u-boot.git/tools/default_image.c, branch v2020.07

crc32: Use the crc.h header for crc functions

2019-12-02T23:23:08+00:00

Drop inclusion of crc.h in common.h and use the correct header directly
instead.

With this we can drop the conflicting definition in fw_env.h and rely on
the crc.h header, which is already included.

Signed-off-by: Simon Glass 
Reviewed-by: Tom Rini

imx: Kconfig: Reduce default CONFIG_CSF_SIZE

2019-10-08T14:36:36+00:00

The default CSF_SIZE defined in Kconfig is too high and SPL cannot
fit into the OCRAM in certain cases.

The CSF cannot achieve 0x2000 length when using RSA 4K key which is
the largest key size supported by HABv4.

According to AN12056 "Encrypted Boot on HABv4 and CAAM Enabled Devices"
it's recommended to pad CSF binary to 0x2000 and append DEK blob to
deploy encrypted boot images.

As the maximum DEK blob size is 0x58 we can reduce CSF_SIZE to 0x2060
which should cover both CSF and DEK blob length.

Update default_image.c and image.c to align with this change and avoid
a U-Boot proper authentication failure in HAB closed devices:

Authenticate image from DDR location 0x877fffc0...
bad magic magic=0x32 length=0x6131 version=0x38
bad length magic=0x32 length=0x6131 version=0x38
bad version magic=0x32 length=0x6131 version=0x38
spl: ERROR:  image authentication fail

Fixes: 96d27fb218 (Revert "habv4: tools: Avoid hardcoded CSF size for SPL targets")

Reported-by: Jagan Teki 
Signed-off-by: Breno Lima

Revert "habv4: tools: Avoid hardcoded CSF size for SPL targets"

2019-10-08T14:35:59+00:00

This reverts commit 62a52f3f85bf33e286632e99f0d39b2c166af0c4.

habv4: tools: Avoid hardcoded CSF size for SPL targets

2019-10-08T14:35:59+00:00

Currently it's not possible to authenticate the U-Boot proper of
mx6ul_14x14_evk_defconfig target:

Authenticate image from DDR location 0x877fffc0...
bad magic magic=0x0 length=0x00 version=0x3
bad length magic=0x0 length=0x00 version=0x3
bad version magic=0x0 length=0x00 version=0x3
spl: ERROR:  image authentication fail

Commit 0633e134784a ("imx: hab: Increase CSF_SIZE for i.MX6 and
i.MX7 devices") has increased CSF_SIZE to avoid a possible issue
when booting encrypted boot images.

Commit d21bd69b6e95 ("tools: mkimage: add firmware-ivt image type
for HAB verification") is hardcoding the CSF and IVT sizes, the
new CSF size is not being considered and u-boot-ivt.img fails to
boot.

Avoid hardcoded CSF and IVT size to fix this issue.

Signed-off-by: Breno Lima 
Reviewed-by: Fabio Estevam

mkimage: Refactor imagetool_get_source_date to take command name

2018-07-10T20:56:00+00:00

So we can use imagetool_get_source_date() from callers who do not have
the image tool params struct, just pass in the command name for the error
message.

Signed-off-by: Alex Kiernan 
Reviewed-by: Simon Glass

SPDX: Convert all of our single license tags to Linux Kernel style

2018-05-07T13:34:12+00:00

When U-Boot started using SPDX tags we were among the early adopters and
there weren't a lot of other examples to borrow from.  So we picked the
area of the file that usually had a full license text and replaced it
with an appropriate SPDX-License-Identifier: entry.  Since then, the
Linux Kernel has adopted SPDX tags and they place it as the very first
line in a file (except where shebangs are used, then it's second line)
and with slightly different comment styles than us.

In part due to community overlap, in part due to better tag visibility
and in part for other minor reasons, switch over to that style.

This commit changes all instances where we have a single declared
license in the tag as both the before and after are identical in tag
contents.  There's also a few places where I found we did not have a tag
and have introduced one.

Signed-off-by: Tom Rini

image: Add IH_OS_TEE for TEE chain-load boot

2018-03-19T20:14:25+00:00

This patch adds a new type IH_OS_TEE. This new OS type will be used for
chain-loading to Linux via a TEE.

With this patch in-place you can generate a bootable OPTEE image like this:

mkimage -A arm -T kernel -O tee -C none -d tee.bin uTee.optee

where "tee.bin" is the input binary prefixed with an OPTEE header and
uTee.optee is the output prefixed with a u-boot wrapper header.

This image type "-T kernel -O tee" is differentiated from the existing
IH_TYPE_TEE "-T tee" in that the IH_TYPE is installed by u-boot (flow
control returns to u-boot) whereas for the new IH_OS_TEE control passes to
the OPTEE firmware and the firmware chainloads onto Linux.

Andrew Davis gave the following ASCII diagram:

IH_OS_TEE: (mkimage -T kernel -O tee)
Non-Secure       Secure

                 BootROM
                   |
      -------------
     |
     v
    SPL
     |
     v
   U-Boot ------>
          <-----  OP-TEE
      |
      V
    Linux

IH_TYPE_TEE: (mkimage -T tee)
Non-Secure       Secure

                 BootROM
                   |
      -------------
     |
     v
    SPL ------->
         <-----  OP-TEE
     |
     v
   U-Boot
      |
      V
    Linux

Signed-off-by: Bryan O'Donoghue 
Suggested-by: Andrew F. Davis 
Cc: Harinarayan Bhatta 
Cc: Andrew F. Davis 
Cc: Tom Rini 
Cc: Kever Yang 
Cc: Philipp Tomsich 
Cc: Peng Fan 
Link: http://mrvan.github.io/optee-imx6ul

tools: mkimage: add firmware-ivt image type for HAB verification

2017-01-02T16:06:57+00:00

When we want to use Secure Boot with HAB from SPL over U-Boot.img,
we need to append the IVT to the image and leave space for the CSF.
Images generated as firmware_ivt can directly be signed using the
Freescale code signing tool. For creation of a CSF, mkimage outputs
the correct HAB Blocks for the image.
The changes to the usual firmware image class are quite small,
that is why I implemented that directly into the default_image.

Cc: sbabic@denx.de

v2-Changes: None

Signed-off-by: Sven Ebenfeld 
Reviewed-by: George McCollister 
Tested-by: George McCollister

Respect SOURCE_DATE_EPOCH when building FIT images.

2016-06-24T21:23:10+00:00

Embedding timestamps in FIT images results in unreproducible builds
for targets that generate a fit image, such as dra7xx_evm.

This patch uses the SOURCE_DATE_EPOCH environment variable, when set,
to use specified value for the date.

Thanks to HW42 for debugging the issue and providing the patch:

  https://lists.alioth.debian.org/pipermail/reproducible-builds/Week-of-Mon-20160606/005722.html

For more information about reproducible builds and the
SOURCE_DATE_EPOCH specification:

  https://reproducible-builds.org/specs/source-date-epoch/
  https://reproducible-builds.org/

Signed-off-by: Vagrant Cascadian 
Reviewed-by: Simon Glass

Fix variation in timestamps caused by timezone differences.

2015-10-11T21:12:12+00:00

When building with SOURCE_DATE_EPOCH set, avoid use of mktime in
default_image.c, which converts the timestamp into localtime. This
causes variation based on timezone when building u-boot.img and
u-boot-sunxi-with-spl.bin targets.

Signed-off-by: Vagrant Cascadian 
Tested-by: Paul Kocialkowski 
Acked-by: Paul Kocialkowski