new file mode 100644
@@ -0,0 +1,118 @@
+/*
+ * Xilinx eFuse/bbram CRC calculator
+ *
+ * Copyright (c) 2021 Xilinx Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "hw/nvram/xlnx-efuse.h"
+
+static uint32_t xlnx_efuse_u37_crc(uint32_t prev_crc, uint32_t data,
+ uint32_t addr)
+{
+ /* A table for 7-bit slicing */
+ static const uint32_t crc_tab[128] = {
+ 0x00000000, 0xe13b70f7, 0xc79a971f, 0x26a1e7e8,
+ 0x8ad958cf, 0x6be22838, 0x4d43cfd0, 0xac78bf27,
+ 0x105ec76f, 0xf165b798, 0xd7c45070, 0x36ff2087,
+ 0x9a879fa0, 0x7bbcef57, 0x5d1d08bf, 0xbc267848,
+ 0x20bd8ede, 0xc186fe29, 0xe72719c1, 0x061c6936,
+ 0xaa64d611, 0x4b5fa6e6, 0x6dfe410e, 0x8cc531f9,
+ 0x30e349b1, 0xd1d83946, 0xf779deae, 0x1642ae59,
+ 0xba3a117e, 0x5b016189, 0x7da08661, 0x9c9bf696,
+ 0x417b1dbc, 0xa0406d4b, 0x86e18aa3, 0x67dafa54,
+ 0xcba24573, 0x2a993584, 0x0c38d26c, 0xed03a29b,
+ 0x5125dad3, 0xb01eaa24, 0x96bf4dcc, 0x77843d3b,
+ 0xdbfc821c, 0x3ac7f2eb, 0x1c661503, 0xfd5d65f4,
+ 0x61c69362, 0x80fde395, 0xa65c047d, 0x4767748a,
+ 0xeb1fcbad, 0x0a24bb5a, 0x2c855cb2, 0xcdbe2c45,
+ 0x7198540d, 0x90a324fa, 0xb602c312, 0x5739b3e5,
+ 0xfb410cc2, 0x1a7a7c35, 0x3cdb9bdd, 0xdde0eb2a,
+ 0x82f63b78, 0x63cd4b8f, 0x456cac67, 0xa457dc90,
+ 0x082f63b7, 0xe9141340, 0xcfb5f4a8, 0x2e8e845f,
+ 0x92a8fc17, 0x73938ce0, 0x55326b08, 0xb4091bff,
+ 0x1871a4d8, 0xf94ad42f, 0xdfeb33c7, 0x3ed04330,
+ 0xa24bb5a6, 0x4370c551, 0x65d122b9, 0x84ea524e,
+ 0x2892ed69, 0xc9a99d9e, 0xef087a76, 0x0e330a81,
+ 0xb21572c9, 0x532e023e, 0x758fe5d6, 0x94b49521,
+ 0x38cc2a06, 0xd9f75af1, 0xff56bd19, 0x1e6dcdee,
+ 0xc38d26c4, 0x22b65633, 0x0417b1db, 0xe52cc12c,
+ 0x49547e0b, 0xa86f0efc, 0x8ecee914, 0x6ff599e3,
+ 0xd3d3e1ab, 0x32e8915c, 0x144976b4, 0xf5720643,
+ 0x590ab964, 0xb831c993, 0x9e902e7b, 0x7fab5e8c,
+ 0xe330a81a, 0x020bd8ed, 0x24aa3f05, 0xc5914ff2,
+ 0x69e9f0d5, 0x88d28022, 0xae7367ca, 0x4f48173d,
+ 0xf36e6f75, 0x12551f82, 0x34f4f86a, 0xd5cf889d,
+ 0x79b737ba, 0x988c474d, 0xbe2da0a5, 0x5f16d052
+ };
+
+ /*
+ * eFuse calculation is shown here:
+ * https://github.com/Xilinx/embeddedsw/blob/release-2019.2/lib/sw_services/xilskey/src/xilskey_utils.c#L1496
+ *
+ * Each u32 word is appended a 5-bit value, for a total of 37 bits; see:
+ * https://github.com/Xilinx/embeddedsw/blob/release-2019.2/lib/sw_services/xilskey/src/xilskey_utils.c#L1356
+ */
+ uint32_t crc = prev_crc;
+ const unsigned rshf = 7;
+ const uint32_t im = (1 << rshf) - 1;
+ const uint32_t rm = (1 << (32 - rshf)) - 1;
+ const uint32_t i2 = (1 << 2) - 1;
+ const uint32_t r2 = (1 << 30) - 1;
+
+ unsigned j;
+ uint32_t i, r;
+ uint64_t w;
+
+ w = (uint64_t)(addr) << 32;
+ w |= data;
+
+ /* Feed 35 bits, in 5 rounds, each a slice of 7 bits */
+ for (j = 0; j < 5; j++) {
+ r = rm & (crc >> rshf);
+ i = im & (crc ^ w);
+ crc = crc_tab[i] ^ r;
+
+ w >>= rshf;
+ }
+
+ /* Feed the remaining 2 bits */
+ r = r2 & (crc >> 2);
+ i = i2 & (crc ^ w);
+ crc = crc_tab[i << (rshf - 2)] ^ r;
+
+ return crc;
+}
+
+uint32_t xlnx_efuse_calc_crc(const uint32_t *data, unsigned u32_cnt,
+ unsigned zpads)
+{
+ uint32_t crc = 0;
+ unsigned index;
+
+ for (index = zpads; index; index--) {
+ crc = xlnx_efuse_u37_crc(crc, 0, (index + u32_cnt));
+ }
+
+ for (index = u32_cnt; index; index--) {
+ crc = xlnx_efuse_u37_crc(crc, data[index - 1], index);
+ }
+
+ return crc;
+}
new file mode 100644
@@ -0,0 +1,252 @@
+/*
+ * QEMU model of the EFUSE eFuse
+ *
+ * Copyright (c) 2015 Xilinx Inc.
+ *
+ * Written by Edgar E. Iglesias <edgari@xilinx.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/nvram/xlnx-efuse.h"
+
+#include "qemu/error-report.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "sysemu/blockdev.h"
+#include "migration/vmstate.h"
+#include "hw/qdev-properties.h"
+#include "hw/qdev-properties-system.h"
+
+#ifndef XLNX_EFUSE_ERR_DEBUG
+#define XLNX_EFUSE_ERR_DEBUG 0
+#endif
+
+#define XLNX_EFUSE(obj) \
+ OBJECT_CHECK(XLNXEFuse, (obj), TYPE_XLNX_EFUSE)
+
+#define TBIT0_OFFSET 28
+#define TBIT1_OFFSET 29
+#define TBIT2_OFFSET 30
+#define TBIT3_OFFSET 31
+#define TBITS_PATTERN (0x0AU << TBIT0_OFFSET)
+#define TBITS_MASK (0x0FU << TBIT0_OFFSET)
+
+bool xlnx_efuse_get_bit(XLNXEFuse *s, unsigned int bit)
+{
+ bool b = s->fuse32[bit / 32] & (1 << (bit % 32));
+ return b;
+}
+
+static void efuse_sync_bdrv(XLNXEFuse *s, unsigned int bit)
+{
+ const int bswap_adj = (const_le32(0x1234) != 0x1234 ? 3 : 0);
+ unsigned int efuse_byte;
+
+ if (!s->blk || s->blk_ro) {
+ return; /* Silient on read-only backend to avoid message flood */
+ }
+
+ efuse_byte = bit / 8;
+
+ if (blk_pwrite(s->blk, efuse_byte,
+ ((uint8_t *) s->fuse32) + (efuse_byte ^ bswap_adj),
+ 1, 0) < 0) {
+ error_report("%s: write error in byte %" PRIu32 ".",
+ __func__, efuse_byte);
+ }
+}
+
+static int efuse_ro_bits_cmp(const void *a, const void *b)
+{
+ uint32_t i = *(const uint32_t *)a;
+ uint32_t j = *(const uint32_t *)b;
+
+ return (i > j) - (i < j);
+}
+
+static void efuse_ro_bits_sort(XLNXEFuse *s)
+{
+ uint32_t *ary = s->ro_bits;
+ const uint32_t cnt = s->ro_bits_cnt;
+
+ if (ary && cnt > 1) {
+ qsort(ary, cnt, sizeof(ary[0]), efuse_ro_bits_cmp);
+ }
+}
+
+static bool efuse_ro_bits_find(XLNXEFuse *s, uint32_t k)
+{
+ const uint32_t *ary = s->ro_bits;
+ const uint32_t cnt = s->ro_bits_cnt;
+
+ if (!ary || !cnt) {
+ return false;
+ }
+
+ return bsearch(&k, ary, cnt, sizeof(ary[0]), efuse_ro_bits_cmp) != NULL;
+}
+
+bool xlnx_efuse_set_bit(XLNXEFuse *s, unsigned int bit)
+{
+ if (efuse_ro_bits_find(s, bit)) {
+ qemu_log_mask(LOG_GUEST_ERROR, "%s: WARN: "
+ "Ignored setting of readonly efuse bit<%u,%u>!\n",
+ object_get_canonical_path(OBJECT(s)),
+ (bit / 32), (bit % 32));
+ return false;
+ }
+
+ s->fuse32[bit / 32] |= 1 << (bit % 32);
+ efuse_sync_bdrv(s, bit);
+ return true;
+}
+
+bool xlnx_efuse_k256_check(XLNXEFuse *s, uint32_t crc, unsigned start)
+{
+ uint32_t calc;
+
+ /* A key always occupies multiple of whole rows */
+ assert((start % 32) == 0);
+
+ calc = xlnx_efuse_calc_crc(&s->fuse32[start / 32], (256 / 32), 0);
+ return calc == crc;
+}
+
+uint32_t xlnx_efuse_tbits_check(XLNXEFuse *s)
+{
+ int nr;
+ uint32_t check = 0;
+
+ for (nr = s->efuse_nr; nr-- > 0; ) {
+ int efuse_start_row_num = (s->efuse_size * nr) / 32;
+ uint32_t data = s->fuse32[efuse_start_row_num];
+
+ /*
+ * If the option is on, auto-init blank T-bits.
+ * (non-blank will still be reported as '0' in the check, e.g.,
+ * for error-injection tests)
+ */
+ if ((data & TBITS_MASK) == 0 && s->init_tbits) {
+ data |= TBITS_PATTERN;
+
+ s->fuse32[efuse_start_row_num] = data;
+ efuse_sync_bdrv(s, (efuse_start_row_num * 32 + TBIT0_OFFSET));
+ }
+
+ check = (check << 1) | ((data & TBITS_MASK) == TBITS_PATTERN);
+ }
+
+ return check;
+}
+
+static void efuse_realize(DeviceState *dev, Error **errp)
+{
+ XLNXEFuse *s = XLNX_EFUSE(dev);
+ BlockBackend *blk;
+ DriveInfo *dinfo;
+ unsigned int nr_bytes;
+ const char *prefix = object_get_canonical_path(OBJECT(dev));
+
+ if (s->drv_index < 0) {
+ /* Set legacy compatibility */
+ s->drv_index = s->efuse_size <= 2048 ? 3 : 1;
+ }
+
+ dinfo = drive_get_by_index(IF_PFLASH, s->drv_index);
+ blk = dinfo ? blk_by_legacy_dinfo(dinfo) : NULL;
+
+ nr_bytes = ROUND_UP((s->efuse_nr * s->efuse_size) / 8, 4);
+ s->fuse32 = g_malloc0(nr_bytes);
+ if (blk) {
+ qdev_prop_set_drive(dev, "drive", blk);
+
+ s->blk_ro = !blk_supports_write_perm(s->blk);
+ if (s->blk_ro) {
+ warn_report("%s: update not saved: backstore is read-only",
+ object_get_canonical_path(OBJECT(s)));
+ }
+ blk_set_perm(s->blk,
+ (BLK_PERM_CONSISTENT_READ
+ | (s->blk_ro ? 0 : BLK_PERM_WRITE)), BLK_PERM_ALL,
+ &error_abort);
+
+ if (blk_pread(s->blk, 0, (void *) s->fuse32, nr_bytes) < 0) {
+ error_setg(&error_abort, "%s: Unable to read-out contents."
+ "backing file too small? Expecting %" PRIu32" bytes",
+ prefix,
+ (unsigned int) (nr_bytes));
+ }
+ if (const_le32(0x1234) != 0x1234) {
+ /* Convert from little-endian backstore for each 32-bit row */
+ unsigned int nr_u32;
+
+ for (nr_u32 = 0; nr_u32 < (nr_bytes / 4); nr_u32++) {
+ s->fuse32[nr_u32] = le32_to_cpu(s->fuse32[nr_u32]);
+ }
+ }
+ }
+
+ /* Sort readonly-list for bsearch lookup */
+ efuse_ro_bits_sort(s);
+}
+
+static Property efuse_properties[] = {
+ DEFINE_PROP_UINT8("efuse-nr", XLNXEFuse, efuse_nr, 3),
+ DEFINE_PROP_UINT32("efuse-size", XLNXEFuse, efuse_size, 64 * 32),
+ DEFINE_PROP_INT32("drive-index", XLNXEFuse, drv_index, -1),
+ DEFINE_PROP_DRIVE("drive", XLNXEFuse, blk),
+ DEFINE_PROP_BOOL("init-factory-tbits", XLNXEFuse, init_tbits, true),
+ DEFINE_PROP_ARRAY("read-only", XLNXEFuse, ro_bits_cnt, ro_bits,
+ qdev_prop_uint32, uint32_t),
+ DEFINE_PROP_END_OF_LIST(),
+};
+
+static const VMStateDescription vmstate_efuse = {
+ .name = TYPE_XLNX_EFUSE,
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .minimum_version_id_old = 1,
+ .fields = (VMStateField[]) {
+ VMSTATE_END_OF_LIST(),
+ }
+};
+
+static void efuse_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ dc->realize = efuse_realize;
+ dc->vmsd = &vmstate_efuse;
+ device_class_set_props(dc, efuse_properties);
+}
+
+static const TypeInfo efuse_info = {
+ .name = TYPE_XLNX_EFUSE,
+ .parent = TYPE_DEVICE,
+ .instance_size = sizeof(XLNXEFuse),
+ .class_init = efuse_class_init,
+};
+
+static void efuse_register_types(void)
+{
+ type_register_static(&efuse_info);
+}
+type_init(efuse_register_types)
new file mode 100644
@@ -0,0 +1,80 @@
+/*
+ * QEMU model of the Xilinx eFuse core
+ *
+ * Copyright (c) 2015 Xilinx Inc.
+ *
+ * Written by Edgar E. Iglesias <edgari@xilinx.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef XLNX_EFUSE_H
+#define XLNX_EFUSE_H
+
+#include "qemu/osdep.h"
+#include "sysemu/block-backend.h"
+#include "hw/qdev-core.h"
+
+#define TYPE_XLNX_EFUSE "xlnx,efuse"
+
+typedef struct XLNXEFuseLkSpec {
+ uint16_t row;
+ uint16_t lk_bit;
+} XLNXEFuseLkSpec;
+
+typedef struct XLNXEFuse {
+ DeviceState parent_obj;
+ BlockBackend *blk;
+ bool blk_ro;
+ uint32_t *fuse32;
+
+ DeviceState *dev;
+
+ bool init_tbits;
+ int drv_index;
+
+ uint8_t efuse_nr;
+ uint32_t efuse_size;
+
+ uint32_t *ro_bits;
+ uint32_t ro_bits_cnt;
+} XLNXEFuse;
+
+uint32_t xlnx_efuse_calc_crc(const uint32_t *data, unsigned u32_cnt,
+ unsigned zpads);
+
+bool xlnx_efuse_get_bit(XLNXEFuse *s, unsigned int bit);
+bool xlnx_efuse_set_bit(XLNXEFuse *s, unsigned int bit);
+bool xlnx_efuse_k256_check(XLNXEFuse *s, uint32_t crc, unsigned start);
+uint32_t xlnx_efuse_tbits_check(XLNXEFuse *s);
+
+/* Return whole row containing the given bit address */
+static inline uint32_t xlnx_efuse_get_row(XLNXEFuse *s, unsigned int bit)
+{
+ if (!(s->fuse32)) {
+ return 0;
+ } else {
+ unsigned int row_idx = bit / 32;
+
+ assert(row_idx < (s->efuse_size * s->efuse_nr / 32));
+ return s->fuse32[row_idx];
+ }
+}
+
+#endif