| 1e846e20 | 27-Jan-2022 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
zynqmp: zcu102: Fix DDR memory size to 4 GiB
Xilinx ZCU102 board has 4 GiB of DDR memory and size must be configured properly in order for dynamic shared memory feature to work.
Without it followin
zynqmp: zcu102: Fix DDR memory size to 4 GiB
Xilinx ZCU102 board has 4 GiB of DDR memory and size must be configured properly in order for dynamic shared memory feature to work.
Without it following error might be present during kernel startup:
E/TC:0 0 std_smc_entry:183 Bad arg address 0x803989000
When compiling for 32 bits only first 2 GiB is available.
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> Acked-by: Etienne Carriere <etienne.carriere@linaro.org> Acked-by: Ricardo Salveti <ricardo@foundries.io> Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| df8976a1 | 26-Jan-2022 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
zynqmp: platform: make it possible to configure DDR size more flexible
Default DDR size comes from platform selection.
If only DDR size is different it is possible to override it with setting CFG_D
zynqmp: platform: make it possible to configure DDR size more flexible
Default DDR size comes from platform selection.
If only DDR size is different it is possible to override it with setting CFG_DDR_SIZE.
Automatic configuration of DDR memory mappings can also be done by device tree (CFG_DT=y) and by overriding if necessary memory address for device tree (CFG_DT_ADDR).
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> Acked-by: Etienne Carriere <etienne.carriere@linaro.org> Acked-by: Ricardo Salveti <ricardo@foundries.io> Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 08363023 | 26-Jan-2022 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
zynqmp: platform: configure default device tree address
Xilinx has selected 0x100000 as default memory address for device tree.
Configure it by default and make it possible to override it (CFG_DT_A
zynqmp: platform: configure default device tree address
Xilinx has selected 0x100000 as default memory address for device tree.
Configure it by default and make it possible to override it (CFG_DT_ADDR).
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> Acked-by: Etienne Carriere <etienne.carriere@linaro.org> Acked-by: Ricardo Salveti <ricardo@foundries.io> Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| f57e4036 | 10-Oct-2021 |
Jorge Ramirez-Ortiz <jorge@foundries.io> |
zynqmp: platform: use HUK derived from PUF KEK for RPMB
Enable the RPMB key when the HUK is generated from the PUF KEK.
Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io> Tested-by: Ricardo Sa
zynqmp: platform: use HUK derived from PUF KEK for RPMB
Enable the RPMB key when the HUK is generated from the PUF KEK.
Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io> Tested-by: Ricardo Salveti <ricardo@foundries.io> Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 1d23b02e | 08-Oct-2021 |
Jorge Ramirez-Ortiz <jorge@foundries.io> |
zynqmp: drivers: generate HUK from PUF KEK
If authenticated boot was disabled we allow generating the HUK using the SHA-256 of the DNA unique identifier.
If authenticated boot was enabled, use the
zynqmp: drivers: generate HUK from PUF KEK
If authenticated boot was disabled we allow generating the HUK using the SHA-256 of the DNA unique identifier.
If authenticated boot was enabled, use the PUK KEK to generate the HUK instead. The PUF KEK must be registered while securing the board using the Xilinx tools. In this case, the HUK is generated by reading the DNA eFuses. This 96 bits value is used to generate a 16 byte digest which is then AES-GCM encrypted using the PUF KEK. The resulting 16 byte value is the HUK. To prevent the HUK from being leaked, the AES-GCM module must be reserved.
The HUK generation was validated on Zynqmp zu3cg using the Xilinx Lightweight Provisioning Tool to enable authenticated boot and to provision the PUF (burning a number of eFuses in the process).
Tested-by: Jorge Ramirez-Ortiz <jorge@foundries.io> Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io> Tested-by: Ricardo Salveti <ricardo@foundries.io> Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 9b61a2bc | 07-Oct-2021 |
Jorge Ramirez-Ortiz <jorge@foundries.io> |
zynqmp: drivers: PM firmware
These routines call TF-A exported SiP services that implement IPI protocol for communication with PMUFW (Platform Management Unit).
To access eFuses, PMUFW should be bu
zynqmp: drivers: PM firmware
These routines call TF-A exported SiP services that implement IPI protocol for communication with PMUFW (Platform Management Unit).
To access eFuses, PMUFW should be built with -DENABLE_EFUSE_ACCESS=1.
Notice however that certain eFuses will not be available unless the Xilskey library linked to the PMUFW is compiled removing some of those security restrictions.
Signed-off-by: Igor Opaniuk <igor.opaniuk@foundries.io> Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io> Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| f072eea4 | 04-Oct-2021 |
Jorge Ramirez-Ortiz <jorge@foundries.io> |
zynqmp: drivers: AES-GCM with PUF KEK
Provide a mechanism to encrypt a red key using the KEK; the KEK is only available on secured boards after the RSA_EN and PPK eFUSES have been burnt (the system
zynqmp: drivers: AES-GCM with PUF KEK
Provide a mechanism to encrypt a red key using the KEK; the KEK is only available on secured boards after the RSA_EN and PPK eFUSES have been burnt (the system will only boot ROM authenticated bootloaders from here on).
The main use case for OP-TEE would be to encode the zynqmp per device unique identifier (DNA0, DNA1, DNA2 eFUSEs - ie, a red key) using the KEK. The encryption key generated this way is cryptographically strong and will be used as the device HUK (ie, black key).
Test code:
csu_aes_encrypt_data(src, dst, BLOB_DATA_SIZE, tag, GCM_TAG_SIZE, iv, GCM_IV_SIZE, CSU_AES_KEY_SRC_DEV); csu_aes_decrypt_data(dst, src, BLOB_DATA_SIZE, tag, GCM_TAG_SIZE, iv, GCM_IV_SIZE, CSU_AES_KEY_SRC_DEV); if (memcmp(src, buffer, BLOB_DATA_SIZE)) { EMSG(" - encrypt/decrypt test failed");
Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io> Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 3e0615de | 04-Oct-2021 |
Jorge Ramirez-Ortiz <jorge@foundries.io> |
zynqmp: register the CSU memory with the platform
The CSU memory block that will be mapped from different drivers (ie, PUF, AES-GCM, SHA..)
Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io> R
zynqmp: register the CSU memory with the platform
The CSU memory block that will be mapped from different drivers (ie, PUF, AES-GCM, SHA..)
Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io> Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 3f32e62a | 13-Oct-2021 |
Jorge Ramirez-Ortiz <jorge@foundries.io> |
zynqmp: define the STACK_ALIGNMENT in terms of CACHELINE
Explicitily define the cache line length
Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io> Acked-by: Etienne Carriere <etienne.carrier
zynqmp: define the STACK_ALIGNMENT in terms of CACHELINE
Explicitily define the cache line length
Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io> Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|