summaryrefslogtreecommitdiff
path: root/boot
diff options
context:
space:
mode:
Diffstat (limited to 'boot')
-rw-r--r--boot/Kconfig18
-rw-r--r--boot/bootm.c3
-rw-r--r--boot/bootm_os.c18
-rw-r--r--boot/bootmeth_cros.c4
-rw-r--r--boot/fdt_support.c53
-rw-r--r--boot/image-fit.c3
-rw-r--r--boot/image.c5
-rw-r--r--boot/pxe_utils.c49
8 files changed, 104 insertions, 49 deletions
diff --git a/boot/Kconfig b/boot/Kconfig
index de277d2ba50..ffcae840a50 100644
--- a/boot/Kconfig
+++ b/boot/Kconfig
@@ -85,7 +85,7 @@ config FIT_SIGNATURE
using a hash signed and verified using RSA. If
CONFIG_SHA_PROG_HW_ACCEL is defined, i.e support for progressive
hashing is available using hardware, then the RSA library will use
- it. See doc/uImage.FIT/signature.txt for more details.
+ it. See doc/usage/fit/signature.rst for more details.
WARNING: When relying on signed FIT images with a required signature
check the legacy image format is disabled by default, so that
@@ -150,10 +150,10 @@ config FIT_IMAGE_POST_PROCESS
processed before being added to the FIT image).
config FIT_PRINT
- bool "Support FIT printing"
- default y
- help
- Support printing the content of the fitImage in a verbose manner.
+ bool "Support FIT printing"
+ default y
+ help
+ Support printing the content of the fitImage in a verbose manner.
config SPL_FIT
bool "Support Flattened Image Tree within SPL"
@@ -223,8 +223,8 @@ config SPL_LOAD_FIT
1. "loadables" images, other than FDTs, which do not have a "load"
property will not be loaded. This limitation also applies to FPGA
images with the correct "compatible" string.
- 2. For FPGA images, the supported "compatible" list is in the
- doc/uImage.FIT/source_file_format.txt.
+ 2. For FPGA images, the supported "compatible" list may be found in
+ https://fitspec.osfw.foundation/.
3. FDTs are only loaded for images with an "os" property of "u-boot".
"linux" images are also supported with Falcon boot mode.
@@ -734,6 +734,10 @@ config LEGACY_IMAGE_FORMAT
config MEASURED_BOOT
bool "Measure boot images and configuration when booting without EFI"
depends on HASH && TPM_V2
+ select SHA1
+ select SHA256
+ select SHA384
+ select SHA512
help
This option enables measurement of the boot process when booting
without UEFI . Measurement involves creating cryptographic hashes
diff --git a/boot/bootm.c b/boot/bootm.c
index 6fa8edab021..376d63aafc9 100644
--- a/boot/bootm.c
+++ b/boot/bootm.c
@@ -24,6 +24,7 @@
#include <asm/io.h>
#include <linux/sizes.h>
#include <tpm-v2.h>
+#include <tpm_tcg2.h>
#if defined(CONFIG_CMD_USB)
#include <usb.h>
#endif
@@ -963,7 +964,7 @@ int bootm_measure(struct bootm_headers *images)
goto unmap_initrd;
if (IS_ENABLED(CONFIG_MEASURE_DEVICETREE)) {
- ret = tcg2_measure_data(dev, &elog, 0, images->ft_len,
+ ret = tcg2_measure_data(dev, &elog, 1, images->ft_len,
(u8 *)images->ft_addr,
EV_TABLE_OF_DEVICES,
strlen("dts") + 1,
diff --git a/boot/bootm_os.c b/boot/bootm_os.c
index 15297ddb530..6a6621706f7 100644
--- a/boot/bootm_os.c
+++ b/boot/bootm_os.c
@@ -8,6 +8,7 @@
#include <bootstage.h>
#include <cpu_func.h>
#include <efi_loader.h>
+#include <elf.h>
#include <env.h>
#include <fdt_support.h>
#include <image.h>
@@ -394,6 +395,20 @@ static int do_bootm_qnxelf(int flag, struct bootm_info *bmi)
}
#endif
+#if defined(CONFIG_BOOTM_ELF)
+static int do_bootm_elf(int flag, struct bootm_info *bmi)
+{
+ Bootelf_flags flags = { .autostart = 1 };
+
+ if (flag != BOOTM_STATE_OS_GO)
+ return 0;
+
+ bootelf(bmi->images->ep, flags, 0, NULL);
+
+ return 1;
+}
+#endif
+
#ifdef CONFIG_INTEGRITY
static int do_bootm_integrity(int flag, struct bootm_info *bmi)
{
@@ -535,6 +550,9 @@ static boot_os_fn *boot_os[] = {
#ifdef CONFIG_BOOTM_EFI
[IH_OS_EFI] = do_bootm_efi,
#endif
+#if defined(CONFIG_BOOTM_ELF)
+ [IH_OS_ELF] = do_bootm_elf,
+#endif
};
/* Allow for arch specific config before we boot */
diff --git a/boot/bootmeth_cros.c b/boot/bootmeth_cros.c
index 645b8bed102..1d5fd8b193d 100644
--- a/boot/bootmeth_cros.c
+++ b/boot/bootmeth_cros.c
@@ -147,7 +147,7 @@ static int scan_part(struct udevice *blk, int partnum,
{
struct blk_desc *desc = dev_get_uclass_plat(blk);
struct vb2_keyblock *hdr;
- struct uuid type;
+ efi_guid_t type;
ulong num_blks;
int ret;
@@ -160,7 +160,7 @@ static int scan_part(struct udevice *blk, int partnum,
/* Check for kernel partition type */
log_debug("part %x: type=%s\n", partnum, info->type_guid);
- if (uuid_str_to_bin(info->type_guid, (u8 *)&type, UUID_STR_FORMAT_GUID))
+ if (uuid_str_to_bin(info->type_guid, type.b, UUID_STR_FORMAT_GUID))
return log_msg_ret("typ", -EINVAL);
if (memcmp(&cros_kern_type, &type, sizeof(type)))
diff --git a/boot/fdt_support.c b/boot/fdt_support.c
index 874ca4d6f5a..2392027d40b 100644
--- a/boot/fdt_support.c
+++ b/boot/fdt_support.c
@@ -6,12 +6,15 @@
* Copyright 2010-2011 Freescale Semiconductor, Inc.
*/
+#include <dm.h>
#include <abuf.h>
#include <env.h>
#include <log.h>
#include <mapmem.h>
#include <net.h>
+#include <rng.h>
#include <stdio_dev.h>
+#include <dm/device_compat.h>
#include <dm/ofnode.h>
#include <linux/ctype.h>
#include <linux/types.h>
@@ -273,6 +276,47 @@ int fdt_initrd(void *fdt, ulong initrd_start, ulong initrd_end)
return 0;
}
+int fdt_kaslrseed(void *fdt, bool overwrite)
+{
+ int len, err, nodeoffset;
+ struct udevice *dev;
+ const u64 *orig;
+ u64 data = 0;
+
+ err = fdt_check_header(fdt);
+ if (err < 0)
+ return err;
+
+ /* find or create "/chosen" node. */
+ nodeoffset = fdt_find_or_add_subnode(fdt, 0, "chosen");
+ if (nodeoffset < 0)
+ return nodeoffset;
+
+ /* return without error if we are not overwriting and existing non-zero node */
+ orig = fdt_getprop(fdt, nodeoffset, "kaslr-seed", &len);
+ if (orig && len == sizeof(*orig))
+ data = fdt64_to_cpu(*orig);
+ if (data && !overwrite) {
+ debug("not overwriting existing kaslr-seed\n");
+ return 0;
+ }
+ err = uclass_get_device(UCLASS_RNG, 0, &dev);
+ if (err) {
+ printf("No RNG device\n");
+ return err;
+ }
+ err = dm_rng_read(dev, &data, sizeof(data));
+ if (err) {
+ dev_err(dev, "dm_rng_read failed: %d\n", err);
+ return err;
+ }
+ err = fdt_setprop(fdt, nodeoffset, "kaslr-seed", &data, sizeof(data));
+ if (err < 0)
+ printf("WARNING: could not set kaslr-seed %s.\n", fdt_strerror(err));
+
+ return err;
+}
+
/**
* board_fdt_chosen_bootargs - boards may override this function to use
* alternative kernel command line arguments
@@ -300,6 +344,15 @@ int fdt_chosen(void *fdt)
if (nodeoffset < 0)
return nodeoffset;
+ /* if DM_RNG enabled automatically inject kaslr-seed node unless:
+ * CONFIG_MEASURED_BOOT enabled: as dt modifications break measured boot
+ * CONFIG_ARMV8_SEC_FIRMWARE_SUPPORT enabled: as that implementation does not use dm yet
+ */
+ if (IS_ENABLED(CONFIG_DM_RNG) &&
+ !IS_ENABLED(CONFIG_MEASURED_BOOT) &&
+ !IS_ENABLED(CONFIG_ARMV8_SEC_FIRMWARE_SUPPORT))
+ fdt_kaslrseed(fdt, false);
+
if (IS_ENABLED(CONFIG_BOARD_RNG_SEED) && !board_rng_seed(&buf)) {
err = fdt_setprop(fdt, nodeoffset, "rng-seed",
abuf_data(&buf), abuf_size(&buf));
diff --git a/boot/image-fit.c b/boot/image-fit.c
index f6464bcf620..9253f81fff5 100644
--- a/boot/image-fit.c
+++ b/boot/image-fit.c
@@ -2175,7 +2175,8 @@ int fit_image_load(struct bootm_headers *images, ulong addr,
fit_image_check_os(fit, noffset, IH_OS_TEE) ||
fit_image_check_os(fit, noffset, IH_OS_OPENRTOS) ||
fit_image_check_os(fit, noffset, IH_OS_EFI) ||
- fit_image_check_os(fit, noffset, IH_OS_VXWORKS);
+ fit_image_check_os(fit, noffset, IH_OS_VXWORKS) ||
+ fit_image_check_os(fit, noffset, IH_OS_ELF);
/*
* If either of the checks fail, we should report an error, but
diff --git a/boot/image.c b/boot/image.c
index fc774d605d1..abac254e026 100644
--- a/boot/image.c
+++ b/boot/image.c
@@ -130,7 +130,10 @@ static const table_entry_t uimage_os[] = {
{ IH_OS_OPENRTOS, "openrtos", "OpenRTOS", },
#endif
{ IH_OS_OPENSBI, "opensbi", "RISC-V OpenSBI", },
- { IH_OS_EFI, "efi", "EFI Firmware" },
+ { IH_OS_EFI, "efi", "EFI Firmware" },
+#ifdef CONFIG_BOOTM_ELF
+ { IH_OS_ELF, "elf", "ELF Image" },
+#endif
{ -1, "", "", },
};
diff --git a/boot/pxe_utils.c b/boot/pxe_utils.c
index 4b22bb6f525..53d6cf700b2 100644
--- a/boot/pxe_utils.c
+++ b/boot/pxe_utils.c
@@ -4,6 +4,8 @@
* Copyright (c) 2014, NVIDIA CORPORATION. All rights reserved.
*/
+#define LOG_CATEGORY LOGC_BOOT
+
#include <command.h>
#include <dm.h>
#include <env.h>
@@ -323,10 +325,6 @@ static void label_boot_kaslrseed(void)
#if CONFIG_IS_ENABLED(DM_RNG)
ulong fdt_addr;
struct fdt_header *working_fdt;
- size_t n = 0x8;
- struct udevice *dev;
- u64 *buf;
- int nodeoffset;
int err;
/* Get the main fdt and map it */
@@ -342,35 +340,7 @@ static void label_boot_kaslrseed(void)
if (err <= 0)
return;
- if (uclass_get_device(UCLASS_RNG, 0, &dev) || !dev) {
- printf("No RNG device\n");
- return;
- }
-
- nodeoffset = fdt_find_or_add_subnode(working_fdt, 0, "chosen");
- if (nodeoffset < 0) {
- printf("Reading chosen node failed\n");
- return;
- }
-
- buf = malloc(n);
- if (!buf) {
- printf("Out of memory\n");
- return;
- }
-
- if (dm_rng_read(dev, buf, n)) {
- printf("Reading RNG failed\n");
- goto err;
- }
-
- err = fdt_setprop(working_fdt, nodeoffset, "kaslr-seed", buf, sizeof(buf));
- if (err < 0) {
- printf("Unable to set kaslr-seed on chosen node: %s\n", fdt_strerror(err));
- goto err;
- }
-err:
- free(buf);
+ fdt_kaslrseed(working_fdt, true);
#endif
return;
}
@@ -762,17 +732,22 @@ static int label_boot(struct pxe_context *ctx, struct pxe_label *label)
/* Try bootm for legacy and FIT format image */
if (genimg_get_format(buf) != IMAGE_FORMAT_INVALID &&
- IS_ENABLED(CONFIG_CMD_BOOTM))
+ IS_ENABLED(CONFIG_CMD_BOOTM)) {
+ log_debug("using bootm\n");
do_bootm(ctx->cmdtp, 0, bootm_argc, bootm_argv);
/* Try booting an AArch64 Linux kernel image */
- else if (IS_ENABLED(CONFIG_CMD_BOOTI))
+ } else if (IS_ENABLED(CONFIG_CMD_BOOTI)) {
+ log_debug("using booti\n");
do_booti(ctx->cmdtp, 0, bootm_argc, bootm_argv);
/* Try booting a Image */
- else if (IS_ENABLED(CONFIG_CMD_BOOTZ))
+ } else if (IS_ENABLED(CONFIG_CMD_BOOTZ)) {
+ log_debug("using bootz\n");
do_bootz(ctx->cmdtp, 0, bootm_argc, bootm_argv);
/* Try booting an x86_64 Linux kernel image */
- else if (IS_ENABLED(CONFIG_CMD_ZBOOT))
+ } else if (IS_ENABLED(CONFIG_CMD_ZBOOT)) {
+ log_debug("using zboot\n");
do_zboot_parent(ctx->cmdtp, 0, zboot_argc, zboot_argv, NULL);
+ }
unmap_sysmem(buf);
generated by cgit v1.2.3 (git 2.0.4) at 2025-07-24 12:15:52 +0000