Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2150657/?format=api
{ "id": 2150657, "url": "http://patchwork.ozlabs.org/api/patches/2150657/?format=api", "web_url": "http://patchwork.ozlabs.org/project/uboot/patch/20251015104702.3726411-5-anshuld@ti.com/", "project": { "id": 18, "url": "http://patchwork.ozlabs.org/api/projects/18/?format=api", "name": "U-Boot", "link_name": "uboot", "list_id": "u-boot.lists.denx.de", "list_email": "u-boot@lists.denx.de", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20251015104702.3726411-5-anshuld@ti.com>", "list_archive_url": null, "date": "2025-10-15T10:46:46", "name": "[v2,4/5] doc: develop: add docs for secure falcon mode", "commit_ref": null, "pull_url": null, "state": "changes-requested", "archived": false, "hash": "0ba18773919ad325565293691c2e6f64f8650e67", "submitter": { "id": 90324, "url": "http://patchwork.ozlabs.org/api/people/90324/?format=api", "name": "Anshul Dalal", "email": "anshuld@ti.com" }, "delegate": { "id": 3651, "url": "http://patchwork.ozlabs.org/api/users/3651/?format=api", "username": "trini", "first_name": "Tom", "last_name": "Rini", "email": "trini@ti.com" }, "mbox": "http://patchwork.ozlabs.org/project/uboot/patch/20251015104702.3726411-5-anshuld@ti.com/mbox/", "series": [ { "id": 477852, "url": "http://patchwork.ozlabs.org/api/series/477852/?format=api", "web_url": "http://patchwork.ozlabs.org/project/uboot/list/?series=477852", "date": "2025-10-15T10:46:42", "name": "Allow falcon boot from A-core SPL on K3 devices", "version": 2, "mbox": "http://patchwork.ozlabs.org/series/477852/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2150657/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2150657/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<u-boot-bounces@lists.denx.de>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=ti.com header.i=@ti.com header.a=rsa-sha256\n header.s=ti-com-17Q1 header.b=eEg5L+DO;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de\n (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de;\n envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org)", "phobos.denx.de;\n dmarc=pass (p=quarantine dis=none) header.from=ti.com", "phobos.denx.de;\n spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de", "phobos.denx.de;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=ti.com header.i=@ti.com header.b=\"eEg5L+DO\";\n\tdkim-atps=neutral", "phobos.denx.de;\n dmarc=pass (p=quarantine dis=none) header.from=ti.com", "phobos.denx.de; spf=pass smtp.mailfrom=anshuld@ti.com" ], "Received": [ "from phobos.denx.de (phobos.denx.de\n [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange X25519 server-signature ECDSA (secp384r1))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4cmnq951Ksz1xvV\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 15 Oct 2025 21:47:49 +1100 (AEDT)", "from h2850616.stratoserver.net (localhost [IPv6:::1])\n\tby phobos.denx.de (Postfix) with ESMTP id EBE2B80107;\n\tWed, 15 Oct 2025 12:47:18 +0200 (CEST)", "by phobos.denx.de (Postfix, from userid 109)\n id E2DF88313B; Wed, 15 Oct 2025 12:47:17 +0200 (CEST)", "from fllvem-ot04.ext.ti.com (fllvem-ot04.ext.ti.com [198.47.19.246])\n (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256\n bits)) (No client certificate requested)\n by phobos.denx.de (Postfix) with ESMTPS id 3CA5580107\n for <u-boot@lists.denx.de>; Wed, 15 Oct 2025 12:47:15 +0200 (CEST)", "from lelvem-sh02.itg.ti.com ([10.180.78.226])\n by