boot: image: add a stage pre-load
Add a stage pre-load that could
check or modify an image.
For the moment, only a header with a signature is
supported. This header has the following format:
- magic : 4 bytes
- version : 4 bytes
- header size : 4 bytes
- image size : 4 bytes
- offset image signature : 4 bytes
- flags : 4 bytes
- reserved0 : 4 bytes
- reserved1 : 4 bytes
- sha256 of the image signature : 32 bytes
- signature of the first 64 bytes : n bytes
- image signature : n bytes
- padding : up to header size
The stage uses a node /image/pre-load/sig to
get some informations:
- algo-name (mandatory) : name of the algo used to sign
- padding-name : name of padding used to sign
- signature-size : size of the signature (in the header)
- mandatory : set to yes if this sig is mandatory
- public-key (madatory) : value of the public key
Before running the image, the stage pre-load checks
the signature provided in the header.
This is an initial support, later we could add the
support of:
- ciphering
- uncompressing
- ...
Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
diff --git a/boot/Kconfig b/boot/Kconfig
index a395529..b3580bd 100644
--- a/boot/Kconfig
+++ b/boot/Kconfig
@@ -1023,6 +1023,61 @@
endmenu
+menu "Image support"
+
+config IMAGE_PRE_LOAD
+ bool "Image pre-load support"
+ help
+ Enable an image pre-load stage in the SPL.
+ This pre-load stage allows to do some manipulation
+ or check (for example signature check) on an image
+ before launching it.
+
+config SPL_IMAGE_PRE_LOAD
+ bool "Image pre-load support within SPL"
+ depends on SPL && IMAGE_PRE_LOAD
+ help
+ Enable an image pre-load stage in the SPL.
+ This pre-load stage allows to do some manipulation
+ or check (for example signature check) on an image
+ before launching it.
+
+config IMAGE_PRE_LOAD_SIG
+ bool "Image pre-load signature support"
+ depends on IMAGE_PRE_LOAD
+ select FIT_SIGNATURE
+ select RSA
+ select RSA_VERIFY_WITH_PKEY
+ help
+ Enable signature check support in the pre-load stage.
+ For this feature a very simple header is added before
+ the image with few fields:
+ - a magic
+ - the image size
+ - the signature
+ All other information (header size, type of signature,
+ ...) are provided in the node /image/pre-load/sig of
+ u-boot.
+
+config SPL_IMAGE_PRE_LOAD_SIG
+ bool "Image pre-load signature support witin SPL"
+ depends on SPL_IMAGE_PRE_LOAD && IMAGE_PRE_LOAD_SIG
+ select SPL_FIT_SIGNATURE
+ select SPL_RSA
+ select SPL_RSA_VERIFY_WITH_PKEY
+ help
+ Enable signature check support in the pre-load stage in the SPL.
+ For this feature a very simple header is added before
+ the image with few fields:
+ - a magic
+ - the image size
+ - the signature
+ All other information (header size, type of signature,
+ ...) are provided in the node /image/pre-load/sig of
+ u-boot.
+
+endmenu
+
config USE_BOOTARGS
bool "Enable boot arguments"
help