patch rootfs to add drivers

This commit is contained in:
ading2210 2023-10-06 21:28:40 -07:00
parent 3f996e63a9
commit a804bbabc7
6 changed files with 41 additions and 673 deletions

View File

@ -146,5 +146,6 @@ main() {
done
}
trap - EXIT
main "$@"
sleep 1d

View File

@ -8,6 +8,7 @@ if [ "$DEBUG" ]; then
fi
. ./patch_initramfs.sh
. ./patch_rootfs.sh
. ./build_image.sh
print_help() {
@ -28,7 +29,7 @@ if [ "$EUID" -ne 0 ]; then
exit 1
fi
if [ -z "$1" ]; then
if [ -z "$3" ]; then
print_help
exit 1
fi
@ -89,7 +90,7 @@ patch_initramfs $initramfs_dir
echo "creating disk image"
rootfs_size=$(du -sm $rootfs_dir | cut -f 1)
rootfs_part_size=$(($rootfs_size * 11 / 10 + 10))
rootfs_part_size=$(($rootfs_size * 11 / 10 + 50))
#create a 20mb bootloader partition
#rootfs partition is 10% larger than its contents
create_image $output_path 20 $rootfs_part_size
@ -100,8 +101,19 @@ image_loop=$(create_loop ${output_path})
echo "creating partitions on the disk image"
create_partitions $image_loop "${kernel_dir}/kernel.bin"
echo "mounting the original shim rootfs"
shim_rootfs="/tmp/shim_rootfs"
make_mountable "${shim_loop}p3"
safe_mount "${shim_loop}p3" $shim_rootfs
echo "copying data into the image"
populate_partitions $image_loop $initramfs_dir $rootfs_dir
rootfs_mount=/tmp/new_rootfs
populate_partitions $image_loop $initramfs_dir $rootfs_dir $rootfs_mount
echo "copying modules into the rootfs"
patch_rootfs $shim_rootfs $rootfs_mount || echo "failed patching rootfs"
umount $rootfs_mount
umount $shim_rootfs
echo "cleaning up loop devices"
losetup -d $shim_loop

View File

@ -11,10 +11,9 @@ create_loop() {
echo $loop_device
}
#useful in the future... maybe
#original shim rootfses have a non standard ext2 filesystem
make_mountable() {
sh lib/ssd_util.sh --no_resign_kernel --remove_rootfs_verification -i $1
printf '\000' | dd of=$1 seek=$((0x464 + 3)) conv=notrunc count=1 bs=1
printf '\000' | dd of=$1 seek=$((0x464 + 3)) conv=notrunc count=1 bs=1 status=none
}
#set required flags on the kernel partition
@ -96,6 +95,7 @@ populate_partitions() {
local image_loop=$(realpath "${1}")
local bootloader_dir=$(realpath "${2}")
local rootfs_dir=$(realpath "${3}")
local rootfs_mount=$(realpath "${4}")
#mount and write empty file to stateful
local stateful_mount=/tmp/shim_stateful
@ -110,10 +110,9 @@ populate_partitions() {
cp -r $bootloader_dir/* $bootloader_mount
umount $bootloader_mount
local rootfs_mount=/tmp/shim_rootfs
#write rootfs to image
safe_mount "${image_loop}p4" $rootfs_mount
cp -r $rootfs_dir/* $rootfs_mount
umount $rootfs_mount
}
create_image() {

View File

@ -1,664 +0,0 @@
#!/bin/sh
#original: https://github.com/MercuryWorkshop/sh1mmer/blob/beautifulworld/wax/lib/ssd_util.sh
# this is a modified version of make_dev_ssd from cros. it allows the script to be run on any linux device and adds extra utility
