We already support creating a load option where the device-path
field contains the concatenation of the binary device-path and
optionally the device path of the initrd which we expose via the
EFI_LOAD_FILE2_PROTOCOL.
Allow to append another device-path pointing to the device-tree
identified by the device-tree GUID.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com> Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
We already support creating a load option where the device-path
field contains the concatenation of the binary device-path and
optionally the device path of the initrd which we expose via the
EFI_LOAD_FILE2_PROTOCOL.
Allow to append another device-path pointing to the device-tree
identified by the device-tree GUID.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com> Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
efi_loader: allow concatenation with contained end node
Allow appending a device-path to a device-path that contains an end node
as separator. We need this feature for creating boot options specifying
kernel, initrd, and dtb.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com> Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Roger Quadros [Wed, 15 May 2024 12:20:08 +0000 (15:20 +0300)]
memory: ti-gpmc: use printf to dump settings/timings
pr_info() depends on CONFIG_LOGLEVEL > 6. If user has
enabled CONFIG_TI_GPMC_DEBUG then we should print the
GPMC settings/timings regardless of CONFIG_LOGLEVEL.
Daniel Schultz [Wed, 22 May 2024 07:21:00 +0000 (00:21 -0700)]
include: extension_board: Increase overlay file name size
Upstream overlays like the ARM64 TI
k3-am625-beagleplay-csi2-tevi-ov5640.dtso can easily have more then
32 characters. Increase the overlay length to 64 characters to
apply overlays with longer names.
Signed-off-by: Daniel Schultz <d.schultz@phytec.de> Acked-by: Kory Maincent <kory.maincent@bootlin.com>
Changes in v2:
- Reabse to current next
- Add Tested-by: John Ma <jma@phytec.com>
- Add Kconfig option to select RAM size statically
- Make board/phytec/common/k3 always compile for CONFIG_ARCH_K3
Wadim Egorov [Wed, 22 May 2024 07:55:05 +0000 (09:55 +0200)]
board: phytec: am62x: Add support for 1 & 4 GB RAM variants
Use content of EEPROM to detect the actual RAM size and adjust
DDR timings, size and banks accordingly.
Also enable the SoM detection per default in the defconfigs.
Signed-off-by: Wadim Egorov <w.egorov@phytec.de> Tested-by: John Ma <jma@phytec.com>
Tom Rini [Fri, 7 Jun 2024 20:02:02 +0000 (14:02 -0600)]
Merge patch series "PHYTEC SOM Detection API v3"
Daniel Schultz <d.schultz@phytec.de> says:
This patch series adds support for the EEPROM v3 API.
V3 is backwards compatible to V2 and therefore, the V2 image still
exists at the beginning. Only the API version changed from 2 to 3.
V3 is a block-based memory layout organized as singled-linked list
with different types of blocks. This is a more flexible approach and
allows us to extend it by more block types in the future.
The V3 data starts with a 8-byte large header which defines the
block count (u8), V3 subversion (u8) and data payload length (u16).
Additionally the header contains a CRC8 checksum a 3 reserved bytes.
Each block starts with a 4-byte large header which defined the
block type (u8), the absolute address of the next block (u16) and a
CRC8 checksum. The content itself is defined via the block type and
we currently have 2 different types:
1) MAC: Contains the Ethernet interface number (u8), MAC address
(6 x u8) and a CRC8 checksum.
Daniel Schultz [Wed, 22 May 2024 06:18:25 +0000 (23:18 -0700)]
board: phytec: common: Add API v3
This API is based on a block structure with a 8 Byte large
API v3 header and various of different blocks following. It extends
our current API v2, which is always 32 Byte large, and is located
directly after v2.
Add the MAC block as first block type. It contains the physical
Ehternet interface number, a MAC address and a CRC checksum over the
MAC payload.
Signed-off-by: Daniel Schultz <d.schultz@phytec.de> Tested-by: Wadim Egorov <w.egorov@phytec.de>
Daniel Schultz [Wed, 22 May 2024 06:18:24 +0000 (23:18 -0700)]
board: phytec: common: Move API v2 init to new function
Move the entire initialization code for API v2 into a dedicated
function. This rework will allow to easily integrate the API v3
as next step during init.
Signed-off-by: Daniel Schultz <d.schultz@phytec.de> Tested-by: Wadim Egorov <w.egorov@phytec.de>
The EEPROM image length for API v2 is fixed to 32 bytes. No need
to use sizeof while this value won't change. This value is
also be required for API v3 to know where the API v3 header starts.
Signed-off-by: Daniel Schultz <d.schultz@phytec.de> Tested-by: Wadim Egorov <w.egorov@phytec.de>
Daniel Schultz [Wed, 22 May 2024 06:18:22 +0000 (23:18 -0700)]
board: phytec: common: Move eeprom read to new function
We need to read multiple times from different offsets in API v3.
Move the EEPROM read logic into a dedicated function to make it
usable multiple times.
Signed-off-by: Daniel Schultz <d.schultz@phytec.de> Tested-by: Wadim Egorov <w.egorov@phytec.de>
Tom Rini [Fri, 7 Jun 2024 20:01:38 +0000 (14:01 -0600)]
Merge patch series "Add remoteproc support for J784S4 SoCs"
Beleswar Padhi <b-padhi@ti.com> says:
Hello All,
This series adds remoteproc support for TI's J784S4 SoCs. The K3 J784S4
SoCs have four dual-core R5F subsystems and four C71x DSP subsystems.
Enable the remoteproc drivers in defconfig and set the rproc firmware
names to add remoteproc support.
Note: No driver changes are required as J784S4 SoCs have the same data
as J721S2 SoCs. Thus, utilize the existing compatible string for driver
probe.
The K3 J784S4 SoC has four dual-core R5F subsystems and four C71x DSP
subsystems. Set config values to enable the remoteproc functionality
with these R5F and DSP subsystems.
Tom Rini [Fri, 7 Jun 2024 20:01:15 +0000 (14:01 -0600)]
Merge patch series "Adding support to load secure firmware for HS devices"
Udit Kumar <u-kumar1@ti.com> says:
Some use case needs rproc firmware to be loaded at u-boot stage,
using following commands at u-boot shell, firmware could be loaded
=> setenv dorprocboot 1
=> run boot_rprocs
For Secure devices, secure version of rproc firmware should be loaded,
which is appended by sec keyword[0].
but currently non-secure firmware is loaded even for secure devices.
So adding support for loading secure firmware on Secured devices.
Manorit Chawdhry [Tue, 21 May 2024 10:56:46 +0000 (16:26 +0530)]
drivers: remoteproc: ti_k3 : enable secure booting with firmware images
Remoteproc firmware images aren't authenticated in the current boot flow.
Authenticates remoteproc firmware images to complete the root of trust
in secure booting.
Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com> Signed-off-by: Simon Glass <sjg@chromium.org> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> # Intel Edison Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Manorit Chawdhry [Tue, 21 May 2024 10:56:45 +0000 (16:26 +0530)]
include: mach-k3: move k3 security functions to security.h
ti_secure_image_post_process and ti_secure_image_check_binary is used
for the authentication purposes in the current boot flow. Authentication
of remoteproc firmware images require ti_secure_image_post_process to be
available outside mach-k3.
Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com> Signed-off-by: Udit Kumar <u-kumar1@ti.com> Signed-off-by: Simon Glass <sjg@chromium.org> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> # Intel Edison Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Tom Rini [Fri, 7 Jun 2024 20:00:26 +0000 (14:00 -0600)]
Merge patch series "k3-j721e: Enable OF_UPSTREAM for J721E"
Neha Malcom Francis <n-francis@ti.com> says:
This series was plucked out from the larger series [1] that did some
templating reformatting and also enabled OF_UPSTREAM for J721E. The
former has been kept aside till all the platforms affected have moved to
using OF_UPSTREAM to have less conflicts while merging.
Patches split J721E EVM and J721E SK to using separate builds, as well
as enable OF_UPSTREAM for both the platforms.
Manually, since SysConfig tool do not have the relevant option,
set PHY_LP4_WDQS_OE_EXTEND to 1.
Since WDQS control mode is required on our modules LPDDR4,
this enables WDQS control mode 1.
Emanuele Ghidoli [Wed, 15 May 2024 08:00:58 +0000 (10:00 +0200)]
arm: dts: k3-am625-verdin: Enable LPDDR4 WDQS control
Manually, since SysConfig tool do not have the relevant option,
set PHY_LP4_WDQS_OE_EXTEND to 1.
