From: Jan Kiszka jan.kiszka@siemens.com

Anything that is not boot-env related is better kept there by now.

At this chance, also drop a stale comment from iot2050.h

Signed-off-by: Jan Kiszka jan.kiszka@siemens.com --- board/siemens/iot2050/iot2050.env | 9 +++++++++ include/configs/iot2050.h | 11 ++--------- 2 files changed, 11 insertions(+), 9 deletions(-) create mode 100644 board/siemens/iot2050/iot2050.env

diff --git a/board/siemens/iot2050/iot2050.env b/board/siemens/iot2050/iot2050.env new file mode 100644 index 00000000000..4bd93f0b2f4 --- /dev/null +++ b/board/siemens/iot2050/iot2050.env @@ -0,0 +1,9 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright (c) Siemens AG, 2023 + * + * Authors: + * Jan Kiszka jan.kiszka@siemens.com + */ + +usb_pgood_delay=900 diff --git a/include/configs/iot2050.h b/include/configs/iot2050.h index cfff46ce339..8dfeaddf541 100644 --- a/include/configs/iot2050.h +++ b/include/configs/iot2050.h @@ -13,12 +13,6 @@

#include <linux/sizes.h>

-/* SPL Loader Configuration */ - -/* U-Boot general configuration */ -#define EXTRA_ENV_IOT2050_BOARD_SETTINGS \ - "usb_pgood_delay=900\0" - #if IS_ENABLED(CONFIG_CMD_USB) # define BOOT_TARGET_USB(func) \ func(USB, usb, 0) \ @@ -40,10 +34,9 @@

#include <config_distro_bootcmd.h>

-#define CFG_EXTRA_ENV_SETTINGS \ +#define CFG_EXTRA_ENV_SETTINGS \ DEFAULT_LINUX_BOOT_ENV \ - BOOTENV \ - EXTRA_ENV_IOT2050_BOARD_SETTINGS + BOOTENV

#include <configs/ti_armv7_common.h>

From: Jan Kiszka jan.kiszka@siemens.com

Allows run-time control over watchdog auto-start and the timeout via setting the environment variable watchdog_timeout_ms. A value of zero means "do not start". Use CONFIG_WATCHDOG_TIMEOUT_MSECS as initial value and this to zero by default. Users can then enable the watchdog once the use and OS which picks it up during boot.

Signed-off-by: Jan Kiszka jan.kiszka@siemens.com --- board/siemens/iot2050/iot2050.env | 8 ++++++++ configs/iot2050_pg1_defconfig | 2 ++ configs/iot2050_pg2_defconfig | 2 ++ 3 files changed, 12 insertions(+)

diff --git a/board/siemens/iot2050/iot2050.env b/board/siemens/iot2050/iot2050.env index 4bd93f0b2f4..02958798b49 100644 --- a/board/siemens/iot2050/iot2050.env +++ b/board/siemens/iot2050/iot2050.env @@ -7,3 +7,11 @@ */

usb_pgood_delay=900 + +watchdog_timeout_ms=CONFIG_WATCHDOG_TIMEOUT_MSECS +start_watchdog= + if test ${watchdog_timeout_ms} -gt 0; then + wdt dev watchdog@40610000; + wdt start ${watchdog_timeout_ms}; + echo Watchdog started, timeout ${watchdog_timeout_ms} ms; + fi diff --git a/configs/iot2050_pg1_defconfig b/configs/iot2050_pg1_defconfig index 2f7a9d86794..258ad4c87e5 100644 --- a/configs/iot2050_pg1_defconfig +++ b/configs/iot2050_pg1_defconfig @@ -32,6 +32,7 @@ CONFIG_OF_BOARD_SETUP=y CONFIG_BOOTSTAGE=y CONFIG_SHOW_BOOT_PROGRESS=y CONFIG_SPL_SHOW_BOOT_PROGRESS=y +CONFIG_BOOTCOMMAND="run start_watchdog; run distro_bootcmd" CONFIG_CONSOLE_MUX=y # CONFIG_DISPLAY_CPUINFO is not set CONFIG_SPL_MAX_SIZE=0x58000 @@ -140,6 +141,7 @@ CONFIG_USB_DWC3_GENERIC=y CONFIG_USB_KEYBOARD=y # CONFIG_WATCHDOG is not set # CONFIG_WATCHDOG_AUTOSTART is not set +CONFIG_WATCHDOG_TIMEOUT_MSECS=0 CONFIG_WDT=y CONFIG_WDT_K3_RTI=y CONFIG_WDT_K3_RTI_LOAD_FW=y diff --git a/configs/iot2050_pg2_defconfig b/configs/iot2050_pg2_defconfig index e3f82ad3065..2ff360b0623 100644 --- a/configs/iot2050_pg2_defconfig +++ b/configs/iot2050_pg2_defconfig @@ -34,6 +34,7 @@ CONFIG_OF_BOARD_SETUP=y CONFIG_BOOTSTAGE=y CONFIG_SHOW_BOOT_PROGRESS=y CONFIG_SPL_SHOW_BOOT_PROGRESS=y +CONFIG_BOOTCOMMAND="run start_watchdog; run distro_bootcmd" CONFIG_CONSOLE_MUX=y # CONFIG_DISPLAY_CPUINFO is not set CONFIG_SPL_MAX_SIZE=0x58000 @@ -144,6 +145,7 @@ CONFIG_USB_DWC3_GENERIC=y CONFIG_USB_KEYBOARD=y # CONFIG_WATCHDOG is not set # CONFIG_WATCHDOG_AUTOSTART is not set +CONFIG_WATCHDOG_TIMEOUT_MSECS=0 CONFIG_WDT=y CONFIG_WDT_K3_RTI=y CONFIG_WDT_K3_RTI_LOAD_FW=y

From: Jan Kiszka jan.kiszka@siemens.com

Add hashes and configuration signature stubs to prepare verified boot of main U-Boot by SPL.

