feat: verify assembly bootloader factory recovery

This commit is contained in:
十七
2026-11-05 21:17:16 +08:00
parent 72393b6ef7
commit 12f6bb62f2
7 changed files with 892 additions and 38 deletions
+33
View File
@@ -0,0 +1,33 @@
# W25Q80BV SPI 独立测试工程。
# 本工程直接从0x8000启动,不依赖Bootloader和正式主程序。
PROJECT := stm8_spi_test
BUILD_DIR := build
AS := sdasstm8
LD := sdldstm8
PACKIHX := packihx
ASMFLAGS := -plosgff
LINKFLAGS := -mjwxu -b HOME=0x8000 -b CODE=0x8068
OBJECT := $(BUILD_DIR)/spi_test.rel
IHX := $(BUILD_DIR)/$(PROJECT).ihx
HEX := $(BUILD_DIR)/$(PROJECT).hex
.PHONY: all clean
all: $(HEX)
$(BUILD_DIR):
mkdir -p $(BUILD_DIR)
$(OBJECT): src/spi_test.asm | $(BUILD_DIR)
$(AS) $(ASMFLAGS) -o $@ $<
$(IHX): $(OBJECT)
$(LD) $(LINKFLAGS) -i $@ $^
$(HEX): $(IHX)
$(PACKIHX) $< > $@
clean:
rm -rf $(BUILD_DIR)
+675
View File
@@ -0,0 +1,675 @@
;-------------------------------------------------------------------------------
; STM8S003F3P6TR - W25Q80BV SPI独立读写测试固件
;
; 测试目的:
; 1. 读取W25Q80BV JEDEC ID;
; 2. 擦除一个专用测试扇区;
; 3. 写入固定测试数据;
; 4. 读回并逐字节比较。
;
; 硬件连接:
; PC5 -> W25Q80BV CLK
; PC6 -> W25Q80BV DI/MOSI
; PC7 <- W25Q80BV DO/MISO
; PD4 -> W25Q80BV CS#
; PB5 -> 测试LED
;
; 测试区域:外部Flash 0x01F000所在的4KB扇区。
; 该区域位于预留空间,不会覆盖出厂固件、出厂元数据、OTA固件和OTA元数据。
;
; LED结果指示:
; 测试成功:PB5约每500ms翻转一次;
; 测试失败:PB5约每100ms翻转一次。
;
; 注意:本固件会擦除并写入外部Flash 0x01F000所在扇区,测试前请确认该扇区
; 没有保存需要保留的数据。
;-------------------------------------------------------------------------------
.module spi_test
.optsdcc -mstm8
.area HOME (ABS)
int _Reset
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
int _DefaultInterrupt
.area CODE
_Reset:
sim
ldw x, #0x03FF
ldw sp, x
; HSI/1,系统主频16MHz。
mov 0x50C6, #0x00
; PB5推挽输出,初始低电平。
bres 0x5005, #5
bset 0x5007, #5
bset 0x5008, #5
bres 0x5009, #5
call _UART_Init
ldw x, #_TextStart
call _UART_SendText
call _SPI_Init
mov 0x0003, #0x01
call _SPI_CheckJedec
tnz a
jrne _TestFail
ldw x, #_TextJedecOK
call _UART_SendText
mov 0x0003, #0x05
call _ReadFactoryImageInfo
tnz a
jrne _TestFail
ldw x, #_TextFactoryPass
call _UART_SendText
_TestPass:
; A=0表示通过,使用长周期指示。
ld a, #0x00
ld 0x0000, a
ldw x, #500
jra _BlinkLoop
_TestFail:
ld a, 0x0003
cp a, #0x01
jreq _ReportJedecFail
cp a, #0x02
jreq _ReportEraseFail
cp a, #0x03
jreq _ReportWriteFail
cp a, #0x05
jreq _ReportFactoryFail
ldw x, #_TextVerifyFail
call _UART_SendText
jra _TestFailLed
_ReportJedecFail:
ldw x, #_TextJedecFail
call _UART_SendText
jra _TestFailLed
_ReportEraseFail:
ldw x, #_TextEraseFail
call _UART_SendText
jra _TestFailLed
_ReportWriteFail:
ldw x, #_TextWriteFail
call _UART_SendText
jra _TestFailLed
_ReportFactoryFail:
ldw x, #_TextFactoryFail
call _UART_SendText
_TestFailLed:
; 0x0003保存失败阶段,进入分组闪烁指示,避免只能知道“失败”而不知道
; 失败发生在JEDEC、擦除、写入还是回读校验阶段。
ld a, 0x0003
ld 0x0004, a
ldw x, #100
call _DelayMsApprox
; 每组开始前先熄灭LED约1秒,作为组间分隔。
bset 0x5005, #5
ldw x, #1000
call _DelayMsApprox
_ErrorGroup:
; 每次点亮约100ms,再熄灭约100ms。
bres 0x5005, #5
ldw x, #100
call _DelayMsApprox
bset 0x5005, #5
ldw x, #100
call _DelayMsApprox
dec 0x0004
jrne _ErrorGroup
; 一组错误码结束后暂停约1秒,然后重复指示。
ldw x, #1000
call _DelayMsApprox
ld a, 0x0003
ld 0x0004, a
jra _ErrorGroup
_BlinkLoop:
call _DelayMsApprox
bcpl 0x5005, #5
ldw x, #500
ld a, 0x0000
tnz a
jrne _FailDelaySelect
jra _BlinkLoop
_FailDelaySelect:
ldw x, #100
jra _BlinkLoop
;-------------------------------------------------------------------------------
; SPI1初始化:PC5/PC6推挽输出,PC7输入;PD4为软件片选。
; SPI模式0,主机模式,约500kHz,MSB first。
;-------------------------------------------------------------------------------
_SPI_Init:
mov 0x500C, #0x60
mov 0x500D, #0x60
mov 0x500E, #0x00
mov 0x500F, #0x10
mov 0x5011, #0x10
mov 0x5012, #0x10
mov 0x5013, #0x00
bset 0x500F, #4
mov 0x5200, #0x4C
mov 0x5201, #0x03
ret
;-------------------------------------------------------------------------------
; UART1初始化,PD5为TX,PD6为RX,16MHz系统时钟下配置为9600bps。
; 测试日志只使用TX发送,RX保持输入状态。
;-------------------------------------------------------------------------------
_UART_Init:
bset 0x5011, #5
bset 0x5012, #5
bres 0x5011, #6
bset 0x5012, #6
; CR2:同时打开UART发送器和接收器,TXE轮询发送才能继续执行。
mov 0x5235, #0x0C
mov 0x5233, #0x03
mov 0x5232, #0x68
mov 0x5234, #0x00
mov 0x5236, #0x00
ret
; 发送A寄存器中的一个UART字节。
_UART_SendByte:
push a
_UART_WaitTXE:
ld a, 0x5230
and a, #0x80
jreq _UART_WaitTXE
pop a
ld 0x5231, a
ret
; 发送以0结尾的ASCII文本,X指向字符串首地址。
_UART_SendText:
ld a, (x)
tnz a
jreq _UART_SendTextDone
call _UART_SendByte
incw x
jra _UART_SendText
_UART_SendTextDone:
ret
; A寄存器发送一个SPI字节,同时返回收到的字节。
_SPI_Transfer:
ld 0x5204, a
_SPI_WaitTx:
btjf 0x5203, #1, _SPI_WaitTx
_SPI_WaitRx:
btjf 0x5203, #0, _SPI_WaitRx
ld a, 0x5204
ret
; 读取JEDEC ID,W25Q80BV期望返回EF 40 14。
_SPI_CheckJedec:
bres 0x500F, #4
