Daniel Golle <daniel@makrotopia.org> says:
A signed FIT configuration can delegate the integrity of a (potentially
large) root filesystem image to the kernel's dm-verity instead of having
U-Boot hash the whole payload at boot: the FIT carries a "dm-verity"
subnode with the roothash, salt and block parameters, U-Boot passes the
roothash to Linux through the dm-mod.create bootargs, and dm-verity then
validates the filesystem block by block against it.
For that to be safe the roothash has to be trusted, and in a signed
configuration the only thing that establishes trust is the configuration
signature. The roothash was not covered by it. fit_config_add_hash()
collected the image node, its hash subnodes and its cipher subnode into
the signed region, but not the dm-verity subnode, so the roothash, the
sole integrity anchor for the filesystem, was left unsigned.
The result is a verified-boot bypass for the root filesystem: an
attacker who can rewrite the boot medium can replace the filesystem,
recompute a matching dm-verity tree, write the new roothash into the
unsigned dm-verity subnode, and the configuration signature still
verifies. dm-verity then faithfully validates the malicious filesystem
against the attacker's roothash.
This series closes the gap.
Link: https://lore.kernel.org/r/cover.1785276461.git.daniel@makrotopia.org
A dm-verity protected filesystem image is not hashed by U-Boot; its
integrity is delegated to the kernel, which trusts the roothash taken
from the FIT dm-verity subnode. For that chain of trust to hold, the
roothash (and salt) must be part of the region covered by the
configuration signature, otherwise an attacker can replace both the
filesystem and the roothash while keeping the signature valid.
Add two independent checks of this property:
- test/py/tests/test_fit_verity_sign.py signs a configuration that
references a filesystem image carrying a dm-verity subnode, then
confirms that tampering the roothash or the salt is rejected by
fit_check_sign. A control that tampers a byte known to be signed
proves the check can fail. A matching page is added under
doc/develop/pytest/ so the module documentation is rendered with
the rest of the generated docs.
- test/boot/fit_verity.c gains a runtime unit test that builds the
exact node list the configuration signature is computed over,
turns it into hashed regions and checks both that the roothash
bytes fall inside a signed region and that tampering them changes
the hash. It needs no private key, so it also runs on real devices
and uses the same hash path a device would.
To let the unit test build the signed-region node list, rename the
config node-list helper to fit_config_get_signed_nodes(), make it
non-static and declare it in image.h.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
A dm-verity protected filesystem image is not hashed by U-Boot when it
is loaded; its integrity is delegated to the kernel, which validates the
filesystem on the fly against the roothash taken from the FIT dm-verity
subnode. The roothash is therefore the sole integrity anchor for the
filesystem, yet fit_config_add_hash() only adds the image node, its
hash subnodes and its cipher subnode to the signed region, leaving the
dm-verity subnode (roothash, salt and block parameters) unsigned.
An attacker able to rewrite the boot medium could then replace both the
filesystem and the roothash, recompute a matching dm-verity tree and
keep the configuration signature valid, defeating verified boot for the
root filesystem.
Add the dm-verity subnode to the list of nodes covered by the
configuration signature, both when signing (tools/image-host.c) and when
verifying (boot/image-fit-sig.c), so the roothash and salt are
authenticated together with the rest of the configuration.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
The MediaTek MTU3 and xHCI text bindings describe legacy U-Boot layouts
which have been superseded by the canonical Linux schemas. Those schemas
are already synchronized into `dts/upstream/Bindings/usb`.
Remove the duplicate text bindings so new devicetrees and driver changes
use the maintained YAML definitions.
Reviewed-by: Marek Vasut <marek.vasut+usb@mailbox.org>
Signed-off-by: Carlo Caione <ccaione@baylibre.com>
CI: https://git.u-boot-project.org/u-boot/custodians/u-boot-imx/-/pipelines/906
- Fix a boot regression on i.MX7 related to the system counter.
- Add Aquila iMX95 0243 PID4.
- Update phycore_imx8mm DDR timings.
- Add FRDM-IMX95 initial support.
- Handle FCFB header during SPI NOR boot and CST backend selection.
Add boot support and peripherals like eMMC/SD, UART, I2C, GPIO, ENETC0/1
and PCIE0/1 for iMX95 15x15 FRDM.
Updated doc for build instructions.
Signed-off-by: Lei Xu <lei.xu@nxp.com>
Signed-off-by: Joseph Guo <qijian.guo@nxp.com>
Add U-Boot support for Milk-V Duo 256M.
This board has a different SoC compared to the Milk-V Duo 64M, it uses
the Sophgo SG2002 instead of the Sophgo CV1800B. Both SoCs share many
common IP blocks, so this board reuses the existing cv1800b CPU support.
The board shares the same 'board.c' with Milk-V Duo 64MB (CV1800B), so
use the same file for now.
Link: https://milkv.io/docs/duo/getting-started/duo256m
Signed-off-by: Hiago De Franco <hfranco@baylibre.com>
Acked-by: Leo Yu-Chi Liang <leo.liang@sifive.com>
Add support for setting the CST backend, both via DT property and
CST_BACKEND environment variable. The CST currently supports two
backends, 'ssl' and 'pkcs11', with 'ssl' being the default when
CST tool is invoked without any -b parameter. Keep 'ssl' backend
as the default, but explicitly pass it via the '-b' parameter,
unless the user selects 'pkcs11' via either method.
Signed-off-by: Marek Vasut <marex@nabladev.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Commit dc3765ede5 ("doc: Switch from setenv to env set") was
too eager to switch "setenv" to "env set" and also incorrectly
rewrote "gpt setenv" to "gpt env set". Undo this error.
Fixes: dc3765ede5 ("doc: Switch from setenv to env set")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
It's either "as with" or "like" but not "as", as reported by Simon.
Let's fix this oversight.
Fixes: 06f0143945 ("doc: CONTRIBUTE: tell people reviewing *is* contributing")
Reported-by: Simon Glass <sjg@chromium.org>
Suggested-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
The attribute mnemonic table did not cover EFI_MEMORY_ISA_VALID and the
EFI_MEMORY_ISA_MASK field, and attribute bits without a mnemonic were
silently dropped, so a memory map carrying ISA-specific, invalid or not
yet known attributes displayed incomplete information without any hint
that something was missing.
Add a mnemonic for EFI_MEMORY_ISA_VALID and print the ISA-specific
field as ISA=<value> when it is valid, instead of decoding bits whose
meaning U-Boot cannot know. Any remaining bits that match neither the
mnemonic table nor the ISA field are printed as a hexadecimal value.
Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
The efi and efidebug commands each carried their own code for printing
the EFI memory map, with separate tables of memory type and attribute
names. The copies had drifted: efidebug knew EFI_PERSISTENT_MEMORY_TYPE
while 'efi mem' printed it as '<invalid>', neither table knew
EFI_UNACCEPTED_MEMORY_TYPE, and the 'efi mem' printer had misaligned
column headers, a broken '<gap>' line and a superfluous Virtual column:
the map is identity mapped before SetVirtualAddressMap() is called, so
the field carries no information at the time the command can run.
Move the printing loop of 'efidebug memmap' into efi_common.c as
efi_show_memmap(), which is linked into both commands, and use it from
both. The second copy in 'efi mem' is deleted together with
efi_print_mem_table() and the private sorting and merging code,
including the 'all' argument.
The memory type names follow the UEFI specification with the leading
'Efi' and the trailing 'Type' stripped, for example ConventionalMemory
for EfiConventionalMemory, and the missing name for unaccepted memory
is added. The type column is widened to fit the longest name,
MemoryMappedIOPortSpace.
The shared function iterates the map with the descriptor size reported
by the firmware instead of assuming sizeof(struct efi_mem_desc). This
matters for 'efi mem' under EDK II based firmware, which reports a
descriptor size of 0x30. The memory map key, which was printed
uninitialized on the payload path, is now initialized. The command
documentation is updated with output captured from the app running
under OVMF, and documents why virtual addresses are not shown.
Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
The current documentation doesn't work as-is for extracting the DDR
training binary from the vendor bootloader. There are some seemingly
undocumented alignment requirements that we need to meet by padding the
binary file. Add some instructions on how to do this with objcopy. Also
fix a minor spelling mistake while we're here.
Signed-off-by: Chris Packham <judge.packham@gmail.com>
Reviewed-by: Stefan Roese <stefan.roese@mailbox.org>
[sr: fix title underline length]
u-boot-dfu-20260728
CI: https://git.u-boot-project.org/u-boot/custodians/u-boot-dfu/-/pipelines/769
Android:
* avb: Update libavb to AOSP 1.3.0
* avb: Fix memory leak on mmc_part
* bootmeth_android: Fix memory leaks for AvbOps and verify-data
* bootmeth_android: Fix out-of-bounds access in bootconfig parsing
USB Gadget:
* cmd: ums: Set serial# on iSerial device descriptor
* dwc2: Set maxpacket_limit and endpoint capabilities to prepare for
udc core migration
* ci_udc: Fix ep type in ep_enable()
* ci_udc: Set usb request status to handle complete callback
* ci_udc: Ensure dtds are inactive before completing request
CI: https://git.u-boot-project.org/u-boot/custodians/u-boot-imx/-/pipelines/749
- Support authenticating signed Mcore container image on i.MX9.
- Support booting CM70, CM71 and CM33 sync cores on i.MX9.
- Add i.MX SNVS RTC driver.
