| Message ID | 20241001082821.26115-1-mikko.rapeli@linaro.org |
|---|---|
| Headers | show |
| Series | systemd uki support | expand |
On 1 Oct 2024, at 09:28, Mikko Rapeli via lists.openembedded.org <mikko.rapeli=linaro.org@lists.openembedded.org> wrote: > These changes enable building systemd uki images which combine > kernel, kernel command line, initrd and possibly signatures to > a single UEFI binary. This binary can be booted with UEFI firmware > and systemd-boot. No grub is needed and UEFI firmware and/or > systemd-boot provide possibilities for boot menus. > The uki binary can also be signed for UEFI secure boot > so the secure boot extends from firmware to kernel and initrd. > Binding secure boot to full userspace is then easier since for example > kernel command line and initrd contain the support needed to mount > encrypted dm-verity etc partitions, and/or create partitions on demand > with systemd-repart using device specific TPM devices for encryption. Something in here breaks a wic/efi image when I don’t touch anything else. eg genericarm64 with systemd: U-Boot 2024.07 (Jul 01 2024 - 18:07:18 +0000) DRAM: 256 MiB Core: 51 devices, 14 uclasses, devicetree: board Flash: 64 MiB Loading Environment from Flash... *** Warning - bad CRC, using default environment In: serial,usbkbd Out: serial,vidconsole Err: serial,vidconsole No USB controllers found Net: eth0: virtio-net#32 starting USB... No USB controllers found Hit any key to stop autoboot: 0 Scanning for bootflows in all bootdevs Seq Method State Uclass Part Name Filename --- ----------- ------ -------- ---- ------------------------ ---------------- Scanning global bootmeth 'efi_mgr': No EFI system partition No EFI system partition Failed to persist EFI variables No EFI system partition Failed to persist EFI variables No EFI system partition Failed to persist EFI variables Missing TPMv2 device for EFI_TCG_PROTOCOL 0 efi_mgr ready (none) 0 <NULL> ** Booting bootflow '<NULL>' with efi_mgr Booting: virtio 0 No loader found. Configuration files in \loader\entries\*.conf are needed. Looks like the /boot partition doesn’t have what it should in. Ross
Hi, On Tue, Oct 08, 2024 at 05:09:16PM +0000, Ross Burton wrote: > On 1 Oct 2024, at 09:28, Mikko Rapeli via lists.openembedded.org <mikko.rapeli=linaro.org@lists.openembedded.org> wrote: > > These changes enable building systemd uki images which combine > > kernel, kernel command line, initrd and possibly signatures to > > a single UEFI binary. This binary can be booted with UEFI firmware > > and systemd-boot. No grub is needed and UEFI firmware and/or > > systemd-boot provide possibilities for boot menus. > > The uki binary can also be signed for UEFI secure boot > > so the secure boot extends from firmware to kernel and initrd. > > Binding secure boot to full userspace is then easier since for example > > kernel command line and initrd contain the support needed to mount > > encrypted dm-verity etc partitions, and/or create partitions on demand > > with systemd-repart using device specific TPM devices for encryption. > > Something in here breaks a wic/efi image when I don’t touch anything else. eg genericarm64 with systemd: > > U-Boot 2024.07 (Jul 01 2024 - 18:07:18 +0000) > > DRAM: 256 MiB > Core: 51 devices, 14 uclasses, devicetree: board > Flash: 64 MiB > Loading Environment from Flash... *** Warning - bad CRC, using default environment > > In: serial,usbkbd > Out: serial,vidconsole > Err: serial,vidconsole > No USB controllers found > Net: eth0: virtio-net#32 > > starting USB... > No USB controllers found > Hit any key to stop autoboot: 0 > Scanning for bootflows in all bootdevs > Seq Method State Uclass Part Name Filename > --- ----------- ------ -------- ---- ------------------------ ---------------- > Scanning global bootmeth 'efi_mgr': > No EFI system partition > No EFI system partition > Failed to persist EFI variables > No EFI system partition > Failed to persist EFI variables > No EFI system partition > Failed to persist EFI variables > Missing TPMv2 device for EFI_TCG_PROTOCOL > 0 efi_mgr ready (none) 0 <NULL> > ** Booting bootflow '<NULL>' with efi_mgr > Booting: virtio 0 > No loader found. Configuration files in \loader\entries\*.conf are needed. > > Looks like the /boot partition doesn’t have what it should in. Ok sorry about this. I missed meta-yocto-bsp/wic/genericarm64.wks.in setup when changing wic uki generation to uki.bbclass. I'll send a fix. I hope this was the only one. Cheers, -Mikko
