plat-versal: add support for the Versal Net variant #6738

jcorbier · 2024-03-05T17:30:10Z

This series upgrades the AMD/Xilinx port with the following:

Add support for a new SoC in the Versal family
Add a hardware crypto accelerator driver for this specific SoC
Fixes for more recent versions of the Xilinx software environment (PLM APIs have changed in 2023)

ldts · 2024-03-06T10:25:47Z

I need to ask that the changes to support the more recent AMD/Xilinx tools maintain backwards compatibility. We should be able to query the ABI at runtime - maybe even propose whatever is needed to AMD/Xilinx https://github.com/Xilinx/embeddedsw .

I'd like to understand as well the level of testing that has been done with this software (just the output of xtest, to check if you encountered any regressions (ie this is the changelog for 4.1.0 #6574 (comment) ).

Thirdly is there anything that you also plan on posting to https://github.com/OP-TEE/optee_docs ?

jcorbier · 2024-03-06T10:38:16Z

Thanks @ldts for your feedback.

I need to ask that the changes to support the more recent AMD/Xilinx tools maintain backwards compatibility. We should be able to query the ABI at runtime - maybe even propose whatever is needed to AMD/Xilinx https://github.com/Xilinx/embeddedsw .

Noted. Let me see how best we can implement that.

I'd like to understand as well the level of testing that has been done with this software (just the output of xtest, to check if you encountered any regressions (ie this is the changelog for 4.1.0 #6574 (comment) ).

I don't have access to the logs right now but the current state is the same as for Versal in 4.1.0.

Thirdly is there anything that you also plan on posting to https://github.com/OP-TEE/optee_docs ?

Yes, a working version is available here https://github.com/ProvenRun/optee_docs/tree/versal_net_port
It needs some additional work before I create a pull request for it though.

Same thing for build and manifest repositories.

ldts · 2024-03-08T11:06:39Z

we should split the drivers (rng/nvm) into a different files (versal_net_rng, versal_net_nvm?)

jcorbier · 2024-03-08T13:39:45Z

we should split the drivers (rng/nvm) into a different files (versal_net_rng, versal_net_nvm?)

Agreed, the initial thinking for the current implementation was to avoid as much code duplication as possible between versal and versal_net but in the end it makes things much more complicated than needed.

nathan-menhorn · 2024-03-12T15:08:46Z

Hi @jcorbier any updates on this PR?

jcorbier · 2024-03-12T15:47:37Z

Hi @jcorbier any updates on this PR?

Hi @nathan-menhorn, still working out the details of what needs to be done to properly split versal/versal-net code, including the TRNG update. I'll try and push an update to this PR by end of this week.

core/arch/arm/plat-versal/conf.mk

core/pta/versal/fpga_pta.c

core/drivers/versal_mbox.c

core/drivers/crypto/versal/ecc.c

core/drivers/crypto/versal/ecc_mbox.c

core/drivers/versal_mbox.c

ldts · 2024-03-31T19:17:50Z

@etienne-lms could you hold your comments until the patchset is updated please?

There are a couple of functional changes that need addressing first

ABI runtime detection (not only to support the older toolchain but also to be covered for changes in the future)
use different files for Versal net instead of conditional macros (since some drivers are radically different).

So I suggest we wait for that before we go into details (ie default configs, coding standards and so on) as some files will change quite a bit

jcorbier · 2024-04-02T14:12:21Z

@etienne-lms could you hold your comments until the patchset is updated please?

Indeed, I'll be pusing fixup commits in the coming hours/days.

core/drivers/crypto/versal/ecc.c

core/drivers/crypto/versal/ecc_mbox.c

core/pta/versal/fpga_pta.c

core/drivers/versal_net_nvm.c

etienne-lms · 2024-04-03T08:01:03Z

core/drivers/versal_pm.c

-#define VERSAL_PM_MAJOR		0
-#define VERSAL_PM_MINOR		1
+#define VERSAL_PM_MAJOR		1
+#define VERSAL_PM_MINOR		0


Deserves a specific commit IMHO.

core/drivers/crypto/versal/authenc.c

nathan-menhorn · 2024-05-07T21:54:57Z

Hi @jcorbier what's the current status of this PR? Thanks.

nathan-menhorn · 2024-05-23T20:49:32Z

Hi @jcorbier any updates on this PR? Are patches to address all the comments in the PR still estimated to come by the end of the month? Thanks.

