Merge tag 'pull-hex-20221003' of https://github.com/quic/qemu into staging
[qemu.git] / hw / misc / tz-mpc.c
1 /*
2 * ARM AHB5 TrustZone Memory Protection Controller emulation
3 *
4 * Copyright (c) 2018 Linaro Limited
5 * Written by Peter Maydell
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 or
9 * (at your option) any later version.
10 */
11
12 #include "qemu/osdep.h"
13 #include "qemu/log.h"
14 #include "qemu/module.h"
15 #include "qapi/error.h"
16 #include "trace.h"
17 #include "hw/sysbus.h"
18 #include "migration/vmstate.h"
19 #include "hw/registerfields.h"
20 #include "hw/irq.h"
21 #include "hw/misc/tz-mpc.h"
22 #include "hw/qdev-properties.h"
23
24 /* Our IOMMU has two IOMMU indexes, one for secure transactions and one for
25 * non-secure transactions.
26 */
27 enum {
28 IOMMU_IDX_S,
29 IOMMU_IDX_NS,
30 IOMMU_NUM_INDEXES,
31 };
32
33 /* Config registers */
34 REG32(CTRL, 0x00)
35 FIELD(CTRL, SEC_RESP, 4, 1)
36 FIELD(CTRL, AUTOINC, 8, 1)
37 FIELD(CTRL, LOCKDOWN, 31, 1)
38 REG32(BLK_MAX, 0x10)
39 REG32(BLK_CFG, 0x14)
40 REG32(BLK_IDX, 0x18)
41 REG32(BLK_LUT, 0x1c)
42 REG32(INT_STAT, 0x20)
43 FIELD(INT_STAT, IRQ, 0, 1)
44 REG32(INT_CLEAR, 0x24)
45 FIELD(INT_CLEAR, IRQ, 0, 1)
46 REG32(INT_EN, 0x28)
47 FIELD(INT_EN, IRQ, 0, 1)
48 REG32(INT_INFO1, 0x2c)
49 REG32(INT_INFO2, 0x30)
50 FIELD(INT_INFO2, HMASTER, 0, 16)
51 FIELD(INT_INFO2, HNONSEC, 16, 1)
52 FIELD(INT_INFO2, CFG_NS, 17, 1)
53 REG32(INT_SET, 0x34)
54 FIELD(INT_SET, IRQ, 0, 1)
55 REG32(PIDR4, 0xfd0)
56 REG32(PIDR5, 0xfd4)
57 REG32(PIDR6, 0xfd8)
58 REG32(PIDR7, 0xfdc)
59 REG32(PIDR0, 0xfe0)
60 REG32(PIDR1, 0xfe4)
61 REG32(PIDR2, 0xfe8)
62 REG32(PIDR3, 0xfec)
63 REG32(CIDR0, 0xff0)
64 REG32(CIDR1, 0xff4)
65 REG32(CIDR2, 0xff8)
66 REG32(CIDR3, 0xffc)
67
68 static const uint8_t tz_mpc_idregs[] = {
69 0x04, 0x00, 0x00, 0x00,
70 0x60, 0xb8, 0x1b, 0x00,
71 0x0d, 0xf0, 0x05, 0xb1,
72 };
73
74 static void tz_mpc_irq_update(TZMPC *s)
75 {
76 qemu_set_irq(s->irq, s->int_stat && s->int_en);
77 }
78
79 static void tz_mpc_iommu_notify(TZMPC *s, uint32_t lutidx,
80 uint32_t oldlut, uint32_t newlut)
81 {
82 /* Called when the LUT word at lutidx has changed from oldlut to newlut;
83 * must call the IOMMU notifiers for the changed blocks.
84 */
85 IOMMUTLBEvent event = {
86 .entry = {
87 .addr_mask = s->blocksize - 1,
88 }
89 };
90 hwaddr addr = lutidx * s->blocksize * 32;
91 int i;
92
93 for (i = 0; i < 32; i++, addr += s->blocksize) {
94 bool block_is_ns;
95
96 if (!((oldlut ^ newlut) & (1 << i))) {
97 continue;
98 }
99 /* This changes the mappings for both the S and the NS space,
100 * so we need to do four notifies: an UNMAP then a MAP for each.
