S28HS512T on TI SK has sector size of 256KB, so update OSPI partition
to align on 256KB sector size. Since the sector size for MT35XU512ABA
on EVM is 128KB, partitions will remain aligned for EVM.
Also, now since the sector size is 256KB ospi.env.backup will collide
with ospi.sysfw, so move ospi.env.backup to the padding space (0x7C0000)
before ospi.rootfs partition.
Signed-off-by: Sinthu Raja <sinthu.raja@ti.com>
Enable configs for building multiple dtbs into a single fit image
and load the right dtb for next stage. This will help to use same
defconfig for both J721E EVM and SK boards.
Signed-off-by: Sinthu Raja <sinthu.raja@ti.com>
J721E Starter Kit (SK)[1] is a low cost, small form factor board designed
for TI’s J721E SoC. TI’s J721E SoC comprises of dual core A72, high
performance vision accelerators, video codec accelerators, latest C71x
and C66x DSP, high bandwidth real-time IPs for capture and display, GPU,
dedicated safety island and security accelerators. The SoC is power
optimized to provide best in class performance for industrial and
automotive applications.
J721E SK supports the following interfaces:
* 4 GB LPDDR4 RAM
* x1 Gigabit Ethernet interface
* x1 USB 3.0 Type-C port
* x3 USB 3.0 Type-A ports
* x1 PCIe M.2 E Key
* x1 PCIe M.2 M Key
* 512 Mbit OSPI flash
* x2 CSI2 Camera interface (RPi and TI Camera connector)
* 40-pin Raspberry Pi GPIO header
Add A72 specific dts for J721E-SK.
[1] https://www.ti.com/tool/SK-TDA4VM
Signed-off-by: Sinthu Raja <sinthu.raja@ti.com>
Board ID I2C EEPROM will be probed before SYSFW is available.
So drop the power-domains property for wakup_i2c0 on which
board ID EEPROM is connected.
Signed-off-by: Sinthu Raja <sinthu.raja@ti.com>
Enable support for selecting DTB from FIT within SPL based on the
board name read from EEPROM. This will help to use single defconfig
for both EVM and SK.
Signed-off-by: Sinthu Raja <sinthu.raja@ti.com>
Update the board_fit_config_name_match() to choose the right dtb
based on the board name read from EEPROM.
Also restrict multpile EEPROM reads by verifying if EEPROM is already
read.
Signed-off-by: Sinthu Raja <sinthu.raja@ti.com>
j721e-sk doesn't have any daughter cards, so disable daughter
card probing inside board_late_init() and spl_board_init() for
j721e-sk.
Signed-off-by: Sinthu Raja <sinthu.raja@ti.com>
J721E EVM has EEPROM populated at 0x50. J721E SK has EEPROM populated
at next address 0x51 in order to be compatible with RPi. So start
looking for TI specific EEPROM at 0x50, if not found look for EEPROM at
0x51.
Signed-off-by: Sinthu Raja <sinthu.raja@ti.com>
board_late_init(), setup_board_eeprom_env() and setup_serial() is
called only under CONFIG_BOARD_LATE_INIT, so guard these functions
with the same. Also, reorder these functions to place it under
single #ifdef
Signed-off-by: Sinthu Raja <sinthu.raja@ti.com>
Buck regulator 1, 2 and 3 of TPS6594132 on j721e-sk is in 3 Phase
confguration, in-order to support this, add configuring 3 Phase buck
in tps65941 while driver probing.
Signed-off-by: Sinthu Raja <sinthu.raja@ti.com>
Acked-by: Jaehoon Chung <jh80.chung@samsung.com>
Since TPS659412 and TPS659413 are both software compatible,
add a compatible string for the same inside tps65941.c.
Signed-off-by: Sinthu Raja <sinthu.raja@ti.com>
Acked-by: Jaehoon Chung <jh80.chung@samsung.com>
This function has not been conditionally compiled for some time, so
remove the incorrect guards around the declaration.
Signed-off-by: Tom Rini <trini@konsulko.com>
The changes introduced with commit 6337d53fdf ("arm: dts: sync am33xx
with Linux 5.9-rc7") prevent the PDU001 from operating correctly.
This patch fixes the configuration of the pin multiplexer and uart3.
Signed-off-by: Felix Brack <fb@ltec.ch>
After replacing of include/config/auto.conf sourcing with
extraction of CONFIG_LOCALVERSION, resulting version string
contains quotes around localversion part which are always
present in auto.conf (even if localversion is empty).
This patch fixes this script to remove quotes.
Signed-off-by: Nikita Maslov <wkernelteam@gmail.com>
Cc: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
Cc: Tom Rini <trini@konsulko.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
The pstore command tries to create a reserved-memory node but fails if
it is already present with:
Add 'reserved-memory' node failed: FDT_ERR_EXISTS
This patch creates the node only if it does not exist and adapts the reg
values sizes depending on already present #address-cells and #size-cells
values.
Signed-off-by: Detlev Casanova <detlev.casanova@collabora.com>
Documentation:
* mkeficapsule man-page
UEFI changes:
* add support for signing images to mkeficapsule
* add support for user define capsule GUID
* adjust unit tests for capsules
* fix UEFI image signature validation in case of multiple signatures
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEbcT5xx8ppvoGt20zxIHbvCwFGsQFAmIGtKEACgkQxIHbvCwF
GsSWlg//Vr61dpbpPVuczl18OtojpUzMg8bwqc4tJQRQrOGMGjmPqrGZJCm1pmMH
Q5ZD4QCAdycbRqAqcpdX9FXHmD5R0HvGmhlC9TnXxo4nKaOcphMMC3PFjBQZlhPJ
KPc7jjoIcycz+fRqbd4CGRFXNGJAecK++4uM6v6WCNF3Dq16r0ws1aUTG7YPlaJF
JNo3/4eEQpRsplNXpJsqVPQhbfLuaiCOJc8VUWYNylRdhBC7Dx8yI7m1FHOSBbKb
Pk4tbysEhowcSc2Duc9muxkaVAkSy/mIHj1I8Z2VzpzH8zXcaiHMjROqMGOE+vwx
raDzJI0ZcEV/MEbm/QLCALlCKqN3d1NRmZLAvXPYN4+ioA8lzPAEnqEywXRPY/Yk
KnkDWaF1KEKzDaY52oqkh2LkasY9wzluvb1sm+oW9bh/kn4wKLr0Z1oSl92/vvci
S/ztLqxhqlXpWx0NzOFnNvUUkEl0VN6IM/+Bsg5AoO7mdWe7MC3iSPOU1Ge5wRU9
R9BLaTrr61/+soc2jrJL5PQr3Rqtyo1qLpIusMFT88jeFp0b8AIUL2AUlJsAUXYg
a2NV7qGUsZN/Ur488N1t7DixTkjGdStHKRk06bSTPrOpfA2oembdA2/H/HECoJMP
JzdwMeZM0qcxFGTbC7c3yO3cTVVYPyIDGh1YEBYjCzfL6AuR2uU=
=AAdJ
-----END PGP SIGNATURE-----
Merge tag 'efi-2022-04-rc2-4' of https://source.denx.de/u-boot/custodians/u-boot-efi
Pull request for efi-2022-04-rc2-4
Documentation:
* mkeficapsule man-page
UEFI changes:
* add support for signing images to mkeficapsule
* add support for user define capsule GUID
* adjust unit tests for capsules
* fix UEFI image signature validation in case of multiple signatures
The previous patch is changing U-Boot's behavior wrt certificate based
binary authentication. Specifically an image who's digest of a
certificate is found in dbx is now rejected. Fix the test accordingly
and add another one testing signatures in reverse order
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
The EFI spec allows for images to carry multiple signatures. Currently
we don't adhere to the verification process for such images.
The spec says:
"Multiple signatures are allowed to exist in the binary's certificate
table (as per PE/COFF Section "Attribute Certificate Table"). Only one
hash or signature is required to be present in db in order to pass
validation, so long as neither the SHA-256 hash of the binary nor any
present signature is reflected in dbx."
With our current implementation signing the image with two certificates
and inserting both of them in db and one of them dbx doesn't always reject
the image. The rejection depends on the order that the image was signed
and the order the certificates are read (and checked) in db.
While at it move the sha256 hash verification outside the signature
checking loop, since it only needs to run once per image and get simplify
the logic for authenticating an unsigned imahe using sha256 hashes.
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Before the capsule authentication is supported, this test script works
correctly, but with the feature enabled, most tests will fail due to
unsigned capsules.
So check the results depending on CAPSULE_AUTHENTICATE or not.
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
This test scenario tests a new feature of mkeficapsule, "--guid" option,
which allows us to specify FMP driver's guid explicitly at the command
line.
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Since the syntax of mkeficapsule was changed in the previous commit,
we need to modify command line arguments in a pytest script.
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
The existing options, "--fit" and "--raw," are only used to put a proper
GUID in a capsule header, where GUID identifies a particular FMP (Firmware
Management Protocol) driver which then would handle the firmware binary in
a capsule. In fact, mkeficapsule does the exact same job in creating
a capsule file whatever the firmware binary type is.
To prepare for the future extension, the command syntax will be a bit
modified to allow users to specify arbitrary GUID for their own FMP driver.
OLD:
[--fit <image> | --raw <image>] <capsule file>
NEW:
[--fit | --raw | --guid <guid-string>] <image> <capsule file>
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Add a couple of test cases against capsule image authentication
for capsule-on-disk, where only a signed capsule file with the verified
signature will be applied to the system.
Due to the difficulty of embedding a public key (esl file) in U-Boot
binary during pytest setup time, all the keys/certificates are pre-created.
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Now we can use mkeficapsule command instead of EDK-II's script
to create a signed capsule file. So update the instruction for
capsule authentication.
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Add a man page for mkeficapsule command.
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
With this enhancement, mkeficapsule will be able to sign a capsule
file when it is created. A signature added will be used later
in the verification at FMP's SetImage() call.
To do that, we need specify additional command parameters:
-monotonic-cout <count> : monotonic count
-private-key <private key file> : private key file
-certificate <certificate file> : certificate file
Only when all of those parameters are given, a signature will be added
to a capsule file.
