1 /***************************************************************************
2 * Copyright (C) 2005 by Dominic Rath *
3 * Dominic.Rath@gmx.de *
5 * Copyright (C) 2008 by Spencer Oliver *
6 * spen@spen-soft.co.uk *
8 * Copyright (C) 2011 by Clement Burin des Roziers *
9 * clement.burin-des-roziers@hikob.com *
11 * This program is free software; you can redistribute it and/or modify *
12 * it under the terms of the GNU General Public License as published by *
13 * the Free Software Foundation; either version 2 of the License, or *
14 * (at your option) any later version. *
16 * This program is distributed in the hope that it will be useful, *
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
19 * GNU General Public License for more details. *
21 * You should have received a copy of the GNU General Public License *
22 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
23 ***************************************************************************/
30 #include <helper/binarybuffer.h>
31 #include <target/algorithm.h>
32 #include <target/armv7m.h>
33 #include <target/cortex_m.h>
35 /* stm32lx flash register locations */
37 #define FLASH_ACR 0x00
38 #define FLASH_PECR 0x04
39 #define FLASH_PDKEYR 0x08
40 #define FLASH_PEKEYR 0x0C
41 #define FLASH_PRGKEYR 0x10
42 #define FLASH_OPTKEYR 0x14
44 #define FLASH_OBR 0x1C
45 #define FLASH_WRPR 0x20
48 #define FLASH_ACR__LATENCY (1<<0)
49 #define FLASH_ACR__PRFTEN (1<<1)
50 #define FLASH_ACR__ACC64 (1<<2)
51 #define FLASH_ACR__SLEEP_PD (1<<3)
52 #define FLASH_ACR__RUN_PD (1<<4)
55 #define FLASH_PECR__PELOCK (1<<0)
56 #define FLASH_PECR__PRGLOCK (1<<1)
57 #define FLASH_PECR__OPTLOCK (1<<2)
58 #define FLASH_PECR__PROG (1<<3)
59 #define FLASH_PECR__DATA (1<<4)
60 #define FLASH_PECR__FTDW (1<<8)
61 #define FLASH_PECR__ERASE (1<<9)
62 #define FLASH_PECR__FPRG (1<<10)
63 #define FLASH_PECR__EOPIE (1<<16)
64 #define FLASH_PECR__ERRIE (1<<17)
65 #define FLASH_PECR__OBL_LAUNCH (1<<18)
68 #define FLASH_SR__BSY (1<<0)
69 #define FLASH_SR__EOP (1<<1)
70 #define FLASH_SR__ENDHV (1<<2)
71 #define FLASH_SR__READY (1<<3)
72 #define FLASH_SR__WRPERR (1<<8)
73 #define FLASH_SR__PGAERR (1<<9)
74 #define FLASH_SR__SIZERR (1<<10)
75 #define FLASH_SR__OPTVERR (1<<11)
78 #define PEKEY1 0x89ABCDEF
79 #define PEKEY2 0x02030405
80 #define PRGKEY1 0x8C9DAEBF
81 #define PRGKEY2 0x13141516
82 #define OPTKEY1 0xFBEAD9C8
83 #define OPTKEY2 0x24252627
86 #define DBGMCU_IDCODE 0xE0042000
87 #define DBGMCU_IDCODE_L0 0x40015800
90 #define FLASH_SECTOR_SIZE 4096
91 #define FLASH_BANK0_ADDRESS 0x08000000
94 #define OPTION_BYTES_ADDRESS 0x1FF80000
96 #define OPTION_BYTE_0_PR1 0xFFFF0000
97 #define OPTION_BYTE_0_PR0 0xFF5500AA
99 static int stm32lx_unlock_program_memory(struct flash_bank
*bank
);
100 static int stm32lx_lock_program_memory(struct flash_bank
*bank
);
101 static int stm32lx_enable_write_half_page(struct flash_bank
*bank
);
102 static int stm32lx_erase_sector(struct flash_bank
*bank
, int sector
);
103 static int stm32lx_wait_until_bsy_clear(struct flash_bank
*bank
);
104 static int stm32lx_lock(struct flash_bank
*bank
);
105 static int stm32lx_unlock(struct flash_bank
*bank
);
106 static int stm32lx_mass_erase(struct flash_bank
*bank
);
107 static int stm32lx_wait_until_bsy_clear_timeout(struct flash_bank
*bank
, int timeout
);
108 static int stm32lx_update_part_info(struct flash_bank
*bank
, uint16_t flash_size_in_kb
);
115 struct stm32lx_part_info
{
117 const char *device_str
;
118 const struct stm32lx_rev
*revs
;
120 unsigned int page_size
;
121 unsigned int pages_per_sector
;
122 uint16_t max_flash_size_kb
;
123 uint16_t first_bank_size_kb
; /* used when has_dual_banks is true */
126 uint32_t flash_base
; /* Flash controller registers location */
127 uint32_t fsize_base
; /* Location of FSIZE register */
130 struct stm32lx_flash_bank
{
133 uint32_t user_bank_size
;
136 struct stm32lx_part_info part_info
;
139 static const struct stm32lx_rev stm32_416_revs
[] = {
140 { 0x1000, "A" }, { 0x1008, "Y" }, { 0x1038, "W" }, { 0x1078, "V" },
142 static const struct stm32lx_rev stm32_417_revs
[] = {
143 { 0x1000, "A" }, { 0x1008, "Z" }, { 0x1018, "Y" }, { 0x1038, "X" }
145 static const struct stm32lx_rev stm32_425_revs
[] = {
146 { 0x1000, "A" }, { 0x2000, "B" }, { 0x2008, "Y" },
148 static const struct stm32lx_rev stm32_427_revs
[] = {
