blob: c09814e079da121179233657324d8a9ead6b61df [file] [log] [blame]
Dan Handley9df48042015-03-19 18:58:55 +00001/*
2 * Copyright (c) 2014-2015, ARM Limited and Contributors. All rights reserved.
3 *
dp-armfa3cf0b2017-05-03 09:38:09 +01004 * SPDX-License-Identifier: BSD-3-Clause
Dan Handley9df48042015-03-19 18:58:55 +00005 */
6
7#include <arm_def.h>
8#include <debug.h>
9#include <platform_def.h>
10#include <tzc400.h>
11
12
13/* Weak definitions may be overridden in specific ARM standard platform */
14#pragma weak plat_arm_security_setup
15
16
17/*******************************************************************************
18 * Initialize the TrustZone Controller for ARM standard platforms.
Sandrine Bailleux03897bb2015-11-26 16:31:34 +000019 * Configure:
20 * - Region 0 with no access;
21 * - Region 1 with secure access only;
22 * - the remaining DRAM regions access from the given Non-Secure masters.
23 *
24 * When booting an EL3 payload, this is simplified: we configure region 0 with
25 * secure access only and do not enable any other region.
Dan Handley9df48042015-03-19 18:58:55 +000026 ******************************************************************************/
Soby Mathew9c708b52016-02-26 14:23:19 +000027void arm_tzc400_setup(void)
Dan Handley9df48042015-03-19 18:58:55 +000028{
29 INFO("Configuring TrustZone Controller\n");
30
Soby Mathew9c708b52016-02-26 14:23:19 +000031 tzc400_init(PLAT_ARM_TZC_BASE);
Dan Handley9df48042015-03-19 18:58:55 +000032
33 /* Disable filters. */
Soby Mathew9c708b52016-02-26 14:23:19 +000034 tzc400_disable_filters();
Dan Handley9df48042015-03-19 18:58:55 +000035
Sandrine Bailleux03897bb2015-11-26 16:31:34 +000036#ifndef EL3_PAYLOAD_BASE
Dan Handley9df48042015-03-19 18:58:55 +000037 /* Region 0 set to no access by default */
Soby Mathew9c708b52016-02-26 14:23:19 +000038 tzc400_configure_region0(TZC_REGION_S_NONE, 0);
Dan Handley9df48042015-03-19 18:58:55 +000039
40 /* Region 1 set to cover Secure part of DRAM */
Soby Mathew9c708b52016-02-26 14:23:19 +000041 tzc400_configure_region(PLAT_ARM_TZC_FILTERS, 1,
Dan Handley9df48042015-03-19 18:58:55 +000042 ARM_AP_TZC_DRAM1_BASE, ARM_AP_TZC_DRAM1_END,
43 TZC_REGION_S_RDWR,
44 0);
45
46 /* Region 2 set to cover Non-Secure access to 1st DRAM address range.
47 * Apply the same configuration to given filters in the TZC. */
Soby Mathew9c708b52016-02-26 14:23:19 +000048 tzc400_configure_region(PLAT_ARM_TZC_FILTERS, 2,
Dan Handley9df48042015-03-19 18:58:55 +000049 ARM_NS_DRAM1_BASE, ARM_NS_DRAM1_END,
50 TZC_REGION_S_NONE,
51 PLAT_ARM_TZC_NS_DEV_ACCESS);
52
53 /* Region 3 set to cover Non-Secure access to 2nd DRAM address range */
Soby Mathew9c708b52016-02-26 14:23:19 +000054 tzc400_configure_region(PLAT_ARM_TZC_FILTERS, 3,
Dan Handley9df48042015-03-19 18:58:55 +000055 ARM_DRAM2_BASE, ARM_DRAM2_END,
56 TZC_REGION_S_NONE,
57 PLAT_ARM_TZC_NS_DEV_ACCESS);
Sandrine Bailleux03897bb2015-11-26 16:31:34 +000058#else
59 /* Allow secure access only to DRAM for EL3 payloads. */
Soby Mathew9c708b52016-02-26 14:23:19 +000060 tzc400_configure_region0(TZC_REGION_S_RDWR, 0);
Sandrine Bailleux03897bb2015-11-26 16:31:34 +000061#endif /* EL3_PAYLOAD_BASE */
Dan Handley9df48042015-03-19 18:58:55 +000062
63 /*
64 * Raise an exception if a NS device tries to access secure memory
65 * TODO: Add interrupt handling support.
66 */
Soby Mathew9c708b52016-02-26 14:23:19 +000067 tzc400_set_action(TZC_ACTION_ERR);
Dan Handley9df48042015-03-19 18:58:55 +000068
69 /* Enable filters. */
Soby Mathew9c708b52016-02-26 14:23:19 +000070 tzc400_enable_filters();
Dan Handley9df48042015-03-19 18:58:55 +000071}
72
73void plat_arm_security_setup(void)
74{
Soby Mathew9c708b52016-02-26 14:23:19 +000075 arm_tzc400_setup();
Dan Handley9df48042015-03-19 18:58:55 +000076}