Fwd: RK3506B: what enables FW_DDR (0xff5f0000) region enforcement from the secure monitor?

[Owen O'Hehir]

Hello all,

I've been working on replacing the closed `rk3506_tee` blob on an
RK3506B (Luckfox Lyra Ultra) with an upstream from-source OP-TEE
build. I've made decent progress but one part that I'm stuck on is DDR
firewall (FW_DDR, base `0xff5f0000`) locking the secure DRAM region
against the non-secure CPU master. So far I can:

- program the region-map + CON + per-master (MST) registers and can
read them back,
- reproduce the exact register/value/ordering sequence that the vendor
secure firmware uses.

I've verified
- With the same idbloader/SPL (mainline-style U-Boot  `arch_cpu_init`,
which only does the MST grants), the vendor TEE enforces but my OP-TEE
does not, NS still reads/writes the region.
- The SGRF slave-security set is identical between the two.

So there appears to be a precondition outside the FW_DDR register
block that is set by the vendor secure firmware's broader init that
makes region checks actually apply to the A7 NS master.

Any pointers to the FW_DDR register summary or how to set this would
be gratefully appreciated!

Regards,

Owen