From: Gatien CHEVALLIER <gatien.chevallier@foss.st.com>
To: <Oleksii_Moisieiev@epam.com>, <gregkh@linuxfoundation.org>,
<herbert@gondor.apana.org.au>, <davem@davemloft.net>,
<robh+dt@kernel.org>, <krzysztof.kozlowski+dt@linaro.org>,
<conor+dt@kernel.org>, <alexandre.torgue@foss.st.com>,
<vkoul@kernel.org>, <jic23@kernel.org>,
<olivier.moysan@foss.st.com>, <arnaud.pouliquen@foss.st.com>,
<mchehab@kernel.org>, <fabrice.gasnier@foss.st.com>,
<andi.shyti@kernel.org>, <ulf.hansson@linaro.org>,
<edumazet@google.com>, <kuba@kernel.org>, <pabeni@redhat.com>,
<hugues.fruchet@foss.st.com>, <lee@kernel.org>, <will@kernel.org>,
<catalin.marinas@arm.com>, <arnd@kernel.org>,
<richardcochran@gmail.com>, Frank Rowand <frowand.list@gmail.com>,
<peng.fan@oss.nxp.com>, <lars@metafoo.de>, <rcsekar@samsung.com>,
<wg@grandegger.com>, <mkl@pengutronix.de>
Cc: <linux-crypto@vger.kernel.org>, <devicetree@vger.kernel.org>,
<linux-stm32@st-md-mailman.stormreply.com>,
<linux-arm-kernel@lists.infradead.org>,
<linux-kernel@vger.kernel.org>, <dmaengine@vger.kernel.org>,
<linux-i2c@vger.kernel.org>, <linux-iio@vger.kernel.org>,
<alsa-devel@alsa-project.org>, <linux-media@vger.kernel.org>,
<linux-mmc@vger.kernel.org>, <netdev@vger.kernel.org>,
<linux-phy@lists.infradead.org>, <linux-serial@vger.kernel.org>,
<linux-spi@vger.kernel.org>, <linux-usb@vger.kernel.org>
Subject: Re: [PATCH v7 00/13] Introduce STM32 Firewall framework
Date: Mon, 11 Dec 2023 19:48:02 +0100 [thread overview]
Message-ID: <719399bd-273d-40b5-b512-59a2e09ddbf8@foss.st.com> (raw)
In-Reply-To: <20231211183044.808204-1-gatien.chevallier@foss.st.com>
Hi,
I messed up when squashing.
I did not restore the ETZPC/RIFSC "simple-bus" compatible for stm32mp15
and stm32mp25 SoC device trees.
I apologize for this inconvenience and will resend the patchset with
this compatible correctly restored.
Best regards,
Gatien
On 12/11/23 19:30, Gatien Chevallier wrote:
> Introduce STM32 Firewall framework for STM32MP1x and STM32MP2x
> platforms. STM32MP1x(ETZPC) and STM32MP2x(RIFSC) Firewall controllers
> register to the framework to offer firewall services such as access
> granting.
>
> This series of patches is a new approach on the previous STM32 system
> bus, history is available here:
> https://lore.kernel.org/lkml/20230127164040.1047583/
>
> The need for such framework arises from the fact that there are now
> multiple hardware firewalls implemented across multiple products.
> Drivers are shared between different products, using the same code.
> When it comes to firewalls, the purpose mostly stays the same: Protect
> hardware resources. But the implementation differs, and there are
> multiple types of firewalls: peripheral, memory, ...
>
> Some hardware firewall controllers such as the RIFSC implemented on
> STM32MP2x platforms may require to take ownership of a resource before
> being able to use it, hence the requirement for firewall services to
> take/release the ownership of such resources.
>
> On the other hand, hardware firewall configurations are becoming
> more and more complex. These mecanisms prevent platform crashes
> or other firewall-related incoveniences by denying access to some
> resources.
>
> The stm32 firewall framework offers an API that is defined in
> firewall controllers drivers to best fit the specificity of each
> firewall.
>
> For every peripherals protected by either the ETZPC or the RIFSC, the
> firewall framework checks the firewall controlelr registers to see if
> the peripheral's access is granted to the Linux kernel. If not, the
> peripheral is configured as secure, the node is marked populated,
> so that the driver is not probed for that device.