Signed-off-by: Jan Kiszka jan.kiszka@siemens.com --- arch/arm/dts/k3-am65-iot2050-boot-image.dtsi | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)

diff --git a/arch/arm/dts/k3-am65-iot2050-boot-image.dtsi b/arch/arm/dts/k3-am65-iot2050-boot-image.dtsi index 3ee0842e993..9082a79a034 100644 --- a/arch/arm/dts/k3-am65-iot2050-boot-image.dtsi +++ b/arch/arm/dts/k3-am65-iot2050-boot-image.dtsi @@ -14,6 +14,7 @@ filename = "flash.bin"; pad-byte = <0xff>; size = <0x8c0000>; + allow-repack;

blob-ext@0x000000 { offset = <0x000000>; @@ -45,6 +46,9 @@ entry = <0x80800000>; u-boot-nodtb { }; + hash { + algo = "sha256"; + }; };

@fdt-SEQ { @@ -52,6 +56,9 @@ type = "flat_dt"; arch = "arm64"; compression = "none"; + hash { + algo = "sha256"; + }; };

#ifdef CONFIG_WDT_K3_RTI_FW_FILE @@ -64,6 +71,9 @@ filename = CONFIG_WDT_K3_RTI_FW_FILE; missing-msg = "k3-rti-wdt-firmware"; }; + hash { + algo = "sha256"; + }; }; #endif }; @@ -77,10 +87,16 @@ #ifdef CONFIG_WDT_K3_RTI_FW_FILE loadables = "k3-rti-wdt-firmware"; #endif + signature { + sign-images = "firmware", "fdt", "loadables"; + }; }; }; };

+ fdtmap { + }; + /* primary env */ fill@0x680000 { offset = <0x680000>;

From: Jan Kiszka jan.kiszka@siemens.com

Allows to create a public key device tree dtsi for inclusion into U-Boot SPL and proper during first build already. This can be achieved via CONFIG_DEVICE_TREE_INCLUDES.

Signed-off-by: Jan Kiszka jan.kiszka@siemens.com --- tools/key2dtsi.py | 64 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 64 insertions(+) create mode 100755 tools/key2dtsi.py

diff --git a/tools/key2dtsi.py b/tools/key2dtsi.py new file mode 100755 index 00000000000..1dbb2cc94bf --- /dev/null +++ b/tools/key2dtsi.py @@ -0,0 +1,64 @@ +#!/usr/bin/env python3 +# SPDX-License-Identifier: GPL-2.0-only +# +# Public key to dtsi converter. +# +# Copyright (c) Siemens AG, 2022 +# + +from argparse import ArgumentParser, FileType +from os.path import basename, splitext +from Cryptodome.PublicKey import RSA +from Cryptodome.Util.number import inverse + +def int_to_bytestr(n, length=None): + if not length: + length = (n.bit_length() + 7) // 8 + byte_array = n.to_bytes(length, 'big') + return ' '.join(['{:02x}'.format(byte) for byte in byte_array]) + +ap = ArgumentParser(description='Public key to dtsi converter') + +ap.add_argument('--hash', '-H', default='sha256', + help='hash to be used with key (default: sha256)') +ap.add_argument('--required-conf', '-c', action='store_true', + help='mark key required for configuration') +ap.add_argument('--required-image', '-i', action='store_true', + help='mark key required for image') +ap.add_argument('--spl', '-s', action='store_true', + help='mark key for usage in SPL') +ap.add_argument('key_file', metavar='KEY_FILE', type=FileType('r'), + help='key file (formats: X.509, PKCS#1, OpenSSH)') +ap.add_argument('dtsi_file', metavar='DTSI_FILE', type=FileType('w'), + help='dtsi output file') + +args = ap.parse_args() + +key_name, _ = splitext(basename(args.key_file.name)) + +key_data = args.key_file.read() +key = RSA.importKey(key_data) + +r_squared = (2**key.size_in_bits())**2 % key.n +n0_inverse = 2**32 - inverse(key.n, 2**32) + +out = args.dtsi_file +out.write('/ {\n') +out.write('\tsignature {\n') +out.write('\t\tkey-{} {{\n'.format(key_name)) +out.write('\t\t\tkey-name-hint = "{}";\n'.format(key_name)) +out.write('\t\t\talgo = "{},rsa{}";\n'.format(args.hash, key.size_in_bits())) +out.write('\t\t\trsa,num-bits = <{}>;\n'.format(key.size_in_bits())) +out.write('\t\t\trsa,modulus = [{}];\n'.format(int_to_bytestr(key.n))) +out.write('\t\t\trsa,exponent = [{}];\n'.format(int_to_bytestr(key.e, 8))) +out.write('\t\t\trsa,r-squared = [{}];\n'.format(int_to_bytestr(r_squared))) +out.write('\t\t\trsa,n0-inverse = <0x{:x}>;\n'.format(n0_inverse)) +if args.required_conf: + out.write('\t\t\trequired = "conf";\n') +elif args.required_image: + out.write('\t\t\trequired = "image";\n') +if args.spl: + out.write('\t\t\tu-boot,dm-spl;\n') +out.write('\t\t};\n') +out.write('\t};\n') +out.write('};\n')

From: Jan Kiszka jan.kiszka@siemens.com

There are many ways to get a signed firmware for the IOT2050 devices, namely for the parts under user-control. This script documents one way of doing it, given a signing key. Augment the board documentation with the required procedure around it.

Signed-off-by: Jan Kiszka jan.kiszka@siemens.com --- doc/board/siemens/iot2050.rst | 52 +++++++++++++++++++++++++++++++++++ tools/iot2050-sign-fw.sh | 51 ++++++++++++++++++++++++++++++++++ 2 files changed, 103 insertions(+) create mode 100755 tools/iot2050-sign-fw.sh

diff --git a/doc/board/siemens/iot2050.rst b/doc/board/siemens/iot2050.rst index 26972e20ae9..4e0925c72c9 100644 --- a/doc/board/siemens/iot2050.rst +++ b/doc/board/siemens/iot2050.rst @@ -79,3 +79,55 @@ Via external programmer Dediprog SF100 or SF600: .. code-block:: text

$ dpcmd --vcc 2 -v -u flash.bin + +Signing (optional) +------------------ + +To enable verified boot for the firmware artifacts after the Siemens-managed +first-stage loader (seboot_pg*.bin), the following steps need to be taken +before and after the build: + +Generate dtsi holding the public key +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: text + + tools/key2dtsi.py -c -s key.pem public-key.dtsi + +This will be used to embed the public key into U-Boot SPL and main so that each +step can validate signatures of the succeeding one. + +Adjust U-Boot configuration +^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Enabled at least the following options in U-Boot: + +.. code-block:: text + + CONFIG_SPL_FIT_SIGNATURE=y + CONFIG_DEVICE_TREE_INCLUDES="/path/to/public-key.dtsi" + CONFIG_RSA=y + +Note that there are more configuration changes needed in order to lock-down +the command line and the boot process of U-Boot for secure scenarios. These are +not in scope here. + +Build U-Boot +^^^^^^^^^^^^ + +See related section above. + +Sign flash.bin +^^^^^^^^^^^^^^ + +In the build folder still containing artifacts from step 3, invoke: + +.. code-block:: text + + tools/iot2050-sign-fw.sh /path/to/key.pem + +Flash signed flash.bin +^^^^^^^^^^^^^^^^^^^^^^ + +The signing has happen in-place in flash.bin, thus the flashing procedure +described above. diff --git a/tools/iot2050-sign-fw.sh b/tools/iot2050-sign-fw.sh new file mode 100755 index 00000000000..4d1d79498c2 --- /dev/null +++ b/tools/iot2050-sign-fw.sh @@ -0,0 +1,51 @@ +#!/bin/sh + +if [ -z "$1" ]; then + echo "Usage: $0 KEY" + exit 1 +fi + +TEMP_X509=$(mktemp XXXXXXXX.temp) + +REVISION=${2:-0} +SHA_VAL=$(openssl dgst -sha512 -hex tispl.bin | sed -e "s/^.*= //g") +BIN_SIZE=$(stat -c %s tispl.bin) + +cat <<EOF >$TEMP_X509 +[ req ] +distinguished_name = req_distinguished_name +x509_extensions = v3_ca +prompt = no +dirstring_type = nobmp + +[ req_distinguished_name ] +CN = IOT2050 Firmware Signature + +[ v3_ca ] +basicConstraints = CA:true +1.3.6.1.4.1.294.1.3 = ASN1:SEQUENCE:swrv +1.3.6.1.4.1.294.1.34 = ASN1:SEQUENCE:sysfw_image_integrity + +[ swrv ] +swrv = INTEGER:$REVISION + +[ sysfw_image_integrity ] +shaType = OID:2.16.840.1.101.3.4.2.3 +shaValue = FORMAT:HEX,OCT:$SHA_VAL +imageSize = INTEGER:$BIN_SIZE +EOF + +CERT_X509=$(mktemp XXXXXXXX.crt) + +openssl req -new -x509 -key $1 -nodes -outform DER -out $CERT_X509 -config $TEMP_X509 -sha512 +cat $CERT_X509 tispl.bin > tispl.bin_signed +# currently broken in upstream +#source/tools/binman/binman replace -i flash.bin -f tispl.bin_signed blob@0x180000 +dd if=tispl.bin_signed of=flash.bin bs=$((0x1000)) seek=$((0x180000/0x1000)) conv=notrunc + +rm $TEMP_X509 $CERT_X509 + +tools/mkimage -G $1 -r -o sha256,rsa4096 -F fit@0x380000.fit +# currently broken in upstream +#source/tools/binman/binman replace -i flash.bin -f fit@0x380000.fit fit@0x380000 +dd if=fit@0x380000.fit of=flash.bin bs=$((0x1000)) seek=$((0x380000/0x1000)) conv=notrunc

From: Jan Kiszka jan.kiszka@siemens.com

Use external blob otpcmd.bin to replace the 0xff filled OTP programming command block to create a firmware image that provisions the OTP on first boot. This otpcmd.bin is generated from the customer keys using steps described in the meta-iot2050 integration layer for the device.

Based on original patch by Baocheng Su.

