[PATCH v3 0/3] Add nvmem node for BCM2711 bootloader public key

[PATCH v3 0/3] Add nvmem node for BCM2711 bootloader public key

[Ivan T. Ivanov]

While debugging kernel stack trace from bug report[1], on openSUSE
Tumbleweed, which uses vendor devicetree, I have found that rmem driver
lack support for multiple rmem devices.

Following patches add new devicetree node, its documentation and
support for it in rmem driver.

[1] https://bugzilla.suse.com/show_bug.cgi?id=1206846

--
[    9.831285] sysfs: cannot create duplicate filename '/bus/nvmem/devices/rmem0'
[    9.831304] CPU: 3 PID: 467 Comm: (udev-worker) Not tainted 6.2.9-1-default #1 openSUSE Tumbleweed a4aeb3a90c0f23041a8a7944b12739b07585f009
[    9.831326] Hardware name: raspberrypi rpi/rpi, BIOS 2023.01 01/01/2023
[    9.831335] Call trace:
[    9.831343]  dump_backtrace+0xe4/0x140
[    9.831366]  show_stack+0x20/0x30
[    9.831379]  dump_stack_lvl+0x64/0x80
[    9.831398]  dump_stack+0x18/0x34
[    9.831410]  sysfs_warn_dup+0x6c/0x90
[    9.831424]  sysfs_do_create_link_sd+0xf8/0x100
[    9.831437]  sysfs_create_link+0x28/0x50
[    9.831449]  bus_add_device+0x70/0x190
[    9.831468]  device_add+0x3e8/0x84c
[    9.831481]  nvmem_register+0x85c/0x9f0
[    9.831500]  devm_nvmem_register+0x24/0x70
[    9.831517]  rmem_probe+0xa0/0xf4 [nvmem_rmem 649243b01e5e28ee94e4dd53bd13b6ececa836f8]
[    9.831555]  platform_probe+0x70/0xd0
[    9.831566]  really_probe+0xc8/0x3e4
[    9.831582]  __driver_probe_device+0x84/0x190
[    9.831598]  driver_probe_device+0x44/0x11c
[    9.831613]  __driver_attach+0xf8/0x200
[    9.831629]  bus_for_each_dev+0x78/0xd0
[    9.831643]  driver_attach+0x2c/0x40
[    9.831657]  bus_add_driver+0x188/0x250
[    9.831672]  driver_register+0x80/0x13c
[    9.831688]  __platform_driver_register+0x30/0x40
[    9.831699]  rmem_driver_init+0x28/0x1000 [nvmem_rmem 649243b01e5e28ee94e4dd53bd13b6ececa836f8]
[    9.831727]  do_one_initcall+0x48/0x2bc
[    9.831740]  do_init_module+0x50/0x1f0
[    9.831753]  load_module+0x1e54/0x2250
[    9.831763]  __do_sys_init_module+0x2ac/0x2f0
[    9.831774]  __arm64_sys_init_module+0x24/0x30
[    9.831785]  invoke_syscall+0x78/0x100
[    9.831803]  el0_svc_common.constprop.0+0x15c/0x180
[    9.831820]  do_el0_svc+0x40/0xb0
[    9.831836]  el0_svc+0x34/0x134
[    9.831850]  el0t_64_sync_handler+0x114/0x120
[    9.831865]  el0t_64_sync+0x1a4/0x1a8
[    9.831956] rmem: probe of 3ef62ce0.nvram failed with error -17

--
Changes since v2
https://lore.kernel.org/all/20230413085206.149730-1-iivanov@suse.de/

 - Add devicetree bindings documentation patch

--
Changes since v1
https://lore.kernel.org/all/20230411135035.106725-1-iivanov@suse.de/

I dig into Raspberry Github repository and found original patches
from Tim and Phil which add new region and fix rmem driver.

