1 /*
2 * Copyright (c) 2016-2020, ARM Limited and Contributors. All rights reserved.
3 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 */
6
7 #include <assert.h>
8 #include <stddef.h>
9
10 #include <common/debug.h>
11 #include <drivers/arm/tzc400.h>
12 #include <lib/mmio.h>
13
14 #include "tzc_common_private.h"
15
16 /*
17 * Macros which will be used by common core functions.
18 */
19 #define TZC_400_REGION_BASE_LOW_0_OFFSET U(0x100)
20 #define TZC_400_REGION_BASE_HIGH_0_OFFSET U(0x104)
21 #define TZC_400_REGION_TOP_LOW_0_OFFSET U(0x108)
22 #define TZC_400_REGION_TOP_HIGH_0_OFFSET U(0x10c)
23 #define TZC_400_REGION_ATTR_0_OFFSET U(0x110)
24 #define TZC_400_REGION_ID_ACCESS_0_OFFSET U(0x114)
25
26 /*
27 * Implementation defined values used to validate inputs later.
28 * Filters : max of 4 ; 0 to 3
29 * Regions : max of 9 ; 0 to 8
30 * Address width : Values between 32 to 64
31 */
32 typedef struct tzc400_instance {
33 uintptr_t base;
34 uint8_t addr_width;
35 uint8_t num_filters;
36 uint8_t num_regions;
37 } tzc400_instance_t;
38
39 static tzc400_instance_t tzc400;
40
_tzc400_read_build_config(uintptr_t base)41 static inline unsigned int _tzc400_read_build_config(uintptr_t base)
42 {
43 return mmio_read_32(base + BUILD_CONFIG_OFF);
44 }
45
_tzc400_read_gate_keeper(uintptr_t base)46 static inline unsigned int _tzc400_read_gate_keeper(uintptr_t base)
47 {
48 return mmio_read_32(base + GATE_KEEPER_OFF);
49 }
50
_tzc400_write_gate_keeper(uintptr_t base,unsigned int val)51 static inline void _tzc400_write_gate_keeper(uintptr_t base, unsigned int val)
52 {
53 mmio_write_32(base + GATE_KEEPER_OFF, val);
54 }
55
56 /*
57 * Get the open status information for all filter units.
58 */
59 #define get_gate_keeper_os(_base) ((_tzc400_read_gate_keeper(_base) >> \
60 GATE_KEEPER_OS_SHIFT) & \
61 GATE_KEEPER_OS_MASK)
62
63
64 /* Define common core functions used across different TZC peripherals. */
65 DEFINE_TZC_COMMON_WRITE_ACTION(400, 400)
66 DEFINE_TZC_COMMON_WRITE_REGION_BASE(400, 400)
67 DEFINE_TZC_COMMON_WRITE_REGION_TOP(400, 400)
68 DEFINE_TZC_COMMON_WRITE_REGION_ATTRIBUTES(400, 400)
69 DEFINE_TZC_COMMON_WRITE_REGION_ID_ACCESS(400, 400)
70 DEFINE_TZC_COMMON_CONFIGURE_REGION0(400)
71 DEFINE_TZC_COMMON_CONFIGURE_REGION(400)
72
_tzc400_get_gate_keeper(uintptr_t base,unsigned int filter)73 static unsigned int _tzc400_get_gate_keeper(uintptr_t base,
74 unsigned int filter)
75 {
76 unsigned int open_status;
77
78 open_status = get_gate_keeper_os(base);
79
80 return (open_status >> filter) & GATE_KEEPER_FILTER_MASK;
81 }
82
83 /* This function is not MP safe. */
_tzc400_set_gate_keeper(uintptr_t base,unsigned int filter,int val)84 static void _tzc400_set_gate_keeper(uintptr_t base,
85 unsigned int filter,
86 int val)
87 {
88 unsigned int open_status;
89
90 /* Upper half is current state. Lower half is requested state. */
91 open_status = get_gate_keeper_os(base);
92
93 if (val != 0)
94 open_status |= (1UL << filter);
95 else
96 open_status &= ~(1UL << filter);
97
98 _tzc400_write_gate_keeper(base, (open_status & GATE_KEEPER_OR_MASK) <<
99 GATE_KEEPER_OR_SHIFT);
100
101 /* Wait here until we see the change reflected in the TZC status. */
102 while ((get_gate_keeper_os(base)) != open_status)
103 ;
104 }
105
tzc400_set_action(unsigned int action)106 void tzc400_set_action(unsigned int action)
107 {
108 assert(tzc400.base != 0U);
109 assert(action <= TZC_ACTION_ERR_INT);
110
111 /*
112 * - Currently no handler is provided to trap an error via interrupt
113 * or exception.
114 * - The interrupt action has not been tested.
