We rename CONFIG_FIT_DISABLE_SHA256 to CONFIG_FIT_ENABLE_SHA256_SUPPORT which is enabled by default and now a positive option. Convert the handful of boards that were disabling it before to save space.
Cc: Dirk Eibach eibach@gdsys.de Cc: Lukasz Dalek luk0104@gmail.com Signed-off-by: Tom Rini trini@konsulko.com Reviewed-by: Simon Glass sjg@chromium.org --- Changes in v4: - Fix HOST_CC side of changes to include/image.h so that the host tools will continue to have SHA256 support. --- Kconfig | 13 +++++++++++++ README | 9 --------- configs/dlvision-10g_defconfig | 1 + configs/dlvision_defconfig | 1 + configs/h2200_defconfig | 1 + configs/io_defconfig | 1 + configs/iocon_defconfig | 1 + configs/neo_defconfig | 1 + include/configs/dlvision-10g.h | 3 --- include/configs/dlvision.h | 3 --- include/configs/h2200.h | 1 - include/configs/io.h | 3 --- include/configs/iocon.h | 3 --- include/configs/neo.h | 3 --- include/image.h | 16 ++++++---------- scripts/config_whitelist.txt | 1 - 16 files changed, 25 insertions(+), 36 deletions(-)
diff --git a/Kconfig b/Kconfig index 1cf990dfce33..0a445313f62c 100644 --- a/Kconfig +++ b/Kconfig @@ -157,6 +157,19 @@ config FIT
if FIT
+config FIT_ENABLE_SHA256_SUPPORT + bool "Support SHA256 checksum of FIT image contents" + default y + help + Enable this to support SHA256 checksum of FIT image contents. A + SHA256 checksum is a 256-bit (32-byte) hash value used to check that + the image contents have not been corrupted. SHA256 is recommended + for use in secure applications since (as at 2016) there is no known + feasible attack that could produce a 'collision' with differing + input data. Use this for the highest security. Note that only the + SHA256 variant is supported: SHA512 and others are not currently + supported in U-Boot. + config FIT_SIGNATURE bool "Enable signature verification of FIT uImages" depends on DM diff --git a/README b/README index f4eecd0a0bd1..9a642afaa80f 100644 --- a/README +++ b/README @@ -3035,15 +3035,6 @@ FIT uImage format: This define is introduced, as the legacy image format is enabled per default for backward compatibility.
-- FIT image support: - CONFIG_FIT_DISABLE_SHA256 - Supporting SHA256 hashes has quite an impact on binary size. - For constrained systems sha256 hash support can be disabled - with this option. - - TODO(sjg@chromium.org): Adjust this option to be positive, - and move it to Kconfig - - Standalone program support: CONFIG_STANDALONE_LOAD_ADDR
diff --git a/configs/dlvision-10g_defconfig b/configs/dlvision-10g_defconfig index c3574e199645..44f7527a9ce7 100644 --- a/configs/dlvision-10g_defconfig +++ b/configs/dlvision-10g_defconfig @@ -3,6 +3,7 @@ CONFIG_IDENT_STRING=" dlvision-10g 0.06" CONFIG_4xx=y CONFIG_TARGET_DLVISION_10G=y CONFIG_FIT=y +# CONFIG_FIT_ENABLE_SHA256_SUPPORT is not set CONFIG_FIT_VERBOSE=y CONFIG_OF_BOARD_SETUP=y CONFIG_BOOTDELAY=5 diff --git a/configs/dlvision_defconfig b/configs/dlvision_defconfig