Signed-off-by: Jan Kiszka jan.kiszka@siemens.com --- arch/arm/dts/k3-am65-iot2050-boot-image.dtsi | 9 +++++++++ board/siemens/iot2050/Kconfig | 7 +++++++ doc/board/siemens/iot2050.rst | 8 ++++++++ tools/binman/missing-blob-help | 8 ++++++++ 4 files changed, 32 insertions(+)

diff --git a/arch/arm/dts/k3-am65-iot2050-boot-image.dtsi b/arch/arm/dts/k3-am65-iot2050-boot-image.dtsi index 9082a79a034..a2fc8bbc123 100644 --- a/arch/arm/dts/k3-am65-iot2050-boot-image.dtsi +++ b/arch/arm/dts/k3-am65-iot2050-boot-image.dtsi @@ -111,10 +111,19 @@ };

/* OTP update command block */ +#if CONFIG_IOT2050_EMBED_OTPCMD + blob-ext@0x6c0000 { + offset = <0x6c0000>; + size = <0x010000>; + filename = "otpcmd.bin"; + missing-msg = "iot2050-otpcmd"; + }; +#else fill@0x6c0000 { offset = <0x6c0000>; size = <0x010000>; fill-byte = [ff]; }; +#endif }; }; diff --git a/board/siemens/iot2050/Kconfig b/board/siemens/iot2050/Kconfig index a2b40881d11..e66b2427d95 100644 --- a/board/siemens/iot2050/Kconfig +++ b/board/siemens/iot2050/Kconfig @@ -49,4 +49,11 @@ config IOT2050_BOOT_SWITCH bool "Disable eMMC boot via USER button (Advanced version only)" default y

+config IOT2050_EMBED_OTPCMD + bool "Embed OTP programming data" + help + Embed signed OTP programming data 'otpcmd.bin' into the firmware + image. This data will be evaluated and executed on first boot of the + device. + endif diff --git a/doc/board/siemens/iot2050.rst b/doc/board/siemens/iot2050.rst index 4e0925c72c9..cb49a0e36bf 100644 --- a/doc/board/siemens/iot2050.rst +++ b/doc/board/siemens/iot2050.rst @@ -27,6 +27,14 @@ The following binaries from that source need to be present in the build folder: - seboot_pg1.bin - seboot_pg2.bin

+For building an image containing the OTP key provisioning data, below binary +needs to be present in the build folder: + + - otpcmd.bin + +Regarding how to generating this otpcmd.bin, please refer to: +https://github.com/siemens/meta-iot2050/tree/master/recipes-bsp/secure-boot-... + Building --------

diff --git a/tools/binman/missing-blob-help b/tools/binman/missing-blob-help index 1a30da7b5aa..db16229f9f2 100644 --- a/tools/binman/missing-blob-help +++ b/tools/binman/missing-blob-help @@ -23,6 +23,14 @@ See the documentation for IOT2050 board. Your image is missing SEBoot which is mandatory for board startup. Prebuilt SEBoot located at meta-iot2050/tree/master/recipes-bsp/u-boot/files/prebuild/seboot_pg*.bin.

+iot2050-otpcmd: +See the documentation for IOT2050 board. Your image is missing OTP command data +block which is used for provisioning the customer keys to the board. +Please refer to +meta-iot2050/tree/master/recipes-bsp/secure-boot-otp-provisioning/files/make-otpcmd.sh +for how to generate this binary. If you are not using secure boot or do not +intend to provision the keys, disable CONFIG_IOT2050_EMBED_OTPCMD. + k3-rti-wdt-firmware: If CONFIG_WDT_K3_RTI_LOAD_FW is enabled, a firmware image is needed for the R5F core(s) to trigger the system reset. One possible source is

From: chao zeng chao.zeng@siemens.com

User-button is controlled by the mcu domain gpio number 25. But main0 main1 mcu domain all have gpio number 25.

To identify where the gpio is from, Using gpio controll base as the prefix to indicate the gpio resource.

Signed-off-by: chao zeng chao.zeng@siemens.com --- board/siemens/iot2050/board.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/board/siemens/iot2050/board.c b/board/siemens/iot2050/board.c index 57d7009e8c7..2735ae3fb74 100644 --- a/board/siemens/iot2050/board.c +++ b/board/siemens/iot2050/board.c @@ -183,7 +183,7 @@ static bool user_button_pressed(void)

memset(&gpio, 0, sizeof(gpio));

- if (dm_gpio_lookup_name("25", &gpio) < 0 || + if (dm_gpio_lookup_name("gpio@42110000_25", &gpio) < 0 || dm_gpio_request(&gpio, "USER button") < 0 || dm_gpio_set_dir_flags(&gpio, GPIOD_IS_IN) < 0) return false;

From: Jan Kiszka jan.kiszka@siemens.com

This feature is desired on the platform.

Signed-off-by: Jan Kiszka jan.kiszka@siemens.com --- configs/iot2050_pg1_defconfig | 1 + configs/iot2050_pg2_defconfig | 5 +---- 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/configs/iot2050_pg1_defconfig b/configs/iot2050_pg1_defconfig index 258ad4c87e5..45c88fc134e 100644 --- a/configs/iot2050_pg1_defconfig +++ b/configs/iot2050_pg1_defconfig @@ -146,3 +146,4 @@ CONFIG_WDT=y CONFIG_WDT_K3_RTI=y CONFIG_WDT_K3_RTI_LOAD_FW=y CONFIG_OF_LIBFDT_OVERLAY=y +CONFIG_EFI_SCROLL_ON_CLEAR_SCREEN=y diff --git a/configs/iot2050_pg2_defconfig b/configs/iot2050_pg2_defconfig index 2ff360b0623..d2bdeab593b 100644 --- a/configs/iot2050_pg2_defconfig +++ b/configs/iot2050_pg2_defconfig @@ -25,11 +25,8 @@ CONFIG_ENV_OFFSET_REDUND=0x6a0000 CONFIG_SPL_SPI_FLASH_SUPPORT=y CONFIG_SPL_SPI=y CONFIG_DISTRO_DEFAULTS=y -CONFIG_HAS_CUSTOM_SYS_INIT_SP_ADDR=y -CONFIG_CUSTOM_SYS_INIT_SP_ADDR=0x80100000 # CONFIG_SYS_MALLOC_CLEAR_ON_INIT is not set CONFIG_SPL_LOAD_FIT=y -# CONFIG_USE_SPL_FIT_GENERATOR is not set CONFIG_OF_BOARD_SETUP=y CONFIG_BOOTSTAGE=y CONFIG_SHOW_BOOT_PROGRESS=y @@ -78,7 +75,6 @@ CONFIG_SPL_OF_LIST="k3-am65-iot2050-spl" CONFIG_SPL_MULTI_DTB_FIT_NO_COMPRESSION=y CONFIG_ENV_IS_IN_SPI_FLASH=y CONFIG_SYS_REDUNDAND_ENVIRONMENT=y -CONFIG_DM=y CONFIG_SPL_DM=y CONFIG_SPL_DM_SEQ_ALIAS=y CONFIG_SPL_REGMAP=y @@ -150,3 +146,4 @@ CONFIG_WDT=y CONFIG_WDT_K3_RTI=y CONFIG_WDT_K3_RTI_LOAD_FW=y CONFIG_OF_LIBFDT_OVERLAY=y +CONFIG_EFI_SCROLL_ON_CLEAR_SCREEN=y

From: Jan Kiszka jan.kiszka@siemens.com

The M.2 slots of the related IOT2050 variant need to be configured according to the plugged cards. This tries to detect the card using the M.2 configuration pins of the B-key slot. If that fails, a U-Boot environment variable can be set to configure manually. This variable is write-permitted also in secure boot mode as it is not able to undermine the integrity of the booted system.

The configuration is then applied to mux the serdes and to fix up the device tree passed to or loaded by the bootloader. The fix-ups are coming from device tree overlays that are embedded into the firmware image and there also integrity protected. The OS remains free to load a device tree to which they do not apply: U-Boot will not fail to boot in that case.

Based on original patch by Chao Zeng.

Signed-off-by: Jan Kiszka jan.kiszka@siemens.com --- arch/arm/dts/Makefile | 4 +- arch/arm/dts/k3-am65-iot2050-boot-image.dtsi | 38 ++- ...050-advanced-m2-bkey-ekey-pcie-overlay.dts | 27 ++ ...-iot2050-advanced-m2-bkey-usb3-overlay.dts | 47 ++++ board/siemens/iot2050/board.c | 259 +++++++++++++++++- doc/board/siemens/iot2050.rst | 18 ++ include/configs/iot2050.h | 1 + 7 files changed, 391 insertions(+), 3 deletions(-) create mode 100644 arch/arm/dts/k3-am6548-iot2050-advanced-m2-bkey-ekey-pcie-overlay.dts create mode 100644 arch/arm/dts/k3-am6548-iot2050-advanced-m2-bkey-usb3-overlay.dts

diff --git a/arch/arm/dts/Makefile b/arch/arm/dts/Makefile index 8e9e2bf9a42..0bfc69ecc86 100644 --- a/arch/arm/dts/Makefile +++ b/arch/arm/dts/Makefile @@ -1254,7 +1254,9 @@ dtb-$(CONFIG_SOC_K3_AM654) += \ k3-am6528-iot2050-basic-pg2.dtb \ k3-am6548-iot2050-advanced.dtb \ k3-am6548-iot2050-advanced-pg2.dtb \ - k3-am6548-iot2050-advanced-m2.dtb + k3-am6548-iot2050-advanced-m2.dtb \ + k3-am6548-iot2050-advanced-m2-bkey-usb3-overlay.dtbo \ + k3-am6548-iot2050-advanced-m2-bkey-ekey-pcie-overlay.dtbo dtb-$(CONFIG_SOC_K3_J721E) += k3-j721e-common-proc-board.dtb \ k3-j721e-r5-common-proc-board.dtb \ k3-j7200-common-proc-board.dtb \ diff --git a/arch/arm/dts/k3-am65-iot2050-boot-image.dtsi b/arch/arm/dts/k3-am65-iot2050-boot-image.dtsi index a2fc8bbc123..03ccc543293 100644 --- a/arch/arm/dts/k3-am65-iot2050-boot-image.dtsi +++ b/arch/arm/dts/k3-am65-iot2050-boot-image.dtsi @@ -61,6 +61,36 @@ }; };

+#ifdef CONFIG_TARGET_IOT2050_A53_PG2 + bkey-usb3-overlay { + description = "M.2-bkey-usb3-overlay"; + type = "blob"; + load = <0x82100000>; + arch = "arm64"; + compression = "none"; + blob-ext { + filename = "k3-am6548-iot2050-advanced-m2-bkey-usb3-overlay.dtbo"; + }; + hash { + algo = "sha256"; + }; + }; + + bkey-ekey-pcie-overlay { + description = "M.2-bkey-ekey-pcie-overlay"; + type = "blob"; + load = <0x82110000>; + arch = "arm64"; + compression = "none"; + blob-ext { + filename = "k3-am6548-iot2050-advanced-m2-bkey-ekey-pcie-overlay.dtbo"; + }; + hash { + algo = "sha256"; + }; + }; +#endif + #ifdef CONFIG_WDT_K3_RTI_FW_FILE k3-rti-wdt-firmware { type = "firmware"; @@ -84,9 +114,15 @@ description = "NAME"; firmware = "u-boot"; fdt = "fdt-SEQ"; + loadables = +#ifdef CONFIG_TARGET_IOT2050_A53_PG2 + "bkey-usb3-overlay", + "bkey-ekey-pcie-overlay", +#endif #ifdef CONFIG_WDT_K3_RTI_FW_FILE - loadables = "k3-rti-wdt-firmware"; + "k3-rti-wdt-firmware", #endif + <>; signature { sign-images = "firmware", "fdt", "loadables"; }; diff --git a/arch/arm/dts/k3-am6548-iot2050-advanced-m2-bkey-ekey-pcie-overlay.dts b/arch/arm/dts/k3-am6548-iot2050-advanced-m2-bkey-ekey-pcie-overlay.dts new file mode 100644 index 00000000000..c9e736098f9 --- /dev/null +++ b/arch/arm/dts/k3-am6548-iot2050-advanced-m2-bkey-ekey-pcie-overlay.dts @@ -0,0 +1,27 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * IOT2050 M.2 variant, overlay for B-key PCIE0_LANE0 + E-key PCIE1_LANE0 + * Copyright (c) Siemens AG, 2022 + * + * Authors: + * Chao Zeng chao.zeng@siemens.com + * Jan Kiszka jan.kiszka@siemens.com + */ + +/dts-v1/; +/plugin/; + +#include <dt-bindings/phy/phy.h> +#include <dt-bindings/gpio/gpio.h> + +&pcie0_rc { + num-lanes = <1>; + phys = <&serdes0 PHY_TYPE_PCIE 1>; + phy-names = "pcie-phy0"; + reset-gpios = <&main_gpio1 15 GPIO_ACTIVE_HIGH>; + status = "okay"; +}; + +&pcie1_rc { + status = "okay"; +}; diff --git a/arch/arm/dts/k3-am6548-iot2050-advanced-m2-bkey-usb3-overlay.dts b/arch/arm/dts/k3-am6548-iot2050-advanced-m2-bkey-usb3-overlay.dts new file mode 100644 index 00000000000..72fc011bd54 --- /dev/null +++ b/arch/arm/dts/k3-am6548-iot2050-advanced-m2-bkey-usb3-overlay.dts @@ -0,0 +1,47 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * IOT2050 M.2 variant, overlay for B-key USB3.0 + E-key PCIE1_LANE0 + * Copyright (c) Siemens AG, 2022 + * + * Authors: + * Chao Zeng chao.zeng@siemens.com + * Jan Kiszka jan.kiszka@siemens.com + */ + +/dts-v1/; +/plugin/; + +#include <dt-bindings/phy/phy.h> +#include <dt-bindings/gpio/gpio.h> + +&serdes0 { + assigned-clock-parents = <&k3_clks 153 7>, <&k3_clks 153 4>; +}; + +&pcie0_rc { + status = "disabled"; +}; + +&pcie1_rc { + pinctrl-names = "default"; + pinctrl-0 = <&minipcie_pins_default>; + + num-lanes = <1>; + phys = <&serdes1 PHY_TYPE_PCIE 0>; + phy-names = "pcie-phy0"; + reset-gpios = <&wkup_gpio0 27 GPIO_ACTIVE_HIGH>; + status = "okay"; +}; + +&dwc3_0 { + assigned-clock-parents = <&k3_clks 151 4>, /* set REF_CLK to 20MHz i.e. PER0_PLL/48 */ + <&k3_clks 151 8>; /* set PIPE3_TXB_CLK to WIZ8B2M4VSB */ + phys = <&serdes0 PHY_TYPE_USB3 0>; + phy-names = "usb3-phy"; +}; + +&usb0 { + maximum-speed = "super-speed"; + snps,dis-u1-entry-quirk; + snps,dis-u2-entry-quirk; +}; diff --git a/board/siemens/iot2050/board.c b/board/siemens/iot2050/board.c index 2735ae3fb74..df705b7c971 100644 --- a/board/siemens/iot2050/board.c +++ b/board/siemens/iot2050/board.c @@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0+ /* * Board specific initialization for IOT2050 - * Copyright (c) Siemens AG, 2018-2021 + * Copyright (c) Siemens AG, 2018-2022 * * Authors: * Le Jin le.jin@siemens.com @@ -11,9 +11,11 @@ #include <common.h> #include <bootstage.h> #include <dm.h> +#include <fdt_support.h> #include <i2c.h> #include <led.h> #include <malloc.h> +#include <mapmem.h> #include <net.h> #include <phy.h> #include <spl.h> @@ -47,6 +49,114 @@ struct iot2050_info {

DECLARE_GLOBAL_DATA_PTR;

+struct gpio_config { + const char *gpio_name; + const char *label; +}; + +enum m2_connector_mode { + BKEY_PCIEX2 = 0, + BKEY_PCIE_EKEY_PCIE, + BKEY_USB30_EKEY_PCIE, + CONNECTOR_MODE_INVALID +}; + +struct m2_config_pins { + int config[4]; +}; + +struct serdes_mux_control { + int ctrl_usb30_pcie0_lane0; + int ctrl_pcie1_pcie0; + int ctrl_usb30_pcie0_lane1; +}; + +struct m2_config_table { + struct m2_config_pins config_pins; + enum m2_connector_mode mode; +}; + +static const struct gpio_config serdes_mux_ctl_pin_info[] = { + {"gpio@600000_88", "CTRL_USB30_PCIE0_LANE0"}, + {"gpio@600000_82", "CTRL_PCIE1_PCIE0"}, + {"gpio@600000_89", "CTRL_USB30_PCIE0_LANE1"}, +}; + +static const struct gpio_config m2_bkey_cfg_pin_info[] = { + {"gpio@601000_18", "KEY_CONFIG_0"}, + {"gpio@601000_19", "KEY_CONFIG_1"}, + {"gpio@601000_88", "KEY_CONFIG_2"}, + {"gpio@601000_89", "KEY_CONFIG_3"}, +}; + +static const struct m2_config_table m2_config_table[] = { + {{{0, 1, 0, 0}}, BKEY_PCIEX2}, + {{{0, 0, 1, 0}}, BKEY_PCIE_EKEY_PCIE}, + {{{0, 1, 1, 0}}, BKEY_PCIE_EKEY_PCIE}, + {{{1, 0, 0, 1}}, BKEY_PCIE_EKEY_PCIE}, + {{{1, 1, 0, 1}}, BKEY_PCIE_EKEY_PCIE}, + {{{0, 0, 0, 1}}, BKEY_USB30_EKEY_PCIE}, + {{{0, 1, 0, 1}}, BKEY_USB30_EKEY_PCIE}, + {{{0, 0, 1, 1}}, BKEY_USB30_EKEY_PCIE}, + {{{0, 1, 1, 1}}, BKEY_USB30_EKEY_PCIE}, + {{{1, 0, 1, 1}}, BKEY_USB30_EKEY_PCIE}, +}; + +static const struct serdes_mux_control serdes_mux_ctrl[] = { + [BKEY_PCIEX2] = {0, 0, 1}, + [BKEY_PCIE_EKEY_PCIE] = {0, 1, 0}, + [BKEY_USB30_EKEY_PCIE] = {1, 1, 0}, +}; + +static const char *m2_connector_mode_name[] = { + [BKEY_PCIEX2] = "PCIe x2 (key B)", + [BKEY_PCIE_EKEY_PCIE] = "PCIe (key B) / PCIe (key E)", + [BKEY_USB30_EKEY_PCIE] = "USB 3.0 (key B) / PCIe (key E)", +}; + +static enum m2_connector_mode connector_mode; + +#if defined(CONFIG_OF_LIBFDT) && defined(CONFIG_OF_BOARD_SETUP) +static void *connector_overlay; +static u32 connector_overlay_size; +#endif + +static int get_pinvalue(const char *gpio_name, const char *label) +{ + struct gpio_desc gpio; + + if (dm_gpio_lookup_name(gpio_name, &gpio) < 0 || + dm_gpio_request(&gpio, label) < 0 || + dm_gpio_set_dir_flags(&gpio, GPIOD_IS_IN) < 0) { + pr_err("Cannot get pin %s for M.2 configuration\n", gpio_name); + return 0; + } + + return dm_gpio_get_value(&gpio); +} + +static void set_pinvalue(const char *gpio_name, const char *label, int value) +{ + struct gpio_desc gpio; + + if (dm_gpio_lookup_name(gpio_name, &gpio) < 0 || + dm_gpio_request(&gpio, label) < 0 || + dm_gpio_set_dir_flags(&gpio, GPIOD_IS_OUT) < 0) { + pr_err("Cannot set pin %s for M.2 configuration\n", gpio_name); + return; + } + dm_gpio_set_value(&gpio, value); +} + +static bool board_is_m2(void) +{ + struct iot2050_info *info = IOT2050_INFO_DATA; + + return IS_ENABLED(CONFIG_TARGET_IOT2050_A53_PG2) && + info->magic == IOT2050_INFO_MAGIC && + strcmp((char *)info->name, "IOT2050-ADVANCED-M2") == 0; +} + static bool board_is_advanced(void) { struct iot2050_info *info = IOT2050_INFO_DATA; @@ -103,6 +213,8 @@ void set_board_info_env(void) if (board_is_advanced()) { if (IS_ENABLED(CONFIG_TARGET_IOT2050_A53_PG1)) fdtfile = "ti/k3-am6548-iot2050-advanced.dtb"; + else if(board_is_m2()) + fdtfile = "ti/k3-am6548-iot2050-advanced-m2.dtb"; else fdtfile = "ti/k3-am6548-iot2050-advanced-pg2.dtb"; } else { @@ -118,6 +230,101 @@ void set_board_info_env(void) env_save(); }

+static void m2_overlay_prepare(void) +{ +#if defined(CONFIG_OF_LIBFDT) && defined(CONFIG_OF_BOARD_SETUP) + const char *overlay_path; + void *overlay; + u64 loadaddr; + ofnode node; + int ret; + + if (connector_mode == BKEY_PCIEX2) + return; + + if (connector_mode == BKEY_PCIE_EKEY_PCIE) + overlay_path = "/fit-images/bkey-ekey-pcie-overlay"; + else + overlay_path = "/fit-images/bkey-usb3-overlay"; + + node = ofnode_path(overlay_path); + if (!ofnode_valid(node)) + goto fit_error; + + ret = ofnode_read_u64(node, "load", &loadaddr); + if (ret) + goto fit_error; + + ret = ofnode_read_u32(node, "size", &connector_overlay_size); + if (ret) + goto fit_error; + + overlay = map_sysmem(loadaddr, connector_overlay_size); + + connector_overlay = malloc(connector_overlay_size); + if (!connector_overlay) + goto fit_error; + + memcpy(connector_overlay, overlay, connector_overlay_size); + return; + +fit_error: + pr_err("M.2 device tree overlay %s not available,\n", overlay_path); +#endif +} + +static void m2_connector_setup(void) +{ + ulong m2_manual_config = env_get_ulong("m2_manual_config", 10, + CONNECTOR_MODE_INVALID); + const char *mode_info = ""; + struct m2_config_pins config_pins; + unsigned int n; + + /* enable M.2 connector power */ + set_pinvalue("gpio@601000_17", "P3V3_M2_EN", 1); + udelay(4 * 100); + + if (m2_manual_config < CONNECTOR_MODE_INVALID) { + mode_info = " [manual mode]"; + connector_mode = m2_manual_config; + } else { /* auto detection */ + for (n = 0; n < ARRAY_SIZE(config_pins.config); n++) + config_pins.config[n] = + get_pinvalue(m2_bkey_cfg_pin_info[n].gpio_name, + m2_bkey_cfg_pin_info[n].label); + connector_mode = CONNECTOR_MODE_INVALID; + for (n = 0; n < ARRAY_SIZE(m2_config_table); n++) { + if (!memcmp(config_pins.config, + m2_config_table[n].config_pins.config, + sizeof(config_pins.config))) { + connector_mode = m2_config_table[n].mode; + break; + } + } + if (connector_mode == CONNECTOR_MODE_INVALID) { + mode_info = " [fallback, card unknown/unsupported]"; + connector_mode = BKEY_USB30_EKEY_PCIE; + } + } + + printf("M.2: %s%s\n", m2_connector_mode_name[connector_mode], + mode_info); + + /* configure serdes mux */ + set_pinvalue(serdes_mux_ctl_pin_info[0].gpio_name, + serdes_mux_ctl_pin_info[0].label, + serdes_mux_ctrl[connector_mode].ctrl_usb30_pcie0_lane0); + set_pinvalue(serdes_mux_ctl_pin_info[1].gpio_name, + serdes_mux_ctl_pin_info[1].label, + serdes_mux_ctrl[connector_mode].ctrl_pcie1_pcie0); + set_pinvalue(serdes_mux_ctl_pin_info[2].gpio_name, + serdes_mux_ctl_pin_info[2].label, + serdes_mux_ctrl[connector_mode].ctrl_usb30_pcie0_lane1); + + m2_overlay_prepare(); +} + int board_init(void) { return 0; @@ -215,6 +422,9 @@ int board_late_init(void) /* change CTRL_MMR register to let serdes0 not output USB3.0 signals. */ writel(0x3, SERDES0_LANE_SELECT);

+ if (board_is_m2()) + m2_connector_setup(); + set_board_info_env();

/* remove the eMMC if requested via button */ @@ -226,6 +436,50 @@ int board_late_init(void) }

#if defined(CONFIG_OF_LIBFDT) && defined(CONFIG_OF_BOARD_SETUP) +static void m2_fdt_fixup(void *blob) +{ + void *overlay_copy = NULL; + void *fdt_copy = NULL; + u32 fdt_size; + int err; + + if (!connector_overlay) + return; + + /* + * We need to work with temporary copies here because fdt_overlay_apply + * is destructive to the overlay and also to the target blob, even if + * application fails. + */ + fdt_size = fdt_totalsize(blob); + fdt_copy = malloc(fdt_size); + if (!fdt_copy) + goto fixup_error; + + memcpy(fdt_copy, blob, fdt_size); + + overlay_copy = malloc(connector_overlay_size); + if (!overlay_copy) + goto fixup_error; + + memcpy(overlay_copy, connector_overlay, connector_overlay_size); + + err = fdt_overlay_apply_verbose(fdt_copy, overlay_copy); + if (err) + goto fixup_error; + + memcpy(blob, fdt_copy, fdt_size); + +cleanup: + free(fdt_copy); + free(overlay_copy); + return; + +fixup_error: + pr_err("Could not apply M.2 device tree overlay\n"); + goto cleanup; +} + int ft_board_setup(void *blob, struct bd_info *bd) { int ret; @@ -237,6 +491,9 @@ int ft_board_setup(void *blob, struct bd_info *bd) if (ret) pr_err("%s: fixing up msmc ram failed %d\n", __func__, ret);

+ if (board_is_m2()) + m2_fdt_fixup(blob); + return ret; } #endif diff --git a/doc/board/siemens/iot2050.rst b/doc/board/siemens/iot2050.rst index 442d2cac216..074d6aa15af 100644 --- a/doc/board/siemens/iot2050.rst +++ b/doc/board/siemens/iot2050.rst @@ -145,3 +145,21 @@ Flash signed flash.bin

The signing has happen in-place in flash.bin, thus the flashing procedure described above. + +M.2 slot configuration +---------------------- + +The M.2 variant of the IOT2050 comes with one B-keyed and one E-keyed slot. +These are configured by U-Boot depending on the detected usage (auto +configuration). The device tree loaded later on for the OS will be fixed up +by U-Boot according to this configuration. + +For the case auto configuration does not work reliably, it is possible to set +the U-Boot environment variable "m2_manual_config" to select the mode manually: + +"0" - B-key: PCIe x2, USB 2.0 + E-key: USB 2.0 +"1" - B-key: PCIe, USB 2.0 + E-key: PCIe, USB 2.0 +"2" - B-key: USB 3.0, + E-key: PCIe, USB 2.0 diff --git a/include/configs/iot2050.h b/include/configs/iot2050.h index 217719472e5..82174b8678b 100644 --- a/include/configs/iot2050.h +++ b/include/configs/iot2050.h @@ -44,6 +44,7 @@ #define CFG_ENV_FLAGS_LIST_STATIC \ "board_uuid:sw,board_name:sw,board_serial:sw,board_a5e:sw," \ "mlfb:sw,fw_version:sw,seboot_version:sw," \ + "m2_manuel_config:sw," \ "eth1addr:mw,eth2addr:mw,watchdog_timeout_ms:dw,boot_targets:sw" #endif