mirror of
https://git.yoctoproject.org/poky
synced 2026-03-05 23:09:39 +01:00
d6858c9f45
The U-Boot signing code is a bit of a mess. The problem is that mkimage
determines the public keys to embed into a device tree based on an image
that it is signing. This results in all sorts of contortions: U-Boot has to
be available to the kernel recipe so that it can have the correct public
keys embedded. Then, the signed U-Boot has to be made available to U-Boot's
do_deploy. This same dance is then repeated for SPL. To complicate matters,
signing for U-Boot and U-Boot SPL is optional, so the whole process must be
seamlessly integrated with a non-signed build.
The complexity and interdependency of this process makes it difficult to
extend. For example, it is not possible to install a signed U-Boot binary
into the root filesystem. This is first because u-boot:do_install must run
before linux:do_assemble_fitimage, which must run before u-boot:do_deploy.
But aside from infrastructure issues, installing a signed U-Boot also can't
happen, because the kernel image might have an embedded initramfs
(containing the signed U-Boot).
However, all of this complexity is accidental. It is not necessary to embed
the public keys into U-Boot and sign the kernel in one fell swoop. Instead,
we can sign the kernel, stage it, and sign the staged kernel again to embed
the public keys into U-Boot [1]. This twice-signed kernel serves only to
provide the correct parameters to mkimage, and does not have to be
installed or deployed. By cutting the dependency of
linux:do_assemble_fitimage on u-boot:do_install, we can drastically
simplify the build process, making it much more extensible.
The process of doing this conversion is a bit involved, since the U-Boot
and Linux recipes are so intertwined at the moment. The most major change
is that uboot-sign is no longer inherited by kernel-fitimage. Similarly,
all U-Boot-related tasks have been removed from kernel-fitimage. We add a
new step to the install task to stage the kernel in /sysroot-only. The
logic to disable assemble_fitimage has been removed. We always assemble it,
even if the final fitImage will use a bundled initramfs, because U-Boot
will need it.
On the U-Boot side, much of the churn stems from multiple config support.
Previously, we took a fairly ad-hoc approach to UBOOT_CONFIG and
UBOOT_MACHINE, introducing for loops wherever we needed to deal with them.
However, I have chosen to use a much more structured approach. Each task
which needs to use the build directory uses the following pseudocode:
do_mytask() {
if ${UBOOT_CONFIG}; then
for config, type in zip(${UBOOT_CONFIG}, ${UBOOT_MACHINE}); do
cd ${config}
mytask_helper ${type}
done
else
cd ${B}
mytask_helper ""
fi
}
By explicitly placing the work in mytask_helper, we make it easier to
ensure that everything is covered, and we also allow bbappends files to
more easily extend the task (as otherwise they would need to reimplement
the loop themselves).
[1] It doesn't particularly matter what we sign. Any FIT will do, but I
chose the kernel's because we already went to the trouble of setting it up
with the correct hashes and signatures. In the future, we could create a
"dummy" image and sign that instead, but it would probably have to happen
in the kernel recipe anyway (so we have access to the appropriate
variables).
(From OE-Core rev: 5e12dc911d0c541f43aa6d0c046fb87e8b7c1f7e)
Signed-off-by: Sean Anderson <sean.anderson@seco.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
144 lines
5.8 KiB
Plaintext
144 lines
5.8 KiB
Plaintext
# Handle U-Boot config for a machine
|
|
#
|
|
# The format to specify it, in the machine, is:
|
|
#
|
|
# UBOOT_CONFIG ??= <default>
|
|
# UBOOT_CONFIG[foo] = "config,images,binary"
|
|
#
|
|
# or
|
|
#
|
|
# UBOOT_MACHINE = "config"
|
|
#
|
|
# Copyright 2013, 2014 (C) O.S. Systems Software LTDA.
|
|
#
|
|
# SPDX-License-Identifier: MIT
|
|
|
|
|
|
def removesuffix(s, suffix):
|
|
if suffix and s.endswith(suffix):
|
|
return s[:-len(suffix)]
|
|
return s
|
|
|
|
UBOOT_ENTRYPOINT ?= "20008000"
|
|
UBOOT_LOADADDRESS ?= "${UBOOT_ENTRYPOINT}"
|
|
|
|
# Some versions of u-boot use .bin and others use .img. By default use .bin
|
|
# but enable individual recipes to change this value.
|
|
UBOOT_SUFFIX ??= "bin"
|
|
UBOOT_BINARY ?= "u-boot.${UBOOT_SUFFIX}"
|
|
UBOOT_BINARYNAME ?= "${@os.path.splitext(d.getVar("UBOOT_BINARY"))[0]}"
|
|
UBOOT_IMAGE ?= "${UBOOT_BINARYNAME}-${MACHINE}-${PV}-${PR}.${UBOOT_SUFFIX}"
|
|
UBOOT_SYMLINK ?= "${UBOOT_BINARYNAME}-${MACHINE}.${UBOOT_SUFFIX}"
|
|
UBOOT_MAKE_TARGET ?= "all"
|
|
|
|
# Output the ELF generated. Some platforms can use the ELF file and directly
|
|
# load it (JTAG booting, QEMU) additionally the ELF can be used for debugging
|
|
# purposes.
|
|
UBOOT_ELF ?= ""
|
|
UBOOT_ELF_SUFFIX ?= "elf"
|
|
UBOOT_ELF_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.${UBOOT_ELF_SUFFIX}"
|
|
UBOOT_ELF_BINARY ?= "u-boot.${UBOOT_ELF_SUFFIX}"
|
|
UBOOT_ELF_SYMLINK ?= "u-boot-${MACHINE}.${UBOOT_ELF_SUFFIX}"
|
|
|
|
# Some versions of u-boot build an SPL (Second Program Loader) image that
|
|
# should be packaged along with the u-boot binary as well as placed in the
|
|
# deploy directory. For those versions they can set the following variables
|
|
# to allow packaging the SPL.
|
|
SPL_SUFFIX ?= ""
|
|
SPL_BINARY ?= ""
|
|
SPL_DELIMITER ?= "${@'.' if d.getVar("SPL_SUFFIX") else ''}"
|
|
SPL_BINARYFILE ?= "${@os.path.basename(d.getVar("SPL_BINARY"))}"
|
|
SPL_BINARYNAME ?= "${@removesuffix(d.getVar("SPL_BINARYFILE"), "." + d.getVar("SPL_SUFFIX"))}"
|
|
SPL_IMAGE ?= "${SPL_BINARYNAME}-${MACHINE}-${PV}-${PR}${SPL_DELIMITER}${SPL_SUFFIX}"
|
|
SPL_SYMLINK ?= "${SPL_BINARYNAME}-${MACHINE}${SPL_DELIMITER}${SPL_SUFFIX}"
|
|
|
|
# Additional environment variables or a script can be installed alongside
|
|
# u-boot to be used automatically on boot. This file, typically 'uEnv.txt'
|
|
# or 'boot.scr', should be packaged along with u-boot as well as placed in the
|
|
# deploy directory. Machine configurations needing one of these files should
|
|
# include it in the SRC_URI and set the UBOOT_ENV parameter.
|
|
UBOOT_ENV_SUFFIX ?= "txt"
|
|
UBOOT_ENV ?= ""
|
|
UBOOT_ENV_SRC_SUFFIX ?= "cmd"
|
|
UBOOT_ENV_SRC ?= "${UBOOT_ENV}.${UBOOT_ENV_SRC_SUFFIX}"
|
|
UBOOT_ENV_BINARY ?= "${UBOOT_ENV}.${UBOOT_ENV_SUFFIX}"
|
|
UBOOT_ENV_IMAGE ?= "${UBOOT_ENV}-${MACHINE}-${PV}-${PR}.${UBOOT_ENV_SUFFIX}"
|
|
UBOOT_ENV_SYMLINK ?= "${UBOOT_ENV}-${MACHINE}.${UBOOT_ENV_SUFFIX}"
|
|
|
|
# Default name of u-boot initial env, but enable individual recipes to change
|
|
# this value.
|
|
UBOOT_INITIAL_ENV ?= "${PN}-initial-env"
|
|
|
|
# U-Boot EXTLINUX variables. U-Boot searches for /boot/extlinux/extlinux.conf
|
|
# to find EXTLINUX conf file.
|
|
UBOOT_EXTLINUX_INSTALL_DIR ?= "/boot/extlinux"
|
|
UBOOT_EXTLINUX_CONF_NAME ?= "extlinux.conf"
|
|
UBOOT_EXTLINUX_SYMLINK ?= "${UBOOT_EXTLINUX_CONF_NAME}-${MACHINE}-${PR}"
|
|
|
|
# Options for the device tree compiler passed to mkimage '-D' feature:
|
|
UBOOT_MKIMAGE_DTCOPTS ??= ""
|
|
SPL_MKIMAGE_DTCOPTS ??= ""
|
|
|
|
# mkimage command
|
|
UBOOT_MKIMAGE ?= "uboot-mkimage"
|
|
UBOOT_MKIMAGE_SIGN ?= "${UBOOT_MKIMAGE}"
|
|
|
|
# Signature activation - this requires KERNEL_IMAGETYPE = "fitImage"
|
|
UBOOT_SIGN_ENABLE ?= "0"
|
|
|
|
# Arguments passed to mkimage for signing
|
|
UBOOT_MKIMAGE_SIGN_ARGS ?= ""
|
|
SPL_MKIMAGE_SIGN_ARGS ?= ""
|
|
|
|
# Options to deploy the u-boot device tree
|
|
UBOOT_DTB ?= ""
|
|
UBOOT_DTB_BINARY ??= ""
|
|
|
|
python () {
|
|
ubootmachine = d.getVar("UBOOT_MACHINE")
|
|
ubootconfigflags = d.getVarFlags('UBOOT_CONFIG')
|
|
ubootbinary = d.getVar('UBOOT_BINARY')
|
|
ubootbinaries = d.getVar('UBOOT_BINARIES')
|
|
# The "doc" varflag is special, we don't want to see it here
|
|
ubootconfigflags.pop('doc', None)
|
|
ubootconfig = (d.getVar('UBOOT_CONFIG') or "").split()
|
|
|
|
if not ubootmachine and not ubootconfig:
|
|
PN = d.getVar("PN")
|
|
FILE = os.path.basename(d.getVar("FILE"))
|
|
bb.debug(1, "To build %s, see %s for instructions on \
|
|
setting up your machine config" % (PN, FILE))
|
|
raise bb.parse.SkipRecipe("Either UBOOT_MACHINE or UBOOT_CONFIG must be set in the %s machine configuration." % d.getVar("MACHINE"))
|
|
|
|
if ubootmachine and ubootconfig:
|
|
raise bb.parse.SkipRecipe("You cannot use UBOOT_MACHINE and UBOOT_CONFIG at the same time.")
|
|
|
|
if ubootconfigflags and ubootbinaries:
|
|
raise bb.parse.SkipRecipe("You cannot use UBOOT_BINARIES as it is internal to uboot_config.bbclass.")
|
|
|
|
if len(ubootconfig) > 0:
|
|
for config in ubootconfig:
|
|
found = False
|
|
for f, v in ubootconfigflags.items():
|
|
if config == f:
|
|
found = True
|
|
items = v.split(',')
|
|
if items[0] and len(items) > 3:
|
|
raise bb.parse.SkipRecipe('Only config,images,binary can be specified!')
|
|
d.appendVar('UBOOT_MACHINE', ' ' + items[0])
|
|
# IMAGE_FSTYPES appending
|
|
if len(items) > 1 and items[1]:
|
|
bb.debug(1, "Appending '%s' to IMAGE_FSTYPES." % items[1])
|
|
d.appendVar('IMAGE_FSTYPES', ' ' + items[1])
|
|
if len(items) > 2 and items[2]:
|
|
bb.debug(1, "Appending '%s' to UBOOT_BINARIES." % items[2])
|
|
d.appendVar('UBOOT_BINARIES', ' ' + items[2])
|
|
else:
|
|
bb.debug(1, "Appending '%s' to UBOOT_BINARIES." % ubootbinary)
|
|
d.appendVar('UBOOT_BINARIES', ' ' + ubootbinary)
|
|
break
|
|
|
|
if not found:
|
|
raise bb.parse.SkipRecipe("The selected UBOOT_CONFIG key %s has no match in %s." % (ubootconfig, ubootconfigflags.keys()))
|
|
}
|