Gitiles
Code Review Sign In
gerrit.openbmc.org / stefanberger / openbmc / f465b3d2f9265b230f9609fb6f1ec4cb0d263a5b / . / meta-phosphor / classes / fit-image.bbclass
blob: 227fe47f72643f774cf23083f7d7bc6aec343417 [file] [log] [blame]
Patrick Williamse479e922023-01-06 13:45:20 -0600[diff] [blame]1inherit uboot-config
2
3CONVERSIONTYPES += "fitImage"
4
5CONVERSION_CMD:fitImage = "run_assemble_fitimage ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${type}"
6INITRAMFS_IMAGE="${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.cpio.${INITRAMFS_CTYPE}"
7KERNEL_OUTPUT_DIR="${DEPLOY_DIR_IMAGE}"
8
9do_image_cpio[depends] += "virtual/kernel:do_deploy"
10
11run_assemble_fitimage() {
12 export linux_comp="none"
13 fitimage_assemble $1.its $1.fitImage 1
14
15 # The fitimage_assemble puts the image into DEPLOY_DIR_NAME due to
16 # KERNEL_OUTPUT_DIR, but we really want it still in ${IMGDEPLOYDIR}, so
17 # move it.
18 mv ${DEPLOY_DIR_IMAGE}/${INITRAMFS_IMAGE}.fitImage .
19 # Delete the spurious linux.bin created by our stubbed uboot_prep_kimage.
20 rm linux.bin
21}
22
23UBOOT_MKIMAGE_KERNEL_TYPE ?= "kernel"
24uboot_prep_kimage() {
25 cp ${DEPLOY_DIR_IMAGE}/${KERNEL_IMAGETYPE} linux.bin
26}
27
28DEPENDS:append = " u-boot-tools-native dtc-native virtual/${TARGET_PREFIX}binutils"
29
30# Description string
31FIT_DESC ?= "Kernel fitImage for ${DISTRO_NAME}/${PV}/${MACHINE}"
32
33# Kernel fitImage Hash Algo
34FIT_HASH_ALG ?= "sha256"
35
36# Kernel fitImage Signature Algo
37FIT_SIGN_ALG ?= "rsa2048"
38
39# Kernel / U-Boot fitImage Padding Algo
40FIT_PAD_ALG ?= "pkcs-1.5"
41
42# Generate keys for signing Kernel fitImage
43FIT_GENERATE_KEYS ?= "0"
44
45# Size of private keys in number of bits
46FIT_SIGN_NUMBITS ?= "2048"
47
48# args to openssl genrsa (Default is just the public exponent)
49FIT_KEY_GENRSA_ARGS ?= "-F4"
50
51# args to openssl req (Default is -batch for non interactive mode and
52# -new for new certificate)
53FIT_KEY_REQ_ARGS ?= "-batch -new"
54
55# Standard format for public key certificate
56FIT_KEY_SIGN_PKCS ?= "-x509"
57
58# Sign individual images as well
59FIT_SIGN_INDIVIDUAL ?= "0"
60
61FIT_CONF_PREFIX ?= "conf-"
62FIT_CONF_PREFIX[doc] = "Prefix to use for FIT configuration node name"
63
64FIT_SUPPORTED_INITRAMFS_FSTYPES ?= "cpio.lz4 cpio.lzo cpio.lzma cpio.xz cpio.zst cpio.gz ext2.gz cpio"
65
66#
67# Emit the fitImage ITS header
68#
69# $1 ... .its filename
70fitimage_emit_fit_header() {
71 cat << EOF >> $1
72/dts-v1/;
73
74/ {
75 description = "${FIT_DESC}";
76 #address-cells = <1>;
77EOF
78}
79
80#
81# Emit the fitImage section bits
82#
83# $1 ... .its filename
84# $2 ... Section bit type: imagestart - image section start
85# confstart - configuration section start
86# sectend - section end
87# fitend - fitimage end
88#
89fitimage_emit_section_maint() {
90 case $2 in
91 imagestart)
92 cat << EOF >> $1
93
94 images {
95EOF
96 ;;
97 confstart)
98 cat << EOF >> $1
99
100 configurations {
101EOF
102 ;;
103 sectend)
104 cat << EOF >> $1
105 };
106EOF
107 ;;
108 fitend)
109 cat << EOF >> $1
110};
111EOF
112 ;;
113 esac
114}
115
116
117#
