riscv-openocd/tcl/target/stm32f7x.cfg

# script for stm32f7x family

#
# stm32f7 devices support both JTAG and SWD transports.
#
source [find target/swj-dp.tcl]
source [find mem_helper.tcl]

if { [info exists CHIPNAME] } {
   set _CHIPNAME $CHIPNAME
} else {
   set _CHIPNAME stm32f7x
}

   set _ENDIAN little

# Work-area is a space in RAM used for flash programming
# By default use 128kB
if { [info exists WORKAREASIZE] } {
   set _WORKAREASIZE $WORKAREASIZE
} else {
   set _WORKAREASIZE 0x20000
}

#jtag scan chain
if { [info exists CPUTAPID] } {
   set _CPUTAPID $CPUTAPID
} else {
   if { [using_jtag] } {
      # See STM Document RM0385
      # Section 40.6.3 - corresponds to Cortex-M7 with FPU r0p0
      set _CPUTAPID 0x5ba00477
   } {
      set _CPUTAPID 0x5ba02477
   }
}

swj_newdap $_CHIPNAME cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id $_CPUTAPID
dap create $_CHIPNAME.dap -chain-position $_CHIPNAME.cpu

if {[using_jtag]} {
   jtag newtap $_CHIPNAME bs -irlen 5
}

set _TARGETNAME $_CHIPNAME.cpu
target create $_TARGETNAME cortex_m -endian $_ENDIAN -dap $_CHIPNAME.dap

$_TARGETNAME configure -work-area-phys 0x20000000 -work-area-size $_WORKAREASIZE -work-area-backup 0

set _FLASHNAME $_CHIPNAME.flash
flash bank $_FLASHNAME stm32f2x 0 0 0 0 $_TARGETNAME
flash bank $_CHIPNAME.otp stm32f2x 0x1ff0f000 0 0 0 $_TARGETNAME

# On the STM32F7, the Flash is mapped at address 0x08000000 via the AXI and
# also address 0x00200000 via the ITCM. The former mapping is read-write in
# hardware, while the latter is read-only. By presenting an alias, we
# accomplish two things:
# (1) We allow writing at 0x00200000 (because the alias acts identically to the
#     original bank), which allows code intended to run from that address to
#     also be linked for loading at that address, simplifying linking.
# (2) We allow the proper memory map to be delivered to GDB, which will cause
#     it to use hardware breakpoints at the 0x00200000 mapping (correctly
#     identifying it as Flash), which it would otherwise not do. Configuring
#     the Flash via ITCM alias as virtual
flash bank $_CHIPNAME.itcm-flash.alias virtual 0x00200000 0 0 0 $_TARGETNAME $_FLASHNAME

# adapter speed should be <= F_CPU/6. F_CPU after reset is 16MHz, so use F_JTAG = 2MHz
adapter speed 2000

adapter srst delay 100
if {[using_jtag]} {
 jtag_ntrst_delay 100
}

# Use hardware reset.
#
# This target is compatible with connect_assert_srst, which may be set in a
# board file.
reset_config srst_only srst_nogate

if {![using_hla]} {
   # if srst is not fitted use SYSRESETREQ to
   # perform a soft reset
   cortex_m reset_config sysresetreq

   # Set CSW[27], which according to ARM ADI v5 appendix E1.4 maps to AHB signal
   # HPROT[3], which according to AMBA AHB/ASB/APB specification chapter 3.7.3
   # makes the data access cacheable. This allows reading and writing data in the
   # CPU cache from the debugger, which is far more useful than going straight to
   # RAM when operating on typical variables, and is generally no worse when
   # operating on special memory locations.
   $_CHIPNAME.dap apcsw 0x08000000 0x08000000
}

$_TARGETNAME configure -event examine-end {
	# DBGMCU_CR |= DBG_STANDBY | DBG_STOP | DBG_SLEEP
	mmw 0xE0042004 0x00000007 0

	# Stop watchdog counters during halt
	# DBGMCU_APB1_FZ |= DBG_IWDG_STOP | DBG_WWDG_STOP
	mmw 0xE0042008 0x00001800 0
}

$_TARGETNAME configure -event trace-config {
	# Set TRACE_IOEN; TRACE_MODE is set to async; when using sync
	# change this value accordingly to configure trace pins
	# assignment
	mmw 0xE0042004 0x00000020 0
}

$_TARGETNAME configure -event reset-init {
	# If the HSE was previously enabled and the external clock source
	# disappeared, RCC_CR.HSERDY can get stuck at 1 and the PLL cannot be
	# properly switched back to HSI. This situation persists even over a system
	# reset, including a pin reset via SRST. However, activating the clock
	# security system will detect the problem and clear HSERDY to 0, which in
	# turn allows the PLL to switch back to HSI properly. Since we just came
	# out of reset, HSEON should be 0. If HSERDY is 1, then this situation must
	# have happened; in that case, activate the clock security system to clear
	# HSERDY.
	if {[mrw 0x40023800] & 0x00020000} {
		mmw 0x40023800 0x00090000 0 ;# RCC_CR = CSSON | HSEON
		sleep 10                    ;# Wait for CSS to fire, if it wants to
		mmw 0x40023800 0 0x00090000 ;# RCC_CR &= ~CSSON & ~HSEON
		mww 0x4002380C 0x00800000   ;# RCC_CIR = CSSC
		sleep 1                     ;# Wait for CSSF to clear
	}

	# If the clock security system fired, it will pend an NMI. A pending NMI
	# will cause a bad time for any subsequent executing code, such as a
	# programming algorithm.
	if {[mrw 0xE000ED04] & 0x80000000} {
		# ICSR.NMIPENDSET reads as 1. Need to clear it. A pending NMI can’t be
		# cleared by any normal means (such as ICSR or NVIC). It can only be
		# cleared by entering the NMI handler or by resetting the processor.
		echo "[target current]: Clock security system generated NMI. Clearing."

		# Keep the old DEMCR value.
		set old [mrw 0xE000EDFC]

		# Enable vector catch on reset.
		mww 0xE000EDFC 0x01000001

		# Issue local reset via AIRCR.
		mww 0xE000ED0C 0x05FA0001

		# Restore old DEMCR value.
		mww 0xE000EDFC $old
	}

	# Configure PLL to boost clock to HSI x 10 (160 MHz)
	mww 0x40023804 0x08002808   ;# RCC_PLLCFGR 16 Mhz /10 (M) * 128 (N) /2(P)
	mww 0x40023C00 0x00000107   ;# FLASH_ACR = PRFTBE | 7(Latency)
	mmw 0x40023800 0x01000000 0 ;# RCC_CR |= PLLON
	sleep 10                    ;# Wait for PLL to lock
	mww 0x40023808 0x00009400   ;# RCC_CFGR_PPRE1 = 5(div 4), PPRE2 = 4(div 2)
	mmw 0x40023808 0x00000002 0 ;# RCC_CFGR |= RCC_CFGR_SW_PLL

	# Boost SWD frequency
	# Do not boost JTAG frequency and slow down JTAG memory access or flash write algo
	# suffers from DAP WAITs
	if {[using_jtag]} {
		[[target current] cget -dap] memaccess 16
	} {
		adapter speed 8000
	}
}

$_TARGETNAME configure -event reset-start {
	# Reduce speed since CPU speed will slow down to 16MHz with the reset
	adapter speed 2000
}