Fix the error message to not use dst and use self as it is copying the properties to self.

While using templating if there are no subnodes defined, we end up in this situation where "dst" isn't defined and it tries to print the error message and fails.

'UnboundLocalError: local variable 'dst' referenced before assignment'

Fixes: 55e1278d5eca ("dtoc: Allow inserting a list of nodes into another")

Signed-off-by: Manorit Chawdhry m-chawdhry@ti.com --- tools/dtoc/fdt.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/dtoc/fdt.py b/tools/dtoc/fdt.py index 5963925146a5..991a36b98796 100644 --- a/tools/dtoc/fdt.py +++ b/tools/dtoc/fdt.py @@ -782,7 +782,7 @@ class Node: for node in parent.subnodes.__reversed__(): dst = self.copy_node(node)

- tout.debug(f'merge props from {parent.path} to {dst.path}') + tout.debug(f'merge props from {parent.path} to {self.path}') self.merge_props(parent, False)

We can now firewall entities while loading them through our secure entity TIFS, the required information should be present in the certificate that is being parsed by TIFS.

The following commit adds the support to enable the certificates to be generated if the firewall configurations are present in the binman dtsi nodes.

Reviewed-by: Simon Glass sjg@chromium.org Signed-off-by: Manorit Chawdhry m-chawdhry@ti.com --- tools/binman/btool/openssl.py | 16 ++++++- tools/binman/etype/ti_secure.py | 95 +++++++++++++++++++++++++++++++++++++++++ tools/binman/etype/x509_cert.py | 4 +- 3 files changed, 112 insertions(+), 3 deletions(-)

diff --git a/tools/binman/btool/openssl.py b/tools/binman/btool/openssl.py index 7ee2683ab236..fe81a1f51b1e 100644 --- a/tools/binman/btool/openssl.py +++ b/tools/binman/btool/openssl.py @@ -82,7 +82,7 @@ imageSize = INTEGER:{len(indata)} return self.run_cmd(*args)

def x509_cert_sysfw(self, cert_fname, input_fname, key_fname, sw_rev, - config_fname, req_dist_name_dict): + config_fname, req_dist_name_dict, firewall_cert_data): """Create a certificate to be booted by system firmware

Args: @@ -94,6 +94,13 @@ imageSize = INTEGER:{len(indata)} req_dist_name_dict (dict): Dictionary containing key-value pairs of req_distinguished_name section extensions, must contain extensions for C, ST, L, O, OU, CN and emailAddress + firewall_cert_data (dict): + - auth_in_place (int): The Priv ID for copying as the + specific host in firewall protected region + - num_firewalls (int): The number of firewalls in the + extended certificate + - certificate (str): Extended firewall certificate with + the information for the firewall configurations.

Returns: str: Tool output @@ -121,6 +128,7 @@ basicConstraints = CA:true 1.3.6.1.4.1.294.1.3 = ASN1:SEQUENCE:swrv 1.3.6.1.4.1.294.1.34 = ASN1:SEQUENCE:sysfw_image_integrity 1.3.6.1.4.1.294.1.35 = ASN1:SEQUENCE:sysfw_image_load +1.3.6.1.4.1.294.1.37 = ASN1:SEQUENCE:firewall

[ swrv ] swrv = INTEGER:{sw_rev} @@ -132,7 +140,11 @@ imageSize = INTEGER:{len(indata)}

[ sysfw_image_load ] destAddr = FORMAT:HEX,OCT:00000000 -authInPlace = INTEGER:2 +authInPlace = INTEGER:{hex(firewall_cert_data['auth_in_place'])} + +[ firewall ] +numFirewallRegions = INTEGER:{firewall_cert_data['num_firewalls']} +{firewall_cert_data['certificate']} ''', file=outf) args = ['req', '-new', '-x509', '-key', key_fname, '-nodes', '-outform', 'DER', '-out', cert_fname, '-config', config_fname, diff --git a/tools/binman/etype/ti_secure.py b/tools/binman/etype/ti_secure.py index d939dce57139..704dcf8a3811 100644 --- a/tools/binman/etype/ti_secure.py +++ b/tools/binman/etype/ti_secure.py @@ -7,9 +7,44 @@

from binman.entry import EntryArg from binman.etype.x509_cert import Entry_x509_cert +from dataclasses import dataclass