118# Emit the fitImage ITS kernel section
119#
120# $1 ... .its filename
121# $2 ... Image counter
122# $3 ... Path to kernel image
123# $4 ... Compression type
124fitimage_emit_section_kernel() {
125
126 kernel_csum="${FIT_HASH_ALG}"
127 kernel_sign_algo="${FIT_SIGN_ALG}"
128 kernel_sign_keyname="${UBOOT_SIGN_IMG_KEYNAME}"
129
130 ENTRYPOINT="${UBOOT_ENTRYPOINT}"
131 if [ -n "${UBOOT_ENTRYSYMBOL}" ]; then
132 ENTRYPOINT=`${HOST_PREFIX}nm vmlinux | \
133 awk '$3=="${UBOOT_ENTRYSYMBOL}" {print "0x"$1;exit}'`
134 fi
135
136 cat << EOF >> $1
137 kernel-$2 {
138 description = "Linux kernel";
139 data = /incbin/("$3");
140 type = "${UBOOT_MKIMAGE_KERNEL_TYPE}";
141 arch = "${UBOOT_ARCH}";
142 os = "linux";
143 compression = "$4";
144 load = <${UBOOT_LOADADDRESS}>;
145 entry = <$ENTRYPOINT>;
146 hash-1 {
147 algo = "$kernel_csum";
148 };
149 };
150EOF
151
152 if [ "${UBOOT_SIGN_ENABLE}" = "1" -a "${FIT_SIGN_INDIVIDUAL}" = "1" -a -n "$kernel_sign_keyname" ] ; then
153 sed -i '$ d' $1
154 cat << EOF >> $1
155 signature-1 {
156 algo = "$kernel_csum,$kernel_sign_algo";
157 key-name-hint = "$kernel_sign_keyname";
158 };
159 };
160EOF
161 fi
162}
163
164#
165# Emit the fitImage ITS DTB section
166#
167# $1 ... .its filename
168# $2 ... Image counter
169# $3 ... Path to DTB image
170fitimage_emit_section_dtb() {
171
172 dtb_csum="${FIT_HASH_ALG}"
173 dtb_sign_algo="${FIT_SIGN_ALG}"
174 dtb_sign_keyname="${UBOOT_SIGN_IMG_KEYNAME}"
175
176 dtb_loadline=""
177 dtb_ext=${DTB##*.}
178 if [ "${dtb_ext}" = "dtbo" ]; then
179 if [ -n "${UBOOT_DTBO_LOADADDRESS}" ]; then
180 dtb_loadline="load = <${UBOOT_DTBO_LOADADDRESS}>;"
181 fi
182 elif [ -n "${UBOOT_DTB_LOADADDRESS}" ]; then
183 dtb_loadline="load = <${UBOOT_DTB_LOADADDRESS}>;"
184 fi
185 cat << EOF >> $1
186 fdt-$2 {
187 description = "Flattened Device Tree blob";
188 data = /incbin/("$3");
189 type = "flat_dt";
190 arch = "${UBOOT_ARCH}";
191 compression = "none";
192 $dtb_loadline
193 hash-1 {
194 algo = "$dtb_csum";
195 };
196 };
197EOF
198
199 if [ "${UBOOT_SIGN_ENABLE}" = "1" -a "${FIT_SIGN_INDIVIDUAL}" = "1" -a -n "$dtb_sign_keyname" ] ; then
200 sed -i '$ d' $1
201 cat << EOF >> $1
202 signature-1 {
203 algo = "$dtb_csum,$dtb_sign_algo";
204 key-name-hint = "$dtb_sign_keyname";
205 };
206 };
207EOF
208 fi
209}
210
211#
212# Emit the fitImage ITS u-boot script section
213#
214# $1 ... .its filename
215# $2 ... Image counter
216# $3 ... Path to boot script image
217fitimage_emit_section_boot_script() {
218
219 bootscr_csum="${FIT_HASH_ALG}"
220 bootscr_sign_algo="${FIT_SIGN_ALG}"
221 bootscr_sign_keyname="${UBOOT_SIGN_IMG_KEYNAME}"
222
223 cat << EOF >> $1
224 bootscr-$2 {
225 description = "U-boot script";
226 data = /incbin/("$3");
227 type = "script";
228 arch = "${UBOOT_ARCH}";
229 compression = "none";
230 hash-1 {
231 algo = "$bootscr_csum";
232 };
233 };
234EOF
235
236 if [ "${UBOOT_SIGN_ENABLE}" = "1" -a "${FIT_SIGN_INDIVIDUAL}" = "1" -a -n "$bootscr_sign_keyname" ] ; then
237 sed -i '$ d' $1
238 cat << EOF >> $1
239 signature-1 {
240 algo = "$bootscr_csum,$bootscr_sign_algo";
241 key-name-hint = "$bootscr_sign_keyname";
242 };
243 };
244EOF
245 fi
246}
247
248#
249# Emit the fitImage ITS setup section
250#
251# $1 ... .its filename
252# $2 ... Image counter
253# $3 ... Path to setup image
254fitimage_emit_section_setup() {
255
256 setup_csum="${FIT_HASH_ALG}"
257
258 cat << EOF >> $1
259 setup-$2 {
260 description = "Linux setup.bin";
261 data = /incbin/("$3");
262 type = "x86_setup";
263 arch = "${UBOOT_ARCH}";
264 os = "linux";
265 compression = "none";
266 load = <0x00090000>;
267 entry = <0x00090000>;
268 hash-1 {
269 algo = "$setup_csum";
270 };
271 };
272EOF
273}
274
275#
276# Emit the fitImage ITS ramdisk section
277#
278# $1 ... .its filename
279# $2 ... Image counter
280# $3 ... Path to ramdisk image
281fitimage_emit_section_ramdisk() {
282
283 ramdisk_csum="${FIT_HASH_ALG}"
284 ramdisk_sign_algo="${FIT_SIGN_ALG}"
285 ramdisk_sign_keyname="${UBOOT_SIGN_IMG_KEYNAME}"
286 ramdisk_loadline=""
287 ramdisk_entryline=""
288
289 if [ -n "${UBOOT_RD_LOADADDRESS}" ]; then
290 ramdisk_loadline="load = <${UBOOT_RD_LOADADDRESS}>;"
291 fi
292 if [ -n "${UBOOT_RD_ENTRYPOINT}" ]; then
293 ramdisk_entryline="entry = <${UBOOT_RD_ENTRYPOINT}>;"
294 fi
295
296 cat << EOF >> $1
297 ramdisk-$2 {
298 description = "${INITRAMFS_IMAGE}";
299 data = /incbin/("$3");
300 type = "ramdisk";
301 arch = "${UBOOT_ARCH}";
302 os = "linux";
303 compression = "none";
304 $ramdisk_loadline
305 $ramdisk_entryline
306 hash-1 {
307 algo = "$ramdisk_csum";
308 };
309 };
310EOF
311
312 if [ "${UBOOT_SIGN_ENABLE}" = "1" -a "${FIT_SIGN_INDIVIDUAL}" = "1" -a -n "$ramdisk_sign_keyname" ] ; then
313 sed -i '$ d' $1
314 cat << EOF >> $1
315 signature-1 {
316 algo = "$ramdisk_csum,$ramdisk_sign_algo";
317 key-name-hint = "$ramdisk_sign_keyname";
318 };
319 };
320EOF
321 fi
322}
323
324#
325# echoes symlink destination if it points below directory
326#
327# $1 ... file that's a potential symlink
328# $2 ... expected parent directory
329symlink_points_below() {
330 file="$2/$1"
331 dir=$2
332
333 if ! [ -L "$file" ]; then
334 return
335 fi
336
337 realpath="$(realpath --relative-to=$dir $file)"
338 if [ -z "${realpath%%../*}" ]; then
339 return
340 fi
341
342 echo "$realpath"
343}
344
345#
346# Emit the fitImage ITS configuration section
347#
348# $1 ... .its filename
349# $2 ... Linux kernel ID
350# $3 ... DTB image name
351# $4 ... ramdisk ID
352# $5 ... u-boot script ID
353# $6 ... config ID
354# $7 ... default flag
355fitimage_emit_section_config() {
356
357 conf_csum="${FIT_HASH_ALG}"
358 conf_sign_algo="${FIT_SIGN_ALG}"
359 conf_padding_algo="${FIT_PAD_ALG}"
360 if [ "${UBOOT_SIGN_ENABLE}" = "1" ] ; then
361 conf_sign_keyname="${UBOOT_SIGN_KEYNAME}"
362 fi
363
364 its_file="$1"
365 kernel_id="$2"
366 dtb_image="$3"
367 ramdisk_id="$4"
368 bootscr_id="$5"
369 config_id="$6"
370 default_flag="$7"
371
372 # Test if we have any DTBs at all
373 sep=""
374 conf_desc=""
375 conf_node="${FIT_CONF_PREFIX}"
376 kernel_line=""
377 fdt_line=""
378 ramdisk_line=""
379 bootscr_line=""
380 setup_line=""
381 default_line=""
382
383 dtb_image_sect=$(symlink_points_below $dtb_image "${EXTERNAL_KERNEL_DEVICETREE}")
