[PATCH] images: Add automatic image crc generation for imd

[PATCH] images: Add automatic image crc generation for imd

[Yunus Bas]

Since commit 9d12256bfcc6, the barebox IMD-header has an additional
register space for CRC32 checksum. This is an important feature, since
it allows us to verify the barebox image after flashing to the hardware.

This patch adds an optional feature for automatically generating the CRC32
checksum and writing it into IMD-section for all generated image-files.
Additionally, the file 'barebox-imd-crc', containing the list of IMD
outputs including the CRC32-value, will be generated under the images
directory.

Signed-off-by: Yunus Bas <y.bas@phytec.de>
---
 common/Kconfig  | 11 +++++++++++
 images/Makefile | 16 ++++++++++++++--
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/common/Kconfig b/common/Kconfig
index 9b73aa845..a278cdbef 100644
--- a/common/Kconfig
+++ b/common/Kconfig
@@ -697,6 +697,17 @@ config IMD
 	select CRC32
 	bool "barebox metadata support"
 
+config IMD_CRC_IMAGE
+	bool "crc32 checksum generation for IMD-header"
+	depends on IMD
+	help
+	  Enable this option for automatic generation and addition of the
+	  crc checksum to the Barebox ImageMetaData (IMD). Once enabled,
+	  this option uses the bareboximd-tool under the scripts directory
+	  to generate and set the crc checksums for all generated img-files.
+	  In addition, the file 'barebox-imd-crc' with a list of IMD's
+	  from the generated images will be created in the images-directory.
+
 config IMD_TARGET
 	bool "build bareboximd target tool"
 	depends on IMD
diff --git a/images/Makefile b/images/Makefile
index b8899dcd2..f5a320bf6 100644
--- a/images/Makefile
+++ b/images/Makefile
@@ -196,7 +196,12 @@ flash-link := $(obj)/../barebox-flash-image
 link-dest := $(if $(filter 1,$(words $(image-y))),$(image-y-path),multi-image-build)
 multi-image-build:
 
-images: $(image-y-path) $(flash-link) $(flash-list) FORCE
+# List of IMD's, including the filled crc reg, from the generated images
+ifdef CONFIG_IMD_CRC_IMAGE
+crc-gen := $(obj)/barebox-imd-crc
+endif
+
+images: $(image-y-path) $(flash-link) $(flash-list) $(crc-gen) FORCE
 	@echo "images built:"
 	@for i in $(image-y); do echo $$i; done
 
@@ -206,8 +211,15 @@ $(flash-link): $(link-dest) FORCE
 $(flash-list): $(image-y-path)
 	@for i in $^; do echo $$i; done > $@
 
+$(crc-gen): $(image-y-path)
+	@echo "generating and adding crc checksum to barebox images:"
+	@for i in $^; do \
+		echo "$$i:"; \
+		scripts/bareboximd -c $$i; \
+	done > $@
+
 clean-files := *.pbl *.pblb *.map start_*.imximg *.img barebox.z start_*.kwbimg \
 	start_*.kwbuartimg *.socfpgaimg *.mlo *.t20img *.t20img.cfg *.t30img \
 	*.t30img.cfg *.t124img *.t124img.cfg *.mlospi *.mlo *.mxsbs *.mxssd \
 	start_*.simximg start_*.usimximg *.zynqimg *.image
-clean-files += pbl.lds
+clean-files += pbl.lds barebox-imd-crc
-- 
2.29.2


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

Re: [PATCH] images: Add automatic image crc generation for imd

[Sascha Hauer]

Hi Yunus,

On Fri, Dec 04, 2020 at 11:04:21AM +0100, Yunus Bas wrote:
> Since commit 9d12256bfcc6, the barebox IMD-header has an additional
> register space for CRC32 checksum. This is an important feature, since
> it allows us to verify the barebox image after flashing to the hardware.
> 
> This patch adds an optional feature for automatically generating the CRC32
> checksum and writing it into IMD-section for all generated image-files.
> Additionally, the file 'barebox-imd-crc', containing the list of IMD
> outputs including the CRC32-value, will be generated under the images
> directory.

