qemu

1
/*
2
 * QEMU model of the ZynqMP eFuse
3
 *
4
 * Copyright (c) 2015 Xilinx Inc.
5
 * Copyright (c) 2023 Advanced Micro Devices, Inc.
6
 *
7
 * Written by Edgar E. Iglesias <edgari@xilinx.com>
8
 *
9
 * Permission is hereby granted, free of charge, to any person obtaining a copy
10
 * of this software and associated documentation files (the "Software"), to deal
11
 * in the Software without restriction, including without limitation the rights
12
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
13
 * copies of the Software, and to permit persons to whom the Software is
14
 * furnished to do so, subject to the following conditions:
15
 *
16
 * The above copyright notice and this permission notice shall be included in
17
 * all copies or substantial portions of the Software.
18
 *
19
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
20
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
21
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
22
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
23
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
24
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25
 * THE SOFTWARE.
26
 */
27

28
#include "qemu/osdep.h"
29
#include "hw/nvram/xlnx-zynqmp-efuse.h"
30

31
#include "qemu/log.h"
32
#include "qapi/error.h"
33
#include "migration/vmstate.h"
34
#include "hw/qdev-properties.h"
35

36
#ifndef ZYNQMP_EFUSE_ERR_DEBUG
37
#define ZYNQMP_EFUSE_ERR_DEBUG 0
38
#endif
39

40
REG32(WR_LOCK, 0x0)
41
    FIELD(WR_LOCK, LOCK, 0, 16)
42
REG32(CFG, 0x4)
43
    FIELD(CFG, SLVERR_ENABLE, 5, 1)
44
    FIELD(CFG, MARGIN_RD, 2, 2)
45
    FIELD(CFG, PGM_EN, 1, 1)
46
    FIELD(CFG, EFUSE_CLK_SEL, 0, 1)
47
REG32(STATUS, 0x8)
48
    FIELD(STATUS, AES_CRC_PASS, 7, 1)
49
    FIELD(STATUS, AES_CRC_DONE, 6, 1)
50
    FIELD(STATUS, CACHE_DONE, 5, 1)
51
    FIELD(STATUS, CACHE_LOAD, 4, 1)
52
    FIELD(STATUS, EFUSE_3_TBIT, 2, 1)
53
    FIELD(STATUS, EFUSE_2_TBIT, 1, 1)
54
    FIELD(STATUS, EFUSE_0_TBIT, 0, 1)
55
REG32(EFUSE_PGM_ADDR, 0xc)
56
    FIELD(EFUSE_PGM_ADDR, EFUSE, 11, 2)
57
    FIELD(EFUSE_PGM_ADDR, ROW, 5, 6)
58
    FIELD(EFUSE_PGM_ADDR, COLUMN, 0, 5)
59
REG32(EFUSE_RD_ADDR, 0x10)
60
    FIELD(EFUSE_RD_ADDR, EFUSE, 11, 2)
61
    FIELD(EFUSE_RD_ADDR, ROW, 5, 6)
62
REG32(EFUSE_RD_DATA, 0x14)
63
REG32(TPGM, 0x18)
64
    FIELD(TPGM, VALUE, 0, 16)
65
REG32(TRD, 0x1c)
66
    FIELD(TRD, VALUE, 0, 8)
67
REG32(TSU_H_PS, 0x20)
68
    FIELD(TSU_H_PS, VALUE, 0, 8)
69
REG32(TSU_H_PS_CS, 0x24)
70
    FIELD(TSU_H_PS_CS, VALUE, 0, 8)
71
REG32(TSU_H_CS, 0x2c)
72
    FIELD(TSU_H_CS, VALUE, 0, 4)
73
REG32(EFUSE_ISR, 0x30)
74
    FIELD(EFUSE_ISR, APB_SLVERR, 31, 1)
75
    FIELD(EFUSE_ISR, CACHE_ERROR, 4, 1)
76
    FIELD(EFUSE_ISR, RD_ERROR, 3, 1)
77
    FIELD(EFUSE_ISR, RD_DONE, 2, 1)
78
    FIELD(EFUSE_ISR, PGM_ERROR, 1, 1)
79
    FIELD(EFUSE_ISR, PGM_DONE, 0, 1)
80
REG32(EFUSE_IMR, 0x34)
81
    FIELD(EFUSE_IMR, APB_SLVERR, 31, 1)
82
    FIELD(EFUSE_IMR, CACHE_ERROR, 4, 1)
83
    FIELD(EFUSE_IMR, RD_ERROR, 3, 1)
84
    FIELD(EFUSE_IMR, RD_DONE, 2, 1)
85
    FIELD(EFUSE_IMR, PGM_ERROR, 1, 1)
86
    FIELD(EFUSE_IMR, PGM_DONE, 0, 1)
87
REG32(EFUSE_IER, 0x38)
88
    FIELD(EFUSE_IER, APB_SLVERR, 31, 1)
89
    FIELD(EFUSE_IER, CACHE_ERROR, 4, 1)
90
    FIELD(EFUSE_IER, RD_ERROR, 3, 1)
91
    FIELD(EFUSE_IER, RD_DONE, 2, 1)
92
    FIELD(EFUSE_IER, PGM_ERROR, 1, 1)
93
    FIELD(EFUSE_IER, PGM_DONE, 0, 1)
94
REG32(EFUSE_IDR, 0x3c)
95
    FIELD(EFUSE_IDR, APB_SLVERR, 31, 1)
96
    FIELD(EFUSE_IDR, CACHE_ERROR, 4, 1)
97
    FIELD(EFUSE_IDR, RD_ERROR, 3, 1)
98
    FIELD(EFUSE_IDR, RD_DONE, 2, 1)
99
    FIELD(EFUSE_IDR, PGM_ERROR, 1, 1)
100
    FIELD(EFUSE_IDR, PGM_DONE, 0, 1)
101
REG32(EFUSE_CACHE_LOAD, 0x40)
102
    FIELD(EFUSE_CACHE_LOAD, LOAD, 0, 1)
103
REG32(EFUSE_PGM_LOCK, 0x44)
104
    FIELD(EFUSE_PGM_LOCK, SPK_ID_LOCK, 0, 1)
105
REG32(EFUSE_AES_CRC, 0x48)
106
REG32(EFUSE_TBITS_PRGRMG_EN, 0x100)
107
    FIELD(EFUSE_TBITS_PRGRMG_EN, TBITS_PRGRMG_EN, 3, 1)
108
REG32(DNA_0, 0x100c)
109
REG32(DNA_1, 0x1010)
110
REG32(DNA_2, 0x1014)
111
REG32(IPDISABLE, 0x1018)
112
    FIELD(IPDISABLE, VCU_DIS, 8, 1)
113
    FIELD(IPDISABLE, GPU_DIS, 5, 1)
114
    FIELD(IPDISABLE, APU3_DIS, 3, 1)
115
    FIELD(IPDISABLE, APU2_DIS, 2, 1)
116
    FIELD(IPDISABLE, APU1_DIS, 1, 1)
117
    FIELD(IPDISABLE, APU0_DIS, 0, 1)
118
REG32(SYSOSC_CTRL, 0x101c)
119
    FIELD(SYSOSC_CTRL, SYSOSC_EN, 0, 1)
120
REG32(USER_0, 0x1020)
121
REG32(USER_1, 0x1024)
122
REG32(USER_2, 0x1028)
123
REG32(USER_3, 0x102c)
124
REG32(USER_4, 0x1030)
125
REG32(USER_5, 0x1034)
126
REG32(USER_6, 0x1038)
127
REG32(USER_7, 0x103c)
128
REG32(MISC_USER_CTRL, 0x1040)
129
    FIELD(MISC_USER_CTRL, FPD_SC_EN_0, 14, 1)
130
    FIELD(MISC_USER_CTRL, LPD_SC_EN_0, 11, 1)
131
    FIELD(MISC_USER_CTRL, LBIST_EN, 10, 1)
132
    FIELD(MISC_USER_CTRL, USR_WRLK_7, 7, 1)
133
    FIELD(MISC_USER_CTRL, USR_WRLK_6, 6, 1)
134
    FIELD(MISC_USER_CTRL, USR_WRLK_5, 5, 1)
135
    FIELD(MISC_USER_CTRL, USR_WRLK_4, 4, 1)
136
    FIELD(MISC_USER_CTRL, USR_WRLK_3, 3, 1)
137
    FIELD(MISC_USER_CTRL, USR_WRLK_2, 2, 1)
138
    FIELD(MISC_USER_CTRL, USR_WRLK_1, 1, 1)
139
    FIELD(MISC_USER_CTRL, USR_WRLK_0, 0, 1)
140
REG32(ROM_RSVD, 0x1044)
141
    FIELD(ROM_RSVD, PBR_BOOT_ERROR, 0, 3)
142
REG32(PUF_CHASH, 0x1050)
143
REG32(PUF_MISC, 0x1054)
144
    FIELD(PUF_MISC, REGISTER_DIS, 31, 1)
145
    FIELD(PUF_MISC, SYN_WRLK, 30, 1)
146
    FIELD(PUF_MISC, SYN_INVLD, 29, 1)
147
    FIELD(PUF_MISC, TEST2_DIS, 28, 1)
148
    FIELD(PUF_MISC, UNUSED27, 27, 1)
149
    FIELD(PUF_MISC, UNUSED26, 26, 1)
150
    FIELD(PUF_MISC, UNUSED25, 25, 1)
151
    FIELD(PUF_MISC, UNUSED24, 24, 1)
152
    FIELD(PUF_MISC, AUX, 0, 24)
153
REG32(SEC_CTRL, 0x1058)
154
    FIELD(SEC_CTRL, PPK1_INVLD, 30, 2)
155
    FIELD(SEC_CTRL, PPK1_WRLK, 29, 1)
156
    FIELD(SEC_CTRL, PPK0_INVLD, 27, 2)
157
    FIELD(SEC_CTRL, PPK0_WRLK, 26, 1)
158
    FIELD(SEC_CTRL, RSA_EN, 11, 15)
159
    FIELD(SEC_CTRL, SEC_LOCK, 10, 1)
160
    FIELD(SEC_CTRL, PROG_GATE_2, 9, 1)
161
    FIELD(SEC_CTRL, PROG_GATE_1, 8, 1)
162
    FIELD(SEC_CTRL, PROG_GATE_0, 7, 1)
163
    FIELD(SEC_CTRL, DFT_DIS, 6, 1)
164
    FIELD(SEC_CTRL, JTAG_DIS, 5, 1)
165
    FIELD(SEC_CTRL, ERROR_DIS, 4, 1)
166
    FIELD(SEC_CTRL, BBRAM_DIS, 3, 1)
167
    FIELD(SEC_CTRL, ENC_ONLY, 2, 1)
168
    FIELD(SEC_CTRL, AES_WRLK, 1, 1)
169
    FIELD(SEC_CTRL, AES_RDLK, 0, 1)
170
REG32(SPK_ID, 0x105c)
171
REG32(PPK0_0, 0x10a0)
172
REG32(PPK0_1, 0x10a4)
173
REG32(PPK0_2, 0x10a8)
174
REG32(PPK0_3, 0x10ac)
175
REG32(PPK0_4, 0x10b0)
176
REG32(PPK0_5, 0x10b4)
177
REG32(PPK0_6, 0x10b8)
178
REG32(PPK0_7, 0x10bc)
179
REG32(PPK0_8, 0x10c0)
180
REG32(PPK0_9, 0x10c4)
181
REG32(PPK0_10, 0x10c8)
182
REG32(PPK0_11, 0x10cc)
183
REG32(PPK1_0, 0x10d0)
184
REG32(PPK1_1, 0x10d4)
185
REG32(PPK1_2, 0x10d8)
186
REG32(PPK1_3, 0x10dc)
187
REG32(PPK1_4, 0x10e0)
188
REG32(PPK1_5, 0x10e4)
189
REG32(PPK1_6, 0x10e8)
190
REG32(PPK1_7, 0x10ec)
191
REG32(PPK1_8, 0x10f0)
192
REG32(PPK1_9, 0x10f4)
193
REG32(PPK1_10, 0x10f8)
194
REG32(PPK1_11, 0x10fc)
195

