@@ -3178,6 +3178,45 @@ You can also specify the machine using this method::
See the :term:`UBOOT_CONFIG` and :term:`UBOOT_MACHINE` variables for additional
information.
+.. _ref-classes-uboot-sign:
+
+``uboot-sign``
+==============
+
+The :ref:`ref-classes-uboot-sign` class provides support for U-Boot verified boot.
+It is intended to be inherited from U-Boot recipes.
+
+Here are variables used by this class:
+
+- :term:`SPL_MKIMAGE_DTCOPTS`: DTC options for U-Boot ``mkimage`` when
+ building the FIT image.
+- :term:`SPL_SIGN_ENABLE`: enable signing the FIT image.
+- :term:`SPL_SIGN_KEYDIR`: directory containing the signing keys.
+- :term:`SPL_SIGN_KEYNAME`: base filename of the signing keys.
+- :term:`UBOOT_FIT_ADDRESS_CELLS`: ``#address-cells`` value for the FIT image.
+- :term:`UBOOT_FIT_DESC`: description string encoded into the FIT image.
+- :term:`UBOOT_FIT_GENERATE_KEYS`: allows to generate the keys
+ if they don't exist yet.
+- :term:`UBOOT_FIT_HASH_ALG`: hash algorithm for the FIT image.
+- :term:`UBOOT_FIT_KEY_GENRSA_ARGS`: ``openssl genrsa`` arguments.
+- :term:`UBOOT_FIT_KEY_REQ_ARGS`: ``openssl req`` arguments.
+- :term:`UBOOT_FIT_SIGN_ALG`: signature algorithm for the FIT image.
+- :term:`UBOOT_FIT_SIGN_NUMBITS`: size of the private key for FIT image
+ signing.
+- :term:`UBOOT_FIT_KEY_SIGN_PKCS`: format for the public key certificate
+ for FIT image signing.
+- :term:`UBOOT_FITIMAGE_ENABLE`: enables the generation of a U-Boot FIT image.
+- :term:`UBOOT_MKIMAGE_DTCOPTS`: DTC options for U-Boot ``mkimage`` when
+ rebuilding the FIT image containing the kernel.
+
+See U-Boot's documentation for details about `verified boot
+<https://source.denx.de/u-boot/u-boot/-/blob/master/doc/uImage.FIT/verified-boot.txt>`__
+and the `signature process
+<https://source.denx.de/u-boot/u-boot/-/blob/master/doc/uImage.FIT/signature.txt>`__.
+
+See also the description of :ref:`ref-classes-kernel-fitimage` class, which this class
+imitates.
+
.. _ref-classes-uninative:
``uninative``
@@ -2927,7 +2927,7 @@ system and gives an overview of their function and contents.
The default value is set to "1" by the :ref:`ref-classes-kernel-fitimage`
class, which corresponds to 32 bit addresses.
- For platforms who need to set 64 bit addresses in
+ For platforms that need to set 64 bit addresses, for example in
:term:`UBOOT_LOADADDRESS` and :term:`UBOOT_ENTRYPOINT`, you need to
set this value to "2", as two 32 bit values (cells) will be needed
to represent such addresses.
@@ -7759,6 +7759,32 @@ system and gives an overview of their function and contents.
section in the Yocto Project Board Support Package Developer's Guide
for additional information.
+ :term:`SPL_MKIMAGE_DTCOPTS`
+ Options for the device tree compiler passed to ``mkimage -D`` feature
+ while creating a FIT image with the :ref:`ref-classes-uboot-sign`
+ class. If :term:`SPL_MKIMAGE_DTCOPTS` is not set then the
+ :ref:`ref-classes-uboot-sign` class will not pass the ``-D`` option
+ to ``mkimage``.
+
+ The default value is set to "" by the :ref:`ref-classes-uboot-config`
+ class.
+
+ :term:`SPL_SIGN_ENABLE`
+ Enable signing of the U-Boot FIT image. The default value is "0".
+ This variable is used by the :ref:`ref-classes-uboot-sign` class.
+
+ :term:`SPL_SIGN_KEYDIR`
+ Location of the directory containing the RSA key and certificate used for
+ signing the U-Boot FIT image, used by the :ref:`ref-classes-uboot-sign`
+ class.
+
+ :term:`SPL_SIGN_KEYNAME`
+ The name of keys used by the :ref:`ref-classes-kernel-fitimage` class
+ for signing U-Boot FIT image stored in the :term:`SPL_SIGN_KEYDIR`
+ directory. If we have for example a ``dev.key`` key and a ``dev.crt``
+ certificate stored in the :term:`SPL_SIGN_KEYDIR` directory, you will
+ have to set :term:`SPL_SIGN_KEYNAME` to ``dev``.
+
:term:`SRCREV_FORMAT`
See :term:`bitbake:SRCREV_FORMAT` in the BitBake manual.
@@ -9097,16 +9123,101 @@ system and gives an overview of their function and contents.
creation, the :term:`UBOOT_ENTRYPOINT` variable is passed as a
command-line parameter to the ``uboot-mkimage`` utility.
- To pass a 64 bit address for FIT image creation, you will need to set
- the :term:`FIT_ADDRESS_CELLS` variable too.
