From patchwork Wed May 4 19:45:49 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Kiszka X-Patchwork-Id: 12838453 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 21D80C433EF for ; Wed, 4 May 2022 19:46:09 +0000 (UTC) Received: from mta-64-225.siemens.flowmailer.net (mta-64-225.siemens.flowmailer.net [185.136.64.225]) by mx.groups.io with SMTP id smtpd.web11.2072.1651693565469715264 for ; Wed, 04 May 2022 12:46:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=jan.kiszka@siemens.com header.s=fm1 header.b=lrv6sSSD; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.225, mailfrom: fm-294854-20220504194601b1a9e4189bfd714ee1-l6moe2@rts-flowmailer.siemens.com) Received: by mta-64-225.siemens.flowmailer.net with ESMTPSA id 20220504194601b1a9e4189bfd714ee1 for ; Wed, 04 May 2022 21:46:02 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=jan.kiszka@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=B1Gz+TLYxJ3TSprOo31rYjOWc/C9tv3v3IdLIcb3fMc=; b=lrv6sSSDQyBSYgoMjG3O9uRhi3a4uoxbuvL8+PLBPR4upBoeNmUEzL46F2wTRmL7AoiVlB ZyN+d8ONI63OE2xbzexlMQyyJ67H9olcCe5COnezrPK86ebZj8hI+CkpjBRCbmGK/jd/bVZL pXufeIcmEuT9wCMeLI82C/AUnoKqk=; From: Jan Kiszka To: cip-dev@lists.cip-project.org Cc: Quirin Gylstorff , Christian Storm Subject: [isar-cip-core][PATCH 01/12] initramfs-etc-overlay-hook: Improve error reporting of script Date: Wed, 4 May 2022 21:45:49 +0200 Message-Id: <4f88138887963ae36f0c54258801d4d059b37132.1651693560.git.jan.kiszka@siemens.com> In-Reply-To: References: MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-294854:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 04 May 2022 19:46:09 -0000 X-Groupsio-URL: https://lists.cip-project.org/g/cip-dev/message/8240 From: Jan Kiszka Fail loudly in case the overlay cannot be mounted. Signed-off-by: Jan Kiszka --- .../initramfs-etc-overlay-hook/files/etc-overlay.script | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/recipes-initramfs/initramfs-etc-overlay-hook/files/etc-overlay.script b/recipes-initramfs/initramfs-etc-overlay-hook/files/etc-overlay.script index a9a3663..6e5aacd 100644 --- a/recipes-initramfs/initramfs-etc-overlay-hook/files/etc-overlay.script +++ b/recipes-initramfs/initramfs-etc-overlay-hook/files/etc-overlay.script @@ -31,4 +31,6 @@ fi mkdir -p ${rootmnt}/var/local/etc mkdir -p ${rootmnt}/var/local/.atomic -mount -t overlay -o lowerdir=${rootmnt}/etc,upperdir=${rootmnt}/var/local/etc,workdir=${rootmnt}/var/local/.atomic overlay ${rootmnt}/etc +if ! mount -t overlay -o lowerdir=${rootmnt}/etc,upperdir=${rootmnt}/var/local/etc,workdir=${rootmnt}/var/local/.atomic overlay ${rootmnt}/etc; then + panic "Can't mount overlay!" +fi From patchwork Wed May 4 19:45:50 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Kiszka X-Patchwork-Id: 12838456 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3A506C433FE for ; Wed, 4 May 2022 19:46:09 +0000 (UTC) Received: from mta-64-226.siemens.flowmailer.net (mta-64-226.siemens.flowmailer.net [185.136.64.226]) by mx.groups.io with SMTP id smtpd.web12.2020.1651693565508466377 for ; Wed, 04 May 2022 12:46:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=jan.kiszka@siemens.com header.s=fm1 header.b=SjO6/Qvg; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.226, mailfrom: fm-294854-202205041946020fb76931bf7ab7f6c7-qvsggo@rts-flowmailer.siemens.com) Received: by mta-64-226.siemens.flowmailer.net with ESMTPSA id 202205041946020fb76931bf7ab7f6c7 for ; Wed, 04 May 2022 21:46:02 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=jan.kiszka@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=yc1tBJMr8NLC7gYRSH6TtnijvCrtxJTLX06pCsbi0s8=; b=SjO6/QvgqxWBocDNy2MhIRVm9DryAS+G4GgRJ27MwMldBfqs9ErzGeMsiIai5HMRR5r9R0 qGioDsrWCgheF0E8VyjdJgM0JwLgrqWN66V42j6fnCPaoeCA62j/VLxbKsplBJQKOMT0henp 2Y3WwDVbgMgTwcQQyLfq6euWYX7Nw=; From: Jan Kiszka To: cip-dev@lists.cip-project.org Cc: Quirin Gylstorff , Christian Storm Subject: [isar-cip-core][PATCH 02/12] initramfs-etc-overlay-hook: Install overlay module Date: Wed, 4 May 2022 21:45:50 +0200 Message-Id: In-Reply-To: References: MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-294854:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 04 May 2022 19:46:09 -0000 X-Groupsio-URL: https://lists.cip-project.org/g/cip-dev/message/8243 From: Jan Kiszka Needed in case overlay support is built as kernel module. Signed-off-by: Jan Kiszka --- .../files/etc-overlay.hook | 25 +++++++++++++++++++ .../initramfs-etc-overlay-hook_0.1.bb | 3 +++ 2 files changed, 28 insertions(+) create mode 100644 recipes-initramfs/initramfs-etc-overlay-hook/files/etc-overlay.hook diff --git a/recipes-initramfs/initramfs-etc-overlay-hook/files/etc-overlay.hook b/recipes-initramfs/initramfs-etc-overlay-hook/files/etc-overlay.hook new file mode 100644 index 0000000..bfaa7b6 --- /dev/null +++ b/recipes-initramfs/initramfs-etc-overlay-hook/files/etc-overlay.hook @@ -0,0 +1,25 @@ +#!/bin/sh +# +# CIP Core, generic profile +# +# Copyright (c) Siemens AG, 2022 +# +# Authors: +# Jan Kiszka +# + +PREREQ="" +prereqs() +{ + echo "$PREREQ" +} +case $1 in +prereqs) + prereqs + exit 0 + ;; +esac + +. /usr/share/initramfs-tools/hook-functions + +manual_add_modules overlay diff --git a/recipes-initramfs/initramfs-etc-overlay-hook/initramfs-etc-overlay-hook_0.1.bb b/recipes-initramfs/initramfs-etc-overlay-hook/initramfs-etc-overlay-hook_0.1.bb index 19e9261..37a04ec 100644 --- a/recipes-initramfs/initramfs-etc-overlay-hook/initramfs-etc-overlay-hook_0.1.bb +++ b/recipes-initramfs/initramfs-etc-overlay-hook/initramfs-etc-overlay-hook_0.1.bb @@ -12,6 +12,7 @@ inherit dpkg-raw SRC_URI += " \ + file://etc-overlay.hook \ file://etc-overlay.script \ " @@ -22,6 +23,8 @@ do_install[cleandirs] += " \ ${D}/usr/share/initramfs-tools/scripts/local-bottom" do_install() { + install -m 0755 "${WORKDIR}/etc-overlay.hook" \ + "${D}/usr/share/initramfs-tools/hooks/etc-overlay" install -m 0755 "${WORKDIR}/etc-overlay.script" \ "${D}/usr/share/initramfs-tools/scripts/local-bottom/etc-overlay" } From patchwork Wed May 4 19:45:51 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Kiszka X-Patchwork-Id: 12838454 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 30536C43219 for ; Wed, 4 May 2022 19:46:09 +0000 (UTC) Received: from mta-65-226.siemens.flowmailer.net (mta-65-226.siemens.flowmailer.net [185.136.65.226]) by mx.groups.io with SMTP id smtpd.web10.2074.1651693565463399558 for ; Wed, 04 May 2022 12:46:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=jan.kiszka@siemens.com header.s=fm1 header.b=bRtJXZOI; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.226, mailfrom: fm-294854-202205041946025bcbe39ebdf837f8e7-altbjm@rts-flowmailer.siemens.com) Received: by mta-65-226.siemens.flowmailer.net with ESMTPSA id 202205041946025bcbe39ebdf837f8e7 for ; Wed, 04 May 2022 21:46:02 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=jan.kiszka@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=H3LAbwPwPAClZiw/dtEOjNGKWWic7d23Z2Eev3QIIss=; b=bRtJXZOImzamVp2KZ5WzdO4r8rrCSejynAL/Rs/VCu47TNet3yWaMRNoSPalRH/iPUkXtT vB0VzSeN/KhWbZa5EMsTuFzR/GiegpcNgY4xwzYYvlVmtPhUMifycbEgqzIiMkz2x6zQTwwe uPaiAlA6Yt14zQoHSIOHeVht7aIt4=; From: Jan Kiszka To: cip-dev@lists.cip-project.org Cc: Quirin Gylstorff , Christian Storm Subject: [isar-cip-core][PATCH 03/12] initramfs-abrootfs-hook: Remove obsolete patch Date: Wed, 4 May 2022 21:45:51 +0200 Message-Id: In-Reply-To: References: MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-294854:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 04 May 2022 19:46:09 -0000 X-Groupsio-URL: https://lists.cip-project.org/g/cip-dev/message/8242 From: Jan Kiszka Forgotten to remove in f1e559498116. Signed-off-by: Jan Kiszka --- .../files/debian-local-patch | 103 ------------------ 1 file changed, 103 deletions(-) delete mode 100644 recipes-initramfs/initramfs-abrootfs-hook/files/debian-local-patch diff --git a/recipes-initramfs/initramfs-abrootfs-hook/files/debian-local-patch b/recipes-initramfs/initramfs-abrootfs-hook/files/debian-local-patch deleted file mode 100644 index cd2d271..0000000 --- a/recipes-initramfs/initramfs-abrootfs-hook/files/debian-local-patch +++ /dev/null @@ -1,103 +0,0 @@ ---- local.orig 2020-11-18 14:42:43.540055680 +0530 -+++ local 2020-11-18 20:15:48.687164540 +0530 -@@ -1,5 +1,4 @@ - # Local filesystem mounting -*- shell-script -*- -- - local_top() - { - if [ "${local_top_used}" != "yes" ]; then -@@ -152,36 +151,70 @@ - DEV="${real_dev}" - } - --local_mount_root() -+local_find_by_uuid() - { -- local_top -- if [ -z "${ROOT}" ]; then -- panic "No root device specified. Boot arguments must include a root= parameter." -- fi -- local_device_setup "${ROOT}" "root file system" -- ROOT="${DEV}" -+ partitions="$1" - -- # Get the root filesystem type if not set -- if [ -z "${ROOTFSTYPE}" ] || [ "${ROOTFSTYPE}" = auto ]; then -- FSTYPE=$(get_fstype "${ROOT}") -- else -- FSTYPE=${ROOTFSTYPE} -- fi -+ for part in $partitions; do -+ if [ "$(blkid -p ${part} --match-types novfat -s USAGE -o value)" = "filesystem" ]; then -+ local_device_setup "${part}" "root file system" -+ ROOT="${DEV}" -+ -+ # Get the root filesystem type if not set -+ if [ -z "${ROOTFSTYPE}" ] || [ "${ROOTFSTYPE}" = auto ]; then -+ FSTYPE=$(get_fstype "${ROOT}") -+ else -+ FSTYPE=${ROOTFSTYPE} -+ fi - -- local_premount -+ local_premount - -- if [ "${readonly?}" = "y" ]; then -- roflag=-r -- else -- roflag=-w -- fi -+ if [ "${readonly?}" = "y" ]; then -+ roflag=-r -+ else -+ roflag=-w -+ fi -+ checkfs "${ROOT}" root "${FSTYPE}" - -- checkfs "${ROOT}" root "${FSTYPE}" -+ # Mount root -+ # shellcheck disable=SC2086 -+ if mount ${roflag} ${FSTYPE:+-t "${FSTYPE}"} ${ROOTFLAGS} "${ROOT}" "${rootmnt?}"; then -+ if [ -e "${rootmnt?}"/etc/os-release ]; then -+ image_uuid=$(sed -n 's/^IMAGE_UUID=//p' "${rootmnt?}"/etc/os-release | tr -d '"' ) -+ if [ "${INITRAMFS_IMAGE_UUID}" = "${image_uuid}" ]; then -+ return 0 -+ fi -+ fi -+ umount "${rootmnt?}" -+ fi -+ fi -+ done -+ return 1 -+} - -- # Mount root -- # shellcheck disable=SC2086 -- if ! mount ${roflag} ${FSTYPE:+-t "${FSTYPE}"} ${ROOTFLAGS} "${ROOT}" "${rootmnt?}"; then -- panic "Failed to mount ${ROOT} as root file system." -+local_mount_root() -+{ -+ local_top -+ if [ ! -e /conf/image_uuid ]; then -+ panic "could not find image_uuid to select correct root file system" -+ fi -+ local INITRAMFS_IMAGE_UUID=$(cat /conf/image_uuid) -+ local partitions="" -+ local ret=1 -+ local timeout_uuid=0 -+ while [ "${ret}" != 0 ] && [ "${timeout_uuid}" -le 10 ]; do -+ wait_for_udev 10 -+ partitions=$(blkid -o device) -+ local_find_by_uuid "$partitions" -+ ret=$? -+ timeout_uuid="$(cat /proc/uptime)" -+ timeout_uuid="${timeout_uuid%%[. ]*}" -+ timeout_uuid=$((timeout_uuid - local_top_time)) -+ done -+ if [ "${ret}" != 0 ]; then -+ panic "Could not find ROOTFS with matching UUID $INITRAMFS_IMAGE_UUID" -+ else -+ return $ret - fi - } - From patchwork Wed May 4 19:45:52 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Kiszka X-Patchwork-Id: 12838458 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 278A8C4332F for ; Wed, 4 May 2022 19:46:09 +0000 (UTC) Received: from mta-65-227.siemens.flowmailer.net (mta-65-227.siemens.flowmailer.net [185.136.65.227]) by mx.groups.io with SMTP id smtpd.web11.2071.1651693565180170019 for ; Wed, 04 May 2022 12:46:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=jan.kiszka@siemens.com header.s=fm1 header.b=eu7YS1Oe; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.227, mailfrom: fm-294854-202205041946038ab36ca14d10a6d702-_xfwgp@rts-flowmailer.siemens.com) Received: by mta-65-227.siemens.flowmailer.net with ESMTPSA id 202205041946038ab36ca14d10a6d702 for ; Wed, 04 May 2022 21:46:03 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=jan.kiszka@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=K35Ae1gfsZ0qcjF3h4mikEhOaqCyQ0NbbkjycvX7GVc=; b=eu7YS1OehWyfllEy7hrBUtocUPUBpf0zpC3QoO+Gmq2WEvOOKVYofr1/jyyuHAkLwpHTpM LOuplsmayig2e5uRFefUMqsLwkqcnmdMvYJKvgAytKGxtvH+Y8V5McSVAtoj5Av/Z6D38CmI SMYeB3OAEAXf9WyLSLDBOBeq4TBSY=; From: Jan Kiszka To: cip-dev@lists.cip-project.org Cc: Quirin Gylstorff , Christian Storm Subject: [isar-cip-core][PATCH 04/12] Rework secure boot key handling and signing recipes Date: Wed, 4 May 2022 21:45:52 +0200 Message-Id: In-Reply-To: References: MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-294854:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 04 May 2022 19:46:09 -0000 X-Groupsio-URL: https://lists.cip-project.org/g/cip-dev/message/8239 From: Jan Kiszka Simplify the signing recipe to a single, generic one. Instead, provide secure-boot-secrets packages that contain the used image key and certificate at a well-defined location. This allows for easy reuse in other recipes than ebg-secure-boot-signer. U-Boot will be one. Rather than using the OVMF package as build-time source for the snakeoil keys, we import the two artifacts here. This allows to run the required key removal upfront and simplifies the usage for buster. The certificate has such a long lifetime that also future Debian should use the same one, thus the snakeoil artifacts of OVMF should stay in sync with our copy of key and cert. We may revisit this when discontinuing support for buster, though. Signed-off-by: Jan Kiszka --- doc/README.secureboot.md | 22 ++++---- kas/opt/ebg-secure-boot-snakeoil.yml | 7 +-- .../ebg-secure-boot-secrets_0.1.bb | 51 ------------------- .../ebg-secure-boot-secrets/files/README.md | 1 - .../files/control.tmpl | 12 ----- .../files/sign_secure_image.sh.tmpl | 22 -------- .../ebg-secure-boot-signer_0.1.bb | 26 ++++++++++ .../files/sign_secure_image.sh | 33 ++++++++++++ .../ebg-secure-boot-snakeoil_0.1.bb | 34 ------------- .../files/control.tmpl | 12 ----- .../files/sign_secure_image.sh | 36 ------------- .../files/PkKek-1-snakeoil.key | 27 ++++++++++ .../files/PkKek-1-snakeoil.pem | 21 ++++++++ .../secure-boot-key_0.1.bb | 14 +++++ .../secure-boot-secrets.inc | 34 +++++++++++++ .../secure-boot-snakeoil_0.1.bb | 17 +++++++ 16 files changed, 186 insertions(+), 183 deletions(-) delete mode 100644 recipes-devtools/ebg-secure-boot-secrets/ebg-secure-boot-secrets_0.1.bb delete mode 100644 recipes-devtools/ebg-secure-boot-secrets/files/README.md delete mode 100644 recipes-devtools/ebg-secure-boot-secrets/files/control.tmpl delete mode 100644 recipes-devtools/ebg-secure-boot-secrets/files/sign_secure_image.sh.tmpl create mode 100644 recipes-devtools/ebg-secure-boot-signer/ebg-secure-boot-signer_0.1.bb create mode 100644 recipes-devtools/ebg-secure-boot-signer/files/sign_secure_image.sh delete mode 100644 recipes-devtools/ebg-secure-boot-snakeoil/ebg-secure-boot-snakeoil_0.1.bb delete mode 100644 recipes-devtools/ebg-secure-boot-snakeoil/files/control.tmpl delete mode 100644 recipes-devtools/ebg-secure-boot-snakeoil/files/sign_secure_image.sh create mode 100644 recipes-devtools/secure-boot-secrets/files/PkKek-1-snakeoil.key create mode 100644 recipes-devtools/secure-boot-secrets/files/PkKek-1-snakeoil.pem create mode 100644 recipes-devtools/secure-boot-secrets/secure-boot-key_0.1.bb create mode 100644 recipes-devtools/secure-boot-secrets/secure-boot-secrets.inc create mode 100644 recipes-devtools/secure-boot-secrets/secure-boot-snakeoil_0.1.bb diff --git a/doc/README.secureboot.md b/doc/README.secureboot.md index b2d7be9..c1a0301 100644 --- a/doc/README.secureboot.md +++ b/doc/README.secureboot.md @@ -43,24 +43,22 @@ executable or script with the following interface: Supply the script name and path to wic by adding `signwith="` to sourceparams of the partition. -### Existing packages to sign an image +### Existing key packages for signing an image -#### ebg-secure-boot-snakeoil +#### secure-boot-snakeoil This package uses the snakeoil key and certificate from the ovmf package(0.0~20200229-2) -backported from Debian bullseye and signs the image. +backported from Debian bullseye for signing the image. -#### ebg-secure-boot-secrets -This package takes a user-generated certificate and adds it to the build system. +#### secure-boot-key + +This package takes a user-generated certificate and key adds them to the build system. The following variable and steps are necessary to build a secure boot capable image: - Set certification information to sign and verify the image with: - - SB_CERTDB: The directory containing the certificate database create with certutil - - SB_VERIFY_CERT: The certificate to verify the signing process - - SB_KEY_NAME: Name of the key in the certificate database -- if necessary change the script to select the boot partition after an update - - recipes-support/initramfs-config/files/initramfs.selectrootfs.script + - SB_CERT: The certificate to verify the signing process + - SB_KEY: The private key of for the certificate -The files referred by SB_CERTDB and SB_VERIFY_CERT must be store in `recipes-devtools/ebg-secure-boot-secrets/files/` +The files referred by SB_CERT and SB_KEY must be store in `recipes-devtools/secure-boot-secrets/files/`. ## Running in QEMU @@ -96,7 +94,7 @@ scripts/generate-sb-db-from-existing-certificate.sh ``` This will create the directory `SB_KEYDIR` and will store the `${SB_NAME}certdb` with the given name. -Copy the used certificate and database to `recipes-devtools/ebg-secure-boot-secrets/files/` +Copy the used certificate and private key to `recipes-devtools/secure-boot-secrets/files/` #### Generate keys diff --git a/kas/opt/ebg-secure-boot-snakeoil.yml b/kas/opt/ebg-secure-boot-snakeoil.yml index b329f41..7442eb7 100644 --- a/kas/opt/ebg-secure-boot-snakeoil.yml +++ b/kas/opt/ebg-secure-boot-snakeoil.yml @@ -28,6 +28,7 @@ local_conf_header: INITRAMFS_INSTALL_append = " initramfs-verity-hook" secure-boot: | - # Add snakeoil binaries for qemu - IMAGER_BUILD_DEPS += "ebg-secure-boot-snakeoil" - IMAGER_INSTALL += "ebg-secure-boot-snakeoil" + IMAGER_BUILD_DEPS += "ebg-secure-boot-signer" + IMAGER_INSTALL += "ebg-secure-boot-signer" + # Use snakeoil keys + PREFERRED_PROVIDER_secure-boot-secrets = "secure-boot-snakeoil" diff --git a/recipes-devtools/ebg-secure-boot-secrets/ebg-secure-boot-secrets_0.1.bb b/recipes-devtools/ebg-secure-boot-secrets/ebg-secure-boot-secrets_0.1.bb deleted file mode 100644 index 0d57910..0000000 --- a/recipes-devtools/ebg-secure-boot-secrets/ebg-secure-boot-secrets_0.1.bb +++ /dev/null @@ -1,51 +0,0 @@ -# -# CIP Core, generic profile -# -# Copyright (c) Siemens AG, 2020 -# -# Authors: -# Quirin Gylstorff -# -# SPDX-License-Identifier: MIT -# - -inherit dpkg-raw - -DESCRIPTION = "Add user defined secureboot certifcates to the buildchroot and the script to \ - sign an image with the given keys" - -# variables -SB_CERT_PATH = "/usr/share/ebg-secure-boot" -SB_CERTDB ??= "" -SB_VERIFY_CERT ??= "" -SB_KEY_NAME ??= "demoDB" - -# used to sign the image -DEBIAN_DEPENDS = "pesign, sbsigntool" - -# this package cannot be install together with: -DEBIAN_CONFLICTS = "ebg-secure-boot-snakeoil" - -SRC_URI = " \ - file://sign_secure_image.sh.tmpl \ - file://control.tmpl" -SRC_URI_append = " ${@ "file://"+d.getVar('SB_CERTDB') if d.getVar('SB_CERTDB') else '' }" -SRC_URI_append = " ${@ "file://"+d.getVar('SB_VERIFY_CERT') if d.getVar('SB_VERIFY_CERT') else '' }" -TEMPLATE_FILES = "sign_secure_image.sh.tmpl" -TEMPLATE_VARS += "SB_CERT_PATH SB_CERTDB SB_VERIFY_CERT SB_KEY_NAME" - -TEMPLATE_FILES += "control.tmpl" -TEMPLATE_VARS += "PN MAINTAINER DPKG_ARCH DEBIAN_DEPENDS DESCRIPTION DEBIAN_CONFLICTS" - -do_install() { - TARGET=${D}${SB_CERT_PATH} - install -m 0700 -d ${TARGET} - cp -a ${WORKDIR}/${SB_CERTDB} ${TARGET}/${SB_CERTDB} - chmod 700 ${TARGET}/${SB_CERTDB} - install -m 0600 ${WORKDIR}/${SB_VERIFY_CERT} ${TARGET}/${SB_VERIFY_CERT} - TARGET=${D}/usr/bin - install -d ${TARGET} - install -m 755 ${WORKDIR}/sign_secure_image.sh ${TARGET}/sign_secure_image.sh -} - -addtask do_install after do_transform_template diff --git a/recipes-devtools/ebg-secure-boot-secrets/files/README.md b/recipes-devtools/ebg-secure-boot-secrets/files/README.md deleted file mode 100644 index c739c51..0000000 --- a/recipes-devtools/ebg-secure-boot-secrets/files/README.md +++ /dev/null @@ -1 +0,0 @@ -For a secure boot image this directory needs to contain the certdb directory and the db.crt file. diff --git a/recipes-devtools/ebg-secure-boot-secrets/files/control.tmpl b/recipes-devtools/ebg-secure-boot-secrets/files/control.tmpl deleted file mode 100644 index 8361a49..0000000 --- a/recipes-devtools/ebg-secure-boot-secrets/files/control.tmpl +++ /dev/null @@ -1,12 +0,0 @@ -Source: ${PN} -Section: misc -Priority: optional -Standards-Version: 3.9.6 -Maintainer: ${MAINTAINER} -Build-Depends: debhelper (>= 9) - -Package: ${PN} -Architecture: ${DPKG_ARCH} -Depends: ${DEBIAN_DEPENDS} -Description: ${DESCRIPTION} -Conflicts: ${DEBIAN_CONFLICTS} diff --git a/recipes-devtools/ebg-secure-boot-secrets/files/sign_secure_image.sh.tmpl b/recipes-devtools/ebg-secure-boot-secrets/files/sign_secure_image.sh.tmpl deleted file mode 100644 index e84fd4c..0000000 --- a/recipes-devtools/ebg-secure-boot-secrets/files/sign_secure_image.sh.tmpl +++ /dev/null @@ -1,22 +0,0 @@ -#!/bin/sh -set -e -set -x -signee=$1 -signed=$2 - -usage(){ - echo "sign with debian snakeoil" - echo "$0 signee signed" - echo "signee: path to the image to be signed" - echo "signed: path to store the signed image" -} - - -if [ -z "$signee" ] || [ -z "$signed" ]; then - usage - exit 1 -fi - -pesign --force --verbose --padding -n ${SB_CERT_PATH}/${SB_CERTDB} -c "${SB_KEY_NAME}" -s -i $signee -o $signed -sbverify --cert ${SB_CERT_PATH}/${SB_VERIFY_CERT} $signed -exit 0 diff --git a/recipes-devtools/ebg-secure-boot-signer/ebg-secure-boot-signer_0.1.bb b/recipes-devtools/ebg-secure-boot-signer/ebg-secure-boot-signer_0.1.bb new file mode 100644 index 0000000..546fded --- /dev/null +++ b/recipes-devtools/ebg-secure-boot-signer/ebg-secure-boot-signer_0.1.bb @@ -0,0 +1,26 @@ +# +# CIP Core, generic profile +# +# Copyright (c) Siemens AG, 2020-2022 +# +# Authors: +# Quirin Gylstorff +# Jan Kiszka +# +# SPDX-License-Identifier: MIT +# + +inherit dpkg-raw + +DESCRIPTION = "Signing script for EFI Boot Guard setups" + +DEPENDS = "secure-boot-secrets" +DEBIAN_DEPENDS = "sbsigntool, secure-boot-secrets" + +SRC_URI = "file://sign_secure_image.sh" + +do_install() { + TARGET=${D}/usr/bin + install -d ${TARGET} + install -m 755 ${WORKDIR}/sign_secure_image.sh ${TARGET}/sign_secure_image.sh +} diff --git a/recipes-devtools/ebg-secure-boot-signer/files/sign_secure_image.sh b/recipes-devtools/ebg-secure-boot-signer/files/sign_secure_image.sh new file mode 100644 index 0000000..0c9b898 --- /dev/null +++ b/recipes-devtools/ebg-secure-boot-signer/files/sign_secure_image.sh @@ -0,0 +1,33 @@ +#!/bin/sh +# +# CIP Core, generic profile +# +# Copyright (c) Siemens AG, 2020-2022 +# +# Authors: +# Quirin Gylstorff +# Jan Kiszka +# +# SPDX-License-Identifier: MIT +# + +set -e + +signee=$1 +signed=$2 + +usage(){ + echo "sign with image keys" + echo "$0 signee signed" + echo "signee: path to the image to be signed" + echo "signed: path to store the signed image" +} + +if [ -z "$signee" ] || [ -z "$signed" ]; then + usage + exit 1 +fi + +keydir=/usr/share/secure-boot-secrets + +sbsign --key ${keydir}/secure-boot.key --cert ${keydir}/secure-boot.pem --output $signed $signee diff --git a/recipes-devtools/ebg-secure-boot-snakeoil/ebg-secure-boot-snakeoil_0.1.bb b/recipes-devtools/ebg-secure-boot-snakeoil/ebg-secure-boot-snakeoil_0.1.bb deleted file mode 100644 index 4975d92..0000000 --- a/recipes-devtools/ebg-secure-boot-snakeoil/ebg-secure-boot-snakeoil_0.1.bb +++ /dev/null @@ -1,34 +0,0 @@ -# -# CIP Core, generic profile -# -# Copyright (c) Siemens AG, 2020 -# -# Authors: -# Quirin Gylstorff -# -# SPDX-License-Identifier: MIT -# - -inherit dpkg-raw - -DESCRIPTION = "Add script to sign for secure boot with the debian snakeoil keys" -# used to sign the image -DEBIAN_DEPENDS = "pesign, sbsigntool, ovmf, openssl, libnss3-tools" - - -# this package cannot be install together with: -DEBIAN_CONFLICTS = "ebg-secure-boot-secrets" - -SRC_URI = "file://sign_secure_image.sh \ - file://control.tmpl" - -TEMPLATE_FILES = "control.tmpl" -TEMPLATE_VARS += "PN MAINTAINER DPKG_ARCH DEBIAN_DEPENDS DESCRIPTION DEBIAN_CONFLICTS" - -do_install() { - TARGET=${D}/usr/bin - install -d ${TARGET} - install -m 755 ${WORKDIR}/sign_secure_image.sh ${TARGET}/sign_secure_image.sh -} - -addtask do_install after do_transform_template diff --git a/recipes-devtools/ebg-secure-boot-snakeoil/files/control.tmpl b/recipes-devtools/ebg-secure-boot-snakeoil/files/control.tmpl deleted file mode 100644 index 8361a49..0000000 --- a/recipes-devtools/ebg-secure-boot-snakeoil/files/control.tmpl +++ /dev/null @@ -1,12 +0,0 @@ -Source: ${PN} -Section: misc -Priority: optional -Standards-Version: 3.9.6 -Maintainer: ${MAINTAINER} -Build-Depends: debhelper (>= 9) - -Package: ${PN} -Architecture: ${DPKG_ARCH} -Depends: ${DEBIAN_DEPENDS} -Description: ${DESCRIPTION} -Conflicts: ${DEBIAN_CONFLICTS} diff --git a/recipes-devtools/ebg-secure-boot-snakeoil/files/sign_secure_image.sh b/recipes-devtools/ebg-secure-boot-snakeoil/files/sign_secure_image.sh deleted file mode 100644 index 081dbe9..0000000 --- a/recipes-devtools/ebg-secure-boot-snakeoil/files/sign_secure_image.sh +++ /dev/null @@ -1,36 +0,0 @@ -#!/bin/sh -set -e -set -x -signee=$1 -signed=$2 - -usage(){ - echo "sign with debian snakeoil" - echo "$0 signee signed" - echo "signee: path to the image to be signed" - echo "signed: path to store the signed image" -} - - -if [ -z "$signee" ] || [ -z "$signed" ]; then - usage - exit 1 -fi - -name=snakeoil -keydir=$(mktemp -d) -inkey=/usr/share/ovmf/PkKek-1-snakeoil.key -incert=/usr/share/ovmf/PkKek-1-snakeoil.pem -nick_name=snakeoil -TMP=$(mktemp -d) -mkdir -p ${keydir}/${name}certdb -certutil -N --empty-password -d ${keydir}/${name}certdb -openssl pkcs12 -export -passin pass:"snakeoil" -passout pass: -out ${TMP}/foo_key.p12 -inkey $inkey -in $incert -name $nick_name -pk12util -W "" -i ${TMP}/foo_key.p12 -d ${keydir}/${name}certdb -cp $incert ${keydir}/$(basename $incert) -rm -rf $TMP - -pesign --force --verbose --padding -n ${keydir}/${name}certdb -c "$nick_name" -s -i $signee -o $signed -sbverify --cert $incert $signed -rm -rf $keydir -exit 0 diff --git a/recipes-devtools/secure-boot-secrets/files/PkKek-1-snakeoil.key b/recipes-devtools/secure-boot-secrets/files/PkKek-1-snakeoil.key new file mode 100644 index 0000000..193de62 --- /dev/null +++ b/recipes-devtools/secure-boot-secrets/files/PkKek-1-snakeoil.key @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEowIBAAKCAQEAyIuuXei5qIw+UvavLxPyyNhx0G6Ijuf9SqxVXOpKcQ+l3ZCc +KQaCLWCH0pbPQj587zVjgMUd4SHgXdVP6awDz8b0NcLgyzF31pHBmmB3z55nv2Jb +gI56bix9TEHLpoDs4+cWAb2WZPkW8rV/6YR+xVuE8fi9aAWJ7H4dwUhPzU7RBB1d +Z1wF6Wv3b8nn1jJa5W8I3zOd+tpWczOsqyRnDnFhMiOulGAiFTtmIXv2VReQf7Tx +rXdqAAs9dcS3qizzNVgY5XpABtmYu1AjyLwwqXZ+blZ2tmUUJicgw3YdCWtlTAtf +XZDHf+ZzgCNtTvhb2DzpAVmF/H+A8w8lUJZiBQIDAQABAoIBABET/BRZNj5JOyF7 +im2a6Ej8TazvTMfGr8ZFKLvR4+b+6yQUJYhE2p8colRnrVy5z4/bXw7fOm0qol27 +RaPjlyuBiNhvMQ98tfTa0r7fyjQvDCy7JomrGHf7Z+wvijUys3mw+ynIyF7u62pd +1HfBZb5OzeKBSTfriNRP5R7JlqooDl+O9JVlnvlJIaFe1rX2sQxZ7F8gVINKIJDv +n7ZZ0o351uIMjKLqwmliULPTjZ2ZeeJqnkB0pFcWZzEf2wAnrrglYRdnn10oNzhB +6cXMHJeuEOedXECLZtmynRw1dWZK9+Xku1jEAqTWAoI0OIjrfYYzntwe/kab8w/R +T7ojFGECgYEA9rGhtmSQiim2h+3iGyXNTEQiEOFFL7E8/1ibfWi3vzDhoLARrnH1 +p45DPgnL664xLHXIUl6/wto79Ij/2qA9mp054nVJ4X4AQgq3xCT/57nL0QHfQLaa +VdzNIoz4jJT3cO0gYcBAK4Bg+dGGQ6ZUrRRt6VkHG/W6fW0D1e7PnEkCgYEA0Bxj +Jr4ShNXb7J4YDQ24uSwmc2E1IgX5FjHu/JMKCiyIDWQkrxtVdIL9v6+kmYecyxFJ +S3Qyr3ZqOHqwN1svYuB/CHyKg6dHrzJyZFTj8cr8h0ZKLDu2xZNFxfBIjn5vitSX +W9q3477oFG/30Ew12Yee4NhDQkaEuB/Ic9+yv90CgYB2y00rLrwnvDSIunXiSs7U +xg59gG03rSrJb5rYxj+NkvVj0sWA8qGwASLCUidfo69MUJ+ZgsTnCP5MIFjMp9Ni +jAne0ko0it+G7fBWRNbyeJb8W+FtIUGqzTv/QlFCKU4KlDW+vLxp9lU8l7gHBabK +/gZ7kwKIZUlbss5hC7Hv+QKBgQCsQBLBKmlhkTEqs9/sTgMrISPiM/8qXg9BE6tf +WsTgjuM9UjoaxWEBwroMQnDWsqxQV8p2rYKWQEjC3qmj59Fc4bvDZnGvbnGizPpp +mOniY8SIouEZo4MwHSmPH8auSnBAVJ3C5VF3K7gj0lknCy03E02phNaGsJ+BVq0v +W2Qz8QKBgEB5RKiwJhgGQA2o+NJKKUUCDM9iBsO1Yy3QwtDWioKKcdAkxdTg3xR+ +XtJdXq6MkCMWM5em3v6GHPceexn81FZTxGBbIMBYNp0Sp4qs/3lK64ln8m5Qttxe +70HVtrp9HhG5oFJ3fUuLPcYpE2GMgPM9fIbAWh9GZ4GpTLuPRtWg +-----END RSA PRIVATE KEY----- diff --git a/recipes-devtools/secure-boot-secrets/files/PkKek-1-snakeoil.pem b/recipes-devtools/secure-boot-secrets/files/PkKek-1-snakeoil.pem new file mode 100644 index 0000000..dd02a82 --- /dev/null +++ b/recipes-devtools/secure-boot-secrets/files/PkKek-1-snakeoil.pem @@ -0,0 +1,21 @@ +-----BEGIN CERTIFICATE----- +MIIDdzCCAl+gAwIBAgIULTs+L+8XzClMGhAvyFIdsp/PYgUwDQYJKoZIhvcNAQEL +BQAwSjELMAkGA1UEBhMCVVMxETAPBgNVBAgMCENvbG9yYWRvMRUwEwYDVQQHDAxG +b3J0IENvbGxpbnMxETAPBgNVBAoMCFNuYWtlT2lsMCAXDTIwMDkwNzE4NDMyMloY +DzIxMjAwODE0MTg0MzIyWjBKMQswCQYDVQQGEwJVUzERMA8GA1UECAwIQ29sb3Jh +ZG8xFTATBgNVBAcMDEZvcnQgQ29sbGluczERMA8GA1UECgwIU25ha2VPaWwwggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIi65d6LmojD5S9q8vE/LI2HHQ +boiO5/1KrFVc6kpxD6XdkJwpBoItYIfSls9CPnzvNWOAxR3hIeBd1U/prAPPxvQ1 +wuDLMXfWkcGaYHfPnme/YluAjnpuLH1MQcumgOzj5xYBvZZk+RbytX/phH7FW4Tx ++L1oBYnsfh3BSE/NTtEEHV1nXAXpa/dvyefWMlrlbwjfM5362lZzM6yrJGcOcWEy +I66UYCIVO2Yhe/ZVF5B/tPGtd2oACz11xLeqLPM1WBjlekAG2Zi7UCPIvDCpdn5u +Vna2ZRQmJyDDdh0Ja2VMC19dkMd/5nOAI21O+FvYPOkBWYX8f4DzDyVQlmIFAgMB +AAGjUzBRMB0GA1UdDgQWBBRjuNXuXfh7mi8I3eTboeYGyFTa2zAfBgNVHSMEGDAW +gBRjuNXuXfh7mi8I3eTboeYGyFTa2zAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3 +DQEBCwUAA4IBAQBW2ckn0APqBnwSiOXCWkMCnvY7K7UOfxAlotEsMFSrkzdEa4IE +sn0+A3RV/r3HZGqIaE8GMsBqp8UiVIbL5H67dkqvJEke94/7wEUC16JSSOBc0Mac +HeArDWsL/WIbzKiVcRrmgX+XwJFlsUN5UtR/feTHR08yiy5srSCIJEqli/cTrOxS +JAgvWPLxcoFhOKf6Mi+nwWdrQEbpXvvv8Jv/qyyz5e/VmTRY0wIVmUjd+Yseu+5M +3+cpKtlYaawMxVni5RibA0A12fm+i60fGPrkCNhascUrNY+Oppaf/h+QmKOwEM7h +pqKXyGFQyU6dB6cFBQ/uD5IABUYuEOuL7VFY +-----END CERTIFICATE----- diff --git a/recipes-devtools/secure-boot-secrets/secure-boot-key_0.1.bb b/recipes-devtools/secure-boot-secrets/secure-boot-key_0.1.bb new file mode 100644 index 0000000..e6ef37c --- /dev/null +++ b/recipes-devtools/secure-boot-secrets/secure-boot-key_0.1.bb @@ -0,0 +1,14 @@ +# +# CIP Core, generic profile +# +# Copyright (c) Siemens AG, 2022 +# +# Authors: +# Jan Kiszka +# +# SPDX-License-Identifier: MIT +# + +require secure-boot-secrets.inc + +DEBIAN_CONFLICTS = "secure-boot-snakeoil" diff --git a/recipes-devtools/secure-boot-secrets/secure-boot-secrets.inc b/recipes-devtools/secure-boot-secrets/secure-boot-secrets.inc new file mode 100644 index 0000000..f53435a --- /dev/null +++ b/recipes-devtools/secure-boot-secrets/secure-boot-secrets.inc @@ -0,0 +1,34 @@ +# +# CIP Core, generic profile +# +# Copyright (c) Siemens AG, 2022 +# +# Authors: +# Jan Kiszka +# +# SPDX-License-Identifier: MIT +# + +inherit dpkg-raw + +PROVIDES += "secure-boot-secrets" + +SB_KEY ??= "" +SB_CERT ??= "" + +SRC_URI_append = " ${@ "file://"+d.getVar('SB_KEY') if d.getVar('SB_KEY') else '' }" +SRC_URI_append = " ${@ "file://"+d.getVar('SB_CERT') if d.getVar('SB_CERT') else '' }" + +do_install() { + if [ -z ${SB_KEY} ] || [ -z ${SB_CERT} ]; then + bbfatal "You must set SB_KEY and SB_CERT and provide the required files as artifacts to this recipe" + fi + TARGET=${D}/usr/share/secure-boot-secrets + install -d -m 0700 ${TARGET} + install -m 0700 ${WORKDIR}/${SB_KEY} ${TARGET}/secure-boot.key + install -m 0700 ${WORKDIR}/${SB_CERT} ${TARGET}/secure-boot.pem +} + +do_prepare_build_append() { + echo "Provides: secure-boot-secrets" >> ${S}/debian/control +} diff --git a/recipes-devtools/secure-boot-secrets/secure-boot-snakeoil_0.1.bb b/recipes-devtools/secure-boot-secrets/secure-boot-snakeoil_0.1.bb new file mode 100644 index 0000000..24a5352 --- /dev/null +++ b/recipes-devtools/secure-boot-secrets/secure-boot-snakeoil_0.1.bb @@ -0,0 +1,17 @@ +# +# CIP Core, generic profile +# +# Copyright (c) Siemens AG, 2022 +# +# Authors: +# Jan Kiszka +# +# SPDX-License-Identifier: MIT +# + +require secure-boot-secrets.inc + +SB_KEY = "PkKek-1-snakeoil.key" +SB_CERT = "PkKek-1-snakeoil.pem" + +DEBIAN_CONFLICTS = "secure-boot-key" From patchwork Wed May 4 19:45:53 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Kiszka X-Patchwork-Id: 12838455 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3ADCFC4167B for ; Wed, 4 May 2022 19:46:09 +0000 (UTC) Received: from mta-64-227.siemens.flowmailer.net (mta-64-227.siemens.flowmailer.net [185.136.64.227]) by mx.groups.io with SMTP id smtpd.web12.2022.1651693566103008307 for ; Wed, 04 May 2022 12:46:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=jan.kiszka@siemens.com header.s=fm1 header.b=HMgGcobO; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.227, mailfrom: fm-294854-2022050419460361ecea6113f5d87df0-013nqa@rts-flowmailer.siemens.com) Received: by mta-64-227.siemens.flowmailer.net with ESMTPSA id 2022050419460361ecea6113f5d87df0 for ; Wed, 04 May 2022 21:46:03 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=jan.kiszka@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=G9aKQFx8ntImR9N6X5/xxkPPrbkwco2j7xI9zrOZtR8=; b=HMgGcobOooGyCofzVFospb1jXuNAnyl/3MO/36JUoR8BGKQUtzBsEW/fi/f5YuVckvhEap PkKGGNIMZSjS/WoqNAMncd9eZ7FztDH1d6y5Y49I4WwT86HbDO9OxrAbQ1wejpSxWCzr2vFJ JSRmRnnGljUnS16gFeFaRNzmFBsFI=; From: Jan Kiszka To: cip-dev@lists.cip-project.org Cc: Quirin Gylstorff , Christian Storm Subject: [isar-cip-core][PATCH 05/12] linux-cip: Update cip-kernel-config for QEMU and ipc227e Date: Wed, 4 May 2022 21:45:53 +0200 Message-Id: <22c861c4d823261c7b37637d1cd9d8578ea0ae98.1651693560.git.jan.kiszka@siemens.com> In-Reply-To: References: MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-294854:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 04 May 2022 19:46:09 -0000 X-Groupsio-URL: https://lists.cip-project.org/g/cip-dev/message/8244 From: Jan Kiszka Needed for iTCO under -rt kernels, swupdate support on arm64 and xattr for squashfs in swupudate scenarios. Signed-off-by: Jan Kiszka --- recipes-kernel/linux/linux-cip-common.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/recipes-kernel/linux/linux-cip-common.inc b/recipes-kernel/linux/linux-cip-common.inc index 238e5b0..0e36bd5 100644 --- a/recipes-kernel/linux/linux-cip-common.inc +++ b/recipes-kernel/linux/linux-cip-common.inc @@ -25,6 +25,6 @@ SRC_URI_append = " ${@ "git://gitlab.com/cip-project/cip-kernel/cip-kernel-confi SRC_URI_append_bbb = "file://${KERNEL_DEFCONFIG}" -SRCREV_cip-kernel-config ?= "0150b63d0e74d64cc0d5baa9b9440cc148abad8b" +SRCREV_cip-kernel-config ?= "a8d04df6595344091eee2b242c3a0f5e108f966c" S = "${WORKDIR}/linux-cip-v${PV}" From patchwork Wed May 4 19:45:54 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Kiszka X-Patchwork-Id: 12838460 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C0E5C4167E for ; Wed, 4 May 2022 19:46:09 +0000 (UTC) Received: from mta-64-228.siemens.flowmailer.net (mta-64-228.siemens.flowmailer.net [185.136.64.228]) by mx.groups.io with SMTP id smtpd.web12.2024.1651693566883093079 for ; Wed, 04 May 2022 12:46:07 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=jan.kiszka@siemens.com header.s=fm1 header.b=h6pBKEU8; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.228, mailfrom: fm-294854-20220504194603708c28dc5a43bb47d3-_yieob@rts-flowmailer.siemens.com) Received: by mta-64-228.siemens.flowmailer.net with ESMTPSA id 20220504194603708c28dc5a43bb47d3 for ; Wed, 04 May 2022 21:46:03 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=jan.kiszka@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=mXv2P4MwnBJxlCvTGoPqN3icakHbb0rep6WZaUFFgV4=; b=h6pBKEU8A9KuUmePOWn6erWYF5NTu4ZeLuaM39dQeaTXQNbjSbyCzP3rcWBmgLxNphuMkL sxH/TzQvxIF/2Yr+NtnIga7hXixKjwjUJ9qBZjL1qmhyss7ogb89NhFGZbzdVJFyPb/JibK6 //v5aqRik9t98rK6H9GI3j6vzq3hA=; From: Jan Kiszka To: cip-dev@lists.cip-project.org Cc: Quirin Gylstorff , Christian Storm Subject: [isar-cip-core][PATCH 06/12] linux-cip: Update to 4.19.239-cip72 and 5.10.112-cip6 Date: Wed, 4 May 2022 21:45:54 +0200 Message-Id: In-Reply-To: References: MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-294854:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 04 May 2022 19:46:09 -0000 X-Groupsio-URL: https://lists.cip-project.org/g/cip-dev/message/8248 From: Jan Kiszka Signed-off-by: Jan Kiszka --- ...{linux-cip_4.19.235-cip70.bb => linux-cip_4.19.239-cip72.bb} | 2 +- .../{linux-cip_5.10.106-cip4.bb => linux-cip_5.10.112-cip6.bb} | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) rename recipes-kernel/linux/{linux-cip_4.19.235-cip70.bb => linux-cip_4.19.239-cip72.bb} (72%) rename recipes-kernel/linux/{linux-cip_5.10.106-cip4.bb => linux-cip_5.10.112-cip6.bb} (72%) diff --git a/recipes-kernel/linux/linux-cip_4.19.235-cip70.bb b/recipes-kernel/linux/linux-cip_4.19.239-cip72.bb similarity index 72% rename from recipes-kernel/linux/linux-cip_4.19.235-cip70.bb rename to recipes-kernel/linux/linux-cip_4.19.239-cip72.bb index eaad5e8..718bbfb 100644 --- a/recipes-kernel/linux/linux-cip_4.19.235-cip70.bb +++ b/recipes-kernel/linux/linux-cip_4.19.239-cip72.bb @@ -13,4 +13,4 @@ require linux-cip-common.inc KERNEL_DEFCONFIG_VERSION ?= "4.19.y-cip" -SRC_URI[sha256sum] = "b3bcb1ffd82c2ccdcb96aba55bdc46c72db12b6b5442591f804c8e298ad405c4" +SRC_URI[sha256sum] = "5f22ea902c89b1cd178706411e48a40613c1db069fa7dc5993b979fd4652c2cd" diff --git a/recipes-kernel/linux/linux-cip_5.10.106-cip4.bb b/recipes-kernel/linux/linux-cip_5.10.112-cip6.bb similarity index 72% rename from recipes-kernel/linux/linux-cip_5.10.106-cip4.bb rename to recipes-kernel/linux/linux-cip_5.10.112-cip6.bb index 2f52cdb..b54dcb5 100644 --- a/recipes-kernel/linux/linux-cip_5.10.106-cip4.bb +++ b/recipes-kernel/linux/linux-cip_5.10.112-cip6.bb @@ -13,4 +13,4 @@ require linux-cip-common.inc KERNEL_DEFCONFIG_VERSION ?= "5.10.y-cip" -SRC_URI[sha256sum] = "512787b7f75b25e2c7f64978957bb2e6613e7c9edccc6d677ddd256109244d25" +SRC_URI[sha256sum] = "aedeaefcb3da02fe6ab36859eb15c2e36844b2a0ea828a902b85037ad145e1ee" From patchwork Wed May 4 19:45:55 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Kiszka X-Patchwork-Id: 12838464 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 48E83C41535 for ; Wed, 4 May 2022 19:46:09 +0000 (UTC) Received: from mta-64-228.siemens.flowmailer.net (mta-64-228.siemens.flowmailer.net [185.136.64.228]) by mx.groups.io with SMTP id smtpd.web12.2025.1651693566883225914 for ; Wed, 04 May 2022 12:46:07 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=jan.kiszka@siemens.com header.s=fm1 header.b=Ay8BB1kv; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.228, mailfrom: fm-294854-20220504194604c66676ea623273c2e9-lyhcxb@rts-flowmailer.siemens.com) Received: by mta-64-228.siemens.flowmailer.net with ESMTPSA id 20220504194604c66676ea623273c2e9 for ; Wed, 04 May 2022 21:46:04 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=jan.kiszka@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=UcJxcVMrwFxw2A4GGhDOOvLkCcllYdRh/T10ps9vJrs=; b=Ay8BB1kvylbK24SRJgJ+HjMKP8nSBNdQcPEBt3RLmbFv17iAyD3f1PyyjWNJHOGEn7881+ x0cOfNBRpuYqPGY28wiAwG0VtsZtJhIkJXwA37F6xdwT/SNzpqeTM1y70pUQPh8RvDWKvgfR JWS2lgtWB/veTO5idZQX/6TRhovo0=; From: Jan Kiszka To: cip-dev@lists.cip-project.org Cc: Quirin Gylstorff , Christian Storm Subject: [isar-cip-core][PATCH 07/12] efibootguard: Update to 0.11 release Date: Wed, 4 May 2022 21:45:55 +0200 Message-Id: In-Reply-To: References: MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-294854:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 04 May 2022 19:46:09 -0000 X-Groupsio-URL: https://lists.cip-project.org/g/cip-dev/message/8247 From: Jan Kiszka This version bring the new unified kernel stub and script to generate unified kernel images from that. That script requires python3, so we need to expand the package dependencies. As we package all tools into a single deb, and the target usually requires bg_{print,set}env, python3 is now also pulled onto the target. If that should be avoided, we will have to split packaging in future. One extra patch is needed that missed the release. It fixes building under buster for arm64. Signed-off-by: Jan Kiszka --- ...bootguard_0.10.bb => efibootguard_0.11.bb} | 4 +-- ...efile-Drop-nostdinc-for-EFI-binaries.patch | 28 +++++++++++++++++++ .../0001-configure-Fix-aarch64-EFI-arch.patch | 28 ------------------- .../efibootguard/files/debian/control.tmpl | 2 +- .../files/debian/efibootguard.install | 3 +- 5 files changed, 33 insertions(+), 32 deletions(-) rename recipes-bsp/efibootguard/{efibootguard_0.10.bb => efibootguard_0.11.bb} (90%) create mode 100644 recipes-bsp/efibootguard/files/0001-Makefile-Drop-nostdinc-for-EFI-binaries.patch delete mode 100644 recipes-bsp/efibootguard/files/0001-configure-Fix-aarch64-EFI-arch.patch diff --git a/recipes-bsp/efibootguard/efibootguard_0.10.bb b/recipes-bsp/efibootguard/efibootguard_0.11.bb similarity index 90% rename from recipes-bsp/efibootguard/efibootguard_0.10.bb rename to recipes-bsp/efibootguard/efibootguard_0.11.bb index bfc0ede..ef6cd9c 100644 --- a/recipes-bsp/efibootguard/efibootguard_0.10.bb +++ b/recipes-bsp/efibootguard/efibootguard_0.11.bb @@ -19,9 +19,9 @@ MAINTAINER = "Jan Kiszka " SRC_URI = " \ https://github.com/siemens/efibootguard/archive/refs/tags/v${PV}.tar.gz;downloadfilename=efitbootguard-v${PV}.tar.gz \ file://debian \ - file://0001-configure-Fix-aarch64-EFI-arch.patch \ + file://0001-Makefile-Drop-nostdinc-for-EFI-binaries.patch \ " -SRC_URI[sha256sum] = "4d58574a0bb8f1e56056ab0bcc2487d37e49fa147dc991e719c2ec8e20f88dd3" +SRC_URI[sha256sum] = "12bd84ff63a34bef56e489b48d4f97955aa4d864eeff9ea2dea1d24a286d8ebe" PROVIDES = "${PN}" PROVIDES += "${PN}-dev" diff --git a/recipes-bsp/efibootguard/files/0001-Makefile-Drop-nostdinc-for-EFI-binaries.patch b/recipes-bsp/efibootguard/files/0001-Makefile-Drop-nostdinc-for-EFI-binaries.patch new file mode 100644 index 0000000..8cc1654 --- /dev/null +++ b/recipes-bsp/efibootguard/files/0001-Makefile-Drop-nostdinc-for-EFI-binaries.patch @@ -0,0 +1,28 @@ +From daf4cb61bec56dac628be83b95a7072c184eabcd Mon Sep 17 00:00:00 2001 +From: Jan Kiszka +Date: Wed, 4 May 2022 11:52:53 +0200 +Subject: [PATCH] Makefile: Drop -nostdinc for EFI binaries + +Not needed, also systemd-boot does not use it, and it actually triggers +a build failure on Debian 10, possibly on other distros as well. + +Signed-off-by: Jan Kiszka +--- + Makefile.am | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/Makefile.am b/Makefile.am +index f0daa15..7398b85 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -191,7 +191,6 @@ efi_cflags = \ + -Wall \ + -Wextra \ + -std=gnu99 \ +- -nostdinc \ + -ggdb -O0 \ + -fpic \ + -fshort-wchar \ +-- +2.34.1 + diff --git a/recipes-bsp/efibootguard/files/0001-configure-Fix-aarch64-EFI-arch.patch b/recipes-bsp/efibootguard/files/0001-configure-Fix-aarch64-EFI-arch.patch deleted file mode 100644 index ee05e94..0000000 --- a/recipes-bsp/efibootguard/files/0001-configure-Fix-aarch64-EFI-arch.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 3f11612fbcbd1c17988d634ecdaecf1ec241f6e0 Mon Sep 17 00:00:00 2001 -From: Jan Kiszka -Date: Mon, 21 Mar 2022 07:02:28 +0100 -Subject: [PATCH] configure: Fix aarch64 EFI arch - -It's aa64 here according to the UEFI spec. - -Signed-off-by: Jan Kiszka ---- - configure.ac | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/configure.ac b/configure.ac -index a1a83e9..09d06d7 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -102,7 +102,7 @@ AM_COND_IF(ARCH_X86_64, [ - MACHINE_TYPE_NAME=x64]) - - AM_COND_IF(ARCH_AARCH64, [ -- MACHINE_TYPE_NAME=aarch64]) -+ MACHINE_TYPE_NAME=aa64]) - - AC_SUBST([ARCH]) - AC_SUBST([MACHINE_TYPE_NAME]) --- -2.34.1 - diff --git a/recipes-bsp/efibootguard/files/debian/control.tmpl b/recipes-bsp/efibootguard/files/debian/control.tmpl index 54b1994..f8bdd8a 100644 --- a/recipes-bsp/efibootguard/files/debian/control.tmpl +++ b/recipes-bsp/efibootguard/files/debian/control.tmpl @@ -7,7 +7,7 @@ Homepage: ${HOMEPAGE} Maintainer: ${MAINTAINER} Package: ${PN} -Depends: ${shlibs:Depends} +Depends: ${shlibs:Depends}, python3 Section: base Architecture: ${DISTRO_ARCH} Priority: required diff --git a/recipes-bsp/efibootguard/files/debian/efibootguard.install b/recipes-bsp/efibootguard/files/debian/efibootguard.install index 910e153..d3ea007 100755 --- a/recipes-bsp/efibootguard/files/debian/efibootguard.install +++ b/recipes-bsp/efibootguard/files/debian/efibootguard.install @@ -1,6 +1,7 @@ #!/usr/bin/dh-exec bg_setenv usr/bin bg_printenv usr/bin -efibootguard*.efi usr/share/efibootguard +tools/bg_gen_unified_kernel usr/bin +*.efi usr/share/efibootguard completion/bash/bg_printenv.bash => usr/share/bash-completion/completions/bg_printenv completion/bash/bg_setenv.bash => usr/share/bash-completion/completions/bg_setenv From patchwork Wed May 4 19:45:56 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Kiszka X-Patchwork-Id: 12838461 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55965C46467 for ; Wed, 4 May 2022 19:46:09 +0000 (UTC) Received: from mta-65-225.siemens.flowmailer.net (mta-65-225.siemens.flowmailer.net [185.136.65.225]) by mx.groups.io with SMTP id smtpd.web12.2026.1651693567343668460 for ; Wed, 04 May 2022 12:46:07 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=jan.kiszka@siemens.com header.s=fm1 header.b=HjUvTHKr; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.225, mailfrom: fm-294854-20220504194604146dfdbadf52abbe52-kj5vqd@rts-flowmailer.siemens.com) Received: by mta-65-225.siemens.flowmailer.net with ESMTPSA id 20220504194604146dfdbadf52abbe52 for ; Wed, 04 May 2022 21:46:04 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=jan.kiszka@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=JS3kyE0WyqIo/FvpweZBJJtuJD4JiKuVY+f+WtLpU+8=; b=HjUvTHKrg7cccX+iIyku7UqNcPspKlRch+pdLYrjgUGQcqEi8no8GCkva7kK554s91jOLw 2jRgrVkIPtwGuwSgoUrDWOXr8q2HB5CqDjx/+5If9ML2NAiAOcG8fJmz0BuQkAj8O1NcXNS7 xptcXBBowVY0mrPfUGnd21M5WdaE4=; From: Jan Kiszka To: cip-dev@lists.cip-project.org Cc: Quirin Gylstorff , Christian Storm Subject: [isar-cip-core][PATCH 08/12] efibootguard: Use new unified kernel image generation Date: Wed, 4 May 2022 21:45:56 +0200 Message-Id: <8bdffb7f844bf0c6610e47a79ca918a3f5a34758.1651693560.git.jan.kiszka@siemens.com> In-Reply-To: References: MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-294854:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 04 May 2022 19:46:09 -0000 X-Groupsio-URL: https://lists.cip-project.org/g/cip-dev/message/8249 From: Jan Kiszka Switch to the unified kernel image and its generator script that EFI Boot Guard now provides. So far this only simplifies the generation process. But it will also allow to use the more advanced device tree embedding of the EBG linux-stub later on. As the linux-stub uses LINUX_EFI_INITRD_MEDIA_GUID for loading the initrd, we need to restrict support to CIP kernel 5.10 as this feature was only introduced with 5.8. Signed-off-by: Jan Kiszka --- Kconfig | 2 +- .../wic/plugins/source/efibootguard-boot.py | 27 +++++-------------- 2 files changed, 7 insertions(+), 22 deletions(-) diff --git a/Kconfig b/Kconfig index 8032ede..135794d 100644 --- a/Kconfig +++ b/Kconfig @@ -127,7 +127,7 @@ config KAS_INCLUDE_TESTING string default "kas/opt/test.yml" if IMAGE_TESTING -if IMAGE_FLASH +if IMAGE_FLASH && !KERNEL_4_4 && !KERNEL_4_19 config IMAGE_SWUPDATE bool "SWUpdate support for root partition" diff --git a/scripts/lib/wic/plugins/source/efibootguard-boot.py b/scripts/lib/wic/plugins/source/efibootguard-boot.py index 909e629..f71dbb0 100644 --- a/scripts/lib/wic/plugins/source/efibootguard-boot.py +++ b/scripts/lib/wic/plugins/source/efibootguard-boot.py @@ -113,7 +113,7 @@ class EfibootguardBootPlugin(SourcePlugin): % ( part.label.upper(), boot_image, - '-a "%s"' % cmdline if cmdline else "", + '-a "%s"' % cmdline if cmdline and unified_kernel != 'y' else "", source_params.get("revision", 1), wdog_timeout ) @@ -181,15 +181,9 @@ class EfibootguardBootPlugin(SourcePlugin): "i386": "ia32" } rootfs_path = rootfs_dir.get('ROOTFS_DIR') - os_release_file = "{root}/etc/os-release".format(root=rootfs_path) - efistub = "{rootfs_path}/usr/lib/systemd/boot/efi/linux{efiarch}.efi.stub"\ + efistub = "{rootfs_path}/usr/share/efibootguard/kernel-stub{efiarch}.efi"\ .format(rootfs_path=rootfs_path, efiarch=distro_to_efi_arch[get_bitbake_var("DISTRO_ARCH")]) - msger.debug("osrelease path: %s", os_release_file) - kernel_cmdline_file = "{cr_workdir}/kernel-command-line-file.txt"\ - .format(cr_workdir=cr_workdir) - with open(kernel_cmdline_file, "w") as cmd_fd: - cmd_fd.write(cmdline) uefi_kernel_name = "linux.efi" uefi_kernel_file = "{deploy_dir}/{uefi_kernel_name}"\ .format(deploy_dir=deploy_dir, uefi_kernel_name=uefi_kernel_name) @@ -197,23 +191,14 @@ class EfibootguardBootPlugin(SourcePlugin): .format(deploy_dir=deploy_dir, kernel_image=kernel_image) initrd = "{deploy_dir}/{initrd_image}"\ .format(deploy_dir=deploy_dir, initrd_image=initrd_image) - objcopy_cmd = 'objcopy \ - --add-section .osrel={os_release_file} \ - --change-section-vma .osrel=0x20000 \ - --add-section .cmdline={kernel_cmdline_file} \ - --change-section-vma .cmdline=0x30000 \ - --add-section .linux={kernel} \ - --change-section-vma .linux=0x2000000 \ - --add-section .initrd={initrd} \ - --change-section-vma .initrd=0x3000000 \ - {efistub} {uefi_kernel_file}'.format( - os_release_file=os_release_file, - kernel_cmdline_file=kernel_cmdline_file, + cmd = 'bg_gen_unified_kernel {efistub} {kernel} {uefi_kernel_file} \ + -c "{cmdline}" -i {initrd}'.format( + cmdline=cmdline, kernel=kernel, initrd=initrd, efistub=efistub, uefi_kernel_file=uefi_kernel_file) - exec_cmd(objcopy_cmd) + exec_cmd(cmd, as_shell=True) cls._sign_file(signee=uefi_kernel_file, source_params=source_params) From patchwork Wed May 4 19:45:57 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Kiszka X-Patchwork-Id: 12838459 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3EF46C4321E for ; Wed, 4 May 2022 19:46:09 +0000 (UTC) Received: from mta-65-227.siemens.flowmailer.net (mta-65-227.siemens.flowmailer.net [185.136.65.227]) by mx.groups.io with SMTP id smtpd.web12.2023.1651693566802373541 for ; Wed, 04 May 2022 12:46:07 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=jan.kiszka@siemens.com header.s=fm1 header.b=Uj2sLAIr; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.227, mailfrom: fm-294854-202205041946044bf71131ee6c35bd03-a3cm_s@rts-flowmailer.siemens.com) Received: by mta-65-227.siemens.flowmailer.net with ESMTPSA id 202205041946044bf71131ee6c35bd03 for ; Wed, 04 May 2022 21:46:04 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=jan.kiszka@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=Os7DwWJ48PSv/+q6Mdp3FPbrrSioPLM9dM0Bi/18Eyg=; b=Uj2sLAIr9QsTkD77T+jnWrk3hqfYr59PY6AI+ahWuigqrlQuJlEZx+dz5NidylIorHdyuk D3Akkyg5FELZkIkaMT+JYuF0hTV/72ccwnHBhPXuuhvypntYS4kH2ydLagV4Yd8/0thiJj/9 tFNAguNoQv7qLF6PVpkltjh5g7WQ8=; From: Jan Kiszka To: cip-dev@lists.cip-project.org Cc: Quirin Gylstorff , Christian Storm Subject: [isar-cip-core][PATCH 09/12] efibootguard: Add support for embedding DTBs into unified kernel images Date: Wed, 4 May 2022 21:45:57 +0200 Message-Id: <8cbe5c3d5cef17b4f1c062ade722003413250617.1651693560.git.jan.kiszka@siemens.com> In-Reply-To: References: MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-294854:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 04 May 2022 19:46:09 -0000 X-Groupsio-URL: https://lists.cip-project.org/g/cip-dev/message/8245 From: Jan Kiszka Pick up the DTBs specified via DTB_FILES and embed them into the unified kernel image that the wic plugin can generate. This does not work for normal kernels, so bail out if DTB_FILES is set in that mode. Signed-off-by: Jan Kiszka --- kas/opt/efibootguard.yml | 2 +- .../lib/wic/plugins/source/efibootguard-boot.py | 15 +++++++++++++-- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/kas/opt/efibootguard.yml b/kas/opt/efibootguard.yml index 2d84427..c71cdb3 100644 --- a/kas/opt/efibootguard.yml +++ b/kas/opt/efibootguard.yml @@ -23,7 +23,7 @@ local_conf_header: efibootguard-wic: | WIC_IMAGER_INSTALL_append = " efibootguard" WDOG_TIMEOUT ?= "60" - WICVARS += "WDOG_TIMEOUT KERNEL_IMAGE INITRD_IMAGE" + WICVARS += "WDOG_TIMEOUT KERNEL_IMAGE INITRD_IMAGE DTB_FILES" IMAGE_FSTYPES ?= "wic-img" WKS_FILE ?= "${MACHINE}-efibootguard.wks.in" diff --git a/scripts/lib/wic/plugins/source/efibootguard-boot.py b/scripts/lib/wic/plugins/source/efibootguard-boot.py index f71dbb0..f0a21a2 100644 --- a/scripts/lib/wic/plugins/source/efibootguard-boot.py +++ b/scripts/lib/wic/plugins/source/efibootguard-boot.py @@ -66,10 +66,12 @@ class EfibootguardBootPlugin(SourcePlugin): initrd_image = "initrd.img" bootloader = creator.ks.bootloader + dtb_files = (get_bitbake_var("DTB_FILES") or '').split() + deploy_dir = get_bitbake_var("DEPLOY_DIR_IMAGE") if not deploy_dir: msger.error("DEPLOY_DIR_IMAGE not set, exiting\n") - sys.exit(1) + exit(1) creator.deploy_dir = deploy_dir wdog_timeout = get_bitbake_var("WDOG_TIMEOUT") @@ -88,9 +90,13 @@ class EfibootguardBootPlugin(SourcePlugin): deploy_dir, kernel_image, initrd_image, + dtb_files, source_params) boot_files.append(boot_image) else: + if dtb_files: + msger.error("DTB_FILES specified while unified kernel is disabled\n") + exit(1) root_dev = source_params.get("root", None) if not root_dev: msger.error("Specify root in source params") @@ -173,7 +179,7 @@ class EfibootguardBootPlugin(SourcePlugin): @classmethod def _create_unified_kernel_image(cls, rootfs_dir, cr_workdir, cmdline, deploy_dir, kernel_image, initrd_image, - source_params): + dtb_files, source_params): # we need to map the distro_arch to uefi values distro_to_efi_arch = { "amd64": "x64", @@ -198,6 +204,11 @@ class EfibootguardBootPlugin(SourcePlugin): initrd=initrd, efistub=efistub, uefi_kernel_file=uefi_kernel_file) + if dtb_files: + for dtb in dtb_files: + cmd += ' -d {deploy_dir}/{dtb_file}'.format( + deploy_dir=deploy_dir, + dtb_file=os.path.basename(dtb)) exec_cmd(cmd, as_shell=True) cls._sign_file(signee=uefi_kernel_file, source_params=source_params) From patchwork Wed May 4 19:45:58 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Kiszka X-Patchwork-Id: 12838462 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 48505C4167D for ; Wed, 4 May 2022 19:46:09 +0000 (UTC) Received: from mta-65-227.siemens.flowmailer.net (mta-65-227.siemens.flowmailer.net [185.136.65.227]) by mx.groups.io with SMTP id smtpd.web08.2031.1651693567185709945 for ; Wed, 04 May 2022 12:46:07 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=jan.kiszka@siemens.com header.s=fm1 header.b=UZH11osk; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.227, mailfrom: fm-294854-20220504194605d278e04d13c6bd2b52-acgcap@rts-flowmailer.siemens.com) Received: by mta-65-227.siemens.flowmailer.net with ESMTPSA id 20220504194605d278e04d13c6bd2b52 for ; Wed, 04 May 2022 21:46:05 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=jan.kiszka@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=PU24+oZ5hM49YyftqyoCFn1TOGIsCUT61/HLyZcfWno=; b=UZH11oskJA7S4ydejdZSwIXPoN7JKRAivdsFsrnSS0DfLoIBhXzr0wURpNIGb2IOjnKb+1 QK6NoY0ZiNrxuZ9BLmSPx12x9PZ5inispP7tjoKX2Enxlm9HEEEEDuTW6G/q4Czhops/VCKt wU6k8G2BGkB6ZtfyEbbAN6kPHEEgY=; From: Jan Kiszka To: cip-dev@lists.cip-project.org Cc: Quirin Gylstorff , Christian Storm Subject: [isar-cip-core][PATCH 10/12] u-boot-qemu-arm64: Add recipe for customized version based on 2022.04 Date: Wed, 4 May 2022 21:45:58 +0200 Message-Id: <7b1860e3dbd4d5f2de5ec2b9a8acf6ed4fd3da31.1651693560.git.jan.kiszka@siemens.com> In-Reply-To: References: MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-294854:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 04 May 2022 19:46:09 -0000 X-Groupsio-URL: https://lists.cip-project.org/g/cip-dev/message/8246 From: Jan Kiszka This will be used for booting via UEFI, both in open and locked-down secure mode. The secure mode variations can be selected by adding "secureboot" to OVERRIDES. One extra patch is needed to add support for long-living certificates. It is pending upstream. Signed-off-by: Jan Kiszka --- ...-rtc_mktime-and-mktime64-Y2038-ready.patch | 107 ++++++++++++++++++ recipes-bsp/u-boot/files/rules | 40 +++++++ recipes-bsp/u-boot/files/secure-boot.cfg | 6 + .../u-boot/u-boot-qemu-arm64_2022.04.bb | 50 ++++++++ 4 files changed, 203 insertions(+) create mode 100644 recipes-bsp/u-boot/files/0001-lib-date-Make-rtc_mktime-and-mktime64-Y2038-ready.patch create mode 100755 recipes-bsp/u-boot/files/rules create mode 100644 recipes-bsp/u-boot/files/secure-boot.cfg create mode 100644 recipes-bsp/u-boot/u-boot-qemu-arm64_2022.04.bb diff --git a/recipes-bsp/u-boot/files/0001-lib-date-Make-rtc_mktime-and-mktime64-Y2038-ready.patch b/recipes-bsp/u-boot/files/0001-lib-date-Make-rtc_mktime-and-mktime64-Y2038-ready.patch new file mode 100644 index 0000000..b2ff705 --- /dev/null +++ b/recipes-bsp/u-boot/files/0001-lib-date-Make-rtc_mktime-and-mktime64-Y2038-ready.patch @@ -0,0 +1,107 @@ +From 8b990a06685678abd8dbc8be86c27bf3e94e3694 Mon Sep 17 00:00:00 2001 +From: Jan Kiszka +Date: Sun, 24 Apr 2022 11:24:54 +0200 +Subject: [PATCH] lib/date: Make rtc_mktime and mktime64 Y2038-ready + +We currently overflow due to wrong types used internally in rtc_mktime, +on all platforms, and we return a too small type on 32-bit. + +One consumer that directly benefits from this is mktime64. Many others +may still store the result in a wrong type. + +While at it, drop the redundant cast of mon in rtc_mktime (obsoleted by +714209832db1). + +Signed-off-by: Jan Kiszka +--- + include/linux/time.h | 3 --- + include/rtc.h | 8 +++++--- + lib/date.c | 13 +++++-------- + 3 files changed, 10 insertions(+), 14 deletions(-) + +diff --git a/include/linux/time.h b/include/linux/time.h +index 702dd276aea..14ff5b6f481 100644 +--- a/include/linux/time.h ++++ b/include/linux/time.h +@@ -152,9 +152,6 @@ _DEFUN (ctime_r, (tim_p, result), + return asctime_r (localtime_r (tim_p, &tm), result); + } + +-/* for compatibility with linux code */ +-typedef __s64 time64_t; +- + #ifdef CONFIG_LIB_DATE + time64_t mktime64(const unsigned int year, const unsigned int mon, + const unsigned int day, const unsigned int hour, +diff --git a/include/rtc.h b/include/rtc.h +index 6c7fcadd488..10104e3bf5a 100644 +--- a/include/rtc.h ++++ b/include/rtc.h +@@ -16,6 +16,8 @@ + #include + #include + ++typedef int64_t time64_t; ++ + #ifdef CONFIG_DM_RTC + + struct udevice; +@@ -301,7 +303,7 @@ int rtc_calc_weekday(struct rtc_time *time); + void rtc_to_tm(u64 time_t, struct rtc_time *time); + + /** +- * rtc_mktime() - Convert a broken-out time into a time_t value ++ * rtc_mktime() - Convert a broken-out time into a time64_t value + * + * The following fields need to be valid for this function to work: + * tm_sec, tm_min, tm_hour, tm_mday, tm_mon, tm_year +@@ -309,9 +311,9 @@ void rtc_to_tm(u64 time_t, struct rtc_time *time); + * Note that tm_wday and tm_yday are ignored. + * + * @time: Broken-out time to convert +- * Return: corresponding time_t value, seconds since 1970-01-01 00:00:00 ++ * Return: corresponding time64_t value, seconds since 1970-01-01 00:00:00 + */ +-unsigned long rtc_mktime(const struct rtc_time *time); ++time64_t rtc_mktime(const struct rtc_time *time); + + /** + * rtc_month_days() - The number of days in the month +diff --git a/lib/date.c b/lib/date.c +index c589d9ed3a2..e3d22459cd0 100644 +--- a/lib/date.c ++++ b/lib/date.c +@@ -71,19 +71,16 @@ int rtc_calc_weekday(struct rtc_time *tm) + * -year / 100 + year / 400 terms, and add 10.] + * + * This algorithm was first published by Gauss (I think). +- * +- * WARNING: this function will overflow on 2106-02-07 06:28:16 on +- * machines where long is 32-bit! (However, as time_t is signed, we +- * will already get problems at other places on 2038-01-19 03:14:08) + */ +-unsigned long rtc_mktime(const struct rtc_time *tm) ++time64_t rtc_mktime(const struct rtc_time *tm) + { + int mon = tm->tm_mon; + int year = tm->tm_year; +- int days, hours; ++ unsigned long days; ++ time64_t hours; + + mon -= 2; +- if (0 >= (int)mon) { /* 1..12 -> 11, 12, 1..10 */ ++ if (0 >= mon) { /* 1..12 -> 11, 12, 1..10 */ + mon += 12; /* Puts Feb last since it has leap day */ + year -= 1; + } +@@ -109,5 +106,5 @@ time64_t mktime64(const unsigned int year, const unsigned int mon, + time.tm_min = min; + time.tm_sec = sec; + +- return (time64_t)rtc_mktime((const struct rtc_time *)&time); ++ return rtc_mktime((const struct rtc_time *)&time); + } +-- +2.34.1 + diff --git a/recipes-bsp/u-boot/files/rules b/recipes-bsp/u-boot/files/rules new file mode 100755 index 0000000..36e1e1b --- /dev/null +++ b/recipes-bsp/u-boot/files/rules @@ -0,0 +1,40 @@ +#!/usr/bin/make -f +# +# Copyright (c) Siemens AG, 2018-2022 +# +# SPDX-License-Identifier: MIT + +ifneq ($(DEB_BUILD_GNU_TYPE),$(DEB_HOST_GNU_TYPE)) +export CROSS_COMPILE=$(DEB_HOST_GNU_TYPE)- +SET_CROSS_BUILD_TOOLS=CROSS_BUILD_TOOLS=y +endif + +override_dh_auto_build: + if [ -e /usr/share/secure-boot-secrets/secure-boot.pem ]; then \ + openssl x509 -in /usr/share/secure-boot-secrets/secure-boot.pem -out secure-boot.der -outform der; \ + rm -f secure-boot.esl; \ + efisiglist -a -c secure-boot.der -o secure-boot.esl; \ + rm -f ubootefi.var; \ + tools/efivar.py set -i ubootefi.var -n PK -d secure-boot.esl -t file; \ + tools/efivar.py set -i ubootefi.var -n KEK -d secure-boot.esl -t file; \ + tools/efivar.py set -i ubootefi.var -n db -d secure-boot.esl -t file; \ + fi + $(MAKE) $(PARALLEL_MAKE) $(U_BOOT_CONFIG) + $(MAKE) $(PARALLEL_MAKE) ${U_BOOT_BIN} + $(MAKE) -n u-boot-initial-env >/dev/null 2>&1; if [ $$? -ne 2 ]; then \ + $(MAKE) $(PARALLEL_MAKE) u-boot-initial-env; \ + else \ + ./scripts/get_default_envs.sh >u-boot-initial-env; \ + fi + $(MAKE) $(PARALLEL_MAKE) $(SET_CROSS_BUILD_TOOLS) NO_SDL=1 tools-only envtools + +override_dh_auto_install: + mv tools/env/lib.a tools/env/libubootenv.a + +override_dh_auto_test: + +override_dh_strip: + dh_strip -X libubootenv.a + +%: + dh $@ --parallel diff --git a/recipes-bsp/u-boot/files/secure-boot.cfg b/recipes-bsp/u-boot/files/secure-boot.cfg new file mode 100644 index 0000000..a1b9931 --- /dev/null +++ b/recipes-bsp/u-boot/files/secure-boot.cfg @@ -0,0 +1,6 @@ +### Secure boot config +CONFIG_BOOTDELAY=-2 +CONFIG_USE_BOOTCOMMAND=y +CONFIG_BOOTCOMMAND="setenv scan_dev_for_boot 'if test -e ${devtype} ${devnum}:${distro_bootpart} efi/boot/bootaa64.efi; then load ${devtype} ${devnum}:${distro_bootpart} ${kernel_addr_r} efi/boot/bootaa64.efi; bootefi ${kernel_addr_r} ${fdtcontroladdr}; fi'; run distro_bootcmd; echo 'EFI Boot failed!'; sleep 1000; reset" +CONFIG_EFI_VARIABLES_PRESEED=y +CONFIG_EFI_SECURE_BOOT=y diff --git a/recipes-bsp/u-boot/u-boot-qemu-arm64_2022.04.bb b/recipes-bsp/u-boot/u-boot-qemu-arm64_2022.04.bb new file mode 100644 index 0000000..e462258 --- /dev/null +++ b/recipes-bsp/u-boot/u-boot-qemu-arm64_2022.04.bb @@ -0,0 +1,50 @@ +# +# CIP Core, generic profile +# +# Copyright (c) Siemens AG, 2022 +# +# Authors: +# Jan Kiszka +# +# SPDX-License-Identifier: MIT +# + +require recipes-bsp/u-boot/u-boot-custom.inc + +SRC_URI += " \ + https://ftp.denx.de/pub/u-boot/u-boot-${PV}.tar.bz2 \ + file://0001-lib-date-Make-rtc_mktime-and-mktime64-Y2038-ready.patch \ + file://rules" +SRC_URI[sha256sum] = "68e065413926778e276ec3abd28bb32fa82abaa4a6898d570c1f48fbdb08bcd0" + +SRC_URI_append_secureboot = " \ + file://secure-boot.cfg" + +S = "${WORKDIR}/u-boot-${PV}" + +DEBIAN_BUILD_DEPENDS += ", libssl-dev:native, libssl-dev:arm64" + +DEBIAN_BUILD_DEPENDS_append_secureboot = ", \ + openssl, pesign, secure-boot-secrets, python3-openssl:native" +DEPENDS_append_secureboot = " secure-boot-secrets" + +U_BOOT_CONFIG = "qemu_arm64_defconfig" +U_BOOT_BIN = "u-boot.bin" + +do_prepare_build_append() { + cp ${WORKDIR}/rules ${S}/debian/rules +} + +do_prepare_build_append_secureboot() { + sed -ni '/### Secure boot config/q;p' ${S}/configs/${U_BOOT_CONFIG} + cat ${WORKDIR}/secure-boot.cfg >> ${S}/configs/${U_BOOT_CONFIG} +} + +do_deploy[dirs] = "${DEPLOY_DIR_IMAGE}" +do_deploy() { + dpkg --fsys-tarfile "${WORKDIR}/u-boot-${MACHINE}_${PV}_${DISTRO_ARCH}.deb" | \ + tar xOf - "./usr/lib/u-boot/${MACHINE}/${U_BOOT_BIN}" \ + > "${DEPLOY_DIR_IMAGE}/firmware.bin" +} + +addtask deploy after do_dpkg_build before do_deploy_deb From patchwork Wed May 4 19:45:59 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Kiszka X-Patchwork-Id: 12838463 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 556E1C35275 for ; Wed, 4 May 2022 19:46:09 +0000 (UTC) Received: from mta-64-225.siemens.flowmailer.net (mta-64-225.siemens.flowmailer.net [185.136.64.225]) by mx.groups.io with SMTP id smtpd.web10.2075.1651693567433473499 for ; Wed, 04 May 2022 12:46:07 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=jan.kiszka@siemens.com header.s=fm1 header.b=WREsqJHT; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.225, mailfrom: fm-294854-20220504194605438e03ad7e5c63327d-x_vdxx@rts-flowmailer.siemens.com) Received: by mta-64-225.siemens.flowmailer.net with ESMTPSA id 20220504194605438e03ad7e5c63327d for ; Wed, 04 May 2022 21:46:05 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=jan.kiszka@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=AzHYcEu0j+5gns1JGUX20ciyeMXO2L5ijI5X5XyEWzY=; b=WREsqJHTRLK0LqLmNzZRzEHKRg8iGQv6611nefKZ1e4/g379YrorfKPKud7D/uHOn82rVE HdQ/MV3+YrFe/ULQKKxVDY6Qq748y3o9Y/nLwkEQNkRoE/9CovF1oSYsT3m7pEpuv4cC1mOI WmT7X6RdbQrS9B+eWNXaO5K5RjrGI=; From: Jan Kiszka To: cip-dev@lists.cip-project.org Cc: Quirin Gylstorff , Christian Storm Subject: [isar-cip-core][PATCH 11/12] Enable SWUpdate with and w/o secure boot for QEMU arm64 Date: Wed, 4 May 2022 21:45:59 +0200 Message-Id: <57b7b395a3ed44e4466fd3fa4ef4602430591d12.1651693560.git.jan.kiszka@siemens.com> In-Reply-To: References: MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-294854:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 04 May 2022 19:46:09 -0000 X-Groupsio-URL: https://lists.cip-project.org/g/cip-dev/message/8250 From: Jan Kiszka Hook up the new U-Boot recipe, provide new wks files and disable the watchdog for EFI Boot Guard - that's all what's need to allow offering SWUpdate and secure boot for the QEMU arm64 target. QEMU currently does not provide a watchdog for the virt machine which we plan to use. A patch to change this has been sent, but for now we will have to live without one. Signed-off-by: Jan Kiszka --- Kconfig | 4 ++-- conf/machine/qemu-arm64.conf | 3 +++ kas/opt/ebg-secure-boot-snakeoil.yml | 3 +++ kas/opt/efibootguard.yml | 4 +++- wic/qemu-arm64-efibootguard-secureboot.wks.in | 15 +++++++++++++++ wic/qemu-arm64-efibootguard.wks.in | 13 +++++++++++++ 6 files changed, 39 insertions(+), 3 deletions(-) create mode 100644 wic/qemu-arm64-efibootguard-secureboot.wks.in create mode 100644 wic/qemu-arm64-efibootguard.wks.in diff --git a/Kconfig b/Kconfig index 135794d..651a726 100644 --- a/Kconfig +++ b/Kconfig @@ -131,11 +131,11 @@ if IMAGE_FLASH && !KERNEL_4_4 && !KERNEL_4_19 config IMAGE_SWUPDATE bool "SWUpdate support for root partition" - depends on TARGET_QEMU_AMD64 || TARGET_SIMATIC_IPC227E + depends on TARGET_QEMU_AMD64 || TARGET_SIMATIC_IPC227E || TARGET_QEMU_ARM64 config IMAGE_SECURE_BOOT bool "Secure boot support" - depends on TARGET_QEMU_AMD64 + depends on TARGET_QEMU_AMD64 || TARGET_QEMU_ARM64 select IMAGE_SWUPDATE config KAS_INCLUDE_SWUPDATE_SECBOOT diff --git a/conf/machine/qemu-arm64.conf b/conf/machine/qemu-arm64.conf index 0d21262..4e12cdb 100644 --- a/conf/machine/qemu-arm64.conf +++ b/conf/machine/qemu-arm64.conf @@ -11,3 +11,6 @@ DISTRO_ARCH = "arm64" IMAGE_FSTYPES ?= "ext4-img" USE_CIP_KERNEL_CONFIG = "1" KERNEL_DEFCONFIG ?= "cip-kernel-config/${KERNEL_DEFCONFIG_VERSION}/arm64/qemu_arm64_defconfig" + +# for SWUpdate setups: watchdog is configured in U-Boot +WDOG_TIMEOUT = "0" diff --git a/kas/opt/ebg-secure-boot-snakeoil.yml b/kas/opt/ebg-secure-boot-snakeoil.yml index 7442eb7..3f2a794 100644 --- a/kas/opt/ebg-secure-boot-snakeoil.yml +++ b/kas/opt/ebg-secure-boot-snakeoil.yml @@ -32,3 +32,6 @@ local_conf_header: IMAGER_INSTALL += "ebg-secure-boot-signer" # Use snakeoil keys PREFERRED_PROVIDER_secure-boot-secrets = "secure-boot-snakeoil" + + secureboot_override: | + OVERRIDES .= ":secureboot" diff --git a/kas/opt/efibootguard.yml b/kas/opt/efibootguard.yml index c71cdb3..d85aed7 100644 --- a/kas/opt/efibootguard.yml +++ b/kas/opt/efibootguard.yml @@ -27,10 +27,12 @@ local_conf_header: IMAGE_FSTYPES ?= "wic-img" WKS_FILE ?= "${MACHINE}-efibootguard.wks.in" - ovmf-binaries: | + firmware-binaries: | # Add ovmf binaries for qemu IMAGER_BUILD_DEPS_append_qemu-amd64 += "ovmf-binaries" # not needed for Debian 11 and later OVERRIDES_append_qemu-amd64 = ":${BASE_DISTRO_CODENAME}" DISTRO_APT_SOURCES_append_qemu-amd64_buster = " conf/distro/debian-buster-backports.list" DISTRO_APT_PREFERENCES_append_qemu-amd64_buster = " conf/distro/preferences.ovmf-snakeoil.conf" + # Add U-Boot for qemu + IMAGER_BUILD_DEPS_append_qemu-arm64 += "u-boot-qemu-arm64" diff --git a/wic/qemu-arm64-efibootguard-secureboot.wks.in b/wic/qemu-arm64-efibootguard-secureboot.wks.in new file mode 100644 index 0000000..df6a9a1 --- /dev/null +++ b/wic/qemu-arm64-efibootguard-secureboot.wks.in @@ -0,0 +1,15 @@ +# EFI partition containing efibootguard bootloader binary +include ebg-signed-bootloader.inc + +# EFI Boot Guard environment/config partitions plus Kernel files +part --source efibootguard-boot --size 32M --extra-space 0 --overhead-factor 1 --label BOOT0 --align 1024 --part-type=0700 --sourceparams "revision=2,signwith=/usr/bin/sign_secure_image.sh" +part --source efibootguard-boot --size 32M --extra-space 0 --overhead-factor 1 --label BOOT1 --align 1024 --part-type=0700 --sourceparams "revision=1,signwith=/usr/bin/sign_secure_image.sh" + +part --source rawcopy --sourceparams "file=${IMAGE_FULLNAME}.${VERITY_IMAGE_TYPE}.verity.img" --align 1024 --fixed-size 1G --uuid "fedcba98-7654-3210-cafe-5e0710000001" +part --source rawcopy --sourceparams "file=${IMAGE_FULLNAME}.${VERITY_IMAGE_TYPE}.verity.img" --align 1024 --fixed-size 1G --uuid "fedcba98-7654-3210-cafe-5e0710000002" + +# home and var are extra partitions +part /home --source rootfs --rootfs-dir=${IMAGE_ROOTFS}/home --fstype=ext4 --label home --align 1024 --size 1G +part /var --source rootfs --rootfs-dir=${IMAGE_ROOTFS}/var --fstype=ext4 --label var --align 1024 --size 2G + +bootloader --ptable gpt --append="panic=5" diff --git a/wic/qemu-arm64-efibootguard.wks.in b/wic/qemu-arm64-efibootguard.wks.in new file mode 100644 index 0000000..a153205 --- /dev/null +++ b/wic/qemu-arm64-efibootguard.wks.in @@ -0,0 +1,13 @@ +# short-description: arm64 with EFI Boot Guard and SWUpdate +# long-description: Disk image for arm64 machines with EFI Boot Guard and SWUpdate + +include ebg-sysparts.inc + +part --source rawcopy --sourceparams "file=${IMAGE_FULLNAME}.squashfs.img" --align 1024 --fixed-size 1G --uuid "fedcba98-7654-3210-cafe-5e0710000001" +part --source rawcopy --sourceparams "file=${IMAGE_FULLNAME}.squashfs.img" --align 1024 --fixed-size 1G --uuid "fedcba98-7654-3210-cafe-5e0710000002" + +# home and var are extra partitions +part /home --source rootfs --rootfs-dir=${IMAGE_ROOTFS}/home --fstype=ext4 --label home --align 1024 --size 1G +part /var --source rootfs --rootfs-dir=${IMAGE_ROOTFS}/var --fstype=ext4 --label var --align 1024 --size 2G + +bootloader --ptable gpt From patchwork Wed May 4 19:46:00 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Kiszka X-Patchwork-Id: 12838452 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 23C5AC433F5 for ; Wed, 4 May 2022 19:46:09 +0000 (UTC) Received: from mta-64-225.siemens.flowmailer.net (mta-64-225.siemens.flowmailer.net [185.136.64.225]) by mx.groups.io with SMTP id smtpd.web11.2075.1651693567778213038 for ; Wed, 04 May 2022 12:46:08 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=jan.kiszka@siemens.com header.s=fm1 header.b=VRNBDvVJ; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.225, mailfrom: fm-294854-20220504194605fff2e700b280273606-_7j7tu@rts-flowmailer.siemens.com) Received: by mta-64-225.siemens.flowmailer.net with ESMTPSA id 20220504194605fff2e700b280273606 for ; Wed, 04 May 2022 21:46:06 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=jan.kiszka@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=rG5xDmnDBa7deYwip/ylz/on0rCvU7M57dqk/4nR6Tk=; b=VRNBDvVJNvGQN29a1+913fVceytw47KBDwMLekSDP/Okl1rVs0rtOD5yUGS85jw64VGjXn NCr7xQV8tUoAFXFwVwhTcWON57URpHN0bYA91zcILNhnLQNdgdc4Sa1PePCaTUcEQUvI3Twf XYLBnY2Oyf2DGhxxyzs7M3oAwZHbQ=; From: Jan Kiszka To: cip-dev@lists.cip-project.org Cc: Quirin Gylstorff , Christian Storm Subject: [isar-cip-core][PATCH 12/12] start-qemu.sh: Add support for SWUpdate and secure boot mode to arm64 Date: Wed, 4 May 2022 21:46:00 +0200 Message-Id: <7091df13d797c9ed013c8d189c9f1d888f384680.1651693560.git.jan.kiszka@siemens.com> In-Reply-To: References: MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-294854:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 04 May 2022 19:46:09 -0000 X-Groupsio-URL: https://lists.cip-project.org/g/cip-dev/message/8251 From: Jan Kiszka We just need to pick up the newly deployed firmware.bin as -bios, analogously to the x86's OVMF, and switch to a disk image. A separate key storage is not yet used, thus there is no difference between normal and secure mode for arm64 so far. Signed-off-by: Jan Kiszka --- start-qemu.sh | 67 ++++++++++++++++++++++++++++++++------------------- 1 file changed, 42 insertions(+), 25 deletions(-) diff --git a/start-qemu.sh b/start-qemu.sh index fe08ebd..ad4fca5 100755 --- a/start-qemu.sh +++ b/start-qemu.sh @@ -45,7 +45,10 @@ if [ -z "${TARGET_IMAGE}" ];then fi fi -case "$1" in +arch="$1" +shift 1 + +case "${arch}" in x86|x86_64|amd64) DISTRO_ARCH=amd64 QEMU=qemu-system-x86_64 @@ -98,7 +101,7 @@ case "$1" in usage ;; *) - echo "Unsupported architecture: $1" + echo "Unsupported architecture: ${arch}" exit 1 ;; esac @@ -107,40 +110,54 @@ IMAGE_PREFIX="$(dirname $0)/build/tmp/deploy/images/qemu-${DISTRO_ARCH}/${TARGET if [ -z "${DISPLAY}" ]; then QEMU_EXTRA_ARGS="${QEMU_EXTRA_ARGS} -nographic" - case "$1" in + case "${arch}" in x86|x86_64|amd64) KERNEL_CMDLINE="${KERNEL_CMDLINE} console=ttyS0" esac fi -shift 1 - QEMU_COMMON_OPTIONS=" \ -m 1G \ -serial mon:stdio \ -netdev user,id=net,hostfwd=tcp:127.0.0.1:22222-:22 \ ${QEMU_EXTRA_ARGS}" -if [ -n "${SECURE_BOOT}" ]; then - ovmf_code=${OVMF_CODE:-./build/tmp/deploy/images/qemu-amd64/OVMF/OVMF_CODE_4M.secboot.fd} - ovmf_vars=${OVMF_VARS:-./build/tmp/deploy/images/qemu-amd64/OVMF/OVMF_VARS_4M.snakeoil.fd} - - ${QEMU_PATH}${QEMU} \ - -global ICH9-LPC.disable_s3=1 \ - -global isa-fdc.driveA= \ - -drive if=pflash,format=raw,unit=0,readonly=on,file=${ovmf_code} \ - -drive if=pflash,format=raw,file=${ovmf_vars} \ - -drive file=${IMAGE_PREFIX}.wic.img,discard=unmap,if=none,id=disk,format=raw \ - ${QEMU_COMMON_OPTIONS} "$@" - -elif [ -n "${SWUPDATE_BOOT}" ]; then - ovmf_code=${OVMF_CODE:-./build/tmp/deploy/images/qemu-amd64/OVMF/OVMF_CODE_4M.fd} - - ${QEMU_PATH}${QEMU} \ - -drive file=${IMAGE_PREFIX}.wic.img,discard=unmap,if=none,id=disk,format=raw \ - -drive if=pflash,format=raw,unit=0,readonly=on,file=${ovmf_code} \ - ${QEMU_COMMON_OPTIONS} "$@" - +if [ -n "${SECURE_BOOT}${SWUPDATE_BOOT}" ]; then + case "${arch}" in + x86|x86_64|amd64) + if [ -n "${SECURE_BOOT}" ]; then + ovmf_code=${OVMF_CODE:-./build/tmp/deploy/images/qemu-amd64/OVMF/OVMF_CODE_4M.secboot.fd} + ovmf_vars=${OVMF_VARS:-./build/tmp/deploy/images/qemu-amd64/OVMF/OVMF_VARS_4M.snakeoil.fd} + + ${QEMU_PATH}${QEMU} \ + -global ICH9-LPC.disable_s3=1 \ + -global isa-fdc.driveA= \ + -drive if=pflash,format=raw,unit=0,readonly=on,file=${ovmf_code} \ + -drive if=pflash,format=raw,file=${ovmf_vars} \ + -drive file=${IMAGE_PREFIX}.wic.img,discard=unmap,if=none,id=disk,format=raw \ + ${QEMU_COMMON_OPTIONS} "$@" + else + ovmf_code=${OVMF_CODE:-./build/tmp/deploy/images/qemu-amd64/OVMF/OVMF_CODE_4M.fd} + + ${QEMU_PATH}${QEMU} \ + -drive file=${IMAGE_PREFIX}.wic.img,discard=unmap,if=none,id=disk,format=raw \ + -drive if=pflash,format=raw,unit=0,readonly=on,file=${ovmf_code} \ + ${QEMU_COMMON_OPTIONS} "$@" + fi + ;; + arm64|aarch64) + u_boot_bin=${FIRMWARE_BIN:-./build/tmp/deploy/images/qemu-arm64/firmware.bin} + + ${QEMU_PATH}${QEMU} \ + -drive file=${IMAGE_PREFIX}.wic.img,discard=unmap,if=none,id=disk,format=raw \ + -bios ${u_boot_bin} \ + ${QEMU_COMMON_OPTIONS} "$@" + ;; + *) + echo "Unsupported architecture: ${arch}" + exit 1 + ;; + esac else IMAGE_FILE=$(ls ${IMAGE_PREFIX}.ext4.img)