Change the indent field in fit_print_ctx from a string pointer to an int
number of spaces to indent.
Set the initial indent value to 3 to match IMAGE_INDENT_STRING
Drop indentation from the debug() calls since these are not visible to
users.
Co-developed-by: Claude <noreply@anthropic.com>
Signed-off-by: Simon Glass <simon.glass@canonical.com>
Move the indent string into struct fit_print_ctx so it is available to
the printing functions. This avoids having to pass it as a separate
parameter.
Co-developed-by: Claude <noreply@anthropic.com>
Signed-off-by: Simon Glass <simon.glass@canonical.com>
Create a struct fit_print_ctx to hold the FIT pointer and pass it to all
printing functions instead of passing the FIT pointer directly. This
provides a foundation for adding additional context in the future.
Co-developed-by: Claude <noreply@anthropic.com>
Signed-off-by: Simon Glass <simon.glass@canonical.com>
Remove the unused third parameter (len) from fit_get_name(). All uses of
this function pass NULL for this parameter.
Co-developed-by: Claude <noreply@anthropic.com>
Signed-off-by: Simon Glass <simon.glass@canonical.com>
Support creation of a load-only FIT (where there is no OS), with a new
--load-only option. Allow FITs to be created without an OS image.
Update the auto-generated FIT description to make this clear.
Signed-off-by: Simon Glass <sjg@chromium.org>
When using '-f auto', mkimage automatically creates a FIT given the
images. For devicetree files, FIT expects that the compatible string
from each is copied to its corresponding configuration node.
Implement this in mkimage, so far only for uncompressed devicetrees.
This requires a few more fields in struct content_info, so take this
opportunity to comment it properly.
Signed-off-by: Simon Glass <sjg@chromium.org>
This function does not actually use the 'name' argument. Drop it and use
FIT_DATA_PROP instead, to avoid confusion.
Signed-off-by: Simon Glass <sjg@chromium.org>
Support creation of a load-only FIT (where there is no OS), with a new
--load-only option. Allow FITs to be created without an OS image.
Update the auto-generated FIT description to make this clear.
Signed-off-by: Simon Glass <sjg@chromium.org>
When using '-f auto', mkimage automatically creates a FIT given the
images. For devicetree files, FIT expects that the compatible string
from each is copied to its corresponding configuration node.
Implement this in mkimage, so far only for uncompressed devicetrees.
This requires a few more fields in struct content_info, so take this
opportunity to comment it properly.
Signed-off-by: Simon Glass <sjg@chromium.org>
This function does not actually use the 'name' argument. Drop it and use
FIT_DATA_PROP instead, to avoid confusion.
Signed-off-by: Simon Glass <sjg@chromium.org>
This is not correct when building a kernel FIT, since it adds a second
loadable in addition to the kernel.
There may in fact be a bug in SPL FIT, in which case that should be
fixed, rather than adding an invalid loadable to the FIT.
This reverts commit cabde449b9.
Series-to: concept
Series-cc: heinrich
Cover-letter:
mkimage: Start to tidy up mkimage and friends
The current mkimage code is a bit messy:
- the main() function is very long
- two similarly named structs are used throughout: the first
(struct image_tool_params) is not actually just parameters, the second
(struct image_type_params) is confusingly similar
- quite a bit of FIT processing happens right at the start of main(),
which can be hard to follow
- the program calls exit() from many different places
This series renames the main structures, avoiding using the common
'params' word. It breaks up part of main() into separate functions and
starts the process of exiting in one place.
It also reverts a patch which causes an invalid 'loadables' property to
be added with '-f auto'.
More remains to be done, but this is a start.
END
Use the same 'itl' (for image-tool) whenever this parameter is passed
around. This makes it easier to recognise. Move away from using the word
'parameters', since it contains essentially all of the info about the
tool, not just parameters. Use 'info' instead.
Signed-off-by: Simon Glass <sjg@chromium.org>
The existing name is confusing since it includes state as well as
parameters. In fact it includes nearly everything known about the tool
while it is running. Rename the struct to imgtool to reflect this.
Signed-off-by: Simon Glass <sjg@chromium.org>
This function is really just getting the data. The size comes along for
the ride. In fact this function is only reliable way to obtain the data
for an image in a FIT, since the FIT may use external data.
Rename it to fit_image_get_data()
Signed-off-by: Simon Glass <sjg@chromium.org>
Open for reading as O_RDONLY instead of O_RDWR:
the only usage of the fd is for the single read() below;
this prevented
mkimage -f auto -A arm64 \
-T kernel -C lz4 -d Image-6.6.15.lz4 \
-b mt8173-elm-hana-6.6.15.dtb outf
when the inputs were unwritable.
Link: https://bugs.debian.org/1063097
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Reviewed-by: Dragan Simic <dsimic@manjaro.org>
Commit cb9faa6f98 ("tools: Use a single target-independent config to
enable OpenSSL") introduced a target-independent configuration to build
crypto features in host tools.
But since commit 2c21256b27 ("hash: Use Kconfig to enable hashing in
host tools and SPL") the build without OpenSSL is broken, due to FIT
signature/encryption features. Add missing conditional compilation
tokens to fix this.
Signed-off-by: Paul-Erwan Rio <paulerwan.rio@gmail.com>
Tested-by: Alexander Dahl <ada@thorsis.com>
Cc: Simon Glass <sjg@chromium.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Padding the header of an external FIT image is achieved by truncating
the existing temporary FIT file to match the required alignment before
appending image data. Reusing an existing file this way means that the
padding will likely contain a portion of the original data not
overwritten by the new header.
Zero out any data past the end of the new header, and stop at either
the end of the desired padding, or the end of the old FIT file,
whichever comes first.
Fixes: 7946a814a3 ("Revert "mkimage: fit: Do not tail-pad fitImage with external data"")
Signed-off-by: Roman Azarenko <roman.azarenko@iopsys.eu>
Reviewed-by: Simon Glass <sjg@chromium.org>
Make it possible for data that was externalized using a static external
position (-p) to be internalized. Enables the ability to convert
existing FIT images built with -p to be converted to a FIT image where the
data is internal, to be converted to a FIT image where the data is
external relative to the end of the FIT (-E) or change the initial
static external position to a different static external position (-p).
Removing the original external-data-related properties ensures that
they're not present after conversion. Without this, they would still be
present in the resulting FIT even if the FIT has been, for example,
internalized.
Signed-off-by: Lars Feyaerts <lars@bitbiz.be>
Reviewed-by: Simon Glass <sjg@chromium.org>
This allows image type print_header() callback to access struct
image_tool_params *params.
Signed-off-by: Pali Rohár <pali@kernel.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Extend support for signing in auto-generated (-f auto) FIT. Previously,
it was possible to get signed 'images' subnodes in the FIT using
options -g and -o together with -f auto. This patch allows signing
'configurations' subnodes instead of 'images' ones (which are hashed),
using option -f auto-conf instead of -f auto. Adding also -K <dtb> and
-r options, will add public key to <dtb> file with required = "conf"
property.
Summary:
-f auto => FIT with crc32 images
-f auto -g ... -o ... => FIT with signed images
-f auto-conf -g ... -o ... => FIT with sha1 images and signed confs
Example: FIT with kernel, two device tree files, and signed
configurations; public key (needed to verify signatures) is
added to u-boot.dtb with required = "conf" property.
mkimage -f auto-conf -A arm -O linux -T kernel -C none -a 43e00000 \
-e 0 -d vmlinuz -b /path/to/first.dtb -b /path/to/second.dtb \
-k /folder/with/key-files -g keyname -o sha256,rsa4096 \
-K u-boot.dtb -r kernel.itb
Example: Add public key with required = "conf" property to u-boot.dtb
without needing to sign anything. This will also create a useless FIT
named unused.itb.
mkimage -f auto-conf -d /dev/null -k /folder/with/key-files \
-g keyname -o sha256,rsa4096 -K u-boot.dtb -r unused.itb
Signed-off-by: Massimo Pegorer <massimo.pegorer@vimar.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Add messages to make it clearer which part of the FIT creation is failing.
This can happen when an invalid 'algo' property is provided in the .its
file.
Signed-off-by: Simon Glass <sjg@chromium.org>
This is not needed and we should avoid typedefs. Use the struct instead
and rename it to indicate that it really is a legacy struct.
