summaryrefslogtreecommitdiffstats
path: root/meta-ti-bsp
diff options
context:
space:
mode:
authorManorit Chawdhry <m-chawdhry@ti.com>2025-11-29 00:11:25 +0530
committerRyan Eatmon <reatmon@ti.com>2025-12-01 16:12:44 -0600
commitb05876bb9c3c7ac273494e00f76bb90cff8ca17b (patch)
tree76ad5a3b1779420a6f0ca3d68af12825ddb5d51d /meta-ti-bsp
parent7bec7f73c68c467f06860cfe3ba27531194d9894 (diff)
downloadmeta-ti-b05876bb9c3c7ac273494e00f76bb90cff8ca17b.tar.gz
trusted-firmware-a/optee-os: Add LPM support on few platforms
Adds the required TF-A and OP-TEE patches to enable LPM support on J7200, J784s4, J742s2. Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com> Signed-off-by: Ryan Eatmon <reatmon@ti.com>
Diffstat (limited to 'meta-ti-bsp')
-rw-r--r--meta-ti-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-ti.inc13
-rw-r--r--meta-ti-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a/0001-feat-k3-choose-cluster_start_id-depending-on-the-soc.patch115
-rw-r--r--meta-ti-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a/0002-feat-ti-add-message-to-encrypt-tfa-during-suspend.patch194
-rw-r--r--meta-ti-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a/0003-feat-k3-handle-suspend-in-case-of-LPM_BOARDCFG_MANAG.patch68
-rw-r--r--meta-ti-bsp/recipes-security/optee/optee-os-ti-overrides.inc11
-rw-r--r--meta-ti-bsp/recipes-security/optee/optee-os/0001-plat-k3-drivers-Open-TRNG-firewall-for-TIFS-on-all-k.patch45
6 files changed, 446 insertions, 0 deletions
diff --git a/meta-ti-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-ti.inc b/meta-ti-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-ti.inc
index f188f35e..27d69241 100644
--- a/meta-ti-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-ti.inc
+++ b/meta-ti-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-ti.inc
@@ -1,5 +1,7 @@
1# NOTE: This .inc file with customizations only gets included for K3 platforms 1# NOTE: This .inc file with customizations only gets included for K3 platforms
2 2
3FILESEXTRAPATHS:prepend := "${THISDIR}/trusted-firmware-a:"
4
3PV = "2.13+git" 5PV = "2.13+git"
4 6
5LIC_FILES_CHKSUM = "file://docs/license.rst;md5=6ed7bace7b0bc63021c6eba7b524039e" 7LIC_FILES_CHKSUM = "file://docs/license.rst;md5=6ed7bace7b0bc63021c6eba7b524039e"
@@ -28,3 +30,14 @@ EXTRA_OEMAKE += "${@ 'BL32_BASE=' + d.getVar('TFA_K3_BL32_BASE') if d.getVar('TF
28EXTRA_OEMAKE += "${@ 'PRELOADED_BL33_BASE=' + d.getVar('TFA_K3_PRELOADED_BL33') if d.getVar('TFA_K3_PRELOADED_BL33') else ''}" 30EXTRA_OEMAKE += "${@ 'PRELOADED_BL33_BASE=' + d.getVar('TFA_K3_PRELOADED_BL33') if d.getVar('TFA_K3_PRELOADED_BL33') else ''}"
29EXTRA_OEMAKE += "${@ 'K3_PM_SYSTEM_SUSPEND=' + d.getVar('TFA_K3_SYSTEM_SUSPEND') if d.getVar('TFA_K3_SYSTEM_SUSPEND') else ''}" 31EXTRA_OEMAKE += "${@ 'K3_PM_SYSTEM_SUSPEND=' + d.getVar('TFA_K3_SYSTEM_SUSPEND') if d.getVar('TFA_K3_SYSTEM_SUSPEND') else ''}"
30EXTRA_OEMAKE:append:ti-falcon = " PRELOADED_BL33_BASE=0x82000000 K3_HW_CONFIG_BASE=0x88000000" 32EXTRA_OEMAKE:append:ti-falcon = " PRELOADED_BL33_BASE=0x82000000 K3_HW_CONFIG_BASE=0x88000000"
