summaryrefslogtreecommitdiffstats
path: root/meta-ti-bsp
diff options
context:
space:
mode:
authorAndrew Davis <afd@ti.com>2023-01-04 13:19:41 -0600
committerRyan Eatmon <reatmon@ti.com>2023-01-24 12:50:06 -0600
commit0e5df43108a2123df3892e67c0fe52557255bd49 (patch)
tree34ca72a36a005acc1be338230407f7b6b0e98049 /meta-ti-bsp
parent7033f0e80415df970756fbdcee974db84482151f (diff)
downloadmeta-ti-0e5df43108a2123df3892e67c0fe52557255bd49.tar.gz
meta-ti-bsp: Move legacy HS signing classes into this layer
These were in the meta-arago layer, but any distro should be able to run on HS devices. So move the classes and setup to the BSP layer. Signed-off-by: Andrew Davis <afd@ti.com> Reviewed-by: Denys Dmytriyenko <denys@konsulko.com> Signed-off-by: Ryan Eatmon <reatmon@ti.com>
Diffstat (limited to 'meta-ti-bsp')
-rw-r--r--meta-ti-bsp/classes/kernel-fitimage-legacyhs.bbclass758
-rw-r--r--meta-ti-bsp/classes/uboot-sign-legacyhs.bbclass131
-rw-r--r--meta-ti-bsp/conf/machine/am335x-hs-evm.conf10
-rw-r--r--meta-ti-bsp/conf/machine/am437x-hs-evm.conf11
-rw-r--r--meta-ti-bsp/conf/machine/am57xx-hs-evm.conf11
-rw-r--r--meta-ti-bsp/conf/machine/dra7xx-hs-evm.conf11
6 files changed, 932 insertions, 0 deletions
diff --git a/meta-ti-bsp/classes/kernel-fitimage-legacyhs.bbclass b/meta-ti-bsp/classes/kernel-fitimage-legacyhs.bbclass
new file mode 100644
index 00000000..69fa0ed2
--- /dev/null
+++ b/meta-ti-bsp/classes/kernel-fitimage-legacyhs.bbclass
@@ -0,0 +1,758 @@
1inherit kernel-uboot uboot-sign-legacyhs
2
3FITIMAGE_HASH_ALGO ?= "sha1"
4FITIMAGE_PACK_TEE ?= "0"
5FITIMAGE_DTB_BY_NAME ?= "0"
6FITIMAGE_TEE_BY_NAME ?= "0"
7FITIMAGE_CONF_BY_NAME ?= "0"
8
9python __anonymous () {
10 kerneltypes = d.getVar('KERNEL_IMAGETYPES') or ""
11 if 'fitImage' in kerneltypes.split():
12 depends = d.getVar("DEPENDS")
13 depends = "%s u-boot-mkimage-native dtc-native" % depends
14 d.setVar("DEPENDS", depends)
15
16 uarch = d.getVar("UBOOT_ARCH")
17 if uarch == "arm64":
18 replacementtype = "Image"
19 elif uarch == "mips":
20 replacementtype = "vmlinuz.bin"
21 elif uarch == "x86":
22 replacementtype = "bzImage"
23 elif uarch == "microblaze":
24 replacementtype = "linux.bin"
25 else:
26 replacementtype = "zImage"
27
28 # Override KERNEL_IMAGETYPE_FOR_MAKE variable, which is internal
29 # to kernel.bbclass . We have to override it, since we pack zImage
30 # (at least for now) into the fitImage .
31 typeformake = d.getVar("KERNEL_IMAGETYPE_FOR_MAKE") or ""
32 if 'fitImage' in typeformake.split():
33 d.setVar('KERNEL_IMAGETYPE_FOR_MAKE', typeformake.replace('fitImage', replacementtype))
34
35 image = d.getVar('INITRAMFS_IMAGE')
36 if image:
37 d.appendVarFlag('do_assemble_fitimage_initramfs', 'depends', ' ${INITRAMFS_IMAGE}:do_image_complete')
38
39 # Verified boot will sign the fitImage and append the public key to
40 # U-boot dtb. We ensure the U-Boot dtb is deployed before assembling
41 # the fitImage:
42 if d.getVar('UBOOT_SIGN_ENABLE'):
43 uboot_pn = d.getVar('PREFERRED_PROVIDER_u-boot') or 'u-boot'
44 d.appendVarFlag('do_assemble_fitimage', 'depends', ' %s:do_deploy' % uboot_pn)
45
46 if d.getVar('FITIMAGE_PACK_TEE') == "1":
47 d.appendVarFlag('do_assemble_fitimage', 'depends', ' optee-os:do_deploy')
48}
49
50# Options for the device tree compiler passed to mkimage '-D' feature:
51UBOOT_MKIMAGE_DTCOPTS ??= ""
52
53fitimage_ti_secure() {
54 if test -n "${TI_SECURE_DEV_PKG}"; then
55 export TI_SECURE_DEV_PKG=${TI_SECURE_DEV_PKG}
56 ${TI_SECURE_DEV_PKG}/scripts/secure-binary-image.sh $1 $2
57 else
58 cp $1 $2
59 fi
60}
61
62#
63# Emit the fitImage ITS header
64#
65# $1 ... .its filename
66fitimage_emit_fit_header() {
67 cat << EOF >> ${1}
68/dts-v1/;
69
70/ {
71 description = "U-Boot fitImage for ${DISTRO_NAME}/${PV}/${MACHINE}";
72 #address-cells = <1>;
73EOF
74}
75
76#
77# Emit the fitImage section bits
78#
79# $1 ... .its filename
