15649 2024-11-15 22:21:38 +0000 uboot-sign does not produce U-Boot binary with public key 2026-01-10 14:57:03 +0000 1 1 7 Build System, Metadata & Runtime OE-Core configuration unspecified BeagleBone Multiple IN PROGRESS REVIEW NIR 01/10 Medium normal Future 1 ccasciato unassigned denis kexin.hao randy.macleod --- --- No (bug/feature does not impact docs) oldest_to_newest 100191 0 ccasciato 2024-11-15 22:21:38 +0000 Reproducible in the master branch (and Scarthgap) poky/build/conf$ diff local.conf{.sample,} 33c33 < #MACHINE ?= "beaglebone-yocto" --- > MACHINE ?= "beaglebone-yocto" 39c39 < MACHINE ??= "qemux86-64" --- > #MACHINE ??= "qemux86-64" 289a290,300 > > UBOOT_SIGN_ENABLE = "1" > UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000" > > FIT_GENERATE_KEYS = "1" > UBOOT_SIGN_KEYDIR = "${TOPDIR}" > UBOOT_SIGN_KEYNAME = "dev" > > KERNEL_IMAGETYPES += " fitImage " > > KERNEL_CLASSES += "kernel-fitimage" As expected, the public key is in a DTB: poky/build/tmp/deploy/images/beaglebone-yocto$ hexdump -e "16 \"%_p\" \"\\n\"" u-boot-beaglebone-yocto.dtb | tr -d '\n' | grep -o 'key-dev' key-dev Unexpectedly, the public key is not in the U-Boot binary: poky/build/tmp/deploy/images/beaglebone-yocto$ hexdump -e "16 \"%_p\" \"\\n\"" u-boot.img | tr -d '\n' | grep -o 'key-dev' I have a local workaround by bypassing the first logic branch starting with: if [ "x${UBOOT_SUFFIX}" = "ximg" -o "x${UBOOT_SUFFIX}" = "xrom" ] In other words, the simple concatenation binary + signed DTB concatenation in this logic branch works as expected: elif [ -e "${UBOOT_NODTB_BINARY}" -a -e "${UBOOT_DTB_BINARY}" ]; then Post-patch results: poky/build/tmp/deploy/images/beaglebone-yocto$ hexdump -e "16 \"%_p\" \"\\n\"" u-boot-beaglebone-yocto.dtb | tr -d '\n' | grep -o 'key-dev' key-dev poky/build/tmp/deploy/images/beaglebone-yocto$ hexdump -e "16 \"%_p\" \"\\n\"" u-boot.img | tr -d '\n' | grep -o 'key-dev' key-dev 100244 1 randy.macleod 2024-11-21 16:44:30 +0000 Clayton, Can you send a patch to openembedded-core@lists.openembedded.org ? See: https://docs.yoctoproject.org/dev/contributor-guide/submit-changes.html 100252 2 ccasciato 2024-11-22 15:07:48 +0000 Hi, Randy! I've submitted a patch and CC'd a few folks. https://lists.openembedded.org/g/openembedded-core/message/207623 100274 3 ccasciato 2024-11-26 15:24:26 +0000 Patch has been accepted to master: https://git.openembedded.org/openembedded-core/commit/meta/classes-recipe/uboot-sign.bbclass?id=0d14e99aa18ee38293df63d585fafc270a4538be 100381 4 denis 2024-12-06 22:28:14 +0000 This may fix beaglebone-yocto case, but the change now breaks most of TI platforms in meta-ti that use uboot-sign, rendering them unbootable. Still investigating the actual root-cause... 100390 5 ccasciato 2024-12-09 13:04:57 +0000 Revert is in master-next: https://git.openembedded.org/openembedded-core/commit/?h=master-next&id=5e82d33451b5662df1e7fe2518a50644d18aa70d 100432 6 randy.macleod 2024-12-12 16:14:20 +0000 Clayton, Will you be able to work with people to revise your patch to avoid the problmes identified? Thanks, -- Randy / YP Bug review 100701 7 ccasciato 2025-01-20 18:47:09 +0000 There have been some significant updates such as the U-Boot upgrade to 2025.01 https://git.openembedded.org/openembedded-core/commit/meta/recipes-bsp/u-boot/u-boot_2025.01.bb?id=e16a24f04b56ca3fec6509a3286e2e3bb5c21c1e This includes a potentially-relevant change: "Makefile: pass external DTB provided by make variable EXT_DTB to binman" https://github.com/u-boot/u-boot/commit/f27e83062956c3b09d2ee3ea3b3c815f9d57e42d Here is U-Boot's "Verified Boot on the Beaglebone Black": https://github.com/u-boot/u-boot/blob/v2025.01/doc/usage/fit/beaglebone_vboot.rst I'm still seeing the same results: poky$ git log -1 --oneline 15d005ccbf (HEAD -> master, origin/master, origin/HEAD) test-manual/reproducible-builds: fix reproducible links poky/build/tmp/deploy/images/beaglebone-yocto$ hexdump -e "16 \"%_p\" \"\\n\"" u-boot-beaglebone-yocto.dtb | tr -d '\n' | grep -o 'key-dev' poky/build/tmp/deploy/images/beaglebone-yocto$ hexdump -e "16 \"%_p\" \"\\n\"" u-boot.img | tr -d '\n' | grep -o 'key-dev' -- Debugging: poky$ git diff diff --git a/meta/classes-recipe/uboot-sign.bbclass b/meta/classes-recipe/uboot-sign.bbclass index a17be745ce..7feefe52c3 100644 --- a/meta/classes-recipe/uboot-sign.bbclass +++ b/meta/classes-recipe/uboot-sign.bbclass @@ -101,6 +101,7 @@ python() { } concat_dtb() { + set -x type="$1" binary="$2" @@ -139,6 +140,7 @@ concat_dtb() { bbwarn "Failure while adding public key to u-boot binary. Verified boot won't be available." fi fi + set +x } deploy_dtb() { -- Select snippets from work/beaglebone_yocto-poky-linux-gnueabi/u-boot/2025.01/temp/log.do_uboot_assemble_fitimage: DEBUG: Executing shell function do_uboot_assemble_fitimage + type= + binary=u-boot.img + [ -e u-boot.dtb ] + uboot-mkimage -D -I dts -O dtb -p 2000 -F -k [SNIP]/poky/build -K u-boot.dtb -r [SNIP]/poky/build/tmp/work/beaglebone_yocto-poky-linux-gnueabi/u-boot/2025.01/build/fitImage-linux Failed to add verification data for 'signature-1' signature node in 'conf-am335x-bone.dtb' configuration node [...] Signature written to '[SNIP]/poky/build/tmp/work/beaglebone_yocto-poky-linux-gnueabi/u-boot/2025.01/build/fitImage-linux', node '/configurations/conf-am335x-bonegreen.dtb/signature-1' Public key written to 'u-boot.dtb', node '/signature/key-dev' + uboot-fit_check_sign -k u-boot.dtb -f [SNIP]/poky/build/tmp/work/beaglebone_yocto-poky-linux-gnueabi/u-boot/2025.01/build/fitImage-linux Signature check OK Verifying Hash Integrity for node 'conf-am335x-bone.dtb'... sha256,rsa2048:dev+ [...] Could not find subimage node type 'ramdisk' + cp u-boot.dtb u-boot.dtb-signed [...] + [ 0 != 1 ] + [ ximg = ximg -o ximg = xrom ] + [ -e u-boot.dtb ] + oe_runmake EXT_DTB=u-boot.dtb-signed all + oe_runmake_call EXT_DTB=u-boot.dtb-signed all [...] cat u-boot.dtb-signed > dts/dt.dtb ./tools/mkimage -f auto -A arm -T firmware -C none -O u-boot -a 0x80800000 -e 0x80800000 -p 0x0 -n "U-Boot 2025.01 for am335x board" -E -b arch/arm/dts/am335x-evm.dtb -b arch/arm/dts/am335x-bone.dtb -b arch/arm/dts/am335x-sancloud-bbe.dtb -b arch/arm/dts/am335x-sancloud-bbe-lite.dtb -b arch/arm/dts/am335x-sancloud-bbe-extended-wifi.dtb -b arch/arm/dts/am335x-boneblack.dtb -b arch/arm/dts/am335x-evmsk.dtb -b arch/arm/dts/am335x-bonegreen.dtb -b arch/arm/dts/am335x-icev2.dtb -b arch/arm/dts/am335x-pocketbeagle.dtb -d u-boot-nodtb.bin u-boot.img >/dev/null && cat /dev/null cat u-boot-nodtb.bin dts/dt.dtb > u-boot-dtb.bin cp u-boot-dtb.bin u-boot.bin [...] cp dts/dt.dtb u-boot.dtb ./tools/mkimage -f auto -A arm -T firmware -C none -O u-boot -a 0x80800000 -e 0x80800000 -p 0x0 -n "U-Boot 2025.01 for am335x board" -E -b arch/arm/dts/am335x-evm.dtb -b arch/arm/dts/am335x-bone.dtb -b arch/arm/dts/am335x-sancloud-bbe.dtb -b arch/arm/dts/am335x-sancloud-bbe-lite.dtb -b arch/arm/dts/am335x-sancloud-bbe-extended-wifi.dtb -b arch/arm/dts/am335x-boneblack.dtb -b arch/arm/dts/am335x-evmsk.dtb -b arch/arm/dts/am335x-bonegreen.dtb -b arch/arm/dts/am335x-icev2.dtb -b arch/arm/dts/am335x-pocketbeagle.dtb -d u-boot-nodtb.bin u-boot-dtb.img >/dev/null && cat /dev/null [SNIP]/poky/build/tmp/work/beaglebone_yocto-poky-linux-gnueabi/u-boot/2025.01/git/scripts/check-of.sh .config [SNIP]/poky/build/tmp/work/beaglebone_yocto-poky-linux-gnueabi/u-boot/2025.01/git/scripts/of_allowlist.txt + [ -n u-boot.img ] + cp u-boot.img u-boot-.img + set +x DEBUG: Shell function do_uboot_assemble_fitimage finished Interesting findings: 1. "Failed to add verification data for 'signature-1' signature node in 'conf-am335x-bone.dtb' configuration node" 2. The type is passed as "", which causes this line: "+ cp u-boot.img u-boot-.img" 3. This looks promising: cat u-boot.dtb-signed > dts/dt.dtb cat u-boot-nodtb.bin dts/dt.dtb > u-boot-dtb.bin cp dts/dt.dtb u-boot.dtb From poky/build/tmp/work/beaglebone_yocto-poky-linux-gnueabi/u-boot/2025.01/build: How many top-level results? $ find . -maxdepth 1 -type f | xargs hexdump -e "16 \"%_p\" \"\\n\"" | tr -d '\n' | grep -o 'key-dev' | uniq -c 4 key-dev Which ones? $ hexdump -e "16 \"%_p\" \"\\n\"" {u-boot.dtb,u-boot.dtb-signed,u-boot-dtb.bin,u-boot.bin} | tr -d '\n' | grep -o 'key-dev' | uniq -c 4 key-dev