Enabling HSE on A53 core

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Enabling HSE on A53 core

998 Views
ashwini2024
Contributor II

How to enable HSE and perform cyrpto operations like Key generation, encryption/decryption, signature generation/verification? Do you have specific document or steps which tells how to enable HSE and perform Crypto graphic operations on A53 core? 

 

I have performed followings for enabling HSE on A53 core 

 

Step1: I have enabled HSE on A53 as per the "chapter 10 - HSE security support " of Linux BSP 40 with all the required configuration and placed HSE firmware in required path as per the document and built the yocto package. 

i have added ,

DISTRO_FEATURES:append = " hse "
NXP_FIRMWARE_LOCAL_DIR = "/yocto-s32/hse"

in local.conf 

and then enabled hse_nxp_support 

and changed the default firmware file.

 

Step2: In NxP boot I have configured ATF booting and I have generated IVT by enabling eFuse and configuring HSE(HSE backup image) and flashed on to the target. Here A53 core booting is not happening and its stuck in booting and showing that A53 core loaded and reset handler address is 0x34610000

0 Kudos
Reply
26 Replies

723 Views
ashwini2024
Contributor II

I am not getting any logs while doing the changes.
In local.conf i have added the following :
DISTRO_FEATURES:append = " hse "
NXP_FIRMWARE_LOCAL_DIR = "/yocto-s32g3/hse"
HSE_VERSION = "0_2_22_0"
HSE_SOC_REV = "rev1.0"
HSE_LIC_MD5 = "a1bda359fc5cdcfca04f84834841a5ca"

what am i supposed to update in local.conf?

0 Kudos
Reply

745 Views
ashwini2024
Contributor II

ashwini2024_0-1728457968905.png

this is the blob structure

0 Kudos
Reply

784 Views
Celeste_Liu
NXP Employee
NXP Employee

Hello @ashwini2024 ,

Thanks for contacting us. We are following this same inquiry with another member of your company, would you like us to mirror the information from the other support case into that one?

And I notice that you want to enable HSE on the A core. If you only want to enable the A core and don't need the M core, then step 2 is not necessary. IVT is used to generate the image for M core startup, and this operation is not mandatory.

As for your question about enabling HSE and performing crypto operations like key generation, encryption/decryption, and signature generation/verification on the A53 core, I recommend referring to documents AN13495 and AN14072. These two documents describe in detail how to access HSE using PKCS#11 in the A53 core. I have already sent these documents to your colleague through the SFDC platform.

If you have any further questions or need more assistance, please feel free to let us know.

Best Regards,

Celeste

0 Kudos
Reply

765 Views
ashwini2024
Contributor II

I am using bsp 40.
In order to enable hse On the A53 core i have included the below lines in local.conf:
DISTRO_FEATURES:append = " hse "
NXP_FIRMWARE_LOCAL_DIR = "/yocto-s32g3/hse" [I have created a hse folder and placed the HSE_FW_S32G3XX_0_2_22_0 folder provided by NXP]
HSE_VERSION = "0_2_22_0"
HSE_SOC_REV = "rev1.0"
HSE_LIC_MD5 = "a1bda359fc5cdcfca04f84834841a5ca"
Then i have enabled NXP_HSE_SUPPORT :
CONFIG_NXP_HSE_SUPPORT=y
CONFIG_NXP_HSE_FW_FILE="/yocto-s32g3/build_s32g399ardb3/tmp/work/s32g399ardb3-fsl-linux/u-boot-s32/2022.04-r0/recipe-sysroot/lib/firmware/s32cc_hse_fw.bin"

Now a log_do_compile file is generated with the image layout as follows:

Image Layout
  DCD:      Offset: 0x200    Size: 0x1c
  IVT:      Offset: 0x1000    Size: 0x100
  HSE Firmware:    Offset: 0x1200    
  HSE SYS Image:    Offset: 0x62400    Size: 0xc000
  AppBootCode Header:  Offset: 0x6e400    Size: 0x40
  Application:    Offset: 0x6e440    Size: 0x2f800

 

Boot Core:  A53_0
IVT Location:  SD/eMMC
Load address:  0x346062c0
Entry point:  0x34610000

While creating blob we have placed hse at 0x1200 and hse sys image at 0x6400 then updated load address as 0x346062c0 as in  the log do compile image layout and even the reset handler address is updated to 0x34610000 Source address in QSPI as 0x601240 and load address in RAM as 0x34606b00.
I have copied the kernel image , rootfs and dtb file to the SD card.
I have flashed the IVT blob, the fip.s32-sdcard.
I am getting the below error the control is not going to the atf and it is stuck at the reset handler.

ashwini2024_0-1728456868786.png

What is the fault and Are there any modifications or should i add any support on the yocto side ?
Please do reply.
Thank you.



0 Kudos
Reply

742 Views
ashwini2024
Contributor II

If i have to enable hse on A53 core alone without nor flash and by using sd card boot mode what steps should i follow ? Should i update the dts file to change the memory reserved for hse ?
Please do reply.

0 Kudos
Reply

738 Views
Celeste_Liu
NXP Employee
NXP Employee

Sorry for the late reply. I have a lot of work on hand and have limited bandwidth.
If you only want to enable HSE only on the A53 core with SD card boot mode. After editing the conf/local.conf file, you can directly use Yocto build and use the command "bitbake fsl-image-auto" to compile and generate the *.sdcard file. It can be found in the build_s32g274aevb/tmp/deploy/images/s32g274aevb directory. After burning the image to the RDB2 board, the boot-up print is as shown below.

Celeste_Liu_0-1728472856183.png

Thank you for your understanding.

0 Kudos
Reply

718 Views
ashwini2024
Contributor II

I am using bsp 40. The board is s32g399ardb3.
Could you let me know what are the changes to be included in the local.conf?

0 Kudos
Reply

709 Views
Celeste_Liu
NXP Employee
NXP Employee

In local.conf, You can only add the following three lines:

DISTRO_FEATURES:append = " hse "
NXP_FIRMWARE_LOCAL_DIR = "/yocto-s32g3/hse"
HSE_VERSION = "0_2_22_0"

Please note that this must be the content of the folder pointed by NXP_FIRMWARE_LOCAL_DIR:

ls /yocto-s32g3/hse
HSE_FW_S32G3XX_0_2_22_0

 

 

0 Kudos
Reply

695 Views
ashwini2024
Contributor II

Thank you for your prompt reply. Are there any changes to be done further for changing the reserved memory space for hse in dts files?

0 Kudos
Reply

674 Views
Celeste_Liu
NXP Employee
NXP Employee

We recommend using the command "bitbake fsl-image-auto" to compile and generate the *.sdcard file. It does not require modifying the DTS files.

0 Kudos
Reply

561 Views
ashwini2024
Contributor II

I am using bitbake ros-image-core and not bitbake fsl-image-core Any changes required?

0 Kudos
Reply

560 Views
ashwini2024
Contributor II

The following is my local.conf file :

