Re: [U-Boot] [PATCH] rpi3: Enable verified boot from FIT image
Matthias Brugger mbrugger@suse.com 于2019年7月31日周三 下午4:05写道：
On 11/07/2019 05:55, Jun Nie wrote:
Enable verified boot from FIT image with select configs and specify boot script image node in FIT image, the FIT image is verified before it is run.
Code that reusing dtb in firmware is disabled, so that the dtb with pubic key packed in u-boot.bin can be used to verify the signature of next stage FIT image.
Signed-off-by: Jun Nie jun.nie@linaro.org
board/raspberrypi/rpi/rpi.c | 6 ++++++ include/configs/rpi.h | 15 ++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c index 617c892..950ee84 100644 --- a/board/raspberrypi/rpi/rpi.c +++ b/board/raspberrypi/rpi/rpi.c @@ -297,6 +297,7 @@ static void set_fdtfile(void) env_set("fdtfile", fdtfile); }
+#ifndef CONFIG_FIT_SIGNATURE /*
- If the firmware provided a valid FDT at boot time, let's expose it in
- ${fdt_addr} so it may be passed unmodified to the kernel.
@@ -311,6 +312,7 @@ static void set_fdt_addr(void)
env_set_hex("fdt_addr", fw_dtb_pointer);} +#endif
/*
- Prevent relocation from stomping on a firmware provided FDT blob.
@@ -393,7 +395,9 @@ static void set_serial_number(void)
int misc_init_r(void) { +#ifndef CONFIG_FIT_SIGNATURE set_fdt_addr(); +#endif set_fdtfile(); set_usbethaddr(); #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG @@ -470,6 +474,7 @@ int board_init(void) return bcm2835_power_on_module(BCM2835_MBOX_POWER_DEVID_USB_HCD); }
+#ifndef CONFIG_FIT_SIGNATURE /*
- If the firmware passed a device tree use it for U-Boot.
*/ @@ -479,6 +484,7 @@ void *board_fdt_blob_setup(void) return NULL; return (void *)fw_dtb_pointer; } +#endif
Just to get this clear we need this because we want to pass the device tree via OF_SEPARATE, correct?
You are right. U-boot need to read he signature from dtb.
int ft_board_setup(void *blob, bd_t *bd) { diff --git a/include/configs/rpi.h b/include/configs/rpi.h index f76c7d1..ba91205 100644 --- a/include/configs/rpi.h +++ b/include/configs/rpi.h @@ -180,11 +180,24 @@
#include <config_distro_bootcmd.h>
+#ifdef CONFIG_FIT_SIGNATURE +#define FIT_BOOT_CMD \
"boot_a_script=" \"load ${devtype} ${devnum}:${distro_bootpart} " \"${scriptaddr} ${prefix}${script}; " \"iminfo ${scriptaddr};" \"if test $? -eq 1; then reset; fi;" \"source ${scriptaddr}:bootscr\0"+#else +#define FIT_BOOT_CMD "" +#endif
Doesn't this overwrite the boot_a_script in distro_bootcmd?
Would it make sense to add FIT booting to the distro boot command?
Regards, Matthias
Yes, it overwrite the boot_a_script in distro_bootcmd. It is make sense to add this to the distro boot command. I can send another patch to move these lines to common code later.
#define CONFIG_EXTRA_ENV_SETTINGS \ "dhcpuboot=usb start; dhcp u-boot.uimg; bootm\0" \ ENV_DEVICE_SETTINGS \ ENV_MEM_LAYOUT_SETTINGS \
BOOTENV
BOOTENV \FIT_BOOT_CMD#endif
Jun Nie jun.nie@linaro.org 于2019年7月31日周三 下午4:16写道：
Matthias Brugger mbrugger@suse.com 于2019年7月31日周三 下午4:05写道：
On 11/07/2019 05:55, Jun Nie wrote:
Enable verified boot from FIT image with select configs and specify boot script image node in FIT image, the FIT image is verified before it is run.
Code that reusing dtb in firmware is disabled, so that the dtb with pubic key packed in u-boot.bin can be used to verify the signature of next stage FIT image.
Signed-off-by: Jun Nie jun.nie@linaro.org
board/raspberrypi/rpi/rpi.c | 6 ++++++ include/configs/rpi.h | 15 ++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c index 617c892..950ee84 100644 --- a/board/raspberrypi/rpi/rpi.c +++ b/board/raspberrypi/rpi/rpi.c @@ -297,6 +297,7 @@ static void set_fdtfile(void) env_set("fdtfile", fdtfile); }
+#ifndef CONFIG_FIT_SIGNATURE /*
- If the firmware provided a valid FDT at boot time, let's expose it in
- ${fdt_addr} so it may be passed unmodified to the kernel.
@@ -311,6 +312,7 @@ static void set_fdt_addr(void)
env_set_hex("fdt_addr", fw_dtb_pointer);} +#endif
/*
- Prevent relocation from stomping on a firmware provided FDT blob.
@@ -393,7 +395,9 @@ static void set_serial_number(void)
int misc_init_r(void) { +#ifndef CONFIG_FIT_SIGNATURE set_fdt_addr(); +#endif set_fdtfile(); set_usbethaddr(); #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG @@ -470,6 +474,7 @@ int board_init(void) return bcm2835_power_on_module(BCM2835_MBOX_POWER_DEVID_USB_HCD); }
+#ifndef CONFIG_FIT_SIGNATURE /*
- If the firmware passed a device tree use it for U-Boot.
*/ @@ -479,6 +484,7 @@ void *board_fdt_blob_setup(void) return NULL; return (void *)fw_dtb_pointer; } +#endif
Just to get this clear we need this because we want to pass the device tree via OF_SEPARATE, correct?
You are right. U-boot need to read he signature from dtb.
int ft_board_setup(void *blob, bd_t *bd) { diff --git a/include/configs/rpi.h b/include/configs/rpi.h index f76c7d1..ba91205 100644 --- a/include/configs/rpi.h +++ b/include/configs/rpi.h @@ -180,11 +180,24 @@
#include <config_distro_bootcmd.h>
+#ifdef CONFIG_FIT_SIGNATURE +#define FIT_BOOT_CMD \
"boot_a_script=" \"load ${devtype} ${devnum}:${distro_bootpart} " \"${scriptaddr} ${prefix}${script}; " \"iminfo ${scriptaddr};" \"if test $? -eq 1; then reset; fi;" \"source ${scriptaddr}:bootscr\0"+#else +#define FIT_BOOT_CMD "" +#endif
Doesn't this overwrite the boot_a_script in distro_bootcmd?
Would it make sense to add FIT booting to the distro boot command?
Regards, Matthias
Yes, it overwrite the boot_a_script in distro_bootcmd. It is make sense to add this to the distro boot command. I can send another patch to move these lines to common code later.
#define CONFIG_EXTRA_ENV_SETTINGS \ "dhcpuboot=usb start; dhcp u-boot.uimg; bootm\0" \ ENV_DEVICE_SETTINGS \ ENV_MEM_LAYOUT_SETTINGS \
BOOTENV
BOOTENV \FIT_BOOT_CMD#endif
Hi Matthias,
How do you think to merge this patch?
Regards, Jun
+Alex, Lukas, Heinrich, Bin and Simon
On 31/07/2019 10:16, Jun Nie wrote:
Matthias Brugger mbrugger@suse.com 于2019年7月31日周三 下午4:05写道：
On 11/07/2019 05:55, Jun Nie wrote:
Enable verified boot from FIT image with select configs and specify boot script image node in FIT image, the FIT image is verified before it is run.
Code that reusing dtb in firmware is disabled, so that the dtb with pubic key packed in u-boot.bin can be used to verify the signature of next stage FIT image.
Signed-off-by: Jun Nie jun.nie@linaro.org
board/raspberrypi/rpi/rpi.c | 6 ++++++ include/configs/rpi.h | 15 ++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c index 617c892..950ee84 100644 --- a/board/raspberrypi/rpi/rpi.c +++ b/board/raspberrypi/rpi/rpi.c @@ -297,6 +297,7 @@ static void set_fdtfile(void) env_set("fdtfile", fdtfile); }
+#ifndef CONFIG_FIT_SIGNATURE /*
- If the firmware provided a valid FDT at boot time, let's expose it in
- ${fdt_addr} so it may be passed unmodified to the kernel.
@@ -311,6 +312,7 @@ static void set_fdt_addr(void)
env_set_hex("fdt_addr", fw_dtb_pointer);} +#endif
/*
- Prevent relocation from stomping on a firmware provided FDT blob.
@@ -393,7 +395,9 @@ static void set_serial_number(void)
int misc_init_r(void) { +#ifndef CONFIG_FIT_SIGNATURE set_fdt_addr(); +#endif set_fdtfile(); set_usbethaddr(); #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG @@ -470,6 +474,7 @@ int board_init(void) return bcm2835_power_on_module(BCM2835_MBOX_POWER_DEVID_USB_HCD); }
+#ifndef CONFIG_FIT_SIGNATURE /*
- If the firmware passed a device tree use it for U-Boot.
*/ @@ -479,6 +484,7 @@ void *board_fdt_blob_setup(void) return NULL; return (void *)fw_dtb_pointer; } +#endif
Just to get this clear we need this because we want to pass the device tree via OF_SEPARATE, correct?
You are right. U-boot need to read he signature from dtb.
int ft_board_setup(void *blob, bd_t *bd) { diff --git a/include/configs/rpi.h b/include/configs/rpi.h index f76c7d1..ba91205 100644 --- a/include/configs/rpi.h +++ b/include/configs/rpi.h @@ -180,11 +180,24 @@
#include <config_distro_bootcmd.h>
+#ifdef CONFIG_FIT_SIGNATURE +#define FIT_BOOT_CMD \
"boot_a_script=" \"load ${devtype} ${devnum}:${distro_bootpart} " \"${scriptaddr} ${prefix}${script}; " \"iminfo ${scriptaddr};" \"if test $? -eq 1; then reset; fi;" \"source ${scriptaddr}:bootscr\0"+#else +#define FIT_BOOT_CMD "" +#endif
Doesn't this overwrite the boot_a_script in distro_bootcmd?
Would it make sense to add FIT booting to the distro boot command?
Regards, Matthias
Yes, it overwrite the boot_a_script in distro_bootcmd. It is make sense to add this to the distro boot command. I can send another patch to move these lines to common code later.
Question to the people just added, as you have relevant submission to distroboot. Do you think it makes sense to add FIT_BOOT_CMD to that?
Regards, Matthias
#define CONFIG_EXTRA_ENV_SETTINGS \ "dhcpuboot=usb start; dhcp u-boot.uimg; bootm\0" \ ENV_DEVICE_SETTINGS \ ENV_MEM_LAYOUT_SETTINGS \
BOOTENV
BOOTENV \FIT_BOOT_CMD#endif
On 9/2/19 12:30 PM, Matthias Brugger wrote:
+Alex, Lukas, Heinrich, Bin and Simon
On 31/07/2019 10:16, Jun Nie wrote:
Matthias Brugger mbrugger@suse.com 于2019年7月31日周三 下午4:05写道：
On 11/07/2019 05:55, Jun Nie wrote:
Enable verified boot from FIT image with select configs and specify boot script image node in FIT image, the FIT image is verified before it is run.
Code that reusing dtb in firmware is disabled, so that the dtb with pubic key packed in u-boot.bin can be used to verify the signature of next stage FIT image.
Signed-off-by: Jun Nie jun.nie@linaro.org
board/raspberrypi/rpi/rpi.c | 6 ++++++ include/configs/rpi.h | 15 ++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c index 617c892..950ee84 100644 --- a/board/raspberrypi/rpi/rpi.c +++ b/board/raspberrypi/rpi/rpi.c @@ -297,6 +297,7 @@ static void set_fdtfile(void) env_set("fdtfile", fdtfile); }
+#ifndef CONFIG_FIT_SIGNATURE /*
- If the firmware provided a valid FDT at boot time, let's expose it in
- ${fdt_addr} so it may be passed unmodified to the kernel.
@@ -311,6 +312,7 @@ static void set_fdt_addr(void)
env_set_hex("fdt_addr", fw_dtb_pointer);} +#endif
/*
- Prevent relocation from stomping on a firmware provided FDT blob.
@@ -393,7 +395,9 @@ static void set_serial_number(void)
int misc_init_r(void) { +#ifndef CONFIG_FIT_SIGNATURE set_fdt_addr(); +#endif set_fdtfile(); set_usbethaddr(); #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG @@ -470,6 +474,7 @@ int board_init(void) return bcm2835_power_on_module(BCM2835_MBOX_POWER_DEVID_USB_HCD); }
+#ifndef CONFIG_FIT_SIGNATURE /*
- If the firmware passed a device tree use it for U-Boot.
*/ @@ -479,6 +484,7 @@ void *board_fdt_blob_setup(void) return NULL; return (void *)fw_dtb_pointer; } +#endif
Just to get this clear we need this because we want to pass the device tree via OF_SEPARATE, correct?
You are right. U-boot need to read he signature from dtb.
int ft_board_setup(void *blob, bd_t *bd) { diff --git a/include/configs/rpi.h b/include/configs/rpi.h index f76c7d1..ba91205 100644 --- a/include/configs/rpi.h +++ b/include/configs/rpi.h @@ -180,11 +180,24 @@
#include <config_distro_bootcmd.h>
+#ifdef CONFIG_FIT_SIGNATURE +#define FIT_BOOT_CMD \
"boot_a_script=" \"load ${devtype} ${devnum}:${distro_bootpart} " \"${scriptaddr} ${prefix}${script}; " \"iminfo ${scriptaddr};" \"if test $? -eq 1; then reset; fi;" \"source ${scriptaddr}:bootscr\0"+#else +#define FIT_BOOT_CMD "" +#endif
Doesn't this overwrite the boot_a_script in distro_bootcmd?
Would it make sense to add FIT booting to the distro boot command?
Regards, Matthias
Yes, it overwrite the boot_a_script in distro_bootcmd. It is make sense to add this to the distro boot command. I can send another patch to move these lines to common code later.
Question to the people just added, as you have relevant submission to distroboot. Do you think it makes sense to add FIT_BOOT_CMD to that?
Regards, Matthias
The idea of distro-boot was to make it easier for Linux distributions to update the information needed by U-Boot to find the right kernel and ramdisk.
According to doc/README.distro file extlinux.conf should be used for the communication between the distribution and U-Boot. Some distributions like Debian still rely on boot.scr.
Many distributions (OpenBSD, FreeBSD, Suse, Fedora) have moved from distro-boot to UEFI as booting standard. Unfortunately we have not documented our support for this in doc/README.distro (TODO for me). Takahiro is working on secure boot using UEFI. Once completed this could obsolete FIT images.
Would we expect Linux distributions to provide FIT images upon kernel updates? Is there any Linux distribution doing so?
Only if we can answer these questions with yes, adding FIT_BOOT_CMD to distro-boot would make sense to me.
Best regards
Heinrich
#define CONFIG_EXTRA_ENV_SETTINGS \ "dhcpuboot=usb start; dhcp u-boot.uimg; bootm\0" \ ENV_DEVICE_SETTINGS \ ENV_MEM_LAYOUT_SETTINGS \
BOOTENV
BOOTENV \FIT_BOOT_CMD#endif
On Mon, Sep 02, 2019 at 01:19:06PM +0200, Heinrich Schuchardt wrote:
On 9/2/19 12:30 PM, Matthias Brugger wrote:
+Alex, Lukas, Heinrich, Bin and Simon
On 31/07/2019 10:16, Jun Nie wrote:
Matthias Brugger mbrugger@suse.com 于2019年7月31日周三 下午4:05写道：
On 11/07/2019 05:55, Jun Nie wrote:
Enable verified boot from FIT image with select configs and specify boot script image node in FIT image, the FIT image is verified before it is run.
Code that reusing dtb in firmware is disabled, so that the dtb with pubic key packed in u-boot.bin can be used to verify the signature of next stage FIT image.
Signed-off-by: Jun Nie jun.nie@linaro.org
board/raspberrypi/rpi/rpi.c | 6 ++++++ include/configs/rpi.h | 15 ++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c index 617c892..950ee84 100644 --- a/board/raspberrypi/rpi/rpi.c +++ b/board/raspberrypi/rpi/rpi.c @@ -297,6 +297,7 @@ static void set_fdtfile(void) env_set("fdtfile", fdtfile); }
+#ifndef CONFIG_FIT_SIGNATURE /*
- If the firmware provided a valid FDT at boot time, let's expose it in
- ${fdt_addr} so it may be passed unmodified to the kernel.
@@ -311,6 +312,7 @@ static void set_fdt_addr(void)
env_set_hex("fdt_addr", fw_dtb_pointer);} +#endif
/*
- Prevent relocation from stomping on a firmware provided FDT blob.
@@ -393,7 +395,9 @@ static void set_serial_number(void)
int misc_init_r(void) { +#ifndef CONFIG_FIT_SIGNATURE set_fdt_addr(); +#endif set_fdtfile(); set_usbethaddr(); #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG @@ -470,6 +474,7 @@ int board_init(void) return bcm2835_power_on_module(BCM2835_MBOX_POWER_DEVID_USB_HCD); }
+#ifndef CONFIG_FIT_SIGNATURE /*
- If the firmware passed a device tree use it for U-Boot.
*/ @@ -479,6 +484,7 @@ void *board_fdt_blob_setup(void) return NULL; return (void *)fw_dtb_pointer; } +#endif
Just to get this clear we need this because we want to pass the device tree via OF_SEPARATE, correct?
You are right. U-boot need to read he signature from dtb.
int ft_board_setup(void *blob, bd_t *bd) { diff --git a/include/configs/rpi.h b/include/configs/rpi.h index f76c7d1..ba91205 100644 --- a/include/configs/rpi.h +++ b/include/configs/rpi.h @@ -180,11 +180,24 @@
#include <config_distro_bootcmd.h>
+#ifdef CONFIG_FIT_SIGNATURE +#define FIT_BOOT_CMD \
"boot_a_script=" \"load ${devtype} ${devnum}:${distro_bootpart} " \"${scriptaddr} ${prefix}${script}; " \"iminfo ${scriptaddr};" \"if test $? -eq 1; then reset; fi;" \"source ${scriptaddr}:bootscr\0"+#else +#define FIT_BOOT_CMD "" +#endif
Doesn't this overwrite the boot_a_script in distro_bootcmd?
Would it make sense to add FIT booting to the distro boot command?
Regards, Matthias
Yes, it overwrite the boot_a_script in distro_bootcmd. It is make sense to add this to the distro boot command. I can send another patch to move these lines to common code later.
Question to the people just added, as you have relevant submission to distroboot. Do you think it makes sense to add FIT_BOOT_CMD to that?
Regards, Matthias
The idea of distro-boot was to make it easier for Linux distributions to update the information needed by U-Boot to find the right kernel and ramdisk.
According to doc/README.distro file extlinux.conf should be used for the communication between the distribution and U-Boot. Some distributions like Debian still rely on boot.scr.
Many distributions (OpenBSD, FreeBSD, Suse, Fedora) have moved from distro-boot to UEFI as booting standard. Unfortunately we have not documented our support for this in doc/README.distro (TODO for me). Takahiro is working on secure boot using UEFI. Once completed this could obsolete FIT images.
Well, UEFI secure boot handles PE(+) images and doesn't cover dtb, initrd or whatever FIT may contain.
-Takahiro Akashi
Would we expect Linux distributions to provide FIT images upon kernel updates? Is there any Linux distribution doing so?
Only if we can answer these questions with yes, adding FIT_BOOT_CMD to distro-boot would make sense to me.
Best regards
Heinrich
#define CONFIG_EXTRA_ENV_SETTINGS \ "dhcpuboot=usb start; dhcp u-boot.uimg; bootm\0" \ ENV_DEVICE_SETTINGS \ ENV_MEM_LAYOUT_SETTINGS \
BOOTENV
BOOTENV \FIT_BOOT_CMD#endif
Heinrich Schuchardt xypron.glpk@gmx.de 于2019年9月2日周一 下午7:19写道：
On 9/2/19 12:30 PM, Matthias Brugger wrote:
+Alex, Lukas, Heinrich, Bin and Simon
On 31/07/2019 10:16, Jun Nie wrote:
Matthias Brugger mbrugger@suse.com 于2019年7月31日周三 下午4:05写道：
On 11/07/2019 05:55, Jun Nie wrote:
Enable verified boot from FIT image with select configs and specify boot script image node in FIT image, the FIT image is verified before it is run.
Code that reusing dtb in firmware is disabled, so that the dtb with pubic key packed in u-boot.bin can be used to verify the signature of next stage FIT image.
Signed-off-by: Jun Nie jun.nie@linaro.org
board/raspberrypi/rpi/rpi.c | 6 ++++++ include/configs/rpi.h | 15 ++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c index 617c892..950ee84 100644 --- a/board/raspberrypi/rpi/rpi.c +++ b/board/raspberrypi/rpi/rpi.c @@ -297,6 +297,7 @@ static void set_fdtfile(void) env_set("fdtfile", fdtfile); }
+#ifndef CONFIG_FIT_SIGNATURE /*
- If the firmware provided a valid FDT at boot time, let's expose it in
- ${fdt_addr} so it may be passed unmodified to the kernel.
@@ -311,6 +312,7 @@ static void set_fdt_addr(void)
env_set_hex("fdt_addr", fw_dtb_pointer);} +#endif
/*
- Prevent relocation from stomping on a firmware provided FDT blob.
@@ -393,7 +395,9 @@ static void set_serial_number(void)
int misc_init_r(void) { +#ifndef CONFIG_FIT_SIGNATURE set_fdt_addr(); +#endif set_fdtfile(); set_usbethaddr(); #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG @@ -470,6 +474,7 @@ int board_init(void) return bcm2835_power_on_module(BCM2835_MBOX_POWER_DEVID_USB_HCD); }
+#ifndef CONFIG_FIT_SIGNATURE /*
- If the firmware passed a device tree use it for U-Boot.
*/ @@ -479,6 +484,7 @@ void *board_fdt_blob_setup(void) return NULL; return (void *)fw_dtb_pointer; } +#endif
Just to get this clear we need this because we want to pass the device tree via OF_SEPARATE, correct?
You are right. U-boot need to read he signature from dtb.
int ft_board_setup(void *blob, bd_t *bd) { diff --git a/include/configs/rpi.h b/include/configs/rpi.h index f76c7d1..ba91205 100644 --- a/include/configs/rpi.h +++ b/include/configs/rpi.h @@ -180,11 +180,24 @@
#include <config_distro_bootcmd.h>
+#ifdef CONFIG_FIT_SIGNATURE +#define FIT_BOOT_CMD \
"boot_a_script=" \"load ${devtype} ${devnum}:${distro_bootpart} " \"${scriptaddr} ${prefix}${script}; " \"iminfo ${scriptaddr};" \"if test $? -eq 1; then reset; fi;" \"source ${scriptaddr}:bootscr\0"+#else +#define FIT_BOOT_CMD "" +#endif
Doesn't this overwrite the boot_a_script in distro_bootcmd?
Would it make sense to add FIT booting to the distro boot command?
Regards, Matthias
Yes, it overwrite the boot_a_script in distro_bootcmd. It is make sense to add this to the distro boot command. I can send another patch to move these lines to common code later.
Question to the people just added, as you have relevant submission to distroboot. Do you think it makes sense to add FIT_BOOT_CMD to that?
Regards, Matthias
The idea of distro-boot was to make it easier for Linux distributions to update the information needed by U-Boot to find the right kernel and ramdisk.
According to doc/README.distro file extlinux.conf should be used for the communication between the distribution and U-Boot. Some distributions like Debian still rely on boot.scr.
Many distributions (OpenBSD, FreeBSD, Suse, Fedora) have moved from distro-boot to UEFI as booting standard. Unfortunately we have not documented our support for this in doc/README.distro (TODO for me). Takahiro is working on secure boot using UEFI. Once completed this could obsolete FIT images.
Would we expect Linux distributions to provide FIT images upon kernel updates? Is there any Linux distribution doing so?
Embedded Linux, a new distribution from ARM, is using FIT images to update kernel. https://os.mbed.com/docs/mbed-linux-os/v0.8/welcome/index.html
Jun
Only if we can answer these questions with yes, adding FIT_BOOT_CMD to distro-boot would make sense to me.
Best regards
Heinrich
#define CONFIG_EXTRA_ENV_SETTINGS \ "dhcpuboot=usb start; dhcp u-boot.uimg; bootm\0" \ ENV_DEVICE_SETTINGS \ ENV_MEM_LAYOUT_SETTINGS \
BOOTENV
BOOTENV \FIT_BOOT_CMD#endif
On 03/09/2019 09:12, Jun Nie wrote:
Heinrich Schuchardt xypron.glpk@gmx.de 于2019年9月2日周一 下午7:19写道：
On 9/2/19 12:30 PM, Matthias Brugger wrote:
+Alex, Lukas, Heinrich, Bin and Simon
On 31/07/2019 10:16, Jun Nie wrote:
Matthias Brugger mbrugger@suse.com 于2019年7月31日周三 下午4:05写道：
On 11/07/2019 05:55, Jun Nie wrote:
Enable verified boot from FIT image with select configs and specify boot script image node in FIT image, the FIT image is verified before it is run.
Code that reusing dtb in firmware is disabled, so that the dtb with pubic key packed in u-boot.bin can be used to verify the signature of next stage FIT image.
Signed-off-by: Jun Nie jun.nie@linaro.org
board/raspberrypi/rpi/rpi.c | 6 ++++++ include/configs/rpi.h | 15 ++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c index 617c892..950ee84 100644 --- a/board/raspberrypi/rpi/rpi.c +++ b/board/raspberrypi/rpi/rpi.c @@ -297,6 +297,7 @@ static void set_fdtfile(void) env_set("fdtfile", fdtfile); }
+#ifndef CONFIG_FIT_SIGNATURE /*
- If the firmware provided a valid FDT at boot time, let's expose it in
- ${fdt_addr} so it may be passed unmodified to the kernel.
@@ -311,6 +312,7 @@ static void set_fdt_addr(void)
env_set_hex("fdt_addr", fw_dtb_pointer);} +#endif
/*
- Prevent relocation from stomping on a firmware provided FDT blob.
@@ -393,7 +395,9 @@ static void set_serial_number(void)
int misc_init_r(void) { +#ifndef CONFIG_FIT_SIGNATURE set_fdt_addr(); +#endif set_fdtfile(); set_usbethaddr(); #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG @@ -470,6 +474,7 @@ int board_init(void) return bcm2835_power_on_module(BCM2835_MBOX_POWER_DEVID_USB_HCD); }
+#ifndef CONFIG_FIT_SIGNATURE /*
- If the firmware passed a device tree use it for U-Boot.
