u-boot.git/tools/Makefile, branch v2022.04-rc2

tools: mkeficapsule: allow for specifying GUID explicitly

2022-02-11T19:07:55Z

The existing options, "--fit" and "--raw," are only used to put a proper GUID in a capsule header, where GUID identifies a particular FMP (Firmware Management Protocol) driver which then would handle the firmware binary in a capsule. In fact, mkeficapsule does the exact same job in creating a capsule file whatever the firmware binary type is. To prepare for the future extension, the command syntax will be a bit modified to allow users to specify arbitrary GUID for their own FMP driver. OLD: [--fit | --raw ] NEW: [--fit | --raw | --guid ] Signed-off-by: AKASHI Takahiro Reviewed-by: Simon Glass

tools: mkeficapsule: add firmware image signing

2022-02-11T19:07:55Z

With this enhancement, mkeficapsule will be able to sign a capsule file when it is created. A signature added will be used later in the verification at FMP's SetImage() call. To do that, we need specify additional command parameters: -monotonic-cout : monotonic count -private-key : private key file -certificate : certificate file Only when all of those parameters are given, a signature will be added to a capsule file. Users are expected to maintain and increment the monotonic count at every time of the update for each firmware image. Signed-off-by: AKASHI Takahiro Reviewed-by: Simon Glass Acked-by: Ilias Apalodimas

tools: build mkeficapsule with tools-only_defconfig

2022-02-11T19:07:55Z

Add CONFIG_TOOLS_MKEFICAPSULE. Then we want to always build mkeficapsule if tools-only_defconfig is used. Signed-off-by: AKASHI Takahiro Reviewed-by: Simon Glass

Create a new boot/ directory

2021-11-12T00:01:56Z

Quite a lot of the code in common/relates to booting and images. Before adding more it seems like a good time to move the code into its own directory. Most files with 'boot' or 'image' in them are moved, except: - autoboot.c which relates to U-Boot automatically running a script - bootstage.c which relates to U-Boot timing Drop the removal of boot* files from the output directory, since this interfers with the symlinks created by tools and there does not appear to be any such file from my brief testing. Signed-off-by: Simon Glass Reviewed-by: Artem Lapkin Tested-by: Artem Lapkin

tools: Stop re-defining -std= when building tools

2021-10-19T15:25:25Z

While we intentionally set -std=gnu11 for building host tools, and have for quite some time, we never dropped -std=gnu99 from tools/Makefile. This resulted in passing -std=gnu11 ... -std=gnu99 when building, and gnu99 would win. This in turn would result now in warnings such as: tools/mkeficapsule.c:25:15: warning: redefinition of typedef 'u32' is a C11 feature [-Wtypedef-redefinition] typedef __u32 u32; ^ Signed-off-by: Tom Rini

image: Split host code out into its own file

2021-10-08T19:53:26Z

To avoid having #ifdefs in a few functions which are completely different in the board and host code, create a new image-host.c file. Signed-off-by: Simon Glass

tools: kwbimage: Remove v1 kwbimage SPL padding to CONFIG_SYS_U_BOOT_OFFS bytes

2021-07-31T07:59:58Z

This padding depends on board config file and therefore it makes the mkimage binary tool board specific, which is not correct. One cannot use mkimage tool built as a result for board A to generate images for board B, even if both A and B are on the same platform. This CONFIG_SYS_U_BOOT_OFFS padding was needed when kwbimage v1 contained SPL code which loaded U-Boot proper based on CONFIG_SYS_U_BOOT_OFFS, instead of reading correct offset from kwbimage header. Now that SPL code parses kwbimage header and deterinate correct offset, there is no need for this CONFIG_SYS_U_BOOT_OFFS padding anymore. By removing it we also reduce the size of SPL code and therefore also decrease the final size of v1 kwbimage. This means there is more space for U-Boot proper binary. Signed-off-by: Pali Rohár Reviewed-by: Marek Behún Reviewed-by: Chris Packham Reviewed-by: Stefan Roese

tools: kwbimage: Do not hide usage of secure header under CONFIG_ARMADA_38X

2021-07-31T07:49:31Z

The mkimage host tool can be used to generate kwbimage v1 image with secure header on host system for A38x plaform also when U-Boot is being compiled for different platform. So there is no reason to not allow compiling of mkimage/kwbimage with secure header support for e.g. x86-64 host. Signed-off-by: Pali Rohár Reviewed-by: Marek Behún Reviewed-by: Chris Packham Reviewed-by: Stefan Roese Tested-by: Chris Packham

tools: kwbimage: Fix compilation without CONFIG_SYS_U_BOOT_OFFS

2021-07-31T07:49:31Z

The CONFIG_SYS_U_BOOT_OFFS option may be defined as empty string. In this case it causes compilation error: tools/kwbimage.c: In function ‘image_headersz_v1’: tools/kwbimage.c:1002:39: error: expected expression before ‘)’ token if (headersz > CONFIG_SYS_U_BOOT_OFFS) { ^ tools/kwbimage.c:1006:41: error: expected expression before ‘)’ token (int)headersz, CONFIG_SYS_U_BOOT_OFFS); ^ tools/kwbimage.c:1011:35: error: expected expression before ‘;’ token headersz = CONFIG_SYS_U_BOOT_OFFS; ^ make[1]: *** [scripts/Makefile.host:112: tools/kwbimage.o] Error 1 make: *** [Makefile:1822: tools] Error 2 Check whether the value of CONFIG_SYS_U_BOOT_OFFS is really set. Signed-off-by: Pali Rohár Reviewed-by: Marek Behún Reviewed-by: Stefan Roese Reviewed-by: Chris Packham Tested-by: Chris Packham

tools: Use a single target-independent config to enable OpenSSL

2021-07-16T19:39:29Z

Host tool features, such as mkimage's ability to sign FIT images were enabled or disabled based on the target configuration. However, this misses the point of a target-agnostic host tool. A target's ability to verify FIT signatures is independent of mkimage's ability to create those signatures. In fact, u-boot's build system doesn't sign images. The target code can be successfully built without relying on any ability to sign such code. Conversely, mkimage's ability to sign images does not require that those images will only work on targets which support FIT verification. Linking mkimage cryptographic features to target support for FIT verification is misguided. Without loss of generality, we can say that host features are and should be independent of target features. While we prefer that a host tool always supports the same feature set, we recognize the following - some users prefer to build u-boot without a dependency on OpenSSL. - some distros prefer to ship mkimage without linking to OpenSSL To allow these use cases, introduce a host-only Kconfig which is used to select or deselect libcrypto support. Some mkimage features or some host tools might not be available, but this shouldn't affect the u-boot build. I also considered setting the default of this config based on FIT_SIGNATURE. While it would preserve the old behaviour it's also contrary to the goals of this change. I decided to enable it by default, so that the default build yields the most feature-complete mkimage. Signed-off-by: Alexandru Gagniuc