It's not that easy unfortunately. Generating CRC IMD tags doesn't work
for many image types. For example the i.MX28 images are all encrypted,
so the bareboximd command won't find any valid tags in the binary. The
signed i.MX6 HAB images could be added a CRC to, but doing that would
invalidate the signature.
I'm afraid it's not possible to add a IMD crc to all images, we must
carefully select the images we can actually do that.

Having said that, generating the crcs automatically would be really
great and I have also thought about that. See the following series as
a starting point. It's not complete though, because it generates the
crcs also in HAB signed images.

Sascha

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

[PATCH 1/3] imd command: specify outfile for crc tag generation

[Sascha Hauer]

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 commands/imd.c       |  2 +-
 common/imd.c         | 11 +++++------
 scripts/bareboximd.c |  2 +-
 3 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/commands/imd.c b/commands/imd.c
index 9f7ac79f8f..5cb80db0f5 100644
--- a/commands/imd.c
+++ b/commands/imd.c
@@ -33,7 +33,7 @@ BAREBOX_CMD_HELP_OPT ("-n <no>", "for tags with multiple strings only show strin
 BAREBOX_CMD_HELP_OPT ("-s VARNAME",  "set variable VARNAME instead of showing information")
 BAREBOX_CMD_HELP_OPT ("-v", "Be verbose")
 BAREBOX_CMD_HELP_OPT ("-V",  "Verify checksum of FILE")
-BAREBOX_CMD_HELP_OPT ("-c", "Create checksum for FILE and write it to the crc32 tag.")
+BAREBOX_CMD_HELP_OPT ("-c OUTFILE", "Create checksum for FILE and write it to the crc32 tag.")
 BAREBOX_CMD_HELP_TEXT("")
 BAREBOX_CMD_HELP_TEXT("Without options all information available is printed. Valid types are:")
 BAREBOX_CMD_HELP_TEXT("release, build, model, of_compatible")
diff --git a/common/imd.c b/common/imd.c
index 4aca8ea78f..044f04bcdd 100644
--- a/common/imd.c
+++ b/common/imd.c
@@ -435,15 +435,14 @@ int imd_command(int argc, char *argv[])
 	size_t size;
 	uint32_t type = IMD_TYPE_INVALID;
 	const struct imd_header *imd_start, *imd;
-	const char *filename;
+	const char *filename, *checksumfile = NULL;
 	const char *variable_name = NULL;
 	char *str;
-	uint32_t checksum = 0;
 	uint32_t verify = 0;
 
 	imd_command_verbose = 0;
 
-	while ((opt = getopt(argc, argv, "vt:s:n:cV")) > 0) {
+	while ((opt = getopt(argc, argv, "vt:s:n:c:V")) > 0) {
 		switch(opt) {
 		case 't':
 			type = imd_name_to_type(optarg);
@@ -462,7 +461,7 @@ int imd_command(int argc, char *argv[])
 			strno = simple_strtoul(optarg, NULL, 0);
 			break;
 		case 'c':
-			checksum = 1;
+			checksumfile = optarg;
 			break;
 		case 'V':
 			verify = 1;
@@ -489,8 +488,8 @@ int imd_command(int argc, char *argv[])
 		goto out;
 	}
 
-	if (checksum) {
-		ret = imd_write_crc32(buf, imd_start, filename, size);
+	if (checksumfile) {
+		ret = imd_write_crc32(buf, imd_start, checksumfile, size);
 		goto out;
 	}
 
diff --git a/scripts/bareboximd.c b/scripts/bareboximd.c
index 0500e01cc2..1ae01e43d3 100644
--- a/scripts/bareboximd.c
+++ b/scripts/bareboximd.c
@@ -163,7 +163,7 @@ static void usage(const char *prgname)
 "-n <no>      for tags with multiple strings only show string <no>\n"
 "-v           Be verbose\n"
 "-V           Verify checksum of FILE\n"
-"-c           Create checksum for FILE and write it to the crc32 tag\n"
+"-c OUTFILE   Create checksum for FILE and write it to the crc32 tag\n"
 "\n"
 "Without options all information available is printed. Valid types are:\n"
 "release, build, model, of_compatible\n",
-- 
2.20.1


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

[PATCH 2/3] kbuild: Add command to generate the crc for the IMD crc tag

[Sascha Hauer]

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 scripts/Makefile.lib | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 2844d29be6..060dad5087 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -448,6 +448,17 @@ cmd_lz4 = (cat $(filter-out FORCE,$^) | \
 %.lz4: %
 	$(call if_changed,lz4)
 
+ifdef CONFIG_IMD
+quiet_cmd_gen_imd_crc = GENCRC $@
+cmd_gen_imd_crc = scripts/bareboximd -c $@ $<
+else
+quiet_cmd_gen_imd_crc =
+cmd_gen_imd_crc = true
+endif
+
+%.imdcrc: %
+	$(call if_changed,gen_imd_crc)
+
 # comp_copy
 # ---------------------------------------------------------------------------
 # Wrapper which only copies a file, but compatible to the compression
-- 
2.20.1


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

[PATCH 3/3] images: i.MX: fill in crc in IMD crc tags

[Sascha Hauer]

FIXME: This also generates crcs in the signed images which invalidates
the signature.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 images/Makefile.imx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/images/Makefile.imx b/images/Makefile.imx
index 514db326bb..808c7a13e8 100644
--- a/images/Makefile.imx
+++ b/images/Makefile.imx
@@ -26,7 +26,7 @@ endef
 .SECONDEXPANSION:
 define imx_image_rule
 $(eval
-$$(obj)/%.$(strip $(1)): $$(obj)/% $$$$(CFG_%.imximg) FORCE
+$$(obj)/%.$(strip $(1)): $$(obj)/%.imdcrc $$$$(CFG_%.imximg) FORCE
 	$$(call if_changed,imx_image,$$(CFG_$$(patsubst %.$(strip $(1)),%.imximg,$$(@F))),$(strip $(2)))
 )
 endef
-- 
2.20.1


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

Re: [PATCH] images: Add automatic image crc generation for imd

[Yunus Bas]

Hi Sascha,

Am 07.12.20 um 10:28 schrieb Sascha Hauer:
> Hi Yunus,
>
> On Fri, Dec 04, 2020 at 11:04:21AM +0100, Yunus Bas wrote:
>> Since commit 9d12256bfcc6, the barebox IMD-header has an additional
>> register space for CRC32 checksum. This is an important feature, since
>> it allows us to verify the barebox image after flashing to the hardware.
>>
>> This patch adds an optional feature for automatically generating the CRC32
>> checksum and writing it into IMD-section for all generated image-files.
>> Additionally, the file 'barebox-imd-crc', containing the list of IMD
>> outputs including the CRC32-value, will be generated under the images
>> directory.
> It's not that easy unfortunately. Generating CRC IMD tags doesn't work
> for many image types. For example the i.MX28 images are all encrypted,
> so the bareboximd command won't find any valid tags in the binary. The
> signed i.MX6 HAB images could be added a CRC to, but doing that would
> invalidate the signature.
> I'm afraid it's not possible to add a IMD crc to all images, we must
> carefully select the images we can actually do that.
>
> Having said that, generating the crcs automatically would be really
> great and I have also thought about that. See the following series as
> a starting point. It's not complete though, because it generates the
> crcs also in HAB signed images.
>
> Sascha
>
Thank you for the reply and sorry that I have not thought about signed 
images, which is obvious.

 From your patches I can see, that you have changed the bareboximd 
behaviour and also added additional imdcrc files. Personally, I wouldn't 
have gone that far, but it looks like your approach is the cleaner 
solution. I will consider your patches and search for a solution on top 
of them.

Mit freundlichen Grüßen
-- 
Yunus Bas
- Software Entwicklung -
Tel.: +49 6131 92 21 0
y.bas@phytec.de
<http://www.phytec.de/>


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox