From: Nikolay Bryskin <nbryskin@gmail.com>
To: Heiko Stuebner <heiko@sntech.de>, Stephen Boyd <sboyd@kernel.org>
Cc: Brian Masney <bmasney+clk@redhat.com>,
Jerome Brunet <jbrunet+clk@baylibre.com>,
linux-clk@vger.kernel.org, linux-rockchip@lists.infradead.org,
linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org,
Nikolay Bryskin <nbryskin@gmail.com>
Subject: [PATCH] clk: rockchip: rk3588: keep the OTP gates shared with the secure world on
Date: Tue, 27 Oct 2026 02:24:19 +0200 [thread overview]
Message-ID: <20261027002419.2099708-1-nbryskin@gmail.com> (raw)
The secure OTP controller (OTPC_S) shares three clock gates in
CRU_CLKGATE_CON18 with the non-secure one: clk_otpc_arb,
clk_otpc_auto_rd_g and clk_otp_phy_g. The kernel treats them as ordinary
gates: clk_otpc_auto_rd_g is disabled as unused at the end of boot, and
the rockchip-otp nvmem driver enables clk_otpc_arb and clk_otp_phy_g
around each read and disables them again afterwards.
Firmware in the secure world (OP-TEE reads its hardware unique key and
the secure boot state from OTPC_S, and programs them) has no way to take
a reference on these clocks. Once Linux has gated them, every secure OTP
access times out, and a normal-world nvmem read on another CPU can gate
them in the middle of a secure access, including a fuse programming
cycle.
Mark the three gates critical so the normal world never turns them off.
They are 24 MHz gates for the OTP block only.
Link: https://github.com/OP-TEE/optee_os/pull/8034
Signed-off-by: Nikolay Bryskin <nbryskin@gmail.com>
---
drivers/clk/rockchip/clk-rk3588.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/clk/rockchip/clk-rk3588.c b/drivers/clk/rockchip/clk-rk3588.c
index 24baa0ef9bf3..8e0f408fdfad 100644
--- a/drivers/clk/rockchip/clk-rk3588.c
+++ b/drivers/clk/rockchip/clk-rk3588.c
@@ -1158,11 +1158,11 @@ static struct rockchip_clk_branch rk3588_early_clk_branches[] __initdata = {
RK3588_CLKGATE_CON(18), 9, GFLAGS),
GATE(CLK_OTPC_NS, "clk_otpc_ns", "xin24m", 0,
RK3588_CLKGATE_CON(18), 10, GFLAGS),
- GATE(CLK_OTPC_ARB, "clk_otpc_arb", "xin24m", 0,
+ GATE(CLK_OTPC_ARB, "clk_otpc_arb", "xin24m", CLK_IS_CRITICAL,
RK3588_CLKGATE_CON(18), 11, GFLAGS),
- GATE(CLK_OTP_PHY_G, "clk_otp_phy_g", "xin24m", 0,
+ GATE(CLK_OTP_PHY_G, "clk_otp_phy_g", "xin24m", CLK_IS_CRITICAL,
RK3588_CLKGATE_CON(18), 13, GFLAGS),
- GATE(CLK_OTPC_AUTO_RD_G, "clk_otpc_auto_rd_g", "xin24m", 0,
+ GATE(CLK_OTPC_AUTO_RD_G, "clk_otpc_auto_rd_g", "xin24m", CLK_IS_CRITICAL,
RK3588_CLKGATE_CON(18), 12, GFLAGS),
GATE(PCLK_SARADC, "pclk_saradc", "pclk_top_root", 0,
--
2.56.0
WARNING: multiple messages have this Message-ID (diff)
From: Nikolay Bryskin <nbryskin@gmail.com>
To: Heiko Stuebner <heiko@sntech.de>, Stephen Boyd <sboyd@kernel.org>
Cc: Brian Masney <bmasney+clk@redhat.com>,
Jerome Brunet <jbrunet+clk@baylibre.com>,
linux-clk@vger.kernel.org, linux-rockchip@lists.infradead.org,
linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org,
Nikolay Bryskin <nbryskin@gmail.com>
Subject: [PATCH] clk: rockchip: rk3588: keep the OTP gates shared with the secure world on
Date: Tue, 27 Oct 2026 02:24:19 +0200 [thread overview]
Message-ID: <20261027002419.2099708-1-nbryskin@gmail.com> (raw)
The secure OTP controller (OTPC_S) shares three clock gates in
CRU_CLKGATE_CON18 with the non-secure one: clk_otpc_arb,
clk_otpc_auto_rd_g and clk_otp_phy_g. The kernel treats them as ordinary
gates: clk_otpc_auto_rd_g is disabled as unused at the end of boot, and
the rockchip-otp nvmem driver enables clk_otpc_arb and clk_otp_phy_g
around each read and disables them again afterwards.
Firmware in the secure world (OP-TEE reads its hardware unique key and
the secure boot state from OTPC_S, and programs them) has no way to take
a reference on these clocks. Once Linux has gated them, every secure OTP
access times out, and a normal-world nvmem read on another CPU can gate
them in the middle of a secure access, including a fuse programming
cycle.
Mark the three gates critical so the normal world never turns them off.
They are 24 MHz gates for the OTP block only.
Link: https://github.com/OP-TEE/optee_os/pull/8034
Signed-off-by: Nikolay Bryskin <nbryskin@gmail.com>
---
drivers/clk/rockchip/clk-rk3588.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/clk/rockchip/clk-rk3588.c b/drivers/clk/rockchip/clk-rk3588.c
index 24baa0ef9bf3..8e0f408fdfad 100644
--- a/drivers/clk/rockchip/clk-rk3588.c
+++ b/drivers/clk/rockchip/clk-rk3588.c
@@ -1158,11 +1158,11 @@ static struct rockchip_clk_branch rk3588_early_clk_branches[] __initdata = {
RK3588_CLKGATE_CON(18), 9, GFLAGS),
GATE(CLK_OTPC_NS, "clk_otpc_ns", "xin24m", 0,
RK3588_CLKGATE_CON(18), 10, GFLAGS),
- GATE(CLK_OTPC_ARB, "clk_otpc_arb", "xin24m", 0,
+ GATE(CLK_OTPC_ARB, "clk_otpc_arb", "xin24m", CLK_IS_CRITICAL,
RK3588_CLKGATE_CON(18), 11, GFLAGS),
- GATE(CLK_OTP_PHY_G, "clk_otp_phy_g", "xin24m", 0,
+ GATE(CLK_OTP_PHY_G, "clk_otp_phy_g", "xin24m", CLK_IS_CRITICAL,
RK3588_CLKGATE_CON(18), 13, GFLAGS),
- GATE(CLK_OTPC_AUTO_RD_G, "clk_otpc_auto_rd_g", "xin24m", 0,
+ GATE(CLK_OTPC_AUTO_RD_G, "clk_otpc_auto_rd_g", "xin24m", CLK_IS_CRITICAL,
RK3588_CLKGATE_CON(18), 12, GFLAGS),
GATE(PCLK_SARADC, "pclk_saradc", "pclk_top_root", 0,
--
2.56.0
_______________________________________________
Linux-rockchip mailing list
Linux-rockchip@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-rockchip
next reply other threads:[~2026-10-27 0:24 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-27 0:24 Nikolay Bryskin [this message]
2026-10-27 0:24 ` [PATCH] clk: rockchip: rk3588: keep the OTP gates shared with the secure world on Nikolay Bryskin
2026-10-27 3:53 ` Chen-Yu Tsai
2026-10-27 3:53 ` Chen-Yu Tsai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261027002419.2099708-1-nbryskin@gmail.com \
--to=nbryskin@gmail.com \
--cc=bmasney+clk@redhat.com \
--cc=heiko@sntech.de \
--cc=jbrunet+clk@baylibre.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-clk@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rockchip@lists.infradead.org \
--cc=sboyd@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.