| 1 | /* |
| 2 | * ARM TrustZone peripheral protection controller emulation |
| 3 | * |
| 4 | * Copyright (c) 2018 Linaro Limited |
| 5 | * Written by Peter Maydell |
| 6 | * |
| 7 | * This program is free software; you can redistribute it and/or modify |
| 8 | * it under the terms of the GNU General Public License version 2 or |
| 9 | * (at your option) any later version. |
| 10 | */ |
| 11 | |
| 12 | /* This is a model of the TrustZone peripheral protection controller (PPC). |
| 13 | * It is documented in the ARM CoreLink SIE-200 System IP for Embedded TRM |
| 14 | * (DDI 0571G): |
| 15 | * https://developer.arm.com/products/architecture/m-profile/docs/ddi0571/g |
| 16 | * |
| 17 | * The PPC sits in front of peripherals and allows secure software to |
| 18 | * configure it to either pass through or reject transactions. |
| 19 | * Rejected transactions may be configured to either be aborted, or to |
| 20 | * behave as RAZ/WI. An interrupt can be signalled for a rejected transaction. |
| 21 | * |
| 22 | * The PPC has no register interface -- it is configured purely by a |
| 23 | * collection of input signals from other hardware in the system. Typically |
| 24 | * they are either hardwired or exposed in an ad-hoc register interface by |
| 25 | * the SoC that uses the PPC. |
| 26 | * |
| 27 | * This QEMU model can be used to model either the AHB5 or APB4 TZ PPC, |
| 28 | * since the only difference between them is that the AHB version has a |
| 29 | * "default" port which has no security checks applied. In QEMU the default |
| 30 | * port can be emulated simply by wiring its downstream devices directly |
| 31 | * into the parent address space, since the PPC does not need to intercept |
| 32 | * transactions there. |
| 33 | * |
| 34 | * In the hardware, selection of which downstream port to use is done by |
| 35 | * the user's decode logic asserting one of the hsel[] signals. In QEMU, |
| 36 | * we provide 16 MMIO regions, one per port, and the user maps these into |
| 37 | * the desired addresses to implement the address decode. |
| 38 | * |
| 39 | * QEMU interface: |
| 40 | * + sysbus MMIO regions 0..15: MemoryRegions defining the upstream end |
| 41 | * of each of the 16 ports of the PPC. When a port is unused (i.e. no |
| 42 | * downstream MemoryRegion is connected to it) at the end of the 0..15 |
| 43 | * range then no sysbus MMIO region is created for its upstream. When an |
| 44 | * unused port lies in the middle of the range with other used ports at |
| 45 | * higher port numbers, a dummy MMIO region is created to ensure that |
| 46 | * port N's upstream is always sysbus MMIO region N. Dummy regions should |
| 47 | * not be mapped, and will assert if any access is made to them. |
| 48 | * + Property "port[0..15]": MemoryRegion defining the downstream device(s) |
| 49 | * for each of the 16 ports of the PPC |
| 50 | * + Named GPIO inputs "cfg_nonsec[0..15]": set to 1 if the port should be |
| 51 | * accessible to NonSecure transactions |
| 52 | * + Named GPIO inputs "cfg_ap[0..15]": set to 1 if the port should be |
| 53 | * accessible to non-privileged transactions |
| 54 | * + Named GPIO input "cfg_sec_resp": set to 1 if a rejected transaction should |
| 55 | * result in a transaction error, or 0 for the transaction to RAZ/WI |
| 56 | * + Named GPIO input "irq_enable": set to 1 to enable interrupts |
| 57 | * + Named GPIO input "irq_clear": set to 1 to clear a pending interrupt |
| 58 | * + Named GPIO output "irq": set for a transaction-failed interrupt |
| 59 | * + Property "NONSEC_MASK": if a bit is set in this mask then accesses to |
| 60 | * the associated port do not have the TZ security check performed. (This |
| 61 | * corresponds to the hardware allowing this to be set as a Verilog |
| 62 | * parameter.) |
| 63 | */ |
| 64 | |
| 65 | #ifndef TZ_PPC_H |
| 66 | #define TZ_PPC_H |
| 67 | |
| 68 | #include "hw/core/sysbus.h" |
| 69 | #include "qom/object.h" |
| 70 | |
| 71 | #define TYPE_TZ_PPC "tz-ppc" |
| 72 | OBJECT_DECLARE_SIMPLE_TYPE(TZPPC, TZ_PPC) |
| 73 | |
| 74 | #define TZ_NUM_PORTS 16 |
| 75 | |
| 76 | |
| 77 | typedef struct TZPPCPort { |
| 78 | TZPPC *ppc; |
| 79 | MemoryRegion upstream; |
| 80 | AddressSpace downstream_as; |
| 81 | MemoryRegion *downstream; |
| 82 | } TZPPCPort; |
| 83 | |
| 84 | struct TZPPC { |
| 85 | /*< private >*/ |
| 86 | SysBusDevice parent_obj; |
| 87 | |
| 88 | /*< public >*/ |
| 89 | |
| 90 | /* State: these just track the values of our input signals */ |
| 91 | bool cfg_nonsec[TZ_NUM_PORTS]; |
| 92 | bool cfg_ap[TZ_NUM_PORTS]; |
| 93 | bool cfg_sec_resp; |
| 94 | bool irq_enable; |
| 95 | bool irq_clear; |
| 96 | /* State: are we asserting irq ? */ |
| 97 | bool irq_status; |
| 98 | |
| 99 | qemu_irq irq; |
| 100 | |
| 101 | /* Properties */ |
| 102 | uint32_t nonsec_mask; |
| 103 | |
| 104 | TZPPCPort port[TZ_NUM_PORTS]; |
| 105 | }; |
| 106 | |
| 107 | #endif |