4444#include "trace.h"
4545
4646#define PARAM_SRAM_DEPTH 1024u
47- #define PARAM_SRAM_OFFSET 4096u
48- #define PARAM_SRAM_EGRESS_DEPTH 832u
49- #define PARAM_SRAM_INGRESS_DEPTH 104u
47+ #define PARAM_SRAM_EGRESS_DEPTH 848u
48+ #define PARAM_SRAM_INGRESS_DEPTH 112u
5049#define PARAM_NUM_CMD_INFO 24u
5150#define PARAM_NUM_LOCALITY 5u
52- #define PARAM_TPM_WR_FIFO_PTR_W 7u
53- #define PARAM_TPM_RD_FIFO_PTR_W 5u
54- #define PARAM_TPM_RD_FIFO_WIDTH 32u
51+ #define PARAM_TPM_RD_FIFO_DEPTH 16u
52+ #define PARAM_TPM_WR_FIFO_DEPTH 16u
5553#define PARAM_NUM_IRQS 8u
5654#define PARAM_NUM_ALERTS 1u
5755#define PARAM_REG_WIDTH 32u
@@ -236,6 +234,8 @@ REG32(TPM_WRITE_FIFO, 0x38u)
236234
237235#define SPI_BUS_PROTO_VER 0
238236#define SPI_BUS_HEADER_SIZE (2u * sizeof(uint32_t))
237+ #define SPI_TPM_READ_FIFO_SIZE_BYTES \
238+ (PARAM_TPM_RD_FIFO_DEPTH * sizeof(uint32_t))
239239/**
240240 * Delay for handling non-aligned generic data transfer and flush the FIFO.
241241 * Generic mode is deprecated anyway. Arbitrarily set to 1 ms.
@@ -252,64 +252,67 @@ REG32(TPM_WRITE_FIFO, 0x38u)
252252 */
253253#define SPI_BUS_FLASH_READ_DELAY_NS 100000000u
254254
255- /*
256- * New scheme (Egress + Ingress) Old Scheme (DPSRAM)
257- * +-----------------------------+ +-----------------------+
258- * | Flash / Passthru modes | | Flash / Passthru modes|
259- * 0x000 -+----------------+------+-----+ -+----------------+------+
260- * | Read Command 0 | 1KiB | Out | | Read Command 0 | 1KiB |
261- * 0x400 -+----------------+------+-----+ -+----------------+------+
262- * | Read Command 1 | 1KiB | Out | | Read Command 1 | 1KiB |
263- * 0x800 -+----------------+------+-----+ -+----------------+------+
264- * | Mailbox | 1KiB | Out | | Mailbox | 1KiB |
265- * 0xc00 -+----------------+------+-----+ -+----------------+------+
266- * | SFDP | 256B | Out | | SFDP | 256B |
267- * 0xd00 -+----------------+------+-----+ -+----------------+------+
268- * | | | Payload FIFO | 256B |
269- * 0xe00 -+----------------+------+-----+ -+----------------+------+
270- * | Payload FIFO | 256B | In | | Command FIFO | 64B |
271- * 0xe40 -+----------------+------+-----+ -+----------------+------+
272- * | Command FIFO | 64B | In | | Address FIFO | 64B |
273- * 0xe80 -+----------------+------+-----+ -+----------------+------+
274- * | Address FIFO | 64B | In |
275- * 0xe80 -+----------------+------+-----+
255+ /* Memory layout extracted from the documentation:
256+ * opentitan.org/book/hw/ip/spi_device/doc/programmers_guide.html#dual-port-sram-layout
276257 *
258+ * New scheme (Egress + Ingress) Old Scheme (DPSRAM)
259+ * +--------------------------------+ +-----------------------+
260+ * | Flash / Passthru modes | | Flash / Passthru modes|
