tegra234: bare-metal BL33 target with verified EL2->EL1 + device-tree boot - #839
Draft
dgarske wants to merge 1 commit into
Draft
tegra234: bare-metal BL33 target with verified EL2->EL1 + device-tree boot#839dgarske wants to merge 1 commit into
dgarske wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds a new tegra234 bare-metal target that runs wolfBoot as the BL33 firmware stage on NVIDIA Jetson Orin (Tegra234), enabling verified payload boot and an EL2→EL1 handoff with a device tree passed in x0 per the arm64 Linux boot ABI.
Changes:
- Add a Tegra234 bare-metal HAL (console via TCU mailbox, generic timer, BPMP IPC, EL2→EL1 handoff plumbing) plus a DRAM-resident linker script.
- Add build/config/docs/CI support for the new
tegra234andtegra234-linuxconfigurations and bundle-building scripts for DRAM-staged boot. - Extend the generic SDHCI driver with an optional platform clock hook to support BPMP/PMC-managed clock trees (e.g., Tegra).
Reviewed changes
Copilot reviewed 16 out of 16 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| tools/scripts/tegra234-mkpoc.sh | New helper to build a PoC BL33 bundle containing wolfBoot + signed payload + DTB for DRAM-staged boot. |
| tools/scripts/tegra234-mkbl33.sh | New helper to build an RCM-bootable BL33 bundle for EL2 payload boot. |
| test-app/boot_arm64_start.S | Preserve/restores handoff x0 across runtime init so the PoC payload can consume DTB pointer. |
| test-app/app_tegra234.c | New Tegra234 PoC payload that prints EL and validates DTB magic at the handed-off pointer. |
| src/sdhci.c | Add weak platform clock hook integration into SDHCI clock programming. |
| src/boot_aarch64_start.S | Tegra234-specific simple-startup tweaks: use dedicated DRAM stack and capture handoff x0. |
| Makefile | Add tegra234 main target selection consistent with RAM-boot style targets. |
| include/sdhci.h | Declare the optional sdhci_platform_set_clock() hook. |
| hal/tegra234.ld | New DRAM-resident linker script and staging address symbols for the Tegra234 BL33 target. |
| hal/tegra234.h | New target header enabling simple builtin startup for Tegra234. |
| hal/tegra234.c | New Tegra234 HAL implementation (console/timer/BPMP IPC/boot handoff + SDHCI WIP hooks). |
| docs/Targets.md | Document the new Tegra234 BL33-firmware target and basic build steps. |
| config/examples/tegra234.config | New base config for Tegra234 BL33 (EL2 payload boot). |
| config/examples/tegra234-linux.config | New config enabling EL2→EL1 + DTB handoff path for DRAM-staged Linux boot. |
| arch.mk | Add Tegra234-specific AArch64 flags and optional handoff dump build flag. |
| .github/workflows/test-configs.yml | Add CI build jobs for the two new tegra234 example configs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+398
to
+401
| base_clk_khz = sdhci_platform_set_clock(clock_khz, base_clk_khz); | ||
| if (base_clk_khz == 0) { | ||
| return -1; | ||
| } |
Comment on lines
+19
to
+21
| L4T=/home/davidgarske/l4t/Linux_for_Tegra | ||
| DTB="${1:-$L4T/kernel/dtb/tegra234-p3768-0000+p3767-0005-nv.dtb}" | ||
| [ -f "$DTB" ] || { echo "ERROR: DTB not found: $DTB"; exit 1; } |
| Build the BL33 image for the DRAM-staged verify + EL2->EL1 + device-tree boot: | ||
|
|
||
| ``` | ||
| tools/scripts/tegra234-mkpoc.sh |
Comment on lines
+22
to
+24
| L4T=/home/davidgarske/l4t/Linux_for_Tegra | ||
| DTB="${1:-$L4T/kernel/dtb/tegra234-p3768-0000+p3767-0005-nv.dtb}" | ||
| [ -f "$DTB" ] || { echo "ERROR: DTB not found: $DTB"; exit 1; } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
tegra234target that runs wolfBoot as bare-metal firmware on the NVIDIA Jetson Orin (Tegra234), replacing the edk2 UEFI payload (BL33) instead of running as a UEFI application. BL33 is the normal-world bootloader that ARM Trusted Firmware (BL31) hands off to at EL2 non-secure; on Jetson it is the edk2 UEFI / cpu-bootloader (cpubl) slot. Running here places wolfBoot's verification directly on top of the SoC's fused root of trust, with a minimal trusted computing base beneath it.This is self-contained and independent of the
aarch64_efiUEFI-application target (which runs wolfBoot under UEFI). The two are complementary and are separate efforts. This branch needs nothing from the UEFI work.Problem it solves
Running wolfBoot as a UEFI application leaves the entire vendor UEFI firmware (a large driver, filesystem, and network stack) between the hardware root of trust and wolfBoot's verifier. For a minimal, auditable secure-boot chain, wolfBoot should own the handoff to the OS directly, with nothing but ARM Trusted Firmware beneath it.
What it does (validated on hardware)
x0-- the arm64 Linux boot contract -- straight from DRAM, with no storage driver.Included
hal/tegra234.{c,h,ld}-- TCU console, ARMv8 generic timer, BPMP IPC, handoff dump, BL33 -> EL1 boot.config/examples/tegra234.config(EL2 boot) andconfig/examples/tegra234-linux.config(EL2 -> EL1 + device tree).tools/scripts/tegra234-mkbl33.shandtegra234-mkpoc.sh-- build the BL33 image with the signed payload + DTB bundled for DRAM boot.docs/Targets.mdsection.Status / limits (documented in-tree)
Boots a verified payload and device tree from DRAM today. Loading a full kernel from storage is in progress, bounded by two constraints: MB2 caps the BL33 image at 4 MB (a full kernel must be loaded, not bundled), and microSD (SDHCI,
DISK_SDCARD, off by default) is blocked on the closed SDMMC1 controller bring-up. Both are noted inhal/tegra234.c.Testing
cp config/examples/tegra234.config .config && make wolfboot.bin CROSS_COMPILE=aarch64-linux-gnu-(and the-linuxconfig). Both are compile-tested in CI.tools/scripts/tegra234-mkpoc.sh, then RCM boot; the console showsFirmware Valid->EL2->EL1 via ERET-> a valid device tree (magic = OK).