Link to v1: https://lore.kernel.org/u-boot/[email protected]/
Changes in v2 (from Simon's review of v1, plus one cleanup noticed while addressing it): - new patch 1: drop the duplicate FIT_ALGO_PROP definition in the cipher node block of include/image.h, noticed while adding the cipher property defines requested in review. - patch 2 (was 1): add FIT_IV_HINT and FIT_IV_PROP to include/image.h and use them in fit_image_setup_cipher(). Non-functional cleanup, so the Reviewed-by is kept. - patch 3 (was 2): fit_resolve_image_data() skips its own pack and rewrite when re-processing a FIT that needs nothing resolved, while still validating every reference; reject image-data combined with a complete external data reference before the import when compiling a source file, where the combination cannot be legitimate, while re-processing keeps import-then-compare for the resolved form; complete the kernel-doc of the three new helpers, with the cipher check describing the source-file and re-processed cases separately; explain in the kernel-doc and at the remaining check why it runs after the import; add FIT_DATA_SIZE_UNCIPHERED_PROP and use the property defines. - patch 5 (was 4): the commit message now states that it completes the validation for the new property rather than fixing a pre-existing problem, and the kernel-doc of fit_image_effective_data() gains its parameter and return descriptions. Comment-only, so the Reviewed-by is kept; still a separate patch to stay reviewable on its own. - patch 6: new, user documentation with a worked example under doc/usage/fit/. - patch 7 (was 5): two cases for the complete offset and position forms of the mixing check; the Reviewed-by is dropped because of the added cases. - patch 4 (was 3): unchanged. --- The 'Shared image data' section of the Flat Image Tree specification [1] defines an image-data property: an image node names another image node under /images whose binary payload it shares, while carrying its own load, entry and remaining metadata. A multi-configuration FIT can then offer the same binary at different addresses without storing it twice. The normative text is in the specification's main branch; a refinement of the cipher interaction is under review in [2]. mkimage resolves the references right after external data has been imported: the target's data is copied into the referencing node, so the later ciphering, hashing, signing and overlap checking steps see normal image nodes, and the property is retained in the resolved FIT as a record of the sharing relationship. Invalid references are rejected: an undefined target, a chained reference, data that disagrees with the target, external data properties mixed with image-data in a source file, and cipher settings that would produce different ciphertexts. Consumers need no changes, since bootloaders ignore the property and the data properties remain authoritative. Patch 1 drops a duplicate definition of FIT_ALGO_PROP in the cipher node block of include/image.h, a leftover from the cipher support that compiles silently because the redefinition is identical. Patch 2 makes fit_image_setup_cipher() use an explicit iv from the cipher node when no iv-name-hint is given, checking its length, and fall back to a random IV only when neither is present. This matches the specification, makes encryption reproducible, and lets encrypted data be shared without relying on an IV file in the key directory. Patch 3 adds the resolution and validation described above, covering inline FITs completely; when re-processing a FIT that needs nothing resolved, the resolution step leaves the file to the later stages without a rewrite of its own. Patch 4 makes external data mode (-E and -p) store the shared payload only once: sharers skip the extraction and are pointed at the referenced image's region through identical data-offset or data-position and data-size values. Patch 5 completes the validation for the new property by teaching the configuration load overlap check to size data-less sharers from their target. The check runs before the references are resolved, so such images would otherwise escape it. Patch 6 adds user documentation: a worked example page under doc/usage/fit/ showing a kernel offered at two load addresses by two configurations while the payload is stored once, followed by the rules the producer enforces, the resolved form, the interaction with hashing, signing and encryption, and a pointer to the specification. Patch 7 adds the sandbox tests: inline and external sharing, mkimage -F re-processing including conversion between the two forms, the rejection cases, encrypted sharing through a shared iv-name-hint and through a shared explicit iv, and the overlap rejection. Each patch builds and works on its own. On sandbox the new tests pass together with the FIT, vboot, mkimage and cipher pytest selection and the complete binman suite. The feature is also verified on hardware: an i.MX6ULL EVK boots an Ubuntu Core style multi-board FIT whose i.MX6ULL variants share the kernel, ramdisk and FDT payloads through image-data, keeping the image at roughly 40 MB instead of the 78 MB it would take with the payloads duplicated. [1] https://github.com/open-source-firmware/flat-image-tree [2] https://github.com/open-source-firmware/flat-image-tree/pull/58 Aristo Chen (7): include: image: drop the duplicate FIT_ALGO_PROP definition tools: mkimage: use an explicit iv from the cipher node when encrypting tools: mkimage: resolve image-data references between FIT images tools: mkimage: share the external-data region between image-data images tools: mkimage: include image-data sharers in the load overlap check doc: fit: document shared image data through the image-data property test: py: add tests for the FIT image-data property doc/usage/fit/index.rst | 1 + doc/usage/fit/multi-with-shared-data.rst | 114 ++++++ include/image.h | 5 +- test/py/tests/test_fit_image_data.py | 391 ++++++++++++++++++++ tools/fit_image.c | 449 ++++++++++++++++++++++- tools/image-host.c | 20 +- 6 files changed, 973 insertions(+), 7 deletions(-) create mode 100644 doc/usage/fit/multi-with-shared-data.rst create mode 100644 test/py/tests/test_fit_image_data.py -- 2.43.0
