With this commit, image validation can be enforced, as UEFI specification
section 32.5 describes, if CONFIG_EFI_SECURE_BOOT is enabled.
Currently we support
* authentication based on db and dbx,
so dbx-validated image will always be rejected.
* following signature types:
EFI_CERT_SHA256_GUID (SHA256 digest for unsigned images)
EFI_CERT_X509_GUID (x509 certificate for signed images)
Timestamp-based certificate revocation is not supported here.
Internally, authentication data is stored in one of certificates tables
of PE image (See efi_image_parse()) and will be verified by
efi_image_authenticate() before loading a given image.
It seems that UEFI specification defines the verification process
in a bit ambiguous way. I tried to implement it as closely to as
EDK2 does.
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
With this commit, EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
is supported for authenticated variables and the system secure state
will transfer between setup mode and user mode as UEFI specification
section 32.3 describes.
Internally, authentication data is stored as part of authenticated
variable's value. It is nothing but a pkcs7 message (but we need some
wrapper, see efi_variable_parse_signature()) and will be validated by
efi_variable_authenticate(), hence efi_signature_verify_with_db().
Associated time value will be encoded in "{...,time=...}" along with
other UEFI variable's attributes.
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
efi_signature_parse_sigdb() is a helper function will be used to parse
signature database variable and instantiate a signature store structure
in later patches.
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
In this commit, implemented are a couple of helper functions which will be
used to materialize variable authentication as well as image authentication
in later patches.
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
This function is a bit large for an inline function, and for U-Boot
proper, it is called via a function pointer anyway (in board_r.c), so
cannot be inlined.
It will shortly set a global variable to be used by the
watchdog_reset() function in wdt-uclass.c, so this also allows making
that variable local to wdt-uclass.c.
The WATCHDOG_TIMEOUT_SECS define is not used elsewhere.
Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Reviewed-by: Stefan Roese <sr@denx.de>
Since WATCHDOG_TIMEOUT_MSECS was converted to Kconfig (commit
ca51ef7c0c), CONFIG_WATCHDOG_TIMEOUT_MSECS has been guaranteed to be
defined. So remove the dead fallback ifdeffery.
Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Reviewed-by: Stefan Roese <sr@denx.de>
Unify the location of DT selection into board_late_init instead of
split between detection and static configuration paths.
Signed-off-by: Joel Johnson <mrjoel@lixil.net>
Reviewed-by: Stefan Roese <sr@denx.de>
Enable distro bootcmd support for additional SATA ports if enabled.
Signed-off-by: Joel Johnson <mrjoel@lixil.net>
Reviewed-by: Stefan Roese <sr@denx.de>
Include attempting to boot from SCSI (SATA) devices within generated
board distro bootcmd environment. The reasoning for boot ordering is
that MMC and USB are external and removable, while when a case is in
use, replacing M.2 or mSATA drives requires disassembly. Therefore,
to boot SCSI, [bootable] external media must be removed. If SCSI were
placed before MMC or USB, then removing a bootable SCSI drive to
enable MMC or USB booting would be more difficult.
Signed-off-by: Joel Johnson <mrjoel@lixil.net>
Reviewed-by: Stefan Roese <sr@denx.de>
Support for sata devices via the scsi command is available and already
enabled by default for the Clearfog Base and Pro. This change adds scsi
to the list of boot targets used by distro-boot.
Signed-off-by: Josua Mayer <josua@solid-run.com>
Cc: Stefan Roese <sr@denx.de>
Reviewed-by: Stefan Roese <sr@denx.de>
Pull in changes that have been pending in our 'next' branch. This
includes:
- A large number of CI improvements including moving to gcc-9.2 for all
platforms.
- amlogic, xilinx, stm32, TI SoC updates
- USB and i2c subsystem updtaes
- Re-sync Kbuild/etc logic with v4.19 of the Linux kernel.
- RSA key handling improvements
Rather than keeping the asynchronous schedule running always, keep it
running only across USB mass storage transfers for now, as it seems
that keeping it running all the time interferes with certain control
transfers during device enumeration.
Note that running the async schedule all the time should not be an
issue, especially on EHCI HCD, as that one implements most of the
transfers using async schedule.
Note that we have usb_disable_asynch(), which however is utterly broken.
The usb_disable_asynch() blocks the USB core from doing async transfers
by setting a global flag. The async schedule should however be disabled
per USB controller. Moreover, setting a global flag does not prevent the
controller from using the async schedule, which e.g. the EHCI HCD does.
This patch implements additional callback to the controller, which
permits it to lock the async schedule and keep it running across
multiple transfers. Once the schedule is unlocked, it must also be
disabled. This thus prevents the async schedule from running outside
of the USB mass storage transfers.
Signed-off-by: Marek Vasut <marek.vasut+renesas@gmail.com>
Cc: Lukasz Majewski <lukma@denx.de>
Cc: Tom Rini <trini@konsulko.com>
Tested-by: Tom Rini <trini@konsulko.com> [omap3_beagle, previously failing]
This patch ajust CONFIG_SYS_MEMTEST_END for vcoreiii-based systems to
avoid overwriting the relocated u-boot. The former setting was too
agressive with networking etc. enabled on some platforms.
Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Reviewed-by: Horatiu Vultur <horatiu.vultur@microchip.com>
Signed-off-by: Lars Povlsen <lars.povlsen@microchip.com>
- sync all Amlogic DT from Linux v5.6-rc2
- MMC clock fixups
- add support for Libre Computer AML-S905D-PC and AML-S912-PC
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEPVPGJshWBf4d9CyLd9zb2sjISdEFAl6K4bQACgkQd9zb2sjI
SdFpIw//QZbwDYFJWb7m3OuutceTWwx6sB/vjYjUBzkRZLBKOWn1WdKmt3PHHcHB
Mj1CrUGaK29TVSyC654Sn7W75WMWJOQsvLwZVIc+TA6gOGU0P0khn/LitHgIyn9r
Fo8wCxD9ohVQLfDcgWn/KRkTdX++Sx1IxURvc1ebd82W507XyTjf8dLjgDA6rETF
3dVlnR/el/UojG0MhxaIce/GVldNukC4Y02Imuw9bV1DvhiXp1GnzVaXqmlChxkr
rqoKFBelh5c2I85xm8+FunUX9wCDPuMXE75pFOwVX5imAekExaVaZA+y78hWIUTg
bEFT6Ug0PWaLzZCJAkPKzE3+flJk4tXbG9oXsPIfgGWm7KoC3Lzd6mstpOMzq55V
NMxvPrFJo7bmPZNM7sIbB/KQYBB1r9dnV+UANXHiRS2G7acBDpueuPX6ki6wiG4v
OlwfcWGWTk+6ci0271a/05B4rclZqM33rbRUGlheEpHrFPINXksaArdaY1Pl5FIu
kuP6wg5lyF4G1QuFE68K8OidJticchzh116D6ccD9z3Z5s2KTg555Wp83lLLe+Zi
2YtNYtEr1yiCUDO9OBaYTHzDK/Tfj5Xz2q1Bny6YAyN48NTiOoeK6R9ZsAyXLDK1
Qn/rjHR31ZyrnZ7OZ7GQ/rqfyfZDD+/Fq9mDZ9+ScYe0QFpTwY4=
=PiOt
-----END PGP SIGNATURE-----
Merge tag 'u-boot-amlogic-20200406' of https://gitlab.denx.de/u-boot/custodians/u-boot-amlogic into next
- clk: meson-g12a: missing break
- sync all Amlogic DT from Linux v5.6-rc2
- MMC clock fixups
- add support for Libre Computer AML-S905D-PC and AML-S912-PC
With multi defconfig NOR flash information about NOR should be taken from
DT that's why there is no reason to specify address and sizes via fixed
config.
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
With multi defconfig targeting several board configurations bug report like
below is so verbose.
Flash: ## Unknown flash on Bank 1 - Size = 0x00000000 = 0 MB
0 Bytes
Do not report that message and simply say "Flash: 0 Bytes" because most of
Zynq boards are using different type of flashes than NOR.
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Sync the device tree and dt-bindings from Linux v5.6-rc2
11a48a5a18c6 ("Linux 5.6-rc2")
The only exception to this is the mmc pinctrl pin bias of gxl SoC family.
This is a fix which found its way to u-boot but not Linux yet.
Acked-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Import the common leds bindings definition from linux
d5226fa6dbae ("Linux 5.5")
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
The Jetson Nano Developer Kit is a Tegra X1-based development board. It
is similar to Jetson TX1 but it is not pin compatible. It features 4GB
of LPDDR4, a SPI NOR flash for early boot firmware and an SD card slot
used for storage.
HDMI 2.0 or DP 1.2 are available for display, four USB ports (3 USB 2.0
and 1 USB 3.0) can be used to attach a variety of peripherals and a PCI
Ethernet controller provides onboard network connectivity. NVMe support
has also been added. Env save is at the end of QSPI (4MB-8K).
A 40-pin header on the board can be used to extend the capabilities and
exposed interfaces of the Jetson Nano.
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Tom Warren <twarren@nvidia.com>
Tested-by: Peter Robinson <pbrobinson@gmail.com>
The L4T kernel is 32MB+, and can overwrite the ramdisk/fdt loaded
from extlinux.conf. Adjust the load addresses to fix this for now.
Using the calculated_env addresses table from T186 U-Boot is a
better fix, but it isn't working correctly on T210 U-Boot right now,
so this will do until I can fix it.
Signed-off-by: Tom Warren <twarren@nvidia.com>
These are used in multiple places so update them to use a shared #define.
Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Philippe Reynes <philippe.reynes@softathome.com>
This series fixes:
* UEFI Python tests CONFIG_OF_CONTROL=y.
* int to pointer cast warning for cmd/efidebug.c
* memory reservation even if fdt node is disabled
Now that the Python test is fixed reintroduce the reverted patch for
vexpress_ca9x4 to enable EFI_LOADER and define the dtb file name.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEbcT5xx8ppvoGt20zxIHbvCwFGsQFAl6C31oACgkQxIHbvCwF
GsSE0g/9Fr+tLqLtTKs4U98YOsspaUFDUJh6o+HkU3CGKVVV2V0hTWqtpYsdMCLv
fZ1ixzW5nObdzZ6MgnuZrnIGbfWSxFQrwi5XtmXonyc3aB4ikztmXpzn16m8GQKH
dvHcvYwdER0OeinXkqp/ao06kZSSLVFk7Jp8+yZuw72QKFUsqne+AjZipqQivwro
PCU0Bi2PXMQ11/g6aYrK2TjEmdDKR3qQmf0TiDfITmgN1QuintqTmjLUFiyqhfDZ
sY4DqaqTtt3+V6qEi9yX16LVg/obgEPkpSm4zYDkKzj8hc9cm71QyZXrrWPTPWgn
j0ymBIPzSU7Y3NlpIDpI8Fz9enES1AOuwFI/xuy00B+EPbT41oHCvSDtqsmDo+30
af68VDIT9alwARJovRd3YxyeWi/lWwksuIHb8eYd9K+MYwxYW5i7V8Pot9VU120C
m+1oAJUg6EUFIp8yRtvJoqrBGGrF6zH650tPUsV73P2MxPgSafqU7ZlmHUGe5zlv
W3qp+A9nEprDJa7DYAHW7oMLQ75Q+UAIpbn4BwGS+4JPZox1uWYUlTDx3YvPDf7r
BvgE57y83fVjSVwB1PnsI6Y326IMGT3W8UriP5Wn0cBD6vrGCVe9hVBX2clWjBRk
8Rv2bOCWNfuxP5K8nQy4ILM2CrdXg7W/SDLP0rkZcPtKTRaspHQ=
=Cgg0
-----END PGP SIGNATURE-----
Merge tag 'efi-2020-04-rc5' of https://gitlab.denx.de/u-boot/custodians/u-boot-efi
Pull request for UEFI sub-system for efi-2020-04-rc5
This series fixes:
* UEFI Python tests CONFIG_OF_CONTROL=y.
* int to pointer cast warning for cmd/efidebug.c
* memory reservation even if fdt node is disabled
Now that the Python test is fixed reintroduce the reverted patch for
vexpress_ca9x4 to enable EFI_LOADER and define the dtb file name.
MC_INIT and BOOT command currently access spi-nor flash memory directly.
As per spi-mem framework, flash memory access via absolute addresses is
no more possible. Use flash APIs to access memory instead of directly
using it.
Signed-off-by: Kuldeep Singh <kuldeep.singh@nxp.com>
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>
Adjust environment kernel_addr_r from 0x96000000 to 0x92000000
to fix a bug that failed to boot kernel for ls1012afrwy with 512MiB RAM,
=> tftpboot $kernel_addr_r Image (Image size is 36 MiB)
TFTP error: trying to overwrite reserved memory...
Signed-off-by: Biwen Li <biwen.li@nxp.com>
Signed-off-by: Priyanka Jain <priyanka.jain@nxp.com>
This patch appends othbootargs to bootargs for LS1021ATWR board.
Signed-off-by: Alison Wang <alison.wang@nxp.com>
Signed-off-by: Priyanka Jain <priyanka.jain@nxp.com>
This supports i2c DM and enables CONFIG_DM_I2C
for SoC LS1046A
Signed-off-by: Biwen Li <biwen.li@nxp.com>
Signed-off-by: Priyanka Jain <priyanka.jain@nxp.com>
This supports i2c DM and enables CONFIG_DM_I2C
for SoC LS1043A
Signed-off-by: Biwen Li <biwen.li@nxp.com>
Signed-off-by: Priyanka Jain <priyanka.jain@nxp.com>
Move the environment variables from command head file to
ls1028ardb specific head file so that they will not mess
up with ls1028aqds board.
Also updated some variable slightly.
There is no function change by this patch.
Signed-off-by: Yuantian Tang <andy.tang@nxp.com>
Signed-off-by: Priyanka Jain <priyanka.jain@nxp.com>
The old load address of itb will overwrite uboots reserved memory
on ls1012afrwy with 512 MiB ram
Signed-off-by: Biwen Li <biwen.li@nxp.com>
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>
Set VID to 800 mV for Rev1 and set VID as per switch settings
for Rev2.
Signed-off-by: Meenakshi Aggarwal <meenakshi.aggarwal@nxp.com>
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>
Update the secure boot headers offsets of Kernel and other
firmware images for SD and XSPI boot sources used by
esbc_validate command.
Signed-off-by: Priyanka Singh <priyanka.singh@nxp.com>
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>
