August 2021 - U-Boot

[PATCH 1/3 v2] efi_capsule: Move signature from DTB to .rodata
by Ilias Apalodimas 02 Aug '21

02 Aug '21

The capsule signature is now part of our DTB. This is problematic when a user is allowed to change/fixup that DTB from U-Boots command line since he can overwrite the signature as well. So Instead of adding the key on the DTB, embed it in the u-boot binary it self as part of it's .rodata. This assumes that the U-Boot binary we load is authenticated by a previous boot stage loader. Reviewed-by: Masami Hiramatsu <masami.hiramatsu(a)linaro.org> Tested-by: Masami Hiramatsu <masami.hiramatsu(a)linaro.org> Tested-by: Sughosh Ganu <sughosh.ganu(a)linaro.org> Signed-off-by: Ilias Apalodimas <ilias.apalodimas(a)linaro.org> --- changes since v1: - added static keyword on efi_get_public_key_data() - added missing config.h on efi_capsule_key.S board/emulation/common/Makefile | 1 - board/emulation/common/qemu_capsule.c | 43 --------------------------- include/asm-generic/sections.h | 2 ++ lib/efi_loader/Kconfig | 7 +++++ lib/efi_loader/Makefile | 8 +++++ lib/efi_loader/efi_capsule.c | 18 +++++++++-- lib/efi_loader/efi_capsule_key.S | 17 +++++++++++ 7 files changed, 49 insertions(+), 47 deletions(-) delete mode 100644 board/emulation/common/qemu_capsule.c create mode 100644 lib/efi_loader/efi_capsule_key.S diff --git a/board/emulation/common/Makefile b/board/emulation/common/Makefile index 7ed447a69dce..c5b452e7e341 100644 --- a/board/emulation/common/Makefile +++ b/board/emulation/common/Makefile @@ -2,4 +2,3 @@ obj-$(CONFIG_SYS_MTDPARTS_RUNTIME) += qemu_mtdparts.o obj-$(CONFIG_SET_DFU_ALT_INFO) += qemu_dfu.o -obj-$(CONFIG_EFI_CAPSULE_FIRMWARE_MANAGEMENT) += qemu_capsule.o diff --git a/board/emulation/common/qemu_capsule.c b/board/emulation/common/qemu_capsule.c deleted file mode 100644 index 6b8a87022a4c..000000000000 --- a/board/emulation/common/qemu_capsule.c +++ /dev/null @@ -1,43 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0+ -/* - * Copyright (c) 2020 Linaro Limited - */ - -#include <common.h> -#include <efi_api.h> -#include <efi_loader.h> -#include <env.h> -#include <fdtdec.h> -#include <asm/global_data.h> - -DECLARE_GLOBAL_DATA_PTR; - -int efi_get_public_key_data(void **pkey, efi_uintn_t *pkey_len) -{ - const void *fdt_blob = gd->fdt_blob; - const void *blob; - const char *cnode_name = "capsule-key"; - const char *snode_name = "signature"; - int sig_node; - int len; - - sig_node = fdt_subnode_offset(fdt_blob, 0, snode_name); - if (sig_node < 0) { - EFI_PRINT("Unable to get signature node offset\n"); - return -FDT_ERR_NOTFOUND; - } - - blob = fdt_getprop(fdt_blob, sig_node, cnode_name, &len); - - if (!blob || len < 0) { - EFI_PRINT("Unable to get capsule-key value\n"); - *pkey = NULL; - *pkey_len = 0; - return -FDT_ERR_NOTFOUND; - } - - *pkey = (void *)blob; - *pkey_len = len; - - return 0; -} diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h index 267f1db73f23..ec992b0c2e3f 100644 --- a/include/asm-generic/sections.h +++ b/include/asm-generic/sections.h @@ -27,6 +27,8 @@ extern char __efi_helloworld_begin[]; extern char __efi_helloworld_end[]; extern char __efi_var_file_begin[]; extern char __efi_var_file_end[]; +extern char __efi_capsule_sig_begin[]; +extern char __efi_capsule_sig_end[]; /* Private data used by of-platdata devices/uclasses */ extern char __priv_data_start[], __priv_data_end[]; diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig index 156b39152112..cf6ff2d537f4 100644 --- a/lib/efi_loader/Kconfig +++ b/lib/efi_loader/Kconfig @@ -213,6 +213,13 @@ config EFI_CAPSULE_AUTHENTICATE Select this option if you want to enable capsule authentication +config EFI_CAPSULE_KEY_PATH + string "Path to .esl cert for capsule authentication" + depends on EFI_CAPSULE_AUTHENTICATE + help + Provide the EFI signature list (esl) certificate used for capsule + authentication + config EFI_DEVICE_PATH_TO_TEXT bool "Device path to text protocol" default y diff --git a/lib/efi_loader/Makefile b/lib/efi_loader/Makefile index fd344cea29b0..9b369430e258 100644 --- a/lib/efi_loader/Makefile +++ b/lib/efi_loader/Makefile @@ -20,11 +20,19 @@ always += helloworld.efi targets += helloworld.o endif +ifeq ($(CONFIG_EFI_CAPSULE_AUTHENTICATE),y) +EFI_CAPSULE_KEY_PATH := $(subst $\",,$(CONFIG_EFI_CAPSULE_KEY_PATH)) +ifeq ("$(wildcard $(EFI_CAPSULE_KEY_PATH))","") +$(error .esl cerificate not found. Configure your CONFIG_EFI_CAPSULE_KEY_PATH) +endif +endif + obj-$(CONFIG_CMD_BOOTEFI_HELLO) += helloworld_efi.o obj-$(CONFIG_CMD_BOOTEFI_BOOTMGR) += efi_bootmgr.o obj-y += efi_boottime.o obj-y += efi_helper.o obj-$(CONFIG_EFI_HAVE_CAPSULE_SUPPORT) += efi_capsule.o +obj-$(CONFIG_EFI_CAPSULE_AUTHENTICATE) += efi_capsule_key.o obj-$(CONFIG_EFI_CAPSULE_FIRMWARE) += efi_firmware.o obj-y += efi_console.o obj-y += efi_device_path.o diff --git a/lib/efi_loader/efi_capsule.c b/lib/efi_loader/efi_capsule.c index b878e71438b8..1900a938c140 100644 --- a/lib/efi_loader/efi_capsule.c +++ b/lib/efi_loader/efi_capsule.c @@ -16,6 +16,7 @@ #include <mapmem.h> #include <sort.h> +#include <asm/sections.h> #include <crypto/pkcs7.h> #include <crypto/pkcs7_parser.h> #include <linux/err.h> @@ -222,12 +223,23 @@ skip: const efi_guid_t efi_guid_capsule_root_cert_guid = EFI_FIRMWARE_MANAGEMENT_CAPSULE_ID_GUID; +static int efi_get_public_key_data(void **pkey, efi_uintn_t *pkey_len) +{ + const void *blob = __efi_capsule_sig_begin; + const int len = __efi_capsule_sig_end - __efi_capsule_sig_begin; + + *pkey = (void *)blob; + *pkey_len = len; + + return 0; +} + efi_status_t efi_capsule_authenticate(const void *capsule, efi_uintn_t capsule_size, void **image, efi_uintn_t *image_size) { u8 *buf; int ret; - void *fdt_pkey, *pkey; + void *stored_pkey, *pkey; efi_uintn_t pkey_len; uint64_t monotonic_count; struct efi_signature_store *truststore; @@ -286,7 +298,7 @@ efi_status_t efi_capsule_authenticate(const void *capsule, efi_uintn_t capsule_s goto out; } - ret = efi_get_public_key_data(&fdt_pkey, &pkey_len); + ret = efi_get_public_key_data(&stored_pkey, &pkey_len); if (ret < 0) goto out; @@ -294,7 +306,7 @@ efi_status_t efi_capsule_authenticate(const void *capsule, efi_uintn_t capsule_s if (!pkey) goto out; - memcpy(pkey, fdt_pkey, pkey_len); + memcpy(pkey, stored_pkey, pkey_len); truststore = efi_build_signature_store(pkey, pkey_len); if (!truststore) goto out; diff --git a/lib/efi_loader/efi_capsule_key.S b/lib/efi_loader/efi_capsule_key.S new file mode 100644 index 000000000000..58f00b8e4bcb --- /dev/null +++ b/lib/efi_loader/efi_capsule_key.S @@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * .esl cert for capsule authentication + * + * Copyright (c) 2021, Ilias Apalodimas <ilias.apalodimas(a)linaro.org> + */ + +#include <config.h> + +.section .rodata.capsule_key.init,"a" +.balign 16 +.global __efi_capsule_sig_begin +__efi_capsule_sig_begin: +.incbin CONFIG_EFI_CAPSULE_KEY_PATH +__efi_capsule_sig_end: +.global __efi_capsule_sig_end +.balign 16 -- 2.31.1

3 13

[PATCH v3 0/7] Arasan sdhci driver updates
by Ashok Reddy Soma 02 Aug '21

02 Aug '21

This patch series updates/fixes below things: - Handle errors from tapdelay functions and return to set_delay() - Add ZynqMP firmware related enums which are used in sdhci driver - Replace mmio_write() with firmware call xilinx_pm_request() - Move tapdelay setting code from tap_delays.c to driver and remove tap_dealy.c and zynqmp_tap_delay.h - Change variable name from deviceid to node_id in couple of functions for consistancy - Add a workaround for sd card detect stable issue for Versal platforms - Use set_control_reg from sdhci.c These patches are based on below microblaze U-Boot 'next' branch. https://source.denx.de/u-boot/custodians/u-boot-microblaze/-/commits/next Changes in v3: - Added new line after return at two places - As we are seeing issues with SPL flow, keep zynqmp_mmio_write method to set tapdelay's and DLL resets. Add xilinx_pm_request on top of it for regular flow. - Changed the patch title to reflect these changes - Make the changes on top of patch 4/7 to move the code to zynq_sdhci.c Changes in v2: - Split patch 1/7 to two patches, one for zynq_sdhci and other one for sdhci - This is the second patch that has been split from 1/7 - This covers changes for sdhci driver separately - Added a debug print in case of error from set_delay() - Added comment for why 1ms delay is needed between DLL assert and release - Remove mmc->dev->seq_ and use priv->deviceid instead - Changed return error from -EIO to -ETIMEDOUT in arasan_sdhci_probe() in card detect state stable workaround Ashok Reddy Soma (5): mmc: zynq_sdhci: Return errors from arasan_sdhci_set_tapdelay mmc: sdhci: Change prototype of set_delay to return errors mmc: zynq_sdhci: Add xilinx_pm_request() method to set tapdelays mmc: zynq_sdhci: Move setting tapdelay code to driver mmc: zynq_sdhci: Use set_control_reg from sdhci.c T Karthik Reddy (2): zynqmp_firmware: Add zynqmp firmware related enums mmc: zynq_sdhci: Wait till sd card detect state is stable board/xilinx/zynqmp/Makefile | 2 - board/xilinx/zynqmp/tap_delays.c | 101 ------------- drivers/mmc/sdhci.c | 10 +- drivers/mmc/zynq_sdhci.c | 242 ++++++++++++++++++++++++++----- include/sdhci.h | 2 +- include/zynqmp_firmware.h | 127 ++++++++++++++++ include/zynqmp_tap_delay.h | 21 --- 7 files changed, 338 insertions(+), 167 deletions(-) delete mode 100644 board/xilinx/zynqmp/tap_delays.c delete mode 100644 include/zynqmp_tap_delay.h -- 2.17.1

2 9

[PATCH v3 00/16] misc: Some more misc patches
by Simon Glass 02 Aug '21

02 Aug '21

Various issues were discovered in getting Chromium OS verified boot running on top of coreboot, booting into U-Boot. Improvements include: - enable serial console if even coreboot doesn't - enable cache always - show the BIOS date since Chromium OS's coreboot doesn't have a version - update docs - allow SPI driver to work without a PCH - fix mtrr command when multi-processing (CONFIG_MP) is disabled - add documentation about the memory map Changes in v3: - Fix comment to menion u-boot,dm-tpl - Fix 'u-boot,dm-pre-tpl' (it should be u-boot,dm-tpl) Changes in v2: - Add a comment about the cases - Reorder declaration and use bios_date for the variable name - Add missing newline in the error path - Use (ret) instead of (ret != 0) to fit with U-Boot style - Convert table to reST format - Add 'cros' tag since this not a generic x86 change - Drop unnecessary patch 'Enable the cbsysinfo command' Simon Glass (16): pci: Use const for pci_find_device_id() etc. x86: pci: Allow binding of some devices before relocation x86: Allow coreboot serial driver to guess the UART spi: ich: Don't require the PCH tpm: cr50: Drop unnecessary coral headers x86: Don't set up MTRRs if previously done x86: Update the MP constants to avoid conflicts x86: Do cache set-up by default when booting from coreboot x86: coreboot: Show the BIOS date x86: coral: Allow booting from coreboot x86: Add function comments to cb_sysinfo.h x86: coreboot: Use vendor in the Kconfig x86: coreboot: Document the memory map x86: cros: Check ROM exists before building vboot dtoc: Check that a parent is not missing doc: Update documentation for cros-2021.04 release arch/x86/cpu/coreboot/Kconfig | 2 +- arch/x86/cpu/i386/cpu.c | 2 +- arch/x86/dts/chromebook_coral.dts | 2 +- arch/x86/dts/chromebook_samus.dts | 2 +- arch/x86/include/asm/cb_sysinfo.h | 16 ++++++ arch/x86/include/asm/mp.h | 12 +++-- arch/x86/lib/init_helpers.c | 18 +++++-- board/coreboot/coreboot/Kconfig | 12 +++-- board/coreboot/coreboot/coreboot.c | 3 ++ board/google/chromebook_coral/coral.c | 28 ++++++++++ doc/board/coreboot/coreboot.rst | 21 ++++++++ doc/chromium/run_vboot.rst | 15 +++--- doc/device-tree-bindings/pci/x86-pci.txt | 7 ++- drivers/pci/pci-uclass.c | 39 ++++++++++++-- drivers/serial/serial_coreboot.c | 68 +++++++++++++++++++++--- drivers/spi/ich.c | 4 +- drivers/tpm/cr50_i2c.c | 2 - include/dt-bindings/pci/pci.h | 12 +++++ include/pci.h | 5 +- include/pci_ids.h | 1 + tools/dtoc/dtb_platdata.py | 9 ++++ tools/dtoc/test/dtoc_test_noparent.dts | 32 +++++++++++ tools/dtoc/test_dtoc.py | 10 ++++ 23 files changed, 278 insertions(+), 44 deletions(-) create mode 100644 include/dt-bindings/pci/pci.h create mode 100644 tools/dtoc/test/dtoc_test_noparent.dts -- 2.32.0.93.g670b81a890-goog

3 22

[PATCH 1/1] doc: add graphviz imagemagick as build dependencies
by Heinrich Schuchardt 01 Aug '21

01 Aug '21

'make htmldocs' requires graphviz and imagemagick (at least with Sphinx 3.5.4). Signed-off-by: Heinrich Schuchardt <xypron.glpk(a)gmx.de> --- doc/build/gcc.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/doc/build/gcc.rst b/doc/build/gcc.rst index 8ffb4e3447..a596487612 100644 --- a/doc/build/gcc.rst +++ b/doc/build/gcc.rst @@ -24,9 +24,9 @@ Depending on the build targets further packages maybe needed .. code-block:: bash sudo apt-get install bc bison build-essential coccinelle \ - device-tree-compiler dfu-util efitools flex gdisk liblz4-tool \ - libguestfs-tools libncurses-dev libpython3-dev libsdl2-dev libssl-dev \ - lz4 lzma lzma-alone openssl python3 python3-coverage \ + device-tree-compiler dfu-util efitools flex gdisk grapviz imagemagick \ + liblz4-tool libguestfs-tools libncurses-dev libpython3-dev libsdl2-dev \ + libssl-dev lz4 lzma lzma-alone openssl python3 python3-coverage \ python3-pycryptodome python3-pyelftools python3-pytest \ python3-sphinxcontrib.apidoc python3-sphinx-rtd-theme python3-virtualenv \ swig -- 2.30.2

1 0

Re: [PATCH] doc: board: Move j721e document to doc/board/ti/ directory
by Heinrich Schuchardt 01 Aug '21

01 Aug '21

Dear Kishon, your merged patch 8baeeecbe305 ("doc: board: Move j721e document to doc/board/ti/ directory") leads to 'make html' build errors: doc/board/index.rst:6: WARNING: toctree contains reference to nonexisting document 'board/ti/index' looking for now-outdated files... none found pickling environment... done checking consistency... /doc/board/ti/j721e_evm.rst: WARNING: document isn't included in any toctree Please, provide a patch with the missing file doc/board/ti/index.rst. @Tom: Shouldn't these errors result in an error on the CI platform? Please, enable option -W (Turn warnings into errors). diff --git a/doc/Makefile b/doc/Makefile index 683e4b5609..050d9dd239 100644 --- a/doc/Makefile +++ b/doc/Makefile @@ -7,4 +7,4 @@ subdir-y := # You can set these variables from the command line. SPHINXBUILD = sphinx-build -SPHINXOPTS = +SPHINXOPTS = -W SPHINXDIRS = . Best regards Heinrich

2 3

[PATCH v3 00/15] image: A partial series for the image clean-up
by Simon Glass 01 Aug '21

01 Aug '21

Now that the competing image clean-up has landed and the smoke has cleared, we can come back to this one. This series includes about a third of the original patches, mostly the ones that apply cleanly. It does not reduce the #idefs by as much, but it does make some small code improvements. Further patches can be pulled in once these ones have been reviewed and land. Changes in v3: - Pick up only the first part of the original v2 series Changes in v2: - Add a patch to introduce a memdup() function - Add new abuf_init_set() function - Update abuf_realloc() to return after every case - Use const for abuf_data() and abuf_size() - Make use of memdup() - Add abuf_init_move() - Add comments about the assumptions made by lib_test_abuf_realloc() - Add better comments about why some tests are skipped at present - Correct 'hose' typo Simon Glass (15): lib: Add memdup() Add support for an owned buffer compiler: Add a comment to host_build() zstd: Create a function for use from U-Boot btrfs: Use U-Boot API for decompression image: Avoid switch default in image_decomp() image: Update zstd to avoid reporting error twice gzip: Avoid use of u64 image: Update image_decomp() to avoid ifdefs image: Split board code out into its own file image: Fix up checkpatch warnings in image-board.c image: Split host code out into its own file image: Create a function to do manual relocation image: Avoid #ifdefs for manual relocation image: Remove ifdefs around image_setup_linux() el at common/Makefile | 2 +- common/bootm.c | 16 +- common/image-board.c | 939 +++++++++++++++++++++++++++++ common/image-host.c | 27 + common/image-sig.c | 40 +- common/image.c | 1177 +++---------------------------------- configs/sandbox_defconfig | 1 + fs/btrfs/compression.c | 51 +- include/abuf.h | 159 +++++ include/compiler.h | 8 + include/gzip.h | 8 +- include/linux/string.h | 13 + include/linux/zstd.h | 11 + include/relocate.h | 30 +- lib/Makefile | 1 + lib/abuf.c | 109 ++++ lib/gunzip.c | 28 +- lib/string.c | 13 + lib/zstd/Makefile | 2 +- lib/zstd/zstd.c | 64 ++ test/lib/Makefile | 1 + test/lib/abuf.c | 344 +++++++++++ test/lib/string.c | 32 + tools/Makefile | 1 + 24 files changed, 1887 insertions(+), 1190 deletions(-) create mode 100644 common/image-board.c create mode 100644 common/image-host.c create mode 100644 include/abuf.h create mode 100644 lib/abuf.c create mode 100644 lib/zstd/zstd.c create mode 100644 test/lib/abuf.c -- 2.32.0.554.ge1b32706d8-goog

