Restricted DMA

The key for this scheme to work is that you need some sort of protection mechanism whereby the PCIe host bridge is allowed/denied access to specific regions of memory. The use of an ARM Trusted Firmware is probably two fold in that it is part of the chain of trust for said platform, and given there are at least 2 different SoC vendors to be supported, then the firmware provides some nice abstraction on how to configure this region to be restricted.