Code Review / openocd.git / blob
? search:


89fad60c7eb78f98d9fe95bb1a9fdaa32a0b928d
[openocd.git] / src / flash / nor / stm32f2x.c
1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
4 * *
5 * Copyright (C) 2008 by Spencer Oliver *
6 * spen@spen-soft.co.uk *
7 * *
8 * Copyright (C) 2011 Øyvind Harboe *
9 * oyvind.harboe@zylin.com *
10 * *
11 * This program is free software; you can redistribute it and/or modify *
12 * it under the terms of the GNU General Public License as published by *
13 * the Free Software Foundation; either version 2 of the License, or *
14 * (at your option) any later version. *
15 * *
16 * This program is distributed in the hope that it will be useful, *
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
19 * GNU General Public License for more details. *
20 * *
21 * You should have received a copy of the GNU General Public License *
22 * along with this program; if not, write to the *
23 * Free Software Foundation, Inc., *
24 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *
25 ***************************************************************************/
26
27 #ifdef HAVE_CONFIG_H
28 #include "config.h"
29 #endif
30
31 #include "imp.h"
32 #include <helper/binarybuffer.h>
33 #include <target/algorithm.h>
34 #include <target/armv7m.h>
35
36 /* Regarding performance:
37 *
38 * Short story - it might be best to leave the performance at
39 * current levels.
40 *
41 * You may see a jump in speed if you change to using
42 * 32bit words for the block programming.
43 *
44 * Its a shame you cannot use the double word as its
45 * even faster - but you require external VPP for that mode.
46 *
47 * Having said all that 16bit writes give us the widest vdd
48 * operating range, so may be worth adding a note to that effect.
49 *
50 */
51
52 /* Danger!!!! The STM32F1x and STM32F2x series actually have
53 * quite different flash controllers.
54 *
55 * What's more scary is that the names of the registers and their
56 * addresses are the same, but the actual bits and what they do are
57 * can be very different.
58 *
59 * To reduce testing complexity and dangers of regressions,
60 * a seperate file is used for stm32fx2x.
61 *
62 * 1mByte part with 4 x 16, 1 x 64, 7 x 128kBytes sectors
63 *
64 * What's the protection page size???
65 *
66 * Tested with STM3220F-EVAL board.
67 *
68 * STM32F21xx series for reference.
69 *
70 * RM0033
71 * http://www.st.com/internet/mcu/product/250192.jsp
72 *
73 * PM0059
74 * www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/
75 * PROGRAMMING_MANUAL/CD00233952.pdf
76 *
77 * STM32F1x series - notice that this code was copy, pasted and knocked
78 * into a stm32f2x driver, so in case something has been converted or
79 * bugs haven't been fixed, here are the original manuals:
80 *
81 * RM0008 - Reference manual
82 *
83 * RM0042, the Flash programming manual for low-, medium- high-density and
84 * connectivity line STM32F10x devices
85 *
86 * PM0068, the Flash programming manual for XL-density STM32F10x devices.
87 *
88 */
89
90 /* Erase time can be as high as 1000ms, 10x this and it's toast... */
91 #define FLASH_ERASE_TIMEOUT 10000
92 #define FLASH_WRITE_TIMEOUT 5
93
94 #define STM32_FLASH_BASE 0x40023c00
95 #define STM32_FLASH_ACR 0x40023c00
96 #define STM32_FLASH_KEYR 0x40023c04
97 #define STM32_FLASH_OPTKEYR 0x40023c08
98 #define STM32_FLASH_SR 0x40023c0C
99 #define STM32_FLASH_CR 0x40023c10
100 #define STM32_FLASH_OPTCR 0x40023c14
101 #define STM32_FLASH_OPTCR1 0x40023c18
102
103 /* FLASH_CR register bits */
104
105 #define FLASH_PG (1 << 0)
106 #define FLASH_SER (1 << 1)
107 #define FLASH_MER (1 << 2)
108 #define FLASH_MER1 (1 << 15)
109 #define FLASH_STRT (1 << 16)
110 #define FLASH_PSIZE_8 (0 << 8)
111 #define FLASH_PSIZE_16 (1 << 8)
112 #define FLASH_PSIZE_32 (2 << 8)
113 #define FLASH_PSIZE_64 (3 << 8)
114 #define FLASH_SNB(a) ((a) << 3)
115 #define FLASH_LOCK (1 << 31)
116
117 /* FLASH_SR register bits */
118
119 #define FLASH_BSY (1 << 16)
120 #define FLASH_PGSERR (1 << 7) /* Programming sequence error */
121 #define FLASH_PGPERR (1 << 6) /* Programming parallelism error */
122 #define FLASH_PGAERR (1 << 5) /* Programming alignment error */
123 #define FLASH_WRPERR (1 << 4) /* Write protection error */
124 #define FLASH_OPERR (1 << 1) /* Operation error */
125
126 #define FLASH_ERROR (FLASH_PGSERR | FLASH_PGPERR | FLASH_PGAERR | FLASH_WRPERR | FLASH_OPERR)
127
128 /* STM32_FLASH_OPTCR register bits */
129
130 #define OPT_LOCK (1 << 0)
131 #define OPT_START (1 << 1)
132
133 /* STM32_FLASH_OBR bit definitions (reading) */
134
135 #define OPT_ERROR 0
136 #define OPT_READOUT 1
137 #define OPT_RDWDGSW 2
138 #define OPT_RDRSTSTOP 3
139 #define OPT_RDRSTSTDBY 4
140 #define OPT_BFB2 5 /* dual flash bank only */
141
142 /* register unlock keys */
143
144 #define KEY1 0x45670123
145 #define KEY2 0xCDEF89AB
146
147 /* option register unlock key */
148 #define OPTKEY1 0x08192A3B
149 #define OPTKEY2 0x4C5D6E7F
150
151 struct stm32x_options {
152 uint8_t RDP;
153 uint8_t user_options;
154 uint32_t protection;
155 };
156
157 struct stm32x_flash_bank {
158 struct stm32x_options option_bytes;
159 int probed;
160 bool has_large_mem; /* stm32f42x/stm32f43x family */
161 uint32_t user_bank_size;
162 };
163
164 /* flash bank stm32x <base> <size> 0 0 <target#>
165 */
166 FLASH_BANK_COMMAND_HANDLER(stm32x_flash_bank_command)
167 {
168 struct stm32x_flash_bank *stm32x_info;
169
170 if (CMD_ARGC < 6)
171 return ERROR_COMMAND_SYNTAX_ERROR;
172
173 stm32x_info = malloc(sizeof(struct stm32x_flash_bank));
174 bank->driver_priv = stm32x_info;
175
176 stm32x_info->probed = 0;
177 stm32x_info->user_bank_size = bank->size;
178
179 return ERROR_OK;
180 }
181
182 static inline int stm32x_get_flash_reg(struct flash_bank *bank, uint32_t reg)
183 {
184 return reg;
185 }
186
187 static inline int stm32x_get_flash_status(struct flash_bank *bank, uint32_t *status)
188 {
189 struct target *target = bank->target;
190 return target_read_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR), status);
191 }
192
193 static int stm32x_wait_status_busy(struct flash_bank *bank, int timeout)
194 {
195 struct target *target = bank->target;
196 uint32_t status;
197 int retval = ERROR_OK;
198
199 /* wait for busy to clear */
200 for (;;) {
201 retval = stm32x_get_flash_status(bank, &status);
202 if (retval != ERROR_OK)
203 return retval;
204 LOG_DEBUG("status: 0x%" PRIx32 "", status);
205 if ((status & FLASH_BSY) == 0)
206 break;
207 if (timeout-- <= 0) {
208 LOG_ERROR("timed out waiting for flash");
209 return ERROR_FAIL;
210 }
211 alive_sleep(1);
212 }
213
214
215 if (status & FLASH_WRPERR) {
216 LOG_ERROR("stm32x device protected");
217 retval = ERROR_FAIL;
218 }
219
220 /* Clear but report errors */
221 if (status & FLASH_ERROR) {
222 /* If this operation fails, we ignore it and report the original
223 * retval
224 */
225 target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_SR),
226 status & FLASH_ERROR);
227 }
228 return retval;
229 }
230
231 static int stm32x_unlock_reg(struct target *target)
232 {
233 uint32_t ctrl;
234
235 /* first check if not already unlocked
236 * otherwise writing on STM32_FLASH_KEYR will fail
237 */
238 int retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
239 if (retval != ERROR_OK)
240 return retval;
241
242 if ((ctrl & FLASH_LOCK) == 0)
243 return ERROR_OK;
244
245 /* unlock flash registers */
246 retval = target_write_u32(target, STM32_FLASH_KEYR, KEY1);
247 if (retval != ERROR_OK)
248 return retval;
249
250 retval = target_write_u32(target, STM32_FLASH_KEYR, KEY2);
251 if (retval != ERROR_OK)
252 return retval;
253
254 retval = target_read_u32(target, STM32_FLASH_CR, &ctrl);
255 if (retval != ERROR_OK)
256 return retval;
257
258 if (ctrl & FLASH_LOCK) {
259 LOG_ERROR("flash not unlocked STM32_FLASH_CR: %x", ctrl);
260 return ERROR_TARGET_FAILURE;
261 }
262
263 return ERROR_OK;
264 }
265
266 static int stm32x_unlock_option_reg(struct target *target)
267 {
268 uint32_t ctrl;
269
270 int retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
271 if (retval != ERROR_OK)
272 return retval;
273
274 if ((ctrl & OPT_LOCK) == 0)
275 return ERROR_OK;
276
277 /* unlock option registers */
278 retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY1);
279 if (retval != ERROR_OK)
280 return retval;
281
282 retval = target_write_u32(target, STM32_FLASH_OPTKEYR, OPTKEY2);
283 if (retval != ERROR_OK)
284 return retval;
285
286 retval = target_read_u32(target, STM32_FLASH_OPTCR, &ctrl);
287 if (retval != ERROR_OK)
288 return retval;
289
290 if (ctrl & OPT_LOCK) {
291 LOG_ERROR("options not unlocked STM32_FLASH_OPTCR: %x", ctrl);
292 return ERROR_TARGET_FAILURE;
293 }
294
295 return ERROR_OK;
296 }
297
298 static int stm32x_read_options(struct flash_bank *bank)
299 {
300 uint32_t optiondata;