+ To pass a 64 bit address for FIT image creation, you will need to set:
+ - The :term:`FIT_ADDRESS_CELLS` variable for FIT image creation.
+ - The :term:`UBOOT_FIT_ADDRESS_CELLS` variable for U-Boot FIT image creation.
+
+ This variable is used by the :ref:`ref-classes-kernel-fitimage`,
+ :ref:`ref-classes-kernel-uimage`, :ref:`ref-classes-kernel`,
+ :ref:`ref-classes-uboot-config` and :ref:`ref-classes-uboot-sign`
+ classes.
+ :term:`UBOOT_FIT_ADDRESS_CELLS`
+ Specifies the value of the ``#address-cells`` value for the
+ description of the U-Boot FIT image.
+
+ The default value is set to "1" by the :ref:`ref-classes-uboot-sign`
+ class, which corresponds to 32 bit addresses.
+
+ For platforms that need to set 64 bit addresses in
+ :term:`UBOOT_LOADADDRESS` and :term:`UBOOT_ENTRYPOINT`, you need to
+ set this value to "2", as two 32 bit values (cells) will be needed
+ to represent such addresses.
+
+ Here is an example setting "0x400000000" as a load address::
+
+ UBOOT_FIT_ADDRESS_CELLS = "2"
+ UBOOT_LOADADDRESS= "0x04 0x00000000"
+
+ See `more details about #address-cells <https://elinux.org/Device_Tree_Usage#How_Addressing_Works>`__.
+
+ :term:`UBOOT_FIT_DESC`
+ Specifies the description string encoded into a U-Boot fitImage. The default
+ value is set by the :ref:`ref-classes-uboot-sign` class as follows::
+
+ UBOOT_FIT_DESC ?= "U-Boot fitImage for ${DISTRO_NAME}/${PV}/${MACHINE}"
+
+ :term:`UBOOT_FIT_GENERATE_KEYS`
+ Decides whether to generate the keys for signing the U-Boot fitImage if
+ they don't already exist. The keys are created in :term:`SPL_SIGN_KEYDIR`.
+ The default value is "0".
+
+ Enable this as follows::
+
+ UBOOT_FIT_GENERATE_KEYS = "1"
+
+ This variable is used in the :ref:`ref-classes-uboot-sign` class.
+
+ :term:`UBOOT_FIT_HASH_ALG`
+ Specifies the hash algorithm used in creating the U-Boot FIT Image.
+ It is set by default to ``sha256`` by the :ref:`ref-classes-uboot-sign`
+ class.
+
+ :term:`UBOOT_FIT_KEY_GENRSA_ARGS`
+ Arguments to ``openssl genrsa`` for generating a RSA private key for
+ signing the U-Boot FIT image. The default value of this variable
+ is set to "-F4" by the :ref:`ref-classes-uboot-sign` class.
+
+ :term:`UBOOT_FIT_KEY_REQ_ARGS`
+ Arguments to ``openssl req`` for generating a certificate for signing
+ the U-Boot FIT image. The default value is "-batch -new" by the
+ :ref:`ref-classes-uboot-sign` class, "batch" for
+ non interactive mode and "new" for generating new keys.
+
+ :term:`UBOOT_FIT_KEY_SIGN_PKCS`
+ Format for the public key certificate used for signing the U-Boot FIT
+ image. The default value is set to "x509" by the
+ :ref:`ref-classes-uboot-sign` class.
+
+ :term:`UBOOT_FIT_SIGN_ALG`
+ Specifies the signature algorithm used in creating the U-Boot FIT Image.
+ This variable is set by default to "rsa2048" by the
+ :ref:`ref-classes-uboot-sign` class.
+
+ :term:`UBOOT_FIT_SIGN_NUMBITS`
+ Size of the private key used in signing the U-Boot FIT image, in number
+ of bits. The default value for this variable is set to "2048"
+ by the :ref:`ref-classes-uboot-sign` class.
+
+ :term:`UBOOT_FITIMAGE_ENABLE`
+ This variable allows to generate a FIT image for U-Boot, which is one
+ of the ways to implement a verified boot process.
+
+ Its default value is "0", so set it to "1" to enable this functionality::
+
+ UBOOT_FITIMAGE_ENABLE = "1"
+
+ See the :ref:`ref-classes-uboot-sign` class for details.
+
:term:`UBOOT_LOADADDRESS`
Specifies the load address for the U-Boot image. During U-Boot image
creation, the :term:`UBOOT_LOADADDRESS` variable is passed as a
command-line parameter to the ``uboot-mkimage`` utility.
- To pass a 64 bit address for FIT image creation, you will need to set
- the :term:`FIT_ADDRESS_CELLS` variable too.
+ To pass a 64 bit address, you will also need to set:
+
+ - The :term:`FIT_ADDRESS_CELLS` variable for FIT image creation.
+ - The :term:`UBOOT_FIT_ADDRESS_CELLS` variable for U-Boot FIT image creation.
This variable is used by the :ref:`ref-classes-kernel-fitimage`,
:ref:`ref-classes-kernel-uimage`, :ref:`ref-classes-kernel`,