?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
flash/nor: improved API of flash_driver.info & fixed buffer overruns
[openocd.git] / src / flash / nor / stm32f2x.c
blob44f06f4fde32a2d0d956395239eebbee5e5121ae
1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
4 * *
5 * Copyright (C) 2008 by Spencer Oliver *
6 * spen@spen-soft.co.uk *
7 * *
8 * Copyright (C) 2011 Øyvind Harboe *
9 * oyvind.harboe@zylin.com *
10 * *
11 * This program is free software; you can redistribute it and/or modify *
12 * it under the terms of the GNU General Public License as published by *
13 * the Free Software Foundation; either version 2 of the License, or *
14 * (at your option) any later version. *
15 * *
16 * This program is distributed in the hope that it will be useful, *
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
19 * GNU General Public License for more details. *
20 * *
21 * You should have received a copy of the GNU General Public License *
22 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
23 ***************************************************************************/
24
25 #ifdef HAVE_CONFIG_H
26 #include "config.h"
27 #endif
28
29 #include "imp.h"
30 #include <helper/binarybuffer.h>
31 #include <target/algorithm.h>
32 #include <target/armv7m.h>
33
34 /* Regarding performance:
35 *
36 * Short story - it might be best to leave the performance at
37 * current levels.
38 *
39 * You may see a jump in speed if you change to using
40 * 32bit words for the block programming.
41 *
42 * Its a shame you cannot use the double word as its
43 * even faster - but you require external VPP for that mode.
44 *
45 * Having said all that 16bit writes give us the widest vdd
46 * operating range, so may be worth adding a note to that effect.
47 *
48 */
49
50 /* Danger!!!! The STM32F1x and STM32F2x series actually have
51 * quite different flash controllers.
52 *
53 * What's more scary is that the names of the registers and their
54 * addresses are the same, but the actual bits and what they do are
55 * can be very different.
56 *
57 * To reduce testing complexity and dangers of regressions,
58 * a separate file is used for stm32fx2x.
59 *
60 * Sector sizes in kiBytes:
61 * 1 MiByte part with 4 x 16, 1 x 64, 7 x 128.
62 * 1.5 MiByte part with 4 x 16, 1 x 64, 11 x 128.
63 * 2 MiByte part with 4 x 16, 1 x 64, 7 x 128, 4 x 16, 1 x 64, 7 x 128.
64 * 1 MiByte STM32F42x/43x part with DB1M Option set:
65 * 4 x 16, 1 x 64, 3 x 128, 4 x 16, 1 x 64, 3 x 128.
66 *
67 * STM32F7[2|3]
68 * 512 kiByte part with 4 x 16, 1 x 64, 3 x 128.
69 *
70 * STM32F7[4|5]
71 * 1 MiByte part with 4 x 32, 1 x 128, 3 x 256.
72 *
73 * STM32F7[6|7]
74 * 1 MiByte part in single bank mode with 4 x 32, 1 x 128, 3 x 256.
75 * 1 MiByte part in dual-bank mode two banks with 4 x 16, 1 x 64, 3 x 128 each.
76 * 2 MiByte part in single-bank mode with 4 x 32, 1 x 128, 7 x 256.
77 * 2 MiByte part in dual-bank mode two banks with 4 x 16, 1 x 64, 7 x 128 each.
78 *
79 * Protection size is sector size.
80 *
81 * Tested with STM3220F-EVAL board.
82 *
83 * STM32F4xx series for reference.
84 *
85 * RM0090
86 * http://www.st.com/web/en/resource/technical/document/reference_manual/DM00031020.pdf
87 *
88 * PM0059
89 * www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/
90 * PROGRAMMING_MANUAL/CD00233952.pdf
91 *
92 * STM32F7xx series for reference.
93 *
94 * RM0385
95 * http://www.st.com/web/en/resource/technical/document/reference_manual/DM00124865.pdf
96 *
97 * RM0410
98 * http://www.st.com/resource/en/reference_manual/dm00224583.pdf
99 *
100 * RM0430
101 * http://www.st.com/resource/en/reference_manual/dm00305666.pdf
102 *
103 * RM0431
104 * http://www.st.com/resource/en/reference_manual/dm00305990.pdf
105 *
106 * STM32F1x series - notice that this code was copy, pasted and knocked
107 * into a stm32f2x driver, so in case something has been converted or
108 * bugs haven't been fixed, here are the original manuals:
109 *
110 * RM0008 - Reference manual
111 *
112 * RM0042, the Flash programming manual for low-, medium- high-density and
113 * connectivity line STM32F10x devices
114 *
115 * PM0068, the Flash programming manual for XL-density STM32F10x devices.
116 *
117 */
118
119 /* Erase time can be as high as 1000ms, 10x this and it's toast... */
120 #define FLASH_ERASE_TIMEOUT 10000
121 #define FLASH_WRITE_TIMEOUT 5
122
123 /* Mass erase time can be as high as 32 s in x8 mode. */
124 #define FLASH_MASS_ERASE_TIMEOUT 33000
125
126 #define FLASH_BANK_BASE 0x80000000
127
128 #define STM32F2_OTP_SIZE 512
129 #define STM32F2_OTP_SECTOR_SIZE 32
130 #define STM32F2_OTP_BANK_BASE 0x1fff7800
131 #define STM32F2_OTP_LOCK_BASE ((STM32F2_OTP_BANK_BASE) + (STM32F2_OTP_SIZE))
132
133 /* see RM0410 section 3.6 "One-time programmable bytes" */
134 #define STM32F7_OTP_SECTOR_SIZE 64
135 #define STM32F7_OTP_SIZE 1024
136 #define STM32F7_OTP_BANK_BASE 0x1ff0f000
137 #define STM32F7_OTP_LOCK_BASE ((STM32F7_OTP_BANK_BASE) + (STM32F7_OTP_SIZE))
138
139 #define STM32_FLASH_BASE 0x40023c00
140 #define STM32_FLASH_ACR 0x40023c00
141 #define STM32_FLASH_KEYR 0x40023c04
142 #define STM32_FLASH_OPTKEYR 0x40023c08
143 #define STM32_FLASH_SR 0x40023c0C
144 #define STM32_FLASH_CR 0x40023c10
145 #define STM32_FLASH_OPTCR 0x40023c14
146 #define STM32_FLASH_OPTCR1 0x40023c18
147 #define STM32_FLASH_OPTCR2 0x40023c1c
148
149 /* FLASH_CR register bits */
150 #define FLASH_PG (1 << 0)
151 #define FLASH_SER (1 << 1)
152 #define FLASH_MER (1 << 2) /* MER/MER1 for f76x/77x */
153 #define FLASH_MER1 (1 << 15) /* MER2 for f76x/77x, confusing ... */
154 #define FLASH_STRT (1 << 16)
155 #define FLASH_PSIZE_8 (0 << 8)
156 #define FLASH_PSIZE_16 (1 << 8)
157 #define FLASH_PSIZE_32 (2 << 8)
158 #define FLASH_PSIZE_64 (3 << 8)
159 /* The sector number encoding is not straight binary for dual bank flash. */
160 #define FLASH_SNB(a) ((a) << 3)
161 #define FLASH_LOCK (1 << 31)
162
163 /* FLASH_SR register bits */
164 #define FLASH_BSY (1 << 16)
165 #define FLASH_PGSERR (1 << 7) /* Programming sequence error */
166 #define FLASH_PGPERR (1 << 6) /* Programming parallelism error */
167 #define FLASH_PGAERR (1 << 5) /* Programming alignment error */
168 #define FLASH_WRPERR (1 << 4) /* Write protection error */
169 #define FLASH_OPERR (1 << 1) /* Operation error */
170
171 #define FLASH_ERROR (FLASH_PGSERR | FLASH_PGPERR | FLASH_PGAERR | FLASH_WRPERR | FLASH_OPERR)
172
173 /* STM32_FLASH_OPTCR register bits */
174 #define OPTCR_LOCK (1 << 0)
175 #define OPTCR_START (1 << 1)
176 #define OPTCR_NDBANK (1 << 29) /* not dual bank mode */
177 #define OPTCR_DB1M (1 << 30) /* 1 MiB devices dual flash bank option */
178 #define OPTCR_SPRMOD (1 << 31) /* switches PCROPi/nWPRi interpretation */
179
180 /* STM32_FLASH_OPTCR2 register bits */
181 #define OPTCR2_PCROP_RDP (1 << 31) /* erase PCROP zone when decreasing RDP */
182
183 /* register unlock keys */
184 #define KEY1 0x45670123
185 #define KEY2 0xCDEF89AB
186
187 /* option register unlock key */
188 #define OPTKEY1 0x08192A3B
189 #define OPTKEY2 0x4C5D6E7F
190
191 struct stm32x_options {
192 uint8_t RDP;
193 uint16_t user_options; /* bit 0-7 usual options, bit 8-11 extra options */
194 uint32_t protection;
195 uint32_t boot_addr;
196 uint32_t optcr2_pcrop;
197 };
198
199 struct stm32x_flash_bank {
200 struct stm32x_options option_bytes;
201 bool probed;
202 bool otp_unlocked;
203 bool has_large_mem; /* F42x/43x/469/479/7xx in dual bank mode */
204 bool has_extra_options; /* F42x/43x/469/479/7xx */
205 bool has_boot_addr; /* F7xx */
206 bool has_optcr2_pcrop; /* F72x/73x */
207 unsigned int protection_bits; /* F413/423 */
208 uint32_t user_bank_size;
209 };
210
211 static bool stm32x_is_otp(struct flash_bank *bank)
212 {
213 return bank->base == STM32F2_OTP_BANK_BASE ||
214 bank->base == STM32F7_OTP_BANK_BASE;
215 }
216
217 static bool stm32x_otp_is_f7(struct flash_bank *bank)
218 {
219 return bank->base == STM32F7_OTP_BANK_BASE;
220 }
221
222 static int stm32x_is_otp_unlocked(struct flash_bank *bank)
223 {
224 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
225
226 return stm32x_info->otp_unlocked;
227 }
228
229 static int stm32x_otp_disable(struct flash_bank *bank)
230 {
231 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
232
233 LOG_INFO("OTP memory bank #%u is disabled for write commands.",
234 bank->bank_number);
235 stm32x_info->otp_unlocked = false;
236 return ERROR_OK;
237 }
238
239 static int stm32x_otp_enable(struct flash_bank *bank)
240 {
241 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
242
243 if (!stm32x_info->otp_unlocked) {
244 LOG_INFO("OTP memory bank #%u is is enabled for write commands.",
245 bank->bank_number);
246 stm32x_info->otp_unlocked = true;
247 } else {
248 LOG_WARNING("OTP memory bank #%u is is already enabled for write commands.",
249 bank->bank_number);
250 }
251 return ERROR_OK;
252 }
253
254 /* flash bank stm32x <base> <size> 0 0 <target#>
255 */
256 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
257 {
258 struct stm32x_flash_bank *stm32x_info;
259
260 if (CMD_ARGC < 6)
261 return ERROR_COMMAND_SYNTAX_ERROR;
262
263 stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
264 bank->driver_priv = stm32x_info;
265
266 stm32x_info->probed = false;
267 stm32x_info->otp_unlocked = false;
268 stm32x_info->user_bank_size = bank->size;
269
270 return ERROR_OK;
271 }
272
273 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
274 {
275 return reg;
276 }
277
278 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
279 {
280 struct target *target = bank->target;
281 return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
282 }
283
284 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
285 {
286 struct target *target = bank->target;
287 uint32_t status;
288 int retval = ERROR_OK;
289
290 /* wait for busy to clear */
291 for (;;) {
292 retval = stm32x_get_flash_status(bank, &status);
293 if (retval != ERROR_OK)
294 return retval;
295 LOG_DEBUG("status: 0x%" PRIx32, status);
296 if ((status & FLASH_BSY) == 0)
297 break;
298 if (timeout-- <= 0) {
299 LOG_ERROR("timed out waiting for flash");
300 return ERROR_FAIL;
301 }
302 alive_sleep(1);
303 }
304
305
306 if (status & FLASH_WRPERR) {
307 LOG_ERROR("stm32x device protected");
308 retval = ERROR_FAIL;
309 }
310
311 /* Clear but report errors */
312 if (status & FLASH_ERROR) {
313 if (retval == ERROR_OK)
314 retval = ERROR_FAIL;
315 /* If this operation fails, we ignore it and report the original
316 * retval
317 */
318 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
319 status & FLASH_ERROR);
320 }
321 return retval;
322 }
323
324 static int stm32x_unlock_reg(struct target *target)
325 {
326 uint32_t ctrl;
327
328 /* first check if not already unlocked
329 * otherwise writing on STM32_FLASH_KEYR will fail
330 */
331 int retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
332 if (retval != ERROR_OK)
333 return retval;
334
335 if ((ctrl & FLASH_LOCK) == 0)
336 return ERROR_OK;
337
338 /* unlock flash registers */
339 retval = target_write_u32(target, STM32_FLASH_KEYR, KEY1);
340 if (retval != ERROR_OK)
341 return retval;
342
343 retval = target_write_u32(target, STM32_FLASH_KEYR, KEY2);
344 if (retval != ERROR_OK)
345 return retval;
346
347 retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
348 if (retval != ERROR_OK)
349 return retval;
350
351 if (ctrl & FLASH_LOCK) {
352 LOG_ERROR("flash not unlocked STM32_FLASH_CR: 0x%" PRIx32, ctrl);
353 return ERROR_TARGET_FAILURE;
354 }
355
356 return ERROR_OK;
357 }
358
359 static int stm32x_unlock_option_reg(struct target *target)
360 {
361 uint32_t ctrl;
362
363 int retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
364 if (retval != ERROR_OK)
365 return retval;
366
367 if ((ctrl & OPTCR_LOCK) == 0)
368 return ERROR_OK;
369
370 /* unlock option registers */
371 retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY1);
372 if (retval != ERROR_OK)
373 return retval;
374
375 retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY2);
376 if (retval != ERROR_OK)
377 return retval;
378
379 retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
380 if (retval != ERROR_OK)
381 return retval;
382
383 if (ctrl & OPTCR_LOCK) {
384 LOG_ERROR("options not unlocked STM32_FLASH_OPTCR: 0x%" PRIx32, ctrl);
385 return ERROR_TARGET_FAILURE;
386 }
387
388 return ERROR_OK;
389 }
390
391 static int stm32x_read_options(struct flash_bank *bank)
392 {
393 uint32_t optiondata;
394 struct stm32x_flash_bank *stm32x_info = NULL;
395 struct target *target = bank->target;
396
397 stm32x_info = bank->driver_priv;
398
399 /* read current option bytes */
400 int retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
401 if (retval != ERROR_OK)
402 return retval;
403
404 /* caution: F2 implements 5 bits (WDG_SW only)
405 * whereas F7 6 bits (IWDG_SW and WWDG_SW) in user_options */
406 stm32x_info->option_bytes.user_options = optiondata & 0xfc;
407 stm32x_info->option_bytes.RDP = (optiondata >> 8) & 0xff;
408 stm32x_info->option_bytes.protection =
409 (optiondata >> 16) & (~(0xffff << stm32x_info->protection_bits) & 0xffff);
410
411 if (stm32x_info->has_extra_options) {
412 /* F42x/43x/469/479 and 7xx have up to 4 bits of extra options */
413 stm32x_info->option_bytes.user_options |= (optiondata >> 20) &
414 ((0xf00 << (stm32x_info->protection_bits - 12)) & 0xf00);
415 }
416
417 if (stm32x_info->has_large_mem || stm32x_info->has_boot_addr) {
418 retval = target_read_u32(target, STM32_FLASH_OPTCR1, &optiondata);
419 if (retval != ERROR_OK)
420 return retval;
421
422 /* FLASH_OPTCR1 has quite different meanings ... */
423 if (stm32x_info->has_boot_addr) {
424 /* for F7xx it contains boot0 and boot1 */
425 stm32x_info->option_bytes.boot_addr = optiondata;
426 } else {
427 /* for F42x/43x/469/479 it contains 12 additional protection bits */
428 stm32x_info->option_bytes.protection |= (optiondata >> 4) & 0x00fff000;
429 }
430 }
431
432 if (stm32x_info->has_optcr2_pcrop) {
433 retval = target_read_u32(target, STM32_FLASH_OPTCR2, &optiondata);
434 if (retval != ERROR_OK)
435 return retval;
436
437 stm32x_info->option_bytes.optcr2_pcrop = optiondata;
438 if (stm32x_info->has_optcr2_pcrop &&
439 (stm32x_info->option_bytes.optcr2_pcrop & ~OPTCR2_PCROP_RDP)) {
440 LOG_INFO("PCROP Engaged");
441 }
442 } else {
443 stm32x_info->option_bytes.optcr2_pcrop = 0x0;
444 }
445
446 if (stm32x_info->option_bytes.RDP != 0xAA)
447 LOG_INFO("Device Security Bit Set");
448
449 return ERROR_OK;
450 }
451
452 static int stm32x_write_options(struct flash_bank *bank)
453 {
454 struct stm32x_flash_bank *stm32x_info = NULL;
455 struct target *target = bank->target;
456 uint32_t optiondata, optiondata2;
457
458 stm32x_info = bank->driver_priv;
459
460 int retval = stm32x_unlock_option_reg(target);
461 if (retval != ERROR_OK)
462 return retval;
463
464 /* rebuild option data */
465 optiondata = stm32x_info->option_bytes.user_options & 0xfc;
466 optiondata |= stm32x_info->option_bytes.RDP << 8;
467 optiondata |= (stm32x_info->option_bytes.protection &
468 (~(0xffff << stm32x_info->protection_bits))) << 16;
469
470 if (stm32x_info->has_extra_options) {
471 /* F42x/43x/469/479 and 7xx have up to 4 bits of extra options */
472 optiondata |= (stm32x_info->option_bytes.user_options &
473 ((0xf00 << (stm32x_info->protection_bits - 12)) & 0xf00)) << 20;
474 }
475
476 if (stm32x_info->has_large_mem || stm32x_info->has_boot_addr) {
477 if (stm32x_info->has_boot_addr) {
478 /* F7xx uses FLASH_OPTCR1 for boot0 and boot1 ... */
479 optiondata2 = stm32x_info->option_bytes.boot_addr;
480 } else {
481 /* F42x/43x/469/479 uses FLASH_OPTCR1 for additional protection bits */
482 optiondata2 = (stm32x_info->option_bytes.protection & 0x00fff000) << 4;
483 }
484
485 retval = target_write_u32(target, STM32_FLASH_OPTCR1, optiondata2);
486 if (retval != ERROR_OK)
487 return retval;
488 }
489
490 /* program extra pcrop register */
491 if (stm32x_info->has_optcr2_pcrop) {
492 retval = target_write_u32(target, STM32_FLASH_OPTCR2,
493 stm32x_info->option_bytes.optcr2_pcrop);
494 if (retval != ERROR_OK)
495 return retval;
496 }
497
498 /* program options */
499 retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata);
500 if (retval != ERROR_OK)
501 return retval;
502
503 /* start programming cycle */
504 retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPTCR_START);
505 if (retval != ERROR_OK)
506 return retval;
507
508 /* wait for completion, this might trigger a security erase and take a while */
509 retval = stm32x_wait_status_busy(bank, FLASH_MASS_ERASE_TIMEOUT);
510 if (retval != ERROR_OK)
511 return retval;
512
513 /* relock registers */
514 retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPTCR_LOCK);
515 if (retval != ERROR_OK)
516 return retval;
517
518 return ERROR_OK;
519 }
520
521 static int stm32x_otp_read_protect(struct flash_bank *bank)
522 {
523 struct target *target = bank->target;
524 uint32_t lock_base;
525 int retval;
526 uint8_t lock;
527
528 lock_base = stm32x_otp_is_f7(bank) ? STM32F7_OTP_LOCK_BASE
529 : STM32F2_OTP_LOCK_BASE;
530
531 for (unsigned int i = 0; i < bank->num_sectors; i++) {
532 retval = target_read_u8(target, lock_base + i, &lock);
533 if (retval != ERROR_OK)
534 return retval;
535 bank->sectors[i].is_protected = !lock;
536 }
537
538 return ERROR_OK;
539 }
540
541 static int stm32x_otp_protect(struct flash_bank *bank, unsigned int first,
542 unsigned int last)
543 {
544 struct target *target = bank->target;
545 uint32_t lock_base;
546 int i, retval;
547 uint8_t lock;
548
549 assert((first <= last) && (last < bank->num_sectors));
550
551 lock_base = stm32x_otp_is_f7(bank) ? STM32F7_OTP_LOCK_BASE
552 : STM32F2_OTP_LOCK_BASE;
553
554 for (i = first; first <= last; i++) {
555 retval = target_read_u8(target, lock_base + i, &lock);
556 if (retval != ERROR_OK)
557 return retval;
558 if (lock)
559 continue;
560
561 lock = 0xff;
562 retval = target_write_u8(target, lock_base + i, lock);
563 if (retval != ERROR_OK)
564 return retval;
565 }
566
567 return ERROR_OK;
568 }
569
570 static int stm32x_protect_check(struct flash_bank *bank)
571 {
572 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
573 struct flash_sector *prot_blocks;
574 unsigned int num_prot_blocks;
575 int retval;
576
577 /* if it's the OTP bank, look at the lock bits there */
578 if (stm32x_is_otp(bank))
579 return stm32x_otp_read_protect(bank);
580
581 /* read write protection settings */
582 retval = stm32x_read_options(bank);
583 if (retval != ERROR_OK) {
584 LOG_DEBUG("unable to read option bytes");
585 return retval;
586 }
587
588 if (bank->prot_blocks) {
589 num_prot_blocks = bank->num_prot_blocks;
590 prot_blocks = bank->prot_blocks;
591 } else {
592 num_prot_blocks = bank->num_sectors;
593 prot_blocks = bank->sectors;
594 }
595
596 for (unsigned int i = 0; i < num_prot_blocks; i++)
597 prot_blocks[i].is_protected =
598 ~(stm32x_info->option_bytes.protection >> i) & 1;
599
600 return ERROR_OK;
601 }
602
603 static int stm32x_erase(struct flash_bank *bank, unsigned int first,
604 unsigned int last)
605 {
606 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
607 struct target *target = bank->target;
608
609 if (stm32x_is_otp(bank)) {
610 LOG_ERROR("Cannot erase OTP memory");
611 return ERROR_FAIL;
612 }
613
614 assert((first <= last) && (last < bank->num_sectors));
615
616 if (bank->target->state != TARGET_HALTED) {
617 LOG_ERROR("Target not halted");
618 return ERROR_TARGET_NOT_HALTED;
619 }
620
621 int retval;
622 retval = stm32x_unlock_reg(target);
623 if (retval != ERROR_OK)
624 return retval;
625
626 /*
627 Sector Erase
628 To erase a sector, follow the procedure below:
629 1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
630 FLASH_SR register
631 2. Set the SER bit and select the sector
632 you wish to erase (SNB) in the FLASH_CR register
633 3. Set the STRT bit in the FLASH_CR register
634 4. Wait for the BSY bit to be cleared
635 */
636
637 for (unsigned int i = first; i <= last; i++) {
638 unsigned int snb;
639 if (stm32x_info->has_large_mem && i >= 12)
640 snb = (i - 12) | 0x10;
641 else
642 snb = i;
643
644 retval = target_write_u32(target,
645 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_SER | FLASH_SNB(snb) | FLASH_STRT);
646 if (retval != ERROR_OK)
647 return retval;
648
649 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
650 if (retval != ERROR_OK)
651 return retval;
652
653 bank->sectors[i].is_erased = 1;
654 }
655
656 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
657 if (retval != ERROR_OK)
658 return retval;
659
660 return ERROR_OK;
661 }
662
663 static int stm32x_protect(struct flash_bank *bank, int set, unsigned int first,
664 unsigned int last)
665 {
666 struct target *target = bank->target;
667 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
668
669 if (target->state != TARGET_HALTED) {
670 LOG_ERROR("Target not halted");
671 return ERROR_TARGET_NOT_HALTED;
672 }
673
674 if (stm32x_is_otp(bank)) {
675 if (!set)
676 return ERROR_COMMAND_ARGUMENT_INVALID;
677
678 return stm32x_otp_protect(bank, first, last);
679 }
680
681 /* read protection settings */
682 int retval = stm32x_read_options(bank);
683 if (retval != ERROR_OK) {
684 LOG_DEBUG("unable to read option bytes");
685 return retval;
686 }
687
688 for (unsigned int i = first; i <= last; i++) {
689 if (set)
690 stm32x_info->option_bytes.protection &= ~(1 << i);
691 else
692 stm32x_info->option_bytes.protection |= (1 << i);
693 }
694
695 retval = stm32x_write_options(bank);
696 if (retval != ERROR_OK)
697 return retval;
698
699 return ERROR_OK;
700 }
701
702 static int stm32x_write_block(struct flash_bank *bank, const uint8_t *buffer,
703 uint32_t offset, uint32_t count)
704 {
705 struct target *target = bank->target;
706 uint32_t buffer_size = 16384;
707 struct working_area *write_algorithm;
708 struct working_area *source;
709 uint32_t address = bank->base + offset;
710 struct reg_param reg_params[5];
711 struct armv7m_algorithm armv7m_info;
712 int retval = ERROR_OK;
713
714 static const uint8_t stm32x_flash_write_code[] = {
715 #include "../../../contrib/loaders/flash/stm32/stm32f2x.inc"
716 };
717
718 if (stm32x_is_otp(bank) && !stm32x_is_otp_unlocked(bank)) {
719 LOG_ERROR("OTP memory bank is disabled for write commands.");
720 return ERROR_FAIL;
721 }
722
723 if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
724 &write_algorithm) != ERROR_OK) {
725 LOG_WARNING("no working area available, can't do block memory writes");
726 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
727 }
728
729 retval = target_write_buffer(target, write_algorithm->address,
730 sizeof(stm32x_flash_write_code),
731 stm32x_flash_write_code);
732 if (retval != ERROR_OK) {
733 target_free_working_area(target, write_algorithm);
734 return retval;
735 }
736
737 /* memory buffer */
738 while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
739 buffer_size /= 2;
740 if (buffer_size <= 256) {
741 /* we already allocated the writing code, but failed to get a
742 * buffer, free the algorithm */
743 target_free_working_area(target, write_algorithm);
744
745 LOG_WARNING("no large enough working area available, can't do block memory writes");
746 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
747 }
748 }
749
750 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
751 armv7m_info.core_mode = ARM_MODE_THREAD;
752
753 init_reg_param(&reg_params[0], "r0", 32, PARAM_IN_OUT); /* buffer start, status (out) */
754 init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT); /* buffer end */
755 init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT); /* target address */
756 init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT); /* count (halfword-16bit) */
757 init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT); /* flash base */
758
759 buf_set_u32(reg_params[0].value, 0, 32, source->address);
760 buf_set_u32(reg_params[1].value, 0, 32, source->address + source->size);
761 buf_set_u32(reg_params[2].value, 0, 32, address);
762 buf_set_u32(reg_params[3].value, 0, 32, count);
763 buf_set_u32(reg_params[4].value, 0, 32, STM32_FLASH_BASE);
764
765 retval = target_run_flash_async_algorithm(target, buffer, count, 2,
766 0, NULL,
767 5, reg_params,
768 source->address, source->size,
769 write_algorithm->address, 0,
770 &armv7m_info);
771
772 if (retval == ERROR_FLASH_OPERATION_FAILED) {
773 LOG_ERROR("error executing stm32x flash write algorithm");
774
775 uint32_t error = buf_get_u32(reg_params[0].value, 0, 32) & FLASH_ERROR;
776
777 if (error & FLASH_WRPERR)
778 LOG_ERROR("flash memory write protected");
779
780 if (error != 0) {
781 LOG_ERROR("flash write failed = 0x%08" PRIx32, error);
782 /* Clear but report errors */
783 target_write_u32(target, STM32_FLASH_SR, error);
784 retval = ERROR_FAIL;
785 }
786 }
787
788 target_free_working_area(target, source);
789 target_free_working_area(target, write_algorithm);
790
791 destroy_reg_param(&reg_params[0]);
792 destroy_reg_param(&reg_params[1]);
793 destroy_reg_param(&reg_params[2]);
794 destroy_reg_param(&reg_params[3]);
795 destroy_reg_param(&reg_params[4]);
796
797 return retval;
798 }
799
800 static int stm32x_write(struct flash_bank *bank, const uint8_t *buffer,
801 uint32_t offset, uint32_t count)
802 {
803 struct target *target = bank->target;
804 uint32_t words_remaining = (count / 2);
805 uint32_t bytes_remaining = (count & 0x00000001);
806 uint32_t address = bank->base + offset;
807 uint32_t bytes_written = 0;
808 int retval;
809
810 if (bank->target->state != TARGET_HALTED) {
811 LOG_ERROR("Target not halted");
812 return ERROR_TARGET_NOT_HALTED;
813 }
814
815 if (offset & 0x1) {
816 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
817 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
818 }
819
820 retval = stm32x_unlock_reg(target);
821 if (retval != ERROR_OK)
822 return retval;
823
824 /* multiple half words (2-byte) to be programmed? */
825 if (words_remaining > 0) {
826 /* try using a block write */
827 retval = stm32x_write_block(bank, buffer, offset, words_remaining);
828 if (retval != ERROR_OK) {
829 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
830 /* if block write failed (no sufficient working area),
831 * we use normal (slow) single dword accesses */
832 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
833 }
834 } else {
835 buffer += words_remaining * 2;
836 address += words_remaining * 2;
837 words_remaining = 0;
838 }
839 }
840
841 if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
842 return retval;
843
844 /*
845 Standard programming
846 The Flash memory programming sequence is as follows:
847 1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
848 FLASH_SR register.
849 2. Set the PG bit in the FLASH_CR register
850 3. Perform the data write operation(s) to the desired memory address (inside main
851 memory block or OTP area):
852 – – Half-word access in case of x16 parallelism
853 – Word access in case of x32 parallelism
854 –
855 4.
856 Byte access in case of x8 parallelism
857 Double word access in case of x64 parallelism
858 Wait for the BSY bit to be cleared
859 */
860 while (words_remaining > 0) {
861 uint16_t value;
862 memcpy(&value, buffer + bytes_written, sizeof(uint16_t));
863
864 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
865 FLASH_PG | FLASH_PSIZE_16);
866 if (retval != ERROR_OK)
867 return retval;
868
869 retval = target_write_u16(target, address, value);
870 if (retval != ERROR_OK)
871 return retval;
872
873 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
874 if (retval != ERROR_OK)
875 return retval;
876
877 bytes_written += 2;
878 words_remaining--;
879 address += 2;
880 }
881
882 if (bytes_remaining) {
883 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
884 FLASH_PG | FLASH_PSIZE_8);
885 if (retval != ERROR_OK)
886 return retval;
887 retval = target_write_u8(target, address, buffer[bytes_written]);
888 if (retval != ERROR_OK)
889 return retval;
890
891 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
892 if (retval != ERROR_OK)
893 return retval;
894 }
895
896 return target_write_u32(target, STM32_FLASH_CR, FLASH_LOCK);
897 }
898
899 static void setup_sector(struct flash_bank *bank, unsigned int i,
900 unsigned int size)
901 {
902 assert(i < bank->num_sectors);
903 bank->sectors[i].offset = bank->size;
904 bank->sectors[i].size = size;
905 bank->size += bank->sectors[i].size;
906 LOG_DEBUG("sector %u: %ukBytes", i, size >> 10);
907 }
908
909 static uint16_t sector_size_in_kb(unsigned int i, uint16_t max_sector_size_in_kb)
910 {
911 if (i < 4)
912 return max_sector_size_in_kb / 8;
913 if (i == 4)
914 return max_sector_size_in_kb / 2;
915 return max_sector_size_in_kb;
916 }
917
918 static unsigned int calculate_number_of_sectors(struct flash_bank *bank,
919 uint16_t flash_size_in_kb,
920 uint16_t max_sector_size_in_kb)
921 {
922 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
923 uint16_t remaining_flash_size_in_kb = flash_size_in_kb;
924 unsigned int nr_sectors;
925
926 /* Dual Bank Flash has two identically-arranged banks of sectors. */
927 if (stm32x_info->has_large_mem)
928 remaining_flash_size_in_kb /= 2;
929
930 for (nr_sectors = 0; remaining_flash_size_in_kb > 0; nr_sectors++) {
931 uint16_t size_in_kb = sector_size_in_kb(nr_sectors, max_sector_size_in_kb);
932 if (size_in_kb > remaining_flash_size_in_kb) {
933 LOG_INFO("%s Bank %" PRIu16 " kiB final sector clipped to %" PRIu16 " kiB",
934 stm32x_info->has_large_mem ? "Dual" : "Single",
935 flash_size_in_kb, remaining_flash_size_in_kb);
936 remaining_flash_size_in_kb = 0;
937 } else {
938 remaining_flash_size_in_kb -= size_in_kb;
939 }
940 }
941
942 return stm32x_info->has_large_mem ? nr_sectors*2 : nr_sectors;
943 }
944
945 static void setup_bank(struct flash_bank *bank, unsigned int start,
946 uint16_t flash_size_in_kb, uint16_t max_sector_size_in_kb)
947 {
948 uint16_t remaining_flash_size_in_kb = flash_size_in_kb;
949 unsigned int sector_index = 0;
950 while (remaining_flash_size_in_kb > 0) {
951 uint16_t size_in_kb = sector_size_in_kb(sector_index, max_sector_size_in_kb);
952 if (size_in_kb > remaining_flash_size_in_kb) {
953 /* Clip last sector. Already warned in
954 * calculate_number_of_sectors. */
955 size_in_kb = remaining_flash_size_in_kb;
956 }
957 setup_sector(bank, start + sector_index, size_in_kb * 1024);
958 remaining_flash_size_in_kb -= size_in_kb;
959 sector_index++;
960 }
961 }
962
963 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
964 {
965 /* this checks for a stm32f4x errata issue where a
966 * stm32f2x DBGMCU_IDCODE is incorrectly returned.
967 * If the issue is detected target is forced to stm32f4x Rev A.
968 * Only effects Rev A silicon */
969
970 struct target *target = bank->target;
971 uint32_t cpuid;
972
973 /* read stm32 device id register */
974 int retval = target_read_u32(target, 0xE0042000, device_id);
975 if (retval != ERROR_OK)
976 return retval;
977
978 if ((*device_id & 0xfff) == 0x411) {
979 /* read CPUID reg to check core type */
980 retval = target_read_u32(target, 0xE000ED00, &cpuid);
981 if (retval != ERROR_OK)
982 return retval;
983
984 /* check for cortex_m4 */
985 if (((cpuid >> 4) & 0xFFF) == 0xC24) {
986 *device_id &= ~((0xFFFF << 16) | 0xfff);
987 *device_id |= (0x1000 << 16) | 0x413;
988 LOG_INFO("stm32f4x errata detected - fixing incorrect MCU_IDCODE");
989 }
990 }
991 return retval;
992 }
993
994 static int stm32x_probe(struct flash_bank *bank)
995 {
996 struct target *target = bank->target;
997 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
998 unsigned int num_prot_blocks, num_sectors;
999 uint16_t flash_size_in_kb;
1000 uint16_t otp_size_in_b;
1001 uint16_t otp_sector_size;
1002 uint32_t flash_size_reg = 0x1FFF7A22;
1003 uint16_t max_sector_size_in_kb = 128;
1004 uint16_t max_flash_size_in_kb;
1005 uint32_t device_id;
1006 uint32_t base_address = 0x08000000;
1007
1008 stm32x_info->probed = false;
1009 stm32x_info->has_large_mem = false;
1010 stm32x_info->has_boot_addr = false;
1011 stm32x_info->has_extra_options = false;
1012 stm32x_info->has_optcr2_pcrop = false;
1013 stm32x_info->protection_bits = 12; /* max. number of nWRPi bits (in FLASH_OPTCR !!!) */
1014 num_prot_blocks = 0;
1015
1016 free(bank->sectors);
1017 bank->num_sectors = 0;
1018 bank->sectors = NULL;
1019
1020 free(bank->prot_blocks);
1021 bank->num_prot_blocks = 0;
1022 bank->prot_blocks = NULL;
1023
1024 /* if explicitly called out as OTP bank, short circuit probe */
1025 if (stm32x_is_otp(bank)) {
1026 if (stm32x_otp_is_f7(bank)) {
1027 otp_size_in_b = STM32F7_OTP_SIZE;
1028 otp_sector_size = STM32F7_OTP_SECTOR_SIZE;
1029 } else {
1030 otp_size_in_b = STM32F2_OTP_SIZE;
1031 otp_sector_size = STM32F2_OTP_SECTOR_SIZE;
1032 }
1033
1034 num_sectors = otp_size_in_b / otp_sector_size;
1035 LOG_INFO("flash size = %" PRIu16 " bytes", otp_size_in_b);
1036
1037 assert(num_sectors > 0);
1038
1039 bank->num_sectors = num_sectors;
1040 bank->sectors = calloc(sizeof(struct flash_sector), num_sectors);
1041
1042 if (stm32x_otp_is_f7(bank))
1043 bank->size = STM32F7_OTP_SIZE;
1044 else
1045 bank->size = STM32F2_OTP_SIZE;
1046
1047 for (unsigned int i = 0; i < num_sectors; i++) {
1048 bank->sectors[i].offset = i * otp_sector_size;
1049 bank->sectors[i].size = otp_sector_size;
1050 bank->sectors[i].is_erased = 1;
1051 bank->sectors[i].is_protected = 0;
1052 }
1053
1054 stm32x_info->probed = true;
1055 return ERROR_OK;
1056 }
1057
1058 /* read stm32 device id register */
1059 int retval = stm32x_get_device_id(bank, &device_id);
1060 if (retval != ERROR_OK)
1061 return retval;
1062 LOG_INFO("device id = 0x%08" PRIx32, device_id);
1063 device_id &= 0xfff; /* only bits 0-11 are used further on */
1064
1065 /* set max flash size depending on family, id taken from AN2606 */
1066 switch (device_id) {
1067 case 0x411: /* F20x/21x */
1068 case 0x413: /* F40x/41x */
1069 max_flash_size_in_kb = 1024;
1070 break;
1071
1072 case 0x419: /* F42x/43x */
1073 case 0x434: /* F469/479 */
1074 stm32x_info->has_extra_options = true;
1075 max_flash_size_in_kb = 2048;
1076 break;
1077
1078 case 0x423: /* F401xB/C */
1079 max_flash_size_in_kb = 256;
1080 break;
1081
1082 case 0x421: /* F446 */
1083 case 0x431: /* F411 */
1084 case 0x433: /* F401xD/E */
1085 case 0x441: /* F412 */
1086 max_flash_size_in_kb = 512;
1087 break;
1088
1089 case 0x458: /* F410 */
1090 max_flash_size_in_kb = 128;
1091 break;
1092
1093 case 0x449: /* F74x/75x */
1094 max_flash_size_in_kb = 1024;
1095 max_sector_size_in_kb = 256;
1096 flash_size_reg = 0x1FF0F442;
1097 stm32x_info->has_extra_options = true;
1098 stm32x_info->has_boot_addr = true;
1099 break;
1100
1101 case 0x451: /* F76x/77x */
1102 max_flash_size_in_kb = 2048;
1103 max_sector_size_in_kb = 256;
1104 flash_size_reg = 0x1FF0F442;
1105 stm32x_info->has_extra_options = true;
1106 stm32x_info->has_boot_addr = true;
1107 break;
1108
1109 case 0x452: /* F72x/73x */
1110 max_flash_size_in_kb = 512;
1111 flash_size_reg = 0x1FF07A22; /* yes, 0x1FF*0*7A22, not 0x1FF*F*7A22 */
1112 stm32x_info->has_extra_options = true;
1113 stm32x_info->has_boot_addr = true;
1114 stm32x_info->has_optcr2_pcrop = true;
1115 break;
1116
1117 case 0x463: /* F413x/423x */
1118 max_flash_size_in_kb = 1536;
1119 stm32x_info->has_extra_options = true;
1120 stm32x_info->protection_bits = 15;
1121 num_prot_blocks = 15;
1122 break;
1123
1124 default:
1125 LOG_WARNING("Cannot identify target as a STM32 family.");
1126 return ERROR_FAIL;
1127 }
1128
1129 /* get flash size from target. */
1130 retval = target_read_u16(target, flash_size_reg, &flash_size_in_kb);
1131
1132 /* failed reading flash size or flash size invalid (early silicon),
1133 * default to max target family */
1134 if (retval != ERROR_OK || flash_size_in_kb == 0xffff || flash_size_in_kb == 0) {
1135 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming %" PRIu16 "k flash",
1136 max_flash_size_in_kb);
1137 flash_size_in_kb = max_flash_size_in_kb;
1138 }
1139
1140 /* if the user sets the size manually then ignore the probed value
1141 * this allows us to work around devices that have a invalid flash size register value */
1142 if (stm32x_info->user_bank_size) {
1143 LOG_INFO("ignoring flash probed value, using configured bank size");
1144 flash_size_in_kb = stm32x_info->user_bank_size / 1024;
1145 }
1146
1147 LOG_INFO("flash size = %" PRIu16 " kbytes", flash_size_in_kb);
1148
1149 /* did we assign flash size? */
1150 assert(flash_size_in_kb != 0xffff);
1151
1152 /* F42x/43x/469/479 1024 kiByte devices have a dual bank option */
1153 if ((device_id == 0x419) || (device_id == 0x434)) {
1154 uint32_t optiondata;
1155 retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
1156 if (retval != ERROR_OK) {
1157 LOG_DEBUG("unable to read option bytes");
1158 return retval;
1159 }
1160 if ((flash_size_in_kb > 1024) || (optiondata & OPTCR_DB1M)) {
1161 stm32x_info->has_large_mem = true;
1162 LOG_INFO("Dual Bank %" PRIu16 " kiB STM32F42x/43x/469/479 found", flash_size_in_kb);
1163 } else {
1164 stm32x_info->has_large_mem = false;
1165 LOG_INFO("Single Bank %" PRIu16 " kiB STM32F42x/43x/469/479 found", flash_size_in_kb);
1166 }
1167 }
1168
1169 /* F76x/77x devices have a dual bank option */
1170 if (device_id == 0x451) {
1171 uint32_t optiondata;
1172 retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
1173 if (retval != ERROR_OK) {
1174 LOG_DEBUG("unable to read option bytes");
1175 return retval;
1176 }
1177 if (optiondata & OPTCR_NDBANK) {
1178 stm32x_info->has_large_mem = false;
1179 LOG_INFO("Single Bank %" PRIu16 " kiB STM32F76x/77x found", flash_size_in_kb);
1180 } else {
1181 stm32x_info->has_large_mem = true;
1182 max_sector_size_in_kb >>= 1; /* sector size divided by 2 in dual-bank mode */
1183 LOG_INFO("Dual Bank %" PRIu16 " kiB STM32F76x/77x found", flash_size_in_kb);
1184 }
1185 }
1186
1187 /* calculate numbers of pages */
1188 unsigned int num_pages = calculate_number_of_sectors(
1189 bank, flash_size_in_kb, max_sector_size_in_kb);
1190
1191 bank->base = base_address;
1192 bank->num_sectors = num_pages;
1193 bank->sectors = calloc(num_pages, sizeof(struct flash_sector));
1194 for (unsigned int i = 0; i < num_pages; i++) {
1195 bank->sectors[i].is_erased = -1;
1196 bank->sectors[i].is_protected = 0;
1197 }
1198 bank->size = 0;
1199 LOG_DEBUG("allocated %u sectors", num_pages);
1200
1201 /* F76x/77x in dual bank mode */
1202 if ((device_id == 0x451) && stm32x_info->has_large_mem)
1203 num_prot_blocks = num_pages >> 1;
1204
1205 if (num_prot_blocks) {
1206 bank->prot_blocks = malloc(sizeof(struct flash_sector) * num_prot_blocks);
1207 for (unsigned int i = 0; i < num_prot_blocks; i++)
1208 bank->prot_blocks[i].is_protected = 0;
1209 LOG_DEBUG("allocated %u prot blocks", num_prot_blocks);
1210 }
1211
1212 if (stm32x_info->has_large_mem) {
1213 /* dual-bank */
1214 setup_bank(bank, 0, flash_size_in_kb >> 1, max_sector_size_in_kb);
1215 setup_bank(bank, num_pages >> 1, flash_size_in_kb >> 1,
1216 max_sector_size_in_kb);
1217
1218 /* F767x/F77x in dual mode, one protection bit refers to two adjacent sectors */
1219 if (device_id == 0x451) {
1220 for (unsigned int i = 0; i < num_prot_blocks; i++) {
1221 bank->prot_blocks[i].offset = bank->sectors[i << 1].offset;
1222 bank->prot_blocks[i].size = bank->sectors[i << 1].size
1223 + bank->sectors[(i << 1) + 1].size;
1224 }
1225 }
1226 } else {
1227 /* single-bank */
1228 setup_bank(bank, 0, flash_size_in_kb, max_sector_size_in_kb);
1229
1230 /* F413/F423, sectors 14 and 15 share one common protection bit */
1231 if (device_id == 0x463) {
1232 for (unsigned int i = 0; i < num_prot_blocks; i++) {
1233 bank->prot_blocks[i].offset = bank->sectors[i].offset;
1234 bank->prot_blocks[i].size = bank->sectors[i].size;
1235 }
1236 bank->prot_blocks[num_prot_blocks - 1].size <<= 1;
1237 }
1238 }
1239 bank->num_prot_blocks = num_prot_blocks;
1240 assert((bank->size >> 10) == flash_size_in_kb);
1241
1242 stm32x_info->probed = true;
1243 return ERROR_OK;
1244 }
1245
1246 static int stm32x_auto_probe(struct flash_bank *bank)
1247 {
1248 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
1249 if (stm32x_info->probed)
1250 return ERROR_OK;
1251 return stm32x_probe(bank);
1252 }
1253
1254 static int get_stm32x_info(struct flash_bank *bank, struct command_invocation *cmd)
1255 {
1256 uint32_t dbgmcu_idcode;
1257
1258 /* read stm32 device id register */
1259 int retval = stm32x_get_device_id(bank, &dbgmcu_idcode);
1260 if (retval != ERROR_OK)
1261 return retval;
1262
1263 uint16_t device_id = dbgmcu_idcode & 0xfff;
1264 uint16_t rev_id = dbgmcu_idcode >> 16;
1265 const char *device_str;
1266 const char *rev_str = NULL;
1267
1268 switch (device_id) {
1269 case 0x411:
1270 device_str = "STM32F2xx";
1271
1272 switch (rev_id) {
1273 case 0x1000:
1274 rev_str = "A";
1275 break;
1276
1277 case 0x2000:
1278 rev_str = "B";
1279 break;
1280
1281 case 0x1001:
1282 rev_str = "Z";
1283 break;
1284
1285 case 0x2001:
1286 rev_str = "Y";
1287 break;
1288
1289 case 0x2003:
1290 rev_str = "X";
1291 break;
1292
1293 case 0x2007:
1294 rev_str = "1";
1295 break;
1296
1297 case 0x200F:
1298 rev_str = "V";
1299 break;
1300
1301 case 0x201F:
1302 rev_str = "2";
1303 break;
1304 }
1305 break;
1306
1307 case 0x413:
1308 case 0x419:
1309 case 0x434:
1310 device_str = "STM32F4xx";
1311
1312 switch (rev_id) {
1313 case 0x1000:
1314 rev_str = "A";
1315 break;
1316
1317 case 0x1001:
1318 rev_str = "Z";
1319 break;
1320
1321 case 0x1003:
1322 rev_str = "Y";
1323 break;
1324
1325 case 0x1007:
1326 rev_str = "1";
1327 break;
1328
1329 case 0x2001:
1330 rev_str = "3";
1331 break;
1332 }
1333 break;
1334
1335 case 0x421:
1336 device_str = "STM32F446";
1337
1338 switch (rev_id) {
1339 case 0x1000:
1340 rev_str = "A";
1341 break;
1342 }
1343 break;
1344
1345 case 0x423:
1346 case 0x431:
1347 case 0x433:
1348 case 0x458:
1349 case 0x441:
1350 device_str = "STM32F4xx (Low Power)";
1351
1352 switch (rev_id) {
1353 case 0x1000:
1354 rev_str = "A";
1355 break;
1356
1357 case 0x1001:
1358 rev_str = "Z";
1359 break;
1360
1361 case 0x2000:
1362 rev_str = "B";
1363 break;
1364
1365 case 0x3000:
1366 rev_str = "C";
1367 break;
1368 }
1369 break;
1370
1371 case 0x449:
1372 device_str = "STM32F7[4|5]x";
1373
1374 switch (rev_id) {
1375 case 0x1000:
1376 rev_str = "A";
1377 break;
1378
1379 case 0x1001:
1380 rev_str = "Z";
1381 break;
1382 }
1383 break;
1384
1385 case 0x451:
1386 device_str = "STM32F7[6|7]x";
1387
1388 switch (rev_id) {
1389 case 0x1000:
1390 rev_str = "A";
1391 break;
1392 case 0x1001:
1393 rev_str = "Z";
1394 break;
1395 }
1396 break;
1397
1398 case 0x452:
1399 device_str = "STM32F7[2|3]x";
1400
1401 switch (rev_id) {
1402 case 0x1000:
1403 rev_str = "A";
1404 break;
1405 }
1406 break;
1407
1408 case 0x463:
1409 device_str = "STM32F4[1|2]3";
1410
1411 switch (rev_id) {
1412 case 0x1000:
1413 rev_str = "A";
1414 break;
1415 }
1416 break;
1417
1418 default:
1419 command_print_sameline(cmd, "Cannot identify target as a STM32F2/4/7\n");
1420 return ERROR_FAIL;
1421 }
1422
1423 if (rev_str != NULL)
1424 command_print_sameline(cmd, "%s - Rev: %s", device_str, rev_str);
1425 else
1426 command_print_sameline(cmd, "%s - Rev: unknown (0x%04" PRIx16 ")", device_str, rev_id);
1427
1428 return ERROR_OK;
1429 }
1430
1431 COMMAND_HANDLER(stm32x_handle_lock_command)
1432 {
1433 struct target *target = NULL;
1434 struct stm32x_flash_bank *stm32x_info = NULL;
1435
1436 if (CMD_ARGC < 1)
1437 return ERROR_COMMAND_SYNTAX_ERROR;
1438
1439 struct flash_bank *bank;
1440 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1441 if (ERROR_OK != retval)
1442 return retval;
1443
1444 stm32x_info = bank->driver_priv;
1445 target = bank->target;
1446
1447 if (target->state != TARGET_HALTED) {
1448 LOG_INFO("Target not halted");
1449 /* return ERROR_TARGET_NOT_HALTED; */
1450 }
1451
1452 if (stm32x_read_options(bank) != ERROR_OK) {
1453 command_print(CMD, "%s failed to read options", bank->driver->name);
1454 return ERROR_OK;
1455 }
1456
1457 /* set readout protection */
1458 stm32x_info->option_bytes.RDP = 0;
1459
1460 if (stm32x_write_options(bank) != ERROR_OK) {
1461 command_print(CMD, "%s failed to lock device", bank->driver->name);
1462 return ERROR_OK;
1463 }
1464
1465 command_print(CMD, "%s locked", bank->driver->name);
1466
1467 return ERROR_OK;
1468 }
1469
1470 COMMAND_HANDLER(stm32x_handle_unlock_command)
1471 {
1472 struct target *target = NULL;
1473 struct stm32x_flash_bank *stm32x_info = NULL;
1474
1475 if (CMD_ARGC < 1)
1476 return ERROR_COMMAND_SYNTAX_ERROR;
1477
1478 struct flash_bank *bank;
1479 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1480 if (ERROR_OK != retval)
1481 return retval;
1482
1483 stm32x_info = bank->driver_priv;
1484 target = bank->target;
1485
1486 if (target->state != TARGET_HALTED) {
1487 LOG_INFO("Target not halted");
1488 /* return ERROR_TARGET_NOT_HALTED; */
1489 }
1490
1491 if (stm32x_read_options(bank) != ERROR_OK) {
1492 command_print(CMD, "%s failed to read options", bank->driver->name);
1493 return ERROR_OK;
1494 }
1495
1496 /* clear readout protection and complementary option bytes
1497 * this will also force a device unlock if set */
1498 stm32x_info->option_bytes.RDP = 0xAA;
1499 if (stm32x_info->has_optcr2_pcrop) {
1500 stm32x_info->option_bytes.optcr2_pcrop = OPTCR2_PCROP_RDP | (~1U << bank->num_sectors);
1501 }
1502
1503 if (stm32x_write_options(bank) != ERROR_OK) {
1504 command_print(CMD, "%s failed to unlock device", bank->driver->name);
1505 return ERROR_OK;
1506 }
1507
1508 command_print(CMD, "%s unlocked.\n"
1509 "INFO: a reset or power cycle is required "
1510 "for the new settings to take effect.", bank->driver->name);
1511
1512 return ERROR_OK;
1513 }
1514
1515 static int stm32x_mass_erase(struct flash_bank *bank)
1516 {
1517 int retval;
1518 uint32_t flash_mer;
1519 struct target *target = bank->target;
1520 struct stm32x_flash_bank *stm32x_info = NULL;
1521
1522 if (target->state != TARGET_HALTED) {
1523 LOG_ERROR("Target not halted");
1524 return ERROR_TARGET_NOT_HALTED;
1525 }
1526
1527 stm32x_info = bank->driver_priv;
1528
1529 retval = stm32x_unlock_reg(target);
1530 if (retval != ERROR_OK)
1531 return retval;
1532
1533 /* mass erase flash memory */
1534 if (stm32x_info->has_large_mem)
1535 flash_mer = FLASH_MER | FLASH_MER1;
1536 else
1537 flash_mer = FLASH_MER;
1538
1539 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), flash_mer);
1540 if (retval != ERROR_OK)
1541 return retval;
1542 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
1543 flash_mer | FLASH_STRT);
1544 if (retval != ERROR_OK)
1545 return retval;
1546
1547 retval = stm32x_wait_status_busy(bank, FLASH_MASS_ERASE_TIMEOUT);
1548 if (retval != ERROR_OK)
1549 return retval;
1550
1551 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
1552 if (retval != ERROR_OK)
1553 return retval;
1554
1555 return ERROR_OK;
1556 }
1557
1558 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
1559 {
1560 if (CMD_ARGC < 1) {
1561 command_print(CMD, "stm32x mass_erase <bank>");
1562 return ERROR_COMMAND_SYNTAX_ERROR;
1563 }
1564
1565 struct flash_bank *bank;
1566 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1567 if (ERROR_OK != retval)
1568 return retval;
1569
1570 retval = stm32x_mass_erase(bank);
1571 if (retval == ERROR_OK) {
1572 /* set all sectors as erased */
1573 for (unsigned int i = 0; i < bank->num_sectors; i++)
1574 bank->sectors[i].is_erased = 1;
1575
1576 command_print(CMD, "stm32x mass erase complete");
1577 } else {
1578 command_print(CMD, "stm32x mass erase failed");
1579 }
1580
1581 return retval;
1582 }
1583
1584 COMMAND_HANDLER(stm32f2x_handle_options_read_command)
1585 {
1586 int retval;
1587 struct flash_bank *bank;
1588 struct stm32x_flash_bank *stm32x_info = NULL;
1589
1590 if (CMD_ARGC != 1) {
1591 command_print(CMD, "stm32f2x options_read <bank>");
1592 return ERROR_COMMAND_SYNTAX_ERROR;
1593 }
1594
1595 retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1596 if (ERROR_OK != retval)
1597 return retval;
1598
1599 retval = stm32x_read_options(bank);
1600 if (ERROR_OK != retval)
1601 return retval;
1602
1603 stm32x_info = bank->driver_priv;
1604 if (stm32x_info->has_extra_options) {
1605 if (stm32x_info->has_boot_addr) {
1606 uint32_t boot_addr = stm32x_info->option_bytes.boot_addr;
1607
1608 command_print(CMD, "stm32f2x user_options 0x%03" PRIX16 ","
1609 " boot_add0 0x%04" PRIX32 ", boot_add1 0x%04" PRIX32,
1610 stm32x_info->option_bytes.user_options,
1611 boot_addr & 0xffff, (boot_addr & 0xffff0000) >> 16);
1612 if (stm32x_info->has_optcr2_pcrop) {
1613 command_print(CMD, "stm32f2x optcr2_pcrop 0x%08" PRIX32,
1614 stm32x_info->option_bytes.optcr2_pcrop);
1615 }
1616 } else {
1617 command_print(CMD, "stm32f2x user_options 0x%03" PRIX16,
1618 stm32x_info->option_bytes.user_options);
1619 }
1620 } else {
1621 command_print(CMD, "stm32f2x user_options 0x%02" PRIX16,
1622 stm32x_info->option_bytes.user_options);
1623
1624 }
1625
1626 return retval;
1627 }
1628
1629 COMMAND_HANDLER(stm32f2x_handle_options_write_command)
1630 {
1631 int retval;
1632 struct flash_bank *bank;
1633 struct stm32x_flash_bank *stm32x_info = NULL;
1634 uint16_t user_options, boot_addr0, boot_addr1, options_mask;
1635
1636 if (CMD_ARGC < 1) {
1637 command_print(CMD, "stm32f2x options_write <bank> ...");
1638 return ERROR_COMMAND_SYNTAX_ERROR;
1639 }
1640
1641 retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1642 if (ERROR_OK != retval)
1643 return retval;
1644
1645 retval = stm32x_read_options(bank);
1646 if (ERROR_OK != retval)
1647 return retval;
1648
1649 stm32x_info = bank->driver_priv;
1650 if (stm32x_info->has_boot_addr) {
1651 if (CMD_ARGC != 4) {
1652 command_print(CMD, "stm32f2x options_write <bank> <user_options>"
1653 " <boot_addr0> <boot_addr1>");
1654 return ERROR_COMMAND_SYNTAX_ERROR;
1655 }
1656 COMMAND_PARSE_NUMBER(u16, CMD_ARGV[2], boot_addr0);
1657 COMMAND_PARSE_NUMBER(u16, CMD_ARGV[3], boot_addr1);
1658 stm32x_info->option_bytes.boot_addr = boot_addr0 | (((uint32_t) boot_addr1) << 16);
1659 } else {
1660 if (CMD_ARGC != 2) {
1661 command_print(CMD, "stm32f2x options_write <bank> <user_options>");
1662 return ERROR_COMMAND_SYNTAX_ERROR;
1663 }
1664 }
1665
1666 COMMAND_PARSE_NUMBER(u16, CMD_ARGV[1], user_options);
1667 options_mask = !stm32x_info->has_extra_options ? ~0xfc :
1668 ~(((0xf00 << (stm32x_info->protection_bits - 12)) | 0xff) & 0xffc);
1669 if (user_options & options_mask) {
1670 command_print(CMD, "stm32f2x invalid user_options");
1671 return ERROR_COMMAND_ARGUMENT_INVALID;
1672 }
1673
1674 stm32x_info->option_bytes.user_options = user_options;
1675
1676 if (stm32x_write_options(bank) != ERROR_OK) {
1677 command_print(CMD, "stm32f2x failed to write options");
1678 return ERROR_OK;
1679 }
1680
1681 /* switching between single- and dual-bank modes requires re-probe */
1682 /* ... and reprogramming of whole flash */
1683 stm32x_info->probed = false;
1684
1685 command_print(CMD, "stm32f2x write options complete.\n"
1686 "INFO: a reset or power cycle is required "
1687 "for the new settings to take effect.");
1688 return retval;
1689 }
1690
1691 COMMAND_HANDLER(stm32f2x_handle_optcr2_write_command)
1692 {
1693 int retval;
1694 struct flash_bank *bank;
1695 struct stm32x_flash_bank *stm32x_info = NULL;
1696 uint32_t optcr2_pcrop;
1697
1698 if (CMD_ARGC != 2) {
1699 command_print(CMD, "stm32f2x optcr2_write <bank> <optcr2_value>");
1700 return ERROR_COMMAND_SYNTAX_ERROR;
1701 }
1702
1703 retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1704 if (ERROR_OK != retval)
1705 return retval;
1706
1707 stm32x_info = bank->driver_priv;
1708 if (!stm32x_info->has_optcr2_pcrop) {
1709 command_print(CMD, "no optcr2 register");
1710 return ERROR_COMMAND_ARGUMENT_INVALID;
1711 }
1712
1713 command_print(CMD, "INFO: To disable PCROP, set PCROP_RDP"
1714 " with PCROPi bits STILL SET, then\nlock device and"
1715 " finally unlock it. Clears PCROP and mass erases flash.");
1716
1717 retval = stm32x_read_options(bank);
1718 if (ERROR_OK != retval)
1719 return retval;
1720
1721 COMMAND_PARSE_NUMBER(u32, CMD_ARGV[1], optcr2_pcrop);
1722 stm32x_info->option_bytes.optcr2_pcrop = optcr2_pcrop;
1723
1724 if (stm32x_write_options(bank) != ERROR_OK) {
1725 command_print(CMD, "stm32f2x failed to write options");
1726 return ERROR_OK;
1727 }
1728
1729 command_print(CMD, "stm32f2x optcr2_write complete.");
1730 return retval;
1731 }
1732
1733 COMMAND_HANDLER(stm32x_handle_otp_command)
1734 {
1735 if (CMD_ARGC < 2) {
1736 command_print(CMD, "stm32x otp <bank> (enable|disable|show)");
1737 return ERROR_COMMAND_SYNTAX_ERROR;
1738 }
1739
1740 struct flash_bank *bank;
1741 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1742 if (ERROR_OK != retval)
1743 return retval;
1744 if (stm32x_is_otp(bank)) {
1745 if (strcmp(CMD_ARGV[1], "enable") == 0) {
1746 stm32x_otp_enable(bank);
1747 } else if (strcmp(CMD_ARGV[1], "disable") == 0) {
1748 stm32x_otp_disable(bank);
1749 } else if (strcmp(CMD_ARGV[1], "show") == 0) {
1750 command_print(CMD,
1751 "OTP memory bank #%u is %s for write commands.",
1752 bank->bank_number,
1753 stm32x_is_otp_unlocked(bank) ? "enabled" : "disabled");
1754 } else {
1755 return ERROR_COMMAND_SYNTAX_ERROR;
1756 }
1757 } else {
1758 command_print(CMD, "Failed: not an OTP bank.");
1759 }
1760
1761 return retval;
1762 }
1763
1764 static const struct command_registration stm32x_exec_command_handlers[] = {
1765 {
1766 .name = "lock",
1767 .handler = stm32x_handle_lock_command,
1768 .mode = COMMAND_EXEC,
1769 .usage = "bank_id",
1770 .help = "Lock entire flash device.",
1771 },
1772 {
1773 .name = "unlock",
1774 .handler = stm32x_handle_unlock_command,
1775 .mode = COMMAND_EXEC,
1776 .usage = "bank_id",
1777 .help = "Unlock entire protected flash device.",
1778 },
1779 {
1780 .name = "mass_erase",
1781 .handler = stm32x_handle_mass_erase_command,
1782 .mode = COMMAND_EXEC,
1783 .usage = "bank_id",
1784 .help = "Erase entire flash device.",
1785 },
1786 {
1787 .name = "options_read",
1788 .handler = stm32f2x_handle_options_read_command,
1789 .mode = COMMAND_EXEC,
1790 .usage = "bank_id",
1791 .help = "Read and display device option bytes.",
1792 },
1793 {
1794 .name = "options_write",
1795 .handler = stm32f2x_handle_options_write_command,
1796 .mode = COMMAND_EXEC,
1797 .usage = "bank_id user_options [ boot_add0 boot_add1 ]",
1798 .help = "Write option bytes",
1799 },
1800 {
1801 .name = "optcr2_write",
1802 .handler = stm32f2x_handle_optcr2_write_command,
1803 .mode = COMMAND_EXEC,
1804 .usage = "bank_id optcr2",
1805 .help = "Write optcr2 word",
1806 },
1807 {
1808 .name = "otp",
1809 .handler = stm32x_handle_otp_command,
1810 .mode = COMMAND_EXEC,
1811 .usage = "bank_id",
1812 .help = "OTP (One Time Programmable) memory write enable/disable.",
1813 },
1814 COMMAND_REGISTRATION_DONE
1815 };
1816
1817 static const struct command_registration stm32x_command_handlers[] = {
1818 {
1819 .name = "stm32f2x",
1820 .mode = COMMAND_ANY,
1821 .help = "stm32f2x flash command group",
1822 .usage = "",
1823 .chain = stm32x_exec_command_handlers,
1824 },
1825 COMMAND_REGISTRATION_DONE
1826 };
1827
1828 const struct flash_driver stm32f2x_flash = {
1829 .name = "stm32f2x",
1830 .commands = stm32x_command_handlers,
1831 .flash_bank_command = stm32x_flash_bank_command,
1832 .erase = stm32x_erase,
1833 .protect = stm32x_protect,
1834 .write = stm32x_write,
1835 .read = default_flash_read,
1836 .probe = stm32x_probe,
1837 .auto_probe = stm32x_auto_probe,
1838 .erase_check = default_flash_blank_check,
1839 .protect_check = stm32x_protect_check,
1840 .info = get_stm32x_info,
1841 .free_driver_priv = default_flash_free_driver_priv,
1842 };
Official OpenOCD Mirror