1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
|
/* Copyright 2018 The Chromium OS Authors. All rights reserved.
* Use of this source code is governed by a BSD-style license that can be
* found in the LICENSE file.
*/
/* Flash memory module for STM32H7 family */
#include "common.h"
#include "clock.h"
#include "cpu.h"
#include "flash.h"
#include "hooks.h"
#include "registers.h"
#include "panic.h"
#include "system.h"
#include "task.h"
#include "timer.h"
#include "util.h"
#include "watchdog.h"
/*
* Approximate number of CPU cycles per iteration of the loop when polling
* the flash status
*/
#define CYCLE_PER_FLASH_LOOP 2
/* Flash 256-bit word programming timeout. */
#define FLASH_TIMEOUT_US 600
/*
* Flash 128-KB block erase timeout.
* Datasheet says maximum is about 4 seconds in x8.
* Real delay seems to be: < 1 second in x64, < 2 seconds in x8.
*/
#define FLASH_ERASE_TIMEOUT_US (4200 * MSEC)
/*
* Option bytes programming timeout.
* No specification, real delay seems to be around 300ms.
*/
#define FLASH_OPT_PRG_TIMEOUT_US (1000 * MSEC)
/*
* All variants have 2 banks (as in parallel hardware / controllers)
* not what is called 'bank' in the common code (ie Write-Protect sectors)
* both have the same number of 128KB blocks.
*/
#define HWBANK_SIZE (CONFIG_FLASH_SIZE / 2)
#define BLOCKS_PER_HWBANK (HWBANK_SIZE / CONFIG_FLASH_ERASE_SIZE)
#define BLOCKS_HWBANK_MASK (BIT(BLOCKS_PER_HWBANK) - 1)
/*
* We can tune the power consumption vs erase/write speed
* by default, go fast (and consume current)
*/
#define DEFAULT_PSIZE FLASH_CR_PSIZE_DWORD
/* Can no longer write/erase flash until next reboot */
static int access_disabled;
/* Can no longer modify write-protection in option bytes until next reboot */
static int option_disabled;
/* Is physical flash stuck protected? (avoid reboot loop) */
static int stuck_locked;
static inline int calculate_flash_timeout(void)
{
return (FLASH_TIMEOUT_US *
(clock_get_freq() / SECOND) / CYCLE_PER_FLASH_LOOP);
}
static int unlock(int bank)
{
/* unlock CR only if needed */
if (STM32_FLASH_CR(bank) & FLASH_CR_LOCK) {
/*
* We may have already locked the flash module and get a bus
* fault in the attempt to unlock. Need to disable bus fault
* handler now.
*/
ignore_bus_fault(1);
STM32_FLASH_KEYR(bank) = FLASH_KEYR_KEY1;
STM32_FLASH_KEYR(bank) = FLASH_KEYR_KEY2;
asm volatile("dsb; isb");
ignore_bus_fault(0);
}
return (STM32_FLASH_CR(bank) & FLASH_CR_LOCK) ? EC_ERROR_UNKNOWN
: EC_SUCCESS;
}
static void lock(int bank)
{
STM32_FLASH_CR(bank) |= FLASH_CR_LOCK;
}
static int unlock_optb(void)
{
if (option_disabled)
return EC_ERROR_ACCESS_DENIED;
if (unlock(0))
return EC_ERROR_UNKNOWN;
/*
* Always use bank 0 flash controller as there is only one option bytes
* set for both banks.
*/
if (STM32_FLASH_OPTCR(0) & FLASH_OPTCR_OPTLOCK) {
/*
* We may have already locked the flash module and get a bus
* fault in the attempt to unlock. Need to disable bus fault
* handler now.
*/
ignore_bus_fault(1);
STM32_FLASH_OPTKEYR(0) = FLASH_OPTKEYR_KEY1;
STM32_FLASH_OPTKEYR(0) = FLASH_OPTKEYR_KEY2;
asm volatile("dsb; isb");
ignore_bus_fault(0);
}
return STM32_FLASH_OPTCR(0) & FLASH_OPTCR_OPTLOCK ? EC_ERROR_UNKNOWN
: EC_SUCCESS;
}
static int commit_optb(void)
{
/* might use this before timer_init, cannot use get_time/usleep */
int timeout = (FLASH_OPT_PRG_TIMEOUT_US *
(clock_get_freq() / SECOND) / CYCLE_PER_FLASH_LOOP);
STM32_FLASH_OPTCR(0) |= FLASH_OPTCR_OPTSTART;
while (STM32_FLASH_OPTSR_CUR(0) & FLASH_OPTSR_BUSY && timeout-- > 0)
;
STM32_FLASH_OPTCR(0) |= FLASH_OPTCR_OPTLOCK;
lock(0);
return (timeout > 0) ? EC_SUCCESS : EC_ERROR_TIMEOUT;
}
static void protect_blocks(uint32_t blocks)
{
if (unlock_optb())
return;
STM32_FLASH_WPSN_PRG(0) &= ~(blocks & BLOCKS_HWBANK_MASK);
STM32_FLASH_WPSN_PRG(1) &= ~((blocks >> BLOCKS_PER_HWBANK)
& BLOCKS_HWBANK_MASK);
commit_optb();
}
/*
* If RDP as PSTATE option is defined, use that as 'Write Protect enabled' flag:
* it makes no sense to be able to unlock RO, as that'd allow flashing
* arbitrary RO that could read back all flash.
*
* crbug.com/888109: Do not copy this code over to other STM32 chips without
* understanding the full implications.
*
* If RDP is not defined, use the option bytes RSS1 bit.
* TODO(crbug.com/888104): Validate that using RSS1 for this purpose is safe.
*/
#ifndef CONFIG_FLASH_READOUT_PROTECTION_AS_PSTATE
#error "crbug.com/888104: Using RSS1 for write protect PSTATE may not be safe."
#endif
static int is_wp_enabled(void)
{
#ifdef CONFIG_FLASH_READOUT_PROTECTION_AS_PSTATE
return (STM32_FLASH_OPTSR_CUR(0) & FLASH_OPTSR_RDP_MASK)
!= FLASH_OPTSR_RDP_LEVEL_0;
#else
return !!(STM32_FLASH_OPTSR_CUR(0) & FLASH_OPTSR_RSS1);
#endif
}
static int set_wp(int enabled)
{
int rv;
rv = unlock_optb();
if (rv)
return rv;
#ifdef CONFIG_FLASH_READOUT_PROTECTION_AS_PSTATE
if (enabled) {
/* Enable RDP level 1. */
STM32_FLASH_OPTSR_PRG(0) =
(STM32_FLASH_OPTSR_PRG(0) & ~FLASH_OPTSR_RDP_MASK) |
FLASH_OPTSR_RDP_LEVEL_1;
}
#else
if (enabled)
STM32_FLASH_OPTSR_PRG(0) |= FLASH_OPTSR_RSS1;
else
STM32_FLASH_OPTSR_PRG(0) &= ~FLASH_OPTSR_RSS1;
#endif
return commit_optb();
}
/*****************************************************************************/
/* Physical layer APIs */
int flash_physical_write(int offset, int size, const char *data)
{
int res = EC_SUCCESS;
int bank = offset / HWBANK_SIZE;
uint32_t *address = (void *)(CONFIG_PROGRAM_MEMORY_BASE + offset);
int timeout = calculate_flash_timeout();
int i;
int unaligned = (uint32_t)data & (CONFIG_FLASH_WRITE_SIZE - 1);
uint32_t *data32 = (void *)data;
if (access_disabled)
return EC_ERROR_ACCESS_DENIED;
/* work on a single hardware bank at a time */
if ((offset + size - 1) / HWBANK_SIZE != bank)
return EC_ERROR_INVAL;
if (unlock(bank) != EC_SUCCESS)
return EC_ERROR_UNKNOWN;
/* Clear previous error status */
STM32_FLASH_CCR(bank) = FLASH_CCR_ERR_MASK;
/* select write parallelism */
STM32_FLASH_CR(bank) = (STM32_FLASH_CR(bank) & ~FLASH_CR_PSIZE_MASK)
| DEFAULT_PSIZE;
/* set PG bit */
STM32_FLASH_CR(bank) |= FLASH_CR_PG;
for (; size > 0; size -= CONFIG_FLASH_WRITE_SIZE) {
/*
* Reload the watchdog timer to avoid watchdog reset when doing
* long writing.
