The following commits adds the configuration of firewalls required to protect ATF and OP-TEE memory region from non-secure reads and writes using master and slave firewalls present in our K3 SOCs.
Signed-off-by: Manorit Chawdhry <m-chawd...@ti.com>
---
arch/arm/dts/k3-j721e-binman.dtsi | 116 ++++++++++++++++++++++++++++++++++++++
1 file changed, 116 insertions(+)
diff --git a/arch/arm/dts/k3-j721e-binman.dtsi
b/arch/arm/dts/k3-j721e-binman.dtsi
index dbc385a852de..1bd9f96a58e9 100644
--- a/arch/arm/dts/k3-j721e-binman.dtsi
+++ b/arch/arm/dts/k3-j721e-binman.dtsi
@@ -146,6 +146,122 @@
fit {
images {
+ atf {
+ ti-secure {
+ auth-in-place = <0xa02>;
+
+ firewall-257-0 {
+ /* cpu_0_cpu_0_msmc
Background Firewall */
+ insert-template =
<&firewall_bg_1>;
+ id = <257>;
+ region = <0>;
+ };
+
+ firewall-257-1 {
+ /* cpu_0_cpu_0_msmc
Foreground Firewall */
+ insert-template =
<&firewall_armv8_atf_fg>;
+ id = <257>;
+ region = <1>;
+ };
+
+ firewall-284-0 {
+ /* dru_0_msmc
Background Firewall */
+ insert-template =
<&firewall_bg_3>;
+ id = <284>;
+ region = <0>;
+ };
+
+ firewall-284-1 {
+ /* dru_0_msmc
Foreground Firewall */
+ insert-template =
<&firewall_armv8_atf_fg>;
+ id = <284>;
+ region = <1>;
+ };
+
+ /* firewall-4760-0 {
+ * nb_slv0__mem0
Background Firewall
+ * Already
configured by the secure entity
+ * };
+ */
+
+ firewall-4760-1 {
+ /* nb_slv0__mem0
Foreground Firewall */
+ insert-template =
<&firewall_armv8_atf_fg>;
+ id = <4760>;
+ region = <1>;
+ };
+
+ /* firewall-4761-0 {
+ * nb_slv1__mem0
Background Firewall
+ * Already
configured by the secure entity
+ * };
+ */
+
+ firewall-4761-1 {
+ /* nb_slv1__mem0
Foreground Firewall */
+ insert-template =
<&firewall_armv8_atf_fg>;
+ id = <4761>;
+ region = <1>;
+ };
+
+ };
+ };
+
+ tee {
+ ti-secure {
+ auth-in-place = <0xa02>;
+
+ /* cpu_0_cpu_0_msmc region 0
and 1 configured
+ * during ATF Firewalling
+ */
+
+ firewall-257-2 {
+ /* cpu_0_cpu_0_msmc
Foreground Firewall */
+ insert-template =
<&firewall_armv8_optee_fg>;
+ id = <257>;
+ region = <2>;
+ };
+
+ /* dru_0_msmc region 0 and 1
configured
+ * during ATF Firewalling
+ */
+
+ firewall-284-2 {
+ /* dru_0_msmc
Foreground Firewall */
+ insert-template =
<&firewall_armv8_optee_fg>;
+ id = <284>;
+ region = <2>;
+ };
+
+ firewall-4762-0 {
+ /* nb_slv2__mem0
Background Firewall */
+ insert-template =
<&firewall_bg_3>;
+ id = <4762>;
+ region = <0>;
+ };
+
+ firewall-4762-1 {
+ /* nb_slv2__mem0
Foreground Firewall */
+ insert-template =
<&firewall_armv8_optee_fg>;
+ id = <4762>;
+ region = <1>;
+ };
+
+ firewall-4763-0 {
+ /* nb_slv3__mem0
Background Firewall */
+ insert-template =
<&firewall_bg_3>;
+ id = <4763>;
+ region = <0>;
+ };
+
+ firewall-4763-1 {
+ /* nb_slv3__mem0
Foreground Firewall */
+ insert-template =
<&firewall_armv8_optee_fg>;
+ id = <4763>;
+ region = <1>;
+ };
+ };
+ };
dm {
ti-secure {
content = <&dm>;
--
2.43.0
