summaryrefslogtreecommitdiffstats
path: root/meta-efi-secure-boot
Commit message (Collapse)AuthorAgeFilesLines
* efitools: do not do_sign if GRUB_SIGN_VERIFY not enabledHongxu Jia2019-11-191-0/+3
| | | | | | | | | | | | | | | | | | | If GRUB_SIGN_VERIFY is not enabled, do_sign will fail in which GPG_PATH is not set (--homedir None) ... |DEBUG: Executing python function do_sign |NOTE: Running: echo "SecureCore" | tmp-glibc/hosttools/gpg --pinentry-mode loopback --batch --homedir None -u "SecureBootCore" --detach-sign --passphrase-fd 0 "tmp-glibc/work/core2-32-wrs-linux/efitools/ 1.9.2+gitAUTOINC+392836a46c-r0/image/boot/efi/EFI/BOOT/LockDown.efi" |ERROR: Failed to sign: tmp-glibc/work/core2-32-wrs-linux/efitools/ 1.9.2+gitAUTOINC+392836a46c-r0/image/boot/efi/EFI/BOOT/LockDown.efi ... Since GPG_PATH is set in do_sign's prefunc check_boot_public_key if GRUB_SIGN_VERIFY is enabled, add the same condition to do_sign Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* efitools-native: Fix compilation problem with latest /usr/include/efiHongxu Jia2019-11-192-1/+1
| | | | | | | Since commit [382ffa1 efitools: Fix compilation problem with latest /usr/include/efi], we should apply the fix to native also. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* kernel-initramfs-efi-secure-boot.inc: Copy .sig files and .p7bJason Wessel2019-11-141-5/+3
| | | | | | | | | | | While refactoring the code to eliminate the overlap in the copy of the .sig and .p7b files the UEFI_SELOADER test was not removed. This results in the .sig files not getting copied to the deploy directory when using the GRUB_SIGN_VERIFY = "1". All that is needed is to remove the UEFI_SELOADER test statement. Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* secure boot: Make SELoader optional and copy sig files when GRUB_SIGN_VERIFY=1Jason Wessel2019-11-086-30/+54
| | | | | | | | | | | | | | | This commit makes the SELoader entire optional and allows it to be removed, with the intended replacement being to use grub's built in gpg key verification. It will be possible in a template or local.conf: UEFI_SELOADER = "0" GRUB_SIGN_VERIFY = "1" [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* grub: Make SELoader optional and add gpg verify supportJason Wessel2019-11-084-74/+247
| | | | | | | | | | | | | | | | | | | | Allow SELoader to be an optional component for secure boot verification. The GPG_SIGN_VERIFY variable was added to control the ability to have grub perform all of the verification of the loaded files using a public key which gets built into grub at the time that mkimage is run. It is not intended that GPG_SIGN_VERIFY and UEFI_SELOADER would both be set to "1". While this configuration could work, it makes very little sense to use the system that way. Also enabled is the tftp feature for grub as a builtin. This allows grub to start from the network when the UEFI is configured to boot off the network with tftp. [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* efitools: Fix compilation problem with latest /usr/include/efiJason Wessel2019-11-082-0/+40
| | | | | | | | | | | | gcc -I/opt/tmp/work/x86_64-linux/efitools-native/1.9.2+gitAUTOINC+392836a46c-r0/git/include/ -I/opt/tmp/work/x86_64-linux/efitools-native/1.9.2+gitAUTOINC+392836a46c-r0/recipe-sysroot-native/usr/include -I/opt/tmp/work/x86_64-linux/efitools-native/1.9.2+gitAUTOINC+392836a46c-r0/recipe-sysroot-native/usr/include/efi -I/opt/tmp/work/x86_64-linux/efitools-native/1.9.2+gitAUTOINC+392836a46c-r0/recipe-sysroot-native/usr/include/efi/x86_64 -I/opt/tmp/work/x86_64-linux/efitools-native/1.9.2+gitAUTOINC+392836a46c-r0/recipe-sysroot-native/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -fno-stack-protector -ffreestanding -fno-stack-check -DGNU_EFI_USE_MS_ABI -DEFI_FUNCTION_WRAPPER -mno-red-zone -DCONFIG_x86_64 -fno-toplevel-reorder -DBUILD_EFI -c console.c -o console.efi.o | console.c:360:5: error: ‘EFI_WARN_UNKOWN_GLYPH’ undeclared here (not in a function); did you mean ‘EFI_WARN_UNKNOWN_GLYPH’? | { EFI_WARN_UNKOWN_GLYPH, L"Warning Unknown Glyph"}, | ^~~~~~~~~~~~~~~~~~~~~ | EFI_WARN_UNKNOWN_GLYPH | ../Make.rules:113: recipe for target 'console.efi.o' failed Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* shim: Fix compilation problem with latest /usr/include/efiJason Wessel2019-11-082-0/+40
| | | | | | | | | | | | | | | | | x86_64-poky-linux-gcc -ggdb -O0 -fno-stack-protector -fno-strict-aliasing -fpic -fshort-wchar -Wall -Wsign-compare -Werror -fno-builtin -Werror=sign-compare -ffreestanding -std=gnu89 -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/recipe-sysroot-native/usr/bin/x86_64-poky-linux/../../lib/x86_64-poky-linux/gcc/x86_64-poky-linux/9.2.0/include -DDEFAULT_LOADER=L"\SELoaderx64.efi" -DDEFAULT_LOADER_CHAR="\SELoaderx64.efi" -nostdinc -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/git/Cryptlib -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/git/Cryptlib/Include -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/recipe-sysroot/usr/include/efi -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/recipe-sysroot/usr/include/efi/x86_64 -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/recipe-sysroot/usr/include/efi/protocol -I/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/git/include -iquote /opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/git -iquote /opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/git -DOVERRIDE_SECURITY_POLICY -DENABLE_HTTPBOOT -mno-mmx -mno-sse -mno-red-zone -nostdinc -maccumulate-outgoing-args -DEFI_FUNCTION_WRAPPER -DGNU_EFI_USE_MS_ABI -DNO_BUILTIN_VA_FUNCS -DMDE_CPU_X64 -DPAGE_SIZE=4096 -DEFI_ARCH=L"x64" -DDEBUGDIR=L"/usr/lib/debug/usr/share/shim/x64-12-_poky_3.0/" -DVENDOR_CERT_FILE="/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/vendor_cert.cer" -c -o console.o console.c | console.c:363:5: error: 'EFI_WARN_UNKOWN_GLYPH' undeclared here (not in a function); did you mean 'EFI_WARN_UNKNOWN_GLYPH'? | 363 | { EFI_WARN_UNKOWN_GLYPH, L"Warning Unknown Glyph"}, | | ^~~~~~~~~~~~~~~~~~~~~ | | EFI_WARN_UNKNOWN_GLYPH | <builtin>: recipe for target 'console.o' failed | make[1]: *** [console.o] Error 1 | make[1]: Leaving directory '/opt/tmp/work/core2-64-poky-linux/shim/12+gitAUTOINC+5202f80c32-r0/git/lib' | Makefile:223: recipe for target 'lib/lib.a' failed | make: *** [lib/lib.a] Error 2 | WARNING: exit code 1 from a shell command. Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* efitools: Uprev to fix LockDown.efi for UEFI built after 2018Jason Wessel2019-11-084-80/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Versions of the UEFI core from 2018 on will not work properly with LockDown.efi's key install. It will report that the PK key cannot be installed due to the handling of the signature header with the PKCS7 data. There are several other minor bug fixes, with the short log shown below. ==== James Bottomley (13): cert-to-efi-hash-list: fix for openssl 1.1 Version: 1.8.0 Fix Fedora build Version: 1.8.1 factor out variable signing code support engine based keys use SignedData instead of PKCS7 for variable updates Version: 1.9.0 Makefile: Reverse the order of lib.a and -lcrypto Version: 1.9.1 sign-efi-sig-list: add man page entry for engine option sha256: do not align raw section sizes Version: 1.9.2 pai-yi.huang (1): efi-updatevar: remove all authenticated attributes from signature Make.rules | 6 ++--- Makefile | 12 +++++----- cert-to-efi-hash-list.c | 6 ++++- efi-updatevar.c | 28 +++++++++++------------ include/openssl_sign.h | 10 ++++++++ include/version.h | 2 +- lib/Makefile | 2 +- lib/openssl_sign.c | 156 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ lib/sha256.c | 8 ++++--- sign-efi-sig-list.c | 59 +++++++++++------------------------------------ 10 files changed, 213 insertions(+), 76 deletions(-) create mode 100644 include/openssl_sign.h create mode 100644 lib/openssl_sign.c [ Issue: LINUXEXEC-2450 ] Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
* grub-efi/boot-menu.inc: remove invalid menuentry (#122)Zhao Yi2019-11-011-5/+0
| | | | | | Currently the recovery menuentry is not available because we don't provide bzImage_backup and initrd_backup. Remove this entry. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* conf/layer.conf: Add zeus to LAYERSERIES_COMPAT (#121)muvarov2019-11-011-1/+1
| | | Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
* seloader: use pkcs7 drivers from OVMFDmitry Eremin-Solenikov2019-09-041-13/+6
| | | | | | | Rather than using pre-compiled EFI drivers, use freshly compiled drivers from OVMF source tree. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
* ovmf: package PKCS7 verification driversDmitry Eremin-Solenikov2019-09-041-0/+59
| | | | | | | Package Pkcs7VerifyDxe.efi and Hash2DxeCrypto.efi to be used by SELoader bootloader. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
* grub-efi: support mok2 verify in multiboot2 protocolDmitry Eremin-Solenikov2019-09-042-0/+55
| | | | | | | Add support for verifying PKCS#7 signatures via MOK2 protocol to multiboot2 command enabling one to load multiboot-capable kernels. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
* grub-efi: fix uid contamination by host QA warningLiwei Song2019-08-261-0/+10
| | | | | | | | | Fix the following QA issue: WARNING: grub-efi-2.04-r0 do_package_qa: QA Issue: grub-efi: /boot/efi/EFI/BOOT/grub.cfg.p7b is owned by uid 19183 chown to root for p7b file to fix uid contamination by host. Signed-off-by: Liwei Song <liwei.song@windriver.com>
* meta-secure-core: add linux-yocto-dev bbappendYi Zhao2019-08-131-0/+1
| | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* meta-efi-secure-boot: only apply if efi-secure-boot distro flag setMark Hatle2019-08-134-150/+151
| | | | | | | | Only apply grub-efi and linux-yocto bbappend if feature efi-secure-boot set Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* grub-efi: update bbappend and refresh patchesYi Zhao2019-08-132-22/+28
| | | | | | | The grub-efi has been upgraded to 2.04 in oe-core. Update the bbappend and refresh patches to adapt it. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* shim: fix build failure with gcc9Yi Zhao2019-06-052-0/+76
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Backport patch to fix build error with gcc9 for option "-Werror=address-of-packed-member" MokManager.c: In function 'write_back_mok_list': MokManager.c:1125:19: error: taking address of packed member of 'struct <anonymous>' may result in an unaligned pointer value [-Werror=address-of-packed-member] 1125 | if (CompareGuid(&(list[i].Type), &CertType) == 0) | ^~~~~~~~~~~~~~~ MokManager.c:1147:19: error: taking address of packed member of 'struct <anonymous>' may result in an unaligned pointer value [-Werror=address-of-packed-member] 1147 | if (CompareGuid(&(list[i].Type), &CertType) == 0) { | ^~~~~~~~~~~~~~~ MokManager.c: In function 'delete_cert': MokManager.c:1188:19: error: taking address of packed member of 'struct <anonymous>' may result in an unaligned pointer value [-Werror=address-of-packed-member] 1188 | if (CompareGuid(&(mok[i].Type), &CertType) != 0) | ^~~~~~~~~~~~~~ MokManager.c: In function 'delete_hash_in_list': MokManager.c:1239:20: error: taking address of packed member of 'struct <anonymous>' may result in an unaligned pointer value [-Werror=address-of-packed-member] 1239 | if ((CompareGuid(&(mok[i].Type), &Type) != 0) || | ^~~~~~~~~~~~~~ MokManager.c: In function 'delete_keys': MokManager.c:1410:19: error: taking address of packed member of 'struct <anonymous>' may result in an unaligned pointer value [-Werror=address-of-packed-member] 1410 | if (CompareGuid(&(del_key[i].Type), &CertType) == 0) { | ^~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors <builtin>: recipe for target 'MokManager.o' failed Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* conf/layer.conf: Add warrior to LAYERSERIES_COMPATYi Zhao2019-04-231-1/+1
| | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* grub-efi: fix the potential uninitialized error for variable 'err'Wenzong Fan2018-12-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix the build errors with DEBUG_BUILD enabled: grub-core/loader/linux.c: In function 'grub_initrd_load': grub-core/loader/linux.c:326:10: error: 'err' may be used \ uninitialized in this function [-Werror=maybe-uninitialized] In function grub_initrd_load: grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, char *argv[], void *target) { [snip] grub_err_t err; [snip] #ifdef GRUB_MACHINE_EFI [snip] err = grub_verify_file (argv[i]); [snip] #endif [snip] fail: [snip] return err; } If the GRUB_MACHINE_EFI is not defined, the function would return an uninitialized value for 'err'. We should initialize it when this variable is assigned. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* kernel-initramfs: only apply the bbappend if efi-secure-boot distro flag setYi Zhao2018-11-302-37/+38
| | | | | | | | | | | | | | | | | | | | | | | When the meta-efi-secure-boot layer is included but feature efi-secure-boot is not set. We got the following error with kernel-initramfs building: ERROR: kernel-initramfs-1.0-r0 do_deploy: Function failed: do_deploy (log file is located at /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/temp/log.do_deploy.16995) ERROR: Logfile of failure stored in: /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/temp/log.do_deploy.16995 Log data follows: | DEBUG: Executing python function sstate_task_prefunc | DEBUG: Python function sstate_task_prefunc finished | DEBUG: Executing shell function do_deploy | install: cannot stat '/buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/image/boot/*.p7b': No such file or directory | WARNING: /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/temp/run.do_deploy.16995:1 exit 1 from 'install -m 0644 ${SIG} /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/deploy-kernel-initramfs' | ERROR: Function failed: do_deploy (log file is located at /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/temp/log.do_deploy.16995) ERROR: Task (/buildarea/poky/meta-secure-core/meta/recipes-core/images/kernel-initramfs.bb:do_deploy) failed with exit code '1' Rename kernel-initramfs.bbappend to kernel-initramfs-efi-secure-boot.inc and add a new bbappend. Make sure this piece of code should be applied only if the efi-secure-boot feature is set. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* meta-efi-secure-boot: Ensure openssl-native exists when we need itTom Rini2018-11-074-2/+5
| | | | | | | | | | | In order to deploy our secure boot keys in DER format we need to use openssl. This must be listed in our DEPENDS line in order for the sysroot to be populated correctly when we run do_sign. Also drop the explicit fakeroot on our empty grub-efi do_sign as we may not have globally populated virtual/fakeroot-native at that point in time. Fixes: 92316d4b402b ("meta-signing-key: When deploying keys UEFI keys, deploy DER format") Signed-off-by: Tom Rini <trini@konsulko.com>
* layer.conf: update LAYERSERIES_COMPAT `sumo' -> `thud'Hongxu Jia2018-10-081-1/+1
| | | | | | | | Since `9ec5a8a layer.conf: Drop sumo from LAYERSERIES_CORENAMES' and `9867924 layer.conf: Add thud to LAYERSERIES_CORENAMES' applied in oe-core, update LAYERSERIES_COMPAT `sumo' -> `thud' Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
* Clean up the stuffs for stable branchesJia Zhang2018-09-202-3/+1
| | | | | | | | | | | The following commits are reverted by the way: - seloader: Fix building for rocko (bc6bbe2) - meta-integrity: rpm: Add back in required patches for rocko (5fa9c85) Because they are only applicable to rocko. Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* mokutil: Fix build failure due to missing crypt.hJia Zhang2018-09-171-1/+1
| | | | Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* linux-yocto-efi-secure-boot: rename type variable to imageTypeYi Zhao2018-09-181-12/+12
| | | | | | | | The oe-core commit 8d454ea754c96561257b1cc011fa638ceaa771db renamed type variable to imageType in kernel.bbclass to avoid confusion with "type" command in shell. We also do the same thing here. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* linux-yocto-efi-secure-boot: rename KERNEL_IMAGE_BASE_NAME to ↵Yi Zhao2018-09-181-2/+2
| | | | | | | | | | KERNEL_IMAGE_NAME and KERNEL_IMAGE_SYMLINK_NAME to KERNEL_IMAGE_LINK_NAME The *_BASE_NAME was renamed to *_NAME and *_SYMLINK_NAME was renamed to *_LINK_NAME in oe-core commit f952c8e08b4798aa0f8bf764cfd70bda0eae9b8b. So we also need to do the same thing here. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* efitools: refresh patch to fix QA warningYi Zhao2018-09-061-6/+3
