linux/poky.git/meta/classes-recipe/uboot-sign.bbclass, branch walnascar

uboot-sign: support to add users specific image tree source

2025-02-27T10:55:17+00:00

Currently, uboot-sign.bbclass only supports to create Image Tree Source(ITS) for "u-boot" and "flat_dt". However, users may want to add their private images into u-boot FIT image for specific application and purpose. To make this bbclass more flexible and support to add users specific snippet ITS, creates a new "UBOOT_FIT_USER_SETTINGS" variable. Users can add their specific snippet ITS into this variable. Example: ``` UBOOT_FIT_MY_ITS = '\ myfw {\n\ description = \"MY Firmware\";\n\ data = /incbin/(\"myfw.bin\");\n\ type = \"mytype\";\n\ arch = \"myarch\";\n\ os = \"myos\";\n\ load = <0xb2000000>;\n\ entry = <0xb2000000>;\n\ compression = \"none\";\n\ };\n\ ' UBOOT_FIT_USER_SETTINGS = "${UBOOT_FIT_MY_ITS}" ``` The generated ITS ``` myfw { description = "My Firmware"; data = /incbin/("myfw.bin"); type = "mytype"; arch = "myarch"; os = "myos"; load = <0xb2000000>; entry = <0xb2000000>; compression = "none"; }; ``` Add a variable "UBOOT_FIT_CONF_USER_LOADABLES" to load users specific images and it is an empty by default. (From OE-Core rev: c12e013453689697a8680f1c7de3e625a0ff28ec) Signed-off-by: Jamin Lin Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

uboot-sign: support to create TEE and ATF image tree source

2025-02-27T10:55:17+00:00

Currently, uboot-sign.bbclass only supports to create Image Tree Source(ITS) for "u-boot" and "flat_dt". However, users may want to support multiple images such as ARM Trusted Firmware(ATF), Trusted Execution Environment(TEE) and users private images for specific application and purpose. To make this bbclass more flexible and support ATF and TEE, creates new functions which are "uboot_fitimage_atf" and "uboot_fitimage_tee" for ATF and TEE ITS file creation, respectively. Add a variable "UBOOT_FIT_ARM_TRUSTED_FIRMWARE" to enable ATF ITS generation and it is disable by default. Add a variable "UBOOT_FIT_TEE" to enable TEE ITS generation and it is disable by default. (From OE-Core rev: c14641a964b5b802e995e574a599c5b4937fb488) Signed-off-by: Jamin Lin Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

u-boot: kernel-fitimage: Restore FIT_SIGN_INDIVIDUAL="1" behavior

2025-02-25T12:17:22+00:00

OE FIT_SIGN_INDIVIDUAL is implemented in an unusual manner, where the resulting signed fitImage contains both signed images and signed configurations, possibly using different keys. This kind of signing of images is redundant, but so is the behavior of FIT_SIGN_INDIVIDUAL="1" and that is here to stay. Adjust the process of public key insertion into u-boot.dtb such that if FIT_SIGN_INDIVIDUAL==1, the image signing key is inserted into u-boot.dtb first, and in any case the configuration signing key is inserted into u-boot.dtb last. The verification of the keys inserted into u-boot.dtb against unused.itb is performed only for FIT_SIGN_INDIVIDUAL!=1 due to mkimage limitation, which does not allow mkimage -f auto-conf to update the generated unused.itb, and instead rewrites it. Fixes: 259bfa86f384 ("u-boot: kernel-fitimage: Fix dependency loop if UBOOT_SIGN_ENABLE and UBOOT_ENV enabled") (From OE-Core rev: 0106e5efab99c8016836a2ab71e2327ce58a9a9d) Signed-off-by: Marek Vasut Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

u-boot: kernel-fitimage: Fix dependency loop if UBOOT_SIGN_ENABLE and UBOOT_ENV enabled

2025-01-22T13:20:29+00:00

In case both UBOOT_SIGN_ENABLE and UBOOT_ENV are enabled and kernel-fitimage.bbclass is in use to generate signed kernel fitImage, there is a circular dependency between uboot-sign and kernel-fitimage bbclasses . The loop looks like this: kernel-fitimage.bbclass: - do_populate_sysroot depends on do_assemble_fitimage - do_assemble_fitimage depends on virtual/bootloader:do_populate_sysroot - virtual/bootloader:do_populate_sysroot depends on virtual/bootloader:do_install => The virtual/bootloader:do_install installs and the virtual/bootloader:do_populate_sysroot places into sysroot an U-Boot environment script embedded into kernel fitImage during do_assemble_fitimage run . uboot-sign.bbclass: - DEPENDS on KERNEL_PN, which is really virtual/kernel. More accurately - do_deploy depends on do_uboot_assemble_fitimage - do_install depends on do_uboot_assemble_fitimage - do_uboot_assemble_fitimage depends on virtual/kernel:do_populate_sysroot => do_install depends on virtual/kernel:do_populate_sysroot => virtual/bootloader:do_install depends on virtual/kernel:do_populate_sysroot virtual/kernel:do_populate_sysroot depends on virtual/bootloader:do_install Attempt to resolve the loop. Pull fitimage configuration options into separate new configuration file image-fitimage.conf so these configuration options can be shared by both uboot-sign.bbclass and kernel-fitimage.bbclass, and make use of mkimage -f auto-conf / mkimage -f auto option to insert /signature node key-* subnode into U-Boot control DT without depending on the layout of kernel fitImage itself. This is perfectly valid to do, because the U-Boot /signature node key-* subnodes 'required' property can contain either of two values, 'conf' or 'image' to authenticate either selected configuration or all of images when booting the fitImage. For details of the U-Boot fitImage signing process, see: https://docs.u-boot.org/en/latest/usage/fit/signature.html For details of mkimage -f auto-conf and -f auto, see: https://manpages.debian.org/experimental/u-boot-tools/mkimage.1.en.html#EXAMPLES Fixes: 5e12dc911d0c ("u-boot: Rework signing to remove interdependencies") Reviewed-by: Adrian Freihofer (From OE-Core rev: 259bfa86f384206f0d0a96a5b84887186c5f689e) Signed-off-by: Marek Vasut Signed-off-by: Richard Purdie

Revert "uboot-sign: fix U-Boot binary with public key"

2024-12-09T15:23:28+00:00

This reverts commit 0d14e99aa18ee38293df63d585fafc270a4538be. The patch removed logic required for correct handling of UBOOT_SUFFIX=img or UBOOT_SUFFIX=rom. We need to find a better way to handle the fix for [YOCTO #15649]. (From OE-Core rev: 5e82d33451b5662df1e7fe2518a50644d18aa70d) Signed-off-by: Ryan Eatmon Signed-off-by: Richard Purdie

uboot-sign: fix U-Boot binary with public key

2024-11-23T14:44:54+00:00

Fixes [YOCTO #15649] The U-Boot binary in the "deploy" directory is missing the public key when the removed logic branch is used. The simple concatenation of the binary and DTB with public key works as expected on a BeagleBone Black. Given: MACHINE = beaglebone-yocto UBOOT_SIGN_KEYNAME = "dev" Post-patch (poky/build/tmp/deploy/images/beaglebone-yocto): $ hexdump -e "16 \"%_p\" \"\\n\"" u-boot-beaglebone-yocto.dtb \ | tr -d '\n' | grep -o 'key-dev' key-dev $ hexdump -e "16 \"%_p\" \"\\n\"" u-boot.img \ | tr -d '\n' | grep -o 'key-dev' key-dev Non-Poky BeagleBone Black testing (Scarthgap): U-Boot 2024.01 [...] [...] Using 'conf-ti_omap_am335x-boneblack.dtb' configuration Verifying Hash Integrity ... sha256,rsa4096:dev+ OK Trying 'kernel-1' kernel subimage [...] (From OE-Core rev: 0d14e99aa18ee38293df63d585fafc270a4538be) Signed-off-by: Clayton Casciato Signed-off-by: Richard Purdie

uboot-sign: fix concat_dtb arguments

2024-11-12T11:19:44+00:00

Fixes [YOCTO #15642] Ensure empty argument passed from do_uboot_assemble_fitimage is passed to concat_dtb (From OE-Core rev: b3c473785e5ceef677ff2b77c5fc17f5704c622f) Signed-off-by: Clayton Casciato Signed-off-by: Richard Purdie

uboot-sign: fix counters in do_uboot_assemble_fitimage

2024-08-30T20:59:38+00:00

Without unsetting `j` and `k` for each `UBOOT_MACHINE`, `j` and `k` are incremented in the same frequency as `i` and therefore `$j -eq $i` and `$k -eq $i` is always true for the first `type` from `UBOOT_CONFIG` and the first `binary` from `UBOOT_BINARIES`. (From OE-Core rev: 3aef55c7ceb654b0012f20618bfd6ead1ef578b6) Signed-off-by: Paul Gerber Signed-off-by: Richard Purdie

uboot-sign: fix loop in do_uboot_assemble_fitimage

2024-05-09T08:48:58+00:00

When using multiple u-boot configurations in UBOOT_CONFIG, the helper function uboot_assemble_fitimage_helper() was not called with all combinations of type & binary, due to a copy-n-paste indexing error. (From OE-Core rev: 2d338548a4b745a71eaf6c29231adc93c4165778) Signed-off-by: Ralph Siemsen Signed-off-by: Richard Purdie

u-boot-sign:uboot-config: support to verify signed FIT image

2024-02-08T17:54:47+00:00

It does not verify the signed FIT image of kernel and uboot. To catch the unexpected errors as far as possible at the build time, add uboot-fit-check-sign tool which is provided by u-boot to verify the signed FIT image. (From OE-Core rev: 17d3c8315e7a7adbe27183e11e1b6d588c1a1784) Signed-off-by: Jamin Lin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie