summaryrefslogtreecommitdiffstats
path: root/meta/classes/uboot-sign.bbclass
Commit message (Collapse)AuthorAgeFilesLines
* classes: Update classes to match new bitbake class scope functionalityRichard Purdie2022-08-121-505/+0
| | | | | | | | | Move classes to classes-global or classes-recipe as appropriate to take advantage of new bitbake functionality to check class scope/usage. (From OE-Core rev: f5c128008365e141082c129417eb72d2751e8045) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes: Add SPDX license identifiersRichard Purdie2022-08-121-0/+2
| | | | | | | | | | | | As stated in our top level license files, the license is MIT unless otherwise stated. Add SPDX identifers accordingly. Replace older license statementa with the standardised syntax. Also drop "All Rights Reserved" expression as it isn't used now, doesn't mean anything and is confusing. (From OE-Core rev: 081a391fe09a21265881e39a2a496e4e10b4f80b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes: Add copyright statements to files without oneRichard Purdie2022-08-121-0/+4
| | | | | | | | | Where there isn't a copyright statement, add one to make it explicit. Also drop editor config lines where they were present. (From OE-Core rev: 880c1ea3edc8edef974e65b2d424fc36809ea034) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel-fitimage.bbclass: add padding algorithm property in config nodesLUIS ENRIQUEZ2022-07-191-0/+3
| | | | | | | | | | This allows choosing padding algorithm when building fitImage. It may be pkcs-1.5 or pss. (From OE-Core rev: 29d5336c728b28890bbaadebf0ccff00ad90a64d) Signed-off-by: LUIS ENRIQUEZ <luis.enriquez@se.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign: Fix potential index error issuesRichard Purdie2022-06-111-0/+2
| | | | | | | | | | | | | Someone reported that if some other shell function has left i or j set, the concat_dtb_helper function could fail. Add a small tweak to avoid this. [YOCTO #14815] (From OE-Core rev: d219c97bdf5d30be89795fbf9b66ddc367bef384) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* u-boot: Fix condition for install_spl_helperSean Anderson2022-04-051-1/+1
| | | | | | | | | | | | | | | The condition for calling install_spl_helper when compiling multiple configs does not match the condition for a single config. This causes compilation failures when ${UBOOT_FITIMAGE_ENABLE} is 1 but ${SPL_SIGN_ENABLE} is not. Fixes: 5af4dfe83c2 ("u-boot: Add infrastructure to SPL verified boot") (From OE-Core rev: 7dc155961649c022d33cf7c6a5155cdfa5dc2969) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign: fix the concatenation when multiple U-BOOT configurations are ↵Thomas Perrot2021-12-091-1/+15
| | | | | | | | | | | | | | | | | | specified Some BSPs, especially those of meta-freescale and meta-ti allow to build U-Boot binaries using different configuration for a given target, for example: - UBOOT_CONFIG ??= "tfa-secure-boot tfa" - UBOOT_CONFIG ??= "nand sdcard spi nor" When this is the case the public key wasn't concatenated to all U-Boot binaries built. (From OE-Core rev: dfd71ae3d102f3010c6117d774e9739a322930f6) Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* featimage: refactor styleAndrej Valek2021-10-181-28/+28
| | | | | | | | | | | | | - use bash variable notation without {} where possible - just to make sure it looks like bash variable not bitbake variable one - fix indent style in "cat" commands - replace "! -z" -> "-n" - make debug info in ramdisk section creation more verbose (From OE-Core rev: f44bb458884da64356ee188917094b5515d3b159) Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Convert to new override syntaxRichard Purdie2021-08-021-4/+4
| | | | | | | | | | | | This is the result of automated script conversion: scripts/contrib/convert-overrides.py <oe-core directory> converting the metadata to use ":" as the override character instead of "_". (From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign.bbclass: fix some install commandsMing Liu2021-06-221-5/+3
| | | | | | | | | | | | | | | | | A "install -d" command is missing when dealing with ${UBOOT_NODTB_BINARY} in install_spl_helper function, this can lead to invalid install error saying: | install: cannot create .../usr/share/u-boot-nodtb-2021.04-r0.bin': No such file or directory Let's drop all "install -d" and replace them with "install -Dm" in install_helper/install_spl_helper functions. (From OE-Core rev: db2b1da511ea3d4daef136a8b1d85b7040a46632) Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign/kernel-fitimage: split generate_rsa_keys taskMing Liu2021-05-251-27/+2
