Commit Graph

2584 Commits

Author SHA1 Message Date
Simon Glass
d43aab19fb efi: Create a common file for the stub
There is some duplicated code across x86 and ARM even though they have
slightly different implementations.

They both call efi_stub_exit_boot_services() and this function does not
relate to the app, so belongs better outside the general-purpose efi.c
file.

Create a new efi_stub C file containing this function. Leave out the
efi_ prefix since this is obvious from the directory name.

Signed-off-by: Simon Glass <sjg@chromium.org>
2025-06-30 14:26:34 -06:00
Simon Glass
0b00c34e7c efi: Drop the efi_ prefix on the arch-specific stub files
These are already in the lib/efi/ directory so the extra efi_ prefix is
redundant and makes files harder to find. Drop it.

Signed-off-by: Simon Glass <sjg@chromium.org>
2025-06-30 14:26:34 -06:00
Simon Glass
72afce26be scripts: Add a script check consistency of linker lists
If linker lists have inconsistent alignment it can cause strange
runtime errors. Add a script that can detect and report these problems.

Signed-off-by: Simon Glass <sjg@chromium.org>
2025-06-29 06:53:46 -06:00
Bryan Brattlof
fd7290c2b2 binman: add atf-bl1 to etypes
Some SoCs require a Trusted Firmware-A (TF-A) AP Trusted ROM (BL1) to
initialize the SoC before U-Boot can run properly. Add an atf-bl1 etype
so we can properly package BL1 into a final binary

Signed-off-by: Bryan Brattlof <bb@ti.com>
Acked-by: Simon Glass <sjg@chromium.org>
2025-06-10 14:09:14 -06:00
Simon Glass
0dccad74d8 Mark this tree as a concept
Use a 'Concept' tag for the experimental U-Boot so that it is clear it
is experimental.

Signed-off-by: Simon Glass <sjg@chromium.org>
2025-06-07 11:39:43 -06:00
Tom Rini
bf030467d2 Merge patch series "Update kbuild"
Ilias Apalodimas <ilias.apalodimas@linaro.org> says:

Last time the kbuild scripts were synced with the Linux kernel was on the
4.20 release. Updating directly to 6.x makes the diff difficult to read, so
let's do the changes incrementally and bump to 5.1 first.

Since the number of commits is big, I am splitting this in multiple series.
This one includes most of the commits for Makefile.build,
Makefile.lib and some from Makefile.

commit eeb5687a7139649e ("kbuild: add -Werror=strict-prototypes flag unconditionally")
commit 3812b8c5c5d5 ("kbuild: make -r/-R effective in top Makefile for old Make versions")
commit b421b8a6cb87 ("kbuild: remove unused archmrproper")
commit 1a49b2fd8f58 ("kbuild: strip whitespace in cmd_record_mcount findstring")
commit 88110713ca9dfb ("kbuild: hardcode genksyms path and remove GENKSYMS variable")
commit 1d8001ef358 ("kbuild: generate modules.order only when CONFIG_MODULES=y")
commit 45c4372d00 ("kbuild: refactor quiet_modtag")
commit b39a691617e4 commit ("kbuild: remove redundant quiet_modtag for $(obj-m)")
commit 5439f09f488f ("kbuild: remove redundant 'set -e' from cmd_* defines")
commit e5d289100d3a ("kbuild: remove trailing semicolon from cmd_* passed to if_changed_rule")
commit 3a2429e1faf4 ("kbuild: change if_changed_rule for multi-line recipe")
commit ee3e46b7efd2 ("kbuild: refactor modversions build rules")
commit 4317ee3b6a5e ("kbuild: remove redundant 'set -e' from sub_cmd_record_mcount")
commit 392885ee82d3 ("kbuild: let fixdep directly write to .*.cmd files")
commit 898f5a009f22 ("kbuild: move archive command to scripts/Makefile.lib")
commit b79c6aa6a1f1 ("kbuild: remove unnecessary in-subshell execution")
commit afa974b77128 ("kbuild: add real-prereqs shorthand for $(filter-out FORCE,$^)")
commit ecbd10d90e94 ("kbuild: simplify rules of data compression with size appending")
commit 58156ba4468f ("kbuild: skip 'addtree' and 'flags' magic for external module build")
commit 172caf1993b7 ("kbuild: remove redundant target cleaning on failure")
commit f3fd4a3f3a38 ("kbuild: remove redundant 'set -e' from filechk_offsets")
commit a2237fec1e06 ("kbuild: Enable dtc graph_port warning by default")
commit 70523a3ce5ff ("kbuild: disable dtc simple_bus_reg warnings by default")
commit e4aca4595005 ("kbuild: de-duplicate fixdep usage")

Link: https://lore.kernel.org/r/20250520052153.307194-1-ilias.apalodimas@linaro.org
2025-05-31 10:07:09 +01:00
Simon Glass
e60873c8f3 passage: Support an incoming passage
Plumb in the ability for U-Boot proper to accept an incoming standard
passage from a previous phase, such as SPL or TF-A. This allows data to
be passed from binary to binary when firmware is booting.

Series-changes: 2
- Rebase to master
- Rework global_data for new stdpass convention

Series-changes: 3
- Move passage.h into this patch
- Add passage_valid() to decide if stdpass was provided
- Move arch_passage_entry() into this patch
- Make the global_data fields present only when needed

Signed-off-by: Simon Glass <sjg@chromium.org>
2025-05-29 17:21:36 +01:00
Simon Glass
5f4327ec9f efi: Rename the lib/efi directory
This directory was created when U-Boot gained the ability to run as an
EFI app in 2015. Since then the EFI-loader feature has been added.

The code in lib/efi is not actually used by the loader, so the name is
confusing.

Rename the directory to efi_client to indicate that it includes files
just for U-Boot being a client of EFI, i.e. the EFI app and stub.

Signed-off-by: Simon Glass <sjg@chromium.org>
2025-05-28 08:02:11 +01:00
Ilias Apalodimas
cc23cb1894 efi_loader: Moved the generated ESL file to objtree
Tom reports that generating the ESL file we need for authenticated
capsule updates fails to work on azure which expects a RO git tree.

Move it to $(objtree)

Reported-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2025-05-27 08:54:53 +01:00
Ilias Apalodimas
261b422aed efi_loader: Move public cert for capsules to .rodata
commit ddf67daac3 ("efi_capsule: Move signature from DTB to .rodata")
was reverted in
commit 47a25e81d3 ("Revert "efi_capsule: Move signature from DTB to .rodata"")
because that's what U-Boot was usually doing -- using the DT to store
configuration and data. Some of the discussions can be found here [0].

(Ab)using the device tree to store random data isn't ideal though.
On top of that with new features introduced over the years, keeping
the certificates in the DT has proven to be problematic.
One of the reasons is that platforms might send U-Boot a DTB
from the previous stage loader using a transfer list which won't contain
the signatures since other loaders are not  aware of internal
U-Boot ABIs. On top of that QEMU creates the DTB on the fly, so adding
the capsule certificate there does not work and requires users to dump
it and re-create it injecting the public keys.

Now that we have proper memory permissions for arm64, move the certificate
to .rodata and read it from there.

[0] https://lore.kernel.org/u-boot/CAPnjgZ2uM=n8Qo-a=DUkx5VW5Bzp5Xy8=Wgmrw8ESqUBK00YJQ@mail.gmail.com/

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Tested-by: Jonathan Humphreys <j-humphreys@ti.com>  # on TI sk-am62p-lp
Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on AML-A311D-CC
Tested-by: Raymond Mao <raymond.mao@linaro.org>
2025-05-16 14:45:26 +02:00
Heinrich Schuchardt
5b690046a9 Makefile: let clean remove capsule_in.capsule*.efi-capsule
Update the CLEAN_FILES list to remove capsule*.*.efi-capsule.

Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2025-05-16 14:45:24 +02:00
Tom Rini
2825b387b0 Kbuild: Always use $(PHASE_)
It is confusing to have both "$(PHASE_)" and "$(XPL_)" be used in our
Makefiles as part of the macros to determine when to do something in our
Makefiles based on what phase of the build we are in. For consistency,
bring this down to a single macro and use "$(PHASE_)" only.

Signed-off-by: Tom Rini <trini@konsulko.com>
2025-05-01 05:56:48 -06:00
Raymond Mao
528a145a55 mbedtls: refactor mbedtls build for XPL
Refactor the entire kconfig page for mbedtls, adapt mbedtls makefile
and default config file using 'XPL_', in order to have independent
mbedtls kconfig options in U-Boot Proper, SPL, TPL and VPL.
User can choose legacy or mbedtls libraries for them independently.