| | | | | | Refresh patch Build-DBX-by-default.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* efitools: add the deployed artifacts to SSTATE_DUPWHITELISTYi Zhao2018-09-061-0/+2
| | | | | | | | | | | | | | | | | | | The oe-core commit 05f6042a40bb772f7ce8d6819c5b2937d8c9808d removed DEPLOY_DIR_IMAGE from SSTATE_DUPWHITELIST which caused a do_depoy error when enable multilib: $ bitbake efitools lib32-efitools ERROR: lib32-efitools-1.7.0+gitAUTOINC+0649468475-r0 do_deploy: The recipe lib32-efitools is trying to install files into a shared area when those files already exist. Those files and their manifest location are: /buildarea/build/tmp-glibc/deploy/images/qemux86-64/LockDown.efi (matched in manifest-qemux86_64-efitools.deploy) Please verify which recipe should provide the above files. Add the deployed artifacts to SSTATE_DUPWHITELIST to fix this issue. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* seloader: add the deployed artifacts to SSTATE_DUPWHITELISTYi Zhao2018-09-061-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | The oe-core commit 05f6042a40bb772f7ce8d6819c5b2937d8c9808d removed DEPLOY_DIR_IMAGE from SSTATE_DUPWHITELIST which caused a do_depoy error when enable multilib: $ bitbake seloader lib32-seloader ERROR: lib32-seloader-0.4.6+gitAUTOINC+8b90f76a8d-r0 do_deploy: The recipe lib32-seloader is trying to install files into a shared area when those files already exist. Those files and their manifest location are: /buildarea/build/tmp-glibc/deploy/images/qemux86-64/Pkcs7VerifyDxe.efi (matched in manifest-qemux86_64-seloader.deploy) /buildarea/build/tmp-glibc/deploy/images/qemux86-64/Hash2DxeCrypto.efi (matched in manifest-qemux86_64-seloader.deploy) /buildarea/build/tmp-glibc/deploy/images/qemux86-64/efi-unsigned/Pkcs7VerifyDxe.efi (matched in manifest-qemux86_64-seloader.deploy) /buildarea/build/tmp-glibc/deploy/images/qemux86-64/efi-unsigned/Hash2DxeCrypto.efi (matched in manifest-qemux86_64-seloader.deploy) Please verify which recipe should provide the above files. Add the deployed artifacts to SSTATE_DUPWHITELIST to fix this issue. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* sbsigntool: Enable nativesdk supportTom Rini2018-08-251-0/+1
| | | | | | | | There are times were we might want to include sbsigntool into an SDK so rename the recipe and extend to include nativesdk. We also need gnu-efi to support nativesdk so include that in a bbappend. Signed-off-by: Tom Rini <trini@konsulko.com>
* seloader: Fix building for rockoTom Rini2018-07-311-0/+2
| | | | | | | | | When building on rocko we have gnu-efi version 3.0.6 around and seloader needs to be told this for certain string functions to be provided by itself rather than gnu-efi. Add in conditional logic to pass this only for rocko. Signed-off-by: Tom Rini <trini@konsulko.com>
* layer.conf: Mark as compatible with rockoTom Rini2018-07-251-1/+1
| | | | | | | As we also work with the 'rocko' release list that in our LAYERSERIES_COMPAT. Signed-off-by: Tom Rini <trini@konsulko.com>
* layer.conf: Include secure-core for kernel-initramfs.bbMark Hatle2018-07-181-0/+1
| | | | | | | | | | | | The kernel-initramfs.bbappend depends on kernel-initramfs.bb in meta-secure-core/meta/recipes-core/images/ Fix parsing error: ERROR: No recipes available for: meta-secure-core/meta-efi-secure-boot/recipes-core/images/kernel-initramfs.bbappend Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* seloader: Update to 0.4.6Jia Zhang2018-07-171-2/+2
| | | | Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* Add root parameter configuration in boot command line.Jinliang Li2018-06-261-0/+6
| | | | | | | It is helpful when secure boot is enabled, because you can not modify boot command line after boot-menu.inc is signed before deploying. Signed-off-by: Jinliang Li <jinliang.li@linux.alibaba.com>
* linux-yocto-efi-secure-boot: using shutil.copyfile instead of shutil.move to ↵Yi Zhao2018-06-201-1/+1
| | | | | | | | | | | | copy kernel p7b file In commit 1c96c0d09614a3a692a8bee201e34694f26c436a, the kernel p7b file is moved from ${B}/${KERNEL_OUTPUT_DIR}/ to ${D}/boot/. But in do_deploy(), it still try to copy p7b file from ${B}/${KERNEL_OUTPUT_DIR}/ to ${DEPLOYDIR}/. Using shutil.copyfile instead of shutil.move to fix this issue. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* linux-yocto-efi-secure-boot: fix typoYi Zhao2018-06-201-1/+1
| | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* layer.conf: add LAYERSERIES_COMPATTrevor Woerner2018-05-261-0/+2
| | | | | | see https://patchwork.openembedded.org/patch/140542/ Signed-off-by: Trevor Woerner <twoerner@gmail.com>
* seloader: sync up with the latestJia Zhang2018-05-201-1/+1
| | | | Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* grub-efi: remove aarch64 from COMPATIBLE_HOSTKai Kang2018-05-161-0/+3
| | | | | | | Functions efi_call_foo and efi_shim_exit are not implemented for arm64 yet, so remove 'aarch64' from COMPATIBLE_HOST for now. Signed-off-by: Kai Kang <kai.kang@windriver.com>
* linux-yocto-efi-secure-boot: Package unversioned signature as symlinkTom Rini2018-05-131-1/+3
| | | | | | | | To match the usual user experience of having /boot/${KERNEL_IMAGETYPE} exist as a symlink to the real kernrel, also have our signature file exist for that as a symlink and include it in the package file. Signed-off-by: Tom Rini <trini@konsulko.com>
* grub-efi: fix compile errors for arm64Kai Kang2018-05-112-20/+32
| | | | | | | It fails to build grub-efi for arm64. Add definitions of missing macros and replace x86 specified asm codes with function grub_halt(). Signed-off-by: Kai Kang <kai.kang@windriver.com>
* grub-efi: refresh patches to fix QA warningYi Zhao2018-05-103-13/+23
| | | | | | | | | Refresh the following patches: 0003-efi-chainloader-implement-an-UEFI-Exit-service-for-s.patch 0005-efi-chainloader-use-shim-to-load-and-verify-an-image.patch Grub-get-and-set-efi-variables.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
* meta-efi-secure-core: Move kernel-initramfs.bbappendTom Rini2018-05-061-0/+0
| | | | | | | As the main recipe resides in meta/recipes-core/images/ move the append to recipes-core/images/ as well for consistency. Signed-off-by: Tom Rini <trini@konsulko.com>
* kernel-initramfs: Rework to use update-alternatives directlyTom Rini2018-05-061-42/+19
| | | | | | | | | | | | | | - All valid initramfs types will be listed in INITRAMFS_FSTYPES so use that variable rather than open-coding a list of possibilities. - Since we're using the list of things that must exist now we don't need to test if the files exist anymore. And when signing, we can sign all of them now. - Add some python to do_package to update all of the ALTERNATIVES variables dynamically based on how we're configured. This introduces an alternative for the initramfs portion as well so there is a stable name. Signed-off-by: Tom Rini <trini@konsulko.com>
* efitools: Rework how we deal with rpath and linking of Linux appsTom Rini2018-05-023-30/+28
| | | | | | | | | | | | | | | | - In all cases, when building Linux apps (and thus linking with gcc) we need to pass in the normal set of LDFLAGS for both rpath and link hash type. - Rework Fix-for-the-cross-compilation.patch a bit. When linking EFI apps (and thus linking with ld) we don't need to pass in other special flags. When linking the "openssl" apps we do not need to spell out the crtN files as gcc handles that for us, they are normal Linux apps. Ensure that all Linux apps get our EXTRA_LDFLAGS passed in. With all of these changes we are now able to reuse sstate cache between build directories. Signed-off-by: Tom Rini <trini@konsulko.com>
* grub/boot-menu: Rename _bakup suffix to _backupJia Zhang2018-03-191-3/+3
| | | | Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* seloader: sync up with upstreamJia Zhang2018-02-281-1/+1
| | | | Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
* efitools: use oe.utils.str_filter_outJackie Huang2018-02-071-2/+2
| | | | | | | oe_filter_out has been removed from oe-core so use the replacement function oe.utils.str_filter_out. Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-04 04:51:32 +0000