4444#include "trace.h"
4545
4646#define PARAM_SRAM_DEPTH 1024u
47- #define PARAM_SRAM_OFFSET 4096u
48- #define PARAM_SRAM_EGRESS_DEPTH 832u
49- #define PARAM_SRAM_INGRESS_DEPTH 104u
47+ #define PARAM_SRAM_EGRESS_DEPTH 848u
48+ #define PARAM_SRAM_INGRESS_DEPTH 112u
5049#define PARAM_NUM_CMD_INFO 24u
5150#define PARAM_NUM_LOCALITY 5u
52- #define PARAM_TPM_WR_FIFO_PTR_W 7u
53- #define PARAM_TPM_RD_FIFO_PTR_W 5u
54- #define PARAM_TPM_RD_FIFO_WIDTH 32u
51+ #define PARAM_TPM_RD_FIFO_DEPTH 16u
52+ #define PARAM_TPM_WR_FIFO_DEPTH 16u
5553#define PARAM_NUM_IRQS 8u
5654#define PARAM_NUM_ALERTS 1u
5755#define PARAM_REG_WIDTH 32u
@@ -235,6 +233,8 @@ REG32(TPM_WRITE_FIFO, 0x38u)
235233
236234#define SPI_BUS_PROTO_VER 0
237235#define SPI_BUS_HEADER_SIZE (2u * sizeof(uint32_t))
236+ #define SPI_TPM_READ_FIFO_SIZE_BYTES \
237+ (PARAM_TPM_RD_FIFO_DEPTH * sizeof(uint32_t))
238238/**
239239 * Delay for handling non-aligned generic data transfer and flush the FIFO.
240240 * Generic mode is deprecated anyway. Arbitrarily set to 1 ms.
@@ -251,64 +251,73 @@ REG32(TPM_WRITE_FIFO, 0x38u)
251251 */
252252#define SPI_BUS_FLASH_READ_DELAY_NS 100000000u
253253
254- /*
255- * New scheme (Egress + Ingress) Old Scheme (DPSRAM)
256- * +-----------------------------+ +-----------------------+
257- * | Flash / Passthru modes | | Flash / Passthru modes|
258- * 0x000 -+----------------+------+-----+ -+----------------+------+
259- * | Read Command 0 | 1KiB | Out | | Read Command 0 | 1KiB |
260- * 0x400 -+----------------+------+-----+ -+----------------+------+
261- * | Read Command 1 | 1KiB | Out | | Read Command 1 | 1KiB |
262- * 0x800 -+----------------+------+-----+ -+----------------+------+
263- * | Mailbox | 1KiB | Out | | Mailbox | 1KiB |
264- * 0xc00 -+----------------+------+-----+ -+----------------+------+
265- * | SFDP | 256B | Out | | SFDP | 256B |
266- * 0xd00 -+----------------+------+-----+ -+----------------+------+
267- * | | | Payload FIFO | 256B |
268- * 0xe00 -+----------------+------+-----+ -+----------------+------+
269- * | Payload FIFO | 256B | In | | Command FIFO | 64B |
270- * 0xe40 -+----------------+------+-----+ -+----------------+------+
271- * | Command FIFO | 64B | In | | Address FIFO | 64B |
272- * 0xe80 -+----------------+------+-----+ -+----------------+------+
273- * | Address FIFO | 64B | In |
274- * 0xe80 -+----------------+------+-----+
254+ /* Memory layout extracted from the documentation:
255+ * opentitan.org/book/hw/ip/spi_device/doc/programmers_guide.html#dual-port-sram-layout
275256 *
257+ * New scheme (Egress + Ingress) Old Scheme (DPSRAM)
258+ * +--------------------------------+ +-----------------------+
259+ * | Flash / Passthru modes | | Flash / Passthru modes|
260+ * 0x000 -+-------------------+------+-----+ -+----------------+------+
261+ * | Read Command 0 | 1KiB | Out | | Read Command 0 | 1KiB |
262+ * 0x400 -+-------------------+------+-----+ -+----------------+------+
263+ * | Read Command 1 | 1KiB | Out | | Read Command 1 | 1KiB |
264+ * 0x800 -+-------------------+------+-----+ -+----------------+------+
265+ * | Mailbox | 1KiB | Out | | Mailbox | 1KiB |
266+ * 0xc00 -+-------------------+------+-----+ -+----------------+------+
267+ * | SFDP | 256B | Out | | SFDP | 256B |
268+ * 0xd00 -+-------------------+------+-----+ -+----------------+------+
269+ * | TPM Read Buffer | 64B | Out | | Payload FIFO | 256B |
270+ * 0xd40 -+-------------------+------+-----+ -+----------------+------+
271+ * | | | | | Command FIFO | 64B |
272+ * 0xe00 -+-------------------+------+-----+ -+----------------+------+
273+ * | Payload FIFO | 256B | In | | Address FIFO | 64B |
274+ * 0xf00 -+-------------------+------+-----+ -+----------------+------+
275+ * | Command FIFO | 64B | In |
276+ * 0xf40 -+-------------------+------+-----+
277+ * | Address FIFO | 64B | In |
278+ * 0xf80 -+-------------------+------+-----+
279+ * | TPM Write Buffer | 64B | In |
280+ * 0xfc0 -+-------------------+------+-----+
276281 *
277282 */
278- #define SPI_SRAM_READ0_OFFSET 0x0
279- #define SPI_SRAM_READ_SIZE 0x400u
280- #define SPI_SRAM_READ1_OFFSET (SPI_SRAM_READ0_OFFSET + SPI_SRAM_READ_SIZE)
281- #define SPI_SRAM_READ1_SIZE 0x400u
282- #define SPI_SRAM_MBX_OFFSET (SPI_SRAM_READ1_OFFSET + SPI_SRAM_READ_SIZE)
283- #define SPI_SRAM_MBX_SIZE 0x400u
284- #define SPI_SRAM_SFDP_OFFSET (SPI_SRAM_MBX_OFFSET + SPI_SRAM_MBX_SIZE)
285- #define SPI_SRAM_SFDP_SIZE 0x100u
286- /* with new scheme (no dual part SRAM, the following offsets are shifted...) */
287- #define SPI_SRAM_INGRESS_OFFSET 0x100u
288- #define SPI_SRAM_PAYLOAD_OFFSET (SPI_SRAM_SFDP_OFFSET + SPI_SRAM_SFDP_SIZE)
283+ #define SPI_SRAM_READ0_OFFSET 0x0
284+ #define SPI_SRAM_READ_SIZE 0x400u
285+ #define SPI_SRAM_READ1_OFFSET (SPI_SRAM_READ0_OFFSET + SPI_SRAM_READ_SIZE)
286+ #define SPI_SRAM_READ1_SIZE 0x400u
287+ #define SPI_SRAM_MBX_OFFSET (SPI_SRAM_READ1_OFFSET + SPI_SRAM_READ_SIZE)
288+ #define SPI_SRAM_MBX_SIZE 0x400u
289+ #define SPI_SRAM_SFDP_OFFSET (SPI_SRAM_MBX_OFFSET + SPI_SRAM_MBX_SIZE)
290+ #define SPI_SRAM_SFDP_SIZE 0x100u
291+ #define SPI_SRAM_TPM_READ_OFFSET (SPI_SRAM_SFDP_OFFSET + SPI_SRAM_SFDP_SIZE)
292+ #define SPI_SRAM_TPM_READ_SIZE 0x40u
293+ #define SPI_SRAM_INGRESS_OFFSET 0xE00u
294+ static_assert (SPI_SRAM_INGRESS_OFFSET >=
295+ (SPI_SRAM_TPM_READ_OFFSET + SPI_SRAM_TPM_READ_SIZE ),
296+ "SPI SRAM Egress buffers overflow into Ingress buffers" );
297+ #define SPI_SRAM_PAYLOAD_OFFSET SPI_SRAM_INGRESS_OFFSET
289298#define SPI_SRAM_PAYLOAD_SIZE 0x100u
290- #define SPI_SRAM_CMD_OFFSET (SPI_SRAM_PAYLOAD_OFFSET + SPI_SRAM_PAYLOAD_SIZE)
291- #define SPI_SRAM_CMD_SIZE 0x40u
292- #define SPI_SRAM_ADDR_OFFSET (SPI_SRAM_CMD_OFFSET + SPI_SRAM_CMD_SIZE)
293- #define SPI_SRAM_ADDR_SIZE 0x40u
294- #define SPI_SRAM_ADDR_END (SPI_SRAM_ADDR_OFFSET + SPI_SRAM_ADDR_SIZE)
295- #define SPI_SRAM_END_OFFSET (SPI_SRAM_ADDR_END)
296- static_assert (SPI_SRAM_END_OFFSET == 0xe80u , "Invalid SRAM definition" );
297299
300+ #define SPI_SRAM_CMD_OFFSET (SPI_SRAM_PAYLOAD_OFFSET + SPI_SRAM_PAYLOAD_SIZE)
301+ #define SPI_SRAM_CMD_SIZE 0x40u
302+ #define SPI_SRAM_ADDR_OFFSET (SPI_SRAM_CMD_OFFSET + SPI_SRAM_CMD_SIZE)
303+ #define SPI_SRAM_ADDR_SIZE 0x40u
304+ #define SPI_SRAM_TPM_WRITE_OFFSET (SPI_SRAM_ADDR_OFFSET + SPI_SRAM_ADDR_SIZE)
305+ #define SPI_SRAM_TPM_WRITE_SIZE 0x40u
306+ #define SPI_SRAM_ADDR_END (SPI_SRAM_TPM_WRITE_OFFSET + SPI_SRAM_TPM_WRITE_SIZE)
307+ #define SPI_SRAM_END_OFFSET (SPI_SRAM_ADDR_END)
308+ static_assert (SPI_SRAM_END_OFFSET == 0xfc0u , "Invalid SRAM definition" );
298309#define SPI_DEVICE_SIZE 0x2000u
299310#define SPI_DEVICE_SPI_REGS_OFFSET 0u
300311#define SPI_DEVICE_TPM_REGS_OFFSET 0x800u
301312#define SPI_DEVICE_SRAM_OFFSET 0x1000u
302313
303- #define SRAM_SIZE PARAM_SRAM_OFFSET
304- #define EGRESS_BUFFER_SIZE_BYTES \
305- (SPI_SRAM_PAYLOAD_OFFSET - SPI_SRAM_READ0_OFFSET)
306- #define EGRESS_BUFFER_SIZE_WORDS (EGRESS_BUFFER_SIZE_BYTES / sizeof(uint32_t))
307- #define INGRESS_BUFFER_SIZE_BYTES \
308- (SPI_SRAM_END_OFFSET - SPI_SRAM_PAYLOAD_OFFSET)
309- #define INGRESS_BUFFER_SIZE_WORDS (INGRESS_BUFFER_SIZE_BYTES / sizeof(uint32_t))
310314
311- #define FLASH_READ_BUFFER_SIZE (2u * SPI_SRAM_READ_SIZE)
315+ #define SRAM_SIZE (PARAM_SRAM_DEPTH * sizeof(uint32_t))
316+ #define EGRESS_BUFFER_SIZE_BYTES (PARAM_SRAM_EGRESS_DEPTH * sizeof(uint32_t))
317+ #define EGRESS_BUFFER_SIZE_WORDS PARAM_SRAM_EGRESS_DEPTH
318+ #define INGRESS_BUFFER_SIZE_BYTES (PARAM_SRAM_INGRESS_DEPTH * sizeof(uint32_t))
319+ #define INGRESS_BUFFER_SIZE_WORDS PARAM_SRAM_INGRESS_DEPTH
320+ #define FLASH_READ_BUFFER_SIZE (2u * SPI_SRAM_READ_SIZE)
312321
313322#define SPI_DEFAULT_TX_VALUE ((uint8_t)0xffu)
314323#define SPI_FLASH_BUFFER_SIZE 256u
@@ -710,7 +719,6 @@ static void ot_spi_device_clear_modes(OtSPIDeviceState *s)
710719 f -> type = SPI_FLASH_CMD_NONE ;
711720 g_assert (s -> sram );
712721 f -> payload = & ((uint8_t * )s -> sram )[SPI_SRAM_PAYLOAD_OFFSET ];
713- f -> payload += SPI_SRAM_INGRESS_OFFSET ;
714722 memset (f -> buffer , 0u , SPI_FLASH_BUFFER_SIZE );
715723
716724 memset (s -> sram , 0u , SRAM_SIZE );
@@ -1821,27 +1829,34 @@ static MemTxResult ot_spi_device_buf_read_with_attrs(
18211829 (void )attrs ;
18221830 uint32_t val32 ;
18231831
1824- hwaddr last = addr + size - 1u ;
1832+ hwaddr last = ( hwaddr )(( uint32_t ) addr + size - 1u ) ;
18251833
1826- if (last < SPI_SRAM_PAYLOAD_OFFSET + SPI_SRAM_INGRESS_OFFSET ) {
1834+ if (addr < SPI_SRAM_INGRESS_OFFSET ) {
18271835 qemu_log_mask (LOG_GUEST_ERROR ,
18281836 "%s: cannot read egress buffer 0x%" HWADDR_PRIx "\n" ,
18291837 __func__ , addr );
18301838 return MEMTX_DECODE_ERROR ;
18311839 }
1832- if (last < SPI_SRAM_CMD_OFFSET + SPI_SRAM_INGRESS_OFFSET ) {
1833- /* payload buffer */
1840+
1841+ if ((addr >= SPI_SRAM_PAYLOAD_OFFSET &&
1842+ last < (SPI_SRAM_PAYLOAD_OFFSET + SPI_SRAM_PAYLOAD_SIZE )) ||
1843+ (addr >= SPI_SRAM_TPM_WRITE_OFFSET &&
1844+ last < (SPI_SRAM_TPM_WRITE_OFFSET + SPI_SRAM_TPM_WRITE_SIZE ))) {
1845+ /* flash payload and tpm write buffers */
18341846 val32 = s -> sram [addr >> 2u ];
1835- } else if (last < SPI_SRAM_ADDR_OFFSET + SPI_SRAM_INGRESS_OFFSET ) {
1836- /* command FIFO */
1847+ } else if (addr >= SPI_SRAM_CMD_OFFSET &&
1848+ last < (SPI_SRAM_CMD_OFFSET + SPI_SRAM_CMD_SIZE )) {
1849+ /* flash command FIFO */
18371850 val32 = ((const uint32_t * )s -> flash .cmd_fifo .data )[addr >> 2u ];
1838- } else if (last < SPI_SRAM_ADDR_END + SPI_SRAM_INGRESS_OFFSET ) {
1839- /* address FIFO */
1851+ } else if (addr >= SPI_SRAM_ADDR_OFFSET &&
1852+ last < (SPI_SRAM_ADDR_OFFSET + SPI_SRAM_ADDR_SIZE )) {
1853+ /* flash address FIFO */
18401854 val32 = s -> flash .address_fifo .data [addr >> 2u ];
18411855 } else {
1842- /* TPM or not used area */
1843- qemu_log_mask (LOG_UNIMP , "%s: TPM not supported 0x%" HWADDR_PRIx "\n" ,
1844- __func__ , addr );
1856+ qemu_log_mask (LOG_GUEST_ERROR ,
1857+ "%s: Invalid ingress buffer access to 0x%" HWADDR_PRIx
1858+ "-0x%" HWADDR_PRIx "\n" ,
1859+ __func__ , addr , last );
18451860 val32 = 0 ;
18461861 }
18471862
@@ -1869,9 +1884,9 @@ static MemTxResult ot_spi_device_buf_write_with_attrs(
18691884 uint32_t pc = ibex_get_current_pc ();
18701885 trace_ot_spi_device_buf_write_in (s -> ot_id , (uint32_t )addr , size , val32 , pc );
18711886
1872- hwaddr last = addr + size - 1u ;
1887+ hwaddr last = ( hwaddr )(( uint32_t ) addr + size - 1u ) ;
18731888
1874- if (last >= SPI_SRAM_PAYLOAD_OFFSET ) {
1889+ if (last >= SPI_SRAM_INGRESS_OFFSET ) {
18751890 qemu_log_mask (LOG_GUEST_ERROR ,
18761891 "%s: cannot write ingress buffer 0x%" HWADDR_PRIx "\n" ,
18771892 __func__ , addr );
0 commit comments