swupdate: rework script to update U-Boot in NAND devices
Rework the script so that it has a similar structure as the MMC leaving it ready to integrate new platforms. Signed-off-by: David Escalona <david.escalona@digi.com>
This commit is contained in:
David Escalona
parent
e25f3e4f5f
commit
6d898e51f9
|
|
@ -1,7 +1,7 @@
|
||||||
#!/bin/sh
|
#!/bin/sh
|
||||||
#===============================================================================
|
#===============================================================================
|
||||||
#
|
#
|
||||||
# Copyright (C) 2022-2023 by Digi International Inc.
|
# Copyright (C) 2022-2024 by Digi International Inc.
|
||||||
# All rights reserved.
|
# All rights reserved.
|
||||||
#
|
#
|
||||||
# This program is free software; you can redistribute it and/or modify it
|
# This program is free software; you can redistribute it and/or modify it
|
||||||
|
|
@ -13,121 +13,154 @@
|
||||||
# Script will be called by swupdate to install a new u-boot within linux.
|
# Script will be called by swupdate to install a new u-boot within linux.
|
||||||
#===============================================================================
|
#===============================================================================
|
||||||
|
|
||||||
UBOOT_FILE="$1"
|
UBOOT_NAME="$1"
|
||||||
UBOOT_ENC="$2"
|
UBOOT_ENC="$2"
|
||||||
TFA_FILE="$4"
|
UBOOT_SEEK_KB="$3"
|
||||||
|
UBOOT_TFA_NAME="$4"
|
||||||
|
UBOOT_TFA_FILE="/tmp/${UBOOT_TFA_NAME}"
|
||||||
|
UBOOT_FILE="/tmp/${UBOOT_NAME}"
|
||||||
|
UBOOT_NAND_DUMP="/tmp/u-boot-dump.hex"
|
||||||
|
UBOOT_ENCRYPTED_DEK="/tmp/u-boot-encrypted-with-dek.imx"
|
||||||
|
|
||||||
echo "**** Start U-Boot update process *****"
|
DEK_FILE="/tmp/dek.bin"
|
||||||
|
DEK_KEY_SIZE="32"
|
||||||
|
DEK_BLOB_SIZE="$((DEK_KEY_SIZE + 56))" # DEK blob has an overhead of 56 bytes: header (8 bytes) + random AES-256 key (32 bytes) + MAC (16 bytes).
|
||||||
|
DEK_BLOB_HEADER="8100584" # The last byte lacks one digit on purpose, to match 40, 41 and 42; all HAB versions.
|
||||||
|
|
||||||
# need to mount debufs to remove some kobs-ng warnings
|
PLATFORM="$(tr -d '\0' </proc/device-tree/digi,machine,name)"
|
||||||
if ! grep -qs debugfs /proc/mounts; then
|
|
||||||
mount -t debugfs debugfs /sys/kernel/debug/
|
clean_artifacts ()
|
||||||
fi
|
{
|
||||||
|
rm -f "${DEK_FILE}" "${UBOOT_NAND_DUMP}" "${UBOOT_ENCRYPTED_DEK}"
|
||||||
|
}
|
||||||
|
|
||||||
|
exit_error ()
|
||||||
|
{
|
||||||
|
local ERROR_MESSAGE="$1"
|
||||||
|
local ERROR_CODE="$2"
|
||||||
|
|
||||||
|
echo "${ERROR_MESSAGE}"
|
||||||
|
clean_artifacts
|
||||||
|
[ -z "${ERROR_CODE}" ] && exit 1 || exit "${ERROR_CODE}"
|
||||||
|
}
|
||||||
|
|
||||||
|
dump_dek_ccimx6ul ()
|
||||||
|
{
|
||||||
|
local IVT_HEADER="d1 00 20 4" # The last byte lacks one digit on purpose, to match 40, 41 and 42; all HAB versions.
|
||||||
|
local UBOOT_MTD_DEV="/dev/mtd0"
|
||||||
|
|
||||||
|
# Look for U-Boot in the NAND. It starts with the IVT table header.
|
||||||
|
local UBOOT_START="0x$(hexdump -C "${UBOOT_MTD_DEV}" | grep -m 1 "${IVT_HEADER}" | head -1 | cut -c -8)"
|
||||||
|
if [ "${UBOOT_START}" = "0x" ]; then
|
||||||
|
exit_error "## ERROR: Could not find U-Boot on NAND."
