[PATCH] uboot: Fixes SPL verified boot on corner cases
Klaus Heinrich Kiwi
klaus at linux.vnet.ibm.com
Thu Apr 1 00:23:13 AEDT 2021
* The kernel-fitimage class adds a do_assemble_fitimage_initramfs task
regardless of INITRAMFS_IMAGE_BUNDLE setting, which in some cases can
result in that task running after do_uboot_assemble_fitimage and
overwriting the u-boot-spl.dtb file with the pristine version (without
public key). Fix this by making do_uboot_assemble_fitimage dependant
on both do_assemble_fitimage_* tasks, regardless of the aforementioned
setting.
* Adjust 'type' and 'os' on the U-boot fitimage its script so that
mkimage/dumpimage can recognize them.
* Move the deployment of the u-boot-spl-nodtb files outside of
concat_spl_dtb_helper(), so that we can better isolate the scenarios
of creating an (unsigned) U-Boot fitimage versus also signing it. This
prevents some stale files from being deployed in the images directory.
* Remove any u-boot-fitImage and u-boot-its files from build tree, in
case the build tree is being reused across bitbake calls.
Signed-off-by: Klaus Heinrich Kiwi <klaus at linux.vnet.ibm.com>
---
meta/classes/uboot-sign.bbclass | 41 +++++++++++++-----------
meta/lib/oeqa/selftest/cases/fitimage.py | 4 +--
2 files changed, 24 insertions(+), 21 deletions(-)
diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass
index 5f1750fdcc..85304d452e 100644
--- a/meta/classes/uboot-sign.bbclass
+++ b/meta/classes/uboot-sign.bbclass
@@ -142,19 +142,12 @@ concat_spl_dtb_helper() {
# We only deploy symlinks to the u-boot-spl.dtb,as the KERNEL_PN will
# be responsible for deploying the real file
if [ -e "${SPL_DIR}/${SPL_DTB_BINARY}" ] ; then
- deployed_spl_dtb_binary='${DEPLOY_DIR_IMAGE}/${SPL_DTB_IMAGE}'
ln -sf ${SPL_DTB_IMAGE} ${DEPLOYDIR}/${SPL_DTB_SYMLINK}
ln -sf ${SPL_DTB_IMAGE} ${DEPLOYDIR}/${SPL_DTB_BINARY}
fi
- if [ -f "${SPL_DIR}/${SPL_NODTB_BINARY}" ] ; then
- echo "Copying u-boot-nodtb binary..."
- install -m 0644 ${SPL_DIR}/${SPL_NODTB_BINARY} ${DEPLOYDIR}/${SPL_NODTB_IMAGE}
- ln -sf ${SPL_NODTB_IMAGE} ${DEPLOYDIR}/${SPL_NODTB_SYMLINK}
- ln -sf ${SPL_NODTB_IMAGE} ${DEPLOYDIR}/${SPL_NODTB_BINARY}
- fi
-
# Concatenate the SPL nodtb binary and u-boot.dtb
+ deployed_spl_dtb_binary='${DEPLOY_DIR_IMAGE}/${SPL_DTB_IMAGE}'
if [ -e "${DEPLOYDIR}/${SPL_NODTB_IMAGE}" -a -e "$deployed_spl_dtb_binary" ] ; then
cd ${DEPLOYDIR}
cat ${SPL_NODTB_IMAGE} $deployed_spl_dtb_binary | tee ${B}/${CONFIG_B_PATH}/${SPL_BINARY} > ${SPL_IMAGE}
@@ -343,8 +336,8 @@ uboot_fitimage_assemble() {
uboot {
description = "U-Boot image";
data = /incbin/("${uboot_nodtb_bin}");
- type = "uboot";
- os = "U-Boot";
+ type = "standalone";
+ os = "u-boot";
arch = "${UBOOT_ARCH}";
compression = "none";
load = <${UBOOT_LOADADDRESS}>;
@@ -438,6 +431,7 @@ do_uboot_assemble_fitimage() {
# do_assemble_fitimage task
cp -P ${STAGING_DATADIR}/u-boot-spl*.dtb ${B}
cp -P ${STAGING_DATADIR}/u-boot-nodtb*.bin ${B}
+ rm -rf ${B}/u-boot-fitImage-* ${B}/u-boot-its-*
kernel_uboot_fitimage_name=`basename ${STAGING_DATADIR}/u-boot-fitImage-*`
kernel_uboot_its_name=`basename ${STAGING_DATADIR}/u-boot-its-*`
cd ${B}
@@ -453,19 +447,30 @@ do_deploy_prepend_pn-${UBOOT_PN}() {
if [ "${UBOOT_SIGN_ENABLE}" = "1" -a -n "${UBOOT_DTB_BINARY}" ] ; then
concat_dtb
fi
- if [ "${SPL_SIGN_ENABLE}" = "1" -a -n "${SPL_DTB_BINARY}" ] ; then
- concat_spl_dtb
- fi
- # We only deploy the symlinks to the uboot-fitImage and uboot-its
- # images, as the KERNEL_PN will take care of deploying the real file
if [ "${UBOOT_FITIMAGE_ENABLE}" = "1" ] ; then
+ # Deploy the u-boot-nodtb binary and symlinks...
+ if [ -f "${SPL_DIR}/${SPL_NODTB_BINARY}" ] ; then
+ echo "Copying u-boot-nodtb binary..."
+ install -m 0644 ${SPL_DIR}/${SPL_NODTB_BINARY} ${DEPLOYDIR}/${SPL_NODTB_IMAGE}
+ ln -sf ${SPL_NODTB_IMAGE} ${DEPLOYDIR}/${SPL_NODTB_SYMLINK}
+ ln -sf ${SPL_NODTB_IMAGE} ${DEPLOYDIR}/${SPL_NODTB_BINARY}
+ fi
+
+
+ # We only deploy the symlinks to the uboot-fitImage and uboot-its
+ # images, as the KERNEL_PN will take care of deploying the real file
ln -sf ${UBOOT_FITIMAGE_IMAGE} ${DEPLOYDIR}/${UBOOT_FITIMAGE_BINARY}
ln -sf ${UBOOT_FITIMAGE_IMAGE} ${DEPLOYDIR}/${UBOOT_FITIMAGE_SYMLINK}
ln -sf ${UBOOT_ITS_IMAGE} ${DEPLOYDIR}/${UBOOT_ITS}
ln -sf ${UBOOT_ITS_IMAGE} ${DEPLOYDIR}/${UBOOT_ITS_SYMLINK}
fi
+ if [ "${SPL_SIGN_ENABLE}" = "1" -a -n "${SPL_DTB_BINARY}" ] ; then
+ concat_spl_dtb
+ fi
+
+
}
python () {
@@ -487,9 +492,7 @@ python () {
# If the Kernel fitImage is being signed, we need to
# create the U-Boot fitImage after it
if d.getVar('UBOOT_SIGN_ENABLE') == '1':
- if d.getVar('INITRAMFS_IMAGE_BUNDLE') == "1":
- d.appendVarFlag('do_uboot_assemble_fitimage', 'depends', ' %s:do_assemble_fitimage_initramfs' % d.getVar('KERNEL_PN'))
- else:
- d.appendVarFlag('do_uboot_assemble_fitimage', 'depends', ' %s:do_assemble_fitimage' % d.getVar('KERNEL_PN'))
+ d.appendVarFlag('do_uboot_assemble_fitimage', 'depends', ' %s:do_assemble_fitimage' % d.getVar('KERNEL_PN'))
+ d.appendVarFlag('do_uboot_assemble_fitimage', 'depends', ' %s:do_assemble_fitimage_initramfs' % d.getVar('KERNEL_PN'))
}
diff --git a/meta/lib/oeqa/selftest/cases/fitimage.py b/meta/lib/oeqa/selftest/cases/fitimage.py
index b911fded74..815ee48c05 100644
--- a/meta/lib/oeqa/selftest/cases/fitimage.py
+++ b/meta/lib/oeqa/selftest/cases/fitimage.py
@@ -293,7 +293,7 @@ FIT_SIGN_INDIVIDUAL = "1"
# different architectures.
its_field_check = [
'description = "A model description";',
- 'type = "uboot";',
+ 'type = "standalone";',
'load = <0x80080000>;',
'entry = <0x80080000>;',
'default = "conf";',
@@ -376,7 +376,7 @@ UBOOT_MKIMAGE_SIGN_ARGS = "-c 'a smart U-Boot comment'"
# different architectures.
its_field_check = [
'description = "A model description";',
- 'type = "uboot";',
+ 'type = "standalone";',
'load = <0x80080000>;',
'entry = <0x80080000>;',
'default = "conf";',
--
2.25.1
More information about the openbmc
mailing list