Changes in secure.h

a77efb6ba4407696ae21676535ee17f923e15930 - Merge changes from topic "dev/rk3568-ddr-fw" into integration

Mon, 02 Mar 2026 16:20:44 +0000

Merge changes from topic "dev/rk3568-ddr-fw" into integration* changes: feat(rk3568): protect TF-As memory area with the DDR firewall feat(rk3568): bring DDR firewall naming in line feat(rk3568): move existing secure init to separate files fix(rockchip): fix comment and value about TZRAM_SIZE List of files: /rk3399_ARM-atf/plat/rockchip/rk3568/drivers/secure/secure.h

1248db70b9622c4f886d2a443e52f1e7a243022e - feat(rk3568): protect TF-As memory area with the DDR firewall

Fri, 12 Sep 2025 13:32:58 +0000

feat(rk3568): protect TF-As memory area with the DDR firewallSimilar to most (all?) other Rockchip SoCs, the RK3568 also has a DDRfirewall to restrict memory regions to secure usage.The original submission didn't protect the TF-A's memory region, soimplement this now with knowledge gained from comments in the OPTEEpull-request for the rk356x [0].Contrary to other SoCs like RK3576 and RK3588, the RK3568 memoryregions are managed in blocks of 128KB, not blocks of 1MB size.With the registers having 16bit for upper and lower block id, this thencan completely fill the 8GB max ram size the RK356x supports.The whole behaviour was tested with a number of reads from main u-boot.With the current config of protecting everything in the first MB of memory,doing any reads before the 1MB border will trigger the expected"Synchronous Abort" and restart.So doing=> md 0x100000 4will succeed, but reading anything before this will trigger the Abort.[0] https://github.com/OP-TEE/optee_os/pull/6954#issuecomment-3041255974Signed-off-by: Heiko Stuebner Tested-by: Diederik de Haas Change-Id: I6c75ab2813566e727e46cea86dd229625a64dd3f List of files: /rk3399_ARM-atf/plat/rockchip/rk3568/drivers/secure/secure.h

5e4a490dbbfa5ee1aa5b3856793ab132da759f8f - feat(rk3568): bring DDR firewall naming in line

Wed, 10 Sep 2025 09:45:26 +0000

feat(rk3568): bring DDR firewall naming in lineThe TRM declares that region as FIREWALL_DDR, so name the memory regionaccordingly in TF-A and also remove the double FW_DDR + _REG addon fromthe one known register.Signed-off-by: Heiko Stuebner Change-Id: Ic098baa13b5c0b4cf339905030ee7d777bcbda34 List of files: /rk3399_ARM-atf/plat/rockchip/rk3568/drivers/secure/secure.h

1dc8eb91c7090e3b04e7717368cb6484c0ff74f7 - feat(rk3568): move existing secure init to separate files

Wed, 10 Sep 2025 09:07:00 +0000

feat(rk3568): move existing secure init to separate filesMove the existing secure_timer_init() and sgrf_init() to a separatefile similar to the other Rockchip platforms.This allows us to add additional secure init later on.Signed-off-by: Heiko Stuebner Change-Id: I1151abed77d68b3730d505c547919e60415e3951 List of files: /rk3399_ARM-atf/plat/rockchip/rk3568/drivers/secure/secure.h