9eb8040c2d
Add a model of the TrustZone peripheral protection controller (PPC), which is used to gate transactions to non-TZ-aware peripherals so that secure software can configure them to not be accessible to non-secure software. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180220180325.29818-15-peter.maydell@linaro.org
102 lines
3.6 KiB
C
102 lines
3.6 KiB
C
/*
|
|
* ARM TrustZone peripheral protection controller emulation
|
|
*
|
|
* Copyright (c) 2018 Linaro Limited
|
|
* Written by Peter Maydell
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 or
|
|
* (at your option) any later version.
|
|
*/
|
|
|
|
/* This is a model of the TrustZone peripheral protection controller (PPC).
|
|
* It is documented in the ARM CoreLink SIE-200 System IP for Embedded TRM
|
|
* (DDI 0571G):
|
|
* https://developer.arm.com/products/architecture/m-profile/docs/ddi0571/g
|
|
*
|
|
* The PPC sits in front of peripherals and allows secure software to
|
|
* configure it to either pass through or reject transactions.
|
|
* Rejected transactions may be configured to either be aborted, or to
|
|
* behave as RAZ/WI. An interrupt can be signalled for a rejected transaction.
|
|
*
|
|
* The PPC has no register interface -- it is configured purely by a
|
|
* collection of input signals from other hardware in the system. Typically
|
|
* they are either hardwired or exposed in an ad-hoc register interface by
|
|
* the SoC that uses the PPC.
|
|
*
|
|
* This QEMU model can be used to model either the AHB5 or APB4 TZ PPC,
|
|
* since the only difference between them is that the AHB version has a
|
|
* "default" port which has no security checks applied. In QEMU the default
|
|
* port can be emulated simply by wiring its downstream devices directly
|
|
* into the parent address space, since the PPC does not need to intercept
|
|
* transactions there.
|
|
*
|
|
* In the hardware, selection of which downstream port to use is done by
|
|
* the user's decode logic asserting one of the hsel[] signals. In QEMU,
|
|
* we provide 16 MMIO regions, one per port, and the user maps these into
|
|
* the desired addresses to implement the address decode.
|
|
*
|
|
* QEMU interface:
|
|
* + sysbus MMIO regions 0..15: MemoryRegions defining the upstream end
|
|
* of each of the 16 ports of the PPC
|
|
* + Property "port[0..15]": MemoryRegion defining the downstream device(s)
|
|
* for each of the 16 ports of the PPC
|
|
* + Named GPIO inputs "cfg_nonsec[0..15]": set to 1 if the port should be
|
|
* accessible to NonSecure transactions
|
|
* + Named GPIO inputs "cfg_ap[0..15]": set to 1 if the port should be
|
|
* accessible to non-privileged transactions
|
|
* + Named GPIO input "cfg_sec_resp": set to 1 if a rejected transaction should
|
|
* result in a transaction error, or 0 for the transaction to RAZ/WI
|
|
* + Named GPIO input "irq_enable": set to 1 to enable interrupts
|
|
* + Named GPIO input "irq_clear": set to 1 to clear a pending interrupt
|
|
* + Named GPIO output "irq": set for a transaction-failed interrupt
|
|
* + Property "NONSEC_MASK": if a bit is set in this mask then accesses to
|
|
* the associated port do not have the TZ security check performed. (This
|
|
* corresponds to the hardware allowing this to be set as a Verilog
|
|
* parameter.)
|
|
*/
|
|
|
|
#ifndef TZ_PPC_H
|
|
#define TZ_PPC_H
|
|
|
|
#include "hw/sysbus.h"
|
|
|
|
#define TYPE_TZ_PPC "tz-ppc"
|
|
#define TZ_PPC(obj) OBJECT_CHECK(TZPPC, (obj), TYPE_TZ_PPC)
|
|
|
|
#define TZ_NUM_PORTS 16
|
|
|
|
typedef struct TZPPC TZPPC;
|
|
|
|
typedef struct TZPPCPort {
|
|
TZPPC *ppc;
|
|
MemoryRegion upstream;
|
|
AddressSpace downstream_as;
|
|
MemoryRegion *downstream;
|
|
} TZPPCPort;
|
|
|
|
struct TZPPC {
|
|
/*< private >*/
|
|
SysBusDevice parent_obj;
|
|
|
|
/*< public >*/
|
|
|
|
/* State: these just track the values of our input signals */
|
|
bool cfg_nonsec[TZ_NUM_PORTS];
|
|
bool cfg_ap[TZ_NUM_PORTS];
|
|
bool cfg_sec_resp;
|
|
bool irq_enable;
|
|
bool irq_clear;
|
|
/* State: are we asserting irq ? */
|
|
bool irq_status;
|
|
|
|
qemu_irq irq;
|
|
|
|
/* Properties */
|
|
uint32_t nonsec_mask;
|
|
|
|
TZPPCPort port[TZ_NUM_PORTS];
|
|
};
|
|
|
|
#endif
|