* [U-Boot] [PATCH v2 1/6] arm: mach-omap2: Move omap5/sec-fxns.c into sec-common.c
2017-07-10 19:45 [U-Boot] [PATCH v2 0/6] AM43xx OP-TEE support Andrew F. Davis
@ 2017-07-10 19:45 ` Andrew F. Davis
2017-07-25 0:42 ` [U-Boot] [U-Boot, v2, " Tom Rini
2017-07-10 19:45 ` [U-Boot] [PATCH v2 2/6] arm: mach-omap2: Factor out common FDT fixup suport Andrew F. Davis
` (5 subsequent siblings)
6 siblings, 1 reply; 14+ messages in thread
From: Andrew F. Davis @ 2017-07-10 19:45 UTC (permalink / raw)
To: u-boot
TEE loading and firewall setup are common to all omap2 devices, move
these function out of omap5 and into mach-omap2. This allows us
to use these functions from other omap class devices.
Signed-off-by: Andrew F. Davis <afd@ti.com>
---
arch/arm/mach-omap2/Kconfig | 26 ++++
arch/arm/mach-omap2/omap5/Kconfig | 26 ----
arch/arm/mach-omap2/omap5/Makefile | 1 -
arch/arm/mach-omap2/omap5/sec-fxns.c | 234 -----------------------------------
arch/arm/mach-omap2/sec-common.c | 226 ++++++++++++++++++++++++++++++++-
5 files changed, 251 insertions(+), 262 deletions(-)
delete mode 100644 arch/arm/mach-omap2/omap5/sec-fxns.c
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index 683cdb9296..013586edd9 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -119,6 +119,32 @@ config TI_SECURE_DEVICE
authenticated) and the code. See the doc/README.ti-secure
file for further details.
+config TI_SECURE_EMIF_REGION_START
+ hex "Reserved EMIF region start address"
+ depends on TI_SECURE_DEVICE
+ default 0x0
+ help
+ Reserved EMIF region start address. Set to "0" to auto-select
+ to be at the end of the external memory region.
+
+config TI_SECURE_EMIF_TOTAL_REGION_SIZE
+ hex "Reserved EMIF region size"
+ depends on TI_SECURE_DEVICE
+ default 0x0
+ help
+ Total reserved EMIF region size. Default is 0, which means no reserved EMIF
+ region on secure devices.
+
+config TI_SECURE_EMIF_PROTECTED_REGION_SIZE
+ hex "Size of protected region within reserved EMIF region"
+ depends on TI_SECURE_DEVICE
+ default 0x0
+ help
+ This config option is used to specify the size of the portion of the total
+ reserved EMIF region set aside for secure OS needs that will be protected
+ using hardware memory firewalls. This value must be smaller than the
+ TI_SECURE_EMIF_TOTAL_REGION_SIZE value.
+
source "arch/arm/mach-omap2/omap3/Kconfig"
source "arch/arm/mach-omap2/omap4/Kconfig"
diff --git a/arch/arm/mach-omap2/omap5/Kconfig b/arch/arm/mach-omap2/omap5/Kconfig
index 1a66abdeb2..7e8e532d4c 100644
--- a/arch/arm/mach-omap2/omap5/Kconfig
+++ b/arch/arm/mach-omap2/omap5/Kconfig
@@ -37,32 +37,6 @@ endchoice
config SYS_SOC
default "omap5"
-config TI_SECURE_EMIF_REGION_START
- hex "Reserved EMIF region start address"
- depends on TI_SECURE_DEVICE
- default 0x0
- help
- Reserved EMIF region start address. Set to "0" to auto-select
- to be at the end of the external memory region.
-
-config TI_SECURE_EMIF_TOTAL_REGION_SIZE
- hex "Reserved EMIF region size"
- depends on TI_SECURE_DEVICE
- default 0x0
- help
- Total reserved EMIF region size. Default is 0, which means no reserved EMIF
- region on secure devices.
-
-config TI_SECURE_EMIF_PROTECTED_REGION_SIZE
- hex "Size of protected region within reserved EMIF region"
- depends on TI_SECURE_DEVICE
- default 0x0
- help
- This config option is used to specify the size of the portion of the total
- reserved EMIF region set aside for secure OS needs that will be protected
- using hardware memory firewalls. This value must be smaller than the
- TI_SECURE_EMIF_TOTAL_REGION_SIZE value.
-
config OMAP_PLATFORM_RESET_TIME_MAX_USEC
int "Something"
range 0 31219
diff --git a/arch/arm/mach-omap2/omap5/Makefile b/arch/arm/mach-omap2/omap5/Makefile
index af17a3deab..a6a5d17ff6 100644
--- a/arch/arm/mach-omap2/omap5/Makefile
+++ b/arch/arm/mach-omap2/omap5/Makefile
@@ -14,5 +14,4 @@ obj-y += hw_data.o
obj-y += abb.o
obj-y += fdt.o
obj-$(CONFIG_IODELAY_RECALIBRATION) += dra7xx_iodelay.o
-obj-$(CONFIG_TI_SECURE_DEVICE) += sec-fxns.o
obj-$(CONFIG_DRA7XX) += sec_entry_cpu1.o
diff --git a/arch/arm/mach-omap2/omap5/sec-fxns.c b/arch/arm/mach-omap2/omap5/sec-fxns.c
deleted file mode 100644
index 7fab57592e..0000000000
--- a/arch/arm/mach-omap2/omap5/sec-fxns.c
+++ /dev/null
@@ -1,234 +0,0 @@
-/*
- *
- * Security related functions for OMAP5 class devices
- *
- * (C) Copyright 2016
- * Texas Instruments, <www.ti.com>
- *
- * Daniel Allred <d-allred@ti.com>
- * Harinarayan Bhatta <harinarayan@ti.com>
- *
- * SPDX-License-Identifier: GPL-2.0+
- */
-
-#include <common.h>
-#include <stdarg.h>
-
-#include <asm/arch/sys_proto.h>
-#include <asm/omap_common.h>
-#include <asm/omap_sec_common.h>
-#include <asm/spl.h>
-#include <spl.h>
-#include <asm/cache.h>
-#include <mapmem.h>
-#include <tee/optee.h>
-
-/* Index for signature PPA-based TI HAL APIs */
-#define PPA_HAL_SERVICES_START_INDEX (0x200)
-#define PPA_SERV_HAL_TEE_LOAD_MASTER (PPA_HAL_SERVICES_START_INDEX + 23)
-#define PPA_SERV_HAL_TEE_LOAD_SLAVE (PPA_HAL_SERVICES_START_INDEX + 24)
-#define PPA_SERV_HAL_SETUP_SEC_RESVD_REGION (PPA_HAL_SERVICES_START_INDEX + 25)
-#define PPA_SERV_HAL_SETUP_EMIF_FW_REGION (PPA_HAL_SERVICES_START_INDEX + 26)
-#define PPA_SERV_HAL_LOCK_EMIF_FW (PPA_HAL_SERVICES_START_INDEX + 27)
-
-int tee_loaded = 0;
-
-/* Argument for PPA_SERV_HAL_TEE_LOAD_MASTER */
-struct ppa_tee_load_info {
- u32 tee_sec_mem_start; /* Physical start address reserved for TEE */
- u32 tee_sec_mem_size; /* Size of the memory reserved for TEE */
- u32 tee_cert_start; /* Address where signed TEE binary is loaded */
- u32 tee_cert_size; /* Size of TEE certificate (signed binary) */
- u32 tee_jump_addr; /* Address to jump to start TEE execution */
- u32 tee_arg0; /* argument to TEE jump function, in r0 */
-};
-
-static u32 get_sec_mem_start(void)
-{
- u32 sec_mem_start = CONFIG_TI_SECURE_EMIF_REGION_START;
- u32 sec_mem_size = CONFIG_TI_SECURE_EMIF_TOTAL_REGION_SIZE;
- /*
- * Total reserved region is all contiguous with protected
- * region coming first, followed by the non-secure region.
