blob: 8d136e940589d5563d9266f5e64ba39b7a77a1b7 [file] [log] [blame]
Patrick Williamsc0f7c042017-02-23 20:41:17 -06001# This file is part of U-Boot verified boot support and is intended to be
2# inherited from u-boot recipe and from kernel-fitimage.bbclass.
3#
4# The signature procedure requires the user to generate an RSA key and
5# certificate in a directory and to define the following variable:
6#
7# UBOOT_SIGN_KEYDIR = "/keys/directory"
8# UBOOT_SIGN_KEYNAME = "dev" # keys name in keydir (eg. "dev.crt", "dev.key")
9# UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000"
10# UBOOT_SIGN_ENABLE = "1"
11#
12# As verified boot depends on fitImage generation, following is also required:
13#
14# KERNEL_CLASSES ?= " kernel-fitimage "
15# KERNEL_IMAGETYPE ?= "fitImage"
16#
17# The signature support is limited to the use of CONFIG_OF_SEPARATE in U-Boot.
18#
19# The tasks sequence is set as below, using DEPLOY_IMAGE_DIR as common place to
20# treat the device tree blob:
21#
Patrick Williams213cb262021-08-07 19:21:33 -050022# * u-boot:do_install:append
Brad Bishop19323692019-04-05 15:28:33 -040023# Install UBOOT_DTB_BINARY to datadir, so that kernel can use it for
24# signing, and kernel will deploy UBOOT_DTB_BINARY after signs it.
25#
26# * virtual/kernel:do_assemble_fitimage
27# Sign the image
28#
29# * u-boot:do_deploy[postfuncs]
30# Deploy files like UBOOT_DTB_IMAGE, UBOOT_DTB_SYMLINK and others.
Patrick Williamsc0f7c042017-02-23 20:41:17 -060031#
Brad Bishop6e60e8b2018-02-01 10:27:11 -050032# For more details on signature process, please refer to U-Boot documentation.
Patrick Williamsc0f7c042017-02-23 20:41:17 -060033
Andrew Geissler3b8a17c2021-04-15 15:55:55 -050034# We need some variables from u-boot-config
35inherit uboot-config
36
37# Enable use of a U-Boot fitImage
38UBOOT_FITIMAGE_ENABLE ?= "0"
39
40# Signature activation - these require their respective fitImages
Patrick Williamsc0f7c042017-02-23 20:41:17 -060041UBOOT_SIGN_ENABLE ?= "0"
Andrew Geissler3b8a17c2021-04-15 15:55:55 -050042SPL_SIGN_ENABLE ?= "0"
Patrick Williamsc0f7c042017-02-23 20:41:17 -060043
44# Default value for deployment filenames.
45UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb"
46UBOOT_DTB_BINARY ?= "u-boot.dtb"
47UBOOT_DTB_SYMLINK ?= "u-boot-${MACHINE}.dtb"
Andrew Geissler3b8a17c2021-04-15 15:55:55 -050048UBOOT_NODTB_IMAGE ?= "u-boot-nodtb-${MACHINE}-${PV}-${PR}.bin"
49UBOOT_NODTB_BINARY ?= "u-boot-nodtb.bin"
50UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.bin"
51UBOOT_ITS_IMAGE ?= "u-boot-its-${MACHINE}-${PV}-${PR}"
