Merge pull request #33 from hliebel/hl/secure-memory

Hl/secure memory
diff --git a/docs/firmware-design.md b/docs/firmware-design.md
index 8c635a9..a40ddac 100644
--- a/docs/firmware-design.md
+++ b/docs/firmware-design.md
@@ -207,15 +207,17 @@
 
 #### Platform initialization
 
-BL2 does not perform any platform initialization that affects subsequent
-stages of the ARM Trusted Firmware or normal world software. It copies the
-information regarding the trusted SRAM populated by BL1 using a
+BL2 copies the information regarding the trusted SRAM populated by BL1 using a
 platform-specific mechanism. It calculates the limits of DRAM (main memory)
 to determine whether there is enough space to load the BL3-3 image. A platform
 defined base address is used to specify the load address for the BL3-1 image.
 It also defines the extents of memory available for use by the BL3-2 image.
 BL2 also initializes UART0 (PL011 console), which enables  access to the
-`printf` family of functions in BL2
+`printf` family of functions in BL2. Platform security is initialized to allow
+access to access controlled components. On the Base FVP a TrustZone controller
+(TZC-400) is configured to give full access to the platform DRAM. The storage
+abstraction layer is initialized which is used to load further bootloader
+images.
 
 #### BL3-1 (EL3 Runtime Firmware) image load
 
diff --git a/docs/porting-guide.md b/docs/porting-guide.md
index 868eb33..8a024d8 100644
--- a/docs/porting-guide.md
+++ b/docs/porting-guide.md
@@ -630,6 +630,10 @@
 this function. This information is accessible in the `bl33_meminfo` field in
 the `bl31_args` structure pointed to by `bl2_to_bl31_args`.
 
+Platform security components are configured if required. For the Base FVP the
+TZC-400 TrustZone controller is configured to grant secure and non-secure access
+to DRAM.
+
 This function is also responsible for initializing the storage abstraction layer
 which is used to load further bootloader images.
 
diff --git a/docs/user-guide.md b/docs/user-guide.md
index 39d09c1..1bb0fe9 100644
--- a/docs/user-guide.md
+++ b/docs/user-guide.md
@@ -532,9 +532,15 @@
 Package at the start of NOR FLASH0 (see the "Building the Trusted Firmware"
 section above).
 
+NOTE: Setting the `-C bp.secure_memory` parameter to `1` is only supported on
+FVP versions 5.4 and newer. Setting this parameter to `0` is also supported.
+The `-C bp.tzc_400.diagnostics=1` parameter is optional. It instructs the FVP to
+provide some helpful information if a secure memory violation occurs.
+
     <path-to>/FVP_Base_AEMv8A-AEMv8A                       \
     -C pctl.startup=0.0.0.0                                \
-    -C bp.secure_memory=0                                  \
+    -C bp.secure_memory=1                                  \
+    -C bp.tzc_400.diagnostics=1                            \
     -C cluster0.NUM_CORES=4                                \
     -C cluster1.NUM_CORES=4                                \
     -C cache_state_modelled=1                              \
@@ -560,9 +566,15 @@
 Package at the start of NOR FLASH0 (see the "Building the Trusted Firmware"
 section above).
 
