December 2019 - U-Boot

[PATCH] arm: omap: fix MPU DPLL divisor for 800MHz clock
by Dario Binacchi 20 Jan '20

20 Jan '20

In locked condition CLKOUT = CLKINP * [M / (N + 1)]. Signed-off-by: Dario Binacchi <dariobin(a)libero.it> --- arch/arm/mach-omap2/am33xx/clock_am33xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm/mach-omap2/am33xx/clock_am33xx.c b/arch/arm/mach-omap2/am33xx/clock_am33xx.c index 32cdf63e3d..f2cd496607 100644 --- a/arch/arm/mach-omap2/am33xx/clock_am33xx.c +++ b/arch/arm/mach-omap2/am33xx/clock_am33xx.c @@ -77,7 +77,7 @@ const struct dpll_params dpll_mpu_opp[NUM_CRYSTAL_FREQ][NUM_OPPS] = { {-1, -1, -1, -1, -1, -1, -1}, /* OPP RESERVED */ {25, 0, 1, -1, -1, -1, -1}, /* OPP 100 */ {30, 0, 1, -1, -1, -1, -1}, /* OPP 120 */ - {100, 3, 1, -1, -1, -1, -1}, /* OPP TB */ + {100, 2, 1, -1, -1, -1, -1}, /* OPP TB */ {125, 2, 1, -1, -1, -1, -1} /* OPP NT */ }, { /* 25 MHz */ -- 2.24.0

2 1

[PATCH v2 0/8] AM654: Add USB support
by Vignesh Raghavendra 20 Jan '20

20 Jan '20

This series adds USB support for AM654 SoC that has DWC3 USB controller. Patch 1 adds new compatible for DWC3 driver. Patch 2 and 3 adds PHY related changes and remaining patches add DT and configs related to USB host,device and DFU support. v2: Rebase onto the latest master Collect Reviewed-bys Vignesh Raghavendra (8): dwc3-generic: Add support for AM654 USB controller phy: omap-usb2-phy: Fix warnings when built for ARM64 phy: omap-usb2-phy: Add support for AM654 USB2 PHY arm: dts: k3-am65-main: add USB support arm: dts: k3-am654-base-board: enable USB1 configs: am65x_evm: Add DFU related env variables am65x_evm_a53_defconfig: Enable configs to support USB and DFU configs: am65x_evm: Enable USB keyboard as second stdin arch/arm/dts/k3-am65-main.dtsi | 78 ++++++++++++++++++++ arch/arm/dts/k3-am654-base-board-u-boot.dtsi | 4 + arch/arm/dts/k3-am654-base-board.dts | 28 +++++++ configs/am65x_evm_a53_defconfig | 22 ++++++ drivers/phy/omap-usb2-phy.c | 22 +++++- drivers/usb/dwc3/dwc3-generic.c | 1 + include/configs/am65x_evm.h | 11 ++- 7 files changed, 162 insertions(+), 4 deletions(-) -- 2.24.0

2 9

[PATCH v4 00/10] dma: ti: k3-udma: Add support for J721e
by Vignesh Raghavendra 20 Jan '20

20 Jan '20

This series adds DMA support for J721e using exist K3 UDMA driver. One main change is thati, on J721e, DMA resources such as DMA channels are shared between different entities running on different cores of the SoC. Therefore, U-Boot running on A72 core should request range of resources allocated to it from centralized resource management core (DMSC) and use only the allocated resource. First two patches adds support for dynamically querying and using allocated resources. Remaining patches fix issues when using UDMA driver on a 32 bit core like R5. Last patch adds a new compatible for J721e v4: Rebase onto latest master and fix a compliation error due to recent changes in master. v3: Address comments by Grygorii and add R-by Vignesh Raghavendra (10): lib: Import few bitmap functions from Linux dma: ti: k3-udma: Query DMA channels allocated from Resource Manager soc: ti: k3-navss-ringacc: Flush/invalidate caches on ring push/pop soc: ti: k3-navss-ringacc: Get SYSFW reference from DT phandle dma: ti: k3-udma: Remove coherency check for cache ops dma: ti: k3-udma: Fix debug prints during enabling MEM_TO_DEV transfers dma: ti: k3-udma: Switch to exposed ring mode dma: ti: k3-udma: Fix ring push operation for 32 bit cores dma: ti: k3-udma: Fix build warnings when building for 32 bit platforms dma: ti: k3-udma: Add new compatible to J721e drivers/dma/ti/k3-udma.c | 365 ++++++++++++++++++++---------- drivers/soc/ti/k3-navss-ringacc.c | 14 +- include/linux/bitmap.h | 133 +++++++++++ include/linux/bitops.h | 12 + 4 files changed, 404 insertions(+), 120 deletions(-) -- 2.24.0

2 11

[U-Boot] [PATCH] ARM: dts: da850-lcdk: Update DTS files for SPL device tree support
by Adam Ford 20 Jan '20

20 Jan '20

Currently, the da850-lcdk uses SPL_OF_PLATDATA and manually loads the necessary source code instead of using the auto-generated, because the drivers don't properly autogenerate the code. This patch simply enables the various device tree options to mimic the da850-evm which doesn't need or use OF_PLATDATA for device tree support. It does not disable OF_PLATDATA. Signed-off-by: Adam Ford <aford173(a)gmail.com> diff --git a/arch/arm/dts/da850-lcdk-u-boot.dtsi b/arch/arm/dts/da850-lcdk-u-boot.dtsi index 541f4ca200..b372d06ca9 100644 --- a/arch/arm/dts/da850-lcdk-u-boot.dtsi +++ b/arch/arm/dts/da850-lcdk-u-boot.dtsi @@ -8,9 +8,23 @@ / { aliases { i2c0 = &i2c0; + mmc0 = &mmc0; + serial2 = &serial2; + }; + + soc@1c00000 { + u-boot,dm-spl; }; nand { compatible = "ti,davinci-nand"; }; }; + +&mmc0 { + u-boot,dm-spl; +}; + +&serial2 { + u-boot,dm-spl; +}; diff --git a/arch/arm/dts/da850-lcdk.dts b/arch/arm/dts/da850-lcdk.dts index 0177e3ed20..db8ae566f3 100644 --- a/arch/arm/dts/da850-lcdk.dts +++ b/arch/arm/dts/da850-lcdk.dts @@ -18,7 +18,7 @@ }; chosen { - stdout-path = "serial2:115200n8"; + stdout-path = &serial2; }; memory@c0000000 { -- 2.20.1