*/ @@ -479,6 +484,7 @@ void *board_fdt_blob_setup(void) return NULL; return (void *)fw_dtb_pointer; } +#endif
Just to get this clear we need this because we want to pass the device tree via OF_SEPARATE, correct?
You are right. U-boot need to read he signature from dtb.
int ft_board_setup(void *blob, bd_t *bd) { diff --git a/include/configs/rpi.h b/include/configs/rpi.h index f76c7d1..ba91205 100644 --- a/include/configs/rpi.h +++ b/include/configs/rpi.h @@ -180,11 +180,24 @@
#include <config_distro_bootcmd.h>
+#ifdef CONFIG_FIT_SIGNATURE +#define FIT_BOOT_CMD \
"boot_a_script=" \"load ${devtype} ${devnum}:${distro_bootpart} " \"${scriptaddr} ${prefix}${script}; " \"iminfo ${scriptaddr};" \"if test $? -eq 1; then reset; fi;" \"source ${scriptaddr}:bootscr\0"+#else +#define FIT_BOOT_CMD "" +#endif
Doesn't this overwrite the boot_a_script in distro_bootcmd?
Would it make sense to add FIT booting to the distro boot command?
Regards, Matthias
Yes, it overwrite the boot_a_script in distro_bootcmd. It is make sense to add this to the distro boot command. I can send another patch to move these lines to common code later.
Question to the people just added, as you have relevant submission to distroboot. Do you think it makes sense to add FIT_BOOT_CMD to that?
Regards, Matthias
The idea of distro-boot was to make it easier for Linux distributions to update the information needed by U-Boot to find the right kernel and ramdisk.
According to doc/README.distro file extlinux.conf should be used for the communication between the distribution and U-Boot. Some distributions like Debian still rely on boot.scr.
Many distributions (OpenBSD, FreeBSD, Suse, Fedora) have moved from distro-boot to UEFI as booting standard. Unfortunately we have not documented our support for this in doc/README.distro (TODO for me). Takahiro is working on secure boot using UEFI. Once completed this could obsolete FIT images.
Would we expect Linux distributions to provide FIT images upon kernel updates? Is there any Linux distribution doing so?
Embedded Linux, a new distribution from ARM, is using FIT images to update kernel. https://os.mbed.com/docs/mbed-linux-os/v0.8/welcome/index.html
Ok, so secure boot does not provide all capabilities that FIT images do and there exists a distro which uses FIT images. I think that's enough to add FIT_BOOT_CMD to distro_boot.
So please do so. Sorry that this has taken longer then expected.
Regards, Matthias
Hi Heinrich,
On Mon, 2 Sep 2019 at 04:24, Heinrich Schuchardt xypron.glpk@gmx.de wrote:
On 9/2/19 12:30 PM, Matthias Brugger wrote:
+Alex, Lukas, Heinrich, Bin and Simon
On 31/07/2019 10:16, Jun Nie wrote:
Matthias Brugger mbrugger@suse.com 于2019年7月31日周三 下午4:05写道：
On 11/07/2019 05:55, Jun Nie wrote:
Enable verified boot from FIT image with select configs and specify boot script image node in FIT image, the FIT image is verified before it is run.
Code that reusing dtb in firmware is disabled, so that the dtb with pubic key packed in u-boot.bin can be used to verify the signature of next stage FIT image.
Signed-off-by: Jun Nie jun.nie@linaro.org
board/raspberrypi/rpi/rpi.c | 6 ++++++ include/configs/rpi.h | 15 ++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c index 617c892..950ee84 100644 --- a/board/raspberrypi/rpi/rpi.c +++ b/board/raspberrypi/rpi/rpi.c @@ -297,6 +297,7 @@ static void set_fdtfile(void) env_set("fdtfile", fdtfile); }
+#ifndef CONFIG_FIT_SIGNATURE /*
- If the firmware provided a valid FDT at boot time, let's expose it in
- ${fdt_addr} so it may be passed unmodified to the kernel.
@@ -311,6 +312,7 @@ static void set_fdt_addr(void)
env_set_hex("fdt_addr", fw_dtb_pointer);} +#endif
/*
- Prevent relocation from stomping on a firmware provided FDT blob.
@@ -393,7 +395,9 @@ static void set_serial_number(void)
int misc_init_r(void) { +#ifndef CONFIG_FIT_SIGNATURE set_fdt_addr(); +#endif set_fdtfile(); set_usbethaddr(); #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG @@ -470,6 +474,7 @@ int board_init(void) return bcm2835_power_on_module(BCM2835_MBOX_POWER_DEVID_USB_HCD); }
+#ifndef CONFIG_FIT_SIGNATURE /*
- If the firmware passed a device tree use it for U-Boot.
*/ @@ -479,6 +484,7 @@ void *board_fdt_blob_setup(void) return NULL; return (void *)fw_dtb_pointer; } +#endif
Just to get this clear we need this because we want to pass the device tree via OF_SEPARATE, correct?
You are right. U-boot need to read he signature from dtb.
int ft_board_setup(void *blob, bd_t *bd) { diff --git a/include/configs/rpi.h b/include/configs/rpi.h index f76c7d1..ba91205 100644 --- a/include/configs/rpi.h +++ b/include/configs/rpi.h @@ -180,11 +180,24 @@
#include <config_distro_bootcmd.h>
+#ifdef CONFIG_FIT_SIGNATURE +#define FIT_BOOT_CMD \
"boot_a_script=" \"load ${devtype} ${devnum}:${distro_bootpart} " \"${scriptaddr} ${prefix}${script}; " \"iminfo ${scriptaddr};" \"if test $? -eq 1; then reset; fi;" \"source ${scriptaddr}:bootscr\0"+#else +#define FIT_BOOT_CMD "" +#endif
Doesn't this overwrite the boot_a_script in distro_bootcmd?
Would it make sense to add FIT booting to the distro boot command?
Regards, Matthias
Yes, it overwrite the boot_a_script in distro_bootcmd. It is make sense to add this to the distro boot command. I can send another patch to move these lines to common code later.
Question to the people just added, as you have relevant submission to distroboot. Do you think it makes sense to add FIT_BOOT_CMD to that?
Regards, Matthias
The idea of distro-boot was to make it easier for Linux distributions to update the information needed by U-Boot to find the right kernel and ramdisk.
According to doc/README.distro file extlinux.conf should be used for the communication between the distribution and U-Boot. Some distributions like Debian still rely on boot.scr.
Many distributions (OpenBSD, FreeBSD, Suse, Fedora) have moved from distro-boot to UEFI as booting standard. Unfortunately we have not documented our support for this in doc/README.distro (TODO for me). Takahiro is working on secure boot using UEFI. Once completed this could obsolete FIT images.
Oh please no.
Would we expect Linux distributions to provide FIT images upon kernel updates? Is there any Linux distribution doing so?
Only if we can answer these questions with yes, adding FIT_BOOT_CMD to distro-boot would make sense to me.
U-Boot is the main boot loader for ARM. I wish that distros would just support it (adding what is needed) instead of trying to pretend that U-Boot is a variant of UEFI :-)
I think having a default secure boot option is useful, but how does the image get signed? Regards, Simon
On 9/6/19 11:04 PM, Simon Glass wrote:
Hi Heinrich,
<snip />
U-Boot is the main boot loader for ARM. I wish that distros would just support it (adding what is needed) instead of trying to pretend that U-Boot is a variant of UEFI :-)
Distros may have a different viewpoint than you. They may not want to add anything boot loader specific and are happy if all systems independent of their architecture can be booted in the same way, e.g. via UEFI and GRUB. Cf. https://fedoraproject.org/wiki/Changes/uEFIforARMv7
Currently OpenBSD, FreeBSD, Fedora, and Suse rely on booting via UEFI. And Debian is ready for it.
That U-Boot implements the UEFI API and this is in wide use in no way contradicts U-Boot being the main boot loader for ARM.
Nothing pretended here ¯_(ツ)_/¯
Regards
Heinrich
Hi Heinrich,
On Fri, 6 Sep 2019 at 15:47, Heinrich Schuchardt xypron.glpk@gmx.de wrote:
On 9/6/19 11:04 PM, Simon Glass wrote:
Hi Heinrich,
<snip />
U-Boot is the main boot loader for ARM. I wish that distros would just support it (adding what is needed) instead of trying to pretend that U-Boot is a variant of UEFI :-)
Distros may have a different viewpoint than you. They may not want to add anything boot loader specific and are happy if all systems independent of their architecture can be booted in the same way, e.g. via UEFI and GRUB. Cf. https://fedoraproject.org/wiki/Changes/uEFIforARMv7
Currently OpenBSD, FreeBSD, Fedora, and Suse rely on booting via UEFI. And Debian is ready for it.
That U-Boot implements the UEFI API and this is in wide use in no way contradicts U-Boot being the main boot loader for ARM.
Well I am not keen on the complexity and layers of obfuscation created by UEFI, and grub. We have so many layers....
Nothing pretended here ¯_(ツ)_/¯
Regards
Heinrich
Regards, Simon
participants (5)
-
AKASHI Takahiro -
Heinrich Schuchardt -
Jun Nie -
Matthias Brugger -
Simon Glass