Okay I found my answer. I'll post here for any other poor soul that might need this.

So I ended up using:

$ make EXT_DTB=<path/to/your/custom/built/dtb>

to get past my previous error.

On Fri, Apr 20, 2018 at 8:21 PM, Davis Roman davis.roman84@gmail.com wrote:

Okay. I found my first mistake. I would help if I could spell properly!

Turns out it was: #define CONFIG_OF_SEPARATE and not #define CONFIG_OF_SEPERATE

but now I'm getting an error:

LD test/dm/built-in.o CC examples/standalone/stubs.o LD examples/standalone/libstubs.o CC examples/standalone/hello_world.o LD examples/standalone/hello_world OBJCOPY examples/standalone/hello_world.srec OBJCOPY examples/standalone/hello_world.bin LDS u-boot.lds LD u-boot OBJCOPY u-boot-nodtb.bin

Device Tree Source is not correctly specified. Please define 'CONFIG_DEFAULT_DEVICE_TREE' or build with 'DEVICE_TREE=<device_tree>' argument

dts/Makefile:27: recipe for target 'arch/arm/dts/unset.dtb' failed make[1]: *** [arch/arm/dts/unset.dtb] Error 1 Makefile:820: recipe for target 'dts/dt.dtb' failed make: *** [dts/dt.dtb] Error 2

Do I need to provide a dts file? I got the impression that this wasn't the case from the docs.

Thank you,

Davis

On Fri, Apr 20, 2018 at 8:00 PM, Davis Roman davis.roman84@gmail.com wrote:

...

Hello,

I'm trying to get verified-boot working using u-boot 2016.03 on an imx6.

So far I've managed to figure out that I need the following additional config settings: #define CONFIG_DM #define CONFIG_ENABLE_VBOOT #define CONFIG_RSA #define CONFIG_FIT #define CONFIG_OF_CONTROL #define CONFIG_FIT_SIGNATURE #define CONFIG_OF_SEPERATE #define CONFIG_OF_LIBFDT #define CONFIG_FIT_VERBOSE

However, no matter what I do I can't seem to generate u-boot.dtb.

My understanding is that u-boot automatically generates this u-boot.dtb for the purpose of storing the public key when mkimage signs the fitimage and that this process does not require that I provide a dts file.

However, below are the files that are generated with my current configuration and no u-boot.dtb file is generated.

Additionally, since u-boot produces a u-boot-nodtb.bin, I figured it was reasonable to believe that u-boot.bin contained the device tree however as shown below both u-boot-nodtb.bin and u-boot.bin have an idential hash.

Is there something that I'm missing here? Any advice would be greatly appreciated

Thank you,

Davis

davis@XPS-15-9560:~/Desktop/u-boot-work/uboot-imx$ ls -l *u-boot* -rwxrwxr-x 1 davis davis 3413272 Apr 20 23:41 u-boot -rwxrwxr-x 1 davis davis 506052 Apr 20 23:37 u-boot.bin -rw-rw-r-- 1 davis davis 39490 Apr 20 23:27 u-boot.cfg -rw-rw-r-- 1 davis davis 510976 Apr 20 23:37 u-boot.imx -rw-rw-r-- 1 davis davis 1286 Apr 20 23:37 u-boot.lds -rw-rw-r-- 1 davis davis 456812 Apr 20 23:41 u-boot.map -rwxrwxr-x 1 davis davis 506052 Apr 20 23:37 u-boot-nodtb.bin -rwxrwxr-x 1 davis davis 1518250 Apr 20 23:37 u-boot.srec -rw-rw-r-- 1 davis davis 119239 Apr 20 23:37 u-boot.sym davis@XPS-15-9560:~/Desktop/u-boot-work/uboot-imx$ davis@XPS-15-9560:~/Desktop/u-boot-work/uboot-imx$ sha1sum *u-boot* cf00f776da67d1081fdfb8578ce71d0a63f16c48 u-boot 1fa17e1e90b51fc0dce73cf3f88d03cad0664a6f u-boot.bin 1d2ad68da6c9aa7915f8684c53b6c532a07d7c7b u-boot.cfg 599cec8e768eebf313d6735951c02c1271475f72 u-boot.imx 97054bccafd82b873a0af24f8e012ff032809b29 u-boot.lds 547e4e8cd4e46b5f9755aee4906a5f84906e2331 u-boot.map 1fa17e1e90b51fc0dce73cf3f88d03cad0664a6f u-boot-nodtb.bin bb5aaaa839b8f23c6c8d952e65f99efac695ae91 u-boot.srec 5f933891f3939802ab92c4d642af16973b60af37 u-boot.sym davis@XPS-15-9560:~/Desktop/u-boot-work/uboot-imx$

Hi Fabio,

Thank you so much for responding. It's good to know that I'm not alone in the world. :)

Unfortunately, I'm stuck with 2016.03 for the moment.

So I'm still having issues with getting verified boot to work. After compiling and installing the new u-boot image on my board I noticed that it bricked my board.

After lots of trail and error, I tracked it down to CONFIG_OF_CONTROL. When enabled, u-boot refuses to boot. ( no output is shown on the serial debug interface)

Since I'm using CONFIG_OF_SEPERATE, I suspect u-boot tries to read my attached dtb blob however it's probably wrong.

So my dts file looks like this:

/dts-v1/;

/ { model = "dummy"; compatible = "dummy";

reset@0 { compatible = "dummy"; }; };

I know that the properties 'model' and 'compatible' matter when in regards to the kernel however u-boot is using the device tree just to hold the public key so do they still matter? For now I just set them to "dummy"

Secondly, I'm doing:

$ cat u-boot.imx my-blob.dtb > u-boot.imx.final

Do you see anything that stands out to you?

Thank you!

Davis

On Tue, Apr 24, 2018 at 7:40 PM, Fabio Estevam festevam@gmail.com wrote:

Hi Davis,

On Fri, Apr 20, 2018 at 9:00 PM, Davis Roman davis.roman84@gmail.com wrote:

...

Hello,

I'm trying to get verified-boot working using u-boot 2016.03 on an imx6.

It would be better to try something more recent, such as 2018.03 instead.

...

So far I've managed to figure out that I need the following additional config settings: #define CONFIG_DM #define CONFIG_ENABLE_VBOOT #define CONFIG_RSA #define CONFIG_FIT #define CONFIG_OF_CONTROL #define CONFIG_FIT_SIGNATURE #define CONFIG_OF_SEPERATE #define CONFIG_OF_LIBFDT #define CONFIG_FIT_VERBOSE

However, no matter what I do I can't seem to generate u-boot.dtb.

This is expected if your board does not use device tree file in U-Boot.

...

My understanding is that u-boot automatically generates this u-boot.dtb for the purpose of storing the public key when mkimage signs the fitimage and that this process does not require that I provide a dts file.

However, below are the files that are generated with my current configuration and no u-boot.dtb file is generated.

Additionally, since u-boot produces a u-boot-nodtb.bin, I figured it was reasonable to believe that u-boot.bin contained the device tree however as shown below both u-boot-nodtb.bin and u-boot.bin have an idential hash.

Is there something that I'm missing here? Any advice would be greatly appreciated

Thank you,

Davis

davis@XPS-15-9560:~/Desktop/u-boot-work/uboot-imx$ ls -l *u-boot* -rwxrwxr-x 1 davis davis 3413272 Apr 20 23:41 u-boot -rwxrwxr-x 1 davis davis 506052 Apr 20 23:37 u-boot.bin -rw-rw-r-- 1 davis davis 39490 Apr 20 23:27 u-boot.cfg -rw-rw-r-- 1 davis davis 510976 Apr 20 23:37 u-boot.imx

That's the one you need.

If your board does not use device tree you will get a u-boot.imx binary that you can flash into your boot media.

Hi Davis,

On Tue, Apr 24, 2018 at 10:19 PM, Davis Roman davis.roman84@gmail.com wrote:

Hi Fabio,

Thank you so much for responding. It's good to know that I'm not alone in the world. :)

Unfortunately, I'm stuck with 2016.03 for the moment.

Ops, not good.

So I'm still having issues with getting verified boot to work. After compiling and installing the new u-boot image on my board I noticed that it bricked my board.

After lots of trail and error, I tracked it down to CONFIG_OF_CONTROL. When enabled, u-boot refuses to boot. ( no output is shown on the serial debug interface)

Since I'm using CONFIG_OF_SEPERATE, I suspect u-boot tries to read my attached dtb blob however it's probably wrong.

So my dts file looks like this:

/dts-v1/;

/ { model = "dummy"; compatible = "dummy";

reset@0 { compatible = "dummy"; }; };

I suppose you are able to boot your board with u-boot.imx and now you are trying to convert it to device tree.

I have never used verified boot and I don't know if verified boot requires device tree. I would think it is not a requirement, but will let others comment.

If you really need to use device tree, then you need to use a real device tree file that describes your hardware.

Secondly, I'm doing:

$ cat u-boot.imx my-blob.dtb > u-boot.imx.final

Maybe you can take a look at this nice tutorial from Jagan: https://openedev.amarulasolutions.com/display/ODUBOOT/Boot+Linux+on+Engicam+...