101 */
102 block_is_ns = newlut & (1 << i);
103
104 trace_tz_mpc_iommu_notify(addr);
105 event.entry.iova = addr;
106 event.entry.translated_addr = addr;
107
108 event.type = IOMMU_NOTIFIER_UNMAP;
109 event.entry.perm = IOMMU_NONE;
110 memory_region_notify_iommu(&s->upstream, IOMMU_IDX_S, event);
111 memory_region_notify_iommu(&s->upstream, IOMMU_IDX_NS, event);
112
113 event.type = IOMMU_NOTIFIER_MAP;
114 event.entry.perm = IOMMU_RW;
115 if (block_is_ns) {
116 event.entry.target_as = &s->blocked_io_as;
117 } else {
118 event.entry.target_as = &s->downstream_as;
119 }
120 memory_region_notify_iommu(&s->upstream, IOMMU_IDX_S, event);
121 if (block_is_ns) {
122 event.entry.target_as = &s->downstream_as;
123 } else {
124 event.entry.target_as = &s->blocked_io_as;
125 }
126 memory_region_notify_iommu(&s->upstream, IOMMU_IDX_NS, event);
127 }
128 }
129
130 static void tz_mpc_autoinc_idx(TZMPC *s, unsigned access_size)
131 {
132 /* Auto-increment BLK_IDX if necessary */
133 if (access_size == 4 && (s->ctrl & R_CTRL_AUTOINC_MASK)) {
134 s->blk_idx++;
135 s->blk_idx %= s->blk_max;
136 }
137 }
138
139 static MemTxResult tz_mpc_reg_read(void *opaque, hwaddr addr,
140 uint64_t *pdata,
141 unsigned size, MemTxAttrs attrs)
142 {
143 TZMPC *s = TZ_MPC(opaque);
144 uint64_t r;
145 uint32_t offset = addr & ~0x3;
146
147 if (!attrs.secure && offset < A_PIDR4) {
148 /* NS accesses can only see the ID registers */
149 qemu_log_mask(LOG_GUEST_ERROR,
150 "TZ MPC register read: NS access to offset 0x%x\n",
151 offset);
152 r = 0;
153 goto read_out;
154 }
155
156 switch (offset) {
157 case A_CTRL:
158 r = s->ctrl;
159 break;
160 case A_BLK_MAX:
161 r = s->blk_max - 1;
162 break;
163 case A_BLK_CFG:
164 /* We are never in "init in progress state", so this just indicates
165 * the block size. s->blocksize == (1 << BLK_CFG + 5), so
166 * BLK_CFG == ctz32(s->blocksize) - 5
167 */
168 r = ctz32(s->blocksize) - 5;
169 break;
170 case A_BLK_IDX:
171 r = s->blk_idx;
172 break;
173 case A_BLK_LUT:
174 r = s->blk_lut[s->blk_idx];
175 tz_mpc_autoinc_idx(s, size);
176 break;
177 case A_INT_STAT:
178 r = s->int_stat;
179 break;
180 case A_INT_EN:
181 r = s->int_en;
182 break;
183 case A_INT_INFO1:
184 r = s->int_info1;
185 break;
186 case A_INT_INFO2:
187 r = s->int_info2;
188 break;
189 case A_PIDR4:
190 case A_PIDR5:
191 case A_PIDR6:
192 case A_PIDR7:
193 case A_PIDR0:
194 case A_PIDR1:
195 case A_PIDR2:
196 case A_PIDR3:
197 case A_CIDR0:
198 case A_CIDR1:
199 case A_CIDR2:
200 case A_CIDR3:
201 r = tz_mpc_idregs[(offset - A_PIDR4) / 4];
202 break;
203 case A_INT_CLEAR:
204 case A_INT_SET:
205 qemu_log_mask(LOG_GUEST_ERROR,
206 "TZ MPC register read: write-only offset 0x%x\n",
207 offset);
208 r = 0;
209 break;
210 default:
211 qemu_log_mask(LOG_GUEST_ERROR,
212 "TZ MPC register read: bad offset 0x%x\n", offset);
213 r = 0;
214 break;
215 }
216
217 if (size != 4) {
218 /* None of our registers are read-sensitive (except BLK_LUT,
219 * which can special case the "size not 4" case), so just
220 * pull the right bytes out of the word read result.