80# $2 ... Section bit type: imagestart - image section start
81# confstart - configuration section start
82# sectend - section end
83# fitend - fitimage end
84#
85fitimage_emit_section_maint() {
86 case $2 in
87 imagestart)
88 cat << EOF >> ${1}
89
90 images {
91EOF
92 ;;
93 confstart)
94 cat << EOF >> ${1}
95
96 configurations {
97EOF
98 ;;
99 sectend)
100 cat << EOF >> ${1}
101 };
102EOF
103 ;;
104 fitend)
105 cat << EOF >> ${1}
106};
107EOF
108 ;;
109 esac
110}
111
112#
113# Emit the fitImage ITS kernel section
114#
115# $1 ... .its filename
116# $2 ... Image counter
117# $3 ... Path to kernel image
118# $4 ... Compression type
119fitimage_emit_section_kernel() {
120
121 kernel_csum=${FITIMAGE_HASH_ALGO}
122
123 ENTRYPOINT="${UBOOT_ENTRYPOINT}"
124 if test -n "${UBOOT_ENTRYSYMBOL}"; then
125 ENTRYPOINT=`${HOST_PREFIX}nm ${S}/vmlinux | \
126 awk '$4=="${UBOOT_ENTRYSYMBOL}" {print $2}'`
127 fi
128
129 cat << EOF >> ${1}
130 kernel-${2} {
131 description = "Linux kernel";
132 data = /incbin/("${3}");
133 type = "kernel";
134 arch = "${UBOOT_ARCH}";
135 os = "linux";
136 compression = "${4}";
137 load = <${UBOOT_LOADADDRESS}>;
138 entry = <${ENTRYPOINT}>;
139EOF
140 if test -n "${FITIMAGE_HASH_ALGO}"; then
141 cat << EOF >> ${1}
142 hash-1 {
143 algo = "${kernel_csum}";
144 };
145EOF
146 fi
147 cat << EOF >> ${1}
148 };
149EOF
150}
151
152#
153# Emit the fitImage ITS DTB section
154#
155# $1 ... .its filename
156# $2 ... Image counter/name
157# $3 ... Path to DTB image
158# $4 ... Load address
159fitimage_emit_section_dtb() {
160
161 dtb_csum=${FITIMAGE_HASH_ALGO}
162 dtb_loadline="${4}"
163
164 cat << EOF >> ${1}
165 ${2} {
166 description = "Flattened Device Tree blob";
167 data = /incbin/("${3}");
168 type = "flat_dt";
169 arch = "${UBOOT_ARCH}";
170 compression = "none";
171 ${dtb_loadline}
172EOF
173 if test -n "${FITIMAGE_HASH_ALGO}"; then
174 cat << EOF >> ${1}
175 hash-1 {
176 algo = "${dtb_csum}";
177 };
178EOF
179 fi
180 cat << EOF >> ${1}
181 };
182EOF
183}
184
185#
186# Emit the fitImage ITS TEE section
187#
188# $1 ... .its filename
189# $2 ... Image counter/name
190# $3 ... Path to TEE image
191fitimage_emit_section_tee() {
192
193 tee_csum=${FITIMAGE_HASH_ALGO}
194
195 cat << EOF >> ${1}
196 ${2} {
197 description = "OPTEE OS Image";
198 data = /incbin/("${3}");
199 type = "tee";
200 arch = "${UBOOT_ARCH}";
201 compression = "none";
202EOF
203 if test -n "${FITIMAGE_HASH_ALGO}"; then
204 cat << EOF >> ${1}
205 hash-1 {
206 algo = "${tee_csum}";
207 };
208EOF
209 fi
210 cat << EOF >> ${1}
211 };
212EOF
213}
214
215#
216# Emit the fitImage ITS setup section
217#
218# $1 ... .its filename
219# $2 ... Image counter
220# $3 ... Path to setup image
221fitimage_emit_section_setup() {
222
223 setup_csum=${FITIMAGE_HASH_ALGO}
224
225 cat << EOF >> ${1}
226 setup-${2} {
227 description = "Linux setup.bin";
228 data = /incbin/("${3}");
229 type = "x86_setup";
230 arch = "${UBOOT_ARCH}";
231 os = "linux";
232 compression = "none";
233 load = <0x00090000>;
234 entry = <0x00090000>;
235EOF
236 if test -n "${FITIMAGE_HASH_ALGO}"; then
237 cat << EOF >> ${1}
238 hash-1 {
239 algo = "${setup_csum}";
240 };
241EOF
242 fi
243 cat << EOF >> ${1}
244 };
245EOF
246}
247
248#
249# Emit the fitImage ITS ramdisk section
250#
251# $1 ... .its filename
252# $2 ... Image counter
253# $3 ... Path to ramdisk image
254fitimage_emit_section_ramdisk() {
255
256 ramdisk_csum=${FITIMAGE_HASH_ALGO}
257 ramdisk_ctype="none"
258
259 case $3 in
260 *.gz|*.gz.sec)
261 ramdisk_ctype="gzip"
262 ;;
263 *.bz2|*.bz2.sec)
264 ramdisk_ctype="bzip2"
265 ;;
266 *.lzma|*.lzma.sec)
267 ramdisk_ctype="lzma"
268 ;;
269 *.lzo|*.lzo.sec)
270 ramdisk_ctype="lzo"
271 ;;
272 *.lz4|*.lz4.sec)
273 ramdisk_ctype="lz4"
274 ;;
275 esac
276
277 cat << EOF >> ${1}
278 ramdisk-${2} {
279 description = "ramdisk image";
280 data = /incbin/("${3}");
281 type = "ramdisk";
282 arch = "${UBOOT_ARCH}";
283 os = "linux";
284 compression = "${ramdisk_ctype}";
285EOF
286 if test -n "${UBOOT_RD_LOADADDRESS}"; then
287 cat << EOF >> ${1}
288 load = <${UBOOT_RD_LOADADDRESS}>;
289EOF
290 fi
291
292 if test -n "${UBOOT_RD_ENTRYPOINT}"; then
293 cat << EOF >> ${1}
294 entry = <${UBOOT_RD_ENTRYPOINT}>;
295EOF
296 fi
297
298 if test -n "${FITIMAGE_HASH_ALGO}"; then
299 cat << EOF >> ${1}
300 hash-1 {
301 algo = "${ramdisk_csum}";
302 };
303EOF
304 fi
305 cat << EOF >> ${1}
306 };
307EOF
308}
309
310#
311# Emit the fitImage ITS configuration section
312#
313# $1 ... .its filename
314# $2 ... Linux kernel ID
315# $3 ... DTB image ID/name
316# $4 ... ramdisk ID
317# $5 ... config ID
318# $6 ... tee ID/name
319fitimage_emit_section_config() {
320
321 conf_csum=${FITIMAGE_HASH_ALGO}
322 if [ -n "${UBOOT_SIGN_ENABLE}" ] ; then
323 conf_sign_keyname="${UBOOT_SIGN_KEYNAME}"
324 fi
325
326 sep=""
327 conf_desc=""
328 kernel_line=""
329 fdt_line=""
330 ramdisk_line=""
331 setup_line=""
332 default_line=""
333
334 if [ -n "${2}" ]; then
335 conf_desc="Linux kernel"
336 sep=", "
337 kernel_line="kernel = \"kernel-${2}\";"
338 fi
339
340 if [ -n "${3}" ]; then
341 conf_desc="${conf_desc}${sep}FDT blob"
342 sep=", "
343 fi
344
345 if [ -n "${4}" ]; then
346 conf_desc="${conf_desc}${sep}ramdisk"
347 sep=", "
348 ramdisk_line="ramdisk = \"ramdisk-${4}\";"
349 fi
350
351 if [ -n "${5}" ]; then
352 conf_desc="${conf_desc}${sep}setup"
353 sep=", "
354 setup_line="setup = \"setup-${5}\";"
355 fi
356
357 if [ -n "${6}" -a "x${FITIMAGE_PACK_TEE}" = "x1" ]; then
358 if [ "x${FITIMAGE_TEE_BY_NAME}" = "x1" ]; then
359 loadables_line="loadables = \"${6}.optee\";"
360 loadables_pager_line="loadables = \"${6}-pager.optee\";"
361 else
362 loadables_line="loadables = \"tee-${6}\";"
363 nextnum=`expr ${6} + 1`
364 loadables_pager_line="loadables = \"tee-${nextnum}\";"
365 fi
366 final_conf_desc="${conf_desc}${sep}OPTEE OS Image"
367 else
368 loadables_line=""
369 loadables_pager_line=""
370 final_conf_desc="${conf_desc}"
371 fi
372
373 dtbcount=1
374 for DTB in ${KERNEL_DEVICETREE}; do
375 DTB=$(basename "${DTB}")
376 dtb_ext=${DTB##*.}
377 if [ "x${FITIMAGE_CONF_BY_NAME}" = "x1" ] ; then
378 conf_name="${DTB}"
379 else
380 conf_name="conf-${dtbcount}"
381 fi
382
383 if [ "x${FITIMAGE_DTB_BY_NAME}" = "x1" ] ; then
384 fdt_line="fdt = \"${DTB}\";"
385 else
386 fdt_line="fdt = \"fdt-${dtbcount}\";"
387 fi
388
389 if [ "x${dtbcount}" = "x1" ]; then
390 cat << EOF >> ${1}
391 default = "${conf_name}";
392EOF
393 fi
394
395# Generate a single configuration section
396 cat << EOF >> ${1}
397 ${conf_name} {
398 description = "${final_conf_desc}";
399 ${fdt_line}
400EOF
401 if [ "${dtb_ext}" != "dtbo" ]; then
402 cat << EOF >> ${1}
403 ${kernel_line}
404 ${ramdisk_line}
405 ${setup_line}
406 ${loadables_line}
407EOF
408 fi
409 if test -n "${FITIMAGE_HASH_ALGO}"; then
410 cat << EOF >> ${1}
411 hash-1 {
412 algo = "${conf_csum}";
413 };
414EOF
415 fi
416
417 if [ ! -z "${conf_sign_keyname}" ] ; then
418
419 sign_line="sign-images = \"kernel\""
420
421 if [ -n "${3}" ]; then
422 sign_line="${sign_line}, \"fdt\""
423 fi
424
425 if [ -n "${4}" ]; then
426 sign_line="${sign_line}, \"ramdisk\""
427 fi
428
429 if [ -n "${5}" ]; then
430 sign_line="${sign_line}, \"setup\""
431 fi
432
433 sign_line="${sign_line};"
434
435 cat << EOF >> ${1}
436 signature-1 {
437 algo = "${conf_csum},rsa2048";
438 key-name-hint = "${conf_sign_keyname}";
439 ${sign_line}
440 };
441EOF
442 fi
443
444 cat << EOF >> ${1}
445 };
446EOF
447# End single config section
448
449# Generate a single "pager" configuration section
450 if [ "${OPTEEPAGER}" = "y" ]; then
451 if [ "x${FITIMAGE_CONF_BY_NAME}" = "x1" ] ; then
452 conf_name="${DTB}-pager"
453 else
454 conf_name="conf-${dtbcount}"
455 fi
456
457 cat << EOF >> ${1}
458 ${conf_name} {
459 description = "${final_conf_desc}";
460 ${fdt_line}
461EOF
462 if [ "${dtb_ext}" != "dtbo" ]; then
463 cat << EOF >> ${1}
464 ${kernel_line}
465 ${ramdisk_line}
466 ${setup_line}
467 ${loadables_pager_line}
468EOF
469 fi
470 if test -n "${FITIMAGE_HASH_ALGO}"; then
471 cat << EOF >> ${1}
472 hash-1 {
473 algo = "${conf_csum}";
474 };
475EOF
476 fi
477
478 if [ ! -z "${conf_sign_keyname}" ] ; then
479
480 sign_line="sign-images = \"kernel\""
481
482 if [ -n "${3}" ]; then
483 sign_line="${sign_line}, \"fdt\""
484 fi
485
486 if [ -n "${4}" ]; then
487 sign_line="${sign_line}, \"ramdisk\""
488 fi
489
490 if [ -n "${5}" ]; then
491 sign_line="${sign_line}, \"setup\""
492 fi
493
494 sign_line="${sign_line};"
495
496 cat << EOF >> ${1}
497 signature-1 {
498 algo = "${conf_csum},rsa2048";
499 key-name-hint = "${conf_sign_keyname}";
500 ${sign_line}
501 };
502EOF
503 fi
504
505 cat << EOF >> ${1}
506 };
507EOF
508 fi
509# End single config section
510
511 dtbcount=`expr ${dtbcount} + 1`
512 done
513}
514
515#
516# Assemble fitImage
517#
518# $1 ... .its filename
519# $2 ... fitImage name
520# $3 ... include ramdisk
521fitimage_assemble() {
522 kernelcount=1
523 dtbcount=""
524 ramdiskcount=${3}
525 setupcount=""
526 teecount=1
527 rm -f ${1} arch/${ARCH}/boot/${2}
528
529 fitimage_emit_fit_header ${1}
530
531 #
532 # Step 1: Prepare a kernel image section.
533 #
534 fitimage_emit_section_maint ${1} imagestart
535
536 uboot_prep_kimage
537 fitimage_ti_secure linux.bin linux.bin.sec
538 fitimage_emit_section_kernel ${1} "${kernelcount}" linux.bin.sec "${linux_comp}"
539
540 #
541 # Step 2: Prepare a DTB image section
542 #
543 if test -n "${KERNEL_DEVICETREE}"; then
544 dtbcount=1
545 dtboaddress="${UBOOT_DTBO_LOADADDRESS}"
546 for DTB in ${KERNEL_DEVICETREE}; do
547 if echo ${DTB} | grep -q '/dts/'; then
548 bbwarn "${DTB} contains the full path to the the dts file, but only the dtb name should be used."
549 DTB=`basename ${DTB} | sed 's,\.dts$,.dtb,g'`
550 fi
551 DTB_PATH="arch/${ARCH}/boot/dts/${DTB}"
552 if [ ! -e "${DTB_PATH}" ]; then
553 DTB_PATH="arch/${ARCH}/boot/${DTB}"
554 fi
555 DTB=$(basename "${DTB}")
556
557 dtb_ext=${DTB##*.}
558 if [ "${dtb_ext}" = "dtbo" ]; then
559 if [ -n "${UBOOT_DTBO_LOADADDRESS}" ]; then
560 dtb_loadline="load = <${dtboaddress}>;"
561 num1=`printf "%d\n" ${dtboaddress}`
562 num2=`printf "%d\n" ${UBOOT_DTBO_OFFSET}`
563 num3=`expr $num1 + $num2`
564 dtboaddress=`printf "0x%x\n" $num3`
565 fi
566 elif [ -n "${UBOOT_DTB_LOADADDRESS}" ]; then
567 dtb_loadline="load = <${UBOOT_DTB_LOADADDRESS}>;"
568 fi
569
570 fitimage_ti_secure ${DTB_PATH} ${DTB_PATH}.sec
571 if [ "x${FITIMAGE_DTB_BY_NAME}" = "x1" ] ; then
572 fitimage_emit_section_dtb ${1} ${DTB} ${DTB_PATH}.sec "${dtb_loadline}"
573 else
574 fitimage_emit_section_dtb ${1} "fdt-${dtbcount}" ${DTB_PATH}.sec "${dtb_loadline}"
575 fi
576 if [ "x${dtbcount}" = "x1" ]; then
577 dtbref=${DTB}
578 fi
579 dtbcount=`expr ${dtbcount} + 1`
580 done
581 fi
582
583 #
584 # Step 2a: Prepare OP/TEE image section
585 #
586 if [ "x${FITIMAGE_PACK_TEE}" = "x1" ] ; then
587 mkdir -p ${B}/usr
588 rm -f ${B}/usr/${OPTEEFLAVOR}.optee
589 if [ -e "${DEPLOY_DIR_IMAGE}/${OPTEEFLAVOR}.optee" ]; then
590 cp ${DEPLOY_DIR_IMAGE}/${OPTEEFLAVOR}.optee ${B}/usr/.
591 fi
592 TEE_PATH="usr/${OPTEEFLAVOR}.optee"
593 fitimage_ti_secure ${TEE_PATH} ${TEE_PATH}.sec
594 if [ "x${FITIMAGE_TEE_BY_NAME}" = "x1" ] ; then
595 fitimage_emit_section_tee ${1} ${OPTEEFLAVOR}.optee ${TEE_PATH}.sec
596 else
597 fitimage_emit_section_tee ${1} "tee-${teecount}" ${TEE_PATH}.sec
598 fi
599
600 if [ "${OPTEEPAGER}" = "y" ]; then
601 teecount=`expr ${teecount} + 1`
602 rm -f ${B}/usr/${OPTEEFLAVOR}-pager.optee
603 if [ -e "${DEPLOY_DIR_IMAGE}/${OPTEEFLAVOR}-pager.optee" ]; then
604 cp ${DEPLOY_DIR_IMAGE}/${OPTEEFLAVOR}-pager.optee ${B}/usr/.
605 fi
606 TEE_PATH="usr/${OPTEEFLAVOR}-pager.optee"
607 fitimage_ti_secure ${TEE_PATH} ${TEE_PATH}.sec
608 if [ "x${FITIMAGE_TEE_BY_NAME}" = "x1" ] ; then
609 fitimage_emit_section_tee ${1} ${OPTEEFLAVOR}-pager.optee ${TEE_PATH}.sec
610 else
611 fitimage_emit_section_tee ${1} "tee-${teecount}" ${TEE_PATH}.sec
612 fi
613 fi
614 fi
615
616 #
617 # Step 3: Prepare a setup section. (For x86)
618 #
619 if test -e arch/${ARCH}/boot/setup.bin ; then
620 setupcount=1
621 fitimage_emit_section_setup ${1} "${setupcount}" arch/${ARCH}/boot/setup.bin
622 fi
623
624 #
625 # Step 4: Prepare a ramdisk section.
626 #
627 if [ "x${ramdiskcount}" = "x1" ] ; then
628 # Find and use the first initramfs image archive type we find
629 for img in cpio.lz4 cpio.lzo cpio.lzma cpio.xz cpio.gz cpio; do
630 initramfs_path="${DEPLOY_DIR_IMAGE}/${INITRAMFS_IMAGE}-${MACHINE}.${img}"
631 initramfs_local="usr/${INITRAMFS_IMAGE}-${MACHINE}.${img}"
632 echo "Using $initramfs_path"
633 if [ -e "${initramfs_path}" ]; then
634 fitimage_ti_secure ${initramfs_path} ${initramfs_local}.sec
635 fitimage_emit_section_ramdisk ${1} "${ramdiskcount}" ${initramfs_local}.sec
636 break
637 fi
638 done
639 fi
640
641 fitimage_emit_section_maint ${1} sectend
642
643 # Force the first Kernel and DTB in the default config
644 kernelcount=1
645 if test -n "${dtbcount}"; then
646 dtbcount=1
647 fi
648 teecount=1
649
650 #
651 # Step 5: Prepare a configurations section
652 #
653 fitimage_emit_section_maint ${1} confstart
654
655 if [ "x${FITIMAGE_DTB_BY_NAME}" != "x1" ] ; then
656 dtbref="fdt-${dtbcount}"
657 fi
658 if [ "x${FITIMAGE_TEE_BY_NAME}" = "x1" ] ; then
659 teeref="${OPTEEFLAVOR}"
660 else
661 teeref="${teecount}"
662 fi
663 fitimage_emit_section_config ${1} "${kernelcount}" "${dtbref}" "${ramdiskcount}" "${setupcount}" "${teeref}"
664
665 fitimage_emit_section_maint ${1} sectend
666
667 fitimage_emit_section_maint ${1} fitend
668
669 #
670 # Step 6: Assemble the image
671 #
672 uboot-mkimage \
673 ${@'-D "${UBOOT_MKIMAGE_DTCOPTS}"' if len('${UBOOT_MKIMAGE_DTCOPTS}') else ''} \
674 -f ${1} \
675 arch/${ARCH}/boot/${2}
676
677 #
678 # Step 7: Sign the image and add public key to U-Boot dtb
679 #
680 if [ "x${UBOOT_SIGN_ENABLE}" = "x1" ] ; then
681 uboot-mkimage \
682 ${@'-D "${UBOOT_MKIMAGE_DTCOPTS}"' if len('${UBOOT_MKIMAGE_DTCOPTS}') else ''} \
683 -F -k "${UBOOT_SIGN_KEYDIR}" \
684 -K "${DEPLOY_DIR_IMAGE}/${UBOOT_DTB_BINARY}" \
685 -r arch/${ARCH}/boot/${2}
686 fi
687}
688
689do_assemble_fitimage() {
690 if echo ${KERNEL_IMAGETYPES} | grep -wq "fitImage"; then
691 cd ${B}
692 fitimage_assemble fit-image.its fitImage
693 fi
694}
695
696addtask assemble_fitimage before do_install after do_compile
697
698do_assemble_fitimage_initramfs() {
699 if echo ${KERNEL_IMAGETYPES} | grep -wq "fitImage" && \
700 test -n "${INITRAMFS_IMAGE}" ; then
701 cd ${B}
702 fitimage_assemble fit-image-${INITRAMFS_IMAGE}.its fitImage-${INITRAMFS_IMAGE} 1
703 fi
704}
705
706addtask assemble_fitimage_initramfs before do_deploy after do_install
707
708FITIMAGE_ITS_SUFFIX ?= "its"
709FITIMAGE_ITB_SUFFIX ?= "itb"
710
711FITIMAGE_ITS_IMAGE ?= "fitImage-its-${PKGE}-${PKGV}-${PKGR}-${MACHINE}-${DATETIME}.${FITIMAGE_ITS_SUFFIX}"
712FITIMAGE_ITS_IMAGE[vardepsexclude] = "DATETIME"
713FITIMAGE_ITS_BINARY ?= "fitImage-its.${FITIMAGE_ITS_SUFFIX}"
714FITIMAGE_ITS_SYMLINK ?= "fitImage-its-${MACHINE}.${FITIMAGE_ITS_SUFFIX}"
715
716FITIMAGE_ITB_IMAGE ?= "fitImage-linux.bin-${PKGE}-${PKGV}-${PKGR}-${MACHINE}-${DATETIME}.${FITIMAGE_ITB_SUFFIX}"
717FITIMAGE_ITB_IMAGE[vardepsexclude] = "DATETIME"
718FITIMAGE_ITB_BINARY ?= "fitImage-linux.bin.${FITIMAGE_ITB_SUFFIX}"
719FITIMAGE_ITB_SYMLINK ?= "fitImage-linux.bin-${MACHINE}.${FITIMAGE_ITB_SUFFIX}"
720
721FITIMAGE_INITRAMFS_ITS_IMAGE ?= "fitImage-its-${INITRAMFS_IMAGE}-${PKGE}-${PKGV}-${PKGR}-${MACHINE}-${DATETIME}.${FITIMAGE_ITS_SUFFIX}"
722FITIMAGE_INITRAMFS_ITS_IMAGE[vardepsexclude] = "DATETIME"
723FITIMAGE_INITRAMFS_ITS_BINARY ?= "fitImage-its-${INITRAMFS_IMAGE}.${FITIMAGE_ITS_SUFFIX}"
724FITIMAGE_INITRAMFS_ITS_SYMLINK ?= "fitImage-its-${INITRAMFS_IMAGE}-${MACHINE}.${FITIMAGE_ITS_SUFFIX}"
725
726FITIMAGE_INITRAMFS_ITB_IMAGE ?= "fitImage-${INITRAMFS_IMAGE}-${PKGE}-${PKGV}-${PKGR}-${MACHINE}-${DATETIME}.${FITIMAGE_ITB_SUFFIX}"
727FITIMAGE_INITRAMFS_ITB_IMAGE[vardepsexclude] = "DATETIME"
728FITIMAGE_INITRAMFS_ITB_BINARY ?= "fitImage-${INITRAMFS_IMAGE}.${FITIMAGE_ITB_SUFFIX}"
729FITIMAGE_INITRAMFS_ITB_SYMLINK ?= "fitImage-${INITRAMFS_IMAGE}-${MACHINE}.${FITIMAGE_ITB_SUFFIX}"
730
731kernel_do_deploy:append() {
732 # Update deploy directory
733 if echo ${KERNEL_IMAGETYPES} | grep -wq "fitImage"; then
734 cd ${B}
735 echo "Copying fit-image.its source file..."
736 install -m 0644 fit-image.its ${DEPLOYDIR}/${FITIMAGE_ITS_IMAGE}
737 install -m 0644 arch/${ARCH}/boot/fitImage ${DEPLOYDIR}/${FITIMAGE_ITB_IMAGE}
738
739 if [ -n "${INITRAMFS_IMAGE}" ]; then
740 echo "Copying fit-image-${INITRAMFS_IMAGE}.its source file..."
741 install -m 0644 fit-image-${INITRAMFS_IMAGE}.its ${DEPLOYDIR}/${FITIMAGE_INITRAMFS_ITS_IMAGE}
742 install -m 0644 arch/${ARCH}/boot/fitImage-${INITRAMFS_IMAGE} ${DEPLOYDIR}/${FITIMAGE_INITRAMFS_ITB_IMAGE}
743 fi
744
745 cd ${DEPLOYDIR}
746 ln -sf ${FITIMAGE_ITS_IMAGE} ${FITIMAGE_ITS_SYMLINK}
747 ln -sf ${FITIMAGE_ITS_IMAGE} ${FITIMAGE_ITS_BINARY}
748 ln -sf ${FITIMAGE_ITB_IMAGE} ${FITIMAGE_ITB_SYMLINK}
749 ln -sf ${FITIMAGE_ITB_IMAGE} ${FITIMAGE_ITB_BINARY}
750
751 if [ -n "${INITRAMFS_IMAGE}" ]; then
752 ln -sf ${FITIMAGE_INITRAMFS_ITS_IMAGE} ${FITIMAGE_INITRAMFS_ITS_SYMLINK}
753 ln -sf ${FITIMAGE_INITRAMFS_ITS_IMAGE} ${FITIMAGE_INITRAMFS_ITS_BINARY}
754 ln -sf ${FITIMAGE_INITRAMFS_ITB_IMAGE} ${FITIMAGE_INITRAMFS_ITB_SYMLINK}
755 ln -sf ${FITIMAGE_INITRAMFS_ITB_IMAGE} ${FITIMAGE_INITRAMFS_ITB_BINARY}
756 fi
757 fi
758}
diff --git a/meta-ti-bsp/classes/uboot-sign-legacyhs.bbclass b/meta-ti-bsp/classes/uboot-sign-legacyhs.bbclass
new file mode 100644
index 00000000..102232b9
--- /dev/null
+++ b/meta-ti-bsp/classes/uboot-sign-legacyhs.bbclass
@@ -0,0 +1,131 @@
1# This file is part of U-Boot verified boot support and is intended to be
2# inherited from u-boot recipe and from kernel-fitimage.bbclass.
3#
4# The signature procedure requires the user to generate an RSA key and
5# certificate in a directory and to define the following variable:
6#
7# UBOOT_SIGN_KEYDIR = "/keys/directory"
8# UBOOT_SIGN_KEYNAME = "dev" # keys name in keydir (eg. "dev.crt", "dev.key")
9# UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000"
10# UBOOT_SIGN_ENABLE = "1"
11#
12# As verified boot depends on fitImage generation, following is also required:
13#
14# KERNEL_CLASSES ?= " kernel-fitimage "
15# KERNEL_IMAGETYPE ?= "fitImage"
16#
17# The signature support is limited to the use of CONFIG_OF_SEPARATE in U-Boot.
18#
19# The tasks sequence is set as below, using DEPLOY_IMAGE_DIR as common place to
20# treat the device tree blob:
21#
22# * u-boot:do_install:append
23# Install UBOOT_DTB_BINARY to datadir, so that kernel can use it for
24# signing, and kernel will deploy UBOOT_DTB_BINARY after signs it.
25#
26# * virtual/kernel:do_assemble_fitimage
27# Sign the image
28#
29# * u-boot:do_deploy[postfuncs]
30# Deploy files like UBOOT_DTB_IMAGE, UBOOT_DTB_SYMLINK and others.
31#
32# For more details on signature process, please refer to U-Boot documentation.
33
34# Signature activation.
35UBOOT_SIGN_ENABLE ?= "0"
36
37# Default value for deployment filenames.
38UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb"
39UBOOT_DTB_BINARY ?= "u-boot.dtb"
40UBOOT_DTB_SYMLINK ?= "u-boot-${MACHINE}.dtb"
41UBOOT_NODTB_IMAGE ?= "u-boot-nodtb-${MACHINE}-${PV}-${PR}.${UBOOT_SUFFIX}"
42UBOOT_NODTB_BINARY ?= "u-boot-nodtb.${UBOOT_SUFFIX}"
43UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.${UBOOT_SUFFIX}"
44
45# Functions in this bbclass is for u-boot only
46UBOOT_PN = "${@d.getVar('PREFERRED_PROVIDER_u-boot') or 'u-boot'}"
47
48concat_dtb_helper() {
49 if [ -e "${UBOOT_DTB_BINARY}" ]; then
50 ln -sf ${UBOOT_DTB_IMAGE} ${DEPLOYDIR}/${UBOOT_DTB_BINARY}
51 ln -sf ${UBOOT_DTB_IMAGE} ${DEPLOYDIR}/${UBOOT_DTB_SYMLINK}
52 fi
53
54 if [ -f "${UBOOT_NODTB_BINARY}" ]; then
55 install ${UBOOT_NODTB_BINARY} ${DEPLOYDIR}/${UBOOT_NODTB_IMAGE}
56 ln -sf ${UBOOT_NODTB_IMAGE} ${DEPLOYDIR}/${UBOOT_NODTB_SYMLINK}
57 ln -sf ${UBOOT_NODTB_IMAGE} ${DEPLOYDIR}/${UBOOT_NODTB_BINARY}
58 fi
59
60 # Concatenate U-Boot w/o DTB & DTB with public key
61 # (cf. kernel-fitimage.bbclass for more details)
62 deployed_uboot_dtb_binary='${DEPLOY_DIR_IMAGE}/${UBOOT_DTB_IMAGE}'
63 if [ "x${UBOOT_SUFFIX}" = "ximg" -o "x${UBOOT_SUFFIX}" = "xrom" ] && \
64 [ -e "$deployed_uboot_dtb_binary" ]; then
65 oe_runmake EXT_DTB=$deployed_uboot_dtb_binary
66 install ${UBOOT_BINARY} ${DEPLOYDIR}/${UBOOT_IMAGE}
67 elif [ -e "${DEPLOYDIR}/${UBOOT_NODTB_IMAGE}" -a -e "$deployed_uboot_dtb_binary" ]; then
68 cd ${DEPLOYDIR}
69 cat ${UBOOT_NODTB_IMAGE} $deployed_uboot_dtb_binary | tee ${B}/${CONFIG_B_PATH}/${UBOOT_BINARY} > ${UBOOT_IMAGE}
70 else
71 bbwarn "Failure while adding public key to u-boot binary. Verified boot won't be available."
72 fi
73}
74
75concat_dtb() {
76 if [ "${UBOOT_SIGN_ENABLE}" = "1" -a "${PN}" = "${UBOOT_PN}" -a -n "${UBOOT_DTB_BINARY}" ]; then
77 mkdir -p ${DEPLOYDIR}
78 if [ -n "${UBOOT_CONFIG}" ]; then
79 for config in ${UBOOT_MACHINE}; do
80 CONFIG_B_PATH="${config}"
81 cd ${B}/${config}
82 concat_dtb_helper
83 done
84 else
85 CONFIG_B_PATH=""
86 cd ${B}
87 concat_dtb_helper
88 fi
89 fi
90}
91
92# Install UBOOT_DTB_BINARY to datadir, so that kernel can use it for
93# signing, and kernel will deploy UBOOT_DTB_BINARY after signs it.
94install_helper() {
95 if [ -f "${UBOOT_DTB_BINARY}" ]; then
96 install -d ${D}${datadir}
97 # UBOOT_DTB_BINARY is a symlink to UBOOT_DTB_IMAGE, so we
98 # need both of them.
99 install ${UBOOT_DTB_BINARY} ${D}${datadir}/${UBOOT_DTB_IMAGE}
100 ln -sf ${UBOOT_DTB_IMAGE} ${D}${datadir}/${UBOOT_DTB_BINARY}
101 else
102 bbwarn "${UBOOT_DTB_BINARY} not found"
103 fi
104}
105
106do_install:append() {
107 if [ "${UBOOT_SIGN_ENABLE}" = "1" -a "${PN}" = "${UBOOT_PN}" -a -n "${UBOOT_DTB_BINARY}" ]; then
108 if [ -n "${UBOOT_CONFIG}" ]; then
109 for config in ${UBOOT_MACHINE}; do
110 cd ${B}/${config}
111 install_helper
112 done
113 else
114 cd ${B}
115 install_helper
116 fi
117 fi
118}
119
120python () {
121 if d.getVar('UBOOT_SIGN_ENABLE') == '1' and d.getVar('PN') == d.getVar('UBOOT_PN') and d.getVar('UBOOT_DTB_BINARY'):
122 kernel_pn = d.getVar('PREFERRED_PROVIDER_virtual/kernel')
123
124 # Make "bitbake u-boot -cdeploy" deploys the signed u-boot.dtb
125 d.appendVarFlag('do_deploy', 'depends', ' %s:do_deploy' % kernel_pn)
126
127 # kernerl's do_deploy is a litle special, so we can't use
128 # do_deploy:append, otherwise it would override
129 # kernel_do_deploy.
130 d.appendVarFlag('do_deploy', 'prefuncs', ' concat_dtb')
131}
diff --git a/meta-ti-bsp/conf/machine/am335x-hs-evm.conf b/meta-ti-bsp/conf/machine/am335x-hs-evm.conf
index 7caa5bfd..670a584c 100644
--- a/meta-ti-bsp/conf/machine/am335x-hs-evm.conf
+++ b/meta-ti-bsp/conf/machine/am335x-hs-evm.conf
@@ -16,3 +16,13 @@ UBOOT_RD_LOADADDRESS = "0x84000000"
16UBOOT_RD_ENTRYPOINT = "0x84000000" 16UBOOT_RD_ENTRYPOINT = "0x84000000"
17 17
18TI_SECURE_DEV_PKG = "${TI_SECURE_DEV_PKG_CAT}/am3x" 18TI_SECURE_DEV_PKG = "${TI_SECURE_DEV_PKG_CAT}/am3x"
19
20# FIT image for legacy secure devices
21KERNEL_CLASSES += " kernel-fitimage-legacyhs"
22KERNEL_IMAGETYPES += " fitImage"
23
24# FIT image settings
25FITIMAGE_HASH_ALGO = ""
26FITIMAGE_DTB_BY_NAME = "1"
27FITIMAGE_TEE_BY_NAME = "1"
28FITIMAGE_CONF_BY_NAME = "1"
diff --git a/meta-ti-bsp/conf/machine/am437x-hs-evm.conf b/meta-ti-bsp/conf/machine/am437x-hs-evm.conf
index 68b808d2..c3c347e3 100644
--- a/meta-ti-bsp/conf/machine/am437x-hs-evm.conf
+++ b/meta-ti-bsp/conf/machine/am437x-hs-evm.conf
@@ -18,3 +18,14 @@ OPTEEFLAVOR = "am43xx"
18OPTEEOUTPUTMACHINE = "ti" 18OPTEEOUTPUTMACHINE = "ti"
19 19
20EXTRA_IMAGEDEPENDS += "optee-os" 20EXTRA_IMAGEDEPENDS += "optee-os"
21
22# FIT image for legacy secure devices
23KERNEL_CLASSES += " kernel-fitimage-legacyhs"
24KERNEL_IMAGETYPES += " fitImage"
25
26# FIT image settings
27FITIMAGE_HASH_ALGO = ""
28FITIMAGE_PACK_TEE = "1"
29FITIMAGE_DTB_BY_NAME = "1"
30FITIMAGE_TEE_BY_NAME = "1"
31FITIMAGE_CONF_BY_NAME = "1"
diff --git a/meta-ti-bsp/conf/machine/am57xx-hs-evm.conf b/meta-ti-bsp/conf/machine/am57xx-hs-evm.conf
index 5232cbd9..63b0c052 100644
--- a/meta-ti-bsp/conf/machine/am57xx-hs-evm.conf
+++ b/meta-ti-bsp/conf/machine/am57xx-hs-evm.conf
@@ -19,3 +19,14 @@ OPTEEOUTPUTMACHINE = "ti"
19OPTEEPAGER = "y" 19OPTEEPAGER = "y"
20 20
21EXTRA_IMAGEDEPENDS += "optee-os" 21EXTRA_IMAGEDEPENDS += "optee-os"
22
23# FIT image for legacy secure devices
24KERNEL_CLASSES += " kernel-fitimage-legacyhs"
25KERNEL_IMAGETYPES += " fitImage"
26
27# FIT image settings
28FITIMAGE_HASH_ALGO = ""
29FITIMAGE_PACK_TEE = "1"
30FITIMAGE_DTB_BY_NAME = "1"
31FITIMAGE_TEE_BY_NAME = "1"
32FITIMAGE_CONF_BY_NAME = "1"
diff --git a/meta-ti-bsp/conf/machine/dra7xx-hs-evm.conf b/meta-ti-bsp/conf/machine/dra7xx-hs-evm.conf
index 49630081..c80ac13c 100644
--- a/meta-ti-bsp/conf/machine/dra7xx-hs-evm.conf
+++ b/meta-ti-bsp/conf/machine/dra7xx-hs-evm.conf
@@ -19,3 +19,14 @@ OPTEEOUTPUTMACHINE = "ti"
19OPTEEPAGER = "y" 19OPTEEPAGER = "y"
20 20
21EXTRA_IMAGEDEPENDS += "optee-os" 21EXTRA_IMAGEDEPENDS += "optee-os"
22
23# FIT image for legacy secure devices
24KERNEL_CLASSES += " kernel-fitimage-legacyhs"
25KERNEL_IMAGETYPES += " fitImage"
26
27# FIT image settings
28FITIMAGE_HASH_ALGO = ""
29FITIMAGE_PACK_TEE = "1"
30FITIMAGE_DTB_BY_NAME = "1"
31FITIMAGE_TEE_BY_NAME = "1"
32FITIMAGE_CONF_BY_NAME = "1"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-08-14 23:30:57 +0000