Some TI K3 SoCs like J721S2, J784S4, and J722S have a HSM (High Security Module) M4F core in the Wakeup Voltage Domain which could be used to run secure services like Authentication. Boot flow for HSM M4 core is different than the general purpose M4F cores, and is as below:
1. Request control of HSM M4F remote processor. 2. Assert Reset on the HSM M4F remote processor. 3. Request Secure Entity to Authenticate and Load HSM firmware into core's internal SRAM memory region. For GP device, load the firmware manually into core's SRAM region. 4. Deassert Reset on the HSM M4F remote processor. 5. Release control of HSM M4F remote processor. This series adds support to boot HSM M4 core from R5 SPL stage. The HSM firmware is packed inside the tispl.bin fit image. The firmware is unpacked into a temporary DDR address which is then used to load HSM core. The configs to boot HSM M4 core are disabled by default. Additional documentation on HSM M4 core usage: https://software-dl.ti.com/jacinto7/esd/processor-sdk-linux-j784s4/latest/exports/docs/linux/Foundational_Components/U-Boot/UG-HSM.html v6: Changelog: [Bryan]: 1. Rebase on upstream main branch. 2. Drop [PATCH v5 1/7] as existing fix is already available in main. 3. Add documentation about enabling and booting HSM core in doc/board/ti/k3.rst. Link to v5: https://lore.kernel.org/all/[email protected]/ v5: Changelog: [Simon]: 1. Add 'depends on SOC_K3_J721S2 || SOC_K3_J784S4 || SOC_K3_J722S' for KConfig options. 2. Use hyphens in DT property names and underscores in python code. 3. Add comments to explain DT property values and link to ti-sci documentation 4. Use lower-case hex for DT property values. 5. Use consistent whitespaces. 6. Add property documentation in function docstring. 7. Log missing properties for boot and load extension groups. 8. Update tests to check the load and boot sections contain the expected values from test DTS. Add negative tests to check it raises an error when some of the properties are missing. 9. Driver improvements: Size check before memcpy(), type-casting, and checking device type via get_device_type(). 10. Invoke ti_secure_image_post_process() only once for HSM images. [General]: 1. Explicitly mention the load address of the HSM image in the FIT. Don't rely on U-Boot to assign a fallback load address. Use a Kconfig option to specify the HSM load address. 2. Pick up R/B tags from Neha and Simon. 3. Squash various patches together as they are atomic. Link to v4: https://lore.kernel.org/all/[email protected]/ v4: Changelog: Re-spinning after Device Tree Syncup happened from Linux to U-Boot. [Andrew]: 1. Reworded commit message on [PATCH v4 03/11]. [Simon]: 1. Add a binman test for the boot & load extensions in certificate in [PATCH v4 08/11]. General: 1. Drop J722S defconfig changes out of this series. Will be posted/discussed separately. Link to v3: https://lore.kernel.org/all/[email protected]/ v3: Changelog: [Andrew]: 1. Added dedicated remoteproc driver for booting HSM core. 2. Added support for signing HSM firmware images in U-Boot. [Anshul] General: 1. Add support for booting HSM on J722S SoC as well. Link to v2: http://lore.kernel.org/all/[email protected]/ v2: Changelog: [Andrew]: 1. Added support in SPL to load FIT images with no 'load' property. 2. Removed 'default = n' in CONFIG option. 3. Used __maybe_unused to decrease preprocessing. 4. Better error messages with error code. [Udit]: 1. Added 'HSM' entries in enum at the last. 2. Added error condition in if-elseif-else ladder. 3. Hang System boot when HSM failed to boot properly. Link to v1: https://lore.kernel.org/all/[email protected]/ Testing done: 1. Tested HSM boot across GP, HS-FS, HS-SE device types for J721S2, J784S4 and J722S SoCs. Logs after enabling HSM boot configs: https://gist.github.com/3V3RYONE/ad33683652c8c49e4fedab49f0493e79 Beleswar Padhi (7): arm: mach-k3: Add config options for packaging HSM firmware arm: dts: k3-{j721s2/j722s/j784s4}-binman: Add template for packing HSM firmware binman: openssl: Add boot and load extensions to x509 cert arm: dts: k3-{j721s2/j722s/j784s4}-r5.dtsi: Enable HSM core remoteproc: k3-hsm: Introduce a remoteproc driver for K3 HSM core arm: mach-k3: r5: common: Invoke boot of HSM M4 core doc: board: ti: k3: Add section for HSM M4F core loading MAINTAINERS | 1 + arch/arm/dts/k3-binman.dtsi | 26 ++ arch/arm/dts/k3-j721s2-binman.dtsi | 12 + arch/arm/dts/k3-j721s2-r5.dtsi | 10 + arch/arm/dts/k3-j722s-binman.dtsi | 12 + arch/arm/dts/k3-j722s-r5.dtsi | 10 + arch/arm/dts/k3-j784s4-binman.dtsi | 12 + arch/arm/dts/k3-j784s4-r5.dtsi | 9 + arch/arm/mach-k3/Kconfig | 16 ++ arch/arm/mach-k3/r5/common.c | 29 +- doc/board/ti/k3.rst | 134 +++++++++ drivers/remoteproc/Kconfig | 10 + drivers/remoteproc/Makefile | 1 + drivers/remoteproc/ti_k3_hsm_rproc.c | 268 ++++++++++++++++++ tools/binman/btool/openssl.py | 49 +++- tools/binman/etype/ti_secure.py | 65 +++++ tools/binman/etype/x509_cert.py | 4 +- tools/binman/ftest.py | 45 +++ .../test/vendor/ti_secure_boot_load_ext.dts | 23 ++ .../ti_secure_boot_load_ext_partial.dts | 20 ++ 20 files changed, 747 insertions(+), 9 deletions(-) create mode 100644 drivers/remoteproc/ti_k3_hsm_rproc.c create mode 100644 tools/binman/test/vendor/ti_secure_boot_load_ext.dts create mode 100644 tools/binman/test/vendor/ti_secure_boot_load_ext_partial.dts -- 2.34.1
