meta/classes/uboot-sign.bbclass

1 # This file is part of U-Boot verified boot support and is intended to be
2 # inherited from u-boot recipe and from kernel-fitimage.bbclass.
12 # As verified boot depends on fitImage generation, following is also required:
17 # The signature support is limited to the use of CONFIG_OF_SEPARATE in U-Boot.
22 # * u-boot:do_install:append
29 # * u-boot:do_deploy[postfuncs]
32 # For more details on signature process, please refer to U-Boot documentation.
34 # We need some variables from u-boot-config
37 # Enable use of a U-Boot fitImage
45 UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb"
46 UBOOT_DTB_BINARY ?= "u-boot.dtb"
47 UBOOT_DTB_SYMLINK ?= "u-boot-${MACHINE}.dtb"
48 UBOOT_NODTB_IMAGE ?= "u-boot-nodtb-${MACHINE}-${PV}-${PR}.bin"
49 UBOOT_NODTB_BINARY ?= "u-boot-nodtb.bin"
50 UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.bin"
51 UBOOT_ITS_IMAGE ?= "u-boot-its-${MACHINE}-${PV}-${PR}"
52 UBOOT_ITS ?= "u-boot.its"
53 UBOOT_ITS_SYMLINK ?= "u-boot-its-${MACHINE}"
54 UBOOT_FITIMAGE_IMAGE ?= "u-boot-fitImage-${MACHINE}-${PV}-${PR}"
55 UBOOT_FITIMAGE_BINARY ?= "u-boot-fitImage"
56 UBOOT_FITIMAGE_SYMLINK ?= "u-boot-fitImage-${MACHINE}"
58 SPL_DTB_IMAGE ?= "u-boot-spl-${MACHINE}-${PV}-${PR}.dtb"
59 SPL_DTB_BINARY ?= "u-boot-spl.dtb"
60 SPL_DTB_SYMLINK ?= "u-boot-spl-${MACHINE}.dtb"
61 SPL_NODTB_IMAGE ?= "u-boot-spl-nodtb-${MACHINE}-${PV}-${PR}.bin"
62 SPL_NODTB_BINARY ?= "u-boot-spl-nodtb.bin"
63 SPL_NODTB_SYMLINK ?= "u-boot-spl-nodtb-${MACHINE}.bin"
65 # U-Boot fitImage description
66 UBOOT_FIT_DESC ?= "U-Boot fitImage for ${DISTRO_NAME}/${PV}/${MACHINE}"
68 # Kernel / U-Boot fitImage Hash Algo
72 # Kernel / U-Boot fitImage Signature Algo
76 # Kernel / U-Boot fitImage Padding Algo
79 # Generate keys for signing Kernel / U-Boot fitImage
100 # Functions on this bbclass can apply to either U-boot or Kernel,
102 UBOOT_PN = "${@d.getVar('PREFERRED_PROVIDER_u-boot') or 'u-boot'}"
105 # We need u-boot-tools-native if we're creating a U-Boot fitImage
109         depends = "%s u-boot-tools-native dtc-native" % depends
125 	# If we're not using a signed u-boot fit, concatenate SPL w/o DTB & U-Boot DTB
148 							cp ${UBOOT_IMAGE} ${B}/${CONFIG_B_PATH}/u-boot-$type.${UBOOT_SUFFIX}
154 			bbwarn "Failure while adding public key to u-boot binary. Verified boot won't be available."
161 	# We only deploy symlinks to the u-boot-spl.dtb,as the KERNEL_PN will
168 	# Concatenate the SPL nodtb binary and u-boot.dtb
174 		bbwarn "Failure while adding public key to spl binary. Verified U-Boot boot won't be available."
227 # Install SPL dtb and u-boot nodtb to datadir,
242 	# We need to install a 'stub' u-boot-fitimage + its to datadir,
289 			echo "Generating RSA private key for signing U-Boot fitImage"
294 			echo "Generating certificate for signing U-Boot fitImage"
305 # Create a ITS file for the U-boot FIT, for use when
329             description = "U-Boot image";
332             os = "u-boot";
351             description = "U-Boot FDT";
374             description = "Boot with signed U-Boot FIT";
383 	# Assemble the U-boot FIT image
392 		# Sign the U-boot FIT image and add public key to SPL dtb
407 	# pubkey in the u-boot.dtb file, so that we can use it when building the U-Boot
413 			# we need to copy the u-boot.dtb from staging ourselves
414 			cp -P ${STAGING_DATADIR}/u-boot*.dtb ${B}
416 		# As we are in the kernel context, we need to copy u-boot-spl.dtb from staging first.
418 		# will contain U-boot's PV
419 		# Similarly, we need to get the filename for the 'stub' u-boot-fitimage + its in
422 		# As for the u-boot.dtb (with fitimage's pubkey), it should come from the dependent
424 		cp -P ${STAGING_DATADIR}/u-boot-spl*.dtb ${B}
425 		cp -P ${STAGING_DATADIR}/u-boot-nodtb*.bin ${B}
426 		rm -rf ${B}/u-boot-fitImage-* ${B}/u-boot-its-*
427 		kernel_uboot_fitimage_name=`basename ${STAGING_DATADIR}/u-boot-fitImage-*`
428 		kernel_uboot_its_name=`basename ${STAGING_DATADIR}/u-boot-its-*`
444 	# Deploy the u-boot-nodtb binary and symlinks...
446 			echo "Copying u-boot-nodtb binary..."
469 	# If we're creating a u-boot fitImage, point u-boot.bin
483         # Make "bitbake u-boot -cdeploy" deploys the signed u-boot.dtb
484         # and/or the U-Boot fitImage
488         # As the U-Boot fitImage is created by the KERNEL_PN, we need
489         # to make sure that the u-boot-spl.dtb and u-boot-spl-nodtb.bin
494         # create the U-Boot fitImage after it