* [RFC][PATCH v2 0/4] U-Boot verified boot basic support
@ 2016-04-20 13:50 Yannick Gicquel
2016-04-20 13:50 ` [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot Yannick Gicquel
` (4 more replies)
0 siblings, 5 replies; 22+ messages in thread
From: Yannick Gicquel @ 2016-04-20 13:50 UTC (permalink / raw)
To: openembedded-core
Changes since v1:
* Uses a class uboot-sign.bbclass file instead of include file.
* 'assemble_dtb' task removed and replace by do_install_prepend function
for u-boot recipe.
Yannick Gicquel (4):
u-boot: basic support of dtb append for verified boot
u-boot: deploy u-boot-nodtb and dtb files
kernel: fitimage: support device tree compiler options
kernel: fitimage: basic support for fitimage signature
meta/classes/kernel-fitimage.bbclass | 52 +++++++++++++++++++++++--
meta/classes/uboot-sign.bbclass | 75 ++++++++++++++++++++++++++++++++++++
meta/recipes-bsp/u-boot/u-boot.inc | 2 +-
3 files changed, 125 insertions(+), 4 deletions(-)
create mode 100644 meta/classes/uboot-sign.bbclass
--
1.9.1
^ permalink raw reply [flat|nested] 22+ messages in thread* [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot 2016-04-20 13:50 [RFC][PATCH v2 0/4] U-Boot verified boot basic support Yannick Gicquel @ 2016-04-20 13:50 ` Yannick Gicquel 2016-04-20 15:23 ` Tom Rini ` (3 more replies) 2016-04-20 13:50 ` [RFC][PATCH v2 2/4] u-boot: deploy u-boot-nodtb and dtb files Yannick Gicquel ` (3 subsequent siblings) 4 siblings, 4 replies; 22+ messages in thread From: Yannick Gicquel @ 2016-04-20 13:50 UTC (permalink / raw) To: openembedded-core This introduces a new uboot-sign.class to support U-Boot verified boot. This part delivers the new class file, with related environment variables, and a basic prepend to do_install task which performs the concatenation of the u-boot-nodtb.bin and the device tree blob. The 'cat' command used overrides the u-boot.bin in both DEPLOYDIR & build dir to propagate the changes in later tasks (do_install, do_package, etc.) Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> --- meta/classes/uboot-sign.bbclass | 59 ++++++++++++++++++++++++++++++++++++++ meta/recipes-bsp/u-boot/u-boot.inc | 2 +- 2 files changed, 60 insertions(+), 1 deletion(-) create mode 100644 meta/classes/uboot-sign.bbclass diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass new file mode 100644 index 0000000..63a5181 --- /dev/null +++ b/meta/classes/uboot-sign.bbclass @@ -0,0 +1,59 @@ +# This file is part of U-Boot verified boot support and is intended to be +# inherited from u-boot recipe and from kernel-fitimage.bbclass. +# +# The signature procedure requires the user to generate an RSA key and +# certificate in a directory and to define the following variable: +# +# UBOOT_SIGN_KEYDIR = "/keys/directory" +# UBOOT_SIGN_KEYNAME = "dev" # keys name in keydir (eg. "dev.crt", "dev.key") +# UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000" +# UBOOT_SIGN_ENABLE = "1" +# +# As verified boot depends on fitImage generation, following is also required: +# +# KERNEL_CLASSES ?= " kernel-fitimage " +# KERNEL_IMAGETYPE ?= "fitImage" +# +# The signature support is limited to the use of CONFIG_OF_SEPARATE in U-Boot. +# +# The tasks sequence is as below, using DEPLOY_IMAGE_DIR as common place to +# treat the device tree blob: +# +# u-boot:do_deploy -> virtual/kernel:do_assemble_fitimage -> u-boot:do_install +# +# For more details on signature process, please refer to U-boot documentation. + +# Signature activation. +UBOOT_SIGN_ENABLE ?= "0" + +# Default value for deployment filenames. +UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb" +UBOOT_DTB_BINARY ?= "u-boot.dtb" +UBOOT_DTB_SYMLINK ?= "u-boot-${MACHINE}.dtb" +UBOOT_NODTB_IMAGE ?= "u-boot-nodtb-${MACHINE}-${PV}-${PR}.${UBOOT_SUFFIX}" +UBOOT_NODTB_BINARY ?= "u-boot-nodtb.${UBOOT_SUFFIX}" +UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.${UBOOT_SUFFIX}" + +# +# Following is relevant only for u-boot recipes: +# + +do_install_prepend_pn-u-boot () { + # Concatenate U-Boot w/o DTB & DTB with public key + # (cf. kernel-fitimage.bbclass for more details) + cd ${DEPLOYDIR} + if [ "x${UBOOT_SIGN_ENABLE}" = "x1" ]; then + if [ -e "${UBOOT_NODTB_IMAGE}" -a -e "${UBOOT_DTB_IMAGE}" ]; then + cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} > ${UBOOT_IMAGE} + cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} > ${B}/${UBOOT_BINARY} + else + bbwarn "Failure while adding public key to u-boot binary. Verified boot won't be available." + fi + fi +} + +python () { + if d.getVar('UBOOT_SIGN_ENABLE', True) == '1' and d.getVar('PN', True) == 'u-boot': + kernel_pn = d.getVar('PREFERRED_PROVIDER_virtual/kernel', True) + d.appendVarFlag('do_install', 'depends', ' %s:do_assemble_fitimage' % kernel_pn) +} diff --git a/meta/recipes-bsp/u-boot/u-boot.inc b/meta/recipes-bsp/u-boot/u-boot.inc index 3ba866d..037f35c 100644 --- a/meta/recipes-bsp/u-boot/u-boot.inc +++ b/meta/recipes-bsp/u-boot/u-boot.inc @@ -12,7 +12,7 @@ S = "${WORKDIR}/git" PACKAGE_ARCH = "${MACHINE_ARCH}" -inherit uboot-config deploy +inherit uboot-config uboot-sign deploy EXTRA_OEMAKE = 'CROSS_COMPILE=${TARGET_PREFIX} CC="${TARGET_PREFIX}gcc ${TOOLCHAIN_OPTIONS}" V=1' EXTRA_OEMAKE += 'HOSTCC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}"' -- 1.9.1 ^ permalink raw reply related [flat|nested] 22+ messages in thread
* Re: [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot 2016-04-20 13:50 ` [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot Yannick Gicquel @ 2016-04-20 15:23 ` Tom Rini 2016-04-20 19:33 ` [RFC, v2, " Andreas Dannenberg ` (2 subsequent siblings) 3 siblings, 0 replies; 22+ messages in thread From: Tom Rini @ 2016-04-20 15:23 UTC (permalink / raw) To: Yannick Gicquel; +Cc: openembedded-core On Wed, Apr 20, 2016 at 03:50:36PM +0200, Yannick Gicquel wrote: > This introduces a new uboot-sign.class to support U-Boot verified boot. > > This part delivers the new class file, with related environment variables, and > a basic prepend to do_install task which performs the concatenation of the > u-boot-nodtb.bin and the device tree blob. The 'cat' command used > overrides the u-boot.bin in both DEPLOYDIR & build dir to propagate the > changes in later tasks (do_install, do_package, etc.) > > Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> Reviewed-by: Tom Rini <trini@konsulko.com> -- Tom ^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [RFC, v2, 1/4] u-boot: basic support of dtb append for verified boot 2016-04-20 13:50 ` [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot Yannick Gicquel 2016-04-20 15:23 ` Tom Rini @ 2016-04-20 19:33 ` Andreas Dannenberg 2016-04-20 19:49 ` [RFC][PATCH v2 " Denys Dmytriyenko 2016-04-21 14:06 ` Andreas Oberritter 3 siblings, 0 replies; 22+ messages in thread From: Andreas Dannenberg @ 2016-04-20 19:33 UTC (permalink / raw) To: Yannick Gicquel; +Cc: openembedded-core On Wed, Apr 20, 2016 at 03:50:36PM +0200, Yannick Gicquel