wolfBoot boots signed Linux on the AMD Versal adaptive SoC, replacing U-Boot in the boot chain. Recent work adds support for DDR apertures above 1 TB, keeps a device tree’s own kernel command line intact, and boots gzip compressed kernels straight from a signed FIT image.
The Versal family combines dual Arm Cortex-A72 application processors, dual Cortex-R5F real time processors, and programmable logic on one device. The boot chain starts in the Platform Loader and Manager (PLM), which brings up the PS and DDR, then hands off through TF-A BL31 at EL3. wolfBoot takes over at EL2 as the last stage before Linux, verifying the OS image before it runs.
What wolfBoot brings to the platform:
- Signature verification with ECDSA (P-256, P-384, P-521), RSA (2048, 3072, 4096), Ed25519, Ed448, and the post quantum ML-DSA, LMS and XMSS algorithms, over SHA-256, SHA-384 or SHA3. The Versal examples ship with ECDSA P-384 and SHA-384.
- Boot media: QSPI NOR flash through the Versal GQSPI controller with DMA, plus SD card and eMMC through the Arasan SDHCI controller.
- Partition tables: MBR and GPT. Filesystems: read only FAT32 and ext4, so a signed image can be read from a file rather than a raw offset.
- FIT images with a gzip compressed kernel, an initramfs ramdisk, and a device tree, all covered by one signature over the whole image.
- A/B partitions with rollback protection, so a failed update falls back to the last known good image.
Three recent changes:
- DDR above 1 TB. Designs that place their DDR aperture high in the address map (for example at 0x400_0000_0000) can now map it in the translation table and run wolfBoot and the payload entirely inside that window.
- Device tree bootargs are preserved. An image’s device tree usually carries the kernel command line it was validated with, including the console settings. wolfBoot now keeps those arguments unless the build explicitly sets its own, and it never honors the command line of a device tree that has not been authenticated.
- Faster, smaller boot images. A gzip compressed kernel inside the FIT is decompressed at boot, which is roughly half the flash footprint of an uncompressed one.
Check out the pull request #879, #895, and #904.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now