[isar-cip-core,0/7] SWUpdate/secure boot for ARM, related recipe updates

Message

Jan Kiszka July 11, 2022, 7:40 p.m. UTC

Finally, this enables also 32-bit ARM for UEFI-based SWUpdate and secure
boot, analogously to ARM64. We need to update EFI Boot Guard to 0.12 and
also bump the cip-kernel-config revision for this. U-Boot is updated to
fix a security bug in its hash validation code for signed UEFI binaries.

One special patch is needed for the efibootguard plugin: mcopy from
buster does not work properly with recursive copying, and that breaks
the boot partition setup.

Jan

Jan Kiszka (7):
  linux-cip: Update cip-kernel-config revision
  efibootguard: Do not rely on mcopy to perform recursive copies
  efibootguard: Update to release 0.12
  u-boot-qemu-arm64: Update to 2022.07
  u-boot-qemu-arm64: Generalize the recipe
  Add support for ARM-based swupdate/secure boot image
  ci: Add qemu-arm target for secure boot with swupdate

 .gitlab-ci.yml                                |  12 ++
 Kconfig                                       |   4 +-
 conf/machine/qemu-arm.conf                    |   5 +
 conf/machine/qemu-arm64.conf                  |   2 +
 kas/opt/efibootguard.yml                      |   1 +
 ...bootguard_0.11.bb => efibootguard_0.12.bb} |   5 +-
 ...efile-Drop-nostdinc-for-EFI-binaries.patch |  28 -----
 ...-rtc_mktime-and-mktime64-Y2038-ready.patch | 107 ------------------
 recipes-bsp/u-boot/files/secure-boot.cfg      |   6 -
 recipes-bsp/u-boot/files/secure-boot.cfg.tmpl |   6 +
 .../u-boot/u-boot-qemu-arm64_2022.07.bb       |  16 +++
 recipes-bsp/u-boot/u-boot-qemu-arm_2022.07.bb |  16 +++
 ...rm64_2022.04.bb => u-boot-qemu-common.inc} |  11 +-
 recipes-kernel/linux/linux-cip-common.inc     |   2 +-
 .../wic/plugins/source/efibootguard-boot.py   |   1 +
 .../wic/plugins/source/efibootguard-efi.py    |   7 +-
 start-qemu.sh                                 |   4 +-
 wic/qemu-arm-efibootguard-secureboot.wks.in   |   1 +
 wic/qemu-arm-efibootguard.wks.in              |   1 +
 19 files changed, 80 insertions(+), 155 deletions(-)
 rename recipes-bsp/efibootguard/{efibootguard_0.11.bb => efibootguard_0.12.bb} (85%)
 delete mode 100644 recipes-bsp/efibootguard/files/0001-Makefile-Drop-nostdinc-for-EFI-binaries.patch
 delete mode 100644 recipes-bsp/u-boot/files/0001-lib-date-Make-rtc_mktime-and-mktime64-Y2038-ready.patch
 delete mode 100644 recipes-bsp/u-boot/files/secure-boot.cfg
 create mode 100644 recipes-bsp/u-boot/files/secure-boot.cfg.tmpl
 create mode 100644 recipes-bsp/u-boot/u-boot-qemu-arm64_2022.07.bb
 create mode 100644 recipes-bsp/u-boot/u-boot-qemu-arm_2022.07.bb
 rename recipes-bsp/u-boot/{u-boot-qemu-arm64_2022.04.bb => u-boot-qemu-common.inc} (77%)
 create mode 120000 wic/qemu-arm-efibootguard-secureboot.wks.in
 create mode 120000 wic/qemu-arm-efibootguard.wks.in