diff --git a/docs/firmware-design.md b/docs/firmware-design.md index 8c635a9..a40ddac 100644 --- a/docs/firmware-design.md +++ b/docs/firmware-design.md @@ -207,15 +207,17 @@ #### Platform initialization -BL2 does not perform any platform initialization that affects subsequent -stages of the ARM Trusted Firmware or normal world software. It copies the -information regarding the trusted SRAM populated by BL1 using a +BL2 copies the information regarding the trusted SRAM populated by BL1 using a platform-specific mechanism. It calculates the limits of DRAM (main memory) to determine whether there is enough space to load the BL3-3 image. A platform defined base address is used to specify the load address for the BL3-1 image. It also defines the extents of memory available for use by the BL3-2 image. BL2 also initializes UART0 (PL011 console), which enables access to the -`printf` family of functions in BL2 +`printf` family of functions in BL2. Platform security is initialized to allow +access to access controlled components. On the Base FVP a TrustZone controller +(TZC-400) is configured to give full access to the platform DRAM. The storage +abstraction layer is initialized which is used to load further bootloader +images. #### BL3-1 (EL3 Runtime Firmware) image load diff --git a/docs/porting-guide.md b/docs/porting-guide.md index 868eb33..8a024d8 100644 --- a/docs/porting-guide.md +++ b/docs/porting-guide.md @@ -630,6 +630,10 @@ this function. This information is accessible in the `bl33_meminfo` field in the `bl31_args` structure pointed to by `bl2_to_bl31_args`. +Platform security components are configured if required. For the Base FVP the +TZC-400 TrustZone controller is configured to grant secure and non-secure access +to DRAM. + This function is also responsible for initializing the storage abstraction layer which is used to load further bootloader images. diff --git a/docs/user-guide.md b/docs/user-guide.md index 39d09c1..1bb0fe9 100644 --- a/docs/user-guide.md +++ b/docs/user-guide.md @@ -532,9 +532,15 @@ Package at the start of NOR FLASH0 (see the "Building the Trusted Firmware" section above). +NOTE: Setting the `-C bp.secure_memory` parameter to `1` is only supported on +FVP versions 5.4 and newer. Setting this parameter to `0` is also supported. +The `-C bp.tzc_400.diagnostics=1` parameter is optional. It instructs the FVP to +provide some helpful information if a secure memory violation occurs. + /FVP_Base_AEMv8A-AEMv8A \ -C pctl.startup=0.0.0.0 \ - -C bp.secure_memory=0 \ + -C bp.secure_memory=1 \ + -C bp.tzc_400.diagnostics=1 \ -C cluster0.NUM_CORES=4 \ -C cluster1.NUM_CORES=4 \ -C cache_state_modelled=1 \ @@ -560,9 +566,15 @@ Package at the start of NOR FLASH0 (see the "Building the Trusted Firmware" section above). +NOTE: Setting the `-C bp.secure_memory` parameter to `1` is only supported on +FVP versions 5.4 and newer. Setting this parameter to `0` is also supported. +The `-C bp.tzc_400.diagnostics=1` parameter is optional. It instructs the FVP to +provide some helpful information if a secure memory violation occurs. + /FVP_Base_Cortex-A57x4-A53x4 \ -C pctl.startup=0.0.0.0 \ - -C bp.secure_memory=0 \ + -C bp.secure_memory=1 \ + -C bp.tzc_400.diagnostics=1 \ -C cache_state_modelled=1 \ -C bp.pl011_uart0.untimed_fifos=1 \ -C bp.secureflashloader.fname="/" \ diff --git a/drivers/arm/interconnect/tzc-400/tzc400.c b/drivers/arm/interconnect/tzc-400/tzc400.c new file mode 100644 index 0000000..b88e34a --- /dev/null +++ b/drivers/arm/interconnect/tzc-400/tzc400.c @@ -0,0 +1,265 @@ +/* + * Copyright (c) 2014, ARM Limited and Contributors. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * Redistributions of source code must retain the above copyright notice, this + * list of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * Neither the name of ARM nor the names of its contributors may be used + * to endorse or promote products derived from this software without specific + * prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +#include +#include "arch_helpers.h" +#include "tzc400.h" +#include "mmio.h" +#include "debug.h" + +static uint32_t tzc_read_build_config(uint64_t base) +{ + return mmio_read_32(base + BUILD_CONFIG_OFF); +} + +static uint32_t tzc_read_gate_keeper(uint64_t base) +{ + return mmio_read_32(base + GATE_KEEPER_OFF); +} + +static void tzc_write_gate_keeper(uint64_t base, uint32_t val) +{ + mmio_write_32(base + GATE_KEEPER_OFF, val); +} + +static void tzc_write_action(uint64_t base, enum tzc_action action) +{ + mmio_write_32(base + ACTION_OFF, action); +} + +static void tzc_write_region_base_low(uint64_t base, uint32_t region, uint32_t val) +{ + mmio_write_32(base + REGION_BASE_LOW_OFF + REGION_NUM_OFF(region), val); +} + +static void tzc_write_region_base_high(uint64_t base, uint32_t region, uint32_t val) +{ + mmio_write_32(base + REGION_BASE_HIGH_OFF + REGION_NUM_OFF(region), val); +} + +static void tzc_write_region_top_low(uint64_t base, uint32_t region, uint32_t val) +{ + mmio_write_32(base + REGION_TOP_LOW_OFF + REGION_NUM_OFF(region), val); +} + +static void tzc_write_region_top_high(uint64_t base, uint32_t region, uint32_t val) +{ + mmio_write_32(base + REGION_TOP_HIGH_OFF + REGION_NUM_OFF(region), val); +} + +static void tzc_write_region_attributes(uint64_t base, uint32_t region, uint32_t val) +{ + mmio_write_32(base + REGION_ATTRIBUTES_OFF + REGION_NUM_OFF(region), val); +} + +static void tzc_write_region_id_access(uint64_t base, uint32_t region, uint32_t val) +{ + mmio_write_32(base + REGION_ID_ACCESS_OFF + REGION_NUM_OFF(region), val); +} + +static uint32_t tzc_read_component_id(uint64_t base) +{ + uint32_t id; + + id = mmio_read_8(base + CID0_OFF); + id |= (mmio_read_8(base + CID1_OFF) << 8); + id |= (mmio_read_8(base + CID2_OFF) << 16); + id |= (mmio_read_8(base + CID3_OFF) << 24); + + return id; +} + +static uint32_t tzc_get_gate_keeper(uint64_t base, uint8_t filter) +{ + uint32_t tmp; + + tmp = (tzc_read_gate_keeper(base) >> GATE_KEEPER_OS_SHIFT) & + GATE_KEEPER_OS_MASK; + + return tmp >> filter; +} + +/* This function is not MP safe. */ +static void tzc_set_gate_keeper(uint64_t base, uint8_t filter, uint32_t val) +{ + uint32_t tmp; + + /* Upper half is current state. Lower half is requested state. */ + tmp = (tzc_read_gate_keeper(base) >> GATE_KEEPER_OS_SHIFT) & + GATE_KEEPER_OS_MASK; + + if (val) + tmp |= (1 << filter); + else + tmp &= ~(1 << filter); + + tzc_write_gate_keeper(base, (tmp & GATE_KEEPER_OR_MASK) << + GATE_KEEPER_OR_SHIFT); + + /* Wait here until we see the change reflected in the TZC status. */ + while (((tzc_read_gate_keeper(base) >> GATE_KEEPER_OS_SHIFT) & + GATE_KEEPER_OS_MASK) != tmp) + ; +} + + +void tzc_init(struct tzc_instance *controller) +{ + uint32_t tzc_id, tzc_build; + + assert(controller != NULL); + + /* + * We expect to see a tzc400. Check component ID. The TZC-400 TRM shows + * component ID is expected to be "0xB105F00D". + */ + tzc_id = tzc_read_component_id(controller->base); + if (tzc_id != TZC400_COMPONENT_ID) { + ERROR("TZC : Wrong device ID (0x%x).\n", tzc_id); + panic(); + } + + /* Save values we will use later. */ + tzc_build = tzc_read_build_config(controller->base); + controller->num_filters = ((tzc_build >> BUILD_CONFIG_NF_SHIFT) & + BUILD_CONFIG_NF_MASK) + 1; + controller->addr_width = ((tzc_build >> BUILD_CONFIG_AW_SHIFT) & + BUILD_CONFIG_AW_MASK) + 1; + controller->num_regions = ((tzc_build >> BUILD_CONFIG_NR_SHIFT) & + BUILD_CONFIG_NR_MASK) + 1; +} + + +/* + * `tzc_configure_region` is used to program regions into the TrustZone + * controller. A region can be associated with more than one filter. The + * associated filters are passed in as a bitmap (bit0 = filter0). + * NOTE: + * The region 0 covers the whole address space and is enabled on all filters, + * this cannot be changed. It is, however, possible to change some region 0 + * permissions. + */ +void tzc_configure_region(const struct tzc_instance *controller, + uint32_t filters, + uint8_t region, + uint64_t region_base, + uint64_t region_top, + enum tzc_region_attributes sec_attr, + uint32_t ns_device_access) +{ + uint64_t max_addr; + + assert(controller != NULL); + + /* Do range checks on filters and regions. */ + assert(((filters >> controller->num_filters) == 0) && + (region < controller->num_regions)); + + /* + * Do address range check based on TZC configuration. A 64bit address is + * the max and expected case. + */ + max_addr = UINT64_MAX >> (64 - controller->addr_width); + if ((region_top > max_addr) || (region_base >= region_top)) + assert(0); + + /* region_base and (region_top + 1) must be 4KB aligned */ + assert(((region_base | (region_top + 1)) & (4096 - 1)) == 0); + + assert(sec_attr <= TZC_REGION_S_RDWR); + + /* + * Inputs look ok, start programming registers. + * All the address registers are 32 bits wide and have a LOW and HIGH + * component used to construct a up to a 64bit address. + */ + tzc_write_region_base_low(controller->base, region, (uint32_t)(region_base)); + tzc_write_region_base_high(controller->base, region, (uint32_t)(region_base >> 32)); + + tzc_write_region_top_low(controller->base, region, (uint32_t)(region_top)); + tzc_write_region_top_high(controller->base, region, (uint32_t)(region_top >> 32)); + + /* Assign the region to a filter and set secure attributes */ + tzc_write_region_attributes(controller->base, region, + (sec_attr << REGION_ATTRIBUTES_SEC_SHIFT) | filters); + + /* + * Specify which non-secure devices have permission to access this + * region. + */ + tzc_write_region_id_access(controller->base, region, ns_device_access); +} + + +void tzc_set_action(const struct tzc_instance *controller, enum tzc_action action) +{ + assert(controller != NULL); + + /* + * - Currently no handler is provided to trap an error via interrupt + * or exception. + * - The interrupt action has not been tested. + */ + tzc_write_action(controller->base, action); +} + + +void tzc_enable_filters(const struct tzc_instance *controller) +{ + uint32_t state; + uint32_t filter; + + assert(controller != NULL); + + for (filter = 0; filter < controller->num_filters; filter++) { + state = tzc_get_gate_keeper(controller->base, filter); + if (state) { + ERROR("TZC : Filter %d Gatekeeper already enabled.\n", + filter); + panic(); + } + tzc_set_gate_keeper(controller->base, filter, 1); + } +} + + +void tzc_disable_filters(const struct tzc_instance *controller) +{ + uint32_t filter; + + assert(controller != NULL); + + /* + * We don't do the same state check as above as the Gatekeepers are + * disabled after reset. + */ + for (filter = 0; filter < controller->num_filters; filter++) + tzc_set_gate_keeper(controller->base, filter, 0); +} diff --git a/drivers/arm/interconnect/tzc-400/tzc400.h b/drivers/arm/interconnect/tzc-400/tzc400.h new file mode 100644 index 0000000..7eaafd2 --- /dev/null +++ b/drivers/arm/interconnect/tzc-400/tzc400.h @@ -0,0 +1,211 @@ +/* + * Copyright (c) 2014, ARM Limited and Contributors. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * Redistributions of source code must retain the above copyright notice, this + * list of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * Neither the name of ARM nor the names of its contributors may be used + * to endorse or promote products derived from this software without specific + * prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +#ifndef __TZC400_H__ +#define __TZC400_H__ + +#include + +#define BUILD_CONFIG_OFF 0x000 +#define ACTION_OFF 0x004 +#define GATE_KEEPER_OFF 0x008 +#define SPECULATION_CTRL_OFF 0x00c +#define INT_STATUS 0x010 +#define INT_CLEAR 0x014 + +#define FAIL_ADDRESS_LOW_OFF 0x020 +#define FAIL_ADDRESS_HIGH_OFF 0x024 +#define FAIL_CONTROL_OFF 0x028 +#define FAIL_ID 0x02c + +#define REGION_BASE_LOW_OFF 0x100 +#define REGION_BASE_HIGH_OFF 0x104 +#define REGION_TOP_LOW_OFF 0x108 +#define REGION_TOP_HIGH_OFF 0x10c +#define REGION_ATTRIBUTES_OFF 0x110 +#define REGION_ID_ACCESS_OFF 0x114 +#define REGION_NUM_OFF(region) (0x20 * region) + +/* ID Registers */ +#define PID0_OFF 0xfe0 +#define PID1_OFF 0xfe4 +#define PID2_OFF 0xfe8 +#define PID3_OFF 0xfec +#define PID4_OFF 0xfd0 +#define PID5_OFF 0xfd4 +#define PID6_OFF 0xfd8 +#define PID7_OFF 0xfdc +#define CID0_OFF 0xff0 +#define CID1_OFF 0xff4 +#define CID2_OFF 0xff8 +#define CID3_OFF 0xffc + +#define BUILD_CONFIG_NF_SHIFT 24 +#define BUILD_CONFIG_NF_MASK 0x3 +#define BUILD_CONFIG_AW_SHIFT 8 +#define BUILD_CONFIG_AW_MASK 0x3f +#define BUILD_CONFIG_NR_SHIFT 0 +#define BUILD_CONFIG_NR_MASK 0x1f + +/* Not describing the case where regions 1 to 8 overlap */ +#define ACTION_RV_SHIFT 0 +#define ACTION_RV_MASK 0x3 +#define ACTION_RV_LOWOK 0x0 +#define ACTION_RV_LOWERR 0x1 +#define ACTION_RV_HIGHOK 0x2 +#define ACTION_RV_HIGHERR 0x3 + +/* + * Number of gate keepers is implementation defined. But we know the max for + * this device is 4. Get implementation details from BUILD_CONFIG. + */ +#define GATE_KEEPER_OS_SHIFT 16 +#define GATE_KEEPER_OS_MASK 0xf +#define GATE_KEEPER_OR_SHIFT 0 +#define GATE_KEEPER_OR_MASK 0xf + +/* Speculation is enabled by default. */ +#define SPECULATION_CTRL_WRITE_DISABLE (1 << 1) +#define SPECULATION_CTRL_READ_DISABLE (1 << 0) + +/* Max number of filters allowed is 4. */ +#define INT_STATUS_OVERLAP_SHIFT 16 +#define INT_STATUS_OVERLAP_MASK 0xf +#define INT_STATUS_OVERRUN_SHIFT 8 +#define INT_STATUS_OVERRUN_MASK 0xf +#define INT_STATUS_STATUS_SHIFT 0 +#define INT_STATUS_STATUS_MASK 0xf + +#define INT_CLEAR_CLEAR_SHIFT 0 +#define INT_CLEAR_CLEAR_MASK 0xf + +#define FAIL_CONTROL_DIR_SHIFT (1 << 24) +#define FAIL_CONTROL_DIR_READ 0x0 +#define FAIL_CONTROL_DIR_WRITE 0x1 +#define FAIL_CONTROL_NS_SHIFT (1 << 21) +#define FAIL_CONTROL_NS_SECURE 0x0 +#define FAIL_CONTROL_NS_NONSECURE 0x1 +#define FAIL_CONTROL_PRIV_SHIFT (1 << 20) +#define FAIL_CONTROL_PRIV_PRIV 0x0 +#define FAIL_CONTROL_PRIV_UNPRIV 0x1 + +/* + * FAIL_ID_ID_MASK depends on AID_WIDTH which is platform specific. + * Platform should provide the value on initialisation. + */ +#define FAIL_ID_VNET_SHIFT 24 +#define FAIL_ID_VNET_MASK 0xf +#define FAIL_ID_ID_SHIFT 0 + +/* Used along with 'tzc_region_attributes_t' below */ +#define REGION_ATTRIBUTES_SEC_SHIFT 30 +#define REGION_ATTRIBUTES_F_EN_SHIFT 0 +#define REGION_ATTRIBUTES_F_EN_MASK 0xf + +#define REGION_ID_ACCESS_NSAID_WR_EN_SHIFT 16 +#define REGION_ID_ACCESS_NSAID_RD_EN_SHIFT 0 +#define REGION_ID_ACCESS_NSAID_ID_MASK 0xf + + +/* Macros for setting Region ID access permissions based on NSAID */ +#define TZC_REGION_ACCESS_RD(id) \ + ((1 << (id & REGION_ID_ACCESS_NSAID_ID_MASK)) << \ + REGION_ID_ACCESS_NSAID_RD_EN_SHIFT) +#define TZC_REGION_ACCESS_WR(id) \ + ((1 << (id & REGION_ID_ACCESS_NSAID_ID_MASK)) << \ + REGION_ID_ACCESS_NSAID_WR_EN_SHIFT) +#define TZC_REGION_ACCESS_RDWR(id) \ + (TZC_REGION_ACCESS_RD(id) | TZC_REGION_ACCESS_WR(id)) + +/* Filters are bit mapped 0 to 3. */ +#define TZC400_COMPONENT_ID 0xb105f00d + +#ifndef __ASSEMBLY__ + +/******************************************************************************* + * Function & variable prototypes + ******************************************************************************/ + +/* + * What type of action is expected when an access violation occurs. + * The memory requested is zeroed. But we can also raise and event to + * let the system know it happened. + * We can raise an interrupt(INT) and/or cause an exception(ERR). + * TZC_ACTION_NONE - No interrupt, no Exception + * TZC_ACTION_ERR - No interrupt, raise exception -> sync external + * data abort + * TZC_ACTION_INT - Raise interrupt, no exception + * TZC_ACTION_ERR_INT - Raise interrupt, raise exception -> sync + * external data abort + */ +enum tzc_action { + TZC_ACTION_NONE = 0, + TZC_ACTION_ERR = 1, + TZC_ACTION_INT = 2, + TZC_ACTION_ERR_INT = (TZC_ACTION_ERR | TZC_ACTION_INT) +}; + +/* + * Controls secure access to a region. If not enabled secure access is not + * allowed to region. + */ +enum tzc_region_attributes { + TZC_REGION_S_NONE = 0, + TZC_REGION_S_RD = 1, + TZC_REGION_S_WR = 2, + TZC_REGION_S_RDWR = (TZC_REGION_S_RD | TZC_REGION_S_WR) +}; + +/* + * Implementation defined values used to validate inputs later. + * Filters : max of 4 ; 0 to 3 + * Regions : max of 9 ; 0 to 8 + * Address width : Values between 32 to 64 + */ +struct tzc_instance { + uint64_t base; + uint32_t aid_width; + uint8_t addr_width; + uint8_t num_filters; + uint8_t num_regions; +}; + +void tzc_init(struct tzc_instance *controller); +void tzc_configure_region(const struct tzc_instance *controller, uint32_t filters, + uint8_t region, uint64_t region_base, uint64_t region_top, + enum tzc_region_attributes sec_attr, uint32_t ns_device_access); +void tzc_enable_filters(const struct tzc_instance *controller); +void tzc_disable_filters(const struct tzc_instance *controller); +void tzc_set_action(const struct tzc_instance *controller, + enum tzc_action action); + +#endif /*__ASSEMBLY__*/ + +#endif /* __TZC400__ */ diff --git a/fdts/fvp-base-gicv2-psci.dtb b/fdts/fvp-base-gicv2-psci.dtb index 5bfdcf1..abdb9a0 100644 --- a/fdts/fvp-base-gicv2-psci.dtb +++ b/fdts/fvp-base-gicv2-psci.dtb Binary files differ diff --git a/fdts/fvp-base-gicv2-psci.dts b/fdts/fvp-base-gicv2-psci.dts index 7924651..7d08922 100644 --- a/fdts/fvp-base-gicv2-psci.dts +++ b/fdts/fvp-base-gicv2-psci.dts @@ -147,10 +147,10 @@ #address-cells = <2>; #size-cells = <2>; ranges; - frame@2a820000 { - frame-number = <0>; - interrupts = <0 25 4>; - reg = <0x0 0x2a820000 0x0 0x10000>; + frame@2a830000 { + frame-number = <1>; + interrupts = <0 26 4>; + reg = <0x0 0x2a830000 0x0 0x10000>; }; }; diff --git a/fdts/fvp-base-gicv2legacy-psci.dtb b/fdts/fvp-base-gicv2legacy-psci.dtb index db17e98..3fc6b3e 100644 --- a/fdts/fvp-base-gicv2legacy-psci.dtb +++ b/fdts/fvp-base-gicv2legacy-psci.dtb Binary files differ diff --git a/fdts/fvp-base-gicv2legacy-psci.dts b/fdts/fvp-base-gicv2legacy-psci.dts index cfd50a7..f095231 100644 --- a/fdts/fvp-base-gicv2legacy-psci.dts +++ b/fdts/fvp-base-gicv2legacy-psci.dts @@ -147,10 +147,10 @@ #address-cells = <2>; #size-cells = <2>; ranges; - frame@2a820000 { - frame-number = <0>; - interrupts = <0 25 4>; - reg = <0x0 0x2a820000 0x0 0x10000>; + frame@2a830000 { + frame-number = <1>; + interrupts = <0 26 4>; + reg = <0x0 0x2a830000 0x0 0x10000>; }; }; diff --git a/fdts/fvp-base-gicv3-psci.dtb b/fdts/fvp-base-gicv3-psci.dtb index 52f251b..1efa136 100644 --- a/fdts/fvp-base-gicv3-psci.dtb +++ b/fdts/fvp-base-gicv3-psci.dtb Binary files differ diff --git a/fdts/fvp-base-gicv3-psci.dts b/fdts/fvp-base-gicv3-psci.dts index 84faeba..96d264e 100644 --- a/fdts/fvp-base-gicv3-psci.dts +++ b/fdts/fvp-base-gicv3-psci.dts @@ -156,10 +156,10 @@ #address-cells = <2>; #size-cells = <2>; ranges; - frame@2a820000 { - frame-number = <0>; - interrupts = <0 25 4>; - reg = <0x0 0x2a820000 0x0 0x10000>; + frame@2a830000 { + frame-number = <1>; + interrupts = <0 26 4>; + reg = <0x0 0x2a830000 0x0 0x10000>; }; }; diff --git a/fdts/fvp-foundation-gicv2-psci.dtb b/fdts/fvp-foundation-gicv2-psci.dtb index d982e85..ca10088 100644 --- a/fdts/fvp-foundation-gicv2-psci.dtb +++ b/fdts/fvp-foundation-gicv2-psci.dtb Binary files differ diff --git a/fdts/fvp-foundation-gicv2-psci.dts b/fdts/fvp-foundation-gicv2-psci.dts index c886f5d..bf368a0 100644 --- a/fdts/fvp-foundation-gicv2-psci.dts +++ b/fdts/fvp-foundation-gicv2-psci.dts @@ -36,7 +36,7 @@ }; / { - model = "FVP Base"; + model = "FVP Foundation"; compatible = "arm,fvp-base", "arm,vexpress"; interrupt-parent = <&gic>; #address-cells = <2>; @@ -123,10 +123,10 @@ #address-cells = <2>; #size-cells = <2>; ranges; - frame@2a820000 { - frame-number = <0>; - interrupts = <0 25 4>; - reg = <0x0 0x2a820000 0x0 0x10000>; + frame@2a830000 { + frame-number = <1>; + interrupts = <0 26 4>; + reg = <0x0 0x2a830000 0x0 0x10000>; }; }; diff --git a/fdts/fvp-foundation-gicv2legacy-psci.dtb b/fdts/fvp-foundation-gicv2legacy-psci.dtb index 849e68a..a602ff5 100644 --- a/fdts/fvp-foundation-gicv2legacy-psci.dtb +++ b/fdts/fvp-foundation-gicv2legacy-psci.dtb Binary files differ diff --git a/fdts/fvp-foundation-gicv2legacy-psci.dts b/fdts/fvp-foundation-gicv2legacy-psci.dts index b62ef2b..63cef80 100644 --- a/fdts/fvp-foundation-gicv2legacy-psci.dts +++ b/fdts/fvp-foundation-gicv2legacy-psci.dts @@ -36,7 +36,7 @@ }; / { - model = "FVP Base"; + model = "FVP Foundation"; compatible = "arm,fvp-base", "arm,vexpress"; interrupt-parent = <&gic>; #address-cells = <2>; @@ -123,10 +123,10 @@ #address-cells = <2>; #size-cells = <2>; ranges; - frame@2a820000 { - frame-number = <0>; - interrupts = <0 25 4>; - reg = <0x0 0x2a820000 0x0 0x10000>; + frame@2a830000 { + frame-number = <1>; + interrupts = <0 26 4>; + reg = <0x0 0x2a830000 0x0 0x10000>; }; }; diff --git a/fdts/fvp-foundation-gicv3-psci.dtb b/fdts/fvp-foundation-gicv3-psci.dtb index c6472e0..f64e421 100644 --- a/fdts/fvp-foundation-gicv3-psci.dtb +++ b/fdts/fvp-foundation-gicv3-psci.dtb Binary files differ diff --git a/fdts/fvp-foundation-gicv3-psci.dts b/fdts/fvp-foundation-gicv3-psci.dts index 1bf7234..f9f1ff3 100644 --- a/fdts/fvp-foundation-gicv3-psci.dts +++ b/fdts/fvp-foundation-gicv3-psci.dts @@ -36,7 +36,7 @@ }; / { - model = "FVP Base"; + model = "FVP Foundation"; compatible = "arm,fvp-base", "arm,vexpress"; interrupt-parent = <&gic>; #address-cells = <2>; @@ -132,10 +132,10 @@ #address-cells = <2>; #size-cells = <2>; ranges; - frame@2a820000 { - frame-number = <0>; - interrupts = <0 25 4>; - reg = <0x0 0x2a820000 0x0 0x10000>; + frame@2a830000 { + frame-number = <1>; + interrupts = <0 26 4>; + reg = <0x0 0x2a830000 0x0 0x10000>; }; }; diff --git a/include/mmio.h b/include/mmio.h index 313448e..c79c3f5 100644 --- a/include/mmio.h +++ b/include/mmio.h @@ -35,6 +35,9 @@ #include +extern void mmio_write_8(uintptr_t addr, uint8_t value); +extern uint8_t mmio_read_8(uintptr_t addr); + extern void mmio_write_32(uintptr_t addr, uint32_t value); extern uint32_t mmio_read_32(uintptr_t addr); diff --git a/lib/mmio.c b/lib/mmio.c index b654be7..1350609 100644 --- a/lib/mmio.c +++ b/lib/mmio.c @@ -30,6 +30,16 @@ #include +void mmio_write_8(uintptr_t addr, uint8_t value) +{ + *(volatile uint8_t*)addr = value; +} + +uint8_t mmio_read_8(uintptr_t addr) +{ + return *(volatile uint8_t*)addr; +} + void mmio_write_32(uintptr_t addr, uint32_t value) { *(volatile uint32_t*)addr = value; diff --git a/plat/fvp/aarch64/plat_common.c b/plat/fvp/aarch64/plat_common.c index 16645cb..dd362f0 100644 --- a/plat/fvp/aarch64/plat_common.c +++ b/plat/fvp/aarch64/plat_common.c @@ -220,6 +220,7 @@ platform_config[CONFIG_CPU_SETUP] = 0; platform_config[CONFIG_BASE_MMAP] = 0; platform_config[CONFIG_HAS_CCI] = 0; + platform_config[CONFIG_HAS_TZC] = 0; break; case HBI_FVP_BASE: midr_pn = (read_midr() >> MIDR_PN_SHIFT) & MIDR_PN_MASK; @@ -232,6 +233,7 @@ platform_config[CONFIG_MAX_AFF1] = 2; platform_config[CONFIG_BASE_MMAP] = 1; platform_config[CONFIG_HAS_CCI] = 1; + platform_config[CONFIG_HAS_TZC] = 1; break; default: assert(0); diff --git a/plat/fvp/bl2_plat_setup.c b/plat/fvp/bl2_plat_setup.c index 4d57ed5..da6a485 100644 --- a/plat/fvp/bl2_plat_setup.c +++ b/plat/fvp/bl2_plat_setup.c @@ -122,6 +122,14 @@ ******************************************************************************/ void bl2_platform_setup() { + /* + * Do initial security configuration to allow DRAM/device access. On + * Base FVP only DRAM security is programmable (via TrustZone), but + * other platforms might have more programmable security devices + * present. + */ + plat_security_setup(); + /* Initialise the IO layer and register platform IO devices */ io_setup(); diff --git a/plat/fvp/plat_security.c b/plat/fvp/plat_security.c new file mode 100644 index 0000000..a60eca3 --- /dev/null +++ b/plat/fvp/plat_security.c @@ -0,0 +1,131 @@ +/* + * Copyright (c) 2014, ARM Limited and Contributors. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * Redistributions of source code must retain the above copyright notice, this + * list of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * Neither the name of ARM nor the names of its contributors may be used + * to endorse or promote products derived from this software without specific + * prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +#include +#include "platform.h" +#include "tzc400.h" +#include "debug.h" + +/* Used to improve readability for configuring regions. */ +#define FILTER_SHIFT(filter) (1 << filter) + +/* + * For the moment we assume that all security programming is done by the + * primary core. + * TODO: + * Might want to enable interrupt on violations when supported? + */ +void plat_security_setup(void) +{ + struct tzc_instance controller; + + /* + * The Base FVP has a TrustZone address space controller, the Foundation + * FVP does not. Trying to program the device on the foundation FVP will + * cause an abort. + * + * If the platform had additional peripheral specific security + * configurations, those would be configured here. + */ + + if (!platform_get_cfgvar(CONFIG_HAS_TZC)) + return; + + /* + * The TrustZone controller controls access to main DRAM. Give + * full NS access for the moment to use with OS. + */ + INFO("Configuring TrustZone Controller\n"); + + /* + * The driver does some error checking and will assert. + * - Provide base address of device on platform. + * - Provide width of ACE-Lite IDs on platform. + */ + controller.base = TZC400_BASE; + controller.aid_width = FVP_AID_WIDTH; + tzc_init(&controller); + + /* + * Currently only filters 0 and 2 are connected on Base FVP. + * Filter 0 : CPU clusters (no access to DRAM by default) + * Filter 1 : not connected + * Filter 2 : LCDs (access to VRAM allowed by default) + * Filter 3 : not connected + * Programming unconnected filters will have no effect at the + * moment. These filter could, however, be connected in future. + * So care should be taken not to configure the unused filters. + */ + + /* Disable all filters before programming. */ + tzc_disable_filters(&controller); + + /* + * Allow full access to all DRAM to supported devices for the + * moment. Give access to the CPUs and Virtio. Some devices + * would normally use the default ID so allow that too. We use + * three different regions to cover the three separate blocks of + * memory in the FVPs. We allow secure access to DRAM to load NS + * software. + * FIXME: In current models Virtio uses a reserved ID. This is + * not correct and will be fixed. + */ + + /* Set to cover 2GB block of DRAM */ + tzc_configure_region(&controller, FILTER_SHIFT(0), 1, + DRAM_BASE, 0xFFFFFFFF, TZC_REGION_S_RDWR, + TZC_REGION_ACCESS_RDWR(FVP_NSAID_AP) | + TZC_REGION_ACCESS_RDWR(FVP_NSAID_DEFAULT) | + TZC_REGION_ACCESS_RDWR(FVP_NSAID_RES5)); + + /* Set to cover the 30GB block */ + tzc_configure_region(&controller, FILTER_SHIFT(0), 2, + 0x880000000, 0xFFFFFFFFF, TZC_REGION_S_RDWR, + TZC_REGION_ACCESS_RDWR(FVP_NSAID_AP) | + TZC_REGION_ACCESS_RDWR(FVP_NSAID_DEFAULT) | + TZC_REGION_ACCESS_RDWR(FVP_NSAID_RES5)); + + /* Set to cover 480GB block */ + tzc_configure_region(&controller, FILTER_SHIFT(0), 3, + 0x8800000000, 0xFFFFFFFFFF, TZC_REGION_S_RDWR, + TZC_REGION_ACCESS_RDWR(FVP_NSAID_AP) | + TZC_REGION_ACCESS_RDWR(FVP_NSAID_DEFAULT) | + TZC_REGION_ACCESS_RDWR(FVP_NSAID_RES5)); + + /* + * TODO: Interrupts are not currently supported. The only + * options we have are for access errors to occur quietly or to + * cause an exception. We choose to cause an exception. + */ + tzc_set_action(&controller, TZC_ACTION_ERR); + + /* Enable filters. */ + tzc_enable_filters(&controller); +} diff --git a/plat/fvp/platform.h b/plat/fvp/platform.h index c594357..01b995b 100644 --- a/plat/fvp/platform.h +++ b/plat/fvp/platform.h @@ -99,7 +99,8 @@ #define CONFIG_BASE_MMAP 7 /* Indicates whether CCI should be enabled on the platform. */ #define CONFIG_HAS_CCI 8 -#define CONFIG_LIMIT 9 +#define CONFIG_HAS_TZC 9 +#define CONFIG_LIMIT 10 /******************************************************************************* * Platform memory map related constants @@ -303,6 +304,28 @@ #define PL011_UART3_BASE 0x1c0c0000 #define PL011_BASE PL011_UART0_BASE + +/******************************************************************************* + * TrustZone address space controller related constants + ******************************************************************************/ +#define TZC400_BASE 0x2a4a0000 + +/* + * The NSAIDs for this platform as used to program the TZC400. + * TODO: + * This list and the numbers in it is still changing on the Base FVP. + * For now only specify the NSAIDs we actually use. + */ + +/* The FVP has 4 bits of NSAIDs. Used with TZC FAIL_ID (ACE Lite ID width) */ +#define FVP_AID_WIDTH 4 +#define FVP_NSAID_DEFAULT 0 +#define FVP_NSAID_AP 9 /* Application Processors */ + +/* FIXME: Currently incorrectly used by Virtio */ +#define FVP_NSAID_RES5 15 + + /******************************************************************************* * Declarations and constants to access the mailboxes safely. Each mailbox is * aligned on the biggest cache line size in the platform. This is known only @@ -374,6 +397,10 @@ extern int plat_get_image_source(const char *image_name, io_dev_handle *dev_handle, void **image_spec); +/* Declarations for plat_security.c */ +extern void plat_security_setup(void); + + #endif /*__ASSEMBLY__*/ #endif /* __PLATFORM_H__ */ diff --git a/plat/fvp/platform.mk b/plat/fvp/platform.mk index 36090f2..0fc45de 100644 --- a/plat/fvp/platform.mk +++ b/plat/fvp/platform.mk @@ -29,6 +29,7 @@ # PLAT_INCLUDES := -Idrivers/arm/interconnect/cci-400 \ + -Idrivers/arm/interconnect/tzc-400 \ -Idrivers/console \ -Idrivers/arm/peripherals/pl011 \ -Idrivers/power @@ -43,6 +44,7 @@ PLAT_BL1_S_VPATH := lib/semihosting/${ARCH} PLAT_BL2_C_VPATH := drivers/arm/interconnect/cci-400 \ + drivers/arm/interconnect/tzc-400 \ drivers/arm/peripherals/pl011 \ lib/arch/${ARCH} \ lib/stdlib \ @@ -82,7 +84,9 @@ BL2_SOURCES += bl2_plat_setup.c \ platform_up_stack.S \ - plat_common.c + plat_common.c \ + plat_security.c \ + tzc400.c BL31_SOURCES += bl31_plat_setup.c \ plat_helpers.S \