u-boot-sign:uboot-config: support to verify signed FIT image

It does not verify the signed FIT image of kernel and uboot.
To catch the unexpected errors as far as possible at the build time,
add uboot-fit-check-sign tool which is provided by u-boot to
verify the signed FIT image.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

diff --git a/meta/classes-recipe/uboot-config.bbclass b/meta/classes-recipe/uboot-config.bbclass
index 9be1d64d3ef9cb5e4b6153ebc9d189aa5fb8bd36..0c579e8861bbd02b6eabaf315e8f339dfbc1d285 100644 (file)
--- a/meta/classes-recipe/uboot-config.bbclass
+++ b/meta/classes-recipe/uboot-config.bbclass
@@ -94,6 +94,9 @@ SPL_MKIMAGE_SIGN_ARGS ?= ""
 UBOOT_DTB ?= ""
 UBOOT_DTB_BINARY ??= ""
 
+# uboot-fit_check_sign command
+UBOOT_FIT_CHECK_SIGN ?= "uboot-fit_check_sign"
+
 python () {
     ubootmachine = d.getVar("UBOOT_MACHINE")
     ubootconfigflags = d.getVarFlags('UBOOT_CONFIG')

diff --git a/meta/classes-recipe/uboot-sign.bbclass b/meta/classes-recipe/uboot-sign.bbclass
index 4b462698f9416b654def1a19a2b6fbff8391f86c..7a0b8047e4968e6a86e584a61c6ab124d57a4208 100644 (file)
--- a/meta/classes-recipe/uboot-sign.bbclass
+++ b/meta/classes-recipe/uboot-sign.bbclass
@@ -112,6 +112,10 @@ concat_dtb() {
                        -K "${UBOOT_DTB_BINARY}" \
                        -r ${B}/fitImage-linux \
                        ${UBOOT_MKIMAGE_SIGN_ARGS}
+               # Verify the kernel image and u-boot dtb
+               ${UBOOT_FIT_CHECK_SIGN} \
+                       -k "${UBOOT_DTB_BINARY}" \
+                       -f ${B}/fitImage-linux
                cp ${UBOOT_DTB_BINARY} ${UBOOT_DTB_SIGNED}
        fi
 
@@ -316,6 +320,12 @@ EOF
                        -K "${SPL_DIR}/${SPL_DTB_BINARY}" \
                        -r ${UBOOT_FITIMAGE_BINARY} \
                        ${SPL_MKIMAGE_SIGN_ARGS}
+               #
+               # Verify the U-boot FIT image and SPL dtb
+               #
+               ${UBOOT_FIT_CHECK_SIGN} \
+                       -k "${SPL_DIR}/${SPL_DTB_BINARY}" \
+                       -f ${UBOOT_FITIMAGE_BINARY}
        fi
 
        if [ -e "${SPL_DIR}/${SPL_DTB_BINARY}" ]; then