ipdbg: fix double free of virtual-ir data
[openocd.git] / src / flash / nor / stm32lx.c
blob1459e942d1e27007e07b27789067ade9600aace7
1 // SPDX-License-Identifier: GPL-2.0-or-later
3 /***************************************************************************
4 * Copyright (C) 2005 by Dominic Rath *
5 * Dominic.Rath@gmx.de *
6 * *
7 * Copyright (C) 2008 by Spencer Oliver *
8 * spen@spen-soft.co.uk *
9 * *
10 * Copyright (C) 2011 by Clement Burin des Roziers *
11 * clement.burin-des-roziers@hikob.com *
12 ***************************************************************************/
14 #ifdef HAVE_CONFIG_H
15 #include "config.h"
16 #endif
18 #include "imp.h"
19 #include <helper/binarybuffer.h>
20 #include <target/algorithm.h>
21 #include <target/armv7m.h>
22 #include <target/cortex_m.h>
24 /* stm32lx flash register locations */
26 #define FLASH_ACR 0x00
27 #define FLASH_PECR 0x04
28 #define FLASH_PDKEYR 0x08
29 #define FLASH_PEKEYR 0x0C
30 #define FLASH_PRGKEYR 0x10
31 #define FLASH_OPTKEYR 0x14
32 #define FLASH_SR 0x18
33 #define FLASH_OBR 0x1C
34 #define FLASH_WRPR 0x20
36 /* FLASH_ACR bites */
37 #define FLASH_ACR__LATENCY (1<<0)
38 #define FLASH_ACR__PRFTEN (1<<1)
39 #define FLASH_ACR__ACC64 (1<<2)
40 #define FLASH_ACR__SLEEP_PD (1<<3)
41 #define FLASH_ACR__RUN_PD (1<<4)
43 /* FLASH_PECR bits */
44 #define FLASH_PECR__PELOCK (1<<0)
45 #define FLASH_PECR__PRGLOCK (1<<1)
46 #define FLASH_PECR__OPTLOCK (1<<2)
47 #define FLASH_PECR__PROG (1<<3)
48 #define FLASH_PECR__DATA (1<<4)
49 #define FLASH_PECR__FTDW (1<<8)
50 #define FLASH_PECR__ERASE (1<<9)
51 #define FLASH_PECR__FPRG (1<<10)
52 #define FLASH_PECR__EOPIE (1<<16)
53 #define FLASH_PECR__ERRIE (1<<17)
54 #define FLASH_PECR__OBL_LAUNCH (1<<18)
56 /* FLASH_SR bits */
57 #define FLASH_SR__BSY (1<<0)
58 #define FLASH_SR__EOP (1<<1)
59 #define FLASH_SR__ENDHV (1<<2)
60 #define FLASH_SR__READY (1<<3)
61 #define FLASH_SR__WRPERR (1<<8)
62 #define FLASH_SR__PGAERR (1<<9)
63 #define FLASH_SR__SIZERR (1<<10)
64 #define FLASH_SR__OPTVERR (1<<11)
66 /* Unlock keys */
67 #define PEKEY1 0x89ABCDEF
68 #define PEKEY2 0x02030405
69 #define PRGKEY1 0x8C9DAEBF
70 #define PRGKEY2 0x13141516
71 #define OPTKEY1 0xFBEAD9C8
72 #define OPTKEY2 0x24252627
74 /* other registers */
75 #define DBGMCU_IDCODE 0xE0042000
76 #define DBGMCU_IDCODE_L0 0x40015800
78 /* Constants */
79 #define FLASH_SECTOR_SIZE 4096
80 #define FLASH_BANK0_ADDRESS 0x08000000
82 /* option bytes */
83 #define OPTION_BYTES_ADDRESS 0x1FF80000
85 #define OPTION_BYTE_0_PR1 0xFFFF0000
86 #define OPTION_BYTE_0_PR0 0xFF5500AA
88 static int stm32lx_unlock_program_memory(struct flash_bank *bank);
89 static int stm32lx_lock_program_memory(struct flash_bank *bank);
90 static int stm32lx_enable_write_half_page(struct flash_bank *bank);
91 static int stm32lx_erase_sector(struct flash_bank *bank, int sector);
92 static int stm32lx_wait_until_bsy_clear(struct flash_bank *bank);
93 static int stm32lx_lock(struct flash_bank *bank);
94 static int stm32lx_unlock(struct flash_bank *bank);
95 static int stm32lx_mass_erase(struct flash_bank *bank);
96 static int stm32lx_wait_until_bsy_clear_timeout(struct flash_bank *bank, int timeout);
97 static int stm32lx_update_part_info(struct flash_bank *bank, uint16_t flash_size_in_kb);
99 struct stm32lx_rev {
100 uint16_t rev;
101 const char *str;
104 struct stm32lx_part_info {
105 uint16_t id;
106 const char *device_str;
107 const struct stm32lx_rev *revs;
108 size_t num_revs;
109 unsigned int page_size;
110 unsigned int pages_per_sector;
111 uint16_t max_flash_size_kb;
112 uint16_t first_bank_size_kb; /* used when has_dual_banks is true */
113 bool has_dual_banks;
115 uint32_t flash_base; /* Flash controller registers location */
116 uint32_t fsize_base; /* Location of FSIZE register */
119 struct stm32lx_flash_bank {
120 bool probed;
121 uint32_t idcode;
122 uint32_t user_bank_size;
123 uint32_t flash_base;
125 struct stm32lx_part_info part_info;
128 static const struct stm32lx_rev stm32_416_revs[] = {
129 { 0x1000, "A" }, { 0x1008, "Y" }, { 0x1038, "W" }, { 0x1078, "V" },
131 static const struct stm32lx_rev stm32_417_revs[] = {
132 { 0x1000, "A" }, { 0x1008, "Z" }, { 0x1018, "Y" }, { 0x1038, "X" }
134 static const struct stm32lx_rev stm32_425_revs[] = {
135 { 0x1000, "A" }, { 0x2000, "B" }, { 0x2008, "Y" }, { 0x2018, "1, X" },
137 static const struct stm32lx_rev stm32_427_revs[] = {
138 { 0x1000, "A" }, { 0x1018, "Y" }, { 0x1038, "X" }, { 0x10f8, "V" },
140 static const struct stm32lx_rev stm32_429_revs[] = {
141 { 0x1000, "A" }, { 0x1018, "Z" },
143 static const struct stm32lx_rev stm32_436_revs[] = {
144 { 0x1000, "A" }, { 0x1008, "Z" }, { 0x1018, "Y" }, { 0x1038, "X" },
146 static const struct stm32lx_rev stm32_437_revs[] = {
147 { 0x1000, "A" },
149 static const struct stm32lx_rev stm32_447_revs[] = {
150 { 0x1000, "A" }, { 0x2000, "B" }, { 0x2008, "Z" },
152 static const struct stm32lx_rev stm32_457_revs[] = {
153 { 0x1000, "A" }, { 0x1008, "Z" },
156 static const struct stm32lx_part_info stm32lx_parts[] = {
158 .id = 0x416,
159 .revs = stm32_416_revs,
160 .num_revs = ARRAY_SIZE(stm32_416_revs),
161 .device_str = "STM32L1xx (Cat.1 - Low/Medium Density)",
162 .page_size = 256,
163 .pages_per_sector = 16,
164 .max_flash_size_kb = 128,
165 .has_dual_banks = false,
166 .flash_base = 0x40023C00,
167 .fsize_base = 0x1FF8004C,
170 .id = 0x417,
171 .revs = stm32_417_revs,
172 .num_revs = ARRAY_SIZE(stm32_417_revs),
173 .device_str = "STM32L0xx (Cat. 3)",
174 .page_size = 128,
175 .pages_per_sector = 32,
176 .max_flash_size_kb = 64,
177 .has_dual_banks = false,
178 .flash_base = 0x40022000,
179 .fsize_base = 0x1FF8007C,
182 .id = 0x425,
183 .revs = stm32_425_revs,
184 .num_revs = ARRAY_SIZE(stm32_425_revs),
185 .device_str = "STM32L0xx (Cat. 2)",
186 .page_size = 128,
187 .pages_per_sector = 32,
188 .max_flash_size_kb = 32,
189 .has_dual_banks = false,
190 .flash_base = 0x40022000,
191 .fsize_base = 0x1FF8007C,
194 .id = 0x427,
195 .revs = stm32_427_revs,
196 .num_revs = ARRAY_SIZE(stm32_427_revs),
197 .device_str = "STM32L1xx (Cat.3 - Medium+ Density)",
198 .page_size = 256,
199 .pages_per_sector = 16,
200 .max_flash_size_kb = 256,
201 .has_dual_banks = false,
202 .flash_base = 0x40023C00,
203 .fsize_base = 0x1FF800CC,
206 .id = 0x429,
207 .revs = stm32_429_revs,
208 .num_revs = ARRAY_SIZE(stm32_429_revs),
209 .device_str = "STM32L1xx (Cat.2)",
210 .page_size = 256,
211 .pages_per_sector = 16,
212 .max_flash_size_kb = 128,
213 .has_dual_banks = false,
214 .flash_base = 0x40023C00,
215 .fsize_base = 0x1FF8004C,
218 .id = 0x436,
219 .revs = stm32_436_revs,
220 .num_revs = ARRAY_SIZE(stm32_436_revs),
221 .device_str = "STM32L1xx (Cat.4/Cat.3 - Medium+/High Density)",
222 .page_size = 256,
223 .pages_per_sector = 16,
224 .max_flash_size_kb = 384,
225 .first_bank_size_kb = 192,
226 .has_dual_banks = true,
227 .flash_base = 0x40023C00,
228 .fsize_base = 0x1FF800CC,
231 .id = 0x437,
232 .revs = stm32_437_revs,
233 .num_revs = ARRAY_SIZE(stm32_437_revs),
234 .device_str = "STM32L1xx (Cat.5/Cat.6)",
235 .page_size = 256,
236 .pages_per_sector = 16,
237 .max_flash_size_kb = 512,
238 .first_bank_size_kb = 0, /* determined in runtime */
239 .has_dual_banks = true,
240 .flash_base = 0x40023C00,
241 .fsize_base = 0x1FF800CC,
244 .id = 0x447,
245 .revs = stm32_447_revs,
246 .num_revs = ARRAY_SIZE(stm32_447_revs),
247 .device_str = "STM32L0xx (Cat.5)",
248 .page_size = 128,
249 .pages_per_sector = 32,
250 .max_flash_size_kb = 192,
251 .first_bank_size_kb = 0, /* determined in runtime */
252 .has_dual_banks = false, /* determined in runtime */
253 .flash_base = 0x40022000,
254 .fsize_base = 0x1FF8007C,
257 .id = 0x457,
258 .revs = stm32_457_revs,
259 .num_revs = ARRAY_SIZE(stm32_457_revs),
260 .device_str = "STM32L0xx (Cat.1)",
261 .page_size = 128,
262 .pages_per_sector = 32,
263 .max_flash_size_kb = 16,
264 .has_dual_banks = false,
265 .flash_base = 0x40022000,
266 .fsize_base = 0x1FF8007C,
270 /* flash bank stm32lx <base> <size> 0 0 <target#>
272 FLASH_BANK_COMMAND_HANDLER(stm32lx_flash_bank_command)
274 struct stm32lx_flash_bank *stm32lx_info;
275 if (CMD_ARGC < 6)
276 return ERROR_COMMAND_SYNTAX_ERROR;
278 /* Create the bank structure */
279 stm32lx_info = calloc(1, sizeof(*stm32lx_info));
281 /* Check allocation */
282 if (!stm32lx_info) {
283 LOG_ERROR("failed to allocate bank structure");
284 return ERROR_FAIL;
287 bank->driver_priv = stm32lx_info;
289 stm32lx_info->probed = false;
290 stm32lx_info->user_bank_size = bank->size;
292 /* the stm32l erased value is 0x00 */
293 bank->default_padded_value = bank->erased_value = 0x00;
295 return ERROR_OK;
298 COMMAND_HANDLER(stm32lx_handle_mass_erase_command)
300 if (CMD_ARGC < 1)
301 return ERROR_COMMAND_SYNTAX_ERROR;
303 struct flash_bank *bank;
304 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
305 if (retval != ERROR_OK)
306 return retval;
308 retval = stm32lx_mass_erase(bank);
309 if (retval == ERROR_OK)
310 command_print(CMD, "stm32lx mass erase complete");
311 else
312 command_print(CMD, "stm32lx mass erase failed");
314 return retval;
317 COMMAND_HANDLER(stm32lx_handle_lock_command)
319 if (CMD_ARGC < 1)
320 return ERROR_COMMAND_SYNTAX_ERROR;
322 struct flash_bank *bank;
323 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
324 if (retval != ERROR_OK)
325 return retval;
327 retval = stm32lx_lock(bank);
329 if (retval == ERROR_OK)
330 command_print(CMD, "STM32Lx locked, takes effect after power cycle.");
331 else
332 command_print(CMD, "STM32Lx lock failed");
334 return retval;
337 COMMAND_HANDLER(stm32lx_handle_unlock_command)
339 if (CMD_ARGC < 1)
340 return ERROR_COMMAND_SYNTAX_ERROR;
342 struct flash_bank *bank;
343 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
344 if (retval != ERROR_OK)
345 return retval;
347 retval = stm32lx_unlock(bank);
349 if (retval == ERROR_OK)
350 command_print(CMD, "STM32Lx unlocked, takes effect after power cycle.");
351 else
352 command_print(CMD, "STM32Lx unlock failed");
354 return retval;
357 static int stm32lx_protect_check(struct flash_bank *bank)
359 int retval;
360 struct target *target = bank->target;
361 struct stm32lx_flash_bank *stm32lx_info = bank->driver_priv;
363 uint32_t wrpr;
366 * Read the WRPR word, and check each bit (corresponding to each
367 * flash sector
369 retval = target_read_u32(target, stm32lx_info->flash_base + FLASH_WRPR,
370 &wrpr);
371 if (retval != ERROR_OK)
372 return retval;
374 for (unsigned int i = 0; i < bank->num_sectors; i++) {
375 if (wrpr & (1 << i))
376 bank->sectors[i].is_protected = 1;
377 else
378 bank->sectors[i].is_protected = 0;
380 return ERROR_OK;
383 static int stm32lx_erase(struct flash_bank *bank, unsigned int first,
384 unsigned int last)
386 int retval;
389 * It could be possible to do a mass erase if all sectors must be
390 * erased, but it is not implemented yet.
393 if (bank->target->state != TARGET_HALTED) {
394 LOG_ERROR("Target not halted");
395 return ERROR_TARGET_NOT_HALTED;
399 * Loop over the selected sectors and erase them
401 for (unsigned int i = first; i <= last; i++) {
402 retval = stm32lx_erase_sector(bank, i);
403 if (retval != ERROR_OK)
404 return retval;
405 bank->sectors[i].is_erased = 1;
407 return ERROR_OK;
410 static int stm32lx_write_half_pages(struct flash_bank *bank, const uint8_t *buffer,
411 uint32_t offset, uint32_t count)
413 struct target *target = bank->target;
414 struct stm32lx_flash_bank *stm32lx_info = bank->driver_priv;
416 uint32_t hp_nb = stm32lx_info->part_info.page_size / 2;
417 uint32_t buffer_size = (16384 / hp_nb) * hp_nb; /* must be multiple of hp_nb */
418 struct working_area *write_algorithm;
419 struct working_area *source;
420 uint32_t address = bank->base + offset;
422 struct reg_param reg_params[5];
423 struct armv7m_algorithm armv7m_info;
425 int retval = ERROR_OK;
427 static const uint8_t stm32lx_flash_write_code[] = {
428 #include "../../../contrib/loaders/flash/stm32/stm32lx.inc"
431 /* Make sure we're performing a half-page aligned write. */
432 if (offset % hp_nb) {
433 LOG_ERROR("The offset must be %" PRIu32 "B-aligned but it is %" PRIi32 "B)", hp_nb, offset);
434 return ERROR_FAIL;
436 if (count % hp_nb) {
437 LOG_ERROR("The byte count must be %" PRIu32 "B-aligned but count is %" PRIu32 "B)", hp_nb, count);
438 return ERROR_FAIL;
441 /* flash write code */
442 if (target_alloc_working_area(target, sizeof(stm32lx_flash_write_code),
443 &write_algorithm) != ERROR_OK) {
444 LOG_DEBUG("no working area for block memory writes");
445 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
448 /* Write the flashing code */
449 retval = target_write_buffer(target,
450 write_algorithm->address,
451 sizeof(stm32lx_flash_write_code),
452 stm32lx_flash_write_code);
453 if (retval != ERROR_OK) {
454 target_free_working_area(target, write_algorithm);
455 return retval;
458 /* Allocate half pages memory */
459 while (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
460 if (buffer_size > 1024)
461 buffer_size -= 1024;
462 else
463 buffer_size /= 2;
465 if (buffer_size <= stm32lx_info->part_info.page_size) {
466 /* we already allocated the writing code, but failed to get a
467 * buffer, free the algorithm */
468 target_free_working_area(target, write_algorithm);
470 LOG_WARNING("no large enough working area available, can't do block memory writes");
471 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
472 } else {
473 /* Make sure we're still asking for an integral number of half-pages */
474 buffer_size -= buffer_size % hp_nb;
478 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
479 armv7m_info.core_mode = ARM_MODE_THREAD;
480 init_reg_param(&reg_params[0], "r0", 32, PARAM_OUT);
481 init_reg_param(&reg_params[1], "r1", 32, PARAM_OUT);
482 init_reg_param(&reg_params[2], "r2", 32, PARAM_OUT);
483 init_reg_param(&reg_params[3], "r3", 32, PARAM_OUT);
484 init_reg_param(&reg_params[4], "r4", 32, PARAM_OUT);
486 /* Enable half-page write */
487 retval = stm32lx_enable_write_half_page(bank);
488 if (retval != ERROR_OK) {
489 target_free_working_area(target, source);
490 target_free_working_area(target, write_algorithm);
492 destroy_reg_param(&reg_params[0]);
493 destroy_reg_param(&reg_params[1]);
494 destroy_reg_param(&reg_params[2]);
495 destroy_reg_param(&reg_params[3]);
496 destroy_reg_param(&reg_params[4]);
497 return retval;
500 struct armv7m_common *armv7m = target_to_armv7m(target);
501 if (!armv7m) {
503 /* something is very wrong if armv7m is NULL */
504 LOG_ERROR("unable to get armv7m target");
505 return retval;
508 /* save any DEMCR flags and configure target to catch any Hard Faults */
509 uint32_t demcr_save = armv7m->demcr;
510 armv7m->demcr = VC_HARDERR;
512 /* Loop while there are bytes to write */
513 while (count > 0) {
514 uint32_t this_count;
515 this_count = (count > buffer_size) ? buffer_size : count;
517 /* Write the next half pages */
518 retval = target_write_buffer(target, source->address, this_count, buffer);
519 if (retval != ERROR_OK)
520 break;
522 /* 4: Store useful information in the registers */
523 /* the destination address of the copy (R0) */
524 buf_set_u32(reg_params[0].value, 0, 32, address);
525 /* The source address of the copy (R1) */
526 buf_set_u32(reg_params[1].value, 0, 32, source->address);
527 /* The number of half pages to copy (R2) */
528 buf_set_u32(reg_params[2].value, 0, 32, this_count / hp_nb);
529 /* The size in byes of a half page (R3) */
530 buf_set_u32(reg_params[3].value, 0, 32, hp_nb);
531 /* The flash base address (R4) */
532 buf_set_u32(reg_params[4].value, 0, 32, stm32lx_info->flash_base);
534 /* 5: Execute the bunch of code */
535 retval = target_run_algorithm(target, 0, NULL,
536 ARRAY_SIZE(reg_params), reg_params,
537 write_algorithm->address, 0, 10000, &armv7m_info);
538 if (retval != ERROR_OK)
539 break;
541 /* check for Hard Fault */
542 if (armv7m->exception_number == 3)
543 break;
545 /* 6: Wait while busy */
546 retval = stm32lx_wait_until_bsy_clear(bank);
547 if (retval != ERROR_OK)
548 break;
550 buffer += this_count;
551 address += this_count;
552 count -= this_count;
555 /* restore previous flags */
556 armv7m->demcr = demcr_save;
558 if (armv7m->exception_number == 3) {
560 /* the stm32l15x devices seem to have an issue when blank.
561 * if a ram loader is executed on a blank device it will
562 * Hard Fault, this issue does not happen for a already programmed device.
563 * A related issue is described in the stm32l151xx errata (Doc ID 17721 Rev 6 - 2.1.3).
564 * The workaround of handling the Hard Fault exception does work, but makes the
565 * loader more complicated, as a compromise we manually write the pages, programming time
566 * is reduced by 50% using this slower method.
569 LOG_WARNING("Couldn't use loader, falling back to page memory writes");
571 while (count > 0) {
572 uint32_t this_count;
573 this_count = (count > hp_nb) ? hp_nb : count;
575 /* Write the next half pages */
576 retval = target_write_buffer(target, address, this_count, buffer);
577 if (retval != ERROR_OK)
578 break;
580 /* Wait while busy */
581 retval = stm32lx_wait_until_bsy_clear(bank);
582 if (retval != ERROR_OK)
583 break;
585 buffer += this_count;
586 address += this_count;
587 count -= this_count;
591 if (retval == ERROR_OK)
592 retval = stm32lx_lock_program_memory(bank);
594 target_free_working_area(target, source);
595 target_free_working_area(target, write_algorithm);
597 destroy_reg_param(&reg_params[0]);
598 destroy_reg_param(&reg_params[1]);
599 destroy_reg_param(&reg_params[2]);
600 destroy_reg_param(&reg_params[3]);
601 destroy_reg_param(&reg_params[4]);
603 return retval;
606 static int stm32lx_write(struct flash_bank *bank, const uint8_t *buffer,
607 uint32_t offset, uint32_t count)
609 struct target *target = bank->target;
610 struct stm32lx_flash_bank *stm32lx_info = bank->driver_priv;
612 uint32_t hp_nb = stm32lx_info->part_info.page_size / 2;
613 uint32_t halfpages_number;
614 uint32_t bytes_remaining = 0;
615 uint32_t address = bank->base + offset;
616 uint32_t bytes_written = 0;
617 int retval, retval2;
619 if (bank->target->state != TARGET_HALTED) {
620 LOG_ERROR("Target not halted");
621 return ERROR_TARGET_NOT_HALTED;
624 if (offset & 0x3) {
625 LOG_ERROR("offset 0x%" PRIx32 " breaks required 4-byte alignment", offset);
626 return ERROR_FLASH_DST_BREAKS_ALIGNMENT;
629 retval = stm32lx_unlock_program_memory(bank);
630 if (retval != ERROR_OK)
631 return retval;
633 /* first we need to write any unaligned head bytes up to
634 * the next 128 byte page */
636 if (offset % hp_nb)
637 bytes_remaining = MIN(count, hp_nb - (offset % hp_nb));
639 while (bytes_remaining > 0) {
640 uint8_t value[4] = {0xff, 0xff, 0xff, 0xff};
642 /* copy remaining bytes into the write buffer */
643 uint32_t bytes_to_write = MIN(4, bytes_remaining);
644 memcpy(value, buffer + bytes_written, bytes_to_write);
646 retval = target_write_buffer(target, address, 4, value);
647 if (retval != ERROR_OK)
648 goto reset_pg_and_lock;
650 bytes_written += bytes_to_write;
651 bytes_remaining -= bytes_to_write;
652 address += 4;
654 retval = stm32lx_wait_until_bsy_clear(bank);
655 if (retval != ERROR_OK)
