You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

1129 lines
31KB

  1. /***************************************************************************
  2. * Copyright (C) 2005 by Dominic Rath *
  3. * Dominic.Rath@gmx.de *
  4. * *
  5. * Copyright (C) 2008 by Spencer Oliver *
  6. * spen@spen-soft.co.uk *
  7. * *
  8. * Copyright (C) 2011 Øyvind Harboe *
  9. * oyvind.harboe@zylin.com *
  10. * *
  11. * This program is free software; you can redistribute it and/or modify *
  12. * it under the terms of the GNU General Public License as published by *
  13. * the Free Software Foundation; either version 2 of the License, or *
  14. * (at your option) any later version. *
  15. * *
  16. * This program is distributed in the hope that it will be useful, *
  17. * but WITHOUT ANY WARRANTY; without even the implied warranty of *
  18. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
  19. * GNU General Public License for more details. *
  20. * *
  21. * You should have received a copy of the GNU General Public License *
  22. * along with this program; if not, write to the *
  23. * Free Software Foundation, Inc., *
  24. * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *
  25. ***************************************************************************/
  26. #ifdef HAVE_CONFIG_H
  27. #include "config.h"
  28. #endif
  29. #include "imp.h"
  30. #include <helper/binarybuffer.h>
  31. #include <target/algorithm.h>
  32. #include <target/armv7m.h>
  33. /* Regarding performance:
  34. *
  35. * Short story - it might be best to leave the performance at
  36. * current levels.
  37. *
  38. * You may see a jump in speed if you change to using
  39. * 32bit words for the block programming.
  40. *
  41. * Its a shame you cannot use the double word as its
  42. * even faster - but you require external VPP for that mode.
  43. *
  44. * Having said all that 16bit writes give us the widest vdd
  45. * operating range, so may be worth adding a note to that effect.
  46. *
  47. */
  48. /* Danger!!!! The STM32F1x and STM32F2x series actually have
  49. * quite different flash controllers.
  50. *
  51. * What's more scary is that the names of the registers and their
  52. * addresses are the same, but the actual bits and what they do are
  53. * can be very different.
  54. *
  55. * To reduce testing complexity and dangers of regressions,
  56. * a seperate file is used for stm32fx2x.
  57. *
  58. * 1mByte part with 4 x 16, 1 x 64, 7 x 128kBytes sectors
  59. *
  60. * What's the protection page size???
  61. *
  62. * Tested with STM3220F-EVAL board.
  63. *
  64. * STM32F21xx series for reference.
  65. *
  66. * RM0033
  67. * http://www.st.com/internet/mcu/product/250192.jsp
  68. *
  69. * PM0059
  70. * www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/
  71. * PROGRAMMING_MANUAL/CD00233952.pdf
  72. *
  73. * STM32F1x series - notice that this code was copy, pasted and knocked
  74. * into a stm32f2x driver, so in case something has been converted or
  75. * bugs haven't been fixed, here are the original manuals:
  76. *
  77. * RM0008 - Reference manual
  78. *
  79. * RM0042, the Flash programming manual for low-, medium- high-density and
  80. * connectivity line STM32F10x devices
  81. *
  82. * PM0068, the Flash programming manual for XL-density STM32F10x devices.
  83. *
  84. */
  85. /* Erase time can be as high as 1000ms, 10x this and it's toast... */
  86. #define FLASH_ERASE_TIMEOUT 10000
  87. #define FLASH_WRITE_TIMEOUT 5
  88. #define STM32_FLASH_BASE 0x40023c00
  89. #define STM32_FLASH_ACR 0x40023c00
  90. #define STM32_FLASH_KEYR 0x40023c04
  91. #define STM32_FLASH_OPTKEYR 0x40023c08
  92. #define STM32_FLASH_SR 0x40023c0C
  93. #define STM32_FLASH_CR 0x40023c10
  94. #define STM32_FLASH_OPTCR 0x40023c14
  95. #define STM32_FLASH_OPTCR1 0x40023c18
  96. /* FLASH_CR register bits */
  97. #define FLASH_PG (1 << 0)
  98. #define FLASH_SER (1 << 1)
  99. #define FLASH_MER (1 << 2)
  100. #define FLASH_MER1 (1 << 15)
  101. #define FLASH_STRT (1 << 16)
  102. #define FLASH_PSIZE_8 (0 << 8)
  103. #define FLASH_PSIZE_16 (1 << 8)
  104. #define FLASH_PSIZE_32 (2 << 8)
  105. #define FLASH_PSIZE_64 (3 << 8)
  106. #define FLASH_SNB(a) ((a) << 3)
  107. #define FLASH_LOCK (1 << 31)
  108. /* FLASH_SR register bits */
  109. #define FLASH_BSY (1 << 16)
  110. #define FLASH_PGSERR (1 << 7) /* Programming sequence error */
  111. #define FLASH_PGPERR (1 << 6) /* Programming parallelism error */
  112. #define FLASH_PGAERR (1 << 5) /* Programming alignment error */
  113. #define FLASH_WRPERR (1 << 4) /* Write protection error */
  114. #define FLASH_OPERR (1 << 1) /* Operation error */
  115. #define FLASH_ERROR (FLASH_PGSERR | FLASH_PGPERR | FLASH_PGAERR | FLASH_WRPERR | FLASH_OPERR)
  116. /* STM32_FLASH_OPTCR register bits */
  117. #define OPT_LOCK (1 << 0)
  118. #define OPT_START (1 << 1)
  119. /* STM32_FLASH_OBR bit definitions (reading) */
  120. #define OPT_ERROR 0
  121. #define OPT_READOUT 1
  122. #define OPT_RDWDGSW 2
  123. #define OPT_RDRSTSTOP 3
  124. #define OPT_RDRSTSTDBY 4
  125. #define OPT_BFB2 5 /* dual flash bank only */
  126. /* register unlock keys */
  127. #define KEY1 0x45670123
  128. #define KEY2 0xCDEF89AB
  129. /* option register unlock key */
  130. #define OPTKEY1 0x08192A3B
  131. #define OPTKEY2 0x4C5D6E7F
  132. struct stm32x_options {
  133. uint8_t RDP;
  134. uint8_t user_options;
  135. uint32_t protection;
  136. };
  137. struct stm32x_flash_bank {
  138. struct stm32x_options option_bytes;
  139. int probed;
  140. bool has_large_mem; /* stm32f42x/stm32f43x family */
  141. uint32_t user_bank_size;
  142. };
  143. /* flash bank stm32x <base> <size> 0 0 <target#>
  144. */
  145. FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
  146. {
  147. struct stm32x_flash_bank *stm32x_info;
  148. if (CMD_ARGC < 6)
  149. return ERROR_COMMAND_SYNTAX_ERROR;
  150. stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
  151. bank->driver_priv = stm32x_info;
  152. stm32x_info->probed = 0;
  153. stm32x_info->user_bank_size = bank->size;
  154. return ERROR_OK;
  155. }
  156. static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
  157. {
  158. return reg;
  159. }
  160. static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
  161. {
  162. struct target *target = bank->target;
  163. return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
  164. }
  165. static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
  166. {
  167. struct target *target = bank->target;
  168. uint32_t status;
  169. int retval = ERROR_OK;
  170. /* wait for busy to clear */
  171. for (;;) {
  172. retval = stm32x_get_flash_status(bank, &status);
  173. if (retval != ERROR_OK)
  174. return retval;
  175. LOG_DEBUG("status: 0x%" PRIx32 "", status);
  176. if ((status & FLASH_BSY) == 0)
  177. break;
  178. if (timeout-- <= 0) {
  179. LOG_ERROR("timed out waiting for flash");
  180. return ERROR_FAIL;
  181. }
  182. alive_sleep(1);
  183. }
  184. if (status & FLASH_WRPERR) {
  185. LOG_ERROR("stm32x device protected");
  186. retval = ERROR_FAIL;
  187. }
  188. /* Clear but report errors */
  189. if (status & FLASH_ERROR) {
  190. /* If this operation fails, we ignore it and report the original
  191. * retval
  192. */
  193. target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
  194. status & FLASH_ERROR);
  195. }
  196. return retval;
  197. }
  198. static int stm32x_unlock_reg(struct target *target)
  199. {
  200. uint32_t ctrl;
  201. /* first check if not already unlocked
  202. * otherwise writing on STM32_FLASH_KEYR will fail
  203. */
  204. int retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
  205. if (retval != ERROR_OK)
  206. return retval;
  207. if ((ctrl & FLASH_LOCK) == 0)
  208. return ERROR_OK;
  209. /* unlock flash registers */
  210. retval = target_write_u32(target, STM32_FLASH_KEYR, KEY1);
  211. if (retval != ERROR_OK)
  212. return retval;
  213. retval = target_write_u32(target, STM32_FLASH_KEYR, KEY2);
  214. if (retval != ERROR_OK)
  215. return retval;
  216. retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
  217. if (retval != ERROR_OK)
  218. return retval;
  219. if (ctrl & FLASH_LOCK) {
  220. LOG_ERROR("flash not unlocked STM32_FLASH_CR: %x", ctrl);
  221. return ERROR_TARGET_FAILURE;
  222. }
  223. return ERROR_OK;
  224. }
  225. static int stm32x_unlock_option_reg(struct target *target)
  226. {
  227. uint32_t ctrl;
  228. int retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
  229. if (retval != ERROR_OK)
  230. return retval;
  231. if ((ctrl & OPT_LOCK) == 0)
  232. return ERROR_OK;
  233. /* unlock option registers */
  234. retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY1);
  235. if (retval != ERROR_OK)
  236. return retval;
  237. retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY2);
  238. if (retval != ERROR_OK)
  239. return retval;
  240. retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
  241. if (retval != ERROR_OK)
  242. return retval;
  243. if (ctrl & OPT_LOCK) {
  244. LOG_ERROR("options not unlocked STM32_FLASH_OPTCR: %x", ctrl);
  245. return ERROR_TARGET_FAILURE;
  246. }
  247. return ERROR_OK;
  248. }
  249. static int stm32x_read_options(struct flash_bank *bank)
  250. {
  251. uint32_t optiondata;
  252. struct stm32x_flash_bank *stm32x_info = NULL;
  253. struct target *target = bank->target;
  254. stm32x_info = bank->driver_priv;
  255. /* read current option bytes */
  256. int retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
  257. if (retval != ERROR_OK)
  258. return retval;
  259. stm32x_info->option_bytes.user_options = optiondata & 0xec;
  260. stm32x_info->option_bytes.RDP = (optiondata >> 8) & 0xff;
  261. stm32x_info->option_bytes.protection = (optiondata >> 16) & 0xfff;
  262. if (stm32x_info->has_large_mem) {
  263. retval = target_read_u32(target, STM32_FLASH_OPTCR1, &optiondata);
  264. if (retval != ERROR_OK)
  265. return retval;
  266. /* append protection bits */
  267. stm32x_info->option_bytes.protection |= (optiondata >> 4) & 0x00fff000;
  268. }
  269. if (stm32x_info->option_bytes.RDP != 0xAA)
  270. LOG_INFO("Device Security Bit Set");
  271. return ERROR_OK;
  272. }
  273. static int stm32x_write_options(struct flash_bank *bank)
  274. {
  275. struct stm32x_flash_bank *stm32x_info = NULL;
  276. struct target *target = bank->target;
  277. uint32_t optiondata;
  278. stm32x_info = bank->driver_priv;
  279. int retval = stm32x_unlock_option_reg(target);
  280. if (retval != ERROR_OK)
  281. return retval;
  282. /* rebuild option data */
  283. optiondata = stm32x_info->option_bytes.user_options;
  284. buf_set_u32(&optiondata, 8, 8, stm32x_info->option_bytes.RDP);
  285. buf_set_u32(&optiondata, 16, 12, stm32x_info->option_bytes.protection);
  286. /* program options */
  287. retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata);
  288. if (retval != ERROR_OK)
  289. return retval;
  290. if (stm32x_info->has_large_mem) {
  291. uint32_t optiondata2 = 0;
  292. buf_set_u32(&optiondata2, 16, 12, stm32x_info->option_bytes.protection >> 12);
  293. retval = target_write_u32(target, STM32_FLASH_OPTCR1, optiondata2);
  294. if (retval != ERROR_OK)
  295. return retval;
  296. }
  297. /* start programming cycle */
  298. retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPT_START);
  299. if (retval != ERROR_OK)
  300. return retval;
  301. /* wait for completion */
  302. retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
  303. if (retval != ERROR_OK)
  304. return retval;
  305. /* relock registers */
  306. retval = target_write_u32(target, STM32_FLASH_OPTCR, OPT_LOCK);
  307. if (retval != ERROR_OK)
  308. return retval;
  309. return ERROR_OK;
  310. }
  311. static int stm32x_protect_check(struct flash_bank *bank)
  312. {
  313. struct target *target = bank->target;
  314. struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
  315. if (target->state != TARGET_HALTED) {
  316. LOG_ERROR("Target not halted");
  317. return ERROR_TARGET_NOT_HALTED;
  318. }
  319. /* read write protection settings */
  320. int retval = stm32x_read_options(bank);
  321. if (retval != ERROR_OK) {
  322. LOG_DEBUG("unable to read option bytes");
  323. return retval;
  324. }
  325. for (int i = 0; i < bank->num_sectors; i++) {
  326. if (stm32x_info->option_bytes.protection & (1 << i))
  327. bank->sectors[i].is_protected = 0;
  328. else
  329. bank->sectors[i].is_protected = 1;
  330. }
  331. return ERROR_OK;
  332. }
  333. static int stm32x_erase(struct flash_bank *bank, int first, int last)
  334. {
  335. struct target *target = bank->target;
  336. int i;
  337. if (bank->target->state != TARGET_HALTED) {
  338. LOG_ERROR("Target not halted");
  339. return ERROR_TARGET_NOT_HALTED;
  340. }
  341. int retval;
  342. retval = stm32x_unlock_reg(target);
  343. if (retval != ERROR_OK)
  344. return retval;
  345. /*
  346. Sector Erase
  347. To erase a sector, follow the procedure below:
  348. 1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
  349. FLASH_SR register
  350. 2. Set the SER bit and select the sector (out of the 12 sectors in the main memory block)
  351. you wish to erase (SNB) in the FLASH_CR register
  352. 3. Set the STRT bit in the FLASH_CR register
  353. 4. Wait for the BSY bit to be cleared
  354. */
  355. for (i = first; i <= last; i++) {
  356. retval = target_write_u32(target,
  357. stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_SER | FLASH_SNB(i) | FLASH_STRT);
  358. if (retval != ERROR_OK)
  359. return retval;
  360. retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
  361. if (retval != ERROR_OK)
  362. return retval;
  363. bank->sectors[i].is_erased = 1;
  364. }
  365. retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
  366. if (retval != ERROR_OK)
  367. return retval;
  368. return ERROR_OK;
  369. }
  370. static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
  371. {
  372. struct target *target = bank->target;
  373. struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
  374. if (target->state != TARGET_HALTED) {
  375. LOG_ERROR("Target not halted");
  376. return ERROR_TARGET_NOT_HALTED;
  377. }
  378. /* read protection settings */
  379. int retval = stm32x_read_options(bank);
  380. if (retval != ERROR_OK) {
  381. LOG_DEBUG("unable to read option bytes");
  382. return retval;
  383. }
  384. for (int i = first; i <= last; i++) {
  385. if (set)
  386. stm32x_info->option_bytes.protection &= ~(1 << i);
  387. else
  388. stm32x_info->option_bytes.protection |= (1 << i);
  389. }
  390. retval = stm32x_write_options(bank);
  391. if (retval != ERROR_OK)
  392. return retval;
  393. return ERROR_OK;
  394. }
  395. static int stm32x_write_block(struct flash_bank *bank, uint8_t *buffer,
  396. uint32_t offset, uint32_t count)
  397. {
  398. struct target *target = bank->target;
  399. uint32_t buffer_size = 16384;
  400. struct working_area *write_algorithm;
  401. struct working_area *source;
  402. uint32_t address = bank->base + offset;
  403. struct reg_param reg_params[5];
  404. struct armv7m_algorithm armv7m_info;
  405. int retval = ERROR_OK;
  406. /* see contrib/loaders/flash/stm32f2x.S for src */
  407. static const uint8_t stm32x_flash_write_code[] = {
  408. /* wait_fifo: */
  409. 0xD0, 0xF8, 0x00, 0x80, /* ldr r8, [r0, #0] */
  410. 0xB8, 0xF1, 0x00, 0x0F, /* cmp r8, #0 */
  411. 0x1A, 0xD0, /* beq exit */
  412. 0x47, 0x68, /* ldr r7, [r0, #4] */
  413. 0x47, 0x45, /* cmp r7, r8 */
  414. 0xF7, 0xD0, /* beq wait_fifo */
  415. 0xDF, 0xF8, 0x30, 0x60, /* ldr r6, STM32_PROG16 */
  416. 0x26, 0x61, /* str r6, [r4, #STM32_FLASH_CR_OFFSET] */
  417. 0x37, 0xF8, 0x02, 0x6B, /* ldrh r6, [r7], #0x02 */
  418. 0x22, 0xF8, 0x02, 0x6B, /* strh r6, [r2], #0x02 */
  419. /* busy: */
  420. 0xE6, 0x68, /* ldr r6, [r4, #STM32_FLASH_SR_OFFSET] */
  421. 0x16, 0xF4, 0x80, 0x3F, /* tst r6, #0x10000 */
  422. 0xFB, 0xD1, /* bne busy */
  423. 0x16, 0xF0, 0xF0, 0x0F, /* tst r6, #0xf0 */
  424. 0x07, 0xD1, /* bne error */
  425. 0x8F, 0x42, /* cmp r7, r1 */
  426. 0x28, 0xBF, /* it cs */
  427. 0x00, 0xF1, 0x08, 0x07, /* addcs r7, r0, #8 */
  428. 0x47, 0x60, /* str r7, [r0, #4] */
  429. 0x01, 0x3B, /* subs r3, r3, #1 */
  430. 0x13, 0xB1, /* cbz r3, exit */
  431. 0xE1, 0xE7, /* b wait_fifo */
  432. /* error: */
  433. 0x00, 0x21, /* movs r1, #0 */
  434. 0x41, 0x60, /* str r1, [r0, #4] */
  435. /* exit: */
  436. 0x30, 0x46, /* mov r0, r6 */
  437. 0x00, 0xBE, /* bkpt #0x00 */
  438. /* <STM32_PROG16>: */
  439. 0x01, 0x01, 0x00, 0x00, /* .word 0x00000101 */
  440. };
  441. if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
  442. &write_algorithm) != ERROR_OK) {
  443. LOG_WARNING("no working area available, can't do block memory writes");
  444. return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
  445. };
  446. retval = target_write_buffer(target, write_algorithm->address,
  447. sizeof(stm32x_flash_write_code),
  448. (uint8_t *)stm32x_flash_write_code);
  449. if (retval != ERROR_OK)
  450. return retval;
  451. /* memory buffer */
  452. while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
  453. buffer_size /= 2;
  454. if (buffer_size <= 256) {
  455. /* we already allocated the writing code, but failed to get a
  456. * buffer, free the algorithm */
  457. target_free_working_area(target, write_algorithm);
  458. LOG_WARNING("no large enough working area available, can't do block memory writes");
  459. return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
  460. }
  461. };
  462. armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
  463. armv7m_info.core_mode = ARM_MODE_THREAD;
  464. init_reg_param(&reg_params[0], "r0", 32, PARAM_IN_OUT); /* buffer start, status (out) */
  465. init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT); /* buffer end */
  466. init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT); /* target address */
  467. init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT); /* count (halfword-16bit) */
  468. init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT); /* flash base */
  469. buf_set_u32(reg_params[0].value, 0, 32, source->address);
  470. buf_set_u32(reg_params[1].value, 0, 32, source->address + source->size);
  471. buf_set_u32(reg_params[2].value, 0, 32, address);
  472. buf_set_u32(reg_params[3].value, 0, 32, count);
  473. buf_set_u32(reg_params[4].value, 0, 32, STM32_FLASH_BASE);
  474. retval = target_run_flash_async_algorithm(target, buffer, count, 2,
  475. 0, NULL,
  476. 5, reg_params,
  477. source->address, source->size,
  478. write_algorithm->address, 0,
  479. &armv7m_info);
  480. if (retval == ERROR_FLASH_OPERATION_FAILED) {
  481. LOG_ERROR("error executing stm32x flash write algorithm");
  482. uint32_t error = buf_get_u32(reg_params[0].value, 0, 32) & FLASH_ERROR;
  483. if (error & FLASH_WRPERR)
  484. LOG_ERROR("flash memory write protected");
  485. if (error != 0) {
  486. LOG_ERROR("flash write failed = %08x", error);
  487. /* Clear but report errors */
  488. target_write_u32(target, STM32_FLASH_SR, error);
  489. retval = ERROR_FAIL;
  490. }
  491. }
  492. target_free_working_area(target, source);
  493. target_free_working_area(target, write_algorithm);
  494. destroy_reg_param(&reg_params[0]);
  495. destroy_reg_param(&reg_params[1]);
  496. destroy_reg_param(&reg_params[2]);
  497. destroy_reg_param(&reg_params[3]);
  498. destroy_reg_param(&reg_params[4]);
  499. return retval;
  500. }
  501. static int stm32x_write(struct flash_bank *bank, uint8_t *buffer,
  502. uint32_t offset, uint32_t count)
  503. {
  504. struct target *target = bank->target;
  505. uint32_t words_remaining = (count / 2);
  506. uint32_t bytes_remaining = (count & 0x00000001);
  507. uint32_t address = bank->base + offset;
  508. uint32_t bytes_written = 0;
  509. int retval;
  510. if (bank->target->state != TARGET_HALTED) {
  511. LOG_ERROR("Target not halted");
  512. return ERROR_TARGET_NOT_HALTED;
  513. }
  514. if (offset & 0x1) {
  515. LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
  516. return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
  517. }
  518. retval = stm32x_unlock_reg(target);
  519. if (retval != ERROR_OK)
  520. return retval;
  521. /* multiple half words (2-byte) to be programmed? */
  522. if (words_remaining > 0) {
  523. /* try using a block write */
  524. retval = stm32x_write_block(bank, buffer, offset, words_remaining);
  525. if (retval != ERROR_OK) {
  526. if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
  527. /* if block write failed (no sufficient working area),
  528. * we use normal (slow) single dword accesses */
  529. LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
  530. }
  531. } else {
  532. buffer += words_remaining * 2;
  533. address += words_remaining * 2;
  534. words_remaining = 0;
  535. }
  536. }
  537. if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
  538. return retval;
  539. /*
  540. Standard programming
  541. The Flash memory programming sequence is as follows:
  542. 1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
  543. FLASH_SR register.
  544. 2. Set the PG bit in the FLASH_CR register
  545. 3. Perform the data write operation(s) to the desired memory address (inside main
  546. memory block or OTP area):
  547. – – Half-word access in case of x16 parallelism
  548. – Word access in case of x32 parallelism
  549. 4.
  550. Byte access in case of x8 parallelism
  551. Double word access in case of x64 parallelism
  552. Wait for the BSY bit to be cleared
  553. */
  554. while (words_remaining > 0) {
  555. uint16_t value;
  556. memcpy(&value, buffer + bytes_written, sizeof(uint16_t));
  557. retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
  558. FLASH_PG | FLASH_PSIZE_16);
  559. if (retval != ERROR_OK)
  560. return retval;
  561. retval = target_write_u16(target, address, value);
  562. if (retval != ERROR_OK)
  563. return retval;
  564. retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
  565. if (retval != ERROR_OK)
  566. return retval;
  567. bytes_written += 2;
  568. words_remaining--;
  569. address += 2;
  570. }
  571. if (bytes_remaining) {
  572. retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
  573. FLASH_PG | FLASH_PSIZE_8);
  574. if (retval != ERROR_OK)
  575. return retval;
  576. retval = target_write_u8(target, address, buffer[bytes_written]);
  577. if (retval != ERROR_OK)
  578. return retval;
  579. retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
  580. if (retval != ERROR_OK)
  581. return retval;
  582. }
  583. return target_write_u32(target, STM32_FLASH_CR, FLASH_LOCK);
  584. }
  585. static void setup_sector(struct flash_bank *bank, int start, int num, int size)
  586. {
  587. for (int i = start; i < (start + num) ; i++) {
  588. bank->sectors[i].offset = bank->size;
  589. bank->sectors[i].size = size;
  590. bank->size += bank->sectors[i].size;
  591. }
  592. }
  593. static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
  594. {
  595. /* this checks for a stm32f4x errata issue where a
  596. * stm32f2x DBGMCU_IDCODE is incorrectly returned.
  597. * If the issue is detected target is forced to stm32f4x Rev A.
  598. * Only effects Rev A silicon */
  599. struct target *target = bank->target;
  600. uint32_t cpuid;
  601. /* read stm32 device id register */
  602. int retval = target_read_u32(target, 0xE0042000, device_id);
  603. if (retval != ERROR_OK)
  604. return retval;
  605. if ((*device_id & 0xfff) == 0x411) {
  606. /* read CPUID reg to check core type */
  607. retval = target_read_u32(target, 0xE000ED00, &cpuid);
  608. if (retval != ERROR_OK)
  609. return retval;
  610. /* check for cortex_m4 */
  611. if (((cpuid >> 4) & 0xFFF) == 0xC24) {
  612. *device_id &= ~((0xFFFF << 16) | 0xfff);
  613. *device_id |= (0x1000 << 16) | 0x413;
  614. LOG_INFO("stm32f4x errata detected - fixing incorrect MCU_IDCODE");
  615. }
  616. }
  617. return retval;
  618. }
  619. static int stm32x_probe(struct flash_bank *bank)
  620. {
  621. struct target *target = bank->target;
  622. struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
  623. int i;
  624. uint16_t flash_size_in_kb;
  625. uint16_t max_flash_size_in_kb;
  626. uint32_t device_id;
  627. uint32_t base_address = 0x08000000;
  628. stm32x_info->probed = 0;
  629. stm32x_info->has_large_mem = false;
  630. /* read stm32 device id register */
  631. int retval = stm32x_get_device_id(bank, &device_id);
  632. if (retval != ERROR_OK)
  633. return retval;
  634. LOG_INFO("device id = 0x%08" PRIx32 "", device_id);
  635. /* set max flash size depending on family */
  636. switch (device_id & 0xfff) {
  637. case 0x411:
  638. case 0x413:
  639. max_flash_size_in_kb = 1024;
  640. break;
  641. case 0x419:
  642. max_flash_size_in_kb = 2048;
  643. stm32x_info->has_large_mem = true;
  644. break;
  645. default:
  646. LOG_WARNING("Cannot identify target as a STM32 family.");
  647. return ERROR_FAIL;
  648. }
  649. /* get flash size from target. */
  650. retval = target_read_u16(target, 0x1FFF7A22, &flash_size_in_kb);
  651. /* failed reading flash size or flash size invalid (early silicon),
  652. * default to max target family */
  653. if (retval != ERROR_OK || flash_size_in_kb == 0xffff || flash_size_in_kb == 0) {
  654. LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming %dk flash",
  655. max_flash_size_in_kb);
  656. flash_size_in_kb = max_flash_size_in_kb;
  657. }
  658. /* if the user sets the size manually then ignore the probed value
  659. * this allows us to work around devices that have a invalid flash size register value */
  660. if (stm32x_info->user_bank_size) {
  661. LOG_INFO("ignoring flash probed value, using configured bank size");
  662. flash_size_in_kb = stm32x_info->user_bank_size / 1024;
  663. }
  664. LOG_INFO("flash size = %dkbytes", flash_size_in_kb);
  665. /* did we assign flash size? */
  666. assert(flash_size_in_kb != 0xffff);
  667. /* calculate numbers of pages */
  668. int num_pages = (flash_size_in_kb / 128) + 4;
  669. /* check for larger 2048 bytes devices */
  670. if (stm32x_info->has_large_mem)
  671. num_pages += 4;
  672. /* check that calculation result makes sense */
  673. assert(num_pages > 0);
  674. if (bank->sectors) {
  675. free(bank->sectors);
  676. bank->sectors = NULL;
  677. }
  678. bank->base = base_address;
  679. bank->num_sectors = num_pages;
  680. bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
  681. bank->size = 0;
  682. /* fixed memory */
  683. setup_sector(bank, 0, 4, 16 * 1024);
  684. setup_sector(bank, 4, 1, 64 * 1024);
  685. /* dynamic memory */
  686. setup_sector(bank, 4 + 1, MAX(12, num_pages) - 5, 128 * 1024);
  687. if (stm32x_info->has_large_mem) {
  688. /* fixed memory for larger devices */
  689. setup_sector(bank, 12, 4, 16 * 1024);
  690. setup_sector(bank, 16, 1, 64 * 1024);
  691. /* dynamic memory for larger devices */
  692. setup_sector(bank, 16 + 1, num_pages - 5 - 12, 128 * 1024);
  693. }
  694. for (i = 0; i < num_pages; i++) {
  695. bank->sectors[i].is_erased = -1;
  696. bank->sectors[i].is_protected = 0;
  697. }
  698. stm32x_info->probed = 1;
  699. return ERROR_OK;
  700. }
  701. static int stm32x_auto_probe(struct flash_bank *bank)
  702. {
  703. struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
  704. if (stm32x_info->probed)
  705. return ERROR_OK;
  706. return stm32x_probe(bank);
  707. }
  708. static int get_stm32x_info(struct flash_bank *bank, char *buf, int buf_size)
  709. {
  710. uint32_t device_id;
  711. int printed;
  712. /* read stm32 device id register */
  713. int retval = stm32x_get_device_id(bank, &device_id);
  714. if (retval != ERROR_OK)
  715. return retval;
  716. if ((device_id & 0xfff) == 0x411) {
  717. printed = snprintf(buf, buf_size, "stm32f2x - Rev: ");
  718. buf += printed;
  719. buf_size -= printed;
  720. switch (device_id >> 16) {
  721. case 0x1000:
  722. snprintf(buf, buf_size, "A");
  723. break;
  724. case 0x2000:
  725. snprintf(buf, buf_size, "B");
  726. break;
  727. case 0x1001:
  728. snprintf(buf, buf_size, "Z");
  729. break;
  730. case 0x2001:
  731. snprintf(buf, buf_size, "Y");
  732. break;
  733. case 0x2003:
  734. snprintf(buf, buf_size, "X");
  735. break;
  736. default:
  737. snprintf(buf, buf_size, "unknown");
  738. break;
  739. }
  740. } else if (((device_id & 0xfff) == 0x413) ||
  741. ((device_id & 0xfff) == 0x419)) {
  742. printed = snprintf(buf, buf_size, "stm32f4x - Rev: ");
  743. buf += printed;
  744. buf_size -= printed;
  745. switch (device_id >> 16) {
  746. case 0x1000:
  747. snprintf(buf, buf_size, "A");
  748. break;
  749. case 0x1001:
  750. snprintf(buf, buf_size, "Z");
  751. break;
  752. default:
  753. snprintf(buf, buf_size, "unknown");
  754. break;
  755. }
  756. } else {
  757. snprintf(buf, buf_size, "Cannot identify target as a stm32x\n");
  758. return ERROR_FAIL;
  759. }
  760. return ERROR_OK;
  761. }
  762. COMMAND_HANDLER(stm32x_handle_lock_command)
  763. {
  764. struct target *target = NULL;
  765. struct stm32x_flash_bank *stm32x_info = NULL;
  766. if (CMD_ARGC < 1)
  767. return ERROR_COMMAND_SYNTAX_ERROR;
  768. struct flash_bank *bank;
  769. int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
  770. if (ERROR_OK != retval)
  771. return retval;
  772. stm32x_info = bank->driver_priv;
  773. target = bank->target;
  774. if (target->state != TARGET_HALTED) {
  775. LOG_ERROR("Target not halted");
  776. return ERROR_TARGET_NOT_HALTED;
  777. }
  778. if (stm32x_read_options(bank) != ERROR_OK) {
  779. command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
  780. return ERROR_OK;
  781. }
  782. /* set readout protection */
  783. stm32x_info->option_bytes.RDP = 0;
  784. if (stm32x_write_options(bank) != ERROR_OK) {
  785. command_print(CMD_CTX, "%s failed to lock device", bank->driver->name);
  786. return ERROR_OK;
  787. }
  788. command_print(CMD_CTX, "%s locked", bank->driver->name);
  789. return ERROR_OK;
  790. }
  791. COMMAND_HANDLER(stm32x_handle_unlock_command)
  792. {
  793. struct target *target = NULL;
  794. struct stm32x_flash_bank *stm32x_info = NULL;
  795. if (CMD_ARGC < 1)
  796. return ERROR_COMMAND_SYNTAX_ERROR;
  797. struct flash_bank *bank;
  798. int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
  799. if (ERROR_OK != retval)
  800. return retval;
  801. stm32x_info = bank->driver_priv;
  802. target = bank->target;
  803. if (target->state != TARGET_HALTED) {
  804. LOG_ERROR("Target not halted");
  805. return ERROR_TARGET_NOT_HALTED;
  806. }
  807. if (stm32x_read_options(bank) != ERROR_OK) {
  808. command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
  809. return ERROR_OK;
  810. }
  811. /* clear readout protection and complementary option bytes
  812. * this will also force a device unlock if set */
  813. stm32x_info->option_bytes.RDP = 0xAA;
  814. if (stm32x_write_options(bank) != ERROR_OK) {
  815. command_print(CMD_CTX, "%s failed to unlock device", bank->driver->name);
  816. return ERROR_OK;
  817. }
  818. command_print(CMD_CTX, "%s unlocked.\n"
  819. "INFO: a reset or power cycle is required "
  820. "for the new settings to take effect.", bank->driver->name);
  821. return ERROR_OK;
  822. }
  823. static int stm32x_mass_erase(struct flash_bank *bank)
  824. {
  825. int retval;
  826. struct target *target = bank->target;
  827. struct stm32x_flash_bank *stm32x_info = NULL;
  828. if (target->state != TARGET_HALTED) {
  829. LOG_ERROR("Target not halted");
  830. return ERROR_TARGET_NOT_HALTED;
  831. }
  832. stm32x_info = bank->driver_priv;
  833. retval = stm32x_unlock_reg(target);
  834. if (retval != ERROR_OK)
  835. return retval;
  836. /* mass erase flash memory */
  837. if (stm32x_info->has_large_mem)
  838. retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER | FLASH_MER1);
  839. else
  840. retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER);
  841. if (retval != ERROR_OK)
  842. return retval;
  843. retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
  844. FLASH_MER | FLASH_STRT);
  845. if (retval != ERROR_OK)
  846. return retval;
  847. retval = stm32x_wait_status_busy(bank, 30000);
  848. if (retval != ERROR_OK)
  849. return retval;
  850. retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
  851. if (retval != ERROR_OK)
  852. return retval;
  853. return ERROR_OK;
  854. }
  855. COMMAND_HANDLER(stm32x_handle_mass_erase_command)
  856. {
  857. int i;
  858. if (CMD_ARGC < 1) {
  859. command_print(CMD_CTX, "stm32x mass_erase <bank>");
  860. return ERROR_COMMAND_SYNTAX_ERROR;
  861. }
  862. struct flash_bank *bank;
  863. int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
  864. if (ERROR_OK != retval)
  865. return retval;
  866. retval = stm32x_mass_erase(bank);
  867. if (retval == ERROR_OK) {
  868. /* set all sectors as erased */
  869. for (i = 0; i < bank->num_sectors; i++)
  870. bank->sectors[i].is_erased = 1;
  871. command_print(CMD_CTX, "stm32x mass erase complete");
  872. } else {
  873. command_print(CMD_CTX, "stm32x mass erase failed");
  874. }
  875. return retval;
  876. }
  877. static const struct command_registration stm32x_exec_command_handlers[] = {
  878. {
  879. .name = "lock",
  880. .handler = stm32x_handle_lock_command,
  881. .mode = COMMAND_EXEC,
  882. .usage = "bank_id",
  883. .help = "Lock entire flash device.",
  884. },
  885. {
  886. .name = "unlock",
  887. .handler = stm32x_handle_unlock_command,
  888. .mode = COMMAND_EXEC,
  889. .usage = "bank_id",
  890. .help = "Unlock entire protected flash device.",
  891. },
  892. {
  893. .name = "mass_erase",
  894. .handler = stm32x_handle_mass_erase_command,
  895. .mode = COMMAND_EXEC,
  896. .usage = "bank_id",
  897. .help = "Erase entire flash device.",
  898. },
  899. COMMAND_REGISTRATION_DONE
  900. };
  901. static const struct command_registration stm32x_command_handlers[] = {
  902. {
  903. .name = "stm32f2x",
  904. .mode = COMMAND_ANY,
  905. .help = "stm32f2x flash command group",
  906. .usage = "",
  907. .chain = stm32x_exec_command_handlers,
  908. },
  909. COMMAND_REGISTRATION_DONE
  910. };
  911. struct flash_driver stm32f2x_flash = {
  912. .name = "stm32f2x",
  913. .commands = stm32x_command_handlers,
  914. .flash_bank_command = stm32x_flash_bank_command,
  915. .erase = stm32x_erase,
  916. .protect = stm32x_protect,
  917. .write = stm32x_write,
  918. .read = default_flash_read,
  919. .probe = stm32x_probe,
  920. .auto_probe = stm32x_auto_probe,
  921. .erase_check = default_flash_blank_check,
  922. .protect_check = stm32x_protect_check,
  923. .info = get_stm32x_info,
  924. };