AM43xx OP-TEE support

Hello all,

This series brings our firewall and OP-TEE support from DRA7xx/AM57xx family devices to the AM43xx class devices. We do this by factoring out code common code from omap5/ into common mach-omap2/ sources. Then add the hooks for the AM43xx boards.

Thanks,
Andrew

Andrew F. Davis (6):
arm: mach-omap2: Move omap5/sec-fxns.c into sec-common.c
arm: mach-omap2: Factor out common FDT fixup suport
arm: mach-omap2: fdt-common: Add OP-TEE node when firmware node is
defined
arm: mach-omap2: am33xx: Add FDT fixup suport for AM33xx/AM43xx boards
board: ti: am43xx: Add TEE loading and firewall setup
board: ti: am43xx: Add FDT fixup for HS devices

 arch/arm/include/asm/omap_common.h                 |   5 +
 arch/arm/include/asm/omap_sec_common.h             |   6 +
 arch/arm/mach-omap2/Kconfig                        |  26 ++++
 arch/arm/mach-omap2/Makefile                       |   2 +
 arch/arm/mach-omap2/am33xx/Makefile                |   1 +
 arch/arm/mach-omap2/am33xx/fdt.c                   |  43 ++++++
 arch/arm/mach-omap2/fdt-common.c                   | 168 +++++++++++++++++++++
 arch/arm/mach-omap2/omap5/Kconfig                  |  26 ----
 arch/arm/mach-omap2/omap5/Makefile                 |   1 -
 arch/arm/mach-omap2/omap5/fdt.c                    | 119 ---------------
 .../mach-omap2/{omap5/sec-fxns.c => sec-common.c}  | 157 ++++++++++++++++++-
 board/ti/am43xx/board.c                            |  16 ++
 configs/am43xx_hs_evm_defconfig                    |   4 +
 13 files changed, 420 insertions(+), 154 deletions(-)
 create mode 100644 arch/arm/mach-omap2/am33xx/fdt.c
 create mode 100644 arch/arm/mach-omap2/fdt-common.c
 rename arch/arm/mach-omap2/{omap5/sec-fxns.c => sec-common.c} (64%)

2.13.0

TEE loading and firewall setup are common to all omap2 devices, move these function out of omap5 and into mach-omap2. This allows us to use these functions from other omap class devices.

---
 arch/arm/mach-omap2/Kconfig                        |  26 ++++
 arch/arm/mach-omap2/omap5/Kconfig                  |  26 ----
 arch/arm/mach-omap2/omap5/Makefile                 |   1 -
 .../mach-omap2/{omap5/sec-fxns.c => sec-common.c}  | 155 ++++++++++++++++++++-
 4 files changed, 174 insertions(+), 34 deletions(-)
 rename arch/arm/mach-omap2/{omap5/sec-fxns.c => sec-common.c} (64%)

index 683cdb9296..013586edd9 100644
@@ -119,6 +119,32 @@ config TI_SECURE_DEVICE
 	  authenticated) and the code. See the doc/README.ti-secure
 	  file for further details.
 
+config TI_SECURE_EMIF_REGION_START
+	hex "Reserved EMIF region start address"
+	depends on TI_SECURE_DEVICE
+	default 0x0
+	help
+	  Reserved EMIF region start address. Set to "0" to auto-select
+	  to be at the end of the external memory region.
+
+config TI_SECURE_EMIF_TOTAL_REGION_SIZE
+	hex "Reserved EMIF region size"
+	depends on TI_SECURE_DEVICE
+	default 0x0
+	help
+	  Total reserved EMIF region size. Default is 0, which means no reserved EMIF
+	  region on secure devices.
+
+config TI_SECURE_EMIF_PROTECTED_REGION_SIZE
+	hex "Size of protected region within reserved EMIF region"
+	depends on TI_SECURE_DEVICE
+	default 0x0
+	help
+	  This config option is used to specify the size of the portion of the total
+	  reserved EMIF region set aside for secure OS needs that will  be protected
+	  using hardware memory firewalls. This value must be smaller than the
+	  TI_SECURE_EMIF_TOTAL_REGION_SIZE value.
+
 source "arch/arm/mach-omap2/omap3/Kconfig"
 
 source "arch/arm/mach-omap2/omap4/Kconfig"

index 1a66abdeb2..7e8e532d4c 100644
@@ -37,32 +37,6 @@ endchoice
 config SYS_SOC
 	default "omap5"
 
-config TI_SECURE_EMIF_REGION_START
-	hex "Reserved EMIF region start address"
-	depends on TI_SECURE_DEVICE
-	default 0x0
-	help
-	  Reserved EMIF region start address. Set to "0" to auto-select
-	  to be at the end of the external memory region.
-
-config TI_SECURE_EMIF_TOTAL_REGION_SIZE
-	hex "Reserved EMIF region size"
-	depends on TI_SECURE_DEVICE
-	default 0x0
-	help
-	  Total reserved EMIF region size. Default is 0, which means no reserved EMIF
-	  region on secure devices.
-
-config TI_SECURE_EMIF_PROTECTED_REGION_SIZE
-	hex "Size of protected region within reserved EMIF region"
-	depends on TI_SECURE_DEVICE
-	default 0x0
-	help
-	  This config option is used to specify the size of the portion of the total
-	  reserved EMIF region set aside for secure OS needs that will  be protected
-	  using hardware memory firewalls. This value must be smaller than the
-	  TI_SECURE_EMIF_TOTAL_REGION_SIZE value.
-
 config OMAP_PLATFORM_RESET_TIME_MAX_USEC
 	int "Something"
 	range 0  31219

index af17a3deab..a6a5d17ff6 100644
@@ -14,5 +14,4 @@ obj-y	+= hw_data.o
 obj-y	+= abb.o
 obj-y	+= fdt.o
 obj-$(CONFIG_IODELAY_RECALIBRATION) += dra7xx_iodelay.o
-obj-$(CONFIG_TI_SECURE_DEVICE) += sec-fxns.o
 obj-$(CONFIG_DRA7XX) += sec_entry_cpu1.o

2.13.0

Thanks and regards,
Lokesh

Some of the fixups currently done for OMAP5 class boards are common to other OMAP family devices, move these to fdt-common.c.

---
 arch/arm/include/asm/omap_common.h     |   5 ++
 arch/arm/include/asm/omap_sec_common.h |   6 ++
 arch/arm/mach-omap2/Makefile           |   2 +
 arch/arm/mach-omap2/fdt-common.c       | 160 +++++++++++++++++++++++++++++++++
 arch/arm/mach-omap2/omap5/fdt.c        | 119 ------------------------
 arch/arm/mach-omap2/sec-common.c       |   2 +-
 6 files changed, 174 insertions(+), 120 deletions(-)
 create mode 100644 arch/arm/mach-omap2/fdt-common.c

index d2ca277772..ef5c481349 100644
@@ -680,6 +680,11 @@ void omap_die_id(unsigned int *die_id);
 /* Initialize general purpose I2C(0) on the SoC */
 void gpi2c_init(void);
 
+/* Common FDT Fixups */
+int ft_hs_disable_rng(void *fdt, bd_t *bd);
+int ft_hs_fixup_dram(void *fdt, bd_t *bd);
+int ft_hs_add_tee(void *fdt, bd_t *bd);
+
 /* ABB */
 #define OMAP_ABB_NOMINAL_OPP		0
 #define OMAP_ABB_FAST_OPP		1

index 79f1fbd2c1..76d0862270 100644
@@ -28,6 +28,12 @@ u32 secure_rom_call(u32 service, u32 proc_id, u32 flag, ...);
 int secure_boot_verify_image(void **p_image, size_t *p_size);
 
 /*
+ * Return the start of secure reserved RAM, if a default start address has
+ * not been configured then return a region at the end of the external DRAM.
+ */
+u32 get_sec_mem_start(void);
+
+/*
  * Invoke a secure HAL API that allows configuration of the external memory
  * firewall regions.
  */

index d43085ca98..d86643db34 100644
@@ -45,4 +45,6 @@ obj-y	+= lowlevel_init.o
 
 obj-y	+= mem-common.o
 
+obj-y	+= fdt-common.o
+
 obj-$(CONFIG_TI_SECURE_DEVICE) += sec-common.o

index f230c9ea4e..030b36f332 100644
@@ -176,7 +176,7 @@ auth_exit:
 	return result;
 }
 
-static u32 get_sec_mem_start(void)
+u32 get_sec_mem_start(void)
 {
 	u32 sec_mem_start = CONFIG_TI_SECURE_EMIF_REGION_START;
 	u32 sec_mem_size = CONFIG_TI_SECURE_EMIF_TOTAL_REGION_SIZE;

2.13.0

Thanks and regards,
Lokesh

If a firmware node is already present in the FDT we will fail to create one and so fail to add our OP-TEE node, make this fixup first check for a firmware node and then only try to add one if it is not found.

---
 arch/arm/mach-omap2/fdt-common.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

index 297d4d4df5..9297e9db48 100644
@@ -134,14 +134,22 @@ int ft_hs_add_tee(void *fdt, bd_t *bd)
 	if (!tee_loaded)
 		return 0;
 
-	path = "/";
+	path = "/firmware";
 	offs = fdt_path_offset(fdt, path);
-
-	subpath = "firmware";
-	offs = fdt_add_subnode(fdt, offs, subpath);
 	if (offs < 0) {
-		printf("Could not create %s node.\n", subpath);
-		return 1;
+		path = "/";
+		offs = fdt_path_offset(fdt, path);
+		if (offs < 0) {
+			printf("Could not find root node.\n");
+			return 1;
+		}
+
+		subpath = "firmware";
+		offs = fdt_add_subnode(fdt, offs, subpath);
+		if (offs < 0) {
+			printf("Could not create %s node.\n", subpath);
+			return 1;
+		}
 	}
 
 	subpath = "optee";

2.13.0

Thanks and regards,
Lokesh

Similar to what is done with OMAP5 class boards we need to perform fixups common to this SoC class, add support for this here and add HS fixups.

---
 arch/arm/mach-omap2/am33xx/Makefile |  1 +
 arch/arm/mach-omap2/am33xx/fdt.c    | 43 +++++++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+)
 create mode 100644 arch/arm/mach-omap2/am33xx/fdt.c

index b2f8158e73..9d4f83cb75 100644
@@ -23,6 +23,7 @@ obj-y	+= board.o
 obj-y	+= mux.o
 obj-y	+= prcm-regs.o
 obj-y	+= hw_data.o
+obj-y	+= fdt.o
 
 obj-$(CONFIG_CLOCK_SYNTHESIZER)	+= clk_synthesizer.o
 

2.13.0

Thanks and regards,
Lokesh

Add support for loading a TEE and setting up firewalled regions to AM43xx HS boards.

---
 board/ti/am43xx/board.c         | 7 +++++++
 configs/am43xx_hs_evm_defconfig | 3 +++
 2 files changed, 10 insertions(+)

index 54f40e64a4..96032215a6 100644
@@ -859,4 +859,11 @@ void board_fit_image_post_process(void **p_image, size_t *p_size)
 {
 	secure_boot_verify_image(p_image, p_size);
 }
+
+void board_tee_image_process(ulong tee_image, size_t tee_size)
+{
+	secure_tee_install((u32)tee_image);
+}
+
+U_BOOT_FIT_LOADABLE_HANDLER(IH_TYPE_TEE, board_tee_image_process);
 #endif

index 6f3cb516fd..37d8e484db 100644
@@ -4,6 +4,9 @@ CONFIG_SYS_MALLOC_F_LEN=0x2000
 CONFIG_AM43XX=y
 CONFIG_TI_COMMON_CMD_OPTIONS=y
 CONFIG_TI_SECURE_DEVICE=y
+CONFIG_TI_SECURE_EMIF_REGION_START=0xbdb00000
+CONFIG_TI_SECURE_EMIF_TOTAL_REGION_SIZE=0x02000000
+CONFIG_TI_SECURE_EMIF_PROTECTED_REGION_SIZE=0x01c00000
 CONFIG_TARGET_AM43XX_EVM=y
 CONFIG_ISW_ENTRY_ADDR=0x403018e0
 CONFIG_SPL_STACK_R_ADDR=0x82000000

2.13.0

I think I'll add this in a separate patch, I'm still not sure that is the best solution to avoid relocation overlap just yet.

Thanks,
Andrew

Disable RNG and add TEE to FDT used on HS devices.

---
 board/ti/am43xx/board.c         | 9 +++++++++
 configs/am43xx_hs_evm_defconfig | 1 +
 2 files changed, 10 insertions(+)

index 96032215a6..933596d59c 100644
@@ -838,6 +838,15 @@ int board_eth_init(bd_t *bis)
 }
 #endif
 
+#if defined(CONFIG_OF_LIBFDT) && defined(CONFIG_OF_BOARD_SETUP)
+int ft_board_setup(void *blob, bd_t *bd)
+{
+	ft_cpu_setup(blob, bd);
+
+	return 0;
+}
+#endif
+
 #ifdef CONFIG_SPL_LOAD_FIT
 int board_fit_config_name_match(const char *name)
 {

index 37d8e484db..699d4cc0de 100644
@@ -12,6 +12,7 @@ CONFIG_ISW_ENTRY_ADDR=0x403018e0
 CONFIG_SPL_STACK_R_ADDR=0x82000000
 CONFIG_DEFAULT_DEVICE_TREE="am437x-gp-evm"
 CONFIG_FIT_IMAGE_POST_PROCESS=y
+CONFIG_OF_BOARD_SETUP=y
 CONFIG_SPL_LOAD_FIT=y
 CONFIG_SPL_FIT_IMAGE_POST_PROCESS=y
 CONFIG_SYS_EXTRA_OPTIONS="CONS_INDEX=1,NAND"

2.13.0

Thanks and regards,
Lokesh