From: Kane-Chen-AS <kane_c...@aspeedtech.com>
This patch connects the aspeed.otpmem device to the ASPEED Secure Boot
Controller (SBC) model. It implements OTP memory access via the SBC's
command interface and enables emulation of secure fuse programming flows.
The following OTP commands are supported:
- READ: reads a 32-bit word from OTP memory into internal registers
- PROG: programs a 32-bit word value to the specified OTP address
Trace events are added to observe read/program operations and command
handling flow.
Signed-off-by: Kane-Chen-AS <kane_c...@aspeedtech.com>
---
hw/misc/aspeed_sbc.c | 92 ++++++++++++++++++++++++++++++++++++
hw/misc/trace-events | 7 +++
include/hw/misc/aspeed_sbc.h | 3 ++
3 files changed, 102 insertions(+)
diff --git a/hw/misc/aspeed_sbc.c b/hw/misc/aspeed_sbc.c
index a7d101ba71..3bc5e37c6b 100644
--- a/hw/misc/aspeed_sbc.c
+++ b/hw/misc/aspeed_sbc.c
@@ -15,9 +15,13 @@
#include "hw/misc/aspeed_sbc.h"
#include "qapi/error.h"
#include "migration/vmstate.h"
+#include "trace.h"
#define R_PROT (0x000 / 4)
+#define R_CMD (0x004 / 4)
+#define R_ADDR (0x010 / 4)
#define R_STATUS (0x014 / 4)
+#define R_CAMP1 (0x020 / 4)
#define R_QSR (0x040 / 4)
/* R_STATUS */
@@ -41,6 +45,11 @@
#define QSR_RSA_MASK (0x3 << 12)
#define QSR_HASH_MASK (0x3 << 10)
+typedef enum {
+ SBC_OTP_CMD_READ = 0x23b1e361,
+ SBC_OTP_CMD_PROG = 0x23b1e364,
+} SBC_OTP_Command;
+
static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr, unsigned int size)
{
AspeedSBCState *s = ASPEED_SBC(opaque);
@@ -57,6 +66,78 @@ static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr,
unsigned int size)
return s->regs[addr];
}
+static bool aspeed_sbc_otpmem_read(AspeedSBCState *s,
+ uint32_t otp_addr, Error **errp)
+{
+ MemTxResult ret;
+ AspeedOTPMemState *otpmem = ASPEED_OTPMEM(s->otpmem);
+ uint32_t value;
+
+ if (otpmem == NULL) {
+ return true;
+ }
+ ret = address_space_read(&otpmem->as, otp_addr, MEMTXATTRS_UNSPECIFIED,
+ &value, sizeof(value));
+ if (ret != 0) {
+ qemu_log_mask(LOG_GUEST_ERROR, "Failed to read OTP memory\n");
+ return false;
+ }
+ s->regs[R_CAMP1] = value;
+ trace_aspeed_sbc_otp_read(otp_addr, value);
+
+ return true;
+}
+
+static bool aspeed_sbc_otpmem_prog(AspeedSBCState *s,
+ uint32_t otp_addr, Error **errp)
+{
+ AspeedOTPMemState *otpmem = ASPEED_OTPMEM(s->otpmem);
+ uint32_t value = 0x12345678;
+
+ if (otpmem == NULL) {
+ return true;
+ }
+ address_space_write(&otpmem->as, otp_addr, MEMTXATTRS_UNSPECIFIED,
+ &value, sizeof(value));
+ trace_aspeed_sbc_otp_prog(otp_addr, value);
+
+ return true;
+}
+
+static void aspeed_sbc_handle_command(void *opaque, uint32_t cmd)
+{
+ AspeedSBCState *s = ASPEED_SBC(opaque);
+ Error *local_err = NULL;
+ bool ret = false;
+ uint32_t otp_addr;
+
+ s->regs[R_STATUS] &= ~(OTP_MEM_IDLE | OTP_IDLE);
+ otp_addr = s->regs[R_ADDR];
+
+ switch (cmd) {
+ case SBC_OTP_CMD_READ:
+ ret = aspeed_sbc_otpmem_read(s, otp_addr, &local_err);
+ break;
+ case SBC_OTP_CMD_PROG:
+ ret = aspeed_sbc_otpmem_prog(s, otp_addr, &local_err);