+NOTE: Setting the `-C bp.secure_memory` parameter to `1` is only supported on
+FVP versions 5.4 and newer. Setting this parameter to `0` is also supported.
+The `-C bp.tzc_400.diagnostics=1` parameter is optional. It instructs the FVP to
+provide some helpful information if a secure memory violation occurs.
+
     <path-to>/FVP_Base_Cortex-A57x4-A53x4                  \
     -C pctl.startup=0.0.0.0                                \
-    -C bp.secure_memory=0                                  \
+    -C bp.secure_memory=1                                  \
+    -C bp.tzc_400.diagnostics=1                            \
     -C cache_state_modelled=1                              \
     -C bp.pl011_uart0.untimed_fifos=1                      \
     -C bp.secureflashloader.fname="<path-to>/<bl1-binary>" \
diff --git a/drivers/arm/interconnect/tzc-400/tzc400.c b/drivers/arm/interconnect/tzc-400/tzc400.c
new file mode 100644
index 0000000..b88e34a
--- /dev/null
+++ b/drivers/arm/interconnect/tzc-400/tzc400.c
@@ -0,0 +1,265 @@
+/*
+ * Copyright (c) 2014, ARM Limited and Contributors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of ARM nor the names of its contributors may be used
+ * to endorse or promote products derived from this software without specific
+ * prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <assert.h>
+#include "arch_helpers.h"
+#include "tzc400.h"
+#include "mmio.h"
+#include "debug.h"
+
+static uint32_t tzc_read_build_config(uint64_t base)
+{
+	return mmio_read_32(base + BUILD_CONFIG_OFF);
+}
+
+static uint32_t tzc_read_gate_keeper(uint64_t base)
+{
+	return mmio_read_32(base + GATE_KEEPER_OFF);
+}
+
+static void tzc_write_gate_keeper(uint64_t base, uint32_t val)
+{
+	mmio_write_32(base + GATE_KEEPER_OFF, val);
+}
+
+static void tzc_write_action(uint64_t base, enum tzc_action action)
+{
+	mmio_write_32(base + ACTION_OFF, action);
+}
+
+static void tzc_write_region_base_low(uint64_t base, uint32_t region, uint32_t val)
+{
+	mmio_write_32(base + REGION_BASE_LOW_OFF + REGION_NUM_OFF(region), val);
+}
+
+static void tzc_write_region_base_high(uint64_t base, uint32_t region, uint32_t val)
+{
+	mmio_write_32(base + REGION_BASE_HIGH_OFF + REGION_NUM_OFF(region), val);
+}
+
+static void tzc_write_region_top_low(uint64_t base, uint32_t region, uint32_t val)
+{
+	mmio_write_32(base + REGION_TOP_LOW_OFF + REGION_NUM_OFF(region), val);
+}
+
+static void tzc_write_region_top_high(uint64_t base, uint32_t region, uint32_t val)
+{
+	mmio_write_32(base + REGION_TOP_HIGH_OFF + REGION_NUM_OFF(region), val);
+}
+
+static void tzc_write_region_attributes(uint64_t base, uint32_t region, uint32_t val)
+{
+	mmio_write_32(base + REGION_ATTRIBUTES_OFF + REGION_NUM_OFF(region), val);
+}
+
+static void tzc_write_region_id_access(uint64_t base, uint32_t region, uint32_t val)
+{
+	mmio_write_32(base + REGION_ID_ACCESS_OFF + REGION_NUM_OFF(region), val);
+}
+
+static uint32_t tzc_read_component_id(uint64_t base)
+{
+	uint32_t id;
+
+	id = mmio_read_8(base + CID0_OFF);
+	id |= (mmio_read_8(base + CID1_OFF) << 8);
+	id |= (mmio_read_8(base + CID2_OFF) << 16);
+	id |= (mmio_read_8(base + CID3_OFF) << 24);
+
+	return id;
+}
+
+static uint32_t tzc_get_gate_keeper(uint64_t base, uint8_t filter)
+{
+	uint32_t tmp;
+
+	tmp = (tzc_read_gate_keeper(base) >> GATE_KEEPER_OS_SHIFT) &
+		GATE_KEEPER_OS_MASK;
+
+	return tmp >> filter;
+}
+
+/* This function is not MP safe. */
+static void tzc_set_gate_keeper(uint64_t base, uint8_t filter, uint32_t val)
+{
+	uint32_t tmp;
+
+	/* Upper half is current state. Lower half is requested state. */
+	tmp = (tzc_read_gate_keeper(base) >> GATE_KEEPER_OS_SHIFT) &
+		GATE_KEEPER_OS_MASK;
+
+	if (val)
+		tmp |=  (1 << filter);
+	else
+		tmp &= ~(1 << filter);
+
+	tzc_write_gate_keeper(base, (tmp & GATE_KEEPER_OR_MASK) <<
+			      GATE_KEEPER_OR_SHIFT);
+
+	/* Wait here until we see the change reflected in the TZC status. */
+	while (((tzc_read_gate_keeper(base) >> GATE_KEEPER_OS_SHIFT) &
+		GATE_KEEPER_OS_MASK) != tmp)
+	  ;
+}
+
+
+void tzc_init(struct tzc_instance *controller)
+{
+	uint32_t tzc_id, tzc_build;
+
+	assert(controller != NULL);
+
+	/*
+	 * We expect to see a tzc400. Check component ID. The TZC-400 TRM shows
+	 * component ID is expected to be "0xB105F00D".
+	 */
+	tzc_id = tzc_read_component_id(controller->base);
+	if (tzc_id != TZC400_COMPONENT_ID) {
+		ERROR("TZC : Wrong device ID (0x%x).\n", tzc_id);
+		panic();
+	}
+
+	/* Save values we will use later. */
+	tzc_build = tzc_read_build_config(controller->base);
+	controller->num_filters = ((tzc_build >> BUILD_CONFIG_NF_SHIFT) &
+			   BUILD_CONFIG_NF_MASK) + 1;
+	controller->addr_width  = ((tzc_build >> BUILD_CONFIG_AW_SHIFT) &
+			   BUILD_CONFIG_AW_MASK) + 1;
+	controller->num_regions = ((tzc_build >> BUILD_CONFIG_NR_SHIFT) &
+			   BUILD_CONFIG_NR_MASK) + 1;
+}
+
+
+/*
+ * `tzc_configure_region` is used to program regions into the TrustZone
+ * controller. A region can be associated with more than one filter. The
+ * associated filters are passed in as a bitmap (bit0 = filter0).
+ * NOTE:
+ * The region 0 covers the whole address space and is enabled on all filters,
+ * this cannot be changed. It is, however, possible to change some region 0
+ * permissions.
+ */
+void tzc_configure_region(const struct tzc_instance *controller,
+			  uint32_t filters,
+			  uint8_t  region,
+			  uint64_t region_base,
+			  uint64_t region_top,
+			  enum tzc_region_attributes sec_attr,
+			  uint32_t ns_device_access)
+{
+	uint64_t max_addr;
+
+	assert(controller != NULL);
+
+	/* Do range checks on filters and regions. */
+	assert(((filters >> controller->num_filters) == 0) &&
+	       (region < controller->num_regions));
+
+	/*
+	 * Do address range check based on TZC configuration. A 64bit address is
+	 * the max and expected case.
+	 */
+	max_addr = UINT64_MAX >> (64 - controller->addr_width);
+	if ((region_top > max_addr) || (region_base >= region_top))
+		assert(0);
+
+	/* region_base and (region_top + 1) must be 4KB aligned */
+	assert(((region_base | (region_top + 1)) & (4096 - 1)) == 0);
+
+	assert(sec_attr <= TZC_REGION_S_RDWR);
+
+	/*
+	 * Inputs look ok, start programming registers.
+	 * All the address registers are 32 bits wide and have a LOW and HIGH
+	 * component used to construct a up to a 64bit address.
+	 */
+	tzc_write_region_base_low(controller->base, region, (uint32_t)(region_base));
+	tzc_write_region_base_high(controller->base, region, (uint32_t)(region_base >> 32));
+
+	tzc_write_region_top_low(controller->base, region, (uint32_t)(region_top));
+	tzc_write_region_top_high(controller->base, region, (uint32_t)(region_top >> 32));
+
+	/* Assign the region to a filter and set secure attributes */
+	tzc_write_region_attributes(controller->base, region,
+		(sec_attr << REGION_ATTRIBUTES_SEC_SHIFT) | filters);
+
+	/*
+	 * Specify which non-secure devices have permission to access this
+	 * region.
+	 */
+	tzc_write_region_id_access(controller->base, region, ns_device_access);
+}
+
+
+void tzc_set_action(const struct tzc_instance *controller, enum tzc_action action)
+{
+	assert(controller != NULL);
+
+	/*
+	 * - Currently no handler is provided to trap an error via interrupt
+	 *   or exception.
+	 * - The interrupt action has not been tested.
+	 */
+	tzc_write_action(controller->base, action);
+}
+
+
+void tzc_enable_filters(const struct tzc_instance *controller)
+{
+	uint32_t state;
+	uint32_t filter;
+
+	assert(controller != NULL);
+
+	for (filter = 0; filter < controller->num_filters; filter++) {
+		state = tzc_get_gate_keeper(controller->base, filter);
+		if (state) {
+			ERROR("TZC : Filter %d Gatekeeper already enabled.\n",
+				filter);
+			panic();
+		}
+		tzc_set_gate_keeper(controller->base, filter, 1);
+	}
+}
+
+
+void tzc_disable_filters(const struct tzc_instance *controller)
+{
+	uint32_t filter;
+
+	assert(controller != NULL);
+
+	/*
+	 * We don't do the same state check as above as the Gatekeepers are
+	 * disabled after reset.
+	 */
+	for (filter = 0; filter < controller->num_filters; filter++)
+		tzc_set_gate_keeper(controller->base, filter, 0);
+}
diff --git a/drivers/arm/interconnect/tzc-400/tzc400.h b/drivers/arm/interconnect/tzc-400/tzc400.h
new file mode 100644
index 0000000..7eaafd2
--- /dev/null
+++ b/drivers/arm/interconnect/tzc-400/tzc400.h
@@ -0,0 +1,211 @@
+/*
+ * Copyright (c) 2014, ARM Limited and Contributors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of ARM nor the names of its contributors may be used
+ * to endorse or promote products derived from this software without specific
+ * prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __TZC400_H__
+#define __TZC400_H__
+
+#include <stdint.h>
+
+#define BUILD_CONFIG_OFF	0x000
+#define ACTION_OFF		0x004
+#define GATE_KEEPER_OFF		0x008
+#define SPECULATION_CTRL_OFF	0x00c
+#define INT_STATUS		0x010
+#define INT_CLEAR		0x014
+
+#define FAIL_ADDRESS_LOW_OFF	0x020
+#define FAIL_ADDRESS_HIGH_OFF	0x024
+#define FAIL_CONTROL_OFF	0x028
+#define FAIL_ID			0x02c
+
+#define REGION_BASE_LOW_OFF	0x100
+#define REGION_BASE_HIGH_OFF	0x104
+#define REGION_TOP_LOW_OFF	0x108
+#define REGION_TOP_HIGH_OFF	0x10c
+#define REGION_ATTRIBUTES_OFF	0x110
+#define REGION_ID_ACCESS_OFF	0x114
+#define REGION_NUM_OFF(region)  (0x20 * region)
+
+/* ID Registers */
+#define PID0_OFF		0xfe0
+#define PID1_OFF		0xfe4
+#define PID2_OFF		0xfe8
+#define PID3_OFF		0xfec
+#define PID4_OFF		0xfd0
+#define PID5_OFF		0xfd4
+#define PID6_OFF		0xfd8
+#define PID7_OFF		0xfdc
+#define CID0_OFF		0xff0
+#define CID1_OFF		0xff4
+#define CID2_OFF		0xff8
+#define CID3_OFF		0xffc
+
+#define BUILD_CONFIG_NF_SHIFT	24
+#define BUILD_CONFIG_NF_MASK	0x3
+#define BUILD_CONFIG_AW_SHIFT	8
+#define BUILD_CONFIG_AW_MASK	0x3f
+#define BUILD_CONFIG_NR_SHIFT	0
+#define BUILD_CONFIG_NR_MASK	0x1f
+
+/* Not describing the case where regions 1 to 8 overlap */
+#define ACTION_RV_SHIFT		0
+#define ACTION_RV_MASK		0x3
+#define  ACTION_RV_LOWOK	0x0
+#define  ACTION_RV_LOWERR	0x1
+#define  ACTION_RV_HIGHOK	0x2
+#define  ACTION_RV_HIGHERR	0x3
+
+/*
+ * Number of gate keepers is implementation defined. But we know the max for
+ * this device is 4. Get implementation details from BUILD_CONFIG.
+ */
+#define GATE_KEEPER_OS_SHIFT	16
+#define GATE_KEEPER_OS_MASK	0xf
+#define GATE_KEEPER_OR_SHIFT	0
+#define GATE_KEEPER_OR_MASK	0xf
+
+/* Speculation is enabled by default. */
+#define SPECULATION_CTRL_WRITE_DISABLE	(1 << 1)
+#define SPECULATION_CTRL_READ_DISABLE	(1 << 0)
+
+/* Max number of filters allowed is 4. */
+#define INT_STATUS_OVERLAP_SHIFT	16
+#define INT_STATUS_OVERLAP_MASK		0xf
+#define INT_STATUS_OVERRUN_SHIFT	8
+#define INT_STATUS_OVERRUN_MASK		0xf
+#define INT_STATUS_STATUS_SHIFT		0
+#define INT_STATUS_STATUS_MASK		0xf
+
+#define INT_CLEAR_CLEAR_SHIFT		0
+#define INT_CLEAR_CLEAR_MASK		0xf
+
+#define FAIL_CONTROL_DIR_SHIFT		(1 << 24)
+#define  FAIL_CONTROL_DIR_READ		0x0
+#define  FAIL_CONTROL_DIR_WRITE		0x1
+#define FAIL_CONTROL_NS_SHIFT		(1 << 21)
+#define  FAIL_CONTROL_NS_SECURE		0x0
+#define  FAIL_CONTROL_NS_NONSECURE	0x1
+#define FAIL_CONTROL_PRIV_SHIFT		(1 << 20)
+#define  FAIL_CONTROL_PRIV_PRIV		0x0
+#define  FAIL_CONTROL_PRIV_UNPRIV	0x1
+
+/*
+ * FAIL_ID_ID_MASK depends on AID_WIDTH which is platform specific.
+ * Platform should provide the value on initialisation.
+ */
+#define FAIL_ID_VNET_SHIFT		24
+#define FAIL_ID_VNET_MASK		0xf
+#define FAIL_ID_ID_SHIFT		0
+
+/* Used along with 'tzc_region_attributes_t' below */
+#define REGION_ATTRIBUTES_SEC_SHIFT	30
+#define REGION_ATTRIBUTES_F_EN_SHIFT	0
+#define REGION_ATTRIBUTES_F_EN_MASK	0xf
+
+#define REGION_ID_ACCESS_NSAID_WR_EN_SHIFT	16
+#define REGION_ID_ACCESS_NSAID_RD_EN_SHIFT	0
+#define REGION_ID_ACCESS_NSAID_ID_MASK		0xf
+
+
+/* Macros for setting Region ID access permissions based on NSAID */
+#define TZC_REGION_ACCESS_RD(id)					\
+		((1 << (id & REGION_ID_ACCESS_NSAID_ID_MASK)) <<	\
+		 REGION_ID_ACCESS_NSAID_RD_EN_SHIFT)
+#define TZC_REGION_ACCESS_WR(id)					\
+		((1 << (id & REGION_ID_ACCESS_NSAID_ID_MASK)) <<	\
+		 REGION_ID_ACCESS_NSAID_WR_EN_SHIFT)
+#define TZC_REGION_ACCESS_RDWR(id)					\
+		(TZC_REGION_ACCESS_RD(id) | TZC_REGION_ACCESS_WR(id))
+
+/* Filters are bit mapped 0 to 3. */
+#define TZC400_COMPONENT_ID	0xb105f00d
+
+#ifndef __ASSEMBLY__
+
+/*******************************************************************************
+ * Function & variable prototypes
+ ******************************************************************************/
+
+/*
+ * What type of action is expected when an access violation occurs.
+ * The memory requested is zeroed. But we can also raise and event to
+ * let the system know it happened.
+ * We can raise an interrupt(INT) and/or cause an exception(ERR).
+ *  TZC_ACTION_NONE    - No interrupt, no Exception
+ *  TZC_ACTION_ERR     - No interrupt, raise exception -> sync external
+ *                       data abort
+ *  TZC_ACTION_INT     - Raise interrupt, no exception
+ *  TZC_ACTION_ERR_INT - Raise interrupt, raise exception -> sync
+ *                       external data abort
+ */
+enum tzc_action {
+	TZC_ACTION_NONE = 0,
+	TZC_ACTION_ERR = 1,
+	TZC_ACTION_INT = 2,
+	TZC_ACTION_ERR_INT = (TZC_ACTION_ERR | TZC_ACTION_INT)
+};
+
+/*
+ * Controls secure access to a region. If not enabled secure access is not
+ * allowed to region.
+ */
+enum tzc_region_attributes {
+	TZC_REGION_S_NONE = 0,
+	TZC_REGION_S_RD = 1,
+	TZC_REGION_S_WR = 2,
+	TZC_REGION_S_RDWR = (TZC_REGION_S_RD | TZC_REGION_S_WR)
+};
+
+/*
+ * Implementation defined values used to validate inputs later.
+ * Filters : max of 4 ; 0 to 3
+ * Regions : max of 9 ; 0 to 8
+ * Address width : Values between 32 to 64
+ */
+struct tzc_instance {
+	uint64_t base;
+	uint32_t aid_width;
+	uint8_t addr_width;
+	uint8_t num_filters;
+	uint8_t num_regions;
+};
+
+void tzc_init(struct tzc_instance *controller);
+void tzc_configure_region(const struct tzc_instance *controller, uint32_t filters,
+	uint8_t region, uint64_t region_base, uint64_t region_top,
+	enum tzc_region_attributes sec_attr, uint32_t ns_device_access);
+void tzc_enable_filters(const struct tzc_instance *controller);
+void tzc_disable_filters(const struct tzc_instance *controller);
+void tzc_set_action(const struct tzc_instance *controller,
+	enum tzc_action action);
+
+#endif /*__ASSEMBLY__*/
+
+#endif /* __TZC400__ */
diff --git a/fdts/fvp-base-gicv2-psci.dtb b/fdts/fvp-base-gicv2-psci.dtb
index 5bfdcf1..abdb9a0 100644
--- a/fdts/fvp-base-gicv2-psci.dtb
+++ b/fdts/fvp-base-gicv2-psci.dtb
Binary files differ
diff --git a/fdts/fvp-base-gicv2-psci.dts b/fdts/fvp-base-gicv2-psci.dts
index 7924651..7d08922 100644
--- a/fdts/fvp-base-gicv2-psci.dts
+++ b/fdts/fvp-base-gicv2-psci.dts
@@ -147,10 +147,10 @@
 			#address-cells = <2>;
 			#size-cells = <2>;
 			ranges;
-			frame@2a820000 {
-				frame-number = <0>;
-				interrupts = <0 25 4>;
-				reg = <0x0 0x2a820000 0x0 0x10000>;
+			frame@2a830000 {
+				frame-number = <1>;
+				interrupts = <0 26 4>;
+				reg = <0x0 0x2a830000 0x0 0x10000>;
 			};
 	};
 
diff --git a/fdts/fvp-base-gicv2legacy-psci.dtb b/fdts/fvp-base-gicv2legacy-psci.dtb
index db17e98..3fc6b3e 100644
--- a/fdts/fvp-base-gicv2legacy-psci.dtb
+++ b/fdts/fvp-base-gicv2legacy-psci.dtb
Binary files differ
diff --git a/fdts/fvp-base-gicv2legacy-psci.dts b/fdts/fvp-base-gicv2legacy-psci.dts
index cfd50a7..f095231 100644
--- a/fdts/fvp-base-gicv2legacy-psci.dts
+++ b/fdts/fvp-base-gicv2legacy-psci.dts
@@ -147,10 +147,10 @@
 			#address-cells = <2>;
 			#size-cells = <2>;
 			ranges;
-			frame@2a820000 {
-				frame-number = <0>;
-				interrupts = <0 25 4>;
-				reg = <0x0 0x2a820000 0x0 0x10000>;
+			frame@2a830000 {
+				frame-number = <1>;
+				interrupts = <0 26 4>;
+				reg = <0x0 0x2a830000 0x0 0x10000>;
 			};
 	};
 
diff --git a/fdts/fvp-base-gicv3-psci.dtb b/fdts/fvp-base-gicv3-psci.dtb
index 52f251b..1efa136 100644
--- a/fdts/fvp-base-gicv3-psci.dtb
+++ b/fdts/fvp-base-gicv3-psci.dtb
Binary files differ
diff --git a/fdts/fvp-base-gicv3-psci.dts b/fdts/fvp-base-gicv3-psci.dts
index 84faeba..96d264e 100644
--- a/fdts/fvp-base-gicv3-psci.dts
+++ b/fdts/fvp-base-gicv3-psci.dts
@@ -156,10 +156,10 @@
 			#address-cells = <2>;
 			#size-cells = <2>;
 			ranges;
-			frame@2a820000 {
-				frame-number = <0>;
-				interrupts = <0 25 4>;
-				reg = <0x0 0x2a820000 0x0 0x10000>;
+			frame@2a830000 {
+				frame-number = <1>;
+				interrupts = <0 26 4>;
+				reg = <0x0 0x2a830000 0x0 0x10000>;
 			};
 	};
 
diff --git a/fdts/fvp-foundation-gicv2-psci.dtb b/fdts/fvp-foundation-gicv2-psci.dtb
index d982e85..ca10088 100644
--- a/fdts/fvp-foundation-gicv2-psci.dtb
+++ b/fdts/fvp-foundation-gicv2-psci.dtb
Binary files differ
diff --git a/fdts/fvp-foundation-gicv2-psci.dts b/fdts/fvp-foundation-gicv2-psci.dts
index c886f5d..bf368a0 100644
--- a/fdts/fvp-foundation-gicv2-psci.dts
+++ b/fdts/fvp-foundation-gicv2-psci.dts
@@ -36,7 +36,7 @@
 };
 
 / {
-	model = "FVP Base";
+	model = "FVP Foundation";
 	compatible = "arm,fvp-base", "arm,vexpress";
 	interrupt-parent = <&gic>;
 	#address-cells = <2>;
@@ -123,10 +123,10 @@
 			#address-cells = <2>;
 			#size-cells = <2>;
 			ranges;
-			frame@2a820000 {
-				frame-number = <0>;
-				interrupts = <0 25 4>;
-				reg = <0x0 0x2a820000 0x0 0x10000>;
+			frame@2a830000 {
+				frame-number = <1>;
+				interrupts = <0 26 4>;
+				reg = <0x0 0x2a830000 0x0 0x10000>;
 			};
 	};
 
diff --git a/fdts/fvp-foundation-gicv2legacy-psci.dtb b/fdts/fvp-foundation-gicv2legacy-psci.dtb
index 849e68a..a602ff5 100644
--- a/fdts/fvp-foundation-gicv2legacy-psci.dtb
+++ b/fdts/fvp-foundation-gicv2legacy-psci.dtb
Binary files differ
diff --git a/fdts/fvp-foundation-gicv2legacy-psci.dts b/fdts/fvp-foundation-gicv2legacy-psci.dts
index b62ef2b..63cef80 100644
--- a/fdts/fvp-foundation-gicv2legacy-psci.dts
+++ b/fdts/fvp-foundation-gicv2legacy-psci.dts
@@ -36,7 +36,7 @@
 };
 
 / {
-	model = "FVP Base";
+	model = "FVP Foundation";
 	compatible = "arm,fvp-base", "arm,vexpress";
 	interrupt-parent = <&gic>;
 	#address-cells = <2>;
@@ -123,10 +123,10 @@
 			#address-cells = <2>;
 			#size-cells = <2>;
 			ranges;
-			frame@2a820000 {
-				frame-number = <0>;
-				interrupts = <0 25 4>;
-				reg = <0x0 0x2a820000 0x0 0x10000>;
+			frame@2a830000 {
+				frame-number = <1>;
+				interrupts = <0 26 4>;
+				reg = <0x0 0x2a830000 0x0 0x10000>;
 			};
 	};
 
diff --git a/fdts/fvp-foundation-gicv3-psci.dtb b/fdts/fvp-foundation-gicv3-psci.dtb
index c6472e0..f64e421 100644
--- a/fdts/fvp-foundation-gicv3-psci.dtb
+++ b/fdts/fvp-foundation-gicv3-psci.dtb
Binary files differ
diff --git a/fdts/fvp-foundation-gicv3-psci.dts b/fdts/fvp-foundation-gicv3-psci.dts
index 1bf7234..f9f1ff3 100644
--- a/fdts/fvp-foundation-gicv3-psci.dts
+++ b/fdts/fvp-foundation-gicv3-psci.dts
@@ -36,7 +36,7 @@
 };
 
 / {
-	model = "FVP Base";
+	model = "FVP Foundation";
 	compatible = "arm,fvp-base", "arm,vexpress";
 	interrupt-parent = <&gic>;
 	#address-cells = <2>;
@@ -132,10 +132,10 @@
 			#address-cells = <2>;
 			#size-cells = <2>;
 			ranges;
-			frame@2a820000 {
-				frame-number = <0>;
-				interrupts = <0 25 4>;
-				reg = <0x0 0x2a820000 0x0 0x10000>;
+			frame@2a830000 {
+				frame-number = <1>;
+				interrupts = <0 26 4>;
+				reg = <0x0 0x2a830000 0x0 0x10000>;
 			};
 	};
 
diff --git a/include/mmio.h b/include/mmio.h
index 313448e..c79c3f5 100644
--- a/include/mmio.h
+++ b/include/mmio.h
@@ -35,6 +35,9 @@
 
 #include <stdint.h>
 
+extern void mmio_write_8(uintptr_t addr, uint8_t value);
+extern uint8_t mmio_read_8(uintptr_t addr);
+
 extern void mmio_write_32(uintptr_t addr, uint32_t value);
 extern uint32_t mmio_read_32(uintptr_t addr);
 
diff --git a/lib/mmio.c b/lib/mmio.c
index b654be7..1350609 100644
--- a/lib/mmio.c
+++ b/lib/mmio.c
@@ -30,6 +30,16 @@
 
