- Concept - U-Boot List

[PATCH 0/6] fat: Some code improvements
by Simon Glass 13 Nov '25

13 Nov '25

From: Simon Glass <simon.glass(a)canonical.com> This is an attempt to improve the structure of the FAT code, since it doesn't fully follow the U-Boot conventions: - fat_write.c includes fat.c which is odd - use of __u32 and its ilk - use of typedef - old-style struct comments This series resolves these problems, making it easier to take on other improvements in future. Simon Glass (6): fat: Create an internal header file fat: Separate fat.c from fat_write.c fat: Update struct fat_itr to kernel-doc style fat: Remove typedefs in fat.h fat: Convert fat.h to kernel-doc style fat: Use standard types for fixed-size values fs/fat/Makefile | 2 +- fs/fat/fat.c | 316 +++++++++------------------------- fs/fat/fat_internal.h | 171 +++++++++++++++++++ fs/fat/fat_write.c | 246 ++++++++++++++------------- include/fat.h | 385 +++++++++++++++++++++++++++++++++--------- 5 files changed, 677 insertions(+), 443 deletions(-) create mode 100644 fs/fat/fat_internal.h -- 2.43.0 base-commit: d3df5a8ca108c08f2136cf04f4f47bd8bd268031 branch: fat

2 8

[PATCH] expo: Ensure that cyclic tasks can run
by Simon Glass 12 Nov '25

12 Nov '25

From: Simon Glass <sjg(a)chromium.org> Since expo now runs with no delays it can trigger the watchdog on sandbox. Add a call to schedule() to avoid this. Signed-off-by: Simon Glass <sjg(a)chromium.org> --- boot/expo.c | 1 + 1 file changed, 1 insertion(+) diff --git a/boot/expo.c b/boot/expo.c index 30f3cbeb9ef..842bacae163 100644 --- a/boot/expo.c +++ b/boot/expo.c @@ -538,6 +538,7 @@ int expo_poll(struct expo *exp, struct expo_action *act) { int key, ret = -EAGAIN; + schedule(); expo_test_mark(exp); /* update mouse position if mouse is enabled */ -- 2.43.0 base-commit: 69d20a8abc56fcfec305967816e4d93fed75a0d8 branch: edc

1 0

[PATCH 0/5] luks: Support the AES-XTS cipher mode
by Simon Glass 12 Nov '25

12 Nov '25

From: Simon Glass <simon.glass(a)canonical.com> This series finishes off the implementation of LUKSv2, adding support for the common cipher mode and testing that files can be read from the disk. It includes a fix for using the correct size when mapping the crypt, as well as some refactoring to split up the code a little better. Simon Glass (5): luks: Exclude the payload from the size calculation luks: test: Check file access in the decryption tests luks: Move blkmap crypt code into a separate file luks: Split out crypt reading into its own function luks: Add XTS cipher mode support for LUKS2 drivers/block/Makefile | 1 + drivers/block/blkmap.c | 204 +---------------- drivers/block/blkmap_crypt.c | 394 ++++++++++++++++++++++++++++++++ drivers/block/blkmap_internal.h | 74 ++++++ drivers/block/luks.c | 50 +++- include/blkmap.h | 13 +- include/luks.h | 10 +- test/boot/luks.c | 41 +++- 8 files changed, 568 insertions(+), 219 deletions(-) create mode 100644 drivers/block/blkmap_crypt.c create mode 100644 drivers/block/blkmap_internal.h -- 2.43.0 base-commit: b68c8fb93b11ce80b683e06d09de74266e4e53f6 branch: sece-fix

1 5

[PATCH 00/24] luks: Provide basic support for unlocking a LUKS1 partition
by Simon Glass 31 Oct '25

