1 /* 2 * Copyright (c) 2016-2022, ARM Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <assert.h> 8 #include <stddef.h> 9 10 #include <common/debug.h> 11 #include <drivers/arm/tzc400.h> 12 #include <lib/mmio.h> 13 #include <lib/utils_def.h> 14 15 #include "tzc_common_private.h" 16 17 /* 18 * Macros which will be used by common core functions. 19 */ 20 #define TZC_400_REGION_BASE_LOW_0_OFFSET U(0x100) 21 #define TZC_400_REGION_BASE_HIGH_0_OFFSET U(0x104) 22 #define TZC_400_REGION_TOP_LOW_0_OFFSET U(0x108) 23 #define TZC_400_REGION_TOP_HIGH_0_OFFSET U(0x10c) 24 #define TZC_400_REGION_ATTR_0_OFFSET U(0x110) 25 #define TZC_400_REGION_ID_ACCESS_0_OFFSET U(0x114) 26 27 /* 28 * Implementation defined values used to validate inputs later. 29 * Filters : max of 4 ; 0 to 3 30 * Regions : max of 9 ; 0 to 8 31 * Address width : Values between 32 to 64 32 */ 33 typedef struct tzc400_instance { 34 uintptr_t base; 35 uint8_t addr_width; 36 uint8_t num_filters; 37 uint8_t num_regions; 38 } tzc400_instance_t; 39 40 static tzc400_instance_t tzc400; 41 42 static inline unsigned int _tzc400_read_build_config(uintptr_t base) 43 { 44 return mmio_read_32(base + BUILD_CONFIG_OFF); 45 } 46 47 static inline unsigned int _tzc400_read_gate_keeper(uintptr_t base) 48 { 49 return mmio_read_32(base + GATE_KEEPER_OFF); 50 } 51 52 static inline void _tzc400_write_gate_keeper(uintptr_t base, unsigned int val) 53 { 54 mmio_write_32(base + GATE_KEEPER_OFF, val); 55 } 56 57 /* 58 * Get the open status information for all filter units. 59 */ 60 #define get_gate_keeper_os(_base) ((_tzc400_read_gate_keeper(_base) >> \ 61 GATE_KEEPER_OS_SHIFT) & \ 62 GATE_KEEPER_OS_MASK) 63 64 65 /* Define common core functions used across different TZC peripherals. */ 66 DEFINE_TZC_COMMON_WRITE_ACTION(400, 400) 67 DEFINE_TZC_COMMON_WRITE_REGION_BASE(400, 400) 68 DEFINE_TZC_COMMON_WRITE_REGION_TOP(400, 400) 69 DEFINE_TZC_COMMON_WRITE_REGION_ATTRIBUTES(400, 400) 70 DEFINE_TZC_COMMON_WRITE_REGION_ID_ACCESS(400, 400) 71 DEFINE_TZC_COMMON_UPDATE_FILTERS(400, 400) 72 DEFINE_TZC_COMMON_CONFIGURE_REGION0(400) 73 DEFINE_TZC_COMMON_CONFIGURE_REGION(400) 74 75 static void _tzc400_clear_it(uintptr_t base, uint32_t filter) 76 { 77 mmio_write_32(base + INT_CLEAR, BIT_32(filter)); 78 } 79 80 static uint32_t _tzc400_get_int_by_filter(uintptr_t base, uint32_t filter) 81 { 82 return mmio_read_32(base + INT_STATUS) & BIT_32(filter); 83 } 84 85 #if DEBUG 86 static unsigned long _tzc400_get_fail_address(uintptr_t base, uint32_t filter) 87 { 88 unsigned long fail_address; 89 90 fail_address = mmio_read_32(base + FAIL_ADDRESS_LOW_OFF + 91 (filter * FILTER_OFFSET)); 92 #ifdef __aarch64__ 93 fail_address += (unsigned long)mmio_read_32(base + FAIL_ADDRESS_HIGH_OFF + 94 (filter * FILTER_OFFSET)) << 32; 95 #endif 96 97 return fail_address; 98 } 99 100 static uint32_t _tzc400_get_fail_id(uintptr_t base, uint32_t filter) 101 { 102 return mmio_read_32(base + FAIL_ID + (filter * FILTER_OFFSET)); 103 } 104 105 static uint32_t _tzc400_get_fail_control(uintptr_t base, uint32_t filter) 106 { 107 return mmio_read_32(base + FAIL_CONTROL_OFF + (filter * FILTER_OFFSET)); 108 } 109 110 static void _tzc400_dump_fail_filter(uintptr_t base, uint32_t filter) 111 { 112 uint32_t control_fail; 113 uint32_t fail_id; 114 unsigned long address_fail; 115 116 address_fail = _tzc400_get_fail_address(base, filter); 117 ERROR("Illegal access to 0x%lx:\n", address_fail); 118 119 fail_id = _tzc400_get_fail_id(base, filter); 120 ERROR("\tFAIL_ID = 0x%x\n", fail_id); 121 122 control_fail = _tzc400_get_fail_control(base, filter); 123 if (((control_fail & BIT_32(FAIL_CONTROL_NS_SHIFT)) >> FAIL_CONTROL_NS_SHIFT) == 124 FAIL_CONTROL_NS_NONSECURE) { 125 ERROR("\tNon-Secure\n"); 126 } else { 127 ERROR("\tSecure\n"); 128 } 129 130 if (((control_fail & BIT_32(FAIL_CONTROL_PRIV_SHIFT)) >> FAIL_CONTROL_PRIV_SHIFT) == 131 FAIL_CONTROL_PRIV_PRIV) { 132 ERROR("\tPrivilege\n"); 133 } else { 134 ERROR("\tUnprivilege\n"); 135 } 136 137 if (((control_fail & BIT_32(FAIL_CONTROL_DIR_SHIFT)) >> FAIL_CONTROL_DIR_SHIFT) == 138 FAIL_CONTROL_DIR_WRITE) { 139 ERROR("\tWrite\n"); 140 } else { 141 ERROR("\tRead\n"); 142 } 143 } 144 #endif /* DEBUG */ 145 146 static unsigned int _tzc400_get_gate_keeper(uintptr_t base, 147 unsigned int filter) 148 { 149 unsigned int open_status; 150 151 open_status = get_gate_keeper_os(base); 152 153 return (open_status >> filter) & GATE_KEEPER_FILTER_MASK; 154 } 155 156 /* This function is not MP safe. */ 157 static void _tzc400_set_gate_keeper(uintptr_t base, 158 unsigned int filter, 159 int val) 160 { 161 unsigned int open_status; 162 163 /* Upper half is current state. Lower half is requested state. */ 164 open_status = get_gate_keeper_os(base); 165 166 if (val != 0) 167 open_status |= (1UL << filter); 168 else 169 open_status &= ~(1UL << filter); 170 171 _tzc400_write_gate_keeper(base, (open_status & GATE_KEEPER_OR_MASK) << 172 GATE_KEEPER_OR_SHIFT); 173 174 /* Wait here until we see the change reflected in the TZC status. */ 175 while ((get_gate_keeper_os(base)) != open_status) 176 ; 177 } 178 179 void tzc400_set_action(unsigned int action) 180 { 181 assert(tzc400.base != 0U); 182 assert(action <= TZC_ACTION_ERR_INT); 183 184 _tzc400_write_action(tzc400.base, action); 185 } 186 187 void tzc400_init(uintptr_t base) 188 { 189 #if DEBUG 190 unsigned int tzc400_id; 191 #endif 192 unsigned int tzc400_build; 193 194 assert(base != 0U); 195 tzc400.base = base; 196 197 #if DEBUG 198 tzc400_id = _tzc_read_peripheral_id(base); 199 if (tzc400_id != TZC_400_PERIPHERAL_ID) { 200 ERROR("TZC-400 : Wrong device ID (0x%x).\n", tzc400_id); 201 panic(); 202 } 203 #endif 204 205 /* Save values we will use later. */ 206 tzc400_build = _tzc400_read_build_config(tzc400.base); 207 tzc400.num_filters = (uint8_t)((tzc400_build >> BUILD_CONFIG_NF_SHIFT) & 208 BUILD_CONFIG_NF_MASK) + 1U; 209 tzc400.addr_width = (uint8_t)((tzc400_build >> BUILD_CONFIG_AW_SHIFT) & 210 BUILD_CONFIG_AW_MASK) + 1U; 211 tzc400.num_regions = (uint8_t)((tzc400_build >> BUILD_CONFIG_NR_SHIFT) & 212 BUILD_CONFIG_NR_MASK) + 1U; 213 } 214 215 /* 216 * `tzc400_configure_region0` is used to program region 0 into the TrustZone 217 * controller. Region 0 covers the whole address space that is not mapped 218 * to any other region, and is enabled on all filters; this cannot be 219 * changed. This function only changes the access permissions. 220 */ 221 void tzc400_configure_region0(unsigned int sec_attr, 222 unsigned int ns_device_access) 223 { 224 assert(tzc400.base != 0U); 225 assert(sec_attr <= TZC_REGION_S_RDWR); 226 227 _tzc400_configure_region0(tzc400.base, sec_attr, ns_device_access); 228 } 229 230 /* 231 * `tzc400_configure_region` is used to program regions into the TrustZone 232 * controller. A region can be associated with more than one filter. The 233 * associated filters are passed in as a bitmap (bit0 = filter0), except that 234 * the value TZC_400_REGION_ATTR_FILTER_BIT_ALL selects all filters, based on 235 * the value of tzc400.num_filters. 