 #include <stdint.h>
 
+void mmio_write_8(uintptr_t addr, uint8_t value)
+{
+	*(volatile uint8_t*)addr = value;
+}
+
+uint8_t mmio_read_8(uintptr_t addr)
+{
+	return *(volatile uint8_t*)addr;
+}
+
 void mmio_write_32(uintptr_t addr, uint32_t value)
 {
 	*(volatile uint32_t*)addr = value;
diff --git a/plat/fvp/aarch64/plat_common.c b/plat/fvp/aarch64/plat_common.c
index 16645cb..dd362f0 100644
--- a/plat/fvp/aarch64/plat_common.c
+++ b/plat/fvp/aarch64/plat_common.c
@@ -220,6 +220,7 @@
 		platform_config[CONFIG_CPU_SETUP] = 0;
 		platform_config[CONFIG_BASE_MMAP] = 0;
 		platform_config[CONFIG_HAS_CCI] = 0;
+		platform_config[CONFIG_HAS_TZC] = 0;
 		break;
 	case HBI_FVP_BASE:
 		midr_pn = (read_midr() >> MIDR_PN_SHIFT) & MIDR_PN_MASK;
@@ -232,6 +233,7 @@
 		platform_config[CONFIG_MAX_AFF1] = 2;
 		platform_config[CONFIG_BASE_MMAP] = 1;
 		platform_config[CONFIG_HAS_CCI] = 1;
+		platform_config[CONFIG_HAS_TZC] = 1;
 		break;
 	default:
 		assert(0);
diff --git a/plat/fvp/bl2_plat_setup.c b/plat/fvp/bl2_plat_setup.c
index 4d57ed5..da6a485 100644
--- a/plat/fvp/bl2_plat_setup.c
+++ b/plat/fvp/bl2_plat_setup.c
@@ -122,6 +122,14 @@
  ******************************************************************************/
 void bl2_platform_setup()
 {
+	/*
+	 * Do initial security configuration to allow DRAM/device access. On
+	 * Base FVP only DRAM security is programmable (via TrustZone), but
+	 * other platforms might have more programmable security devices
+	 * present.
+	 */
+	plat_security_setup();
+
 	/* Initialise the IO layer and register platform IO devices */
 	io_setup();
 
diff --git a/plat/fvp/plat_security.c b/plat/fvp/plat_security.c
new file mode 100644
index 0000000..a60eca3
--- /dev/null
+++ b/plat/fvp/plat_security.c
@@ -0,0 +1,131 @@
+/*
+ * Copyright (c) 2014, ARM Limited and Contributors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of ARM nor the names of its contributors may be used
+ * to endorse or promote products derived from this software without specific
+ * prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <assert.h>
+#include "platform.h"
+#include "tzc400.h"
+#include "debug.h"
+
+/* Used to improve readability for configuring regions. */
+#define FILTER_SHIFT(filter)	(1 << filter)
+
+/*
+ * For the moment we assume that all security programming is done by the
+ * primary core.
+ * TODO:
+ * Might want to enable interrupt on violations when supported?
+ */
+void plat_security_setup(void)
+{
+	struct tzc_instance controller;
+
+	/*
+	 * The Base FVP has a TrustZone address space controller, the Foundation
+	 * FVP does not. Trying to program the device on the foundation FVP will
+	 * cause an abort.
+	 *
+	 * If the platform had additional peripheral specific security
+	 * configurations, those would be configured here.
+	 */
+
+	if (!platform_get_cfgvar(CONFIG_HAS_TZC))
+		return;
+
+	/*
+	 * The TrustZone controller controls access to main DRAM. Give
+	 * full NS access for the moment to use with OS.
+	 */
+	INFO("Configuring TrustZone Controller\n");
+
+	/*
+	 * The driver does some error checking and will assert.
+	 * - Provide base address of device on platform.
+	 * - Provide width of ACE-Lite IDs on platform.
+	 */
+	controller.base = TZC400_BASE;
+	controller.aid_width = FVP_AID_WIDTH;
+	tzc_init(&controller);
+
+	/*
+	 * Currently only filters 0 and 2 are connected on Base FVP.
+	 * Filter 0 : CPU clusters (no access to DRAM by default)
+	 * Filter 1 : not connected
+	 * Filter 2 : LCDs (access to VRAM allowed by default)
+	 * Filter 3 : not connected
+	 * Programming unconnected filters will have no effect at the
+	 * moment. These filter could, however, be connected in future.
+	 * So care should be taken not to configure the unused filters.
+	 */
+
+	/* Disable all filters before programming. */
+	tzc_disable_filters(&controller);
+
+	/*
+	 * Allow full access to all DRAM to supported devices for the
+	 * moment. Give access to the CPUs and Virtio. Some devices
+	 * would normally use the default ID so allow that too. We use
+	 * three different regions to cover the three separate blocks of
+	 * memory in the FVPs. We allow secure access to DRAM to load NS
+	 * software.
+	 * FIXME: In current models Virtio uses a reserved ID. This is
+	 * not correct and will be fixed.
+	 */
+
+	/* Set to cover 2GB block of DRAM */
+	tzc_configure_region(&controller, FILTER_SHIFT(0), 1,
+			DRAM_BASE, 0xFFFFFFFF, TZC_REGION_S_RDWR,
+			TZC_REGION_ACCESS_RDWR(FVP_NSAID_AP) |
+			TZC_REGION_ACCESS_RDWR(FVP_NSAID_DEFAULT) |
+			TZC_REGION_ACCESS_RDWR(FVP_NSAID_RES5));
+
+	/* Set to cover the 30GB block */
+	tzc_configure_region(&controller, FILTER_SHIFT(0), 2,
+			0x880000000, 0xFFFFFFFFF, TZC_REGION_S_RDWR,
+			TZC_REGION_ACCESS_RDWR(FVP_NSAID_AP) |
+			TZC_REGION_ACCESS_RDWR(FVP_NSAID_DEFAULT) |
+			TZC_REGION_ACCESS_RDWR(FVP_NSAID_RES5));
+
+	/* Set to cover 480GB block */
+	tzc_configure_region(&controller, FILTER_SHIFT(0), 3,
+			0x8800000000, 0xFFFFFFFFFF, TZC_REGION_S_RDWR,
+			TZC_REGION_ACCESS_RDWR(FVP_NSAID_AP) |
+			TZC_REGION_ACCESS_RDWR(FVP_NSAID_DEFAULT) |
+			TZC_REGION_ACCESS_RDWR(FVP_NSAID_RES5));
+
+	/*
+	 * TODO: Interrupts are not currently supported. The only
+	 * options we have are for access errors to occur quietly or to
+	 * cause an exception. We choose to cause an exception.
+	 */
+	tzc_set_action(&controller, TZC_ACTION_ERR);
+
+	/* Enable filters. */
+	tzc_enable_filters(&controller);
+}
diff --git a/plat/fvp/platform.h b/plat/fvp/platform.h
index c594357..01b995b 100644
--- a/plat/fvp/platform.h
+++ b/plat/fvp/platform.h
@@ -99,7 +99,8 @@
 #define CONFIG_BASE_MMAP		7
 /* Indicates whether CCI should be enabled on the platform. */
 #define CONFIG_HAS_CCI			8
-#define CONFIG_LIMIT			9
+#define CONFIG_HAS_TZC			9
+#define CONFIG_LIMIT			10
 
 /*******************************************************************************
  * Platform memory map related constants
@@ -303,6 +304,28 @@
 #define PL011_UART3_BASE		0x1c0c0000
 #define PL011_BASE			PL011_UART0_BASE
 
+
+/*******************************************************************************
+ * TrustZone address space controller related constants
+ ******************************************************************************/
+#define TZC400_BASE			0x2a4a0000
+
+/*
+ * The NSAIDs for this platform as used to program the TZC400.
+ * TODO:
+ * This list and the numbers in it is still changing on the Base FVP.
+ * For now only specify the NSAIDs we actually use.
+ */
+
+/* The FVP has 4 bits of NSAIDs. Used with TZC FAIL_ID (ACE Lite ID width) */
+#define FVP_AID_WIDTH			4
+#define FVP_NSAID_DEFAULT		0
+#define FVP_NSAID_AP			9  /* Application Processors */
+
+/* FIXME: Currently incorrectly used by Virtio */
+#define FVP_NSAID_RES5			15
+
+
 /*******************************************************************************
  * Declarations and constants to access the mailboxes safely. Each mailbox is
  * aligned on the biggest cache line size in the platform. This is known only
@@ -374,6 +397,10 @@
 extern int plat_get_image_source(const char *image_name,
 		io_dev_handle *dev_handle, void **image_spec);
 
+/* Declarations for plat_security.c */
+extern void plat_security_setup(void);
+
+
 #endif /*__ASSEMBLY__*/
 
 #endif /* __PLATFORM_H__ */
diff --git a/plat/fvp/platform.mk b/plat/fvp/platform.mk
index 36090f2..0fc45de 100644
--- a/plat/fvp/platform.mk
+++ b/plat/fvp/platform.mk
@@ -29,6 +29,7 @@
 #
 
 PLAT_INCLUDES		:=	-Idrivers/arm/interconnect/cci-400	\
+				-Idrivers/arm/interconnect/tzc-400	\
 				-Idrivers/console			\
 				-Idrivers/arm/peripherals/pl011		\
 				-Idrivers/power
@@ -43,6 +44,7 @@
 PLAT_BL1_S_VPATH	:=	lib/semihosting/${ARCH}
 
 PLAT_BL2_C_VPATH	:=	drivers/arm/interconnect/cci-400	\
+				drivers/arm/interconnect/tzc-400	\
 				drivers/arm/peripherals/pl011		\
 				lib/arch/${ARCH}			\
 				lib/stdlib				\
@@ -82,7 +84,9 @@
 
 BL2_SOURCES		+=	bl2_plat_setup.c			\
 				platform_up_stack.S			\
-				plat_common.c
+				plat_common.c				\
+				plat_security.c				\
+				tzc400.c
 
 BL31_SOURCES		+=	bl31_plat_setup.c			\
 				plat_helpers.S				\