| | | | | | | | | | | | | Currently generate_rsa_keys tasks are being executed parallelly in kernel and uboot's task list, and both of them are calling openssl to generate rsa keys in same path, this can lead to race condition. Let's split it to kernel_generate_rsa_keys and uboot_generate_rsa_keys. (From OE-Core rev: 36814f5467c9abd84aeb05916b4fd49f766f4f9f) Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot: Fixes SPL verified boot on corner casesKlaus Heinrich Kiwi2021-04-061-19/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | * The kernel-fitimage class adds a do_assemble_fitimage_initramfs task regardless of INITRAMFS_IMAGE_BUNDLE setting, which in some cases can result in that task running after do_uboot_assemble_fitimage and overwriting the u-boot-spl.dtb file with the pristine version (without public key). Fix this by making do_uboot_assemble_fitimage dependant on both do_assemble_fitimage_* tasks, regardless of the aforementioned setting. * Adjust 'type' and 'os' on the U-boot fitimage its script so that mkimage/dumpimage can recognize them. * Move the deployment of the u-boot-spl-nodtb files outside of concat_spl_dtb_helper(), so that we can better isolate the scenarios of creating an (unsigned) U-Boot fitimage versus also signing it. This prevents some stale files from being deployed in the images directory. * Remove any u-boot-fitImage and u-boot-its files from build tree, in case the build tree is being reused across bitbake calls. (From OE-Core rev: dc26d35e0935f30af55a3d2cb5c501d1b5c35437) Signed-off-by: Klaus Heinrich Kiwi <klaus@linux.vnet.ibm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* u-boot: Use a different Key for SPL signingKlaus Heinrich Kiwi2021-04-061-10/+43
| | | | | | | | | | Duplicate the variables governing u-boot signing so that we can have a different set of keys/parameters signing the SPL. (From OE-Core rev: 0e6b0fefa02356afeb11a32dfee7f0c7c250ab7f) Signed-off-by: Klaus Heinrich Kiwi <klaus@linux.vnet.ibm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* u-boot: Add infrastructure to SPL verified bootKlaus Heinrich Kiwi2021-04-061-28/+323
| | | | | | | | | | | Add the necessary infrastructure to create a U-boot proper fitimage, sign it (using the same keys as the kernel-fitimage), and put the public key in the SPL binary so that verified SPL boot can be accomplished. (From OE-Core rev: 5af4dfe83c2f6509015916262be32fc09bc9714d) Signed-off-by: Klaus Heinrich Kiwi <klaus@linux.vnet.ibm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* u-boot: Move definitions to common locationsKlaus Heinrich Kiwi2021-04-061-0/+35
| | | | | | | | | | | | Move some definitions from u-boot.inc into uboot-config.bbclass and similarly from kernel-fitimage.bbclass into uboot-sign.bbclass, so that they can be useful when signing the U-boot proper fitimage, for a verified-boot SPL. (From OE-Core rev: cc6c3e31526d3b6ef3a87ba5e548fcad7483bd51) Signed-off-by: Klaus Heinrich Kiwi <klaus@linux.vnet.ibm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot: Deploy default symlinks with fitImageKlaus Heinrich Kiwi2021-04-051-0/+9
| | | | | | | | | | | Some image recipes uses ${DEPLOY_DIR_IMAGE}/${UBOOT_BINARY} to create their images. Force the re-creation of those symlinks pointing to the u-boot-fitImage in case UBOOT_FITIMAGE_ENABLE is set. (From OE-Core rev: 11a016aaf243a110f7139ea052fd4e568aad40dd) Signed-off-by: Klaus Heinrich Kiwi <klaus@linux.vnet.ibm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign: Refactor do_deploy prefunc to do_deploy_prependDaniel Klauer2020-06-301-5/+6
| | | | | | | | | | | | | | | | | When inherited by the u-boot recipe (UBOOT_PN), uboot-sign.bbclass adds a concat_dtb step, which places additional files into ${DEPLOYDIR} before do_deploy. By turning this from a prefunc into a part of the normal do_deploy function, it becomes possible to use do_deploy[cleandirs] = "${DEPLOYDIR}" in the future, without deleting the files produced by concat_dtb. As before, care is taken to not interfere with the kernel's do_deploy definition, since concat_dtb was only needed for u-boot. (From OE-Core rev: 17619c1a41fa961afc317e4aafab9cdc4ff14a49) Signed-off-by: Daniel Klauer <daniel.klauer@gin.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel-fitimage: uboot-sign: fix missing signatureJun Nie2019-07-181-1/+3
