[PATCH v3 1/2] mkimage: Document more misc options

[PATCH v3 1/2] mkimage: Document more misc options

[Sean Anderson]

Document -G and the secondary image types which can be used with -R.
Also reword the documentation of -s for clarity.

Signed-off-by: Sean Anderson <sean.anderson@seco.com>
---

Changes in v3:
- Rebased onto u-boot/master, as v1 was applied instead of v2
- Reworded commit message to reflect this

Changes in v2:
- Document secondary image types
- Move -G directly after -k
- Reword documentation for -s

 doc/mkimage.1 | 33 +++++++++++++++++++++++++++++++--
 1 file changed, 31 insertions(+), 2 deletions(-)

diff --git a/doc/mkimage.1 b/doc/mkimage.1
index c92e133732..878db90475 100644
--- a/doc/mkimage.1
+++ b/doc/mkimage.1
@@ -99,6 +99,30 @@ Set image name to 'image name'.
 .BI "\-R [" "secondary image name" "]"
 Some image types support a second image for additional data. For these types,
 use \-R to specify this second image.
+.TS
+allbox;
+lb lbx
+l l.
+Image Type	Secondary Image Description
+pblimage	Additional RCW-style header, typically used for PBI commands.
+zynqimage, zynqmpimage	T{
+Initialization parameters, one per line. Each parameter has the form
+.sp
+.ti 4
+.I address data
+.sp
+where
+.I address
+and
+.I data
+are hexadecimal integers. The boot ROM will write each
+.I data
+to
+.I address
+when loading the image. At most 256 parameters may be specified in this
+manner.
+T}
+.TE
 
 .TP
 .BI "\-d [" "image data file" "]"
@@ -110,8 +134,8 @@ Set XIP (execute in place) flag.
 
 .TP
 .BI "\-s"
-Create an image with no data. The header will be created, but the image itself
-will not contain data (such as U-Boot or any specified kernel).
+Don't copy in the image data. Depending on the image type, this may create
+just the header, everything but the image data, or nothing at all.
 
 .TP
 .BI "\-v"
@@ -176,6 +200,11 @@ Specifies the directory containing keys to use for signing. This directory
 should contain a private key file <name>.key for use with signing and a
 certificate <name>.crt (containing the public key) for use with verification.
 
+.TP
+.BI "\-G [" "key_file" "]"
+Specifies the private key file to use when signing. This option may be used
+instead of \-k.
+
 .TP
 .BI "\-K [" "key_destination" "]"
 Specifies a compiled device tree binary file (typically .dtb) to write
-- 
2.35.1.1320.gc452695387.dirty

[PATCH v3 2/2] mkimage: Support signing 'auto' FITs

[Sean Anderson]

This adds support for signing images in auto-generated FITs. To do this,
we need to add a signature node. The algorithm name property already has
its own option, but we need one for the key name hint. We could have
gone the -G route and added an explicit name for the public key (like
what is done for the private key). However, many places assume the
public key can be constructed from the key dir and hint, and I don't
want to do the refactoring necessary.

As a consequence of this, it is now easier to add public keys to an
existing image without signing something. This could be done all along,
but now you don't have to create an its just to do it. Ideally, we
wouldn't create a FIT at the end. This could be done by calling
fit_image_setup_sig/info.crypto->add_verify_data directly.

Signed-off-by: Sean Anderson <sean.anderson@seco.com>
---

(no changes since v1)

 doc/mkimage.1     | 24 ++++++++++++++++++++++++
 tools/fit_image.c | 41 ++++++++++++++++++++++++++++++++++-------
 tools/imagetool.h |  1 +
 tools/mkimage.c   |  5 ++++-
 4 files changed, 63 insertions(+), 8 deletions(-)

diff --git a/doc/mkimage.1 b/doc/mkimage.1
index 878db90475..759dc2d12f 100644
--- a/doc/mkimage.1
+++ b/doc/mkimage.1
@@ -218,6 +218,13 @@ CONFIG_OF_CONTROL in U-Boot.
 Specifies the private key file to use when signing. This option may be used
 instead of \-k.
 
