hw/nvram/xlnx-zynqmp-efuse.c

   1 /*
   2  * QEMU model of the ZynqMP eFuse
   3  *
   4  * Copyright (c) 2015 Xilinx Inc.
   5  *
   6  * Written by Edgar E. Iglesias <edgari@xilinx.com>
   7  *
   8  * Permission is hereby granted, free of charge, to any person obtaining a copy
   9  * of this software and associated documentation files (the "Software"), to deal
  10  * in the Software without restriction, including without limitation the rights
  11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  12  * copies of the Software, and to permit persons to whom the Software is
  13  * furnished to do so, subject to the following conditions:
  14  *
  15  * The above copyright notice and this permission notice shall be included in
  16  * all copies or substantial portions of the Software.
  17  *
  18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  21  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  24  * THE SOFTWARE.
  25  */
  26
  27 #include "qemu/osdep.h"
  28 #include "hw/nvram/xlnx-zynqmp-efuse.h"
  29
  30 #include "qemu/log.h"
  31 #include "qapi/error.h"
  32 #include "migration/vmstate.h"
  33 #include "hw/qdev-properties.h"
  34
  35 #ifndef ZYNQMP_EFUSE_ERR_DEBUG
  36 #define ZYNQMP_EFUSE_ERR_DEBUG 0
  37 #endif
  38
  39 REG32(WR_LOCK, 0x0)
  40     FIELD(WR_LOCK, LOCK, 0, 16)
  41 REG32(CFG, 0x4)
  42     FIELD(CFG, SLVERR_ENABLE, 5, 1)
  43     FIELD(CFG, MARGIN_RD, 2, 2)
  44     FIELD(CFG, PGM_EN, 1, 1)
  45     FIELD(CFG, EFUSE_CLK_SEL, 0, 1)
  46 REG32(STATUS, 0x8)
  47     FIELD(STATUS, AES_CRC_PASS, 7, 1)
  48     FIELD(STATUS, AES_CRC_DONE, 6, 1)
  49     FIELD(STATUS, CACHE_DONE, 5, 1)
  50     FIELD(STATUS, CACHE_LOAD, 4, 1)
  51     FIELD(STATUS, EFUSE_3_TBIT, 2, 1)
  52     FIELD(STATUS, EFUSE_2_TBIT, 1, 1)
  53     FIELD(STATUS, EFUSE_0_TBIT, 0, 1)
  54 REG32(EFUSE_PGM_ADDR, 0xc)
  55     FIELD(EFUSE_PGM_ADDR, EFUSE, 11, 2)
  56     FIELD(EFUSE_PGM_ADDR, ROW, 5, 6)
  57     FIELD(EFUSE_PGM_ADDR, COLUMN, 0, 5)
  58 REG32(EFUSE_RD_ADDR, 0x10)
  59     FIELD(EFUSE_RD_ADDR, EFUSE, 11, 2)
  60     FIELD(EFUSE_RD_ADDR, ROW, 5, 6)
  61 REG32(EFUSE_RD_DATA, 0x14)
  62 REG32(TPGM, 0x18)
  63     FIELD(TPGM, VALUE, 0, 16)
  64 REG32(TRD, 0x1c)
  65     FIELD(TRD, VALUE, 0, 8)
  66 REG32(TSU_H_PS, 0x20)
  67     FIELD(TSU_H_PS, VALUE, 0, 8)
  68 REG32(TSU_H_PS_CS, 0x24)
  69     FIELD(TSU_H_PS_CS, VALUE, 0, 8)
  70 REG32(TSU_H_CS, 0x2c)
  71     FIELD(TSU_H_CS, VALUE, 0, 4)
  72 REG32(EFUSE_ISR, 0x30)
  73     FIELD(EFUSE_ISR, APB_SLVERR, 31, 1)
  74     FIELD(EFUSE_ISR, CACHE_ERROR, 4, 1)
  75     FIELD(EFUSE_ISR, RD_ERROR, 3, 1)
  76     FIELD(EFUSE_ISR, RD_DONE, 2, 1)
  77     FIELD(EFUSE_ISR, PGM_ERROR, 1, 1)
  78     FIELD(EFUSE_ISR, PGM_DONE, 0, 1)
  79 REG32(EFUSE_IMR, 0x34)
  80     FIELD(EFUSE_IMR, APB_SLVERR, 31, 1)
  81     FIELD(EFUSE_IMR, CACHE_ERROR, 4, 1)
  82     FIELD(EFUSE_IMR, RD_ERROR, 3, 1)
  83     FIELD(EFUSE_IMR, RD_DONE, 2, 1)
  84     FIELD(EFUSE_IMR, PGM_ERROR, 1, 1)
  85     FIELD(EFUSE_IMR, PGM_DONE, 0, 1)
  86 REG32(EFUSE_IER, 0x38)
  87     FIELD(EFUSE_IER, APB_SLVERR, 31, 1)
  88     FIELD(EFUSE_IER, CACHE_ERROR, 4, 1)
  89     FIELD(EFUSE_IER, RD_ERROR, 3, 1)
  90     FIELD(EFUSE_IER, RD_DONE, 2, 1)
  91     FIELD(EFUSE_IER, PGM_ERROR, 1, 1)
  92     FIELD(EFUSE_IER, PGM_DONE, 0, 1)
  93 REG32(EFUSE_IDR, 0x3c)
  94     FIELD(EFUSE_IDR, APB_SLVERR, 31, 1)
  95     FIELD(EFUSE_IDR, CACHE_ERROR, 4, 1)
  96     FIELD(EFUSE_IDR, RD_ERROR, 3, 1)
  97     FIELD(EFUSE_IDR, RD_DONE, 2, 1)
  98     FIELD(EFUSE_IDR, PGM_ERROR, 1, 1)
  99     FIELD(EFUSE_IDR, PGM_DONE, 0, 1)
 100 REG32(EFUSE_CACHE_LOAD, 0x40)
 101     FIELD(EFUSE_CACHE_LOAD, LOAD, 0, 1)
 102 REG32(EFUSE_PGM_LOCK, 0x44)
 103     FIELD(EFUSE_PGM_LOCK, SPK_ID_LOCK, 0, 1)
 104 REG32(EFUSE_AES_CRC, 0x48)
 105 REG32(EFUSE_TBITS_PRGRMG_EN, 0x100)
 106     FIELD(EFUSE_TBITS_PRGRMG_EN, TBITS_PRGRMG_EN, 3, 1)
