xref: /optee_os/core/drivers/stm32_bsec.c (revision 9fc2442cc66c279cb962c90c4375746fc9b28bb9)
1 // SPDX-License-Identifier: BSD-3-Clause
2 /*
3  * Copyright (c) 2017-2020, STMicroelectronics
4  */
5 
6 #include <assert.h>
7 #include <config.h>
8 #include <drivers/stm32_bsec.h>
9 #include <io.h>
10 #include <kernel/delay.h>
11 #include <kernel/dt.h>
12 #include <kernel/boot.h>
13 #include <kernel/spinlock.h>
14 #include <libfdt.h>
15 #include <limits.h>
16 #include <mm/core_memprot.h>
17 #include <platform_config.h>
18 #include <stm32_util.h>
19 #include <string.h>
20 #include <tee_api_defines.h>
21 #include <types_ext.h>
22 #include <util.h>
23 
24 #define BSEC_OTP_MASK			GENMASK_32(4, 0)
25 #define BSEC_OTP_BANK_SHIFT		5
26 
27 /* Permanent lock bitmasks */
28 #define ADDR_LOWER_OTP_PERLOCK_SHIFT	3
29 #define DATA_LOWER_OTP_PERLOCK_BIT	3
30 #define DATA_LOWER_OTP_PERLOCK_MASK	GENMASK_32(2, 0)
31 #define ADDR_UPPER_OTP_PERLOCK_SHIFT	4
32 #define DATA_UPPER_OTP_PERLOCK_BIT	1
33 #define DATA_UPPER_OTP_PERLOCK_MASK	GENMASK_32(3, 0)
34 
35 /* BSEC register offset */
36 #define BSEC_OTP_CONF_OFF		0x000U
37 #define BSEC_OTP_CTRL_OFF		0x004U
38 #define BSEC_OTP_WRDATA_OFF		0x008U
39 #define BSEC_OTP_STATUS_OFF		0x00CU
40 #define BSEC_OTP_LOCK_OFF		0x010U
41 #define BSEC_DEN_OFF			0x014U
42 #define BSEC_FEN_OFF			0x018U
43 #define BSEC_DISTURBED_OFF		0x01CU
44 #define BSEC_DISTURBED1_OFF		0x020U
45 #define BSEC_DISTURBED2_OFF		0x024U
46 #define BSEC_ERROR_OFF			0x034U
47 #define BSEC_ERROR1_OFF			0x038U
48 #define BSEC_ERROR2_OFF			0x03CU
49 #define BSEC_WRLOCK_OFF			0x04CU
50 #define BSEC_WRLOCK1_OFF		0x050U
51 #define BSEC_WRLOCK2_OFF		0x054U
52 #define BSEC_SPLOCK_OFF			0x064U
53 #define BSEC_SPLOCK1_OFF		0x068U
54 #define BSEC_SPLOCK2_OFF		0x06CU
55 #define BSEC_SWLOCK_OFF			0x07CU
56 #define BSEC_SWLOCK1_OFF		0x080U
57 #define BSEC_SWLOCK2_OFF		0x084U
58 #define BSEC_SRLOCK_OFF			0x094U
59 #define BSEC_SRLOCK1_OFF		0x098U
60 #define BSEC_SRLOCK2_OFF		0x09CU
61 #define BSEC_JTAG_IN_OFF		0x0ACU
62 #define BSEC_JTAG_OUT_OFF		0x0B0U
63 #define BSEC_SCRATCH_OFF		0x0B4U
64 #define BSEC_OTP_DATA_OFF		0x200U
65 #define BSEC_IPHW_CFG_OFF		0xFF0U
66 #define BSEC_IPVR_OFF			0xFF4U
67 #define BSEC_IP_ID_OFF			0xFF8U
68 #define BSEC_IP_MAGIC_ID_OFF		0xFFCU
69 
70 /* BSEC_CONFIGURATION Register */
71 #define BSEC_CONF_POWER_UP_MASK		BIT(0)
72 #define BSEC_CONF_POWER_UP_SHIFT	0
73 #define BSEC_CONF_FRQ_MASK		GENMASK_32(2, 1)
74 #define BSEC_CONF_FRQ_SHIFT		1
75 #define BSEC_CONF_PRG_WIDTH_MASK	GENMASK_32(6, 3)
76 #define BSEC_CONF_PRG_WIDTH_SHIFT	3
77 #define BSEC_CONF_TREAD_MASK		GENMASK_32(8, 7)
78 #define BSEC_CONF_TREAD_SHIFT		7
79 
80 /* BSEC_CONTROL Register */
81 #define BSEC_READ			0x000U
82 #define BSEC_WRITE			0x100U
83 #define BSEC_LOCK			0x200U
84 
85 /* BSEC_STATUS Register */
86 #define BSEC_MODE_STATUS_MASK		GENMASK_32(2, 0)
87 #define BSEC_MODE_BUSY_MASK		BIT(3)
