1 /* 2 * QEMU model of the Versal eFuse controller 3 * 4 * Copyright (c) 2020 Xilinx Inc. 5 * Copyright (c) 2023 Advanced Micro Devices, Inc. 6 * 7 * Permission is hereby granted, free of charge, to any person obtaining a copy 8 * of this software and associated documentation files (the "Software"), to deal 9 * in the Software without restriction, including without limitation the rights 10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 11 * copies of the Software, and to permit persons to whom the Software is 12 * furnished to do so, subject to the following conditions: 13 * 14 * The above copyright notice and this permission notice shall be included in 15 * all copies or substantial portions of the Software. 16 * 17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 23 * THE SOFTWARE. 24 */ 25 26 #include "qemu/osdep.h" 27 #include "hw/nvram/xlnx-versal-efuse.h" 28 29 #include "qemu/log.h" 30 #include "qapi/error.h" 31 #include "migration/vmstate.h" 32 #include "hw/qdev-properties.h" 33 34 #ifndef XLNX_VERSAL_EFUSE_CTRL_ERR_DEBUG 35 #define XLNX_VERSAL_EFUSE_CTRL_ERR_DEBUG 0 36 #endif 37 38 REG32(WR_LOCK, 0x0) 39 FIELD(WR_LOCK, LOCK, 0, 16) 40 REG32(CFG, 0x4) 41 FIELD(CFG, SLVERR_ENABLE, 5, 1) 42 FIELD(CFG, MARGIN_RD, 2, 1) 43 FIELD(CFG, PGM_EN, 1, 1) 44 REG32(STATUS, 0x8) 45 FIELD(STATUS, AES_USER_KEY_1_CRC_PASS, 11, 1) 46 FIELD(STATUS, AES_USER_KEY_1_CRC_DONE, 10, 1) 47 FIELD(STATUS, AES_USER_KEY_0_CRC_PASS, 9, 1) 48 FIELD(STATUS, AES_USER_KEY_0_CRC_DONE, 8, 1) 49 FIELD(STATUS, AES_CRC_PASS, 7, 1) 50 FIELD(STATUS, AES_CRC_DONE, 6, 1) 51 FIELD(STATUS, CACHE_DONE, 5, 1) 52 FIELD(STATUS, CACHE_LOAD, 4, 1) 53 FIELD(STATUS, EFUSE_2_TBIT, 2, 1) 54 FIELD(STATUS, EFUSE_1_TBIT, 1, 1) 55 FIELD(STATUS, EFUSE_0_TBIT, 0, 1) 56 REG32(EFUSE_PGM_ADDR, 0xc) 57 FIELD(EFUSE_PGM_ADDR, PAGE, 13, 4) 58 FIELD(EFUSE_PGM_ADDR, ROW, 5, 8) 59 FIELD(EFUSE_PGM_ADDR, COLUMN, 0, 5) 60 REG32(EFUSE_RD_ADDR, 0x10) 61 FIELD(EFUSE_RD_ADDR, PAGE, 13, 4) 62 FIELD(EFUSE_RD_ADDR, ROW, 5, 8) 63 REG32(EFUSE_RD_DATA, 0x14) 64 REG32(TPGM, 0x18) 65 FIELD(TPGM, VALUE, 0, 16) 66 REG32(TRD, 0x1c) 67 FIELD(TRD, VALUE, 0, 8) 68 REG32(TSU_H_PS, 0x20) 69 FIELD(TSU_H_PS, VALUE, 0, 8) 70 REG32(TSU_H_PS_CS, 0x24) 71 FIELD(TSU_H_PS_CS, VALUE, 0, 8) 72 REG32(TRDM, 0x28) 73 FIELD(TRDM, VALUE, 0, 8) 74 REG32(TSU_H_CS, 0x2c) 75 FIELD(TSU_H_CS, VALUE, 0, 8) 76 REG32(EFUSE_ISR, 0x30) 77 FIELD(EFUSE_ISR, APB_SLVERR, 31, 1) 78 FIELD(EFUSE_ISR, CACHE_PARITY_E2, 14, 1) 79 FIELD(EFUSE_ISR, CACHE_PARITY_E1, 13, 1) 80 FIELD(EFUSE_ISR, CACHE_PARITY_E0S, 12, 1) 81 FIELD(EFUSE_ISR, CACHE_PARITY_E0R, 11, 1) 82 FIELD(EFUSE_ISR, CACHE_APB_SLVERR, 10, 1) 83 FIELD(EFUSE_ISR, CACHE_REQ_ERROR, 9, 1) 84 FIELD(EFUSE_ISR, MAIN_REQ_ERROR, 8, 1) 85 FIELD(EFUSE_ISR, READ_ON_CACHE_LD, 7, 1) 86 FIELD(EFUSE_ISR, CACHE_FSM_ERROR, 6, 1) 87 FIELD(EFUSE_ISR, MAIN_FSM_ERROR, 5, 1) 88 FIELD(EFUSE_ISR, CACHE_ERROR, 4, 1) 89 FIELD(EFUSE_ISR, RD_ERROR, 3, 1) 90 FIELD(EFUSE_ISR, RD_DONE, 2, 1) 91 FIELD(EFUSE_ISR, PGM_ERROR, 1, 1) 92 FIELD(EFUSE_ISR, PGM_DONE, 0, 1) 93 REG32(EFUSE_IMR, 0x34) 94 FIELD(EFUSE_IMR, APB_SLVERR, 31, 1) 95 FIELD(EFUSE_IMR, CACHE_PARITY_E2, 14, 1) 96 FIELD(EFUSE_IMR, CACHE_PARITY_E1, 13, 1) 97 FIELD(EFUSE_IMR, CACHE_PARITY_E0S, 12, 1) 98 FIELD(EFUSE_IMR, CACHE_PARITY_E0R, 11, 1) 99 FIELD(EFUSE_IMR, CACHE_APB_SLVERR, 10, 1) 100 FIELD(EFUSE_IMR, CACHE_REQ_ERROR, 9, 1) 101 FIELD(EFUSE_IMR, MAIN_REQ_ERROR, 8, 1) 102 FIELD(EFUSE_IMR, READ_ON_CACHE_LD, 7, 1) 103 FIELD(EFUSE_IMR, CACHE_FSM_ERROR, 6, 1) 104 FIELD(EFUSE_IMR, MAIN_FSM_ERROR, 5, 1) 105 FIELD(EFUSE_IMR, CACHE_ERROR, 4, 1) 106 FIELD(EFUSE_IMR, RD_ERROR, 3, 1) 107 FIELD(EFUSE_IMR, RD_DONE, 2, 1) 108 FIELD(EFUSE_IMR, PGM_ERROR, 1, 1) 109 FIELD(EFUSE_IMR, PGM_DONE, 0, 1) 110 REG32(EFUSE_IER, 0x38) 111 FIELD(EFUSE_IER, APB_SLVERR, 31, 1) 112 FIELD(EFUSE_IER, CACHE_PARITY_E2, 14, 1) 113 FIELD(EFUSE_IER, CACHE_PARITY_E1, 13, 1) 114 FIELD(EFUSE_IER, CACHE_PARITY_E0S, 12, 1) 115 FIELD(EFUSE_IER, CACHE_PARITY_E0R, 11, 1) 116 FIELD(EFUSE_IER, CACHE_APB_SLVERR, 10, 1) 117 FIELD(EFUSE_IER, CACHE_REQ_ERROR, 9, 1) 118 FIELD(EFUSE_IER, MAIN_REQ_ERROR, 8, 1) 119 FIELD(EFUSE_IER, READ_ON_CACHE_LD, 7, 1) 120 FIELD(EFUSE_IER, CACHE_FSM_ERROR, 6, 1) 121 FIELD(EFUSE_IER, MAIN_FSM_ERROR, 5, 1) 122 FIELD(EFUSE_IER, CACHE_ERROR, 4, 1) 123 FIELD(EFUSE_IER, RD_ERROR, 3, 1) 124 FIELD(EFUSE_IER, RD_DONE, 2, 1) 125 FIELD(EFUSE_IER, PGM_ERROR, 1, 1) 126 FIELD(EFUSE_IER, PGM_DONE, 0, 1) 127 REG32(EFUSE_IDR, 0x3c) 128 FIELD(EFUSE_IDR, APB_SLVERR, 31, 1) 129 FIELD(EFUSE_IDR, CACHE_PARITY_E2, 14, 1) 130 FIELD(EFUSE_IDR, CACHE_PARITY_E1, 13, 1) 131 FIELD(EFUSE_IDR, CACHE_PARITY_E0S, 12, 1) 132 FIELD(EFUSE_IDR, CACHE_PARITY_E0R, 11, 1) 133 FIELD(EFUSE_IDR, CACHE_APB_SLVERR, 10, 1) 134 FIELD(EFUSE_IDR, CACHE_REQ_ERROR, 9, 1) 135 FIELD(EFUSE_IDR, MAIN_REQ_ERROR, 8, 1) 136 FIELD(EFUSE_IDR, READ_ON_CACHE_LD, 7, 1) 137 FIELD(EFUSE_IDR, CACHE_FSM_ERROR, 6, 1) 138 FIELD(EFUSE_IDR, MAIN_FSM_ERROR, 5, 1) 139 FIELD(EFUSE_IDR, CACHE_ERROR, 4, 1) 140 FIELD(EFUSE_IDR, RD_ERROR, 3, 1) 141 FIELD(EFUSE_IDR, RD_DONE, 2, 1) 142 FIELD(EFUSE_IDR, PGM_ERROR, 1, 1) 143 FIELD(EFUSE_IDR, PGM_DONE, 0, 1) 144 REG32(EFUSE_CACHE_LOAD, 0x40) 145 FIELD(EFUSE_CACHE_LOAD, LOAD, 0, 1) 146 REG32(EFUSE_PGM_LOCK, 0x44) 147 FIELD(EFUSE_PGM_LOCK, SPK_ID_LOCK, 0, 1) 148 REG32(EFUSE_AES_CRC, 0x48) 149 REG32(EFUSE_AES_USR_KEY0_CRC, 0x4c) 150 REG32(EFUSE_AES_USR_KEY1_CRC, 0x50) 151 REG32(EFUSE_PD, 0x54) 152 REG32(EFUSE_ANLG_OSC_SW_1LP, 0x60) 153 REG32(EFUSE_TEST_CTRL, 0x100) 154 155 #define R_MAX (R_EFUSE_TEST_CTRL + 1) 156 157 #define R_WR_LOCK_UNLOCK_PASSCODE (0xDF0D) 158 159 /* 160 * eFuse layout references: 161 * https://github.com/Xilinx/embeddedsw/blob/release-2019.2/lib/sw_services/xilnvm/src/xnvm_efuse_hw.h 162 */ 163 #define BIT_POS_OF(A_) \ 164 ((uint32_t)((A_) & (R_EFUSE_PGM_ADDR_ROW_MASK | \ 165 R_EFUSE_PGM_ADDR_COLUMN_MASK))) 166 167 #define BIT_POS(R_, C_) \ 168 ((uint32_t)((R_EFUSE_PGM_ADDR_ROW_MASK \ 169 & ((R_) << R_EFUSE_PGM_ADDR_ROW_SHIFT)) \ 170 | \ 171 (R_EFUSE_PGM_ADDR_COLUMN_MASK \ 172 & ((C_) << R_EFUSE_PGM_ADDR_COLUMN_SHIFT)))) 173 174 #define EFUSE_TBIT_POS(A_) (BIT_POS_OF(A_) >= BIT_POS(0, 28)) 175 176 #define EFUSE_ANCHOR_ROW (0) 177 #define EFUSE_ANCHOR_3_COL (27) 178 #define EFUSE_ANCHOR_1_COL (1) 179 180 #define EFUSE_AES_KEY_START BIT_POS(12, 0) 181 #define EFUSE_AES_KEY_END BIT_POS(19, 31) 182 #define EFUSE_USER_KEY_0_START BIT_POS(20, 0) 183 #define EFUSE_USER_KEY_0_END BIT_POS(27, 31) 184 #define EFUSE_USER_KEY_1_START BIT_POS(28, 0) 185 #define EFUSE_USER_KEY_1_END BIT_POS(35, 31) 186 187 #define EFUSE_RD_BLOCKED_START EFUSE_AES_KEY_START 188 #define EFUSE_RD_BLOCKED_END EFUSE_USER_KEY_1_END 189 190 #define EFUSE_GLITCH_DET_WR_LK BIT_POS(4, 31) 191 #define EFUSE_PPK0_WR_LK BIT_POS(43, 6) 192 #define EFUSE_PPK1_WR_LK BIT_POS(43, 7) 193 #define EFUSE_PPK2_WR_LK BIT_POS(43, 8) 194 #define EFUSE_AES_WR_LK BIT_POS(43, 11) 195 #define EFUSE_USER_KEY_0_WR_LK BIT_POS(43, 13) 196 #define EFUSE_USER_KEY_1_WR_LK BIT_POS(43, 15) 197 #define EFUSE_PUF_SYN_LK BIT_POS(43, 16) 198 #define EFUSE_DNA_WR_LK BIT_POS(43, 27) 199 #define EFUSE_BOOT_ENV_WR_LK BIT_POS(43, 28) 200 201 #define EFUSE_PGM_LOCKED_START BIT_POS(44, 0) 202 #define EFUSE_PGM_LOCKED_END BIT_POS(51, 31) 203 204 #define EFUSE_PUF_PAGE (2) 205 #define EFUSE_PUF_SYN_START BIT_POS(129, 0) 206 #define EFUSE_PUF_SYN_END BIT_POS(255, 27) 207 208 #define EFUSE_KEY_CRC_LK_ROW (43) 209 #define EFUSE_AES_KEY_CRC_LK_MASK ((1U << 9) | (1U << 10)) 210 #define EFUSE_USER_KEY_0_CRC_LK_MASK (1U << 12) 211 #define EFUSE_USER_KEY_1_CRC_LK_MASK (1U << 14) 212 213 /* 214 * A handy macro to return value of an array element, 215 * or a specific default if given index is out of bound. 216 */ 217 #define ARRAY_GET(A_, I_, D_) \ 218 ((unsigned int)(I_) < ARRAY_SIZE(A_) ? (A_)[I_] : (D_)) 219 220 QEMU_BUILD_BUG_ON(R_MAX != ARRAY_SIZE(((XlnxVersalEFuseCtrl *)0)->regs)); 221 222 typedef struct XlnxEFuseLkSpec { 223 uint16_t row; 224 uint16_t lk_bit; 225 } XlnxEFuseLkSpec; 226 227 static void efuse_imr_update_irq(XlnxVersalEFuseCtrl *s) 228 { 229 bool pending = s->regs[R_EFUSE_ISR] & ~s->regs[R_EFUSE_IMR]; 230 qemu_set_irq(s->irq_efuse_imr, pending); 231 } 232 233 static void efuse_isr_postw(RegisterInfo *reg, uint64_t val64) 234 { 235 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(reg->opaque); 236 efuse_imr_update_irq(s); 237 } 238 239 static uint64_t efuse_ier_prew(RegisterInfo *reg, uint64_t val64) 240 { 241 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(reg->opaque); 242 uint32_t val = val64; 243 244 s->regs[R_EFUSE_IMR] &= ~val; 245 efuse_imr_update_irq(s); 246 return 0; 247 } 248 249 static uint64_t efuse_idr_prew(RegisterInfo *reg, uint64_t val64) 250 { 251 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(reg->opaque); 252 uint32_t val = val64; 253 254 s->regs[R_EFUSE_IMR] |= val; 255 efuse_imr_update_irq(s); 256 return 0; 257 } 258 259 static void efuse_status_tbits_sync(XlnxVersalEFuseCtrl *s) 260 { 261 uint32_t check = xlnx_efuse_tbits_check(s->efuse); 262 uint32_t val = s->regs[R_STATUS]; 263 264 val = FIELD_DP32(val, STATUS, EFUSE_0_TBIT, !!(check & (1 << 0))); 265 val = FIELD_DP32(val, STATUS, EFUSE_1_TBIT, !!(check & (1 << 1))); 266 val = FIELD_DP32(val, STATUS, EFUSE_2_TBIT, !!(check & (1 << 2))); 267 268 s->regs[R_STATUS] = val; 269 } 270 271 static void efuse_anchor_bits_check(XlnxVersalEFuseCtrl *s) 272 { 273 unsigned page; 274 275 if (!s->efuse || !s->efuse->init_tbits) { 276 return; 277 } 278 279 for (page = 0; page < s->efuse->efuse_nr; page++) { 280 uint32_t row = 0, bit; 281 282 row = FIELD_DP32(row, EFUSE_PGM_ADDR, PAGE, page); 283 row = FIELD_DP32(row, EFUSE_PGM_ADDR, ROW, EFUSE_ANCHOR_ROW); 284 285 bit = FIELD_DP32(row, EFUSE_PGM_ADDR, COLUMN, EFUSE_ANCHOR_3_COL); 286 if (!xlnx_efuse_get_bit(s->efuse, bit)) { 287 xlnx_efuse_set_bit(s->efuse, bit); 288 } 289 290 bit = FIELD_DP32(row, EFUSE_PGM_ADDR, COLUMN, EFUSE_ANCHOR_1_COL); 291 if (!xlnx_efuse_get_bit(s->efuse, bit)) { 292 xlnx_efuse_set_bit(s->efuse, bit); 293 } 294 } 295 } 296 297 static void efuse_key_crc_check(RegisterInfo *reg, uint32_t crc, 298 uint32_t pass_mask, uint32_t done_mask, 299 unsigned first, uint32_t lk_mask) 300 { 301 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(reg->opaque); 302 uint32_t r, lk_bits; 303 304 /* 305 * To start, assume both DONE and PASS, and clear PASS by xor 306 * if CRC-check fails or CRC-check disabled by lock fuse. 307 */ 308 r = s->regs[R_STATUS] | done_mask | pass_mask; 309 310 lk_bits = xlnx_efuse_get_row(s->efuse, EFUSE_KEY_CRC_LK_ROW) & lk_mask; 311 if (lk_bits == 0 && xlnx_efuse_k256_check(s->efuse, crc, first)) { 312 pass_mask = 0; 313 } 314 315 s->regs[R_STATUS] = r ^ pass_mask; 316 } 317 318 static void efuse_data_sync(XlnxVersalEFuseCtrl *s) 319 { 320 efuse_status_tbits_sync(s); 321 } 322 323 static int efuse_lk_spec_cmp(const void *a, const void *b) 324 { 325 uint16_t r1 = ((const XlnxEFuseLkSpec *)a)->row; 326 uint16_t r2 = ((const XlnxEFuseLkSpec *)b)->row; 327 328 return (r1 > r2) - (r1 < r2); 329 } 330 331 static void efuse_lk_spec_sort(XlnxVersalEFuseCtrl *s) 332 { 333 XlnxEFuseLkSpec *ary = s->extra_pg0_lock_spec; 334 const uint32_t n8 = s->extra_pg0_lock_n16 * 2; 335 const uint32_t sz = sizeof(ary[0]); 336 const uint32_t cnt = n8 / sz; 337 338 if (ary && cnt) { 339 qsort(ary, cnt, sz, efuse_lk_spec_cmp); 340 } 341 } 342 343 static uint32_t efuse_lk_spec_find(XlnxVersalEFuseCtrl *s, uint32_t row) 344 { 345 const XlnxEFuseLkSpec *ary = s->extra_pg0_lock_spec; 346 const uint32_t n8 = s->extra_pg0_lock_n16 * 2; 347 const uint32_t sz = sizeof(ary[0]); 348 const uint32_t cnt = n8 / sz; 349 const XlnxEFuseLkSpec *item = NULL; 350 351 if (ary && cnt) { 352 XlnxEFuseLkSpec k = { .row = row, }; 353 354 item = bsearch(&k, ary, cnt, sz, efuse_lk_spec_cmp); 355 } 356 357 return item ? item->lk_bit : 0; 358 } 359 360 static uint32_t efuse_bit_locked(XlnxVersalEFuseCtrl *s, uint32_t bit) 361 { 362 /* Hard-coded locks */ 363 static const uint16_t pg0_hard_lock[] = { 364 [4] = EFUSE_GLITCH_DET_WR_LK, 365 [37] = EFUSE_BOOT_ENV_WR_LK, 366 367 [8 ... 11] = EFUSE_DNA_WR_LK, 368 [12 ... 19] = EFUSE_AES_WR_LK, 369 [20 ... 27] = EFUSE_USER_KEY_0_WR_LK, 370 [28 ... 35] = EFUSE_USER_KEY_1_WR_LK, 371 [64 ... 71] = EFUSE_PPK0_WR_LK, 372 [72 ... 