3 2

[U-Boot] [PATCH] thermal: ti-bandgap: Fix adc value datatype
by Faiz Abbas 20 Jan '20

20 Jan '20

The CORE_TEMP_SENSOR_MPU register gives a raw adc value which needs to be indexed into a lookup table to get the actual temperature. Fix the naming and datatype of the adc value variable. Signed-off-by: Faiz Abbas <faiz_abbas(a)ti.com> --- drivers/thermal/ti-bandgap.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/thermal/ti-bandgap.c b/drivers/thermal/ti-bandgap.c index b490391e96..8b332f116c 100644 --- a/drivers/thermal/ti-bandgap.c +++ b/drivers/thermal/ti-bandgap.c @@ -26,7 +26,7 @@ struct ti_bandgap { ulong base; - int temperature; /* in mili degree celsius */ + uint adc_val; }; /* @@ -162,8 +162,8 @@ static int ti_bandgap_get_temp(struct udevice *dev, int *temp) { struct ti_bandgap *bgp = dev_get_priv(dev); - bgp->temperature = 0x3ff & readl(bgp->base + CTRL_CORE_TEMP_SENSOR_MPU); - *temp = dra752_adc_to_temp[bgp->temperature - DRA752_ADC_START_VALUE]; + bgp->adc_val = 0x3ff & readl(bgp->base + CTRL_CORE_TEMP_SENSOR_MPU); + *temp = dra752_adc_to_temp[bgp->adc_val - DRA752_ADC_START_VALUE]; return 0; } -- 2.19.2

2 1

[U-Boot] [PATCH 0/4] J721e: Add USB support
by Vignesh Raghavendra 20 Jan '20

20 Jan '20

Add USB support for J721e SoC. First patch fixes a compile issue with Cadence USB driver. Rest of the patches add env, DT and configs related to USB. Vignesh Raghavendra (4): usb: cdns3: Fix include file path environment: ti: Add DFU environment variables k3_dfu.h arm: dts: k3-j721e: Add DT nodes for USB configs: j721e_evm_a72_defconfig: Enable USB related configs .../k3-j721e-common-proc-board-u-boot.dtsi | 14 ++++ arch/arm/dts/k3-j721e-common-proc-board.dts | 37 ++++++++++ arch/arm/dts/k3-j721e-main.dtsi | 70 +++++++++++++++++++ .../arm/dts/k3-j721e-r5-common-proc-board.dts | 7 ++ configs/j721e_evm_a72_defconfig | 28 ++++++++ drivers/usb/cdns3/core.c | 2 +- drivers/usb/cdns3/host.c | 2 +- include/configs/j721e_evm.h | 10 +++ include/environment/ti/k3_dfu.h | 46 ++++++++++++ 9 files changed, 214 insertions(+), 2 deletions(-) create mode 100644 include/environment/ti/k3_dfu.h -- 2.24.0

3 8

[U-Boot] [PATCH] ARM: reset: use do_reset in SPL/TPL if SYSRESET was not enabled for them
by Claudius Heine 19 Jan '20

19 Jan '20

In case CONFIG_SYSRESET is set, do_reset from reset.c will not be available anywere, even if SYSRESET is disabled for SPL/TPL. 'do_reset' is called from SPL for instance from the panic handler and PANIC_HANG is not set Signed-off-by: Claudius Heine <ch(a)denx.de> --- arch/arm/lib/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm/lib/Makefile b/arch/arm/lib/Makefile index 9de9a9acee..7bf2c077ba 100644 --- a/arch/arm/lib/Makefile +++ b/arch/arm/lib/Makefile @@ -56,7 +56,7 @@ obj-y += interrupts_64.o else obj-y += interrupts.o endif -ifndef CONFIG_SYSRESET +ifndef CONFIG_$(SPL_TPL_)SYSRESET obj-y += reset.o endif -- 2.21.0

7 16

[PATCH 1/2] mkimage: fit: add support to encrypt image with aes
by Philippe Reynes 17 Jan '20

