wolfBoot ZynqMP FSBL: signed FIT Linux boot + direct-EL3 security (eFuse / PUF / AES-CSU)#817
Draft
dgarske wants to merge 1 commit into
Draft
wolfBoot ZynqMP FSBL: signed FIT Linux boot + direct-EL3 security (eFuse / PUF / AES-CSU)#817dgarske wants to merge 1 commit into
dgarske wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds a ZynqMP (ZCU102) “wolfBoot as FSBL replacement” boot flow, where BootROM loads wolfBoot into OCM at EL3, wolfBoot performs PS init (psu_init), verifies a signed FIT (kernel/DTB/optional BL31), and optionally hands off to TF-A BL31 for Linux boot.
Changes:
- Add ZynqMP FSBL-replacement build configuration, OCM linker script, PS-init shims, and PMU configuration-object support.
- Add BL31 handoff plumbing (handoff parameter block + PMU scratch registers) and TF-A patch for DTB forwarding to direct-kernel BL33.
- Rework ZynqMP GQSPI read path and add diagnostics to improve reliability for large QSPI DMA reads.
Reviewed changes
Copilot reviewed 25 out of 25 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| tools/scripts/zcu102/zynqmp_wolfboot_fsbl.bif | Bootgen BIF for BootROM loading wolfBoot as bootloader (FSBL replacement). |
| tools/scripts/zcu102/zynqmp_wolfboot_fsbl_auth.bif | Authenticated Bootgen BIF (RSA) for hardware root-of-trust boot. |
| tools/scripts/zcu102/zcu102-ca53-qspi.cmm | TRACE32 script update for flashing signed FIT to the boot partition offset. |
| tools/scripts/zcu102/tf-a-zynqmp-wolfboot-dtb.patch | TF-A patch to forward DTB pointer to direct-kernel BL33 via PMU scratch. |
| src/update_ram.c | RAM boot path updates: improved overlap check, QSPI load diagnostics, optional BL31 load/handoff. |
| src/update_disk.c | Disk boot path updates: optional BL31 load/handoff from FIT. |
| src/boot_aarch64.c | Add EL3 exception reporting handlers for improved fault visibility. |
| src/boot_aarch64_start.S | FSBL-replacement timer-frequency behavior and new EL3→BL31 handoff routine. |
| include/wolfboot_smc.h | New SMC ABI definition for wolfBoot EL3 monitor services and shared-memory region. |
| hal/zynqmp/xil_io.h | Minimal Xilinx-compatible MMIO/types shim for unmodified psu_init_gpl.c. |
| hal/zynqmp/sleep.h | Minimal Xilinx-compatible sleep/usleep shim API for psu_init_gpl.c. |
| hal/zynqmp_psu_shim.c | Delay/timer primitives and psu_init wrapper sequence (incl. optional SERDES and debug markers). |
| hal/zynqmp_ocm.ld | New linker script to run wolfBoot entirely from OCM for FSBL-replacement boot. |
| hal/zynqmp_fsbl.its | FIT source for kernel+DTB+BL31 packaging for wolfBoot FSBL-replacement boot. |
| hal/zynqmp_atf.h | BL31 handoff API for wolfBoot-as-FSBL. |
| hal/zynqmp_atf.c | BL31 handoff parameter block construction + PMU scratch publication + EL3 teardown/branch. |
| hal/zynq.h | Add GQSPI DMA max-chunk configuration constant. |
| hal/zynq.c | Significant QSPI DMA/read sequencing changes, cache maintenance adjustments, and FSBL-mode PM config loading. |
| hal/board/zynqmp/README.txt | Documentation for supplying board-generated psu_init_gpl.* into the build. |
| hal/board/zynqmp/pm_cfg_obj.c | PMU configuration object blob for ZCU102/design permissions (EEMI table). |
| hal/board/zynqmp/.gitignore | Ignore board-generated psu_init_gpl.* artifacts. |
| docs/Targets.md | Add a documented ZynqMP FSBL-replacement target and boot flow instructions. |
| config/examples/zynqmp_fsbl.config | New FSBL-replacement QSPI configuration example. |
