From 19672fcc58c57c44e8bd32f0b5a34a83ae9cda01 Mon Sep 17 00:00:00 2001 From: Tobias Waldekranz Date: Mon, 6 Feb 2023 09:41:12 +0100 Subject: [PATCH] rauc: Initial support Add support for firmware updates via RAUC on aarch64. The created RAUC bundle (images/infix-$BR2_ARCH.pkg) is signed with the same key used to sign the raw FIT image. --- board/aarch64/linux_defconfig | 3 ++ board/aarch64/rootfs/etc/rauc/system.conf | 21 +++++++++++ board/amd64/grubenv | 8 +++++ board/amd64/linux_defconfig | 6 ++++ board/amd64/rootfs/etc/rauc/system.conf | 18 ++++++++++ board/common/common.mk | 8 +++++ board/common/mkdisk.sh | 4 ++- board/common/mkrauc.sh | 44 +++++++++++++++++++++++ board/common/post-image.sh | 3 ++ board/common/rauc-hooks.sh | 18 ++++++++++ configs/aarch64_defconfig | 10 +++++- configs/amd64_defconfig | 10 +++++- 12 files changed, 150 insertions(+), 3 deletions(-) create mode 100644 board/aarch64/rootfs/etc/rauc/system.conf create mode 100644 board/amd64/grubenv create mode 100644 board/amd64/rootfs/etc/rauc/system.conf create mode 100755 board/common/mkrauc.sh create mode 100755 board/common/rauc-hooks.sh diff --git a/board/aarch64/linux_defconfig b/board/aarch64/linux_defconfig index fb84859a..b57529a0 100644 --- a/board/aarch64/linux_defconfig +++ b/board/aarch64/linux_defconfig @@ -141,6 +141,7 @@ CONFIG_MTD_SPI_NOR=y CONFIG_OF_OVERLAY=y CONFIG_BLK_DEV_NULL_BLK=y CONFIG_BLK_DEV_LOOP=y +CONFIG_BLK_DEV_NBD=y CONFIG_BLK_DEV_RAM=y CONFIG_VIRTIO_BLK=y CONFIG_BLK_DEV_NVME=y @@ -160,6 +161,8 @@ CONFIG_PATA_OF_PLATFORM=y CONFIG_MD=y CONFIG_BLK_DEV_DM=y CONFIG_DM_INIT=y +CONFIG_DM_VERITY=y +CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y CONFIG_NETDEVICES=y CONFIG_BONDING=y CONFIG_DUMMY=y diff --git a/board/aarch64/rootfs/etc/rauc/system.conf b/board/aarch64/rootfs/etc/rauc/system.conf new file mode 100644 index 00000000..b9466dc9 --- /dev/null +++ b/board/aarch64/rootfs/etc/rauc/system.conf @@ -0,0 +1,21 @@ +[system] +compatible=infix-aarch64 +bootloader=uboot +statusfile=/var/lib/rauc/status +mountprefix=/var/lib/rauc/mnt +bundle-formats=-plain + +[keyring] +directory=/etc/rauc/keys + +[slot.rootfs.0] +device=/dev/disk/by-partlabel/primary +bootname=primary + +[slot.rootfs.1] +device=/dev/disk/by-partlabel/secondary +bootname=secondary + +[slot.net.0] +device=/dev/ram +bootname=net diff --git a/board/amd64/grubenv b/board/amd64/grubenv new file mode 100644 index 00000000..242f6809 --- /dev/null +++ b/board/amd64/grubenv @@ -0,0 +1,8 @@ +# GRUB Environment Block +# WARNING: Do not edit this file by tools other than grub-editenv!!! +ORDER=primary secondary +primary_OK=1 +secondary_OK=1 +primary_TRY=0 +secondary_TRY=0 +################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################ \ No newline at end of file diff --git a/board/amd64/linux_defconfig b/board/amd64/linux_defconfig index ae0a17af..e3666d05 100644 --- a/board/amd64/linux_defconfig +++ b/board/amd64/linux_defconfig @@ -95,6 +95,7 @@ CONFIG_FW_CFG_SYSFS=y CONFIG_FW_CFG_SYSFS_CMDLINE=y CONFIG_BLK_DEV_NULL_BLK=y CONFIG_BLK_DEV_LOOP=y +CONFIG_BLK_DEV_NBD=y CONFIG_BLK_DEV_RAM=y CONFIG_VIRTIO_BLK=y CONFIG_BLK_DEV_SD=y @@ -102,6 +103,10 @@ CONFIG_BLK_DEV_SR=y CONFIG_SCSI_VIRTIO=y CONFIG_ATA=y CONFIG_ATA_PIIX=y +CONFIG_MD=y +CONFIG_BLK_DEV_DM=y +CONFIG_DM_VERITY=y +CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y CONFIG_NETDEVICES=y CONFIG_BONDING=y CONFIG_DUMMY=y @@ -167,6 +172,7 @@ CONFIG_SQUASHFS_ZSTD=y CONFIG_9P_FS=y CONFIG_NLS_CODEPAGE_437=y CONFIG_NLS_ISO8859_1=y +CONFIG_CRYPTO_SHA256=y CONFIG_DEBUG_KERNEL=y CONFIG_MAGIC_SYSRQ=y CONFIG_DEBUG_FS=y diff --git a/board/amd64/rootfs/etc/rauc/system.conf b/board/amd64/rootfs/etc/rauc/system.conf new file mode 100644 index 00000000..acc81dd4 --- /dev/null +++ b/board/amd64/rootfs/etc/rauc/system.conf @@ -0,0 +1,18 @@ +[system] +compatible=infix-x86_64 +bootloader=grub +grubenv=/mnt/aux/grub/grubenv +statusfile=/var/lib/rauc/status +mountprefix=/var/lib/rauc/mnt +bundle-formats=-plain + +[keyring] +directory=/etc/rauc/keys + +[slot.rootfs.0] +device=/dev/disk/by-partlabel/primary +bootname=primary + +[slot.rootfs.1] +device=/dev/disk/by-partlabel/secondary +bootname=secondary diff --git a/board/common/common.mk b/board/common/common.mk index 7086e663..72956858 100644 --- a/board/common/common.mk +++ b/board/common/common.mk @@ -1 +1,9 @@ include $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/uboot.mk + +define RAUC_POST_BUILD_INSTALL_CERT + @$(call IXMSG,"Installing signing cert for RAUC") + mkdir -p $(TARGET_DIR)/etc/rauc/keys + $(foreach crt,$(shell ls $(SIGN_KEY)/*.crt), \ + cp $(crt) $(TARGET_DIR)/etc/rauc/keys/$(shell openssl x509 -hash -noout <$(crt)).0;) +endef +RAUC_POST_BUILD_HOOKS += RAUC_POST_BUILD_INSTALL_CERT diff --git a/board/common/mkdisk.sh b/board/common/mkdisk.sh index c17c51c4..e2c5a89c 100755 --- a/board/common/mkdisk.sh +++ b/board/common/mkdisk.sh @@ -166,7 +166,9 @@ case "$arch" in ;; x86_64) mkdir -p $root/aux/grub - cp -f $BR2_EXTERNAL_INFIX_PATH/board/amd64/grub.cfg $root/aux/grub/grub.cfg + cp -f $BR2_EXTERNAL_INFIX_PATH/board/amd64/grub.cfg \ + $BR2_EXTERNAL_INFIX_PATH/board/amd64/grubenv \ + $root/aux/grub/ ;; *) ;; diff --git a/board/common/mkrauc.sh b/board/common/mkrauc.sh new file mode 100755 index 00000000..b253910c --- /dev/null +++ b/board/common/mkrauc.sh @@ -0,0 +1,44 @@ +#!/bin/sh + +set -e + +GIT_VERSION=$(git -C $BR2_EXTERNAL_INFIX_PATH describe --always --dirty --tags) + +arch=$1 +sign=$2 + +crt=$(ls $sign/*.crt) +key=$(ls $sign/*.key) + +common=$(dirname $(readlink -f "$0")) + +work=$BUILD_DIR/mkrauc +mkdir -p $work + +cp -f $common/rauc-hooks.sh $work/hooks.sh + +# RAUC internally uses the file extension to find a suitable install +# handler, hence the name must be .img +cp -f $BINARIES_DIR/rootfs.squashfs $work/rootfs.img +cp -f $BINARIES_DIR/rootfs.itbh $work/rootfs.itbh + +cat >$work/manifest.raucm <