wangjudyw · 2024-06-27T03:02:11Z

core/drivers/versal_net_nvm.c

+	return do_write_efuses_value(EFUSE_WRITE_MISC1_CTRL_BITS, val);
+}
+
+TEE_Result versal_efuse_write_offchip_ids(uint32_t id)


this function is incorrect, there are total 8 offchip_revoke_id, and we use the api to update values for certain id, the parameters is lacking of the values going into that offchip id.
Please refer to the implementation in versal_nvm.c

Hi @wangjudyw,

Thanks for your feedback. This implementation is a direct mapping of the API offered by the xilnvm service:

https://github.com/Xilinx/embeddedsw/blob/86a272bd9cd412bf1e5214f6098aefff301e58f0/lib/sw_services/xilnvm/src/versal_net/server/xnvm_efuse_cdohandler.c#L229

As you can see, it only expects an uint32_t for the ID to be written in the fuses (and a flag that is set by default by the do_write_efuses_value() helper function). Could you elaborate what you mean?

Thanks!

etienne-lms

mainly coding style issues

core/drivers/crypto/versal/ecc.c

core/drivers/crypto/versal/ecc_mbox.c

core/drivers/versal_mbox.c

core/drivers/versal_net_nvm.c

core/drivers/versal_trng.c

lib/libutee/include/pta_versal_fpga.h

github-actions · 2024-07-29T01:43:11Z

This pull request has been marked as a stale pull request because it has been open (more than) 30 days with no activity. Remove the stale label or add a comment, otherwise this pull request will automatically be closed in 5 days. Note, that you can always re-open a closed issue at any time.

nathan-menhorn · 2024-07-29T13:54:56Z

Hi @jcorbier what's the status of this PR? Last we discussed updates were supposed to be pushed a few weeks ago? Thanks.

core/arch/arm/plat-versal/conf.mk

core/drivers/crypto/versal/authenc.c

core/drivers/crypto/versal/ecc.c

core/drivers/crypto/versal/ecc_mbox.c

core/drivers/versal_puf.c

core/include/drivers/versal_mbox.h

core/include/drivers/versal_trng.h

core/pta/versal/fpga_pta.c

ldts · 2024-08-22T13:00:14Z

@jcorbier do you plan on folding the commits as per the initial patch-set for further review? I can then have a a better look - last time I checked I found a simple regression (easy to fix).

Also I was testing the Xen hypervisor with the tip of OP-TEE on the vck190 evaluation kit and I found it to be broken. I was wondering if this is a configuration (optee+xen on Versal) that you have tested? I believe probably nobody has yet (@nathan-menhorn ?)

nathan-menhorn · 2024-08-26T03:00:24Z

Hi @ldts no testing has been performed on Xen+optee yet as there haven't been any customers requests.

nathan-menhorn · 2024-09-11T14:30:30Z

@jcorbier @ldts @etienne-lms just keeping this PR alive. We should be expecting some input from @jcorbier soon.

jcorbier · 2024-09-18T15:35:54Z

@jcorbier do you plan on folding the commits as per the initial patch-set for further review? I can then have a a better look - last time I checked I found a simple regression (easy to fix).

Yes, there a couple more things I want to fix then I'll force push a clean patchset to clean up the current fixup commits mess.

nathan-menhorn · 2024-09-18T19:01:09Z

core/drivers/versal_net_nvm.c

@@ -994,8 +1010,16 @@ TEE_Result versal_efuse_write_revoke_ppk(enum versal_nvm_ppk_type type)
 	return versal_efuse_write_misc(&misc_ctrl);
 }

+/*
+ * versal_efuse_write_revoke_id expects an efuse identifier between
+ * 1 and 256. 


@jcorbier 0 to 255

nathan-menhorn · 2024-09-18T19:03:27Z

core/drivers/versal_net_nvm.c

 TEE_Result versal_efuse_write_revoke_id(uint32_t id)
 {
+	if ((id < VERSAL_NET_REVOKE_EFUSE_MIN) ||


@jcorbier check should be between 0 and 255.

I'm not sure why the AMD software was implemented this way as this is very confusing and it doesn't match the OFFCHIP_REVOKE function, which expects values from 1 - 256, but this function expects values from 0 to 255

See the error handling of
https://github.com/Xilinx/embeddedsw/blob/master/lib/sw_services/xilnvm/src/versal_net/server/xnvm_efuse.c#L615C21-L617
compared to
https://github.com/Xilinx/embeddedsw/blob/master/lib/sw_services/xilnvm/src/versal_net/server/xnvm_efuse.c#L701-L703

nathan-menhorn · 2024-09-19T14:39:58Z

core/drivers/versal_net_nvm.c

@@ -1012,12 +1014,12 @@ TEE_Result versal_efuse_write_revoke_ppk(enum versal_nvm_ppk_type type)

 /*
 * versal_efuse_write_revoke_id expects an efuse identifier between
- * 1 and 256. 
+ * 1 and 256.


@jcorbier please fix.

nathan-menhorn · 2024-09-19T14:40:36Z

core/drivers/versal_net_nvm.c

+	if (id < VERSAL_NET_REVOKE_EFUSE_MIN ||
+	    id > VERSAL_NET_REVOKE_EFUSE_MAX)


@jcorbier checks needs to be between 0 and 255 for this function.

@jcorbier please fix.

ldts · 2024-09-23T06:31:46Z

@jcorbier @nathan-menhorn I am not seeing the separate commit that updates versal to the new PLM - I dont think this should be introduced just as part of the versal_net platform.
having said that, if we want to drop the support for the previous toolchain (@nathan-menhorn?) then I suppose we could.

Re: is this all that is needed or something else coming (this breaks versal last time I tested it)
9267cb6

nathan-menhorn · 2024-09-27T03:27:53Z

@jcorbier @nathan-menhorn I am not seeing the separate commit that updates versal to the new PLM - I dont think this should be introduced just as part of the versal_net platform. having said that, if we want to drop the support for the previous toolchain (@nathan-menhorn?) then I suppose we could.

Re: is this all that is needed or something else coming (this breaks versal last time I tested it) 9267cb6

Hi @ldts we still need Versal support as customers are actively using the Versal version. If this (your link above) breaks your original port supported for the 2022.1 and 2022.2 Versal BSPs then this isn't good.

ldts · 2024-09-27T06:54:41Z

Hi @ldts we still need Versal support as customers are actively using the Versal version. If this (your link above) breaks your original port supported for the 2022.1 and 2022.2 Versal BSPs then this isn't good.

ok. I'll wait for the commits being fold, then validate and review the partitioning/integration - @etienne-lms has already done the heavy lifting.

do you know if anyone is looking into the xen support? as I said it broken but I dont think it should be much work to get it right

nathan-menhorn · 2024-09-30T15:37:33Z

Thanks @ldts. No one is looking into Xen + OP-TEE support. We don't have any customer requests and we don't have the resources to investigate this at this time.

ldts · 2024-09-30T19:18:19Z

Thanks @ldts. No one is looking into Xen + OP-TEE support. We don't have any customer requests and we don't have the resources to investigate this at this time.

um, that is a pity. Over the summer I did some prototyping - integrated OP-TEE on meta-xilinx booted xen and started debugging op-tee but then had to drop it.

Maybe I'll continue with it since I still have your board - need to check with my employer first if they allow me work on this on my spare time. will let you know

nathan-menhorn · 2024-10-01T02:11:11Z

Thanks @ldts. Feel free to give me an update offline through email.

etienne-lms · 2024-11-15T14:08:36Z

I suggest you squash the fixup commits when updating this P-R.

jcorbier · 2024-11-15T14:10:02Z

``

I suggest you squash the fixup commits when updating this P-R.

Indeed, I'll push a cleaned up patch set. It's getting very messy. Thanks!

ldts · 2024-11-22T08:30:50Z

``

I suggest you squash the fixup commits when updating this P-R.

Indeed, I'll push a cleaned up patch set. It's getting very messy. Thanks!

thanks @jcorbier - in case I dont see the github notification (github notifications operate as a TRNG for me), you can ping me on jorge@foundries.io and I'll validate locally

nathan-menhorn · 2024-12-13T15:13:07Z

Hi @jcorbier what's the chance of getting this work finished (including the TRNG) as discussed in our last meeting as there's only about 15 days left in the year? The end customer is now almost a year behind awaiting this port. Thanks.

nathan-menhorn · 2024-12-17T17:22:07Z

@jcorbier what's the status?

nathan-menhorn · 2024-12-20T16:33:35Z

Hi @jcorbier 11 days left in the year. Could we at least get an update? Thanks.

jcorbier · 2024-12-21T09:38:56Z

Hello @nathan-menhorn, things have been hectic here and the développer who was supposed to complete the last missing pieces for the port is only available starting next Monday. I'll sync up with him and let you know when we can finally finish this up. Sorry for the delay.

nathan-menhorn · 2025-01-07T17:47:49Z

Hi @jcorbier Happy New Year! Thank you for the update. Please give me an email update by the end of the week (or post here) as the end customer is still awaiting the port. Thanks.

nathan-menhorn · 2025-01-17T17:59:54Z

Hi @jcorbier what's the status of this port? Thanks.

nathan-menhorn · 2025-01-20T17:27:56Z

Hi @jcorbier what's the status of this port? Thanks.

jcorbier · 2025-01-30T17:52:07Z

@nathan-menhorn This push is just a massive cleanup of the work on the upstreaming. I'll be pushing missing bits tomorrow before end of business day. I understand the frustration about the whole timeline. Sorry about that.

nathan-menhorn · 2025-01-30T22:47:33Z

Thanks for the update @jcorbier. Will this also include the TRNG updates?

jcorbier · 2025-01-30T22:53:02Z

Yes, this will include support for TRNGv2 Le jeu. 30 janv. 2025, 23:47, nathan-menhorn ***@***.***> a écrit :

…

Thanks for the update @jcorbier <https://github.com/jcorbier>. Will this also include the TRNG updates? — Reply to this email directly, view it on GitHub <#6738 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABV5XYCSWQGD57VAEZFXNRD2NKTZXAVCNFSM6AAAAABEHSAW5WVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMMRVG43TGNZRGA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

jenswi-linaro · 2025-01-31T08:48:06Z

Please rebase the patches to resolve the conflicts.

jcorbier · 2025-01-31T09:13:26Z

Please rebase the patches to resolve the conflicts.

@jenswi-linaro Will do, thanks. I'll be pushing more updates today.

Versal Net is a new SoC flavor based on the Versal architecture. This commit introduces it in versal platform code. Signed-off-by: Jeremie Corbier <jeremie.corbier@provenrun.com>

Make it more generic and still provide a default IPI channel to the PMC for the other drivers. Signed-off-by: Jeremie Corbier <jeremie.corbier@provenrun.com>

PLM HWRNG driver cannot provide more than 32 bytes of entropy at a time. Split bigger requests into 32 bytes chunks. Signed-off-by: Jeremie Corbier <jeremie.corbier@provenrun.com>

The Versal Net variant comes with a dedicated PKI engine. This driver makes use of the engine for ECDSA P-256, P-384, and P-521 sign, verify and key generation operations. Signed-off-by: Jeremie Corbier <jeremie.corbier@provenrun.com>

The original HUK driver generated the HUK using SHA-256. This commit replaces this mechanism with the more robust HKDF-SHA256. Signed-off-by: Jeremie Corbier <jeremie.corbier@provenrun.com>

Add simple PTA allowing to dynamically load data in the Versal PL. Signed-off-by: Jeremie Corbier <jeremie.corbier@provenrun.com>

- update crypto API IDs - update calls to the KAT subsystem Signed-off-by: Jeremie Corbier <jeremie.corbier@provenrun.com>

The XilNvm API has heavily changed between Versal and Versal Net. This commit adds support for the Net variant. Signed-off-by: Jeremie Corbier <jeremie.corbier@provenrun.com>

XilSecure has been updated to pack the public exponent right after the modulus rather than at a fixed 512 bytes (RSA 4096 key size) offset. See commit below for more details: Xilinx/embeddedsw@c2dd2eb Signed-off-by: Jeremie Corbier <jeremie.corbier@provenrun.com>

Versal Net TRNG is very close to Versal but includes hardware DF. This patch adds support for this. Signed-off-by: Jeremie Corbier <jeremie.corbier@provenrun.com>

jcorbier · 2025-01-31T16:05:54Z

@nathan-menhorn Just pushed a rebased version of the port with support for TRNG v2. I'll be pushing all other repositories on Monday morning after more testing but everything is pretty close to being complete.

etienne-lms reviewed Mar 20, 2024

View reviewed changes

etienne-lms reviewed Apr 3, 2024

View reviewed changes

wangjudyw reviewed Jun 27, 2024

View reviewed changes

etienne-lms reviewed Jun 27, 2024

View reviewed changes

github-actions bot added the Stale label Jul 29, 2024

github-actions bot removed the Stale label Jul 30, 2024

etienne-lms reviewed Aug 21, 2024

View reviewed changes

nathan-menhorn reviewed Sep 19, 2024

View reviewed changes

jforissier removed the Stale label Nov 15, 2024

jcorbier force-pushed the versal_net_port_upstreaming branch 2 times, most recently from 59c4f3a to 8e21b82 Compare January 30, 2025 17:43

jcorbier added 10 commits January 31, 2025 16:59

plat-versal: add support for Versal Net variant

d7d4604

Versal Net is a new SoC flavor based on the Versal architecture. This commit introduces it in versal platform code. Signed-off-by: Jeremie Corbier <jeremie.corbier@provenrun.com>

drivers: versal: rework mbox driver

ab79007

Make it more generic and still provide a default IPI channel to the PMC for the other drivers. Signed-off-by: Jeremie Corbier <jeremie.corbier@provenrun.com>

drivers: versal: use PLM for generic RNG operations

697aa34

PLM HWRNG driver cannot provide more than 32 bytes of entropy at a time. Split bigger requests into 32 bytes chunks. Signed-off-by: Jeremie Corbier <jeremie.corbier@provenrun.com>

drivers: versal: PKI engine driver for Versal Net

39c7115

The Versal Net variant comes with a dedicated PKI engine. This driver makes use of the engine for ECDSA P-256, P-384, and P-521 sign, verify and key generation operations. Signed-off-by: Jeremie Corbier <jeremie.corbier@provenrun.com>

drivers: versal: use HKDF to derive the HUK

1433253

The original HUK driver generated the HUK using SHA-256. This commit replaces this mechanism with the more robust HKDF-SHA256. Signed-off-by: Jeremie Corbier <jeremie.corbier@provenrun.com>

core: pta: add Versal FPGA PTA

4f7a7c6

Add simple PTA allowing to dynamically load data in the Versal PL. Signed-off-by: Jeremie Corbier <jeremie.corbier@provenrun.com>

drivers: versal: update to support more recent versions of the PLM

70ce215

- update crypto API IDs - update calls to the KAT subsystem Signed-off-by: Jeremie Corbier <jeremie.corbier@provenrun.com>

drivers: versal: NVM driver for Versal Net

fd65377

The XilNvm API has heavily changed between Versal and Versal Net. This commit adds support for the Net variant. Signed-off-by: Jeremie Corbier <jeremie.corbier@provenrun.com>

drivers: versal: add support for new TRNG IP

0ab9785

Versal Net TRNG is very close to Versal but includes hardware DF. This patch adds support for this. Signed-off-by: Jeremie Corbier <jeremie.corbier@provenrun.com>

jcorbier force-pushed the versal_net_port_upstreaming branch from 8e21b82 to 0ab9785 Compare January 31, 2025 16:04

		if (id < VERSAL_NET_REVOKE_EFUSE_MIN \|\|
		id > VERSAL_NET_REVOKE_EFUSE_MAX)

plat-versal: add support for the Versal Net variant #6738

Are you sure you want to change the base?

plat-versal: add support for the Versal Net variant #6738

Conversation

jcorbier commented Mar 5, 2024

ldts commented Mar 6, 2024 • edited Loading

jcorbier commented Mar 6, 2024

ldts commented Mar 8, 2024

jcorbier commented Mar 8, 2024

nathan-menhorn commented Mar 12, 2024

jcorbier commented Mar 12, 2024

ldts commented Mar 31, 2024

jcorbier commented Apr 2, 2024

Choose a reason for hiding this comment

nathan-menhorn commented May 7, 2024

nathan-menhorn commented May 23, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

etienne-lms left a comment

Choose a reason for hiding this comment

github-actions bot commented Jul 29, 2024

nathan-menhorn commented Jul 29, 2024

ldts commented Aug 22, 2024 • edited Loading

nathan-menhorn commented Aug 26, 2024

nathan-menhorn commented Sep 11, 2024

jcorbier commented Sep 18, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ldts commented Sep 23, 2024 • edited Loading

nathan-menhorn commented Sep 27, 2024

ldts commented Sep 27, 2024

nathan-menhorn commented Sep 30, 2024

ldts commented Sep 30, 2024

nathan-menhorn commented Oct 1, 2024

etienne-lms commented Nov 15, 2024

jcorbier commented Nov 15, 2024

ldts commented Nov 22, 2024

nathan-menhorn commented Dec 13, 2024

nathan-menhorn commented Dec 17, 2024

nathan-menhorn commented Dec 20, 2024

jcorbier commented Dec 21, 2024

nathan-menhorn commented Jan 7, 2025

nathan-menhorn commented Jan 17, 2025

nathan-menhorn commented Jan 20, 2025

jcorbier commented Jan 30, 2025

nathan-menhorn commented Jan 30, 2025

jcorbier commented Jan 30, 2025 via email

jenswi-linaro commented Jan 31, 2025

jcorbier commented Jan 31, 2025

jcorbier commented Jan 31, 2025

ldts commented Mar 6, 2024 •

edited

Loading

ldts commented Aug 22, 2024 •

edited

Loading

ldts commented Sep 23, 2024 •

edited

Loading