linux/poky.git/meta/classes/uboot-sign.bbclass, branch hardknott-next

uboot: Fixes SPL verified boot on corner cases

2021-04-06T21:37:23+00:00

* The kernel-fitimage class adds a do_assemble_fitimage_initramfs task regardless of INITRAMFS_IMAGE_BUNDLE setting, which in some cases can result in that task running after do_uboot_assemble_fitimage and overwriting the u-boot-spl.dtb file with the pristine version (without public key). Fix this by making do_uboot_assemble_fitimage dependant on both do_assemble_fitimage_* tasks, regardless of the aforementioned setting. * Adjust 'type' and 'os' on the U-boot fitimage its script so that mkimage/dumpimage can recognize them. * Move the deployment of the u-boot-spl-nodtb files outside of concat_spl_dtb_helper(), so that we can better isolate the scenarios of creating an (unsigned) U-Boot fitimage versus also signing it. This prevents some stale files from being deployed in the images directory. * Remove any u-boot-fitImage and u-boot-its files from build tree, in case the build tree is being reused across bitbake calls. (From OE-Core rev: dc26d35e0935f30af55a3d2cb5c501d1b5c35437) Signed-off-by: Klaus Heinrich Kiwi Signed-off-by: Richard Purdie

u-boot: Use a different Key for SPL signing

2021-04-06T10:36:51+00:00

Duplicate the variables governing u-boot signing so that we can have a different set of keys/parameters signing the SPL. (From OE-Core rev: 0e6b0fefa02356afeb11a32dfee7f0c7c250ab7f) Signed-off-by: Klaus Heinrich Kiwi Signed-off-by: Richard Purdie

u-boot: Add infrastructure to SPL verified boot

2021-04-06T10:36:51+00:00

Add the necessary infrastructure to create a U-boot proper fitimage, sign it (using the same keys as the kernel-fitimage), and put the public key in the SPL binary so that verified SPL boot can be accomplished. (From OE-Core rev: 5af4dfe83c2f6509015916262be32fc09bc9714d) Signed-off-by: Klaus Heinrich Kiwi Signed-off-by: Richard Purdie

u-boot: Move definitions to common locations

2021-04-06T10:36:51+00:00

Move some definitions from u-boot.inc into uboot-config.bbclass and similarly from kernel-fitimage.bbclass into uboot-sign.bbclass, so that they can be useful when signing the U-boot proper fitimage, for a verified-boot SPL. (From OE-Core rev: cc6c3e31526d3b6ef3a87ba5e548fcad7483bd51) Signed-off-by: Klaus Heinrich Kiwi Signed-off-by: Richard Purdie

uboot: Deploy default symlinks with fitImage

2021-04-05T14:29:02+00:00

Some image recipes uses ${DEPLOY_DIR_IMAGE}/${UBOOT_BINARY} to create their images. Force the re-creation of those symlinks pointing to the u-boot-fitImage in case UBOOT_FITIMAGE_ENABLE is set. (From OE-Core rev: 11a016aaf243a110f7139ea052fd4e568aad40dd) Signed-off-by: Klaus Heinrich Kiwi Signed-off-by: Richard Purdie

uboot-sign: Refactor do_deploy prefunc to do_deploy_prepend

2020-06-30T22:03:02+00:00

When inherited by the u-boot recipe (UBOOT_PN), uboot-sign.bbclass adds a concat_dtb step, which places additional files into ${DEPLOYDIR} before do_deploy. By turning this from a prefunc into a part of the normal do_deploy function, it becomes possible to use do_deploy[cleandirs] = "${DEPLOYDIR}" in the future, without deleting the files produced by concat_dtb. As before, care is taken to not interfere with the kernel's do_deploy definition, since concat_dtb was only needed for u-boot. (From OE-Core rev: 17619c1a41fa961afc317e4aafab9cdc4ff14a49) Signed-off-by: Daniel Klauer Signed-off-by: Richard Purdie

kernel-fitimage: uboot-sign: fix missing signature

2019-07-18T11:16:19+00:00

u-boot.bin with dtb & signature should be placed in ${B} so that it can be deployed by u-boot as expected. Otherwise, the version without signature is installed. (From OE-Core rev: bfc8c964a9760a2c4a1d1902918908a1e7361c17) Signed-off-by: Jun Nie Signed-off-by: Richard Purdie

kernel-fitimage: uboot-sign: Check UBOOT_DTB_BINARY before adding deps

2019-06-12T20:08:52+00:00

Since UBOOT_DTB_BINARY empty means we don't need to inject signatures into the U-Boot DTB, we can remove the dependencies between consumers of these two classes and resolve a circular dependency between u-boot and kernel. (From OE-Core rev: c6b49cb75285e71909d1f9e4bf636f186941b519) Signed-off-by: Alex Kiernan Signed-off-by: Richard Purdie

uboot-sign: Fix u-boot-nodtb symlinks

2019-05-09T15:31:56+00:00

When using u-boot-nodtb, the symlink didn't install correctly to the ${DEPLOYDIR}. This commit fixes this bug. (From OE-Core rev: c4eddb65e2ddb61bf519b768fab1e131fb0c297b) Signed-off-by: Ying-Chun Liu (PaulLiu) Signed-off-by: Richard Purdie

uboot-sign: Fix build when UBOOT_DTB_BINARY is empty

2019-05-03T05:11:57+00:00

When UBOOT_DTB_BINARY is empty and because the code now changes directory into ${B}, the test for the existence becomes `[ -f ]` which succeeds and subsequently the install fails. Reorder the code so it's clear that UBOOT_DTB_BINARY empty is an expected configuration and then quote UBOOT_DTB_BINARY everywhere so no one trips over this again. Fixes: bacb59079eb6 ("uboot-sign: add support for different u-boot configurations") (From OE-Core rev: e79f0db0745625b35dd83483747e486d08eebfde) Signed-off-by: Alex Kiernan Signed-off-by: Richard Purdie