301 struct stm32x_flash_bank *stm32x_info = NULL;
302 struct target *target = bank->target;
303
304 stm32x_info = bank->driver_priv;
305
306 /* read current option bytes */
307 int retval = target_read_u32(target, STM32_FLASH_OPTCR, &optiondata);
308 if (retval != ERROR_OK)
309 return retval;
310
311 stm32x_info->option_bytes.user_options = optiondata & 0xec;
312 stm32x_info->option_bytes.RDP = (optiondata >> 8) & 0xff;
313 stm32x_info->option_bytes.protection = (optiondata >> 16) & 0xfff;
314
315 if (stm32x_info->has_large_mem) {
316
317 retval = target_read_u32(target, STM32_FLASH_OPTCR1, &optiondata);
318 if (retval != ERROR_OK)
319 return retval;
320
321 /* append protection bits */
322 stm32x_info->option_bytes.protection |= (optiondata >> 4) & 0x00fff000;
323 }
324
325 if (stm32x_info->option_bytes.RDP != 0xAA)
326 LOG_INFO("Device Security Bit Set");
327
328 return ERROR_OK;
329 }
330
331 static int stm32x_write_options(struct flash_bank *bank)
332 {
333 struct stm32x_flash_bank *stm32x_info = NULL;
334 struct target *target = bank->target;
335 uint32_t optiondata;
336
337 stm32x_info = bank->driver_priv;
338
339 int retval = stm32x_unlock_option_reg(target);
340 if (retval != ERROR_OK)
341 return retval;
342
343 /* rebuild option data */
344 optiondata = stm32x_info->option_bytes.user_options;
345 buf_set_u32(&optiondata, 8, 8, stm32x_info->option_bytes.RDP);
346 buf_set_u32(&optiondata, 16, 12, stm32x_info->option_bytes.protection);
347
348 /* program options */
349 retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata);
350 if (retval != ERROR_OK)
351 return retval;
352
353 if (stm32x_info->has_large_mem) {
354
355 uint32_t optiondata2 = 0;
356 buf_set_u32(&optiondata2, 16, 12, stm32x_info->option_bytes.protection >> 12);
357 retval = target_write_u32(target, STM32_FLASH_OPTCR1, optiondata2);
358 if (retval != ERROR_OK)
359 return retval;
360 }
361
362 /* start programming cycle */
363 retval = target_write_u32(target, STM32_FLASH_OPTCR, optiondata | OPT_START);
364 if (retval != ERROR_OK)
365 return retval;
366
367 /* wait for completion */
368 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
369 if (retval != ERROR_OK)
370 return retval;
371
372 /* relock registers */
373 retval = target_write_u32(target, STM32_FLASH_OPTCR, OPT_LOCK);
374 if (retval != ERROR_OK)
375 return retval;
376
377 return ERROR_OK;
378 }
379
380 static int stm32x_protect_check(struct flash_bank *bank)
381 {
382 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
383
384 /* read write protection settings */
385 int retval = stm32x_read_options(bank);
386 if (retval != ERROR_OK) {
387 LOG_DEBUG("unable to read option bytes");
388 return retval;
389 }
390
391 for (int i = 0; i < bank->num_sectors; i++) {
392 if (stm32x_info->option_bytes.protection & (1 << i))
393 bank->sectors[i].is_protected = 0;
394 else
395 bank->sectors[i].is_protected = 1;
396 }
397
398 return ERROR_OK;
399 }
400
401 static int stm32x_erase(struct flash_bank *bank, int first, int last)
402 {
403 struct target *target = bank->target;
404 int i;
405
406 if (bank->target->state != TARGET_HALTED) {
407 LOG_ERROR("Target not halted");
408 return ERROR_TARGET_NOT_HALTED;
409 }
410
411 int retval;
412 retval = stm32x_unlock_reg(target);
413 if (retval != ERROR_OK)
414 return retval;
415
416 /*
417 Sector Erase
418 To erase a sector, follow the procedure below:
419 1. Check that no Flash memory operation is ongoing by checking the BSY bit in the
420 FLASH_SR register
421 2. Set the SER bit and select the sector (out of the 12 sectors in the main memory block)
422 you wish to erase (SNB) in the FLASH_CR register
423 3. Set the STRT bit in the FLASH_CR register
424 4. Wait for the BSY bit to be cleared
425 */
426
427 for (i = first; i <= last; i++) {
428 retval = target_write_u32(target,
429 stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_SER | FLASH_SNB(i) | FLASH_STRT);
430 if (retval != ERROR_OK)
431 return retval;
432
433 retval = stm32x_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
434 if (retval != ERROR_OK)
435 return retval;
436
437 bank->sectors[i].is_erased = 1;
438 }
439
440 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
441 if (retval != ERROR_OK)
442 return retval;
443
444 return ERROR_OK;
445 }
446
447 static int stm32x_protect(struct flash_bank *bank, int set, int first, int last)
448 {
449 struct target *target = bank->target;
450 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
451
452 if (target->state != TARGET_HALTED) {
453 LOG_ERROR("Target not halted");
454 return ERROR_TARGET_NOT_HALTED;
455 }
456
457 /* read protection settings */
458 int retval = stm32x_read_options(bank);
459 if (retval != ERROR_OK) {
460 LOG_DEBUG("unable to read option bytes");
461 return retval;
462 }
463
464 for (int i = first; i <= last; i++) {
465
466 if (set)
467 stm32x_info->option_bytes.protection &= ~(1 << i);
468 else
469 stm32x_info->option_bytes.protection |= (1 << i);
470 }
471
472 retval = stm32x_write_options(bank);
473 if (retval != ERROR_OK)
474 return retval;
475
476 return ERROR_OK;
477 }
478
479 static int stm32x_write_block(struct flash_bank *bank, uint8_t *buffer,
480 uint32_t offset, uint32_t count)
481 {
482 struct target *target = bank->target;
483 uint32_t buffer_size = 16384;
484 struct working_area *write_algorithm;
485 struct working_area *source;
486 uint32_t address = bank->base + offset;
487 struct reg_param reg_params[5];
488 struct armv7m_algorithm armv7m_info;
489 int retval = ERROR_OK;
490
491 /* see contrib/loaders/flash/stm32f2x.S for src */
492
493 static const uint8_t stm32x_flash_write_code[] = {
494 /* wait_fifo: */
495 0xD0, 0xF8, 0x00, 0x80, /* ldr r8, [r0, #0] */
496 0xB8, 0xF1, 0x00, 0x0F, /* cmp r8, #0 */
497 0x1A, 0xD0, /* beq exit */
498 0x47, 0x68, /* ldr r7, [r0, #4] */
499 0x47, 0x45, /* cmp r7, r8 */
500 0xF7, 0xD0, /* beq wait_fifo */
501
502 0xDF, 0xF8, 0x30, 0x60, /* ldr r6, STM32_PROG16 */
503 0x26, 0x61, /* str r6, [r4, #STM32_FLASH_CR_OFFSET] */
504 0x37, 0xF8, 0x02, 0x6B, /* ldrh r6, [r7], #0x02 */
505 0x22, 0xF8, 0x02, 0x6B, /* strh r6, [r2], #0x02 */
506 /* busy: */
507 0xE6, 0x68, /* ldr r6, [r4, #STM32_FLASH_SR_OFFSET] */
508 0x16, 0xF4, 0x80, 0x3F, /* tst r6, #0x10000 */
509 0xFB, 0xD1, /* bne busy */
510 0x16, 0xF0, 0xF0, 0x0F, /* tst r6, #0xf0 */
511 0x07, 0xD1, /* bne error */
512
513 0x8F, 0x42, /* cmp r7, r1 */
514 0x28, 0xBF, /* it cs */
515 0x00, 0xF1, 0x08, 0x07, /* addcs r7, r0, #8 */
516 0x47, 0x60, /* str r7, [r0, #4] */
517 0x01, 0x3B, /* subs r3, r3, #1 */
518 0x13, 0xB1, /* cbz r3, exit */
519 0xE1, 0xE7, /* b wait_fifo */
520 /* error: */
521 0x00, 0x21, /* movs r1, #0 */
522 0x41, 0x60, /* str r1, [r0, #4] */
523 /* exit: */
524 0x30, 0x46, /* mov r0, r6 */
525 0x00, 0xBE, /* bkpt #0x00 */
526
527 /* <STM32_PROG16>: */
528 0x01, 0x01, 0x00, 0x00, /* .word 0x00000101 */
529 };
530
531 if (target_alloc_working_area(target, sizeof(stm32x_flash_write_code),
532 &write_algorithm) != ERROR_OK) {
533 LOG_WARNING("no working area available, can't do block memory writes");
534 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
535 };
536
537 retval = target_write_buffer(target, write_algorithm->address,
538 sizeof(stm32x_flash_write_code),
539 (uint8_t *)stm32x_flash_write_code);
540 if (retval != ERROR_OK)
541 return retval;
542
543 /* memory buffer */
544 while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
545 buffer_size /= 2;
546 if (buffer_size <= 256) {
547 /* we already allocated the writing code, but failed to get a
548 * buffer, free the algorithm */
549 target_free_working_area(target, write_algorithm);
550
551 LOG_WARNING("no large enough working area available, can't do block memory writes");
552 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
553 }
554 };
555
556 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
557 armv7m_info.core_mode = ARM_MODE_THREAD;
558
559 init_reg_param(&reg_params[0], "r0", 32, PARAM_IN_OUT); /* buffer start, status (out) */
560 init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT); /* buffer end */
561 init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT); /* target address */
562 init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT); /* count (halfword-16bit) */
563 init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT); /* flash base */
564
565 buf_set_u32(reg_params[0].value, 0, 32, source->address);
566 buf_set_u32(reg_params[1].value, 0, 32, source->address + source->size);
567 buf_set_u32(reg_params[2].value, 0, 32, address);
568 buf_set_u32(reg_params[3].value, 0, 32, count);
569 buf_set_u32(reg_params[4].value, 0, 32, STM32_FLASH_BASE);
570
571 retval = target_run_flash_async_algorithm(target, buffer, count, 2,
572 0, NULL,
573 5, reg_params,
574 source->address, source->size,
575 write_algorithm->address, 0,
