cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

tz-ppc.h (4115B)

      1/*
      2 * ARM TrustZone peripheral protection controller emulation
      3 *
      4 * Copyright (c) 2018 Linaro Limited
      5 * Written by Peter Maydell
      6 *
      7 * This program is free software; you can redistribute it and/or modify
      8 * it under the terms of the GNU General Public License version 2 or
      9 * (at your option) any later version.
     10 */
     11
     12/* This is a model of the TrustZone peripheral protection controller (PPC).
     13 * It is documented in the ARM CoreLink SIE-200 System IP for Embedded TRM
     14 * (DDI 0571G):
     15 * https://developer.arm.com/products/architecture/m-profile/docs/ddi0571/g
     16 *
     17 * The PPC sits in front of peripherals and allows secure software to
     18 * configure it to either pass through or reject transactions.
     19 * Rejected transactions may be configured to either be aborted, or to
     20 * behave as RAZ/WI. An interrupt can be signalled for a rejected transaction.
     21 *
     22 * The PPC has no register interface -- it is configured purely by a
     23 * collection of input signals from other hardware in the system. Typically
     24 * they are either hardwired or exposed in an ad-hoc register interface by
     25 * the SoC that uses the PPC.
     26 *
     27 * This QEMU model can be used to model either the AHB5 or APB4 TZ PPC,
     28 * since the only difference between them is that the AHB version has a
     29 * "default" port which has no security checks applied. In QEMU the default
     30 * port can be emulated simply by wiring its downstream devices directly
     31 * into the parent address space, since the PPC does not need to intercept
     32 * transactions there.
     33 *
     34 * In the hardware, selection of which downstream port to use is done by
     35 * the user's decode logic asserting one of the hsel[] signals. In QEMU,
     36 * we provide 16 MMIO regions, one per port, and the user maps these into
     37 * the desired addresses to implement the address decode.
     38 *
     39 * QEMU interface:
     40 * + sysbus MMIO regions 0..15: MemoryRegions defining the upstream end
     41 *   of each of the 16 ports of the PPC. When a port is unused (i.e. no
     42 *   downstream MemoryRegion is connected to it) at the end of the 0..15
     43 *   range then no sysbus MMIO region is created for its upstream. When an
     44 *   unused port lies in the middle of the range with other used ports at
     45 *   higher port numbers, a dummy MMIO region is created to ensure that
     46 *   port N's upstream is always sysbus MMIO region N. Dummy regions should
     47 *   not be mapped, and will assert if any access is made to them.
     48 * + Property "port[0..15]": MemoryRegion defining the downstream device(s)
     49 *   for each of the 16 ports of the PPC
     50 * + Named GPIO inputs "cfg_nonsec[0..15]": set to 1 if the port should be
     51 *   accessible to NonSecure transactions
     52 * + Named GPIO inputs "cfg_ap[0..15]": set to 1 if the port should be
     53 *   accessible to non-privileged transactions
     54 * + Named GPIO input "cfg_sec_resp": set to 1 if a rejected transaction should
     55 *   result in a transaction error, or 0 for the transaction to RAZ/WI
     56 * + Named GPIO input "irq_enable": set to 1 to enable interrupts
     57 * + Named GPIO input "irq_clear": set to 1 to clear a pending interrupt
     58 * + Named GPIO output "irq": set for a transaction-failed interrupt
     59 * + Property "NONSEC_MASK": if a bit is set in this mask then accesses to
     60 *   the associated port do not have the TZ security check performed. (This
     61 *   corresponds to the hardware allowing this to be set as a Verilog
     62 *   parameter.)
     63 */
     64
     65#ifndef TZ_PPC_H
     66#define TZ_PPC_H
     67
     68#include "hw/sysbus.h"
     69#include "qom/object.h"
     70
     71#define TYPE_TZ_PPC "tz-ppc"
     72OBJECT_DECLARE_SIMPLE_TYPE(TZPPC, TZ_PPC)
     73
     74#define TZ_NUM_PORTS 16
     75
     76
     77typedef struct TZPPCPort {
     78    TZPPC *ppc;
     79    MemoryRegion upstream;
     80    AddressSpace downstream_as;
     81    MemoryRegion *downstream;
     82} TZPPCPort;
     83
     84struct TZPPC {
     85    /*< private >*/
     86    SysBusDevice parent_obj;
     87
     88    /*< public >*/
     89
     90    /* State: these just track the values of our input signals */
     91    bool cfg_nonsec[TZ_NUM_PORTS];
     92    bool cfg_ap[TZ_NUM_PORTS];
     93    bool cfg_sec_resp;
     94    bool irq_enable;
     95    bool irq_clear;
     96    /* State: are we asserting irq ? */
     97    bool irq_status;
     98
     99    qemu_irq irq;
    100
    101    /* Properties */
    102    uint32_t nonsec_mask;
    103
    104    TZPPCPort port[TZ_NUM_PORTS];
    105};
    106
    107#endif