Since WDQS control mode is required on our modules LPDDR4,
this enables WDQS control mode 1.
Update the autogenerated LPDDR4 configuration using the latest available
SysConfig tool.
This changes are cosmetic and are made to track the last used tool version.
Tom Rini [Fri, 7 Jun 2024 16:48:41 +0000 (10:48 -0600)]
Merge patch series "'eeprom' command improvements"
Marek Behún <kabel@kernel.org> says:
This series contains improvements for the 'eeprom' command:
- refactors
- fixes
- improvements
- ability to use driver model EEPROMs (uclass UCLASS_I2C_EEPROM)
- more flexible EEPROM layout support
It should not cause any behavior change for any existing board.
This series is a dependency for some DDR issue fixes for Turris Omnia.
I will be sending that one separately.
github PR link (with CI):
https://github.com/u-boot/u-boot/pull/540
- there is a failure for
test.py for sandbox sandbox_clang
but it seems unrelated to these changes
Marek Behún [Tue, 21 May 2024 07:13:35 +0000 (09:13 +0200)]
cmd: eeprom: Extend to EEPROMs probed via driver model
Extend the 'eeprom' command to allow accessing EEPROMs probed via
driver model, uclass UCLASS_I2C_EEPROM.
When the CONFIG_I2C_EEPROM config option is enabled (and so the
i2c-eeprom driver is built), the 'eeprom' command now accepts driver
model device name as EEPROM specifier for the 'eeprom' command, in
addition to the legacy [[bus] devaddr] specifier.
Moreover if no device specifier is given, then the first
UCLASS_I2C_EEPROM device is used, if found.
In preparation for allowing to access eeprom by driver-model device
name, refactor the eeprom device specifier parsing. Instead of filling
two parameters (i2c_bus, i2c_addr), the parsing function now fills one
parameter of type struct eeprom_dev_spec.
Marek Behún [Tue, 21 May 2024 07:13:30 +0000 (09:13 +0200)]
cmd: eeprom: Hide eeprom layout versioning behind a Kconfig option
Add a new Kconfig option EEPROM_LAYOUT_VERSIONS, and hide eeprom
layout versionsing code behind it. Only print the relevant help in
'eeprom' command usage if this option is enabled.
Enable this new option for cm_fx6_defconfig and cm_t43_defconfig.
These are the only boards using EEPROM layout versioning.
Marek Behún [Tue, 21 May 2024 07:13:29 +0000 (09:13 +0200)]
cmd: eeprom: Fix usage help for the eeprom command
The bus and devaddr arguments of the eeprom command are optional, and if
only one is given, it is assumed to be devaddr. Change the usage help
from
<bus> <devaddr>
to
[[bus] [devaddr]
Marek Behún [Tue, 21 May 2024 07:13:27 +0000 (09:13 +0200)]
common: eeprom_field: Fix updating binary field
The __eeprom_field_update_bin() function is expected to parse a hex
string into bytes (potentially in reverse order), but the
simple_strtoul() function is given 0 as base. This does not work since
the string does not contain '0x' prefix. Add explicit base 16.
Marek Behún [Tue, 21 May 2024 07:13:26 +0000 (09:13 +0200)]
common: eeprom_layout: Split field finding code from the field update function
Split the eeprom layout field finding code from the
eeprom_layout_update_field() function in order to make it usable in
alternative implementations of update method.
Marek Behún [Tue, 21 May 2024 07:13:25 +0000 (09:13 +0200)]
common: eeprom_layout: Assign default layout methods and parameters before specific ones
Assign the default eeprom layout parameter .data_size and methods
.print() and .update() before calling eeprom_layout_assign() in
eeprom_layout_setup().
This allows eeprom_layout_assign() to overwrite these if needed.
- Support different RAM sizes on imx8m phycoce boards.
- Support new toradex variants.
- Support Samsung 4GB DDR and Realtek RTL8211E PHY on imx8mm-cl-iot-gate.
- Convert imx8mm-phycore and imx8mp-phycore boards to use OF_UPSTREAM.
Benjamin Hahn [Tue, 28 May 2024 13:35:15 +0000 (15:35 +0200)]
board: phycore_imx8mp: enable setting 2GHz timings without RAM size
make it possible to set the RAM timing frequency statically independent
from the RAM size. Fixed RAM timing frequency can be used while the
RAM size is still determined by the EEPROM image.
