1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2008 by Spencer Oliver *
6 * spen@spen-soft.co.uk *
8 * Copyright (C) 2011 by Clement Burin des Roziers *
9 * clement.burin-des-roziers@hikob.com *
11 * This program is free software; you can redistribute it and/or modify *
12 * it under the terms of the GNU General Public License as published by *
13 * the Free Software Foundation; either version 2 of the License, or *
14 * (at your option) any later version. *
16 * This program is distributed in the hope that it will be useful, *
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
19 * GNU General Public License for more details. *
21 * You should have received a copy of the GNU General Public License *
22 * along with this program; if not, write to the *
23 * Free Software Foundation, Inc., *
24 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *
25 ***************************************************************************/
32 #include <helper/binarybuffer.h>
33 #include <target/algorithm.h>
34 #include <target/armv7m.h>
35 #include <target/cortex_m.h>
37 /* stm32lx flash register locations */
39 #define FLASH_ACR 0x00
40 #define FLASH_PECR 0x04
41 #define FLASH_PDKEYR 0x08
42 #define FLASH_PEKEYR 0x0C
43 #define FLASH_PRGKEYR 0x10
44 #define FLASH_OPTKEYR 0x14
46 #define FLASH_OBR 0x1C
47 #define FLASH_WRPR 0x20
50 #define FLASH_ACR__LATENCY (1<<0)
51 #define FLASH_ACR__PRFTEN (1<<1)
52 #define FLASH_ACR__ACC64 (1<<2)
53 #define FLASH_ACR__SLEEP_PD (1<<3)
54 #define FLASH_ACR__RUN_PD (1<<4)
57 #define FLASH_PECR__PELOCK (1<<0)
58 #define FLASH_PECR__PRGLOCK (1<<1)
59 #define FLASH_PECR__OPTLOCK (1<<2)
60 #define FLASH_PECR__PROG (1<<3)
61 #define FLASH_PECR__DATA (1<<4)
62 #define FLASH_PECR__FTDW (1<<8)
63 #define FLASH_PECR__ERASE (1<<9)
64 #define FLASH_PECR__FPRG (1<<10)
65 #define FLASH_PECR__EOPIE (1<<16)
66 #define FLASH_PECR__ERRIE (1<<17)
67 #define FLASH_PECR__OBL_LAUNCH (1<<18)
70 #define FLASH_SR__BSY (1<<0)
71 #define FLASH_SR__EOP (1<<1)
72 #define FLASH_SR__ENDHV (1<<2)
73 #define FLASH_SR__READY (1<<3)
74 #define FLASH_SR__WRPERR (1<<8)
75 #define FLASH_SR__PGAERR (1<<9)
76 #define FLASH_SR__SIZERR (1<<10)
77 #define FLASH_SR__OPTVERR (1<<11)
80 #define PEKEY1 0x89ABCDEF
81 #define PEKEY2 0x02030405
82 #define PRGKEY1 0x8C9DAEBF
83 #define PRGKEY2 0x13141516
84 #define OPTKEY1 0xFBEAD9C8
85 #define OPTKEY2 0x24252627
88 #define DBGMCU_IDCODE 0xE0042000
89 #define DBGMCU_IDCODE_L0 0x40015800
92 #define FLASH_SECTOR_SIZE 4096
93 #define FLASH_BANK0_ADDRESS 0x08000000
96 #define OPTION_BYTES_ADDRESS 0x1FF80000
98 #define OPTION_BYTE_0_PR1 0xFFFF0000
99 #define OPTION_BYTE_0_PR0 0xFF5500AA
101 static int stm32lx_unlock_program_memory(struct flash_bank
*bank
);
102 static int stm32lx_lock_program_memory(struct flash_bank
*bank
);
103 static int stm32lx_enable_write_half_page(struct flash_bank
*bank
);
104 static int stm32lx_erase_sector(struct flash_bank
*bank
, int sector
);
105 static int stm32lx_wait_until_bsy_clear(struct flash_bank
*bank
);
106 static int stm32lx_lock(struct flash_bank
*bank
);
107 static int stm32lx_unlock(struct flash_bank
*bank
);
108 static int stm32lx_mass_erase(struct flash_bank
*bank
);
109 static int stm32lx_wait_until_bsy_clear_timeout(struct flash_bank
*bank
, int timeout
);
116 struct stm32lx_part_info
{
118 const char *device_str
;
119 const struct stm32lx_rev
*revs
;
121 unsigned int page_size
;
122 unsigned int pages_per_sector
;
123 uint16_t max_flash_size_kb
;
124 uint16_t first_bank_size_kb
; /* used when has_dual_banks is true */
127 uint32_t flash_base
; /* Flash controller registers location */
128 uint32_t fsize_base
; /* Location of FSIZE register */
131 struct stm32lx_flash_bank
{
134 uint32_t user_bank_size
;
137 const struct stm32lx_part_info
*part_info
;
140 static const struct stm32lx_rev stm32_416_revs
[] = {
141 { 0x1000, "A" }, { 0x1008, "Y" }, { 0x1038, "W" }, { 0x1078, "V" },
143 static const struct stm32lx_rev stm32_417_revs
[] = {
144 { 0x1000, "A" }, { 0x1008, "Z" }, { 0x1018, "Y" }, { 0x1038, "X" }
146 static const struct stm32lx_rev stm32_425_revs
[] = {
147 { 0x1000, "A" }, { 0x2000, "B" }, { 0x2008, "Y" },
149 static const struct stm32lx_rev stm32_427_revs
[] = {
150 { 0x1000, "A" }, { 0x1018, "Y" }, { 0x1038, "X" },
152 static const struct stm32lx_rev stm32_429_revs
[] = {
153 { 0x1000, "A" }, { 0x1018, "Z" },
