From patchwork Wed Oct 4 12:31:34 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Manorit Chawdhry X-Patchwork-Id: 1843290 X-Patchwork-Delegate: trini@ti.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=ti.com header.i=@ti.com header.a=rsa-sha256 header.s=ti-com-17Q1 header.b=vkRy0CEY; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org) Received: from phobos.denx.de (phobos.denx.de [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4S0vHS03LXz1ypx for ; Wed, 4 Oct 2023 23:33:23 +1100 (AEDT) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 64FE08755F; Wed, 4 Oct 2023 14:32:38 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=quarantine dis=none) header.from=ti.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; unprotected) header.d=ti.com header.i=@ti.com header.b="vkRy0CEY"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 5AF8887541; Wed, 4 Oct 2023 14:32:37 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_PASS, SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Received: from fllv0015.ext.ti.com (fllv0015.ext.ti.com [198.47.19.141]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 2B07F87558 for ; Wed, 4 Oct 2023 14:32:35 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=quarantine dis=none) header.from=ti.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=m-chawdhry@ti.com Received: from lelv0265.itg.ti.com ([10.180.67.224]) by fllv0015.ext.ti.com (8.15.2/8.15.2) with ESMTP id 394CWWr2032604; Wed, 4 Oct 2023 07:32:32 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ti.com; s=ti-com-17Q1; t=1696422752; bh=5f7lKFh9hwCX+GDkYMziKnOvIs1KoeAN7oE3BsJkphQ=; h=From:Date:Subject:References:In-Reply-To:To:CC; b=vkRy0CEY7jn9Ru3fB/bTLMTFlKGm/uTKfqZQ2UVdl/wGCcZv7ZT+TIpeAMjOnpyIG 7LI646G98llfVklUeWGK+SuCChvIz7lkqCiyYAtcCUgjgaq2TwBq26qTY3qYnPPpru +fo6iPiM9Js1hGpfO5zfbRIkTr9N5Y/uAXmC/rco= Received: from DFLE105.ent.ti.com (dfle105.ent.ti.com [10.64.6.26]) by lelv0265.itg.ti.com (8.15.2/8.15.2) with ESMTPS id 394CWWNv005042 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=FAIL); Wed, 4 Oct 2023 07:32:32 -0500 Received: from DFLE106.ent.ti.com (10.64.6.27) by DFLE105.ent.ti.com (10.64.6.26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.2507.23; Wed, 4 Oct 2023 07:32:32 -0500 Received: from lelv0326.itg.ti.com (10.180.67.84) by DFLE106.ent.ti.com (10.64.6.27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.2507.23 via Frontend Transport; Wed, 4 Oct 2023 07:32:32 -0500 Received: from [127.0.1.1] (ileaxei01-snat2.itg.ti.com [10.180.69.6]) by lelv0326.itg.ti.com (8.15.2/8.15.2) with ESMTP id 394CWBJq010622; Wed, 4 Oct 2023 07:32:29 -0500 From: Manorit Chawdhry Date: Wed, 4 Oct 2023 18:01:34 +0530 Subject: [PATCH v3 5/6] binman: j721s2: Add firewall configurations MIME-Version: 1.0 Message-ID: <20231004-binman-firewalling-v3-5-e4a102324e1f@ti.com> References: <20231004-binman-firewalling-v3-0-e4a102324e1f@ti.com> In-Reply-To: <20231004-binman-firewalling-v3-0-e4a102324e1f@ti.com> To: Simon Glass , Alper Nebi Yasak , Neha Malcom Francis , Andrew Davis , Vignesh Raghavendra CC: , Udit Kumar , Praneeth Bajjuri , Kamlesh Gurudasani , Nishanth Menon , Manorit Chawdhry X-Mailer: b4 0.13-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1696422731; l=7801; i=m-chawdhry@ti.com; s=20230324; h=from:subject:message-id; bh=pjozoaYgC6nfdyjecwcsgSBLpB+oY2PhSSqGl5TklM4=; b=nL0Xvc+7dtqggYuHD0da6w5PIZ6CzY4rJAKQiM+Zcq6tUBZ7w9yImdEryDTSYWCw5E9YYqxpk f9uMUZnDCPQDg6EVLeKMO9gecmydjwbhTsXpn/QAsiKTru3G+zTrw4U X-Developer-Key: i=m-chawdhry@ti.com; a=ed25519; pk=Z51yAzxWCcDqKRLHiDBrUxIdXbB21R89ms8xgECdiak= X-EXCLAIMER-MD-CONFIG: e1e8a2fd-e40a-4ac6-ac9b-f7e9cc9ee180 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean The following commits adds the configuration of firewalls required to protect ATF and OP-TEE memory region from non-secure reads and writes using master and slave firewalls present in our K3 SOCs. Signed-off-by: Manorit Chawdhry --- arch/arm/dts/k3-j721s2-binman.dtsi | 208 +++++++++++++++++++++++++++++++++++++ 1 file changed, 208 insertions(+) diff --git a/arch/arm/dts/k3-j721s2-binman.dtsi b/arch/arm/dts/k3-j721s2-binman.dtsi index 5bca4e94ecf9..19e858c5c44b 100644 --- a/arch/arm/dts/k3-j721s2-binman.dtsi +++ b/arch/arm/dts/k3-j721s2-binman.dtsi @@ -177,6 +177,102 @@ ti-secure { content = <&atf>; keyfile = "custMpk.pem"; + auth_in_place = <0xa02>; + + firewall-257-0 { + /* cpu_0_cpu_0_msmc Background Firewall */ + id = <257>; + region = <0>; + control = <(FWCTRL_EN | FWCTRL_LOCK | + FWCTRL_BG | FWCTRL_CACHE)>; + permissions = <((FWPRIVID_ALL << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD | + FWPERM_NON_SECURE_PRIV_RWCD | + FWPERM_NON_SECURE_USER_RWCD)>; + start_address = <0x0 0x0>; + end_address = <0xff 0xffffffff>; + }; + + firewall-257-1 { + /* cpu_0_cpu_0_msmc Foreground Firewall */ + id = <257>; + region = <1>; + control = <(FWCTRL_EN | FWCTRL_LOCK | + FWCTRL_CACHE)>; + permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD)>; + start_address = <0x0 0x70000000>; + end_address = <0x0 0x7001ffff>; + }; + + firewall-284-0 { + /* dru_0_msmc Background Firewall */ + id = <284>; + region = <0>; + control = <(FWCTRL_EN | FWCTRL_LOCK | + FWCTRL_BG | FWCTRL_CACHE)>; + permissions = <((FWPRIVID_ALL << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD | + FWPERM_NON_SECURE_PRIV_RWCD | + FWPERM_NON_SECURE_USER_RWCD)>; + start_address = <0x0 0x0>; + end_address = <0xff 0xffffffff>; + }; + + firewall-284-1 { + /* dru_0_msmc Foreground Firewall */ + id = <284>; + region = <1>; + control = <(FWCTRL_EN | FWCTRL_LOCK | + FWCTRL_CACHE)>; + permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD)>; + start_address = <0x0 0x70000000>; + end_address = <0x0 0x7001ffff>; + }; + + /* firewall-5140-0 { + * nb_slv0__mem0 Background Firewall + * Already configured by the secure entity + * }; + */ + + firewall-5140-1 { + /* nb_slv0__mem0 Foreground Firewall */ + id = <5140>; + region = <1>; + control = <(FWCTRL_EN | FWCTRL_LOCK | + FWCTRL_CACHE)>; + permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD)>; + start_address = <0x0 0x70000000>; + end_address = <0x0 0x7001ffff>; + }; + + /* firewall-5140-0 { + * nb_slv1__mem0 Background Firewall + * Already configured by the secure entity + * }; + */ + + firewall-5141-1 { + /* nb_slv1__mem0 Foreground Firewall */ + id = <5141>; + region = <1>; + control = <(FWCTRL_EN | FWCTRL_LOCK | + FWCTRL_CACHE)>; + permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD)>; + start_address = <0x0 0x70000000>; + end_address = <0x0 0x7001ffff>; + }; + }; atf: atf-bl31 { }; @@ -193,6 +289,118 @@ ti-secure { content = <&tee>; keyfile = "custMpk.pem"; + auth_in_place = <0xa02>; + + firewall-257-2 { + /* cpu_0_cpu_0_msmc Foreground Firewall */ + id = <257>; + region = <2>; + control = <(FWCTRL_EN | FWCTRL_LOCK | + FWCTRL_CACHE)>; + permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD)>; + start_address = <0x0 0x9e800000>; + end_address = <0x0 0x9fffffff>; + }; + + firewall-284-2 { + /* dru_0_msmc Foreground Firewall */ + id = <284>; + region = <2>; + control = <(FWCTRL_EN | FWCTRL_LOCK | + FWCTRL_CACHE)>; + permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD)>; + start_address = <0x0 0x9e800000>; + end_address = <0x0 0x9fffffff>; + }; + + firewall-5142-0 { + /* nb_slv2__mem0 Background Firewall - 0 */ + id = <5142>; + region = <0>; + control = <(FWCTRL_EN | FWCTRL_LOCK | + FWCTRL_BG | FWCTRL_CACHE)>; + permissions = <((FWPRIVID_ALL << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD | + FWPERM_NON_SECURE_PRIV_RWCD | + FWPERM_NON_SECURE_USER_RWCD)>; + start_address = <0x0 0x0>; + end_address = <0xff 0xffffffff>; + }; + + firewall-5142-1 { + /* nb_slv2__mem0 Foreground Firewall */ + id = <5142>; + region = <1>; + control = <(FWCTRL_EN | FWCTRL_LOCK | + FWCTRL_CACHE)>; + permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD)>; + start_address = <0x0 0x9e800000>; + end_address = <0x0 0x9fffffff>; + }; + + firewall-5143-0 { + /* nb_slv3__mem0 Background Firewall - 0 */ + id = <5143>; + region = <0>; + control = <(FWCTRL_EN | FWCTRL_LOCK | + FWCTRL_BG | FWCTRL_CACHE)>; + permissions = <((FWPRIVID_ALL << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD | + FWPERM_NON_SECURE_PRIV_RWCD | + FWPERM_NON_SECURE_USER_RWCD)>; + start_address = <0x0 0x0>; + end_address = <0xff 0xffffffff>; + }; + + firewall-5143-1 { + /* nb_slv3__mem0 Foreground Firewall */ + id = <5143>; + region = <1>; + control = <(FWCTRL_EN | FWCTRL_LOCK | + FWCTRL_CACHE)>; + permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD)>; + start_address = <0x0 0x9e800000>; + end_address = <0x0 0x9fffffff>; + }; + + firewall-5144-0 { + /* nb_slv4__mem0 Background Firewall - 0 */ + id = <5144>; + region = <0>; + control = <(FWCTRL_EN | FWCTRL_LOCK | + FWCTRL_BG | FWCTRL_CACHE)>; + permissions = <((FWPRIVID_ALL << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD | + FWPERM_NON_SECURE_PRIV_RWCD | + FWPERM_NON_SECURE_USER_RWCD)>; + start_address = <0x0 0x0>; + end_address = <0xff 0xffffffff>; + }; + + firewall-5144-1 { + /* nb_slv4__mem0 Foreground Firewall */ + id = <5144>; + region = <1>; + control = <(FWCTRL_EN | FWCTRL_LOCK | + FWCTRL_CACHE)>; + permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD)>; + start_address = <0x0 0x9e800000>; + end_address = <0x0 0x9fffffff>; + }; + }; tee: tee-os { };