>
> The firewall framework relies on the access-controller device tree
> binding. It is used by peripherals to reference a domain access
> controller. In this case a firewall controller. The bus uses the ID
> referenced by the access-controller property to know where to look
> in the firewall to get the security configuration for the peripheral.
> This allows a device tree description rather than a hardcoded peripheral
> table in the bus driver.
>
> The STM32 ETZPC device is responsible for filtering accesses based on
> security level, or co-processor isolation for any resource connected
> to it.
>
> The RIFSC is responsible for filtering accesses based on Compartment
> ID / security level / privilege level for any resource connected to
> it.
>
> STM32MP13/15/25 SoC device tree files are updated in this series to
> implement this mecanism.
>
> Changes in V7:
> - Separate indentation changes from access-controllers changes
> in the device tree file commits
> - Select OF_DYNAMIC when STM32_FIREWALL is set in order to use
> of_detach_node() in the firewall framework
> - Handle previously non-present RNG and HASH nodes in the
> STM32MP13 device tree file
>
> Changes in V6:
> - Rename access-controller to access-controllers
> - Remove access-controller-provider
> - Update device trees and other bindings accordingly
> - Rework ETZPC/RIFSC bindings to define what access-controllers
> cells contain inside #access-controller-cells
> - Some other minor fixes
>
> Changes in V5:
> - Integrate and rework the "feature-domains" binding patch in
> this patchset. The binding is renamed to "access-controller"
> - Rename every feature-domain* reference to access-control*
> ones
> - Correct loop bug and missing select STM32_FIREWALL in 32-bit
> platform Kconfig
>
>
> Changes in V4:
> - Fix typo in commit message and YAML check errors in
> "dt-bindings: Document common device controller bindings"
> Note: This patch should be ignored as stated in the cover
> letter. I've done this to avoid errors on this series of
> patch
> - Correct code syntax/style issues reported by Simon Horman
> - Added Jonathan's tag for IIO on the treewide patch
>
> Changes in V3:
>
> Change incorrect ordering for bindings commits leading
> to an error while running
> "make DT_CHECKER_FLAGS=-m dt_binding_check"
>
> Changes in V2:
>
> generic:
> - Add fw_devlink dependency for "feature-domains"
> property.
>
> bindings:
> - Corrected YAMLS errors highlighted by Rob's robot
> - Firewall controllers YAMLs no longer define the
> maxItems for the "feature-domains" property
> - Renamed st,stm32-rifsc.yaml to
> st,stm32mp25-rifsc.yaml
> - Fix examples in YAML files
> - Change feature-domains maxItems to 2 in firewall
> consumer files as there should not be more than
> 2 entries for now
> - Declare "feature-domain-names" as an optional
> property for firewall controllers child nodes.
> - Add missing "feature-domains" property declaration
> in bosch,m_can.yaml and st,stm32-cryp.yaml files
>
> firewall framework:
> - Support multiple entries for "feature-domains"
> property
> - Better handle the device-tree parsing using
> phandle+args APIs
> - Remove "resource firewall" type
> - Add a field for the name of the firewall entry
> - Fix licenses
>
> RIFSC:
> - Add controller name
> - Driver is now a module_platform_driver
> - Fix license
>
> ETZPC:
> - Add controller name
> - Driver is now a module_platform_driver
> - Fix license
>
> Device trees:
> - Fix rifsc node name
