[PATCH v6 5/8] binman: j721s2: Add firewall configurations
Manorit Chawdhry
m-chawdhry at ti.com
Wed Dec 6 10:51:27 CET 2023
The following commits adds the configuration of firewalls required to
protect ATF and OP-TEE memory region from non-secure reads and
writes using master and slave firewalls present in our K3 SOCs.
Signed-off-by: Manorit Chawdhry <m-chawdhry at ti.com>
---
arch/arm/dts/k3-j721s2-binman.dtsi | 217 +++++++++++++++++++++++++++++++++++++
1 file changed, 217 insertions(+)
diff --git a/arch/arm/dts/k3-j721s2-binman.dtsi b/arch/arm/dts/k3-j721s2-binman.dtsi
index 3922007b3b7a..72d54635f4e1 100644
--- a/arch/arm/dts/k3-j721s2-binman.dtsi
+++ b/arch/arm/dts/k3-j721s2-binman.dtsi
@@ -159,6 +159,223 @@
fit {
images {
+ atf {
+ ti-secure {
+ auth-in-place = <0xa02>;
+
+ firewall-257-0 {
+ /* cpu_0_cpu_0_msmc Background Firewall */
+ id = <257>;
+ region = <0>;
+ control = <(FWCTRL_EN | FWCTRL_LOCK |
+ FWCTRL_BG | FWCTRL_CACHE)>;
+ permissions = <((FWPRIVID_ALL << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD |
+ FWPERM_NON_SECURE_PRIV_RWCD |
+ FWPERM_NON_SECURE_USER_RWCD)>;
+ start_address = <0x0 0x0>;
+ end_address = <0xff 0xffffffff>;
+ };
+
+ firewall-257-1 {
+ /* cpu_0_cpu_0_msmc Foreground Firewall */
+ id = <257>;
+ region = <1>;
+ control = <(FWCTRL_EN | FWCTRL_LOCK |
+ FWCTRL_CACHE)>;
+ permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD)>;
+ start_address = <0x0 0x70000000>;
+ end_address = <0x0 0x7001ffff>;
+ };
+
+ firewall-284-0 {
+ /* dru_0_msmc Background Firewall */
+ id = <284>;
+ region = <0>;
+ control = <(FWCTRL_EN | FWCTRL_LOCK |
+ FWCTRL_BG | FWCTRL_CACHE)>;
+ permissions = <((FWPRIVID_ALL << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD |
+ FWPERM_NON_SECURE_PRIV_RWCD |
+ FWPERM_NON_SECURE_USER_RWCD)>;
+ start_address = <0x0 0x0>;
+ end_address = <0xff 0xffffffff>;
+ };
+
+ firewall-284-1 {
+ /* dru_0_msmc Foreground Firewall */
+ id = <284>;
+ region = <1>;
+ control = <(FWCTRL_EN | FWCTRL_LOCK |
+ FWCTRL_CACHE)>;
+ permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD)>;
+ start_address = <0x0 0x70000000>;
+ end_address = <0x0 0x7001ffff>;
+ };
+
+ /* firewall-5140-0 {
+ * nb_slv0__mem0 Background Firewall
+ * Already configured by the secure entity
+ * };
+ */
+
+ firewall-5140-1 {
+ /* nb_slv0__mem0 Foreground Firewall */
+ id = <5140>;
+ region = <1>;
+ control = <(FWCTRL_EN | FWCTRL_LOCK |
+ FWCTRL_CACHE)>;
+ permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD)>;
+ start_address = <0x0 0x70000000>;
+ end_address = <0x0 0x7001ffff>;
+ };
+
+ /* firewall-5140-0 {
+ * nb_slv1__mem0 Background Firewall
+ * Already configured by the secure entity
+ * };
+ */
+
+ firewall-5141-1 {
+ /* nb_slv1__mem0 Foreground Firewall */
+ id = <5141>;
+ region = <1>;
+ control = <(FWCTRL_EN | FWCTRL_LOCK |
+ FWCTRL_CACHE)>;
+ permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD)>;
+ start_address = <0x0 0x70000000>;
+ end_address = <0x0 0x7001ffff>;
+ };
+
+ };
+ };
+
+ tee {
+ ti-secure {
+ auth-in-place = <0xa02>;
+
+ firewall-257-2 {
+ /* cpu_0_cpu_0_msmc Foreground Firewall */
+ id = <257>;
+ region = <2>;
+ control = <(FWCTRL_EN | FWCTRL_LOCK |
+ FWCTRL_CACHE)>;
+ permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD)>;
+ start_address = <0x0 0x9e800000>;
+ end_address = <0x0 0x9fffffff>;
+ };
+
+ firewall-284-2 {
+ /* dru_0_msmc Foreground Firewall */
+ id = <284>;
+ region = <2>;
+ control = <(FWCTRL_EN | FWCTRL_LOCK |
+ FWCTRL_CACHE)>;
+ permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD)>;
+ start_address = <0x0 0x9e800000>;
+ end_address = <0x0 0x9fffffff>;
+ };
+
+ firewall-5142-0 {
+ /* nb_slv2__mem0 Background Firewall - 0 */
+ id = <5142>;
+ region = <0>;
+ control = <(FWCTRL_EN | FWCTRL_LOCK |
+ FWCTRL_BG | FWCTRL_CACHE)>;
+ permissions = <((FWPRIVID_ALL << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD |
+ FWPERM_NON_SECURE_PRIV_RWCD |
+ FWPERM_NON_SECURE_USER_RWCD)>;
+ start_address = <0x0 0x0>;
+ end_address = <0xff 0xffffffff>;
+ };
+
+ firewall-5142-1 {
+ /* nb_slv2__mem0 Foreground Firewall */
+ id = <5142>;
+ region = <1>;
+ control = <(FWCTRL_EN | FWCTRL_LOCK |
+ FWCTRL_CACHE)>;
+ permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD)>;
+ start_address = <0x0 0x9e800000>;
+ end_address = <0x0 0x9fffffff>;
+ };
+
+ firewall-5143-0 {
+ /* nb_slv3__mem0 Background Firewall - 0 */
+ id = <5143>;
+ region = <0>;
+ control = <(FWCTRL_EN | FWCTRL_LOCK |
+ FWCTRL_BG | FWCTRL_CACHE)>;
+ permissions = <((FWPRIVID_ALL << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD |
+ FWPERM_NON_SECURE_PRIV_RWCD |
+ FWPERM_NON_SECURE_USER_RWCD)>;
+ start_address = <0x0 0x0>;
+ end_address = <0xff 0xffffffff>;
+ };
+
+ firewall-5143-1 {
+ /* nb_slv3__mem0 Foreground Firewall */
+ id = <5143>;
+ region = <1>;
+ control = <(FWCTRL_EN | FWCTRL_LOCK |
+ FWCTRL_CACHE)>;
+ permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD)>;
+ start_address = <0x0 0x9e800000>;
+ end_address = <0x0 0x9fffffff>;
+ };
+
+ firewall-5144-0 {
+ /* nb_slv4__mem0 Background Firewall - 0 */
+ id = <5144>;
+ region = <0>;
+ control = <(FWCTRL_EN | FWCTRL_LOCK |
+ FWCTRL_BG | FWCTRL_CACHE)>;
+ permissions = <((FWPRIVID_ALL << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD |
+ FWPERM_NON_SECURE_PRIV_RWCD |
+ FWPERM_NON_SECURE_USER_RWCD)>;
+ start_address = <0x0 0x0>;
+ end_address = <0xff 0xffffffff>;
+ };
+
+ firewall-5144-1 {
+ /* nb_slv4__mem0 Foreground Firewall */
+ id = <5144>;
+ region = <1>;
+ control = <(FWCTRL_EN | FWCTRL_LOCK |
+ FWCTRL_CACHE)>;
+ permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) |
+ FWPERM_SECURE_PRIV_RWCD |
+ FWPERM_SECURE_USER_RWCD)>;
+ start_address = <0x0 0x9e800000>;
+ end_address = <0x0 0x9fffffff>;
+ };
+
+ };
+ };
dm {
ti-secure {
content = <&dm>;
--
2.41.0
More information about the U-Boot
mailing list