1 /* 2 * Copyright (c) 2016-2018, ARM Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <assert.h> 8 #include <stddef.h> 9 10 #include <common/debug.h> 11 #include <drivers/arm/tzc400.h> 12 #include <lib/mmio.h> 13 14 #include "tzc_common_private.h" 15 16 /* 17 * Macros which will be used by common core functions. 18 */ 19 #define TZC_400_REGION_BASE_LOW_0_OFFSET U(0x100) 20 #define TZC_400_REGION_BASE_HIGH_0_OFFSET U(0x104) 21 #define TZC_400_REGION_TOP_LOW_0_OFFSET U(0x108) 22 #define TZC_400_REGION_TOP_HIGH_0_OFFSET U(0x10c) 23 #define TZC_400_REGION_ATTR_0_OFFSET U(0x110) 24 #define TZC_400_REGION_ID_ACCESS_0_OFFSET U(0x114) 25 26 /* 27 * Implementation defined values used to validate inputs later. 28 * Filters : max of 4 ; 0 to 3 29 * Regions : max of 9 ; 0 to 8 30 * Address width : Values between 32 to 64 31 */ 32 typedef struct tzc400_instance { 33 uintptr_t base; 34 uint8_t addr_width; 35 uint8_t num_filters; 36 uint8_t num_regions; 37 } tzc400_instance_t; 38 39 static tzc400_instance_t tzc400; 40 41 static inline unsigned int _tzc400_read_build_config(uintptr_t base) 42 { 43 return mmio_read_32(base + BUILD_CONFIG_OFF); 44 } 45 46 static inline unsigned int _tzc400_read_gate_keeper(uintptr_t base) 47 { 48 return mmio_read_32(base + GATE_KEEPER_OFF); 49 } 50 51 static inline void _tzc400_write_gate_keeper(uintptr_t base, unsigned int val) 52 { 53 mmio_write_32(base + GATE_KEEPER_OFF, val); 54 } 55 56 /* 57 * Get the open status information for all filter units. 58 */ 59 #define get_gate_keeper_os(_base) ((_tzc400_read_gate_keeper(_base) >> \ 60 GATE_KEEPER_OS_SHIFT) & \ 61 GATE_KEEPER_OS_MASK) 62 63 64 /* Define common core functions used across different TZC peripherals. */ 65 DEFINE_TZC_COMMON_WRITE_ACTION(400, 400) 66 DEFINE_TZC_COMMON_WRITE_REGION_BASE(400, 400) 67 DEFINE_TZC_COMMON_WRITE_REGION_TOP(400, 400) 68 DEFINE_TZC_COMMON_WRITE_REGION_ATTRIBUTES(400, 400) 69 DEFINE_TZC_COMMON_WRITE_REGION_ID_ACCESS(400, 400) 70 DEFINE_TZC_COMMON_CONFIGURE_REGION0(400) 71 DEFINE_TZC_COMMON_CONFIGURE_REGION(400) 72 73 static unsigned int _tzc400_get_gate_keeper(uintptr_t base, 74 unsigned int filter) 75 { 76 unsigned int open_status; 77 78 open_status = get_gate_keeper_os(base); 79 80 return (open_status >> filter) & GATE_KEEPER_FILTER_MASK; 81 } 82 83 /* This function is not MP safe. */ 84 static void _tzc400_set_gate_keeper(uintptr_t base, 85 unsigned int filter, 86 int val) 87 { 88 unsigned int open_status; 89 90 /* Upper half is current state. Lower half is requested state. */ 91 open_status = get_gate_keeper_os(base); 92 93 if (val != 0) 94 open_status |= (1U << filter); 95 else 96 open_status &= ~(1U << filter); 97 98 _tzc400_write_gate_keeper(base, (open_status & GATE_KEEPER_OR_MASK) << 99 GATE_KEEPER_OR_SHIFT); 100 101 /* Wait here until we see the change reflected in the TZC status. */ 102 while ((get_gate_keeper_os(base)) != open_status) 103 ; 104 } 105 106 void tzc400_set_action(unsigned int action) 107 { 108 assert(tzc400.base != 0U); 109 assert(action <= TZC_ACTION_ERR_INT); 110 111 /* 112 * - Currently no handler is provided to trap an error via interrupt 113 * or exception. 114 * - The interrupt action has not been tested. 115 */ 116 _tzc400_write_action(tzc400.base, action); 117 } 118 119 void tzc400_init(uintptr_t base) 120 { 121 #if DEBUG 122 unsigned int tzc400_id; 123 #endif 124 unsigned int tzc400_build; 125 126 assert(base != 0U); 127 tzc400.base = base; 128 129 #if DEBUG 130 tzc400_id = _tzc_read_peripheral_id(base); 131 if (tzc400_id != TZC_400_PERIPHERAL_ID) { 132 ERROR("TZC-400 : Wrong device ID (0x%x).\n", tzc400_id); 133 panic(); 134 } 135 #endif 136 137 /* Save values we will use later. */ 138 tzc400_build = _tzc400_read_build_config(tzc400.base); 139 tzc400.num_filters = (uint8_t)((tzc400_build >> BUILD_CONFIG_NF_SHIFT) & 140 BUILD_CONFIG_NF_MASK) + 1U; 141 tzc400.addr_width = (uint8_t)((tzc400_build >> BUILD_CONFIG_AW_SHIFT) & 142 BUILD_CONFIG_AW_MASK) + 1U; 143 tzc400.num_regions = (uint8_t)((tzc400_build >> BUILD_CONFIG_NR_SHIFT) & 144 BUILD_CONFIG_NR_MASK) + 1U; 145 } 146 147 /* 148 * `tzc400_configure_region0` is used to program region 0 into the TrustZone 149 * controller. Region 0 covers the whole address space that is not mapped 150 * to any other region, and is enabled on all filters; this cannot be 151 * changed. This function only changes the access permissions. 152 */ 153 void tzc400_configure_region0(unsigned int sec_attr, 154 unsigned int ns_device_access) 155 { 156 assert(tzc400.base != 0U); 157 assert(sec_attr <= TZC_REGION_S_RDWR); 158 159 _tzc400_configure_region0(tzc400.base, sec_attr, ns_device_access); 160 } 161 162 /* 163 * `tzc400_configure_region` is used to program regions into the TrustZone 164 * controller. A region can be associated with more than one filter. The 165 * associated filters are passed in as a bitmap (bit0 = filter0). 166 * NOTE: 167 * Region 0 is special; it is preferable to use tzc400_configure_region0 168 * for this region (see comment for that function). 169 */ 170 void tzc400_configure_region(unsigned int filters, 171 unsigned int region, 172 unsigned long long region_base, 173 unsigned long long region_top, 174 unsigned int sec_attr, 175 unsigned int nsaid_permissions) 176 { 177 assert(tzc400.base != 0U); 178 179 /* Do range checks on filters and regions. */ 180 assert(((filters >> tzc400.num_filters) == 0U) && 181 (region < tzc400.num_regions)); 182 183 /* 184 * Do address range check based on TZC configuration. A 64bit address is 185 * the max and expected case. 186 */ 187 assert((region_top <= (UINT64_MAX >> (64U - tzc400.addr_width))) && 188 (region_base < region_top)); 189 190 /* region_base and (region_top + 1) must be 4KB aligned */ 191 assert(((region_base | (region_top + 1U)) & (4096U - 1U)) == 0U); 192 193 assert(sec_attr <= TZC_REGION_S_RDWR); 194 195 _tzc400_configure_region(tzc400.base, filters, region, region_base, 196 region_top, 197 sec_attr, nsaid_permissions); 198 } 199 200 void tzc400_enable_filters(void) 201 { 202 unsigned int state; 203 unsigned int filter; 204 205 assert(tzc400.base != 0U); 206 207 for (filter = 0U; filter < tzc400.num_filters; filter++) { 208 state = _tzc400_get_gate_keeper(tzc400.base, filter); 209 if (state != 0U) { 210 /* 211 * The TZC filter is already configured. Changing the 212 * programmer's view in an active system can cause 213 * unpredictable behavior therefore panic for now rather 214 * than try to determine whether this is safe in this 215 * instance. 216 * 217 * See the 'ARM (R) CoreLink TM TZC-400 TrustZone (R) 218 * Address Space Controller' Technical Reference Manual. 219 */ 220 ERROR("TZC-400 : Filter %d Gatekeeper already" 221 " enabled.\n", filter); 222 panic(); 223 } 224 _tzc400_set_gate_keeper(tzc400.base, filter, 1); 225 } 226 } 227 228 void tzc400_disable_filters(void) 229 { 230 unsigned int filter; 231 232 assert(tzc400.base != 0U); 233 234 /* 235 * We don't do the same state check as above as the Gatekeepers are 236 * disabled after reset. 237 */ 238 for (filter = 0; filter < tzc400.num_filters; filter++) 239 _tzc400_set_gate_keeper(tzc400.base, filter, 0); 240 } 241