155 static const struct stm32lx_rev stm32_436_revs
[] = {
156 { 0x1000, "A" }, { 0x1008, "Z" }, { 0x1018, "Y" },
158 static const struct stm32lx_rev stm32_437_revs
[] = {
161 static const struct stm32lx_rev stm32_447_revs
[] = {
162 { 0x1000, "A" }, { 0x2000, "B" }, { 0x2008, "Z" },
164 static const struct stm32lx_rev stm32_457_revs
[] = {
165 { 0x1000, "A" }, { 0x1008, "Z" },
168 static const struct stm32lx_part_info stm32lx_parts
[] = {
171 .revs
= stm32_416_revs
,
172 .num_revs
= ARRAY_SIZE(stm32_416_revs
),
173 .device_str
= "STM32L1xx (Cat.1 - Low/Medium Density)",
175 .pages_per_sector
= 16,
176 .max_flash_size_kb
= 128,
177 .has_dual_banks
= false,
178 .flash_base
= 0x40023C00,
179 .fsize_base
= 0x1FF8004C,
183 .revs
= stm32_417_revs
,
184 .num_revs
= ARRAY_SIZE(stm32_417_revs
),
185 .device_str
= "STM32L0xx (Cat. 3)",
187 .pages_per_sector
= 32,
188 .max_flash_size_kb
= 64,
189 .has_dual_banks
= false,
190 .flash_base
= 0x40022000,
191 .fsize_base
= 0x1FF8007C,
195 .revs
= stm32_425_revs
,
196 .num_revs
= ARRAY_SIZE(stm32_425_revs
),
197 .device_str
= "STM32L0xx (Cat. 2)",
199 .pages_per_sector
= 32,
200 .max_flash_size_kb
= 32,
201 .has_dual_banks
= false,
202 .flash_base
= 0x40022000,
203 .fsize_base
= 0x1FF8007C,
207 .revs
= stm32_427_revs
,
208 .num_revs
= ARRAY_SIZE(stm32_427_revs
),
209 .device_str
= "STM32L1xx (Cat.3 - Medium+ Density)",
211 .pages_per_sector
= 16,
212 .max_flash_size_kb
= 256,
213 .first_bank_size_kb
= 192,
214 .has_dual_banks
= true,
215 .flash_base
= 0x40023C00,
216 .fsize_base
= 0x1FF800CC,
220 .revs
= stm32_429_revs
,
221 .num_revs
= ARRAY_SIZE(stm32_429_revs
),
222 .device_str
= "STM32L1xx (Cat.2)",
224 .pages_per_sector
= 16,
225 .max_flash_size_kb
= 128,
226 .has_dual_banks
= false,
227 .flash_base
= 0x40023C00,
228 .fsize_base
= 0x1FF8004C,
232 .revs
= stm32_436_revs
,
233 .num_revs
= ARRAY_SIZE(stm32_436_revs
),
234 .device_str
= "STM32L1xx (Cat.4/Cat.3 - Medium+/High Density)",
236 .pages_per_sector
= 16,
237 .max_flash_size_kb
= 384,
238 .first_bank_size_kb
= 192,
239 .has_dual_banks
= true,
240 .flash_base
= 0x40023C00,
241 .fsize_base
= 0x1FF800CC,
245 .revs
= stm32_437_revs
,
246 .num_revs
= ARRAY_SIZE(stm32_437_revs
),
247 .device_str
= "STM32L1xx (Cat.5/Cat.6)",
249 .pages_per_sector
= 16,
250 .max_flash_size_kb
= 512,
251 .first_bank_size_kb
= 256,
252 .has_dual_banks
= true,
253 .flash_base
= 0x40023C00,
254 .fsize_base
= 0x1FF800CC,
258 .revs
= stm32_447_revs
,
259 .num_revs
= ARRAY_SIZE(stm32_447_revs
),
260 .device_str
= "STM32L0xx (Cat.5)",
262 .pages_per_sector
= 32,
263 .max_flash_size_kb
= 192,
264 .first_bank_size_kb
= 128,
265 .has_dual_banks
= true,
266 .flash_base
= 0x40022000,
267 .fsize_base
= 0x1FF8007C,
271 .revs
= stm32_457_revs
,
272 .num_revs
= ARRAY_SIZE(stm32_457_revs
),
273 .device_str
= "STM32L0xx (Cat.1)",
275 .pages_per_sector
= 32,
276 .max_flash_size_kb
= 16,
277 .has_dual_banks
= false,
278 .flash_base
= 0x40022000,
279 .fsize_base
= 0x1FF8007C,
283 /* flash bank stm32lx <base> <size> 0 0 <target#>
285 FLASH_BANK_COMMAND_HANDLER(stm32lx_flash_bank_command
)
287 struct stm32lx_flash_bank
*stm32lx_info
;
289 return ERROR_COMMAND_SYNTAX_ERROR
;
291 /* Create the bank structure */
292 stm32lx_info
= calloc(1, sizeof(*stm32lx_info
));
294 /* Check allocation */
295 if (stm32lx_info
== NULL
) {
296 LOG_ERROR("failed to allocate bank structure");
300 bank
->driver_priv
= stm32lx_info
;
302 stm32lx_info
->probed
= 0;
303 stm32lx_info
->user_bank_size
= bank
->size
;
305 /* the stm32l erased value is 0x00 */
306 bank
->default_padded_value
= 0x00;
311 COMMAND_HANDLER(stm32lx_handle_mass_erase_command
)
316 return ERROR_COMMAND_SYNTAX_ERROR
;
318 struct flash_bank
*bank
;
319 int retval
= CALL_COMMAND_HANDLER(flash_command_get_bank
, 0, &bank
);
320 if (ERROR_OK
!= retval
)
323 retval
= stm32lx_mass_erase(bank
);
324 if (retval
== ERROR_OK
) {
325 /* set all sectors as erased */
326 for (i
= 0; i
< bank
->num_sectors
; i
++)
327 bank
->sectors
[i
].is_erased
= 1;
329 command_print(CMD_CTX
, "stm32lx mass erase complete");
331 command_print(CMD_CTX
, "stm32lx mass erase failed");
337 COMMAND_HANDLER(stm32lx_handle_lock_command
)
340 return ERROR_COMMAND_SYNTAX_ERROR
;
342 struct flash_bank
*bank
;
343 int retval
= CALL_COMMAND_HANDLER(flash_command_get_bank
, 0, &bank
);
344 if (ERROR_OK
!= retval
)
347 retval
= stm32lx_lock(bank
);
349 if (retval
== ERROR_OK
)
350 command_print(CMD_CTX
, "STM32Lx locked, takes effect after power cycle.");
352 command_print(CMD_CTX
, "STM32Lx lock failed");
357 COMMAND_HANDLER(stm32lx_handle_unlock_command
)
360 return ERROR_COMMAND_SYNTAX_ERROR
;
362 struct flash_bank
*bank
;
363 int retval
= CALL_COMMAND_HANDLER(flash_command_get_bank
, 0, &bank
);
364 if (ERROR_OK
!= retval
)
367 retval
= stm32lx_unlock(bank
);
369 if (retval
== ERROR_OK
)
370 command_print(CMD_CTX
, "STM32Lx unlocked, takes effect after power cycle.");
372 command_print(CMD_CTX
, "STM32Lx unlock failed");
377 static int stm32lx_protect_check(struct flash_bank
*bank
)
380 struct target
*target
= bank
->target
;
381 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
386 * Read the WRPR word, and check each bit (corresponding to each
389 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_WRPR
,
391 if (retval
!= ERROR_OK
)
394 for (int i
= 0; i
< bank
->num_sectors
; i
++) {
396 bank
->sectors
[i
].is_protected
= 1;
398 bank
->sectors
[i
].is_protected
= 0;
403 static int stm32lx_erase(struct flash_bank
*bank
, int first
, int last
)
408 * It could be possible to do a mass erase if all sectors must be
409 * erased, but it is not implemented yet.
412 if (bank
->target
->state
!= TARGET_HALTED
) {
413 LOG_ERROR("Target not halted");
414 return ERROR_TARGET_NOT_HALTED
;
418 * Loop over the selected sectors and erase them
420 for (int i
= first
; i
<= last
; i
++) {
421 retval
= stm32lx_erase_sector(bank
, i
);
422 if (retval
!= ERROR_OK
)
424 bank
->sectors
[i
].is_erased
= 1;
429 static int stm32lx_protect(struct flash_bank
*bank
, int set
, int first
,
432 LOG_WARNING("protection of the STM32L flash is not implemented");
436 static int stm32lx_write_half_pages(struct flash_bank
*bank
, const uint8_t *buffer
,
437 uint32_t offset
, uint32_t count
)
439 struct target
*target
= bank
->target
;
440 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
442 uint32_t hp_nb
= stm32lx_info
->part_info
->page_size
/ 2;
443 uint32_t buffer_size
= 16384;
444 struct working_area
*write_algorithm
;
445 struct working_area
*source
;
446 uint32_t address
= bank
->base
+ offset
;
448 struct reg_param reg_params
[3];
449 struct armv7m_algorithm armv7m_info
;
451 int retval
= ERROR_OK
;
453 /* see contib/loaders/flash/stm32lx.S for src */
455 static const uint8_t stm32lx_flash_write_code
[] = {
457 0x00, 0x23, /* movs r3, #0 */
458 0x04, 0xe0, /* b test_done */
461 0x51, 0xf8, 0x04, 0xcb, /* ldr ip, [r1], #4 */
462 0x40, 0xf8, 0x04, 0xcb, /* str ip, [r0], #4 */
463 0x01, 0x33, /* adds r3, #1 */
466 0x93, 0x42, /* cmp r3, r2 */
467 0xf8, 0xd3, /* bcc write_word */
468 0x00, 0xbe, /* bkpt 0 */
471 /* Make sure we're performing a half-page aligned write. */
473 LOG_ERROR("The byte count must be %" PRIu32
"B-aligned but count is %" PRIi32
"B)", hp_nb
, count
);
477 /* flash write code */
478 if (target_alloc_working_area(target
, sizeof(stm32lx_flash_write_code
),
479 &write_algorithm
) != ERROR_OK
) {
480 LOG_DEBUG("no working area for block memory writes");
481 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
484 /* Write the flashing code */
485 retval
= target_write_buffer(target
,
486 write_algorithm
->address
,
487 sizeof(stm32lx_flash_write_code
),
488 stm32lx_flash_write_code
);
489 if (retval
!= ERROR_OK
) {
490 target_free_working_area(target
, write_algorithm
);
494 /* Allocate half pages memory */
495 while (target_alloc_working_area_try(target
, buffer_size
, &source
) != ERROR_OK
) {
496 if (buffer_size
> 1024)
501 if (buffer_size
<= stm32lx_info
->part_info
->page_size
) {
502 /* we already allocated the writing code, but failed to get a
503 * buffer, free the algorithm */
504 target_free_working_area(target
, write_algorithm
);
506 LOG_WARNING("no large enough working area available, can't do block memory writes");
507 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
511 armv7m_info
.common_magic
= ARMV7M_COMMON_MAGIC
;
512 armv7m_info
.core_mode
= ARM_MODE_THREAD
;
513 init_reg_param(®_params
[0], "r0", 32, PARAM_OUT
);
514 init_reg_param(®_params
[1], "r1", 32, PARAM_OUT
);
515 init_reg_param(®_params
[2], "r2", 32, PARAM_OUT
);
517 /* Enable half-page write */
518 retval
= stm32lx_enable_write_half_page(bank
);
519 if (retval
!= ERROR_OK
) {
520 target_free_working_area(target
, source
);
521 target_free_working_area(target
, write_algorithm
);
523 destroy_reg_param(®_params
[0]);
524 destroy_reg_param(®_params
[1]);
525 destroy_reg_param(®_params
[2]);
529 struct armv7m_common
*armv7m
= target_to_armv7m(target
);
530 if (armv7m
== NULL
) {
532 /* something is very wrong if armv7m is NULL */
533 LOG_ERROR("unable to get armv7m target");
537 /* save any DEMCR flags and configure target to catch any Hard Faults */
538 uint32_t demcr_save
= armv7m
->demcr
;
539 armv7m
->demcr
= VC_HARDERR
;
541 /* Loop while there are bytes to write */
544 this_count
= (count
> buffer_size
) ? buffer_size
: count
;
546 /* Write the next half pages */
547 retval
= target_write_buffer(target
, source
->address
, this_count
, buffer
);
548 if (retval
!= ERROR_OK
)
551 /* 4: Store useful information in the registers */
552 /* the destination address of the copy (R0) */
553 buf_set_u32(reg_params
[0].value
, 0, 32, address
);
554 /* The source address of the copy (R1) */
555 buf_set_u32(reg_params
[1].value
, 0, 32, source
->address
);
556 /* The length of the copy (R2) */
557 buf_set_u32(reg_params
[2].value
, 0, 32, this_count
/ 4);
559 /* 5: Execute the bunch of code */
560 retval
= target_run_algorithm(target
, 0, NULL
, sizeof(reg_params
)
561 / sizeof(*reg_params
), reg_params
,
562 write_algorithm
->address
, 0, 10000, &armv7m_info
);
563 if (retval
!= ERROR_OK
)
566 /* check for Hard Fault */
567 if (armv7m
->exception_number
== 3)
570 /* 6: Wait while busy */
571 retval
= stm32lx_wait_until_bsy_clear(bank
);
572 if (retval
!= ERROR_OK
)
575 buffer
+= this_count
;
576 address
+= this_count
;
580 /* restore previous flags */
581 armv7m
->demcr
= demcr_save
;
583 if (armv7m
->exception_number
== 3) {
585 /* the stm32l15x devices seem to have an issue when blank.
586 * if a ram loader is executed on a blank device it will
587 * Hard Fault, this issue does not happen for a already programmed device.
588 * A related issue is described in the stm32l151xx errata (Doc ID 17721 Rev 6 - 2.1.3).
589 * The workaround of handling the Hard Fault exception does work, but makes the
590 * loader more complicated, as a compromise we manually write the pages, programming time
591 * is reduced by 50% using this slower method.
594 LOG_WARNING("couldn't use loader, falling back to page memory writes");
598 this_count
= (count
> hp_nb
) ? hp_nb
: count
;
600 /* Write the next half pages */
601 retval
= target_write_buffer(target
, address
, this_count
, buffer
);
602 if (retval
!= ERROR_OK
)
605 /* Wait while busy */
606 retval
= stm32lx_wait_until_bsy_clear(bank
);
607 if (retval
!= ERROR_OK
)
610 buffer
+= this_count
;
611 address
+= this_count
;
616 if (retval
== ERROR_OK
)
617 retval
= stm32lx_lock_program_memory(bank
);
619 target_free_working_area(target
, source
);
620 target_free_working_area(target
, write_algorithm
);
622 destroy_reg_param(®_params
[0]);
623 destroy_reg_param(®_params
[1]);
624 destroy_reg_param(®_params
[2]);
629 static int stm32lx_write(struct flash_bank
*bank
, const uint8_t *buffer
,
630 uint32_t offset
, uint32_t count
)
632 struct target
*target
= bank
->target
;
633 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
635 uint32_t hp_nb
= stm32lx_info
->part_info
->page_size
/ 2;
636 uint32_t halfpages_number
;
637 uint32_t bytes_remaining
= 0;
638 uint32_t address
= bank
->base
+ offset
;
639 uint32_t bytes_written
= 0;
642 if (bank
->target
->state
!= TARGET_HALTED
) {
643 LOG_ERROR("Target not halted");
644 return ERROR_TARGET_NOT_HALTED
;
648 LOG_ERROR("offset 0x%" PRIx32
" breaks required 4-byte alignment", offset
);
649 return ERROR_FLASH_DST_BREAKS_ALIGNMENT
;
652 retval
= stm32lx_unlock_program_memory(bank
);
653 if (retval
!= ERROR_OK
)
656 /* first we need to write any unaligned head bytes upto
657 * the next 128 byte page */
660 bytes_remaining
= MIN(count
, hp_nb
- (offset
% hp_nb
));
662 while (bytes_remaining
> 0) {
663 uint8_t value
[4] = {0xff, 0xff, 0xff, 0xff};
665 /* copy remaining bytes into the write buffer */
666 uint32_t bytes_to_write
= MIN(4, bytes_remaining
);
667 memcpy(value
, buffer
+ bytes_written
, bytes_to_write
);
669 retval
= target_write_buffer(target
, address
, 4, value
);
670 if (retval
!= ERROR_OK
)
671 goto reset_pg_and_lock
;
673 bytes_written
+= bytes_to_write
;
674 bytes_remaining
-= bytes_to_write
;
677 retval
= stm32lx_wait_until_bsy_clear(bank
);
678 if (retval
!= ERROR_OK
)
679 goto reset_pg_and_lock
;
682 offset
+= bytes_written
;
683 count
-= bytes_written
;
685 /* this should always pass this check here */
686 assert((offset
% hp_nb
) == 0);
688 /* calculate half pages */
689 halfpages_number
= count
/ hp_nb
;
691 if (halfpages_number
) {
692 retval
= stm32lx_write_half_pages(bank
, buffer
+ bytes_written
, offset
, hp_nb
* halfpages_number
);
693 if (retval
== ERROR_TARGET_RESOURCE_NOT_AVAILABLE
) {
694 /* attempt slow memory writes */
695 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
696 halfpages_number
= 0;
698 if (retval
!= ERROR_OK
)
703 /* write any remaining bytes */
704 uint32_t page_bytes_written
= hp_nb
* halfpages_number
;
705 bytes_written
+= page_bytes_written
;
706 address
+= page_bytes_written
;
707 bytes_remaining
= count
- page_bytes_written
;
709 retval
= stm32lx_unlock_program_memory(bank
);
710 if (retval
!= ERROR_OK
)
713 while (bytes_remaining
> 0) {
714 uint8_t value
[4] = {0xff, 0xff, 0xff, 0xff};
716 /* copy remaining bytes into the write buffer */
717 uint32_t bytes_to_write
= MIN(4, bytes_remaining
);
718 memcpy(value
, buffer
+ bytes_written
, bytes_to_write
);
720 retval
= target_write_buffer(target
, address
, 4, value
);
721 if (retval
!= ERROR_OK
)
722 goto reset_pg_and_lock
;
724 bytes_written
+= bytes_to_write
;
725 bytes_remaining
-= bytes_to_write
;
728 retval
= stm32lx_wait_until_bsy_clear(bank
);
729 if (retval
!= ERROR_OK
)
730 goto reset_pg_and_lock
;
734 retval2
= stm32lx_lock_program_memory(bank
);
735 if (retval
== ERROR_OK
)
741 static int stm32lx_read_id_code(struct target
*target
, uint32_t *id
)
743 /* read stm32 device id register */
744 int retval
= target_read_u32(target
, DBGMCU_IDCODE
, id
);
745 if (retval
!= ERROR_OK
)
748 /* STM32L0 parts will have 0 there, try reading the L0's location for
749 * DBG_IDCODE in case this is an L0 part. */
751 retval
= target_read_u32(target
, DBGMCU_IDCODE_L0
, id
);
756 static int stm32lx_probe(struct flash_bank
*bank
)
758 struct target
*target
= bank
->target
;
759 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
761 uint16_t flash_size_in_kb
;
763 uint32_t base_address
= FLASH_BANK0_ADDRESS
;
764 uint32_t second_bank_base
;
766 stm32lx_info
->probed
= 0;
767 stm32lx_info
->part_info
= NULL
;
769 int retval
= stm32lx_read_id_code(bank
->target
, &device_id
);
770 if (retval
!= ERROR_OK
)
773 stm32lx_info
->idcode
= device_id
;
775 LOG_DEBUG("device id = 0x%08" PRIx32
"", device_id
);
777 for (unsigned int n
= 0; n
< ARRAY_SIZE(stm32lx_parts
); n
++) {
778 if ((device_id
& 0xfff) == stm32lx_parts
[n
].id
)
779 stm32lx_info
->part_info
= &stm32lx_parts
[n
];
782 if (!stm32lx_info
->part_info
) {
783 LOG_WARNING("Cannot identify target as a STM32L family.");
786 LOG_INFO("Device: %s", stm32lx_info
->part_info
->device_str
);
789 stm32lx_info
->flash_base
= stm32lx_info
->part_info
->flash_base
;
791 /* Get the flash size from target. */
792 retval
= target_read_u16(target
, stm32lx_info
->part_info
->fsize_base
,
795 /* 0x436 devices report their flash size as a 0 or 1 code indicating 384K
796 * or 256K, respectively. Please see RM0038 r8 or newer and refer to
798 if (retval
== ERROR_OK
&& (device_id
& 0xfff) == 0x436) {
799 if (flash_size_in_kb
== 0)
800 flash_size_in_kb
= 384;
801 else if (flash_size_in_kb
== 1)
802 flash_size_in_kb
= 256;
805 /* Failed reading flash size or flash size invalid (early silicon),
806 * default to max target family */
807 if (retval
!= ERROR_OK
|| flash_size_in_kb
== 0xffff || flash_size_in_kb
== 0) {
808 LOG_WARNING("STM32L flash size failed, probe inaccurate - assuming %dk flash",
809 stm32lx_info
->part_info
->max_flash_size_kb
);
810 flash_size_in_kb
= stm32lx_info
->part_info
->max_flash_size_kb
;
811 } else if (flash_size_in_kb
> stm32lx_info
->part_info
->max_flash_size_kb
) {
812 LOG_WARNING("STM32L probed flash size assumed incorrect since FLASH_SIZE=%dk > %dk, - assuming %dk flash",
813 flash_size_in_kb
, stm32lx_info
->part_info
->max_flash_size_kb
,
814 stm32lx_info
->part_info
->max_flash_size_kb
);
815 flash_size_in_kb
= stm32lx_info
->part_info
->max_flash_size_kb
;
818 if (stm32lx_info
->part_info
->has_dual_banks
) {
819 /* Use the configured base address to determine if this is the first or second flash bank.
820 * Verify that the base address is reasonably correct and determine the flash bank size
822 second_bank_base
= base_address
+
823 stm32lx_info
->part_info
->first_bank_size_kb
* 1024;
824 if (bank
->base
== second_bank_base
|| !bank
->base
) {
825 /* This is the second bank */
826 base_address
= second_bank_base
;
827 flash_size_in_kb
= flash_size_in_kb
-
828 stm32lx_info
->part_info
->first_bank_size_kb
;
829 } else if (bank
->base
== base_address
) {
830 /* This is the first bank */
831 flash_size_in_kb
= stm32lx_info
->part_info
->first_bank_size_kb
;
833 LOG_WARNING("STM32L flash bank base address config is incorrect."
834 " 0x%" PRIx32
" but should rather be 0x%" PRIx32
" or 0x%" PRIx32
,
835 bank
->base
, base_address
, second_bank_base
);
838 LOG_INFO("STM32L flash has dual banks. Bank (%d) size is %dkb, base address is 0x%" PRIx32
,
839 bank
->bank_number
, flash_size_in_kb
, base_address
);
841 LOG_INFO("STM32L flash size is %dkb, base address is 0x%" PRIx32
, flash_size_in_kb
, base_address
);
844 /* if the user sets the size manually then ignore the probed value
845 * this allows us to work around devices that have a invalid flash size register value */
846 if (stm32lx_info
->user_bank_size
) {
847 flash_size_in_kb
= stm32lx_info
->user_bank_size
/ 1024;
848 LOG_INFO("ignoring flash probed value, using configured bank size: %dkbytes", flash_size_in_kb
);
851 /* calculate numbers of sectors (4kB per sector) */
852 int num_sectors
= (flash_size_in_kb
* 1024) / FLASH_SECTOR_SIZE
;
856 bank
->sectors
= NULL
;
859 bank
->size
= flash_size_in_kb
* 1024;
860 bank
->base
= base_address
;
861 bank
->num_sectors
= num_sectors
;
862 bank
->sectors
= malloc(sizeof(struct flash_sector
) * num_sectors
);
863 if (bank
->sectors
== NULL
) {
864 LOG_ERROR("failed to allocate bank sectors");
868 for (i
= 0; i
< num_sectors
; i
++) {
869 bank
->sectors
[i
].offset
= i
* FLASH_SECTOR_SIZE
;
870 bank
->sectors
[i
].size
= FLASH_SECTOR_SIZE
;
871 bank
->sectors
[i
].is_erased
= -1;
872 bank
->sectors
[i
].is_protected
= 1;
875 stm32lx_info
->probed
= 1;
880 static int stm32lx_auto_probe(struct flash_bank
*bank
)
882 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
884 if (stm32lx_info
->probed
)
887 return stm32lx_probe(bank
);
890 static int stm32lx_erase_check(struct flash_bank
*bank
)
892 struct target
*target
= bank
->target
;
893 const int buffer_size
= 4096;
896 int retval
= ERROR_OK
;
898 if (bank
->target
->state
!= TARGET_HALTED
) {
899 LOG_ERROR("Target not halted");
900 return ERROR_TARGET_NOT_HALTED
;
903 uint8_t *buffer
= malloc(buffer_size
);
904 if (buffer
== NULL
) {
905 LOG_ERROR("failed to allocate read buffer");
909 for (i
= 0; i
< bank
->num_sectors
; i
++) {
911 bank
->sectors
[i
].is_erased
= 1;
913 /* Loop chunk by chunk over the sector */
914 for (j
= 0; j
< bank
->sectors
[i
].size
; j
+= buffer_size
) {
917 if (chunk
> (j
- bank
->sectors
[i
].size
))
918 chunk
= (j
- bank
->sectors
[i
].size
);
920 retval
= target_read_memory(target
, bank
->base
921 + bank
->sectors
[i
].offset
+ j
, 4, chunk
/ 4, buffer
);
922 if (retval
!= ERROR_OK
)
925 for (nBytes
= 0; nBytes
< chunk
; nBytes
++) {
926 if (buffer
[nBytes
] != 0x00) {
927 bank
->sectors
[i
].is_erased
= 0;
932 if (retval
!= ERROR_OK
)
940 /* This method must return a string displaying information about the bank */
941 static int stm32lx_get_info(struct flash_bank
*bank
, char *buf
, int buf_size
)
943 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
945 if (!stm32lx_info
->probed
) {
946 int retval
= stm32lx_probe(bank
);
947 if (retval
!= ERROR_OK
) {
948 snprintf(buf
, buf_size
,
949 "Unable to find bank information.");
954 const struct stm32lx_part_info
*info
= stm32lx_info
->part_info
;
957 const char *rev_str
= NULL
;
958 uint16_t rev_id
= stm32lx_info
->idcode
>> 16;
960 for (unsigned int i
= 0; i
< info
->num_revs
; i
++)
961 if (rev_id
== info
->revs
[i
].rev
)
962 rev_str
= info
->revs
[i
].str
;
964 if (rev_str
!= NULL
) {
965 snprintf(buf
, buf_size
,
967 stm32lx_info
->part_info
->device_str
, rev_str
);
969 snprintf(buf
, buf_size
,
970 "%s - Rev: unknown (0x%04x)",
971 stm32lx_info
->part_info
->device_str
, rev_id
);
976 snprintf(buf
, buf_size
, "Cannot identify target as a STM32Lx");
982 static const struct command_registration stm32lx_exec_command_handlers
[] = {
984 .name
= "mass_erase",
985 .handler
= stm32lx_handle_mass_erase_command
,
986 .mode
= COMMAND_EXEC
,
988 .help
= "Erase entire flash device. including available EEPROM",
992 .handler
= stm32lx_handle_lock_command
,
993 .mode
= COMMAND_EXEC
,
995 .help
= "Increase the readout protection to Level 1.",
999 .handler
= stm32lx_handle_unlock_command
,
1000 .mode
= COMMAND_EXEC
,
1002 .help
= "Lower the readout protection from Level 1 to 0.",
1004 COMMAND_REGISTRATION_DONE
1007 static const struct command_registration stm32lx_command_handlers
[] = {
1010 .mode
= COMMAND_ANY
,
1011 .help
= "stm32lx flash command group",
1013 .chain
= stm32lx_exec_command_handlers
,
1015 COMMAND_REGISTRATION_DONE
1018 struct flash_driver stm32lx_flash
= {
1020 .commands
= stm32lx_command_handlers
,
1021 .flash_bank_command
= stm32lx_flash_bank_command
,
1022 .erase
= stm32lx_erase
,
1023 .protect
= stm32lx_protect
,
1024 .write
= stm32lx_write
,
1025 .read
= default_flash_read
,
1026 .probe
= stm32lx_probe
,
1027 .auto_probe
= stm32lx_auto_probe
,
1028 .erase_check
= stm32lx_erase_check
,
1029 .protect_check
= stm32lx_protect_check
,
1030 .info
= stm32lx_get_info
,
1033 /* Static methods implementation */
1034 static int stm32lx_unlock_program_memory(struct flash_bank
*bank
)
1036 struct target
*target
= bank
->target
;
1037 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1042 * Unlocking the program memory is done by unlocking the PECR,
1043 * then by writing the 2 PRGKEY to the PRGKEYR register
1046 /* check flash is not already unlocked */
1047 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1049 if (retval
!= ERROR_OK
)
1052 if ((reg32
& FLASH_PECR__PRGLOCK
) == 0)
1055 /* To unlock the PECR write the 2 PEKEY to the PEKEYR register */
1056 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PEKEYR
,
1058 if (retval
!= ERROR_OK
)
1061 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PEKEYR
,
1063 if (retval
!= ERROR_OK
)
1066 /* Make sure it worked */
1067 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1069 if (retval
!= ERROR_OK
)
1072 if (reg32
& FLASH_PECR__PELOCK
) {
1073 LOG_ERROR("PELOCK is not cleared :(");
1074 return ERROR_FLASH_OPERATION_FAILED
;
1077 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PRGKEYR
,
1079 if (retval
!= ERROR_OK
)
1081 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PRGKEYR
,
1083 if (retval
!= ERROR_OK
)
1086 /* Make sure it worked */
1087 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1089 if (retval
!= ERROR_OK
)
1092 if (reg32
& FLASH_PECR__PRGLOCK
) {
1093 LOG_ERROR("PRGLOCK is not cleared :(");
1094 return ERROR_FLASH_OPERATION_FAILED
;
1100 static int stm32lx_enable_write_half_page(struct flash_bank
*bank
)
1102 struct target
*target
= bank
->target
;
1103 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1108 * Unlock the program memory, then set the FPRG bit in the PECR register.
1110 retval
= stm32lx_unlock_program_memory(bank
);
1111 if (retval
!= ERROR_OK
)
1114 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1116 if (retval
!= ERROR_OK
)
1119 reg32
|= FLASH_PECR__FPRG
;
1120 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1122 if (retval
!= ERROR_OK
)
1125 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1127 if (retval
!= ERROR_OK
)
1130 reg32
|= FLASH_PECR__PROG
;
1131 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1137 static int stm32lx_lock_program_memory(struct flash_bank
*bank
)
1139 struct target
*target
= bank
->target
;
1140 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1144 /* To lock the program memory, simply set the lock bit and lock PECR */
1146 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1148 if (retval
!= ERROR_OK
)
1151 reg32
|= FLASH_PECR__PRGLOCK
;
1152 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1154 if (retval
!= ERROR_OK
)
1157 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1159 if (retval
!= ERROR_OK
)
1162 reg32
|= FLASH_PECR__PELOCK
;
1163 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1165 if (retval
!= ERROR_OK
)
1171 static int stm32lx_erase_sector(struct flash_bank
*bank
, int sector
)
1173 struct target
*target
= bank
->target
;
1174 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1179 * To erase a sector (i.e. stm32lx_info->part_info.pages_per_sector pages),
1180 * first unlock the memory, loop over the pages of this sector
1181 * and write 0x0 to its first word.
1184 retval
= stm32lx_unlock_program_memory(bank
);
1185 if (retval
!= ERROR_OK
)
1188 for (int page
= 0; page
< (int)stm32lx_info
->part_info
->pages_per_sector
;
1190 reg32
= FLASH_PECR__PROG
| FLASH_PECR__ERASE
;
1191 retval
= target_write_u32(target
,
1192 stm32lx_info
->flash_base
+ FLASH_PECR
, reg32
);
1193 if (retval
!= ERROR_OK
)
1196 retval
= stm32lx_wait_until_bsy_clear(bank
);
1197 if (retval
!= ERROR_OK
)
1200 uint32_t addr
= bank
->base
+ bank
->sectors
[sector
].offset
+ (page
1201 * stm32lx_info
->part_info
->page_size
);
1202 retval
= target_write_u32(target
, addr
, 0x0);
1203 if (retval
!= ERROR_OK
)
1206 retval
= stm32lx_wait_until_bsy_clear(bank
);
1207 if (retval
!= ERROR_OK
)
1211 retval
= stm32lx_lock_program_memory(bank
);
1212 if (retval
!= ERROR_OK
)
1218 static inline int stm32lx_get_flash_status(struct flash_bank
*bank
, uint32_t *status
)
1220 struct target
*target
= bank
->target
;
1221 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1223 return target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_SR
, status
);
1226 static int stm32lx_wait_until_bsy_clear(struct flash_bank
*bank
)
1228 return stm32lx_wait_until_bsy_clear_timeout(bank
, 100);
1231 static int stm32lx_unlock_options_bytes(struct flash_bank
*bank
)
1233 struct target
*target
= bank
->target
;
1234 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1239 * Unlocking the options bytes is done by unlocking the PECR,
1240 * then by writing the 2 FLASH_PEKEYR to the FLASH_OPTKEYR register
1243 /* check flash is not already unlocked */
1244 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
, ®32
);
1245 if (retval
!= ERROR_OK
)
1248 if ((reg32
& FLASH_PECR__OPTLOCK
) == 0)
1251 if ((reg32
& FLASH_PECR__PELOCK
) != 0) {
1253 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PEKEYR
, PEKEY1
);
1254 if (retval
!= ERROR_OK
)
1257 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PEKEYR
, PEKEY2
);
1258 if (retval
!= ERROR_OK
)
1262 /* To unlock the PECR write the 2 OPTKEY to the FLASH_OPTKEYR register */
1263 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_OPTKEYR
, OPTKEY1
);
1264 if (retval
!= ERROR_OK
)
1267 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_OPTKEYR
, OPTKEY2
);
1268 if (retval
!= ERROR_OK
)
1274 static int stm32lx_wait_until_bsy_clear_timeout(struct flash_bank
*bank
, int timeout
)
1276 struct target
*target
= bank
->target
;
1277 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1279 int retval
= ERROR_OK
;
1281 /* wait for busy to clear */
1283 retval
= stm32lx_get_flash_status(bank
, &status
);
1284 if (retval
!= ERROR_OK
)
1287 LOG_DEBUG("status: 0x%" PRIx32
"", status
);
1288 if ((status
& FLASH_SR__BSY
) == 0)
1291 if (timeout
-- <= 0) {
1292 LOG_ERROR("timed out waiting for flash");
1298 if (status
& FLASH_SR__WRPERR
) {
1299 LOG_ERROR("access denied / write protected");
1300 retval
= ERROR_FAIL
;
1303 if (status
& FLASH_SR__PGAERR
) {
1304 LOG_ERROR("invalid program address");
1305 retval
= ERROR_FAIL
;
1308 /* Clear but report errors */
1309 if (status
& FLASH_SR__OPTVERR
) {
1310 /* If this operation fails, we ignore it and report the original retval */
1311 target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_SR
, status
& FLASH_SR__OPTVERR
);
1317 static int stm32lx_obl_launch(struct flash_bank
*bank
)
1319 struct target
*target
= bank
->target
;
1320 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1323 /* This will fail as the target gets immediately rebooted */
1324 target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1325 FLASH_PECR__OBL_LAUNCH
);
1329 target_halt(target
);
1330 retval
= target_poll(target
);
1331 } while (--tries
> 0 &&
1332 (retval
!= ERROR_OK
|| target
->state
!= TARGET_HALTED
));
1334 return tries
? ERROR_OK
: ERROR_FAIL
;
1337 static int stm32lx_lock(struct flash_bank
*bank
)
1340 struct target
*target
= bank
->target
;
1342 if (target
->state
!= TARGET_HALTED
) {
1343 LOG_ERROR("Target not halted");
1344 return ERROR_TARGET_NOT_HALTED
;
1347 retval
= stm32lx_unlock_options_bytes(bank
);
1348 if (retval
!= ERROR_OK
)
1351 /* set the RDP protection level to 1 */
1352 retval
= target_write_u32(target
, OPTION_BYTES_ADDRESS
, OPTION_BYTE_0_PR1
);
1353 if (retval
!= ERROR_OK
)
1359 static int stm32lx_unlock(struct flash_bank
*bank
)
1362 struct target
*target
= bank
->target
;
1364 if (target
->state
!= TARGET_HALTED
) {
1365 LOG_ERROR("Target not halted");
1366 return ERROR_TARGET_NOT_HALTED
;
1369 retval
= stm32lx_unlock_options_bytes(bank
);
1370 if (retval
!= ERROR_OK
)
1373 /* set the RDP protection level to 0 */
1374 retval
= target_write_u32(target
, OPTION_BYTES_ADDRESS
, OPTION_BYTE_0_PR0
);
1375 if (retval
!= ERROR_OK
)
1378 retval
= stm32lx_wait_until_bsy_clear_timeout(bank
, 30000);
1379 if (retval
!= ERROR_OK
)
1385 static int stm32lx_mass_erase(struct flash_bank
*bank
)
1388 struct target
*target
= bank
->target
;
1389 struct stm32lx_flash_bank
*stm32lx_info
= NULL
;
1392 if (target
->state
!= TARGET_HALTED
) {
1393 LOG_ERROR("Target not halted");
1394 return ERROR_TARGET_NOT_HALTED
;
1397 stm32lx_info
= bank
->driver_priv
;
1399 retval
= stm32lx_lock(bank
);
1400 if (retval
!= ERROR_OK
)
1403 retval
= stm32lx_obl_launch(bank
);
1404 if (retval
!= ERROR_OK
)
1407 retval
= stm32lx_unlock(bank
);
1408 if (retval
!= ERROR_OK
)
1411 retval
= stm32lx_obl_launch(bank
);
1412 if (retval
!= ERROR_OK
)
1415 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
, ®32
);
1416 if (retval
!= ERROR_OK
)
1419 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
, reg32
| FLASH_PECR__OPTLOCK
);
1420 if (retval
!= ERROR_OK
)