31 Oct '25

From: Simon Glass <sjg(a)chromium.org> With full-disk encryption (FDE) it is traditional to unlock a LUKS partition within userspace as part of the initial ramdisk passed to Linux. The user is prompted for a passphrase and then the disk is unlocked. This works well but does have some drawbacks: - firmware has no way of knowing whether the boot will success - the 'passphrase' prompt comes quite late in the boot, which can be confusing for the user - specifically it is not possible to provide an integrated 'boot' UI in firmware where the user can enter the passphrase - in a VM environment, the key may be known in advance, but there is no way to take advantage of this - it is not possible to use an encryted disk unless also using a ramdisk This series makes a small step towards improving U-Boot in this area. It allows a passphrase to be checked against a LUKS1-encrypted partition. It also provides read-only access to the unencrypted data, so that files can be read. Simon Glass (24): aes: Fix key size handling for AES-192 and AES-256 doc: Provide documentation for the blkmap command log: Provide a macro to log a hex string panic: Provide a way to poweroff on panic sandbox: Enable CONFIG_PANIC_POWEROFF sandbox: Add devon and devoff subcommands to sb command mbedtls: hash: Provide the mbedtls hash type in the hash interface mbedtls: Allow use of PKCS#5 functions test/py: Support creating space after a filesystem test/py: Support FDE with the extlinux image test/py: Set up an Ubuntu image with space for FDE docker: Add cryptsetup package for LUKS testing CI: Update Docker image to including luks tools luks: Add a way to create an encrypted partition luks: Encrypt the mmc11 test image luks: Add the beginning of LUKS support luks: Add a simple command luks: Create a very simple JSON library luks: Create a disk image with LUKS2 encryption luks: Show the JSON information for LUKSv2 luks: Enhance blkmap to support LUKSv1 luks: Provide a way to unlock and map encrypted partitions luks: Add a subcommand to unlock an encrypted partition luks: Add detection of LUKS partition .gitlab-ci.yml | 6 +- MAINTAINERS | 14 + arch/sandbox/dts/test.dts | 8 + cmd/Kconfig | 9 + cmd/Makefile | 1 + cmd/luks.c | 133 +++++++ cmd/sb.c | 107 ++++- common/hash.c | 5 + configs/sandbox_defconfig | 2 + doc/usage/blkmap.rst | 5 + doc/usage/cmd/blkmap.rst | 323 +++++++++++++++ doc/usage/cmd/luks.rst | 254 ++++++++++++ doc/usage/cmd/sb.rst | 40 +- doc/usage/index.rst | 3 + doc/usage/luks.rst | 340 ++++++++++++++++ drivers/block/Kconfig | 22 ++ drivers/block/Makefile | 1 + drivers/block/blkmap.c | 152 +++++++ drivers/block/luks.c | 656 +++++++++++++++++++++++++++++++ include/blkmap.h | 24 ++ include/hash.h | 33 +- include/json.h | 23 ++ include/log.h | 16 + include/luks.h | 175 +++++++++ lib/Kconfig | 15 + lib/Makefile | 1 + lib/aes.c | 15 +- lib/json.c | 122 ++++++ lib/mbedtls/Kconfig | 14 + lib/mbedtls/Makefile | 2 + lib/mbedtls/mbedtls_def_config.h | 4 + lib/panic.c | 8 + test/boot/Makefile | 1 + test/boot/luks.c | 241 ++++++++++++ test/cmd/Makefile | 1 + test/cmd/sb.c | 123 ++++++ test/lib/Makefile | 1 + test/lib/json.c | 211 ++++++++++ test/py/img/common.py | 18 +- test/py/img/ubuntu.py | 12 +- test/py/tests/fs_helper.py | 142 ++++++- test/py/tests/test_ut.py | 3 +- tools/docker/Dockerfile | 1 + 43 files changed, 3262 insertions(+), 25 deletions(-) create mode 100644 cmd/luks.c create mode 100644 doc/usage/cmd/blkmap.rst create mode 100644 doc/usage/cmd/luks.rst create mode 100644 doc/usage/luks.rst create mode 100644 drivers/block/luks.c create mode 100644 include/json.h create mode 100644 include/luks.h create mode 100644 lib/json.c create mode 100644 test/boot/luks.c create mode 100644 test/cmd/sb.c create mode 100644 test/lib/json.c -- 2.43.0 base-commit: 2ee77c0b8cb36f203fa3b1436ae3e8f07a054347 branch: secc

