[U-Boot] [PATCH 1/3] rockchip: rk3399-evb: add script for atf fit

[U-Boot] [PATCH 1/3] rockchip: rk3399-evb: add script for atf fit

[Kever Yang]

Add a script to generate binaries from bl31.elf, and generate
u-boot.its file for FIT image including u-boot, dtb and atf binaries.

Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
---

 board/rockchip/evb_rk3399/mk_fit_atf.sh | 110 ++++++++++++++++++++++++++++++++
 1 file changed, 110 insertions(+)
 create mode 100755 board/rockchip/evb_rk3399/mk_fit_atf.sh

diff --git a/board/rockchip/evb_rk3399/mk_fit_atf.sh b/board/rockchip/evb_rk3399/mk_fit_atf.sh
new file mode 100755
index 0000000..146550a
--- /dev/null
+++ b/board/rockchip/evb_rk3399/mk_fit_atf.sh
@@ -0,0 +1,110 @@
+#!/bin/sh
+#
+# script to generate FIT image source for rk3399 boards with
+# ARM Trusted Firmware and multiple device trees (given on the command line)
+#
+# usage: $0 <dt_name> [<dt_name> [<dt_name] ...]
+
+[ -z "$BL31" ] && BL31="bl31.elf"
+
+if [ ! -f $BL31 ]; then
+	echo "WARNING: BL31 file $BL31 NOT found, resulting binary is non-functional" >&2
+	BL31=/dev/null
+fi
+
+#tools/mkimage -n rk3399 -T rksd -d spl/u-boot-spl.bin idbspl.img
+
+cat << __HEADER_EOF
+/dts-v1/;
+
+/ {
+	description = "Configuration to load ATF before U-Boot";
+	#address-cells = <1>;
+
+	images {
+		uboot at 1 {
+			description = "U-Boot (64-bit)";
+			data = /incbin/("u-boot-nodtb.bin");
+			type = "standalone";
+			arch = "arm64";
+			compression = "none";
+			load = <0x00200000>;
+		};
+__HEADER_EOF
+
+atf_cnt=1
+
+for l in `readelf -l $BL31 | grep -A1 LOAD | gawk --non-decimal-data \
+	'{if (NR % 2) {printf "%d:0x%x:", $2,$4} else {printf "%d\n", $1}}'`
+do
+	offset=${l%%:*}
+	ll=${l#*:}
+	phy_offset=${ll%:*}
+	filesz=${ll##*:}
+
+	#echo "$offset/$phy_offset/$filesz"
+
+	of=rk3399bl31_${phy_offset}.bin
+	dd if=$BL31 of=$of bs=1 skip=$offset count=$filesz
+
+	out_string="${out_string}:${phy_offset}"
+
+	cat << __ATF1_EOF
+		atf@$atf_cnt {
+			description = "ARM Trusted Firmware";
+			data = /incbin/("$of");
+			type = "firmware";
+			arch = "arm64";
+			compression = "none";
+			load = <$phy_offset>;
+__ATF1_EOF
+	if [ "$atf_cnt" -eq 1 ]; then
+		cat << __ATF2_EOF
+			entry = <$phy_offset>;
+__ATF2_EOF
+		fi
+	cat << __ATF3_EOF
+		};
+__ATF3_EOF
+	atf_cnt=$((atf_cnt + 1))
+done
+
+cnt=1
+for dtname in $*
+do
+	cat << __FDT_IMAGE_EOF
+		fdt@$cnt {
+			description = "$(basename $dtname .dtb)";
+			data = /incbin/("$dtname");
+			type = "flat_dt";
+			compression = "none";
+		};
+__FDT_IMAGE_EOF
+	cnt=$((cnt+1))
+done
+
+cat << __CONF_HEADER_EOF
+	};
+	configurations {
+		default = "config at 1";
+
+__CONF_HEADER_EOF
+
+cnt=1
+for dtname in $*
+do
+	cat << __CONF_SECTION_EOF
+		config@$cnt {
+			description = "$(basename $dtname .dtb)";
+			firmware = "uboot at 1";
+			loadables = "atf at 1","atf at 2","atf at 3";
+			fdt = "fdt@1";
+		};
+__CONF_SECTION_EOF
+	cnt=$((cnt+1))
+done
+
+cat << __ITS_EOF
+	};
+};
+__ITS_EOF
-- 
1.9.1

[U-Boot] [PATCH 2/3] rockchip: firefly-rk3399: add FIT for rk3399

[Kever Yang]

Enable SPL_FIT_GENERATOR with path for it.
With this patch you can get u-boot.itb for rk3399-evb with:
> make u-boot.itb

Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
---

 configs/firefly-rk3399_defconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/configs/firefly-rk3399_defconfig b/configs/firefly-rk3399_defconfig
index 67e14c1..2572933 100644
--- a/configs/firefly-rk3399_defconfig
+++ b/configs/firefly-rk3399_defconfig
@@ -9,6 +9,7 @@ CONFIG_DEFAULT_DEVICE_TREE="rk3399-firefly"
 CONFIG_DEBUG_UART=y
 CONFIG_FIT=y
 CONFIG_SPL_LOAD_FIT=y
+CONFIG_SPL_FIT_GENERATOR="board/rockchip/evb_rk3399/mk_fit_atf.sh"
 CONFIG_ENV_IS_IN_MMC=y
 # CONFIG_DISPLAY_CPUINFO is not set
 CONFIG_SPL_STACK_R=y
-- 
1.9.1

[U-Boot] [PATCH 3/3] rockchip: evb-rk3399: update document for board bring up

[Kever Yang]

Since we support ATF in SPL and add script for it, let's make the
document up to date.

Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
---

 board/rockchip/evb_rk3399/README | 79 ++++++++++++++++++++++++++++++++--------
 1 file changed, 63 insertions(+), 16 deletions(-)

diff --git a/board/rockchip/evb_rk3399/README b/board/rockchip/evb_rk3399/README
index fb8bb19..9982848 100644
--- a/board/rockchip/evb_rk3399/README
+++ b/board/rockchip/evb_rk3399/README
@@ -18,8 +18,8 @@ evb key features:
 * PMIC: rk808
 * debug console: UART2
 
-In order to support Arm Trust Firmware(ATF), we need to use the
-miniloader from rockchip which:
+In order to support Arm Trust Firmware(ATF), we can use either SPL or
+miniloader from rockchip to do:
 * do DRAM init
 * load and verify ATF image
 * load and verify U-Boot image
@@ -32,8 +32,8 @@ Get the Source and prebuild binary
   > mkdir ~/evb_rk3399
   > cd ~/evb_rk3399
   > git clone https://github.com/ARM-software/arm-trusted-firmware.git
-  > git clone https://github.com/rockchip-linux/rkbin
-  > git clone https://github.com/rockchip-linux/rkflashtool
+  > git clone https://github.com/rockchip-linux/rkbin.git
+  > git clone https://github.com/rockchip-linux/rkdeveloptool.git
 
 Compile the ATF
 ===============
@@ -42,32 +42,79 @@ Compile the ATF
   > make realclean
   > make CROSS_COMPILE=aarch64-linux-gnu- PLAT=rk3399 bl31
 
+  Or you can get the bl31.elf directly from Rockchip:
+  cp rkbin/rk33/rk3399_bl31_v1.00.elf ../u-boot/bl31.elf
+
+  Get bl31.elf in this step, copy it to U-Boot root dir:
+  > cp bl31.elf ../u-boot/
+
 Compile the U-Boot
 ==================
 
   > cd ../u-boot
-  > make CROSS_COMPILE=aarch64-linux-gnu- evb-rk3399_defconfig all
+  > export ARCH=arm64
+  > export CROSS_COMPILE=aarch64-linux-gnu-
+  > make evb-rk3399_defconfig
+  for firefly-rk3399, use below instead:
+  > make evb-firefly_defconfig
+  > make
+  > make u-boot.itb
 
-Compile the rkflashtool
-=======================
+  Get spl/u-boot-spl.bin and u-boot.itb in this step.
 
+Compile the rkdeveloptool
+=======================
+  Follow instructions in latest README
   > cd ../rkflashtool
+  > autoreconf -i
+  > ./configure
   > make
+  > sudo make install
+
+  Get rkdeveloptool in you Host in this step.
+
+Both origin binaries and Tool are ready now, choose either option 1 or
+option 2 to deploy U-Boot.
+
+Package the image
+=================
 
-Package the image for miniloader
-================================
+Package the image for U-Boot SPL(option 1)
+--------------------------------
   > cd ..
-  > cp arm-trusted-firmware/build/rk3399/release/bl31.bin rkbin/rk33
+  > tools/mkimage -n rk3399 -T rksd -d spl/u-boot-spl.bin idbspl.img
+
+  Get idbspl.img in this step.
+
+Package the image for Rockchip miniloader(option 2)
+------------------------------------------
+  > cd ..
+  > cp arm-trusted-firmware/build/rk3399/release/bl31.elf rkbin/rk33
   > ./rkbin/tools/trust_merger rkbin/tools/RK3399TRUST.ini
   > ./rkbin/tools/loaderimage --pack --uboot u-boot/u-boot-dtb.bin uboot.img
-  > mkdir image
-  > mv trust.img ./image/
-  > mv uboot.img ./image/rk3399evb-uboot.bin
 
-Flash the image
-===============
+  Get trust.img and uboot.img in this step.
+
+Flash the image to eMMC
+=======================
+
+Flash the image with U-Boot SPL(option 1)
+-------------------------------
 Power on(or reset with RESET KEY) with MASKROM KEY preesed, and then:
+  > rkdeveloptool db rkbin/rk33/rk3399_loader_v1.08.106.bin
+  > rkdeveloptool wl 64 u-boot/idbspl.img
+  > rkdeveloptool wl 512 u-boot/u-boot.itb
+  > rkdeveloptool rd
 
-  > ./rkflashtool/rkflashloader rk3399evb
+Flash the image with Rockchip miniloader(option 2)
+----------------------------------------
+Power on(or reset with RESET KEY) with MASKROM KEY preesed, and then:
+  > rkdeveloptool db rkbin/rk33/rk3399_loader_v1.08.106.bin
+  > rkdeveloptool ul rkbin/rk33/rk3399_loader_v1.08.106.bin
+  > rkdeveloptool wl 0x4000 u-boot/uboot.img
+  > rkdeveloptool wl 0x6000 u-boot/trust.img
+  > rkdeveloptool rd
 
 You should be able to get U-Boot log message in console/UART2 now.
+For more detail, please reference to:
+http://opensource.rock-chips.com/wiki_Boot_option
-- 
1.9.1

[U-Boot] [PATCH 1/3] rockchip: rk3399-evb: add script for atf fit

[Mark Kettenis]

> From: Kever Yang <kever.yang@rock-chips.com>
> Date: Fri, 18 Aug 2017 13:07:04 +0800
> 
> Add a script to generate binaries from bl31.elf, and generate
> u-boot.its file for FIT image including u-boot, dtb and atf binaries.
> 
> Signed-off-by: Kever Yang <kever.yang@rock-chips.com>

This doesn't work if the ATF BL31_BASE is 0x1000 instead of 0x10000,
but there are other reasons why 0x1000 doesn't work.  Tested this with
ATF v1.4 with BL31_BASE moved back to 0x10000, and that works fine.
So this is defenitely progress!  This allows me to build my own
firmware for the Firefly-RK3399 with a sane console speed of 115200.

Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
Tested-by: Mark Kettenis <kettenis@openbsd.org>

> ---
> 
>  board/rockchip/evb_rk3399/mk_fit_atf.sh | 110 ++++++++++++++++++++++++++++++++
>  1 file changed, 110 insertions(+)
>  create mode 100755 board/rockchip/evb_rk3399/mk_fit_atf.sh
> 
> diff --git a/board/rockchip/evb_rk3399/mk_fit_atf.sh b/board/rockchip/evb_rk3399/mk_fit_atf.sh
> new file mode 100755
> index 0000000..146550a
> --- /dev/null
> +++ b/board/rockchip/evb_rk3399/mk_fit_atf.sh
> @@ -0,0 +1,110 @@
> +#!/bin/sh
> +#
> +# script to generate FIT image source for rk3399 boards with
> +# ARM Trusted Firmware and multiple device trees (given on the command line)
> +#
> +# usage: $0 <dt_name> [<dt_name> [<dt_name] ...]
> +
> +[ -z "$BL31" ] && BL31="bl31.elf"
> +
> +if [ ! -f $BL31 ]; then
> +	echo "WARNING: BL31 file $BL31 NOT found, resulting binary is non-functional" >&2
> +	BL31=/dev/null
> +fi
> +
> +#tools/mkimage -n rk3399 -T rksd -d spl/u-boot-spl.bin idbspl.img
> +
> +cat << __HEADER_EOF
> +/dts-v1/;
> +
> +/ {
> +	description = "Configuration to load ATF before U-Boot";
> +	#address-cells = <1>;
> +
> +	images {
> +		uboot at 1 {
> +			description = "U-Boot (64-bit)";
> +			data = /incbin/("u-boot-nodtb.bin");
> +			type = "standalone";
> +			arch = "arm64";
> +			compression = "none";
> +			load = <0x00200000>;
> +		};
> +__HEADER_EOF
> +
> +atf_cnt=1
> +
> +for l in `readelf -l $BL31 | grep -A1 LOAD | gawk --non-decimal-data \
> +	'{if (NR % 2) {printf "%d:0x%x:", $2,$4} else {printf "%d\n", $1}}'`
> +do
> +	offset=${l%%:*}
> +	ll=${l#*:}
> +	phy_offset=${ll%:*}
> +	filesz=${ll##*:}
> +
> +	#echo "$offset/$phy_offset/$filesz"
> +
> +	of=rk3399bl31_${phy_offset}.bin
> +	dd if=$BL31 of=$of bs=1 skip=$offset count=$filesz
> +
> +	out_string="${out_string}:${phy_offset}"
> +
> +	cat << __ATF1_EOF
> +		atf@$atf_cnt {
> +			description = "ARM Trusted Firmware";
> +			data = /incbin/("$of");
> +			type = "firmware";
> +			arch = "arm64";
> +			compression = "none";
> +			load = <$phy_offset>;
> +__ATF1_EOF
> +	if [ "$atf_cnt" -eq 1 ]; then
> +		cat << __ATF2_EOF
> +			entry = <$phy_offset>;
> +__ATF2_EOF
> +		fi
> +	cat << __ATF3_EOF
> +		};
> +__ATF3_EOF
> +	atf_cnt=$((atf_cnt + 1))
> +done
> +
> +cnt=1
> +for dtname in $*
> +do
> +	cat << __FDT_IMAGE_EOF
> +		fdt@$cnt {
> +			description = "$(basename $dtname .dtb)";
> +			data = /incbin/("$dtname");
> +			type = "flat_dt";
> +			compression = "none";
> +		};
> +__FDT_IMAGE_EOF
> +	cnt=$((cnt+1))
> +done
> +
> +cat << __CONF_HEADER_EOF
> +	};
> +	configurations {
> +		default = "config at 1";
> +
> +__CONF_HEADER_EOF
> +
> +cnt=1
> +for dtname in $*
> +do
> +	cat << __CONF_SECTION_EOF
> +		config@$cnt {
> +			description = "$(basename $dtname .dtb)";
> +			firmware = "uboot at 1";
> +			loadables = "atf at 1","atf at 2","atf at 3";
> +			fdt = "fdt at 1";
> +		};
> +__CONF_SECTION_EOF
> +	cnt=$((cnt+1))
> +done
> +
> +cat << __ITS_EOF
> +	};
> +};
> +__ITS_EOF
> -- 
> 1.9.1
> 
> _______________________________________________
> U-Boot mailing list
> U-Boot at lists.denx.de
> https://lists.denx.de/listinfo/u-boot
> 
> 

[U-Boot] [PATCH 2/3] rockchip: firefly-rk3399: add FIT for rk3399

[Mark Kettenis]

> From: Kever Yang <kever.yang@rock-chips.com>
> Date: Fri, 18 Aug 2017 13:07:05 +0800
> 
> Enable SPL_FIT_GENERATOR with path for it.
> With this patch you can get u-boot.itb for rk3399-evb with:

You mean rk3399-firefly ;).

> > make u-boot.itb
> 
> Signed-off-by: Kever Yang <kever.yang@rock-chips.com>

Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
Tested-by: Mark Kettenis <kettenis@openbsd.org>

> ---
> 
>  configs/firefly-rk3399_defconfig | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/configs/firefly-rk3399_defconfig b/configs/firefly-rk3399_defconfig
> index 67e14c1..2572933 100644
> --- a/configs/firefly-rk3399_defconfig
> +++ b/configs/firefly-rk3399_defconfig
> @@ -9,6 +9,7 @@ CONFIG_DEFAULT_DEVICE_TREE="rk3399-firefly"
>  CONFIG_DEBUG_UART=y
>  CONFIG_FIT=y
>  CONFIG_SPL_LOAD_FIT=y
> +CONFIG_SPL_FIT_GENERATOR="board/rockchip/evb_rk3399/mk_fit_atf.sh"
>  CONFIG_ENV_IS_IN_MMC=y
>  # CONFIG_DISPLAY_CPUINFO is not set
>  CONFIG_SPL_STACK_R=y
> -- 
> 1.9.1
> 
> _______________________________________________
> U-Boot mailing list
> U-Boot at lists.denx.de
> https://lists.denx.de/listinfo/u-boot
> 
> 

[U-Boot] [PATCH 3/3] rockchip: evb-rk3399: update document for board bring up

[Mark Kettenis]

> From: Kever Yang <kever.yang@rock-chips.com>
> Date: Fri, 18 Aug 2017 13:07:06 +0800
> 
> Since we support ATF in SPL and add script for it, let's make the
> document up to date.
> 
> Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
> ---
> 
>  board/rockchip/evb_rk3399/README | 79 ++++++++++++++++++++++++++++++++--------
>  1 file changed, 63 insertions(+), 16 deletions(-)
> 
> diff --git a/board/rockchip/evb_rk3399/README b/board/rockchip/evb_rk3399/README
> index fb8bb19..9982848 100644
> --- a/board/rockchip/evb_rk3399/README
> +++ b/board/rockchip/evb_rk3399/README
> @@ -18,8 +18,8 @@ evb key features:
>  * PMIC: rk808
>  * debug console: UART2
>  
> -In order to support Arm Trust Firmware(ATF), we need to use the
> -miniloader from rockchip which:
> +In order to support Arm Trust Firmware(ATF), we can use either SPL or
> +miniloader from rockchip to do:
>  * do DRAM init
>  * load and verify ATF image
>  * load and verify U-Boot image
> @@ -32,8 +32,8 @@ Get the Source and prebuild binary
>    > mkdir ~/evb_rk3399
>    > cd ~/evb_rk3399
>    > git clone https://github.com/ARM-software/arm-trusted-firmware.git
> -  > git clone https://github.com/rockchip-linux/rkbin
> -  > git clone https://github.com/rockchip-linux/rkflashtool
> +  > git clone https://github.com/rockchip-linux/rkbin.git
> +  > git clone https://github.com/rockchip-linux/rkdeveloptool.git
>  
>  Compile the ATF
>  ===============
> @@ -42,32 +42,79 @@ Compile the ATF
>    > make realclean
>    > make CROSS_COMPILE=aarch64-linux-gnu- PLAT=rk3399 bl31
>  
> +  Or you can get the bl31.elf directly from Rockchip:
> +  cp rkbin/rk33/rk3399_bl31_v1.00.elf ../u-boot/bl31.elf
> +
> +  Get bl31.elf in this step, copy it to U-Boot root dir:
> +  > cp bl31.elf ../u-boot/
> +
>  Compile the U-Boot
>  ==================
>  
>    > cd ../u-boot
> -  > make CROSS_COMPILE=aarch64-linux-gnu- evb-rk3399_defconfig all
> +  > export ARCH=arm64
> +  > export CROSS_COMPILE=aarch64-linux-gnu-
> +  > make evb-rk3399_defconfig
> +  for firefly-rk3399, use below instead:
> +  > make evb-firefly_defconfig

That should be firefly-rk3399_defconfig

> +  > make
> +  > make u-boot.itb
>  
> -Compile the rkflashtool
> -=======================
> +  Get spl/u-boot-spl.bin and u-boot.itb in this step.
>  
> +Compile the rkdeveloptool
> +=======================
> +  Follow instructions in latest README
>    > cd ../rkflashtool
> +  > autoreconf -i
> +  > ./configure
>    > make
> +  > sudo make install
> +
> +  Get rkdeveloptool in you Host in this step.
> +
> +Both origin binaries and Tool are ready now, choose either option 1 or
> +option 2 to deploy U-Boot.
> +
> +Package the image
> +=================
>  
> -Package the image for miniloader
> -================================
> +Package the image for U-Boot SPL(option 1)
> +--------------------------------
>    > cd ..
> -  > cp arm-trusted-firmware/build/rk3399/release/bl31.bin rkbin/rk33
> +  > tools/mkimage -n rk3399 -T rksd -d spl/u-boot-spl.bin idbspl.img
> +
> +  Get idbspl.img in this step.
> +
> +Package the image for Rockchip miniloader(option 2)
> +------------------------------------------
> +  > cd ..
> +  > cp arm-trusted-firmware/build/rk3399/release/bl31.elf rkbin/rk33
>    > ./rkbin/tools/trust_merger rkbin/tools/RK3399TRUST.ini
>    > ./rkbin/tools/loaderimage --pack --uboot u-boot/u-boot-dtb.bin uboot.img
> -  > mkdir image
> -  > mv trust.img ./image/
> -  > mv uboot.img ./image/rk3399evb-uboot.bin
>  
> -Flash the image
> -===============
> +  Get trust.img and uboot.img in this step.
> +
> +Flash the image to eMMC
> +=======================
> +
> +Flash the image with U-Boot SPL(option 1)
> +-------------------------------
>  Power on(or reset with RESET KEY) with MASKROM KEY preesed, and then:
> +  > rkdeveloptool db rkbin/rk33/rk3399_loader_v1.08.106.bin
> +  > rkdeveloptool wl 64 u-boot/idbspl.img
> +  > rkdeveloptool wl 512 u-boot/u-boot.itb
> +  > rkdeveloptool rd
>  
> -  > ./rkflashtool/rkflashloader rk3399evb
> +Flash the image with Rockchip miniloader(option 2)
> +----------------------------------------
> +Power on(or reset with RESET KEY) with MASKROM KEY preesed, and then:
> +  > rkdeveloptool db rkbin/rk33/rk3399_loader_v1.08.106.bin
> +  > rkdeveloptool ul rkbin/rk33/rk3399_loader_v1.08.106.bin
> +  > rkdeveloptool wl 0x4000 u-boot/uboot.img
> +  > rkdeveloptool wl 0x6000 u-boot/trust.img
> +  > rkdeveloptool rd
>  
>  You should be able to get U-Boot log message in console/UART2 now.
> +For more detail, please reference to:
> +http://opensource.rock-chips.com/wiki_Boot_option
> -- 
> 1.9.1
> 
> _______________________________________________
> U-Boot mailing list
> U-Boot at lists.denx.de
> https://lists.denx.de/listinfo/u-boot
> 
> 

[U-Boot] [U-Boot, 3/3] rockchip: evb-rk3399: update document for board bring up

[Philipp Tomsich]

> Since we support ATF in SPL and add script for it, let's make the
> document up to date.
> 
> Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
> ---
> 
>  board/rockchip/evb_rk3399/README | 79 ++++++++++++++++++++++++++++++++--------
>  1 file changed, 63 insertions(+), 16 deletions(-)
> 

Acked-by: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>

[U-Boot] [PATCH 1/3] rockchip: rk3399-evb: add script for atf fit

[Simon Glass]

Hi,

On 17 August 2017 at 23:07, Kever Yang <kever.yang@rock-chips.com> wrote:
> Add a script to generate binaries from bl31.elf, and generate
> u-boot.its file for FIT image including u-boot, dtb and atf binaries.
>
> Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
> ---
>
>  board/rockchip/evb_rk3399/mk_fit_atf.sh | 110 ++++++++++++++++++++++++++++++++
>  1 file changed, 110 insertions(+)
>  create mode 100755 board/rockchip/evb_rk3399/mk_fit_atf.sh

Can you instead write this in python and put it in binman?

That is the tool which should be used to generate more complex firmware images.