mspm0: Flash target using on-device core loop stub

Author: hardesk

src/target/cortexm.c

@@ -1007,7 +1007,8 @@ static int cortexm_fault_unwind(target_s *target)
 	return 0;
 }
 
-bool cortexm_run_stub(target_s *target, uint32_t loadaddr, uint32_t r0, uint32_t r1, uint32_t r2, uint32_t r3)
+bool cortexm_run_stub(
+	target_s *target, uint32_t loadaddr, uint32_t r0, uint32_t r1, uint32_t r2, uint32_t r3, uint32_t sp)
 {
 	uint32_t regs[CORTEXM_MAX_REG_COUNT] = {0};
 
@@ -1016,6 +1017,8 @@ bool cortexm_run_stub(target_s *target, uint32_t loadaddr, uint32_t r0, uint32_t
 	regs[2] = r2;
 	regs[3] = r3;
 	regs[15] = loadaddr;
+	regs[CORTEX_REG_SP] = sp;
+	regs[CORTEX_REG_MSP] = sp;
 	regs[CORTEX_REG_XPSR] = CORTEXM_XPSR_THUMB;
 	regs[19] = 0;
 

src/target/cortexm.h

@@ -198,7 +198,8 @@ extern unsigned cortexm_wait_timeout;
 bool cortexm_attach(target_s *target);
 void cortexm_detach(target_s *target);
 void cortexm_halt_resume(target_s *target, bool step);
-bool cortexm_run_stub(target_s *target, uint32_t loadaddr, uint32_t r0, uint32_t r1, uint32_t r2, uint32_t r3);
+bool cortexm_run_stub(
+	target_s *target, uint32_t loadaddr, uint32_t r0, uint32_t r1, uint32_t r2, uint32_t r3, uint32_t sp);
 int cortexm_mem_write_aligned(target_s *target, target_addr_t dest, const void *src, size_t len, align_e align);
 uint32_t cortexm_demcr_read(const target_s *target);
 void cortexm_demcr_write(target_s *target, uint32_t demcr);

src/target/efm32.c

@@ -635,7 +635,7 @@ static bool efm32_flash_write(target_flash_s *flash, target_addr_t dest, const v
 	target_mem32_write(target, STUB_BUFFER_BASE, src, len);
 	/* Run flashloader */
 	const bool ret =
-		cortexm_run_stub(target, SRAM_BASE, dest, STUB_BUFFER_BASE, len, priv_storage->device->msc_addr) == 0;
+		cortexm_run_stub(target, SRAM_BASE, dest, STUB_BUFFER_BASE, len, priv_storage->device->msc_addr, 0) == 0;
 
 #if ENABLE_DEBUG == 1
 	/* Check the MSC_IF */

src/target/flashstub/meson.build

@@ -32,6 +32,7 @@
 lmi_stub = []
 efm32_stub = []
 rp2040_stub = []
+mspm0_stub = []
 
 # If we're doing a firmware build, type to find hexdump and objcopy
 if is_firmware_build
@@ -189,3 +190,35 @@ rp2040_stub = custom_target(
 	output: 'rp.stub',
 	capture: true,
 )
+
+# Flash stub for MSPM0 parts
+mspm0_stub_elf = executable(
+	'mspm0_stub.elf',
+	'mspm0.c',
+	c_args: [
+		'-mcpu=cortex-m0plus',
+		stub_build_args
+	],
+	link_args: [
+		'-mcpu=cortex-m0plus',
+		stub_build_args,
+		'-T', '@0@/mspm0.ld'.format(meson.current_source_dir()),
+	],
+	link_depends: files('mspm0.ld'),
+	pie: false,
+	install: false,
+)
+
+mspm0_stub_bin = custom_target(
+	command: [ objcopy, '-O', 'binary', '@INPUT@', '@OUTPUT@' ],
+	input: mspm0_stub_elf,
+	output: 'mspm0_stub.bin'
+)
+
+mspm0_stub = custom_target(
+	'mspm0_stub-hex',
+	command: [ hexdump, '-v', '-e', '/2 "0x%04X, "' , '@INPUT@' ],
+	input: mspm0_stub_bin,
+	output: 'mspm0.stub',
+	capture: true,
+)