1 24

[PATCH 1/1] bloblist: adjust default bloblist size after reloc
by Heinrich Schuchardt 30 Oct '25

30 Oct '25

If neither CONFIG_BLOBLIST_FIXED NOR CONFIG_BLOBLIST_ALLOC is set, currently CONFIG_BLOBLIST_SIZE_RELOC defaults to 0 except if * CONFIG_ARM=y && CONFIG_EFI_LOADER=y && GENERATE_ACPI_TABLE=y. A size of zero never makes sense for a bloblist. When using QFW we need more than 64 KiB to host the ACPI table. In this case CONFIG_BLOBLIST_ALLOC is used. Set a reasonable default. Remove the CONFIG_BLOBLIST_SIZE_RELOC in ARM QEMU defconfigs which are not compatible with ACPI tables passed from QEMU. Fixes: 6f9b015c138b ("common: Enable BLOBLIST_TABLES on arm") Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt(a)canonical.com> --- common/Kconfig | 4 ++-- configs/qemu_arm64_defconfig | 1 - configs/qemu_arm_defconfig | 1 - 3 files changed, 2 insertions(+), 4 deletions(-) diff --git a/common/Kconfig b/common/Kconfig index 3bd11f44c51..1665d34fac5 100644 --- a/common/Kconfig +++ b/common/Kconfig @@ -1129,8 +1129,8 @@ config BLOBLIST_SIZE config BLOBLIST_SIZE_RELOC hex "Size of bloblist after relocation" - default BLOBLIST_SIZE if BLOBLIST_FIXED || BLOBLIST_ALLOC - default 0x20000 if (ARM && EFI_LOADER && GENERATE_ACPI_TABLE) + default BLOBLIST_SIZE if BLOBLIST_FIXED + default 0x20000 help Sets the size of the bloblist in bytes after relocation. Since U-Boot has a lot more memory available then, it is possible to use a larger diff --git a/configs/qemu_arm64_defconfig b/configs/qemu_arm64_defconfig index e6555b6d3d3..4fff61d7675 100644 --- a/configs/qemu_arm64_defconfig +++ b/configs/qemu_arm64_defconfig @@ -2,7 +2,6 @@ CONFIG_ARM=y CONFIG_POSITION_INDEPENDENT=y CONFIG_ARCH_QEMU_ARM=y CONFIG_SYS_MALLOC_LEN=0x1000000 -CONFIG_BLOBLIST_SIZE_RELOC=0x2000 CONFIG_NR_DRAM_BANKS=1 CONFIG_CUSTOM_SYS_INIT_SP_ADDR=0x40200000 CONFIG_ENV_SIZE=0x40000 diff --git a/configs/qemu_arm_defconfig b/configs/qemu_arm_defconfig index 22781226efb..50046e2fbf2 100644 --- a/configs/qemu_arm_defconfig +++ b/configs/qemu_arm_defconfig @@ -2,7 +2,6 @@ CONFIG_ARM=y CONFIG_ARM_SMCCC=y CONFIG_ARCH_QEMU_ARM=y CONFIG_SYS_MALLOC_LEN=0x1000000 -CONFIG_BLOBLIST_SIZE_RELOC=0x2000 CONFIG_NR_DRAM_BANKS=1 CONFIG_CUSTOM_SYS_INIT_SP_ADDR=0x40200000 CONFIG_ENV_SIZE=0x40000 -- 2.51.0

2 3

[PATCH 0/7] efi: Minor improvements to QEMU and build scripts
by Simon Glass 29 Oct '25

