implement stm32h5 series, erase, read and write

config/chips/H5xx.chip

@@ -3,12 +3,13 @@
 dev_type STM32H5xx
 ref_manual_id 0481
 chip_id 0x484                // STM32_CHIPID_H5xx
-flash_type L5_U5_H5
+flash_type H5
 flash_size_reg 0x08fff80c
 flash_pagesize 0x2000        // 8 KB
 sram_size 0xa0000            // 640 KB
 bootrom_base 0x0bf80000
 bootrom_size 0x8000          // 32 KB
 option_base 0x0
 option_size 0x0
+target_ap 1
 flags dualbank

config/chips/L5x2xx.chip

@@ -3,7 +3,7 @@
 dev_type STM32L5x2xx
 ref_manual_id 0438
 chip_id 0x472                // STM32_CHIPID_L5x2xx
-flash_type L5_U5_H5
+flash_type L5_U5
 flash_size_reg 0x0bfa05e0
 flash_pagesize 0x1000        // 4 KB
 sram_size 0x40000            // 256 KB

config/chips/U535_U545.chip

@@ -3,7 +3,7 @@
 dev_type STM32U535_U545
 ref_manual_id 0456
 chip_id 0x455                // STM32_CHIPID_U535_545
-flash_type L5_U5_H5
+flash_type L5_U5
 flash_size_reg 0x0bfa07a0
 flash_pagesize 0x2000        // 8 KB
 sram_size 0x44800            // 274 KB

config/chips/U575_U585.chip

@@ -3,7 +3,7 @@
 dev_type STM32U575_U585
 ref_manual_id 0456
 chip_id 0x482                // STM32_CHIPID_U575_U585
-flash_type L5_U5_H5
+flash_type L5_U5
 flash_size_reg 0x0bfa07a0
 flash_pagesize 0x2000        // 8 KB
 sram_size 0xc4800            // 786 KB

config/chips/U59x_U5Ax.chip

@@ -3,7 +3,7 @@
 dev_type STM32U59x_U5Ax
 ref_manual_id 0456
 chip_id 0x481                // STM32_CHIPID_U59x_5Ax
-flash_type L5_U5_H5
+flash_type L5_U5
 flash_size_reg 0x0bfa07a0
 flash_pagesize 0x2000        // 8 KB
 sram_size 0x274800           // 2514 KB

config/chips/U5Fx_U5Gx.chip

@@ -3,7 +3,7 @@
 dev_type STM32U5Fx_U5Gx
 ref_manual_id 0456
 chip_id 0x476                // STM32_CHIPID_U5Fx5_5Gx
-flash_type L5_U5_H5
+flash_type L5_U5
 flash_size_reg 0x0bfa07a0
 flash_pagesize 0x2000        // 8 KB
 sram_size 0x2f4800           // 3026 KB

flashloaders/Makefile

@@ -11,8 +11,9 @@ XXDFLAGS = -i -c 4
 
 CFLAGS_ARMV6_M = -mcpu=Cortex-M0 -Tlinker.ld -ffreestanding -nostdlib
 CFLAGS_ARMV7_M = -mcpu=Cortex-M3 -Tlinker.ld -ffreestanding -nostdlib
+CFLAGS_ARMV8_M = -mcpu=Cortex-M33 -Tlinker.ld -ffreestanding -nostdlib
 
-all: stm32vl.h stm32f0.h stm32wb0.h stm32lx.h stm32f4.h stm32f4lv.h stm32l4.h stm32f7.h stm32f7lv.h
+all: stm32vl.h stm32f0.h stm32wb0.h stm32lx.h stm32f4.h stm32f4lv.h stm32l4.h stm32f7.h stm32f7lv.h stm32h5.h
 
 
 %.h: %.bin
@@ -43,5 +44,8 @@ stm32lx.o: stm32lx.s
 %.o: %.s
 	$(CC) $< $(CFLAGS_ARMV7_M) -o $@
 
+stm32h5.o: stm32h5.s
+	$(CC) stm32h5.s $(CFLAGS_ARMV8_M) -o stm32h5.o
+
 clean:
 	rm -f *.h

flashloaders/cleanroom.md

@@ -122,4 +122,32 @@ Copy one word each time. No wait for write.
 
