Add optional read-only FAT32 and ext4 support to the disk loader

.github/workflows/test-configs.yml

@@ -348,6 +348,12 @@ jobs:
     with:
       arch: riscv64
       config-file: ./config/examples/polarfire_mpfs250.config
+  microchip_mpfs250_fs_test:
+    uses: ./.github/workflows/test-build-riscv.yml
+    with:
+      arch: riscv64
+      config-file: ./config/examples/polarfire_mpfs250.config
+      make-args: DISK_FS=both
   microchip_mpfs250_qspi_test:
     uses: ./.github/workflows/test-build-riscv.yml
     with:
@@ -473,6 +479,13 @@ jobs:
       config-file: ./config/examples/sim-fips.config
       fips: true
 
+  tegra234_sdcard_fs_test:
+    uses: ./.github/workflows/test-build.yml
+    with:
+      arch: aarch64
+      config-file: ./config/examples/tegra234-sdcard.config
+      make-args: DISK_FS=both wolfboot.bin test-app/image_v1_signed.bin CROSS_COMPILE=aarch64-linux-gnu-
+
   sim_tfm_smallstack_test:
     uses: ./.github/workflows/test-build.yml
     with:
@@ -872,6 +885,29 @@ jobs:
       arch: aarch64
       config-file: ./config/examples/zynqmp_sdcard.config
 
+  # Builds that compile the read-only filesystem layer (src/disk_fs.c,
+  # src/fat32.c, src/ext4.c) and the DISK_FS branches of src/update_disk.c.
+  zynqmp_sdcard_fs_test:
+    uses: ./.github/workflows/test-build-aarch64.yml
+    with:
+      arch: aarch64
+      config-file: ./config/examples/zynqmp_sdcard.config
+      make-args: DISK_FS=both
+
+  zynqmp_sdcard_fs_fat32_test:
+    uses: ./.github/workflows/test-build-aarch64.yml
+    with:
+      arch: aarch64
+      config-file: ./config/examples/zynqmp_sdcard.config
+      make-args: DISK_FS=fat32
+
+  zynqmp_sdcard_fs_ext4_test:
+    uses: ./.github/workflows/test-build-aarch64.yml
+    with:
+      arch: aarch64
+      config-file: ./config/examples/zynqmp_sdcard.config
+      make-args: DISK_FS=ext4
+
   # Only build that compiles the DISK_ENCRYPT paths of src/update_disk.c.
   zynqmp_sdcard_encrypt_test:
     uses: ./.github/workflows/test-build-aarch64.yml
@@ -947,12 +983,32 @@ jobs:
       arch: arm
       config-file: ./config/examples/zynq7000_sdcard.config
 
+  zynq7000_sdcard_fs_test:
+    uses: ./.github/workflows/test-build.yml
+    with:
+      arch: arm
+      config-file: ./config/examples/zynq7000_sdcard.config
+      make-args: DISK_FS=both
+
   versal_vmk180_test:
     uses: ./.github/workflows/test-build-aarch64.yml
     with:
       arch: aarch64
       config-file: ./config/examples/versal_vmk180.config
 
+  versal_vmk180_sdcard_test:
+    uses: ./.github/workflows/test-build-aarch64.yml
+    with:
+      arch: aarch64
+      config-file: ./config/examples/versal_vmk180_sdcard.config
+
+  versal_vmk180_sdcard_fs_test:
+    uses: ./.github/workflows/test-build-aarch64.yml
+    with:
+      arch: aarch64
+      config-file: ./config/examples/versal_vmk180_sdcard.config
+      make-args: DISK_FS=both
+
   sim_wolfhsm_test:
     uses: ./.github/workflows/test-build.yml
     with:

.github/workflows/test-endian.yml

@@ -0,0 +1,55 @@
+name: Big-endian disk/filesystem test
+
+# Everything on a disk is little-endian: the MBR table, the GPT header and
+# entries, and every FAT32 and ext4 field. wolfBoot reads all of it byte-wise
+# so the stack is endian-neutral, but nothing in a little-endian CI run proves
+# that. This job builds the real parsers as big-endian PowerPC and reads real
+# mkfs-created volumes under qemu-user, which catches any future change that
+# reintroduces a native multi-byte read of on-disk data.
+
+on:
+  pull_request:
+    branches: [ '*' ]
+
+jobs:
+  bigendian_fs_test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: install req
+        run: |
+          export DEBIAN_FRONTEND=noninteractive
+          sudo apt-get update -o Acquire::Retries=3
+          sudo apt-get install --no-install-recommends -y -q \
+            -o Acquire::Retries=3 \
+            gcc-powerpc-linux-gnu libc6-dev-powerpc-cross qemu-user-static \
+            dosfstools mtools e2fsprogs
+
+      # Fixture generation takes minutes, so prove the cross toolchain works
+      # first. A missing libc6-dev-powerpc-cross shows up here in seconds,
+      # clearly labelled, instead of as failing filesystem cases later.
+      - name: verify big-endian toolchain
+        run: |
+          printf 'int main(void){return 0;}' > /tmp/be_probe.c
+          powerpc-linux-gnu-gcc -static -o /tmp/be_probe /tmp/be_probe.c
+          file /tmp/be_probe | grep -q 'MSB' \
+            || { echo "cross-compiler did not produce a big-endian binary"; exit 1; }
+          qemu-ppc-static /tmp/be_probe \
+            || { echo "qemu-ppc-static cannot run a big-endian binary"; exit 1; }
+          echo "big-endian toolchain OK"
+
+      - name: generate filesystem fixtures
+        run: |
+          cd tools/fs-test
+          QUICK=1 ./mkfixtures.sh
+
+      - name: little-endian and big-endian read-back
+        run: |
+          cd tools/fs-test
+          make
+          ./runtests.sh

.github/workflows/test-x86-fsp-qemu.yml

@@ -53,3 +53,27 @@ jobs:
       - name: run test
         run: |
           ./tools/scripts/x86_fsp/qemu/test_qemu.sh
+
+  # Same target, but wolfBoot reads its image from a file on a read-only
+  # filesystem instead of from raw offset 0 of a partition. The job above
+  # is left untouched, so it stays the regression check for the raw path.
+  fsp_qemu_fs_test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - name: install req
+        run: |
+          export DEBIAN_FRONTEND=noninteractive
+          sudo apt-get update -o Acquire::Retries=3
+          sudo apt-get install --no-install-recommends -y -q -o Acquire::Retries=3 nasm gcc-multilib qemu-system-x86 uuid-dev dosfstools mtools e2fsprogs
+      - name: setup git
+        run: |
+          git config --global user.email "you@example.com"
+          git config --global user.name "Your Name"
+      - name: run test
+        run: |
+          ./tools/scripts/x86_fsp/qemu/test_qemu.sh -f

.gitignore

@@ -144,6 +144,21 @@ tools/unit-tests/unit-aes256
 tools/unit-tests/unit-chacha20
 tools/unit-tests/unit-delta
 tools/unit-tests/unit-disk
+tools/unit-tests/unit-fs-probe
+tools/unit-tests/unit-fat32
+tools/unit-tests/unit-fs-malicious
+tools/unit-tests/unit-ext4
+tools/unit-tests/unit-update-disk-fs
+tools/unit-tests/unit-update-disk-fs-enc
+tools/unit-tests/ext4-min.img
+tools/unit-tests/ext4-stock.img
+tools/unit-tests/ext4-payload.bin
+tools/unit-tests/ext4-nested.bin
+tools/unit-tests/ext4-fixtures.stamp
+tools/unit-tests/fat32-test.img
+tools/unit-tests/fat32-payload.bin
+tools/unit-tests/fat32-nested.bin
+tools/unit-tests/fat32-short.bin
 tools/unit-tests/unit-enc-nvm
 tools/unit-tests/unit-enc-nvm-flagshome
 tools/unit-tests/unit-extflash
@@ -526,3 +541,13 @@ tools/scripts/cm4/rauc/
 
 # TI cl2000 (ARCH=C2000) intermediate assembly listings left in the repo root
 /*.asm
+
+# fs-test host harness: built binaries and generated filesystem images.
+# The fixtures are multi-GiB (sparse) and are regenerated by mkfixtures.sh.
+tools/fs-test/fs-test
+tools/fs-test/fs-test-be
+tools/fs-test/fixtures/
+
+# x86 FSP QEMU filesystem test images (make_hd.sh FS=1)
+fs_a.img
+fs_b.img

Makefile

@@ -229,6 +229,11 @@ ifeq ($(WOLFHAL),1)
   include hal/boards/$(BOARD)/board.mk
 endif
 
+# Set only here, so that host-tool sub-makes which also include options.mk
+# (tools/bin-assemble, tools/bin2hex) skip the checks that only make sense
+# once arch.mk has run. Deliberately not exported.
+WOLFBOOT_TARGET_BUILD=1
+
 # Parse config options
 include options.mk
 

config/examples/polarfire_mpfs250.config

@@ -68,6 +68,34 @@ WOLFBOOT_NO_PARTITIONS=1
 WOLFBOOT_RAMBOOT_MAX_SIZE=0x80000000
 CFLAGS_EXTRA+=-DBOOT_PART_A=1
 CFLAGS_EXTRA+=-DBOOT_PART_B=2
+
+# ============================================================================
+# Optional: read the signed image from a file on a read-only filesystem
+# ============================================================================
+# By default wolfBoot reads the image from raw offset 0 of the partition, so
+# the image has to be written there with dd. With DISK_FS set, the partition
+# is probed for a FAT32 or ext4 filesystem and, if one is found, the image is
+# read from the file named below instead. A partition holding no supported
+# filesystem is read raw exactly as before, so leaving this commented out
+# changes nothing.
+#
+# FAT32 (with long filenames) and ext4 (extent-mapped files) only. Symlinks,
+# uninitialized extents, inline data, encryption and 4Kn sectors are refused
+# with a clear error rather than misread. Sparse files read correctly (a hole
+# reads as zeros). See docs/compile.md.
+#DISK_FS=both
+#CFLAGS_EXTRA+=-DBOOT_FILE_A='"/boot/fitImage_A.itb"'
+#CFLAGS_EXTRA+=-DBOOT_FILE_B='"/boot/fitImage_B.itb"'
+# Select the partitions by name instead of by index. The GPT partition label
+# is matched first, then the filesystem volume label (which is what makes
+# this work on MBR disks, where partitions have no names).
+#CFLAGS_EXTRA+=-DBOOT_LABEL_A='"boot_a"'
+#CFLAGS_EXTRA+=-DBOOT_LABEL_B='"boot_b"'
+# Filesystem metadata cache, in bytes. Must be a multiple of 512; 512 is the
+# minimum and the default. Raising it reduces metadata reads when walking a
+# heavily fragmented file.
+#WOLFBOOT_FS_CACHE_SIZE=512
+#CFLAGS_EXTRA+=-DDEBUG_FS
 # Speed up disk partition read (512KB chunks - max DMA size)
 CFLAGS_EXTRA+=-DDISK_BLOCK_SIZE=0x80000
 

config/examples/tegra234-sdcard.config

@@ -31,6 +31,34 @@ WOLFBOOT_PARTITION_SIZE?=0x100000
 # Boot from the external microSD (SDMMC1) via the generic SDHCI driver.
 DISK_SDCARD=1
 
+# ============================================================================
+# Optional: read the signed image from a file on a read-only filesystem
+# ============================================================================
+# By default wolfBoot reads the image from raw offset 0 of the partition, so
+# the image has to be written there with dd. With DISK_FS set, the partition
+# is probed for a FAT32 or ext4 filesystem and, if one is found, the image is
+# read from the file named below instead. A partition holding no supported
+# filesystem is read raw exactly as before, so leaving this commented out
+# changes nothing.
+#
+# FAT32 (with long filenames) and ext4 (extent-mapped files) only. Symlinks,
+# uninitialized extents, inline data, encryption and 4Kn sectors are refused
+# with a clear error rather than misread. Sparse files read correctly (a hole
+# reads as zeros). See docs/compile.md.
+#DISK_FS=both
+#CFLAGS_EXTRA+=-DBOOT_FILE_A='"/boot/fitImage_A.itb"'
+#CFLAGS_EXTRA+=-DBOOT_FILE_B='"/boot/fitImage_B.itb"'
+# Select the partitions by name instead of by index. The GPT partition label
+# is matched first, then the filesystem volume label (which is what makes
+# this work on MBR disks, where partitions have no names).
+#CFLAGS_EXTRA+=-DBOOT_LABEL_A='"boot_a"'
+#CFLAGS_EXTRA+=-DBOOT_LABEL_B='"boot_b"'
+# Filesystem metadata cache, in bytes. Must be a multiple of 512; 512 is the
+# minimum and the default. Raising it reduces metadata reads when walking a
+# heavily fragmented file.
+#WOLFBOOT_FS_CACHE_SIZE=512
+#CFLAGS_EXTRA+=-DDEBUG_FS
+
 # Upper bound on the image copied into RAM before verification. Keep
 # LOAD_DTS_ADDRESS above LOAD_ADDRESS + RAMBOOT_MAX_SIZE so the DTB relocation
 # cannot land inside the loaded image.

config/examples/versal_vmk180_sdcard.config

@@ -69,10 +69,46 @@ CROSS_COMPILE=aarch64-none-elf-
 # These are 0-based indices into the parsed partition array:
 #   part[0]=boot, part[1]=OFP_A, part[2]=OFP_B, part[3]=rootfs
 WOLFBOOT_NO_PARTITIONS=1
-WOLFBOOT_RAMBOOT_MAX_SIZE=0x80000000
+
+# Cap on the RAM load region. The disk image payload is copied to
+# WOLFBOOT_LOAD_ADDRESS (0x10000000, set below) before its header is
+# authenticated, so the on-disk fw_size must be bounded first (see
+# src/update_disk.c). The VMK180's DDR-low aperture ends at 0x80000000, so
+# the bound is top_of_DDR_low - WOLFBOOT_LOAD_ADDRESS. The previous
+# 0x80000000 let a claimed size reach 0x90000000, past the end of the
+# aperture. Tighten further to suit the largest FIT you actually deploy.
+WOLFBOOT_RAMBOOT_MAX_SIZE=0x70000000
 CFLAGS_EXTRA+=-DBOOT_PART_A=1
 CFLAGS_EXTRA+=-DBOOT_PART_B=2
 
+# ============================================================================
+# Optional: read the signed image from a file on a read-only filesystem
+# ============================================================================
+# By default wolfBoot reads the image from raw offset 0 of the partition, so
+# the image has to be written there with dd. With DISK_FS set, the partition
+# is probed for a FAT32 or ext4 filesystem and, if one is found, the image is
+# read from the file named below instead. A partition holding no supported
+# filesystem is read raw exactly as before, so leaving this commented out
+# changes nothing.
+#
+# FAT32 (with long filenames) and ext4 (extent-mapped files) only. Symlinks,
+# uninitialized extents, inline data, encryption and 4Kn sectors are refused
+# with a clear error rather than misread. Sparse files read correctly (a hole
+# reads as zeros). See docs/compile.md.
+#DISK_FS=both
+#CFLAGS_EXTRA+=-DBOOT_FILE_A='"/boot/fitImage_A.itb"'
+#CFLAGS_EXTRA+=-DBOOT_FILE_B='"/boot/fitImage_B.itb"'
+# Select the partitions by name instead of by index. The GPT partition label
+# is matched first, then the filesystem volume label (which is what makes
+# this work on MBR disks, where partitions have no names).
+#CFLAGS_EXTRA+=-DBOOT_LABEL_A='"boot_a"'
+#CFLAGS_EXTRA+=-DBOOT_LABEL_B='"boot_b"'
+# Filesystem metadata cache, in bytes. Must be a multiple of 512; 512 is the
+# minimum and the default. Raising it reduces metadata reads when walking a
+# heavily fragmented file.
+#WOLFBOOT_FS_CACHE_SIZE=512
+#CFLAGS_EXTRA+=-DDEBUG_FS
+
 # Disk read chunk size (512KB)
 CFLAGS_EXTRA+=-DDISK_BLOCK_SIZE=0x80000
 

config/examples/x86_fsp_qemu_fs.config

@@ -0,0 +1,57 @@
+ARCH=x86_64
+TARGET=x86_fsp_qemu
+WOLFBOOT_SMALL_STACK=1
+SIGN=ECC256
+HASH=SHA256
+DEBUG=1
+SPMATH=1
+FORCE_32BIT=1
+ENCRYPTION=0
+WOLFBOOT_NO_PARTITIONS=1
+WOLFTPM=0
+
+# TPM Keystore options
+#WOLFBOOT_TPM_KEYSTORE?=1
+#WOLFBOOT_TPM_KEYSTORE_NV_BASE?=0x01800200
+#WOLFBOOT_TPM_POLICY_NV_INDEX?=0x01800201
+
+# 4gb - 8mb
+WOLFBOOT_LOAD_BASE=0x2000000
+WOLFBOOT_LOAD_ADDRESS=0x1000000
+
+# required for keytools
+WOLFBOOT_SECTOR_SIZE?=0x1000
+WOLFBOOT_DATA_ADDRESS=0x1000000
+
+FSP_M_BASE=0xffe30000
+FSP_S_BASE=0xffed6000
+FSP_T_BASE=0xfffe0000
+FSP_S_LOAD_BASE=0x0FED5F00
+WOLFBOOT_ORIGIN=0xfff80000
+
+BOOTLOADER_PARTITION_SIZE=0xe0000
+BIOS_REGION_SIZE=0x800000
+MACHINE_OBJ=src/x86/qemu_fsp.o
+FSP_T_BIN=./src/x86/fsp_t.bin
+FSP_M_BIN=./src/x86/fsp_m.bin
+FSP_S_BIN=./src/x86/fsp_s.bin
+STAGE1_AUTH=1
+64BIT=1
+ELF=1
+MULTIBOOT2=1
+
+# ============================================================================
+# Read-only filesystem boot
+# ============================================================================
+# Same target as x86_fsp_qemu.config, but the signed image is read from a
+# file on a filesystem instead of from raw offset 0 of a partition.
+#
+# tools/scripts/x86_fsp/qemu/make_hd.sh FS=1 builds a matching disk: the
+# raw OFP_A / OFP_B partitions stay where they are, and two more are added
+# holding a FAT32 volume (slot A, version 1) and an ext4 volume (slot B,
+# version 2). Partition indices are 0-based, so those are 2 and 3.
+DISK_FS=both
+CFLAGS_EXTRA+=-DBOOT_PART_A=2
+CFLAGS_EXTRA+=-DBOOT_PART_B=3
+CFLAGS_EXTRA+=-DBOOT_FILE_A='"/boot/os.itb"'
+CFLAGS_EXTRA+=-DBOOT_FILE_B='"/boot/os.itb"'