29 Oct '25

From: Simon Glass <sjg(a)chromium.org> This series introduces a few improvements: - passing a boot command to the EFI app - FPDT support for EFI app Simon Glass (7): acpi: qfw: Add FPDT support for QEMU builds qfw: Silence the message when opt/u-boot/bootcmd is not found doc: qemu-x86: Document opt/u-boot/bootcmd feature scripts: Support --bootcmd more generally scripts: build-efi: Write uboot.env file for bootcmd support efi-x86_app64: Use bootflow scan for boot command efi-x86_app64: Enable environment in FAT filesystem configs/efi-x86_app64_defconfig | 5 +- doc/board/emulation/qemu-x86.rst | 20 +++++++ drivers/qfw/qfw.c | 26 ++++++--- drivers/qfw/qfw_acpi.c | 10 ++++ include/qfw.h | 20 ++++++- lib/acpi/acpi_extra.c | 92 ++++++++++++++++++++++++++++++++ lib/acpi/acpi_table.c | 90 ------------------------------- scripts/build-efi | 34 ++++++++++++ scripts/build-qemu | 7 --- scripts/build_helper.py | 7 +++ 10 files changed, 204 insertions(+), 107 deletions(-) -- 2.43.0 base-commit: 1002f1fc35605c58cfacd955ac4780bf046d4109 branch: secd

1 7

[PATCH 00/11] Bootstage and script enhancements
by Simon Glass 23 Oct '25

23 Oct '25

From: Simon Glass <sjg(a)chromium.org> This series collects together a few improvements to the bootstage subsystem, principally some new tests. It also adds support for ACPI FPDT which is a way of passing timing information to the OS. A bug fix is provided for mouse clicks with expo. Finally the series includes some new options for the build-efi script for networking, spice, etc. Simon Glass (11): expo: Correct handling of mouse clicks bootstage: Move the bootstage record to the header file bootstage: Add some more tests bootstage: Add a way to read the time from a record acpi: Add support for Firmware Performance Data Table acpi: fpdt: Generate the table bootm: Update FPDT boot times before handing off to OS scripts: build-efi: Support spice integration scripts: build-efi: Allow enabling networking scripts: build-efi: Flush output before running QEMU scripts: build-qemu: Allow enabling TKey access boot/bootflow_menu.c | 1 + boot/bootm_final.c | 17 ++++ common/bootstage.c | 59 +++++++++-- include/acpi/acpi_table.h | 76 ++++++++++++++ include/bootstage.h | 55 +++++++++++ lib/acpi/acpi_table.c | 86 ++++++++++++++++ scripts/build-efi | 18 +++- scripts/build-qemu | 5 + test/cmd/Makefile | 1 + test/cmd/bootstage.c | 32 ++++++ test/common/Makefile | 2 + test/common/bootstage.c | 201 ++++++++++++++++++++++++++++++++++++++ test/dm/acpi.c | 73 ++++++++++++++ 13 files changed, 617 insertions(+), 9 deletions(-) create mode 100644 test/cmd/bootstage.c create mode 100644 test/common/bootstage.c -- 2.43.0 base-commit: 7c50fc5afa29cee5782b2a8bac3271b12023af0d branch: secb

1 11

[PATCH 0/8] tkey: Provide basic support for Tillitis TKey
by Simon Glass 19 Oct '25

19 Oct '25

From: Simon Glass <sjg(a)chromium.org> This device provides a way to sign data using an internal, unique key. It can be useful for features such as unlocking an encrypted disk. This series provides basic support for the Tkey, with a uclass, two sandbox drivers (emulator and serial), a simple command some tests. Simon Glass (8): serial: ns16550: Add skip-init devicetree property lib: Add blake2s support for TKey USS derivation tkey: Provide a uclass for the Tillitis TKey tkey: Add the signer firmware tkey: Add emulator and test tkey: Add a command sandbox: Add TTY configuration for TKey serial communication tkey: Add a sandbox driver for real TKey hardware arch/sandbox/cpu/Makefile | 4 +- arch/sandbox/cpu/tty.c | 56 +++ arch/sandbox/dts/sandbox.dtsi | 5 + arch/sandbox/dts/test.dts | 4 + cmd/Kconfig | 10 + cmd/Makefile | 1 + cmd/tkey.c | 298 +++++++++++++ doc/usage/cmd/tkey.rst | 247 +++++++++++ doc/usage/index.rst | 1 + drivers/misc/Kconfig | 11 + drivers/misc/Makefile | 6 + drivers/misc/signer.bin-v1.0.0 | Bin 0 -> 28024 bytes drivers/misc/tkey-uclass.c | 741 +++++++++++++++++++++++++++++++++ drivers/misc/tkey_emul.c | 284 +++++++++++++ drivers/misc/tkey_sandbox.c | 170 ++++++++ drivers/serial/ns16550.c | 12 +- include/dm/uclass-id.h | 1 + include/ns16550.h | 2 + include/os.h | 12 + include/tkey.h | 232 +++++++++++ include/u-boot/blake2.h | 51 ++- lib/Makefile | 2 +- lib/blake2/blake2s.c | 282 +++++++++++++ scripts/Makefile.lib | 20 + test/cmd/Makefile | 1 + test/cmd/tkey.c | 67 +++ test/dm/Makefile | 1 + test/dm/tkey.c | 290 +++++++++++++ 28 files changed, 2804 insertions(+), 7 deletions(-) create mode 100644 arch/sandbox/cpu/tty.c create mode 100644 cmd/tkey.c create mode 100644 doc/usage/cmd/tkey.rst create mode 100644 drivers/misc/signer.bin-v1.0.0 create mode 100644 drivers/misc/tkey-uclass.c create mode 100644 drivers/misc/tkey_emul.c create mode 100644 drivers/misc/tkey_sandbox.c create mode 100644 include/tkey.h create mode 100644 lib/blake2/blake2s.c create mode 100644 test/cmd/tkey.c create mode 100644 test/dm/tkey.c -- 2.43.0 base-commit: b03a94008560660911055bc20f564e273eb02b55 branch: seca

1 8

[PATCH 00/24] bootctl: Expand bootctl to include a new UI
by Simon Glass 18 Oct '25

18 Oct '25

From: Simon Glass <sjg(a)chromium.org> The current bootctl UI is fairly basic, just supporting a keyboard menu with text. Now that expo supports a mouse, add a more interesting UI, with more graphical elements. Provide a way to switch between this and the simple UI. This series also includes some small test improvements, along with a patch to remove a blob from a bloblist. Simon Glass (24): test/py: Make test_bind_unbind_with_uclass() independent test/py: Mark a few more tests as slow bloblist: Add a name for the EFI log bloblist: Provide a way to remove a blob tpm: Correct address handling in tcg2_platform_get_log() scripts: build-efi: Use a locally built OVMF image boot: test: Add another Ubuntu image on mmc11 boot: Allow switching back to another layout test: Correct an incomplete sentence in prep_mmc_bootdev() sandbox: Enable Ubuntu fonts bootctl: Plumb in the feature bootctl: Create a common struct for the BOOTCTL_UI uclass bootctl: Avoid hanging on failure bootctl: Provide an option to slow the display refresh bootctl: Respect the autoboot option bootctl: Re-apply the theme when showing the UI bootctl: Bring in some additional images bootctl: Add an option to switch the layout bootctl: Provide a multi-themed UI bootctl: Disable autoboot bootctl: Add a test for the multi UI efi: x86: Provide settings for bootctl efi: x86: Enable required Kconfig options for bootctl efi: x86: Use only serial for input .gitignore | 2 + arch/sandbox/dts/test.dts | 9 + arch/x86/dts/efi-x86_app.dts | 14 + board/efi/efi-x86_app/efi-x86_app.env | 1 + boot/Kconfig | 4 +- boot/Makefile | 2 + boot/bootctl/Makefile | 1 + boot/bootctl/bootctl-uclass.c | 2 + boot/bootctl/bootctl.c | 3 +- boot/bootctl/logic.c | 3 +- boot/bootctl/multi_ui.c | 588 ++++++++++++++++++++++++++ boot/bootctl/simple_ui.c | 111 ++--- boot/bootctl/util.c | 15 + boot/bootflow_menu.c | 2 + cmd/Makefile | 1 + common/bloblist.c | 33 ++ configs/efi-x86_app64_defconfig | 11 +- configs/sandbox_defconfig | 2 + drivers/video/images/Makefile | 5 + drivers/video/images/canonical.bmp | Bin 0 -> 14258 bytes drivers/video/images/help.bmp | Bin 0 -> 1782 bytes drivers/video/images/multipass.bmp | Bin 0 -> 4378 bytes drivers/video/images/settings.bmp | Bin 0 -> 1782 bytes drivers/video/images/tick.bmp | Bin 0 -> 822 bytes include/bloblist.h | 12 + include/bootctl.dtsi | 11 +- include/bootctl/logic.h | 2 + include/bootctl/ui.h | 43 ++ include/tpm_tcg2.h | 4 +- lib/tpm_tcg2.c | 21 +- scripts/build-efi | 2 +- test/boot/bootctl/bootctl.c | 181 +++++++- test/boot/bootflow.c | 2 +- test/cmd/font.c | 5 + test/common/bloblist.c | 64 +++ test/dm/video.c | 7 +- test/py/tests/test_bind.py | 5 + test/py/tests/test_fit_auto_signed.py | 1 + test/py/tests/test_make_dep.py | 3 + test/py/tests/test_ut.py | 3 +- 40 files changed, 1084 insertions(+), 91 deletions(-) create mode 100644 boot/bootctl/multi_ui.c create mode 100644 drivers/video/images/canonical.bmp create mode 100644 drivers/video/images/help.bmp create mode 100644 drivers/video/images/multipass.bmp create mode 100644 drivers/video/images/settings.bmp create mode 100644 drivers/video/images/tick.bmp -- 2.43.0 base-commit: 05ed569280ad46563c77fafbc5f86fdf3f9d20d0 branch: proi

1 24

[PATCH 00/16] boot: Separate out the boot-menu style
by Simon Glass 14 Oct '25

14 Oct '25

This series refactors the boot menu so that it is possible to create the items and then (later) change the style/position to the simple style. This allows swapping back and forth between a different style and the simple style. It also adjusts how the mouse is set up, so that the initial mouse position is only set up once the video device is known. This allows the position to be centred on the display, a better starting point than the top left. Simon Glass (16): scripts: build-efi: Use the USB mouse video: Report failure to write a frame to a file expo: Check the mouse once the video device is known expo: Avoid setting SCENEOF_SIZE_VALID with calculated size expo: Avoid setting SCENEOF_SIZE_VALID with menu items expo: Allow applying the theme to just the display expo: Clarify that text objects are not string IDs mouse: Place mouse in the middle of the display boot: Split out setting menu properties from menu creation boot: Move prompt strings into bootflow_menu_set_props() boot: Hide unwanted objects and show the menu pointer boot: Add the distro version and box into the menu boot: Move text for desc and label items to after setup boot: Explicitly request that the menu position its objects boot: Explicitly set up the theme with the boot menu boot: Set the item properties with the boot menu boot/bootflow_menu.c | 204 ++++++++++++++++++++++++++--------- boot/expo.c | 32 +++--- boot/scene.c | 19 ++-- boot/scene_menu.c | 13 +-- drivers/input/mouse-uclass.c | 2 + include/bootflow.h | 14 +++ include/expo.h | 23 +++- include/mouse.h | 2 + scripts/build-efi | 2 +- test/dm/video.c | 7 +- 10 files changed, 235 insertions(+), 83 deletions(-) -- 2.43.0 base-commit: 4855727dbde154a25671f61bfec9db4caf0604db branch: proh

1 16