52UBOOT_ITS ?= "u-boot.its"
53UBOOT_ITS_SYMLINK ?= "u-boot-its-${MACHINE}"
54UBOOT_FITIMAGE_IMAGE ?= "u-boot-fitImage-${MACHINE}-${PV}-${PR}"
55UBOOT_FITIMAGE_BINARY ?= "u-boot-fitImage"
56UBOOT_FITIMAGE_SYMLINK ?= "u-boot-fitImage-${MACHINE}"
57SPL_DIR ?= "spl"
58SPL_DTB_IMAGE ?= "u-boot-spl-${MACHINE}-${PV}-${PR}.dtb"
59SPL_DTB_BINARY ?= "u-boot-spl.dtb"
60SPL_DTB_SYMLINK ?= "u-boot-spl-${MACHINE}.dtb"
61SPL_NODTB_IMAGE ?= "u-boot-spl-nodtb-${MACHINE}-${PV}-${PR}.bin"
62SPL_NODTB_BINARY ?= "u-boot-spl-nodtb.bin"
63SPL_NODTB_SYMLINK ?= "u-boot-spl-nodtb-${MACHINE}.bin"
Patrick Williamsc0f7c042017-02-23 20:41:17 -060064
Andrew Geissler3b8a17c2021-04-15 15:55:55 -050065# U-Boot fitImage description
66UBOOT_FIT_DESC ?= "U-Boot fitImage for ${DISTRO_NAME}/${PV}/${MACHINE}"
67
68# Kernel / U-Boot fitImage Hash Algo
69FIT_HASH_ALG ?= "sha256"
70UBOOT_FIT_HASH_ALG ?= "sha256"
71
72# Kernel / U-Boot fitImage Signature Algo
73FIT_SIGN_ALG ?= "rsa2048"
74UBOOT_FIT_SIGN_ALG ?= "rsa2048"
75
76# Generate keys for signing Kernel / U-Boot fitImage
77FIT_GENERATE_KEYS ?= "0"
78UBOOT_FIT_GENERATE_KEYS ?= "0"
79
80# Size of private keys in number of bits
81FIT_SIGN_NUMBITS ?= "2048"
82UBOOT_FIT_SIGN_NUMBITS ?= "2048"
83
84# args to openssl genrsa (Default is just the public exponent)
85FIT_KEY_GENRSA_ARGS ?= "-F4"
86UBOOT_FIT_KEY_GENRSA_ARGS ?= "-F4"
87
88# args to openssl req (Default is -batch for non interactive mode and
89# -new for new certificate)
90FIT_KEY_REQ_ARGS ?= "-batch -new"
91UBOOT_FIT_KEY_REQ_ARGS ?= "-batch -new"
92
93# Standard format for public key certificate
94FIT_KEY_SIGN_PKCS ?= "-x509"
95UBOOT_FIT_KEY_SIGN_PKCS ?= "-x509"
96
97# Functions on this bbclass can apply to either U-boot or Kernel,
98# depending on the scenario
Brad Bishop19323692019-04-05 15:28:33 -040099UBOOT_PN = "${@d.getVar('PREFERRED_PROVIDER_u-boot') or 'u-boot'}"
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500100KERNEL_PN = "${@d.getVar('PREFERRED_PROVIDER_virtual/kernel')}"
101
102# We need u-boot-tools-native if we're creating a U-Boot fitImage
103python() {
104 if d.getVar('UBOOT_FITIMAGE_ENABLE') == '1':
105 depends = d.getVar("DEPENDS")
106 depends = "%s u-boot-tools-native dtc-native" % depends
107 d.setVar("DEPENDS", depends)
108}
Patrick Williamsc0f7c042017-02-23 20:41:17 -0600109
Brad Bishopc342db32019-05-15 21:57:59 -0400110concat_dtb_helper() {
111 if [ -e "${UBOOT_DTB_BINARY}" ]; then
112 ln -sf ${UBOOT_DTB_IMAGE} ${DEPLOYDIR}/${UBOOT_DTB_BINARY}
113 ln -sf ${UBOOT_DTB_IMAGE} ${DEPLOYDIR}/${UBOOT_DTB_SYMLINK}