> - Move the "ranges" property under the
> "feature-domains" one
>
> Gatien Chevallier (12):
> dt-bindings: treewide: add access-controllers description
> dt-bindings: bus: document RIFSC
> dt-bindings: bus: document ETZPC
> firewall: introduce stm32_firewall framework
> of: property: fw_devlink: Add support for "access-controller"
> bus: rifsc: introduce RIFSC firewall controller driver
> arm64: dts: st: add RIFSC as an access controller for STM32MP25x
> boards
> bus: etzpc: introduce ETZPC firewall controller driver
> ARM: dts: stm32: add ETZPC as a system bus for STM32MP15x boards
> ARM: dts: stm32: put ETZPC as an access controller for STM32MP15x
> boards
> ARM: dts: stm32: add ETZPC as a system bus for STM32MP13x boards
> ARM: dts: stm32: put ETZPC as an access controller for STM32MP13x
> boards
>
> Oleksii Moisieiev (1):
> dt-bindings: document generic access controllers
>
> .../access-controllers.yaml | 84 +
> .../bindings/bus/st,stm32-etzpc.yaml | 87 +
> .../bindings/bus/st,stm32mp25-rifsc.yaml | 96 +
> .../bindings/crypto/st,stm32-cryp.yaml | 4 +
> .../bindings/crypto/st,stm32-hash.yaml | 4 +
> .../devicetree/bindings/dma/st,stm32-dma.yaml | 4 +
> .../bindings/dma/st,stm32-dmamux.yaml | 4 +
> .../devicetree/bindings/i2c/st,stm32-i2c.yaml | 4 +
> .../bindings/iio/adc/st,stm32-adc.yaml | 4 +
> .../bindings/iio/adc/st,stm32-dfsdm-adc.yaml | 4 +
> .../bindings/iio/dac/st,stm32-dac.yaml | 4 +
> .../bindings/media/cec/st,stm32-cec.yaml | 4 +
> .../bindings/media/st,stm32-dcmi.yaml | 4 +
> .../memory-controllers/st,stm32-fmc2-ebi.yaml | 4 +
> .../bindings/mfd/st,stm32-lptimer.yaml | 4 +
> .../bindings/mfd/st,stm32-timers.yaml | 4 +
> .../devicetree/bindings/mmc/arm,pl18x.yaml | 4 +
> .../bindings/net/can/bosch,m_can.yaml | 4 +
> .../devicetree/bindings/net/stm32-dwmac.yaml | 4 +
> .../bindings/phy/phy-stm32-usbphyc.yaml | 4 +
> .../bindings/regulator/st,stm32-vrefbuf.yaml | 4 +
> .../devicetree/bindings/rng/st,stm32-rng.yaml | 4 +
> .../bindings/serial/st,stm32-uart.yaml | 4 +
> .../bindings/sound/st,stm32-i2s.yaml | 4 +
> .../bindings/sound/st,stm32-sai.yaml | 4 +
> .../bindings/sound/st,stm32-spdifrx.yaml | 4 +
> .../bindings/spi/st,stm32-qspi.yaml | 4 +
> .../devicetree/bindings/spi/st,stm32-spi.yaml | 4 +
> .../devicetree/bindings/usb/dwc2.yaml | 4 +
> MAINTAINERS | 7 +
> arch/arm/boot/dts/st/stm32mp131.dtsi | 1063 ++++---
> arch/arm/boot/dts/st/stm32mp133.dtsi | 51 +-
> arch/arm/boot/dts/st/stm32mp13xc.dtsi | 19 +-
> arch/arm/boot/dts/st/stm32mp13xf.dtsi | 19 +-
> arch/arm/boot/dts/st/stm32mp151.dtsi | 2756 +++++++++--------
> arch/arm/boot/dts/st/stm32mp153.dtsi | 52 +-
> arch/arm/boot/dts/st/stm32mp15xc.dtsi | 19 +-
> arch/arm/mach-stm32/Kconfig | 1 +
> arch/arm64/Kconfig.platforms | 1 +
> arch/arm64/boot/dts/st/stm32mp251.dtsi | 6 +-
> drivers/bus/Kconfig | 10 +
> drivers/bus/Makefile | 1 +
> drivers/bus/stm32_etzpc.c | 141 +
> drivers/bus/stm32_firewall.c | 294 ++
> drivers/bus/stm32_firewall.h | 83 +
> drivers/bus/stm32_rifsc.c | 252 ++
> drivers/of/property.c | 2 +
> include/linux/bus/stm32_firewall_device.h | 141 +
> 48 files changed, 3351 insertions(+), 1938 deletions(-)
> create mode 100644 Documentation/devicetree/bindings/access-controllers/access-controllers.yaml
> create mode 100644 Documentation/devicetree/bindings/bus/st,stm32-etzpc.yaml
> create mode 100644 Documentation/devicetree/bindings/bus/st,stm32mp25-rifsc.yaml
> create mode 100644 drivers/bus/stm32_etzpc.c
> create mode 100644 drivers/bus/stm32_firewall.c
> create mode 100644 drivers/bus/stm32_firewall.h
> create mode 100644 drivers/bus/stm32_rifsc.c
> create mode 100644 include/linux/bus/stm32_firewall_device.h
>
--
linux-phy mailing list
linux-phy@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/linux-phy
prev parent reply other threads:[~2023-12-11 18:48 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-11 18:30 [PATCH v7 00/13] Introduce STM32 Firewall framework Gatien Chevallier
2023-12-11 18:30 ` [PATCH v7 01/13] dt-bindings: document generic access controllers Gatien Chevallier
2023-12-11 18:30 ` [PATCH v7 02/13] dt-bindings: treewide: add access-controllers description Gatien Chevallier
2023-12-11 18:30 ` [PATCH v7 03/13] dt-bindings: bus: document RIFSC Gatien Chevallier
2023-12-11 18:30 ` [PATCH v7 04/13] dt-bindings: bus: document ETZPC Gatien Chevallier
2023-12-11 18:30 ` [PATCH v7 05/13] firewall: introduce stm32_firewall framework Gatien Chevallier
2023-12-11 18:30 ` [PATCH v7 06/13] of: property: fw_devlink: Add support for "access-controller" Gatien Chevallier
2023-12-11 18:30 ` [PATCH v7 07/13] bus: rifsc: introduce RIFSC firewall controller driver Gatien Chevallier
2023-12-11 18:30 ` [PATCH v7 08/13] arm64: dts: st: add RIFSC as an access controller for STM32MP25x boards Gatien Chevallier
2023-12-11 18:30 ` [PATCH v7 09/13] bus: etzpc: introduce ETZPC firewall controller driver Gatien Chevallier
2023-12-11 18:30 ` [PATCH v7 10/13] ARM: dts: stm32: add ETZPC as a system bus for STM32MP15x boards Gatien Chevallier
2023-12-11 18:30 ` [PATCH v7 11/13] ARM: dts: stm32: put ETZPC as an access controller " Gatien Chevallier
2023-12-11 18:30 ` [PATCH v7 12/13] ARM: dts: stm32: add ETZPC as a system bus for STM32MP13x boards Gatien Chevallier
2023-12-11 18:30 ` [PATCH v7 13/13] ARM: dts: stm32: put ETZPC as an access controller " Gatien Chevallier
2023-12-11 18:48 ` Gatien CHEVALLIER [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=719399bd-273d-40b5-b512-59a2e09ddbf8@foss.st.com \
--to=gatien.chevallier@foss.st.com \
--cc=Oleksii_Moisieiev@epam.com \
--cc=alexandre.torgue@foss.st.com \
--cc=alsa-devel@alsa-project.org \
--cc=andi.shyti@kernel.org \
--cc=arnaud.pouliquen@foss.st.com \
--cc=arnd@kernel.org \
--cc=catalin.marinas@arm.com \
--cc=conor+dt@kernel.org \
--cc=davem@davemloft.net \
--cc=devicetree@vger.kernel.org \
--cc=dmaengine@vger.kernel.org \
--cc=edumazet@google.com \
--cc=fabrice.gasnier@foss.st.com \
--cc=frowand.list@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=herbert@gondor.apana.org.au \
--cc=hugues.fruchet@foss.st.com \
--cc=jic23@kernel.org \
--cc=krzysztof.kozlowski+dt@linaro.org \
--cc=kuba@kernel.org \
--cc=lars@metafoo.de \
--cc=lee@kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-i2c@vger.kernel.org \
--cc=linux-iio@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=linux-mmc@vger.kernel.org \
--cc=linux-phy@lists.infradead.org \
--cc=linux-serial@vger.kernel.org \
--cc=linux-spi@vger.kernel.org \
--cc=linux-stm32@st-md-mailman.stormreply.com \
--cc=linux-usb@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=mkl@pengutronix.de \
--cc=netdev@vger.kernel.org \
--cc=olivier.moysan@foss.st.com \
--cc=pabeni@redhat.com \
--cc=peng.fan@oss.nxp.com \
--cc=rcsekar@samsung.com \
--cc=richardcochran@gmail.com \
--cc=robh+dt@kernel.org \
--cc=ulf.hansson@linaro.org \
--cc=vkoul@kernel.org \
--cc=wg@grandegger.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).