88 #define BSEC_MODE_PROGFAIL_MASK		BIT(4)
89 #define BSEC_MODE_PWR_MASK		BIT(5)
90 #define BSEC_MODE_BIST1_LOCK_MASK	BIT(6)
91 #define BSEC_MODE_BIST2_LOCK_MASK	BIT(7)
92 
93 /* BSEC_DEBUG */
94 #define BSEC_HDPEN			BIT(4)
95 #define BSEC_SPIDEN			BIT(5)
96 #define BSEC_SPINDEN			BIT(6)
97 #define BSEC_DBGSWGEN			BIT(10)
98 #define BSEC_DEN_ALL_MSK		GENMASK_32(10, 0)
99 
100 /*
101  * OTP Lock services definition
102  * Value must corresponding to the bit position in the register
103  */
104 #define BSEC_LOCK_UPPER_OTP		0x00
105 #define BSEC_LOCK_DEBUG			0x02
106 #define BSEC_LOCK_PROGRAM		0x04
107 
108 /* Timeout when polling on status */
109 #define BSEC_TIMEOUT_US			1000
110 
111 #define BITS_PER_WORD		(CHAR_BIT * sizeof(uint32_t))
112 
113 struct bsec_dev {
114 	struct io_pa_va base;
115 	unsigned int upper_base;
116 	unsigned int max_id;
117 	uint32_t *nsec_access;
118 };
119 
120 /* Only 1 instance of BSEC is expected per platform */
121 static struct bsec_dev bsec_dev;
122 
123 /* BSEC access protection */
124 static unsigned int lock = SPINLOCK_UNLOCK;
125 
126 static uint32_t bsec_lock(void)
127 {
128 	return may_spin_lock(&lock);
129 }
130 
131 static void bsec_unlock(uint32_t exceptions)
132 {
133 	may_spin_unlock(&lock, exceptions);
134 }
135 
136 static uint32_t otp_max_id(void)
137 {
138 	return bsec_dev.max_id;
139 }
140 
141 static uint32_t otp_upper_base(void)
142 {
143 	return bsec_dev.upper_base;
144 }
145 
146 static uint32_t otp_bank_offset(uint32_t otp_id)
147 {
148 	assert(otp_id <= otp_max_id());
149 
150 	return ((otp_id & ~BSEC_OTP_MASK) >> BSEC_OTP_BANK_SHIFT) *
151 		sizeof(uint32_t);
152 }
153 
154 static vaddr_t bsec_base(void)
155 {
156 	return io_pa_or_va_secure(&bsec_dev.base);
157 }
158 
159 static uint32_t bsec_status(void)
160 {
161 	return io_read32(bsec_base() + BSEC_OTP_STATUS_OFF);
162 }
163 
164 /*
165  * Check that BSEC interface does not report an error
166  * @otp_id : OTP number
167  * @check_disturbed: check only error (false) or all sources (true)
168  * Return a TEE_Result compliant value
169  */
170 static TEE_Result check_no_error(uint32_t otp_id, bool check_disturbed)
171 {
172 	uint32_t bit = BIT(otp_id & BSEC_OTP_MASK);
173 	uint32_t bank = otp_bank_offset(otp_id);
174 
175 	if (io_read32(bsec_base() + BSEC_ERROR_OFF + bank) & bit)
176 		return TEE_ERROR_GENERIC;
177 
178 	if (check_disturbed &&
179 	    io_read32(bsec_base() + BSEC_DISTURBED_OFF + bank) & bit)
180 		return TEE_ERROR_GENERIC;
181 
182 	return TEE_SUCCESS;
183 }
184 
185 static TEE_Result power_up_safmem(void)
186 {
187 	uint64_t timeout_ref = timeout_init_us(BSEC_TIMEOUT_US);
188 
189 	io_mask32(bsec_base() + BSEC_OTP_CONF_OFF, BSEC_CONF_POWER_UP_MASK,
190 		  BSEC_CONF_POWER_UP_MASK);
191 
192 	/*
193 	 * If a timeout is detected, test the condition again to consider
194 	 * cases where timeout is due to the executing TEE thread rescheduling.