Set mbedtls native hashing libraries as default when MBEDTLS_LIB,
SPL_MBEDTLS_LIB, TPL_MBEDTLS_LIB or VPL_MBEDTLS_LIB is selected.

If users prefer using U-Boot legacy hashing libraries, please select
MBEDTLS_LIB_HASHING_ALT, SPL_MBEDTLS_LIB_HASHING_ALT,
TPL_MBEDTLS_LIB_HASHING_ALT or VPL_MBEDTLS_LIB_HASHING_ALT for U-Boot
Proper, SPL, TPL and VPL respectively.

Moreover, rename a few kconfig options and update their descriptions to
improve the consistency of terminology.

Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2025-05-01 05:56:48 -06:00
Simon Glass
eb82ca7cbe efi: Generate the app as a shared library
The app should be built as a shared library, with position-independent
code and the -shared flags. Update the Makefile to handle this.

Signed-off-by: Simon Glass <sjg@chromium.org>
2025-03-27 05:31:43 -06:00
Simon Glass
06b75366ac Makefile: Avoid using TEXT_BASE with the EFI APP
This value is not available with the EFI app. Add a condition to avoid
introducing errors when linking.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
2025-03-27 05:28:53 -06:00
Simon Glass
0408f93544 test: Move fdt-overlay-test rule into test/
The Makefile rules for tests should be within test/Makefile so move the
'fdt-overlay' rule over.

Signed-off-by: Simon Glass <sjg@chromium.org>
2025-02-16 14:11:28 +00:00
Simon Glass
0685170546 test: Move optee-test rule into test/
The Makefile rules for tests should be within test/Makefile so move the
'optee' rule over.

Signed-off-by: Simon Glass <sjg@chromium.org>
2025-02-16 14:11:28 +00:00
Simon Glass
f65aeeabd7 test: Move env-test rule into test/
The Makefile rules for tests should be within test/Makefile so move the
'env' rule over.

Signed-off-by: Simon Glass <sjg@chromium.org>
2025-02-16 14:11:28 +00:00
Simon Glass
07ebcdd543 test: Tweak FDT-overlay tests
Use fdt_overlay consistently in the identifiers and file/dir names.

Signed-off-by: Simon Glass <sjg@chromium.org>
2025-02-16 14:11:28 +00:00
Marek Vasut
f168da34d0 Makefile: Drop SPL_FIT_GENERATOR support
The SPL_FIT_GENERATOR is long superseded by binman, drop SPL_FIT_GENERATOR
support as there are no more users.

Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/22109373594b6a5d1110be9420ccd8fbb93a61d3.1730452668.git.michal.simek@amd.com
2025-02-10 04:38:21 -07:00
Michal Simek
f038defa61 binman: Add option for pointing to separate description
Adding binman node with target images description can be unwanted feature
but as of today there is no way to disable it.
Also on size constrained systems it is not useful to add binman description
to DTB.
Introduce BINMAN_DTB Kconfig symbol which allows separate DTB for target
from DTB for binman itself.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/f1379d2587f9bf279a7a75c318aabbc1b35ee0c6.1730452668.git.michal.simek@amd.com
2025-02-10 04:38:21 -07:00
Caleb Connolly
e0a8bf6f45 efi: stub: support running U-Boot as an EFI payload on ARM64
Implement support for launching U-Boot via an EFI stub app on ARM64.

This is more or less a straight port of the x86 implementation, but due
to the highly x86/qemu specific nature of that implementation I decided
to just split it out to its own file.

Unlike the x86 implementation, there is no debug UART here since ARM
platforms don't have a standard UART interface. However it is usually
possible to port over the debug uart implementation for you platform for
bringup purposes.

Currently this implementation doesn't provide a DTB to U-Boot and
expects U-Boot to use a built-in one, however this ought to be a fairly
trivial addition in the future.

The other significant difference to the x86 version is that rather than
copying U-Boot to CONFIG_TEXT_OFFSET, we require that U-Boot is built
position independent and copy it to EFI allocated memory.