2 16

[PATCH v2 0/4] sf: Add documentation and an 'sf mmap' command
by Simon Glass 01 Aug '21

01 Aug '21

This little series adds documentation and a few other tidy-ups to the 'sf' command. It also provides a way to access memory-mapped SPI via the command line. Changes in v2: - Explain why 'usage' cannot be const - Many fixes as suggested by Heinrich Simon Glass (4): command: Use a constant pointer for the help sf: Tidy up code to avoid #ifdef sf: doc: Add documentation for the 'sf' command sf: Provide a command to access memory-mapped SPI arch/Kconfig | 2 + cmd/Kconfig | 8 ++ cmd/sf.c | 67 +++++++--- doc/usage/index.rst | 1 + doc/usage/sf.rst | 291 ++++++++++++++++++++++++++++++++++++++++++++ include/command.h | 2 +- 6 files changed, 352 insertions(+), 19 deletions(-) create mode 100644 doc/usage/sf.rst -- 2.32.0.554.ge1b32706d8-goog

2 6

U-Boot zboot on x86-64 VirtualBox UEFI.
by Christian Melki 01 Aug '21

01 Aug '21

Hi. I have been trying to boot a bzImage with zboot from a VirtualBox UEFI instance -> U-Boot UEFI payload. So far I've been using 2021.07-rc1. I'd like to try a newer rc, but even if built exactly the same with the same .config, newer won't boot as an UEFI payload. So right now, I'm stuck at rc1. Anyway. The kernel in question starts when configured with an EFI stub from the UEFI shell. U-boot fails to boot the bzImage from the console using zboot though. Just freezes after "Starting kernel..." zboot 01080000 - 04000000 319c000 Valid Boot Flag Magic signature found Linux kernel version 5.12.0 (ptxdist@ptxdist) #2 SMP PREEMPT 2021-06-01T00:00:00+00:00 Building boot_params at 0x00090000 Loading bzImage at address 100000 (6516096 bytes) Initial RAM disk at linear address 0x04000000, size 52019200 bytes Kernel command line: "console=ttyS0,115200 rw quiet" Kernel loaded at 00100000, setup_base=00090000 Starting kernel ... Any ideas? Best regards, Christian

2 4

[PATCH 1/1] doc: handle 'make htmldocs' warnings as errors
by Heinrich Schuchardt 01 Aug '21

01 Aug '21

Parameter -W for sphinx-build turns build warnings into errors. This helps us to avoid bad patches passing Gitlab CI. Signed-off-by: Heinrich Schuchardt <xypron.glpk(a)gmx.de> --- doc/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/Makefile b/doc/Makefile index 683e4b5609..050d9dd239 100644 --- a/doc/Makefile +++ b/doc/Makefile @@ -6,7 +6,7 @@ subdir-y := # You can set these variables from the command line. SPHINXBUILD = sphinx-build -SPHINXOPTS = +SPHINXOPTS = -W SPHINXDIRS = . _SPHINXDIRS = $(patsubst $(srctree)/doc/%/conf.py,%,$(wildcard $(srctree)/doc/*/conf.py)) SPHINX_CONF = conf.py -- 2.30.2

1 0

[PATCH 1/1] doc: add missing board/ti/index.rst
by Heinrich Schuchardt 01 Aug '21

01 Aug '21

Commit 8baeeecbe305 ("doc: board: Move j721e document to doc/board/ti/ directory") introduced 'make htmldocs' build errors due to a missing file board/ti/index.rst. Fixes: 8baeeecbe305 ("doc: board: Move j721e document to doc/board/ti/ directory") Signed-off-by: Heinrich Schuchardt <xypron.glpk(a)gmx.de> --- doc/board/ti/index.rst | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 doc/board/ti/index.rst diff --git a/doc/board/ti/index.rst b/doc/board/ti/index.rst new file mode 100644 index 0000000000..c0da04b109 --- /dev/null +++ b/doc/board/ti/index.rst @@ -0,0 +1,9 @@ +.. SPDX-License-Identifier: GPL-2.0+ + +Texas Instruments +================= + +.. toctree:: + :maxdepth: 2 + + j721e_evm -- 2.30.2

1 0