33
34# LPM support patches for Jacinto platforms (J7200, J742S2, J784S4)
35TFA_JACINTO_LPM_PATCHES = " \
36 file://0001-feat-k3-choose-cluster_start_id-depending-on-the-soc.patch \
37 file://0002-feat-ti-add-message-to-encrypt-tfa-during-suspend.patch \
38 file://0003-feat-k3-handle-suspend-in-case-of-LPM_BOARDCFG_MANAG.patch \
39"
40
41SRC_URI:append:j7200 = " ${TFA_JACINTO_LPM_PATCHES}"
42SRC_URI:append:j742s2 = " ${TFA_JACINTO_LPM_PATCHES}"
43SRC_URI:append:j784s4 = " ${TFA_JACINTO_LPM_PATCHES}"
diff --git a/meta-ti-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a/0001-feat-k3-choose-cluster_start_id-depending-on-the-soc.patch b/meta-ti-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a/0001-feat-k3-choose-cluster_start_id-depending-on-the-soc.patch
new file mode 100644
index 00000000..ad3b8fbf
--- /dev/null
+++ b/meta-ti-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a/0001-feat-k3-choose-cluster_start_id-depending-on-the-soc.patch
@@ -0,0 +1,115 @@
1From 3de4f871d9bfe29c3862860e494bfa70ba72af3e Mon Sep 17 00:00:00 2001
2From: Abhash Kumar Jha <a-kumar2@ti.com>
3Date: Mon, 20 Oct 2025 11:26:17 +0530
4Subject: [PATCH 1/3] feat(k3): choose cluster_start_id depending on the soc
5
6The CLUSTER_DEVICE_START_ID denotes the device id of the A-core cluster.
7It is utilized when powering off the entire cluster.
8
9J7200, J721E and J721S2 have a different cluster_start_id than their
10"generic" counterparts.
11
12Query the JTAG_ID register to get the part id and choose the
13cluster_start_id depending on that.
14
15Upstream-Status: Pending
16
17Change-Id: I44d3ac0ec646c39019e4c0167d34f410015a147a
18Signed-off-by: Abhash Kumar Jha <a-kumar2@ti.com>
19---
20 plat/ti/k3/common/k3_bl31_setup.c | 1 +
21 plat/ti/k3/common/k3_psci.c | 25 ++++++++++++++++++++++++-
22 plat/ti/k3/include/platform_def.h | 16 ++++++++++++++++
23 3 files changed, 41 insertions(+), 1 deletion(-)
24
25diff --git a/plat/ti/k3/common/k3_bl31_setup.c b/plat/ti/k3/common/k3_bl31_setup.c
26index 1b93dc860..79a9c924c 100644
27--- a/plat/ti/k3/common/k3_bl31_setup.c
28+++ b/plat/ti/k3/common/k3_bl31_setup.c
29@@ -20,6 +20,7 @@ const mmap_region_t plat_k3_mmap[] = {
30 K3_MAP_REGION_FLAT(SEC_PROXY_RT_BASE, SEC_PROXY_RT_SIZE, MT_DEVICE | MT_RW | MT_SECURE),
31 K3_MAP_REGION_FLAT(SEC_PROXY_SCFG_BASE, SEC_PROXY_SCFG_SIZE, MT_DEVICE | MT_RW | MT_SECURE),
32 K3_MAP_REGION_FLAT(SEC_PROXY_DATA_BASE, SEC_PROXY_DATA_SIZE, MT_DEVICE | MT_RW | MT_SECURE),
33+ K3_MAP_REGION_FLAT(WKUP_CTRL_MMR0_BASE, WKUP_CTRL_MMR0_SIZE, MT_DEVICE | MT_RW | MT_SECURE),
34 { /* sentinel */ }
35 };
36
37diff --git a/plat/ti/k3/common/k3_psci.c b/plat/ti/k3/common/k3_psci.c
38index ec37d9f4c..a443dd851 100644
39--- a/plat/ti/k3/common/k3_psci.c
40+++ b/plat/ti/k3/common/k3_psci.c
41@@ -11,6 +11,8 @@
42 #include <common/debug.h>
43 #include <lib/el3_runtime/cpu_data.h>
44 #include <lib/psci/psci.h>
45+#include <lib/mmio.h>
46+#include <lib/utils_def.h>
47 #include <plat/common/platform.h>
48
49 #include <ti_sci_protocol.h>
50@@ -83,6 +85,27 @@ static int k3_pwr_domain_on(u_register_t mpidr)
51 return PSCI_E_SUCCESS;
52 }
53
54+uint32_t get_plat_cluster_start_id()
55+{
56+ static uint32_t cluster_id;
57+ uint32_t part_id, jtag_id_reg;
58+
59+ if (cluster_id) {
60+ return cluster_id;
61+ }
62+
63+ jtag_id_reg = mmio_read_32(WKUP_CTRL_MMR0_BASE + JTAG_ID);
64+ part_id = EXTRACT(JTAG_PART_ID, jtag_id_reg);
65+
66+ if ((part_id == J7200_PART_ID) || (part_id == J721E_PART_ID) || (part_id == J721S2_PART_ID)) {
67+ cluster_id = J7_PLAT_CLUSTER_DEVICE_START_ID;
68+ } else {
69+ cluster_id = PLAT_CLUSTER_DEVICE_START_ID;
70+ }
71+
72+ return cluster_id;
73+}
74+
75 void k3_pwr_domain_off(const psci_power_state_t *target_state)
76 {
77 int core, cluster, proc_id, device_id, cluster_id, ret;
78@@ -97,7 +120,7 @@ void k3_pwr_domain_off(const psci_power_state_t *target_state)
79 cluster = MPIDR_AFFLVL1_VAL(read_mpidr_el1());
80 proc_id = PLAT_PROC_START_ID + core;
81 device_id = PLAT_PROC_DEVICE_START_ID + core;
82- cluster_id = PLAT_CLUSTER_DEVICE_START_ID + (cluster * 2);
83+ cluster_id = get_plat_cluster_start_id() + (cluster * 2);
84
85 /*
86 * If we are the last core in the cluster then we take a reference to
87diff --git a/plat/ti/k3/include/platform_def.h b/plat/ti/k3/include/platform_def.h
88index db5e31d95..d191781a6 100644
89--- a/plat/ti/k3/include/platform_def.h
90+++ b/plat/ti/k3/include/platform_def.h
91@@ -25,6 +25,22 @@
92 #define SEC_PROXY_RT_SIZE 0x80000
93 #endif /* K3_SEC_PROXY_LITE */
94
95+#define WKUP_CTRL_MMR0_BASE UL(0x43000000)
96+#define WKUP_CTRL_MMR0_SIZE UL(0x20000)
97+#define JTAG_ID U(0x14)
98+#define JTAG_PART_ID_MASK GENMASK(27, 12)
99+
100+#define J721E_PART_ID U(0xBB64)
101+#define J7200_PART_ID U(0xBB6D)
102+#define J721S2_PART_ID U(0xBB75)
103+#define J784S4_J742S2_PART_ID U(0xBB80)
104+
105+#define JTAG_PART_ID_WIDTH U(0x10)
106+#define JTAG_PART_ID_SHIFT U(0xC)
107+
108+/* A-core Cluster Device ID for j721e, j7200 and j721s2 */
109+#define J7_PLAT_CLUSTER_DEVICE_START_ID U(0x4)
110+
111 #define SEC_PROXY_TIMEOUT_US 1000000
112 #define SEC_PROXY_MAX_MESSAGE_SIZE 56
113
114--
1152.34.1
diff --git a/meta-ti-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a/0002-feat-ti-add-message-to-encrypt-tfa-during-suspend.patch b/meta-ti-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a/0002-feat-ti-add-message-to-encrypt-tfa-during-suspend.patch
new file mode 100644
index 00000000..09e69999
--- /dev/null
+++ b/meta-ti-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a/0002-feat-ti-add-message-to-encrypt-tfa-during-suspend.patch
@@ -0,0 +1,194 @@
1From c79ff3679a4360bb848b01d4036c365533fcf791 Mon Sep 17 00:00:00 2001
2From: Richard Genoud <richard.genoud@bootlin.com>
3Date: Tue, 11 Feb 2025 18:20:17 +0100
4Subject: [PATCH 2/3] feat(ti): add message to encrypt tfa during suspend
5
6At suspend, BL31 with its context will be encrypted by TIFS in DDR.
7Encryption is needed for security matters, so that the BL31 is not
8modified before entering suspend or early at resume.
9
10We only need the encryption function here because the decryption message
11will be send by the R5 SPL at resume.
12
13Also introduce the LPM_ENCRYPT_IMAGE cap signals that FW has the support
14to encrypt the image using the TISCI_MSG_LPM_ENCRYPT tisci message.
15
16This is useful in suspend to ram cases where we would like to
17store the encrypted image of a secure fw instead of the original image
18itself in the DDR.
19
20Check for LPM_ENCRYPT_IMAGE flag in the FW capabilities, and only then
21call encrypt.
22
23Upstream-Status: Pending
24
25Change-Id: I266472da87dd0821493019b2d9853f8886f33811
26Signed-off-by: Richard Genoud <richard.genoud@bootlin.com>
27Signed-off-by: Abhash Kumar Jha <a-kumar2@ti.com>
28---
29 drivers/ti/ti_sci/ti_sci.c | 36 +++++++++++++++++++++++++++++
30 drivers/ti/ti_sci/ti_sci.h | 7 ++++++
31 drivers/ti/ti_sci/ti_sci_protocol.h | 32 +++++++++++++++++++++++++
32 plat/ti/k3/common/k3_psci.c | 10 ++++++++
33 4 files changed, 85 insertions(+)
34
35diff --git a/drivers/ti/ti_sci/ti_sci.c b/drivers/ti/ti_sci/ti_sci.c
36index f0813e5b0..ee5f7166f 100644
37--- a/drivers/ti/ti_sci/ti_sci.c
38+++ b/drivers/ti/ti_sci/ti_sci.c
39@@ -1784,3 +1784,39 @@ int ti_sci_lpm_get_next_sys_mode(uint8_t *next_mode)
40
41 return 0;
42 }
43+/*
44+ * ti_sci_encrypt_tfa - Ask TIFS to encrypt TFA at a specific address
45+ *
46+ * @src_tfa_addr: Address where the TFA lies unencrypted
47+ * @src_tfa_len: Size of the TFA unencrypted
48+ *
49+ * Return: 0 if all goes well, else appropriate error message
50+ */
51+int ti_sci_encrypt_tfa(uint64_t src_tfa_addr,
52+ uint32_t src_tfa_len)
53+{
54+ struct ti_sci_msg_req_encrypt_tfa req = { 0 };
55+ struct ti_sci_msg_resp_encrypt_tfa resp = { 0 };
56+ struct ti_sci_xfer xfer;
57+ int ret;
58+
59+ ret = ti_sci_setup_one_xfer(TISCI_MSG_LPM_ENCRYPT_TFA, 0,
60+ &req, sizeof(req),
61+ &resp, sizeof(resp),
62+ &xfer);
63+ if (ret != 0U) {
64+ ERROR("Message alloc failed (%d)\n", ret);
65+ return ret;
66+ }
67+
68+ req.src_tfa_addr = src_tfa_addr;
69+ req.src_tfa_len = src_tfa_len;
70+
71+ ret = ti_sci_do_xfer(&xfer);
72+ if (ret != 0U) {
73+ ERROR("Transfer send failed (%d)\n", ret);
74+ return ret;
75+ }
76+
77+ return 0;
78+}
79diff --git a/drivers/ti/ti_sci/ti_sci.h b/drivers/ti/ti_sci/ti_sci.h
80index 1f1963274..2afa11317 100644
81--- a/drivers/ti/ti_sci/ti_sci.h
82+++ b/drivers/ti/ti_sci/ti_sci.h
83@@ -258,6 +258,11 @@ int ti_sci_proc_wait_boot_status_no_wait(uint8_t proc_id,
84 *
85 * Return: 0 if all goes well, else appropriate error message
86 *
87+ * - ti_sci_encrypt_tfa - Ask TIFS to encrypt TFA at a specific address
88+ *
89+ * @src_tfa_addr: Address where the TFA lies unencrypted
90+ * @src_tfa_len: Size of the TFA unencrypted
91+ *
92 * NOTE: for all these functions, the following are generic in nature:
93 * Returns 0 for successful request, else returns corresponding error message.
