git.gag.com Git - fw/openocd/blob - src/flash/nor/stm32f2x.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2
   3 /***************************************************************************
   4  *   Copyright (C) 2005 by Dominic Rath                                    *
   5  *   Dominic.Rath@gmx.de                                                   *
   6  *                                                                         *
   7  *   Copyright (C) 2008 by Spencer Oliver                                  *
   8  *   spen@spen-soft.co.uk                                                  *
   9  *                                                                         *
  10  *   Copyright (C) 2011 Øyvind Harboe                                      *
  11  *   oyvind.harboe@zylin.com                                               *
  12  ***************************************************************************/
  13
  14 #ifdef HAVE_CONFIG_H
  15 #include "config.h"
  16 #endif
  17
  18 #include "imp.h"
  19 #include <helper/binarybuffer.h>
  20 #include <target/algorithm.h>
  21 #include <target/cortex_m.h>
  22
  23 /* Regarding performance:
  24  *
  25  * Short story - it might be best to leave the performance at
  26  * current levels.
  27  *
  28  * You may see a jump in speed if you change to using
  29  * 32bit words for the block programming.
  30  *
  31  * Its a shame you cannot use the double word as its
  32  * even faster - but you require external VPP for that mode.
  33  *
  34  * Having said all that 16bit writes give us the widest vdd
  35  * operating range, so may be worth adding a note to that effect.
  36  *
  37  */
  38
  39 /* Danger!!!! The STM32F1x and STM32F2x series actually have
  40  * quite different flash controllers.
  41  *
  42  * What's more scary is that the names of the registers and their
  43  * addresses are the same, but the actual bits and what they do are
  44  * can be very different.
  45  *
  46  * To reduce testing complexity and dangers of regressions,
  47  * a separate file is used for stm32fx2x.
  48  *
  49  * Sector sizes in kiBytes:
  50  * 1 MiByte part with 4 x 16, 1 x 64, 7 x 128.
  51  * 1.5 MiByte part with 4 x 16, 1 x 64, 11 x 128.
  52  * 2 MiByte part with 4 x 16, 1 x 64, 7 x 128, 4 x 16, 1 x 64, 7 x 128.
  53  * 1 MiByte STM32F42x/43x part with DB1M Option set:
  54  *                    4 x 16, 1 x 64, 3 x 128, 4 x 16, 1 x 64, 3 x 128.
  55  *
  56  * STM32F7[2|3]
  57  * 512 kiByte part with 4 x 16, 1 x 64, 3 x 128.
  58  *
  59  * STM32F7[4|5]
  60  * 1 MiByte part with 4 x 32, 1 x 128, 3 x 256.
  61  *
  62  * STM32F7[6|7]
  63  * 1 MiByte part in single bank mode with 4 x 32, 1 x 128, 3 x 256.
  64  * 1 MiByte part in dual-bank mode two banks with 4 x 16, 1 x 64, 3 x 128 each.
  65  * 2 MiByte part in single-bank mode with 4 x 32, 1 x 128, 7 x 256.
  66  * 2 MiByte part in dual-bank mode two banks with 4 x 16, 1 x 64, 7 x 128 each.
  67  *
  68  * Protection size is sector size.
  69  *
  70  * Tested with STM3220F-EVAL board.
  71  *
  72  * STM32F4xx series for reference.
  73  *
  74  * RM0090
  75  * http://www.st.com/web/en/resource/technical/document/reference_manual/DM00031020.pdf
  76  *
  77  * PM0059
  78  * www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/
  79  * PROGRAMMING_MANUAL/CD00233952.pdf
  80  *
  81  * STM32F7xx series for reference.
  82  *
  83  * RM0385
  84  * http://www.st.com/web/en/resource/technical/document/reference_manual/DM00124865.pdf
  85  *
  86  * RM0410
  87  * http://www.st.com/resource/en/reference_manual/dm00224583.pdf
  88  *
  89  * RM0430
  90  * http://www.st.com/resource/en/reference_manual/dm00305666.pdf
  91  *
  92  * RM0431
  93  * http://www.st.com/resource/en/reference_manual/dm00305990.pdf
  94  *
  95  * STM32F1x series - notice that this code was copy, pasted and knocked
  96  * into a stm32f2x driver, so in case something has been converted or
  97  * bugs haven't been fixed, here are the original manuals:
  98  *
  99  * RM0008 - Reference manual
 100  *
 101  * RM0042, the Flash programming manual for low-, medium- high-density and
 102  * connectivity line STM32F10x devices
 103  *
 104  * PM0068, the Flash programming manual for XL-density STM32F10x devices.
 105  *
 106  */
 107
 108 /* Erase time can be as high as 1000ms, 10x this and it's toast... */
 109 #define FLASH_ERASE_TIMEOUT 10000
 110 #define FLASH_WRITE_TIMEOUT 5
 111
 112 /* Mass erase time can be as high as 32 s in x8 mode. */
 113 #define FLASH_MASS_ERASE_TIMEOUT 33000
 114
 115 #define FLASH_BANK_BASE     0x80000000
 116
 117 #define STM32F2_OTP_SIZE 512
 118 #define STM32F2_OTP_SECTOR_SIZE 32
 119 #define STM32F2_OTP_BANK_BASE       0x1fff7800
 120 #define STM32F2_OTP_LOCK_BASE       ((STM32F2_OTP_BANK_BASE) + (STM32F2_OTP_SIZE))
 121
 122 /* see RM0410 section 3.6 "One-time programmable bytes" */
 123 #define STM32F7_OTP_SECTOR_SIZE 64
 124 #define STM32F7_OTP_SIZE 1024
 125 #define STM32F7_OTP_BANK_BASE       0x1ff0f000
 126 #define STM32F7_OTP_LOCK_BASE       ((STM32F7_OTP_BANK_BASE) + (STM32F7_OTP_SIZE))
 127
 128 #define STM32_FLASH_BASE    0x40023c00
 129 #define STM32_FLASH_ACR     0x40023c00
 130 #define STM32_FLASH_KEYR    0x40023c04
 131 #define STM32_FLASH_OPTKEYR 0x40023c08
 132 #define STM32_FLASH_SR      0x40023c0C
 133 #define STM32_FLASH_CR      0x40023c10
 134 #define STM32_FLASH_OPTCR   0x40023c14
 135 #define STM32_FLASH_OPTCR1  0x40023c18
 136 #define STM32_FLASH_OPTCR2  0x40023c1c
 137
 138 /* FLASH_CR register bits */
 139 #define FLASH_PG       (1 << 0)
 140 #define FLASH_SER      (1 << 1)
 141 #define FLASH_MER      (1 << 2)         /* MER/MER1 for f76x/77x */
 142 #define FLASH_MER1     (1 << 15)        /* MER2 for f76x/77x, confusing ... */
 143 #define FLASH_STRT     (1 << 16)
 144 #define FLASH_PSIZE_8  (0 << 8)
 145 #define FLASH_PSIZE_16 (1 << 8)
 146 #define FLASH_PSIZE_32 (2 << 8)
 147 #define FLASH_PSIZE_64 (3 << 8)
 148 /* The sector number encoding is not straight binary for dual bank flash. */
 149 #define FLASH_SNB(a)   ((a) << 3)
 150 #define FLASH_LOCK     (1 << 31)
 151
 152 /* FLASH_SR register bits */
 153 #define FLASH_BSY      (1 << 16)
 154 #define FLASH_PGSERR   (1 << 7) /* Programming sequence error */
 155 #define FLASH_PGPERR   (1 << 6) /* Programming parallelism error */
 156 #define FLASH_PGAERR   (1 << 5) /* Programming alignment error */
 157 #define FLASH_WRPERR   (1 << 4) /* Write protection error */
 158 #define FLASH_OPERR    (1 << 1) /* Operation error */
 159
 160 #define FLASH_ERROR (FLASH_PGSERR | FLASH_PGPERR | FLASH_PGAERR | FLASH_WRPERR | FLASH_OPERR)
 161
 162 /* STM32_FLASH_OPTCR register bits */
 163 #define OPTCR_LOCK     (1 << 0)
 164 #define OPTCR_START    (1 << 1)
 165 #define OPTCR_NDBANK   (1 << 29)        /* not dual bank mode */
 166 #define OPTCR_DB1M     (1 << 30)        /* 1 MiB devices dual flash bank option */
 167 #define OPTCR_SPRMOD   (1 << 31)        /* switches PCROPi/nWPRi interpretation */
 168
 169 /* STM32_FLASH_OPTCR2 register bits */
 170 #define OPTCR2_PCROP_RDP        (1 << 31)       /* erase PCROP zone when decreasing RDP */
 171
 172 /* register unlock keys */
 173 #define KEY1           0x45670123
 174 #define KEY2           0xCDEF89AB
 175
 176 /* option register unlock key */
 177 #define OPTKEY1        0x08192A3B
 178 #define OPTKEY2        0x4C5D6E7F
 179
 180 struct stm32x_options {
 181         uint8_t RDP;
 182         uint16_t user_options;  /* bit 0-7 usual options, bit 8-11 extra options */
 183         uint32_t protection;
 184         uint32_t boot_addr;
 185         uint32_t optcr2_pcrop;
 186 };
 187
 188 struct stm32x_flash_bank {
 189         struct stm32x_options option_bytes;
 190         bool probed;
 191         bool otp_unlocked;
 192         bool has_large_mem;             /* F42x/43x/469/479/7xx in dual bank mode */
 193         bool has_extra_options; /* F42x/43x/469/479/7xx */
 194         bool has_boot_addr;     /* F7xx */
 195         bool has_optcr2_pcrop;  /* F72x/73x */
 196         unsigned int protection_bits; /* F413/423 */
 197         uint32_t user_bank_size;
 198 };
 199
 200 static bool stm32x_is_otp(struct flash_bank *bank)
 201 {
 202         return bank->base == STM32F2_OTP_BANK_BASE ||
 203                 bank->base == STM32F7_OTP_BANK_BASE;
 204 }
 205
 206 static bool stm32x_otp_is_f7(struct flash_bank *bank)
 207 {
 208         return bank->base == STM32F7_OTP_BANK_BASE;
 209 }
 210
 211 static int stm32x_is_otp_unlocked(struct flash_bank *bank)
 212 {
 213         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 214
 215         return stm32x_info->otp_unlocked;
 216 }
 217
 218 static int stm32x_otp_disable(struct flash_bank *bank)
 219 {
 220         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 221
 222         LOG_INFO("OTP memory bank #%u is disabled for write commands.",
 223                  bank->bank_number);
 224         stm32x_info->otp_unlocked = false;
 225         return ERROR_OK;
 226 }
 227
 228 static int stm32x_otp_enable(struct flash_bank *bank)
 229 {
 230         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 231
 232         if (!stm32x_info->otp_unlocked) {
 233                 LOG_INFO("OTP memory bank #%u is is enabled for write commands.",
 234                          bank->bank_number);
 235                 stm32x_info->otp_unlocked = true;
 236         } else {
 237                 LOG_WARNING("OTP memory bank #%u is is already enabled for write commands.",
 238                             bank->bank_number);
 239         }
 240         return ERROR_OK;
 241 }
 242
 243 /* flash bank stm32x <base> <size> 0 0 <target#>
 244  */
 245 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
 246 {
 247         struct stm32x_flash_bank *stm32x_info;
 248
 249         if (CMD_ARGC < 6)
 250                 return ERROR_COMMAND_SYNTAX_ERROR;
 251
 252         stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
 253         bank->driver_priv = stm32x_info;
 254
 255         stm32x_info->probed = false;
 256         stm32x_info->otp_unlocked = false;
 257         stm32x_info->user_bank_size = bank->size;
 258
 259         return ERROR_OK;
 260 }
 261
 262 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
 263 {
 264         return reg;
 265 }
 266
 267 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
 268 {
 269         struct target *target = bank->target;
 270         return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
 271 }
 272
 273 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
 274 {
 275         struct target *target = bank->target;
 276         uint32_t status;
 277         int retval = ERROR_OK;
 278
 279         /* wait for busy to clear */
 280         for (;;) {
 281                 retval = stm32x_get_flash_status(bank, &status);
 282                 if (retval != ERROR_OK)
 283                         return retval;
 284                 LOG_DEBUG("status: 0x%" PRIx32, status);
 285                 if ((status & FLASH_BSY) == 0)
 286                         break;
 287                 if (timeout-- <= 0) {
 288                         LOG_ERROR("timed out waiting for flash");
 289                         return ERROR_FAIL;
 290                 }
 291                 alive_sleep(1);
 292         }
 293
 294
 295         if (status & FLASH_WRPERR) {
 296                 LOG_ERROR("stm32x device protected");
 297                 retval = ERROR_FAIL;
 298         }
 299
 300         /* Clear but report errors */
 301         if (status & FLASH_ERROR) {
 302                 if (retval == ERROR_OK)
 303                         retval = ERROR_FAIL;
 304                 /* If this operation fails, we ignore it and report the original
 305                  * retval
 306                  */
 307                 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
 308                                 status & FLASH_ERROR);
 309         }
 310         return retval;
 311 }
 312
 313 static int stm32x_unlock_reg(struct target *target)
 314 {
 315         uint32_t ctrl;
 316
 317         /* first check if not already unlocked
 318          * otherwise writing on STM32_FLASH_KEYR will fail
 319          */
 320         int retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
 321         if (retval != ERROR_OK)
 322                 return retval;
 323
 324         if ((ctrl & FLASH_LOCK) == 0)
 325                 return ERROR_OK;
 326
 327         /* unlock flash registers */
 328         retval = target_write_u32(target, STM32_FLASH_KEYR, KEY1);
 329         if (retval != ERROR_OK)
 330                 return retval;
 331
 332         retval = target_write_u32(target, STM32_FLASH_KEYR, KEY2);
 333         if (retval != ERROR_OK)
 334                 return retval;
 335
 336         retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
 337         if (retval != ERROR_OK)
 338                 return retval;
 339
 340         if (ctrl & FLASH_LOCK) {
 341                 LOG_ERROR("flash not unlocked STM32_FLASH_CR: 0x%" PRIx32, ctrl);
 342                 return ERROR_TARGET_FAILURE;
 343         }
 344
 345         return ERROR_OK;
 346 }
 347
 348 static int stm32x_unlock_option_reg(struct target *target)
 349 {
 350         uint32_t ctrl;
 351
 352         int retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
 353         if (retval != ERROR_OK)
 354                 return retval;
 355
 356         if ((ctrl & OPTCR_LOCK) == 0)
 357                 return ERROR_OK;
 358
 359         /* unlock option registers */
 360         retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY1);
 361         if (retval != ERROR_OK)
 362                 return retval;
 363
 364         retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY2);
 365         if (retval != ERROR_OK)
 366                 return retval;
 367
 368         retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
 369         if (retval != ERROR_OK)
 370                 return retval;
 371
 372         if (ctrl & OPTCR_LOCK) {
 373                 LOG_ERROR("options not unlocked STM32_FLASH_OPTCR: 0x%" PRIx32, ctrl);
 374                 return ERROR_TARGET_FAILURE;
 375         }
 376
 377         return ERROR_OK;
 378 }
 379
 380 static int stm32x_read_options(struct flash_bank *bank)
 381 {
 382         uint32_t optiondata;
 383         struct stm32x_flash_bank *stm32x_info = NULL;
 384         struct target *target = bank->target;
 385
 386         stm32x_info = bank->driver_priv;
 387
 388         /* read current option bytes */
 389         int retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
 390         if (retval != ERROR_OK)
 391                 return retval;
 392
 393     /* caution: F2 implements 5 bits (WDG_SW only)
 394      * whereas F7 6 bits (IWDG_SW and WWDG_SW) in user_options */
 395         stm32x_info->option_bytes.user_options = optiondata & 0xfc;
 396         stm32x_info->option_bytes.RDP = (optiondata >> 8) & 0xff;
 397         stm32x_info->option_bytes.protection =
 398                 (optiondata >> 16) & (~(0xffff << stm32x_info->protection_bits) & 0xffff);
 399
 400         if (stm32x_info->has_extra_options) {
 401                 /* F42x/43x/469/479 and 7xx have up to 4 bits of extra options */
 402                 stm32x_info->option_bytes.user_options |= (optiondata >> 20) &
 403                         ((0xf00 << (stm32x_info->protection_bits - 12)) & 0xf00);
 404         }
 405
 406         if (stm32x_info->has_large_mem || stm32x_info->has_boot_addr) {
 407                 retval = target_read_u32(target, STM32_FLASH_OPTCR1, &optiondata);
 408                 if (retval != ERROR_OK)
 409                         return retval;
 410
 411                 /* FLASH_OPTCR1 has quite different meanings ... */
 412                 if (stm32x_info->has_boot_addr) {
 413                         /* for F7xx it contains boot0 and boot1 */
 414                         stm32x_info->option_bytes.boot_addr = optiondata;
 415                 } else {
 416                         /* for F42x/43x/469/479 it contains 12 additional protection bits */
 417                         stm32x_info->option_bytes.protection |= (optiondata >> 4) & 0x00fff000;
 418                 }
 419         }
 420
 421         if (stm32x_info->has_optcr2_pcrop) {
 422                 retval = target_read_u32(target, STM32_FLASH_OPTCR2, &optiondata);
 423                 if (retval != ERROR_OK)
 424                         return retval;
 425
 426                 stm32x_info->option_bytes.optcr2_pcrop = optiondata;
 427                 if (stm32x_info->has_optcr2_pcrop &&
 428                         (stm32x_info->option_bytes.optcr2_pcrop & ~OPTCR2_PCROP_RDP)) {
 429                         LOG_INFO("PCROP Engaged");
 430                 }
 431         } else {
 432                 stm32x_info->option_bytes.optcr2_pcrop = 0x0;
 433         }
 434
 435         if (stm32x_info->option_bytes.RDP != 0xAA)
 436                 LOG_INFO("Device Security Bit Set");
 437
 438         return ERROR_OK;
 439 }
 440
 441 static int stm32x_write_options(struct flash_bank *bank)
 442 {
 443         struct stm32x_flash_bank *stm32x_info = NULL;
 444         struct target *target = bank->target;
 445         uint32_t optiondata, optiondata2;
 446
 447         stm32x_info = bank->driver_priv;
 448
 449         int retval = stm32x_unlock_option_reg(target);
 450         if (retval != ERROR_OK)
 451                 return retval;
 452
 453         /* rebuild option data */
 454         optiondata = stm32x_info->option_bytes.user_options & 0xfc;
 455         optiondata |= stm32x_info->option_bytes.RDP << 8;
 456         optiondata |= (stm32x_info->option_bytes.protection &
 457                 (~(0xffff << stm32x_info->protection_bits))) << 16;
 458
 459         if (stm32x_info->has_extra_options) {
 460                 /* F42x/43x/469/479 and 7xx have up to 4 bits of extra options */
 461                 optiondata |= (stm32x_info->option_bytes.user_options &
 462                         ((0xf00 << (stm32x_info->protection_bits - 12)) & 0xf00)) << 20;
 463         }
 464
 465         if (stm32x_info->has_large_mem || stm32x_info->has_boot_addr) {
 466                 if (stm32x_info->has_boot_addr) {
 467                         /* F7xx uses FLASH_OPTCR1 for boot0 and boot1 ... */
 468                         optiondata2 = stm32x_info->option_bytes.boot_addr;
 469                 } else {
 470                         /* F42x/43x/469/479 uses FLASH_OPTCR1 for additional protection bits */
 471                         optiondata2 = (stm32x_info->option_bytes.protection & 0x00fff000) << 4;
 472                 }
 473
 474                 retval = target_write_u32(target, STM32_FLASH_OPTCR1, optiondata2);
 475                 if (retval != ERROR_OK)
 476                         return retval;
 477         }
 478
 479         /* program extra pcrop register */
 480         if (stm32x_info->has_optcr2_pcrop) {
 481                 retval = target_write_u32(target, STM32_FLASH_OPTCR2,
 482                         stm32x_info->option_bytes.optcr2_pcrop);
 483                 if (retval != ERROR_OK)
 484                         return retval;
 485         }
 486
 487         /* program options */
 488         retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata);