|
||||||
|
fi
|
||||||
|
# DEK blob is located at the end of the image. Determine the total size of the image.
|
||||||
|
local DUMP_SIZE_OFFSET="$((UBOOT_START + 36))" # Size is located at an offset of 36 (32 bytes of IVT header + 4 bytes of image destination).
|
||||||
|
local DUMP_SIZE="$(hexdump -n 4 -s "${DUMP_SIZE_OFFSET}" -e '/4 "0x%08x" "\n"' "${UBOOT_MTD_DEV}")"
|
||||||
|
# The dump start needs to be aligned (U-Boot always leaves 0x400 for DOS table).
|
||||||
|
local DUMP_START=$((UBOOT_START - 0x400))
|
||||||
|
# Read the complete image (to skip alignment issues) and keep only the DEK blob (which is at the end).
|
||||||
|
nanddump -s "${DUMP_START}" -l "${DUMP_SIZE}" "${UBOOT_MTD_DEV}" | tail -c "${DEK_BLOB_SIZE}" > "${DEK_FILE}"
|
||||||
|
local rc=$?
|
||||||
|
if [ "${rc}" -ne 0 ]; then
|
||||||
|
exit_error "## ERROR: DEK dump to file failed." "${rc}"
|
||||||
|
fi
|
||||||
|
# Validate the DEK blob.
|
||||||
|
if ! dd if="${DEK_FILE}" bs=1 count=4 2>/dev/null | hexdump -ve '1/1 "%.2X"' | grep -q "${DEK_BLOB_HEADER}"; then
|
||||||
|
exit_error "## ERROR: Could not find DEK blob."
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
dump_dek ()
|
dump_dek ()
|
||||||
{
|
{
|
||||||
echo "**** Get DEK and append to the new u-boot *****"
|
case "${PLATFORM}" in
|
||||||
UBOOT_MTD_DEV="/dev/mtd0"
|
ccimx6ul*)
|
||||||
OUTPUT_FILE="/tmp/dek.bin"
|
dump_dek_ccimx6ul
|
||||||
KEY_SIZE_BYTES="32"
|
;;
|
||||||
ENCRYPTED_UBOOT_DEK="u-boot-encrypted-with-dek.imx"
|
*)
|
||||||
|
exit_error "## ERROR: Device not supported ${PLATFORM}."
|
||||||
#(The last byte lacks one digit on purpose, to match 40, 41 and 42; all HAB versions)
|
;;
|
||||||
UBOOT_HEADER="d1 00 20 4"
|
esac
|
||||||
DEK_BLOB_HEADER="81 00 58 4"
|
|
||||||
|
|
||||||
uboot_start="0x$(nanddump ${UBOOT_MTD_DEV} | hexdump -C | grep -m 1 "${UBOOT_HEADER}" | head -1 | cut -c -8)"
|
|
||||||
if [ "${uboot_start}" = "0x" ]; then
|
|
||||||
echo "Could not find U-Boot on NAND"
|
|
||||||
return 78
|
|
||||||
fi
|
|
||||||
|
|
||||||
uboot_size_offset=$((uboot_start + 36))
|
|
||||||
uboot_size=$(hexdump -n 4 -s ${uboot_size_offset} -e '/4 "0x%08x\t" "\n"' ${UBOOT_MTD_DEV})
|
|
||||||
# dump start needs to be aligned (U-Boot always leaves 0x400 for DOS table)
|
|
||||||
dump_start=$((uboot_start - 0x400))
|
|
||||||
# DEK blobs have an overhead of 56 bytes.
|
|
||||||
dek_blob_size=$((KEY_SIZE_BYTES + 56))
|
|
||||||
|
|
||||||
# remove the output DEK file before creating it.
|
|
||||||
# Since this function is called twice.
|
|
||||||
# For the actual upgrade and then for the validation after the upgrade.
|
|
||||||
rm -f ${OUTPUT_FILE}
|
|
||||||
# read the complete U-Boot (to skip alignment issues) and keep the dek_blob (which is at the end)
|
|
||||||
nanddump -s ${dump_start} -l ${uboot_size} ${UBOOT_MTD_DEV} | tail -c ${dek_blob_size} > ${OUTPUT_FILE}
|
|
||||||
rc=$?