 Copy one double word each time (More than one register is allowed).
 
-How to wait for the write process: read a half word from `FLASH_BSY`, loop until the busy bit is reset.
+How to wait for the write process: read a half word from `FLASH_BSY`, loop until the busy bit is reset.
+
+## stm32h5.s
+
+Bank 1 registers:
+
+`FLASH_NSSR`: 0x40022020
+
+`FLASH_NSCR`: 0x40022028
+
+`FLASH_NSCCR`: 0x40022030
+
+Bank 2 registers:
+
+`FLASH_NSSR`: 0x50022020
+
+`FLASH_NSCR`: 0x50022028
+
+`FLASH_NSCCR`: 0x50022030
+
+**Special Requirements**:
+
+Copy one quadword each time (16 bytes, four 32-bit words).
+
+Use `r3` to select the bank-specific flash register block. Clear sticky status
+once before starting, wait for `BSY`, `WBNE`, and `DBNE` to clear, then keep
+`PG` set for the whole chunk. The loader should accept an exact byte count and
+pad the last quadword with `0xFF` locally. Clear `PG` and the sticky status
+bits once on exit.

flashloaders/stm32h5.h

@@ -0,0 +1,56 @@
+unsigned char stm32h5_bin[] = {
+  0x00, 0x2b, 0x06, 0xd0,
+  0xdf, 0xf8, 0xb8, 0xc0,
+  0xdf, 0xf8, 0xb8, 0xb0,
+  0xdf, 0xf8, 0xb8, 0xa0,
+  0x05, 0xe0, 0xdf, 0xf8,
+  0xa0, 0xc0, 0xdf, 0xf8,
+  0xa0, 0xb0, 0xdf, 0xf8,
+  0xa0, 0xa0, 0xef, 0xf3,
+  0x10, 0x83, 0x72, 0xb6,
+  0x84, 0xb0, 0xdf, 0xf8,
+  0xa4, 0x90, 0xdf, 0xf8,
+  0xa4, 0x80, 0xca, 0xf8,
+  0x00, 0x90, 0xdc, 0xf8,
+  0x00, 0x40, 0x14, 0xf0,
+  0x0b, 0x0f, 0xfa, 0xd1,
+  0xdb, 0xf8, 0x00, 0x40,
+  0x44, 0xf0, 0x02, 0x04,
+  0xcb, 0xf8, 0x00, 0x40,
+  0x00, 0x2a, 0x26, 0xdd,
+  0x10, 0x2a, 0x01, 0xd3,
+  0xf0, 0xc8, 0x11, 0xe0,
+  0x6f, 0xf0, 0x00, 0x04,
+  0x00, 0x94, 0x01, 0x94,
+  0x02, 0x94, 0x03, 0x94,
+  0x6d, 0x46, 0x16, 0x46,
+  0x00, 0x2e, 0x05, 0xd0,
+  0x10, 0xf8, 0x01, 0x4b,
+  0x05, 0xf8, 0x01, 0x4b,
+  0x01, 0x3e, 0xf7, 0xe7,
+  0x9d, 0xe8, 0xf0, 0x00,
+  0xf0, 0xc1, 0xbf, 0xf3,
+  0x4f, 0x8f, 0xdc, 0xf8,
+  0x00, 0x40, 0x14, 0xf0,
+  0x0b, 0x0f, 0xfa, 0xd1,
+  0x14, 0xea, 0x08, 0x0f,
+  0x05, 0xd1, 0x10, 0x2a,
+  0x01, 0xd3, 0x10, 0x3a,
+  0xd8, 0xe7, 0x00, 0x22,
+  0xd6, 0xe7, 0x20, 0x46,
+  0xdb, 0xf8, 0x00, 0x40,
+  0x24, 0xf0, 0x02, 0x04,
+  0xcb, 0xf8, 0x00, 0x40,
+  0xca, 0xf8, 0x00, 0x90,
+  0x04, 0xb0, 0x83, 0xf3,
+  0x10, 0x88, 0x00, 0xbe,
+  0x20, 0x20, 0x02, 0x40,
+  0x28, 0x20, 0x02, 0x40,
+  0x30, 0x20, 0x02, 0x40,
+  0x20, 0x20, 0x02, 0x50,
+  0x28, 0x20, 0x02, 0x50,
+  0x30, 0x20, 0x02, 0x50,
+  0x00, 0x00, 0x9f, 0x00,
+  0x00, 0x00, 0x9e, 0x00
+};
+unsigned int stm32h5_bin_len = 212;

flashloaders/stm32h5.s

@@ -0,0 +1,133 @@
+    .syntax unified
+    .text
+
+    /*
+     * Arguments:
+     *   r0 - source SRAM ptr
+     *   r1 - target flash ptr
+     *   r2 - exact count of bytes to program
+     *   r3 - flash bank selector (0 = bank 1, 1 = bank 2)
+     *
+     * Return:
+     *   r0 - last observed NSSR value
+     *   r2 - remaining bytes (0 on success)
+     */
+
+    .global copy
+copy:
+    cmp r3, #0
+    beq bank1
+
+bank2:
+    ldr r12, flash_bank2_nssr
+    ldr r11, flash_bank2_nscr
+    ldr r10, flash_bank2_nsccr
+    b prepare
+
+bank1:
+    ldr r12, flash_bank1_nssr
+    ldr r11, flash_bank1_nscr
+    ldr r10, flash_bank1_nsccr
+
+prepare:
+    mrs r3, primask
+    cpsid i
+    sub sp, sp, #16
+    ldr r9, flash_clear_mask
+    ldr r8, flash_error_mask
+    str r9, [r10]
+
+wait_ready:
+    ldr r4, [r12]
+
+    # wait until BSY, WBNE and DBNE are all clear
+    tst r4, #0xb
+    bne wait_ready
+
+    # keep PG set for the full chunk write
+    ldr r4, [r11]
+    orr r4, r4, #0x2
+    str r4, [r11]
+
+loop:
+    cmp r2, #0
+    ble exit
+
+    cmp r2, #16
+    blo tail
+
+    # copy one quadword as four consecutive 32-bit writes
+    ldmia r0!, {r4-r7}
+    b program_quad
+
+tail:
+    mvn r4, #0
+    str r4, [sp, #0]
+    str r4, [sp, #4]
+    str r4, [sp, #8]
+    str r4, [sp, #12]
+    mov r5, sp
+    mov r6, r2
+
+tail_copy:
+    cmp r6, #0
+    beq tail_load
+    ldrb r4, [r0], #1
+    strb r4, [r5], #1
+    subs r6, r6, #1
+    b tail_copy
+
+tail_load:
+    ldmia sp, {r4-r7}
+
+program_quad:
+    stmia r1!, {r4-r7}
+    dsb sy
+
+wait:
+    ldr r4, [r12]
+
+    # wait until BSY, WBNE and DBNE are all clear
+    tst r4, #0xb
+    bne wait
+
+    # stop early and leave r2 pointing at the first unwritten quadword
+    tst r4, r8
+    bne exit
+
+    cmp r2, #16
+    blo tail_done
+    subs r2, r2, #16
+    b loop
+
+tail_done:
+    movs r2, #0
+    b loop
+
+exit:
+    mov r0, r4
+    ldr r4, [r11]
+    bic r4, r4, #0x2
+    str r4, [r11]
+    str r9, [r10]
+    add sp, sp, #16
+    msr primask, r3
+    bkpt
+
+    .align 2
+flash_bank1_nssr:
+    .word 0x40022020
+flash_bank1_nscr:
+    .word 0x40022028
+flash_bank1_nsccr:
+    .word 0x40022030
+flash_bank2_nssr:
+    .word 0x50022020
+flash_bank2_nscr:
+    .word 0x50022028
+flash_bank2_nsccr:
+    .word 0x50022030
+flash_clear_mask:
+    .word 0x009f0000
+flash_error_mask:
+    .word 0x009e0000

inc/stlink.h

@@ -79,7 +79,6 @@ enum target_state {
 #define STLINK_F_HAS_JTAG_SET_FREQ      (1 << 2)
 #define STLINK_F_HAS_MEM_16BIT          (1 << 3)
 #define STLINK_F_HAS_GETLASTRWSTATUS2   (1 << 4)
-#define STLINK_F_HAS_DAP_REG            (1 << 5)
 #define STLINK_F_QUIRK_JTAG_DP_READ     (1 << 6)
 #define STLINK_F_HAS_AP_INIT            (1 << 7)
 #define STLINK_F_HAS_DPBANKSEL          (1 << 8)
@@ -222,6 +221,11 @@ struct _stlink {
     /* option settings */
     stm32_addr_t option_base;
     uint32_t option_size;
+    uint8_t target_ap;
+    bool target_ap_inited;
+    bool h5_ap1_mode;
+    bool h5_native_debug_regs;
+    bool h5_native_core_regs;
 
     // bootloader
     // sys_base and sys_size are not used by the tools, but are only there to download the bootloader code
@@ -239,6 +243,20 @@ struct _stlink {
     uint32_t otp_size;
 };
 
+static inline bool stlink_target_uses_ap(const stlink_t *sl) {
+    return sl->target_ap != 0;
+}
+
+static inline bool stlink_h5_uses_ap(const stlink_t *sl) {
+    return sl->chip_id == STM32_CHIPID_H5xx && stlink_target_uses_ap(sl);
+}
+
+static inline void stlink_invalidate_ap_session(stlink_t *sl) {
+    if(stlink_target_uses_ap(sl)) {
+        sl->target_ap_inited = false;
+    }
+}
+
 
 /* === Declaration of functions defined in common_legacy.c === */
 

inc/stlink_cmd.h

@@ -59,6 +59,7 @@ enum stlink_debug_commands {
     STLINK_DEBUG_APIV2_STOP_TRACE_RX     = 0x41,
     STLINK_DEBUG_APIV2_GET_TRACE_NB      = 0x42,
     STLINK_DEBUG_APIV2_SWD_SET_FREQ      = 0x43,
+    STLINK_DEBUG_APIV2_INIT_AP           = 0x4B,
 
     STLINK_DEBUG_APIV3_SET_COM_FREQ      = 0x61,
     STLINK_DEBUG_APIV3_GET_COM_FREQ      = 0x62,

inc/stm32.h

@@ -61,9 +61,10 @@ enum stm32_flash_type {
     STM32_FLASH_TYPE_H7        =  8,
     STM32_FLASH_TYPE_L0_L1     =  9,
     STM32_FLASH_TYPE_L4        = 10,
-    STM32_FLASH_TYPE_L5_U5_H5  = 11,
+    STM32_FLASH_TYPE_L5_U5     = 11,
     STM32_FLASH_TYPE_WB_WL     = 12,
     STM32_FLASH_TYPE_WB0       = 13,
+    STM32_FLASH_TYPE_H5        = 14,
 };
 
 /* STM32 chip-ids */
@@ -203,6 +204,10 @@ enum stm32_chipids {
 #define STM32H7_DBGMCU_APB1HFZ 0x5C001054
 #define STM32H7_DBGMCU_APB1HFZ_IWDG_STOP 18
 
+#define STM32H5_DBGMCU_APB1FZR1 0x44024008
+#define STM32H5_DBGMCU_APB1FZR1_WWDG_STOP 11
+#define STM32H5_DBGMCU_APB1FZR1_IWDG_STOP 12
+
 #define STM32WB_DBGMCU_APB1FZR1 0xE004203C
 #define STM32WB_DBGMCU_APB1FZR1_WWDG_STOP 11
 #define STM32WB_DBGMCU_APB1FZR1_IWDG_STOP 12