Users are expected to maintain and increment the monotonic count at
every time of the update for each firmware image.
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Add CONFIG_TOOLS_MKEFICAPSULE. Then we want to always build mkeficapsule
if tools-only_defconfig is used.
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
We need to install libgnutls-devel package to build the host tool,
mkeficapsule, and as of now, there seems to be a depencency conflict
in the current msys2 installer;
:: installing libp11-kit (0.24.1-1) breaks dependency \
'libp11-kit=0.23.22' required by p11-kit
To resolve this conflict, however, the initial "pacman -Syyuu" in
'tools_only_windows' job is not enough. Another "pacman -Su" will
enforce all the out-of-date packages being upgraded.
(Probably the first "-Syyuu" can be changed to "-Syu".)
See the installation steps in
https://www.msys2.org/
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
A partial list:
- fw_env updates, a new testcase for mkimage -o ..., nop-phy reset-gpios
support, DFU updates, kaslr-seed support in extlinux.conf, modern
"partitions" support in mtd device tree
The output size for snprint() should not only be respected for whole fields
but also with fields. Add more tests.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Some usb-nop-xceiv devices use a gpio take them out
of reset. Add a reset function to put them into that
state. This is similar to how Linux handles the
usb-nop-xceiv driver.
Signed-off-by: Adam Ford <aford173@gmail.com>
Environment variables can be stored in two formats:
1. Single entry with header containing CRC32
2. Two entries with extra flags field in each entry header
For that reason fw_env_open() has two main code paths and there are
pointers for CRC32/flags/data.
Previous implementation was a bit hard to follow:
1. It was checking for used format twice (in reversed order each time)
2. It was setting "environment" global struct fields to some temporary
values that required extra comments explaining it
This change simplifies that code:
1. It introduces two clear code paths
2. It sets "environment" global struct fields values only once it really
knows them
To be fair there are *two* crc32() calls now and an extra pointer
variable but that should be cheap enough and worth it.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
It's usually easier to understand code & follow it if all arguments are
passed explicitly. Many coding styles also discourage using global
variables.
Behaviour of flash_io() was a bit unintuitive as it was writing to a
buffer referenced in a global struct. That required developers to
remember how it works and sometimes required hacking "environment"
global struct variable to read data into a proper buffer.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Since dfu is not only used for USB, and some platform only
supports DFU_OVER_TFTP or EFI capsule update, dfu_alt_info
is defined on such platforms too.
For such platform, 'dfu list' command is useful to check
how the current dfu_alt_info setting is parsed.
Signed-off-by: Masami Hiramatsu <masami.hiramatsu@linaro.org>
Fix some typo and wrong information about dfu_alt_info.
- Add the parameter format, decimal only or hexadecimal.
- Use same parameter name for the same kind of parameters.
(e.g. dev -> dev_id)
Signed-off-by: Masami Hiramatsu <masami.hiramatsu@linaro.org>
When parsing the dfu_alt_info, check the number of arguments
and argument string strictly. If there is any garbage data
(which is not able to be parsed correctly) in dfu_alt_info,
that means something wrong and user may make a typo or mis-
understanding about the syntax. Since the dfu_alt_info is
used for updating the firmware, this mistake may lead to
brick the hardware.
Thus it should be checked strictly for making sure there
is no mistake.
Signed-off-by: Masami Hiramatsu <masami.hiramatsu@linaro.org>
If dfu_alt_info has repeated spaces or tab (for indentation or
readability), the dfu fails to parse it. For example, if
dfu_alt_info="mtd nor1=image raw 100000 200000" (double spaces
after "raw"), the image entity start address is '0' and the size
'0x100000'. This is because the repeated space is not skipped.
Use space and tab as a separater and apply skip_spaces() to
skip redundant spaces and tabs.
Signed-off-by: Masami Hiramatsu <masami.hiramatsu@linaro.org>
Use strlcpy() instead of strcpy() to prevent copying the
entity name over the name buffer size.
Signed-off-by: Masami Hiramatsu <masami.hiramatsu@linaro.org>
Addresses the feedback provided on 5902a397d0 ("mkimage: Allow to
specify the signature algorithm on the command line") which raced with
the merge.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
echo -n does not give the intended effect when invoked in macOS through
/bin/sh, which is the shell make uses by default, see
"https://stackoverflow.com/questions/11675070/makefile-echo-n-not-working"
for a detailed explanation. In this case, it resulted in "-n" being
written to env.txt and env.in even though they should be empty, which
caused compilation to fail with "Your board uses a text-file
environment, so must not define CONFIG_EXTRA_ENV_SETTINGS".
This patch prevents the error by replacing echo -n's with touch, as they
are used to create empty files in these cases.
strlen() returns size_t. So we should use %zu to print it.
This avoids incorrect output on 32bit systems.
Fixes: 2fc62f2991 ("stackprot: Make our test a bit more complex")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Stress the '-o algo_name' argument of mkimage by expanding the vboot
test.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
[trini: Update scripts/pylint.base]