- * If 0x0 start address is given, we simply put the reserved
- * region at the end of the external DRAM.
- */
- if (sec_mem_start == 0)
- sec_mem_start =
- (CONFIG_SYS_SDRAM_BASE +
- (omap_sdram_size() - sec_mem_size));
- return sec_mem_start;
-}
-
-int secure_emif_firewall_setup(uint8_t region_num, uint32_t start_addr,
- uint32_t size, uint32_t access_perm,
- uint32_t initiator_perm)
-{
- int result = 1;
-
- /*
- * Call PPA HAL API to do any other general firewall
- * configuration for regions 1-6 of the EMIF firewall.
- */
- debug("%s: regionNum = %x, startAddr = %x, size = %x", __func__,
- region_num, start_addr, size);
-
- result = secure_rom_call(
- PPA_SERV_HAL_SETUP_EMIF_FW_REGION, 0, 0, 4,
- (start_addr & 0xFFFFFFF0) | (region_num & 0x0F),
- size, access_perm, initiator_perm);
-
- if (result != 0) {
- puts("Secure EMIF Firewall Setup failed!\n");
- debug("Return Value = %x\n", result);
- }
-
- return result;
-}
-
-#if (CONFIG_TI_SECURE_EMIF_TOTAL_REGION_SIZE < \
- CONFIG_TI_SECURE_EMIF_PROTECTED_REGION_SIZE)
-#error "TI Secure EMIF: Protected size cannot be larger than total size."
-#endif
-int secure_emif_reserve(void)
-{
- int result = 1;
- u32 sec_mem_start = get_sec_mem_start();
- u32 sec_prot_size = CONFIG_TI_SECURE_EMIF_PROTECTED_REGION_SIZE;
-
- /* If there is no protected region, there is no reservation to make */
- if (sec_prot_size == 0)
- return 0;
-
- /*
- * Call PPA HAL API to reserve a chunk of EMIF SDRAM
- * for secure world use. This region should be carved out
- * from use by any public code. EMIF firewall region 7
- * will be used to protect this block of memory.
- */
- result = secure_rom_call(
- PPA_SERV_HAL_SETUP_SEC_RESVD_REGION,
- 0, 0, 2, sec_mem_start, sec_prot_size);
-
- if (result != 0) {
- puts("SDRAM Firewall: Secure memory reservation failed!\n");
- debug("Return Value = %x\n", result);
- }
-
- return result;
-}
-
-int secure_emif_firewall_lock(void)
-{
- int result = 1;
-
- /*
- * Call PPA HAL API to lock the EMIF firewall configurations.
- * After this API is called, none of the PPA HAL APIs for
- * configuring the EMIF firewalls will be usable again (that
- * is, calls to those APIs will return failure and have no
- * effect).
- */
-
- result = secure_rom_call(
- PPA_SERV_HAL_LOCK_EMIF_FW,
- 0, 0, 0);
-
- if (result != 0) {
- puts("Secure EMIF Firewall Lock failed!\n");
- debug("Return Value = %x\n", result);
- }
-
- return result;
-}
-
-static struct ppa_tee_load_info tee_info __aligned(ARCH_DMA_MINALIGN);
-
-int secure_tee_install(u32 addr)
-{
- struct optee_header *hdr;
- void *loadptr;
- u32 tee_file_size;
- u32 sec_mem_start = get_sec_mem_start();
- const u32 size = CONFIG_TI_SECURE_EMIF_PROTECTED_REGION_SIZE;
- u32 *smc_cpu1_params;
- u32 ret;
-
- /* If there is no protected region, there is no place to put the TEE */
- if (size == 0) {
- printf("Error loading TEE, no protected memory region available\n");
- return -ENOBUFS;
- }
-
- hdr = (struct optee_header *)map_sysmem(addr, sizeof(struct optee_header));
- /* 280 bytes = size of signature */
- tee_file_size = hdr->init_size + hdr->paged_size +
- sizeof(struct optee_header) + 280;
-
- if ((hdr->magic != OPTEE_MAGIC) ||
- (hdr->version != OPTEE_VERSION) ||
- (hdr->init_load_addr_hi != 0) ||
- (hdr->init_load_addr_lo < (sec_mem_start + sizeof(struct optee_header))) ||
- (tee_file_size > size) ||
- ((hdr->init_load_addr_lo + tee_file_size - 1) >
- (sec_mem_start + size - 1))) {
- printf("Error in TEE header. Check load address and sizes\n");
- unmap_sysmem(hdr);
- return CMD_RET_FAILURE;
- }
-
- tee_info.tee_sec_mem_start = sec_mem_start;
- tee_info.tee_sec_mem_size = size;
- tee_info.tee_jump_addr = hdr->init_load_addr_lo;
- tee_info.tee_cert_start = addr;
- tee_info.tee_cert_size = tee_file_size;
- tee_info.tee_arg0 = hdr->init_size + tee_info.tee_jump_addr;
- unmap_sysmem(hdr);
- loadptr = map_sysmem(addr, tee_file_size);
-
- debug("tee_info.tee_sec_mem_start= %08X\n", tee_info.tee_sec_mem_start);
- debug("tee_info.tee_sec_mem_size = %08X\n", tee_info.tee_sec_mem_size);
- debug("tee_info.tee_jump_addr = %08X\n", tee_info.tee_jump_addr);
- debug("tee_info.tee_cert_start = %08X\n", tee_info.tee_cert_start);
- debug("tee_info.tee_cert_size = %08X\n", tee_info.tee_cert_size);
- debug("tee_info.tee_arg0 = %08X\n", tee_info.tee_arg0);
- debug("tee_file_size = %d\n", tee_file_size);
-
-#if !defined(CONFIG_SYS_DCACHE_OFF)
- flush_dcache_range(
- rounddown((u32)loadptr, ARCH_DMA_MINALIGN),
- roundup((u32)loadptr + tee_file_size, ARCH_DMA_MINALIGN));
-
- flush_dcache_range((u32)&tee_info, (u32)&tee_info +
- roundup(sizeof(tee_info), ARCH_DMA_MINALIGN));
-#endif
- unmap_sysmem(loadptr);
-
- ret = secure_rom_call(PPA_SERV_HAL_TEE_LOAD_MASTER, 0, 0, 1, &tee_info);
- if (ret) {
- printf("TEE_LOAD_MASTER Failed\n");
- return ret;
- }
- printf("TEE_LOAD_MASTER Done\n");
-
- if (!is_dra72x()) {
- /* Reuse the tee_info buffer for SMC params */
- smc_cpu1_params = (u32 *)&tee_info;
- smc_cpu1_params[0] = 0;
-#if !defined(CONFIG_SYS_DCACHE_OFF)
- flush_dcache_range((u32)smc_cpu1_params, (u32)smc_cpu1_params +
- roundup(sizeof(u32), ARCH_DMA_MINALIGN));
-#endif
- ret = omap_smc_sec_cpu1(PPA_SERV_HAL_TEE_LOAD_SLAVE, 0, 0,
- smc_cpu1_params);
- if (ret) {
- printf("TEE_LOAD_SLAVE Failed\n");
- return ret;
- }
- printf("TEE_LOAD_SLAVE Done\n");
- }
-
- tee_loaded = 1;
-
- return 0;
-}
diff --git a/arch/arm/mach-omap2/sec-common.c b/arch/arm/mach-omap2/sec-common.c
index ec1ffa556a..f230c9ea4e 100644
--- a/arch/arm/mach-omap2/sec-common.c
+++ b/arch/arm/mach-omap2/sec-common.c
@@ -2,11 +2,13 @@
*
* Common security related functions for OMAP devices
*
- * (C) Copyright 2016
+ * (C) Copyright 2016-2017
* Texas Instruments, <www.ti.com>
*
* Daniel Allred <d-allred@ti.com>
* Andreas Dannenberg <dannenberg@ti.com>
+ * Harinarayan Bhatta <harinarayan@ti.com>
+ * Andrew F. Davis <afd@ti.com>
*
* SPDX-License-Identifier: GPL-2.0+
*/
@@ -15,10 +17,14 @@
#include <stdarg.h>
#include <asm/arch/sys_proto.h>
+#include <asm/cache.h>
#include <asm/omap_common.h>
#include <asm/omap_sec_common.h>
#include <asm/spl.h>
+#include <asm/ti-common/sys_proto.h>
+#include <mapmem.h>
#include <spl.h>
+#include <tee/optee.h>
/* Index for signature verify ROM API */
#ifdef CONFIG_AM33XX
@@ -27,6 +33,26 @@
#define API_HAL_KM_VERIFYCERTIFICATESIGNATURE_INDEX (0x0000000E)
#endif
+/* Index for signature PPA-based TI HAL APIs */
+#define PPA_HAL_SERVICES_START_INDEX (0x200)
+#define PPA_SERV_HAL_TEE_LOAD_MASTER (PPA_HAL_SERVICES_START_INDEX + 23)
+#define PPA_SERV_HAL_TEE_LOAD_SLAVE (PPA_HAL_SERVICES_START_INDEX + 24)
+#define PPA_SERV_HAL_SETUP_SEC_RESVD_REGION (PPA_HAL_SERVICES_START_INDEX + 25)
+#define PPA_SERV_HAL_SETUP_EMIF_FW_REGION (PPA_HAL_SERVICES_START_INDEX + 26)
+#define PPA_SERV_HAL_LOCK_EMIF_FW (PPA_HAL_SERVICES_START_INDEX + 27)
+
+int tee_loaded = 0;
+
+/* Argument for PPA_SERV_HAL_TEE_LOAD_MASTER */
+struct ppa_tee_load_info {
+ u32 tee_sec_mem_start; /* Physical start address reserved for TEE */
+ u32 tee_sec_mem_size; /* Size of the memory reserved for TEE */
+ u32 tee_cert_start; /* Address where signed TEE binary is loaded */
+ u32 tee_cert_size; /* Size of TEE certificate (signed binary) */
+ u32 tee_jump_addr; /* Address to jump to start TEE execution */
+ u32 tee_arg0; /* argument to TEE jump function, in r0 */
+};
+
static uint32_t secure_rom_call_args[5] __aligned(ARCH_DMA_MINALIGN);
u32 secure_rom_call(u32 service, u32 proc_id, u32 flag, ...)
@@ -149,3 +175,201 @@ auth_exit:
return result;
}
+
+static u32 get_sec_mem_start(void)
+{
+ u32 sec_mem_start = CONFIG_TI_SECURE_EMIF_REGION_START;
+ u32 sec_mem_size = CONFIG_TI_SECURE_EMIF_TOTAL_REGION_SIZE;
+ /*
+ * Total reserved region is all contiguous with protected
+ * region coming first, followed by the non-secure region.
+ * If 0x0 start address is given, we simply put the reserved
+ * region at the end of the external DRAM.
+ */
+ if (sec_mem_start == 0)
+ sec_mem_start =
+ (CONFIG_SYS_SDRAM_BASE + (
+#if defined(CONFIG_OMAP54XX)
+ omap_sdram_size()
+#else
+ get_ram_size((void *)CONFIG_SYS_SDRAM_BASE,
+ CONFIG_MAX_RAM_BANK_SIZE)
+#endif
+ - sec_mem_size));
+ return sec_mem_start;
+}
+
+int secure_emif_firewall_setup(uint8_t region_num, uint32_t start_addr,
+ uint32_t size, uint32_t access_perm,
+ uint32_t initiator_perm)
+{
+ int result = 1;
+
+ /*
+ * Call PPA HAL API to do any other general firewall
+ * configuration for regions 1-6 of the EMIF firewall.
+ */
+ debug("%s: regionNum = %x, startAddr = %x, size = %x", __func__,
+ region_num, start_addr, size);
+
+ result = secure_rom_call(
+ PPA_SERV_HAL_SETUP_EMIF_FW_REGION, 0, 0, 4,
+ (start_addr & 0xFFFFFFF0) | (region_num & 0x0F),
+ size, access_perm, initiator_perm);
+
+ if (result != 0) {
+ puts("Secure EMIF Firewall Setup failed!\n");
+ debug("Return Value = %x\n", result);
+ }
+
+ return result;
+}
+
+#if (CONFIG_TI_SECURE_EMIF_TOTAL_REGION_SIZE < \
+ CONFIG_TI_SECURE_EMIF_PROTECTED_REGION_SIZE)
+#error "TI Secure EMIF: Protected size cannot be larger than total size."
+#endif
+int secure_emif_reserve(void)
+{
+ int result = 1;
+ u32 sec_mem_start = get_sec_mem_start();
+ u32 sec_prot_size = CONFIG_TI_SECURE_EMIF_PROTECTED_REGION_SIZE;
+
+ /* If there is no protected region, there is no reservation to make */
+ if (sec_prot_size == 0)
+ return 0;
+
+ /*
+ * Call PPA HAL API to reserve a chunk of EMIF SDRAM
+ * for secure world use. This region should be carved out
+ * from use by any public code. EMIF firewall region 7
+ * will be used to protect this block of memory.
+ */
+ result = secure_rom_call(
+ PPA_SERV_HAL_SETUP_SEC_RESVD_REGION,
+ 0, 0, 2, sec_mem_start, sec_prot_size);
+
+ if (result != 0) {
+ puts("SDRAM Firewall: Secure memory reservation failed!\n");
+ debug("Return Value = %x\n", result);
+ }
+
+ return result;
+}
+
+int secure_emif_firewall_lock(void)
+{
+ int result = 1;
+
+ /*
+ * Call PPA HAL API to lock the EMIF firewall configurations.
+ * After this API is called, none of the PPA HAL APIs for
+ * configuring the EMIF firewalls will be usable again (that
+ * is, calls to those APIs will return failure and have no
+ * effect).
+ */
+
+ result = secure_rom_call(
+ PPA_SERV_HAL_LOCK_EMIF_FW,
+ 0, 0, 0);
+
+ if (result != 0) {
+ puts("Secure EMIF Firewall Lock failed!\n");
+ debug("Return Value = %x\n", result);
+ }
+
+ return result;
+}
+
+static struct ppa_tee_load_info tee_info __aligned(ARCH_DMA_MINALIGN);
+
+int secure_tee_install(u32 addr)
+{
+ struct optee_header *hdr;
+ void *loadptr;
+ u32 tee_file_size;
+ u32 sec_mem_start = get_sec_mem_start();
+ const u32 size = CONFIG_TI_SECURE_EMIF_PROTECTED_REGION_SIZE;
+ u32 ret;
+
+ /* If there is no protected region, there is no place to put the TEE */
+ if (size == 0) {
+ printf("Error loading TEE, no protected memory region available\n");
+ return -ENOBUFS;
+ }
+
+ hdr = (struct optee_header *)map_sysmem(addr, sizeof(struct optee_header));
+ /* 280 bytes = size of signature */
+ tee_file_size = hdr->init_size + hdr->paged_size +
+ sizeof(struct optee_header) + 280;
+
+ if ((hdr->magic != OPTEE_MAGIC) ||
+ (hdr->version != OPTEE_VERSION) ||
+ (hdr->init_load_addr_hi != 0) ||
+ (hdr->init_load_addr_lo < (sec_mem_start + sizeof(struct optee_header))) ||
+ (tee_file_size > size) ||
+ ((hdr->init_load_addr_lo + tee_file_size - 1) >
+ (sec_mem_start + size - 1))) {
+ printf("Error in TEE header. Check load address and sizes\n");
+ unmap_sysmem(hdr);
+ return CMD_RET_FAILURE;
+ }
+
+ tee_info.tee_sec_mem_start = sec_mem_start;
+ tee_info.tee_sec_mem_size = size;
+ tee_info.tee_jump_addr = hdr->init_load_addr_lo;
+ tee_info.tee_cert_start = addr;
+ tee_info.tee_cert_size = tee_file_size;
+ tee_info.tee_arg0 = hdr->init_size + tee_info.tee_jump_addr;
+ unmap_sysmem(hdr);
+ loadptr = map_sysmem(addr, tee_file_size);
+
+ debug("tee_info.tee_sec_mem_start= %08X\n", tee_info.tee_sec_mem_start);
+ debug("tee_info.tee_sec_mem_size = %08X\n", tee_info.tee_sec_mem_size);
+ debug("tee_info.tee_jump_addr = %08X\n", tee_info.tee_jump_addr);
+ debug("tee_info.tee_cert_start = %08X\n", tee_info.tee_cert_start);
+ debug("tee_info.tee_cert_size = %08X\n", tee_info.tee_cert_size);
+ debug("tee_info.tee_arg0 = %08X\n", tee_info.tee_arg0);
+ debug("tee_file_size = %d\n", tee_file_size);
+
+#if !defined(CONFIG_SYS_DCACHE_OFF)
+ flush_dcache_range(
+ rounddown((u32)loadptr, ARCH_DMA_MINALIGN),
+ roundup((u32)loadptr + tee_file_size, ARCH_DMA_MINALIGN));
+
+ flush_dcache_range((u32)&tee_info, (u32)&tee_info +
+ roundup(sizeof(tee_info), ARCH_DMA_MINALIGN));
+#endif
+ unmap_sysmem(loadptr);
+
+ ret = secure_rom_call(PPA_SERV_HAL_TEE_LOAD_MASTER, 0, 0, 1, &tee_info);
+ if (ret) {
+ printf("TEE_LOAD_MASTER Failed\n");
+ return ret;
+ }
+ printf("TEE_LOAD_MASTER Done\n");
+
+#if defined(CONFIG_OMAP54XX)
+ if (!is_dra72x()) {
+ u32 *smc_cpu1_params;
+ /* Reuse the tee_info buffer for SMC params */
+ smc_cpu1_params = (u32 *)&tee_info;
+ smc_cpu1_params[0] = 0;
+#if !defined(CONFIG_SYS_DCACHE_OFF)
+ flush_dcache_range((u32)smc_cpu1_params, (u32)smc_cpu1_params +
+ roundup(sizeof(u32), ARCH_DMA_MINALIGN));
+#endif
+ ret = omap_smc_sec_cpu1(PPA_SERV_HAL_TEE_LOAD_SLAVE, 0, 0,
+ smc_cpu1_params);
+ if (ret) {
+ printf("TEE_LOAD_SLAVE Failed\n");
+ return ret;
+ }
+ printf("TEE_LOAD_SLAVE Done\n");
+ }
+#endif
+
+ tee_loaded = 1;
+
+ return 0;
+}
--
2.13.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [U-Boot] [PATCH v2 2/6] arm: mach-omap2: Factor out common FDT fixup suport
2017-07-10 19:45 [U-Boot] [PATCH v2 0/6] AM43xx OP-TEE support Andrew F. Davis
2017-07-10 19:45 ` [U-Boot] [PATCH v2 1/6] arm: mach-omap2: Move omap5/sec-fxns.c into sec-common.c Andrew F. Davis
@ 2017-07-10 19:45 ` Andrew F. Davis
2017-07-25 0:42 ` [U-Boot] [U-Boot, v2, " Tom Rini
2017-07-10 19:45 ` [U-Boot] [PATCH v2 3/6] arm: mach-omap2: fdt-common: Add OP-TEE node when firmware node is defined Andrew F. Davis
` (4 subsequent siblings)
6 siblings, 1 reply; 14+ messages in thread
From: Andrew F. Davis @ 2017-07-10 19:45 UTC (permalink / raw)
To: u-boot
Some of the fixups currently done for OMAP5 class boards are common to
other OMAP family devices, move these to fdt-common.c.
Signed-off-by: Andrew F. Davis <afd@ti.com>
---
arch/arm/include/asm/omap_common.h | 5 ++
arch/arm/include/asm/omap_sec_common.h | 6 ++
arch/arm/mach-omap2/Makefile | 2 +
arch/arm/mach-omap2/fdt-common.c | 160 +++++++++++++++++++++++++++++++++
arch/arm/mach-omap2/omap5/fdt.c | 119 ------------------------
arch/arm/mach-omap2/sec-common.c | 2 +-
6 files changed, 174 insertions(+), 120 deletions(-)
create mode 100644 arch/arm/mach-omap2/fdt-common.c
diff --git a/arch/arm/include/asm/omap_common.h b/arch/arm/include/asm/omap_common.h
index d2ca277772..ef5c481349 100644
--- a/arch/arm/include/asm/omap_common.h
+++ b/arch/arm/include/asm/omap_common.h
@@ -680,6 +680,11 @@ void omap_die_id(unsigned int *die_id);
/* Initialize general purpose I2C(0) on the SoC */
void gpi2c_init(void);
+/* Common FDT Fixups */
+int ft_hs_disable_rng(void *fdt, bd_t *bd);
+int ft_hs_fixup_dram(void *fdt, bd_t *bd);
+int ft_hs_add_tee(void *fdt, bd_t *bd);
+
/* ABB */
#define OMAP_ABB_NOMINAL_OPP 0
#define OMAP_ABB_FAST_OPP 1
diff --git a/arch/arm/include/asm/omap_sec_common.h b/arch/arm/include/asm/omap_sec_common.h
index 79f1fbd2c1..76d0862270 100644
--- a/arch/arm/include/asm/omap_sec_common.h
+++ b/arch/arm/include/asm/omap_sec_common.h
@@ -28,6 +28,12 @@ u32 secure_rom_call(u32 service, u32 proc_id, u32 flag, ...);
int secure_boot_verify_image(void **p_image, size_t *p_size);
/*
+ * Return the start of secure reserved RAM, if a default start address has
+ * not been configured then return a region at the end of the external DRAM.
+ */
+u32 get_sec_mem_start(void);
+
+/*
* Invoke a secure HAL API that allows configuration of the external memory
* firewall regions.
*/
diff --git a/arch/arm/mach-omap2/Makefile b/arch/arm/mach-omap2/Makefile
index d43085ca98..d86643db34 100644
--- a/arch/arm/mach-omap2/Makefile
+++ b/arch/arm/mach-omap2/Makefile
@@ -45,4 +45,6 @@ obj-y += lowlevel_init.o
obj-y += mem-common.o
+obj-y += fdt-common.o
+
obj-$(CONFIG_TI_SECURE_DEVICE) += sec-common.o
diff --git a/arch/arm/mach-omap2/fdt-common.c b/arch/arm/mach-omap2/fdt-common.c
new file mode 100644
index 0000000000..297d4d4df5
--- /dev/null
+++ b/arch/arm/mach-omap2/fdt-common.c
@@ -0,0 +1,160 @@
+/*
+ * Copyright 2016-2017 Texas Instruments, Inc.
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ */
+
+#include <common.h>
+#include <libfdt.h>
+#include <fdt_support.h>
+
+#include <asm/omap_common.h>
+#include <asm/omap_sec_common.h>
+
+#ifdef CONFIG_TI_SECURE_DEVICE
+
+/* Give zero values if not already defined */
+#ifndef TI_OMAP5_SECURE_BOOT_RESV_SRAM_SZ
+#define TI_OMAP5_SECURE_BOOT_RESV_SRAM_SZ (0)
+#endif
+#ifndef CONFIG_SECURE_RUNTIME_RESV_SRAM_SZ
+#define CONFIG_SECURE_RUNTIME_RESV_SRAM_SZ (0)
+#endif
+
+int ft_hs_disable_rng(void *fdt, bd_t *bd)
+{
+ const char *path;
+ int offs;
+ int ret;
+
+ /* Make HW RNG reserved for secure world use */
+ path = "/ocp/rng";
+ offs = fdt_path_offset(fdt, path);
+ if (offs < 0) {
+ debug("Node %s not found.\n", path);
+ return 0;
+ }
+ ret = fdt_setprop_string(fdt, offs,
+ "status", "disabled");
+ if (ret < 0) {
+ printf("Could not add status property to node %s: %s\n",
+ path, fdt_strerror(ret));
+ return ret;
+ }
+ return 0;
+}
+
+#if (CONFIG_TI_SECURE_EMIF_TOTAL_REGION_SIZE != 0)
+/*
+ * fdt_pack_reg - pack address and size array into the "reg"-suitable stream
+ */
+static int fdt_pack_reg(const void *fdt, void *buf, u64 address, u64 size)
+{
+ int address_cells = fdt_address_cells(fdt, 0);
+ int size_cells = fdt_size_cells(fdt, 0);
+ char *p = buf;
+
+ if (address_cells == 2)
+ *(fdt64_t *)p = cpu_to_fdt64(address);
+ else
+ *(fdt32_t *)p = cpu_to_fdt32(address);
+ p += 4 * address_cells;
+
+ if (size_cells == 2)
+ *(fdt64_t *)p = cpu_to_fdt64(size);
+ else
+ *(fdt32_t *)p = cpu_to_fdt32(size);
+ p += 4 * size_cells;
+
+ return p - (char *)buf;
+}
+
+int ft_hs_fixup_dram(void *fdt, bd_t *bd)
+{
+ const char *path, *subpath;
+ int offs, len;
+ u32 sec_mem_start = get_sec_mem_start();
+ u32 sec_mem_size = CONFIG_TI_SECURE_EMIF_TOTAL_REGION_SIZE;
+ fdt32_t address_cells = cpu_to_fdt32(fdt_address_cells(fdt, 0));
+ fdt32_t size_cells = cpu_to_fdt32(fdt_size_cells(fdt, 0));
+ u8 temp[16]; /* Up to 64-bit address + 64-bit size */
+
+ /* Delete any original secure_reserved node */
+ path = "/reserved-memory/secure_reserved";
+ offs = fdt_path_offset(fdt, path);
+ if (offs >= 0)
+ fdt_del_node(fdt, offs);
+
+ /* Add new secure_reserved node */
+ path = "/reserved-memory";
+ offs = fdt_path_offset(fdt, path);
+ if (offs < 0) {
+ debug("Node %s not found\n", path);
+ path = "/";
+ subpath = "reserved-memory";
+ offs = fdt_path_offset(fdt, path);
+ offs = fdt_add_subnode(fdt, offs, subpath);
+ if (offs < 0) {
+ printf("Could not create %s%s node.\n", path, subpath);
+ return 1;
+ }
+ path = "/reserved-memory";
+ offs = fdt_path_offset(fdt, path);
+
+ fdt_setprop(fdt, offs, "#address-cells", &address_cells, sizeof(address_cells));
+ fdt_setprop(fdt, offs, "#size-cells", &size_cells, sizeof(size_cells));
+ fdt_setprop(fdt, offs, "ranges", NULL, 0);
+ }
+
+ subpath = "secure_reserved";
+ offs = fdt_add_subnode(fdt, offs, subpath);
+ if (offs < 0) {
+ printf("Could not create %s%s node.\n", path, subpath);
+ return 1;
+ }
+
+ fdt_setprop_string(fdt, offs, "compatible", "ti,secure-memory");
+ fdt_setprop_string(fdt, offs, "status", "okay");
+ fdt_setprop(fdt, offs, "no-map", NULL, 0);
+ len = fdt_pack_reg(fdt, temp, sec_mem_start, sec_mem_size);
+ fdt_setprop(fdt, offs, "reg", temp, len);
+
+ return 0;
+}
+#else
+int ft_hs_fixup_dram(void *fdt, bd_t *bd) { return 0; }
+#endif
+
+int ft_hs_add_tee(void *fdt, bd_t *bd)
+{
+ const char *path, *subpath;
+ int offs;
+
+ extern int tee_loaded;
+ if (!tee_loaded)
+ return 0;
+
+ path = "/";
+ offs = fdt_path_offset(fdt, path);
+
+ subpath = "firmware";
+ offs = fdt_add_subnode(fdt, offs, subpath);
+ if (offs < 0) {
+ printf("Could not create %s node.\n", subpath);
+ return 1;
+ }
+
+ subpath = "optee";
+ offs = fdt_add_subnode(fdt, offs, subpath);
+ if (offs < 0) {
+ printf("Could not create %s node.\n", subpath);
+ return 1;
+ }
+
+ fdt_setprop_string(fdt, offs, "compatible", "linaro,optee-tz");
+ fdt_setprop_string(fdt, offs, "method", "smc");
+
+ return 0;
+}
+
+#endif
diff --git a/arch/arm/mach-omap2/omap5/fdt.c b/arch/arm/mach-omap2/omap5/fdt.c
index 7a3a8db517..1e556da9be 100644
--- a/arch/arm/mach-omap2/omap5/fdt.c
+++ b/arch/arm/mach-omap2/omap5/fdt.c
