mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-30 03:32:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

uboot-sign: support to create TEE and ATF image tree source

Browse Source 
Currently, uboot-sign.bbclass only supports to create Image Tree Source(ITS)
for "u-boot" and "flat_dt". However, users may want to support multiple images
such as  ARM Trusted Firmware(ATF), Trusted Execution Environment(TEE) and
users private images for specific application and purpose.

To make this bbclass more flexible and support ATF and TEE, creates new
functions which are "uboot_fitimage_atf" and "uboot_fitimage_tee"
for ATF and TEE ITS file creation, respectively.

Add a variable "UBOOT_FIT_ARM_TRUSTED_FIRMWARE" to
enable ATF ITS generation and it is disable by default.

Add a variable "UBOOT_FIT_TEE" to enable TEE ITS generation
and it is disable by default.

(From OE-Core rev: c14641a964b5b802e995e574a599c5b4937fb488)

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Jamin Lin
2025-02-17 16:52:31 +08:00
committed by Richard Purdie
parent fa198a04eb
commit e6ff708977
1 changed files with 79 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

80
meta/classes-recipe/uboot-sign.bbclass
View File

@@ -86,6 +86,18 @@ UBOOT_FIT_KEY_SIGN_PKCS ?= "-x509"
# ex: 1 32bits address, 2 64bits address
UBOOT_FIT_ADDRESS_CELLS ?= "1"
# ARM Trusted Firmware(ATF) is a reference implementation of secure world
# software for Arm A-Profile architectures, (Armv8-A and Armv7-A), including
# an Exception Level 3 (EL3) Secure Monitor.
UBOOT_FIT_ARM_TRUSTED_FIRMWARE ?= "0"
UBOOT_FIT_ARM_TRUSTED_FIRMWARE_IMAGE ?= "bl31.bin"
# A Trusted Execution Environment(TEE) is an environment for executing code,
# in which those executing the code can have high levels of trust in the asset
# management of that surrounding environment.
UBOOT_FIT_TEE ?= "0"
UBOOT_FIT_TEE_IMAGE ?= "tee-raw.bin"
UBOOT_FIT_UBOOT_LOADADDRESS ?= "${UBOOT_LOADADDRESS}"
UBOOT_FIT_UBOOT_ENTRYPOINT ?= "${UBOOT_ENTRYPOINT}"
@@ -282,9 +294,64 @@ do_uboot_generate_rsa_keys() {
addtask uboot_generate_rsa_keys before do_uboot_assemble_fitimage after do_compile
# Create a ITS file for the atf
uboot_fitimage_atf() {
cat << EOF >> ${UBOOT_ITS}
atf {
description = "ARM Trusted Firmware";
data = /incbin/("${UBOOT_FIT_ARM_TRUSTED_FIRMWARE_IMAGE}");
type = "firmware";
arch = "${UBOOT_ARCH}";
os = "arm-trusted-firmware";
load = <${UBOOT_FIT_ARM_TRUSTED_FIRMWARE_LOADADDRESS}>;
entry = <${UBOOT_FIT_ARM_TRUSTED_FIRMWARE_ENTRYPOINT}>;
compression = "none";
EOF
if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then
cat << EOF >> ${UBOOT_ITS}
signature {
algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}";
key-name-hint = "${SPL_SIGN_KEYNAME}";
};
EOF
fi
cat << EOF >> ${UBOOT_ITS}
};
EOF
}
# Create a ITS file for the tee
uboot_fitimage_tee() {
cat << EOF >> ${UBOOT_ITS}
tee {
description = "Trusted Execution Environment";
data = /incbin/("${UBOOT_FIT_TEE_IMAGE}");
type = "tee";
arch = "${UBOOT_ARCH}";
os = "tee";
load = <${UBOOT_FIT_TEE_LOADADDRESS}>;
entry = <${UBOOT_FIT_TEE_ENTRYPOINT}>;
compression = "none";
EOF
if [ "${SPL_SIGN_ENABLE}" = "1" ] ; then
cat << EOF >> ${UBOOT_ITS}
signature {
algo = "${UBOOT_FIT_HASH_ALG},${UBOOT_FIT_SIGN_ALG}";
key-name-hint = "${SPL_SIGN_KEYNAME}";
};
EOF
fi
cat << EOF >> ${UBOOT_ITS}
};
EOF
}
# Create a ITS file for the U-boot FIT, for use when
# we want to sign it so that the SPL can verify it
uboot_fitimage_assemble() {
conf_loadables="\"uboot\""
rm -f ${UBOOT_ITS} ${UBOOT_FITIMAGE_BINARY}
# First we create the ITS script
@@ -337,13 +404,24 @@ EOF
cat << EOF >> ${UBOOT_ITS}
};
EOF
if [ "${UBOOT_FIT_TEE}" = "1" ] ; then
conf_loadables="\"tee\", ${conf_loadables}"
uboot_fitimage_tee
fi
if [ "${UBOOT_FIT_ARM_TRUSTED_FIRMWARE}" = "1" ] ; then
conf_loadables="\"atf\", ${conf_loadables}"
uboot_fitimage_atf
fi
cat << EOF >> ${UBOOT_ITS}
};
configurations {
default = "conf";
conf {
description = "Boot with signed U-Boot FIT";
loadables = "uboot";
loadables = ${conf_loadables};
fdt = "fdt";
};
};