| config/examples/zynqmp_fsbl_sd.config | New FSBL-replacement SD configuration example. |
| arch.mk | Build-system integration for FSBL-replacement (OCM link, psu_init integration, optional PM config/SERDES). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
dgarske
changed the title
…ity (eFuse/PUF/AES-CSU)
Comment on lines
+685
to
+689
| flush_dcache_range((unsigned long)iv, (unsigned long)iv + CSU_AES_IV_SZ); | ||
| flush_dcache_range((unsigned long)in, | ||
| (unsigned long)in + sz + CSU_AES_GCM_TAG_SZ); | ||
| flush_dcache_range((unsigned long)out, | ||
| (unsigned long)out + sz + CSU_AES_GCM_TAG_SZ); |
Comment on lines
+756
to
+763
| if (ret == 0) | ||
| ret = csu_dma_transfer(CSUDMA_CH_SRC, (uintptr_t)in, sz, | ||
| CSUDMA_SIZE_LAST_WORD); | ||
| if (ret == 0 && csu_dma_wait_done(CSUDMA_CH_SRC) != 0) | ||
| ret = -11; /* ciphertext transfer timeout */ | ||
| if (ret == 0) | ||
| ret = csu_dma_transfer(CSUDMA_CH_SRC, (uintptr_t)(in + sz), | ||
| CSU_AES_GCM_TAG_SZ, CSUDMA_SIZE_LAST_WORD); |
| } | ||
| load_address = new_load; | ||
| } | ||
| #if defined(WOLFBOOT_ZYNQMP_FSBL) |
Comment on lines
+778
to
+780
| /* Invalidate the DMA-written output so the CPU reads fresh data */ | ||
| flush_dcache_range((unsigned long)out, | ||
| (unsigned long)out + sz + CSU_AES_GCM_TAG_SZ); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds support for running wolfBoot as the Xilinx ZynqMP FSBL replacement (ZCU102 / xczu9eg). The BootROM authenticates and loads wolfBoot into OCM at EL3; wolfBoot runs
psu_init()(PLLs/DDR/MIO/clocks/PS-GTR serdes), loads and verifies a signed FIT (kernel + ATF/BL31 + FDT) from QSPI with its own keys, loads the PMU configuration object over the APU->PMU IPI, and hands off to BL31 which drops to Linux. Validated end-to-end on real hardware to apetalinux login:prompt.On top of the boot path, this adds direct-at-EL3 access to the CSU / eFuse / PUF / AES engines for FSBL mode, where the usual SMC-to-ATF path is unavailable (there is no ATF beneath wolfBoot).
What's included
psu_initshim (timer/serdes), PMU config-object load, BL31 (TF-A) handoff viaPMU_GLOBALscratch registers, signed-FIT load/verify. New configconfig/examples/zynqmp_fsbl.config(+ SD variant); build withZYNQMP_FSBL=1.pmu_mmio_read/writeuse direct MMIO underWOLFBOOT_ZYNQMP_FSBLand the existing SMC path in BL33 mode, so the wholecsu_*tree works in both without change.ZYNQMP_SEC=1): read-only dump of the eFuse cache (SEC_CTRL, PPK0 hash, PUF CHASH/AUX) directly from the controller at EL3.wc_Sha3_384_*.csu_puf_*/csu_aescode.csu_aesis refactored tocsu_aes_ex(selectable key source + KUP load) with the device-key wrapper preserved.WOLFBOOT_ORIGIN(and hardened against a wrapped end address), and the EL3 exception printers are gated onDEBUG_UARTso release EL3 targets (e.g.nxp_ls1028a) keep the silent stub.Hardware validation (ZCU102)
Testing / build coverage
tools/unit-tests: 19/19 pass, including newunit-update-ramoverlap-predicate cases.ZYNQMP_SEC, and PUF/AES self-tests), a normal ZynqMP BL33 target withHW_SHA3=1(CSU SHA3 HAL intact), andnxp_ls1028a(bothDEBUG_UARTsettings).ZYNQMP_PUF_SELFTEST/ZYNQMP_AES_SELFTEST).Notes for reviewers
psu_init_gpl.candpm_cfg_obj.c(Xilinx-tool-generated numeric design data) are supplied at build time fromZYNQMP_PSU_INIT_DIRand are not part of this tree.xlnx_rebase_v2.12) plus the small in-tree DTB-forwarding patch undertools/scripts/zcu102/.docs/Targets.mdfor the ZynqMP FSBL section and packaging (bootgenBIF files undertools/scripts/zcu102/).