from dtoc import fdt_util

+@dataclass +class Firewall(): + id: int + region: int + control : int + permissions: list + start_address: str + end_address: str + + def ensure_props(self, etype, name): + missing_props = [] + for key, val in self.__dict__.items(): + if val is None: + missing_props += [key] + + if len(missing_props): + etype.Raise(f"Subnode '{name}' is missing properties: {','.join(missing_props)}") + + def get_certificate(self) -> str: + unique_identifier = f"{self.id}{self.region}" + cert = f""" +firewallID{unique_identifier} = INTEGER:{self.id} +region{unique_identifier} = INTEGER:{self.region} +control{unique_identifier} = INTEGER:{hex(self.control)} +nPermissionRegs{unique_identifier} = INTEGER:{len(self.permissions)} +""" + for index, permission in enumerate(self.permissions): + cert += f"""permissions{unique_identifier}{index} = INTEGER:{hex(permission)} +""" + cert += f"""startAddress{unique_identifier} = FORMAT:HEX,OCT:{self.start_address:02x} +endAddress{unique_identifier} = FORMAT:HEX,OCT:{self.end_address:02x} +""" + return cert + class Entry_ti_secure(Entry_x509_cert): """Entry containing a TI x509 certificate binary

@@ -17,6 +52,11 @@ class Entry_ti_secure(Entry_x509_cert): - content: List of phandles to entries to sign - keyfile: Filename of file containing key to sign binary with - sha: Hash function to be used for signing + - auth-in-place: This is an integer field that contains two pieces + of information + Lower Byte - Remains 0x02 as per our use case + ( 0x02: Move the authenticated binary back to the header ) + Upper Byte - The Host ID of the core owning the firewall

Output files: - input.<unique_name> - input file passed to openssl @@ -25,6 +65,35 @@ class Entry_ti_secure(Entry_x509_cert): - cert.<unique_name> - output file generated by openssl (which is used as the entry contents)

+ Depending on auth-in-place information in the inputs, we read the + firewall nodes that describe the configurations of firewall that TIFS + will be doing after reading the certificate. + + The syntax of the firewall nodes are as such: + + firewall-257-0 { + id = <257>; /* The ID of the firewall being configured */ + region = <0>; /* Region number to configure */ + + control = /* The control register */ + <(FWCTRL_EN | FWCTRL_LOCK | FWCTRL_BG | FWCTRL_CACHE)>; + + permissions = /* The permission registers */ + <((FWPRIVID_ALL << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD | + FWPERM_NON_SECURE_PRIV_RWCD | + FWPERM_NON_SECURE_USER_RWCD)>; + + /* More defines can be found in k3-security.h */ + + start_address = /* The Start Address of the firewall */ + <0x0 0x0>; + end_address = /* The End Address of the firewall */ + <0xff 0xffffffff>; + }; + + openssl signs the provided data, using the TI templated config file and writes the signature in this entry. This allows verification that the data is genuine. @@ -32,11 +101,20 @@ class Entry_ti_secure(Entry_x509_cert): def __init__(self, section, etype, node): super().__init__(section, etype, node) self.openssl = None + self.firewall_cert_data: dict = { + 'auth_in_place': 0x02, + 'num_firewalls': 0, + 'certificate': '', + }

def ReadNode(self): super().ReadNode() self.key_fname = self.GetEntryArgsOrProps([ EntryArg('keyfile', str)], required=True)[0] + auth_in_place = fdt_util.GetInt(self._node, 'auth-in-place') + if auth_in_place: + self.firewall_cert_data['auth_in_place'] = auth_in_place + self.ReadFirewallNode() self.sha = fdt_util.GetInt(self._node, 'sha', 512) self.req_dist_name = {'C': 'US', 'ST': 'TX', @@ -46,6 +124,23 @@ class Entry_ti_secure(Entry_x509_cert): 'CN': 'TI Support', 'emailAddress': 'support@ti.com'}

+ def ReadFirewallNode(self): + self.firewall_cert_data['certificate'] = "" + self.firewall_cert_data['num_firewalls'] = 0 + for node in self._node.subnodes: + if 'firewall' in node.name: + firewall = Firewall( + fdt_util.GetInt(node, 'id'), + fdt_util.GetInt(node, 'region'), + fdt_util.GetInt(node, 'control'), + fdt_util.GetPhandleList(node, 'permissions'), + fdt_util.GetInt64(node, 'start_address'), + fdt_util.GetInt64(node, 'end_address'), + ) + firewall.ensure_props(self, node.name) + self.firewall_cert_data['num_firewalls'] += 1 + self.firewall_cert_data['certificate'] += firewall.get_certificate() + def GetCertificate(self, required): """Get the contents of this entry

diff --git a/tools/binman/etype/x509_cert.py b/tools/binman/etype/x509_cert.py index fc0bb1227867..29630d1b86c8 100644 --- a/tools/binman/etype/x509_cert.py +++ b/tools/binman/etype/x509_cert.py @@ -51,6 +51,7 @@ class Entry_x509_cert(Entry_collection): self.hashval_sysfw_data = None self.sysfw_inner_cert_ext_boot_block = None self.dm_data_ext_boot_block = None + self.firewall_cert_data = None

def ReadNode(self): super().ReadNode() @@ -98,7 +99,8 @@ class Entry_x509_cert(Entry_collection): key_fname=self.key_fname, config_fname=config_fname, sw_rev=self.sw_rev, - req_dist_name_dict=self.req_dist_name) + req_dist_name_dict=self.req_dist_name, + firewall_cert_data=self.firewall_cert_data) elif type == 'rom': stdout = self.openssl.x509_cert_rom( cert_fname=output_fname,

For readability during configuring firewalls, adding k3-security.h file and including it in k3-binman.dtsi to be accessible across K3 SoCs

Reviewed-by: Simon Glass sjg@chromium.org Signed-off-by: Manorit Chawdhry m-chawdhry@ti.com --- arch/arm/dts/k3-binman.dtsi | 49 ++++++++++++++++++++++++++++++++++++++ arch/arm/dts/k3-security.h | 58 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 107 insertions(+)

diff --git a/arch/arm/dts/k3-binman.dtsi b/arch/arm/dts/k3-binman.dtsi index cd9926a01696..758c8bf6ea16 100644 --- a/arch/arm/dts/k3-binman.dtsi +++ b/arch/arm/dts/k3-binman.dtsi @@ -3,6 +3,8 @@ * Copyright (C) 2022-2023 Texas Instruments Incorporated - https://www.ti.com/ */

+#include "k3-security.h" + / { binman: binman { multiple-images; @@ -437,6 +439,53 @@ }; }; }; + firewall_bg_1: template-5 { + control = <(FWCTRL_EN | FWCTRL_LOCK | + FWCTRL_BG | FWCTRL_CACHE)>; + permissions = <((FWPRIVID_ALL << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD | + FWPERM_NON_SECURE_PRIV_RWCD | + FWPERM_NON_SECURE_USER_RWCD)>; + start_address = <0x0 0x0>; + end_address = <0xff 0xffffffff>; + }; + firewall_bg_3: template-6 { + insert-template = <&firewall_bg_1>; + permissions = <((FWPRIVID_ALL << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD | + FWPERM_NON_SECURE_PRIV_RWCD | + FWPERM_NON_SECURE_USER_RWCD)>, + <((FWPRIVID_ALL << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD | + FWPERM_NON_SECURE_PRIV_RWCD | + FWPERM_NON_SECURE_USER_RWCD)>, + <((FWPRIVID_ALL << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD | + FWPERM_NON_SECURE_PRIV_RWCD | + FWPERM_NON_SECURE_USER_RWCD)>; + }; + firewall_armv8_atf_fg: template-7 { + control = <(FWCTRL_EN | FWCTRL_LOCK | + FWCTRL_CACHE)>; + permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD)>; + start_address = <0x0 0x70000000>; + end_address = <0x0 0x7001ffff>; + }; + firewall_armv8_optee_fg: template-8 { + control = <(FWCTRL_EN | FWCTRL_LOCK | + FWCTRL_CACHE)>; + permissions = <((FWPRIVID_ARMV8 << FWPRIVID_SHIFT) | + FWPERM_SECURE_PRIV_RWCD | + FWPERM_SECURE_USER_RWCD)>; + start_address = <0x0 0x9e800000>; + end_address = <0x0 0x9fffffff>; + };

};

diff --git a/arch/arm/dts/k3-security.h b/arch/arm/dts/k3-security.h new file mode 100644 index 000000000000..33609caa8fb5 --- /dev/null +++ b/arch/arm/dts/k3-security.h @@ -0,0 +1,58 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (C) 2023 Texas Instruments Incorporated - https://www.ti.com/ + */ + +#ifndef DTS_ARM64_TI_K3_FIREWALL_H +#define DTS_ARM64_TI_K3_FIREWALL_H + +#define FWPRIVID_ALL 0xc3 +#define FWPRIVID_ARMV8 1 +#define FWPRIVID_SHIFT 16 + +#define FWCTRL_EN 0xA +#define FWCTRL_LOCK (1 << 4) +#define FWCTRL_BG (1 << 8) +#define FWCTRL_CACHE (1 << 9) + +#define FWPERM_SECURE_PRIV_WRITE (1 << 0) +#define FWPERM_SECURE_PRIV_READ (1 << 1) +#define FWPERM_SECURE_PRIV_CACHEABLE (1 << 2) +#define FWPERM_SECURE_PRIV_DEBUG (1 << 3) + +#define FWPERM_SECURE_PRIV_RWCD (FWPERM_SECURE_PRIV_READ | \ + FWPERM_SECURE_PRIV_WRITE | \ + FWPERM_SECURE_PRIV_CACHEABLE | \ + FWPERM_SECURE_PRIV_DEBUG) + +#define FWPERM_SECURE_USER_WRITE (1 << 4) +#define FWPERM_SECURE_USER_READ (1 << 5) +#define FWPERM_SECURE_USER_CACHEABLE (1 << 6) +#define FWPERM_SECURE_USER_DEBUG (1 << 7) + +#define FWPERM_SECURE_USER_RWCD (FWPERM_SECURE_USER_READ | \ + FWPERM_SECURE_USER_WRITE | \ + FWPERM_SECURE_USER_CACHEABLE | \ + FWPERM_SECURE_USER_DEBUG) + +#define FWPERM_NON_SECURE_PRIV_WRITE (1 << 8) +#define FWPERM_NON_SECURE_PRIV_READ (1 << 9) +#define FWPERM_NON_SECURE_PRIV_CACHEABLE (1 << 10) +#define FWPERM_NON_SECURE_PRIV_DEBUG (1 << 11) + +#define FWPERM_NON_SECURE_PRIV_RWCD (FWPERM_NON_SECURE_PRIV_READ | \ + FWPERM_NON_SECURE_PRIV_WRITE | \ + FWPERM_NON_SECURE_PRIV_CACHEABLE | \ + FWPERM_NON_SECURE_PRIV_DEBUG) + +#define FWPERM_NON_SECURE_USER_WRITE (1 << 12) +#define FWPERM_NON_SECURE_USER_READ (1 << 13) +#define FWPERM_NON_SECURE_USER_CACHEABLE (1 << 14) +#define FWPERM_NON_SECURE_USER_DEBUG (1 << 15) + +#define FWPERM_NON_SECURE_USER_RWCD (FWPERM_NON_SECURE_USER_READ | \ + FWPERM_NON_SECURE_USER_WRITE | \ + FWPERM_NON_SECURE_USER_CACHEABLE | \ + FWPERM_NON_SECURE_USER_DEBUG) + +#endif

The following commits adds the configuration of firewalls required to protect ATF and OP-TEE memory region from non-secure reads and writes using master and slave firewalls present in our K3 SOCs.

Signed-off-by: Manorit Chawdhry m-chawdhry@ti.com --- arch/arm/dts/k3-j721e-binman.dtsi | 116 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 116 insertions(+)

diff --git a/arch/arm/dts/k3-j721e-binman.dtsi b/arch/arm/dts/k3-j721e-binman.dtsi index dbc385a852de..1bd9f96a58e9 100644 --- a/arch/arm/dts/k3-j721e-binman.dtsi +++ b/arch/arm/dts/k3-j721e-binman.dtsi @@ -146,6 +146,122 @@

fit { images { + atf { + ti-secure { + auth-in-place = <0xa02>; + + firewall-257-0 { + /* cpu_0_cpu_0_msmc Background Firewall */ + insert-template = <&firewall_bg_1>; + id = <257>; + region = <0>; + }; + + firewall-257-1 { + /* cpu_0_cpu_0_msmc Foreground Firewall */ + insert-template = <&firewall_armv8_atf_fg>; + id = <257>; + region = <1>; + }; + + firewall-284-0 { + /* dru_0_msmc Background Firewall */ + insert-template = <&firewall_bg_3>; + id = <284>; + region = <0>; + }; + + firewall-284-1 { + /* dru_0_msmc Foreground Firewall */ + insert-template = <&firewall_armv8_atf_fg>; + id = <284>; + region = <1>; + }; + + /* firewall-4760-0 { + * nb_slv0__mem0 Background Firewall + * Already configured by the secure entity + * }; + */ + + firewall-4760-1 { + /* nb_slv0__mem0 Foreground Firewall */ + insert-template = <&firewall_armv8_atf_fg>; + id = <4760>; + region = <1>; + }; + + /* firewall-4761-0 { + * nb_slv1__mem0 Background Firewall + * Already configured by the secure entity + * }; + */ + + firewall-4761-1 { + /* nb_slv1__mem0 Foreground Firewall */ + insert-template = <&firewall_armv8_atf_fg>; + id = <4761>; + region = <1>; + }; + + }; + }; + + tee { + ti-secure { + auth-in-place = <0xa02>; + + /* cpu_0_cpu_0_msmc region 0 and 1 configured + * during ATF Firewalling + */ + + firewall-257-2 { + /* cpu_0_cpu_0_msmc Foreground Firewall */ + insert-template = <&firewall_armv8_optee_fg>; + id = <257>; + region = <2>; + }; + + /* dru_0_msmc region 0 and 1 configured + * during ATF Firewalling + */ + + firewall-284-2 { + /* dru_0_msmc Foreground Firewall */ + insert-template = <&firewall_armv8_optee_fg>; + id = <284>; + region = <2>; + }; + + firewall-4762-0 { + /* nb_slv2__mem0 Background Firewall */ + insert-template = <&firewall_bg_3>; + id = <4762>; + region = <0>; + }; + + firewall-4762-1 { + /* nb_slv2__mem0 Foreground Firewall */ + insert-template = <&firewall_armv8_optee_fg>; + id = <4762>; + region = <1>; + }; + + firewall-4763-0 { + /* nb_slv3__mem0 Background Firewall */ + insert-template = <&firewall_bg_3>; + id = <4763>; + region = <0>; + }; + + firewall-4763-1 { + /* nb_slv3__mem0 Foreground Firewall */ + insert-template = <&firewall_armv8_optee_fg>; + id = <4763>; + region = <1>; + }; + }; + }; dm { ti-secure { content = <&dm>;

The following commits adds the configuration of firewalls required to protect ATF and OP-TEE memory region from non-secure reads and writes using master and slave firewalls present in our K3 SOCs.

Signed-off-by: Manorit Chawdhry m-chawdhry@ti.com --- arch/arm/dts/k3-j7200-binman.dtsi | 90 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 90 insertions(+)

diff --git a/arch/arm/dts/k3-j7200-binman.dtsi b/arch/arm/dts/k3-j7200-binman.dtsi index 38cccabaa71d..06db86598761 100644 --- a/arch/arm/dts/k3-j7200-binman.dtsi +++ b/arch/arm/dts/k3-j7200-binman.dtsi @@ -195,6 +195,96 @@

fit { images { + atf { + ti-secure { + auth-in-place = <0xa02>; + + firewall-257-0 { + /* cpu_0_cpu_0_msmc Background Firewall */ + insert-template = <&firewall_bg_1>; + id = <257>; + region = <0>; + }; + + firewall-257-1 { + /* cpu_0_cpu_0_msmc Foreground Firewall */ + insert-template = <&firewall_armv8_atf_fg>; + id = <257>; + region = <1>; + }; + + /* firewall-4760-0 { + * nb_slv0__mem0 Background Firewall + * Already configured by the secure entity + * }; + */ + + firewall-4760-1 { + /* nb_slv0__mem0 Foreground Firewall */ + insert-template = <&firewall_armv8_atf_fg>; + id = <4760>; + region = <1>; + }; + + /* firewall-4761-0 { + * nb_slv1__mem0 Background Firewall + * Already configured by the secure entity + * }; + */ + + firewall-4761-1 { + /* nb_slv1__mem0 Foreground Firewall */ + insert-template = <&firewall_armv8_atf_fg>; + id = <4761>; + region = <1>; + }; + }; + }; + + tee { + ti-secure { + auth-in-place = <0xa02>; + + /* cpu_0_cpu_0_msmc region 0 and 1 configured + * during ATF Firewalling + */ + + firewall-257-2 { + /* cpu_0_cpu_0_msmc Foreground Firewall */ + insert-template = <&firewall_armv8_optee_fg>; + id = <257>; + region = <2>; + }; + + firewall-4762-0 { + /* nb_slv2__mem0 Background Firewall - 0 */ + insert-template = <&firewall_bg_3>; + id = <4762>; + region = <0>; + }; + + firewall-4762-1 { + /* nb_slv2__mem0 Foreground Firewall */ + insert-template = <&firewall_armv8_optee_fg>; + id = <4762>; + region = <1>; + }; + + firewall-4763-0 { + /* nb_slv3__mem0 Background Firewall - 0 */ + insert-template = <&firewall_bg_3>; + id = <4763>; + region = <0>; + }; + + firewall-4763-1 { + /* nb_slv3__mem0 Foreground Firewall */ + insert-template = <&firewall_armv8_optee_fg>; + id = <4763>; + region = <1>; + }; + }; + }; dm { ti-secure { content = <&dm>;

The previous documentation had been very crude so refactor it to make it cleaner and concise.

Signed-off-by: Manorit Chawdhry m-chawdhry@ti.com --- doc/board/ti/k3.rst | 270 +++++++++++++++++++++++++++++++++------------------- 1 file changed, 171 insertions(+), 99 deletions(-)

diff --git a/doc/board/ti/k3.rst b/doc/board/ti/k3.rst index f19ee56f296e..1064c21b5a1d 100644 --- a/doc/board/ti/k3.rst +++ b/doc/board/ti/k3.rst @@ -248,6 +248,8 @@ Building tiboot3.bin the final `tiboot3.bin` binary. (or the `sysfw.itb` if your device uses the split binary flow)

+.. _k3_rst_include_start_build_steps_spl_r5: + .. k3_rst_include_start_build_steps_spl_r5 .. prompt:: bash $

@@ -312,6 +314,8 @@ use the `lite` option. finished, we can jump back into U-Boot again, this time running on a 64bit core in the main domain.

+.. _k3_rst_include_start_build_steps_uboot: + .. k3_rst_include_start_build_steps_uboot .. prompt:: bash $

@@ -337,144 +341,212 @@ wakeup and main domain and to boot to the U-Boot prompt | `tispl.bin` for HS devices or `tispl.bin_unsigned` for GP devices | `u-boot.img` for HS devices or `u-boot.img_unsigned` for GP devices

-Fit Signature Signing +FIT signature signing ---------------------

-K3 Platforms have fit signature signing enabled by default on their primary -platforms. Here we'll take an example for creating fit image for J721e platform +K3 platforms have FIT signature signing enabled by default on their primary +platforms. Here we'll take an example for creating FIT Image for J721E platform and the same can be extended to other platforms

-1. Describing FIT source +Pre-requisites: + +* U-boot build (:ref:`U-boot build <k3_rst_include_start_build_steps_spl_r5>`) +* Linux Image and Linux DTB prebuilt + +Describing FIT source +^^^^^^^^^^^^^^^^^^^^^

- .. code-block:: bash +FIT Image is a packed structure containing binary blobs and configurations. +The Kernel FIT Image that we have has Kernel Image, DTB and the DTBOs. It +supports packing multiple images and configurations that allow you to +choose any configuration at runtime to boot from. + +.. code-block::

/dts-v1/;

/ { - description = "Kernel fitImage for j721e-hs-evm"; - #address-cells = <1>; - - images { - kernel-1 { - description = "Linux kernel"; - data = /incbin/("Image"); - type = "kernel"; - arch = "arm64"; - os = "linux"; - compression = "none"; - load = <0x80080000>; - entry = <0x80080000>; - hash-1 { - algo = "sha512"; - }; - - }; - fdt-ti_k3-j721e-common-proc-board.dtb { - description = "Flattened Device Tree blob"; - data = /incbin/("k3-j721e-common-proc-board.dtb"); - type = "flat_dt"; - arch = "arm64"; - compression = "none"; - load = <0x83000000>; - hash-1 { - algo = "sha512"; - }; - - }; + description = "FIT Image description"; + #address-cells = <1>; + + images { + [image-1] + [image-2] + [fdt-1] + [fdt-2] + } + + configurations { + default = <conf-1> + [conf-1: image-1,fdt-1] + [conf-2: image-2,fdt-1] + } + } + +* Sample Images + +.. code-block:: + + kernel-1 { + description = "Linux kernel"; + data = /incbin/("linux.bin"); + type = "kernel"; + arch = "arm64"; + os = "linux"; + compression = "gzip"; + load = <0x81000000>; + entry = <0x81000000>; + hash-1 { + algo = "sha512"; }; - - configurations { - default = "conf-ti_k3-j721e-common-proc-board.dtb"; - conf-ti_k3-j721e-common-proc-board.dtb { - description = "Linux kernel, FDT blob"; - fdt = "fdt-ti_k3-j721e-common-proc-board.dtb"; - kernel = "kernel-1"; - signature-1 { - algo = "sha512,rsa4096"; - key-name-hint = "custMpk"; - sign-images = "kernel", "fdt"; - }; - }; + }; + fdt-ti_k3-j721e-common-proc-board.dtb { + description = "Flattened Device Tree blob"; + data = /incbin/("arch/arm64/boot/dts/ti/k3-j721e-common-proc-board.dtb"); + type = "flat_dt"; + arch = "arm64"; + compression = "none"; + load = <0x83000000>; + hash-1 { + algo = "sha512"; }; }; + # Optional images + fdt-ti_k3-j721e-evm-virt-mac-client.dtbo { + description = "Flattened Device Tree blob"; + data = /incbin/("arch/arm64/boot/dts/ti/k3-j721e-evm-virt-mac-client.dtbo"); + type = "flat_dt"; + arch = "arm64"; + compression = "none"; + load = <0x83080000>; + hash-1 { + algo = "sha512"; + }; + }; + +.. note:: + + Change the path in data variables to point to the respective files in your + local machine. For e.g change "linux.bin" to "<path-to-kernel-image>".