384 if [ -z "$dtb_image_sect" ]; then
385 dtb_image_sect=$dtb_image
386 fi
387
388 dtb_image=$(echo $dtb_image | tr '/' '_')
389 dtb_image_sect=$(echo "${dtb_image_sect}" | tr '/' '_')
390
391 # conf node name is selected based on dtb ID if it is present,
392 # otherwise its selected based on kernel ID
393 if [ -n "$dtb_image" ]; then
394 conf_node=$conf_node$dtb_image
395 else
396 conf_node=$conf_node$kernel_id
397 fi
398
399 if [ -n "$kernel_id" ]; then
400 conf_desc="Linux kernel"
401 sep=", "
402 kernel_line="kernel = \"kernel-$kernel_id\";"
403 fi
404
405 if [ -n "$dtb_image" ]; then
406 conf_desc="$conf_desc${sep}FDT blob"
407 sep=", "
408 fdt_line="fdt = \"fdt-$dtb_image_sect\";"
409 fi
410
411 if [ -n "$ramdisk_id" ]; then
412 conf_desc="$conf_desc${sep}ramdisk"
413 sep=", "
414 ramdisk_line="ramdisk = \"ramdisk-$ramdisk_id\";"
415 fi
416
417 if [ -n "$bootscr_id" ]; then
418 conf_desc="$conf_desc${sep}u-boot script"
419 sep=", "
420 bootscr_line="bootscr = \"bootscr-$bootscr_id\";"
421 fi
422
423 if [ -n "$config_id" ]; then
424 conf_desc="$conf_desc${sep}setup"
425 setup_line="setup = \"setup-$config_id\";"
426 fi
427
428 if [ "$default_flag" = "1" ]; then
429 # default node is selected based on dtb ID if it is present,
430 # otherwise its selected based on kernel ID
431 if [ -n "$dtb_image" ]; then
432 default_line="default = \"${FIT_CONF_PREFIX}$dtb_image\";"
433 else
434 default_line="default = \"${FIT_CONF_PREFIX}$kernel_id\";"
435 fi
436 fi
437
438 cat << EOF >> $its_file
439 $default_line
440 $conf_node {
441 description = "$default_flag $conf_desc";
442 $kernel_line
443 $fdt_line
444 $ramdisk_line
445 $bootscr_line
446 $setup_line
447 hash-1 {
448 algo = "$conf_csum";
449 };
450EOF
451
452 if [ -n "$conf_sign_keyname" ] ; then
453
454 sign_line="sign-images = "
455 sep=""
456
457 if [ -n "$kernel_id" ]; then
458 sign_line="$sign_line${sep}\"kernel\""
459 sep=", "
460 fi
461
462 if [ -n "$dtb_image" ]; then
463 sign_line="$sign_line${sep}\"fdt\""
464 sep=", "
465 fi
466
467 if [ -n "$ramdisk_id" ]; then
468 sign_line="$sign_line${sep}\"ramdisk\""
469 sep=", "
470 fi
471
472 if [ -n "$bootscr_id" ]; then
473 sign_line="$sign_line${sep}\"bootscr\""
474 sep=", "
475 fi
476
477 if [ -n "$config_id" ]; then
478 sign_line="$sign_line${sep}\"setup\""
479 fi
480
481 sign_line="$sign_line;"
482
483 cat << EOF >> $its_file
484 signature-1 {
485 algo = "$conf_csum,$conf_sign_algo";
486 key-name-hint = "$conf_sign_keyname";
487 padding = "$conf_padding_algo";
488 $sign_line
489 };
490EOF
491 fi
492
493 cat << EOF >> $its_file
494 };
495EOF
496}
497
498#
499# Assemble fitImage
500#
501# $1 ... .its filename
502# $2 ... fitImage name
503# $3 ... include ramdisk
504fitimage_assemble() {
505 kernelcount=1
506 dtbcount=""
507 DTBS=""
508 ramdiskcount=$3
509 setupcount=""
510 bootscr_id=""
511 rm -f $1 ${KERNEL_OUTPUT_DIR}/$2
512
513 if [ -n "${UBOOT_SIGN_IMG_KEYNAME}" -a "${UBOOT_SIGN_KEYNAME}" = "${UBOOT_SIGN_IMG_KEYNAME}" ]; then
514 bbfatal "Keys used to sign images and configuration nodes must be different."