Signed-off-by: Caleb Connolly <caleb.connolly@linaro.org>
2025-02-03 04:43:48 -07:00
Simon Glass
27a5f244ce efi: Switch over to OF_SEPARATE for the app
Now that we can support a separate devicetree, enable this for the
EFI-app builds.

Drop the Makefile-warning exception since we don't need it anymore.

Signed-off-by: Simon Glass <sjg@chromium.org>
2024-12-17 05:34:41 -07:00
Simon Glass
e6eed34cc7 efi: Correct logic for OF_EMBED and OF_SEPARATE co-existing
While we do plan to switch to OF_SEPARATE now it is supported, it seems
worth at least showing how OF_EMBED could be used instead, just for the
record.

So make the Makefile rule conditional on OF_SEPARATE and adjust fdtdec
to avoid a build error when OF_EMBED is used.

Finally. the dtb symbol has a double underscore, so update it to avoid a
build warning.

With future patches, OF_EMBED will no-longer be used with the EFI app,
so it is expected that it will eventually stop working.

Signed-off-by: Simon Glass <sjg@chromium.org>
Fixes: 2e7bf25f6b ("Support separate DTB files with the UEFI app")
2024-12-17 05:34:41 -07:00
Matthew Garrett
2e7bf25f6b Support separate DTB files with the UEFI app
The UEFI app is an actual executable with things like section headers,
so just gluing the DTB onto the end of it won't work. Add an additional
section to contain this and allocate some space, and then during build
copy the DTB into that section.

Signed-off-by: Matthew Garrett <mgarrett@aurora.tech>
Reviewed-by: Simon Glass <sjg@chromium.org>
2024-12-08 07:44:33 -07:00
Simon Glass
6cc483bc22 env: Provide a work-around for unquoting fdtfile
Some boards use a CONFIG option to specify the value of this variable.
This is normally handled by efi_get_distro_fdt_name() but in the case
of sunxi this does not work, since 'soc' is sunxi, but the files are
in the allwinner directory.

Provide a work-around for this particular case.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
2024-12-05 13:58:19 -07:00
Tom Rini
3073246d1b Prepare v2025.01-rc3
Signed-off-by: Tom Rini <trini@konsulko.com>
2024-11-25 16:59:13 -06:00
Quentin Schulz
04b1d84221 Makefile: fix empty MK_ARCH when using ccache
One can use ccache by prefixing the typical CROSS_COMPILE value with
"ccache " (e.g. "ccache aarch64-gnu-linux-" for Aarch64). This however
makes the MK_ARCH empty because sed won't find a match anymore since it
expects the CROSS_COMPILE value to start with the actual toolchain (with
an unlimited number of white spaces before).

This is failing builds since commit 7506c15669 ("sandbox: Report host
default-filename in native mode").

Add "ccache" prefix to ignore but participate in the matching regex used
by sed to identify the target architecture.

Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
2024-11-14 10:51:28 -06:00
Simon Glass
bbc3d12516 Makefile: Fake external blob with BINMAN_ALLOW_MISSING=1
This flag was lost by a previous change and has never been restored.
Without it, binman cannot fully handle missing blobs which are
themselves inputs to mkimage.

Discussion on this at [1] indicated that this was necessary but the
patch was not updated.

Restore the flag so that all missing blobs are reported.

Link: https://patchwork.ozlabs.org/project/uboot/patch/20221206020336.315465-1-trini@konsulko.com/

Signed-off-by: Simon Glass <sjg@chromium.org>
Fixes: 93685d0dcb ("Makefile: With BINMAN_ALLOW_MISSING=1 don't error")
2024-11-13 08:18:31 -06:00
Tom Rini
cca05617a8 Prepare v2025.01-rc2
Signed-off-by: Tom Rini <trini@konsulko.com>
2024-11-11 10:07:36 -06:00
Tom Rini
180d31ae94 Prepare v2025.01-rc1
Signed-off-by: Tom Rini <trini@konsulko.com>
2024-10-28 17:26:30 -06:00
Tom Rini
8ab2178de0 Merge tag 'u-boot-imx-master-20241018a' of https://gitlab.denx.de/u-boot/custodians/u-boot-imx
CI: https://source.denx.de/u-boot/custodians/u-boot-imx/-/pipelines/22796

- Switch to using upstream DT on DH i.MX8MP DHCOM PDK2/PDK3.
- Add ability to build fallback DTBOs from arch/$(ARCH)/dts.
- Remove fdt_high and initrd_high env variables from imx6-dhcom.
- Add dummy clk for imx8.
- Fix DT corruption in imx8_cpu.
- Improve DDR stability on pico-imx7d.
2024-10-18 09:05:04 -06:00
Marek Vasut
a55c4836f3 dts: Add ability to build fallback DTBOs from arch/$(ARCH)/dts
Currently the enablement of OF_UPSTREAM results on the build system
searching for DTs only in dts/upstream/ . There are platforms which
use U-Boot specific DTBOs applied on top of U-Boot control DT during
SPL stage, and source DTs for these are located in arch/$(ARCH)/dtb.

Add dedicated 'dtbos' target which builds only .dtbos and not .dtbs and
in case CONFIG_OF_UPSTREAM_INCLUDE_LOCAL_FALLBACK_DTBOS is enabled, build
this target for arch/$(ARCH)/dtb to generate local U-Boot specific DTBOs.

Adjust top level Makefile so binman would search for .dtb and .dtbo in
both OF_UPSTREAM specific paths and arch/$(ARCH)/dtb for the .dtbo case
in case CONFIG_OF_UPSTREAM_INCLUDE_LOCAL_FALLBACK_DTBOS is enabled.

Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Signed-off-by: Marek Vasut <marex@denx.de>
2024-10-18 09:41:09 -03:00
Marek Vasut
8efc954fc7 Makefile: Drop SPL_FIT_SOURCE support
The SPL_FIT_SOURCE is long superseded by SPL_FIT_GENERATOR which
is long superseded by binman, drop SPL_FIT_SOURCE support as there
are no more users.

Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
2024-10-17 08:36:10 -06:00
Sebastian Reichel
1db4c0ac77 usb: tcpm: add core framework
This adds TCPM framework in preparation for fusb302 support, which can
handle USB power delivery messages. This is needed to solve issues with
devices, that are running from a USB-C port supporting USB-PD, but not
having a battery.

Such a device currently boots to the kernel without interacting with
the power-supply at all. If there are no USB-PD message replies within
5 seconds, the power-supply assumes the peripheral is not capable of
USB-PD. It usually takes more than 5 seconds for the system to reach
the kernel and probe the I2C based fusb302 chip driver. Thus the
system always runs into this state. The power-supply's solution to
fix this error state is a hard reset, which involves removing the
power from VBUS. Boards without a battery (or huge capacitors) will
reset at this point resulting in a boot loop.

This imports the TCPM framework from the kernel. The porting has
originally been done by Rockchip using hardware timers and the Linux
kernel's TCPM code from some years ago.

I had a look at upgrading to the latest TCPM kernel code, but that
beast became a lot more complex due to adding more USB-C features.
I believe these features are not needed in U-Boot and with multiple
kthreads and hrtimers being involved it is non-trivial to port them.
Instead I worked on stripping down features from the Rockchip port
to an even more basic level. Also the TCPM code has been reworked
to avoid complete use of any timers (Rockchip used SoC specific
hardware timers + IRQ to implement delayed work mechanism). Instead
the delayed state changes are handled directly from the poll loop.

Note, that (in contrast to the original Rockchip port) the state
machine has the same hard reset quirk, that the kernel has - i.e.
it avoids disabling the CC pin resistors for devices that are not
self-powered. Without that quirk, the Radxa Rock 5B will not just
end up doing a machine reset when a hard reset is triggered, but will
not even recover, because the CPU will loose power and the FUSB302
will keep this state because of leak voltage arriving through the RX
serial pin (assuming a serial adapter is connected).

This also includes a 'tcpm' command, which can be used to get
information about the current state and the negotiated voltage
and current.

Co-developed-by: Wang Jie <dave.wang@rock-chips.com>
Signed-off-by: Wang Jie <dave.wang@rock-chips.com>
Tested-by: Soeren Moch <smoch@web.de>
Tested-by: Anand Moon <linux.amoon@gmail.com>
Reviewed-by: Jonas Karlman <jonas@kwiboo.se>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2024-10-17 03:12:47 +02:00
Jerome Forissier
1d5d292b79 net: split net into net{,-common,-legacy,-lwip}
Make net.h a wrapper which includes net-common.h and either
net-legacy.h or net-lwip.h based on NET_LWIP. The function
copy_filename() can be useful when NET_LWIP is enabled, therefore
move it out of net/net.c which is built only when networking choice
is NET and create a new file net/net-common.c.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2024-10-16 11:11:56 -06:00
Jerome Forissier
8cb330355b net: introduce alternative implementation as net/lwip/
Prepare the introduction of the lwIP (lightweight IP) TCP/IP stack by
adding a new net/lwip/ directory and the NET_LWIP symbol. Network
support is either NO_NET, NET (legacy stack) or NET_LWIP. Subsequent
commits will introduce the lwIP code, re-work the NETDEVICE integration
and port some of the NET commands and features to lwIP.

SPL_NET cannot be enabled when NET_LWIP=y. SPL_NET pulls some symbols
that are part of NET (such as arp_init(), arp_timeout_check(),
arp_receive(), net_arp_wait_packet_ip()). lwIP support in SPL may be
added later.

Similarly, DFU_TFTP and FASTBOOT are not compatible with NET_LWIP
because of dependencies on net_loop(), tftp_timeout_ms,
tftp_timeout_count_max and other NET things. Let's add a dependency on
!NET_LWIP for now.

SANDBOX can select NET_LWIP but doing so will currently disable the eth
dm tests as well as the wget tests which have strong dependencies on the
NET code.

Other adjustments to Kconfig files are made to fix "unmet direct
dependencies detected" for USB_FUNCTION_SDP and CMD_FASTBOOT when
the default networking stack is set to NET_LWIP ("default NET_LWIP"
instead of "default NET" in Kconfig).

The networking stack is now a choice between NO_NET,
NET and NET_LWIP. Therefore '# CONFIG_NET is not set' should be
'CONFIG_NO_NET=y'. Adjust the defconfigs accordingly.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2024-10-16 11:11:56 -06:00
Tom Rini
d5cab0d6ad Revert "Makefile: Drop SPL_FIT_GENERATOR / SPL_FIT_SOURCE support" changes
:hile we had hoped to be able to remove these options finally, it was
missed that zynq still requires these currently.

This reverts commit 5b9261fb0b and
commit 099b6df556.

Reported-by: Jonas Karlman <jonas@kwiboo.se>
Signed-off-by: Tom Rini <trini@konsulko.com>
2024-10-15 20:35:07 -06:00
Marek Vasut
5b9261fb0b Makefile: Drop SPL_FIT_GENERATOR support
The SPL_FIT_GENERATOR is long superseded by binman, drop SPL_FIT_GENERATOR
support as there are no more users.

Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2024-10-15 12:30:07 -06:00
Marek Vasut
099b6df556 Makefile: Drop SPL_FIT_SOURCE support
The SPL_FIT_SOURCE is long superseded by SPL_FIT_GENERATOR which
is long superseded by binman, drop SPL_FIT_SOURCE support as there
are no more users.

Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
2024-10-15 12:30:07 -06:00
Tom Rini
d467f359c4 Merge patch series "Integrate MbedTLS v3.6 LTS with U-Boot"
Raymond Mao <raymond.mao@linaro.org> says:
Integrate MbedTLS v3.6 LTS (currently v3.6.0) with U-Boot.

Motivations:
------------

1. MbedTLS is well maintained with LTS versions.
2. LWIP is integrated with MbedTLS and easily to enable HTTPS.
3. MbedTLS recently switched license back to GPLv2.

Prerequisite:
-------------

This patch series requires mbedtls git repo to be added as a
subtree to the main U-Boot repo via:
    $ git subtree add --prefix lib/mbedtls/external/mbedtls \
          https://github.com/Mbed-TLS/mbedtls.git \
          v3.6.0 --squash
Moreover, due to the Windows-style files from mbedtls git repo,
we need to convert the CRLF endings to LF and do a commit manually:
    $ git add --renormalize .
    $ git commit

New Kconfig options:
--------------------

`MBEDTLS_LIB` is for MbedTLS general switch.
`MBEDTLS_LIB_CRYPTO` is for replacing original digest and crypto libs with
MbedTLS.
`MBEDTLS_LIB_CRYPTO_ALT` is for using original U-Boot crypto libs as
MbedTLS crypto alternatives.
`MBEDTLS_LIB_X509` is for replacing original X509, PKCS7, MSCode, ASN1,
and Pubkey parser with MbedTLS.
By default `MBEDTLS_LIB_CRYPTO_ALT` and `MBEDTLS_LIB_X509` are selected
when `MBEDTLS_LIB` is enabled.
`LEGACY_CRYPTO` is introduced as a main switch for legacy crypto library.
`LEGACY_CRYPTO_BASIC` is for the basic crypto functionalities and
`LEGACY_CRYPTO_CERT` is for the certificate related functionalities.
For each of the algorithm, a pair of `<alg>_LEGACY` and `<alg>_MBEDTLS`
Kconfig options are introduced. Meanwhile, `SPL_` Kconfig options are
introduced.

In this patch set, MBEDTLS_LIB, MBEDTLS_LIB_CRYPTO and MBEDTLS_LIB_X509
are by default enabled in qemu_arm64_defconfig and sandbox_defconfig
for testing purpose.

Patches for external MbedTLS project:
-------------------------------------

Since U-Boot uses Microsoft Authentication Code to verify PE/COFFs
executables which is not supported by MbedTLS at the moment,
addtional patches for MbedTLS are created to adapt with the EFI loader:
1. Decoding of Microsoft Authentication Code.
2. Decoding of PKCS#9 Authenticate Attributes.
3. Extending MbedTLS PKCS#7 lib to support multiple signer's certificates.
4. MbedTLS native test suites for PKCS#7 signer's info.

All above 4 patches (tagged with `mbedtls/external`) are submitted to
MbedTLS project and being reviewed, eventually they should be part of
MbedTLS LTS release.
But before that, please merge them into U-Boot, otherwise the building
will be broken when MBEDTLS_LIB_X509 is enabled.

See below PR link for the reference:
https://github.com/Mbed-TLS/mbedtls/pull/9001

Miscellaneous:
--------------

Optimized MbedTLS library size by tailoring the config file
and disabling all unnecessary features for EFI loader.
From v2, original libs (rsa, asn1_decoder, rsa_helper, md5, sha1, sha256,
sha512) are completely replaced when MbedTLS is enabled.
From v3, the size-growth is slightly reduced by refactoring Hash functions.
From v6, smaller implementations for SHA256 and SHA512 are enabled and
target size reduce significantly.
Target(QEMU arm64) size-growth when enabling MbedTLS:
v1: 6.03%
v2: 4.66%
v3 - v5: 4.55%
v6: 2.90%

Tests done:
-----------

EFI Secure Boot test (EFI variables loading and verifying, EFI signed image
verifying and booting) via U-Boot console.
EFI Secure Boot and Capsule sandbox test passed.

Known issues:
-------------

None.

Link: https://lore.kernel.org/u-boot/20241003215112.3103601-1-raymond.mao@linaro.org/
2024-10-14 17:59:04 -06:00
Raymond Mao
13de848338 mbedtls: add mbedtls into the build system
Port mbedtls with adapted libc header files.
Add mbedtls default config header file.
Optimize mbedtls default config by disabling unused features to
reduce the target size.
Add mbedtls kbuild makefile.
Add Kconfig skeleton and config submenu entry for selecting
crypto libraries between mbedtls and legacy ones.
Add the mbedtls include directories into the build system.
Port u-boot hash functions as MbedTLS crypto alternatives and set
it as default.

Subsequent patches will separate those Kconfigs into pairs of
_LEGACY and _MBEDTLS for controlling the implementations of legacy
crypto libraries and MbedTLS ones respectively.

The motivation of moving and adapting *INT* macros from kernel.h
to limits.h is to fulfill the MbedTLS building requirement.
The conditional compilation statements in MbedTLS expects the
*INT* macros as constant expressions, thus expressions like
`((int)(~0U >> 1))` will not work.

Prerequisite
------------

This patch series requires mbedtls git repo to be added as a
subtree to the main U-Boot repo via:

$ git subtree add --prefix lib/mbedtls/external/mbedtls \
      https://github.com/Mbed-TLS/mbedtls.git \
      v3.6.0 --squash

Moreover, due to the Windows-style files from mbedtls git repo,
we need to convert the CRLF endings to LF and do a commit manually:

$ git add --renormalize .
$ git commit

Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
2024-10-14 17:58:12 -06:00
Tom Rini
47e544f576 Merge patch series "Tidy up use of 'SPL' and CONFIG_SPL_BUILD"
Simon Glass <sjg@chromium.org> says:

When the SPL build-phase was first created it was designed to solve a
particular problem (the need to init SDRAM so that U-Boot proper could
be loaded). It has since expanded to become an important part of U-Boot,
with three phases now present: TPL, VPL and SPL

Due to this history, the term 'SPL' is used to mean both a particular
phase (the one before U-Boot proper) and all the non-proper phases.
This has become confusing.

For a similar reason CONFIG_SPL_BUILD is set to 'y' for all 'SPL'
phases, not just SPL. So code which can only be compiled for actual SPL,
for example, must use something like this:

   #if defined(CONFIG_SPL_BUILD) && !defined(CONFIG_TPL_BUILD)

In Makefiles we have similar issues. SPL_ has been used as a variable
which expands to either SPL_ or nothing, to chose between options like
CONFIG_BLK and CONFIG_SPL_BLK. When TPL appeared, a new SPL_TPL variable
was created which expanded to 'SPL_', 'TPL_' or nothing. Later it was
updated to support 'VPL_' as well.

This series starts a change in terminology and usage to resolve the
above issues:

- The word 'xPL' is used instead of 'SPL' to mean a non-proper build
- A new CONFIG_XPL_BUILD define indicates that the current build is an
  'xPL' build
- The existing CONFIG_SPL_BUILD is changed to mean SPL; it is not now
  defined for TPL and VPL phases
- The existing SPL_ Makefile variable is renamed to SPL_
- The existing SPL_TPL Makefile variable is renamed to PHASE_

It should be noted that xpl_phase() can generally be used instead of
the above CONFIGs without a code-space or run-time penalty.

This series does not attempt to convert all of U-Boot to use this new
terminology but it makes a start. In particular, renaming spl.h and
common/spl seems like a bridge too far at this point.

The series is fully bisectable. It has also been checked to ensure there
are no code-size changes on any commit.
2024-10-11 12:23:25 -06:00
Simon Glass
5c10c8badf global: Rename SPL_TPL_ to PHASE_
Use PHASE_ as the symbol to select a particular XPL build. This means
that SPL_TPL_ is no-longer set.

Update the comment in bootstage to refer to this symbol, instead of
SPL_

Signed-off-by: Simon Glass <sjg@chromium.org>
2024-10-11 11:44:48 -06:00
Simon Glass
c46760d596 global: Rename SPL_ to XPL_
Use XPL_ as the symbol to indicate an SPL build. This means that SPL_ is
no-longer set.

Signed-off-by: Simon Glass <sjg@chromium.org>
2024-10-11 11:44:48 -06:00
Simon Glass
c6efb7a42d scripts: Rename Makefile.spl to Makefile.xpl
Rename this file to indicate that it refers to any non-U-Boot-proper
phase, not just SPL, which is the phase immediately before U-Boot
proper.

Signed-off-by: Simon Glass <sjg@chromium.org>
2024-10-11 11:44:47 -06:00
Simon Glass
01ab644ebc Makefile: Add a u-boot.cfg file for VPL
Create this file for VPL as well, for consistency.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
2024-10-11 11:44:46 -06:00
Tom Rini
c530f6079c Merge branch 'next' 2024-10-07 09:06:49 -06:00
Tom Rini
f919c3a889 Prepare v2024.10
Signed-off-by: Tom Rini <trini@konsulko.com>
2024-10-07 08:54:35 -06:00
Alexander Kochetkov
f27e830629 Makefile: pass external DTB provided by make variable EXT_DTB to binman
Yocto build is using EXT_DTB to repack U-Boot during signed
FIT kernel creation. First, it takes the DTB from U-Boot, then
it creates signed FIT kernel image and places kernel key into
the DTB. After that it executes:
    make EXT_DTB=/path/to/dtb/with/kernel/key

Despite the fact that in the documentation all examples with EXT_DTB
use only single DTB, the patch allows pass many DTB files separated
by spaces, e.g.:
    make EXT_DTB="/path1/to/1.dtb /path2/to/2.dtb"

The first DTB from the list become default configuration.

Signed-off-by: Alexander Kochetkov <al.kochet@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2024-10-02 13:38:59 -06:00