The HSM M4 core needs to be booted at R5 SPL stage so that it can be used for further Authentication and security services. Therefore, the firmware for the HSM core needs to be packed in tispl.bin fit image so that it can be used by R5 SPL to boot the HSM core. By default, point to the firmware for HS-SE device type. This needs to be changed to point to appropriate firmware when using a different device type.
Add a template for packing the HSM firmware in tispl.bin. The template also contains necessary fields which will be populated in the boot extension and load extension in the x509 certificate for HSM firmware. This is required as the HSM firmware needs to be signed before invoking TIFS to authenticate and load the blob to HSM core. Note: The os = "hsm" property is matched against image_os_match[IMAGE_ID_HSM] in arch/arm/mach-k3/r5/common.c during post-processing. This string must be kept consistent between the device tree and code, as changing it will break the image identification logic. Signed-off-by: Beleswar Padhi <[email protected]> Reviewed-by: Simon Glass <[email protected]> --- v6: Changelog: 1. None Link to v5: https://lore.kernel.org/all/[email protected]/ v5: Changelog: 1. Squash [PATCH v4 05/11] and [PATCH v4 06/11] into [PATCH v5 3/7] for bisectability. 2. Use hyphens in DT property names. 3. Update commit message to call out os = "hsm" matching criteria. 4. Add comments explaining DT property values and add link to ti-sci documentation. 5. Use whitespaces consistently. 6. Add R/B tags. Link to v4: https://lore.kernel.org/all/[email protected]/ v4: Changelog: 1. Changed phandle from hsm to hsm_fw in 'content' field to match with node label. Link to v3: https://lore.kernel.org/all/[email protected]/ v3: Changelog: 1. Added ti-secure node for signing hsm firmware image in U-Boot. Link to v2: https://lore.kernel.org/all/[email protected]/ v2: Changelog: 1. Got rid of 'load' and 'entry' properties. Rely on U-Boot to set it. Link to v1: https://lore.kernel.org/all/[email protected]/ arch/arm/dts/k3-binman.dtsi | 26 ++++++++++++++++++++++++++ arch/arm/dts/k3-j721s2-binman.dtsi | 12 ++++++++++++ arch/arm/dts/k3-j722s-binman.dtsi | 12 ++++++++++++ arch/arm/dts/k3-j784s4-binman.dtsi | 12 ++++++++++++ 4 files changed, 62 insertions(+) diff --git a/arch/arm/dts/k3-binman.dtsi b/arch/arm/dts/k3-binman.dtsi index ad127663d03..af752619255 100644 --- a/arch/arm/dts/k3-binman.dtsi +++ b/arch/arm/dts/k3-binman.dtsi @@ -297,6 +297,32 @@ }; }; +#ifdef CONFIG_K3_HSM_FW + hsm { + description = "HSM binary"; + type = "standalone"; + compression = "none"; + os = "hsm"; + load = <CONFIG_K3_HSM_LOAD_ADDR>; + + ti-secure { + /* + * HSM (Hardware Security Module) core boot configuration. + * Refer to TIFS Boot Extension format specification: + * https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/security/sec_cert_format.html#sysfw-boot-ext + */ + content = <&hsm_fw>; + keyfile = "custMpk.pem"; + proc-id = <0x80>; /* HSM core processor ID */ + flags-set = <0x04>; /* Bit 2: Release processor from reset */ + flags-clr = <0x00>; /* No flags to clear */ + reset-vector = <0x00>; /* HSM starts execution from address 0x0 */ + dest-addr = <0x43c00000>; /* Load address: HSM SRAM base */ + auth-type = <0xfd00>; /* Upper byte 0xfd: HSM host ID, lower byte 0x00: Copy to dest-addr */ + }; + }; +#endif + dm { description = "DM binary"; type = "firmware"; diff --git a/arch/arm/dts/k3-j721s2-binman.dtsi b/arch/arm/dts/k3-j721s2-binman.dtsi index f79b3e543ae..2b36b04965e 100644 --- a/arch/arm/dts/k3-j721s2-binman.dtsi +++ b/arch/arm/dts/k3-j721s2-binman.dtsi @@ -268,6 +268,14 @@ }; }; +#ifdef CONFIG_K3_HSM_FW + hsm { + hsm_fw: blob-ext { + filename = "ti-hsm/hsm-demo-firmware-j721s2-hs.bin"; + }; + }; +#endif + dm { ti-secure { content = <&dm>; @@ -300,7 +308,11 @@ conf-0 { description = "k3-j721s2-common-proc-board"; firmware = "atf"; +#ifdef CONFIG_K3_HSM_FW + loadables = "hsm", "tee", "dm", "spl"; +#else loadables = "tee", "dm", "spl"; +#endif fdt = "fdt-0"; }; }; diff --git a/arch/arm/dts/k3-j722s-binman.dtsi b/arch/arm/dts/k3-j722s-binman.dtsi index 278b7bfac7f..3834d081c30 100644 --- a/arch/arm/dts/k3-j722s-binman.dtsi +++ b/arch/arm/dts/k3-j722s-binman.dtsi @@ -117,6 +117,14 @@ fit { images { +#ifdef CONFIG_K3_HSM_FW + hsm { + hsm_fw: blob-ext { + filename = "ti-hsm/hsm-demo-firmware-j722s-hs.bin"; + }; + }; +#endif + dm { ti-secure { content = <&dm>; @@ -153,7 +161,11 @@ conf-0 { description = "k3-j722s-evm"; firmware = "atf"; +#ifdef CONFIG_K3_HSM_FW + loadables = "hsm", "tee", "dm", "spl"; +#else loadables = "tee", "dm", "spl"; +#endif fdt = "fdt-0"; }; }; diff --git a/arch/arm/dts/k3-j784s4-binman.dtsi b/arch/arm/dts/k3-j784s4-binman.dtsi index 34b2cc1e681..ac12335a84c 100644 --- a/arch/arm/dts/k3-j784s4-binman.dtsi +++ b/arch/arm/dts/k3-j784s4-binman.dtsi @@ -154,6 +154,14 @@ fit { images { +#ifdef CONFIG_K3_HSM_FW + hsm { + hsm_fw: blob-ext { + filename = "ti-hsm/hsm-demo-firmware-j784s4-hs.bin"; + }; + }; +#endif + dm { ti-secure { content = <&dm>; @@ -188,7 +196,11 @@ conf-0 { description = BOARD_DESCRIPTION; firmware = "atf"; +#ifdef CONFIG_K3_HSM_FW + loadables = "hsm", "tee", "dm", "spl"; +#else loadables = "tee", "dm", "spl"; +#endif fdt = "fdt-0"; }; }; -- 2.34.1
