Merge changes from topic "rockchip-secure-ddr" into integration

* changes:
  rockchip: make miniloader ddr_parameter handling optional
  rockchip: px30: cleanup securing of ddr regions
  rockchip: px30: move secure init to separate file
  rockchip: really use base+size for secure ddr regions
  rockchip: bring TZRAM_SIZE values in line

plat/rockchip/px30/drivers/pmu/pmu.c

@@ -22,6 +22,7 @@
 #include <plat_private.h>
 #include <pmu.h>
 #include <px30_def.h>
+#include <secure.h>
 #include <soc.h>
 
 DEFINE_BAKERY_LOCK(rockchip_pd_lock);

plat/rockchip/px30/drivers/secure/secure.c

+/*
+ * Copyright (c) 2019, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <assert.h>
+#include <ddr_parameter.h>
+#include <plat_private.h>
+#include <secure.h>
+#include <px30_def.h>
+
+/**
+ * There are 8 regions for DDR security control
+ * @rgn - the DDR regions 0 ~ 7 which are can be configured.
+ * @st - start address to set as secure
+ * @sz - length of area to set as secure
+ * The internal unit is megabytes, so memory areas need to be aligned
+ * to megabyte borders.
+ */
+static void secure_ddr_region(uint32_t rgn,
+			      uintptr_t st, size_t sz)
+{
+	uintptr_t ed = st + sz;
+	uintptr_t st_mb, ed_mb;
+	uint32_t val;
+
+	assert(rgn <= 7);
+	assert(st < ed);
+
+	/* check aligned 1MB */
+	assert(st % SIZE_M(1) == 0);
+	assert(ed % SIZE_M(1) == 0);
+
+	st_mb = st / SIZE_M(1);
+	ed_mb = ed / SIZE_M(1);
+
+	/* map top and base */
+	mmio_write_32(FIREWALL_DDR_BASE +
+		      FIREWALL_DDR_FW_DDR_RGN(rgn),
+		      RG_MAP_SECURE(ed_mb, st_mb));
+
+	/* enable secure */
+	val = mmio_read_32(FIREWALL_DDR_BASE + FIREWALL_DDR_FW_DDR_CON_REG);
+	val |= BIT(rgn);
+	mmio_write_32(FIREWALL_DDR_BASE +
+		      FIREWALL_DDR_FW_DDR_CON_REG, val);
+}
+
+void secure_timer_init(void)
+{
+	mmio_write_32(STIMER_CHN_BASE(1) + TIMER_CONTROL_REG,
+		      TIMER_DIS);
+
+	mmio_write_32(STIMER_CHN_BASE(1) + TIMER_LOAD_COUNT0, 0xffffffff);
+	mmio_write_32(STIMER_CHN_BASE(1) + TIMER_LOAD_COUNT1, 0xffffffff);
+
+	/* auto reload & enable the timer */
+	mmio_write_32(STIMER_CHN_BASE(1) + TIMER_CONTROL_REG,
+		      TIMER_EN | TIMER_FMODE);
+}
+
+void sgrf_init(void)
+{
+#ifdef PLAT_RK_SECURE_DDR_MINILOADER
+	uint32_t i;
+	struct param_ddr_usage usg;
+
+	/* general secure regions */
+	usg = ddr_region_usage_parse(DDR_PARAM_BASE,
+				     PLAT_MAX_DDR_CAPACITY_MB);
+
+	/* region-0 for TF-A, region-1 for optional OP-TEE */
+	assert(usg.s_nr < 7);
+
+	for (i = 0; i < usg.s_nr; i++)
+		secure_ddr_region(7 - i, usg.s_top[i], usg.s_base[i]);
+#endif
+
+	/* secure the trustzone ram */
+	secure_ddr_region(0, TZRAM_BASE, TZRAM_SIZE);
+
+	/* set all slave ip into no-secure, except stimer */
+	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(4), SGRF_SLV_S_ALL_NS);
+	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(5), SGRF_SLV_S_ALL_NS);
+	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(6), SGRF_SLV_S_ALL_NS);
+	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(7), SGRF_SLV_S_ALL_NS);
+	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(8), 0x00030000);
+
+	/* set master crypto to no-secure, dcf to secure */
+	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(3), 0x000f0003);
+
+	/* set DMAC into no-secure */
+	mmio_write_32(SGRF_BASE + SGRF_DMAC_CON(0), DMA_IRQ_BOOT_NS);
+	mmio_write_32(SGRF_BASE + SGRF_DMAC_CON(1), DMA_PERI_CH_NS_15_0);
+	mmio_write_32(SGRF_BASE + SGRF_DMAC_CON(2), DMA_PERI_CH_NS_19_16);
+	mmio_write_32(SGRF_BASE + SGRF_DMAC_CON(3), DMA_MANAGER_BOOT_NS);
+
+	/* soft reset dma before use */
+	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(1), DMA_SOFTRST_REQ);
+	udelay(5);
+	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(1), DMA_SOFTRST_RLS);
+}

plat/rockchip/px30/drivers/secure/secure.h

+/*
+ * Copyright (c) 2019, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef SECURE_H
+#define SECURE_H
+
+/***************************************************************************
+ * SGRF
+ ***************************************************************************/
+#define SGRF_SOC_CON(i)		((i) * 0x4)
+#define SGRF_DMAC_CON(i)	(0x30 + (i) * 0x4)
+
+#define SGRF_MST_S_ALL_NS	0xffffffff
+#define SGRF_SLV_S_ALL_NS	0xffff0000
+#define DMA_IRQ_BOOT_NS		0xffffffff
+#define DMA_PERI_CH_NS_15_0	0xffffffff
+#define DMA_PERI_CH_NS_19_16	0x000f000f
+#define DMA_MANAGER_BOOT_NS	0x00010001
+#define DMA_SOFTRST_REQ		BITS_WITH_WMASK(1, 0x1, 12)
+#define DMA_SOFTRST_RLS		BITS_WITH_WMASK(0, 0x1, 12)
+
+/***************************************************************************
+ * DDR FIREWALL
+ ***************************************************************************/
+#define FIREWALL_DDR_FW_DDR_RGN(i)	((i) * 0x4)
+#define FIREWALL_DDR_FW_DDR_MST(i)	(0x20 + (i) * 0x4)
+#define FIREWALL_DDR_FW_DDR_CON_REG	0x40
+#define FIREWALL_DDR_FW_DDR_RGN_NUM	8
+#define FIREWALL_DDR_FW_DDR_MST_NUM	6
+
+#define PLAT_MAX_DDR_CAPACITY_MB	4096
+#define RG_MAP_SECURE(top, base)	((((top) - 1) << 16) | (base))
+
+/**************************************************
+ * secure timer
+ **************************************************/
+
+/* chanal0~5 */
+#define STIMER_CHN_BASE(n)	(STIME_BASE + 0x20 * (n))
+
+#define TIMER_LOAD_COUNT0	0x0
+#define TIMER_LOAD_COUNT1	0x4
+
+#define TIMER_CUR_VALUE0	0x8
+#define TIMER_CUR_VALUE1	0xc
+
+#define TIMER_CONTROL_REG	0x10
+#define TIMER_INTSTATUS		0x18
+
+#define TIMER_DIS		0x0
+#define TIMER_EN		0x1
+
+#define TIMER_FMODE		(0x0 << 1)
+#define TIMER_RMODE		(0x1 << 1)
+
+#define TIMER_LOAD_COUNT0_MSK	(0xffffffff)
+#define TIMER_LOAD_COUNT1_MSK	(0xffffffff00000000)
+
+void secure_timer_init(void);
+void sgrf_init(void);
+
+#endif /* SECURE_H */

plat/rockchip/px30/drivers/soc/soc.c

@@ -12,10 +12,10 @@
 #include <drivers/delay_timer.h>
 #include <lib/mmio.h>
 
-#include <ddr_parameter.h>
 #include <platform_def.h>
 #include <pmu.h>
 #include <px30_def.h>
+#include <secure.h>
 #include <soc.h>
 #include <rockchip_sip_svc.h>
 
@@ -83,65 +83,6 @@ void clk_gate_con_disable(void)
 			      0xffff0000);
 }
 
-void secure_timer_init(void)
-{
-	mmio_write_32(STIMER_CHN_BASE(1) + TIMER_CONTROL_REG,
-		      TIMER_DIS);
-
-	mmio_write_32(STIMER_CHN_BASE(1) + TIMER_LOAD_COUNT0, 0xffffffff);
-	mmio_write_32(STIMER_CHN_BASE(1) + TIMER_LOAD_COUNT1, 0xffffffff);
-
-	/* auto reload & enable the timer */
-	mmio_write_32(STIMER_CHN_BASE(1) + TIMER_CONTROL_REG,
-		      TIMER_EN | TIMER_FMODE);
-}
-
-static void sgrf_init(void)
-{
-	uint32_t i, val;
-	struct param_ddr_usage usg;
-
-	/* general secure regions */
-	usg = ddr_region_usage_parse(DDR_PARAM_BASE,
-				     PLAT_MAX_DDR_CAPACITY_MB);
-	for (i = 0; i < usg.s_nr; i++) {
-		/* enable secure */
-		val = mmio_read_32(FIREWALL_DDR_BASE +
-			      FIREWALL_DDR_FW_DDR_CON_REG);
-		val |= BIT(7 - i);
-		mmio_write_32(FIREWALL_DDR_BASE +
-			      FIREWALL_DDR_FW_DDR_CON_REG, val);
-		/* map top and base */
-		mmio_write_32(FIREWALL_DDR_BASE +
-			      FIREWALL_DDR_FW_DDR_RGN(7 - i),
-			      RG_MAP_SECURE(usg.s_top[i], usg.s_base[i]));
-	}
-
-	/* set ddr rgn0_top and rga0_top as 0 */
-	mmio_write_32(FIREWALL_DDR_BASE + FIREWALL_DDR_FW_DDR_RGN(0), 0x0);
-
-	/* set all slave ip into no-secure, except stimer */
-	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(4), SGRF_SLV_S_ALL_NS);
-	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(5), SGRF_SLV_S_ALL_NS);
-	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(6), SGRF_SLV_S_ALL_NS);
-	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(7), SGRF_SLV_S_ALL_NS);
-	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(8), 0x00030000);
-
-	/* set master crypto to no-secure, dcf to secure */
-	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(3), 0x000f0003);
-
-	/* set DMAC into no-secure */
-	mmio_write_32(SGRF_BASE + SGRF_DMAC_CON(0), DMA_IRQ_BOOT_NS);
-	mmio_write_32(SGRF_BASE + SGRF_DMAC_CON(1), DMA_PERI_CH_NS_15_0);
-	mmio_write_32(SGRF_BASE + SGRF_DMAC_CON(2), DMA_PERI_CH_NS_19_16);
-	mmio_write_32(SGRF_BASE + SGRF_DMAC_CON(3), DMA_MANAGER_BOOT_NS);
-
-	/* soft reset dma before use */
-	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(1), DMA_SOFTRST_REQ);
-	udelay(5);
-	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(1), DMA_SOFTRST_RLS);
-}
-
 static void soc_reset_config_all(void)
 {
 	uint32_t tmp;

plat/rockchip/px30/drivers/soc/soc.h

@@ -28,21 +28,6 @@ enum pll_mode {
 	DEEP_SLOW_MODE,
 };
 