 489         if (retval != ERROR_OK)
 490                 return retval;
 491
 492         /* start programming cycle */
 493         retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPTCR_START);
 494         if (retval != ERROR_OK)
 495                 return retval;
 496
 497         /* wait for completion, this might trigger a security erase and take a while */
 498         retval = stm32x_wait_status_busy(bank, FLASH_MASS_ERASE_TIMEOUT);
 499         if (retval != ERROR_OK)
 500                 return retval;
 501
 502         /* relock registers */
 503         retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPTCR_LOCK);
 504         if (retval != ERROR_OK)
 505                 return retval;
 506
 507         return ERROR_OK;
 508 }
 509
 510 static int stm32x_otp_read_protect(struct flash_bank *bank)
 511 {
 512         struct target *target = bank->target;
 513         uint32_t lock_base;
 514         int retval;
 515         uint8_t lock;
 516
 517         lock_base = stm32x_otp_is_f7(bank) ? STM32F7_OTP_LOCK_BASE
 518                   : STM32F2_OTP_LOCK_BASE;
 519
 520         for (unsigned int i = 0; i < bank->num_sectors; i++) {
 521                 retval = target_read_u8(target, lock_base + i, &lock);
 522                 if (retval != ERROR_OK)
 523                         return retval;
 524                 bank->sectors[i].is_protected = !lock;
 525         }
 526
 527         return ERROR_OK;
 528 }
 529
 530 static int stm32x_otp_protect(struct flash_bank *bank, unsigned int first,
 531                 unsigned int last)
 532 {
 533         struct target *target = bank->target;
 534         uint32_t lock_base;
 535         int i, retval;
 536         uint8_t lock;
 537
 538         assert((first <= last) && (last < bank->num_sectors));
 539
 540         lock_base = stm32x_otp_is_f7(bank) ? STM32F7_OTP_LOCK_BASE
 541                   : STM32F2_OTP_LOCK_BASE;
 542
 543         for (i = first; first <= last; i++) {
 544                 retval = target_read_u8(target, lock_base + i, &lock);
 545                 if (retval != ERROR_OK)
 546                         return retval;
 547                 if (lock)
 548                         continue;
 549
 550                 lock = 0xff;
 551                 retval = target_write_u8(target, lock_base + i, lock);
 552                 if (retval != ERROR_OK)
 553                         return retval;
 554         }
 555
 556         return ERROR_OK;
 557 }
 558
 559 static int stm32x_protect_check(struct flash_bank *bank)
 560 {
 561         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 562         struct flash_sector *prot_blocks;
 563         unsigned int num_prot_blocks;
 564         int retval;
 565
 566         /* if it's the OTP bank, look at the lock bits there */
 567         if (stm32x_is_otp(bank))
 568                 return stm32x_otp_read_protect(bank);
 569
 570         /* read write protection settings */
 571         retval = stm32x_read_options(bank);
 572         if (retval != ERROR_OK) {
 573                 LOG_DEBUG("unable to read option bytes");
 574                 return retval;
 575         }
 576
 577         if (bank->prot_blocks) {
 578                 num_prot_blocks = bank->num_prot_blocks;
 579                 prot_blocks = bank->prot_blocks;
 580         } else {
 581                 num_prot_blocks = bank->num_sectors;
 582                 prot_blocks = bank->sectors;
 583         }
 584
 585         for (unsigned int i = 0; i < num_prot_blocks; i++)
 586                 prot_blocks[i].is_protected =
 587                         ~(stm32x_info->option_bytes.protection >> i) & 1;
 588
 589         return ERROR_OK;
 590 }
 591
 592 static int stm32x_erase(struct flash_bank *bank, unsigned int first,
 593                 unsigned int last)
 594 {
 595         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 596         struct target *target = bank->target;
 597
 598         if (stm32x_is_otp(bank)) {
 599                 LOG_ERROR("Cannot erase OTP memory");
 600                 return ERROR_FAIL;
 601         }
 602
 603         assert((first <= last) && (last < bank->num_sectors));
 604
 605         if (bank->target->state != TARGET_HALTED) {
 606                 LOG_ERROR("Target not halted");
 607                 return ERROR_TARGET_NOT_HALTED;
 608         }
 609
 610         int retval;
 611         retval = stm32x_unlock_reg(target);
 612         if (retval != ERROR_OK)
 613                 return retval;
 614
 615         /*
 616         Sector Erase
 617         To erase a sector, follow the procedure below:
 618         1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
 619           FLASH_SR register
 620         2. Set the SER bit and select the sector
 621           you wish to erase (SNB) in the FLASH_CR register
 622         3. Set the STRT bit in the FLASH_CR register
 623         4. Wait for the BSY bit to be cleared
 624          */
 625
 626         for (unsigned int i = first; i <= last; i++) {
 627                 unsigned int snb;
 628                 if (stm32x_info->has_large_mem && i >= (bank->num_sectors / 2))
 629                         snb = (i - (bank->num_sectors / 2)) | 0x10;
 630                 else
 631                         snb = i;
 632
 633                 retval = target_write_u32(target,
 634                                 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_SER | FLASH_SNB(snb) | FLASH_STRT);
 635                 if (retval != ERROR_OK)
 636                         return retval;
 637
 638                 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
 639                 if (retval != ERROR_OK)
 640                         return retval;
 641         }
 642
 643         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
 644         if (retval != ERROR_OK)
 645                 return retval;
 646
 647         return ERROR_OK;
 648 }
 649
 650 static int stm32x_protect(struct flash_bank *bank, int set, unsigned int first,
 651                 unsigned int last)
 652 {
 653         struct target *target = bank->target;
 654         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 655
 656         if (target->state != TARGET_HALTED) {
 657                 LOG_ERROR("Target not halted");
 658                 return ERROR_TARGET_NOT_HALTED;
 659         }
 660
 661         if (stm32x_is_otp(bank)) {
 662                 if (!set)
 663                         return ERROR_COMMAND_ARGUMENT_INVALID;
 664
 665                 return stm32x_otp_protect(bank, first, last);
 666         }
 667
 668         /* read protection settings */
 669         int retval = stm32x_read_options(bank);
 670         if (retval != ERROR_OK) {
 671                 LOG_DEBUG("unable to read option bytes");
 672                 return retval;
 673         }
 674
 675         for (unsigned int i = first; i <= last; i++) {
 676                 if (set)
 677                         stm32x_info->option_bytes.protection &= ~(1 << i);
 678                 else
 679                         stm32x_info->option_bytes.protection |= (1 << i);
 680         }
 681
 682         retval = stm32x_write_options(bank);
 683         if (retval != ERROR_OK)
 684                 return retval;
 685
 686         return ERROR_OK;
 687 }
 688
 689 static int stm32x_write_block(struct flash_bank *bank, const uint8_t *buffer,
 690                 uint32_t offset, uint32_t count)
 691 {
 692         struct target *target = bank->target;
 693         uint32_t buffer_size = 16384;
 694         struct working_area *write_algorithm;
 695         struct working_area *source;
 696         uint32_t address = bank->base + offset;
 697         struct reg_param reg_params[5];
 698         struct armv7m_algorithm armv7m_info;
 699         int retval = ERROR_OK;
 700
 701         static const uint8_t stm32x_flash_write_code[] = {
 702 #include "../../../contrib/loaders/flash/stm32/stm32f2x.inc"
 703         };
 704
 705         if (stm32x_is_otp(bank) && !stm32x_is_otp_unlocked(bank)) {
 706                 LOG_ERROR("OTP memory bank is disabled for write commands.");
 707                 return ERROR_FAIL;
 708         }
 709
 710         if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
 711                         &write_algorithm) != ERROR_OK) {
 712                 LOG_WARNING("no working area available, can't do block memory writes");
 713                 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
 714         }
 715
 716         retval = target_write_buffer(target, write_algorithm->address,
 717                         sizeof(stm32x_flash_write_code),
 718                         stm32x_flash_write_code);
 719         if (retval != ERROR_OK) {
 720                 target_free_working_area(target, write_algorithm);
 721                 return retval;
 722         }
 723
 724         /* memory buffer */
 725         while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
 726                 buffer_size /= 2;
 727                 if (buffer_size <= 256) {
 728                         /* we already allocated the writing code, but failed to get a
 729                          * buffer, free the algorithm */
 730                         target_free_working_area(target, write_algorithm);
 731
 732                         LOG_WARNING("no large enough working area available, can't do block memory writes");
 733                         return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
 734                 }
 735         }
 736
 737         armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
 738         armv7m_info.core_mode = ARM_MODE_THREAD;
 739
