stm32f4: fix flash_physical_protect_now behavior

flash_physical_protect_now(), which is called when
EC_FLASH_PROTECT_ALL_NOW is set, should protect the entire flash
temporarily until reboot. Current behavior enable flash protect on all
region permanently. The correct implementation should be writing an
invalid key to the flash controller to disable flash flash only
temporarily until reboot.

Since the implementation of flash-stm32f3 and flash-stm32f4 is almost
the same after restoring the changes made in commit
35f4d8acaa40050f10158459a04e0bf9b24149c6, we merge to file by creating a
symlink from flash-stm32f3.c to flash-stm32f4.c to reduce code
duplication.

BRANCH=none
BUG=b:37584134
TEST=on eve:
     1) `ectool --name=cros_tp flashprotect`
        Flash protect flags: 0x00000008 wp_gpio_asserted
     2) `flashrom -p ec:type=tp --wp-enable
     3) `ectool --name=cros_tp reboot_ec`
     3) `flashrom -p ec:type=tp --wp-status`
        WP: status: 0x80
        WP: status.srp0: 1
        WP: write protect is enabled.
        WP: write protect range: start=0x00000000, len=0x00040000
     4) `ectool --name=cros_tp flashprotect`, all_now should present
        Flash protect flags: 0x0000000f wp_gpio_asserted ro_at_boot ro_now \
        all_now
     5) `ectool --name=cros_tp reboot_ec; sleep 0.3; \
         ectool --name=cros_tp rwsigaction abort` to stay in RO.
        In EC console, `flashinfo`, should show that only RO is actually
        flash protected:
        Protected now:
            YYYYYY..
     6) `flashrom -p ec:type=tp -w ec.bin -i EC_RW` works
     7) `make BOARD=ryu -j` works (for testing flash-stm32f3.c)

Change-Id: Ia7a60ae8b3084198abb468e4fc8074b4445d6915
Signed-off-by: Wei-Ning Huang <wnhuang@google.com>
Reviewed-on: https://chromium-review.googlesource.com/549681
Commit-Ready: Wei-Ning Huang <wnhuang@chromium.org>
Tested-by: Wei-Ning Huang <wnhuang@chromium.org>
Reviewed-by: Gwendal Grignou <gwendal@chromium.org>

3 files changed, 50 insertions, 115 deletions

diff --git a/chip/stm32/flash-f.c b/chip/stm32/flash-f.c
index 9f7da82914..59c1a20943 100644
--- a/chip/stm32/flash-f.c
+++ b/chip/stm32/flash-f.c
@@ -445,16 +445,6 @@ static void unprotect_all_blocks(void)
 	write_optb(STM32_FLASH_nWRP_ALL, STM32_FLASH_nWRP_ALL);
 }
 
-int flash_physical_protect_now(int all)
-{
-	if (all) {
-		write_optb(STM32_FLASH_nWRP_ALL, 0);
-		return EC_SUCCESS;
-	}
-	/* No way to protect just the RO flash until next boot */
-	return EC_ERROR_INVAL;
-}
-
 #else   /* CHIP_FAMILY_STM32F4 */
 static int flash_physical_get_protect_at_boot(int block)
 {
diff --git a/chip/stm32/flash-stm32f3.c b/chip/stm32/flash-stm32f3.c
index 299d40d5c1..6fe7df91c5 100644
--- a/chip/stm32/flash-stm32f3.c
+++ b/chip/stm32/flash-stm32f3.c
@@ -1,9 +1,9 @@
-/* Copyright 2014 The Chromium OS Authors. All rights reserved.
+/* Copyright 2017 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
-/* Flash memory module for Chrome EC */
+/* Flash memory module for stm32f3 and stm32f4 */
 
 #include "common.h"
 #include "flash.h"
@@ -12,17 +12,44 @@
 #include "system.h"
 #include "panic.h"
 
+#ifdef CHIP_FAMILY_STM32F4
+/*****************************************************************************/
+/* Physical layer APIs */
+/*
+ * 8 "erase" sectors : 16KB/16KB/16KB/16KB/64KB/128KB/128KB/128KB
+ */
+struct ec_flash_bank const flash_bank_array[] = {
+	{
+		.count = 4,
+		.size_exp = __fls(SIZE_16KB),
+		.write_size_exp = __fls(CONFIG_FLASH_WRITE_SIZE),
+		.erase_size_exp = __fls(SIZE_16KB),
+		.protect_size_exp = __fls(SIZE_16KB),
+	},
+	{
+		.count = 1,
+		.size_exp = __fls(SIZE_64KB),
+		.write_size_exp = __fls(CONFIG_FLASH_WRITE_SIZE),
+		.erase_size_exp = __fls(SIZE_64KB),
+		.protect_size_exp = __fls(SIZE_64KB),
+	},
+	{
+		.count = (CONFIG_FLASH_SIZE - SIZE_128KB) / SIZE_128KB,
+		.write_size_exp = __fls(CONFIG_FLASH_WRITE_SIZE),
+		.size_exp = __fls(SIZE_128KB),
+		.erase_size_exp = __fls(SIZE_128KB),
+		.protect_size_exp = __fls(SIZE_128KB),
+	},
+};
+#endif
+
 /* Flag indicating whether we have locked down entire flash */
 static int entire_flash_locked;
 
 #define FLASH_SYSJUMP_TAG 0x5750 /* "WP" - Write Protect */
 #define FLASH_HOOK_VERSION 1
+
 /* The previous write protect state before sys jump */
-/*
- * TODO(crosbug.com/p/23798): check if STM32L code works here too - that is,
- * check if entire flash is locked by attempting to lock it rather than keeping
- * a global variable.
- */
 struct flash_wp_state {
 	int entire_flash_locked;
 };
@@ -32,7 +59,13 @@ struct flash_wp_state {
 
 int flash_physical_get_protect(int block)
 {
-	return entire_flash_locked || !(STM32_FLASH_WRPR & (1 << block));
+	return (entire_flash_locked ||
+#if defined(CHIP_FAMILY_STM32F3)
+		!(STM32_FLASH_WRPR & (1 << block))
+#elif defined(CHIP_FAMILY_STM32F4)
+		!(STM32_OPTB_WP & STM32_OPTB_nWRP(block))
+#endif
+	       );
 }
 
 uint32_t flash_physical_get_protect_flags(void)
@@ -53,6 +86,11 @@ int flash_physical_protect_now(int all)
 		 * Lock by writing a wrong key to FLASH_KEYR. This triggers a
 		 * bus fault, so we need to disable bus fault handler while
 		 * doing this.
+		 *
+		 * This incorrect key fault causes the flash to become
+		 * permanenlty locked until reset, a correct keyring write
+		 * will not unlock it. In this way we can implement system
+		 * write protect.
 		 */
 		ignore_bus_fault(1);
 		STM32_FLASH_KEYR = 0xffffffff;
@@ -61,10 +99,10 @@ int flash_physical_protect_now(int all)
 		entire_flash_locked = 1;
 
 		return EC_SUCCESS;
-	} else {
-		/* No way to protect just the RO flash until next boot */
-		return EC_ERROR_INVAL;
 	}
+
+	/* No way to protect just the RO flash until next boot */
+	return EC_ERROR_INVAL;
 }
 
 uint32_t flash_physical_get_valid_flags(void)
diff --git a/chip/stm32/flash-stm32f4.c b/chip/stm32/flash-stm32f4.c
index 95af3f1820..6ff8130e17 100644..120000
--- a/chip/stm32/flash-stm32f4.c
+++ b/chip/stm32/flash-stm32f4.c
@@ -1,94 +1 @@
-/* Copyright 2016 The Chromium OS Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file.
- */
-
-/* Flash memory module for stm32f4 */
-
-#include "clock.h"
-#include "compile_time_macros.h"
-#include "console.h"
-#include "common.h"
-#include "flash.h"
-#include "hooks.h"
-#include "registers.h"
-#include "system.h"
-#include "util.h"
-
-/*****************************************************************************/
-/* Physical layer APIs */
-/*
- * 8 "erase" sectors : 16KB/16KB/16KB/16KB/64KB/128KB/128KB/128KB
- */
-struct ec_flash_bank const flash_bank_array[] = {
-	{
-		.count = 4,
-		.size_exp = __fls(SIZE_16KB),
-		.write_size_exp = __fls(CONFIG_FLASH_WRITE_SIZE),
-		.erase_size_exp = __fls(SIZE_16KB),
-		.protect_size_exp = __fls(SIZE_16KB),
-	},
-	{
-		.count = 1,
-		.size_exp = __fls(SIZE_64KB),
-		.write_size_exp = __fls(CONFIG_FLASH_WRITE_SIZE),
-		.erase_size_exp = __fls(SIZE_64KB),
-		.protect_size_exp = __fls(SIZE_64KB),
-	},
-	{
-		.count = (CONFIG_FLASH_SIZE - SIZE_128KB) / SIZE_128KB,
-		.write_size_exp = __fls(CONFIG_FLASH_WRITE_SIZE),
-		.size_exp = __fls(SIZE_128KB),
-		.erase_size_exp = __fls(SIZE_128KB),
-		.protect_size_exp = __fls(SIZE_128KB),
-	},
-};
-
-/*****************************************************************************/
-/* Physical layer APIs */
-
-int flash_physical_get_protect(int bank)
-{
-	return !(STM32_OPTB_WP & STM32_OPTB_nWRP(bank));
-}
-
-uint32_t flash_physical_get_protect_flags(void)
-{
-	uint32_t flags = 0;
-
-	if ((STM32_OPTB_WP & STM32_OPTB_nWRP_ALL) == 0)
-		flags |= EC_FLASH_PROTECT_ALL_NOW;
-
-	return flags;
-}
-
-uint32_t flash_physical_get_valid_flags(void)
-{
-	return EC_FLASH_PROTECT_RO_AT_BOOT |
-	       EC_FLASH_PROTECT_RO_NOW |
-	       EC_FLASH_PROTECT_ALL_NOW;
-}
-
-uint32_t flash_physical_get_writable_flags(uint32_t cur_flags)
-{
-	uint32_t ret = 0;
-
-	/* If RO protection isn't enabled, its at-boot state can be changed. */
-	if (!(cur_flags & EC_FLASH_PROTECT_RO_NOW))
-		ret |= EC_FLASH_PROTECT_RO_AT_BOOT;
-
-	/*
-	 * If entire flash isn't protected at this boot, it can be enabled if
-	 * the WP GPIO is asserted.
-	 */
-	if (!(cur_flags & EC_FLASH_PROTECT_ALL_NOW) &&
-	    (cur_flags & EC_FLASH_PROTECT_GPIO_ASSERTED))
-		ret |= EC_FLASH_PROTECT_ALL_NOW;
-
-	return ret;
-}
-
-int flash_physical_restore_state(void)
-{
-	return 0;
-}
+flash-stm32f3.c
\ No newline at end of file