Message ID | 1562817337-949-1-git-send-email-jun.nie@linaro.org |
---|---|
State | Changes Requested |
Delegated to: | Matthias Brugger |
Headers | show |
Series | [U-Boot] rpi3: Enable verified boot from FIT image | expand |
Jun Nie <jun.nie@linaro.org> 于2019年7月11日周四 上午11:56写道: > > Enable verified boot from FIT image with select configs > and specify boot script image node in FIT image, the FIT > image is verified before it is run. > > Code that reusing dtb in firmware is disabled, so that > the dtb with pubic key packed in u-boot.bin can be used > to verify the signature of next stage FIT image. > Hi Matthias, Do you have comments on verified boot config here? Thanks! Jun
Matthias Brugger <mbrugger@suse.com> 于2019年7月31日周三 下午4:05写道: > > > > On 11/07/2019 05:55, Jun Nie wrote: > > Enable verified boot from FIT image with select configs > > and specify boot script image node in FIT image, the FIT > > image is verified before it is run. > > > > Code that reusing dtb in firmware is disabled, so that > > the dtb with pubic key packed in u-boot.bin can be used > > to verify the signature of next stage FIT image. > > > > Signed-off-by: Jun Nie <jun.nie@linaro.org> > > --- > > board/raspberrypi/rpi/rpi.c | 6 ++++++ > > include/configs/rpi.h | 15 ++++++++++++++- > > 2 files changed, 20 insertions(+), 1 deletion(-) > > > > diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c > > index 617c892..950ee84 100644 > > --- a/board/raspberrypi/rpi/rpi.c > > +++ b/board/raspberrypi/rpi/rpi.c > > @@ -297,6 +297,7 @@ static void set_fdtfile(void) > > env_set("fdtfile", fdtfile); > > } > > > > +#ifndef CONFIG_FIT_SIGNATURE > > /* > > * If the firmware provided a valid FDT at boot time, let's expose it in > > * ${fdt_addr} so it may be passed unmodified to the kernel. > > @@ -311,6 +312,7 @@ static void set_fdt_addr(void) > > > > env_set_hex("fdt_addr", fw_dtb_pointer); > > } > > +#endif > > > > /* > > * Prevent relocation from stomping on a firmware provided FDT blob. > > @@ -393,7 +395,9 @@ static void set_serial_number(void) > > > > int misc_init_r(void) > > { > > +#ifndef CONFIG_FIT_SIGNATURE > > set_fdt_addr(); > > +#endif > > set_fdtfile(); > > set_usbethaddr(); > > #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG > > @@ -470,6 +474,7 @@ int board_init(void) > > return bcm2835_power_on_module(BCM2835_MBOX_POWER_DEVID_USB_HCD); > > } > > > > +#ifndef CONFIG_FIT_SIGNATURE > > /* > > * If the firmware passed a device tree use it for U-Boot. > > */ > > @@ -479,6 +484,7 @@ void *board_fdt_blob_setup(void) > > return NULL; > > return (void *)fw_dtb_pointer; > > } > > +#endif > > Just to get this clear we need this because we want to pass the device tree via > OF_SEPARATE, correct? You are right. U-boot need to read he signature from dtb. > > > > > int ft_board_setup(void *blob, bd_t *bd) > > { > > diff --git a/include/configs/rpi.h b/include/configs/rpi.h > > index f76c7d1..ba91205 100644 > > --- a/include/configs/rpi.h > > +++ b/include/configs/rpi.h > > @@ -180,11 +180,24 @@ > > > > #include <config_distro_bootcmd.h> > > > > +#ifdef CONFIG_FIT_SIGNATURE > > +#define FIT_BOOT_CMD \ > > + "boot_a_script=" \ > > + "load ${devtype} ${devnum}:${distro_bootpart} " \ > > + "${scriptaddr} ${prefix}${script}; " \ > > + "iminfo ${scriptaddr};" \ > > + "if test $? -eq 1; then reset; fi;" \ > > + "source ${scriptaddr}:bootscr\0" > > +#else > > +#define FIT_BOOT_CMD "" > > +#endif > > + > > Doesn't this overwrite the boot_a_script in distro_bootcmd? > > Would it make sense to add FIT booting to the distro boot command? > > Regards, > Matthias Yes, it overwrite the boot_a_script in distro_bootcmd. It is make sense to add this to the distro boot command. I can send another patch to move these lines to common code later. > > > #define CONFIG_EXTRA_ENV_SETTINGS \ > > "dhcpuboot=usb start; dhcp u-boot.uimg; bootm\0" \ > > ENV_DEVICE_SETTINGS \ > > ENV_MEM_LAYOUT_SETTINGS \ > > - BOOTENV > > + BOOTENV \ > > + FIT_BOOT_CMD > > > > > > #endif > >
Jun Nie <jun.nie@linaro.org> 于2019年7月31日周三 下午4:16写道: > > Matthias Brugger <mbrugger@suse.com> 于2019年7月31日周三 下午4:05写道: > > > > > > > > On 11/07/2019 05:55, Jun Nie wrote: > > > Enable verified boot from FIT image with select configs > > > and specify boot script image node in FIT image, the FIT > > > image is verified before it is run. > > > > > > Code that reusing dtb in firmware is disabled, so that > > > the dtb with pubic key packed in u-boot.bin can be used > > > to verify the signature of next stage FIT image. > > > > > > Signed-off-by: Jun Nie <jun.nie@linaro.org> > > > --- > > > board/raspberrypi/rpi/rpi.c | 6 ++++++ > > > include/configs/rpi.h | 15 ++++++++++++++- > > > 2 files changed, 20 insertions(+), 1 deletion(-) > > > > > > diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c > > > index 617c892..950ee84 100644 > > > --- a/board/raspberrypi/rpi/rpi.c > > > +++ b/board/raspberrypi/rpi/rpi.c > > > @@ -297,6 +297,7 @@ static void set_fdtfile(void) > > > env_set("fdtfile", fdtfile); > > > } > > > > > > +#ifndef CONFIG_FIT_SIGNATURE > > > /* > > > * If the firmware provided a valid FDT at boot time, let's