#
# Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
#
# This script can change key (usually developer keys) and kernel config
# of kernels on an disk image (usually for SSD but also works for USB).
SCRIPT_BASE="$(dirname "$0")"
. "$SCRIPT_BASE/common_minimal.sh"
load_shflags || exit 1
# Constants used by DEFINE_*
VBOOT_BASE='/usr/share/vboot'
DEFAULT_KEYS_FOLDER="$VBOOT_BASE/devkeys"
DEFAULT_PARTITIONS='2 4'
# Only store backup in stateful partition if available.
if [ -d /mnt/stateful_partition ]; then
DEFAULT_BACKUP_FOLDER="/mnt/stateful_partition"
else
DEFAULT_BACKUP_FOLDER="$(pwd)"
fi
DEFAULT_BACKUP_FOLDER="${DEFAULT_BACKUP_FOLDER}/cros_sign_backups"
# TODO(hungte) The default image selection is no longer a SSD, so the script
# works more like "make_dev_image". We may change the file name in future.
ROOTDEV="$(rootdev -s 2>/dev/null)"
ROOTDEV_PARTITION="$(echo $ROOTDEV | sed -n 's/.*[^0-9]\([0-9][0-9]*\)$/\1/p')"
ROOTDEV_DISK="$(rootdev -s -d 2>/dev/null)"
ROOTDEV_KERNEL="$((ROOTDEV_PARTITION - 1))"
# DEFINE_string name default_value description flag
DEFINE_string image "$ROOTDEV_DISK" "Path to device or image file" "i"
DEFINE_string keys "$DEFAULT_KEYS_FOLDER" "Path to folder of dev keys" "k"
DEFINE_boolean remove_rootfs_verification \
"${FLAGS_FALSE}" "Modify kernel boot config to disable rootfs verification" \
"r"
DEFINE_boolean unlock_arch \
"${FLAGS_FALSE}" "Unlock arch"
DEFINE_boolean lock_root \
"${FLAGS_FALSE}" "lock rootfs"
DEFINE_boolean lock_arch \
"${FLAGS_FALSE}" "lock arch"
DEFINE_boolean enable_earlycon "${FLAGS_FALSE}" \
"Enable earlycon from stdout-path (ARM/ARM64) or SPCR (x86)." ""
DEFINE_boolean disable_earlycon "${FLAGS_FALSE}" \
"Disable earlycon." ""
DEFINE_boolean enable_console "${FLAGS_FALSE}" \
"Enable serial console." ""
DEFINE_boolean disable_console "${FLAGS_FALSE}" \
"Disable serial console." ""
DEFINE_string backup_dir \
"$DEFAULT_BACKUP_FOLDER" "Path of directory to store kernel backups" ""
DEFINE_string save_config "" \
"Base filename to store kernel configs to, instead of resigning." ""
DEFINE_string set_config "" \
"Base filename to load kernel configs from" ""
DEFINE_boolean edit_config "${FLAGS_FALSE}" \
"Edit kernel config in-place." ""
DEFINE_string partitions "" \
"List of partitions to examine (default: $DEFAULT_PARTITIONS)" ""
DEFINE_boolean recovery_key "$FLAGS_FALSE" \
"Use recovery key to sign image (to boot from USB)" ""
DEFINE_boolean force "$FLAGS_FALSE" \
"Skip validity checks and make the change" "f"
DEFINE_boolean default_rw_root "${FLAGS_TRUE}" \
"When --remove_rootfs_verification is set, change root mount option to RW." ""
DEFINE_boolean no_resign_kernel "${FLAGS_FALSE}" \
"make changes without resigning the kernel" ""
# Parse command line
FLAGS "$@" || exit 1
ORIGINAL_CMD="$0"
ORIGINAL_PARAMS="$@"
eval set -- "$FLAGS_ARGV"
ORIGINAL_PARTITIONS="$FLAGS_partitions"
: ${FLAGS_partitions:=$DEFAULT_PARTITIONS}
# Globals
# ----------------------------------------------------------------------------
set -e
# a log file to keep the output results of executed command
EXEC_LOG="$(make_temp_file)"
# Functions
# ----------------------------------------------------------------------------
# Removes rootfs verification from kernel boot parameter
# And strip out bootcache args if it exists
remove_rootfs_verification() {
local new_root="PARTUUID=%U/PARTNROFF=1"
# the first line in sed is to strip out bootcache details
local rw_root_opt="s| ro | rw |"
if [ "${FLAGS_default_rw_root}" = "${FLAGS_FALSE}" ]; then
rw_root_opt="s| rw | ro |"
fi
echo "$*" | sed '
s| dm=\"2 [^"]*bootcache[^"]* vroot | dm=\"1 vroot |
s| root=/dev/dm-[0-9] | root='"$new_root"' |
s| dm_verity.dev_wait=1 | dm_verity.dev_wait=0 |
s| payload=PARTUUID=%U/PARTNROFF=1 | payload=ROOT_DEV |
s| hashtree=PARTUUID=%U/PARTNROFF=1 | hashtree=HASH_DEV |
'"${rw_root_opt}"
}
remove_legacy_boot_rootfs_verification() {
# See src/scripts/create_legacy_bootloader_templates
local image="$1"
local mount_point="$(make_temp_dir)"
local config_file
debug_msg "Removing rootfs verification for legacy boot configuration."