*/
watchdog_reload();
/* write a 256-bit flash word */
if (unaligned) {
for (i = 0; i < CONFIG_FLASH_WRITE_SIZE / 4; i++,
data += 4)
*address++ = (uint32_t)data[0] | (data[1] << 8)
| (data[2] << 16) | (data[3] << 24);
} else {
for (i = 0; i < CONFIG_FLASH_WRITE_SIZE / 4; i++)
*address++ = *data32++;
}
/* Wait for writes to complete */
for (i = 0; (STM32_FLASH_SR(bank) &
(FLASH_SR_WBNE | FLASH_SR_QW)) && (i < timeout); i++)
;
if (STM32_FLASH_SR(bank) & (FLASH_SR_WBNE | FLASH_SR_QW)) {
res = EC_ERROR_TIMEOUT;
goto exit_wr;
}
if (STM32_FLASH_SR(bank) & FLASH_CCR_ERR_MASK) {
res = EC_ERROR_UNKNOWN;
goto exit_wr;
}
}
exit_wr:
/* Disable PG bit */
STM32_FLASH_CR(bank) &= ~FLASH_CR_PG;
lock(bank);
#ifdef CONFIG_ARMV7M_CACHE
/* Invalidate D-cache, to make sure we do not read back stale data. */
cpu_clean_invalidate_dcache();
#endif
return res;
}
int flash_physical_erase(int offset, int size)
{
int res = EC_SUCCESS;
int bank = offset / HWBANK_SIZE;
int last = (offset + size) / CONFIG_FLASH_ERASE_SIZE;
int sect;
if (access_disabled)
return EC_ERROR_ACCESS_DENIED;
/* work on a single hardware bank at a time */
if ((offset + size - 1) / HWBANK_SIZE != bank)
return EC_ERROR_INVAL;
if (unlock(bank) != EC_SUCCESS)
return EC_ERROR_UNKNOWN;
/* Clear previous error status */
STM32_FLASH_CCR(bank) = FLASH_CCR_ERR_MASK;
/* select erase parallelism */
STM32_FLASH_CR(bank) = (STM32_FLASH_CR(bank) & ~FLASH_CR_PSIZE_MASK)
| DEFAULT_PSIZE;
for (sect = offset / CONFIG_FLASH_ERASE_SIZE; sect < last; sect++) {
timestamp_t deadline;
/* select page to erase and PER bit */
STM32_FLASH_CR(bank) = (STM32_FLASH_CR(bank)
& ~FLASH_CR_SNB_MASK)
| FLASH_CR_SER | FLASH_CR_SNB(sect);
/* set STRT bit : start erase */
STM32_FLASH_CR(bank) |= FLASH_CR_STRT;
/*
* Reload the watchdog timer to avoid watchdog reset during a
* long erase operation.
*/
watchdog_reload();
deadline.val = get_time().val + FLASH_ERASE_TIMEOUT_US;
/* Wait for erase to complete */
while ((STM32_FLASH_SR(bank) & FLASH_SR_BUSY) &&
(get_time().val < deadline.val)) {
usleep(5000);
}
if (STM32_FLASH_SR(bank) & FLASH_SR_BUSY) {
res = EC_ERROR_TIMEOUT;
goto exit_er;
}
/*
* Check for error conditions - erase failed, voltage error,
* protection error
*/
if (STM32_FLASH_SR(bank) & FLASH_CCR_ERR_MASK) {
res = EC_ERROR_UNKNOWN;
goto exit_er;
}
}
exit_er:
/* reset SER bit */
STM32_FLASH_CR(bank) &= ~(FLASH_CR_SER | FLASH_CR_SNB_MASK);
lock(bank);
#ifdef CONFIG_ARMV7M_CACHE
/* Invalidate D-cache, to make sure we do not read back stale data. */
cpu_clean_invalidate_dcache();
#endif
return res;
}
int flash_physical_get_protect(int block)
{
int bank = block / BLOCKS_PER_HWBANK;
int index = block % BLOCKS_PER_HWBANK;
return !(STM32_FLASH_WPSN_CUR(bank) & BIT(index));
}
/*
* Note: This does not need to update _NOW flags, as flash_get_protect
* in common code already does so.
*/
uint32_t flash_physical_get_protect_flags(void)
{
uint32_t flags = 0;
if (access_disabled)
flags |= EC_FLASH_PROTECT_ALL_NOW;
if (is_wp_enabled())
flags |= EC_FLASH_PROTECT_RO_AT_BOOT;
/* Check if blocks were stuck locked at pre-init */
if (stuck_locked)
flags |= EC_FLASH_PROTECT_ERROR_STUCK;
return flags;
}
#define WP_RANGE(start, count) (((1 << (count)) - 1) << (start))
#define RO_WP_RANGE WP_RANGE(WP_BANK_OFFSET, WP_BANK_COUNT)
int flash_physical_protect_now(int all)
{
protect_blocks(RO_WP_RANGE);
/*
* Lock the option bytes or the full access by writing a wrong
* key to FLASH_*KEYR. This triggers a bus fault, so we need to
* disable bus fault handler while doing this.
*
* This incorrect key fault causes the flash to become
* permanently locked until reset, a correct keyring write
* will not unlock it.
*/
ignore_bus_fault(1);
if (all) {
/* cannot do any write/erase access until next reboot */
STM32_FLASH_KEYR(0) = 0xffffffff;
STM32_FLASH_KEYR(1) = 0xffffffff;
access_disabled = 1;
}
/* cannot modify the WP bits in the option bytes until reboot */
STM32_FLASH_OPTKEYR(0) = 0xffffffff;
option_disabled = 1;
asm volatile("dsb; isb");
ignore_bus_fault(0);
return EC_SUCCESS;
}
int flash_physical_protect_at_boot(uint32_t new_flags)
{
int new_wp_enable = !!(new_flags & EC_FLASH_PROTECT_RO_AT_BOOT);
if (is_wp_enabled() != new_wp_enable)
return set_wp(new_wp_enable);
return EC_SUCCESS;
}
uint32_t flash_physical_get_valid_flags(void)
{
return EC_FLASH_PROTECT_RO_AT_BOOT |
EC_FLASH_PROTECT_RO_NOW |
EC_FLASH_PROTECT_ALL_NOW;
}
uint32_t flash_physical_get_writable_flags(uint32_t cur_flags)
{
uint32_t ret = 0;
/* If RO protection isn't enabled, its at-boot state can be changed. */
if (!(cur_flags & EC_FLASH_PROTECT_RO_NOW))
ret |= EC_FLASH_PROTECT_RO_AT_BOOT;
/*
* If entire flash isn't protected at this boot, it can be enabled if
* the WP GPIO is asserted.
*/
if (!(cur_flags & EC_FLASH_PROTECT_ALL_NOW) &&
(cur_flags & EC_FLASH_PROTECT_GPIO_ASSERTED))
ret |= EC_FLASH_PROTECT_ALL_NOW;
return ret;
}
int flash_pre_init(void)
{
uint32_t reset_flags = system_get_reset_flags();
uint32_t prot_flags = flash_get_protect();
uint32_t unwanted_prot_flags = EC_FLASH_PROTECT_ALL_NOW |
EC_FLASH_PROTECT_ERROR_INCONSISTENT;
/*
* If we have already jumped between images, an earlier image could
* have applied write protection. Nothing additional needs to be done.
*/
if (reset_flags & RESET_FLAG_SYSJUMP)
return EC_SUCCESS;
if (prot_flags & EC_FLASH_PROTECT_GPIO_ASSERTED) {
/*
* Write protect is asserted. If we want RO flash protected,
* protect it now.
*/
if ((prot_flags & EC_FLASH_PROTECT_RO_AT_BOOT) &&
!(prot_flags & EC_FLASH_PROTECT_RO_NOW)) {
int rv;
rv = flash_set_protect(EC_FLASH_PROTECT_RO_NOW,
EC_FLASH_PROTECT_RO_NOW);
if (rv)
return rv;
/* Re-read flags */
prot_flags = flash_get_protect();
}
} else {
/* Don't want RO flash protected */
unwanted_prot_flags |= EC_FLASH_PROTECT_RO_NOW;
}
/* If there are no unwanted flags, done */
if (!(prot_flags & unwanted_prot_flags))
return EC_SUCCESS;
/*
* If the last reboot was a power-on reset, it should have cleared
* write-protect. If it didn't, then the flash write protect registers
* have been permanently committed and we can't fix that.
*/
if (reset_flags & RESET_FLAG_POWER_ON) {
stuck_locked = 1;
return EC_ERROR_ACCESS_DENIED;
}
/* Otherwise, do a hard boot to clear the flash protection registers */
system_reset(SYSTEM_RESET_HARD | SYSTEM_RESET_PRESERVE_FLAGS);
/* That doesn't return, so if we're still here that's an error */
return EC_ERROR_UNKNOWN;
}
|