<lschmid>
Sorry to bother you all again, but I've got another issue regarding U-Boot. If I enable DM_SPL (since it's needed to use verified FIT-Images) I cant compile anymore because "gpio_request_by_name" on "sunxi_mmc_probe" is now undefined. But, at least as far as I can tell, "gpio_request_by_name" is getting built and should also be available...
Sensu_Bean has joined #linux-sunxi
Sensu_Be1 has quit [Read error: Connection reset by peer]
Schimsalabim has joined #linux-sunxi
Schimsalabim has quit [Ping timeout: 480 seconds]
Schimsalabim has joined #linux-sunxi
bauen1 has joined #linux-sunxi
Sensu_Be1 has joined #linux-sunxi
Sensu_Bean has quit [Ping timeout: 480 seconds]
apritzel has joined #linux-sunxi
<apritzel>
lschmid: sorry, but it won't work this way: you cannot just enable DM_SPL for Allwinner without reworking significant amounts of code, and breaking other SoCs in the process
Schimsalabim has quit [Read error: No route to host]
<apritzel>
junari, wens: indeed, the eMMC rails must be at least automatically enabled at PMIC reset, otherwise the BROM couldn't boot from there (as the BROM has no clue or code for any PMIC)
Schimsalabim has joined #linux-sunxi
cnxsoft1 has quit [Ping timeout: 480 seconds]
Schimsalabim has quit [Read error: Connection reset by peer]
Schimsalabim has joined #linux-sunxi
ftg has joined #linux-sunxi
Schimsalabim has quit [Ping timeout: 480 seconds]
Schimsalabim has joined #linux-sunxi
dsimic is now known as Guest23806
dsimic has joined #linux-sunxi
Guest23806 has quit [Ping timeout: 480 seconds]
Schimsalabim has quit [Ping timeout: 480 seconds]
Sensu_Bean has joined #linux-sunxi
Schimsalabim has joined #linux-sunxi
Sensu_Be1 has quit [Ping timeout: 480 seconds]
Sensu_Be1 has joined #linux-sunxi
Sensu_Bean has quit [Ping timeout: 480 seconds]
Sensu_Bean has joined #linux-sunxi
Sensu_Be2 has joined #linux-sunxi
Sensu_Be1 has quit [Ping timeout: 480 seconds]
Sensu_Bean has quit [Ping timeout: 480 seconds]
Sensu_Bean has joined #linux-sunxi
Sensu_Be2 has quit [Ping timeout: 480 seconds]
apritzel has quit [Ping timeout: 480 seconds]
<lschmid>
apritzel: Do you maybe know of a way that SPL could verify U-Boot without needing the fit-Image?
flyback has quit [Remote host closed the connection]
flyback has joined #linux-sunxi
bpye_ has joined #linux-sunxi
bpye has quit [Ping timeout: 480 seconds]
hazardchem has quit [Read error: Connection reset by peer]
hazardchem has joined #linux-sunxi
spawacz has quit []
hazardchem has quit [Read error: Connection reset by peer]
hazardchem has joined #linux-sunxi
apritzel has joined #linux-sunxi
JohnDoe_71Rus has quit [Quit: KVIrc KVIrc Quasar 5.2.6, revision: 5.2.6+git-7614-6f23368f1, build type: debug, sources date: 20160102, built on: 2025-03-30 13:34:35 UTC 5.2.6+git-7614-]
gsz has joined #linux-sunxi
Schimsalabim has quit [Read error: Connection reset by peer]
Schimsalabim has joined #linux-sunxi
<apritzel>
lschmid: using a FIT image is not the problem, all arm64 boards are using it, and I think you should be able to just enable it for arm builds as well?
<lschmid>
fit-Image in SPL? For loading signed main-uboot binary?
Schimsalabim has quit [Ping timeout: 480 seconds]
<apritzel>
I don't know about signed, but just setting SPL_LOAD_FIT_ADDRESS=y will make U-Boot generate a FIT image with U-Boot proper and the DTB
<apritzel>
which will be loaded then by the SPL
<apritzel>
that's how all arm64 Allwinner boards boot, because the FIT image there also contains Trusted Firmware
<apritzel>
I haven't tried what it takes to enable signature checks on top of that, though
Schimsalabim has joined #linux-sunxi
<lschmid>
I did enable that. But then there is "SPL_FIT_SIGNATURE" and it requires "SPL_DM" for some reason
<apritzel>
ah, yeah, it's SPL_FIT_SIGNATURE that depends on DM_SPL
<lschmid>
Why would signature checking need DM?
<lschmid>
Or does it... I commented out "SPL_DM" and it did build...
<apritzel>
yeah, wondering myself, was just about to try the same ;-)
<lschmid>
So I guess I'll just try it. What load address should I give it for the fit image?
<lschmid>
Default is 0 but the description doesn't say anything about auto when 0
<apritzel>
keep it at 0, I think that doesn't matter
<apritzel>
commit 9009798df20f60f introduced the dependency, sounds pretty vague to me
<lschmid>
Okay. I'm somewhat worried that u-boot didnt complain about a missing certificate or anything for the signature check... so no idea where that will come from. But i'll check if it boots
<lschmid>
First of all, U-Boot/SPL gets now stuck at "Trying to boot from MMC2". I'll enable some verbose fail functions in the fit settings.
<lschmid>
The fit signature link is for u-boot loading linux/app not spl loading u-boot, right
<lschmid>
And does the patch mean I cannot use RSA in SPL without DM?
<apritzel>
it sounds very odd, I am just looking at it
<apritzel>
there is UCLASS_MOD_EXP, and apparently there are two hardware devices that implement the mod exp algorithm (ASPEED acry and some Freescale thing), plus the software implementation
<apritzel>
and since the ASPEED one has a DT node, this pulls the whole thing into CONFIG_(SPL_)DM
<apritzel>
the fsl one doesn't even use DT or DM, really, it's just hooking this one function up
<lschmid>
And having the ASPEED in a #ifdef SPL_DM or something was not an option i guesS?
<apritzel>
I guess no one asked about it
<lschmid>
Until now
<apritzel>
U-Boot is often just hacked up enough to make it work for one particular use case
<lschmid>
But I don't get SPL to load U-Boot now anyways with fit enabled. It just hangs there. Maybe I do need to set the address?
<apritzel>
arm64 doesn't do it (it's 0), and it works there
<apritzel>
we added FIT SPL support for 32-bit SoCs later, but didn't enable it automatically, I need to check what's needed, and whether this has regressed since then
<lschmid>
Okay seems related to the signature stuff i enabled. We're getting stuck on "## Checking hash(es) for config config-1 ... "
<lschmid>
It might be related to the fact that the fit that u-boot built does not actually have hashes or signatures inside it
<apritzel>
I suggest you look at other platforms/boards that enable CONFIG_SPL_FIT_SIGNATURE and check what they do
<apritzel>
also be warned that U-Boot's Kbuild implementation is less refined than the kernel's one, often you need to put an option in the defconfig for it to work properly, just enabling it manually in menuconfig sometimes doesn't work
<lschmid>
Would a savedefconfig and the make that_defconfig fix this?
<apritzel>
yes, if you got a working config, that's the best approach. But I got a lot of "unmet direct dependencies" complaints when just enabling certain options, so there might be something missing that other platforms enable
<lschmid>
I've looked at other defconfigs and they don't seem to enable anything that I don't have enabled (regarding spl or hashing...)
<lschmid>
Oh i see. The sunxi-u-boot.dtsi has not has properties added when SIGNATURE config is set.
<apritzel>
yes, I guess it's rockchip-u-boot.dtsi to copy from
apritzel has quit [Remote host closed the connection]
apritzel has joined #linux-sunxi
<apritzel>
lschmid: do you need RSA for the verification? Or can you use another algorithm?
<lschmid>
I'd prefer it.. What other options would there be in uboot?
<apritzel>
I don't know, that was my actual question ;-)
<apritzel>
I guess one could put #ifdef's in rsa-verify.c to avoid the uclass_get_device() calls, but this might not be too popular (since DM is a clean and preferred concept)
<apritzel>
although it sounds a bit over the top to force DM on something like an algorithm when there is only one quite obscure hardware driver to use that
<lschmid>
Yeah I don't see the point of having to use DM because one device or platform decieded that it needs it
<lschmid>
At least in this regard
<apritzel>
we could just call rsa_mod_exp_sw() directly, that's basically the same interface as the DM ops function
<apritzel>
maybe you can hack this up as a proof of concept
<lschmid>
Hmm i could try that, yes
<lschmid>
Basically what they are doing for HOSTCC already?
Sensu_Be1 has joined #linux-sunxi
Sensu_Bean has quit [Read error: Connection reset by peer]
<apritzel>
lol, just figured the same ...
Sensu_Bean has joined #linux-sunxi
<apritzel>
#if CONFIG_IS_ENABLED(DM) would be the idiom to use
<lschmid>
I'll give that a shot. However i am still failing to make it sign the image in the first place. The hashes are there and the sig config is to, but nothing is getting signed. I dont see how others do it, or rather I think i've set it up the same
Sensu_Be1 has quit [Ping timeout: 480 seconds]
gsz has quit [Ping timeout: 480 seconds]
<lschmid>
Okay "fit,sign" was missing. It now signs the images. However uboot is still stuck at checking hashes...
<lschmid>
Oh. gd->fdt_blob is needed for it to work, but is a pointer to null
Sensu_Be1 has joined #linux-sunxi
Sensu_Bean has quit [Read error: Connection reset by peer]
Sensu_Bean has joined #linux-sunxi
Sensu_Be1 has quit [Ping timeout: 480 seconds]
Sensu_Be1 has joined #linux-sunxi
Sensu_Bean has quit [Read error: Connection reset by peer]