| Message ID | 20200526104412.3666210-4-heiko@sntech.de |
|---|---|
| State | New |
| Headers | show |
| Series | rockchip: make it possible to sign the u-boot.itb | expand |
On Tue, 26 May 2020 at 04:44, Heiko Stuebner <heiko at sntech.de> wrote: > > From: Heiko Stuebner <heiko.stuebner at theobroma-systems.com> > > With SPL_FIT_SIGNATURE enabled we will likely want a generated > u-boot.itb to be signed and the key stores so that the spl can > reach it. > > So add a SPL_FIT_SIGNATURE_KEY_DIR option and suitable hooks > into the Makefile to have mkimage sign the .itb and store the > used key into the spl dtb file. > > The added dependencies should make sure that the u-boot.itb > gets generated before the spl-binary gets build, so that there > is the necessary space for the key to get included. > > Signed-off-by: Heiko Stuebner <heiko.stuebner at theobroma-systems.com> > Reviewed-by: Philipp Tomsich <philipp.tomsich at theobroma-systems.com> > --- > changes in v2.1: > - depend on $(CONFIG_SPL_FIT_SIGNATURE)$(U_BOOT_ITS) > instead of only $(CONFIG_SPL_FIT_GENERATOR) > > Kconfig | 8 ++++++++ > Makefile | 11 ++++++++++- > 2 files changed, 18 insertions(+), 1 deletion(-) > Reviewed-by: Simon Glass <sjg at chromium.org>
diff --git a/Kconfig b/Kconfig index 0c184f7f06..bab7c4f3ee 100644 --- a/Kconfig +++ b/Kconfig @@ -465,6 +465,14 @@ config SPL_FIT_SIGNATURE select SPL_RSA_VERIFY select SPL_IMAGE_SIGN_INFO +config SPL_FIT_SIGNATURE_KEY_DIR + string "key directory for signing U-Boot FIT image" + depends on SPL_FIT_SIGNATURE + default "keys" + help + The directory to give to mkimage to retrieve keys from when + generating a signed U-Boot FIT image. + config SPL_LOAD_FIT bool "Enable SPL loading U-Boot as a FIT (basic fitImage features)" select SPL_FIT diff --git a/Makefile b/Makefile index 463fa72e3f..b8f7536940 100644 --- a/Makefile +++ b/Makefile @@ -1407,6 +1407,14 @@ MKIMAGEFLAGS_u-boot.itb = else MKIMAGEFLAGS_u-boot.itb = -E endif +ifdef CONFIG_SPL_FIT_SIGNATURE +ifdef CONFIG_SPL_OF_CONTROL +MKIMAGEFLAGS_u-boot.itb += -K dts/dt-spl.dtb -r +ifneq ($(CONFIG_SPL_FIT_SIGNATURE_KEY_DIR),"") +MKIMAGEFLAGS_u-boot.itb += -k $(CONFIG_SPL_FIT_SIGNATURE_KEY_DIR) +endif +endif +endif u-boot.itb: u-boot-nodtb.bin \ $(if $(CONFIG_OF_SEPARATE)$(CONFIG_OF_EMBED)$(CONFIG_OF_HOSTFILE),dts/dt.dtb) \ @@ -1929,7 +1937,8 @@ spl/u-boot-spl.bin: spl/u-boot-spl spl/u-boot-spl: tools prepare \ $(if $(CONFIG_OF_SEPARATE)$(CONFIG_OF_EMBED)$(CONFIG_SPL_OF_PLATDATA),dts/dt.dtb) \ - $(if $(CONFIG_OF_SEPARATE)$(CONFIG_OF_EMBED)$(CONFIG_TPL_OF_PLATDATA),dts/dt.dtb) + $(if $(CONFIG_OF_SEPARATE)$(CONFIG_OF_EMBED)$(CONFIG_TPL_OF_PLATDATA),dts/dt.dtb) \ + $(if $(CONFIG_SPL_FIT_SIGNATURE)$(U_BOOT_ITS),u-boot.itb FORCE) $(Q)$(MAKE) obj=spl -f $(srctree)/scripts/Makefile.spl all spl/sunxi-spl.bin: spl/u-boot-spl