[v1] Initial support for One-Time Programmable Memory (OTP) in BCM2835

[PATCH 1/3] hw/nvram: Add BCM2835 OTP device

Posted by Rayhan Faizel 1 year, 9 months ago

The OTP device registers are currently stubbed. For now, the device
houses the OTP rows which will be accessed directly by other peripherals.

Signed-off-by: Rayhan Faizel <rayhan.faizel@gmail.com>
---
 hw/nvram/bcm2835_otp.c         | 187 +++++++++++++++++++++++++++++++++
 hw/nvram/meson.build           |   1 +
 include/hw/nvram/bcm2835_otp.h |  43 ++++++++
 3 files changed, 231 insertions(+)
 create mode 100644 hw/nvram/bcm2835_otp.c
 create mode 100644 include/hw/nvram/bcm2835_otp.h

diff --git a/hw/nvram/bcm2835_otp.c b/hw/nvram/bcm2835_otp.c
new file mode 100644
index 0000000000..a8d01c6f1d
--- /dev/null
+++ b/hw/nvram/bcm2835_otp.c
@@ -0,0 +1,187 @@
+/*
+ * BCM2835 One-Time Programmable (OTP) Memory
+ *
+ * The OTP implementation is mostly a stub except for the OTP rows
+ * which are accessed directly by other peripherals such as the mailbox.
+ *
+ * The OTP registers are unimplemented due to lack of documentation.
+ *
+ * Copyright (c) 2024 Rayhan Faizel <rayhan.faizel@gmail.com>
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "hw/nvram/bcm2835_otp.h"
+#include "migration/vmstate.h"
+
+/* OTP rows are 1-indexed */
+uint32_t bcm2835_otp_read_row(BCM2835OTPState *s, unsigned int row)
+{
+    assert(row <= 66 && row >= 1);
+
+    return s->otp_rows[row - 1];
+}
+
+void bcm2835_otp_write_row(BCM2835OTPState *s, unsigned int row,
+                           uint32_t value)
+{
+    assert(row <= 66 && row >= 1);
+
+    /* Real OTP rows work as e-fuses */
+    s->otp_rows[row - 1] |= value;
+}
+
+static uint64_t bcm2835_otp_read(void *opaque, hwaddr addr, unsigned size)
+{
+    switch (addr) {
+    case BCM2835_OTP_BOOTMODE_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_BOOTMODE_REG\n");
+        break;
+    case BCM2835_OTP_CONFIG_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_CONFIG_REG\n");
+        break;
+    case BCM2835_OTP_CTRL_LO_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_CTRL_LO_REG\n");
+        break;
+    case BCM2835_OTP_CTRL_HI_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_CTRL_HI_REG\n");
+        break;
+    case BCM2835_OTP_STATUS_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_STATUS_REG\n");
+        break;
+    case BCM2835_OTP_BITSEL_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_BITSEL_REG\n");
+        break;
+    case BCM2835_OTP_DATA_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_DATA_REG\n");
+        break;
+    case BCM2835_OTP_ADDR_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_ADDR_REG\n");
+        break;
+    case BCM2835_OTP_WRITE_DATA_READ_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_WRITE_DATA_READ_REG\n");
+        break;
+    case BCM2835_OTP_INIT_STATUS_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_INIT_STATUS_REG\n");
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
+    }
+
+    return 0;
+}
+
+static void bcm2835_otp_write(void *opaque, hwaddr addr,
+                              uint64_t value, unsigned int size)
+{
+    switch (addr) {
+    case BCM2835_OTP_BOOTMODE_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_BOOTMODE_REG\n");
+        break;
+    case BCM2835_OTP_CONFIG_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_CONFIG_REG\n");
+        break;
+    case BCM2835_OTP_CTRL_LO_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_CTRL_LO_REG\n");
+        break;
+    case BCM2835_OTP_CTRL_HI_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_CTRL_HI_REG\n");
+        break;
+    case BCM2835_OTP_STATUS_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_STATUS_REG\n");
+        break;
+    case BCM2835_OTP_BITSEL_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_BITSEL_REG\n");
+        break;
+    case BCM2835_OTP_DATA_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_DATA_REG\n");
+        break;
+    case BCM2835_OTP_ADDR_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_ADDR_REG\n");
+        break;
+    case BCM2835_OTP_WRITE_DATA_READ_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_WRITE_DATA_READ_REG\n");
+        break;
+    case BCM2835_OTP_INIT_STATUS_REG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_otp: BCM2835_OTP_INIT_STATUS_REG\n");
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
+    }
+}
+
+static const MemoryRegionOps bcm2835_otp_ops = {
+    .read = bcm2835_otp_read,
+    .write = bcm2835_otp_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static void bcm2835_otp_realize(DeviceState *dev, Error **errp)
+{
+    BCM2835OTPState *s = BCM2835_OTP(dev);
+    memory_region_init_io(&s->iomem, OBJECT(dev), &bcm2835_otp_ops, s,
+                          TYPE_BCM2835_OTP, 0x28);
+    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
+
+    memset(s->otp_rows, 0x00, sizeof(s->otp_rows));
+}
+
+static const VMStateDescription vmstate_bcm2835_otp = {
+    .name = TYPE_BCM2835_OTP,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(otp_rows, BCM2835OTPState, 66),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void bcm2835_otp_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = bcm2835_otp_realize;
+    dc->vmsd = &vmstate_bcm2835_otp;
+}
+
+static const TypeInfo bcm2835_otp_info = {
+    .name = TYPE_BCM2835_OTP,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(BCM2835OTPState),
+    .class_init = bcm2835_otp_class_init,
+};
+
+static void bcm2835_otp_register_types(void)
+{
+    type_register_static(&bcm2835_otp_info);
+}
+
+type_init(bcm2835_otp_register_types)
diff --git a/hw/nvram/meson.build b/hw/nvram/meson.build
index 4996c72456..10f3639db6 100644
--- a/hw/nvram/meson.build
+++ b/hw/nvram/meson.build
@@ -1,5 +1,6 @@
 system_ss.add(files('fw_cfg-interface.c'))
 system_ss.add(files('fw_cfg.c'))
+system_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2835_otp.c'))
 system_ss.add(when: 'CONFIG_CHRP_NVRAM', if_true: files('chrp_nvram.c'))
 system_ss.add(when: 'CONFIG_DS1225Y', if_true: files('ds1225y.c'))
 system_ss.add(when: 'CONFIG_NMC93XX_EEPROM', if_true: files('eeprom93xx.c'))
diff --git a/include/hw/nvram/bcm2835_otp.h b/include/hw/nvram/bcm2835_otp.h
new file mode 100644
index 0000000000..ef02d3055c
--- /dev/null
+++ b/include/hw/nvram/bcm2835_otp.h
@@ -0,0 +1,43 @@
+/*
+ * BCM2835 One-Time Programmable (OTP) Memory
+ *
+ * Copyright (c) 2024 Rayhan Faizel <rayhan.faizel@gmail.com>
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#ifndef BCM2835_OTP_H
+#define BCM2835_OTP_H
+
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_BCM2835_OTP "bcm2835-otp"
+OBJECT_DECLARE_SIMPLE_TYPE(BCM2835OTPState, BCM2835_OTP)
+
+/* https://elinux.org/BCM2835_registers#OTP */
+#define BCM2835_OTP_BOOTMODE_REG            0x00
+#define BCM2835_OTP_CONFIG_REG              0x04
+#define BCM2835_OTP_CTRL_LO_REG             0x08
+#define BCM2835_OTP_CTRL_HI_REG             0x0c
+#define BCM2835_OTP_STATUS_REG              0x10
+#define BCM2835_OTP_BITSEL_REG              0x14
+#define BCM2835_OTP_DATA_REG                0x18
+#define BCM2835_OTP_ADDR_REG                0x1c
+#define BCM2835_OTP_WRITE_DATA_READ_REG     0x20
+#define BCM2835_OTP_INIT_STATUS_REG         0x24
+
+struct BCM2835OTPState {
+    /* <private> */
+    SysBusDevice parent_obj;
+
+    /* <public> */
+    MemoryRegion iomem;
+    uint32_t otp_rows[66];
+};
+
+
+uint32_t bcm2835_otp_read_row(BCM2835OTPState *s, unsigned int row);
+void bcm2835_otp_write_row(BCM2835OTPState *s, unsigned row, uint32_t value);
+
+#endif
-- 
2.34.1

Re: [PATCH 1/3] hw/nvram: Add BCM2835 OTP device

Posted by Philippe Mathieu-Daudé 1 year, 9 months ago

On 10/5/24 16:10, Rayhan Faizel wrote:
> The OTP device registers are currently stubbed. For now, the device
> houses the OTP rows which will be accessed directly by other peripherals.
> 
> Signed-off-by: Rayhan Faizel <rayhan.faizel@gmail.com>
> ---
>   hw/nvram/bcm2835_otp.c         | 187 +++++++++++++++++++++++++++++++++
>   hw/nvram/meson.build           |   1 +
>   include/hw/nvram/bcm2835_otp.h |  43 ++++++++
>   3 files changed, 231 insertions(+)
>   create mode 100644 hw/nvram/bcm2835_otp.c
>   create mode 100644 include/hw/nvram/bcm2835_otp.h


> +/* OTP rows are 1-indexed */
> +uint32_t bcm2835_otp_read_row(BCM2835OTPState *s, unsigned int row)
> +{
> +    assert(row <= 66 && row >= 1);
> +
> +    return s->otp_rows[row - 1];
> +}
> +
> +void bcm2835_otp_write_row(BCM2835OTPState *s, unsigned int row,
> +                           uint32_t value)
> +{
> +    assert(row <= 66 && row >= 1);
> +
> +    /* Real OTP rows work as e-fuses */
> +    s->otp_rows[row - 1] |= value;

Maybe name get/set instead of read/write?

> +}

Re: [PATCH 1/3] hw/nvram: Add BCM2835 OTP device

Posted by Philippe Mathieu-Daudé 1 year, 9 months ago

Hi Rayhan,

On 10/5/24 16:10, Rayhan Faizel wrote:
> The OTP device registers are currently stubbed. For now, the device
> houses the OTP rows which will be accessed directly by other peripherals.
> 
> Signed-off-by: Rayhan Faizel <rayhan.faizel@gmail.com>
> ---
>   hw/nvram/bcm2835_otp.c         | 187 +++++++++++++++++++++++++++++++++
>   hw/nvram/meson.build           |   1 +
>   include/hw/nvram/bcm2835_otp.h |  43 ++++++++
>   3 files changed, 231 insertions(+)
>   create mode 100644 hw/nvram/bcm2835_otp.c
>   create mode 100644 include/hw/nvram/bcm2835_otp.h


> +static void bcm2835_otp_write(void *opaque, hwaddr addr,
> +                              uint64_t value, unsigned int size)
> +{
> +    switch (addr) {
> +    case BCM2835_OTP_BOOTMODE_REG:
> +        qemu_log_mask(LOG_UNIMP,
> +                      "bcm2835_otp: BCM2835_OTP_BOOTMODE_REG\n");
> +        break;
> +    case BCM2835_OTP_CONFIG_REG:
> +        qemu_log_mask(LOG_UNIMP,
> +                      "bcm2835_otp: BCM2835_OTP_CONFIG_REG\n");
> +        break;
> +    case BCM2835_OTP_CTRL_LO_REG:
> +        qemu_log_mask(LOG_UNIMP,
> +                      "bcm2835_otp: BCM2835_OTP_CTRL_LO_REG\n");
> +        break;
> +    case BCM2835_OTP_CTRL_HI_REG:
> +        qemu_log_mask(LOG_UNIMP,
> +                      "bcm2835_otp: BCM2835_OTP_CTRL_HI_REG\n");
> +        break;
> +    case BCM2835_OTP_STATUS_REG:
> +        qemu_log_mask(LOG_UNIMP,
> +                      "bcm2835_otp: BCM2835_OTP_STATUS_REG\n");
> +        break;
> +    case BCM2835_OTP_BITSEL_REG:
> +        qemu_log_mask(LOG_UNIMP,
> +                      "bcm2835_otp: BCM2835_OTP_BITSEL_REG\n");
> +        break;
> +    case BCM2835_OTP_DATA_REG:
> +        qemu_log_mask(LOG_UNIMP,
> +                      "bcm2835_otp: BCM2835_OTP_DATA_REG\n");
> +        break;
> +    case BCM2835_OTP_ADDR_REG:
> +        qemu_log_mask(LOG_UNIMP,
> +                      "bcm2835_otp: BCM2835_OTP_ADDR_REG\n");
> +        break;
> +    case BCM2835_OTP_WRITE_DATA_READ_REG:
> +        qemu_log_mask(LOG_UNIMP,
> +                      "bcm2835_otp: BCM2835_OTP_WRITE_DATA_READ_REG\n");
> +        break;
> +    case BCM2835_OTP_INIT_STATUS_REG:
> +        qemu_log_mask(LOG_UNIMP,
> +                      "bcm2835_otp: BCM2835_OTP_INIT_STATUS_REG\n");
> +        break;
> +    default:
> +        qemu_log_mask(LOG_GUEST_ERROR,
> +                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
> +    }
> +}
> +
> +static const MemoryRegionOps bcm2835_otp_ops = {
> +    .read = bcm2835_otp_read,
> +    .write = bcm2835_otp_write,
> +    .endianness = DEVICE_NATIVE_ENDIAN,
> +    .valid = {

s/valid/impl/ here, this is your implementation. It isn't illegal to
access these registers with a non 32-bit size.

> +        .min_access_size = 4,
> +        .max_access_size = 4,
> +    },
> +};


> +/* https://elinux.org/BCM2835_registers#OTP */
> +#define BCM2835_OTP_BOOTMODE_REG            0x00
> +#define BCM2835_OTP_CONFIG_REG              0x04
> +#define BCM2835_OTP_CTRL_LO_REG             0x08
> +#define BCM2835_OTP_CTRL_HI_REG             0x0c
> +#define BCM2835_OTP_STATUS_REG              0x10
> +#define BCM2835_OTP_BITSEL_REG              0x14
> +#define BCM2835_OTP_DATA_REG                0x18
> +#define BCM2835_OTP_ADDR_REG                0x1c
> +#define BCM2835_OTP_WRITE_DATA_READ_REG     0x20
> +#define BCM2835_OTP_INIT_STATUS_REG         0x24

[PATCH 1/3] hw/nvram: Add BCM2835 OTP device
[PATCH 2/3] hw/arm: Connect OTP device to BCM2835
[PATCH 3/3] hw/misc: Implement mailbox properties for customer OTP and device specific private keys