wrote: > This introduces a new uboot-sign.class to support U-Boot verified boot. > > This part delivers the new class file, with related environment variables, and > a basic prepend to do_install task which performs the concatenation of the > u-boot-nodtb.bin and the device tree blob. The 'cat' command used > overrides the u-boot.bin in both DEPLOYDIR & build dir to propagate the > changes in later tasks (do_install, do_package, etc.) > > Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> > Reviewed-by: Tom Rini <trini@konsulko.com> Acked-by: Andreas Dannenberg <dannenberg@ti.com> Thanks for the submission! Agreed with Tom, this will hopefully make the FIT-based authentication scheme easier and more accessible. -- Andreas Dannenberg Texas Instruments Inc ^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot 2016-04-20 13:50 ` [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot Yannick Gicquel 2016-04-20 15:23 ` Tom Rini 2016-04-20 19:33 ` [RFC, v2, " Andreas Dannenberg @ 2016-04-20 19:49 ` Denys Dmytriyenko 2016-04-20 21:03 ` Tom Rini 2016-04-21 14:06 ` Andreas Oberritter 3 siblings, 1 reply; 22+ messages in thread From: Denys Dmytriyenko @ 2016-04-20 19:49 UTC (permalink / raw) To: Yannick Gicquel; +Cc: openembedded-core On Wed, Apr 20, 2016 at 03:50:36PM +0200, Yannick Gicquel wrote: > This introduces a new uboot-sign.class to support U-Boot verified boot. > > This part delivers the new class file, with related environment variables, and > a basic prepend to do_install task which performs the concatenation of the > u-boot-nodtb.bin and the device tree blob. The 'cat' command used > overrides the u-boot.bin in both DEPLOYDIR & build dir to propagate the > changes in later tasks (do_install, do_package, etc.) > > Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> > --- > meta/classes/uboot-sign.bbclass | 59 ++++++++++++++++++++++++++++++++++++++ > meta/recipes-bsp/u-boot/u-boot.inc | 2 +- > 2 files changed, 60 insertions(+), 1 deletion(-) > create mode 100644 meta/classes/uboot-sign.bbclass > > diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass > new file mode 100644 > index 0000000..63a5181 > --- /dev/null > +++ b/meta/classes/uboot-sign.bbclass > @@ -0,0 +1,59 @@ > +# This file is part of U-Boot verified boot support and is intended to be > +# inherited from u-boot recipe and from kernel-fitimage.bbclass. > +# > +# The signature procedure requires the user to generate an RSA key and > +# certificate in a directory and to define the following variable: > +# > +# UBOOT_SIGN_KEYDIR = "/keys/directory" > +# UBOOT_SIGN_KEYNAME = "dev" # keys name in keydir (eg. "dev.crt", "dev.key") > +# UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000" > +# UBOOT_SIGN_ENABLE = "1" > +# > +# As verified boot depends on fitImage generation, following is also required: > +# > +# KERNEL_CLASSES ?= " kernel-fitimage " > +# KERNEL_IMAGETYPE ?= "fitImage" > +# > +# The signature support is limited to the use of CONFIG_OF_SEPARATE in U-Boot. > +# > +# The tasks sequence is as below, using DEPLOY_IMAGE_DIR as common place to > +# treat the device tree blob: > +# > +# u-boot:do_deploy -> virtual/kernel:do_assemble_fitimage -> u-boot:do_install > +# > +# For more details on signature process, please refer to U-boot documentation. > + > +# Signature activation. > +UBOOT_SIGN_ENABLE ?= "0" > + > +# Default value for deployment filenames. > +UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb" > +UBOOT_DTB_BINARY ?= "u-boot.dtb" > +UBOOT_DTB_SYMLINK ?= "u-boot-${MACHINE}.dtb" > +UBOOT_NODTB_IMAGE ?= "u-boot-nodtb-${MACHINE}-${PV}-${PR}.${UBOOT_SUFFIX}" > +UBOOT_NODTB_BINARY ?= "u-boot-nodtb.${UBOOT_SUFFIX}" > +UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.${UBOOT_SUFFIX}" > + > +# > +# Following is relevant only for u-boot recipes: > +# > + > +do_install_prepend_pn-u-boot () { Why _pn-u-boot here? What if I have my own version of u-boot recipe? > + # Concatenate U-Boot w/o DTB & DTB with public key > + # (cf. kernel-fitimage.bbclass for more details) > + cd ${DEPLOYDIR} > + if [ "x${UBOOT_SIGN_ENABLE}" = "x1" ]; then > + if [ -e "${UBOOT_NODTB_IMAGE}" -a -e "${UBOOT_DTB_IMAGE}" ]; then > + cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} > ${UBOOT_IMAGE} > + cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} > ${B}/${UBOOT_BINARY} > + else > + bbwarn "Failure while adding public key to u-boot binary. Verified boot won't be available." > + fi > + fi > +} > + > +python () { > + if d.getVar('UBOOT_SIGN_ENABLE', True) == '1' and d.getVar('PN', True) == 'u-boot': > + kernel_pn = d.getVar('PREFERRED_PROVIDER_virtual/kernel', True) > + d.appendVarFlag('do_install', 'depends', ' %s:do_assemble_fitimage' % kernel_pn) > +} > diff --git a/meta/recipes-bsp/u-boot/u-boot.inc b/meta/recipes-bsp/u-boot/u-boot.inc > index 3ba866d..037f35c 100644 > --- a/meta/recipes-bsp/u-boot/u-boot.inc > +++ b/meta/recipes-bsp/u-boot/u-boot.inc > @@ -12,7 +12,7 @@ S = "${WORKDIR}/git" > > PACKAGE_ARCH = "${MACHINE_ARCH}" > > -inherit uboot-config deploy > +inherit uboot-config uboot-sign deploy > > EXTRA_OEMAKE = 'CROSS_COMPILE=${TARGET_PREFIX} CC="${TARGET_PREFIX}gcc ${TOOLCHAIN_OPTIONS}" V=1' > EXTRA_OEMAKE += 'HOSTCC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}"' > -- > 1.9.1 > > -- > _______________________________________________ > Openembedded-core mailing list > Openembedded-core@lists.openembedded.org > http://lists.openembedded.org/mailman/listinfo/openembedded-core ^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot 2016-04-20 19:49 ` [RFC][PATCH v2 " Denys Dmytriyenko @ 2016-04-20 21:03 ` Tom Rini 2016-04-21 10:25 ` Yannick GICQUEL 0 siblings, 1 reply; 22+ messages in thread From: Tom Rini @ 2016-04-20 21:03 UTC (permalink / raw) To: Denys Dmytriyenko; +Cc: openembedded-core [-- Attachment #1: Type: text/plain, Size: 3074 bytes --] On Wed, Apr 20, 2016 at 03:49:58PM -0400, Denys Dmytriyenko wrote: > On Wed, Apr 20, 2016 at 03:50:36PM +0200, Yannick Gicquel wrote: > > This introduces a new uboot-sign.class to support U-Boot verified boot. > > > > This part delivers the new class file, with related environment variables, and > > a basic prepend to do_install task which performs the concatenation of the > > u-boot-nodtb.bin and the device tree blob. The 'cat' command used > > overrides the u-boot.bin in both DEPLOYDIR & build dir to propagate the > > changes in later tasks (do_install, do_package, etc.) > > > > Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> > > --- > > meta/classes/uboot-sign.bbclass | 59 ++++++++++++++++++++++++++++++++++++++ > > meta/recipes-bsp/u-boot/u-boot.inc | 2 +- > > 2 files changed, 60 insertions(+), 1 deletion(-) > > create mode 100644 meta/classes/uboot-sign.bbclass > > > > diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass > > new file mode 100644 > > index 0000000..63a5181 > > --- /dev/null > > +++ b/meta/classes/uboot-sign.bbclass > > @@ -0,0 +1,59 @@ > > +# This file is part of U-Boot verified boot support and is intended to be > > +# inherited from u-boot recipe and from kernel-fitimage.bbclass. > > +# > > +# The signature procedure requires the user to generate an RSA key and > > +# certificate in a directory and to define the following variable: > > +# > > +# UBOOT_SIGN_KEYDIR = "/keys/directory" > > +# UBOOT_SIGN_KEYNAME = "dev" # keys name in keydir (eg. "dev.crt", "dev.key") > > +# UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000" > > +# UBOOT_SIGN_ENABLE = "1" > > +# > > +# As verified boot depends on fitImage generation, following is also required: > > +# > > +# KERNEL_CLASSES ?