fllvem-ot04.ext.ti.com (8.15.2/8.15.2) with ESMTP id 59FAlD8H1736242;\n Wed, 15 Oct 2025 05:47:13 -0500", "from DFLE215.ent.ti.com (dfle215.ent.ti.com [10.64.6.73])\n by lelvem-sh02.itg.ti.com (8.18.1/8.18.1) with ESMTPS id 59FAlD691166534\n (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL);\n Wed, 15 Oct 2025 05:47:13 -0500", "from DFLE201.ent.ti.com (10.64.6.59) by DFLE215.ent.ti.com\n (10.64.6.73) with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Wed, 15 Oct\n 2025 05:47:13 -0500", "from lelvem-mr05.itg.ti.com (10.180.75.9) by DFLE201.ent.ti.com\n (10.64.6.59) with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20 via Frontend\n Transport; Wed, 15 Oct 2025 05:47:13 -0500", "from localhost (dhcp-172-24-233-105.dhcp.ti.com [172.24.233.105])\n by lelvem-mr05.itg.ti.com (8.18.1/8.18.1) with ESMTP id 59FAlB5d1778527;\n Wed, 15 Oct 2025 05:47:12 -0500" ], "X-Spam-Checker-Version": "SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de", "X-Spam-Level": "", "X-Spam-Status": "No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,\n DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,\n RCVD_IN_DNSWL_BLOCKED,RCVD_IN_VALIDITY_CERTIFIED_BLOCKED,\n RCVD_IN_VALIDITY_RPBL_BLOCKED,SPF_HELO_PASS,SPF_PASS autolearn=ham\n autolearn_force=no version=3.4.2", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=ti.com;\n s=ti-com-17Q1; t=1760525233;\n bh=gKV3SRfUzN7SeIQatqXcBImL6Um2zlARTH4l12I5c58=;\n h=From:To:CC:Subject:Date:In-Reply-To:References;\n b=eEg5L+DOsXhe8L8J1tCKlR5CGesPufUXrjsTwlNaulZ/Ev2Ni2+j4Yc+szQl1DsuR\n 3ap1PzfVEZoNJFN1a6O97QbQREKgTbXlQJ5cF3hqbWWVgkC7sh5JfCoksHfw6lFG1p\n hU4SqUdnPk2apMIq66G8W1WPmxSncRy6XXq0nIzA=", "From": "Anshul Dalal <anshuld@ti.com>", "To": "<u-boot@lists.denx.de>", "CC": "Anshul Dalal <anshuld@ti.com>, <vigneshr@ti.com>, <trini@konsulko.com>,\n <afd@ti.com>, <m-chawdhry@ti.com>, <n-francis@ti.com>, <b-liu@ti.com>,\n <nm@ti.com>, <bb@ti.com>", "Subject": "[PATCH v2 4/5] doc: develop: add docs for secure falcon mode", "Date": "Wed, 15 Oct 2025 16:16:46 +0530", "Message-ID": "<20251015104702.3726411-5-anshuld@ti.com>", "X-Mailer": "git-send-email 2.51.0", "In-Reply-To": "<20251015104702.3726411-1-anshuld@ti.com>", "References": "<20251015104702.3726411-1-anshuld@ti.com>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "Content-Type": "text/plain", "X-C2ProcessedOrg": "333ef613-75bf-4e12-a4b1-8e3623f5dcea", "X-BeenThere": "u-boot@lists.denx.de", "X-Mailman-Version": "2.1.39", "Precedence": "list", "List-Id": "U-Boot discussion <u-boot.lists.denx.de>", "List-Unsubscribe": "<https://lists.denx.de/options/u-boot>,\n <mailto:u-boot-request@lists.denx.de?subject=unsubscribe>", "List-Archive": "<https://lists.denx.de/pipermail/u-boot/>", "List-Post": "<mailto:u-boot@lists.denx.de>", "List-Help": "<mailto:u-boot-request@lists.denx.de?subject=help>", "List-Subscribe": "<https://lists.denx.de/listinfo/u-boot>,\n <mailto:u-boot-request@lists.denx.de?subject=subscribe>", "Errors-To": "u-boot-bounces@lists.denx.de", "Sender": "\"U-Boot\" <u-boot-bounces@lists.denx.de>", "X-Virus-Scanned": "clamav-milter 0.103.8 at phobos.denx.de", "X-Virus-Status": "Clean" }, "content": "This patch documents the newly added SPL_OS_BOOT_SECURE option that\nenables authenticated boot in falcon mode.\n\nThe document provides steps for using secure falcon mode on ARM64 taking\nTI's AM62x EVM as an example.\n\nSigned-off-by: Anshul Dalal <anshuld@ti.com>\n---\n doc/develop/falcon.rst | 252 +++++++++++++++++++++++++++++++++++++++++\n 1 file changed, 252 insertions(+)", "diff": "diff --git a/doc/develop/falcon.rst b/doc/develop/falcon.rst\nindex 5689d5b93a7..528a9c389bf 100644\n--- a/doc/develop/falcon.rst\n+++ b/doc/develop/falcon.rst\n@@ -82,6 +82,14 @@ CONFIG_CMD_SPL_WRITE_SIZE\n CONFIG_SPL_OS_BOOT\n Activate Falcon Mode.\n \n+CONFIG_SPL_OS_BOOT_ARGS\n+ Allow SPL to load args file for the kernel in Falcon Mode. This option can\n+ be disabled if the device-tree is packaged directly in the FIT payload.\n+\n+CONFIG_SPL_OS_BOOT_SECURE\n+ Enable secure boot for Falcon Mode, which provides an additional layer of\n+ security by authenticating the boot process using a signed FIT image.\n+\n Function that a board must implement\n ------------------------------------\n \n@@ -187,6 +195,250 @@ Falcon Mode was presented at the RMLL 2012. Slides are available at:\n \n http://schedule2012.rmll.info/IMG/pdf/LSM2012_UbootFalconMode_Babic.pdf\n \n+Secure Falcon Mode\n+------------------\n+\n+Introduction\n+~~~~~~~~~~~~\n+\n+Secure Falcon Mode is an enhancement to Falcon Mode that provides additional\n+security features. It authenticates the boot process using a signed FIT Image\n+and restricts certain features that are inherently insecure.\n+\n+Configuration\n+~~~~~~~~~~~~~\n+\n+To enable Secure Falcon Mode, the ``CONFIG_SPL_OS_BOOT_SECURE`` option must be\n+set. This option modifies the behavior of Falcon Mode in the following ways:\n+\n+1. Fallback Mechanism:\n+^^^^^^^^^^^^^^^^^^^^^^\n+\n+Unlike regular Falcon Mode, which falls back to the standard U-Boot boot flow\n+if kernel booting fails, Secure Falcon Mode disables this fallback mechanism. If\n+the secure boot process fails, the boot process will not proceed.\n+\n+2. Signed FIT Image:\n+^^^^^^^^^^^^^^^^^^^^\n+\n+Secure Falcon Mode requires a signed FIT, which contains the kernel and\n+device tree, to boot the system. The ``falcon_args_file`` environment variable\n+is ignored, and instead, the device tree is read from the signed FIT. This\n+ensures the authenticity and integrity of the boot process.\n+\n+Example\n+~~~~~~~\n+\n+Secure falcon mode can be enabled on TI AM62x EVM as follows with SD boot mode:\n+\n+1. Prepare the device-tree:\n+^^^^^^^^^^^^^^^^^^^^^^^^^^^\n+\n+To optimize performance, the SPL in Falcon Mode expects the FIT to contain a\n+device-tree with fixups already applied. Such a device-tree can be generated\n+using the spl export command as follows:\n+\n+**Setting bootargs**\n+\n+Set the bootargs environment variable to the desired value:\n+\n+.. prompt:: bash =>\n+\n+ env set bootargs 'console=ttyS2,115200n8 root=/dev/mmcblk1p2 rw rootfstype=ext4 rootwait'\n+\n+**Read FIT from SD**\n+\n+Load the FIT image from the SD card:\n+\n+.. prompt:: bash =>\n+\n+ load mmc 1:2 0x90000000 /boot/fitImage\n+\n+**Generate device-tree**\n+\n+Use the ``spl export`` command to generate a device-tree with fixups applied:\n+\n+.. prompt:: bash =>\n+\n+ spl export fdt 0x90000000\n+\n+**Save the device-tree**\n+\n+Write the generated device-tree to the SD card:\n+\n+.. prompt:: bash =>\n+\n+ fatwrite mmc 1:1 $fdtargsaddr k3-am625-sk-falcon.dtb $fdtargslen\n+\n+2. Create the FIT Image:\n+^^^^^^^^^^^^^^^^^^^^^^^^\n+\n+Create a new FIT image that includes the fixed device-tree generated in the\n+previous step. You will also need to add a signature node to the SPL's DTB\n+containing the keys to authenticate the new FIT.