 740         init_reg_param(&reg_params[0], "r0", 32, PARAM_IN_OUT);         /* buffer start, status (out) */
 741         init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);            /* buffer end */
 742         init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);            /* target address */
 743         init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);            /* count (halfword-16bit) */
 744         init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT);            /* flash base */
 745
 746         buf_set_u32(reg_params[0].value, 0, 32, source->address);
 747         buf_set_u32(reg_params[1].value, 0, 32, source->address + source->size);
 748         buf_set_u32(reg_params[2].value, 0, 32, address);
 749         buf_set_u32(reg_params[3].value, 0, 32, count);
 750         buf_set_u32(reg_params[4].value, 0, 32, STM32_FLASH_BASE);
 751
 752         retval = target_run_flash_async_algorithm(target, buffer, count, 2,
 753                         0, NULL,
 754                         5, reg_params,
 755                         source->address, source->size,
 756                         write_algorithm->address, 0,
 757                         &armv7m_info);
 758
 759         if (retval == ERROR_FLASH_OPERATION_FAILED) {
 760                 LOG_ERROR("error executing stm32x flash write algorithm");
 761
 762                 uint32_t error = buf_get_u32(reg_params[0].value, 0, 32) & FLASH_ERROR;
 763
 764                 if (error & FLASH_WRPERR)
 765                         LOG_ERROR("flash memory write protected");
 766
 767                 if (error != 0) {
 768                         LOG_ERROR("flash write failed = 0x%08" PRIx32, error);
 769                         /* Clear but report errors */
 770                         target_write_u32(target, STM32_FLASH_SR, error);
 771                         retval = ERROR_FAIL;
 772                 }
 773         }
 774
 775         target_free_working_area(target, source);
 776         target_free_working_area(target, write_algorithm);
 777
 778         destroy_reg_param(&reg_params[0]);
 779         destroy_reg_param(&reg_params[1]);
 780         destroy_reg_param(&reg_params[2]);
 781         destroy_reg_param(&reg_params[3]);
 782         destroy_reg_param(&reg_params[4]);
 783
 784         return retval;
 785 }
 786
 787 static int stm32x_write(struct flash_bank *bank, const uint8_t *buffer,
 788                 uint32_t offset, uint32_t count)
 789 {
 790         struct target *target = bank->target;
 791         uint32_t words_remaining = (count / 2);
 792         uint32_t bytes_remaining = (count & 0x00000001);
 793         uint32_t address = bank->base + offset;
 794         uint32_t bytes_written = 0;
 795         int retval;
 796
 797         if (bank->target->state != TARGET_HALTED) {
 798                 LOG_ERROR("Target not halted");
 799                 return ERROR_TARGET_NOT_HALTED;
 800         }
 801
 802         if (offset & 0x1) {
 803                 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
 804                 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
 805         }
 806
 807         retval = stm32x_unlock_reg(target);
 808         if (retval != ERROR_OK)
 809                 return retval;
 810
 811         /* multiple half words (2-byte) to be programmed? */
 812         if (words_remaining > 0) {
 813                 /* try using a block write */
 814                 retval = stm32x_write_block(bank, buffer, offset, words_remaining);
 815                 if (retval != ERROR_OK) {
 816                         if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
 817                                 /* if block write failed (no sufficient working area),
 818                                  * we use normal (slow) single dword accesses */
 819                                 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
 820                         }
 821                 } else {
 822                         buffer += words_remaining * 2;
 823                         address += words_remaining * 2;
 824                         words_remaining = 0;
 825                 }
 826         }
 827
 828         if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
 829                 return retval;
 830
 831         /*
 832         Standard programming
 833         The Flash memory programming sequence is as follows:
 834         1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
 835           FLASH_SR register.
 836         2. Set the PG bit in the FLASH_CR register
 837         3. Perform the data write operation(s) to the desired memory address (inside main
 838           memory block or OTP area):
 839         – – Half-word access in case of x16 parallelism
 840         – Word access in case of x32 parallelism
 841         –
 842         4.
 843         Byte access in case of x8 parallelism
 844         Double word access in case of x64 parallelism
 845         Wait for the BSY bit to be cleared
 846         */
 847         while (words_remaining > 0) {
 848                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
 849                                 FLASH_PG | FLASH_PSIZE_16);
 850                 if (retval != ERROR_OK)
 851                         return retval;
 852
 853                 retval = target_write_memory(target, address, 2, 1, buffer + bytes_written);
 854                 if (retval != ERROR_OK)
 855                         return retval;
 856
 857                 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
 858                 if (retval != ERROR_OK)
 859                         return retval;
 860
 861                 bytes_written += 2;
 862                 words_remaining--;
 863                 address += 2;
 864         }
 865
 866         if (bytes_remaining) {
 867                 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
 868                                 FLASH_PG | FLASH_PSIZE_8);
 869                 if (retval != ERROR_OK)
 870                         return retval;
 871                 retval = target_write_u8(target, address, buffer[bytes_written]);
 872                 if (retval != ERROR_OK)
 873                         return retval;
 874
 875                 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
 876                 if (retval != ERROR_OK)
 877                         return retval;
 878         }
 879
 880         return target_write_u32(target, STM32_FLASH_CR, FLASH_LOCK);
 881 }
 882
 883 static void setup_sector(struct flash_bank *bank, unsigned int i,
 884                 unsigned int size)
 885 {
 886         assert(i < bank->num_sectors);
 887         bank->sectors[i].offset = bank->size;
 888         bank->sectors[i].size = size;
 889         bank->size += bank->sectors[i].size;
 890         LOG_DEBUG("sector %u: %ukBytes", i, size >> 10);
 891 }
 892
 893 static uint16_t sector_size_in_kb(unsigned int i, uint16_t max_sector_size_in_kb)
 894 {
 895         if (i < 4)
 896                 return max_sector_size_in_kb / 8;
 897         if (i == 4)
 898                 return max_sector_size_in_kb / 2;
 899         return max_sector_size_in_kb;
 900 }
 901
 902 static unsigned int calculate_number_of_sectors(struct flash_bank *bank,
 903                 uint16_t flash_size_in_kb,
 904                 uint16_t max_sector_size_in_kb)
 905 {
 906         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 907         uint16_t remaining_flash_size_in_kb = flash_size_in_kb;
 908         unsigned int nr_sectors;
 909
 910         /* Dual Bank Flash has two identically-arranged banks of sectors. */
 911         if (stm32x_info->has_large_mem)
 912                 remaining_flash_size_in_kb /= 2;
 913
 914         for (nr_sectors = 0; remaining_flash_size_in_kb > 0; nr_sectors++) {
 915                 uint16_t size_in_kb = sector_size_in_kb(nr_sectors, max_sector_size_in_kb);
 916                 if (size_in_kb > remaining_flash_size_in_kb) {
 917                         LOG_INFO("%s Bank %" PRIu16 " kiB final sector clipped to %" PRIu16 " kiB",
 918                                  stm32x_info->has_large_mem ? "Dual" : "Single",
 919                                  flash_size_in_kb, remaining_flash_size_in_kb);
 920                         remaining_flash_size_in_kb = 0;
 921                 } else {
 922                         remaining_flash_size_in_kb -= size_in_kb;
 923                 }
 924         }
 925
 926         return stm32x_info->has_large_mem ? nr_sectors*2 : nr_sectors;
 927 }
 928
 929 static void setup_bank(struct flash_bank *bank, unsigned int start,
 930         uint16_t flash_size_in_kb, uint16_t max_sector_size_in_kb)
 931 {
 932         uint16_t remaining_flash_size_in_kb = flash_size_in_kb;
 933         unsigned int sector_index = 0;
 934         while (remaining_flash_size_in_kb > 0) {
 935                 uint16_t size_in_kb = sector_size_in_kb(sector_index, max_sector_size_in_kb);
 936                 if (size_in_kb > remaining_flash_size_in_kb) {
 937                         /* Clip last sector. Already warned in
 938                          * calculate_number_of_sectors. */
 939                         size_in_kb = remaining_flash_size_in_kb;
 940                 }
 941                 setup_sector(bank, start + sector_index, size_in_kb * 1024);
 942                 remaining_flash_size_in_kb -= size_in_kb;
 943                 sector_index++;
 944         }
 945 }
 946
 947 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
 948 {
 949         /* this checks for a stm32f4x errata issue where a
 950          * stm32f2x DBGMCU_IDCODE is incorrectly returned.
 951          * If the issue is detected target is forced to stm32f4x Rev A.
 952          * Only effects Rev A silicon */
 953
 954         struct target *target = bank->target;
 955
 956         /* read stm32 device id register */
 957         int retval = target_read_u32(target, 0xE0042000, device_id);
 958         if (retval != ERROR_OK)
 959                 return retval;
 960
 961         if ((*device_id & 0xfff) == 0x411
 962                         && cortex_m_get_partno_safe(target) == CORTEX_M4_PARTNO) {
 963                 *device_id &= ~((0xFFFF << 16) | 0xfff);
 964                 *device_id |= (0x1000 << 16) | 0x413;
 965                 LOG_INFO("stm32f4x errata detected - fixing incorrect MCU_IDCODE");
 966         }
 967         return retval;
 968 }
 969
 970 static int stm32x_probe(struct flash_bank *bank)
 971 {
 972         struct target *target = bank->target;
 973         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
 974         unsigned int num_prot_blocks, num_sectors;
 975         uint16_t flash_size_in_kb;
 976         uint16_t otp_size_in_b;
 977         uint16_t otp_sector_size;
 978         uint32_t flash_size_reg = 0x1FFF7A22;
 979         uint16_t max_sector_size_in_kb = 128;
 980         uint16_t max_flash_size_in_kb;
 981         uint32_t device_id;
 982         uint32_t base_address = 0x08000000;
 983
 984         stm32x_info->probed = false;
 985         stm32x_info->has_large_mem = false;
 986         stm32x_info->has_boot_addr = false;
 987         stm32x_info->has_extra_options = false;
 988         stm32x_info->has_optcr2_pcrop = false;
 989         stm32x_info->protection_bits = 12;              /* max. number of nWRPi bits (in FLASH_OPTCR !!!) */
 990         num_prot_blocks = 0;
 991
 992         free(bank->sectors);
 993         bank->num_sectors = 0;
 994         bank->sectors = NULL;
 995
 996         free(bank->prot_blocks);
 997         bank->num_prot_blocks = 0;
 998         bank->prot_blocks = NULL;
 999
1000         if (!target_was_examined(target)) {
1001                 LOG_ERROR("Target not examined yet");
1002                 return ERROR_TARGET_NOT_EXAMINED;
1003         }
1004
1005         /* if explicitly called out as OTP bank, short circuit probe */
1006         if (stm32x_is_otp(bank)) {
1007                 if (stm32x_otp_is_f7(bank)) {
1008                         otp_size_in_b = STM32F7_OTP_SIZE;
1009                         otp_sector_size = STM32F7_OTP_SECTOR_SIZE;
1010                 } else {
1011                         otp_size_in_b = STM32F2_OTP_SIZE;
1012                         otp_sector_size = STM32F2_OTP_SECTOR_SIZE;
1013                 }
1014
1015                 num_sectors = otp_size_in_b / otp_sector_size;
1016                 LOG_INFO("flash size = %" PRIu16 " bytes", otp_size_in_b);
1017
1018                 assert(num_sectors > 0);
1019
1020                 bank->num_sectors = num_sectors;
1021                 bank->sectors = calloc(sizeof(struct flash_sector), num_sectors);
1022
1023                 if (stm32x_otp_is_f7(bank))
1024                         bank->size = STM32F7_OTP_SIZE;
1025                 else
1026                         bank->size = STM32F2_OTP_SIZE;
1027
1028                 for (unsigned int i = 0; i < num_sectors; i++) {
1029                         bank->sectors[i].offset = i * otp_sector_size;
1030                         bank->sectors[i].size = otp_sector_size;
1031                         bank->sectors[i].is_erased = 1;
1032                         bank->sectors[i].is_protected = 0;
1033                 }
1034
1035                 stm32x_info->probed = true;
1036                 return ERROR_OK;
1037         }
1038
1039         /* read stm32 device id register */
1040         int retval = stm32x_get_device_id(bank, &device_id);
1041         if (retval != ERROR_OK)
1042                 return retval;
1043         LOG_INFO("device id = 0x%08" PRIx32, device_id);
1044         device_id &= 0xfff;             /* only bits 0-11 are used further on */
1045
1046         /* set max flash size depending on family, id taken from AN2606 */
1047         switch (device_id) {
1048         case 0x411: /* F20x/21x */
1049         case 0x413: /* F40x/41x */
1050                 max_flash_size_in_kb = 1024;
1051                 break;
1052
1053         case 0x419: /* F42x/43x */
1054         case 0x434: /* F469/479 */
1055                 stm32x_info->has_extra_options = true;
1056                 max_flash_size_in_kb = 2048;
1057                 break;
1058
1059         case 0x423:     /* F401xB/C */
1060                 max_flash_size_in_kb = 256;
1061                 break;
1062
1063         case 0x421:     /* F446 */
1064         case 0x431: /* F411 */
1065         case 0x433: /* F401xD/E */
1066         case 0x441: /* F412 */
1067                 max_flash_size_in_kb = 512;
1068                 break;
1069
1070         case 0x458: /* F410 */
1071                 max_flash_size_in_kb = 128;
1072                 break;
1073
1074         case 0x449:     /* F74x/75x */
1075                 max_flash_size_in_kb = 1024;
1076                 max_sector_size_in_kb = 256;
1077                 flash_size_reg = 0x1FF0F442;
1078                 stm32x_info->has_extra_options = true;
1079                 stm32x_info->has_boot_addr = true;
1080                 break;
1081
1082         case 0x451:     /* F76x/77x */
1083                 max_flash_size_in_kb = 2048;
1084                 max_sector_size_in_kb = 256;
1085                 flash_size_reg = 0x1FF0F442;
1086                 stm32x_info->has_extra_options = true;
1087                 stm32x_info->has_boot_addr = true;
1088                 break;
1089
1090         case 0x452:     /* F72x/73x */
1091                 max_flash_size_in_kb = 512;
1092                 flash_size_reg = 0x1FF07A22;    /* yes, 0x1FF*0*7A22, not 0x1FF*F*7A22 */
1093                 stm32x_info->has_extra_options = true;
1094                 stm32x_info->has_boot_addr = true;
1095                 stm32x_info->has_optcr2_pcrop = true;
1096                 break;
1097
1098         case 0x463:     /* F413x/423x */
1099                 max_flash_size_in_kb = 1536;
1100                 stm32x_info->has_extra_options = true;
1101                 stm32x_info->protection_bits = 15;
1102                 num_prot_blocks = 15;
1103                 break;
1104
1105         default:
1106                 LOG_WARNING("Cannot identify target as a STM32 family.");
1107                 return ERROR_FAIL;
1108         }
1109
1110         /* get flash size from target. */
1111         retval = target_read_u16(target, flash_size_reg, &flash_size_in_kb);
1112
1113         /* failed reading flash size or flash size invalid (early silicon),
1114          * default to max target family */
1115         if (retval != ERROR_OK || flash_size_in_kb == 0xffff || flash_size_in_kb == 0) {
1116                 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming %" PRIu16 "k flash",
1117                         max_flash_size_in_kb);
1118                 flash_size_in_kb = max_flash_size_in_kb;
1119         }
1120
1121         /* if the user sets the size manually then ignore the probed value
1122          * this allows us to work around devices that have a invalid flash size register value */
1123         if (stm32x_info->user_bank_size) {
1124                 LOG_INFO("ignoring flash probed value, using configured bank size");
1125                 flash_size_in_kb = stm32x_info->user_bank_size / 1024;
1126         }
1127
1128         LOG_INFO("flash size = %" PRIu16 " KiB", flash_size_in_kb);
1129
1130         /* did we assign flash size? */
1131         assert(flash_size_in_kb != 0xffff);
1132
1133         /* F42x/43x/469/479 1024 kiByte devices have a dual bank option */
1134         if ((device_id == 0x419) || (device_id == 0x434)) {
1135                 uint32_t optiondata;
1136                 retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
1137                 if (retval != ERROR_OK) {
1138                         LOG_DEBUG("unable to read option bytes");
1139                         return retval;
1140                 }
1141                 if ((flash_size_in_kb > 1024) || (optiondata & OPTCR_DB1M)) {
1142                         stm32x_info->has_large_mem = true;
1143                         LOG_INFO("Dual Bank %" PRIu16 " kiB STM32F42x/43x/469/479 found", flash_size_in_kb);
1144                 } else {
1145                         stm32x_info->has_large_mem = false;
1146                         LOG_INFO("Single Bank %" PRIu16 " kiB STM32F42x/43x/469/479 found", flash_size_in_kb);
1147                 }
1148         }
1149
1150         /* F76x/77x devices have a dual bank option */
1151         if (device_id == 0x451) {
1152                 uint32_t optiondata;
1153                 retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
1154                 if (retval != ERROR_OK) {
1155                         LOG_DEBUG("unable to read option bytes");
1156                         return retval;
1157                 }
1158                 if (optiondata & OPTCR_NDBANK) {
1159                         stm32x_info->has_large_mem = false;
1160                         LOG_INFO("Single Bank %" PRIu16 " kiB STM32F76x/77x found", flash_size_in_kb);
1161                 } else {
1162                         stm32x_info->has_large_mem = true;
1163                         max_sector_size_in_kb >>= 1; /* sector size divided by 2 in dual-bank mode */
1164                         LOG_INFO("Dual Bank %" PRIu16 " kiB STM32F76x/77x found", flash_size_in_kb);
1165                 }
1166         }
1167
1168         /* calculate numbers of pages */
1169         unsigned int num_pages = calculate_number_of_sectors(
1170                         bank, flash_size_in_kb, max_sector_size_in_kb);
1171
1172         bank->base = base_address;
1173         bank->num_sectors = num_pages;
1174         bank->sectors = calloc(num_pages, sizeof(struct flash_sector));
1175         for (unsigned int i = 0; i < num_pages; i++) {
1176                 bank->sectors[i].is_erased = -1;
1177                 bank->sectors[i].is_protected = 0;
1178         }
1179         bank->size = 0;
1180         LOG_DEBUG("allocated %u sectors", num_pages);
1181
1182         /* F76x/77x in dual bank mode */
1183         if ((device_id == 0x451) && stm32x_info->has_large_mem)
1184                 num_prot_blocks = num_pages >> 1;
1185
1186         if (num_prot_blocks) {
1187                 bank->prot_blocks = malloc(sizeof(struct flash_sector) * num_prot_blocks);
1188                 for (unsigned int i = 0; i < num_prot_blocks; i++)
1189                         bank->prot_blocks[i].is_protected = 0;
1190                 LOG_DEBUG("allocated %u prot blocks", num_prot_blocks);
1191         }
1192
1193         if (stm32x_info->has_large_mem) {
1194                 /* dual-bank */
1195                 setup_bank(bank, 0, flash_size_in_kb >> 1, max_sector_size_in_kb);
1196                 setup_bank(bank, num_pages >> 1, flash_size_in_kb >> 1,
1197                         max_sector_size_in_kb);
1198
1199                 /* F767x/F77x in dual mode, one protection bit refers to two adjacent sectors */
1200                 if (device_id == 0x451) {
1201                         for (unsigned int i = 0; i < num_prot_blocks; i++) {
1202                                 bank->prot_blocks[i].offset = bank->sectors[i << 1].offset;
1203                                 bank->prot_blocks[i].size = bank->sectors[i << 1].size
1204                                                 + bank->sectors[(i << 1) + 1].size;
1205                         }
1206                 }
1207         } else {
1208                 /* single-bank */
1209                 setup_bank(bank, 0, flash_size_in_kb, max_sector_size_in_kb);
1210
1211                 /* F413/F423, sectors 14 and 15 share one common protection bit */
1212                 if (device_id == 0x463) {
1213                         for (unsigned int i = 0; i < num_prot_blocks; i++) {
1214                                 bank->prot_blocks[i].offset = bank->sectors[i].offset;
1215                                 bank->prot_blocks[i].size = bank->sectors[i].size;
1216                         }
1217                         bank->prot_blocks[num_prot_blocks - 1].size <<= 1;
1218                 }
1219         }
1220         bank->num_prot_blocks = num_prot_blocks;
1221         assert((bank->size >> 10) == flash_size_in_kb);
1222
1223         stm32x_info->probed = true;
1224         return ERROR_OK;
1225 }
1226
1227 static int stm32x_auto_probe(struct flash_bank *bank)
1228 {
1229         struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
1230         if (stm32x_info->probed)
1231                 return ERROR_OK;
1232         return stm32x_probe(bank);
1233 }
1234
1235 static int get_stm32x_info(struct flash_bank *bank, struct command_invocation *cmd)
1236 {
1237         uint32_t dbgmcu_idcode;
1238
1239         /* read stm32 device id register */
1240         int retval = stm32x_get_device_id(bank, &dbgmcu_idcode);
1241         if (retval != ERROR_OK)
1242                 return retval;
1243
1244         uint16_t device_id = dbgmcu_idcode & 0xfff;
1245         uint16_t rev_id = dbgmcu_idcode >> 16;
1246         const char *device_str;
1247         const char *rev_str = NULL;
1248
1249         switch (device_id) {
1250         case 0x411:
1251                 device_str = "STM32F2xx";
1252
1253                 switch (rev_id) {
1254                 case 0x1000:
1255                         rev_str = "A";
1256                         break;
1257
1258                 case 0x2000:
1259                         rev_str = "B";
1260                         break;
1261
1262                 case 0x1001:
1263                         rev_str = "Z";
1264                         break;
1265
1266                 case 0x2001:
1267                         rev_str = "Y";
1268                         break;
1269
1270                 case 0x2003:
1271                         rev_str = "X";
1272                         break;
1273
1274                 case 0x2007:
1275                         rev_str = "1";
1276                         break;
1277
1278                 case 0x200F:
1279                         rev_str = "V";
1280                         break;
1281
1282                 case 0x201F:
1283                         rev_str = "2";
1284                         break;
1285                 }
1286                 break;
1287
1288         case 0x413:
1289         case 0x419:
1290         case 0x434:
1291                 device_str = "STM32F4xx";
1292
1293                 switch (rev_id) {
1294                 case 0x1000:
1295                         rev_str = "A";
1296                         break;
1297
1298                 case 0x1001:
1299                         rev_str = "Z";
1300                         break;
1301
1302                 case 0x1003:
1303                         rev_str = "Y";
1304                         break;
1305
1306                 case 0x1007:
1307                         rev_str = "1";
1308                         break;
1309
1310                 case 0x2001:
1311                         rev_str = "3";
1312                         break;
1313                 }
1314                 break;
1315
1316         case 0x421:
1317                 device_str = "STM32F446";
1318
1319                 switch (rev_id) {
1320                 case 0x1000:
1321                         rev_str = "A";
1322                         break;
1323                 }
1324                 break;
1325
1326         case 0x423:
1327         case 0x431:
1328         case 0x433:
1329         case 0x458:
1330         case 0x441:
1331                 device_str = "STM32F4xx (Low Power)";
1332
1333                 switch (rev_id) {
1334                 case 0x1000:
1335                         rev_str = "A";
1336                         break;
1337
1338                 case 0x1001:
1339                         rev_str = "Z";
1340                         break;
1341
1342                 case 0x2000:
1343                         rev_str = "B";
1344                         break;
1345
1346                 case 0x3000:
1347                         rev_str = "C";
1348                         break;
1349                 }
1350                 break;
1351
1352         case 0x449:
1353                 device_str = "STM32F7[4|5]x";
1354
1355                 switch (rev_id) {
1356                 case 0x1000:
1357                         rev_str = "A";
1358                         break;
1359
1360                 case 0x1001:
1361                         rev_str = "Z";
1362                         break;
1363                 }
1364                 break;
1365
1366         case 0x451:
1367                 device_str = "STM32F7[6|7]x";
1368
1369                 switch (rev_id) {
1370                 case 0x1000:
1371                         rev_str = "A";
1372                         break;
1373                 case 0x1001:
1374                         rev_str = "Z";
1375                         break;
1376                 }
1377                 break;
1378
1379         case 0x452:
1380                 device_str = "STM32F7[2|3]x";
1381
1382                 switch (rev_id) {
1383                 case 0x1000:
1384                         rev_str = "A";
1385                         break;
1386                 }
1387                 break;
1388
1389         case 0x463:
1390                 device_str = "STM32F4[1|2]3";
1391
1392                 switch (rev_id) {
1393                 case 0x1000:
1394                         rev_str = "A";
1395                         break;
1396                 }
1397                 break;
1398
1399         default:
1400                 command_print_sameline(cmd, "Cannot identify target as a STM32F2/4/7\n");
1401                 return ERROR_FAIL;
1402         }
1403
1404         if (rev_str)
1405                 command_print_sameline(cmd, "%s - Rev: %s", device_str, rev_str);
1406         else
1407                 command_print_sameline(cmd, "%s - Rev: unknown (0x%04" PRIx16 ")", device_str, rev_id);
1408
1409         return ERROR_OK;
1410 }
1411
1412 COMMAND_HANDLER(stm32x_handle_lock_command)
1413 {
1414         struct target *target = NULL;
1415         struct stm32x_flash_bank *stm32x_info = NULL;
1416
1417         if (CMD_ARGC < 1)
1418                 return ERROR_COMMAND_SYNTAX_ERROR;
1419
1420         struct flash_bank *bank;
1421         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1422         if (retval != ERROR_OK)
1423                 return retval;
1424
1425         stm32x_info = bank->driver_priv;
1426         target = bank->target;
1427
1428         if (target->state != TARGET_HALTED) {
1429                 LOG_INFO("Target not halted");
1430                 /* return ERROR_TARGET_NOT_HALTED; */
1431         }
1432
1433         if (stm32x_read_options(bank) != ERROR_OK) {
1434                 command_print(CMD, "%s failed to read options", bank->driver->name);
1435                 return ERROR_OK;
1436         }
1437
1438         /* set readout protection */
1439         stm32x_info->option_bytes.RDP = 0;
1440
1441         if (stm32x_write_options(bank) != ERROR_OK) {
1442                 command_print(CMD, "%s failed to lock device", bank->driver->name);
1443                 return ERROR_OK;
1444         }
1445
1446         command_print(CMD, "%s locked", bank->driver->name);
1447
1448         return ERROR_OK;
1449 }
1450
1451 COMMAND_HANDLER(stm32x_handle_unlock_command)
1452 {
1453         struct target *target = NULL;
1454         struct stm32x_flash_bank *stm32x_info = NULL;
1455
1456         if (CMD_ARGC < 1)
1457                 return ERROR_COMMAND_SYNTAX_ERROR;
1458
1459         struct flash_bank *bank;
1460         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1461         if (retval != ERROR_OK)
1462                 return retval;
1463
1464         stm32x_info = bank->driver_priv;
1465         target = bank->target;
1466
1467         if (target->state != TARGET_HALTED) {
1468                 LOG_INFO("Target not halted");
1469                 /* return ERROR_TARGET_NOT_HALTED; */
1470         }
1471
1472         if (stm32x_read_options(bank) != ERROR_OK) {
1473                 command_print(CMD, "%s failed to read options", bank->driver->name);
1474                 return ERROR_OK;
1475         }
1476
1477         /* clear readout protection and complementary option bytes
1478          * this will also force a device unlock if set */
1479         stm32x_info->option_bytes.RDP = 0xAA;
1480         if (stm32x_info->has_optcr2_pcrop) {
1481                 stm32x_info->option_bytes.optcr2_pcrop = OPTCR2_PCROP_RDP | (~1U << bank->num_sectors);
1482         }
1483
1484         if (stm32x_write_options(bank) != ERROR_OK) {
1485                 command_print(CMD, "%s failed to unlock device", bank->driver->name);
1486                 return ERROR_OK;
1487         }
1488
1489         command_print(CMD, "%s unlocked.\n"
1490                         "INFO: a reset or power cycle is required "
1491                         "for the new settings to take effect.", bank->driver->name);
1492
1493         return ERROR_OK;
1494 }
1495
1496 static int stm32x_mass_erase(struct flash_bank *bank)
1497 {
1498         int retval;
1499         uint32_t flash_mer;
1500         struct target *target = bank->target;
1501         struct stm32x_flash_bank *stm32x_info = NULL;
1502
1503         if (target->state != TARGET_HALTED) {
1504                 LOG_ERROR("Target not halted");
1505                 return ERROR_TARGET_NOT_HALTED;
1506         }
1507
1508         stm32x_info = bank->driver_priv;
1509
1510         retval = stm32x_unlock_reg(target);
1511         if (retval != ERROR_OK)
1512                 return retval;
1513
1514         /* mass erase flash memory */
1515         if (stm32x_info->has_large_mem)
1516                 flash_mer = FLASH_MER | FLASH_MER1;
1517         else
1518                 flash_mer = FLASH_MER;
1519
1520         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), flash_mer);
1521         if (retval != ERROR_OK)
1522                 return retval;
1523         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
1524                 flash_mer | FLASH_STRT);
1525         if (retval != ERROR_OK)
1526                 return retval;
1527
1528         retval = stm32x_wait_status_busy(bank, FLASH_MASS_ERASE_TIMEOUT);
1529         if (retval != ERROR_OK)
1530                 return retval;
1531
1532         retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
1533         if (retval != ERROR_OK)
1534                 return retval;
1535
1536         return ERROR_OK;
1537 }
1538
1539 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
1540 {
1541         if (CMD_ARGC < 1) {
1542                 command_print(CMD, "stm32x mass_erase <bank>");
1543                 return ERROR_COMMAND_SYNTAX_ERROR;
1544         }
1545
1546         struct flash_bank *bank;
1547         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1548         if (retval != ERROR_OK)
1549                 return retval;
1550
1551         retval = stm32x_mass_erase(bank);
1552         if (retval == ERROR_OK) {
1553                 command_print(CMD, "stm32x mass erase complete");
1554         } else {
1555                 command_print(CMD, "stm32x mass erase failed");
1556         }
1557
1558         return retval;
1559 }
1560
1561 COMMAND_HANDLER(stm32f2x_handle_options_read_command)
1562 {
1563         int retval;
1564         struct flash_bank *bank;
1565         struct stm32x_flash_bank *stm32x_info = NULL;
1566
1567         if (CMD_ARGC != 1) {
1568                 command_print(CMD, "stm32f2x options_read <bank>");
1569                 return ERROR_COMMAND_SYNTAX_ERROR;
1570         }
1571
1572         retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1573         if (retval != ERROR_OK)
1574                 return retval;
1575
1576         retval = stm32x_read_options(bank);
1577         if (retval != ERROR_OK)
1578                 return retval;
1579
1580         stm32x_info = bank->driver_priv;
1581         if (stm32x_info->has_extra_options) {
1582                 if (stm32x_info->has_boot_addr) {
1583                         uint32_t boot_addr = stm32x_info->option_bytes.boot_addr;
1584
1585                         command_print(CMD, "stm32f2x user_options 0x%03" PRIX16 ","
1586                                 " boot_add0 0x%04" PRIX32 ", boot_add1 0x%04" PRIX32,
1587                                 stm32x_info->option_bytes.user_options,
1588                                 boot_addr & 0xffff, (boot_addr & 0xffff0000) >> 16);
1589                         if (stm32x_info->has_optcr2_pcrop) {
1590                                 command_print(CMD, "stm32f2x optcr2_pcrop 0x%08" PRIX32,
1591                                                 stm32x_info->option_bytes.optcr2_pcrop);
1592                         }
1593                 } else {
1594                         command_print(CMD, "stm32f2x user_options 0x%03" PRIX16,
1595                                 stm32x_info->option_bytes.user_options);
1596                 }
1597         } else {
1598                 command_print(CMD, "stm32f2x user_options 0x%02" PRIX16,
1599                         stm32x_info->option_bytes.user_options);
1600
1601         }
1602
1603         return retval;
1604 }
1605
1606 COMMAND_HANDLER(stm32f2x_handle_options_write_command)
1607 {
1608         int retval;
1609         struct flash_bank *bank;
1610         struct stm32x_flash_bank *stm32x_info = NULL;
1611         uint16_t user_options, boot_addr0, boot_addr1, options_mask;
1612
1613         if (CMD_ARGC < 1) {
1614                 command_print(CMD, "stm32f2x options_write <bank> ...");
