >> 10);
 779         }
 780
 781         return start + num;
 782 }
 783
 784 static void setup_bank(struct flash_bank *bank, int start,
 785         uint16_t flash_size_in_kb, uint16_t max_sector_size_in_kb)
 786 {
 787         int remain;
 788
 789         start = setup_sector(bank, start, 4, (max_sector_size_in_kb / 8) * 1024);
 790         start = setup_sector(bank, start, 1, (max_sector_size_in_kb / 2) * 1024);
 791
 792         /* remaining sectors all of size max_sector_size_in_kb */
 793         remain = (flash_size_in_kb / max_sector_size_in_kb) - 1;
 794         start = setup_sector(bank, start, remain, max_sector_size_in_kb * 1024);
 795 }
 796
 797 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
 798 {
 799         /* this checks for a stm32f4x errata issue where a
 800          * stm32f2x DBGMCU_IDCODE is incorrectly returned.
 801          * If the issue is detected target is forced to stm32f4x Rev A.
 802          * Only effects Rev A silicon */
 803
 804         struct target *target = bank->target;
 805         uint32_t cpuid;
 806
 807         /* read stm32 device id register */
 808         int retval = target_read_u32(target, 0xE0042000, device_id);
 809         if (retval != ERROR_OK)
 810                 return retval;
 811
 812         if ((*device_id & 0xfff) == 0x411) {
 813                 /* read CPUID reg to check core type */
 814                 retval = target_read_u32(target, 0xE000ED00, &cpuid);
 815                 if (retval != ERROR_OK)
 816                         return retval;
 817
 818                 /* check for cortex_m4 */
 819                 if (((cpuid >> 4) & 0xFFF) == 0xC24) {
 820                         *device_id &= ~((0xFFFF << 16) | 0xfff);
 821                         *device_id |= (0x1000 << 16) | 0x413;
 822                         LOG_INFO("stm32f4x errata detected - fixing incorrect MCU_IDCODE");
 823                 }
 824         }
 825         return retval;
 826 }
 827
 828 static int stm32x_probe(struct flash_bank *bank)
 829 {
 830         struct target *target = bank->target;
 831         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 832         int i;
 833         uint16_t flash_size_in_kb;
 834         uint32_t flash_size_reg = 0x1FFF7A22;
 835         uint16_t max_sector_size_in_kb = 128;
 836         uint16_t max_flash_size_in_kb;
 837         uint32_t device_id;
 838         uint32_t base_address = 0x08000000;
 839
 840         stm32x_info->probed = 0;
 841         stm32x_info->has_large_mem = false;
 842         stm32x_info->has_boot_addr = false;
 843         stm32x_info->has_extra_options = false;
 844
 845         /* read stm32 device id register */
 846         int retval = stm32x_get_device_id(bank, &device_id);
 847         if (retval != ERROR_OK)
 848                 return retval;
 849         LOG_INFO("device id = 0x%08" PRIx32 "", device_id);
 850
 851         /* set max flash size depending on family, id taken from AN2606 */
 852         switch (device_id & 0xfff) {
 853         case 0x411: /* F20x/21x */
 854         case 0x413: /* F40x/41x */
 855                 max_flash_size_in_kb = 1024;
 856                 break;
 857
 858         case 0x419: /* F42x/43x */
 859         case 0x434: /* F469/479 */
 860                 stm32x_info->has_extra_options = true;
 861                 max_flash_size_in_kb = 2048;
 862                 break;
 863
 864         case 0x423:     /* F401xB/C */
 865                 max_flash_size_in_kb = 256;
 866                 break;
 867
 868         case 0x421:     /* F446 */
 869         case 0x431: /* F411 */
 870         case 0x433: /* F401xD/E */
 871         case 0x441: /* F412 */
 872                 max_flash_size_in_kb = 512;
 873                 break;
 874
 875         case 0x458: /* F410 */
 876                 max_flash_size_in_kb = 128;
 877                 break;
 878
 879         case 0x449:     /* F74x/75x */
 880                 max_flash_size_in_kb = 1024;
 881                 max_sector_size_in_kb = 256;
 882                 flash_size_reg = 0x1FF0F442;
 883                 stm32x_info->has_extra_options = true;
 884                 stm32x_info->has_boot_addr = true;
 885                 break;
 886
 887         case 0x451:     /* F76x/77x */
 888                 max_flash_size_in_kb = 2048;
 889                 max_sector_size_in_kb = 256;
 890                 flash_size_reg = 0x1FF0F442;
 891                 stm32x_info->has_extra_options = true;
 892                 stm32x_info->has_boot_addr = true;
 893                 break;
 894
 895         default:
 896                 LOG_WARNING("Cannot identify target as a STM32 family.");
 897                 return ERROR_FAIL;
 898         }
 899
 900         /* get flash size from target. */
 901         retval = target_read_u16(target, flash_size_reg, &flash_size_in_kb);
 902
 903         /* failed reading flash size or flash size invalid (early silicon),
 904          * default to max target family */
 905         if (retval != ERROR_OK || flash_size_in_kb == 0xffff || flash_size_in_kb == 0) {
 906                 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming %dk flash",
 907                         max_flash_size_in_kb);
 908                 flash_size_in_kb = max_flash_size_in_kb;
 909         }
 910
 911         /* if the user sets the size manually then ignore the probed value
 912          * this allows us to work around devices that have a invalid flash size register value */
 913         if (stm32x_info->user_bank_size) {
 914                 LOG_INFO("ignoring flash probed value, using configured bank size");
 915                 flash_size_in_kb = stm32x_info->user_bank_size / 1024;
 916         }
 917
 918         LOG_INFO("flash size = %dkbytes", flash_size_in_kb);
 919
 920         /* did we assign flash size? */
 921         assert(flash_size_in_kb != 0xffff);
 922
 923         /* Devices with > 1024 kiByte always are dual-banked */
 924         if (flash_size_in_kb > 1024)
 925                 stm32x_info->has_large_mem = true;
 926
 927         /* F42x/43x/469/479 1024 kiByte devices have a dual bank option */
 928         if ((device_id & 0xfff) == 0x419 || (device_id & 0xfff) == 0x434) {
 929                 uint32_t optiondata;
 930                 retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
 931                 if (retval != ERROR_OK) {
 932                         LOG_DEBUG("unable to read option bytes");
 933                         return retval;
 934                 }
 935                 if ((flash_size_in_kb > 1024) || (optiondata & OPTCR_DB1M)) {
 936                         stm32x_info->has_large_mem = true;
 937                         LOG_INFO("Dual Bank %d kiB STM32F42x/43x/469/479 found", flash_size_in_kb);
 938                 } else {
 939                         stm32x_info->has_large_mem = false;
 940                         LOG_INFO("Single Bank %d kiB STM32F42x/43x/469/479 found", flash_size_in_kb);
 941                 }
 942         }
 943
 944         /* F76x/77x devices have a dual bank option */
 945         if ((device_id & 0xfff) == 0x451) {
 946                 uint32_t optiondata;
 947                 retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
 948                 if (retval != ERROR_OK) {
 949                         LOG_DEBUG("unable to read option bytes");
 950                         return retval;
 951                 }
 952                 if (optiondata & OPTCR_NDBANK) {
 953                         stm32x_info->has_large_mem = false;
 954                         LOG_INFO("Single Bank %d kiB STM32F76x/77x found", flash_size_in_kb);
 955                 } else {
 956                         stm32x_info->has_large_mem = true;
 957                         max_sector_size_in_kb >>= 1; /* sector size divided by 2 in dual-bank mode */
 958                         LOG_INFO("Dual Bank %d kiB STM32F76x/77x found", flash_size_in_kb);
 959                 }
 960         }
 961
 962         /* calculate numbers of pages */
 963         int num_pages = flash_size_in_kb / max_sector_size_in_kb
 964                 + (stm32x_info->has_large_mem ? 8 : 4);
 965
 966         if (bank->sectors) {
 967                 free(bank->sectors);
 968                 bank->sectors = NULL;
 969         }
 970
 971         bank->base = base_address;
 972         bank->num_sectors = num_pages;
 973         bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
 974         for (i = 0; i < num_pages; i++) {
 975                 bank->sectors[i].is_erased = -1;
 976                 bank->sectors[i].is_protected = 0;
 977         }
 978         bank->size = 0;
 979         LOG_DEBUG("allocated %d sectors", num_pages);
 980