= " kernel-fitimage " > > +# KERNEL_IMAGETYPE ?= "fitImage" > > +# > > +# The signature support is limited to the use of CONFIG_OF_SEPARATE in U-Boot. > > +# > > +# The tasks sequence is as below, using DEPLOY_IMAGE_DIR as common place to > > +# treat the device tree blob: > > +# > > +# u-boot:do_deploy -> virtual/kernel:do_assemble_fitimage -> u-boot:do_install > > +# > > +# For more details on signature process, please refer to U-boot documentation. > > + > > +# Signature activation. > > +UBOOT_SIGN_ENABLE ?= "0" > > + > > +# Default value for deployment filenames. > > +UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb" > > +UBOOT_DTB_BINARY ?= "u-boot.dtb" > > +UBOOT_DTB_SYMLINK ?= "u-boot-${MACHINE}.dtb" > > +UBOOT_NODTB_IMAGE ?= "u-boot-nodtb-${MACHINE}-${PV}-${PR}.${UBOOT_SUFFIX}" > > +UBOOT_NODTB_BINARY ?= "u-boot-nodtb.${UBOOT_SUFFIX}" > > +UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.${UBOOT_SUFFIX}" > > + > > +# > > +# Following is relevant only for u-boot recipes: > > +# > > + > > +do_install_prepend_pn-u-boot () { > > Why _pn-u-boot here? What if I have my own version of u-boot recipe? Oh good point, maybe this should be class-target instead of pn-u-boot (here and elsewhere) ? -- Tom [-- Attachment #2: Digital signature --] [-- Type: application/pgp-signature, Size: 836 bytes --] ^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot 2016-04-20 21:03 ` Tom Rini @ 2016-04-21 10:25 ` Yannick GICQUEL 0 siblings, 0 replies; 22+ messages in thread From: Yannick GICQUEL @ 2016-04-21 10:25 UTC (permalink / raw) To: Tom Rini, Denys Dmytriyenko; +Cc: openembedded-core Le 20/04/2016 23:03, Tom Rini a écrit : > On Wed, Apr 20, 2016 at 03:49:58PM -0400, Denys Dmytriyenko wrote: >> On Wed, Apr 20, 2016 at 03:50:36PM +0200, Yannick Gicquel wrote: >>> This introduces a new uboot-sign.class to support U-Boot verified boot. >>> >>> This part delivers the new class file, with related environment variables, and >>> a basic prepend to do_install task which performs the concatenation of the >>> u-boot-nodtb.bin and the device tree blob. The 'cat' command used >>> overrides the u-boot.bin in both DEPLOYDIR & build dir to propagate the >>> changes in later tasks (do_install, do_package, etc.) >>> >>> Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> >>> --- >>> meta/classes/uboot-sign.bbclass | 59 ++++++++++++++++++++++++++++++++++++++ >>> meta/recipes-bsp/u-boot/u-boot.inc | 2 +- >>> 2 files changed, 60 insertions(+), 1 deletion(-) >>> create mode 100644 meta/classes/uboot-sign.bbclass >>> >>> diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass >>> new file mode 100644 >>> index 0000000..63a5181 >>> --- /dev/null >>> +++ b/meta/classes/uboot-sign.bbclass >>> @@ -0,0 +1,59 @@ >>> +# This file is part of U-Boot verified boot support and is intended to be >>> +# inherited from u-boot recipe and from kernel-fitimage.bbclass. >>> +# >>> +# The signature procedure requires the user to generate an RSA key and >>> +# certificate in a directory and to define the following variable: >>> +# >>> +# UBOOT_SIGN_KEYDIR = "/keys/directory" >>> +# UBOOT_SIGN_KEYNAME = "dev" # keys name in keydir (eg. "dev.crt", "dev.key") >>> +# UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000" >>> +# UBOOT_SIGN_ENABLE = "1" >>> +# >>> +# As verified boot depends on fitImage generation, following is also required: >>> +# >>> +# KERNEL_CLASSES ?= " kernel-fitimage " >>> +# KERNEL_IMAGETYPE ?= "fitImage" >>> +# >>> +# The signature support is limited to the use of CONFIG_OF_SEPARATE in U-Boot. >>> +# >>> +# The tasks sequence is as below, using DEPLOY_IMAGE_DIR as common place to >>> +# treat the device tree blob: >>> +# >>> +# u-boot:do_deploy -> virtual/kernel:do_assemble_fitimage -> u-boot:do_install >>> +# >>> +# For more details on signature process, please refer to U-boot documentation. >>> + >>> +# Signature activation. >>> +UBOOT_SIGN_ENABLE ?= "0" >>> + >>> +# Default value for deployment filenames. >>> +UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb" >>> +UBOOT_DTB_BINARY ?= "u-boot.dtb" >>> +UBOOT_DTB_SYMLINK ?= "u-boot-${MACHINE}.dtb" >>> +UBOOT_NODTB_IMAGE ?= "u-boot-nodtb-${MACHINE}-${PV}-${PR}.${UBOOT_SUFFIX}" >>> +UBOOT_NODTB_BINARY ?= "u-boot-nodtb.${UBOOT_SUFFIX}" >>> +UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.${UBOOT_SUFFIX}" >>> + >>> +# >>> +# Following is relevant only for u-boot recipes: >>> +# >>> + >>> +do_install_prepend_pn-u-boot () { >> Why _pn-u-boot here? What if I have my own version of u-boot recipe? > Oh good point, maybe this should be class-target instead of pn-u-boot > (here and elsewhere) ? > Hi Tom, Denys, all, I initially though that any custom u-boot recipes declares a 'PROVIDE += "u-boot"' and the bitbake "_pn-" syntax will append functions to u-boot recipes only. Unfortunately, i just checked and confirmed the appends functions are not called anymore when the u-boot recipe is not named "u-boot". Using "class-target" is an interesting idea, but it looks like the kernel recipe is also part of this class (at least on my setup), thus it may not be reliable enough. What about using the "PREFERRED_PROVIDER_u-boot" variable instead of static 'u-boot' string in the relevant places ? A "do_install_prepend_pn-${PREFERRED_PROVIDER_u-boot}" is not valid, but it can be performed by adding tasks in the python function at EOF. Something like: -do_deploy_append_pn-u-boot () { +do_before_uboot_deploy () { [snip] python() { if d.getVar('PN', True) == d.getVar('PREFERRED_PROVIDER_u-boot', True): bb.build.addtask('do_before_uboot_deploy', None, 'do_deploy', d) } Off course, it requires few changes in other places, but I hope you'll see the idea ? What do you think ? Best regards, Yannick ^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot 2016-04-20 13:50 ` [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot Yannick Gicquel ` (2 preceding siblings ...) 