From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from metis.whiteo.stw.pengutronix.de (metis.whiteo.stw.pengutronix.de [185.203.201.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1475114A98 for ; Tue, 2 Jan 2024 15:53:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=pengutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=pengutronix.de Received: from ptz.office.stw.pengutronix.de ([2a0a:edc0:0:900:1d::77] helo=[127.0.0.1]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1rKh4q-0001xX-4T; Tue, 02 Jan 2024 16:53:12 +0100 Message-ID: Date: Tue, 2 Jan 2024 16:53:09 +0100 Precedence: bulk X-Mailing-List: linux-doc@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v9 2/2] arm64: boot: Support Flat Image Tree Content-Language: en-US To: Masahiro Yamada , Chen-Yu Tsai Cc: Geert Uytterhoeven , Laurent Pinchart , Simon Glass , linux-arm-kernel@lists.infradead.org, U-Boot Mailing List , Nicolas Schier , Tom Rini , Catalin Marinas , Jonathan Corbet , Nathan Chancellor , Nick Terrell , Will Deacon , linux-doc@vger.kernel.org, linux-kbuild@vger.kernel.org, linux-kernel@vger.kernel.org, workflows@vger.kernel.org References: <20231202035511.487946-1-sjg@chromium.org> <20231202035511.487946-3-sjg@chromium.org> <20231203153401.GV8402@pendragon.ideasonboard.com> <20231207142723.GA3187877@google.com> <20231207143814.GD15521@pendragon.ideasonboard.com> <20231209152946.GC13421@pendragon.ideasonboard.com> From: Ahmad Fatoum In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-SA-Exim-Connect-IP: 2a0a:edc0:0:900:1d::77 X-SA-Exim-Mail-From: a.fatoum@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false X-PTX-Original-Recipient: linux-doc@vger.kernel.org Hello Yamada-san, On 14.12.23 08:33, Masahiro Yamada wrote: >> The FIT spec allows the "fdt" property to list >> multiple image nodes. >> >> >> o config-1 >> |- description = "configuration description" >> |- kernel = "kernel sub-node unit name" >> |- fdt = "fdt sub-node unit-name" [, "fdt overlay sub-node unit-name", ...] >> |- loadables = "loadables sub-node unit-name" >> |- script = " >> |- compatible = "vendor > > > > > > This is a question for U-Boot (and barebox). > > > > > images { > base { > ... > }; > > addon1 { > ... > }; > > addon2 { > ... > }; > }; > > configurations { > ... > fdt = "base", "addon1", "addon2"; > }; > > > > > Is U-Boot's "bootm" command able to dynamically construct > the full DTB from "base" + "addon1" + "addon2" > and pass to the kernel? barebox can apply overlays to the DT, but doesn't do so yet from the extra entries in configuration fdt properties. This should be straight-forward to add though, if the need arises. > Is U-Boot able to handle FIT (includes kernel + DTs) > and a separate initrd? > > # bootm : This is possible in barebox, provided that the FIT image doesn't already have a ramdisk and that CONFIG_BOOTM_FORCE_SIGNED_IMAGES=n: bootm -r /mnt/nfs/ramdisk.gz /mnt/nfs/image.fit (Or the equivalent variables if not wanting to use the shell.) > Presumably, it would be difficult to inject initramdisk > into image.fit later, so I am hoping bootm would work like that, > but I did not delve into U-Boot code. > > > > If it works, is it possible to verify the integrity of initrd? > The kernel and DTs inside FIT will be verified, but not sure > if it is possible for ramdisk. If one wants to preclude mix & match attacks, the configuration needs to be verified fully, so if signing is required, it's probably better to amend the FIT later on with the new configuration instead of signing the initrd separately and combining them at runtime. Cheers, Ahmad > > > > > -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |