[meta-ti][dunfell][PATCH 1/2] ti-sci-fw: Allow build to continue without TI_SECURE_DEV_PKG set

[meta-ti][dunfell][PATCH 1/2] ti-sci-fw: Allow build to continue without TI_SECURE_DEV_PKG set

[Andrew Davis]

If we do not have TI_SECURE_DEV_PKG set then SYSFW generation will fail
if we are building for the HS platform. When TI_SECURE_DEV_PKG is not
set we assume the builder is only interested in the GP boards, so fake
generating the HS SYSFW images. These will be non-functional on HS
boards, but they would have been just as non-functional if built
without TI_SECURE_DEV_PKG set.

Signed-off-by: Andrew Davis <afd@ti.com>
---
 recipes-bsp/ti-sci-fw/ti-sci-fw_git.bb | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/recipes-bsp/ti-sci-fw/ti-sci-fw_git.bb b/recipes-bsp/ti-sci-fw/ti-sci-fw_git.bb
index 18652dd4..287e5a40 100644
--- a/recipes-bsp/ti-sci-fw/ti-sci-fw_git.bb
+++ b/recipes-bsp/ti-sci-fw/ti-sci-fw_git.bb
@@ -66,6 +66,11 @@ EXTRA_OEMAKE_remove_j7-hs-evm-k3r5 = " SBL="${STAGING_DIR_HOST}/boot/u-boot-spl.
 EXTRA_OEMAKE_remove_j7-hs-evm-k3r5-sr1-1 = " SBL="${STAGING_DIR_HOST}/boot/u-boot-spl.bin""
 
 do_compile() {
+	if [ ! "${SYSFW_SUFFIX}" = "gp" ] && [ ! -f ${TI_SECURE_DEV_PKG}/scripts/secure-binary-image.sh ]; then
+		echo "Warning: TI_SECURE_DEV_PKG not set, skipping HS SYSFW generation."
+		touch ${WORKDIR}/imggen/${SYSFW_TIBOOT3}
+		exit 0
+	fi
 	cd ${WORKDIR}/imggen/
 	oe_runmake
 }
-- 
2.36.1

[meta-ti][dunfell][PATCH 2/2] conf: machine: am64xx-evm: Make HS-SE the default

[Andrew Davis]

The HS-SE AM64xx machine can now be run on GP devices and built without
needing the TI_SECURE_DEV_PKG for the same. AM64xx will only be available
in the HS-FS type going forward. Make the HS-SE the default and remove
the original GP machine.

Signed-off-by: Andrew Davis <afd@ti.com>
---
 ...m-k3r5-gp.conf => am64xx-evm-k3r5-gp.conf} |  6 ++++-
 conf/machine/am64xx-evm-k3r5-hs-se.conf       | 14 +++++++++++
 conf/machine/am64xx-evm-k3r5.conf             | 11 --------
 conf/machine/am64xx-evm.conf                  |  6 +++++
 conf/machine/am64xx-hs-evm-k3r5.conf          | 12 ---------
 conf/machine/am64xx-hs-evm.conf               | 25 -------------------
 conf/machine/include/am64xx.inc               |  5 ++--
 conf/multiconfig/k3r5-hs-se.conf              |  3 +++
 .../trusted-firmware-a_%.bbappend             |  2 +-
 recipes-security/optee/optee-os_%.bbappend    |  2 +-
 10 files changed, 33 insertions(+), 53 deletions(-)
 rename conf/machine/{am64xx-hs-evm-k3r5-gp.conf => am64xx-evm-k3r5-gp.conf} (78%)
 create mode 100644 conf/machine/am64xx-evm-k3r5-hs-se.conf
 delete mode 100644 conf/machine/am64xx-evm-k3r5.conf
 delete mode 100644 conf/machine/am64xx-hs-evm-k3r5.conf
 delete mode 100644 conf/machine/am64xx-hs-evm.conf
 create mode 100644 conf/multiconfig/k3r5-hs-se.conf

diff --git a/conf/machine/am64xx-hs-evm-k3r5-gp.conf b/conf/machine/am64xx-evm-k3r5-gp.conf
similarity index 78%
rename from conf/machine/am64xx-hs-evm-k3r5-gp.conf
rename to conf/machine/am64xx-evm-k3r5-gp.conf
index b255dca8..c599ee47 100644
--- a/conf/machine/am64xx-hs-evm-k3r5-gp.conf
+++ b/conf/machine/am64xx-evm-k3r5-gp.conf
@@ -4,12 +4,16 @@
 
 # Booting GP requires different SYSFW, the rest is handled at runtime
 
-require conf/machine/am64xx-hs-evm-k3r5.conf
+require conf/machine/include/k3r5.inc
 SOC_FAMILY_append = ":k3r5-gp"
 
+SYSFW_SOC = "am64x"
+SYSFW_CONFIG = "evm"
 SYSFW_SUFFIX = "gp"
 SYSFW_TIBOOT3_SYMLINK = ""
 
+UBOOT_MACHINE = "am64x_evm_r5_defconfig"
+
 SPL_BINARY = ""
 UBOOT_BINARY = "u-boot-spl.${UBOOT_SUFFIX}"
 UBOOT_IMAGE = "u-boot-r5spl-gp-${MAINMACHINE}-${PV}-${PR}.${UBOOT_SUFFIX}"
diff --git a/conf/machine/am64xx-evm-k3r5-hs-se.conf b/conf/machine/am64xx-evm-k3r5-hs-se.conf
new file mode 100644
index 00000000..7cab7d15
--- /dev/null
+++ b/conf/machine/am64xx-evm-k3r5-hs-se.conf
@@ -0,0 +1,14 @@
+#@TYPE: Machine
+#@NAME: AM64xx HS-SE EVM (R5F)
+#@DESCRIPTION: Machine configuration for the TI AM64xx HS-SE EVM (R5F core)
+
+# Booting HS-SE requires different SYSFW, the rest is handled at runtime
+
+require conf/machine/include/k3r5.inc
+SOC_FAMILY_append = ":k3r5-hs-se"
+
+SYSFW_SOC = "am64x"
+SYSFW_CONFIG = "evm"
+SYSFW_SUFFIX = "hs"
+
+UBOOT_MACHINE = "am64x_evm_r5_defconfig"
diff --git a/conf/machine/am64xx-evm-k3r5.conf b/conf/machine/am64xx-evm-k3r5.conf
deleted file mode 100644
index afd36b72..00000000
--- a/conf/machine/am64xx-evm-k3r5.conf
+++ /dev/null
@@ -1,11 +0,0 @@
-#@TYPE: Machine
-#@NAME: AM64xx EVM (R5F)
-#@DESCRIPTION: Machine configuration for the TI AM64xx EVM (R5F core)
-
-require conf/machine/include/k3r5.inc
-
-SYSFW_SOC = "am64x"
-SYSFW_CONFIG = "evm"
-SYSFW_SUFFIX = "gp"
-
-UBOOT_MACHINE = "am64x_evm_r5_defconfig"
diff --git a/conf/machine/am64xx-evm.conf b/conf/machine/am64xx-evm.conf
index 2cb7f55a..d6efdf52 100644
--- a/conf/machine/am64xx-evm.conf
+++ b/conf/machine/am64xx-evm.conf
@@ -9,3 +9,9 @@ UBOOT_MACHINE = "am64x_evm_a53_defconfig"
 SPL_BINARY = "tispl.bin_HS"
 UBOOT_BINARY = "u-boot.img_HS"
 UBOOT_SYMLINK = "u-boot.img"
+
+# Since default tiboot3.bin on AM64x is for HS-SE, add a version for GP
+BBMULTICONFIG += "k3r5-gp"
+IMAGE_BOOT_FILES += " tiboot3-am64x-gp-evm.bin"
+do_image_wic[mcdepends] += "mc::k3r5-gp:ti-sci-fw:do_deploy"
+do_image_tar[mcdepends] += "mc::k3r5-gp:ti-sci-fw:do_deploy"
diff --git a/conf/machine/am64xx-hs-evm-k3r5.conf b/conf/machine/am64xx-hs-evm-k3r5.conf
deleted file mode 100644
index 95e68751..00000000
--- a/conf/machine/am64xx-hs-evm-k3r5.conf
+++ /dev/null
@@ -1,12 +0,0 @@
-#@TYPE: Machine
-#@NAME: AM64xx HS EVM (R5F)
-#@DESCRIPTION: Machine configuration for the TI AM64xx HS EVM (R5F core)
-
-require conf/machine/include/k3r5.inc
-
-SYSFW_SOC = "am64x"
-SYSFW_CONFIG = "evm"
-SYSFW_SUFFIX = "hs"
-SYSFW_SYMLINK = ""
-
-UBOOT_MACHINE = "am64x_evm_r5_defconfig"
diff --git a/conf/machine/am64xx-hs-evm.conf b/conf/machine/am64xx-hs-evm.conf
deleted file mode 100644
index 1149d4c7..00000000
--- a/conf/machine/am64xx-hs-evm.conf
+++ /dev/null
@@ -1,25 +0,0 @@
-#@TYPE: Machine
-#@NAME: AM64xx HS EVM
-#@DESCRIPTION: Machine configuration for the TI AM64xx HS EVM
-
-require conf/machine/include/am64xx.inc
-
-UBOOT_MACHINE = "am64x_evm_a53_defconfig"
-
-UBOOT_ENTRYPOINT =       "0x80080000"
-UBOOT_LOADADDRESS =      "0x80080000"
-UBOOT_RD_LOADADDRESS =   "0x84000000"
-UBOOT_RD_ENTRYPOINT =    "0x84000000"
-UBOOT_DTB_LOADADDRESS =  "0x83000000"
-UBOOT_DTBO_LOADADDRESS = "0x83080000"
-UBOOT_DTBO_OFFSET =      "0x00010000"
-
-SPL_BINARY = "tispl.bin_HS"
-UBOOT_BINARY = "u-boot.img_HS"
-UBOOT_SYMLINK = "u-boot.img"
-
-# Since default tiboot3.bin on AM64x is for HS, add a version for GP
-BBMULTICONFIG += "k3r5-gp"
-IMAGE_BOOT_FILES += " tiboot3-am64x-gp-evm.bin"
-do_image_wic[mcdepends] += "mc::k3r5-gp:ti-sci-fw:do_deploy"
-do_image_tar[mcdepends] += "mc::k3r5-gp:ti-sci-fw:do_deploy"
diff --git a/conf/machine/include/am64xx.inc b/conf/machine/include/am64xx.inc
index 930fba08..becc79d4 100644
--- a/conf/machine/include/am64xx.inc
+++ b/conf/machine/include/am64xx.inc
@@ -14,8 +14,9 @@ KERNEL_DEVICETREE = " \
     ti/k3-am642-evm-nand.dtbo \
 "
 
-do_image_wic[mcdepends] = "mc::k3r5:ti-sci-fw:do_deploy"
-do_image_tar[mcdepends] = "mc::k3r5:ti-sci-fw:do_deploy"
+BBMULTICONFIG = "k3r5-hs-se"
+do_image_wic[mcdepends] = "mc::k3r5-hs-se:ti-sci-fw:do_deploy"
+do_image_tar[mcdepends] = "mc::k3r5-hs-se:ti-sci-fw:do_deploy"
 
 TFA_BOARD = "lite"
 OPTEEMACHINE = "k3-am64x"
diff --git a/conf/multiconfig/k3r5-hs-se.conf b/conf/multiconfig/k3r5-hs-se.conf
new file mode 100644
index 00000000..701f8e88
--- /dev/null
+++ b/conf/multiconfig/k3r5-hs-se.conf
@@ -0,0 +1,3 @@
+require k3r5.conf
+
+MACHINE_append = "-hs-se"
diff --git a/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend b/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend
index 965c99d4..dff244d2 100644
--- a/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend
+++ b/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend
@@ -27,7 +27,7 @@ do_compile_append_am65xx-hs-evm() {
 	tfa_sign_k3hs
 }
 
-do_compile_append_am64xx-hs-evm() {
+do_compile_append_am64xx-evm() {
 	tfa_sign_k3hs
 }
 
diff --git a/recipes-security/optee/optee-os_%.bbappend b/recipes-security/optee/optee-os_%.bbappend
index 5a25bd99..8a429bbc 100644
--- a/recipes-security/optee/optee-os_%.bbappend
+++ b/recipes-security/optee/optee-os_%.bbappend
@@ -66,7 +66,7 @@ do_compile_append_am65xx-hs-evm() {
     optee_sign_k3hs
 }
 
-do_compile_append_am64xx-hs-evm() {
+do_compile_append_am64xx-evm() {
     optee_sign_k3hs
 }
 
-- 
2.36.1

Re: [meta-ti][dunfell][PATCH 1/2] ti-sci-fw: Allow build to continue without TI_SECURE_DEV_PKG set

[Ryan Eatmon]

On 8/10/2022 9:47, Andrew Davis wrote:
> If we do not have TI_SECURE_DEV_PKG set then SYSFW generation will fail
> if we are building for the HS platform. When TI_SECURE_DEV_PKG is not
> set we assume the builder is only interested in the GP boards, so fake
> generating the HS SYSFW images. These will be non-functional on HS
> boards, but they would have been just as non-functional if built
> without TI_SECURE_DEV_PKG set.


Have you tested what happens if they do not have it set and build the 
"dummy" files, and then realize their mistake, set the variable and 
build again?  Do the files then build correctly, or does the sstate 
cache prevent them from getting the correct thing without clearing the 
cache and rebuilding everything?




-- 
Ryan Eatmon                reatmon@ti.com
-----------------------------------------
Texas Instruments, Inc.  -  LCPD  -  MGTS

Re: [meta-ti][dunfell][PATCH 1/2] ti-sci-fw: Allow build to continue without TI_SECURE_DEV_PKG set

[Andrew Davis]

On 8/10/22 10:58 AM, Ryan Eatmon wrote:
> 
> 
> On 8/10/2022 9:47, Andrew Davis wrote:
>> If we do not have TI_SECURE_DEV_PKG set then SYSFW generation will fail
>> if we are building for the HS platform. When TI_SECURE_DEV_PKG is not
>> set we assume the builder is only interested in the GP boards, so fake
>> generating the HS SYSFW images. These will be non-functional on HS
>> boards, but they would have been just as non-functional if built
>> without TI_SECURE_DEV_PKG set.
> 
> 
> Have you tested what happens if they do not have it set and build the "dummy" files, and then realize their mistake, set the variable and build again?  Do the files then build correctly, or does the sstate cache prevent them from getting the correct thing without clearing the cache and rebuilding everything?
> 
> 

Yes, changing the value of the TI_SECURE_DEV_PKG causes all packages that use
it to get rebuilt. I was surprised bitbake was smart enough to do that but seems
like it is.

Andrew

Re: [meta-ti][dunfell][PATCH 1/2] ti-sci-fw: Allow build to continue without TI_SECURE_DEV_PKG set

[Ryan Eatmon]

On 8/10/2022 11:00, Andrew Davis wrote:
> On 8/10/22 10:58 AM, Ryan Eatmon wrote:
>>
>>
>> On 8/10/2022 9:47, Andrew Davis wrote:
>>> If we do not have TI_SECURE_DEV_PKG set then SYSFW generation will fail
>>> if we are building for the HS platform. When TI_SECURE_DEV_PKG is not
>>> set we assume the builder is only interested in the GP boards, so fake
>>> generating the HS SYSFW images. These will be non-functional on HS
>>> boards, but they would have been just as non-functional if built
>>> without TI_SECURE_DEV_PKG set.
>>
>>
>> Have you tested what happens if they do not have it set and build the 
>> "dummy" files, and then realize their mistake, set the variable and 
>> build again?  Do the files then build correctly, or does the sstate 
>> cache prevent them from getting the correct thing without clearing the 
>> cache and rebuilding everything?
>>
>>
> 
> Yes, changing the value of the TI_SECURE_DEV_PKG causes all packages 
> that use
> it to get rebuilt. I was surprised bitbake was smart enough to do that 
> but seems
> like it is.

Nice!


-- 
Ryan Eatmon                reatmon@ti.com
-----------------------------------------
Texas Instruments, Inc.  -  LCPD  -  MGTS

Re: [meta-ti][dunfell][PATCH 2/2] conf: machine: am64xx-evm: Make HS-SE the default

[Denys Dmytriyenko]

On Wed, Aug 10, 2022 at 09:47:08AM -0500, Andrew Davis via lists.yoctoproject.org wrote:
> The HS-SE AM64xx machine can now be run on GP devices and built without
> needing the TI_SECURE_DEV_PKG for the same. AM64xx will only be available
> in the HS-FS type going forward. Make the HS-SE the default and remove
> the original GP machine.

Why create another multiconfig? Can all this be done in regular -k3r5?


> Signed-off-by: Andrew Davis <afd@ti.com>
> ---
>  ...m-k3r5-gp.conf => am64xx-evm-k3r5-gp.conf} |  6 ++++-
>  conf/machine/am64xx-evm-k3r5-hs-se.conf       | 14 +++++++++++
>  conf/machine/am64xx-evm-k3r5.conf             | 11 --------
>  conf/machine/am64xx-evm.conf                  |  6 +++++
>  conf/machine/am64xx-hs-evm-k3r5.conf          | 12 ---------
>  conf/machine/am64xx-hs-evm.conf               | 25 -------------------
>  conf/machine/include/am64xx.inc               |  5 ++--
>  conf/multiconfig/k3r5-hs-se.conf              |  3 +++
>  .../trusted-firmware-a_%.bbappend             |  2 +-
>  recipes-security/optee/optee-os_%.bbappend    |  2 +-
>  10 files changed, 33 insertions(+), 53 deletions(-)
>  rename conf/machine/{am64xx-hs-evm-k3r5-gp.conf => am64xx-evm-k3r5-gp.conf} (78%)
>  create mode 100644 conf/machine/am64xx-evm-k3r5-hs-se.conf
>  delete mode 100644 conf/machine/am64xx-evm-k3r5.conf
>  delete mode 100644 conf/machine/am64xx-hs-evm-k3r5.conf
>  delete mode 100644 conf/machine/am64xx-hs-evm.conf
>  create mode 100644 conf/multiconfig/k3r5-hs-se.conf
> 
> diff --git a/conf/machine/am64xx-hs-evm-k3r5-gp.conf b/conf/machine/am64xx-evm-k3r5-gp.conf
> similarity index 78%
> rename from conf/machine/am64xx-hs-evm-k3r5-gp.conf
> rename to conf/machine/am64xx-evm-k3r5-gp.conf
> index b255dca8..c599ee47 100644
> --- a/conf/machine/am64xx-hs-evm-k3r5-gp.conf
> +++ b/conf/machine/am64xx-evm-k3r5-gp.conf
> @@ -4,12 +4,16 @@
>  
>  # Booting GP requires different SYSFW, the rest is handled at runtime
>  
> -require conf/machine/am64xx-hs-evm-k3r5.conf
> +require conf/machine/include/k3r5.inc
>  SOC_FAMILY_append = ":k3r5-gp"
>  
> +SYSFW_SOC = "am64x"
> +SYSFW_CONFIG = "evm"
>  SYSFW_SUFFIX = "gp"
>  SYSFW_TIBOOT3_SYMLINK = ""
>  
> +UBOOT_MACHINE = "am64x_evm_r5_defconfig"
> +
>  SPL_BINARY = ""
>  UBOOT_BINARY = "u-boot-spl.${UBOOT_SUFFIX}"
>  UBOOT_IMAGE = "u-boot-r5spl-gp-${MAINMACHINE}-${PV}-${PR}.${UBOOT_SUFFIX}"
> diff --git a/conf/machine/am64xx-evm-k3r5-hs-se.conf b/conf/machine/am64xx-evm-k3r5-hs-se.conf
> new file mode 100644
> index 00000000..7cab7d15
> --- /dev/null
> +++ b/conf/machine/am64xx-evm-k3r5-hs-se.conf
> @@ -0,0 +1,14 @@
> +#@TYPE: Machine
> +#@NAME: AM64xx HS-SE EVM (R5F)
> +#@DESCRIPTION: Machine configuration for the TI AM64xx HS-SE EVM (R5F core)
> +
> +# Booting HS-SE requires different SYSFW, the rest is handled at runtime
> +
> +require conf/machine/include/k3r5.inc
> +SOC_FAMILY_append = ":k3r5-hs-se"
> +
> +SYSFW_SOC = "am64x"
> +SYSFW_CONFIG = "evm"
> +SYSFW_SUFFIX = "hs"
> +
> +UBOOT_MACHINE = "am64x_evm_r5_defconfig"
> diff --git a/conf/machine/am64xx-evm-k3r5.conf b/conf/machine/am64xx-evm-k3r5.conf
> deleted file mode 100644
> index afd36b72..00000000
> --- a/conf/machine/am64xx-evm-k3r5.conf
> +++ /dev/null
> @@ -1,11 +0,0 @@
> -#@TYPE: Machine
> -#@NAME: AM64xx EVM (R5F)
> -#@DESCRIPTION: Machine configuration for the TI AM64xx EVM (R5F core)
> -
> -require conf/machine/include/k3r5.inc
> -
> -SYSFW_SOC = "am64x"
> -SYSFW_CONFIG = "evm"
> -SYSFW_SUFFIX = "gp"
> -
> -UBOOT_MACHINE = "am64x_evm_r5_defconfig"
> diff --git a/conf/machine/am64xx-evm.conf b/conf/machine/am64xx-evm.conf
> index 2cb7f55a..d6efdf52 100644
> --- a/conf/machine/am64xx-evm.conf
> +++ b/conf/machine/am64xx-evm.conf
> @@ -9,3 +9,9 @@ UBOOT_MACHINE = "am64x_evm_a53_defconfig"
>  SPL_BINARY = "tispl.bin_HS"
>  UBOOT_BINARY = "u-boot.img_HS"
>  UBOOT_SYMLINK = "u-boot.img"
> +
> +# Since default tiboot3.bin on AM64x is for HS-SE, add a version for GP
> +BBMULTICONFIG += "k3r5-gp"
> +IMAGE_BOOT_FILES += " tiboot3-am64x-gp-evm.bin"
> +do_image_wic[mcdepends] += "mc::k3r5-gp:ti-sci-fw:do_deploy"
> +do_image_tar[mcdepends] += "mc::k3r5-gp:ti-sci-fw:do_deploy"
> diff --git a/conf/machine/am64xx-hs-evm-k3r5.conf b/conf/machine/am64xx-hs-evm-k3r5.conf
> deleted file mode 100644
> index 95e68751..00000000
> --- a/conf/machine/am64xx-hs-evm-k3r5.conf
> +++ /dev/null
> @@ -1,12 +0,0 @@
> -#@TYPE: Machine
> -#@NAME: AM64xx HS EVM (R5F)
> -#@DESCRIPTION: Machine configuration for the TI AM64xx HS EVM (R5F core)
> -
> -require conf/machine/include/k3r5.inc
> -
> -SYSFW_SOC = "am64x"
> -SYSFW_CONFIG = "evm"
> -SYSFW_SUFFIX = "hs"
> -SYSFW_SYMLINK = ""
> -
> -UBOOT_MACHINE = "am64x_evm_r5_defconfig"
> diff --git a/conf/machine/am64xx-hs-evm.conf b/conf/machine/am64xx-hs-evm.conf
> deleted file mode 100644
> index 1149d4c7..00000000
> --- a/conf/machine/am64xx-hs-evm.conf
> +++ /dev/null
> @@ -1,25 +0,0 @@
> -#@TYPE: Machine
> -#@NAME: AM64xx HS EVM
> -#@DESCRIPTION: Machine configuration for the TI AM64xx HS EVM
> -
> -require conf/machine/include/am64xx.inc
> -
> -UBOOT_MACHINE = "am64x_evm_a53_defconfig"
> -
> -UBOOT_ENTRYPOINT =       "0x80080000"
> -UBOOT_LOADADDRESS =      "0x80080000"
> -UBOOT_RD_LOADADDRESS =   "0x84000000"
> -UBOOT_RD_ENTRYPOINT =    "0x84000000"
> -UBOOT_DTB_LOADADDRESS =  "0x83000000"
> -UBOOT_DTBO_LOADADDRESS = "0x83080000"
> -UBOOT_DTBO_OFFSET =      "0x00010000"
> -
> -SPL_BINARY = "tispl.bin_HS"
> -UBOOT_BINARY = "u-boot.img_HS"
> -UBOOT_SYMLINK = "u-boot.img"
> -
> -# Since default tiboot3.bin on AM64x is for HS, add a version for GP
> -BBMULTICONFIG += "k3r5-gp"
> -IMAGE_BOOT_FILES += " tiboot3-am64x-gp-evm.bin"
> -do_image_wic[mcdepends] += "mc::k3r5-gp:ti-sci-fw:do_deploy"
> -do_image_tar[mcdepends] += "mc::k3r5-gp:ti-sci-fw:do_deploy"
> diff --git a/conf/machine/include/am64xx.inc b/conf/machine/include/am64xx.inc
> index 930fba08..becc79d4 100644
> --- a/conf/machine/include/am64xx.inc
> +++ b/conf/machine/include/am64xx.inc
> @@ -14,8 +14,9 @@ KERNEL_DEVICETREE = " \
>      ti/k3-am642-evm-nand.dtbo \
>  "
>  
> -do_image_wic[mcdepends] = "mc::k3r5:ti-sci-fw:do_deploy"
> -do_image_tar[mcdepends] = "mc::k3r5:ti-sci-fw:do_deploy"
> +BBMULTICONFIG = "k3r5-hs-se"
> +do_image_wic[mcdepends] = "mc::k3r5-hs-se:ti-sci-fw:do_deploy"
> +do_image_tar[mcdepends] = "mc::k3r5-hs-se:ti-sci-fw:do_deploy"
>  
>  TFA_BOARD = "lite"
>  OPTEEMACHINE = "k3-am64x"
> diff --git a/conf/multiconfig/k3r5-hs-se.conf b/conf/multiconfig/k3r5-hs-se.conf
> new file mode 100644
> index 00000000..701f8e88
> --- /dev/null
> +++ b/conf/multiconfig/k3r5-hs-se.conf
> @@ -0,0 +1,3 @@
> +require k3r5.conf
> +
> +MACHINE_append = "-hs-se"
> diff --git a/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend b/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend
> index 965c99d4..dff244d2 100644
> --- a/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend
> +++ b/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend
> @@ -27,7 +27,7 @@ do_compile_append_am65xx-hs-evm() {
>  	tfa_sign_k3hs
>  }
>  
> -do_compile_append_am64xx-hs-evm() {
> +do_compile_append_am64xx-evm() {
>  	tfa_sign_k3hs
>  }
>  
> diff --git a/recipes-security/optee/optee-os_%.bbappend b/recipes-security/optee/optee-os_%.bbappend
> index 5a25bd99..8a429bbc 100644
> --- a/recipes-security/optee/optee-os_%.bbappend
> +++ b/recipes-security/optee/optee-os_%.bbappend
> @@ -66,7 +66,7 @@ do_compile_append_am65xx-hs-evm() {
>      optee_sign_k3hs
>  }
>  
> -do_compile_append_am64xx-hs-evm() {
> +do_compile_append_am64xx-evm() {
>      optee_sign_k3hs
>  }
>  
> -- 
> 2.36.1
> 

Re: [meta-ti][dunfell][PATCH 1/2] ti-sci-fw: Allow build to continue without TI_SECURE_DEV_PKG set

[Andrew Davis]

Denys, Ryan,

I'm not really happy with this patch to be honest. Nor with how we handle
TI_SECURE_DEV_PKG in general.

So a little history (Denys correct me if my memory has faded any here). We
use TI_SECURE_DEV_PKG for legacy platforms as the SECDEV tools are NDA-only,
so they *had* to be feed into the SDK from an external location. This
carried over to the K3 machines.

But with K3 we don't have this NDA-only restriction. The K3 TI_SECURE_DEV_PKG
tools are fully open source and publicly available on git.ti.com. Now that
we are bringing HS to the board market with AM64x, it is time we fix things.

My idea is to treat TI_SECURE_DEV_PKG like the other toolchains. If we define
it in our environment then we use that version. If it is not defined then we
fetch it for the user. I've got a simple recipe to build a tik3secdev-native
package, and am working to use that everywhere we use TI_SECURE_DEV_PKG in
recipes today. Then we can use preferred providers to pick which SECDEV
to use, the legacy ones, or the K3 one.

The legacy tisecdev-native will require TI_SECURE_DEV_PKG_CAT/AUTO set
as required today, but the tik3secdev-native will download it for you
if not set.

So my questions are, does this sound like a reasonable approach, and if so
do you have any guidance on this? This will require me to dig down into
the deeper parts of the build system and I've not done that before. Any
pointers welcome.

I'm also thinking on making a dummy secdev package, that just copies
the images instead of signing them. That should be the default preferred
provider for the non-HS machines, then we can drop the various checks we
have based -hs-evm vs -evm. All machines take the same path, then based
on the secdev package provider they do the right thing.

Thanks,
Andrew

On 8/10/22 9:47 AM, Andrew Davis wrote:
> If we do not have TI_SECURE_DEV_PKG set then SYSFW generation will fail
> if we are building for the HS platform. When TI_SECURE_DEV_PKG is not
> set we assume the builder is only interested in the GP boards, so fake
> generating the HS SYSFW images. These will be non-functional on HS
> boards, but they would have been just as non-functional if built
> without TI_SECURE_DEV_PKG set.
> 
> Signed-off-by: Andrew Davis <afd@ti.com>
> ---
>   recipes-bsp/ti-sci-fw/ti-sci-fw_git.bb | 5 +++++
>   1 file changed, 5 insertions(+)
> 
> diff --git a/recipes-bsp/ti-sci-fw/ti-sci-fw_git.bb b/recipes-bsp/ti-sci-fw/ti-sci-fw_git.bb
> index 18652dd4..287e5a40 100644
> --- a/recipes-bsp/ti-sci-fw/ti-sci-fw_git.bb
> +++ b/recipes-bsp/ti-sci-fw/ti-sci-fw_git.bb
> @@ -66,6 +66,11 @@ EXTRA_OEMAKE_remove_j7-hs-evm-k3r5 = " SBL="${STAGING_DIR_HOST}/boot/u-boot-spl.
>   EXTRA_OEMAKE_remove_j7-hs-evm-k3r5-sr1-1 = " SBL="${STAGING_DIR_HOST}/boot/u-boot-spl.bin""
>   
>   do_compile() {
> +	if [ ! "${SYSFW_SUFFIX}" = "gp" ] && [ ! -f ${TI_SECURE_DEV_PKG}/scripts/secure-binary-image.sh ]; then
> +		echo "Warning: TI_SECURE_DEV_PKG not set, skipping HS SYSFW generation."
> +		touch ${WORKDIR}/imggen/${SYSFW_TIBOOT3}
> +		exit 0
> +	fi
>   	cd ${WORKDIR}/imggen/
>   	oe_runmake
>   }

Re: [meta-ti][dunfell][PATCH 2/2] conf: machine: am64xx-evm: Make HS-SE the default

[Andrew Davis]

On 8/10/22 11:11 AM, Denys Dmytriyenko wrote:
> On Wed, Aug 10, 2022 at 09:47:08AM -0500, Andrew Davis via lists.yoctoproject.org wrote:
>> The HS-SE AM64xx machine can now be run on GP devices and built without
>> needing the TI_SECURE_DEV_PKG for the same. AM64xx will only be available
>> in the HS-FS type going forward. Make the HS-SE the default and remove
>> the original GP machine.
> 
> Why create another multiconfig? Can all this be done in regular -k3r5?
> 

Two reasons, first it is more clear what config builds for what. Eventually
the GP can be compleatly dropped, and we will have a single SYSFW bin
for both HS-FS and HS-SE, but until then we will have 3 different tiboot3.bin
files.

Then it gets worse, AM64x has a PG2.0 that we will support in my next patchset.
So in the end, yes we will only have one supported config, but during the
transision we will have 5(!):

conf/machine/am64xx-evm-k3r5-gp.conf
conf/machine/am64xx-evm-k3r5-hs-fs.conf
conf/machine/am64xx-evm-k3r5-hs-se.conf
conf/machine/am64xx-evm-k3r5-sr2-hs-fs.conf
conf/machine/am64xx-evm-k3r5-sr2-hs-se.conf

So wanting to make the names clear from the start.

