-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEgWII69YpahbL5iK5gS8AYozs+qIFAmU7j50ACgkQgS8AYozs
+qIh8w/+O4UjT0sG1NLwmyV7U1Ypk+EyYaE6wmSWzpsJLfH/YvtObBJOYRuXxRVh
J9lkgCsw8Ct1ZNCrp8iVO+Dz1DtV8+QvTecrUHZqcOhTYDaqxXnlvEH2/EUhgo5T
9a/ZaDtOP1mKz754C4G6G363+iRCvbcqDECeKg9VYxfWCo1cINOmqyQCqlGxFT+h
PKiB5VzUpN/K/yiie+Hr42/+6XaykAUjUvEWeyKOsRmYY4lNiK22vG/puE42bFTh
catXwTE2a7x+yzPKkdhR0UGvDUlIKET2kF6mi+pYN2h/cSUxWTzbP/OxcU9yJOnm
qJiRZ+Woez1I7ul6ln4ci2kiWc3CTYFXfctwrBJPuJ/EO+2EEb3oHqG2S3Fc9VBZ
N17flHW7XZHEQbNexlUhk9cRpCwRuSA5OJXwW+IZIuydgNeo3xF0iYvipbjkEGgW
BBkt8PH+ivTLjEz6Gcmquvo1fHGJLHRIPg7DNb0phGHviuC0zlDJ7N5DZk0CpkiT
36siV9xK4X6qvWkOTa6Ldw60e4tN9nv3VG30uXtPHi3XdOkKfNkyIuqO/5BkkQPt
6yEc9IYXYoWNKDVUGme5+xszZp1sSvqltajG9VVNupt958dFyOSgS5aNa6B4UsWX
3XfndP1/s2bezUHoQx5zjraapKVrqBFLkGeTlCDUD+mEgP440G8=
=gvDs
-----END PGP SIGNATURE-----
Merge tag 'tpm-next-27102023' of https://source.denx.de/u-boot/custodians/u-boot-tpm
bootX measurements and measurement API moved to u-boot core:
Up to now, U-Boot could perform measurements and EventLog creation as
described by the TCG spec when booting via EFI.
The EFI code was residing in lib/efi_loader/efi_tcg2.c and contained
both EFI specific code + the API needed to access the TPM, extend PCRs
and create an EventLog. The non-EFI part proved modular enough and
moving it around to the TPM subsystem was straightforward.
With that in place we can have a common API for measuring binaries
regardless of the boot command, EFI or boot(m|i|z), and contructing an
EventLog.
I've tested all of the EFI cases -- booting with an empty EventLog and
booting with a previous stage loader providing one and found no
regressions. Eddie tested the bootX part.
Eddie also fixed the sandbox TPM which couldn't be used for the EFI code
and it now supports all the required capabilities. This had a slight
sideeffect in our testing since the EFI subsystem initializes the TPM
early and 'tpm2 init' failed during some python tests. That code only
opens the device though, so we can replace it with 'tpm2 autostart'
which doesn't error out and still allows you to perfom the rest of the
tests but doesn't report an error if the device is already opened.
There's a few minor issues with this PR as well but since testing and
verifying the changes takes a considerable amount of time, I prefer
merging it now.
Heinrich has already sent a PR for -master containing "efi_loader: fix
EFI_ENTRY point on get_active_pcr_banks" and I am not sure if that will
cause any conflicts, but in any case they should be trivial to resolve.
Both the EFI and non-EFI code have a Kconfig for measuring the loaded
Device Tree. The reason this is optional is that we can't reason
when/if devices add random info like kaslr-seed, mac addresses etc in
the DT. In that case measurements are random, board specific and
eventually useless. The reason it was difficult to fix it prior to this
patchset is because the EFI subsystem and thus measurements was brought
up late and DT fixups might have already been applied. With this
patchset we can measure the DT really early in the future.
Heinrich also pointed out that the two Kconfigs for the DTB measurements
can be squashed in a single one and that the documentation only explains
the non-EFI case. I agree on both but as I said this is a sane working
version, so let's pull this first it's aleady big enough and painful to
test.
Pull request efi-2024-01-rc2-2
Documentation:
* Bump urllib3 version
* Replace references to dm_dump_all() with dm_dump_tree()
* Update description of build dependencies for Alpine Linux
* Fix typo in gpt example
* Fix ordering of shell commands
UEFI:
* Move misplace EFI_ENTRY macro
efi_tcg2_get_active_pcr_banks doesn't immediately call the
EFI_ENTRY() wrapper once it enters the function. Move the call a
few lines above to cover the error cases properly as well.
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
I initially didn't find the bootz docs when I went looking for them. :)
Signed-off-by: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
While unlikely to be a direct issue for us, urllib3 before 2.0.7 is
vulnerable to CVE-2023-45803, so bump our version up.
Reported-by: GitHub dependabot
Signed-off-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
- Fix environment saving for new Android boot features on vim3*_android
- Add SPIFC support for Amlogic A1
- Add DFU RAM boot step when booting over USB
Add A1 SPIFC driver from Linux. Slightly modified to use u-boot driver
framework and accommodate to lack of ioread32_rep/iowrite32_rep.
Based on Linux version 6.6-rc4
Signed-off-by: Igor Prusov <IVPrusov@sberdevices.ru>
Signed-off-by: Martin Kurbanov <mmkurbanov@sberdevices.ru>
Reviewed-by: Simon Glass <sjg@chromium.org>
Link: https://lore.kernel.org/r/20231024225140.366571-2-ivprusov@sberdevices.ru
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
[trini: Drop <common.h> as it's not needed]
- kirkwood: Enable bootstd on some boards (Tony)
- mvebu: turris_mox: Extend to support RIPE Atlas Probe (Marek)
- mvebu/bubt: Support eMMC data partition booting (Josua)
commit 789ed27842 ("test/py: replace 'tpm2 init, startup, selftest' sequences")
changed some of the tpm2 init sequences to 'tpm2 autostart' instead of
calling 'tpm init', 'tpm startup TPM2_SU_CLEAR', 'tpm2 self_test full'.
The autostart command calls the afforementioned sequence and on top of
that deals with the 'tpm2 init' return codes if the tpm is already
started. Since we initialize the tpm from various subsystems now,
replace the last remaining instances of 'tpm2 init' with 'tpm2
autostart'. Since the latter calls 'tpm2 init' anyway we will still be
implicitly testing the validity of that command
It's worth noting that since 'tpm2 autostart' performs the startup and
self tests sequences of the tpm we could drop
'test_tpm2_sandbox_self_test_full' and 'test_tpm2_startup, but let's
keep the since they test tpm commands and options
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
We currently use PCR 0 for testing the PCR read/extend functionality in
our selftests. How ever those PCRs are defined by the TCG spec for
platform use. For example if the tests run *after* the efi subsystem
initialization, which extends PCRs 0 & 7 it will give a false positive.
So let's switch over to a PCR which is more suitable and is defined for
OS use. It's worth noting that we are using PCR10 here, since PCR9 is
used internally by U-Boot if we choose to measure the loaded DTB
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
efi_tcg2_get_active_pcr_banks doesn't immediately call the
EFI_ENTRY() wrapper once it enters the function. Move the call a
few lines above to cover the error cases properly as well.
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Briefly describe the feature and specify the requirements.
Signed-off-by: Eddie James <eajames@linux.ibm.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Use the sandbox TPM driver to measure some boot images in a unit
test case.
Signed-off-by: Eddie James <eajames@linux.ibm.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Add a configuration option to measure the boot through the bootm
function. Add the measurement state to the booti and bootz paths
as well.
