[v4] ref-manual: document authentication key variables

Submitted by Usama Arif on Oct. 1, 2020, 9:27 a.m. | Patch ID: 176925


Message ID 20201001092713.37930-1-usama.arif@arm.com
State New
Headers show

Commit Message

Usama Arif Oct. 1, 2020, 9:27 a.m.
This documents the variables used to create keys for
signing fitImage.

Signed-off-by: Usama Arif <usama.arif@arm.com>
 documentation/ref-manual/ref-classes.rst   |  4 +++-
 documentation/ref-manual/ref-variables.rst | 23 ++++++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

Patch hide | download patch | download mbox

diff --git a/documentation/ref-manual/ref-classes.rst b/documentation/ref-manual/ref-classes.rst
index 60ce8efd21..b007e34826 100644
--- a/documentation/ref-manual/ref-classes.rst
+++ b/documentation/ref-manual/ref-classes.rst
@@ -1413,7 +1413,9 @@  variables :term:`UBOOT_SIGN_ENABLE`, :term:`UBOOT_MKIMAGE_DTCOPTS`,
 :term:`UBOOT_SIGN_KEYDIR` and :term:`UBOOT_SIGN_KEYNAME` are set
 appropriately. The default values used for :term:`FIT_HASH_ALG` and
 :term:`FIT_SIGN_ALG` in ``kernel-fitimage`` are "sha256" and
-"rsa2048" respectively.
+"rsa2048" respectively. The keys for signing fitImage can be generated using
+the ``kernel-fitimage`` class when both :term:`FIT_GENERATE_KEYS` and
+:term:`UBOOT_SIGN_ENABLE` are set to "1".
 .. _ref-classes-kernel-grub:
diff --git a/documentation/ref-manual/ref-variables.rst b/documentation/ref-manual/ref-variables.rst
index cf37703814..2d6719df11 100644
--- a/documentation/ref-manual/ref-variables.rst
+++ b/documentation/ref-manual/ref-variables.rst
@@ -2585,13 +2585,36 @@  system and gives an overview of their function and contents.
       For guidance on how to create your own file permissions settings
       table file, examine the existing ``fs-perms.txt``.
+      Decides whether to generate the keys for signing fitImage if they
+      don't already exist. The keys are created in ``UBOOT_SIGN_KEYDIR``.
+      The default value is 0.
       Specifies the hash algorithm used in creating the FIT Image. For e.g. sha256.
+      Arguments to openssl genrsa for generating RSA private key for signing
+      fitImage. The default value is "-F4". i.e. the public exponent 65537 to
+      use.
+      Arguments to openssl req for generating certificate for signing fitImage.
+      The default value is "-batch -new". batch for non interactive mode
+      and new for generating new keys.
+      Format for public key ceritifcate used in signing fitImage.
+      The default value is "x509".
       Specifies the signature algorithm used in creating the FIT Image.
       For e.g. rsa2048.
+      Size of private key in number of bits used in fitImage. The default
+      value is "2048".
       When inheriting the :ref:`fontcache <ref-classes-fontcache>` class,
       this variable specifies the runtime dependencies for font packages.