[Buildroot] [PATCH v3 0/5] allwinner: arm64: use mainline TF-A

[Buildroot] [PATCH v3 0/5] allwinner: arm64: use mainline TF-A

[Sergey Matyukevich]

Hi all,

This is the 3rd revision of the patch set that replaces custom fork with
mainline TF-A in Allwinner H5/A64 BSPs. The changes include:

- introduce TF-A selection menu to explicitly chose GCC stack protection
- switch from custom port to mainline TF-A in orangepi-zero-pluse2 BSP
- bump Linux kernel version
- bump U-Boot version
  -- switch to combined u-boot-sunxi-with-spl.bin image
  -- for now disable support for Allwinner SCP firmware

So far I have got no feedback from the boards custodians. So this time
I only keep the board that I can test myself: orangepi-zero-plus2.

Regards,
Sergey

v3:
- rework TF-A stack protection approach: add selection menu
- only keep the board that I can test: orangepi-zero-plus2
- cleanup commit messages: TF-A instead of ATF

v2:
- as per Heiko Thiery suggestion, bump mainline ATF version to v2.5
- cleanup commit messages: use 'mainline' instead of 'upstream'

Sergey Matyukevich (5):
  boot/arm-trusted-firmware: enable stack protection level selection
  support/testing: switch TestATFAllwinner to mainline TF-A
  support/testing/tests/boot/test_atf: update U-Boot in TestATFAllwinner
  configs/orangepi_zero_plus2_defconfig: switch to mainline TF-A
  configs/orangepi-zero-plus2: bump BSP versions

 .../orangepi/orangepi-zero-plus2/genimage.cfg | 10 ++-----
 boot/arm-trusted-firmware/Config.in           | 26 +++++++++++++++++++
 .../arm-trusted-firmware.mk                   |  8 +++---
 configs/orangepi_zero_plus2_defconfig         | 19 +++++++-------
 support/testing/tests/boot/test_atf.py        | 16 ++++++------
 5 files changed, 50 insertions(+), 29 deletions(-)

-- 
2.32.0

[Buildroot] [PATCH v3 1/5] boot/arm-trusted-firmware: enable stack protection level selection

[Sergey Matyukevich]

Buildroot sets appropriate ENABLE_STACK_PROTECTOR build flag value based on
the toolchain BR2_SSP_* option. However it might not be always convenient
to automatically infer TF-A stack protection from the toolchian features.
For instance, secure memory constraints may become an issue and all the
extra TF-A features need to be tuned or disabled in order to shrink
TF-A firmware image.

Besides, for any values other than "none", TF-A platform specific hook
'plat_get_stack_protector_canary' should be implemented. However this
hook is not implemented by all the platforms supported by TF-A. For
instance, allwinner currently does not provide such a hook.

Add choice menu to TF-A Config.in to enable selection of the
appropriate stack protection level.

Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
---
 boot/arm-trusted-firmware/Config.in           | 26 +++++++++++++++++++
 .../arm-trusted-firmware.mk                   |  8 +++---
 2 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/boot/arm-trusted-firmware/Config.in b/boot/arm-trusted-firmware/Config.in
index a5a8c5bfc3..5cdb0c37fd 100644
--- a/boot/arm-trusted-firmware/Config.in
+++ b/boot/arm-trusted-firmware/Config.in
@@ -188,4 +188,30 @@ config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NEEDS_ARM32_TOOLCHAIN
 	  Select this option if your ATF board configuration requires
 	  an ARM32 bare metal toolchain to be available.
 
