1 /*
2 * Copyright (c) 2014-2015, ARM Limited and Contributors. All rights reserved.
3 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 */
6
7 #include <arm_def.h>
8 #include <debug.h>
9 #include <platform_def.h>
10 #include <tzc400.h>
11
12
13 /* Weak definitions may be overridden in specific ARM standard platform */
14 #pragma weak plat_arm_security_setup
15
16
17 /*******************************************************************************
18 * Initialize the TrustZone Controller for ARM standard platforms.
19 * Configure:
20 * - Region 0 with no access;
21 * - Region 1 with secure access only;
22 * - the remaining DRAM regions access from the given Non-Secure masters.
23 *
24 * When booting an EL3 payload, this is simplified: we configure region 0 with
25 * secure access only and do not enable any other region.
26 ******************************************************************************/
arm_tzc400_setup(void)27 void arm_tzc400_setup(void)
28 {
29 INFO("Configuring TrustZone Controller\n");
30
31 tzc400_init(PLAT_ARM_TZC_BASE);
32
33 /* Disable filters. */
34 tzc400_disable_filters();
35
36 #ifndef EL3_PAYLOAD_BASE
37
38 /* Region 0 set to no access by default */
39 tzc400_configure_region0(TZC_REGION_S_NONE, 0);
40
41 /* Region 1 set to cover Secure part of DRAM */
42 tzc400_configure_region(PLAT_ARM_TZC_FILTERS, 1,
43 ARM_AP_TZC_DRAM1_BASE, ARM_EL3_TZC_DRAM1_END,
44 TZC_REGION_S_RDWR,
45 0);
46
47 /* Region 2 set to cover Non-Secure access to 1st DRAM address range.
48 * Apply the same configuration to given filters in the TZC. */
49 tzc400_configure_region(PLAT_ARM_TZC_FILTERS, 2,
50 ARM_NS_DRAM1_BASE, ARM_NS_DRAM1_END,
51 ARM_TZC_NS_DRAM_S_ACCESS,
52 PLAT_ARM_TZC_NS_DEV_ACCESS);
53
54 /* Region 3 set to cover Non-Secure access to 2nd DRAM address range */
55 tzc400_configure_region(PLAT_ARM_TZC_FILTERS, 3,
56 ARM_DRAM2_BASE, ARM_DRAM2_END,
57 ARM_TZC_NS_DRAM_S_ACCESS,
58 PLAT_ARM_TZC_NS_DEV_ACCESS);
59 #else
60 /* Allow secure access only to DRAM for EL3 payloads. */
61 tzc400_configure_region0(TZC_REGION_S_RDWR, 0);
62 #endif /* EL3_PAYLOAD_BASE */
63
64 /*
65 * Raise an exception if a NS device tries to access secure memory
66 * TODO: Add interrupt handling support.
67 */
68 tzc400_set_action(TZC_ACTION_ERR);
69
70 /* Enable filters. */
71 tzc400_enable_filters();
72 }
73
plat_arm_security_setup(void)74 void plat_arm_security_setup(void)
75 {
76 arm_tzc400_setup();
77 }
78