10 Commits (master)

Author	SHA1	Message	Date
Daniele Lacamera	376f9e124f	F-12920: zero firmware-DTB initrd pointers in hal_get_boot_dts ... The CM4 firmware DTB is unverified (unsigned FAT partition) and this path never attaches an authenticated ramdisk, so a non-zero linux,initrd-start/end in it would direct the signed kernel to an unauthenticated initramfs in RAM. Zero both properties on the relocated DTB (fail closed on fixup error) and update the SECURITY comment to state the new behavior.	2026-09-07 15:49:31 +02:00
David Garske	95227f823c	fdt: rewrite device tree parser with capacity bound and full validation	2026-09-02 10:48:52 +02:00
David Garske	8015a1fa4f	Peer review fixes (thanks Daniele)	2026-08-24 12:47:34 +02:00
David Garske	8ec8443345	Fixes from skoll review findings	2026-08-24 12:47:34 +02:00
David Garske	88984858d5	Peer review fixes (thanks Jack)	2026-08-24 12:47:34 +02:00
David Garske	67c819bc0b	cm4: add RAUC A/B slot selection via U-Boot env (wolfBoot replaces U-Boot)	2026-08-24 12:47:34 +02:00
David Garske	56651bde95	cm4: add Linux kernel FIT boot via firmware-provided DTB with injected bootargs	2026-08-24 12:47:34 +02:00
David Garske	9a4f800546	cm4: hardware-validate eMMC A/B disk boot and FIPS on CM4 (arm64 header, 0x200000 load, mini-UART console)	2026-08-24 12:47:34 +02:00
David Garske	71b855f7b5	cm4: add wolfCrypt FIPS 140-3 support + CI, SDHCI unit test, review fixes	2026-08-24 12:47:34 +02:00
David Garske	eb7ad83ca0	cm4: add Raspberry Pi Compute Module 4 (BCM2711 Cortex-A72) target with authenticated boot	2026-08-24 12:47:34 +02:00