17 Jan '20

This commit add the support of encrypting image with aes in mkimage. To enable the ciphering, a node cipher with a reference to a key and IV (Initialization Vector) must be added to the its file. Then mkimage add the encrypted image to the FIT and add the key and IV to the u-boot device tree. Signed-off-by: Philippe Reynes <philippe.reynes(a)softathome.com> --- Kconfig | 8 ++ common/Makefile | 1 + common/image-cipher.c | 63 +++++++++++ common/image-fit.c | 27 +++++ include/image.h | 63 +++++++++++ include/u-boot/aes.h | 31 ++++++ lib/aes/aes-encrypt.c | 136 +++++++++++++++++++++++ tools/Makefile | 14 ++- tools/fit_image.c | 83 +++++++++++++- tools/image-host.c | 292 ++++++++++++++++++++++++++++++++++++++++++++++++++ 10 files changed, 716 insertions(+), 2 deletions(-) create mode 100644 common/image-cipher.c create mode 100644 include/u-boot/aes.h create mode 100644 lib/aes/aes-encrypt.c diff --git a/Kconfig b/Kconfig index 92fc4fc..13e2c6c 100644 --- a/Kconfig +++ b/Kconfig @@ -383,6 +383,14 @@ config FIT_ENABLE_RSASSA_PSS_SUPPORT Enable this to support the pss padding algorithm as described in the rfc8017 (https://tools.ietf.org/html/rfc8017). +config FIT_CIPHER + bool "Enable ciphering data in a FIT uImages" + depends on DM + select AES + help + Enable the feature of data ciphering/unciphering in the tool mkimage + and in the u-boot support of the FIT image. + config FIT_VERBOSE bool "Show verbose messages when FIT images fail" help diff --git a/common/Makefile b/common/Makefile index 302d8be..a02b073 100644 --- a/common/Makefile +++ b/common/Makefile @@ -113,6 +113,7 @@ obj-$(CONFIG_$(SPL_TPL_)OF_LIBFDT) += image-fdt.o obj-$(CONFIG_$(SPL_TPL_)FIT) += image-fit.o obj-$(CONFIG_$(SPL_)MULTI_DTB_FIT) += boot_fit.o common_fit.o obj-$(CONFIG_$(SPL_TPL_)FIT_SIGNATURE) += image-sig.o +obj-$(CONFIG_$(SPL_TPL_)FIT_CIPHER) += image-cipher.o obj-$(CONFIG_IO_TRACE) += iotrace.o obj-y += memsize.o obj-y += stdio.o diff --git a/common/image-cipher.c b/common/image-cipher.c new file mode 100644 index 0000000..ab8b45b --- /dev/null +++ b/common/image-cipher.c @@ -0,0 +1,63 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright (c) 2019, Softathome + */ + +#ifdef USE_HOSTCC +#include "mkimage.h" +#include <time.h> +#else +#include <common.h> +#include <malloc.h> +DECLARE_GLOBAL_DATA_PTR; +#endif /* !USE_HOSTCC*/ +#include <image.h> +#include <uboot_aes.h> +#include <u-boot/aes.h> + +struct cipher_algo cipher_algos[] = { + { + .name = "aes128", + .key_len = AES128_KEY_LENGTH, + .iv_len = AES_BLOCK_LENGTH, +#if IMAGE_ENABLE_ENCRYPT + .calculate_type = EVP_aes_128_cbc, +#endif + .encrypt = image_aes_encrypt, + .add_cipher_data = image_aes_add_cipher_data + }, + { + .name = "aes192", + .key_len = AES192_KEY_LENGTH, + .iv_len = AES_BLOCK_LENGTH, +#if IMAGE_ENABLE_ENCRYPT + .calculate_type = EVP_aes_192_cbc, +#endif + .encrypt = image_aes_encrypt, + .add_cipher_data = image_aes_add_cipher_data + }, + { + .name = "aes256", + .key_len = AES256_KEY_LENGTH, + .iv_len = AES_BLOCK_LENGTH, +#if IMAGE_ENABLE_ENCRYPT + .calculate_type = EVP_aes_256_cbc, +#endif + .encrypt = image_aes_encrypt, + .add_cipher_data = image_aes_add_cipher_data + } +}; + +struct cipher_algo *image_get_cipher_algo(const char *full_name) +{ + int i; + const char *name; + + for (i = 0; i < ARRAY_SIZE(cipher_algos); i++) { + name = cipher_algos[i].name; + if (!strncmp(name, full_name, strlen(name))) + return &cipher_algos[i]; + } + + return NULL; +} diff --git a/common/image-fit.c b/common/image-fit.c index c52f945..a06760e 100644 --- a/common/image-fit.c +++ b/common/image-fit.c @@ -1080,6 +1080,33 @@ static int fit_image_hash_get_ignore(const void *fit, int noffset, int *ignore) return 0; } +/** + * fit_image_cipher_get_algo - get cipher algorithm name + * @fit: pointer to the FIT format image header + * @noffset: cipher node offset + * @algo: double pointer to char, will hold pointer to the algorithm name + * + * fit_image_cipher_get_algo() finds cipher algorithm property in a given + * cipher node. If the property is found its data start address is returned + * to the caller. + * + * returns: + * 0, on success + * -1, on failure + */ +int fit_image_cipher_get_algo(const void *fit, int noffset, char **algo) +{ + int len; + + *algo = (char *)fdt_getprop(fit, noffset, FIT_ALGO_PROP, &len); + if (!*algo) { + fit_get_debug(fit, noffset, FIT_ALGO_PROP, len); + return -1; + } + + return 0; +} + ulong fit_get_end(const void *fit) { return map_to_sysmem((void *)(fit + fdt_totalsize(fit))); diff --git a/include/image.h b/include/image.h index f4d2aaf..14a9a5b 100644 --- a/include/image.h +++ b/include/image.h @@ -929,6 +929,10 @@ int booti_setup(ulong image, ulong *relocated_addr, ulong *size, #define FIT_IGNORE_PROP "uboot-ignore" #define FIT_SIG_NODENAME "signature" +/* cipher node */ +#define FIT_CIPHER_NODENAME "cipher" +#define FIT_ALGO_PROP "algo" + /* image node */ #define FIT_DATA_PROP "data" #define FIT_DATA_POSITION_PROP "data-position" @@ -1027,6 +1031,10 @@ int fit_image_hash_get_value(const void *fit, int noffset, uint8_t **value, int fit_set_timestamp(void *fit, int noffset, time_t timestamp); +int fit_cipher_data(const char *keydir, void *keydest, void *fit, + const char *comment, int require_keys, + const char *engine_id, const char *cmdname); + /** * fit_add_verification_data() - add verification data to FIT image nodes * @@ -1137,6 +1145,7 @@ struct image_sign_info { const char *require_keys; /* Value for 'required' property */ const char *engine_id; /* Engine to use for signing */ }; + #endif /* Allow struct image_region to always be defined for rsa.h */ /* A part of an image, used for hashing */ @@ -1309,6 +1318,60 @@ static inline int fit_image_check_target_arch(const void *fdt, int node) #endif } +/* + * At present we only support ciphering on the host, and unciphering on the + * device + */ +#if defined(USE_HOSTCC) +# if defined(CONFIG_FIT_CIPHER) +# define IMAGE_ENABLE_ENCRYPT 1 +# define IMAGE_ENABLE_DECRYPT 1 +# include <openssl/evp.h> +# else +# define IMAGE_ENABLE_ENCRYPT 0 +# define IMAGE_ENABLE_DECRYPT 0 +# endif +#else +# define IMAGE_ENABLE_ENCRYPT 0 +# define IMAGE_ENABLE_DECRYPT CONFIG_IS_ENABLED(FIT_CIPHER) +#endif + +/* Information passed to the ciphering routines */ +struct image_cipher_info { + const char *keydir; /* Directory containing keys */ + const char *keyname; /* Name of key to use */ + const char *ivname; /* Name of IV to use */ + const void *fit; /* Pointer to FIT blob */ + int node_noffset; /* Offset of the cipher node */ + const char *name; /* Algorithm name */ + struct cipher_algo *cipher; /* Cipher algorithm information */ + const void *fdt_blob; /* FDT containing key and IV */ + const void *key; /* Value of the key */ + const void *iv; /* Value of the IV */ + size_t size_unciphered; /* Size of the unciphered data */ +}; + +struct cipher_algo { + const char *name; /* Name of algorithm */ + int key_len; /* Length of the key */ + int iv_len; /* Length of the IV */ + +#if IMAGE_ENABLE_ENCRYPT + const EVP_CIPHER * (*calculate_type)(void); +#endif + + int (*encrypt)(struct image_cipher_info *info, + const unsigned char *data, int data_len, + unsigned char **cipher, int *cipher_len); + + int (*add_cipher_data)(struct image_cipher_info *info, + void *keydest); +}; + +int fit_image_cipher_get_algo(const void *fit, int noffset, char **algo); + +struct cipher_algo *image_get_cipher_algo(const char *full_name); + #ifdef CONFIG_FIT_VERBOSE #define fit_unsupported(msg) printf("! %s:%d " \ "FIT images not supported for '%s'\n", \ diff --git a/include/u-boot/aes.h b/include/u-boot/aes.h new file mode 100644 index 0000000..4fb2cb7 --- /dev/null +++ b/include/u-boot/aes.h @@ -0,0 +1,31 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * Copyright (c) 2019, Softathome + */ + +#ifndef _AES_H +#define _AES_H + +#include <errno.h> +#include <image.h> + +#if IMAGE_ENABLE_ENCRYPT +int image_aes_encrypt(struct image_cipher_info *info, + const unsigned char *data, int size, + unsigned char **cipher, int *cipher_len); +int image_aes_add_cipher_data(struct image_cipher_info *info, void *keydest); +#else +int image_aes_encrypt(struct image_cipher_info *info, + const unsigned char *data, int size, + unsigned char **cipher, int *cipher_len) +{ + return -ENXIO; +} + +int image_aes_add_cipher_data(struct image_cipher_info *info, void *keydest) +{ + return -ENXIO; +} +#endif /* IMAGE_ENABLE_ENCRYPT */ + +#endif diff --git a/lib/aes/aes-encrypt.c b/lib/aes/aes-encrypt.c new file mode 100644 index 0000000..de00a83 --- /dev/null +++ b/lib/aes/aes-encrypt.c @@ -0,0 +1,136 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright (c) 2019,Softathome + */ +#include "mkimage.h" +#include <stdio.h> +#include <string.h> +#include <image.h> +#include <time.h> +#include <openssl/bn.h> +#include <openssl/rsa.h> +#include <openssl/pem.h> +#include <openssl/err.h> +#include <openssl/ssl.h> +#include <openssl/evp.h> +#include <openssl/engine.h> +#include <uboot_aes.h> + +#if OPENSSL_VERSION_NUMBER >= 0x10000000L +#define HAVE_ERR_REMOVE_THREAD_STATE +#endif + +int image_aes_encrypt(struct image_cipher_info *info, + unsigned char *data, int size, + unsigned char **cipher, int *cipher_len) +{ + EVP_CIPHER_CTX *ctx; + unsigned char *buf = NULL; + int buf_len, len, ret = 0; + + /* create and initialise the context */ + ctx = EVP_CIPHER_CTX_new(); + if (!ctx) { + printf("Can't create context\n"); + return -1; + } + + /* allocate a buffer for the result */ + buf = malloc(size + AES_BLOCK_LENGTH); + if (!buf) { + printf("Can't allocate memory to encrypt\n"); + ret = -1; + goto out; + } + + if (EVP_EncryptInit_ex(ctx, info->cipher->calculate_type(), + NULL, info->key, info->iv) != 1) { + printf("Can't init encryption\n"); + ret = -1; + goto out; + } + + if (EVP_EncryptUpdate(ctx, buf, &len, data, size) != 1) { + printf("Can't encrypt