Commit Graph

247 Commits

Author SHA1 Message Date
Alexandru Gagniuc ed6c9e0b66 lib: Add support for ECDSA image signing
mkimage supports rsa2048, and rsa4096 signatures. With newer silicon
now supporting hardware-accelerated ECDSA, it makes sense to expand
signing support to elliptic curves.

Implement host-side ECDSA signing and verification with libcrypto.
Device-side implementation of signature verification is beyond the
scope of this patch.

Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2021-04-14 15:06:08 -04:00
Alexandru Gagniuc 4c17e5f691 lib/rsa: Make fdt_add_bignum() available outside of RSA code
fdt_add_bignum() is useful for algorithms other than just RSA. To
allow its use for ECDSA, move it to a common file under lib/.

The new file is suffixed with '-libcrypto' because it has a direct
dependency on openssl. This is due to the use of the "BIGNUM *" type.

Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2021-04-14 15:06:08 -04:00
Alexandru Gagniuc 0bcb28dfb9 lib: Rename rsa-checksum.c to hash-checksum.c
rsa-checksum.c sontains the hash_calculate() implementations. Despite
the "rsa-" file prefix, this function is useful for other algorithms.

To prevent confusion, move this file to lib/, and rename it to
hash-checksum.c, to give it a more "generic" feel.

Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2021-04-14 15:06:08 -04:00
Pali Rohár 15942805b7 arm: mvebu: a38x: Remove dead code ARMADA_39X
Config option ARMADA_39X is never set so remove all dead code hidden under
ifdef CONFIG_ARMADA_39X blocks.

Also remove useless checks for CONFIG_ARMADA_38X define as this macro is
always defined for a38x code path.

Signed-off-by: Pali Rohár <pali@kernel.org>
Reviewed-by: Stefan Roese <sr@denx.de>
2021-03-12 07:44:21 +01:00
Joel Stanley 5d40d5f12e tools/Makefile: FIT_CIPHER requires libssl
If CONFIG_FIT_CIPHER is enabled without CONFIG_FIT_SIGNATURE then
mkimage/dumpimage will fail to link:

 /usr/bin/ld: tools/common/image-cipher.o: in function `fit_image_decrypt_data':
 image-cipher.c:(.text+0x9a): undefined reference to `image_get_host_blob'
 /usr/bin/ld: tools/common/image-cipher.o:(.data.rel+0x10): undefined reference to `EVP_aes_128_cbc'
 /usr/bin/ld: tools/common/image-cipher.o:(.data.rel+0x40): undefined reference to `EVP_aes_192_cbc'
 /usr/bin/ld: tools/common/image-cipher.o:(.data.rel+0x70): undefined reference to `EVP_aes_256_cbc'
 /usr/bin/ld: tools/lib/aes/aes-encrypt.o: in function `image_aes_encrypt':
 aes-encrypt.c:(.text+0x22): undefined reference to `EVP_CIPHER_CTX_new'
 /usr/bin/ld: aes-encrypt.c:(.text+0x6f): undefined reference to `EVP_EncryptInit_ex'
 /usr/bin/ld: aes-encrypt.c:(.text+0x8d): undefined reference to `EVP_EncryptUpdate'
 /usr/bin/ld: aes-encrypt.c:(.text+0xac): undefined reference to `EVP_CIPHER_CTX_free'
 /usr/bin/ld: aes-encrypt.c:(.text+0xf2): undefined reference to `EVP_EncryptFinal_ex'
 collect2: error: ld returned 1 exit status

Signed-off-by: Joel Stanley <joel@jms.id.au>
2021-01-22 16:17:52 -05:00
Andre Przywara 6d295099cc tools: mkimage: Add Allwinner eGON support
So far we used the separate mksunxiboot tool for generating a bootable
image for Allwinner SPLs, probably just for historical reasons.