261+ * 0x000 -+-------------------+------+-----+ -+----------------+------+
262+ * | Read Command 0 | 1KiB | Out | | Read Command 0 | 1KiB |
263+ * 0x400 -+-------------------+------+-----+ -+----------------+------+
264+ * | Read Command 1 | 1KiB | Out | | Read Command 1 | 1KiB |
265+ * 0x800 -+-------------------+------+-----+ -+----------------+------+
266+ * | Mailbox | 1KiB | Out | | Mailbox | 1KiB |
267+ * 0xc00 -+-------------------+------+-----+ -+----------------+------+
268+ * | SFDP | 256B | Out | | SFDP | 256B |
269+ * 0xd00 -+-------------------+------+-----+ -+----------------+------+
270+ * | TPM Read Buffer | 64B | Out | | Payload FIFO | 256B |
271+ * 0xd40 -+-------------------+------+-----+ -+----------------+------+
272+ * | | | | | Command FIFO | 64B |
273+ * 0xe00 -+-------------------+------+-----+ -+----------------+------+
274+ * | Payload FIFO | 256B | In | | Address FIFO | 64B |
275+ * 0xf00 -+-------------------+------+-----+ -+----------------+------+
276+ * | Command FIFO | 64B | In |
277+ * 0xf40 -+-------------------+------+-----+
278+ * | Address FIFO | 64B | In |
279+ * 0xf80 -+-------------------+------+-----+
280+ * | TPM Write Buffer | 64B | In |
281+ * 0xfc0 -+-------------------+------+-----+
277282 *
278283 */
279- #define SPI_SRAM_READ0_OFFSET 0x0
280- #define SPI_SRAM_READ_SIZE 0x400u
281- #define SPI_SRAM_READ1_OFFSET (SPI_SRAM_READ0_OFFSET + SPI_SRAM_READ_SIZE)
282- #define SPI_SRAM_READ1_SIZE 0x400u
283- #define SPI_SRAM_MBX_OFFSET (SPI_SRAM_READ1_OFFSET + SPI_SRAM_READ_SIZE)
284- #define SPI_SRAM_MBX_SIZE 0x400u
285- #define SPI_SRAM_SFDP_OFFSET (SPI_SRAM_MBX_OFFSET + SPI_SRAM_MBX_SIZE)
286- #define SPI_SRAM_SFDP_SIZE 0x100u
287- /* with new scheme (no dual part SRAM, the following offsets are shifted...) */
288- #define SPI_SRAM_INGRESS_OFFSET 0x100u
289- #define SPI_SRAM_PAYLOAD_OFFSET (SPI_SRAM_SFDP_OFFSET + SPI_SRAM_SFDP_SIZE)
290- #define SPI_SRAM_PAYLOAD_SIZE 0x100u
291- #define SPI_SRAM_CMD_OFFSET (SPI_SRAM_PAYLOAD_OFFSET + SPI_SRAM_PAYLOAD_SIZE)
292- #define SPI_SRAM_CMD_SIZE 0x40u
293- #define SPI_SRAM_ADDR_OFFSET (SPI_SRAM_CMD_OFFSET + SPI_SRAM_CMD_SIZE)
294- #define SPI_SRAM_ADDR_SIZE 0x40u
295- #define SPI_SRAM_ADDR_END (SPI_SRAM_ADDR_OFFSET + SPI_SRAM_ADDR_SIZE)
296- #define SPI_SRAM_END_OFFSET (SPI_SRAM_ADDR_END)
297- static_assert (SPI_SRAM_END_OFFSET == 0xe80u , "Invalid SRAM definition" );
298-
284+ #define SPI_SRAM_READ0_OFFSET 0x0
285+ #define SPI_SRAM_READ_SIZE 0x400u
286+ #define SPI_SRAM_READ1_OFFSET (SPI_SRAM_READ0_OFFSET + SPI_SRAM_READ_SIZE)
287+ #define SPI_SRAM_READ1_SIZE 0x400u
288+ #define SPI_SRAM_MBX_OFFSET (SPI_SRAM_READ1_OFFSET + SPI_SRAM_READ_SIZE)
289+ #define SPI_SRAM_MBX_SIZE 0x400u
290+ #define SPI_SRAM_SFDP_OFFSET (SPI_SRAM_MBX_OFFSET + SPI_SRAM_MBX_SIZE)