576 &armv7m_info);
577
578 if (retval == ERROR_FLASH_OPERATION_FAILED) {
579 LOG_ERROR("error executing stm32x flash write algorithm");
580
581 uint32_t error = buf_get_u32(reg_params[0].value, 0, 32) & FLASH_ERROR;
582
583 if (error & FLASH_WRPERR)
584 LOG_ERROR("flash memory write protected");
585
586 if (error != 0) {
587 LOG_ERROR("flash write failed = %08x", error);
588 /* Clear but report errors */
589 target_write_u32(target, STM32_FLASH_SR, error);
590 retval = ERROR_FAIL;
591 }
592 }
593
594 target_free_working_area(target, source);
595 target_free_working_area(target, write_algorithm);
596
597 destroy_reg_param(&reg_params[0]);
598 destroy_reg_param(&reg_params[1]);
599 destroy_reg_param(&reg_params[2]);
600 destroy_reg_param(&reg_params[3]);
601 destroy_reg_param(&reg_params[4]);
602
603 return retval;
604 }
605
606 static int stm32x_write(struct flash_bank *bank, uint8_t *buffer,
607 uint32_t offset, uint32_t count)
608 {
609 struct target *target = bank->target;
610 uint32_t words_remaining = (count / 2);
611 uint32_t bytes_remaining = (count & 0x00000001);
612 uint32_t address = bank->base + offset;
613 uint32_t bytes_written = 0;
614 int retval;
615
616 if (bank->target->state != TARGET_HALTED) {
617 LOG_ERROR("Target not halted");
618 return ERROR_TARGET_NOT_HALTED;
619 }
620
621 if (offset & 0x1) {
622 LOG_WARNING("offset 0x%" PRIx32 " breaks required 2-byte alignment", offset);
623 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
624 }
625
626 retval = stm32x_unlock_reg(target);
627 if (retval != ERROR_OK)
628 return retval;
629
630 /* multiple half words (2-byte) to be programmed? */
631 if (words_remaining > 0) {
632 /* try using a block write */
633 retval = stm32x_write_block(bank, buffer, offset, words_remaining);
634 if (retval != ERROR_OK) {
635 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
636 /* if block write failed (no sufficient working area),
637 * we use normal (slow) single dword accesses */
638 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
639 }
640 } else {
641 buffer += words_remaining * 2;
642 address += words_remaining * 2;
643 words_remaining = 0;
644 }
645 }
646
647 if ((retval != ERROR_OK) && (retval != ERROR_TARGET_RESOURCE_NOT_AVAILABLE))
648 return retval;
649
650 /*
651 Standard programming
652 The Flash memory programming sequence is as follows:
653 1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the
654 FLASH_SR register.
655 2. Set the PG bit in the FLASH_CR register
656 3. Perform the data write operation(s) to the desired memory address (inside main
657 memory block or OTP area):
658 – – Half-word access in case of x16 parallelism
659 – Word access in case of x32 parallelism
660 –
661 4.
662 Byte access in case of x8 parallelism
663 Double word access in case of x64 parallelism
664 Wait for the BSY bit to be cleared
665 */
666 while (words_remaining > 0) {
667 uint16_t value;
668 memcpy(&value, buffer + bytes_written, sizeof(uint16_t));
669
670 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
671 FLASH_PG | FLASH_PSIZE_16);
672 if (retval != ERROR_OK)
673 return retval;
674
675 retval = target_write_u16(target, address, value);
676 if (retval != ERROR_OK)
677 return retval;
678
679 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
680 if (retval != ERROR_OK)
681 return retval;
682
683 bytes_written += 2;
684 words_remaining--;
685 address += 2;
686 }
687
688 if (bytes_remaining) {
689 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
690 FLASH_PG | FLASH_PSIZE_8);
691 if (retval != ERROR_OK)
692 return retval;
693 retval = target_write_u8(target, address, buffer[bytes_written]);
694 if (retval != ERROR_OK)
695 return retval;
696
697 retval = stm32x_wait_status_busy(bank, FLASH_WRITE_TIMEOUT);
698 if (retval != ERROR_OK)
699 return retval;
700 }
701
702 return target_write_u32(target, STM32_FLASH_CR, FLASH_LOCK);
703 }
704
705 static void setup_sector(struct flash_bank *bank, int start, int num, int size)
706 {
707 for (int i = start; i < (start + num) ; i++) {
708 assert(i < bank->num_sectors);
709 bank->sectors[i].offset = bank->size;
710 bank->sectors[i].size = size;
711 bank->size += bank->sectors[i].size;
712 }
713 }
714
715 static int stm32x_get_device_id(struct flash_bank *bank, uint32_t *device_id)
716 {
717 /* this checks for a stm32f4x errata issue where a
718 * stm32f2x DBGMCU_IDCODE is incorrectly returned.