These changes enable building systemd uki images which combine kernel, kernel command line, initrd and possibly signatures to a single UEFI binary. This binary can be booted with UEFI firmware and systemd-boot. No grub is needed and UEFI firmware and/or systemd-boot provide possibilities for boot menus. The uki binary can also be signed for UEFI secure boot so the secure boot extends from firmware to kernel and initrd. Binding secure boot to full userspace is then easier since for example kernel command line and initrd contain the support needed to mount encrypted dm-verity etc partitions, and/or create partitions on demand with systemd-repart using device specific TPM devices for encryption. Tested on qemuarm64-secureboot machine from meta-arm with changes to support secure boot. Slightly different configuration tested on multiple arm64 System Ready boards with UEFI firmware, real and firmware based TPM devices. Tested with ovmf firmware on x86_64 with selftests but without secure boot which seems to be harder to setup in ovmf. Sadly I see two wic selftests, wic.Wic2.test_rawcopy_plugin_qemu and wic.Wic2.test_expand_mbr_image, failing when executing all wic selftests on a build machine with zfs filesystem. Will investigate this further. The issue seems to be in mkfs.ext4 producing broken filesystem, and partially in the tests which don't run the correct rootfs file (.ext4 vs .wic). Will debug this further and it is IMO unrelated to these changes since they reproduce on pure master branch without this series. v5: drop patch "image_types_wic.bbclass: set systemd-boot and os-release dependency for all archs" since systemd-boot does not support all architectures v4: handle missing runqemu variable from build config, add python3-pefile to fast ptest list v3: rebased, fixed and added more sefltests, removed wic plugin side uki support v2: https://lists.openembedded.org/g/openembedded-core/message/204090 Michelle Lin (1): uki.bbclass: add class for building Unified Kernel Images (UKI) Mikko Rapeli (10): python3-pefile: add recipe from meta-openembedded maintainers.inc: add python3-pefile systemd-boot-native: add runtime dependency to python3-pefile-native wic bootimg-efi.py: keep timestamps and add debug prints wic bootimg-efi.py: change UKI support from wic plugin to uki.bbclass oeqa selftest uki.py: add tests for uki.bbclass oeqa selftest efibootpartition.py: add TEST_RUNQEMUPARAMS to runqemu oeqa selftest efibootpartition.py: remove systemd-boot from grub-efi test oeqa selftest wic.py: add TEST_RUNQEMUPARAMS to runqemu oeqa selftest wic.py: support UKIs via uki.bbclass meta-selftest/wic/test_efi_plugin.wks | 5 +- meta/classes-recipe/image_types_wic.bbclass | 3 +- meta/classes-recipe/uki.bbclass | 197 ++++++++++++++++++ meta/conf/distro/include/maintainers.inc | 1 + .../distro/include/ptest-packagelists.inc | 1 + .../oeqa/selftest/cases/efibootpartition.py | 11 +- meta/lib/oeqa/selftest/cases/uki.py | 138 ++++++++++++ meta/lib/oeqa/selftest/cases/wic.py | 58 ++++-- .../systemd/systemd-boot-native_256.6.bb | 2 + .../python/python3-pefile/run-ptest | 3 + .../python/python3-pefile_2023.2.7.bb | 28 +++ .../wic/canned-wks/efi-uki-bootdisk.wks.in | 3 + scripts/lib/wic/plugins/source/bootimg-efi.py | 187 +++++------------ 13 files changed, 481 insertions(+), 156 deletions(-) create mode 100644 meta/classes-recipe/uki.bbclass create mode 100644 meta/lib/oeqa/selftest/cases/uki.py create mode 100644 meta/recipes-devtools/python/python3-pefile/run-ptest create mode 100644 meta/recipes-devtools/python/python3-pefile_2023.2.7.bb create mode 100644 scripts/lib/wic/canned-wks/efi-uki-bootdisk.wks.in