What is the proper procedure to secure a bootloader build for the DK1?
I've attempted to build my own u-boot image based on the trusted defconfig and a dk1 device tree, i.e.
$ make stm32mp15_basic_defconfig
$ make DEVICE_TREE=stm32mp157a-dk1 allThe build worked successfully, however when I attempted to use the `u-boot.stm32` image it failed to flash/boot. Getting the older fsbl working to flash my image into the ssbl ended up with failing messages:
stm32_smc: Failed to exec in secure mode (err = -3)
stm32_smc: Failed to exec in secure mode (err = -3)
stm32_smc: Failed to exec in secure mode (err = -3)
stm32_smc: Failed to exec in secure mode (err = -3)
stpmic1_read: failed to read register 0x22 : -110stpmic1_read: failed to read register 0x22 : -110stpmic1_read: failed to read register 0x22 : -110stpmic1_read: failed to read register 0x22 : -110Can't enable vdda-supply: -110
stpmic1_read: failed to read register 0x22 : -110stpmic1_read: failed to read register 0x22 : -110stpmic1_read: failed to read register 0x22 : -110stpmic1_read: failed to read register 0x22 : -110Can't enable vdda-supply: -110Clearly the build wasn't secure so it couldn't be booted. I attempted to fix this via the STM32MP_KeyGen_CLI.exe and STM32MP_SigningTool_CLI.exe. I generated keys based on a test password that I created, then signed my u-boot image and flashed that instead.
After flashing, I attempted to boot and ran into a different error:
NFO: PMIC version = 0x10
INFO: Using SDMMC
INFO: Instance 1
INFO: Boot used partition fsbl1
NOTICE: BL2: v2.2-r2.0(debug):v2.2-dirty
NOTICE: BL2: Built : 13:36:23, Oct 22 2019
INFO: Using crypto library 'stm32_crypto_lib'
INFO: BL2: Doing platform setup
INFO: RAM: DDR3-DDR3L 16bits 533000Khz
INFO: Memory size = 0x20000000 (512 MB)
INFO: BL2 runs SP_MIN setup
INFO: BL2: Loading image id 4
INFO: Loading image id=4 at address 0x2ffeb000
INFO: Image id=4 loaded: 0x2ffeb000 - 0x2ffff000
INFO: BL2: Loading image id 5
INFO: Loading image id=5 at address 0xc0100000
INFO: STM32 Image size : 810794
INFO: Image id=5 loaded: 0xc0100000 - 0xc01c5f2a
INFO: Check signature on Open deviceBasically the DK hangs here at "check signature". I'm guessing because I generated it incorrectly somehow, or it was looking for something specific.
Are there any instructions on the correct way to "sign" a u-boot image to be used by the DK1?
Thanks.
-Mike