1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
|
/*
* ARM AHB5 TrustZone Memory Protection Controller emulation
*
* Copyright (c) 2018 Linaro Limited
* Written by Peter Maydell
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 or
* (at your option) any later version.
*/
#include "qemu/osdep.h"
#include "qemu/log.h"
#include "qemu/module.h"
#include "qapi/error.h"
#include "trace.h"
#include "hw/sysbus.h"
#include "migration/vmstate.h"
#include "hw/registerfields.h"
#include "hw/irq.h"
#include "hw/misc/tz-mpc.h"
#include "hw/qdev-properties.h"
/* Our IOMMU has two IOMMU indexes, one for secure transactions and one for
* non-secure transactions.
*/
enum {
IOMMU_IDX_S,
IOMMU_IDX_NS,
IOMMU_NUM_INDEXES,
};
/* Config registers */
REG32(CTRL, 0x00)
FIELD(CTRL, SEC_RESP, 4, 1)
FIELD(CTRL, AUTOINC, 8, 1)
FIELD(CTRL, LOCKDOWN, 31, 1)
REG32(BLK_MAX, 0x10)
REG32(BLK_CFG, 0x14)
REG32(BLK_IDX, 0x18)
REG32(BLK_LUT, 0x1c)
REG32(INT_STAT, 0x20)
FIELD(INT_STAT, IRQ, 0, 1)
REG32(INT_CLEAR, 0x24)
FIELD(INT_CLEAR, IRQ, 0, 1)
REG32(INT_EN, 0x28)
FIELD(INT_EN, IRQ, 0, 1)
REG32(INT_INFO1, 0x2c)
REG32(INT_INFO2, 0x30)
FIELD(INT_INFO2, HMASTER, 0, 16)
FIELD(INT_INFO2, HNONSEC, 16, 1)
FIELD(INT_INFO2, CFG_NS, 17, 1)
REG32(INT_SET, 0x34)
FIELD(INT_SET, IRQ, 0, 1)
REG32(PIDR4, 0xfd0)
REG32(PIDR5, 0xfd4)
REG32(PIDR6, 0xfd8)
REG32(PIDR7, 0xfdc)
REG32(PIDR0, 0xfe0)
REG32(PIDR1, 0xfe4)
REG32(PIDR2, 0xfe8)
REG32(PIDR3, 0xfec)
REG32(CIDR0, 0xff0)
REG32(CIDR1, 0xff4)
REG32(CIDR2, 0xff8)
REG32(CIDR3, 0xffc)
static const uint8_t tz_mpc_idregs[] = {
0x04, 0x00, 0x00, 0x00,
0x60, 0xb8, 0x1b, 0x00,
0x0d, 0xf0, 0x05, 0xb1,
};
static void tz_mpc_irq_update(TZMPC *s)
{
qemu_set_irq(s->irq, s->int_stat && s->int_en);
}
static void tz_mpc_iommu_notify(TZMPC *s, uint32_t lutidx,
uint32_t oldlut, uint32_t newlut)
{
/* Called when the LUT word at lutidx has changed from oldlut to newlut;
* must call the IOMMU notifiers for the changed blocks.
*/
IOMMUTLBEvent event = {
.entry = {
.addr_mask = s->blocksize - 1,
}
};
hwaddr addr = lutidx * s->blocksize * 32;
int i;
for (i = 0; i < 32; i++, addr += s->blocksize) {
bool block_is_ns;
if (!((oldlut ^ newlut) & (1 << i))) {
continue;
}
/* This changes the mappings for both the S and the NS space,
* so we need to do four notifies: an UNMAP then a MAP for each.
*/
block_is_ns = newlut & (1 << i);
trace_tz_mpc_iommu_notify(addr);
event.entry.iova = addr;
event.entry.translated_addr = addr;
event.type = IOMMU_NOTIFIER_UNMAP;
event.entry.perm = IOMMU_NONE;
memory_region_notify_iommu(&s->upstream, IOMMU_IDX_S, event);
memory_region_notify_iommu(&s->upstream, IOMMU_IDX_NS, event);
event.type = IOMMU_NOTIFIER_MAP;
event.entry.perm = IOMMU_RW;
if (block_is_ns) {
event.entry.target_as = &s->blocked_io_as;
} else {
event.entry.target_as = &s->downstream_as;
}
memory_region_notify_iommu(&s->upstream, IOMMU_IDX_S, event);
if (block_is_ns) {
event.entry.target_as = &s->downstream_as;
} else {
event.entry.target_as = &s->blocked_io_as;
}
memory_region_notify_iommu(&s->upstream, IOMMU_IDX_NS, event);
}
}
static void tz_mpc_autoinc_idx(TZMPC *s, unsigned access_size)
{
/* Auto-increment BLK_IDX if necessary */
if (access_size == 4 && (s->ctrl & R_CTRL_AUTOINC_MASK)) {
s->blk_idx++;
s->blk_idx %= s->blk_max;
}
}
static MemTxResult tz_mpc_reg_read(void *opaque, hwaddr addr,
uint64_t *pdata,
unsigned size, MemTxAttrs attrs)
{
TZMPC *s = TZ_MPC(opaque);
uint64_t r;
uint32_t offset = addr & ~0x3;
if (!attrs.secure && offset < A_PIDR4) {
/* NS accesses can only see the ID registers */
qemu_log_mask(LOG_GUEST_ERROR,
"TZ MPC register read: NS access to offset 0x%x\n",
offset);
r = 0;
goto read_out;
}
switch (offset) {
case A_CTRL:
r = s->ctrl;
break;
case A_BLK_MAX:
r = s->blk_max - 1;
break;
case A_BLK_CFG:
/* We are never in "init in progress state", so this just indicates
* the block size. s->blocksize == (1 << BLK_CFG + 5), so
* BLK_CFG == ctz32(s->blocksize) - 5
*/
r = ctz32(s->blocksize) - 5;
break;
case A_BLK_IDX:
r = s->blk_idx;
break;
case A_BLK_LUT:
r = s->blk_lut[s->blk_idx];
tz_mpc_autoinc_idx(s, size);
break;
case A_INT_STAT:
r = s->int_stat;
break;
case A_INT_EN:
r = s->int_en;
break;
case A_INT_INFO1:
r = s->int_info1;
break;
case A_INT_INFO2:
r = s->int_info2;
break;
case A_PIDR4:
case A_PIDR5:
case A_PIDR6:
case A_PIDR7:
case A_PIDR0:
case A_PIDR1:
case A_PIDR2:
case A_PIDR3:
case A_CIDR0:
case A_CIDR1:
case A_CIDR2:
case A_CIDR3:
r = tz_mpc_idregs[(offset - A_PIDR4) / 4];
break;
case A_INT_CLEAR:
case A_INT_SET:
qemu_log_mask(LOG_GUEST_ERROR,
"TZ MPC register read: write-only offset 0x%x\n",
offset);
r = 0;
break;
default:
qemu_log_mask(LOG_GUEST_ERROR,
"TZ MPC register read: bad offset 0x%x\n", offset);
r = 0;
break;
}
if (size != 4) {
/* None of our registers are read-sensitive (except BLK_LUT,
* which can special case the "size not 4" case), so just
* pull the right bytes out of the word read result.
*/
r = extract32(r, (addr & 3) * 8, size * 8);
}
read_out:
trace_tz_mpc_reg_read(addr, r, size);
*pdata = r;
return MEMTX_OK;
}
static MemTxResult tz_mpc_reg_write(void *opaque, hwaddr addr,
uint64_t value,
unsigned size, MemTxAttrs attrs)
{
TZMPC *s = TZ_MPC(opaque);
uint32_t offset = addr & ~0x3;
trace_tz_mpc_reg_write(addr, value, size);
if (!attrs.secure && offset < A_PIDR4) {
/* NS accesses can only see the ID registers */
qemu_log_mask(LOG_GUEST_ERROR,
"TZ MPC register write: NS access to offset 0x%x\n",
offset);
return MEMTX_OK;
}
if (size != 4) {
/* Expand the byte or halfword write to a full word size.
* In most cases we can do this with zeroes; the exceptions
* are CTRL, BLK_IDX and BLK_LUT.
*/
uint32_t oldval;
switch (offset) {
case A_CTRL:
oldval = s->ctrl;
break;
case A_BLK_IDX:
oldval = s->blk_idx;
break;
case A_BLK_LUT:
oldval = s->blk_lut[s->blk_idx];
break;
default:
oldval = 0;
break;
}
value = deposit32(oldval, (addr & 3) * 8, size * 8, value);
}
if ((s->ctrl & R_CTRL_LOCKDOWN_MASK) &&
(offset == A_CTRL || offset == A_BLK_LUT || offset == A_INT_EN)) {
/* Lockdown mode makes these three registers read-only, and
* the only way out of it is to reset the device.
*/
qemu_log_mask(LOG_GUEST_ERROR, "TZ MPC register write to offset 0x%x "
"while MPC is in lockdown mode\n", offset);
return MEMTX_OK;
}
switch (offset) {
case A_CTRL:
/* We don't implement the 'data gating' feature so all other bits
* are reserved and we make them RAZ/WI.
*/
s->ctrl = value & (R_CTRL_SEC_RESP_MASK |
R_CTRL_AUTOINC_MASK |
R_CTRL_LOCKDOWN_MASK);
break;
case A_BLK_IDX:
s->blk_idx = value % s->blk_max;
break;
case A_BLK_LUT:
tz_mpc_iommu_notify(s, s->blk_idx, s->blk_lut[s->blk_idx], value);
s->blk_lut[s->blk_idx] = value;
tz_mpc_autoinc_idx(s, size);
break;
case A_INT_CLEAR:
if (value & R_INT_CLEAR_IRQ_MASK) {
s->int_stat = 0;
tz_mpc_irq_update(s);
}
break;
case A_INT_EN:
s->int_en = value & R_INT_EN_IRQ_MASK;
tz_mpc_irq_update(s);
break;
case A_INT_SET:
if (value & R_INT_SET_IRQ_MASK) {
s->int_stat = R_INT_STAT_IRQ_MASK;
tz_mpc_irq_update(s);
}
break;
case A_PIDR4:
case A_PIDR5:
case A_PIDR6:
case A_PIDR7:
case A_PIDR0:
case A_PIDR1:
case A_PIDR2:
case A_PIDR3:
case A_CIDR0:
case A_CIDR1:
case A_CIDR2:
case A_CIDR3:
qemu_log_mask(LOG_GUEST_ERROR,
"TZ MPC register write: read-only offset 0x%x\n", offset);
break;
default:
qemu_log_mask(LOG_GUEST_ERROR,
"TZ MPC register write: bad offset 0x%x\n", offset);
break;
}
return MEMTX_OK;
}
static const MemoryRegionOps tz_mpc_reg_ops = {
.read_with_attrs = tz_mpc_reg_read,
.write_with_attrs = tz_mpc_reg_write,
.endianness = DEVICE_LITTLE_ENDIAN,
.valid.min_access_size = 1,
.valid.max_access_size = 4,
.impl.min_access_size = 1,
.impl.max_access_size = 4,
};
static inline bool tz_mpc_cfg_ns(TZMPC *s, hwaddr addr)
{
/* Return the cfg_ns bit from the LUT for the specified address */
hwaddr blknum = addr / s->blocksize;
hwaddr blkword = blknum / 32;
uint32_t blkbit = 1U << (blknum % 32);
/* This would imply the address was larger than the size we
* defined this memory region to be, so it can't happen.
*/
assert(blkword < s->blk_max);
return s->blk_lut[blkword] & blkbit;
}
static MemTxResult tz_mpc_handle_block(TZMPC *s, hwaddr addr, MemTxAttrs attrs)
{
/* Handle a blocked transaction: raise IRQ, capture info, etc */
if (!s->int_stat) {
/* First blocked transfer: capture information into INT_INFO1 and
* INT_INFO2. Subsequent transfers are still blocked but don't
* capture information until the guest clears the interrupt.
*/
s->int_info1 = addr;
s->int_info2 = 0;
s->int_info2 = FIELD_DP32(s->int_info2, INT_INFO2, HMASTER,
attrs.requester_id & 0xffff);
s->int_info2 = FIELD_DP32(s->int_info2, INT_INFO2, HNONSEC,
~attrs.secure);
s->int_info2 = FIELD_DP32(s->int_info2, INT_INFO2, CFG_NS,
tz_mpc_cfg_ns(s, addr));
s->int_stat |= R_INT_STAT_IRQ_MASK;
tz_mpc_irq_update(s);
}
/* Generate bus error if desired; otherwise RAZ/WI */
return (s->ctrl & R_CTRL_SEC_RESP_MASK) ? MEMTX_ERROR : MEMTX_OK;
}
/* Accesses only reach these read and write functions if the MPC is
* blocking them; non-blocked accesses go directly to the downstream
* memory region without passing through this code.