291+ #define SPI_SRAM_SFDP_SIZE 0x100u
292+ #define SPI_SRAM_TPM_READ_OFFSET (SPI_SRAM_SFDP_OFFSET + SPI_SRAM_SFDP_SIZE)
293+ #define SPI_SRAM_TPM_READ_SIZE 0x40u
294+ #define SPI_SRAM_INGRESS_OFFSET 0xE00u
295+ #define SPI_SRAM_PAYLOAD_OFFSET SPI_SRAM_INGRESS_OFFSET
296+ #define SPI_SRAM_PAYLOAD_SIZE 0x100u
297+ #define SPI_SRAM_CMD_OFFSET (SPI_SRAM_PAYLOAD_OFFSET + SPI_SRAM_PAYLOAD_SIZE)
298+ #define SPI_SRAM_CMD_SIZE 0x40u
299+ #define SPI_SRAM_ADDR_OFFSET (SPI_SRAM_CMD_OFFSET + SPI_SRAM_CMD_SIZE)
300+ #define SPI_SRAM_ADDR_SIZE 0x40u
301+ #define SPI_SRAM_TPM_WRITE_OFFSET (SPI_SRAM_ADDR_OFFSET + SPI_SRAM_ADDR_SIZE)
302+ #define SPI_SRAM_TPM_WRITE_SIZE 0x40u
303+ #define SPI_SRAM_ADDR_END (SPI_SRAM_TPM_WRITE_OFFSET + SPI_SRAM_TPM_WRITE_SIZE)
304+ #define SPI_SRAM_END_OFFSET (SPI_SRAM_ADDR_END)
299305#define SPI_DEVICE_SIZE 0x2000u
300306#define SPI_DEVICE_SPI_REGS_OFFSET 0u
301307#define SPI_DEVICE_TPM_REGS_OFFSET 0x800u
302308#define SPI_DEVICE_SRAM_OFFSET 0x1000u
303309
304- #define SRAM_SIZE PARAM_SRAM_OFFSET
305- #define EGRESS_BUFFER_SIZE_BYTES \
306- (SPI_SRAM_PAYLOAD_OFFSET - SPI_SRAM_READ0_OFFSET)
307- #define EGRESS_BUFFER_SIZE_WORDS (EGRESS_BUFFER_SIZE_BYTES / sizeof(uint32_t))
308- #define INGRESS_BUFFER_SIZE_BYTES \
309- (SPI_SRAM_END_OFFSET - SPI_SRAM_PAYLOAD_OFFSET)
310- #define INGRESS_BUFFER_SIZE_WORDS (INGRESS_BUFFER_SIZE_BYTES / sizeof(uint32_t))
311-
312- #define FLASH_READ_BUFFER_SIZE (2u * SPI_SRAM_READ_SIZE)
310+ #define SRAM_SIZE (PARAM_SRAM_DEPTH * sizeof(uint32_t))
311+ #define EGRESS_BUFFER_SIZE_BYTES (PARAM_SRAM_EGRESS_DEPTH * sizeof(uint32_t))
312+ #define EGRESS_BUFFER_SIZE_WORDS PARAM_SRAM_EGRESS_DEPTH
313+ #define INGRESS_BUFFER_SIZE_BYTES (PARAM_SRAM_INGRESS_DEPTH * sizeof(uint32_t))
314+ #define INGRESS_BUFFER_SIZE_WORDS PARAM_SRAM_INGRESS_DEPTH
315+ #define FLASH_READ_BUFFER_SIZE (2u * SPI_SRAM_READ_SIZE)
313316
314317#define SPI_DEFAULT_TX_VALUE ((uint8_t)0xffu)
315318#define SPI_FLASH_BUFFER_SIZE 256u
@@ -347,6 +350,10 @@ static_assert((SPI_DEVICE_CMD_HW_STA_COUNT + SPI_DEVICE_CMD_SW_COUNT +
347350static_assert (PARAM_NUM_CMD_INFO ==
348351 SPI_DEVICE_CMD_HW_CFG_FIRST - SPI_DEVICE_CMD_HW_STA_FIRST ,
349352 "Invalid command info definitions" );
353+ static_assert (SPI_SRAM_INGRESS_OFFSET >=
354+ (SPI_SRAM_TPM_READ_OFFSET + SPI_SRAM_TPM_READ_SIZE ),
355+ "SPI SRAM Egress buffers overflow into Ingress buffers" );
356+ static_assert (SPI_SRAM_END_OFFSET == 0xfc0u , "Invalid SRAM definition" );
350357
351358typedef enum {
352359 CTRL_MODE_DISABLED ,
@@ -711,7 +718,6 @@ static void ot_spi_device_clear_modes(OtSPIDeviceState *s)
711718 f -> type = SPI_FLASH_CMD_NONE ;
712719 g_assert (s -> sram );
713720 f -> payload = & ((uint8_t * )s -> sram )[SPI_SRAM_PAYLOAD_OFFSET ];
714- f -> payload += SPI_SRAM_INGRESS_OFFSET ;
715721 memset (f -> buffer , 0u , SPI_FLASH_BUFFER_SIZE );
716722
717723 memset (s -> sram , 0u , SRAM_SIZE );
@@ -1822,27 +1828,34 @@ static MemTxResult ot_spi_device_buf_read_with_attrs(
18221828 (void )attrs ;
18231829 uint32_t val32 ;
18241830
1825- hwaddr last = addr + size - 1u ;
1831+ hwaddr last = ( hwaddr )(( uint32_t ) addr + size - 1u ) ;
18261832
1827- if (last < SPI_SRAM_PAYLOAD_OFFSET + SPI_SRAM_INGRESS_OFFSET ) {
1833+ if (addr < SPI_SRAM_INGRESS_OFFSET ) {
18281834 qemu_log_mask (LOG_GUEST_ERROR ,
18291835 "%s: cannot read egress buffer 0x%" HWADDR_PRIx "\n" ,
18301836 __func__ , addr );
18311837 return MEMTX_DECODE_ERROR ;
18321838 }
1833- if (last < SPI_SRAM_CMD_OFFSET + SPI_SRAM_INGRESS_OFFSET ) {
1834- /* payload buffer */
1839+
1840+ if ((addr >= SPI_SRAM_PAYLOAD_OFFSET &&
1841+ last < (SPI_SRAM_PAYLOAD_OFFSET + SPI_SRAM_PAYLOAD_SIZE )) ||
1842+ (addr >= SPI_SRAM_TPM_WRITE_OFFSET &&
1843+ last < (SPI_SRAM_TPM_WRITE_OFFSET + SPI_SRAM_TPM_WRITE_SIZE ))) {
1844+ /* flash payload and tpm write buffers */
18351845 val32 = s -> sram [addr >> 2u ];
1836- } else if (last < SPI_SRAM_ADDR_OFFSET + SPI_SRAM_INGRESS_OFFSET ) {
1837- /* command FIFO */
1846+ } else if (addr >= SPI_SRAM_CMD_OFFSET &&
1847+ last < (SPI_SRAM_CMD_OFFSET + SPI_SRAM_CMD_SIZE )) {
1848+ /* flash command FIFO */
18381849 val32 = ((const uint32_t * )s -> flash .cmd_fifo .data )[addr >> 2u ];
1839- } else if (last < SPI_SRAM_ADDR_END + SPI_SRAM_INGRESS_OFFSET ) {
1840- /* address FIFO */
1850+ } else if (addr >= SPI_SRAM_ADDR_OFFSET &&
1851+ last < (SPI_SRAM_ADDR_OFFSET + SPI_SRAM_ADDR_SIZE )) {
1852+ /* flash address FIFO */
18411853 val32 = s -> flash .address_fifo .data [addr >> 2u ];
18421854 } else {
1843- /* TPM or not used area */
1844- qemu_log_mask (LOG_UNIMP , "%s: TPM not supported 0x%" HWADDR_PRIx "\n" ,
1845- __func__ , addr );
1855+ qemu_log_mask (LOG_GUEST_ERROR ,
1856+ "%s: Invalid ingress buffer access to 0x%" HWADDR_PRIx
1857+ "-0x%" HWADDR_PRIx "\n" ,
1858+ __func__ , addr , last );
18461859 val32 = 0 ;
18471860 }
18481861
@@ -1870,9 +1883,9 @@ static MemTxResult ot_spi_device_buf_write_with_attrs(
18701883 uint32_t pc = ibex_get_current_pc ();
18711884 trace_ot_spi_device_buf_write_in (s -> ot_id , (uint32_t )addr , size , val32 , pc );
18721885
1873- hwaddr last = addr + size - 1u ;
1886+ hwaddr last = ( hwaddr )(( uint32_t ) addr + size - 1u ) ;
18741887
1875- if (last >= SPI_SRAM_PAYLOAD_OFFSET ) {
1888+ if (last >= SPI_SRAM_INGRESS_OFFSET ) {
18761889 qemu_log_mask (LOG_GUEST_ERROR ,
18771890 "%s: cannot write ingress buffer 0x%" HWADDR_PRIx "\n" ,
18781891 __func__ , addr );
0 commit comments