79] = EFUSE_PPK1_WR_LK, 373 [80 ... 87] = EFUSE_PPK2_WR_LK, 374 }; 375 376 uint32_t row = FIELD_EX32(bit, EFUSE_PGM_ADDR, ROW); 377 uint32_t lk_bit = ARRAY_GET(pg0_hard_lock, row, 0); 378 379 return lk_bit ? lk_bit : efuse_lk_spec_find(s, row); 380 } 381 382 static bool efuse_pgm_locked(XlnxVersalEFuseCtrl *s, unsigned int bit) 383 { 384 385 unsigned int lock = 1; 386 387 /* Global lock */ 388 if (!ARRAY_FIELD_EX32(s->regs, CFG, PGM_EN)) { 389 goto ret_lock; 390 } 391 392 /* Row lock */ 393 switch (FIELD_EX32(bit, EFUSE_PGM_ADDR, PAGE)) { 394 case 0: 395 if (ARRAY_FIELD_EX32(s->regs, EFUSE_PGM_LOCK, SPK_ID_LOCK) && 396 bit >= EFUSE_PGM_LOCKED_START && bit <= EFUSE_PGM_LOCKED_END) { 397 goto ret_lock; 398 } 399 400 lock = efuse_bit_locked(s, bit); 401 break; 402 case EFUSE_PUF_PAGE: 403 if (bit < EFUSE_PUF_SYN_START || bit > EFUSE_PUF_SYN_END) { 404 lock = 0; 405 goto ret_lock; 406 } 407 408 lock = EFUSE_PUF_SYN_LK; 409 break; 410 default: 411 lock = 0; 412 goto ret_lock; 413 } 414 415 /* Row lock by an efuse bit */ 416 if (lock) { 417 lock = xlnx_efuse_get_bit(s->efuse, lock); 418 } 419 420 ret_lock: 421 return lock != 0; 422 } 423 424 static void efuse_pgm_addr_postw(RegisterInfo *reg, uint64_t val64) 425 { 426 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(reg->opaque); 427 unsigned bit = val64; 428 bool ok = false; 429 430 /* Always zero out PGM_ADDR because it is write-only */ 431 s->regs[R_EFUSE_PGM_ADDR] = 0; 432 433 /* 434 * Indicate error if bit is write-protected (or read-only 435 * as guarded by efuse_set_bit()). 436 * 437 * Keep it simple by not modeling program timing. 438 * 439 * Note: model must NEVER clear the PGM_ERROR bit; it is 440 * up to guest to do so (or by reset). 441 */ 442 if (efuse_pgm_locked(s, bit)) { 443 g_autofree char *path = object_get_canonical_path(OBJECT(s)); 444 445 qemu_log_mask(LOG_GUEST_ERROR, 446 "%s: Denied setting of efuse<%u, %u, %u>\n", 447 path, 448 FIELD_EX32(bit, EFUSE_PGM_ADDR, PAGE), 449 FIELD_EX32(bit, EFUSE_PGM_ADDR, ROW), 450 FIELD_EX32(bit, EFUSE_PGM_ADDR, COLUMN)); 451 } else if (xlnx_efuse_set_bit(s->efuse, bit)) { 452 ok = true; 453 if (EFUSE_TBIT_POS(bit)) { 454 efuse_status_tbits_sync(s); 455 } 456 } 457 458 if (!ok) { 459 ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, PGM_ERROR, 1); 460 } 461 462 ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, PGM_DONE, 1); 463 efuse_imr_update_irq(s); 464 } 465 466 static void efuse_rd_addr_postw(RegisterInfo *reg, uint64_t val64) 467 { 468 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(reg->opaque); 469 unsigned bit = val64; 470 bool denied; 471 472 /* Always zero out RD_ADDR because it is write-only */ 473 s->regs[R_EFUSE_RD_ADDR] = 0; 474 475 /* 476 * Indicate error if row is read-blocked. 477 * 478 * Note: model must NEVER clear the RD_ERROR bit; it is 479 * up to guest to do so (or by reset). 480 */ 481 s->regs[R_EFUSE_RD_DATA] = xlnx_versal_efuse_read_row(s->efuse, 482 bit, &denied); 483 if (denied) { 484 g_autofree char *path = object_get_canonical_path(OBJECT(s)); 485 486 qemu_log_mask(LOG_GUEST_ERROR, 487 "%s: Denied reading of efuse<%u, %u>\n", 488 path, 489 FIELD_EX32(bit, EFUSE_RD_ADDR, PAGE), 490 FIELD_EX32(bit, EFUSE_RD_ADDR, ROW)); 491 492 ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, RD_ERROR, 1); 493 } 494 495 ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, RD_DONE, 1); 496 efuse_imr_update_irq(s); 497 return; 498 } 499 500 static uint64_t efuse_cache_load_prew(RegisterInfo *reg, uint64_t val64) 501 { 502 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(reg->opaque); 503 504 if (val64 & R_EFUSE_CACHE_LOAD_LOAD_MASK) { 505 efuse_data_sync(s); 506 507 ARRAY_FIELD_DP32(s->regs, STATUS, CACHE_DONE, 1); 508 efuse_imr_update_irq(s); 509 } 510 511 return 0; 512 } 513 514 static uint64_t efuse_pgm_lock_prew(RegisterInfo *reg, uint64_t val64) 515 { 516 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(reg->opaque); 517 518 /* Ignore all other bits */ 519 val64 = FIELD_EX32(val64, EFUSE_PGM_LOCK, SPK_ID_LOCK); 520 521 /* Once the bit is written 1, only reset will clear it to 0 */ 522 val64 |= ARRAY_FIELD_EX32(s->regs, EFUSE_PGM_LOCK, SPK_ID_LOCK); 523 524 return val64; 525 } 526 527 static void efuse_aes_crc_postw(RegisterInfo *reg, uint64_t val64) 528 { 529 efuse_key_crc_check(reg, val64, 530 R_STATUS_AES_CRC_PASS_MASK, 531 R_STATUS_AES_CRC_DONE_MASK, 532 EFUSE_AES_KEY_START, 533 EFUSE_AES_KEY_CRC_LK_MASK); 534 } 535 536 static void efuse_aes_u0_crc_postw(RegisterInfo *reg, uint64_t val64) 537 { 538 efuse_key_crc_check(reg, val64, 539 R_STATUS_AES_USER_KEY_0_CRC_PASS_MASK, 540 R_STATUS_AES_USER_KEY_0_CRC_DONE_MASK, 541 EFUSE_USER_KEY_0_START, 542 EFUSE_USER_KEY_0_CRC_LK_MASK); 543 } 544 545 static void efuse_aes_u1_crc_postw(RegisterInfo *reg, uint64_t val64) 546 { 547 efuse_key_crc_check(reg, val64, 548 R_STATUS_AES_USER_KEY_1_CRC_PASS_MASK, 549 R_STATUS_AES_USER_KEY_1_CRC_DONE_MASK, 550 EFUSE_USER_KEY_1_START, 551 EFUSE_USER_KEY_1_CRC_LK_MASK); 552 } 553 554 static uint64_t efuse_wr_lock_prew(RegisterInfo *reg, uint64_t val) 555 { 556 return val != R_WR_LOCK_UNLOCK_PASSCODE; 557 } 558 559 static const RegisterAccessInfo efuse_ctrl_regs_info[] = { 560 { .name = "WR_LOCK", .addr = A_WR_LOCK, 561 .reset = 0x1, 562 .pre_write = efuse_wr_lock_prew, 563 },{ .name = "CFG", .addr = A_CFG, 564 .rsvd = 0x9, 565 },{ .name = "STATUS", .addr = A_STATUS, 566 .rsvd = 0x8, 567 .ro = 0xfff, 568 },{ .name = "EFUSE_PGM_ADDR", .addr = A_EFUSE_PGM_ADDR, 569 .post_write = efuse_pgm_addr_postw, 570 },{ .name = "EFUSE_RD_ADDR", .addr = A_EFUSE_RD_ADDR, 571 .rsvd = 0x1f, 572 .post_write = efuse_rd_addr_postw, 573 },{ .name = "EFUSE_RD_DATA", .addr = A_EFUSE_RD_DATA, 574 .ro = 0xffffffff, 575 },{ .name = "TPGM", .addr = A_TPGM, 576 },{ .name = "TRD", .addr = A_TRD, 577 .reset = 0x19, 578 },{ .name = "TSU_H_PS", .addr = A_TSU_H_PS, 579 .reset = 0xff, 580 },{ .name = "TSU_H_PS_CS", .addr = A_TSU_H_PS_CS, 581 .reset = 0x11, 582 },{ .name = "TRDM", .addr = A_TRDM, 583 .reset = 0x3a, 584 },{ .name = "TSU_H_CS", .addr = A_TSU_H_CS, 585 .reset = 0x16, 586 },{ .name = "EFUSE_ISR", .addr = A_EFUSE_ISR, 587 .rsvd = 0x7fff8000, 588 .w1c = 0x80007fff, 589 .post_write = efuse_isr_postw, 590 },{ .name = "EFUSE_IMR", .addr = A_EFUSE_IMR, 591 .reset = 0x80007fff, 592 .rsvd = 0x7fff8000, 593 .ro = 0xffffffff, 594 },{ .name = "EFUSE_IER", .addr = A_EFUSE_IER, 595 .rsvd = 0x7fff8000, 596 .pre_write = efuse_ier_prew, 597 },{ .name = "EFUSE_IDR", .addr = A_EFUSE_IDR, 598 .rsvd = 0x7fff8000, 599 .pre_write = efuse_idr_prew, 600 },{ .name = "EFUSE_CACHE_LOAD", .addr = A_EFUSE_CACHE_LOAD, 601 .pre_write = efuse_cache_load_prew, 602 },{ .name = "EFUSE_PGM_LOCK", .addr = A_EFUSE_PGM_LOCK, 603 .pre_write = efuse_pgm_lock_prew, 604 },{ .name = "EFUSE_AES_CRC", .addr = A_EFUSE_AES_CRC, 605 .post_write = efuse_aes_crc_postw, 606 },{ .name = "EFUSE_AES_USR_KEY0_CRC", .addr = A_EFUSE_AES_USR_KEY0_CRC, 607 .post_write = efuse_aes_u0_crc_postw, 608 },{ .name = "EFUSE_AES_USR_KEY1_CRC", .addr = A_EFUSE_AES_USR_KEY1_CRC, 609 .post_write = efuse_aes_u1_crc_postw, 610 },{ .name = "EFUSE_PD", .addr = A_EFUSE_PD, 611 .ro = 0xfffffffe, 612 },{ .name = "EFUSE_ANLG_OSC_SW_1LP", .addr = A_EFUSE_ANLG_OSC_SW_1LP, 613 },{ .name = "EFUSE_TEST_CTRL", .addr = A_EFUSE_TEST_CTRL, 614 .reset = 0x8, 615 } 616 }; 617 618 static void efuse_ctrl_reg_write(void *opaque, hwaddr addr, 619 uint64_t data, unsigned size) 620 { 621 RegisterInfoArray *reg_array = opaque; 622 XlnxVersalEFuseCtrl *s; 623 Object *dev; 624 625 assert(reg_array != NULL); 626 627 dev = reg_array->mem.owner; 628 assert(dev); 629 630 s = XLNX_VERSAL_EFUSE_CTRL(dev); 631 632 if (addr != A_WR_LOCK && s->regs[R_WR_LOCK]) { 633 g_autofree char *path = object_get_canonical_path(OBJECT(s)); 634 635 qemu_log_mask(LOG_GUEST_ERROR, 636 "%s[reg_0x%02lx]: Attempt to write locked register.\n", 637 path, (long)addr); 638 } else { 639 register_write_memory(opaque, addr, data, size); 640 } 641 } 642 643 static void efuse_ctrl_register_reset(RegisterInfo *reg) 644 { 645 if (!reg->data || !reg->access) { 646 return; 647 } 648 649 /* Reset must not trigger some registers' writers */ 650 switch (reg->access->addr) { 651 case A_EFUSE_AES_CRC: 652 case A_EFUSE_AES_USR_KEY0_CRC: 653 case A_EFUSE_AES_USR_KEY1_CRC: 654 *(uint32_t *)reg->data = reg->access->reset; 655 return; 656 } 657 658 register_reset(reg); 659 } 660 661 static void efuse_ctrl_reset_hold(Object *obj, ResetType type) 662 { 663 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(obj); 664 unsigned int i; 665 666 for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) { 667 efuse_ctrl_register_reset(&s->regs_info[i]); 668 } 669 670 efuse_anchor_bits_check(s); 671 efuse_data_sync(s); 672 efuse_imr_update_irq(s); 673 } 674 675 static const MemoryRegionOps efuse_ctrl_ops = { 676 .read = register_read_memory, 677 .write = efuse_ctrl_reg_write, 678 .endianness = DEVICE_LITTLE_ENDIAN, 679 .valid = { 680 .min_access_size = 4, 681 .max_access_size = 4, 682 }, 683 }; 684 685 static void efuse_ctrl_realize(DeviceState *dev, Error **errp) 686 { 687 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(dev); 688 const uint32_t lks_sz = sizeof(XlnxEFuseLkSpec) / 2; 689 690 if (!s->efuse) { 691 g_autofree char *path = object_get_canonical_path(OBJECT(s)); 692 693 error_setg(errp, "%s.efuse: link property not connected to XLNX-EFUSE", 694 path); 695 return; 696 } 697 698 /* Sort property-defined pgm-locks for bsearch lookup */ 699 if ((s->extra_pg0_lock_n16 % lks_sz) != 0) { 700 g_autofree char *path = object_get_canonical_path(OBJECT(s)); 701 702 error_setg(errp, 703 "%s.pg0-lock: array property item-count not multiple of %u", 704 path, lks_sz); 705 return; 706 } 707 708 efuse_lk_spec_sort(s); 709 } 710 711 static void efuse_ctrl_init(Object *obj) 712 { 713 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(obj); 714 SysBusDevice *sbd = SYS_BUS_DEVICE(obj); 715 716 s->reg_array = 717 register_init_block32(DEVICE(obj), efuse_ctrl_regs_info, 718 ARRAY_SIZE(efuse_ctrl_regs_info), 719 s->regs_info, s->regs, 720 &efuse_ctrl_ops, 721 XLNX_VERSAL_EFUSE_CTRL_ERR_DEBUG, 722 R_MAX * 4); 723 724 sysbus_init_mmio(sbd, &s->reg_array->mem); 725 sysbus_init_irq(sbd, &s->irq_efuse_imr); 726 } 727 728 static void efuse_ctrl_finalize(Object *obj) 729 { 730 XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(obj); 731 732 register_finalize_block(s->reg_array); 733 g_free(s->extra_pg0_lock_spec); 734 } 735 736 static const VMStateDescription vmstate_efuse_ctrl = { 737 .name = TYPE_XLNX_VERSAL_EFUSE_CTRL, 738 .version_id = 1, 739 .minimum_version_id = 1, 740 .fields = (const VMStateField[]) { 741 VMSTATE_UINT32_ARRAY(regs, XlnxVersalEFuseCtrl, R_MAX), 742 VMSTATE_END_OF_LIST(), 743 } 744 }; 745 746 static Property efuse_ctrl_props[] = { 747 DEFINE_PROP_LINK("efuse", 748 XlnxVersalEFuseCtrl, efuse, 749 TYPE_XLNX_EFUSE, XlnxEFuse *), 750 DEFINE_PROP_ARRAY("pg0-lock", 751 XlnxVersalEFuseCtrl, extra_pg0_lock_n16, 752 extra_pg0_lock_spec, qdev_prop_uint16, uint16_t), 753 754 DEFINE_PROP_END_OF_LIST(), 755 }; 756 757 static void efuse_ctrl_class_init(ObjectClass *klass, void *data) 758 { 759 DeviceClass *dc = DEVICE_CLASS(klass); 760 ResettableClass *rc = RESETTABLE_CLASS(klass); 761 762 rc->phases.hold = efuse_ctrl_reset_hold; 763 dc->realize = efuse_ctrl_realize; 764 dc->vmsd = &vmstate_efuse_ctrl; 765 device_class_set_props(dc, efuse_ctrl_props); 766 } 767 768 static const TypeInfo efuse_ctrl_info = { 769 .name = TYPE_XLNX_VERSAL_EFUSE_CTRL, 770 .parent = TYPE_SYS_BUS_DEVICE, 771 .instance_size = sizeof(XlnxVersalEFuseCtrl), 772 .class_init = efuse_ctrl_class_init, 773 .instance_init = efuse_ctrl_init, 774 .instance_finalize = efuse_ctrl_finalize, 775 }; 776 777 static void efuse_ctrl_register_types(void) 778 { 779 type_register_static(&efuse_ctrl_info); 780 } 781 782 type_init(efuse_ctrl_register_types) 783 784 /* 785 * Retrieve a row, with unreadable bits returned as 0. 786 */ 787 uint32_t xlnx_versal_efuse_read_row(XlnxEFuse *efuse, 788 uint32_t bit, bool *denied) 789 { 790 bool dummy; 791 792 if (!denied) { 793 denied = &dummy; 794 } 795 796 if (bit >= EFUSE_RD_BLOCKED_START && bit <= EFUSE_RD_BLOCKED_END) { 797 *denied = true; 798 return 0; 799 } 800 801 *denied = false; 802 return xlnx_efuse_get_row(efuse, bit); 803 } 804