MACHINE ??= 's32g399ardb3'
DISTRO ?= 'fsl-auto'
PACKAGE_CLASSES ?= "package_deb"
IMAGE_FEATURES += "package-management"
EXTRA_IMAGE_FEATURES ?= "debug-tweaks"
USER_CLASSES ?= "buildstats"
PATCHRESOLVE = "noop"
BB_DISKMON_DIRS ??= "\
    STOPTASKS,${TMPDIR},1G,100K \
    STOPTASKS,${DL_DIR},1G,100K \
    STOPTASKS,${SSTATE_DIR},1G,100K \
    STOPTASKS,/tmp,100M,100K \
    HALT,${TMPDIR},100M,1K \
    HALT,${DL_DIR},100M,1K \
    HALT,${SSTATE_DIR},100M,1K \
    HALT,/tmp,10M,1K"
PACKAGECONFIG:append:pn-qemu-system-native = " sdl"
CONF_VERSION = "2"
BB_NUMBER_THREADS = "4"
PARALLEL_MAKE = "-j 4"
DL_DIR = "/yocto-s32g3/downloads"
SSTATE_DIR = "/yocto-s32g3/sstate-cache"
ACCEPT_FSL_EULA = ""
LICENSE_FLAGS_ACCEPTED:append = " commercial_elektrobit"
GCCVERSION = "11.%"
GCC_DISABLE_LANGUAGES = "fortran"
EXTRA_OECONF:append_pn-gcc = " --disable-languages=fortran"
EXTRA_OECONF:appen_pn-gcc-corss = " --disable-languages=fortran"
DISTRO_FEATURES:append = " virtualization "
DISTRO_FEATURES:append = " lxc"
PREFERRED_VERSION_linux-s32 = "6.6.12"
IMAGE_INSTALL += "modemmanager"

 

# Parallelism Options
BB_NUMBER_THREADS = "8"
PARALLEL_MAKE = "-j 8"
DL_DIR = "/yocto-s32g3/downloads"
SSTATE_DIR = "/yocto-s32g3/sstate-cache"

 

DISTRO_FEATURES:append = " hse "
NXP_FIRMWARE_LOCAL_DIR = "/yocto-s32g3/folder"
HSE_VERSION="0_2_22_0"

Inside my /folder/hse/bin the fw file is as follows:

rev1.0_s32g3xx_hse_fw_0.20.0_2.22.0_pb230821.bin.pink

 Now when i do bitbake ros-image-core and generate the .sdcard file and copy it and flash on the target machine and do sd card boot ,
i am not getting any logs and the output is as below displayed in the image.
Please let me know where i am doing an error .
THank you.

ashwini2024_0-1728973205986.png

 



0 Kudos
Reply

542 Views
Celeste_Liu
NXP Employee
NXP Employee

In your environment, when executing the command "ls /yocto-s32g3/folder", the returned result is "HSE_FW_S32G2XX_0_2_22_0". Inside the path "/yocto-s32g3/folder/hse/bin", the firmware file is as follows: rev1.1_s32g3xx_hse_fw_0.20.0_2.22.0_pb230810.bin.pink.
For this purpose, please add a line "HSE_SOC_REV = "rev1.1"" in the local.conf file.

0 Kudos
Reply

536 Views
ashwini2024
Contributor II

Why should i use rev 1.1 and not rev 1.0 ?

0 Kudos
Reply

518 Views
Celeste_Liu
NXP Employee
NXP Employee

See the description in the document "Release Notes for S32G3 HSE Firmware 0.2.22.0".

Celeste_Liu_0-1728982741737.png

 

0 Kudos
Reply

514 Views
ashwini2024
Contributor II

Does that mean i can use any version or is it board dependent ?

0 Kudos
Reply

492 Views
Celeste_Liu
NXP Employee
NXP Employee

It is board dependent. It can be seen from the startup print information of U-boot. On my side, the screenshot is as follows.

Celeste_Liu_0-1728984946595.png

 

0 Kudos
Reply

489 Views
ashwini2024
Contributor II

Whats the command to check that ?

0 Kudos
Reply

484 Views
Celeste_Liu
NXP Employee
NXP Employee

No command is needed. It is the automatic print information when booting through the serial port. You can download any Linux BSP prebuilt image. After burning it to an SD card and starting it normally, you can see it. If you don't know how to download the prebuilt image, please tell me.

0 Kudos
Reply

393 Views
ashwini2024
Contributor II

Now the following shows up
How do i ensure that hse is up and status is OK ?
Am i supposed to write a C code and could u let me know the api to use ?

0 Kudos
Reply