summaryrefslogtreecommitdiffstats
path: root/meta/classes
diff options
context:
space:
mode:
authorKlaus Heinrich Kiwi <klaus@linux.vnet.ibm.com>2021-03-31 10:23:13 -0300
committerRichard Purdie <richard.purdie@linuxfoundation.org>2021-04-06 22:37:23 +0100
commit900f8676e5d3919e6e668c0958eac870e866bdff (patch)
treea827c2427aa40bbf3068b00d726cb16cb5add690 /meta/classes
parent3d13fc1f255e5a1729f9a0bfa37fb17750ba9f71 (diff)
downloadpoky-900f8676e5d3919e6e668c0958eac870e866bdff.tar.gz
uboot: Fixes SPL verified boot on corner cases
* The kernel-fitimage class adds a do_assemble_fitimage_initramfs task regardless of INITRAMFS_IMAGE_BUNDLE setting, which in some cases can result in that task running after do_uboot_assemble_fitimage and overwriting the u-boot-spl.dtb file with the pristine version (without public key). Fix this by making do_uboot_assemble_fitimage dependant on both do_assemble_fitimage_* tasks, regardless of the aforementioned setting. * Adjust 'type' and 'os' on the U-boot fitimage its script so that mkimage/dumpimage can recognize them. * Move the deployment of the u-boot-spl-nodtb files outside of concat_spl_dtb_helper(), so that we can better isolate the scenarios of creating an (unsigned) U-Boot fitimage versus also signing it. This prevents some stale files from being deployed in the images directory. * Remove any u-boot-fitImage and u-boot-its files from build tree, in case the build tree is being reused across bitbake calls. (From OE-Core rev: dc26d35e0935f30af55a3d2cb5c501d1b5c35437) Signed-off-by: Klaus Heinrich Kiwi <klaus@linux.vnet.ibm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/classes')
-rw-r--r--meta/classes/uboot-sign.bbclass41
1 files changed, 22 insertions, 19 deletions
diff --git a/meta/classes/uboot-sign.bbclass b/meta/classes/uboot-sign.bbclass
index 137ce29b43..d11882f90f 100644
--- a/meta/classes/uboot-sign.bbclass
+++ b/meta/classes/uboot-sign.bbclass
@@ -142,19 +142,12 @@ concat_spl_dtb_helper() {
142 # We only deploy symlinks to the u-boot-spl.dtb,as the KERNEL_PN will 142 # We only deploy symlinks to the u-boot-spl.dtb,as the KERNEL_PN will
143 # be responsible for deploying the real file 143 # be responsible for deploying the real file
144 if [ -e "${SPL_DIR}/${SPL_DTB_BINARY}" ] ; then 144 if [ -e "${SPL_DIR}/${SPL_DTB_BINARY}" ] ; then
145 deployed_spl_dtb_binary='${DEPLOY_DIR_IMAGE}/${SPL_DTB_IMAGE}'
146 ln -sf ${SPL_DTB_IMAGE} ${DEPLOYDIR}/${SPL_DTB_SYMLINK} 145 ln -sf ${SPL_DTB_IMAGE} ${DEPLOYDIR}/${SPL_DTB_SYMLINK}
147 ln -sf ${SPL_DTB_IMAGE} ${DEPLOYDIR}/${SPL_DTB_BINARY} 146 ln -sf ${SPL_DTB_IMAGE} ${DEPLOYDIR}/${SPL_DTB_BINARY}
148 fi 147 fi
149 148
150 if [ -f "${SPL_DIR}/${SPL_NODTB_BINARY}" ] ; then
151 echo "Copying u-boot-nodtb binary..."
152 install -m 0644 ${SPL_DIR}/${SPL_NODTB_BINARY} ${DEPLOYDIR}/${SPL_NODTB_IMAGE}
153 ln -sf ${SPL_NODTB_IMAGE} ${DEPLOYDIR}/${SPL_NODTB_SYMLINK}
154 ln -sf ${SPL_NODTB_IMAGE} ${DEPLOYDIR}/${SPL_NODTB_BINARY}
155 fi
156
157 # Concatenate the SPL nodtb binary and u-boot.dtb 149 # Concatenate the SPL nodtb binary and u-boot.dtb
150 deployed_spl_dtb_binary='${DEPLOY_DIR_IMAGE}/${SPL_DTB_IMAGE}'
158 if [ -e "${DEPLOYDIR}/${SPL_NODTB_IMAGE}" -a -e "$deployed_spl_dtb_binary" ] ; then 151 if [ -e "${DEPLOYDIR}/${SPL_NODTB_IMAGE}" -a -e "$deployed_spl_dtb_binary" ] ; then
159 cd ${DEPLOYDIR} 152 cd ${DEPLOYDIR}
160 cat ${SPL_NODTB_IMAGE} $deployed_spl_dtb_binary | tee ${B}/${CONFIG_B_PATH}/${SPL_BINARY} > ${SPL_IMAGE} 153 cat ${SPL_NODTB_IMAGE} $deployed_spl_dtb_binary | tee ${B}/${CONFIG_B_PATH}/${SPL_BINARY} > ${SPL_IMAGE}
@@ -343,8 +336,8 @@ uboot_fitimage_assemble() {
343 uboot { 336 uboot {
344 description = "U-Boot image"; 337 description = "U-Boot image";
