diff mbox series

binman: Fill in most of the imx8mimage and imx8mcst tests

Message ID 20250105203714.158480-1-marex@denx.de
State New
Delegated to: Fabio Estevam
Headers show
Series binman: Fill in most of the imx8mimage and imx8mcst tests | expand

Commit Message

Marek Vasut Jan. 5, 2025, 8:36 p.m. UTC
Rename the test .dts and tests and include the M suffix to indicate
those tests are for i.MX8M, not for i.MX8, which is a different SoC.

Update 339_nxp_imx8m.dts, add testNxpImx8MImageMkimageMissing and
update nxp_imx8mimage.py test to bring nxp_imx8mimage test to 100% .

Add 343..345_nxp_imx8m.dts, add matching tests and update nxp_imx8mcst.py
to bring CST tests to 97% . It is not clear how to test the CST output
file to reach 100%.

Signed-off-by: Marek Vasut <marex@denx.de>
---
Cc: Brian Ruley <brian.ruley@gehealthcare.com>
Cc: Paul HENRYS <paul.henrys_ext@softathome.com>
Cc: Rasmus Villemoes <ravi@prevas.dk>
Cc: Simon Glass <sjg@chromium.org>
Cc: Tim Harvey <tharvey@gateworks.com>
Cc: Tom Rini <trini@konsulko.com>
Cc: u-boot@lists.denx.de
---
 tools/binman/etype/nxp_imx8mcst.py            |  4 --
 tools/binman/etype/nxp_imx8mimage.py          |  4 --
 tools/binman/ftest.py                         | 42 +++++++++++++++++--
 .../{339_nxp_imx8.dts => 339_nxp_imx8m.dts}   |  3 ++
 tools/binman/test/343_nxp_imx8m.dts           | 26 ++++++++++++
 tools/binman/test/344_nxp_imx8m.dts           | 28 +++++++++++++
 tools/binman/test/345_nxp_imx8m.dts           | 19 +++++++++
 7 files changed, 115 insertions(+), 11 deletions(-)
 rename tools/binman/test/{339_nxp_imx8.dts => 339_nxp_imx8m.dts} (93%)
 create mode 100644 tools/binman/test/343_nxp_imx8m.dts
 create mode 100644 tools/binman/test/344_nxp_imx8m.dts
 create mode 100644 tools/binman/test/345_nxp_imx8m.dts

Comments

Simon Glass Jan. 6, 2025, 2:38 p.m. UTC | #1
Hi Marek,

On Sun, 5 Jan 2025 at 13:37, Marek Vasut <marex@denx.de> wrote:
>
> Rename the test .dts and tests and include the M suffix to indicate
> those tests are for i.MX8M, not for i.MX8, which is a different SoC.
>
> Update 339_nxp_imx8m.dts, add testNxpImx8MImageMkimageMissing and
> update nxp_imx8mimage.py test to bring nxp_imx8mimage test to 100% .
>
> Add 343..345_nxp_imx8m.dts, add matching tests and update nxp_imx8mcst.py
> to bring CST tests to 97% . It is not clear how to test the CST output
> file to reach 100%.
>
> Signed-off-by: Marek Vasut <marex@denx.de>
> ---
> Cc: Brian Ruley <brian.ruley@gehealthcare.com>
> Cc: Paul HENRYS <paul.henrys_ext@softathome.com>
> Cc: Rasmus Villemoes <ravi@prevas.dk>
> Cc: Simon Glass <sjg@chromium.org>
> Cc: Tim Harvey <tharvey@gateworks.com>
> Cc: Tom Rini <trini@konsulko.com>
> Cc: u-boot@lists.denx.de
> ---
>  tools/binman/etype/nxp_imx8mcst.py            |  4 --
>  tools/binman/etype/nxp_imx8mimage.py          |  4 --
>  tools/binman/ftest.py                         | 42 +++++++++++++++++--
>  .../{339_nxp_imx8.dts => 339_nxp_imx8m.dts}   |  3 ++
>  tools/binman/test/343_nxp_imx8m.dts           | 26 ++++++++++++
>  tools/binman/test/344_nxp_imx8m.dts           | 28 +++++++++++++
>  tools/binman/test/345_nxp_imx8m.dts           | 19 +++++++++
>  7 files changed, 115 insertions(+), 11 deletions(-)
>  rename tools/binman/test/{339_nxp_imx8.dts => 339_nxp_imx8m.dts} (93%)
>  create mode 100644 tools/binman/test/343_nxp_imx8m.dts
>  create mode 100644 tools/binman/test/344_nxp_imx8m.dts
>  create mode 100644 tools/binman/test/345_nxp_imx8m.dts
>

Thanks for looking at this! For me I get an error when applying to -next:

$binman test
======================== Running binman tests ========================
............................................................................................................................................................................................................................................................................E................................E.................................E.....................................................................................................................E...............................................................................................................................
======================================================================
ERROR: binman.ftest.TestFunctional.testNxpImx8MCSTSPL (subunit.RemotedTestCase)
binman.ftest.TestFunctional.testNxpImx8MCSTSPL
----------------------------------------------------------------------
testtools.testresult.real._StringException: Traceback (most recent call last):
ValueError: Error 1 running 'cst -i
/tmp/binman.kv3d4uif/nxp.csf-config-txt.nxp-imx8mcst -o
/tmp/binman.kv3d4uif/nxp.csf-output-blob.nxp-imx8mcst': Install SRK
File not present SRK_1_2_3_4_table.bin


======================================================================
ERROR: binman.ftest.TestFunctional.testNxpImx8MCSTFIT (subunit.RemotedTestCase)
binman.ftest.TestFunctional.testNxpImx8MCSTFIT
----------------------------------------------------------------------
testtools.testresult.real._StringException: Traceback (most recent call last):
ValueError: Error 1 running 'cst -i
/tmp/binman.jh5hnl3s/nxp.csf-config-txt.nxp-imx8mcst -o
/tmp/binman.jh5hnl3s/nxp.csf-output-blob.nxp-imx8mcst': Install SRK
File not present SRK_1_2_3_4_table.bin


======================================================================
ERROR: binman.ftest.TestFunctional.testSimpleFitEncryptedData
(subunit.RemotedTestCase)
binman.ftest.TestFunctional.testSimpleFitEncryptedData
----------------------------------------------------------------------
testtools.testresult.real._StringException: Traceback (most recent call last):
KeyError: 'iv'


======================================================================
ERROR: binman.ftest.TestFunctional.testNxpImx8MCSTMkimageMissing
(subunit.RemotedTestCase)
binman.ftest.TestFunctional.testNxpImx8MCSTMkimageMissing
----------------------------------------------------------------------
testtools.testresult.real._StringException: Traceback (most recent call last):
struct.error: unpack requires a buffer of 4 bytes


----------------------------------------------------------------------
Ran 581 tests in 1.784s

FAILED (errors=4)


I wonder if the cst needs to be updated (binman tool -f cst)? At
present it is using apt-get and has:

$ dpkg -l imx-code-signing-tool
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                  Version             Architecture Description
+++-=====================-===================-============-===================================
ii  imx-code-signing-tool 3.3.1+dfsg-2ubuntu1 amd64        code
signing tool for i.MX platform

Regards,
SImon
Marek Vasut Jan. 6, 2025, 8:50 p.m. UTC | #2
On 1/6/25 3:38 PM, Simon Glass wrote:

[...]

> I wonder if the cst needs to be updated (binman tool -f cst)? At
> present it is using apt-get and has:
> 
> $ dpkg -l imx-code-signing-tool
> Desired=Unknown/Install/Remove/Purge/Hold
> | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
> |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
> ||/ Name                  Version             Architecture Description
> +++-=====================-===================-============-===================================
> ii  imx-code-signing-tool 3.3.1+dfsg-2ubuntu1 amd64        code
> signing tool for i.MX platform
Perhaps. Can you suggest a fix ?

I am also unsure how to get the CST test to 100%.

I still don't fully understand what exactly are these tests testing or 
whether they are even valid.
Simon Glass Jan. 7, 2025, 3:50 a.m. UTC | #3
Hi Marek,

On Mon, 6 Jan 2025 at 13:51, Marek Vasut <marex@denx.de> wrote:
>
> On 1/6/25 3:38 PM, Simon Glass wrote:
>
> [...]
>
> > I wonder if the cst needs to be updated (binman tool -f cst)? At
> > present it is using apt-get and has:
> >
> > $ dpkg -l imx-code-signing-tool
> > Desired=Unknown/Install/Remove/Purge/Hold
> > | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
> > |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
> > ||/ Name                  Version             Architecture Description
> > +++-=====================-===================-============-===================================
> > ii  imx-code-signing-tool 3.3.1+dfsg-2ubuntu1 amd64        code
> > signing tool for i.MX platform
> Perhaps. Can you suggest a fix ?
>
> I am also unsure how to get the CST test to 100%.
>
> I still don't fully understand what exactly are these tests testing or
> whether they are even valid.

Well, if I could run the test and have it pass (like presumably you
do) then I could suggest something. Could you point me to a cst binary
which works for you and makes your tests pass?

Regards,
Simon
Marek Vasut Jan. 7, 2025, 10:39 a.m. UTC | #4
On 1/7/25 4:50 AM, Simon Glass wrote:
> Hi Marek,
> 
> On Mon, 6 Jan 2025 at 13:51, Marek Vasut <marex@denx.de> wrote:
>>
>> On 1/6/25 3:38 PM, Simon Glass wrote:
>>
>> [...]
>>
>>> I wonder if the cst needs to be updated (binman tool -f cst)? At
>>> present it is using apt-get and has:
>>>
>>> $ dpkg -l imx-code-signing-tool
>>> Desired=Unknown/Install/Remove/Purge/Hold
>>> | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
>>> |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
>>> ||/ Name                  Version             Architecture Description
>>> +++-=====================-===================-============-===================================
>>> ii  imx-code-signing-tool 3.3.1+dfsg-2ubuntu1 amd64        code
>>> signing tool for i.MX platform
>> Perhaps. Can you suggest a fix ?
>>
>> I am also unsure how to get the CST test to 100%.
>>
>> I still don't fully understand what exactly are these tests testing or
>> whether they are even valid.
> 
> Well, if I could run the test and have it pass (like presumably you
> do) then I could suggest something. Could you point me to a cst binary
> which works for you and makes your tests pass?
CST 3.4.0 from debian/testing works with real hardware.
Simon Glass Jan. 9, 2025, 2:10 p.m. UTC | #5
Hi Marek,

On Tue, 7 Jan 2025 at 04:24, Marek Vasut <marex@denx.de> wrote:
>
> On 1/7/25 4:50 AM, Simon Glass wrote:
> > Hi Marek,
> >
> > On Mon, 6 Jan 2025 at 13:51, Marek Vasut <marex@denx.de> wrote:
> >>
> >> On 1/6/25 3:38 PM, Simon Glass wrote:
> >>
> >> [...]
> >>
> >>> I wonder if the cst needs to be updated (binman tool -f cst)? At
> >>> present it is using apt-get and has:
> >>>
> >>> $ dpkg -l imx-code-signing-tool
> >>> Desired=Unknown/Install/Remove/Purge/Hold
> >>> | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
> >>> |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
> >>> ||/ Name                  Version             Architecture Description
> >>> +++-=====================-===================-============-===================================
> >>> ii  imx-code-signing-tool 3.3.1+dfsg-2ubuntu1 amd64        code
> >>> signing tool for i.MX platform
> >> Perhaps. Can you suggest a fix ?
> >>
> >> I am also unsure how to get the CST test to 100%.
> >>
> >> I still don't fully understand what exactly are these tests testing or
> >> whether they are even valid.
> >
> > Well, if I could run the test and have it pass (like presumably you
> > do) then I could suggest something. Could you point me to a cst binary
> > which works for you and makes your tests pass?
> CST 3.4.0 from debian/testing works with real hardware.

Unfortunately after much messing around I cannot install this on my
machine (jammy). I do plan to upgrade to Noble at some point. But we
cannot rely on people having a particular distro to build U-Boot
images. That is what 'binman tool' is supposed to fix.

I got the package source and tried that. The build instructions use
docker, which I have not mastered. The container needs curl but does
not have it.

I was able to build it from source code without docker. Is there a
public source-code repo somewhere, so Binman could build it?

Anyway, with this patch applied and the new cst:

$ binman test testNxpImx8MCSTSPL
======================== Running binman tests ========================
E
======================================================================
ERROR: binman.ftest.TestFunctional.testNxpImx8MCSTSPL (subunit.RemotedTestCase)
binman.ftest.TestFunctional.testNxpImx8MCSTSPL
----------------------------------------------------------------------
testtools.testresult.real._StringException: Traceback (most recent call last):
ValueError: Error 1 running 'cst -i
/tmp/binman.t45m9_fv/nxp.csf-config-txt.nxp-imx8mcst -o
/tmp/binman.t45m9_fv/nxp.csf-output-blob.nxp-imx8mcst': File not
present SRK_1_2_3_4_table.bin


----------------------------------------------------------------------
Ran 1 test in 0.151s

FAILED (errors=1)

So where is the SRK_1_2_3_4_table.bin file?

Regards,
Simon
Fabio Estevam Jan. 10, 2025, 11:02 a.m. UTC | #6
Hi Simon,

On Thu, Jan 9, 2025 at 11:21 AM Simon Glass <sjg@chromium.org> wrote:

> I was able to build it from source code without docker. Is there a
> public source-code repo somewhere, so Binman could build it?

Yes, there is:

https://gitlab.apertis.org/pkg/imx-code-signing-tool/-/tree/debian/3.4.0+dfsg-2?ref_type=tags
Marek Vasut Feb. 5, 2025, 10:19 a.m. UTC | #7
On 1/9/25 3:10 PM, Simon Glass wrote:
> Hi Marek,
> 
> On Tue, 7 Jan 2025 at 04:24, Marek Vasut <marex@denx.de> wrote:
>>
>> On 1/7/25 4:50 AM, Simon Glass wrote:
>>> Hi Marek,
>>>
>>> On Mon, 6 Jan 2025 at 13:51, Marek Vasut <marex@denx.de> wrote:
>>>>
>>>> On 1/6/25 3:38 PM, Simon Glass wrote:
>>>>
>>>> [...]
>>>>
>>>>> I wonder if the cst needs to be updated (binman tool -f cst)? At
>>>>> present it is using apt-get and has:
>>>>>
>>>>> $ dpkg -l imx-code-signing-tool
>>>>> Desired=Unknown/Install/Remove/Purge/Hold
>>>>> | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
>>>>> |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
>>>>> ||/ Name                  Version             Architecture Description
>>>>> +++-=====================-===================-============-===================================
>>>>> ii  imx-code-signing-tool 3.3.1+dfsg-2ubuntu1 amd64        code
>>>>> signing tool for i.MX platform
>>>> Perhaps. Can you suggest a fix ?
>>>>
>>>> I am also unsure how to get the CST test to 100%.
>>>>
>>>> I still don't fully understand what exactly are these tests testing or
>>>> whether they are even valid.
>>>
>>> Well, if I could run the test and have it pass (like presumably you
>>> do) then I could suggest something. Could you point me to a cst binary
>>> which works for you and makes your tests pass?
>> CST 3.4.0 from debian/testing works with real hardware.
> 
> Unfortunately after much messing around I cannot install this on my
> machine (jammy). I do plan to upgrade to Noble at some point. But we
> cannot rely on people having a particular distro to build U-Boot
> images. That is what 'binman tool' is supposed to fix.
> 
> I got the package source and tried that. The build instructions use
> docker, which I have not mastered. The container needs curl but does
> not have it.
> 
> I was able to build it from source code without docker. Is there a
> public source-code repo somewhere, so Binman could build it?
> 
> Anyway, with this patch applied and the new cst:
> 
> $ binman test testNxpImx8MCSTSPL
> ======================== Running binman tests ========================
> E
> ======================================================================
> ERROR: binman.ftest.TestFunctional.testNxpImx8MCSTSPL (subunit.RemotedTestCase)
> binman.ftest.TestFunctional.testNxpImx8MCSTSPL
> ----------------------------------------------------------------------
> testtools.testresult.real._StringException: Traceback (most recent call last):
> ValueError: Error 1 running 'cst -i
> /tmp/binman.t45m9_fv/nxp.csf-config-txt.nxp-imx8mcst -o
> /tmp/binman.t45m9_fv/nxp.csf-output-blob.nxp-imx8mcst': File not
> present SRK_1_2_3_4_table.bin
> 
> 
> ----------------------------------------------------------------------
> Ran 1 test in 0.151s
> 
> FAILED (errors=1)
> 
> So where is the SRK_1_2_3_4_table.bin file?
See the tool documentation:

https://gitlab.apertis.org/pkg/imx-code-signing-tool/-/blob/debian/3.4.0+dfsg-2/docs/CST_UG.pdf?ref_type=tags

3.1.2 Running the hab4_pki_tree script Example
3.1.2.1 Running the hab4_pki_tree script in interactive mode

The hab4_pki_tree.sh script should generate all those files.
Simon Glass Feb. 6, 2025, 12:42 p.m. UTC | #8
Hi,

On Wed, 5 Feb 2025 at 03:20, Marek Vasut <marex@denx.de> wrote:
>
> On 1/9/25 3:10 PM, Simon Glass wrote:
> > Hi Marek,
> >
> > On Tue, 7 Jan 2025 at 04:24, Marek Vasut <marex@denx.de> wrote:
> >>
> >> On 1/7/25 4:50 AM, Simon Glass wrote:
> >>> Hi Marek,
> >>>
> >>> On Mon, 6 Jan 2025 at 13:51, Marek Vasut <marex@denx.de> wrote:
> >>>>
> >>>> On 1/6/25 3:38 PM, Simon Glass wrote:
> >>>>
> >>>> [...]
> >>>>
> >>>>> I wonder if the cst needs to be updated (binman tool -f cst)? At
> >>>>> present it is using apt-get and has:
> >>>>>
> >>>>> $ dpkg -l imx-code-signing-tool
> >>>>> Desired=Unknown/Install/Remove/Purge/Hold
> >>>>> | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
> >>>>> |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
> >>>>> ||/ Name                  Version             Architecture Description
> >>>>> +++-=====================-===================-============-===================================
> >>>>> ii  imx-code-signing-tool 3.3.1+dfsg-2ubuntu1 amd64        code
> >>>>> signing tool for i.MX platform
> >>>> Perhaps. Can you suggest a fix ?
> >>>>
> >>>> I am also unsure how to get the CST test to 100%.
> >>>>
> >>>> I still don't fully understand what exactly are these tests testing or
> >>>> whether they are even valid.
> >>>
> >>> Well, if I could run the test and have it pass (like presumably you
> >>> do) then I could suggest something. Could you point me to a cst binary
> >>> which works for you and makes your tests pass?
> >> CST 3.4.0 from debian/testing works with real hardware.
> >
> > Unfortunately after much messing around I cannot install this on my
> > machine (jammy). I do plan to upgrade to Noble at some point. But we
> > cannot rely on people having a particular distro to build U-Boot
> > images. That is what 'binman tool' is supposed to fix.
> >
> > I got the package source and tried that. The build instructions use
> > docker, which I have not mastered. The container needs curl but does
> > not have it.
> >
> > I was able to build it from source code without docker. Is there a
> > public source-code repo somewhere, so Binman could build it?
> >
> > Anyway, with this patch applied and the new cst:
> >
> > $ binman test testNxpImx8MCSTSPL
> > ======================== Running binman tests ========================
> > E
> > ======================================================================
> > ERROR: binman.ftest.TestFunctional.testNxpImx8MCSTSPL (subunit.RemotedTestCase)
> > binman.ftest.TestFunctional.testNxpImx8MCSTSPL
> > ----------------------------------------------------------------------
> > testtools.testresult.real._StringException: Traceback (most recent call last):
> > ValueError: Error 1 running 'cst -i
> > /tmp/binman.t45m9_fv/nxp.csf-config-txt.nxp-imx8mcst -o
> > /tmp/binman.t45m9_fv/nxp.csf-output-blob.nxp-imx8mcst': File not
> > present SRK_1_2_3_4_table.bin
> >
> >
> > ----------------------------------------------------------------------
> > Ran 1 test in 0.151s
> >
> > FAILED (errors=1)
> >
> > So where is the SRK_1_2_3_4_table.bin file?
> See the tool documentation:
>
> https://gitlab.apertis.org/pkg/imx-code-signing-tool/-/blob/debian/3.4.0+dfsg-2/docs/CST_UG.pdf?ref_type=tags
>
> 3.1.2 Running the hab4_pki_tree script Example
> 3.1.2.1 Running the hab4_pki_tree script in interactive mode
>
> The hab4_pki_tree.sh script should generate all those files.

But with binman we want to avoid vendor scripts, etc.

Could someone take a look at updating tools/binman/btool/cst.py or
similar to build the tool from source? There are examples of others
that do this, e.g. bootgen.py

Regards,
SImon
Marek Vasut Feb. 6, 2025, 8:40 p.m. UTC | #9
On 2/6/25 1:42 PM, Simon Glass wrote:

Hi,

>>> FAILED (errors=1)
>>>
>>> So where is the SRK_1_2_3_4_table.bin file?
>> See the tool documentation:
>>
>> https://gitlab.apertis.org/pkg/imx-code-signing-tool/-/blob/debian/3.4.0+dfsg-2/docs/CST_UG.pdf?ref_type=tags
>>
>> 3.1.2 Running the hab4_pki_tree script Example
>> 3.1.2.1 Running the hab4_pki_tree script in interactive mode
>>
>> The hab4_pki_tree.sh script should generate all those files.
> 
> But with binman we want to avoid vendor scripts, etc.

I believe the script internally runs openssl to generate that file.

> Could someone take a look at updating tools/binman/btool/cst.py or
> similar to build the tool from source? There are examples of others
> that do this, e.g. bootgen.py
Is this relevant to finalizing this patch ?
Simon Glass Feb. 7, 2025, 12:49 a.m. UTC | #10
Hi Marek,

On Thu, 6 Feb 2025 at 13:52, Marek Vasut <marex@denx.de> wrote:
>
> On 2/6/25 1:42 PM, Simon Glass wrote:
>
> Hi,
>
> >>> FAILED (errors=1)
> >>>
> >>> So where is the SRK_1_2_3_4_table.bin file?
> >> See the tool documentation:
> >>
> >> https://gitlab.apertis.org/pkg/imx-code-signing-tool/-/blob/debian/3.4.0+dfsg-2/docs/CST_UG.pdf?ref_type=tags
> >>
> >> 3.1.2 Running the hab4_pki_tree script Example
> >> 3.1.2.1 Running the hab4_pki_tree script in interactive mode
> >>
> >> The hab4_pki_tree.sh script should generate all those files.
> >
> > But with binman we want to avoid vendor scripts, etc.
>
> I believe the script internally runs openssl to generate that file.
>
> > Could someone take a look at updating tools/binman/btool/cst.py or
> > similar to build the tool from source? There are examples of others
> > that do this, e.g. bootgen.py
> Is this relevant to finalizing this patch ?

Well, I don't see how the tests can pass if we can't build/run the tools needed.

Regards,
Simon
Marek Vasut Feb. 8, 2025, 9:19 p.m. UTC | #11
On 2/7/25 1:49 AM, Simon Glass wrote:
> Hi Marek,
> 
> On Thu, 6 Feb 2025 at 13:52, Marek Vasut <marex@denx.de> wrote:
>>
>> On 2/6/25 1:42 PM, Simon Glass wrote:
>>
>> Hi,
>>
>>>>> FAILED (errors=1)
>>>>>
>>>>> So where is the SRK_1_2_3_4_table.bin file?
>>>> See the tool documentation:
>>>>
>>>> https://gitlab.apertis.org/pkg/imx-code-signing-tool/-/blob/debian/3.4.0+dfsg-2/docs/CST_UG.pdf?ref_type=tags
>>>>
>>>> 3.1.2 Running the hab4_pki_tree script Example
>>>> 3.1.2.1 Running the hab4_pki_tree script in interactive mode
>>>>
>>>> The hab4_pki_tree.sh script should generate all those files.
>>>
>>> But with binman we want to avoid vendor scripts, etc.
>>
>> I believe the script internally runs openssl to generate that file.
>>
>>> Could someone take a look at updating tools/binman/btool/cst.py or
>>> similar to build the tool from source? There are examples of others
>>> that do this, e.g. bootgen.py
>> Is this relevant to finalizing this patch ?
> 
> Well, I don't see how the tests can pass if we can't build/run the tools needed.
Maybe you can try to use the shell scripts to generate the missing bin 
file ? I suspect the script does some openssl invocation, which can be 
reproduced in binman ?
Simon Glass Feb. 15, 2025, 1:38 p.m. UTC | #12
Hi Marek,

On Sat, 8 Feb 2025 at 14:27, Marek Vasut <marex@denx.de> wrote:
>
> On 2/7/25 1:49 AM, Simon Glass wrote:
> > Hi Marek,
> >
> > On Thu, 6 Feb 2025 at 13:52, Marek Vasut <marex@denx.de> wrote:
> >>
> >> On 2/6/25 1:42 PM, Simon Glass wrote:
> >>
> >> Hi,
> >>
> >>>>> FAILED (errors=1)
> >>>>>
> >>>>> So where is the SRK_1_2_3_4_table.bin file?
> >>>> See the tool documentation:
> >>>>
> >>>> https://gitlab.apertis.org/pkg/imx-code-signing-tool/-/blob/debian/3.4.0+dfsg-2/docs/CST_UG.pdf?ref_type=tags
> >>>>
> >>>> 3.1.2 Running the hab4_pki_tree script Example
> >>>> 3.1.2.1 Running the hab4_pki_tree script in interactive mode
> >>>>
> >>>> The hab4_pki_tree.sh script should generate all those files.
> >>>
> >>> But with binman we want to avoid vendor scripts, etc.
> >>
> >> I believe the script internally runs openssl to generate that file.
> >>
> >>> Could someone take a look at updating tools/binman/btool/cst.py or
> >>> similar to build the tool from source? There are examples of others
> >>> that do this, e.g. bootgen.py
> >> Is this relevant to finalizing this patch ?
> >
> > Well, I don't see how the tests can pass if we can't build/run the tools needed.
> Maybe you can try to use the shell scripts to generate the missing bin
> file ? I suspect the script does some openssl invocation, which can be
> reproduced in binman ?

But 'binman tool -f <toolname>' is supposed to build/fetch the tool.
So any such building should happen in that bintool.

One of the main goals of binman is to reduce the work needed to create
a working image. If people have to go spelunking around the Internet,
build it themselves, etc. that is not good.

Regards,
Simon
diff mbox series

Patch

diff --git a/tools/binman/etype/nxp_imx8mcst.py b/tools/binman/etype/nxp_imx8mcst.py
index dd9f226b751..c36a8f68971 100644
--- a/tools/binman/etype/nxp_imx8mcst.py
+++ b/tools/binman/etype/nxp_imx8mcst.py
@@ -181,10 +181,6 @@  class Entry_nxp_imx8mcst(Entry_mkimage):
         upto = 0x00
         for entry in super().GetEntries().values():
             entry.SetOffsetSize(upto, None)
-
-            # Give up if any entries lack a size
-            if entry.size is None:
-                return
             upto += entry.size
 
         Entry_section.SetImagePos(self, image_pos)
diff --git a/tools/binman/etype/nxp_imx8mimage.py b/tools/binman/etype/nxp_imx8mimage.py
index 8ad177b3b65..8d14e16154a 100644
--- a/tools/binman/etype/nxp_imx8mimage.py
+++ b/tools/binman/etype/nxp_imx8mimage.py
@@ -66,10 +66,6 @@  class Entry_nxp_imx8mimage(Entry_mkimage):
         upto = 0x00
         for entry in super().GetEntries().values():
             entry.SetOffsetSize(upto, None)
-
-            # Give up if any entries lack a size
-            if entry.size is None:
-                return
             upto += entry.size
 
         Entry_section.SetImagePos(self, image_pos)
diff --git a/tools/binman/ftest.py b/tools/binman/ftest.py
index a553ca9e564..467f24a85d5 100644
--- a/tools/binman/ftest.py
+++ b/tools/binman/ftest.py
@@ -7822,9 +7822,45 @@  fdt         fdtmap                Extract the devicetree blob from the fdtmap
         self.assertIn('Symbol-writing: no value for /binman/section/u-boot',
                       out)
 
-    def testNxpImx8Image(self):
-        """Test that binman can produce an iMX8 image"""
-        self._DoTestFile('339_nxp_imx8.dts')
+    def testNxpImx8MImage(self):
+        """Test that binman can produce an iMX8M image"""
+        self._DoTestFile('339_nxp_imx8m.dts')
+
+    def testNxpImx8MImageMkimageMissing(self):
+        """Test that binman can produce an iMX8M image"""
+        with test_util.capture_sys_output() as (_, stderr):
+            self._DoTestFile('339_nxp_imx8m.dts',
+                             force_missing_bintools='mkimage')
+        err = stderr.getvalue()
+        self.assertRegex(err, "Image 'image'.*missing bintools.*: mkimage")
+
+    def testNxpImx8MCSTSPL(self):
+        """Test that binman can sign an iMX8M SPL image"""
+        self._DoTestFile('343_nxp_imx8m.dts')
+
+    def testNxpImx8MCSTFIT(self):
+        """Test that binman can sign an iMX8M FIT image"""
+        self._DoTestFile('344_nxp_imx8m.dts')
+
+    def testNxpImx8MCSTUnknown(self):
+        """Test that binman can sign an iMX8M Unknown image"""
+        self._DoTestFile('345_nxp_imx8m.dts')
+
+    def testNxpImx8MCSTMkimageMissing(self):
+        """Test that binman can sign an iMX8M image"""
+        with test_util.capture_sys_output() as (_, stderr):
+            self._DoTestFile('343_nxp_imx8m.dts',
+                             force_missing_bintools='mkimage')
+        err = stderr.getvalue()
+        self.assertRegex(err, "Image 'image'.*missing bintools.*: mkimage")
+
+    def testNxpImx8MCSTtoolMissing(self):
+        """Test that binman can sign an iMX8M image"""
+        with test_util.capture_sys_output() as (_, stderr):
+            self._DoTestFile('343_nxp_imx8m.dts',
+                             force_missing_bintools='cst')
+        err = stderr.getvalue()
+        self.assertRegex(err, "Image 'image'.*missing bintools.*: cst")
 
     def testFitSignSimple(self):
         """Test that image with FIT and signature nodes can be signed"""
diff --git a/tools/binman/test/339_nxp_imx8.dts b/tools/binman/test/339_nxp_imx8m.dts
similarity index 93%
rename from tools/binman/test/339_nxp_imx8.dts
rename to tools/binman/test/339_nxp_imx8m.dts
index cb512ae9aa2..2c8f4bee5b7 100644
--- a/tools/binman/test/339_nxp_imx8.dts
+++ b/tools/binman/test/339_nxp_imx8m.dts
@@ -12,6 +12,9 @@ 
 			nxp,boot-from = "sd";
 			nxp,rom-version = <1>;
 			nxp,loader-address = <0x10>;
+
+			section {
+			};
 		};
 	};
 };
diff --git a/tools/binman/test/343_nxp_imx8m.dts b/tools/binman/test/343_nxp_imx8m.dts
new file mode 100644
index 00000000000..5e76a97641b
--- /dev/null
+++ b/tools/binman/test/343_nxp_imx8m.dts
@@ -0,0 +1,26 @@ 
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		nxp-imx8mcst {
+			args;	/* TODO: Needed by mkimage etype superclass */
+			nxp,loader-address = <0x12340000>;
+			nxp,unlock;
+
+			nxp-imx8mimage {
+				args;	/* TODO: Needed by mkimage etype superclass */
+				nxp,boot-from = "sd";
+				nxp,rom-version = <1>;
+				nxp,loader-address = <0x10>;
+
+				section {
+				};
+			};
+		};
+	};
+};
diff --git a/tools/binman/test/344_nxp_imx8m.dts b/tools/binman/test/344_nxp_imx8m.dts
new file mode 100644
index 00000000000..c38267bb815
--- /dev/null
+++ b/tools/binman/test/344_nxp_imx8m.dts
@@ -0,0 +1,28 @@ 
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		nxp-imx8mcst {
+			nxp,loader-address = <0x12340000>;
+			nxp,fast-auth;
+			offset = <0x58000>;
+			args;	/* Needed by mkimage etype superclass */
+
+			fit {
+				description = "test desc";
+				#address-cells = <1>;
+
+				images {
+				};
+
+				configurations {
+				};
+			};
+		};
+	};
+};
diff --git a/tools/binman/test/345_nxp_imx8m.dts b/tools/binman/test/345_nxp_imx8m.dts
new file mode 100644
index 00000000000..0ed6e3ca9d0
--- /dev/null
+++ b/tools/binman/test/345_nxp_imx8m.dts
@@ -0,0 +1,19 @@ 
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		nxp-imx8mcst {
+			nxp,loader-address = <0x12340000>;
+			offset = <0x58000>;
+			args;	/* Needed by mkimage etype superclass */
+
+			u-boot {
+			};
+		};
+	};
+};