 - Use NVMEM_DEVID_AUTO instead making region name unique from
   the driver itself.
 - Add devicetree node for BCM2711 bootloader public key.
--

Ivan T. Ivanov (1):
  dt-bindings: nvmem: rmem: Add raspberrypi,bootloader-public-key

Phil Elwell (1):
  nvmem: rmem: Use NVMEM_DEVID_AUTO

Tim Gover (1):
  ARM: dts: Add nvmem node for BCM2711 bootloader public key

 Documentation/devicetree/bindings/nvmem/rmem.yaml |  1 +
 arch/arm/boot/dts/bcm2711-rpi.dtsi                | 14 ++++++++++++++
 drivers/nvmem/rmem.c                              |  1 +
 3 files changed, 16 insertions(+)

-- 
2.35.3

[PATCH v3 1/3] dt-bindings: nvmem: rmem: Add raspberrypi,bootloader-public-key

[Ivan T. Ivanov]

On RPi4 the bootloader[1] will copy the binary public key blob
(if present) into memory location specified by this node, for
use by the OS.

[1] https://www.raspberrypi.com/documentation/computers/configuration.html#nvmem-nodes

Signed-off-by: Ivan T. Ivanov <iivanov@suse.de>
---
 Documentation/devicetree/bindings/nvmem/rmem.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Documentation/devicetree/bindings/nvmem/rmem.yaml b/Documentation/devicetree/bindings/nvmem/rmem.yaml
index a4a755dcfc43..566eff3d1061 100644
--- a/Documentation/devicetree/bindings/nvmem/rmem.yaml
+++ b/Documentation/devicetree/bindings/nvmem/rmem.yaml
@@ -17,6 +17,7 @@ properties:
     items:
       - enum:
           - raspberrypi,bootloader-config
+          - raspberrypi,bootloader-public-key
       - const: nvmem-rmem
 
   reg:
-- 
2.35.3

[PATCH v3 2/3] ARM: dts: Add nvmem node for BCM2711 bootloader public key

[Ivan T. Ivanov]

From: Tim Gover <tim.gover@raspberrypi.com>

Make a copy of the bootloader secure-boot public key available to the OS
via an nvmem node. The placement information is populated by the
Raspberry Pi firmware[1] if a public key is present in the BCM2711
bootloader EEPROM.

[1] https://www.raspberrypi.com/documentation/computers/configuration.html#nvmem-nodes

Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
[iivanov] Added link to documentation.
Signed-off-by: Ivan T. Ivanov <iivanov@suse.de>
---
 arch/arm/boot/dts/bcm2711-rpi.dtsi | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/arch/arm/boot/dts/bcm2711-rpi.dtsi b/arch/arm/boot/dts/bcm2711-rpi.dtsi
index 98817a6675b9..e30fbe84f9c3 100644
--- a/arch/arm/boot/dts/bcm2711-rpi.dtsi
+++ b/arch/arm/boot/dts/bcm2711-rpi.dtsi
@@ -15,6 +15,7 @@ aliases {
 		ethernet0 = &genet;
 		pcie0 = &pcie0;
 		blconfig = &blconfig;
+		blpubkey = &blpubkey;
 	};
 };
 
@@ -67,6 +68,19 @@ blconfig: nvram@0 {
 		no-map;
 		status = "disabled";
 	};
+
+	/*
+	 * RPi4 will copy the binary public key blob (if present) from the bootloader
+	 * into memory for use by the OS.
+	 */
+	blpubkey: nvram@1 {
+		compatible = "raspberrypi,bootloader-public-key", "nvmem-rmem";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0x0 0x0 0x0>;
+		no-map;
+		status = "disabled";
+	};
 };
 
 &v3d {
-- 
2.35.3

[PATCH v3 3/3] nvmem: rmem: Use NVMEM_DEVID_AUTO

[Ivan T. Ivanov]

From: Phil Elwell <phil@raspberrypi.com>

It is reasonable to declare multiple nvmem blocks. Unless a unique 'id'
is passed in for each block there may be name clashes.

Avoid this by using the magic token NVMEM_DEVID_AUTO.

Fixes: 5a3fa75a4d9cb ("nvmem: Add driver to expose reserved memory as nvmem")

Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Signed-off-by: Ivan T. Ivanov <iivanov@suse.de>
---
 drivers/nvmem/rmem.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/nvmem/rmem.c b/drivers/nvmem/rmem.c
index 80cb187f1481..752d0bf4445e 100644
--- a/drivers/nvmem/rmem.c
+++ b/drivers/nvmem/rmem.c
@@ -71,6 +71,7 @@ static int rmem_probe(struct platform_device *pdev)
 	config.dev = dev;
 	config.priv = priv;
 	config.name = "rmem";
+	config.id = NVMEM_DEVID_AUTO;
 	config.size = mem->size;
 	config.reg_read = rmem_read;
 