Use the mkimage framework to generate a so called eGON image the
Allwinner BROM expects.
The new image type is called "sunxi_egon", to differentiate it
from the (still to be implemented) secure boot TOC0 image.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Reviewed-by: Jernej Skrabec <jernej.skrabec@siol.net>
Reviewed-by: Samuel Holland <samuel@sholland.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
2021-01-11 23:19:33 +00:00
Tom Rini 720620e691 Prepare v2021.01-rc5
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEEGjx/cOCPqxcHgJu/FHw5/5Y0tywFAl/0YVIACgkQFHw5/5Y0
 tywtEwv/cJWlKgcSnYjuJrxwuJdauUTfXdbUgtCxOtBw/BP4dsKkbGTJPw5q5M+4
 LJJSKyksmJVTX26h1dpkzQjOpWtTDnWqm5CTIxD52oQD7pxK+zCQ9T6S+QbQD0Se
 ogHmZluzFoluxbNgo8tiO52xvMhDO3TVAzxsNDdGfkd5/tAXOHClPc34RmAkdRHU
 VsR89AKdT2q543fiUfrRZYDzdctaNWhRGXMDcJ4+QU/8hQhrpcr8EtHbF+3mWX4K
 pA01pDz150Rn4UI6S2xKEWrjSTHe55fxVj/Qj0rq9z2E/+NqGXemf5s13AR0G/z3
 PqHdVLHzDe64pbOvmyU1pVQ0aMb8vMJUnqx68SQZY3On2c+MjRWQ+7aVVaKOcPGp
 uatk6QMrggHp3Li+3yZrLBE0qPr/sNMVb7mUesdZb6lFd2VIs8siwhfeGXMS+nDI
 xePzsR43Fnn5Q5KIqqvcWUb+TTTqUDUff0wyAU8NBgCaIBIZK8h2ppS1jjnbms0I
 mr8Er2vb
 =Dfum
 -----END PGP SIGNATURE-----

Merge tag 'v2021.01-rc5' into next

Prepare v2021.01-rc5

Signed-off-by: Tom Rini <trini@konsulko.com>
2021-01-05 16:20:26 -05:00
Sughosh Ganu 322c813f4b mkeficapsule: Add support for embedding public key in a dtb
Add options for embedding the public key esl(efi signature list) file
to the platform's dtb. The esl file is then retrieved and used for
authenticating the capsule to be used for updating firmare components
on the platform.

The esl file can now be embedded in the dtb by invoking the following
command
mkeficapsule -K <pub_key.esl> -D <dtb>

In the scenario where the esl file is to be embedded in an overlay,
this can be done through the following command
mkeficapsule -O -K <pub_key.esl> -D <dtb>

This will create a node named 'signature' in the dtb, and the esl file
will be stored as 'capsule-key'

Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
2020-12-31 14:41:31 +01:00
AKASHI Takahiro fab430be2f tools: add mkeficapsule command for UEFI capsule update
This is a utility mainly for test purpose.
  mkeficapsule -f: create a test capsule file for FIT image firmware

Having said that, you will be able to customize the code to fit
your specific requirements for your platform.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-12-03 21:22:50 +01:00
Stefan Roese 540a2bcec1 mips: octeon: tools: Add update_octeon_header tool
Add a tool to update or insert an Octeon specific header into the U-Boot
image. This is needed e.g. for booting via SPI NOR, eMMC and NAND.

While working on this, move enum cvmx_board_types_enum and
cvmx_board_type_to_string() to cvmx-bootloader.h and remove the
unreferenced (unsupported) board definition.

Signed-off-by: Stefan Roese <sr@denx.de>
Cc: Aaron Williams <awilliams@marvell.com>
Cc: Chandrakala Chavva <cchavva@marvell.com>
Cc: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
Reviewed-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
2020-11-30 18:32:09 +01:00
Reuben Dowle d16b38f427 Add support for SHA384 and SHA512
The current recommendation for best security practice from the US government
is to use SHA384 for TOP SECRET [1].

This patch adds support for SHA384 and SHA512 in the hash command, and also
allows FIT images to be hashed with these algorithms, and signed with
sha384,rsaXXXX and sha512,rsaXXXX

The SHA implementation is adapted from the linux kernel implementation.

[1] Commercial National Security Algorithm Suite
http://www.iad.gov/iad/programs/iad-initiatives/cnsa-suite.cfm

Signed-off-by: Reuben Dowle <reuben.dowle@4rf.com>
2020-06-12 13:14:07 -04:00
Trevor Woerner bb0fb4c0f4 rename symbol: CONFIG_KIRKWOOD -> CONFIG_ARCH_KIRKWOOD
Have this symbol follow the pattern of all other such symbols.
This patch also removes a TODO from the code.

Reviewed-by: Chris Packham <judge.packham@gmail.com>
Signed-off-by: Trevor Woerner <twoerner@gmail.com>
2020-05-15 14:47:35 -04:00
Masahiro Yamada 3e69db1223 fdt_region: move fdt_region.c to common/ from lib/libfdt/
My goal is to sync lib/libfdt/ with scripts/dtc/libfdt/, that is,
make lib/libfdt/ contain only wrapper files.

fdt_region.c was written only for U-Boot to implement the verified
boot. So, this belongs to the same group as common/fdt_support.c,
which is a collection of U-Boot own fdt helpers.

Move lib/libfdt/fdt_region.c to common/fdt_region.c . This is
necessary only when CONFIG_(SPL_TPL_)_FIT_SIGNATURE is enabled.

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
2020-04-26 14:23:55 -06:00
Masahiro Yamada bcbdab70a2 libfdt: migrate fdt_ro.c to a wrapper of scripts/dtc/libfdt/fdt_ro.c
There is no essential difference between scripts/dtc/libfdt/fdt_ro.c
and lib/libfdt/fdt_ro.c

Migrate to a simple wrapper like the other files.

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
2020-04-26 14:23:39 -06:00
Tom Rini 587e4a4296 kconfig / kbuild: Re-sync with Linux 4.19
Align Kconfig and Kbuild logic to Linux 4.19 release with minimal impact
on files outside of this scope.

Our previous Kconfig sync was done by commit 5972ff077e ("kconfig /
kbuild: re-sync with Linux 4.18").

In this particular re-sync in order to keep clang support working a
number of related changes needed to be pulled in that had been missed
previously.  Not all of these changes we easily traceable and so have
been omitted from the list below.

The imported Linux commits are:
[From prior to v4.18]
9f3f1fd29976 kbuild: Add __cc-option macro
d7f14c66c273 kbuild: Enable Large File Support for hostprogs
6d79a7b424a5 kbuild: suppress warnings from 'getconf LFS_*'
24403874316a Shared library support
86a9df597cdd kbuild: fix linker feature test macros when cross compiling with Clang
0294e6f4a000 kbuild: simplify ld-option implementation

[From v4.18 to v4.19]
96f14fe738b6 kbuild: Rename HOSTCFLAGS to KBUILD_HOSTCFLAGS
10844aebf448 kbuild: Rename HOSTCXXFLAGS to KBUILD_HOSTCXXFLAGS
b90a368000ab kbuild: Rename HOSTLDFLAGS to KBUILD_HOSTLDFLAGS
8377bd2b9ee1 kbuild: Rename HOST_LOADLIBES to KBUILD_HOSTLDLIBS
f92d19e0ef9b kbuild: Use HOST*FLAGS options from the command line
4ab3b80159d4 kconfig: check for pkg-config on make {menu,n,g,x}config
693359f7ac90 kconfig: rename SYMBOL_AUTO to SYMBOL_NO_WRITE
f60b992e30ff kbuild: replace $(LDFLAGS) $(ldflags-y) with $(ld_flags)
2fb9279f2c3e kbuild: change ld_flags to contain LDFLAGS_$(@F)
c931d34ea085 arm64: build with baremetal linker target instead of Linux when available
5accd7f3360e kconfig: handle format string before calling conf_message_callback()
a2ff4040151a kconfig: rename file_write_dep and move it to confdata.c
0608182ad542 kconfig: split out useful helpers in confdata.c
adc18acf42a1 kconfig: remove unneeded directory generation from local*config
79123b1389cc kconfig: create directories needed for syncconfig by itself
16952b77d8b5 kconfig: make syncconfig update .config regardless of sym_change_count
d6c6ab93e17f kbuild: remove deprecated host-progs variable
56869d45e364 kconfig: fix the rule of mainmenu_stmt symbol
c151272d1687 kconfig: remove unused sym_get_env_prop() function
1880861226c1 kconfig: remove P_ENV property type
e3fd9b5384f3 scripts/dtc: consolidate include path options in Makefile
4bf6a9af0e91 kconfig: add build-only configurator targets
f1575595d156 kconfig: error out when seeing recursive dependency
5e8c5299d315 kconfig: report recursive dependency involving 'imply'
f498926c47aa kconfig: improve the recursive dependency report
98a4afbfafd2 kconfig: fix "Can't open ..." in parallel build
9a9ddcf47831 kconfig: suppress "configuration written to .config" for syncconfig
87a32e624037 kbuild: pass LDFLAGS to recordmcount.pl
d503ac531a52 kbuild: rename LDFLAGS to KBUILD_LDFLAGS
217c3e019675 disable stringop truncation warnings for now
bc8d2e20a3eb kconfig: remove a spurious self-assignment
fd65465b7016 kconfig: do not require pkg-config on make {menu,n}config
5a4630aadb9a ftrace: Build with CPPFLAGS to get -Qunused-arguments