114 fi
115
116 if [ -f "${UBOOT_NODTB_BINARY}" ]; then
117 install ${UBOOT_NODTB_BINARY} ${DEPLOYDIR}/${UBOOT_NODTB_IMAGE}
118 ln -sf ${UBOOT_NODTB_IMAGE} ${DEPLOYDIR}/${UBOOT_NODTB_SYMLINK}
119 ln -sf ${UBOOT_NODTB_IMAGE} ${DEPLOYDIR}/${UBOOT_NODTB_BINARY}
120 fi
121
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500122 # If we're not using a signed u-boot fit, concatenate SPL w/o DTB & U-Boot DTB
123 # with public key (otherwise it will be deployed by the equivalent
124 # concat_spl_dtb_helper function - cf. kernel-fitimage.bbclass for more details)
125 if [ "${SPL_SIGN_ENABLE}" != "1" ] ; then
126 deployed_uboot_dtb_binary='${DEPLOY_DIR_IMAGE}/${UBOOT_DTB_IMAGE}'
127 if [ "x${UBOOT_SUFFIX}" = "ximg" -o "x${UBOOT_SUFFIX}" = "xrom" ] && \
128 [ -e "$deployed_uboot_dtb_binary" ]; then
129 oe_runmake EXT_DTB=$deployed_uboot_dtb_binary
130 install ${UBOOT_BINARY} ${DEPLOYDIR}/${UBOOT_IMAGE}
131 elif [ -e "${DEPLOYDIR}/${UBOOT_NODTB_IMAGE}" -a -e "$deployed_uboot_dtb_binary" ]; then
132 cd ${DEPLOYDIR}
133 cat ${UBOOT_NODTB_IMAGE} $deployed_uboot_dtb_binary | tee ${B}/${CONFIG_B_PATH}/${UBOOT_BINARY} > ${UBOOT_IMAGE}
Andrew Geissler595f6302022-01-24 19:11:47 +0000134
135 if [ -n "${UBOOT_CONFIG}" ]
136 then
137 for config in ${UBOOT_MACHINE}; do
138 i=$(expr $i + 1);
139 for type in ${UBOOT_CONFIG}; do
140 j=$(expr $j + 1);
141 if [ $j -eq $i ]
142 then
143 cp ${UBOOT_IMAGE} ${B}/${CONFIG_B_PATH}/u-boot-$type.${UBOOT_SUFFIX}
144 fi
145 done
146 done
147 fi
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500148 else
149 bbwarn "Failure while adding public key to u-boot binary. Verified boot won't be available."
150 fi
Brad Bishopc342db32019-05-15 21:57:59 -0400151 fi
152}
153
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500154concat_spl_dtb_helper() {
155
156 # We only deploy symlinks to the u-boot-spl.dtb,as the KERNEL_PN will
157 # be responsible for deploying the real file
158 if [ -e "${SPL_DIR}/${SPL_DTB_BINARY}" ] ; then
159 ln -sf ${SPL_DTB_IMAGE} ${DEPLOYDIR}/${SPL_DTB_SYMLINK}
160 ln -sf ${SPL_DTB_IMAGE} ${DEPLOYDIR}/${SPL_DTB_BINARY}
161 fi
162
163 # Concatenate the SPL nodtb binary and u-boot.dtb
164 deployed_spl_dtb_binary='${DEPLOY_DIR_IMAGE}/${SPL_DTB_IMAGE}'
165 if [ -e "${DEPLOYDIR}/${SPL_NODTB_IMAGE}" -a -e "$deployed_spl_dtb_binary" ] ; then
166 cd ${DEPLOYDIR}
167 cat ${SPL_NODTB_IMAGE} $deployed_spl_dtb_binary | tee ${B}/${CONFIG_B_PATH}/${SPL_BINARY} > ${SPL_IMAGE}
168 else
169 bbwarn "Failure while adding public key to spl binary. Verified U-Boot boot won't be available."