-- 
2.35.3

Re: [PATCH v3 2/3] ARM: dts: Add nvmem node for BCM2711 bootloader public key

[Krzysztof Kozlowski]

On 20/04/2023 14:29, Ivan T. Ivanov wrote:
> From: Tim Gover <tim.gover@raspberrypi.com>
> 
> Make a copy of the bootloader secure-boot public key available to the OS
> via an nvmem node. The placement information is populated by the
> Raspberry Pi firmware[1] if a public key is present in the BCM2711
> bootloader EEPROM.
> 
> [1] https://www.raspberrypi.com/documentation/computers/configuration.html#nvmem-nodes
> 
> Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
> [iivanov] Added link to documentation.
> Signed-off-by: Ivan T. Ivanov <iivanov@suse.de>
> ---
>  arch/arm/boot/dts/bcm2711-rpi.dtsi | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)
> 
> diff --git a/arch/arm/boot/dts/bcm2711-rpi.dtsi b/arch/arm/boot/dts/bcm2711-rpi.dtsi
> index 98817a6675b9..e30fbe84f9c3 100644
> --- a/arch/arm/boot/dts/bcm2711-rpi.dtsi
> +++ b/arch/arm/boot/dts/bcm2711-rpi.dtsi
> @@ -15,6 +15,7 @@ aliases {
>  		ethernet0 = &genet;
>  		pcie0 = &pcie0;
>  		blconfig = &blconfig;
> +		blpubkey = &blpubkey;
>  	};
>  };
>  
> @@ -67,6 +68,19 @@ blconfig: nvram@0 {
>  		no-map;
>  		status = "disabled";
>  	};
> +
> +	/*
> +	 * RPi4 will copy the binary public key blob (if present) from the bootloader
> +	 * into memory for use by the OS.
> +	 */
> +	blpubkey: nvram@1 {
> +		compatible = "raspberrypi,bootloader-public-key", "nvmem-rmem";
> +		#address-cells = <1>;
> +		#size-cells = <1>;
> +		reg = <0x0 0x0 0x0>;
> +		no-map;
> +		status = "disabled";

Why this is disabled? What external resources are missing?

Best regards,
Krzysztof

Re: [PATCH v3 1/3] dt-bindings: nvmem: rmem: Add raspberrypi,bootloader-public-key

[Krzysztof Kozlowski]

On 20/04/2023 14:29, Ivan T. Ivanov wrote:
> On RPi4 the bootloader[1] will copy the binary public key blob
> (if present) into memory location specified by this node, for
> use by the OS.
> 
> [1] https://www.raspberrypi.com/documentation/computers/configuration.html#nvmem-nodes
> 
> Signed-off-by: Ivan T. Ivanov <iivanov@suse.de>

Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>

Best regards,
Krzysztof

Re: [PATCH v3 2/3] ARM: dts: Add nvmem node for BCM2711 bootloader public key

[Tim Gover]

On Fri, 21 Apr 2023 at 08:55, Krzysztof Kozlowski
<krzysztof.kozlowski@linaro.org> wrote:
>
> On 20/04/2023 14:29, Ivan T. Ivanov wrote:
> > From: Tim Gover <tim.gover@raspberrypi.com>
> >
> > Make a copy of the bootloader secure-boot public key available to the OS
> > via an nvmem node. The placement information is populated by the
> > Raspberry Pi firmware[1] if a public key is present in the BCM2711
> > bootloader EEPROM.
> >
> > [1] https://www.raspberrypi.com/documentation/computers/configuration.html#nvmem-nodes
> >
> > Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
> > [iivanov] Added link to documentation.
> > Signed-off-by: Ivan T. Ivanov <iivanov@suse.de>
> > ---
> >  arch/arm/boot/dts/bcm2711-rpi.dtsi | 14 ++++++++++++++
> >  1 file changed, 14 insertions(+)
> >
> > diff --git a/arch/arm/boot/dts/bcm2711-rpi.dtsi b/arch/arm/boot/dts/bcm2711-rpi.dtsi
> > index 98817a6675b9..e30fbe84f9c3 100644
> > --- a/arch/arm/boot/dts/bcm2711-rpi.dtsi
> > +++ b/arch/arm/boot/dts/bcm2711-rpi.dtsi
> > @@ -15,6 +15,7 @@ aliases {
> >               ethernet0 = &genet;
> >               pcie0 = &pcie0;
> >               blconfig = &blconfig;
> > +             blpubkey = &blpubkey;
> >       };
> >  };
> >
> > @@ -67,6 +68,19 @@ blconfig: nvram@0 {
> >               no-map;
> >               status = "disabled";
> >       };
> > +
> > +     /*
> > +      * RPi4 will copy the binary public key blob (if present) from the bootloader
> > +      * into memory for use by the OS.
> > +      */
> > +     blpubkey: nvram@1 {
> > +             compatible = "raspberrypi,bootloader-public-key", "nvmem-rmem";
> > +             #address-cells = <1>;
> > +             #size-cells = <1>;
> > +             reg = <0x0 0x0 0x0>;
> > +             no-map;
> > +             status = "disabled";
>
> Why this is disabled? What external resources are missing?
>
> Best regards,
> Krzysztof

These nodes default to disabled because the firmware will not populate
them if the public-key or configuration file are not present.
e.g. There's no requirement to have a bootloader EEPROM on BCM2711.

Tim

Re: [PATCH v3 2/3] ARM: dts: Add nvmem node for BCM2711 bootloader public key

[Stefan Wahren]

Hi Tim,

Am 20.04.23 um 14:29 schrieb Ivan T. Ivanov:
> From: Tim Gover <tim.gover@raspberrypi.com>
> 
> Make a copy of the bootloader secure-boot public key available to the OS
> via an nvmem node. The placement information is populated by the
> Raspberry Pi firmware[1] if a public key is present in the BCM2711
> bootloader EEPROM.
> 
> [1] https://www.raspberrypi.com/documentation/computers/configuration.html#nvmem-nodes
> 
> Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
> [iivanov] Added link to documentation.
> Signed-off-by: Ivan T. Ivanov <iivanov@suse.de>
> ---
>   arch/arm/boot/dts/bcm2711-rpi.dtsi | 14 ++++++++++++++
>   1 file changed, 14 insertions(+)
> 
> diff --git a/arch/arm/boot/dts/bcm2711-rpi.dtsi b/arch/arm/boot/dts/bcm2711-rpi.dtsi
> index 98817a6675b9..e30fbe84f9c3 100644
> --- a/arch/arm/boot/dts/bcm2711-rpi.dtsi
> +++ b/arch/arm/boot/dts/bcm2711-rpi.dtsi
> @@ -15,6 +15,7 @@ aliases {
>   		ethernet0 = &genet;
>   		pcie0 = &pcie0;
>   		blconfig = &blconfig;
> +		blpubkey = &blpubkey;
>   	};
>   };
>   
> @@ -67,6 +68,19 @@ blconfig: nvram@0 {
>   		no-map;
>   		status = "disabled";
>   	};
> +
> +	/*
> +	 * RPi4 will copy the binary public key blob (if present) from the bootloader
> +	 * into memory for use by the OS.

is the public key also possibly available for CM4 and RPi 400?

> +	 */
> +	blpubkey: nvram@1 {
> +		compatible = "raspberrypi,bootloader-public-key", "nvmem-rmem";
> +		#address-cells = <1>;
> +		#size-cells = <1>;
> +		reg = <0x0 0x0 0x0>;
> +		no-map;
> +		status = "disabled";
> +	};
>   };
>   
>   &v3d {

Re: [PATCH v3 2/3] ARM: dts: Add nvmem node for BCM2711 bootloader public key

[Tim Gover]

