1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
|
# script for stm32f7x family
#
# stm32f7 devices support both JTAG and SWD transports.
#
source [find target/swj-dp.tcl]
source [find mem_helper.tcl]
if { [info exists CHIPNAME] } {
set _CHIPNAME $CHIPNAME
} else {
set _CHIPNAME stm32f7x
}
set _ENDIAN little
# Work-area is a space in RAM used for flash programming
# By default use 128kB
if { [info exists WORKAREASIZE] } {
set _WORKAREASIZE $WORKAREASIZE
} else {
set _WORKAREASIZE 0x20000
}
#jtag scan chain
if { [info exists CPUTAPID] } {
set _CPUTAPID $CPUTAPID
} else {
if { [using_jtag] } {
# See STM Document RM0385
# Section 40.6.3 - corresponds to Cortex-M7 with FPU r0p0
set _CPUTAPID 0x5ba00477
} {
set _CPUTAPID 0x5ba02477
}
}
swj_newdap $_CHIPNAME cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id $_CPUTAPID
dap create $_CHIPNAME.dap -chain-position $_CHIPNAME.cpu
if {[using_jtag]} {
jtag newtap $_CHIPNAME bs -irlen 5
}
set _TARGETNAME $_CHIPNAME.cpu
target create $_TARGETNAME cortex_m -endian $_ENDIAN -dap $_CHIPNAME.dap
$_TARGETNAME configure -work-area-phys 0x20000000 -work-area-size $_WORKAREASIZE -work-area-backup 0
set _FLASHNAME $_CHIPNAME.flash
flash bank $_FLASHNAME stm32f2x 0 0 0 0 $_TARGETNAME
flash bank $_CHIPNAME.otp stm32f2x 0x1ff0f000 0 0 0 $_TARGETNAME
# On the STM32F7, the Flash is mapped at address 0x08000000 via the AXI and
# also address 0x00200000 via the ITCM. The former mapping is read-write in
# hardware, while the latter is read-only. By presenting an alias, we
# accomplish two things:
# (1) We allow writing at 0x00200000 (because the alias acts identically to the
# original bank), which allows code intended to run from that address to
# also be linked for loading at that address, simplifying linking.
# (2) We allow the proper memory map to be delivered to GDB, which will cause
# it to use hardware breakpoints at the 0x00200000 mapping (correctly
# identifying it as Flash), which it would otherwise not do. Configuring
# the Flash via ITCM alias as virtual
flash bank $_CHIPNAME.itcm-flash.alias virtual 0x00200000 0 0 0 $_TARGETNAME $_FLASHNAME
# adapter speed should be <= F_CPU/6. F_CPU after reset is 16MHz, so use F_JTAG = 2MHz
adapter speed 2000
adapter srst delay 100
if {[using_jtag]} {
jtag_ntrst_delay 100
}
# Use hardware reset.
#
# This target is compatible with connect_assert_srst, which may be set in a
# board file.
reset_config srst_only srst_nogate
if {![using_hla]} {
# if srst is not fitted use SYSRESETREQ to
# perform a soft reset
cortex_m reset_config sysresetreq
# Set CSW[27], which according to ARM ADI v5 appendix E1.4 maps to AHB signal
# HPROT[3], which according to AMBA AHB/ASB/APB specification chapter 3.7.3
# makes the data access cacheable. This allows reading and writing data in the
# CPU cache from the debugger, which is far more useful than going straight to
# RAM when operating on typical variables, and is generally no worse when
# operating on special memory locations.
$_CHIPNAME.dap apcsw 0x08000000 0x08000000
}
$_TARGETNAME configure -event examine-end {
# DBGMCU_CR |= DBG_STANDBY | DBG_STOP | DBG_SLEEP
mmw 0xE0042004 0x00000007 0
# Stop watchdog counters during halt
# DBGMCU_APB1_FZ |= DBG_IWDG_STOP | DBG_WWDG_STOP
mmw 0xE0042008 0x00001800 0
}
$_TARGETNAME configure -event trace-config {
# Set TRACE_IOEN; TRACE_MODE is set to async; when using sync
# change this value accordingly to configure trace pins
# assignment
mmw 0xE0042004 0x00000020 0
}
$_TARGETNAME configure -event reset-init {
# If the HSE was previously enabled and the external clock source
# disappeared, RCC_CR.HSERDY can get stuck at 1 and the PLL cannot be
# properly switched back to HSI. This situation persists even over a system
# reset, including a pin reset via SRST. However, activating the clock
# security system will detect the problem and clear HSERDY to 0, which in
# turn allows the PLL to switch back to HSI properly. Since we just came
# out of reset, HSEON should be 0. If HSERDY is 1, then this situation must
# have happened; in that case, activate the clock security system to clear
# HSERDY.
if {[mrw 0x40023800] & 0x00020000} {
mmw 0x40023800 0x00090000 0 ;# RCC_CR = CSSON | HSEON
sleep 10 ;# Wait for CSS to fire, if it wants to
mmw 0x40023800 0 0x00090000 ;# RCC_CR &= ~CSSON & ~HSEON
mww 0x4002380C 0x00800000 ;# RCC_CIR = CSSC
sleep 1 ;# Wait for CSSF to clear
}
# If the clock security system fired, it will pend an NMI. A pending NMI
# will cause a bad time for any subsequent executing code, such as a
# programming algorithm.
if {[mrw 0xE000ED04] & 0x80000000} {
# ICSR.NMIPENDSET reads as 1. Need to clear it. A pending NMI can’t be
# cleared by any normal means (such as ICSR or NVIC). It can only be
# cleared by entering the NMI handler or by resetting the processor.
echo "[target current]: Clock security system generated NMI. Clearing."
# Keep the old DEMCR value.
set old [mrw 0xE000EDFC]
# Enable vector catch on reset.
mww 0xE000EDFC 0x01000001
# Issue local reset via AIRCR.
mww 0xE000ED0C 0x05FA0001
# Restore old DEMCR value.
mww 0xE000EDFC $old
}
# Configure PLL to boost clock to HSI x 10 (160 MHz)
mww 0x40023804 0x08002808 ;# RCC_PLLCFGR 16 Mhz /10 (M) * 128 (N) /2(P)
mww 0x40023C00 0x00000107 ;# FLASH_ACR = PRFTBE | 7(Latency)
mmw 0x40023800 0x01000000 0 ;# RCC_CR |= PLLON
sleep 10 ;# Wait for PLL to lock
mww 0x40023808 0x00009400 ;# RCC_CFGR_PPRE1 = 5(div 4), PPRE2 = 4(div 2)
mmw 0x40023808 0x00000002 0 ;# RCC_CFGR |= RCC_CFGR_SW_PLL
# Boost SWD frequency
# Do not boost JTAG frequency and slow down JTAG memory access or flash write algo
# suffers from DAP WAITs
if {[using_jtag]} {
[[target current] cget -dap] memaccess 16
} {
adapter speed 8000
}
}
$_TARGETNAME configure -event reset-start {
# Reduce speed since CPU speed will slow down to 16MHz with the reset
adapter speed 2000
}
|