+.TP
+.BI "\-g [" "key_name_hint" "]"
+Sets the key-name-hint property when used with \-f auto. This is the <name>
+part of the key. The directory part is set by \-k. This option also indicates
+that the images included in the FIT should be signed. If this option is
+specified, \-o must be specified as well.
+
 .TP
 .BI "\-o [" "signing algorithm" "]"
 Specifies the algorithm to be used for signing a FIT image. The default is
@@ -278,6 +285,15 @@ skipping those for which keys cannot be found. Also add a comment.
 .B -c """Kernel 3.8 image for production devices""" kernel.itb
 .fi
 
+.P
+Add public keys to u-boot.dtb without needing a FIT to sign. This will also
+create a FIT containing an images node with no data named unused.itb.
+.nf
+.B mkimage -f auto -d /dev/null -k /public/signing-keys -g dev \\\\
+.br
+.B -o sha256,rsa2048 -K u-boot.dtb unused.itb
+.fi
+
 .P
 Update an existing FIT image, signing it with additional keys.
 Add corresponding public keys into u-boot.dtb. This will resign all images
@@ -306,6 +322,14 @@ automatic mode. No .its file is required.
 .B -c """Kernel 4.4 image for production devices""" -d vmlinuz \\\\
 .B -b /path/to/rk3288-firefly.dtb -b /path/to/rk3288-jerry.dtb kernel.itb
 .fi
+.P
+Create a FIT image containing a signed kernel, using automatic mode. No .its
+file is required.
+.nf
+.B mkimage -f auto -A arm -O linux -T kernel -C none -a 43e00000 -e 0 \\\\
+.br
+.B -d vmlinuz -k /secret/signing-keys -g dev -o sha256,rsa2048 kernel.itb
+.fi
 
 .SH HOMEPAGE
 http://www.denx.de/wiki/U-Boot/WebHome
diff --git a/tools/fit_image.c b/tools/fit_image.c
index 0d5a6a28f9..48fc1f5579 100644
--- a/tools/fit_image.c
+++ b/tools/fit_image.c
@@ -199,15 +199,36 @@ static void get_basename(char *str, int size, const char *fname)
 }
 
 /**
- * add_crc_node() - Add a hash node to request a CRC checksum for an image
+ * add_hash_node() - Add a hash or signature node
  *
+ * @params: Image parameters
  * @fdt: Device tree to add to (in sequential-write mode)
+ *
+ * If there is a key name hint, try to sign the images. Otherwise, just add a
+ * CRC.
+ *
+ * Return: 0 on success, or -1 on failure
  */
-static void add_crc_node(void *fdt)
+static int add_hash_node(struct image_tool_params *params, void *fdt)
 {
-	fdt_begin_node(fdt, "hash-1");
-	fdt_property_string(fdt, FIT_ALGO_PROP, "crc32");
+	if (params->keyname) {
+		if (!params->algo_name) {
+			fprintf(stderr,
+				"%s: Algorithm name must be specified\n",
+				params->cmdname);
+			return -1;
+		}
+
+		fdt_begin_node(fdt, "signature-1");
+		fdt_property_string(fdt, FIT_ALGO_PROP, params->algo_name);
+		fdt_property_string(fdt, FIT_KEY_HINT, params->keyname);
+	} else {
+		fdt_begin_node(fdt, "hash-1");
+		fdt_property_string(fdt, FIT_ALGO_PROP, "crc32");
+	}
+
 	fdt_end_node(fdt);
+	return 0;
 }
 
 /**
@@ -248,7 +269,9 @@ static int fit_write_images(struct image_tool_params *params, char *fdt)
 	ret = fdt_property_file(params, fdt, FIT_DATA_PROP, params->datafile);
 	if (ret)
 		return ret;
-	add_crc_node(fdt);
+	ret = add_hash_node(params, fdt);
+	if (ret)
+		return ret;
 	fdt_end_node(fdt);
 
 	/* Now the device tree files if available */
@@ -271,7 +294,9 @@ static int fit_write_images(struct image_tool_params *params, char *fdt)
 				    genimg_get_arch_short_name(params->arch));
 		fdt_property_string(fdt, FIT_COMP_PROP,
 				    genimg_get_comp_short_name(IH_COMP_NONE));
-		add_crc_node(fdt);
+		ret = add_hash_node(params, fdt);
+		if (ret)
+			return ret;
 		fdt_end_node(fdt);
 	}
 
@@ -289,7 +314,9 @@ static int fit_write_images(struct image_tool_params *params, char *fdt)
 					params->fit_ramdisk);
 		if (ret)
 			return ret;
-		add_crc_node(fdt);
+		ret = add_hash_node(params, fdt);
+		if (ret)
+			return ret;
 		fdt_end_node(fdt);
 	}
 
diff --git a/tools/imagetool.h b/tools/imagetool.h
index 05dd94d108..ca7c2e48ba 100644
--- a/tools/imagetool.h
+++ b/tools/imagetool.h
@@ -71,6 +71,7 @@ struct image_tool_params {
 	const char *keydir;	/* Directory holding private keys */
 	const char *keydest;	/* Destination .dtb for public key */
 	const char *keyfile;	/* Filename of private or public key */
+	const char *keyname;	/* Key name "hint" */
 	const char *comment;	/* Comment to add to signature node */
 	/* Algorithm name to use for hashing/signing or NULL to use the one
 	 * specified in the its */
diff --git a/tools/mkimage.c b/tools/mkimage.c
index 5c6a60e851..0e1198b411 100644
--- a/tools/mkimage.c
+++ b/tools/mkimage.c
@@ -119,6 +119,7 @@ static void usage(const char *msg)
 		"Signing / verified boot options: [-k keydir] [-K dtb] [ -c <comment>] [-p addr] [-r] [-N engine]\n"
 		"          -k => set directory containing private keys\n"
 		"          -K => write public keys to this .dtb file\n"
+		"          -g => set key name hint\n"
 		"          -G => use this signing key (in lieu of -k)\n"
 		"          -c => add comment in signature node\n"
 		"          -F => re-sign existing FIT image\n"
@@ -163,7 +164,7 @@ static void process_args(int argc, char **argv)
 	int opt;
 
 	while ((opt = getopt(argc, argv,
-		   "a:A:b:B:c:C:d:D:e:Ef:FG:k:i:K:ln:N:p:o:O:rR:qstT:vVx")) != -1) {
+		   "a:A:b:B:c:C:d:D:e:Ef:Fg:G:k:i:K:ln:N:p:o:O:rR:qstT:vVx")) != -1) {
 		switch (opt) {
 		case 'a':
 			params.addr = strtoull(optarg, &ptr, 16);
@@ -239,6 +240,8 @@ static void process_args(int argc, char **argv)
 			params.type = IH_TYPE_FLATDT;
 			params.fflag = 1;
 			break;
+		case 'g':
+			params.keyname = optarg;
 		case 'G':
 			params.keyfile = optarg;
 			break;
-- 
2.35.1.1320.gc452695387.dirty

Re: [PATCH v3 1/2] mkimage: Document more misc options

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 298 bytes --]

On Mon, May 16, 2022 at 04:11:07PM -0400, Sean Anderson wrote:

> Document -G and the secondary image types which can be used with -R.
> Also reword the documentation of -s for clarity.
> 
> Signed-off-by: Sean Anderson <sean.anderson@seco.com>

Applied to u-boot/next, thanks!

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

Re: [PATCH v3 2/2] mkimage: Support signing 'auto' FITs

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 1003 bytes --]

On Mon, May 16, 2022 at 04:11:08PM -0400, Sean Anderson wrote:

> This adds support for signing images in auto-generated FITs. To do this,
> we need to add a signature node. The algorithm name property already has
> its own option, but we need one for the key name hint. We could have
> gone the -G route and added an explicit name for the public key (like
> what is done for the private key). However, many places assume the
> public key can be constructed from the key dir and hint, and I don't
> want to do the refactoring necessary.
> 
> As a consequence of this, it is now easier to add public keys to an
> existing image without signing something. This could be done all along,
> but now you don't have to create an its just to do it. Ideally, we
> wouldn't create a FIT at the end. This could be done by calling
> fit_image_setup_sig/info.crypto->add_verify_data directly.
> 
> Signed-off-by: Sean Anderson <sean.anderson@seco.com>

Applied to u-boot/next, thanks!

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]