1615                 return ERROR_COMMAND_SYNTAX_ERROR;
1616         }
1617
1618         retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1619         if (retval != ERROR_OK)
1620                 return retval;
1621
1622         retval = stm32x_read_options(bank);
1623         if (retval != ERROR_OK)
1624                 return retval;
1625
1626         stm32x_info = bank->driver_priv;
1627         if (stm32x_info->has_boot_addr) {
1628                 if (CMD_ARGC != 4) {
1629                         command_print(CMD, "stm32f2x options_write <bank> <user_options>"
1630                                 " <boot_addr0> <boot_addr1>");
1631                         return ERROR_COMMAND_SYNTAX_ERROR;
1632                 }
1633                 COMMAND_PARSE_NUMBER(u16, CMD_ARGV[2], boot_addr0);
1634                 COMMAND_PARSE_NUMBER(u16, CMD_ARGV[3], boot_addr1);
1635                 stm32x_info->option_bytes.boot_addr = boot_addr0 | (((uint32_t) boot_addr1) << 16);
1636         } else {
1637                 if (CMD_ARGC != 2) {
1638                         command_print(CMD, "stm32f2x options_write <bank> <user_options>");
1639                         return ERROR_COMMAND_SYNTAX_ERROR;
1640                 }
1641         }
1642
1643         COMMAND_PARSE_NUMBER(u16, CMD_ARGV[1], user_options);
1644         options_mask = !stm32x_info->has_extra_options ? ~0xfc :
1645                 ~(((0xf00 << (stm32x_info->protection_bits - 12)) | 0xff) & 0xffc);
1646         if (user_options & options_mask) {
1647                 command_print(CMD, "stm32f2x invalid user_options");
1648                 return ERROR_COMMAND_ARGUMENT_INVALID;
1649         }
1650
1651         stm32x_info->option_bytes.user_options = user_options;
1652
1653         if (stm32x_write_options(bank) != ERROR_OK) {
1654                 command_print(CMD, "stm32f2x failed to write options");
1655                 return ERROR_OK;
1656         }
1657
1658         /* switching between single- and dual-bank modes requires re-probe */
1659         /* ... and reprogramming of whole flash */
1660         stm32x_info->probed = false;
1661
1662         command_print(CMD, "stm32f2x write options complete.\n"
1663                                 "INFO: a reset or power cycle is required "
1664                                 "for the new settings to take effect.");
1665         return retval;
1666 }
1667
1668 COMMAND_HANDLER(stm32f2x_handle_optcr2_write_command)
1669 {
1670         int retval;
1671         struct flash_bank *bank;
1672         struct stm32x_flash_bank *stm32x_info = NULL;
1673         uint32_t optcr2_pcrop;
1674
1675         if (CMD_ARGC != 2) {
1676                 command_print(CMD, "stm32f2x optcr2_write <bank> <optcr2_value>");
1677                 return ERROR_COMMAND_SYNTAX_ERROR;
1678         }
1679
1680         retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1681         if (retval != ERROR_OK)
1682                 return retval;
1683
1684         stm32x_info = bank->driver_priv;
1685         if (!stm32x_info->has_optcr2_pcrop) {
1686                 command_print(CMD, "no optcr2 register");
1687                 return ERROR_COMMAND_ARGUMENT_INVALID;
1688         }
1689
1690         command_print(CMD, "INFO: To disable PCROP, set PCROP_RDP"
1691                                 " with PCROPi bits STILL SET, then\nlock device and"
1692                                 " finally unlock it. Clears PCROP and mass erases flash.");
1693
1694         retval = stm32x_read_options(bank);
1695         if (retval != ERROR_OK)
1696                 return retval;
1697
1698         COMMAND_PARSE_NUMBER(u32, CMD_ARGV[1], optcr2_pcrop);
1699         stm32x_info->option_bytes.optcr2_pcrop = optcr2_pcrop;
1700
1701         if (stm32x_write_options(bank) != ERROR_OK) {
1702                 command_print(CMD, "stm32f2x failed to write options");
1703                 return ERROR_OK;
1704         }
1705
1706         command_print(CMD, "stm32f2x optcr2_write complete.");
1707         return retval;
1708 }
1709
1710 COMMAND_HANDLER(stm32x_handle_otp_command)
1711 {
1712         if (CMD_ARGC < 2) {
1713                 command_print(CMD, "stm32x otp <bank> (enable|disable|show)");
1714                 return ERROR_COMMAND_SYNTAX_ERROR;
1715         }
1716
1717         struct flash_bank *bank;
1718         int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1719         if (retval != ERROR_OK)
1720                 return retval;
1721         if (stm32x_is_otp(bank)) {
1722                 if (strcmp(CMD_ARGV[1], "enable") == 0) {
1723                         stm32x_otp_enable(bank);
1724                 } else if (strcmp(CMD_ARGV[1], "disable") == 0) {
1725                         stm32x_otp_disable(bank);
1726                 } else if (strcmp(CMD_ARGV[1], "show") == 0) {
1727                         command_print(CMD,
1728                                 "OTP memory bank #%u is %s for write commands.",
1729                                 bank->bank_number,
1730                                 stm32x_is_otp_unlocked(bank) ? "enabled" : "disabled");
1731                 } else {
1732                         return ERROR_COMMAND_SYNTAX_ERROR;
1733                 }
1734         } else {
1735                 command_print(CMD, "Failed: not an OTP bank.");
1736         }
1737
1738         return retval;
1739 }
1740
1741 static const struct command_registration stm32f2x_exec_command_handlers[] = {
1742         {
1743                 .name = "lock",
1744                 .handler = stm32x_handle_lock_command,
1745                 .mode = COMMAND_EXEC,
1746                 .usage = "bank_id",
1747                 .help = "Lock entire flash device.",
1748         },
1749         {
1750                 .name = "unlock",
1751                 .handler = stm32x_handle_unlock_command,
1752                 .mode = COMMAND_EXEC,
1753                 .usage = "bank_id",
1754                 .help = "Unlock entire protected flash device.",
1755         },
1756         {
1757                 .name = "mass_erase",
1758                 .handler = stm32x_handle_mass_erase_command,
1759                 .mode = COMMAND_EXEC,
1760                 .usage = "bank_id",
1761                 .help = "Erase entire flash device.",
1762         },
1763         {
1764                 .name = "options_read",
1765                 .handler = stm32f2x_handle_options_read_command,
1766                 .mode = COMMAND_EXEC,
1767                 .usage = "bank_id",
1768                 .help = "Read and display device option bytes.",
1769         },
1770         {
1771                 .name = "options_write",
1772                 .handler = stm32f2x_handle_options_write_command,
1773                 .mode = COMMAND_EXEC,
1774                 .usage = "bank_id user_options [ boot_add0 boot_add1 ]",
1775                 .help = "Write option bytes",
1776         },
1777         {
1778                 .name = "optcr2_write",
1779                 .handler = stm32f2x_handle_optcr2_write_command,
1780                 .mode = COMMAND_EXEC,
1781                 .usage = "bank_id optcr2",
1782                 .help = "Write optcr2 word",
1783         },
1784         {
1785                 .name = "otp",
1786                 .handler = stm32x_handle_otp_command,
1787                 .mode = COMMAND_EXEC,
1788                 .usage = "bank_id",
1789                 .help = "OTP (One Time Programmable) memory write enable/disable.",
1790         },
1791         COMMAND_REGISTRATION_DONE
1792 };
1793
1794 static const struct command_registration stm32f2x_command_handlers[] = {
1795         {
1796                 .name = "stm32f2x",
1797                 .mode = COMMAND_ANY,
1798                 .help = "stm32f2x flash command group",
1799                 .usage = "",
1800                 .chain = stm32f2x_exec_command_handlers,
1801         },
1802         COMMAND_REGISTRATION_DONE
1803 };
1804
1805 const struct flash_driver stm32f2x_flash = {
1806         .name = "stm32f2x",
1807         .commands = stm32f2x_command_handlers,
1808         .flash_bank_command = stm32x_flash_bank_command,
1809         .erase = stm32x_erase,
1810         .protect = stm32x_protect,
1811         .write = stm32x_write,
1812         .read = default_flash_read,
1813         .probe = stm32x_probe,
1814         .auto_probe = stm32x_auto_probe,
1815         .erase_check = default_flash_blank_check,
1816         .protect_check = stm32x_protect_check,
1817         .info = get_stm32x_info,
1818         .free_driver_priv = default_flash_free_driver_priv,
1819 };