1 /***************************************************************************
2 * Copyright (C) 2015 by Uwe Bonnes *
3 * bon@elektron.ikp.physik.tu-darmstadt.de *
5 * Copyright (C) 2019 by Tarek Bochkati for STMicroelectronics *
6 * tarek.bouchkati@gmail.com *
8 * This program is free software; you can redistribute it and/or modify *
9 * it under the terms of the GNU General Public License as published by *
10 * the Free Software Foundation; either version 2 of the License, or *
11 * (at your option) any later version. *
13 * This program is distributed in the hope that it will be useful, *
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
16 * GNU General Public License for more details. *
18 * You should have received a copy of the GNU General Public License *
19 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
20 ***************************************************************************/
27 #include <helper/binarybuffer.h>
28 #include <target/algorithm.h>
29 #include <target/armv7m.h>
33 /* STM32L4xxx series for reference.
35 * RM0351 (STM32L4x5/STM32L4x6)
36 * http://www.st.com/resource/en/reference_manual/dm00083560.pdf
38 * RM0394 (STM32L43x/44x/45x/46x)
39 * http://www.st.com/resource/en/reference_manual/dm00151940.pdf
41 * RM0432 (STM32L4R/4Sxx)
42 * http://www.st.com/resource/en/reference_manual/dm00310109.pdf
44 * STM32L476RG Datasheet (for erase timing)
45 * http://www.st.com/resource/en/datasheet/stm32l476rg.pdf
47 * The RM0351 devices have normally two banks, but on 512 and 256 kiB devices
48 * an option byte is available to map all sectors to the first bank.
49 * Both STM32 banks are treated as one OpenOCD bank, as other STM32 devices
52 * RM0394 devices have a single bank only.
54 * RM0432 devices have single and dual bank operating modes.
55 * - for STM32L4R/Sxx the FLASH size is 2Mbyte or 1Mbyte.
56 * - for STM32L4P/Q5x the FLASH size is 1Mbyte or 512Kbyte.
57 * Bank page (sector) size is 4Kbyte (dual mode) or 8Kbyte (single mode).
59 * Bank mode is controlled by two different bits in option bytes register.
61 * In 2M FLASH devices bit 22 (DBANK) controls Dual Bank mode.
62 * In 1M FLASH devices bit 21 (DB1M) controls Dual Bank mode.
64 * In 1M FLASH devices bit 22 (DBANK) controls Dual Bank mode.
65 * In 512K FLASH devices bit 21 (DB512K) controls Dual Bank mode.
69 /* STM32WBxxx series for reference.
72 * http://www.st.com/resource/en/reference_manual/dm00318631.pdf
75 * http://www.st.com/resource/en/reference_manual/dm00622834.pdf
78 /* STM32WLxxx series for reference.
81 * http://www.st.com/resource/en/reference_manual/dm00530369.pdf
85 * STM32G0xxx series for reference.
88 * http://www.st.com/resource/en/reference_manual/dm00371828.pdf
91 * http://www.st.com/resource/en/reference_manual/dm00463896.pdf
95 * STM32G4xxx series for reference.
97 * RM0440 (STM32G43x/44x/47x/48x)
98 * http://www.st.com/resource/en/reference_manual/dm00355726.pdf
100 * Cat. 2 devices have single bank only, page size is 2kByte.
102 * Cat. 3 devices have single and dual bank operating modes,
103 * Page size is 2kByte (dual mode) or 4kByte (single mode).
105 * Bank mode is controlled by bit 22 (DBANK) in option bytes register.
106 * Both banks are treated as a single OpenOCD bank.
109 /* Erase time can be as high as 25ms, 10x this and assume it's toast... */
111 #define FLASH_ERASE_TIMEOUT 250
118 struct stm32l4_part_info {
120 const char *device_str;
121 const struct stm32l4_rev *revs;
122 const size_t num_revs;
123 const uint16_t max_flash_size_kb;
124 const bool has_dual_bank;
125 const uint32_t flash_regs_base;
126 const uint32_t fsize_addr;
129 struct stm32l4_flash_bank {
135 uint32_t user_bank_size;
136 uint32_t wrpxxr_mask;
137 const struct stm32l4_part_info *part_info;
140 /* human readable list of families this drivers supports */
141 static const char *device_families = "STM32L4/L4+/WB/WL/G4/G0";
143 static const struct stm32l4_rev stm32_415_revs[] = {
144 { 0x1000, "1" }, { 0x1001, "2" }, { 0x1003, "3" }, { 0x1007, "4" }
147 static const struct stm32l4_rev stm32_435_revs[] = {
148 { 0x1000, "A" }, { 0x1001, "Z" }, { 0x2001, "Y" },
151 static const struct stm32l4_rev stm32_460_revs[] = {
152 { 0x1000, "A/Z" } /* A and Z, no typo in RM! */, { 0x2000, "B" },
155 static const struct stm32l4_rev stm32_461_revs[] = {
156 { 0x1000, "A" }, { 0x2000, "B" },
159 static const struct stm32l4_rev stm32_462_revs[] = {
160 { 0x1000, "A" }, { 0x1001, "Z" }, { 0x2001, "Y" },
163 static const struct stm32l4_rev stm32_464_revs[] = {
164 { 0x1000, "A" }, { 0x1001, "Z" }, { 0x2001, "Y" },
167 static const struct stm32l4_rev stm32_466_revs[] = {
168 { 0x1000, "A" }, { 0x1001, "Z" }, { 0x2000, "B" },
171 static const struct stm32l4_rev stm32_468_revs[] = {
172 { 0x1000, "A" }, { 0x2000, "B" }, { 0x2001, "Z" },
175 static const struct stm32l4_rev stm32_469_revs[] = {
176 { 0x1000, "A" }, { 0x2000, "B" }, { 0x2001, "Z" },
179 static const struct stm32l4_rev stm32_470_revs[] = {
180 { 0x1000, "A" }, { 0x1001, "Z" }, { 0x1003, "Y" }, { 0x100F, "W" },
183 static const struct stm32l4_rev stm32_471_revs[] = {
187 static const struct stm32l4_rev stm32_495_revs[] = {
191 static const struct stm32l4_rev stm32_497_revs[] = {
195 static const struct stm32l4_part_info stm32l4_parts[] = {
198 .revs = stm32_415_revs,
199 .num_revs = ARRAY_SIZE(stm32_415_revs),
200 .device_str = "STM32L47/L48xx",
201 .max_flash_size_kb = 1024,
202 .has_dual_bank = true,
203 .flash_regs_base = 0x40022000,
204 .fsize_addr = 0x1FFF75E0,
208 .revs = stm32_435_revs,
209 .num_revs = ARRAY_SIZE(stm32_435_revs),
210 .device_str = "STM32L43/L44xx",
211 .max_flash_size_kb = 256,
212 .has_dual_bank = false,
213 .flash_regs_base = 0x40022000,
214 .fsize_addr = 0x1FFF75E0,
218 .revs = stm32_460_revs,
219 .num_revs = ARRAY_SIZE(stm32_460_revs),
220 .device_str = "STM32G07/G08xx",
221 .max_flash_size_kb = 128,
222 .has_dual_bank = false,
223 .flash_regs_base = 0x40022000,
224 .fsize_addr = 0x1FFF75E0,
228 .revs = stm32_461_revs,
229 .num_revs = ARRAY_SIZE(stm32_461_revs),
230 .device_str = "STM32L49/L4Axx",
231 .max_flash_size_kb = 1024,
232 .has_dual_bank = true,
233 .flash_regs_base = 0x40022000,
234 .fsize_addr = 0x1FFF75E0,
238 .revs = stm32_462_revs,
239 .num_revs = ARRAY_SIZE(stm32_462_revs),
240 .device_str = "STM32L45/L46xx",
241 .max_flash_size_kb = 512,
242 .has_dual_bank = false,
243 .flash_regs_base = 0x40022000,
244 .fsize_addr = 0x1FFF75E0,
248 .revs = stm32_464_revs,
249 .num_revs = ARRAY_SIZE(stm32_464_revs),
250 .device_str = "STM32L41/L42xx",
251 .max_flash_size_kb = 128,
252 .has_dual_bank = false,
253 .flash_regs_base = 0x40022000,
254 .fsize_addr = 0x1FFF75E0,
258 .revs = stm32_466_revs,
259 .num_revs = ARRAY_SIZE(stm32_466_revs),
260 .device_str = "STM32G03/G04xx",
261 .max_flash_size_kb = 64,
262 .has_dual_bank = false,
263 .flash_regs_base = 0x40022000,
264 .fsize_addr = 0x1FFF75E0,
268 .revs = stm32_468_revs,
269 .num_revs = ARRAY_SIZE(stm32_468_revs),
270 .device_str = "STM32G43/G44xx",
271 .max_flash_size_kb = 128,
272 .has_dual_bank = false,
273 .flash_regs_base = 0x40022000,
274 .fsize_addr = 0x1FFF75E0,
278 .revs = stm32_469_revs,
279 .num_revs = ARRAY_SIZE(stm32_469_revs),
280 .device_str = "STM32G47/G48xx",
281 .max_flash_size_kb = 512,
282 .has_dual_bank = true,
283 .flash_regs_base = 0x40022000,
284 .fsize_addr = 0x1FFF75E0,
288 .revs = stm32_470_revs,
289 .num_revs = ARRAY_SIZE(stm32_470_revs),
290 .device_str = "STM32L4R/L4Sxx",
291 .max_flash_size_kb = 2048,
292 .has_dual_bank = true,
293 .flash_regs_base = 0x40022000,
294 .fsize_addr = 0x1FFF75E0,
298 .revs = stm32_471_revs,
299 .num_revs = ARRAY_SIZE(stm32_471_revs),
300 .device_str = "STM32L4P5/L4Q5x",
301 .max_flash_size_kb = 1024,
302 .has_dual_bank = true,
303 .flash_regs_base = 0x40022000,
304 .fsize_addr = 0x1FFF75E0,
308 .revs = stm32_495_revs,
309 .num_revs = ARRAY_SIZE(stm32_495_revs),
310 .device_str = "STM32WB5x",
311 .max_flash_size_kb = 1024,
312 .has_dual_bank = false,
313 .flash_regs_base = 0x58004000,
314 .fsize_addr = 0x1FFF75E0,
318 .revs = stm32_497_revs,
319 .num_revs = ARRAY_SIZE(stm32_497_revs),
320 .device_str = "STM32WLEx",
321 .max_flash_size_kb = 256,
322 .has_dual_bank = false,
323 .flash_regs_base = 0x58004000,
324 .fsize_addr = 0x1FFF75E0,
328 /* flash bank stm32l4x <base> <size> 0 0 <target#> */
329 FLASH_BANK_COMMAND_HANDLER(stm32l4_flash_bank_command)
331 struct stm32l4_flash_bank *stm32l4_info;
334 return ERROR_COMMAND_SYNTAX_ERROR;
336 stm32l4_info = malloc(sizeof(struct stm32l4_flash_bank));
338 return ERROR_FAIL; /* Checkme: What better error to use?*/
339 bank->driver_priv = stm32l4_info;
341 /* The flash write must be aligned to a double word (8-bytes) boundary.
342 * Ask the flash infrastructure to ensure required alignment */
343 bank->write_start_alignment = bank->write_end_alignment = 8;
345 stm32l4_info->probed = false;
346 stm32l4_info->user_bank_size = bank->size;
351 static inline uint32_t stm32l4_get_flash_reg(struct flash_bank *bank, uint32_t reg_offset)
353 struct stm32l4_flash_bank *stm32l4_info = bank->driver_priv;
354 return stm32l4_info->part_info->flash_regs_base + reg_offset;
357 static inline int stm32l4_read_flash_reg(struct flash_bank *bank, uint32_t reg_offset, uint32_t *value)
359 return target_read_u32(bank->target, stm32l4_get_flash_reg(bank, reg_offset), value);
362 static inline int stm32l4_write_flash_reg(struct flash_bank *bank, uint32_t reg_offset, uint32_t value)
364 return target_write_u32(bank->target, stm32l4_get_flash_reg(bank, reg_offset), value);
367 static int stm32l4_wait_status_busy(struct flash_bank *bank, int timeout)
370 int retval = ERROR_OK;
372 /* wait for busy to clear */
374 retval = stm32l4_read_flash_reg(bank, STM32_FLASH_SR, &status);
375 if (retval != ERROR_OK)
377 LOG_DEBUG("status: 0x%" PRIx32 "", status);
378 if ((status & FLASH_BSY) == 0)
380 if (timeout-- <= 0) {
381 LOG_ERROR("timed out waiting for flash");
388 if (status & FLASH_WRPERR) {
389 LOG_ERROR("stm32x device protected");
393 /* Clear but report errors */
394 if (status & FLASH_ERROR) {
395 if (retval == ERROR_OK)
397 /* If this operation fails, we ignore it and report the original
400 stm32l4_write_flash_reg(bank, STM32_FLASH_SR, status & FLASH_ERROR);
406 static int stm32l4_unlock_reg(struct flash_bank *bank)
410 /* first check if not already unlocked
411 * otherwise writing on STM32_FLASH_KEYR will fail
413 int retval = stm32l4_read_flash_reg(bank, STM32_FLASH_CR, &ctrl);
414 if (retval != ERROR_OK)
417 if ((ctrl & FLASH_LOCK) == 0)
420 /* unlock flash registers */
421 retval = stm32l4_write_flash_reg(bank, STM32_FLASH_KEYR, KEY1);
422 if (retval != ERROR_OK)
425 retval = stm32l4_write_flash_reg(bank, STM32_FLASH_KEYR, KEY2);
426 if (retval != ERROR_OK)
429 retval = stm32l4_read_flash_reg(bank, STM32_FLASH_CR, &ctrl);
430 if (retval != ERROR_OK)
433 if (ctrl & FLASH_LOCK) {
434 LOG_ERROR("flash not unlocked STM32_FLASH_CR: %" PRIx32, ctrl);
435 return ERROR_TARGET_FAILURE;
441 static int stm32l4_unlock_option_reg(struct flash_bank *bank)
445 int retval = stm32l4_read_flash_reg(bank, STM32_FLASH_CR, &ctrl);
446 if (retval != ERROR_OK)
449 if ((ctrl & FLASH_OPTLOCK) == 0)
452 /* unlock option registers */
453 retval = stm32l4_write_flash_reg(bank, STM32_FLASH_OPTKEYR, OPTKEY1);
454 if (retval != ERROR_OK)
457 retval = stm32l4_write_flash_reg(bank, STM32_FLASH_OPTKEYR, OPTKEY2);
458 if (retval != ERROR_OK)
461 retval = stm32l4_read_flash_reg(bank, STM32_FLASH_CR, &ctrl);
462 if (retval != ERROR_OK)
465 if (ctrl & FLASH_OPTLOCK) {
466 LOG_ERROR("options not unlocked STM32_FLASH_CR: %" PRIx32, ctrl);
467 return ERROR_TARGET_FAILURE;
473 static int stm32l4_write_option(struct flash_bank *bank, uint32_t reg_offset,
474 uint32_t value, uint32_t mask)
479 retval = stm32l4_read_flash_reg(bank, reg_offset, &optiondata);
480 if (retval != ERROR_OK)
483 retval = stm32l4_unlock_reg(bank);
484 if (retval != ERROR_OK)
487 retval = stm32l4_unlock_option_reg(bank);
488 if (retval != ERROR_OK)
491 optiondata = (optiondata & ~mask) | (value & mask);
493 retval = stm32l4_write_flash_reg(bank, reg_offset, optiondata);
494 if (retval != ERROR_OK)
497 retval = stm32l4_write_flash_reg(bank, STM32_FLASH_CR, FLASH_OPTSTRT);
498 if (retval != ERROR_OK)
501 retval = stm32l4_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
504 retval2 = stm32l4_write_flash_reg(bank, STM32_FLASH_CR, FLASH_LOCK | FLASH_OPTLOCK);
506 if (retval != ERROR_OK)
512 static int stm32l4_protect_check(struct flash_bank *bank)
514 struct stm32l4_flash_bank *stm32l4_info = bank->driver_priv;
516 uint32_t wrp1ar, wrp1br, wrp2ar, wrp2br;
517 stm32l4_read_flash_reg(bank, STM32_FLASH_WRP1AR, &wrp1ar);
518 stm32l4_read_flash_reg(bank, STM32_FLASH_WRP1BR, &wrp1br);
519 if (stm32l4_info->part_info->has_dual_bank) {
520 stm32l4_read_flash_reg(bank, STM32_FLASH_WRP2AR, &wrp2ar);
521 stm32l4_read_flash_reg(bank, STM32_FLASH_WRP2BR, &wrp2br);
523 /* prevent unintialized errors */
528 const uint8_t wrp1a_start = wrp1ar & stm32l4_info->wrpxxr_mask;
529 const uint8_t wrp1a_end = (wrp1ar >> 16) & stm32l4_info->wrpxxr_mask;
530 const uint8_t wrp1b_start = wrp1br & stm32l4_info->wrpxxr_mask;
531 const uint8_t wrp1b_end = (wrp1br >> 16) & stm32l4_info->wrpxxr_mask;
532 const uint8_t wrp2a_start = wrp2ar & stm32l4_info->wrpxxr_mask;
533 const uint8_t wrp2a_end = (wrp2ar >> 16) & stm32l4_info->wrpxxr_mask;
534 const uint8_t wrp2b_start = wrp2br & stm32l4_info->wrpxxr_mask;
535 const uint8_t wrp2b_end = (wrp2br >> 16) & stm32l4_info->wrpxxr_mask;
537 for (int i = 0; i < bank->num_sectors; i++) {
538 if (i < stm32l4_info->bank1_sectors) {
539 if (((i >= wrp1a_start) &&
541 ((i >= wrp1b_start) &&
543 bank->sectors[i].is_protected = 1;
545 bank->sectors[i].is_protected = 0;
547 assert(stm32l4_info->part_info->has_dual_bank == true);
549 snb = i - stm32l4_info->bank1_sectors;
550 if (((snb >= wrp2a_start) &&
551 (snb <= wrp2a_end)) ||
552 ((snb >= wrp2b_start) &&
554 bank->sectors[i].is_protected = 1;
556 bank->sectors[i].is_protected = 0;
562 static int stm32l4_erase(struct flash_bank *bank, int first, int last)
564 struct stm32l4_flash_bank *stm32l4_info = bank->driver_priv;
568 assert((0 <= first) && (first <= last) && (last < bank->num_sectors));
570 if (bank->target->state != TARGET_HALTED) {
571 LOG_ERROR("Target not halted");
572 return ERROR_TARGET_NOT_HALTED;
575 retval = stm32l4_unlock_reg(bank);
576 if (retval != ERROR_OK)
581 To erase a sector, follow the procedure below:
582 1. Check that no Flash memory operation is ongoing by
583 checking the BSY bit in the FLASH_SR register
584 2. Set the PER bit and select the page and bank
585 you wish to erase in the FLASH_CR register
586 3. Set the STRT bit in the FLASH_CR register
587 4. Wait for the BSY bit to be cleared
590 for (i = first; i <= last; i++) {
591 uint32_t erase_flags;
592 erase_flags = FLASH_PER | FLASH_STRT;
594 if (i >= stm32l4_info->bank1_sectors) {
596 snb = i - stm32l4_info->bank1_sectors;
597 erase_flags |= snb << FLASH_PAGE_SHIFT | FLASH_CR_BKER;
599 erase_flags |= i << FLASH_PAGE_SHIFT;
600 retval = stm32l4_write_flash_reg(bank, STM32_FLASH_CR, erase_flags);
601 if (retval != ERROR_OK)
604 retval = stm32l4_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
605 if (retval != ERROR_OK)
608 bank->sectors[i].is_erased = 1;
612 retval2 = stm32l4_write_flash_reg(bank, STM32_FLASH_CR, FLASH_LOCK);
614 if (retval != ERROR_OK)
620 static int stm32l4_protect(struct flash_bank *bank, int set, int first, int last)
622 struct target *target = bank->target;
623 struct stm32l4_flash_bank *stm32l4_info = bank->driver_priv;
625 if (target->state != TARGET_HALTED) {
626 LOG_ERROR("Target not halted");
627 return ERROR_TARGET_NOT_HALTED;
632 uint32_t reg_value = 0xFF; /* Default to bank un-protected */
633 if (last >= stm32l4_info->bank1_sectors) {
635 uint8_t begin = first > stm32l4_info->bank1_sectors ? first : 0x00;
636 reg_value = ((last & 0xFF) << 16) | begin;
639 ret = stm32l4_write_option(bank, STM32_FLASH_WRP2AR, reg_value, 0xffffffff);
642 reg_value = 0xFF; /* Default to bank un-protected */
643 if (first < stm32l4_info->bank1_sectors) {
645 uint8_t end = last >= stm32l4_info->bank1_sectors ? 0xFF : last;
646 reg_value = (end << 16) | (first & 0xFF);
649 ret = stm32l4_write_option(bank, STM32_FLASH_WRP1AR, reg_value, 0xffffffff);
655 /* Count is in double-words */
656 static int stm32l4_write_block(struct flash_bank *bank, const uint8_t *buffer,
657 uint32_t offset, uint32_t count)
659 struct target *target = bank->target;
660 struct stm32l4_flash_bank *stm32l4_info = bank->driver_priv;
661 uint32_t buffer_size;
662 struct working_area *write_algorithm;
663 struct working_area *source;
664 uint32_t address = bank->base + offset;
665 struct reg_param reg_params[6];
666 struct armv7m_algorithm armv7m_info;
667 int retval = ERROR_OK;
669 static const uint8_t stm32l4_flash_write_code[] = {
670 #include "../../../contrib/loaders/flash/stm32/stm32l4x.inc"
673 if (target_alloc_working_area(target, sizeof(stm32l4_flash_write_code),
674 &write_algorithm) != ERROR_OK) {
675 LOG_WARNING("no working area available, can't do block memory writes");
676 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
679 retval = target_write_buffer(target, write_algorithm->address,
680 sizeof(stm32l4_flash_write_code),
681 stm32l4_flash_write_code);
682 if (retval != ERROR_OK) {
683 target_free_working_area(target, write_algorithm);
687 /* memory buffer, size *must* be multiple of dword plus one dword for rp and one for wp */
688 buffer_size = target_get_working_area_avail(target) & ~(2 * sizeof(uint32_t) - 1);
689 if (buffer_size < 256) {
690 LOG_WARNING("large enough working area not available, can't do block memory writes");
691 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
692 } else if (buffer_size > 16384) {
693 /* probably won't benefit from more than 16k ... */
697 if (target_alloc_working_area_try(target, buffer_size, &source) != ERROR_OK) {
698 LOG_ERROR("allocating working area failed");
699 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
702 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
703 armv7m_info.core_mode = ARM_MODE_THREAD;
705 init_reg_param(®_params[0], "r0", 32, PARAM_IN_OUT); /* buffer start, status (out) */
706 init_reg_param(®_params[1], "r1", 32, PARAM_OUT); /* buffer end */
707 init_reg_param(®_params[2], "r2", 32, PARAM_OUT); /* target address */
708 init_reg_param(®_params[3], "r3", 32, PARAM_OUT); /* count (double word-64bit) */
709 init_reg_param(®_params[4], "r4", 32, PARAM_OUT); /* flash status register */
710 init_reg_param(®_params[5], "r5", 32, PARAM_OUT); /* flash control register */
712 buf_set_u32(reg_params[0].value, 0, 32, source->address);
713 buf_set_u32(reg_params[1].value, 0, 32, source->address + source->size);
714 buf_set_u32(reg_params[2].value, 0, 32, address);
715 buf_set_u32(reg_params[3].value, 0, 32, count);
716 buf_set_u32(reg_params[4].value, 0, 32, stm32l4_info->part_info->flash_regs_base + STM32_FLASH_SR);
717 buf_set_u32(reg_params[5].value, 0, 32, stm32l4_info->part_info->flash_regs_base + STM32_FLASH_CR);
719 retval = target_run_flash_async_algorithm(target, buffer, count, 8,
721 ARRAY_SIZE(reg_params), reg_params,
722 source->address, source->size,
723 write_algorithm->address, 0,
726 if (retval == ERROR_FLASH_OPERATION_FAILED) {
727 LOG_ERROR("error executing stm32l4 flash write algorithm");
729 uint32_t error = buf_get_u32(reg_params[0].value, 0, 32) & FLASH_ERROR;
731 if (error & FLASH_WRPERR)
732 LOG_ERROR("flash memory write protected");
735 LOG_ERROR("flash write failed = %08" PRIx32, error);
736 /* Clear but report errors */
737 stm32l4_write_flash_reg(bank, STM32_FLASH_SR, error);
742 target_free_working_area(target, source);
743 target_free_working_area(target, write_algorithm);
745 destroy_reg_param(®_params[0]);
746 destroy_reg_param(®_params[1]);
747 destroy_reg_param(®_params[2]);
748 destroy_reg_param(®_params[3]);
749 destroy_reg_param(®_params[4]);
750 destroy_reg_param(®_params[5]);
755 static int stm32l4_write(struct flash_bank *bank, const uint8_t *buffer,
756 uint32_t offset, uint32_t count)
758 int retval = ERROR_OK, retval2;
760 if (bank->target->state != TARGET_HALTED) {
761 LOG_ERROR("Target not halted");
762 return ERROR_TARGET_NOT_HALTED;
765 /* The flash write must be aligned to a double word (8-bytes) boundary.
766 * The flash infrastructure ensures it, do just a security check */
767 assert(offset % 8 == 0);
768 assert(count % 8 == 0);
770 /* STM32G4xxx Cat. 3 devices may have gaps between banks, check whether
771 * data to be written does not go into a gap:
772 * suppose buffer is fully contained in bank from sector 0 to sector
773 * num->sectors - 1 and sectors are ordered according to offset
775 struct flash_sector *head = &bank->sectors[0];
776 struct flash_sector *tail = &bank->sectors[bank->num_sectors - 1];
778 while ((head < tail) && (offset >= (head + 1)->offset)) {
779 /* buffer does not intersect head nor gap behind head */
783 while ((head < tail) && (offset + count <= (tail - 1)->offset + (tail - 1)->size)) {
784 /* buffer does not intersect tail nor gap before tail */
788 LOG_DEBUG("data: 0x%08" PRIx32 " - 0x%08" PRIx32 ", sectors: 0x%08" PRIx32 " - 0x%08" PRIx32,
789 offset, offset + count - 1, head->offset, tail->offset + tail->size - 1);
791 /* Now check that there is no gap from head to tail, this should work
792 * even for multiple or non-symmetric gaps
794 while (head < tail) {
795 if (head->offset + head->size != (head + 1)->offset) {
796 LOG_ERROR("write into gap from " TARGET_ADDR_FMT " to " TARGET_ADDR_FMT,
797 bank->base + head->offset + head->size,
798 bank->base + (head + 1)->offset - 1);
799 retval = ERROR_FLASH_DST_OUT_OF_BANK;
804 if (retval != ERROR_OK)
807 retval = stm32l4_unlock_reg(bank);
808 if (retval != ERROR_OK)
811 retval = stm32l4_write_block(bank, buffer, offset, count / 8);
814 retval2 = stm32l4_write_flash_reg(bank, STM32_FLASH_CR, FLASH_LOCK);
816 if (retval != ERROR_OK) {
817 LOG_ERROR("block write failed");
823 static int stm32l4_read_idcode(struct flash_bank *bank, uint32_t *id)
827 /* try stm32l4/l4+/wb/g4 id register first, then stm32g0 id register */
828 retval = target_read_u32(bank->target, DBGMCU_IDCODE_L4_G4, id);
829 if ((retval != ERROR_OK) || ((*id & 0xfff) == 0) || ((*id & 0xfff) == 0xfff)) {
830 retval = target_read_u32(bank->target, DBGMCU_IDCODE_G0, id);
831 if ((retval != ERROR_OK) || ((*id & 0xfff) == 0) || ((*id & 0xfff) == 0xfff)) {
832 LOG_ERROR("can't get device id");
833 return (retval == ERROR_OK) ? ERROR_FAIL : retval;
840 static int stm32l4_probe(struct flash_bank *bank)
842 struct target *target = bank->target;
843 struct stm32l4_flash_bank *stm32l4_info = bank->driver_priv;
844 const struct stm32l4_part_info *part_info;
845 uint16_t flash_size_kb = 0xffff;
849 stm32l4_info->probed = false;
851 /* read stm32 device id registers */
852 int retval = stm32l4_read_idcode(bank, &stm32l4_info->idcode);
853 if (retval != ERROR_OK)
856 device_id = stm32l4_info->idcode & 0xFFF;
858 for (unsigned int n = 0; n < ARRAY_SIZE(stm32l4_parts); n++) {
859 if (device_id == stm32l4_parts[n].id)
860 stm32l4_info->part_info = &stm32l4_parts[n];
863 if (!stm32l4_info->part_info) {
864 LOG_WARNING("Cannot identify target as an %s family device.", device_families);
868 part_info = stm32l4_info->part_info;
870 char device_info[1024];
871 retval = bank->driver->info(bank, device_info, sizeof(device_info));
872 if (retval != ERROR_OK)
875 LOG_INFO("device idcode = 0x%08" PRIx32 " (%s)", stm32l4_info->idcode, device_info);
877 /* get flash size from target. */
878 retval = target_read_u16(target, part_info->fsize_addr, &flash_size_kb);
880 /* failed reading flash size or flash size invalid (early silicon),
881 * default to max target family */
882 if (retval != ERROR_OK || flash_size_kb == 0xffff || flash_size_kb == 0
883 || flash_size_kb > part_info->max_flash_size_kb) {
884 LOG_WARNING("STM32 flash size failed, probe inaccurate - assuming %dk flash",
885 part_info->max_flash_size_kb);
886 flash_size_kb = part_info->max_flash_size_kb;
889 /* if the user sets the size manually then ignore the probed value
890 * this allows us to work around devices that have a invalid flash size register value */
891 if (stm32l4_info->user_bank_size) {
892 LOG_WARNING("overriding size register by configured bank size - MAY CAUSE TROUBLE");
893 flash_size_kb = stm32l4_info->user_bank_size / 1024;
896 LOG_INFO("flash size = %dkbytes", flash_size_kb);
898 /* did we assign a flash size? */
899 assert((flash_size_kb != 0xffff) && flash_size_kb);
901 /* read flash option register */
902 retval = stm32l4_read_flash_reg(bank, STM32_FLASH_OPTR, &options);
903 if (retval != ERROR_OK)
906 stm32l4_info->bank1_sectors = 0;
907 stm32l4_info->hole_sectors = 0;
910 int page_size_kb = 0;
912 stm32l4_info->dual_bank_mode = false;
915 case 0x415: /* STM32L47/L48xx */
916 case 0x461: /* STM32L49/L4Axx */
917 /* if flash size is max (1M) the device is always dual bank
918 * 0x415: has variants with 512K
919 * 0x461: has variants with 512 and 256
920 * for these variants:
921 * if DUAL_BANK = 0 -> single bank
922 * else -> dual bank without gap
923 * note: the page size is invariant
926 num_pages = flash_size_kb / page_size_kb;
927 stm32l4_info->bank1_sectors = num_pages;
929 /* check DUAL_BANK bit[21] if the flash is less than 1M */
930 if (flash_size_kb == 1024 || (options & BIT(21))) {
931 stm32l4_info->dual_bank_mode = true;
932 stm32l4_info->bank1_sectors = num_pages / 2;
935 case 0x435: /* STM32L43/L44xx */
936 case 0x460: /* STM32G07/G08xx */
937 case 0x462: /* STM32L45/L46xx */
938 case 0x464: /* STM32L41/L42xx */
939 case 0x466: /* STM32G03/G04xx */
940 case 0x468: /* STM32G43/G44xx */
941 case 0x497: /* STM32WLEx */
942 /* single bank flash */
944 num_pages = flash_size_kb / page_size_kb;
945 stm32l4_info->bank1_sectors = num_pages;
947 case 0x469: /* STM32G47/G48xx */
948 /* STM32G47/8 can be single/dual bank:
949 * if DUAL_BANK = 0 -> single bank
950 * else -> dual bank WITH gap
953 num_pages = flash_size_kb / page_size_kb;
954 stm32l4_info->bank1_sectors = num_pages;
955 if (options & BIT(22)) {
956 stm32l4_info->dual_bank_mode = true;
958 num_pages = flash_size_kb / page_size_kb;
959 stm32l4_info->bank1_sectors = num_pages / 2;
961 /* for devices with trimmed flash, there is a gap between both banks */
962 stm32l4_info->hole_sectors =
963 (part_info->max_flash_size_kb - flash_size_kb) / (2 * page_size_kb);
966 case 0x470: /* STM32L4R/L4Sxx */
967 case 0x471: /* STM32L4P5/L4Q5x */
968 /* STM32L4R/S can be single/dual bank:
969 * if size = 2M check DBANK bit(22)
970 * if size = 1M check DB1M bit(21)
971 * STM32L4P/Q can be single/dual bank
972 * if size = 1M check DBANK bit(22)
973 * if size = 512K check DB512K bit(21)
976 num_pages = flash_size_kb / page_size_kb;
977 stm32l4_info->bank1_sectors = num_pages;
978 const bool use_dbank_bit = flash_size_kb == part_info->max_flash_size_kb;
979 if ((use_dbank_bit && (options & BIT(22))) ||
980 (!use_dbank_bit && (options & BIT(21)))) {
981 stm32l4_info->dual_bank_mode = true;
983 num_pages = flash_size_kb / page_size_kb;
984 stm32l4_info->bank1_sectors = num_pages / 2;
987 case 0x495: /* STM32WB5x */
988 /* single bank flash */
990 num_pages = flash_size_kb / page_size_kb;
991 stm32l4_info->bank1_sectors = num_pages;
994 LOG_ERROR("unsupported device");
998 LOG_INFO("flash mode : %s-bank", stm32l4_info->dual_bank_mode ? "dual" : "single");
1000 const int gap_size_kb = stm32l4_info->hole_sectors * page_size_kb;
1002 if (gap_size_kb != 0) {
1003 LOG_INFO("gap detected from 0x%08" PRIx32 " to 0x%08" PRIx32,
1004 STM32_FLASH_BANK_BASE + stm32l4_info->bank1_sectors
1005 * page_size_kb * 1024,
1006 STM32_FLASH_BANK_BASE + (stm32l4_info->bank1_sectors
1007 * page_size_kb + gap_size_kb) * 1024 - 1);
1010 /* number of significant bits in WRPxxR differs per device,
1011 * always right adjusted, on some devices non-implemented
1012 * bits read as '0', on others as '1' ...
1013 * notably G4 Cat. 2 implement only 6 bits, contradicting the RM
1016 /* use *max_flash_size* instead of actual size as the trimmed versions
1017 * certainly use the same number of bits
1018 * max_flash_size is always power of two, so max_pages too
1020 uint32_t max_pages = stm32l4_info->part_info->max_flash_size_kb / page_size_kb;
1021 assert((max_pages & (max_pages - 1)) == 0);
1023 /* in dual bank mode number of pages is doubled, but extra bit is bank selection */
1024 stm32l4_info->wrpxxr_mask = ((max_pages >> (stm32l4_info->dual_bank_mode ? 1 : 0)) - 1);
1025 assert((stm32l4_info->wrpxxr_mask & 0xFFFF0000) == 0);
1026 LOG_DEBUG("WRPxxR mask 0x%04" PRIx16, stm32l4_info->wrpxxr_mask);
1028 if (bank->sectors) {
1029 free(bank->sectors);
1030 bank->sectors = NULL;
1033 bank->size = (flash_size_kb + gap_size_kb) * 1024;
1034 bank->base = STM32_FLASH_BANK_BASE;
1035 bank->num_sectors = num_pages;
1036 bank->sectors = malloc(sizeof(struct flash_sector) * bank->num_sectors);
1037 if (bank->sectors == NULL) {
1038 LOG_ERROR("failed to allocate bank sectors");
1042 for (int i = 0; i < bank->num_sectors; i++) {
1043 bank->sectors[i].offset = i * page_size_kb * 1024;
1044 /* in dual bank configuration, if there is a gap between banks
1045 * we fix up the sector offset to consider this gap */
1046 if (i >= stm32l4_info->bank1_sectors && stm32l4_info->hole_sectors)
1047 bank->sectors[i].offset += gap_size_kb * 1024;
1048 bank->sectors[i].size = page_size_kb * 1024;
1049 bank->sectors[i].is_erased = -1;
1050 bank->sectors[i].is_protected = 1;
1053 stm32l4_info->probed = true;
1057 static int stm32l4_auto_probe(struct flash_bank *bank)
1059 struct stm32l4_flash_bank *stm32l4_info = bank->driver_priv;
1060 if (stm32l4_info->probed)
1063 return stm32l4_probe(bank);
1066 static int get_stm32l4_info(struct flash_bank *bank, char *buf, int buf_size)
1068 struct stm32l4_flash_bank *stm32l4_info = bank->driver_priv;
1069 const struct stm32l4_part_info *part_info = stm32l4_info->part_info;
1072 const char *rev_str = NULL;
1073 uint16_t rev_id = stm32l4_info->idcode >> 16;
1074 for (unsigned int i = 0; i < part_info->num_revs; i++) {
1075 if (rev_id == part_info->revs[i].rev) {
1076 rev_str = part_info->revs[i].str;
1078 if (rev_str != NULL) {
1079 snprintf(buf, buf_size, "%s - Rev: %s%s",
1080 part_info->device_str, rev_str, stm32l4_info->probed ?
1081 (stm32l4_info->dual_bank_mode ? " dual-bank" : " single-bank") : "");
1087 snprintf(buf, buf_size, "%s - Rev: unknown (0x%04x)%s",
1088 part_info->device_str, rev_id, stm32l4_info->probed ?
1089 (stm32l4_info->dual_bank_mode ? " dual-bank" : " single-bank") : "");
1092 snprintf(buf, buf_size, "Cannot identify target as an %s device", device_families);
1099 static int stm32l4_mass_erase(struct flash_bank *bank)
1101 int retval, retval2;
1102 struct target *target = bank->target;
1103 struct stm32l4_flash_bank *stm32l4_info = bank->driver_priv;
1105 uint32_t action = FLASH_MER1;
1107 if (stm32l4_info->part_info->has_dual_bank)
1108 action |= FLASH_MER2;
1110 if (target->state != TARGET_HALTED) {
1111 LOG_ERROR("Target not halted");
1112 return ERROR_TARGET_NOT_HALTED;
1115 retval = stm32l4_unlock_reg(bank);
1116 if (retval != ERROR_OK)
1119 /* mass erase flash memory */
1120 retval = stm32l4_wait_status_busy(bank, FLASH_ERASE_TIMEOUT / 10);
1121 if (retval != ERROR_OK)
1124 retval = stm32l4_write_flash_reg(bank, STM32_FLASH_CR, action);
1125 if (retval != ERROR_OK)
1128 retval = stm32l4_write_flash_reg(bank, STM32_FLASH_CR, action | FLASH_STRT);
1129 if (retval != ERROR_OK)
1132 retval = stm32l4_wait_status_busy(bank, FLASH_ERASE_TIMEOUT);
1135 retval2 = stm32l4_write_flash_reg(bank, STM32_FLASH_CR, FLASH_LOCK);
1137 if (retval != ERROR_OK)
1143 COMMAND_HANDLER(stm32l4_handle_mass_erase_command)
1146 command_print(CMD, "stm32l4x mass_erase <STM32L4 bank>");
1147 return ERROR_COMMAND_SYNTAX_ERROR;
1150 struct flash_bank *bank;
1151 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1152 if (ERROR_OK != retval)
1155 retval = stm32l4_mass_erase(bank);
1156 if (retval == ERROR_OK) {
1157 /* set all sectors as erased */
1158 for (int i = 0; i < bank->num_sectors; i++)
1159 bank->sectors[i].is_erased = 1;
1161 command_print(CMD, "stm32l4x mass erase complete");
1163 command_print(CMD, "stm32l4x mass erase failed");
1169 COMMAND_HANDLER(stm32l4_handle_option_read_command)
1172 command_print(CMD, "stm32l4x option_read <STM32L4 bank> <option_reg offset>");
1173 return ERROR_COMMAND_SYNTAX_ERROR;
1176 struct flash_bank *bank;
1177 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1178 if (ERROR_OK != retval)
1181 uint32_t reg_offset, reg_addr;
1184 reg_offset = strtoul(CMD_ARGV[1], NULL, 16);
1185 reg_addr = stm32l4_get_flash_reg(bank, reg_offset);
1187 retval = stm32l4_read_flash_reg(bank, reg_offset, &value);
1188 if (ERROR_OK != retval)
1191 command_print(CMD, "Option Register: <0x%" PRIx32 "> = 0x%" PRIx32 "", reg_addr, value);
1196 COMMAND_HANDLER(stm32l4_handle_option_write_command)
1199 command_print(CMD, "stm32l4x option_write <STM32L4 bank> <option_reg offset> <value> [mask]");
1200 return ERROR_COMMAND_SYNTAX_ERROR;
1203 struct flash_bank *bank;
1204 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1205 if (ERROR_OK != retval)
1208 uint32_t reg_offset;
1210 uint32_t mask = 0xFFFFFFFF;
1212 reg_offset = strtoul(CMD_ARGV[1], NULL, 16);
1213 value = strtoul(CMD_ARGV[2], NULL, 16);
1215 mask = strtoul(CMD_ARGV[3], NULL, 16);
1217 command_print(CMD, "%s Option written.\n"
1218 "INFO: a reset or power cycle is required "
1219 "for the new settings to take effect.", bank->driver->name);
1221 retval = stm32l4_write_option(bank, reg_offset, value, mask);
1225 COMMAND_HANDLER(stm32l4_handle_option_load_command)
1228 return ERROR_COMMAND_SYNTAX_ERROR;
1230 struct flash_bank *bank;
1231 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1232 if (ERROR_OK != retval)
1235 retval = stm32l4_unlock_reg(bank);
1236 if (ERROR_OK != retval)
1239 retval = stm32l4_unlock_option_reg(bank);
1240 if (ERROR_OK != retval)
1243 /* Set OBL_LAUNCH bit in CR -> system reset and option bytes reload,
1244 * but the RMs explicitly do *NOT* list this as power-on reset cause, and:
1245 * "Note: If the read protection is set while the debugger is still
1246 * connected through JTAG/SWD, apply a POR (power-on reset) instead of a system reset."
1248 retval = stm32l4_write_flash_reg(bank, STM32_FLASH_CR, FLASH_OBL_LAUNCH);
1250 command_print(CMD, "stm32l4x option load completed. Power-on reset might be required");
1252 /* Need to re-probe after change */
1253 struct stm32l4_flash_bank *stm32l4_info = bank->driver_priv;
1254 stm32l4_info->probed = false;
1259 COMMAND_HANDLER(stm32l4_handle_lock_command)
1261 struct target *target = NULL;
1264 return ERROR_COMMAND_SYNTAX_ERROR;
1266 struct flash_bank *bank;
1267 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1268 if (ERROR_OK != retval)
1271 target = bank->target;
1273 if (target->state != TARGET_HALTED) {
1274 LOG_ERROR("Target not halted");
1275 return ERROR_TARGET_NOT_HALTED;
1278 /* set readout protection level 1 by erasing the RDP option byte */
1279 if (stm32l4_write_option(bank, STM32_FLASH_OPTR, 0, 0x000000FF) != ERROR_OK) {
1280 command_print(CMD, "%s failed to lock device", bank->driver->name);
1287 COMMAND_HANDLER(stm32l4_handle_unlock_command)
1289 struct target *target = NULL;
1292 return ERROR_COMMAND_SYNTAX_ERROR;
1294 struct flash_bank *bank;
1295 int retval = CALL_COMMAND_HANDLER(flash_command_get_bank, 0, &bank);
1296 if (ERROR_OK != retval)
1299 target = bank->target;
1301 if (target->state != TARGET_HALTED) {
1302 LOG_ERROR("Target not halted");
1303 return ERROR_TARGET_NOT_HALTED;
1306 if (stm32l4_write_option(bank, STM32_FLASH_OPTR, RDP_LEVEL_0, 0x000000FF) != ERROR_OK) {
1307 command_print(CMD, "%s failed to unlock device", bank->driver->name);
1314 static const struct command_registration stm32l4_exec_command_handlers[] = {
1317 .handler = stm32l4_handle_lock_command,
1318 .mode = COMMAND_EXEC,
1320 .help = "Lock entire flash device.",
1324 .handler = stm32l4_handle_unlock_command,
1325 .mode = COMMAND_EXEC,
1327 .help = "Unlock entire protected flash device.",
1330 .name = "mass_erase",
1331 .handler = stm32l4_handle_mass_erase_command,
1332 .mode = COMMAND_EXEC,
1334 .help = "Erase entire flash device.",
1337 .name = "option_read",
1338 .handler = stm32l4_handle_option_read_command,
1339 .mode = COMMAND_EXEC,
1340 .usage = "bank_id reg_offset",
1341 .help = "Read & Display device option bytes.",
1344 .name = "option_write",
1345 .handler = stm32l4_handle_option_write_command,
1346 .mode = COMMAND_EXEC,
1347 .usage = "bank_id reg_offset value mask",
1348 .help = "Write device option bit fields with provided value.",
1351 .name = "option_load",
1352 .handler = stm32l4_handle_option_load_command,
1353 .mode = COMMAND_EXEC,
1355 .help = "Force re-load of device options (will cause device reset).",
1357 COMMAND_REGISTRATION_DONE
1360 static const struct command_registration stm32l4_command_handlers[] = {
1363 .mode = COMMAND_ANY,
1364 .help = "stm32l4x flash command group",
1366 .chain = stm32l4_exec_command_handlers,
1368 COMMAND_REGISTRATION_DONE
1371 const struct flash_driver stm32l4x_flash = {
1373 .commands = stm32l4_command_handlers,
1374 .flash_bank_command = stm32l4_flash_bank_command,
1375 .erase = stm32l4_erase,
1376 .protect = stm32l4_protect,
1377 .write = stm32l4_write,
1378 .read = default_flash_read,
1379 .probe = stm32l4_probe,
1380 .auto_probe = stm32l4_auto_probe,
1381 .erase_check = default_flash_blank_check,
1382 .protect_check = stm32l4_protect_check,
1383 .info = get_stm32l4_info,
1384 .free_driver_priv = default_flash_free_driver_priv,