1 /* 2 * Copyright (c) 2016 - 2020, Broadcom 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <common/debug.h> 8 #include <drivers/arm/tzc400.h> 9 #include <lib/mmio.h> 10 11 #include <cmn_sec.h> 12 #include <platform_def.h> 13 14 /* 15 * Trust Zone controllers 16 */ 17 #define TZC400_FS_SRAM_ROOT 0x66d84000 18 19 /* 20 * TZPC Master configure registers 21 */ 22 23 /* TZPC_TZPCDECPROT0set */ 24 #define TZPC0_MASTER_NS_BASE 0x68b40804 25 #define TZPC0_SATA3_BIT 5 26 #define TZPC0_SATA2_BIT 4 27 #define TZPC0_SATA1_BIT 3 28 #define TZPC0_SATA0_BIT 2 29 #define TZPC0_USB3H1_BIT 1 30 #define TZPC0_USB3H0_BIT 0 31 #define TZPC0_MASTER_SEC_DEFAULT 0 32 33 /* TZPC_TZPCDECPROT1set */ 34 #define TZPC1_MASTER_NS_BASE 0x68b40810 35 #define TZPC1_SDIO1_BIT 6 36 #define TZPC1_SDIO0_BIT 5 37 #define TZPC1_AUDIO0_BIT 4 38 #define TZPC1_USB2D_BIT 3 39 #define TZPC1_USB2H1_BIT 2 40 #define TZPC1_USB2H0_BIT 1 41 #define TZPC1_AMAC0_BIT 0 42 #define TZPC1_MASTER_SEC_DEFAULT 0 43 44 45 struct tz_sec_desc { 46 uintptr_t addr; 47 uint32_t val; 48 }; 49 50 static const struct tz_sec_desc tz_master_defaults[] = { 51 { TZPC0_MASTER_NS_BASE, TZPC0_MASTER_SEC_DEFAULT }, 52 { TZPC1_MASTER_NS_BASE, TZPC1_MASTER_SEC_DEFAULT } 53 }; 54 55 /* 56 * Initialize the TrustZone Controller for SRAM partitioning. 57 */ 58 static void bcm_tzc_setup(void) 59 { 60 VERBOSE("Configuring SRAM TrustZone Controller\n"); 61 62 /* Init the TZASC controller */ 63 tzc400_init(TZC400_FS_SRAM_ROOT); 64 65 /* 66 * Close the entire SRAM space 67 * Region 0 covers the entire SRAM space 68 * None of the NS device can access it. 69 */ 70 tzc400_configure_region0(TZC_REGION_S_RDWR, 0); 71 72 /* Do raise an exception if a NS device tries to access secure memory */ 73 tzc400_set_action(TZC_ACTION_ERR); 74 } 75 76 /* 77 * Configure TZ Master as NS_MASTER or SECURE_MASTER 78 * To set a Master to non-secure, use *_SET registers 79 * To set a Master to secure, use *_CLR registers (set + 0x4 address) 80 */ 81 static void tz_master_set(uint32_t base, uint32_t value, uint32_t ns) 82 { 83 if (ns == SECURE_MASTER) { 84 mmio_write_32(base + 4, value); 85 } else { 86 mmio_write_32(base, value); 87 } 88 } 89 90 /* 91 * Initialize the secure environment for sdio. 92 */ 93 void plat_tz_sdio_ns_master_set(uint32_t ns) 94 { 95 tz_master_set(TZPC1_MASTER_NS_BASE, 96 1 << TZPC1_SDIO0_BIT, 97 ns); 98 } 99 100 /* 101 * Initialize the secure environment for usb. 102 */ 103 void plat_tz_usb_ns_master_set(uint32_t ns) 104 { 105 tz_master_set(TZPC1_MASTER_NS_BASE, 106 1 << TZPC1_USB2H0_BIT, 107 ns); 108 } 109 110 /* 111 * Set masters to default configuration. 112 * 113 * DMA security settings are programmed into the PL-330 controller and 114 * are not set by iProc TZPC registers. 115 * DMA always comes up as secure master (*NS bit is 0). 116 * 117 * Because the default reset values of TZPC are 0 (== Secure), 118 * ARM Verilog code makes all masters, including PCIe, come up as 119 * secure. 120 * However, SOTP has a bit called SOTP_ALLMASTER_NS that overrides 121 * TZPC and makes all masters non-secure for AB devices. 122 * 123 * Hence we first set all the TZPC bits to program all masters, 124 * including PCIe, as non-secure, then set the CLEAR_ALLMASTER_NS bit 125 * so that the SOTP_ALLMASTER_NS cannot override TZPC. 126 * now security settings for each masters come from TZPC 127 * (which makes all masters other than DMA as non-secure). 128 * 129 * During the boot, all masters other than DMA Ctrlr + list 130 * are non-secure in an AB Prod/AB Dev/AB Pending device. 131 * 132 */ 133 void plat_tz_master_default_cfg(void) 134 { 135 int i; 136 137 /* Configure default secure and non-secure TZ Masters */ 138 for (i = 0; i < ARRAY_SIZE(tz_master_defaults); i++) { 139 tz_master_set(tz_master_defaults[i].addr, 140 tz_master_defaults[i].val, 141 SECURE_MASTER); 142 tz_master_set(tz_master_defaults[i].addr, 143 ~tz_master_defaults[i].val, 144 NS_MASTER); 145 } 146 147 /* Clear all master NS */ 148 mmio_setbits_32(SOTP_CHIP_CTRL, 149 1 << SOTP_CLEAR_SYSCTRL_ALL_MASTER_NS); 150 151 /* Initialize TZ controller and Set SRAM to secure */ 152 bcm_tzc_setup(); 153 } 154