From dc26d35e0935f30af55a3d2cb5c501d1b5c35437 Mon Sep 17 00:00:00 2001 From: Klaus Heinrich Kiwi Date: Wed, 31 Mar 2021 10:23:13 -0300 Subject: uboot: Fixes SPL verified boot on corner cases * The kernel-fitimage class adds a do_assemble_fitimage_initramfs task regardless of INITRAMFS_IMAGE_BUNDLE setting, which in some cases can result in that task running after do_uboot_assemble_fitimage and overwriting the u-boot-spl.dtb file with the pristine version (without public key). Fix this by making do_uboot_assemble_fitimage dependant on both do_assemble_fitimage_* tasks, regardless of the aforementioned setting. * Adjust 'type' and 'os' on the U-boot fitimage its script so that mkimage/dumpimage can recognize them. * Move the deployment of the u-boot-spl-nodtb files outside of concat_spl_dtb_helper(), so that we can better isolate the scenarios of creating an (unsigned) U-Boot fitimage versus also signing it. This prevents some stale files from being deployed in the images directory. * Remove any u-boot-fitImage and u-boot-its files from build tree, in case the build tree is being reused across bitbake calls. Signed-off-by: Klaus Heinrich Kiwi Signed-off-by: Richard Purdie --- meta/classes/uboot-sign.bbclass | 41 +++++++++++++++++--------------- meta/lib/oeqa/selftest/cases/fitimage.py | 4 ++-- 2 files changed, 24 insertions(+), 21 deletions(-) diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass index 137ce29b43..d11882f90f 100644 --- a/meta/classes/uboot-sign.bbclass +++ b/meta/classes/uboot-sign.bbclass @@ -142,19 +142,12 @@ concat_spl_dtb_helper() { # We only deploy symlinks to the u-boot-spl.dtb,as the KERNEL_PN will # be responsible for deploying the real file if [ -e "${SPL_DIR}/${SPL_DTB_BINARY}" ] ; then - deployed_spl_dtb_binary='${DEPLOY_DIR_IMAGE}/${SPL_DTB_IMAGE}' ln -sf ${SPL_DTB_IMAGE} ${DEPLOYDIR}/${SPL_DTB_SYMLINK} ln -sf ${SPL_DTB_IMAGE} ${DEPLOYDIR}/${SPL_DTB_BINARY} fi - if [ -f "${SPL_DIR}/${SPL_NODTB_BINARY}" ] ; then - echo "Copying u-boot-nodtb binary..." - install -m 0644 ${SPL_DIR}/${SPL_NODTB_BINARY} ${DEPLOYDIR}/${SPL_NODTB_IMAGE} - ln -sf ${SPL_NODTB_IMAGE} ${DEPLOYDIR}/${SPL_NODTB_SYMLINK} - ln -sf ${SPL_NODTB_IMAGE} ${DEPLOYDIR}/${SPL_NODTB_BINARY} - fi - # Concatenate the SPL nodtb binary and u-boot.dtb + deployed_spl_dtb_binary='${DEPLOY_DIR_IMAGE}/${SPL_DTB_IMAGE}' if [ -e "${DEPLOYDIR}/${SPL_NODTB_IMAGE}" -a -e "$deployed_spl_dtb_binary" ] ; then cd ${DEPLOYDIR} cat ${SPL_NODTB_IMAGE} $deployed_spl_dtb_binary | tee ${B}/${CONFIG_B_PATH}/${SPL_BINARY} > ${SPL_IMAGE} @@ -343,8 +336,8 @@ uboot_fitimage_assemble() { uboot { description = "U-Boot image"; data = /incbin/("${uboot_nodtb_bin}"); - type = "uboot"; - os = "U-Boot"; + type = "standalone"; + os = "u-boot"; arch = "${UBOOT_ARCH}"; compression = "none"; load = <${UBOOT_LOADADDRESS}>; @@ -438,6 +431,7 @@ do_uboot_assemble_fitimage() { # do_assemble_fitimage task cp -P ${STAGING_DATADIR}/u-boot-spl*.dtb ${B} cp -P ${STAGING_DATADIR}/u-boot-nodtb*.bin ${B} + rm -rf ${B}/u-boot-fitImage-* ${B}/u-boot-its-* kernel_uboot_fitimage_name=`basename ${STAGING_DATADIR}/u-boot-fitImage-*` kernel_uboot_its_name=`basename ${STAGING_DATADIR}/u-boot-its-*` cd ${B} @@ -453,19 +447,30 @@ do_deploy_prepend_pn-${UBOOT_PN}() { if [ "${UBOOT_SIGN_ENABLE}" = "1" -a -n "${UBOOT_DTB_BINARY}" ] ; then concat_dtb fi - if [ "${SPL_SIGN_ENABLE}" = "1" -a -n "${SPL_DTB_BINARY}" ] ; then - concat_spl_dtb - fi - # We only deploy the symlinks to the uboot-fitImage and uboot-its - # images, as the KERNEL_PN will take care of deploying the real file if [ "${UBOOT_FITIMAGE_ENABLE}" = "1" ] ; then + # Deploy the u-boot-nodtb binary and symlinks... + if [ -f "${SPL_DIR}/${SPL_NODTB_BINARY}" ] ; then + echo "Copying u-boot-nodtb binary..." + install -m 0644 ${SPL_DIR}/${SPL_NODTB_BINARY} ${DEPLOYDIR}/${SPL_NODTB_IMAGE} + ln -sf ${SPL_NODTB_IMAGE} ${DEPLOYDIR}/${SPL_NODTB_SYMLINK} + ln -sf ${SPL_NODTB_IMAGE} ${DEPLOYDIR}/${SPL_NODTB_BINARY} + fi + + + # We only deploy the symlinks to the uboot-fitImage and uboot-its + # images, as the KERNEL_PN will take care of deploying the real file ln -sf ${UBOOT_FITIMAGE_IMAGE} ${DEPLOYDIR}/${UBOOT_FITIMAGE_BINARY} ln -sf ${UBOOT_FITIMAGE_IMAGE} ${DEPLOYDIR}/${UBOOT_FITIMAGE_SYMLINK} ln -sf ${UBOOT_ITS_IMAGE} ${DEPLOYDIR}/${UBOOT_ITS} ln -sf ${UBOOT_ITS_IMAGE} ${DEPLOYDIR}/${UBOOT_ITS_SYMLINK} fi + if [ "${SPL_SIGN_ENABLE}" = "1" -a -n "${SPL_DTB_BINARY}" ] ; then + concat_spl_dtb + fi + + } do_deploy_append_pn-${UBOOT_PN}() { @@ -496,9 +501,7 @@ python () { # If the Kernel fitImage is being signed, we need to # create the U-Boot fitImage after it if d.getVar('UBOOT_SIGN_ENABLE') == '1': - if d.getVar('INITRAMFS_IMAGE_BUNDLE') == "1": - d.appendVarFlag('do_uboot_assemble_fitimage', 'depends', ' %s:do_assemble_fitimage_initramfs' % d.getVar('KERNEL_PN')) - else: - d.appendVarFlag('do_uboot_assemble_fitimage', 'depends', ' %s:do_assemble_fitimage' % d.getVar('KERNEL_PN')) + d.appendVarFlag('do_uboot_assemble_fitimage', 'depends', ' %s:do_assemble_fitimage' % d.getVar('KERNEL_PN')) + d.appendVarFlag('do_uboot_assemble_fitimage', 'depends', ' %s:do_assemble_fitimage_initramfs' % d.getVar('KERNEL_PN')) } diff --git a/meta/lib/oeqa/selftest/cases/fitimage.py b/meta/lib/oeqa/selftest/cases/fitimage.py index b911fded74..815ee48c05 100644 --- a/meta/lib/oeqa/selftest/cases/fitimage.py +++ b/meta/lib/oeqa/selftest/cases/fitimage.py @@ -293,7 +293,7 @@ FIT_SIGN_INDIVIDUAL = "1" # different architectures. its_field_check = [ 'description = "A model description";', - 'type = "uboot";', + 'type = "standalone";', 'load = <0x80080000>;', 'entry = <0x80080000>;', 'default = "conf";', @@ -376,7 +376,7 @@ UBOOT_MKIMAGE_SIGN_ARGS = "-c 'a smart U-Boot comment'" # different architectures. its_field_check = [ 'description = "A model description";', - 'type = "uboot";', + 'type = "standalone";', 'load = <0x80080000>;', 'entry = <0x80080000>;', 'default = "conf";', -- cgit 1.2.3-korg