u-boot.git/include/image.h, branch v2017.07

armv8: Support loading 32-bit OS which is not in the form of FIT

2017-06-10T00:34:56+00:00

As only FIT image is supported now, this patch is to support loading
32-bit uImage, dtb and rootfs separately.

Signed-off-by: Alison Wang 
Reviewed-by: Tom Rini

lib: move hash CONFIG options to Kconfig

2017-05-22T12:36:58+00:00

Commit 94e3c8c4fd7b ("crypto/fsl - Add progressive hashing support
using hardware acceleration.") created entries for CONFIG_SHA1,
CONFIG_SHA256, CONFIG_SHA_HW_ACCEL, and CONFIG_SHA_PROG_HW_ACCEL.
However, no defconfig has migrated to it.  Complete the move by first
adding additional logic to various Kconfig files to select this when
required and then use the moveconfig tool.  In many cases we can select
these because they are required to implement other drivers.  We also
correct how we include the various hashing algorithms in SPL.

This commit was generated as follows (after Kconfig additions):

[1] tools/moveconfig.py -y SHA1 SHA256 SHA_HW_ACCEL
[2] tools/moveconfig.py -y SHA_PROG_HW_ACCEL

Note:
We cannot move SHA_HW_ACCEL and SHA_PROG_HW_ACCEL simultaneously
because there is dependency between them.

Cc: Poonam Aggrwal 
Cc: Naveen Burmi 
Cc: Po Liu 
Cc: Shengzhou Liu 
Cc: Priyanka Jain 
Cc: Shaohui Xie 
Cc: Chunhe Lan 
Cc: Chander Kashyap 
Cc: Steve Rae 
Cc: Dirk Eibach 
Cc: Feng Li 
Cc: Alison Wang 
Cc: Sumit Garg 
Cc: Mingkai Hu 
Cc: York Sun 
Cc: Prabhakar Kushwaha 
Cc: Jaehoon Chung 
Cc: Akshay Saraswat 
Cc: Heiko Schocher 
Cc: Jagan Teki 
Signed-off-by: Tom Rini 
Reviewed-by: Simon Glass 
Signed-off-by: Tom Rini

FIT: Rename FIT_DISABLE_SHA256 to FIT_ENABLE_SHA256_SUPPORT

2017-05-22T11:29:55+00:00

We rename CONFIG_FIT_DISABLE_SHA256 to CONFIG_FIT_ENABLE_SHA256_SUPPORT which
is enabled by default and now a positive option.  Convert the handful of boards
that were disabling it before to save space.

Cc: Dirk Eibach 
Cc: Lukasz Dalek 
Signed-off-by: Tom Rini 
Reviewed-by: Simon Glass 
Reviewed-by: Simon Glass

image: Fixes build warning with CONFIG_FIT_IMAGE_POST_PROCESS

2017-04-09T01:35:04+00:00

The function 'board_fit_image_post_process' is defined only when the
config option CONFIG_FIT_IMAGE_POST_PROCESS is enabled. For secure
systems that do not use SPL but do use FIT kernel images, only
CONFIG_FIT_IMAGE_POST_PROCESS will be defined, which will result in an
implicit declaration of function 'board_fit_image_post_process' warning
while building u-boot. Fix this warning.

Signed-off-by: Madan Srinivas 
Signed-off-by: Andrew F. Davis 
Reviewed-by: Tom Rini 
Reviewed-by: Lokesh Vutla

Kconfig: define MD5 dependency for FIT support

2017-03-17T13:09:40+00:00

FIT images require MD5 support to verify image checksums. So far this
was expressed by defining a CPP symbol in image.h. Since MD5 is now a
first class Kconfig citizen, express that in Kconfig instead.

Signed-off-by: Andre Przywara 
Reviewed-by: Simon Glass

bootm: relocate ramdisk if CONFIG_SYS_BOOT_RAMDISK_HIGH set

2017-01-20T14:15:20+00:00

In 35fc84f, bootm was refactored so plain 'bootm' and
'bootm ' shared a common implementation.
The 'bootm ramdisk' command implementation is now part of the common
implementation but not invoke by plain 'bootm' since the original
implementation never did ramdisk relocation.  Instead, ramdisk
relocation happened in image_setup_linux() which is typically called
during the OS portion of 'bootm'.

On ARM, parameters to the Linux kernel can either be passed by FDT or
ATAGS. When using FDT, image_setup_linux() is called which also triggers
ramdisk relocation.  When using ATAGS, image_setup_linux() is _not_
called because it mostly does FDT setup.

Instead of calling image_setup_linux() in both FDT and ATAGS cases,
include BOOTM_STATE_RAMDISK in the requested states during a plain
'bootm' if CONFIG_SYS_BOOT_RAMDISK_HIGH is set and remove the ramdisk
relocation from image_setup_linux().  This causes ramdisk relocation to
happen on any system where CONFIG_SYS_BOOT_RAMDISK_HIGH regardless of
the OS being booted. Also remove IMAGE_ENABLE_RAMDISK_HIGH as it was
only used by the now-removed code from image_setup_linux().

Signed-off-by: Rick Altherr 
Reviewed-by: Simon Glass 
Reviewed-by: Joel Stanley

Merge branch 'master' of git://git.denx.de/u-boot-video

2017-01-17T01:23:14+00:00

mkimage: Add support for signing with pkcs11

2017-01-14T21:47:13+00:00

Add support for signing with the pkcs11 engine. This allows FIT images
to be signed with keys securely stored on a smartcard, hardware security
module, etc without exposing the keys.

Support for other engines can be added in the future by modifying
rsa_engine_get_pub_key() and rsa_engine_get_priv_key() to construct
correct key_id strings.

Signed-off-by: George McCollister

splash: add support for loading splash from a FIT image

2017-01-13T16:40:38+00:00

Enable support for loading a splash image from within a FIT image.
The image is assumed to be generated with mkimage -E flag to hold
the data external to the FIT.

Signed-off-by: Tomas Melin 
Acked-by: Igor Grinberg

tools: mkimage: add firmware-ivt image type for HAB verification

2017-01-02T16:06:57+00:00

When we want to use Secure Boot with HAB from SPL over U-Boot.img,
we need to append the IVT to the image and leave space for the CSF.
Images generated as firmware_ivt can directly be signed using the
Freescale code signing tool. For creation of a CSF, mkimage outputs
the correct HAB Blocks for the image.
The changes to the usual firmware image class are quite small,
that is why I implemented that directly into the default_image.

Cc: sbabic@denx.de

v2-Changes: None

Signed-off-by: Sven Ebenfeld 
Reviewed-by: George McCollister 
Tested-by: George McCollister