 107 REG32(DNA_0, 0x100c)
 108 REG32(DNA_1, 0x1010)
 109 REG32(DNA_2, 0x1014)
 110 REG32(IPDISABLE, 0x1018)
 111     FIELD(IPDISABLE, VCU_DIS, 8, 1)
 112     FIELD(IPDISABLE, GPU_DIS, 5, 1)
 113     FIELD(IPDISABLE, APU3_DIS, 3, 1)
 114     FIELD(IPDISABLE, APU2_DIS, 2, 1)
 115     FIELD(IPDISABLE, APU1_DIS, 1, 1)
 116     FIELD(IPDISABLE, APU0_DIS, 0, 1)
 117 REG32(SYSOSC_CTRL, 0x101c)
 118     FIELD(SYSOSC_CTRL, SYSOSC_EN, 0, 1)
 119 REG32(USER_0, 0x1020)
 120 REG32(USER_1, 0x1024)
 121 REG32(USER_2, 0x1028)
 122 REG32(USER_3, 0x102c)
 123 REG32(USER_4, 0x1030)
 124 REG32(USER_5, 0x1034)
 125 REG32(USER_6, 0x1038)
 126 REG32(USER_7, 0x103c)
 127 REG32(MISC_USER_CTRL, 0x1040)
 128     FIELD(MISC_USER_CTRL, FPD_SC_EN_0, 14, 1)
 129     FIELD(MISC_USER_CTRL, LPD_SC_EN_0, 11, 1)
 130     FIELD(MISC_USER_CTRL, LBIST_EN, 10, 1)
 131     FIELD(MISC_USER_CTRL, USR_WRLK_7, 7, 1)
 132     FIELD(MISC_USER_CTRL, USR_WRLK_6, 6, 1)
 133     FIELD(MISC_USER_CTRL, USR_WRLK_5, 5, 1)
 134     FIELD(MISC_USER_CTRL, USR_WRLK_4, 4, 1)
 135     FIELD(MISC_USER_CTRL, USR_WRLK_3, 3, 1)
 136     FIELD(MISC_USER_CTRL, USR_WRLK_2, 2, 1)
 137     FIELD(MISC_USER_CTRL, USR_WRLK_1, 1, 1)
 138     FIELD(MISC_USER_CTRL, USR_WRLK_0, 0, 1)
 139 REG32(ROM_RSVD, 0x1044)
 140     FIELD(ROM_RSVD, PBR_BOOT_ERROR, 0, 3)
 141 REG32(PUF_CHASH, 0x1050)
 142 REG32(PUF_MISC, 0x1054)
 143     FIELD(PUF_MISC, REGISTER_DIS, 31, 1)
 144     FIELD(PUF_MISC, SYN_WRLK, 30, 1)
 145     FIELD(PUF_MISC, SYN_INVLD, 29, 1)
 146     FIELD(PUF_MISC, TEST2_DIS, 28, 1)
 147     FIELD(PUF_MISC, UNUSED27, 27, 1)
 148     FIELD(PUF_MISC, UNUSED26, 26, 1)
 149     FIELD(PUF_MISC, UNUSED25, 25, 1)
 150     FIELD(PUF_MISC, UNUSED24, 24, 1)
 151     FIELD(PUF_MISC, AUX, 0, 24)
 152 REG32(SEC_CTRL, 0x1058)
 153     FIELD(SEC_CTRL, PPK1_INVLD, 30, 2)
 154     FIELD(SEC_CTRL, PPK1_WRLK, 29, 1)
 155     FIELD(SEC_CTRL, PPK0_INVLD, 27, 2)
 156     FIELD(SEC_CTRL, PPK0_WRLK, 26, 1)
 157     FIELD(SEC_CTRL, RSA_EN, 11, 15)
 158     FIELD(SEC_CTRL, SEC_LOCK, 10, 1)
 159     FIELD(SEC_CTRL, PROG_GATE_2, 9, 1)
 160     FIELD(SEC_CTRL, PROG_GATE_1, 8, 1)
 161     FIELD(SEC_CTRL, PROG_GATE_0, 7, 1)
 162     FIELD(SEC_CTRL, DFT_DIS, 6, 1)
 163     FIELD(SEC_CTRL, JTAG_DIS, 5, 1)
 164     FIELD(SEC_CTRL, ERROR_DIS, 4, 1)
 165     FIELD(SEC_CTRL, BBRAM_DIS, 3, 1)
 166     FIELD(SEC_CTRL, ENC_ONLY, 2, 1)
 167     FIELD(SEC_CTRL, AES_WRLK, 1, 1)
 168     FIELD(SEC_CTRL, AES_RDLK, 0, 1)
 169 REG32(SPK_ID, 0x105c)
 170 REG32(PPK0_0, 0x10a0)
 171 REG32(PPK0_1, 0x10a4)
 172 REG32(PPK0_2, 0x10a8)
 173 REG32(PPK0_3, 0x10ac)
 174 REG32(PPK0_4, 0x10b0)
 175 REG32(PPK0_5, 0x10b4)
 176 REG32(PPK0_6, 0x10b8)
 177 REG32(PPK0_7, 0x10bc)
 178 REG32(PPK0_8, 0x10c0)
 179 REG32(PPK0_9, 0x10c4)
 180 REG32(PPK0_10, 0x10c8)
 181 REG32(PPK0_11, 0x10cc)
 182 REG32(PPK1_0, 0x10d0)
 183 REG32(PPK1_1, 0x10d4)
 184 REG32(PPK1_2, 0x10d8)
 185 REG32(PPK1_3, 0x10dc)
 186 REG32(PPK1_4, 0x10e0)
 187 REG32(PPK1_5, 0x10e4)
 188 REG32(PPK1_6, 0x10e8)
 189 REG32(PPK1_7, 0x10ec)
 190 REG32(PPK1_8, 0x10f0)
 191 REG32(PPK1_9, 0x10f4)
 192 REG32(PPK1_10, 0x10f8)
 193 REG32(PPK1_11, 0x10fc)
 194
 195 #define BIT_POS(ROW, COLUMN)    (ROW * 32 + COLUMN)
 196 #define R_MAX (R_PPK1_11 + 1)
 197
 198 /* #define EFUSE_XOSC            26 */
 199
 200 /*
 201  * eFUSE layout references:
 202  *   ZynqMP: UG1085 (v2.1) August 21, 2019, p.277, Table 12-13
 203  */
 204 #define EFUSE_AES_RDLK        BIT_POS(22, 0)
 205 #define EFUSE_AES_WRLK        BIT_POS(22, 1)
 206 #define EFUSE_ENC_ONLY        BIT_POS(22, 2)
 207 #define EFUSE_BBRAM_DIS       BIT_POS(22, 3)
 208 #define EFUSE_ERROR_DIS       BIT_POS(22, 4)
 209 #define EFUSE_JTAG_DIS        BIT_POS(22, 5)
 210 #define EFUSE_DFT_DIS         BIT_POS(22, 6)
 211 #define EFUSE_PROG_GATE_0     BIT_POS(22, 7)
 212 #define EFUSE_PROG_GATE_1     BIT_POS(22, 7)
 213 #define EFUSE_PROG_GATE_2     BIT_POS(22, 9)
 214 #define EFUSE_SEC_LOCK        BIT_POS(22, 10)
 215 #define EFUSE_RSA_EN          BIT_POS(22, 11)
 216 #define EFUSE_RSA_EN14        BIT_POS(22, 25)
 217 #define EFUSE_PPK0_WRLK       BIT_POS(22, 26)
 218 #define EFUSE_PPK0_INVLD      BIT_POS(22, 27)
 219 #define EFUSE_PPK0_INVLD_1    BIT_POS(22, 28)
 220 #define EFUSE_PPK1_WRLK       BIT_POS(22, 29)
 221 #define EFUSE_PPK1_INVLD      BIT_POS(22, 30)
 222 #define EFUSE_PPK1_INVLD_1    BIT_POS(22, 31)
 223
 224 /* Areas.  */
 225 #define EFUSE_TRIM_START      BIT_POS(1, 0)
 226 #define EFUSE_TRIM_END        BIT_POS(1, 30)
 227 #define EFUSE_DNA_START       BIT_POS(3, 0)
 228 #define EFUSE_DNA_END         BIT_POS(5, 31)
 229 #define EFUSE_AES_START       BIT_POS(24, 0)
 230 #define EFUSE_AES_END         BIT_POS(31, 31)
 231 #define EFUSE_ROM_START       BIT_POS(17, 0)
 232 #define EFUSE_ROM_END         BIT_POS(17, 31)
 233 #define EFUSE_IPDIS_START     BIT_POS(6, 0)
 234 #define EFUSE_IPDIS_END       BIT_POS(6, 31)
 235 #define EFUSE_USER_START      BIT_POS(8, 0)
 236 #define EFUSE_USER_END        BIT_POS(15, 31)
 237 #define EFUSE_BISR_START      BIT_POS(32, 0)
 238 #define EFUSE_BISR_END        BIT_POS(39, 31)
 239
 240 #define EFUSE_USER_CTRL_START BIT_POS(16, 0)
 241 #define EFUSE_USER_CTRL_END   BIT_POS(16, 16)
 242 #define EFUSE_USER_CTRL_MASK  ((uint32_t)MAKE_64BIT_MASK(0, 17))
 243
 244 #define EFUSE_PUF_CHASH_START BIT_POS(20, 0)
 245 #define EFUSE_PUF_CHASH_END   BIT_POS(20, 31)
 246 #define EFUSE_PUF_MISC_START  BIT_POS(21, 0)
 247 #define EFUSE_PUF_MISC_END    BIT_POS(21, 31)
 248 #define EFUSE_PUF_SYN_WRLK    BIT_POS(21, 30)
 249
 250 #define EFUSE_SPK_START       BIT_POS(23, 0)
 251 #define EFUSE_SPK_END         BIT_POS(23, 31)
 252
 253 #define EFUSE_PPK0_START      BIT_POS(40, 0)
 254 #define EFUSE_PPK0_END        BIT_POS(51, 31)
 255 #define EFUSE_PPK1_START      BIT_POS(52, 0)
 256 #define EFUSE_PPK1_END        BIT_POS(63, 31)
 257
 258 #define EFUSE_CACHE_FLD(s, reg, field) \
 259     ARRAY_FIELD_DP32((s)->regs, reg, field, \
 260                      (xlnx_efuse_get_row((s->efuse), EFUSE_ ## field) \
 261                       >> (EFUSE_ ## field % 32)))
 262
 263 #define EFUSE_CACHE_BIT(s, reg, field) \
 264     ARRAY_FIELD_DP32((s)->regs, reg, field, xlnx_efuse_get_bit((s->efuse), \
 265                 EFUSE_ ## field))
 266
 267 #define FBIT_UNKNOWN (~0)
 268
 269 QEMU_BUILD_BUG_ON(R_MAX != ARRAY_SIZE(((XlnxZynqMPEFuse *)0)->regs));
 270
 271 static void update_tbit_status(XlnxZynqMPEFuse *s)
 272 {
 273     unsigned int check = xlnx_efuse_tbits_check(s->efuse);
 274     uint32_t val = s->regs[R_STATUS];
 275
 276     val = FIELD_DP32(val, STATUS, EFUSE_0_TBIT, !!(check & (1 << 0)));
 277     val = FIELD_DP32(val, STATUS, EFUSE_2_TBIT, !!(check & (1 << 1)));
 278     val = FIELD_DP32(val, STATUS, EFUSE_3_TBIT, !!(check & (1 << 2)));
 279
 280     s->regs[R_STATUS] = val;
 281 }
 282
 283 /* Update the u32 array from efuse bits. Slow but simple approach.  */
 284 static void cache_sync_u32(XlnxZynqMPEFuse *s, unsigned int r_start,
 285                            unsigned int f_start, unsigned int f_end,
 286                            unsigned int f_written)
 287 {
 288     uint32_t *u32 = &s->regs[r_start];
 289     unsigned int fbit, wbits = 0, u32_off = 0;
 290
 291     /* Avoid working on bits that are not relevant.  */
 292     if (f_written != FBIT_UNKNOWN
 293         && (f_written < f_start || f_written > f_end)) {
 294         return;
 295     }
 296
 297     for (fbit = f_start; fbit <= f_end; fbit++, wbits++) {
 298         if (wbits == 32) {
 299             /* Update the key offset.  */
 300             u32_off += 1;
 301             wbits = 0;
 302         }
 303         u32[u32_off] |= xlnx_efuse_get_bit(s->efuse, fbit) << wbits;
 304     }
 305 }
 306
 307 /*
 308  * Keep the syncs in bit order so we can bail out for the
 309  * slower ones.