Signed-off-by: Simon Glass <sjg@chromium.org>
This adds support for signing images in auto-generated FITs. To do this,
we need to add a signature node. The algorithm name property already has
its own option, but we need one for the key name hint. We could have
gone the -G route and added an explicit name for the public key (like
what is done for the private key). However, many places assume the
public key can be constructed from the key dir and hint, and I don't
want to do the refactoring necessary.
As a consequence of this, it is now easier to add public keys to an
existing image without signing something. This could be done all along,
but now you don't have to create an its just to do it. Ideally, we
wouldn't create a FIT at the end. This could be done by calling
fit_image_setup_sig/info.crypto->add_verify_data directly.
Signed-off-by: Sean Anderson <sean.anderson@seco.com>
This commit enhances mkimage to update the node
/image/pre-load/sig with the public key.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
At present mkimage displays the node information but it is not clear what
signing action was taken. Add a message that shows it. For now it only
supports showing a single signing action, since that is the common case.
Sample:
Signature written to 'sha1-basic/test.fit',
node '/configurations/conf-1/signature'
Public key written to 'sha1-basic/sandbox-u-boot.dtb',
node '/signature/key-dev'
Signed-off-by: Simon Glass <sjg@chromium.org>
This is a debug message at present, which is not very helpful. Print out
the error so that action can be taken.
Signed-off-by: Simon Glass <sjg@chromium.org>
This permits to prepare FIT image description that do not hard-code the
final choice of the signature algorithm, possibly requiring the user to
patch the sources.
When -o <algo> is specified, this information is used in favor of the
'algo' property in the signature node. Furthermore, that property is set
accordingly when writing the image.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
fit_extract_contents does a fit_check_format even thought it was already
checked during imagetool_verify_print_header.
Therefore, this check is not necessary. This commit removes the
redundancy.
Signed-off-by: Stefan Eichenberger <eichest@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
It's not always desirable to use 'keydir' and some ad-hoc heuristics
to get the filename of the signing key. More often, just passing the
filename is the simpler, easier, and logical thing to do.
Since mkimage doesn't use long options, we're slowly running out of
letters. I've chosen '-G' because it was available.
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
At present this function does not accept a size for the FIT. This means
that it must be read from the FIT itself, introducing potential security
risk. Update the function to include a size parameter, which can be
invalid, in which case fit_check_format() calculates it.
For now no callers pass the size, but this can be updated later.
Also adjust the return value to an error code so that all the different
types of problems can be distinguished by the user.
Signed-off-by: Simon Glass <sjg@chromium.org>
Reported-by: Bruce Monroe <bruce.monroe@intel.com>
Reported-by: Arie Haenel <arie.haenel@intel.com>
Reported-by: Julien Lenoir <julien.lenoir@intel.com>
The external data is located after the mmapped FDT pointed to by
'old_fdt', not in the newly created FDT we are importing into at 'fdt'.
Signed-off-by: Patrick Oppenlander <patrick.oppenlander@gmail.com>
Vagrant Cascadian reported that mx6cuboxi target no longer builds
reproducibility on Debian.
One example of builds mismatches:
00096680: 696e 6700 736f 756e 642d 6461 6900 6465 ing.sound-dai.de
-00096690: 7465 6374 2d67 7069 6f73 0000 tect-gpios..
+00096690: 7465 6374 2d67 7069 6f73 0061 tect-gpios.a
This problem happens because all the buffers in fit_image.c are
allocated via malloc(), which does not zero out the allocated buffer.
Using calloc() fixes this unpredictable behaviour as it guarantees
that the allocated buffer are zero initialized.
Reported-by: Vagrant Cascadian <vagrant@reproducible-builds.org>
Suggested-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Tested-by: Vagrant Cascadian <vagrant@reproducible-builds.org>
Normally the FIT timestamp is created the first time mkimage is run on a
FIT, when converting the source .its to the binary .fit file. This
corresponds to using the -f flag. But if the original input to mkimage is
a binary file (already compiled) then the timestamp is assumed to have
been set previously.
Add a -t flag to allow setting the timestamp in this case.
Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Normally the FIT timestamp is created the first time mkimage is run on a
FIT, when converting the source .its to the binary .fit file. This
corresponds to using the -f flag. But if the original input to mkimage is
a binary file (already compiled) then the timestamp is assumed to have
been set previously.
Add a -t flag to allow setting the timestamp in this case.
Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
This option currently does not add any sort of hash to the images in the
FIT.
Add a hash node requesting a crc32 checksum, which at least provides some
protection.
The crc32 value is easily ignored (e.g. in SPL) if not needed. and takes
up only about 48 bytes per image, including overhead.
Suggested-by: Wolfgang Denk <wd@denx.de>
Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Wolfgang Denk <wd@denx.de>
This has been reported to break booting of U-Boot from SPL on a number
of platforms due to a lack of alignment of the external data. The
issues this commit is addressing will need to be resolved another way.
Re-introduce a data leak in the padding for now.
This reverts commit 20a154f95b.
Reported-by: Alex Kiernan <alex.kiernan@gmail.com>
Reported-by: Michael Walle <michael@walle.cc>
Tested-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
There is no reason to tail-pad fitImage with external data to 4-bytes,
while fitImage without external data does not have any such padding and
is often unaligned. DT spec also does not mandate any such padding.
Moreover, the tail-pad fills the last few bytes with uninitialized data,
which could lead to a potential information leak.
$ echo -n xy > /tmp/data ; \
./tools/mkimage -E -f auto -d /tmp/data /tmp/fitImage ; \
hexdump -vC /tmp/fitImage | tail -n 3
before:
00000260 61 2d 6f 66 66 73 65 74 00 64 61 74 61 2d 73 69 |a-offset.data-si|
00000270 7a 65 00 00 78 79 64 64 |ze..xydd|
^^ ^^ ^^
after:
00000260 61 2d 6f 66 66 73 65 74 00 64 61 74 61 2d 73 69 |a-offset.data-si|
00000270 7a 65 00 78 79 |ze.xy|
Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Tom Rini <trini@konsulko.com>
If given ptr to free() is NULL, no operation is performed.
Hence we can just free buf directly in fit_extract_data().
Signed-off-by: Bin Meng <bin.meng@windriver.com>
Without calling munmap(), the follow-up call to open() the same file
with a flag O_TRUNC seems not to cause any issue on Linux, but it fails
on Windows with error like below:
Can't open kernel_fdt.itb.tmp: Permission denied
Fix this by unmapping the memory before closing fd in fit_import_data().
Signed-off-by: Lihua Zhao <lihua.zhao@windriver.com>
Signed-off-by: Bin Meng <bin.meng@windriver.com>
The image is usually stored in block device like emmc, SD card, make the
offset of image data aligned to block(512 byte) can avoid data copy
during boot process.
eg. SPL boot from FIT image with external data:
- SPL read the first block of FIT image, and then parse the header;
- SPL read image data separately;
- The first image offset is the base_offset which is the header size;
- The second image offset is just after the first image;
- If the offset of imge does not aligned, SPL will do memcpy;
The header size is a ramdon number, which is very possible not aligned, so
add '-B size'to specify the align size in hex for better performance.
example usage:
./tools/mkimage -E -f u-boot.its -B 0x200 u-boot.itb
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
Reviewed-by: Punit Agrawal <punit1.agrawal@toshiba.co.jp>
Reviewed-by: Tom Rini <trini@konsulko.com>
commit 7298e42250 ("mkimage: fit: add support to encrypt image with
aes") added a new copyfile() function as part of the FIT image creation
flow. This function as currently written creates the final image with a
mode of 0700 (before umask), differing from the old behavior of 0666.
Since there doesn't seem to be any reason to make the image executable
or non-group, non-other readable, change the mask to 0666 to preserve
the old behavior.
Fixes: 7298e42250 ("mkimage: fit: add support to encrypt image with aes")
Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
This commit add the support of encrypting image with aes
in mkimage. To enable the ciphering, a node cipher with
a reference to a key and IV (Initialization Vector) must
be added to the its file. Then mkimage add the encrypted
image to the FIT and add the key and IV to the u-boot
device tree.
Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
fit_check_params() wants at least two of dflag, fflag, and lflag set.
Simplify the logical constraint checking this.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
This is very similar to fit_image_get_data but has the benefit of working
on FIT images with external data unlike fit_image_get_data. This is
useful for extracting sub-images from type of FIT image as this would
previously just silently fail. Add an error message also so if this
still fails it is easier to find out why.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Reviewed-by: Lokesh Vutla <lokeshvutla@ti.com>