|
|
||||||
if [ $rc -ne 0 ]; then
|
|
||||||
echo "DEK dump to the output file failed."
|
|
||||||
return $rc
|
|
||||||
fi
|
|
||||||
echo "dump_dek: output file has been created."
|
|
||||||
# Validate DEK blob
|
|
||||||
if [ -z "$(dd if=${OUTPUT_FILE} bs=1 count=4 2>/dev/null | hexdump -C | grep "${DEK_BLOB_HEADER}")" ]; then
|
|
||||||
echo "Could not find DEK blob"
|
|
||||||
rm -rf ${OUTPUT_FILE}
|
|
||||||
return 60
|
|
||||||
fi
|
|
||||||
echo "DEK blob correctly dumped"
|
|
||||||
return 0
|
|
||||||
}
|
}
|
||||||
|
|
||||||
install_fwu ()
|
append_dek_ccimx6ul ()
|
||||||
{
|
{
|
||||||
FLASH_DEV="$1"
|
cat "${UBOOT_FILE}" "${DEK_FILE}" > "${UBOOT_ENCRYPTED_DEK}"
|
||||||
FW_FILE="$2"
|
local rc=$?
|
||||||
|
if [ "${rc}" -ne 0 ]; then
|
||||||
flash_eraseall ${FLASH_DEV}
|
exit_error "## ERROR: Merging DEK with U-Boot image failed." "${rc}"
|
||||||
rc=$?
|
|
||||||
if [ "$rc" -ne 0 ]; then
|
|
||||||
echo "U-Boot: erasing ${FLASH_DEV} failed"
|
|
||||||
exit $rc
|
|
||||||
fi
|
|
||||||
nandwrite -p ${FLASH_DEV} /tmp/${FW_FILE}
|
|
||||||
if [ "$rc" -ne 0 ]; then
|
|
||||||
echo "U-Boot: failed to write firmware to ${FLASH_DEV}"
|
|
||||||
exit $rc
|
|
||||||
fi
|
fi
|
||||||
}
|
}
|
||||||
|
|
||||||
COMP_CCMP1=$(cat /proc/device-tree/compatible | grep "\bdigi,ccmp1\b")
|
append_dek ()
|
||||||
|
{
|
||||||
|
dump_dek
|
||||||
|
case "${PLATFORM}" in
|
||||||
|
ccimx6ul*)
|
||||||
|
append_dek_ccimx6ul
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
exit_error "## ERROR: Device not supported: ${PLATFORM}."
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
UBOOT_FILE="${UBOOT_ENCRYPTED_DEK}"
|
||||||
|
}
|
||||||
|
|
||||||
|
write_file_to_nand ()
|
||||||
|
{
|
||||||
|
local FLASH_DEV="$1"
|
||||||
|
local FW_FILE="$2"
|
||||||
|
|
||||||
|
# Sanity check.
|
||||||
|
if [ ! -c "${FLASH_DEV}" ]; then
|
||||||
|
exit_error "## ERROR: Invalid MTD partition: ${FLASH_DEV}."
|
||||||
|
fi
|
||||||
|
# Clean MTD partition.
|
||||||
|
flash_eraseall "${FLASH_DEV}"
|
||||||
|
local rc=$?
|
||||||
|
if [ "${rc}" -ne 0 ]; then
|
||||||
|
exit_error "## ERROR: Could not erase ${FLASH_DEV} partition." "${rc}"
|
||||||
|
fi
|
||||||
|
# Write file to NAND.
|
||||||
|
nandwrite -p "${FLASH_DEV}" "${FW_FILE}"
|
||||||
|
local rc=$?
|
||||||
|
if [ "${rc}" -ne 0 ]; then
|
||||||
|
exit_error "## ERROR: Could not write file to NAND." "${rc}"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
get_mtd_number_from_partition ()
|
||||||
|
{
|
||||||
|
local PARTITION_NAME="$1"
|
||||||
|
local MTD_NUM="$(sed -ne "/${PARTITION_NAME}/s,^mtd\([0-9]\+\).*,\1,g;T;p" /proc/mtd)"
|
||||||
|
|
||||||
|
echo "${MTD_NUM}"
|
||||||
|
}
|
||||||
|
|
||||||
|
# If U-Boot is encrypted, the DEK key blob needs to be extracted from existing U-Boot
|
||||||
|
# and appended to the new U-Boot before writing it.
|
||||||
if [ "${UBOOT_ENC}" = "enc" ]; then
|
if [ "${UBOOT_ENC}" = "enc" ]; then
|
||||||
if [ "${COMP_CCMP1}" = "digi,ccmp1" ]; then
|
append_dek
|
||||||
# Currently not supported for these platforms
|
fi
|
||||||
echo "*** Encrypted U-boot currently not support for CCMP1 ***"
|
# Write U-Boot
|
||||||
else
|
if expr "${PLATFORM}" : "ccmp1.*" >/dev/null; then
|
||||||
dump_dek
|
# Install TFA file in fsbl1 partition.
|
||||||
rc=$?
|
write_file_to_nand "/dev/mtd$(get_mtd_number_from_partition fsbl1)" "${UBOOT_TFA_FILE}"
|
||||||
if [ "$rc" -ne 0 ]; then
|
# Install U-Boot FIP file in fip-a partition.
|
||||||
echo "u-boot: DEK dump failed"
|
write_file_to_nand "/dev/mtd$(get_mtd_number_from_partition fip-a)" "${UBOOT_FILE}"
|
||||||
exit $rc
|
else
|
||||||
fi
|
# Mount debug file system to remove some kobs-ng warnings.
|
||||||
cat $UBOOT_FILE $OUTPUT_FILE > /tmp/$ENCRYPTED_UBOOT_DEK
|
if ! grep -qs debugfs /proc/mounts; then
|
||||||
rc=$?
|
mount -t debugfs debugfs /sys/kernel/debug/
|
||||||
if [ "$rc" -ne 0 ]; then
|
fi
|
||||||
echo "u-boot: Merging DEK with U-Boot image failed (DEV/FILE = $UBOOT_FILE)"
|
# Install U-Boot onto the Nand Flash using kobs-ng.
|
||||||
exit $rc
|
kobs-ng init -x -v "${UBOOT_FILE}"
|
||||||
fi
|
rc=$?
|
||||||
UBOOT_FILE="${ENCRYPTED_UBOOT_DEK}"
|
if [ "${rc}" -ne 0 ]; then
|
||||||
|
exit_error "## ERROR: Could not write file to NAND." "${rc}"
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
|
# Clean intermediate artifacts.
|
||||||
|
clean_artifacts
|
||||||
|
|
||||||
if [ "${COMP_CCMP1}" = "digi,ccmp1" ]; then
|
exit 0
|
||||||
# install TF-A onto fsbl1 partition
|
|
||||||
mtd_num="$(sed -ne "/fsbl1/s,^mtd\([0-9]\+\).*,\1,g;T;p" /proc/mtd)"
|
|
||||||
TFA_DEV="/dev/mtd${mtd_num}"
|
|
||||||
install_fwu ${TFA_DEV} ${TFA_FILE}
|
|
||||||
# install U-Boot onto FIP-a partition
|
|
||||||
mtd_num="$(sed -ne "/fip-a/s,^mtd\([0-9]\+\).*,\1,g;T;p" /proc/mtd)"
|
|
||||||
FIP_DEV="/dev/mtd${mtd_num}"
|
|
||||||
install_fwu ${FIP_DEV} ${UBOOT_FILE}
|
|
||||||
else
|
|
||||||
# install U-Boot onto the Nand Flash
|
|
||||||
kobs-ng init -x -v /tmp/${UBOOT_FILE}
|
|
||||||
fi
|
|
||||||
rc=$?
|
|
||||||
if [ "$rc" -ne 0 ]; then
|
|
||||||
echo "u-Boot: Updating U-Boot partition failed"
|
|
||||||
else
|
|
||||||
echo "u-Boot: Updating U-Boot partition successful"
|
|
||||||
fi
|
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue