Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CICD Tests #442

Open
wants to merge 10 commits into
base: next
Choose a base branch
from
Open

CICD Tests #442

wants to merge 10 commits into from

Conversation

manorit2001
Copy link
Contributor

Please do not submit a Pull Request via github. Our project makes use of
mailing lists for patch submission and review. For more details please
see https://u-boot.readthedocs.io/en/latest/develop/sending_patches.html

The only exception to this is in order to trigger a CI loop on Azure prior
to posting of patches.

@manorit2001 manorit2001 force-pushed the b4/upstream/rfc/firewalling branch 2 times, most recently from 5ea2827 to 51c6bcf Compare November 13, 2023 08:05
manorit2001 added a commit to manorit2001/u-boot that referenced this pull request Nov 13, 2023
@manorit2001
ATF and OP-TEE Firewalling for K3 devices.
e78d75f 
K3 devices have firewalls that are used to prevent illegal accesses to
memory regions that are deemed secure. The series prevents the illegal
accesses to ATF and OP-TEE regions that are present in different K3
devices. 

AM62X, AM62AX and AM64X are currently in hold due to some firewall
configurations that our System Controller (TIFS) needs to handle. 
The devices that are not configured with the firewalling nodes will not
be affected and can continue to work fine until the firewall nodes are
added so will be a non-blocking merge. 

Test Logs: https://gist.github.com/manorit2001/c929e6ccab03f55b3828896fbd04184b
CICD Run: u-boot#442

Cc: u-boot@lists.denx.de
To: Simon Glass <sjg@chromium.org>
To: Alper Nebi Yasak <alpernebiyasak@gmail.com>
To: Neha Malcom Francis <n-francis@ti.com>
To: Andrew Davis <afd@ti.com>
To: Vignesh Raghavendra <vigneshr@ti.com>
Cc: Udit Kumar <u-kumar1@ti.com>
Cc: Praneeth Bajjuri <praneeth@ti.com>
Cc: Kamlesh Gurudasani <kamlesh@ti.com>
Cc: Nishanth Menon <nm@ti.com>
Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com>

---
Changes in v5:

* Simon
- Change and improve the error message

- Fix the test case, wasn't working properly previously
- Link to v4: https://lore.kernel.org/r/20231011-binman-firewalling-v4-0-a08085d300e9@ti.com

--- b4-submit-tracking ---
# This section is used internally by b4 prep for tracking purposes.
{
  "series": {
    "revision": 5,
    "change-id": "20230724-binman-firewalling-65ecdb23ec0a",
    "base-branch": "upstream-next",
    "prefixes": [],
    "history": {
      "v1": [
        "20230905-binman-firewalling-v1-0-3894520bff8a@ti.com"
      ],
      "v2": [
        "20230926-binman-firewalling-v2-0-b1a084ec634d@ti.com"
      ],
      "v3": [
        "20231004-binman-firewalling-v3-0-e4a102324e1f@ti.com"
      ],
      "v4": [
        "20231011-binman-firewalling-v4-0-a08085d300e9@ti.com"
      ]
    }
  }
}
manorit2001 added a commit to manorit2001/u-boot that referenced this pull request Nov 13, 2023
@manorit2001
ATF and OP-TEE Firewalling for K3 devices.
c9a34cf 
K3 devices have firewalls that are used to prevent illegal accesses to
memory regions that are deemed secure. The series prevents the illegal
accesses to ATF and OP-TEE regions that are present in different K3
devices. 

AM62X, AM62AX and AM64X are currently in hold due to some firewall
configurations that our System Controller (TIFS) needs to handle. 
The devices that are not configured with the firewalling nodes will not
be affected and can continue to work fine until the firewall nodes are
added so will be a non-blocking merge. 

Test Logs: https://gist.github.com/manorit2001/c929e6ccab03f55b3828896fbd04184b
CICD Run: u-boot#442

Cc: u-boot@lists.denx.de
To: Simon Glass <sjg@chromium.org>
To: Alper Nebi Yasak <alpernebiyasak@gmail.com>
To: Neha Malcom Francis <n-francis@ti.com>
To: Andrew Davis <afd@ti.com>
To: Vignesh Raghavendra <vigneshr@ti.com>
Cc: Udit Kumar <u-kumar1@ti.com>
Cc: Praneeth Bajjuri <praneeth@ti.com>
Cc: Kamlesh Gurudasani <kamlesh@ti.com>
Cc: Nishanth Menon <nm@ti.com>
Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com>

---
Changes in v5:

* Simon
- Change and improve the error message

- Fix the test case, wasn't working properly previously
- Link to v4: https://lore.kernel.org/r/20231011-binman-firewalling-v4-0-a08085d300e9@ti.com

--- b4-submit-tracking ---
# This section is used internally by b4 prep for tracking purposes.
{
  "series": {
    "revision": 5,
    "change-id": "20230724-binman-firewalling-65ecdb23ec0a",
    "base-branch": "upstream-next",
    "prefixes": [],
    "history": {
      "v1": [
        "20230905-binman-firewalling-v1-0-3894520bff8a@ti.com"
      ],
      "v2": [
        "20230926-binman-firewalling-v2-0-b1a084ec634d@ti.com"
      ],
      "v3": [
        "20231004-binman-firewalling-v3-0-e4a102324e1f@ti.com"
      ],
      "v4": [
        "20231011-binman-firewalling-v4-0-a08085d300e9@ti.com"
      ]
    }
  }
}
manorit2001 added a commit to manorit2001/u-boot that referenced this pull request Nov 13, 2023
@manorit2001
ATF and OP-TEE Firewalling for K3 devices.
2951046 
K3 devices have firewalls that are used to prevent illegal accesses to
memory regions that are deemed secure. The series prevents the illegal
accesses to ATF and OP-TEE regions that are present in different K3
devices. 

AM62X, AM62AX and AM64X are currently in hold due to some firewall
configurations that our System Controller (TIFS) needs to handle. 
The devices that are not configured with the firewalling nodes will not
be affected and can continue to work fine until the firewall nodes are
added so will be a non-blocking merge. 

Test Logs: https://gist.github.com/manorit2001/c929e6ccab03f55b3828896fbd04184b
CICD Run: u-boot#442

Cc: u-boot@lists.denx.de
To: Simon Glass <sjg@chromium.org>
To: Alper Nebi Yasak <alpernebiyasak@gmail.com>
To: Neha Malcom Francis <n-francis@ti.com>
To: Andrew Davis <afd@ti.com>
To: Vignesh Raghavendra <vigneshr@ti.com>
Cc: Udit Kumar <u-kumar1@ti.com>
Cc: Praneeth Bajjuri <praneeth@ti.com>
Cc: Kamlesh Gurudasani <kamlesh@ti.com>
Cc: Nishanth Menon <nm@ti.com>
Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com>

---
Changes in v5:

* Simon
- Change and improve the error message

- Fix the test case, wasn't working properly previously
- Rebase on top of master
- Link to v4: https://lore.kernel.org/r/20231011-binman-firewalling-v4-0-a08085d300e9@ti.com

--- b4-submit-tracking ---
# This section is used internally by b4 prep for tracking purposes.
{
  "series": {
    "revision": 5,
    "change-id": "20230724-binman-firewalling-65ecdb23ec0a",
    "base-branch": "upstream-next",
    "prefixes": [],
    "history": {
      "v1": [
        "20230905-binman-firewalling-v1-0-3894520bff8a@ti.com"
      ],
      "v2": [
        "20230926-binman-firewalling-v2-0-b1a084ec634d@ti.com"
      ],
      "v3": [
        "20231004-binman-firewalling-v3-0-e4a102324e1f@ti.com"
      ],
      "v4": [
        "20231011-binman-firewalling-v4-0-a08085d300e9@ti.com"
      ]
    }
  }
}
manorit2001 added a commit to manorit2001/u-boot that referenced this pull request Dec 6, 2023
@manorit2001
ATF and OP-TEE Firewalling for K3 devices.
6d2f409 
K3 devices have firewalls that are used to prevent illegal accesses to
memory regions that are deemed secure. The series prevents the illegal
accesses to ATF and OP-TEE regions that are present in different K3
devices. 

AM62X, AM62AX and AM64X are currently in hold due to some firewall
configurations that our System Controller (TIFS) needs to handle. 
The devices that are not configured with the firewalling nodes will not
be affected and can continue to work fine until the firewall nodes are
added so will be a non-blocking merge. 

Test Logs: https://gist.github.com/manorit2001/c929e6ccab03f55b3828896fbd04184b
CICD Run: u-boot#442

Cc: u-boot@lists.denx.de
To: Simon Glass <sjg@chromium.org>
To: Alper Nebi Yasak <alpernebiyasak@gmail.com>
To: Neha Malcom Francis <n-francis@ti.com>
To: Andrew Davis <afd@ti.com>
To: Vignesh Raghavendra <vigneshr@ti.com>
Cc: Udit Kumar <u-kumar1@ti.com>
Cc: Praneeth Bajjuri <praneeth@ti.com>
Cc: Kamlesh Gurudasani <kamlesh@ti.com>
Cc: Nishanth Menon <nm@ti.com>
Cc: Thomas Richard <thomas.richard@bootlin.com>
Cc: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com>

---
Changes in v7:
- EDITME: describe what is new in this series revision.
- EDITME: use bulletpoints and terse descriptions.
- Link to v6: https://lore.kernel.org/r/20231206-binman-firewalling-v6-0-e7fce13a6dc1@ti.com

Changes in v6:
- Rebase on -next
- Link to v5: https://lore.kernel.org/r/20231113-binman-firewalling-v5-0-b3ba6f839606@ti.com

--- b4-submit-tracking ---
# This section is used internally by b4 prep for tracking purposes.
{
  "series": {
    "revision": 7,
    "change-id": "20230724-binman-firewalling-65ecdb23ec0a",
    "base-branch": "upstream-next",
    "prefixes": [],
    "history": {
      "v1": [
        "20230905-binman-firewalling-v1-0-3894520bff8a@ti.com"
      ],
      "v2": [
        "20230926-binman-firewalling-v2-0-b1a084ec634d@ti.com"
      ],
      "v3": [
        "20231004-binman-firewalling-v3-0-e4a102324e1f@ti.com"
      ],
      "v4": [
        "20231011-binman-firewalling-v4-0-a08085d300e9@ti.com"
      ],
      "v5": [
        "20231113-binman-firewalling-v5-0-b3ba6f839606@ti.com"
      ],
      "v6": [
        "20231206-binman-firewalling-v6-0-e7fce13a6dc1@ti.com"
      ]
    }
  }
}
@manorit2001 manorit2001 changed the base branch from master to next December 6, 2023 09:57
@manorit2001
ATF and OP-TEE Firewalling for K3 devices.
5d36b87 
K3 devices have firewalls that are used to prevent illegal accesses to
memory regions that are deemed secure. The series prevents the illegal
accesses to ATF and OP-TEE regions that are present in different K3
devices. 

AM62X, AM62AX and AM64X are currently in hold due to some firewall
configurations that our System Controller (TIFS) needs to handle. 
The devices that are not configured with the firewalling nodes will not
be affected and can continue to work fine until the firewall nodes are
added so will be a non-blocking merge. 