- You would require to change the '/incbin/' lines to point to the respective - files in your local machine and the key-name-hint also needs to be changed - if you are using some other key other than the TI dummy key that we are - using for this example. +For enabling usage of FIT signature, add the signature node to the +corresponding configuration node as follows.

-2. Compile U-boot for the respective board +* Sample Configurations

-.. include:: k3.rst - :start-after: .. k3_rst_include_start_build_steps_uboot - :end-before: .. k3_rst_include_end_build_steps_uboot +.. code-block:: + + conf-ti_k3-j721e-common-proc-board.dtb { + description = "Linux kernel, FDT blob"; + fdt = "fdt-ti_k3-j721e-common-proc-board.dtb"; + kernel = "kernel-1"; + signature-1 { + algo = "sha512,rsa4096"; + key-name-hint = "custMpk"; + sign-images = "kernel", "fdt"; + }; + }; + # Optional configurations + conf-ti_k3-j721e-evm-virt-mac-client.dtbo { + description = "FDTO blob"; + fdt = "fdt-ti_k3-j721e-evm-virt-mac-client.dtbo"; + + signature-1 { + algo = "sha512,rsa4096"; + key-name-hint = "custMpk"; + sign-images = "fdt"; + }; + }; + +Specify all images you need the signature to authenticate as a part of +sign-images. The key-name-hint needs to be changed if you are using some +other key other than the TI dummy key that we are using for this example. +It should be the name of the file containing the keys.

.. note::

- The changes only affect a72 binaries so the example just builds that + Generating new set of keys: + + .. prompt:: bash $

-3. Sign the fit image and embed the dtb in uboot + mkdir keys + openssl genpkey -algorithm RSA -out keys/dev.key \ + -pkeyopt rsa_keygen_bits:4096 -pkeyopt rsa_keygen_pubexp:65537 + openssl req -batch -new -x509 -key keys/dev.key -out keys/dev.crt

- Now once the build is done, you'll have a dtb for your board that you'll - be passing to mkimage for signing the fitImage and embedding the key in - the u-boot dtb. +Generating the fitImage +^^^^^^^^^^^^^^^^^^^^^^^

- .. prompt:: bash $ +.. note:: + + For signing a secondary platform like SK boards, you'll require + additional steps + + - Change the CONFIG_DEFAULT_DEVICE_TREE

- mkimage -r -f fitImage.its -k $UBOOT_PATH/board/ti/keys -K - $UBOOT_PATH/build/a72/dts/dt.dtb + For e.g

- For signing a secondary platform, pass the -K parameter to that DTB + .. code-block::

- .. prompt:: bash $ + diff --git a/configs/j721e_evm_a72_defconfig b/configs/j721e_evm_a72_defconfig + index a5c1df7e0054..6d0126d955ef 100644 + --- a/configs/j721e_evm_a72_defconfig + +++ b/configs/j721e_evm_a72_defconfig + @@ -13,7 +13,7 @@ CONFIG_CUSTOM_SYS_INIT_SP_ADDR=0x80480000 + CONFIG_ENV_SIZE=0x20000 + CONFIG_DM_GPIO=y + CONFIG_SPL_DM_SPI=y + -CONFIG_DEFAULT_DEVICE_TREE="k3-j721e-common-proc-board" + +CONFIG_DEFAULT_DEVICE_TREE="k3-j721e-sk" + CONFIG_SPL_TEXT_BASE=0x80080000 + CONFIG_DM_RESET=y + CONFIG_SPL_MMC=y

- mkimage -f fitImage.its -k $UBOOT_PATH/board/ti/keys -K - $UBOOT_PATH/build/a72/arch/arm/dts/k3-j721e-sk.dtb + - Change the binman nodes to package u-boot.dtb for the correct set of platform

- .. note:: + For e.g

- If changing `CONFIG_DEFAULT_DEVICE_TREE` to the secondary platform, - binman changes would also be required so that correct dtb gets packaged. + .. code-block::

- .. code-block:: bash + diff --git a/arch/arm/dts/k3-j721e-binman.dtsi b/arch/arm/dts/k3-j721e-binman.dtsi + index 673be646b1e3..752fa805fe8d 100644 + --- a/arch/arm/dts/k3-j721e-binman.dtsi + +++ b/arch/arm/dts/k3-j721e-binman.dtsi + @@ -299,8 +299,8 @@ + #define SPL_J721E_SK_DTB "spl/dts/k3-j721e-sk.dtb"

- diff --git a/arch/arm/dts/k3-j721e-binman.dtsi b/arch/arm/dts/k3-j721e-binman.dtsi - index 673be646b1e3..752fa805fe8d 100644 - --- a/arch/arm/dts/k3-j721e-binman.dtsi - +++ b/arch/arm/dts/k3-j721e-binman.dtsi - @@ -299,8 +299,8 @@ - #define SPL_J721E_SK_DTB "spl/dts/k3-j721e-sk.dtb" + #define UBOOT_NODTB "u-boot-nodtb.bin" + -#define J721E_EVM_DTB "u-boot.dtb" + -#define J721E_SK_DTB "arch/arm/dts/k3-j721e-sk.dtb" + +#define J721E_EVM_DTB "arch/arm/dts/k3-j721e-common-proc-board.dtb" + +#define J721E_SK_DTB "u-boot.dtb"

- #define UBOOT_NODTB "u-boot-nodtb.bin" - -#define J721E_EVM_DTB "u-boot.dtb" - -#define J721E_SK_DTB "arch/arm/dts/k3-j721e-sk.dtb" - +#define J721E_EVM_DTB "arch/arm/dts/k3-j721e-common-proc-board.dtb" - +#define J721E_SK_DTB "u-boot.dtb" +This step will embed the public key in the u-boot.dtb file that was already +built during the initial u-boot build.

-5. Rebuilt u-boot +.. prompt:: bash $

- This is required so that the modified dtb gets updated in u-boot.img + mkimage -r -f fitImage.its -k $UBOOT_PATH/board/ti/keys -K $UBOOT_PATH/build/$ARMV8/dts/dt.dtb fitImage

-.. include:: k3.rst - :start-after: .. k3_rst_include_start_build_steps_uboot - :end-before: .. k3_rst_include_end_build_steps_uboot +.. note::

-6. (Optional) Enabled FIT_SIGNATURE_ENFORCED + If you have another set of keys then change the -k argument to point to + the folder where your keys are present, the build requires the presence + of both .key and .crt file.

- By default u-boot will boot up the fit image without any authentication as - such if the public key is not embedded properly, to check if the public key - nodes are proper you can enable FIT_SIGNATURE_ENFORCED that would not rely - on the dtb for anything else then the signature node for checking the fit - image, rest other things will be enforced such as the property of - required-keys. This is not an extensive check so do manual checks also +Build u-boot again +^^^^^^^^^^^^^^^^^^

- This is by default enabled for devices with TI_SECURE_DEVICE enabled. +The updated u-boot.dtb needs to be packed in u-boot.img for authentication +so rebuild U-boot ARMV8 without changing any parameters. +Refer (:ref:`U-boot ARMV8 build <k3_rst_include_start_build_steps_uboot>`)

.. note::

- The devices now also have distroboot enabled so if the fit image doesn't - work then the fallback to normal distroboot will be there on hs devices, - this will need to be explicitly disabled by changing the boot_targets. + The devices now also have distroboot enabled so if the FIT image doesn't + work then the fallback to normal distroboot will be there on HS devices. + This will need to be explicitly disabled by changing the boot_targets to + disallow fallback during testing.

Saving environment ------------------