mbox series

[0/3] systemd uki support

Message ID 20240902094117.31156-1-mikko.rapeli@linaro.org
Headers show
Series systemd uki support | expand

Message

Mikko Rapeli Sept. 2, 2024, 9:41 a.m. UTC 
These changes enable building systemd uki images which combine
kernel, kernel command line, initrd and possibly signatures to
a single UEFI binary. This binary can be booted with UEFI firmware
and systemd-boot. No grub is needed and UEFI firmware and/or
systemd-boot provide possibilities for boot menus.
The uki binary can also be signed for UEFI secure boot
so the secure boot extends from firmware to kernel and initrd.
Binding secure boot to full userspace is then easier since for example
kernel command line and initrd contain the support needed to mount
encrypted dm-verity etc partitions, and/or create partitions on demand
with systemd-repart using device specific TPM devices for encryption.

Tested on qemuarm64-secureboot machine from meta-arm with changes to
support secure boot. Slightly different configuration tested on
multiple arm64 System Ready boards with UEFI firmware, real and firmware
based TPM devices.

Erik Schilling (1):
  systemd-tools: add recipe

Michelle Lin (1):
  uki.bbclass: add class for building Unified Kernel Images (UKI)

Mikko Rapeli (1):
  bitbake.conf: add getopt to HOSTTOOLS

 meta/classes-recipe/uki.bbclass               | 158 ++++++++++++++++++
 meta/conf/bitbake.conf                        |   2 +-
 .../systemd/systemd-tools_256.5.bb            |  41 +++++
 3 files changed, 200 insertions(+), 1 deletion(-)
 create mode 100644 meta/classes-recipe/uki.bbclass
 create mode 100644 meta/recipes-core/systemd/systemd-tools_256.5.bb