@@ -90,29 +90,6 @@ static int ft_hs_fixup_crossbar(void *fdt, bd_t *bd)
return 0;
}
-static int ft_hs_disable_rng(void *fdt, bd_t *bd)
-{
- const char *path;
- int offs;
- int ret;
-
- /* Make HW RNG reserved for secure world use */
- path = "/ocp/rng";
- offs = fdt_path_offset(fdt, path);
- if (offs < 0) {
- debug("Node %s not found.\n", path);
- return 0;
- }
- ret = fdt_setprop_string(fdt, offs,
- "status", "disabled");
- if (ret < 0) {
- printf("Could not add status property to node %s: %s\n",
- path, fdt_strerror(ret));
- return ret;
- }
- return 0;
-}
-
#if ((TI_OMAP5_SECURE_BOOT_RESV_SRAM_SZ != 0) || \
(CONFIG_SECURE_RUNTIME_RESV_SRAM_SZ != 0))
static int ft_hs_fixup_sram(void *fdt, bd_t *bd)
@@ -153,102 +130,6 @@ static int ft_hs_fixup_sram(void *fdt, bd_t *bd)
static int ft_hs_fixup_sram(void *fdt, bd_t *bd) { return 0; }
#endif
-#if (CONFIG_TI_SECURE_EMIF_TOTAL_REGION_SIZE != 0)
-static int ft_hs_fixup_dram(void *fdt, bd_t *bd)
-{
- const char *path, *subpath;
- int offs;
- u32 sec_mem_start = CONFIG_TI_SECURE_EMIF_REGION_START;
- u32 sec_mem_size = CONFIG_TI_SECURE_EMIF_TOTAL_REGION_SIZE;
- fdt64_t temp[2];
- fdt32_t two;
-
- /* If start address is zero, place@end of DRAM */
- if (0 == sec_mem_start)
- sec_mem_start =
- (CONFIG_SYS_SDRAM_BASE +
- (omap_sdram_size() - sec_mem_size));
-
- /* Delete any original secure_reserved node */
- path = "/reserved-memory/secure_reserved";
- offs = fdt_path_offset(fdt, path);
- if (offs >= 0)
- fdt_del_node(fdt, offs);
-
- /* Add new secure_reserved node */
- path = "/reserved-memory";
- offs = fdt_path_offset(fdt, path);
- if (offs < 0) {
- debug("Node %s not found\n", path);
- path = "/";
- subpath = "reserved-memory";
- offs = fdt_path_offset(fdt, path);
- offs = fdt_add_subnode(fdt, offs, subpath);
- if (offs < 0) {
- printf("Could not create %s%s node.\n", path, subpath);
- return 1;
- }
- path = "/reserved-memory";
- offs = fdt_path_offset(fdt, path);
- two = cpu_to_fdt32(2);
- fdt_setprop(fdt, offs, "#address-cells", &two, sizeof(two));
- fdt_setprop(fdt, offs, "#size-cells", &two, sizeof(two));
- fdt_setprop(fdt, offs, "ranges", NULL, 0);
- }
-
- subpath = "secure_reserved";
- offs = fdt_add_subnode(fdt, offs, subpath);
- if (offs < 0) {
- printf("Could not create %s%s node.\n", path, subpath);
- return 1;
- }
-
- temp[0] = cpu_to_fdt64(((u64)sec_mem_start));
- temp[1] = cpu_to_fdt64(((u64)sec_mem_size));
- fdt_setprop_string(fdt, offs, "compatible",
- "ti,dra7-secure-memory");
- fdt_setprop_string(fdt, offs, "status", "okay");
- fdt_setprop(fdt, offs, "no-map", NULL, 0);
- fdt_setprop(fdt, offs, "reg", temp, sizeof(temp));
-
- return 0;
-}
-#else
-static int ft_hs_fixup_dram(void *fdt, bd_t *bd) { return 0; }
-#endif
-
-static int ft_hs_add_tee(void *fdt, bd_t *bd)
-{
- const char *path, *subpath;
- int offs;
-
- extern int tee_loaded;
- if (!tee_loaded)
- return 0;
-
- path = "/";
- offs = fdt_path_offset(fdt, path);
-
- subpath = "firmware";
- offs = fdt_add_subnode(fdt, offs, subpath);
- if (offs < 0) {
- printf("Could not create %s node.\n", subpath);
- return 1;
- }
-
- subpath = "optee";
- offs = fdt_add_subnode(fdt, offs, subpath);
- if (offs < 0) {
- printf("Could not create %s node.\n", subpath);
- return 1;
- }
-
- fdt_setprop_string(fdt, offs, "compatible", "linaro,optee-tz");
- fdt_setprop_string(fdt, offs, "method", "smc");
-
- return 0;
-}
-
static void ft_hs_fixups(void *fdt, bd_t *bd)
{
/* Check we are running on an HS/EMU device type */
diff --git a/arch/arm/mach-omap2/sec-common.c b/arch/arm/mach-omap2/sec-common.c
index f230c9ea4e..030b36f332 100644
--- a/arch/arm/mach-omap2/sec-common.c
+++ b/arch/arm/mach-omap2/sec-common.c
@@ -176,7 +176,7 @@ auth_exit:
return result;
}
-static u32 get_sec_mem_start(void)
+u32 get_sec_mem_start(void)
{
u32 sec_mem_start = CONFIG_TI_SECURE_EMIF_REGION_START;
u32 sec_mem_size = CONFIG_TI_SECURE_EMIF_TOTAL_REGION_SIZE;
--
2.13.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [U-Boot] [PATCH v2 3/6] arm: mach-omap2: fdt-common: Add OP-TEE node when firmware node is defined
2017-07-10 19:45 [U-Boot] [PATCH v2 0/6] AM43xx OP-TEE support Andrew F. Davis
2017-07-10 19:45 ` [U-Boot] [PATCH v2 1/6] arm: mach-omap2: Move omap5/sec-fxns.c into sec-common.c Andrew F. Davis
2017-07-10 19:45 ` [U-Boot] [PATCH v2 2/6] arm: mach-omap2: Factor out common FDT fixup suport Andrew F. Davis
@ 2017-07-10 19:45 ` Andrew F. Davis
2017-07-25 0:42 ` [U-Boot] [U-Boot, v2, " Tom Rini
2017-07-10 19:45 ` [U-Boot] [PATCH v2 4/6] arm: mach-omap2: am33xx: Add FDT fixup suport for AM33xx/AM43xx boards Andrew F. Davis
` (3 subsequent siblings)
6 siblings, 1 reply; 14+ messages in thread
From: Andrew F. Davis @ 2017-07-10 19:45 UTC (permalink / raw)
To: u-boot
If a firmware node is already present in the FDT we will fail to create
one and so fail to add our OP-TEE node, make this fixup first check for
a firmware node and then only try to add one if it is not found.
Signed-off-by: Andrew F. Davis <afd@ti.com>
---
arch/arm/mach-omap2/fdt-common.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
diff --git a/arch/arm/mach-omap2/fdt-common.c b/arch/arm/mach-omap2/fdt-common.c
index 297d4d4df5..9297e9db48 100644
--- a/arch/arm/mach-omap2/fdt-common.c
+++ b/arch/arm/mach-omap2/fdt-common.c
@@ -134,14 +134,22 @@ int ft_hs_add_tee(void *fdt, bd_t *bd)
if (!tee_loaded)
return 0;
- path = "/";
+ path = "/firmware";
offs = fdt_path_offset(fdt, path);
-
- subpath = "firmware";
- offs = fdt_add_subnode(fdt, offs, subpath);
if (offs < 0) {
- printf("Could not create %s node.\n", subpath);
- return 1;
+ path = "/";
+ offs = fdt_path_offset(fdt, path);
+ if (offs < 0) {
+ printf("Could not find root node.\n");
+ return 1;
+ }
+
+ subpath = "firmware";
+ offs = fdt_add_subnode(fdt, offs, subpath);
+ if (offs < 0) {
+ printf("Could not create %s node.\n", subpath);
+ return 1;
+ }
}
subpath = "optee";
--
2.13.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [U-Boot] [PATCH v2 4/6] arm: mach-omap2: am33xx: Add FDT fixup suport for AM33xx/AM43xx boards
2017-07-10 19:45 [U-Boot] [PATCH v2 0/6] AM43xx OP-TEE support Andrew F. Davis
` (2 preceding siblings ...)
2017-07-10 19:45 ` [U-Boot] [PATCH v2 3/6] arm: mach-omap2: fdt-common: Add OP-TEE node when firmware node is defined Andrew F. Davis
@ 2017-07-10 19:45 ` Andrew F. Davis
2017-07-25 0:42 ` [U-Boot] [U-Boot, v2, " Tom Rini
2017-07-10 19:45 ` [U-Boot] [PATCH v2 5/6] board: ti: am43xx: Add TEE loading and firewall setup Andrew F. Davis
` (2 subsequent siblings)
6 siblings, 1 reply; 14+ messages in thread
From: Andrew F. Davis @ 2017-07-10 19:45 UTC (permalink / raw)
To: u-boot
Similar to what is done with OMAP5 class boards we need to
perform fixups common to this SoC class, add support for this here
and add HS fixups.
Signed-off-by: Andrew F. Davis <afd@ti.com>
---
arch/arm/mach-omap2/am33xx/Makefile | 1 +
arch/arm/mach-omap2/am33xx/fdt.c | 43 +++++++++++++++++++++++++++++++++++++
2 files changed, 44 insertions(+)
create mode 100644 arch/arm/mach-omap2/am33xx/fdt.c
diff --git a/arch/arm/mach-omap2/am33xx/Makefile b/arch/arm/mach-omap2/am33xx/Makefile
index b2f8158e73..9d4f83cb75 100644
--- a/arch/arm/mach-omap2/am33xx/Makefile
+++ b/arch/arm/mach-omap2/am33xx/Makefile
@@ -23,6 +23,7 @@ obj-y += board.o
obj-y += mux.o
obj-y += prcm-regs.o
obj-y += hw_data.o
+obj-y += fdt.o
obj-$(CONFIG_CLOCK_SYNTHESIZER) += clk_synthesizer.o
diff --git a/arch/arm/mach-omap2/am33xx/fdt.c b/arch/arm/mach-omap2/am33xx/fdt.c
new file mode 100644
index 0000000000..02e8243800
--- /dev/null
+++ b/arch/arm/mach-omap2/am33xx/fdt.c
@@ -0,0 +1,43 @@
+/*
+ * Copyright 2017 Texas Instruments, Inc.
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ */
+
+#include <common.h>
+#include <libfdt.h>
+#include <fdt_support.h>
+#include <malloc.h>
+
+#include <asm/omap_common.h>
+#include <asm/arch-am33xx/sys_proto.h>
+
+#ifdef CONFIG_TI_SECURE_DEVICE
+
+static void ft_hs_fixups(void *fdt, bd_t *bd)
+{
+ /* Check we are running on an HS/EMU device type */
+ if (GP_DEVICE != get_device_type()) {
+ if ((ft_hs_disable_rng(fdt, bd) == 0) &&
+ (ft_hs_fixup_dram(fdt, bd) == 0) &&
+ (ft_hs_add_tee(fdt, bd) == 0))
+ return;
+ } else {
+ printf("ERROR: Incorrect device type (GP) detected!");
+ }
+ /* Fixup failed or wrong device type */
+ hang();
+}
+#else
+static void ft_hs_fixups(void *fdt, bd_t *bd) { }
+#endif /* #ifdef CONFIG_TI_SECURE_DEVICE */
+
+/*
+ * Place for general cpu/SoC FDT fixups. Board specific
+ * fixups should remain in the board files which is where
+ * this function should be called from.
+ */
+void ft_cpu_setup(void *fdt, bd_t *bd)
+{
+ ft_hs_fixups(fdt, bd);
+}
--
2.13.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [U-Boot] [PATCH v2 5/6] board: ti: am43xx: Add TEE loading and firewall setup
2017-07-10 19:45 [U-Boot] [PATCH v2 0/6] AM43xx OP-TEE support Andrew F. Davis
` (3 preceding siblings ...)
2017-07-10 19:45 ` [U-Boot] [PATCH v2 4/6] arm: mach-omap2: am33xx: Add FDT fixup suport for AM33xx/AM43xx boards Andrew F. Davis
@ 2017-07-10 19:45 ` Andrew F. Davis
2017-07-25 0:43 ` [U-Boot] [U-Boot, v2, " Tom Rini
2017-07-10 19:45 ` [U-Boot] [PATCH v2 6/6] board: ti: am43xx: Add FDT fixup for HS devices Andrew F. Davis
2017-07-10 19:48 ` [U-Boot] [PATCH v2 0/6] AM43xx OP-TEE support Andrew F. Davis
6 siblings, 1 reply; 14+ messages in thread
From: Andrew F. Davis @ 2017-07-10 19:45 UTC (permalink / raw)
To: u-boot
Add support for loading a TEE and setting up firewalled regions to
AM43xx HS boards.
Signed-off-by: Andrew F. Davis <afd@ti.com>
---
board/ti/am43xx/board.c | 7 +++++++
configs/am43xx_hs_evm_defconfig | 3 +++
2 files changed, 10 insertions(+)
diff --git a/board/ti/am43xx/board.c b/board/ti/am43xx/board.c
index 54f40e64a4..96032215a6 100644
--- a/board/ti/am43xx/board.c
+++ b/board/ti/am43xx/board.c
@@ -859,4 +859,11 @@ void board_fit_image_post_process(void **p_image, size_t *p_size)
{
secure_boot_verify_image(p_image, p_size);
}
+
+void board_tee_image_process(ulong tee_image, size_t tee_size)
+{
+ secure_tee_install((u32)tee_image);
+}
+
+U_BOOT_FIT_LOADABLE_HANDLER(IH_TYPE_TEE, board_tee_image_process);
#endif
diff --git a/configs/am43xx_hs_evm_defconfig b/configs/am43xx_hs_evm_defconfig
index fb4bb037dd..0cb2ee90ad 100644
--- a/configs/am43xx_hs_evm_defconfig
+++ b/configs/am43xx_hs_evm_defconfig
@@ -4,6 +4,9 @@ CONFIG_TI_COMMON_CMD_OPTIONS=y
CONFIG_SYS_MALLOC_F_LEN=0x2000
CONFIG_AM43XX=y
CONFIG_TI_SECURE_DEVICE=y
+CONFIG_TI_SECURE_EMIF_REGION_START=0xbdb00000
+CONFIG_TI_SECURE_EMIF_TOTAL_REGION_SIZE=0x02000000
+CONFIG_TI_SECURE_EMIF_PROTECTED_REGION_SIZE=0x01c00000
CONFIG_ISW_ENTRY_ADDR=0x403018e0
CONFIG_SPL_STACK_R_ADDR=0x82000000
CONFIG_DEFAULT_DEVICE_TREE="am437x-gp-evm"
--
2.13.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [U-Boot] [PATCH v2 6/6] board: ti: am43xx: Add FDT fixup for HS devices
2017-07-10 19:45 [U-Boot] [PATCH v2 0/6] AM43xx OP-TEE support Andrew F. Davis
` (4 preceding siblings ...)
2017-07-10 19:45 ` [U-Boot] [PATCH v2 5/6] board: ti: am43xx: Add TEE loading and firewall setup Andrew F. Davis
@ 2017-07-10 19:45 ` Andrew F. Davis
2017-07-25 0:43 ` [U-Boot] [U-Boot, v2, " Tom Rini
2017-07-10 19:48 ` [U-Boot] [PATCH v2 0/6] AM43xx OP-TEE support Andrew F. Davis
6 siblings, 1 reply; 14+ messages in thread
From: Andrew F. Davis @ 2017-07-10 19:45 UTC (permalink / raw)
To: u-boot
Disable RNG and add TEE to FDT used on HS devices.
Signed-off-by: Andrew F. Davis <afd@ti.com>
---
board/ti/am43xx/board.c | 9 +++++++++
configs/am43xx_hs_evm_defconfig | 1 +
2 files changed, 10 insertions(+)
diff --git a/board/ti/am43xx/board.c b/board/ti/am43xx/board.c
index 96032215a6..933596d59c 100644
--- a/board/ti/am43xx/board.c
+++ b/board/ti/am43xx/board.c
@@ -838,6 +838,15 @@ int board_eth_init(bd_t *bis)
}
#endif
+#if defined(CONFIG_OF_LIBFDT) && defined(CONFIG_OF_BOARD_SETUP)
+int ft_board_setup(void *blob, bd_t *bd)
+{
+ ft_cpu_setup(blob, bd);
+
+ return 0;
+}
+#endif
+
#ifdef CONFIG_SPL_LOAD_FIT
int board_fit_config_name_match(const char *name)
{
diff --git a/configs/am43xx_hs_evm_defconfig b/configs/am43xx_hs_evm_defconfig
index 0cb2ee90ad..4ad676ff0b 100644
--- a/configs/am43xx_hs_evm_defconfig
+++ b/configs/am43xx_hs_evm_defconfig
@@ -11,6 +11,7 @@ CONFIG_ISW_ENTRY_ADDR=0x403018e0
CONFIG_SPL_STACK_R_ADDR=0x82000000
CONFIG_DEFAULT_DEVICE_TREE="am437x-gp-evm"
CONFIG_FIT_IMAGE_POST_PROCESS=y
+CONFIG_OF_BOARD_SETUP=y
CONFIG_SPL_LOAD_FIT=y
CONFIG_SPL_FIT_IMAGE_POST_PROCESS=y
CONFIG_SYS_EXTRA_OPTIONS="CONS_INDEX=1,NAND"
--
2.13.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [U-Boot] [PATCH v2 0/6] AM43xx OP-TEE support
2017-07-10 19:45 [U-Boot] [PATCH v2 0/6] AM43xx OP-TEE support Andrew F. Davis
` (5 preceding siblings ...)
2017-07-10 19:45 ` [U-Boot] [PATCH v2 6/6] board: ti: am43xx: Add FDT fixup for HS devices Andrew F. Davis
@ 2017-07-10 19:48 ` Andrew F. Davis
6 siblings, 0 replies; 14+ messages in thread
From: Andrew F. Davis @ 2017-07-10 19:48 UTC (permalink / raw)
To: u-boot
On 07/10/2017 02:45 PM, Andrew F. Davis wrote:
> Hello all,
>
> This series brings our firewall and OP-TEE support from DRA7xx/AM57xx
> family devices to the AM43xx class devices. We do this by factoring
> out code common code from omap5/ into common mach-omap2/ sources. Then
> add the hooks for the AM43xx boards.
>
> Thanks,
> Andrew
>
> Changes from v1:
> - Stop format-patch from thinking the first patch is a rename
> - Rebase on latest master
>
Looks like I forgot to add the Reviewed-bys..
All patches except #5 should have:
Reviewed-by: Lokesh Vutla <lokeshvutla@ti.com>
Reviewed-by: Tom Rini <trini@konsulko.com>
> Andrew F. Davis (6):
> arm: mach-omap2: Move omap5/sec-fxns.c into sec-common.c
> arm: mach-omap2: Factor out common FDT fixup suport
> arm: mach-omap2: fdt-common: Add OP-TEE node when firmware node is
> defined
> arm: mach-omap2: am33xx: Add FDT fixup suport for AM33xx/AM43xx boards
> board: ti: am43xx: Add TEE loading and firewall setup
> board: ti: am43xx: Add FDT fixup for HS devices
>
> arch/arm/include/asm/omap_common.h | 5 +
> arch/arm/include/asm/omap_sec_common.h | 6 +
> arch/arm/mach-omap2/Kconfig | 26 ++++
> arch/arm/mach-omap2/Makefile | 2 +
> arch/arm/mach-omap2/am33xx/Makefile | 1 +
> arch/arm/mach-omap2/am33xx/fdt.c | 43 ++++++
> arch/arm/mach-omap2/fdt-common.c | 168 +++++++++++++++++++++++
> arch/arm/mach-omap2/omap5/Kconfig | 26 ----
> arch/arm/mach-omap2/omap5/Makefile | 1 -
> arch/arm/mach-omap2/omap5/fdt.c | 119 -----------------
> arch/arm/mach-omap2/omap5/sec-fxns.c | 234 ---------------------------------
> arch/arm/mach-omap2/sec-common.c | 226 ++++++++++++++++++++++++++++++-
> board/ti/am43xx/board.c | 16 +++
> configs/am43xx_hs_evm_defconfig | 4 +
> 14 files changed, 496 insertions(+), 381 deletions(-)
> create mode 100644 arch/arm/mach-omap2/am33xx/fdt.c
> create mode 100644 arch/arm/mach-omap2/fdt-common.c
> delete mode 100644 arch/arm/mach-omap2/omap5/sec-fxns.c
>
^ permalink raw reply [flat|nested] 14+ messages in thread