src/target/flashstub/mspm0.c

@@ -0,0 +1,72 @@
+/*
+ * This file is part of the Black Magic Debug project.
+ *
+ * Copyright (C) 2026 1BitSquared <info@1bitsquared.com>
+ * Written by hardesk <hardesk17@gmail.com>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <stdint.h>
+#include "stub.h"
+
+#define MSPM0_FLASH_MAIN      0x00000000U
+#define MSPM0_FLASH_SECTOR_SZ 1024U
+
+#define MSPM0_FLASHCTL_BASE             0x400cd000U
+#define MSPM0_FLASHCTL_CMDEXEC          *((volatile uint32_t *)(MSPM0_FLASHCTL_BASE + 0x1100U))
+#define MSPM0_FLASHCTL_CMDTYPE          *((volatile uint32_t *)(MSPM0_FLASHCTL_BASE + 0x1104U))
+#define MSPM0_FLASHCTL_CMDCTL           *((volatile uint32_t *)(MSPM0_FLASHCTL_BASE + 0x1108U))
+#define MSPM0_FLASHCTL_CMDADDR          *((volatile uint32_t *)(MSPM0_FLASHCTL_BASE + 0x1120U))
+#define MSPM0_FLASHCTL_BYTEN            *((volatile uint32_t *)(MSPM0_FLASHCTL_BASE + 0x1124U))
+#define MSPM0_FLASHCTL_STATCMD          *((volatile uint32_t *)(MSPM0_FLASHCTL_BASE + 0x13d0U))
+#define MSPM0_FLASHCTL_CMDDATA0         *((volatile uint32_t *)(MSPM0_FLASHCTL_BASE + 0x1130U))
+#define MSPM0_FLASHCTL_CMDDATA1         *((volatile uint32_t *)(MSPM0_FLASHCTL_BASE + 0x1134U))
+#define MSPM0_FLASHCTL_CMDWEPROTA       *((volatile uint32_t *)(MSPM0_FLASHCTL_BASE + 0x11d0U))
+#define MSPM0_FLASHCTL_CMDWEPROTB       *((volatile uint32_t *)(MSPM0_FLASHCTL_BASE + 0x11d4U))
+#define MSPM0_FLASHCTL_CMDWEPROTC       *((volatile uint32_t *)(MSPM0_FLASHCTL_BASE + 0x11d8U))
+#define MSPM0_FLASHCTL_CMDTYPE_PROG     1U
+#define MSPM0_FLASHCTL_CMDTYPE_SZ_1WORD (0U << 4U)
+#define MSPM0_FLASHCTL_CMDEXEC_EXEC     1U
+#define MSPM0_FLASHCTL_STATCMD_DONE     0x01U
+#define MSPM0_FLASHCTL_STATCMD_CMDPASS  0x02U
+
+void mspm0_flash_write_stub(const uint32_t *const dest, const uint32_t *const src, const uint32_t size)
+{
+	for (uint32_t i = 0U; i < size / 4; i += 2) {
+		uint32_t addr = (uint32_t)(dest + i);
+		uint32_t sector = (addr - MSPM0_FLASH_MAIN) / MSPM0_FLASH_SECTOR_SZ;
+
+		if (sector < 32U)
+			MSPM0_FLASHCTL_CMDWEPROTA = ~(1U << sector);
+		else if (sector < 256U)
+			MSPM0_FLASHCTL_CMDWEPROTB = 0U;
+		else
+			MSPM0_FLASHCTL_CMDWEPROTC = 0U;
+
+		MSPM0_FLASHCTL_CMDCTL = 0U;
+		MSPM0_FLASHCTL_BYTEN = 0xffffffffU;
+		MSPM0_FLASHCTL_CMDTYPE = MSPM0_FLASHCTL_CMDTYPE_PROG | MSPM0_FLASHCTL_CMDTYPE_SZ_1WORD;
+
+		MSPM0_FLASHCTL_CMDADDR = addr;
+		MSPM0_FLASHCTL_CMDDATA0 = src[i];
+		MSPM0_FLASHCTL_CMDDATA1 = src[i + 1U];
+		MSPM0_FLASHCTL_CMDEXEC = MSPM0_FLASHCTL_CMDEXEC_EXEC;
+		while (!(MSPM0_FLASHCTL_STATCMD & MSPM0_FLASHCTL_STATCMD_DONE))
+			continue;
+		if (!(MSPM0_FLASHCTL_STATCMD & MSPM0_FLASHCTL_STATCMD_CMDPASS))
+			stub_exit(0);
+	}
+
+	stub_exit(1);
+}

src/target/flashstub/mspm0.ld

@@ -0,0 +1,10 @@
+MEMORY { sram (rwx): ORIGIN = 0x20000000, LENGTH = 0x00001000 }
+
+SECTIONS
+{
+	.text :
+	{
+		KEEP(*(.entry))
+		*(.text.*, .text)
+	} > sram
+}

