flash/stm32l4x: STM32L5 support programming when TZEN=1 and RDP=0xAA

STM32L5 flash memory is aliased to 0x0C000000, this address mapping
is used for secure applications. (0x08000000 for non-secure)

this change allows the programming of secure and non-secure flash
when trustzone is enabled and RDP level is 0

Change-Id: I89d1f1b5d493cf01a142ca4dbfef5a3731cab96e
Signed-off-by: Tarek BOCHKATI <tarek.bouchkati@gmail.com>
Reviewed-on: https://review.openocd.org/c/openocd/+/5936
Tested-by: jenkins
Reviewed-by: Antonio Borneo <borneo.antonio@gmail.com>
Reviewed-by: Oleksij Rempel <linux@rempel-privat.de>

1 files changed, 77 insertions, 12 deletions

diff --git a/tcl/target/stm32l5x.cfg b/tcl/target/stm32l5x.cfg
index 92083b9..02297e3 100644
--- a/tcl/target/stm32l5x.cfg
+++ b/tcl/target/stm32l5x.cfg
@@ -52,9 +52,10 @@ target create $_TARGETNAME cortex_m -endian $_ENDIAN -dap $_CHIPNAME.dap
 # use non-secure RAM by default
 $_TARGETNAME configure -work-area-phys 0x20000000 -work-area-size $_WORKAREASIZE -work-area-backup 0
 
-# declare non-secure flash
-flash bank $_CHIPNAME.flash_ns stm32l4x 0x08000000 0 0 0 $_TARGETNAME
-flash bank $_CHIPNAME.otp      stm32l4x 0x0BFA0000 0 0 0 $_TARGETNAME
+# create sec/ns flash and otp memories (sizes will be probed)
+flash bank $_CHIPNAME.flash_ns      stm32l4x 0x08000000 0 0 0 $_TARGETNAME
+flash bank $_CHIPNAME.flash_alias_s stm32l4x 0x0C000000 0 0 0 $_TARGETNAME
+flash bank $_CHIPNAME.otp           stm32l4x 0x0BFA0000 0 0 0 $_TARGETNAME
 
 # Common knowledges tells JTAG speed should be <= F_CPU/6.
 # F_CPU after reset is MSI 4MHz, so use F_JTAG = 500 kHz to stay on
@@ -77,30 +78,47 @@ if {![using_hla]} {
 	cortex_m reset_config sysresetreq
 }
 
+proc is_secure {} {
+	# read Debug Security Control and Status Regsiter (DSCSR) and check CDS (bit 16)
+	set DSCSR [mrw 0xE000EE08]
+	return [expr {($DSCSR & (1 << 16)) != 0}]
+}
+
 proc clock_config_110_mhz {} {
+	set offset [expr {[is_secure] ? 0x10000000 : 0}]
 	# MCU clock is MSI (4MHz) after reset, set MCU freq at 110 MHz with PLL
 	# RCC_APB1ENR1 = PWREN
-	mww 0x40021058 0x10000000
+	mww [expr {0x40021058 + $offset}] 0x10000000
 	# delay for register clock enable (read back reg)
-	mrw 0x40021058
+	mrw [expr {0x40021058 + $offset}]
 	# PWR_CR1 : VOS Range 0
-	mww 0x40007000 0
+	mww [expr {0x40007000 + $offset}] 0
 	# while (PWR_SR2 & VOSF)
-	while {([mrw 0x40007014] & 0x0400)} {}
+	while {([mrw [expr {0x40007014 + $offset}]] & 0x0400)} {}
 	# FLASH_ACR : 5 WS for 110 MHz HCLK
 	mww 0x40022000 0x00000005
 	# RCC_PLLCFGR = PLLP=PLLQ=0, PLLR=00=2, PLLREN=1, PLLN=55, PLLM=0000=1, PLLSRC=MSI 4MHz
 	# fVCO = 4 x 55 /1 = 220
 	# SYSCLOCK = fVCO/PLLR = 220/2 = 110 MHz
-	mww 0x4002100C 0x01003711
+	mww [expr {0x4002100C + $offset}] 0x01003711
 	# RCC_CR |= PLLON
-	mmw 0x40021000 0x01000000 0
+	mmw [expr {0x40021000 + $offset}] 0x01000000 0
 	# while !(RCC_CR & PLLRDY)
-	while {!([mrw 0x40021000] & 0x02000000)} {}
+	while {!([mrw [expr {0x40021000 + $offset}]] & 0x02000000)} {}
 	# RCC_CFGR |= SW_PLL
-	mmw 0x40021008 0x00000003 0
+	mmw [expr {0x40021008 + $offset}] 0x00000003 0
 	# while ((RCC_CFGR & SWS) != PLL)
-	while {([mrw 0x40021008] & 0x0C) != 0x0C} {}
+	while {([mrw [expr {0x40021008 + $offset}]] & 0x0C) != 0x0C} {}
+}
+
+proc ahb_ap_non_secure_access {} {
+	# SPROT=1=Non Secure access, Priv=1
+	[[target current] cget -dap] apcsw 0x4B000000 0x4F000000
+}
+
+proc ahb_ap_secure_access {} {
+	# SPROT=0=Secure access, Priv=1
+	[[target current] cget -dap] apcsw 0x0B000000 0x4F000000
 }
 
 $_TARGETNAME configure -event reset-init {
@@ -123,6 +141,53 @@ $_TARGETNAME configure -event examine-end {
 	mmw 0xE0044008 0x00001800 0
 }
 
+$_TARGETNAME configure -event halted {
+	set secure [is_secure]
+
+	if {$secure} {
+		set secure_str "Secure"
+		ahb_ap_secure_access
+	} else {
+		set secure_str "Non-Secure"
+		ahb_ap_non_secure_access
+	}
+
+	# print the secure state only when it changes
+	set _TARGETNAME [target current]
+	global $_TARGETNAME.secure
+
+	if {![info exists $_TARGETNAME.secure] || $secure != [set $_TARGETNAME.secure]} {
+		echo "CPU in $secure_str state"
+		# update saved security state
+		set $_TARGETNAME.secure $secure
+	}
+}
+
+$_TARGETNAME configure -event gdb-flash-erase-start {
+	set use_secure_workarea 0
+	# check if FLASH_OPTR.TZEN is enabled
+	set FLASH_OPTR [mrw 0x40022040]
+	if {[expr {$FLASH_OPTR & 0x80000000}] == 0} {
+		echo "TZEN option bit disabled"
+		ahb_ap_non_secure_access
+	} {
+		ahb_ap_secure_access
+		echo "TZEN option bit enabled"
+		set use_secure_workarea 1
+	}
+
+	set workarea_addr [$_TARGETNAME cget -work-area-phys]
+	echo "workarea_addr $workarea_addr"
+
+	if {$use_secure_workarea} {
+		set workarea_addr [expr {$workarea_addr | 0x10000000}]
+	} {
+		set workarea_addr [expr {$workarea_addr & ~0x10000000}]
+	}
+
+	$_TARGETNAME configure -work-area-phys $workarea_addr
+}
+
 $_TARGETNAME configure -event trace-config {
 	# Set TRACE_IOEN; TRACE_MODE is set to async; when using sync
 	# change this value accordingly to configure trace pins