fit: gzip-compressed kernel + ramdisk (initramfs) support

Wires the new wolfBoot_gunzip inflater into the FIT image-loading path
and adds initramfs (ramdisk) extraction with DTB /chosen fixup so a
single signed FIT can carry kernel, DTB, and rootfs.

GZIP path
---------
* fit_load_image_ex(out_max) added; fit_load_image kept as a wrapper.
* When a subimage carries compression="gzip", inflate straight to the
  FIT-declared load address, then verify the FIT hash-1 subnode
  (sha256 / sha384 if available) for defense in depth on top of the
  outer wolfBoot signature. The compression property is now read
  unconditionally so a build without WOLFBOOT_GZIP can warn and fail
  closed instead of silently memcpy-ing compressed bytes as if they
  were raw.
* fit_verify_hash propagates wc_InitSha256 / wc_Sha256Update /
  wc_Sha256Final return codes (and the SHA-384 equivalents) - any
  non-zero return is treated as a verification failure so a misbehaving
  backend cannot silently degrade to a no-op.
* GZIP=1 is the new default in the FIT-using example configs (zynqmp,
  zynqmp_sdcard, polarfire_mpfs250, polarfire_mpfs250_qspi,
  versal_vmk180, versal_vmk180_sdcard); set GZIP=0 to opt out.

Ramdisk path
------------
* fit_find_images() gains a ramdisk out-arg and fdt_fixup_initrd()
  writes /chosen/linux,initrd-{start,end} as 64-bit big-endian cells.
* update_disk.c and update_ram.c load the FIT ramdisk node (under
  WOLFBOOT_FIT_RAMDISK) and patch the loaded DTB. Compressed (gzip)
  ramdisks reuse the same fit_load_image_ex() decompress path.
* RAMDISK=1 build switch defines WOLFBOOT_FIT_RAMDISK;
  WOLFBOOT_LOAD_RAMDISK_ADDRESS is plumbed through tools/config.mk ->
  Makefile sed -> include/target.h.in. Defaults to 0; when 0 the
  ramdisk stays at whatever fit_load_image returned.
* hal/zynq.c and hal/versal.c bump fdt_totalsize headroom from 512 to
  768 bytes to fit the new linux,initrd-{start,end} entries.
* config/examples/zynqmp_sdcard.config gains a commented-out opt-in
  block (RAMDISK=1, WOLFBOOT_LOAD_RAMDISK_ADDRESS=0x40000000, alt
  LINUX_BOOTARGS) so a single config file covers both rootfs-on-disk
  and FIT-bundled-initramfs flows.

Builds against the existing master configs are byte-identical when
GZIP=0 and RAMDISK is unset.

Author: dgarske

Makefile

@@ -638,6 +638,7 @@ include/target.h: $(TARGET_H_TEMPLATE) FORCE
 	sed -e "s/@WOLFBOOT_DTS_UPDATE_ADDRESS@/$(WOLFBOOT_DTS_UPDATE_ADDRESS)/g" | \
 	sed -e "s/@WOLFBOOT_LOAD_ADDRESS@/$(WOLFBOOT_LOAD_ADDRESS)/g" | \
 	sed -e "s/@WOLFBOOT_LOAD_DTS_ADDRESS@/$(WOLFBOOT_LOAD_DTS_ADDRESS)/g" | \
+	sed -e "s/@WOLFBOOT_LOAD_RAMDISK_ADDRESS@/$(WOLFBOOT_LOAD_RAMDISK_ADDRESS)/g" | \
 	sed -e "s|@WOLFBOOT_RAMBOOT_MAX_SIZE_DEFINE@|$(if $(strip $(WOLFBOOT_RAMBOOT_MAX_SIZE)),#define WOLFBOOT_RAMBOOT_MAX_SIZE             $(WOLFBOOT_RAMBOOT_MAX_SIZE),/* WOLFBOOT_RAMBOOT_MAX_SIZE undefined */)|g" | \
 	sed -e "s/@WOLFBOOT_PARTITION_SELF_HEADER_ADDRESS@/$(WOLFBOOT_PARTITION_SELF_HEADER_ADDRESS)/g" \
 		> $@

config/examples/polarfire_mpfs250.config

@@ -46,6 +46,9 @@ WOLFTPM?=0
 ELF?=1
 #DEBUG_ELF?=1
 
+# Native gzip decompression for FIT subimages (set GZIP=0 to disable)
+GZIP?=1
+
 # Use RISC-V assembly version of ECDSA and SHA
 NO_ASM?=0
 

config/examples/polarfire_mpfs250_qspi.config

@@ -35,6 +35,9 @@ WOLFTPM?=0
 ELF?=1
 #DEBUG_ELF?=1
 
+# Native gzip decompression for FIT subimages (set GZIP=0 to disable)
+GZIP?=1
+
 # Use RISC-V assembly version of ECDSA and SHA
 NO_ASM?=0
 

config/examples/versal_vmk180.config

@@ -59,6 +59,9 @@ NO_XIP=1
 # ELF loading support
 ELF?=1
 
+# Native gzip decompression for FIT subimages (set GZIP=0 to disable)
+GZIP?=1
+
 # Toolchain
 USE_GCC=1
 CROSS_COMPILE=aarch64-none-elf-

config/examples/versal_vmk180_sdcard.config

@@ -33,6 +33,9 @@ NO_XIP=1
 # ELF loading support
 ELF?=1
 
+# Native gzip decompression for FIT subimages (set GZIP=0 to disable)
+GZIP?=1
+
 # Boot Benchmarking (optional)
 BOOT_BENCHMARK?=1
 