221 */
222 r = extract32(r, (addr & 3) * 8, size * 8);
223 }
224
225 read_out:
226 trace_tz_mpc_reg_read(addr, r, size);
227 *pdata = r;
228 return MEMTX_OK;
229 }
230
231 static MemTxResult tz_mpc_reg_write(void *opaque, hwaddr addr,
232 uint64_t value,
233 unsigned size, MemTxAttrs attrs)
234 {
235 TZMPC *s = TZ_MPC(opaque);
236 uint32_t offset = addr & ~0x3;
237
238 trace_tz_mpc_reg_write(addr, value, size);
239
240 if (!attrs.secure && offset < A_PIDR4) {
241 /* NS accesses can only see the ID registers */
242 qemu_log_mask(LOG_GUEST_ERROR,
243 "TZ MPC register write: NS access to offset 0x%x\n",
244 offset);
245 return MEMTX_OK;
246 }
247
248 if (size != 4) {
249 /* Expand the byte or halfword write to a full word size.
250 * In most cases we can do this with zeroes; the exceptions
251 * are CTRL, BLK_IDX and BLK_LUT.
252 */
253 uint32_t oldval;
254
255 switch (offset) {
256 case A_CTRL:
257 oldval = s->ctrl;
258 break;
259 case A_BLK_IDX:
260 oldval = s->blk_idx;
261 break;
262 case A_BLK_LUT:
263 oldval = s->blk_lut[s->blk_idx];
264 break;
265 default:
266 oldval = 0;
267 break;
268 }
269 value = deposit32(oldval, (addr & 3) * 8, size * 8, value);
270 }
271
272 if ((s->ctrl & R_CTRL_LOCKDOWN_MASK) &&
273 (offset == A_CTRL || offset == A_BLK_LUT || offset == A_INT_EN)) {
274 /* Lockdown mode makes these three registers read-only, and
275 * the only way out of it is to reset the device.
276 */
277 qemu_log_mask(LOG_GUEST_ERROR, "TZ MPC register write to offset 0x%x "
278 "while MPC is in lockdown mode\n", offset);
279 return MEMTX_OK;
280 }
281
282 switch (offset) {
283 case A_CTRL:
284 /* We don't implement the 'data gating' feature so all other bits
285 * are reserved and we make them RAZ/WI.
286 */
287 s->ctrl = value & (R_CTRL_SEC_RESP_MASK |
288 R_CTRL_AUTOINC_MASK |
289 R_CTRL_LOCKDOWN_MASK);
290 break;
291 case A_BLK_IDX:
292 s->blk_idx = value % s->blk_max;
293 break;
294 case A_BLK_LUT:
295 tz_mpc_iommu_notify(s, s->blk_idx, s->blk_lut[s->blk_idx], value);
296 s->blk_lut[s->blk_idx] = value;
297 tz_mpc_autoinc_idx(s, size);
298 break;
299 case A_INT_CLEAR:
300 if (value & R_INT_CLEAR_IRQ_MASK) {
301 s->int_stat = 0;
302 tz_mpc_irq_update(s);
303 }
304 break;
305 case A_INT_EN:
306 s->int_en = value & R_INT_EN_IRQ_MASK;
307 tz_mpc_irq_update(s);
308 break;
309 case A_INT_SET:
310 if (value & R_INT_SET_IRQ_MASK) {
311 s->int_stat = R_INT_STAT_IRQ_MASK;
312 tz_mpc_irq_update(s);
313 }
314 break;
315 case A_PIDR4:
316 case A_PIDR5:
317 case A_PIDR6:
318 case A_PIDR7:
319 case A_PIDR0:
320 case A_PIDR1:
321 case A_PIDR2:
322 case A_PIDR3:
323 case A_CIDR0:
324 case A_CIDR1:
325 case A_CIDR2:
326 case A_CIDR3:
327 qemu_log_mask(LOG_GUEST_ERROR,
328 "TZ MPC register write: read-only offset 0x%x\n", offset);
329 break;
330 default:
331 qemu_log_mask(LOG_GUEST_ERROR,
332 "TZ MPC register write: bad offset 0x%x\n", offset);
333 break;
334 }
335
336 return MEMTX_OK;
337 }
338
339 static const MemoryRegionOps tz_mpc_reg_ops = {
340 .read_with_attrs = tz_mpc_reg_read,
341 .write_with_attrs = tz_mpc_reg_write,
342 .endianness = DEVICE_LITTLE_ENDIAN,
343 .valid.min_access_size = 1,
344 .valid.max_access_size = 4,
345 .impl.min_access_size = 1,
346 .impl.max_access_size = 4,
347 };
348
349 static inline bool tz_mpc_cfg_ns(TZMPC *s, hwaddr addr)
350 {
351 /* Return the cfg_ns bit from the LUT for the specified address */
352 hwaddr blknum = addr / s->blocksize;
353 hwaddr blkword = blknum / 32;
354 uint32_t blkbit = 1U << (blknum % 32);
355
356 /* This would imply the address was larger than the size we
357 * defined this memory region to be, so it can't happen.
358 */
359 assert(blkword < s->blk_max);
360 return s->blk_lut[blkword] & blkbit;
361 }
362
363 static MemTxResult tz_mpc_handle_block(TZMPC *s, hwaddr addr, MemTxAttrs attrs)
364 {
365 /* Handle a blocked transaction: raise IRQ, capture info, etc */
366 if (!s->int_stat) {
367 /* First blocked transfer: capture information into INT_INFO1 and
368 * INT_INFO2. Subsequent transfers are still blocked but don't
369 * capture information until the guest clears the interrupt.
370 */
371
372 s->int_info1 = addr;
373 s->int_info2 = 0;
374 s->int_info2 = FIELD_DP32(s->int_info2, INT_INFO2, HMASTER,
375 attrs.requester_id & 0xffff);
376 s->int_info2 = FIELD_DP32(s->int_info2, INT_INFO2, HNONSEC,
377 ~attrs.secure);
378 s->int_info2 = FIELD_DP32(s->int_info2, INT_INFO2, CFG_NS,
379 tz_mpc_cfg_ns(s, addr));
380 s->int_stat |= R_INT_STAT_IRQ_MASK;
381 tz_mpc_irq_update(s);
382 }
383
384 /* Generate bus error if desired; otherwise RAZ/WI */
385 return (s->ctrl & R_CTRL_SEC_RESP_MASK) ? MEMTX_ERROR : MEMTX_OK;
386 }
387
388 /* Accesses only reach these read and write functions if the MPC is
389 * blocking them; non-blocked accesses go directly to the downstream
390 * memory region without passing through this code.
391 */
392 static MemTxResult tz_mpc_mem_blocked_read(void *opaque, hwaddr addr,
393 uint64_t *pdata,
394 unsigned size, MemTxAttrs attrs)
395 {
396 TZMPC *s = TZ_MPC(opaque);
397
398 trace_tz_mpc_mem_blocked_read(addr, size, attrs.secure);
399
400 *pdata = 0;
401 return tz_mpc_handle_block(s, addr, attrs);
402 }
403
404 static MemTxResult tz_mpc_mem_blocked_write(void *opaque, hwaddr addr,
405 uint64_t value,
406 unsigned size, MemTxAttrs attrs)
407 {
408 TZMPC *s = TZ_MPC(opaque);
409
410 trace_tz_mpc_mem_blocked_write(addr, value, size, attrs.secure);
411
412 return tz_mpc_handle_block(s, addr, attrs);
413 }
414
415 static const MemoryRegionOps tz_mpc_mem_blocked_ops = {
416 .read_with_attrs = tz_mpc_mem_blocked_read,
417 .write_with_attrs = tz_mpc_mem_blocked_write,
418 .endianness = DEVICE_LITTLE_ENDIAN,
419 .valid.min_access_size = 1,
420 .valid.max_access_size = 8,
421 .impl.min_access_size = 1,
422 .impl.max_access_size = 8,
423 };
424
425 static IOMMUTLBEntry tz_mpc_translate(IOMMUMemoryRegion *iommu,
426 hwaddr addr, IOMMUAccessFlags flags,
427 int iommu_idx)
428 {
429 TZMPC *s = TZ_MPC(container_of(iommu, TZMPC, upstream));
430 bool ok;
431
432 IOMMUTLBEntry ret = {
433 .iova = addr & ~(s->blocksize - 1),
434 .translated_addr = addr & ~(s->blocksize - 1),
435 .addr_mask = s->blocksize - 1,
436 .perm = IOMMU_RW,
437 };
438
439 /* Look at the per-block configuration for this address, and
440 * return a TLB entry directing the transaction at either
441 * downstream_as or blocked_io_as, as appropriate.