Signed-off-by: Eddie James <eajames@linux.ibm.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Ilias: Added some info on Kconfig explaining this is when booting !EFI
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Add TPM2 functions to support boot measurement. This includes
starting up the TPM, initializing/appending the event log, and
measuring the U-Boot version. Much of the code was used in the
EFI subsystem, so remove it there and use the common functions.
Signed-off-by: Eddie James <eajames@linux.ibm.com>
For the API moving around from EFI -> u-boot core
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
For EFI testing
Tested-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
The driver needs to support getting the PCRs in the capabilities
command. Fix various other things and support the max number
of PCRs for TPM2.
Remove the !SANDBOX dependency for EFI TCG2 as well.
Signed-off-by: Eddie James <eajames@linux.ibm.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
The R-Car Gen3 SD_CLK_CTRL register does not use BIT(16) to implement
divider 1/1024, instead BIT(16) is reserved bit and divider 1/1024 is
not supported. The divider 1/1024 is specific to Socionext variant of
the IP, as is indicated by Linux commit:
0196c8db8363 ("mmc: tmio: move tmio_mmc_set_clock() to platform hook")
"
Socionext (and Panasonic) uses bit 10 (CLKSEL) for 1/1. Also, newer
versions of UniPhier SoC variants use bit 16 for 1/1024.
"
Do not set the TMIO_SD_CAP_DIV1024 on Renesas R-Car platforms even if
the IP VERSION register does exist, and indicates IP version is newer
or equal to version 1.0 . The IP version 1.0 or newer does not imply
presence of the 1/1024 divider.
Since the TMIO driver is used exactly by two supported platforms, that
is Renesas R-Car and Socionext UniPhier, it is OK to check whether the
TMIO_SD_CAP_RCAR capability is not set to identify the UniPhier platform
and add the capability only on that platform.
Fixes: 58c35b17aa ("mmc: matsushita-common: Always check controller version")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Acked-by: Paul Barker <paul.barker.ct@bp.renesas.com>
Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Tested-by: Thuan Nguyen Hong <thuan.nguyen-hong@banvien.com.vn>
Unconditionally check for errors even after successful reception
of IRQ flag, since the hardware may set both an IRQ completion
flag and an error flag at the same time.
This mode of failure happens in case of an error during transfer,
in which case the hardware may set the expected IRQ completion
flag as well as error flags. The later is currently not checked
by the driver and such an error is not detected. Improve the
error detection.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Tested-by: Thuan Nguyen Hong <thuan.nguyen-hong@banvien.com.vn>
This driver is long superseded by renesas-sdhi.c and unused.
Drop the driver.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Acked-by: Paul Barker <paul.barker.ct@bp.renesas.com>
We should ensure that reset_free() is called in the error path.
Signed-off-by: Paul Barker <paul.barker.ct@bp.renesas.com>
Fixes: 93c811b733 ("mmc: renesas-sdhi: Initialize module on RZ/G2L")
Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Add boot over DFU RAM as an alternate to running script at
a fixed address like done today.
The main culprit is that it's not possible to do that
on G12A/Sm1 platforms due to changes in the USB boot protocol.
With this, U-Boot will present a DFU device with a ram slot where
the Host could write a fitImage or legacy U-Boot image, then with the
detach command boot will continue trying to boot the uploaded image.
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lore.kernel.org/r/20231023-usb-dfu-boot-v1-3-df9d121c67c1@linaro.org
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
The environment is used to configure some additional boot features such as:
* extra boot arguments
* enable AVB (Android Verified Boot) verification
Right now, we cannot store it in eMMC:
Loading Environment from nowhere... OK
Fix it by enabling the appropriate options in the defconfig
Fixes: b749d5ecdc ("configs: meson64_android: define raw parts for bootloader")
Signed-off-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://lore.kernel.org/r/20231026-fix-saveenv-v1-1-6aa59be65481@baylibre.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
A38x bootrom only searches 2 sectors when booting from eMMC,
irregardless of data or boot partition: 0 & 4096.
For eMMC boot partitions sector 0 is fine, but on data partition it
conflicts with MBR.
Change bubt command default to 4096 for eMMC data partition only, to
allow using an MBR partition table on the eMMC data partition while also
booting from it.
Signed-off-by: Josua Mayer <josua@solid-run.com>
Reviewed-by: Stefan Roese <sr@denx.de>
Disarm the error message forcing u-boot/spl image to be located at
sector 0 on eMMC data-partition and microSD.
Offset 0 makes sense on eMMC boot partitions only, data partition must
use 4096 to avoid conflicting with MBR.
Valid offsets when booting from microSD, reported by boot-rom v1.73:
BootROM: Bad header at offset 00000200
BootROM: Bad header at offset 00004400
BootROM: Bad header at offset 00200000
BootROM: Bad header at offset 00400000
BootROM: Bad header at offset 00600000
BootROM: Bad header at offset 00800000
BootROM: Bad header at offset 00A00000
BootROM: Bad header at offset 00C00000
BootROM: Bad header at offset 00E00000
BootROM: Bad header at offset 01000000
BootROM: Bad header at offset 01200000
BootROM: Bad header at offset 01400000
BootROM: Bad header at offset 01600000
BootROM: Bad header at offset 01800000
BootROM: Bad header at offset 01A00000
BootROM: Bad header at offset 01C00000
BootROM: Bad header at offset 01E00000
BootROM: Bad header at offset 02000000
BootROM: Bad header at offset 02200000
BootROM: Bad header at offset 02400000
BootROM: Bad header at offset 02600000
BootROM: Bad header at offset 02800000
BootROM: Bad header at offset 02A00000
BootROM: Bad header at offset 02C00000
BootROM: Bad header at offset 02E00000
Valid offsets when booting from eMMC:
BootROM: Bad header at offset 00000000
BootROM: Bad header at offset 00200000
Switching BootPartitions.
BootROM: Bad header at offset 00000000
BootROM: Bad header at offset 00200000
Fixes: 2226ca1734 ("arm: mvebu: Load U-Boot proper binary in SPL code based on kwbimage header")
Signed-off-by: Josua Mayer <josua@solid-run.com>
Reviewed-by: Stefan Roese <sr@denx.de>
Extend Turris Mox board code to support CZ.NIC's RIPE Atlas Probe.
Signed-off-by: Marek Behún <kabel@kernel.org>
Reviewed-by: Stefan Roese <sr@denx.de>
Signed-off-by: Milan P. Stanić <mps@arvanta.net>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reformat and keep ncurses-dev needed for 'make menuconfig'
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
- Remove common.h in a number of places and make checkpatch.pl complain
about its use in all cases, allow the mbr command to handle 4 primary
partitions, fix an issue with the pstore command, fix a problem with
cli parsing of escape sequences, remove and ignore more files, allow
for the serial port to be flushed with every print (for debugging),
and add SCMI power domain support.
When debugging, one sometimes only gets partial output lines or
nothing at all from the last printf, because the uart has a largish
buffer, and the code after the printf() may cause the CPU to hang
before the uart IP has time to actually emit all the characters. That
can be very confusing, because one doesn't then know exactly where the
hang happens.
Introduce a config knob allowing one to wait for the uart fifo to
drain whenever a newline character is printed, roughly corresponding
to the effect of setvbuf(..., _IOLBF, ...) in ordinary C programs.
Since this uses IS_ENABLED() instead of cpp ifdef, we can remove the
ifdef around the _serial_flush() definition - if neither
CONSOLE_FLUSH_SUPPORT or CONSOLE_FLUSH_ON_NEWLINE are enabled, the
compiler elides _serial_flush(), but it won't warn about it being
unused.
Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Reviewed-by: Simon Glass <sjg@chromium.org>
This ut has tests for the SCMI power domain protocol as well as DM
interfaces for power domain devices.
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
SCMI power domain management protocol is supported on sandbox
for test purpose. Add fake agent interfaces and associated
power domain devices.
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
In this patch, added are helper functions to directly manipulate
SCMI power domain management protocol. DM compliant power domain
driver will be implemented on top of those interfaces in a succeeding
patch.
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Current code allows up to 3 MBR partitions without extended one.
If more than 3 partitions are required, then extended partition(s)
must be used.
This commit allows up to 4 primary MBR partitions without the
need for extended partition.
Add mbr test unit. In order to run the test manually, mmc6.img file
of size 12 MiB or greater is required in the same directory as u-boot.
Test also runs automatically via ./test/py/test.py tool.
Running mbr test is only supported in sandbox mode.
Signed-off-by: Alex Gendin <agendin@matrox.com>
[ And due to some further changes for testing ]
Signed-off-by: Simon Glass <sjg@chromium.org>
u-boot adds reserve-memory node, if it's missing, with following
properties:
```
reserved-memory {
#address-cells = <2>;
#size-cells = <2>;
ranges;
}
```
But with these default address-cells and size-cells values, pstore
isn't working on A64. Root node for A64 defines 'address-cells' and
'size-cells' as 1.
dtc complains if reserved-memory has different address-cells and
size-cells.
```
Warning (ranges_format): /reserved-memory:ranges: empty "ranges"
property but its #address-cells (2) differs from / (1)
```
This patch takes into account address-cells and size-cells of the root
node and uses them as values for new reserved-memory node.
Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
make rock5b-rk3588_defconfig
make
git status
before
~~~~~~~
On branch master
Your branch is ahead of 'origin/master' by 1 commit.
(use "git push" to publish your local commits)
Untracked files:
(use "git add <file>..." to include in what will be committed)
include/autoconf.mk
include/autoconf.mk.dep
include/config.h
mkimage-in-simple-bin-spi.mkimage-rockchip-tpl
mkimage-in-simple-bin-spi.mkimage-u-boot-spl
mkimage-in-simple-bin.mkimage-rockchip-tpl
mkimage-in-simple-bin.mkimage-u-boot-spl
simple-bin-spi.map
simple-bin.fit.fit
simple-bin.fit.itb
simple-bin.map
tools/generated/
after
~~~~~~~
On branch master
Your branch is ahead of 'origin/master' by 1 commit.
(use "git push" to publish your local commits)
nothing to commit, working tree clean
Signed-off-by: John Clark <inindev@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
make rock5b-rk3588_defconfig
make
make clean
git status
before
~~~~~~~
On branch master
Your branch is up to date with 'origin/master'.
Untracked files:
(use "git add <file>..." to include in what will be committed)
include/autoconf.mk
include/autoconf.mk.dep
include/config.h
mkimage-in-simple-bin-spi.mkimage-rockchip-tpl
mkimage-in-simple-bin-spi.mkimage-u-boot-spl
mkimage-in-simple-bin.mkimage-rockchip-tpl
mkimage-in-simple-bin.mkimage-u-boot-spl
simple-bin.fit.fit
simple-bin.fit.itb
after
~~~~~~~
On branch master
Your branch is ahead of 'origin/master' by 1 commit.
(use "git push" to publish your local commits)
nothing to commit, working tree clean
Signed-off-by: John Clark <inindev@gmail.com>
We can remove common.h from most cases of the code here, and only a few
places need an additional header instead.
Signed-off-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Rick Chen <rick@andestech.com>
We can remove common.h from most cases of the code here, and only a few
places need an additional header instead.
Signed-off-by: Tom Rini <trini@konsulko.com>
We can remove common.h from most cases of the code here, and only a few
places need an additional header instead.
Signed-off-by: Tom Rini <trini@konsulko.com>
Acked-by: Michal Simek <michal.simek@amd.com>
We can remove common.h from most cases of the code here, and only a few
places need an additional header instead.
Signed-off-by: Tom Rini <trini@konsulko.com>
Acked-by: Angelo Dureghello <angelo@kernel-space.org>