 981         if (stm32x_info->has_large_mem) {
 982                 /* dual-bank */
 983                 setup_bank(bank, 0, flash_size_in_kb >> 1, max_sector_size_in_kb);
 984                 setup_bank(bank, num_pages >> 1, flash_size_in_kb >> 1,
 985                         max_sector_size_in_kb);
 986         } else {
 987                 /* single-bank */
 988                 setup_bank(bank, 0, flash_size_in_kb, max_sector_size_in_kb);
 989         }
 990         assert((bank->size >> 10) == flash_size_in_kb);
 991
 992         stm32x_info->probed = 1;
 993         return ERROR_OK;
 994 }
 995
 996 static int stm32x_auto_probe(struct flash_bank *bank)
 997 {
 998         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 999         if (stm32x_info->probed)
1000                 return ERROR_OK;
1001         return stm32x_probe(bank);
1002 }
1003
1004 static int get_stm32x_info(struct flash_bank *bank, char *buf, int buf_size)
1005 {
1006         uint32_t dbgmcu_idcode;
1007
1008         /* read stm32 device id register */
1009         int retval = stm32x_get_device_id(bank, &dbgmcu_idcode);
1010         if (retval != ERROR_OK)
1011                 return retval;
1012
1013         uint16_t device_id = dbgmcu_idcode & 0xfff;
1014         uint16_t rev_id = dbgmcu_idcode >> 16;
1015         const char *device_str;
1016         const char *rev_str = NULL;
1017
1018         switch (device_id) {
1019         case 0x411:
1020                 device_str = "STM32F2xx";
1021
1022                 switch (rev_id) {
1023                 case 0x1000:
1024                         rev_str = "A";
1025                         break;
1026
1027                 case 0x2000:
1028                         rev_str = "B";
1029                         break;
1030
1031                 case 0x1001:
1032                         rev_str = "Z";
1033                         break;
1034
1035                 case 0x2001:
1036                         rev_str = "Y";
1037                         break;
1038
1039                 case 0x2003:
1040                         rev_str = "X";
1041                         break;
1042
1043                 case 0x2007:
1044                         rev_str = "1";
1045                         break;
1046
1047                 case 0x200F:
1048                         rev_str = "V";
1049                         break;
1050
1051                 case 0x201F:
1052                         rev_str = "2";
1053                         break;
1054                 }
1055                 break;
1056
1057         case 0x413:
1058         case 0x419:
1059         case 0x434:
1060                 device_str = "STM32F4xx";
1061
1062                 switch (rev_id) {
1063                 case 0x1000:
1064                         rev_str = "A";
1065                         break;
1066
1067                 case 0x1001:
1068                         rev_str = "Z";
1069                         break;
1070
1071                 case 0x1003:
1072                         rev_str = "Y";
1073                         break;
1074
1075                 case 0x1007:
1076                         rev_str = "1";
1077                         break;
1078
1079                 case 0x2001:
1080                         rev_str = "3";
1081                         break;
1082                 }
1083                 break;
1084
1085         case 0x421:
1086                 device_str = "STM32F446";
1087
1088                 switch (rev_id) {
1089                 case 0x1000:
1090                         rev_str = "A";
1091                         break;
1092                 }
1093                 break;
1094
1095         case 0x423:
1096         case 0x431:
1097         case 0x433:
1098         case 0x458:
1099         case 0x441:
1100                 device_str = "STM32F4xx (Low Power)";
1101
1102                 switch (rev_id) {
1103                 case 0x1000:
1104                         rev_str = "A";
1105                         break;
1106
1107                 case 0x1001:
1108                         rev_str = "Z";
1109                         break;
1110                 }
1111                 break;
1112
1113         case 0x449:
1114                 device_str = "STM32F7[4|5]x";
1115
1116                 switch (rev_id) {
1117                 case 0x1000:
1118                         rev_str = "A";
1119                         break;
1120
1121                 case 0x1001:
1122                         rev_str = "Z";
1123                         break;
1124                 }
1125                 break;
1126
1127         case 0x451:
1128                 device_str = "STM32F7[6|7]x";
1129
1130                 switch (rev_id) {
1131                 case 0x1000:
1132                         rev_str = "A";
1133                         break;
1134                 }
1135                 break;
1136
1137         default:
1138                 snprintf(buf, buf_size, "Cannot identify target as a STM32F2/4/7\n");
1139                 return ERROR_FAIL;
1140         }
1141
1142         if (rev_str != NULL)
1143                 snprintf(buf, buf_size, "%s - Rev: %s", device_str, rev_str);
1144         else
1145                 snprintf(buf, buf_size, "%s - Rev: unknown (0x%04x)", device_str, rev_id);
1146
1147         return ERROR_OK;
1148 }
1149
1150 COMMAND_HANDLER(stm32x_handle_lock_command)
1151 {
1152         struct target *target = NULL;
1153         struct stm32x_flash_bank *stm32x_info = NULL;
1154
1155         if (CMD_ARGC < 1)
1156                 return ERROR_COMMAND_SYNTAX_ERROR;
1157
1158         struct flash_bank *bank;
1159         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1160         if (ERROR_OK != retval)
1161                 return retval;
1162
1163         stm32x_info = bank->driver_priv;
1164         target = bank->target;
1165
1166         if (target->state != TARGET_HALTED) {
1167                 LOG_ERROR("Target not halted");
1168                 return ERROR_TARGET_NOT_HALTED;
1169         }
1170
1171         if (stm32x_read_options(bank) != ERROR_OK) {
1172                 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
1173                 return ERROR_OK;
1174         }
1175
1176         /* set readout protection */
1177         stm32x_info->option_bytes.RDP = 0;
1178
1179         if (stm32x_write_options(bank) != ERROR_OK) {
1180                 command_print(CMD_CTX, "%s failed to lock device", bank->driver->name);
1181                 return ERROR_OK;
1182         }
1183
1184         command_print(CMD_CTX, "%s locked", bank->driver->name);
1185
1186         return ERROR_OK;
1187 }
1188
1189 COMMAND_HANDLER(stm32x_handle_unlock_command)
1190 {
1191         struct target *target = NULL;
1192         struct stm32x_flash_bank *stm32x_info = NULL;
1193
1194         if (CMD_ARGC < 1)
1195                 return ERROR_COMMAND_SYNTAX_ERROR;
1196
1197         struct flash_bank *bank;
1198         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1199         if (ERROR_OK != retval)
1200                 return retval;
1201
1202         stm32x_info = bank->driver_priv;
1203         target = bank->target;
1204
1205         if (target->state != TARGET_HALTED) {
1206                 LOG_ERROR("Target not halted");
1207                 return ERROR_TARGET_NOT_HALTED;
1208         }
1209
1210         if (stm32x_read_options(bank) != ERROR_OK) {
1211                 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
1212                 return ERROR_OK;
1213         }
1214
1215         /* clear readout protection and complementary option bytes
1216          * this will also force a device unlock if set */
1217         stm32x_info->option_bytes.RDP = 0xAA;
1218
1219         if (stm32x_write_options(bank) != ERROR_OK) {
1220                 command_print(CMD_CTX, "%s failed to unlock device", bank->driver->name);
1221                 return ERROR_OK;
1222         }
1223
1224         command_print(CMD_CTX, "%s unlocked.\n"
1225                         "INFO: a reset or power cycle is required "
1226                         "for the new settings to take effect.", bank->driver->name);
1227
1228         return ERROR_OK;
1229 }
1230
1231 static int stm32x_mass_erase(struct flash_bank *bank)
1232 {
1233         int retval;
1234         uint32_t flash_mer;
1235         struct target *target = bank->target;
1236         struct stm32x_flash_bank *stm32x_info = NULL;
1237
1238         if (target->state != TARGET_HALTED) {
1239                 LOG_ERROR("Target not halted");
1240                 return ERROR_TARGET_NOT_HALTED;
1241         }
1242
1243         stm32x_info = bank->driver_priv;
1244
1245         retval = stm32x_unlock_reg(target);
1246         if (retval != ERROR_OK)
1247                 return retval;
1248
1249         /* mass erase flash memory */
1250         if (stm32x_info->has_large_mem)
1251                 flash_mer = FLASH_MER | FLASH_MER1;
1252         else
1253                 flash_mer = FLASH_MER;
1254
1255         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), flash_mer);
1256         if (retval != ERROR_OK)
1257                 return retval;
1258         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
1259                 flash_mer | FLASH_STRT);
1260         if (retval != ERROR_OK)
1261                 return retval;
1262
1263         retval = stm32x_wait_status_busy(bank, FLASH_MASS_ERASE_TIMEOUT);
1264         if (retval != ERROR_OK)
1265                 return retval;
1266
1267         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
1268         if (retval != ERROR_OK)
1269                 return retval;
1270
1271         return ERROR_OK;
1272 }
1273
1274 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
1275 {
1276         int i;
1277
1278         if (CMD_ARGC < 1) {
1279                 command_print(CMD_CTX, "stm32x mass_erase <bank>");
1280                 return ERROR_COMMAND_SYNTAX_ERROR;
1281         }
1282
1283         struct flash_bank *bank;
1284         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1285         if (ERROR_OK != retval)
1286                 return retval;
1287
1288         retval = stm32x_mass_erase(bank);
1289         if (retval == ERROR_OK) {
1290                 /* set all sectors as erased */
1291                 for (i = 0; i < bank->num_sectors; i++)
1292                         bank->sectors[i].is_erased = 1;
1293
1294                 command_print(CMD_CTX, "stm32x mass erase complete");
1295         } else {
1296                 command_print(CMD_CTX, "stm32x mass erase failed");
1297         }
1298
1299         return retval;
1300 }
1301
1302 COMMAND_HANDLER(stm32f2x_handle_options_read_command)
1303 {
1304         int retval;
1305         struct flash_bank *bank;
1306         struct stm32x_flash_bank *stm32x_info = NULL;
1307
1308         if (CMD_ARGC != 1) {
1309                 command_print(CMD_CTX, "stm32f2x options_read <bank>");
1310                 return ERROR_COMMAND_SYNTAX_ERROR;
1311         }
1312
1313         retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1314         if (ERROR_OK != retval)
1315                 return retval;
1316
1317         retval = stm32x_read_options(bank);
1318         if (ERROR_OK != retval)
1319                 return retval;
1320
1321         stm32x_info = bank->driver_priv;
1322         if (stm32x_info->has_extra_options) {
1323                 if (stm32x_info->has_boot_addr) {
1324                         uint32_t boot_addr = stm32x_info->option_bytes.boot_addr;
1325
1326                         command_print(CMD_CTX, "stm32f2x user_options 0x%03X,"
1327                                 " boot_add0 0x%04X, boot_add1 0x%04X",
1328                                 stm32x_info->option_bytes.user_options,
1329                                 boot_addr & 0xffff, (boot_addr & 0xffff0000) >> 16);
1330                 } else {
1331                         command_print(CMD_CTX, "stm32f2x user_options 0x%03X,",
1332                                 stm32x_info->option_bytes.user_options);
1333                 }
1334         } else {
1335                 command_print(CMD_CTX, "stm32f2x user_options 0x%02X",
1336                         stm32x_info->option_bytes.user_options);
1337
1338         }
1339
1340         return retval;
1341 }
1342
1343 COMMAND_HANDLER(stm32f2x_handle_options_write_command)
1344 {
1345         int retval;
1346         struct flash_bank *bank;
1347         struct stm32x_flash_bank *stm32x_info = NULL;
1348         uint16_t user_options, boot_addr0, boot_addr1;
1349
1350         if (CMD_ARGC < 1) {
1351                 command_print(CMD_CTX, "stm32f2x options_write <bank> ...");
1352                 return ERROR_COMMAND_SYNTAX_ERROR;
1353         }
1354
1355         retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1356         if (ERROR_OK != retval)
1357                 return retval;
1358
1359         retval = stm32x_read_options(bank);
1360         if (ERROR_OK != retval)
1361                 return retval;
1362
1363         stm32x_info = bank->driver_priv;
1364         if (stm32x_info->has_boot_addr) {
1365                 if (CMD_ARGC != 4) {
1366                         command_print(CMD_CTX, "stm32f2x options_write <bank> <user_options>"
1367                                 " <boot_addr0> <boot_addr1>");
1368                         return ERROR_COMMAND_SYNTAX_ERROR;
1369                 }
1370                 COMMAND_PARSE_NUMBER(u16, CMD_ARGV[2], boot_addr0);
1371                 COMMAND_PARSE_NUMBER(u16, CMD_ARGV[3], boot_addr1);
1372                 stm32x_info->option_bytes.boot_addr = boot_addr0 | (((uint32_t) boot_addr1) << 16);
1373         } else {
1374                 if (CMD_ARGC != 2) {
1375                         command_print(CMD_CTX, "stm32f2x options_write <bank> <user_options>");
1376                         return ERROR_COMMAND_SYNTAX_ERROR;
1377                 }
1378         }
1379
1380         COMMAND_PARSE_NUMBER(u16, CMD_ARGV[1], user_options);
1381         if (user_options & (stm32x_info->has_extra_options ? ~0xffc : ~0xfc)) {
1382                 command_print(CMD_CTX, "stm32f2x invalid user_options");
1383                 return ERROR_COMMAND_SYNTAX_ERROR;
1384         }
1385
1386         stm32x_info->option_bytes.user_options = user_options;
1387
1388         if (stm32x_write_options(bank) != ERROR_OK) {
1389                 command_print(CMD_CTX, "stm32f2x failed to write options");
1390                 return ERROR_OK;
1391         }
1392
1393         /* switching between single- and dual-bank modes requires re-probe */
1394         /* ... and reprogramming of whole flash */
1395         stm32x_info->probed = 0;
1396
1397         command_print(CMD_CTX, "stm32f2x write options complete.\n"
1398                                 "INFO: a reset or power cycle is required "
1399                                 "for the new settings to take effect.");
1400         return retval;
1401 }
1402
1403 static const struct command_registration stm32x_exec_command_handlers[] = {
1404         {
1405                 .name = "lock",
1406                 .handler = stm32x_handle_lock_command,
1407                 .mode = COMMAND_EXEC,
1408                 .usage = "bank_id",
1409                 .help = "Lock entire flash device.",
1410         },
1411         {
1412                 .name = "unlock",
1413                 .handler = stm32x_handle_unlock_command,
1414                 .mode = COMMAND_EXEC,
1415                 .usage = "bank_id",
1416                 .help = "Unlock entire protected flash device.",
1417         },
1418         {
1419                 .name = "mass_erase",
1420                 .handler = stm32x_handle_mass_erase_command,
1421                 .mode = COMMAND_EXEC,
1422                 .usage = "bank_id",
1423                 .help = "Erase entire flash device.",
1424         },
1425         {
1426                 .name = "options_read",
1427                 .handler = stm32f2x_handle_options_read_command,
1428                 .mode = COMMAND_EXEC,
1429                 .usage = "bank_id",
1430                 .help = "Read and display device option bytes.",
1431         },
1432         {
1433                 .name = "options_write",
1434                 .handler = stm32f2x_handle_options_write_command,
1435                 .mode = COMMAND_EXEC,
1436                 .usage = "bank_id user_options [ boot_add0 boot_add1]",
1437                 .help = "Write option bytes",
1438         },
1439         COMMAND_REGISTRATION_DONE
1440 };
1441
1442 static const struct command_registration stm32x_command_handlers[] = {
1443         {
1444                 .name = "stm32f2x",
1445                 .mode = COMMAND_ANY,
1446                 .help = "stm32f2x flash command group",
1447                 .usage = "",
1448                 .chain = stm32x_exec_command_handlers,
1449         },
1450         COMMAND_REGISTRATION_DONE
1451 };
1452
1453 struct flash_driver stm32f2x_flash = {
1454         .name = "stm32f2x",
1455         .commands = stm32x_command_handlers,
1456         .flash_bank_command = stm32x_flash_bank_command,
1457         .erase = stm32x_erase,
1458         .protect = stm32x_protect,
1459         .write = stm32x_write,
1460         .read = default_flash_read,
1461         .probe = stm32x_probe,
1462         .auto_probe = stm32x_auto_probe,
1463         .erase_check = default_flash_blank_check,
1464         .protect_check = stm32x_protect_check,
1465         .info = get_stm32x_info,
1466 };