Signed-off-by: Benjamin Hahn <B.Hahn@phytec.de> Signed-off-by: Teresa Remmet <t.remmet@phytec.de>
Teresa Remmet [Tue, 28 May 2024 13:35:13 +0000 (15:35 +0200)]
board: phytec: phycore_imx8mp: Add support for different RAM sizes
Add support for different RAM sizes and speed grades on the
phyCORE-i.MX8MP.
Add support for 1GB 1.5GHz, 1GB 2GHz, 4GB 1.5GHz,
4GB 2GHz and 8GB 2GHz RAM.
The RAM size and speed grade is detected by the information
stored in the EEPROM on the SoM.
Yannic Moog [Tue, 28 May 2024 11:25:00 +0000 (13:25 +0200)]
arm: imx8mp-phycore: move to OF_UPSTREAM
The PHYCORE_IMX8MP is used by the phyBOARD-Pollux. Migrate board to
OF_UPSTREAM. Linux kernel device tree for the board can be used as is,
corresponding U-Boot device tree files are removed. U-Boot tweaks are
kept unchanged.
Yannic Moog [Tue, 28 May 2024 11:24:59 +0000 (13:24 +0200)]
arm: imx8mm-phycore: move to OF_UPSTREAM
The PHYCORE_IMX8MM is used by the phyBOARD-Polis and the
phyGATE-Tauri-L. Migrate both boards to OF_UPSTREAM. Linux kernel device
trees for both boards can be used as is, corresponding U-Boot device
tree files are removed. U-Boot tweaks are kept unchanged.
Emanuele Ghidoli [Tue, 28 May 2024 09:59:37 +0000 (11:59 +0200)]
board: toradex: verdin-imx8mm: add 4 GB lpddr4 memory support
Add support for MT53E512M32D1ZW-046 IT:C memory.
This 4 GB memory has 17 row bits instead of 16 and requires 380 ns of
tRFC (tRFCab) instead of 280 ns due to increased channel density to 16 Gb.
Both modifications are retro-compatible with previous memories.
Marek Vasut [Sun, 26 May 2024 18:00:25 +0000 (20:00 +0200)]
ARM: dts: renesas: Switch to using upstream DT on Renesas R8A779H0 V4M
Enable OF_UPSTREAM to use upstream DT and add renesas/ prefix to the
DEFAULT_DEVICE_TREE. And thereby directly build DTB from dts/upstream/src/
including *-u-boot.dtsi files from arch/$(ARCH)/dts/ directory.
This patch finalizes OF_UPSTREAM conversion of R8A779H0 V4M which DTs
landed in Linux 6.9 .
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Acked-by: Sumit Garg <sumit.garg@linaro.org>
Adam Ford [Sat, 1 Jun 2024 14:55:20 +0000 (09:55 -0500)]
configs: rzg2_beacon: Realign ENV location and offset
The ENV size and offset were changed to different
values in Beacon's downstream release. Change them to the
same values as the downstream for consistent behavior.
Signed-off-by: Adam Ford <aford173@gmail.com> Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Adam Ford [Sat, 1 Jun 2024 14:55:19 +0000 (09:55 -0500)]
renesas: beacon-rzg2m: Add Marek to MAINTAINER file
Since any changes to the RZ/G2 family go through Marek's tree,
update the MAINTAINER file to automatically show his name
when running get_maintainer.pl. Without this, he is not
copied.
Signed-off-by: Adam Ford <aford173@gmail.com> Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Marek Vasut [Sun, 19 May 2024 20:40:07 +0000 (22:40 +0200)]
ARM: dts: renesas: Reserve space in 64bit R-Car DTs
Reserve 4 kiB of space in 64bit R-Car DTs when those DTs are compiled
to permit patching in OpTee-OS /firmware node, /reserved-memory node,
possibly also additional /memory@ nodes and RPC node by TFA.
This duplicates behavior in arch/arm/dts/Makefile with OF_UPSTREAM.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Tom Rini [Thu, 30 May 2024 13:07:51 +0000 (07:07 -0600)]
Merge patch series "omap3: igep0x00: Fix boot failure and modernize the boards support"
Javier Martinez Canillas <javier@dowhile0.org> says:
Hello,
I noticed that the IGEPv2 board did not boot anymore with mainline U-Boot.