170 fi
171}
172
173
Brad Bishop19323692019-04-05 15:28:33 -0400174concat_dtb() {
Brad Bishopc342db32019-05-15 21:57:59 -0400175 if [ "${UBOOT_SIGN_ENABLE}" = "1" -a "${PN}" = "${UBOOT_PN}" -a -n "${UBOOT_DTB_BINARY}" ]; then
Brad Bishop19323692019-04-05 15:28:33 -0400176 mkdir -p ${DEPLOYDIR}
Brad Bishopc342db32019-05-15 21:57:59 -0400177 if [ -n "${UBOOT_CONFIG}" ]; then
178 for config in ${UBOOT_MACHINE}; do
Andrew Geisslereff27472021-10-29 15:35:00 -0500179 CONFIG_B_PATH="$config"
180 cd ${B}/$config
Brad Bishopc342db32019-05-15 21:57:59 -0400181 concat_dtb_helper
182 done
183 else
Brad Bishop96ff1982019-08-19 13:50:42 -0400184 CONFIG_B_PATH=""
Patrick Williamsc0f7c042017-02-23 20:41:17 -0600185 cd ${B}
Brad Bishopc342db32019-05-15 21:57:59 -0400186 concat_dtb_helper
Patrick Williamsc0f7c042017-02-23 20:41:17 -0600187 fi
188 fi
189}
190
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500191concat_spl_dtb() {
192 if [ "${SPL_SIGN_ENABLE}" = "1" -a "${PN}" = "${UBOOT_PN}" -a -n "${SPL_DTB_BINARY}" ]; then
193 mkdir -p ${DEPLOYDIR}
194 if [ -n "${UBOOT_CONFIG}" ]; then
195 for config in ${UBOOT_MACHINE}; do
Andrew Geisslereff27472021-10-29 15:35:00 -0500196 CONFIG_B_PATH="$config"
197 cd ${B}/$config
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500198 concat_spl_dtb_helper
199 done
200 else
201 CONFIG_B_PATH=""
202 cd ${B}
203 concat_spl_dtb_helper
204 fi
205 fi
206}
207
208
Brad Bishop19323692019-04-05 15:28:33 -0400209# Install UBOOT_DTB_BINARY to datadir, so that kernel can use it for
210# signing, and kernel will deploy UBOOT_DTB_BINARY after signs it.
Brad Bishopc342db32019-05-15 21:57:59 -0400211install_helper() {
212 if [ -f "${UBOOT_DTB_BINARY}" ]; then
Brad Bishopc342db32019-05-15 21:57:59 -0400213 # UBOOT_DTB_BINARY is a symlink to UBOOT_DTB_IMAGE, so we
214 # need both of them.
Andrew Geissler09036742021-06-25 14:25:14 -0500215 install -Dm 0644 ${UBOOT_DTB_BINARY} ${D}${datadir}/${UBOOT_DTB_IMAGE}
Brad Bishopc342db32019-05-15 21:57:59 -0400216 ln -sf ${UBOOT_DTB_IMAGE} ${D}${datadir}/${UBOOT_DTB_BINARY}
217 else
218 bbwarn "${UBOOT_DTB_BINARY} not found"
219 fi
220}
221
Andrew Geissler595f6302022-01-24 19:11:47 +0000222# Install SPL dtb and u-boot nodtb to datadir,
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500223install_spl_helper() {
224 if [ -f "${SPL_DIR}/${SPL_DTB_BINARY}" ]; then
Andrew Geissler09036742021-06-25 14:25:14 -0500225 install -Dm 0644 ${SPL_DIR}/${SPL_DTB_BINARY} ${D}${datadir}/${SPL_DTB_IMAGE}
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500226 ln -sf ${SPL_DTB_IMAGE} ${D}${datadir}/${SPL_DTB_BINARY}
227 else
228 bbwarn "${SPL_DTB_BINARY} not found"
229 fi
230 if [ -f "${UBOOT_NODTB_BINARY}" ] ; then
Andrew Geissler09036742021-06-25 14:25:14 -0500231 install -Dm 0644 ${UBOOT_NODTB_BINARY} ${D}${datadir}/${UBOOT_NODTB_IMAGE}
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500232 ln -sf ${UBOOT_NODTB_IMAGE} ${D}${datadir}/${UBOOT_NODTB_BINARY}
233 else
234 bbwarn "${UBOOT_NODTB_BINARY} not found"
235 fi
236
237 # We need to install a 'stub' u-boot-fitimage + its to datadir,
238 # so that the KERNEL_PN can use the correct filename when
239 # assembling and deploying them
240 touch ${D}/${datadir}/${UBOOT_FITIMAGE_IMAGE}