expose it in > > > * ${fdt_addr} so it may be passed unmodified to the kernel. > > > @@ -311,6 +312,7 @@ static void set_fdt_addr(void) > > > > > > env_set_hex("fdt_addr", fw_dtb_pointer); > > > } > > > +#endif > > > > > > /* > > > * Prevent relocation from stomping on a firmware provided FDT blob. > > > @@ -393,7 +395,9 @@ static void set_serial_number(void) > > > > > > int misc_init_r(void) > > > { > > > +#ifndef CONFIG_FIT_SIGNATURE > > > set_fdt_addr(); > > > +#endif > > > set_fdtfile(); > > > set_usbethaddr(); > > > #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG > > > @@ -470,6 +474,7 @@ int board_init(void) > > > return bcm2835_power_on_module(BCM2835_MBOX_POWER_DEVID_USB_HCD); > > > } > > > > > > +#ifndef CONFIG_FIT_SIGNATURE > > > /* > > > * If the firmware passed a device tree use it for U-Boot. > > > */ > > > @@ -479,6 +484,7 @@ void *board_fdt_blob_setup(void) > > > return NULL; > > > return (void *)fw_dtb_pointer; > > > } > > > +#endif > > > > Just to get this clear we need this because we want to pass the device tree via > > OF_SEPARATE, correct? > > You are right. U-boot need to read he signature from dtb. > > > > > > > > > int ft_board_setup(void *blob, bd_t *bd) > > > { > > > diff --git a/include/configs/rpi.h b/include/configs/rpi.h > > > index f76c7d1..ba91205 100644 > > > --- a/include/configs/rpi.h > > > +++ b/include/configs/rpi.h > > > @@ -180,11 +180,24 @@ > > > > > > #include <config_distro_bootcmd.h> > > > > > > +#ifdef CONFIG_FIT_SIGNATURE > > > +#define FIT_BOOT_CMD \ > > > + "boot_a_script=" \ > > > + "load ${devtype} ${devnum}:${distro_bootpart} " \ > > > + "${scriptaddr} ${prefix}${script}; " \ > > > + "iminfo ${scriptaddr};" \ > > > + "if test $? -eq 1; then reset; fi;" \ > > > + "source ${scriptaddr}:bootscr\0" > > > +#else > > > +#define FIT_BOOT_CMD "" > > > +#endif > > > + > > > > Doesn't this overwrite the boot_a_script in distro_bootcmd? > > > > Would it make sense to add FIT booting to the distro boot command? > > > > Regards, > > Matthias > > Yes, it overwrite the boot_a_script in distro_bootcmd. It is make > sense to add this to the distro boot command. I can send another patch > to move these lines to common code later. > > > > > > #define CONFIG_EXTRA_ENV_SETTINGS \ > > > "dhcpuboot=usb start; dhcp u-boot.uimg; bootm\0" \ > > > ENV_DEVICE_SETTINGS \ > > > ENV_MEM_LAYOUT_SETTINGS \ > > > - BOOTENV > > > + BOOTENV \ > > > + FIT_BOOT_CMD > > > > > > > > > #endif > > > Hi Matthias, How do you think to merge this patch? Regards, Jun
Jun Nie <jun.nie@linaro.org> 于2019年7月11日周四 上午11:56写道: > > Enable verified boot from FIT image with select configs > and specify boot script image node in FIT image, the FIT > image is verified before it is run. > > Code that reusing dtb in firmware is disabled, so that > the dtb with pubic key packed in u-boot.bin can be used > to verify the signature of next stage FIT image. > > Signed-off-by: Jun Nie <jun.nie@linaro.org> > --- > board/raspberrypi/rpi/rpi.c | 6 ++++++ > include/configs/rpi.h | 15 ++++++++++++++- > 2 files changed, 20 insertions(+), 1 deletion(-) > Hi Matthias, Do you have any concern or comments for merging this patch? Regards, Jun
+Alex, Lukas, Heinrich, Bin and Simon On 31/07/2019 10:16, Jun Nie wrote: > Matthias Brugger <mbrugger@suse.com> 于2019年7月31日周三 下午4:05写道: >> >> >> >> On 11/07/2019 05:55, Jun Nie wrote: >>> Enable verified boot from FIT image with select configs >>> and specify boot script image node in FIT image, the FIT >>> image is verified before it is run. >>> >>> Code that reusing dtb in firmware is disabled, so that >>> the dtb with pubic key packed in u-boot.bin can be used >>> to verify the signature of next stage FIT image. >>> >>> Signed-off-by: Jun Nie <jun.nie@linaro.org> >>> --- >>> board/raspberrypi/rpi/rpi.c | 6 ++++++ >>> include/configs/rpi.h | 15 ++++++++++++++- >>> 2 files changed, 20 insertions(+), 1 deletion(-) >>> >>> diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c >>> index 617c892..950ee84 100644 >>> --- a/board/raspberrypi/rpi/rpi.c >>> +++ b/board/raspberrypi/rpi/rpi.c >>> @@ -297,6 +297,7 @@ static void set_fdtfile(void) >>> env_set("fdtfile", fdtfile); >>> } >>> >>> +#ifndef CONFIG_FIT_SIGNATURE >>> /* >>> * If the firmware provided a valid FDT at boot time, let's expose it in >>> * ${fdt_addr} so it may be passed unmodified to the kernel. >>> @@ -311,6 +312,7 @@ static void set_fdt_addr(void) >>> >>> env_set_hex("fdt_addr", fw_dtb_pointer); >>> } >>> +#endif >>> >>> /* >>> * Prevent relocation from stomping on a firmware provided FDT blob. >>> @@ -393,7 +395,9 @@ static void set_serial_number(void) >>> >>> int misc_init_r(void) >>> { >>> +#ifndef CONFIG_FIT_SIGNATURE >>> set_fdt_addr(); >>> +#endif >>> set_fdtfile(); >>> set_usbethaddr(); >>> #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG >>> @@ -470,6 +474,7 @@ int board_init(void) >>> return bcm2835_power_on_module(BCM2835_MBOX_POWER_DEVID_USB_HCD); >>> } >>> >>> +#ifndef CONFIG_FIT_SIGNATURE >>> /* >>> * If the firmware passed a device tree use it for U-Boot. >>> */ >>> @@ -479,6 +484,7 @@ void *board_fdt_blob_setup(void) >>> return