Gahing's Space

Posted 2026-07-17Updated 2026-08-18Firmware & Secure Boot4 minutes read (About 548 words)

TL;DR

ArmSoM’s sales team emailed unprompted after noticing the CM5-IO listed as hardware-verified in the edk2-rk3576 README — kind words about both the UEFI port and the NPU mainlining work, and one real question: is the CM5 device tree headed for mainline Linux too, or just riding along with the UEFI path?
It’s going straight into mainline. rk3576-armsom-cm5.dtsi (module) and rk3576-armsom-cm5-io.dts (carrier) are on the linux-rockchip list at v4, split the same way as ArmSoM’s own Sige5 — already in mainline as rk3576-armsom-sige5.dts since v7.2-rc3 — which I used as the direct reference.
The binding patch carries Krzysztof Kozlowski’s Acked-by, and the DTS keeps ArmSoM’s copyright line.
Hardware-verified on the CM5-IO: GMAC0 with the on-module YT8531 linking at 1000 Mbit/s, RK806, HYM8563, eMMC, microSD, the USB3 hub, and PCIe all probe.
A small side patch too: a dwmac-rk fix on netdev that ungates the 25 MHz reference the crystal-less YT8531 needs in RGMII mode.

Posted 2026-06-12Updated 2026-08-18Firmware & Secure Boot9 minutes read (About 1310 words)

It came up secure end-to-end: memory map + DDR firewall, a real hardware TRNG (RK3576’s RKRNG, not RK3588’s TRNG_V1), and an OTP-derived Hardware Unique Key — xtest passes 113/114 on hardware, and the one miss was a build config, not the platform.
The silent console was a forced-override bug. TF-A hands RK3576’s BL32 no non-secure DT pointer, so the normal console probe never runs; needs CFG_EARLY_CONSOLE forced on (not just defaulted) and TF-A/OP-TEE agreeing on UART0.
The OTP key is a one-way door, and it’s treated like one: ephemeral HUK by default, persistent fuse-burning gated behind an explicit off-by-default flag until the OTP index is confirmed — burn the wrong row and it’s permanent.
Base platform support (#7821) is merged into mainline OP-TEE; the OTP key-derivation half (#7841) is still in review, split out deliberately so the irreversible part gets its own scrutiny.

Posted 2026-05-24Updated 2026-08-18Firmware & Secure Boot4 minutes read (About 583 words)

The patch deletes one line — a leftover GICV2_G0_FOR_EL3 := 1 override in plat/rockchip/rk3576/platform.mk that was both redundant (the tree-wide default is already 0) and wrong (RK3576 has no reason to route GICv2 Group 0 to EL3).
It’s still the first thing I sent to Trusted Firmware-A, and it got read closely by engineers from ST, Arm, and Rockchip before it landed.
The point isn’t the diff size — it’s what upstream review actually asks of you even when the change is nearly nothing: is this safe for every configuration, not just yours?