tcl/target/stm32u5x.cfg

   1 # SPDX-License-Identifier: GPL-2.0-or-later
   2
   3 # script for stm32u5x family
   4
   5 #
   6 # stm32u5 devices support both JTAG and SWD transports.
   7 #
   8 source [find target/swj-dp.tcl]
   9 source [find mem_helper.tcl]
  10
  11 if { [info exists CHIPNAME] } {
  12         set _CHIPNAME $CHIPNAME
  13 } else {
  14         set _CHIPNAME stm32u5x
  15 }
  16
  17 set _ENDIAN little
  18
  19 # Work-area is a space in RAM used for flash programming
  20 # By default use 64kB
  21 if { [info exists WORKAREASIZE] } {
  22         set _WORKAREASIZE $WORKAREASIZE
  23 } else {
  24         set _WORKAREASIZE 0x10000
  25 }
  26
  27 #jtag scan chain
  28 if { [info exists CPUTAPID] } {
  29         set _CPUTAPID $CPUTAPID
  30 } else {
  31         if { [using_jtag] } {
  32                 # See STM Document RM0438
  33                 # RM0456 Rev1, Section 65.2.8 JTAG debug port - Table 661. JTAG-DP data registers
  34                 # Corresponds to Cortex®-M33 JTAG debug port ID code
  35                 set _CPUTAPID 0x0ba04477
  36         } {
  37                 # SWD IDCODE (single drop, arm)
  38                 set _CPUTAPID 0x0be12477
  39         }
  40 }
  41
  42 swj_newdap $_CHIPNAME cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id $_CPUTAPID
  43 dap create $_CHIPNAME.dap -chain-position $_CHIPNAME.cpu
  44
  45 if {[using_jtag]} {
  46         jtag newtap $_CHIPNAME bs -irlen 5
  47 }
  48
  49 set _TARGETNAME $_CHIPNAME.cpu
  50 target create $_TARGETNAME cortex_m -endian $_ENDIAN -dap $_CHIPNAME.dap
  51
  52 # use non-secure RAM by default
  53 $_TARGETNAME configure -work-area-phys 0x20000000 -work-area-size $_WORKAREASIZE -work-area-backup 0
  54
  55 # create sec/ns flash and otp memories (sizes will be probed)
  56 flash bank $_CHIPNAME.flash_ns      stm32l4x 0x08000000 0 0 0 $_TARGETNAME
  57 flash bank $_CHIPNAME.flash_alias_s stm32l4x 0x0C000000 0 0 0 $_TARGETNAME
  58 flash bank $_CHIPNAME.otp           stm32l4x 0x0BFA0000 0 0 0 $_TARGETNAME
  59
  60 # Common knowledges tells JTAG speed should be <= F_CPU/6.
  61 # F_CPU after reset is MSI 4MHz, so use F_JTAG = 500 kHz to stay on
  62 # the safe side.
  63 #
  64 # Note that there is a pretty wide band where things are
  65 # more or less stable, see http://openocd.zylin.com/#/c/3366/
  66 adapter speed 500
  67
  68 adapter srst delay 100
  69 if {[using_jtag]} {
  70         jtag_ntrst_delay 100
  71 }
  72
  73 reset_config srst_nogate
  74
  75 if {![using_hla]} {
  76         # if srst is not fitted use SYSRESETREQ to
  77         # perform a soft reset
  78         cortex_m reset_config sysresetreq
  79 }
  80
  81 proc is_secure {} {
  82         # read Debug Security Control and Status Regsiter (DSCSR) and check CDS (bit 16)
  83         set DSCSR [mrw 0xE000EE08]
  84         return [expr {($DSCSR & (1 << 16)) != 0}]
  85 }
  86
  87 proc clock_config_160_mhz {} {
  88         set offset [expr {[is_secure] ? 0x10000000 : 0}]
  89         # MCU clock is at MSI 4MHz after reset, set MCU freq at 160 MHz with PLL
  90
  91         # Enable voltage range 1 for frequency above 100 Mhz
  92         # RCC_AHB3ENR = PWREN
  93         mww [expr {0x46020C94 + $offset}] 0x00000004
  94         # delay for register clock enable (read back reg)
  95         mrw [expr {0x56020C94 + $offset}]
  96         # PWR_VOSR : VOS Range 1
  97         mww [expr {0x4602080C + $offset}] 0x00030000
  98         # delay for register write (read back reg)
  99         mrw [expr {0x4602080C + $offset}]
 100         # FLASH_ACR : 4 WS for 160 MHz HCLK
 101         mww [expr {0x40022000 + $offset}] 0x00000004
 102         # RCC_PLL1CFGR => PLL1M=0000=/1, PLL1SRC=MSI 4MHz
 103         mww [expr {0x46020C28 + $offset}] 0x00000001
 104         # RCC_PLL1DIVR => PLL1P=PLL1Q=PLL1R=000001=/2, PLL1N=0x4F=80