Andrew

> 
>> Signed-off-by: Andrew Davis <afd@ti.com>
>> ---
>>   ...m-k3r5-gp.conf => am64xx-evm-k3r5-gp.conf} |  6 ++++-
>>   conf/machine/am64xx-evm-k3r5-hs-se.conf       | 14 +++++++++++
>>   conf/machine/am64xx-evm-k3r5.conf             | 11 --------
>>   conf/machine/am64xx-evm.conf                  |  6 +++++
>>   conf/machine/am64xx-hs-evm-k3r5.conf          | 12 ---------
>>   conf/machine/am64xx-hs-evm.conf               | 25 -------------------
>>   conf/machine/include/am64xx.inc               |  5 ++--
>>   conf/multiconfig/k3r5-hs-se.conf              |  3 +++
>>   .../trusted-firmware-a_%.bbappend             |  2 +-
>>   recipes-security/optee/optee-os_%.bbappend    |  2 +-
>>   10 files changed, 33 insertions(+), 53 deletions(-)
>>   rename conf/machine/{am64xx-hs-evm-k3r5-gp.conf => am64xx-evm-k3r5-gp.conf} (78%)
>>   create mode 100644 conf/machine/am64xx-evm-k3r5-hs-se.conf
>>   delete mode 100644 conf/machine/am64xx-evm-k3r5.conf
>>   delete mode 100644 conf/machine/am64xx-hs-evm-k3r5.conf
>>   delete mode 100644 conf/machine/am64xx-hs-evm.conf
>>   create mode 100644 conf/multiconfig/k3r5-hs-se.conf
>>
>> diff --git a/conf/machine/am64xx-hs-evm-k3r5-gp.conf b/conf/machine/am64xx-evm-k3r5-gp.conf
>> similarity index 78%
>> rename from conf/machine/am64xx-hs-evm-k3r5-gp.conf
>> rename to conf/machine/am64xx-evm-k3r5-gp.conf
>> index b255dca8..c599ee47 100644
>> --- a/conf/machine/am64xx-hs-evm-k3r5-gp.conf
>> +++ b/conf/machine/am64xx-evm-k3r5-gp.conf
>> @@ -4,12 +4,16 @@
>>   
>>   # Booting GP requires different SYSFW, the rest is handled at runtime
>>   
>> -require conf/machine/am64xx-hs-evm-k3r5.conf
>> +require conf/machine/include/k3r5.inc
>>   SOC_FAMILY_append = ":k3r5-gp"
>>   
>> +SYSFW_SOC = "am64x"
>> +SYSFW_CONFIG = "evm"
>>   SYSFW_SUFFIX = "gp"
>>   SYSFW_TIBOOT3_SYMLINK = ""
>>   
>> +UBOOT_MACHINE = "am64x_evm_r5_defconfig"
>> +
>>   SPL_BINARY = ""
>>   UBOOT_BINARY = "u-boot-spl.${UBOOT_SUFFIX}"
>>   UBOOT_IMAGE = "u-boot-r5spl-gp-${MAINMACHINE}-${PV}-${PR}.${UBOOT_SUFFIX}"
>> diff --git a/conf/machine/am64xx-evm-k3r5-hs-se.conf b/conf/machine/am64xx-evm-k3r5-hs-se.conf
>> new file mode 100644
>> index 00000000..7cab7d15
>> --- /dev/null
>> +++ b/conf/machine/am64xx-evm-k3r5-hs-se.conf
>> @@ -0,0 +1,14 @@
>> +#@TYPE: Machine
>> +#@NAME: AM64xx HS-SE EVM (R5F)
>> +#@DESCRIPTION: Machine configuration for the TI AM64xx HS-SE EVM (R5F core)
>> +
>> +# Booting HS-SE requires different SYSFW, the rest is handled at runtime
>> +
>> +require conf/machine/include/k3r5.inc
>> +SOC_FAMILY_append = ":k3r5-hs-se"
>> +
>> +SYSFW_SOC = "am64x"
>> +SYSFW_CONFIG = "evm"
>> +SYSFW_SUFFIX = "hs"
>> +
>> +UBOOT_MACHINE = "am64x_evm_r5_defconfig"
>> diff --git a/conf/machine/am64xx-evm-k3r5.conf b/conf/machine/am64xx-evm-k3r5.conf
>> deleted file mode 100644
>> index afd36b72..00000000
>> --- a/conf/machine/am64xx-evm-k3r5.conf
>> +++ /dev/null
>> @@ -1,11 +0,0 @@
>> -#@TYPE: Machine
>> -#@NAME: AM64xx EVM (R5F)
>> -#@DESCRIPTION: Machine configuration for the TI AM64xx EVM (R5F core)
>> -
>> -require conf/machine/include/k3r5.inc
>> -
>> -SYSFW_SOC = "am64x"
>> -SYSFW_CONFIG = "evm"
>> -SYSFW_SUFFIX = "gp"
>> -
>> -UBOOT_MACHINE = "am64x_evm_r5_defconfig"
>> diff --git a/conf/machine/am64xx-evm.conf b/conf/machine/am64xx-evm.conf
>> index 2cb7f55a..d6efdf52 100644
>> --- a/conf/machine/am64xx-evm.conf
>> +++ b/conf/machine/am64xx-evm.conf
>> @@ -9,3 +9,9 @@ UBOOT_MACHINE = "am64x_evm_a53_defconfig"
>>   SPL_BINARY = "tispl.bin_HS"
>>   UBOOT_BINARY = "u-boot.img_HS"
>>   UBOOT_SYMLINK = "u-boot.img"
>> +
>> +# Since default tiboot3.bin on AM64x is for HS-SE, add a version for GP
>> +BBMULTICONFIG += "k3r5-gp"
>> +IMAGE_BOOT_FILES += " tiboot3-am64x-gp-evm.bin"
>> +do_image_wic[mcdepends] += "mc::k3r5-gp:ti-sci-fw:do_deploy"
>> +do_image_tar[mcdepends] += "mc::k3r5-gp:ti-sci-fw:do_deploy"
>> diff --git a/conf/machine/am64xx-hs-evm-k3r5.conf b/conf/machine/am64xx-hs-evm-k3r5.conf
>> deleted file mode 100644
>> index 95e68751..00000000
>> --- a/conf/machine/am64xx-hs-evm-k3r5.conf
>> +++ /dev/null
>> @@ -1,12 +0,0 @@
>> -#@TYPE: Machine
>> -#@NAME: AM64xx HS EVM (R5F)
>> -#@DESCRIPTION: Machine configuration for the TI AM64xx HS EVM (R5F core)
>> -
>> -require conf/machine/include/k3r5.inc
>> -
>> -SYSFW_SOC = "am64x"
>> -SYSFW_CONFIG = "evm"
>> -SYSFW_SUFFIX = "hs"
>> -SYSFW_SYMLINK = ""
>> -
>> -UBOOT_MACHINE = "am64x_evm_r5_defconfig"
>> diff --git a/conf/machine/am64xx-hs-evm.conf b/conf/machine/am64xx-hs-evm.conf
>> deleted file mode 100644
>> index 1149d4c7..00000000
>> --- a/conf/machine/am64xx-hs-evm.conf
>> +++ /dev/null
>> @@ -1,25 +0,0 @@
>> -#@TYPE: Machine
>> -#@NAME: AM64xx HS EVM
>> -#@DESCRIPTION: Machine configuration for the TI AM64xx HS EVM
>> -
>> -require conf/machine/include/am64xx.inc
>> -
>> -UBOOT_MACHINE = "am64x_evm_a53_defconfig"
>> -
>> -UBOOT_ENTRYPOINT =       "0x80080000"
>> -UBOOT_LOADADDRESS =      "0x80080000"
>> -UBOOT_RD_LOADADDRESS =   "0x84000000"
>> -UBOOT_RD_ENTRYPOINT =    "0x84000000"
>> -UBOOT_DTB_LOADADDRESS =  "0x83000000"
>> -UBOOT_DTBO_LOADADDRESS = "0x83080000"
>> -UBOOT_DTBO_OFFSET =      "0x00010000"
>> -
>> -SPL_BINARY = "tispl.bin_HS"
>> -UBOOT_BINARY = "u-boot.img_HS"
>> -UBOOT_SYMLINK = "u-boot.img"
>> -
>> -# Since default tiboot3.bin on AM64x is for HS, add a version for GP
>> -BBMULTICONFIG += "k3r5-gp"
>> -IMAGE_BOOT_FILES += " tiboot3-am64x-gp-evm.bin"
>> -do_image_wic[mcdepends] += "mc::k3r5-gp:ti-sci-fw:do_deploy"
>> -do_image_tar[mcdepends] += "mc::k3r5-gp:ti-sci-fw:do_deploy"
>> diff --git a/conf/machine/include/am64xx.inc b/conf/machine/include/am64xx.inc
>> index 930fba08..becc79d4 100644
>> --- a/conf/machine/include/am64xx.inc
>> +++ b/conf/machine/include/am64xx.inc
>> @@ -14,8 +14,9 @@ KERNEL_DEVICETREE = " \
>>       ti/k3-am642-evm-nand.dtbo \
>>   "
>>   
>> -do_image_wic[mcdepends] = "mc::k3r5:ti-sci-fw:do_deploy"
>> -do_image_tar[mcdepends] = "mc::k3r5:ti-sci-fw:do_deploy"
>> +BBMULTICONFIG = "k3r5-hs-se"
>> +do_image_wic[mcdepends] = "mc::k3r5-hs-se:ti-sci-fw:do_deploy"
>> +do_image_tar[mcdepends] = "mc::k3r5-hs-se:ti-sci-fw:do_deploy"
>>   
>>   TFA_BOARD = "lite"
>>   OPTEEMACHINE = "k3-am64x"
>> diff --git a/conf/multiconfig/k3r5-hs-se.conf b/conf/multiconfig/k3r5-hs-se.conf
>> new file mode 100644
>> index 00000000..701f8e88
>> --- /dev/null
>> +++ b/conf/multiconfig/k3r5-hs-se.conf
>> @@ -0,0 +1,3 @@
>> +require k3r5.conf
>> +
>> +MACHINE_append = "-hs-se"
>> diff --git a/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend b/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend
>> index 965c99d4..dff244d2 100644
>> --- a/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend
>> +++ b/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend
>> @@ -27,7 +27,7 @@ do_compile_append_am65xx-hs-evm() {
>>   	tfa_sign_k3hs
>>   }
>>   
>> -do_compile_append_am64xx-hs-evm() {
>> +do_compile_append_am64xx-evm() {
>>   	tfa_sign_k3hs
>>   }
>>   
>> diff --git a/recipes-security/optee/optee-os_%.bbappend b/recipes-security/optee/optee-os_%.bbappend
>> index 5a25bd99..8a429bbc 100644
>> --- a/recipes-security/optee/optee-os_%.bbappend
>> +++ b/recipes-security/optee/optee-os_%.bbappend
>> @@ -66,7 +66,7 @@ do_compile_append_am65xx-hs-evm() {
>>       optee_sign_k3hs
>>   }
>>   
>> -do_compile_append_am64xx-hs-evm() {
>> +do_compile_append_am64xx-evm() {
>>       optee_sign_k3hs
>>   }
>>   
>> -- 
>> 2.36.1
>>

Re: [meta-ti][dunfell][PATCH 1/2] ti-sci-fw: Allow build to continue without TI_SECURE_DEV_PKG set

[Andrew Davis]

On 8/10/22 11:25 AM, Andrew Davis wrote:
> Denys, Ryan,
> 
> I'm not really happy with this patch to be honest. Nor with how we handle
> TI_SECURE_DEV_PKG in general.
> 
> So a little history (Denys correct me if my memory has faded any here). We
> use TI_SECURE_DEV_PKG for legacy platforms as the SECDEV tools are NDA-only,
> so they *had* to be feed into the SDK from an external location. This
> carried over to the K3 machines.
> 
> But with K3 we don't have this NDA-only restriction. The K3 TI_SECURE_DEV_PKG
> tools are fully open source and publicly available on git.ti.com. Now that
> we are bringing HS to the board market with AM64x, it is time we fix things.
> 
> My idea is to treat TI_SECURE_DEV_PKG like the other toolchains. If we define
> it in our environment then we use that version. If it is not defined then we
> fetch it for the user. I've got a simple recipe to build a tik3secdev-native
> package, and am working to use that everywhere we use TI_SECURE_DEV_PKG in
> recipes today. Then we can use preferred providers to pick which SECDEV
> to use, the legacy ones, or the K3 one.
> 
> The legacy tisecdev-native will require TI_SECURE_DEV_PKG_CAT/AUTO set
> as required today, but the tik3secdev-native will download it for you
> if not set.
> 
> So my questions are, does this sound like a reasonable approach, and if so
> do you have any guidance on this? This will require me to dig down into
> the deeper parts of the build system and I've not done that before. Any
> pointers welcome.
> 
> I'm also thinking on making a dummy secdev package, that just copies
> the images instead of signing them. That should be the default preferred
> provider for the non-HS machines, then we can drop the various checks we
> have based -hs-evm vs -evm. All machines take the same path, then based
> on the secdev package provider they do the right thing.
> 
> Thanks,
> Andrew
> 

Okay, gave this a quick attempt, see

https://lore.kernel.org/yocto-meta-ti/20220812014128.1185-1-afd@ti.com/

and for its use

https://lore.kernel.org/yocto-meta-ti/20220812014128.1185-2-afd@ti.com/

If we like it, we can start to add for the non-K3 machines and drop
a bunch of machine specific checks. Move them all to a single preferred
provider set in the top level machine configs, instead of out in the
recipes.

Andrew

> On 8/10/22 9:47 AM, Andrew Davis wrote:
>> If we do not have TI_SECURE_DEV_PKG set then SYSFW generation will fail
>> if we are building for the HS platform. When TI_SECURE_DEV_PKG is not
>> set we assume the builder is only interested in the GP boards, so fake
>> generating the HS SYSFW images. These will be non-functional on HS
>> boards, but they would have been just as non-functional if built
>> without TI_SECURE_DEV_PKG set.
>>
>> Signed-off-by: Andrew Davis <afd@ti.com>
>> ---
>>   recipes-bsp/ti-sci-fw/ti-sci-fw_git.bb | 5 +++++
>>   1 file changed, 5 insertions(+)
>>
>> diff --git a/recipes-bsp/ti-sci-fw/ti-sci-fw_git.bb b/recipes-bsp/ti-sci-fw/ti-sci-fw_git.bb
>> index 18652dd4..287e5a40 100644
>> --- a/recipes-bsp/ti-sci-fw/ti-sci-fw_git.bb
>> +++ b/recipes-bsp/ti-sci-fw/ti-sci-fw_git.bb
>> @@ -66,6 +66,11 @@ EXTRA_OEMAKE_remove_j7-hs-evm-k3r5 = " SBL="${STAGING_DIR_HOST}/boot/u-boot-spl.
>>   EXTRA_OEMAKE_remove_j7-hs-evm-k3r5-sr1-1 = " SBL="${STAGING_DIR_HOST}/boot/u-boot-spl.bin""
>>   do_compile() {
>> +    if [ ! "${SYSFW_SUFFIX}" = "gp" ] && [ ! -f ${TI_SECURE_DEV_PKG}/scripts/secure-binary-image.sh ]; then
>> +        echo "Warning: TI_SECURE_DEV_PKG not set, skipping HS SYSFW generation."
>> +        touch ${WORKDIR}/imggen/${SYSFW_TIBOOT3}
>> +        exit 0
>> +    fi
>>       cd ${WORKDIR}/imggen/
>>       oe_runmake
>>   }