How to enable HSE and perform cyrpto operations like Key generation, encryption/decryption, signature generation/verification? Do you have specific document or steps which tells how to enable HSE and perform Crypto graphic operations on A53 core?
I have performed followings for enabling HSE on A53 core
Step1: I have enabled HSE on A53 as per the "chapter 10 - HSE security support " of Linux BSP 40 with all the required configuration and placed HSE firmware in required path as per the document and built the yocto package.
i have added ,
DISTRO_FEATURES:append = " hse "
NXP_FIRMWARE_LOCAL_DIR = "/yocto-s32/hse"
in local.conf
and then enabled hse_nxp_support
and changed the default firmware file.
Step2: In NxP boot I have configured ATF booting and I have generated IVT by enabling eFuse and configuring HSE(HSE backup image) and flashed on to the target. Here A53 core booting is not happening and its stuck in booting and showing that A53 core loaded and reset handler address is 0x34610000
I am not getting any logs while doing the changes.
In local.conf i have added the following :
DISTRO_FEATURES:append = " hse "
NXP_FIRMWARE_LOCAL_DIR = "/yocto-s32g3/hse"
HSE_VERSION = "0_2_22_0"
HSE_SOC_REV = "rev1.0"
HSE_LIC_MD5 = "a1bda359fc5cdcfca04f84834841a5ca"
what am i supposed to update in local.conf?
this is the blob structure
Hello @ashwini2024 ,
Thanks for contacting us. We are following this same inquiry with another member of your company, would you like us to mirror the information from the other support case into that one?
And I notice that you want to enable HSE on the A core. If you only want to enable the A core and don't need the M core, then step 2 is not necessary. IVT is used to generate the image for M core startup, and this operation is not mandatory.
As for your question about enabling HSE and performing crypto operations like key generation, encryption/decryption, and signature generation/verification on the A53 core, I recommend referring to documents AN13495 and AN14072. These two documents describe in detail how to access HSE using PKCS#11 in the A53 core. I have already sent these documents to your colleague through the SFDC platform.
If you have any further questions or need more assistance, please feel free to let us know.
Best Regards,
Celeste
I am using bsp 40.
In order to enable hse On the A53 core i have included the below lines in local.conf:
DISTRO_FEATURES:append = " hse "
NXP_FIRMWARE_LOCAL_DIR = "/yocto-s32g3/hse" [I have created a hse folder and placed the HSE_FW_S32G3XX_0_2_22_0 folder provided by NXP]
HSE_VERSION = "0_2_22_0"
HSE_SOC_REV = "rev1.0"
HSE_LIC_MD5 = "a1bda359fc5cdcfca04f84834841a5ca"
Then i have enabled NXP_HSE_SUPPORT :
CONFIG_NXP_HSE_SUPPORT=y
CONFIG_NXP_HSE_FW_FILE="/yocto-s32g3/build_s32g399ardb3/tmp/work/s32g399ardb3-fsl-linux/u-boot-s32/2022.04-r0/recipe-sysroot/lib/firmware/s32cc_hse_fw.bin"
Now a log_do_compile file is generated with the image layout as follows:
Image Layout
DCD: Offset: 0x200 Size: 0x1c
IVT: Offset: 0x1000 Size: 0x100
HSE Firmware: Offset: 0x1200
HSE SYS Image: Offset: 0x62400 Size: 0xc000
AppBootCode Header: Offset: 0x6e400 Size: 0x40
Application: Offset: 0x6e440 Size: 0x2f800
Boot Core: A53_0
IVT Location: SD/eMMC
Load address: 0x346062c0
Entry point: 0x34610000
While creating blob we have placed hse at 0x1200 and hse sys image at 0x6400 then updated load address as 0x346062c0 as in the log do compile image layout and even the reset handler address is updated to 0x34610000 Source address in QSPI as 0x601240 and load address in RAM as 0x34606b00.
I have copied the kernel image , rootfs and dtb file to the SD card.
I have flashed the IVT blob, the fip.s32-sdcard.
I am getting the below error the control is not going to the atf and it is stuck at the reset handler.
What is the fault and Are there any modifications or should i add any support on the yocto side ?
Please do reply.
Thank you.
If i have to enable hse on A53 core alone without nor flash and by using sd card boot mode what steps should i follow ? Should i update the dts file to change the memory reserved for hse ?
Please do reply.
Sorry for the late reply. I have a lot of work on hand and have limited bandwidth.
If you only want to enable HSE only on the A53 core with SD card boot mode. After editing the conf/local.conf file, you can directly use Yocto build and use the command "bitbake fsl-image-auto" to compile and generate the *.sdcard file. It can be found in the build_s32g274aevb/tmp/deploy/images/s32g274aevb directory. After burning the image to the RDB2 board, the boot-up print is as shown below.
Thank you for your understanding.
I am using bsp 40. The board is s32g399ardb3.
Could you let me know what are the changes to be included in the local.conf?
In local.conf, You can only add the following three lines:
DISTRO_FEATURES:append = " hse "
NXP_FIRMWARE_LOCAL_DIR = "/yocto-s32g3/hse"
HSE_VERSION = "0_2_22_0"
Please note that this must be the content of the folder pointed by NXP_FIRMWARE_LOCAL_DIR:
ls /yocto-s32g3/hse
HSE_FW_S32G3XX_0_2_22_0
Thank you for your prompt reply. Are there any changes to be done further for changing the reserved memory space for hse in dts files?
We recommend using the command "bitbake fsl-image-auto" to compile and generate the *.sdcard file. It does not require modifying the DTS files.
I am using bitbake ros-image-core and not bitbake fsl-image-core Any changes required?
The following is my local.conf file :
MACHINE ??= 's32g399ardb3'
DISTRO ?= 'fsl-auto'
PACKAGE_CLASSES ?= "package_deb"
IMAGE_FEATURES += "package-management"
EXTRA_IMAGE_FEATURES ?= "debug-tweaks"
USER_CLASSES ?= "buildstats"
PATCHRESOLVE = "noop"
BB_DISKMON_DIRS ??= "\
STOPTASKS,${TMPDIR},1G,100K \
STOPTASKS,${DL_DIR},1G,100K \
STOPTASKS,${SSTATE_DIR},1G,100K \
STOPTASKS,/tmp,100M,100K \
HALT,${TMPDIR},100M,1K \
HALT,${DL_DIR},100M,1K \
HALT,${SSTATE_DIR},100M,1K \
HALT,/tmp,10M,1K"
PACKAGECONFIG:append:pn-qemu-system-native = " sdl"
CONF_VERSION = "2"
BB_NUMBER_THREADS = "4"
PARALLEL_MAKE = "-j 4"
DL_DIR = "/yocto-s32g3/downloads"
SSTATE_DIR = "/yocto-s32g3/sstate-cache"
ACCEPT_FSL_EULA = ""
LICENSE_FLAGS_ACCEPTED:append = " commercial_elektrobit"
GCCVERSION = "11.%"
GCC_DISABLE_LANGUAGES = "fortran"
EXTRA_OECONF:append_pn-gcc = " --disable-languages=fortran"
EXTRA_OECONF:appen_pn-gcc-corss = " --disable-languages=fortran"
DISTRO_FEATURES:append = " virtualization "
DISTRO_FEATURES:append = " lxc"
PREFERRED_VERSION_linux-s32 = "6.6.12"
IMAGE_INSTALL += "modemmanager"
# Parallelism Options
BB_NUMBER_THREADS = "8"
PARALLEL_MAKE = "-j 8"
DL_DIR = "/yocto-s32g3/downloads"
SSTATE_DIR = "/yocto-s32g3/sstate-cache"
DISTRO_FEATURES:append = " hse "
NXP_FIRMWARE_LOCAL_DIR = "/yocto-s32g3/folder"
HSE_VERSION="0_2_22_0"
Inside my /folder/hse/bin the fw file is as follows:
rev1.0_s32g3xx_hse_fw_0.20.0_2.22.0_pb230821.bin.pink
Now when i do bitbake ros-image-core and generate the .sdcard file and copy it and flash on the target machine and do sd card boot ,
i am not getting any logs and the output is as below displayed in the image.
Please let me know where i am doing an error .
THank you.
In your environment, when executing the command "ls /yocto-s32g3/folder", the returned result is "HSE_FW_S32G2XX_0_2_22_0". Inside the path "/yocto-s32g3/folder/hse/bin", the firmware file is as follows: rev1.1_s32g3xx_hse_fw_0.20.0_2.22.0_pb230810.bin.pink.
For this purpose, please add a line "HSE_SOC_REV = "rev1.1"" in the local.conf file.
Why should i use rev 1.1 and not rev 1.0 ?
See the description in the document "Release Notes for S32G3 HSE Firmware 0.2.22.0".
Does that mean i can use any version or is it board dependent ?
It is board dependent. It can be seen from the startup print information of U-boot. On my side, the screenshot is as follows.
Whats the command to check that ?
No command is needed. It is the automatic print information when booting through the serial port. You can download any Linux BSP prebuilt image. After burning it to an SD card and starting it normally, you can see it. If you don't know how to download the prebuilt image, please tell me.
Now the following shows up
How do i ensure that hse is up and status is OK ?
Am i supposed to write a C code and could u let me know the api to use ?