515 fi
516
517 fitimage_emit_fit_header $1
518
519 #
520 # Step 1: Prepare a kernel image section.
521 #
522 fitimage_emit_section_maint $1 imagestart
523
524 uboot_prep_kimage
525 fitimage_emit_section_kernel $1 $kernelcount linux.bin "$linux_comp"
526
527 #
528 # Step 2: Prepare a DTB image section
529 #
530
531 if [ -n "${KERNEL_DEVICETREE}" ]; then
532 dtbcount=1
533 for DTB in ${KERNEL_DEVICETREE}; do
534 if echo $DTB | grep -q '/dts/'; then
535 bbwarn "$DTB contains the full path to the the dts file, but only the dtb name should be used."
536 DTB=`basename $DTB | sed 's,\.dts$,.dtb,g'`
537 fi
538
539 # Skip ${DTB} if it's also provided in ${EXTERNAL_KERNEL_DEVICETREE}
540 if [ -n "${EXTERNAL_KERNEL_DEVICETREE}" ] && [ -s ${EXTERNAL_KERNEL_DEVICETREE}/${DTB} ]; then
541 continue
542 fi
543
544 DTB_PATH="${KERNEL_OUTPUT_DIR}/dts/$DTB"
545 if [ ! -e "$DTB_PATH" ]; then
546 DTB_PATH="${KERNEL_OUTPUT_DIR}/$DTB"
547 fi
548
549 # Skip DTB if we've picked it up previously
550 echo "$DTBS" | tr ' ' '\n' | grep -xq "$DTB" && continue
551
552 DTBS="$DTBS $DTB"
553 DTB=$(echo $DTB | tr '/' '_')
554 fitimage_emit_section_dtb $1 $DTB $DTB_PATH
555 done
556 fi
557
558 if [ -n "${EXTERNAL_KERNEL_DEVICETREE}" ]; then
559 dtbcount=1
560 for DTB in $(find "${EXTERNAL_KERNEL_DEVICETREE}" \( -name '*.dtb' -o -name '*.dtbo' \) -printf '%P\n' | sort); do
561 # Skip DTB if we've picked it up previously
562 echo "$DTBS" | tr ' ' '\n' | grep -xq "$DTB" && continue
563
564 DTBS="$DTBS $DTB"
565
566 # Also skip if a symlink. We'll later have each config section point at it
567 [ $(symlink_points_below $DTB "${EXTERNAL_KERNEL_DEVICETREE}") ] && continue
568
569 DTB=$(echo $DTB | tr '/' '_')
570 fitimage_emit_section_dtb $1 $DTB "${EXTERNAL_KERNEL_DEVICETREE}/$DTB"
571 done
572 fi
573
574 #
575 # Step 3: Prepare a u-boot script section
576 #
577
578 if [ -n "${UBOOT_ENV}" ] && [ -d "${STAGING_DIR_HOST}/boot" ]; then
579 if [ -e "${STAGING_DIR_HOST}/boot/${UBOOT_ENV_BINARY}" ]; then
580 cp ${STAGING_DIR_HOST}/boot/${UBOOT_ENV_BINARY} ${B}
581 bootscr_id="${UBOOT_ENV_BINARY}"
582 fitimage_emit_section_boot_script $1 "$bootscr_id" ${UBOOT_ENV_BINARY}
583 else
584 bbwarn "${STAGING_DIR_HOST}/boot/${UBOOT_ENV_BINARY} not found."
585 fi
586 fi
587
588 #
589 # Step 4: Prepare a setup section. (For x86)
590 #
591 if [ -e ${KERNEL_OUTPUT_DIR}/setup.bin ]; then
592 setupcount=1
593 fitimage_emit_section_setup $1 $setupcount ${KERNEL_OUTPUT_DIR}/setup.bin
594 fi
595
596 #
597 # Step 5: Prepare a ramdisk section.
598 #
599 if [ "x${ramdiskcount}" = "x1" ] && [ "${INITRAMFS_IMAGE_BUNDLE}" != "1" ]; then
600 # Find and use the first initramfs image archive type we find
601 found=
602 for img in ${FIT_SUPPORTED_INITRAMFS_FSTYPES}; do
603 initramfs_path="${DEPLOY_DIR_IMAGE}/${INITRAMFS_IMAGE_NAME}.$img"
604 if [ -e "$initramfs_path" ]; then
605 bbnote "Found initramfs image: $initramfs_path"
606 found=true
607 fitimage_emit_section_ramdisk $1 "$ramdiskcount" "$initramfs_path"
608 break
609 else
610 bbnote "Did not find initramfs image: $initramfs_path"
611 fi
612 done
613
614 if [ -z "$found" ] && [ -e ${INITRAMFS_IMAGE} ]; then
615 found=true
616 bbnote "Found initramfs image: ${INITRAMFS_IMAGE}"
617 fitimage_emit_section_ramdisk $1 "$ramdiskcount" "${INITRAMFS_IMAGE}"
618 fi
619
620 if [ -z "$found" ]; then
621 bbfatal "Could not find a valid initramfs type for ${INITRAMFS_IMAGE_NAME}, the supported types are: ${FIT_SUPPORTED_INITRAMFS_FSTYPES}"
622 fi
623 fi
624
625 fitimage_emit_section_maint $1 sectend
626
627 # Force the first Kernel and DTB in the default config
628 kernelcount=1
629 if [ -n "$dtbcount" ]; then
630 dtbcount=1
631 fi
632
633 #
634 # Step 6: Prepare a configurations section
635 #
636 fitimage_emit_section_maint $1 confstart
637
638 # kernel-fitimage.bbclass currently only supports a single kernel (no less or
639 # more) to be added to the FIT image along with 0 or more device trees and
640 # 0 or 1 ramdisk.
641 # It is also possible to include an initramfs bundle (kernel and rootfs in one binary)
642 # When the initramfs bundle is used ramdisk is disabled.
643 # If a device tree is to be part of the FIT image, then select
644 # the default configuration to be used is based on the dtbcount. If there is
645 # no dtb present than select the default configuation to be based on
646 # the kernelcount.
647 if [ -n "$DTBS" ]; then
648 i=1
649 for DTB in ${DTBS}; do
650 dtb_ext=${DTB##*.}
651 if [ "$dtb_ext" = "dtbo" ]; then
652 fitimage_emit_section_config $1 "" "$DTB" "" "$bootscr_id" "" "`expr $i = $dtbcount`"
653 else
654 fitimage_emit_section_config $1 $kernelcount "$DTB" "$ramdiskcount" "$bootscr_id" "$setupcount" "`expr $i = $dtbcount`"
655 fi
656 i=`expr $i + 1`
657 done
658 else
659 defaultconfigcount=1
660 fitimage_emit_section_config $1 $kernelcount "" "$ramdiskcount" "$bootscr_id" "$setupcount" $defaultconfigcount
661 fi
662
663 fitimage_emit_section_maint $1 sectend
664
665 fitimage_emit_section_maint $1 fitend
666
667 #
668 # Step 7: Assemble the image
669 #
670 ${UBOOT_MKIMAGE} \
671 ${@'-D "${UBOOT_MKIMAGE_DTCOPTS}"' if len('${UBOOT_MKIMAGE_DTCOPTS}') else ''} \
672 -f $1 \
673 ${KERNEL_OUTPUT_DIR}/$2
674
675 #
676 # Step 8: Sign the image
677 #
678 if [ "x${UBOOT_SIGN_ENABLE}" = "x1" ] ; then
679 ${UBOOT_MKIMAGE_SIGN} \
680 ${@'-D "${UBOOT_MKIMAGE_DTCOPTS}"' if len('${UBOOT_MKIMAGE_DTCOPTS}') else ''} \
681 -F -k "${UBOOT_SIGN_KEYDIR}" \
682 -r ${KERNEL_OUTPUT_DIR}/$2 \
683 ${UBOOT_MKIMAGE_SIGN_ARGS}
684 fi
685}