Commit 37579ca

# Load address for the FIT kernel sub-image, overriding the FIT's own

# `load`/`entry`. Needed when the ITS omits them (Yocto leaves them out

# unless UBOOT_LOADADDRESS/UBOOT_ENTRYPOINT are set), since a gzip kernel

# has nowhere to decompress to and an uncompressed one would be entered in

# place at whatever alignment the FIT happens to give it. 0 honors the FIT.

#WOLFBOOT_LOAD_KERNEL_ADDRESS?=0x200000

# Likewise for the ramdisk: 0 honors the FIT's own `load`.

#WOLFBOOT_LOAD_RAMDISK_ADDRESS?=0x40000000

# (e.g. DDR at 0x400_0000_0000). config/examples/versal_vmk180_highddr.config

# is this recipe already applied, with a worked DDR layout.

# These must stay BELOW the defaults above and

#

# Note the digit count: 0x40000800000 is 0x400_0080_0000 (8 MB into the

# window), not 0x400_0800_0000 (128 MB in).

#

# Every address below is a distinct, non-overlapping region. The kernel and

# ramdisk destinations must clear the FIT staging buffer at

# WOLFBOOT_LOAD_ADDRESS, because the sub-images are read out of it while

# they are being written - a large image whose destination overlaps the

# staging buffer (or wolfBoot itself) hangs partway through the copy.

# Size WOLFBOOT_PARTITION_SIZE for the whole signed FIT: a kernel plus a

# large initramfs easily exceeds the 44 MB default set above.

#WOLFBOOT_LOAD_KERNEL_ADDRESS=0x40002000000

#WOLFBOOT_LOAD_RAMDISK_ADDRESS=0x40030000000

# wolfBoot configuration for AMD Versal - DDR Boot with a high DDR aperture

# Versal with DDR mapped at 0x400_0000_0000 instead of the default map.

#

# This configuration replaces U-Boot in the Versal boot flow:

# PLM -> PSM -> BL31 (EL3) -> wolfBoot (EL2) -> Linux (EL1)

#

# Derived from versal_vmk180.config; see that file for the knobs this one

# does not change. Every address here lives inside the aperture declared by

# VERSAL_DDR_HIGH_BASE/SIZE, which is what generates the translation-table

# entries covering it. All clock, MIO and DDR initialization is done by

# PLM/PSM before wolfBoot starts.

#

# Three things outside this file have to agree with it:

# - the bootgen BIF: wolfboot.elf at WOLFBOOT_ORIGIN, and the raw DTB

# partition at WOLFBOOT_LOAD_DTS_ADDRESS

# - BL31's BL33 entry (PRELOADED_BL33_BASE) = WOLFBOOT_ORIGIN

# - the FIT ITS: #address-cells = <2>, because a single cell cannot hold

# an address above 4 GB

ARCH?=AARCH64

TARGET?=versal

WOLFBOOT_VERSION?=1

# ECC-384 with SHA-384 (good balance of security and performance)

SIGN?=ECC384

HASH?=SHA384

IMAGE_HEADER_SIZE?=512

# RSA 4096-bit with SHA3-384 (alternative)

#SIGN?=RSA4096

#HASH?=SHA3

#IMAGE_HEADER_SIZE?=1024

# Debug options

DEBUG?=1

DEBUG_SYMBOLS=1

DEBUG_UART=1

# Boot Benchmarking (optional):

# Enables timing of boot operations (flash read, integrity, signature).

BOOT_BENCHMARK?=1

VTOR?=1

CORTEX_M0?=0

NO_ASM?=0

ALLOW_DOWNGRADE?=0

NVM_FLASH_WRITEONCE?=0

V?=0

SPMATH?=1

RAM_CODE?=0

DUALBANK_SWAP?=0

PKA?=0

WOLFTPM?=0

# Flash configuration

EXT_FLASH?=1

NO_XIP=1

# Boot Exception Level

# Choose the exception level for booting applications (mutually exclusive):

# BOOT_EL1: Transition applications to EL1 (default - for Linux, most bare-metal)

# BOOT_EL2: Boot applications at EL2 (for hypervisors, RTOSes that expect EL2)

# Default is BOOT_EL1 if neither is specified.

# Uncomment one of the following to override:

#BOOT_EL1=1

#BOOT_EL2=1

# ELF loading support

ELF?=1

# Native gzip decompression for FIT subimages (set GZIP=0 to disable)

GZIP?=1

# FIT ramdisk (initramfs) extraction plus the /chosen/linux,initrd-{start,end}

# fixup. A stock PetaLinux image.ub carries a ramdisk sub-image that a U-Boot

# "bootm" loads; without this wolfBoot ignores it.

FIT_RAMDISK?=1

# WOLFBOOT_LOAD_KERNEL_ADDRESS / WOLFBOOT_LOAD_RAMDISK_ADDRESS override the

# FIT's own `load`/`entry`, which is what lets a FIT built without them boot

# at all (Yocto omits both unless UBOOT_LOADADDRESS/UBOOT_ENTRYPOINT are

# set). Both are set in the DDR layout below.

# Toolchain

USE_GCC=1

CROSS_COMPILE=aarch64-none-elf-

# ============================================================================

# Boot Memory Layout

# ============================================================================

# wolfBoot runs from DDR inside the high aperture, at EL2 non-secure.

# WOLFBOOT_ORIGIN is set with the rest of the layout further down - the

# bootgen BIF partition header and BL31's PRELOADED_BL33_BASE must both

# name that same address, not the 0x8000000 the default-map configs use.

# Optional debugging with OCRAM

# Versal Gen 1 (VMK180): OCM is 256KB at 0xFFFC0000 - 0xFFFFFFFF

# Versal Gen 2: OCM is 2MB at 0xFFE00000 - 0xFFFFFFFF

#WOLFBOOT_ORIGIN=0xFFFC0000

# Flash Sector Size (QSPI)

WOLFBOOT_SECTOR_SIZE=0x20000

# Application Partition Size (44MB)

WOLFBOOT_PARTITION_SIZE=0x2C00000

# Location in Flash for Primary Boot Partition

WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x800000

# Load Partition to RAM Address (Linux kernel loads here)

WOLFBOOT_LOAD_ADDRESS?=0x10000000

# Location in Flash for Secondary Partition (update image)

WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x3400000

# Location to store wolfBoot state/swap

WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x6000000

# DTS (Device Tree) - matches addresses from BOOT.BIN analysis

WOLFBOOT_LOAD_DTS_ADDRESS?=0x1000

# The aperture itself. Base and size are 512 GB aligned with no UL/ULL

# suffix, because the assembler consumes them when it builds the

# translation tables. VERSAL_NO_DDR_LOW drops the default low-DDR mapping

# for parts that have none.

CFLAGS_EXTRA+=-DVERSAL_DDR_HIGH_BASE=0x40000000000

CFLAGS_EXTRA+=-DVERSAL_DDR_HIGH_SIZE=0x10000000000

CFLAGS_EXTRA+=-DVERSAL_NO_DDR_LOW

# DDR layout inside the aperture. These use '=' so they override the '?='

# defaults above. Each region is distinct: the kernel and ramdisk

# destinations clear the FIT staging buffer at WOLFBOOT_LOAD_ADDRESS,

# because the sub-images are read out of it while they are being written,

# and a destination that overlaps the staging buffer or wolfBoot itself

# hangs partway through the copy.

#

# 0x400_0000_1000 DTB (WOLFBOOT_LOAD_DTS_ADDRESS)

# 0x400_0080_0000 wolfBoot (WOLFBOOT_ORIGIN)

# 0x400_0200_0000 kernel (WOLFBOOT_LOAD_KERNEL_ADDRESS)

# 0x400_1000_0000 FIT staging (WOLFBOOT_LOAD_ADDRESS)

# 0x400_3000_0000 ramdisk (WOLFBOOT_LOAD_RAMDISK_ADDRESS)

WOLFBOOT_ORIGIN=0x40000800000

WOLFBOOT_LOAD_DTS_ADDRESS=0x40000001000

WOLFBOOT_LOAD_KERNEL_ADDRESS=0x40002000000

WOLFBOOT_LOAD_ADDRESS=0x40010000000

WOLFBOOT_LOAD_RAMDISK_ADDRESS=0x40030000000

WOLFBOOT_DTS_BOOT_ADDRESS?=0x7B0000

WOLFBOOT_DTS_UPDATE_ADDRESS?=0x39B0000

# Speed up reads by using larger blocks

CFLAGS_EXTRA+=-DWOLFBOOT_SHA_BLOCK_SIZE=4096

# UART Configuration - UART0 for APU console

CFLAGS_EXTRA+=-DDEBUG_UART_NUM=0

# QSPI Reference Clock: Ref (300MHz default for Versal)

#CFLAGS_EXTRA+=-DGQSPI_CLK_REF=300000000

# QSPI Bus Divisor: (2 << div) = BUS (0=div2, 1=div4, 2=div8)

# MT25QU01G max: 133MHz Quad Read (0x6C) with 8 dummy cycles

# div=0: 300MHz/2 = 150MHz (above spec but tested working)

# div=1: 300MHz/4 = 75MHz (within spec, default)

# div=2: 300MHz/8 = 37.5MHz (conservative)

#CFLAGS_EXTRA+=-DGQSPI_CLK_DIV=1

# QSPI flash options (uncomment to enable)

#CFLAGS_EXTRA+=-DDEBUG_QSPI # Enable QSPI debug logging

#CFLAGS_EXTRA+=-DGQSPI_MODE_IO # Use polling instead of DMA (slower)

#CFLAGS_EXTRA+=-DTEST_EXT_FLASH # Run flash erase/write/read test

Some producers emit a FIT whose kernel node declares neither `load` nor `entry` - Yocto's `kernel-fitimage` class omits both unless `UBOOT_LOADADDRESS` and `UBOOT_ENTRYPOINT` are set - and leave it to U-Boot to place the image. wolfBoot needs a destination: a `compression = "gzip"` kernel has nowhere to decompress to, and an uncompressed one would be entered in place inside the staged FIT at whatever alignment the FIT happens to give it, which does not satisfy the arm64 boot protocol's 2 MB-aligned base.

Either add the properties to the ITS, or set `WOLFBOOT_LOAD_KERNEL_ADDRESS` in the config to the address the kernel should be staged at. A nonzero value overrides the FIT's `load`/`entry` for the kernel node and is returned as the entry point; 0 (the default) honors whatever the FIT declares. `WOLFBOOT_LOAD_RAMDISK_ADDRESS` does the same for the `ramdisk` node.

For a DDR aperture above 4 GB the ITS must use `#address-cells = <2>` and two-cell values, since a single cell cannot hold the address:

A kernel-only FIT - no `fdt` sub-image, and no `fdt` property on the configuration node - takes its device tree from the boot firmware instead, which is the arrangement U-Boot describes with `fdtcontroladdr`. Point `WOLFBOOT_LOAD_DTS_ADDRESS` at wherever the earlier stage left the blob; for a bootgen raw partition that is the `load` address in the BIF:

wolfBoot then relocates and validates that DTB exactly as it does for a non-FIT payload, and hands it to the kernel in `x0`.

Because such a DTB is outside the FIT, the wolfBoot signature does not cover it, so it is not treated as authenticated: `/chosen/bootargs` from the blob is **not** trusted and `LINUX_BOOTARGS` replaces it (see below). Bind a digest with `sign --dts` to have the DTB authenticated and its own bootargs honored, and set `WOLFBOOT_REQUIRE_SIGNED_DTB=1` to make a missing digest fatal rather than a warning.

void* fit_load_kernel(fdt_ctx* ctx, const char* kernel_node, int* lenp);

WOLFBOOT_LOAD_KERNEL_ADDRESS ?= 0

ifneq ($(WOLFBOOT_LOAD_KERNEL_ADDRESS),0)

CFLAGS+=-DWOLFBOOT_LOAD_KERNEL_ADDRESS=$(WOLFBOOT_LOAD_KERNEL_ADDRESS)

wolfBoot_printf("do_boot: entry=%p, EL=%d\n", (void*)app_offset,

current_el());

wolfBoot_printf("do_boot: dts=%p\n", (void*)dts_offset);

uint64_t addr64 = fdt_rd64u(val);

/* A two-cell value wider than the target's pointer must be

#if UINTPTR_MAX < UINT64_MAX

if (addr64 > (uint64_t)UINTPTR_MAX) {

return NULL;

}

return (void*)(uintptr_t)addr64;

#ifndef WOLFBOOT_LOAD_KERNEL_ADDRESS

#define WOLFBOOT_LOAD_KERNEL_ADDRESS 0

#ifndef WOLFBOOT_FIT_MAX_KERNEL

#define WOLFBOOT_FIT_MAX_KERNEL WOLFBOOT_FIT_MAX_DECOMP

void* fit_load_kernel(fdt_ctx* ctx, const char* kernel_node, int* lenp)

{

if (WOLFBOOT_LOAD_KERNEL_ADDRESS != 0) {

return fit_load_image_to(ctx, kernel_node,

(void*)WOLFBOOT_LOAD_KERNEL_ADDRESS,

(uint32_t)WOLFBOOT_FIT_MAX_KERNEL, lenp);

}

return fit_load_image(ctx, kernel_node, lenp);

}

"compressed bytes through as raw. Add `load` to the "

"FIT node; the kernel, ramdisk and fpga loaders can "

"take WOLFBOOT_LOAD_{KERNEL,RAMDISK,FPGA}_ADDRESS "

"instead\n",