94 */
95@@ -265,5 +270,7 @@ int ti_sci_enter_sleep(uint8_t proc_id,
96 uint8_t mode,
97 uint64_t core_resume_addr);
98 int ti_sci_lpm_get_next_sys_mode(uint8_t *next_mode);
99+int ti_sci_encrypt_tfa(uint64_t src_tfa_addr,
100+ uint32_t src_tfa_len);
101
102 #endif /* TI_SCI_H */
103diff --git a/drivers/ti/ti_sci/ti_sci_protocol.h b/drivers/ti/ti_sci/ti_sci_protocol.h
104index bdd24622a..a165cda99 100644
105--- a/drivers/ti/ti_sci/ti_sci_protocol.h
106+++ b/drivers/ti/ti_sci/ti_sci_protocol.h
107@@ -53,6 +53,9 @@
108 #define TISCI_MSG_GET_PROC_BOOT_STATUS 0xc400
109 #define TISCI_MSG_WAIT_PROC_BOOT_STATUS 0xc401
110
111+/* TFA encrypt/decrypt messages */
112+#define TISCI_MSG_LPM_ENCRYPT_TFA 0x030F
113+
114 /**
115 * struct ti_sci_secure_msg_hdr - Header that prefixes all TISCI messages sent
116 * via secure transport.
117@@ -160,6 +163,7 @@ struct ti_sci_msg_resp_query_fw_caps {
118 #define MSG_FLAG_CAPS_LPM_STANDBY TI_SCI_MSG_FLAG(3)
119 #define MSG_FLAG_CAPS_LPM_PARTIAL_IO TI_SCI_MSG_FLAG(4)
120 #define MSG_FLAG_CAPS_LPM_DM_MANAGED TI_SCI_MSG_FLAG(5)
121+#define MSG_FLAG_CAPS_LPM_ENCRYPT_IMAGE TI_SCI_MSG_FLAG(11)
122 uint64_t fw_caps;
123 } __packed;
124
125@@ -810,4 +814,32 @@ struct ti_sci_msg_resp_lpm_get_next_sys_mode {
126 uint8_t mode;
127 } __packed;
128
129+/*
130+ * struct ti_sci_msg_req_encrypt_tfa - Request for TISCI_MSG_LPM_ENCRYPT_TFA.
131+ *
132+ * @hdr Generic Header
133+ * @src_tfa_addr: Address where the TFA lies unencrypted
134+ * @src_tfa_len: Size of the TFA unencrypted
135+ *
136+ * This message is to be sent when the system is going in suspend, just before
137+ * TI_SCI_MSG_ENTER_SLEEP.
138+ * The TIFS will then encrypt the TFA and store it in RAM, along with a private
139+ * header.
140+ * Upon resume, the SPL will ask TIFS to decrypt it back.
141+ */
142+struct ti_sci_msg_req_encrypt_tfa {
143+ struct ti_sci_msg_hdr hdr;
144+ uint64_t src_tfa_addr;
145+ uint32_t src_tfa_len;
146+} __packed;
147+
148+/*
149+ * struct ti_sci_msg_req_encrypt_tfa - Request for TISCI_MSG_LPM_ENCRYPT_TFA.