+choice
+        prompt "TF-A GCC stack protection"
+        help
+          Select TF-A GCC stack protection. This feature requires
+          support from both toolchain and TF-A platform specific
+          layer. Namely, for all values other than 'none' the
+          plat_get_stack_protector_canary() platform hook needs
+          to be implemented.
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_NONE
+        bool "none"
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_DEFAULT
+        bool "default"
+        depends on BR2_SSP_REGULAR
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_STRONG
+        bool "strong"
+        depends on BR2_SSP_STRONG
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_ALL
+        bool "all"
+        depends on BR2_SSP_ALL
+
+endchoice
+
 endif
diff --git a/boot/arm-trusted-firmware/arm-trusted-firmware.mk b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
index 279658712b..9b00672aa6 100644
--- a/boot/arm-trusted-firmware/arm-trusted-firmware.mk
+++ b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
@@ -109,11 +109,13 @@ ARM_TRUSTED_FIRMWARE_MAKE_OPTS += MV_DDR_PATH=$(MV_DDR_MARVELL_DIR)
 ARM_TRUSTED_FIRMWARE_DEPENDENCIES += mv-ddr-marvell
 endif
 
-ifeq ($(BR2_SSP_REGULAR),y)
+ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_NONE),y)
+ARM_TRUSTED_FIRMWARE_MAKE_OPTS += ENABLE_STACK_PROTECTOR=none
+else ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_DEFAULT),y)
 ARM_TRUSTED_FIRMWARE_MAKE_OPTS += ENABLE_STACK_PROTECTOR=default
-else ifeq ($(BR2_SSP_STRONG),y)
+else ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_STRONG),y)
 ARM_TRUSTED_FIRMWARE_MAKE_OPTS += ENABLE_STACK_PROTECTOR=strong
-else ifeq ($(BR2_SSP_ALL),y)
+else ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_ALL),y)
 ARM_TRUSTED_FIRMWARE_MAKE_OPTS += ENABLE_STACK_PROTECTOR=all
 endif
 
-- 
2.32.0

[Buildroot] [PATCH v3 2/5] support/testing: switch TestATFAllwinner to mainline TF-A

[Sergey Matyukevich]

Switch to mainline TF-A that provides basic support for H5 and A64.
Note that Allwinner platform layer in TF-A does not provide support
for GCC stack protection, so make sure to disable this TF-A feature.

Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
---
 support/testing/tests/boot/test_atf.py | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/support/testing/tests/boot/test_atf.py b/support/testing/tests/boot/test_atf.py
index e6c11aa742..8c29fbd594 100644
--- a/support/testing/tests/boot/test_atf.py
+++ b/support/testing/tests/boot/test_atf.py
@@ -33,10 +33,11 @@ class TestATFAllwinner(infra.basetest.BRTest):
         BR2_TOOLCHAIN_EXTERNAL=y
         BR2_TOOLCHAIN_EXTERNAL_LINARO_AARCH64=y
         BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
-        BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_GIT=y
-        BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_URL="https://github.com/apritzel/arm-trusted-firmware.git"
-        BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="sun50iw1p1"
-        BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_VERSION="aa75c8da415158a94b82a430b2b40000778e851f"
+        BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
+        BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION=y
+        BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION_VALUE="v2.5"
+        BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="sun50i_a64"
+        BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_NONE=y
         BR2_TARGET_ARM_TRUSTED_FIRMWARE_BL31=y
         BR2_TARGET_UBOOT=y
         BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
-- 
2.32.0

[Buildroot] [PATCH v3 3/5] support/testing/tests/boot/test_atf: update U-Boot in TestATFAllwinner

[Sergey Matyukevich]

Bump U-Boot version in TestATFAllwinner. Updating U-Boot version to
2021.04 requires the following two changes.

First, after switching to binman, u-boot.itb is no more generated for
64-bit sunxi boards. Combined u-boot-sunxi-with-spl.bin image should
be used instead. This image contains SPL, U-Boot, and FIT image,
where FIT image contains other binaries such as BL31 and SCP.

Second, new U-Boot enables support for System Control Processor (SCP)
firmware. SCP firmware is included by default into FIT image in the
combined u-boot-sunxi-with-spl.bin binary. When SCP is not available
or not needed, it should be explicitly disabled by pointing to an
empty file. Support for Allwinner SCP firmware is not yet available
neither in Buildroot nor in mainline kernel. So disable it for now
using custom U-Boot build options.

Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
---
 support/testing/tests/boot/test_atf.py | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/support/testing/tests/boot/test_atf.py b/support/testing/tests/boot/test_atf.py
index 8c29fbd594..915e0a5093 100644
--- a/support/testing/tests/boot/test_atf.py
+++ b/support/testing/tests/boot/test_atf.py
@@ -42,16 +42,15 @@ class TestATFAllwinner(infra.basetest.BRTest):
         BR2_TARGET_UBOOT=y
         BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
         BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-        BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.10"
+        BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2021.04"
         BR2_TARGET_UBOOT_BOARD_DEFCONFIG="bananapi_m64"
         BR2_TARGET_UBOOT_NEEDS_DTC=y
         BR2_TARGET_UBOOT_NEEDS_PYTHON3=y
         BR2_TARGET_UBOOT_NEEDS_PYLIBFDT=y
         BR2_TARGET_UBOOT_NEEDS_ATF_BL31=y
-        BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
-        BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="u-boot.itb"
         BR2_TARGET_UBOOT_SPL=y
-        BR2_TARGET_UBOOT_SPL_NAME="spl/sunxi-spl.bin"
+        BR2_TARGET_UBOOT_SPL_NAME="u-boot-sunxi-with-spl.bin"
+        BR2_TARGET_UBOOT_CUSTOM_MAKEOPTS="SCP=/dev/null"
         """
 
     def test_run(self):
-- 
2.32.0

[Buildroot] [PATCH v3 4/5] configs/orangepi_zero_plus2_defconfig: switch to mainline TF-A

[Sergey Matyukevich]

Switch to mainline TF-A that provides basic support for H5 and A64.
Note that Allwinner platform layer in TF-A does not provide support
for GCC stack protection, so make sure to disable this TF-A feature.

Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
---
 configs/orangepi_zero_plus2_defconfig | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/configs/orangepi_zero_plus2_defconfig b/configs/orangepi_zero_plus2_defconfig
index aa4c5c9413..203d86e7fc 100644
--- a/configs/orangepi_zero_plus2_defconfig
+++ b/configs/orangepi_zero_plus2_defconfig
@@ -8,10 +8,10 @@ BR2_ROOTFS_OVERLAY="board/orangepi/orangepi-zero-plus2/rootfs_overlay"
 
 # Firmware
 BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_GIT=y
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_URL="https://github.com/apritzel/arm-trusted-firmware.git"
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="sun50iw1p1"
-BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_VERSION="aa75c8da415158a94b82a430b2b40000778e851f"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION_VALUE="v2.5"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="sun50i_a64"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_NONE=y
 BR2_TARGET_ARM_TRUSTED_FIRMWARE_BL31=y
 
 # Bootloader
-- 
2.32.0

[Buildroot] [PATCH v3 5/5] configs/orangepi-zero-plus2: bump BSP versions

[Sergey Matyukevich]

Bump U-Boot and Linux kernel versions. Updating U-Boot to 2021.04
requires the following two changes.

First, after switching to binman, u-boot.itb is no more generated for
64-bit sunxi boards. Combined u-boot-sunxi-with-spl.bin image should
be used instead. This image contains SPL, U-Boot, and FIT image,
where FIT image contains other binaries such as BL31 and SCP.

Second, new U-Boot enables support for System Control Processor (SCP)
firmware. SCP firmware is included by default into FIT image in the
combined u-boot-sunxi-with-spl.bin binary. When SCP is not available
or not needed, it should be explicitly disabled by pointing to an
empty file. Support for Allwinner SCP firmware is not yet available
neither in Buildroot nor in mainline kernel. So disable it for now
using custom U-Boot build options.

Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
---
 board/orangepi/orangepi-zero-plus2/genimage.cfg | 10 ++--------
 configs/orangepi_zero_plus2_defconfig           | 11 +++++------
 2 files changed, 7 insertions(+), 14 deletions(-)

diff --git a/board/orangepi/orangepi-zero-plus2/genimage.cfg b/board/orangepi/orangepi-zero-plus2/genimage.cfg
index 98ebf5b475..255acdbecb 100644
--- a/board/orangepi/orangepi-zero-plus2/genimage.cfg
+++ b/board/orangepi/orangepi-zero-plus2/genimage.cfg
@@ -19,15 +19,9 @@ image sdcard.img {
 
 	partition spl {
 		in-partition-table = "no"
-		image = "sunxi-spl.bin"
+		image = "u-boot-sunxi-with-spl.bin"
 		offset = 8192
-	}
-
-	partition u-boot {
-		in-partition-table = "no"
-		image = "u-boot.itb"
-		offset = 40K
-		size = 1024000 # 1MB - 40K + 16K(GPT)
+		size = 1056768 # 1MB - 8K + 16K(GPT)
 	}
 
 	partition boot {
diff --git a/configs/orangepi_zero_plus2_defconfig b/configs/orangepi_zero_plus2_defconfig
index 203d86e7fc..75ddbf1b55 100644
--- a/configs/orangepi_zero_plus2_defconfig
+++ b/configs/orangepi_zero_plus2_defconfig
@@ -2,7 +2,7 @@ BR2_aarch64=y
 BR2_cortex_a53=y
 BR2_ARM_FPU_VFPV4=y
 
-BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_10=y
+BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_12=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_MDEV=y
 BR2_ROOTFS_OVERLAY="board/orangepi/orangepi-zero-plus2/rootfs_overlay"
 
@@ -18,16 +18,15 @@ BR2_TARGET_ARM_TRUSTED_FIRMWARE_BL31=y
 BR2_TARGET_UBOOT=y
 BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.10"
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2021.04"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="orangepi_zero_plus2"
 BR2_TARGET_UBOOT_NEEDS_DTC=y
 BR2_TARGET_UBOOT_NEEDS_PYTHON3=y
 BR2_TARGET_UBOOT_NEEDS_PYLIBFDT=y
 BR2_TARGET_UBOOT_NEEDS_ATF_BL31=y
-BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
-BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="u-boot.itb"
 BR2_TARGET_UBOOT_SPL=y
-BR2_TARGET_UBOOT_SPL_NAME="spl/sunxi-spl.bin"
+BR2_TARGET_UBOOT_SPL_NAME="u-boot-sunxi-with-spl.bin"
+BR2_TARGET_UBOOT_CUSTOM_MAKEOPTS="SCP=/dev/null"
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_BOOT_SCRIPT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_BOOT_SCRIPT_SOURCE="board/orangepi/orangepi-zero-plus2/boot.cmd"
@@ -35,7 +34,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_BOOT_SCRIPT_SOURCE="board/orangepi/orangepi-zero-pl
 # Kernel
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="5.10.10"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="5.12.10"
 BR2_LINUX_KERNEL_USE_ARCH_DEFAULT_CONFIG=y
 BR2_LINUX_KERNEL_DTS_SUPPORT=y
 BR2_LINUX_KERNEL_INTREE_DTS_NAME="allwinner/sun50i-h5-orangepi-zero-plus2"
-- 
2.32.0

[Buildroot] [PATCH v3 1/5] boot/arm-trusted-firmware: enable stack protection level selection

[Yann E. MORIN]

