* [PATCH v3 01/13] qemuarm64-secureboot: Introduce uefi-secureboot machine feature
2024-08-22 1:43 [PATCH v3 00/13] qemuarm64-secureboot: Add UEFI Secure Boot Javier Tia
@ 2024-08-22 1:43 ` Javier Tia
2024-08-22 1:43 ` [PATCH v3 02/13] core-image-base: Use UEFI layout disk partitions Javier Tia
` (11 subsequent siblings)
12 siblings, 0 replies; 15+ messages in thread
From: Javier Tia @ 2024-08-22 1:43 UTC (permalink / raw)
To: meta-arm; +Cc: Mikko Rapeli, Ross Burton, Jon Mason, Javier Tia
Signed-off-by: Javier Tia <javier.tia@linaro.org>
---
meta-arm/conf/machine/qemuarm64-secureboot.conf | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta-arm/conf/machine/qemuarm64-secureboot.conf b/meta-arm/conf/machine/qemuarm64-secureboot.conf
index cfc6ff77..6789b1c6 100644
--- a/meta-arm/conf/machine/qemuarm64-secureboot.conf
+++ b/meta-arm/conf/machine/qemuarm64-secureboot.conf
@@ -25,3 +25,4 @@ WKS_FILE_DEPENDS = "trusted-firmware-a"
IMAGE_BOOT_FILES = "${KERNEL_IMAGETYPE}"
MACHINE_FEATURES += "optee-ftpm"
+MACHINE_FEATURES += "uefi-secureboot"
--
2.46.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH v3 02/13] core-image-base: Use UEFI layout disk partitions
2024-08-22 1:43 [PATCH v3 00/13] qemuarm64-secureboot: Add UEFI Secure Boot Javier Tia
2024-08-22 1:43 ` [PATCH v3 01/13] qemuarm64-secureboot: Introduce uefi-secureboot machine feature Javier Tia
@ 2024-08-22 1:43 ` Javier Tia
2024-08-23 10:26 ` Mikko Rapeli
2024-08-22 1:43 ` [PATCH v3 03/13] layer.conf: Introduce UEFI_SB_KEYS_DIR Javier Tia
` (10 subsequent siblings)
12 siblings, 1 reply; 15+ messages in thread
From: Javier Tia @ 2024-08-22 1:43 UTC (permalink / raw)
To: meta-arm; +Cc: Mikko Rapeli, Ross Burton, Jon Mason, Javier Tia
- Use efi-disk-no-swap.wks.in disk definition to add expected UEFI disk
partitions configuration.
Signed-off-by: Javier Tia <javier.tia@linaro.org>
---
.../recipes-bsp/images/core-image-base-uefi-secureboot.inc | 1 +
meta-arm-bsp/recipes-bsp/images/core-image-base.bbappend | 1 +
2 files changed, 2 insertions(+)
create mode 100644 meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
create mode 100644 meta-arm-bsp/recipes-bsp/images/core-image-base.bbappend
diff --git a/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc b/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
new file mode 100644
index 00000000..351e9030
--- /dev/null
+++ b/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
@@ -0,0 +1 @@
+WKS_FILE = "efi-disk-no-swap.wks.in"
diff --git a/meta-arm-bsp/recipes-bsp/images/core-image-base.bbappend b/meta-arm-bsp/recipes-bsp/images/core-image-base.bbappend
new file mode 100644
index 00000000..1f6dbd24
--- /dev/null
+++ b/meta-arm-bsp/recipes-bsp/images/core-image-base.bbappend
@@ -0,0 +1 @@
+require ${@bb.utils.contains('MACHINE_FEATURES', 'uefi-secureboot', 'core-image-base-uefi-secureboot.inc', '', d)}
\ No newline at end of file
--
2.46.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* Re: [PATCH v3 02/13] core-image-base: Use UEFI layout disk partitions
2024-08-22 1:43 ` [PATCH v3 02/13] core-image-base: Use UEFI layout disk partitions Javier Tia
@ 2024-08-23 10:26 ` Mikko Rapeli
0 siblings, 0 replies; 15+ messages in thread
From: Mikko Rapeli @ 2024-08-23 10:26 UTC (permalink / raw)
To: Javier Tia; +Cc: meta-arm, Ross Burton, Jon Mason
Hi,
On Wed, Aug 21, 2024 at 07:43:24PM -0600, Javier Tia wrote:
> - Use efi-disk-no-swap.wks.in disk definition to add expected UEFI disk
> partitions configuration.
>
> Signed-off-by: Javier Tia <javier.tia@linaro.org>
> ---
> .../recipes-bsp/images/core-image-base-uefi-secureboot.inc | 1 +
> meta-arm-bsp/recipes-bsp/images/core-image-base.bbappend | 1 +
> 2 files changed, 2 insertions(+)
> create mode 100644 meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
> create mode 100644 meta-arm-bsp/recipes-bsp/images/core-image-base.bbappend
Could these be moved to meta-arm/recipes-core/images?
Could the image be changed to core-image-minimal? Is there some specific need for
core-image-base only?
I'm adding systemd Unified Kernel Image on top of these changes so that
UEFI secure boot signatures cover systemd-boot, kernel, initramfs and kernel
command line.
core-image-minimal-initramfs seems to be more usable with core-image-minimal
when using systemd. I can of course keep these changes in my followup series too.
Will also add /usr dm-verity and TPM encrypted read-write rootfs but likely to
meta-security then.
Cheers,
-Mikko
^ permalink raw reply [flat|nested] 15+ messages in thread
* [PATCH v3 03/13] layer.conf: Introduce UEFI_SB_KEYS_DIR
2024-08-22 1:43 [PATCH v3 00/13] qemuarm64-secureboot: Add UEFI Secure Boot Javier Tia
2024-08-22 1:43 ` [PATCH v3 01/13] qemuarm64-secureboot: Introduce uefi-secureboot machine feature Javier Tia
2024-08-22 1:43 ` [PATCH v3 02/13] core-image-base: Use UEFI layout disk partitions Javier Tia
@ 2024-08-22 1:43 ` Javier Tia
2024-08-22 1:43 ` [PATCH v3 04/13] uefi-sb-keys.bbclass: Add class to validate UEFI keys Javier Tia
` (9 subsequent siblings)
12 siblings, 0 replies; 15+ messages in thread
From: Javier Tia @ 2024-08-22 1:43 UTC (permalink / raw)
To: meta-arm; +Cc: Mikko Rapeli, Ross Burton, Jon Mason, Javier Tia
UEFI_SB_KEYS_DIR saves UEFI keys path.