2016-04-20 19:49 ` [RFC][PATCH v2 " Denys Dmytriyenko @ 2016-04-21 14:06 ` Andreas Oberritter 2016-04-21 19:55 ` Yannick GICQUEL 3 siblings, 1 reply; 22+ messages in thread From: Andreas Oberritter @ 2016-04-21 14:06 UTC (permalink / raw) To: openembedded-core On 20.04.2016 15:50, Yannick Gicquel wrote: > This introduces a new uboot-sign.class to support U-Boot verified boot. > > This part delivers the new class file, with related environment variables, and > a basic prepend to do_install task which performs the concatenation of the > u-boot-nodtb.bin and the device tree blob. The 'cat' command used > overrides the u-boot.bin in both DEPLOYDIR & build dir to propagate the > changes in later tasks (do_install, do_package, etc.) > > Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> > --- > meta/classes/uboot-sign.bbclass | 59 ++++++++++++++++++++++++++++++++++++++ > meta/recipes-bsp/u-boot/u-boot.inc | 2 +- > 2 files changed, 60 insertions(+), 1 deletion(-) > create mode 100644 meta/classes/uboot-sign.bbclass > > diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass > new file mode 100644 > index 0000000..63a5181 > --- /dev/null > +++ b/meta/classes/uboot-sign.bbclass > @@ -0,0 +1,59 @@ > +# This file is part of U-Boot verified boot support and is intended to be > +# inherited from u-boot recipe and from kernel-fitimage.bbclass. > +# > +# The signature procedure requires the user to generate an RSA key and > +# certificate in a directory and to define the following variable: > +# > +# UBOOT_SIGN_KEYDIR = "/keys/directory" > +# UBOOT_SIGN_KEYNAME = "dev" # keys name in keydir (eg. "dev.crt", "dev.key") > +# UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000" > +# UBOOT_SIGN_ENABLE = "1" > +# > +# As verified boot depends on fitImage generation, following is also required: > +# > +# KERNEL_CLASSES ?= " kernel-fitimage " > +# KERNEL_IMAGETYPE ?= "fitImage" > +# > +# The signature support is limited to the use of CONFIG_OF_SEPARATE in U-Boot. > +# > +# The tasks sequence is as below, using DEPLOY_IMAGE_DIR as common place to > +# treat the device tree blob: > +# > +# u-boot:do_deploy -> virtual/kernel:do_assemble_fitimage -> u-boot:do_install > +# > +# For more details on signature process, please refer to U-boot documentation. > + > +# Signature activation. > +UBOOT_SIGN_ENABLE ?= "0" > + > +# Default value for deployment filenames. > +UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb" > +UBOOT_DTB_BINARY ?= "u-boot.dtb" > +UBOOT_DTB_SYMLINK ?= "u-boot-${MACHINE}.dtb" > +UBOOT_NODTB_IMAGE ?= "u-boot-nodtb-${MACHINE}-${PV}-${PR}.${UBOOT_SUFFIX}" > +UBOOT_NODTB_BINARY ?= "u-boot-nodtb.${UBOOT_SUFFIX}" > +UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.${UBOOT_SUFFIX}" > + I think you should split the file at this point and either put the lines above into uboot-sign-base.bbclass and include it from here or put the lines below into u-boot.inc directly. This way you don't add unnecessary code for u-boot to kernel recipes, and lose the dependency on PN = "u-boot" at the same time. Regards, Andreas > +# > +# Following is relevant only for u-boot recipes: > +# > + > +do_install_prepend_pn-u-boot () { > + # Concatenate U-Boot w/o DTB & DTB with public key > + # (cf. kernel-fitimage.bbclass for more details) > + cd ${DEPLOYDIR} > + if [ "x${UBOOT_SIGN_ENABLE}" = "x1" ]; then > + if [ -e "${UBOOT_NODTB_IMAGE}" -a -e "${UBOOT_DTB_IMAGE}" ]; then > + cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} > ${UBOOT_IMAGE} > + cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} > ${B}/${UBOOT_BINARY} > + else > + bbwarn "Failure while adding public key to u-boot binary. Verified boot won't be available." > + fi > + fi > +} > + > +python () { > + if d.getVar('UBOOT_SIGN_ENABLE', True) == '1' and d.getVar('PN', True) == 'u-boot': > + kernel_pn = d.getVar('PREFERRED_PROVIDER_virtual/kernel', True) > + d.appendVarFlag('do_install', 'depends', ' %s:do_assemble_fitimage' % kernel_pn) > +} > diff --git a/meta/recipes-bsp/u-boot/u-boot.inc b/meta/recipes-bsp/u-boot/u-boot.inc > index 3ba866d..037f35c 100644 > --- a/meta/recipes-bsp/u-boot/u-boot.inc > +++ b/meta/recipes-bsp/u-boot/u-boot.inc > @@ -12,7 +12,7 @@ S = "${WORKDIR}/git" > > PACKAGE_ARCH = "${MACHINE_ARCH}" > > -inherit uboot-config deploy > +inherit uboot-config uboot-sign deploy > > EXTRA_OEMAKE = 'CROSS_COMPILE=${TARGET_PREFIX} CC="${TARGET_PREFIX}gcc ${TOOLCHAIN_OPTIONS}" V=1' > EXTRA_OEMAKE += 'HOSTCC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}"' > ^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot 2016-04-21 14:06 ` Andreas Oberritter @ 2016-04-21 19:55 ` Yannick GICQUEL 2016-04-24 12:56 ` Bernhard Reutner-Fischer 0 siblings, 1 reply; 22+ messages in thread From: Yannick GICQUEL @ 2016-04-21 19:55 UTC (permalink / raw) To: openembedded-core [-- Attachment #1: Type: text/plain, Size: 5606 bytes --] Le 21/04/2016 16:06, Andreas Oberritter a écrit : > On 20.04.2016 15:50, Yannick Gicquel wrote: >> This introduces a new uboot-sign.class to support U-Boot verified boot. >> >> This part delivers the new class file, with related environment variables, and >> a basic prepend to do_install task which performs the concatenation of the >> u-boot-nodtb.bin and the device tree blob. The 'cat' command used >> overrides the u-boot.bin in both DEPLOYDIR & build dir to propagate the >> changes in later tasks (do_install, do_package, etc.) >> >> Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> >> --- >> meta/classes/uboot-sign.bbclass | 59 ++++++++++++++++++++++++++++++++++++++ >> meta/recipes-bsp/u-boot/u-boot.inc | 2 +- >> 2 files changed, 60 insertions(+), 1 deletion(-) >> create mode 100644 meta/classes/uboot-sign.bbclass >> >> diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass >> new file mode 100644 >> index 0000000..63a5181 >> --- /dev/null >> +++ b/meta/classes/uboot-sign.bbclass >> @@ -0,0 +1,59 @@ >> +# This file is part of U-Boot verified boot support and is intended to be >> +# inherited from u-boot recipe and from kernel-fitimage.bbclass. >> +# >> +# The signature procedure requires the user to generate an RSA key and >> +# certificate in a directory and to define the following variable: >> +# >> +# UBOOT_SIGN_KEYDIR = "/keys/directory" >> +# UBOOT_SIGN_KEYNAME = "dev" # keys name in keydir (eg. "dev.crt", "dev.key") >> +# UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000" >> +# UBOOT_SIGN_ENABLE = "1" >> +# >> +# As verified boot depends on fitImage generation, following is also required: >> +# >> +# KERNEL_CLASSES ?= " kernel-fitimage " >> +# KERNEL_IMAGETYPE ?= "fitImage" >> +# >> +# The signature support is limited to the use of CONFIG_OF_SEPARATE in U-Boot. >> +# >> +# The tasks sequence is as below, using DEPLOY_IMAGE_DIR as common place to >> +# treat the device tree blob: >> +# >> +# u-boot:do_deploy -> virtual/kernel:do_assemble_fitimage -> u-boot:do_install >> +# >> +# For more details on signature process, please refer to U-boot documentation. >> + >> +# Signature activation. >> +UBOOT_SIGN_ENABLE ?= "0" >> + >> +# Default value for deployment filenames. >> +UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb" >> +UBOOT_DTB_BINARY ?= "u-boot.dtb" >> +UBOOT_DTB_SYMLINK ?= "u-boot-${MACHINE}.dtb" >> +UBOOT_NODTB_IMAGE ?= "u-boot-nodtb-${MACHINE}-${PV}-${PR}.