195 	 */
196 	while (!timeout_elapsed(timeout_ref))
197 		if (bsec_status() & BSEC_MODE_PWR_MASK)
198 			break;
199 
200 	if (bsec_status() & BSEC_MODE_PWR_MASK)
201 		return TEE_SUCCESS;
202 
203 	return TEE_ERROR_GENERIC;
204 }
205 
206 static TEE_Result power_down_safmem(void)
207 {
208 	uint64_t timeout_ref = timeout_init_us(BSEC_TIMEOUT_US);
209 
210 	io_mask32(bsec_base() + BSEC_OTP_CONF_OFF, 0, BSEC_CONF_POWER_UP_MASK);
211 
212 	/*
213 	 * If a timeout is detected, test the condition again to consider
214 	 * cases where timeout is due to the executing TEE thread rescheduling.
215 	 */
216 	while (!timeout_elapsed(timeout_ref))
217 		if (!(bsec_status() & BSEC_MODE_PWR_MASK))
218 			break;
219 
220 	if (!(bsec_status() & BSEC_MODE_PWR_MASK))
221 		return TEE_SUCCESS;
222 
223 	return TEE_ERROR_GENERIC;
224 }
225 
226 TEE_Result stm32_bsec_shadow_register(uint32_t otp_id)
227 {
228 	TEE_Result result = 0;
229 	uint32_t exceptions = 0;
230 	uint64_t timeout_ref = 0;
231 	bool locked = false;
232 
233 	/* Check if shadowing of OTP is locked, informative only */
234 	result = stm32_bsec_read_sr_lock(otp_id, &locked);
235 	if (result)
236 		return result;
237 
238 	if (locked)
239 		DMSG("BSEC shadow warning: OTP locked");
240 
241 	exceptions = bsec_lock();
242 
243 	result = power_up_safmem();
244 	if (result)
245 		return result;
246 
247 	io_write32(bsec_base() + BSEC_OTP_CTRL_OFF, otp_id | BSEC_READ);
248 
249 	timeout_ref = timeout_init_us(BSEC_TIMEOUT_US);
250 	while (!timeout_elapsed(timeout_ref))
251 		if (!(bsec_status() & BSEC_MODE_BUSY_MASK))
252 			break;
253 
254 	if (bsec_status() & BSEC_MODE_BUSY_MASK)
255 		result = TEE_ERROR_GENERIC;
256 	else
257 		result = check_no_error(otp_id, true /* check-disturbed */);
258 
259 	power_down_safmem();
260 
261 	bsec_unlock(exceptions);
262 
263 	return result;
264 }
265 
266 TEE_Result stm32_bsec_read_otp(uint32_t *value, uint32_t otp_id)
267 {
268 	if (otp_id > otp_max_id())
269 		return TEE_ERROR_BAD_PARAMETERS;
270 
271 	*value = io_read32(bsec_base() + BSEC_OTP_DATA_OFF +
272 			   (otp_id * sizeof(uint32_t)));
273 
274 	return TEE_SUCCESS;
275 }
276 
277 TEE_Result stm32_bsec_shadow_read_otp(uint32_t *otp_value, uint32_t otp_id)
278 {
279 	TEE_Result result = 0;
280 
281 	result = stm32_bsec_shadow_register(otp_id);
282 	if (result) {
283 		EMSG("BSEC %"PRIu32" Shadowing Error %#"PRIx32, otp_id, result);
284 		return result;
285 	}
286 
287 	result = stm32_bsec_read_otp(otp_value, otp_id);
288 	if (result)
289 		EMSG("BSEC %"PRIu32" Read Error %#"PRIx32, otp_id, result);
290 
291 	return result;
292 }
293 
294 TEE_Result stm32_bsec_write_otp(uint32_t value, uint32_t otp_id)
295 {
296 	TEE_Result result = 0;
297 	uint32_t exceptions = 0;
298 	vaddr_t otp_data_base = bsec_base() + BSEC_OTP_DATA_OFF;
299 	bool locked = false;
300 
301 	/* Check if write of OTP is locked, informative only */
302 	result = stm32_bsec_read_sw_lock(otp_id, &locked);
303 	if (result)
304 		return result;
305 
306 	if (locked)
307 		DMSG("BSEC write warning: OTP locked");
308 
309 	exceptions = bsec_lock();
310 
311 	io_write32(otp_data_base + (otp_id * sizeof(uint32_t)), value);
312 
313 	bsec_unlock(exceptions);
314 
315 	return TEE_SUCCESS;
316 }
317 
318 #ifdef CFG_STM32_BSEC_WRITE
319 TEE_Result stm32_bsec_program_otp(uint32_t value, uint32_t otp_id)
320 {
321 	TEE_Result result = 0;
322 	uint32_t exceptions = 0;
323 	uint64_t timeout_ref = 0;
324 	bool locked = false;
325 
326 	/* Check if shadowing of OTP is locked, informative only */
327 	result = stm32_bsec_read_sp_lock(otp_id, &locked);
328 	if (result)
329 		return result;
330 
331 	if (locked)
332 		DMSG("BSEC program warning: OTP locked");
333 
334 	if (io_read32(bsec_base() + BSEC_OTP_LOCK_OFF) & BIT(BSEC_LOCK_PROGRAM))
335 		DMSG("BSEC program warning: GPLOCK activated");
336 
337 	exceptions = bsec_lock();
338 
339 	result = power_up_safmem();
340 	if (result)
341 		return result;
342 
343 	io_write32(bsec_base() + BSEC_OTP_WRDATA_OFF, value);
344 	io_write32(bsec_base() + BSEC_OTP_CTRL_OFF, otp_id | BSEC_WRITE);
345 
346 	timeout_ref = timeout_init_us(BSEC_TIMEOUT_US);
347 	while (!timeout_elapsed(timeout_ref))
348 		if (!(bsec_status() & BSEC_MODE_BUSY_MASK))
349 			break;
350 
351 	if (bsec_status() & (BSEC_MODE_BUSY_MASK | BSEC_MODE_PROGFAIL_MASK))
352 		result = TEE_ERROR_GENERIC;
353 	else
354 		result = check_no_error(otp_id, true /* check-disturbed */);
355 
356 	power_down_safmem();
357 
358 	bsec_unlock(exceptions);
359 
360 	return result;
361 }
362 #endif /*CFG_STM32_BSEC_WRITE*/
363 
364 TEE_Result stm32_bsec_permanent_lock_otp(uint32_t otp_id)
365 {
366 	TEE_Result result = 0;
367 	uint32_t data = 0;
368 	uint32_t addr = 0;
369 	uint32_t exceptions = 0;
370 	vaddr_t base = bsec_base();
371 	uint64_t timeout_ref = 0;
372 
373 	if (otp_id > otp_max_id())
374 		return TEE_ERROR_BAD_PARAMETERS;
375 
376 	if (otp_id < otp_upper_base()) {
377 		addr = otp_id >> ADDR_LOWER_OTP_PERLOCK_SHIFT;
378 		data = DATA_LOWER_OTP_PERLOCK_BIT <<
379 		       ((otp_id & DATA_LOWER_OTP_PERLOCK_MASK) << 1U);
380 	} else {
381 		addr = (otp_id >> ADDR_UPPER_OTP_PERLOCK_SHIFT) + 2U;
382 		data = DATA_UPPER_OTP_PERLOCK_BIT <<
383 		       (otp_id & DATA_UPPER_OTP_PERLOCK_MASK);
384 	}
385 
386 	exceptions = bsec_lock();
387 
388 	result = power_up_safmem();
389 	if (result)
390 		return result;
391 
392 	io_write32(base + BSEC_OTP_WRDATA_OFF, data);
393 	io_write32(base + BSEC_OTP_CTRL_OFF, addr | BSEC_WRITE | BSEC_LOCK);
394 
395 	timeout_ref = timeout_init_us(BSEC_TIMEOUT_US);
396 	while (!timeout_elapsed(timeout_ref))
397 		if (!(bsec_status() & BSEC_MODE_BUSY_MASK))
398 			break;
399 
400 	if (bsec_status() & (BSEC_MODE_BUSY_MASK | BSEC_MODE_PROGFAIL_MASK))
401 		result = TEE_ERROR_BAD_PARAMETERS;
402 	else
403 		result = check_no_error(otp_id, false /* not-disturbed */);
404 
405 	power_down_safmem();
406 
407 	bsec_unlock(exceptions);
408 
409 	return result;
410 }
411 
412 #ifdef CFG_STM32_BSEC_WRITE
413 TEE_Result stm32_bsec_write_debug_conf(uint32_t value)
414 {
415 	TEE_Result result = TEE_ERROR_GENERIC;
416 	uint32_t masked_val = value & BSEC_DEN_ALL_MSK;
417 	uint32_t exceptions = 0;
418 
419 	exceptions = bsec_lock();
420 
421 	io_write32(bsec_base() + BSEC_DEN_OFF, value);
422 
423 	if ((io_read32(bsec_base() + BSEC_DEN_OFF) ^ masked_val) == 0U)
424 		result = TEE_SUCCESS;
425 
426 	bsec_unlock(exceptions);
427 
428 	return result;
429 }
430 #endif /*CFG_STM32_BSEC_WRITE*/
431 
432 uint32_t stm32_bsec_read_debug_conf(void)
433 {
434 	return io_read32(bsec_base() + BSEC_DEN_OFF);
435 }
436 
437 static TEE_Result set_bsec_lock(uint32_t otp_id, size_t lock_offset)
438 {
439 	uint32_t bank = otp_bank_offset(otp_id);
440 	uint32_t otp_mask = BIT(otp_id & BSEC_OTP_MASK);
441 	vaddr_t lock_addr = bsec_base() + bank + lock_offset;
442 	uint32_t exceptions = 0;
443 
444 	if (otp_id > STM32MP1_OTP_MAX_ID)
445 		return TEE_ERROR_BAD_PARAMETERS;
446 
447 	exceptions = bsec_lock();
448 
449 	io_write32(lock_addr, otp_mask);
450 
451 	bsec_unlock(exceptions);
452 
453 	return TEE_SUCCESS;
454 }
455 
456 TEE_Result stm32_bsec_set_sr_lock(uint32_t otp_id)
457 {
458 	return set_bsec_lock(otp_id, BSEC_SRLOCK_OFF);
459 }
460 
461 TEE_Result stm32_bsec_set_sw_lock(uint32_t otp_id)
462 {
463 	return set_bsec_lock(otp_id, BSEC_SWLOCK_OFF);
464 }
465 
466 TEE_Result stm32_bsec_set_sp_lock(uint32_t otp_id)
467 {
468 	return set_bsec_lock(otp_id, BSEC_SPLOCK_OFF);
469 }
470 
471 static TEE_Result read_bsec_lock(uint32_t otp_id, bool *locked,
472 				 size_t lock_offset)
473 {
474 	uint32_t bank = otp_bank_offset(otp_id);
475 	uint32_t otp_mask = BIT(otp_id & BSEC_OTP_MASK);
476 	vaddr_t lock_addr = bsec_base() + bank + lock_offset;
477 
478 	if (otp_id > STM32MP1_OTP_MAX_ID)
479 		return TEE_ERROR_BAD_PARAMETERS;
480 
481 	*locked = (io_read32(lock_addr) & otp_mask) != 0;
482 
483 	return TEE_SUCCESS;
484 }
485 
486 TEE_Result stm32_bsec_read_sr_lock(uint32_t otp_id, bool *locked)
487 {
488 	return read_bsec_lock(otp_id, locked, BSEC_SRLOCK_OFF);
489 }
490 
491 TEE_Result stm32_bsec_read_sw_lock(uint32_t otp_id, bool *locked)
492 {
493 	return read_bsec_lock(otp_id, locked, BSEC_SWLOCK_OFF);
494 }
495 
496 TEE_Result stm32_bsec_read_sp_lock(uint32_t otp_id, bool *locked)
497 {
498 	return read_bsec_lock(otp_id, locked, BSEC_SPLOCK_OFF);
499 }
500 
501 TEE_Result stm32_bsec_read_permanent_lock(uint32_t otp_id, bool *locked)
502 {
503 	return read_bsec_lock(otp_id, locked, BSEC_WRLOCK_OFF);
504 }
505 
506 TEE_Result stm32_bsec_otp_lock(uint32_t service)
507 {
508 	vaddr_t addr = bsec_base() + BSEC_OTP_LOCK_OFF;
509 
510 	switch (service) {
511 	case BSEC_LOCK_UPPER_OTP:
512 		io_write32(addr, BIT(BSEC_LOCK_UPPER_OTP));
513 		break;
514 	case BSEC_LOCK_DEBUG:
515 		io_write32(addr, BIT(BSEC_LOCK_DEBUG));
516 		break;
517 	case BSEC_LOCK_PROGRAM:
518 		io_write32(addr, BIT(BSEC_LOCK_PROGRAM));
519 		break;
520 	default:
521 		return TEE_ERROR_BAD_PARAMETERS;
522 	}
523 
524 	return TEE_SUCCESS;
525 }
526 
527 static size_t nsec_access_array_size(void)
528 {
529 	size_t upper_count = otp_max_id() - otp_upper_base() + 1;
530 
531 	return ROUNDUP(upper_count, BITS_PER_WORD) / BITS_PER_WORD;
532 }
533 
534 static bool nsec_access_granted(unsigned int index)
535 {
536 	uint32_t *array = bsec_dev.nsec_access;
537 
538 	return array &&
539 	       (index / BITS_PER_WORD) < nsec_access_array_size() &&
540 	       array[index / BITS_PER_WORD] & BIT(index % BITS_PER_WORD);
541 }
542 
543 bool stm32_bsec_nsec_can_access_otp(uint32_t otp_id)
544 {
545 	return otp_id < otp_upper_base() ||
546 	       nsec_access_granted(otp_id - otp_upper_base());
547 }
548 
549 #ifdef CFG_DT
550 static void enable_nsec_access(unsigned int otp_id)
551 {
552 	unsigned int idx = (otp_id - otp_upper_base()) / BITS_PER_WORD;
553 
554 	if (otp_id < otp_upper_base())
555 		return;
556 
557 	if (otp_id > otp_max_id() || stm32_bsec_shadow_register(otp_id))
558 		panic();
559 
560 	bsec_dev.nsec_access[idx] |= BIT(otp_id % BITS_PER_WORD);
561 }
562 
563 static void bsec_dt_otp_nsec_access(void *fdt, int bsec_node)
564 {
565 	int bsec_subnode = 0;
566 
567 	bsec_dev.nsec_access = calloc(nsec_access_array_size(),
568 				      sizeof(*bsec_dev.nsec_access));
569 	if (!bsec_dev.nsec_access)
570 		panic();
571 
572 	fdt_for_each_subnode(bsec_subnode, fdt, bsec_node) {
573 		const fdt32_t *cuint = NULL;
574 		unsigned int otp_id = 0;
575 		unsigned int i = 0;
576 		size_t size = 0;
577 		uint32_t offset = 0;
578 		uint32_t length = 0;
579 
580 		cuint = fdt_getprop(fdt, bsec_subnode, "reg", NULL);
581 		assert(cuint);
582 
583 		offset = fdt32_to_cpu(*cuint);
584 		cuint++;
585 		length = fdt32_to_cpu(*cuint);
586 
587 		otp_id = offset / sizeof(uint32_t);
588 
589 		if (otp_id < STM32MP1_UPPER_OTP_START) {
590 			unsigned int otp_end = ROUNDUP(offset + length,
591 						       sizeof(uint32_t)) /
592 					       sizeof(uint32_t);
593 
594 			if (otp_end > STM32MP1_UPPER_OTP_START) {
595 				/*
596 				 * OTP crosses Lower/Upper boundary, consider
597 				 * only the upper part.
598 				 */
599 				otp_id = STM32MP1_UPPER_OTP_START;
600 				length -= (STM32MP1_UPPER_OTP_START *
601 					   sizeof(uint32_t)) - offset;
602 				offset = STM32MP1_UPPER_OTP_START *
603 					 sizeof(uint32_t);
604 
605 				DMSG("OTP crosses Lower/Upper boundary");
606 			} else {
607 				continue;
608 			}
609 		}
610 
611 		if (!fdt_getprop(fdt, bsec_subnode, "st,non-secure-otp", NULL))
612 			continue;
613 
614 		if ((offset % sizeof(uint32_t)) || (length % sizeof(uint32_t)))
615 			panic("Unaligned non-secure OTP");
616 
617 		size = length / sizeof(uint32_t);
618 
619 		if (otp_id + size > STM32MP1_OTP_MAX_ID)
620 			panic("OTP range oversized");
621 
622 		for (i = otp_id; i < otp_id + size; i++)
623 			enable_nsec_access(i);
624 	}
625 }
626 
627 static void initialize_bsec_from_dt(void)
628 {
629 	void *fdt = NULL;
630 	int node = 0;
631 	struct dt_node_info bsec_info = { };
632 
633 	fdt = get_embedded_dt();
634 	node = fdt_node_offset_by_compatible(fdt, 0, "st,stm32mp15-bsec");
635 	if (node < 0)
636 		panic();
637 
638 	_fdt_fill_device_info(fdt, &bsec_info, node);
639 
640 	if (bsec_info.reg != bsec_dev.base.pa ||
641 	    !(bsec_info.status & DT_STATUS_OK_SEC))
642 		panic();
643 
644 	bsec_dt_otp_nsec_access(fdt, node);
645 }
646 #else
647 static void initialize_bsec_from_dt(void)
648 {
649 }
650 #endif /*CFG_DT*/
651 
652 static TEE_Result initialize_bsec(void)
653 {
654 	struct stm32_bsec_static_cfg cfg = { };
655 
656 	stm32mp_get_bsec_static_cfg(&cfg);
657 
658 	bsec_dev.base.pa = cfg.base;
659 	bsec_dev.upper_base = cfg.upper_start;
660 	bsec_dev.max_id = cfg.max_id;
661 
662 	if (IS_ENABLED(CFG_EMBED_DTB))
663 		initialize_bsec_from_dt();
664 
665 	return TEE_SUCCESS;
666 }
667 
668 driver_init(initialize_bsec);
669