image: Add IH_OS_EFI for EFI chain-load boot

Add a new OS type to be used for chain-loading an EFI compatible
firmware or boot loader like GRUB2, possibly in a verified boot
scenario.

Bellow is sample ITS file that generates a FIT image supporting
secure boot. Please note the presence of 'os = "efi";' line, which
identifies the currently introduced OS type:

/ {
    #address-cells = <1>;

    images {
        efi-grub {
            description = "GRUB EFI";
            data = /incbin/("bootarm.efi");
            type = "kernel_noload";
            arch = "arm";
            os = "efi";
            compression = "none";
            load = <0x0>;
            entry = <0x0>;
            hash-1 {
                algo = "sha256";
            };
        };
    };

    configurations {
        default = "config-grub";
        config-grub {
            kernel = "efi-grub";
            signature-1 {
                algo = "sha256,rsa2048";
                sign-images = "kernel";
            };
        };
    };
};

Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@gmail.com>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>

diff --git a/common/image-fit.c b/common/image-fit.c
index c52f94512088dada17fd95bc4c47bfe9ec5c5d81..231612ff5f01a85c8b2efdf4c9d47dace10eccc1 100644 (file)
--- a/common/image-fit.c
+++ b/common/image-fit.c
@@ -1926,7 +1926,8 @@ int fit_image_load(bootm_headers_t *images, ulong addr,
                image_type == IH_TYPE_FPGA ||
                fit_image_check_os(fit, noffset, IH_OS_LINUX) ||
                fit_image_check_os(fit, noffset, IH_OS_U_BOOT) ||
-               fit_image_check_os(fit, noffset, IH_OS_OPENRTOS);
+               fit_image_check_os(fit, noffset, IH_OS_OPENRTOS) ||
+               fit_image_check_os(fit, noffset, IH_OS_EFI);
 
        /*
         * If either of the checks fail, we should report an error, but

diff --git a/common/image.c b/common/image.c
index eb626dcac92b0ad5b0a9ed7672b7e670756463a9..75d5dd944ff0487bb0d712b1388c149343ac30fc 100644 (file)
--- a/common/image.c
+++ b/common/image.c
@@ -137,6 +137,7 @@ static const table_entry_t uimage_os[] = {
        {       IH_OS_OPENRTOS, "openrtos",     "OpenRTOS",             },
 #endif
        {       IH_OS_OPENSBI,  "opensbi",      "RISC-V OpenSBI",       },
+       {       IH_OS_EFI,      "efi",          "EFI Firmware" },
 
        {       -1,             "",             "",                     },
 };

diff --git a/include/image.h b/include/image.h
index f4d2aaf53e87c11096644893f4227cc1d64d42ce..4a280b78e748ebe49f4c74a4ab60b160ec8b37e2 100644 (file)
--- a/include/image.h
+++ b/include/image.h
@@ -157,6 +157,7 @@ enum {
        IH_OS_ARM_TRUSTED_FIRMWARE,     /* ARM Trusted Firmware */
        IH_OS_TEE,                      /* Trusted Execution Environment */
        IH_OS_OPENSBI,                  /* RISC-V OpenSBI */
+       IH_OS_EFI,                      /* EFI Firmware (e.g. GRUB2) */
 
        IH_OS_COUNT,
 };