peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-08-01 13:23:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

board/riscv64: generalized secure boot support

Browse Source 
- Enable squashfs for rootfs image
 - Enable signing of images
 - Add secondary partition
 - Add mkaux.sh script

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit is contained in:
Joachim Wiberg
2024-08-08 13:35:27 +02:00
parent b7c2cde57f
commit 28b1ffe2ae
11 changed files with 107 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
board/common/Config.in
+6
View File
@@ -160,3 +160,9 @@ config FIT_ARCH
config FIT_KERNEL_LOAD_ADDR
string "Kernel load address"
depends on FIT_IMAGE
config SDCARD_AUX
bool "Create SD-card aux partition"
help
Create and populate aux.ext4 with rootfs.itbh and rauc.status
For use with a static genimage.cfg for, e.g., SD-cards.
board/common/mkaux.sh
Executable
+38
View File
@@ -0,0 +1,38 @@
#!/bin/sh
rootdir=$BUILD_DIR/genimage.root
tempdir=$BUILD_DIR/genimage.tmp
cat <<EOF > /tmp/mkaux.cfg
image aux.ext4 {
mountpoint = "/aux"
size = 16M
ext4 {
label = "aux"
use-mke2fs = true
}
}
# Silence genimage warnings
config {}
EOF
rm -rf "$rootdir/aux"
mkdir -p "$rootdir/aux"
cp -f "$BINARIES_DIR/rootfs.itbh" "$rootdir/aux/primary.itbh"
cp -f "$BINARIES_DIR/rootfs.itbh" "$rootdir/aux/secondary.itbh"
cp -f "$BINARIES_DIR/rauc.status" "$rootdir/aux/rauc.status"
mkenvimage -s 0x4000 -o "$rootdir/aux/uboot.env" \
"$BR2_EXTERNAL_INFIX_PATH/board/common/uboot/aux-env.txt"
rm -rf "$BINARIES_DIR/aux.ext4"
rm -rf "$tempdir"
genimage \
--rootpath "$rootdir" \
--tmppath "$tempdir" \
--inputpath "$BINARIES_DIR" \
--outputpath "$BINARIES_DIR" \
--config "/tmp/mkaux.cfg"
board/common/post-image.sh
+8
View File
@@ -60,6 +60,14 @@ if [ "$DISK_IMAGE" = "y" ]; then
$common/mkdisk.sh -a $BR2_ARCH -n $diskimg -s $DISK_IMAGE_SIZE $bootcfg
fi
load_cfg SDCARD_AUX
if [ "$SDCARD_AUX" = "y" ]; then
ixmsg "Creating initial rauc.status"
$common/mkrauc-status.sh "$BINARIES_DIR/${NAME}.pkg" >"$BINARIES_DIR/rauc.status"
ixmsg "Creating aux.ext4 for sdcard.img"
$common/mkaux.sh
fi
load_cfg GNS3_APPLIANCE
if [ "$GNS3_APPLIANCE" = "y" ]; then
ixmsg "Creating GNS3 Appliance, $GNS3_APPLIANCE_RAM MiB with $GNS3_APPLIANCE_IFNUM ports"
board/riscv64/rootfs/boot/syslinux/syslinux.conf
+4
View File
@@ -0,0 +1,4 @@
label Infix (riscv64)
kernel /boot/Image
fdtdir /boot
append ${bootargs_root} ${bootargs_log} -- ${bootargs_user}
board/riscv64/visionfive2/rootfs/etc/rauc/system.conf → board/riscv64/rootfs/etc/rauc/system.conf
+5 -1
View File
@@ -10,9 +10,13 @@ max-bundle-download-size=1073741824
directory=/etc/rauc/keys
[slot.rootfs.0]
device=/dev/mmcblk1p3
device=/dev/disk/by-partlabel/primary
bootname=primary
[slot.rootfs.1]
device=/dev/disk/by-partlabel/secondary
bootname=secondary
[slot.net.0]
device=/dev/ram0
bootname=net
board/riscv64/visionfive2/genimage.cfg
+13 -21
View File
@@ -1,19 +1,4 @@
# Infix SD card image for the Starfive VisionFive2
#
# NOTE: The aux partition doesn't do anything more than silence the boot atm.
# The current U-Boot for the VisionFive2 doesn't support loading kernel
# from rootfs.squashfs, so we've made this ugly hack with ext4 instead.
image aux.ext4 {
#mountpoint = "/aux"
temporary = true
size = 16M
ext4 {
label = "aux"
use-mke2fs = true
}
}
image cfg.ext4 {
empty = true
@@ -52,17 +37,24 @@ image sdcard.img {
image = "u-boot.itb"
}
partition rootfs {
partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
bootable = true
image = "rootfs.ext4"
}
partition aux {
partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
# Created by mkaux.sh
image = "aux.ext4"
}
partition primary {
partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
bootable = true
image = "rootfs.squashfs"
}
partition secondary {
partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
bootable = true
image = "rootfs.squashfs"
}
partition cfg {
partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
image = "cfg.ext4"
board/riscv64/visionfive2/patches/uboot/uboot.hash
+1
View File
@@ -1,2 +1,3 @@
# Locally calculated
sha256 18a853fe39fad7ad03a90cc2d4275aeaed6da69735defac3492b80508843dd4a u-boot-2024.04.tar.bz2
sha256 f591da9ab90ef3d6b3d173766d0ddff90c4ed7330680897486117df390d83c8f u-boot-2024.07.tar.bz2
board/riscv64/visionfive2/rootfs/boot/extlinux/extlinux.conf
-4
View File
@@ -1,4 +0,0 @@
label Infix (riscv64)
kernel /boot/Image
devicetree /boot/jh7110-starfive-visionfive-2-v1.3b.dtb
append console=ttyS0,115200 root=/dev/mmcblk1p3 quiet
board/riscv64/visionfive2/uboot/extras.config
+6
View File
@@ -0,0 +1,6 @@
# CONFIG_MMC_PCI is not set
CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi visionfive2-env.dtsi "
CONFIG_SYS_PROMPT="(visionfive2) "
CONFIG_ENV_IS_NOWHERE=y
# CONFIG_ENV_IS_IN_MMC is not set
board/riscv64/visionfive2/uboot/visionfive2-env.dtsi
+12
View File
@@ -0,0 +1,12 @@
/ {
config {
environment {
boot_targets = "mmc1";
ethprime = "eth1";
/* This is a development platform, hard code developer mode */
ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
ixbtn-factory = "echo \"No button available, use bootmenu\"";
};
};
};
configs/riscv64_defconfig
+14 -3
View File
@@ -11,15 +11,17 @@ BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
BR2_INIT_FINIT=y
BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
BR2_ROOTFS_MERGED_USR=y
# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
BR2_SYSTEM_BIN_SH_BASH=y
BR2_TARGET_GENERIC_GETTY_PORT="@console"
BR2_TARGET_GENERIC_GETTY_TERM="xterm"
BR2_SYSTEM_DHCP="eth0"
BR2_SYSTEM_DEFAULT_PATH="/bin:/sbin:/usr/bin:/usr/sbin"
BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
BR2_TARGET_TZ_INFO=y
BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/riscv64/visionfive2/rootfs"
BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/riscv64/rootfs"
BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_INFIX_PATH)/board/common/post-build.sh"
BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_INFIX_PATH)/board/common/post-image.sh support/scripts/genimage.sh"
BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/riscv64/visionfive2/genimage.cfg"
@@ -31,6 +33,7 @@ BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/riscv64/linux_defconfig"
BR2_LINUX_KERNEL_DTS_SUPPORT=y
BR2_LINUX_KERNEL_INTREE_DTS_NAME="starfive/jh7110-starfive-visionfive-2-v1.3b"
BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
BR2_LINUX_KERNEL_INSTALL_TARGET=y
BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
@@ -128,6 +131,7 @@ BR2_TARGET_ROOTFS_EXT2_4=y
BR2_TARGET_ROOTFS_EXT2_SIZE="512M"
BR2_TARGET_ROOTFS_EXT2_INODE_SIZE=0
BR2_TARGET_ROOTFS_EXT2_MKFS_OPTIONS="-O ^64bit,large_file,ext_attr"
BR2_TARGET_ROOTFS_SQUASHFS=y
# BR2_TARGET_ROOTFS_TAR is not set
BR2_TARGET_OPENSBI=y
BR2_TARGET_OPENSBI_CUSTOM_VERSION=y
@@ -138,20 +142,25 @@ BR2_TARGET_OPENSBI_ADDITIONAL_VARIABLES="FW_TEXT_START=0x40000000 FW_OPTIONS=0"
BR2_TARGET_UBOOT=y
BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
BR2_TARGET_UBOOT_CUSTOM_VERSION=y
BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2024.04"
BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2024.07"
BR2_TARGET_UBOOT_BOARD_DEFCONFIG="starfive_visionfive2"
BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/riscv64/visionfive2/uboot/extras.config"
BR2_TARGET_UBOOT_NEEDS_DTC=y
BR2_TARGET_UBOOT_NEEDS_PYLIBFDT=y
BR2_TARGET_UBOOT_NEEDS_OPENSSL=y
BR2_TARGET_UBOOT_NEEDS_OPENSBI=y
# BR2_TARGET_UBOOT_FORMAT_BIN is not set
BR2_TARGET_UBOOT_FORMAT_DTB=y
BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="u-boot.itb"
BR2_TARGET_UBOOT_SPL=y
BR2_TARGET_UBOOT_SPL_NAME="spl/u-boot-spl.bin.normal.out"
BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_INFIX_PATH)/board/riscv64/visionfive2/uboot/visionfive2-env.dtsi"
BR2_PACKAGE_HOST_GENIMAGE=y
BR2_PACKAGE_HOST_RAUC=y
BR2_PACKAGE_HOST_UBOOT_TOOLS=y
BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
INFIX_VENDOR_HOME="https://github.com/kernelkit"
INFIX_DESC="Infix is a Network Operating System based on Linux. It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
INFIX_HOME="https://github.com/kernelkit/infix/"
@@ -184,5 +193,7 @@ BR2_PACKAGE_PODMAN_DRIVER_VFS=y
BR2_PACKAGE_TETRIS=y
BR2_PACKAGE_ROUSETTE=y
BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
# SIGN_ENABLED is not set
TRUSTED_KEYS=y
TRUSTED_KEYS_DEVELOPMENT=y
# GNS3_APPLIANCE is not set
SDCARD_AUX=y