NULL; >>> return (void *)fw_dtb_pointer; >>> } >>> +#endif >> >> Just to get this clear we need this because we want to pass the device tree via >> OF_SEPARATE, correct? > > You are right. U-boot need to read he signature from dtb. > >> >>> >>> int ft_board_setup(void *blob, bd_t *bd) >>> { >>> diff --git a/include/configs/rpi.h b/include/configs/rpi.h >>> index f76c7d1..ba91205 100644 >>> --- a/include/configs/rpi.h >>> +++ b/include/configs/rpi.h >>> @@ -180,11 +180,24 @@ >>> >>> #include <config_distro_bootcmd.h> >>> >>> +#ifdef CONFIG_FIT_SIGNATURE >>> +#define FIT_BOOT_CMD \ >>> + "boot_a_script=" \ >>> + "load ${devtype} ${devnum}:${distro_bootpart} " \ >>> + "${scriptaddr} ${prefix}${script}; " \ >>> + "iminfo ${scriptaddr};" \ >>> + "if test $? -eq 1; then reset; fi;" \ >>> + "source ${scriptaddr}:bootscr\0" >>> +#else >>> +#define FIT_BOOT_CMD "" >>> +#endif >>> + >> >> Doesn't this overwrite the boot_a_script in distro_bootcmd? >> >> Would it make sense to add FIT booting to the distro boot command? >> >> Regards, >> Matthias > > Yes, it overwrite the boot_a_script in distro_bootcmd. It is make > sense to add this to the distro boot command. I can send another patch > to move these lines to common code later. > Question to the people just added, as you have relevant submission to distroboot. Do you think it makes sense to add FIT_BOOT_CMD to that? Regards, Matthias >> >>> #define CONFIG_EXTRA_ENV_SETTINGS \ >>> "dhcpuboot=usb start; dhcp u-boot.uimg; bootm\0" \ >>> ENV_DEVICE_SETTINGS \ >>> ENV_MEM_LAYOUT_SETTINGS \ >>> - BOOTENV >>> + BOOTENV \ >>> + FIT_BOOT_CMD >>> >>> >>> #endif >>> >
On 9/2/19 12:30 PM, Matthias Brugger wrote: > +Alex, Lukas, Heinrich, Bin and Simon > > On 31/07/2019 10:16, Jun Nie wrote: >> Matthias Brugger <mbrugger@suse.com> 于2019年7月31日周三 下午4:05写道: >>> >>> >>> >>> On 11/07/2019 05:55, Jun Nie wrote: >>>> Enable verified boot from FIT image with select configs >>>> and specify boot script image node in FIT image, the FIT >>>> image is verified before it is run. >>>> >>>> Code that reusing dtb in firmware is disabled, so that >>>> the dtb with pubic key packed in u-boot.bin can be used >>>> to verify the signature of next stage FIT image. >>>> >>>> Signed-off-by: Jun Nie <jun.nie@linaro.org> >>>> --- >>>> board/raspberrypi/rpi/rpi.c | 6 ++++++ >>>> include/configs/rpi.h | 15 ++++++++++++++- >>>> 2 files changed, 20 insertions(+), 1 deletion(-) >>>> >>>> diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c >>>> index 617c892..950ee84 100644 >>>> --- a/board/raspberrypi/rpi/rpi.c >>>> +++ b/board/raspberrypi/rpi/rpi.c >>>> @@ -297,6 +297,7 @@ static void set_fdtfile(void) >>>> env_set("fdtfile", fdtfile); >>>> } >>>> >>>> +#ifndef CONFIG_FIT_SIGNATURE >>>> /* >>>> * If the firmware provided a valid FDT at boot time, let's expose it in >>>> * ${fdt_addr} so it may be passed unmodified to the kernel. >>>> @@ -311,6 +312,7 @@ static void set_fdt_addr(void) >>>> >>>> env_set_hex("fdt_addr", fw_dtb_pointer); >>>> } >>>> +#endif >>>> >>>> /* >>>> * Prevent relocation from stomping on a firmware provided FDT blob. >>>> @@ -393,7 +395,9 @@ static void set_serial_number(void) >>>> >>>> int misc_init_r(void) >>>> { >>>> +#ifndef CONFIG_FIT_SIGNATURE >>>> set_fdt_addr(); >>>> +#endif >>>> set_fdtfile(); >>>> set_usbethaddr(); >>>> #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG >>>> @@ -470,6 +474,7 @@ int board_init(void) >>>> return bcm2835_power_on_module(BCM2835_MBOX_POWER_DEVID_USB_HCD); >>>> } >>>> >>>> +#ifndef CONFIG_FIT_SIGNATURE >>>> /* >>>> * If the firmware passed a device tree use it for U-Boot. >>>> */ >>>> @@ -479,6 +484,7 @@ void *board_fdt_blob_setup(void) >>>> return NULL; >>>> return (void *)fw_dtb_pointer; >>>> } >>>> +#endif >>> >>> Just to get this clear we need this because we want to pass the device tree via >>> OF_SEPARATE, correct? >> >> You are right. U-boot need to read he signature from dtb. >> >>> >>>> >>>> int ft_board_setup(void *blob, bd_t *bd) >>>> { >>>> diff --git a/include/configs/rpi.h b/include/configs/rpi.h >>>> index f76c7d1..ba91205 100644 >>>> --- a/include/configs/rpi.h >>>> +++ b/include/configs/rpi.h >>>> @@ -180,11 +180,24 @@ >>>> >>>> #include <config_distro_bootcmd.h> >>>> >>>> +#ifdef CONFIG_FIT_SIGNATURE >>>> +#define FIT_BOOT_CMD \ >>>> + "boot_a_script=" \ >>>> + "load ${devtype} ${devnum}:${distro_bootpart} " \ >>>> + "${scriptaddr} ${prefix}${script}; " \ >>>> + "iminfo ${scriptaddr};" \ >>>> + "if test $? -eq 1; then reset; fi;" \ >>>> + "source ${scriptaddr}:bootscr\0" >>>> +#else >>>> +#define FIT_BOOT_CMD "" >>>> +#endif >>>> + >>> >>> Doesn't this overwrite the boot_a_script in distro_bootcmd? >>> >>> Would it make sense to add FIT booting to the distro boot command? >>> >>> Regards, >>> Matthias >> >> Yes, it overwrite the boot_a_script in distro_bootcmd. It is make >> sense to add this to the distro boot command. I can send another patch >> to move these lines to common code later. >> > > Question to the people just added, as you have relevant submission to > distroboot. Do you think it makes sense to add FIT_BOOT_CMD to that? > > Regards, > Matthias The idea of distro-boot was to make it easier for Linux distributions to update the information needed by U-Boot to find the right kernel and ramdisk. According to doc/README.distro file extlinux.conf should be used for the communication between the distribution and U-Boot. Some distributions like Debian still rely on boot.scr. Many distributions (OpenBSD, FreeBSD, Suse, Fedora) have moved from distro-boot to UEFI as booting standard. Unfortunately we have not documented our support for this in doc/README.distro (TODO for me). Takahiro is working on secure boot using UEFI. Once completed this could obsolete FIT images. Would we expect Linux distributions to provide FIT images upon kernel updates? Is there any Linux distribution doing so? Only if we can answer these questions with yes, adding FIT_BOOT_CMD to distro-boot would make sense to me. Best regards Heinrich > >>> >>>> #define CONFIG_EXTRA_ENV_SETTINGS \ >>>> "dhcpuboot=usb start; dhcp u-boot.uimg; bootm\0" \ >>>> ENV_DEVICE_SETTINGS \ >>>> ENV_MEM_LAYOUT_SETTINGS \ >>>> - BOOTENV >>>> + BOOTENV \ >>>> + FIT_BOOT_CMD >>>> >>>> >>>> #endif >>>> >> >
On Mon, Sep 02, 2019 at 01:19:06PM +0200, Heinrich Schuchardt wrote: > On 9/2/19 12:30 PM, Matthias Brugger wrote: > >+Alex, Lukas, Heinrich, Bin and Simon > > > >On 31/07/2019 10:16, Jun Nie wrote: > >>Matthias Brugger <mbrugger@suse.com> 于2019年7月31日周三 下午4:05写道: > >>> > >>> > >>> > >>>On 11/07/2019 05:55, Jun Nie wrote: > >>>>Enable verified boot from FIT image with select configs > >>>>and specify boot script image node in FIT image, the FIT > >>>>image is verified before it is run. > >>>> > >>>>Code that reusing dtb in firmware is disabled, so that > >>>>the dtb with pubic key packed in u-boot.bin can be used > >>>>to verify the signature of next stage FIT image. > >>>> > >>>>Signed-off-by: Jun Nie <jun.nie@linaro.org> > >>>>--- > >>>> board/raspberrypi/rpi/rpi.c | 6 ++++++ > >>>> include/configs/rpi.h | 15 ++++++++++++++- > >>>> 2 files changed, 20 insertions(+), 1 deletion(-) > >>>> > >>>>diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c > >>>>index 617c892..950ee84 100644 > >>>>--- a/board/raspberrypi/rpi/rpi.c > >>>>+++ b/board/raspberrypi/rpi/rpi.c > >>>>@@ -297,6 +297,7 @@ static void set_fdtfile(void) > >>>> env_set("fdtfile", fdtfile); > >>>> } > >>>> > >>>>+#ifndef CONFIG_FIT_SIGNATURE > >>>> /* > >>>> * If the firmware provided a valid FDT at boot time, let's expose it in > >>>> * ${fdt_addr} so it may be passed unmodified to the kernel. > >>>>@@ -311,6 +312,7 @@ static void set_fdt_addr(void) > >>>> > >>>> env_set_hex("fdt_addr", fw_dtb_pointer); > >>>> } > >>>>+#endif > >>>> > >>>> /* > >>>> * Prevent relocation from stomping on a firmware provided FDT blob. > >>>>@@ -393,7 +395,9 @@ static void set_serial_number(void) > >>>> > >>>> int misc_init_r(void) > >>>> { > >>>>+#ifndef CONFIG_FIT_SIGNATURE > >>>> set_fdt_addr(); > >>>>+#endif > >>>> set_fdtfile(); > >>>> set_usbethaddr(); > >>>> #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG > >>>>@@ -470,6 +474,7 @@ int board_init(void) > >>>> return bcm2835_power_on_module(BCM2835_MBOX_POWER_DEVID_USB_HCD); > >>>> } > >>>> > >>>>+#ifndef CONFIG_FIT_SIGNATURE > >>>> /* > >>>> * If the firmware passed a device tree use it for U-Boot. > >>>> */ > >>>>@@ -479,6 +484,7 @@ void *board_fdt_blob_setup(void) > >>>> return NULL; > >>>> return (void *)fw_dtb_pointer; > >>>> } > >>>>+#endif > >>> > >>>Just to get this clear we need this because we want to pass the device tree via > >>>OF_SEPARATE, correct? > >> > >>You are right. U-boot need to read he signature from dtb. > >> > >>> > >>>> > >>>> int ft_board_setup(void *blob, bd_t *bd) > >>>> { > >>>>diff --git a/include/configs/rpi.h b/include/configs/rpi.h > >>>>index f76c7d1..ba91205 100644 > >>>>--- a/include/configs/rpi.h > >>>>+++ b/include/configs/rpi.h > >>>>@@ -180,11 +180,24 @@ > >>>> > >>>> #include <config_distro_bootcmd.h> > >>>> > >>>>+#ifdef CONFIG_FIT_SIGNATURE > >>>>+#define FIT_BOOT_CMD \ > >>>>+ "boot_a_script=" \ > >>>>+ "load ${devtype} ${devnum}:${distro_bootpart} " \ > >>>>+ "${scriptaddr} ${prefix}${script}; " \ > >>>>+ "iminfo ${scriptaddr};" \ > >>>>+ "if test $? -eq 1; then reset; fi;" \ > >>>>+ "source ${scriptaddr}:bootscr\0" > >>>>+#else > >>>>+#define FIT_BOOT_CMD "" > >>>>+#endif > >>>>+ > >>> > >>>Doesn't this overwrite the boot_a_script in distro_bootcmd? > >>> > >>>Would it make sense to add FIT booting to the distro boot command? > >>> > >>>Regards, > >>>Matthias > >> > >>Yes, it overwrite the boot_a_script in distro_bootcmd. It is make > >>sense to add this to the distro boot command. I can send another patch > >>to move these lines to common code later. > >> > > > >Question to the people just added, as you have relevant submission to > >distroboot. Do you think it makes sense to add FIT_BOOT_CMD to that? > > > >Regards, > >Matthias > > The idea of distro-boot was to make it easier for Linux distributions to > update the information needed by U-Boot to find the right kernel and > ramdisk. > > According to doc/README.distro file extlinux.conf should be used for the > communication between the distribution and U-Boot. Some distributions > like Debian still rely on boot.scr. > > Many distributions (OpenBSD, FreeBSD, Suse, Fedora) have moved from > distro-boot to UEFI as booting standard. Unfortunately we have not > documented our support for this in doc/README.distro (TODO for me). > Takahiro is working on secure boot using UEFI. Once completed this could > obsolete FIT images. Well, UEFI secure boot handles PE(+) images and doesn't cover dtb, initrd or whatever FIT may contain. -Takahiro Akashi > Would we expect Linux distributions to provide FIT images upon kernel > updates? > Is there any Linux distribution doing so? > > Only if we can answer these questions with yes, adding FIT_BOOT_CMD to > distro-boot would make sense to me. > > Best regards > > Heinrich > > > > >>> > >>>> #define CONFIG_EXTRA_ENV_SETTINGS \ > >>>> "dhcpuboot=usb start; dhcp u-boot.uimg; bootm\0" \ > >>>> ENV_DEVICE_SETTINGS \ > >>>> ENV_MEM_LAYOUT_SETTINGS \ > >>>>- BOOTENV > >>>>+ BOOTENV \ > >>>>+ FIT_BOOT_CMD > >>>> > >>>> > >>>> #endif > >>>> > >> > > >
Heinrich Schuchardt <xypron.glpk@gmx.de> 于2019年9月2日周一 下午7:19写道: > > On 9/2/19 12:30 PM, Matthias Brugger wrote: > > +Alex, Lukas, Heinrich, Bin and Simon > > > > On 31/07/2019 10:16, Jun Nie wrote: > >> Matthias Brugger <mbrugger@suse.com> 于2019年7月31日周三 下午4:05写道: > >>> > >>> > >>> > >>> On 11/07/2019 05:55, Jun Nie wrote: > >>>> Enable verified boot from FIT image with select configs > >>>> and specify boot script image node in FIT image, the FIT > >>>> image is verified before it is run. > >>>> > >>>> Code that reusing dtb in firmware is disabled, so that > >>>> the dtb with pubic key packed in u-boot.bin can be used > >>>> to verify the signature of next stage FIT image. > >>>> > >>>> Signed-off-by: Jun Nie <jun.nie@linaro.org> > >>>> --- > >>>> board/raspberrypi/rpi/rpi.c | 6 ++++++ > >>>> include/configs/rpi.h | 15 ++++++++++++++- > >>>> 2 files changed, 20 insertions(+), 1 deletion(-) > >>>> > >>>> diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c > >>>> index 617c892..950ee84 100644 > >>>> --- a/board/raspberrypi/rpi/rpi.c > >>>> +++ b/board/raspberrypi/rpi/rpi.c > >>>> @@ -297,6 +297,7 @@ static void set_fdtfile(void) > >>>> env_set("fdtfile", fdtfile); > >>>> } > >>>> > >>>> +#ifndef CONFIG_FIT_SIGNATURE > >>>> /* > >>>> * If the firmware provided a valid FDT at boot time, let's expose it in > >>>> * ${fdt_addr} so it may be passed unmodified to the kernel. > >>>> @@ -311,6 +312,7 @@ static void set_fdt_addr(void) > >>>> > >>>> env_set_hex("fdt_addr", fw_dtb_pointer); > >>>> } > >>>> +#endif > >>>> > >>>> /* > >>>> * Prevent relocation from stomping on a firmware provided FDT blob. > >>>> @@ -393,7 +395,9 @@ static void set_serial_number(void) > >>>> > >>>> int misc_init_r(void) > >>>> { > >>>> +#ifndef CONFIG_FIT_SIGNATURE > >>>> set_fdt_addr(); > >>>> +#endif > >>>> set_fdtfile(); > >>>> set_usbethaddr(); > >>>> #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG > >>>> @@ -470,6 +474,7 @@ int board_init(void) > >>>> return bcm2835_power_on_module(BCM2835_MBOX_POWER_DEVID_USB_HCD); > >>>> } > >>>> > >>>> +#ifndef CONFIG_FIT_SIGNATURE > >>>> /* > >>>> * If the firmware passed a device tree use it for U-Boot. > >>>> */ > >>>> @@ -479,6 +484,7 @@ void *board_fdt_blob_setup(void) > >>>> return NULL; > >>>> return (void *)fw_dtb_pointer; > >>>> } > >>>> +#endif > >>> > >>> Just to get this clear we need this because we want to pass the device tree via > >>> OF_SEPARATE, correct? > >> > >> You are right. U-boot need to read he signature from dtb. > >> > >>> > >>>> > >>>> int ft_board_setup(void *blob, bd_t *bd) > >>>> { > >>>> diff --git a/include/configs/rpi.h b/include/configs/rpi.h > >>>> index f76c7d1..ba91205 100644 > >>>> --- a/include/configs/rpi.h > >>>> +++ b/include/configs/rpi.h > >>>> @@ -180,11 +180,24 @@ > >>>> > >>>> #include <config_distro_bootcmd.h> > >>>> > >>>> +#ifdef CONFIG_FIT_SIGNATURE > >>>> +#define FIT_BOOT_CMD \ > >>>> + "boot_a_script=" \ > >>>> + "load ${devtype} ${devnum}:${distro_bootpart} " \ > >>>> + "${scriptaddr} ${prefix}${script}; " \ > >>>> + "iminfo ${scriptaddr};" \ > >>>> + "if test $? -eq 1; then reset; fi;" \ > >>>> + "source ${scriptaddr}:bootscr\0" > >>>> +#else > >>>> +#define FIT_BOOT_CMD "" > >>>> +#endif > >>>> + > >>> > >>> Doesn't this overwrite the boot_a_script in distro_bootcmd? > >>> > >>> Would it make sense to add FIT booting to the distro boot command? > >>> > >>> Regards, > >>> Matthias > >> > >> Yes, it overwrite the boot_a_script in distro_bootcmd. It is make > >> sense to add this to the distro boot command. I can send another patch > >> to move these lines to common code later. > >> > > > > Question to the people just added, as you have relevant submission to > > distroboot. Do you think it makes sense to add FIT_BOOT_CMD to that? > > > > Regards, > > Matthias > > The idea of distro-boot was to make it easier for Linux distributions to > update the information needed by U-Boot to find the right kernel and > ramdisk. > > According to doc/README.distro file extlinux.conf should be used for the > communication between the distribution and U-Boot. Some distributions > like Debian still rely on boot.scr. > > Many distributions (OpenBSD, FreeBSD, Suse, Fedora) have moved from > distro-boot to UEFI as booting standard. Unfortunately we have not > documented our support for this in doc/README.distro (TODO for me). > Takahiro is working on secure boot using UEFI. Once completed this could > obsolete FIT images. > > Would we expect Linux distributions to provide FIT images upon kernel > updates? > Is there any Linux distribution doing so? Embedded Linux, a new distribution from ARM, is using FIT images to update kernel. https://os.mbed.com/docs/mbed-linux-os/v0.8/welcome/index.html Jun > > Only if we can answer these questions with yes, adding FIT_BOOT_CMD to > distro-boot would make sense to me. > > Best regards > > Heinrich > > > > >>> > >>>> #define CONFIG_EXTRA_ENV_SETTINGS \ > >>>> "dhcpuboot=usb start; dhcp u-boot.uimg; bootm\0" \ > >>>> ENV_DEVICE_SETTINGS \ > >>>> ENV_MEM_LAYOUT_SETTINGS \ > >>>> - BOOTENV > >>>> + BOOTENV \ > >>>> + FIT_BOOT_CMD > >>>> > >>>> > >>>> #endif > >>>> > >> > > >
On 03/09/2019 09:12, Jun Nie wrote: > Heinrich Schuchardt <xypron.glpk@gmx.de> 于2019年9月2日周一 下午7:19写道: >> >> On 9/2/19 12:30 PM, Matthias Brugger wrote: >>> +Alex, Lukas, Heinrich, Bin and Simon >>> >>> On 31/07/2019 10:16, Jun Nie wrote: >>>> Matthias Brugger <mbrugger@suse.com> 于2019年7月31日周三 下午4:05写道: >>>>> >>>>> >>>>> >>>>> On 11/07/2019 05:55, Jun Nie wrote: >>>>>> Enable verified boot from FIT image with select configs >>>>>> and specify boot script image node in FIT image, the FIT >>>>>> image is verified before it is run. >>>>>> >>>>>> Code that reusing dtb in firmware is disabled, so that >>>>>> the dtb with pubic key packed in u-boot.bin can be used >>>>>> to verify the signature of next stage FIT image. >>>>>> >>>>>> Signed-off-by: Jun Nie <jun.nie@linaro.org> >>>>>> --- >>>>>> board/raspberrypi/rpi/rpi.c | 6 ++++++ >>>>>> include/configs/rpi.h | 15 ++++++++++++++- >>>>>> 2 files changed, 20 insertions(+), 1 deletion(-) >>>>>> >>>>>> diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c >>>>>> index 617c892..950ee84 100644 >>>>>> --- a/board/raspberrypi/rpi/rpi.c >>>>>> +++ b/board/raspberrypi/rpi/rpi.c >>>>>> @@ -297,6 +297,7 @@ static void set_fdtfile(void) >>>>>> env_set("fdtfile", fdtfile); >>>>>> } >>>>>> >>>>>> +#ifndef CONFIG_FIT_SIGNATURE >>>>>> /* >>>>>> * If the firmware provided a valid FDT at boot time, let's expose it in >>>>>> * ${fdt_addr} so it may be passed unmodified to the kernel. >>>>>> @@ -311,6 +312,7 @@ static void set_fdt_addr(void) >>>>>> >>>>>> env_set_hex("fdt_addr", fw_dtb_pointer); >>>>>> } >>>>>> +#endif >>>>>> >>>>>> /* >>>>>> * Prevent relocation from stomping on a firmware provided FDT blob. >>>>>> @@ -393,7 +395,9 @@ static void set_serial_number(void) >>>>>> >>>>>> int misc_init_r(void) >>>>>> { >>>>>> +#ifndef CONFIG_FIT_SIGNATURE >>>>>> set_fdt_addr(); >>>>>> +#endif >>>>>> set_fdtfile(); >>>>>> set_usbethaddr(); >>>>>> #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG >>>>>> @@ -470,6 +474,7 @@ int board_init(void) >>>>>> return bcm2835_power_on_module(BCM2835_MBOX_POWER_DEVID_USB_HCD); >>>>>> } >>>>>> >>>>>> +#ifndef CONFIG_FIT_SIGNATURE >>>>>> /* >>>>>> * If the firmware passed a device tree use it for U-Boot. >>>>>> */ >>>>>> @@ -479,6 +484,7 @@ void *board_fdt_blob_setup(void) >>>>>> return NULL; >>>>>> return (void *)fw_dtb_pointer; >>>>>> } >>>>>> +#endif >>>>> >>>>> Just to get this clear we need this because we want to pass the device tree via >>>>> OF_SEPARATE, correct? >>>> >>>> You are right. U-boot need to read he signature from dtb. >>>> >>>>> >>>>>> >>>>>> int ft_board_setup(void *blob, bd_t *bd) >>>>>> { >>>>>> diff --git a/include/configs/rpi.h b/include/configs/rpi.h >>>>>> index f76c7d1..ba91205 100644 >>>>>> --- a/include/configs/rpi.h >>>>>> +++ b/include/configs/rpi.h >>>>>> @@ -180,11 +180,24 @@ >>>>>> >>>>>> #include <config_distro_bootcmd.h> >>>>>> >>>>>> +#ifdef CONFIG_FIT_SIGNATURE >>>>>> +#define FIT_BOOT_CMD \ >>>>>> + "boot_a_script=" \ >>>>>> + "load ${devtype} ${devnum}:${distro_bootpart} " \ >>>>>> + "${scriptaddr} ${prefix}${script}; " \ >>>>>> + "iminfo ${scriptaddr};" \ >>>>>> + "if test $? -eq 1; then reset; fi;" \ >>>>>> + "source ${scriptaddr}:bootscr\0" >>>>>> +#else >>>>>> +#define FIT_BOOT_CMD "" >>>>>> +#endif >>>>>> + >>>>> >>>>> Doesn't this overwrite the boot_a_script in distro_bootcmd? >>>>> >>>>> Would it make sense to add FIT booting to the distro boot command? >>>>> >>>>> Regards, >>>>> Matthias >>>> >>>> Yes, it overwrite the boot_a_script in distro_bootcmd. It is make >>>> sense to add this to the distro boot command. I can send another patch >>>> to move these lines to common code later. >>>> >>> >>> Question to the people just added, as you have relevant submission to >>> distroboot. Do you think it makes sense to add FIT_BOOT_CMD to that? >>> >>> Regards, >>> Matthias >> >> The idea of distro-boot was to make it easier for Linux distributions to >> update the information needed by U-Boot to find the right kernel and >> ramdisk. >> >> According to doc/README.distro file extlinux.conf should be used for the >> communication between the distribution and U-Boot. Some distributions >> like Debian still rely on boot.scr. >> >> Many distributions (OpenBSD, FreeBSD, Suse, Fedora) have moved from >> distro-boot to UEFI as booting standard. Unfortunately we have not >> documented our support for this in doc/README.distro (TODO for me). >> Takahiro is working on secure boot using UEFI. Once completed this could >> obsolete FIT images. >> >> Would we expect Linux distributions to provide FIT images upon kernel >> updates? >> Is there any Linux distribution doing so? > > Embedded Linux, a new distribution from ARM, is using FIT images to > update kernel. > https://os.mbed.com/docs/mbed-linux-os/v0.8/welcome/index.html > Ok, so secure boot does not provide all capabilities that FIT images do and there exists a distro which uses FIT images. I think that's enough to add FIT_BOOT_CMD to distro_boot. So please do so. Sorry that this has taken longer then expected. Regards, Matthias
Hi Heinrich, On Mon, 2 Sep 2019 at 04:24, Heinrich Schuchardt <xypron.glpk@gmx.de> wrote: > > On 9/2/19 12:30 PM, Matthias Brugger wrote: > > +Alex, Lukas, Heinrich, Bin and Simon > > > > On 31/07/2019 10:16, Jun Nie wrote: > >> Matthias Brugger <mbrugger@suse.com> 于2019年7月31日周三 下午4:05写道: > >>> > >>> > >>> > >>> On 11/07/2019 05:55, Jun Nie wrote: > >>>> Enable verified boot from FIT image with select configs > >>>> and specify boot script image node in FIT image, the FIT > >>>> image is verified before it is run. > >>>> > >>>> Code that reusing dtb in firmware is disabled, so that > >>>> the dtb with pubic key packed in u-boot.bin can be used > >>>> to verify the signature of next stage FIT image. > >>>> > >>>> Signed-off-by: Jun Nie <jun.nie@linaro.org> > >>>> --- > >>>> board/raspberrypi/rpi/rpi.c | 6 ++++++ > >>>> include/configs/rpi.h | 15 ++++++++++++++- > >>>> 2 files changed, 20 insertions(+), 1 deletion(-) > >>>> > >>>> diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c > >>>> index 617c892..950ee84 100644 > >>>> --- a/board/raspberrypi/rpi/rpi.c > >>>> +++ b/board/raspberrypi/rpi/rpi.c > >>>> @@ -297,6 +297,7 @@ static void set_fdtfile(void) > >>>> env_set("fdtfile", fdtfile); > >>>> } > >>>> > >>>> +#ifndef CONFIG_FIT_SIGNATURE > >>>> /* > >>>> * If the firmware provided a valid FDT at boot time, let's expose it in > >>>> * ${fdt_addr} so it may be passed unmodified to the kernel. > >>>> @@ -311,6 +312,7 @@ static void set_fdt_addr(void) > >>>> > >>>> env_set_hex("fdt_addr", fw_dtb_pointer); > >>>> } > >>>> +#endif > >>>> > >>>> /* > >>>> * Prevent relocation from stomping on a firmware provided FDT blob. > >>>> @@ -393,7 +395,9 @@ static void set_serial_number(void) > >>>> > >>>> int misc_init_r(void) > >>>> { > >>>> +#ifndef CONFIG_FIT_SIGNATURE > >>>> set_fdt_addr(); > >>>> +#endif > >>>> set_fdtfile(); > >>>> set_usbethaddr(); > >>>> #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG > >>>> @@ -470,6 +474,7 @@ int board_init(void) > >>>> return bcm2835_power_on_module(BCM2835_MBOX_POWER_DEVID_USB_HCD); > >>>> } > >>>> > >>>> +#ifndef CONFIG_FIT_SIGNATURE > >>>> /* > >>>> * If the firmware passed a device tree use it for U-Boot. > >>>> */ > >>>> @@ -479,6 +484,7 @@ void *board_fdt_blob_setup(void) > >>>> return NULL; > >>>> return (void *)fw_dtb_pointer; > >>>> } > >>>> +#endif > >>> > >>> Just to get this clear we need this because we want to pass the device tree via > >>> OF_SEPARATE, correct? > >> > >> You are right. U-boot need to read he signature from dtb. > >> > >>> > >>>> > >>>> int ft_board_setup(void *blob, bd_t *bd) > >>>> { > >>>> diff --git a/include/configs/rpi.h b/include/configs/rpi.h > >>>> index f76c7d1..ba91205 100644 > >>>> --- a/include/configs/rpi.h > >>>> +++ b/include/configs/rpi.h > >>>> @@ -180,11 +180,24 @@ > >>>> > >>>> #include <config_distro_bootcmd.h> > >>>> > >>>> +#ifdef CONFIG_FIT_SIGNATURE > >>>> +#define FIT_BOOT_CMD \ > >>>> + "boot_a_script=" \ > >>>> + "load ${devtype} ${devnum}:${distro_bootpart} " \ > >>>> + "${scriptaddr} ${prefix}${script}; " \ > >>>> + "iminfo ${scriptaddr};" \ > >>>> + "if test $? -eq 1; then reset; fi;" \ > >>>> + "source ${scriptaddr}:bootscr\0" > >>>> +#else > >>>> +#define FIT_BOOT_CMD "" > >>>> +#endif > >>>> + > >>> > >>> Doesn't this overwrite the boot_a_script in distro_bootcmd? > >>> > >>> Would it make sense to add FIT booting to the distro boot command? > >>> > >>> Regards, > >>> Matthias > >> > >> Yes, it overwrite the boot_a_script in distro_bootcmd. It is make > >> sense to add this to the distro boot command. I can send another patch > >> to move these lines to common code later. > >> > > > > Question to the people just added, as you have relevant submission to > > distroboot. Do you think it makes sense to add FIT_BOOT_CMD to that? > > > > Regards, > > Matthias > > The idea of distro-boot was to make it easier for Linux distributions to > update the information needed by U-Boot to find the right kernel and > ramdisk. > > According to doc/README.distro file extlinux.conf should be used for the > communication between the distribution and U-Boot. Some distributions > like Debian still rely on boot.scr. > > Many distributions (OpenBSD, FreeBSD, Suse, Fedora) have moved from > distro-boot to UEFI as booting standard. Unfortunately we have not > documented our support for this in doc/README.distro (TODO for me). > Takahiro is working on secure boot using UEFI. Once completed this could > obsolete FIT images. Oh please no. > > Would we expect Linux distributions to provide FIT images upon kernel > updates? > Is there any Linux distribution doing so? > > Only if we can answer these questions with yes, adding FIT_BOOT_CMD to > distro-boot would make sense to me. > U-Boot is the main boot loader for ARM. I wish that distros would just support it (adding what is needed) instead of trying to pretend that U-Boot is a variant of UEFI :-) I think having a default secure boot option is useful, but how does the image get signed? Regards, Simon
On 9/6/19 11:04 PM, Simon Glass wrote: > Hi Heinrich, <snip /> > U-Boot is the main boot loader for ARM. I wish that distros would just > support it (adding what is needed) instead of trying to pretend that > U-Boot is a variant of UEFI :-) Distros may have a different viewpoint than you. They may not want to add anything boot loader specific and are happy if all systems independent of their architecture can be booted in the same way, e.g. via UEFI and GRUB. Cf. https://fedoraproject.org/wiki/Changes/uEFIforARMv7 Currently OpenBSD, FreeBSD, Fedora, and Suse rely on booting via UEFI. And Debian is ready for it. That U-Boot implements the UEFI API and this is in wide use in no way contradicts U-Boot being the main boot loader for ARM. Nothing pretended here ¯\_(ツ)_/¯ Regards Heinrich
Hi Heinrich, On Fri, 6 Sep 2019 at 15:47, Heinrich Schuchardt <xypron.glpk@gmx.de> wrote: > > On 9/6/19 11:04 PM, Simon Glass wrote: > > Hi Heinrich, > > <snip /> > > > U-Boot is the main boot loader for ARM. I wish that distros would just > > support it (adding what is needed) instead of trying to pretend that > > U-Boot is a variant of UEFI :-) > > Distros may have a different viewpoint than you. They may not want to > add anything boot loader specific and are happy if all systems > independent of their architecture can be booted in the same way, e.g. > via UEFI and GRUB. Cf. > https://fedoraproject.org/wiki/Changes/uEFIforARMv7 > > Currently OpenBSD, FreeBSD, Fedora, and Suse rely on booting via UEFI. > And Debian is ready for it. > > That U-Boot implements the UEFI API and this is in wide use in no way > contradicts U-Boot being the main boot loader for ARM. Well I am not keen on the complexity and layers of obfuscation created by UEFI, and grub. We have so many layers.... > > Nothing pretended here ¯\_(ツ)_/¯ > > Regards > > Heinrich Regards, Simon
diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c index 617c892..950ee84 100644 --- a/board/raspberrypi/rpi/rpi.c +++ b/board/raspberrypi/rpi/rpi.c @@ -297,6 +297,7 @@ static void set_fdtfile(void) env_set("fdtfile", fdtfile); } +#ifndef CONFIG_FIT_SIGNATURE /* * If the firmware provided a valid FDT at boot time, let's expose it in * ${fdt_addr} so it may be passed unmodified to the kernel. @@ -311,6 +312,7 @@ static void set_fdt_addr(void) env_set_hex("fdt_addr", fw_dtb_pointer); } +#endif /* * Prevent relocation from stomping on a firmware provided FDT blob. @@ -393,7 +395,9 @@ static void set_serial_number(void) int misc_init_r(void) { +#ifndef CONFIG_FIT_SIGNATURE set_fdt_addr(); +#endif set_fdtfile(); set_usbethaddr(); #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG @@ -470,6 +474,7 @@ int board_init(void) return bcm2835_power_on_module(BCM2835_MBOX_POWER_DEVID_USB_HCD); } +#ifndef CONFIG_FIT_SIGNATURE /* * If the firmware passed a device tree use it for U-Boot. */ @@ -479,6 +484,7 @@ void *board_fdt_blob_setup(void) return NULL; return (void *)fw_dtb_pointer; } +#endif int ft_board_setup(void *blob, bd_t *bd) { diff --git a/include/configs/rpi.h b/include/configs/rpi.h index f76c7d1..ba91205 100644 --- a/include/configs/rpi.h +++ b/include/configs/rpi.h @@ -180,11 +180,24 @@ #include <config_distro_bootcmd.h> +#ifdef CONFIG_FIT_SIGNATURE +#define FIT_BOOT_CMD \ + "boot_a_script=" \ + "load ${devtype} ${devnum}:${distro_bootpart} " \ + "${scriptaddr} ${prefix}${script}; " \ + "iminfo ${scriptaddr};" \ + "if test $? -eq 1; then reset; fi;" \ + "source ${scriptaddr}:bootscr\0" +#else +#define FIT_BOOT_CMD "" +#endif + #define CONFIG_EXTRA_ENV_SETTINGS \ "dhcpuboot=usb start; dhcp u-boot.uimg; bootm\0" \ ENV_DEVICE_SETTINGS \ ENV_MEM_LAYOUT_SETTINGS \ - BOOTENV + BOOTENV \ + FIT_BOOT_CMD #endif
Enable verified boot from FIT image with select configs and specify boot script image node in FIT image, the FIT image is verified before it is run. Code that reusing dtb in firmware is disabled, so that the dtb with pubic key packed in u-boot.bin can be used to verify the signature of next stage FIT image. Signed-off-by: Jun Nie <jun.nie@linaro.org> --- board/raspberrypi/rpi/rpi.c | 6 ++++++ include/configs/rpi.h | 15 ++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-)