index f9f07ee8f12a..4dd09a2af8d4 100644 --- a/configs/dlvision_defconfig +++ b/configs/dlvision_defconfig @@ -3,6 +3,7 @@ CONFIG_IDENT_STRING=" dlvision 0.02" CONFIG_4xx=y CONFIG_TARGET_DLVISION=y CONFIG_FIT=y +# CONFIG_FIT_ENABLE_SHA256_SUPPORT is not set CONFIG_FIT_VERBOSE=y CONFIG_OF_BOARD_SETUP=y CONFIG_BOOTDELAY=5 diff --git a/configs/h2200_defconfig b/configs/h2200_defconfig index b85ed598066e..9d3698c5559c 100644 --- a/configs/h2200_defconfig +++ b/configs/h2200_defconfig @@ -1,6 +1,7 @@ CONFIG_ARM=y CONFIG_TARGET_H2200=y CONFIG_FIT=y +# CONFIG_FIT_ENABLE_SHA256_SUPPORT is not set CONFIG_SYS_CONSOLE_IS_IN_ENV=y # CONFIG_DISPLAY_CPUINFO is not set # CONFIG_DISPLAY_BOARDINFO is not set diff --git a/configs/io_defconfig b/configs/io_defconfig index 5dca2b121c8a..27edc5976b2c 100644 --- a/configs/io_defconfig +++ b/configs/io_defconfig @@ -3,6 +3,7 @@ CONFIG_IDENT_STRING=" io 0.06" CONFIG_4xx=y CONFIG_TARGET_IO=y CONFIG_FIT=y +# CONFIG_FIT_ENABLE_SHA256_SUPPORT is not set CONFIG_FIT_VERBOSE=y CONFIG_OF_BOARD_SETUP=y CONFIG_BOOTDELAY=5 diff --git a/configs/iocon_defconfig b/configs/iocon_defconfig index c74df944a6ae..2529181620d5 100644 --- a/configs/iocon_defconfig +++ b/configs/iocon_defconfig @@ -3,6 +3,7 @@ CONFIG_IDENT_STRING=" iocon 0.06" CONFIG_4xx=y CONFIG_TARGET_IOCON=y CONFIG_FIT=y +# CONFIG_FIT_ENABLE_SHA256_SUPPORT is not set CONFIG_OF_BOARD_SETUP=y CONFIG_BOOTDELAY=5 CONFIG_SYS_CONSOLE_INFO_QUIET=y diff --git a/configs/neo_defconfig b/configs/neo_defconfig index fbb2da47f0a6..1bf5151baad6 100644 --- a/configs/neo_defconfig +++ b/configs/neo_defconfig @@ -3,6 +3,7 @@ CONFIG_IDENT_STRING=" neo 0.02" CONFIG_4xx=y CONFIG_TARGET_NEO=y CONFIG_FIT=y +# CONFIG_FIT_ENABLE_SHA256_SUPPORT is not set CONFIG_FIT_VERBOSE=y CONFIG_OF_BOARD_SETUP=y CONFIG_BOOTDELAY=5 diff --git a/include/configs/dlvision-10g.h b/include/configs/dlvision-10g.h index e32651f54113..c5e227650e54 100644 --- a/include/configs/dlvision-10g.h +++ b/include/configs/dlvision-10g.h @@ -31,9 +31,6 @@ #define PLLMR0_DEFAULT PLLMR0_266_133_66 #define PLLMR1_DEFAULT PLLMR1_266_133_66
-/* new uImage format support */ -#define CONFIG_FIT_DISABLE_SHA256 - #define CONFIG_ENV_IS_IN_FLASH /* use FLASH for environment vars */
/* diff --git a/include/configs/dlvision.h b/include/configs/dlvision.h index 2b7d62b03482..f8d390ba33ae 100644 --- a/include/configs/dlvision.h +++ b/include/configs/dlvision.h @@ -29,9 +29,6 @@ #define PLLMR0_DEFAULT PLLMR0_266_133_66_33 #define PLLMR1_DEFAULT PLLMR1_266_133_66_33
-/* new uImage format support */ -#define CONFIG_FIT_DISABLE_SHA256 - #define CONFIG_ENV_IS_IN_FLASH /* use FLASH for environment vars */
/* diff --git a/include/configs/h2200.h b/include/configs/h2200.h index d8724f86a738..530a88e9e1a7 100644 --- a/include/configs/h2200.h +++ b/include/configs/h2200.h @@ -109,7 +109,6 @@
#define CONFIG_SYS_BAUDRATE_TABLE { 9600, 38400, 115200 }
-#define CONFIG_FIT_DISABLE_SHA256 #define CONFIG_SETUP_MEMORY_TAGS #define CONFIG_CMDLINE_TAG #define CONFIG_INITRD_TAG diff --git a/include/configs/io.h b/include/configs/io.h index 3e44a8c60753..ee2b52a7ede6 100644 --- a/include/configs/io.h +++ b/include/configs/io.h @@ -31,9 +31,6 @@ #define PLLMR0_DEFAULT PLLMR0_266_133_66 #define PLLMR1_DEFAULT PLLMR1_266_133_66
-/* new uImage format support */ -#define CONFIG_FIT_DISABLE_SHA256 - #define CONFIG_ENV_IS_IN_FLASH /* use FLASH for environment vars */
/* diff --git a/include/configs/iocon.h b/include/configs/iocon.h index 9c3be78bc73b..afa69942e84a 100644 --- a/include/configs/iocon.h +++ b/include/configs/iocon.h @@ -33,9 +33,6 @@ #define PLLMR0_DEFAULT PLLMR0_266_133_66 #define PLLMR1_DEFAULT PLLMR1_266_133_66
-/* new uImage format support */ -#define CONFIG_FIT_DISABLE_SHA256 - #define CONFIG_ENV_IS_IN_FLASH /* use FLASH for environment vars */
/* diff --git a/include/configs/neo.h b/include/configs/neo.h index 9115e251b1bf..1d8e13f0353b 100644 --- a/include/configs/neo.h +++ b/include/configs/neo.h @@ -31,9 +31,6 @@ #define PLLMR0_DEFAULT PLLMR0_266_133_66_33 #define PLLMR1_DEFAULT PLLMR1_266_133_66_33
-/* new uImage format support */ -#define CONFIG_FIT_DISABLE_SHA256 - #define CONFIG_ENV_IS_IN_FLASH /* use FLASH for environment vars */
/* diff --git a/include/image.h b/include/image.h index 3f26f9bd1f62..800426d51f96 100644 --- a/include/image.h +++ b/include/image.h @@ -29,6 +29,7 @@ struct lmb; #define IMAGE_ENABLE_FIT 1 #define IMAGE_ENABLE_OF_LIBFDT 1 #define CONFIG_FIT_VERBOSE 1 /* enable fit_format_{error,warning}() */ +#define CONFIG_FIT_ENABLE_SHA256_SUPPORT
#define IMAGE_ENABLE_IGNORE 0 #define IMAGE_INDENT_STRING "" @@ -62,9 +63,6 @@ struct lmb; # ifdef CONFIG_SPL_SHA1_SUPPORT # define IMAGE_ENABLE_SHA1 1 # endif -# ifdef CONFIG_SPL_SHA256_SUPPORT -# define IMAGE_ENABLE_SHA256 1 -# endif # else # define CONFIG_CRC32 /* FIT images need CRC32 support */ # define CONFIG_SHA1 /* and SHA1 */ @@ -72,14 +70,8 @@ struct lmb; # define IMAGE_ENABLE_CRC32 1 # define IMAGE_ENABLE_MD5 1 # define IMAGE_ENABLE_SHA1 1 -# define IMAGE_ENABLE_SHA256 1 # endif
-#ifdef CONFIG_FIT_DISABLE_SHA256 -#undef CONFIG_SHA256 -#undef IMAGE_ENABLE_SHA256 -#endif - #ifndef IMAGE_ENABLE_CRC32 #define IMAGE_ENABLE_CRC32 0 #endif @@ -92,7 +84,11 @@ struct lmb; #define IMAGE_ENABLE_SHA1 0 #endif
-#ifndef IMAGE_ENABLE_SHA256 +#if defined(CONFIG_FIT_ENABLE_SHA256_SUPPORT) || \ + defined(CONFIG_SPL_SHA256_SUPPORT) +#define CONFIG_SHA256 +#define IMAGE_ENABLE_SHA256 1 +#else #define IMAGE_ENABLE_SHA256 0 #endif
diff --git a/scripts/config_whitelist.txt b/scripts/config_whitelist.txt index 0cb5d338ab12..8e456fe03fbd 100644 --- a/scripts/config_whitelist.txt +++ b/scripts/config_whitelist.txt @@ -948,7 +948,6 @@ CONFIG_FFUART CONFIG_FILE CONFIG_FIRMWARE_OFFSET CONFIG_FIRMWARE_SIZE -CONFIG_FIT_DISABLE_SHA256 CONFIG_FIXED_PHY CONFIG_FIXED_PHY_ADDR CONFIG_FIXED_SDHCI_ALIGNED_BUFFER