Last edited 2 months ago

BSEC device tree configuration: Difference between revisions

Visual
Registered User
m (Reverted edits by Registered User (-) to last revision by Registered User)
Tag: Rollback
Registered User
Tag: 2017 source edit
 
(58 intermediate revisions by 9 users not shown)
Line 1: Line 1:
<noinclude>{{ApplicableFor
|MPUs list=STM32MP13x, STM32MP15x, STM32MP21x, STM32MP23x, STM32MP25x
|MPUs checklist=STM32MP13x, STM32MP15x, STM32MP21x, STM32MP23x, STM32MP25x
}}</noinclude>
== Article purpose ==
== Article purpose ==
{{Warning|This article explains how to configure [[BSEC_internal_peripheral|BSEC]] at boot time.}}
The purpose of this article is to explain how to configure the [[BSEC internal peripheral|BSEC]] using the [[Device tree|device tree]] mechanism, relying on the bindings documentation, that is the description of the required and optional device-tree properties.
 
This article describes the [[BSEC internal peripheral|BSEC]] configuration performed using the [[Device tree|device tree]] mechanism, which provides a hardware description of the [[BSEC_internal_peripheral|BSEC]] peripheral.


== DT bindings documentation ==
== DT bindings documentation ==
Line 8: Line 11:
Generic information about NVMEM is available in the [[NVMEM_overview#Device_tree_configuration|NVMEM overview]].
Generic information about NVMEM is available in the [[NVMEM_overview#Device_tree_configuration|NVMEM overview]].


The following binding-related documentation explains how to write device tree files for BSEC:
The device tree binding documents for [[BSEC internal peripheral|BSEC]] are stored either in the given applicable components listed below, or in the Linux kernel repository:
* [[TF-A overview|TF-A]]: ''tf-a/docs/devicetree/bindings/soc/st,stm32-romem.txt"<ref name="st,stm32-romem.txt"> {{CodeSource | TF-A | docs/devicetree/bindings/soc/st,stm32-romem.txt}} [[TF-A overview|TF-A]] BSEC binding information file</ref>
* TF-A BL2:
* Linux<sup>&reg;</sup> BSEC devicetree bindings: Documentation/devicetree/bindings/nvmem/st,stm32-romem.txt<ref name="Linux,st,stm32-romem">{{CodeSource | Linux kernel | Documentation/devicetree/bindings/nvmem/st,stm32-romem.txt}}</ref>
** {{CodeSource | TF-A | docs/devicetree/bindings/soc/st,stm32-romem.txt}}
* Linux<sup>&reg;</sup> generic NVMEM devicetree bindings: Documentation/devicetree/bindings/nvmem/nvmem.txt<ref name="nvmem.txt">{{CodeSource | Linux kernel | Documentation/devicetree/bindings/nvmem/nvmem.txt}}</ref>
* OP-TEE:
** STM32 BSEC device tree bindings: {{CodeSource | OP-TEE_OS | documentation/devicetree/bindings/nvmem/st,stm32-romem.yaml}}
* U-Boot, Linux<sup>&reg;</sup> OS:
** STM32 BSEC device tree bindings: {{CodeSource | Linux kernel | Documentation/devicetree/bindings/nvmem/st,stm32-romem.yaml}}
** generic NVMEM devicetree bindings: {{CodeSource | Linux kernel | Documentation/devicetree/bindings/nvmem/nvmem.yaml}}, {{CodeSource | Linux kernel | Documentation/devicetree/bindings/nvmem/nvmem-consumer.yaml}}


== DT configuration ==
== DT configuration ==
This hardware description is a combination of the '''STM32 microprocessor''' device tree files (''.dtsi'' extension) and '''board''' device tree files (''.dts'' extension). See the [[Device tree]] for an explanation of the device-tree file split.
This hardware description is a combination of the '''STM32 microprocessor''' device tree files (''.dtsi'' extension) and '''board''' device tree files (''.dts'' extension). See the [[Device tree]] for an explanation of the device-tree file organization.


'''STM32CubeMX''' can be used to generate the board device tree. Refer to [[#How_to_configure_the_DT_using_STM32CubeMX|How to configure the DT using STM32CubeMX]] for more details.
'''STM32CubeMX''' can be used to generate the board device tree. Refer to [[#How_to_configure_the_DT_using_STM32CubeMX|How to configure the DT using STM32CubeMX]] for more details.


=== DT configuration (STM32 level) ===
=== DT configuration (STM32/SoC level) ===
The STM32MP1 [[BSEC_internal_peripheral|BSEC]] node is located in the file ''stm32mp151.dtsi''<ref name="stm32mp151_kernel_dtsi">{{CodeSource | Linux kernel | arch/arm/boot/dts/stm32mp151.dtsi}} : STM32MP151 Linux kernel device tree files</ref> (see [[Device tree]] for further explanation).
The [[BSEC_internal_peripheral|BSEC]] node and [[NVMEM_overview#Device_tree_configuration|NVMEM]] node are located in the [[STM32 MPU device_tree#Device tree structure|device tree file]] for the software components, supporting the peripheral and listed in the above [[#DT bindings documentation|DT bindings documentation]] paragraph.
 
{{Warning|This device tree part is related to STM32 microprocessors. It must be kept as is, without being modified by the end-user.}}
 
=== DT configuration (board level) ===


  / {
The objective of this chapter is to explain how to enable and configure the  [[BSEC_internal_peripheral|BSEC]]  DT nodes for a board.
  ...
  soc {
  ...
  bsec: nvmem@5c005000 {
  compatible = "st,stm32mp15-bsec";
  reg = <0x5c005000 0x400>;
  #address-cells = <1>;
  #size-cells = <1>;
 
  part_number_otp: part_number_otp@4 {
  reg = <0x4 0x1>;
  };
  ts_cal1: calib@5c {
  reg = <0x5c 0x2>;
  };
  ts_cal2: calib@5e {
  reg = <0x5e 0x2>;
  };
  };
  ...
  };
  ...
  };


Please refer to the [[NVMEM_overview#Device_tree_configuration|NVMEM overview]] for the bindings common with the  Linux<sup>&reg;</sup> kernel.
Peripheral configuration should be done in specific board device tree files (board dts file).


=== DT configuration (board level) ===
==== BSEC node append ====
==== STM32MP1 BSEC node append ====
The board definition in the device tree may include some additional board-specific OTP declarations, for example to add a NVMEM data cell:
The board definition in the device tree may include some additional board-specific OTP declarations:


   &bsec {
   &bsec {
  calib@20 {
  reg = <0x20 0x2>;
  };
   board_id: board_id@ec {
   board_id: board_id@ec {
   reg = <0xec 0x4>;
   reg = <0xec 0x4>;
   st,non-secure-otp;
   {{highlightParam|st,non-secure-otp}};
  };
  oem_enc_key@170 {
  reg = <0x170 0x10>;
  {{highlightParam|st,non-secure-otp-provisioning}};
   };
   };
   };
   };


With only 32 lower NVMEM 32-bit data words, the software needs to manage exceptions in order to allow some upper OTPs to be accessed by the non-secure world, through secure world services for very specific needs. The user can add an OTP declaration in the device tree, using the "st,non-secure-otp" property, with a 32-bit length granularity (that is, 4 bytes).<br/>
On {{MicroprocessorDevice | device=1}}, only lower OTPs (OTP 0 to 31) are accessible by the non-secure world by default.
</div></div>
 
==== STM32MP1 BSEC node append (bootloader specific) ====
The bootloader-specific STM32MP1 [[BSEC_internal_peripheral|BSEC]] node append data is located in the file ''stm32mp151.dtsi'' <ref name="stm32mp151_tfa_dtsi">{{CodeSource | TF-A | fdts/stm32mp151.dtsi}} STM32MP151 TF-A device tree files</ref> for [[TF-A overview|TF-A]] (see [[Device tree]] for further explanation).<br />
This completes NVMEM data providers, for bootloader-specific purposes only, either for a driver, or the platform itself.
 
  bsec: nvmem@5c005000 {                                         
  compatible = "st,stm32mp15-bsec";                       
  reg = <0x5c005000 0x400>;                               
  #address-cells = <1>;                                   
  #size-cells = <1>;                                     
 
  cfg0_otp: cfg0_otp@0 {                                 
  reg = <0x0 0x1>;                               
  };                                                     
  part_number_otp: part_number_otp@4 {                   
  reg = <0x4 0x1>;                               
  };                                                     
  monotonic_otp: monotonic_otp@10 {                       
  reg = <0x10 0x4>;                               
  };                                                     
  nand_otp: nand_otp@24 {                                 
  reg = <0x24 0x4>;                               
  };                                                     
  uid_otp: uid_otp@34 {                                   
  reg = <0x34 0xc>;                               
  };                                                     
  package_otp: package_otp@40 {                           
  reg = <0x40 0x4>;                               
  };                                                     
  hw2_otp: hw2_otp@48 {                                   
  reg = <0x48 0x4>;                               
  };                                                     
  ts_cal1: calib@5c {                                     
  reg = <0x5c 0x2>;                               
  };                                                     
  ts_cal2: calib@5e {                                     
  reg = <0x5e 0x2>;                               
  };                                                     
  pkh_otp: pkh_otp@60 {                                   
  reg = <0x60 0x20>;                             
  };                                                     
  mac_addr: mac_addr@e4 {                                 
  reg = <0xe4 0x8>;                               
  st,non-secure-otp;                             
  };                                                     
  };                         
 
Please see the "st,non-secure-otp" definition in the previous section above. No more spare field declaration here.
 
==== STM32MP1 driver node append ====
The driver can directly consume NVMEM data cells, as described in [[NVMEM_overview#Device_tree_configuration|NVMEM overview]].<br/>
The CPU0 device is a good example, with a dedicated OTP containing part number information.<br/>
The device node is located in the ''stm32mp151.dtsi''<ref name="stm32mp151_kernel_dtsi"></ref> file.


  cpu0: cpu@0 {
On {{MicroprocessorDevice | device=2}}, lower and middle OTPs (OTP 0 to 255) are accessible by the non-secure world.
  compatible = "arm,cortex-a7";
  device_type = "cpu";
  reg = <0>;
  clocks = <&scmi0_clk CK_SCMI0_MPU>;
  clock-names = "cpu";
  operating-points-v2 = <&cpu0_opp_table>;
  nvmem-cells = <&part_number_otp>;
  nvmem-cell-names = "part_number";
  #cooling-cells = <2>;
  };


With these nvmem-cells / nvmem-cell-names properties, the CPU0 device can easily find the OTP number, in order to access part number information.<br/>
[[STM32 MPU OP-TEE_overview|OP-TEE]] needs to manage exceptions in [[OP-TEE_OTP_overview|BSEC PTA]] to allow some upper OTPs to be accessed by the non-secure world, through secure world services for very specific needs as described in {{CodeSource | OP-TEE_OS | documentation/devicetree/bindings/nvmem/st,stm32-romem.yaml}}.


==== STM32MP1 nvmem_layout node (bootloader specific) ====
{{Warning| Upper (and middle on {{MicroprocessorDevice | device=2}}) OTP 32-bit length words are ECC-protected. To avoid an invalid ECC, computed after a second write operation, these 64 upper OTPs should be be permanent write locked when they are programmed.}}
The STM32MP1 nvmem_layout node gathers all NVMEM platform-dependent layout information, including OTP names and phandles, in order to allow easy access for data consumers, using pre-defined string in the nvmem-cell-names property.


  nvmem_layout: nvmem_layout@0 {
This exceptions are defined by the OTP declaration in the secure world device tree with a 32-bit length granularity (that is, 4 bytes):
  compatible = "st,stm32mp1-nvmem-layout";
* using the {{highlightParam|st,non-secure-otp}} property to allow a read/write (only supported by {{MicroprocessorDevice | device=1}})
  nvmem-cells = <&cfg0_otp>,
* using the {{highlightParam|st,non-secure-otp-provisioning}} property to allow a write until the first programmed value or permanent lock; used for secrets used by secure world but provisioned by the non-secured world.
        <&part_number_otp>,
        <&monotonic_otp>,
        <&nand_otp>,
        <&uid_otp>,
        <&package_otp>,
        <&hw2_otp>;
 
  nvmem-cell-names = "cfg0_otp",
    "part_number_otp",
    "monotonic_otp",
    "uid_otp",
    "nand_otp",
    "package_otp",
    "hw2_otp";
  };


With this new node, the platform can easily find the OTP numbers, in order to access all the necessary information.
See example {{CodeSource | OP-TEE_OS | core/arch/arm/dts/stm32mp135f-dk.dts}}.


==How to configure the DT using STM32CubeMX==
==How to configure the DT using STM32CubeMX==
The [[STM32CubeMX]] tool can be used to configure the STM32MPU device and get the corresponding [[Device_tree#STM32|platform configuration device tree]] files.<br />
The [[STM32CubeMX]] tool can be used to configure the STM32MPU device and get the corresponding [[Device_tree#STM32_MPU|platform configuration device tree]] files.<br />
STM32CubeMX may not support all the properties described in the documents listed in [[#DT bindings documentation|DT bindings documentation]] above. If so, the tool inserts '''user sections''' in the generated device tree. These sections can then be edited to add some properties that are preserved from one generation to another. Refer to the [[STM32CubeMX]] user manual for further information.
STM32CubeMX may not support all the properties described in DT binding files listed in the above [[#DT bindings documentation|DT bindings documentation]] paragraph. If so, the tool inserts '''user sections''' in the generated device tree. These sections can then be edited to add some properties, and they are preserved from one generation to another. Refer to [[STM32CubeMX]] user manual for further information.


==References==
==References==
Line 163: Line 77:
<noinclude>
<noinclude>
[[Category:Device tree configuration]]
[[Category:Device tree configuration]]
[[Category:Platform security]]
[[Category:OP-TEE Persistent storage]]  
{{ArticleBasedOnModel | Peripheral or framework device tree configuration model}}
{{ArticleBasedOnModel | Peripheral or framework device tree configuration model}}
{{PublicationRequestId | 15044 | 2020-02-21 | 13613 (PhilipS - 2019-10-09))}}
{{PublicationRequestId | 15044 | 2020-02-21 | 13613 (PhilipS - 2019-10-09))}}
</noinclude>
</noinclude>

Latest revision as of 13:39, 9 May 2025↑

Applicable for STM32MP13x lines, STM32MP15x lines, STM32MP21x lines, STM32MP23x lines, STM32MP25x lines

1. Article purpose[edit | edit source]↑

The purpose of this article is to explain how to configure the BSEC using the device tree mechanism, relying on the bindings documentation, that is the description of the required and optional device-tree properties.

2. DT bindings documentation[edit | edit source]↑

Generic information about NVMEM is available in the NVMEM overview.

The device tree binding documents for BSEC are stored either in the given applicable components listed below, or in the Linux kernel repository:

3. DT configuration[edit | edit source]↑

This hardware description is a combination of the STM32 microprocessor device tree files (.dtsi extension) and board device tree files (.dts extension). See the Device tree for an explanation of the device-tree file organization.

STM32CubeMX can be used to generate the board device tree. Refer to How to configure the DT using STM32CubeMX for more details.

3.1. DT configuration (STM32/SoC level)[edit | edit source]↑

The BSEC node and NVMEM node are located in the device tree file for the software components, supporting the peripheral and listed in the above DT bindings documentation paragraph.

Warning.png This device tree part is related to STM32 microprocessors. It must be kept as is, without being modified by the end-user.

3.2. DT configuration (board level)[edit | edit source]↑

The objective of this chapter is to explain how to enable and configure the BSEC DT nodes for a board.

Peripheral configuration should be done in specific board device tree files (board dts file).

3.2.1. BSEC node append[edit | edit source]↑

The board definition in the device tree may include some additional board-specific OTP declarations, for example to add a NVMEM data cell: 

 &bsec {
 	calib@20 {
 		reg = <0x20 0x2>;
 	};
 	board_id: board_id@ec {
 		reg = <0xec 0x4>;
 		st,non-secure-otp;
 	};
 	oem_enc_key@170 {
 		reg = <0x170 0x10>;
 		st,non-secure-otp-provisioning;
 	};
 };

On STM32MP1 series, only lower OTPs (OTP 0 to 31) are accessible by the non-secure world by default.

On STM32MP2 series, lower and middle OTPs (OTP 0 to 255) are accessible by the non-secure world.

OP-TEE needs to manage exceptions in BSEC PTA to allow some upper OTPs to be accessed by the non-secure world, through secure world services for very specific needs as described in documentation/devicetree/bindings/nvmem/st,stm32-romem.yaml .

Warning.png Upper (and middle on STM32MP2 series) OTP 32-bit length words are ECC-protected. To avoid an invalid ECC, computed after a second write operation, these 64 upper OTPs should be be permanent write locked when they are programmed.

This exceptions are defined by the OTP declaration in the secure world device tree with a 32-bit length granularity (that is, 4 bytes):

  • using the st,non-secure-otp property to allow a read/write (only supported by STM32MP1 series)
  • using the st,non-secure-otp-provisioning property to allow a write until the first programmed value or permanent lock; used for secrets used by secure world but provisioned by the non-secured world.

See example core/arch/arm/dts/stm32mp135f-dk.dts .

4. How to configure the DT using STM32CubeMX[edit | edit source]↑

The STM32CubeMX tool can be used to configure the STM32MPU device and get the corresponding platform configuration device tree files.
STM32CubeMX may not support all the properties described in DT binding files listed in the above DT bindings documentation paragraph. If so, the tool inserts user sections in the generated device tree. These sections can then be edited to add some properties, and they are preserved from one generation to another. Refer to STM32CubeMX user manual for further information.

5. References[edit | edit source]↑

Please refer to the following links for additional information:



Device tree

Linux® is a registered trademark of Linus Torvalds.

Trusted firmware for Arm® Cortex®-A (see TF-A)

Boot loader stage 2

Open portable trusted execution environment

Boot and Security and OTP control

Das U-Boot -- the universal boot loader (see U-Boot)

Operating system

One time programmed

Error correction capability or Elliptic curve cryptography, meaning depends on context

Retrieved from "https://wiki.st.com/stm32mpu/index.php?title=BSEC_device_tree_configuration&oldid=116642"