\n+\n+Create a ``fitImage.its`` file with the following contents:\n+\n+.. code-block:: dts\n+\n+ /dts-v1/;\n+\n+ / {\n+ description = \"Kernel fitImage\";\n+ #address-cells = <1>;\n+\n+ images {\n+ kernel {\n+ description = \"Linux kernel\";\n+ data = /incbin/(\"Image\");\n+ type = \"kernel\";\n+ arch = \"arm64\";\n+ os = \"linux\";\n+ compression = \"none\";\n+ load = <0x82000000>;\n+ entry = <0x82000000>;\n+ hash-1 {\n+ algo = \"sha512\";\n+ };\n+ };\n+\n+ fdt-falcon {\n+ description = \"Flattened Device Tree blob\";\n+ data = /incbin/(\"k3-am625-sk-falcon.dtb\");\n+ type = \"flat_dt\";\n+ arch = \"arm64\";\n+ compression = \"none\";\n+ load = <0x88000000>;\n+ entry = <0x88000000>;\n+ hash-1 {\n+ algo = \"sha512\";\n+ };\n+ };\n+ };\n+\n+ configurations {\n+ default = \"conf-ti_am625\";\n+\n+ conf-ti_am625 {\n+ description = \"Linux kernel, FDT blob\";\n+ kernel = \"kernel\";\n+ fdt = \"fdt-falcon\";\n+ hash-1 {\n+ algo = \"sha512\";\n+ };\n+\n+ signature-1 {\n+ algo = \"sha512,rsa4096\";\n+ key-name-hint = \"custMpk\";\n+ padding = \"pkcs-1.5\";\n+ sign-images = \"kernel\", \"fdt-falcon\";\n+ };\n+ };\n+ };\n+ };\n+\n+Then, use the mkimage tool to create the FIT image and modify SPL's DTB:\n+\n+.. prompt:: bash $\n+\n+ tools/mkimage -f fitImage.its -K build/spl/dts/ti/k3-am625-sk.dtb -k arch/arm/mach-k3/keys -r fitImage\n+\n+3. Rebuild U-Boot SPL:\n+^^^^^^^^^^^^^^^^^^^^^^\n+\n+With the newly created ``fitImage`` written to the boot partition of the SD card\n+and the keys added to the SPL's device-tree, you can rebuild the SPL with the\n+following configuration fragment to enable Falcon Mode:\n+\n+::\n+\n+ CONFIG_SPL_OS_BOOT=y\n+ CONFIG_SPL_OS_BOOT_SECURE=y\n+ CONFIG_SPL_FIT_SIGNATURE=y\n+ CONFIG_SPL_RSA=y\n+\n+ # Only support MMC falcon mode\n+ CONFIG_SPL_SPI_FLASH_SUPPORT=n\n+ CONFIG_SPL_NOR_SUPPORT=n\n+ CONFIG_SPL_NAND_SUPPORT=n\n+\n+ # We don't need TIFS authenticating the FIT\n+ CONFIG_SPL_FIT_IMAGE_POST_PROCESS=n\n+\n+ # Modify memory map to allow more space for the larger FIT\n+ CONFIG_SPL_STACK_R_ADDR=0x88000000\n+ CONFIG_SPL_LOAD_FIT_ADDRESS=0x82000000\n+ CONFIG_SPL_STACK_R_MALLOC_SIMPLE_LEN=0x4000000\n+\n+Console Log\n+~~~~~~~~~~~\n+\n+The following console log output shows the boot process with Secure Falcon Mode\n+enabled:\n+\n+::\n+\n+ U-Boot SPL 2025.10-rc5-00482-ge14055bfa9d1-dirty (Oct 09 2025 - 14:31:50 +0530)\n+ SYSFW ABI: 4.0 (firmware rev 0x000b '11.0.7--v11.00.07 (Fancy Rat)')\n+ SPL initial stack usage: 1968 bytes\n+ Trying to boot from MMC2\n+ ## Checking hash(es) for config conf-ti_am625 ... sha512,rsa4096:custMpk+ OK\n+ ## Checking hash(es) for Image kernel ... sha512+ OK\n+ ## Checking hash(es) for Image fdt-falcon ... sha512+ OK\n+ [ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]\n+ [ 0.000000] Linux version 6.6.58-ti-01497-ga7758da17c28-dirty (oe-user@oe-host) (aarch64-oe-linux-gcc (GCC) 14.2.0, GNU ld (GNU Binutils) 2.43.1\n+ .20241111) #1 SMP PREEMPT Wed Nov 27 13:23:15 UTC 2024\n+ [ 0.000000] KASLR enabled\n+ [ 0.000000] Machine model: Texas Instruments AM625 SK\n+ [ 0.000000] efi: UEFI not found.\n+ [ 0.000000] Reserved memory: created CMA memory pool at 0x00000000f8000000, size 128 MiB\n+ [ 0.000000] OF: reserved mem: initialized node linux,cma, compatible id shared-dma-pool\n+ [ 0.000000] OF: reserved mem: 0x00000000f8000000..0x00000000ffffffff (131072 KiB) map reusable linux,cma\n+ [ 0.000000] OF: reserved mem: 0x0000000080000000..0x000000008007ffff (512 KiB) nomap non-reusable tfa@80000000\n+ [ 0.000000] OF: reserved mem: 0x000000009c700000..0x000000009c7fffff (1024 KiB) map non-reusable ramoops@9c700000\n+ [ 0.000000] Reserved memory: created DMA memory pool at 0x000000009c800000, size 3 MiB\n+ [ 0.000000] OF: reserved mem: initialized node ipc-memories@9c800000, compatible id shared-dma-pool\n+ [ 0.000000] OF: reserved mem: 0x000000009c800000..0x000000009cafffff (3072 KiB) nomap non-reusable ipc-memories@9c800000\n+ [ 0.000000] Reserved memory: created DMA memory pool at 0x000000009cb00000, size 1 MiB\n+ [ 0.000000] OF: reserved mem: initialized node m4f-dma-memory@9cb00000, compatible id shared-dma-pool\n+ [ 0.000000] OF: reserved mem: 0x000000009cb00000..0x000000009cbfffff (1024 KiB) nomap non-reusable m4f-dma-memory@9cb00000\n+ [ 0.000000] Reserved memory: created DMA memory pool at 0x000000009cc00000, size 14 MiB\n+ [ 0.000000] OF: reserved mem: initialized node m4f-memory@9cc00000, compatible id shared-dma-pool\n+ [ 0.000000] OF: reserved mem: 0x000000009cc00000..0x000000009d9fffff (14336 KiB) nomap non-reusable m4f-memory@9cc00000\n+ [ 0.000000] Reserved memory: created DMA memory pool at 0x000000009da00000, size 1 MiB\n+ [ 0.000000] OF: reserved mem: initialized node r5f-dma-memory@9da00000, compatible id shared-dma-pool\n+ [ 0.000000] OF: reserved mem: 0x000000009da00000..0x000000009dafffff (1024 KiB) nomap non-reusable r5f-dma-memory@9da00000\n+ [ 0.000000] Reserved memory: created DMA memory pool at 0x000000009db00000, size 12 MiB\n+ [ 0.000000] OF: reserved mem: initialized node r5f-memory@9db00000, compatible id shared-dma-pool\n+ [ 0.000000] OF: reserved mem: 0x000000009db00000..0x000000009e6fffff (12288 KiB) nomap non-reusable r5f-memory@9db00000\n+ [ 0.000000] OF: reserved mem: 0x000000009e800000..0x000000009fffffff (24576 KiB) nomap non-reusable optee@9e800000\n+ [ 0.000000] Zone ranges:\n+ [ 0.000000] DMA [mem 0x0000000080000000-0x00000000ffffffff]\n+ [ 0.000000] DMA32 empty\n+ [ 0.000000] Normal empty\n+ [ 0.000000] Movable zone start for each node\n+ [ 0.000000] Early memory node ranges\n+ [ 0.000000] node 0: [mem 0x0000000080000000-0x000000008007ffff]\n+ [ 0.000000] node 0: [mem 0x0000000080080000-0x000000009c7fffff]\n+ [ 0.000000] node 0: [mem 0x000000009c800000-0x000000009e6fffff]\n+ [ 0.000000] node 0: [mem 0x000000009e700000-0x000000009e7fffff]\n+ [ 0.000000] node 0: [mem 0x000000009e800000-0x000000009fffffff]\n+ [ 0.000000] node 0: [mem 0x00000000a0000000-0x00000000ffffffff]\n+ [ 0.000000] Initmem setup node 0 [mem 0x0000000080000000-0x00000000ffffffff]\n+ [ 0.000000] psci: probing for conduit method from DT.\n+ [ 0.000000] psci: PSCIv1.1 detected in firmware.\n+ [ 0.000000] psci: Using standard PSCI v0.2 function IDs\n+ [ 0.000000] psci: Trusted OS migration not required\n+ [ 0.000000] psci: SMC Calling Convention v1.5\n+ [ 0.000000] percpu: Embedded 20 pages/cpu s43176 r8192 d30552 u81920\n+ [ 0.000000] Detected VIPT I-cache on CPU0\n+ [ 0.000000] CPU features: detected: GIC system register CPU interface\n+ [ 0.000000] CPU features: kernel page table isolation forced ON by KASLR\n+ [ 0.000000] CPU features: detected: Kernel page table isolation (KPTI)\n+ [ 0.000000] CPU features: detected: ARM erratum 845719\n+ [ 0.000000] alternatives: applying boot alternatives\n+ [ 0.000000] Kernel command line: console=ttyS2,115200n8 root=/dev/mmcblk1p2 rw rootfstype=ext4 rootwait\n+\n Falcon Mode Boot on RISC-V\n --------------------------\n \n", "prefixes": [ "v2", "4/5" ] }