719 * If the issue is detected target is forced to stm32f4x Rev A.
720 * Only effects Rev A silicon */
721
722 struct target *target = bank->target;
723 uint32_t cpuid;
724
725 /* read stm32 device id register */
726 int retval = target_read_u32(target, 0xE0042000, device_id);
727 if (retval != ERROR_OK)
728 return retval;
729
730 if ((*device_id & 0xfff) == 0x411) {
731 /* read CPUID reg to check core type */
732 retval = target_read_u32(target, 0xE000ED00, &cpuid);
733 if (retval != ERROR_OK)
734 return retval;
735
736 /* check for cortex_m4 */
737 if (((cpuid >> 4) & 0xFFF) == 0xC24) {
738 *device_id &= ~((0xFFFF << 16) | 0xfff);
739 *device_id |= (0x1000 << 16) | 0x413;
740 LOG_INFO("stm32f4x errata detected - fixing incorrect MCU_IDCODE");
741 }
742 }
743 return retval;
744 }
745
746 static int stm32x_probe(struct flash_bank *bank)
747 {
748 struct target *target = bank->target;
749 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
750 int i;
751 uint16_t flash_size_in_kb;
752 uint16_t max_flash_size_in_kb;
753 uint32_t device_id;
754 uint32_t base_address = 0x08000000;
755
756 stm32x_info->probed = 0;
757 stm32x_info->has_large_mem = false;
758
759 /* read stm32 device id register */
760 int retval = stm32x_get_device_id(bank, &device_id);
761 if (retval != ERROR_OK)
762 return retval;
763 LOG_INFO("device id = 0x%08" PRIx32 "", device_id);
764
765 /* set max flash size depending on family */
766 switch (device_id & 0xfff) {
767 case 0x411:
768 case 0x413:
769 max_flash_size_in_kb = 1024;
770 break;
771 case 0x419:
772 max_flash_size_in_kb = 2048;
773 stm32x_info->has_large_mem = true;
774 break;
775 case 0x423:
776 max_flash_size_in_kb = 256;
777 break;
778 default:
779 LOG_WARNING("Cannot identify target as a STM32 family.");
780 return ERROR_FAIL;
781 }
782
783 /* get flash size from target. */
784 retval = target_read_u16(target, 0x1FFF7A22, &flash_size_in_kb);
785
786 /* failed reading flash size or flash size invalid (early silicon),
787 * default to max target family */
788 if (retval != ERROR_OK || flash_size_in_kb == 0xffff || flash_size_in_kb == 0) {
789 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming %dk flash",
790 max_flash_size_in_kb);
791 flash_size_in_kb = max_flash_size_in_kb;
792 }
793
794 /* if the user sets the size manually then ignore the probed value
795 * this allows us to work around devices that have a invalid flash size register value */
796 if (stm32x_info->user_bank_size) {
797 LOG_INFO("ignoring flash probed value, using configured bank size");
798 flash_size_in_kb = stm32x_info->user_bank_size / 1024;
799 }
800
801 LOG_INFO("flash size = %dkbytes", flash_size_in_kb);
802
803 /* did we assign flash size? */
804 assert(flash_size_in_kb != 0xffff);
805
806 /* calculate numbers of pages */
807 int num_pages = (flash_size_in_kb / 128) + 4;
808
809 /* check for larger 2048 bytes devices */
810 if (stm32x_info->has_large_mem)
811 num_pages += 4;
812
813 /* check that calculation result makes sense */
814 assert(num_pages > 0);
815
816 if (bank->sectors) {
817 free(bank->sectors);
818 bank->sectors = NULL;
819 }
820
821 bank->base = base_address;
822 bank->num_sectors = num_pages;
823 bank->sectors = malloc(sizeof(struct flash_sector) * num_pages);
824 bank->size = 0;
825
826 /* fixed memory */
827 setup_sector(bank, 0, 4, 16 * 1024);
828 setup_sector(bank, 4, 1, 64 * 1024);
829
830 /* dynamic memory */
831 setup_sector(bank, 4 + 1, MIN(12, num_pages) - 5, 128 * 1024);
832
833 if (stm32x_info->has_large_mem) {
834
835 /* fixed memory for larger devices */
836 setup_sector(bank, 12, 4, 16 * 1024);
837 setup_sector(bank, 16, 1, 64 * 1024);
838
839 /* dynamic memory for larger devices */
840 setup_sector(bank, 16 + 1, num_pages - 5 - 12, 128 * 1024);
841 }
842
843 for (i = 0; i < num_pages; i++) {
844 bank->sectors[i].is_erased = -1;
845 bank->sectors[i].is_protected = 0;
846 }
847
848 stm32x_info->probed = 1;
849
850 return ERROR_OK;
851 }
852
853 static int stm32x_auto_probe(struct flash_bank *bank)
854 {
855 struct stm32x_flash_bank *stm32x_info = bank->driver_priv;
856 if (stm32x_info->probed)
857 return ERROR_OK;
858 return stm32x_probe(bank);
859 }
860
861 static int get_stm32x_info(struct flash_bank *bank, char *buf, int buf_size)
862 {
863 uint32_t dbgmcu_idcode;
864
865 /* read stm32 device id register */
866 int retval = stm32x_get_device_id(bank, &dbgmcu_idcode);
867 if (retval != ERROR_OK)
868 return retval;
869
870 uint16_t device_id = dbgmcu_idcode & 0xfff;
871 uint16_t rev_id = dbgmcu_idcode >> 16;
872 const char *device_str;
873 const char *rev_str = NULL;
874
875 switch (device_id) {
876 case 0x411:
877 device_str = "STM32F2xx";
878
879 switch (rev_id) {
880 case 0x1000:
881 rev_str = "A";
882 break;
883
884 case 0x2000:
885 rev_str = "B";
886 break;
887
888 case 0x1001:
889 rev_str = "Z";
890 break;
891
892 case 0x2001:
893 rev_str = "Y";
894 break;
895
896 case 0x2003:
897 rev_str = "X";
898 break;
899 }
900 break;
901
902 case 0x413:
903 case 0x419:
904 device_str = "STM32F4xx";
905
906 switch (rev_id) {
907 case 0x1000:
908 rev_str = "A";
909 break;
910
911 case 0x1001:
912 rev_str = "Z";
913 break;
914 }
915 break;
916
917 case 0x423:
918 device_str = "STM32F4xx (Low Power)";
919
920 switch (rev_id) {
921 case 0x1000:
922 rev_str = "A";
923 break;
924
925 case 0x1001:
926 rev_str = "Z";
927 break;
928 }
929 break;
930
931 default:
932 snprintf(buf, buf_size, "Cannot identify target as a STM32F2/4\n");
933 return ERROR_FAIL;
934 }
935
936 if (rev_str != NULL)
937 snprintf(buf, buf_size, "%s - Rev: %s", device_str, rev_str);
938 else
939 snprintf(buf, buf_size, "%s - Rev: unknown (0x%04x)", device_str, rev_id);
940
941 return ERROR_OK;
942 }
943
944 COMMAND_HANDLER(stm32x_handle_lock_command)
945 {
946 struct target *target = NULL;
947 struct stm32x_flash_bank *stm32x_info = NULL;
948
949 if (CMD_ARGC < 1)
950 return ERROR_COMMAND_SYNTAX_ERROR;
951
952 struct flash_bank *bank;
953 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
954 if (ERROR_OK != retval)
955 return retval;
956
957 stm32x_info = bank->driver_priv;
958 target = bank->target;
959
960 if (target->state != TARGET_HALTED) {
961 LOG_ERROR("Target not halted");
962 return ERROR_TARGET_NOT_HALTED;
963 }
964
965 if (stm32x_read_options(bank) != ERROR_OK) {
966 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
967 return ERROR_OK;
968 }
969
970 /* set readout protection */
971 stm32x_info->option_bytes.RDP = 0;
972
973 if (stm32x_write_options(bank) != ERROR_OK) {
974 command_print(CMD_CTX, "%s failed to lock device", bank->driver->name);
975 return ERROR_OK;
976 }
977
978 command_print(CMD_CTX, "%s locked", bank->driver->name);
979
980 return ERROR_OK;
981 }
982
983 COMMAND_HANDLER(stm32x_handle_unlock_command)
984 {
985 struct target *target = NULL;
986 struct stm32x_flash_bank *stm32x_info = NULL;
987
988 if (CMD_ARGC < 1)
989 return ERROR_COMMAND_SYNTAX_ERROR;
990
991 struct flash_bank *bank;
992 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
993 if (ERROR_OK != retval)
994 return retval;
995
996 stm32x_info = bank->driver_priv;
997 target = bank->target;
998
999 if (target->state != TARGET_HALTED) {
1000 LOG_ERROR("Target not halted");
1001 return ERROR_TARGET_NOT_HALTED;
1002 }
1003
1004 if (stm32x_read_options(bank) != ERROR_OK) {
1005 command_print(CMD_CTX, "%s failed to read options", bank->driver->name);
1006 return ERROR_OK;
1007 }
1008
1009 /* clear readout protection and complementary option bytes
1010 * this will also force a device unlock if set */
1011 stm32x_info->option_bytes.RDP = 0xAA;
1012
1013 if (stm32x_write_options(bank) != ERROR_OK) {
1014 command_print(CMD_CTX, "%s failed to unlock device", bank->driver->name);
1015 return ERROR_OK;
1016 }
1017
1018 command_print(CMD_CTX, "%s unlocked.\n"
1019 "INFO: a reset or power cycle is required "
1020 "for the new settings to take effect.", bank->driver->name);
1021
1022 return ERROR_OK;
1023 }
