Hi Beleswar On 31/08/26 14:03, Beleswar Padhi wrote: > Some TI K3 SoCs like J721S2, J784S4, and J722S have a HSM (High Security > Module) M4F core in the Wakeup Voltage Domain which could be used to > run secure services like Authentication. Boot flow for HSM M4 core is > different than the general purpose M4F cores, and is as below: > > 1. Request control of HSM M4F remote processor. > 2. Assert Reset on the HSM M4F remote processor. > 3. Request Secure Entity to Authenticate and Load HSM firmware into > core's internal SRAM memory region. For GP device, load the firmware > manually into core's SRAM region. > 4. Deassert Reset on the HSM M4F remote processor. > 5. Release control of HSM M4F remote processor. > > This series adds support to boot HSM M4 core from R5 SPL stage. The HSM > firmware is packed inside the tispl.bin fit image. The firmware is > unpacked into a temporary DDR address which is then used to load HSM > core. The configs to boot HSM M4 core are disabled by default. > > Additional documentation on HSM M4 core usage: > https://software-dl.ti.com/jacinto7/esd/processor-sdk-linux-j784s4/latest/exports/docs/linux/Foundational_Components/U-Boot/UG-HSM.html > > v6: Changelog: > [Bryan]: > 1. Rebase on upstream main branch. > 2. Drop [PATCH v5 1/7] as existing fix is already available in main. > 3. Add documentation about enabling and booting HSM core in > doc/board/ti/k3.rst. > > Link to v5: > https://lore.kernel.org/all/[email protected]/ > > v5: Changelog: > [Simon]: > 1. Add 'depends on SOC_K3_J721S2 || SOC_K3_J784S4 || SOC_K3_J722S' for > KConfig options. > 2. Use hyphens in DT property names and underscores in python code. > 3. Add comments to explain DT property values and link to ti-sci > documentation > 4. Use lower-case hex for DT property values. > 5. Use consistent whitespaces. > 6. Add property documentation in function docstring. > 7. Log missing properties for boot and load extension groups. > 8. Update tests to check the load and boot sections contain the > expected values from test DTS. Add negative tests to check it raises > an error when some of the properties are missing. > 9. Driver improvements: Size check before memcpy(), type-casting, and > checking device type via get_device_type(). > 10. Invoke ti_secure_image_post_process() only once for HSM images. > [General]: > 1. Explicitly mention the load address of the HSM image in the FIT. > Don't rely on U-Boot to assign a fallback load address. Use a > Kconfig option to specify the HSM load address. > 2. Pick up R/B tags from Neha and Simon. > 3. Squash various patches together as they are atomic. > > Link to v4: > https://lore.kernel.org/all/[email protected]/ > > v4: Changelog: > Re-spinning after Device Tree Syncup happened from Linux to U-Boot. > [Andrew]: > 1. Reworded commit message on [PATCH v4 03/11]. > [Simon]: > 1. Add a binman test for the boot & load extensions in certificate in > [PATCH v4 08/11]. > General: > 1. Drop J722S defconfig changes out of this series. Will be > posted/discussed separately. > > Link to v3: > https://lore.kernel.org/all/[email protected]/ > > v3: Changelog: > [Andrew]: > 1. Added dedicated remoteproc driver for booting HSM core. > 2. Added support for signing HSM firmware images in U-Boot. [Anshul] > General: > 1. Add support for booting HSM on J722S SoC as well. > > Link to v2: > http://lore.kernel.org/all/[email protected]/ > > v2: Changelog: > [Andrew]: > 1. Added support in SPL to load FIT images with no 'load' property. > 2. Removed 'default = n' in CONFIG option. > 3. Used __maybe_unused to decrease preprocessing. > 4. Better error messages with error code. > [Udit]: > 1. Added 'HSM' entries in enum at the last. > 2. Added error condition in if-elseif-else ladder. > 3. Hang System boot when HSM failed to boot properly. > > Link to v1: > https://lore.kernel.org/all/[email protected]/ > > Testing done: > 1. Tested HSM boot across GP, HS-FS, HS-SE device types for J721S2, > J784S4 and J722S SoCs. > > Logs after enabling HSM boot configs: > https://gist.github.com/3V3RYONE/ad33683652c8c49e4fedab49f0493e79 > > Beleswar Padhi (7): > arm: mach-k3: Add config options for packaging HSM firmware > arm: dts: k3-{j721s2/j722s/j784s4}-binman: Add template for packing > HSM firmware > binman: openssl: Add boot and load extensions to x509 cert > arm: dts: k3-{j721s2/j722s/j784s4}-r5.dtsi: Enable HSM core > remoteproc: k3-hsm: Introduce a remoteproc driver for K3 HSM core > arm: mach-k3: r5: common: Invoke boot of HSM M4 core > doc: board: ti: k3: Add section for HSM M4F core loading > > MAINTAINERS | 1 + > arch/arm/dts/k3-binman.dtsi | 26 ++ > arch/arm/dts/k3-j721s2-binman.dtsi | 12 + > arch/arm/dts/k3-j721s2-r5.dtsi | 10 + > arch/arm/dts/k3-j722s-binman.dtsi | 12 + > arch/arm/dts/k3-j722s-r5.dtsi | 10 + > arch/arm/dts/k3-j784s4-binman.dtsi | 12 + > arch/arm/dts/k3-j784s4-r5.dtsi | 9 + > arch/arm/mach-k3/Kconfig | 16 ++ > arch/arm/mach-k3/r5/common.c | 29 +- > doc/board/ti/k3.rst | 134 +++++++++ > drivers/remoteproc/Kconfig | 10 + > drivers/remoteproc/Makefile | 1 + > drivers/remoteproc/ti_k3_hsm_rproc.c | 268 ++++++++++++++++++ > tools/binman/btool/openssl.py | 49 +++- > tools/binman/etype/ti_secure.py | 65 +++++ > tools/binman/etype/x509_cert.py | 4 +- > tools/binman/ftest.py | 45 +++ > .../test/vendor/ti_secure_boot_load_ext.dts | 23 ++ > .../ti_secure_boot_load_ext_partial.dts | 20 ++ > 20 files changed, 747 insertions(+), 9 deletions(-) > create mode 100644 drivers/remoteproc/ti_k3_hsm_rproc.c > create mode 100644 tools/binman/test/vendor/ti_secure_boot_load_ext.dts > create mode 100644 > tools/binman/test/vendor/ti_secure_boot_load_ext_partial.dts >
Please send to [email protected] instead of the old mailing list. -- Thanking You Neha Malcom Francis