115 */
116 _tzc400_write_action(tzc400.base, action);
117 }
118
tzc400_init(uintptr_t base)119 void tzc400_init(uintptr_t base)
120 {
121 #if DEBUG
122 unsigned int tzc400_id;
123 #endif
124 unsigned int tzc400_build;
125
126 assert(base != 0U);
127 tzc400.base = base;
128
129 #if DEBUG
130 tzc400_id = _tzc_read_peripheral_id(base);
131 if (tzc400_id != TZC_400_PERIPHERAL_ID) {
132 ERROR("TZC-400 : Wrong device ID (0x%x).\n", tzc400_id);
133 panic();
134 }
135 #endif
136
137 /* Save values we will use later. */
138 tzc400_build = _tzc400_read_build_config(tzc400.base);
139 tzc400.num_filters = (uint8_t)((tzc400_build >> BUILD_CONFIG_NF_SHIFT) &
140 BUILD_CONFIG_NF_MASK) + 1U;
141 tzc400.addr_width = (uint8_t)((tzc400_build >> BUILD_CONFIG_AW_SHIFT) &
142 BUILD_CONFIG_AW_MASK) + 1U;
143 tzc400.num_regions = (uint8_t)((tzc400_build >> BUILD_CONFIG_NR_SHIFT) &
144 BUILD_CONFIG_NR_MASK) + 1U;
145 }
146
147 /*
148 * `tzc400_configure_region0` is used to program region 0 into the TrustZone
149 * controller. Region 0 covers the whole address space that is not mapped
150 * to any other region, and is enabled on all filters; this cannot be
151 * changed. This function only changes the access permissions.
152 */
tzc400_configure_region0(unsigned int sec_attr,unsigned int ns_device_access)153 void tzc400_configure_region0(unsigned int sec_attr,
154 unsigned int ns_device_access)
155 {
156 assert(tzc400.base != 0U);
157 assert(sec_attr <= TZC_REGION_S_RDWR);
158
159 _tzc400_configure_region0(tzc400.base, sec_attr, ns_device_access);
160 }
161
162 /*
163 * `tzc400_configure_region` is used to program regions into the TrustZone
164 * controller. A region can be associated with more than one filter. The
165 * associated filters are passed in as a bitmap (bit0 = filter0).
166 * NOTE:
167 * Region 0 is special; it is preferable to use tzc400_configure_region0
168 * for this region (see comment for that function).
169 */
tzc400_configure_region(unsigned int filters,unsigned int region,unsigned long long region_base,unsigned long long region_top,unsigned int sec_attr,unsigned int nsaid_permissions)170 void tzc400_configure_region(unsigned int filters,
171 unsigned int region,
172 unsigned long long region_base,
173 unsigned long long region_top,
174 unsigned int sec_attr,
175 unsigned int nsaid_permissions)
176 {
177 assert(tzc400.base != 0U);
178
179 /* Do range checks on filters and regions. */
180 assert(((filters >> tzc400.num_filters) == 0U) &&
181 (region < tzc400.num_regions));
182
183 /*
184 * Do address range check based on TZC configuration. A 64bit address is
185 * the max and expected case.
186 */
187 assert((region_top <= (UINT64_MAX >> (64U - tzc400.addr_width))) &&
188 (region_base < region_top));
189
190 /* region_base and (region_top + 1) must be 4KB aligned */
191 assert(((region_base | (region_top + 1U)) & (4096U - 1U)) == 0U);
192
193 assert(sec_attr <= TZC_REGION_S_RDWR);
194
195 _tzc400_configure_region(tzc400.base, filters, region, region_base,
196 region_top,
197 sec_attr, nsaid_permissions);
198 }
199
tzc400_enable_filters(void)200 void tzc400_enable_filters(void)
201 {
202 unsigned int state;
203 unsigned int filter;
204
205 assert(tzc400.base != 0U);
206
207 for (filter = 0U; filter < tzc400.num_filters; filter++) {
208 state = _tzc400_get_gate_keeper(tzc400.base, filter);
209 if (state != 0U) {
210 /*
211 * The TZC filter is already configured. Changing the
212 * programmer's view in an active system can cause
213 * unpredictable behavior therefore panic for now rather
214 * than try to determine whether this is safe in this
215 * instance.
216 *
217 * See the 'ARM (R) CoreLink TM TZC-400 TrustZone (R)
218 * Address Space Controller' Technical Reference Manual.
219 */
220 ERROR("TZC-400 : Filter %d Gatekeeper already"
221 " enabled.\n", filter);
222 panic();
223 }
224 _tzc400_set_gate_keeper(tzc400.base, filter, 1);
225 }
226 }
227
tzc400_disable_filters(void)228 void tzc400_disable_filters(void)
229 {
230 unsigned int filter;
231
232 assert(tzc400.base != 0U);
233
234 /*
235 * We don't do the same state check as above as the Gatekeepers are
236 * disabled after reset.
237 */
238 for (filter = 0; filter < tzc400.num_filters; filter++)
239 _tzc400_set_gate_keeper(tzc400.base, filter, 0);
240 }
241