${UBOOT_SUFFIX}" >> +UBOOT_NODTB_BINARY ?= "u-boot-nodtb.${UBOOT_SUFFIX}" >> +UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.${UBOOT_SUFFIX}" >> + > I think you should split the file at this point and either put the lines > above into uboot-sign-base.bbclass and include it from here or put the > lines below into u-boot.inc directly. This way you don't add unnecessary > code for u-boot to kernel recipes, and lose the dependency on PN = > "u-boot" at the same time. Thanks for the proposal, that's interesting. I agree that splitting the file should remove the dependencies on '_pn-u-boot' and it also allow to keep usage of existing 'deploy' and 'install' tasks. But even in that case, we will still have a last reference to 'u-boot' recipe name, hardcoded in kernel-fitimage.bbclass: d.appendVarFlag('do_assemble_fitimage', 'depends', ' u-boot:do_deploy') ^^^^^^ For now, I don't know a way to avoid using PREFERRED_PROVIDER_u-boot variable at some point. Also, I worked on an update (keeping one class file) and in that case it now introduces specifics tasks for u-boot. (cf. patch attached). I would prefer to keep the whole thing in one single class file to avoid fragmentation, except if introducing new tasks it is not advised for any reason? Your comments are welcome. Anyway, I would be able to send a V3 series (maybe without RFC) early next week. Thank you all for Acked, Reviewed and comments! Best regards, Yannick > > Regards, > Andreas > >> +# >> +# Following is relevant only for u-boot recipes: >> +# >> + >> +do_install_prepend_pn-u-boot () { >> + # Concatenate U-Boot w/o DTB & DTB with public key >> + # (cf. kernel-fitimage.bbclass for more details) >> + cd ${DEPLOYDIR} >> + if [ "x${UBOOT_SIGN_ENABLE}" = "x1" ]; then >> + if [ -e "${UBOOT_NODTB_IMAGE}" -a -e "${UBOOT_DTB_IMAGE}" ]; then >> + cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} > ${UBOOT_IMAGE} >> + cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} > ${B}/${UBOOT_BINARY} >> + else >> + bbwarn "Failure while adding public key to u-boot binary. Verified boot won't be available." >> + fi >> + fi >> +} >> + >> +python () { >> + if d.getVar('UBOOT_SIGN_ENABLE', True) == '1' and d.getVar('PN', True) == 'u-boot': >> + kernel_pn = d.getVar('PREFERRED_PROVIDER_virtual/kernel', True) >> + d.appendVarFlag('do_install', 'depends', ' %s:do_assemble_fitimage' % kernel_pn) >> +} >> diff --git a/meta/recipes-bsp/u-boot/u-boot.inc b/meta/recipes-bsp/u-boot/u-boot.inc >> index 3ba866d..037f35c 100644 >> --- a/meta/recipes-bsp/u-boot/u-boot.inc >> +++ b/meta/recipes-bsp/u-boot/u-boot.inc >> @@ -12,7 +12,7 @@ S = "${WORKDIR}/git" >> >> PACKAGE_ARCH = "${MACHINE_ARCH}" >> >> -inherit uboot-config deploy >> +inherit uboot-config uboot-sign deploy >> >> EXTRA_OEMAKE = 'CROSS_COMPILE=${TARGET_PREFIX} CC="${TARGET_PREFIX}gcc ${TOOLCHAIN_OPTIONS}" V=1' >> EXTRA_OEMAKE += 'HOSTCC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}"' >> [-- Attachment #2: uboot-pn.patch --] [-- Type: text/x-patch, Size: 3227 bytes --] diff --git a/meta/classes/kernel-fitimage.bbclass b/meta/classes/kernel-fitimage.bbclass index dfd3306..809bd4d 100644 --- a/meta/classes/kernel-fitimage.bbclass +++ b/meta/classes/kernel-fitimage.bbclass @@ -20,7 +20,8 @@ python __anonymous () { # U-boot dtb. We ensure the U-Boot dtb is deployed before assembling # the fitImage: if d.getVar('UBOOT_SIGN_ENABLE', True): - d.appendVarFlag('do_assemble_fitimage', 'depends', ' u-boot:do_deploy') + uboot_pn = d.getVar('PREFERRED_PROVIDER_u-boot', True) or 'u-boot' + d.appendVarFlag('do_assemble_fitimage', 'depends', ' %s:do_deploy' % uboot_pn) } # Options for the device tree compiler passed to mkimage '-D' feature: diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass index adb24d4..f3d0c73 100644 --- a/meta/classes/uboot-sign.bbclass +++ b/meta/classes/uboot-sign.bbclass @@ -16,10 +16,14 @@ # # The signature support is limited to the use of CONFIG_OF_SEPARATE in U-Boot. # -# The tasks sequence is as below, using DEPLOY_IMAGE_DIR as common place to +# The tasks sequence is set as below, using DEPLOY_IMAGE_DIR as common place to # treat the device tree blob: # -# u-boot:do_deploy -> virtual/kernel:do_assemble_fitimage -> u-boot:do_install +# u-boot:do_deploy_dtb +# u-boot:do_deploy +# virtual/kernel:do_assemble_fitimage +# u-boot:do_concat_dtb +# u-boot:do_install # # For more details on signature process, please refer to U-boot documentation. @@ -38,8 +42,10 @@ UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.${UBOOT_SUFFIX}" # Following is relevant only for u-boot recipes: # -do_deploy_append_pn-u-boot () { - # OF_SEPARATE generated files deployment +do_deploy_dtb () { + mkdir -p ${DEPLOYDIR} + cd ${DEPLOYDIR} + if [ -f ${B}/${UBOOT_DTB_BINARY} ]; then install ${B}/${UBOOT_DTB_BINARY} ${DEPLOYDIR}/${UBOOT_DTB_IMAGE} rm -f ${UBOOT_DTB_BINARY} ${UBOOT_DTB_SYMLINK} @@ -54,7 +60,7 @@ do_deploy_append_pn-u-boot () { fi } -do_install_prepend_pn-u-boot () { +do_concat_dtb () { # Concatenate U-Boot w/o DTB & DTB with public key # (cf. kernel-fitimage.bbclass for more details) cd ${DEPLOYDIR} @@ -69,7 +75,16 @@ do_install_prepend_pn-u-boot () { } python () { - if d.getVar('UBOOT_SIGN_ENABLE', True) == '1' and d.getVar('PN', True) == 'u-boot': + uboot_pn = d.getVar('PREFERRED_PROVIDER_u-boot', True) or 'u-boot' + if d.getVar('UBOOT_SIGN_ENABLE', True) == '1' and d.getVar('PN', True) == uboot_pn: kernel_pn = d.getVar('PREFERRED_PROVIDER_virtual/kernel', True) - d.appendVarFlag('do_install', 'depends', ' %s:do_assemble_fitimage' % kernel_pn) + + # u-boot.dtb and u-boot-nodtb.bin are deployed _before_ do_deploy + # Thus, do_deploy_setscene will also populate them in DEPLOY_IMAGE_DIR + bb.build.addtask('do_deploy_dtb', 'do_deploy', 'do_compile', d) + + # do_concat_dtb is scheduled _before_ do_install as it overwrite the + # u-boot.bin in both DEPLOYDIR and DEPLOY_IMAGE_DIR. + bb.build.addtask('do_concat_dtb', 'do_install', None, d) + d.appendVarFlag('do_concat_dtb', 'depends', ' %s:do_assemble_fitimage' % kernel_pn) } ^ permalink raw reply related [flat|nested] 22+ messages in thread
* Re: [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot 2016-04-21 19:55 ` Yannick GICQUEL @ 2016-04-24 12:56 ` Bernhard Reutner-Fischer 0 siblings, 0 replies; 22+ messages in thread From: Bernhard Reutner-Fischer @ 2016-04-24 12:56 UTC (permalink / raw) To: yannick.gicquel, openembedded-core On April 21, 2016 9:55:21 PM GMT+02:00, Yannick GICQUEL <yannick.gicquel@iot.bzh> wrote: >>> +do_install_prepend_pn-u-boot () { >>> + # Concatenate U-Boot w/o DTB & DTB with public key >>> + # (cf. kernel-fitimage.bbclass for more details) >>> + cd ${DEPLOYDIR} >>> + if [ "x${UBOOT_SIGN_ENABLE}" = "x1" ]; then >>> + if [ -e "${UBOOT_NODTB_IMAGE}" -a -e "${UBOOT_DTB_IMAGE}" ]; then >>> + cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} > ${UBOOT_IMAGE} >>> + cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} > >${B}/${UBOOT_BINARY} + cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} | tee ${B}/${UBOOT_BINARY} > ${UBOOT_IMAGE} thanks, >>> + else >>> + bbwarn "Failure while adding public key to u-boot binary. >Verified boot won't be available." >>> + fi >>> + fi >>> +} >>> + ^ permalink raw reply [flat|nested] 22+ messages in thread
* [RFC][PATCH v2 2/4] u-boot: deploy u-boot-nodtb and dtb files 2016-04-20 13:50 [RFC][PATCH v2 0/4] U-Boot verified boot basic support Yannick Gicquel 2016-04-20 13:50 ` [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot Yannick Gicquel @ 2016-04-20 13:50 ` Yannick Gicquel 2016-04-20 15:23 ` Tom Rini ` (2 more replies) 2016-04-20 13:50 ` [RFC][PATCH v2 3/4] kernel: fitimage: support device tree compiler options Yannick Gicquel ` (2 subsequent siblings) 4 siblings, 3 replies; 22+ messages in thread From: Yannick Gicquel @ 2016-04-20 13:50 UTC (permalink / raw) To: openembedded-core This enable the deployment of u-boot-nodtb.bin and u-boot.dtb files. Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> --- meta/classes/uboot-sign.bbclass | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass index 63a5181..adb24d4 100644 --- a/meta/classes/uboot-sign.bbclass +++ b/meta/classes/uboot-sign.bbclass @@ -38,6 +38,22 @@ UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.${UBOOT_SUFFIX}" # Following is relevant only for u-boot recipes: # +do_deploy_append_pn-u-boot () { + # OF_SEPARATE generated files deployment + if [ -f ${B}/${UBOOT_DTB_BINARY} ]; then + install ${B}/${UBOOT_DTB_BINARY} ${DEPLOYDIR}/${UBOOT_DTB_IMAGE} + rm -f ${UBOOT_DTB_BINARY} ${UBOOT_DTB_SYMLINK} + ln -sf ${UBOOT_DTB_IMAGE} ${UBOOT_DTB_SYMLINK} + ln -sf ${UBOOT_DTB_IMAGE} ${UBOOT_DTB_BINARY} + fi + if [ -f ${B}/${UBOOT_NODTB_BINARY} ]; then + install ${B}/${UBOOT_NODTB_BINARY} ${DEPLOYDIR}/${UBOOT_NODTB_IMAGE} + rm -f ${UBOOT_NODTB_BINARY} ${UBOOT_NODTB_SYMLINK} + ln -sf ${UBOOT_NODTB_IMAGE} ${UBOOT_NODTB_SYMLINK} + ln -sf ${UBOOT_NODTB_IMAGE} ${UBOOT_NODTB_BINARY} + fi +} + do_install_prepend_pn-u-boot () { # Concatenate U-Boot w/o DTB & DTB with public key # (cf. kernel-fitimage.bbclass for more details) -- 1.9.1 ^ permalink raw reply related [flat|nested] 22+ messages in thread
* Re: [RFC][PATCH v2 2/4] u-boot: deploy u-boot-nodtb and dtb files 2016-04-20 13:50 ` [RFC][PATCH v2 2/4] u-boot: deploy u-boot-nodtb and dtb files Yannick Gicquel @ 2016-04-20 15:23 ` Tom Rini 2016-04-20 19:34 ` [RFC, v2, " Andreas Dannenberg 2016-04-20 19:51 ` [RFC][PATCH v2 " Denys Dmytriyenko 2 siblings, 0 replies; 22+ messages in thread From: Tom Rini @ 2016-04-20 15:23 UTC (permalink / raw) To: Yannick Gicquel; +Cc: openembedded-core On Wed, Apr 20, 2016 at 03:50:37PM +0200, Yannick Gicquel wrote: > This enable the deployment of u-boot-nodtb.bin and u-boot.dtb files. > > Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> Reviewed-by: Tom Rini <trini@konsulko.com> -- Tom ^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [RFC, v2, 2/4] u-boot: deploy u-boot-nodtb and dtb files 2016-04-20 13:50 ` [RFC][PATCH v2 2/4] u-boot: deploy u-boot-nodtb and dtb files Yannick Gicquel 2016-04-20 15:23 ` Tom Rini @ 2016-04-20 19:34 ` Andreas Dannenberg 2016-04-20 19:51 ` [RFC][PATCH v2 " Denys Dmytriyenko 2 siblings, 0 replies; 22+ messages in thread From: Andreas Dannenberg @ 2016-04-20 19:34 UTC (permalink / raw) To: Yannick Gicquel; +Cc: openembedded-core On Wed, Apr 20, 2016 at 03:50:37PM +0200, Yannick Gicquel wrote: > This enable the deployment of u-boot-nodtb.bin and u-boot.dtb files. > > Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> > Reviewed-by: Tom Rini <trini@konsulko.com> Acked-by: Andreas Dannenberg <dannenberg@ti.com> -- Andreas Dannenberg Texas Instruments Inc ^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [RFC][PATCH v2 2/4] u-boot: deploy u-boot-nodtb and dtb files 2016-04-20 13:50 ` [RFC][PATCH v2 2/4] u-boot: deploy u-boot-nodtb and dtb files Yannick Gicquel 2016-04-20 15:23 ` Tom Rini 2016-04-20 19:34 ` [RFC, v2, " Andreas Dannenberg @ 2016-04-20 19:51 ` Denys Dmytriyenko 2 siblings, 0 replies; 22+ messages in thread From: Denys Dmytriyenko @ 2016-04-20 19:51 UTC (permalink / raw) To: Yannick Gicquel; +Cc: openembedded-core On Wed, Apr 20, 2016 at 03:50:37PM +0200, Yannick Gicquel wrote: > This enable the deployment of u-boot-nodtb.bin and u-boot.dtb files. > > Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> > --- > meta/classes/uboot-sign.bbclass | 16 ++++++++++++++++ > 1 file changed, 16 insertions(+) > > diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass > index 63a5181..adb24d4 100644 > --- a/meta/classes/uboot-sign.bbclass > +++ b/meta/classes/uboot-sign.bbclass > @@ -38,6 +38,22 @@ UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.${UBOOT_SUFFIX}" > # Following is relevant only for u-boot recipes: > # > > +do_deploy_append_pn-u-boot () { Same question here about _pn-u-boot. > + # OF_SEPARATE generated files deployment > + if [ -f ${B}/${UBOOT_DTB_BINARY} ]; then > + install ${B}/${UBOOT_DTB_BINARY} ${DEPLOYDIR}/${UBOOT_DTB_IMAGE} > + rm -f ${UBOOT_DTB_BINARY} ${UBOOT_DTB_SYMLINK} > + ln -sf ${UBOOT_DTB_IMAGE} ${UBOOT_DTB_SYMLINK} > + ln -sf ${UBOOT_DTB_IMAGE} ${UBOOT_DTB_BINARY} > + fi > + if [ -f ${B}/${UBOOT_NODTB_BINARY} ]; then > + install ${B}/${UBOOT_NODTB_BINARY} ${DEPLOYDIR}/${UBOOT_NODTB_IMAGE} > + rm -f ${UBOOT_NODTB_BINARY} ${UBOOT_NODTB_SYMLINK} > + ln -sf ${UBOOT_NODTB_IMAGE} ${UBOOT_NODTB_SYMLINK} > + ln -sf ${UBOOT_NODTB_IMAGE} ${UBOOT_NODTB_BINARY} > + fi > +} > + > do_install_prepend_pn-u-boot () { > # Concatenate U-Boot w/o DTB & DTB with public key > # (cf. kernel-fitimage.bbclass for more details) > -- > 1.9.1 > > -- > _______________________________________________ > Openembedded-core mailing list > Openembedded-core@lists.openembedded.org > http://lists.openembedded.org/mailman/listinfo/openembedded-core ^ permalink raw reply [flat|nested] 22+ messages in thread
* [RFC][PATCH v2 3/4] kernel: fitimage: support device tree compiler options 2016-04-20 13:50 [RFC][PATCH v2 0/4] U-Boot verified boot basic support Yannick Gicquel 2016-04-20 13:50 ` [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot Yannick Gicquel 2016-04-20 13:50 ` [RFC][PATCH v2 2/4] u-boot: deploy u-boot-nodtb and dtb files Yannick Gicquel @ 2016-04-20 13:50 ` Yannick Gicquel 2016-04-20 15:23 ` Tom Rini 2016-04-20 19:34 ` [RFC, v2, " Andreas Dannenberg 2016-04-20 13:50 ` [RFC][PATCH v2 4/4] kernel: fitimage: basic support for fitimage signature Yannick Gicquel 2016-04-20 15:23 ` [RFC][PATCH v2 0/4] U-Boot verified boot basic support Tom Rini 4 siblings, 2 replies; 22+ messages in thread From: Yannick Gicquel @ 2016-04-20 13:50 UTC (permalink / raw) To: openembedded-core This introduces a new variable to set the device tree compiler options while calling mkimage ('-D' option). By default, this variable is not set but it can be defined in a configuration file, as following example: UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000" Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> --- meta/classes/kernel-fitimage.bbclass | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/meta/classes/kernel-fitimage.bbclass b/meta/classes/kernel-fitimage.bbclass index e5b75ed..62e0017 100644 --- a/meta/classes/kernel-fitimage.bbclass +++ b/meta/classes/kernel-fitimage.bbclass @@ -17,6 +17,9 @@ python __anonymous () { d.appendVarFlag('do_assemble_fitimage', 'depends', ' ${INITRAMFS_IMAGE}:do_image_complete') } +# Options for the device tree compiler passed to mkimage '-D' feature: +UBOOT_MKIMAGE_DTCOPTS ??= "" + # # Emit the fitImage ITS header # @@ -209,7 +212,10 @@ do_assemble_fitimage() { # # Step 4: Assemble the image # - uboot-mkimage -f fit-image.its arch/${ARCH}/boot/fitImage + uboot-mkimage \ + ${@'-D "${UBOOT_MKIMAGE_DTCOPTS}"' if len('${UBOOT_MKIMAGE_DTCOPTS}') else ''} \ + -f fit-image.its \ + arch/${ARCH}/boot/fitImage fi } -- 1.9.1 ^ permalink raw reply related [flat|nested] 22+ messages in thread
* Re: [RFC][PATCH v2 3/4] kernel: fitimage: support device tree compiler options 2016-04-20 13:50 ` [RFC][PATCH v2 3/4] kernel: fitimage: support device tree compiler options Yannick Gicquel @ 2016-04-20 15:23 ` Tom Rini 2016-04-20 19:34 ` [RFC, v2, " Andreas Dannenberg 1 sibling, 0 replies; 22+ messages in thread From: Tom Rini @ 2016-04-20 15:23 UTC (permalink / raw) To: Yannick Gicquel; +Cc: openembedded-core On Wed, Apr 20, 2016 at 03:50:38PM +0200, Yannick Gicquel wrote: > This introduces a new variable to set the device tree compiler options while > calling mkimage ('-D' option). By default, this variable is not set but it can > be defined in a configuration file, as following example: > > UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000" > > Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> Reviewed-by: Tom Rini <trini@konsulko.com> -- Tom ^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [RFC, v2, 3/4] kernel: fitimage: support device tree compiler options 2016-04-20 13:50 ` [RFC][PATCH v2 3/4] kernel: fitimage: support device tree compiler options Yannick Gicquel 2016-04-20 15:23 ` Tom Rini @ 2016-04-20 19:34 ` Andreas Dannenberg 1 sibling, 0 replies; 22+ messages in thread From: Andreas Dannenberg @ 2016-04-20 19:34 UTC (permalink / raw) To: Yannick Gicquel; +Cc: openembedded-core On Wed, Apr 20, 2016 at 03:50:38PM +0200, Yannick Gicquel wrote: > This introduces a new variable to set the device tree compiler options while > calling mkimage ('-D' option). By default, this variable is not set but it can > be defined in a configuration file, as following example: > > UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000" > > Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> > Reviewed-by: Tom Rini <trini@konsulko.com> Acked-by: Andreas Dannenberg <dannenberg@ti.com> -- Andreas Dannenberg Texas Instruments Inc ^ permalink raw reply [flat|nested] 22+ messages in thread
* [RFC][PATCH v2 4/4] kernel: fitimage: basic support for fitimage signature 2016-04-20 13:50 [RFC][PATCH v2 0/4] U-Boot verified boot basic support Yannick Gicquel ` (2 preceding siblings ...) 2016-04-20 13:50 ` [RFC][PATCH v2 3/4] kernel: fitimage: support device tree compiler options Yannick Gicquel @ 2016-04-20 13:50 ` Yannick Gicquel 2016-04-20 15:23 ` Tom Rini 2016-04-20 19:35 ` [RFC, v2, " Andreas Dannenberg 2016-04-20 15:23 ` [RFC][PATCH v2 0/4] U-Boot verified boot basic support Tom Rini 4 siblings, 2 replies; 22+ messages in thread From: Yannick Gicquel @ 2016-04-20 13:50 UTC (permalink / raw) To: openembedded-core This is an initial support of fitImage signature to enable U-Boot verified boot. This feature is implemented by adding a signature tag to the configuration section of the generated fit-image.its file. When a UBOOT_SIGN_ENABLE variable is set to "1", the signature procedure is activated and performs a second call to mkimage to sign the fitImage file and to include the public key in the deployed U-Boot device tree blob. (This implementation depends on the use of CONFIG_OF_SEPARATE in U-Boot.) As the U-Boot device tree blob is appended in the deploy dir, a dependency on 'u-boot:do_deploy' is added when the feature is activated. Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> --- meta/classes/kernel-fitimage.bbclass | 44 ++++++++++++++++++++++++++++++++++-- 1 file changed, 42 insertions(+), 2 deletions(-) diff --git a/meta/classes/kernel-fitimage.bbclass b/meta/classes/kernel-fitimage.bbclass index 62e0017..dfd3306 100644 --- a/meta/classes/kernel-fitimage.bbclass +++ b/meta/classes/kernel-fitimage.bbclass @@ -1,4 +1,4 @@ -inherit kernel-uboot +inherit kernel-uboot uboot-sign python __anonymous () { kerneltype = d.getVar('KERNEL_IMAGETYPE', True) @@ -15,6 +15,12 @@ python __anonymous () { image = d.getVar('INITRAMFS_IMAGE', True) if image: d.appendVarFlag('do_assemble_fitimage', 'depends', ' ${INITRAMFS_IMAGE}:do_image_complete') + + # Verified boot will sign the fitImage and append the public key to + # U-boot dtb. We ensure the U-Boot dtb is deployed before assembling + # the fitImage: + if d.getVar('UBOOT_SIGN_ENABLE', True): + d.appendVarFlag('do_assemble_fitimage', 'depends', ' u-boot:do_deploy') } # Options for the device tree compiler passed to mkimage '-D' feature: @@ -132,6 +138,9 @@ EOF fitimage_emit_section_config() { conf_csum="sha1" + if [ -n "${UBOOT_SIGN_ENABLE}" ] ; then + conf_sign_keyname="${UBOOT_SIGN_KEYNAME}" + fi # Test if we have any DTBs at all if [ -z "${2}" ] ; then @@ -152,6 +161,26 @@ fitimage_emit_section_config() { hash@1 { algo = "${conf_csum}"; }; +EOF + + if [ ! -z "${conf_sign_keyname}" ] ; then + + if [ -z "${2}" ] ; then + sign_line="sign-images = \"kernel\";" + else + sign_line="sign-images = \"fdt\", \"kernel\";" + fi + + cat << EOF >> fit-image.its + signature@1 { + algo = "${conf_csum},rsa2048"; + key-name-hint = "${conf_sign_keyname}"; + sign-images = "fdt", "kernel"; + }; +EOF + fi + + cat << EOF >> fit-image.its }; EOF } @@ -160,7 +189,7 @@ do_assemble_fitimage() { if test "x${KERNEL_IMAGETYPE}" = "xfitImage" ; then kernelcount=1 dtbcount="" - rm -f fit-image.its + rm -f fit-image.its arch/${ARCH}/boot/fitImage fitimage_emit_fit_header @@ -216,6 +245,17 @@ do_assemble_fitimage() { ${@'-D "${UBOOT_MKIMAGE_DTCOPTS}"' if len('${UBOOT_MKIMAGE_DTCOPTS}') else ''} \ -f fit-image.its \ arch/${ARCH}/boot/fitImage + + # + # Step 5: Sign the image and add public key to U-Boot dtb + # + if test -n "${UBOOT_SIGN_ENABLE}"; then + uboot-mkimage \ + ${@'-D "${UBOOT_MKIMAGE_DTCOPTS}"' if len('${UBOOT_MKIMAGE_DTCOPTS}') else ''} \ + -F -k "${UBOOT_SIGN_KEYDIR}" \ + -K "${DEPLOY_DIR_IMAGE}/${UBOOT_DTB_BINARY}" \ + -r arch/${ARCH}/boot/fitImage + fi fi } -- 1.9.1 ^ permalink raw reply related [flat|nested] 22+ messages in thread
* Re: [RFC][PATCH v2 4/4] kernel: fitimage: basic support for fitimage signature 2016-04-20 13:50 ` [RFC][PATCH v2 4/4] kernel: fitimage: basic support for fitimage signature Yannick Gicquel @ 2016-04-20 15:23 ` Tom Rini 2016-04-20 19:35 ` [RFC, v2, " Andreas Dannenberg 1 sibling, 0 replies; 22+ messages in thread From: Tom Rini @ 2016-04-20 15:23 UTC (permalink / raw) To: Yannick Gicquel; +Cc: openembedded-core On Wed, Apr 20, 2016 at 03:50:39PM +0200, Yannick Gicquel wrote: > This is an initial support of fitImage signature to enable U-Boot verified > boot. This feature is implemented by adding a signature tag to the > configuration section of the generated fit-image.its file. > > When a UBOOT_SIGN_ENABLE variable is set to "1", the signature procedure is > activated and performs a second call to mkimage to sign the fitImage file and > to include the public key in the deployed U-Boot device tree blob. (This > implementation depends on the use of CONFIG_OF_SEPARATE in U-Boot.) > > As the U-Boot device tree blob is appended in the deploy dir, a dependency > on 'u-boot:do_deploy' is added when the feature is activated. > > Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> Reviewed-by: Tom Rini <trini@konsulko.com> -- Tom ^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [RFC, v2, 4/4] kernel: fitimage: basic support for fitimage signature 2016-04-20 13:50 ` [RFC][PATCH v2 4/4] kernel: fitimage: basic support for fitimage signature Yannick Gicquel 2016-04-20 15:23 ` Tom Rini @ 2016-04-20 19:35 ` Andreas Dannenberg 1 sibling, 0 replies; 22+ messages in thread From: Andreas Dannenberg @ 2016-04-20 19:35 UTC (permalink / raw) To: Yannick Gicquel; +Cc: openembedded-core On Wed, Apr 20, 2016 at 03:50:39PM +0200, Yannick Gicquel wrote: > This is an initial support of fitImage signature to enable U-Boot verified > boot. This feature is implemented by adding a signature tag to the > configuration section of the generated fit-image.its file. > > When a UBOOT_SIGN_ENABLE variable is set to "1", the signature procedure is > activated and performs a second call to mkimage to sign the fitImage file and > to include the public key in the deployed U-Boot device tree blob. (This > implementation depends on the use of CONFIG_OF_SEPARATE in U-Boot.) > > As the U-Boot device tree blob is appended in the deploy dir, a dependency > on 'u-boot:do_deploy' is added when the feature is activated. > > Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh> > Reviewed-by: Tom Rini <trini@konsulko.com> Acked-by: Andreas Dannenberg <dannenberg@ti.com> -- Andreas Dannenberg Texas Instruments Inc ^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [RFC][PATCH v2 0/4] U-Boot verified boot basic support 2016-04-20 13:50 [RFC][PATCH v2 0/4] U-Boot verified boot basic support Yannick Gicquel ` (3 preceding siblings ...) 2016-04-20 13:50 ` [RFC][PATCH v2 4/4] kernel: fitimage: basic support for fitimage signature Yannick Gicquel @ 2016-04-20 15:23 ` Tom Rini 2016-04-20 19:43 ` Denys Dmytriyenko 4 siblings, 1 reply; 22+ messages in thread From: Tom Rini @ 2016-04-20 15:23 UTC (permalink / raw) To: Yannick Gicquel; +Cc: openembedded-core On Wed, Apr 20, 2016 at 03:50:35PM +0200, Yannick Gicquel wrote: > Changes since v1: > * Uses a class uboot-sign.bbclass file instead of include file. > * 'assemble_dtb' task removed and replace by do_install_prepend function > for u-boot recipe. > > Yannick Gicquel (4): > u-boot: basic support of dtb append for verified boot > u-boot: deploy u-boot-nodtb and dtb files > kernel: fitimage: support device tree compiler options > kernel: fitimage: basic support for fitimage signature > > meta/classes/kernel-fitimage.bbclass | 52 +++++++++++++++++++++++-- > meta/classes/uboot-sign.bbclass | 75 ++++++++++++++++++++++++++++++++++++ > meta/recipes-bsp/u-boot/u-boot.inc | 2 +- > 3 files changed, 125 insertions(+), 4 deletions(-) > create mode 100644 meta/classes/uboot-sign.bbclass Thanks for doing this. It will hopefully make this knowledge more wide spread and thus more widely used. -- Tom ^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [RFC][PATCH v2 0/4] U-Boot verified boot basic support 2016-04-20 15:23 ` [RFC][PATCH v2 0/4] U-Boot verified boot basic support Tom Rini @ 2016-04-20 19:43 ` Denys Dmytriyenko 0 siblings, 0 replies; 22+ messages in thread From: Denys Dmytriyenko @ 2016-04-20 19:43 UTC (permalink / raw) To: Tom Rini; +Cc: openembedded-core On Wed, Apr 20, 2016 at 11:23:18AM -0400, Tom Rini wrote: > On Wed, Apr 20, 2016 at 03:50:35PM +0200, Yannick Gicquel wrote: > > > Changes since v1: > > * Uses a class uboot-sign.bbclass file instead of include file. > > * 'assemble_dtb' task removed and replace by do_install_prepend function > > for u-boot recipe. > > > > Yannick Gicquel (4): > > u-boot: basic support of dtb append for verified boot > > u-boot: deploy u-boot-nodtb and dtb files > > kernel: fitimage: support device tree compiler options > > kernel: fitimage: basic support for fitimage signature > > > > meta/classes/kernel-fitimage.bbclass | 52 +++++++++++++++++++++++-- > > meta/classes/uboot-sign.bbclass | 75 ++++++++++++++++++++++++++++++++++++ > > meta/recipes-bsp/u-boot/u-boot.inc | 2 +- > > 3 files changed, 125 insertions(+), 4 deletions(-) > > create mode 100644 meta/classes/uboot-sign.bbclass > > Thanks for doing this. It will hopefully make this knowledge more wide > spread and thus more widely used. This is very timely for us as well and it is nice to use the standard and open implementation. For the entire series: Acked-by: Denys Dmytriyenko <denys@ti.com> -- Denys ^ permalink raw reply [flat|nested] 22+ messages in thread
end of thread, other threads:[~2016-04-24 12:56 UTC | newest] Thread overview: 22+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2016-04-20 13:50 [RFC][PATCH v2 0/4] U-Boot verified boot basic support Yannick Gicquel 2016-04-20 13:50 ` [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot Yannick Gicquel 2016-04-20 15:23 ` Tom Rini 2016-04-20 19:33 ` [RFC, v2, " Andreas Dannenberg 2016-04-20 19:49 ` [RFC][PATCH v2 " Denys Dmytriyenko 2016-04-20 21:03 ` Tom Rini 2016-04-21 10:25 ` Yannick GICQUEL 2016-04-21 14:06 ` Andreas Oberritter 2016-04-21 19:55 ` Yannick GICQUEL 2016-04-24 12:56 ` Bernhard Reutner-Fischer 2016-04-20 13:50 ` [RFC][PATCH v2 2/4] u-boot: deploy u-boot-nodtb and dtb files Yannick Gicquel 2016-04-20 15:23 ` Tom Rini 2016-04-20 19:34 ` [RFC, v2, " Andreas Dannenberg 2016-04-20 19:51 ` [RFC][PATCH v2 " Denys Dmytriyenko 2016-04-20 13:50 ` [RFC][PATCH v2 3/4] kernel: fitimage: support device tree compiler options Yannick Gicquel 2016-04-20 15:23 ` Tom Rini 2016-04-20 19:34 ` [RFC, v2, " Andreas Dannenberg 2016-04-20 13:50 ` [RFC][PATCH v2 4/4] kernel: fitimage: basic support for fitimage signature Yannick Gicquel 2016-04-20 15:23 ` Tom Rini 2016-04-20 19:35 ` [RFC, v2, " Andreas Dannenberg 2016-04-20 15:23 ` [RFC][PATCH v2 0/4] U-Boot verified boot basic support Tom Rini 2016-04-20 19:43 ` Denys Dmytriyenko
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.