From: Alexandre TORGUE <alexandre.torgue@foss.st.com>
To: Rob Herring <robh+dt@kernel.org>
Cc: Gatien Chevallier <gatien.chevallier@foss.st.com>,
<Oleksii_Moisieiev@epam.com>, <gregkh@linuxfoundation.org>,
<herbert@gondor.apana.org.au>, <davem@davemloft.net>,
<krzysztof.kozlowski+dt@linaro.org>, <conor+dt@kernel.org>,
<vkoul@kernel.org>, <jic23@kernel.org>,
<olivier.moysan@foss.st.com>, <arnaud.pouliquen@foss.st.com>,
<mchehab@kernel.org>, <fabrice.gasnier@foss.st.com>,
<andi.shyti@kernel.org>, <ulf.hansson@linaro.org>,
<edumazet@google.com>, <kuba@kernel.org>, <pabeni@redhat.com>,
<hugues.fruchet@foss.st.com>, <lee@kernel.org>, <will@kernel.org>,
<catalin.marinas@arm.com>, <arnd@kernel.org>,
<richardcochran@gmail.com>, Frank Rowand <frowand.list@gmail.com>,
<peng.fan@oss.nxp.com>, <lars@metafoo.de>, <rcsekar@samsung.com>,
<wg@grandegger.com>, <mkl@pengutronix.de>,
<linux-crypto@vger.kernel.org>, <devicetree@vger.kernel.org>,
<linux-stm32@st-md-mailman.stormreply.com>,
<linux-arm-kernel@lists.infradead.org>,
<linux-kernel@vger.kernel.org>, <dmaengine@vger.kernel.org>,
<linux-i2c@vger.kernel.org>, <linux-iio@vger.kernel.org>,
<alsa-devel@alsa-project.org>, <linux-media@vger.kernel.org>,
<linux-mmc@vger.kernel.org>, <netdev@vger.kernel.org>,
<linux-phy@lists.infradead.org>, <linux-serial@vger.kernel.org>,
<linux-spi@vger.kernel.org>, <linux-usb@vger.kernel.org>
Subject: Re: [PATCH v9 00/13] Introduce STM32 Firewall framework
Date: Thu, 11 Apr 2024 11:37:24 +0200 [thread overview]
Message-ID: <ee47d2e8-763f-4451-b9f3-b46ded4c1b97@foss.st.com> (raw)
In-Reply-To: <CAL_JsqJTiBK3qzdMzL-ZuARosKGqnf_PjyCj13_H=V415y9sHQ@mail.gmail.com>
Hi Rob
On 4/9/24 19:13, Rob Herring wrote:
> On Mon, Apr 8, 2024 at 3:44 AM Alexandre TORGUE
> <alexandre.torgue@foss.st.com> wrote:
>>
>> Hi Gatien,
>>
>> On 1/5/24 14:03, Gatien Chevallier wrote:
>>> Introduce STM32 Firewall framework for STM32MP1x and STM32MP2x
>>> platforms. STM32MP1x(ETZPC) and STM32MP2x(RIFSC) Firewall controllers
>>> register to the framework to offer firewall services such as access
>>> granting.
>>>
>>> This series of patches is a new approach on the previous STM32 system
>>> bus, history is available here:
>>> https://lore.kernel.org/lkml/20230127164040.1047583/
>>>
>>> The need for such framework arises from the fact that there are now
>>> multiple hardware firewalls implemented across multiple products.
>>> Drivers are shared between different products, using the same code.
>>> When it comes to firewalls, the purpose mostly stays the same: Protect
>>> hardware resources. But the implementation differs, and there are
>>> multiple types of firewalls: peripheral, memory, ...
>>>
>>> Some hardware firewall controllers such as the RIFSC implemented on
>>> STM32MP2x platforms may require to take ownership of a resource before
>>> being able to use it, hence the requirement for firewall services to
>>> take/release the ownership of such resources.
>>>
>>> On the other hand, hardware firewall configurations are becoming
>>> more and more complex. These mecanisms prevent platform crashes
>>> or other firewall-related incoveniences by denying access to some
>>> resources.
>>>
>>> The stm32 firewall framework offers an API that is defined in
>>> firewall controllers drivers to best fit the specificity of each
>>> firewall.
>>>
>>> For every peripherals protected by either the ETZPC or the RIFSC, the
>>> firewall framework checks the firewall controlelr registers to see if
>>> the peripheral's access is granted to the Linux kernel. If not, the
>>> peripheral is configured as secure, the node is marked populated,
>>> so that the driver is not probed for that device.
>>>
>>> The firewall framework relies on the access-controller device tree
>>> binding. It is used by peripherals to reference a domain access
>>> controller. In this case a firewall controller. The bus uses the ID
>>> referenced by the access-controller property to know where to look
>>> in the firewall to get the security configuration for the peripheral.
>>> This allows a device tree description rather than a hardcoded peripheral
>>> table in the bus driver.
>>>
>>> The STM32 ETZPC device is responsible for filtering accesses based on
>>> security level, or co-processor isolation for any resource connected
>>> to it.
>>>
>>> The RIFSC is responsible for filtering accesses based on Compartment
>>> ID / security level / privilege level for any resource connected to
>>> it.
>>>
>>> STM32MP13/15/25 SoC device tree files are updated in this series to
>>> implement this mecanism.
>>>
>>
>> ...
>>
>> After minor cosmetic fixes, series applied on stm32-next.
>> Seen with Arnd: it will be part on my next PR and will come through
>> arm-soc tree.
>
> And there's some new warnings in next with it:
>
> 1 venc@480e0000: 'access-controllers' does not match any of the
> regexes: 'pinctrl-[0-9]+'
> 1 vdec@480d0000: 'access-controllers' does not match any of the
> regexes: 'pinctrl-[0-9]+'
Yes I noticed it to my colleague. YAML update has been sent for VEND/VDENC.
https://lore.kernel.org/lkml/171276671618.403884.13818480350194550959.robh@kernel.org/T/
As soon as it is acked I could merge it in my tree.
Alex
>
> Rob
prev parent reply other threads:[~2024-04-11 9:39 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-05 13:03 [PATCH v9 00/13] Introduce STM32 Firewall framework Gatien Chevallier
2024-01-05 13:03 ` [PATCH v9 01/13] dt-bindings: document generic access controllers Gatien Chevallier
2024-01-05 13:03 ` [PATCH v9 02/13] dt-bindings: treewide: add access-controllers description Gatien Chevallier
2024-01-19 22:06 ` Rob Herring
2024-01-05 13:03 ` [PATCH v9 03/13] dt-bindings: bus: document RIFSC Gatien Chevallier
2024-01-05 13:03 ` [PATCH v9 04/13] dt-bindings: bus: document ETZPC Gatien Chevallier
2024-01-05 13:03 ` [PATCH v9 05/13] firewall: introduce stm32_firewall framework Gatien Chevallier
2024-01-05 13:03 ` [PATCH v9 06/13] of: property: fw_devlink: Add support for "access-controller" Gatien Chevallier
2024-04-24 5:57 ` Saravana Kannan
2024-04-24 12:19 ` Alexandre TORGUE
2024-01-05 13:03 ` [PATCH v9 07/13] bus: rifsc: introduce RIFSC firewall controller driver Gatien Chevallier
2024-01-05 13:03 ` [PATCH v9 08/13] arm64: dts: st: add RIFSC as an access controller for STM32MP25x boards Gatien Chevallier
2024-01-05 13:04 ` [PATCH v9 09/13] bus: etzpc: introduce ETZPC firewall controller driver Gatien Chevallier
2024-01-05 13:04 ` [PATCH v9 10/13] ARM: dts: stm32: add ETZPC as a system bus for STM32MP15x boards Gatien Chevallier
2024-01-05 13:04 ` [PATCH v9 11/13] ARM: dts: stm32: put ETZPC as an access controller " Gatien Chevallier
2024-01-05 13:04 ` [PATCH v9 12/13] ARM: dts: stm32: add ETZPC as a system bus for STM32MP13x boards Gatien Chevallier
2024-01-05 13:04 ` [PATCH v9 13/13] ARM: dts: stm32: put ETZPC as an access controller " Gatien Chevallier
2024-04-08 8:42 ` [PATCH v9 00/13] Introduce STM32 Firewall framework Alexandre TORGUE
2024-04-09 17:13 ` Rob Herring
2024-04-11 9:37 ` Alexandre TORGUE [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ee47d2e8-763f-4451-b9f3-b46ded4c1b97@foss.st.com \
--to=alexandre.torgue@foss.st.com \
--cc=Oleksii_Moisieiev@epam.com \
--cc=alsa-devel@alsa-project.org \
--cc=andi.shyti@kernel.org \
--cc=arnaud.pouliquen@foss.st.com \
--cc=arnd@kernel.org \
--cc=catalin.marinas@arm.com \
--cc=conor+dt@kernel.org \
--cc=davem@davemloft.net \
--cc=devicetree@vger.kernel.org \
--cc=dmaengine@vger.kernel.org \
--cc=edumazet@google.com \
--cc=fabrice.gasnier@foss.st.com \
--cc=frowand.list@gmail.com \
--cc=gatien.chevallier@foss.st.com \
--cc=gregkh@linuxfoundation.org \
--cc=herbert@gondor.apana.org.au \
--cc=hugues.fruchet@foss.st.com \
--cc=jic23@kernel.org \
--cc=krzysztof.kozlowski+dt@linaro.org \
--cc=kuba@kernel.org \
--cc=lars@metafoo.de \
--cc=lee@kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-i2c@vger.kernel.org \
--cc=linux-iio@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=linux-mmc@vger.kernel.org \
--cc=linux-phy@lists.infradead.org \
--cc=linux-serial@vger.kernel.org \
--cc=linux-spi@vger.kernel.org \
--cc=linux-stm32@st-md-mailman.stormreply.com \
--cc=linux-usb@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=mkl@pengutronix.de \
--cc=netdev@vger.kernel.org \
--cc=olivier.moysan@foss.st.com \
--cc=pabeni@redhat.com \
--cc=peng.fan@oss.nxp.com \
--cc=rcsekar@samsung.com \
--cc=richardcochran@gmail.com \
--cc=robh+dt@kernel.org \
--cc=ulf.hansson@linaro.org \
--cc=vkoul@kernel.org \
--cc=wg@grandegger.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).