656 goto reset_pg_and_lock;
659 offset += bytes_written;
660 count -= bytes_written;
662 /* this should always pass this check here */
663 assert((offset % hp_nb) == 0);
665 /* calculate half pages */
666 halfpages_number = count / hp_nb;
668 if (halfpages_number) {
669 retval = stm32lx_write_half_pages(bank, buffer + bytes_written, offset, hp_nb * halfpages_number);
670 if (retval == ERROR_TARGET_RESOURCE_NOT_AVAILABLE) {
671 /* attempt slow memory writes */
672 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
673 halfpages_number = 0;
674 } else {
675 if (retval != ERROR_OK)
676 return ERROR_FAIL;
680 /* write any remaining bytes */
681 uint32_t page_bytes_written = hp_nb * halfpages_number;
682 bytes_written += page_bytes_written;
683 address += page_bytes_written;
684 bytes_remaining = count - page_bytes_written;
686 retval = stm32lx_unlock_program_memory(bank);
687 if (retval != ERROR_OK)
688 return retval;
690 while (bytes_remaining > 0) {
691 uint8_t value[4] = {0xff, 0xff, 0xff, 0xff};
693 /* copy remaining bytes into the write buffer */
694 uint32_t bytes_to_write = MIN(4, bytes_remaining);
695 memcpy(value, buffer + bytes_written, bytes_to_write);
697 retval = target_write_buffer(target, address, 4, value);
698 if (retval != ERROR_OK)
699 goto reset_pg_and_lock;
701 bytes_written += bytes_to_write;
702 bytes_remaining -= bytes_to_write;
703 address += 4;
705 retval = stm32lx_wait_until_bsy_clear(bank);
706 if (retval != ERROR_OK)
707 goto reset_pg_and_lock;
710 reset_pg_and_lock:
711 retval2 = stm32lx_lock_program_memory(bank);
712 if (retval == ERROR_OK)
713 retval = retval2;
715 return retval;
718 static int stm32lx_read_id_code(struct target *target, uint32_t *id)
720 struct armv7m_common *armv7m = target_to_armv7m(target);
721 int retval;
722 if (armv7m->arm.arch == ARM_ARCH_V6M)
723 retval = target_read_u32(target, DBGMCU_IDCODE_L0, id);
724 else
725 /* read stm32 device id register */
726 retval = target_read_u32(target, DBGMCU_IDCODE, id);
727 return retval;
730 static int stm32lx_probe(struct flash_bank *bank)
732 struct target *target = bank->target;
733 struct stm32lx_flash_bank *stm32lx_info = bank->driver_priv;
734 uint16_t flash_size_in_kb;
735 uint32_t device_id;
736 uint32_t base_address = FLASH_BANK0_ADDRESS;
737 uint32_t second_bank_base;
738 unsigned int n;
740 stm32lx_info->probed = false;
742 int retval = stm32lx_read_id_code(bank->target, &device_id);
743 if (retval != ERROR_OK)
744 return retval;
746 stm32lx_info->idcode = device_id;
748 LOG_DEBUG("device id = 0x%08" PRIx32 "", device_id);
750 for (n = 0; n < ARRAY_SIZE(stm32lx_parts); n++) {
751 if ((device_id & 0xfff) == stm32lx_parts[n].id) {
752 stm32lx_info->part_info = stm32lx_parts[n];
753 break;
757 if (n == ARRAY_SIZE(stm32lx_parts)) {
758 LOG_ERROR("Cannot identify target as an STM32 L0 or L1 family device.");
759 return ERROR_FAIL;
760 } else {
761 LOG_INFO("Device: %s", stm32lx_info->part_info.device_str);
764 stm32lx_info->flash_base = stm32lx_info->part_info.flash_base;
766 /* Get the flash size from target. */
767 retval = target_read_u16(target, stm32lx_info->part_info.fsize_base,
768 &flash_size_in_kb);
770 /* 0x436 devices report their flash size as a 0 or 1 code indicating 384K
771 * or 256K, respectively. Please see RM0038 r8 or newer and refer to
772 * section 30.1.1. */
773 if (retval == ERROR_OK && (device_id & 0xfff) == 0x436) {
774 if (flash_size_in_kb == 0)
775 flash_size_in_kb = 384;
776 else if (flash_size_in_kb == 1)
777 flash_size_in_kb = 256;
780 /* 0x429 devices only use the lowest 8 bits of the flash size register */
781 if (retval == ERROR_OK && (device_id & 0xfff) == 0x429) {
782 flash_size_in_kb &= 0xff;
785 /* Failed reading flash size or flash size invalid (early silicon),
786 * default to max target family */
787 if (retval != ERROR_OK || flash_size_in_kb == 0xffff || flash_size_in_kb == 0) {
788 LOG_WARNING("STM32L flash size failed, probe inaccurate - assuming %dk flash",
789 stm32lx_info->part_info.max_flash_size_kb);
790 flash_size_in_kb = stm32lx_info->part_info.max_flash_size_kb;
791 } else if (flash_size_in_kb > stm32lx_info->part_info.max_flash_size_kb) {
792 LOG_WARNING("STM32L probed flash size assumed incorrect since FLASH_SIZE=%dk > %dk, - assuming %dk flash",
793 flash_size_in_kb, stm32lx_info->part_info.max_flash_size_kb,
794 stm32lx_info->part_info.max_flash_size_kb);
795 flash_size_in_kb = stm32lx_info->part_info.max_flash_size_kb;
798 /* Overwrite default dual-bank configuration */
799 retval = stm32lx_update_part_info(bank, flash_size_in_kb);
800 if (retval != ERROR_OK)
801 return ERROR_FAIL;
803 if (stm32lx_info->part_info.has_dual_banks) {
804 /* Use the configured base address to determine if this is the first or second flash bank.
805 * Verify that the base address is reasonably correct and determine the flash bank size
807 second_bank_base = base_address +
808 stm32lx_info->part_info.first_bank_size_kb * 1024;
809 if (bank->base == second_bank_base || !bank->base) {
810 /* This is the second bank */
811 base_address = second_bank_base;
812 flash_size_in_kb = flash_size_in_kb -
813 stm32lx_info->part_info.first_bank_size_kb;
814 } else if (bank->base == base_address) {
815 /* This is the first bank */
816 flash_size_in_kb = stm32lx_info->part_info.first_bank_size_kb;
817 } else {
818 LOG_WARNING("STM32L flash bank base address config is incorrect. "
819 TARGET_ADDR_FMT " but should rather be 0x%" PRIx32
820 " or 0x%" PRIx32,
821 bank->base, base_address, second_bank_base);
822 return ERROR_FAIL;
824 LOG_INFO("STM32L flash has dual banks. Bank (%u) size is %dkb, base address is 0x%" PRIx32,
825 bank->bank_number, flash_size_in_kb, base_address);
826 } else {
827 LOG_INFO("STM32L flash size is %dkb, base address is 0x%" PRIx32, flash_size_in_kb, base_address);
830 /* if the user sets the size manually then ignore the probed value
831 * this allows us to work around devices that have a invalid flash size register value */
832 if (stm32lx_info->user_bank_size) {
833 flash_size_in_kb = stm32lx_info->user_bank_size / 1024;
834 LOG_INFO("ignoring flash probed value, using configured bank size: %dkbytes", flash_size_in_kb);
837 /* calculate numbers of sectors (4kB per sector) */
838 unsigned int num_sectors = (flash_size_in_kb * 1024) / FLASH_SECTOR_SIZE;
840 free(bank->sectors);
842 bank->size = flash_size_in_kb * 1024;
843 bank->base = base_address;
844 bank->num_sectors = num_sectors;
845 bank->sectors = malloc(sizeof(struct flash_sector) * num_sectors);
846 if (!bank->sectors) {
847 LOG_ERROR("failed to allocate bank sectors");
848 return ERROR_FAIL;
851 for (unsigned int i = 0; i < num_sectors; i++) {
852 bank->sectors[i].offset = i * FLASH_SECTOR_SIZE;
853 bank->sectors[i].size = FLASH_SECTOR_SIZE;
854 bank->sectors[i].is_erased = -1;
855 bank->sectors[i].is_protected = -1;
858 stm32lx_info->probed = true;
860 return ERROR_OK;
863 static int stm32lx_auto_probe(struct flash_bank *bank)
865 struct stm32lx_flash_bank *stm32lx_info = bank->driver_priv;
867 if (stm32lx_info->probed)
868 return ERROR_OK;
870 return stm32lx_probe(bank);
873 /* This method must return a string displaying information about the bank */
874 static int stm32lx_get_info(struct flash_bank *bank, struct command_invocation *cmd)
876 struct stm32lx_flash_bank *stm32lx_info = bank->driver_priv;
877 const struct stm32lx_part_info *info = &stm32lx_info->part_info;
878 uint16_t rev_id = stm32lx_info->idcode >> 16;
879 const char *rev_str = NULL;
881 if (!stm32lx_info->probed) {
882 int retval = stm32lx_probe(bank);
883 if (retval != ERROR_OK) {
884 command_print_sameline(cmd, "Unable to find bank information.");
885 return retval;
889 for (unsigned int i = 0; i < info->num_revs; i++)
890 if (rev_id == info->revs[i].rev)
891 rev_str = info->revs[i].str;
893 if (rev_str) {
894 command_print_sameline(cmd, "%s - Rev: %s", info->device_str, rev_str);
895 } else {
896 command_print_sameline(cmd, "%s - Rev: unknown (0x%04x)", info->device_str, rev_id);
899 return ERROR_OK;
902 static const struct command_registration stm32lx_exec_command_handlers[] = {
904 .name = "mass_erase",
905 .handler = stm32lx_handle_mass_erase_command,
906 .mode = COMMAND_EXEC,
907 .usage = "bank_id",
908 .help = "Erase entire flash device. including available EEPROM",
911 .name = "lock",
912 .handler = stm32lx_handle_lock_command,
913 .mode = COMMAND_EXEC,
914 .usage = "bank_id",
915 .help = "Increase the readout protection to Level 1.",
918 .name = "unlock",
919 .handler = stm32lx_handle_unlock_command,
920 .mode = COMMAND_EXEC,
921 .usage = "bank_id",
922 .help = "Lower the readout protection from Level 1 to 0.",
924 COMMAND_REGISTRATION_DONE
927 static const struct command_registration stm32lx_command_handlers[] = {
929 .name = "stm32lx",
930 .mode = COMMAND_ANY,
931 .help = "stm32lx flash command group",
932 .usage = "",
933 .chain = stm32lx_exec_command_handlers,
935 COMMAND_REGISTRATION_DONE
938 const struct flash_driver stm32lx_flash = {
939 .name = "stm32lx",
940 .commands = stm32lx_command_handlers,
941 .flash_bank_command = stm32lx_flash_bank_command,
942 .erase = stm32lx_erase,
943 .write = stm32lx_write,
944 .read = default_flash_read,
945 .probe = stm32lx_probe,
946 .auto_probe = stm32lx_auto_probe,
947 .erase_check = default_flash_blank_check,
948 .protect_check = stm32lx_protect_check,
949 .info = stm32lx_get_info,
950 .free_driver_priv = default_flash_free_driver_priv,
953 /* Static methods implementation */
954 static int stm32lx_unlock_program_memory(struct flash_bank *bank)
956 struct target *target = bank->target;
957 struct stm32lx_flash_bank *stm32lx_info = bank->driver_priv;
958 int retval;
959 uint32_t reg32;
962 * Unlocking the program memory is done by unlocking the PECR,
963 * then by writing the 2 PRGKEY to the PRGKEYR register
966 /* check flash is not already unlocked */
967 retval = target_read_u32(target, stm32lx_info->flash_base + FLASH_PECR,
968 &reg32);
969 if (retval != ERROR_OK)
970 return retval;
972 if ((reg32 & FLASH_PECR__PRGLOCK) == 0)
973 return ERROR_OK;
975 /* To unlock the PECR write the 2 PEKEY to the PEKEYR register */
976 retval = target_write_u32(target, stm32lx_info->flash_base + FLASH_PEKEYR,
977 PEKEY1);
978 if (retval != ERROR_OK)
979 return retval;
981 retval = target_write_u32(target, stm32lx_info->flash_base + FLASH_PEKEYR,
982 PEKEY2);
983 if (retval != ERROR_OK)
984 return retval;
986 /* Make sure it worked */
987 retval = target_read_u32(target, stm32lx_info->flash_base + FLASH_PECR,
988 &reg32);
989 if (retval != ERROR_OK)
990 return retval;
992 if (reg32 & FLASH_PECR__PELOCK) {
993 LOG_ERROR("PELOCK is not cleared :(");
994 return ERROR_FLASH_OPERATION_FAILED;
997 retval = target_write_u32(target, stm32lx_info->flash_base + FLASH_PRGKEYR,
998 PRGKEY1);
999 if (retval != ERROR_OK)
1000 return retval;
1001 retval = target_write_u32(target, stm32lx_info->flash_base + FLASH_PRGKEYR,
1002 PRGKEY2);
1003 if (retval != ERROR_OK)
1004 return retval;
1006 /* Make sure it worked */
1007 retval = target_read_u32(target, stm32lx_info->flash_base + FLASH_PECR,
1008 &reg32);
1009 if (retval != ERROR_OK)
1010 return retval;
1012 if (reg32 & FLASH_PECR__PRGLOCK) {
1013 LOG_ERROR("PRGLOCK is not cleared :(");
1014 return ERROR_FLASH_OPERATION_FAILED;
1017 return ERROR_OK;
1020 static int stm32lx_enable_write_half_page(struct flash_bank *bank)
1022 struct target *target = bank->target;
1023 struct stm32lx_flash_bank *stm32lx_info = bank->driver_priv;
1024 int retval;
1025 uint32_t reg32;
1028 * Unlock the program memory, then set the FPRG bit in the PECR register.
1030 retval = stm32lx_unlock_program_memory(bank);
1031 if (retval != ERROR_OK)
1032 return retval;
1034 retval = target_read_u32(target, stm32lx_info->flash_base + FLASH_PECR,
1035 &reg32);
1036 if (retval != ERROR_OK)
1037 return retval;
1039 reg32 |= FLASH_PECR__FPRG;
1040 retval = target_write_u32(target, stm32lx_info->flash_base + FLASH_PECR,
1041 reg32);
1042 if (retval != ERROR_OK)
1043 return retval;
1045 retval = target_read_u32(target, stm32lx_info->flash_base + FLASH_PECR,
1046 &reg32);
1047 if (retval != ERROR_OK)
1048 return retval;
1050 reg32 |= FLASH_PECR__PROG;
1051 retval = target_write_u32(target, stm32lx_info->flash_base + FLASH_PECR,
1052 reg32);
1054 return retval;
1057 static int stm32lx_lock_program_memory(struct flash_bank *bank)
1059 struct target *target = bank->target;
1060 struct stm32lx_flash_bank *stm32lx_info = bank->driver_priv;
1061 int retval;
1062 uint32_t reg32;
1064 /* To lock the program memory, simply set the lock bit and lock PECR */
1066 retval = target_read_u32(target, stm32lx_info->flash_base + FLASH_PECR,
1067 &reg32);
1068 if (retval != ERROR_OK)
1069 return retval;
1071 reg32 |= FLASH_PECR__PRGLOCK;
1072 retval = target_write_u32(target, stm32lx_info->flash_base + FLASH_PECR,
1073 reg32);
1074 if (retval != ERROR_OK)
1075 return retval;
1077 retval = target_read_u32(target, stm32lx_info->flash_base + FLASH_PECR,
1078 &reg32);
1079 if (retval != ERROR_OK)
1080 return retval;
1082 reg32 |= FLASH_PECR__PELOCK;
1083 retval = target_write_u32(target, stm32lx_info->flash_base + FLASH_PECR,
1084 reg32);
1085 if (retval != ERROR_OK)
1086 return retval;
1088 return ERROR_OK;
1091 static int stm32lx_erase_sector(struct flash_bank *bank, int sector)
1093 struct target *target = bank->target;
1094 struct stm32lx_flash_bank *stm32lx_info = bank->driver_priv;
1095 int retval;
1096 uint32_t reg32;
1099 * To erase a sector (i.e. stm32lx_info->part_info.pages_per_sector pages),
1100 * first unlock the memory, loop over the pages of this sector
1101 * and write 0x0 to its first word.
1104 retval = stm32lx_unlock_program_memory(bank);
1105 if (retval != ERROR_OK)
1106 return retval;
1108 for (int page = 0; page < (int)stm32lx_info->part_info.pages_per_sector;
1109 page++) {
1110 reg32 = FLASH_PECR__PROG | FLASH_PECR__ERASE;
1111 retval = target_write_u32(target,
1112 stm32lx_info->flash_base + FLASH_PECR, reg32);
1113 if (retval != ERROR_OK)
1114 return retval;
1116 retval = stm32lx_wait_until_bsy_clear(bank);
1117 if (retval != ERROR_OK)
1118 return retval;
1120 uint32_t addr = bank->base + bank->sectors[sector].offset + (page
1121 * stm32lx_info->part_info.page_size);
1122 retval = target_write_u32(target, addr, 0x0);
1123 if (retval != ERROR_OK)
1124 return retval;
1126 retval = stm32lx_wait_until_bsy_clear(bank);
1127 if (retval != ERROR_OK)
1128 return retval;
1131 retval = stm32lx_lock_program_memory(bank);
1132 if (retval != ERROR_OK)
1133 return retval;
1135 return ERROR_OK;
1138 static inline int stm32lx_get_flash_status(struct flash_bank *bank, uint32_t *status)
1140 struct target *target = bank->target;
1141 struct stm32lx_flash_bank *stm32lx_info = bank->driver_priv;
1143 return target_read_u32(target, stm32lx_info->flash_base + FLASH_SR, status);
1146 static int stm32lx_wait_until_bsy_clear(struct flash_bank *bank)
1148 return stm32lx_wait_until_bsy_clear_timeout(bank, 100);
1151 static int stm32lx_unlock_options_bytes(struct flash_bank *bank)
1153 struct target *target = bank->target;
1154 struct stm32lx_flash_bank *stm32lx_info = bank->driver_priv;
1155 int retval;
1156 uint32_t reg32;
1159 * Unlocking the options bytes is done by unlocking the PECR,
1160 * then by writing the 2 FLASH_PEKEYR to the FLASH_OPTKEYR register
1163 /* check flash is not already unlocked */
1164 retval = target_read_u32(target, stm32lx_info->flash_base + FLASH_PECR, &reg32);
1165 if (retval != ERROR_OK)
1166 return retval;
1168 if ((reg32 & FLASH_PECR__OPTLOCK) == 0)
1169 return ERROR_OK;
1171 if ((reg32 & FLASH_PECR__PELOCK) != 0) {
1173 retval = target_write_u32(target, stm32lx_info->flash_base + FLASH_PEKEYR, PEKEY1);
1174 if (retval != ERROR_OK)
1175 return retval;
1177 retval = target_write_u32(target, stm32lx_info->flash_base + FLASH_PEKEYR, PEKEY2);
1178 if (retval != ERROR_OK)
1179 return retval;
1182 /* To unlock the PECR write the 2 OPTKEY to the FLASH_OPTKEYR register */
1183 retval = target_write_u32(target, stm32lx_info->flash_base + FLASH_OPTKEYR, OPTKEY1);
1184 if (retval != ERROR_OK)
1185 return retval;
1187 retval = target_write_u32(target, stm32lx_info->flash_base + FLASH_OPTKEYR, OPTKEY2);
1188 if (retval != ERROR_OK)
1189 return retval;
1191 return ERROR_OK;
1194 static int stm32lx_wait_until_bsy_clear_timeout(struct flash_bank *bank, int timeout)
1196 struct target *target = bank->target;
1197 struct stm32lx_flash_bank *stm32lx_info = bank->driver_priv;
1198 uint32_t status;
1199 int retval = ERROR_OK;
1201 /* wait for busy to clear */
1202 for (;;) {
1203 retval = stm32lx_get_flash_status(bank, &status);
1204 if (retval != ERROR_OK)
1205 return retval;
1207 LOG_DEBUG("status: 0x%" PRIx32 "", status);
1208 if ((status & FLASH_SR__BSY) == 0)
1209 break;
1211 if (timeout-- <= 0) {
1212 LOG_ERROR("timed out waiting for flash");
1213 return ERROR_FAIL;
1215 alive_sleep(1);
1218 if (status & FLASH_SR__WRPERR) {
1219 LOG_ERROR("access denied / write protected");
1220 retval = ERROR_FAIL;
1223 if (status & FLASH_SR__PGAERR) {
1224 LOG_ERROR("invalid program address");
1225 retval = ERROR_FAIL;
1228 /* Clear but report errors */
1229 if (status & FLASH_SR__OPTVERR) {
1230 /* If this operation fails, we ignore it and report the original retval */
1231 target_write_u32(target, stm32lx_info->flash_base + FLASH_SR, status & FLASH_SR__OPTVERR);
1234 return retval;
1237 static int stm32lx_obl_launch(struct flash_bank *bank)
1239 struct target *target = bank->target;
1240 struct stm32lx_flash_bank *stm32lx_info = bank->driver_priv;
1241 int retval;
1243 /* This will fail as the target gets immediately rebooted */
1244 target_write_u32(target, stm32lx_info->flash_base + FLASH_PECR,
1245 FLASH_PECR__OBL_LAUNCH);
1247 size_t tries = 10;
1248 do {
1249 target_halt(target);
1250 retval = target_poll(target);
1251 } while (--tries > 0 &&
1252 (retval != ERROR_OK || target->state != TARGET_HALTED));
1254 return tries ? ERROR_OK : ERROR_FAIL;
1257 static int stm32lx_lock(struct flash_bank *bank)
1259 int retval;
1260 struct target *target = bank->target;
1262 if (target->state != TARGET_HALTED) {
1263 LOG_ERROR("Target not halted");
1264 return ERROR_TARGET_NOT_HALTED;
1267 retval = stm32lx_unlock_options_bytes(bank);
1268 if (retval != ERROR_OK)
1269 return retval;
1271 /* set the RDP protection level to 1 */
1272 retval = target_write_u32(target, OPTION_BYTES_ADDRESS, OPTION_BYTE_0_PR1);
1273 if (retval != ERROR_OK)
1274 return retval;
1276 return ERROR_OK;
1279 static int stm32lx_unlock(struct flash_bank *bank)
1281 int retval;
1282 struct target *target = bank->target;
1284 if (target->state != TARGET_HALTED) {
1285 LOG_ERROR("Target not halted");
1286 return ERROR_TARGET_NOT_HALTED;
1289 retval = stm32lx_unlock_options_bytes(bank);
1290 if (retval != ERROR_OK)
1291 return retval;
1293 /* set the RDP protection level to 0 */
1294 retval = target_write_u32(target, OPTION_BYTES_ADDRESS, OPTION_BYTE_0_PR0);
1295 if (retval != ERROR_OK)
1296 return retval;
1298 retval = stm32lx_wait_until_bsy_clear_timeout(bank, 30000);
1299 if (retval != ERROR_OK)
1300 return retval;
1302 return ERROR_OK;
1305 static int stm32lx_mass_erase(struct flash_bank *bank)
1307 int retval;
1308 struct target *target = bank->target;
1309 struct stm32lx_flash_bank *stm32lx_info = NULL;
1310 uint32_t reg32;
1312 if (target->state != TARGET_HALTED) {
1313 LOG_ERROR("Target not halted");
1314 return ERROR_TARGET_NOT_HALTED;
1317 stm32lx_info = bank->driver_priv;
1319 retval = stm32lx_lock(bank);
1320 if (retval != ERROR_OK)
1321 return retval;
1323 retval = stm32lx_obl_launch(bank);
1324 if (retval != ERROR_OK)
1325 return retval;
1327 retval = stm32lx_unlock(bank);
1328 if (retval != ERROR_OK)
1329 return retval;
1331 retval = stm32lx_obl_launch(bank);
1332 if (retval != ERROR_OK)
1333 return retval;
1335 retval = target_read_u32(target, stm32lx_info->flash_base + FLASH_PECR, &reg32);
1336 if (retval != ERROR_OK)
1337 return retval;
1339 retval = target_write_u32(target, stm32lx_info->flash_base + FLASH_PECR, reg32 | FLASH_PECR__OPTLOCK);
1340 if (retval != ERROR_OK)
1341 return retval;
1343 return ERROR_OK;
1346 static int stm32lx_update_part_info(struct flash_bank *bank, uint16_t flash_size_in_kb)
1348 struct stm32lx_flash_bank *stm32lx_info = bank->driver_priv;
1350 switch (stm32lx_info->part_info.id) {
1351 case 0x447: /* STM32L0xx (Cat.5) devices */
1352 if (flash_size_in_kb == 192 || flash_size_in_kb == 128) {
1353 stm32lx_info->part_info.first_bank_size_kb = flash_size_in_kb / 2;
1354 stm32lx_info->part_info.has_dual_banks = true;
1356 break;
1357 case 0x437: /* STM32L1xx (Cat.5/Cat.6) */
1358 stm32lx_info->part_info.first_bank_size_kb = flash_size_in_kb / 2;
1359 break;
1362 return ERROR_OK;