From 24338c81ec2f689f09d761afbcf28c8661d536b6 Mon Sep 17 00:00:00 2001 From: Suhaas Joshi Date: Tue, 27 Jan 2026 13:46:43 +0530 Subject: arm: dts: k3-binman: Use configs for ATF/OPTEE addresses Instead of hard-coding ATF and OPTEE addresses in firewall configuration templates, use K3_*_LOAD_ADDR. Doing so ensures that if someone moves ATF/OPTEE regions, the change gets picked up by binman without explicitly having to modify dts files. Signed-off-by: Suhaas Joshi Reviewed-by: Neha Malcom Francis --- arch/arm/dts/k3-binman.dtsi | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/arm/dts/k3-binman.dtsi b/arch/arm/dts/k3-binman.dtsi index 761b1730464..0fd93f9536a 100644 --- a/arch/arm/dts/k3-binman.dtsi +++ b/arch/arm/dts/k3-binman.dtsi @@ -476,8 +476,8 @@ permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) | FWPERM_SECURE_PRIV_RWCD | FWPERM_SECURE_USER_RWCD)>; - start_address = <0x0 0x70000000>; - end_address = <0x0 0x7001ffff>; + start_address = <0x0 CONFIG_K3_ATF_LOAD_ADDR>; + end_address = <0x0 (CONFIG_K3_ATF_LOAD_ADDR + 0x1ffff)>; }; firewall_armv8_optee_fg: template-8 { control = <(FWCTRL_EN | FWCTRL_LOCK | @@ -485,8 +485,8 @@ permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) | FWPERM_SECURE_PRIV_RWCD | FWPERM_SECURE_USER_RWCD)>; - start_address = <0x0 0x9e800000>; - end_address = <0x0 0x9fffffff>; + start_address = <0x0 CONFIG_K3_OPTEE_LOAD_ADDR>; + end_address = <0x0 (CONFIG_K3_OPTEE_LOAD_ADDR + 0x17fffff)>; }; ti_falcon_template: template-9 { -- cgit v1.2.3 From 27f105fbbda22291173155f105ae5242c6f08bd9 Mon Sep 17 00:00:00 2001 From: Suhaas Joshi Date: Tue, 27 Jan 2026 13:46:44 +0530 Subject: arm: dts: k3-am625-binman: Configure firewall for ATF/OPTEE Add firewall configurations to protect ATF and OP-TEE memory regions from non-secure reads and writes in AM62x. Signed-off-by: Suhaas Joshi --- arch/arm/dts/k3-am625-sk-binman.dtsi | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/arch/arm/dts/k3-am625-sk-binman.dtsi b/arch/arm/dts/k3-am625-sk-binman.dtsi index 42edb35fa7b..8d6015e44a9 100644 --- a/arch/arm/dts/k3-am625-sk-binman.dtsi +++ b/arch/arm/dts/k3-am625-sk-binman.dtsi @@ -275,6 +275,35 @@ fit { images { + atf { + ti-secure { + auth-in-place = <0xa02>; + + firewall-1-0 { + insert-template = <&firewall_bg_3>; + id = <1>; + region = <0>; + }; + + firewall-1-1 { + insert-template = <&firewall_armv8_atf_fg>; + id = <1>; + region = <1>; + }; + }; + }; + + tee { + ti-secure { + auth-in-place = <0xa02>; + + firewall-1-2 { + insert-template = <&firewall_armv8_optee_fg>; + id = <1>; + region = <2>; + }; + }; + }; tifsstub-hs { description = "TIFSSTUB"; -- cgit v1.2.3 From 0cee13fe86b8e2a4e2feb9cb447baaca914c0f97 Mon Sep 17 00:00:00 2001 From: Suhaas Joshi Date: Tue, 27 Jan 2026 13:46:45 +0530 Subject: arm: dts: k3-am625-phycore-binman: Configure firewall for ATF/OPTEE Add firewall configurations to protect ATF and OP-TEE from non-secure reads and writes in Phycore AM625 SOM. Signed-off-by: Suhaas Joshi --- arch/arm/dts/k3-am625-phycore-som-binman.dtsi | 30 +++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/arch/arm/dts/k3-am625-phycore-som-binman.dtsi b/arch/arm/dts/k3-am625-phycore-som-binman.dtsi index a9bd5a2be84..5e777a1f305 100644 --- a/arch/arm/dts/k3-am625-phycore-som-binman.dtsi +++ b/arch/arm/dts/k3-am625-phycore-som-binman.dtsi @@ -215,6 +215,36 @@ fit { images { + atf { + ti-secure { + auth-in-place = <0xa02>; + + firewall-1-0 { + insert-template = <&firewall_bg_3>; + id = <1>; + region = <0>; + }; + + firewall-1-1 { + insert-template = <&firewall_armv8_atf_fg>; + id = <1>; + region = <1>; + }; + }; + }; + + tee { + ti-secure { + auth-in-place = <0xa02>; + + firewall-1-2 { + insert-template = <&firewall_armv8_optee_fg>; + id = <1>; + region = <2>; + }; + }; + }; + tifsstub-hs { description = "TIFSSTUB"; type = "firmware"; -- cgit v1.2.3 From 13c54cf588d82b9df073933844443b5dabbdd739 Mon Sep 17 00:00:00 2001 From: Suhaas Joshi Date: Tue, 27 Jan 2026 13:46:46 +0530 Subject: arm: dts: k3-am625-verdin-binman: Configure Firewall for ATF/OPTEE Add firewall configurations to protect ATF and OP-TEE memory regions from non-secure read's and write's in Verdin AM62 board. Signed-off-by: Suhaas Joshi --- arch/arm/dts/k3-am625-verdin-wifi-dev-binman.dtsi | 30 +++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/arch/arm/dts/k3-am625-verdin-wifi-dev-binman.dtsi b/arch/arm/dts/k3-am625-verdin-wifi-dev-binman.dtsi index 65fef6e4790..7b646629587 100644 --- a/arch/arm/dts/k3-am625-verdin-wifi-dev-binman.dtsi +++ b/arch/arm/dts/k3-am625-verdin-wifi-dev-binman.dtsi @@ -200,6 +200,36 @@ fit { images { + atf { + ti-secure { + auth-in-place = <0xa02>; + + firewall-1-0 { + insert-template = <&firewall_bg_3>; + id = <1>; + region = <0>; + }; + + firewall-1-1 { + insert-template = <&firewall_armv8_atf_fg>; + id = <1>; + region = <1>; + }; + }; + }; + + tee { + ti-secure { + auth-in-place = <0xa02>; + + firewall-1-2 { + insert-template = <&firewall_armv8_optee_fg>; + id = <1>; + region = <2>; + }; + }; + }; + tifsstub-hs { description = "TIFSSTUB"; type = "firmware"; -- cgit v1.2.3 From eaaec18f7a189dd5a46cb47b23366301b75ca13c Mon Sep 17 00:00:00 2001 From: Suhaas Joshi Date: Tue, 27 Jan 2026 13:46:47 +0530 Subject: arm: dts: k3-am62p-binman: Configure firewall for ATF/OPTEE Add firewall configurations to protect ATF and OP-TEE memory regions from non-secure reads and writes in AM62P. Signed-off-by: Suhaas Joshi --- arch/arm/dts/k3-am62p-sk-binman.dtsi | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/arch/arm/dts/k3-am62p-sk-binman.dtsi b/arch/arm/dts/k3-am62p-sk-binman.dtsi index e1443d6226b..603487341d2 100644 --- a/arch/arm/dts/k3-am62p-sk-binman.dtsi +++ b/arch/arm/dts/k3-am62p-sk-binman.dtsi @@ -217,6 +217,38 @@ fit { images { + atf { + ti-secure { + auth-in-place = <0xa02>; + + firewall-1-0 { + insert-template = <&firewall_bg_3>; + id = <1>; + region = <0>; + }; + + firewall-1-1 { + insert-template = <&firewall_armv8_atf_fg>; + id = <1>; + region = <1>; + }; + + }; + }; + + tee { + ti-secure { + auth-in-place = <0xa02>; + + firewall-1-2 { + insert-template = <&firewall_armv8_optee_fg>; + id = <1>; + region = <2>; + }; + + }; + }; + tifsstub-hs { description = "TIFSSTUB"; type = "firmware"; -- cgit v1.2.3 From 0c3a6f748c90b88ad9af5c937f2c967cd0d6878a Mon Sep 17 00:00:00 2001 From: Suhaas Joshi Date: Tue, 27 Jan 2026 13:46:48 +0530 Subject: arm: dts: k3-am62p5-verdin-binman: Configure firewall for ATF/OPTEE Add firewall configurations to protect ATF and OP-TEE memory regions from non-secure read's and write's in Verdin AM62P board. Signed-off-by: Suhaas Joshi --- arch/arm/dts/k3-am62p5-verdin-wifi-dev-binman.dtsi | 32 ++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/arch/arm/dts/k3-am62p5-verdin-wifi-dev-binman.dtsi b/arch/arm/dts/k3-am62p5-verdin-wifi-dev-binman.dtsi index 57ce3c0b41c..b46e871ef8a 100644 --- a/arch/arm/dts/k3-am62p5-verdin-wifi-dev-binman.dtsi +++ b/arch/arm/dts/k3-am62p5-verdin-wifi-dev-binman.dtsi @@ -159,6 +159,38 @@ fit { images { + atf { + ti-secure { + auth-in-place = <0xa02>; + + firewall-1-0 { + insert-template = <&firewall_bg_3>; + id = <1>; + region = <0>; + }; + + firewall-1-1 { + insert-template = <&firewall_armv8_atf_fg>; + id = <1>; + region = <1>; + }; + + }; + }; + + tee { + ti-secure { + auth-in-place = <0xa02>; + + firewall-1-2 { + insert-template = <&firewall_armv8_optee_fg>; + id = <1>; + region = <2>; + }; + + }; + }; + tifsstub-hs { description = "TIFSSTUB"; type = "firmware"; -- cgit v1.2.3 From cb238a6b66ac0f6fe9b1e01d30224c30880ad8c0 Mon Sep 17 00:00:00 2001 From: Suhaas Joshi Date: Tue, 27 Jan 2026 13:46:49 +0530 Subject: arm: dts: k3-am62a-binman: Configure firewall for ATF/OPTEE Add firewall configurations to protect ATF and OP-TEE memory regions from non-secure reads and writes in AM62A. Signed-off-by: Suhaas Joshi --- arch/arm/dts/k3-am62a-sk-binman.dtsi | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/arch/arm/dts/k3-am62a-sk-binman.dtsi b/arch/arm/dts/k3-am62a-sk-binman.dtsi index cb9a56b8c37..49c90f5855c 100644 --- a/arch/arm/dts/k3-am62a-sk-binman.dtsi +++ b/arch/arm/dts/k3-am62a-sk-binman.dtsi @@ -200,6 +200,36 @@ fit { images { + atf { + ti-secure { + auth-in-place = <0xa02>; + + firewall-1-0 { + insert-template = <&firewall_bg_3>; + id = <1>; + region = <0>; + }; + + firewall-1-1 { + insert-template = <&firewall_armv8_atf_fg>; + id = <1>; + region = <1>; + }; + }; + }; + + tee { + ti-secure { + auth-in-place = <0xa02>; + + firewall-1-2 { + insert-template = <&firewall_armv8_optee_fg>; + id = <1>; + region = <2>; + }; + }; + }; + tifsstub-hs { description = "TIFSSTUB"; type = "firmware"; -- cgit v1.2.3 From 3c6c2f3f5c228a869ec9d342852e201a7a662968 Mon Sep 17 00:00:00 2001 From: Suhaas Joshi Date: Tue, 27 Jan 2026 13:46:50 +0530 Subject: arm: dts: k3-am62a-phycore-binman: Configure firewall for ATF/OPTEE Add firewall configurations to protect ATF and OP-TEE memory regions from non-secure read's and write's in Phycore AM62A SOM. Signed-off-by: Suhaas Joshi --- arch/arm/dts/k3-am62a-phycore-som-binman.dtsi | 30 +++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/arch/arm/dts/k3-am62a-phycore-som-binman.dtsi b/arch/arm/dts/k3-am62a-phycore-som-binman.dtsi index a284226320c..6f82a40908f 100644 --- a/arch/arm/dts/k3-am62a-phycore-som-binman.dtsi +++ b/arch/arm/dts/k3-am62a-phycore-som-binman.dtsi @@ -165,6 +165,36 @@ fit { images { + atf { + ti-secure { + auth-in-place = <0xa02>; + + firewall-1-0 { + insert-template = <&firewall_bg_3>; + id = <1>; + region = <0>; + }; + + firewall-1-1 { + insert-template = <&firewall_armv8_atf_fg>; + id = <1>; + region = <1>; + }; + }; + }; + + tee { + ti-secure { + auth-in-place = <0xa02>; + + firewall-1-2 { + insert-template = <&firewall_armv8_optee_fg>; + id = <1>; + region = <2>; + }; + }; + }; + tifsstub-hs { description = "TIFSSTUB"; type = "firmware"; -- cgit v1.2.3 From 31d5d1b378b204f2743e317c44496a3869d0a83c Mon Sep 17 00:00:00 2001 From: Suhaas Joshi Date: Tue, 27 Jan 2026 13:46:51 +0530 Subject: arm: dts: k3-am64x-binman: Configure firewall for ATF/OPTEE Add firewall configurations to protect ATF and OP-TEE memory regions from non-secure reads and writes in AM64x. Signed-off-by: Suhaas Joshi --- arch/arm/dts/k3-am64x-binman.dtsi | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/arch/arm/dts/k3-am64x-binman.dtsi b/arch/arm/dts/k3-am64x-binman.dtsi index 32e47a3f688..f3c7f2c939d 100644 --- a/arch/arm/dts/k3-am64x-binman.dtsi +++ b/arch/arm/dts/k3-am64x-binman.dtsi @@ -139,6 +139,37 @@ #address-cells = <1>; images { + atf { + ti-secure { + auth-in-place = <0xa02>; + + firewall-24-5 { + insert-template = <&firewall_armv8_atf_fg>; + id = <24>; + region = <5>; + }; + }; + }; + + tee { + ti-secure { + auth-in-place = <0xa02>; + + firewall-1-0 { + insert-template = <&firewall_bg_3>; + id = <1>; + region = <0>; + }; + + + firewall-1-1 { + insert-template = <&firewall_armv8_optee_fg>; + id = <1>; + region = <1>; + }; + }; + }; + dm { blob-ext { filename = "/dev/null"; -- cgit v1.2.3 From 64daef1ada4e29a4fe6975bd7ad2f9f128cefe04 Mon Sep 17 00:00:00 2001 From: Suhaas Joshi Date: Tue, 27 Jan 2026 13:46:52 +0530 Subject: arm: dts: k3-am642-phycore-binman: Configure firewall for ATF/OPTEE Add firewall configurations to protect ATF and OP-TEE memory regions from non-secure read's and write's in Phycore AM64 SOM. Signed-off-by: Suhaas Joshi --- arch/arm/dts/k3-am642-phycore-som-binman.dtsi | 31 +++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/arch/arm/dts/k3-am642-phycore-som-binman.dtsi b/arch/arm/dts/k3-am642-phycore-som-binman.dtsi index 966905bd64d..07cb79fd04a 100644 --- a/arch/arm/dts/k3-am642-phycore-som-binman.dtsi +++ b/arch/arm/dts/k3-am642-phycore-som-binman.dtsi @@ -141,6 +141,37 @@ #address-cells = <1>; images { + atf { + ti-secure { + auth-in-place = <0xa02>; + + firewall-24-5 { + insert-template = <&firewall_armv8_atf_fg>; + id = <24>; + region = <5>; + }; + }; + }; + + tee { + ti-secure { + auth-in-place = <0xa02>; + + firewall-1-0 { + insert-template = <&firewall_bg_3>; + id = <1>; + region = <0>; + }; + + + firewall-1-1 { + insert-template = <&firewall_armv8_optee_fg>; + id = <1>; + region = <1>; + }; + }; + }; + dm { blob-ext { filename = "/dev/null"; -- cgit v1.2.3