To avoid security issues, UEFI keys are not provided and they can be
generated by gen_uefi_keys.sh script.
Signed-off-by: Javier Tia <javier.tia@linaro.org>
---
meta-arm/conf/layer.conf | 2 ++
meta-arm/uefi-sb-keys/gen_uefi_keys.sh | 35 ++++++++++++++++++++++++++
2 files changed, 37 insertions(+)
create mode 100755 meta-arm/uefi-sb-keys/gen_uefi_keys.sh
diff --git a/meta-arm/conf/layer.conf b/meta-arm/conf/layer.conf
index 9e9c9dbd..2854dd69 100644
--- a/meta-arm/conf/layer.conf
+++ b/meta-arm/conf/layer.conf
@@ -21,3 +21,5 @@ HOSTTOOLS_NONFATAL += "telnet"
addpylib ${LAYERDIR}/lib oeqa
WARN_QA:append:layer-meta-arm = " patch-status"
+
+UEFI_SB_KEYS_DIR ??= "${LAYERDIR}/uefi-sb-keys"
\ No newline at end of file
diff --git a/meta-arm/uefi-sb-keys/gen_uefi_keys.sh b/meta-arm/uefi-sb-keys/gen_uefi_keys.sh
new file mode 100755
index 00000000..fc7f25c9
--- /dev/null
+++ b/meta-arm/uefi-sb-keys/gen_uefi_keys.sh
@@ -0,0 +1,35 @@
+#/bin/sh
+
+set -eux
+
+#Create PK
+openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=Linaro_LEDGE/ -keyout PK.key -out PK.crt -nodes -days 3650
+cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc PK.crt PK.esl
+sign-efi-sig-list -c PK.crt -k PK.key PK PK.esl PK.auth
+
+#Create KEK
+openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=Linaro_LEDGE/ -keyout KEK.key -out KEK.crt -nodes -days 3650
+cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc KEK.crt KEK.esl
+sign-efi-sig-list -c PK.crt -k PK.key KEK KEK.esl KEK.auth
+
+#Create DB
+openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=Linaro_LEDGE/ -keyout db.key -out db.crt -nodes -days 3650
+cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc db.crt db.esl
+sign-efi-sig-list -c KEK.crt -k KEK.key db db.esl db.auth
+
+#Create DBX
+openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=Linaro_LEDGE/ -keyout dbx.key -out dbx.crt -nodes -days 3650
+cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc dbx.crt dbx.esl
+sign-efi-sig-list -c KEK.crt -k KEK.key dbx dbx.esl dbx.auth
+
+#Sign image
+#sbsign --key db.key --cert db.crt Image
+
+#Digest image
+#hash-to-efi-sig-list Image db_Image.hash
+#sign-efi-sig-list -c KEK.crt -k KEK.key db db_Image.hash db_Image.auth
+
+#Empty cert for testing
+touch noPK.esl
+sign-efi-sig-list -c PK.crt -k PK.key PK noPK.esl noPK.auth
+
--
2.46.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH v3 04/13] uefi-sb-keys.bbclass: Add class to validate UEFI keys
2024-08-22 1:43 [PATCH v3 00/13] qemuarm64-secureboot: Add UEFI Secure Boot Javier Tia
` (2 preceding siblings ...)
2024-08-22 1:43 ` [PATCH v3 03/13] layer.conf: Introduce UEFI_SB_KEYS_DIR Javier Tia
@ 2024-08-22 1:43 ` Javier Tia
2024-08-22 1:43 ` [PATCH v3 05/13] sbsign.bbclass: Add class to sign binaries Javier Tia
` (8 subsequent siblings)
12 siblings, 0 replies; 15+ messages in thread
From: Javier Tia @ 2024-08-22 1:43 UTC (permalink / raw)
To: meta-arm; +Cc: Mikko Rapeli, Ross Burton, Jon Mason, Javier Tia
Without UEFI keys, signing will fail and the OS will not boot.
Signed-off-by: Javier Tia <javier.tia@linaro.org>
---
meta-arm/classes/uefi-sb-keys.bbclass | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
create mode 100644 meta-arm/classes/uefi-sb-keys.bbclass
diff --git a/meta-arm/classes/uefi-sb-keys.bbclass b/meta-arm/classes/uefi-sb-keys.bbclass
new file mode 100644
index 00000000..e800b4c6
--- /dev/null
+++ b/meta-arm/classes/uefi-sb-keys.bbclass
@@ -0,0 +1,24 @@
+# Validate UEFI keys
+python __anonymous () {
+ if d.getVar("UEFI_SB_KEYS_DIR", False) is None:
+ raise bb.parse.SkipRecipe("UEFI_SB_KEYS_DIR is not set.")
+
+ # keys used for UEFI secure boot
+ uefi_sb_keys = d.getVar("UEFI_SB_KEYS_DIR")
+
+ keys_to_check = [
+ uefi_sb_keys + "/PK.esl",
+ uefi_sb_keys + "/KEK.esl",
+ uefi_sb_keys + "/dbx.esl",
+ uefi_sb_keys + "/db.esl",
+ uefi_sb_keys + "/db.key",
+ uefi_sb_keys + "/db.crt",
+ ]
+
+ missing_keys = [f for f in keys_to_check if not os.path.exists(f)]
+
+ if missing_keys:
+ raise bb.parse.SkipRecipe("Required missing keys: %s" % (", ".join(missing_keys), )
+ + ".\nRun %s/gen_uefi_keys.sh to generate missing keys." % uefi_sb_keys)
+
+}
--
2.46.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH v3 05/13] sbsign.bbclass: Add class to sign binaries
2024-08-22 1:43 [PATCH v3 00/13] qemuarm64-secureboot: Add UEFI Secure Boot Javier Tia
` (3 preceding siblings ...)
2024-08-22 1:43 ` [PATCH v3 04/13] uefi-sb-keys.bbclass: Add class to validate UEFI keys Javier Tia
@ 2024-08-22 1:43 ` Javier Tia
2024-08-22 1:43 ` [PATCH v3 06/13] core-image-base: Inherit uefi-sb-keys Javier Tia
` (7 subsequent siblings)
12 siblings, 0 replies; 15+ messages in thread
From: Javier Tia @ 2024-08-22 1:43 UTC (permalink / raw)
To: meta-arm; +Cc: Mikko Rapeli, Ross Burton, Jon Mason, Javier Tia
A lot of recipes are using these same steps to sign binaries
for UEFI secure boot.
Authored-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Javier Tia <javier.tia@linaro.org>
---
meta-arm/classes/sbsign.bbclass | 39 +++++++++++++++++++++++++++++++++
1 file changed, 39 insertions(+)
create mode 100644 meta-arm/classes/sbsign.bbclass
diff --git a/meta-arm/classes/sbsign.bbclass b/meta-arm/classes/sbsign.bbclass
new file mode 100644
index 00000000..a99c0218
--- /dev/null
+++ b/meta-arm/classes/sbsign.bbclass
@@ -0,0 +1,39 @@
+# Sign binaries for UEFI secure boot
+# Usage in recipes:
+#
+# Set key and cert files in recipe or machine/distro config:
+# SBSIGN_KEY = "db.key"
+# SBSIGN_CERT = "db.crt"
+#
+# Set binary to sign per recipe:
+# SBSIGN_TARGET_BINARY = "${B}/binary_to_sign"
+#
+# Then call do_sbsign() in correct stage of the build
+# do_compile:append() {
+# do_sbsign
+# }
+
+DEPENDS += "sbsigntool-native"
+
+SBSIGN_KEY ?= "db.key"
+SBSIGN_CERT ?= "db.crt"
+SBSIGN_TARGET_BINARY ?= "binary_to_sign"
+
+# makes sure changed keys trigger rebuild/re-signing
+SRC_URI += "\
+ file://${SBSIGN_KEY} \
+ file://${SBSIGN_CERT} \
+"
+
+# not adding as task since recipes may need to sign binaries at different
+# stages. Instead they can call this function when needed by calling this function
+do_sbsign() {
+ bbnote "Signing ${PN} binary ${SBSIGN_TARGET_BINARY} with ${SBSIGN_KEY} and ${SBSIGN_CERT}"
+ ${STAGING_BINDIR_NATIVE}/sbsign \
+ --key "${UNPACKDIR}/${SBSIGN_KEY}" \
+ --cert "${UNPACKDIR}/${SBSIGN_CERT}" \
+ --output "${SBSIGN_TARGET_BINARY}.signed" \
+ "${SBSIGN_TARGET_BINARY}"
+ cp "${SBSIGN_TARGET_BINARY}" "${SBSIGN_TARGET_BINARY}.unsigned"
+ cp "${SBSIGN_TARGET_BINARY}.signed" "${SBSIGN_TARGET_BINARY}"
+}
\ No newline at end of file
--
2.46.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH v3 06/13] core-image-base: Inherit uefi-sb-keys
2024-08-22 1:43 [PATCH v3 00/13] qemuarm64-secureboot: Add UEFI Secure Boot Javier Tia
` (4 preceding siblings ...)
2024-08-22 1:43 ` [PATCH v3 05/13] sbsign.bbclass: Add class to sign binaries Javier Tia
@ 2024-08-22 1:43 ` Javier Tia
2024-08-22 1:43 ` [PATCH v3 07/13] meta-arm: Introduce gen-uefi-sb-keys.bb recipe Javier Tia
` (6 subsequent siblings)
12 siblings, 0 replies; 15+ messages in thread
From: Javier Tia @ 2024-08-22 1:43 UTC (permalink / raw)
To: meta-arm; +Cc: Mikko Rapeli, Ross Burton, Jon Mason, Javier Tia
Signed-off-by: Javier Tia <javier.tia@linaro.org>
---
.../recipes-bsp/images/core-image-base-uefi-secureboot.inc | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc b/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
index 351e9030..2232d3b3 100644
--- a/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
+++ b/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
@@ -1 +1,3 @@
+inherit uefi-sb-keys
+
WKS_FILE = "efi-disk-no-swap.wks.in"
--
2.46.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH v3 07/13] meta-arm: Introduce gen-uefi-sb-keys.bb recipe
2024-08-22 1:43 [PATCH v3 00/13] qemuarm64-secureboot: Add UEFI Secure Boot Javier Tia
` (5 preceding siblings ...)
2024-08-22 1:43 ` [PATCH v3 06/13] core-image-base: Inherit uefi-sb-keys Javier Tia
@ 2024-08-22 1:43 ` Javier Tia
2024-08-22 1:43 ` [PATCH v3 08/13] u-boot: Setup UEFI and Secure Boot Javier Tia
` (5 subsequent siblings)
12 siblings, 0 replies; 15+ messages in thread
From: Javier Tia @ 2024-08-22 1:43 UTC (permalink / raw)
To: meta-arm; +Cc: Mikko Rapeli, Ross Burton, Jon Mason, Javier Tia
Generate a new set of keys on build time. It avoids to use same keys
which could generate a security issue.
Signed-off-by: Javier Tia <javier.tia@linaro.org>
---
meta-arm/recipes-bsp/uefi/gen-uefi-sb-keys.bb | 26 +++++++++
meta-arm/uefi-sb-keys/.gitignore | 4 ++
meta-arm/uefi-sb-keys/gen_uefi_keys.sh | 56 +++++++++----------
3 files changed, 57 insertions(+), 29 deletions(-)
create mode 100644 meta-arm/recipes-bsp/uefi/gen-uefi-sb-keys.bb
create mode 100644 meta-arm/uefi-sb-keys/.gitignore
diff --git a/meta-arm/recipes-bsp/uefi/gen-uefi-sb-keys.bb b/meta-arm/recipes-bsp/uefi/gen-uefi-sb-keys.bb
new file mode 100644
index 00000000..a4ae6d87
--- /dev/null
+++ b/meta-arm/recipes-bsp/uefi/gen-uefi-sb-keys.bb
@@ -0,0 +1,26 @@
+# SPDX-License-Identifier: MIT
+
+SUMMARY = "Generate UEFI keys for secure boot"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302"
+
+DEPENDS += "bash-native"
+DEPENDS += "coreutils-native"
+DEPENDS += "efitools-native"
+DEPENDS += "openssl-native"
+
+SRC_URI = "file://${UEFI_SB_KEYS_DIR}/gen_uefi_keys.sh"
+
+UNPACKDIR = "${S}"
+
+do_fetch[noexec] = "1"
+do_patch[noexec] = "1"
+do_compile[noexec] = "1"
+do_configure[noexec] = "1"
+
+do_install() {
+ ${UEFI_SB_KEYS_DIR}/gen_uefi_keys.sh ${UEFI_SB_KEYS_DIR}
+}
+
+FILES:${PN} = "${UEFI_SB_KEYS_DIR}/*.key"
+FILES:${PN} += "${UEFI_SB_KEYS_DIR}/*.crt"
diff --git a/meta-arm/uefi-sb-keys/.gitignore b/meta-arm/uefi-sb-keys/.gitignore
new file mode 100644
index 00000000..f8669919
--- /dev/null
+++ b/meta-arm/uefi-sb-keys/.gitignore
@@ -0,0 +1,4 @@
+*.auth
+*.crt
+*.esl
+*.key
\ No newline at end of file
diff --git a/meta-arm/uefi-sb-keys/gen_uefi_keys.sh b/meta-arm/uefi-sb-keys/gen_uefi_keys.sh
index fc7f25c9..21e65c72 100755
--- a/meta-arm/uefi-sb-keys/gen_uefi_keys.sh
+++ b/meta-arm/uefi-sb-keys/gen_uefi_keys.sh
@@ -1,35 +1,33 @@
-#/bin/sh
+#!/bin/bash
+#
+# SPDX-License-Identifier: MIT
+#
set -eux
-#Create PK
-openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=Linaro_LEDGE/ -keyout PK.key -out PK.crt -nodes -days 3650
-cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc PK.crt PK.esl
-sign-efi-sig-list -c PK.crt -k PK.key PK PK.esl PK.auth
+KEYS_PATH=${1:-./}
+SUBJECT="/CN=Linaro_LEDGE/"
+GUID="11111111-2222-3333-4444-123456789abc"
-#Create KEK
-openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=Linaro_LEDGE/ -keyout KEK.key -out KEK.crt -nodes -days 3650
-cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc KEK.crt KEK.esl
-sign-efi-sig-list -c PK.crt -k PK.key KEK KEK.esl KEK.auth
+openssl req -x509 -sha256 -newkey rsa:2048 -subj "${SUBJECT}" \
+ -keyout "${KEYS_PATH}"/PK.key -out "${KEYS_PATH}"/PK.crt \
+ -nodes -days 3650
+cert-to-efi-sig-list -g ${GUID} \
+ "${KEYS_PATH}"/PK.crt "${KEYS_PATH}"/PK.esl
+sign-efi-sig-list -c "${KEYS_PATH}"/PK.crt -k "${KEYS_PATH}"/PK.key \
+ "${KEYS_PATH}"/PK "${KEYS_PATH}"/PK.esl "${KEYS_PATH}"/PK.auth
-#Create DB
-openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=Linaro_LEDGE/ -keyout db.key -out db.crt -nodes -days 3650
-cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc db.crt db.esl
-sign-efi-sig-list -c KEK.crt -k KEK.key db db.esl db.auth
-
-#Create DBX
-openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=Linaro_LEDGE/ -keyout dbx.key -out dbx.crt -nodes -days 3650
-cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc dbx.crt dbx.esl
-sign-efi-sig-list -c KEK.crt -k KEK.key dbx dbx.esl dbx.auth
-
-#Sign image
-#sbsign --key db.key --cert db.crt Image
-
-#Digest image
-#hash-to-efi-sig-list Image db_Image.hash
-#sign-efi-sig-list -c KEK.crt -k KEK.key db db_Image.hash db_Image.auth
-
-#Empty cert for testing
-touch noPK.esl
-sign-efi-sig-list -c PK.crt -k PK.key PK noPK.esl noPK.auth
+for key in KEK db dbx; do
+ openssl req -x509 -sha256 -newkey rsa:2048 -subj "${SUBJECT}" \
+ -keyout "${KEYS_PATH}"/${key}.key -out "${KEYS_PATH}"/${key}.crt \
+ -nodes -days 3650
+ cert-to-efi-sig-list -g ${GUID} \
+ "${KEYS_PATH}"/${key}.crt "${KEYS_PATH}"/${key}.esl
+ sign-efi-sig-list -c "${KEYS_PATH}"/PK.crt -k "${KEYS_PATH}"/PK.key \
+ "${KEYS_PATH}"/${key} "${KEYS_PATH}"/${key}.esl "${KEYS_PATH}"/${key}.auth
+done
+# Empty cert for testing
+touch "${KEYS_PATH}"/noPK.esl
+sign-efi-sig-list -c "${KEYS_PATH}"/PK.crt -k "${KEYS_PATH}"/PK.key \
+ "${KEYS_PATH}"/PK "${KEYS_PATH}"/noPK.esl "${KEYS_PATH}"/noPK.auth
--
2.46.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH v3 08/13] u-boot: Setup UEFI and Secure Boot
2024-08-22 1:43 [PATCH v3 00/13] qemuarm64-secureboot: Add UEFI Secure Boot Javier Tia
` (6 preceding siblings ...)
2024-08-22 1:43 ` [PATCH v3 07/13] meta-arm: Introduce gen-uefi-sb-keys.bb recipe Javier Tia
@ 2024-08-22 1:43 ` Javier Tia
2024-08-22 1:43 ` [PATCH v3 09/13] qemuarm64-secureboot: Add meta-secure-core layer as dependency Javier Tia
` (4 subsequent siblings)
12 siblings, 0 replies; 15+ messages in thread
From: Javier Tia @ 2024-08-22 1:43 UTC (permalink / raw)
To: meta-arm; +Cc: Mikko Rapeli, Ross Burton, Jon Mason, Javier Tia
Add U-Boot minimal UEFI definitions.
Embedded UEFI variables with the keys previously generated. It's to
enable UEFI Secure Boot and verify the authenticity of the firmware and
operating system.
When U-Boot is built with UEFI support, it includes a set of efivars
that are used to store the Secure Boot variables. These efivars are
embedded in the U-Boot binary and are stored in the flash memory of the
system.
Signed-off-by: Javier Tia <javier.tia@linaro.org>
---
.../u-boot/u-boot-qemuarm64-secureboot.inc | 18 ++++++++++++++++++
.../u-boot/u-boot/uefi-secureboot.cfg | 10 ++++++++++
.../recipes-bsp/u-boot/u-boot_%.bbappend | 2 +-
3 files changed, 29 insertions(+), 1 deletion(-)
create mode 100644 meta-arm-bsp/recipes-bsp/u-boot/u-boot-qemuarm64-secureboot.inc
create mode 100644 meta-arm-bsp/recipes-bsp/u-boot/u-boot/uefi-secureboot.cfg
diff --git a/meta-arm-bsp/recipes-bsp/u-boot/u-boot-qemuarm64-secureboot.inc b/meta-arm-bsp/recipes-bsp/u-boot/u-boot-qemuarm64-secureboot.inc
new file mode 100644
index 00000000..ffad08e4
--- /dev/null
+++ b/meta-arm-bsp/recipes-bsp/u-boot/u-boot-qemuarm64-secureboot.inc
@@ -0,0 +1,18 @@
+FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
+
+SRC_URI += "file://uefi-secureboot.cfg"
+
+UBOOT_BOARDDIR = "${S}/board/emulation/qemu-arm"
+UBOOT_ENV_NAME = "qemu-arm.env"
+
+DEPENDS += 'python3-pyopenssl-native'
+
+do_compile:prepend() {
+ export CRYPTOGRAPHY_OPENSSL_NO_LEGACY=1
+
+ "${S}"/tools/efivar.py set -i "${S}"/ubootefi.var -n pk -d "${UEFI_SB_KEYS_DIR}"/PK.esl -t file
+ "${S}"/tools/efivar.py set -i "${S}"/ubootefi.var -n kek -d "${UEFI_SB_KEYS_DIR}"/KEK.esl -t file
+ "${S}"/tools/efivar.py set -i "${S}"/ubootefi.var -n db -d "${UEFI_SB_KEYS_DIR}"/db.esl -t file
+ "${S}"/tools/efivar.py set -i "${S}"/ubootefi.var -n dbx -d "${UEFI_SB_KEYS_DIR}"/dbx.esl -t file
+ "${S}"/tools/efivar.py print -i "${S}"/ubootefi.var
+}
diff --git a/meta-arm-bsp/recipes-bsp/u-boot/u-boot/uefi-secureboot.cfg b/meta-arm-bsp/recipes-bsp/u-boot/u-boot/uefi-secureboot.cfg
new file mode 100644
index 00000000..d2edb5fb
--- /dev/null
+++ b/meta-arm-bsp/recipes-bsp/u-boot/u-boot/uefi-secureboot.cfg
@@ -0,0 +1,10 @@
+CONFIG_CMD_BOOTMENU=y
+CONFIG_USE_BOOTCOMMAND=y
+CONFIG_BOOTCOMMAND="bootmenu"
+CONFIG_USE_PREBOOT=y
+CONFIG_EFI_VAR_BUF_SIZE=65536
+CONFIG_FIT_SIGNATURE=y
+CONFIG_EFI_SECURE_BOOT=y
+CONFIG_EFI_VARIABLES_PRESEED=y
+CONFIG_PREBOOT="setenv bootmenu_0 UEFI Boot Manager=bootefi bootmgr; setenv bootmenu_1 UEFI Maintenance Menu=eficonfig"
+CONFIG_PREBOOT_DEFINED=y
\ No newline at end of file
diff --git a/meta-arm-bsp/recipes-bsp/u-boot/u-boot_%.bbappend b/meta-arm-bsp/recipes-bsp/u-boot/u-boot_%.bbappend
index 11f332ad..ee815b6a 100644
--- a/meta-arm-bsp/recipes-bsp/u-boot/u-boot_%.bbappend
+++ b/meta-arm-bsp/recipes-bsp/u-boot/u-boot_%.bbappend
@@ -5,6 +5,6 @@ MACHINE_U-BOOT_REQUIRE:corstone1000 = "u-boot-corstone1000.inc"
MACHINE_U-BOOT_REQUIRE:fvp-base = "u-boot-fvp-base.inc"
MACHINE_U-BOOT_REQUIRE:juno = "u-boot-juno.inc"
MACHINE_U-BOOT_REQUIRE:tc = "u-boot-tc.inc"
+MACHINE_U-BOOT_REQUIRE += "${@bb.utils.contains('MACHINE_FEATURES', 'uefi-secureboot', 'u-boot-qemuarm64-secureboot.inc', '', d)}"
require ${MACHINE_U-BOOT_REQUIRE}
-
--
2.46.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH v3 09/13] qemuarm64-secureboot: Add meta-secure-core layer as dependency
2024-08-22 1:43 [PATCH v3 00/13] qemuarm64-secureboot: Add UEFI Secure Boot Javier Tia
` (7 preceding siblings ...)
2024-08-22 1:43 ` [PATCH v3 08/13] u-boot: Setup UEFI and Secure Boot Javier Tia
@ 2024-08-22 1:43 ` Javier Tia
2024-08-22 1:43 ` [PATCH v3 10/13] linux-yocto: Setup UEFI and sign kernel image Javier Tia
` (3 subsequent siblings)
12 siblings, 0 replies; 15+ messages in thread
From: Javier Tia @ 2024-08-22 1:43 UTC (permalink / raw)
To: meta-arm; +Cc: Mikko Rapeli, Ross Burton, Jon Mason, Javier Tia
meta-secure-core is required because of sbsigntool.
Signed-off-by: Javier Tia <javier.tia@linaro.org>
---
ci/qemuarm64-secureboot.yml | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/ci/qemuarm64-secureboot.yml b/ci/qemuarm64-secureboot.yml
index b26941e0..958a1ff1 100644
--- a/ci/qemuarm64-secureboot.yml
+++ b/ci/qemuarm64-secureboot.yml
@@ -4,13 +4,15 @@ header:
version: 14
includes:
- ci/base.yml
-
-machine: qemuarm64-secureboot
-
-target:
- - core-image-base
+ - ci/meta-openembedded.yml
+ - ci/meta-secure-core.yml
local_conf_header:
optee: |
IMAGE_INSTALL:append = " optee-test optee-client optee-os-ta"
TEST_SUITES:append = " optee ftpm"
+
+machine: qemuarm64-secureboot
+
+target:
+ - core-image-base
--
2.46.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH v3 10/13] linux-yocto: Setup UEFI and sign kernel image
2024-08-22 1:43 [PATCH v3 00/13] qemuarm64-secureboot: Add UEFI Secure Boot Javier Tia
` (8 preceding siblings ...)
2024-08-22 1:43 ` [PATCH v3 09/13] qemuarm64-secureboot: Add meta-secure-core layer as dependency Javier Tia
@ 2024-08-22 1:43 ` Javier Tia
2024-08-22 1:43 ` [PATCH v3 11/13] systemd: Add UEFI support Javier Tia
` (2 subsequent siblings)
12 siblings, 0 replies; 15+ messages in thread
From: Javier Tia @ 2024-08-22 1:43 UTC (permalink / raw)
To: meta-arm; +Cc: Mikko Rapeli, Ross Burton, Jon Mason, Javier Tia
efivarfs kernel module is required to access EFI vars.
Signed-off-by: Javier Tia <javier.tia@linaro.org>
---
.../core-image-base-uefi-secureboot.inc | 8 ++++++++
.../linux/linux-yocto%.bbappend | 2 ++
.../linux/linux-yocto-uefi-secureboot.inc | 19 +++++++++++++++++++
3 files changed, 29 insertions(+)
create mode 100644 meta-arm/recipes-kernel/linux/linux-yocto-uefi-secureboot.inc
diff --git a/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc b/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
index 2232d3b3..06046f6e 100644
--- a/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
+++ b/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
@@ -1,3 +1,11 @@
inherit uefi-sb-keys
WKS_FILE = "efi-disk-no-swap.wks.in"
+
+# Detected by passing kernel parameter
+QB_KERNEL_ROOT = ""
+
+# kernel is in the image, should not be loaded separately
+QB_DEFAULT_KERNEL = "none"
+
+KERNEL_IMAGETYPE = "Image"
diff --git a/meta-arm/recipes-kernel/linux/linux-yocto%.bbappend b/meta-arm/recipes-kernel/linux/linux-yocto%.bbappend
index a287d0e1..29c21355 100644
--- a/meta-arm/recipes-kernel/linux/linux-yocto%.bbappend
+++ b/meta-arm/recipes-kernel/linux/linux-yocto%.bbappend
@@ -25,3 +25,5 @@ SRC_URI:append:qemuarm = " \
FFA_TRANSPORT_INCLUDE = "${@bb.utils.contains('MACHINE_FEATURES', 'arm-ffa', 'arm-ffa-transport.inc', '' , d)}"
require ${FFA_TRANSPORT_INCLUDE}
+
+require ${@bb.utils.contains('MACHINE_FEATURES', 'uefi-secureboot', 'linux-yocto-uefi-secureboot.inc', '', d)}
\ No newline at end of file
diff --git a/meta-arm/recipes-kernel/linux/linux-yocto-uefi-secureboot.inc b/meta-arm/recipes-kernel/linux/linux-yocto-uefi-secureboot.inc
new file mode 100644
index 00000000..cb62fdee
--- /dev/null
+++ b/meta-arm/recipes-kernel/linux/linux-yocto-uefi-secureboot.inc
@@ -0,0 +1,19 @@
+KERNEL_FEATURES += "cfg/efi-ext.scc"
+
+DEPENDS += 'gen-uefi-sb-keys'
+
+inherit sbsign
+
+SBSIGN_KEY = "${UEFI_SB_KEYS_DIR}/db.key"
+SBSIGN_CERT = "${UEFI_SB_KEYS_DIR}/db.crt"
+
+# shell variable set inside do_compile task
+SBSIGN_TARGET_BINARY = "$KERNEL_IMAGE"
+
+do_compile:append() {
+ KERNEL_IMAGE=$(find ${B} -name ${KERNEL_IMAGETYPE} -print -quit)
+ do_sbsign
+}
+
+RRECOMMENDS:${PN} += "kernel-module-efivarfs"
+RRECOMMENDS:${PN} += "kernel-module-efivars"
--
2.46.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH v3 11/13] systemd: Add UEFI support
2024-08-22 1:43 [PATCH v3 00/13] qemuarm64-secureboot: Add UEFI Secure Boot Javier Tia
` (9 preceding siblings ...)
2024-08-22 1:43 ` [PATCH v3 10/13] linux-yocto: Setup UEFI and sign kernel image Javier Tia
@ 2024-08-22 1:43 ` Javier Tia
2024-08-22 1:43 ` [PATCH v3 12/13] systemd-boot: Use it as bootloader & sign UEFI image Javier Tia
2024-08-22 1:43 ` [PATCH v3 13/13] meta-arm: Add UEFI Secure Boot test Javier Tia
12 siblings, 0 replies; 15+ messages in thread
From: Javier Tia @ 2024-08-22 1:43 UTC (permalink / raw)
To: meta-arm; +Cc: Mikko Rapeli, Ross Burton, Jon Mason, Javier Tia
Signed-off-by: Javier Tia <javier.tia@linaro.org>
---
.../recipes-bsp/images/core-image-base-uefi-secureboot.inc | 2 ++
meta-arm/conf/machine/qemuarm64-secureboot.conf | 5 +++++
meta-arm/recipes-core/systemd/systemd-efi.inc | 1 +
meta-arm/recipes-core/systemd/systemd_%.bbappend | 1 +
4 files changed, 9 insertions(+)
create mode 100644 meta-arm/recipes-core/systemd/systemd-efi.inc
create mode 100644 meta-arm/recipes-core/systemd/systemd_%.bbappend
diff --git a/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc b/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
index 06046f6e..07e315a3 100644
--- a/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
+++ b/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
@@ -9,3 +9,5 @@ QB_KERNEL_ROOT = ""
QB_DEFAULT_KERNEL = "none"
KERNEL_IMAGETYPE = "Image"
+
+IMAGE_INSTALL += "systemd"
diff --git a/meta-arm/conf/machine/qemuarm64-secureboot.conf b/meta-arm/conf/machine/qemuarm64-secureboot.conf
index 6789b1c6..d6a7e22b 100644
--- a/meta-arm/conf/machine/qemuarm64-secureboot.conf
+++ b/meta-arm/conf/machine/qemuarm64-secureboot.conf
@@ -25,4 +25,9 @@ WKS_FILE_DEPENDS = "trusted-firmware-a"
IMAGE_BOOT_FILES = "${KERNEL_IMAGETYPE}"
MACHINE_FEATURES += "optee-ftpm"
+MACHINE_FEATURES += "efi"
MACHINE_FEATURES += "uefi-secureboot"
+
+INIT_MANAGER = "systemd"
+DISTRO_FEATURES += "systemd"
+DISTRO_FEATURES_NATIVE += "systemd"
diff --git a/meta-arm/recipes-core/systemd/systemd-efi.inc b/meta-arm/recipes-core/systemd/systemd-efi.inc
new file mode 100644
index 00000000..5572e51a
--- /dev/null
+++ b/meta-arm/recipes-core/systemd/systemd-efi.inc
@@ -0,0 +1 @@
+PACKAGECONFIG:append = " efi"
diff --git a/meta-arm/recipes-core/systemd/systemd_%.bbappend b/meta-arm/recipes-core/systemd/systemd_%.bbappend
new file mode 100644
index 00000000..660358c2
--- /dev/null
+++ b/meta-arm/recipes-core/systemd/systemd_%.bbappend
@@ -0,0 +1 @@
+require ${@bb.utils.contains('MACHINE_FEATURES', 'efi', 'systemd-efi.inc', '', d)}
--
2.46.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH v3 12/13] systemd-boot: Use it as bootloader & sign UEFI image
2024-08-22 1:43 [PATCH v3 00/13] qemuarm64-secureboot: Add UEFI Secure Boot Javier Tia
` (10 preceding siblings ...)
2024-08-22 1:43 ` [PATCH v3 11/13] systemd: Add UEFI support Javier Tia
@ 2024-08-22 1:43 ` Javier Tia
2024-08-22 1:43 ` [PATCH v3 13/13] meta-arm: Add UEFI Secure Boot test Javier Tia
12 siblings, 0 replies; 15+ messages in thread
From: Javier Tia @ 2024-08-22 1:43 UTC (permalink / raw)
To: meta-arm; +Cc: Mikko Rapeli, Ross Burton, Jon Mason, Javier Tia
As qemuarm64-secureboot is already using systemd as Init manager, use
too systemd-boot as bootloader. It has a simpler and more intuitive
configuration format compared to grub. It uses a single configuration
file that is easy to understand and modify.
Signed-off-by: Javier Tia <javier.tia@linaro.org>
---
.../images/core-image-base-uefi-secureboot.inc | 2 +-
meta-arm-bsp/wic/efi-disk-no-swap.wks.in | 2 +-
meta-arm/conf/machine/qemuarm64-secureboot.conf | 2 ++
.../systemd/systemd-boot-uefi-secureboot.inc | 12 ++++++++++++
.../recipes-core/systemd/systemd-boot_%.bbappend | 1 +
5 files changed, 17 insertions(+), 2 deletions(-)
create mode 100644 meta-arm/recipes-core/systemd/systemd-boot-uefi-secureboot.inc
create mode 100644 meta-arm/recipes-core/systemd/systemd-boot_%.bbappend
diff --git a/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc b/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
index 07e315a3..e5cf7760 100644
--- a/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
+++ b/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
@@ -10,4 +10,4 @@ QB_DEFAULT_KERNEL = "none"
KERNEL_IMAGETYPE = "Image"
-IMAGE_INSTALL += "systemd"
+IMAGE_INSTALL += "systemd systemd-boot"
diff --git a/meta-arm-bsp/wic/efi-disk-no-swap.wks.in b/meta-arm-bsp/wic/efi-disk-no-swap.wks.in
index 6ae7ad9d..6d77d3aa 100644
--- a/meta-arm-bsp/wic/efi-disk-no-swap.wks.in
+++ b/meta-arm-bsp/wic/efi-disk-no-swap.wks.in
@@ -7,4 +7,4 @@ part /boot --source bootimg-efi --sourceparams="loader=${EFI_PROVIDER}" --label
part / --source rootfs --fstype=ext4 --label root --align 1024 --use-uuid --exclude-path boot/
-bootloader --ptable gpt --timeout=1 --append="${GRUB_LINUX_APPEND}"
+bootloader --ptable gpt --timeout=5 --append="${LINUX_KERNEL_ARGS}"
diff --git a/meta-arm/conf/machine/qemuarm64-secureboot.conf b/meta-arm/conf/machine/qemuarm64-secureboot.conf
index d6a7e22b..2f40d360 100644
--- a/meta-arm/conf/machine/qemuarm64-secureboot.conf
+++ b/meta-arm/conf/machine/qemuarm64-secureboot.conf
@@ -28,6 +28,8 @@ MACHINE_FEATURES += "optee-ftpm"
MACHINE_FEATURES += "efi"
MACHINE_FEATURES += "uefi-secureboot"
+EFI_PROVIDER = "systemd-boot"
+
INIT_MANAGER = "systemd"
DISTRO_FEATURES += "systemd"
DISTRO_FEATURES_NATIVE += "systemd"
diff --git a/meta-arm/recipes-core/systemd/systemd-boot-uefi-secureboot.inc b/meta-arm/recipes-core/systemd/systemd-boot-uefi-secureboot.inc
new file mode 100644
index 00000000..c0753614
--- /dev/null
+++ b/meta-arm/recipes-core/systemd/systemd-boot-uefi-secureboot.inc
@@ -0,0 +1,12 @@
+DEPENDS += 'gen-uefi-sb-keys'
+DEPENDS += "sbsigntool-native"
+
+inherit sbsign
+
+SBSIGN_KEY = "${UEFI_SB_KEYS_DIR}/db.key"
+SBSIGN_CERT = "${UEFI_SB_KEYS_DIR}/db.crt"
+SBSIGN_TARGET_BINARY = "${B}/src/boot/efi/systemd-boot${EFI_ARCH}.efi"
+
+do_compile:append() {
+ do_sbsign
+}
diff --git a/meta-arm/recipes-core/systemd/systemd-boot_%.bbappend b/meta-arm/recipes-core/systemd/systemd-boot_%.bbappend
new file mode 100644
index 00000000..caba9830
--- /dev/null
+++ b/meta-arm/recipes-core/systemd/systemd-boot_%.bbappend
@@ -0,0 +1 @@
+require ${@bb.utils.contains('MACHINE_FEATURES', 'uefi-secureboot', 'systemd-boot-uefi-secureboot.inc', '', d)}
\ No newline at end of file
--
2.46.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [PATCH v3 13/13] meta-arm: Add UEFI Secure Boot test
2024-08-22 1:43 [PATCH v3 00/13] qemuarm64-secureboot: Add UEFI Secure Boot Javier Tia
` (11 preceding siblings ...)
2024-08-22 1:43 ` [PATCH v3 12/13] systemd-boot: Use it as bootloader & sign UEFI image Javier Tia
@ 2024-08-22 1:43 ` Javier Tia
12 siblings, 0 replies; 15+ messages in thread
From: Javier Tia @ 2024-08-22 1:43 UTC (permalink / raw)
To: meta-arm; +Cc: Mikko Rapeli, Ross Burton, Jon Mason, Javier Tia
Add a test to verify UEFI Secure Boot is enabled
Run the test:
kas build 'ci/qemuarm64-secureboot.yml:ci/testimage.yml'
Signed-off-by: Javier Tia <javier.tia@linaro.org>
---
ci/qemuarm64-secureboot.yml | 2 ++
.../core-image-base-uefi-secureboot.inc | 6 +++-
.../oeqa/runtime/cases/uefi_secure_boot.py | 32 +++++++++++++++++++
3 files changed, 39 insertions(+), 1 deletion(-)
create mode 100644 meta-arm/lib/oeqa/runtime/cases/uefi_secure_boot.py
diff --git a/ci/qemuarm64-secureboot.yml b/ci/qemuarm64-secureboot.yml
index 958a1ff1..02341934 100644
--- a/ci/qemuarm64-secureboot.yml
+++ b/ci/qemuarm64-secureboot.yml
@@ -11,6 +11,8 @@ local_conf_header:
optee: |
IMAGE_INSTALL:append = " optee-test optee-client optee-os-ta"
TEST_SUITES:append = " optee ftpm"
+ uefi_secure_boot: |
+ TEST_SUITES:append = " uefi_secure_boot"
machine: qemuarm64-secureboot
diff --git a/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc b/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
index e5cf7760..ce64b8b5 100644
--- a/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
+++ b/meta-arm-bsp/recipes-bsp/images/core-image-base-uefi-secureboot.inc
@@ -10,4 +10,8 @@ QB_DEFAULT_KERNEL = "none"
KERNEL_IMAGETYPE = "Image"
-IMAGE_INSTALL += "systemd systemd-boot"
+IMAGE_INSTALL += "systemd systemd-boot util-linux coreutils efivar"
+
+inherit extrausers
+
+EXTRA_IMAGE_FEATURES += "allow-root-login empty-root-password"
diff --git a/meta-arm/lib/oeqa/runtime/cases/uefi_secure_boot.py b/meta-arm/lib/oeqa/runtime/cases/uefi_secure_boot.py
new file mode 100644
index 00000000..4a62b54c
--- /dev/null
+++ b/meta-arm/lib/oeqa/runtime/cases/uefi_secure_boot.py
@@ -0,0 +1,32 @@
+#
+# SPDX-License-Identifier: MIT
+#
+
+import os
+
+from oeqa.runtime.case import OERuntimeTestCase
+from oeqa.runtime.decorator.package import OEHasPackage
+from oeqa.core.decorator.oetimeout import OETimeout
+
+
+class UEFI_SB_TestSuite(OERuntimeTestCase):
+ """
+ Validate Secure Boot is Enabled
+ """
+
+ @OETimeout(1300)
+ def test_uefi_secure_boot(self):
+ # Validate Secure Boot is enabled by checking
+ # 8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot.
+ # The GUID '8be4df61-93ca-11d2-aa0d-00e098032b8c' is a well-known
+ # identifier for the Secure Boot UEFI variable. By checking the value of
+ # this variable, specifically
+ # '8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot', we can determine
+ # whether Secure Boot is enabled or not. This variable is set by the
+ # UEFI firmware to indicate the current Secure Boot state. If the
+ # variable is set to a value of '0x1' (or '1'), it indicates that Secure
+ # Boot is enabled. If the variable is set to a value of '0x0' (or '0'),
+ # it indicates that Secure Boot is disabled.
+ cmd = "efivar -d -n 8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot"
+ status, output = self.target.run(cmd, timeout=120)
+ self.assertEqual(output, "1", msg="\n".join([cmd, output]))
--
2.46.0
^ permalink raw reply related [flat|nested] 15+ messages in thread