data\n"); + ret = -1; + goto out; + } + + buf_len = len; + + if (EVP_EncryptFinal_ex(ctx, buf + len, &len) != 1) { + printf("Can't finalise the encryption\n"); + ret = -1; + goto out; + } + + buf_len += len; + + *cipher = buf; + *cipher_len = buf_len; + + out: + EVP_CIPHER_CTX_free(ctx); + return ret; +} + +int image_aes_add_cipher_data(struct image_cipher_info *info, void *keydest) +{ + int parent, node; + char name[128]; + int ret = 0; + + /* Either create or overwrite the named cipher node */ + parent = fdt_subnode_offset(keydest, 0, FIT_CIPHER_NODENAME); + if (parent == -FDT_ERR_NOTFOUND) { + parent = fdt_add_subnode(keydest, 0, FIT_CIPHER_NODENAME); + if (parent < 0) { + ret = parent; + if (ret != -FDT_ERR_NOSPACE) { + fprintf(stderr, + "Couldn't create cipher node: %s\n", + fdt_strerror(parent)); + } + } + } + if (ret) + goto done; + + /* Either create or overwrite the named key node */ + snprintf(name, sizeof(name), "key-%s-%s-%s", + info->name, info->keyname, info->ivname); + node = fdt_subnode_offset(keydest, parent, name); + if (node == -FDT_ERR_NOTFOUND) { + node = fdt_add_subnode(keydest, parent, name); + if (node < 0) { + ret = node; + if (ret != -FDT_ERR_NOSPACE) { + fprintf(stderr, + "Could not create key subnode: %s\n", + fdt_strerror(node)); + } + } + } else if (node < 0) { + fprintf(stderr, "Cannot select keys parent: %s\n", + fdt_strerror(node)); + ret = node; + } + + if (!ret) + ret = fdt_setprop(keydest, node, "iv", + info->iv, info->cipher->iv_len); + + if (!ret) + ret = fdt_setprop(keydest, node, "key", + info->key, info->cipher->key_len); + + if (!ret) + ret = fdt_setprop_u32(keydest, node, "key-len", + info->cipher->key_len); + +done: + if (ret) + ret = ret == -FDT_ERR_NOSPACE ? -ENOSPC : -EIO; + + return ret; +} diff --git a/tools/Makefile b/tools/Makefile index 345bc84..051127a 100644 --- a/tools/Makefile +++ b/tools/Makefile @@ -59,6 +59,7 @@ hostprogs-$(CONFIG_CMD_BOOTEFI_SELFTEST) += file2include FIT_OBJS-$(CONFIG_FIT) := fit_common.o fit_image.o image-host.o common/image-fit.o FIT_SIG_OBJS-$(CONFIG_FIT_SIGNATURE) := common/image-sig.o +FIT_CIPHER_OBJS-$(CONFIG_FIT_CIPHER) := common/image-cipher.o # The following files are synced with upstream DTC. # Use synced versions from scripts/dtc/libfdt/. @@ -75,6 +76,9 @@ RSA_OBJS-$(CONFIG_FIT_SIGNATURE) := $(addprefix lib/rsa/, \ rsa-sign.o rsa-verify.o rsa-checksum.o \ rsa-mod-exp.o) +AES_OBJS-$(CONFIG_FIT_CIPHER) := $(addprefix lib/aes/, \ + aes-encrypt.o) + ROCKCHIP_OBS = lib/rc4.o rkcommon.o rkimage.o rksd.o rkspi.o # common objs for dumpimage and mkimage @@ -82,6 +86,7 @@ dumpimage-mkimage-objs := aisimage.o \ atmelimage.o \ $(FIT_OBJS-y) \ $(FIT_SIG_OBJS-y) \ + $(FIT_CIPHER_OBJS-y) \ common/bootm.o \ lib/crc32.o \ default_image.o \ @@ -116,7 +121,8 @@ dumpimage-mkimage-objs := aisimage.o \ gpimage.o \ gpimage-common.o \ mtk_image.o \ - $(RSA_OBJS-y) + $(RSA_OBJS-y) \ + $(AES_OBJS-y) dumpimage-objs := $(dumpimage-mkimage-objs) dumpimage.o mkimage-objs := $(dumpimage-mkimage-objs) mkimage.o @@ -137,6 +143,12 @@ HOST_EXTRACFLAGS += -DCONFIG_FIT_SIGNATURE HOST_EXTRACFLAGS += -DCONFIG_FIT_SIGNATURE_MAX_SIZE=$(CONFIG_FIT_SIGNATURE_MAX_SIZE) endif +ifdef CONFIG_FIT_CIPHER +# This affects include/image.h, but including the board config file +# is tricky, so manually define this options here. +HOST_EXTRACFLAGS += -DCONFIG_FIT_CIPHER +endif + ifdef CONFIG_SYS_U_BOOT_OFFS HOSTCFLAGS_kwbimage.o += -DCONFIG_SYS_U_BOOT_OFFS=$(CONFIG_SYS_U_BOOT_OFFS) endif diff --git a/tools/fit_image.c b/tools/fit_image.c index 0201cc4..e6a5ae4 100644 --- a/tools/fit_image.c +++ b/tools/fit_image.c @@ -59,6 +59,14 @@ static int fit_add_file_data(struct image_tool_params *params, size_t size_inc, } if (!ret) { + ret = fit_cipher_data(params->keydir, dest_blob, ptr, + params->comment, + params->require_keys, + params->engine_id, + params->cmdname); + } + + if (!ret) { ret = fit_add_verification_data(params->keydir, dest_blob, ptr, params->comment, params->require_keys, @@ -74,7 +82,6 @@ static int fit_add_file_data(struct image_tool_params *params, size_t size_inc, err_keydest: munmap(ptr, sbuf.st_size); close(tfd); - return ret; } @@ -621,6 +628,62 @@ err_no_fd: return ret; } +static int copyfile(const char *src, const char *dst) +{ + int fd_src = -1, fd_dst = -1; + void *buf = NULL; + ssize_t size; + size_t count; + int ret = -1; + + fd_src = open(src, O_RDONLY); + if (fd_src < 0) { + printf("Can't open file %s (%s)\n", src, strerror(errno)); + goto out; + } + + fd_dst = open(dst, O_WRONLY | O_CREAT, 0700); + if (fd_dst < 0) { + printf("Can't open file %s (%s)\n", dst, strerror(errno)); + goto out; + } + + buf = malloc(512); + if (!buf) { + printf("Can't allocate buffer to copy file\n"); + goto out; + } + + while (1) { + size = read(fd_src, buf, 512); + if (size < 0) { + printf("Can't read file %s\n", src); + goto out; + } + if (!size) + break; + + count = size; + size = write(fd_dst, buf, count); + if (size < 0) { + printf("Can't write file %s\n", dst); + goto out; + } + } + + ret = 0; + + out: + if (fd_src >= 0) + close(fd_src); + if (fd_dst >= 0) + close(fd_dst); + if (buf) + free(buf); + + return ret; +} + /** * fit_handle_file - main FIT file processing function * @@ -636,6 +699,7 @@ err_no_fd: static int fit_handle_file(struct image_tool_params *params) { char tmpfile[MKIMAGE_MAX_TMPFILE_LEN]; + char bakfile[MKIMAGE_MAX_TMPFILE_LEN + 4] = {0}; char cmd[MKIMAGE_MAX_DTC_CMDLINE_LEN]; size_t size_inc; int ret; @@ -670,6 +734,7 @@ static int fit_handle_file(struct image_tool_params *params) snprintf(cmd, sizeof(cmd), "cp \"%s\" \"%s\"", params->imagefile, tmpfile); } + if (*cmd && system(cmd) == -1) { fprintf (stderr, "%s: system(%s) failed: %s\n", params->cmdname, cmd, strerror(errno)); @@ -682,6 +747,14 @@ static int fit_handle_file(struct image_tool_params *params) goto err_system; /* + * Copy the tmpfile to bakfile, then in the following loop + * we copy bakfile to tmpfile. So we always start from the + * beginning. + */ + sprintf(bakfile, "%s%s", tmpfile, ".bak"); + rename(tmpfile, bakfile); + + /* * Set hashes for images in the blob. Unfortunately we may need more * space in either FDT, so keep trying until we succeed. * @@ -692,6 +765,11 @@ static int fit_handle_file(struct image_tool_params *params) * steps of this loop is enough to sign with several keys. */ for (size_inc = 0; size_inc < 64 * 1024; size_inc += 1024) { + if (copyfile(bakfile, tmpfile) < 0) { + printf("Can't copy %s to %s\n", bakfile, tmpfile); + ret = -EIO; + break; + } ret = fit_add_file_data(params, size_inc, tmpfile); if (!ret || ret != -ENOSPC) break; @@ -715,13 +793,16 @@ static int fit_handle_file(struct image_tool_params *params) params->cmdname, tmpfile, params->imagefile, strerror (errno)); unlink (tmpfile); + unlink(bakfile); unlink (params->imagefile); return EXIT_FAILURE; } + unlink(bakfile); return EXIT_SUCCESS; err_system: unlink(tmpfile); + unlink(bakfile); return -1; } diff --git a/tools/image-host.c b/tools/image-host.c index 88b3295..9483561 100644 --- a/tools/image-host.c +++ b/tools/image-host.c @@ -12,6 +12,7 @@ #include <bootm.h> #include <image.h> #include <version.h> +#include <uboot_aes.h> /** * fit_set_hash_value - set hash value in requested has node @@ -268,6 +269,262 @@ static int fit_image_process_sig(const char *keydir, void *keydest, return 0; } +static int fit_image_read_data(char *filename, unsigned char *data, + int expected_size) +{ + struct stat sbuf; + int fd, ret = -1; + ssize_t n; + + /* Open file */ + fd = open(filename, O_RDONLY | O_BINARY); + if (fd < 0) { + printf("Can't open file %s (err=%d => %s)\n", + filename, errno, strerror(errno)); + return -1; + } + + /* Compute file size */ + if (fstat(fd, &sbuf) < 0) { + printf("Can't fstat file %s (err=%d => %s)\n", + filename, errno, strerror(errno)); + goto err; + } + + /* Check file size */ + if (sbuf.st_size != expected_size) { + printf("File %s don't have the expected size (size=%ld, expected=%d)\n", + filename, sbuf.st_size, expected_size); + goto err; + } + + /* Read data */ + n = read(fd, data, sbuf.st_size); + if (n < 0) { + printf("Can't read file %s (err=%d => %s)\n", + filename, errno, strerror(errno)); + goto err; + } + + /* Check that we have read all the file */ + if (n != sbuf.st_size) { + printf("Can't read all file %s (read %ld bytes, expexted %ld)\n", + filename, n, sbuf.st_size); + goto err; + } + + ret = 0; + +err: + close(fd); + return ret; +} + +static int fit_image_setup_cipher(struct image_cipher_info *info, + const char *keydir, void *fit, + const char *image_name, int image_noffset, + const char *node_name, int noffset) +{ + char *algo_name; + char filename[128]; + int ret = -1; + + if (fit_image_cipher_get_algo(fit, noffset, &algo_name)) { + printf("Can't get algo name for cipher '%s' in image '%s'\n", + node_name, image_name); + goto out; + } + + info->keydir = keydir; + + /* Read the key name */ + info->keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL); + if (!info->keyname) { + printf("Can't get key name for cipher '%s' in image '%s'\n", + node_name, image_name); + goto out; + } + + /* Read the IV name */ + info->ivname = fdt_getprop(fit, noffset, "iv-name-hint", NULL); + if (!info->ivname) { + printf("Can't get iv name for cipher '%s' in image '%s'\n", + node_name, image_name); + goto out; + } + + info->fit = fit; + info->node_noffset = noffset; + info->name = algo_name; + + info->cipher = image_get_cipher_algo(algo_name); + if (!info->cipher) { + printf("Can't get algo for cipher '%s'\n", image_name); + goto out; + } + + /* Read the key in the file */ + snprintf(filename, sizeof(filename), "%s/%s%s", + info->keydir, info->keyname, ".bin"); + info->key = malloc(info->cipher->key_len); + if (!info->key) { + printf("Can't allocate memory for key\n"); + ret = -1; + goto out; + } + ret = fit_image_read_data(filename, (unsigned char *)info->key, + info->cipher->key_len); + if (ret < 0) + goto out; + + /* Read the IV in the file */ + snprintf(filename, sizeof(filename), "%s/%s%s", + info->keydir, info->ivname, ".bin"); + info->iv = malloc(info->cipher->iv_len); + if (!info->iv) { + printf("Can't allocate memory for iv\n"); + ret = -1; + goto out; + } + ret = fit_image_read_data(filename, (unsigned char *)info->iv, + info->cipher->iv_len); + + out: + return ret; +} + +int fit_image_write_cipher(void *fit, int image_noffset, int noffset, + const void *data, size_t size, + unsigned char *data_ciphered, int data_ciphered_len) +{ + int ret = -1; + + /* Remove unciphered data */ + ret = fdt_delprop(fit, image_noffset, FIT_DATA_PROP); + if (ret) { + printf("Can't remove data (err = %d)\n", ret); + goto out; + } + + /* Add ciphered data */ + ret = fdt_setprop(fit, image_noffset, FIT_DATA_PROP, + data_ciphered, data_ciphered_len); + if (ret) { + printf("Can't add ciphered data (err = %d)\n", ret); + goto out; + } + + /* add non ciphered data size */ + ret = fdt_setprop_u32(fit, image_noffset, "data-size-unciphered", size); + if (ret) { + printf("Can't add unciphered data size (err = %d)\n", ret); + goto out; + } + + out: + return ret; +} + +static int +fit_image_process_cipher(const char *keydir, void *keydest, void *fit, + const char *image_name, int image_noffset, + const char *node_name, int node_noffset, + const void *data, size_t size, + const char *cmdname) +{ + struct image_cipher_info info; + unsigned char *data_ciphered = NULL; + int data_ciphered_len; + int ret; + + memset(&info, 0, sizeof(info)); + + ret = fit_image_setup_cipher(&info, keydir, fit, image_name, + image_noffset, node_name, node_noffset); + if (ret) + goto out; + + ret = info.cipher->encrypt(&info, data, size, + &data_ciphered, &data_ciphered_len); + if (ret) + goto out; + + /* + * Write the public key into the supplied FDT file; this might fail + * several times, since we try signing with successively increasing + * size values + */ + if (keydest) { + ret = info.cipher->add_cipher_data(&info, keydest); + if (ret) { + printf("Failed to add verification data for cipher '%s' in image '%s'\n", + info.keyname, image_name); + goto out; + } + } + + ret = fit_image_write_cipher(fit, image_noffset, node_noffset, + data, size, + data_ciphered, data_ciphered_len); + + out: + free(data_ciphered); + free((void *)info.key); + free((void *)info.iv); + return ret; +} + +int fit_image_cipher_data(const char *keydir, void *keydest, + void *fit, int image_noffset, const char *comment, + int require_keys, const char *engine_id, + const char *cmdname) +{ + const char *image_name; + const void *data; + size_t size; + int node_noffset; + + /* Get image name */ + image_name = fit_get_name(fit, image_noffset, NULL); + if (!image_name) { + printf("Can't get image name\n"); + return -1; + } + + /* Get image data and data length */ + if (fit_image_get_data(fit, image_noffset, &data, &size)) { + printf("Can't get image data/size\n"); + return -1; + } + + /* Process all hash subnodes of the component image node */ + for (node_noffset = fdt_first_subnode(fit, image_noffset); + node_noffset >= 0; + node_noffset = fdt_next_subnode(fit, node_noffset)) { + const char *node_name; + int ret = 0; + + node_name = fit_get_name(fit, node_noffset, NULL); + if (!node_name) { + printf("Can't get node name\n"); + return -1; + } + + if (IMAGE_ENABLE_ENCRYPT && keydir && + !strncmp(node_name, FIT_CIPHER_NODENAME, + strlen(FIT_CIPHER_NODENAME))) + ret = fit_image_process_cipher(keydir, keydest, + fit, image_name, + image_noffset, + node_name, node_noffset, + data, size, cmdname); + if (ret) + return ret; + } + + return 0; +} + /** * fit_image_add_verification_data() - calculate/set verig. data for image node * @@ -675,6 +932,41 @@ static int fit_config_add_verification_data(const char *keydir, void *keydest, return 0; } +int fit_cipher_data(const char *keydir, void *keydest, void *fit, + const char *comment, int require_keys, + const char *engine_id, const char *cmdname) +{ + int images_noffset; + int noffset; + int ret; + + /* Find images parent node offset */ + images_noffset = fdt_path_offset(fit, FIT_IMAGES_PATH); + if (images_noffset < 0) { + printf("Can't find images parent node '%s' (%s)\n", + FIT_IMAGES_PATH, fdt_strerror(images_noffset)); + return images_noffset; + } + + /* Process its subnodes, print out component images details */ + for (noffset = fdt_first_subnode(fit, images_noffset); + noffset >= 0; + noffset = fdt_next_subnode(fit, noffset)) { + /* + * Direct child node of the images parent node, + * i.e. component image node. + */ + ret = fit_image_cipher_data(keydir, keydest, + fit, noffset, comment, + require_keys, engine_id, + cmdname); + if (ret) + return ret; + } + + return 0; +} + int fit_add_verification_data(const char *keydir, void *keydest, void *fit, const char *comment, int require_keys, const char *engine_id, const char *cmdname) -- 2.7.4

2 3

[U-Boot] [PATCH 0/2] spi: cadence-qspi: Move to spi-mem APIs
by Vignesh Raghavendra 17 Jan '20

17 Jan '20

First patch moves driver over to spi-mem framework and implement spi_mem_ops. This is require to support more SPI Flash opcodes like SFDP parsing etc. Series is in prepartion to add Octal mode for support for the same driver to support OSPI version of the controller. Second patch adds DAC mode that provide memory mapped access to flash. This greatly increases the read throughput. Tested with mt25qu512 flash and s25fl512 flash Simon, Would greatly appreciate if you could test this series on platforms that you have access to? Vignesh Raghavendra (2): spi: cadence_qspi: Move to spi-mem framework spi: cadence-qspi: Add direct mode support drivers/spi/cadence_qspi.c | 148 ++++++++++++--------------- drivers/spi/cadence_qspi.h | 24 +++-- drivers/spi/cadence_qspi_apb.c | 181 +++++++++++++++------------------ 3 files changed, 160 insertions(+), 193 deletions(-) -- 2.23.0

3 17

[U-Boot] [RFC PATCH] pxe: add support for FDT overlays
by Neil Armstrong 17 Jan '20

17 Jan '20

This adds support for specicyinf FDT overlays in an extlinux/pxelinux configuration file. Without this, there is no simple way to apply overlays when the kernel and ftd is loaded by the pxe command. This change adds the 'fdtoverlays' keyword for a label, supporting multiple overlay files to be applied on top of the fdt specific in the 'fdt' or 'devicetree' keyword. Cc: Jernej Škrabec <jernej.skrabec(a)siol.net> Cc: Jonas Karlman <jonas(a)kwiboo.se> Signed-off-by: Neil Armstrong <narmstrong(a)baylibre.com> --- cmd/pxe.c | 104 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 104 insertions(+) diff --git a/cmd/pxe.c b/cmd/pxe.c index 1dd0a74ea3..8d19e6f99f 100644 --- a/cmd/pxe.c +++ b/cmd/pxe.c @@ -13,6 +13,8 @@ #include <linux/ctype.h> #include <errno.h> #include <linux/list.h> +#include <fdt_support.h> +#include <linux/libfdt.h> #include <fs.h> #include <splash.h> #include <asm/io.h> @@ -481,6 +483,7 @@ struct pxe_label { char *initrd; char *fdt; char *fdtdir; + char *fdtoverlays; int ipappend; int attempted; int localboot; @@ -561,6 +564,9 @@ static void label_destroy(struct pxe_label *label) if (label->fdtdir) free(label->fdtdir); + if (label->fdtoverlays) + free(label->fdtoverlays); + free(label); } @@ -608,6 +614,92 @@ static int label_localboot(struct pxe_label *label) return run_command_list(localcmd, strlen(localcmd), 0); } +/* + * Loads fdt overlays specified in 'fdtoverlays'. + */ +#ifdef CONFIG_OF_LIBFDT_OVERLAY +static void label_boot_fdtoverlay(cmd_tbl_t *cmdtp, struct pxe_label *label) +{ + char *fdtoverlay = label->fdtoverlays; + struct fdt_header *working_fdt; + char *fdtoverlay_addr_env; + ulong fdtoverlay_addr; + ulong fdt_addr; + int err; + + /* Get the main fdt and map it */ + fdt_addr = simple_strtoul(env_get("fdt_addr_r"), NULL, 16); + working_fdt = map_sysmem(fdt_addr, 0); + err = fdt_check_header(working_fdt); + if (err) + return; + + /* Get the specific overlay loading address */ + fdtoverlay_addr_env = env_get("fdtoverlay_addr_r"); + if (!fdtoverlay_addr_env) { + printf("Invalid fdtoverlay_addr_r for loading overlays\n"); + return; + } + + fdtoverlay_addr = simple_strtoul(fdtoverlay_addr_env, NULL, 16); + + /* Cycle over the overlay files and apply them in order */ + do { + struct fdt_header *blob; + char *overlayfile; + char *end; + int len; + + /* Drop leading spaces */ + while (*fdtoverlay == ' ') + ++fdtoverlay; + + /* Copy a single filename if multiple provided */ + end = strstr(fdtoverlay, " "); + if (end) { + len = (int)(end - fdtoverlay); + overlayfile = malloc(len + 1); + strncpy(overlayfile, fdtoverlay, len); + overlayfile[len] = '\0'; + } else + overlayfile = fdtoverlay; + + if (!strlen(overlayfile)) + goto skip_overlay; + + /* Load overlay file */ + err = get_relfile_envaddr(cmdtp, overlayfile, + "fdtoverlay_addr_r"); + if (err < 0) { + printf("Failed loading overlay %s\n", overlayfile); + goto skip_overlay; + } + + /* Resize main fdt */ + fdt_shrink_to_minimum(working_fdt, 8192); + + blob = map_sysmem(fdtoverlay_addr, 0); + err = fdt_check_header(blob); + if (err) { + printf("Invalid overlay %s, skipping\n", + overlayfile); + goto skip_overlay; + } + + err = fdt_overlay_apply_verbose(working_fdt, blob); + if (err) { + printf("Failed to apply overlay %s, skipping\n", + overlayfile); + goto skip_overlay; + } + +skip_overlay: + if (end) + free(overlayfile); + } while ((fdtoverlay = strstr(fdtoverlay, " "))); +} +#endif + /* * Boot according to the contents of a pxe_label. * @@ -798,6 +890,11 @@ static int label_boot(cmd_tbl_t *cmdtp, struct pxe_label *label) label->name); goto cleanup; } + +#ifdef CONFIG_OF_LIBFDT_OVERLAY + if (label->fdtoverlays) + label_boot_fdtoverlay(cmdtp, label); +#endif } else { bootm_argv[3] = NULL; } @@ -855,6 +952,7 @@ enum token_type { T_INCLUDE, T_FDT, T_FDTDIR, + T_FDTOVERLAYS, T_ONTIMEOUT, T_IPAPPEND, T_BACKGROUND, @@ -889,6 +987,7 @@ static const struct token keywords[] = { {"fdt", T_FDT}, {"devicetreedir", T_FDTDIR}, {"fdtdir", T_FDTDIR}, + {"fdtoverlays", T_FDTOVERLAYS}, {"ontimeout", T_ONTIMEOUT,}, {"ipappend", T_IPAPPEND,}, {"background", T_BACKGROUND,}, @@ -1322,6 +1421,11 @@ static int parse_label(char **c, struct pxe_menu *cfg) err = parse_sliteral(c, &label->fdtdir); break; + case T_FDTOVERLAYS: + if (!label->fdtoverlays) + err = parse_sliteral(c, &label->fdtoverlays); + break; + case T_LOCALBOOT: label->localboot = 1; err = parse_integer(c, &label->localboot_val); -- 2.21.0

2 2