1 /*
2 * Copyright (c) 2016-2021, ARM Limited and Contributors. All rights reserved.
3 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 */
6
7 #include <assert.h>
8 #include <stddef.h>
9
10 #include <common/debug.h>
11 #include <drivers/arm/tzc400.h>
12 #include <lib/mmio.h>
13 #include <lib/utils_def.h>
14
15 #include "tzc_common_private.h"
16
17 /*
18 * Macros which will be used by common core functions.
19 */
20 #define TZC_400_REGION_BASE_LOW_0_OFFSET U(0x100)
21 #define TZC_400_REGION_BASE_HIGH_0_OFFSET U(0x104)
22 #define TZC_400_REGION_TOP_LOW_0_OFFSET U(0x108)
23 #define TZC_400_REGION_TOP_HIGH_0_OFFSET U(0x10c)
24 #define TZC_400_REGION_ATTR_0_OFFSET U(0x110)
25 #define TZC_400_REGION_ID_ACCESS_0_OFFSET U(0x114)
26
27 /*
28 * Implementation defined values used to validate inputs later.
29 * Filters : max of 4 ; 0 to 3
30 * Regions : max of 9 ; 0 to 8
31 * Address width : Values between 32 to 64
32 */
33 typedef struct tzc400_instance {
34 uintptr_t base;
35 uint8_t addr_width;
36 uint8_t num_filters;
37 uint8_t num_regions;
38 } tzc400_instance_t;
39
40 static tzc400_instance_t tzc400;
41
_tzc400_read_build_config(uintptr_t base)42 static inline unsigned int _tzc400_read_build_config(uintptr_t base)
43 {
44 return mmio_read_32(base + BUILD_CONFIG_OFF);
45 }
46
_tzc400_read_gate_keeper(uintptr_t base)47 static inline unsigned int _tzc400_read_gate_keeper(uintptr_t base)
48 {
49 return mmio_read_32(base + GATE_KEEPER_OFF);
50 }
51
_tzc400_write_gate_keeper(uintptr_t base,unsigned int val)52 static inline void _tzc400_write_gate_keeper(uintptr_t base, unsigned int val)
53 {
54 mmio_write_32(base + GATE_KEEPER_OFF, val);
55 }
56
57 /*
58 * Get the open status information for all filter units.
59 */
60 #define get_gate_keeper_os(_base) ((_tzc400_read_gate_keeper(_base) >> \
61 GATE_KEEPER_OS_SHIFT) & \
62 GATE_KEEPER_OS_MASK)
63
64
65 /* Define common core functions used across different TZC peripherals. */
66 DEFINE_TZC_COMMON_WRITE_ACTION(400, 400)
67 DEFINE_TZC_COMMON_WRITE_REGION_BASE(400, 400)
68 DEFINE_TZC_COMMON_WRITE_REGION_TOP(400, 400)
69 DEFINE_TZC_COMMON_WRITE_REGION_ATTRIBUTES(400, 400)
70 DEFINE_TZC_COMMON_WRITE_REGION_ID_ACCESS(400, 400)
71 DEFINE_TZC_COMMON_CONFIGURE_REGION0(400)
72 DEFINE_TZC_COMMON_CONFIGURE_REGION(400)
73
_tzc400_clear_it(uintptr_t base,uint32_t filter)74 static void _tzc400_clear_it(uintptr_t base, uint32_t filter)
75 {
76 mmio_write_32(base + INT_CLEAR, BIT_32(filter));
77 }
78
_tzc400_get_int_by_filter(uintptr_t base,uint32_t filter)79 static uint32_t _tzc400_get_int_by_filter(uintptr_t base, uint32_t filter)
80 {
81 return mmio_read_32(base + INT_STATUS) & BIT_32(filter);
82 }
83
84 #if DEBUG
_tzc400_get_fail_address(uintptr_t base,uint32_t filter)85 static unsigned long _tzc400_get_fail_address(uintptr_t base, uint32_t filter)
86 {
87 unsigned long fail_address;
88
89 fail_address = mmio_read_32(base + FAIL_ADDRESS_LOW_OFF +
90 (filter * FILTER_OFFSET));
91 #ifdef __aarch64__
92 fail_address += (unsigned long)mmio_read_32(base + FAIL_ADDRESS_HIGH_OFF +
93 (filter * FILTER_OFFSET)) << 32;
94 #endif
95
96 return fail_address;
97 }
98
_tzc400_get_fail_id(uintptr_t base,uint32_t filter)99 static uint32_t _tzc400_get_fail_id(uintptr_t base, uint32_t filter)
100 {
101 return mmio_read_32(base + FAIL_ID + (filter * FILTER_OFFSET));
102 }
103
_tzc400_get_fail_control(uintptr_t base,uint32_t filter)104 static uint32_t _tzc400_get_fail_control(uintptr_t base, uint32_t filter)
105 {
106 return mmio_read_32(base + FAIL_CONTROL_OFF + (filter * FILTER_OFFSET));
107 }
108
_tzc400_dump_fail_filter(uintptr_t base,uint32_t filter)109 static void _tzc400_dump_fail_filter(uintptr_t base, uint32_t filter)
110 {
111 uint32_t control_fail;
112 uint32_t fail_id;
113 unsigned long address_fail;
114
115 address_fail = _tzc400_get_fail_address(base, filter);
116 ERROR("Illegal access to 0x%lx:\n", address_fail);
117
118 fail_id = _tzc400_get_fail_id(base, filter);
119 ERROR("\tFAIL_ID = 0x%x\n", fail_id);
120
121 control_fail = _tzc400_get_fail_control(base, filter);
122 if (((control_fail & BIT_32(FAIL_CONTROL_NS_SHIFT)) >> FAIL_CONTROL_NS_SHIFT) ==
123 FAIL_CONTROL_NS_NONSECURE) {
124 ERROR("\tNon-Secure\n");
125 } else {
126 ERROR("\tSecure\n");
127 }
128
129 if (((control_fail & BIT_32(FAIL_CONTROL_PRIV_SHIFT)) >> FAIL_CONTROL_PRIV_SHIFT) ==
130 FAIL_CONTROL_PRIV_PRIV) {
131 ERROR("\tPrivilege\n");
132 } else {
133 ERROR("\tUnprivilege\n");
134 }
135
136 if (((control_fail & BIT_32(FAIL_CONTROL_DIR_SHIFT)) >> FAIL_CONTROL_DIR_SHIFT) ==
137 FAIL_CONTROL_DIR_WRITE) {
138 ERROR("\tWrite\n");
139 } else {
140 ERROR("\tRead\n");
141 }
142 }
143 #endif /* DEBUG */
144
_tzc400_get_gate_keeper(uintptr_t base,unsigned int filter)145 static unsigned int _tzc400_get_gate_keeper(uintptr_t base,
146 unsigned int filter)
147 {
148 unsigned int open_status;
149
150 open_status = get_gate_keeper_os(base);
151
152 return (open_status >> filter) & GATE_KEEPER_FILTER_MASK;
153 }
154
155 /* This function is not MP safe. */
_tzc400_set_gate_keeper(uintptr_t base,unsigned int filter,int val)156 static void _tzc400_set_gate_keeper(uintptr_t base,
157 unsigned int filter,
158 int val)
159 {
160 unsigned int open_status;
161
162 /* Upper half is current state. Lower half is requested state. */
163 open_status = get_gate_keeper_os(base);
164
165 if (val != 0)
166 open_status |= (1UL << filter);
167 else
168 open_status &= ~(1UL << filter);
169
170 _tzc400_write_gate_keeper(base, (open_status & GATE_KEEPER_OR_MASK) <<
171 GATE_KEEPER_OR_SHIFT);
172
173 /* Wait here until we see the change reflected in the TZC status. */
174 while ((get_gate_keeper_os(base)) != open_status)
175 ;
176 }
177
tzc400_set_action(unsigned int action)178 void tzc400_set_action(unsigned int action)
179 {
180 assert(tzc400.base != 0U);
181 assert(action <= TZC_ACTION_ERR_INT);
182
183 _tzc400_write_action(tzc400.base, action);
184 }
185
tzc400_init(uintptr_t base)186 void tzc400_init(uintptr_t base)
187 {
188 #if DEBUG
189 unsigned int tzc400_id;
190 #endif
191 unsigned int tzc400_build;
192
193 assert(base != 0U);
194 tzc400.base = base;
195
196 #if DEBUG
197 tzc400_id = _tzc_read_peripheral_id(base);
198 if (tzc400_id != TZC_400_PERIPHERAL_ID) {
199 ERROR("TZC-400 : Wrong device ID (0x%x).\n", tzc400_id);
200 panic();
201 }
202 #endif
203
204 /* Save values we will use later. */
205 tzc400_build = _tzc400_read_build_config(tzc400.base);
206 tzc400.num_filters = (uint8_t)((tzc400_build >> BUILD_CONFIG_NF_SHIFT) &
207 BUILD_CONFIG_NF_MASK) + 1U;
208 tzc400.addr_width = (uint8_t)((tzc400_build >> BUILD_CONFIG_AW_SHIFT) &
209 BUILD_CONFIG_AW_MASK) + 1U;
210 tzc400.num_regions = (uint8_t)((tzc400_build >> BUILD_CONFIG_NR_SHIFT) &
211 BUILD_CONFIG_NR_MASK) + 1U;
212 }
213
214 /*
215 * `tzc400_configure_region0` is used to program region 0 into the TrustZone
216 * controller. Region 0 covers the whole address space that is not mapped
217 * to any other region, and is enabled on all filters; this cannot be
218 * changed. This function only changes the access permissions.
219 */
tzc400_configure_region0(unsigned int sec_attr,unsigned int ns_device_access)220 void tzc400_configure_region0(unsigned int sec_attr,
221 unsigned int ns_device_access)
222 {
223 assert(tzc400.base != 0U);
224 assert(sec_attr <= TZC_REGION_S_RDWR);
225
226 _tzc400_configure_region0(tzc400.base, sec_attr, ns_device_access);
227 }
228
229 /*
230 * `tzc400_configure_region` is used to program regions into the TrustZone
231 * controller. A region can be associated with more than one filter. The
232 * associated filters are passed in as a bitmap (bit0 = filter0), except that
233 * the value TZC_400_REGION_ATTR_FILTER_BIT_ALL selects all filters, based on
234 * the value of tzc400.num_filters.
235 * NOTE:
236 * Region 0 is special; it is preferable to use tzc400_configure_region0
237 * for this region (see comment for that function).
238 */
tzc400_configure_region(unsigned int filters,unsigned int region,unsigned long long region_base,unsigned long long region_top,unsigned int sec_attr,unsigned int nsaid_permissions)239 void tzc400_configure_region(unsigned int filters,
240 unsigned int region,
241 unsigned long long region_base,
242 unsigned long long region_top,
243 unsigned int sec_attr,
244 unsigned int nsaid_permissions)
245 {
246 assert(tzc400.base != 0U);
247
248 /* Adjust filter mask by real filter number */
249 if (filters == TZC_400_REGION_ATTR_FILTER_BIT_ALL) {
250 filters = (1U << tzc400.num_filters) - 1U;
251 }
252
253 /* Do range checks on filters and regions. */
254 assert(((filters >> tzc400.num_filters) == 0U) &&
255 (region < tzc400.num_regions));
256
257 /*
258 * Do address range check based on TZC configuration. A 64bit address is
259 * the max and expected case.
260 */
261 assert((region_top <= (UINT64_MAX >> (64U - tzc400.addr_width))) &&
262 (region_base < region_top));
263
264 /* region_base and (region_top + 1) must be 4KB aligned */
265 assert(((region_base | (region_top + 1U)) & (4096U - 1U)) == 0U);
266
267 assert(sec_attr <= TZC_REGION_S_RDWR);
268
269 _tzc400_configure_region(tzc400.base, filters, region, region_base,
270 region_top,
271 sec_attr, nsaid_permissions);
272 }
273
tzc400_enable_filters(void)274 void tzc400_enable_filters(void)
275 {
276 unsigned int state;
277 unsigned int filter;
278
279 assert(tzc400.base != 0U);
280
281 for (filter = 0U; filter < tzc400.num_filters; filter++) {
282 state = _tzc400_get_gate_keeper(tzc400.base, filter);
283 if (state != 0U) {
284 /*
285 * The TZC filter is already configured. Changing the
286 * programmer's view in an active system can cause
287 * unpredictable behavior therefore panic for now rather
288 * than try to determine whether this is safe in this
289 * instance.
290 *
291 * See the 'ARM (R) CoreLink TM TZC-400 TrustZone (R)
292 * Address Space Controller' Technical Reference Manual.
293 */
294 ERROR("TZC-400 : Filter %d Gatekeeper already"
295 " enabled.\n", filter);
296 panic();
297 }
298 _tzc400_set_gate_keeper(tzc400.base, filter, 1);
299 }
300 }
301
tzc400_disable_filters(void)302 void tzc400_disable_filters(void)
303 {
304 unsigned int filter;
305
306 assert(tzc400.base != 0U);
307
308 /*
309 * We don't do the same state check as above as the Gatekeepers are
310 * disabled after reset.
311 */
312 for (filter = 0; filter < tzc400.num_filters; filter++)
313 _tzc400_set_gate_keeper(tzc400.base, filter, 0);
314 }
315
tzc400_it_handler(void)316 int tzc400_it_handler(void)
317 {
318 uint32_t filter;
319 uint32_t filter_it_pending = tzc400.num_filters;
320
321 assert(tzc400.base != 0U);
322
323 for (filter = 0U; filter < tzc400.num_filters; filter++) {
324 if (_tzc400_get_int_by_filter(tzc400.base, filter) != 0U) {
325 filter_it_pending = filter;
326 break;
327 }
328 }
329
330 if (filter_it_pending == tzc400.num_filters) {
331 ERROR("TZC-400: No interrupt pending!\n");
332 return -1;
333 }
334
335 #if DEBUG
336 _tzc400_dump_fail_filter(tzc400.base, filter_it_pending);
337 #endif
338
339 _tzc400_clear_it(tzc400.base, filter_it_pending);
340
341 return 0;
342 }
343