236 * NOTE: 237 * Region 0 is special; it is preferable to use tzc400_configure_region0 238 * for this region (see comment for that function). 239 */ 240 void tzc400_configure_region(unsigned int filters, 241 unsigned int region, 242 unsigned long long region_base, 243 unsigned long long region_top, 244 unsigned int sec_attr, 245 unsigned int nsaid_permissions) 246 { 247 assert(tzc400.base != 0U); 248 249 /* Adjust filter mask by real filter number */ 250 if (filters == TZC_400_REGION_ATTR_FILTER_BIT_ALL) { 251 filters = (1U << tzc400.num_filters) - 1U; 252 } 253 254 /* Do range checks on filters and regions. */ 255 assert(((filters >> tzc400.num_filters) == 0U) && 256 (region < tzc400.num_regions)); 257 258 /* 259 * Do address range check based on TZC configuration. A 64bit address is 260 * the max and expected case. 261 */ 262 assert((region_top <= (UINT64_MAX >> (64U - tzc400.addr_width))) && 263 (region_base < region_top)); 264 265 /* region_base and (region_top + 1) must be 4KB aligned */ 266 assert(((region_base | (region_top + 1U)) & (4096U - 1U)) == 0U); 267 268 assert(sec_attr <= TZC_REGION_S_RDWR); 269 270 _tzc400_configure_region(tzc400.base, filters, region, region_base, 271 region_top, 272 sec_attr, nsaid_permissions); 273 } 274 275 void tzc400_update_filters(unsigned int region, unsigned int filters) 276 { 277 /* Do range checks on filters and regions. */ 278 assert(((filters >> tzc400.num_filters) == 0U) && 279 (region < tzc400.num_regions)); 280 281 _tzc400_update_filters(tzc400.base, region, tzc400.num_filters, filters); 282 } 283 284 void tzc400_enable_filters(void) 285 { 286 unsigned int state; 287 unsigned int filter; 288 289 assert(tzc400.base != 0U); 290 291 for (filter = 0U; filter < tzc400.num_filters; filter++) { 292 state = _tzc400_get_gate_keeper(tzc400.base, filter); 293 if (state != 0U) { 294 /* Filter 0 is special and cannot be disabled. 295 * So here we allow it being already enabled. */ 296 if (filter == 0U) { 297 continue; 298 } 299 /* 300 * The TZC filter is already configured. Changing the 301 * programmer's view in an active system can cause 302 * unpredictable behavior therefore panic for now rather 303 * than try to determine whether this is safe in this 304 * instance. 305 * 306 * See the 'ARM (R) CoreLink TM TZC-400 TrustZone (R) 307 * Address Space Controller' Technical Reference Manual. 308 */ 309 ERROR("TZC-400 : Filter %u Gatekeeper already enabled.\n", 310 filter); 311 panic(); 312 } 313 _tzc400_set_gate_keeper(tzc400.base, filter, 1); 314 } 315 } 316 317 void tzc400_disable_filters(void) 318 { 319 unsigned int filter; 320 unsigned int state; 321 unsigned int start = 0U; 322 323 assert(tzc400.base != 0U); 324 325 /* Filter 0 is special and cannot be disabled. */ 326 state = _tzc400_get_gate_keeper(tzc400.base, 0); 327 if (state != 0U) { 328 start++; 329 } 330 for (filter = start; filter < tzc400.num_filters; filter++) 331 _tzc400_set_gate_keeper(tzc400.base, filter, 0); 332 } 333 334 int tzc400_it_handler(void) 335 { 336 uint32_t filter; 337 uint32_t filter_it_pending = tzc400.num_filters; 338 339 assert(tzc400.base != 0U); 340 341 for (filter = 0U; filter < tzc400.num_filters; filter++) { 342 if (_tzc400_get_int_by_filter(tzc400.base, filter) != 0U) { 343 filter_it_pending = filter; 344 break; 345 } 346 } 347 348 if (filter_it_pending == tzc400.num_filters) { 349 ERROR("TZC-400: No interrupt pending!\n"); 350 return -1; 351 } 352 353 #if DEBUG 354 _tzc400_dump_fail_filter(tzc400.base, filter_it_pending); 355 #endif 356 357 _tzc400_clear_it(tzc400.base, filter_it_pending); 358 359 return 0; 360 } 361