Add a binman build -k/--keydir option and pass KEYDIR through with
that option from the top-level Makefile. FIT entries prefer this key
directory over include-dir discovery and then pass it to mkimage -k.
Signed-off-by: James Hilliard <[email protected]>
---
Makefile | 1 +
tools/binman/binman.rst | 10 +++++++-
tools/binman/cmdline.py | 2 ++
tools/binman/control.py | 1 +
tools/binman/etype/fit.py | 24 +++++++++++-------
tools/binman/ftest.py | 51 ++++++++++++++++++++++++++++++++++++---
tools/binman/state.py | 21 ++++++++++++++++
7 files changed, 97 insertions(+), 13 deletions(-)
diff --git a/Makefile b/Makefile
index d8287323c43..27be2a81e83 100644
--- a/Makefile
+++ b/Makefile
@@ -1689,6 +1689,7 @@ cmd_binman = $(srctree)/tools/binman/binman $(if
$(BINMAN_DEBUG),-D) \
-I . -I $(srctree)/board/$(BOARDDIR) -I $(srctree) \
$(foreach f,$(of_list_dirs),-I $(f)) -a of-list=$(of_list) \
$(foreach f,$(BINMAN_INDIRS),-I $(f)) \
+ $(if $(KEYDIR),-k $(KEYDIR)) \
-a atf-bl1-path=${BL1} \
-a atf-bl31-path=${BL31} \
-a tee-os-path=${TEE} \
diff --git a/tools/binman/binman.rst b/tools/binman/binman.rst
index 366491089ad..8770b279ff8 100644
--- a/tools/binman/binman.rst
+++ b/tools/binman/binman.rst
@@ -1711,7 +1711,7 @@ Usage::
binman build [-h] [-a ENTRY_ARG] [-b BOARD] [-d DT] [--fake-dtb]
[--fake-ext-blobs] [--force-missing-bintools FORCE_MISSING_BINTOOLS]
- [-i IMAGE] [-I INDIR] [-m] [-M] [-n] [-O OUTDIR] [-p] [-u]
+ [-i IMAGE] [-I INDIR] [-k KEYDIR] [-m] [-M] [-n] [-O OUTDIR] [-p] [-u]
[--update-fdt-in-elf UPDATE_FDT_IN_ELF] [-W]
Options:
@@ -1738,6 +1738,9 @@ Options:
Add a path to the list of directories to use for input files. This can be
specified multiple times to add more than one path.
+-k KEYDIR, --keydir KEYDIR
+ Directory containing keys for signing/encryption.
+
-m, --map
Output a map file for each image. See `Map files`_.
@@ -2161,6 +2164,11 @@ BINMAN_INDIRS
Sets the search path for input files used by binman by adding one or more
`-I` arguments. See :ref:`External blobs`.
+KEYDIR
+ Sets the key directory passed to FIT entries by adding a `-k` argument.
+ FIT entries use this directory for mkimage's `-k` argument when `fit,sign`
+ or `fit,encrypt` is enabled.
+
BINMAN_TOOLPATHS
Sets the search path for external tool used by binman by adding one or
more
`--toolpath` arguments. See :ref:`External tools`.
diff --git a/tools/binman/cmdline.py b/tools/binman/cmdline.py
index 9632ec115e5..cd4d05dfb69 100644
--- a/tools/binman/cmdline.py
+++ b/tools/binman/cmdline.py
@@ -128,6 +128,8 @@ controlled by a description in the board device tree.'''
help='Image filename to build (if not specified, build all)')
build_parser.add_argument('-I', '--indir', action='append',
help='Add a path to the list of directories to use for input
files')
+ build_parser.add_argument('-k', '--keydir', type=str,
+ help='Directory containing keys for signing/encryption')
build_parser.add_argument('-m', '--map', action='store_true',
default=False, help='Output a map file for each image')
build_parser.add_argument('-M', '--allow-missing', action='store_true',
diff --git a/tools/binman/control.py b/tools/binman/control.py
index 816f7c1eba2..84586d1baf1 100644
--- a/tools/binman/control.py
+++ b/tools/binman/control.py
@@ -923,6 +923,7 @@ def Binman(args):
tools.set_input_dirs(args.indir)
tools.prepare_output_dir(args.outdir, args.preserve)
state.SetEntryArgs(args.entry_arg)
+ state.SetKeydir(args.keydir)
state.SetThreads(args.threads)
images = PrepareImagesAndDtbs(dtb_fname, args.image,
diff --git a/tools/binman/etype/fit.py b/tools/binman/etype/fit.py
index f28b1e6b4cb..404e33d3022 100644
--- a/tools/binman/etype/fit.py
+++ b/tools/binman/etype/fit.py
@@ -14,6 +14,7 @@ import os
from binman.entry import Entry, EntryArg
from binman.etype.section import Entry_section
from binman import elf
+from binman import state
from dtoc import fdt_util
from dtoc.fdt import Fdt
from u_boot_pylib import tools
@@ -105,18 +106,20 @@ class Entry_fit(Entry_section):
fit,sign
Enable signing FIT images via mkimage as described in
verified-boot.rst.
- If the property is found and fit,engine is not set, the private
- keys path is detected among binman include directories and passed
to
- mkimage via -k flag. All the keys required for signing FIT must be
- available at time of signing and must be located in single include
- directory.
+ If the property is found and fit,engine is not set, the key
+ directory passed with binman build -k is passed to mkimage via the
+ -k flag. If no key directory is provided, the private keys path is
+ detected among binman include directories. All the keys required
for
+ signing FIT must be available at time of signing and must be
+ located in a single directory.
fit,encrypt
Enable data encryption in FIT images via mkimage. If the property
- is found, the keys path is detected among binman include
- directories and passed to mkimage via -k flag. All the keys
+ is found, the key directory passed with binman build -k is passed
+ to mkimage via the -k flag. If no key directory is provided, the
+ keys path is detected among binman include directories. All the
keys
required for encrypting the FIT must be available at the time of
- encrypting and must be located in a single include directory.
+ encrypting and must be located in a single directory.
Incompatible with fit,engine.
@@ -485,6 +488,8 @@ class Entry_fit(Entry_section):
includes 'generator' entries which are used to create the FIT,
but should not be processed as real entries. This is set up
once
we have the entries
+ _keydir (str): Key directory from the binman build -k option, if
+ provided
_loadables (list of str): List of generated split-elf nodes, each
a node name
_remove_props (list of str): Value of of-spl-remove-props
EntryArg,
@@ -500,6 +505,7 @@ class Entry_fit(Entry_section):
self._fit_list_prop = None
self._fit_default_dt = None
self._priv_entries = {}
+ self._keydir = state.GetKeydir()
self._loadables = []
self._remove_props = []
props = self.GetEntryArgsOrProps(
@@ -701,7 +707,7 @@ class Entry_fit(Entry_section):
args.update({'engine': engine})
# If no engine, keys must exist locally, find them
if engine is None:
- keydir = self._get_keys_dir(data)
+ keydir = self._keydir or self._get_keys_dir(data)
