harden pieeprom-flashrom with clean up

Signed-off-by: Yann CARDAILLAC <yann.cardaillac@balena.io>

Author: ycardaillac

layers/meta-balena-raspberrypi/recipes-bsp/rpi-eeprom/files/pieeprom-flashrom.sh

@@ -10,11 +10,18 @@ set -o errexit
 # shellcheck disable=SC1091
 . /usr/libexec/os-helpers-logging
 
-NEW_IMG="${1:-pieeprom.bin}"
+NEW_IMG="${1:-pieeprom.upd}"
 CURR_IMG=pieeprom-current.bin.tmp
 CURR_IMG_PATH=/tmp
 NEW_IMG_PATH=/mnt/boot
 SPI_SPEED=16000
+SPI_DEVICE=""
+VCHIQ_UNBOUND=0
+SPI_WAS_UNBOUND=0
+SPI_IS_BOUND=0
+AUDIO_WAS_DISABLED=0
+SPI_OVERLAY_WAS_ENABLED=0
+MAILBOX_WAS_DISABLED=0
 
 # Unbind a device from a driver
 # Usage: device=$(driver_unbind <driver_path> <device_pattern>)
@@ -86,19 +93,98 @@ vchiq_unbind() {
     driver_unbind "${VCHIQ_DRIVER_PATH}" "*.mailbox"
 }
 
+cleanup() {
+    exit_code=$?
+    cleanup_failed=0
+
+    # Cleanup must be best-effort and should not fail the script.
+    set +o errexit
+
+    rm -f "${CURR_IMG_PATH}/${CURR_IMG}"
+
+    if [ "${SPI_IS_BOUND}" = "1" ] && [ -n "${SPI_DEVICE}" ]; then
+        if ! echo "${SPI_DEVICE}" > "${SPI_DRIVER_PATH}/unbind" 2>/dev/null; then
+            warn "Failed to unbind ${SPI_DEVICE} during cleanup"
+        else
+            SPI_IS_BOUND=0
+        fi
+    fi
+
+    if [ "${SPI_OVERLAY_WAS_ENABLED}" = "1" ]; then
+        /usr/bin/dtparam -d /mnt/boot/overlays/ -R spi-gpio40-45 || \
+            {
+                warn "Failed to remove spi-gpio40-45 overlay during cleanup"
+                cleanup_failed=1
+            }
+    fi
+
+    if [ "${AUDIO_WAS_DISABLED}" = "1" ]; then
+        /usr/bin/dtparam -d /mnt/boot/overlays/ audio=on || \
+            {
+                warn "Failed to restore audio=on during cleanup"
+                cleanup_failed=1
+            }
+    fi
+
+    if [ "${MAILBOX_WAS_DISABLED}" = "1" ]; then
+        /usr/bin/vcmailbox 0x00030056 4 4 1 > /dev/null || \
+            {
+                warn "Failed to restore mailbox state during cleanup"
+                cleanup_failed=1
+            }
+    fi
+
+    if [ "${SPI_WAS_UNBOUND}" = "1" ] && [ "${SPI_IS_BOUND}" = "0" ] && [ -n "${SPI_DEVICE}" ]; then
+        if ! spi_bind "${SPI_DEVICE}"; then
+            warn "Failed to restore SPI driver during cleanup"
+            cleanup_failed=1
+        fi
+    fi
+
+    # VCHIQ cannot be restored at runtime due to firmware limitations.
+    # Even with mailbox/audio restored, VideoCore services remain unavailable until reboot.
+    # https://github.com/raspberrypi/rpi-eeprom/issues/801#issuecomment-3859373151
+    if [ "${VCHIQ_UNBOUND}" = "1" ]; then
+        warn "VCHIQ was unbound during EEPROM update and cannot be restored at runtime."
+        warn "Audio, camera and other VideoCore services will not work until the next reboot."
+    fi
+
+    if [ "${exit_code}" -eq 0 ] && [ "${cleanup_failed}" -eq 1 ]; then
+        warn "EEPROM update was successful, but cleanup failed. Exiting."
+        exit 2
+    fi
+
+    exit "${exit_code}"
+}
+
+trap cleanup EXIT
+
 SPI_DEVICE=$(spi_unbind)
 if [ -z "${SPI_DEVICE}" ]; then
     fail "SPI device not found or failed to unbind, cannot proceed with EEPROM update"
 fi
+SPI_WAS_UNBOUND=1
+
+if /usr/bin/vcmailbox 0x00030056 4 4 0 > /dev/null; then
+    MAILBOX_WAS_DISABLED=1
+else
+    warn "Failed to disable mailbox before EEPROM update; continuing"
+fi
+if /usr/bin/dtparam -d /mnt/boot/overlays/ audio=off; then
+    AUDIO_WAS_DISABLED=1
+else
+    fail "Failed to disable audio before EEPROM update"
+fi
 
-/usr/bin/vcmailbox 0x00030056 4 4 0 > /dev/null || true
-/usr/bin/dtparam -d /mnt/boot/overlays/ audio=off
-/usr/bin/dtoverlay -d /mnt/boot/overlays/ spi-gpio40-45
+if /usr/bin/dtoverlay -d /mnt/boot/overlays/ spi-gpio40-45; then
+    SPI_OVERLAY_WAS_ENABLED=1
+else
+    fail "Failed to apply spi-gpio40-45 overlay before EEPROM update"
+fi
 
 # Try binding SPI; if it fails (pinctrl conflict with VCHIQ holding GPIO 40-45),
 # unbind VCHIQ and retry. VCHIQ cannot be rebound at runtime, so audio/camera
 # will be unavailable until reboot.
-VCHIQ_UNBOUND=0
 if ! spi_bind "$SPI_DEVICE"; then
     warn "Unbinding VCHIQ to release GPIO 40-45 (audio/camera will be unavailable until reboot)"
     vchiq_unbind
@@ -107,6 +193,7 @@ if ! spi_bind "$SPI_DEVICE"; then
         fail "SPI bind failed even after VCHIQ unbind, cannot proceed"
     fi
 fi
+SPI_IS_BOUND=1
 
 /usr/sbin/flashrom -p "linux_spi:dev=/dev/spidev0.0,spispeed=${SPI_SPEED}" --read "${CURR_IMG_PATH}/${CURR_IMG}"
 
@@ -120,25 +207,3 @@ else
     /usr/sbin/flashrom -p "linux_spi:dev=/dev/spidev0.0,spispeed=${SPI_SPEED}" --write "${NEW_IMG_PATH}/${NEW_IMG}"
     info "SPI EEPROM fw update successful"
 fi
-
-rm "${CURR_IMG_PATH}/${CURR_IMG}"
-
-SPI_DEVICE=$(spi_unbind)
-if [ -z "${SPI_DEVICE}" ]; then
-    fail "SPI device not found during cleanup, cannot restore system state"
-fi
-
-/usr/bin/dtparam -d /mnt/boot/overlays/ -R spi-gpio40-45
-/usr/bin/dtparam -d /mnt/boot/overlays/ audio=on
-/usr/bin/vcmailbox 0x00030056 4 4 1 > /dev/null || true
-
-if ! spi_bind "$SPI_DEVICE"; then
-    fail "Failed to restore SPI driver during cleanup"
-fi
-
-# In an ideal world we would restore the mailbox, but unfortunately this is impossible
-# https://github.com/raspberrypi/rpi-eeprom/issues/801#issuecomment-3859373151
-if [ "${VCHIQ_UNBOUND}" = "1" ]; then
-    warn "VCHIQ was unbound during EEPROM update and cannot be restored at runtime."
-    warn "Audio, camera and other VideoCore services will not work until the next reboot."
-fi

layers/meta-balena-raspberrypi/recipes-bsp/rpi-eeprom/files/pieeprom-update.sh

@@ -16,7 +16,7 @@ if type is_secured >/dev/null 2>&1 && is_secured; then
     exit 0
 fi
 
-NEW_IMG="${1:-pieeprom.bin}"
+NEW_IMG="${1:-pieeprom.upd}"
 DT_BOOTLOADER_TS="/proc/device-tree/chosen/bootloader/build-timestamp"
 # Minimum bootloader version that supports self-update (2022-04-26)
 # See https://github.com/raspberrypi/rpi-eeprom/blob/master/rpi-eeprom-update