* [PATCH u-boot v2019.04-aspeed-openbmc 0/2] FIT verification
@ 2021-01-25 4:58 Joel Stanley
2021-01-25 4:58 ` [PATCH u-boot v2019.04-aspeed-openbmc 1/2] ast2600: Modify SPL SRAM layout Joel Stanley
2021-01-25 4:58 ` [PATCH u-boot v2019.04-aspeed-openbmc 2/2] config: ast2600: Enable FIT signature verification Joel Stanley
0 siblings, 2 replies; 6+ messages in thread
From: Joel Stanley @ 2021-01-25 4:58 UTC (permalink / raw)
To: openbmc, Andrew Jeffery, Ryan Chen
As part of our effort to enable secure boot in openbmc, this turns on
FIT verification in the SPL and u-boot.
It adjusts the SRAM layout to accommodate the extra code size, moving
the heap to the non-parity checked 24KB of SRAM.
Joel Stanley (2):
ast2600: Modify SPL SRAM layout
config: ast2600: Enable FIT signature verification
configs/ast2600_openbmc_spl_emmc_defconfig | 3 +++
include/configs/evb_ast2600a1_spl.h | 4 ++--
2 files changed, 5 insertions(+), 2 deletions(-)
--
2.29.2
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH u-boot v2019.04-aspeed-openbmc 1/2] ast2600: Modify SPL SRAM layout
2021-01-25 4:58 [PATCH u-boot v2019.04-aspeed-openbmc 0/2] FIT verification Joel Stanley
@ 2021-01-25 4:58 ` Joel Stanley
2021-01-27 1:55 ` Klaus Heinrich Kiwi
2021-01-25 4:58 ` [PATCH u-boot v2019.04-aspeed-openbmc 2/2] config: ast2600: Enable FIT signature verification Joel Stanley
1 sibling, 1 reply; 6+ messages in thread
From: Joel Stanley @ 2021-01-25 4:58 UTC (permalink / raw)
To: openbmc, Andrew Jeffery, Ryan Chen
The SRAM is 89KB on the A1 and beyond:
0x1000_0000 to 0x1000_ffff: 64KB, with parity check
0x1001_0000 to 0x1001_5fff: 24KB, w/o parity check
0x1001_6000 to 0x1001_63ff: 1KB, w/o parity check, each byte write once
Allow the image to fill the full 64KB payload size (max that secure boot
supports) and plcae the stack at the top of the 24KB of SRAM.
Signed-off-by: Joel Stanley <joel@jms.id.au>
---
include/configs/evb_ast2600a1_spl.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/configs/evb_ast2600a1_spl.h b/include/configs/evb_ast2600a1_spl.h
index 69f3c32ce1d5..a39988820add 100644
--- a/include/configs/evb_ast2600a1_spl.h
+++ b/include/configs/evb_ast2600a1_spl.h
@@ -25,8 +25,8 @@
/* SPL */
#define CONFIG_SPL_TEXT_BASE 0x00000000
-#define CONFIG_SPL_MAX_SIZE 0x0000E800
-#define CONFIG_SPL_STACK 0x10010000
+#define CONFIG_SPL_MAX_SIZE 0x00010000
+#define CONFIG_SPL_STACK 0x10016000
#define CONFIG_SPL_BSS_START_ADDR 0x90000000
#define CONFIG_SPL_BSS_MAX_SIZE 0x00100000
--
2.29.2
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH u-boot v2019.04-aspeed-openbmc 2/2] config: ast2600: Enable FIT signature verification
2021-01-25 4:58 [PATCH u-boot v2019.04-aspeed-openbmc 0/2] FIT verification Joel Stanley
2021-01-25 4:58 ` [PATCH u-boot v2019.04-aspeed-openbmc 1/2] ast2600: Modify SPL SRAM layout Joel Stanley
@ 2021-01-25 4:58 ` Joel Stanley
1 sibling, 0 replies; 6+ messages in thread
From: Joel Stanley @ 2021-01-25 4:58 UTC (permalink / raw)
To: openbmc, Andrew Jeffery, Ryan Chen
This turns on FIT signature verification for the OpenBMC SPL
configuration, for both the SPL and u-boot.
Signed-off-by: Joel Stanley <joel@jms.id.au>
---
configs/ast2600_openbmc_spl_emmc_defconfig | 3 +++
1 file changed, 3 insertions(+)
diff --git a/configs/ast2600_openbmc_spl_emmc_defconfig b/configs/ast2600_openbmc_spl_emmc_defconfig
index 68d18652c980..20f2e7019cb3 100644
--- a/configs/ast2600_openbmc_spl_emmc_defconfig
+++ b/configs/ast2600_openbmc_spl_emmc_defconfig
@@ -35,6 +35,9 @@ CONFIG_ARMV7_BOOT_SEC_DEFAULT=y
CONFIG_ARMV7_PSCI_NR_CPUS=2
CONFIG_NR_DRAM_BANKS=1
CONFIG_FIT=y
+CONFIG_FIT_SIGNATURE=y
+CONFIG_SPL_FIT_SIGNATURE=y
+CONFIG_SPL_LOAD_FIT=y
CONFIG_USE_BOOTARGS=y
CONFIG_BOOTARGS="console=ttyS4,115200n8 root=/dev/ram rw"
CONFIG_USE_BOOTCOMMAND=y
--
2.29.2
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH u-boot v2019.04-aspeed-openbmc 1/2] ast2600: Modify SPL SRAM layout
2021-01-25 4:58 ` [PATCH u-boot v2019.04-aspeed-openbmc 1/2] ast2600: Modify SPL SRAM layout Joel Stanley
@ 2021-01-27 1:55 ` Klaus Heinrich Kiwi
2021-01-27 6:56 ` Joel Stanley
0 siblings, 1 reply; 6+ messages in thread
From: Klaus Heinrich Kiwi @ 2021-01-27 1:55 UTC (permalink / raw)
To: Joel Stanley, openbmc, Andrew Jeffery, Ryan Chen
Hi Joel,
On 1/25/2021 1:58 AM, Joel Stanley wrote:
> The SRAM is 89KB on the A1 and beyond:
I guess I'll have to trust you on that one.
>
> 0x1000_0000 to 0x1000_ffff: 64KB, with parity check
> 0x1001_0000 to 0x1001_5fff: 24KB, w/o parity check
> 0x1001_6000 to 0x1001_63ff: 1KB, w/o parity check, each byte write once
>
> Allow the image to fill the full 64KB payload size (max that secure boot
> supports) and plcae the stack at the top of the 24KB of SRAM.
typo
> @@ -25,8 +25,8 @@
>
> /* SPL */
> #define CONFIG_SPL_TEXT_BASE 0x00000000
> -#define CONFIG_SPL_MAX_SIZE 0x0000E800
> -#define CONFIG_SPL_STACK 0x10010000
> +#define CONFIG_SPL_MAX_SIZE 0x00010000
> +#define CONFIG_SPL_STACK 0x10016000
> #define CONFIG_SPL_BSS_START_ADDR 0x90000000
> #define CONFIG_SPL_BSS_MAX_SIZE 0x00100000
>
Got the following when I tried this patch (Ubuntu 18.04.5, gcc 7.5.0, binutils 2.30). Am I missing something?
LD spl/u-boot-spl
arm-linux-gnueabihf-ld.bfd: u-boot-spl section `.u_boot_list' will not fit in region `flash'
arm-linux-gnueabihf-ld.bfd: region `flash' overflowed by 1612 bytes
scripts/Makefile.spl:384: recipe for target 'spl/u-boot-spl' failed
make[1]: *** [spl/u-boot-spl] Error 1
Makefile:1663: recipe for target 'spl/u-boot-spl' failed
make: *** [spl/u-boot-spl] Error 2
--
Klaus Heinrich Kiwi <klaus@linux.vnet.ibm.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH u-boot v2019.04-aspeed-openbmc 1/2] ast2600: Modify SPL SRAM layout
2021-01-27 1:55 ` Klaus Heinrich Kiwi
@ 2021-01-27 6:56 ` Joel Stanley
2021-01-27 12:13 ` Klaus Heinrich Kiwi
0 siblings, 1 reply; 6+ messages in thread
From: Joel Stanley @ 2021-01-27 6:56 UTC (permalink / raw)
To: Klaus Heinrich Kiwi; +Cc: Andrew Jeffery, OpenBMC Maillist, Ryan Chen
On Wed, 27 Jan 2021 at 01:55, Klaus Heinrich Kiwi
<klaus@linux.vnet.ibm.com> wrote:
>
> Hi Joel,
>
> On 1/25/2021 1:58 AM, Joel Stanley wrote:
> > The SRAM is 89KB on the A1 and beyond:
>
> I guess I'll have to trust you on that one.
You have access to the datasheet and can verify this.
>
> >
> > 0x1000_0000 to 0x1000_ffff: 64KB, with parity check
> > 0x1001_0000 to 0x1001_5fff: 24KB, w/o parity check
> > 0x1001_6000 to 0x1001_63ff: 1KB, w/o parity check, each byte write once
> >
> > Allow the image to fill the full 64KB payload size (max that secure boot
> > supports) and plcae the stack at the top of the 24KB of SRAM.
> typo
>
> > @@ -25,8 +25,8 @@
> >
> > /* SPL */
> > #define CONFIG_SPL_TEXT_BASE 0x00000000
> > -#define CONFIG_SPL_MAX_SIZE 0x0000E800
> > -#define CONFIG_SPL_STACK 0x10010000
> > +#define CONFIG_SPL_MAX_SIZE 0x00010000
> > +#define CONFIG_SPL_STACK 0x10016000
> > #define CONFIG_SPL_BSS_START_ADDR 0x90000000
> > #define CONFIG_SPL_BSS_MAX_SIZE 0x00100000
> >
>
> Got the following when I tried this patch (Ubuntu 18.04.5, gcc 7.5.0, binutils 2.30). Am I missing something?
This is a very out of date compiler. We use GCC 10 for openbmc.
I will submit a v2 with some new features for reducing the image size.
>
> LD spl/u-boot-spl
> arm-linux-gnueabihf-ld.bfd: u-boot-spl section `.u_boot_list' will not fit in region `flash'
> arm-linux-gnueabihf-ld.bfd: region `flash' overflowed by 1612 bytes
> scripts/Makefile.spl:384: recipe for target 'spl/u-boot-spl' failed
> make[1]: *** [spl/u-boot-spl] Error 1
> Makefile:1663: recipe for target 'spl/u-boot-spl' failed
> make: *** [spl/u-boot-spl] Error 2
>
>
> --
> Klaus Heinrich Kiwi <klaus@linux.vnet.ibm.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH u-boot v2019.04-aspeed-openbmc 1/2] ast2600: Modify SPL SRAM layout
2021-01-27 6:56 ` Joel Stanley
@ 2021-01-27 12:13 ` Klaus Heinrich Kiwi
0 siblings, 0 replies; 6+ messages in thread
From: Klaus Heinrich Kiwi @ 2021-01-27 12:13 UTC (permalink / raw)
To: Joel Stanley; +Cc: Andrew Jeffery, OpenBMC Maillist, Ryan Chen
On 1/27/2021 3:56 AM, Joel Stanley wrote:
> On Wed, 27 Jan 2021 at 01:55, Klaus Heinrich Kiwi
> <klaus@linux.vnet.ibm.com> wrote:
>>
>> Hi Joel,
>>
>> On 1/25/2021 1:58 AM, Joel Stanley wrote:
>>> The SRAM is 89KB on the A1 and beyond:
>>
>> I guess I'll have to trust you on that one.
>
> You have access to the datasheet and can verify this.
I'm not sure where to find it. Is that published somewhere?
>>
>>>
>>> 0x1000_0000 to 0x1000_ffff: 64KB, with parity check
>>> 0x1001_0000 to 0x1001_5fff: 24KB, w/o parity check
>>> 0x1001_6000 to 0x1001_63ff: 1KB, w/o parity check, each byte write once
>>>
>>> Allow the image to fill the full 64KB payload size (max that secure boot
>>> supports) and plcae the stack at the top of the 24KB of SRAM.
>> typo
>>
>>> @@ -25,8 +25,8 @@
>>>
>>> /* SPL */
>>> #define CONFIG_SPL_TEXT_BASE 0x00000000
>>> -#define CONFIG_SPL_MAX_SIZE 0x0000E800
>>> -#define CONFIG_SPL_STACK 0x10010000
>>> +#define CONFIG_SPL_MAX_SIZE 0x00010000
>>> +#define CONFIG_SPL_STACK 0x10016000
>>> #define CONFIG_SPL_BSS_START_ADDR 0x90000000
>>> #define CONFIG_SPL_BSS_MAX_SIZE 0x00100000
>>>
>>
>> Got the following when I tried this patch (Ubuntu 18.04.5, gcc 7.5.0, binutils 2.30). Am I missing something?
>
> This is a very out of date compiler. We use GCC 10 for openbmc.
What compiler version did you test this on?
| (cd spl && arm-openbmc-linux-gnueabi-ld.bfd -T u-boot-spl.lds --gc-sections -Bstatic --gc-sections -pie --no-dynamic-linker -Ttext 0x00000000 arch/arm/cpu/armv7/start.o --start-group arch/arm/mach-aspeed/built-in.o arch/arm/cpu/armv7/built-in.o arch/arm/cpu/built-in.o arch/arm/lib/built-in.o board/aspeed/evb_ast2600a1/built-in.o common/spl/built-in.o common/init/built-in.o common/built-in.o cmd/built-in.o env/built-in.o lib/built-in.o disk/built-in.o drivers/built-in.o dts/built-in.o fs/built-in.o --end-group arch/arm/lib/eabi_compat.o arch/arm/lib/lib.a -Map u-boot-spl.map -o u-boot-spl)
| arm-openbmc-linux-gnueabi-ld.bfd: u-boot-spl section `.u_boot_list' will not fit in region `flash'
| arm-openbmc-linux-gnueabi-ld.bfd: region `flash' overflowed by 1736 bytes
$ ./arm-openbmc-linux-gnueabi-gcc --version
arm-openbmc-linux-gnueabi-gcc (GCC) 10.2.0
>
> I will submit a v2 with some new features for reducing the image size.
Thank you.
--
Klaus Heinrich Kiwi <klaus@linux.vnet.ibm.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-01-27 12:17 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-25 4:58 [PATCH u-boot v2019.04-aspeed-openbmc 0/2] FIT verification Joel Stanley
2021-01-25 4:58 ` [PATCH u-boot v2019.04-aspeed-openbmc 1/2] ast2600: Modify SPL SRAM layout Joel Stanley
2021-01-27 1:55 ` Klaus Heinrich Kiwi
2021-01-27 6:56 ` Joel Stanley
2021-01-27 12:13 ` Klaus Heinrich Kiwi
2021-01-25 4:58 ` [PATCH u-boot v2019.04-aspeed-openbmc 2/2] config: ast2600: Enable FIT signature verification Joel Stanley
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.