1 /*
2 * QEMU model of the Versal eFuse controller
3 *
4 * Copyright (c) 2020 Xilinx Inc.
5 * Copyright (c) 2023 Advanced Micro Devices, Inc.
6 *
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be included in
15 * all copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23 * THE SOFTWARE.
24 */
25
26 #include "qemu/osdep.h"
27 #include "hw/nvram/xlnx-versal-efuse.h"
28
29 #include "qemu/log.h"
30 #include "qapi/error.h"
31 #include "migration/vmstate.h"
32 #include "hw/qdev-properties.h"
33
34 #ifndef XLNX_VERSAL_EFUSE_CTRL_ERR_DEBUG
35 #define XLNX_VERSAL_EFUSE_CTRL_ERR_DEBUG 0
36 #endif
37
38 REG32(WR_LOCK, 0x0)
39 FIELD(WR_LOCK, LOCK, 0, 16)
40 REG32(CFG, 0x4)
41 FIELD(CFG, SLVERR_ENABLE, 5, 1)
42 FIELD(CFG, MARGIN_RD, 2, 1)
43 FIELD(CFG, PGM_EN, 1, 1)
44 REG32(STATUS, 0x8)
45 FIELD(STATUS, AES_USER_KEY_1_CRC_PASS, 11, 1)
46 FIELD(STATUS, AES_USER_KEY_1_CRC_DONE, 10, 1)
47 FIELD(STATUS, AES_USER_KEY_0_CRC_PASS, 9, 1)
48 FIELD(STATUS, AES_USER_KEY_0_CRC_DONE, 8, 1)
49 FIELD(STATUS, AES_CRC_PASS, 7, 1)
50 FIELD(STATUS, AES_CRC_DONE, 6, 1)
51 FIELD(STATUS, CACHE_DONE, 5, 1)
52 FIELD(STATUS, CACHE_LOAD, 4, 1)
53 FIELD(STATUS, EFUSE_2_TBIT, 2, 1)
54 FIELD(STATUS, EFUSE_1_TBIT, 1, 1)
55 FIELD(STATUS, EFUSE_0_TBIT, 0, 1)
56 REG32(EFUSE_PGM_ADDR, 0xc)
57 FIELD(EFUSE_PGM_ADDR, PAGE, 13, 4)
58 FIELD(EFUSE_PGM_ADDR, ROW, 5, 8)
59 FIELD(EFUSE_PGM_ADDR, COLUMN, 0, 5)
60 REG32(EFUSE_RD_ADDR, 0x10)
61 FIELD(EFUSE_RD_ADDR, PAGE, 13, 4)
62 FIELD(EFUSE_RD_ADDR, ROW, 5, 8)
63 REG32(EFUSE_RD_DATA, 0x14)
64 REG32(TPGM, 0x18)
65 FIELD(TPGM, VALUE, 0, 16)
66 REG32(TRD, 0x1c)
67 FIELD(TRD, VALUE, 0, 8)
68 REG32(TSU_H_PS, 0x20)
69 FIELD(TSU_H_PS, VALUE, 0, 8)
70 REG32(TSU_H_PS_CS, 0x24)
71 FIELD(TSU_H_PS_CS, VALUE, 0, 8)
72 REG32(TRDM, 0x28)
73 FIELD(TRDM, VALUE, 0, 8)
74 REG32(TSU_H_CS, 0x2c)
75 FIELD(TSU_H_CS, VALUE, 0, 8)
76 REG32(EFUSE_ISR, 0x30)
77 FIELD(EFUSE_ISR, APB_SLVERR, 31, 1)
78 FIELD(EFUSE_ISR, CACHE_PARITY_E2, 14, 1)
79 FIELD(EFUSE_ISR, CACHE_PARITY_E1, 13, 1)
80 FIELD(EFUSE_ISR, CACHE_PARITY_E0S, 12, 1)
81 FIELD(EFUSE_ISR, CACHE_PARITY_E0R, 11, 1)
82 FIELD(EFUSE_ISR, CACHE_APB_SLVERR, 10, 1)
83 FIELD(EFUSE_ISR, CACHE_REQ_ERROR, 9, 1)
84 FIELD(EFUSE_ISR, MAIN_REQ_ERROR, 8, 1)
85 FIELD(EFUSE_ISR, READ_ON_CACHE_LD, 7, 1)
86 FIELD(EFUSE_ISR, CACHE_FSM_ERROR, 6, 1)
87 FIELD(EFUSE_ISR, MAIN_FSM_ERROR, 5, 1)
88 FIELD(EFUSE_ISR, CACHE_ERROR, 4, 1)
89 FIELD(EFUSE_ISR, RD_ERROR, 3, 1)
90 FIELD(EFUSE_ISR, RD_DONE, 2, 1)
91 FIELD(EFUSE_ISR, PGM_ERROR, 1, 1)
92 FIELD(EFUSE_ISR, PGM_DONE, 0, 1)
93 REG32(EFUSE_IMR, 0x34)
94 FIELD(EFUSE_IMR, APB_SLVERR, 31, 1)
95 FIELD(EFUSE_IMR, CACHE_PARITY_E2, 14, 1)
96 FIELD(EFUSE_IMR, CACHE_PARITY_E1, 13, 1)
97 FIELD(EFUSE_IMR, CACHE_PARITY_E0S, 12, 1)
98 FIELD(EFUSE_IMR, CACHE_PARITY_E0R, 11, 1)
99 FIELD(EFUSE_IMR, CACHE_APB_SLVERR, 10, 1)
100 FIELD(EFUSE_IMR, CACHE_REQ_ERROR, 9, 1)
101 FIELD(EFUSE_IMR, MAIN_REQ_ERROR, 8, 1)
102 FIELD(EFUSE_IMR, READ_ON_CACHE_LD, 7, 1)
103 FIELD(EFUSE_IMR, CACHE_FSM_ERROR, 6, 1)
104 FIELD(EFUSE_IMR, MAIN_FSM_ERROR, 5, 1)
105 FIELD(EFUSE_IMR, CACHE_ERROR, 4, 1)
106 FIELD(EFUSE_IMR, RD_ERROR, 3, 1)
107 FIELD(EFUSE_IMR, RD_DONE, 2, 1)
108 FIELD(EFUSE_IMR, PGM_ERROR, 1, 1)
109 FIELD(EFUSE_IMR, PGM_DONE, 0, 1)
110 REG32(EFUSE_IER, 0x38)
111 FIELD(EFUSE_IER, APB_SLVERR, 31, 1)
112 FIELD(EFUSE_IER, CACHE_PARITY_E2, 14, 1)
113 FIELD(EFUSE_IER, CACHE_PARITY_E1, 13, 1)
114 FIELD(EFUSE_IER, CACHE_PARITY_E0S, 12, 1)
115 FIELD(EFUSE_IER, CACHE_PARITY_E0R, 11, 1)
116 FIELD(EFUSE_IER, CACHE_APB_SLVERR, 10, 1)
117 FIELD(EFUSE_IER, CACHE_REQ_ERROR, 9, 1)
118 FIELD(EFUSE_IER, MAIN_REQ_ERROR, 8, 1)
119 FIELD(EFUSE_IER, READ_ON_CACHE_LD, 7, 1)
120 FIELD(EFUSE_IER, CACHE_FSM_ERROR, 6, 1)
121 FIELD(EFUSE_IER, MAIN_FSM_ERROR, 5, 1)
122 FIELD(EFUSE_IER, CACHE_ERROR, 4, 1)
123 FIELD(EFUSE_IER, RD_ERROR, 3, 1)
124 FIELD(EFUSE_IER, RD_DONE, 2, 1)
125 FIELD(EFUSE_IER, PGM_ERROR, 1, 1)
126 FIELD(EFUSE_IER, PGM_DONE, 0, 1)
127 REG32(EFUSE_IDR, 0x3c)
128 FIELD(EFUSE_IDR, APB_SLVERR, 31, 1)
129 FIELD(EFUSE_IDR, CACHE_PARITY_E2, 14, 1)
130 FIELD(EFUSE_IDR, CACHE_PARITY_E1, 13, 1)
131 FIELD(EFUSE_IDR, CACHE_PARITY_E0S, 12, 1)
132 FIELD(EFUSE_IDR, CACHE_PARITY_E0R, 11, 1)
133 FIELD(EFUSE_IDR, CACHE_APB_SLVERR, 10, 1)
134 FIELD(EFUSE_IDR, CACHE_REQ_ERROR, 9, 1)
135 FIELD(EFUSE_IDR, MAIN_REQ_ERROR, 8, 1)
136 FIELD(EFUSE_IDR, READ_ON_CACHE_LD, 7, 1)
137 FIELD(EFUSE_IDR, CACHE_FSM_ERROR, 6, 1)
138 FIELD(EFUSE_IDR, MAIN_FSM_ERROR, 5, 1)
139 FIELD(EFUSE_IDR, CACHE_ERROR, 4, 1)
140 FIELD(EFUSE_IDR, RD_ERROR, 3, 1)
141 FIELD(EFUSE_IDR, RD_DONE, 2, 1)
142 FIELD(EFUSE_IDR, PGM_ERROR, 1, 1)
143 FIELD(EFUSE_IDR, PGM_DONE, 0, 1)
144 REG32(EFUSE_CACHE_LOAD, 0x40)
145 FIELD(EFUSE_CACHE_LOAD, LOAD, 0, 1)
146 REG32(EFUSE_PGM_LOCK, 0x44)
147 FIELD(EFUSE_PGM_LOCK, SPK_ID_LOCK, 0, 1)
148 REG32(EFUSE_AES_CRC, 0x48)
149 REG32(EFUSE_AES_USR_KEY0_CRC, 0x4c)
150 REG32(EFUSE_AES_USR_KEY1_CRC, 0x50)
151 REG32(EFUSE_PD, 0x54)
152 REG32(EFUSE_ANLG_OSC_SW_1LP, 0x60)
153 REG32(EFUSE_TEST_CTRL, 0x100)
154
155 #define R_MAX (R_EFUSE_TEST_CTRL + 1)
156
157 #define R_WR_LOCK_UNLOCK_PASSCODE (0xDF0D)
158
159 /*
160 * eFuse layout references:
161 * https://github.com/Xilinx/embeddedsw/blob/release-2019.2/lib/sw_services/xilnvm/src/xnvm_efuse_hw.h
162 */
163 #define BIT_POS_OF(A_) \
164 ((uint32_t)((A_) & (R_EFUSE_PGM_ADDR_ROW_MASK | \
165 R_EFUSE_PGM_ADDR_COLUMN_MASK)))
166
167 #define BIT_POS(R_, C_) \
168 ((uint32_t)((R_EFUSE_PGM_ADDR_ROW_MASK \
169 & ((R_) << R_EFUSE_PGM_ADDR_ROW_SHIFT)) \
170 | \
171 (R_EFUSE_PGM_ADDR_COLUMN_MASK \
172 & ((C_) << R_EFUSE_PGM_ADDR_COLUMN_SHIFT))))
173
174 #define EFUSE_TBIT_POS(A_) (BIT_POS_OF(A_) >= BIT_POS(0, 28))
175
176 #define EFUSE_ANCHOR_ROW (0)
177 #define EFUSE_ANCHOR_3_COL (27)
178 #define EFUSE_ANCHOR_1_COL (1)
179
180 #define EFUSE_AES_KEY_START BIT_POS(12, 0)
181 #define EFUSE_AES_KEY_END BIT_POS(19, 31)
182 #define EFUSE_USER_KEY_0_START BIT_POS(20, 0)
183 #define EFUSE_USER_KEY_0_END BIT_POS(27, 31)
184 #define EFUSE_USER_KEY_1_START BIT_POS(28, 0)
185 #define EFUSE_USER_KEY_1_END BIT_POS(35, 31)
186
187 #define EFUSE_RD_BLOCKED_START EFUSE_AES_KEY_START
188 #define EFUSE_RD_BLOCKED_END EFUSE_USER_KEY_1_END
189
190 #define EFUSE_GLITCH_DET_WR_LK BIT_POS(4, 31)
191 #define EFUSE_PPK0_WR_LK BIT_POS(43, 6)
192 #define EFUSE_PPK1_WR_LK BIT_POS(43, 7)
193 #define EFUSE_PPK2_WR_LK BIT_POS(43, 8)
194 #define EFUSE_AES_WR_LK BIT_POS(43, 11)
195 #define EFUSE_USER_KEY_0_WR_LK BIT_POS(43, 13)
196 #define EFUSE_USER_KEY_1_WR_LK BIT_POS(43, 15)
197 #define EFUSE_PUF_SYN_LK BIT_POS(43, 16)
198 #define EFUSE_DNA_WR_LK BIT_POS(43, 27)
199 #define EFUSE_BOOT_ENV_WR_LK BIT_POS(43, 28)
200
201 #define EFUSE_PGM_LOCKED_START BIT_POS(44, 0)
202 #define EFUSE_PGM_LOCKED_END BIT_POS(51, 31)
203
204 #define EFUSE_PUF_PAGE (2)
205 #define EFUSE_PUF_SYN_START BIT_POS(129, 0)
206 #define EFUSE_PUF_SYN_END BIT_POS(255, 27)
207
208 #define EFUSE_KEY_CRC_LK_ROW (43)
209 #define EFUSE_AES_KEY_CRC_LK_MASK ((1U << 9) | (1U << 10))
210 #define EFUSE_USER_KEY_0_CRC_LK_MASK (1U << 12)
211 #define EFUSE_USER_KEY_1_CRC_LK_MASK (1U << 14)
212
213 /*
214 * A handy macro to return value of an array element,
215 * or a specific default if given index is out of bound.
216 */
217 #define ARRAY_GET(A_, I_, D_) \
218 ((unsigned int)(I_) < ARRAY_SIZE(A_) ? (A_)[I_] : (D_))
219
220 QEMU_BUILD_BUG_ON(R_MAX != ARRAY_SIZE(((XlnxVersalEFuseCtrl *)0)->regs));
221
222 typedef struct XlnxEFuseLkSpec {
223 uint16_t row;
224 uint16_t lk_bit;
225 } XlnxEFuseLkSpec;
226
efuse_imr_update_irq(XlnxVersalEFuseCtrl * s)227 static void efuse_imr_update_irq(XlnxVersalEFuseCtrl *s)
228 {
229 bool pending = s->regs[R_EFUSE_ISR] & ~s->regs[R_EFUSE_IMR];
230 qemu_set_irq(s->irq_efuse_imr, pending);
231 }
232
efuse_isr_postw(RegisterInfo * reg,uint64_t val64)233 static void efuse_isr_postw(RegisterInfo *reg, uint64_t val64)
234 {
235 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(reg->opaque);
236 efuse_imr_update_irq(s);
237 }
238
efuse_ier_prew(RegisterInfo * reg,uint64_t val64)239 static uint64_t efuse_ier_prew(RegisterInfo *reg, uint64_t val64)
240 {
241 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(reg->opaque);
242 uint32_t val = val64;
243
244 s->regs[R_EFUSE_IMR] &= ~val;
245 efuse_imr_update_irq(s);
246 return 0;
247 }
248
efuse_idr_prew(RegisterInfo * reg,uint64_t val64)249 static uint64_t efuse_idr_prew(RegisterInfo *reg, uint64_t val64)
250 {
251 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(reg->opaque);
252 uint32_t val = val64;
253
254 s->regs[R_EFUSE_IMR] |= val;
255 efuse_imr_update_irq(s);
256 return 0;
257 }
258
efuse_status_tbits_sync(XlnxVersalEFuseCtrl * s)259 static void efuse_status_tbits_sync(XlnxVersalEFuseCtrl *s)
260 {
261 uint32_t check = xlnx_efuse_tbits_check(s->efuse);
262 uint32_t val = s->regs[R_STATUS];
263
264 val = FIELD_DP32(val, STATUS, EFUSE_0_TBIT, !!(check & (1 << 0)));
265 val = FIELD_DP32(val, STATUS, EFUSE_1_TBIT, !!(check & (1 << 1)));
266 val = FIELD_DP32(val, STATUS, EFUSE_2_TBIT, !!(check & (1 << 2)));
267
268 s->regs[R_STATUS] = val;
269 }
270
efuse_anchor_bits_check(XlnxVersalEFuseCtrl * s)271 static void efuse_anchor_bits_check(XlnxVersalEFuseCtrl *s)
272 {
273 unsigned page;
274
275 if (!s->efuse || !s->efuse->init_tbits) {
276 return;
277 }
278
279 for (page = 0; page < s->efuse->efuse_nr; page++) {
280 uint32_t row = 0, bit;
281
282 row = FIELD_DP32(row, EFUSE_PGM_ADDR, PAGE, page);
283 row = FIELD_DP32(row, EFUSE_PGM_ADDR, ROW, EFUSE_ANCHOR_ROW);
284
285 bit = FIELD_DP32(row, EFUSE_PGM_ADDR, COLUMN, EFUSE_ANCHOR_3_COL);
286 if (!xlnx_efuse_get_bit(s->efuse, bit)) {
287 xlnx_efuse_set_bit(s->efuse, bit);
288 }
289
290 bit = FIELD_DP32(row, EFUSE_PGM_ADDR, COLUMN, EFUSE_ANCHOR_1_COL);
291 if (!xlnx_efuse_get_bit(s->efuse, bit)) {
292 xlnx_efuse_set_bit(s->efuse, bit);
293 }
294 }
295 }
296
efuse_key_crc_check(RegisterInfo * reg,uint32_t crc,uint32_t pass_mask,uint32_t done_mask,unsigned first,uint32_t lk_mask)297 static void efuse_key_crc_check(RegisterInfo *reg, uint32_t crc,
298 uint32_t pass_mask, uint32_t done_mask,
299 unsigned first, uint32_t lk_mask)
300 {
301 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(reg->opaque);
302 uint32_t r, lk_bits;
303
304 /*
305 * To start, assume both DONE and PASS, and clear PASS by xor
306 * if CRC-check fails or CRC-check disabled by lock fuse.
307 */
308 r = s->regs[R_STATUS] | done_mask | pass_mask;
309
310 lk_bits = xlnx_efuse_get_row(s->efuse, EFUSE_KEY_CRC_LK_ROW) & lk_mask;
311 if (lk_bits == 0 && xlnx_efuse_k256_check(s->efuse, crc, first)) {
312 pass_mask = 0;
313 }
314
315 s->regs[R_STATUS] = r ^ pass_mask;
316 }
317
efuse_data_sync(XlnxVersalEFuseCtrl * s)318 static void efuse_data_sync(XlnxVersalEFuseCtrl *s)
319 {
320 efuse_status_tbits_sync(s);
321 }
322
efuse_lk_spec_cmp(const void * a,const void * b)323 static int efuse_lk_spec_cmp(const void *a, const void *b)
324 {
325 uint16_t r1 = ((const XlnxEFuseLkSpec *)a)->row;
326 uint16_t r2 = ((const XlnxEFuseLkSpec *)b)->row;
327
328 return (r1 > r2) - (r1 < r2);
329 }
330
efuse_lk_spec_sort(XlnxVersalEFuseCtrl * s)331 static void efuse_lk_spec_sort(XlnxVersalEFuseCtrl *s)
332 {
333 XlnxEFuseLkSpec *ary = s->extra_pg0_lock_spec;
334 const uint32_t n8 = s->extra_pg0_lock_n16 * 2;
335 const uint32_t sz = sizeof(ary[0]);
336 const uint32_t cnt = n8 / sz;
337
338 if (ary && cnt) {
339 qsort(ary, cnt, sz, efuse_lk_spec_cmp);
340 }
341 }
342
efuse_lk_spec_find(XlnxVersalEFuseCtrl * s,uint32_t row)343 static uint32_t efuse_lk_spec_find(XlnxVersalEFuseCtrl *s, uint32_t row)
344 {
345 const XlnxEFuseLkSpec *ary = s->extra_pg0_lock_spec;
346 const uint32_t n8 = s->extra_pg0_lock_n16 * 2;
347 const uint32_t sz = sizeof(ary[0]);
348 const uint32_t cnt = n8 / sz;
349 const XlnxEFuseLkSpec *item = NULL;
350
351 if (ary && cnt) {
352 XlnxEFuseLkSpec k = { .row = row, };
353
354 item = bsearch(&k, ary, cnt, sz, efuse_lk_spec_cmp);
355 }
356
357 return item ? item->lk_bit : 0;
358 }
359
efuse_bit_locked(XlnxVersalEFuseCtrl * s,uint32_t bit)360 static uint32_t efuse_bit_locked(XlnxVersalEFuseCtrl *s, uint32_t bit)
361 {
362 /* Hard-coded locks */
363 static const uint16_t pg0_hard_lock[] = {
364 [4] = EFUSE_GLITCH_DET_WR_LK,
365 [37] = EFUSE_BOOT_ENV_WR_LK,
366
367 [8 ... 11] = EFUSE_DNA_WR_LK,
368 [12 ... 19] = EFUSE_AES_WR_LK,
369 [20 ... 27] = EFUSE_USER_KEY_0_WR_LK,
370 [28 ... 35] = EFUSE_USER_KEY_1_WR_LK,
371 [64 ... 71] = EFUSE_PPK0_WR_LK,
372 [72 ... 79] = EFUSE_PPK1_WR_LK,
373 [80 ... 87] = EFUSE_PPK2_WR_LK,
374 };
375
376 uint32_t row = FIELD_EX32(bit, EFUSE_PGM_ADDR, ROW);
377 uint32_t lk_bit = ARRAY_GET(pg0_hard_lock, row, 0);
378
379 return lk_bit ? lk_bit : efuse_lk_spec_find(s, row);
380 }
381
efuse_pgm_locked(XlnxVersalEFuseCtrl * s,unsigned int bit)382 static bool efuse_pgm_locked(XlnxVersalEFuseCtrl *s, unsigned int bit)
383 {
384
385 unsigned int lock = 1;
386
387 /* Global lock */
388 if (!ARRAY_FIELD_EX32(s->regs, CFG, PGM_EN)) {
389 goto ret_lock;
390 }
391
392 /* Row lock */
393 switch (FIELD_EX32(bit, EFUSE_PGM_ADDR, PAGE)) {
394 case 0:
395 if (ARRAY_FIELD_EX32(s->regs, EFUSE_PGM_LOCK, SPK_ID_LOCK) &&
396 bit >= EFUSE_PGM_LOCKED_START && bit <= EFUSE_PGM_LOCKED_END) {
397 goto ret_lock;
398 }
399
400 lock = efuse_bit_locked(s, bit);
401 break;
402 case EFUSE_PUF_PAGE:
403 if (bit < EFUSE_PUF_SYN_START || bit > EFUSE_PUF_SYN_END) {
404 lock = 0;
405 goto ret_lock;
406 }
407
408 lock = EFUSE_PUF_SYN_LK;
409 break;
410 default:
411 lock = 0;
412 goto ret_lock;
413 }
414
415 /* Row lock by an efuse bit */
416 if (lock) {
417 lock = xlnx_efuse_get_bit(s->efuse, lock);
418 }
419
420 ret_lock:
421 return lock != 0;
422 }
423
efuse_pgm_addr_postw(RegisterInfo * reg,uint64_t val64)424 static void efuse_pgm_addr_postw(RegisterInfo *reg, uint64_t val64)
425 {
426 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(reg->opaque);
427 unsigned bit = val64;
428 bool ok = false;
429
430 /* Always zero out PGM_ADDR because it is write-only */
431 s->regs[R_EFUSE_PGM_ADDR] = 0;
432
433 /*
434 * Indicate error if bit is write-protected (or read-only
435 * as guarded by efuse_set_bit()).
436 *
437 * Keep it simple by not modeling program timing.
438 *
439 * Note: model must NEVER clear the PGM_ERROR bit; it is
440 * up to guest to do so (or by reset).
441 */
442 if (efuse_pgm_locked(s, bit)) {
443 g_autofree char *path = object_get_canonical_path(OBJECT(s));
444
445 qemu_log_mask(LOG_GUEST_ERROR,
446 "%s: Denied setting of efuse<%u, %u, %u>\n",
447 path,
448 FIELD_EX32(bit, EFUSE_PGM_ADDR, PAGE),
449 FIELD_EX32(bit, EFUSE_PGM_ADDR, ROW),
450 FIELD_EX32(bit, EFUSE_PGM_ADDR, COLUMN));
451 } else if (xlnx_efuse_set_bit(s->efuse, bit)) {
452 ok = true;
453 if (EFUSE_TBIT_POS(bit)) {
454 efuse_status_tbits_sync(s);
455 }
456 }
457
458 if (!ok) {
459 ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, PGM_ERROR, 1);
460 }
461
462 ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, PGM_DONE, 1);
463 efuse_imr_update_irq(s);
464 }
465
efuse_rd_addr_postw(RegisterInfo * reg,uint64_t val64)466 static void efuse_rd_addr_postw(RegisterInfo *reg, uint64_t val64)
467 {
468 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(reg->opaque);
469 unsigned bit = val64;
470 bool denied;
471
472 /* Always zero out RD_ADDR because it is write-only */
473 s->regs[R_EFUSE_RD_ADDR] = 0;
474
475 /*
476 * Indicate error if row is read-blocked.
477 *
478 * Note: model must NEVER clear the RD_ERROR bit; it is
479 * up to guest to do so (or by reset).
480 */
481 s->regs[R_EFUSE_RD_DATA] = xlnx_versal_efuse_read_row(s->efuse,
482 bit, &denied);
483 if (denied) {
484 g_autofree char *path = object_get_canonical_path(OBJECT(s));
485
486 qemu_log_mask(LOG_GUEST_ERROR,
487 "%s: Denied reading of efuse<%u, %u>\n",
488 path,
489 FIELD_EX32(bit, EFUSE_RD_ADDR, PAGE),
490 FIELD_EX32(bit, EFUSE_RD_ADDR, ROW));
491
492 ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, RD_ERROR, 1);
493 }
494
495 ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, RD_DONE, 1);
496 efuse_imr_update_irq(s);
497 }
498
efuse_cache_load_prew(RegisterInfo * reg,uint64_t val64)499 static uint64_t efuse_cache_load_prew(RegisterInfo *reg, uint64_t val64)
500 {
501 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(reg->opaque);
502
503 if (val64 & R_EFUSE_CACHE_LOAD_LOAD_MASK) {
504 efuse_data_sync(s);
505
506 ARRAY_FIELD_DP32(s->regs, STATUS, CACHE_DONE, 1);
507 efuse_imr_update_irq(s);
508 }
509
510 return 0;
511 }
512
efuse_pgm_lock_prew(RegisterInfo * reg,uint64_t val64)513 static uint64_t efuse_pgm_lock_prew(RegisterInfo *reg, uint64_t val64)
514 {
515 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(reg->opaque);
516
517 /* Ignore all other bits */
518 val64 = FIELD_EX32(val64, EFUSE_PGM_LOCK, SPK_ID_LOCK);
519
520 /* Once the bit is written 1, only reset will clear it to 0 */
521 val64 |= ARRAY_FIELD_EX32(s->regs, EFUSE_PGM_LOCK, SPK_ID_LOCK);
522
523 return val64;
524 }
525
efuse_aes_crc_postw(RegisterInfo * reg,uint64_t val64)526 static void efuse_aes_crc_postw(RegisterInfo *reg, uint64_t val64)
527 {
528 efuse_key_crc_check(reg, val64,
529 R_STATUS_AES_CRC_PASS_MASK,
530 R_STATUS_AES_CRC_DONE_MASK,
531 EFUSE_AES_KEY_START,
532 EFUSE_AES_KEY_CRC_LK_MASK);
533 }
534
efuse_aes_u0_crc_postw(RegisterInfo * reg,uint64_t val64)535 static void efuse_aes_u0_crc_postw(RegisterInfo *reg, uint64_t val64)
536 {
537 efuse_key_crc_check(reg, val64,
538 R_STATUS_AES_USER_KEY_0_CRC_PASS_MASK,
539 R_STATUS_AES_USER_KEY_0_CRC_DONE_MASK,
540 EFUSE_USER_KEY_0_START,
541 EFUSE_USER_KEY_0_CRC_LK_MASK);
542 }
543
efuse_aes_u1_crc_postw(RegisterInfo * reg,uint64_t val64)544 static void efuse_aes_u1_crc_postw(RegisterInfo *reg, uint64_t val64)
545 {
546 efuse_key_crc_check(reg, val64,
547 R_STATUS_AES_USER_KEY_1_CRC_PASS_MASK,
548 R_STATUS_AES_USER_KEY_1_CRC_DONE_MASK,
549 EFUSE_USER_KEY_1_START,
550 EFUSE_USER_KEY_1_CRC_LK_MASK);
551 }
552
efuse_wr_lock_prew(RegisterInfo * reg,uint64_t val)553 static uint64_t efuse_wr_lock_prew(RegisterInfo *reg, uint64_t val)
554 {
555 return val != R_WR_LOCK_UNLOCK_PASSCODE;
556 }
557
558 static const RegisterAccessInfo efuse_ctrl_regs_info[] = {
559 { .name = "WR_LOCK", .addr = A_WR_LOCK,
560 .reset = 0x1,
561 .pre_write = efuse_wr_lock_prew,
562 },{ .name = "CFG", .addr = A_CFG,
563 .rsvd = 0x9,
564 },{ .name = "STATUS", .addr = A_STATUS,
565 .rsvd = 0x8,
566 .ro = 0xfff,
567 },{ .name = "EFUSE_PGM_ADDR", .addr = A_EFUSE_PGM_ADDR,
568 .post_write = efuse_pgm_addr_postw,
569 },{ .name = "EFUSE_RD_ADDR", .addr = A_EFUSE_RD_ADDR,
570 .rsvd = 0x1f,
571 .post_write = efuse_rd_addr_postw,
572 },{ .name = "EFUSE_RD_DATA", .addr = A_EFUSE_RD_DATA,
573 .ro = 0xffffffff,
574 },{ .name = "TPGM", .addr = A_TPGM,
575 },{ .name = "TRD", .addr = A_TRD,
576 .reset = 0x19,
577 },{ .name = "TSU_H_PS", .addr = A_TSU_H_PS,
578 .reset = 0xff,
579 },{ .name = "TSU_H_PS_CS", .addr = A_TSU_H_PS_CS,
580 .reset = 0x11,
581 },{ .name = "TRDM", .addr = A_TRDM,
582 .reset = 0x3a,
583 },{ .name = "TSU_H_CS", .addr = A_TSU_H_CS,
584 .reset = 0x16,
585 },{ .name = "EFUSE_ISR", .addr = A_EFUSE_ISR,
586 .rsvd = 0x7fff8000,
587 .w1c = 0x80007fff,
588 .post_write = efuse_isr_postw,
589 },{ .name = "EFUSE_IMR", .addr = A_EFUSE_IMR,
590 .reset = 0x80007fff,
591 .rsvd = 0x7fff8000,
592 .ro = 0xffffffff,
593 },{ .name = "EFUSE_IER", .addr = A_EFUSE_IER,
594 .rsvd = 0x7fff8000,
595 .pre_write = efuse_ier_prew,
596 },{ .name = "EFUSE_IDR", .addr = A_EFUSE_IDR,
597 .rsvd = 0x7fff8000,
598 .pre_write = efuse_idr_prew,
599 },{ .name = "EFUSE_CACHE_LOAD", .addr = A_EFUSE_CACHE_LOAD,
600 .pre_write = efuse_cache_load_prew,
601 },{ .name = "EFUSE_PGM_LOCK", .addr = A_EFUSE_PGM_LOCK,
602 .pre_write = efuse_pgm_lock_prew,
603 },{ .name = "EFUSE_AES_CRC", .addr = A_EFUSE_AES_CRC,
604 .post_write = efuse_aes_crc_postw,
605 },{ .name = "EFUSE_AES_USR_KEY0_CRC", .addr = A_EFUSE_AES_USR_KEY0_CRC,
606 .post_write = efuse_aes_u0_crc_postw,
607 },{ .name = "EFUSE_AES_USR_KEY1_CRC", .addr = A_EFUSE_AES_USR_KEY1_CRC,
608 .post_write = efuse_aes_u1_crc_postw,
609 },{ .name = "EFUSE_PD", .addr = A_EFUSE_PD,
610 .ro = 0xfffffffe,
611 },{ .name = "EFUSE_ANLG_OSC_SW_1LP", .addr = A_EFUSE_ANLG_OSC_SW_1LP,
612 },{ .name = "EFUSE_TEST_CTRL", .addr = A_EFUSE_TEST_CTRL,
613 .reset = 0x8,
614 }
615 };
616
efuse_ctrl_reg_write(void * opaque,hwaddr addr,uint64_t data,unsigned size)617 static void efuse_ctrl_reg_write(void *opaque, hwaddr addr,
618 uint64_t data, unsigned size)
619 {
620 RegisterInfoArray *reg_array = opaque;
621 XlnxVersalEFuseCtrl *s;
622 Object *dev;
623
624 assert(reg_array != NULL);
625
626 dev = reg_array->mem.owner;
627 assert(dev);
628
629 s = XLNX_VERSAL_EFUSE_CTRL(dev);
630
631 if (addr != A_WR_LOCK && s->regs[R_WR_LOCK]) {
632 g_autofree char *path = object_get_canonical_path(OBJECT(s));
633
634 qemu_log_mask(LOG_GUEST_ERROR,
635 "%s[reg_0x%02lx]: Attempt to write locked register.\n",
636 path, (long)addr);
637 } else {
638 register_write_memory(opaque, addr, data, size);
639 }
640 }
641
efuse_ctrl_register_reset(RegisterInfo * reg)642 static void efuse_ctrl_register_reset(RegisterInfo *reg)
643 {
644 if (!reg->data || !reg->access) {
645 return;
646 }
647
648 /* Reset must not trigger some registers' writers */
649 switch (reg->access->addr) {
650 case A_EFUSE_AES_CRC:
651 case A_EFUSE_AES_USR_KEY0_CRC:
652 case A_EFUSE_AES_USR_KEY1_CRC:
653 *(uint32_t *)reg->data = reg->access->reset;
654 return;
655 }
656
657 register_reset(reg);
658 }
659
efuse_ctrl_reset_hold(Object * obj,ResetType type)660 static void efuse_ctrl_reset_hold(Object *obj, ResetType type)
661 {
662 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(obj);
663 unsigned int i;
664
665 for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
666 efuse_ctrl_register_reset(&s->regs_info[i]);
667 }
668
669 efuse_anchor_bits_check(s);
670 efuse_data_sync(s);
671 efuse_imr_update_irq(s);
672 }
673
674 static const MemoryRegionOps efuse_ctrl_ops = {
675 .read = register_read_memory,
676 .write = efuse_ctrl_reg_write,
677 .endianness = DEVICE_LITTLE_ENDIAN,
678 .valid = {
679 .min_access_size = 4,
680 .max_access_size = 4,
681 },
682 };
683
efuse_ctrl_realize(DeviceState * dev,Error ** errp)684 static void efuse_ctrl_realize(DeviceState *dev, Error **errp)
685 {
686 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(dev);
687 const uint32_t lks_sz = sizeof(XlnxEFuseLkSpec) / 2;
688
689 if (!s->efuse) {
690 g_autofree char *path = object_get_canonical_path(OBJECT(s));
691
692 error_setg(errp, "%s.efuse: link property not connected to XLNX-EFUSE",
693 path);
694 return;
695 }
696
697 /* Sort property-defined pgm-locks for bsearch lookup */
698 if ((s->extra_pg0_lock_n16 % lks_sz) != 0) {
699 g_autofree char *path = object_get_canonical_path(OBJECT(s));
700
701 error_setg(errp,
702 "%s.pg0-lock: array property item-count not multiple of %u",
703 path, lks_sz);
704 return;
705 }
706
707 efuse_lk_spec_sort(s);
708 }
709
efuse_ctrl_init(Object * obj)710 static void efuse_ctrl_init(Object *obj)
711 {
712 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(obj);
713 SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
714
715 s->reg_array =
716 register_init_block32(DEVICE(obj), efuse_ctrl_regs_info,
717 ARRAY_SIZE(efuse_ctrl_regs_info),
718 s->regs_info, s->regs,
719 &efuse_ctrl_ops,
720 XLNX_VERSAL_EFUSE_CTRL_ERR_DEBUG,
721 R_MAX * 4);
722
723 sysbus_init_mmio(sbd, &s->reg_array->mem);
724 sysbus_init_irq(sbd, &s->irq_efuse_imr);
725 }
726
efuse_ctrl_finalize(Object * obj)727 static void efuse_ctrl_finalize(Object *obj)
728 {
729 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(obj);
730
731 register_finalize_block(s->reg_array);
732 g_free(s->extra_pg0_lock_spec);
733 }
734
735 static const VMStateDescription vmstate_efuse_ctrl = {
736 .name = TYPE_XLNX_VERSAL_EFUSE_CTRL,
737 .version_id = 1,
738 .minimum_version_id = 1,
739 .fields = (const VMStateField[]) {
740 VMSTATE_UINT32_ARRAY(regs, XlnxVersalEFuseCtrl, R_MAX),
741 VMSTATE_END_OF_LIST(),
742 }
743 };
744
745 static const Property efuse_ctrl_props[] = {
746 DEFINE_PROP_LINK("efuse",
747 XlnxVersalEFuseCtrl, efuse,
748 TYPE_XLNX_EFUSE, XlnxEFuse *),
749 DEFINE_PROP_ARRAY("pg0-lock",
750 XlnxVersalEFuseCtrl, extra_pg0_lock_n16,
751 extra_pg0_lock_spec, qdev_prop_uint16, uint16_t),
752 };
753
efuse_ctrl_class_init(ObjectClass * klass,const void * data)754 static void efuse_ctrl_class_init(ObjectClass *klass, const void *data)
755 {
756 DeviceClass *dc = DEVICE_CLASS(klass);
757 ResettableClass *rc = RESETTABLE_CLASS(klass);
758
759 rc->phases.hold = efuse_ctrl_reset_hold;
760 dc->realize = efuse_ctrl_realize;
761 dc->vmsd = &vmstate_efuse_ctrl;
762 device_class_set_props(dc, efuse_ctrl_props);
763 }
764
765 static const TypeInfo efuse_ctrl_info = {
766 .name = TYPE_XLNX_VERSAL_EFUSE_CTRL,
767 .parent = TYPE_SYS_BUS_DEVICE,
768 .instance_size = sizeof(XlnxVersalEFuseCtrl),
769 .class_init = efuse_ctrl_class_init,
770 .instance_init = efuse_ctrl_init,
771 .instance_finalize = efuse_ctrl_finalize,
772 };
773
efuse_ctrl_register_types(void)774 static void efuse_ctrl_register_types(void)
775 {
776 type_register_static(&efuse_ctrl_info);
777 }
778
type_init(efuse_ctrl_register_types)779 type_init(efuse_ctrl_register_types)
780
781 /*
782 * Retrieve a row, with unreadable bits returned as 0.
783 */
784 uint32_t xlnx_versal_efuse_read_row(XlnxEFuse *efuse,
785 uint32_t bit, bool *denied)
786 {
787 bool dummy;
788
789 if (!denied) {
790 denied = &dummy;
791 }
792
793 if (bit >= EFUSE_RD_BLOCKED_START && bit <= EFUSE_RD_BLOCKED_END) {
794 *denied = true;
795 return 0;
796 }
797
798 *denied = false;
799 return xlnx_efuse_get_row(efuse, bit);
800 }
801