150+ *
151+ * @hdr Generic Header
152+ */
153+struct ti_sci_msg_resp_encrypt_tfa {
154+ struct ti_sci_msg_hdr hdr;
155+} __packed;
156+
157 #endif /* TI_SCI_PROTOCOL_H */
158diff --git a/plat/ti/k3/common/k3_psci.c b/plat/ti/k3/common/k3_psci.c
159index a443dd851..c2017666b 100644
160--- a/plat/ti/k3/common/k3_psci.c
161+++ b/plat/ti/k3/common/k3_psci.c
162@@ -24,6 +24,7 @@
163 #define SYSTEM_PWR_STATE(state) ((state)->pwr_domain_state[PLAT_MAX_PWR_LVL])
164
165 uintptr_t k3_sec_entrypoint;
166+bool encrypt_image;
167
168 static void k3_cpu_standby(plat_local_state_t cpu_state)
169 {
170@@ -282,6 +283,11 @@ static void k3_pwr_domain_suspend_to_mode(const psci_power_state_t *target_state
171 k3_gic_cpuif_disable();
172 k3_gic_save_context();
173
174+ if (encrypt_image)
175+ {
176+ ti_sci_encrypt_tfa((uint64_t)__TEXT_START__, BL31_SIZE);
177+ }
178+
179 k3_pwr_domain_off(target_state);
180
181 ti_sci_enter_sleep(proc_id, mode, k3_sec_entrypoint);
182@@ -347,6 +353,10 @@ int plat_setup_psci_ops(uintptr_t sec_entrypoint,
183 ERROR("Unable to query firmware capabilities (%d)\n", ret);
184 }
185
186+ if (fw_caps & MSG_FLAG_CAPS_LPM_ENCRYPT_IMAGE) {
187+ encrypt_image = true;
188+ }
189+
190 /* If firmware does not support any known suspend mode */
191 if (!(fw_caps & (MSG_FLAG_CAPS_LPM_DEEP_SLEEP |
192 MSG_FLAG_CAPS_LPM_MCU_ONLY |
193--
1942.34.1
diff --git a/meta-ti-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a/0003-feat-k3-handle-suspend-in-case-of-LPM_BOARDCFG_MANAG.patch b/meta-ti-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a/0003-feat-k3-handle-suspend-in-case-of-LPM_BOARDCFG_MANAG.patch
new file mode 100644
index 00000000..a1209fe1
--- /dev/null
+++ b/meta-ti-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a/0003-feat-k3-handle-suspend-in-case-of-LPM_BOARDCFG_MANAG.patch
@@ -0,0 +1,68 @@
1From 470cf022d03e350beab36605d4250944d2c92ffe Mon Sep 17 00:00:00 2001
2From: Abhash Kumar Jha <a-kumar2@ti.com>
3Date: Tue, 28 Oct 2025 23:24:22 +0530
4Subject: [PATCH 3/3] feat(k3): handle suspend in case of LPM_BOARDCFG_MANAGED
5
6The J7 platforms support LPM_BOARDCFG_MANAGED capability where the
7low power mode configuration is done statically for the DM via the
8pm-boardcfg.
9
10This is entirely opposite to the case of DM_MANAGED, where the DM fw
11decides the low power mode to enter into.
12
13Introduce LPM_BOARDCFG_MANAGED cap to handle suspend for those
14platforms as well.