mount_image_partition "$image" 12 "$mount_point" || return $FLAGS_FALSE
config_file="$mount_point/efi/boot/grub.cfg"
[ ! -f "${config_file}" ] ||
sudo sed -i -e 's/^ *defaultA=2 *$/defaultA=0/g' \
-e 's/^ *defaultB=3 *$/defaultB=1/g' "${config_file}"
config_file="$mount_point/syslinux/default.cfg"
[ ! -f "$config_file" ] ||
sudo sed -i 's/-vusb/-usb/g; s/-vhd/-hd/g' "$config_file"
sudo umount "$mount_point"
}
# Enable/Disable earlycon or serial console
insert_parameter() {
local cmdline="$1"
local param="$2"
if [ -n "${cmdline##*${param}*}" ]; then
cmdline="${param} ${cmdline}"
fi
echo "${cmdline}"
}
remove_parameter() {
local cmdline="$1"
local param="$2"
cmdline=$(echo "${cmdline}" | sed '
s/'"${param} "'//g')
echo "${cmdline}"
}
# Wrapped version of dd
mydd() {
# oflag=sync is safer, but since we need bs=512, syncing every block would be
# very slow.
dd "$@" >"$EXEC_LOG" 2>&1 ||
die "Failed in [dd $*], Message: $(cat "${EXEC_LOG}")"
}
# Prints a more friendly name from kernel index number
cros_kernel_name() {
case $1 in
2)
echo "Kernel A"
;;
4)
echo "Kernel B"
;;
6)
echo "Kernel C"
;;
*)
echo "Partition $1"
esac
}
find_valid_kernel_partitions() {
local part_id
local valid_partitions=""
for part_id in $*; do
local name="$(cros_kernel_name $part_id)"
local kernel_part="$(make_partition_dev "$FLAGS_image" "$part_id")"
info "futil: $FUTILITY"
if [ -z "$(${FUTILITY} dump_kernel_config "$kernel_part" 2>"$EXEC_LOG")" ]; then
info "${name}: no kernel boot information, ignored." >&2
else
[ -z "$valid_partitions" ] &&
valid_partitions="$part_id" ||
valid_partitions="$valid_partitions $part_id"
continue
fi
done
debug_msg "find_valid_kernel_partitions: [$*] -> [$valid_partitions]"
echo "$valid_partitions"
}
# Resigns a kernel on SSD or image.
resign_ssd_kernel() {
local ssd_device="$1"
local bs="$(blocksize "${ssd_device}")"
# reasonable size for current kernel partition
local min_kernel_size=$((8000 * 1024 / bs))
local resigned_kernels=0
for kernel_index in $FLAGS_partitions; do
local old_blob="$(make_temp_file)"
local new_blob="$(make_temp_file)"
local name="$(cros_kernel_name $kernel_index)"
local rootfs_index="$(($kernel_index + 1))"
debug_msg "Probing $name information"
local offset size
offset="$(partoffset "$ssd_device" "$kernel_index")" ||
die "Failed to get partition ${kernel_index} offset from ${ssd_device}"
size="$(partsize "$ssd_device" "$kernel_index")" ||
die "Failed to get partition ${kernel_index} size from ${ssd_device}"
if [ ! $size -gt $min_kernel_size ]; then
info "${name} seems too small (${size}), ignored."
continue
fi
debug_msg "Reading $name from partition $kernel_index"
mydd if="$ssd_device" of="$old_blob" bs=$bs skip=$offset count=$size
debug_msg "Checking if $name is valid"
local kernel_config
if ! kernel_config="$(${FUTILITY} dump_kernel_config "$old_blob" 2>"$EXEC_LOG")"; then
debug_msg "dump_kernel_config error message: $(cat "$EXEC_LOG")"
info "${name}: no kernel boot information, ignored."
continue
fi
if [ "$FLAGS_no_resign_kernel" = "$FLAGS_TRUE" ]; then
info "Skipping resign for ${FLAGS_image}"
if [ ${FLAGS_remove_rootfs_verification} = $FLAGS_TRUE ]; then
local root_offset_sector=$(partoffset "$ssd_device" $rootfs_index)
local root_offset_bytes=$((root_offset_sector * bs))
info "dev: ${ssd_device} $root_offset_bytes"
if ! is_ext2 "$ssd_device" "$root_offset_bytes"; then
debug_msg "Non-ext2 partition: $ssd_device$rootfs_index, skip."
elif ! rw_mount_disabled "$ssd_device" "$root_offset_bytes"; then
debug_msg "Root file system is writable. No need to modify."
else
# disable the RO ext2 hack
info "Disabling rootfs ext2 RO bit hack"
enable_rw_mount "$ssd_device" "$root_offset_bytes" >"$EXEC_LOG" 2>&1 ||
die "Failed turning off rootfs RO bit. OS may be corrupted. " \
"Message: $(cat "${EXEC_LOG}")"
fi
fi
return
fi
if [ -n "${FLAGS_save_config}" ]; then
# Save current kernel config
local old_config_file
old_config_file="${FLAGS_save_config}.$kernel_index"
info "Saving ${name} config to ${old_config_file}"
echo "$kernel_config" > "$old_config_file"
# Just save; don't resign
continue
fi
if [ -n "${FLAGS_set_config}" ]; then
# Set new kernel config from file
local new_config_file
new_config_file="${FLAGS_set_config}.$kernel_index"
kernel_config="$(cat "$new_config_file")" ||
die "Failed to read new kernel config from ${new_config_file}"
debug_msg "New kernel config: $kernel_config)"
info "${name}: Replaced config from ${new_config_file}"
fi
if [ "${FLAGS_edit_config}" = ${FLAGS_TRUE} ]; then
debug_msg "Editing kernel config file."
local new_config_file="$(make_temp_file)"
echo "${kernel_config}" >"${new_config_file}"
local old_md5sum="$(md5sum "${new_config_file}")"
local editor="${VISUAL:-${EDITOR:-vi}}"
info "${name}: Editing kernel config:"
# On ChromiumOS, some builds may come with broken EDITOR that refers to
# nano so we want to check again if the editor really exists.
if type "${editor}" >/dev/null 2>&1; then
"${editor}" "${new_config_file}"
else
# This script runs under dash but we want readline in bash to support
# editing in in console.
bash -c "read -e -i '${kernel_config}' &&
echo \"\${REPLY}\" >${new_config_file}" ||
die "Failed to run editor. Please specify editor name by VISUAL."
fi
kernel_config="$(cat "${new_config_file}")"
if [ "$(md5sum "${new_config_file}")" = "${old_md5sum}" ]; then
info "${name}: Config not changed."
else
debug_msg "New kernel config: ${kernel_config})"
info "${name}: Config updated"
fi
fi
if [ ${FLAGS_remove_rootfs_verification} = $FLAGS_FALSE ]; then
debug_msg "Bypassing rootfs verification check"
else
debug_msg "Changing boot parameter to remove rootfs verification"
kernel_config="$(remove_rootfs_verification "$kernel_config")"
debug_msg "New kernel config: $kernel_config"
info "${name}: Disabled rootfs verification."
remove_legacy_boot_rootfs_verification "$ssd_device"
fi
if [ "${FLAGS_enable_earlycon}" = "${FLAGS_TRUE}" ]; then
debug_msg "Enabling earlycon"
kernel_config="$(insert_parameter "${kernel_config}" "earlycon")"
debug_msg "New kernel config: ${kernel_config}"
elif [ "${FLAGS_disable_earlycon}" = "${FLAGS_TRUE}" ]; then
debug_msg "Disabling earlycon"
kernel_config="$(remove_parameter "${kernel_config}" "earlycon")"
debug_msg "New kernel config: ${kernel_config}"
fi
if [ "${FLAGS_enable_console}" = "${FLAGS_TRUE}" ]; then
debug_msg "Enabling serial console"
kernel_config="$(remove_parameter "${kernel_config}" "console=")"
debug_msg "New kernel config: ${kernel_config}"
elif [ "${FLAGS_disable_console}" = "${FLAGS_TRUE}" ]; then
debug_msg "Disabling serial console"
kernel_config="$(insert_parameter "${kernel_config}" "console=")"
debug_msg "New kernel config: ${kernel_config}"
fi
local new_kernel_config_file="$(make_temp_file)"
echo -n "$kernel_config" >"$new_kernel_config_file"
debug_msg "Re-signing $name from $old_blob to $new_blob"
debug_msg "Using key: $KERNEL_DATAKEY"
vbutil_kernel \
--repack "$new_blob" \
--keyblock "$KERNEL_KEYBLOCK" \
--config "$new_kernel_config_file" \
--signprivate "$KERNEL_DATAKEY" \
--oldblob "$old_blob" >"$EXEC_LOG" 2>&1 ||
die "Failed to resign ${name}. Message: $(cat "${EXEC_LOG}")"
debug_msg "Creating new kernel image (vboot+code+config)"
local new_kern="$(make_temp_file)"
cp "$old_blob" "$new_kern"
mydd if="$new_blob" of="$new_kern" conv=notrunc
if is_debug_mode; then
debug_msg "for debug purposes, check *.dbgbin"
cp "$old_blob" old_blob.dbgbin
cp "$new_blob" new_blob.dbgbin
cp "$new_kern" new_kern.dbgbin
fi
debug_msg "Verifying new kernel and keys"
vbutil_kernel \
--verify "$new_kern" \
--signpubkey "$KERNEL_PUBKEY" --verbose >"$EXEC_LOG" 2>&1 ||
die "Failed to verify new ${name}. Message: $(cat "${EXEC_LOG}")"
debug_msg "Backup old kernel blob"
local backup_date_time="$(date +'%Y%m%d_%H%M%S')"
local backup_name="$(echo "$name" | sed 's/ /_/g; s/^K/k/')"
local backup_file_name="${backup_name}_${backup_date_time}.bin"
local backup_file_path="$FLAGS_backup_dir/$backup_file_name"
if mkdir -p "$FLAGS_backup_dir" &&
cp -f "$old_blob" "$backup_file_path"; then
info "Backup of ${name} is stored in: ${backup_file_path}"
else
warn "Cannot create file in ${FLAGS_backup_dir} ... Ignore backups."
fi
debug_msg "Writing $name to partition $kernel_index"
mydd \
if="$new_kern" \
of="$ssd_device" \
seek=$offset \
bs=$bs \
count=$size \
conv=notrunc
resigned_kernels=$(($resigned_kernels + 1))
debug_msg "Make the root file system writable if needed."
