From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3AA3FC77B73 for ; Mon, 8 May 2023 05:06:12 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 3533684703; Mon, 8 May 2023 07:06:10 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=quarantine dis=none) header.from=ti.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; unprotected) header.d=ti.com header.i=@ti.com header.b="n5x+YvAU"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 845A884705; Mon, 8 May 2023 07:06:08 +0200 (CEST) Received: from fllv0015.ext.ti.com (fllv0015.ext.ti.com [198.47.19.141]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 177AB846FB for ; Mon, 8 May 2023 07:06:04 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=quarantine dis=none) header.from=ti.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=n-francis@ti.com Received: from lelv0266.itg.ti.com ([10.180.67.225]) by fllv0015.ext.ti.com (8.15.2/8.15.2) with ESMTP id 34855oIm080009; Mon, 8 May 2023 00:05:50 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ti.com; s=ti-com-17Q1; t=1683522350; bh=5AfyvV75OkySwt8qiJt2QKK79DI+/lg8DhoG10+Tq7E=; h=Date:Subject:To:CC:References:From:In-Reply-To; b=n5x+YvAUVcCUjGskT0GFnUJEAlxZ1AP65oUJaT1wqSksmNqeD2cgcw7Lv8cqgaCxv 3RIRK0jQjZD4RrIuh3GfLYEqaQLuKTqCK0NLDoMWVZArvxs4eITbUKOnb8t6RXXZK5 ff50lx4PjPjl7duVaOGJ2+NXtt9b3+JMa2uOvlIQ= Received: from DLEE103.ent.ti.com (dlee103.ent.ti.com [157.170.170.33]) by lelv0266.itg.ti.com (8.15.2/8.15.2) with ESMTPS id 34855oL1120889 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=FAIL); Mon, 8 May 2023 00:05:50 -0500 Received: from DLEE114.ent.ti.com (157.170.170.25) by DLEE103.ent.ti.com (157.170.170.33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.2507.23; Mon, 8 May 2023 00:05:49 -0500 Received: from fllv0039.itg.ti.com (10.64.41.19) by DLEE114.ent.ti.com (157.170.170.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.2507.23 via Frontend Transport; Mon, 8 May 2023 00:05:49 -0500 Received: from [172.24.145.195] (ileaxei01-snat2.itg.ti.com [10.180.69.6]) by fllv0039.itg.ti.com (8.15.2/8.15.2) with ESMTP id 34855kPj059783; Mon, 8 May 2023 00:05:46 -0500 Message-ID: Date: Mon, 8 May 2023 10:35:45 +0530 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.10.0 Subject: Re: [PATCH v3 00/19] Migration to using binman for bootloader To: Jan Kiszka CC: , , , , , , , , , Tom Rini References: <20230421123203.1315330-1-n-francis@ti.com> <20230426223750.GA643785@bill-the-cat> <3516dc21-00ab-3307-376d-612c83770cb4@siemens.com> Content-Language: en-US From: Neha Malcom Francis In-Reply-To: <3516dc21-00ab-3307-376d-612c83770cb4@siemens.com> Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 8bit X-EXCLAIMER-MD-CONFIG: e1e8a2fd-e40a-4ac6-ac9b-f7e9cc9ee180 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean Hi Jan, On 07/05/23 17:41, Jan Kiszka wrote: > On 04.05.23 08:13, Neha Malcom Francis wrote: >> Hi Jan >> >> On 04/05/23 10:13, Neha Malcom Francis wrote: >>> Hi Jan, >>> >>> On 03/05/23 22:04, Jan Kiszka wrote: >>>> On 03.05.23 14:56, Neha Malcom Francis wrote: >>>>> Hi Jan, >>>>> >>>>> On 03/05/23 12:57, Neha Malcom Francis wrote: >>>>>> Hi Tom >>>>>> >>>>>> On 27/04/23 04:07, Tom Rini wrote: >>>>>>> On Fri, Apr 21, 2023 at 06:01:44PM +0530, Neha Malcom Francis wrote: >>>>>>> >>>>>>>> This series aims to eliminate the use of additional custom >>>>>>>> repositories >>>>>>>> such as k3-image-gen (K3 Image Generation) repo and >>>>>>>> core-secdev-k3 (K3 >>>>>>>> Security Development Tools) that was plumbed into the U-Boot >>>>>>>> build flow >>>>>>>> to generate boot images for TI K3 platform devices. And instead, we >>>>>>>> move >>>>>>>> towards using binman that aligns better with the community standard >>>>>>>> build >>>>>>>> flow. >>>>>>>> >>>>>>>> This series uses binman for all K3 platforms supported on U-Boot >>>>>>>> currently; >>>>>>>> both HS (High Security, both SE and FS) and GP (General Purpose) >>>>>>>> devices. >>>>>>>> >>>>>>>> Background on using k3-image-gen: >>>>>>>>      * TI K3 devices require a SYSFW (System Firmware) image >>>>>>>> consisting >>>>>>>>      of a signed system firmware image and board configuration >>>>>>>> binaries, >>>>>>>>      this is needed to bring up system firmware during U-Boot R5 SPL >>>>>>>>      startup. >>>>>>>>      * Board configuration data contain board-specific information >>>>>>>>      such as resource management, power management and security. >>>>>>>> >>>>>>>> Background on using core-secdev-k3: >>>>>>>>      * Contains resources to sign x509 certificates for HS devices >>>>>>>> >>>>>>>> Series intends to use binman to take over the packaging and >>>>>>>> signing for >>>>>>>> the R5 bootloader images tiboot3.bin (and sysfw.itb, for >>>>>>>> non-combined >>>>>>>> boot flow) instead of k3-image-gen. >>>>>>>> >>>>>>>> Series also packages the A72/A53 bootloader images (tispl.bin and >>>>>>>> u-boot.img) using ATF, OPTEE and DM (Device Manager) >>>>>>> >>>>>>> So, next up is fixing this in CI. After taking Andrew's patch to >>>>>>> fix the >>>>>>> typedef issue, and after my patches to ensure we can get >>>>>>> pyyaml/jsonschema for python, there's problems still: >>>>>> >>>>>> >>>>>> Thanks for checking this! Couple things: >>>>>> >>>>>>> Over at https://source.denx.de/u-boot/u-boot/-/jobs/617966: >>>>>>> binman: Filename 'spl/dts/k3-am68-sk-base-board.dtb' not found in >>>>>>> input >>>>>>> path (.,/builds/u-boot/u-boot,board/ti/j721s2,arch/arm/dts) >>>>>>> (cwd='/tmp/.bm-work/j721s2_hs_evm_a72') >>>>>> >>>>>> 1. This is dependent on the patch merging J721S2 HS and GP configs >>>>>> [1]. However it has been reverted on -next, seen in the same thread. >>>>>> >>>>>>> >>>>>>> And then: >>>>>>> https://source.denx.de/u-boot/u-boot/-/jobs/617965#L1328 >>>>>>> Error: arch/arm/dts/k3-am62a-sk-binman.dtsi:167.1-8 syntax error >>>>>>> I've fixed this, minor but serious change. >>>>>> >>>>>> 2. Regarding iot2050, build fails since it uses >>>>>> arch/arm/mach-k3/config.mk which is now entirely binman based. Will >>>>>> try moving iot2050 to binman as well. >>>>> >>>>> I'll need some help with this, might need to know the bootloader >>>>> flow to >>>>> make a clean migration. >>>> >>>> Where do I have to look at? Is there a git repo with that experiment >>>> somewhere? >>>> >>>> Jan >>>> >>> >>> There's no experiment yet, I will send one today; but I do not have >>> complete understanding of the booting; whether the tispl.bin (which I >>> assume is the only boot component that is affecting iot2050 boot since >>> k3_fit_atf.sh is no longer there) has any concept of signing? Is >>> core-secdev-k3 ever used? >>> >> >> I have a tree posted here [2] that builds flash.bin with no error for >> me. Please confirm whether your build flow does the same and also let me >> know if the binary actually boots. >> >> [2] >> https://github.com/nehamalcom/u-boot/tree/migration-to-binman-cicd-iot2050 >> > > I've tested the latest version in that branch in the meantime. It > compiles but it does not work. This is missing from the original script: > > diff --git a/arch/arm/dts/k3-am65-iot2050-boot-image.dtsi b/arch/arm/dts/k3-am65-iot2050-boot-image.dtsi > index e17ffd7481f..9d83898d33f 100644 > --- a/arch/arm/dts/k3-am65-iot2050-boot-image.dtsi > +++ b/arch/arm/dts/k3-am65-iot2050-boot-image.dtsi > @@ -92,6 +92,15 @@ > }; > }; > }; > + > + configurations { > + default = "spl"; > + spl { > + fdt = "fdt-0"; > + firmware = "atf"; > + loadables = "tee", "dm", "spl"; > + }; > + }; > }; > > fit@0x380000 { > Thanks for this! I'll make sure to add this, so we are booting fine on non-secure with this patch applied as well right? > I didn't test secure booting yet, though. We are currently still signing > via tools/iot2050-sign-fw.sh, partly due to missing features in binman > (there were a lot of proposals on the list recently, may that is solved > now), but partly also due to some remaining breakages. Got it. To confirm, this is not modifying anything in the secure flow is it? flash.bin is just signed manually using tools/iot2050-sign-fw.sh correct? > > Jan > -- Thanking You Neha Malcom Francis