| | | | | | | | | | | u-boot.bin with dtb & signature should be placed in ${B} so that it can be deployed by u-boot as expected. Otherwise, the version without signature is installed. (From OE-Core rev: bfc8c964a9760a2c4a1d1902918908a1e7361c17) Signed-off-by: Jun Nie <jun.nie@linaro.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel-fitimage: uboot-sign: Check UBOOT_DTB_BINARY before adding depsAlex Kiernan2019-06-121-1/+1
| | | | | | | | | | | | Since UBOOT_DTB_BINARY empty means we don't need to inject signatures into the U-Boot DTB, we can remove the dependencies between consumers of these two classes and resolve a circular dependency between u-boot and kernel. (From OE-Core rev: c6b49cb75285e71909d1f9e4bf636f186941b519) Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign: Fix u-boot-nodtb symlinksYing-Chun Liu (PaulLiu)2019-05-091-2/+2
| | | | | | | | | | When using u-boot-nodtb, the symlink didn't install correctly to the ${DEPLOYDIR}. This commit fixes this bug. (From OE-Core rev: c4eddb65e2ddb61bf519b768fab1e131fb0c297b) Signed-off-by: Ying-Chun Liu (PaulLiu) <paulliu@debian.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign: Fix build when UBOOT_DTB_BINARY is emptyAlex Kiernan2019-05-031-7/+7
| | | | | | | | | | | | | | | | When UBOOT_DTB_BINARY is empty and because the code now changes directory into ${B}, the test for the existence becomes `[ -f ]` which succeeds and subsequently the install fails. Reorder the code so it's clear that UBOOT_DTB_BINARY empty is an expected configuration and then quote UBOOT_DTB_BINARY everywhere so no one trips over this again. Fixes: bacb59079eb6 ("uboot-sign: add support for different u-boot configurations") (From OE-Core rev: e79f0db0745625b35dd83483747e486d08eebfde) Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign: add support for different u-boot configurationsAndreas Obergschwandtner2019-04-161-31/+54
| | | | | | | | | | | This is done by concatenating the DTB with the kernels public key to all built u-boot binaries. Furthermore the installation of all the binaries is required. (From OE-Core rev: bacb59079eb6ba7e43507a6d3a357341fb367f83) Signed-off-by: Andreas Obergschwandtner <andreas.obergschwandtner@skidata.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign.bbclass: silence warnings when UBOOT_DTB_BINARY is emptyAlex Kiernan2019-01-111-2/+2
| | | | | | | | | | | | When UBOOT_DTB_BINARY is set to "", the keys for signed booting are expected to be already present in U-Boot's DTB, so don't issue warnings for this. (From OE-Core rev: 04656f5df326a72747fc5878ce201b636a2a419c) Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign.bbclass: fix signature and deploymentRobert Yang2018-12-081-42/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixed: MACHINE = "beaglebone-yocto" KERNEL_CLASSES += "kernel-fitimage" KERNEL_IMAGETYPE_beaglebone-yocto = "fitImage" UBOOT_MACHINE_beaglebone-yocto = "am335x_boneblack_vboot_config" UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000" UBOOT_SIGN_KEYDIR = "${TOPDIR}/conf" UBOOT_SIGN_KEYNAME = "dev" UBOOT_SIGN_ENABLE = "1" IMAGE_INSTALL_remove = "kernel-image-zimage" $ cd conf $ openssl genrsa -F4 -out dev.key 2048 $ openssl req -batch -new -x509 -key dev.key -out dev.crt $ cd ../ $ bitbake u-boot linux-yocto $ grep signature tmp/deploy/images/beaglebone-yocto/*.dtb Binary file tmp/deploy/images/beaglebone-yocto/u-boot-beaglebone-yocto-2018.07-r0.dtb matches Binary file tmp/deploy/images/beaglebone-yocto/u-boot-beaglebone-yocto.dtb matches Binary file tmp/deploy/images/beaglebone-yocto/u-boot.dtb matches And there would be no signature info when rebuild from sstate: $ bitbake u-boot linux-yocto -cclean $ bitbake u-boot linux-yocto $ grep signature tmp/deploy/images/beaglebone-yocto/*.dtb No result This s because kernel directly edit ${DEPLOY_DIR_IMAGE}/u-boot.dtb, (Note, it is global ${DEPLOY_DIR_IMAGE}, not recipe's DEPLOYDIR), so that the modified info is not in sstate, and would be lost when rebuild from sstate. There are other problems in previouse code: - The u-boot.dtb is provided by u-boot, but edited by kernel during signing, so it should be deployed by kernel rather than u-boot. - The u-boot.do_concat_dtb directly install files to global ${DEPLOY_DIR_IMAGE}, this is incorrect, the ${DEPLOY_DIR_IMAGE} should be installed by do_deploy. - It