peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-08-03 14:23:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

rauc: Initial support

Browse Source 
Add support for firmware updates via RAUC on aarch64. The created RAUC
bundle (images/infix-$BR2_ARCH.pkg) is signed with the same key used
to sign the raw FIT image.
This commit is contained in:
Tobias Waldekranz
2023-03-13 14:46:37 +01:00
parent e7112ca0c9
commit 19672fcc58
12 changed files with 150 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
board/aarch64/linux_defconfig
+3
View File
@@ -141,6 +141,7 @@ CONFIG_MTD_SPI_NOR=y
CONFIG_OF_OVERLAY=y
CONFIG_BLK_DEV_NULL_BLK=y
CONFIG_BLK_DEV_LOOP=y
CONFIG_BLK_DEV_NBD=y
CONFIG_BLK_DEV_RAM=y
CONFIG_VIRTIO_BLK=y
CONFIG_BLK_DEV_NVME=y
@@ -160,6 +161,8 @@ CONFIG_PATA_OF_PLATFORM=y
CONFIG_MD=y
CONFIG_BLK_DEV_DM=y
CONFIG_DM_INIT=y
CONFIG_DM_VERITY=y
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
CONFIG_NETDEVICES=y
CONFIG_BONDING=y
CONFIG_DUMMY=y
board/aarch64/rootfs/etc/rauc/system.conf
+21
View File
@@ -0,0 +1,21 @@
[system]
compatible=infix-aarch64
bootloader=uboot
statusfile=/var/lib/rauc/status
mountprefix=/var/lib/rauc/mnt
bundle-formats=-plain
[keyring]
directory=/etc/rauc/keys
[slot.rootfs.0]
device=/dev/disk/by-partlabel/primary
bootname=primary
[slot.rootfs.1]
device=/dev/disk/by-partlabel/secondary
bootname=secondary
[slot.net.0]
device=/dev/ram
bootname=net
board/amd64/grubenv
+8
View File
@@ -0,0 +1,8 @@
# GRUB Environment Block
# WARNING: Do not edit this file by tools other than grub-editenv!!!
ORDER=primary secondary
primary_OK=1
secondary_OK=1
primary_TRY=0
secondary_TRY=0
################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################
board/amd64/linux_defconfig
+6
View File
@@ -95,6 +95,7 @@ CONFIG_FW_CFG_SYSFS=y
CONFIG_FW_CFG_SYSFS_CMDLINE=y
CONFIG_BLK_DEV_NULL_BLK=y
CONFIG_BLK_DEV_LOOP=y
CONFIG_BLK_DEV_NBD=y
CONFIG_BLK_DEV_RAM=y
CONFIG_VIRTIO_BLK=y
CONFIG_BLK_DEV_SD=y
@@ -102,6 +103,10 @@ CONFIG_BLK_DEV_SR=y
CONFIG_SCSI_VIRTIO=y
CONFIG_ATA=y
CONFIG_ATA_PIIX=y
CONFIG_MD=y
CONFIG_BLK_DEV_DM=y
CONFIG_DM_VERITY=y
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
CONFIG_NETDEVICES=y
CONFIG_BONDING=y
CONFIG_DUMMY=y
@@ -167,6 +172,7 @@ CONFIG_SQUASHFS_ZSTD=y
CONFIG_9P_FS=y
CONFIG_NLS_CODEPAGE_437=y
CONFIG_NLS_ISO8859_1=y
CONFIG_CRYPTO_SHA256=y
CONFIG_DEBUG_KERNEL=y
CONFIG_MAGIC_SYSRQ=y
CONFIG_DEBUG_FS=y
board/amd64/rootfs/etc/rauc/system.conf
+18
View File
@@ -0,0 +1,18 @@
[system]
compatible=infix-x86_64
bootloader=grub
grubenv=/mnt/aux/grub/grubenv
statusfile=/var/lib/rauc/status
mountprefix=/var/lib/rauc/mnt
bundle-formats=-plain
[keyring]
directory=/etc/rauc/keys
[slot.rootfs.0]
device=/dev/disk/by-partlabel/primary
bootname=primary
[slot.rootfs.1]
device=/dev/disk/by-partlabel/secondary
bootname=secondary
board/common/common.mk
+8
View File
@@ -1 +1,9 @@
include $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/uboot.mk
define RAUC_POST_BUILD_INSTALL_CERT
@$(call IXMSG,"Installing signing cert for RAUC")
mkdir -p $(TARGET_DIR)/etc/rauc/keys
$(foreach crt,$(shell ls $(SIGN_KEY)/*.crt), \
cp $(crt) $(TARGET_DIR)/etc/rauc/keys/$(shell openssl x509 -hash -noout <$(crt)).0;)
endef
RAUC_POST_BUILD_HOOKS += RAUC_POST_BUILD_INSTALL_CERT
board/common/mkdisk.sh
+3 -1
View File
@@ -166,7 +166,9 @@ case "$arch" in
;;
x86_64)
mkdir -p $root/aux/grub
cp -f $BR2_EXTERNAL_INFIX_PATH/board/amd64/grub.cfg $root/aux/grub/grub.cfg
cp -f $BR2_EXTERNAL_INFIX_PATH/board/amd64/grub.cfg \
$BR2_EXTERNAL_INFIX_PATH/board/amd64/grubenv \
$root/aux/grub/
;;
*)
;;
board/common/mkrauc.sh
Executable
+44
View File
@@ -0,0 +1,44 @@
#!/bin/sh
set -e
GIT_VERSION=$(git -C $BR2_EXTERNAL_INFIX_PATH describe --always --dirty --tags)
arch=$1
sign=$2
crt=$(ls $sign/*.crt)
key=$(ls $sign/*.key)
common=$(dirname $(readlink -f "$0"))
work=$BUILD_DIR/mkrauc
mkdir -p $work
cp -f $common/rauc-hooks.sh $work/hooks.sh
# RAUC internally uses the file extension to find a suitable install
# handler, hence the name must be .img
cp -f $BINARIES_DIR/rootfs.squashfs $work/rootfs.img
cp -f $BINARIES_DIR/rootfs.itbh $work/rootfs.itbh
cat >$work/manifest.raucm <<EOF
[update]
compatible=infix-${arch}
version=${GIT_VERSION}
[bundle]
format=verity
[hooks]
filename=hooks.sh
[image.rootfs]
filename=rootfs.img
hooks=post-install
EOF
rm -f $BINARIES_DIR/infix-$arch.pkg
rauc --cert=$crt --key=$key \
bundle $work $BINARIES_DIR/infix-$arch.pkg
board/common/post-image.sh
+3
View File
@@ -11,6 +11,9 @@ load_cfg SIGN_KEY
ixmsg "Signing SquashFS Image"
$common/sign.sh $BR2_ARCH $SIGN_KEY
ixmsg "Creating RAUC Update Bundle"
$common/mkrauc.sh $BR2_ARCH $SIGN_KEY
load_cfg DISK_IMAGE
if [ "$DISK_IMAGE" = "y" ]; then
ixmsg "Creating Disk Image"
board/common/rauc-hooks.sh
Executable
+18
View File
@@ -0,0 +1,18 @@
#!/bin/sh
set -e
case "$1" in
slot-post-install)
[ "$RAUC_SLOT_CLASS" = "rootfs" ] || break
echo "Updating signature information for $RAUC_SLOT_BOOTNAME"
itbh=$(dirname $RAUC_IMAGE_NAME)/rootfs.itbh
cp $itbh /mnt/aux/$RAUC_SLOT_BOOTNAME.itbh
sync
;;
*)
exit 1
;;
esac
configs/aarch64_defconfig
+9 -1
View File
@@ -43,7 +43,10 @@ BR2_PACKAGE_DBUS_TRIGGERD=y
BR2_PACKAGE_EUDEV_RULES_GEN=y
# BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
BR2_PACKAGE_RNG_TOOLS=y
BR2_PACKAGE_LIBCURL=y
BR2_PACKAGE_UBOOT_TOOLS=y
BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
BR2_PACKAGE_LIBCURL_CURL=y
BR2_PACKAGE_NSS_MDNS=y
BR2_PACKAGE_ONIGURUMA=y
@@ -96,6 +99,10 @@ BR2_PACKAGE_TTYD=y
BR2_PACKAGE_IRQBALANCE=y
BR2_PACKAGE_KMOD_TOOLS=y
BR2_PACKAGE_PWGEN=y
BR2_PACKAGE_RAUC=y
BR2_PACKAGE_RAUC_GPT=y
BR2_PACKAGE_RAUC_NETWORK=y
BR2_PACKAGE_RAUC_STREAMING=y
BR2_PACKAGE_SYSKLOGD=y
BR2_PACKAGE_SYSKLOGD_LOGGER=y
BR2_PACKAGE_WATCHDOGD=y
@@ -108,6 +115,7 @@ BR2_PACKAGE_HOST_E2FSPROGS=y
BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
BR2_PACKAGE_HOST_GENEXT2FS=y
BR2_PACKAGE_HOST_GENIMAGE=y
BR2_PACKAGE_HOST_RAUC=y
BR2_PACKAGE_HOST_UBOOT_TOOLS=y
BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
configs/amd64_defconfig
+9 -1
View File
@@ -40,7 +40,10 @@ BR2_PACKAGE_DBUS_TRIGGERD=y
BR2_PACKAGE_EUDEV_RULES_GEN=y
# BR2_PACKAGE_EUDEV_ENABLE_HWDB is not set
BR2_PACKAGE_RNG_TOOLS=y
BR2_PACKAGE_LIBCURL=y
BR2_PACKAGE_UBOOT_TOOLS=y
BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
BR2_PACKAGE_LIBCURL_CURL=y
BR2_PACKAGE_NSS_MDNS=y
BR2_PACKAGE_ONIGURUMA=y
@@ -93,6 +96,10 @@ BR2_PACKAGE_TTYD=y
BR2_PACKAGE_IRQBALANCE=y
BR2_PACKAGE_KMOD_TOOLS=y
BR2_PACKAGE_PWGEN=y
BR2_PACKAGE_RAUC=y
BR2_PACKAGE_RAUC_GPT=y
BR2_PACKAGE_RAUC_NETWORK=y
BR2_PACKAGE_RAUC_STREAMING=y
BR2_PACKAGE_SYSKLOGD=y
BR2_PACKAGE_SYSKLOGD_LOGGER=y
BR2_PACKAGE_WATCHDOGD=y
@@ -111,6 +118,7 @@ BR2_PACKAGE_HOST_E2FSPROGS=y
BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
BR2_PACKAGE_HOST_GENEXT2FS=y
BR2_PACKAGE_HOST_GENIMAGE=y
BR2_PACKAGE_HOST_RAUC=y
BR2_PACKAGE_HOST_UBOOT_TOOLS=y
BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y