From: Heiko Stuebner heiko.stuebner@theobroma-systems.com

Right now if its bl31.bin is missing, the imx make_fit_atf.sh does return "sucessful" without generating an .its source file, which makes autobuilders unhappy.

So this change is similar to Tom Rini's commit 4c78028737c3 ("mksunxi_fit_atf.sh: Allow for this to complete when bl31.bin is missing") in that it changes the behaviour to a warning and still lets the script generate a usable u-boot.its and thus also lets the u-boot.itb get build successfully

Cc: Stefano Babic sbabic@denx.de Cc: Fabio Estevam festevam@gmail.com Cc: uboot-imx@nxp.com Signed-off-by: Heiko Stuebner heiko.stuebner@theobroma-systems.com --- changes in v3: - new patch

arch/arm/mach-imx/mkimage_fit_atf.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-imx/mkimage_fit_atf.sh b/arch/arm/mach-imx/mkimage_fit_atf.sh index dd1ca5ad3f..2224d85281 100755 --- a/arch/arm/mach-imx/mkimage_fit_atf.sh +++ b/arch/arm/mach-imx/mkimage_fit_atf.sh @@ -12,8 +12,8 @@ [ -z "$BL33_LOAD_ADDR" ] && BL33_LOAD_ADDR="0x40200000"

if [ ! -f $BL31 ]; then - echo "ERROR: BL31 file $BL31 NOT found" >&2 - exit 0 + echo "WARNING: BL31 file $BL31 NOT found, resulting binary is not-functional" >&2 + BL31=/dev/null else echo "$BL31 size: " >&2 ls -lct $BL31 | awk '{print $5}' >&2

From: Heiko Stuebner heiko.stuebner@theobroma-systems.com

fit_image_write_sig() contains mostly functions from libfdt that return FDT_ERR_foo errors but also a call to fit_set_timestamp() which returns a regular error.

When handling the size increase via multiple iterations, check for both -FDT_ERR_NOSPACE but also for -ENOSPC.

There is no real conflict, as FDT_ERR_NOSPACE = 3 = ESRCH (No such process) and ENOSPC = 28 which is above any FDT_ERR_*.

Signed-off-by: Heiko Stuebner heiko.stuebner@theobroma-systems.com Reviewed-by: Simon Glass sjg@chromium.org Reviewed-by: Kever Yang kever.yang@rock-chips.com --- tools/image-host.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/image-host.c b/tools/image-host.c index 9a83b7f675..baf9590f3b 100644 --- a/tools/image-host.c +++ b/tools/image-host.c @@ -241,7 +241,7 @@ static int fit_image_process_sig(const char *keydir, void *keydest, ret = fit_image_write_sig(fit, noffset, value, value_len, comment, NULL, 0, cmdname); if (ret) { - if (ret == -FDT_ERR_NOSPACE) + if (ret == -FDT_ERR_NOSPACE || ret == -ENOSPC) return -ENOSPC; printf("Can't write signature for '%s' signature node in '%s' conf node: %s\n", node_name, image_name, fdt_strerror(ret));

From: Heiko Stuebner heiko.stuebner@theobroma-systems.com

If the newly added fit-generator key-options are found, append needed signature nodes to all generated image blocks, so that they can get signed when mkimage later compiles the .itb from the generated .its.

Signed-off-by: Heiko Stuebner heiko.stuebner@theobroma-systems.com Reviewed-by: Kever Yang kever.yang@rock-chips.com --- arch/arm/mach-rockchip/make_fit_atf.py | 51 +++++++++++++++++++++++++- 1 file changed, 50 insertions(+), 1 deletion(-)

diff --git a/arch/arm/mach-rockchip/make_fit_atf.py b/arch/arm/mach-rockchip/make_fit_atf.py index d15c32b303..5b353f9d0a 100755 --- a/arch/arm/mach-rockchip/make_fit_atf.py +++ b/arch/arm/mach-rockchip/make_fit_atf.py @@ -14,6 +14,8 @@ import sys import getopt import logging import struct +import Crypto +from Crypto.PublicKey import RSA

DT_HEADER = """ /* @@ -37,7 +39,9 @@ DT_UBOOT = """ arch = "arm64"; compression = "none"; load = <0x%08x>; - }; +""" + +DT_UBOOT_NODE_END = """ };

"""

@@ -47,6 +51,46 @@ DT_IMAGES_NODE_END = """ };

DT_END = "};"

+def append_signature(file): + if not os.path.exists("u-boot.cfg"): + return + + config = {} + with open("u-boot.cfg") as fd: + for line in fd: + line = line.strip() + values = line[8:].split(' ', 1) + if len(values) > 1: + key, value = values + value = value.strip('"') + else: + key = values[0] + value = '1' + if not key.startswith('CONFIG_'): + continue + config[key] = value + + try: + keyhint = config["CONFIG_SPL_FIT_GENERATOR_KEY_HINT"] + except KeyError: + return + + try: + keyfile = os.path.join(config["CONFIG_SPL_FIT_SIGNATURE_KEY_DIR"], keyhint) + except KeyError: + keyfile = keyhint + + if not os.path.exists('%s.key' % keyfile): + return + + f = open('%s.key' % keyfile,'r') + key = RSA.importKey(f.read()) + + file.write('\t\t\tsignature {\n') + file.write('\t\t\t\talgo = "sha256,rsa%s";\n' % key.n.bit_length()) + file.write('\t\t\t\tkey-name-hint = "%s";\n' % keyhint) + file.write('\t\t\t};\n') + def append_bl31_node(file, atf_index, phy_addr, elf_entry): # Append BL31 DT node to input FIT dts file. data = 'bl31_0x%08x.bin' % phy_addr @@ -60,6 +104,7 @@ def append_bl31_node(file, atf_index, phy_addr, elf_entry): file.write('\t\t\tload = <0x%08x>;\n' % phy_addr) if atf_index == 1: file.write('\t\t\tentry = <0x%08x>;\n' % elf_entry) + append_signature(file); file.write('\t\t};\n') file.write('\n')

@@ -75,6 +120,7 @@ def append_tee_node(file, atf_index, phy_addr, elf_entry): file.write('\t\t\tcompression = "none";\n') file.write('\t\t\tload = <0x%08x>;\n' % phy_addr) file.write('\t\t\tentry = <0x%08x>;\n' % elf_entry) + append_signature(file); file.write('\t\t};\n') file.write('\n')

@@ -88,6 +134,7 @@ def append_fdt_node(file, dtbs): file.write('\t\t\tdata = /incbin/("%s");\n' % dtb) file.write('\t\t\ttype = "flat_dt";\n') file.write('\t\t\tcompression = "none";\n') + append_signature(file); file.write('\t\t};\n') file.write('\n') cnt = cnt + 1 @@ -129,6 +176,8 @@ def generate_atf_fit_dts_uboot(fit_file, uboot_file_name): raise ValueError("Invalid u-boot ELF image '%s'" % uboot_file_name) index, entry, p_paddr, data = segments[0] fit_file.write(DT_UBOOT % p_paddr) + append_signature(fit_file) + fit_file.write(DT_UBOOT_NODE_END)

def generate_atf_fit_dts_bl31(fit_file, bl31_file_name, tee_file_name, dtbs_file_name): segments = unpack_elf(bl31_file_name)