diff mbox series

[v2,6/7] spl: fit: add Kconfig option to specify key-hint for fit_generator

Message ID 20200421002333.111461-7-heiko@sntech.de
State Superseded
Headers show
Series rockchip: make it possible to sign the u-boot.itb | expand

Commit Message

Heiko Stuebner April 21, 2020, 12:23 a.m. UTC
From: Heiko Stuebner <heiko.stuebner at theobroma-systems.com>

The u-boot.itb can be generated either from a static .its that can
simply include the needed signature nodes with key-hints or from a
fit-generator script referenced in CONFIG_SPL_FIT_GENERATOR.

In the script-case it will need to know what key to include for the
key-hint and specified algorithm, so add an option for that key-name.

Signed-off-by: Heiko Stuebner <heiko.stuebner at theobroma-systems.com>
Reviewed-by: Philipp Tomsich <philipp.tomsich at theobroma-systems.com>
---
changes in v2:
- add doc snippet explaining the option

 Kconfig                  |  8 ++++++++
 doc/uImage.FIT/howto.txt | 13 +++++++++++++
 2 files changed, 21 insertions(+)

Comments

Simon Glass April 21, 2020, 5:37 p.m. UTC | #1
On Mon, 20 Apr 2020 at 18:23, Heiko Stuebner <heiko at sntech.de> wrote:
>
> From: Heiko Stuebner <heiko.stuebner at theobroma-systems.com>
>
> The u-boot.itb can be generated either from a static .its that can
> simply include the needed signature nodes with key-hints or from a
> fit-generator script referenced in CONFIG_SPL_FIT_GENERATOR.
>
> In the script-case it will need to know what key to include for the
> key-hint and specified algorithm, so add an option for that key-name.
>
> Signed-off-by: Heiko Stuebner <heiko.stuebner at theobroma-systems.com>
> Reviewed-by: Philipp Tomsich <philipp.tomsich at theobroma-systems.com>
> ---
> changes in v2:
> - add doc snippet explaining the option
>
>  Kconfig                  |  8 ++++++++
>  doc/uImage.FIT/howto.txt | 13 +++++++++++++
>  2 files changed, 21 insertions(+)
>

Reviewed-by: Simon Glass <sjg at chromium.org>
Kever Yang April 28, 2020, 1:53 p.m. UTC | #2
On 2020/4/21 ??8:23, Heiko Stuebner wrote:
> From: Heiko Stuebner <heiko.stuebner at theobroma-systems.com>
>
> The u-boot.itb can be generated either from a static .its that can
> simply include the needed signature nodes with key-hints or from a
> fit-generator script referenced in CONFIG_SPL_FIT_GENERATOR.
>
> In the script-case it will need to know what key to include for the
> key-hint and specified algorithm, so add an option for that key-name.
>
> Signed-off-by: Heiko Stuebner <heiko.stuebner at theobroma-systems.com>
> Reviewed-by: Philipp Tomsich <philipp.tomsich at theobroma-systems.com>

Reviewed-by: Kever Yang <kever.yang at rock-chips.com>

Thanks,
- Kever
> ---
> changes in v2:
> - add doc snippet explaining the option
>
>   Kconfig                  |  8 ++++++++
>   doc/uImage.FIT/howto.txt | 13 +++++++++++++
>   2 files changed, 21 insertions(+)
>
> diff --git a/Kconfig b/Kconfig
> index 15a783a67d..703762d740 100644
> --- a/Kconfig
> +++ b/Kconfig
> @@ -534,6 +534,14 @@ config SPL_FIT_GENERATOR
>   	  passed a list of supported device tree file stub names to
>   	  include in the generated image.
>   
> +config SPL_FIT_GENERATOR_KEY_HINT
> +	string "key hint for signing U-Boot FIT image"
> +	depends on SPL_FIT_SIGNATURE
> +	default "dev"
> +	help
> +	  The key hint to store in both the generated .its file as well as
> +	  u-boot-key.dtb generated separately and embedded into the SPL.
> +
>   endif # SPL
>   
>   endif # FIT
> diff --git a/doc/uImage.FIT/howto.txt b/doc/uImage.FIT/howto.txt
> index 8592719685..f409b3770e 100644
> --- a/doc/uImage.FIT/howto.txt
> +++ b/doc/uImage.FIT/howto.txt
> @@ -66,6 +66,19 @@ can point to a script which generates this image source file during
>   the build process. It gets passed a list of device tree files (taken from the
>   CONFIG_OF_LIST symbol).
>   
> +Signing u-boot.itb with SPL_FIT_GENERATOR
> +-----------------------------------------
> +
> +u-boot.itb can be signed to verify the integrity of its components.
> +When CONFIG_SPL_FIT_SIGNATURE is enabled the CONFIG_SPL_FIT_SIGNATURE_KEY_DIR
> +option can be used to specifiy the key directory - either a relative or
> +absolute path.
> +
> +See signature.txt for general signature handling, but when
> +CONFIG_SPL_FIT_GENERATOR is used the option CONFIG_SPL_FIT_GENERATOR_KEY_HINT
> +can be used to specify the key-hint that should be included into the
> +created u-boot.its by the generator.
> +
>   Example 1 -- old-style (non-FDT) kernel booting
>   -----------------------------------------------
>
diff mbox series

Patch

diff --git a/Kconfig b/Kconfig
index 15a783a67d..703762d740 100644
--- a/Kconfig
+++ b/Kconfig
@@ -534,6 +534,14 @@  config SPL_FIT_GENERATOR
 	  passed a list of supported device tree file stub names to
 	  include in the generated image.
 
+config SPL_FIT_GENERATOR_KEY_HINT
+	string "key hint for signing U-Boot FIT image"
+	depends on SPL_FIT_SIGNATURE
+	default "dev"
+	help
+	  The key hint to store in both the generated .its file as well as
+	  u-boot-key.dtb generated separately and embedded into the SPL.
+
 endif # SPL
 
 endif # FIT
diff --git a/doc/uImage.FIT/howto.txt b/doc/uImage.FIT/howto.txt
index 8592719685..f409b3770e 100644
--- a/doc/uImage.FIT/howto.txt
+++ b/doc/uImage.FIT/howto.txt
@@ -66,6 +66,19 @@  can point to a script which generates this image source file during
 the build process. It gets passed a list of device tree files (taken from the
 CONFIG_OF_LIST symbol).
 
+Signing u-boot.itb with SPL_FIT_GENERATOR
+-----------------------------------------
+
+u-boot.itb can be signed to verify the integrity of its components.
+When CONFIG_SPL_FIT_SIGNATURE is enabled the CONFIG_SPL_FIT_SIGNATURE_KEY_DIR
+option can be used to specifiy the key directory - either a relative or
+absolute path.
+
+See signature.txt for general signature handling, but when
+CONFIG_SPL_FIT_GENERATOR is used the option CONFIG_SPL_FIT_GENERATOR_KEY_HINT
+can be used to specify the key-hint that should be included into the
+created u-boot.its by the generator.
+
 Example 1 -- old-style (non-FDT) kernel booting
 -----------------------------------------------