U-boot proper signature is not verified by SPL on most platforms
even config SPL_FIT_SIGNATURE is enabled. Only fsl-layerscape
platform support secure boot in platform specific code. So
verified boot cannot be achieved if u-boot proper is loaded by
SPL.
This patch add signature verification to u-boot proper images
when loading FIT image in SPL. It is tested on Allwinner bananapi
zero board with H2+ SoC.
Signed-off-by: Jun Nie <jun.nie@linaro.org>
Thomas reported U-Boot failed to build host tools if libfdt-devel
package is installed because tools include libfdt headers from
/usr/include/ instead of using internal ones.
This commit moves the header code:
include/libfdt.h -> include/linux/libfdt.h
include/libfdt_env.h -> include/linux/libfdt_env.h
and replaces include directives:
#include <libfdt.h> -> #include <linux/libfdt.h>
#include <libfdt_env.h> -> #include <linux/libfdt_env.h>
Reported-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
For external data, FIT has a optional property "data-position" which
can set the external data to a fixed offset to FIT beginning.
Add the support for this property in SPL FIT.
Signed-off-by: Ye Li <ye.li@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Tomas Melin <tomas.melin@vaisala.com>
Cc: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Cc: "Andrew F. Davis" <afd@ti.com>
Cc: Igor Grinberg <grinberg@compulab.co.il>
Cc: "tomas.melin@vaisala.com" <tomas.melin@vaisala.com>
Cc: Kever Yang <kever.yang@rock-chips.com>
Cc: Andre Przywara <andre.przywara@arm.com>
Cc: York Sun <york.sun@nxp.com>
Cc: Lokesh Vutla <lokeshvutla@ti.com>
Cc: "Cooper Jr., Franklin" <fcooper@ti.com>
Cc: George McCollister <george.mccollister@gmail.com>
Cc: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
Cc: Jean-Jacques Hiblot <jjhiblot@ti.com>
Cc: Rick Altherr <raltherr@google.com>
Cc: Tom Rini <trini@konsulko.com>
Reviewed-by: Lokesh Vutla <lokeshvutla@ti.com>
Reviewed-by: York Sun <york.sun@nxp.com>
A minor code-size increase from the changes for tracking the os-type
of FIT images and from infrastructure for recording the loadables into
the the loaded FDT, broke the builds for sun50i and some OMAP2+ devices.
This change adds a new config option (enabled by default for
MACH_SUN50I, MACH_SUN50I_H5 and ARCH_OMAP2PLUS) that does skips these
processing steps (bringing code size down to below the limit
again). The os-type is not evaluated, but assumed to be IH_OS_UBOOT
(i.e. taking the code-paths intended for backward-compatibility).
Note that enabling this config option precludes any useful downstream
processing, such as utilising a special calling convention for ATF or
OPTEE, based on the os-type of the loadables.
Signed-off-by: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
If a FDT was loaded (e.g. to append it to U-Boot image), we store it's
address and record information for all loadables into this FDT. This
allows us to easily keep track of images for multiple privilege levels
(e.g. with ATF) or of firmware images preloaded into temporary
locations (e.g. PMU firmware that may overlap the SPL stage).
Signed-off-by: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
To better support bootin through an ATF or OPTEE, we need to
streamline some of the logic for when the FDT is appended to an image:
depending on the image type, we'd like to append the FDT not at all
(the case for the OS boot), to the 'firmware' image (if it is a
U-Boot) or to one of the loadables (if the 'firmware' is an ATF, an
OPTEE, or some other image-type and U-Boot is listed in the
loadabled).
To achieve this goal, we drop the os_boot flag and track the type of
image loaded. If it is of type IH_OS_U_BOOT, we append the FDT.
Signed-off-by: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
Acked-by: York Sun <york.sun@nxp.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
common/spl/spl_fit.c:201:12: warning: passing argument 4 of ‘gunzip’
from incompatible pointer type [-Wincompatible-pointer-types]
src, &length))
Signed-off-by: York Sun <york.sun@nxp.com>
Reported-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
CC: Jean-Jacques Hiblot <jjhiblot@ti.com>
If CONFIG_SPL_OS_BOOT is enabled, boot OS if kernel image is found
in FIT structure.
Signed-off-by: York Sun <york.sun@nxp.com>
Reviewed-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
SPL supports U-Boot image in FIT format which has data outside of
FIT structure. This adds support for embedded data for normal FIT
images.
Signed-off-by: York Sun <york.sun@nxp.com>
Reviewed-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Add Kconfig option SPL_GZIP and SPL_ZLIB to enable gunzip support for
SPL boot, eg. falcon boot compressed kernel image.
Signed-off-by: York Sun <york.sun@nxp.com>
Reviewed-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Some of the functions within spl_fit will be used for non spl purposes.
Instead of duplicating functions simply break the functions to be reused
into its own file.
Signed-off-by: Franklin S Cooper Jr <fcooper@ti.com>
Reviewed-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
[trini: Only add the new define to image.h, otherwise we see breakage
due to massive include leakage into host tools in some cases]
Signed-off-by: Tom Rini <trini@konsulko.com>
So far we were not using the FIT image format to its full potential:
The SPL FIT loader was just loading the first image from the /images
node plus one of the listed DTBs.
Now with the refactored loader code it's easy to load an arbitrary
number of images in addition to the two mentioned above.
As described in the FIT image source file format description, iterate
over all images listed at the "loadables" property in the configuration
node and load every image at its desired location.
This allows to load any kind of images:
- firmware images to execute before U-Boot proper (for instance
ARM Trusted Firmware (ATF))
- firmware images for management processors (SCP, arisc, ...)
- firmware images for devices like WiFi controllers
- bit files for FPGAs
- additional configuration data
- kernels and/or ramdisks
The actual usage of this feature would be platform and/or board specific.
Also update the FIT documentation to mention the new SPL feature and
provide an example .its file to demonstrate its features.
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Reviewed-by: Lokesh Vutla <lokeshvuta@ti.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Kever Yang <kever.yang@rock-chips.com>
Tested-by: Kever Yang <kever.yang@rock-chips.com>
Tested-by: Jagan Teki <jagan@openedev.com>
Reviewed-by: Jagan Teki <jagan@openedev.com>
At the moment we load two images from a FIT image: the actual U-Boot
image and the .dtb file. Both times we have very similar code, that deals
with alignment requirements the media we load from imposes upon us.
Factor out this code into a new function, which we just call twice.
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Kever Yang <kever.yang@rock-chips.com>
Tested-by: Kever Yang <kever.yang@rock-chips.com>
Tested-by: Jagan Teki <jagan@openedev.com>
At the moment we ignore any errors due to missing FIT properties,
instead go ahead and calculate our addresses with the -1 return value.
Fix this and bail out if any of the mandatory properties are missing.
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Kever Yang <kever.yang@rock-chips.com>
Tested-by: Kever Yang <kever.yang@rock-chips.com>
Tested-by: Jagan Teki <jagan@openedev.com>
Reviewed-by: Jagan Teki <jagan@openedev.com>
Currently the SPL FIT loader always looks only for the first image in
the /images node a FIT tree, which it loads and later executes.
Generalize this by looking for a "firmware" property in the matched
configuration subnode, or, if that does not exist, for the first string
in the "loadables" property. Then using the string in that property,
load the image of that name from the /images node.
This still loads only one image at the moment, but refactors the code to
allow extending this in a following patch.
To simplify later re-usage, we also generalize the spl_fit_select_index()
function to not return the image location, but just the node offset.
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Reviewed-by: Lokesh Vutla <lokeshvuta@ti.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Kever Yang <kever.yang@rock-chips.com>
Tested-by: Kever Yang <kever.yang@rock-chips.com>
Tested-by: Jagan Teki <jagan@openedev.com>
Currently the SPL FIT loader uses the spl_fit_select_fdt() function to
find the offset to the right DTB within the FIT image.
For this it iterates over all subnodes of the /configuration node in
the FIT tree and compares all "description" strings therein using a
board specific matching function.
If that finds a match, it uses the string in the "fdt" property of that
subnode to locate the matching subnode in the /images node, which points
to the DTB data.
Now this works very well, but is quite specific to cover this particular
use case. To open up the door for a more generic usage, let's split this
function into:
1) a function that just returns the node offset for the matching
configuration node (spl_fit_find_config_node())
2) a function that returns the image data any given property in a given
configuration node points to, additionally using a given index into
a possbile list of strings (spl_fit_select_index())
This allows us to replace the specific function above by asking for the
image the _first string of the "fdt" property_ in the matching
configuration subnode points to.
This patch introduces no functional changes, it just refactors the code
to allow reusing it later.
(diff is overly clever here and produces a hard-to-read patch, so I
recommend to throw a look at the result instead).
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Reviewed-by: Lokesh Vutla <lokeshvuta@ti.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Kever Yang <kever.yang@rock-chips.com>
Tested-by: Kever Yang <kever.yang@rock-chips.com>
Tested-by: Jagan Teki <jagan@openedev.com>
In raw mode a full sector is to be read even if image covers part of
a sector. Number of sectors are calculated as ROUND_UP(size)/sec_size by FIT
framework. This calculation assumes that image is at the 0th offset of a sector,
which is not true always in FIT case. So, include the image offset while
calculating number of sectors.
Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
Reviewed-by: Tom Rini <trini@konsulko.com>
The next stage boot loader image and the selected FDT can be post-
processed by board/platform/device-specific code, which can include
modifying the size and altering the starting source address before
copying these binary blobs to their final destination. This might be
desired to do things like strip headers or footers attached to the
images before they were packaged into the FIT, or to perform operations
such as decryption or authentication. Introduce new configuration
option CONFIG_SPL_FIT_IMAGE_POST_PROCESS to allow controlling this
feature. If enabled, a platform-specific post-process function must
be provided.
Signed-off-by: Daniel Allred <d-allred@ti.com>
Signed-off-by: Andreas Dannenberg <dannenberg@ti.com>
Reviewed-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
When no DTB can be matched successfully to the board that's being used
a list of available FIT-embedded DTBs will be output to the console for
diagnostic purposes. But rather than the contents of the "description"
FDT property a non-existent property was accessed and as a result "NULL"
was output instead of the actual name(s) of the DTB(s). Fix this issue
by using the correct property which is also the exact same property
that's used earlier during the actual board matching process.
Signed-off-by: Andreas Dannenberg <dannenberg@ti.com>
When loading fit header, it should be loaded to a previous address
aligned to ARCH_DMA_MINALIGN and not 8. Fixing the same.
Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
This provides a way to load a FIT containing U-Boot and a selection of device
tree files from a File system. Making sure that all the reads and writes
are aligned to their respective needs.
Tested-by: Michal Simek <michal.simek@xilinx.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
[trini: Make this still apply with Michal's alignment change for 'fit']
Signed-off-by: Tom Rini <trini@konsulko.com>
sectors field is not being updated when reading fdt from fit image. Because of
this size_of(u-boot.bin) is being read when reading fdt. Fixing it by updating
the sectors field properly.
Tested-by: Michal Simek <michal.simek@xilinx.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
If bl_len is not aligned it can caused a problem because another code
expects that start is aligned.
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
When FDT is not present in the image user doesn't get any error what's
wrong. Print error message if LIBCOMMON_SUPPORT is enabled.
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Seris-cc: uboot
Reviewed-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
This provides a way to load a FIT containing U-Boot and a selection of device
tree files. The board can select the correct device tree by probing the
hardware. Then U-Boot is started with the selected device tree.
Signed-off-by: Simon Glass <sjg@chromium.org>
Jun Nie
Masahiro Yamada
Peng Fan
Philipp Tomsich
York Sun
Cooper Jr., Franklin
Andre Przywara
Simon Glass
Lokesh Vutla
Daniel Allred
Andreas Dannenberg
Michal Simek