This patch adds a new section "Launching a UEFI binary from a FIT image"
documenting the usage of the CONFIG_BOOTM_EFI extension to bootm command
that offers a verified boot alternative for UEFI binaries such as GRUB2.
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@gmail.com>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
This patch adds an example FIT image description file demonstrating
the usage of bootm command to securely launch UEFI binaries.
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@gmail.com>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Add support for booting EFI binaries contained in FIT images.
A typical usage scenario is chain-loading GRUB2 in a verified
boot environment.
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@gmail.com>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Add a new OS type to be used for chain-loading an EFI compatible
firmware or boot loader like GRUB2, possibly in a verified boot
scenario.
Bellow is sample ITS file that generates a FIT image supporting
secure boot. Please note the presence of 'os = "efi";' line, which
identifies the currently introduced OS type:
/ {
#address-cells = <1>;
images {
efi-grub {
description = "GRUB EFI";
data = /incbin/("bootarm.efi");
type = "kernel_noload";
arch = "arm";
os = "efi";
compression = "none";
load = <0x0>;
entry = <0x0>;
hash-1 {
algo = "sha256";
};
};
};
configurations {
default = "config-grub";
config-grub {
kernel = "efi-grub";
signature-1 {
algo = "sha256,rsa2048";
sign-images = "kernel";
};
};
};
};
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@gmail.com>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
When we hit a matching GUID we can directly return the text. There is no
need for a check after the loop.
efi_guid_t is defined as 8 byte aligned but GUIDs in packed structures do
not follow this alignment. Do not require the argument of get_guid_text()
to be correctly aligned.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Of all warning status codes up to now only EFI_WARN_DELETE_FAILURE is
defined.
The patch adds the missing definitions for later usage.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
When be launch a binary via bootefi the bootargs environment variable is
used to set the load options in the loaded image protocol.
Free memory allocated for load options when the UEFI binary exits.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Add guidcpy function to copy the source guid to the destination
guid. Use this function instead of memcpy for copying to the
destination guid.
Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
Use void * instead of efi_guid_t * for arguments to allow copying unaligned
GUIDs. The GUIDs of configuration tables are __packed.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
U-Boot can be compiled with function tracing enabled.
When compiling with FTRACE __cyg_profile_func_enter() is called when a
function is entered and __cyg_profile_func_exit() when the function is
left.
To avoid a crash we have to define these function for the free-standing
UEFI binaries.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Add a comment indicating that the value of GPT_HEADER_SIGNATURE_UBOOT
equals the ASCII string 'EFI PART'.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
On a VT100 terminal <ESC>[2J should be enough to both clear the whole
screen and set the cursor to position (1, 1). But the Linux console does
not behave like this. So send an extra <ESC>[H. For reference see the
console_codes(4) man page.
Add a function description.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Add the following file to .gitignore
efi_miniapp_file_image_exception.h
Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
Use efi_miniapp_*.h instead of file enumeration.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Use a pointer to addressable memory instead of a "physical" address in the
virtual address space of the sandbox to efi_install_fdt().
Export the efi_install_fdt() function.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
If the bootefi command is called without passing the address of a device
tree, the internal device tree is used. For devices with a hardware device
tree it is preferable to used the hardware device tree in this case.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
As part of moving the parsing of command line arguments to do_bootefi()
call efi_install_fdt() with the address of the device tree instead of a
string.
If the address is EFI_FDT_USE_INTERNAL (= 0), the internal device tree
is used.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
When the GetInfo() method of the EFI_FILE_PROTOCOL is called to retrieve
the file system info we claim that the volume is read only and has no free
space. This leads to failures in programs that check this information
before writing to the volume like SCT's InstallSct.efi.
Currently there is no function to determine these parameters in U-Boot. So
let's return optimistic values:
Return that the volume is writable.
Return the volume size as free space.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
UEFI applications like GRUB and SCT assume that function keys are enabled
on the keyboard.
Let EFI_LOADER imply USB_KEYBOARD_FN_KEYS.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
The index (IMAGE_DIRECTORY_ENTRY_SECURITY) in a table points to
a region containing authentication information (image's signature)
in PE format.
WIN_CERTIFICATE structure defines an embedded signature format.
Those definitions will be used in my UEFI secure boot patch.
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Consider the following test sample:
@pytest.mark.buildconfigspec('fit')
@pytest.mark.notbuildconfigspec('generate_acpi_table')
def test_sample(u_boot_console):
Whatever the argument of the 'notbuildconfigspec' is,
the test ends up being skipped with the message:
('/uboot/test/py/conftest.py', 463,
'Skipped: .config feature "fit" enabled')
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@gmail.com>
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Bring in the following merges:
commit 8fbbec12f7
Merge: 87f69f467a63618e71e8
Author: Tom Rini <trini@konsulko.com>
Date: Fri Jan 3 09:48:47 2020 -0500
Merge https://gitlab.denx.de/u-boot/custodians/u-boot-fsl-qoriq into next
- updates and fixes on ls1028a, lx2, ls1046a, MC-DPSPARSER support
commit 87f69f467a
Merge: c0912f9bbf4466b99703
Author: Tom Rini <trini@konsulko.com>
Date: Tue Dec 24 08:18:19 2019 -0500
Merge https://gitlab.denx.de/u-boot/custodians/u-boot-mpc85xx into next
- Enable DM driver on ppc/km boards
- Enable DM_USB for some of NXP powerpc platforms: P5040, T4240, T208x,
T104x, P4080, P2041, P2020, P1020, P3041
- Some updates in mpc85xx-ddr driver, km boards
commit c0912f9bbf
Merge: 533c9f5714a1d6dc3f84
Author: Tom Rini <trini@konsulko.com>
Date: Wed Dec 18 07:20:19 2019 -0500
Merge branch 'next' of https://gitlab.denx.de/u-boot/custodians/u-boot-x86 into next
- Various x86 common codes updated for TPL/SPL
- I2C designware driver updated for PCI
- ICH SPI driver updated to support Apollo Lake
- Add Intel FSP2 base support
- Intel Apollo Lake platform specific drivers support
- Add a new board Google Chromebook Coral
commit 533c9f5714
Merge: 553cb06887033e18b47b
Author: Tom Rini <trini@konsulko.com>
Date: Tue Dec 17 07:53:08 2019 -0500
Merge tag '20191217-for-next' of https://gitlab.denx.de/u-boot/custodians/u-boot-i2c into next
i2c: for next
- misc: i2c_eeprom:
Add partition support and add ability to query size
of eeprom device and partitions
- i2c common:
add support for offset overflow in to address and add
sandbox tests for it.
commit 553cb06887
Merge: f39abbbc53b4f98b3b16
Author: Tom Rini <trini@konsulko.com>
Date: Thu Dec 12 08:18:59 2019 -0500
Merge tag 'dm-next-13dec19' of https://gitlab.denx.de/u-boot/custodians/u-boot-dm into next
buildman improvements including toolchain environment feature
sandbox unicode support in serial
Adam Ford reports that this change breaks booting on da850-evm and
Bartosz Golaszewski agrees that with the impending release we should
revert the change for now. With that noted:
This reverts commit 21a4d80a71.
Cc: Bartosz Golaszewski <brgl@bgdev.pl>
Tested-by: Adam Ford <aford173@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
On K3 devices there are 2 conditions where R5F can deadlock:
1.When software is performing series of store operations to
cacheable write back/write allocate memory region and later
on software execute barrier operation (DSB or DMB). R5F may
hang at the barrier instruction.
2.When software is performing a mix of load and store operations
within a tight loop and store operations are all writing to
cacheable write back/write allocates memory regions, R5F may
hang at one of the load instruction.
To avoid the above two conditions disable linefill optimization
inside Cortex R5F which will make R5F to only issue up to 2 cache
line fills at any point of time.
Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
Update the ddr settings to use the DDR reg config tool rev 0.2.0.
This reduces the aging count(in DDRSS_CTL_274_DATA reg) to 15 in-order
to avoid DSS underflow errors.
Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
Signed-off-by: Kevin Scholz <k-scholz@ti.com>
The build failure was originally reported on arm64-musl
target at https://bugs.gentoo.org/703132. Here is the amd64-musl
variant:
```
$ LANG=C make CROSS_COMPILE=x86_64-gentoo-linux-musl- tools-only_defconfig -j$(nproc)
$ LANG=C make CROSS_COMPILE=x86_64-gentoo-linux-musl- tools-all -j$(nproc)
...
include/u-boot/crc.h:37:44: error: unknown type name 'uint'; did you mean 'int'?
37 | void crc16_ccitt_wd_buf(const uint8_t *in, uint len,
| ^~~~
| int
```
Note: 'uint' is not defined there.
On glibc 'uint' comes from <sys/types.h> and happens to work on most .c files.
The change imports 'uint' declaration from '<compiler.h>'.
Bug: https://bugs.gentoo.org/703132
Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
The build failure was originally reported on arm64-musl
target at https://bugs.gentoo.org/703132. Here is the amd64-musl
variant:
```
$ LANG=C make CROSS_COMPILE=x86_64-gentoo-linux-musl- tools-only_defconfig -j$(nproc)
$ LANG=C make CROSS_COMPILE=x86_64-gentoo-linux-musl- tools-all -j$(nproc)
...
In file included from tools/env/../../env/flags.c:7,
from tools/env/env_flags.c:1:
include/env.h:159:1: error: unknown type name 'ulong'; did you mean 'long'?
159 | ulong env_get_ulong(const char *name, int base, ulong default_val);
| ^~~~~
| long
```
Note: 'ulong' is not defined there.
