1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2008 by Spencer Oliver *
6 * spen@spen-soft.co.uk *
8 * Copyright (C) 2011 by Clement Burin des Roziers *
9 * clement.burin-des-roziers@hikob.com *
11 * This program is free software; you can redistribute it and/or modify *
12 * it under the terms of the GNU General Public License as published by *
13 * the Free Software Foundation; either version 2 of the License, or *
14 * (at your option) any later version. *
16 * This program is distributed in the hope that it will be useful, *
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
19 * GNU General Public License for more details. *
21 * You should have received a copy of the GNU General Public License *
22 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
23 ***************************************************************************/
30 #include <helper/binarybuffer.h>
31 #include <target/algorithm.h>
32 #include <target/armv7m.h>
33 #include <target/cortex_m.h>
35 /* stm32lx flash register locations */
37 #define FLASH_ACR 0x00
38 #define FLASH_PECR 0x04
39 #define FLASH_PDKEYR 0x08
40 #define FLASH_PEKEYR 0x0C
41 #define FLASH_PRGKEYR 0x10
42 #define FLASH_OPTKEYR 0x14
44 #define FLASH_OBR 0x1C
45 #define FLASH_WRPR 0x20
48 #define FLASH_ACR__LATENCY (1<<0)
49 #define FLASH_ACR__PRFTEN (1<<1)
50 #define FLASH_ACR__ACC64 (1<<2)
51 #define FLASH_ACR__SLEEP_PD (1<<3)
52 #define FLASH_ACR__RUN_PD (1<<4)
55 #define FLASH_PECR__PELOCK (1<<0)
56 #define FLASH_PECR__PRGLOCK (1<<1)
57 #define FLASH_PECR__OPTLOCK (1<<2)
58 #define FLASH_PECR__PROG (1<<3)
59 #define FLASH_PECR__DATA (1<<4)
60 #define FLASH_PECR__FTDW (1<<8)
61 #define FLASH_PECR__ERASE (1<<9)
62 #define FLASH_PECR__FPRG (1<<10)
63 #define FLASH_PECR__EOPIE (1<<16)
64 #define FLASH_PECR__ERRIE (1<<17)
65 #define FLASH_PECR__OBL_LAUNCH (1<<18)
68 #define FLASH_SR__BSY (1<<0)
69 #define FLASH_SR__EOP (1<<1)
70 #define FLASH_SR__ENDHV (1<<2)
71 #define FLASH_SR__READY (1<<3)
72 #define FLASH_SR__WRPERR (1<<8)
73 #define FLASH_SR__PGAERR (1<<9)
74 #define FLASH_SR__SIZERR (1<<10)
75 #define FLASH_SR__OPTVERR (1<<11)
78 #define PEKEY1 0x89ABCDEF
79 #define PEKEY2 0x02030405
80 #define PRGKEY1 0x8C9DAEBF
81 #define PRGKEY2 0x13141516
82 #define OPTKEY1 0xFBEAD9C8
83 #define OPTKEY2 0x24252627
86 #define DBGMCU_IDCODE 0xE0042000
87 #define DBGMCU_IDCODE_L0 0x40015800
90 #define FLASH_SECTOR_SIZE 4096
91 #define FLASH_BANK0_ADDRESS 0x08000000
94 #define OPTION_BYTES_ADDRESS 0x1FF80000
96 #define OPTION_BYTE_0_PR1 0xFFFF0000
97 #define OPTION_BYTE_0_PR0 0xFF5500AA
99 static int stm32lx_unlock_program_memory(struct flash_bank
*bank
);
100 static int stm32lx_lock_program_memory(struct flash_bank
*bank
);
101 static int stm32lx_enable_write_half_page(struct flash_bank
*bank
);
102 static int stm32lx_erase_sector(struct flash_bank
*bank
, int sector
);
103 static int stm32lx_wait_until_bsy_clear(struct flash_bank
*bank
);
104 static int stm32lx_lock(struct flash_bank
*bank
);
105 static int stm32lx_unlock(struct flash_bank
*bank
);
106 static int stm32lx_mass_erase(struct flash_bank
*bank
);
107 static int stm32lx_wait_until_bsy_clear_timeout(struct flash_bank
*bank
, int timeout
);
114 struct stm32lx_part_info
{
116 const char *device_str
;
117 const struct stm32lx_rev
*revs
;
119 unsigned int page_size
;
120 unsigned int pages_per_sector
;
121 uint16_t max_flash_size_kb
;
122 uint16_t first_bank_size_kb
; /* used when has_dual_banks is true */
125 uint32_t flash_base
; /* Flash controller registers location */
126 uint32_t fsize_base
; /* Location of FSIZE register */
129 struct stm32lx_flash_bank
{
132 uint32_t user_bank_size
;
135 const struct stm32lx_part_info
*part_info
;
138 static const struct stm32lx_rev stm32_416_revs
[] = {
139 { 0x1000, "A" }, { 0x1008, "Y" }, { 0x1038, "W" }, { 0x1078, "V" },
141 static const struct stm32lx_rev stm32_417_revs
[] = {
142 { 0x1000, "A" }, { 0x1008, "Z" }, { 0x1018, "Y" }, { 0x1038, "X" }
144 static const struct stm32lx_rev stm32_425_revs
[] = {
145 { 0x1000, "A" }, { 0x2000, "B" }, { 0x2008, "Y" },
147 static const struct stm32lx_rev stm32_427_revs
[] = {
148 { 0x1000, "A" }, { 0x1018, "Y" }, { 0x1038, "X" },
150 static const struct stm32lx_rev stm32_429_revs
[] = {
151 { 0x1000, "A" }, { 0x1018, "Z" },
153 static const struct stm32lx_rev stm32_436_revs
[] = {
154 { 0x1000, "A" }, { 0x1008, "Z" }, { 0x1018, "Y" },
156 static const struct stm32lx_rev stm32_437_revs
[] = {
159 static const struct stm32lx_rev stm32_447_revs
[] = {
160 { 0x1000, "A" }, { 0x2000, "B" }, { 0x2008, "Z" },
162 static const struct stm32lx_rev stm32_457_revs
[] = {
163 { 0x1000, "A" }, { 0x1008, "Z" },
166 static const struct stm32lx_part_info stm32lx_parts
[] = {
169 .revs
= stm32_416_revs
,
170 .num_revs
= ARRAY_SIZE(stm32_416_revs
),
171 .device_str
= "STM32L1xx (Cat.1 - Low/Medium Density)",
173 .pages_per_sector
= 16,
174 .max_flash_size_kb
= 128,
175 .has_dual_banks
= false,
176 .flash_base
= 0x40023C00,
177 .fsize_base
= 0x1FF8004C,
181 .revs
= stm32_417_revs
,
182 .num_revs
= ARRAY_SIZE(stm32_417_revs
),
183 .device_str
= "STM32L0xx (Cat. 3)",
185 .pages_per_sector
= 32,
186 .max_flash_size_kb
= 64,
187 .has_dual_banks
= false,
188 .flash_base
= 0x40022000,
189 .fsize_base
= 0x1FF8007C,
193 .revs
= stm32_425_revs
,
194 .num_revs
= ARRAY_SIZE(stm32_425_revs
),
195 .device_str
= "STM32L0xx (Cat. 2)",
197 .pages_per_sector
= 32,
198 .max_flash_size_kb
= 32,
199 .has_dual_banks
= false,
200 .flash_base
= 0x40022000,
201 .fsize_base
= 0x1FF8007C,
205 .revs
= stm32_427_revs
,
206 .num_revs
= ARRAY_SIZE(stm32_427_revs
),
207 .device_str
= "STM32L1xx (Cat.3 - Medium+ Density)",
209 .pages_per_sector
= 16,
210 .max_flash_size_kb
= 256,
211 .has_dual_banks
= false,
212 .flash_base
= 0x40023C00,
213 .fsize_base
= 0x1FF800CC,
217 .revs
= stm32_429_revs
,
218 .num_revs
= ARRAY_SIZE(stm32_429_revs
),
219 .device_str
= "STM32L1xx (Cat.2)",
221 .pages_per_sector
= 16,
222 .max_flash_size_kb
= 128,
223 .has_dual_banks
= false,
224 .flash_base
= 0x40023C00,
225 .fsize_base
= 0x1FF8004C,
229 .revs
= stm32_436_revs
,
230 .num_revs
= ARRAY_SIZE(stm32_436_revs
),
231 .device_str
= "STM32L1xx (Cat.4/Cat.3 - Medium+/High Density)",
233 .pages_per_sector
= 16,
234 .max_flash_size_kb
= 384,
235 .first_bank_size_kb
= 192,
236 .has_dual_banks
= true,
237 .flash_base
= 0x40023C00,
238 .fsize_base
= 0x1FF800CC,
242 .revs
= stm32_437_revs
,
243 .num_revs
= ARRAY_SIZE(stm32_437_revs
),
244 .device_str
= "STM32L1xx (Cat.5/Cat.6)",
246 .pages_per_sector
= 16,
247 .max_flash_size_kb
= 512,
248 .first_bank_size_kb
= 256,
249 .has_dual_banks
= true,
250 .flash_base
= 0x40023C00,
251 .fsize_base
= 0x1FF800CC,
255 .revs
= stm32_447_revs
,
256 .num_revs
= ARRAY_SIZE(stm32_447_revs
),
257 .device_str
= "STM32L0xx (Cat.5)",
259 .pages_per_sector
= 32,
260 .max_flash_size_kb
= 192,
261 .first_bank_size_kb
= 128,
262 .has_dual_banks
= true,
263 .flash_base
= 0x40022000,
264 .fsize_base
= 0x1FF8007C,
268 .revs
= stm32_457_revs
,
269 .num_revs
= ARRAY_SIZE(stm32_457_revs
),
270 .device_str
= "STM32L0xx (Cat.1)",
272 .pages_per_sector
= 32,
273 .max_flash_size_kb
= 16,
274 .has_dual_banks
= false,
275 .flash_base
= 0x40022000,
276 .fsize_base
= 0x1FF8007C,
280 /* flash bank stm32lx <base> <size> 0 0 <target#>
282 FLASH_BANK_COMMAND_HANDLER(stm32lx_flash_bank_command
)
284 struct stm32lx_flash_bank
*stm32lx_info
;
286 return ERROR_COMMAND_SYNTAX_ERROR
;
288 /* Create the bank structure */
289 stm32lx_info
= calloc(1, sizeof(*stm32lx_info
));
291 /* Check allocation */
292 if (stm32lx_info
== NULL
) {
293 LOG_ERROR("failed to allocate bank structure");
297 bank
->driver_priv
= stm32lx_info
;
299 stm32lx_info
->probed
= 0;
300 stm32lx_info
->user_bank_size
= bank
->size
;
302 /* the stm32l erased value is 0x00 */
303 bank
->default_padded_value
= 0x00;
308 COMMAND_HANDLER(stm32lx_handle_mass_erase_command
)
313 return ERROR_COMMAND_SYNTAX_ERROR
;
315 struct flash_bank
*bank
;
316 int retval
= CALL_COMMAND_HANDLER(flash_command_get_bank
, 0, &bank
);
317 if (ERROR_OK
!= retval
)
320 retval
= stm32lx_mass_erase(bank
);
321 if (retval
== ERROR_OK
) {
322 /* set all sectors as erased */
323 for (i
= 0; i
< bank
->num_sectors
; i
++)
324 bank
->sectors
[i
].is_erased
= 1;
326 command_print(CMD_CTX
, "stm32lx mass erase complete");
328 command_print(CMD_CTX
, "stm32lx mass erase failed");
334 COMMAND_HANDLER(stm32lx_handle_lock_command
)
337 return ERROR_COMMAND_SYNTAX_ERROR
;
339 struct flash_bank
*bank
;
340 int retval
= CALL_COMMAND_HANDLER(flash_command_get_bank
, 0, &bank
);
341 if (ERROR_OK
!= retval
)
344 retval
= stm32lx_lock(bank
);
346 if (retval
== ERROR_OK
)
347 command_print(CMD_CTX
, "STM32Lx locked, takes effect after power cycle.");
349 command_print(CMD_CTX
, "STM32Lx lock failed");
354 COMMAND_HANDLER(stm32lx_handle_unlock_command
)
357 return ERROR_COMMAND_SYNTAX_ERROR
;
359 struct flash_bank
*bank
;
360 int retval
= CALL_COMMAND_HANDLER(flash_command_get_bank
, 0, &bank
);
361 if (ERROR_OK
!= retval
)
364 retval
= stm32lx_unlock(bank
);
366 if (retval
== ERROR_OK
)
367 command_print(CMD_CTX
, "STM32Lx unlocked, takes effect after power cycle.");
369 command_print(CMD_CTX
, "STM32Lx unlock failed");
374 static int stm32lx_protect_check(struct flash_bank
*bank
)
377 struct target
*target
= bank
->target
;
378 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
383 * Read the WRPR word, and check each bit (corresponding to each
386 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_WRPR
,
388 if (retval
!= ERROR_OK
)
391 for (int i
= 0; i
< bank
->num_sectors
; i
++) {
393 bank
->sectors
[i
].is_protected
= 1;
395 bank
->sectors
[i
].is_protected
= 0;
400 static int stm32lx_erase(struct flash_bank
*bank
, int first
, int last
)
405 * It could be possible to do a mass erase if all sectors must be
406 * erased, but it is not implemented yet.
409 if (bank
->target
->state
!= TARGET_HALTED
) {
410 LOG_ERROR("Target not halted");
411 return ERROR_TARGET_NOT_HALTED
;
415 * Loop over the selected sectors and erase them
417 for (int i
= first
; i
<= last
; i
++) {
418 retval
= stm32lx_erase_sector(bank
, i
);
419 if (retval
!= ERROR_OK
)
421 bank
->sectors
[i
].is_erased
= 1;
426 static int stm32lx_protect(struct flash_bank
*bank
, int set
, int first
,
429 LOG_WARNING("protection of the STM32L flash is not implemented");
433 static int stm32lx_write_half_pages(struct flash_bank
*bank
, const uint8_t *buffer
,
434 uint32_t offset
, uint32_t count
)
436 struct target
*target
= bank
->target
;
437 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
439 uint32_t hp_nb
= stm32lx_info
->part_info
->page_size
/ 2;
440 uint32_t buffer_size
= 16384;
441 struct working_area
*write_algorithm
;
442 struct working_area
*source
;
443 uint32_t address
= bank
->base
+ offset
;
445 struct reg_param reg_params
[3];
446 struct armv7m_algorithm armv7m_info
;
448 int retval
= ERROR_OK
;
450 /* see contib/loaders/flash/stm32lx.S for src */
452 static const uint8_t stm32lx_flash_write_code
[] = {
454 0x00, 0x23, /* movs r3, #0 */
455 0x04, 0xe0, /* b test_done */
458 0x51, 0xf8, 0x04, 0xcb, /* ldr ip, [r1], #4 */
459 0x40, 0xf8, 0x04, 0xcb, /* str ip, [r0], #4 */
460 0x01, 0x33, /* adds r3, #1 */
463 0x93, 0x42, /* cmp r3, r2 */
464 0xf8, 0xd3, /* bcc write_word */
465 0x00, 0xbe, /* bkpt 0 */
468 /* Make sure we're performing a half-page aligned write. */
470 LOG_ERROR("The byte count must be %" PRIu32
"B-aligned but count is %" PRIi32
"B)", hp_nb
, count
);
474 /* flash write code */
475 if (target_alloc_working_area(target
, sizeof(stm32lx_flash_write_code
),
476 &write_algorithm
) != ERROR_OK
) {
477 LOG_DEBUG("no working area for block memory writes");
478 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
481 /* Write the flashing code */
482 retval
= target_write_buffer(target
,
483 write_algorithm
->address
,
484 sizeof(stm32lx_flash_write_code
),
485 stm32lx_flash_write_code
);
486 if (retval
!= ERROR_OK
) {
487 target_free_working_area(target
, write_algorithm
);
491 /* Allocate half pages memory */
492 while (target_alloc_working_area_try(target
, buffer_size
, &source
) != ERROR_OK
) {
493 if (buffer_size
> 1024)
498 if (buffer_size
<= stm32lx_info
->part_info
->page_size
) {
499 /* we already allocated the writing code, but failed to get a
500 * buffer, free the algorithm */
501 target_free_working_area(target
, write_algorithm
);
503 LOG_WARNING("no large enough working area available, can't do block memory writes");
504 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
508 armv7m_info
.common_magic
= ARMV7M_COMMON_MAGIC
;
509 armv7m_info
.core_mode
= ARM_MODE_THREAD
;
510 init_reg_param(®_params
[0], "r0", 32, PARAM_OUT
);
511 init_reg_param(®_params
[1], "r1", 32, PARAM_OUT
);
512 init_reg_param(®_params
[2], "r2", 32, PARAM_OUT
);
514 /* Enable half-page write */
515 retval
= stm32lx_enable_write_half_page(bank
);
516 if (retval
!= ERROR_OK
) {
517 target_free_working_area(target
, source
);
518 target_free_working_area(target
, write_algorithm
);
520 destroy_reg_param(®_params
[0]);
521 destroy_reg_param(®_params
[1]);
522 destroy_reg_param(®_params
[2]);
526 struct armv7m_common
*armv7m
= target_to_armv7m(target
);
527 if (armv7m
== NULL
) {
529 /* something is very wrong if armv7m is NULL */
530 LOG_ERROR("unable to get armv7m target");
534 /* save any DEMCR flags and configure target to catch any Hard Faults */
535 uint32_t demcr_save
= armv7m
->demcr
;
536 armv7m
->demcr
= VC_HARDERR
;
538 /* Loop while there are bytes to write */
541 this_count
= (count
> buffer_size
) ? buffer_size
: count
;
543 /* Write the next half pages */
544 retval
= target_write_buffer(target
, source
->address
, this_count
, buffer
);
545 if (retval
!= ERROR_OK
)
548 /* 4: Store useful information in the registers */
549 /* the destination address of the copy (R0) */
550 buf_set_u32(reg_params
[0].value
, 0, 32, address
);
551 /* The source address of the copy (R1) */
552 buf_set_u32(reg_params
[1].value
, 0, 32, source
->address
);
553 /* The length of the copy (R2) */
554 buf_set_u32(reg_params
[2].value
, 0, 32, this_count
/ 4);
556 /* 5: Execute the bunch of code */
557 retval
= target_run_algorithm(target
, 0, NULL
, sizeof(reg_params
)
558 / sizeof(*reg_params
), reg_params
,
559 write_algorithm
->address
, 0, 10000, &armv7m_info
);
560 if (retval
!= ERROR_OK
)
563 /* check for Hard Fault */
564 if (armv7m
->exception_number
== 3)
567 /* 6: Wait while busy */
568 retval
= stm32lx_wait_until_bsy_clear(bank
);
569 if (retval
!= ERROR_OK
)
572 buffer
+= this_count
;
573 address
+= this_count
;
577 /* restore previous flags */
578 armv7m
->demcr
= demcr_save
;
580 if (armv7m
->exception_number
== 3) {
582 /* the stm32l15x devices seem to have an issue when blank.
583 * if a ram loader is executed on a blank device it will
584 * Hard Fault, this issue does not happen for a already programmed device.
585 * A related issue is described in the stm32l151xx errata (Doc ID 17721 Rev 6 - 2.1.3).
586 * The workaround of handling the Hard Fault exception does work, but makes the
587 * loader more complicated, as a compromise we manually write the pages, programming time
588 * is reduced by 50% using this slower method.
591 LOG_WARNING("couldn't use loader, falling back to page memory writes");
595 this_count
= (count
> hp_nb
) ? hp_nb
: count
;
597 /* Write the next half pages */
598 retval
= target_write_buffer(target
, address
, this_count
, buffer
);
599 if (retval
!= ERROR_OK
)
602 /* Wait while busy */
603 retval
= stm32lx_wait_until_bsy_clear(bank
);
604 if (retval
!= ERROR_OK
)
607 buffer
+= this_count
;
608 address
+= this_count
;
613 if (retval
== ERROR_OK
)
614 retval
= stm32lx_lock_program_memory(bank
);
616 target_free_working_area(target
, source
);
617 target_free_working_area(target
, write_algorithm
);
619 destroy_reg_param(®_params
[0]);
620 destroy_reg_param(®_params
[1]);
621 destroy_reg_param(®_params
[2]);
626 static int stm32lx_write(struct flash_bank
*bank
, const uint8_t *buffer
,
627 uint32_t offset
, uint32_t count
)
629 struct target
*target
= bank
->target
;
630 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
632 uint32_t hp_nb
= stm32lx_info
->part_info
->page_size
/ 2;
633 uint32_t halfpages_number
;
634 uint32_t bytes_remaining
= 0;
635 uint32_t address
= bank
->base
+ offset
;
636 uint32_t bytes_written
= 0;
639 if (bank
->target
->state
!= TARGET_HALTED
) {
640 LOG_ERROR("Target not halted");
641 return ERROR_TARGET_NOT_HALTED
;
645 LOG_ERROR("offset 0x%" PRIx32
" breaks required 4-byte alignment", offset
);
646 return ERROR_FLASH_DST_BREAKS_ALIGNMENT
;
649 retval
= stm32lx_unlock_program_memory(bank
);
650 if (retval
!= ERROR_OK
)
653 /* first we need to write any unaligned head bytes upto
654 * the next 128 byte page */
657 bytes_remaining
= MIN(count
, hp_nb
- (offset
% hp_nb
));
659 while (bytes_remaining
> 0) {
660 uint8_t value
[4] = {0xff, 0xff, 0xff, 0xff};
662 /* copy remaining bytes into the write buffer */
663 uint32_t bytes_to_write
= MIN(4, bytes_remaining
);
664 memcpy(value
, buffer
+ bytes_written
, bytes_to_write
);
666 retval
= target_write_buffer(target
, address
, 4, value
);
667 if (retval
!= ERROR_OK
)
668 goto reset_pg_and_lock
;
670 bytes_written
+= bytes_to_write
;
671 bytes_remaining
-= bytes_to_write
;
674 retval
= stm32lx_wait_until_bsy_clear(bank
);
675 if (retval
!= ERROR_OK
)
676 goto reset_pg_and_lock
;
679 offset
+= bytes_written
;
680 count
-= bytes_written
;
682 /* this should always pass this check here */
683 assert((offset
% hp_nb
) == 0);
685 /* calculate half pages */
686 halfpages_number
= count
/ hp_nb
;
688 if (halfpages_number
) {
689 retval
= stm32lx_write_half_pages(bank
, buffer
+ bytes_written
, offset
, hp_nb
* halfpages_number
);
690 if (retval
== ERROR_TARGET_RESOURCE_NOT_AVAILABLE
) {
691 /* attempt slow memory writes */
692 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
693 halfpages_number
= 0;
695 if (retval
!= ERROR_OK
)
700 /* write any remaining bytes */
701 uint32_t page_bytes_written
= hp_nb
* halfpages_number
;
702 bytes_written
+= page_bytes_written
;
703 address
+= page_bytes_written
;
704 bytes_remaining
= count
- page_bytes_written
;
706 retval
= stm32lx_unlock_program_memory(bank
);
707 if (retval
!= ERROR_OK
)
710 while (bytes_remaining
> 0) {
711 uint8_t value
[4] = {0xff, 0xff, 0xff, 0xff};
713 /* copy remaining bytes into the write buffer */
714 uint32_t bytes_to_write
= MIN(4, bytes_remaining
);
715 memcpy(value
, buffer
+ bytes_written
, bytes_to_write
);
717 retval
= target_write_buffer(target
, address
, 4, value
);
718 if (retval
!= ERROR_OK
)
719 goto reset_pg_and_lock
;
721 bytes_written
+= bytes_to_write
;
722 bytes_remaining
-= bytes_to_write
;
725 retval
= stm32lx_wait_until_bsy_clear(bank
);
726 if (retval
!= ERROR_OK
)
727 goto reset_pg_and_lock
;
731 retval2
= stm32lx_lock_program_memory(bank
);
732 if (retval
== ERROR_OK
)
738 static int stm32lx_read_id_code(struct target
*target
, uint32_t *id
)
740 /* read stm32 device id register */
741 int retval
= target_read_u32(target
, DBGMCU_IDCODE
, id
);
742 if (retval
!= ERROR_OK
)
745 /* STM32L0 parts will have 0 there, try reading the L0's location for
746 * DBG_IDCODE in case this is an L0 part. */
748 retval
= target_read_u32(target
, DBGMCU_IDCODE_L0
, id
);
753 static int stm32lx_probe(struct flash_bank
*bank
)
755 struct target
*target
= bank
->target
;
756 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
758 uint16_t flash_size_in_kb
;
760 uint32_t base_address
= FLASH_BANK0_ADDRESS
;
761 uint32_t second_bank_base
;
763 stm32lx_info
->probed
= 0;
764 stm32lx_info
->part_info
= NULL
;
766 int retval
= stm32lx_read_id_code(bank
->target
, &device_id
);
767 if (retval
!= ERROR_OK
)
770 stm32lx_info
->idcode
= device_id
;
772 LOG_DEBUG("device id = 0x%08" PRIx32
"", device_id
);
774 for (unsigned int n
= 0; n
< ARRAY_SIZE(stm32lx_parts
); n
++) {
775 if ((device_id
& 0xfff) == stm32lx_parts
[n
].id
)
776 stm32lx_info
->part_info
= &stm32lx_parts
[n
];
779 if (!stm32lx_info
->part_info
) {
780 LOG_WARNING("Cannot identify target as a STM32L family.");
783 LOG_INFO("Device: %s", stm32lx_info
->part_info
->device_str
);
786 stm32lx_info
->flash_base
= stm32lx_info
->part_info
->flash_base
;
788 /* Get the flash size from target. */
789 retval
= target_read_u16(target
, stm32lx_info
->part_info
->fsize_base
,
792 /* 0x436 devices report their flash size as a 0 or 1 code indicating 384K
793 * or 256K, respectively. Please see RM0038 r8 or newer and refer to
795 if (retval
== ERROR_OK
&& (device_id
& 0xfff) == 0x436) {
796 if (flash_size_in_kb
== 0)
797 flash_size_in_kb
= 384;
798 else if (flash_size_in_kb
== 1)
799 flash_size_in_kb
= 256;
802 /* Failed reading flash size or flash size invalid (early silicon),
803 * default to max target family */
804 if (retval
!= ERROR_OK
|| flash_size_in_kb
== 0xffff || flash_size_in_kb
== 0) {
805 LOG_WARNING("STM32L flash size failed, probe inaccurate - assuming %dk flash",
806 stm32lx_info
->part_info
->max_flash_size_kb
);
807 flash_size_in_kb
= stm32lx_info
->part_info
->max_flash_size_kb
;
808 } else if (flash_size_in_kb
> stm32lx_info
->part_info
->max_flash_size_kb
) {
809 LOG_WARNING("STM32L probed flash size assumed incorrect since FLASH_SIZE=%dk > %dk, - assuming %dk flash",
810 flash_size_in_kb
, stm32lx_info
->part_info
->max_flash_size_kb
,
811 stm32lx_info
->part_info
->max_flash_size_kb
);
812 flash_size_in_kb
= stm32lx_info
->part_info
->max_flash_size_kb
;
815 if (stm32lx_info
->part_info
->has_dual_banks
) {
816 /* Use the configured base address to determine if this is the first or second flash bank.
817 * Verify that the base address is reasonably correct and determine the flash bank size
819 second_bank_base
= base_address
+
820 stm32lx_info
->part_info
->first_bank_size_kb
* 1024;
821 if (bank
->base
== second_bank_base
|| !bank
->base
) {
822 /* This is the second bank */
823 base_address
= second_bank_base
;
824 flash_size_in_kb
= flash_size_in_kb
-
825 stm32lx_info
->part_info
->first_bank_size_kb
;
826 } else if (bank
->base
== base_address
) {
827 /* This is the first bank */
828 flash_size_in_kb
= stm32lx_info
->part_info
->first_bank_size_kb
;
830 LOG_WARNING("STM32L flash bank base address config is incorrect."
831 " 0x%" PRIx32
" but should rather be 0x%" PRIx32
" or 0x%" PRIx32
,
832 bank
->base
, base_address
, second_bank_base
);
835 LOG_INFO("STM32L flash has dual banks. Bank (%d) size is %dkb, base address is 0x%" PRIx32
,
836 bank
->bank_number
, flash_size_in_kb
, base_address
);
838 LOG_INFO("STM32L flash size is %dkb, base address is 0x%" PRIx32
, flash_size_in_kb
, base_address
);
841 /* if the user sets the size manually then ignore the probed value
842 * this allows us to work around devices that have a invalid flash size register value */
843 if (stm32lx_info
->user_bank_size
) {
844 flash_size_in_kb
= stm32lx_info
->user_bank_size
/ 1024;
845 LOG_INFO("ignoring flash probed value, using configured bank size: %dkbytes", flash_size_in_kb
);
848 /* calculate numbers of sectors (4kB per sector) */
849 int num_sectors
= (flash_size_in_kb
* 1024) / FLASH_SECTOR_SIZE
;
853 bank
->sectors
= NULL
;
856 bank
->size
= flash_size_in_kb
* 1024;
857 bank
->base
= base_address
;
858 bank
->num_sectors
= num_sectors
;
859 bank
->sectors
= malloc(sizeof(struct flash_sector
) * num_sectors
);
860 if (bank
->sectors
== NULL
) {
861 LOG_ERROR("failed to allocate bank sectors");
865 for (i
= 0; i
< num_sectors
; i
++) {
866 bank
->sectors
[i
].offset
= i
* FLASH_SECTOR_SIZE
;
867 bank
->sectors
[i
].size
= FLASH_SECTOR_SIZE
;
868 bank
->sectors
[i
].is_erased
= -1;
869 bank
->sectors
[i
].is_protected
= 1;
872 stm32lx_info
->probed
= 1;
877 static int stm32lx_auto_probe(struct flash_bank
*bank
)
879 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
881 if (stm32lx_info
->probed
)
884 return stm32lx_probe(bank
);
887 static int stm32lx_erase_check(struct flash_bank
*bank
)
889 struct target
*target
= bank
->target
;
890 const int buffer_size
= 4096;
893 int retval
= ERROR_OK
;
895 if (bank
->target
->state
!= TARGET_HALTED
) {
896 LOG_ERROR("Target not halted");
897 return ERROR_TARGET_NOT_HALTED
;
900 uint8_t *buffer
= malloc(buffer_size
);
901 if (buffer
== NULL
) {
902 LOG_ERROR("failed to allocate read buffer");
906 for (i
= 0; i
< bank
->num_sectors
; i
++) {
908 bank
->sectors
[i
].is_erased
= 1;
910 /* Loop chunk by chunk over the sector */
911 for (j
= 0; j
< bank
->sectors
[i
].size
; j
+= buffer_size
) {
914 if (chunk
> (j
- bank
->sectors
[i
].size
))
915 chunk
= (j
- bank
->sectors
[i
].size
);
917 retval
= target_read_memory(target
, bank
->base
918 + bank
->sectors
[i
].offset
+ j
, 4, chunk
/ 4, buffer
);
919 if (retval
!= ERROR_OK
)
922 for (nBytes
= 0; nBytes
< chunk
; nBytes
++) {
923 if (buffer
[nBytes
] != 0x00) {
924 bank
->sectors
[i
].is_erased
= 0;
929 if (retval
!= ERROR_OK
)
937 /* This method must return a string displaying information about the bank */
938 static int stm32lx_get_info(struct flash_bank
*bank
, char *buf
, int buf_size
)
940 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
942 if (!stm32lx_info
->probed
) {
943 int retval
= stm32lx_probe(bank
);
944 if (retval
!= ERROR_OK
) {
945 snprintf(buf
, buf_size
,
946 "Unable to find bank information.");
951 const struct stm32lx_part_info
*info
= stm32lx_info
->part_info
;
954 const char *rev_str
= NULL
;
955 uint16_t rev_id
= stm32lx_info
->idcode
>> 16;
957 for (unsigned int i
= 0; i
< info
->num_revs
; i
++)
958 if (rev_id
== info
->revs
[i
].rev
)
959 rev_str
= info
->revs
[i
].str
;
961 if (rev_str
!= NULL
) {
962 snprintf(buf
, buf_size
,
964 stm32lx_info
->part_info
->device_str
, rev_str
);
966 snprintf(buf
, buf_size
,
967 "%s - Rev: unknown (0x%04x)",
968 stm32lx_info
->part_info
->device_str
, rev_id
);
973 snprintf(buf
, buf_size
, "Cannot identify target as a STM32Lx");
979 static const struct command_registration stm32lx_exec_command_handlers
[] = {
981 .name
= "mass_erase",
982 .handler
= stm32lx_handle_mass_erase_command
,
983 .mode
= COMMAND_EXEC
,
985 .help
= "Erase entire flash device. including available EEPROM",
989 .handler
= stm32lx_handle_lock_command
,
990 .mode
= COMMAND_EXEC
,
992 .help
= "Increase the readout protection to Level 1.",
996 .handler
= stm32lx_handle_unlock_command
,
997 .mode
= COMMAND_EXEC
,
999 .help
= "Lower the readout protection from Level 1 to 0.",
1001 COMMAND_REGISTRATION_DONE
1004 static const struct command_registration stm32lx_command_handlers
[] = {
1007 .mode
= COMMAND_ANY
,
1008 .help
= "stm32lx flash command group",
1010 .chain
= stm32lx_exec_command_handlers
,
1012 COMMAND_REGISTRATION_DONE
1015 struct flash_driver stm32lx_flash
= {
1017 .commands
= stm32lx_command_handlers
,
1018 .flash_bank_command
= stm32lx_flash_bank_command
,
1019 .erase
= stm32lx_erase
,
1020 .protect
= stm32lx_protect
,
1021 .write
= stm32lx_write
,
1022 .read
= default_flash_read
,
1023 .probe
= stm32lx_probe
,
1024 .auto_probe
= stm32lx_auto_probe
,
1025 .erase_check
= stm32lx_erase_check
,
1026 .protect_check
= stm32lx_protect_check
,
1027 .info
= stm32lx_get_info
,
1030 /* Static methods implementation */
1031 static int stm32lx_unlock_program_memory(struct flash_bank
*bank
)
1033 struct target
*target
= bank
->target
;
1034 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1039 * Unlocking the program memory is done by unlocking the PECR,
1040 * then by writing the 2 PRGKEY to the PRGKEYR register
1043 /* check flash is not already unlocked */
1044 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1046 if (retval
!= ERROR_OK
)
1049 if ((reg32
& FLASH_PECR__PRGLOCK
) == 0)
1052 /* To unlock the PECR write the 2 PEKEY to the PEKEYR register */
1053 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PEKEYR
,
1055 if (retval
!= ERROR_OK
)
1058 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PEKEYR
,
1060 if (retval
!= ERROR_OK
)
1063 /* Make sure it worked */
1064 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1066 if (retval
!= ERROR_OK
)
1069 if (reg32
& FLASH_PECR__PELOCK
) {
1070 LOG_ERROR("PELOCK is not cleared :(");
1071 return ERROR_FLASH_OPERATION_FAILED
;
1074 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PRGKEYR
,
1076 if (retval
!= ERROR_OK
)
1078 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PRGKEYR
,
1080 if (retval
!= ERROR_OK
)
1083 /* Make sure it worked */
1084 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1086 if (retval
!= ERROR_OK
)
1089 if (reg32
& FLASH_PECR__PRGLOCK
) {
1090 LOG_ERROR("PRGLOCK is not cleared :(");
1091 return ERROR_FLASH_OPERATION_FAILED
;
1097 static int stm32lx_enable_write_half_page(struct flash_bank
*bank
)
1099 struct target
*target
= bank
->target
;
1100 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1105 * Unlock the program memory, then set the FPRG bit in the PECR register.
1107 retval
= stm32lx_unlock_program_memory(bank
);
1108 if (retval
!= ERROR_OK
)
1111 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1113 if (retval
!= ERROR_OK
)
1116 reg32
|= FLASH_PECR__FPRG
;
1117 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1119 if (retval
!= ERROR_OK
)
1122 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1124 if (retval
!= ERROR_OK
)
1127 reg32
|= FLASH_PECR__PROG
;
1128 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1134 static int stm32lx_lock_program_memory(struct flash_bank
*bank
)
1136 struct target
*target
= bank
->target
;
1137 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1141 /* To lock the program memory, simply set the lock bit and lock PECR */
1143 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1145 if (retval
!= ERROR_OK
)
1148 reg32
|= FLASH_PECR__PRGLOCK
;
1149 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1151 if (retval
!= ERROR_OK
)
1154 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1156 if (retval
!= ERROR_OK
)
1159 reg32
|= FLASH_PECR__PELOCK
;
1160 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1162 if (retval
!= ERROR_OK
)
1168 static int stm32lx_erase_sector(struct flash_bank
*bank
, int sector
)
1170 struct target
*target
= bank
->target
;
1171 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1176 * To erase a sector (i.e. stm32lx_info->part_info.pages_per_sector pages),
1177 * first unlock the memory, loop over the pages of this sector
1178 * and write 0x0 to its first word.
1181 retval
= stm32lx_unlock_program_memory(bank
);
1182 if (retval
!= ERROR_OK
)
1185 for (int page
= 0; page
< (int)stm32lx_info
->part_info
->pages_per_sector
;
1187 reg32
= FLASH_PECR__PROG
| FLASH_PECR__ERASE
;
1188 retval
= target_write_u32(target
,
1189 stm32lx_info
->flash_base
+ FLASH_PECR
, reg32
);
1190 if (retval
!= ERROR_OK
)
1193 retval
= stm32lx_wait_until_bsy_clear(bank
);
1194 if (retval
!= ERROR_OK
)
1197 uint32_t addr
= bank
->base
+ bank
->sectors
[sector
].offset
+ (page
1198 * stm32lx_info
->part_info
->page_size
);
1199 retval
= target_write_u32(target
, addr
, 0x0);
1200 if (retval
!= ERROR_OK
)
1203 retval
= stm32lx_wait_until_bsy_clear(bank
);
1204 if (retval
!= ERROR_OK
)
1208 retval
= stm32lx_lock_program_memory(bank
);
1209 if (retval
!= ERROR_OK
)
1215 static inline int stm32lx_get_flash_status(struct flash_bank
*bank
, uint32_t *status
)
1217 struct target
*target
= bank
->target
;
1218 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1220 return target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_SR
, status
);
1223 static int stm32lx_wait_until_bsy_clear(struct flash_bank
*bank
)
1225 return stm32lx_wait_until_bsy_clear_timeout(bank
, 100);
1228 static int stm32lx_unlock_options_bytes(struct flash_bank
*bank
)
1230 struct target
*target
= bank
->target
;
1231 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1236 * Unlocking the options bytes is done by unlocking the PECR,
1237 * then by writing the 2 FLASH_PEKEYR to the FLASH_OPTKEYR register
1240 /* check flash is not already unlocked */
1241 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
, ®32
);
1242 if (retval
!= ERROR_OK
)
1245 if ((reg32
& FLASH_PECR__OPTLOCK
) == 0)
1248 if ((reg32
& FLASH_PECR__PELOCK
) != 0) {
1250 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PEKEYR
, PEKEY1
);
1251 if (retval
!= ERROR_OK
)
1254 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PEKEYR
, PEKEY2
);
1255 if (retval
!= ERROR_OK
)
1259 /* To unlock the PECR write the 2 OPTKEY to the FLASH_OPTKEYR register */
1260 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_OPTKEYR
, OPTKEY1
);
1261 if (retval
!= ERROR_OK
)
1264 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_OPTKEYR
, OPTKEY2
);
1265 if (retval
!= ERROR_OK
)
1271 static int stm32lx_wait_until_bsy_clear_timeout(struct flash_bank
*bank
, int timeout
)
1273 struct target
*target
= bank
->target
;
1274 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1276 int retval
= ERROR_OK
;
1278 /* wait for busy to clear */
1280 retval
= stm32lx_get_flash_status(bank
, &status
);
1281 if (retval
!= ERROR_OK
)
1284 LOG_DEBUG("status: 0x%" PRIx32
"", status
);
1285 if ((status
& FLASH_SR__BSY
) == 0)
1288 if (timeout
-- <= 0) {
1289 LOG_ERROR("timed out waiting for flash");
1295 if (status
& FLASH_SR__WRPERR
) {
1296 LOG_ERROR("access denied / write protected");
1297 retval
= ERROR_FAIL
;
1300 if (status
& FLASH_SR__PGAERR
) {
1301 LOG_ERROR("invalid program address");
1302 retval
= ERROR_FAIL
;
1305 /* Clear but report errors */
1306 if (status
& FLASH_SR__OPTVERR
) {
1307 /* If this operation fails, we ignore it and report the original retval */
1308 target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_SR
, status
& FLASH_SR__OPTVERR
);
1314 static int stm32lx_obl_launch(struct flash_bank
*bank
)
1316 struct target
*target
= bank
->target
;
1317 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1320 /* This will fail as the target gets immediately rebooted */
1321 target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1322 FLASH_PECR__OBL_LAUNCH
);
1326 target_halt(target
);
1327 retval
= target_poll(target
);
1328 } while (--tries
> 0 &&
1329 (retval
!= ERROR_OK
|| target
->state
!= TARGET_HALTED
));
1331 return tries
? ERROR_OK
: ERROR_FAIL
;
1334 static int stm32lx_lock(struct flash_bank
*bank
)
1337 struct target
*target
= bank
->target
;
1339 if (target
->state
!= TARGET_HALTED
) {
1340 LOG_ERROR("Target not halted");
1341 return ERROR_TARGET_NOT_HALTED
;
1344 retval
= stm32lx_unlock_options_bytes(bank
);
1345 if (retval
!= ERROR_OK
)
1348 /* set the RDP protection level to 1 */
1349 retval
= target_write_u32(target
, OPTION_BYTES_ADDRESS
, OPTION_BYTE_0_PR1
);
1350 if (retval
!= ERROR_OK
)
1356 static int stm32lx_unlock(struct flash_bank
*bank
)
1359 struct target
*target
= bank
->target
;
1361 if (target
->state
!= TARGET_HALTED
) {
1362 LOG_ERROR("Target not halted");
1363 return ERROR_TARGET_NOT_HALTED
;
1366 retval
= stm32lx_unlock_options_bytes(bank
);
1367 if (retval
!= ERROR_OK
)
1370 /* set the RDP protection level to 0 */
1371 retval
= target_write_u32(target
, OPTION_BYTES_ADDRESS
, OPTION_BYTE_0_PR0
);
1372 if (retval
!= ERROR_OK
)
1375 retval
= stm32lx_wait_until_bsy_clear_timeout(bank
, 30000);
1376 if (retval
!= ERROR_OK
)
1382 static int stm32lx_mass_erase(struct flash_bank
*bank
)
1385 struct target
*target
= bank
->target
;
1386 struct stm32lx_flash_bank
*stm32lx_info
= NULL
;
1389 if (target
->state
!= TARGET_HALTED
) {
1390 LOG_ERROR("Target not halted");
1391 return ERROR_TARGET_NOT_HALTED
;
1394 stm32lx_info
= bank
->driver_priv
;
1396 retval
= stm32lx_lock(bank
);
1397 if (retval
!= ERROR_OK
)
1400 retval
= stm32lx_obl_launch(bank
);
1401 if (retval
!= ERROR_OK
)
1404 retval
= stm32lx_unlock(bank
);
1405 if (retval
!= ERROR_OK
)
1408 retval
= stm32lx_obl_launch(bank
);
1409 if (retval
!= ERROR_OK
)
1412 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
, ®32
);
1413 if (retval
!= ERROR_OK
)
1416 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
, reg32
| FLASH_PECR__OPTLOCK
);
1417 if (retval
!= ERROR_OK
)
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)