This was caused by a driver change to allocate its platform data before
relocation and U-Boot not having enough pre-relocation heap size for this.
This series fixes this issue and also makes the board support more modern,
by enabling DM for SPL and migrating the IGEP boards to use upstream DTBs.
The IGEPv2 board boot started to fail since the commit afd4f15a39de ("spi:
omap3_spi: Read platform data in ofdata_to_platdata()"). Because this made
the OMAP3 SPI controller driver to allocate its platform data before doing
a relocation, but the igep0x00 config sets this pool size to just 1 KiB.
Increase the pre-relocation malloc heap size to 16 KiB, as is set by other
OMAP3 boards. This not only restores booting but also makes it consistent.
Leave the SPL pool size to the previous 1 KiB size since 16 KiB may not be
a possible size in that constrained environment and is also the value that
is set by other OMAP3 boards.
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Enric Balletbo i Serra <eballetbo@gmail.com>
H Bell [Wed, 22 May 2024 19:12:51 +0000 (19:12 +0000)]
board: starfive: support Pine64 Star64 board
Add documentation files
Signed-off-by: Henry Bell <dmoo_dv@protonmail.com> Cc: ycliang@andestech.com Cc: heinrich.schuchardt@canonical.com Reviewed-by: E Shattow <lucent@gmail.com>
H Bell [Wed, 22 May 2024 19:12:48 +0000 (19:12 +0000)]
board: starfive: support Pine64 Star64 board
Similar to the Milk-V Mars, The Star64 board contains few differences to the
VisionFive 2 boards, so can be part of the same U-boot build.
Signed-off-by: Henry Bell <dmoo_dv@protonmail.com> Cc: ycliang@andestech.com Cc: heinrich.schuchardt@canonical.com Reviewed-by: E Shattow <lucent@gmail.com>
Conor Dooley [Wed, 15 May 2024 15:04:31 +0000 (16:04 +0100)]
board: microchip: icicle: make both ethernets optional
A given AMP configuration for a board may make either one, or neither
of, the ethernet ports available to U-Boot. The Icicle's init code will
fail if mac1 is not present, so move it to the optional approach taken
for mac0.
Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Reviewed-by: Leo Yu-Chi Liang <ycliang@andestech.com>
Conor Dooley [Wed, 15 May 2024 15:04:30 +0000 (16:04 +0100)]
board: microchip: icicle: correct type for node offset
Node offsets returned by libfdt can contain negative error numbers, so
the variable type should be "int". As things stand, if the ethernet
nodes are not found in the early init callback, the if (node < 0) tests
pass and the code errors out while trying to set the local-mac-address
for a non-existent node.
Quentin Schulz [Fri, 24 May 2024 11:46:36 +0000 (13:46 +0200)]
migrate Theobroma Systems mail addresses to CHERRY Embedded Solutions
See
https://embedded.cherry.de/theobroma-systems-is-now-officially-part-of-cherry-se/
While the mail addresses on the theobroma-systems.com domain should be
redirect to cherry.de, let's anticipate IT hiccups and avoid important
mails not reaching us by swapping the domain name wherever appropriate
for the newer one.
Christoph Mueller isn't working at ~Theobroma~ CHERRY Embedded Solutions
anymore, but I don't know his new mail address so mails destined to him
will keep bouncing.
Cc: Heiko Stuebner <heiko.stuebner@cherry.de> <heiko.stuebner@theobroma-systems.com> Cc: Jakob Unterwurzacher <jakob.unterwurzacher@cherry.de> Cc: Klaus Goger <klaus.goger@cherry.de> Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Bryan Brattlof [Thu, 23 May 2024 16:43:20 +0000 (11:43 -0500)]
arm: mach-k3: am62p: Fixup TF-A/OP-TEE reserved-memory node in FDT
The address we load TFA and OPTEE is configurable by the
CONFIG_K3_{ATF,OPTEE)_LOAD_ADDR, but the DT node reservations remain
static which can cause some confusion about where exactly these firmware
are exactly. Fix this by updating the reserved-memory{} nodes when the
loaded address does not match the address in DT.