- Detect RAM sizes on Toradex smarc and aquila i.MX95 boards.
- Add support for the Librem5 devkit.
- Subtract half a cycle instead of three quarters of a cycle after DQS
gating calibration on i.MX6.
- Several tqma6 improvements.
- Add product ID support for new Toradex boards.
- Switched to use upstream pinctrl header include,
- Dropped SDHCI DT properties in U-Boot-specific DT for NanoPi R5 as
most are present upstream and those which aren't are breaking devices,
- Fixed ECC strength mismatch between reading and writing on non-0
NAND chips configured as boot medium (nand-is-boot-medium),
- Moved Simon to reviewer for ARM ROCKCHIP,
- Fixed build issue related to GPT capsule support accessing a struct
member only present when CONFIG_PARTITION_TYPE_GUID is set,
- Added support for new devices:
- Anbernic RG-DS
- ROC-RK3588S-PC
Vincent Jardin <vjardin@free.fr> says:
3 commits providing documentation of impacts and testing the dispatch
for null_dev_desc_ok fstypes (semihosting, ubifs, sandbox) in the
generic `load <iface> ...` command.
The test does not cover ubifs, I could not make it work with
qemu. Since the code logic is there and testing with semihost
is done, it should cover the needed cases.
Link: https://lore.kernel.org/r/20260715165735.3207801-1-vjardin@free.fr
Document the usage of remoteproc on R-Car Gen5 RSIP U-Boot port
and clarify how to start Cortex-R52 cores from U-Boot on RSIP.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
The "env" command is the recommended environment management command,
its "print" subcommand is the equivalent replacement for legacy "printenv"
command. Update the documentation to use the contemporary "env print"
command instead of legacy "printenv" command.
Note that the "printenv" command is unlikely to be removed from U-Boot
in the near future due to it being integral part of the command line
ABI.
Implemented using:
$ sed -i 's@\<printenv\>@env print@g' $(git grep -li '\<printenv\>' doc/) README
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
The "env" command is the recommended environment management command,
its "set" subcommand is the equivalent replacement for legacy "setenv"
command. Update the documentation to use the contemporary "env set"
command instead of legacy "setenv" command.
Note that the "setenv" command is unlikely to be removed from U-Boot
in the near future due to it being integral part of the command line
ABI.
Implemented using:
$ sed -i 's@\<setenv\>@env set@g' $(git grep -li '\<setenv\>' doc/) README
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Add that the "BOOT" button must be used
to switch the board to fastboot mode.
Signed-off-by: Michael Opdenacker <michael.opdenacker@rootcommit.com>
Reviewed-by: Yao Zi <me@ziyao.cc>
Document the dispatch path added by the former commit
fs: dispatch null_dev_desc_ok filesystems before lookup
Add a null-block-device interfaces section that:
* lists the three fstypes that can benefit of it (semihosting, ubifs,
sandbox) and the CONFIG option that builds each
* explains the '-' convention for the unused <dev[:part]> field
Suggested-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Vincent Jardin <vjardin@free.fr>
Reviewed-by: Simon Glass <sjg@chromium.org>
Although it has similar naming the Librem 5 Devkit is a completely
different design from the Librem 5 phone. It uses an imx8mq SOM from
Emcraft, a separate HDMI port instead of DisplayPort, different USB-C
chip, panel, etc.
This is based on a Emcraft's SOM documentation, Purism's downstream fork
and the available schematics of the devkit.
Link: https://developer.puri.sm/Librem5/Development_Environment/Boards/imx8.html
Link: https://source.puri.sm/Librem5/dvk-mx8m-bsb
Co-authored-by: Angus Ainslie <angus@akkea.ca>
Co-authored-by: Manuel Traut <manut@mecka.net>
Signed-off-by: Manuel Traut <manut@mecka.net>
Tested-by: Manuel Traut <manut@mecka.net>
Signed-off-by: Guido Günther <agx@sigxcpu.org>
[fabio: Removed the arch/arm/dts/Makefile entry that does not apply and
it is not needed as the board uses OF_UPSTREAM]
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Note that verification is performed by the libavb copy vendored under
lib/libavb/ (AVB version 1.3.0) and which parts are U-Boot-specific, and
pin the README reference to the exact upstream commit the vendored copy
corresponds to instead of a moving master branch.
Signed-off-by: Igor Opaniuk <igor.opaniuk@gmail.com>
With CONFIG_FIT_BEST_MATCH, fit_conf_find_compat() selects the
configuration matching the most specific U-Boot compatible string; on
equal matches the first listed configuration wins and the configurations
node 'default' property is never consulted.
A FIT whose configurations all share the same base devicetree compatible
(e.g. one manifest carrying a base tree plus overlay combinations for a
single board) therefore always boots the first configuration, silently
ignoring the default chosen by the manifest author.
Break score ties in favour of the default configuration. A strictly
better compatible match still wins over it, and FITs without a default
keep the current first-listed behaviour.
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Carlo Caione <ccaione@baylibre.com>
The legacy network stack supports tftpsrv, which listens for an
incoming TFTP write request and receives the first file into memory.
Despite the old command help wording, the command returns after
receiving the file and does not boot it automatically.
The lwIP stack already builds the lwIP TFTP application, but only wires
it up for client-side tftpboot. Add a lwIP tftpsrv command and
implement the server path with tftp_init_server(). Reuse the existing
lwIP TFTP write callback and memory copy path so LMB checks, progress
output, filesize/fileaddr updates and EFI bootdev handling stay
consistent with tftpboot.
Track receive timeout and write-failure state around the lwIP callbacks
so a stalled or rejected receive is not reported as a successful close.
Move CMD_TFTPSRV out of the legacy-only Kconfig block so it can be
enabled with either network stack. Update the command help text and add
usage documentation for the receive-only behavior.
Add pytest coverage for tftpsrv using a generated host file and curl's
TFTP upload support. Enable the command in qemu_arm64_lwip_defconfig so
the test can be run with the existing lwIP QEMU build when the boardenv
provides env__net_tftpsrv_file.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[Jerome Forissier: remove trailing ':' after SPDX tag]
Signed-off-by: Jerome Forissier <jerome.forissier@arm.com>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
Rasmus Villemoes <rv@rasmusvillemoes.dk> says:
This started by me wanting something like what patch 8 does. That
wasn't too hard, except we had no strcasestr(), and also our regex
engine (which I didn't really want to pull into the mix anyway)
doesn't have a flag that requests case-insensitive matching. So I
wanted to add strcasestr(), but then I stumbled on a bunch of stuff
that should be cleaned up in str-land.
Link: https://lore.kernel.org/r/20260708203711.849489-1-rv@rasmusvillemoes.dk
Add a little documentation for the config command and its new ability
to filter the output.
Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
Reviewed-by: Simon Glass <sjg@chromium.org>
The K1 SPL patchset requires DDR firmware integration and FSBL signing
steps that are not covered by existing documentation. Add a SoC-level
guide so reviewers and developers can build and test on hardware.
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Tested-by: Songsong Zhang <sszhang@vsit.ai>
Restructure K1 SoC support to handle multiple boards through a single
configuration:
1. Rename bananapi-f3_defconfig to spacemit_k1_defconfig.
2. Move all K1 board files to board/spacemit/k1/.
3. Replace TARGET_BANANAPI_F3 with TARGET_SPACEMIT_K1 and rename the
board's <board>.h header to k1.h.
Eliminates the need for board-specific defconfigs while maintaining
hardware compatibility.
Signed-off-by: Raymond Mao <raymond.mao@riscstar.com>
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Link: https://patch.msgid.link/20260519-b4-k1-spl-bring-up-v4-0-3915a2a904c1@riscstar.com
Tested-by: Songsong Zhang <sszhang@vsit.ai>
As part of moving our git forge to a new location, update all references
in tree to point to git.u-boot-project.org now.
Signed-off-by: Tom Rini <trini@konsulko.com>
The U-Boot Mailing-list is moving to the lists.u-boot-project.org
domain, so update all references of list.denx.de to the new
domain in the documentation.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
We don't have too many people looking at those at the moment, so having
people getting into the project by adding tests or documentation is I
believe a good thing so let's encourage those specific contributions.
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
We are "a bit" struggling with reviewing things and it's most of the
time maintainers or long time contributors reviewing patches on the
mailing list.
Hint that reviewing is also contributing to the project and that even if
you don't feel you're an expert, your review is still welcome and can
help us catch bugs before they are merged.
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Reviewed-by: Tom Rini <trini@konsulko.com>
This way we don't need to make sure this link still points to something
that exists, as Sphinx will enforce it at build time. It also has the
added benefit that if someone builds the docs they will point at their
docs (though that is debatable whether that's useful, but at least you
stay on the same website).
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
The list-table layout does not allow grouping columns together,
convert the table into grid-table layout instead and rework it
such that SoC families, generations, architectures and SoCs are
grouped together. Include SoC column to group SoCs together, and
Core column which is useful on SoC like the R-Car X5H where U-Boot
can run on multiple cores in the SoC.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Update the Build section and note that it is only applicable
in case the table above does not contain any board specific
instructions. Include information that the Architecture column
now contains toolchain setup instruction links.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Add document which clarifies how to build and install U-Boot on
Renesas R-Car Gen5 X5H Ironhide board.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Add document which clarifies how to build and install U-Boot on
Retronix R-Car Gen4 V4H Sparrow Hawk board.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
