Tartarus changed the topic of #u-boot to: SOURCE MOVED TO https://source.denx.de/u-boot/u-boot.git / U-Boot v2022.07 is OUT / Merge Window is OPEN, -next is CLOSED / Release v2022.10 is scheduled for 3 October 2022 / http://www.denx.de/wiki/U-Boot / Channel archives at https://libera.irclog.whitequark.org/u-boot
<Forty-Bot> vagrantc: sorry, zynqmp
<vagrantc> ah, configs/xilinx_zynqmp*
qschulz has quit [Remote host closed the connection]
qschulz has joined #u-boot
thopiekar has quit [Ping timeout: 252 seconds]
thopiekar has joined #u-boot
umbramalison has quit [Quit: %So long and thanks for all the fish%]
umbramalison has joined #u-boot
xroumegue has quit [Ping timeout: 244 seconds]
xroumegue has joined #u-boot
LeSpocky has quit [Ping timeout: 252 seconds]
LeSpocky has joined #u-boot
lucascastro has joined #u-boot
brassado has quit [Ping timeout: 240 seconds]
mmu_man has quit [Ping timeout: 240 seconds]
jclsn has quit [Ping timeout: 244 seconds]
sakman has joined #u-boot
jclsn has joined #u-boot
thopiekar has quit [Ping timeout: 252 seconds]
thopiekar has joined #u-boot
lucascastro has quit [Ping timeout: 268 seconds]
vagrantc has quit [Quit: leaving]
hanetzer has quit [Ping timeout: 245 seconds]
hanetzer has joined #u-boot
kmcopper has joined #u-boot
camus has quit [Quit: camus]
hanetzer has quit [Ping timeout: 252 seconds]
hanetzer has joined #u-boot
kmcopper has quit [Remote host closed the connection]
GNUtoo has quit [Ping timeout: 268 seconds]
GNUtoo has joined #u-boot
camus has joined #u-boot
persmule has quit [Remote host closed the connection]
persmule has joined #u-boot
Xeroine has joined #u-boot
Xeroine has quit [Remote host closed the connection]
Net147 has quit [Quit: Quit]
Net147 has joined #u-boot
Net147 has joined #u-boot
Net147 has quit [Changing host]
rvalue has quit [Read error: Connection reset by peer]
rvalue has joined #u-boot
gsz has joined #u-boot
vfazio has quit [Remote host closed the connection]
vfazio has joined #u-boot
akaWolf has quit [Ping timeout: 268 seconds]
akaWolf has joined #u-boot
persmule has quit [Remote host closed the connection]
persmule has joined #u-boot
mmu_man has joined #u-boot
___nick___ has joined #u-boot
___nick___ has quit [Client Quit]
___nick___ has joined #u-boot
___nick___ has quit [Client Quit]
___nick___ has joined #u-boot
<johang> u-boot for amlogic-s905x/meson-gxl broke somewhere between v2022.04 and v2022.07
<hramrach> that would not be the only board. bisect?
<hramrach> also what is broken, specificallY?
persmule has quit [Ping timeout: 268 seconds]
persmule has joined #u-boot
persmule has quit [Ping timeout: 268 seconds]
persmule has joined #u-boot
persmule has quit [Remote host closed the connection]
persmule has joined #u-boot
gsz has quit [Quit: leaving]
vagrantc has joined #u-boot
persmule has quit [Ping timeout: 268 seconds]
persmule has joined #u-boot
Gravis has quit [Ping timeout: 268 seconds]
jagan has joined #u-boot
persmule has quit [Remote host closed the connection]
persmule has joined #u-boot
Gravis has joined #u-boot
<marex> sjg1: so the MX8M SPL signing example using binman, that cannot be used at all, this is not at all how the image generation works
<marex> sjg1: the csf is not at fixed location, the location is determined from the mkimage generated header, the part marked "Image Vector Table - not sure what goes in here"
<marex> also the part "Something in here?" is used for calculation of offsets ...
<marex> and the rest of the patch is just copy file to file ... hum ... nothing on handling the fitImage part
<sjg1> marex: I have to go out soon, back in a few hours. I'm not suggesting it can be used as it. It is a starting point
<sjg1> marex: You can put a 'mkimage {}' entry instead of the vector table easily enough, and drop the offset for the csf
<sjg1> marex: But it will be easier to get it generating all the right stuff first, then worry about where it sits in the image
<marex> so how exactly do I place the csf generated blob at the offset coming from mkimage header ?
<marex> the "worry where it sits" is one of the most important parts of the CSF btw
<sjg1> marex: See Entry_intel_descriptor() and the GetOffsets() method. It allows one entry to control the position of another in the image
<sjg1> marex: But as I said, best to get everything else right first
<marex> sjg1: I have a script which gets it all right, it's in fact the script which I pointed you to
<marex> sjg1: now all that is left is to somehow integrate it into binman, which ... might not be possible
hurricos has quit [Remote host closed the connection]
hurricos has joined #u-boot
<sjg1> Marex if you can do it in a script I can make it work in binman
hurricos has quit [Ping timeout: 268 seconds]
hurricos has joined #u-boot
Xeroine has joined #u-boot
mmu_man has quit [Ping timeout: 252 seconds]
mmu_man has joined #u-boot
<marex> sjg1: OK, so I implemented GetData() and not even that gets called (or prints don;t work), I cannot tell
<marex> seems like nothing in the imx8mm-csf ever gets called
<johang> hramrach: getting "Synchronous Abort" handler, esr 0x96000004 with libretech-cc_defconfig. looks to me that it happens in efi_loader.
<johang> happens when running booti btw. other commands in prompt are fine, such as load from ext4.
thopiekar has quit [Ping timeout: 252 seconds]
thopiekar has joined #u-boot
<hramrach> you can always bisect, and where it happens may help with educated guess as to what broke
<hramrach> if you have serial console posting the log in a pastebin might be useful
<johang> I did a quick bisect and found that it's this merge that causes it: 46a06ed82a81dfcb451fe82381c59c1d0a6667a1. will continue to bisect to find exact change.
<johang> full crash here: https://pastebin.com/gtVC4RbB
<hramrach> you can also try to boot with no DT to see if the problem is with the DT loading or some later code
<johang> already did that. happens even if I skip both dt and initrd and boot with "booti ${kernel_addr_r} - -".
vagrantc has quit [Quit: leaving]
<johang> from bisection is looks like the crash is introduced by a57ad20d07e82f9ddbbdf981c8f8dd5368b225e4
<sjg1> marex: Did you read the comment in entry.py for ReadData()? It is used to read data from an image, e.g. when you use 'binman ls' or 'binman extract'.
<sjg1> marex: I already put the function in there - ObtainContents()
<johang> not actually it's introduced in a9bf024b2933bba0e23038892970a18b72dfaeb4, the commit after a57ad20d07e82f9ddbbdf981c8f8dd5368b225e4
redbrain has quit [Read error: Connection reset by peer]
redbrain has joined #u-boot
<lvrp16> johang: is there a custom boot.scr or is that vanilla u-boot?
jagan has quit [Quit: Connection closed]
<marex> sjg1: ok, so the 10 lines which generates signed SPL (not signed u-boot.itb, that's completely beyond possibility) are now 300 lines of code for binman ... 30x more code, sigh
<marex> and it still does not even do what I need at all
<sjg1> marex: Let's worry about the number of lines later. Are you getting closer? Feel free to post something if you are stuck on it
<marex> sjg1: I am getting something which looks increasingly convoluted compared to the trivial script I have so far
<marex> and the complexity seems unjustified
<marex> I am getting lost in the insane complexity of this tool and code
<sjg1> marex: It will probably look a lot better when you have it working
<marex> like it would be 2000 lines of utterly unreadable gibberish instead of 20-line script ?
<marex> because this is how it looks like now, and this is the EASIER SPL part
<sjg1> marex: I'll be very surprised if it is that big. There is quite a bit of overhead in setting up a bintool (so it can be installed or bypassed if missing). If you are doing something genuinely new, then it can be more work. But if you think you are going to hit 4000 lines, I can't imagine how
<marex> I dont know how it managed to grow from 20 lines of trivial shell script to 300 lines right now either
<marex> maybe our tooling is overly insanely complex ?
<marex> to the point it is not possible to grasp it anymore ?
<sjg1> marex: Well see if you can get it working and then we'll see how complicated it is, and how many lines. There may be opportunities to share features with other entry types
<marex> I DO have it working
<marex> I have both signing and encryption working via a simple shell script
<marex> rewriting it into binman was supposed to make this easier, not insanely more complex than it already is
<marex> argh
<marex> and it just does not seem like it is making it any better or easier to deal with
<sjg1> marex: I don't think it is worth talking about this when you are just getting started with it. I've been working with firmware packaging for 10 years so have some perspective on where things are heading...the data-driven approach is the only way we'll be able to handle this in U-Boot
<johang> lvrp16: I have a small custom boot.scr that loads dtb, initrd and kernel from ext4
<marex> sjg1: indeed, I am rather new to all this, U-Boot and all ... thank you for your input
<sjg1> marex: :-) You gave the same feedback about the test system, if I recall. Stick at it
<marex> sjg1: maybe there is a pattern of a problem from which you can infer something
<sjg1> marex: I didn't write the pytest stuff (Stephen Warren @ Nvidia did) but it has enabled us to test a lot of things we could not before. Anyway I have said I'm happy to help you get this figured out
mmu_man has quit [Ping timeout: 240 seconds]
___nick___ has quit [Ping timeout: 268 seconds]
mmu_man has joined #u-boot
<marex> lovely, so whatever I had working no longer works after clean build due to some botched dependency on u-boot-spl-ddr.bin
sbach has quit [Read error: Connection reset by peer]
persmule has quit [Remote host closed the connection]
persmule has joined #u-boot
sbach has joined #u-boot
Xeroine has quit [Ping timeout: 240 seconds]
<marex> sjg1: so I tried compiling the patch you provided me as-is
<marex> u-boot$ git clean -fqdx ; make -j imx8mm_venice_defconfig ; make -j65 flash.bin
<marex> binman: Filename 'u-boot-spl-ddr.bin' not found in input path (.,.,./board/gateworks/venice,arch/arm/dts)
<marex> it apparently never worked
<sjg1> marex: Hmm it builds for me
<sjg1> (er, ignore the 'find' line)
<marex> sjg1: do you also run 'make flash.bin' ?
<marex> or do you have some convoluted scripting all around which might hide the error ?
<sjg1> marex: No I mean I don't get that error
<sjg1> Why are you running binman manually?
<marex> to enable debug output
<sjg1> marex: BINMAN_VERBOSE=5 make ...
<sjg1> Anyway you can do that, but you need to add --allow-missing if you have missing input binaries
<marex> sjg1: err ... the --allow-missing is part of the binman command line already
<marex> sjg1: try make -j ?
<marex> also, are you on u-boot/master or do you have extra patches ?
<marex> 56edbb5eaf ("Merge branch '2022-08-05-buildman-integrate-boardscfg'")
<marex> here I am + 1 patch
<sjg1> I pushed my tree - see above
<marex> nope, same problem on that tree
<marex> up to date debian testing btw
<sjg1> marex: Well something is different. Does it work if you run make normally?
<marex> no
<marex> it also doesn't work in debian11 stable container
<sjg1> marex: It isn't the toolchain
<marex> u-boot$ python3 --version
<marex> Python 3.10.5
<sjg1> marex: OK I got the same error by deleting my build first....will look
<sjg1> marex: Oh it's because the first image is used inside the second image. We've just been talking about that for rockchip
<marex> sjg1: sure, there are data dependencies between the images
<sjg1> marex: So why not produce the final image in one step?
<marex> sjg1: err, what ?
<sjg1> marex: You can just produce the final imx-boot image without first creating the spi.bin asd u-boot.itb files
<marex> did you forget I need to sign spl.bin and u-boot.itb bin separately using cst ?
<sjg1> marex: I keep saying we need to do the signing at the end. I really mean it, honest. We'll just go around in circles otherwise
<sjg1> marex: binman can happily sign things that are not written to disk
<sjg1> marex: Also you have changed arch/arm/dts/imx8mn-venice-u-boot.dtsi which has made things very confusing. Why not do this on arch/arm/dts/imx8mm-u-boot.dtsi ?
<marex> sjg1: errr ... I have not changed arch/arm/dts/imx8mn-venice-u-boot.dtsi ?
<marex> what ?
<marex> I just picked random mx8mm board
<marex> I dont mind signing the result at the end, that's what the script does right now anyway
<marex> I just need access to the offsets to generate the cst text file inputs
<sjg1> marex: No I mean let's not worry about signing now. PLEASE!
<sjg1> marex: which file contains the binman description?
<marex> arch/arm/dts/imx8mm-u-boot.dtsi ?
<sjg1> marex: Somehow they both seem to be used and they are getting merged. What is going on?
<marex> I am confused, what gets merged and used ?
<sjg1> marex: Me too. It is supposed to be 8mm or 8mn?
<marex> 8mm
<marex> u-boot$ git grep -lri binman arch/arm/dts/imx8mm* | sort -u
<marex> arch/arm/dts/imx8mm-cl-iot-gate-optee-u-boot.dtsi
<marex> arch/arm/dts/imx8mm-u-boot.dtsi
<marex> arch/arm/dts/imx8mm-verdin-wifi-dev-u-boot.dtsi
<sjg1> marex: OMG. So there is a #include "imx8mm-u-boot.dtsi" in arch/arm/dts/imx8mm-venice-u-boot.dtsi
<marex> so yes, apparently some boards do tweak the binman node further, ignore that, focus on the imx8mm-u-boot.dtsi
<sjg1> marex: OK. Very confusing
<sjg1> marex: Well now I don't have spl/u-boot-spl.cfgout
<marex> sjg1: how's your frustration so far ? :-)
<sjg1> marex: It is unbelievable complicated and convoluted. It desperately needs to move to binman
<marex> sjg1: your frustration or the imx8m image generation ?
<sjg1> marex: ^ OMG
<marex> sjg1: what's up ?
<sjg1> marex: That code is a mess
<sjg1> marex: Also, it seems to put the SPL image into a file u-boot-spl-ddr.bin, then create another file called spl/u-boot-spl.cfgout that points to it?
<sjg1> containing:
<marex> sjg1: arent you mixing legacy unconverted and binman ?
<sjg1> and that is where the error is coming from
<marex> binman should invoke mkimage and generate the .cfgout in the process, right ?
<sjg1> marex: You want binman to generate the .cfgout file?
<sjg1> marex: The file is an *input* to mkimage, so far as I can tell
<marex> oh, fun
persmule has quit [Remote host closed the connection]
<marex> hm, but wait ,what's the problem with the spl/u-boot-spl.cfgout ?
<marex> that should exist before binman is started anyway
<sjg1> marex: Basically it defeats the ability of binman to provide the input data to mkimage
persmule has joined #u-boot
<marex> which really does not make a difference in this case
<sjg1> marex: it makes all the difference, as it means that binman cannot provide the file
<marex> sjg1: but the file already exists ?
<marex> binman also doesn't provide u-boot.bin for example, it already exists by the time binman runs
<sjg1> marex: no, well not with that name.
<sjg1> marex: binman collects the input data for mkimage and puts it into a file. In this case it is called mkimage.secure-boot.spl.mkimage
<sjg1> marex: Can you pull that for-marek tree again? I have something hacked up to build that part, at least
<marex> yes ?
<sjg1> marex: Does it build for you now?
<marex> yes, it seems like it does
<sjg1> marex: OK so that is some progress. What is next?
<sjg1> marex: Is secure-boot.bin the ultimate goal? What is imx-boot ?
<marex> sjg1: have you had a look at the signing script ?
<sjg1> marex: No, where is that?
<sjg1> OK I pushed a new tree with csf added back in
<sjg1> marex: Have a look at GetCsf() and update / rename the sign_firmware() method in csf.py
<marex> sjg1: you are aware that this does not work at all, right ?
<marex> I mean, the ivt is generated by mkimage, so is boot-data
<sjg1> marex: So maybe have a look at those first. How is the ivt created?
<sjg1> marex: I mean where?
<marex> sjg1: the mkimage call generates those 0x40 bytes on top of u-boot-spl-ddr.bin
<marex> that is the IVT and boot data
<sjg1> marex: OK well it looks like it is putting them in the output: mkimage-out.secure-boot.spl.mkimage
<sjg1> So we should drop vector-table {} from the image description, also boot-data {}
<marex> yes
<sjg1> marex: OK I pushed a commit for that
<sjg1> marex: What is next?
<marex> sjg1: have you had a look at the links above ?
<marex> esp. the csf.sh ?
<sjg1> marex: Yes but it is a confusing mess. I also don't see the csf_fit.tmp that it seems to need as an input
<marex> sjg1: I got as far as https://paste.debian.net/hidden/44a9774e/
<sjg1> So basically csf needs a text file as input?
<marex> those should be generated by binman and fed into cst
<marex> yes
<marex> and it does in-place modification of its input data, i.e. flash.bin
<sjg1> marex: OK, should be easy enough? Just a case of converting the .sh to Python?
<marex> the u-boot.itb part is the hard part
<marex> also, see the paste above
<sjg1> why is the .itb the hard part? Also re in-place modification, binman can do that on the fly
<marex> sjg1: because CST does in-place modifications to parts of fitImage ?
<sjg1> marex: I'm running out of time on this.
<sjg1> marex: That's OK I think. Weird, but it can be handled
<marex> the CST is binary tool from NXP, it just cannot be modified
<marex> it sucks and that's it, sadly
<sjg1> marex: It's OK, can call it, then read in the FIT and update the (other) entry with the contents.
<marex> ok ... so ... how should the SPL and fitImage signing look like within binman then ?
<marex> I mean, we got literally to nowhere
<sjg1> marex: Seems like the fitimage needs to move into secure-boot.bin?
<marex> that's not possible
<sjg1> marex: Oh I see, so flash.bin is the final image
<marex> the SPL and fitImage are two parts which are loaded separately
<marex> they are also signed separately
<sjg1> So is the ultimate goal to produce flash.bin ?
<marex> yes, except patched with signed blobs in it
<sjg1> OK I pushed a new patch
<sjg1> marex: So if you can figure out what needs to happen in csf and let me know where you get to, I can come back to this
<marex> sjg1: let's see
<marex> (this might take a bit longer)
haritz has quit [Remote host closed the connection]
GNUtoo has quit [Write error: Connection reset by peer]
persmule has quit [Remote host closed the connection]
haritz has joined #u-boot
haritz has joined #u-boot
GNUtoo has joined #u-boot
persmule has joined #u-boot
persmule has quit [Remote host closed the connection]
persmule has joined #u-boot
<marex> sjg1: git clean -fqdx ; make -j imx8mm_venice_defconfig ; make V=1 -j65 flash.bin
<marex> binman: Error 1 running 'mkimage -d ./mkimage.imx-boot.secure-boot.spl.mkimage -n spl/u-boot-spl.cfgout -T imx8mimage -e 0x7e1000 ./mkimage-out.imx-boot.secure-boot.spl.mkimage': mkimage.secure-boot.spl.mkimage: Can't open: No such file or directory