 310  */
 311 static void zynqmp_efuse_sync_cache(XlnxZynqMPEFuse *s, unsigned int bit)
 312 {
 313     EFUSE_CACHE_BIT(s, SEC_CTRL, AES_RDLK);
 314     EFUSE_CACHE_BIT(s, SEC_CTRL, AES_WRLK);
 315     EFUSE_CACHE_BIT(s, SEC_CTRL, ENC_ONLY);
 316     EFUSE_CACHE_BIT(s, SEC_CTRL, BBRAM_DIS);
 317     EFUSE_CACHE_BIT(s, SEC_CTRL, ERROR_DIS);
 318     EFUSE_CACHE_BIT(s, SEC_CTRL, JTAG_DIS);
 319     EFUSE_CACHE_BIT(s, SEC_CTRL, DFT_DIS);
 320     EFUSE_CACHE_BIT(s, SEC_CTRL, PROG_GATE_0);
 321     EFUSE_CACHE_BIT(s, SEC_CTRL, PROG_GATE_1);
 322     EFUSE_CACHE_BIT(s, SEC_CTRL, PROG_GATE_2);
 323     EFUSE_CACHE_BIT(s, SEC_CTRL, SEC_LOCK);
 324     EFUSE_CACHE_BIT(s, SEC_CTRL, PPK0_WRLK);
 325     EFUSE_CACHE_BIT(s, SEC_CTRL, PPK1_WRLK);
 326
 327     EFUSE_CACHE_FLD(s, SEC_CTRL, RSA_EN);
 328     EFUSE_CACHE_FLD(s, SEC_CTRL, PPK0_INVLD);
 329     EFUSE_CACHE_FLD(s, SEC_CTRL, PPK1_INVLD);
 330
 331     /* Update the tbits.  */
 332     update_tbit_status(s);
 333
 334     /* Sync the various areas.  */
 335     s->regs[R_MISC_USER_CTRL] = xlnx_efuse_get_row(s->efuse,
 336                                                    EFUSE_USER_CTRL_START)
 337                                 & EFUSE_USER_CTRL_MASK;
 338     s->regs[R_PUF_CHASH] = xlnx_efuse_get_row(s->efuse, EFUSE_PUF_CHASH_START);
 339     s->regs[R_PUF_MISC]  = xlnx_efuse_get_row(s->efuse, EFUSE_PUF_MISC_START);
 340
 341     cache_sync_u32(s, R_DNA_0, EFUSE_DNA_START, EFUSE_DNA_END, bit);
 342
 343     if (bit < EFUSE_AES_START) {
 344         return;
 345     }
 346
 347     cache_sync_u32(s, R_ROM_RSVD, EFUSE_ROM_START, EFUSE_ROM_END, bit);
 348     cache_sync_u32(s, R_IPDISABLE, EFUSE_IPDIS_START, EFUSE_IPDIS_END, bit);
 349     cache_sync_u32(s, R_USER_0, EFUSE_USER_START, EFUSE_USER_END, bit);
 350     cache_sync_u32(s, R_SPK_ID, EFUSE_SPK_START, EFUSE_SPK_END, bit);
 351     cache_sync_u32(s, R_PPK0_0, EFUSE_PPK0_START, EFUSE_PPK0_END, bit);
 352     cache_sync_u32(s, R_PPK1_0, EFUSE_PPK1_START, EFUSE_PPK1_END, bit);
 353 }
 354
 355 static void zynqmp_efuse_update_irq(XlnxZynqMPEFuse *s)
 356 {
 357     bool pending = s->regs[R_EFUSE_ISR] & s->regs[R_EFUSE_IMR];
 358     qemu_set_irq(s->irq, pending);
 359 }
 360
 361 static void zynqmp_efuse_isr_postw(RegisterInfo *reg, uint64_t val64)
 362 {
 363     XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(reg->opaque);
 364     zynqmp_efuse_update_irq(s);
 365 }
 366
 367 static uint64_t zynqmp_efuse_ier_prew(RegisterInfo *reg, uint64_t val64)
 368 {
 369     XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(reg->opaque);
 370     uint32_t val = val64;
 371
 372     s->regs[R_EFUSE_IMR] |= val;
 373     zynqmp_efuse_update_irq(s);
 374     return 0;
 375 }
 376
 377 static uint64_t zynqmp_efuse_idr_prew(RegisterInfo *reg, uint64_t val64)
 378 {
 379     XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(reg->opaque);
 380     uint32_t val = val64;
 381
 382     s->regs[R_EFUSE_IMR] &= ~val;
 383     zynqmp_efuse_update_irq(s);
 384     return 0;
 385 }
 386
 387 static void zynqmp_efuse_pgm_addr_postw(RegisterInfo *reg, uint64_t val64)
 388 {
 389     XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(reg->opaque);
 390     unsigned bit = val64;
 391     unsigned page = FIELD_EX32(bit, EFUSE_PGM_ADDR, EFUSE);
 392     bool puf_prot = false;
 393     const char *errmsg = NULL;
 394
 395     /* Allow only valid array, and adjust for skipped array 1 */
 396     switch (page) {
 397     case 0:
 398         break;
 399     case 2 ... 3:
 400         bit = FIELD_DP32(bit, EFUSE_PGM_ADDR, EFUSE, page - 1);
 401         puf_prot = xlnx_efuse_get_bit(s->efuse, EFUSE_PUF_SYN_WRLK);
 402         break;
 403     default:
 404         errmsg = "Invalid address";
 405         goto pgm_done;
 406     }
 407
 408     if (ARRAY_FIELD_EX32(s->regs, WR_LOCK, LOCK)) {
 409         errmsg = "Array write-locked";
 410         goto pgm_done;
 411     }
 412
 413     if (!ARRAY_FIELD_EX32(s->regs, CFG, PGM_EN)) {
 414         errmsg = "Array pgm-disabled";
 415         goto pgm_done;
 416     }
 417
 418     if (puf_prot) {
 419         errmsg = "PUF_HD-store write-locked";
 420         goto pgm_done;
 421     }
 422
 423     if (ARRAY_FIELD_EX32(s->regs, SEC_CTRL, AES_WRLK)
 424         && bit >= EFUSE_AES_START && bit <= EFUSE_AES_END) {
 425         errmsg = "AES key-store Write-locked";
 426         goto pgm_done;
 427     }
 428
 429     if (!xlnx_efuse_set_bit(s->efuse, bit)) {
 430         errmsg = "Write failed";
 431     }
 432
 433  pgm_done:
 434     if (!errmsg) {
 435         ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, PGM_ERROR, 0);
 436     } else {
 437         g_autofree char *path = object_get_canonical_path(OBJECT(s));
 438
 439         ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, PGM_ERROR, 1);
 440         qemu_log_mask(LOG_GUEST_ERROR,
 441                       "%s - eFuse write error: %s; addr=0x%x\n",
 442                       path, errmsg, (unsigned)val64);
 443     }
 444
 445     ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, PGM_DONE, 1);
 446     zynqmp_efuse_update_irq(s);
 447 }
 448
 449 static void zynqmp_efuse_rd_addr_postw(RegisterInfo *reg, uint64_t val64)
 450 {
 451     XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(reg->opaque);
 452     g_autofree char *path = NULL;
 453
 454     /*
 455      * Grant reads only to allowed bits; reference sources:
 456      * 1/ XilSKey - XilSKey_ZynqMp_EfusePs_ReadRow()
 457      * 2/ UG1085, v2.0, table 12-13
 458      * (note: enumerates the masks as <first, last> per described in
 459      *  references to avoid mental translation).
 460      */
 461 #define COL_MASK(L_, H_) \
 462     ((uint32_t)MAKE_64BIT_MASK((L_), (1 + (H_) - (L_))))
 463
 464     static const uint32_t ary0_col_mask[] = {
 465         /* XilSKey - XSK_ZYNQMP_EFUSEPS_TBITS_ROW */
 466         [0]  = COL_MASK(28, 31),
 467
 468         /* XilSKey - XSK_ZYNQMP_EFUSEPS_USR{0:7}_FUSE_ROW */
 469         [8]  = COL_MASK(0, 31), [9]  = COL_MASK(0, 31),
 470         [10] = COL_MASK(0, 31), [11] = COL_MASK(0, 31),
 471         [12] = COL_MASK(0, 31), [13] = COL_MASK(0, 31),
 472         [14] = COL_MASK(0, 31), [15] = COL_MASK(0, 31),
 473
 474         /* XilSKey - XSK_ZYNQMP_EFUSEPS_MISC_USR_CTRL_ROW */
 475         [16] = COL_MASK(0, 7) | COL_MASK(10, 16),
 476
 477         /* XilSKey - XSK_ZYNQMP_EFUSEPS_PBR_BOOT_ERR_ROW */
 478         [17] = COL_MASK(0, 2),
 479
 480         /* XilSKey - XSK_ZYNQMP_EFUSEPS_PUF_CHASH_ROW */
 481         [20] = COL_MASK(0, 31),
 482
 483         /* XilSKey - XSK_ZYNQMP_EFUSEPS_PUF_AUX_ROW */
 484         [21] = COL_MASK(0, 23) | COL_MASK(29, 31),
 485
 486         /* XilSKey - XSK_ZYNQMP_EFUSEPS_SEC_CTRL_ROW */
 487         [22] = COL_MASK(0, 31),
 488
 489         /* XilSKey - XSK_ZYNQMP_EFUSEPS_SPK_ID_ROW */
 490         [23] = COL_MASK(0, 31),
 491
 492         /* XilSKey - XSK_ZYNQMP_EFUSEPS_PPK0_START_ROW */
 493         [40] = COL_MASK(0, 31), [41] = COL_MASK(0, 31),
 494         [42] = COL_MASK(0, 31), [43] = COL_MASK(0, 31),
 495         [44] = COL_MASK(0, 31), [45] = COL_MASK(0, 31),
 496         [46] = COL_MASK(0, 31), [47] = COL_MASK(0, 31),
 497         [48] = COL_MASK(0, 31), [49] = COL_MASK(0, 31),
 498         [50] = COL_MASK(0, 31), [51] = COL_MASK(0, 31),
 499
 500         /* XilSKey - XSK_ZYNQMP_EFUSEPS_PPK1_START_ROW */
 501         [52] = COL_MASK(0, 31), [53] = COL_MASK(0, 31),
 502         [54] = COL_MASK(0, 31), [55] = COL_MASK(0, 31),
 503         [56] = COL_MASK(0, 31), [57] = COL_MASK(0, 31),
 504         [58] = COL_MASK(0, 31), [59] = COL_MASK(0, 31),
 505         [60] = COL_MASK(0, 31), [61] = COL_MASK(0, 31),
 506         [62] = COL_MASK(0, 31), [63] = COL_MASK(0, 31),
 507     };
 508
 509     uint32_t col_mask = COL_MASK(0, 31);
 510 #undef COL_MASK
 511
 512     uint32_t efuse_idx = s->regs[R_EFUSE_RD_ADDR];
 513     uint32_t efuse_ary = FIELD_EX32(efuse_idx, EFUSE_RD_ADDR, EFUSE);
 514     uint32_t efuse_row = FIELD_EX32(efuse_idx, EFUSE_RD_ADDR, ROW);
 515
 516     switch (efuse_ary) {
 517     case 0:     /* Various */
 518         if (efuse_row >= ARRAY_SIZE(ary0_col_mask)) {
 519             goto denied;
 520         }
 521
 522         col_mask = ary0_col_mask[efuse_row];
 523         if (!col_mask) {
 524             goto denied;
 525         }
 526         break;
 527     case 2:     /* PUF helper data, adjust for skipped array 1 */
 528     case 3:
 529         val64 = FIELD_DP32(efuse_idx, EFUSE_RD_ADDR, EFUSE, efuse_ary - 1);
 530         break;
 531     default:
 532         goto denied;
 533     }
 534
 535     s->regs[R_EFUSE_RD_DATA] = xlnx_efuse_get_row(s->efuse, val64) & col_mask;
 536
 537     ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, RD_ERROR, 0);
 538     ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, RD_DONE, 1);
 539     zynqmp_efuse_update_irq(s);
 540     return;
 541
 542  denied:
 543     path = object_get_canonical_path(OBJECT(s));
 544     qemu_log_mask(LOG_GUEST_ERROR,
 545                   "%s: Denied efuse read from array %u, row %u\n",
 546                   path, efuse_ary, efuse_row);
 547
 548     s->regs[R_EFUSE_RD_DATA] = 0;
 549
 550     ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, RD_ERROR, 1);
 551     ARRAY_FIELD_DP32(s->regs, EFUSE_ISR, RD_DONE, 0);
 552     zynqmp_efuse_update_irq(s);
 553 }
 554
 555 static void zynqmp_efuse_aes_crc_postw(RegisterInfo *reg, uint64_t val64)
 556 {
 557     XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(reg->opaque);
 558     bool ok;
 559
 560     ok = xlnx_efuse_k256_check(s->efuse, (uint32_t)val64, EFUSE_AES_START);
 561
 562     ARRAY_FIELD_DP32(s->regs, STATUS, AES_CRC_PASS, (ok ? 1 : 0));
 563     ARRAY_FIELD_DP32(s->regs, STATUS, AES_CRC_DONE, 1);
 564
 565     s->regs[R_EFUSE_AES_CRC] = 0;   /* crc value is write-only */
 566 }
 567
 568 static uint64_t zynqmp_efuse_cache_load_prew(RegisterInfo *reg,
 569                                              uint64_t valu64)
 570 {
 571     XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(reg->opaque);
 572
 573     if (valu64 & R_EFUSE_CACHE_LOAD_LOAD_MASK) {
 574         zynqmp_efuse_sync_cache(s, FBIT_UNKNOWN);
 575         ARRAY_FIELD_DP32(s->regs, STATUS, CACHE_DONE, 1);
 576         zynqmp_efuse_update_irq(s);
 577     }
 578
 579     return 0;
 580 }
 581
 582 static uint64_t zynqmp_efuse_wr_lock_prew(RegisterInfo *reg, uint64_t val)
 583 {
 584     return val == 0xDF0D ? 0 : 1;
 585 }
 586
 587 static RegisterAccessInfo zynqmp_efuse_regs_info[] = {
 588     {   .name = "WR_LOCK",  .addr = A_WR_LOCK,
 589         .reset = 0x1,
 590         .pre_write = zynqmp_efuse_wr_lock_prew,
 591     },{ .name = "CFG",  .addr = A_CFG,
 592     },{ .name = "STATUS",  .addr = A_STATUS,
 593         .rsvd = 0x8,
 594         .ro = 0xff,
 595     },{ .name = "EFUSE_PGM_ADDR",  .addr = A_EFUSE_PGM_ADDR,
 596          .post_write = zynqmp_efuse_pgm_addr_postw
 597     },{ .name = "EFUSE_RD_ADDR",  .addr = A_EFUSE_RD_ADDR,
 598         .rsvd = 0x1f,
 599         .post_write = zynqmp_efuse_rd_addr_postw,
 600     },{ .name = "EFUSE_RD_DATA",  .addr = A_EFUSE_RD_DATA,
 601         .ro = 0xffffffff,
 602     },{ .name = "TPGM",  .addr = A_TPGM,
 603     },{ .name = "TRD",  .addr = A_TRD,
 604         .reset = 0x1b,
 605     },{ .name = "TSU_H_PS",  .addr = A_TSU_H_PS,
 606         .reset = 0xff,
 607     },{ .name = "TSU_H_PS_CS",  .addr = A_TSU_H_PS_CS,
 608         .reset = 0xb,
 609     },{ .name = "TSU_H_CS",  .addr = A_TSU_H_CS,
 610         .reset = 0x7,
 611     },{ .name = "EFUSE_ISR",  .addr = A_EFUSE_ISR,
 612         .rsvd = 0x7fffffe0,
 613         .w1c = 0x8000001f,
 614         .post_write = zynqmp_efuse_isr_postw,
 615     },{ .name = "EFUSE_IMR",  .addr = A_EFUSE_IMR,
 616         .reset = 0x8000001f,
 617         .rsvd = 0x7fffffe0,
 618         .ro = 0xffffffff,
 619     },{ .name = "EFUSE_IER",  .addr = A_EFUSE_IER,
 620         .rsvd = 0x7fffffe0,
 621         .pre_write = zynqmp_efuse_ier_prew,
 622     },{ .name = "EFUSE_IDR",  .addr = A_EFUSE_IDR,
 623         .rsvd = 0x7fffffe0,
 624         .pre_write = zynqmp_efuse_idr_prew,
 625     },{ .name = "EFUSE_CACHE_LOAD",  .addr = A_EFUSE_CACHE_LOAD,
 626         .pre_write = zynqmp_efuse_cache_load_prew,
 627     },{ .name = "EFUSE_PGM_LOCK",  .addr = A_EFUSE_PGM_LOCK,
 628     },{ .name = "EFUSE_AES_CRC",  .addr = A_EFUSE_AES_CRC,
