STM32H5: DUAL BANK update

danielinux · danielinux · commit 81187ffa53cf · 2024-05-09T16:28:20.000+02:00
diff --git a/config/examples/stm32h5-dualbank.config b/config/examples/stm32h5-dualbank.config
diff --git a/docs/Targets.md b/docs/Targets.md
@@ -23,6 +23,7 @@ This README describes configuration of supported targets.
 * [STM32L5](#stm32l5)
 * [STM32G0](#stm32g0)
 * [STM32C0](#stm32c0)
+* [STM32H5](#stm32h5)
 * [STM32H7](#stm32h7)
 * [STM32U5](#stm32u5)
 * [STM32WB55](#stm32wb55)
@@ -807,6 +808,59 @@ arm-none-eabi-gdb
 (gdb) target remote:3333
 ```
 
+## STM32H5
+
+### DUALBANK mode (Trustzone disabled)
+
+The STM32H5 can be configured to use hardware-assisted bank swapping to facilitate the update.
+The configuration file to copy into `.config` is `config/examples/stm32h5-dualbank.config`.
+
+DUALBANK configuration (Tested on NUCLEO-STM32H563ZI):
+
+BANK A: 0x08000000 to 0x080FFFFFF (1MB)
+BANK B: 0x08100000 to 0x081FFFFFF (1MB)
+
+First of all, ensure that the `SWAP_BANK` option byte is off when running wolfBoot
+for the first time:
+
+```
+STM32_Programmer_CLI -c port=swd -ob SWAP_BANK=0
+```
+
+It is a good idea to start with an empty flash, by erasing all sectors via:
+
+```
+STM32_Programmer_CLI -c port=swd -e 0 255
+```
+Compile wolfBoot with `make`. The file `factory.bin` contains both wolfboot and the
+version 1 of the application, and can be uploaded to the board at the beginning
+of the first bank using `STM32_Programmer_CLI` tool:
+
+```
+STM32_Programmer_CLI -c port=swd -d factory.bin 0x08000000
+```
+
+Optionally, you can upload another copy of wolfboot.bin to the beginning of the second bank.
+Wolfboot should take care of copying itself to the second bank upon first boot if you don't.:
+
+```
+STM32_Programmer_CLI -c port=swd -d wolfboot.bin 0x08100000
+```
+
+After uploading the images, reboot your board. The green LED should indicate that v1 of the
+test application is running.
+
+To initiate an update, sign a new version of the app and upload the v3 to the update partition
+on the second bank:
+
+```
+tools/keytools/sign --ecc256 test-app/image.bin wolfboot_signing_private_key.der 3
+STM32_Programmer_CLI -c port=swd -d test-app/image_v3_signed.bin 0x08110000
+```
+
+Reboot the board to initiate an update via DUALBANK hw-assisted swap.
+Any version except the first one will also turn on the orange LED.
+
 
 ## STM32H7
 
diff --git a/hal/stm32h5.c b/hal/stm32h5.c
@@ -31,7 +31,8 @@ static void RAMFUNCTION flash_set_waitstates(unsigned int waitstates)
     uint32_t reg = FLASH_ACR;
     if ((reg & FLASH_ACR_LATENCY_MASK) < waitstates)
         do {
-            FLASH_ACR =  (reg & ~FLASH_ACR_LATENCY_MASK) | waitstates ;
+            FLASH_ACR =  (reg & ~(FLASH_ACR_LATENCY_MASK | (FLASH_ACR_WRHIGHFREQ_MASK << FLASH_ACR_WRHIGHFREQ_SHIFT))) |
+                         waitstates | (0x02 << FLASH_ACR_WRHIGHFREQ_SHIFT) ;
         }
         while ((FLASH_ACR & FLASH_ACR_LATENCY_MASK) != waitstates);
 }
@@ -49,11 +50,9 @@ void RAMFUNCTION hal_flash_wait_complete(uint8_t bank)
 
 void RAMFUNCTION hal_flash_clear_errors(uint8_t bank)
 {
-    FLASH_SR |= ( FLASH_SR_WBNE | FLASH_SR_DBNE );
-
-#if (TZ_SECURE())
-    FLASH_NS_SR |= ( FLASH_SR_WBNE | FLASH_SR_DBNE );
-#endif
+    FLASH_CCR |= ( FLASH_CCR_CLR_WBNE | FLASH_CCR_CLR_DBNE | FLASH_CCR_CLR_INCE|
+            FLASH_CCR_CLR_PGSE | FLASH_CCR_CLR_OPTE | FLASH_CCR_CLR_OPTWE |
+            FLASH_CCR_CLR_WRPE | FLASH_CCR_CLR_EOP);
 
 }
 
@@ -156,25 +155,23 @@ int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
     for (p = address; p < end_address; p += FLASH_PAGE_SIZE) {
         uint32_t reg;
         uint32_t base;
-        uint32_t bker = 0;
-        if ((((FLASH_OPTCR & FLASH_OPTCR_SWAP_BANK) == 0) && (p <= FLASH_TOP)) ||
-                (p < FLASH_BANK2_BASE)) {
-            base = FLASHMEM_ADDRESS_SPACE;
-        }
-        else if(p >= (FLASH_BANK2_BASE) && (p <= (FLASH_TOP) ))
+        uint32_t bnksel = 0;
+        base = FLASHMEM_ADDRESS_SPACE;
+        reg = FLASH_CR & (~((FLASH_CR_PNB_MASK << FLASH_CR_PNB_SHIFT) | FLASH_CR_BER));
+
+        if(p >= (FLASH_BANK2_BASE) && (p <= (FLASH_TOP) ))
         {
 #if TZ_SECURE()
             /* When in secure mode, skip erasing non-secure pages: will be erased upon claim */
             return 0;
 #endif
-            bker = FLASH_CR_BER;
             base = FLASH_BANK2_BASE;
+            bnksel = 1;
         } else {
             FLASH_CR &= ~FLASH_CR_SER ;
             return 0; /* Address out of range */
         }
-        reg = FLASH_CR & (~((FLASH_CR_PNB_MASK << FLASH_CR_PNB_SHIFT) | FLASH_CR_BER));
-        reg |= ((((p - base)  >> 11) << FLASH_CR_PNB_SHIFT) | FLASH_CR_SER | bker );
+        reg |= ((((p - base)  >> 13) << FLASH_CR_PNB_SHIFT) | FLASH_CR_SER | (bnksel << 31));
         FLASH_CR = reg;
         DMB();
         FLASH_CR |= FLASH_CR_STRT;
@@ -336,8 +333,6 @@ static void periph_unsecure()
 #endif
 
 
-#define OPTR_SWAP_BANK (1 << 20)
-
 #define AIRCR *(volatile uint32_t *)(0xE000ED0C)
 #define AIRCR_VKEY (0x05FA << 16)
 #define AIRCR_SYSRESETREQ (1 << 2)
@@ -356,29 +351,33 @@ static void RAMFUNCTION stm32h5_reboot(void)
 void RAMFUNCTION hal_flash_dualbank_swap(void)
 {
     uint32_t cur_opts;
+    cur_opts = (FLASH_OPTSR_CUR & FLASH_OPTSR_SWAP_BANK) >> 31;
+    hal_flash_clear_errors(0);
     hal_flash_unlock();
     hal_flash_opt_unlock();
-    cur_opts = (FLASH_OPTCR & FLASH_OPTCR_SWAP_BANK) >> 31;
     if (cur_opts)
-        FLASH_SECCR &= ~(FLASH_SECCR_BKSEL);
+        FLASH_OPTSR_PRG &= ~(FLASH_OPTSR_SWAP_BANK);
     else
-        FLASH_SECCR |= FLASH_SECCR_BKSEL;
+        FLASH_OPTSR_PRG |= FLASH_OPTSR_SWAP_BANK;
+
+    FLASH_OPTCR |= FLASH_OPTCR_OPTSTRT;
+    DMB();
     hal_flash_opt_lock();
     hal_flash_lock();
     stm32h5_reboot();
 }
 
 static uint8_t bootloader_copy_mem[BOOTLOADER_SIZE];
 
-static void RAMFUNCTION fork_bootloader(void)
+static void fork_bootloader(void)
 {
     uint8_t *data = (uint8_t *) FLASHMEM_ADDRESS_SPACE;
     uint32_t dst  = FLASH_BANK2_BASE;
     uint32_t r = 0, w = 0;
     int i;
 
     /* Return if content already matches */
-    if (memcmp(data, (void *)FLASH_BANK2_BASE, BOOTLOADER_SIZE) == 0)
+    if (memcmp(data, (const char*)FLASH_BANK2_BASE, BOOTLOADER_SIZE) == 0)
         return;
 
     /* Read the wolfBoot image in RAM */
@@ -395,16 +394,16 @@ static void RAMFUNCTION fork_bootloader(void)
 void hal_init(void)
 {
 
+#if defined(DUALBANK_SWAP) && defined(__WOLFBOOT)
+    if ((FLASH_OPTSR_CUR & (FLASH_OPTSR_SWAP_BANK)) == 0)
+        fork_bootloader();
+#endif
 
 #if TZ_SECURE()
     hal_tz_sau_init();
     hal_gtzc_init();
 #endif
     clock_pll_on();
-#if defined(DUALBANK_SWAP) && defined(__WOLFBOOT)
-    if ((FLASH_OPTSR_CUR & (FLASH_OPTSR_CUR_SWAP_BANK)) == 0)
-        fork_bootloader();
-#endif
 
 }
 
diff --git a/hal/stm32h5.h b/hal/stm32h5.h
@@ -213,21 +213,27 @@
 
 #define FLASH_NS_BASE          (0x40022000)   //RM0481 - Table 3
 #define FLASH_NS_KEYR        (*(volatile uint32_t *)(FLASH_NS_BASE + 0x08))
-#define FLASH_NS_OPTKEYR     (*(volatile uint32_t *)(FLASH_NS_BASE + 0x10))
+#define FLASH_NS_OPTKEYR     (*(volatile uint32_t *)(FLASH_NS_BASE + 0x0C))
 #define FLASH_NS_SR          (*(volatile uint32_t *)(FLASH_NS_BASE + 0x20))
 #define FLASH_NS_CR          (*(volatile uint32_t *)(FLASH_NS_BASE + 0x28))
 
-#define TZSC_PRIVCFGR2   *((uint32_t *)(0x50036424))
+#define TZSC_PRIVCFGR2   *((volatile uint32_t *)(0x50036424))
 #define TZSC_PRIVCFG2_LPUARTPRIV (1 << 25) /* LPUART1 */
 
+/* Mapping FLASH_SECCR for bank swapping */
+#define FLASH_CCR            (*(volatile uint32_t *)(FLASH_BASE + 0x34))
 
 #else
 /* Non-Secure only */
 #define FLASH_BASE          (0x40022000)   //RM0481 - Table 3
 #define FLASH_KEYR        (*(volatile uint32_t *)(FLASH_BASE + 0x04))
-#define FLASH_OPTKEYR     (*(volatile uint32_t *)(FLASH_BASE + 0x10))
+#define FLASH_OPTKEYR     (*(volatile uint32_t *)(FLASH_BASE + 0x0C))
 #define FLASH_SR          (*(volatile uint32_t *)(FLASH_BASE + 0x20))
 #define FLASH_CR          (*(volatile uint32_t *)(FLASH_BASE + 0x28))
+
+/* Mapping FLASH_NSCCR for bank swapping */
+#define FLASH_CCR            (*(volatile uint32_t *)(FLASH_BASE + 0x30))
+
 #endif
 
 /* Both secure + non secure */
@@ -252,11 +258,9 @@
 
 
 #if defined(DUALBANK_SWAP) && defined (__WOLFBOOT)
-    /* Mapping FLASH_SECCR for bank swapping */
     #define FLASH_OPTSR_CUR   (*(volatile uint32_t *)(FLASH_BASE + 0x50))
-    #define FLASH_SECCR       (*(volatile uint32_t *)(FLASH_BASE + 0x2C))
-    #define FLASH_SECCR_BKSEL (1 << 31)
-    #define FLASH_OPTSR_CUR_SWAP_BANK (1 << 31)
+    #define FLASH_OPTSR_PRG   (*(volatile uint32_t *)(FLASH_BASE + 0x54))
+    #define FLASH_OPTSR_SWAP_BANK (1 << 31)
 #endif
 
 /* Register values (for both secure and non secure registers) 
@@ -266,12 +270,23 @@
 #define FLASH_SR_WBNE                       (1 << 1)
 #define FLASH_SR_DBNE                       (1 << 3)
 #define FLASH_SR_EOP                        (1 << 16)
-#define FLASH_SR_WRPERR                     (1 << 17)
-#define FLASH_SR_PGSERR                     (1 << 18)
-#define FLASH_SR_STRBERR                    (1 << 19)
-#define FLASH_SR_INCERR                     (1 << 20)
-#define FLASH_SR_OPTERR                     (1 << 21)
-#define FLASH_SR_OPTWERR                    (1 << 22)
+#define FLASH_SR_WRPE                       (1 << 17)
+#define FLASH_SR_PGSE                       (1 << 18)
+#define FLASH_SR_STRBE                      (1 << 19)
+#define FLASH_SR_INCE                       (1 << 20)
+#define FLASH_SR_OPTE                       (1 << 21)
+#define FLASH_SR_OPTWE                      (1 << 22)
+
+#define FLASH_CCR_CLR_BUSY                  (1 << 0) 
+#define FLASH_CCR_CLR_WBNE                  (1 << 1)
+#define FLASH_CCR_CLR_DBNE                  (1 << 3)
+#define FLASH_CCR_CLR_EOP                   (1 << 16)
+#define FLASH_CCR_CLR_WRPE                  (1 << 17)
+#define FLASH_CCR_CLR_PGSE                  (1 << 18)
+#define FLASH_CCR_CLR_STRBE                 (1 << 19)
+#define FLASH_CCR_CLR_INCE                  (1 << 20)
+#define FLASH_CCR_CLR_OPTE                  (1 << 21)
+#define FLASH_CCR_CLR_OPTWE                 (1 << 22)
 
 #define FLASH_CR_LOCK                       (1 << 0)
 #define FLASH_CR_PG                         (1 << 1)
@@ -295,6 +310,9 @@
 
 #define FLASH_ACR           (*(volatile uint32_t *)(FLASH_BASE + 0x00))
 #define FLASH_ACR_LATENCY_MASK              (0x0F)
+#define FLASH_ACR_WRHIGHFREQ_MASK           (0x03)
+#define FLASH_ACR_WRHIGHFREQ_SHIFT          (4)
+
 
 #define FLASH_OPTCR          (*(volatile uint32_t *)(FLASH_BASE + 0x1C))
 #define FLASH_OPTCR_OPTSTRT   (1 << 1)
@@ -305,7 +323,7 @@
 #define FLASH_PAGE_SIZE           (0x2000)      /* 8KB */
 #define FLASH_BANK2_BASE          (0x08100000) /*!< Base address of Flash Bank2     */
 #define BOOTLOADER_SIZE           (0x8000)
-#define FLASH_TOP                 (0x080FFFFF) /*!< FLASH end address (sector 127)  */
+#define FLASH_TOP                 (0x081FFFFF) /*!< FLASH end address (sector 127)  */
 
 #define FLASH_KEY1                            (0x45670123U)
 #define FLASH_KEY2                            (0xCDEF89ABU)