Note that this adds new cleanup work to do in that we should adapt the
shared library support we have to what is now upstream.

Signed-off-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Masahiro Yamada <masahiroy@kernel.org>
2020-04-10 11:18:32 -04:00
AKASHI Takahiro b983cc2da0 lib: rsa: decouple rsa from FIT image verification
Introduce new configuration, CONFIG_RSA_VERIFY which will decouple building
RSA functions from FIT verification and allow for adding a RSA-based
signature verification for other file formats, in particular PE file
for UEFI secure boot.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
2020-03-12 08:20:38 -04:00
Philippe Reynes 4df3578119 u-boot: fit: add support to decrypt fit with aes
This commit add to u-boot the support to decrypt
fit image encrypted with aes. The FIT image contains
the key name and the IV name. Then u-boot look for
the key and IV in his device tree and decrypt images
before moving to the next stage.

Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
2020-01-17 10:16:29 -05:00
Philippe Reynes 7298e42250 mkimage: fit: add support to encrypt image with aes
This commit add the support of encrypting image with aes
in mkimage. To enable the ciphering, a node cipher with
a reference to a key and IV (Initialization Vector) must
be added to the its file. Then mkimage add the encrypted
image to the FIT and add the key and IV to the u-boot
device tree.

Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
2020-01-17 10:15:49 -05:00
AKASHI Takahiro 2b12196dc1 cmd: add asn1_compiler
Imported from linux kernel v5.3:
 asn1.h without changes
 asn1_ber_bytecode.h without changes
 asn1_decoder.h without changes
 asn1_compiler.c without changes

This host command will be used to create a ASN1 parser, for example,
for pkcs7 messages or x509 certificates. More specifically, it will
generate *byte code* which will be interpreted by asn1 decoder library.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2019-12-06 16:44:20 -05:00
Heinrich Schuchardt 44de15d686 tools: remove easylogo and include/video_logo.h
include/video_logo.h once was created via the tool easylogo and than used
in cpu/mpc8xx/video.c to display Tux. video_logo.h has been replaced by
include/linux_logo.h and is not needed anymore.

Delete the include and the tool,

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2019-08-26 11:46:30 -04:00
Heiko Schocher 245b1029e1 bmp_logo: support CONFIG_DM_VIDEO
in case of bmp_logo, the video_bmp driver is used for
drawing a bmp logo. This driver supports only "full"
bmp data. Adding a logo with the bmp_logo tool to
u-boot binary adds currently only real data and drops
the bmp header.

This patch adds now the full bmp data to the u-boot
binary, so video_bmp driver works with the logo embedded
into u-boot.

Fixed also some checkpatch error poping up with this
patch.

Signed-off-by: Heiko Schocher <hs@denx.de>
2019-07-29 00:20:31 +02:00
Simon Glass 56bf4f8630 x86: Add ifwitool for Intel Integrated Firmware Image
Some Intel SoCs from about 2016 boot using an internal microcontroller via
an 'IFWI' image. This is a special format which can hold firmware images.
In U-Boot's case it holds u-boot-tpl.bin.

Add this tool, taken from coreboot, so that we can build bootable images
on apollolake SoCs.

This tool itself has no tests. Some amount of coverage will be provided by
the binman tests that use it, so enable building the tool on sandbox.

Signed-off-by: Simon Glass <sjg@chromium.org>
2019-07-23 20:27:56 -07:00
Simon Goldschmidt 2577015dc5 spl: add overall SPL size check
This adds a size check for SPL that can dynamically check generated
SPL binaries (including devicetree) for a size limit that ensures
this image plus global data, heap and stack fit in initial SRAM.

Since some of these sizes are not available to make, a new host tool
'spl_size_limit' is added that dumps the resulting maximum size for
an SPL binary to stdout. This tool is used in toplevel Makefile to
implement the size check on SPL binaries.

Signed-off-by: Simon Goldschmidt <simon.k.r.goldschmidt@gmail.com>
2019-06-07 11:03:39 -04:00
Fabrice Fontaine 93e078807f Make FIT support really optional
Due to some mistakes in the source code, it was not possible to really
turn FIT support off. This commit fixes the problem by means of the
following changes:

- Enclose "bootm_host_load_image" and "bootm_host_load_images" between
  checks for CONFIG_FIT_SIGNATURE, in common/bootm.c.

- Enclose the declaration of "bootm_host_load_images" between checks for
  CONFIG_FIT_SIGNATURE, in common/bootm.h.

- Condition the compilation and linking of fit_common.o fit_image.o
  image-host.o common/image-fit.o to CONFIG_FIT=y, in tools/Makefile.

Signed-off-by: Carlos Santos <casantos@datacom.ind.br>
[fabio: adapt for 2016.07]
Signed-off-by: Fabio Estevam <festevam@gmail.com>
[Ricardo: fix conditional compilation and linking of the files mentioned above
for 2016.07]
Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com>
[Jörg: adapt for 2019.01]
Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
[Retrieved from:
https://git.buildroot.net/buildroot/tree/package/uboot-tools/0003-Make-FIT-support-really-optional.patch]
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
2019-05-09 19:52:55 -04:00
Fabrice Fontaine 72c69ea8d6 tools/Makefile: fix HOSTCFLAGS with CROSS_BUILD_TOOLS
When CROSS_BUILD_TOOLS is set, set HOSTCFLAGS to CFLAGS otherwise CC
will be used with HOSTCFLAGS which seems wrong

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
2019-05-03 07:30:31 -04:00
Pierre Bourdon 9bdfe290e9 tools/Makefile: get openssl CFLAGS from pkg-config
Fixes building mkimage on systems where OpenSSL header files do not
live in the standard include path.

Signed-off-by: Pierre Bourdon <delroth@gmail.com>
2019-04-26 17:51:51 -04:00
Thomas Petazzoni d7edeba79b tools/Makefile: build host tools with -std=gnu99
Parts of the code are using C99 constructs (such as variables declared
inside loops), but also GNU extensions (such as typeof), so using
-std=gnu99 is necessary to build with older versions of gcc that don't
default to building with gnu99.

It fixes the following build failure:

./tools/../lib/crc16.c: In function "crc16_ccitt":
./tools/../lib/crc16.c:70:2: error: "for" loop initial declarations are only allowed in C99 mode
  for (int i = 0;  i < len;  i++)
  ^
./tools/../lib/crc16.c:70:2: note: use option -std=c99 or -std=gnu99 to compile your code

when building the host tools with gcc 4.7.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
2019-04-03 10:26:46 -04:00
Tom Rini 522e035441 imx for 2019.01
- introduce support for i.MX8M
 - fix size limit for Vhybrid / pico boards
 - several board fixes
 - w1 driver for MX2x / MX5x
 -----BEGIN PGP SIGNATURE-----
 
 iQHDBAABCgAtFiEEiZClFGvhzbUNsmAvKMTY0yrV63cFAlwrbc8PHHNiYWJpY0Bk
 ZW54LmRlAAoJECjE2NMq1et3oCwL/RCqesqQaLKkUQDiYQJzoa6Ia7TeSTD1HoHl
 lYXarE9FloD7lHp4Lz1elU8Y+yTtjvixKS9UJGRc0pMcJJ/CEavjK+oBOVNbEnvH
 vm/oXQfZqj60tLc2Z7RfRe1gHHCcaGiBXJePea5WhP89cUZW1YBs4TVY2AIEQeRV
 V8vcxbBprqqBWyFRgH+ORsWrmkfcYEfiMr97Y8v07RRPX/C80e98PTc16fh9o7S1
 +i8Pcs0SIMnA8PqXVgrpa4DT7OS/ZtLADG/ODpvJ25nHoKvdhlXMc8o8L5dyaO1f
 66UD0A8D3PXkXkFodZujSjtKl5ygeA/4YkEnY6PRqd2W6kZsq6R7XCu/3e3eQSwK
 GFnWQnzLkDOCKMZlxR8l3sJdhY3Ee3oAQ+EX3PEy1MvKKrGA8PSOIKHq3tVNrPYB
 tBnJP32G+2Ya0SG169ROoUMZQQXfTt+9kdqsxx5xL2Pfpt9d+YinCM8uQdhqBGPa
 COqegLaD0ZkADsodZp876u3Irbo6bw==
 =mEcH
 -----END PGP SIGNATURE-----

Merge tag 'u-boot-imx-20190101' of git://www.denx.de/git/u-boot-imx

imx for 2019.01

- introduce support for i.MX8M
- fix size limit for Vhybrid / pico boards
- several board fixes
- w1 driver for MX2x / MX5x
2019-01-01 10:01:00 -05:00
Peng Fan 6609c2663c tools: add i.MX8M image support
i.MX8M bootable image type is like i.MX6/7, but there is signed HDMI
firmware image in front of A53 bootable image, which is also has an IVT
header.

Here we also include fit image to generate a bootable image.

Signed-off-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Stefano Babic <sbabic@denx.de>
2019-01-01 14:12:18 +01:00
Otavio Salvador 80870e2a66 tools: add a generic config for native tools building
The motivation for this is to allow distributions to distribute all
possible tools in a generic way, avoiding the need of specific tools
building for each machine.

Especially on OpenEmbedded / Yocto Project ecosystem, it is very
common each BSP to end providing their specific tools when they need
to generate images for some SoC (e.g MX23 / MX28 in meta-freescale
case).

Using this, we can package the tools doing:

$: make tools-only_defconfig
$: make tools-only

Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
[trini: Add MAINTAINERS entry for myself, add to .travis.yml, make
U-Boot itself buildable to not trip up other frameworks]
Signed-off-by: Tom Rini <trini@konsulko.com>
2018-12-15 11:49:56 -05:00
Philipp Tomsich 51c2345bd2 Roll CRC16-CCITT into the hash infrastructure
The CRC16-CCITT checksum function is useful for space-constrained
applications (such as obtaining a checksum across a 2KBit or 4KBit
EEPROM) in boot applications. It has not been accessible from boot
scripts until now (due to not having a dedicated command and not being
supported by the hash infrstructure) limiting its applicability
outside of custom commands.

This adds the CRC16-CCITT (poly 0x1021, init 0x0) algorithm to the
list of available hashes and adds a new crc16_ccitt_wd_buf() to make
this possible.

Signed-off-by: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
[trini: Fix building crc16.o for SPL/TPL]
Signed-off-by: Tom Rini <trini@konsulko.com>
2018-12-08 20:18:44 -05:00
Ryder Lee 3b975a147c tools: MediaTek: add MTK boot header generation to mkimage
This patch adds support for MTK boot image generation.

Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2018-11-28 23:04:43 -05:00
Peng Fan a2b96ece5b tools: add i.MX8/8X image support
i.MX8/8X bootable image type is container type.
The bootable image, containers a container set which supports two
container. The 1st container is for SECO firmware, the 2nd container
needs to include scfw, m4_0/1 image, ACore images per your requirement.

Signed-off-by: Peng Fan <peng.fan@nxp.com>
2018-10-22 13:01:27 +02:00
Teddy Reed 72239fc85f vboot: Add FIT_SIGNATURE_MAX_SIZE protection
This adds a new config value FIT_SIGNATURE_MAX_SIZE, which controls the
max size of a FIT header's totalsize field. The field is checked before
signature checks are applied to protect from reading past the intended
FIT regions.

This field is not part of the vboot signature so it should be sanity
checked. If the field is corrupted then the structure or string region
reads may have unintended behavior, such as reading from device memory.
A default value of 256MB is set and intended to support most max storage
sizes.

Suggested-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Teddy Reed <teddy.reed@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2018-07-10 16:55:58 -04:00
Alexander Graf 6915dcf359 tools: zynqmpimage: Add bif support
The officially described way to generate boot.bin files for ZynqMP is to
describe the contents of the target binary using a file of the "bif"
format.  This file then links to other files that all get packed into a
bootable image.

This patch adds support to read such a .bif file and generate a respective
ZynqMP boot.bin file that can include the normal image and pmu files, but
also supports image partitions now. This makes it a handy replacement for
the proprietary "bootgen" utility that is currently used to generate
boot.bin files with FSBL.

Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
2018-05-11 09:23:44 +02:00
Tom Rini 83d290c56f SPDX: Convert all of our single license tags to Linux Kernel style
When U-Boot started using SPDX tags we were among the early adopters and
there weren't a lot of other examples to borrow from.  So we picked the
area of the file that usually had a full license text and replaced it
with an appropriate SPDX-License-Identifier: entry.  Since then, the
Linux Kernel has adopted SPDX tags and they place it as the very first
line in a file (except where shebangs are used, then it's second line)
and with slightly different comment styles than us.

In part due to community overlap, in part due to better tag visibility
and in part for other minor reasons, switch over to that style.

This commit changes all instances where we have a single declared
license in the tag as both the before and after are identical in tag
contents.  There's also a few places where I found we did not have a tag
and have introduced one.

Signed-off-by: Tom Rini <trini@konsulko.com>
2018-05-07 09:34:12 -04:00
Tuomas Tynkkynen 5473eb6d15 tools: Make kwboot build if HOST_TOOLS_ALL=y
The kwboot tool for Marvell devices isn't currently being built even if
HOST_TOOLS_ALL is set. It doesn't appear to depend on any CONFIG_
options, so it seems appropriate to enable building it here.

Signed-off-by: Tuomas Tynkkynen <tuomas@tuxera.com>
2018-03-22 13:25:20 -04:00
Patrick Delaunay 81260e3331 tools/mkimage: add support for STM32 image format
STM32MP157 bootrom needs a specific header for first boot stage.
This patch adds support of this header in mkimage.

Signed-off-by: Patrick Delaunay <patrick.delaunay@st.com>
2018-03-19 16:14:19 -04:00
Paul Kocialkowski e0d20dc152 tools: Include U-Boot libfdt headers from their actual path
There are no headers for libfdt in lib/libfdt, as they are instead
located in scripts/dtc/libfdt. Specifying lib/libfdt for headers
inclusion in host tools results in using the system libfdt headers,
which is not what we want. Change this to the proper path.

Signed-off-by: Paul Kocialkowski <contact@paulk.fr>
2018-03-05 10:16:28 -05:00
Masahiro Yamada 662282203a libfdt: migrate include/libfdt_env.h to a wrapper
libfdt_env.h is supposed to provide system-dependent defines.

scripts/dtc/libfdt/libfdt_env.h from upstream DTC is suitable
for user-space, so we should use this for USE_HOSTCC case.

For compiling U-Boot, we need to override such system-dependent
defines, so use <linux/libfdt_env.h> imported from Linux.

<libfdt.h> selects a proper one.  Maybe, we should split header
inclusion completely, but I do not want too many patches at one.

I can rip off the include/libfdt_env.h from HOST_EXTRACFLAGS.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2018-01-28 12:27:31 -05:00
Masahiro Yamada ae9ace7089 libfdt: migrate fdt_rw.c to a wrapper of scripts/dtc/libfdt/fdt_rw.c
The only difference between scripts/dtc/libfdt/fdt_rw.c and
lib/libfdt/fdt_rw.c is fdt_remove_unused_strings().

It is only used by fdtgrep, so we do not need to compile it for U-Boot
image.  Move it to tools/libfdt/fdw_rw.c so that lib/libfdt/fdt_rw.c
can be a wrapper of scripts/dtc/libfdt/fdt_rw.c.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2018-01-28 12:27:30 -05:00
Heinrich Schuchardt ac02019616 tools: provide a tool to convert a binary file to an include
For testing EFI disk management we need an in-memory image of
a disk.

The tool file2include converts a file to a C include. The file
is separated into strings of 8 bytes. Only the non-zero strings
are written to the include. The output format has been designed
to maintain readability.

 #define EFI_ST_DISK_IMG { 0x00010000, { \
  {0x000001b8, "\x94\x37\x69\xfc\x00\x00\x00\x00"}, /* .7i..... */ \
  {0x000001c0, "\x02\x00\x83\x02\x02\x00\x01\x00"}, /* ........ */ \
  {0x000001c8, "\x00\x00\x7f\x00\x00\x00\x00\x00"}, /* ........ */ \
  {0x000001f8, "\x00\x00\x00\x00\x00\x00\x55\xaa"}, /* ......U. */ \
 ...
  {0x00006000, "\x48\x65\x6c\x6c\x6f\x20\x77\x6f"}, /* Hello wo */ \
  {0x00006008, "\x72\x6c\x64\x21\x0a\x00\x00\x00"}, /* rld!.... */ \
  {0, NULL} } }

As the disk image needed for testing contains mostly zeroes a high
compression ratio can be attained.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Alexander Graf <agraf@suse.de>
2018-01-22 23:09:12 +01:00
Rick Chen 42ac26f2b0 riscv: tools: Prelink u-boot
Add prelink-riscv to arrange .rela.dyn and .rela.got
in compile time. So that u-boot can be directly
executed without fixup.

Signed-off-by: Chih-Mao Chen <cmchen@andestech.com>
Signed-off-by: Rick Chen <rick@andestech.com>
Signed-off-by: Rick Chen <rickchen36@gmail.com>
Signed-off-by: Greentime Hu <green.hu@gmail.com>
2018-01-12 08:05:12 -05:00
Masahiro Yamada 26e961c8cf libfdt: migrate fdt_wip.c to a wrapper of scripts/dtc/libfdt/fdt_wip.c
Now, lib/libfdt/fdt_wip.c is the same as scripts/dtc/libfdt/fdt_wip.c

Change the former to a wrapper of the latter.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2017-12-04 09:59:02 -05:00
Masahiro Yamada b38ad663a4 tools: use files from scripts/dtc/libfdt where possible
Prior to this commit, tools/Makefile pulls all libfdt files from
lib/libfdt.

lib/libfdt/ and scripts/dtc/libfdt have the same copies for the
followings 6 files:
  fdt.c fdt_addresses.c fdt_empty_tree.c fdt_overlay.c fdt_strerr.c
  fdt_sw.c

This commit changes them to #include ones from scripts/dtc/libfdt.

Unfortunately, U-Boot locally modified the following 3 files:
  fdt_ro.c fdt_wip.c fdt_rw.c

I did not touch them in order to avoid unpredictable impact.

The fdt_region.c is U-Boot own file.  This is also borrowed from
lib/libfdt/.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
2017-11-17 07:44:13 -05:00
Masahiro Yamada 15b97f5c5e pylibfdt: move pylibfdt to scripts/dtc/pylibfdt and refactor makefile
The pylibfdt is used by dtoc (and, indirectly by binman), but there
is no reason why it must be generated in the tools/ directory.

Recently, U-Boot switched over to the bundled DTC, and the directory
structure under scripts/dtc/ now mirrors the upstream DTC project.
So, scripts/dtc/pylibfdt is the best location.

I also rewrote the Makefile in a cleaner Kbuild style.

The scripts from the upstream have been moved as follows:

  lib/libfdt/pylibfdt/setup.py -> scripts/dtc/pylibfdt/setup.py
  lib/libfdt/pylibfdt/libfdt.i -> scripts/dtc/pylibfdt/libfdt.i_shipped

The .i_shipped is coped to .i during building because the .i must be
located in the objtree when we build it out of tree.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
2017-11-17 07:43:32 -05:00
Tuomas Tynkkynen 7b7341d7f3 env: Drop CONFIG_ENV_IS_IN_DATAFLASH
Last user of this option went away in commit:

fdc7718999 ("board: usb_a9263: Update to support DT and DM")

Signed-off-by: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
2017-10-16 09:42:51 -04:00
Tom Rini 1f6049e250 tools/mkimage: Make the path to the dtc binary that mkimage calls configurable
In some cases, such as FreeBSD, the path to an alternative dtc needs to
be used.  Rather than override the one given in the Makefile on the
command line, make this part of the build configuration.

Signed-off-by: Tom Rini <trini@konsulko.com>
2017-09-24 07:33:03 -04:00
Bin Meng 6935aec0e3 Makefile: Suppress output of python libfdt build command
This should not be printed by default. Prefix it with $(Q).

Fixes ee95d10b: ("fdt: Build the new python libfdt module")
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
2017-09-03 15:30:37 -04:00
Bin Meng a5ab5c771b Makefile: Quiesce libfdt build
Since commit 3809e302 "Makefile: honor PYTHON configuration properly",
the build commands of libfdt are printed while previously were not.

This adds the missing '--quiet' back.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
2017-09-03 15:30:36 -04:00