# TODO(hungte) for safety concern, a more robust way would be to:
# (1) change kernel config to ro
# (2) check if we can enable rw mount
# (3) change kernel config to rw
if [ ${FLAGS_lock_root} = $FLAGS_TRUE ]; then
local root_offset_sector=$(partoffset "$ssd_device" $rootfs_index)
local root_offset_bytes=$((root_offset_sector * bs))
# enable the RO ext2 hack
if ! is_ext2 "$ssd_device" "$root_offset_bytes"; then
debug_msg "Non-ext2 partition: $ssd_device$rootfs_index, skip."
else
echo "Re-enabling the ext2 hack :trolley:"
disable_rw_mount "$ssd_device" "$root_offset_bytes" >"$EXEC_LOG" 2>&1 ||
die "Failed turning off rootfs RO bit. OS may be corrupted. " \
"Message: $(cat "${EXEC_LOG}")"
fi
fi
if [ ${FLAGS_lock_arch} = $FLAGS_TRUE ]; then
local root_offset_sector=$(partoffset "$ssd_device" 13)
local root_offset_bytes=$((root_offset_sector * bs))
# enable the RO ext2 hack
if ! is_ext2 "$ssd_device" "$root_offset_bytes"; then
debug_msg "Non-ext2 partition: $ssd_device$rootfs_index, skip."
else
echo "Locking arch partition"
disable_rw_mount "$ssd_device" "$root_offset_bytes" >"$EXEC_LOG" 2>&1 ||
die "Failed turning off rootfs RO bit. OS may be corrupted. " \
"Message: $(cat "${EXEC_LOG}")"
fi
fi
if [ ${FLAGS_unlock_arch} = $FLAGS_TRUE ]; then
local root_offset_sector=$(partoffset "$ssd_device" 13)
local root_offset_bytes=$((root_offset_sector * bs))
# enable the RO ext2 hack
if ! is_ext2 "$ssd_device" "$root_offset_bytes"; then
echo "Non-ext2 partition: $ssd_device$rootfs_index, skip."
else
echo "unlocking arch partition"
enable_rw_mount "$ssd_device" "$root_offset_bytes" >"$EXEC_LOG" 2>&1 ||
die "Failed turning off rootfs RO bit. OS may be corrupted. " \
"Message: $(cat "${EXEC_LOG}")"
fi
fi
if [ ${FLAGS_remove_rootfs_verification} = $FLAGS_TRUE ]; then
local root_offset_sector=$(partoffset "$ssd_device" $rootfs_index)
local root_offset_bytes=$((root_offset_sector * bs))
if ! is_ext2 "$ssd_device" "$root_offset_bytes"; then
debug_msg "Non-ext2 partition: $ssd_device$rootfs_index, skip."
elif ! rw_mount_disabled "$ssd_device" "$root_offset_bytes"; then
debug_msg "Root file system is writable. No need to modify."
else
# disable the RO ext2 hack
info "Disabling rootfs ext2 RO bit hack"
enable_rw_mount "$ssd_device" "$root_offset_bytes" >"$EXEC_LOG" 2>&1 ||
die "Failed turning off rootfs RO bit. OS may be corrupted. " \
"Message: $(cat "${EXEC_LOG}")"
fi
fi
# Sometimes doing "dump_kernel_config" or other I/O now (or after return to
# shell) will get the data before modification. Not a problem now, but for
# safety, let's try to sync more.
sync; sync; sync
info "${name}: Re-signed with developer keys successfully."
done
# If we saved the kernel config, exit now so we don't print an error
if [ -n "${FLAGS_save_config}" ]; then
info "(Kernels have not been resigned.)"
exit 0
fi
return $resigned_kernels
}
validity_check_crossystem_flags() {
debug_msg "crossystem validity check"
if [ -n "${FLAGS_save_config}" ]; then
debug_msg "not resigning kernel."
return
fi
if [ "$(crossystem dev_boot_signed_only)" = "0" ]; then
debug_msg "dev_boot_signed_only not set - safe."
return
fi
echo "
ERROR: YOUR FIRMWARE WILL ONLY BOOT SIGNED IMAGES.