442 * If the LUT cfg_ns bit is 1, only non-secure transactions
443 * may pass. If the bit is 0, only secure transactions may pass.
444 */
445 ok = tz_mpc_cfg_ns(s, addr) == (iommu_idx == IOMMU_IDX_NS);
446
447 trace_tz_mpc_translate(addr, flags,
448 iommu_idx == IOMMU_IDX_S ? "S" : "NS",
449 ok ? "pass" : "block");
450
451 ret.target_as = ok ? &s->downstream_as : &s->blocked_io_as;
452 return ret;
453 }
454
455 static int tz_mpc_attrs_to_index(IOMMUMemoryRegion *iommu, MemTxAttrs attrs)
456 {
457 /* We treat unspecified attributes like secure. Transactions with
458 * unspecified attributes come from places like
459 * rom_reset() for initial image load, and we want
460 * those to pass through the from-reset "everything is secure" config.
461 * All the real during-emulation transactions from the CPU will
462 * specify attributes.
463 */
464 return (attrs.unspecified || attrs.secure) ? IOMMU_IDX_S : IOMMU_IDX_NS;
465 }
466
467 static int tz_mpc_num_indexes(IOMMUMemoryRegion *iommu)
468 {
469 return IOMMU_NUM_INDEXES;
470 }
471
472 static void tz_mpc_reset(DeviceState *dev)
473 {
474 TZMPC *s = TZ_MPC(dev);
475
476 s->ctrl = 0x00000100;
477 s->blk_idx = 0;
478 s->int_stat = 0;
479 s->int_en = 1;
480 s->int_info1 = 0;
481 s->int_info2 = 0;
482
483 memset(s->blk_lut, 0, s->blk_max * sizeof(uint32_t));
484 }
485
486 static void tz_mpc_init(Object *obj)
487 {
488 DeviceState *dev = DEVICE(obj);
489 TZMPC *s = TZ_MPC(obj);
490
491 qdev_init_gpio_out_named(dev, &s->irq, "irq", 1);
492 }
493
494 static void tz_mpc_realize(DeviceState *dev, Error **errp)
495 {
496 Object *obj = OBJECT(dev);
497 SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
498 TZMPC *s = TZ_MPC(dev);
499 uint64_t size;
500
501 /* We can't create the upstream end of the port until realize,
502 * as we don't know the size of the MR used as the downstream until then.
503 * We insist on having a downstream, to avoid complicating the code
504 * with handling the "don't know how big this is" case. It's easy
505 * enough for the user to create an unimplemented_device as downstream
506 * if they have nothing else to plug into this.
507 */
508 if (!s->downstream) {
509 error_setg(errp, "MPC 'downstream' link not set");
510 return;
511 }
512
513 size = memory_region_size(s->downstream);
514
515 memory_region_init_iommu(&s->upstream, sizeof(s->upstream),
516 TYPE_TZ_MPC_IOMMU_MEMORY_REGION,
517 obj, "tz-mpc-upstream", size);
518
519 /* In real hardware the block size is configurable. In QEMU we could
520 * make it configurable but will need it to be at least as big as the
521 * target page size so we can execute out of the resulting MRs. Guest
522 * software is supposed to check the block size using the BLK_CFG
523 * register, so make it fixed at the page size.
524 */
525 s->blocksize = memory_region_iommu_get_min_page_size(&s->upstream);
526 if (size % s->blocksize != 0) {
527 error_setg(errp,
528 "MPC 'downstream' size %" PRId64
529 " is not a multiple of %" HWADDR_PRIx " bytes",
530 size, s->blocksize);
531 object_unref(OBJECT(&s->upstream));
532 return;
533 }
534
535 /* BLK_MAX is the max value of BLK_IDX, which indexes an array of 32-bit
536 * words, each bit of which indicates one block.