196
#define BIT_POS(ROW, COLUMN)    (ROW * 32 + COLUMN)
197
#define R_MAX (R_PPK1_11 + 1)
198

199
/* #define EFUSE_XOSC            26 */
200

201
/*
202
 * eFUSE layout references:
203
 *   ZynqMP: UG1085 (v2.1) August 21, 2019, p.277, Table 12-13
204
 */
205
#define EFUSE_AES_RDLK        BIT_POS(22, 0)
206
#define EFUSE_AES_WRLK        BIT_POS(22, 1)
207
#define EFUSE_ENC_ONLY        BIT_POS(22, 2)
208
#define EFUSE_BBRAM_DIS       BIT_POS(22, 3)
209
#define EFUSE_ERROR_DIS       BIT_POS(22, 4)
210
#define EFUSE_JTAG_DIS        BIT_POS(22, 5)
211
#define EFUSE_DFT_DIS         BIT_POS(22, 6)
212
#define EFUSE_PROG_GATE_0     BIT_POS(22, 7)
213
#define EFUSE_PROG_GATE_1     BIT_POS(22, 7)
214
#define EFUSE_PROG_GATE_2     BIT_POS(22, 9)
215
#define EFUSE_SEC_LOCK        BIT_POS(22, 10)
216
#define EFUSE_RSA_EN          BIT_POS(22, 11)
217
#define EFUSE_RSA_EN14        BIT_POS(22, 25)
218
#define EFUSE_PPK0_WRLK       BIT_POS(22, 26)
219
#define EFUSE_PPK0_INVLD      BIT_POS(22, 27)
220
#define EFUSE_PPK0_INVLD_1    BIT_POS(22, 28)
221
#define EFUSE_PPK1_WRLK       BIT_POS(22, 29)
222
#define EFUSE_PPK1_INVLD      BIT_POS(22, 30)
223
#define EFUSE_PPK1_INVLD_1    BIT_POS(22, 31)
224

225
/* Areas.  */
226
#define EFUSE_TRIM_START      BIT_POS(1, 0)
227
#define EFUSE_TRIM_END        BIT_POS(1, 30)
228
#define EFUSE_DNA_START       BIT_POS(3, 0)
229
#define EFUSE_DNA_END         BIT_POS(5, 31)
230
#define EFUSE_AES_START       BIT_POS(24, 0)
231
#define EFUSE_AES_END         BIT_POS(31, 31)
232
#define EFUSE_ROM_START       BIT_POS(17, 0)
233
#define EFUSE_ROM_END         BIT_POS(17, 31)
234
#define EFUSE_IPDIS_START     BIT_POS(6, 0)
235
#define EFUSE_IPDIS_END       BIT_POS(6, 31)
236
#define EFUSE_USER_START      BIT_POS(8, 0)
237
#define EFUSE_USER_END        BIT_POS(15, 31)
238
#define EFUSE_BISR_START      BIT_POS(32, 0)
239
#define EFUSE_BISR_END        BIT_POS(39, 31)
240

241
#define EFUSE_USER_CTRL_START BIT_POS(16, 0)
242
#define EFUSE_USER_CTRL_END   BIT_POS(16, 16)
243
#define EFUSE_USER_CTRL_MASK  ((uint32_t)MAKE_64BIT_MASK(0, 17))
244

245
#define EFUSE_PUF_CHASH_START BIT_POS(20, 0)
246
#define EFUSE_PUF_CHASH_END   BIT_POS(20, 31)
247
#define EFUSE_PUF_MISC_START  BIT_POS(21, 0)
248
#define EFUSE_PUF_MISC_END    BIT_POS(21, 31)
249
#define EFUSE_PUF_SYN_WRLK    BIT_POS(21, 30)
250

251
#define EFUSE_SPK_START       BIT_POS(23, 0)
252
#define EFUSE_SPK_END         BIT_POS(23, 31)
253

254
#define EFUSE_PPK0_START      BIT_POS(40, 0)
255
#define EFUSE_PPK0_END        BIT_POS(51, 31)
256
#define EFUSE_PPK1_START      BIT_POS(52, 0)
257
#define EFUSE_PPK1_END        BIT_POS(63, 31)
258

259
#define EFUSE_CACHE_FLD(s, reg, field) \
260
    ARRAY_FIELD_DP32((s)->regs, reg, field, \
261
                     (xlnx_efuse_get_row((s->efuse), EFUSE_ ## field) \
262
                      >> (EFUSE_ ## field % 32)))
263

264
#define EFUSE_CACHE_BIT(s, reg, field) \
265
    ARRAY_FIELD_DP32((s)->regs, reg, field, xlnx_efuse_get_bit((s->efuse), \
266
                EFUSE_ ## field))
267

268
#define FBIT_UNKNOWN (~0)
269

270
QEMU_BUILD_BUG_ON(R_MAX != ARRAY_SIZE(((XlnxZynqMPEFuse *)0)->regs));
271

272
static void update_tbit_status(XlnxZynqMPEFuse *s)
273
{
274
    unsigned int check = xlnx_efuse_tbits_check(s->efuse);
275
    uint32_t val = s->regs[R_STATUS];
276

277
    val = FIELD_DP32(val, STATUS, EFUSE_0_TBIT, !!(check & (1 << 0)));
278
    val = FIELD_DP32(val, STATUS, EFUSE_2_TBIT, !!(check & (1 << 1)));
279
    val = FIELD_DP32(val, STATUS, EFUSE_3_TBIT, !!(check & (1 << 2)));
280

281
    s->regs[R_STATUS] = val;
282
}
283

284
/* Update the u32 array from efuse bits. Slow but simple approach.  */
285
static void cache_sync_u32(XlnxZynqMPEFuse *s, unsigned int r_start,
286
                           unsigned int f_start, unsigned int f_end,
287
                           unsigned int f_written)
288
{
289
    uint32_t *u32 = &s->regs[r_start];
290
    unsigned int fbit, wbits = 0, u32_off = 0;
291

292
    /* Avoid working on bits that are not relevant.  */
293
    if (f_written != FBIT_UNKNOWN
294
        && (f_written < f_start || f_written > f_end)) {
295
        return;
296
    }
297

298
    for (fbit = f_start; fbit <= f_end; fbit++, wbits++) {
299
        if (wbits == 32) {
300
            /* Update the key offset.  */
301
            u32_off += 1;
302
            wbits = 0;
303
        }
304
        u32[u32_off] |= xlnx_efuse_get_bit(s->efuse, fbit) << wbits;
305
    }
306
}
307

308
/*
309
 * Keep the syncs in bit order so we can bail out for the
310
 * slower ones.
311
 */
312
static void zynqmp_efuse_sync_cache(XlnxZynqMPEFuse *s, unsigned int bit)
313
{
314
    EFUSE_CACHE_BIT(s, SEC_CTRL, AES_RDLK);
315
    EFUSE_CACHE_BIT(s, SEC_CTRL, AES_WRLK);
316
    EFUSE_CACHE_BIT(s, SEC_CTRL, ENC_ONLY);
317
    EFUSE_CACHE_BIT(s, SEC_CTRL, BBRAM_DIS);
318
    EFUSE_CACHE_BIT(s, SEC_CTRL, ERROR_DIS);
319
    EFUSE_CACHE_BIT(s, SEC_CTRL, JTAG_DIS);
320
    EFUSE_CACHE_BIT(s, SEC_CTRL, DFT_DIS);
321
    EFUSE_CACHE_BIT(s, SEC_CTRL, PROG_GATE_0);
322
    EFUSE_CACHE_BIT(s, SEC_CTRL, PROG_GATE_1);
323
    EFUSE_CACHE_BIT(s, SEC_CTRL, PROG_GATE_2);
324
    EFUSE_CACHE_BIT(s, SEC_CTRL, SEC_LOCK);
325
    EFUSE_CACHE_BIT(s, SEC_CTRL, PPK0_WRLK);
326
    EFUSE_CACHE_BIT(s, SEC_CTRL, PPK1_WRLK);
327

328
    EFUSE_CACHE_FLD(s, SEC_CTRL, RSA_EN);
329
    EFUSE_CACHE_FLD(s, SEC_CTRL, PPK0_INVLD);
330
    EFUSE_CACHE_FLD(s, SEC_CTRL, PPK1_INVLD);
331

332
    /* Update the tbits.  */
333
    update_tbit_status(s);
334

335
    /* Sync the various areas.  */
336
    s->regs[R_MISC_USER_CTRL] = xlnx_efuse_get_row(s->efuse,
337
                                                   EFUSE_USER_CTRL_START)
338
                                & EFUSE_USER_CTRL_MASK;
339
    s->regs[R_PUF_CHASH] = xlnx_efuse_get_row(s->efuse, EFUSE_PUF_CHASH_START);
340
    s->regs[R_PUF_MISC]  = xlnx_efuse_get_row(s->efuse, EFUSE_PUF_MISC_START);
341

342
    cache_sync_u32(s, R_DNA_0, EFUSE_DNA_START, EFUSE_DNA_END, bit);
343

344
    if (bit < EFUSE_AES_START) {
345
        return;
346
    }
347

348
    cache_sync_u32(s, R_ROM_RSVD, EFUSE_ROM_START, EFUSE_ROM_END, bit);
349
    cache_sync_u32(s, R_IPDISABLE, EFUSE_IPDIS_START, EFUSE_IPDIS_END, bit);
350
    cache_sync_u32(s, R_USER_0, EFUSE_USER_START, EFUSE_USER_END, bit);
351
    cache_sync_u32(s, R_SPK_ID, EFUSE_SPK_START, EFUSE_SPK_END, bit);
352
    cache_sync_u32(s, R_PPK0_0, EFUSE_PPK0_START, EFUSE_PPK0_END, bit);
353
    cache_sync_u32(s, R_PPK1_0, EFUSE_PPK1_START, EFUSE_PPK1_END, bit);
354
}
355

356
static void zynqmp_efuse_update_irq(XlnxZynqMPEFuse *s)
357
{
358
    bool pending = s->regs[R_EFUSE_ISR] & s->regs[R_EFUSE_IMR];
359
    qemu_set_irq(s->irq, pending);
360
}
361

362
static void zynqmp_efuse_isr_postw(RegisterInfo *reg, uint64_t val64)
363
{
364
    XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(reg->opaque);
365
    zynqmp_efuse_update_irq(s);
366
}
367

368
static uint64_t zynqmp_efuse_ier_prew(RegisterInfo *reg, uint64_t val64)
369
{
370
    XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(reg->opaque);
371
    uint32_t val = val64;
372

373
    s->regs[R_EFUSE_IMR] |= val;
374
    zynqmp_efuse_update_irq(s);
375
    return 0;
376
}
377

378
static uint64_t zynqmp_efuse_idr_prew(RegisterInfo *reg, uint64_t val64)
379
{
380
    XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(reg->opaque);
381
    uint32_t val = val64;
382

383
    s->regs[R_EFUSE_IMR] &= ~val;
384
    zynqmp_efuse_update_irq(s);
385
    return 0;
386
}
387

388
static void zynqmp_efuse_pgm_addr_postw(RegisterInfo *reg, uint64_t val64)
389
{
390
    XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(reg->opaque);
391
    unsigned bit = val64;
392
    unsigned page = FIELD_EX32(bit, EFUSE_PGM_ADDR, EFUSE);
393
    bool puf_prot = false;
394
    const char *errmsg = NULL;
395

396
    /* Allow only valid array, and adjust for skipped array 1 */
397
    switch (page) {
398
    case 0:
399
        break;
400
    case 2 ... 3:
401
        bit = FIELD_DP32(bit, EFUSE_PGM_ADDR, EFUSE, page - 1);
402
        puf_prot = xlnx_efuse_get_bit(s->efuse, EFUSE_PUF_SYN_WRLK);
403
        break;
404
    default:
405
        errmsg = "Invalid address";
406
        goto pgm_done;
407
    }
408

409
    if (ARRAY_FIELD_EX32(s->regs, WR_LOCK, LOCK)) {
410
        errmsg = "Array write-locked";
411
        goto pgm_done;
412
    }
413

414
    if (!ARRAY_FIELD_EX32(s->regs, CFG, PGM_EN)) {
415
        errmsg = "Array pgm-disabled";
416
        goto pgm_done;
417
    }
418

419
    if (puf_prot) {
420
        errmsg = "PUF_HD-store write-locked";
421
        goto pgm_done;
422
    }
423

424
    if (ARRAY_FIELD_EX32(s->regs, SEC_CTRL, AES_WRLK)
425
        && bit >= EFUSE_AES_START && bit <= EFUSE_AES_END) {
426
        errmsg = "AES key-store Write-locked";
427
        goto pgm_done;
428
    }
429

430
    if (!xlnx_efuse_set_bit(s->efuse, bit)) {
431
        errmsg = "Write failed";
432
    }
433

434
 pgm_done:
435
    if (!errmsg) {
436
        ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, PGM_ERROR, 0);
437
    } else {
438
        g_autofree char *path = object_get_canonical_path(OBJECT(s));
439

440
        ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, PGM_ERROR, 1);
441
        qemu_log_mask(LOG_GUEST_ERROR,
442
                      "%s - eFuse write error: %s; addr=0x%x\n",
443
                      path, errmsg, (unsigned)val64);
444
    }
445

446
    ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, PGM_DONE, 1);
447
    zynqmp_efuse_update_irq(s);
448
}
449

450
static void zynqmp_efuse_rd_addr_postw(RegisterInfo *reg, uint64_t val64)
451
{
452
    XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(reg->opaque);
453
    g_autofree char *path = NULL;
454

455
    /*
456
     * Grant reads only to allowed bits; reference sources:
457
     * 1/ XilSKey - XilSKey_ZynqMp_EfusePs_ReadRow()
458
     * 2/ UG1085, v2.0, table 12-13
459
     * (note: enumerates the masks as <first, last> per described in
460
     *  references to avoid mental translation).
461
     */
462
#define COL_MASK(L_, H_) \
463
    ((uint32_t)MAKE_64BIT_MASK((L_), (1 + (H_) - (L_))))
464

465
    static const uint32_t ary0_col_mask[] = {
466
        /* XilSKey - XSK_ZYNQMP_EFUSEPS_TBITS_ROW */
467
        [0]  = COL_MASK(28, 31),
468

469
        /* XilSKey - XSK_ZYNQMP_EFUSEPS_USR{0:7}_FUSE_ROW */
470
        [8]  = COL_MASK(0, 31), [9]  = COL_MASK(0, 31),
471
        [10] = COL_MASK(0, 31), [11] = COL_MASK(0, 31),
472
        [12] = COL_MASK(0, 31), [13] = COL_MASK(0, 31),
473
        [14] = COL_MASK(0, 31), [15] = COL_MASK(0, 31),
474

475
        /* XilSKey - XSK_ZYNQMP_EFUSEPS_MISC_USR_CTRL_ROW */
476
        [16] = COL_MASK(0, 7) | COL_MASK(10, 16),
477

478
        /* XilSKey - XSK_ZYNQMP_EFUSEPS_PBR_BOOT_ERR_ROW */
479
        [17] = COL_MASK(0, 2),
480

481
        /* XilSKey - XSK_ZYNQMP_EFUSEPS_PUF_CHASH_ROW */
482
        [20] = COL_MASK(0, 31),
483

484
        /* XilSKey - XSK_ZYNQMP_EFUSEPS_PUF_AUX_ROW */
485
        [21] = COL_MASK(0, 23) | COL_MASK(29, 31),
486

487
        /* XilSKey - XSK_ZYNQMP_EFUSEPS_SEC_CTRL_ROW */
488
        [22] = COL_MASK(0, 31),
489

490
        /* XilSKey - XSK_ZYNQMP_EFUSEPS_SPK_ID_ROW */
491
        [23] = COL_MASK(0, 31),
492

493
        /* XilSKey - XSK_ZYNQMP_EFUSEPS_PPK0_START_ROW */
494
        [40] = COL_MASK(0, 31), [41] = COL_MASK(0, 31),
495
        [42] = COL_MASK(0, 31), [43] = COL_MASK(0, 31),
496
        [44] = COL_MASK(0, 31), [45] = COL_MASK(0, 31),
497
        [46] = COL_MASK(0, 31), [47] = COL_MASK(0, 31),
498
        [48] = COL_MASK(0, 31), [49] = COL_MASK(0, 31),
499
        [50] = COL_MASK(0, 31), [51] = COL_MASK(0, 31),
500

501
        /* XilSKey - XSK_ZYNQMP_EFUSEPS_PPK1_START_ROW */
502
        [52] = COL_MASK(0, 31), [53] = COL_MASK(0, 31),
503
        [54] = COL_MASK(0, 31), [55] = COL_MASK(0, 31),
504
        [56] = COL_MASK(0, 31), [57] = COL_MASK(0, 31),
505
        [58] = COL_MASK(0, 31), [59] = COL_MASK(0, 31),
506
        [60] = COL_MASK(0, 31), [61] = COL_MASK(0, 31),
507
        [62] = COL_MASK(0, 31), [63] = COL_MASK(0, 31),
508
    };
509

510
    uint32_t col_mask = COL_MASK(0, 31);
511
#undef COL_MASK
512

513
    uint32_t efuse_idx = s->regs[R_EFUSE_RD_ADDR];
514
    uint32_t efuse_ary = FIELD_EX32(efuse_idx, EFUSE_RD_ADDR, EFUSE);
515
    uint32_t efuse_row = FIELD_EX32(efuse_idx, EFUSE_RD_ADDR, ROW);
516

517
    switch (efuse_ary) {
518
    case 0:     /* Various */
519
        if (efuse_row >= ARRAY_SIZE(ary0_col_mask)) {
520
            goto denied;
521
        }
522

523
        col_mask = ary0_col_mask[efuse_row];
524
        if (!col_mask) {
525
            goto denied;
526
        }
527
        break;
528
    case 2:     /* PUF helper data, adjust for skipped array 1 */
529
    case 3:
530
        val64 = FIELD_DP32(efuse_idx, EFUSE_RD_ADDR, EFUSE, efuse_ary - 1);
531
        break;
532
    default:
533
        goto denied;
534
    }
535

536
    s->regs[R_EFUSE_RD_DATA] = xlnx_efuse_get_row(s->efuse, val64) & col_mask;
537

538
    ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, RD_ERROR, 0);
539
    ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, RD_DONE, 1);
540
    zynqmp_efuse_update_irq(s);
541
    return;
542

543
 denied:
544
    path = object_get_canonical_path(OBJECT(s));
545
    qemu_log_mask(LOG_GUEST_ERROR,
546
                  "%s: Denied efuse read from array %u, row %u\n",
547
                  path, efuse_ary, efuse_row);
548

549
    s->regs[R_EFUSE_RD_DATA] = 0;
550

551
    ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, RD_ERROR, 1);
552
    ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, RD_DONE, 0);
553
    zynqmp_efuse_update_irq(s);
554
}
555

556
static void zynqmp_efuse_aes_crc_postw(RegisterInfo *reg, uint64_t val64)
557
{
558
    XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(reg->opaque);
559
    bool ok;
560

561
    ok = xlnx_efuse_k256_check(s->efuse, (uint32_t)val64, EFUSE_AES_START);
562

563
    ARRAY_FIELD_DP32(s->regs, STATUS, AES_CRC_PASS, (ok ? 1 : 0));
564
    ARRAY_FIELD_DP32(s->regs, STATUS, AES_CRC_DONE, 1);
565

566
    s->regs[R_EFUSE_AES_CRC] = 0;   /* crc value is write-only */
567
}
568

569
static uint64_t zynqmp_efuse_cache_load_prew(RegisterInfo *reg,
570
                                             uint64_t valu64)
571
{
572
    XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(reg->opaque);
573

574
    if (valu64 & R_EFUSE_CACHE_LOAD_LOAD_MASK) {
575
        zynqmp_efuse_sync_cache(s, FBIT_UNKNOWN);
576
        ARRAY_FIELD_DP32(s->regs, STATUS, CACHE_DONE, 1);
577
        zynqmp_efuse_update_irq(s);
578
    }
579

580
    return 0;
581
}
582

583
static uint64_t zynqmp_efuse_wr_lock_prew(RegisterInfo *reg, uint64_t val)
584
{
585
    return val == 0xDF0D ? 0 : 1;
586
}
587

588
static RegisterAccessInfo zynqmp_efuse_regs_info[] = {
589
    {   .name = "WR_LOCK",  .addr = A_WR_LOCK,
590
        .reset = 0x1,
591
        .pre_write = zynqmp_efuse_wr_lock_prew,
592
    },{ .name = "CFG",  .addr = A_CFG,
593
    },{ .name = "STATUS",  .addr = A_STATUS,
594
        .rsvd = 0x8,
595
        .ro = 0xff,
596
    },{ .name = "EFUSE_PGM_ADDR",  .addr = A_EFUSE_PGM_ADDR,
597
         .post_write = zynqmp_efuse_pgm_addr_postw
598
    },{ .name = "EFUSE_RD_ADDR",  .addr = A_EFUSE_RD_ADDR,
599
        .rsvd = 0x1f,
600
        .post_write = zynqmp_efuse_rd_addr_postw,
601
    },{ .name = "EFUSE_RD_DATA",  .addr = A_EFUSE_RD_DATA,
602
        .ro = 0xffffffff,
603
    },{ .name = "TPGM",  .addr = A_TPGM,
604
    },{ .name = "TRD",  .addr = A_TRD,
605
        .reset = 0x1b,
606
    },{ .name = "TSU_H_PS",  .addr = A_TSU_H_PS,
607
        .reset = 0xff,
608
    },{ .name = "TSU_H_PS_CS",  .addr = A_TSU_H_PS_CS,
609
        .reset = 0xb,
610
    },{ .name = "TSU_H_CS",  .addr = A_TSU_H_CS,
611
        .reset = 0x7,
612
    },{ .name = "EFUSE_ISR",  .addr = A_EFUSE_ISR,
613
        .rsvd = 0x7fffffe0,
614
        .w1c = 0x8000001f,
615
        .post_write = zynqmp_efuse_isr_postw,
616
    },{ .name = "EFUSE_IMR",  .addr = A_EFUSE_IMR,
617
        .reset = 0x8000001f,
618
        .rsvd = 0x7fffffe0,
619
        .ro = 0xffffffff,
620
    },{ .name = "EFUSE_IER",  .addr = A_EFUSE_IER,
621
        .rsvd = 0x7fffffe0,
622
        .pre_write = zynqmp_efuse_ier_prew,
623
    },{ .name = "EFUSE_IDR",  .addr = A_EFUSE_IDR,
624
        .rsvd = 0x7fffffe0,
625
        .pre_write = zynqmp_efuse_idr_prew,
626
    },{ .name = "EFUSE_CACHE_LOAD",  .addr = A_EFUSE_CACHE_LOAD,
627
        .pre_write = zynqmp_efuse_cache_load_prew,
628
    },{ .name = "EFUSE_PGM_LOCK",  .addr = A_EFUSE_PGM_LOCK,
629
    },{ .name = "EFUSE_AES_CRC",  .addr = A_EFUSE_AES_CRC,
630
        .post_write = zynqmp_efuse_aes_crc_postw,
631
    },{ .name = "EFUSE_TBITS_PRGRMG_EN",  .addr = A_EFUSE_TBITS_PRGRMG_EN,
632
        .reset = R_EFUSE_TBITS_PRGRMG_EN_TBITS_PRGRMG_EN_MASK,
633
    },{ .name = "DNA_0",  .addr = A_DNA_0,
634
        .ro = 0xffffffff,
635
    },{ .name = "DNA_1",  .addr = A_DNA_1,
636
        .ro = 0xffffffff,
637
    },{ .name = "DNA_2",  .addr = A_DNA_2,
638
        .ro = 0xffffffff,
639
    },{ .name = "IPDISABLE",  .addr = A_IPDISABLE,
640
        .ro = 0xffffffff,
641
    },{ .name = "SYSOSC_CTRL",  .addr = A_SYSOSC_CTRL,
642
        .ro = 0xffffffff,
643
    },{ .name = "USER_0",  .addr = A_USER_0,
644
        .ro = 0xffffffff,
645
    },{ .name = "USER_1",  .addr = A_USER_1,
646
        .ro = 0xffffffff,
647
    },{ .name = "USER_2",  .addr = A_USER_2,
648
        .ro = 0xffffffff,
649
    },{ .name = "USER_3",  .addr = A_USER_3,
650
        .ro = 0xffffffff,
651
    },{ .name = "USER_4",  .addr = A_USER_4,
652
        .ro = 0xffffffff,
653
    },{ .name = "USER_5",  .addr = A_USER_5,
654
        .ro = 0xffffffff,
655
    },{ .name = "USER_6",  .addr = A_USER_6,
656
        .ro = 0xffffffff,
657
    },{ .name = "USER_7",  .addr = A_USER_7,
658
        .ro = 0xffffffff,
659
    },{ .name = "MISC_USER_CTRL",  .addr = A_MISC_USER_CTRL,
660
        .ro = 0xffffffff,
661
    },{ .name = "ROM_RSVD",  .addr = A_ROM_RSVD,
662
        .ro = 0xffffffff,
663
    },{ .name = "PUF_CHASH", .addr = A_PUF_CHASH,
664
        .ro = 0xffffffff,
665
    },{ .name = "PUF_MISC",  .addr = A_PUF_MISC,
666
        .ro = 0xffffffff,
667
    },{ .name = "SEC_CTRL",  .addr = A_SEC_CTRL,
668
        .ro = 0xffffffff,
669
    },{ .name = "SPK_ID",  .addr = A_SPK_ID,
670
        .ro = 0xffffffff,
671
    },{ .name = "PPK0_0",  .addr = A_PPK0_0,
672
        .ro = 0xffffffff,
673
    },{ .name = "PPK0_1",  .addr = A_PPK0_1,
674
        .ro = 0xffffffff,
675
    },{ .name = "PPK0_2",  .addr = A_PPK0_2,
676
        .ro = 0xffffffff,
677
    },{ .name = "PPK0_3",  .addr = A_PPK0_3,
678
        .ro = 0xffffffff,
679
    },{ .name = "PPK0_4",  .addr = A_PPK0_4,
680
        .ro = 0xffffffff,
681
    },{ .name = "PPK0_5",  .addr = A_PPK0_5,
682
        .ro = 0xffffffff,
683
    },{ .name = "PPK0_6",  .addr = A_PPK0_6,
684
        .ro = 0xffffffff,
685
    },{ .name = "PPK0_7",  .addr = A_PPK0_7,
686
        .ro = 0xffffffff,
687
    },{ .name = "PPK0_8",  .addr = A_PPK0_8,
688
        .ro = 0xffffffff,
689
    },{ .name = "PPK0_9",  .addr = A_PPK0_9,
690
        .ro = 0xffffffff,
691
    },{ .name = "PPK0_10",  .addr = A_PPK0_10,
692
        .ro = 0xffffffff,
693
    },{ .name = "PPK0_11",  .addr = A_PPK0_11,
694
        .ro = 0xffffffff,
695
    },{ .name = "PPK1_0",  .addr = A_PPK1_0,
696
        .ro = 0xffffffff,
697
    },{ .name = "PPK1_1",  .addr = A_PPK1_1,
698
        .ro = 0xffffffff,
699
    },{ .name = "PPK1_2",  .addr = A_PPK1_2,
700
        .ro = 0xffffffff,
701
    },{ .name = "PPK1_3",  .addr = A_PPK1_3,
702
        .ro = 0xffffffff,
703
    },{ .name = "PPK1_4",  .addr = A_PPK1_4,
704
        .ro = 0xffffffff,
705
    },{ .name = "PPK1_5",  .addr = A_PPK1_5,
706
        .ro = 0xffffffff,
707
    },{ .name = "PPK1_6",  .addr = A_PPK1_6,
708
        .ro = 0xffffffff,
709
    },{ .name = "PPK1_7",  .addr = A_PPK1_7,
710
        .ro = 0xffffffff,
711
    },{ .name = "PPK1_8",  .addr = A_PPK1_8,
712
        .ro = 0xffffffff,
713
    },{ .name = "PPK1_9",  .addr = A_PPK1_9,
714
        .ro = 0xffffffff,
715
    },{ .name = "PPK1_10",  .addr = A_PPK1_10,
716
        .ro = 0xffffffff,
717
    },{ .name = "PPK1_11",  .addr = A_PPK1_11,
718
        .ro = 0xffffffff,
719
    }
720
};
721

722
static void zynqmp_efuse_reg_write(void *opaque, hwaddr addr,
723
                                   uint64_t data, unsigned size)
724
{
725
    RegisterInfoArray *reg_array = opaque;
726
    XlnxZynqMPEFuse *s;
727
    Object *dev;
728

729
    assert(reg_array != NULL);
730

731
    dev = reg_array->mem.owner;
732
    assert(dev);
733

734
    s = XLNX_ZYNQMP_EFUSE(dev);
735

736
    if (addr != A_WR_LOCK && s->regs[R_WR_LOCK]) {
737
        g_autofree char *path = object_get_canonical_path(OBJECT(s));
738

739
        qemu_log_mask(LOG_GUEST_ERROR,
740
                      "%s[reg_0x%02lx]: Attempt to write locked register.\n",
741
                      path, (long)addr);
742
    } else {
743
        register_write_memory(opaque, addr, data, size);
744
    }
745
}
746

747
static const MemoryRegionOps zynqmp_efuse_ops = {
748
    .read = register_read_memory,
749
    .write = zynqmp_efuse_reg_write,
750
    .endianness = DEVICE_LITTLE_ENDIAN,
751
    .valid = {
752
        .min_access_size = 4,
753
        .max_access_size = 4,
754
    },
755
};
756

757
static void zynqmp_efuse_register_reset(RegisterInfo *reg)
758
{
759
    if (!reg->data || !reg->access) {
760
        return;
761
    }
762

763
    /* Reset must not trigger some registers' writers */
764
    switch (reg->access->addr) {
765
    case A_EFUSE_AES_CRC:
766
        *(uint32_t *)reg->data = reg->access->reset;
767
        return;
768
    }
769

770
    register_reset(reg);
771
}
772

773
static void zynqmp_efuse_reset_hold(Object *obj, ResetType type)
774
{
775
    XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(obj);
776
    unsigned int i;
777

778
    for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
779
        zynqmp_efuse_register_reset(&s->regs_info[i]);
780
    }
781

782
    zynqmp_efuse_sync_cache(s, FBIT_UNKNOWN);
783
    ARRAY_FIELD_DP32(s->regs, STATUS, CACHE_DONE, 1);
784
    zynqmp_efuse_update_irq(s);
785
}
786

787
static void zynqmp_efuse_realize(DeviceState *dev, Error **errp)
788
{
789
    XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(dev);
790

791
    if (!s->efuse) {
792
        g_autofree char *path = object_get_canonical_path(OBJECT(s));
793

794
        error_setg(errp, "%s.efuse: link property not connected to XLNX-EFUSE",
795
                   path);
796
        return;
797
    }
798

799
    s->efuse->dev = dev;
800
}
801

802
static void zynqmp_efuse_init(Object *obj)
803
{
804
    XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(obj);
805
    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
806
    RegisterInfoArray *reg_array;
807

808
    reg_array =
809
        register_init_block32(DEVICE(obj), zynqmp_efuse_regs_info,
810
                              ARRAY_SIZE(zynqmp_efuse_regs_info),
811
                              s->regs_info, s->regs,
812
                              &zynqmp_efuse_ops,
813
                              ZYNQMP_EFUSE_ERR_DEBUG,
814
                              R_MAX * 4);
815

816
    sysbus_init_mmio(sbd, &reg_array->mem);
817
    sysbus_init_irq(sbd, &s->irq);
818
}
819

820
static const VMStateDescription vmstate_efuse = {
821
    .name = TYPE_XLNX_ZYNQMP_EFUSE,
822
    .version_id = 1,
823
    .minimum_version_id = 1,
824
    .fields = (const VMStateField[]) {
825
        VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPEFuse, R_MAX),
826
        VMSTATE_END_OF_LIST(),
827
    }
828
};
829

830
static Property zynqmp_efuse_props[] = {
831
    DEFINE_PROP_LINK("efuse",
832
                     XlnxZynqMPEFuse, efuse,
833
                     TYPE_XLNX_EFUSE, XlnxEFuse *),
834

835
    DEFINE_PROP_END_OF_LIST(),
836
};
837

838
static void zynqmp_efuse_class_init(ObjectClass *klass, void *data)
839
{
840
    DeviceClass *dc = DEVICE_CLASS(klass);
841
    ResettableClass *rc = RESETTABLE_CLASS(klass);
842

843
    rc->phases.hold = zynqmp_efuse_reset_hold;
844
    dc->realize = zynqmp_efuse_realize;
845
    dc->vmsd = &vmstate_efuse;
846
    device_class_set_props(dc, zynqmp_efuse_props);
847
}
848

849

850
static const TypeInfo efuse_info = {
851
    .name          = TYPE_XLNX_ZYNQMP_EFUSE,
852
    .parent        = TYPE_SYS_BUS_DEVICE,
853
    .instance_size = sizeof(XlnxZynqMPEFuse),
854
    .class_init    = zynqmp_efuse_class_init,
855
    .instance_init = zynqmp_efuse_init,
856
};
857

858
static void efuse_register_types(void)
859
{
860
    type_register_static(&efuse_info);
861
}
862

863
type_init(efuse_register_types)
864