Sergey, All,

On 2021-06-25 22:33 +0300, Sergey Matyukevich spake thusly:
> Buildroot sets appropriate ENABLE_STACK_PROTECTOR build flag value based on
> the toolchain BR2_SSP_* option. However it might not be always convenient
> to automatically infer TF-A stack protection from the toolchian features.
> For instance, secure memory constraints may become an issue and all the
> extra TF-A features need to be tuned or disabled in order to shrink
> TF-A firmware image.
> 
> Besides, for any values other than "none", TF-A platform specific hook
> 'plat_get_stack_protector_canary' should be implemented. However this
> hook is not implemented by all the platforms supported by TF-A. For
> instance, allwinner currently does not provide such a hook.
> 
> Add choice menu to TF-A Config.in to enable selection of the
> appropriate stack protection level.
> 
> Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
> ---
>  boot/arm-trusted-firmware/Config.in           | 26 +++++++++++++++++++
>  .../arm-trusted-firmware.mk                   |  8 +++---
>  2 files changed, 31 insertions(+), 3 deletions(-)
> 
> diff --git a/boot/arm-trusted-firmware/Config.in b/boot/arm-trusted-firmware/Config.in
> index a5a8c5bfc3..5cdb0c37fd 100644
> --- a/boot/arm-trusted-firmware/Config.in
> +++ b/boot/arm-trusted-firmware/Config.in
> @@ -188,4 +188,30 @@ config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NEEDS_ARM32_TOOLCHAIN
>  	  Select this option if your ATF board configuration requires
>  	  an ARM32 bare metal toolchain to be available.
>  
> +choice
> +        prompt "TF-A GCC stack protection"
> +        help
> +          Select TF-A GCC stack protection. This feature requires
> +          support from both toolchain and TF-A platform specific
> +          layer. Namely, for all values other than 'none' the
> +          plat_get_stack_protector_canary() platform hook needs
> +          to be implemented.
> +
> +config BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_NONE
> +        bool "none"
> +
> +config BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_DEFAULT
> +        bool "default"
> +        depends on BR2_SSP_REGULAR
> +
> +config BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_STRONG
> +        bool "strong"
> +        depends on BR2_SSP_STRONG
> +
> +config BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_ALL
> +        bool "all"
> +        depends on BR2_SSP_ALL
> +
> +endchoice

So, basically, the issue is that we may need to disable SSP when
building ATF. If, we just use the global SSP setting.

So, I've changed this slightly-convoluted choice, into a single boolean
option:

    config BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP
            bool "Build with SSP"
            depends on BR2_TOOLCHAIN_HAS_SSP
            depends on !BR2_SSP_NONE
            default y
            help
              Say 'y' here if you want to build ATF with SSP.

              Your board must have SSP support in ATF: it must have an
              implementation for plat_get_stack_protector_canary().

              If you say 'y', the SSP level will be the level selected
              by the global SSP setting.

This single option is much simpler to understand, I believe.

>  endif
> diff --git a/boot/arm-trusted-firmware/arm-trusted-firmware.mk b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
> index 279658712b..9b00672aa6 100644
> --- a/boot/arm-trusted-firmware/arm-trusted-firmware.mk
> +++ b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
> @@ -109,11 +109,13 @@ ARM_TRUSTED_FIRMWARE_MAKE_OPTS += MV_DDR_PATH=$(MV_DDR_MARVELL_DIR)
>  ARM_TRUSTED_FIRMWARE_DEPENDENCIES += mv-ddr-marvell
>  endif
>  
> -ifeq ($(BR2_SSP_REGULAR),y)
> +ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_NONE),y)
> +ARM_TRUSTED_FIRMWARE_MAKE_OPTS += ENABLE_STACK_PROTECTOR=none
> +else ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_DEFAULT),y)
>  ARM_TRUSTED_FIRMWARE_MAKE_OPTS += ENABLE_STACK_PROTECTOR=default
> -else ifeq ($(BR2_SSP_STRONG),y)
> +else ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_STRONG),y)
>  ARM_TRUSTED_FIRMWARE_MAKE_OPTS += ENABLE_STACK_PROTECTOR=strong
> -else ifeq ($(BR2_SSP_ALL),y)
> +else ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_ALL),y)
>  ARM_TRUSTED_FIRMWARE_MAKE_OPTS += ENABLE_STACK_PROTECTOR=all

I've moved this conditional block into Config.in:

    config BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_LEVEL
            string
            default "none"    if !BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP
            default "default" if BR2_SSP_REGULAR
            default "strong"  if BR2_SSP_STRONG
            default "all"     if BR2_SSP_ALL

And thus the SSP option in the .mk is now unconditional:

    ARM_TRUSTED_FIRMWARE_MAKE_OPTS += \
        ENABLE_STACK_PROTECTOR=$(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_LEVEL))

Applied to master with the above changes, thanks.

Regards,
Yann E. MORIN.

>  endif
>  
> -- 
> 2.32.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'

[Buildroot] [PATCH v3 2/5] support/testing: switch TestATFAllwinner to mainline TF-A

[Yann E. MORIN]

On 2021-06-25 22:33 +0300, Sergey Matyukevich spake thusly:
> Switch to mainline TF-A that provides basic support for H5 and A64.
> Note that Allwinner platform layer in TF-A does not provide support
> for GCC stack protection, so make sure to disable this TF-A feature.
> 
> Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
> ---
>  support/testing/tests/boot/test_atf.py | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/support/testing/tests/boot/test_atf.py b/support/testing/tests/boot/test_atf.py
> index e6c11aa742..8c29fbd594 100644
> --- a/support/testing/tests/boot/test_atf.py
> +++ b/support/testing/tests/boot/test_atf.py
> @@ -33,10 +33,11 @@ class TestATFAllwinner(infra.basetest.BRTest):
>          BR2_TOOLCHAIN_EXTERNAL=y
>          BR2_TOOLCHAIN_EXTERNAL_LINARO_AARCH64=y
>          BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
> -        BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_GIT=y
> -        BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_URL="https://github.com/apritzel/arm-trusted-firmware.git"
> -        BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="sun50iw1p1"
> -        BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_VERSION="aa75c8da415158a94b82a430b2b40000778e851f"
> +        BR2_TARGET_ARM_TRUSTED_FIRMWARE=y

This was duplicating the existing option, so I removed it.

> +        BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION=y
> +        BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION_VALUE="v2.5"
> +        BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="sun50i_a64"
> +        BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_NONE=y

I've changed that to the new boolean option.

Applied to master, thanks.

Regards,
Yann E. MORIN.

>          BR2_TARGET_ARM_TRUSTED_FIRMWARE_BL31=y
>          BR2_TARGET_UBOOT=y
>          BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
> -- 
> 2.32.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'

[Buildroot] [PATCH v3 3/5] support/testing/tests/boot/test_atf: update U-Boot in TestATFAllwinner

[Yann E. MORIN]

Sergey, All,

On 2021-06-25 22:33 +0300, Sergey Matyukevich spake thusly:
> Bump U-Boot version in TestATFAllwinner. Updating U-Boot version to
> 2021.04 requires the following two changes.
> 
> First, after switching to binman, u-boot.itb is no more generated for
> 64-bit sunxi boards. Combined u-boot-sunxi-with-spl.bin image should
> be used instead. This image contains SPL, U-Boot, and FIT image,
> where FIT image contains other binaries such as BL31 and SCP.
> 
> Second, new U-Boot enables support for System Control Processor (SCP)
> firmware. SCP firmware is included by default into FIT image in the
> combined u-boot-sunxi-with-spl.bin binary. When SCP is not available
> or not needed, it should be explicitly disabled by pointing to an
> empty file. Support for Allwinner SCP firmware is not yet available
> neither in Buildroot nor in mainline kernel. So disable it for now
> using custom U-Boot build options.
> 
> Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>

Applied to master, thanks.

Regards,
Yann E. MORIN.

> ---
>  support/testing/tests/boot/test_atf.py | 7 +++----
>  1 file changed, 3 insertions(+), 4 deletions(-)
> 
> diff --git a/support/testing/tests/boot/test_atf.py b/support/testing/tests/boot/test_atf.py
> index 8c29fbd594..915e0a5093 100644
> --- a/support/testing/tests/boot/test_atf.py
> +++ b/support/testing/tests/boot/test_atf.py
> @@ -42,16 +42,15 @@ class TestATFAllwinner(infra.basetest.BRTest):
>          BR2_TARGET_UBOOT=y
>          BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
>          BR2_TARGET_UBOOT_CUSTOM_VERSION=y
> -        BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.10"
> +        BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2021.04"
>          BR2_TARGET_UBOOT_BOARD_DEFCONFIG="bananapi_m64"
>          BR2_TARGET_UBOOT_NEEDS_DTC=y
>          BR2_TARGET_UBOOT_NEEDS_PYTHON3=y
>          BR2_TARGET_UBOOT_NEEDS_PYLIBFDT=y
>          BR2_TARGET_UBOOT_NEEDS_ATF_BL31=y
> -        BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
> -        BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="u-boot.itb"
>          BR2_TARGET_UBOOT_SPL=y
> -        BR2_TARGET_UBOOT_SPL_NAME="spl/sunxi-spl.bin"
> +        BR2_TARGET_UBOOT_SPL_NAME="u-boot-sunxi-with-spl.bin"
> +        BR2_TARGET_UBOOT_CUSTOM_MAKEOPTS="SCP=/dev/null"
>          """
>  
>      def test_run(self):
> -- 
> 2.32.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'

[Buildroot] [PATCH v3 4/5] configs/orangepi_zero_plus2_defconfig: switch to mainline TF-A

[Yann E. MORIN]

Sergey, All,

On 2021-06-25 22:33 +0300, Sergey Matyukevich spake thusly:
> Switch to mainline TF-A that provides basic support for H5 and A64.
> Note that Allwinner platform layer in TF-A does not provide support
> for GCC stack protection, so make sure to disable this TF-A feature.

Actually, this was not needed at all, because the toolchain used by this
defconfig does not support SSP to begin with. So I dropped both this
part of the commit log, and the option (which was renamed anyway).

Applied to master, with the above changes, thanks.

Regards,
Yann E. MORIN.

> Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
> ---
>  configs/orangepi_zero_plus2_defconfig | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/configs/orangepi_zero_plus2_defconfig b/configs/orangepi_zero_plus2_defconfig
> index aa4c5c9413..203d86e7fc 100644
> --- a/configs/orangepi_zero_plus2_defconfig
> +++ b/configs/orangepi_zero_plus2_defconfig
> @@ -8,10 +8,10 @@ BR2_ROOTFS_OVERLAY="board/orangepi/orangepi-zero-plus2/rootfs_overlay"
>  
>  # Firmware
>  BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
> -BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_GIT=y
> -BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_URL="https://github.com/apritzel/arm-trusted-firmware.git"
> -BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="sun50iw1p1"
> -BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_VERSION="aa75c8da415158a94b82a430b2b40000778e851f"
> +BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION=y
> +BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION_VALUE="v2.5"
> +BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="sun50i_a64"
> +BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_NONE=y
>  BR2_TARGET_ARM_TRUSTED_FIRMWARE_BL31=y
>  
>  # Bootloader
> -- 
> 2.32.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'

[Buildroot] [PATCH v3 5/5] configs/orangepi-zero-plus2: bump BSP versions

[Yann E. MORIN]

Sergey, All,

On 2021-06-25 22:33 +0300, Sergey Matyukevich spake thusly:
> Bump U-Boot and Linux kernel versions. Updating U-Boot to 2021.04
> requires the following two changes.
> 
> First, after switching to binman, u-boot.itb is no more generated for
> 64-bit sunxi boards. Combined u-boot-sunxi-with-spl.bin image should
> be used instead. This image contains SPL, U-Boot, and FIT image,
> where FIT image contains other binaries such as BL31 and SCP.
> 
> Second, new U-Boot enables support for System Control Processor (SCP)
> firmware. SCP firmware is included by default into FIT image in the
> combined u-boot-sunxi-with-spl.bin binary. When SCP is not available
> or not needed, it should be explicitly disabled by pointing to an
> empty file. Support for Allwinner SCP firmware is not yet available
> neither in Buildroot nor in mainline kernel. So disable it for now
> using custom U-Boot build options.
> 
> Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>

Applied to master, thanks.

Regards,
Yann E. MORIN.

> ---
>  board/orangepi/orangepi-zero-plus2/genimage.cfg | 10 ++--------
>  configs/orangepi_zero_plus2_defconfig           | 11 +++++------
>  2 files changed, 7 insertions(+), 14 deletions(-)
> 
> diff --git a/board/orangepi/orangepi-zero-plus2/genimage.cfg b/board/orangepi/orangepi-zero-plus2/genimage.cfg
> index 98ebf5b475..255acdbecb 100644
> --- a/board/orangepi/orangepi-zero-plus2/genimage.cfg
> +++ b/board/orangepi/orangepi-zero-plus2/genimage.cfg
> @@ -19,15 +19,9 @@ image sdcard.img {
>  
>  	partition spl {
>  		in-partition-table = "no"
> -		image = "sunxi-spl.bin"
> +		image = "u-boot-sunxi-with-spl.bin"
>  		offset = 8192
> -	}
> -
> -	partition u-boot {
> -		in-partition-table = "no"
> -		image = "u-boot.itb"
> -		offset = 40K
> -		size = 1024000 # 1MB - 40K + 16K(GPT)
> +		size = 1056768 # 1MB - 8K + 16K(GPT)
>  	}
>  
>  	partition boot {
> diff --git a/configs/orangepi_zero_plus2_defconfig b/configs/orangepi_zero_plus2_defconfig
> index 203d86e7fc..75ddbf1b55 100644
> --- a/configs/orangepi_zero_plus2_defconfig
> +++ b/configs/orangepi_zero_plus2_defconfig
> @@ -2,7 +2,7 @@ BR2_aarch64=y
>  BR2_cortex_a53=y
>  BR2_ARM_FPU_VFPV4=y
>  
> -BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_10=y
> +BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_12=y
>  BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_MDEV=y
>  BR2_ROOTFS_OVERLAY="board/orangepi/orangepi-zero-plus2/rootfs_overlay"
>  
> @@ -18,16 +18,15 @@ BR2_TARGET_ARM_TRUSTED_FIRMWARE_BL31=y
>  BR2_TARGET_UBOOT=y
>  BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
>  BR2_TARGET_UBOOT_CUSTOM_VERSION=y
> -BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.10"
> +BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2021.04"
>  BR2_TARGET_UBOOT_BOARD_DEFCONFIG="orangepi_zero_plus2"
>  BR2_TARGET_UBOOT_NEEDS_DTC=y
>  BR2_TARGET_UBOOT_NEEDS_PYTHON3=y
>  BR2_TARGET_UBOOT_NEEDS_PYLIBFDT=y
>  BR2_TARGET_UBOOT_NEEDS_ATF_BL31=y
> -BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
> -BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="u-boot.itb"
>  BR2_TARGET_UBOOT_SPL=y
> -BR2_TARGET_UBOOT_SPL_NAME="spl/sunxi-spl.bin"
> +BR2_TARGET_UBOOT_SPL_NAME="u-boot-sunxi-with-spl.bin"
> +BR2_TARGET_UBOOT_CUSTOM_MAKEOPTS="SCP=/dev/null"
>  BR2_PACKAGE_HOST_UBOOT_TOOLS=y
>  BR2_PACKAGE_HOST_UBOOT_TOOLS_BOOT_SCRIPT=y
>  BR2_PACKAGE_HOST_UBOOT_TOOLS_BOOT_SCRIPT_SOURCE="board/orangepi/orangepi-zero-plus2/boot.cmd"
> @@ -35,7 +34,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_BOOT_SCRIPT_SOURCE="board/orangepi/orangepi-zero-pl
>  # Kernel
>  BR2_LINUX_KERNEL=y
>  BR2_LINUX_KERNEL_CUSTOM_VERSION=y
> -BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="5.10.10"
> +BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="5.12.10"
>  BR2_LINUX_KERNEL_USE_ARCH_DEFAULT_CONFIG=y
>  BR2_LINUX_KERNEL_DTS_SUPPORT=y
>  BR2_LINUX_KERNEL_INTREE_DTS_NAME="allwinner/sun50i-h5-orangepi-zero-plus2"
> -- 
> 2.32.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'