[RFC][PATCH v2 0/4] U-Boot verified boot basic support

[RFC][PATCH v2 0/4] U-Boot verified boot basic support

[Yannick Gicquel]

Changes since v1:
  * Uses a class uboot-sign.bbclass file instead of include file.
  * 'assemble_dtb' task removed and replace by do_install_prepend function
    for u-boot recipe.

Yannick Gicquel (4):
  u-boot: basic support of dtb append for verified boot
  u-boot: deploy u-boot-nodtb and dtb files
  kernel: fitimage: support device tree compiler options
  kernel: fitimage: basic support for fitimage signature

 meta/classes/kernel-fitimage.bbclass | 52 +++++++++++++++++++++++--
 meta/classes/uboot-sign.bbclass      | 75 ++++++++++++++++++++++++++++++++++++
 meta/recipes-bsp/u-boot/u-boot.inc   |  2 +-
 3 files changed, 125 insertions(+), 4 deletions(-)
 create mode 100644 meta/classes/uboot-sign.bbclass

-- 
1.9.1

[RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot

[Yannick Gicquel]

This introduces a new uboot-sign.class to support U-Boot verified boot.

This part delivers the new class file, with related environment variables, and
a basic prepend to do_install task which performs the concatenation of the
u-boot-nodtb.bin and the device tree blob. The 'cat' command used
overrides the u-boot.bin in both DEPLOYDIR & build dir to propagate the
changes in later tasks (do_install, do_package, etc.)

Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh>
---
 meta/classes/uboot-sign.bbclass    | 59 ++++++++++++++++++++++++++++++++++++++
 meta/recipes-bsp/u-boot/u-boot.inc |  2 +-
 2 files changed, 60 insertions(+), 1 deletion(-)
 create mode 100644 meta/classes/uboot-sign.bbclass

diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass
new file mode 100644
index 0000000..63a5181
--- /dev/null
+++ b/meta/classes/uboot-sign.bbclass
@@ -0,0 +1,59 @@
+# This file is part of U-Boot verified boot support and is intended to be
+# inherited from u-boot recipe and from kernel-fitimage.bbclass.
+#
+# The signature procedure requires the user to generate an RSA key and
+# certificate in a directory and to define the following variable:
+#
+#   UBOOT_SIGN_KEYDIR = "/keys/directory"
+#   UBOOT_SIGN_KEYNAME = "dev" # keys name in keydir (eg. "dev.crt", "dev.key")
+#   UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000"
+#   UBOOT_SIGN_ENABLE = "1"
+#
+# As verified boot depends on fitImage generation, following is also required:
+#
+#   KERNEL_CLASSES ?= " kernel-fitimage "
+#   KERNEL_IMAGETYPE ?= "fitImage"
+#
+# The signature support is limited to the use of CONFIG_OF_SEPARATE in U-Boot.
+#
+# The tasks sequence is as below, using DEPLOY_IMAGE_DIR as common place to
+# treat the device tree blob:
+#
+# u-boot:do_deploy -> virtual/kernel:do_assemble_fitimage -> u-boot:do_install
+#
+# For more details on signature process, please refer to U-boot documentation.
+
+# Signature activation.
+UBOOT_SIGN_ENABLE ?= "0"
+
+# Default value for deployment filenames.
+UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb"
+UBOOT_DTB_BINARY ?= "u-boot.dtb"
+UBOOT_DTB_SYMLINK ?= "u-boot-${MACHINE}.dtb"
+UBOOT_NODTB_IMAGE ?= "u-boot-nodtb-${MACHINE}-${PV}-${PR}.${UBOOT_SUFFIX}"
+UBOOT_NODTB_BINARY ?= "u-boot-nodtb.${UBOOT_SUFFIX}"
+UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.${UBOOT_SUFFIX}"
+
+#
+# Following is relevant only for u-boot recipes:
+#
+
+do_install_prepend_pn-u-boot () {
+	# Concatenate U-Boot w/o DTB & DTB with public key
+	# (cf. kernel-fitimage.bbclass for more details)
+	cd ${DEPLOYDIR}
+	if [ "x${UBOOT_SIGN_ENABLE}" = "x1" ]; then
+		if [ -e "${UBOOT_NODTB_IMAGE}" -a -e "${UBOOT_DTB_IMAGE}" ]; then
+			cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} > ${UBOOT_IMAGE}
+			cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} > ${B}/${UBOOT_BINARY}
+		else
+			bbwarn "Failure while adding public key to u-boot binary. Verified boot won't be available."
+		fi
+	fi
+}
+
+python () {
+	if d.getVar('UBOOT_SIGN_ENABLE', True) == '1' and d.getVar('PN', True) == 'u-boot':
+		kernel_pn = d.getVar('PREFERRED_PROVIDER_virtual/kernel', True)
+		d.appendVarFlag('do_install', 'depends', ' %s:do_assemble_fitimage' % kernel_pn)
+}
diff --git a/meta/recipes-bsp/u-boot/u-boot.inc b/meta/recipes-bsp/u-boot/u-boot.inc
index 3ba866d..037f35c 100644
--- a/meta/recipes-bsp/u-boot/u-boot.inc
+++ b/meta/recipes-bsp/u-boot/u-boot.inc
@@ -12,7 +12,7 @@ S = "${WORKDIR}/git"
 
 PACKAGE_ARCH = "${MACHINE_ARCH}"
 
-inherit uboot-config deploy
+inherit uboot-config uboot-sign deploy
 
 EXTRA_OEMAKE = 'CROSS_COMPILE=${TARGET_PREFIX} CC="${TARGET_PREFIX}gcc ${TOOLCHAIN_OPTIONS}" V=1'
 EXTRA_OEMAKE += 'HOSTCC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}"'
-- 
1.9.1

Re: [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot

[Tom Rini]

On Wed, Apr 20, 2016 at 03:50:36PM +0200, Yannick Gicquel wrote:

> This introduces a new uboot-sign.class to support U-Boot verified boot.
> 
> This part delivers the new class file, with related environment variables, and
> a basic prepend to do_install task which performs the concatenation of the
> u-boot-nodtb.bin and the device tree blob. The 'cat' command used
> overrides the u-boot.bin in both DEPLOYDIR & build dir to propagate the
> changes in later tasks (do_install, do_package, etc.)
> 
> Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh>

Reviewed-by: Tom Rini <trini@konsulko.com>

-- 
Tom

Re: [RFC, v2, 1/4] u-boot: basic support of dtb append for verified boot

[Andreas Dannenberg]

On Wed, Apr 20, 2016 at 03:50:36PM +0200, Yannick Gicquel wrote:
> This introduces a new uboot-sign.class to support U-Boot verified boot.
> 
> This part delivers the new class file, with related environment variables, and
> a basic prepend to do_install task which performs the concatenation of the
> u-boot-nodtb.bin and the device tree blob. The 'cat' command used
> overrides the u-boot.bin in both DEPLOYDIR & build dir to propagate the
> changes in later tasks (do_install, do_package, etc.)
> 
> Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh>
> Reviewed-by: Tom Rini <trini@konsulko.com>

Acked-by: Andreas Dannenberg <dannenberg@ti.com>


Thanks for the submission! Agreed with Tom, this will hopefully make the
FIT-based authentication scheme easier and more accessible.


--
Andreas Dannenberg
Texas Instruments Inc

Re: [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot

[Denys Dmytriyenko]

On Wed, Apr 20, 2016 at 03:50:36PM +0200, Yannick Gicquel wrote:
> This introduces a new uboot-sign.class to support U-Boot verified boot.
> 
> This part delivers the new class file, with related environment variables, and
> a basic prepend to do_install task which performs the concatenation of the
> u-boot-nodtb.bin and the device tree blob. The 'cat' command used
> overrides the u-boot.bin in both DEPLOYDIR & build dir to propagate the
> changes in later tasks (do_install, do_package, etc.)
> 
> Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh>
> ---
>  meta/classes/uboot-sign.bbclass    | 59 ++++++++++++++++++++++++++++++++++++++
>  meta/recipes-bsp/u-boot/u-boot.inc |  2 +-
>  2 files changed, 60 insertions(+), 1 deletion(-)
>  create mode 100644 meta/classes/uboot-sign.bbclass
> 
> diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass
> new file mode 100644
> index 0000000..63a5181
> --- /dev/null
> +++ b/meta/classes/uboot-sign.bbclass
> @@ -0,0 +1,59 @@
> +# This file is part of U-Boot verified boot support and is intended to be
> +# inherited from u-boot recipe and from kernel-fitimage.bbclass.
> +#
> +# The signature procedure requires the user to generate an RSA key and
> +# certificate in a directory and to define the following variable:
> +#
> +#   UBOOT_SIGN_KEYDIR = "/keys/directory"
> +#   UBOOT_SIGN_KEYNAME = "dev" # keys name in keydir (eg. "dev.crt", "dev.key")
> +#   UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000"
> +#   UBOOT_SIGN_ENABLE = "1"
> +#
> +# As verified boot depends on fitImage generation, following is also required:
> +#
> +#   KERNEL_CLASSES ?= " kernel-fitimage "
> +#   KERNEL_IMAGETYPE ?= "fitImage"
> +#
> +# The signature support is limited to the use of CONFIG_OF_SEPARATE in U-Boot.
> +#
> +# The tasks sequence is as below, using DEPLOY_IMAGE_DIR as common place to
> +# treat the device tree blob:
> +#
> +# u-boot:do_deploy -> virtual/kernel:do_assemble_fitimage -> u-boot:do_install
> +#
> +# For more details on signature process, please refer to U-boot documentation.
> +
> +# Signature activation.
> +UBOOT_SIGN_ENABLE ?= "0"
> +
> +# Default value for deployment filenames.
> +UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb"
> +UBOOT_DTB_BINARY ?= "u-boot.dtb"
> +UBOOT_DTB_SYMLINK ?= "u-boot-${MACHINE}.dtb"
> +UBOOT_NODTB_IMAGE ?= "u-boot-nodtb-${MACHINE}-${PV}-${PR}.${UBOOT_SUFFIX}"
> +UBOOT_NODTB_BINARY ?= "u-boot-nodtb.${UBOOT_SUFFIX}"
> +UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.${UBOOT_SUFFIX}"
> +
> +#
> +# Following is relevant only for u-boot recipes:
> +#
> +
> +do_install_prepend_pn-u-boot () {

Why _pn-u-boot here? What if I have my own version of u-boot recipe?


> +	# Concatenate U-Boot w/o DTB & DTB with public key
> +	# (cf. kernel-fitimage.bbclass for more details)
> +	cd ${DEPLOYDIR}
> +	if [ "x${UBOOT_SIGN_ENABLE}" = "x1" ]; then
> +		if [ -e "${UBOOT_NODTB_IMAGE}" -a -e "${UBOOT_DTB_IMAGE}" ]; then
> +			cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} > ${UBOOT_IMAGE}
> +			cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} > ${B}/${UBOOT_BINARY}
> +		else
> +			bbwarn "Failure while adding public key to u-boot binary. Verified boot won't be available."
> +		fi
> +	fi
> +}
> +
> +python () {
> +	if d.getVar('UBOOT_SIGN_ENABLE', True) == '1' and d.getVar('PN', True) == 'u-boot':
> +		kernel_pn = d.getVar('PREFERRED_PROVIDER_virtual/kernel', True)
> +		d.appendVarFlag('do_install', 'depends', ' %s:do_assemble_fitimage' % kernel_pn)
> +}
> diff --git a/meta/recipes-bsp/u-boot/u-boot.inc b/meta/recipes-bsp/u-boot/u-boot.inc
> index 3ba866d..037f35c 100644
> --- a/meta/recipes-bsp/u-boot/u-boot.inc
> +++ b/meta/recipes-bsp/u-boot/u-boot.inc
> @@ -12,7 +12,7 @@ S = "${WORKDIR}/git"
>  
>  PACKAGE_ARCH = "${MACHINE_ARCH}"
>  
> -inherit uboot-config deploy
> +inherit uboot-config uboot-sign deploy
>  
>  EXTRA_OEMAKE = 'CROSS_COMPILE=${TARGET_PREFIX} CC="${TARGET_PREFIX}gcc ${TOOLCHAIN_OPTIONS}" V=1'
>  EXTRA_OEMAKE += 'HOSTCC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}"'
> -- 
> 1.9.1
> 
> -- 
> _______________________________________________
> Openembedded-core mailing list
> Openembedded-core@lists.openembedded.org
> http://lists.openembedded.org/mailman/listinfo/openembedded-core

Re: [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 3074 bytes --]

On Wed, Apr 20, 2016 at 03:49:58PM -0400, Denys Dmytriyenko wrote:
> On Wed, Apr 20, 2016 at 03:50:36PM +0200, Yannick Gicquel wrote:
> > This introduces a new uboot-sign.class to support U-Boot verified boot.
> > 
> > This part delivers the new class file, with related environment variables, and
> > a basic prepend to do_install task which performs the concatenation of the
> > u-boot-nodtb.bin and the device tree blob. The 'cat' command used
> > overrides the u-boot.bin in both DEPLOYDIR & build dir to propagate the
> > changes in later tasks (do_install, do_package, etc.)
> > 
> > Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh>
> > ---
> >  meta/classes/uboot-sign.bbclass    | 59 ++++++++++++++++++++++++++++++++++++++
> >  meta/recipes-bsp/u-boot/u-boot.inc |  2 +-
> >  2 files changed, 60 insertions(+), 1 deletion(-)
> >  create mode 100644 meta/classes/uboot-sign.bbclass
> > 
> > diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass
> > new file mode 100644
> > index 0000000..63a5181
> > --- /dev/null
> > +++ b/meta/classes/uboot-sign.bbclass
> > @@ -0,0 +1,59 @@
> > +# This file is part of U-Boot verified boot support and is intended to be
> > +# inherited from u-boot recipe and from kernel-fitimage.bbclass.
> > +#
> > +# The signature procedure requires the user to generate an RSA key and
> > +# certificate in a directory and to define the following variable:
> > +#
> > +#   UBOOT_SIGN_KEYDIR = "/keys/directory"
> > +#   UBOOT_SIGN_KEYNAME = "dev" # keys name in keydir (eg. "dev.crt", "dev.key")
> > +#   UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000"
> > +#   UBOOT_SIGN_ENABLE = "1"
> > +#
> > +# As verified boot depends on fitImage generation, following is also required:
> > +#
> > +#   KERNEL_CLASSES ?= " kernel-fitimage "
> > +#   KERNEL_IMAGETYPE ?= "fitImage"
> > +#
> > +# The signature support is limited to the use of CONFIG_OF_SEPARATE in U-Boot.
> > +#
> > +# The tasks sequence is as below, using DEPLOY_IMAGE_DIR as common place to
> > +# treat the device tree blob:
> > +#
> > +# u-boot:do_deploy -> virtual/kernel:do_assemble_fitimage -> u-boot:do_install
> > +#
> > +# For more details on signature process, please refer to U-boot documentation.
> > +
> > +# Signature activation.
> > +UBOOT_SIGN_ENABLE ?= "0"
> > +
> > +# Default value for deployment filenames.
> > +UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb"
> > +UBOOT_DTB_BINARY ?= "u-boot.dtb"
> > +UBOOT_DTB_SYMLINK ?= "u-boot-${MACHINE}.dtb"
> > +UBOOT_NODTB_IMAGE ?= "u-boot-nodtb-${MACHINE}-${PV}-${PR}.${UBOOT_SUFFIX}"
> > +UBOOT_NODTB_BINARY ?= "u-boot-nodtb.${UBOOT_SUFFIX}"
> > +UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.${UBOOT_SUFFIX}"
> > +
> > +#
> > +# Following is relevant only for u-boot recipes:
> > +#
> > +
> > +do_install_prepend_pn-u-boot () {
> 
> Why _pn-u-boot here? What if I have my own version of u-boot recipe?

Oh good point, maybe this should be class-target instead of pn-u-boot
(here and elsewhere) ?

-- 
Tom

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

Re: [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot

[Yannick GICQUEL]

Le 20/04/2016 23:03, Tom Rini a écrit :
> On Wed, Apr 20, 2016 at 03:49:58PM -0400, Denys Dmytriyenko wrote:
>> On Wed, Apr 20, 2016 at 03:50:36PM +0200, Yannick Gicquel wrote:
>>> This introduces a new uboot-sign.class to support U-Boot verified boot.
>>>
>>> This part delivers the new class file, with related environment variables, and
>>> a basic prepend to do_install task which performs the concatenation of the
>>> u-boot-nodtb.bin and the device tree blob. The 'cat' command used
>>> overrides the u-boot.bin in both DEPLOYDIR & build dir to propagate the
>>> changes in later tasks (do_install, do_package, etc.)
>>>
>>> Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh>
>>> ---
>>>   meta/classes/uboot-sign.bbclass    | 59 ++++++++++++++++++++++++++++++++++++++
>>>   meta/recipes-bsp/u-boot/u-boot.inc |  2 +-
>>>   2 files changed, 60 insertions(+), 1 deletion(-)
>>>   create mode 100644 meta/classes/uboot-sign.bbclass
>>>
>>> diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass
>>> new file mode 100644
>>> index 0000000..63a5181
>>> --- /dev/null
>>> +++ b/meta/classes/uboot-sign.bbclass
>>> @@ -0,0 +1,59 @@
>>> +# This file is part of U-Boot verified boot support and is intended to be
>>> +# inherited from u-boot recipe and from kernel-fitimage.bbclass.
>>> +#
>>> +# The signature procedure requires the user to generate an RSA key and
>>> +# certificate in a directory and to define the following variable:
>>> +#
>>> +#   UBOOT_SIGN_KEYDIR = "/keys/directory"
>>> +#   UBOOT_SIGN_KEYNAME = "dev" # keys name in keydir (eg. "dev.crt", "dev.key")
>>> +#   UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000"
>>> +#   UBOOT_SIGN_ENABLE = "1"
>>> +#
>>> +# As verified boot depends on fitImage generation, following is also required:
>>> +#
>>> +#   KERNEL_CLASSES ?= " kernel-fitimage "
>>> +#   KERNEL_IMAGETYPE ?= "fitImage"
>>> +#
>>> +# The signature support is limited to the use of CONFIG_OF_SEPARATE in U-Boot.
>>> +#
>>> +# The tasks sequence is as below, using DEPLOY_IMAGE_DIR as common place to
>>> +# treat the device tree blob:
>>> +#
>>> +# u-boot:do_deploy -> virtual/kernel:do_assemble_fitimage -> u-boot:do_install
>>> +#
>>> +# For more details on signature process, please refer to U-boot documentation.
>>> +
>>> +# Signature activation.
>>> +UBOOT_SIGN_ENABLE ?= "0"
>>> +
>>> +# Default value for deployment filenames.
>>> +UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb"
>>> +UBOOT_DTB_BINARY ?= "u-boot.dtb"
>>> +UBOOT_DTB_SYMLINK ?= "u-boot-${MACHINE}.dtb"
>>> +UBOOT_NODTB_IMAGE ?= "u-boot-nodtb-${MACHINE}-${PV}-${PR}.${UBOOT_SUFFIX}"
>>> +UBOOT_NODTB_BINARY ?= "u-boot-nodtb.${UBOOT_SUFFIX}"
>>> +UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.${UBOOT_SUFFIX}"
>>> +
>>> +#
>>> +# Following is relevant only for u-boot recipes:
>>> +#
>>> +
>>> +do_install_prepend_pn-u-boot () {
>> Why _pn-u-boot here? What if I have my own version of u-boot recipe?
> Oh good point, maybe this should be class-target instead of pn-u-boot
> (here and elsewhere) ?
>

Hi Tom, Denys, all,

I initially though that any custom u-boot recipes declares a 'PROVIDE += 
"u-boot"' and the bitbake "_pn-" syntax will append functions to u-boot 
recipes only. Unfortunately, i just checked and confirmed the appends 
functions are not called anymore when the u-boot recipe is not named 
"u-boot".
Using "class-target" is an interesting idea, but it looks like the 
kernel recipe is also part of this class (at least on my setup), thus it 
may not be reliable enough.

What about using the "PREFERRED_PROVIDER_u-boot" variable instead of 
static 'u-boot' string in the relevant places ?
A "do_install_prepend_pn-${PREFERRED_PROVIDER_u-boot}" is not valid, but 
it can be performed by adding tasks in the python function at EOF.

Something like:

-do_deploy_append_pn-u-boot () {
+do_before_uboot_deploy () {

[snip]

python() {
   if d.getVar('PN', True) == d.getVar('PREFERRED_PROVIDER_u-boot', True):
      bb.build.addtask('do_before_uboot_deploy', None, 'do_deploy', d)
}

Off course, it requires few changes in other places, but I hope you'll 
see the idea ? What do you think ?

Best regards,
Yannick

Re: [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot

[Andreas Oberritter]

On 20.04.2016 15:50, Yannick Gicquel wrote:
> This introduces a new uboot-sign.class to support U-Boot verified boot.
> 
> This part delivers the new class file, with related environment variables, and
> a basic prepend to do_install task which performs the concatenation of the
> u-boot-nodtb.bin and the device tree blob. The 'cat' command used
> overrides the u-boot.bin in both DEPLOYDIR & build dir to propagate the
> changes in later tasks (do_install, do_package, etc.)
> 
> Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh>
> ---
>  meta/classes/uboot-sign.bbclass    | 59 ++++++++++++++++++++++++++++++++++++++
>  meta/recipes-bsp/u-boot/u-boot.inc |  2 +-
>  2 files changed, 60 insertions(+), 1 deletion(-)
>  create mode 100644 meta/classes/uboot-sign.bbclass
> 
> diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass
> new file mode 100644
> index 0000000..63a5181
> --- /dev/null
> +++ b/meta/classes/uboot-sign.bbclass
> @@ -0,0 +1,59 @@
> +# This file is part of U-Boot verified boot support and is intended to be
> +# inherited from u-boot recipe and from kernel-fitimage.bbclass.
> +#
> +# The signature procedure requires the user to generate an RSA key and
> +# certificate in a directory and to define the following variable:
> +#
> +#   UBOOT_SIGN_KEYDIR = "/keys/directory"
> +#   UBOOT_SIGN_KEYNAME = "dev" # keys name in keydir (eg. "dev.crt", "dev.key")
> +#   UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000"
> +#   UBOOT_SIGN_ENABLE = "1"
> +#
> +# As verified boot depends on fitImage generation, following is also required:
> +#
> +#   KERNEL_CLASSES ?= " kernel-fitimage "
> +#   KERNEL_IMAGETYPE ?= "fitImage"
> +#
> +# The signature support is limited to the use of CONFIG_OF_SEPARATE in U-Boot.
> +#
> +# The tasks sequence is as below, using DEPLOY_IMAGE_DIR as common place to
> +# treat the device tree blob:
> +#
> +# u-boot:do_deploy -> virtual/kernel:do_assemble_fitimage -> u-boot:do_install
> +#
> +# For more details on signature process, please refer to U-boot documentation.
> +
> +# Signature activation.
> +UBOOT_SIGN_ENABLE ?= "0"
> +
> +# Default value for deployment filenames.
> +UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb"
> +UBOOT_DTB_BINARY ?= "u-boot.dtb"
> +UBOOT_DTB_SYMLINK ?= "u-boot-${MACHINE}.dtb"
> +UBOOT_NODTB_IMAGE ?= "u-boot-nodtb-${MACHINE}-${PV}-${PR}.${UBOOT_SUFFIX}"
> +UBOOT_NODTB_BINARY ?= "u-boot-nodtb.${UBOOT_SUFFIX}"
> +UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.${UBOOT_SUFFIX}"
> +

I think you should split the file at this point and either put the lines
above into uboot-sign-base.bbclass and include it from here or put the
lines below into u-boot.inc directly. This way you don't add unnecessary
code for u-boot to kernel recipes, and lose the dependency on PN =
"u-boot" at the same time.

Regards,
Andreas

> +#
> +# Following is relevant only for u-boot recipes:
> +#
> +
> +do_install_prepend_pn-u-boot () {
> +	# Concatenate U-Boot w/o DTB & DTB with public key
> +	# (cf. kernel-fitimage.bbclass for more details)
> +	cd ${DEPLOYDIR}
> +	if [ "x${UBOOT_SIGN_ENABLE}" = "x1" ]; then
> +		if [ -e "${UBOOT_NODTB_IMAGE}" -a -e "${UBOOT_DTB_IMAGE}" ]; then
> +			cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} > ${UBOOT_IMAGE}
> +			cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} > ${B}/${UBOOT_BINARY}
> +		else
> +			bbwarn "Failure while adding public key to u-boot binary. Verified boot won't be available."
> +		fi
> +	fi
> +}
> +
> +python () {
> +	if d.getVar('UBOOT_SIGN_ENABLE', True) == '1' and d.getVar('PN', True) == 'u-boot':
> +		kernel_pn = d.getVar('PREFERRED_PROVIDER_virtual/kernel', True)
> +		d.appendVarFlag('do_install', 'depends', ' %s:do_assemble_fitimage' % kernel_pn)
> +}
> diff --git a/meta/recipes-bsp/u-boot/u-boot.inc b/meta/recipes-bsp/u-boot/u-boot.inc
> index 3ba866d..037f35c 100644
> --- a/meta/recipes-bsp/u-boot/u-boot.inc
> +++ b/meta/recipes-bsp/u-boot/u-boot.inc
> @@ -12,7 +12,7 @@ S = "${WORKDIR}/git"
>  
>  PACKAGE_ARCH = "${MACHINE_ARCH}"
>  
> -inherit uboot-config deploy
> +inherit uboot-config uboot-sign deploy
>  
>  EXTRA_OEMAKE = 'CROSS_COMPILE=${TARGET_PREFIX} CC="${TARGET_PREFIX}gcc ${TOOLCHAIN_OPTIONS}" V=1'
>  EXTRA_OEMAKE += 'HOSTCC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}"'
> 

Re: [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot

[Yannick GICQUEL]

[-- Attachment #1: Type: text/plain, Size: 5606 bytes --]



Le 21/04/2016 16:06, Andreas Oberritter a écrit :
> On 20.04.2016 15:50, Yannick Gicquel wrote:
>> This introduces a new uboot-sign.class to support U-Boot verified boot.
>>
>> This part delivers the new class file, with related environment variables, and
>> a basic prepend to do_install task which performs the concatenation of the
>> u-boot-nodtb.bin and the device tree blob. The 'cat' command used
>> overrides the u-boot.bin in both DEPLOYDIR & build dir to propagate the
>> changes in later tasks (do_install, do_package, etc.)
>>
>> Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh>
>> ---
>>   meta/classes/uboot-sign.bbclass    | 59 ++++++++++++++++++++++++++++++++++++++
>>   meta/recipes-bsp/u-boot/u-boot.inc |  2 +-
>>   2 files changed, 60 insertions(+), 1 deletion(-)
>>   create mode 100644 meta/classes/uboot-sign.bbclass
>>
>> diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass
>> new file mode 100644
>> index 0000000..63a5181
>> --- /dev/null
>> +++ b/meta/classes/uboot-sign.bbclass
>> @@ -0,0 +1,59 @@
>> +# This file is part of U-Boot verified boot support and is intended to be
>> +# inherited from u-boot recipe and from kernel-fitimage.bbclass.
>> +#
>> +# The signature procedure requires the user to generate an RSA key and
>> +# certificate in a directory and to define the following variable:
>> +#
>> +#   UBOOT_SIGN_KEYDIR = "/keys/directory"
>> +#   UBOOT_SIGN_KEYNAME = "dev" # keys name in keydir (eg. "dev.crt", "dev.key")
>> +#   UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000"
>> +#   UBOOT_SIGN_ENABLE = "1"
>> +#
>> +# As verified boot depends on fitImage generation, following is also required:
>> +#
>> +#   KERNEL_CLASSES ?= " kernel-fitimage "
>> +#   KERNEL_IMAGETYPE ?= "fitImage"
>> +#
>> +# The signature support is limited to the use of CONFIG_OF_SEPARATE in U-Boot.
>> +#
>> +# The tasks sequence is as below, using DEPLOY_IMAGE_DIR as common place to
>> +# treat the device tree blob:
>> +#
>> +# u-boot:do_deploy -> virtual/kernel:do_assemble_fitimage -> u-boot:do_install
>> +#
>> +# For more details on signature process, please refer to U-boot documentation.
>> +
>> +# Signature activation.
>> +UBOOT_SIGN_ENABLE ?= "0"
>> +
>> +# Default value for deployment filenames.
>> +UBOOT_DTB_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.dtb"
>> +UBOOT_DTB_BINARY ?= "u-boot.dtb"
>> +UBOOT_DTB_SYMLINK ?= "u-boot-${MACHINE}.dtb"
>> +UBOOT_NODTB_IMAGE ?= "u-boot-nodtb-${MACHINE}-${PV}-${PR}.${UBOOT_SUFFIX}"
>> +UBOOT_NODTB_BINARY ?= "u-boot-nodtb.${UBOOT_SUFFIX}"
>> +UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.${UBOOT_SUFFIX}"
>> +
> I think you should split the file at this point and either put the lines
> above into uboot-sign-base.bbclass and include it from here or put the
> lines below into u-boot.inc directly. This way you don't add unnecessary
> code for u-boot to kernel recipes, and lose the dependency on PN =
> "u-boot" at the same time.

Thanks for the proposal, that's interesting.
I agree that splitting the file should remove the dependencies on 
'_pn-u-boot' and it also allow to keep usage of existing 'deploy' and 
'install' tasks.
But even in that case, we will still have a last reference to 'u-boot' 
recipe name, hardcoded in kernel-fitimage.bbclass:

d.appendVarFlag('do_assemble_fitimage', 'depends', ' u-boot:do_deploy')
                                                      ^^^^^^
For now, I don't know a way to avoid using PREFERRED_PROVIDER_u-boot 
variable at some point.

Also, I worked on an update (keeping one class file) and in that case it 
now introduces specifics tasks for u-boot. (cf. patch attached).
I would prefer to keep the whole thing in one single class file to avoid 
fragmentation, except if introducing new tasks it is not advised for any 
reason?
Your comments are welcome.

Anyway, I would be able to send a V3 series (maybe without RFC) early 
next week.
Thank you all for Acked, Reviewed and comments!

Best regards,
Yannick

>
> Regards,
> Andreas
>
>> +#
>> +# Following is relevant only for u-boot recipes:
>> +#
>> +
>> +do_install_prepend_pn-u-boot () {
>> +	# Concatenate U-Boot w/o DTB & DTB with public key
>> +	# (cf. kernel-fitimage.bbclass for more details)
>> +	cd ${DEPLOYDIR}
>> +	if [ "x${UBOOT_SIGN_ENABLE}" = "x1" ]; then
>> +		if [ -e "${UBOOT_NODTB_IMAGE}" -a -e "${UBOOT_DTB_IMAGE}" ]; then
>> +			cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} > ${UBOOT_IMAGE}
>> +			cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} > ${B}/${UBOOT_BINARY}
>> +		else
>> +			bbwarn "Failure while adding public key to u-boot binary. Verified boot won't be available."
>> +		fi
>> +	fi
>> +}
>> +
>> +python () {
>> +	if d.getVar('UBOOT_SIGN_ENABLE', True) == '1' and d.getVar('PN', True) == 'u-boot':
>> +		kernel_pn = d.getVar('PREFERRED_PROVIDER_virtual/kernel', True)
>> +		d.appendVarFlag('do_install', 'depends', ' %s:do_assemble_fitimage' % kernel_pn)
>> +}
>> diff --git a/meta/recipes-bsp/u-boot/u-boot.inc b/meta/recipes-bsp/u-boot/u-boot.inc
>> index 3ba866d..037f35c 100644
>> --- a/meta/recipes-bsp/u-boot/u-boot.inc
>> +++ b/meta/recipes-bsp/u-boot/u-boot.inc
>> @@ -12,7 +12,7 @@ S = "${WORKDIR}/git"
>>   
>>   PACKAGE_ARCH = "${MACHINE_ARCH}"
>>   
>> -inherit uboot-config deploy
>> +inherit uboot-config uboot-sign deploy
>>   
>>   EXTRA_OEMAKE = 'CROSS_COMPILE=${TARGET_PREFIX} CC="${TARGET_PREFIX}gcc ${TOOLCHAIN_OPTIONS}" V=1'
>>   EXTRA_OEMAKE += 'HOSTCC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}"'
>>


[-- Attachment #2: uboot-pn.patch --]
[-- Type: text/x-patch, Size: 3227 bytes --]

diff --git a/meta/classes/kernel-fitimage.bbclass b/meta/classes/kernel-fitimage.bbclass
index dfd3306..809bd4d 100644
--- a/meta/classes/kernel-fitimage.bbclass
+++ b/meta/classes/kernel-fitimage.bbclass
@@ -20,7 +20,8 @@ python __anonymous () {
         # U-boot dtb. We ensure the U-Boot dtb is deployed before assembling
         # the fitImage:
         if d.getVar('UBOOT_SIGN_ENABLE', True):
-            d.appendVarFlag('do_assemble_fitimage', 'depends', ' u-boot:do_deploy')
+            uboot_pn = d.getVar('PREFERRED_PROVIDER_u-boot', True) or 'u-boot'
+            d.appendVarFlag('do_assemble_fitimage', 'depends', ' %s:do_deploy' % uboot_pn)
 }
 
 # Options for the device tree compiler passed to mkimage '-D' feature:
diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass
index adb24d4..f3d0c73 100644
--- a/meta/classes/uboot-sign.bbclass
+++ b/meta/classes/uboot-sign.bbclass
@@ -16,10 +16,14 @@
 #
 # The signature support is limited to the use of CONFIG_OF_SEPARATE in U-Boot.
 #
-# The tasks sequence is as below, using DEPLOY_IMAGE_DIR as common place to
+# The tasks sequence is set as below, using DEPLOY_IMAGE_DIR as common place to
 # treat the device tree blob:
 #
-# u-boot:do_deploy -> virtual/kernel:do_assemble_fitimage -> u-boot:do_install
+#   u-boot:do_deploy_dtb
+#   u-boot:do_deploy
+#   virtual/kernel:do_assemble_fitimage
+#   u-boot:do_concat_dtb
+#   u-boot:do_install
 #
 # For more details on signature process, please refer to U-boot documentation.
 
@@ -38,8 +42,10 @@ UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.${UBOOT_SUFFIX}"
 # Following is relevant only for u-boot recipes:
 #
 
-do_deploy_append_pn-u-boot () {
-	# OF_SEPARATE generated files deployment
+do_deploy_dtb () {
+	mkdir -p ${DEPLOYDIR}
+	cd ${DEPLOYDIR}
+
 	if [ -f ${B}/${UBOOT_DTB_BINARY} ]; then
 		install ${B}/${UBOOT_DTB_BINARY} ${DEPLOYDIR}/${UBOOT_DTB_IMAGE}
 		rm -f ${UBOOT_DTB_BINARY} ${UBOOT_DTB_SYMLINK}
@@ -54,7 +60,7 @@ do_deploy_append_pn-u-boot () {
 	fi
 }
 
-do_install_prepend_pn-u-boot () {
+do_concat_dtb () {
 	# Concatenate U-Boot w/o DTB & DTB with public key
 	# (cf. kernel-fitimage.bbclass for more details)
 	cd ${DEPLOYDIR}
@@ -69,7 +75,16 @@ do_install_prepend_pn-u-boot () {
 }
 
 python () {
-	if d.getVar('UBOOT_SIGN_ENABLE', True) == '1' and d.getVar('PN', True) == 'u-boot':
+	uboot_pn = d.getVar('PREFERRED_PROVIDER_u-boot', True) or 'u-boot'
+	if d.getVar('UBOOT_SIGN_ENABLE', True) == '1' and d.getVar('PN', True) == uboot_pn:
 		kernel_pn = d.getVar('PREFERRED_PROVIDER_virtual/kernel', True)
-		d.appendVarFlag('do_install', 'depends', ' %s:do_assemble_fitimage' % kernel_pn)
+
+		# u-boot.dtb and u-boot-nodtb.bin are deployed _before_ do_deploy
+		# Thus, do_deploy_setscene will also populate them in DEPLOY_IMAGE_DIR
+		bb.build.addtask('do_deploy_dtb', 'do_deploy', 'do_compile', d)
+
+		# do_concat_dtb is scheduled _before_ do_install as it overwrite the
+		# u-boot.bin in both DEPLOYDIR and DEPLOY_IMAGE_DIR.
+		bb.build.addtask('do_concat_dtb', 'do_install', None, d)
+		d.appendVarFlag('do_concat_dtb', 'depends', ' %s:do_assemble_fitimage' % kernel_pn)
 }

Re: [RFC][PATCH v2 1/4] u-boot: basic support of dtb append for verified boot

[Bernhard Reutner-Fischer]

On April 21, 2016 9:55:21 PM GMT+02:00, Yannick GICQUEL <yannick.gicquel@iot.bzh> wrote:

>>> +do_install_prepend_pn-u-boot () {
>>> +	# Concatenate U-Boot w/o DTB & DTB with public key
>>> +	# (cf. kernel-fitimage.bbclass for more details)
>>> +	cd ${DEPLOYDIR}
>>> +	if [ "x${UBOOT_SIGN_ENABLE}" = "x1" ]; then
>>> +		if [ -e "${UBOOT_NODTB_IMAGE}" -a -e "${UBOOT_DTB_IMAGE}" ]; then
>>> +			cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} > ${UBOOT_IMAGE}
>>> +			cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} >
>${B}/${UBOOT_BINARY}


+			cat ${UBOOT_NODTB_IMAGE} ${UBOOT_DTB_IMAGE} | tee ${B}/${UBOOT_BINARY} > ${UBOOT_IMAGE}

thanks,

>>> +		else
>>> +			bbwarn "Failure while adding public key to u-boot binary.
>Verified boot won't be available."
>>> +		fi
>>> +	fi
>>> +}
>>> +

[RFC][PATCH v2 2/4] u-boot: deploy u-boot-nodtb and dtb files

[Yannick Gicquel]

This enable the deployment of u-boot-nodtb.bin and u-boot.dtb files.

Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh>
---
 meta/classes/uboot-sign.bbclass | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass
index 63a5181..adb24d4 100644
--- a/meta/classes/uboot-sign.bbclass
+++ b/meta/classes/uboot-sign.bbclass
@@ -38,6 +38,22 @@ UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.${UBOOT_SUFFIX}"
 # Following is relevant only for u-boot recipes:
 #
 
+do_deploy_append_pn-u-boot () {
+	# OF_SEPARATE generated files deployment
+	if [ -f ${B}/${UBOOT_DTB_BINARY} ]; then
+		install ${B}/${UBOOT_DTB_BINARY} ${DEPLOYDIR}/${UBOOT_DTB_IMAGE}
+		rm -f ${UBOOT_DTB_BINARY} ${UBOOT_DTB_SYMLINK}
+		ln -sf ${UBOOT_DTB_IMAGE} ${UBOOT_DTB_SYMLINK}
+		ln -sf ${UBOOT_DTB_IMAGE} ${UBOOT_DTB_BINARY}
+	fi
+	if [ -f ${B}/${UBOOT_NODTB_BINARY} ]; then
+		install ${B}/${UBOOT_NODTB_BINARY} ${DEPLOYDIR}/${UBOOT_NODTB_IMAGE}
+		rm -f ${UBOOT_NODTB_BINARY} ${UBOOT_NODTB_SYMLINK}
+		ln -sf ${UBOOT_NODTB_IMAGE} ${UBOOT_NODTB_SYMLINK}
+		ln -sf ${UBOOT_NODTB_IMAGE} ${UBOOT_NODTB_BINARY}
+	fi
+}
+
 do_install_prepend_pn-u-boot () {
 	# Concatenate U-Boot w/o DTB & DTB with public key
 	# (cf. kernel-fitimage.bbclass for more details)
-- 
1.9.1

Re: [RFC][PATCH v2 2/4] u-boot: deploy u-boot-nodtb and dtb files

[Tom Rini]

On Wed, Apr 20, 2016 at 03:50:37PM +0200, Yannick Gicquel wrote:

> This enable the deployment of u-boot-nodtb.bin and u-boot.dtb files.
> 
> Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh>

Reviewed-by: Tom Rini <trini@konsulko.com>

-- 
Tom

Re: [RFC, v2, 2/4] u-boot: deploy u-boot-nodtb and dtb files

[Andreas Dannenberg]

On Wed, Apr 20, 2016 at 03:50:37PM +0200, Yannick Gicquel wrote:
> This enable the deployment of u-boot-nodtb.bin and u-boot.dtb files.
> 
> Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh>
> Reviewed-by: Tom Rini <trini@konsulko.com>

Acked-by: Andreas Dannenberg <dannenberg@ti.com>


--
Andreas Dannenberg
Texas Instruments Inc

Re: [RFC][PATCH v2 2/4] u-boot: deploy u-boot-nodtb and dtb files

[Denys Dmytriyenko]

On Wed, Apr 20, 2016 at 03:50:37PM +0200, Yannick Gicquel wrote:
> This enable the deployment of u-boot-nodtb.bin and u-boot.dtb files.
> 
> Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh>
> ---
>  meta/classes/uboot-sign.bbclass | 16 ++++++++++++++++
>  1 file changed, 16 insertions(+)
> 
> diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass
> index 63a5181..adb24d4 100644
> --- a/meta/classes/uboot-sign.bbclass
> +++ b/meta/classes/uboot-sign.bbclass
> @@ -38,6 +38,22 @@ UBOOT_NODTB_SYMLINK ?= "u-boot-nodtb-${MACHINE}.${UBOOT_SUFFIX}"
>  # Following is relevant only for u-boot recipes:
>  #
>  
> +do_deploy_append_pn-u-boot () {

Same question here about _pn-u-boot.


> +	# OF_SEPARATE generated files deployment
> +	if [ -f ${B}/${UBOOT_DTB_BINARY} ]; then
> +		install ${B}/${UBOOT_DTB_BINARY} ${DEPLOYDIR}/${UBOOT_DTB_IMAGE}
> +		rm -f ${UBOOT_DTB_BINARY} ${UBOOT_DTB_SYMLINK}
> +		ln -sf ${UBOOT_DTB_IMAGE} ${UBOOT_DTB_SYMLINK}
> +		ln -sf ${UBOOT_DTB_IMAGE} ${UBOOT_DTB_BINARY}
> +	fi
> +	if [ -f ${B}/${UBOOT_NODTB_BINARY} ]; then
> +		install ${B}/${UBOOT_NODTB_BINARY} ${DEPLOYDIR}/${UBOOT_NODTB_IMAGE}
> +		rm -f ${UBOOT_NODTB_BINARY} ${UBOOT_NODTB_SYMLINK}
> +		ln -sf ${UBOOT_NODTB_IMAGE} ${UBOOT_NODTB_SYMLINK}
> +		ln -sf ${UBOOT_NODTB_IMAGE} ${UBOOT_NODTB_BINARY}
> +	fi
> +}
> +
>  do_install_prepend_pn-u-boot () {
>  	# Concatenate U-Boot w/o DTB & DTB with public key
>  	# (cf. kernel-fitimage.bbclass for more details)
> -- 
> 1.9.1
> 
> -- 
> _______________________________________________
> Openembedded-core mailing list
> Openembedded-core@lists.openembedded.org
> http://lists.openembedded.org/mailman/listinfo/openembedded-core

[RFC][PATCH v2 3/4] kernel: fitimage: support device tree compiler options

[Yannick Gicquel]

This introduces a new variable to set the device tree compiler options while
calling mkimage ('-D' option). By default, this variable is not set but it can
be defined in a configuration file, as following example:

UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000"

Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh>
---
 meta/classes/kernel-fitimage.bbclass | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/meta/classes/kernel-fitimage.bbclass b/meta/classes/kernel-fitimage.bbclass
index e5b75ed..62e0017 100644
--- a/meta/classes/kernel-fitimage.bbclass
+++ b/meta/classes/kernel-fitimage.bbclass
@@ -17,6 +17,9 @@ python __anonymous () {
             d.appendVarFlag('do_assemble_fitimage', 'depends', ' ${INITRAMFS_IMAGE}:do_image_complete')
 }
 
+# Options for the device tree compiler passed to mkimage '-D' feature:
+UBOOT_MKIMAGE_DTCOPTS ??= ""
+
 #
 # Emit the fitImage ITS header
 #
@@ -209,7 +212,10 @@ do_assemble_fitimage() {
 		#
 		# Step 4: Assemble the image
 		#
-		uboot-mkimage -f fit-image.its arch/${ARCH}/boot/fitImage
+		uboot-mkimage \
+			${@'-D "${UBOOT_MKIMAGE_DTCOPTS}"' if len('${UBOOT_MKIMAGE_DTCOPTS}') else ''} \
+			-f fit-image.its \
+			arch/${ARCH}/boot/fitImage
 	fi
 }
 
-- 
1.9.1

Re: [RFC][PATCH v2 3/4] kernel: fitimage: support device tree compiler options

[Tom Rini]

On Wed, Apr 20, 2016 at 03:50:38PM +0200, Yannick Gicquel wrote:

> This introduces a new variable to set the device tree compiler options while
> calling mkimage ('-D' option). By default, this variable is not set but it can
> be defined in a configuration file, as following example:
> 
> UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000"
> 
> Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh>

Reviewed-by: Tom Rini <trini@konsulko.com>

-- 
Tom

Re: [RFC, v2, 3/4] kernel: fitimage: support device tree compiler options

[Andreas Dannenberg]

On Wed, Apr 20, 2016 at 03:50:38PM +0200, Yannick Gicquel wrote:
> This introduces a new variable to set the device tree compiler options while
> calling mkimage ('-D' option). By default, this variable is not set but it can
> be defined in a configuration file, as following example:
> 
> UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000"
> 
> Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh>
> Reviewed-by: Tom Rini <trini@konsulko.com>


Acked-by: Andreas Dannenberg <dannenberg@ti.com>

--
Andreas Dannenberg
Texas Instruments Inc

[RFC][PATCH v2 4/4] kernel: fitimage: basic support for fitimage signature

[Yannick Gicquel]

This is an initial support of fitImage signature to enable U-Boot verified
boot. This feature is implemented by adding a signature tag to the
configuration section of the generated fit-image.its file.

When a UBOOT_SIGN_ENABLE variable is set to "1", the signature procedure is
activated and performs a second call to mkimage to sign the fitImage file and
to include the public key in the deployed U-Boot device tree blob. (This
implementation depends on the use of CONFIG_OF_SEPARATE in U-Boot.)

As the U-Boot device tree blob is appended in the deploy dir, a dependency
on 'u-boot:do_deploy' is added when the feature is activated.

Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh>
---
 meta/classes/kernel-fitimage.bbclass | 44 ++++++++++++++++++++++++++++++++++--
 1 file changed, 42 insertions(+), 2 deletions(-)

diff --git a/meta/classes/kernel-fitimage.bbclass b/meta/classes/kernel-fitimage.bbclass
index 62e0017..dfd3306 100644
--- a/meta/classes/kernel-fitimage.bbclass
+++ b/meta/classes/kernel-fitimage.bbclass
@@ -1,4 +1,4 @@
-inherit kernel-uboot
+inherit kernel-uboot uboot-sign
 
 python __anonymous () {
     kerneltype = d.getVar('KERNEL_IMAGETYPE', True)
@@ -15,6 +15,12 @@ python __anonymous () {
         image = d.getVar('INITRAMFS_IMAGE', True)
         if image:
             d.appendVarFlag('do_assemble_fitimage', 'depends', ' ${INITRAMFS_IMAGE}:do_image_complete')
+
+        # Verified boot will sign the fitImage and append the public key to
+        # U-boot dtb. We ensure the U-Boot dtb is deployed before assembling
+        # the fitImage:
+        if d.getVar('UBOOT_SIGN_ENABLE', True):
+            d.appendVarFlag('do_assemble_fitimage', 'depends', ' u-boot:do_deploy')
 }
 
 # Options for the device tree compiler passed to mkimage '-D' feature:
@@ -132,6 +138,9 @@ EOF
 fitimage_emit_section_config() {
 
 	conf_csum="sha1"
+	if [ -n "${UBOOT_SIGN_ENABLE}" ] ; then
+		conf_sign_keyname="${UBOOT_SIGN_KEYNAME}"
+	fi
 
 	# Test if we have any DTBs at all
 	if [ -z "${2}" ] ; then
@@ -152,6 +161,26 @@ fitimage_emit_section_config() {
                         hash@1 {
                                 algo = "${conf_csum}";
                         };
+EOF
+
+	if [ ! -z "${conf_sign_keyname}" ] ; then
+
+		if [ -z "${2}" ] ; then
+			sign_line="sign-images = \"kernel\";"
+		else
+			sign_line="sign-images = \"fdt\", \"kernel\";"
+		fi
+
+		cat << EOF >> fit-image.its
+                        signature@1 {
+                                algo = "${conf_csum},rsa2048";
+                                key-name-hint = "${conf_sign_keyname}";
+                                sign-images = "fdt", "kernel";
+                        };
+EOF
+	fi
+
+	cat << EOF >> fit-image.its
                 };
 EOF
 }
@@ -160,7 +189,7 @@ do_assemble_fitimage() {
 	if test "x${KERNEL_IMAGETYPE}" = "xfitImage" ; then
 		kernelcount=1
 		dtbcount=""
-		rm -f fit-image.its
+		rm -f fit-image.its arch/${ARCH}/boot/fitImage
 
 		fitimage_emit_fit_header
 
@@ -216,6 +245,17 @@ do_assemble_fitimage() {
 			${@'-D "${UBOOT_MKIMAGE_DTCOPTS}"' if len('${UBOOT_MKIMAGE_DTCOPTS}') else ''} \
 			-f fit-image.its \
 			arch/${ARCH}/boot/fitImage
+
+		#
+		# Step 5: Sign the image and add public key to U-Boot dtb
+		#
+		if test -n "${UBOOT_SIGN_ENABLE}"; then
+			uboot-mkimage \
+				${@'-D "${UBOOT_MKIMAGE_DTCOPTS}"' if len('${UBOOT_MKIMAGE_DTCOPTS}') else ''} \
+				-F -k "${UBOOT_SIGN_KEYDIR}" \
+				-K "${DEPLOY_DIR_IMAGE}/${UBOOT_DTB_BINARY}" \
+				-r arch/${ARCH}/boot/fitImage
+		fi
 	fi
 }
 
-- 
1.9.1

Re: [RFC][PATCH v2 4/4] kernel: fitimage: basic support for fitimage signature

[Tom Rini]

On Wed, Apr 20, 2016 at 03:50:39PM +0200, Yannick Gicquel wrote:

> This is an initial support of fitImage signature to enable U-Boot verified
> boot. This feature is implemented by adding a signature tag to the
> configuration section of the generated fit-image.its file.
> 
> When a UBOOT_SIGN_ENABLE variable is set to "1", the signature procedure is
> activated and performs a second call to mkimage to sign the fitImage file and
> to include the public key in the deployed U-Boot device tree blob. (This
> implementation depends on the use of CONFIG_OF_SEPARATE in U-Boot.)
> 
> As the U-Boot device tree blob is appended in the deploy dir, a dependency
> on 'u-boot:do_deploy' is added when the feature is activated.
> 
> Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh>

Reviewed-by: Tom Rini <trini@konsulko.com>

-- 
Tom

Re: [RFC, v2, 4/4] kernel: fitimage: basic support for fitimage signature

[Andreas Dannenberg]

On Wed, Apr 20, 2016 at 03:50:39PM +0200, Yannick Gicquel wrote:
> This is an initial support of fitImage signature to enable U-Boot verified
> boot. This feature is implemented by adding a signature tag to the
> configuration section of the generated fit-image.its file.
> 
> When a UBOOT_SIGN_ENABLE variable is set to "1", the signature procedure is
> activated and performs a second call to mkimage to sign the fitImage file and
> to include the public key in the deployed U-Boot device tree blob. (This
> implementation depends on the use of CONFIG_OF_SEPARATE in U-Boot.)
> 
> As the U-Boot device tree blob is appended in the deploy dir, a dependency
> on 'u-boot:do_deploy' is added when the feature is activated.
> 
> Signed-off-by: Yannick Gicquel <yannick.gicquel@iot.bzh>
> Reviewed-by: Tom Rini <trini@konsulko.com>


Acked-by: Andreas Dannenberg <dannenberg@ti.com>

--
Andreas Dannenberg
Texas Instruments Inc

Re: [RFC][PATCH v2 0/4] U-Boot verified boot basic support

[Tom Rini]

On Wed, Apr 20, 2016 at 03:50:35PM +0200, Yannick Gicquel wrote:

> Changes since v1:
>   * Uses a class uboot-sign.bbclass file instead of include file.
>   * 'assemble_dtb' task removed and replace by do_install_prepend function
>     for u-boot recipe.
> 
> Yannick Gicquel (4):
>   u-boot: basic support of dtb append for verified boot
>   u-boot: deploy u-boot-nodtb and dtb files
>   kernel: fitimage: support device tree compiler options
>   kernel: fitimage: basic support for fitimage signature
> 
>  meta/classes/kernel-fitimage.bbclass | 52 +++++++++++++++++++++++--
>  meta/classes/uboot-sign.bbclass      | 75 ++++++++++++++++++++++++++++++++++++
>  meta/recipes-bsp/u-boot/u-boot.inc   |  2 +-
>  3 files changed, 125 insertions(+), 4 deletions(-)
>  create mode 100644 meta/classes/uboot-sign.bbclass

Thanks for doing this.  It will hopefully make this knowledge more wide
spread and thus more widely used.

-- 
Tom

Re: [RFC][PATCH v2 0/4] U-Boot verified boot basic support

[Denys Dmytriyenko]

On Wed, Apr 20, 2016 at 11:23:18AM -0400, Tom Rini wrote:
> On Wed, Apr 20, 2016 at 03:50:35PM +0200, Yannick Gicquel wrote:
> 
> > Changes since v1:
> >   * Uses a class uboot-sign.bbclass file instead of include file.
> >   * 'assemble_dtb' task removed and replace by do_install_prepend function
> >     for u-boot recipe.
> > 
> > Yannick Gicquel (4):
> >   u-boot: basic support of dtb append for verified boot
> >   u-boot: deploy u-boot-nodtb and dtb files
> >   kernel: fitimage: support device tree compiler options
> >   kernel: fitimage: basic support for fitimage signature
> > 
> >  meta/classes/kernel-fitimage.bbclass | 52 +++++++++++++++++++++++--
> >  meta/classes/uboot-sign.bbclass      | 75 ++++++++++++++++++++++++++++++++++++
> >  meta/recipes-bsp/u-boot/u-boot.inc   |  2 +-
> >  3 files changed, 125 insertions(+), 4 deletions(-)
> >  create mode 100644 meta/classes/uboot-sign.bbclass
> 
> Thanks for doing this.  It will hopefully make this knowledge more wide
> spread and thus more widely used.

This is very timely for us as well and it is nice to use the standard and open 
implementation. For the entire series:

Acked-by: Denys Dmytriyenko <denys@ti.com>

-- 
Denys