15
16Upstream-Status: Pending
17
18Change-Id: Iaa0ab478cbe0db6652f61e9d733c0fddb4bab234
19Signed-off-by: Abhash Kumar Jha <a-kumar2@ti.com>
20---
21 drivers/ti/ti_sci/ti_sci_protocol.h | 1 +
22 plat/ti/k3/common/k3_psci.c | 13 ++++++++-----
23 2 files changed, 9 insertions(+), 5 deletions(-)
24
25diff --git a/drivers/ti/ti_sci/ti_sci_protocol.h b/drivers/ti/ti_sci/ti_sci_protocol.h
26index a165cda99..b83174b0d 100644
27--- a/drivers/ti/ti_sci/ti_sci_protocol.h
28+++ b/drivers/ti/ti_sci/ti_sci_protocol.h
29@@ -164,6 +164,7 @@ struct ti_sci_msg_resp_query_fw_caps {
30 #define MSG_FLAG_CAPS_LPM_PARTIAL_IO TI_SCI_MSG_FLAG(4)
31 #define MSG_FLAG_CAPS_LPM_DM_MANAGED TI_SCI_MSG_FLAG(5)
32 #define MSG_FLAG_CAPS_LPM_ENCRYPT_IMAGE TI_SCI_MSG_FLAG(11)
33+#define MSG_FLAG_CAPS_LPM_BOARDCFG_MANAGED TI_SCI_MSG_FLAG(12)
34 uint64_t fw_caps;
35 } __packed;
36
37diff --git a/plat/ti/k3/common/k3_psci.c b/plat/ti/k3/common/k3_psci.c
38index c2017666b..9cf41b4cb 100644
39--- a/plat/ti/k3/common/k3_psci.c
40+++ b/plat/ti/k3/common/k3_psci.c
41@@ -357,17 +357,20 @@ int plat_setup_psci_ops(uintptr_t sec_entrypoint,
42 encrypt_image = true;
43 }
44
45- /* If firmware does not support any known suspend mode */
46- if (!(fw_caps & (MSG_FLAG_CAPS_LPM_DEEP_SLEEP |
47+ /* If firmware is capabale of low power modes */
48+ if (fw_caps & (MSG_FLAG_CAPS_LPM_DM_MANAGED |
49+ MSG_FLAG_CAPS_LPM_BOARDCFG_MANAGED)) {
50+ k3_plat_psci_ops.pwr_domain_suspend = k3_pwr_domain_suspend_dm_managed;
51+ } else if (!(fw_caps & (MSG_FLAG_CAPS_LPM_DEEP_SLEEP |
52 MSG_FLAG_CAPS_LPM_MCU_ONLY |
53 MSG_FLAG_CAPS_LPM_STANDBY |
54 MSG_FLAG_CAPS_LPM_PARTIAL_IO))) {
55- /* Disable PSCI suspend support */
56+ /* If firmware does not support any known suspend mode
57+ * disable PSCI suspend support
58+ */
59 k3_plat_psci_ops.pwr_domain_suspend = NULL;
60 k3_plat_psci_ops.pwr_domain_suspend_finish = NULL;
61 k3_plat_psci_ops.get_sys_suspend_power_state = NULL;
62- } else if (fw_caps & MSG_FLAG_CAPS_LPM_DM_MANAGED) {
63- k3_plat_psci_ops.pwr_domain_suspend = k3_pwr_domain_suspend_dm_managed;
64 }
65
66 *psci_ops = &k3_plat_psci_ops;
67--
682.34.1
diff --git a/meta-ti-bsp/recipes-security/optee/optee-os-ti-overrides.inc b/meta-ti-bsp/recipes-security/optee/optee-os-ti-overrides.inc
index 61a74a06..d636ae00 100644
--- a/meta-ti-bsp/recipes-security/optee/optee-os-ti-overrides.inc
+++ b/meta-ti-bsp/recipes-security/optee/optee-os-ti-overrides.inc
@@ -1,6 +1,8 @@
1# Use TI SECDEV for signing 1# Use TI SECDEV for signing
2inherit ti-secdev 2inherit ti-secdev
3 3
4FILESEXTRAPATHS:prepend := "${THISDIR}/optee-os:"
5
4EXTRA_OEMAKE:remove = "CFG_MAP_EXT_DT_SECURE=y" 6EXTRA_OEMAKE:remove = "CFG_MAP_EXT_DT_SECURE=y"
5 7
6EXTRA_OEMAKE:append:k3 = " ${@ 'CFG_CONSOLE_UART='+ d.getVar('OPTEE_K3_USART') if d.getVar('OPTEE_K3_USART') else ''}" 8EXTRA_OEMAKE:append:k3 = " ${@ 'CFG_CONSOLE_UART='+ d.getVar('OPTEE_K3_USART') if d.getVar('OPTEE_K3_USART') else ''}"
@@ -76,3 +78,12 @@ RDEPENDS:${PN} += "${PN}-ta"
76 78
77# This is needed for bl32.elf 79# This is needed for bl32.elf
78INSANE_SKIP:${PN}:append:k3 = " textrel" 80INSANE_SKIP:${PN}:append:k3 = " textrel"
81
82# LPM support patch for Jacinto platforms (J7200, J742S2, J784S4)
83OPTEE_JACINTO_LPM_PATCHES = " \
84 file://0001-plat-k3-drivers-Open-TRNG-firewall-for-TIFS-on-all-k.patch \
85"
86
87SRC_URI:append:j7200 = " ${OPTEE_JACINTO_LPM_PATCHES}"
88SRC_URI:append:j742s2 = " ${OPTEE_JACINTO_LPM_PATCHES}"
89SRC_URI:append:j784s4 = " ${OPTEE_JACINTO_LPM_PATCHES}"
diff --git a/meta-ti-bsp/recipes-security/optee/optee-os/0001-plat-k3-drivers-Open-TRNG-firewall-for-TIFS-on-all-k.patch b/meta-ti-bsp/recipes-security/optee/optee-os/0001-plat-k3-drivers-Open-TRNG-firewall-for-TIFS-on-all-k.patch
new file mode 100644
index 00000000..59d7a795
--- /dev/null
+++ b/meta-ti-bsp/recipes-security/optee/optee-os/0001-plat-k3-drivers-Open-TRNG-firewall-for-TIFS-on-all-k.patch
@@ -0,0 +1,45 @@
1From 00f74ba2ab00088d51e6da3c0eefe50599ef5c82 Mon Sep 17 00:00:00 2001
2From: Prasanth Babu Mantena <p-mantena@ti.com>
3Date: Mon, 3 Nov 2025 12:42:57 +0530
4Subject: [PATCH] plat-k3: drivers: Open TRNG firewall for TIFS on all k3 devs
5
6On k3 devices, TRNG is firewalled to be accessed only by OPTEE.
7
8TIFS needs this for the encryption and decryption services to support
9different low power modes. So, open firewall to TIFS as well.
10
11There is no concurrent usage of TRNG, as TIFS uses TRNG only at suspend
12when OPTEE is down and resume, when firewalls are restored but OPTEE is
13not up yet.
14
15As this is a firewall that required to be shared along with TIFS on all
16devices, making this a common change and open on all devs.
17
18Upstream-Status: Submitted [https://github.com/OP-TEE/optee_os/pull/7582]
19
20Signed-off-by: Prasanth Babu Mantena <p-mantena@ti.com>
21Reviewed-by: Manorit Chawdhry <m-chawdhry@ti.com>
22Reviewed-by: Andrew Davis <afd@ti.com>
23---
24 core/arch/arm/plat-k3/drivers/sa2ul.c | 5 -----
25 1 file changed, 5 deletions(-)
26
27diff --git a/core/arch/arm/plat-k3/drivers/sa2ul.c b/core/arch/arm/plat-k3/drivers/sa2ul.c
28index c50757b2c..e10bde131 100644
29--- a/core/arch/arm/plat-k3/drivers/sa2ul.c
30+++ b/core/arch/arm/plat-k3/drivers/sa2ul.c
31@@ -121,12 +121,7 @@ static TEE_Result sa2ul_init(void)
32 start_address = RNG_BASE;
33 end_address = RNG_BASE + RNG_REG_SIZE - 1;
34 permissions[num_perm++] = (FW_BIG_ARM_PRIVID << 16) | FW_SECURE_ONLY;
35-#if defined(PLATFORM_FLAVOR_am62x) || \
36- defined(PLATFORM_FLAVOR_am62ax) || \
37- defined(PLATFORM_FLAVOR_am62px)
38-
39 permissions[num_perm++] = (FW_TIFS_PRIVID << 16) | FW_NON_SECURE;
40-#endif
41 ret = ti_sci_set_fwl_region(fwl_id, rng_region, num_perm,
42 control, permissions,
43 start_address, end_address);
44--
452.34.1
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-22 06:04:29 +0000