 105         # fVCO = 4 x 80 /1 = 320
 106         # SYSCLOCK = fVCO/PLL1R = 320/2 = 160 MHz
 107         mmw [expr {0x46020C34 + $offset}] 0x0000004F 0
 108         # RCC_PLL1CFGR => PLL1REN=1
 109         mmw [expr {0x46020C28 + $offset}] 0x00040000 0
 110         # RCC_CR |= PLL1ON
 111         mmw [expr {0x46020C00 + $offset}] 0x01000000 0
 112         # while !(RCC_CR & PLL1RDY)
 113         while {!([mrw [expr {0x46020C00 + $offset}]] & 0x02000000)} {}
 114         # RCC_CFGR1 |= SW_PLL
 115         mmw [expr {0x46020C1C + $offset}] 0x00000003 0
 116         # while ((RCC_CFGR1 & SWS) != PLL)
 117         while {([mrw [expr {0x46020C1C + $offset}]] & 0x0C) != 0x0C} {}
 118 }
 119
 120 proc ahb_ap_non_secure_access {} {
 121         # SPROT=1=Non Secure access, Priv=1
 122         [[target current] cget -dap] apcsw 0x4B000000 0x4F000000
 123 }
 124
 125 proc ahb_ap_secure_access {} {
 126         # SPROT=0=Secure access, Priv=1
 127         [[target current] cget -dap] apcsw 0x0B000000 0x4F000000
 128 }
 129
 130 $_TARGETNAME configure -event reset-init {
 131         clock_config_160_mhz
 132         # Boost JTAG frequency
 133         adapter speed 4000
 134 }
 135
 136 $_TARGETNAME configure -event reset-start {
 137         # Reset clock is MSI (4 MHz)
 138         adapter speed 480
 139 }
 140
 141 $_TARGETNAME configure -event examine-end {
 142         # DBGMCU_CR |= DBG_STANDBY | DBG_STOP
 143         mmw 0xE0044004 0x00000006 0
 144
 145         # Stop watchdog counters during halt
 146         # DBGMCU_APB1_FZ |= DBG_IWDG_STOP | DBG_WWDG_STOP
 147         mmw 0xE0044008 0x00001800 0
 148 }
 149
 150 $_TARGETNAME configure -event halted {
 151         set secure [is_secure]
 152
 153         if {$secure} {
 154                 set secure_str "Secure"
 155                 ahb_ap_secure_access
 156         } else {
 157                 set secure_str "Non-Secure"
 158                 ahb_ap_non_secure_access
 159         }
 160
 161         # print the secure state only when it changes
 162         set _TARGETNAME [target current]
 163         global $_TARGETNAME.secure
 164
 165         if {![info exists $_TARGETNAME.secure] || $secure != [set $_TARGETNAME.secure]} {
 166                 echo "CPU in $secure_str state"
 167                 # update saved security state
 168                 set $_TARGETNAME.secure $secure
 169         }
 170 }
 171
 172 $_TARGETNAME configure -event gdb-flash-erase-start {
 173         set use_secure_workarea 0
 174         # check if FLASH_OPTR.TZEN is enabled
 175         set FLASH_OPTR [mrw 0x40022040]
 176         if {[expr {$FLASH_OPTR & 0x80000000}] == 0} {
 177                 echo "TZEN option bit disabled"
 178                 ahb_ap_non_secure_access
 179         } else {
 180                 ahb_ap_secure_access
 181                 echo "TZEN option bit enabled"
 182
 183                 # check if FLASH_OPTR.RDP is not Level 0.5
 184                 if {[expr {$FLASH_OPTR & 0xFF}] != 0x55} {
 185                         set use_secure_workarea 1
 186                 }
 187         }
 188
 189         set _TARGETNAME [target current]
 190         set workarea_addr [$_TARGETNAME cget -work-area-phys]
 191         echo "workarea_addr $workarea_addr"
 192
 193         if {$use_secure_workarea} {
 194                 set workarea_addr [expr {$workarea_addr | 0x10000000}]
 195         } else {
 196                 set workarea_addr [expr {$workarea_addr & ~0x10000000}]
 197         }
 198
 199         $_TARGETNAME configure -work-area-phys $workarea_addr
 200 }
 201
 202 $_TARGETNAME configure -event trace-config {
 203         # Set TRACE_IOEN; TRACE_MODE is set to async; when using sync
 204         # change this value accordingly to configure trace pins
 205         # assignment
 206         mmw 0xE0044004 0x00000020 0
 207 }