On Tue, 25 Apr 2023 at 17:02, Stefan Wahren <stefan.wahren@i2se.com> wrote:
>
> Hi Tim,
>
> Am 20.04.23 um 14:29 schrieb Ivan T. Ivanov:
> > From: Tim Gover <tim.gover@raspberrypi.com>
> >
> > Make a copy of the bootloader secure-boot public key available to the OS
> > via an nvmem node. The placement information is populated by the
> > Raspberry Pi firmware[1] if a public key is present in the BCM2711
> > bootloader EEPROM.
> >
> > [1] https://www.raspberrypi.com/documentation/computers/configuration.html#nvmem-nodes
> >
> > Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
> > [iivanov] Added link to documentation.
> > Signed-off-by: Ivan T. Ivanov <iivanov@suse.de>
> > ---
> >   arch/arm/boot/dts/bcm2711-rpi.dtsi | 14 ++++++++++++++
> >   1 file changed, 14 insertions(+)
> >
> > diff --git a/arch/arm/boot/dts/bcm2711-rpi.dtsi b/arch/arm/boot/dts/bcm2711-rpi.dtsi
> > index 98817a6675b9..e30fbe84f9c3 100644
> > --- a/arch/arm/boot/dts/bcm2711-rpi.dtsi
> > +++ b/arch/arm/boot/dts/bcm2711-rpi.dtsi
> > @@ -15,6 +15,7 @@ aliases {
> >               ethernet0 = &genet;
> >               pcie0 = &pcie0;
> >               blconfig = &blconfig;
> > +             blpubkey = &blpubkey;
> >       };
> >   };
> >
> > @@ -67,6 +68,19 @@ blconfig: nvram@0 {
> >               no-map;
> >               status = "disabled";
> >       };
> > +
> > +     /*
> > +      * RPi4 will copy the binary public key blob (if present) from the bootloader
> > +      * into memory for use by the OS.
>
> is the public key also possibly available for CM4 and RPi 400?

Yes, the public key is potentially available on CM4 and RPi 400.  If
there is no public-key then the firmware will leave the status field
as "disabled".

>
> > +      */
> > +     blpubkey: nvram@1 {
> > +             compatible = "raspberrypi,bootloader-public-key", "nvmem-rmem";
> > +             #address-cells = <1>;
> > +             #size-cells = <1>;
> > +             reg = <0x0 0x0 0x0>;
> > +             no-map;
> > +             status = "disabled";
> > +     };
> >   };
> >
> >   &v3d {

Re: [PATCH v3 0/3] Add nvmem node for BCM2711 bootloader public key

[Stefan Wahren]

Am 20.04.23 um 14:29 schrieb Ivan T. Ivanov:
> While debugging kernel stack trace from bug report[1], on openSUSE
> Tumbleweed, which uses vendor devicetree, I have found that rmem driver
> lack support for multiple rmem devices.
> 
> Following patches add new devicetree node, its documentation and
> support for it in rmem driver.
> 
> [1] https://bugzilla.suse.com/show_bug.cgi?id=1206846
> 

The whole series is:

Reviewed-by: Stefan Wahren <stefan.wahren@i2se.com>

> 
> --
> Changes since v2
> https://lore.kernel.org/all/20230413085206.149730-1-iivanov@suse.de/
> 
>   - Add devicetree bindings documentation patch
> 
> --
> Changes since v1
> https://lore.kernel.org/all/20230411135035.106725-1-iivanov@suse.de/
> 
> I dig into Raspberry Github repository and found original patches
> from Tim and Phil which add new region and fix rmem driver.
> 
>   - Use NVMEM_DEVID_AUTO instead making region name unique from
>     the driver itself.
>   - Add devicetree node for BCM2711 bootloader public key.
> --
> 
> Ivan T. Ivanov (1):
>    dt-bindings: nvmem: rmem: Add raspberrypi,bootloader-public-key
> 
> Phil Elwell (1):
>    nvmem: rmem: Use NVMEM_DEVID_AUTO
> 
> Tim Gover (1):
>    ARM: dts: Add nvmem node for BCM2711 bootloader public key
> 
>   Documentation/devicetree/bindings/nvmem/rmem.yaml |  1 +
>   arch/arm/boot/dts/bcm2711-rpi.dtsi                | 14 ++++++++++++++
>   drivers/nvmem/rmem.c                              |  1 +
>   3 files changed, 16 insertions(+)
> 

Re: [PATCH v3 1/3] dt-bindings: nvmem: rmem: Add raspberrypi,bootloader-public-key

[Srinivas Kandagatla]

On 20/04/2023 13:29, Ivan T. Ivanov wrote:
> On RPi4 the bootloader[1] will copy the binary public key blob
> (if present) into memory location specified by this node, for
> use by the OS.
> 
> [1] https://www.raspberrypi.com/documentation/computers/configuration.html#nvmem-nodes
> 
> Signed-off-by: Ivan T. Ivanov <iivanov@suse.de>
> ---

Applied thanks,

--srini
>   Documentation/devicetree/bindings/nvmem/rmem.yaml | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/Documentation/devicetree/bindings/nvmem/rmem.yaml b/Documentation/devicetree/bindings/nvmem/rmem.yaml
> index a4a755dcfc43..566eff3d1061 100644
> --- a/Documentation/devicetree/bindings/nvmem/rmem.yaml
> +++ b/Documentation/devicetree/bindings/nvmem/rmem.yaml
> @@ -17,6 +17,7 @@ properties:
>       items:
>         - enum:
>             - raspberrypi,bootloader-config
> +          - raspberrypi,bootloader-public-key
>         - const: nvmem-rmem
>   
>     reg:

Re: [PATCH v3 3/3] nvmem: rmem: Use NVMEM_DEVID_AUTO

[Srinivas Kandagatla]

On 20/04/2023 13:29, Ivan T. Ivanov wrote:
> From: Phil Elwell <phil@raspberrypi.com>
> 
> It is reasonable to declare multiple nvmem blocks. Unless a unique 'id'
> is passed in for each block there may be name clashes.
> 
> Avoid this by using the magic token NVMEM_DEVID_AUTO.
> 
> Fixes: 5a3fa75a4d9cb ("nvmem: Add driver to expose reserved memory as nvmem")
> 
> Signed-off-by: Phil Elwell <phil@raspberrypi.com>
> Signed-off-by: Ivan T. Ivanov <iivanov@suse.de>
> ---


Applied thanks,

--srini

>   drivers/nvmem/rmem.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/nvmem/rmem.c b/drivers/nvmem/rmem.c
> index 80cb187f1481..752d0bf4445e 100644
> --- a/drivers/nvmem/rmem.c
> +++ b/drivers/nvmem/rmem.c
> @@ -71,6 +71,7 @@ static int rmem_probe(struct platform_device *pdev)
>   	config.dev = dev;
>   	config.priv = priv;
>   	config.name = "rmem";
> +	config.id = NVMEM_DEVID_AUTO;
>   	config.size = mem->size;
>   	config.reg_read = rmem_read;
>   

Re: [PATCH v3 2/3] ARM: dts: Add nvmem node for BCM2711 bootloader public key

[Ivan T . Ivanov]

On 04-20 15:29, Ivan T. Ivanov wrote:
> Message-Id: <20230420122924.37997-3-iivanov@suse.de>
> 
> From: Tim Gover <tim.gover@raspberrypi.com>
> 
> Make a copy of the bootloader secure-boot public key available to the OS
> via an nvmem node. The placement information is populated by the
> Raspberry Pi firmware[1] if a public key is present in the BCM2711
> bootloader EEPROM.
> 
> [1] https://www.raspberrypi.com/documentation/computers/configuration.html#nvmem-nodes
> 
> Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
> [iivanov] Added link to documentation.
> Signed-off-by: Ivan T. Ivanov <iivanov@suse.de>


Hi Rob, Krzysztof,

Do you have any more question on this or it could be merged as is?

Regards,
Ivan


> ---
>  arch/arm/boot/dts/bcm2711-rpi.dtsi | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)
> 
> diff --git a/arch/arm/boot/dts/bcm2711-rpi.dtsi b/arch/arm/boot/dts/bcm2711-rpi.dtsi
> index 98817a6675b9..e30fbe84f9c3 100644
> --- a/arch/arm/boot/dts/bcm2711-rpi.dtsi
> +++ b/arch/arm/boot/dts/bcm2711-rpi.dtsi
> @@ -15,6 +15,7 @@ aliases {
>  		ethernet0 = &genet;
>  		pcie0 = &pcie0;
>  		blconfig = &blconfig;
> +		blpubkey = &blpubkey;
>  	};
>  };
>  
> @@ -67,6 +68,19 @@ blconfig: nvram@0 {
>  		no-map;
>  		status = "disabled";
>  	};
> +
> +	/*
> +	 * RPi4 will copy the binary public key blob (if present) from the bootloader
> +	 * into memory for use by the OS.
> +	 */
> +	blpubkey: nvram@1 {
> +		compatible = "raspberrypi,bootloader-public-key", "nvmem-rmem";
> +		#address-cells = <1>;
> +		#size-cells = <1>;
> +		reg = <0x0 0x0 0x0>;
> +		no-map;
> +		status = "disabled";
> +	};
>  };
>  
>  &v3d {