vhaudiquet/u-boot-krane
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge patch series "Firewall ATF and OP-TEE memory regions in Sitara"

Browse Source 
Suhaas Joshi <s-joshi@ti.com> says:

This series starts by replacing hard-coded addresses in firewall
templates that are defined in k3-binman.dtsi, by Kconfigs. Using
Kconfigs makes it easier for someone to move ATF and OP-TEE to another
location, since they wouldn't have to fiddle with the firewall
configurations in dtsi files.

The rest of the commits in this series add firewall configs to each
device's dtsi files.

I have only tested this patch series with TI boards. For non-TI Sitara
boards, respective board maintainers are requested to test the relevant
patch and confirm whether it works.

To test this, I used `k3conf <read|write> <address> [<value>]`. Both of
these operations were disallowed, as expected.

Link: https://lore.kernel.org/r/20260127081652.506357-1-s-joshi@ti.com
This commit is contained in:
Tom Rini
2026-02-07 11:51:14 -06:00
parent 3243a73102 64daef1ada
commit 2ffab9da91
10 changed files with 279 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
arch/arm/dts/k3-am625-phycore-som-binman.dtsi
+30
View File
@@ -215,6 +215,36 @@
fit {
images {
atf {
ti-secure {
auth-in-place = <0xa02>;
firewall-1-0 {
insert-template = <&firewall_bg_3>;
id = <1>;
region = <0>;
};
firewall-1-1 {
insert-template = <&firewall_armv8_atf_fg>;
id = <1>;
region = <1>;
};
};
};
tee {
ti-secure {
auth-in-place = <0xa02>;
firewall-1-2 {
insert-template = <&firewall_armv8_optee_fg>;
id = <1>;
region = <2>;
};
};
};
tifsstub-hs {
description = "TIFSSTUB";
type = "firmware";
arch/arm/dts/k3-am625-sk-binman.dtsi
+29
View File
@@ -275,6 +275,35 @@
fit {
images {
atf {
ti-secure {
auth-in-place = <0xa02>;
firewall-1-0 {
insert-template = <&firewall_bg_3>;
id = <1>;
region = <0>;
};
firewall-1-1 {
insert-template = <&firewall_armv8_atf_fg>;
id = <1>;
region = <1>;
};
};
};
tee {
ti-secure {
auth-in-place = <0xa02>;
firewall-1-2 {
insert-template = <&firewall_armv8_optee_fg>;
id = <1>;
region = <2>;
};
};
};
tifsstub-hs {
description = "TIFSSTUB";
arch/arm/dts/k3-am625-verdin-wifi-dev-binman.dtsi
+30
View File
@@ -200,6 +200,36 @@
fit {
images {
atf {
ti-secure {
auth-in-place = <0xa02>;
firewall-1-0 {
insert-template = <&firewall_bg_3>;
id = <1>;
region = <0>;
};
firewall-1-1 {
insert-template = <&firewall_armv8_atf_fg>;
id = <1>;
region = <1>;
};
};
};
tee {
ti-secure {
auth-in-place = <0xa02>;
firewall-1-2 {
insert-template = <&firewall_armv8_optee_fg>;
id = <1>;
region = <2>;
};
};
};
tifsstub-hs {
description = "TIFSSTUB";
type = "firmware";
arch/arm/dts/k3-am62a-phycore-som-binman.dtsi
+30
View File
@@ -165,6 +165,36 @@
fit {
images {
atf {
ti-secure {
auth-in-place = <0xa02>;
firewall-1-0 {
insert-template = <&firewall_bg_3>;
id = <1>;
region = <0>;
};
firewall-1-1 {
insert-template = <&firewall_armv8_atf_fg>;
id = <1>;
region = <1>;
};
};
};
tee {
ti-secure {
auth-in-place = <0xa02>;
firewall-1-2 {
insert-template = <&firewall_armv8_optee_fg>;
id = <1>;
region = <2>;
};
};
};
tifsstub-hs {
description = "TIFSSTUB";
type = "firmware";
arch/arm/dts/k3-am62a-sk-binman.dtsi
+30
View File
@@ -200,6 +200,36 @@
fit {
images {
atf {
ti-secure {
auth-in-place = <0xa02>;
firewall-1-0 {
insert-template = <&firewall_bg_3>;
id = <1>;
region = <0>;
};
firewall-1-1 {
insert-template = <&firewall_armv8_atf_fg>;
id = <1>;
region = <1>;
};
};
};
tee {
ti-secure {
auth-in-place = <0xa02>;
firewall-1-2 {
insert-template = <&firewall_armv8_optee_fg>;
id = <1>;
region = <2>;
};
};
};
tifsstub-hs {
description = "TIFSSTUB";
type = "firmware";
arch/arm/dts/k3-am62p-sk-binman.dtsi
+32
View File
@@ -217,6 +217,38 @@
fit {
images {
atf {
ti-secure {
auth-in-place = <0xa02>;
firewall-1-0 {
insert-template = <&firewall_bg_3>;
id = <1>;
region = <0>;
};
firewall-1-1 {
insert-template = <&firewall_armv8_atf_fg>;
id = <1>;
region = <1>;
};
};
};
tee {
ti-secure {
auth-in-place = <0xa02>;
firewall-1-2 {
insert-template = <&firewall_armv8_optee_fg>;
id = <1>;
region = <2>;
};
};
};
tifsstub-hs {
description = "TIFSSTUB";
type = "firmware";
arch/arm/dts/k3-am62p5-verdin-wifi-dev-binman.dtsi
+32
View File
@@ -159,6 +159,38 @@
fit {
images {
atf {
ti-secure {
auth-in-place = <0xa02>;
firewall-1-0 {
insert-template = <&firewall_bg_3>;
id = <1>;
region = <0>;
};
firewall-1-1 {
insert-template = <&firewall_armv8_atf_fg>;
id = <1>;
region = <1>;
};
};
};
tee {
ti-secure {
auth-in-place = <0xa02>;
firewall-1-2 {
insert-template = <&firewall_armv8_optee_fg>;
id = <1>;
region = <2>;
};
};
};
tifsstub-hs {
description = "TIFSSTUB";
type = "firmware";
arch/arm/dts/k3-am642-phycore-som-binman.dtsi
+31
View File
@@ -141,6 +141,37 @@
#address-cells = <1>;
images {
atf {
ti-secure {
auth-in-place = <0xa02>;
firewall-24-5 {
insert-template = <&firewall_armv8_atf_fg>;
id = <24>;
region = <5>;
};
};
};
tee {
ti-secure {
auth-in-place = <0xa02>;
firewall-1-0 {
insert-template = <&firewall_bg_3>;
id = <1>;
region = <0>;
};
firewall-1-1 {
insert-template = <&firewall_armv8_optee_fg>;
id = <1>;
region = <1>;
};
};
};
dm {
blob-ext {
filename = "/dev/null";
arch/arm/dts/k3-am64x-binman.dtsi
+31
View File
@@ -139,6 +139,37 @@
#address-cells = <1>;
images {
atf {
ti-secure {
auth-in-place = <0xa02>;
firewall-24-5 {
insert-template = <&firewall_armv8_atf_fg>;
id = <24>;
region = <5>;
};
};
};
tee {
ti-secure {
auth-in-place = <0xa02>;
firewall-1-0 {
insert-template = <&firewall_bg_3>;
id = <1>;
region = <0>;
};
firewall-1-1 {
insert-template = <&firewall_armv8_optee_fg>;
id = <1>;
region = <1>;
};
};
};
dm {
blob-ext {
filename = "/dev/null";
arch/arm/dts/k3-binman.dtsi
+4 -4
View File
@@ -476,8 +476,8 @@
permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) |
FWPERM_SECURE_PRIV_RWCD |
FWPERM_SECURE_USER_RWCD)>;
start_address = <0x0 0x70000000>;
end_address = <0x0 0x7001ffff>;
start_address = <0x0 CONFIG_K3_ATF_LOAD_ADDR>;
end_address = <0x0 (CONFIG_K3_ATF_LOAD_ADDR + 0x1ffff)>;
};
firewall_armv8_optee_fg: template-8 {
control = <(FWCTRL_EN | FWCTRL_LOCK |
@@ -485,8 +485,8 @@
permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) |
FWPERM_SECURE_PRIV_RWCD |
FWPERM_SECURE_USER_RWCD)>;
start_address = <0x0 0x9e800000>;
end_address = <0x0 0x9fffffff>;
start_address = <0x0 CONFIG_K3_OPTEE_LOAD_ADDR>;
end_address = <0x0 (CONFIG_K3_OPTEE_LOAD_ADDR + 0x17fffff)>;
};
ti_falcon_template: template-9 {