seems that it assumes do_deploy depends on do_install according the comments, but they have no relationships: # do_concat_dtb is scheduled _before_ do_install as it overwrite the # u-boot.bin in both DEPLOYDIR and DEPLOY_IMAGE_DIR. - The do_concat_dtb should be run after do_compile, but it doesn't have this dependency. Make u-boot install u-boot.dtb to ${datadir}, kernel copies u-boot.dtb from ${STAGING_DATADIR} to ${B} and deploy it can fix the problem. [YOCTO #12112] Reported-by: Christian Andersen <c.andersen@kostal.com> (From OE-Core rev: 493f70cfb177f1d452a13329647a38642bf2b161) Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign.bbclass: Remove tab indentations in python codeRobert Yang2018-12-051-10/+10
| | | | | | | | | Use 4 spaces to replace a tab. (From OE-Core rev: 790828a65316fee57cd7659ad8b7544de5d2610c) Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes: Fix "U-boot", use proper spelling of "U-Boot".Robert P. J. Day2017-03-171-1/+1
| | | | | | | | | | | U-Boot people are amazingly pedantic in their insistence on proper spelling of "U-Boot", so humour them. (From OE-Core rev: f346a9bdc372ec477bafcda358f9339ff4e4c79d) Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta: remove True option to getVar callsJoshua Lock2016-12-161-3/+3
| | | | | | | | | | | | | getVar() now defaults to expanding by default, thus remove the True option from getVar() calls with a regex search and replace. Search made with the following regex: getVar ?\(( ?[^,()]*), True\) (From OE-Core rev: 7c552996597faaee2fbee185b250c0ee30ea3b5f) Signed-off-by: Joshua Lock <joshua.g.lock@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign: fix do_concat_dtb for .img, .romGeorge McCollister2016-11-061-2/+2
| | | | | | | | | | | Now that out of tree building is enabled, ${B} must be used instead of ${S} as the path for UBOOT_BINARY. (From OE-Core rev: 1fe17c52e4d7ce1b9d69aaa2cd9d4b351a4b2603) Signed-off-by: George McCollister <george.mccollister@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign: do_concat_dtb(): cd to $BGeorge McCollister2016-08-101-0/+1
| | | | | | | | | | | | | | | | Prior to running oe_runmake make sure $B is the cwd. This is required due to bitbake commit 67a7b8b021badc17d8fdf447c250e79d291e75f7 "build: don't use $B as the default cwd for functions". Without this change, do_concat_dtb fails with: | ERROR: oe_runmake failed | make: *** No targets specified and no makefile found. Stop. (From OE-Core rev: 6dca3dee34b587157d0d49c590a177ff1dabb374) Signed-off-by: George McCollister <george.mccollister@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign: Handle .rom signing the same as .imgGeorge McCollister2016-08-101-1/+2
| | | | | | | | | | | Handle u-boot.rom signing (U-Boot as x86 BIOS replacement) the same way that u-boot.img signing is handled. (From OE-Core rev: 94e3f427bbeb005d8443e9d822c3182f280df470) Signed-off-by: George McCollister <george.mccollister@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uboot-sign: rebuild u-boot.img with signed dtbGeorge McCollister2016-05-301-2/+6
| | | | | | | | | | | | | u-boot-nodtb.img doesn't exist so if UBOOT_SUFFIX = "img" is used u-boot.img must be rebuilt by running make with EXT_DTB=${DEPLOYDIR}/${UBOOT_DTB_IMAGE} then the resulting .img file must be install to the deploy directories. (From OE-Core rev: 4afee787e455ce1d4c002cd5c003182f1fc50028) Signed-off-by: George McCollister <george.mccollister@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* u-boot: deploy u-boot-nodtb and dtb filesYannick Gicquel2016-05-061-0/+22
| | | | | | | | | This enable the deployment of u-boot-nodtb.bin and u-boot.dtb files. (From OE-Core rev: 396a3fb0f55a443f73d6ddd99d8ba83412db2d40) Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* u-boot: basic support of dtb append for verified bootYannick Gicquel2016-05-061-0/+67
This introduces a new uboot-sign.class to support U-Boot verified boot. This part delivers the new class file, with related environment variables, and a new task intended to run before do_install task and which performs the concatenation of the u-boot-nodtb.bin and the device tree blob. The 'cat' command used overrides the u-boot.bin in both DEPLOYDIR & build dir to propagate the changes in later tasks (do_install, do_package, etc.) (From OE-Core rev: 27e21c50ada2f5fb6296cce680da4350a229977c) Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-12 12:22:51 +0000