241 touch ${D}/${datadir}/${UBOOT_ITS_IMAGE}
242}
243
Patrick Williams213cb262021-08-07 19:21:33 -0500244do_install:append() {
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500245 if [ "${PN}" = "${UBOOT_PN}" ]; then
Brad Bishopc342db32019-05-15 21:57:59 -0400246 if [ -n "${UBOOT_CONFIG}" ]; then
247 for config in ${UBOOT_MACHINE}; do
Andrew Geisslereff27472021-10-29 15:35:00 -0500248 cd ${B}/$config
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500249 if [ "${UBOOT_SIGN_ENABLE}" = "1" -o "${UBOOT_FITIMAGE_ENABLE}" = "1" ] && \
250 [ -n "${UBOOT_DTB_BINARY}" ]; then
251 install_helper
252 fi
253 if [ "${SPL_SIGN_ENABLE}" = "1" -a -n "${SPL_DTB_BINARY}" ]; then
254 install_spl_helper
255 fi
Brad Bishopc342db32019-05-15 21:57:59 -0400256 done
257 else
258 cd ${B}
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500259 if [ "${UBOOT_SIGN_ENABLE}" = "1" -o "${UBOOT_FITIMAGE_ENABLE}" = "1" ] && \
260 [ -n "${UBOOT_DTB_BINARY}" ]; then
261 install_helper
262 fi
263 if [ "${UBOOT_FITIMAGE_ENABLE}" = "1" -a -n "${SPL_DTB_BINARY}" ]; then
264 install_spl_helper
265 fi
Brad Bishop19323692019-04-05 15:28:33 -0400266 fi
267 fi
268}
269
William A. Kennington IIIac69b482021-06-02 12:28:27 -0700270do_uboot_generate_rsa_keys() {
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500271 if [ "${SPL_SIGN_ENABLE}" = "0" ] && [ "${UBOOT_FIT_GENERATE_KEYS}" = "1" ]; then
272 bbwarn "UBOOT_FIT_GENERATE_KEYS is set to 1 eventhough SPL_SIGN_ENABLE is set to 0. The keys will not be generated as they won't be used."
273 fi
274
275 if [ "${SPL_SIGN_ENABLE}" = "1" ] && [ "${UBOOT_FIT_GENERATE_KEYS}" = "1" ]; then
276
277 # Generate keys only if they don't already exist
278 if [ ! -f "${SPL_SIGN_KEYDIR}/${SPL_SIGN_KEYNAME}".key ] || \
279 [ ! -f "${SPL_SIGN_KEYDIR}/${SPL_SIGN_KEYNAME}".crt ]; then
280
281 # make directory if it does not already exist
282 mkdir -p "${SPL_SIGN_KEYDIR}"
283
284 echo "Generating RSA private key for signing U-Boot fitImage"
285 openssl genrsa ${UBOOT_FIT_KEY_GENRSA_ARGS} -out \
286 "${SPL_SIGN_KEYDIR}/${SPL_SIGN_KEYNAME}".key \
287 "${UBOOT_FIT_SIGN_NUMBITS}"
288
289 echo "Generating certificate for signing U-Boot fitImage"
290 openssl req ${FIT_KEY_REQ_ARGS} "${UBOOT_FIT_KEY_SIGN_PKCS}" \
291 -key "${SPL_SIGN_KEYDIR}/${SPL_SIGN_KEYNAME}".key \
292 -out "${SPL_SIGN_KEYDIR}/${SPL_SIGN_KEYNAME}".crt
293 fi
294 fi
295
296}
297
William A. Kennington IIIac69b482021-06-02 12:28:27 -0700298addtask uboot_generate_rsa_keys before do_uboot_assemble_fitimage after do_compile
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500299
300# Create a ITS file for the U-boot FIT, for use when
301# we want to sign it so that the SPL can verify it
302uboot_fitimage_assemble() {
Andrew Geisslereff27472021-10-29 15:35:00 -0500303 uboot_its="$1"
304 uboot_nodtb_bin="$2"
305 uboot_dtb="$3"
306 uboot_bin="$4"
307 spl_dtb="$5"
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500308 uboot_csum="${UBOOT_FIT_HASH_ALG}"
309 uboot_sign_algo="${UBOOT_FIT_SIGN_ALG}"
310 uboot_sign_keyname="${SPL_SIGN_KEYNAME}"
311
Andrew Geisslereff27472021-10-29 15:35:00 -0500312 rm -f $uboot_its $uboot_bin
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500313
314 # First we create the ITS script
Andrew Geisslereff27472021-10-29 15:35:00 -0500315 cat << EOF >> $uboot_its
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500316/dts-v1/;
317
318/ {
319 description = "${UBOOT_FIT_DESC}";
320 #address-cells = <1>;
321
322 images {
323 uboot {
324 description = "U-Boot image";
Andrew Geisslereff27472021-10-29 15:35:00 -0500325 data = /incbin/("$uboot_nodtb_bin");
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500326 type = "standalone";
327 os = "u-boot";
328 arch = "${UBOOT_ARCH}";
329 compression = "none";
330 load = <${UBOOT_LOADADDRESS}>;
331 entry = <${UBOOT_ENTRYPOINT}>;
332EOF
333
334 if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then
Andrew Geisslereff27472021-10-29 15:35:00 -0500335 cat << EOF >> $uboot_its
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500336 signature {
Andrew Geisslereff27472021-10-29 15:35:00 -0500337 algo = "$uboot_csum,$uboot_sign_algo";
338 key-name-hint = "$uboot_sign_keyname";
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500339 };
340EOF
341 fi
342
Andrew Geisslereff27472021-10-29 15:35:00 -0500343 cat << EOF >> $uboot_its
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500344 };
345 fdt {
346 description = "U-Boot FDT";
Andrew Geisslereff27472021-10-29 15:35:00 -0500347 data = /incbin/("$uboot_dtb");
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500348 type = "flat_dt";
349 arch = "${UBOOT_ARCH}";
350 compression = "none";
351EOF
352
353 if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then
Andrew Geisslereff27472021-10-29 15:35:00 -0500354 cat << EOF >> $uboot_its
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500355 signature {
Andrew Geisslereff27472021-10-29 15:35:00 -0500356 algo = "$uboot_csum,$uboot_sign_algo";
357 key-name-hint = "$uboot_sign_keyname";
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500358 };
359EOF
360 fi
361
Andrew Geisslereff27472021-10-29 15:35:00 -0500362 cat << EOF >> $uboot_its
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500363 };
364 };
365
366 configurations {
367 default = "conf";
368 conf {
369 description = "Boot with signed U-Boot FIT";
370 loadables = "uboot";
371 fdt = "fdt";
372 };
373 };
374};
375EOF
376
377 #
378 # Assemble the U-boot FIT image
379 #
380 ${UBOOT_MKIMAGE} \
381 ${@'-D "${SPL_MKIMAGE_DTCOPTS}"' if len('${SPL_MKIMAGE_DTCOPTS}') else ''} \
Andrew Geisslereff27472021-10-29 15:35:00 -0500382 -f $uboot_its \
383 $uboot_bin
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500384
385 if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then
386 #
387 # Sign the U-boot FIT image and add public key to SPL dtb
388 #
389 ${UBOOT_MKIMAGE_SIGN} \
390 ${@'-D "${SPL_MKIMAGE_DTCOPTS}"' if len('${SPL_MKIMAGE_DTCOPTS}') else ''} \
391 -F -k "${SPL_SIGN_KEYDIR}" \
Andrew Geisslereff27472021-10-29 15:35:00 -0500392 -K "$spl_dtb" \
393 -r $uboot_bin \
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500394 ${SPL_MKIMAGE_SIGN_ARGS}
395 fi
396
397}
398
399do_uboot_assemble_fitimage() {
400 # This function runs in KERNEL_PN context. The reason for that is that we need to
401 # support the scenario where UBOOT_SIGN_ENABLE is placing the Kernel fitImage's
402 # pubkey in the u-boot.dtb file, so that we can use it when building the U-Boot
403 # fitImage itself.
404 if [ "${UBOOT_FITIMAGE_ENABLE}" = "1" ] && \
405 [ -n "${SPL_DTB_BINARY}" -a "${PN}" = "${KERNEL_PN}" ] ; then
406 if [ "${UBOOT_SIGN_ENABLE}" != "1" ]; then
407 # If we're not signing the Kernel fitImage, that means
408 # we need to copy the u-boot.dtb from staging ourselves
409 cp -P ${STAGING_DATADIR}/u-boot*.dtb ${B}
410 fi
411 # As we are in the kernel context, we need to copy u-boot-spl.dtb from staging first.
412 # Unfortunately, need to glob on top of ${SPL_DTB_BINARY} since _IMAGE and _SYMLINK
413 # will contain U-boot's PV
414 # Similarly, we need to get the filename for the 'stub' u-boot-fitimage + its in
415 # staging so that we can use it for creating the image with the correct filename
416 # in the KERNEL_PN context.
417 # As for the u-boot.dtb (with fitimage's pubkey), it should come from the dependent
418 # do_assemble_fitimage task
419 cp -P ${STAGING_DATADIR}/u-boot-spl*.dtb ${B}
420 cp -P ${STAGING_DATADIR}/u-boot-nodtb*.bin ${B}
421 rm -rf ${B}/u-boot-fitImage-* ${B}/u-boot-its-*
422 kernel_uboot_fitimage_name=`basename ${STAGING_DATADIR}/u-boot-fitImage-*`
423 kernel_uboot_its_name=`basename ${STAGING_DATADIR}/u-boot-its-*`
424 cd ${B}
Andrew Geisslereff27472021-10-29 15:35:00 -0500425 uboot_fitimage_assemble $kernel_uboot_its_name ${UBOOT_NODTB_BINARY} \
426 ${UBOOT_DTB_BINARY} $kernel_uboot_fitimage_name \
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500427 ${SPL_DTB_BINARY}
428 fi
429}
430
431addtask uboot_assemble_fitimage before do_deploy after do_compile
432
Patrick Williams213cb262021-08-07 19:21:33 -0500433do_deploy:prepend:pn-${UBOOT_PN}() {
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500434 if [ "${UBOOT_SIGN_ENABLE}" = "1" -a -n "${UBOOT_DTB_BINARY}" ] ; then
Andrew Geissler475cb722020-07-10 16:00:51 -0500435 concat_dtb
436 fi
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500437
438 if [ "${UBOOT_FITIMAGE_ENABLE}" = "1" ] ; then
439 # Deploy the u-boot-nodtb binary and symlinks...
440 if [ -f "${SPL_DIR}/${SPL_NODTB_BINARY}" ] ; then
441 echo "Copying u-boot-nodtb binary..."
442 install -m 0644 ${SPL_DIR}/${SPL_NODTB_BINARY} ${DEPLOYDIR}/${SPL_NODTB_IMAGE}
443 ln -sf ${SPL_NODTB_IMAGE} ${DEPLOYDIR}/${SPL_NODTB_SYMLINK}
444 ln -sf ${SPL_NODTB_IMAGE} ${DEPLOYDIR}/${SPL_NODTB_BINARY}
445 fi
446
447
448 # We only deploy the symlinks to the uboot-fitImage and uboot-its
449 # images, as the KERNEL_PN will take care of deploying the real file
450 ln -sf ${UBOOT_FITIMAGE_IMAGE} ${DEPLOYDIR}/${UBOOT_FITIMAGE_BINARY}
451 ln -sf ${UBOOT_FITIMAGE_IMAGE} ${DEPLOYDIR}/${UBOOT_FITIMAGE_SYMLINK}
452 ln -sf ${UBOOT_ITS_IMAGE} ${DEPLOYDIR}/${UBOOT_ITS}
453 ln -sf ${UBOOT_ITS_IMAGE} ${DEPLOYDIR}/${UBOOT_ITS_SYMLINK}
454 fi
455
456 if [ "${SPL_SIGN_ENABLE}" = "1" -a -n "${SPL_DTB_BINARY}" ] ; then
457 concat_spl_dtb
458 fi
459
460
461}
462
Patrick Williams213cb262021-08-07 19:21:33 -0500463do_deploy:append:pn-${UBOOT_PN}() {
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500464 # If we're creating a u-boot fitImage, point u-boot.bin
465 # symlink since it might get used by image recipes
466 if [ "${UBOOT_FITIMAGE_ENABLE}" = "1" ] ; then
467 ln -sf ${UBOOT_FITIMAGE_IMAGE} ${DEPLOYDIR}/${UBOOT_BINARY}
468 ln -sf ${UBOOT_FITIMAGE_IMAGE} ${DEPLOYDIR}/${UBOOT_SYMLINK}
469 fi
Andrew Geissler475cb722020-07-10 16:00:51 -0500470}
471
Patrick Williamsc0f7c042017-02-23 20:41:17 -0600472python () {
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500473 if ( (d.getVar('UBOOT_SIGN_ENABLE') == '1'
474 or d.getVar('UBOOT_FITIMAGE_ENABLE') == '1')
475 and d.getVar('PN') == d.getVar('UBOOT_PN')
476 and d.getVar('UBOOT_DTB_BINARY')):
Patrick Williamsc0f7c042017-02-23 20:41:17 -0600477
Brad Bishop19323692019-04-05 15:28:33 -0400478 # Make "bitbake u-boot -cdeploy" deploys the signed u-boot.dtb
Andrew Geissler3b8a17c2021-04-15 15:55:55 -0500479 # and/or the U-Boot fitImage
480 d.appendVarFlag('do_deploy', 'depends', ' %s:do_deploy' % d.getVar('KERNEL_PN'))
481
482 if d.getVar('UBOOT_FITIMAGE_ENABLE') == '1' and d.getVar('PN') == d.getVar('KERNEL_PN'):
483 # As the U-Boot fitImage is created by the KERNEL_PN, we need
484 # to make sure that the u-boot-spl.dtb and u-boot-spl-nodtb.bin
485 # files are in the staging dir for it's use
486 d.appendVarFlag('do_uboot_assemble_fitimage', 'depends', ' %s:do_populate_sysroot' % d.getVar('UBOOT_PN'))
487
488 # If the Kernel fitImage is being signed, we need to
489 # create the U-Boot fitImage after it
490 if d.getVar('UBOOT_SIGN_ENABLE') == '1':
491 d.appendVarFlag('do_uboot_assemble_fitimage', 'depends', ' %s:do_assemble_fitimage' % d.getVar('KERNEL_PN'))
492 d.appendVarFlag('do_uboot_assemble_fitimage', 'depends', ' %s:do_assemble_fitimage_initramfs' % d.getVar('KERNEL_PN'))
493
Patrick Williamsc0f7c042017-02-23 20:41:17 -0600494}