149 { 0x1000, "A" }, { 0x1018, "Y" }, { 0x1038, "X" }, { 0x10f8, "V" },
151 static const struct stm32lx_rev stm32_429_revs
[] = {
152 { 0x1000, "A" }, { 0x1018, "Z" },
154 static const struct stm32lx_rev stm32_436_revs
[] = {
155 { 0x1000, "A" }, { 0x1008, "Z" }, { 0x1018, "Y" },
157 static const struct stm32lx_rev stm32_437_revs
[] = {
160 static const struct stm32lx_rev stm32_447_revs
[] = {
161 { 0x1000, "A" }, { 0x2000, "B" }, { 0x2008, "Z" },
163 static const struct stm32lx_rev stm32_457_revs
[] = {
164 { 0x1000, "A" }, { 0x1008, "Z" },
167 static const struct stm32lx_part_info stm32lx_parts
[] = {
170 .revs
= stm32_416_revs
,
171 .num_revs
= ARRAY_SIZE(stm32_416_revs
),
172 .device_str
= "STM32L1xx (Cat.1 - Low/Medium Density)",
174 .pages_per_sector
= 16,
175 .max_flash_size_kb
= 128,
176 .has_dual_banks
= false,
177 .flash_base
= 0x40023C00,
178 .fsize_base
= 0x1FF8004C,
182 .revs
= stm32_417_revs
,
183 .num_revs
= ARRAY_SIZE(stm32_417_revs
),
184 .device_str
= "STM32L0xx (Cat. 3)",
186 .pages_per_sector
= 32,
187 .max_flash_size_kb
= 64,
188 .has_dual_banks
= false,
189 .flash_base
= 0x40022000,
190 .fsize_base
= 0x1FF8007C,
194 .revs
= stm32_425_revs
,
195 .num_revs
= ARRAY_SIZE(stm32_425_revs
),
196 .device_str
= "STM32L0xx (Cat. 2)",
198 .pages_per_sector
= 32,
199 .max_flash_size_kb
= 32,
200 .has_dual_banks
= false,
201 .flash_base
= 0x40022000,
202 .fsize_base
= 0x1FF8007C,
206 .revs
= stm32_427_revs
,
207 .num_revs
= ARRAY_SIZE(stm32_427_revs
),
208 .device_str
= "STM32L1xx (Cat.3 - Medium+ Density)",
210 .pages_per_sector
= 16,
211 .max_flash_size_kb
= 256,
212 .has_dual_banks
= false,
213 .flash_base
= 0x40023C00,
214 .fsize_base
= 0x1FF800CC,
218 .revs
= stm32_429_revs
,
219 .num_revs
= ARRAY_SIZE(stm32_429_revs
),
220 .device_str
= "STM32L1xx (Cat.2)",
222 .pages_per_sector
= 16,
223 .max_flash_size_kb
= 128,
224 .has_dual_banks
= false,
225 .flash_base
= 0x40023C00,
226 .fsize_base
= 0x1FF8004C,
230 .revs
= stm32_436_revs
,
231 .num_revs
= ARRAY_SIZE(stm32_436_revs
),
232 .device_str
= "STM32L1xx (Cat.4/Cat.3 - Medium+/High Density)",
234 .pages_per_sector
= 16,
235 .max_flash_size_kb
= 384,
236 .first_bank_size_kb
= 192,
237 .has_dual_banks
= true,
238 .flash_base
= 0x40023C00,
239 .fsize_base
= 0x1FF800CC,
243 .revs
= stm32_437_revs
,
244 .num_revs
= ARRAY_SIZE(stm32_437_revs
),
245 .device_str
= "STM32L1xx (Cat.5/Cat.6)",
247 .pages_per_sector
= 16,
248 .max_flash_size_kb
= 512,
249 .first_bank_size_kb
= 0, /* determined in runtime */
250 .has_dual_banks
= true,
251 .flash_base
= 0x40023C00,
252 .fsize_base
= 0x1FF800CC,
256 .revs
= stm32_447_revs
,
257 .num_revs
= ARRAY_SIZE(stm32_447_revs
),
258 .device_str
= "STM32L0xx (Cat.5)",
260 .pages_per_sector
= 32,
261 .max_flash_size_kb
= 192,
262 .first_bank_size_kb
= 0, /* determined in runtime */
263 .has_dual_banks
= false, /* determined in runtime */
264 .flash_base
= 0x40022000,
265 .fsize_base
= 0x1FF8007C,
269 .revs
= stm32_457_revs
,
270 .num_revs
= ARRAY_SIZE(stm32_457_revs
),
271 .device_str
= "STM32L0xx (Cat.1)",
273 .pages_per_sector
= 32,
274 .max_flash_size_kb
= 16,
275 .has_dual_banks
= false,
276 .flash_base
= 0x40022000,
277 .fsize_base
= 0x1FF8007C,
281 /* flash bank stm32lx <base> <size> 0 0 <target#>
283 FLASH_BANK_COMMAND_HANDLER(stm32lx_flash_bank_command
)
285 struct stm32lx_flash_bank
*stm32lx_info
;
287 return ERROR_COMMAND_SYNTAX_ERROR
;
289 /* Create the bank structure */
290 stm32lx_info
= calloc(1, sizeof(*stm32lx_info
));
292 /* Check allocation */
293 if (stm32lx_info
== NULL
) {
294 LOG_ERROR("failed to allocate bank structure");
298 bank
->driver_priv
= stm32lx_info
;
300 stm32lx_info
->probed
= 0;
301 stm32lx_info
->user_bank_size
= bank
->size
;
303 /* the stm32l erased value is 0x00 */
304 bank
->default_padded_value
= bank
->erased_value
= 0x00;
309 COMMAND_HANDLER(stm32lx_handle_mass_erase_command
)
314 return ERROR_COMMAND_SYNTAX_ERROR
;
316 struct flash_bank
*bank
;
317 int retval
= CALL_COMMAND_HANDLER(flash_command_get_bank
, 0, &bank
);
318 if (ERROR_OK
!= retval
)
321 retval
= stm32lx_mass_erase(bank
);
322 if (retval
== ERROR_OK
) {
323 /* set all sectors as erased */
324 for (i
= 0; i
< bank
->num_sectors
; i
++)
325 bank
->sectors
[i
].is_erased
= 1;
327 command_print(CMD_CTX
, "stm32lx mass erase complete");
329 command_print(CMD_CTX
, "stm32lx mass erase failed");