Test Logs: https://gist.github.com/manorit2001/c929e6ccab03f55b3828896fbd04184b
CICD Run: u-boot#442

Cc: u-boot@lists.denx.de
To: Simon Glass <sjg@chromium.org>
To: Alper Nebi Yasak <alpernebiyasak@gmail.com>
To: Neha Malcom Francis <n-francis@ti.com>
To: Andrew Davis <afd@ti.com>
To: Vignesh Raghavendra <vigneshr@ti.com>
Cc: Udit Kumar <u-kumar1@ti.com>
Cc: Praneeth Bajjuri <praneeth@ti.com>
Cc: Kamlesh Gurudasani <kamlesh@ti.com>
Cc: Nishanth Menon <nm@ti.com>
Cc: Thomas Richard <thomas.richard@bootlin.com>
Cc: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com>

---
Changes in v7:

* Andrew
- Update documentation
- Incorporate templating 

* Simon
- Change the prefix for -binman.dtsi files

* Jon
- Remove the unintentional dependency on python3.9+
  (https://lore.kernel.org/all/CADL8D3ZWoZpMidBTy+iSs-KOB6+LRAFVcDa-n_fVqvd00Z0=nw@mail.gmail.com/)

- Add another patch to fix templating framework with firewalling.
- Change headings level for secure boot documentation
- Populate 3 priv id slots for the background firewalls that require it
- Link to v6: https://lore.kernel.org/r/20231206-binman-firewalling-v6-0-e7fce13a6dc1@ti.com

--- b4-submit-tracking ---
# This section is used internally by b4 prep for tracking purposes.
{
  "series": {
    "revision": 7,
    "change-id": "20230724-binman-firewalling-65ecdb23ec0a",
    "base-branch": "upstream-next",
    "prefixes": [],
    "history": {
      "v1": [
        "20230905-binman-firewalling-v1-0-3894520bff8a@ti.com"
      ],
      "v2": [
        "20230926-binman-firewalling-v2-0-b1a084ec634d@ti.com"
      ],
      "v3": [
        "20231004-binman-firewalling-v3-0-e4a102324e1f@ti.com"
      ],
      "v4": [
        "20231011-binman-firewalling-v4-0-a08085d300e9@ti.com"
      ],
      "v5": [
        "20231113-binman-firewalling-v5-0-b3ba6f839606@ti.com"
      ],
      "v6": [
        "20231206-binman-firewalling-v6-0-e7fce13a6dc1@ti.com"
      ]
    }
  }
}
manorit2001 added a commit to manorit2001/u-boot that referenced this pull request Dec 29, 2023
@manorit2001
ATF and OP-TEE Firewalling for K3 devices.
d1115ff 
K3 devices have firewalls that are used to prevent illegal accesses to
memory regions that are deemed secure. The series prevents the illegal
accesses to ATF and OP-TEE regions that are present in different K3
devices. 

AM62X, AM62AX and AM64X are currently in hold due to some firewall
configurations that our System Controller (TIFS) needs to handle. 
The devices that are not configured with the firewalling nodes will not
be affected and can continue to work fine until the firewall nodes are
added so will be a non-blocking merge. 

Test Logs: https://gist.github.com/manorit2001/c929e6ccab03f55b3828896fbd04184b
CICD Run: u-boot#442

Cc: u-boot@lists.denx.de
To: Simon Glass <sjg@chromium.org>
To: Alper Nebi Yasak <alpernebiyasak@gmail.com>
To: Neha Malcom Francis <n-francis@ti.com>
To: Andrew Davis <afd@ti.com>
To: Vignesh Raghavendra <vigneshr@ti.com>
Cc: Udit Kumar <u-kumar1@ti.com>
Cc: Praneeth Bajjuri <praneeth@ti.com>
Cc: Kamlesh Gurudasani <kamlesh@ti.com>
Cc: Nishanth Menon <nm@ti.com>
Cc: Thomas Richard <thomas.richard@bootlin.com>
Cc: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com>

---
Changes in v7:
- EDITME: TODO: update documentation
- Incorporate templating 
- Link to v6: https://lore.kernel.org/r/20231206-binman-firewalling-v6-0-e7fce13a6dc1@ti.com

--- b4-submit-tracking ---
# This section is used internally by b4 prep for tracking purposes.
{
  "series": {
    "revision": 7,
    "change-id": "20230724-binman-firewalling-65ecdb23ec0a",
    "base-branch": "upstream-next",
    "prefixes": [],
    "history": {
      "v1": [
        "20230905-binman-firewalling-v1-0-3894520bff8a@ti.com"
      ],
      "v2": [
        "20230926-binman-firewalling-v2-0-b1a084ec634d@ti.com"
      ],
      "v3": [
        "20231004-binman-firewalling-v3-0-e4a102324e1f@ti.com"
      ],
      "v4": [
        "20231011-binman-firewalling-v4-0-a08085d300e9@ti.com"
      ],
      "v5": [
        "20231113-binman-firewalling-v5-0-b3ba6f839606@ti.com"
      ],
      "v6": [
        "20231206-binman-firewalling-v6-0-e7fce13a6dc1@ti.com"
      ]
    }
  }
}
@manorit2001
dtoc: Change dst to self in debug message
edb9c14 
Fix the error message to not use dst and use self as it is copying the
properties to self.

While using templating if there are no subnodes defined, we end up in
this situation where "dst" isn't defined and it tries to print the error
message and fails.

'UnboundLocalError: local variable 'dst' referenced before assignment'

Fixes: 55e1278 ("dtoc: Allow inserting a list of nodes into another")

Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com>
@manorit2001
binman: ti-secure: Add support for firewalling entities
215ff34 
We can now firewall entities while loading them through our secure
entity TIFS, the required information should be present in the
certificate that is being parsed by TIFS.

The following commit adds the support to enable the certificates to be
generated if the firewall configurations are present in the binman dtsi
nodes.

Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com>
@manorit2001
binman: ftest: Add test for ti-secure firewall node
00fd1e7 
Add test for TI firewalling node in ti-secure.

Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com>
@manorit2001
arm: dts: k3-binman: Add k3-security.h and include it in k3-binman.dtsi
17a8387 
For readability during configuring firewalls, adding k3-security.h file
and including it in k3-binman.dtsi to be accessible across K3 SoCs

Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com>
@manorit2001
arm: dts: k3-j721e-binman: Add firewall configurations
29ec71a 
The following commits adds the configuration of firewalls required to
protect ATF and OP-TEE memory region from non-secure reads and
writes using master and slave firewalls present in our K3 SOCs.

Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com>
@manorit2001
arm: dts: k3-j721s2-binman: Add firewall configurations
093f4e1 
The following commits adds the configuration of firewalls required to
protect ATF and OP-TEE memory region from non-secure reads and
writes using master and slave firewalls present in our K3 SOCs.

Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com>
@manorit2001
arm: dts: k3-j7200-binman: Add firewall configurations
dcf79a0 
The following commits adds the configuration of firewalls required to
protect ATF and OP-TEE memory region from non-secure reads and
writes using master and slave firewalls present in our K3 SOCs.

Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com>
@manorit2001
docs: board: ti: k3: Cleanup FIT signature documentation
224e033 
The previous documentation had been very crude so refactor it to make it
cleaner and concise.

Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com>
@manorit2001
docs: board: ti: k3: Add secure booting documentation
3a0f1de 
This commit adds a general flow to explain the usage of firewalls and
the chain of trust in K3 devices.

Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com>
trini added a commit to trini/u-boot that referenced this pull request Jan 4, 2024
@trini
Merge patch series "ATF and OP-TEE Firewalling for K3 devices."
0d53be7 
Manorit Chawdhry <m-chawdhry@ti.com> says:

K3 devices have firewalls that are used to prevent illegal accesses to
memory regions that are deemed secure. The series prevents the illegal
accesses to ATF and OP-TEE regions that are present in different K3
devices.

AM62X, AM62AX and AM64X are currently in hold due to some firewall
configurations that our System Controller (TIFS) needs to handle.
The devices that are not configured with the firewalling nodes will not
be affected and can continue to work fine until the firewall nodes are
added so will be a non-blocking merge.

Test Logs: https://gist.github.com/manorit2001/4cead2fb3a19eb5d19005b3f54682627
CICD Run: u-boot/u-boot#442
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
1 participant
@manorit2001