1 files changed, 213 insertions, 51 deletions

diff --git a/meta/classes-recipe/uboot-sign.bbclass b/meta/classes-recipe/uboot-sign.bbclass
index c8e097f2f2..0f387a3a3e 100644
--- a/meta/classes-recipe/uboot-sign.bbclass
+++ b/meta/classes-recipe/uboot-sign.bbclass
@@ -26,6 +26,7 @@
 
 # We need some variables from u-boot-config
 inherit uboot-config
+require conf/image-fitimage.conf
 
 # Enable use of a U-Boot fitImage
 UBOOT_FITIMAGE_ENABLE ?= "0"
@@ -49,6 +50,8 @@ UBOOT_FITIMAGE_BINARY ?= "u-boot-fitImage"
 UBOOT_FITIMAGE_SYMLINK ?= "u-boot-fitImage-${MACHINE}"
 SPL_DIR ?= "spl"
 SPL_DTB_IMAGE ?= "u-boot-spl-${MACHINE}-${PV}-${PR}.dtb"
+# When SPL is not used, set SPL_DTB_BINARY ?= "" to explicitly indicate
+# that no SPL DTB should be created or signed.
 SPL_DTB_BINARY ?= "u-boot-spl.dtb"
 SPL_DTB_SIGNED ?= "${SPL_DTB_BINARY}-signed"
 SPL_DTB_SYMLINK ?= "u-boot-spl-${MACHINE}.dtb"
@@ -85,19 +88,40 @@ UBOOT_FIT_KEY_SIGN_PKCS ?= "-x509"
 # ex: 1 32bits address, 2 64bits address
 UBOOT_FIT_ADDRESS_CELLS ?= "1"
 
-# This is only necessary for determining the signing configuration
-KERNEL_PN = "${PREFERRED_PROVIDER_virtual/kernel}"
+# ARM Trusted Firmware(ATF) is a reference implementation of secure world
+# software for Arm A-Profile architectures, (Armv8-A and Armv7-A), including
+# an Exception Level 3 (EL3) Secure Monitor.
+UBOOT_FIT_ARM_TRUSTED_FIRMWARE ?= "0"
+UBOOT_FIT_ARM_TRUSTED_FIRMWARE_IMAGE ?= "bl31.bin"
+
+# A Trusted Execution Environment(TEE) is an environment for executing code,
+# in which those executing the code can have high levels of trust in the asset
+# management of that surrounding environment.
+UBOOT_FIT_TEE ?= "0"
+UBOOT_FIT_TEE_IMAGE ?= "tee-raw.bin"
+
+# User specific settings
+UBOOT_FIT_USER_SETTINGS ?= ""
+
+# Sets the firmware property to select the image to boot first.
+# If not set, the first entry in "loadables" is used instead.
+UBOOT_FIT_CONF_FIRMWARE ?= ""
+
+# Unit name containing a list of users additional binaries to be loaded.
+# It is a comma-separated list of strings.
+UBOOT_FIT_CONF_USER_LOADABLES ?= ''
 
 UBOOT_FIT_UBOOT_LOADADDRESS ?= "${UBOOT_LOADADDRESS}"
 UBOOT_FIT_UBOOT_ENTRYPOINT ?= "${UBOOT_ENTRYPOINT}"
 
+
+DEPENDS:append = " ${@'kernel-signing-keys-native' if d.getVar('FIT_GENERATE_KEYS') == '1' else ''}"
+
 python() {
     # We need u-boot-tools-native if we're creating a U-Boot fitImage
     sign = d.getVar('UBOOT_SIGN_ENABLE') == '1'
     if d.getVar('UBOOT_FITIMAGE_ENABLE') == '1' or sign:
         d.appendVar('DEPENDS', " u-boot-tools-native dtc-native")
-    if sign:
-        d.appendVar('DEPENDS', " " + d.getVar('KERNEL_PN'))
 }
 
 concat_dtb() {
@@ -105,38 +129,92 @@ concat_dtb() {
         binary="$2"
 
         if [ -e "${UBOOT_DTB_BINARY}" ]; then
-                # Re-sign the kernel in order to add the keys to our dtb
+                # Signing individual images is not recommended as that
+                # makes fitImage susceptible to mix-and-match attack.
+                #
+                # OE FIT_SIGN_INDIVIDUAL is implemented in an unusual manner,
+                # where the resulting signed fitImage contains both signed
+                # images and signed configurations. This is redundant. In
+                # order to prevent mix-and-match attack, it is sufficient
+                # to sign configurations. The FIT_SIGN_INDIVIDUAL = "1"
+                # support is kept to avoid breakage of existing layers, but
+                # it is highly recommended to avoid FIT_SIGN_INDIVIDUAL = "1",
+                # i.e. set FIT_SIGN_INDIVIDUAL = "0" .
+                if [ "${FIT_SIGN_INDIVIDUAL}" = "1" ] ; then
+                        # Sign dummy image images in order to
+                        # add the image signing keys to our dtb
+                        ${UBOOT_MKIMAGE_SIGN} \
+                                ${@'-D "${UBOOT_MKIMAGE_DTCOPTS}"' if len('${UBOOT_MKIMAGE_DTCOPTS}') else ''} \
+                                -f auto \
+                                -k "${UBOOT_SIGN_KEYDIR}" \
+                                -o "${FIT_HASH_ALG},${FIT_SIGN_ALG}" \
+                                -g "${UBOOT_SIGN_IMG_KEYNAME}" \
+                                -K "${UBOOT_DTB_BINARY}" \
+                                -d /dev/null \
+                                -r ${B}/unused.itb \
+                                ${UBOOT_MKIMAGE_SIGN_ARGS}
+                fi
+
+                # Sign dummy image configurations in order to
+                # add the configuration signing keys to our dtb
                 ${UBOOT_MKIMAGE_SIGN} \
                         ${@'-D "${UBOOT_MKIMAGE_DTCOPTS}"' if len('${UBOOT_MKIMAGE_DTCOPTS}') else ''} \
-                        -F -k "${UBOOT_SIGN_KEYDIR}" \
+                        -f auto-conf \
+                        -k "${UBOOT_SIGN_KEYDIR}" \
+                        -o "${FIT_HASH_ALG},${FIT_SIGN_ALG}" \
+                        -g "${UBOOT_SIGN_KEYNAME}" \
                         -K "${UBOOT_DTB_BINARY}" \
-                        -r ${B}/fitImage-linux \
+                        -d /dev/null \
+                        -r ${B}/unused.itb \
                         ${UBOOT_MKIMAGE_SIGN_ARGS}
-                # Verify the kernel image and u-boot dtb
-                ${UBOOT_FIT_CHECK_SIGN} \
-                        -k "${UBOOT_DTB_BINARY}" \
-                        -f ${B}/fitImage-linux
+
+                # Verify the dummy fitImage signature against u-boot.dtb
+                # augmented using public key material.
+                #
+                # This only works for FIT_SIGN_INDIVIDUAL = "0", because
+                # mkimage -f auto-conf does not support -F to extend the
+                # existing unused.itb , and instead rewrites unused.itb
+                # from scratch.
+                #
+                # Using two separate unused.itb for mkimage -f auto and
+                # mkimage -f auto-conf invocation above would not help, as
+                # the signature verification process below checks whether
+                # all keys inserted into u-boot.dtb /signature node pass
+                # the verification. Separate unused.itb would each miss one
+                # of the signatures.
+                #
+                # The FIT_SIGN_INDIVIDUAL = "1" support is kept to avoid
+                # breakage of existing layers, but it is highly recommended
+                # to not use FIT_SIGN_INDIVIDUAL = "1", i.e. set
+                # FIT_SIGN_INDIVIDUAL = "0" .
+                if [ "${FIT_SIGN_INDIVIDUAL}" != "1" ] ; then
+                        ${UBOOT_FIT_CHECK_SIGN} \
+                                -k "${UBOOT_DTB_BINARY}" \
+                                -f ${B}/unused.itb
+                fi
                 cp ${UBOOT_DTB_BINARY} ${UBOOT_DTB_SIGNED}
         fi
 
         # If we're not using a signed u-boot fit, concatenate SPL w/o DTB & U-Boot DTB
         # with public key (otherwise U-Boot will be packaged by uboot_fitimage_assemble)
         if [ "${SPL_SIGN_ENABLE}" != "1" ] ; then
-                if [ "x${UBOOT_SUFFIX}" = "ximg" -o "x${UBOOT_SUFFIX}" = "xrom" ] && \
-                        [ -e "${UBOOT_DTB_BINARY}" ]; then
+                if [ ! -e "${UBOOT_DTB_BINARY}" ]; then
+                        bbwarn "Failure while adding public key to u-boot binary. Verified boot won't be available."
+                        return
+                fi
+
+                if [ "x${UBOOT_SUFFIX}" = "ximg" ] || [ "x${UBOOT_SUFFIX}" = "xrom" ]; then
                         oe_runmake EXT_DTB="${UBOOT_DTB_SIGNED}" ${UBOOT_MAKE_TARGET}
                         if [ -n "${binary}" ]; then
                                 cp ${binary} ${UBOOT_BINARYNAME}-${type}.${UBOOT_SUFFIX}
                         fi
-                elif [ -e "${UBOOT_NODTB_BINARY}" -a -e "${UBOOT_DTB_BINARY}" ]; then
+                elif [ -e "${UBOOT_NODTB_BINARY}" ]; then
                         if [ -n "${binary}" ]; then
                                 cat ${UBOOT_NODTB_BINARY} ${UBOOT_DTB_SIGNED} | tee ${binary} > \
                                         ${UBOOT_BINARYNAME}-${type}.${UBOOT_SUFFIX}
                         else
                                 cat ${UBOOT_NODTB_BINARY} ${UBOOT_DTB_SIGNED} > ${UBOOT_BINARY}
                         fi
-                else
-                        bbwarn "Failure while adding public key to u-boot binary. Verified boot won't be available."
                 fi
         fi
 }
@@ -168,7 +246,7 @@ deploy_dtb() {
 }
 
 concat_spl_dtb() {
-        if [ -e "${SPL_DIR}/${SPL_NODTB_BINARY}" -a -e "${SPL_DIR}/${SPL_DTB_BINARY}" ] ; then
+        if [ -e "${SPL_DIR}/${SPL_NODTB_BINARY}" ] && [ -e "${SPL_DIR}/${SPL_DTB_BINARY}" ] ; then
                 cat ${SPL_DIR}/${SPL_NODTB_BINARY} ${SPL_DIR}/${SPL_DTB_SIGNED} > "${SPL_BINARY}"
         else
                 bbwarn "Failure while adding public key to spl binary. Verified U-Boot boot won't be available."
@@ -234,9 +312,65 @@ do_uboot_generate_rsa_keys() {
 
 addtask uboot_generate_rsa_keys before do_uboot_assemble_fitimage after do_compile
 
+# Create a ITS file for the atf
+uboot_fitimage_atf() {
+        cat << EOF >> ${UBOOT_ITS}
+        atf {
+            description = "ARM Trusted Firmware";
+            data = /incbin/("${UBOOT_FIT_ARM_TRUSTED_FIRMWARE_IMAGE}");
+            type = "firmware";
+            arch = "${UBOOT_ARCH}";
+            os = "arm-trusted-firmware";
+            load = <${UBOOT_FIT_ARM_TRUSTED_FIRMWARE_LOADADDRESS}>;
+            entry = <${UBOOT_FIT_ARM_TRUSTED_FIRMWARE_ENTRYPOINT}>;
+            compression = "none";
+EOF
+        if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then
+                cat << EOF >> ${UBOOT_ITS}
+            signature {
+                algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}";
+                key-name-hint = "${SPL_SIGN_KEYNAME}";
+            };
+EOF
+        fi
+
+        cat << EOF >> ${UBOOT_ITS}
+        };
+EOF
+}
+
+# Create a ITS file for the tee
+uboot_fitimage_tee() {
+        cat << EOF >> ${UBOOT_ITS}
+        tee {
+            description = "Trusted Execution Environment";
+            data = /incbin/("${UBOOT_FIT_TEE_IMAGE}");
+            type = "tee";
+            arch = "${UBOOT_ARCH}";
+            os = "tee";
+            load = <${UBOOT_FIT_TEE_LOADADDRESS}>;
+            entry = <${UBOOT_FIT_TEE_ENTRYPOINT}>;
+            compression = "none";
+EOF
+        if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then
+                cat << EOF >> ${UBOOT_ITS}
+            signature {
+                algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}";
+                key-name-hint = "${SPL_SIGN_KEYNAME}";
+            };
+EOF
+        fi
+
+        cat << EOF >> ${UBOOT_ITS}
+        };
+EOF
+}
+
 # Create a ITS file for the U-boot FIT, for use when
 # we want to sign it so that the SPL can verify it
 uboot_fitimage_assemble() {
+        conf_loadables="\"uboot\""
+        conf_firmware=""
         rm -f ${UBOOT_ITS} ${UBOOT_FITIMAGE_BINARY}
 
         # First we create the ITS script
@@ -289,13 +423,38 @@ EOF
 
         cat << EOF >> ${UBOOT_ITS}
         };
+EOF
+        if [ "${UBOOT_FIT_TEE}" = "1" ] ; then
+                conf_loadables="\"tee\", ${conf_loadables}"
+                uboot_fitimage_tee
+        fi
+
+        if [ "${UBOOT_FIT_ARM_TRUSTED_FIRMWARE}" = "1" ] ; then
+                conf_loadables="\"atf\", ${conf_loadables}"
+                uboot_fitimage_atf
+        fi
+
+        if [ -n "${UBOOT_FIT_USER_SETTINGS}" ] ; then
+                printf "%b" "${UBOOT_FIT_USER_SETTINGS}" >> ${UBOOT_ITS}
+        fi
+
+        if [ -n "${UBOOT_FIT_CONF_USER_LOADABLES}" ] ; then
+                conf_loadables="${conf_loadables}${UBOOT_FIT_CONF_USER_LOADABLES}"
+        fi
+
+        if [ -n "${UBOOT_FIT_CONF_FIRMWARE}" ] ; then
+                conf_firmware="firmware = \"${UBOOT_FIT_CONF_FIRMWARE}\";"
+        fi
+
+        cat << EOF >> ${UBOOT_ITS}
     };
 
     configurations {
         default = "conf";
         conf {
             description = "Boot with signed U-Boot FIT";
-            loadables = "uboot";
+            ${conf_firmware}
+            loadables = ${conf_loadables};
             fdt = "fdt";
         };
     };
@@ -311,25 +470,31 @@ EOF
                 ${UBOOT_FITIMAGE_BINARY}
 
         if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then
-                #
-                # Sign the U-boot FIT image and add public key to SPL dtb
-                #
-                ${UBOOT_MKIMAGE_SIGN} \
-                        ${@'-D "${SPL_MKIMAGE_DTCOPTS}"' if len('${SPL_MKIMAGE_DTCOPTS}') else ''} \
-                        -F -k "${SPL_SIGN_KEYDIR}" \
-                        -K "${SPL_DIR}/${SPL_DTB_BINARY}" \
-                        -r ${UBOOT_FITIMAGE_BINARY} \
-                        ${SPL_MKIMAGE_SIGN_ARGS}
-                #
-                # Verify the U-boot FIT image and SPL dtb
-                #
-                ${UBOOT_FIT_CHECK_SIGN} \
-                        -k "${SPL_DIR}/${SPL_DTB_BINARY}" \
-                        -f ${UBOOT_FITIMAGE_BINARY}
-        fi
-
-        if [ -e "${SPL_DIR}/${SPL_DTB_BINARY}" ]; then
-                cp ${SPL_DIR}/${SPL_DTB_BINARY} ${SPL_DIR}/${SPL_DTB_SIGNED}
+                if [ -n "${SPL_DTB_BINARY}" ] ; then
+                        #
+                        # Sign the U-boot FIT image and add public key to SPL dtb
+                        #
+                        ${UBOOT_MKIMAGE_SIGN} \
+                                ${@'-D "${SPL_MKIMAGE_DTCOPTS}"' if len('${SPL_MKIMAGE_DTCOPTS}') else ''} \
+                                -F -k "${SPL_SIGN_KEYDIR}" \
+                                -K "${SPL_DIR}/${SPL_DTB_BINARY}" \
+                                -r ${UBOOT_FITIMAGE_BINARY} \
+                                ${SPL_MKIMAGE_SIGN_ARGS}
+
+                        # Verify the U-boot FIT image and SPL dtb
+                        ${UBOOT_FIT_CHECK_SIGN} \
+                                -k "${SPL_DIR}/${SPL_DTB_BINARY}" \
+                                -f ${UBOOT_FITIMAGE_BINARY}
+
+                        cp ${SPL_DIR}/${SPL_DTB_BINARY} ${SPL_DIR}/${SPL_DTB_SIGNED}
+                else
+                        # Sign the U-boot FIT image
+                        ${UBOOT_MKIMAGE_SIGN} \
+                                ${@'-D "${SPL_MKIMAGE_DTCOPTS}"' if len('${SPL_MKIMAGE_DTCOPTS}') else ''} \
+                                -F -k "${SPL_SIGN_KEYDIR}" \
+                                -r ${UBOOT_FITIMAGE_BINARY} \
+                                ${SPL_MKIMAGE_SIGN_ARGS}
+                fi
         fi
 }
 
@@ -337,27 +502,24 @@ uboot_assemble_fitimage_helper() {
         type="$1"
         binary="$2"
 
-        if [ "${UBOOT_SIGN_ENABLE}" = "1" -a -n "${UBOOT_DTB_BINARY}" ] ; then
-                concat_dtb $type $binary
+        if [ "${UBOOT_SIGN_ENABLE}" = "1" ] && [ -n "${UBOOT_DTB_BINARY}" ] ; then
+                concat_dtb "$type" "$binary"
         fi
 
-        if [ "${UBOOT_FITIMAGE_ENABLE}" = "1" -a -n "${SPL_DTB_BINARY}" ]; then
+        if [ "${UBOOT_FITIMAGE_ENABLE}" = "1" ]; then
                 uboot_fitimage_assemble
         fi
 
-        if [ "${SPL_SIGN_ENABLE}" = "1" -a -n "${SPL_DTB_BINARY}" ] ; then
+        if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ -n "${SPL_DTB_BINARY}" ] ; then
                 concat_spl_dtb
         fi
 }
 
 do_uboot_assemble_fitimage() {
-        if [ "${UBOOT_SIGN_ENABLE}" = "1" ] ; then
-                cp "${STAGING_DIR_HOST}/sysroot-only/fitImage" "${B}/fitImage-linux"
-        fi
-
         if [ -n "${UBOOT_CONFIG}" ]; then
-                unset i j k
+                unset i
                 for config in ${UBOOT_MACHINE}; do
+                        unset j k
                         i=$(expr $i + 1);
                         for type in ${UBOOT_CONFIG}; do
                                 j=$(expr $j + 1);
@@ -387,11 +549,11 @@ addtask uboot_assemble_fitimage before do_install do_deploy after do_compile
 deploy_helper() {
         type="$1"
 
-        if [ "${UBOOT_SIGN_ENABLE}" = "1" -a -n "${UBOOT_DTB_SIGNED}" ] ; then
+        if [ "${UBOOT_SIGN_ENABLE}" = "1" ] && [ -n "${UBOOT_DTB_SIGNED}" ] ; then
                 deploy_dtb $type
         fi
 
-        if [ "${UBOOT_FITIMAGE_ENABLE}" = "1" -a -n "${SPL_DTB_BINARY}" ]; then
+        if [ "${UBOOT_FITIMAGE_ENABLE}" = "1" ]; then
                 if [ -n "${type}" ]; then
                         uboot_its_image="u-boot-its-${type}-${PV}-${PR}"
                         uboot_fitimage_image="u-boot-fitImage-${type}-${PV}-${PR}"
@@ -409,7 +571,7 @@ deploy_helper() {
                 fi
         fi
 
-        if [ "${SPL_SIGN_ENABLE}" = "1" -a -n "${SPL_DTB_SIGNED}" ] ; then
+        if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ -n "${SPL_DTB_BINARY}" ] ; then
                 deploy_spl_dtb $type
         fi
 }
@@ -434,7 +596,7 @@ do_deploy:prepend() {
                 deploy_helper ""
         fi
 
-        if [ "${UBOOT_SIGN_ENABLE}" = "1" -a -n "${UBOOT_DTB_BINARY}" ] ; then
+        if [ "${UBOOT_SIGN_ENABLE}" = "1" ] && [ -n "${UBOOT_DTB_BINARY}" ] ; then
                 ln -sf ${UBOOT_DTB_IMAGE} ${DEPLOYDIR}/${UBOOT_DTB_BINARY}
                 ln -sf ${UBOOT_DTB_IMAGE} ${DEPLOYDIR}/${UBOOT_DTB_SYMLINK}
                 ln -sf ${UBOOT_NODTB_IMAGE} ${DEPLOYDIR}/${UBOOT_NODTB_SYMLINK}
@@ -448,7 +610,7 @@ do_deploy:prepend() {
                 ln -sf ${UBOOT_FITIMAGE_IMAGE} ${DEPLOYDIR}/${UBOOT_FITIMAGE_SYMLINK}
         fi
 
-        if [ "${SPL_SIGN_ENABLE}" = "1" -a -n "${SPL_DTB_BINARY}" ] ; then
+        if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ -n "${SPL_DTB_BINARY}" ] ; then
                 ln -sf ${SPL_DTB_IMAGE} ${DEPLOYDIR}/${SPL_DTB_SYMLINK}
                 ln -sf ${SPL_DTB_IMAGE} ${DEPLOYDIR}/${SPL_DTB_BINARY}
                 ln -sf ${SPL_NODTB_IMAGE} ${DEPLOYDIR}/${SPL_NODTB_SYMLINK}