-/***************************************************************************
- * SGRF
- ***************************************************************************/
-#define SGRF_SOC_CON(i)		((i) * 0x4)
-#define SGRF_DMAC_CON(i)	(0x30 + (i) * 0x4)
-
-#define SGRF_MST_S_ALL_NS	0xffffffff
-#define SGRF_SLV_S_ALL_NS	0xffff0000
-#define DMA_IRQ_BOOT_NS		0xffffffff
-#define DMA_PERI_CH_NS_15_0	0xffffffff
-#define DMA_PERI_CH_NS_19_16	0x000f000f
-#define DMA_MANAGER_BOOT_NS	0x00010001
-#define DMA_SOFTRST_REQ		BITS_WITH_WMASK(1, 0x1, 12)
-#define DMA_SOFTRST_RLS		BITS_WITH_WMASK(0, 0x1, 12)
-
 /***************************************************************************
  * GRF
  ***************************************************************************/
@@ -60,18 +45,6 @@ enum pll_mode {
 
 #define GRF_SOC_CON2_NSWDT_RST_EN 12
 
-/***************************************************************************
- * DDR FIREWALL
- ***************************************************************************/
-#define FIREWALL_DDR_FW_DDR_RGN(i)	((i) * 0x4)
-#define FIREWALL_DDR_FW_DDR_MST(i)	(0x20 + (i) * 0x4)
-#define FIREWALL_DDR_FW_DDR_CON_REG	0x40
-#define FIREWALL_DDR_FW_DDR_RGN_NUM	8
-#define FIREWALL_DDR_FW_DDR_MST_NUM	6
-
-#define PLAT_MAX_DDR_CAPACITY_MB	4096
-#define RG_MAP_SECURE(top, base)	((((top) - 1) << 16) | (base))
-
 /***************************************************************************
  * cru
  ***************************************************************************/
@@ -136,37 +109,10 @@ enum pll_mode {
 #define GPIO_INT_STATUS		0x40
 #define GPIO_NUMS		4
 
-/**************************************************
- * secure timer
- **************************************************/
-
-/* chanal0~5 */
-#define STIMER_CHN_BASE(n)	(STIME_BASE + 0x20 * (n))
-
-#define TIMER_LOAD_COUNT0	0x0
-#define TIMER_LOAD_COUNT1	0x4
-
-#define TIMER_CUR_VALUE0	0x8
-#define TIMER_CUR_VALUE1	0xc
-
-#define TIMER_CONTROL_REG	0x10
-#define TIMER_INTSTATUS		0x18
-
-#define TIMER_DIS		0x0
-#define TIMER_EN		0x1
-
-#define TIMER_FMODE		(0x0 << 1)
-#define TIMER_RMODE		(0x1 << 1)
-
-#define TIMER_LOAD_COUNT0_MSK	(0xffffffff)
-#define TIMER_LOAD_COUNT1_MSK	(0xffffffff00000000)
-
 void clk_gate_con_save(uint32_t *clkgt_save);
 void clk_gate_con_restore(uint32_t *clkgt_save);
 void clk_gate_con_disable(void);
 
-void secure_timer_init(void);
-void secure_timer_disable(void);
 void px30_soc_reset_config(void);
 
 #endif /* __SOC_H__ */

plat/rockchip/px30/include/platform_def.h

@@ -69,9 +69,9 @@
 /*******************************************************************************
  * Platform memory map related constants
  ******************************************************************************/
-/* TF text, ro, rw, Size: 512KB */
+/* TF text, ro, rw, Size: 1MB */
 #define TZRAM_BASE		(0x0)
-#define TZRAM_SIZE		(0x80000)
+#define TZRAM_SIZE		(0x100000)
 
 /*******************************************************************************
  * BL31 specific defines.

plat/rockchip/px30/platform.mk

@@ -20,6 +20,7 @@ PLAT_INCLUDES		:=	-Idrivers/arm/gic/common/			\
 				-I${RK_PLAT_COMMON}/pmusram			\
 				-I${RK_PLAT_SOC}/				\
 				-I${RK_PLAT_SOC}/drivers/pmu/			\
+				-I${RK_PLAT_SOC}/drivers/secure/		\
 				-I${RK_PLAT_SOC}/drivers/soc/			\
 				-I${RK_PLAT_SOC}/include/
 
@@ -45,16 +46,20 @@ BL31_SOURCES		+=	${RK_GIC_SOURCES}				\
 				${RK_PLAT_COMMON}/aarch64/plat_helpers.S	\
 				${RK_PLAT_COMMON}/aarch64/platform_common.c	\
 				${RK_PLAT_COMMON}/bl31_plat_setup.c		\
-				${RK_PLAT_COMMON}/drivers/parameter/ddr_parameter.c	\
 				${RK_PLAT_COMMON}/params_setup.c		\
 				${RK_PLAT_COMMON}/pmusram/cpus_on_fixed_addr.S	\
 				${RK_PLAT_COMMON}/plat_pm.c			\
 				${RK_PLAT_COMMON}/plat_topology.c		\
 				${RK_PLAT_COMMON}/rockchip_sip_svc.c		\
 				${RK_PLAT_SOC}/drivers/pmu/pmu.c		\
+				${RK_PLAT_SOC}/drivers/secure/secure.c		\
 				${RK_PLAT_SOC}/drivers/soc/soc.c		\
 				${RK_PLAT_SOC}/plat_sip_calls.c
 
+ifdef PLAT_RK_SECURE_DDR_MINILOADER
+BL31_SOURCES		+=	${RK_PLAT_COMMON}/drivers/parameter/ddr_parameter.c
+endif
+
 ENABLE_PLAT_COMPAT	:=	0
 MULTI_CONSOLE_API	:=	1
 

plat/rockchip/px30/px30_def.h

@@ -11,6 +11,7 @@
 #define MINOR_VERSION		(0)
 
 #define SIZE_K(n)		((n) * 1024)
+#define SIZE_M(n)		((n) * 1024 * 1024)
 
 #define WITH_16BITS_WMSK(bits)	(0xffff0000 | (bits))
 

plat/rockchip/rk3288/drivers/secure/secure.c

 /*
- * Copyright (c) 2016, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2016-2019, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -38,15 +38,18 @@ static void sgrf_ddr_rgn_global_bypass(uint32_t bypass)
  * SGRF_SOC_CON21 - end address of the RGN_7 + RGN_X control
  *
  * @rgn - the DDR regions 0 ~ 7 which are can be configured.
- * The @st and @ed indicate the start and end addresses for which to set
- * the security, and the unit is byte. When the st_mb == 0, ed_mb == 0, the
+ * @st - start address to set as secure
+ * @sz - length of area to set as secure
+ * The @st_mb and @ed_mb indicate the start and end addresses for which to set
+ * the security, and the unit is megabyte. When the st_mb == 0, ed_mb == 0, the
  * address range 0x0 ~ 0xfffff is secure.
  *
  * For example, if we would like to set the range [0, 32MB) is security via
  * DDR_RGN0, then rgn == 0, st_mb == 0, ed_mb == 31.
  */
-static void sgrf_ddr_rgn_config(uint32_t rgn, uintptr_t st, uintptr_t ed)
+static void sgrf_ddr_rgn_config(uint32_t rgn, uintptr_t st, size_t sz)
 {
+	uintptr_t ed = st + sz;
 	uintptr_t st_mb, ed_mb;
 
 	assert(rgn <= 7);

plat/rockchip/rk3328/drivers/soc/soc.c

 /*
- * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2017-2019, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -97,6 +97,7 @@ void secure_timer_init(void)
 
 void sgrf_init(void)
 {
+#ifdef PLAT_RK_SECURE_DDR_MINILOADER
 	uint32_t i, val;
 	struct param_ddr_usage usg;
 
@@ -115,6 +116,7 @@ void sgrf_init(void)
 			      FIREWALL_DDR_FW_DDR_RGN(7 - i),
 			      RG_MAP_SECURE(usg.s_top[i], usg.s_base[i]));
 	}
+#endif
 
 	/* set ddr rgn0_top and rga0_top as 0 */
 	mmio_write_32(FIREWALL_DDR_BASE + FIREWALL_DDR_FW_DDR_RGN(0), 0x0);

plat/rockchip/rk3328/include/platform_def.h

 /*
- * Copyright (c) 2017-2018, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2017-2019, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -66,9 +66,9 @@
 /*******************************************************************************
  * Platform memory map related constants
  ******************************************************************************/
-/* TF text, ro, rw, Size: 512KB */
+/* TF text, ro, rw, Size: 1MB */
 #define TZRAM_BASE		(0x0)
-#define TZRAM_SIZE		(0x80000)
+#define TZRAM_SIZE		(0x100000)
 
 /*******************************************************************************
  * BL31 specific defines.

plat/rockchip/rk3328/platform.mk

@@ -42,7 +42,6 @@ BL31_SOURCES		+=	${RK_GIC_SOURCES}				\
 				drivers/delay_timer/generic_delay_timer.c	\
 				lib/cpus/aarch64/aem_generic.S			\
 				lib/cpus/aarch64/cortex_a53.S			\
-				${RK_PLAT_COMMON}/drivers/parameter/ddr_parameter.c	\
 				${RK_PLAT_COMMON}/aarch64/plat_helpers.S	\
 				${RK_PLAT_COMMON}/params_setup.c		\
 				${RK_PLAT_COMMON}/bl31_plat_setup.c		\
@@ -53,6 +52,10 @@ BL31_SOURCES		+=	${RK_GIC_SOURCES}				\
 				${RK_PLAT_SOC}/drivers/pmu/pmu.c		\
 				${RK_PLAT_SOC}/drivers/soc/soc.c
 
+ifdef PLAT_RK_SECURE_DDR_MINILOADER
+BL31_SOURCES		+=	${RK_PLAT_COMMON}/drivers/parameter/ddr_parameter.c
+endif
+
 include lib/coreboot/coreboot.mk
 include lib/libfdt/libfdt.mk
 

plat/rockchip/rk3368/include/platform_def.h

 /*
- * Copyright (c) 2014-2018, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2014-2019, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -67,9 +67,9 @@
 /*******************************************************************************
  * Platform memory map related constants
  ******************************************************************************/
-/* TF text, ro, rw, Size: 512KB */
+/* TF text, ro, rw, Size: 1MB */
 #define TZRAM_BASE		(0x0)
-#define TZRAM_SIZE		(0x80000)
+#define TZRAM_SIZE		(0x100000)
 
 /*******************************************************************************
  * BL31 specific defines.

plat/rockchip/rk3399/drivers/secure/secure.c

 /*
- * Copyright (c) 2016, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2016-2019, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -45,6 +45,8 @@ static void sgrf_ddr_rgn_global_bypass(uint32_t bypass)
  *                bypass, 1: enable bypass
  *
  * @rgn - the DDR regions 0 ~ 7 which are can be configured.
+ * @st - start address to set as secure
+ * @sz - length of area to set as secure
  * The @st_mb and @ed_mb indicate the start and end addresses for which to set
  * the security, and the unit is megabyte. When the st_mb == 0, ed_mb == 0, the
  * address range 0x0 ~ 0xfffff is secure.
@@ -53,8 +55,9 @@ static void sgrf_ddr_rgn_global_bypass(uint32_t bypass)
  * DDR_RGN0, then rgn == 0, st_mb == 0, ed_mb == 31.
  */
 static void sgrf_ddr_rgn_config(uint32_t rgn,
-				uintptr_t st, uintptr_t ed)
+				uintptr_t st, size_t sz)
 {
+	uintptr_t ed = st + sz;
 	uintptr_t st_mb, ed_mb;
 
 	assert(rgn <= 7);