ld a, #0x9F
call _SPI_Transfer
ld a, #0x00
call _SPI_Transfer
cp a, #0xEF
jrne _SPI_Fail
ld a, #0x00
call _SPI_Transfer
cp a, #0x40
jrne _SPI_Fail
ld a, #0x00
call _SPI_Transfer
cp a, #0x14
jrne _SPI_Fail
bset 0x500F, #4
ld a, #0x00
ret
_SPI_Fail:
bset 0x500F, #4
ld a, #0x01
ret
; 等待W25Q80BV非忙状态,超时返回失败。
_SPI_WaitReady:
ldw x, #0xFFFF
_SPI_ReadyLoop:
bres 0x500F, #4
ld a, #0x05
call _SPI_Transfer
ld a, #0x00
call _SPI_Transfer
push a
bset 0x500F, #4
pop a
and a, #0x01
jreq _SPI_ReadyOK
decw x
jrne _SPI_ReadyLoop
ld a, #0x01
ret
_SPI_ReadyOK:
ld a, #0x00
ret
; 发送写使能命令WREN。
_SPI_WriteEnable:
bres 0x500F, #4
ld a, #0x06
call _SPI_Transfer
bset 0x500F, #4
ret
;-------------------------------------------------------------------------------
; 从W25Q80BV读取一个字节。
; 输入:X为16位地址;当前出厂固件和元数据地址均低于0x10000。
; 返回:A为读取到的数据。
;-------------------------------------------------------------------------------
_SPI_ReadByteX:
bres 0x500F, #4
ld a, #0x03
call _SPI_Transfer
ld a, #0x00
call _SPI_Transfer
ld a, xh
call _SPI_Transfer
ld a, xl
call _SPI_Transfer
ld a, #0xFF
call _SPI_Transfer
push a
bset 0x500F, #4
pop a
ret
;-------------------------------------------------------------------------------
; 读取出厂固件和元数据,并由STM8重新计算出厂固件CRC16/MODBUS。
; 返回:A=0表示元数据和固件CRC均正确,A=1表示检查失败。
; 串口输出实际读取到的关键字段,便于确认CH341A烧录内容。
;-------------------------------------------------------------------------------
_ReadFactoryImageInfo:
; 读取并输出魔数0x2000~0x2003。
ldw x, #0x2000
call _SPI_ReadByteX
ld 0x0005, a
incw x
call _SPI_ReadByteX
ld 0x0006, a
incw x
call _SPI_ReadByteX
ld 0x0007, a
incw x
call _SPI_ReadByteX
ld 0x0008, a
ldw x, #_TextMagic
call _UART_SendText
ld a, 0x0005
call _UART_SendHexByte
ld a, 0x0006
call _UART_SendHexByte
ld a, 0x0007
call _UART_SendHexByte
ld a, 0x0008
call _UART_SendHexByte
ldw x, #_TextCRLF
call _UART_SendText
ld a, 0x0005
cp a, #0x31
jreq _FactoryMagic1OK
jpf _FactoryInfoFail
_FactoryMagic1OK:
ld a, 0x0006
cp a, #0x43
jreq _FactoryMagic2OK
jpf _FactoryInfoFail
_FactoryMagic2OK:
ld a, 0x0007
cp a, #0x41
jreq _FactoryMagic3OK
jpf _FactoryInfoFail
_FactoryMagic3OK:
ld a, 0x0008
cp a, #0x46
jreq _FactoryMagic4OK
jpf _FactoryInfoFail
_FactoryMagic4OK:
; 读取4字节固件长度,保存低16位供CRC循环使用。
ldw x, #0x2004
call _SPI_ReadByteX
; 32位长度的高字节必须为0。
tnz a
jreq _FactoryLengthByte0OK
jpf _FactoryInfoFail
_FactoryLengthByte0OK:
incw x
call _SPI_ReadByteX
; 32位长度的次高字节也必须为0。
tnz a
jreq _FactoryLengthByte1OK
jpf _FactoryInfoFail
_FactoryLengthByte1OK:
incw x
call _SPI_ReadByteX
ld 0x0000, a
incw x
call _SPI_ReadByteX
ld 0x0001, a
ldw x, #_TextLength
call _UART_SendText
ld a, 0x0000
call _UART_SendHexByte
ld a, 0x0001
call _UART_SendHexByte
ldw x, #_TextCRLF
call _UART_SendText
; 输出版本号。
ldw x, #_TextVersion
call _UART_SendText
ldw x, #0x2008
call _SPI_ReadByteX
call _UART_SendHexByte
incw x
call _SPI_ReadByteX
call _UART_SendHexByte
ldw x, #_TextCRLF
call _UART_SendText
; 读取并输出元数据保存的CRC16,高字节在0x0002,低字节在0x0003。
ldw x, #0x200A
call _SPI_ReadByteX
ld 0x0002, a
incw x
call _SPI_ReadByteX
ld 0x0003, a
ldw x, #_TextStoredCRC
call _UART_SendText
ld a, 0x0002
call _UART_SendHexByte
ld a, 0x0003
call _UART_SendHexByte
ldw x, #_TextCRLF
call _UART_SendText
; 输出并检查镜像有效标志。
ldw x, #0x200E
call _SPI_ReadByteX
ld 0x0009, a
ldw x, #_TextValid
call _UART_SendText
ld a, 0x0009
call _UART_SendHexByte
ldw x, #_TextCRLF
call _UART_SendText
ld a, 0x0009
cp a, #0xA5
jrne _FactoryInfoFail
; 从外部Flash 0x000000开始逐字节计算完整固件CRC。
ld a, #0xFF
ld 0x000A, a
ld 0x000B, a
ldw x, #0x0000
_FactoryCrcLoop:
ld a, 0x0000
or a, 0x0001
jreq _FactoryCrcDone
call _SPI_ReadByteX
call _CRC_UpdateByte
incw x
call _DecLength
jra _FactoryCrcLoop
_FactoryCrcDone:
ldw x, #_TextCalcCRC
call _UART_SendText
ld a, 0x000B
call _UART_SendHexByte
ld a, 0x000A
call _UART_SendHexByte
ldw x, #_TextCRLF
call _UART_SendText
ld a, 0x000B
cp a, 0x0002
jrne _FactoryInfoFail
ld a, 0x000A
cp a, 0x0003
jrne _FactoryInfoFail
ld a, #0x00
ret
_FactoryInfoFail:
ld a, #0x01
ret
; CRC-16/MODBUS逐字节更新,输入A,累加值低字节0x000A、高字节0x000B。
_CRC_UpdateByte:
xor a, 0x000A
ld 0x000A, a
mov 0x000C, #0x08
_CRC_BitLoop:
srl 0x000B
rrc 0x000A
jrc _CRC_Poly
jra _CRC_Next
_CRC_Poly:
ld a, 0x000A
xor a, #0x01
ld 0x000A, a
ld a, 0x000B
xor a, #0xA0
ld 0x000B, a
_CRC_Next:
dec 0x000C
jrne _CRC_BitLoop
ret
; 递减0x0000/0x0001保存的16位剩余长度。
_DecLength:
ld a, 0x0001
tnz a
jrne _DecLengthLow
dec 0x0000
_DecLengthLow:
dec 0x0001
ret
; 输出A的两个十六进制字符。
_UART_SendHexByte:
push a
swap a
and a, #0x0F
call _UART_SendHexNibble
pop a
and a, #0x0F
call _UART_SendHexNibble
ret
_UART_SendHexNibble:
cp a, #0x0A
jrult _UART_SendDigit
add a, #0x37
jra _UART_SendHexOut
_UART_SendDigit:
add a, #0x30
_UART_SendHexOut:
call _UART_SendByte
ret
; 擦除0x01F000所在4KB扇区。
_SPI_EraseSector:
call _SPI_WriteEnable
bres 0x500F, #4
ld a, #0x20
call _SPI_Transfer
ld a, #0x01
call _SPI_Transfer
ld a, #0xF0
call _SPI_Transfer
ld a, #0x00
call _SPI_Transfer
bset 0x500F, #4
call _SPI_WaitReady
ret
; 向0x01F000写入8字节测试数据:00 55 AA FF 12 34 56 78。
_SPI_WriteTestData:
call _SPI_WriteEnable
bres 0x500F, #4
ld a, #0x02
call _SPI_Transfer
ld a, #0x01
call _SPI_Transfer
ld a, #0xF0
call _SPI_Transfer
ld a, #0x00
call _SPI_Transfer
ld a, #0x00
call _SPI_Transfer
ld a, #0x55
call _SPI_Transfer
ld a, #0xAA
call _SPI_Transfer
ld a, #0xFF
call _SPI_Transfer
ld a, #0x12
call _SPI_Transfer
ld a, #0x34
call _SPI_Transfer
ld a, #0x56
call _SPI_Transfer
ld a, #0x78
call _SPI_Transfer
bset 0x500F, #4
call _SPI_WaitReady
ret
; 读取8字节并逐字节比较测试数据。
_SPI_VerifyTestData:
bres 0x500F, #4
ld a, #0x03
call _SPI_Transfer
ld a, #0x01
call _SPI_Transfer
ld a, #0xF0
call _SPI_Transfer
ld a, #0x00
call _SPI_Transfer
ldw x, #_TestData
mov 0x0001, #0x08
_VerifyLoop:
ld a, #0xFF
call _SPI_Transfer
ld 0x0002, a
ld a, (x)
cp a, 0x0002
jrne _VerifyFail
incw x
dec 0x0001
jrne _VerifyLoop
bset 0x500F, #4
ld a, #0x00
ret
_VerifyFail:
bset 0x500F, #4
ld a, #0x01
ret
; 固定测试数据表。
_TestData:
.db 0x00, 0x55, 0xAA, 0xFF, 0x12, 0x34, 0x56, 0x78
; 粗略毫秒延时,X中的次数由调用方设置。
_DelayMsApprox:
pushw x
_DelayOuter:
ldw y, #1600
_DelayInner:
decw y
jrne _DelayInner
popw x
decw x
jrne _DelayMsApprox
ret
_DefaultInterrupt:
sim
_DefaultLoop:
jra _DefaultLoop
; UART测试日志文本,均以回车换行结尾并以0结束。
_TextStart:
.ascii "SPI TEST START\r\n"
.db 0
_TextJedecOK:
.ascii "JEDEC OK\r\n"
.db 0
_TextEraseOK:
.ascii "ERASE OK\r\n"
.db 0
_TextWriteOK:
.ascii "WRITE OK\r\n"
.db 0
_TextVerifyOK:
.ascii "VERIFY OK\r\n"
.db 0
_TextPass:
.ascii "SPI TEST PASS\r\n"
.db 0
_TextJedecFail:
.ascii "JEDEC FAIL\r\n"
.db 0
_TextEraseFail:
.ascii "ERASE FAIL\r\n"
.db 0
_TextWriteFail:
.ascii "WRITE FAIL\r\n"
.db 0
_TextVerifyFail:
.ascii "VERIFY FAIL\r\n"
.db 0
_TextFactoryFail:
.ascii "FACTORY IMAGE FAIL\r\n"
.db 0
_TextFactoryPass:
.ascii "FACTORY IMAGE PASS\r\n"
.db 0
_TextMagic:
.ascii "MAGIC: "
.db 0
_TextLength:
.ascii "LENGTH: "
.db 0
_TextVersion:
.ascii "VERSION: "
.db 0
_TextStoredCRC:
.ascii "STORED CRC: "
.db 0
_TextValid:
.ascii "VALID: "
.db 0
_TextCalcCRC:
.ascii "CALC CRC: "
.db 0
_TextCRLF:
.ascii "\r\n"
.db 0