1 /*
2 * Copyright (c) 2016-2021, ARM Limited and Contributors. All rights reserved.
3 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 */
6
7 #include <assert.h>
8 #include <stddef.h>
9
10 #include <common/debug.h>
11 #include <drivers/arm/tzc400.h>
12 #include <lib/mmio.h>
13 #include <lib/utils_def.h>
14
15 #include "tzc_common_private.h"
16
17 /*
18 * Macros which will be used by common core functions.
19 */
20 #define TZC_400_REGION_BASE_LOW_0_OFFSET U(0x100)
21 #define TZC_400_REGION_BASE_HIGH_0_OFFSET U(0x104)
22 #define TZC_400_REGION_TOP_LOW_0_OFFSET U(0x108)
23 #define TZC_400_REGION_TOP_HIGH_0_OFFSET U(0x10c)
24 #define TZC_400_REGION_ATTR_0_OFFSET U(0x110)
25 #define TZC_400_REGION_ID_ACCESS_0_OFFSET U(0x114)
26
27 /*
28 * Implementation defined values used to validate inputs later.
29 * Filters : max of 4 ; 0 to 3
30 * Regions : max of 9 ; 0 to 8
31 * Address width : Values between 32 to 64
32 */
33 typedef struct tzc400_instance {
34 uintptr_t base;
35 uint8_t addr_width;
36 uint8_t num_filters;
37 uint8_t num_regions;
38 } tzc400_instance_t;
39
40 static tzc400_instance_t tzc400;
41
_tzc400_read_build_config(uintptr_t base)42 static inline unsigned int _tzc400_read_build_config(uintptr_t base)
43 {
44 return mmio_read_32(base + BUILD_CONFIG_OFF);
45 }
46
_tzc400_read_gate_keeper(uintptr_t base)47 static inline unsigned int _tzc400_read_gate_keeper(uintptr_t base)
48 {
49 return mmio_read_32(base + GATE_KEEPER_OFF);
50 }
51
_tzc400_write_gate_keeper(uintptr_t base,unsigned int val)52 static inline void _tzc400_write_gate_keeper(uintptr_t base, unsigned int val)
53 {
54 mmio_write_32(base + GATE_KEEPER_OFF, val);
55 }
56
57 /*
58 * Get the open status information for all filter units.
59 */
60 #define get_gate_keeper_os(_base) ((_tzc400_read_gate_keeper(_base) >> \
61 GATE_KEEPER_OS_SHIFT) & \
62 GATE_KEEPER_OS_MASK)
63
64
65 /* Define common core functions used across different TZC peripherals. */
66 DEFINE_TZC_COMMON_WRITE_ACTION(400, 400)
67 DEFINE_TZC_COMMON_WRITE_REGION_BASE(400, 400)
68 DEFINE_TZC_COMMON_WRITE_REGION_TOP(400, 400)
69 DEFINE_TZC_COMMON_WRITE_REGION_ATTRIBUTES(400, 400)
70 DEFINE_TZC_COMMON_WRITE_REGION_ID_ACCESS(400, 400)
71 DEFINE_TZC_COMMON_UPDATE_FILTERS(400, 400)
72 DEFINE_TZC_COMMON_CONFIGURE_REGION0(400)
73 DEFINE_TZC_COMMON_CONFIGURE_REGION(400)
74
_tzc400_clear_it(uintptr_t base,uint32_t filter)75 static void _tzc400_clear_it(uintptr_t base, uint32_t filter)
76 {
77 mmio_write_32(base + INT_CLEAR, BIT_32(filter));
78 }
79
_tzc400_get_int_by_filter(uintptr_t base,uint32_t filter)80 static uint32_t _tzc400_get_int_by_filter(uintptr_t base, uint32_t filter)
81 {
82 return mmio_read_32(base + INT_STATUS) & BIT_32(filter);
83 }
84
85 #if DEBUG
_tzc400_get_fail_address(uintptr_t base,uint32_t filter)86 static unsigned long _tzc400_get_fail_address(uintptr_t base, uint32_t filter)
87 {
88 unsigned long fail_address;
89
90 fail_address = mmio_read_32(base + FAIL_ADDRESS_LOW_OFF +
91 (filter * FILTER_OFFSET));
92 #ifdef __aarch64__
93 fail_address += (unsigned long)mmio_read_32(base + FAIL_ADDRESS_HIGH_OFF +
94 (filter * FILTER_OFFSET)) << 32;
95 #endif
96
97 return fail_address;
98 }
99
_tzc400_get_fail_id(uintptr_t base,uint32_t filter)100 static uint32_t _tzc400_get_fail_id(uintptr_t base, uint32_t filter)
101 {
102 return mmio_read_32(base + FAIL_ID + (filter * FILTER_OFFSET));
103 }
104
_tzc400_get_fail_control(uintptr_t base,uint32_t filter)105 static uint32_t _tzc400_get_fail_control(uintptr_t base, uint32_t filter)
106 {
107 return mmio_read_32(base + FAIL_CONTROL_OFF + (filter * FILTER_OFFSET));
108 }
109
_tzc400_dump_fail_filter(uintptr_t base,uint32_t filter)110 static void _tzc400_dump_fail_filter(uintptr_t base, uint32_t filter)
111 {
112 uint32_t control_fail;
113 uint32_t fail_id;
114 unsigned long address_fail;
115
116 address_fail = _tzc400_get_fail_address(base, filter);
117 ERROR("Illegal access to 0x%lx:\n", address_fail);
118
119 fail_id = _tzc400_get_fail_id(base, filter);
120 ERROR("\tFAIL_ID = 0x%x\n", fail_id);
121
122 control_fail = _tzc400_get_fail_control(base, filter);
123 if (((control_fail & BIT_32(FAIL_CONTROL_NS_SHIFT)) >> FAIL_CONTROL_NS_SHIFT) ==
124 FAIL_CONTROL_NS_NONSECURE) {
125 ERROR("\tNon-Secure\n");
126 } else {
127 ERROR("\tSecure\n");
128 }
129
130 if (((control_fail & BIT_32(FAIL_CONTROL_PRIV_SHIFT)) >> FAIL_CONTROL_PRIV_SHIFT) ==
131 FAIL_CONTROL_PRIV_PRIV) {
132 ERROR("\tPrivilege\n");
133 } else {
134 ERROR("\tUnprivilege\n");
135 }
136
137 if (((control_fail & BIT_32(FAIL_CONTROL_DIR_SHIFT)) >> FAIL_CONTROL_DIR_SHIFT) ==
138 FAIL_CONTROL_DIR_WRITE) {
139 ERROR("\tWrite\n");
140 } else {
141 ERROR("\tRead\n");
142 }
143 }
144 #endif /* DEBUG */
145
_tzc400_get_gate_keeper(uintptr_t base,unsigned int filter)146 static unsigned int _tzc400_get_gate_keeper(uintptr_t base,
147 unsigned int filter)
148 {
149 unsigned int open_status;
150
151 open_status = get_gate_keeper_os(base);
152
153 return (open_status >> filter) & GATE_KEEPER_FILTER_MASK;
154 }
155
156 /* This function is not MP safe. */
_tzc400_set_gate_keeper(uintptr_t base,unsigned int filter,int val)157 static void _tzc400_set_gate_keeper(uintptr_t base,
158 unsigned int filter,
159 int val)
160 {
161 unsigned int open_status;
162
163 /* Upper half is current state. Lower half is requested state. */
164 open_status = get_gate_keeper_os(base);
165
166 if (val != 0)
167 open_status |= (1UL << filter);
168 else
169 open_status &= ~(1UL << filter);
170
171 _tzc400_write_gate_keeper(base, (open_status & GATE_KEEPER_OR_MASK) <<
172 GATE_KEEPER_OR_SHIFT);
173
174 /* Wait here until we see the change reflected in the TZC status. */
175 while ((get_gate_keeper_os(base)) != open_status)
176 ;
177 }
178
tzc400_set_action(unsigned int action)179 void tzc400_set_action(unsigned int action)
180 {
181 assert(tzc400.base != 0U);
182 assert(action <= TZC_ACTION_ERR_INT);
183
184 _tzc400_write_action(tzc400.base, action);
185 }
186
tzc400_init(uintptr_t base)187 void tzc400_init(uintptr_t base)
188 {
189 #if DEBUG
190 unsigned int tzc400_id;
191 #endif
192 unsigned int tzc400_build;
193
194 assert(base != 0U);
195 tzc400.base = base;
196
197 #if DEBUG
198 tzc400_id = _tzc_read_peripheral_id(base);
199 if (tzc400_id != TZC_400_PERIPHERAL_ID) {
200 ERROR("TZC-400 : Wrong device ID (0x%x).\n", tzc400_id);
201 panic();
202 }
203 #endif
204
205 /* Save values we will use later. */
206 tzc400_build = _tzc400_read_build_config(tzc400.base);
207 tzc400.num_filters = (uint8_t)((tzc400_build >> BUILD_CONFIG_NF_SHIFT) &
208 BUILD_CONFIG_NF_MASK) + 1U;
209 tzc400.addr_width = (uint8_t)((tzc400_build >> BUILD_CONFIG_AW_SHIFT) &
210 BUILD_CONFIG_AW_MASK) + 1U;
211 tzc400.num_regions = (uint8_t)((tzc400_build >> BUILD_CONFIG_NR_SHIFT) &
212 BUILD_CONFIG_NR_MASK) + 1U;
213 }
214
215 /*
216 * `tzc400_configure_region0` is used to program region 0 into the TrustZone
217 * controller. Region 0 covers the whole address space that is not mapped
218 * to any other region, and is enabled on all filters; this cannot be
219 * changed. This function only changes the access permissions.
220 */
tzc400_configure_region0(unsigned int sec_attr,unsigned int ns_device_access)221 void tzc400_configure_region0(unsigned int sec_attr,
222 unsigned int ns_device_access)
223 {
224 assert(tzc400.base != 0U);
225 assert(sec_attr <= TZC_REGION_S_RDWR);
226
227 _tzc400_configure_region0(tzc400.base, sec_attr, ns_device_access);
228 }
229
230 /*
231 * `tzc400_configure_region` is used to program regions into the TrustZone
232 * controller. A region can be associated with more than one filter. The
233 * associated filters are passed in as a bitmap (bit0 = filter0), except that
234 * the value TZC_400_REGION_ATTR_FILTER_BIT_ALL selects all filters, based on
235 * the value of tzc400.num_filters.
236 * NOTE:
237 * Region 0 is special; it is preferable to use tzc400_configure_region0
238 * for this region (see comment for that function).
239 */
tzc400_configure_region(unsigned int filters,unsigned int region,unsigned long long region_base,unsigned long long region_top,unsigned int sec_attr,unsigned int nsaid_permissions)240 void tzc400_configure_region(unsigned int filters,
241 unsigned int region,
242 unsigned long long region_base,
243 unsigned long long region_top,
244 unsigned int sec_attr,
245 unsigned int nsaid_permissions)
246 {
247 assert(tzc400.base != 0U);
248
249 /* Adjust filter mask by real filter number */
250 if (filters == TZC_400_REGION_ATTR_FILTER_BIT_ALL) {
251 filters = (1U << tzc400.num_filters) - 1U;
252 }
253
254 /* Do range checks on filters and regions. */
255 assert(((filters >> tzc400.num_filters) == 0U) &&
256 (region < tzc400.num_regions));
257
258 /*
259 * Do address range check based on TZC configuration. A 64bit address is
260 * the max and expected case.
261 */
262 assert((region_top <= (UINT64_MAX >> (64U - tzc400.addr_width))) &&
263 (region_base < region_top));
264
265 /* region_base and (region_top + 1) must be 4KB aligned */
266 assert(((region_base | (region_top + 1U)) & (4096U - 1U)) == 0U);
267
268 assert(sec_attr <= TZC_REGION_S_RDWR);
269
270 _tzc400_configure_region(tzc400.base, filters, region, region_base,
271 region_top,
272 sec_attr, nsaid_permissions);
273 }
274
tzc400_update_filters(unsigned int region,unsigned int filters)275 void tzc400_update_filters(unsigned int region, unsigned int filters)
276 {
277 /* Do range checks on filters and regions. */
278 assert(((filters >> tzc400.num_filters) == 0U) &&
279 (region < tzc400.num_regions));
280
281 _tzc400_update_filters(tzc400.base, region, tzc400.num_filters, filters);
282 }
283
tzc400_enable_filters(void)284 void tzc400_enable_filters(void)
285 {
286 unsigned int state;
287 unsigned int filter;
288
289 assert(tzc400.base != 0U);
290
291 for (filter = 0U; filter < tzc400.num_filters; filter++) {
292 state = _tzc400_get_gate_keeper(tzc400.base, filter);
293 if (state != 0U) {
294 /* Filter 0 is special and cannot be disabled.
295 * So here we allow it being already enabled. */
296 if (filter == 0U) {
297 continue;
298 }
299 /*
300 * The TZC filter is already configured. Changing the
301 * programmer's view in an active system can cause
302 * unpredictable behavior therefore panic for now rather
303 * than try to determine whether this is safe in this
304 * instance.
305 *
306 * See the 'ARM (R) CoreLink TM TZC-400 TrustZone (R)
307 * Address Space Controller' Technical Reference Manual.
308 */
309 ERROR("TZC-400 : Filter %d Gatekeeper already"
310 " enabled.\n", filter);
311 panic();
312 }
313 _tzc400_set_gate_keeper(tzc400.base, filter, 1);
314 }
315 }
316
tzc400_disable_filters(void)317 void tzc400_disable_filters(void)
318 {
319 unsigned int filter;
320 unsigned int state;
321 unsigned int start = 0U;
322
323 assert(tzc400.base != 0U);
324
325 /* Filter 0 is special and cannot be disabled. */
326 state = _tzc400_get_gate_keeper(tzc400.base, 0);
327 if (state != 0U) {
328 start++;
329 }
330 for (filter = start; filter < tzc400.num_filters; filter++)
331 _tzc400_set_gate_keeper(tzc400.base, filter, 0);
332 }
333
tzc400_it_handler(void)334 int tzc400_it_handler(void)
335 {
336 uint32_t filter;
337 uint32_t filter_it_pending = tzc400.num_filters;
338
339 assert(tzc400.base != 0U);
340
341 for (filter = 0U; filter < tzc400.num_filters; filter++) {
342 if (_tzc400_get_int_by_filter(tzc400.base, filter) != 0U) {
343 filter_it_pending = filter;
344 break;
345 }
346 }
347
348 if (filter_it_pending == tzc400.num_filters) {
349 ERROR("TZC-400: No interrupt pending!\n");
350 return -1;
351 }
352
353 #if DEBUG
354 _tzc400_dump_fail_filter(tzc400.base, filter_it_pending);
355 #endif
356
357 _tzc400_clear_it(tzc400.base, filter_it_pending);
358
359 return 0;
360 }
361