+ break;
+ default:
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: Unknown command 0x%x\n",
+ __func__, cmd);
+ break;
+ }
+
+ trace_aspeed_sbc_handle_cmd(cmd, otp_addr, ret);
+ if (ret == false && local_err) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: %s\n",
+ __func__, error_get_pretty(local_err));
+ error_free(local_err);
+ }
+ s->regs[R_STATUS] |= (OTP_MEM_IDLE | OTP_IDLE);
+}
+
static void aspeed_sbc_write(void *opaque, hwaddr addr, uint64_t data,
unsigned int size)
{
@@ -78,6 +159,9 @@ static void aspeed_sbc_write(void *opaque, hwaddr addr,
uint64_t data,
"%s: write to read only register 0x%" HWADDR_PRIx "\n",
__func__, addr << 2);
return;
+ case R_CMD:
+ aspeed_sbc_handle_command(opaque, data);
+ return;
default:
break;
}
@@ -119,11 +203,19 @@ static void aspeed_sbc_realize(DeviceState *dev, Error
**errp)
{
AspeedSBCState *s = ASPEED_SBC(dev);
SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+ AspeedSBCClass *sc = ASPEED_SBC_GET_CLASS(s);
memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_sbc_ops, s,
TYPE_ASPEED_SBC, 0x1000);
sysbus_init_mmio(sbd, &s->iomem);
+
+ if (sc->has_otpmem) {
+ s->otpmem = ASPEED_OTPMEM(object_new(TYPE_ASPEED_OTPMEM));
+ object_initialize_child(OBJECT(s), "otp", s->otpmem,
+ TYPE_ASPEED_OTPMEM);
+ qdev_realize(DEVICE(s->otpmem), NULL, errp);
+ }
}
static const VMStateDescription vmstate_aspeed_sbc = {
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index e3f64c0ff6..0f6e2038cf 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -90,6 +90,13 @@ slavio_sysctrl_mem_readl(uint32_t ret) "Read system control
0x%08x"
slavio_led_mem_writew(uint32_t val) "Write diagnostic LED 0x%04x"
slavio_led_mem_readw(uint32_t ret) "Read diagnostic LED 0x%04x"
+# aspped_sbc.c
+aspeed_sbc_otpmem_state(const char *enabled) "OTP Memory is %s"
+aspeed_sbc_ignore_cmd(uint32_t cmd) "Ignoring command 0x%" PRIx32
+aspeed_sbc_handle_cmd(uint32_t cmd, uint32_t addr, bool ret) "Handling command
0x%" PRIx32 " for OTP addr 0x%" PRIx32 " Result: %d"
+aspeed_sbc_otp_read(uint32_t addr, uint32_t value) "OTP Memory read: addr 0x%"
PRIx32 " value 0x%" PRIx32
+aspeed_sbc_otp_prog(uint32_t addr, uint32_t value) "OTP Memory write: addr
0x%" PRIx32 " value 0x%" PRIx32
+
# aspeed_scu.c
aspeed_scu_write(uint64_t offset, unsigned size, uint32_t data) "To 0x%"
PRIx64 " of size %u: 0x%" PRIx32
aspeed_scu_read(uint64_t offset, unsigned size, uint32_t data) "To 0x%" PRIx64
" of size %u: 0x%" PRIx32
diff --git a/include/hw/misc/aspeed_sbc.h b/include/hw/misc/aspeed_sbc.h
index 405e6782b9..3191c6eb87 100644
--- a/include/hw/misc/aspeed_sbc.h
+++ b/include/hw/misc/aspeed_sbc.h
@@ -10,6 +10,7 @@
#define ASPEED_SBC_H
#include "hw/sysbus.h"
+#include "hw/misc/aspeed_otpmem.h"
#define TYPE_ASPEED_SBC "aspeed.sbc"
#define TYPE_ASPEED_AST2600_SBC TYPE_ASPEED_SBC "-ast2600"
@@ -36,6 +37,8 @@ struct AspeedSBCState {
MemoryRegion iomem;
uint32_t regs[ASPEED_SBC_NR_REGS];
+
+ AspeedOTPMemState *otpmem;
};
struct AspeedSBCClass {
--
2.43.0