Reported-by: Andrew Davis <afd@ti.com> Signed-off-by: Bryan Brattlof <bb@ti.com>
Sam Protsenko [Sat, 25 May 2024 21:51:38 +0000 (16:51 -0500)]
arm: dts: e850-96: Remove not needed bootph-all flags
Most of the nodes in e850-96 appended device tree that add bootph-all
flags are not necessary. All those nodes are instantiated as
dependencies of other nodes anyway. Remove those nodes to avoid
cluttering the appended dts. 'bdinfo' reports 768 bytes reduction for
"Early malloc usage", and 'dm tree' output doesn't change. Keep only
pmu_system_controller changes, which are actually needed for serial to
work properly.
Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org> Signed-off-by: Minkyu Kang <mk7.kang@samsung.com>
Sam Protsenko [Sat, 25 May 2024 21:18:36 +0000 (16:18 -0500)]
arm: exynos: Migrate E850-96 board to OF_UPSTREAM
Use upstream device tree files and bindings. To do so:
- imply (enable) OF_UPSTREAM option for E850-96 target
- point DEFAULT_DEVICE_TREE in E850-96 config to upstream dts
- remove now not needed local dts files, binding docs and headers
- update MAINTAINERS and board/samsung/e850-96/MAINTAINERS
correspondingly
Upstream device tree files for Exynos850 SoC and E850-96 board are
pretty much the same as local (removed) ones, so the conversion is
rather straightforward and painless in this case. The appended dts file
(arch/arm/dts/exynos850-e850-96-u-boot.dtsi) stays unchanged.
The only remaining local dt-bindings doc for E850-96 board is
exynos-pmu.yaml. It wasn't removed as it's quite different from Linux
kernel version. Particularly U-Boot local version of exynos-pmu.yaml
describes "samsung,uart-debug-1" property, which is not present in Linux
kernel binding. Later it might be upstreamed to Linux kernel, and once
it's done the U-Boot exynos-pmu.yaml binding can be removed.
No functional change.
Acked-by: Sumit Garg <sumit.garg@linaro.org> Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org> Signed-off-by: Minkyu Kang <mk7.kang@samsung.com>
Tim Harvey [Sat, 25 May 2024 20:00:49 +0000 (13:00 -0700)]
tpm-v2: allow algorithm name to be configured for pcr_read and pcr_extend
For pcr_read and pcr_extend commands allow the digest algorithm to be
specified by an additional argument. If not specified it will default to
SHA256 for backwards compatibility.
Additionally update test_tpm2.py for the changes in output in pcr_read
which now shows the algo and algo length in the output.
A follow-on to this could be to extend all PCR banks with the detected
algo when the <digest_algo> argument is 'auto'.
Tim Harvey [Wed, 15 May 2024 23:21:38 +0000 (16:21 -0700)]
tpm: display warning if using gpio reset with TPM
Instead of displaying what looks like an error message if a
gpio-reset dt prop is missing for a TPM display a warning that
having a gpio reset on a TPM should not be used for a secure production
device.
TCG TIS spec [1] says:
"The TPM_Init (LRESET#/SPI_RST#) signal MUST be connected to the
platform CPU Reset signal such that it complies with the requirements
specified in section 1.2.7 HOST Platform Reset in the PC Client
Implementation Specification for Conventional BIOS."
The reasoning is that you should not be able to toggle a GPIO and reset
the TPM without resetting the CPU as well because if an attacker can
break into your OS via an OS level security flaw they can then reset the
TPM via GPIO and replay the measurements required to unseal keys
that you have otherwise protected.
Additionally restructure the code for improved readability allowing for
removal of the init label.
Before:
- board with no reset gpio
u-boot=> tpm init && tpm info
tpm_tis_spi_probe: missing reset GPIO
tpm@1 v2.0: VendorID 0x1114, DeviceID 0x3205, RevisionID 0x01 [open]
- board with a reset gpio
u-boot=> tpm init && tpm info
tpm@1 v2.0: VendorID 0x1114, DeviceID 0x3205, RevisionID 0x01 [open]
After:
- board with no reset gpio
u-boot=> tpm init && tpm info
tpm@1 v2.0: VendorID 0x1114, DeviceID 0x3205, RevisionID 0x01 [open]
- board with a reset gpio
u-boot=> tpm init && tpm info
tpm@1: TPM gpio reset should not be used on secure production devices
tpm@1 v2.0: VendorID 0x1114, DeviceID 0x3205, RevisionID 0x01 [open]
projects / u-boot.git / log