*/
static MemTxResult tz_mpc_mem_blocked_read(void *opaque, hwaddr addr,
uint64_t *pdata,
unsigned size, MemTxAttrs attrs)
{
TZMPC *s = TZ_MPC(opaque);
trace_tz_mpc_mem_blocked_read(addr, size, attrs.secure);
*pdata = 0;
return tz_mpc_handle_block(s, addr, attrs);
}
static MemTxResult tz_mpc_mem_blocked_write(void *opaque, hwaddr addr,
uint64_t value,
unsigned size, MemTxAttrs attrs)
{
TZMPC *s = TZ_MPC(opaque);
trace_tz_mpc_mem_blocked_write(addr, value, size, attrs.secure);
return tz_mpc_handle_block(s, addr, attrs);
}
static const MemoryRegionOps tz_mpc_mem_blocked_ops = {
.read_with_attrs = tz_mpc_mem_blocked_read,
.write_with_attrs = tz_mpc_mem_blocked_write,
.endianness = DEVICE_LITTLE_ENDIAN,
.valid.min_access_size = 1,
.valid.max_access_size = 8,
.impl.min_access_size = 1,
.impl.max_access_size = 8,
};
static IOMMUTLBEntry tz_mpc_translate(IOMMUMemoryRegion *iommu,
hwaddr addr, IOMMUAccessFlags flags,
int iommu_idx)
{
TZMPC *s = TZ_MPC(container_of(iommu, TZMPC, upstream));
bool ok;
IOMMUTLBEntry ret = {
.iova = addr & ~(s->blocksize - 1),
.translated_addr = addr & ~(s->blocksize - 1),
.addr_mask = s->blocksize - 1,
.perm = IOMMU_RW,
};
/* Look at the per-block configuration for this address, and
* return a TLB entry directing the transaction at either
* downstream_as or blocked_io_as, as appropriate.
* If the LUT cfg_ns bit is 1, only non-secure transactions
* may pass. If the bit is 0, only secure transactions may pass.
*/
ok = tz_mpc_cfg_ns(s, addr) == (iommu_idx == IOMMU_IDX_NS);
trace_tz_mpc_translate(addr, flags,
iommu_idx == IOMMU_IDX_S ? "S" : "NS",
ok ? "pass" : "block");
ret.target_as = ok ? &s->downstream_as : &s->blocked_io_as;
return ret;
}
static int tz_mpc_attrs_to_index(IOMMUMemoryRegion *iommu, MemTxAttrs attrs)
{
/* We treat unspecified attributes like secure. Transactions with
* unspecified attributes come from places like
* rom_reset() for initial image load, and we want
* those to pass through the from-reset "everything is secure" config.
* All the real during-emulation transactions from the CPU will
* specify attributes.
*/
return (attrs.unspecified || attrs.secure) ? IOMMU_IDX_S : IOMMU_IDX_NS;
}
static int tz_mpc_num_indexes(IOMMUMemoryRegion *iommu)
{
return IOMMU_NUM_INDEXES;
}
static void tz_mpc_reset(DeviceState *dev)
{
TZMPC *s = TZ_MPC(dev);
s->ctrl = 0x00000100;
s->blk_idx = 0;
s->int_stat = 0;
s->int_en = 1;
s->int_info1 = 0;
s->int_info2 = 0;
memset(s->blk_lut, 0, s->blk_max * sizeof(uint32_t));
}
static void tz_mpc_init(Object *obj)
{
DeviceState *dev = DEVICE(obj);
TZMPC *s = TZ_MPC(obj);
qdev_init_gpio_out_named(dev, &s->irq, "irq", 1);
}
static void tz_mpc_realize(DeviceState *dev, Error **errp)
{
Object *obj = OBJECT(dev);
SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
TZMPC *s = TZ_MPC(dev);
uint64_t size;
/* We can't create the upstream end of the port until realize,
* as we don't know the size of the MR used as the downstream until then.
* We insist on having a downstream, to avoid complicating the code
* with handling the "don't know how big this is" case. It's easy
* enough for the user to create an unimplemented_device as downstream
* if they have nothing else to plug into this.
*/
if (!s->downstream) {
error_setg(errp, "MPC 'downstream' link not set");
return;
}
size = memory_region_size(s->downstream);
memory_region_init_iommu(&s->upstream, sizeof(s->upstream),
TYPE_TZ_MPC_IOMMU_MEMORY_REGION,
obj, "tz-mpc-upstream", size);
/* In real hardware the block size is configurable. In QEMU we could
* make it configurable but will need it to be at least as big as the
* target page size so we can execute out of the resulting MRs. Guest
* software is supposed to check the block size using the BLK_CFG
* register, so make it fixed at the page size.
*/
s->blocksize = memory_region_iommu_get_min_page_size(&s->upstream);
if (size % s->blocksize != 0) {
error_setg(errp,
"MPC 'downstream' size %" PRId64
" is not a multiple of %" HWADDR_PRIx " bytes",
size, s->blocksize);
object_unref(OBJECT(&s->upstream));
return;
}
/* BLK_MAX is the max value of BLK_IDX, which indexes an array of 32-bit
* words, each bit of which indicates one block.
*/
s->blk_max = DIV_ROUND_UP(size / s->blocksize, 32);
memory_region_init_io(&s->regmr, obj, &tz_mpc_reg_ops,
s, "tz-mpc-regs", 0x1000);
sysbus_init_mmio(sbd, &s->regmr);
sysbus_init_mmio(sbd, MEMORY_REGION(&s->upstream));
/* This memory region is not exposed to users of this device as a
* sysbus MMIO region, but is instead used internally as something
* that our IOMMU translate function might direct accesses to.
*/
memory_region_init_io(&s->blocked_io, obj, &tz_mpc_mem_blocked_ops,
s, "tz-mpc-blocked-io", size);
address_space_init(&s->downstream_as, s->downstream,
"tz-mpc-downstream");
address_space_init(&s->blocked_io_as, &s->blocked_io,
"tz-mpc-blocked-io");
s->blk_lut = g_new0(uint32_t, s->blk_max);
}
static int tz_mpc_post_load(void *opaque, int version_id)
{
TZMPC *s = TZ_MPC(opaque);
/* Check the incoming data doesn't point blk_idx off the end of blk_lut. */
if (s->blk_idx >= s->blk_max) {
return -1;
}
return 0;
}
static const VMStateDescription tz_mpc_vmstate = {
.name = "tz-mpc",
.version_id = 1,
.minimum_version_id = 1,
.post_load = tz_mpc_post_load,
.fields = (const VMStateField[]) {
VMSTATE_UINT32(ctrl, TZMPC),
VMSTATE_UINT32(blk_idx, TZMPC),
VMSTATE_UINT32(int_stat, TZMPC),
VMSTATE_UINT32(int_en, TZMPC),
VMSTATE_UINT32(int_info1, TZMPC),
VMSTATE_UINT32(int_info2, TZMPC),
VMSTATE_VARRAY_UINT32(blk_lut, TZMPC, blk_max,
0, vmstate_info_uint32, uint32_t),
VMSTATE_END_OF_LIST()
}
};
static const Property tz_mpc_properties[] = {
DEFINE_PROP_LINK("downstream", TZMPC, downstream,
TYPE_MEMORY_REGION, MemoryRegion *),
DEFINE_PROP_END_OF_LIST(),
};
static void tz_mpc_class_init(ObjectClass *klass, void *data)
{
DeviceClass *dc = DEVICE_CLASS(klass);
dc->realize = tz_mpc_realize;
dc->vmsd = &tz_mpc_vmstate;
device_class_set_legacy_reset(dc, tz_mpc_reset);
device_class_set_props(dc, tz_mpc_properties);
}
static const TypeInfo tz_mpc_info = {
.name = TYPE_TZ_MPC,
.parent = TYPE_SYS_BUS_DEVICE,
.instance_size = sizeof(TZMPC),
.instance_init = tz_mpc_init,
.class_init = tz_mpc_class_init,
};
static void tz_mpc_iommu_memory_region_class_init(ObjectClass *klass,
void *data)
{
IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
imrc->translate = tz_mpc_translate;
imrc->attrs_to_index = tz_mpc_attrs_to_index;
imrc->num_indexes = tz_mpc_num_indexes;
}
static const TypeInfo tz_mpc_iommu_memory_region_info = {
.name = TYPE_TZ_MPC_IOMMU_MEMORY_REGION,
.parent = TYPE_IOMMU_MEMORY_REGION,
.class_init = tz_mpc_iommu_memory_region_class_init,
};
static void tz_mpc_register_types(void)
{
type_register_static(&tz_mpc_info);
type_register_static(&tz_mpc_iommu_memory_region_info);
}
type_init(tz_mpc_register_types);
|