uboot-sign.bbclass: fix signature and deployment

* V2
Rebase to master-next and resend.

* V1
Initial version

The following changes since commit e821100b1ee2a023b813adb20e56fe1ccc352d42:

musl: Update to latest trunk (2018-11-29 23:34:46 +0000)

are available in the git repository at:

git://git.openembedded.org/openembedded-core-contrib rbt/uboot
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=rbt/uboot

Robert Yang (1):
uboot-sign.bbclass: fix signature and deployment

 meta/classes/kernel-fitimage.bbclass | 17 ++++++-
 meta/classes/uboot-sign.bbclass      | 95 ++++++++++++++++++++----------------
 meta/recipes-bsp/u-boot/u-boot.inc   |  2 +-
 3 files changed, 69 insertions(+), 45 deletions(-)

2.7.4

Fixed:
MACHINE = "beaglebone-yocto"
KERNEL_CLASSES += "kernel-fitimage" KERNEL_IMAGETYPE_beaglebone-yocto = "fitImage" UBOOT_MACHINE_beaglebone-yocto = "am335x_boneblack_vboot_config" UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000" UBOOT_SIGN_KEYDIR = "${TOPDIR}/conf" UBOOT_SIGN_KEYNAME = "dev"
UBOOT_SIGN_ENABLE = "1"
IMAGE_INSTALL_remove = "kernel-image-zimage"

$ cd conf
$ openssl genrsa -F4 -out dev.key 2048
$ openssl req -batch -new -x509 -key dev.key -out dev.crt
$ cd ../
$ bitbake u-boot linux-yocto
$ grep signature tmp/deploy/images/beaglebone-yocto/*.dtb
Binary file tmp/deploy/images/beaglebone-yocto/u-boot-beaglebone-yocto-2018.07-r0.dtb matches
Binary file tmp/deploy/images/beaglebone-yocto/u-boot-beaglebone-yocto.dtb matches
Binary file tmp/deploy/images/beaglebone-yocto/u-boot.dtb matches

And there would be no signature info when rebuild from sstate:

$ bitbake u-boot linux-yocto -cclean
$ bitbake u-boot linux-yocto
$ grep signature tmp/deploy/images/beaglebone-yocto/*.dtb
No result

This s because kernel directly edit ${DEPLOY_DIR_IMAGE}/u-boot.dtb, (Note, it is global ${DEPLOY_DIR_IMAGE}, not recipe's DEPLOYDIR), so that the modified info is not in sstate, and would be lost when rebuild from sstate.

There are other problems in previouse code:
- The u-boot.dtb is provided by u-boot, but edited by kernel during signing, so it should be deployed by kernel rather than u-boot.

- The u-boot.do_concat_dtb directly install files to global ${DEPLOY_DIR_IMAGE}, this is incorrect, the ${DEPLOY_DIR_IMAGE} should be installed by do_deploy.

- It seems that it assumes do_deploy depends on do_install according the comments, but they have no relationships:

  # do_concat_dtb is scheduled _before_ do_install as it overwrite the
  # u-boot.bin in both DEPLOYDIR and DEPLOY_IMAGE_DIR.

- The do_concat_dtb should be run after do_compile, but it doesn't have this dependency.

Make u-boot install u-boot.dtb to ${datadir}, kernel copies u-boot.dtb from ${STAGING_DATADIR} to ${B} and deploy it can fix the problem.

[YOCTO #12112]

---
 meta/classes/kernel-fitimage.bbclass | 17 ++++++-
 meta/classes/uboot-sign.bbclass      | 95 ++++++++++++++++++++----------------
 meta/recipes-bsp/u-boot/u-boot.inc   |  2 +-
 3 files changed, 69 insertions(+), 45 deletions(-)

index 328bef4..5f6380f 100644
@@ -35,7 +35,7 @@ python __anonymous () {
         # the fitImage:
         if d.getVar('UBOOT_SIGN_ENABLE') == "1":
             uboot_pn = d.getVar('PREFERRED_PROVIDER_u-boot') or 'u-boot'
-            d.appendVarFlag('do_assemble_fitimage', 'depends', ' %s:do_deploy' % uboot_pn)
+            d.appendVarFlag('do_assemble_fitimage', 'depends', ' %s:do_populate_sysroot' % uboot_pn)
 }
 
 # Options for the device tree compiler passed to mkimage '-D' feature:

@@ -456,10 +456,17 @@ fitimage_assemble() {
 	# Step 7: Sign the image and add public key to U-Boot dtb
 	#
 	if [ "x${UBOOT_SIGN_ENABLE}" = "x1" ] ; then
+		add_key_to_u_boot=""
+		if [ -n "${UBOOT_DTB_BINARY}" ]; then
+			# The u-boot.dtb is a symlink to UBOOT_DTB_IMAGE, so we need copy
+			# both of them, and don't dereference the symlink.
+			cp -P ${STAGING_DATADIR}/u-boot*.dtb ${B}
+			add_key_to_u_boot="-K ${B}/${UBOOT_DTB_BINARY}"
+		fi
 		uboot-mkimage \
 			${@'-D "${UBOOT_MKIMAGE_DTCOPTS}"' if len('${UBOOT_MKIMAGE_DTCOPTS}') else ''} \
 			-F -k "${UBOOT_SIGN_KEYDIR}" \
-			${@'-K "${DEPLOY_DIR_IMAGE}/${UBOOT_DTB_BINARY}"' if len('${UBOOT_DTB_BINARY}') else ''} \
+			$add_key_to_u_boot \
 			-r arch/${ARCH}/boot/${2}
 	fi
 }

@@ -505,5 +512,11 @@ kernel_do_deploy_append() {
 			install -m 0644 ${B}/arch/${ARCH}/boot/fitImage-${INITRAMFS_IMAGE} ${DEPLOYDIR}/fitImage-${INITRAMFS_IMAGE_NAME}-${KERNEL_FIT_NAME}.bin
 			ln -snf fitImage-${INITRAMFS_IMAGE_NAME}-${KERNEL_FIT_NAME}.bin ${DEPLOYDIR}/fitImage-${INITRAMFS_IMAGE_NAME}-${KERNEL_FIT_LINK_NAME}
 		fi
+		if [ "${UBOOT_SIGN_ENABLE}" = "1" -a -n "${UBOOT_DTB_BINARY}" ] ; then
+			# UBOOT_DTB_IMAGE is a realfile, but we can't use
+			# ${UBOOT_DTB_IMAGE} since it contains ${PV} which is aimed
+			# for u-boot, but we are in kernel env now.
+			install -m 0644 ${B}/u-boot-${MACHINE}*.dtb ${DEPLOYDIR}/
+		fi
 	fi
 }

index 48fbc57..bbdbc25 100644
@@ -201,7 +201,7 @@ do_install () {
 
 }
 
-FILES_${PN} = "/boot ${sysconfdir}"
+FILES_${PN} = "/boot ${sysconfdir} ${datadir}"
 
 do_deploy () {
     if [ -n "${UBOOT_CONFIG}" ]

2.7.4

== Series Details ==

Series: uboot-sign.bbclass: fix signature and deployment (rev2)
Revision: 2
URL : https://patchwork.openembedded.org/series/15013/
State : failure

== Summary ==

Thank you for submitting this patch series to OpenEmbedded Core. This is an automated response. Several tests have been executed on the proposed series by patchtest resulting in the following failures:

* Issue Series does not apply on top of target branch [test_series_merge_on_head]
Suggested fix Rebase your series on top of targeted branch
Targeted branch master (currently at 21387613fe)

If you believe any of these test results are incorrect, please reply to the mailing list ([email protected]) raising your concerns. Otherwise we would appreciate you correcting the issues and submitting a new version of the patchset if applicable. Please ensure you add/increment the version number when sending the new version (i.e. [PATCH] -> [PATCH v2] -> [PATCH v3] -> ...).

---

Guidelines:     https://www.openembedded.org/wiki/Commit_Patch_Message_Guidelines
Test framework: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest
Test suite:     http://git.yoctoproject.org/cgit/cgit.cgi/patchtest-oe

This patch is for master-next, not master, so I think that we can ignore this issue.

// Robert