[PULL 05/21] hw/misc/aspeed_sbc: Derive secure boot state from OTP config

["Cédric Le Goater" <clg@redhat.com>]

From: Kane Chen <kane_chen@aspeedtech.com>

The secure boot state is currently controlled by the
"signing-settings" machine property instead of the OTP configuration.

Derive SECURE_BOOT_EN and R_QSR from the OTP configuration when the
registers are read.

Remove the "signing-settings" property as the secure boot state is now
derived from OTP.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260918065347.3713868-4-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/misc/aspeed_sbc.h |  2 --
 hw/misc/aspeed_sbc.c         | 22 +++++++++++++---------
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/include/hw/misc/aspeed_sbc.h b/include/hw/misc/aspeed_sbc.h
index b210ffb8aa86..7f3fa7062f96 100644
--- a/include/hw/misc/aspeed_sbc.h
+++ b/include/hw/misc/aspeed_sbc.h
@@ -32,8 +32,6 @@ OBJECT_DECLARE_TYPE(AspeedSBCState, AspeedSBCClass, ASPEED_SBC)
 struct AspeedSBCState {
     SysBusDevice parent;
 
-    uint32_t signing_settings;
-
     MemoryRegion iomem;
 
     uint32_t regs[ASPEED_SBC_NR_REGS];
diff --git a/hw/misc/aspeed_sbc.c b/hw/misc/aspeed_sbc.c
index 6cec9ad3daf0..ad4c2b4b1d0c 100644
--- a/hw/misc/aspeed_sbc.c
+++ b/hw/misc/aspeed_sbc.c
@@ -79,6 +79,8 @@
 #define MODE_REGISTER_A             (0x3000)
 #define MODE_REGISTER_B             (0x5000)
 
+static bool aspeed_sbc_otp_read(AspeedSBCState *s, uint32_t otp_addr);
+
 static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr, unsigned int size)
 {
     AspeedSBCState *s = ASPEED_SBC(opaque);
@@ -102,8 +104,16 @@ static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr, unsigned int size)
             val &= ~ABR_EN;
         }
 
+        if (aspeed_otp_read_config(&s->otp, 0) & BIT(1)) {
+            val |= SECURE_BOOT_EN;
+        } else {
+            val &= ~SECURE_BOOT_EN;
+        }
+
         return val;
     }
+    case R_QSR:
+        return aspeed_otp_read_config(&s->otp, 0);
     default:
         return s->regs[addr];
     }
@@ -406,16 +416,11 @@ static void aspeed_sbc_reset_hold(Object *obj, ResetType type)
     memset(s->regs, 0, sizeof(s->regs));
 
     /*
-     * ABR_EN is derived from OTP on every read, see aspeed_sbc_read().
-     * Set secure boot enabled with RSA4096_SHA256.
+     * ABR_EN and SECURE_BOOT_EN are derived from OTP on every read, see
+     * aspeed_sbc_read(), since the SBC status register is just a
+     * reflection of the OTP fuse state.
      */
     s->regs[R_STATUS] = OTP_IDLE | OTP_MEM_IDLE;
-
-    if (s->signing_settings) {
-        s->regs[R_STATUS] &= SECURE_BOOT_EN;
-    }
-
-    s->regs[R_QSR] = s->signing_settings;
 }
 
 static void aspeed_sbc_instance_init(Object *obj)
@@ -468,7 +473,6 @@ static const VMStateDescription vmstate_aspeed_sbc = {
 };
 
 static const Property aspeed_sbc_properties[] = {
-    DEFINE_PROP_UINT32("signing-settings", AspeedSBCState, signing_settings, 0),
     DEFINE_PROP_LINK("sram", AspeedSBCState, sram,
                      TYPE_MEMORY_REGION, MemoryRegion *),
 };
-- 
2.56.0