{"id":2228195,"url":"http://patchwork.ozlabs.org/api/1.1/covers/2228195/?format=json","web_url":"http://patchwork.ozlabs.org/project/uboot/cover/20260425033742.1519298-1-b-padhi@ti.com/","project":{"id":18,"url":"http://patchwork.ozlabs.org/api/1.1/projects/18/?format=json","name":"U-Boot","link_name":"uboot","list_id":"u-boot.lists.denx.de","list_email":"u-boot@lists.denx.de","web_url":null,"scm_url":null,"webscm_url":null},"msgid":"<20260425033742.1519298-1-b-padhi@ti.com>","date":"2026-04-25T03:37:31","name":"[v4,00/11] Add support to boot TI K3 HSM M4 core","submitter":{"id":88460,"url":"http://patchwork.ozlabs.org/api/1.1/people/88460/?format=json","name":"Padhi, Beleswar","email":"b-padhi@ti.com"},"mbox":"http://patchwork.ozlabs.org/project/uboot/cover/20260425033742.1519298-1-b-padhi@ti.com/mbox/","series":[{"id":501450,"url":"http://patchwork.ozlabs.org/api/1.1/series/501450/?format=json","web_url":"http://patchwork.ozlabs.org/project/uboot/list/?series=501450","date":"2026-04-25T03:37:39","name":"Add support to boot TI K3 HSM M4 core","version":4,"mbox":"http://patchwork.ozlabs.org/series/501450/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/covers/2228195/comments/","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=ti.com header.i=@ti.com header.a=rsa-sha256\n header.s=selector1 header.b=a8ek9myv;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de\n (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de;\n envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org)","phobos.denx.de;\n dmarc=pass (p=quarantine dis=none) header.from=ti.com","phobos.denx.de;\n spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de","phobos.denx.de;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=ti.com header.i=@ti.com header.b=\"a8ek9myv\";\n\tdkim-atps=neutral","phobos.denx.de;\n dmarc=pass (p=quarantine dis=none) header.from=ti.com","phobos.denx.de; spf=pass smtp.mailfrom=b-padhi@ti.com"],"Received":["from phobos.denx.de (phobos.denx.de\n [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g2vvD5Q2kz1y2d\n\tfor ; Sun, 26 Apr 2026 02:10:48 +1000 (AEST)","from h2850616.stratoserver.net (localhost [IPv6:::1])\n\tby phobos.denx.de (Postfix) with ESMTP id 85D10843D1;\n\tSat, 25 Apr 2026 18:10:39 +0200 (CEST)","by phobos.denx.de (Postfix, from userid 109)\n id 08B1E84150; Sat, 25 Apr 2026 18:10:38 +0200 (CEST)","from SN4PR2101CU001.outbound.protection.outlook.com\n (mail-southcentralusazlp170120001.outbound.protection.outlook.com\n [IPv6:2a01:111:f403:c10d::1])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))\n (No client certificate requested)\n by phobos.denx.de (Postfix) with ESMTPS id 07CE584353\n for ; Sat, 25 Apr 2026 18:10:01 +0200 (CEST)","from DM3PR10MB7911.namprd10.prod.outlook.com (2603:10b6:0:1e::20) by\n CY8PR10MB6489.namprd10.prod.outlook.com (2603:10b6:930:5f::22) with\n Microsoft\n SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id\n 15.20.9846.20; Sat, 25 Apr 2026 06:58:13 +0000","from SA9PR13CA0130.namprd13.prod.outlook.com (2603:10b6:806:27::15)\n by DM3PR10MB7911.namprd10.prod.outlook.com (2603:10b6:0:1e::20) with\n Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9846.22; Sat, 25 Apr\n 2026 03:37:50 +0000","from SN1PEPF0002636A.namprd02.prod.outlook.com\n (2603:10b6:806:27:cafe::a6) by SA9PR13CA0130.outlook.office365.com\n (2603:10b6:806:27::15) with Microsoft SMTP Server (version=TLS1_3,\n cipher=TLS_AES_256_GCM_SHA384) id 15.20.9846.19 via Frontend Transport; Sat,\n 25 Apr 2026 03:37:50 +0000","from lewvzet201.ext.ti.com (198.47.23.195) by\n SN1PEPF0002636A.mail.protection.outlook.com (10.167.241.135) with Microsoft\n SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id\n 15.20.9846.18 via Frontend Transport; Sat, 25 Apr 2026 03:37:50 +0000","from DLEE203.ent.ti.com (157.170.170.78) by lewvzet201.ext.ti.com\n (10.4.14.104) with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Fri, 24 Apr\n 2026 22:37:49 -0500","from DLEE203.ent.ti.com (157.170.170.78) by DLEE203.ent.ti.com\n (157.170.170.78) with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Fri, 24 Apr\n 2026 22:37:49 -0500","from lelvem-mr06.itg.ti.com (10.180.75.8) by DLEE203.ent.ti.com\n (157.170.170.78) with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20 via Frontend\n Transport; Fri, 24 Apr 2026 22:37:49 -0500","from uda0510294.dhcp.ti.com (uda0510294.dhcp.ti.com [10.24.50.162])\n by lelvem-mr06.itg.ti.com (8.18.1/8.18.1) with ESMTP id\n 63P3bk7x2903263; Fri, 24 Apr 2026 22:37:46 -0500"],"X-Spam-Checker-Version":"SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de","X-Spam-Level":"","X-Spam-Status":"No, score=-1.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,\n DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,\n RCVD_IN_DNSWL_BLOCKED,SPF_HELO_PASS,T_SPF_PERMERROR autolearn=no\n autolearn_force=no version=3.4.2","ARC-Seal":"i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;\n b=Iw6q5iA+jjwNZwy5AvmEmSEjxYbdHeJ9HdVmVc/qiGnJPnKz4ebzRw7WMArGhdcQtoYcfcMuK3TYRWmcqEVwikKXC1ENzZeLwyauAaKJiJb7rtJGQU5zVJ3BRkkqELcV056hBz/DNj19duEc9hv/154iwLaRYVgvr+Aj8DUk/LhjMRjTEzm61px4ax4Tzr/IySu+S7f+hno/w1DfDfbTkmuNPqi+PPK1gPMyh2i+/CpLRJUi1EzhV6Jv4ti/gmevxAmrwR4WIMcP+CQvlGzqLMRjE3M7TmSD3WSuUaheM043DNYz6nqwvFLirQtz5/VNp9/GkIvONb9Eg7uJOCNtNQ==","ARC-Message-Signature":"i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;\n s=arcselector10001;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;\n bh=vO1PIG5XVx6mitI+Q0zACDtIFRXPfT4yjCw4x9hn1NE=;\n b=AqbMAE+USngioE7Le5B251jvjaw9MX4D1DlBjWFDTOnfxR4OtmcJJbNoU9pO7LGggIX7ITGLpcReB6mKF/CqGaH5vRA92CnNBt/4wAzF18evnht+JRPICdYrviIP+KLbgamF3laZMRMMgSqJ3v20ehjcTpvg1yrtb0FJH89uNxx5DPJfFHHZeqQnUPWg+rtinFM1DIl9hfKgIM9o0myV2YtJP2sy7K+dHI7sl7MZZP9/bvU5YvikFioMC9zDouFgnahWtoRG1RA4TAq3Y6rNkd12/IFlxsbngDsMnW1W2LADAQBTDDZvJwidgAMM7uPmzlB1w8jzy6X9px3j1NwPag==","ARC-Authentication-Results":"i=1; mx.microsoft.com 1; spf=pass (sender ip is\n 198.47.23.195) smtp.rcpttodomain=lists.denx.de smtp.mailfrom=ti.com;\n dmarc=pass (p=quarantine sp=none pct=100) action=none header.from=ti.com;\n dkim=none (message not signed); arc=none (0)","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=ti.com; s=selector1;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;\n bh=vO1PIG5XVx6mitI+Q0zACDtIFRXPfT4yjCw4x9hn1NE=;\n b=a8ek9myvtChdQfg3UYjXwh1fn2eSIyYNftQFZSvTxQM/d4GjapzTI2CnzM2dcqAbnt0NLYiMACUGph5V9hSDd/Oybak01aV6VH2va7XcPDQP5ISN6n7R5GwmU017o8VWAEOYX3+9TSR09UnMetEzVvgpPAXvhzYkXHrgA0iwKX8=","X-MS-Exchange-Authentication-Results":"spf=pass (sender IP is 198.47.23.195)\n smtp.mailfrom=ti.com; dkim=none (message not signed) header.d=none;\n dmarc=pass\n action=none header.from=ti.com;","Received-SPF":"Pass (protection.outlook.com: domain of ti.com designates\n 198.47.23.195 as permitted sender) receiver=protection.outlook.com;\n client-ip=198.47.23.195; helo=lewvzet201.ext.ti.com; pr=C","From":"Beleswar Padhi ","To":"","CC":", , , ,\n , , , ,\n , ","Subject":"[PATCH v4 00/11] Add support to boot TI K3 HSM M4 core","Date":"Sat, 25 Apr 2026 09:07:31 +0530","Message-ID":"<20260425033742.1519298-1-b-padhi@ti.com>","X-Mailer":"git-send-email 2.34.1","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","Content-Type":"text/plain","X-C2ProcessedOrg":"333ef613-75bf-4e12-a4b1-8e3623f5dcea","X-EOPAttributedMessage":"0","X-MS-PublicTrafficType":"Email","X-MS-TrafficTypeDiagnostic":"\n SN1PEPF0002636A:EE_|DM3PR10MB7911:EE_|CY8PR10MB6489:EE_","X-MS-Office365-Filtering-Correlation-Id":"23cac420-2ab0-4e9b-0996-08dea27c0681","X-MS-Exchange-SenderADCheck":"1","X-MS-Exchange-AntiSpam-Relay":"0","X-Microsoft-Antispam":"BCL:0;\n ARA:13230040|376014|1800799024|82310400026|36860700016|18002099003|56012099003;","X-Microsoft-Antispam-Message-Info":"\n LdlzrxK/zPONzBQq2icshVdlnzLe080bS9vmsFtAfRkEx3aCgpOPmNDvPXDNKl1gw7bPNkHCaaXHj4lBje1B56wnt//HnVvmC6D0bOTqjAKnk8aJUcPg3D9Pt1BbeEB+1/73iDDGmUQqwC3Xt6kbTN3vU6lwzNwHtC4KWCWR1WNghRlG/URV54NeKEeMF0EUWiW8NtajfkeIp6Rl34MsHMjAoga9DnoGn0ciUGy1CtpfXmk7sEpPWOujjMuVxMM72vPjPYjcc8evy1WvQPlR3vtW3+6R+DHfB16VoCE5BVRRCzwJgnP6jXGmt8E6XV8ckwu1eBEKZHcJIYhRxtKCLr7kp70tzMqxFnkRDBSYHpLM+tzAidWbRDJASdla1yl7UC/wQ6k128k0AYRjDIg2KrMclHfH9Nz+UNTDKnxIuzf6KyaOCaNSitUgxSa17mRZfvUDX1w+B/2awByzqwRuxtLtnBjqSuHCcn9J9tcypUi93woJHdfWpDmYOWi8wDATz4pM7S47ZxIBasE5F5FAXU+bg7hyEM23rscJdJf0IZHp3jkxiZH8X9ATjZ/C3b00+FpYg4FU2f8pXxbDnZxs88DaCiU2e5x9LHFtE4HUazcCTqdBy6L5oiaCKXxT9bfLbbAn87y5m8lxv0Ves/jGrKdxUcf8g5YJgJ7hdtlBkOciPaWeKpa2AKkoqcs/3X6YkJFzvsjgoh87EqHU79gDhqVVmLkmq79Xj66VnQvN7uemr+j9H9mlSdwadpxCqvt132W1LH8Cs9h1NccKc4Y+hDbtM9ZtMsQ/BENg+SFDYvk=","X-Forefront-Antispam-Report":"CIP:198.47.23.195; CTRY:US; LANG:en; SCL:1; SRV:;\n IPV:NLI; SFV:NSPM; H:lewvzet201.ext.ti.com; PTR:InfoDomainNonexistent;\n CAT:NONE;\n SFS:(13230040)(376014)(1800799024)(82310400026)(36860700016)(18002099003)(56012099003);\n DIR:OUT; SFP:1101;","X-MS-Exchange-AntiSpam-MessageData-ChunkCount":"1","X-MS-Exchange-AntiSpam-MessageData-0":"\n f4kYsOgN5Iq6duz2eP0nw4JeeSE50wbeORiuirgRfGNDjF1xLpkTwB061pzVVArGsAGJjRC5rhopX5cfMg1v+FYkykfW0PCGI4sNQXMlyQoAhDUhObjCF36C+D7fJ7Q3yU6XRxxpiS5avZbwYnHvc8O5acpwkbs2VPjbJIwmK3wrSC+jkitBD4FTWS4h1gKaAtlMfrweP3Vk9Eqqh8CcAyXREul5CHPAKsilF6A2no20LYAuBWGC+D6ioQ5NBxXiaRrLgbx8cGmxP13TG79iuUQTF+upIoW6aqXtWv5Ldq4InUqu3xS0qH7ToxaDHYOWvmEiY55Wrzl59WjFrjYulMDTxnJQIkski+WzFNMhD5I8c/PUx/gDz9/M19cbH35ApaodZx/mNdA37TZW88WgDG/o1iECLFkr5GobzStHpICDR2HRMpafgEqCKd2/SpAV","X-MS-Exchange-CrossTenant-OriginalArrivalTime":"25 Apr 2026 03:37:50.1309 (UTC)","X-MS-Exchange-CrossTenant-Network-Message-Id":"\n 23cac420-2ab0-4e9b-0996-08dea27c0681","X-MS-Exchange-CrossTenant-Id":"e5b49634-450b-4709-8abb-1e2b19b982b7","X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp":"\n TenantId=e5b49634-450b-4709-8abb-1e2b19b982b7; Ip=[198.47.23.195];\n Helo=[lewvzet201.ext.ti.com]","X-MS-Exchange-CrossTenant-AuthSource":"\n SN1PEPF0002636A.namprd02.prod.outlook.com","X-MS-Exchange-CrossTenant-AuthAs":"Anonymous","X-MS-Exchange-CrossTenant-FromEntityHeader":"HybridOnPrem","X-MS-Exchange-Transport-CrossTenantHeadersStamped":"DM3PR10MB7911","X-OriginatorOrg":"ti.com","X-BeenThere":"u-boot@lists.denx.de","X-Mailman-Version":"2.1.39","Precedence":"list","List-Id":"U-Boot discussion ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"u-boot-bounces@lists.denx.de","Sender":"\"U-Boot\" ","X-Virus-Scanned":"clamav-milter 0.103.8 at phobos.denx.de","X-Virus-Status":"Clean"},"content":"Some TI K3 SoCs like J721S2, J784S4, and J722S have a HSM (High Security\nModule) M4F core in the Wakeup Voltage Domain which could be used to\nrun secure services like Authentication. Boot flow for HSM M4 core is\ndifferent than the general purpose M4F cores, and is as below:\n\n1. Request control of HSM M4F remote processor.\n2. Assert Reset on the HSM M4F remote processor.\n3. Request Secure Entity to Authenticate and Load HSM firmware into\n core's internal SRAM memory region. For GP device, load the firmware\n manually into core's SRAM region.\n4. Deassert Reset on the HSM M4F remote processor.\n5. Release control of HSM M4F remote processor.\n\nThis series adds support to boot HSM M4 core from R5 SPL stage. The HSM\nfirmware is packed inside the tispl.bin fit image. The firmware is\nunpacked into a temporary DDR address which is then used to load HSM\ncore. The configs to boot HSM M4 core are disabled by default.\n\nv4: Changelog:\nRe-spinning after Device Tree Syncup happened from Linux to U-Boot.\n[Andrew]:\n 1. Reworded commit message on [PATCH v4 03/11].\n[Simon]:\n 1. Add a binman test for the boot & load extensions in certificate in\n [PATCH v4 08/11].\nGeneral:\n 1. Drop J722S defconfig changes out of this series. Will be\n posted/discussed separately.\n\nLink to v3:\nhttps://lore.kernel.org/all/20251231173621.1069988-1-b-padhi@ti.com/\n\nv3: Changelog:\n[Andrew]:\n 1. Added dedicated remoteproc driver for booting HSM core.\n 2. Added support for signing HSM firmware images in U-Boot. [Anshul]\nGeneral:\n 1. Add support for booting HSM on J722S SoC as well.\n\nLink to v2:\nhttp://lore.kernel.org/all/20250506104202.16741-1-b-padhi@ti.com/\n\nv2: Changelog:\n[Andrew]:\n 1. Added support in SPL to load FIT images with no 'load' property.\n 2. Removed 'default = n' in CONFIG option.\n 3. Used __maybe_unused to decrease preprocessing.\n 4. Better error messages with error code. \n[Udit]:\n 1. Added 'HSM' entries in enum at the last.\n 2. Added error condition in if-elseif-else ladder.\n 3. Hang System boot when HSM failed to boot properly.\n\nLink to v1:\nhttps://lore.kernel.org/all/20250422095430.363792-1-b-padhi@ti.com/\n\nTesting done:\n1. Tested HSM boot across GP, HS-FS, HS-SE device types for J721S2,\nJ784S4 and J722S SoCs.\n\nLogs after enabling HSM boot configs:\nhttps://gist.github.com/3V3RYONE/ad33683652c8c49e4fedab49f0493e79\n\nBeleswar Padhi (11):\n spl: Use FIT data address as fallback when 'load' property is absent\n arm: mach-k3: Use FIT image data addr as fallback if 'load' prop is\n missing\n arm: mach-k3: Explicitly identify TIFSSTUB images when discarding\n buffers\n arm: mach-k3: Add config option for packaging HSM firmware\n arm: dts: k3-binman: Add template for packing HSM firmware\n arm: dts: k3-{j721s2/j722s/j784s4}-binman: Pack HSM firmware inside\n tispl.bin\n binman: openssl: Add boot and load extensions to x509 cert\n tools: binman: Add a test for boot and load extensions\n arm: dts: k3-{j721s2/j722s/j784s4}-r5.dtsi: Enable HSM core\n remoteproc: k3-hsm: Introduce a remoteproc driver for K3 HSM core\n arm: mach-k3: r5: common: Invoke boot of HSM M4 core\n\n MAINTAINERS | 1 +\n arch/arm/dts/k3-binman.dtsi | 20 ++\n arch/arm/dts/k3-j721s2-binman.dtsi | 12 +\n arch/arm/dts/k3-j721s2-r5.dtsi | 5 +\n arch/arm/dts/k3-j722s-binman.dtsi | 12 +\n arch/arm/dts/k3-j722s-r5.dtsi | 5 +\n arch/arm/dts/k3-j784s4-binman.dtsi | 14 +\n arch/arm/dts/k3-j784s4-r5.dtsi | 4 +\n arch/arm/mach-k3/Kconfig | 7 +\n arch/arm/mach-k3/r5/common.c | 42 ++-\n common/spl/spl_fit.c | 16 +-\n drivers/remoteproc/Kconfig | 10 +\n drivers/remoteproc/Makefile | 1 +\n drivers/remoteproc/ti_k3_hsm_rproc.c | 252 ++++++++++++++++++\n tools/binman/btool/openssl.py | 49 +++-\n tools/binman/etype/ti_secure.py | 18 ++\n tools/binman/etype/x509_cert.py | 4 +-\n tools/binman/ftest.py | 10 +\n .../test/vendor/ti_secure_boot_load_ext.dts | 23 ++\n 19 files changed, 496 insertions(+), 9 deletions(-)\n create mode 100644 drivers/remoteproc/ti_k3_hsm_rproc.c\n create mode 100644 tools/binman/test/vendor/ti_secure_boot_load_ext.dts"}