345 data = /incbin/("${uboot_nodtb_bin}"); 338 data = /incbin/("${uboot_nodtb_bin}");
346 type = "uboot"; 339 type = "standalone";
347 os = "U-Boot"; 340 os = "u-boot";
348 arch = "${UBOOT_ARCH}"; 341 arch = "${UBOOT_ARCH}";
349 compression = "none"; 342 compression = "none";
350 load = <${UBOOT_LOADADDRESS}>; 343 load = <${UBOOT_LOADADDRESS}>;
@@ -438,6 +431,7 @@ do_uboot_assemble_fitimage() {
438 # do_assemble_fitimage task 431 # do_assemble_fitimage task
439 cp -P ${STAGING_DATADIR}/u-boot-spl*.dtb ${B} 432 cp -P ${STAGING_DATADIR}/u-boot-spl*.dtb ${B}
440 cp -P ${STAGING_DATADIR}/u-boot-nodtb*.bin ${B} 433 cp -P ${STAGING_DATADIR}/u-boot-nodtb*.bin ${B}
434 rm -rf ${B}/u-boot-fitImage-* ${B}/u-boot-its-*
441 kernel_uboot_fitimage_name=`basename ${STAGING_DATADIR}/u-boot-fitImage-*` 435 kernel_uboot_fitimage_name=`basename ${STAGING_DATADIR}/u-boot-fitImage-*`
442 kernel_uboot_its_name=`basename ${STAGING_DATADIR}/u-boot-its-*` 436 kernel_uboot_its_name=`basename ${STAGING_DATADIR}/u-boot-its-*`
443 cd ${B} 437 cd ${B}
@@ -453,19 +447,30 @@ do_deploy_prepend_pn-${UBOOT_PN}() {
453 if [ "${UBOOT_SIGN_ENABLE}" = "1" -a -n "${UBOOT_DTB_BINARY}" ] ; then 447 if [ "${UBOOT_SIGN_ENABLE}" = "1" -a -n "${UBOOT_DTB_BINARY}" ] ; then
454 concat_dtb 448 concat_dtb
455 fi 449 fi
456 if [ "${SPL_SIGN_ENABLE}" = "1" -a -n "${SPL_DTB_BINARY}" ] ; then
457 concat_spl_dtb
458 fi
459 450
460 # We only deploy the symlinks to the uboot-fitImage and uboot-its
461 # images, as the KERNEL_PN will take care of deploying the real file
462 if [ "${UBOOT_FITIMAGE_ENABLE}" = "1" ] ; then 451 if [ "${UBOOT_FITIMAGE_ENABLE}" = "1" ] ; then
452 # Deploy the u-boot-nodtb binary and symlinks...
453 if [ -f "${SPL_DIR}/${SPL_NODTB_BINARY}" ] ; then
454 echo "Copying u-boot-nodtb binary..."
455 install -m 0644 ${SPL_DIR}/${SPL_NODTB_BINARY} ${DEPLOYDIR}/${SPL_NODTB_IMAGE}
456 ln -sf ${SPL_NODTB_IMAGE} ${DEPLOYDIR}/${SPL_NODTB_SYMLINK}
457 ln -sf ${SPL_NODTB_IMAGE} ${DEPLOYDIR}/${SPL_NODTB_BINARY}
458 fi
459
460
461 # We only deploy the symlinks to the uboot-fitImage and uboot-its
462 # images, as the KERNEL_PN will take care of deploying the real file
463 ln -sf ${UBOOT_FITIMAGE_IMAGE} ${DEPLOYDIR}/${UBOOT_FITIMAGE_BINARY} 463 ln -sf ${UBOOT_FITIMAGE_IMAGE} ${DEPLOYDIR}/${UBOOT_FITIMAGE_BINARY}
464 ln -sf ${UBOOT_FITIMAGE_IMAGE} ${DEPLOYDIR}/${UBOOT_FITIMAGE_SYMLINK} 464 ln -sf ${UBOOT_FITIMAGE_IMAGE} ${DEPLOYDIR}/${UBOOT_FITIMAGE_SYMLINK}
465 ln -sf ${UBOOT_ITS_IMAGE} ${DEPLOYDIR}/${UBOOT_ITS} 465 ln -sf ${UBOOT_ITS_IMAGE} ${DEPLOYDIR}/${UBOOT_ITS}
466 ln -sf ${UBOOT_ITS_IMAGE} ${DEPLOYDIR}/${UBOOT_ITS_SYMLINK} 466 ln -sf ${UBOOT_ITS_IMAGE} ${DEPLOYDIR}/${UBOOT_ITS_SYMLINK}
467 fi 467 fi
468 468
469 if [ "${SPL_SIGN_ENABLE}" = "1" -a -n "${SPL_DTB_BINARY}" ] ; then
470 concat_spl_dtb
471 fi
472
473
469} 474}
470 475
471do_deploy_append_pn-${UBOOT_PN}() { 476do_deploy_append_pn-${UBOOT_PN}() {
@@ -496,9 +501,7 @@ python () {
496 # If the Kernel fitImage is being signed, we need to 501 # If the Kernel fitImage is being signed, we need to
497 # create the U-Boot fitImage after it 502 # create the U-Boot fitImage after it
498 if d.getVar('UBOOT_SIGN_ENABLE') == '1': 503 if d.getVar('UBOOT_SIGN_ENABLE') == '1':
499 if d.getVar('INITRAMFS_IMAGE_BUNDLE') == "1": 504 d.appendVarFlag('do_uboot_assemble_fitimage', 'depends', ' %s:do_assemble_fitimage' % d.getVar('KERNEL_PN'))
500 d.appendVarFlag('do_uboot_assemble_fitimage', 'depends', ' %s:do_assemble_fitimage_initramfs' % d.getVar('KERNEL_PN')) 505 d.appendVarFlag('do_uboot_assemble_fitimage', 'depends', ' %s:do_assemble_fitimage_initramfs' % d.getVar('KERNEL_PN'))
501 else:
502 d.appendVarFlag('do_uboot_assemble_fitimage', 'depends', ' %s:do_assemble_fitimage' % d.getVar('KERNEL_PN'))
503 506
504} 507}