On glibc 'ulong' comes from <sys/types.h>:
```c
/* Old compatibility names for C types. */
typedef unsigned long int ulong;
```
On musl it comes from <sys/types.h> as well but from under different guards:
```c
typedef unsigned long u_long, ulong;
```
The change inlines 'ulong' define similar to 'uint' define.
Bug: https://bugs.gentoo.org/703132
Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
- avoid using #ifdef in video code
- add .gitignore for video font *.S files
-----BEGIN PGP SIGNATURE-----
iGwEABECACwWIQSC4hxrSoIUVfFO0kRM6ATMmsalXAUCXg5F7g4cYWd1c3RAZGVu
eC5kZQAKCRBM6ATMmsalXKzNAJ93lUmXiaSDCJDTJ99G6RcpbDY98QCeKdAsgKEq
+edrqBimoikBmbw0NYE=
=+x5b
-----END PGP SIGNATURE-----
Merge tag 'fixes-v2020.01' of https://gitlab.denx.de/u-boot/custodians/u-boot-video
- fix missing graphics output on some x86 boards
- avoid using #ifdef in video code
- add .gitignore for video font *.S files
The scripts/Makefile.lib generates an assembler file (*.S) to wrap the
font data for each file of type ttf defined in Kconfig.
Signed-off-by: Dario Binacchi <dariobin@libero.it>
- Fix latest mainline kernel for rk3308
- Update rk3288-evb config to suport OP-TEE
- Fix for firefly-px30 DEBUG_UART channel and make it standalone
- Script make_fit_atf add python3 support
- Fix rk3328 timer with correct COUNTER_FREQUENCY
- Fix rk3328 ATF support with enable spl-fifo-mode
My address at Linaro doesn't exist anymore, so people
keep getting mail delivery error responses. Map this address
to the actual one.
Signed-off-by: Igor Opaniuk <igor.opaniuk@gmail.com>
Reviewed-by: Oleksandr Suvorov <oleksandr.suvorov@toradex.com>
get_env() was originally written to strip() the output of printenv to
isolate the test from any whitespace changes in printenv's output.
However, this throws away any whitespace in the variable value, which can
cause issues when test code expects to see that whitespace. In fact,
printenv never adds any whitespace at all, so there's no need to strip.
The strip causes a practical problem for test_env_echo_exists() if
state_test_env.get_existent_var() happens to choose a U-Boot variable that
contains trailing whitespace. This is true for variable boot_targets.
With Python 2, get_existent_var() never returned boot_targets so this
issue never caused a practical problem.
With Python 3, get_existent_var does sometimes return boot_targets, no
doubt due to Python 3's different dict hash key order implementation,
about 0.5-2% of the time, so this test appears intermittent. With the
strip removed, this intermittency is solved, since the test passes for all
possible U-Boot variables.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
As described in doc/README.asn1 document the tools/asn1_compiler is used
to "generate bytecode as a C file (*.asn1.[ch]) from *.asn1 file".
Signed-off-by: Dario Binacchi <dariobin@libero.it>
Add the tool to the ignore list to prevent being marked as unversioned.
Signed-off-by: Dario Binacchi <dariobin@libero.it>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
This code does not really need to use #ifdef. We can use if() instead and
gain build coverage without impacting code size.
Change the #ifdefs to use IS_ENABLED(), etc., instead.
Signed-off-by: Simon Glass <sjg@chromium.org>
This code does not really need to use #ifdef. We can use if() instead and
gain build coverage without impacting code size.
Change the #ifdefs to use CONFIG_IS_ENABLED() instead.
Signed-off-by: Simon Glass <sjg@chromium.org>
This code does not really need to use #ifdef. We can use if() instead and
gain build coverage without impacting code size.
Change the #ifdefs to use IS_ENABLED() instead.
Signed-off-by: Simon Glass <sjg@chromium.org>
This code does not really need to use #ifdef. We can use if() instead and
gain build coverage without impacting code size.
Change the #ifdefs to use IS_ENABLED() instead.
Signed-off-by: Simon Glass <sjg@chromium.org>
Most x86 boards that use video make use of 32bpp graphics. Enable this by
default. This fixes missing graphics output on some x86 boards.
Also remove the unnecessary 'default n' while we are here.
Signed-off-by: Simon Glass <sjg@chromium.org>
The ep node device tree name is governed by these bindings:
https://github.com/torvalds/linux/blob/master/Documentation/
devicetree/bindings/pci/layerscape-pci.txt#L24
As per above the ep compatible node contains platform name.
Therefore, define the ep node compatible as CONFIG to find the
pcie ep node in device tree during device tree fixup.
Signed-off-by: Pankaj Bansal <pankaj.bansal@nxp.com>
Signed-off-by: Priyanka Jain <priyanka.jain@nxp.com>
