This OTP is read-only and contains various keys used by the console to
decrypt, encrypt or verify various pieces of storage.
Its size depends on the console, it is 128 bytes on the Wii and
1024 bytes on the Wii U (split into eight 128 bytes banks).
It can be used directly by writing into one register and reading from
the other one, without any additional synchronisation.
Signed-off-by: Emmanuel Gil Peyrot <[email protected]>
---
drivers/nvmem/Kconfig | 11 ++++
drivers/nvmem/Makefile | 2 +
drivers/nvmem/nintendo-otp.c | 115 +++++++++++++++++++++++++++++++++++
3 files changed, 128 insertions(+)
create mode 100644 drivers/nvmem/nintendo-otp.c
diff --git a/drivers/nvmem/Kconfig b/drivers/nvmem/Kconfig
index dd2019006838..dd6196e49b2d 100644
--- a/drivers/nvmem/Kconfig
+++ b/drivers/nvmem/Kconfig
@@ -107,6 +107,17 @@ config MTK_EFUSE
This driver can also be built as a module. If so, the module
will be called efuse-mtk.
+config NVMEM_NINTENDO_OTP
+ tristate "Nintendo Wii and Wii U OTP Support"
+ help
+ This is a driver to expose the OTP on a Nintendo Wii or Wii U.
+
+ This memory contains common and per-console keys, signatures and
+ related data required to access peripherals.
+
+ This driver can also be built as a module. If so, the module
+ will be called nvmem-nintendo-otp.
+
config QCOM_QFPROM
tristate "QCOM QFPROM Support"
depends on ARCH_QCOM || COMPILE_TEST
diff --git a/drivers/nvmem/Makefile b/drivers/nvmem/Makefile
index bbea1410240a..dcbbde35b6a8 100644
--- a/drivers/nvmem/Makefile
+++ b/drivers/nvmem/Makefile
@@ -23,6 +23,8 @@ obj-$(CONFIG_NVMEM_LPC18XX_OTP) += nvmem_lpc18xx_otp.o
nvmem_lpc18xx_otp-y := lpc18xx_otp.o
obj-$(CONFIG_NVMEM_MXS_OCOTP) += nvmem-mxs-ocotp.o
nvmem-mxs-ocotp-y := mxs-ocotp.o
+obj-$(CONFIG_NVMEM_NINTENDO_OTP) += nvmem-nintendo-otp.o
+nvmem-nintendo-otp-y := nintendo-otp.o
obj-$(CONFIG_MTK_EFUSE) += nvmem_mtk-efuse.o
nvmem_mtk-efuse-y := mtk-efuse.o
obj-$(CONFIG_QCOM_QFPROM) += nvmem_qfprom.o
diff --git a/drivers/nvmem/nintendo-otp.c b/drivers/nvmem/nintendo-otp.c
new file mode 100644
index 000000000000..de6f5d7c10ef
--- /dev/null
+++ b/drivers/nvmem/nintendo-otp.c
@@ -0,0 +1,115 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Nintendo Wii and Wii U OTP driver
+ *
+ * Copyright (C) 2021 Emmanuel Gil Peyrot <[email protected]>
+ */
+
+#include <linux/device.h>
+#include <linux/io.h>
+#include <linux/module.h>
+#include <linux/mod_devicetable.h>
+#include <linux/nvmem-provider.h>
+#include <linux/of_device.h>
+#include <linux/platform_device.h>
+
+#define HW_OTPCMD 0
+#define HW_OTPDATA 4
+#define OTP_READ 0x80000000
+
+struct nintendo_otp_priv {
+ void __iomem *regs;
+};
+
+struct nintendo_otp_devtype_data {
+ const char *name;
+ unsigned int num_banks;
+};
+
+static const struct nintendo_otp_devtype_data hollywood_otp_data = {
+ .name = "wii-otp",
+ .num_banks = 1,
+};
+
+static const struct nintendo_otp_devtype_data latte_otp_data = {
+ .name = "wiiu-otp",
+ .num_banks = 8,
+};
+
+static int nintendo_otp_reg_read(void *context,
+ unsigned int reg, void *_val, size_t bytes)
+{
+ struct nintendo_otp_priv *priv = context;
+ u32 *val = _val;
+ int words = bytes >> 2;
+ u32 bank, addr;
+
+ while (words--) {
+ bank = (reg << 1) & ~0xff;
+ addr = (reg >> 2) & 0x1f;
+ iowrite32be(OTP_READ | bank | addr, priv->regs + HW_OTPCMD);
+ *val++ = ioread32be(priv->regs + HW_OTPDATA);
+ reg += 4;
+ }
+
+ return 0;
+}
+
+static const struct of_device_id nintendo_otp_of_table[] = {
+ { .compatible = "nintendo,hollywood-otp", .data = &hollywood_otp_data },
+ { .compatible = "nintendo,latte-otp", .data = &latte_otp_data },
+ {/* sentinel */},
+};
+MODULE_DEVICE_TABLE(of, nintendo_otp_of_table);
+
+static int nintendo_otp_probe(struct platform_device *pdev)
+{
+ struct device *dev = &pdev->dev;
+ const struct of_device_id *of_id =
+ of_match_device(nintendo_otp_of_table, dev);
+ struct resource *res;
+ struct nvmem_device *nvmem;
+ struct nintendo_otp_priv *priv;
+
+ struct nvmem_config config = {
+ .stride = 4,
+ .word_size = 4,
+ .reg_read = nintendo_otp_reg_read,
+ .read_only = true,
+ .root_only = true,
+ };
+
+ priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+ if (!priv)
+ return -ENOMEM;
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ priv->regs = devm_ioremap_resource(dev, res);
+ if (IS_ERR(priv->regs))
+ return PTR_ERR(priv->regs);
+
+ if (of_id->data) {
+ const struct nintendo_otp_devtype_data *data = of_id->data;
+ config.name = data->name;
+ config.size = data->num_banks * 128;
+ }
+
+ config.dev = dev;
+ config.priv = priv;
+
+ nvmem = devm_nvmem_register(dev, &config);
+
+ return PTR_ERR_OR_ZERO(nvmem);
+}
+
+static struct platform_driver nintendo_otp_driver = {
+ .probe = nintendo_otp_probe,
+ .driver = {
+ .name = "nintendo-otp",
+ .of_match_table = nintendo_otp_of_table,
+ },
+};
+module_platform_driver(nintendo_otp_driver);
+MODULE_AUTHOR("Emmanuel Gil Peyrot <[email protected]>");
+MODULE_DESCRIPTION("Nintendo Wii and Wii U OTP driver");
+MODULE_LICENSE("GPL v2");
--
2.31.1
Hi,
On Wed, May 19, 2021 at 11:50:41AM +0200, Emmanuel Gil Peyrot wrote:
> This OTP is read-only and contains various keys used by the console to
> decrypt, encrypt or verify various pieces of storage.
>
> Its size depends on the console, it is 128 bytes on the Wii and
> 1024 bytes on the Wii U (split into eight 128 bytes banks).
>
> It can be used directly by writing into one register and reading from
> the other one, without any additional synchronisation.
>
> Signed-off-by: Emmanuel Gil Peyrot <[email protected]>
> ---
A link to the (third-party) documentation would be nice, either in the
commit message or in the code itself.
(https://wiiubrew.org/wiki/Hardware/OTP i guess)
[...]
> +static int nintendo_otp_reg_read(void *context,
> + unsigned int reg, void *_val, size_t bytes)
> +{
> + struct nintendo_otp_priv *priv = context;
> + u32 *val = _val;
> + int words = bytes >> 2;
> + u32 bank, addr;
> +
> + while (words--) {
> + bank = (reg << 1) & ~0xff;
This is a bit non-obvious, IMHO. As far as I understand it, the expanded
formula is:
bank = (reg / 128) << 8;
I.e. first divide by bank size, then shift the parameter into the right
place.
> + addr = (reg >> 2) & 0x1f;
Here, I think it's about the word size (4 bytes); I think / 4 would be
clearer.
I *think* (but haven't checked) that gcc should generate efficent shifts
for the divisions above, so using the division operator shouldn't be
problem.
> + iowrite32be(OTP_READ | bank | addr, priv->regs + HW_OTPCMD);
> + *val++ = ioread32be(priv->regs + HW_OTPDATA);
> + reg += 4;
> + }
> +
> + return 0;
> +}
> +
[...]
> + if (of_id->data) {
> + const struct nintendo_otp_devtype_data *data = of_id->data;
> + config.name = data->name;
> + config.size = data->num_banks * 128;
Given that 128 appears a few times, perhaps a #define would be good.
> + }
> +
> + config.dev = dev;
> + config.priv = priv;
> +
> + nvmem = devm_nvmem_register(dev, &config);
> +
> + return PTR_ERR_OR_ZERO(nvmem);
> +}
> +
> +static struct platform_driver nintendo_otp_driver = {
> + .probe = nintendo_otp_probe,
> + .driver = {
> + .name = "nintendo-otp",
> + .of_match_table = nintendo_otp_of_table,
> + },
> +};
> +module_platform_driver(nintendo_otp_driver);
> +MODULE_AUTHOR("Emmanuel Gil Peyrot <[email protected]>");
> +MODULE_DESCRIPTION("Nintendo Wii and Wii U OTP driver");
> +MODULE_LICENSE("GPL v2");
> --
> 2.31.1
>
Tested-by: Jonathan Neuschäfer <[email protected]> # on Wii
Thanks,
Jonathan Neuschäfer