summaryrefslogtreecommitdiff
path: root/arch
diff options
context:
space:
mode:
Diffstat (limited to 'arch')
-rw-r--r--arch/arm/dts/k3-binman.dtsi49
-rw-r--r--arch/arm/dts/k3-j7200-binman.dtsi90
-rw-r--r--arch/arm/dts/k3-j721e-binman.dtsi116
-rw-r--r--arch/arm/dts/k3-j721s2-binman.dtsi123
-rw-r--r--arch/arm/dts/k3-security.h58
5 files changed, 436 insertions, 0 deletions
diff --git a/arch/arm/dts/k3-binman.dtsi b/arch/arm/dts/k3-binman.dtsi
index cd9926a0169..758c8bf6ea1 100644
--- a/arch/arm/dts/k3-binman.dtsi
+++ b/arch/arm/dts/k3-binman.dtsi
@@ -3,6 +3,8 @@
* Copyright (C) 2022-2023 Texas Instruments Incorporated - https://www.ti.com/
*/
+#include "k3-security.h"
+
/ {
binman: binman {
multiple-images;
@@ -437,6 +439,53 @@
};
};
};
+ firewall_bg_1: template-5 {
+ control = <(FWCTRL_EN | FWCTRL_LOCK |
+ FWCTRL_BG | FWCTRL_CACHE)>;
+ permissions = <((FWPRIVID_ALL << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD |
+ FWPERM_NON_SECURE_PRIV_RWCD |
+ FWPERM_NON_SECURE_USER_RWCD)>;
+ start_address = <0x0 0x0>;
+ end_address = <0xff 0xffffffff>;
+ };
+ firewall_bg_3: template-6 {
+ insert-template = <&firewall_bg_1>;
+ permissions = <((FWPRIVID_ALL << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD |
+ FWPERM_NON_SECURE_PRIV_RWCD |
+ FWPERM_NON_SECURE_USER_RWCD)>,
+ <((FWPRIVID_ALL << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD |
+ FWPERM_NON_SECURE_PRIV_RWCD |
+ FWPERM_NON_SECURE_USER_RWCD)>,
+ <((FWPRIVID_ALL << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD |
+ FWPERM_NON_SECURE_PRIV_RWCD |
+ FWPERM_NON_SECURE_USER_RWCD)>;
+ };
+ firewall_armv8_atf_fg: template-7 {
+ control = <(FWCTRL_EN | FWCTRL_LOCK |
+ FWCTRL_CACHE)>;
+ permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD)>;
+ start_address = <0x0 0x70000000>;
+ end_address = <0x0 0x7001ffff>;
+ };
+ firewall_armv8_optee_fg: template-8 {
+ control = <(FWCTRL_EN | FWCTRL_LOCK |
+ FWCTRL_CACHE)>;
+ permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD)>;
+ start_address = <0x0 0x9e800000>;
+ end_address = <0x0 0x9fffffff>;
+ };
};
diff --git a/arch/arm/dts/k3-j7200-binman.dtsi b/arch/arm/dts/k3-j7200-binman.dtsi
index 38cccabaa71..06db8659876 100644
--- a/arch/arm/dts/k3-j7200-binman.dtsi
+++ b/arch/arm/dts/k3-j7200-binman.dtsi
@@ -195,6 +195,96 @@
fit {
images {
+ atf {
+ ti-secure {
+ auth-in-place = <0xa02>;
+
+ firewall-257-0 {
+ /* cpu_0_cpu_0_msmc Background Firewall */
+ insert-template = <&firewall_bg_1>;
+ id = <257>;
+ region = <0>;
+ };
+
+ firewall-257-1 {
+ /* cpu_0_cpu_0_msmc Foreground Firewall */
+ insert-template = <&firewall_armv8_atf_fg>;
+ id = <257>;
+ region = <1>;
+ };
+
+ /* firewall-4760-0 {
+ * nb_slv0__mem0 Background Firewall
+ * Already configured by the secure entity
+ * };
+ */
+
+ firewall-4760-1 {
+ /* nb_slv0__mem0 Foreground Firewall */
+ insert-template = <&firewall_armv8_atf_fg>;
+ id = <4760>;
+ region = <1>;
+ };
+
+ /* firewall-4761-0 {
+ * nb_slv1__mem0 Background Firewall
+ * Already configured by the secure entity
+ * };
+ */
+
+ firewall-4761-1 {
+ /* nb_slv1__mem0 Foreground Firewall */
+ insert-template = <&firewall_armv8_atf_fg>;
+ id = <4761>;
+ region = <1>;
+ };
+ };
+ };
+
+ tee {
+ ti-secure {
+ auth-in-place = <0xa02>;
+
+ /* cpu_0_cpu_0_msmc region 0 and 1 configured
+ * during ATF Firewalling
+ */
+
+ firewall-257-2 {
+ /* cpu_0_cpu_0_msmc Foreground Firewall */
+ insert-template = <&firewall_armv8_optee_fg>;
+ id = <257>;
+ region = <2>;
+ };
+
+ firewall-4762-0 {
+ /* nb_slv2__mem0 Background Firewall - 0 */
+ insert-template = <&firewall_bg_3>;
+ id = <4762>;
+ region = <0>;
+ };
+
+ firewall-4762-1 {
+ /* nb_slv2__mem0 Foreground Firewall */
+ insert-template = <&firewall_armv8_optee_fg>;
+ id = <4762>;
+ region = <1>;
+ };
+
+ firewall-4763-0 {
+ /* nb_slv3__mem0 Background Firewall - 0 */
+ insert-template = <&firewall_bg_3>;
+ id = <4763>;
+ region = <0>;
+ };
+
+ firewall-4763-1 {
+ /* nb_slv3__mem0 Foreground Firewall */
+ insert-template = <&firewall_armv8_optee_fg>;
+ id = <4763>;
+ region = <1>;
+ };
+ };
+ };
dm {
ti-secure {
content = <&dm>;
diff --git a/arch/arm/dts/k3-j721e-binman.dtsi b/arch/arm/dts/k3-j721e-binman.dtsi
index dbc385a852d..1bd9f96a58e 100644
--- a/arch/arm/dts/k3-j721e-binman.dtsi
+++ b/arch/arm/dts/k3-j721e-binman.dtsi
@@ -146,6 +146,122 @@
fit {
images {
+ atf {
+ ti-secure {
+ auth-in-place = <0xa02>;
+
+ firewall-257-0 {
+ /* cpu_0_cpu_0_msmc Background Firewall */
+ insert-template = <&firewall_bg_1>;
+ id = <257>;
+ region = <0>;
+ };
+
+ firewall-257-1 {
+ /* cpu_0_cpu_0_msmc Foreground Firewall */
+ insert-template = <&firewall_armv8_atf_fg>;
+ id = <257>;
+ region = <1>;
+ };
+
+ firewall-284-0 {
+ /* dru_0_msmc Background Firewall */
+ insert-template = <&firewall_bg_3>;
+ id = <284>;
+ region = <0>;
+ };
+
+ firewall-284-1 {
+ /* dru_0_msmc Foreground Firewall */
+ insert-template = <&firewall_armv8_atf_fg>;
+ id = <284>;
+ region = <1>;
+ };
+
+ /* firewall-4760-0 {
+ * nb_slv0__mem0 Background Firewall
+ * Already configured by the secure entity
+ * };
+ */
+
+ firewall-4760-1 {
+ /* nb_slv0__mem0 Foreground Firewall */
+ insert-template = <&firewall_armv8_atf_fg>;
+ id = <4760>;
+ region = <1>;
+ };
+
+ /* firewall-4761-0 {
+ * nb_slv1__mem0 Background Firewall
+ * Already configured by the secure entity
+ * };
+ */
+
+ firewall-4761-1 {
+ /* nb_slv1__mem0 Foreground Firewall */
+ insert-template = <&firewall_armv8_atf_fg>;
+ id = <4761>;
+ region = <1>;
+ };
+
+ };
+ };
+
+ tee {
+ ti-secure {
+ auth-in-place = <0xa02>;
+
+ /* cpu_0_cpu_0_msmc region 0 and 1 configured
+ * during ATF Firewalling
+ */
+
+ firewall-257-2 {
+ /* cpu_0_cpu_0_msmc Foreground Firewall */
+ insert-template = <&firewall_armv8_optee_fg>;
+ id = <257>;
+ region = <2>;
+ };
+
+ /* dru_0_msmc region 0 and 1 configured
+ * during ATF Firewalling
+ */
+
+ firewall-284-2 {
+ /* dru_0_msmc Foreground Firewall */
+ insert-template = <&firewall_armv8_optee_fg>;
+ id = <284>;
+ region = <2>;
+ };
+
+ firewall-4762-0 {
+ /* nb_slv2__mem0 Background Firewall */
+ insert-template = <&firewall_bg_3>;
+ id = <4762>;
+ region = <0>;
+ };
+
+ firewall-4762-1 {
+ /* nb_slv2__mem0 Foreground Firewall */
+ insert-template = <&firewall_armv8_optee_fg>;
+ id = <4762>;
+ region = <1>;
+ };
+
+ firewall-4763-0 {
+ /* nb_slv3__mem0 Background Firewall */
+ insert-template = <&firewall_bg_3>;
+ id = <4763>;
+ region = <0>;
+ };
+
+ firewall-4763-1 {
+ /* nb_slv3__mem0 Foreground Firewall */
+ insert-template = <&firewall_armv8_optee_fg>;
+ id = <4763>;
+ region = <1>;
+ };
+ };
+ };
dm {
ti-secure {
content = <&dm>;
diff --git a/arch/arm/dts/k3-j721s2-binman.dtsi b/arch/arm/dts/k3-j721s2-binman.dtsi
index f17dd8e04cf..7efb135bdff 100644
--- a/arch/arm/dts/k3-j721s2-binman.dtsi
+++ b/arch/arm/dts/k3-j721s2-binman.dtsi
@@ -159,6 +159,129 @@
fit {
images {
+ atf {
+ ti-secure {
+ auth-in-place = <0xa02>;
+
+ firewall-257-0 {
+ /* cpu_0_cpu_0_msmc Background Firewall */
+ insert-template = <&firewall_bg_1>;
+ id = <257>;
+ region = <0>;
+ };
+
+ firewall-257-1 {
+ /* cpu_0_cpu_0_msmc Foreground Firewall */
+ insert-template = <&firewall_armv8_atf_fg>;
+ id = <257>;
+ region = <1>;
+ };
+
+ firewall-284-0 {
+ /* dru_0_msmc Background Firewall */
+ insert-template = <&firewall_bg_3>;
+ id = <284>;
+ region = <0>;
+ };
+
+ firewall-284-1 {
+ /* dru_0_msmc Foreground Firewall */
+ insert-template = <&firewall_armv8_atf_fg>;
+ id = <284>;
+ region = <1>;
+ };
+
+ /* firewall-5140-0 {
+ * nb_slv0__mem0 Background Firewall
+ * Already configured by the secure entity
+ * };
+ */
+
+ firewall-5140-1 {
+ /* nb_slv0__mem0 Foreground Firewall */
+ insert-template = <&firewall_armv8_atf_fg>;
+ id = <5140>;
+ region = <1>;
+ };
+
+ /* firewall-5140-0 {
+ * nb_slv1__mem0 Background Firewall
+ * Already configured by the secure entity
+ * };
+ */
+
+ firewall-5141-1 {
+ /* nb_slv1__mem0 Foreground Firewall */
+ insert-template = <&firewall_armv8_atf_fg>;
+ id = <5141>;
+ region = <1>;
+ };
+
+ };
+ };
+
+ tee {
+ ti-secure {
+ auth-in-place = <0xa02>;
+
+ firewall-257-2 {
+ /* cpu_0_cpu_0_msmc Foreground Firewall */
+ insert-template = <&firewall_armv8_optee_fg>;
+ id = <257>;
+ region = <2>;
+ };
+
+ firewall-284-2 {
+ /* dru_0_msmc Foreground Firewall */
+ insert-template = <&firewall_armv8_optee_fg>;
+ id = <284>;
+ region = <2>;
+ };
+
+ firewall-5142-0 {
+ /* nb_slv2__mem0 Background Firewall - 0 */
+ insert-template = <&firewall_bg_3>;
+ id = <5142>;
+ region = <0>;
+ };
+
+ firewall-5142-1 {
+ /* nb_slv2__mem0 Foreground Firewall */
+ insert-template = <&firewall_armv8_optee_fg>;
+ id = <5142>;
+ region = <1>;
+ };
+
+ firewall-5143-0 {
+ /* nb_slv3__mem0 Background Firewall - 0 */
+ insert-template = <&firewall_bg_3>;
+ id = <5143>;
+ region = <0>;
+ };
+
+ firewall-5143-1 {
+ /* nb_slv3__mem0 Foreground Firewall */
+ insert-template = <&firewall_armv8_optee_fg>;
+ id = <5143>;
+ region = <1>;
+ };
+
+ firewall-5144-0 {
+ /* nb_slv4__mem0 Background Firewall - 0 */
+ insert-template = <&firewall_bg_3>;
+ id = <5144>;
+ region = <0>;
+ };
+
+ firewall-5144-1 {
+ /* nb_slv4__mem0 Foreground Firewall */
+ insert-template = <&firewall_armv8_optee_fg>;
+ id = <5144>;
+ region = <1>;
+ };
+
+ };
+ };
dm {
ti-secure {
content = <&dm>;
diff --git a/arch/arm/dts/k3-security.h b/arch/arm/dts/k3-security.h
new file mode 100644
index 00000000000..33609caa8fb
--- /dev/null
+++ b/arch/arm/dts/k3-security.h
@@ -0,0 +1,58 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (C) 2023 Texas Instruments Incorporated - https://www.ti.com/
+ */
+
+#ifndef DTS_ARM64_TI_K3_FIREWALL_H
+#define DTS_ARM64_TI_K3_FIREWALL_H
+
+#define FWPRIVID_ALL 0xc3
+#define FWPRIVID_ARMV8 1
+#define FWPRIVID_SHIFT 16
+
+#define FWCTRL_EN 0xA
+#define FWCTRL_LOCK (1 << 4)
+#define FWCTRL_BG (1 << 8)
+#define FWCTRL_CACHE (1 << 9)
+
+#define FWPERM_SECURE_PRIV_WRITE (1 << 0)
+#define FWPERM_SECURE_PRIV_READ (1 << 1)
+#define FWPERM_SECURE_PRIV_CACHEABLE (1 << 2)
+#define FWPERM_SECURE_PRIV_DEBUG (1 << 3)
+
+#define FWPERM_SECURE_PRIV_RWCD (FWPERM_SECURE_PRIV_READ | \
+ FWPERM_SECURE_PRIV_WRITE | \
+ FWPERM_SECURE_PRIV_CACHEABLE | \
+ FWPERM_SECURE_PRIV_DEBUG)
+
+#define FWPERM_SECURE_USER_WRITE (1 << 4)
+#define FWPERM_SECURE_USER_READ (1 << 5)
+#define FWPERM_SECURE_USER_CACHEABLE (1 << 6)
+#define FWPERM_SECURE_USER_DEBUG (1 << 7)
+
+#define FWPERM_SECURE_USER_RWCD (FWPERM_SECURE_USER_READ | \
+ FWPERM_SECURE_USER_WRITE | \
+ FWPERM_SECURE_USER_CACHEABLE | \
+ FWPERM_SECURE_USER_DEBUG)
+
+#define FWPERM_NON_SECURE_PRIV_WRITE (1 << 8)
+#define FWPERM_NON_SECURE_PRIV_READ (1 << 9)
+#define FWPERM_NON_SECURE_PRIV_CACHEABLE (1 << 10)
+#define FWPERM_NON_SECURE_PRIV_DEBUG (1 << 11)
+
+#define FWPERM_NON_SECURE_PRIV_RWCD (FWPERM_NON_SECURE_PRIV_READ | \
+ FWPERM_NON_SECURE_PRIV_WRITE | \
+ FWPERM_NON_SECURE_PRIV_CACHEABLE | \
+ FWPERM_NON_SECURE_PRIV_DEBUG)
+
+#define FWPERM_NON_SECURE_USER_WRITE (1 << 12)
+#define FWPERM_NON_SECURE_USER_READ (1 << 13)
+#define FWPERM_NON_SECURE_USER_CACHEABLE (1 << 14)
+#define FWPERM_NON_SECURE_USER_DEBUG (1 << 15)
+
+#define FWPERM_NON_SECURE_USER_RWCD (FWPERM_NON_SECURE_USER_READ | \
+ FWPERM_NON_SECURE_USER_WRITE | \
+ FWPERM_NON_SECURE_USER_CACHEABLE | \
+ FWPERM_NON_SECURE_USER_DEBUG)
+
+#endif
generated by cgit v1.2.3 (git 2.0.4) at 2025-08-06 04:42:33 +0000