1024
1025 static int stm32x_mass_erase(struct flash_bank *bank)
1026 {
1027 int retval;
1028 struct target *target = bank->target;
1029 struct stm32x_flash_bank *stm32x_info = NULL;
1030
1031 if (target->state != TARGET_HALTED) {
1032 LOG_ERROR("Target not halted");
1033 return ERROR_TARGET_NOT_HALTED;
1034 }
1035
1036 stm32x_info = bank->driver_priv;
1037
1038 retval = stm32x_unlock_reg(target);
1039 if (retval != ERROR_OK)
1040 return retval;
1041
1042 /* mass erase flash memory */
1043 if (stm32x_info->has_large_mem)
1044 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER | FLASH_MER1);
1045 else
1046 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_MER);
1047 if (retval != ERROR_OK)
1048 return retval;
1049 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR),
1050 FLASH_MER | FLASH_STRT);
1051 if (retval != ERROR_OK)
1052 return retval;
1053
1054 retval = stm32x_wait_status_busy(bank, 30000);
1055 if (retval != ERROR_OK)
1056 return retval;
1057
1058 retval = target_write_u32(target, stm32x_get_flash_reg(bank, STM32_FLASH_CR), FLASH_LOCK);
1059 if (retval != ERROR_OK)
1060 return retval;
1061
1062 return ERROR_OK;
1063 }
1064
1065 COMMAND_HANDLER(stm32x_handle_mass_erase_command)
1066 {
1067 int i;
1068
1069 if (CMD_ARGC < 1) {
1070 command_print(CMD_CTX, "stm32x mass_erase <bank>");
1071 return ERROR_COMMAND_SYNTAX_ERROR;
1072 }
1073
1074 struct flash_bank *bank;
1075 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1076 if (ERROR_OK != retval)
1077 return retval;
1078
1079 retval = stm32x_mass_erase(bank);
1080 if (retval == ERROR_OK) {
1081 /* set all sectors as erased */
1082 for (i = 0; i < bank->num_sectors; i++)
1083 bank->sectors[i].is_erased = 1;
1084
1085 command_print(CMD_CTX, "stm32x mass erase complete");
1086 } else {
1087 command_print(CMD_CTX, "stm32x mass erase failed");
1088 }
1089
1090 return retval;
1091 }
1092
1093 static const struct command_registration stm32x_exec_command_handlers[] = {
1094 {
1095 .name = "lock",
1096 .handler = stm32x_handle_lock_command,
1097 .mode = COMMAND_EXEC,
1098 .usage = "bank_id",
1099 .help = "Lock entire flash device.",
1100 },
1101 {
1102 .name = "unlock",
1103 .handler = stm32x_handle_unlock_command,
1104 .mode = COMMAND_EXEC,
1105 .usage = "bank_id",
1106 .help = "Unlock entire protected flash device.",
1107 },
1108 {
1109 .name = "mass_erase",
1110 .handler = stm32x_handle_mass_erase_command,
1111 .mode = COMMAND_EXEC,
1112 .usage = "bank_id",
1113 .help = "Erase entire flash device.",
1114 },
1115 COMMAND_REGISTRATION_DONE
1116 };
1117
1118 static const struct command_registration stm32x_command_handlers[] = {
1119 {
1120 .name = "stm32f2x",
1121 .mode = COMMAND_ANY,
1122 .help = "stm32f2x flash command group",
1123 .usage = "",
1124 .chain = stm32x_exec_command_handlers,
1125 },
1126 COMMAND_REGISTRATION_DONE
1127 };
1128
1129 struct flash_driver stm32f2x_flash = {
1130 .name = "stm32f2x",
1131 .commands = stm32x_command_handlers,
1132 .flash_bank_command = stm32x_flash_bank_command,
1133 .erase = stm32x_erase,
1134 .protect = stm32x_protect,
1135 .write = stm32x_write,
1136 .read = default_flash_read,
1137 .probe = stm32x_probe,
1138 .auto_probe = stm32x_auto_probe,
1139 .erase_check = default_flash_blank_check,
1140 .protect_check = stm32x_protect_check,
1141 .info = get_stm32x_info,
1142 };
Open On-Chip Debugger

Linking to existing account procedure

If you already have an account and want to add another login method you MUST first sign in with your existing account and then change URL to read https://review.openocd.org/login/?link to get to this page again but this time it'll work for linking. Thank you.

SSH host keys fingerprints

1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=..              |
|+o..   .         |
|*.o   . .        |
|+B . . .         |
|Bo. = o S        |
|Oo.+ + =         |
|oB=.* = . o      |
| =+=.+   + E     |
|. .=o   . o      |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)