1 // SPDX-License-Identifier: GPL-2.0-or-later
3 /***************************************************************************
4 * Copyright (C) 2005 by Dominic Rath *
5 * Dominic.Rath@gmx.de *
7 * Copyright (C) 2008 by Spencer Oliver *
8 * spen@spen-soft.co.uk *
10 * Copyright (C) 2011 by Clement Burin des Roziers *
11 * clement.burin-des-roziers@hikob.com *
12 ***************************************************************************/
19 #include <helper/binarybuffer.h>
20 #include <target/algorithm.h>
21 #include <target/armv7m.h>
22 #include <target/cortex_m.h>
24 /* stm32lx flash register locations */
26 #define FLASH_ACR 0x00
27 #define FLASH_PECR 0x04
28 #define FLASH_PDKEYR 0x08
29 #define FLASH_PEKEYR 0x0C
30 #define FLASH_PRGKEYR 0x10
31 #define FLASH_OPTKEYR 0x14
33 #define FLASH_OBR 0x1C
34 #define FLASH_WRPR 0x20
37 #define FLASH_ACR__LATENCY (1<<0)
38 #define FLASH_ACR__PRFTEN (1<<1)
39 #define FLASH_ACR__ACC64 (1<<2)
40 #define FLASH_ACR__SLEEP_PD (1<<3)
41 #define FLASH_ACR__RUN_PD (1<<4)
44 #define FLASH_PECR__PELOCK (1<<0)
45 #define FLASH_PECR__PRGLOCK (1<<1)
46 #define FLASH_PECR__OPTLOCK (1<<2)
47 #define FLASH_PECR__PROG (1<<3)
48 #define FLASH_PECR__DATA (1<<4)
49 #define FLASH_PECR__FTDW (1<<8)
50 #define FLASH_PECR__ERASE (1<<9)
51 #define FLASH_PECR__FPRG (1<<10)
52 #define FLASH_PECR__EOPIE (1<<16)
53 #define FLASH_PECR__ERRIE (1<<17)
54 #define FLASH_PECR__OBL_LAUNCH (1<<18)
57 #define FLASH_SR__BSY (1<<0)
58 #define FLASH_SR__EOP (1<<1)
59 #define FLASH_SR__ENDHV (1<<2)
60 #define FLASH_SR__READY (1<<3)
61 #define FLASH_SR__WRPERR (1<<8)
62 #define FLASH_SR__PGAERR (1<<9)
63 #define FLASH_SR__SIZERR (1<<10)
64 #define FLASH_SR__OPTVERR (1<<11)
67 #define PEKEY1 0x89ABCDEF
68 #define PEKEY2 0x02030405
69 #define PRGKEY1 0x8C9DAEBF
70 #define PRGKEY2 0x13141516
71 #define OPTKEY1 0xFBEAD9C8
72 #define OPTKEY2 0x24252627
75 #define DBGMCU_IDCODE 0xE0042000
76 #define DBGMCU_IDCODE_L0 0x40015800
79 #define FLASH_SECTOR_SIZE 4096
80 #define FLASH_BANK0_ADDRESS 0x08000000
83 #define OPTION_BYTES_ADDRESS 0x1FF80000
85 #define OPTION_BYTE_0_PR1 0xFFFF0000
86 #define OPTION_BYTE_0_PR0 0xFF5500AA
88 static int stm32lx_unlock_program_memory(struct flash_bank
*bank
);
89 static int stm32lx_lock_program_memory(struct flash_bank
*bank
);
90 static int stm32lx_enable_write_half_page(struct flash_bank
*bank
);
91 static int stm32lx_erase_sector(struct flash_bank
*bank
, int sector
);
92 static int stm32lx_wait_until_bsy_clear(struct flash_bank
*bank
);
93 static int stm32lx_lock(struct flash_bank
*bank
);
94 static int stm32lx_unlock(struct flash_bank
*bank
);
95 static int stm32lx_mass_erase(struct flash_bank
*bank
);
96 static int stm32lx_wait_until_bsy_clear_timeout(struct flash_bank
*bank
, int timeout
);
97 static int stm32lx_update_part_info(struct flash_bank
*bank
, uint16_t flash_size_in_kb
);
104 struct stm32lx_part_info
{
106 const char *device_str
;
107 const struct stm32lx_rev
*revs
;
109 unsigned int page_size
;
110 unsigned int pages_per_sector
;
111 uint16_t max_flash_size_kb
;
112 uint16_t first_bank_size_kb
; /* used when has_dual_banks is true */
115 uint32_t flash_base
; /* Flash controller registers location */
116 uint32_t fsize_base
; /* Location of FSIZE register */
119 struct stm32lx_flash_bank
{
122 uint32_t user_bank_size
;
125 struct stm32lx_part_info part_info
;
128 static const struct stm32lx_rev stm32_416_revs
[] = {
129 { 0x1000, "A" }, { 0x1008, "Y" }, { 0x1038, "W" }, { 0x1078, "V" },
131 static const struct stm32lx_rev stm32_417_revs
[] = {
132 { 0x1000, "A" }, { 0x1008, "Z" }, { 0x1018, "Y" }, { 0x1038, "X" }
134 static const struct stm32lx_rev stm32_425_revs
[] = {
135 { 0x1000, "A" }, { 0x2000, "B" }, { 0x2008, "Y" }, { 0x2018, "1, X" },
137 static const struct stm32lx_rev stm32_427_revs
[] = {
138 { 0x1000, "A" }, { 0x1018, "Y" }, { 0x1038, "X" }, { 0x10f8, "V" },
140 static const struct stm32lx_rev stm32_429_revs
[] = {
141 { 0x1000, "A" }, { 0x1018, "Z" },
143 static const struct stm32lx_rev stm32_436_revs
[] = {
144 { 0x1000, "A" }, { 0x1008, "Z" }, { 0x1018, "Y" }, { 0x1038, "X" },
146 static const struct stm32lx_rev stm32_437_revs
[] = {
149 static const struct stm32lx_rev stm32_447_revs
[] = {
150 { 0x1000, "A" }, { 0x2000, "B" }, { 0x2008, "Z" },
152 static const struct stm32lx_rev stm32_457_revs
[] = {
153 { 0x1000, "A" }, { 0x1008, "Z" },
156 static const struct stm32lx_part_info stm32lx_parts
[] = {
159 .revs
= stm32_416_revs
,
160 .num_revs
= ARRAY_SIZE(stm32_416_revs
),
161 .device_str
= "STM32L1xx (Cat.1 - Low/Medium Density)",
163 .pages_per_sector
= 16,
164 .max_flash_size_kb
= 128,
165 .has_dual_banks
= false,
166 .flash_base
= 0x40023C00,
167 .fsize_base
= 0x1FF8004C,
171 .revs
= stm32_417_revs
,
172 .num_revs
= ARRAY_SIZE(stm32_417_revs
),
173 .device_str
= "STM32L0xx (Cat. 3)",
175 .pages_per_sector
= 32,
176 .max_flash_size_kb
= 64,
177 .has_dual_banks
= false,
178 .flash_base
= 0x40022000,
179 .fsize_base
= 0x1FF8007C,
183 .revs
= stm32_425_revs
,
184 .num_revs
= ARRAY_SIZE(stm32_425_revs
),
185 .device_str
= "STM32L0xx (Cat. 2)",
187 .pages_per_sector
= 32,
188 .max_flash_size_kb
= 32,
189 .has_dual_banks
= false,
190 .flash_base
= 0x40022000,
191 .fsize_base
= 0x1FF8007C,
195 .revs
= stm32_427_revs
,
196 .num_revs
= ARRAY_SIZE(stm32_427_revs
),
197 .device_str
= "STM32L1xx (Cat.3 - Medium+ Density)",
199 .pages_per_sector
= 16,
200 .max_flash_size_kb
= 256,
201 .has_dual_banks
= false,
202 .flash_base
= 0x40023C00,
203 .fsize_base
= 0x1FF800CC,
207 .revs
= stm32_429_revs
,
208 .num_revs
= ARRAY_SIZE(stm32_429_revs
),
209 .device_str
= "STM32L1xx (Cat.2)",
211 .pages_per_sector
= 16,
212 .max_flash_size_kb
= 128,
213 .has_dual_banks
= false,
214 .flash_base
= 0x40023C00,
215 .fsize_base
= 0x1FF8004C,
219 .revs
= stm32_436_revs
,
220 .num_revs
= ARRAY_SIZE(stm32_436_revs
),
221 .device_str
= "STM32L1xx (Cat.4/Cat.3 - Medium+/High Density)",
223 .pages_per_sector
= 16,
224 .max_flash_size_kb
= 384,
225 .first_bank_size_kb
= 192,
226 .has_dual_banks
= true,
227 .flash_base
= 0x40023C00,
228 .fsize_base
= 0x1FF800CC,
232 .revs
= stm32_437_revs
,
233 .num_revs
= ARRAY_SIZE(stm32_437_revs
),
234 .device_str
= "STM32L1xx (Cat.5/Cat.6)",
236 .pages_per_sector
= 16,
237 .max_flash_size_kb
= 512,
238 .first_bank_size_kb
= 0, /* determined in runtime */
239 .has_dual_banks
= true,
240 .flash_base
= 0x40023C00,
241 .fsize_base
= 0x1FF800CC,
245 .revs
= stm32_447_revs
,
246 .num_revs
= ARRAY_SIZE(stm32_447_revs
),
247 .device_str
= "STM32L0xx (Cat.5)",
249 .pages_per_sector
= 32,
250 .max_flash_size_kb
= 192,
251 .first_bank_size_kb
= 0, /* determined in runtime */
252 .has_dual_banks
= false, /* determined in runtime */
253 .flash_base
= 0x40022000,
254 .fsize_base
= 0x1FF8007C,
258 .revs
= stm32_457_revs
,
259 .num_revs
= ARRAY_SIZE(stm32_457_revs
),
260 .device_str
= "STM32L0xx (Cat.1)",
262 .pages_per_sector
= 32,
263 .max_flash_size_kb
= 16,
264 .has_dual_banks
= false,
265 .flash_base
= 0x40022000,
266 .fsize_base
= 0x1FF8007C,
270 /* flash bank stm32lx <base> <size> 0 0 <target#>
272 FLASH_BANK_COMMAND_HANDLER(stm32lx_flash_bank_command
)
274 struct stm32lx_flash_bank
*stm32lx_info
;
276 return ERROR_COMMAND_SYNTAX_ERROR
;
278 /* Create the bank structure */
279 stm32lx_info
= calloc(1, sizeof(*stm32lx_info
));
281 /* Check allocation */
283 LOG_ERROR("failed to allocate bank structure");
287 bank
->driver_priv
= stm32lx_info
;
289 stm32lx_info
->probed
= false;
290 stm32lx_info
->user_bank_size
= bank
->size
;
292 /* the stm32l erased value is 0x00 */
293 bank
->default_padded_value
= bank
->erased_value
= 0x00;
298 COMMAND_HANDLER(stm32lx_handle_mass_erase_command
)
301 return ERROR_COMMAND_SYNTAX_ERROR
;
303 struct flash_bank
*bank
;
304 int retval
= CALL_COMMAND_HANDLER(flash_command_get_bank
, 0, &bank
);
305 if (retval
!= ERROR_OK
)
308 retval
= stm32lx_mass_erase(bank
);
309 if (retval
== ERROR_OK
)
310 command_print(CMD
, "stm32lx mass erase complete");
312 command_print(CMD
, "stm32lx mass erase failed");
317 COMMAND_HANDLER(stm32lx_handle_lock_command
)
320 return ERROR_COMMAND_SYNTAX_ERROR
;
322 struct flash_bank
*bank
;
323 int retval
= CALL_COMMAND_HANDLER(flash_command_get_bank
, 0, &bank
);
324 if (retval
!= ERROR_OK
)
327 retval
= stm32lx_lock(bank
);
329 if (retval
== ERROR_OK
)
330 command_print(CMD
, "STM32Lx locked, takes effect after power cycle.");
332 command_print(CMD
, "STM32Lx lock failed");
337 COMMAND_HANDLER(stm32lx_handle_unlock_command
)
340 return ERROR_COMMAND_SYNTAX_ERROR
;
342 struct flash_bank
*bank
;
343 int retval
= CALL_COMMAND_HANDLER(flash_command_get_bank
, 0, &bank
);
344 if (retval
!= ERROR_OK
)
347 retval
= stm32lx_unlock(bank
);
349 if (retval
== ERROR_OK
)
350 command_print(CMD
, "STM32Lx unlocked, takes effect after power cycle.");
352 command_print(CMD
, "STM32Lx unlock failed");
357 static int stm32lx_protect_check(struct flash_bank
*bank
)
360 struct target
*target
= bank
->target
;
361 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
366 * Read the WRPR word, and check each bit (corresponding to each
369 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_WRPR
,
371 if (retval
!= ERROR_OK
)
374 for (unsigned int i
= 0; i
< bank
->num_sectors
; i
++) {
376 bank
->sectors
[i
].is_protected
= 1;
378 bank
->sectors
[i
].is_protected
= 0;
383 static int stm32lx_erase(struct flash_bank
*bank
, unsigned int first
,
389 * It could be possible to do a mass erase if all sectors must be
390 * erased, but it is not implemented yet.
393 if (bank
->target
->state
!= TARGET_HALTED
) {
394 LOG_ERROR("Target not halted");
395 return ERROR_TARGET_NOT_HALTED
;
399 * Loop over the selected sectors and erase them
401 for (unsigned int i
= first
; i
<= last
; i
++) {
402 retval
= stm32lx_erase_sector(bank
, i
);
403 if (retval
!= ERROR_OK
)
405 bank
->sectors
[i
].is_erased
= 1;
410 static int stm32lx_write_half_pages(struct flash_bank
*bank
, const uint8_t *buffer
,
411 uint32_t offset
, uint32_t count
)
413 struct target
*target
= bank
->target
;
414 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
416 uint32_t hp_nb
= stm32lx_info
->part_info
.page_size
/ 2;
417 uint32_t buffer_size
= (16384 / hp_nb
) * hp_nb
; /* must be multiple of hp_nb */
418 struct working_area
*write_algorithm
;
419 struct working_area
*source
;
420 uint32_t address
= bank
->base
+ offset
;
422 struct reg_param reg_params
[5];
423 struct armv7m_algorithm armv7m_info
;
425 int retval
= ERROR_OK
;
427 static const uint8_t stm32lx_flash_write_code
[] = {
428 #include "../../../contrib/loaders/flash/stm32/stm32lx.inc"
431 /* Make sure we're performing a half-page aligned write. */
432 if (offset
% hp_nb
) {
433 LOG_ERROR("The offset must be %" PRIu32
"B-aligned but it is %" PRIi32
"B)", hp_nb
, offset
);
437 LOG_ERROR("The byte count must be %" PRIu32
"B-aligned but count is %" PRIu32
"B)", hp_nb
, count
);
441 /* flash write code */
442 if (target_alloc_working_area(target
, sizeof(stm32lx_flash_write_code
),
443 &write_algorithm
) != ERROR_OK
) {
444 LOG_DEBUG("no working area for block memory writes");
445 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
448 /* Write the flashing code */
449 retval
= target_write_buffer(target
,
450 write_algorithm
->address
,
451 sizeof(stm32lx_flash_write_code
),
452 stm32lx_flash_write_code
);
453 if (retval
!= ERROR_OK
) {
454 target_free_working_area(target
, write_algorithm
);
458 /* Allocate half pages memory */
459 while (target_alloc_working_area_try(target
, buffer_size
, &source
) != ERROR_OK
) {
460 if (buffer_size
> 1024)
465 if (buffer_size
<= stm32lx_info
->part_info
.page_size
) {
466 /* we already allocated the writing code, but failed to get a
467 * buffer, free the algorithm */
468 target_free_working_area(target
, write_algorithm
);
470 LOG_WARNING("no large enough working area available, can't do block memory writes");
471 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
473 /* Make sure we're still asking for an integral number of half-pages */
474 buffer_size
-= buffer_size
% hp_nb
;
478 armv7m_info
.common_magic
= ARMV7M_COMMON_MAGIC
;
479 armv7m_info
.core_mode
= ARM_MODE_THREAD
;
480 init_reg_param(®_params
[0], "r0", 32, PARAM_OUT
);
481 init_reg_param(®_params
[1], "r1", 32, PARAM_OUT
);
482 init_reg_param(®_params
[2], "r2", 32, PARAM_OUT
);
483 init_reg_param(®_params
[3], "r3", 32, PARAM_OUT
);
484 init_reg_param(®_params
[4], "r4", 32, PARAM_OUT
);
486 /* Enable half-page write */
487 retval
= stm32lx_enable_write_half_page(bank
);
488 if (retval
!= ERROR_OK
) {
489 target_free_working_area(target
, source
);
490 target_free_working_area(target
, write_algorithm
);
492 destroy_reg_param(®_params
[0]);
493 destroy_reg_param(®_params
[1]);
494 destroy_reg_param(®_params
[2]);
495 destroy_reg_param(®_params
[3]);
496 destroy_reg_param(®_params
[4]);
500 struct armv7m_common
*armv7m
= target_to_armv7m(target
);
503 /* something is very wrong if armv7m is NULL */
504 LOG_ERROR("unable to get armv7m target");
508 /* save any DEMCR flags and configure target to catch any Hard Faults */
509 uint32_t demcr_save
= armv7m
->demcr
;
510 armv7m
->demcr
= VC_HARDERR
;
512 /* Loop while there are bytes to write */
515 this_count
= (count
> buffer_size
) ? buffer_size
: count
;
517 /* Write the next half pages */
518 retval
= target_write_buffer(target
, source
->address
, this_count
, buffer
);
519 if (retval
!= ERROR_OK
)
522 /* 4: Store useful information in the registers */
523 /* the destination address of the copy (R0) */
524 buf_set_u32(reg_params
[0].value
, 0, 32, address
);
525 /* The source address of the copy (R1) */
526 buf_set_u32(reg_params
[1].value
, 0, 32, source
->address
);
527 /* The number of half pages to copy (R2) */
528 buf_set_u32(reg_params
[2].value
, 0, 32, this_count
/ hp_nb
);
529 /* The size in byes of a half page (R3) */
530 buf_set_u32(reg_params
[3].value
, 0, 32, hp_nb
);
531 /* The flash base address (R4) */
532 buf_set_u32(reg_params
[4].value
, 0, 32, stm32lx_info
->flash_base
);
534 /* 5: Execute the bunch of code */
535 retval
= target_run_algorithm(target
, 0, NULL
,
536 ARRAY_SIZE(reg_params
), reg_params
,
537 write_algorithm
->address
, 0, 10000, &armv7m_info
);
538 if (retval
!= ERROR_OK
)
541 /* check for Hard Fault */
542 if (armv7m
->exception_number
== 3)
545 /* 6: Wait while busy */
546 retval
= stm32lx_wait_until_bsy_clear(bank
);
547 if (retval
!= ERROR_OK
)
550 buffer
+= this_count
;
551 address
+= this_count
;
555 /* restore previous flags */
556 armv7m
->demcr
= demcr_save
;
558 if (armv7m
->exception_number
== 3) {
560 /* the stm32l15x devices seem to have an issue when blank.
561 * if a ram loader is executed on a blank device it will
562 * Hard Fault, this issue does not happen for a already programmed device.
563 * A related issue is described in the stm32l151xx errata (Doc ID 17721 Rev 6 - 2.1.3).
564 * The workaround of handling the Hard Fault exception does work, but makes the
565 * loader more complicated, as a compromise we manually write the pages, programming time
566 * is reduced by 50% using this slower method.
569 LOG_WARNING("Couldn't use loader, falling back to page memory writes");
573 this_count
= (count
> hp_nb
) ? hp_nb
: count
;
575 /* Write the next half pages */
576 retval
= target_write_buffer(target
, address
, this_count
, buffer
);
577 if (retval
!= ERROR_OK
)
580 /* Wait while busy */
581 retval
= stm32lx_wait_until_bsy_clear(bank
);
582 if (retval
!= ERROR_OK
)
585 buffer
+= this_count
;
586 address
+= this_count
;
591 if (retval
== ERROR_OK
)
592 retval
= stm32lx_lock_program_memory(bank
);
594 target_free_working_area(target
, source
);
595 target_free_working_area(target
, write_algorithm
);
597 destroy_reg_param(®_params
[0]);
598 destroy_reg_param(®_params
[1]);
599 destroy_reg_param(®_params
[2]);
600 destroy_reg_param(®_params
[3]);
601 destroy_reg_param(®_params
[4]);
606 static int stm32lx_write(struct flash_bank
*bank
, const uint8_t *buffer
,
607 uint32_t offset
, uint32_t count
)
609 struct target
*target
= bank
->target
;
610 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
612 uint32_t hp_nb
= stm32lx_info
->part_info
.page_size
/ 2;
613 uint32_t halfpages_number
;
614 uint32_t bytes_remaining
= 0;
615 uint32_t address
= bank
->base
+ offset
;
616 uint32_t bytes_written
= 0;
619 if (bank
->target
->state
!= TARGET_HALTED
) {
620 LOG_ERROR("Target not halted");
621 return ERROR_TARGET_NOT_HALTED
;
625 LOG_ERROR("offset 0x%" PRIx32
" breaks required 4-byte alignment", offset
);
626 return ERROR_FLASH_DST_BREAKS_ALIGNMENT
;
629 retval
= stm32lx_unlock_program_memory(bank
);
630 if (retval
!= ERROR_OK
)
633 /* first we need to write any unaligned head bytes up to
634 * the next 128 byte page */
637 bytes_remaining
= MIN(count
, hp_nb
- (offset
% hp_nb
));
639 while (bytes_remaining
> 0) {
640 uint8_t value
[4] = {0xff, 0xff, 0xff, 0xff};
642 /* copy remaining bytes into the write buffer */
643 uint32_t bytes_to_write
= MIN(4, bytes_remaining
);
644 memcpy(value
, buffer
+ bytes_written
, bytes_to_write
);
646 retval
= target_write_buffer(target
, address
, 4, value
);
647 if (retval
!= ERROR_OK
)
648 goto reset_pg_and_lock
;
650 bytes_written
+= bytes_to_write
;
651 bytes_remaining
-= bytes_to_write
;
654 retval
= stm32lx_wait_until_bsy_clear(bank
);
655 if (retval
!= ERROR_OK
)
656 goto reset_pg_and_lock
;
659 offset
+= bytes_written
;
660 count
-= bytes_written
;
662 /* this should always pass this check here */
663 assert((offset
% hp_nb
) == 0);
665 /* calculate half pages */
666 halfpages_number
= count
/ hp_nb
;
668 if (halfpages_number
) {
669 retval
= stm32lx_write_half_pages(bank
, buffer
+ bytes_written
, offset
, hp_nb
* halfpages_number
);
670 if (retval
== ERROR_TARGET_RESOURCE_NOT_AVAILABLE
) {
671 /* attempt slow memory writes */
672 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
673 halfpages_number
= 0;
675 if (retval
!= ERROR_OK
)
680 /* write any remaining bytes */
681 uint32_t page_bytes_written
= hp_nb
* halfpages_number
;
682 bytes_written
+= page_bytes_written
;
683 address
+= page_bytes_written
;
684 bytes_remaining
= count
- page_bytes_written
;
686 retval
= stm32lx_unlock_program_memory(bank
);
687 if (retval
!= ERROR_OK
)
690 while (bytes_remaining
> 0) {
691 uint8_t value
[4] = {0xff, 0xff, 0xff, 0xff};
693 /* copy remaining bytes into the write buffer */
694 uint32_t bytes_to_write
= MIN(4, bytes_remaining
);
695 memcpy(value
, buffer
+ bytes_written
, bytes_to_write
);
697 retval
= target_write_buffer(target
, address
, 4, value
);
698 if (retval
!= ERROR_OK
)
699 goto reset_pg_and_lock
;
701 bytes_written
+= bytes_to_write
;
702 bytes_remaining
-= bytes_to_write
;
705 retval
= stm32lx_wait_until_bsy_clear(bank
);
706 if (retval
!= ERROR_OK
)
707 goto reset_pg_and_lock
;
711 retval2
= stm32lx_lock_program_memory(bank
);
712 if (retval
== ERROR_OK
)
718 static int stm32lx_read_id_code(struct target
*target
, uint32_t *id
)
720 struct armv7m_common
*armv7m
= target_to_armv7m(target
);
722 if (armv7m
->arm
.arch
== ARM_ARCH_V6M
)
723 retval
= target_read_u32(target
, DBGMCU_IDCODE_L0
, id
);
725 /* read stm32 device id register */
726 retval
= target_read_u32(target
, DBGMCU_IDCODE
, id
);
730 static int stm32lx_probe(struct flash_bank
*bank
)
732 struct target
*target
= bank
->target
;
733 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
734 uint16_t flash_size_in_kb
;
736 uint32_t base_address
= FLASH_BANK0_ADDRESS
;
737 uint32_t second_bank_base
;
740 stm32lx_info
->probed
= false;
742 int retval
= stm32lx_read_id_code(bank
->target
, &device_id
);
743 if (retval
!= ERROR_OK
)
746 stm32lx_info
->idcode
= device_id
;
748 LOG_DEBUG("device id = 0x%08" PRIx32
"", device_id
);
750 for (n
= 0; n
< ARRAY_SIZE(stm32lx_parts
); n
++) {
751 if ((device_id
& 0xfff) == stm32lx_parts
[n
].id
) {
752 stm32lx_info
->part_info
= stm32lx_parts
[n
];
757 if (n
== ARRAY_SIZE(stm32lx_parts
)) {
758 LOG_ERROR("Cannot identify target as an STM32 L0 or L1 family device.");
761 LOG_INFO("Device: %s", stm32lx_info
->part_info
.device_str
);
764 stm32lx_info
->flash_base
= stm32lx_info
->part_info
.flash_base
;
766 /* Get the flash size from target. */
767 retval
= target_read_u16(target
, stm32lx_info
->part_info
.fsize_base
,
770 /* 0x436 devices report their flash size as a 0 or 1 code indicating 384K
771 * or 256K, respectively. Please see RM0038 r8 or newer and refer to
773 if (retval
== ERROR_OK
&& (device_id
& 0xfff) == 0x436) {
774 if (flash_size_in_kb
== 0)
775 flash_size_in_kb
= 384;
776 else if (flash_size_in_kb
== 1)
777 flash_size_in_kb
= 256;
780 /* 0x429 devices only use the lowest 8 bits of the flash size register */
781 if (retval
== ERROR_OK
&& (device_id
& 0xfff) == 0x429) {
782 flash_size_in_kb
&= 0xff;
785 /* Failed reading flash size or flash size invalid (early silicon),
786 * default to max target family */
787 if (retval
!= ERROR_OK
|| flash_size_in_kb
== 0xffff || flash_size_in_kb
== 0) {
788 LOG_WARNING("STM32L flash size failed, probe inaccurate - assuming %dk flash",
789 stm32lx_info
->part_info
.max_flash_size_kb
);
790 flash_size_in_kb
= stm32lx_info
->part_info
.max_flash_size_kb
;
791 } else if (flash_size_in_kb
> stm32lx_info
->part_info
.max_flash_size_kb
) {
792 LOG_WARNING("STM32L probed flash size assumed incorrect since FLASH_SIZE=%dk > %dk, - assuming %dk flash",
793 flash_size_in_kb
, stm32lx_info
->part_info
.max_flash_size_kb
,
794 stm32lx_info
->part_info
.max_flash_size_kb
);
795 flash_size_in_kb
= stm32lx_info
->part_info
.max_flash_size_kb
;
798 /* Overwrite default dual-bank configuration */
799 retval
= stm32lx_update_part_info(bank
, flash_size_in_kb
);
800 if (retval
!= ERROR_OK
)
803 if (stm32lx_info
->part_info
.has_dual_banks
) {
804 /* Use the configured base address to determine if this is the first or second flash bank.
805 * Verify that the base address is reasonably correct and determine the flash bank size
807 second_bank_base
= base_address
+
808 stm32lx_info
->part_info
.first_bank_size_kb
* 1024;
809 if (bank
->base
== second_bank_base
|| !bank
->base
) {
810 /* This is the second bank */
811 base_address
= second_bank_base
;
812 flash_size_in_kb
= flash_size_in_kb
-
813 stm32lx_info
->part_info
.first_bank_size_kb
;
814 } else if (bank
->base
== base_address
) {
815 /* This is the first bank */
816 flash_size_in_kb
= stm32lx_info
->part_info
.first_bank_size_kb
;
818 LOG_WARNING("STM32L flash bank base address config is incorrect. "
819 TARGET_ADDR_FMT
" but should rather be 0x%" PRIx32
821 bank
->base
, base_address
, second_bank_base
);
824 LOG_INFO("STM32L flash has dual banks. Bank (%u) size is %dkb, base address is 0x%" PRIx32
,
825 bank
->bank_number
, flash_size_in_kb
, base_address
);
827 LOG_INFO("STM32L flash size is %dkb, base address is 0x%" PRIx32
, flash_size_in_kb
, base_address
);
830 /* if the user sets the size manually then ignore the probed value
831 * this allows us to work around devices that have a invalid flash size register value */
832 if (stm32lx_info
->user_bank_size
) {
833 flash_size_in_kb
= stm32lx_info
->user_bank_size
/ 1024;
834 LOG_INFO("ignoring flash probed value, using configured bank size: %dkbytes", flash_size_in_kb
);
837 /* calculate numbers of sectors (4kB per sector) */
838 unsigned int num_sectors
= (flash_size_in_kb
* 1024) / FLASH_SECTOR_SIZE
;
842 bank
->size
= flash_size_in_kb
* 1024;
843 bank
->base
= base_address
;
844 bank
->num_sectors
= num_sectors
;
845 bank
->sectors
= malloc(sizeof(struct flash_sector
) * num_sectors
);
846 if (!bank
->sectors
) {
847 LOG_ERROR("failed to allocate bank sectors");
851 for (unsigned int i
= 0; i
< num_sectors
; i
++) {
852 bank
->sectors
[i
].offset
= i
* FLASH_SECTOR_SIZE
;
853 bank
->sectors
[i
].size
= FLASH_SECTOR_SIZE
;
854 bank
->sectors
[i
].is_erased
= -1;
855 bank
->sectors
[i
].is_protected
= -1;
858 stm32lx_info
->probed
= true;
863 static int stm32lx_auto_probe(struct flash_bank
*bank
)
865 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
867 if (stm32lx_info
->probed
)
870 return stm32lx_probe(bank
);
873 /* This method must return a string displaying information about the bank */
874 static int stm32lx_get_info(struct flash_bank
*bank
, struct command_invocation
*cmd
)
876 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
877 const struct stm32lx_part_info
*info
= &stm32lx_info
->part_info
;
878 uint16_t rev_id
= stm32lx_info
->idcode
>> 16;
879 const char *rev_str
= NULL
;
881 if (!stm32lx_info
->probed
) {
882 int retval
= stm32lx_probe(bank
);
883 if (retval
!= ERROR_OK
) {
884 command_print_sameline(cmd
, "Unable to find bank information.");
889 for (unsigned int i
= 0; i
< info
->num_revs
; i
++)
890 if (rev_id
== info
->revs
[i
].rev
)
891 rev_str
= info
->revs
[i
].str
;
894 command_print_sameline(cmd
, "%s - Rev: %s", info
->device_str
, rev_str
);
896 command_print_sameline(cmd
, "%s - Rev: unknown (0x%04x)", info
->device_str
, rev_id
);
902 static const struct command_registration stm32lx_exec_command_handlers
[] = {
904 .name
= "mass_erase",
905 .handler
= stm32lx_handle_mass_erase_command
,
906 .mode
= COMMAND_EXEC
,
908 .help
= "Erase entire flash device. including available EEPROM",
912 .handler
= stm32lx_handle_lock_command
,
913 .mode
= COMMAND_EXEC
,
915 .help
= "Increase the readout protection to Level 1.",
919 .handler
= stm32lx_handle_unlock_command
,
920 .mode
= COMMAND_EXEC
,
922 .help
= "Lower the readout protection from Level 1 to 0.",
924 COMMAND_REGISTRATION_DONE
927 static const struct command_registration stm32lx_command_handlers
[] = {
931 .help
= "stm32lx flash command group",
933 .chain
= stm32lx_exec_command_handlers
,
935 COMMAND_REGISTRATION_DONE
938 const struct flash_driver stm32lx_flash
= {
940 .commands
= stm32lx_command_handlers
,
941 .flash_bank_command
= stm32lx_flash_bank_command
,
942 .erase
= stm32lx_erase
,
943 .write
= stm32lx_write
,
944 .read
= default_flash_read
,
945 .probe
= stm32lx_probe
,
946 .auto_probe
= stm32lx_auto_probe
,
947 .erase_check
= default_flash_blank_check
,
948 .protect_check
= stm32lx_protect_check
,
949 .info
= stm32lx_get_info
,
950 .free_driver_priv
= default_flash_free_driver_priv
,
953 /* Static methods implementation */
954 static int stm32lx_unlock_program_memory(struct flash_bank
*bank
)
956 struct target
*target
= bank
->target
;
957 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
962 * Unlocking the program memory is done by unlocking the PECR,
963 * then by writing the 2 PRGKEY to the PRGKEYR register
966 /* check flash is not already unlocked */
967 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
969 if (retval
!= ERROR_OK
)
972 if ((reg32
& FLASH_PECR__PRGLOCK
) == 0)
975 /* To unlock the PECR write the 2 PEKEY to the PEKEYR register */
976 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PEKEYR
,
978 if (retval
!= ERROR_OK
)
981 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PEKEYR
,
983 if (retval
!= ERROR_OK
)
986 /* Make sure it worked */
987 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
989 if (retval
!= ERROR_OK
)
992 if (reg32
& FLASH_PECR__PELOCK
) {
993 LOG_ERROR("PELOCK is not cleared :(");
994 return ERROR_FLASH_OPERATION_FAILED
;
997 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PRGKEYR
,
999 if (retval
!= ERROR_OK
)
1001 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PRGKEYR
,
1003 if (retval
!= ERROR_OK
)
1006 /* Make sure it worked */
1007 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1009 if (retval
!= ERROR_OK
)
1012 if (reg32
& FLASH_PECR__PRGLOCK
) {
1013 LOG_ERROR("PRGLOCK is not cleared :(");
1014 return ERROR_FLASH_OPERATION_FAILED
;
1020 static int stm32lx_enable_write_half_page(struct flash_bank
*bank
)
1022 struct target
*target
= bank
->target
;
1023 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1028 * Unlock the program memory, then set the FPRG bit in the PECR register.
1030 retval
= stm32lx_unlock_program_memory(bank
);
1031 if (retval
!= ERROR_OK
)
1034 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1036 if (retval
!= ERROR_OK
)
1039 reg32
|= FLASH_PECR__FPRG
;
1040 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1042 if (retval
!= ERROR_OK
)
1045 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1047 if (retval
!= ERROR_OK
)
1050 reg32
|= FLASH_PECR__PROG
;
1051 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1057 static int stm32lx_lock_program_memory(struct flash_bank
*bank
)
1059 struct target
*target
= bank
->target
;
1060 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1064 /* To lock the program memory, simply set the lock bit and lock PECR */
1066 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1068 if (retval
!= ERROR_OK
)
1071 reg32
|= FLASH_PECR__PRGLOCK
;
1072 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1074 if (retval
!= ERROR_OK
)
1077 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1079 if (retval
!= ERROR_OK
)
1082 reg32
|= FLASH_PECR__PELOCK
;
1083 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1085 if (retval
!= ERROR_OK
)
1091 static int stm32lx_erase_sector(struct flash_bank
*bank
, int sector
)
1093 struct target
*target
= bank
->target
;
1094 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1099 * To erase a sector (i.e. stm32lx_info->part_info.pages_per_sector pages),
1100 * first unlock the memory, loop over the pages of this sector
1101 * and write 0x0 to its first word.
1104 retval
= stm32lx_unlock_program_memory(bank
);
1105 if (retval
!= ERROR_OK
)
1108 for (int page
= 0; page
< (int)stm32lx_info
->part_info
.pages_per_sector
;
1110 reg32
= FLASH_PECR__PROG
| FLASH_PECR__ERASE
;
1111 retval
= target_write_u32(target
,
1112 stm32lx_info
->flash_base
+ FLASH_PECR
, reg32
);
1113 if (retval
!= ERROR_OK
)
1116 retval
= stm32lx_wait_until_bsy_clear(bank
);
1117 if (retval
!= ERROR_OK
)
1120 uint32_t addr
= bank
->base
+ bank
->sectors
[sector
].offset
+ (page
1121 * stm32lx_info
->part_info
.page_size
);
1122 retval
= target_write_u32(target
, addr
, 0x0);
1123 if (retval
!= ERROR_OK
)
1126 retval
= stm32lx_wait_until_bsy_clear(bank
);
1127 if (retval
!= ERROR_OK
)
1131 retval
= stm32lx_lock_program_memory(bank
);
1132 if (retval
!= ERROR_OK
)
1138 static inline int stm32lx_get_flash_status(struct flash_bank
*bank
, uint32_t *status
)
1140 struct target
*target
= bank
->target
;
1141 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1143 return target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_SR
, status
);
1146 static int stm32lx_wait_until_bsy_clear(struct flash_bank
*bank
)
1148 return stm32lx_wait_until_bsy_clear_timeout(bank
, 100);
1151 static int stm32lx_unlock_options_bytes(struct flash_bank
*bank
)
1153 struct target
*target
= bank
->target
;
1154 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1159 * Unlocking the options bytes is done by unlocking the PECR,
1160 * then by writing the 2 FLASH_PEKEYR to the FLASH_OPTKEYR register
1163 /* check flash is not already unlocked */
1164 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
, ®32
);
1165 if (retval
!= ERROR_OK
)
1168 if ((reg32
& FLASH_PECR__OPTLOCK
) == 0)
1171 if ((reg32
& FLASH_PECR__PELOCK
) != 0) {
1173 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PEKEYR
, PEKEY1
);
1174 if (retval
!= ERROR_OK
)
1177 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PEKEYR
, PEKEY2
);
1178 if (retval
!= ERROR_OK
)
1182 /* To unlock the PECR write the 2 OPTKEY to the FLASH_OPTKEYR register */
1183 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_OPTKEYR
, OPTKEY1
);
1184 if (retval
!= ERROR_OK
)
1187 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_OPTKEYR
, OPTKEY2
);
1188 if (retval
!= ERROR_OK
)
1194 static int stm32lx_wait_until_bsy_clear_timeout(struct flash_bank
*bank
, int timeout
)
1196 struct target
*target
= bank
->target
;
1197 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1199 int retval
= ERROR_OK
;
1201 /* wait for busy to clear */
1203 retval
= stm32lx_get_flash_status(bank
, &status
);
1204 if (retval
!= ERROR_OK
)
1207 LOG_DEBUG("status: 0x%" PRIx32
"", status
);
1208 if ((status
& FLASH_SR__BSY
) == 0)
1211 if (timeout
-- <= 0) {
1212 LOG_ERROR("timed out waiting for flash");
1218 if (status
& FLASH_SR__WRPERR
) {
1219 LOG_ERROR("access denied / write protected");
1220 retval
= ERROR_FAIL
;
1223 if (status
& FLASH_SR__PGAERR
) {
1224 LOG_ERROR("invalid program address");
1225 retval
= ERROR_FAIL
;
1228 /* Clear but report errors */
1229 if (status
& FLASH_SR__OPTVERR
) {
1230 /* If this operation fails, we ignore it and report the original retval */
1231 target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_SR
, status
& FLASH_SR__OPTVERR
);
1237 static int stm32lx_obl_launch(struct flash_bank
*bank
)
1239 struct target
*target
= bank
->target
;
1240 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1243 /* This will fail as the target gets immediately rebooted */
1244 target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1245 FLASH_PECR__OBL_LAUNCH
);
1249 target_halt(target
);
1250 retval
= target_poll(target
);
1251 } while (--tries
> 0 &&
1252 (retval
!= ERROR_OK
|| target
->state
!= TARGET_HALTED
));
1254 return tries
? ERROR_OK
: ERROR_FAIL
;
1257 static int stm32lx_lock(struct flash_bank
*bank
)
1260 struct target
*target
= bank
->target
;
1262 if (target
->state
!= TARGET_HALTED
) {
1263 LOG_ERROR("Target not halted");
1264 return ERROR_TARGET_NOT_HALTED
;
1267 retval
= stm32lx_unlock_options_bytes(bank
);
1268 if (retval
!= ERROR_OK
)
1271 /* set the RDP protection level to 1 */
1272 retval
= target_write_u32(target
, OPTION_BYTES_ADDRESS
, OPTION_BYTE_0_PR1
);
1273 if (retval
!= ERROR_OK
)
1279 static int stm32lx_unlock(struct flash_bank
*bank
)
1282 struct target
*target
= bank
->target
;
1284 if (target
->state
!= TARGET_HALTED
) {
1285 LOG_ERROR("Target not halted");
1286 return ERROR_TARGET_NOT_HALTED
;
1289 retval
= stm32lx_unlock_options_bytes(bank
);
1290 if (retval
!= ERROR_OK
)
1293 /* set the RDP protection level to 0 */
1294 retval
= target_write_u32(target
, OPTION_BYTES_ADDRESS
, OPTION_BYTE_0_PR0
);
1295 if (retval
!= ERROR_OK
)
1298 retval
= stm32lx_wait_until_bsy_clear_timeout(bank
, 30000);
1299 if (retval
!= ERROR_OK
)
1305 static int stm32lx_mass_erase(struct flash_bank
*bank
)
1308 struct target
*target
= bank
->target
;
1309 struct stm32lx_flash_bank
*stm32lx_info
= NULL
;
1312 if (target
->state
!= TARGET_HALTED
) {
1313 LOG_ERROR("Target not halted");
1314 return ERROR_TARGET_NOT_HALTED
;
1317 stm32lx_info
= bank
->driver_priv
;
1319 retval
= stm32lx_lock(bank
);
1320 if (retval
!= ERROR_OK
)
1323 retval
= stm32lx_obl_launch(bank
);
1324 if (retval
!= ERROR_OK
)
1327 retval
= stm32lx_unlock(bank
);
1328 if (retval
!= ERROR_OK
)
1331 retval
= stm32lx_obl_launch(bank
);
1332 if (retval
!= ERROR_OK
)
1335 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
, ®32
);
1336 if (retval
!= ERROR_OK
)
1339 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
, reg32
| FLASH_PECR__OPTLOCK
);
1340 if (retval
!= ERROR_OK
)
1346 static int stm32lx_update_part_info(struct flash_bank
*bank
, uint16_t flash_size_in_kb
)
1348 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1350 switch (stm32lx_info
->part_info
.id
) {
1351 case 0x447: /* STM32L0xx (Cat.5) devices */
1352 if (flash_size_in_kb
== 192 || flash_size_in_kb
== 128) {
1353 stm32lx_info
->part_info
.first_bank_size_kb
= flash_size_in_kb
/ 2;
1354 stm32lx_info
->part_info
.has_dual_banks
= true;
1357 case 0x437: /* STM32L1xx (Cat.5/Cat.6) */
1358 stm32lx_info
->part_info
.first_bank_size_kb
= flash_size_in_kb
/ 2;