537 */
538 s->blk_max = DIV_ROUND_UP(size / s->blocksize, 32);
539
540 memory_region_init_io(&s->regmr, obj, &tz_mpc_reg_ops,
541 s, "tz-mpc-regs", 0x1000);
542 sysbus_init_mmio(sbd, &s->regmr);
543
544 sysbus_init_mmio(sbd, MEMORY_REGION(&s->upstream));
545
546 /* This memory region is not exposed to users of this device as a
547 * sysbus MMIO region, but is instead used internally as something
548 * that our IOMMU translate function might direct accesses to.
549 */
550 memory_region_init_io(&s->blocked_io, obj, &tz_mpc_mem_blocked_ops,
551 s, "tz-mpc-blocked-io", size);
552
553 address_space_init(&s->downstream_as, s->downstream,
554 "tz-mpc-downstream");
555 address_space_init(&s->blocked_io_as, &s->blocked_io,
556 "tz-mpc-blocked-io");
557
558 s->blk_lut = g_new0(uint32_t, s->blk_max);
559 }
560
561 static int tz_mpc_post_load(void *opaque, int version_id)
562 {
563 TZMPC *s = TZ_MPC(opaque);
564
565 /* Check the incoming data doesn't point blk_idx off the end of blk_lut. */
566 if (s->blk_idx >= s->blk_max) {
567 return -1;
568 }
569 return 0;
570 }
571
572 static const VMStateDescription tz_mpc_vmstate = {
573 .name = "tz-mpc",
574 .version_id = 1,
575 .minimum_version_id = 1,
576 .post_load = tz_mpc_post_load,
577 .fields = (VMStateField[]) {
578 VMSTATE_UINT32(ctrl, TZMPC),
579 VMSTATE_UINT32(blk_idx, TZMPC),
580 VMSTATE_UINT32(int_stat, TZMPC),
581 VMSTATE_UINT32(int_en, TZMPC),
582 VMSTATE_UINT32(int_info1, TZMPC),
583 VMSTATE_UINT32(int_info2, TZMPC),
584 VMSTATE_VARRAY_UINT32(blk_lut, TZMPC, blk_max,
585 0, vmstate_info_uint32, uint32_t),
586 VMSTATE_END_OF_LIST()
587 }
588 };
589
590 static Property tz_mpc_properties[] = {
591 DEFINE_PROP_LINK("downstream", TZMPC, downstream,
592 TYPE_MEMORY_REGION, MemoryRegion *),
593 DEFINE_PROP_END_OF_LIST(),
594 };
595
596 static void tz_mpc_class_init(ObjectClass *klass, void *data)
597 {
598 DeviceClass *dc = DEVICE_CLASS(klass);
599
600 dc->realize = tz_mpc_realize;
601 dc->vmsd = &tz_mpc_vmstate;
602 dc->reset = tz_mpc_reset;
603 device_class_set_props(dc, tz_mpc_properties);
604 }
605
606 static const TypeInfo tz_mpc_info = {
607 .name = TYPE_TZ_MPC,
608 .parent = TYPE_SYS_BUS_DEVICE,
609 .instance_size = sizeof(TZMPC),
610 .instance_init = tz_mpc_init,
611 .class_init = tz_mpc_class_init,
612 };
613
614 static void tz_mpc_iommu_memory_region_class_init(ObjectClass *klass,
615 void *data)
616 {
617 IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
618
619 imrc->translate = tz_mpc_translate;
620 imrc->attrs_to_index = tz_mpc_attrs_to_index;
621 imrc->num_indexes = tz_mpc_num_indexes;
622 }
623
624 static const TypeInfo tz_mpc_iommu_memory_region_info = {
625 .name = TYPE_TZ_MPC_IOMMU_MEMORY_REGION,
626 .parent = TYPE_IOMMU_MEMORY_REGION,
627 .class_init = tz_mpc_iommu_memory_region_class_init,
628 };
629
630 static void tz_mpc_register_types(void)
631 {
632 type_register_static(&tz_mpc_info);
633 type_register_static(&tz_mpc_iommu_memory_region_info);
634 }
635
636 type_init(tz_mpc_register_types);