1 # SPDX-License-Identifier: GPL-2.0-or-later
3 # script for stm32u5x family
6 # stm32u5 devices support both JTAG and SWD transports.
8 source [find target/swj-dp.tcl]
9 source [find mem_helper.tcl]
11 if { [info exists CHIPNAME] } {
12 set _CHIPNAME $CHIPNAME
14 set _CHIPNAME stm32u5x
19 # Work-area is a space in RAM used for flash programming
21 if { [info exists WORKAREASIZE] } {
22 set _WORKAREASIZE $WORKAREASIZE
24 set _WORKAREASIZE 0x10000
28 if { [info exists CPUTAPID] } {
29 set _CPUTAPID $CPUTAPID
32 # See STM Document RM0438
33 # RM0456 Rev1, Section 65.2.8 JTAG debug port - Table 661. JTAG-DP data registers
34 # Corresponds to Cortex®-M33 JTAG debug port ID code
35 set _CPUTAPID 0x0ba04477
37 # SWD IDCODE (single drop, arm)
38 set _CPUTAPID 0x0be12477
42 swj_newdap $_CHIPNAME cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id $_CPUTAPID
43 dap create $_CHIPNAME.dap -chain-position $_CHIPNAME.cpu
46 jtag newtap $_CHIPNAME bs -irlen 5
49 set _TARGETNAME $_CHIPNAME.cpu
50 target create $_TARGETNAME cortex_m -endian $_ENDIAN -dap $_CHIPNAME.dap
52 # use non-secure RAM by default
53 $_TARGETNAME configure -work-area-phys 0x20000000 -work-area-size $_WORKAREASIZE -work-area-backup 0
55 # create sec/ns flash and otp memories (sizes will be probed)
56 flash bank $_CHIPNAME.flash_ns stm32l4x 0x08000000 0 0 0 $_TARGETNAME
57 flash bank $_CHIPNAME.flash_alias_s stm32l4x 0x0C000000 0 0 0 $_TARGETNAME
58 flash bank $_CHIPNAME.otp stm32l4x 0x0BFA0000 0 0 0 $_TARGETNAME
60 # Common knowledges tells JTAG speed should be <= F_CPU/6.
61 # F_CPU after reset is MSI 4MHz, so use F_JTAG = 500 kHz to stay on
64 # Note that there is a pretty wide band where things are
65 # more or less stable, see http://openocd.zylin.com/#/c/3366/
68 adapter srst delay 100
73 reset_config srst_nogate
76 # if srst is not fitted use SYSRESETREQ to
77 # perform a soft reset
78 cortex_m reset_config sysresetreq
82 # read Debug Security Control and Status Regsiter (DSCSR) and check CDS (bit 16)
83 set DSCSR [mrw 0xE000EE08]
84 return [expr {($DSCSR & (1 << 16)) != 0}]
87 proc clock_config_160_mhz {} {
88 set offset [expr {[is_secure] ? 0x10000000 : 0}]
89 # MCU clock is at MSI 4MHz after reset, set MCU freq at 160 MHz with PLL
91 # Enable voltage range 1 for frequency above 100 Mhz
93 mww [expr {0x46020C94 + $offset}] 0x00000004
94 # delay for register clock enable (read back reg)
95 mrw [expr {0x56020C94 + $offset}]
96 # PWR_VOSR : VOS Range 1
97 mww [expr {0x4602080C + $offset}] 0x00030000
98 # delay for register write (read back reg)
99 mrw [expr {0x4602080C + $offset}]
100 # FLASH_ACR : 4 WS for 160 MHz HCLK
101 mww [expr {0x40022000 + $offset}] 0x00000004
102 # RCC_PLL1CFGR => PLL1M=0000=/1, PLL1SRC=MSI 4MHz
103 mww [expr {0x46020C28 + $offset}] 0x00000001
104 # RCC_PLL1DIVR => PLL1P=PLL1Q=PLL1R=000001=/2, PLL1N=0x4F=80
105 # fVCO = 4 x 80 /1 = 320
106 # SYSCLOCK = fVCO/PLL1R = 320/2 = 160 MHz
107 mmw [expr {0x46020C34 + $offset}] 0x0000004F 0
108 # RCC_PLL1CFGR => PLL1REN=1
109 mmw [expr {0x46020C28 + $offset}] 0x00040000 0
111 mmw [expr {0x46020C00 + $offset}] 0x01000000 0
112 # while !(RCC_CR & PLL1RDY)
113 while {!([mrw [expr {0x46020C00 + $offset}]] & 0x02000000)} {}
114 # RCC_CFGR1 |= SW_PLL
115 mmw [expr {0x46020C1C + $offset}] 0x00000003 0
116 # while ((RCC_CFGR1 & SWS) != PLL)
117 while {([mrw [expr {0x46020C1C + $offset}]] & 0x0C) != 0x0C} {}
120 proc ahb_ap_non_secure_access {} {
121 # SPROT=1=Non Secure access, Priv=1
122 [[target current] cget -dap] apcsw 0x4B000000 0x4F000000
125 proc ahb_ap_secure_access {} {
126 # SPROT=0=Secure access, Priv=1
127 [[target current] cget -dap] apcsw 0x0B000000 0x4F000000
130 $_TARGETNAME configure -event reset-init {
132 # Boost JTAG frequency
136 $_TARGETNAME configure -event reset-start {
137 # Reset clock is MSI (4 MHz)
141 $_TARGETNAME configure -event examine-end {
142 # DBGMCU_CR |= DBG_STANDBY | DBG_STOP
143 mmw 0xE0044004 0x00000006 0
145 # Stop watchdog counters during halt
146 # DBGMCU_APB1_FZ |= DBG_IWDG_STOP | DBG_WWDG_STOP
147 mmw 0xE0044008 0x00001800 0
150 $_TARGETNAME configure -event halted {
151 set secure [is_secure]
154 set secure_str "Secure"
157 set secure_str "Non-Secure"
158 ahb_ap_non_secure_access
161 # print the secure state only when it changes
162 set _TARGETNAME [target current]
163 global $_TARGETNAME.secure
165 if {![info exists $_TARGETNAME.secure] || $secure != [set $_TARGETNAME.secure]} {
166 echo "CPU in $secure_str state"
167 # update saved security state
168 set $_TARGETNAME.secure $secure
172 $_TARGETNAME configure -event gdb-flash-erase-start {
173 set use_secure_workarea 0
174 # check if FLASH_OPTR.TZEN is enabled
175 set FLASH_OPTR [mrw 0x40022040]
176 if {[expr {$FLASH_OPTR & 0x80000000}] == 0} {
177 echo "TZEN option bit disabled"
178 ahb_ap_non_secure_access
181 echo "TZEN option bit enabled"
183 # check if FLASH_OPTR.RDP is not Level 0.5
184 if {[expr {$FLASH_OPTR & 0xFF}] != 0x55} {
185 set use_secure_workarea 1
189 set _TARGETNAME [target current]
190 set workarea_addr [$_TARGETNAME cget -work-area-phys]
191 echo "workarea_addr $workarea_addr"
193 if {$use_secure_workarea} {
194 set workarea_addr [expr {$workarea_addr | 0x10000000}]
196 set workarea_addr [expr {$workarea_addr & ~0x10000000}]
199 $_TARGETNAME configure -work-area-phys $workarea_addr
202 $_TARGETNAME configure -event trace-config {
203 # Set TRACE_IOEN; TRACE_MODE is set to async; when using sync
204 # change this value accordingly to configure trace pins
206 mmw 0xE0044004 0x00000020 0