From patchwork Fri Jun 19 10:45:45 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Heiko Stuebner X-Patchwork-Id: 242662 List-Id: U-Boot discussion From: heiko at sntech.de (Heiko Stuebner) Date: Fri, 19 Jun 2020 12:45:45 +0200 Subject: [PATCH v4 1/6] imx: mkimage_fit_atf: Fix FIT image if BL31.bin missing In-Reply-To: <20200619104550.1972307-1-heiko@sntech.de> References: <20200619104550.1972307-1-heiko@sntech.de> Message-ID: <20200619104550.1972307-2-heiko@sntech.de> From: Heiko Stuebner Right now if its bl31.bin is missing, the imx make_fit_atf.sh does return "sucessful" without generating an .its source file, which makes autobuilders unhappy. So this change is similar to Tom Rini's commit 4c78028737c3 ("mksunxi_fit_atf.sh: Allow for this to complete when bl31.bin is missing") in that it changes the behaviour to a warning and still lets the script generate a usable u-boot.its and thus also lets the u-boot.itb get build successfully Signed-off-by: Heiko Stuebner Reviewed-by: Peng Fan --- arch/arm/mach-imx/mkimage_fit_atf.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm/mach-imx/mkimage_fit_atf.sh b/arch/arm/mach-imx/mkimage_fit_atf.sh index fe12b7bb4b..2f77c6d70d 100755 --- a/arch/arm/mach-imx/mkimage_fit_atf.sh +++ b/arch/arm/mach-imx/mkimage_fit_atf.sh @@ -12,8 +12,8 @@ [ -z "$BL33_LOAD_ADDR" ] && BL33_LOAD_ADDR="0x40200000" if [ ! -f $BL31 ]; then - echo "ERROR: BL31 file $BL31 NOT found" >&2 - exit 0 + echo "WARNING: BL31 file $BL31 NOT found, resulting binary is not-functional" >&2 + BL31=/dev/null else echo "$BL31 size: " >&2 ls -lct $BL31 | awk '{print $5}' >&2 From patchwork Fri Jun 19 10:45:46 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Heiko Stuebner X-Patchwork-Id: 242657 List-Id: U-Boot discussion From: heiko at sntech.de (Heiko Stuebner) Date: Fri, 19 Jun 2020 12:45:46 +0200 Subject: [PATCH v4 2/6] mkimage: fit_image: handle multiple errors when writing signatures In-Reply-To: <20200619104550.1972307-1-heiko@sntech.de> References: <20200619104550.1972307-1-heiko@sntech.de> Message-ID: <20200619104550.1972307-3-heiko@sntech.de> From: Heiko Stuebner fit_image_write_sig() contains mostly functions from libfdt that return FDT_ERR_foo errors but also a call to fit_set_timestamp() which returns a regular error. When handling the size increase via multiple iterations, check for both -FDT_ERR_NOSPACE but also for -ENOSPC. There is no real conflict, as FDT_ERR_NOSPACE = 3 = ESRCH (No such process) and ENOSPC = 28 which is above any FDT_ERR_*. Signed-off-by: Heiko Stuebner Reviewed-by: Simon Glass --- tools/image-host.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/image-host.c b/tools/image-host.c index 9a83b7f675..baf9590f3b 100644 --- a/tools/image-host.c +++ b/tools/image-host.c @@ -241,7 +241,7 @@ static int fit_image_process_sig(const char *keydir, void *keydest, ret = fit_image_write_sig(fit, noffset, value, value_len, comment, NULL, 0, cmdname); if (ret) { - if (ret == -FDT_ERR_NOSPACE) + if (ret == -FDT_ERR_NOSPACE || ret == -ENOSPC) return -ENOSPC; printf("Can't write signature for '%s' signature node in '%s' conf node: %s\n", node_name, image_name, fdt_strerror(ret)); From patchwork Fri Jun 19 10:45:47 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Heiko Stuebner X-Patchwork-Id: 242656 List-Id: U-Boot discussion From: heiko at sntech.de (Heiko Stuebner) Date: Fri, 19 Jun 2020 12:45:47 +0200 Subject: [PATCH v4 3/6] spl: fit: dont set U_BOOT_ITS var if not build SPL_FIT support In-Reply-To: <20200619104550.1972307-1-heiko@sntech.de> References: <20200619104550.1972307-1-heiko@sntech.de> Message-ID: <20200619104550.1972307-4-heiko@sntech.de> From: Heiko Stuebner Both CONFIG_SPL_FIT_SOURCE and CONFIG_SPL_FIT_GENERATOR depend on CONFIG_SPL_FIT, so U_BOOT_ITS should only be defined if one of them is set. When undefined, the ifneq ($(CONFIG_SPL_FIT_SOURCE),"") seems to evaluate to true all the time though, setting U_BOOT_ITS to u-boot.its, even if no FIT support gets build. This may prove cumbersome if later parts want to check against "do we need an U_BOOT_ITS", so to fix that just wrap the whole block in a "ifdef CONFIG_SPL_FIT" which needs to be defined if any SPL_FIT_* options get used. Signed-off-by: Heiko Stuebner --- Makefile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Makefile b/Makefile index 149f839948..1cc7e37c37 100644 --- a/Makefile +++ b/Makefile @@ -1320,6 +1320,7 @@ endif # Boards with more complex image requirements can provide an .its source file # or a generator script +ifdef CONFIG_SPL_FIT ifneq ($(CONFIG_SPL_FIT_SOURCE),"") U_BOOT_ITS := u-boot.its $(U_BOOT_ITS): $(subst ",,$(CONFIG_SPL_FIT_SOURCE)) @@ -1338,6 +1339,7 @@ $(U_BOOT_ITS): $(U_BOOT_ITS_DEPS) FORCE $(patsubst %,arch/$(ARCH)/dts/%.dtb,$(subst ",,$(CONFIG_OF_LIST))) > $@ endif endif +endif ifdef CONFIG_SPL_LOAD_FIT MKIMAGEFLAGS_u-boot.img = -f auto -A $(ARCH) -T firmware -C none -O u-boot \ From patchwork Fri Jun 19 10:45:48 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Heiko Stuebner X-Patchwork-Id: 242658 List-Id: U-Boot discussion From: heiko at sntech.de (Heiko Stuebner) Date: Fri, 19 Jun 2020 12:45:48 +0200 Subject: [PATCH v4 4/6] spl: fit: enable signing a generated u-boot.itb In-Reply-To: <20200619104550.1972307-1-heiko@sntech.de> References: <20200619104550.1972307-1-heiko@sntech.de> Message-ID: <20200619104550.1972307-5-heiko@sntech.de> From: Heiko Stuebner With SPL_FIT_SIGNATURE enabled we will likely want a generated u-boot.itb to be signed and the key stores so that the spl can reach it. So add a SPL_FIT_SIGNATURE_KEY_DIR option and suitable hooks into the Makefile to have mkimage sign the .itb and store the used key into the spl dtb file. The added dependencies should make sure that the u-boot.itb gets generated before the spl-binary gets build, so that there is the necessary space for the key to get included. Signed-off-by: Heiko Stuebner Reviewed-by: Philipp Tomsich Reviewed-by: Simon Glass --- Kconfig | 8 ++++++++ Makefile | 11 ++++++++++- 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/Kconfig b/Kconfig index b34fbf5827..05a13d1836 100644 --- a/Kconfig +++ b/Kconfig @@ -465,6 +465,14 @@ config SPL_FIT_SIGNATURE select SPL_RSA_VERIFY select SPL_IMAGE_SIGN_INFO +config SPL_FIT_SIGNATURE_KEY_DIR + string "key directory for signing U-Boot FIT image" + depends on SPL_FIT_SIGNATURE + default "keys" + help + The directory to give to mkimage to retrieve keys from when + generating a signed U-Boot FIT image. + config SPL_LOAD_FIT bool "Enable SPL loading U-Boot as a FIT (basic fitImage features)" select SPL_FIT diff --git a/Makefile b/Makefile index 1cc7e37c37..d19f556a04 100644 --- a/Makefile +++ b/Makefile @@ -1409,6 +1409,14 @@ MKIMAGEFLAGS_u-boot.itb = else MKIMAGEFLAGS_u-boot.itb = -E endif +ifdef CONFIG_SPL_FIT_SIGNATURE +ifdef CONFIG_SPL_OF_CONTROL +MKIMAGEFLAGS_u-boot.itb += -K dts/dt-spl.dtb -r +ifneq ($(CONFIG_SPL_FIT_SIGNATURE_KEY_DIR),"") +MKIMAGEFLAGS_u-boot.itb += -k $(CONFIG_SPL_FIT_SIGNATURE_KEY_DIR) +endif +endif +endif u-boot.itb: u-boot-nodtb.bin \ $(if $(CONFIG_OF_SEPARATE)$(CONFIG_OF_EMBED)$(CONFIG_OF_HOSTFILE),dts/dt.dtb) \ @@ -1924,7 +1932,8 @@ spl/u-boot-spl.bin: spl/u-boot-spl spl/u-boot-spl: tools prepare \ $(if $(CONFIG_OF_SEPARATE)$(CONFIG_OF_EMBED)$(CONFIG_SPL_OF_PLATDATA),dts/dt.dtb) \ - $(if $(CONFIG_OF_SEPARATE)$(CONFIG_OF_EMBED)$(CONFIG_TPL_OF_PLATDATA),dts/dt.dtb) + $(if $(CONFIG_OF_SEPARATE)$(CONFIG_OF_EMBED)$(CONFIG_TPL_OF_PLATDATA),dts/dt.dtb) \ + $(if $(CONFIG_SPL_FIT_SIGNATURE)$(U_BOOT_ITS),u-boot.itb FORCE) $(Q)$(MAKE) obj=spl -f $(srctree)/scripts/Makefile.spl all spl/sunxi-spl.bin: spl/u-boot-spl From patchwork Fri Jun 19 10:45:49 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Heiko Stuebner X-Patchwork-Id: 242660 List-Id: U-Boot discussion From: heiko at sntech.de (Heiko Stuebner) Date: Fri, 19 Jun 2020 12:45:49 +0200 Subject: [PATCH v4 5/6] spl: fit: add Kconfig option to specify key-hint for fit_generator In-Reply-To: <20200619104550.1972307-1-heiko@sntech.de> References: <20200619104550.1972307-1-heiko@sntech.de> Message-ID: <20200619104550.1972307-6-heiko@sntech.de> From: Heiko Stuebner The u-boot.itb can be generated either from a static .its that can simply include the needed signature nodes with key-hints or from a fit-generator script referenced in CONFIG_SPL_FIT_GENERATOR. In the script-case it will need to know what key to include for the key-hint and specified algorithm, so add an option for that key-name. Signed-off-by: Heiko Stuebner Reviewed-by: Philipp Tomsich --- Kconfig | 8 ++++++++ doc/uImage.FIT/howto.txt | 13 +++++++++++++ 2 files changed, 21 insertions(+) diff --git a/Kconfig b/Kconfig index 05a13d1836..de144ae430 100644 --- a/Kconfig +++ b/Kconfig @@ -548,6 +548,14 @@ config SPL_FIT_GENERATOR passed a list of supported device tree file stub names to include in the generated image. +config SPL_FIT_GENERATOR_KEY_HINT + string "key hint for signing U-Boot FIT image" + depends on SPL_FIT_SIGNATURE + default "dev" + help + The key hint to store in both the generated .its file as well as + u-boot-key.dtb generated separately and embedded into the SPL. + endif # SPL endif # FIT diff --git a/doc/uImage.FIT/howto.txt b/doc/uImage.FIT/howto.txt index 8592719685..f409b3770e 100644 --- a/doc/uImage.FIT/howto.txt +++ b/doc/uImage.FIT/howto.txt @@ -66,6 +66,19 @@ can point to a script which generates this image source file during the build process. It gets passed a list of device tree files (taken from the CONFIG_OF_LIST symbol). +Signing u-boot.itb with SPL_FIT_GENERATOR +----------------------------------------- + +u-boot.itb can be signed to verify the integrity of its components. +When CONFIG_SPL_FIT_SIGNATURE is enabled the CONFIG_SPL_FIT_SIGNATURE_KEY_DIR +option can be used to specifiy the key directory - either a relative or +absolute path. + +See signature.txt for general signature handling, but when +CONFIG_SPL_FIT_GENERATOR is used the option CONFIG_SPL_FIT_GENERATOR_KEY_HINT +can be used to specify the key-hint that should be included into the +created u-boot.its by the generator. + Example 1 -- old-style (non-FDT) kernel booting ----------------------------------------------- From patchwork Fri Jun 19 10:45:50 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Heiko Stuebner X-Patchwork-Id: 242659 List-Id: U-Boot discussion From: heiko at sntech.de (Heiko Stuebner) Date: Fri, 19 Jun 2020 12:45:50 +0200 Subject: [PATCH v4 6/6] rockchip: make_fit_atf: add signature handling In-Reply-To: <20200619104550.1972307-1-heiko@sntech.de> References: <20200619104550.1972307-1-heiko@sntech.de> Message-ID: <20200619104550.1972307-7-heiko@sntech.de> From: Heiko Stuebner If the newly added fit-generator key-options are found, append needed signature nodes to all generated image blocks, so that they can get signed when mkimage later compiles the .itb from the generated .its. Signed-off-by: Heiko Stuebner --- arch/arm/mach-rockchip/make_fit_atf.py | 57 +++++++++++++++++++++++++- 1 file changed, 56 insertions(+), 1 deletion(-) diff --git a/arch/arm/mach-rockchip/make_fit_atf.py b/arch/arm/mach-rockchip/make_fit_atf.py index d15c32b303..de7dc19d11 100755 --- a/arch/arm/mach-rockchip/make_fit_atf.py +++ b/arch/arm/mach-rockchip/make_fit_atf.py @@ -14,6 +14,14 @@ import sys import getopt import logging import struct +try: + # in python3 Cryptodome succeeds Crypto + import Cryptodome + from Cryptodome.PublicKey import RSA +except: + import Crypto + from Crypto.PublicKey import RSA + DT_HEADER = """ /* @@ -37,7 +45,9 @@ DT_UBOOT = """ arch = "arm64"; compression = "none"; load = <0x%08x>; - }; +""" + +DT_UBOOT_NODE_END = """ }; """ @@ -47,6 +57,46 @@ DT_IMAGES_NODE_END = """ }; DT_END = "};" +def append_signature(file): + if not os.path.exists("u-boot.cfg"): + return + + config = {} + with open("u-boot.cfg") as fd: + for line in fd: + line = line.strip() + values = line[8:].split(' ', 1) + if len(values) > 1: + key, value = values + value = value.strip('"') + else: + key = values[0] + value = '1' + if not key.startswith('CONFIG_'): + continue + config[key] = value + + try: + keyhint = config["CONFIG_SPL_FIT_GENERATOR_KEY_HINT"] + except KeyError: + return + + try: + keyfile = os.path.join(config["CONFIG_SPL_FIT_SIGNATURE_KEY_DIR"], keyhint) + except KeyError: + keyfile = keyhint + + if not os.path.exists('%s.key' % keyfile): + return + + f = open('%s.key' % keyfile,'r') + key = RSA.importKey(f.read()) + + file.write('\t\t\tsignature {\n') + file.write('\t\t\t\talgo = "sha256,rsa%s";\n' % key.n.bit_length()) + file.write('\t\t\t\tkey-name-hint = "%s";\n' % keyhint) + file.write('\t\t\t};\n') + def append_bl31_node(file, atf_index, phy_addr, elf_entry): # Append BL31 DT node to input FIT dts file. data = 'bl31_0x%08x.bin' % phy_addr @@ -60,6 +110,7 @@ def append_bl31_node(file, atf_index, phy_addr, elf_entry): file.write('\t\t\tload = <0x%08x>;\n' % phy_addr) if atf_index == 1: file.write('\t\t\tentry = <0x%08x>;\n' % elf_entry) + append_signature(file); file.write('\t\t};\n') file.write('\n') @@ -75,6 +126,7 @@ def append_tee_node(file, atf_index, phy_addr, elf_entry): file.write('\t\t\tcompression = "none";\n') file.write('\t\t\tload = <0x%08x>;\n' % phy_addr) file.write('\t\t\tentry = <0x%08x>;\n' % elf_entry) + append_signature(file); file.write('\t\t};\n') file.write('\n') @@ -88,6 +140,7 @@ def append_fdt_node(file, dtbs): file.write('\t\t\tdata = /incbin/("%s");\n' % dtb) file.write('\t\t\ttype = "flat_dt";\n') file.write('\t\t\tcompression = "none";\n') + append_signature(file); file.write('\t\t};\n') file.write('\n') cnt = cnt + 1 @@ -129,6 +182,8 @@ def generate_atf_fit_dts_uboot(fit_file, uboot_file_name): raise ValueError("Invalid u-boot ELF image '%s'" % uboot_file_name) index, entry, p_paddr, data = segments[0] fit_file.write(DT_UBOOT % p_paddr) + append_signature(fit_file) + fit_file.write(DT_UBOOT_NODE_END) def generate_atf_fit_dts_bl31(fit_file, bl31_file_name, tee_file_name, dtbs_file_name): segments = unpack_elf(bl31_file_name)