From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-oa1-x33.google.com (mail-oa1-x33.google.com [IPv6:2001:4860:4864:20::33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.bufferbloat.net (Postfix) with ESMTPS id 3F44F3B2A4 for ; Wed, 5 Jul 2023 13:40:34 -0400 (EDT) Received: by mail-oa1-x33.google.com with SMTP id 586e51a60fabf-1b05d63080cso7028090fac.2 for ; Wed, 05 Jul 2023 10:40:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1688578833; x=1691170833; h=content-transfer-encoding:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=O23GMQWz23+Gf6U6K3MTV+aRr8JFzZZeeAWfnBLDudU=; b=scZiWpK1xSPBf/7nnpsuBV1FSBbomrzgV+s1iuPeP4bvdhXIG+0tZh9wGDSiB5086g ifuRW0RbTyBimD6QMtNWbkg68YhGcS4Bth+ZSNz36iT0zXHodXCx6T/UGMRc/idHHrKM hJHoWcd3YMZNySObMJss31x9thKqtRFLOvXWIXQrfml9e7OQjmpB4Q3UASZYblhbXhWq uCjBKaUu02z+3dXIZfMv2itBC9xc+4VDxouVjD4aRcD1aHwqnh6IxmzBKXEHqnVxJ2Ef mQipwhkrykxbMGnAOFJS1WESq/IGsot8nhjk/Hj/pWWJGI4yDXQ6PuQHOIbwC1fV3Nbb ge+Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1688578833; x=1691170833; h=content-transfer-encoding:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=O23GMQWz23+Gf6U6K3MTV+aRr8JFzZZeeAWfnBLDudU=; b=X9PZPVZLSw0EqsJT6Y7XPnrQlBkSKaX5xRH51kLDvlbHohE75ejJTsMPO/qJeWRDqN bnbMyUmZRMAHQ2pkSYNbq914xH1Gy+HQNbdBmu3V0bEiQ6Zolpvz+Nao0jyvxldNKIoj StnIu2c3vZe4lvb8IXLe5r5IgoCxBLnp+C6aTIRSdgK08otFEGYWoGDB/vWYmn9ltVvh EZgBL/Gd8J/L/30WdaQ7/UAnqAN4f9ijOo39kWWHOR+0sSXngP9LA8BziL0N5Yl/G1q9 OGMUMeSQEaaOVNvbV2UKx3nL9QqTIaYj2Aan4x7922EzVcBweixLRxN41oZ4VSAjYiYL 280g== X-Gm-Message-State: ABy/qLZBQrX/6YovtrSG2MTsFs/P21u/LELccmZZRKivL6mjglADbhhl tVKXwrlLiCkhaqZ8ynp5Dq+6nvCxiaBoNnnT14/qFJJSuIg= X-Google-Smtp-Source: APBJJlE2WQYbqJsQ6lgeBGkbCKz0NayothiJhh3HYylhChMLuyY/p32xzSiCnLe+d0MHVbvMOSRYd0FC8YFqd75Qp2Y= X-Received: by 2002:a05:6870:9726:b0:1a6:c968:4a15 with SMTP id n38-20020a056870972600b001a6c9684a15mr20933990oaq.4.1688578832819; Wed, 05 Jul 2023 10:40:32 -0700 (PDT) MIME-Version: 1.0 References: <20230705172759.1610753-1-gatien.chevallier@foss.st.com> In-Reply-To: <20230705172759.1610753-1-gatien.chevallier@foss.st.com> From: Dave Taht Date: Wed, 5 Jul 2023 11:40:20 -0600 Message-ID: To: cerowrt-devel Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Subject: [Cerowrt-devel] Fwd: [PATCH 00/10] Introduce STM32 Firewall framework X-BeenThere: cerowrt-devel@lists.bufferbloat.net X-Mailman-Version: 2.1.20 Precedence: list List-Id: Development issues regarding the cerowrt test router project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Jul 2023 17:40:34 -0000 ---------- Forwarded message --------- From: Gatien Chevallier Date: Wed, Jul 5, 2023 at 11:29=E2=80=AFAM Subject: [PATCH 00/10] Introduce STM32 Firewall framework To: , , , , , , , , , , , , , , , , , , , , , , , , Cc: , , , , , , , , , , , , , , , , Gatien Chevallier Introduce STM32 Firewall framework for STM32MP1x and STM32MP2x platforms. STM32MP1x(ETZPC) and STM32MP2x(RIFSC) Firewall controllers register to the framework to offer firewall services such as access granting. This series of patches is a new approach on the previous STM32 system bus, history is available here: https://lore.kernel.org/lkml/20230127164040.1047583/ The need for such framework arises from the fact that there are now multiple hardware firewalls implemented across multiple products. Drivers are shared between different products, using the same code. When it comes to firewalls, the purpose mostly stays the same: Protect hardware resources. But the implementation differs, and there are multiple types of firewalls: peripheral, memory, ... Some hardware firewall controllers such as the RIFSC implemented on STM32MP2x platforms may require to take ownership of a resource before being able to use it, hence the requirement for firewall services to take/release the ownership of such resources. On the other hand, hardware firewall configurations are becoming more and more complex. These mecanisms prevent platform crashes or other firewall-related incoveniences by denying access to some resources. The stm32 firewall framework offers an API that is defined in firewall controllers drivers to best fit the specificity of each firewall. For every peripherals protected by either the ETZPC or the RIFSC, the firewall framework checks the firewall controlelr registers to see if the peripheral's access is granted to the Linux kernel. If not, the peripheral is configured as secure, the node is marked populated, so that the driver is not probed for that device. The firewall framework relies on the feature-domain-controller device tree bindings: https://lore.kernel.org/lkml/0c0a82bb-18ae-d057-562b. It is used by peripherals to reference a domain controller, in this case a firewall feature domain. The bus uses the ID referenced by the feature-domains property to know where to look in the firewall to get the security configuration for the peripheral. This allows a device tree description rather than a hardcoded peripheral table in the bus driver. The STM32 ETZPC device is responsible for filtering accesses based on security level, or co-processor isolation for any resource connected to it. The RIFSC is responsible for filtering accesses based on Compartment ID / security level / privilege level for any resource connected to it. STM32MP13/15/25 SoC device tree files are updated in this series to implement this mecanism. Oleksii Moisieiev (1): dt-bindings: Document common device controller bindings Gatien Chevallier (9): dt-bindings: bus: add device tree bindings for RIFSC dt-bindings: bus: add device tree bindings for ETZPC dt-bindings: treewide: add feature-domains description in binding files firewall: introduce stm32_firewall framework bus: rifsc: introduce RIFSC firewall controller driver arm64: dts: st: add RIFSC as a domain controller for STM32MP25x boards bus: etzpc: introduce ETZPC firewall controller driver ARM: dts: stm32: add ETZPC as a system bus for STM32MP15x boards ARM: dts: stm32: add ETZPC as a system bus for STM32MP13x boards .../bindings/bus/st,stm32-etzpc.yaml | 90 + .../bindings/bus/st,stm32-rifsc.yaml | 101 + .../bindings/crypto/st,stm32-hash.yaml | 4 + .../devicetree/bindings/dma/st,stm32-dma.yaml | 4 + .../bindings/dma/st,stm32-dmamux.yaml | 4 + .../feature-domain-controller.yaml | 84 + .../devicetree/bindings/i2c/st,stm32-i2c.yaml | 4 + .../bindings/iio/adc/st,stm32-adc.yaml | 4 + .../bindings/iio/adc/st,stm32-dfsdm-adc.yaml | 4 + .../bindings/iio/dac/st,stm32-dac.yaml | 4 + .../bindings/media/cec/st,stm32-cec.yaml | 4 + .../bindings/media/st,stm32-dcmi.yaml | 4 + .../memory-controllers/st,stm32-fmc2-ebi.yaml | 4 + .../bindings/mfd/st,stm32-lptimer.yaml | 4 + .../bindings/mfd/st,stm32-timers.yaml | 5 + .../devicetree/bindings/mmc/arm,pl18x.yaml | 4 + .../devicetree/bindings/net/stm32-dwmac.yaml | 4 + .../bindings/phy/phy-stm32-usbphyc.yaml | 4 + .../bindings/regulator/st,stm32-vrefbuf.yaml | 4 + .../devicetree/bindings/rng/st,stm32-rng.yaml | 4 + .../bindings/serial/st,stm32-uart.yaml | 4 + .../bindings/sound/st,stm32-i2s.yaml | 4 + .../bindings/sound/st,stm32-sai.yaml | 4 + .../bindings/sound/st,stm32-spdifrx.yaml | 4 + .../bindings/spi/st,stm32-qspi.yaml | 4 + .../devicetree/bindings/spi/st,stm32-spi.yaml | 4 + .../devicetree/bindings/usb/dwc2.yaml | 4 + MAINTAINERS | 7 + arch/arm/boot/dts/st/stm32mp131.dtsi | 1027 +++--- arch/arm/boot/dts/st/stm32mp133.dtsi | 51 +- arch/arm/boot/dts/st/stm32mp13xc.dtsi | 19 +- arch/arm/boot/dts/st/stm32mp13xf.dtsi | 19 +- arch/arm/boot/dts/st/stm32mp151.dtsi | 2757 +++++++++-------- arch/arm/boot/dts/st/stm32mp153.dtsi | 52 +- arch/arm/boot/dts/st/stm32mp15xc.dtsi | 19 +- arch/arm64/Kconfig.platforms | 1 + arch/arm64/boot/dts/st/stm32mp251.dtsi | 5 +- drivers/bus/Kconfig | 10 + drivers/bus/Makefile | 1 + drivers/bus/stm32_etzpc.c | 137 + drivers/bus/stm32_firewall.c | 252 ++ drivers/bus/stm32_firewall.h | 83 + drivers/bus/stm32_rifsc.c | 248 ++ include/linux/bus/stm32_firewall_device.h | 134 + 44 files changed, 3276 insertions(+), 1918 deletions(-) create mode 100644 Documentation/devicetree/bindings/bus/st,stm32-etzpc.ya= ml create mode 100644 Documentation/devicetree/bindings/bus/st,stm32-rifsc.ya= ml create mode 100644 Documentation/devicetree/bindings/feature-controllers/feature-domain-contro= ller.yaml create mode 100644 drivers/bus/stm32_etzpc.c create mode 100644 drivers/bus/stm32_firewall.c create mode 100644 drivers/bus/stm32_firewall.h create mode 100644 drivers/bus/stm32_rifsc.c create mode 100644 include/linux/bus/stm32_firewall_device.h -- 2.25.1 --=20 Podcast: https://www.linkedin.com/feed/update/urn:li:activity:7058793910227= 111937/ Dave T=C3=A4ht CSO, LibreQos