[PATCH v7 0/4] UEFI secureboot

[Jon Mason <jdmason@kudzu.us>]

Sending a modified version of Javier's patches, combined with a subset
of the patches sent out by Mikko recently.  This was done to expedite
the acceptance of this series (given the code freeze tomorrow).  Also,
the optee update that Mikko's series included cannot be included (given
the code freeze).  2 of that series are needed for this one.  So,
combining everything into this and sending it out publicly for Javier,
Mikko, and anyone else to ack/nack.

Thanks,
Jon


Javier Tia (3):
  arm/optee: Add optee udev rules
  arm: Enable Secure Boot in all required recipes
  arm/qemuarm64-secureboot: Enable UEFI Secure Boot

Mikko Rapeli (1):
  arm/optee-client: fix systemd service dependencies

 .gitlab-ci.yml                                |  1 +
 ci/uefi-secureboot.yml                        | 37 +++++++++++++
 meta-arm/classes/sbsign.bbclass               | 31 +++++++++++
 .../lib/oeqa/runtime/cases/uefi_secureboot.py | 29 +++++++++++
 .../u-boot/u-boot-uefi-secureboot.inc         | 17 ++++++
 .../u-boot/u-boot/uefi-secureboot.cfg         | 10 ++++
 meta-arm/recipes-bsp/u-boot/u-boot_%.bbappend |  2 +
 meta-arm/recipes-bsp/uefi/gen-sbkeys.bb       | 48 +++++++++++++++++
 .../recipes-bsp/uefi/gen-sbkeys/gen_sbkeys.sh | 52 +++++++++++++++++++
 .../systemd/systemd-boot-uefi-secureboot.inc  |  7 +++
 .../systemd/systemd-boot_%.bbappend           |  1 +
 meta-arm/recipes-core/systemd/systemd-efi.inc |  1 +
 .../recipes-core/systemd/systemd_%.bbappend   |  1 +
 .../linux/linux-yocto%.bbappend               |  2 +
 .../linux/linux-yocto-uefi-secureboot.inc     | 14 +++++
 .../recipes-security/optee/optee-client.inc   |  8 ++-
 .../optee/optee-client/optee-udev.rules       |  6 +++
 .../optee-client/tee-supplicant@.service      | 10 ++--
 18 files changed, 272 insertions(+), 5 deletions(-)
 create mode 100644 ci/uefi-secureboot.yml
 create mode 100644 meta-arm/classes/sbsign.bbclass
 create mode 100644 meta-arm/lib/oeqa/runtime/cases/uefi_secureboot.py
 create mode 100644 meta-arm/recipes-bsp/u-boot/u-boot-uefi-secureboot.inc
 create mode 100644 meta-arm/recipes-bsp/u-boot/u-boot/uefi-secureboot.cfg
 create mode 100644 meta-arm/recipes-bsp/uefi/gen-sbkeys.bb
 create mode 100755 meta-arm/recipes-bsp/uefi/gen-sbkeys/gen_sbkeys.sh
 create mode 100644 meta-arm/recipes-core/systemd/systemd-boot-uefi-secureboot.inc
 create mode 100644 meta-arm/recipes-core/systemd/systemd-boot_%.bbappend
 create mode 100644 meta-arm/recipes-core/systemd/systemd-efi.inc
 create mode 100644 meta-arm/recipes-core/systemd/systemd_%.bbappend
 create mode 100644 meta-arm/recipes-kernel/linux/linux-yocto-uefi-secureboot.inc
 create mode 100644 meta-arm/recipes-security/optee/optee-client/optee-udev.rules

-- 
2.39.5