335 COMMAND_HANDLER(stm32lx_handle_lock_command
)
338 return ERROR_COMMAND_SYNTAX_ERROR
;
340 struct flash_bank
*bank
;
341 int retval
= CALL_COMMAND_HANDLER(flash_command_get_bank
, 0, &bank
);
342 if (ERROR_OK
!= retval
)
345 retval
= stm32lx_lock(bank
);
347 if (retval
== ERROR_OK
)
348 command_print(CMD_CTX
, "STM32Lx locked, takes effect after power cycle.");
350 command_print(CMD_CTX
, "STM32Lx lock failed");
355 COMMAND_HANDLER(stm32lx_handle_unlock_command
)
358 return ERROR_COMMAND_SYNTAX_ERROR
;
360 struct flash_bank
*bank
;
361 int retval
= CALL_COMMAND_HANDLER(flash_command_get_bank
, 0, &bank
);
362 if (ERROR_OK
!= retval
)
365 retval
= stm32lx_unlock(bank
);
367 if (retval
== ERROR_OK
)
368 command_print(CMD_CTX
, "STM32Lx unlocked, takes effect after power cycle.");
370 command_print(CMD_CTX
, "STM32Lx unlock failed");
375 static int stm32lx_protect_check(struct flash_bank
*bank
)
378 struct target
*target
= bank
->target
;
379 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
384 * Read the WRPR word, and check each bit (corresponding to each
387 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_WRPR
,
389 if (retval
!= ERROR_OK
)
392 for (int i
= 0; i
< bank
->num_sectors
; i
++) {
394 bank
->sectors
[i
].is_protected
= 1;
396 bank
->sectors
[i
].is_protected
= 0;
401 static int stm32lx_erase(struct flash_bank
*bank
, int first
, int last
)
406 * It could be possible to do a mass erase if all sectors must be
407 * erased, but it is not implemented yet.
410 if (bank
->target
->state
!= TARGET_HALTED
) {
411 LOG_ERROR("Target not halted");
412 return ERROR_TARGET_NOT_HALTED
;
416 * Loop over the selected sectors and erase them
418 for (int i
= first
; i
<= last
; i
++) {
419 retval
= stm32lx_erase_sector(bank
, i
);
420 if (retval
!= ERROR_OK
)
422 bank
->sectors
[i
].is_erased
= 1;
427 static int stm32lx_write_half_pages(struct flash_bank
*bank
, const uint8_t *buffer
,
428 uint32_t offset
, uint32_t count
)
430 struct target
*target
= bank
->target
;
431 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
433 uint32_t hp_nb
= stm32lx_info
->part_info
.page_size
/ 2;
434 uint32_t buffer_size
= 16384;
435 struct working_area
*write_algorithm
;
436 struct working_area
*source
;
437 uint32_t address
= bank
->base
+ offset
;
439 struct reg_param reg_params
[3];
440 struct armv7m_algorithm armv7m_info
;
442 int retval
= ERROR_OK
;
444 static const uint8_t stm32lx_flash_write_code
[] = {
445 #include "../../../contrib/loaders/flash/stm32/stm32lx.inc"
448 /* Make sure we're performing a half-page aligned write. */
450 LOG_ERROR("The byte count must be %" PRIu32
"B-aligned but count is %" PRIi32
"B)", hp_nb
, count
);
454 /* flash write code */
455 if (target_alloc_working_area(target
, sizeof(stm32lx_flash_write_code
),
456 &write_algorithm
) != ERROR_OK
) {
457 LOG_DEBUG("no working area for block memory writes");
458 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
461 /* Write the flashing code */
462 retval
= target_write_buffer(target
,
463 write_algorithm
->address
,
464 sizeof(stm32lx_flash_write_code
),
465 stm32lx_flash_write_code
);
466 if (retval
!= ERROR_OK
) {
467 target_free_working_area(target
, write_algorithm
);
471 /* Allocate half pages memory */
472 while (target_alloc_working_area_try(target
, buffer_size
, &source
) != ERROR_OK
) {
473 if (buffer_size
> 1024)
478 if (buffer_size
<= stm32lx_info
->part_info
.page_size
) {
479 /* we already allocated the writing code, but failed to get a
480 * buffer, free the algorithm */
481 target_free_working_area(target
, write_algorithm
);
483 LOG_WARNING("no large enough working area available, can't do block memory writes");
484 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE
;
488 armv7m_info
.common_magic
= ARMV7M_COMMON_MAGIC
;
489 armv7m_info
.core_mode
= ARM_MODE_THREAD
;
490 init_reg_param(®_params
[0], "r0", 32, PARAM_OUT
);
491 init_reg_param(®_params
[1], "r1", 32, PARAM_OUT
);
492 init_reg_param(®_params
[2], "r2", 32, PARAM_OUT
);
494 /* Enable half-page write */
495 retval
= stm32lx_enable_write_half_page(bank
);
496 if (retval
!= ERROR_OK
) {
497 target_free_working_area(target
, source
);
498 target_free_working_area(target
, write_algorithm
);
500 destroy_reg_param(®_params
[0]);
501 destroy_reg_param(®_params
[1]);
502 destroy_reg_param(®_params
[2]);
506 struct armv7m_common
*armv7m
= target_to_armv7m(target
);
507 if (armv7m
== NULL
) {
509 /* something is very wrong if armv7m is NULL */
510 LOG_ERROR("unable to get armv7m target");
514 /* save any DEMCR flags and configure target to catch any Hard Faults */
515 uint32_t demcr_save
= armv7m
->demcr
;
516 armv7m
->demcr
= VC_HARDERR
;
518 /* Loop while there are bytes to write */
521 this_count
= (count
> buffer_size
) ? buffer_size
: count
;
523 /* Write the next half pages */
524 retval
= target_write_buffer(target
, source
->address
, this_count
, buffer
);
525 if (retval
!= ERROR_OK
)
528 /* 4: Store useful information in the registers */
529 /* the destination address of the copy (R0) */
530 buf_set_u32(reg_params
[0].value
, 0, 32, address
);
531 /* The source address of the copy (R1) */
532 buf_set_u32(reg_params
[1].value
, 0, 32, source
->address
);
533 /* The length of the copy (R2) */
534 buf_set_u32(reg_params
[2].value
, 0, 32, this_count
/ 4);
536 /* 5: Execute the bunch of code */
537 retval
= target_run_algorithm(target
, 0, NULL
, sizeof(reg_params
)
538 / sizeof(*reg_params
), reg_params
,
539 write_algorithm
->address
, 0, 10000, &armv7m_info
);
540 if (retval
!= ERROR_OK
)
543 /* check for Hard Fault */
544 if (armv7m
->exception_number
== 3)
547 /* 6: Wait while busy */
548 retval
= stm32lx_wait_until_bsy_clear(bank
);
549 if (retval
!= ERROR_OK
)
552 buffer
+= this_count
;
553 address
+= this_count
;
557 /* restore previous flags */
558 armv7m
->demcr
= demcr_save
;
560 if (armv7m
->exception_number
== 3) {
562 /* the stm32l15x devices seem to have an issue when blank.
563 * if a ram loader is executed on a blank device it will
564 * Hard Fault, this issue does not happen for a already programmed device.
565 * A related issue is described in the stm32l151xx errata (Doc ID 17721 Rev 6 - 2.1.3).
566 * The workaround of handling the Hard Fault exception does work, but makes the
567 * loader more complicated, as a compromise we manually write the pages, programming time
568 * is reduced by 50% using this slower method.
571 LOG_WARNING("Couldn't use loader, falling back to page memory writes");
575 this_count
= (count
> hp_nb
) ? hp_nb
: count
;
577 /* Write the next half pages */
578 retval
= target_write_buffer(target
, address
, this_count
, buffer
);
579 if (retval
!= ERROR_OK
)
582 /* Wait while busy */
583 retval
= stm32lx_wait_until_bsy_clear(bank
);
584 if (retval
!= ERROR_OK
)
587 buffer
+= this_count
;
588 address
+= this_count
;
593 if (retval
== ERROR_OK
)
594 retval
= stm32lx_lock_program_memory(bank
);
596 target_free_working_area(target
, source
);
597 target_free_working_area(target
, write_algorithm
);
599 destroy_reg_param(®_params
[0]);
600 destroy_reg_param(®_params
[1]);
601 destroy_reg_param(®_params
[2]);
606 static int stm32lx_write(struct flash_bank
*bank
, const uint8_t *buffer
,
607 uint32_t offset
, uint32_t count
)
609 struct target
*target
= bank
->target
;
610 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
612 uint32_t hp_nb
= stm32lx_info
->part_info
.page_size
/ 2;
613 uint32_t halfpages_number
;
614 uint32_t bytes_remaining
= 0;
615 uint32_t address
= bank
->base
+ offset
;
616 uint32_t bytes_written
= 0;
619 if (bank
->target
->state
!= TARGET_HALTED
) {
620 LOG_ERROR("Target not halted");
621 return ERROR_TARGET_NOT_HALTED
;
625 LOG_ERROR("offset 0x%" PRIx32
" breaks required 4-byte alignment", offset
);
626 return ERROR_FLASH_DST_BREAKS_ALIGNMENT
;
629 retval
= stm32lx_unlock_program_memory(bank
);
630 if (retval
!= ERROR_OK
)
633 /* first we need to write any unaligned head bytes upto
634 * the next 128 byte page */
637 bytes_remaining
= MIN(count
, hp_nb
- (offset
% hp_nb
));
639 while (bytes_remaining
> 0) {
640 uint8_t value
[4] = {0xff, 0xff, 0xff, 0xff};
642 /* copy remaining bytes into the write buffer */
643 uint32_t bytes_to_write
= MIN(4, bytes_remaining
);
644 memcpy(value
, buffer
+ bytes_written
, bytes_to_write
);
646 retval
= target_write_buffer(target
, address
, 4, value
);
647 if (retval
!= ERROR_OK
)
648 goto reset_pg_and_lock
;
650 bytes_written
+= bytes_to_write
;
651 bytes_remaining
-= bytes_to_write
;
654 retval
= stm32lx_wait_until_bsy_clear(bank
);
655 if (retval
!= ERROR_OK
)
656 goto reset_pg_and_lock
;
659 offset
+= bytes_written
;
660 count
-= bytes_written
;
662 /* this should always pass this check here */
663 assert((offset
% hp_nb
) == 0);
665 /* calculate half pages */
666 halfpages_number
= count
/ hp_nb
;
668 if (halfpages_number
) {
669 retval
= stm32lx_write_half_pages(bank
, buffer
+ bytes_written
, offset
, hp_nb
* halfpages_number
);
670 if (retval
== ERROR_TARGET_RESOURCE_NOT_AVAILABLE
) {
671 /* attempt slow memory writes */
672 LOG_WARNING("couldn't use block writes, falling back to single memory accesses");
673 halfpages_number
= 0;
675 if (retval
!= ERROR_OK
)
680 /* write any remaining bytes */
681 uint32_t page_bytes_written
= hp_nb
* halfpages_number
;
682 bytes_written
+= page_bytes_written
;
683 address
+= page_bytes_written
;
684 bytes_remaining
= count
- page_bytes_written
;
686 retval
= stm32lx_unlock_program_memory(bank
);
687 if (retval
!= ERROR_OK
)
690 while (bytes_remaining
> 0) {
691 uint8_t value
[4] = {0xff, 0xff, 0xff, 0xff};
693 /* copy remaining bytes into the write buffer */
694 uint32_t bytes_to_write
= MIN(4, bytes_remaining
);
695 memcpy(value
, buffer
+ bytes_written
, bytes_to_write
);
697 retval
= target_write_buffer(target
, address
, 4, value
);
698 if (retval
!= ERROR_OK
)
699 goto reset_pg_and_lock
;
701 bytes_written
+= bytes_to_write
;
702 bytes_remaining
-= bytes_to_write
;
705 retval
= stm32lx_wait_until_bsy_clear(bank
);
706 if (retval
!= ERROR_OK
)
707 goto reset_pg_and_lock
;
711 retval2
= stm32lx_lock_program_memory(bank
);
712 if (retval
== ERROR_OK
)
718 static int stm32lx_read_id_code(struct target
*target
, uint32_t *id
)
720 struct armv7m_common
*armv7m
= target_to_armv7m(target
);
722 if (armv7m
->arm
.is_armv6m
== true)
723 retval
= target_read_u32(target
, DBGMCU_IDCODE_L0
, id
);
725 /* read stm32 device id register */
726 retval
= target_read_u32(target
, DBGMCU_IDCODE
, id
);
730 static int stm32lx_probe(struct flash_bank
*bank
)
732 struct target
*target
= bank
->target
;
733 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
735 uint16_t flash_size_in_kb
;
737 uint32_t base_address
= FLASH_BANK0_ADDRESS
;
738 uint32_t second_bank_base
;
741 stm32lx_info
->probed
= 0;
743 int retval
= stm32lx_read_id_code(bank
->target
, &device_id
);
744 if (retval
!= ERROR_OK
)
747 stm32lx_info
->idcode
= device_id
;
749 LOG_DEBUG("device id = 0x%08" PRIx32
"", device_id
);
751 for (n
= 0; n
< ARRAY_SIZE(stm32lx_parts
); n
++) {
752 if ((device_id
& 0xfff) == stm32lx_parts
[n
].id
) {
753 stm32lx_info
->part_info
= stm32lx_parts
[n
];
758 if (n
== ARRAY_SIZE(stm32lx_parts
)) {
759 LOG_WARNING("Cannot identify target as a STM32L family.");
762 LOG_INFO("Device: %s", stm32lx_info
->part_info
.device_str
);
765 stm32lx_info
->flash_base
= stm32lx_info
->part_info
.flash_base
;
767 /* Get the flash size from target. */
768 retval
= target_read_u16(target
, stm32lx_info
->part_info
.fsize_base
,
771 /* 0x436 devices report their flash size as a 0 or 1 code indicating 384K
772 * or 256K, respectively. Please see RM0038 r8 or newer and refer to
774 if (retval
== ERROR_OK
&& (device_id
& 0xfff) == 0x436) {
775 if (flash_size_in_kb
== 0)
776 flash_size_in_kb
= 384;
777 else if (flash_size_in_kb
== 1)
778 flash_size_in_kb
= 256;
781 /* 0x429 devices only use the lowest 8 bits of the flash size register */
782 if (retval
== ERROR_OK
&& (device_id
& 0xfff) == 0x429) {
783 flash_size_in_kb
&= 0xff;
786 /* Failed reading flash size or flash size invalid (early silicon),
787 * default to max target family */
788 if (retval
!= ERROR_OK
|| flash_size_in_kb
== 0xffff || flash_size_in_kb
== 0) {
789 LOG_WARNING("STM32L flash size failed, probe inaccurate - assuming %dk flash",
790 stm32lx_info
->part_info
.max_flash_size_kb
);
791 flash_size_in_kb
= stm32lx_info
->part_info
.max_flash_size_kb
;
792 } else if (flash_size_in_kb
> stm32lx_info
->part_info
.max_flash_size_kb
) {
793 LOG_WARNING("STM32L probed flash size assumed incorrect since FLASH_SIZE=%dk > %dk, - assuming %dk flash",
794 flash_size_in_kb
, stm32lx_info
->part_info
.max_flash_size_kb
,
795 stm32lx_info
->part_info
.max_flash_size_kb
);
796 flash_size_in_kb
= stm32lx_info
->part_info
.max_flash_size_kb
;
799 /* Overwrite default dual-bank configuration */
800 retval
= stm32lx_update_part_info(bank
, flash_size_in_kb
);
801 if (retval
!= ERROR_OK
)
804 if (stm32lx_info
->part_info
.has_dual_banks
) {
805 /* Use the configured base address to determine if this is the first or second flash bank.
806 * Verify that the base address is reasonably correct and determine the flash bank size
808 second_bank_base
= base_address
+
809 stm32lx_info
->part_info
.first_bank_size_kb
* 1024;
810 if (bank
->base
== second_bank_base
|| !bank
->base
) {
811 /* This is the second bank */
812 base_address
= second_bank_base
;
813 flash_size_in_kb
= flash_size_in_kb
-
814 stm32lx_info
->part_info
.first_bank_size_kb
;
815 } else if (bank
->base
== base_address
) {
816 /* This is the first bank */
817 flash_size_in_kb
= stm32lx_info
->part_info
.first_bank_size_kb
;
819 LOG_WARNING("STM32L flash bank base address config is incorrect. "
820 TARGET_ADDR_FMT
" but should rather be 0x%" PRIx32
822 bank
->base
, base_address
, second_bank_base
);
825 LOG_INFO("STM32L flash has dual banks. Bank (%d) size is %dkb, base address is 0x%" PRIx32
,
826 bank
->bank_number
, flash_size_in_kb
, base_address
);
828 LOG_INFO("STM32L flash size is %dkb, base address is 0x%" PRIx32
, flash_size_in_kb
, base_address
);
831 /* if the user sets the size manually then ignore the probed value
832 * this allows us to work around devices that have a invalid flash size register value */
833 if (stm32lx_info
->user_bank_size
) {
834 flash_size_in_kb
= stm32lx_info
->user_bank_size
/ 1024;
835 LOG_INFO("ignoring flash probed value, using configured bank size: %dkbytes", flash_size_in_kb
);
838 /* calculate numbers of sectors (4kB per sector) */
839 int num_sectors
= (flash_size_in_kb
* 1024) / FLASH_SECTOR_SIZE
;
843 bank
->sectors
= NULL
;
846 bank
->size
= flash_size_in_kb
* 1024;
847 bank
->base
= base_address
;
848 bank
->num_sectors
= num_sectors
;
849 bank
->sectors
= malloc(sizeof(struct flash_sector
) * num_sectors
);
850 if (bank
->sectors
== NULL
) {
851 LOG_ERROR("failed to allocate bank sectors");
855 for (i
= 0; i
< num_sectors
; i
++) {
856 bank
->sectors
[i
].offset
= i
* FLASH_SECTOR_SIZE
;
857 bank
->sectors
[i
].size
= FLASH_SECTOR_SIZE
;
858 bank
->sectors
[i
].is_erased
= -1;
859 bank
->sectors
[i
].is_protected
= -1;
862 stm32lx_info
->probed
= 1;
867 static int stm32lx_auto_probe(struct flash_bank
*bank
)
869 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
871 if (stm32lx_info
->probed
)
874 return stm32lx_probe(bank
);
877 /* This method must return a string displaying information about the bank */
878 static int stm32lx_get_info(struct flash_bank
*bank
, char *buf
, int buf_size
)
880 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
881 const struct stm32lx_part_info
*info
= &stm32lx_info
->part_info
;
882 uint16_t rev_id
= stm32lx_info
->idcode
>> 16;
883 const char *rev_str
= NULL
;
885 if (!stm32lx_info
->probed
) {
886 int retval
= stm32lx_probe(bank
);
887 if (retval
!= ERROR_OK
) {
888 snprintf(buf
, buf_size
,
889 "Unable to find bank information.");
894 for (unsigned int i
= 0; i
< info
->num_revs
; i
++)
895 if (rev_id
== info
->revs
[i
].rev
)
896 rev_str
= info
->revs
[i
].str
;
898 if (rev_str
!= NULL
) {
899 snprintf(buf
, buf_size
,
901 info
->device_str
, rev_str
);
903 snprintf(buf
, buf_size
,
904 "%s - Rev: unknown (0x%04x)",
905 info
->device_str
, rev_id
);
911 static const struct command_registration stm32lx_exec_command_handlers
[] = {
913 .name
= "mass_erase",
914 .handler
= stm32lx_handle_mass_erase_command
,
915 .mode
= COMMAND_EXEC
,
917 .help
= "Erase entire flash device. including available EEPROM",
921 .handler
= stm32lx_handle_lock_command
,
922 .mode
= COMMAND_EXEC
,
924 .help
= "Increase the readout protection to Level 1.",
928 .handler
= stm32lx_handle_unlock_command
,
929 .mode
= COMMAND_EXEC
,
931 .help
= "Lower the readout protection from Level 1 to 0.",
933 COMMAND_REGISTRATION_DONE
936 static const struct command_registration stm32lx_command_handlers
[] = {
940 .help
= "stm32lx flash command group",
942 .chain
= stm32lx_exec_command_handlers
,
944 COMMAND_REGISTRATION_DONE
947 const struct flash_driver stm32lx_flash
= {
949 .commands
= stm32lx_command_handlers
,
950 .flash_bank_command
= stm32lx_flash_bank_command
,
951 .erase
= stm32lx_erase
,
952 .write
= stm32lx_write
,
953 .read
= default_flash_read
,
954 .probe
= stm32lx_probe
,
955 .auto_probe
= stm32lx_auto_probe
,
956 .erase_check
= default_flash_blank_check
,
957 .protect_check
= stm32lx_protect_check
,
958 .info
= stm32lx_get_info
,
959 .free_driver_priv
= default_flash_free_driver_priv
,
962 /* Static methods implementation */
963 static int stm32lx_unlock_program_memory(struct flash_bank
*bank
)
965 struct target
*target
= bank
->target
;
966 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
971 * Unlocking the program memory is done by unlocking the PECR,
972 * then by writing the 2 PRGKEY to the PRGKEYR register
975 /* check flash is not already unlocked */
976 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
978 if (retval
!= ERROR_OK
)
981 if ((reg32
& FLASH_PECR__PRGLOCK
) == 0)
984 /* To unlock the PECR write the 2 PEKEY to the PEKEYR register */
985 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PEKEYR
,
987 if (retval
!= ERROR_OK
)
990 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PEKEYR
,
992 if (retval
!= ERROR_OK
)
995 /* Make sure it worked */
996 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
998 if (retval
!= ERROR_OK
)
1001 if (reg32
& FLASH_PECR__PELOCK
) {
1002 LOG_ERROR("PELOCK is not cleared :(");
1003 return ERROR_FLASH_OPERATION_FAILED
;
1006 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PRGKEYR
,
1008 if (retval
!= ERROR_OK
)
1010 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PRGKEYR
,
1012 if (retval
!= ERROR_OK
)
1015 /* Make sure it worked */
1016 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1018 if (retval
!= ERROR_OK
)
1021 if (reg32
& FLASH_PECR__PRGLOCK
) {
1022 LOG_ERROR("PRGLOCK is not cleared :(");
1023 return ERROR_FLASH_OPERATION_FAILED
;
1029 static int stm32lx_enable_write_half_page(struct flash_bank
*bank
)
1031 struct target
*target
= bank
->target
;
1032 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1037 * Unlock the program memory, then set the FPRG bit in the PECR register.
1039 retval
= stm32lx_unlock_program_memory(bank
);
1040 if (retval
!= ERROR_OK
)
1043 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1045 if (retval
!= ERROR_OK
)
1048 reg32
|= FLASH_PECR__FPRG
;
1049 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1051 if (retval
!= ERROR_OK
)
1054 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1056 if (retval
!= ERROR_OK
)
1059 reg32
|= FLASH_PECR__PROG
;
1060 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1066 static int stm32lx_lock_program_memory(struct flash_bank
*bank
)
1068 struct target
*target
= bank
->target
;
1069 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1073 /* To lock the program memory, simply set the lock bit and lock PECR */
1075 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1077 if (retval
!= ERROR_OK
)
1080 reg32
|= FLASH_PECR__PRGLOCK
;
1081 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1083 if (retval
!= ERROR_OK
)
1086 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1088 if (retval
!= ERROR_OK
)
1091 reg32
|= FLASH_PECR__PELOCK
;
1092 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1094 if (retval
!= ERROR_OK
)
1100 static int stm32lx_erase_sector(struct flash_bank
*bank
, int sector
)
1102 struct target
*target
= bank
->target
;
1103 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1108 * To erase a sector (i.e. stm32lx_info->part_info.pages_per_sector pages),
1109 * first unlock the memory, loop over the pages of this sector
1110 * and write 0x0 to its first word.
1113 retval
= stm32lx_unlock_program_memory(bank
);
1114 if (retval
!= ERROR_OK
)
1117 for (int page
= 0; page
< (int)stm32lx_info
->part_info
.pages_per_sector
;
1119 reg32
= FLASH_PECR__PROG
| FLASH_PECR__ERASE
;
1120 retval
= target_write_u32(target
,
1121 stm32lx_info
->flash_base
+ FLASH_PECR
, reg32
);
1122 if (retval
!= ERROR_OK
)
1125 retval
= stm32lx_wait_until_bsy_clear(bank
);
1126 if (retval
!= ERROR_OK
)
1129 uint32_t addr
= bank
->base
+ bank
->sectors
[sector
].offset
+ (page
1130 * stm32lx_info
->part_info
.page_size
);
1131 retval
= target_write_u32(target
, addr
, 0x0);
1132 if (retval
!= ERROR_OK
)
1135 retval
= stm32lx_wait_until_bsy_clear(bank
);
1136 if (retval
!= ERROR_OK
)
1140 retval
= stm32lx_lock_program_memory(bank
);
1141 if (retval
!= ERROR_OK
)
1147 static inline int stm32lx_get_flash_status(struct flash_bank
*bank
, uint32_t *status
)
1149 struct target
*target
= bank
->target
;
1150 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1152 return target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_SR
, status
);
1155 static int stm32lx_wait_until_bsy_clear(struct flash_bank
*bank
)
1157 return stm32lx_wait_until_bsy_clear_timeout(bank
, 100);
1160 static int stm32lx_unlock_options_bytes(struct flash_bank
*bank
)
1162 struct target
*target
= bank
->target
;
1163 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1168 * Unlocking the options bytes is done by unlocking the PECR,
1169 * then by writing the 2 FLASH_PEKEYR to the FLASH_OPTKEYR register
1172 /* check flash is not already unlocked */
1173 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
, ®32
);
1174 if (retval
!= ERROR_OK
)
1177 if ((reg32
& FLASH_PECR__OPTLOCK
) == 0)
1180 if ((reg32
& FLASH_PECR__PELOCK
) != 0) {
1182 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PEKEYR
, PEKEY1
);
1183 if (retval
!= ERROR_OK
)
1186 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PEKEYR
, PEKEY2
);
1187 if (retval
!= ERROR_OK
)
1191 /* To unlock the PECR write the 2 OPTKEY to the FLASH_OPTKEYR register */
1192 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_OPTKEYR
, OPTKEY1
);
1193 if (retval
!= ERROR_OK
)
1196 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_OPTKEYR
, OPTKEY2
);
1197 if (retval
!= ERROR_OK
)
1203 static int stm32lx_wait_until_bsy_clear_timeout(struct flash_bank
*bank
, int timeout
)
1205 struct target
*target
= bank
->target
;
1206 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1208 int retval
= ERROR_OK
;
1210 /* wait for busy to clear */
1212 retval
= stm32lx_get_flash_status(bank
, &status
);
1213 if (retval
!= ERROR_OK
)
1216 LOG_DEBUG("status: 0x%" PRIx32
"", status
);
1217 if ((status
& FLASH_SR__BSY
) == 0)
1220 if (timeout
-- <= 0) {
1221 LOG_ERROR("timed out waiting for flash");
1227 if (status
& FLASH_SR__WRPERR
) {
1228 LOG_ERROR("access denied / write protected");
1229 retval
= ERROR_FAIL
;
1232 if (status
& FLASH_SR__PGAERR
) {
1233 LOG_ERROR("invalid program address");
1234 retval
= ERROR_FAIL
;
1237 /* Clear but report errors */
1238 if (status
& FLASH_SR__OPTVERR
) {
1239 /* If this operation fails, we ignore it and report the original retval */
1240 target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_SR
, status
& FLASH_SR__OPTVERR
);
1246 static int stm32lx_obl_launch(struct flash_bank
*bank
)
1248 struct target
*target
= bank
->target
;
1249 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1252 /* This will fail as the target gets immediately rebooted */
1253 target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
,
1254 FLASH_PECR__OBL_LAUNCH
);
1258 target_halt(target
);
1259 retval
= target_poll(target
);
1260 } while (--tries
> 0 &&
1261 (retval
!= ERROR_OK
|| target
->state
!= TARGET_HALTED
));
1263 return tries
? ERROR_OK
: ERROR_FAIL
;
1266 static int stm32lx_lock(struct flash_bank
*bank
)
1269 struct target
*target
= bank
->target
;
1271 if (target
->state
!= TARGET_HALTED
) {
1272 LOG_ERROR("Target not halted");
1273 return ERROR_TARGET_NOT_HALTED
;
1276 retval
= stm32lx_unlock_options_bytes(bank
);
1277 if (retval
!= ERROR_OK
)
1280 /* set the RDP protection level to 1 */
1281 retval
= target_write_u32(target
, OPTION_BYTES_ADDRESS
, OPTION_BYTE_0_PR1
);
1282 if (retval
!= ERROR_OK
)
1288 static int stm32lx_unlock(struct flash_bank
*bank
)
1291 struct target
*target
= bank
->target
;
1293 if (target
->state
!= TARGET_HALTED
) {
1294 LOG_ERROR("Target not halted");
1295 return ERROR_TARGET_NOT_HALTED
;
1298 retval
= stm32lx_unlock_options_bytes(bank
);
1299 if (retval
!= ERROR_OK
)
1302 /* set the RDP protection level to 0 */
1303 retval
= target_write_u32(target
, OPTION_BYTES_ADDRESS
, OPTION_BYTE_0_PR0
);
1304 if (retval
!= ERROR_OK
)
1307 retval
= stm32lx_wait_until_bsy_clear_timeout(bank
, 30000);
1308 if (retval
!= ERROR_OK
)
1314 static int stm32lx_mass_erase(struct flash_bank
*bank
)
1317 struct target
*target
= bank
->target
;
1318 struct stm32lx_flash_bank
*stm32lx_info
= NULL
;
1321 if (target
->state
!= TARGET_HALTED
) {
1322 LOG_ERROR("Target not halted");
1323 return ERROR_TARGET_NOT_HALTED
;
1326 stm32lx_info
= bank
->driver_priv
;
1328 retval
= stm32lx_lock(bank
);
1329 if (retval
!= ERROR_OK
)
1332 retval
= stm32lx_obl_launch(bank
);
1333 if (retval
!= ERROR_OK
)
1336 retval
= stm32lx_unlock(bank
);
1337 if (retval
!= ERROR_OK
)
1340 retval
= stm32lx_obl_launch(bank
);
1341 if (retval
!= ERROR_OK
)
1344 retval
= target_read_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
, ®32
);
1345 if (retval
!= ERROR_OK
)
1348 retval
= target_write_u32(target
, stm32lx_info
->flash_base
+ FLASH_PECR
, reg32
| FLASH_PECR__OPTLOCK
);
1349 if (retval
!= ERROR_OK
)
1355 static int stm32lx_update_part_info(struct flash_bank
*bank
, uint16_t flash_size_in_kb
)
1357 struct stm32lx_flash_bank
*stm32lx_info
= bank
->driver_priv
;
1359 switch (stm32lx_info
->part_info
.id
) {
1360 case 0x447: /* STM32L0xx (Cat.5) devices */
1361 if (flash_size_in_kb
== 192 || flash_size_in_kb
== 128) {
1362 stm32lx_info
->part_info
.first_bank_size_kb
= flash_size_in_kb
/ 2;
1363 stm32lx_info
->part_info
.has_dual_banks
= true;
1366 case 0x437: /* STM32L1xx (Cat.5/Cat.6) */
1367 stm32lx_info
->part_info
.first_bank_size_kb
= flash_size_in_kb
/ 2;
Linking to existing account procedure
If you already have an account and want to add another login method
you
MUST first sign in with your existing account and
then change URL to read
https://review.openocd.org/login/?link
to get to this page again but this time it'll work for linking. Thank you.
SSH host keys fingerprints
1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=.. |
|+o.. . |
|*.o . . |
|+B . . . |
|Bo. = o S |
|Oo.+ + = |
|oB=.* = . o |
| =+=.+ + E |
|. .=o . o |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)