config/examples/zynqmp.config

@@ -58,6 +58,9 @@ USE_GCC=1
 ELF?=1
 #DEBUG_ELF?=1
 
+# Native gzip decompression for FIT subimages (set GZIP=0 to disable)
+GZIP?=1
+
 # Flash Sector Size
 WOLFBOOT_SECTOR_SIZE=0x20000
 # Application Partition Size

config/examples/zynqmp_sdcard.config

@@ -43,6 +43,9 @@ NO_XIP=1
 ELF?=1
 #DEBUG_ELF?=1
 
+# Native gzip decompression for FIT subimages (set GZIP=0 to disable)
+GZIP?=1
+
 # Boot Exception Level: leave wolfBoot at EL2 for handoff to Linux (matches
 # the standard PetaLinux U-Boot flow and preserves KVM/hypervisor use of
 # EL2). The EL2 Linux-cleanup path in do_boot() will clean dcache/disable
@@ -100,6 +103,21 @@ CFLAGS_EXTRA+=-DDISK_BLOCK_SIZE=0x80000
 # Check `ls /sys/class/mmc_host/` on your running target to confirm.
 CFLAGS_EXTRA+=-DLINUX_BOOTARGS_ROOT=\"/dev/mmcblk0p4\"
 
+# ============================================================================
+# Optional: FIT-bundled initramfs (ramdisk) instead of an on-disk rootfs
+# ============================================================================
+# Expects the PetaLinux INITRAMFS_IMAGE_BUNDLE=0 layout (FIT contains kernel
+# + DTB + ramdisk). wolfBoot extracts the ramdisk to
+# WOLFBOOT_LOAD_RAMDISK_ADDRESS and patches the loaded DTB with
+# /chosen/linux,initrd-{start,end} so the kernel can find it. Compressed
+# (gzip) ramdisks decompress automatically when GZIP=1.
+#
+# To enable: uncomment the three lines below and comment out the
+# LINUX_BOOTARGS_ROOT line above (root= is supplied by the cpio's /init).
+#RAMDISK?=1
+#WOLFBOOT_LOAD_RAMDISK_ADDRESS?=0x40000000
+#CFLAGS_EXTRA+=-DLINUX_BOOTARGS='"earlycon console=ttyPS0,115200 init_fatal_sh=1"'
+
 # ============================================================================
 # Boot Memory Layout
 # ============================================================================

hal/versal.c

@@ -1276,8 +1276,9 @@ int hal_dts_fixup(void* dts_addr)
     wolfBoot_printf("FDT: Version %d, Size %d\n",
         fdt_version(fdt), fdt_totalsize(fdt));
 
-    /* Expand total size to allow adding/modifying properties */
-    fdt_set_totalsize(fdt, fdt_totalsize(fdt) + 512);
+    /* Expand total size to allow adding/modifying properties (bootargs and,
+     * when WOLFBOOT_FIT_RAMDISK is in play, linux,initrd-{start,end}). */
+    fdt_set_totalsize(fdt, fdt_totalsize(fdt) + 768);
 
     /* Find /chosen node; create it only if genuinely missing. Any other
      * negative return (malformed FDT, etc.) is surfaced directly rather

hal/zynq.c

@@ -1927,11 +1927,12 @@ int hal_dts_fixup(void* dts_addr)
         fdt_version(fdt), fdt_totalsize(fdt));
 
     /* Expand totalsize so fdt_setprop() has in-blob free space to place
-     * a new/larger bootargs property. Physical headroom is already
-     * guaranteed by the load-address layout (DTB at WOLFBOOT_LOAD_DTS_ADDRESS,
-     * kernel loaded much higher), so growing the header is safe. Matches
-     * the pattern used in hal/versal.c:hal_dts_fixup. */
-    fdt_set_totalsize(fdt, fdt_totalsize(fdt) + 512);
+     * a new/larger bootargs property and (when WOLFBOOT_FIT_RAMDISK is in
+     * play) the linux,initrd-{start,end} properties. Physical headroom is
+     * already guaranteed by the load-address layout (DTB at
+     * WOLFBOOT_LOAD_DTS_ADDRESS, kernel loaded much higher), so growing
+     * the header is safe. Matches the pattern in hal/versal.c. */
+    fdt_set_totalsize(fdt, fdt_totalsize(fdt) + 768);
 
     /* Find /chosen node; create it only if genuinely missing. Any other
      * negative return (malformed FDT, etc.) is surfaced directly rather

include/fdt.h

@@ -158,8 +158,15 @@ int fdt_fixup_val64(void* fdt, int off, const char* node, const char* name, uint
 int fdt_shrink(void* fdt);
 
 /* FIT */
-const char* fit_find_images(void* fdt, const char** pkernel, const char** pflat_dt);
+const char* fit_find_images(void* fdt, const char** pkernel, const char** pflat_dt,
+    const char** pramdisk);
 void* fit_load_image(void* fdt, const char* image, int* lenp);
+void* fit_load_image_ex(void* fdt, const char* image, int* lenp, uint32_t out_max);
+
+/* FDT initrd fixup: writes /chosen/linux,initrd-{start,end} as 64-bit
+ * big-endian properties. Creates /chosen if missing. Returns 0 on success
+ * or a negative FDT_ERR_*. */
+int fdt_fixup_initrd(void* fdt, uint64_t start, uint64_t size);
 
 #ifdef __cplusplus
 }