add support for TI's AM64x and AM62x boards

The TI K3 R5 loader package essentially is a wrapper to build a special version of U-boot SPL used as part of a multi-stage boot flow on TI K3 devices, and as such needs full flexibility as to specifying the U-Boot sources used for the build. To accomodate this, add the same options as already available in the regular U-Boot package. For most use cases, the same source settings (repo URL, versions, etc.) should be used for both ti-k3-r5-loader and uboot packages.

Signed-off-by Andreas Dannenberg <[email protected]>

---
 boot/ti-k3-r5-loader/Config.in          | 65 +++++++++++++++++++++++--
 boot/ti-k3-r5-loader/ti-k3-r5-loader.mk | 28 ++++++++++-
 2 files changed, 89 insertions(+), 4 deletions(-)

boot/ti-k3-r5-loader/Config.in +62 -3

index 10602c8df3..2419babe70 100644
@@ -1,14 +1,73 @@
 config BR2_TARGET_TI_K3_R5_LOADER
-       bool "ti-k3-r5-loader"
+       bool "TI K3 R5 Loader"
        depends on BR2_aarch64
        help
-         Separate U-Boot build for R5 cores on TI's k3 boards.
+         Separate U-Boot SPL build for R5 core on TI's K3 processors.
          Usually used to build tiboot3.bin with k3-image-gen.
 
 if BR2_TARGET_TI_K3_R5_LOADER
 
 choice
-       prompt "Configuration"
+       prompt "U-Boot Version"
+       help
+         Select the specific U-Boot version you want to use to build the
+         initial SPL running on the R5 core. Note that for most use cases
+         you'd want to use the exact same configuration here as it is used
+         to build the main U-Boot package.
+
+config BR2_TARGET_TI_K3_R5_LOADER_LATEST_VERSION
+       bool "2022.10"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION
+       bool "Custom version"
+       help
+         This option allows to use a specific official versions
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL
+       bool "Custom tarball"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_GIT
+       bool "Custom Git repository"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_HG
+       bool "Custom Mercurial repository"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_SVN
+       bool "Custom Subversion repository"
+
+endchoice
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION_VALUE
+       string "U-Boot version"
+       depends on BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL_LOCATION
+       string "URL of custom U-Boot tarball"
+       depends on BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL
+
+if BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_GIT || BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_HG || BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_SVN
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_URL
+       string "URL of custom repository"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_VERSION
+       string "Custom repository version"
+       help
+         Revision to use in the typical format used by
+         Git/Mercurial/Subversion E.G. a sha id, a tag, branch, ..
+
+endif
+
+config BR2_TARGET_TI_K3_R5_LOADER_VERSION
+       string
+       default "2022.10"       if BR2_TARGET_TI_K3_R5_LOADER_LATEST_VERSION
+       default BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION_VALUE \
+               if BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION
+       default "custom"        if BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL
+       default BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_VERSION \
+               if BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_GIT || BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_HG || BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_SVN
+choice
+       prompt "U-Boot Configuration"
        default BR2_TARGET_TI_K3_R5_LOADER_USE_DEFCONFIG
 
 config BR2_TARGET_TI_K3_R5_LOADER_USE_DEFCONFIG

boot/ti-k3-r5-loader/ti-k3-r5-loader.mk +7 -1

index afa309aa98..fe403a5c44 100644
@@ -2,11 +2,37 @@
 #
 # ti-k3-r5-loader
 #
+# The ti-k3-r5 loader package should really be built from the same U-Boot
+# sources as the uboot package itself, so for most users so all LOADER_SITE /
+# LOADER_SOURCE type definitions should be set the same for both packages.
+# However it still makes sense to keep the ti-k3-r5-loader package somewhat
+# separated and independent from the uboot package to allow for special use
+# cases such as Falcon boot (which would skip the uboot package completely).
+#
 ################################################################################
 
-TI_K3_R5_LOADER_VERSION = 2022.10

boot/ti-k3-r5-loader/ti-k3-r5-loader.mk +10 -1

+else ifeq ($(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_HG),y)
+TI_K3_R5_LOADER_SITE = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_URL))
+TI_K3_R5_LOADER_SITE_METHOD = hg
+else ifeq ($(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_SVN),y)
+TI_K3_R5_LOADER_SITE = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_URL))
+TI_K3_R5_LOADER_SITE_METHOD = svn
+else
+# Handle stable official U-Boot versions
 TI_K3_R5_LOADER_SITE = https://ftp.denx.de/pub/u-boot
 TI_K3_R5_LOADER_SOURCE = u-boot-$(TI_K3_R5_LOADER_VERSION).tar.bz2
+endif
+
 TI_K3_R5_LOADER_LICENSE = GPL-2.0+
 TI_K3_R5_LOADER_LICENSE_FILES = Licenses/gpl-2.0.txt
 TI_K3_R5_LOADER_CPE_ID_VENDOR = denx
--

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Quoted 114 lines · Andreas Dannenberg via buildroot

The TI K3 R5 loader package essentially is a wrapper to build a special version of U-boot SPL used as part of a multi-stage boot flow on TI K3 devices, and as such needs full flexibility as to specifying the U-Boot sources used for the build. To accomodate this, add the same options as already available in the regular U-Boot package. For most use cases, the same source settings (repo URL, versions, etc.) should be used for both ti-k3-r5-loader and uboot packages.

Signed-off-by Andreas Dannenberg <[email protected]>

---
 boot/ti-k3-r5-loader/Config.in          | 65 +++++++++++++++++++++++--
 boot/ti-k3-r5-loader/ti-k3-r5-loader.mk | 28 ++++++++++-
 2 files changed, 89 insertions(+), 4 deletions(-)

boot/ti-k3-r5-loader/Config.in +62 -3

index 10602c8df3..2419babe70 100644
@@ -1,14 +1,73 @@
 config BR2_TARGET_TI_K3_R5_LOADER
-       bool "ti-k3-r5-loader"
+       bool "TI K3 R5 Loader"
        depends on BR2_aarch64
        help
-         Separate U-Boot build for R5 cores on TI's k3 boards.
+         Separate U-Boot SPL build for R5 core on TI's K3 processors.
          Usually used to build tiboot3.bin with k3-image-gen.
 
 if BR2_TARGET_TI_K3_R5_LOADER
 
 choice
-       prompt "Configuration"
+       prompt "U-Boot Version"
+       help
+         Select the specific U-Boot version you want to use to build the
+         initial SPL running on the R5 core. Note that for most use cases
+         you'd want to use the exact same configuration here as it is used
+         to build the main U-Boot package.
+
+config BR2_TARGET_TI_K3_R5_LOADER_LATEST_VERSION
+       bool "2022.10"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION
+       bool "Custom version"
+       help
+         This option allows to use a specific official versions
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL
+       bool "Custom tarball"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_GIT
+       bool "Custom Git repository"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_HG
+       bool "Custom Mercurial repository"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_SVN
+       bool "Custom Subversion repository"
+
+endchoice
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION_VALUE
+       string "U-Boot version"
+       depends on BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL_LOCATION
+       string "URL of custom U-Boot tarball"
+       depends on BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL
+
+if BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_GIT || BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_HG || BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_SVN
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_URL
+       string "URL of custom repository"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_VERSION
+       string "Custom repository version"
+       help
+         Revision to use in the typical format used by
+         Git/Mercurial/Subversion E.G. a sha id, a tag, branch, ..
+
+endif
+
+config BR2_TARGET_TI_K3_R5_LOADER_VERSION
+       string
+       default "2022.10"       if BR2_TARGET_TI_K3_R5_LOADER_LATEST_VERSION
+       default BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION_VALUE \
+               if BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION
+       default "custom"        if BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL
+       default BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_VERSION \
+               if BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_GIT || BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_HG || BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_SVN
+choice
+       prompt "U-Boot Configuration"
        default BR2_TARGET_TI_K3_R5_LOADER_USE_DEFCONFIG
 
 config BR2_TARGET_TI_K3_R5_LOADER_USE_DEFCONFIG

boot/ti-k3-r5-loader/ti-k3-r5-loader.mk +7 -1

index afa309aa98..fe403a5c44 100644
@@ -2,11 +2,37 @@
 #
 # ti-k3-r5-loader
 #
+# The ti-k3-r5 loader package should really be built from the same U-Boot
+# sources as the uboot package itself, so for most users so all LOADER_SITE /
+# LOADER_SOURCE type definitions should be set the same for both packages.
+# However it still makes sense to keep the ti-k3-r5-loader package somewhat
+# separated and independent from the uboot package to allow for special use
+# cases such as Falcon boot (which would skip the uboot package completely).
+#
 ################################################################################
 
-TI_K3_R5_LOADER_VERSION = 2022.10

boot/ti-k3-r5-loader/ti-k3-r5-loader.mk line 23

Quoted 10 lines

boot/ti-k3-r5-loader/ti-k3-r5-loader.mk +10 -0

+TI_K3_R5_LOADER_VERSION = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_VERSION))
+
+ifeq ($(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL),y)
+# Handle custom U-Boot tarballs as specified by the configuration
+TI_K3_R5_LOADER_TARBALL = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL_LOCATION))
+TI_K3_R5_LOADER_SITE = $(patsubst %/,%,$(dir $(TI_K3_R5_LOADER_TARBALL)))
+TI_K3_R5_LOADER_SOURCE = $(notdir $(TI_K3_R5_LOADER_TARBALL))
+else ifeq ($(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_GIT),y)
+TI_K3_R5_LOADER_SITE = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_URL))
+TI_K3_R5_LOADER_SITE_METHOD = git

I think this may also need:
BR_NO_CHECK_HASH_FOR += $(TI_K3_R5_LOADER_SOURCE)
in the git case, otherwise buildroot will look for a hash for the archive generated from the git version.

I'm not a buildroot expert, so there may be a better way to do this.

Quoted 18 lines

boot/ti-k3-r5-loader/ti-k3-r5-loader.mk +10 -1

+else ifeq ($(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_HG),y)
+TI_K3_R5_LOADER_SITE = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_URL))
+TI_K3_R5_LOADER_SITE_METHOD = hg
+else ifeq ($(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_SVN),y)
+TI_K3_R5_LOADER_SITE = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_URL))
+TI_K3_R5_LOADER_SITE_METHOD = svn
+else
+# Handle stable official U-Boot versions
 TI_K3_R5_LOADER_SITE = https://ftp.denx.de/pub/u-boot
 TI_K3_R5_LOADER_SOURCE = u-boot-$(TI_K3_R5_LOADER_VERSION).tar.bz2
+endif
+
 TI_K3_R5_LOADER_LICENSE = GPL-2.0+
 TI_K3_R5_LOADER_LICENSE_FILES = Licenses/gpl-2.0.txt
 TI_K3_R5_LOADER_CPE_ID_VENDOR = denx
--

2.34.1

Quoted 4 lines

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Hi Patrick,

Quoted 132 lines · Patrick Oppenlander

Quoted 114 lines · Andreas Dannenberg via buildroot

The TI K3 R5 loader package essentially is a wrapper to build a special version of U-boot SPL used as part of a multi-stage boot flow on TI K3 devices, and as such needs full flexibility as to specifying the U-Boot sources used for the build. To accomodate this, add the same options as already available in the regular U-Boot package. For most use cases, the same source settings (repo URL, versions, etc.) should be used for both ti-k3-r5-loader and uboot packages.

Signed-off-by Andreas Dannenberg <[email protected]>

---
 boot/ti-k3-r5-loader/Config.in          | 65 +++++++++++++++++++++++--
 boot/ti-k3-r5-loader/ti-k3-r5-loader.mk | 28 ++++++++++-
 2 files changed, 89 insertions(+), 4 deletions(-)

boot/ti-k3-r5-loader/Config.in +62 -3

index 10602c8df3..2419babe70 100644
@@ -1,14 +1,73 @@
 config BR2_TARGET_TI_K3_R5_LOADER
-       bool "ti-k3-r5-loader"
+       bool "TI K3 R5 Loader"
        depends on BR2_aarch64
        help
-         Separate U-Boot build for R5 cores on TI's k3 boards.
+         Separate U-Boot SPL build for R5 core on TI's K3 processors.
          Usually used to build tiboot3.bin with k3-image-gen.
 
 if BR2_TARGET_TI_K3_R5_LOADER
 
 choice
-       prompt "Configuration"
+       prompt "U-Boot Version"
+       help
+         Select the specific U-Boot version you want to use to build the
+         initial SPL running on the R5 core. Note that for most use cases
+         you'd want to use the exact same configuration here as it is used
+         to build the main U-Boot package.
+
+config BR2_TARGET_TI_K3_R5_LOADER_LATEST_VERSION
+       bool "2022.10"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION
+       bool "Custom version"
+       help
+         This option allows to use a specific official versions
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL
+       bool "Custom tarball"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_GIT
+       bool "Custom Git repository"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_HG
+       bool "Custom Mercurial repository"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_SVN
+       bool "Custom Subversion repository"
+
+endchoice
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION_VALUE
+       string "U-Boot version"
+       depends on BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL_LOCATION
+       string "URL of custom U-Boot tarball"
+       depends on BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL
+
+if BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_GIT || BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_HG || BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_SVN
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_URL
+       string "URL of custom repository"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_VERSION
+       string "Custom repository version"
+       help
+         Revision to use in the typical format used by
+         Git/Mercurial/Subversion E.G. a sha id, a tag, branch, ..
+
+endif
+
+config BR2_TARGET_TI_K3_R5_LOADER_VERSION
+       string
+       default "2022.10"       if BR2_TARGET_TI_K3_R5_LOADER_LATEST_VERSION
+       default BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION_VALUE \
+               if BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION
+       default "custom"        if BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL
+       default BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_VERSION \
+               if BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_GIT || BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_HG || BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_SVN
+choice
+       prompt "U-Boot Configuration"
        default BR2_TARGET_TI_K3_R5_LOADER_USE_DEFCONFIG
 
 config BR2_TARGET_TI_K3_R5_LOADER_USE_DEFCONFIG

boot/ti-k3-r5-loader/ti-k3-r5-loader.mk +7 -1

index afa309aa98..fe403a5c44 100644
@@ -2,11 +2,37 @@
 #
 # ti-k3-r5-loader
 #
+# The ti-k3-r5 loader package should really be built from the same U-Boot
+# sources as the uboot package itself, so for most users so all LOADER_SITE /
+# LOADER_SOURCE type definitions should be set the same for both packages.
+# However it still makes sense to keep the ti-k3-r5-loader package somewhat
+# separated and independent from the uboot package to allow for special use
+# cases such as Falcon boot (which would skip the uboot package completely).
+#
 ################################################################################
 
-TI_K3_R5_LOADER_VERSION = 2022.10

boot/ti-k3-r5-loader/ti-k3-r5-loader.mk line 23

Quoted 10 lines

boot/ti-k3-r5-loader/ti-k3-r5-loader.mk +10 -0

+TI_K3_R5_LOADER_VERSION = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_VERSION))
+
+ifeq ($(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL),y)
+# Handle custom U-Boot tarballs as specified by the configuration
+TI_K3_R5_LOADER_TARBALL = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL_LOCATION))
+TI_K3_R5_LOADER_SITE = $(patsubst %/,%,$(dir $(TI_K3_R5_LOADER_TARBALL)))
+TI_K3_R5_LOADER_SOURCE = $(notdir $(TI_K3_R5_LOADER_TARBALL))
+else ifeq ($(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_GIT),y)
+TI_K3_R5_LOADER_SITE = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_URL))
+TI_K3_R5_LOADER_SITE_METHOD = git

I think this may also need:
BR_NO_CHECK_HASH_FOR += $(TI_K3_R5_LOADER_SOURCE)
in the git case, otherwise buildroot will look for a hash for the archive generated from the git version.

Quoted 1 line

I'm not a buildroot expert, so there may be a better way to do this.

Honestly I just "borrowed" this section from the boot/uboot package, as ti-k3-r5-loader is actually largely the same thing to 95%. But looking at it closer you are probably right, it looks like it'd need that in case of BR2_TARGET_TI_K3_R5_LOADER_LATEST_VERSION, which is the ti-k3-r5-loader equivalent of BR2_TARGET_UBOOT_LATEST_VERSION, as per

https://git.busybox.net/buildroot/tree/boot/uboot/uboot.mk#n43

Regards, Andreas

Quoted 18 lines

Quoted 18 lines

boot/ti-k3-r5-loader/ti-k3-r5-loader.mk +10 -1

+else ifeq ($(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_HG),y)
+TI_K3_R5_LOADER_SITE = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_URL))
+TI_K3_R5_LOADER_SITE_METHOD = hg
+else ifeq ($(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_SVN),y)
+TI_K3_R5_LOADER_SITE = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_URL))
+TI_K3_R5_LOADER_SITE_METHOD = svn
+else
+# Handle stable official U-Boot versions
 TI_K3_R5_LOADER_SITE = https://ftp.denx.de/pub/u-boot
 TI_K3_R5_LOADER_SOURCE = u-boot-$(TI_K3_R5_LOADER_VERSION).tar.bz2
+endif
+
 TI_K3_R5_LOADER_LICENSE = GPL-2.0+
 TI_K3_R5_LOADER_LICENSE_FILES = Licenses/gpl-2.0.txt
 TI_K3_R5_LOADER_CPE_ID_VENDOR = denx
--

2.34.1

Quoted 4 lines

Quoted 4 lines

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Hi Patrick,

Quoted 137 lines · Andreas Dannenberg via buildroot

Hi Patrick,

Quoted 132 lines · Patrick Oppenlander

Quoted 114 lines · Andreas Dannenberg via buildroot

The TI K3 R5 loader package essentially is a wrapper to build a special version of U-boot SPL used as part of a multi-stage boot flow on TI K3 devices, and as such needs full flexibility as to specifying the U-Boot sources used for the build. To accomodate this, add the same options as already available in the regular U-Boot package. For most use cases, the same source settings (repo URL, versions, etc.) should be used for both ti-k3-r5-loader and uboot packages.

Signed-off-by Andreas Dannenberg <[email protected]>

---
 boot/ti-k3-r5-loader/Config.in          | 65 +++++++++++++++++++++++--
 boot/ti-k3-r5-loader/ti-k3-r5-loader.mk | 28 ++++++++++-
 2 files changed, 89 insertions(+), 4 deletions(-)

boot/ti-k3-r5-loader/Config.in +62 -3

index 10602c8df3..2419babe70 100644
@@ -1,14 +1,73 @@
 config BR2_TARGET_TI_K3_R5_LOADER
-       bool "ti-k3-r5-loader"
+       bool "TI K3 R5 Loader"
        depends on BR2_aarch64
        help
-         Separate U-Boot build for R5 cores on TI's k3 boards.
+         Separate U-Boot SPL build for R5 core on TI's K3 processors.
          Usually used to build tiboot3.bin with k3-image-gen.
 
 if BR2_TARGET_TI_K3_R5_LOADER
 
 choice
-       prompt "Configuration"
+       prompt "U-Boot Version"
+       help
+         Select the specific U-Boot version you want to use to build the
+         initial SPL running on the R5 core. Note that for most use cases
+         you'd want to use the exact same configuration here as it is used
+         to build the main U-Boot package.
+
+config BR2_TARGET_TI_K3_R5_LOADER_LATEST_VERSION
+       bool "2022.10"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION
+       bool "Custom version"
+       help
+         This option allows to use a specific official versions
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL
+       bool "Custom tarball"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_GIT
+       bool "Custom Git repository"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_HG
+       bool "Custom Mercurial repository"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_SVN
+       bool "Custom Subversion repository"
+
+endchoice
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION_VALUE
+       string "U-Boot version"
+       depends on BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL_LOCATION
+       string "URL of custom U-Boot tarball"
+       depends on BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL
+
+if BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_GIT || BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_HG || BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_SVN
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_URL
+       string "URL of custom repository"
+
+config BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_VERSION
+       string "Custom repository version"
+       help
+         Revision to use in the typical format used by
+         Git/Mercurial/Subversion E.G. a sha id, a tag, branch, ..
+
+endif
+
+config BR2_TARGET_TI_K3_R5_LOADER_VERSION
+       string
+       default "2022.10"       if BR2_TARGET_TI_K3_R5_LOADER_LATEST_VERSION
+       default BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION_VALUE \
+               if BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_VERSION
+       default "custom"        if BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL
+       default BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_VERSION \
+               if BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_GIT || BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_HG || BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_SVN
+choice
+       prompt "U-Boot Configuration"
        default BR2_TARGET_TI_K3_R5_LOADER_USE_DEFCONFIG
 
 config BR2_TARGET_TI_K3_R5_LOADER_USE_DEFCONFIG

boot/ti-k3-r5-loader/ti-k3-r5-loader.mk +7 -1

index afa309aa98..fe403a5c44 100644
@@ -2,11 +2,37 @@
 #
 # ti-k3-r5-loader
 #
+# The ti-k3-r5 loader package should really be built from the same U-Boot
+# sources as the uboot package itself, so for most users so all LOADER_SITE /
+# LOADER_SOURCE type definitions should be set the same for both packages.
+# However it still makes sense to keep the ti-k3-r5-loader package somewhat
+# separated and independent from the uboot package to allow for special use
+# cases such as Falcon boot (which would skip the uboot package completely).
+#
 ################################################################################
 
-TI_K3_R5_LOADER_VERSION = 2022.10

boot/ti-k3-r5-loader/ti-k3-r5-loader.mk line 23

Quoted 10 lines

boot/ti-k3-r5-loader/ti-k3-r5-loader.mk +10 -0

+TI_K3_R5_LOADER_VERSION = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_VERSION))
+
+ifeq ($(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL),y)
+# Handle custom U-Boot tarballs as specified by the configuration
+TI_K3_R5_LOADER_TARBALL = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL_LOCATION))
+TI_K3_R5_LOADER_SITE = $(patsubst %/,%,$(dir $(TI_K3_R5_LOADER_TARBALL)))
+TI_K3_R5_LOADER_SOURCE = $(notdir $(TI_K3_R5_LOADER_TARBALL))
+else ifeq ($(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_GIT),y)
+TI_K3_R5_LOADER_SITE = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_URL))
+TI_K3_R5_LOADER_SITE_METHOD = git

I think this may also need:
BR_NO_CHECK_HASH_FOR += $(TI_K3_R5_LOADER_SOURCE)
in the git case, otherwise buildroot will look for a hash for the archive generated from the git version.

Quoted 1 line

I'm not a buildroot expert, so there may be a better way to do this.

Quoted 7 lines

Honestly I just "borrowed" this section from the boot/uboot package, as ti-k3-r5-loader is actually largely the same thing to 95%. But looking at it closer you are probably right, it looks like it'd need that in case of BR2_TARGET_TI_K3_R5_LOADER_LATEST_VERSION, which is the ti-k3-r5-loader equivalent of BR2_TARGET_UBOOT_LATEST_VERSION, as per

https://git.busybox.net/buildroot/tree/boot/uboot/uboot.mk#n43

I looked at this closer and debugged some more, and yes the change needed here is adding a construct similar to how it is in the current U-Boot (and Kernel, ATF, and other) packages already...

(quoted diff) +3 -0

+ifeq ($(BR2_TARGET_TI_K3_R5_LOADER)$(BR2_TARGET_TI_K3_R5_LOADER_LATEST_VERSION),y)
+BR_NO_CHECK_HASH_FOR += $(TI_K3_R5_LOADER_SOURCE)
+endif

...which is to disable hash checks only for the *_LATEST_VERSION (in addition to the other SCM-related source methods explicitly defined in package/pkg-generic.mk).

--
Andreas Dannenberg
Texas Instruments Inc

Quoted 29 lines

Regards, Andreas

Quoted 18 lines

Quoted 18 lines

boot/ti-k3-r5-loader/ti-k3-r5-loader.mk +10 -1

+else ifeq ($(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_HG),y)
+TI_K3_R5_LOADER_SITE = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_URL))
+TI_K3_R5_LOADER_SITE_METHOD = hg
+else ifeq ($(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_SVN),y)
+TI_K3_R5_LOADER_SITE = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_URL))
+TI_K3_R5_LOADER_SITE_METHOD = svn
+else
+# Handle stable official U-Boot versions
 TI_K3_R5_LOADER_SITE = https://ftp.denx.de/pub/u-boot
 TI_K3_R5_LOADER_SOURCE = u-boot-$(TI_K3_R5_LOADER_VERSION).tar.bz2
+endif
+
 TI_K3_R5_LOADER_LICENSE = GPL-2.0+
 TI_K3_R5_LOADER_LICENSE_FILES = Licenses/gpl-2.0.txt
 TI_K3_R5_LOADER_CPE_ID_VENDOR = denx
--

2.34.1

Quoted 4 lines

Quoted 4 lines

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

The TI K3 R5 loader package essentially is a wrapper to build a special version of U-boot SPL used as part of a multi-stage boot flow on TI K3 devices, and as such needs full flexibility as to specifying the U-Boot sources used for the build. To accomodate this, add the same options as already available in the regular U-Boot package. For most use cases, the same source settings (repo URL, versions, etc.) should be used for both ti-k3-r5-loader and uboot packages.

Signed-off-by Andreas Dannenberg <[email protected]>

boot/ti-k3-r5-loader/ti-k3-r5-loader.mk +0 -0

index afa309aa98..fe403a5c44 100644

boot/ti-k3-r5-loader/ti-k3-r5-loader.mk +12 -1

+#
 ################################################################################
 
-TI_K3_R5_LOADER_VERSION = 2022.10
+TI_K3_R5_LOADER_VERSION = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_VERSION))
+
+ifeq ($(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL),y)
+# Handle custom U-Boot tarballs as specified by the configuration
+TI_K3_R5_LOADER_TARBALL = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL_LOCATION))
+TI_K3_R5_LOADER_SITE = $(patsubst %/,%,$(dir $(TI_K3_R5_LOADER_TARBALL)))
+TI_K3_R5_LOADER_SOURCE = $(notdir $(TI_K3_R5_LOADER_TARBALL))
+else ifeq ($(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_GIT),y)
+TI_K3_R5_LOADER_SITE = $(call qstrip,$(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_REPO_URL))
+TI_K3_R5_LOADER_SITE_METHOD = git
+else ifeq ($(BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_HG),y)

From: Xuanhao Shi <[email protected]>

This is the image generator that builds the initial boot binary, tiboot3.bin, for the R5 core on TI's K3 family of devices. This requires the R5 SPL output from the ti-k3-r5-loader package.

https://git.ti.com/cgit/k3-image-gen/k3-image-gen

Signed-off-by Xuanhao Shi <[email protected]>

Signed-off-by Anand Gadiyar <[email protected]>

Signed-off-by Andreas Dannenberg <[email protected]>

Reviewed-by Giulio Benetti <[email protected]>

Acked-by Andrew Davis <[email protected]>

Tested-by Bryan Brattlof <[email protected]>

Cc Romain Naour <[email protected]>

Reviewed-by Francois Perrad <[email protected]>

Reviewed-by Julien Olivain <[email protected]>

boot/ti-k3-image-gen/Config.in new file +34 -0

+if BR2_TARGET_TI_K3_IMAGE_GEN
+choice
+	prompt "SoC firmware type for image gen"
+	default BR2_TARGET_TI_K3_IMAGE_GEN_FW_TYPE_TIFS
+
+config BR2_TARGET_TI_K3_IMAGE_GEN_FW_TYPE_TIFS
+	bool "Firmware type TIFS"
+	help
+	  Use firmware type TIFS for SoCs like AM62x and
+	  AM62Ax.
+
+config BR2_TARGET_TI_K3_IMAGE_GEN_FW_TYPE_TISCI
+	bool "Firmware type TISCI"
+	help
+	  Use firmware type TISCI for SoCs like AM64x and
+	  AM65x.
+
+endchoice
+
+config BR2_TARGET_TI_K3_IMAGE_GEN_SOC
+	string "SoC"
+	help
+	  The target SoC option for image gen.
+	  For example, "am64x" for AM64x boards.
+
+config BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE
+	string "security type"
+	help
+	  The target SoC security type option for image gen.
+	  Valid options are "gp" for General Purpose devices,
+	  "hs-fs" for High Security - Field Securable devices, or
+	  "hs" for High Security - Security Enforcing devices.
+	  Note for all High Security device variants the
+	  TI_SECURE_DEV_PKG environmental variable must be defined

boot/ti-k3-image-gen/ti-k3-image-gen.hash new file +13 -0

new file mode 100644
index 0000000000..6fb8c4c1eb
@@ -0,0 +1,23 @@
+# Locally calculated
+sha256  f89ea4b1f5c992455b1a682fde48359221b53f3294135df4bf20feea6aea90e4  k3-image-gen-08.06.00.007.tar.gz
+sha256  f012e8d000d711d0539e5b4c812fc1d3a59c10fc1e3d6ea155556f5b78286845  LICENSE
+
+sha256  eca3d0dca65ceabdf17c7efa6b0eb651d365c6056730aa1c67700b7fea2e8bd2  ti-fs-firmware-am62x-gp.bin
+sha256  9ed6089ca7d59e9e5919b0da92effe788138edef41682e0bf7eaea25a896a4f1  ti-fs-firmware-am62x-hs-cert.bin
+sha256  655b5ded62b63f26c17b3ae2f23ac3565ae91fbd7fba1b7b0a4cb7807467523b  ti-fs-firmware-am62x-hs-enc.bin
+sha256  5efa229acd122685fa928170a3f2e39597cce0231fca10b03d9b4d519db2259f  ti-fs-firmware-am62x-hs-fs-cert.bin
+sha256  0f49da5e616a95dc8573531799d20fa7697a000f88084d09f3f6f5a665d85680  ti-fs-firmware-am62x-hs-fs-enc.bin
+
+sha256  c5c91d005b228a926fdc518f1e4365d2f693248a63f2432fccfbde10e5717499  ti-fs-firmware-am62ax-gp.bin
+sha256  6de6d6a249217b15dd78dfb2b0ca99bda95aa15b7e4867a2cbe0d5a169422522  ti-fs-firmware-am62ax-hs-cert.bin
+sha256  b1b3b25409013174fa5969b5bfaa572c0a79eee9e8b7445b3ac7867646eaf402  ti-fs-firmware-am62ax-hs-enc.bin

boot/ti-k3-image-gen/ti-k3-image-gen.mk new file +6 -0

new file mode 100644
index 0000000000..cdeac13cfa
@@ -0,0 +1,71 @@
+################################################################################
+#
+# ti-k3-image-gen
+#
+################################################################################
+

boot/ti-k3-image-gen/ti-k3-image-gen.mk new file +7 -0

+
+# The ti-k3-image-gen makefiles seem to need some feature from Make v4.0,
+# similar to u-boot. Explicitly use $(BR2_MAKE) here, as the build
+# otherwise fails with some misleading error message.
+TI_K3_IMAGE_GEN_MAKE = $(BR2_MAKE)
+TI_K3_IMAGE_GEN_MAKE_OPTS = \
+	SOC=$(TI_K3_IMAGE_GEN_SOC) \

Hello Andreas,

Quoted 8 lines · On Thu, 15 Jun 2023 19:23:51 -0500 Andreas Dannenberg via buildroot…

From: Xuanhao Shi <[email protected]>

This is the image generator that builds the initial boot binary, tiboot3.bin, for the R5 core on TI's K3 family of devices. This requires the R5 SPL output from the ti-k3-r5-loader package.

https://git.ti.com/cgit/k3-image-gen/k3-image-gen

Quoted 9 lines

Signed-off-by Xuanhao Shi <[email protected]>

Signed-off-by Anand Gadiyar <[email protected]>

Signed-off-by Andreas Dannenberg <[email protected]>

Reviewed-by Giulio Benetti <[email protected]>

Acked-by Andrew Davis <[email protected]>

Tested-by Bryan Brattlof <[email protected]>

Cc Romain Naour <[email protected]>

Reviewed-by Francois Perrad <[email protected]>

Reviewed-by Julien Olivain <[email protected]>

I have applied this, but after doing a lot of changes.

The first major change is that I have created a boot/ti-k3-boot-firmware/ package that is responsible for downloading the ti-sysfw and ti-dm firmware files, and installing them in $(BINARIES_DIR). Indeed your solution of downloading them directly from ti-k3-image-gen (for ti-sysfw) and from uboot (for ti-dm) really wasn't very clean, and it didn't allow to associate those firmware files to their license, which is quite important considering they are closed-source binary blobs.

In boot/ti-k3-boot-firmware/, I hesitated a long time between downloading only the firmware files themselves directly, or downloading the whole repository. In the end, I opted for downloading the whole repository. Indeed, the firmware files themselves don't have a version number in their file name, so once they land in the download directory, we cannot have multiple versions of the firmware files sitting side by side. Yes, the hash would detect that a firmware file is no longer correct and needs to be re-downloaded. But if you alternate between Buildroot versions that use different firmware versions, it would constantly get an invalid and redownload, which I found not very nice. So, this package download the monster 200+ MB .tar.gz, only to extra a few hundreds of KBs of firmware files.

boot/ti-k3-image-gen/Config.in line 3

Quoted 9 lines

boot/ti-k3-image-gen/Config.in new file +3 -0

new file mode 100644
index 0000000000..97cb470119
@@ -0,0 +1,55 @@
+config BR2_TARGET_TI_K3_IMAGE_GEN
+	bool "ti-k3-image-gen"
+	depends on BR2_TARGET_TI_K3_R5_LOADER

Changed to:

(quoted diff) +6 -0

+       depends on BR2_TARGET_TI_K3_R5_LOADER
+       select BR2_TARGET_TI_K3_BOOT_FIRMWARE
+       # We need FIT support in uboot-tools, which is why we select a
+       # host package
+       select BR2_PACKAGE_HOST_UBOOT_TOOLS
+       select BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT

boot/ti-k3-image-gen/Config.in line 8

Quoted 6 lines

boot/ti-k3-image-gen/Config.in new file +5 -0

+	help
+	  Use TI's k3-image-gen to build a separate bare metal
+	  boot binary from a separate SPL that is running on
+	  the R5 core. Currently supports version 08.06.00.007
+	  as default.

Remove the reference to the version. We don't want to update the Config.in help text when we update the package version.

Quoted 34 lines

boot/ti-k3-image-gen/Config.in new file +34 -0

+if BR2_TARGET_TI_K3_IMAGE_GEN
+choice
+	prompt "SoC firmware type for image gen"
+	default BR2_TARGET_TI_K3_IMAGE_GEN_FW_TYPE_TIFS
+
+config BR2_TARGET_TI_K3_IMAGE_GEN_FW_TYPE_TIFS
+	bool "Firmware type TIFS"
+	help
+	  Use firmware type TIFS for SoCs like AM62x and
+	  AM62Ax.
+
+config BR2_TARGET_TI_K3_IMAGE_GEN_FW_TYPE_TISCI
+	bool "Firmware type TISCI"
+	help
+	  Use firmware type TISCI for SoCs like AM64x and
+	  AM65x.
+
+endchoice
+
+config BR2_TARGET_TI_K3_IMAGE_GEN_SOC
+	string "SoC"
+	help
+	  The target SoC option for image gen.
+	  For example, "am64x" for AM64x boards.
+
+config BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE
+	string "security type"
+	help
+	  The target SoC security type option for image gen.
+	  Valid options are "gp" for General Purpose devices,
+	  "hs-fs" for High Security - Field Securable devices, or
+	  "hs" for High Security - Security Enforcing devices.
+	  Note for all High Security device variants the
+	  TI_SECURE_DEV_PKG environmental variable must be defined

boot/ti-k3-image-gen/Config.in line 55

Quoted 10 lines

boot/ti-k3-image-gen/Config.in new file +10 -0

+	  at build time pointing to a valid core-secdev-k3 folder
+	  location, otherwise the build will fail, see
+	  https://git.ti.com/cgit/security-development-tools/core-secdev-k3
+
+config BR2_TARGET_TI_K3_IMAGE_GEN_CONFIG
+	string "config type"
+	help
+	  The board config option for image gen.
+	  Usually "sk" or "evm".
+endif

I've changed this whole thing to use choices for the SoC and security type. For the "config type", it was always "evm" for now, and the firmware files only exist for "evm", so I dropped this option and simply hardcoded "evm" in the package. It can always be revisited later on. So it looks like this:

(quoted diff) +5 -0

+if BR2_TARGET_TI_K3_IMAGE_GEN
+choice
+       prompt "SoC family"
+
+config BR2_TARGET_TI_K3_IMAGE_GEN_SOC_AM62AX

boot/ti-k3-image-gen/Config.in new file +3 -0

+
+endchoice
+

Quoted 8 lines

boot/ti-k3-image-gen/Config.in new file +7 -0

+
+# The ti-k3-image-gen makefiles seem to need some feature from Make v4.0,
+# similar to u-boot. Explicitly use $(BR2_MAKE) here, as the build
+# otherwise fails with some misleading error message.
+TI_K3_IMAGE_GEN_MAKE = $(BR2_MAKE)
+TI_K3_IMAGE_GEN_MAKE_OPTS = \
+	SOC=$(TI_K3_IMAGE_GEN_SOC) \

boot/ti-k3-image-gen/Config.in

Quoted 10 lines

boot/ti-k3-image-gen/Config.in new file +10 -0

+	SOC_TYPE=$(TI_K3_IMAGE_GEN_SOC_TYPE) \
+	CONFIG=$(TI_K3_IMAGE_GEN_CONFIG) \
+	CROSS_COMPILE=$(HOST_DIR)/bin/arm-none-eabi- \
+	SBL=$(BINARIES_DIR)/r5-u-boot-spl.bin \
+	O=$(@D)/tmp \
+	BIN_DIR=$(@D)
+
+define TI_K3_IMAGE_GEN_BUILD_CMDS
+	$(TI_K3_IMAGE_GEN_MAKE) -C $(@D) $(TI_K3_IMAGE_GEN_MAKE_OPTS)
+endef

The intermediate variables were not really useful, so changed to:

boot/ti-k3-image-gen/ti-k3-image-gen.mk new file +3 -0

+               O=$(@D)/tmp \
+               BIN_DIR=$(@D)
+endef

The $(TARGET_MAKE_ENV) was also important as it allowed the build logic to find our host tools in $(HOST_DIR)/bin, especially python3, mkimage and openssl.

See the final commits of:

- ti-k3-boot-firmware:

   https://gitlab.com/buildroot.org/buildroot/-/commit/2389c76a95725b91ba538b56fb7da70877c7d3ad

- ti-k3-image-gen:

   https://gitlab.com/buildroot.org/buildroot/-/commit/6134872d2878f46f8f2800c81baf917281bc79b0

Best regards,

Thomas

Hello,

Le 22/08/2023 à 12:29, Thomas Petazzoni via buildroot a écrit :

Quoted 23 lines

Hello Andreas,

Quoted 8 lines · On Thu, 15 Jun 2023 19:23:51 -0500 Andreas Dannenberg via buildroot…

From: Xuanhao Shi <[email protected]>

This is the image generator that builds the initial boot binary, tiboot3.bin, for the R5 core on TI's K3 family of devices. This requires the R5 SPL output from the ti-k3-r5-loader package.

https://git.ti.com/cgit/k3-image-gen/k3-image-gen

Quoted 9 lines

Signed-off-by Xuanhao Shi <[email protected]>

Signed-off-by Anand Gadiyar <[email protected]>

Signed-off-by Andreas Dannenberg <[email protected]>

Reviewed-by Giulio Benetti <[email protected]>

Acked-by Andrew Davis <[email protected]>

Tested-by Bryan Brattlof <[email protected]>

Cc Romain Naour <[email protected]>

Reviewed-by Francois Perrad <[email protected]>

Reviewed-by Julien Olivain <[email protected]>

Quoted 1 line

I have applied this, but after doing a lot of changes.

Indeed, TI k3 is really complex to follow.
I have on remark below.

Quoted 12 lines

I've changed this whole thing to use choices for the SoC and security type. For the "config type", it was always "evm" for now, and the firmware files only exist for "evm", so I dropped this option and simply hardcoded "evm" in the package. It can always be revisited later on. So it looks like this:

(quoted diff) +5 -0

+if BR2_TARGET_TI_K3_IMAGE_GEN
+choice
+       prompt "SoC family"
+
+config BR2_TARGET_TI_K3_IMAGE_GEN_SOC_AM62AX

Review

Quoted 10 lines

(quoted diff) +10 -0

+       bool "am62ax"
+
+config BR2_TARGET_TI_K3_IMAGE_GEN_SOC_AM62X
+       bool "am62x"
+
+config BR2_TARGET_TI_K3_IMAGE_GEN_SOC_AM64X
+       bool "am64x"
+
+config BR2_TARGET_TI_K3_IMAGE_GEN_SOC_AM65X
+       bool "am65x"

I don't think AM65x can build here due to a ti-k3-image-gen check [1]

Indeed AM65X SoC doesn't support "combined boot image" so it requires to not define SBL image.

I beleive we need an option to explicitely support "combined boot flow only SoC" or "combined boot flow not supported at all by the SoC" or "combined or non-combined boot flow supported by the SoC"

[1]
https://git.ti.com/cgit/k3-image-gen/k3-image-gen/tree/Makefile?h=09.00.00.001#n164

Quoted 3 lines

boot/ti-k3-image-gen/Config.in new file +3 -0

+
+endchoice
+

[...]

Quoted 21 lines

Quoted 8 lines

boot/ti-k3-image-gen/ti-k3-image-gen.mk new file +7 -0

+
+# The ti-k3-image-gen makefiles seem to need some feature from Make v4.0,
+# similar to u-boot. Explicitly use $(BR2_MAKE) here, as the build
+# otherwise fails with some misleading error message.
+TI_K3_IMAGE_GEN_MAKE = $(BR2_MAKE)
+TI_K3_IMAGE_GEN_MAKE_OPTS = \
+	SOC=$(TI_K3_IMAGE_GEN_SOC) \

boot/ti-k3-image-gen/ti-k3-image-gen.mk line 65

Quoted 10 lines

boot/ti-k3-image-gen/ti-k3-image-gen.mk new file +10 -0

+	SOC_TYPE=$(TI_K3_IMAGE_GEN_SOC_TYPE) \
+	CONFIG=$(TI_K3_IMAGE_GEN_CONFIG) \
+	CROSS_COMPILE=$(HOST_DIR)/bin/arm-none-eabi- \
+	SBL=$(BINARIES_DIR)/r5-u-boot-spl.bin \
+	O=$(@D)/tmp \
+	BIN_DIR=$(@D)
+
+define TI_K3_IMAGE_GEN_BUILD_CMDS
+	$(TI_K3_IMAGE_GEN_MAKE) -C $(@D) $(TI_K3_IMAGE_GEN_MAKE_OPTS)
+endef

The intermediate variables were not really useful, so changed to:

Review

Quoted 8 lines

(quoted diff) +8 -0

+define TI_K3_IMAGE_GEN_BUILD_CMDS
+       $(TARGET_MAKE_ENV) \
+       $(BR2_MAKE) -C $(@D) \
+               SOC=$(TI_K3_IMAGE_GEN_SOC) \
+               SOC_TYPE=$(TI_K3_IMAGE_GEN_SECTYPE) \
+               CONFIG=evm \
+               CROSS_COMPILE=$(HOST_DIR)/bin/arm-none-eabi- \
+               SBL=$(BINARIES_DIR)/r5-u-boot-spl.bin \SBL image is defined here, so it can't work for an AM65X SoC (like for j721e

SoC) because the SoC cannot build combined boot image (SBL must not be defined).

I have a SK-TDA4VM board (j721e SoC) and I'd like to rework theses ti-k3 packages for this SoC but it fail before reaching u-boot on A72 core.

I hope to have some spare time to take a look at the issue.

Certain TI K3 devices such as AM62x and AM62Ax require a Device Manager (DM) firmnware to be made available to the U-Boot build, which will get packaged into the "tispl.bin" image tree blob during A53 SPL build. Without that DM firmware U-Boot will not be functional. To support this, add a config option called BR2_TARGET_UBOOT_NEEDS_TI_K3_DM to enable this feature, and another option BR2_TARGET_UBOOT_TI_K3_DM_SOC to allow setting the name of the SOC which needs to match the corresponding folder name in the ti-linux-firmware Git repository.

Signed-off-by Andreas Dannenberg <[email protected]>

boot/uboot/Config.in +6 -0

index 085397d03d..7e1dd44196 100644
@@ -240,6 +240,23 @@ config BR2_TARGET_UBOOT_NEEDS_OPTEE_TEE
 	  U-Boot, and that the TEE variable pointing to OPTEE's
 	  tee.elf, is passed during the Buildroot build.
 
+config BR2_TARGET_UBOOT_NEEDS_TI_K3_DM
+	bool "U-Boot needs TI K3 Device Manager (DM)"
+	help
+	  Some TI K3 devices need the Device Manager (DM) firmware
+	  to be available for the U-Boot build. Currently supports FW
+	  from Git tag 08.06.00.006 by default.

boot/uboot/uboot.mk +5 -0

index 4eae8e95c3..48af69bd26 100644
@@ -184,6 +184,22 @@ UBOOT_DEPENDENCIES += optee-os
 UBOOT_MAKE_OPTS += TEE=$(BINARIES_DIR)/tee.elf
 endif
 
+ifeq ($(BR2_TARGET_UBOOT_NEEDS_TI_K3_DM),y)
+# Currently supports the FW from Git tag 08.06.00.006 by default
+TI_K3_DM_VERSION = 340194800a581baf976360386dfc7b5acab8d948
+TI_K3_DM_SITE = https://git.ti.com/processor-firmware/ti-linux-firmware/blobs/raw/$(TI_K3_DM_VERSION)/ti-dm/$(BR2_TARGET_UBOOT_TI_K3_DM_SOC)
+TI_K3_DM_SOURCE = ipc_echo_testb_mcu1_0_release_strip.xer5f

From: Xuanhao Shi <[email protected]>

Adds support for TI's SK-AM64 board by introducing the am64x_sk_defconfig file and related support files.

More information about the board can be found at:
https://www.ti.com/tool/SK-AM64

Signed-off-by Xuanhao Shi <[email protected]>

Signed-off-by Anand Gadiyar <[email protected]>

Signed-off-by Andreas Dannenberg <[email protected]>

Reviewed-by Giulio Benetti <[email protected]>

Acked-by Andrew Davis <[email protected]>

Tested-by Bryan Brattlof <[email protected]>

Cc Romain Naour <[email protected]>

Reviewed-by Francois Perrad <[email protected]>

Reviewed-by Julien Olivain <[email protected]>

From: Xuanhao Shi <[email protected]>

Adds support for TI's SK-AM62 board by introducing the am62x_sk_defconfig file and related support files.

More information about the board can be found at:
https://www.ti.com/tool/SK-AM62

Signed-off-by Xuanhao Shi <[email protected]>

Signed-off-by Andreas Dannenberg <[email protected]>

---
 DEVELOPERS                     |  4 +++
 board/ti/am62x_sk/genimage.cfg | 27 ++++++++++++++++++++
 board/ti/am62x_sk/readme.txt   | 26 ++++++++++++++++++++
 configs/am62x_sk_defconfig     | 45 ++++++++++++++++++++++++++++++++++
 4 files changed, 102 insertions(+)
 create mode 100644 board/ti/am62x_sk/genimage.cfg
 create mode 100644 board/ti/am62x_sk/readme.txt
 create mode 100644 configs/am62x_sk_defconfig

Current starter kits for AM62x (called SK-AM62B, see [1]) and AM64x (called SK-AM64B, see [2]) both contain High Security - Field Securable (HS-FS) device variants, and those are really the recommended production device variants and boards TI will provide moving forward. Hence, switch the defconfigs for those boards over to accommodate those now-shipping device variants and boards.

[1] https://www.ti.com/tool/SK-AM62B
[2] https://www.ti.com/tool/SK-AM64B

Signed-off-by Andreas Dannenberg <[email protected]>

---
 board/ti/am62x_sk/readme.txt | 16 ++++++++++++++++
 board/ti/am64x_sk/readme.txt | 16 ++++++++++++++++
 configs/am62x_sk_defconfig   |  2 +-
 configs/am64x_sk_defconfig   |  4 ++--
 4 files changed, 35 insertions(+), 3 deletions(-)

board/ti/am62x_sk/readme.txt +14 -0

index ccbb24896b..9c7c8818af 100644
@@ -12,6 +12,22 @@ $ make am62x_sk_defconfig
 Optional: modify the configuration:
 $ make menuconfig
 
+Required setup step for High Security HS-FS and HS-SE SoC variants:
+
+To allow the image signing process for various firmware artifacts to
+work the build process for HS-FS and HS-SE device variants is using
+an external 'core-secdev-k3' package which can be obtained from
+https://git.ti.com/cgit/security-development-tools/core-secdev-k3.
+To prepare building for those device variants create a local copy of
+the 'core-secdev-k3' and export its location through the
+TI_SECURE_DEV_PKG environmental variable. Use the package as-is for
+HS-FS device variants such as populated on the SK-AM64B board, or
+customize this package with your private signing keys when using a
+HS-SE device variant.
+
+$ git clone

https://git.ti.com/git/security-development-tools/core-secdev-k3.git
+$ export TI_SECURE_DEV_PKG=$PWD/core-secdev-k3

board/ti/am62x_sk/readme.txt +1 -0

+
 Build:
 $ make

board/ti/am64x_sk/readme.txt +14 -0

index fe83c675f5..51d0312726 100644
@@ -12,6 +12,22 @@ $ make am64x_sk_defconfig
 Optional: modify the configuration:
 $ make menuconfig
 
+Required setup step for High Security HS-FS and HS-SE SoC variants:
+
+To allow the image signing process for various firmware artifacts to
+work the build process for HS-FS and HS-SE device variants is using
+an external 'core-secdev-k3' package which can be obtained from
+https://git.ti.com/cgit/security-development-tools/core-secdev-k3.
+To prepare building for those device variants create a local copy of
+the 'core-secdev-k3' and export its location through the
+TI_SECURE_DEV_PKG environmental variable. Use the package as-is for
+HS-FS device variants such as populated on the SK-AM64B board, or
+customize this package with your private signing keys when using a
+HS-SE device variant.
+
+$ git clone

https://git.ti.com/git/security-development-tools/core-secdev-k3.git
+$ export TI_SECURE_DEV_PKG=$PWD/core-secdev-k3

board/ti/am64x_sk/readme.txt +1 -0

+
 Build:
 $ make

configs/am62x_sk_defconfig +1 -1

index 2d05ddd96b..033101b735 100644
@@ -28,7 +28,7 @@ BR2_TARGET_OPTEE_OS_NEEDS_PYTHON_CRYPTOGRAPHY=y
 BR2_TARGET_OPTEE_OS_PLATFORM="k3"
 BR2_TARGET_TI_K3_IMAGE_GEN=y
 BR2_TARGET_TI_K3_IMAGE_GEN_SOC="am62x"
-BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="gp"
+BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="hs-fs"
 BR2_TARGET_TI_K3_IMAGE_GEN_CONFIG="evm"
 BR2_TARGET_TI_K3_R5_LOADER=y
 BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL=y

configs/am64x_sk_defconfig +2 -3

index a26e38a043..096dd77f6a 100644
@@ -28,8 +28,8 @@ BR2_TARGET_OPTEE_OS_NEEDS_PYTHON_CRYPTOGRAPHY=y
 BR2_TARGET_OPTEE_OS_PLATFORM="k3"
 BR2_TARGET_TI_K3_IMAGE_GEN=y
 BR2_TARGET_TI_K3_IMAGE_GEN_FW_TYPE_TISCI=y
-BR2_TARGET_TI_K3_IMAGE_GEN_SOC="am64x"
-BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="gp"
+BR2_TARGET_TI_K3_IMAGE_GEN_SOC="am64x_sr2"
+BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="hs-fs"
 BR2_TARGET_TI_K3_IMAGE_GEN_CONFIG="evm"
 BR2_TARGET_TI_K3_R5_LOADER=y
 BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL=y
--

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Quoted 38 lines · Andreas Dannenberg via buildroot

Current starter kits for AM62x (called SK-AM62B, see [1]) and AM64x (called SK-AM64B, see [2]) both contain High Security - Field Securable (HS-FS) device variants, and those are really the recommended production device variants and boards TI will provide moving forward. Hence, switch the defconfigs for those boards over to accommodate those now-shipping device variants and boards.

[1] https://www.ti.com/tool/SK-AM62B
[2] https://www.ti.com/tool/SK-AM64B

Signed-off-by Andreas Dannenberg <[email protected]>

---
 board/ti/am62x_sk/readme.txt | 16 ++++++++++++++++
 board/ti/am64x_sk/readme.txt | 16 ++++++++++++++++
 configs/am62x_sk_defconfig   |  2 +-
 configs/am64x_sk_defconfig   |  4 ++--
 4 files changed, 35 insertions(+), 3 deletions(-)

board/ti/am62x_sk/readme.txt +12 -0

index ccbb24896b..9c7c8818af 100644
@@ -12,6 +12,22 @@ $ make am62x_sk_defconfig
 Optional: modify the configuration:
 $ make menuconfig
 
+Required setup step for High Security HS-FS and HS-SE SoC variants:
+
+To allow the image signing process for various firmware artifacts to
+work the build process for HS-FS and HS-SE device variants is using
+an external 'core-secdev-k3' package which can be obtained from
+https://git.ti.com/cgit/security-development-tools/core-secdev-k3.
+To prepare building for those device variants create a local copy of
+the 'core-secdev-k3' and export its location through the
+TI_SECURE_DEV_PKG environmental variable. Use the package as-is for
+HS-FS device variants such as populated on the SK-AM64B board, or
+customize this package with your private signing keys when using a
+HS-SE device variant.

Quoted 5 lines

board/ti/am62x_sk/readme.txt +2 -0

+
+$ git clone

https://git.ti.com/git/security-development-tools/core-secdev-k3.git
+$ export TI_SECURE_DEV_PKG=$PWD/core-secdev-k3

core-secdev-k3 could be a host package and an optional dependency of uboot or atf

################################################################################
#

# ti-core-secdev-k3
#
################################################################################

TI_CORE_SECDEV_K3_VERSION = 08.06.00.007 TI_CORE_SECDEV_K3_SITE =
https://git.ti.com/cgit/security-development-tools/core-secdev-k3/snapshot
TI_CORE_SECDEV_K3_SOURCE = core-secdev-k3-$(TI_CORE_SECDEV_K3_VERSION).tar.gz

TI_SECURE_DEV_PKG=$(BUILD_DIR)/ti-core-secdev-k3-$(TI_CORE_SECDEV_K3_VERSION)

$(eval $(host-generic-package))

François

Quoted 63 lines

board/ti/am62x_sk/readme.txt +1 -0

+
 Build:
 $ make

board/ti/am64x_sk/readme.txt +14 -0

index fe83c675f5..51d0312726 100644
@@ -12,6 +12,22 @@ $ make am64x_sk_defconfig
 Optional: modify the configuration:
 $ make menuconfig
 
+Required setup step for High Security HS-FS and HS-SE SoC variants:
+
+To allow the image signing process for various firmware artifacts to
+work the build process for HS-FS and HS-SE device variants is using
+an external 'core-secdev-k3' package which can be obtained from
+https://git.ti.com/cgit/security-development-tools/core-secdev-k3.
+To prepare building for those device variants create a local copy of
+the 'core-secdev-k3' and export its location through the
+TI_SECURE_DEV_PKG environmental variable. Use the package as-is for
+HS-FS device variants such as populated on the SK-AM64B board, or
+customize this package with your private signing keys when using a
+HS-SE device variant.
+
+$ git clone

https://git.ti.com/git/security-development-tools/core-secdev-k3.git
+$ export TI_SECURE_DEV_PKG=$PWD/core-secdev-k3

board/ti/am64x_sk/readme.txt +1 -0

+
 Build:
 $ make

configs/am62x_sk_defconfig +1 -1

index 2d05ddd96b..033101b735 100644
@@ -28,7 +28,7 @@ BR2_TARGET_OPTEE_OS_NEEDS_PYTHON_CRYPTOGRAPHY=y
 BR2_TARGET_OPTEE_OS_PLATFORM="k3"
 BR2_TARGET_TI_K3_IMAGE_GEN=y
 BR2_TARGET_TI_K3_IMAGE_GEN_SOC="am62x"
-BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="gp"
+BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="hs-fs"
 BR2_TARGET_TI_K3_IMAGE_GEN_CONFIG="evm"
 BR2_TARGET_TI_K3_R5_LOADER=y
 BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL=y

configs/am64x_sk_defconfig +2 -3

index a26e38a043..096dd77f6a 100644
@@ -28,8 +28,8 @@ BR2_TARGET_OPTEE_OS_NEEDS_PYTHON_CRYPTOGRAPHY=y
 BR2_TARGET_OPTEE_OS_PLATFORM="k3"
 BR2_TARGET_TI_K3_IMAGE_GEN=y
 BR2_TARGET_TI_K3_IMAGE_GEN_FW_TYPE_TISCI=y
-BR2_TARGET_TI_K3_IMAGE_GEN_SOC="am64x"
-BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="gp"
+BR2_TARGET_TI_K3_IMAGE_GEN_SOC="am64x_sr2"
+BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="hs-fs"
 BR2_TARGET_TI_K3_IMAGE_GEN_CONFIG="evm"
 BR2_TARGET_TI_K3_R5_LOADER=y
 BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL=y
--

2.34.1

Quoted 5 lines

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Hi François,

Quoted 6 lines · François Perrad

Quoted 3 lines · Andreas Dannenberg via buildroot

Current starter kits for AM62x (called SK-AM62B, see [1]) and AM64x (called SK-AM64B, see [2]) both contain High Security - Field Securable (HS-FS) device variants, and those are really the recommended

production

Quoted 1 line

Quoted 1 line

device variants and boards TI will provide moving forward. Hence,

switch

Quoted 14 lines

Quoted 14 lines

the defconfigs for those boards over to accommodate those now-shipping device variants and boards.

[1] https://www.ti.com/tool/SK-AM62B
[2] https://www.ti.com/tool/SK-AM64B

Signed-off-by Andreas Dannenberg <[email protected]>

---
 board/ti/am62x_sk/readme.txt | 16 ++++++++++++++++
 board/ti/am64x_sk/readme.txt | 16 ++++++++++++++++
 configs/am62x_sk_defconfig   |  2 +-
 configs/am64x_sk_defconfig   |  4 ++--
 4 files changed, 35 insertions(+), 3 deletions(-)

Quoted 1 line

Review

Quoted 1 line

(quoted diff) +0 -0

b/board/ti/am62x_sk/readme.txt

Quoted 18 lines

Quoted 18 lines

index ccbb24896b..9c7c8818af 100644

board/ti/am62x_sk/readme.txt +11 -0

@@ -12,6 +12,22 @@ $ make am62x_sk_defconfig
 Optional: modify the configuration:
 $ make menuconfig
 
+Required setup step for High Security HS-FS and HS-SE SoC variants:
+
+To allow the image signing process for various firmware artifacts to
+work the build process for HS-FS and HS-SE device variants is using
+an external 'core-secdev-k3' package which can be obtained from
+https://git.ti.com/cgit/security-development-tools/core-secdev-k3.
+To prepare building for those device variants create a local copy of
+the 'core-secdev-k3' and export its location through the
+TI_SECURE_DEV_PKG environmental variable. Use the package as-is for
+HS-FS device variants such as populated on the SK-AM64B board, or
+customize this package with your private signing keys when using a

Quoted 8 lines

Quoted 6 lines

board/ti/am62x_sk/readme.txt +3 -0

+HS-SE device variant.
+
+$ git clone

https://git.ti.com/git/security-development-tools/core-secdev-k3.git
+$ export TI_SECURE_DEV_PKG=$PWD/core-secdev-k3

core-secdev-k3 could be a host package and an optional dependency of

uboot

Quoted 1 line

or atf

Good suggestion, I thought about same but wasn't quite sure how to set this up, but I'll look into this based on your below starting point. It would cover HS-FS device variants ("High Security - Field Securable"), which is 90% of the use case, and 100% of the initial use case (somebody getting a board, evaluating), all when the custom keys were not yet programmed into the SOC (which is what turns the device into a HS-SE device, at which time custom signing keys will need to be provided as part of core-secdev-k3).

Can a host package easily export/share and ENV variable (TI_SECURE_DEV_PKG)?

This will be needed not only by ti-k3-image-gen but also by uboot and potentially other packages in the future.

Regards, Andreas

Quoted 2 lines

################################################################################

Quoted 4 lines

#

# ti-core-secdev-k3
#

################################################################################

Quoted 4 lines

TI_CORE_SECDEV_K3_VERSION = 08.06.00.007
TI_CORE_SECDEV_K3_SITE =

https://git.ti.com/cgit/security-development-tools/core-secdev-k3/snapshot

Quoted 4 lines

TI_CORE_SECDEV_K3_SOURCE = core-secdev-k3-$(TI_CORE_SECDEV_K3_VERSION).tar.gz

TI_SECURE_DEV_PKG=$(BUILD_DIR)/ti-core-secdev-k3-$(TI_CORE_SECDEV_K3_VERSION)

Quoted 7 lines

$(eval $(host-generic-package))

François

Quoted 5 lines

Review

Quoted 5 lines

board/ti/am62x_sk/readme.txt +1 -0

+
 Build:
 $ make

(quoted diff) +0 -0

b/board/ti/am64x_sk/readme.txt

Quoted 58 lines

Quoted 58 lines

index fe83c675f5..51d0312726 100644

board/ti/am64x_sk/readme.txt +14 -0

@@ -12,6 +12,22 @@ $ make am64x_sk_defconfig
 Optional: modify the configuration:
 $ make menuconfig
 
+Required setup step for High Security HS-FS and HS-SE SoC variants:
+
+To allow the image signing process for various firmware artifacts to
+work the build process for HS-FS and HS-SE device variants is using
+an external 'core-secdev-k3' package which can be obtained from
+https://git.ti.com/cgit/security-development-tools/core-secdev-k3.
+To prepare building for those device variants create a local copy of
+the 'core-secdev-k3' and export its location through the
+TI_SECURE_DEV_PKG environmental variable. Use the package as-is for
+HS-FS device variants such as populated on the SK-AM64B board, or
+customize this package with your private signing keys when using a
+HS-SE device variant.
+
+$ git clone

https://git.ti.com/git/security-development-tools/core-secdev-k3.git
+$ export TI_SECURE_DEV_PKG=$PWD/core-secdev-k3

board/ti/am64x_sk/readme.txt +1 -0

+
 Build:
 $ make

configs/am62x_sk_defconfig +1 -1

index 2d05ddd96b..033101b735 100644
@@ -28,7 +28,7 @@ BR2_TARGET_OPTEE_OS_NEEDS_PYTHON_CRYPTOGRAPHY=y
 BR2_TARGET_OPTEE_OS_PLATFORM="k3"
 BR2_TARGET_TI_K3_IMAGE_GEN=y
 BR2_TARGET_TI_K3_IMAGE_GEN_SOC="am62x"
-BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="gp"
+BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="hs-fs"
 BR2_TARGET_TI_K3_IMAGE_GEN_CONFIG="evm"
 BR2_TARGET_TI_K3_R5_LOADER=y
 BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL=y

configs/am64x_sk_defconfig +2 -3

index a26e38a043..096dd77f6a 100644
@@ -28,8 +28,8 @@ BR2_TARGET_OPTEE_OS_NEEDS_PYTHON_CRYPTOGRAPHY=y
 BR2_TARGET_OPTEE_OS_PLATFORM="k3"
 BR2_TARGET_TI_K3_IMAGE_GEN=y
 BR2_TARGET_TI_K3_IMAGE_GEN_FW_TYPE_TISCI=y
-BR2_TARGET_TI_K3_IMAGE_GEN_SOC="am64x"
-BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="gp"
+BR2_TARGET_TI_K3_IMAGE_GEN_SOC="am64x_sr2"
+BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="hs-fs"
 BR2_TARGET_TI_K3_IMAGE_GEN_CONFIG="evm"
 BR2_TARGET_TI_K3_R5_LOADER=y
 BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL=y
--

2.34.1

Quoted 5 lines

Quoted 5 lines

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Le ven. 16 juin 2023 à 14:05, Andreas Dannenberg <[email protected]> a écrit :

Quoted 66 lines

Hi François,

Quoted 6 lines · François Perrad

Quoted 3 lines · Andreas Dannenberg via buildroot

Current starter kits for AM62x (called SK-AM62B, see [1]) and AM64x (called SK-AM64B, see [2]) both contain High Security - Field Securable (HS-FS) device variants, and those are really the recommended

production

Quoted 1 line

Quoted 1 line

device variants and boards TI will provide moving forward. Hence,

switch

Quoted 14 lines

Quoted 14 lines

the defconfigs for those boards over to accommodate those now-shipping device variants and boards.

[1] https://www.ti.com/tool/SK-AM62B
[2] https://www.ti.com/tool/SK-AM64B

Signed-off-by Andreas Dannenberg <[email protected]>

---
 board/ti/am62x_sk/readme.txt | 16 ++++++++++++++++
 board/ti/am64x_sk/readme.txt | 16 ++++++++++++++++
 configs/am62x_sk_defconfig   |  2 +-
 configs/am64x_sk_defconfig   |  4 ++--
 4 files changed, 35 insertions(+), 3 deletions(-)

Quoted 1 line

Review

Quoted 1 line

(quoted diff) +0 -0

b/board/ti/am62x_sk/readme.txt

Quoted 18 lines

Quoted 18 lines

index ccbb24896b..9c7c8818af 100644

board/ti/am62x_sk/readme.txt +11 -0

@@ -12,6 +12,22 @@ $ make am62x_sk_defconfig
 Optional: modify the configuration:
 $ make menuconfig
 
+Required setup step for High Security HS-FS and HS-SE SoC variants:
+
+To allow the image signing process for various firmware artifacts to
+work the build process for HS-FS and HS-SE device variants is using
+an external 'core-secdev-k3' package which can be obtained from
+https://git.ti.com/cgit/security-development-tools/core-secdev-k3.
+To prepare building for those device variants create a local copy of
+the 'core-secdev-k3' and export its location through the
+TI_SECURE_DEV_PKG environmental variable. Use the package as-is for
+HS-FS device variants such as populated on the SK-AM64B board, or
+customize this package with your private signing keys when using a

Quoted 8 lines

Quoted 6 lines

board/ti/am62x_sk/readme.txt +3 -0

+HS-SE device variant.
+
+$ git clone

https://git.ti.com/git/security-development-tools/core-secdev-k3.git
+$ export TI_SECURE_DEV_PKG=$PWD/core-secdev-k3

core-secdev-k3 could be a host package and an optional dependency of

uboot

Quoted 1 line

or atf

Good suggestion, I thought about same but wasn't quite sure how to set this up, but I'll look into this based on your below starting point. It would cover HS-FS device variants ("High Security - Field Securable"), which is 90% of the use case, and 100% of the initial use case (somebody getting a board, evaluating), all when the custom keys were not yet programmed into the SOC (which is what turns the device into a HS-SE device, at which time custom signing keys will need to be provided as part of core-secdev-k3).

Quoted 4 lines

Can a host package easily export/share and ENV variable (TI_SECURE_DEV_PKG)?

yes (we are in a Makefile fragment):
export TI_SECURE_DEV_PKG=$(BUILD_DIR)/ti-core-secdev-k3-$(TI_CORE_SECDEV_K3_VERSION)

when a package needed it, just add :
FOO_DEPENDENCIES += host-ti-core-secdev-k3

François

Quoted 95 lines

This will be needed not only by ti-k3-image-gen but also by uboot and potentially other packages in the future.

Regards, Andreas

Quoted 2 lines

################################################################################

Quoted 4 lines

#

# ti-core-secdev-k3
#

################################################################################

Quoted 4 lines

TI_CORE_SECDEV_K3_VERSION = 08.06.00.007
TI_CORE_SECDEV_K3_SITE =

https://git.ti.com/cgit/security-development-tools/core-secdev-k3/snapshot

Quoted 4 lines

TI_CORE_SECDEV_K3_SOURCE = core-secdev-k3-$(TI_CORE_SECDEV_K3_VERSION).tar.gz

TI_SECURE_DEV_PKG=$(BUILD_DIR)/ti-core-secdev-k3-$(TI_CORE_SECDEV_K3_VERSION)

Quoted 7 lines

$(eval $(host-generic-package))

François

Quoted 5 lines

Review

Quoted 5 lines

board/ti/am62x_sk/readme.txt +1 -0

+
 Build:
 $ make

(quoted diff) +0 -0

b/board/ti/am64x_sk/readme.txt

Quoted 58 lines

Quoted 58 lines

index fe83c675f5..51d0312726 100644

board/ti/am64x_sk/readme.txt +14 -0

@@ -12,6 +12,22 @@ $ make am64x_sk_defconfig
 Optional: modify the configuration:
 $ make menuconfig
 
+Required setup step for High Security HS-FS and HS-SE SoC variants:
+
+To allow the image signing process for various firmware artifacts to
+work the build process for HS-FS and HS-SE device variants is using
+an external 'core-secdev-k3' package which can be obtained from
+https://git.ti.com/cgit/security-development-tools/core-secdev-k3.
+To prepare building for those device variants create a local copy of
+the 'core-secdev-k3' and export its location through the
+TI_SECURE_DEV_PKG environmental variable. Use the package as-is for
+HS-FS device variants such as populated on the SK-AM64B board, or
+customize this package with your private signing keys when using a
+HS-SE device variant.
+
+$ git clone

https://git.ti.com/git/security-development-tools/core-secdev-k3.git
+$ export TI_SECURE_DEV_PKG=$PWD/core-secdev-k3

board/ti/am64x_sk/readme.txt +1 -0

+
 Build:
 $ make

configs/am62x_sk_defconfig +1 -1

index 2d05ddd96b..033101b735 100644
@@ -28,7 +28,7 @@ BR2_TARGET_OPTEE_OS_NEEDS_PYTHON_CRYPTOGRAPHY=y
 BR2_TARGET_OPTEE_OS_PLATFORM="k3"
 BR2_TARGET_TI_K3_IMAGE_GEN=y
 BR2_TARGET_TI_K3_IMAGE_GEN_SOC="am62x"
-BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="gp"
+BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="hs-fs"
 BR2_TARGET_TI_K3_IMAGE_GEN_CONFIG="evm"
 BR2_TARGET_TI_K3_R5_LOADER=y
 BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL=y

configs/am64x_sk_defconfig +2 -3

index a26e38a043..096dd77f6a 100644
@@ -28,8 +28,8 @@ BR2_TARGET_OPTEE_OS_NEEDS_PYTHON_CRYPTOGRAPHY=y
 BR2_TARGET_OPTEE_OS_PLATFORM="k3"
 BR2_TARGET_TI_K3_IMAGE_GEN=y
 BR2_TARGET_TI_K3_IMAGE_GEN_FW_TYPE_TISCI=y
-BR2_TARGET_TI_K3_IMAGE_GEN_SOC="am64x"
-BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="gp"
+BR2_TARGET_TI_K3_IMAGE_GEN_SOC="am64x_sr2"
+BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="hs-fs"
 BR2_TARGET_TI_K3_IMAGE_GEN_CONFIG="evm"
 BR2_TARGET_TI_K3_R5_LOADER=y
 BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL=y
--

2.34.1

Quoted 6 lines

Quoted 5 lines

Quoted 5 lines

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Hi François,

Quoted 11 lines · François Perrad

Le ven. 16 juin 2023 à 14:05, Andreas Dannenberg <[email protected]> a écrit :

Quoted 8 lines

Hi François,

Quoted 5 lines · François Perrad

Quoted 2 lines · Andreas Dannenberg via buildroot

Current starter kits for AM62x (called SK-AM62B, see [1]) and AM64x (called SK-AM64B, see [2]) both contain High Security - Field

Securable

Quoted 5 lines

Quoted 5 lines

Quoted 1 line

Quoted 1 line

(HS-FS) device variants, and those are really the recommended

production

Quoted 1 line

Quoted 1 line

device variants and boards TI will provide moving forward. Hence,

switch

Quoted 1 line

Quoted 1 line

the defconfigs for those boards over to accommodate those

now-shipping

Quoted 15 lines

Quoted 15 lines

Quoted 13 lines

Quoted 13 lines

device variants and boards.

[1] https://www.ti.com/tool/SK-AM62B
[2] https://www.ti.com/tool/SK-AM64B

Signed-off-by Andreas Dannenberg <[email protected]>

---
 board/ti/am62x_sk/readme.txt | 16 ++++++++++++++++
 board/ti/am64x_sk/readme.txt | 16 ++++++++++++++++
 configs/am62x_sk_defconfig   |  2 +-
 configs/am64x_sk_defconfig   |  4 ++--
 4 files changed, 35 insertions(+), 3 deletions(-)

Quoted 1 line

Review

Quoted 1 line

(quoted diff) +0 -0

b/board/ti/am62x_sk/readme.txt

Quoted 8 lines

Quoted 8 lines

Quoted 8 lines

board/ti/am62x_sk/readme.txt $ make am62x_sk_defconfig · line 15

Quoted 8 lines

index ccbb24896b..9c7c8818af 100644

board/ti/am62x_sk/readme.txt +1 -0

@@ -12,6 +12,22 @@ $ make am62x_sk_defconfig
 Optional: modify the configuration:
 $ make menuconfig
 
+Required setup step for High Security HS-FS and HS-SE SoC

variants:

Quoted 2 lines

Quoted 2 lines

Quoted 2 lines

board/ti/am62x_sk/readme.txt $ make am62x_sk_defconfig · line 17

Quoted 2 lines

board/ti/am62x_sk/readme.txt +2 -0

+
+To allow the image signing process for various firmware artifacts

to

Quoted 1 line

Quoted 1 line

Quoted 1 line

board/ti/am62x_sk/readme.txt $ make am62x_sk_defconfig · line 18

Quoted 1 line

board/ti/am62x_sk/readme.txt +1 -0

+work the build process for HS-FS and HS-SE device variants is

using

Quoted 2 lines

Quoted 2 lines

Quoted 2 lines

board/ti/am62x_sk/readme.txt $ make am62x_sk_defconfig · line 20

Quoted 2 lines

board/ti/am62x_sk/readme.txt +2 -0

+an external 'core-secdev-k3' package which can be obtained from
+https://git.ti.com/cgit/security-development-tools/core-secdev-k3

.

Quoted 1 line

Quoted 1 line

Quoted 1 line

board/ti/am62x_sk/readme.txt $ make am62x_sk_defconfig · line 21

Quoted 1 line

board/ti/am62x_sk/readme.txt +1 -0

+To prepare building for those device variants create a local copy

of

Quoted 2 lines

Quoted 2 lines

Quoted 2 lines

board/ti/am62x_sk/readme.txt $ make am62x_sk_defconfig · line 23

Quoted 2 lines

board/ti/am62x_sk/readme.txt +2 -0

+the 'core-secdev-k3' and export its location through the
+TI_SECURE_DEV_PKG environmental variable. Use the package as-is

for

Quoted 6 lines

Quoted 6 lines

Quoted 6 lines

board/ti/am62x_sk/readme.txt $ make am62x_sk_defconfig · line 29

Quoted 6 lines

board/ti/am62x_sk/readme.txt +5 -0

+HS-FS device variants such as populated on the SK-AM64B board, or
+customize this package with your private signing keys when using a
+HS-SE device variant.
+
+$ git clone
 

https://git.ti.com/git/security-development-tools/core-secdev-k3.git

Quoted 11 lines

Quoted 11 lines

Quoted 4 lines

board/ti/am62x_sk/readme.txt $ make am62x_sk_defconfig · line 31

Quoted 2 lines

board/ti/am62x_sk/readme.txt +1 -0

+$ export TI_SECURE_DEV_PKG=$PWD/core-secdev-k3
 

core-secdev-k3 could be a host package and an optional dependency of

uboot

Quoted 1 line

or atf

Good suggestion, I thought about same but wasn't quite sure how to set this up, but I'll look into this based on your below starting point. It would cover HS-FS device variants ("High Security - Field Securable"), which is 90% of the use case, and 100% of the initial use case

(somebody

Quoted 5 lines

Quoted 5 lines

getting a board, evaluating), all when the custom keys were not yet programmed into the SOC (which is what turns the device into a HS-SE device, at which time custom signing keys will need to be provided as part of core-secdev-k3).

Quoted 7 lines

Quoted 4 lines

Can a host package easily export/share and ENV variable (TI_SECURE_DEV_PKG)?

yes (we are in a Makefile fragment):
export

TI_SECURE_DEV_PKG=$(BUILD_DIR)/ti-core-secdev-k3-$(TI_CORE_SECDEV_K3_VERSION)

Quoted 5 lines

when a package needed it, just add :
FOO_DEPENDENCIES += host-ti-core-secdev-k3

François

Good point, using the make construct for 'export' should work, and in fact it does. Just tried it out. Was able to largely carry over what you came up with (thanks again!!). One change I had to made was to add a 'host-' prefix to the line exporting the ti-core-secdev-k3 package location. Below is my Makefile fragment. Will make this part of PATCH v9 series I intent to send out next week (want to give it a few more days to allow folks to add feedback).

package/ti-core-secdev-k3/ti-core-secdev-k3.mk new file +8 -0

@@ -0,0 +1,21 @@
 
+################################################################################
+#
+## ti-core-secdev-k3
+#
 
+#################################################################################
+
+TI_CORE_SECDEV_K3_VERSION = 08.06.00.007
+TI_CORE_SECDEV_K3_SITE =

https://git.ti.com/cgit/security-development-tools/core-secdev-k3/snapshot
+TI_CORE_SECDEV_K3_LICENSE
<https://git.ti.com/cgit/security-development-tools/core-secdev-k3/snapshot+TI_CORE_SECDEV_K3_LICENSE>
= TI TSPA License

package/ti-core-secdev-k3/ti-core-secdev-k3.mk new file +2 -0

+TI_CORE_SECDEV_K3_LICENSE_FILES = manifest/k3-secdev-0.2-manifest.html
+TI_CORE_SECDEV_K3_SOURCE =

core-secdev-k3-$(TI_CORE_SECDEV_K3_VERSION).tar.gz

package/ti-core-secdev-k3/ti-core-secdev-k3.mk new file +2 -0

+
+# To allow the image signing process for various firmware artifacts to

work the
+# build process for TI K3 platform HS-FS and HS-SE device variants is using the
+# 'core-secdev-k3' tool provided by TI. Its location must be made available to

package/ti-core-secdev-k3/ti-core-secdev-k3.mk new file +2 -0

+# the build process by exporting it through the use of an environmental
+# variable. From there on, other packages like ti-k3-r5-loader will pick

up the

package/ti-core-secdev-k3/ti-core-secdev-k3.mk new file +2 -0

+# signing tools and keys that are provided in this package.
+export TI_SECURE_DEV_PKG =

$(BUILD_DIR)/host-ti-core-secdev-k3-$(TI_CORE_SECDEV_K3_VERSION) +
+$(eval $(host-generic-package))

--
Andreas Dannenberg
Texas Instruments Inc

Quoted 9 lines

Quoted 9 lines

This will be needed not only by ti-k3-image-gen but also by uboot and potentially other packages in the future.

Regards, Andreas

Quoted 2 lines

################################################################################

Quoted 5 lines

Quoted 5 lines

Quoted 4 lines

#

# ti-core-secdev-k3
#

################################################################################

Quoted 5 lines

Quoted 5 lines

Quoted 4 lines

TI_CORE_SECDEV_K3_VERSION = 08.06.00.007
TI_CORE_SECDEV_K3_SITE =

https://git.ti.com/cgit/security-development-tools/core-secdev-k3/snapshot

Quoted 5 lines

Quoted 5 lines

Quoted 4 lines

TI_CORE_SECDEV_K3_SOURCE = core-secdev-k3-$(TI_CORE_SECDEV_K3_VERSION).tar.gz

TI_SECURE_DEV_PKG=$(BUILD_DIR)/ti-core-secdev-k3-$(TI_CORE_SECDEV_K3_VERSION)

Quoted 13 lines

Quoted 13 lines

Quoted 7 lines

$(eval $(host-generic-package))

François

Quoted 5 lines

Review

Quoted 5 lines

board/ti/am62x_sk/readme.txt +1 -0

+
 Build:

 $ make

(quoted diff) +0 -0

b/board/ti/am64x_sk/readme.txt

Quoted 8 lines

Quoted 8 lines

Quoted 8 lines

board/ti/am64x_sk/readme.txt $ make am64x_sk_defconfig · line 15

Quoted 8 lines

index fe83c675f5..51d0312726 100644

board/ti/am64x_sk/readme.txt +1 -0

@@ -12,6 +12,22 @@ $ make am64x_sk_defconfig
 Optional: modify the configuration:
 $ make menuconfig
 
+Required setup step for High Security HS-FS and HS-SE SoC

variants:

Quoted 2 lines

Quoted 2 lines

Quoted 2 lines

board/ti/am64x_sk/readme.txt $ make am64x_sk_defconfig · line 17

Quoted 2 lines

board/ti/am64x_sk/readme.txt +2 -0

+
+To allow the image signing process for various firmware artifacts

to

Quoted 1 line

Quoted 1 line

Quoted 1 line

board/ti/am64x_sk/readme.txt $ make am64x_sk_defconfig · line 18

Quoted 1 line

board/ti/am64x_sk/readme.txt +1 -0

+work the build process for HS-FS and HS-SE device variants is

using

Quoted 2 lines

Quoted 2 lines

Quoted 2 lines

board/ti/am64x_sk/readme.txt $ make am64x_sk_defconfig · line 20

Quoted 2 lines

board/ti/am64x_sk/readme.txt +2 -0

+an external 'core-secdev-k3' package which can be obtained from
+https://git.ti.com/cgit/security-development-tools/core-secdev-k3

.

Quoted 1 line

Quoted 1 line

Quoted 1 line

board/ti/am64x_sk/readme.txt $ make am64x_sk_defconfig · line 21

Quoted 1 line

board/ti/am64x_sk/readme.txt +1 -0

+To prepare building for those device variants create a local copy

of

Quoted 2 lines

Quoted 2 lines

Quoted 2 lines

board/ti/am64x_sk/readme.txt $ make am64x_sk_defconfig · line 23

Quoted 2 lines

board/ti/am64x_sk/readme.txt +2 -0

+the 'core-secdev-k3' and export its location through the
+TI_SECURE_DEV_PKG environmental variable. Use the package as-is

for

Quoted 6 lines

Quoted 6 lines

Quoted 6 lines

board/ti/am64x_sk/readme.txt $ make am64x_sk_defconfig · line 29

Quoted 6 lines

board/ti/am64x_sk/readme.txt +5 -0

+HS-FS device variants such as populated on the SK-AM64B board, or
+customize this package with your private signing keys when using a
+HS-SE device variant.
+
+$ git clone
 

https://git.ti.com/git/security-development-tools/core-secdev-k3.git

Quoted 6 lines

Quoted 6 lines

Quoted 6 lines

Review

Quoted 6 lines

board/ti/am64x_sk/readme.txt +2 -0

+$ export TI_SECURE_DEV_PKG=$PWD/core-secdev-k3
+
 Build:
 $ make

(quoted diff) +0 -0

b/configs/am62x_sk_defconfig

Quoted 5 lines

Quoted 5 lines

Quoted 5 lines

Quoted 5 lines

index 2d05ddd96b..033101b735 100644

configs/am62x_sk_defconfig +0 -0

@@ -28,7 +28,7 @@ BR2_TARGET_OPTEE_OS_NEEDS_PYTHON_CRYPTOGRAPHY=y
 BR2_TARGET_OPTEE_OS_PLATFORM="k3"

Quoted 8 lines

Quoted 8 lines

Quoted 8 lines

Review

Quoted 8 lines

configs/am62x_sk_defconfig +1 -1

 BR2_TARGET_TI_K3_IMAGE_GEN=y
 BR2_TARGET_TI_K3_IMAGE_GEN_SOC="am62x"
-BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="gp"
+BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="hs-fs"
 BR2_TARGET_TI_K3_IMAGE_GEN_CONFIG="evm"
 BR2_TARGET_TI_K3_R5_LOADER=y
 BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL=y

(quoted diff) +0 -0

b/configs/am64x_sk_defconfig

Quoted 23 lines

Quoted 23 lines

Quoted 22 lines

Quoted 22 lines

index a26e38a043..096dd77f6a 100644

configs/am64x_sk_defconfig +2 -3

@@ -28,8 +28,8 @@ BR2_TARGET_OPTEE_OS_NEEDS_PYTHON_CRYPTOGRAPHY=y
 BR2_TARGET_OPTEE_OS_PLATFORM="k3"
 BR2_TARGET_TI_K3_IMAGE_GEN=y
 BR2_TARGET_TI_K3_IMAGE_GEN_FW_TYPE_TISCI=y
-BR2_TARGET_TI_K3_IMAGE_GEN_SOC="am64x"
-BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="gp"
+BR2_TARGET_TI_K3_IMAGE_GEN_SOC="am64x_sr2"
+BR2_TARGET_TI_K3_IMAGE_GEN_SOC_TYPE="hs-fs"
 BR2_TARGET_TI_K3_IMAGE_GEN_CONFIG="evm"
 BR2_TARGET_TI_K3_R5_LOADER=y
 BR2_TARGET_TI_K3_R5_LOADER_CUSTOM_TARBALL=y
--

2.34.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Le sam. 17 juin 2023 à 00:13, Andreas Dannenberg <[email protected]> a écrit :

Quoted 96 lines

Hi François,

Quoted 11 lines · François Perrad

Le ven. 16 juin 2023 à 14:05, Andreas Dannenberg <[email protected]> a écrit :

Quoted 8 lines

Hi François,

Quoted 5 lines · François Perrad

Quoted 2 lines · Andreas Dannenberg via buildroot

Current starter kits for AM62x (called SK-AM62B, see [1]) and AM64x (called SK-AM64B, see [2]) both contain High Security - Field

Securable

Quoted 5 lines

Quoted 5 lines

Quoted 1 line

Quoted 1 line

(HS-FS) device variants, and those are really the recommended

production

Quoted 1 line

Quoted 1 line

device variants and boards TI will provide moving forward. Hence,

switch

Quoted 1 line

Quoted 1 line

the defconfigs for those boards over to accommodate those

now-shipping

Quoted 15 lines

Quoted 15 lines

Quoted 13 lines

Quoted 13 lines

device variants and boards.

[1] https://www.ti.com/tool/SK-AM62B
[2] https://www.ti.com/tool/SK-AM64B

Signed-off-by Andreas Dannenberg <[email protected]>

---
 board/ti/am62x_sk/readme.txt | 16 ++++++++++++++++
 board/ti/am64x_sk/readme.txt | 16 ++++++++++++++++
 configs/am62x_sk_defconfig   |  2 +-
 configs/am64x_sk_defconfig   |  4 ++--
 4 files changed, 35 insertions(+), 3 deletions(-)

Quoted 1 line

Review

Quoted 1 line

(quoted diff) +0 -0

b/board/ti/am62x_sk/readme.txt

Quoted 8 lines

Quoted 8 lines

Quoted 8 lines

board/ti/am62x_sk/readme.txt $ make am62x_sk_defconfig · line 15

Quoted 8 lines

index ccbb24896b..9c7c8818af 100644

board/ti/am62x_sk/readme.txt +1 -0

@@ -12,6 +12,22 @@ $ make am62x_sk_defconfig
 Optional: modify the configuration:
 $ make menuconfig
 
+Required setup step for High Security HS-FS and HS-SE SoC

variants:

Quoted 2 lines

Quoted 2 lines

Quoted 2 lines

board/ti/am62x_sk/readme.txt $ make am62x_sk_defconfig · line 17

Quoted 2 lines

board/ti/am62x_sk/readme.txt +2 -0

+
+To allow the image signing process for various firmware artifacts

to

Quoted 1 line

Quoted 1 line

Quoted 1 line

board/ti/am62x_sk/readme.txt $ make am62x_sk_defconfig · line 18

Quoted 1 line

board/ti/am62x_sk/readme.txt +1 -0

+work the build process for HS-FS and HS-SE device variants is

using

Quoted 2 lines

Quoted 2 lines

Quoted 2 lines

board/ti/am62x_sk/readme.txt $ make am62x_sk_defconfig · line 20

Quoted 2 lines

board/ti/am62x_sk/readme.txt +2 -0

+an external 'core-secdev-k3' package which can be obtained from
+https://git.ti.com/cgit/security-development-tools/core-secdev-k3

.

Quoted 1 line

Quoted 1 line

Quoted 1 line

board/ti/am62x_sk/readme.txt $ make am62x_sk_defconfig · line 21

Quoted 1 line

board/ti/am62x_sk/readme.txt +1 -0

+To prepare building for those device variants create a local copy

of

Quoted 2 lines

Quoted 2 lines

Quoted 2 lines

board/ti/am62x_sk/readme.txt $ make am62x_sk_defconfig · line 23

Quoted 2 lines

board/ti/am62x_sk/readme.txt +2 -0

+the 'core-secdev-k3' and export its location through the
+TI_SECURE_DEV_PKG environmental variable. Use the package as-is

for

Quoted 6 lines

Quoted 6 lines

Quoted 6 lines

board/ti/am62x_sk/readme.txt $ make am62x_sk_defconfig · line 29

Quoted 6 lines

board/ti/am62x_sk/readme.txt +5 -0

+HS-FS device variants such as populated on the SK-AM64B board, or
+customize this package with your private signing keys when using a
+HS-SE device variant.
+
+$ git clone
 

https://git.ti.com/git/security-development-tools/core-secdev-k3.git

Quoted 11 lines

Quoted 11 lines

Quoted 4 lines

board/ti/am62x_sk/readme.txt $ make am62x_sk_defconfig · line 31

Quoted 2 lines

board/ti/am62x_sk/readme.txt +1 -0

+$ export TI_SECURE_DEV_PKG=$PWD/core-secdev-k3
 

core-secdev-k3 could be a host package and an optional dependency of

uboot

Quoted 1 line

or atf

Good suggestion, I thought about same but wasn't quite sure how to set this up, but I'll look into this based on your below starting point. It would cover HS-FS device variants ("High Security - Field Securable"), which is 90% of the use case, and 100% of the initial use case

(somebody

Quoted 5 lines

Quoted 5 lines

getting a board, evaluating), all when the custom keys were not yet programmed into the SOC (which is what turns the device into a HS-SE device, at which time custom signing keys will need to be provided as part of core-secdev-k3).

Quoted 7 lines

Quoted 4 lines

Can a host package easily export/share and ENV variable (TI_SECURE_DEV_PKG)?

yes (we are in a Makefile fragment):
export

TI_SECURE_DEV_PKG=$(BUILD_DIR)/ti-core-secdev-k3-$(TI_CORE_SECDEV_K3_VERSION)

Quoted 5 lines

when a package needed it, just add :
FOO_DEPENDENCIES += host-ti-core-secdev-k3

François

Quoted 10 lines

Good point, using the make construct for 'export' should work, and in fact it does. Just tried it out. Was able to largely carry over what you came up with (thanks again!!). One change I had to made was to add a 'host-' prefix to the line exporting the ti-core-secdev-k3 package location. Below is my Makefile fragment. Will make this part of PATCH v9 series I intent to send out next week (want to give it a few more days to allow folks to add feedback).

in order to support the creation of a relocatable SDK, it will be better to install the stuff somewhere in $(HOST_DIR), like that: