Dan Handley | 9df4804 | 2015-03-19 18:58:55 +0000 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (c) 2014-2015, ARM Limited and Contributors. All rights reserved. |
| 3 | * |
dp-arm | fa3cf0b | 2017-05-03 09:38:09 +0100 | [diff] [blame] | 4 | * SPDX-License-Identifier: BSD-3-Clause |
Dan Handley | 9df4804 | 2015-03-19 18:58:55 +0000 | [diff] [blame] | 5 | */ |
| 6 | |
| 7 | #include <arm_def.h> |
| 8 | #include <debug.h> |
| 9 | #include <platform_def.h> |
| 10 | #include <tzc400.h> |
| 11 | |
| 12 | |
| 13 | /* Weak definitions may be overridden in specific ARM standard platform */ |
| 14 | #pragma weak plat_arm_security_setup |
| 15 | |
| 16 | |
| 17 | /******************************************************************************* |
| 18 | * Initialize the TrustZone Controller for ARM standard platforms. |
Sandrine Bailleux | 03897bb | 2015-11-26 16:31:34 +0000 | [diff] [blame] | 19 | * Configure: |
| 20 | * - Region 0 with no access; |
| 21 | * - Region 1 with secure access only; |
| 22 | * - the remaining DRAM regions access from the given Non-Secure masters. |
| 23 | * |
| 24 | * When booting an EL3 payload, this is simplified: we configure region 0 with |
| 25 | * secure access only and do not enable any other region. |
Dan Handley | 9df4804 | 2015-03-19 18:58:55 +0000 | [diff] [blame] | 26 | ******************************************************************************/ |
Soby Mathew | 9c708b5 | 2016-02-26 14:23:19 +0000 | [diff] [blame] | 27 | void arm_tzc400_setup(void) |
Dan Handley | 9df4804 | 2015-03-19 18:58:55 +0000 | [diff] [blame] | 28 | { |
| 29 | INFO("Configuring TrustZone Controller\n"); |
| 30 | |
Soby Mathew | 9c708b5 | 2016-02-26 14:23:19 +0000 | [diff] [blame] | 31 | tzc400_init(PLAT_ARM_TZC_BASE); |
Dan Handley | 9df4804 | 2015-03-19 18:58:55 +0000 | [diff] [blame] | 32 | |
| 33 | /* Disable filters. */ |
Soby Mathew | 9c708b5 | 2016-02-26 14:23:19 +0000 | [diff] [blame] | 34 | tzc400_disable_filters(); |
Dan Handley | 9df4804 | 2015-03-19 18:58:55 +0000 | [diff] [blame] | 35 | |
Sandrine Bailleux | 03897bb | 2015-11-26 16:31:34 +0000 | [diff] [blame] | 36 | #ifndef EL3_PAYLOAD_BASE |
Dan Handley | 9df4804 | 2015-03-19 18:58:55 +0000 | [diff] [blame] | 37 | /* Region 0 set to no access by default */ |
Soby Mathew | 9c708b5 | 2016-02-26 14:23:19 +0000 | [diff] [blame] | 38 | tzc400_configure_region0(TZC_REGION_S_NONE, 0); |
Dan Handley | 9df4804 | 2015-03-19 18:58:55 +0000 | [diff] [blame] | 39 | |
| 40 | /* Region 1 set to cover Secure part of DRAM */ |
Soby Mathew | 9c708b5 | 2016-02-26 14:23:19 +0000 | [diff] [blame] | 41 | tzc400_configure_region(PLAT_ARM_TZC_FILTERS, 1, |
Dan Handley | 9df4804 | 2015-03-19 18:58:55 +0000 | [diff] [blame] | 42 | ARM_AP_TZC_DRAM1_BASE, ARM_AP_TZC_DRAM1_END, |
| 43 | TZC_REGION_S_RDWR, |
| 44 | 0); |
| 45 | |
| 46 | /* Region 2 set to cover Non-Secure access to 1st DRAM address range. |
| 47 | * Apply the same configuration to given filters in the TZC. */ |
Soby Mathew | 9c708b5 | 2016-02-26 14:23:19 +0000 | [diff] [blame] | 48 | tzc400_configure_region(PLAT_ARM_TZC_FILTERS, 2, |
Dan Handley | 9df4804 | 2015-03-19 18:58:55 +0000 | [diff] [blame] | 49 | ARM_NS_DRAM1_BASE, ARM_NS_DRAM1_END, |
| 50 | TZC_REGION_S_NONE, |
| 51 | PLAT_ARM_TZC_NS_DEV_ACCESS); |
| 52 | |
| 53 | /* Region 3 set to cover Non-Secure access to 2nd DRAM address range */ |
Soby Mathew | 9c708b5 | 2016-02-26 14:23:19 +0000 | [diff] [blame] | 54 | tzc400_configure_region(PLAT_ARM_TZC_FILTERS, 3, |
Dan Handley | 9df4804 | 2015-03-19 18:58:55 +0000 | [diff] [blame] | 55 | ARM_DRAM2_BASE, ARM_DRAM2_END, |
| 56 | TZC_REGION_S_NONE, |
| 57 | PLAT_ARM_TZC_NS_DEV_ACCESS); |
Sandrine Bailleux | 03897bb | 2015-11-26 16:31:34 +0000 | [diff] [blame] | 58 | #else |
| 59 | /* Allow secure access only to DRAM for EL3 payloads. */ |
Soby Mathew | 9c708b5 | 2016-02-26 14:23:19 +0000 | [diff] [blame] | 60 | tzc400_configure_region0(TZC_REGION_S_RDWR, 0); |
Sandrine Bailleux | 03897bb | 2015-11-26 16:31:34 +0000 | [diff] [blame] | 61 | #endif /* EL3_PAYLOAD_BASE */ |
Dan Handley | 9df4804 | 2015-03-19 18:58:55 +0000 | [diff] [blame] | 62 | |
| 63 | /* |
| 64 | * Raise an exception if a NS device tries to access secure memory |
| 65 | * TODO: Add interrupt handling support. |
| 66 | */ |
Soby Mathew | 9c708b5 | 2016-02-26 14:23:19 +0000 | [diff] [blame] | 67 | tzc400_set_action(TZC_ACTION_ERR); |
Dan Handley | 9df4804 | 2015-03-19 18:58:55 +0000 | [diff] [blame] | 68 | |
| 69 | /* Enable filters. */ |
Soby Mathew | 9c708b5 | 2016-02-26 14:23:19 +0000 | [diff] [blame] | 70 | tzc400_enable_filters(); |
Dan Handley | 9df4804 | 2015-03-19 18:58:55 +0000 | [diff] [blame] | 71 | } |
| 72 | |
| 73 | void plat_arm_security_setup(void) |
| 74 | { |
Soby Mathew | 9c708b5 | 2016-02-26 14:23:19 +0000 | [diff] [blame] | 75 | arm_tzc400_setup(); |
Dan Handley | 9df4804 | 2015-03-19 18:58:55 +0000 | [diff] [blame] | 76 | } |