hw/misc/aspeed_sbc.c

   1 /*
   2  * ASPEED Secure Boot Controller
   3  *
   4  * Copyright (C) 2021-2022 IBM Corp.
   5  *
   6  * Joel Stanley <joel@jms.id.au>
   7  *
   8  * SPDX-License-Identifier: GPL-2.0-or-later
   9  */
  10
  11 #include "qemu/osdep.h"
  12 #include "qemu/log.h"
  13 #include "qemu/error-report.h"
  14 #include "hw/qdev-properties.h"
  15 #include "hw/misc/aspeed_sbc.h"
  16 #include "qapi/error.h"
  17 #include "migration/vmstate.h"
  18
  19 #define R_PROT          (0x000 / 4)
  20 #define R_STATUS        (0x014 / 4)
  21 #define R_QSR           (0x040 / 4)
  22
  23 /* R_STATUS */
  24 #define ABR_EN                  BIT(14) /* Mirrors SCU510[11] */
  25 #define ABR_IMAGE_SOURCE        BIT(13)
  26 #define SPI_ABR_IMAGE_SOURCE    BIT(12)
  27 #define SB_CRYPTO_KEY_EXP_DONE  BIT(11)
  28 #define SB_CRYPTO_BUSY          BIT(10)
  29 #define OTP_WP_EN               BIT(9)
  30 #define OTP_ADDR_WP_EN          BIT(8)
  31 #define LOW_SEC_KEY_EN          BIT(7)
  32 #define SECURE_BOOT_EN          BIT(6)
  33 #define UART_BOOT_EN            BIT(5)
  34 /* bit 4 reserved*/
  35 #define OTP_CHARGE_PUMP_READY   BIT(3)
  36 #define OTP_IDLE                BIT(2)
  37 #define OTP_MEM_IDLE            BIT(1)
  38 #define OTP_COMPARE_STATUS      BIT(0)
  39
  40 /* QSR */
  41 #define QSR_RSA_MASK           (0x3 << 12)
  42 #define QSR_HASH_MASK          (0x3 << 10)
  43
  44 static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr, unsigned int size)
  45 {
  46     AspeedSBCState *s = ASPEED_SBC(opaque);
  47
  48     addr >>= 2;
  49
  50     if (addr >= ASPEED_SBC_NR_REGS) {
  51         qemu_log_mask(LOG_GUEST_ERROR,
  52                       "%s: Out-of-bounds read at offset 0x%" HWADDR_PRIx "\n",
  53                       __func__, addr << 2);
  54         return 0;
  55     }
  56
  57     return s->regs[addr];
  58 }
  59
  60 static void aspeed_sbc_write(void *opaque, hwaddr addr, uint64_t data,
  61                               unsigned int size)
  62 {
  63     AspeedSBCState *s = ASPEED_SBC(opaque);
  64
  65     addr >>= 2;
  66
  67     if (addr >= ASPEED_SBC_NR_REGS) {
  68         qemu_log_mask(LOG_GUEST_ERROR,
  69                       "%s: Out-of-bounds write at offset 0x%" HWADDR_PRIx "\n",
  70                       __func__, addr << 2);
  71         return;
  72     }
  73
  74     switch (addr) {
  75     case R_STATUS:
  76     case R_QSR:
  77         qemu_log_mask(LOG_GUEST_ERROR,
  78                       "%s: write to read only register 0x%" HWADDR_PRIx "\n",
  79                       __func__, addr << 2);
  80         return;
  81     default:
  82         break;
  83     }
  84
  85     s->regs[addr] = data;
  86 }
  87
  88 static const MemoryRegionOps aspeed_sbc_ops = {
  89     .read = aspeed_sbc_read,
  90     .write = aspeed_sbc_write,
  91     .endianness = DEVICE_LITTLE_ENDIAN,
  92     .valid = {
  93         .min_access_size = 1,
  94         .max_access_size = 4,
  95     },
  96 };
  97
  98 static void aspeed_sbc_reset(DeviceState *dev)
  99 {
 100     struct AspeedSBCState *s = ASPEED_SBC(dev);
 101
 102     memset(s->regs, 0, sizeof(s->regs));
 103
 104     /* Set secure boot enabled with RSA4096_SHA256 and enable eMMC ABR */
 105     s->regs[R_STATUS] = OTP_IDLE | OTP_MEM_IDLE;
 106
 107     if (s->emmc_abr) {
 108         s->regs[R_STATUS] &= ABR_EN;
 109     }
 110
 111     if (s->signing_settings) {
 112         s->regs[R_STATUS] &= SECURE_BOOT_EN;
 113     }
 114
 115     s->regs[R_QSR] = s->signing_settings;
 116 }
 117
 118 static void aspeed_sbc_realize(DeviceState *dev, Error **errp)
 119 {
 120     AspeedSBCState *s = ASPEED_SBC(dev);
 121     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 122
 123     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_sbc_ops, s,
 124             TYPE_ASPEED_SBC, 0x1000);
 125
 126     sysbus_init_mmio(sbd, &s->iomem);
 127 }
 128
 129 static const VMStateDescription vmstate_aspeed_sbc = {
 130     .name = TYPE_ASPEED_SBC,
 131     .version_id = 1,
 132     .minimum_version_id = 1,
 133     .fields = (VMStateField[]) {
 134         VMSTATE_UINT32_ARRAY(regs, AspeedSBCState, ASPEED_SBC_NR_REGS),
 135         VMSTATE_END_OF_LIST(),
 136     }
 137 };
 138
 139 static Property aspeed_sbc_properties[] = {
 140     DEFINE_PROP_BOOL("emmc-abr", AspeedSBCState, emmc_abr, 0),
 141     DEFINE_PROP_UINT32("signing-settings", AspeedSBCState, signing_settings, 0),
 142     DEFINE_PROP_END_OF_LIST(),
 143 };
 144
 145 static void aspeed_sbc_class_init(ObjectClass *klass, void *data)
 146 {
 147     DeviceClass *dc = DEVICE_CLASS(klass);
 148
 149     dc->realize = aspeed_sbc_realize;
 150     dc->reset = aspeed_sbc_reset;
 151     dc->vmsd = &vmstate_aspeed_sbc;
 152     device_class_set_props(dc, aspeed_sbc_properties);
 153 }
 154
 155 static const TypeInfo aspeed_sbc_info = {
 156     .name = TYPE_ASPEED_SBC,
 157     .parent = TYPE_SYS_BUS_DEVICE,
 158     .instance_size = sizeof(AspeedSBCState),
 159     .class_init = aspeed_sbc_class_init,
 160     .class_size = sizeof(AspeedSBCClass)
 161 };
 162
 163 static void aspeed_ast2600_sbc_class_init(ObjectClass *klass, void *data)
 164 {
 165     DeviceClass *dc = DEVICE_CLASS(klass);
 166
 167     dc->desc = "AST2600 Secure Boot Controller";
 168 }
 169
 170 static const TypeInfo aspeed_ast2600_sbc_info = {
 171     .name = TYPE_ASPEED_AST2600_SBC,
 172     .parent = TYPE_ASPEED_SBC,
 173     .class_init = aspeed_ast2600_sbc_class_init,
 174 };
 175
 176 static void aspeed_sbc_register_types(void)
 177 {
 178     type_register_static(&aspeed_ast2600_sbc_info);
 179     type_register_static(&aspeed_sbc_info);
 180 }
 181
 182 type_init(aspeed_sbc_register_types);