 629         .post_write = zynqmp_efuse_aes_crc_postw,
 630     },{ .name = "EFUSE_TBITS_PRGRMG_EN",  .addr = A_EFUSE_TBITS_PRGRMG_EN,
 631         .reset = R_EFUSE_TBITS_PRGRMG_EN_TBITS_PRGRMG_EN_MASK,
 632     },{ .name = "DNA_0",  .addr = A_DNA_0,
 633         .ro = 0xffffffff,
 634     },{ .name = "DNA_1",  .addr = A_DNA_1,
 635         .ro = 0xffffffff,
 636     },{ .name = "DNA_2",  .addr = A_DNA_2,
 637         .ro = 0xffffffff,
 638     },{ .name = "IPDISABLE",  .addr = A_IPDISABLE,
 639         .ro = 0xffffffff,
 640     },{ .name = "SYSOSC_CTRL",  .addr = A_SYSOSC_CTRL,
 641         .ro = 0xffffffff,
 642     },{ .name = "USER_0",  .addr = A_USER_0,
 643         .ro = 0xffffffff,
 644     },{ .name = "USER_1",  .addr = A_USER_1,
 645         .ro = 0xffffffff,
 646     },{ .name = "USER_2",  .addr = A_USER_2,
 647         .ro = 0xffffffff,
 648     },{ .name = "USER_3",  .addr = A_USER_3,
 649         .ro = 0xffffffff,
 650     },{ .name = "USER_4",  .addr = A_USER_4,
 651         .ro = 0xffffffff,
 652     },{ .name = "USER_5",  .addr = A_USER_5,
 653         .ro = 0xffffffff,
 654     },{ .name = "USER_6",  .addr = A_USER_6,
 655         .ro = 0xffffffff,
 656     },{ .name = "USER_7",  .addr = A_USER_7,
 657         .ro = 0xffffffff,
 658     },{ .name = "MISC_USER_CTRL",  .addr = A_MISC_USER_CTRL,
 659         .ro = 0xffffffff,
 660     },{ .name = "ROM_RSVD",  .addr = A_ROM_RSVD,
 661         .ro = 0xffffffff,
 662     },{ .name = "PUF_CHASH", .addr = A_PUF_CHASH,
 663         .ro = 0xffffffff,
 664     },{ .name = "PUF_MISC",  .addr = A_PUF_MISC,
 665         .ro = 0xffffffff,
 666     },{ .name = "SEC_CTRL",  .addr = A_SEC_CTRL,
 667         .ro = 0xffffffff,
 668     },{ .name = "SPK_ID",  .addr = A_SPK_ID,
 669         .ro = 0xffffffff,
 670     },{ .name = "PPK0_0",  .addr = A_PPK0_0,
 671         .ro = 0xffffffff,
 672     },{ .name = "PPK0_1",  .addr = A_PPK0_1,
 673         .ro = 0xffffffff,
 674     },{ .name = "PPK0_2",  .addr = A_PPK0_2,
 675         .ro = 0xffffffff,
 676     },{ .name = "PPK0_3",  .addr = A_PPK0_3,
 677         .ro = 0xffffffff,
 678     },{ .name = "PPK0_4",  .addr = A_PPK0_4,
 679         .ro = 0xffffffff,
 680     },{ .name = "PPK0_5",  .addr = A_PPK0_5,
 681         .ro = 0xffffffff,
 682     },{ .name = "PPK0_6",  .addr = A_PPK0_6,
 683         .ro = 0xffffffff,
 684     },{ .name = "PPK0_7",  .addr = A_PPK0_7,
 685         .ro = 0xffffffff,
 686     },{ .name = "PPK0_8",  .addr = A_PPK0_8,
 687         .ro = 0xffffffff,
 688     },{ .name = "PPK0_9",  .addr = A_PPK0_9,
 689         .ro = 0xffffffff,
 690     },{ .name = "PPK0_10",  .addr = A_PPK0_10,
 691         .ro = 0xffffffff,
 692     },{ .name = "PPK0_11",  .addr = A_PPK0_11,
 693         .ro = 0xffffffff,
 694     },{ .name = "PPK1_0",  .addr = A_PPK1_0,
 695         .ro = 0xffffffff,
 696     },{ .name = "PPK1_1",  .addr = A_PPK1_1,
 697         .ro = 0xffffffff,
 698     },{ .name = "PPK1_2",  .addr = A_PPK1_2,
 699         .ro = 0xffffffff,
 700     },{ .name = "PPK1_3",  .addr = A_PPK1_3,
 701         .ro = 0xffffffff,
 702     },{ .name = "PPK1_4",  .addr = A_PPK1_4,
 703         .ro = 0xffffffff,
 704     },{ .name = "PPK1_5",  .addr = A_PPK1_5,
 705         .ro = 0xffffffff,
 706     },{ .name = "PPK1_6",  .addr = A_PPK1_6,
 707         .ro = 0xffffffff,
 708     },{ .name = "PPK1_7",  .addr = A_PPK1_7,
 709         .ro = 0xffffffff,
 710     },{ .name = "PPK1_8",  .addr = A_PPK1_8,
 711         .ro = 0xffffffff,
 712     },{ .name = "PPK1_9",  .addr = A_PPK1_9,
 713         .ro = 0xffffffff,
 714     },{ .name = "PPK1_10",  .addr = A_PPK1_10,
 715         .ro = 0xffffffff,
 716     },{ .name = "PPK1_11",  .addr = A_PPK1_11,
 717         .ro = 0xffffffff,
 718     }
 719 };
 720
 721 static void zynqmp_efuse_reg_write(void *opaque, hwaddr addr,
 722                                    uint64_t data, unsigned size)
 723 {
 724     RegisterInfoArray *reg_array = opaque;
 725     XlnxZynqMPEFuse *s;
 726     Object *dev;
 727
 728     assert(reg_array != NULL);
 729
 730     dev = reg_array->mem.owner;
 731     assert(dev);
 732
 733     s = XLNX_ZYNQMP_EFUSE(dev);
 734
 735     if (addr != A_WR_LOCK && s->regs[R_WR_LOCK]) {
 736         g_autofree char *path = object_get_canonical_path(OBJECT(s));
 737
 738         qemu_log_mask(LOG_GUEST_ERROR,
 739                       "%s[reg_0x%02lx]: Attempt to write locked register.\n",
 740                       path, (long)addr);
 741     } else {
 742         register_write_memory(opaque, addr, data, size);
 743     }
 744 }
 745
 746 static const MemoryRegionOps zynqmp_efuse_ops = {
 747     .read = register_read_memory,
 748     .write = zynqmp_efuse_reg_write,
 749     .endianness = DEVICE_LITTLE_ENDIAN,
 750     .valid = {
 751         .min_access_size = 4,
 752         .max_access_size = 4,
 753     },
 754 };
 755
 756 static void zynqmp_efuse_register_reset(RegisterInfo *reg)
 757 {
 758     if (!reg->data || !reg->access) {
 759         return;
 760     }
 761
 762     /* Reset must not trigger some registers' writers */
 763     switch (reg->access->addr) {
 764     case A_EFUSE_AES_CRC:
 765         *(uint32_t *)reg->data = reg->access->reset;
 766         return;
 767     }
 768
 769     register_reset(reg);
 770 }
 771
 772 static void zynqmp_efuse_reset(DeviceState *dev)
 773 {
 774     XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(dev);
 775     unsigned int i;
 776
 777     for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
 778         zynqmp_efuse_register_reset(&s->regs_info[i]);
 779     }
 780
 781     zynqmp_efuse_sync_cache(s, FBIT_UNKNOWN);
 782     ARRAY_FIELD_DP32(s->regs, STATUS, CACHE_DONE, 1);
 783     zynqmp_efuse_update_irq(s);
 784 }
 785
 786 static void zynqmp_efuse_realize(DeviceState *dev, Error **errp)
 787 {
 788     XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(dev);
 789
 790     if (!s->efuse) {
 791         g_autofree char *path = object_get_canonical_path(OBJECT(s));
 792
 793         error_setg(errp, "%s.efuse: link property not connected to XLNX-EFUSE",
 794                    path);
 795         return;
 796     }
 797
 798     s->efuse->dev = dev;
 799 }
 800
 801 static void zynqmp_efuse_init(Object *obj)
 802 {
 803     XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(obj);
 804     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 805     RegisterInfoArray *reg_array;
 806
 807     reg_array =
 808         register_init_block32(DEVICE(obj), zynqmp_efuse_regs_info,
 809                               ARRAY_SIZE(zynqmp_efuse_regs_info),
 810                               s->regs_info, s->regs,
 811                               &zynqmp_efuse_ops,
 812                               ZYNQMP_EFUSE_ERR_DEBUG,
 813                               R_MAX * 4);
 814
 815     sysbus_init_mmio(sbd, &reg_array->mem);
 816     sysbus_init_irq(sbd, &s->irq);
 817 }
 818
 819 static const VMStateDescription vmstate_efuse = {
 820     .name = TYPE_XLNX_ZYNQMP_EFUSE,
 821     .version_id = 1,
 822     .minimum_version_id = 1,
 823     .fields = (VMStateField[]) {
 824         VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPEFuse, R_MAX),
 825         VMSTATE_END_OF_LIST(),
 826     }
 827 };
 828
 829 static Property zynqmp_efuse_props[] = {
 830     DEFINE_PROP_LINK("efuse",
 831                      XlnxZynqMPEFuse, efuse,
 832                      TYPE_XLNX_EFUSE, XlnxEFuse *),
 833
 834     DEFINE_PROP_END_OF_LIST(),
 835 };
 836
 837 static void zynqmp_efuse_class_init(ObjectClass *klass, void *data)
 838 {
 839     DeviceClass *dc = DEVICE_CLASS(klass);
 840
 841     dc->reset = zynqmp_efuse_reset;
 842     dc->realize = zynqmp_efuse_realize;
 843     dc->vmsd = &vmstate_efuse;
 844     device_class_set_props(dc, zynqmp_efuse_props);
 845 }
 846
 847
 848 static const TypeInfo efuse_info = {
 849     .name          = TYPE_XLNX_ZYNQMP_EFUSE,
 850     .parent        = TYPE_SYS_BUS_DEVICE,
 851     .instance_size = sizeof(XlnxZynqMPEFuse),
 852     .class_init    = zynqmp_efuse_class_init,
 853     .instance_init = zynqmp_efuse_init,
 854 };
 855
 856 static void efuse_register_types(void)
 857 {
 858     type_register_static(&efuse_info);
 859 }
 860
 861 type_init(efuse_register_types)