uboot FIT signature difference

uboot FIT signature difference

[Frank Wunderlich]

Hi,

i try to create a upstream uboot binary for use with rockchip rk3568 (bananapi r2 pro). Currently i'm on preparation phase as i don't have the hardware yet (so i cannot test it).

First thanks to everybody upstreamed support for this SOC in uboot and linux.

i found a compiled uboot.img with this signature:

FIT Image with ATF/OP-TEE/U-Boot

my created itb (make u-boot.itb) has this signature:

FIT image for U-Boot with bl31 (TF-A)

can anybody give me a hint how to create same signature as above? or where i have to look...

i guess the uboot.img is created using this source:
https://github.com/rockchip-linux/u-boot

as far as i see the itb gets generated from the dtb

  OBJCOPY u-boot-nodtb.bin
./"arch/arm/mach-rockchip/make_fit_atf.py" \
arch/arm/dts/rk3568-evb.dtb > u-boot.its
  RELOC   u-boot-nodtb.bin
  MKIMAGE u-boot.itb

op-tee seems to be a lib only in rockchip repo, not upstream

https://github.com/rockchip-linux/u-boot/tree/next-dev/lib/optee_clientApi

seems to be some kind of secure boot, idk if this is needed to boot the device

i wonder why uboot differentiate between ATF and BL31...imho BL31 is part of ATF, do i need all parts of ATF (at least BL2) to get same signature? i have some rk3568_ddr_xxxxMHz_v1.08.bin which can be BL2 (did not found any signature and Rockchip ATF source is afaik not yet released, at least not for rk35xx which is new).

"my" source is this:

https://github.com/frank-w/u-boot/tree/2021-10-bpi-r2-pro

regards Frank

Re: uboot FIT signature difference

[Simon Glass]

Hi Frank,

On Sun, 10 Oct 2021 at 11:51, Frank Wunderlich <frank-w@public-files.de> wrote:
>
> Hi,
>
> i try to create a upstream uboot binary for use with rockchip rk3568 (bananapi r2 pro). Currently i'm on preparation phase as i don't have the hardware yet (so i cannot test it).
>
> First thanks to everybody upstreamed support for this SOC in uboot and linux.
>
> i found a compiled uboot.img with this signature:
>
> FIT Image with ATF/OP-TEE/U-Boot
>
> my created itb (make u-boot.itb) has this signature:
>
> FIT image for U-Boot with bl31 (TF-A)
>
> can anybody give me a hint how to create same signature as above? or where i have to look...

As far as I know this is just the description, which you can change by
updating the 'description' of your .its file, or binman node if you
are using that.

>
> i guess the uboot.img is created using this source:
> https://github.com/rockchip-linux/u-boot
>
> as far as i see the itb gets generated from the dtb
>
>   OBJCOPY u-boot-nodtb.bin
> ./"arch/arm/mach-rockchip/make_fit_atf.py" \
> arch/arm/dts/rk3568-evb.dtb > u-boot.its
>   RELOC   u-boot-nodtb.bin
>   MKIMAGE u-boot.itb
>
> op-tee seems to be a lib only in rockchip repo, not upstream
>
> https://github.com/rockchip-linux/u-boot/tree/next-dev/lib/optee_clientApi
>
> seems to be some kind of secure boot, idk if this is needed to boot the device
>
> i wonder why uboot differentiate between ATF and BL31...imho BL31 is part of ATF, do i need all parts of ATF (at least BL2) to get same signature? i have some rk3568_ddr_xxxxMHz_v1.08.bin which can be BL2 (did not found any signature and Rockchip ATF source is afaik not yet released, at least not for rk35xx which is new).
>
> "my" source is this:
>
> https://github.com/frank-w/u-boot/tree/2021-10-bpi-r2-pro

I'm not sure about all these flows. It is all quite complicated these days...

Regards,
Simon

Aw: Re: uboot FIT signature difference

[Frank Wunderlich]

> Gesendet: Sonntag, 24. Oktober 2021 um 21:53 Uhr
> Von: "Simon Glass" <sjg@chromium.org>
> An: "Frank Wunderlich" <frank-w@public-files.de>
> Cc: "Philipp Tomsich" <philipp.tomsich@vrull.eu>, "Kever Yang" <kever.yang@rock-chips.com>, "U-Boot Mailing List" <u-boot@lists.denx.de>
> Betreff: Re: uboot FIT signature difference
>
> Hi Frank,
>
> On Sun, 10 Oct 2021 at 11:51, Frank Wunderlich <frank-w@public-files.de> wrote:
> >
> > Hi,
> >
> > i try to create a upstream uboot binary for use with rockchip rk3568 (bananapi r2 pro). Currently i'm on preparation phase as i don't have the hardware yet (so i cannot test it).
> >
> > First thanks to everybody upstreamed support for this SOC in uboot and linux.
> >
> > i found a compiled uboot.img with this signature:
> >
> > FIT Image with ATF/OP-TEE/U-Boot
> >
> > my created itb (make u-boot.itb) has this signature:
> >
> > FIT image for U-Boot with bl31 (TF-A)
> >
> > can anybody give me a hint how to create same signature as above? or where i have to look...
>
> As far as I know this is just the description, which you can change by
> updating the 'description' of your .its file, or binman node if you
> are using that.

Hi,

i found the signature of my binary here:

https://github.com/frank-w/u-boot/blob/2020-10-bpi/arch/arm/mach-rockchip/make_fit_atf.py#L25

string on the possible source of the other binary differs...maybe it is somehow changed

compile-progress seems to be this:

https://gitlab.com/pgwipeout/quartz64_ci/-/blob/main/.gitlab-ci.yml#L58

so it looks like this python-script is used:

https://gitlab.com/pgwipeout/u-boot-rockchip/-/blob/quartz64/arch/arm/mach-rockchip/make_fit_atf.py

but still different...anyway thanks for looking into it

Regards Frank

> > i guess the uboot.img is created using this source:
> > https://github.com/rockchip-linux/u-boot
> >
> > as far as i see the itb gets generated from the dtb
> >
> >   OBJCOPY u-boot-nodtb.bin
> > ./"arch/arm/mach-rockchip/make_fit_atf.py" \
> > arch/arm/dts/rk3568-evb.dtb > u-boot.its
> >   RELOC   u-boot-nodtb.bin
> >   MKIMAGE u-boot.itb
> >
> > op-tee seems to be a lib only in rockchip repo, not upstream
> >
> > https://github.com/rockchip-linux/u-boot/tree/next-dev/lib/optee_clientApi
> >
> > seems to be some kind of secure boot, idk if this is needed to boot the device
> >
> > i wonder why uboot differentiate between ATF and BL31...imho BL31 is part of ATF, do i need all parts of ATF (at least BL2) to get same signature? i have some rk3568_ddr_xxxxMHz_v1.08.bin which can be BL2 (did not found any signature and Rockchip ATF source is afaik not yet released, at least not for rk35xx which is new).
> >
> > "my" source is this:
> >
> > https://github.com/frank-w/u-boot/tree/2021-10-bpi-r2-pro
>
> I'm not sure about all these flows. It is all quite complicated these days...

no worry, i try my binary on the board if i get it ;)

> Regards,
> Simon