ArmPlatformPkg/TZASC: Allow specifying subregions to be disabled

ARM TZASC-380 IP provides a mechanism to split memory regions being
protected via it into eight equal-sized sub-regions. A bit-setting
allows the corresponding subregion to be disabled.

Several NXP/FSL SoCs support the TZASC-380 IP block and allow
the DDR connected via the TZASC to be partitioned into regions
having different security settings and also allow subregions
to be disabled.

This patch enables this support and can be used for SoCs which
support such a partition of DDR regions.

Details of the 'subregion_disable' register can be viewed here:
http://infocenter.arm.com/help/topic/com.arm.doc.ddi0431c/CHDIGDCI.html

Cc: Leif Lindholm <leif.lindholm@linaro.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Bhupesh Sharma <bhupesh.sharma@nxp.com>
[bhupesh.linux@gmail.com : Added gmail ID as NXP one is no longer valid]
Signed-off-by: Bhupesh Sharma <bhupesh.linux@gmail.com>
Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>

diff --git a/ArmPlatformPkg/ArmVExpressPkg/Library/ArmVExpressSecLibCTA9x4/CTA9x4Sec.c b/ArmPlatformPkg/ArmVExpressPkg/Library/ArmVExpressSecLibCTA9x4/CTA9x4Sec.c
index 6fa0774f59f8cb8356825356c670c3723cde9b7f..42d731ea98c9ea99dd3b17168ad698023b86ef8b 100644 (file)
--- a/ArmPlatformPkg/ArmVExpressPkg/Library/ArmVExpressSecLibCTA9x4/CTA9x4Sec.c
+++ b/ArmPlatformPkg/ArmVExpressPkg/Library/ArmVExpressSecLibCTA9x4/CTA9x4Sec.c
@@ -72,18 +72,18 @@ ArmPlatformSecTrustzoneInit (
   // NOR Flash 0 non secure (BootMon)\r
   TZASCSetRegion(ARM_VE_TZASC_BASE,1,TZASC_REGION_ENABLED,\r
       ARM_VE_SMB_NOR0_BASE,0,\r
-      TZASC_REGION_SIZE_64MB, TZASC_REGION_SECURITY_NSRW);\r
+      TZASC_REGION_SIZE_64MB, TZASC_REGION_SECURITY_NSRW, 0);\r
 \r
   // NOR Flash 1. The first half of the NOR Flash1 must be secure for the secure firmware (sec_uefi.bin)\r
   if (PcdGetBool (PcdTrustzoneSupport) == TRUE) {\r
     //Note: Your OS Kernel must be aware of the secure regions before to enable this region\r
     TZASCSetRegion(ARM_VE_TZASC_BASE,2,TZASC_REGION_ENABLED,\r
         ARM_VE_SMB_NOR1_BASE + SIZE_32MB,0,\r
-        TZASC_REGION_SIZE_32MB, TZASC_REGION_SECURITY_NSRW);\r
+        TZASC_REGION_SIZE_32MB, TZASC_REGION_SECURITY_NSRW, 0);\r
   } else {\r
     TZASCSetRegion(ARM_VE_TZASC_BASE,2,TZASC_REGION_ENABLED,\r
         ARM_VE_SMB_NOR1_BASE,0,\r
-        TZASC_REGION_SIZE_64MB, TZASC_REGION_SECURITY_NSRW);\r
+        TZASC_REGION_SIZE_64MB, TZASC_REGION_SECURITY_NSRW, 0);\r
   }\r
 \r
   // Base of SRAM. Only half of SRAM in Non Secure world\r
@@ -92,22 +92,22 @@ ArmPlatformSecTrustzoneInit (
     //Note: Your OS Kernel must be aware of the secure regions before to enable this region\r
     TZASCSetRegion(ARM_VE_TZASC_BASE,3,TZASC_REGION_ENABLED,\r
         ARM_VE_SMB_SRAM_BASE,0,\r
-        TZASC_REGION_SIZE_16MB, TZASC_REGION_SECURITY_NSRW);\r
+        TZASC_REGION_SIZE_16MB, TZASC_REGION_SECURITY_NSRW, 0);\r
   } else {\r
     TZASCSetRegion(ARM_VE_TZASC_BASE,3,TZASC_REGION_ENABLED,\r
         ARM_VE_SMB_SRAM_BASE,0,\r
-        TZASC_REGION_SIZE_32MB, TZASC_REGION_SECURITY_NSRW);\r
+        TZASC_REGION_SIZE_32MB, TZASC_REGION_SECURITY_NSRW, 0);\r
   }\r
 \r
   // Memory Mapped Peripherals. All in non secure world\r
   TZASCSetRegion(ARM_VE_TZASC_BASE,4,TZASC_REGION_ENABLED,\r
       ARM_VE_SMB_PERIPH_BASE,0,\r
-      TZASC_REGION_SIZE_64MB, TZASC_REGION_SECURITY_NSRW);\r
+      TZASC_REGION_SIZE_64MB, TZASC_REGION_SECURITY_NSRW, 0);\r
 \r
   // MotherBoard Peripherals and On-chip peripherals.\r
   TZASCSetRegion(ARM_VE_TZASC_BASE,5,TZASC_REGION_ENABLED,\r
       ARM_VE_SMB_MB_ON_CHIP_PERIPH_BASE,0,\r
-      TZASC_REGION_SIZE_256MB, TZASC_REGION_SECURITY_NSRW);\r
+      TZASC_REGION_SIZE_256MB, TZASC_REGION_SECURITY_NSRW, 0);\r
 }\r
 \r
 /**\r

diff --git a/ArmPlatformPkg/Drivers/ArmTrustZone/ArmTrustZone.c b/ArmPlatformPkg/Drivers/ArmTrustZone/ArmTrustZone.c
index 070c0dcb5d4d29f910a46d120963803ed20f8c0c..1f002198e5521126610d27c460bd71b128311444 100644 (file)
--- a/ArmPlatformPkg/Drivers/ArmTrustZone/ArmTrustZone.c
+++ b/ArmPlatformPkg/Drivers/ArmTrustZone/ArmTrustZone.c
@@ -87,20 +87,27 @@ TZASCSetRegion (
   IN  UINTN LowAddress,\r
   IN  UINTN HighAddress,\r
   IN  UINTN Size,\r
-  IN  UINTN Security\r
+  IN  UINTN Security,\r
+  IN  UINTN SubregionDisableMask\r
   )\r
 {\r
   UINT32*     Region;\r
+  UINT32      RegionAttributes;\r
 \r
   if (RegionId > TZASCGetNumRegions(TzascBase)) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r
 \r
+  RegionAttributes = TZASC_REGION_ATTR_SECURITY(Security) |\r
+                     TZASC_REGION_ATTR_SUBREG_DISABLE(SubregionDisableMask) |\r
+                     TZASC_REGION_ATTR_SIZE(Size) |\r
+                     TZASC_REGION_ATTR_ENABLE(Enabled);\r
+\r
   Region = (UINT32*)((UINTN)TzascBase + TZASC_REGIONS_REG + (RegionId * 0x10));\r
 \r
-  MmioWrite32((UINTN)(Region), LowAddress&0xFFFF8000);\r
+  MmioWrite32((UINTN)(Region), TZASC_REGION_SETUP_LO_ADDR(LowAddress));\r
   MmioWrite32((UINTN)(Region+1), HighAddress);\r
-  MmioWrite32((UINTN)(Region+2), ((Security & 0xF) <<28) | ((Size & 0x3F) << 1) | (Enabled & 0x1));\r
+  MmioWrite32((UINTN)(Region+2), RegionAttributes);\r
 \r
   return EFI_SUCCESS;\r
 }\r

diff --git a/ArmPlatformPkg/Include/Drivers/ArmTrustzone.h b/ArmPlatformPkg/Include/Drivers/ArmTrustzone.h
index 78e98aad535ff680af5e3f2f8da9ded2a7c22b0d..827b5cd568c1f66a1f42b258c8c27311591dbd32 100644 (file)
--- a/ArmPlatformPkg/Include/Drivers/ArmTrustzone.h
+++ b/ArmPlatformPkg/Include/Drivers/ArmTrustzone.h
@@ -71,6 +71,22 @@ TZPCClearDecProtBits (
 #define TZASC_REGION_SECURITY_NSW   1\r
 #define TZASC_REGION_SECURITY_NSRW  (TZASC_REGION_SECURITY_NSR|TZASC_REGION_SECURITY_NSW)\r
 \r
+/* Some useful masks */\r
+#define TZASC_REGION_SETUP_LO_ADDR_MASK   0xFFFF8000\r
+\r
+#define TZASC_REGION_ATTR_SECURITY_MASK   0xF\r
+#define TZASC_REGION_ATTR_SUBREG_DIS_MASK 0xFF\r
+#define TZASC_REGION_ATTR_SIZE_MASK       0x3F\r
+#define TZASC_REGION_ATTR_EN_MASK         0x1\r
+\r
+#define TZASC_REGION_SETUP_LO_ADDR(x)  ((x) & TZASC_REGION_SETUP_LO_ADDR_MASK)\r
+\r
+#define TZASC_REGION_ATTR_SECURITY(x)  (((x) & TZASC_REGION_ATTR_SECURITY_MASK) << 28)\r
+#define TZASC_REGION_ATTR_SUBREG_DISABLE(x) \\r
+                                       (((x) & TZASC_REGION_ATTR_SUBREG_DIS_MASK) << 8)\r
+#define TZASC_REGION_ATTR_SIZE(x)      (((x) & TZASC_REGION_ATTR_SIZE_MASK) << 1)\r
+#define TZASC_REGION_ATTR_ENABLE(x)    ((x) & TZASC_REGION_ATTR_EN_MASK)\r
+\r
 /**\r
     FIXME: Need documentation\r
 **/\r
@@ -82,7 +98,8 @@ TZASCSetRegion (
   IN  UINTN LowAddress,\r
   IN  UINTN HighAddress,\r
   IN  UINTN Size,\r
-  IN  UINTN Security\r
+  IN  UINTN Security,\r
+  IN  UINTN SubregionDisableMask\r
   );\r
 \r
 #endif\r