Modifying the kernel or root filesystem will result in an unusable system. If
you really want to make this change, allow the firmware to boot self-signed
images by running:
sudo crossystem dev_boot_signed_only=0
before re-executing this command.
"
return $FLAGS_FALSE
}
validity_check_live_partitions() {
debug_msg "Partition validity check"
if [ "$FLAGS_partitions" = "$ROOTDEV_KERNEL" ]; then
debug_msg "only for current active partition - safe."
return
fi
if [ "$ORIGINAL_PARTITIONS" != "" ]; then
debug_msg "user has assigned partitions - provide more info."
info "Making change to ${FLAGS_partitions} on ${FLAGS_image}."
return
fi
echo "
ERROR: YOU ARE TRYING TO MODIFY THE LIVE SYSTEM IMAGE $FLAGS_image.
The system may become unusable after that change, especially when you have
some auto updates in progress. To make it safer, we suggest you to only
change the partition you have booted with. To do that, re-execute this command
as:
sudo $ORIGINAL_CMD $ORIGINAL_PARAMS --partitions $ROOTDEV_KERNEL
If you are sure to modify other partition, please invoke the command again and
explicitly assign only one target partition for each time (--partitions N )
"
return $FLAGS_FALSE
}
validity_check_live_firmware() {
debug_msg "Firmware compatibility validity check"
if [ "$(crossystem mainfw_type)" = "developer" ]; then
debug_msg "developer type firmware in active."
return
fi
debug_msg "Loading firmware to check root key..."
local bios_image="$(make_temp_file)"
local rootkey_file="$(make_temp_file)"
info "checking system firmware..."
sudo flashrom -p host -i GBB -r "$bios_image" >/dev/null 2>&1
futility gbb -g --rootkey="$rootkey_file" "$bios_image" >/dev/null 2>&1
if [ ! -s "$rootkey_file" ]; then
debug_msg "failed to read root key from system firmware..."
else
# The magic 130 is counted by "od dev-rootkey" for the lines until the body
# of key is reached. Trailing bytes (0x00 or 0xFF - both may appear, and
# that's why we need to skip them) are started at line 131.
# TODO(hungte) compare with rootkey in $VBOOT_BASE directly.
local rootkey_hash="$(od "$rootkey_file" |
head -130 | md5sum |
sed 's/ .*$//' )"
if [ "$rootkey_hash" = "a13642246ef93daaf75bd791446fec9b" ]; then
debug_msg "detected DEV root key in firmware."
return
else
debug_msg "non-devkey hash: $rootkey_hash"
fi
fi
echo "
ERROR: YOU ARE NOT USING DEVELOPER FIRMWARE, AND RUNNING THIS COMMAND MAY
THROW YOUR CHROMEOS DEVICE INTO UN-BOOTABLE STATE.
You need to either install developer firmware, or change system root key.
- To install developer firmware: type command
sudo chromeos-firmwareupdate --mode=todev
- To change system rootkey: disable firmware write protection (a hardware
switch) and then type command:
sudo $SCRIPT_BASE/make_dev_firmware.sh
If you are sure that you want to make such image without developer
firmware or you've already changed system root keys, please run this
command again with --force paramemeter:
sudo $ORIGINAL_CMD --force $ORIGINAL_PARAMS
"
return $FLAGS_FALSE
}
validity_check() {
validity_check_live_partitions || return $FLAGS_FALSE
# Remaining checks depend on firmware; skip if device is running in a VM.
if crossystem 'inside_vm?1'; then
debug_msg "Device is a VM, skipping firmware checks"
return $FLAGS_TRUE
fi
validity_check_live_firmware || return $FLAGS_FALSE
validity_check_crossystem_flags || return $FLAGS_FALSE
return $FLAGS_TRUE
}
# Main
# ----------------------------------------------------------------------------
main() {
local num_signed=0
local num_given=$(echo "$FLAGS_partitions" | wc -w)
local kaltdir=$(dirname $0)/keys
if [ -d "$kaltdir" ]; then
FLAGS_keys=$kaltdir
fi
# Check parameters
if [ "$FLAGS_recovery_key" = "$FLAGS_TRUE" ]; then
KERNEL_KEYBLOCK="$FLAGS_keys/recovery_kernel.keyblock"
KERNEL_DATAKEY="$FLAGS_keys/recovery_kernel_data_key.vbprivk"
KERNEL_PUBKEY="$FLAGS_keys/recovery_key.vbpubk"
else
KERNEL_KEYBLOCK="$FLAGS_keys/kernel.keyblock"
KERNEL_DATAKEY="$FLAGS_keys/kernel_data_key.vbprivk"
KERNEL_PUBKEY="$FLAGS_keys/kernel_subkey.vbpubk"
fi
debug_msg "Prerequisite check"
ensure_files_exist \
"$KERNEL_KEYBLOCK" \
"$KERNEL_DATAKEY" \
"$KERNEL_PUBKEY" \
"$FLAGS_image" ||
exit 1
# checks for running on a live system image.
if [ "$FLAGS_image" = "$ROOTDEV_DISK" ]; then
debug_msg "check valid kernel partitions for live system"
local valid_partitions="$(find_valid_kernel_partitions $FLAGS_partitions)"
[ -n "$valid_partitions" ] ||
die "No valid kernel partitions on ${FLAGS_image} (${FLAGS_partitions})."
FLAGS_partitions="$valid_partitions"
# Validity checks
if [ "$FLAGS_force" = "$FLAGS_TRUE" ]; then
echo "
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
! INFO: ALL VALIDITY CHECKS WERE BYPASSED. YOU ARE ON YOUR OWN. !
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
" >&2
local i
for i in $(seq 5 -1 1); do
echo -n "\rStart in $i second(s) (^C to abort)... " >&2
sleep 1
done
echo ""
elif ! validity_check; then
die "IMAGE ${FLAGS_image} IS NOT MODIFIED."
fi
fi
resign_ssd_kernel "$FLAGS_image" || num_signed=$?
debug_msg "Complete."
if [ $num_signed -gt 0 -a $num_signed -le $num_given ]; then
# signed something at least
info "Successfully re-signed ${num_signed} of ${num_given} kernel(s)" \
" on device ${FLAGS_image}."
info "Please remember to reboot before updating the kernel on this device."
else
if [ "$FLAGS_no_resign_kernel" = "$FLAGS_FALSE" ]; then
die "Failed re-signing kernels."
fi
fi
}
# People using this to process images may forget to add "-i",
# so adding parameter check is safer.
if [ "$#" -gt 0 ]; then
flags_help
die "Unknown parameters: $*"
fi
main

View File

@ -8,7 +8,7 @@ if [ "$DEBUG" ]; then
fi
patch_initramfs() {
initramfs_path=$(realpath $1)
local initramfs_path=$(realpath $1)
rm "${initramfs_path}/init" -f
cp -r bootloader/* "${initramfs_path}/"

20
patch_rootfs.sh Executable file
View File

@ -0,0 +1,20 @@
#!/bin/bash
#patch the target rootfs to add any needed drivers
set -e
if [ "$DEBUG" ]; then
set -x
fi
patch_rootfs() {
local shim_rootfs=$(realpath $1)
local target_rootfs=$(realpath $2)
cp -r "${shim_rootfs}/lib/modules/"* "${target_rootfs}/lib/modules/"
cp -r "${shim_rootfs}/lib/modprobe.d/"* "${target_rootfs}/lib/modprobe.d/"
cp -r "${shim_rootfs}/etc/modprobe.d/"* "${target_rootfs}/etc/modprobe.d/"
cp -r "${shim_rootfs}/lib/firmware/"* "${target_rootfs}/lib/firmware/"
}
patch_rootfs $1 $2