src/target/flashstub/mspm0.stub

@@ -0,0 +1 @@
+0xB5F7, 0x0893, 0x9301, 0x2380, 0x2580, 0x021B, 0x2601, 0x469C, 0x2200, 0x2301, 0x02ED, 0x4276, 0x9C01, 0x4294, 0xD801, 0xBE01, 0xBDF7, 0x4560, 0xD222, 0x001F, 0x0A84, 0x40A7, 0x43FC, 0x4F13, 0x603C, 0x2700, 0x4C12, 0x6027, 0x4C12, 0x6026, 0x4C12, 0x6023, 0x4C12, 0x6020, 0x680F, 0x4C12, 0x6027, 0x684F, 0x4C11, 0x6027, 0x4C11, 0x6023, 0x4C11, 0x6827, 0x421F, 0xD0FC, 0x6824, 0x07A4, 0xD400, 0xBE00, 0x3202, 0x3008, 0x3108, 0xE7D5, 0x2400, 0x42A8, 0xD201, 0x4F0B, 0xE7DC, 0x4F0B, 0xE7DA, 0x46C0, 0xE1D0, 0x400C, 0xE108, 0x400C, 0xE124, 0x400C, 0xE104, 0x400C, 0xE120, 0x400C, 0xE130, 0x400C, 0xE134, 0x400C, 0xE100, 0x400C, 0xE3D0, 0x400C, 0xE1D4, 0x400C, 0xE1D8, 0x400C,

src/target/lmi.c

@@ -229,5 +229,5 @@ static bool lmi_flash_write(target_flash_s *flash, target_addr_t dest, const voi
 	if (target_check_error(target))
 		return false;
 
-	return cortexm_run_stub(target, LMI_SRAM_BASE, dest, LMI_STUB_BUFFER_BASE, len, 0) == 0;
+	return cortexm_run_stub(target, LMI_SRAM_BASE, dest, LMI_STUB_BUFFER_BASE, len, 0, 0) == 0;
 }

src/target/meson.build

@@ -370,7 +370,7 @@ target_ti_cortexm = declare_dependency(
 		'msp432e4.c',
 		'msp432p4.c',
 		'mspm0.c'
-	) + lmi_stub,
+	) + lmi_stub + mspm0_stub,
 	compile_args: ['-DCONFIG_TI=1'],
 	dependencies: target_cortexm,
 )

src/target/mspm0.c

@@ -1,7 +1,7 @@
 /*
  * This file is part of the Black Magic Debug project.
  *
- * Copyright (C) 2024 hardesk <hardesk@gmail.com>
+ * Copyright (C) 2024-2026 hardesk <hardesk17@gmail.com>
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -22,7 +22,7 @@
 #include "target_internal.h"
 #include "buffer_utils.h"
 #include "jep106.h"
-#include "cortex.h"
+#include "cortexm.h"
 
 #define MSPM0_CONFIG_FLASH_DUMP_SUPPORT (CONFIG_BMDA == 1 || ENABLE_DEBUG == 1)
 
@@ -31,12 +31,14 @@
 #define TI_DEVID_MSPM0L_1227_2228 0xbb9fU /* MSPM0L[12]22[78]*/
 #define TI_DEVID_MSPM0G           0xbb88U /* MSPM0G310[567], MSPM0G150[567], MSPM0G350[567] */
 
-#define MSPM0_SRAM_BASE       0x20000000U
-#define MSPM0_FLASH_MAIN      0x00000000U
-#define MSPM0_FLASH_NONMAIN   0x41c00000U /* One Sector, BANK0. Device boot configuration (BCR, BSL) */
-#define MSPM0_FLASH_FACTORY   0x41c40000U /* One Sector, BANK0. Non modifiable */
-#define MSPM0_FLASH_DATA      0x41d00000U
-#define MSPM0_FLASH_SECTOR_SZ 1024U
+#define MSPM0_SRAM_BASE             0x20000000U
+#define MSPM0_FLASH_MAIN            0x00000000U
+#define MSPM0_FLASH_NONMAIN         0x41c00000U /* One Sector, BANK0. Device boot configuration (BCR, BSL) */
+#define MSPM0_FLASH_FACTORY         0x41c40000U /* One Sector, BANK0. Non modifiable */
+#define MSPM0_FLASH_DATA            0x41d00000U
+#define MSPM0_FLASH_SECTOR_SZ       1024U
+#define MSPM0_FLASH_WRITE_CHUNK_SZ  MSPM0_FLASH_SECTOR_SZ
+#define MSPM0_FLASH_STUB_STACK_SIZE 0x20U
 
 #define MSPM0_FACTORYREGION_DEVICEID  (MSPM0_FLASH_FACTORY + 0x4U)
 #define MSPM0_FACTORYREGION_SRAMFLASH (MSPM0_FLASH_FACTORY + 0x18U)
@@ -89,8 +91,18 @@
 typedef struct mspm0_flash {
 	target_flash_s target_flash;
 	uint32_t banks;
+	uint32_t ram_size; /* 0 if not enough ram to use stub flashing */
 } mspm0_flash_s;
 
+static const uint16_t mspm0_flash_write_stub[] = {
+#include "flashstub/mspm0.stub"
+};
+#define STUB_BUFFER_BASE ALIGN(MSPM0_SRAM_BASE + sizeof(mspm0_flash_write_stub), 4)
+
+static bool mspm0_flash_erase(target_flash_s *flash, target_addr_t addr, size_t length);
+static bool mspm0_flash_write(target_flash_s *flash, target_addr_t dest, const void *src, size_t length);
+static bool mspm0_mass_erase(target_s *target, platform_timeout_s *print_progess);
+
 #if MSPM0_CONFIG_FLASH_DUMP_SUPPORT
 static bool mspm0_dump_factory_config(target_s *target, int argc, const char **argv);
 static bool mspm0_dump_bcr_config(target_s *target, int argc, const char **argv);
@@ -102,10 +114,6 @@ static command_s mspm0_cmds_list[] = {
 };
 #endif
 
-static bool mspm0_flash_erase(target_flash_s *flash, target_addr_t addr, size_t length);
-static bool mspm0_flash_write(target_flash_s *flash, target_addr_t dest, const void *src, size_t length);
-static bool mspm0_mass_erase(target_s *target, platform_timeout_s *print_progess);
-
 #if MSPM0_CONFIG_FLASH_DUMP_SUPPORT
 typedef struct conf_register {
 	uint16_t reg_offset;
@@ -185,20 +193,31 @@ static bool mspm0_dump_bcr_config(target_s *const target, const int argc, const
 }
 #endif
 
-static void mspm0_add_flash(target_s *const target, const uint32_t base, const size_t length, const uint32_t banks)
+static void mspm0_add_flash(
+	target_s *const target, const uint32_t base, const size_t length, const uint32_t banks, uint32_t sram_size)
 {
 	mspm0_flash_s *const flash = calloc(1, sizeof(*flash));
 	if (flash == NULL) {
 		DEBUG_WARN("%s: calloc failed for %" PRIu32 " bytes\n", __func__, (uint32_t)length);
 		return;
 	}
 
+	/* Decrease writesize until it fits within available RAM */
+	uint32_t write_size = MSPM0_FLASH_WRITE_CHUNK_SZ;
+	uint32_t stub_plus = ALIGN(sizeof mspm0_flash_write_stub, 4) + MSPM0_FLASH_STUB_STACK_SIZE;
+	if (sram_size >= stub_plus) {
+		uint32_t avail_ram = sram_size - stub_plus;
+		while (write_size > avail_ram)
+			write_size >>= 1;
+		flash->ram_size = sram_size;
+	}
+
 	flash->banks = banks;
 	target_flash_s *target_flash = &flash->target_flash;
 	target_flash->start = base;
 	target_flash->length = length;
 	target_flash->blocksize = MSPM0_FLASH_SECTOR_SZ;
-	target_flash->writesize = 8U;
+	target_flash->writesize = write_size;
 	target_flash->erase = mspm0_flash_erase;
 	target_flash->write = mspm0_flash_write;
 	target_flash->erased = 0xffU;
@@ -235,9 +254,9 @@ bool mspm0_probe(target_s *const target)
 			MSPM0_FACTORYREGION_SRAMFLASH_DATAFLASH_SZ_SHIFT);
 
 	target_add_ram32(target, MSPM0_SRAM_BASE, sram_size);
-	mspm0_add_flash(target, MSPM0_FLASH_MAIN, mainflash_size, main_num_banks);
+	mspm0_add_flash(target, MSPM0_FLASH_MAIN, mainflash_size, main_num_banks, sram_size);
 	if (dataflash_size != 0)
-		mspm0_add_flash(target, MSPM0_FLASH_DATA, dataflash_size, 1U);
+		mspm0_add_flash(target, MSPM0_FLASH_DATA, dataflash_size, 1U, sram_size);
 
 #if MSPM0_CONFIG_FLASH_DUMP_SUPPORT
 	target_add_commands(target, mspm0_cmds_list, "MSPM0");
@@ -257,7 +276,7 @@ static uint32_t mspm0_flash_wait_done(target_s *const target)
 		status = target_mem32_read32(target, MSPM0_FLASHCTL_STATCMD);
 		if (platform_timeout_is_expired(&timeout))
 			return 0U;
-	};
+	}
 
 	return status;
 }
@@ -278,8 +297,10 @@ static void mspm0_flash_unprotect_sector(target_flash_s *const target_flash, con
 		uint32_t mask = ~(1U << sector);
 		target_mem32_write32(target_flash->t, MSPM0_FLASHCTL_CMDWEPROTA, mask);
 	} else if (sector < 256U) { /* 8 sectors per bit */
-		/* When main flash is single bank, PROTB covers sectors starting after PROTA which is 32k. In multibank case
-		 * PROTB bits overlap PROTA and starts at sector 0. */
+		/* Sectors affected by PROTB depend on the flash configuration. In single-bank
+		* main flash, PROTB applies to sectors after those affected by PROTA
+		* (that is, starting at sector 32). In multi-bank configurations, PROTA overlaps
+		* PROTB, so PROTB applies starting at sector 0.  */
 		uint32_t start_protb_sector = mspm0_flash->banks > 1U ? 0U : 32U;
 		uint32_t mask = ~(1U << ((sector - start_protb_sector) >> 3U));
 		target_mem32_write32(target_flash->t, MSPM0_FLASHCTL_CMDWEPROTB, mask);
@@ -291,9 +312,7 @@ static void mspm0_flash_unprotect_sector(target_flash_s *const target_flash, con
 
 static bool mspm0_flash_erase(target_flash_s *const target_flash, const target_addr_t addr, const size_t length)
 {
-#ifdef DEBUG_TARGET_IS_NOOP
 	(void)length;
-#endif
 
 	target_s *const target = target_flash->t;
 
@@ -316,27 +335,19 @@ static bool mspm0_flash_erase(target_flash_s *const target_flash, const target_a
 static bool mspm0_flash_write(
 	target_flash_s *const target_flash, target_addr_t dest, const void *const src, const size_t length)
 {
-#ifdef DEBUG_TARGET_IS_NOOP
-	(void)length;
-#endif
-
 	target_s *const target = target_flash->t;
+	mspm0_flash_s *flash = (mspm0_flash_s *)target_flash;
+	if (flash->ram_size == 0)
+		return false;
 
-	mspm0_flash_unprotect_sector(target_flash, dest);
-	target_mem32_write32(target, MSPM0_FLASHCTL_CMDTYPE, MSPM0_FLASHCTL_CMDTYPE_PROG | MSPM0_FLASHCTL_CMDTYPE_SZ_1WORD);
-	target_mem32_write32(target, MSPM0_FLASHCTL_CMDCTL, 0U);
-	target_mem32_write32(target, MSPM0_FLASHCTL_CMDADDR, dest);
-	target_mem32_write32(target, MSPM0_FLASHCTL_BYTEN, 0xffffffffU);
-	target_mem32_write32(target, MSPM0_FLASHCTL_CMDDATA0, read_le4((const uint8_t *)src, 0U));
-	target_mem32_write32(target, MSPM0_FLASHCTL_CMDDATA1, read_le4((const uint8_t *)src, 4U));
-	target_mem32_write32(target, MSPM0_FLASHCTL_CMDEXEC, MSPM0_FLASHCTL_CMDEXEC_EXEC);
+	DEBUG_TARGET(
+		"%s: Writing flash addr %08" PRIx32 " length %08" PRIx32 "\n", __func__, (uint32_t)dest, (uint32_t)length);
 
-	const uint32_t status = mspm0_flash_wait_done(target);
-	if (!(status & MSPM0_FLASHCTL_STAT_CMDPASS))
-		DEBUG_TARGET("%s: Failed to write to flash, status %08" PRIx32 " addr %08" PRIx32 " length %08" PRIx32 "\n",
-			__func__, status, dest, (uint32_t)length);
+	target_mem32_write(target, MSPM0_SRAM_BASE, mspm0_flash_write_stub, sizeof(mspm0_flash_write_stub));
+	target_mem32_write(target, STUB_BUFFER_BASE, src, length);
 
-	return status & MSPM0_FLASHCTL_STAT_CMDPASS;
+	return cortexm_run_stub(
+		target, MSPM0_SRAM_BASE, dest, STUB_BUFFER_BASE, length, 0, MSPM0_SRAM_BASE + flash->ram_size);
 }
 
 static bool mspm0_mass_erase(target_s *const target, platform_timeout_s *const print_progess)