ARM TZASC-380 IP provides a mechanism to split memory regions being
protected via it into eight equal-sized sub-regions. A bit-setting
allows the corresponding subregion to be disabled.
Several NXP/FSL SoCs support the TZASC-380 IP block and allow
the DDR connected via the TZASC to be partitioned into regions
having different security settings and also allow subregions
to be disabled.
This patch enables this support and can be used for SoCs which
support such a partition of DDR regions.
Details of the 'subregion_disable' register can be viewed here:
http://infocenter.arm.com/help/topic/com.arm.doc.ddi0431c/CHDIGDCI.html
Cc: Leif Lindholm <leif.lindholm(a)linaro.org>
Cc: Ard Biesheuvel <ard.biesheuvel(a)linaro.org>
Signed-off-by: Bhupesh Sharma <bhupesh.linux(a)gmail.com>
Contributed-under: TianoCore Contribution Agreement 1.0
---
.../Library/ArmVExpressSecLibCTA9x4/CTA9x4Sec.c | 14 +++++++-------
ArmPlatformPkg/Drivers/ArmTrustZone/ArmTrustZone.c | 10 ++++++++--
ArmPlatformPkg/Include/Drivers/ArmTrustzone.h | 3 ++-
3 files changed, 17 insertions(+), 10 deletions(-)
diff --git a/ArmPlatformPkg/ArmVExpressPkg/Library/ArmVExpressSecLibCTA9x4/CTA9x4Sec.c b/ArmPlatformPkg/ArmVExpressPkg/Library/ArmVExpressSecLibCTA9x4/CTA9x4Sec.c
index 6fa0774f59f8..42d731ea98c9 100644
--- a/ArmPlatformPkg/ArmVExpressPkg/Library/ArmVExpressSecLibCTA9x4/CTA9x4Sec.c
+++ b/ArmPlatformPkg/ArmVExpressPkg/Library/ArmVExpressSecLibCTA9x4/CTA9x4Sec.c
@@ -72,18 +72,18 @@ ArmPlatformSecTrustzoneInit (
// NOR Flash 0 non secure (BootMon)
TZASCSetRegion(ARM_VE_TZASC_BASE,1,TZASC_REGION_ENABLED,
ARM_VE_SMB_NOR0_BASE,0,
- TZASC_REGION_SIZE_64MB, TZASC_REGION_SECURITY_NSRW);
+ TZASC_REGION_SIZE_64MB, TZASC_REGION_SECURITY_NSRW, 0);
// NOR Flash 1. The first half of the NOR Flash1 must be secure for the secure firmware (sec_uefi.bin)
if (PcdGetBool (PcdTrustzoneSupport) == TRUE) {
//Note: Your OS Kernel must be aware of the secure regions before to enable this region
TZASCSetRegion(ARM_VE_TZASC_BASE,2,TZASC_REGION_ENABLED,
ARM_VE_SMB_NOR1_BASE + SIZE_32MB,0,
- TZASC_REGION_SIZE_32MB, TZASC_REGION_SECURITY_NSRW);
+ TZASC_REGION_SIZE_32MB, TZASC_REGION_SECURITY_NSRW, 0);
} else {
TZASCSetRegion(ARM_VE_TZASC_BASE,2,TZASC_REGION_ENABLED,
ARM_VE_SMB_NOR1_BASE,0,
- TZASC_REGION_SIZE_64MB, TZASC_REGION_SECURITY_NSRW);
+ TZASC_REGION_SIZE_64MB, TZASC_REGION_SECURITY_NSRW, 0);
}
// Base of SRAM. Only half of SRAM in Non Secure world
@@ -92,22 +92,22 @@ ArmPlatformSecTrustzoneInit (
//Note: Your OS Kernel must be aware of the secure regions before to enable this region
TZASCSetRegion(ARM_VE_TZASC_BASE,3,TZASC_REGION_ENABLED,
ARM_VE_SMB_SRAM_BASE,0,
- TZASC_REGION_SIZE_16MB, TZASC_REGION_SECURITY_NSRW);
+ TZASC_REGION_SIZE_16MB, TZASC_REGION_SECURITY_NSRW, 0);
} else {
TZASCSetRegion(ARM_VE_TZASC_BASE,3,TZASC_REGION_ENABLED,
ARM_VE_SMB_SRAM_BASE,0,
- TZASC_REGION_SIZE_32MB, TZASC_REGION_SECURITY_NSRW);
+ TZASC_REGION_SIZE_32MB, TZASC_REGION_SECURITY_NSRW, 0);
}
// Memory Mapped Peripherals. All in non secure world
TZASCSetRegion(ARM_VE_TZASC_BASE,4,TZASC_REGION_ENABLED,
ARM_VE_SMB_PERIPH_BASE,0,
- TZASC_REGION_SIZE_64MB, TZASC_REGION_SECURITY_NSRW);
+ TZASC_REGION_SIZE_64MB, TZASC_REGION_SECURITY_NSRW, 0);
// MotherBoard Peripherals and On-chip peripherals.
TZASCSetRegion(ARM_VE_TZASC_BASE,5,TZASC_REGION_ENABLED,
ARM_VE_SMB_MB_ON_CHIP_PERIPH_BASE,0,
- TZASC_REGION_SIZE_256MB, TZASC_REGION_SECURITY_NSRW);
+ TZASC_REGION_SIZE_256MB, TZASC_REGION_SECURITY_NSRW, 0);
}
/**
diff --git a/ArmPlatformPkg/Drivers/ArmTrustZone/ArmTrustZone.c b/ArmPlatformPkg/Drivers/ArmTrustZone/ArmTrustZone.c
index 070c0dcb5d4d..c99c16d4c442 100644
--- a/ArmPlatformPkg/Drivers/ArmTrustZone/ArmTrustZone.c
+++ b/ArmPlatformPkg/Drivers/ArmTrustZone/ArmTrustZone.c
@@ -87,20 +87,26 @@ TZASCSetRegion (
IN UINTN LowAddress,
IN UINTN HighAddress,
IN UINTN Size,
- IN UINTN Security
+ IN UINTN Security,
+ IN UINTN SubregionDisableMask
)
{
UINT32* Region;
+ UINT32 RegionAttributes;
if (RegionId > TZASCGetNumRegions(TzascBase)) {
return EFI_INVALID_PARAMETER;
}
+ RegionAttributes = ((Security & 0xF) << 28) |
+ ((SubregionDisableMask & 0xFF) << 8) |
+ ((Size & 0x3F) << 1) | (Enabled & 0x1);
+
Region = (UINT32*)((UINTN)TzascBase + TZASC_REGIONS_REG + (RegionId * 0x10));
MmioWrite32((UINTN)(Region), LowAddress&0xFFFF8000);
MmioWrite32((UINTN)(Region+1), HighAddress);
- MmioWrite32((UINTN)(Region+2), ((Security & 0xF) <<28) | ((Size & 0x3F) << 1) | (Enabled & 0x1));
+ MmioWrite32((UINTN)(Region+2), RegionAttributes);
return EFI_SUCCESS;
}
diff --git a/ArmPlatformPkg/Include/Drivers/ArmTrustzone.h b/ArmPlatformPkg/Include/Drivers/ArmTrustzone.h
index 78e98aad535f..1ba963d7b6c5 100644
--- a/ArmPlatformPkg/Include/Drivers/ArmTrustzone.h
+++ b/ArmPlatformPkg/Include/Drivers/ArmTrustzone.h
@@ -82,7 +82,8 @@ TZASCSetRegion (
IN UINTN LowAddress,
IN UINTN HighAddress,
IN UINTN Size,
- IN UINTN Security
+ IN UINTN Security,
+ IN UINTN SubregionDisableMask
);
#endif
--
2.7.4
Hi everyone,
I'd like to know if there's a way to hide SimpleFileSystem instance from
boot entries?
Currently we have some entries that are known to be sure not bootable (used
only for configuration purposes) and we don't want to expose them to user.
Thanks in advance.
Best regards,
Konrad Adamczyk
Hi ,all
In the progress of UEFI porting, I had a big problem. The function GicV2DxeInitialize in ArmGicDxe.inf module produced a Synchronous Exception, when it executed MmioRead32 (mGicDistributorBase + ARM_GIC_ICDICTR). And I am also using GIC400. The GICD&GICC register base have been set correctly. Strangely enough, the MmioRead32 (mGicDistributorBase + ARM_GIC_ICDICTR) code can be executed successfully in Arm trusted firmware which is the previous stage of UEFI. And also, I tried to use a evaluation to analysis the exception and got the following error message.
[cid:image001.png@01D25C42.2B95A4F0]
I don't know whether the ArmGicDxe.inf module must be executed in a particular environment which have not been set correctly in the previous module of UEFI? By the way, I'm using dependency expression way to dispatch the DXE drivers on Poplar board. I don't know the main cause of this problem and how to solve it. Can you give me some advises?
Best Regards,
Wengang