diff --git a/meta-ti-bsp/recipes-kernel/linux/files/0001-move-common-SSL-helper-functions-to-a-header.patch b/meta-ti-bsp/recipes-kernel/linux/files/0001-move-common-SSL-helper-functions-to-a-header.patch new file mode 100644 index 00000000..6a58b5eb --- /dev/null +++ b/meta-ti-bsp/recipes-kernel/linux/files/0001-move-common-SSL-helper-functions-to-a-header.patch @@ -0,0 +1,205 @@ +From 300e6d4116f956b035281ec94297dc4dc8d4e1d3 Mon Sep 17 00:00:00 2001 +From: Jan Stancek +Date: Fri, 12 Jul 2024 09:11:14 +0200 +Subject: sign-file,extract-cert: move common SSL helper functions to a header + +Couple error handling helpers are repeated in both tools, so +move them to a common header. + +Signed-off-by: Jan Stancek +Reviewed-by: Jarkko Sakkinen +Tested-by: R Nageswara Sastry +Reviewed-by: Neal Gompa +Signed-off-by: Jarkko Sakkinen + +Upstream-Status: Inappropriate [OE specific] +--- + MAINTAINERS | 1 + + certs/Makefile | 2 +- + certs/extract-cert.c | 37 ++----------------------------------- + scripts/sign-file.c | 37 ++----------------------------------- + scripts/ssl-common.h | 39 +++++++++++++++++++++++++++++++++++++++ + 5 files changed, 45 insertions(+), 71 deletions(-) + create mode 100644 scripts/ssl-common.h + +diff --git a/MAINTAINERS b/MAINTAINERS +index 9278c30ef1d5a..23f9028848552 100644 +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -5204,6 +5204,7 @@ S: Maintained + F: Documentation/admin-guide/module-signing.rst + F: certs/ + F: scripts/sign-file.c ++F: scripts/ssl-common.h + F: tools/certs/ + + CFAG12864B LCD DRIVER +diff --git a/certs/Makefile b/certs/Makefile +index 1094e3860c2a7..f6fa4d8d75e05 100644 +--- a/certs/Makefile ++++ b/certs/Makefile +@@ -84,5 +84,5 @@ targets += x509_revocation_list + + hostprogs := extract-cert + +-HOSTCFLAGS_extract-cert.o = $(shell $(HOSTPKG_CONFIG) --cflags libcrypto 2> /dev/null) ++HOSTCFLAGS_extract-cert.o = $(shell $(HOSTPKG_CONFIG) --cflags libcrypto 2> /dev/null) -I$(srctree)/scripts + HOSTLDLIBS_extract-cert = $(shell $(HOSTPKG_CONFIG) --libs libcrypto 2> /dev/null || echo -lcrypto) +diff --git a/certs/extract-cert.c b/certs/extract-cert.c +index 70e9ec89d87d3..8e7ba9974a1fa 100644 +--- a/certs/extract-cert.c ++++ b/certs/extract-cert.c +@@ -23,6 +23,8 @@ + #include + #include + ++#include "ssl-common.h" ++ + /* + * OpenSSL 3.0 deprecates the OpenSSL's ENGINE API. + * +@@ -40,41 +42,6 @@ void format(void) + exit(2); + } + +-static void display_openssl_errors(int l) +-{ +- const char *file; +- char buf[120]; +- int e, line; +- +- if (ERR_peek_error() == 0) +- return; +- fprintf(stderr, "At main.c:%d:\n", l); +- +- while ((e = ERR_get_error_line(&file, &line))) { +- ERR_error_string(e, buf); +- fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line); +- } +-} +- +-static void drain_openssl_errors(void) +-{ +- const char *file; +- int line; +- +- if (ERR_peek_error() == 0) +- return; +- while (ERR_get_error_line(&file, &line)) {} +-} +- +-#define ERR(cond, fmt, ...) \ +- do { \ +- bool __cond = (cond); \ +- display_openssl_errors(__LINE__); \ +- if (__cond) { \ +- err(1, fmt, ## __VA_ARGS__); \ +- } \ +- } while(0) +- + static const char *key_pass; + static BIO *wb; + static char *cert_dst; +diff --git a/scripts/sign-file.c b/scripts/sign-file.c +index 3edb156ae52c3..39ba58db5d4ea 100644 +--- a/scripts/sign-file.c ++++ b/scripts/sign-file.c +@@ -29,6 +29,8 @@ + #include + #include + ++#include "ssl-common.h" ++ + /* + * OpenSSL 3.0 deprecates the OpenSSL's ENGINE API. + * +@@ -83,41 +85,6 @@ void format(void) + exit(2); + } + +-static void display_openssl_errors(int l) +-{ +- const char *file; +- char buf[120]; +- int e, line; +- +- if (ERR_peek_error() == 0) +- return; +- fprintf(stderr, "At main.c:%d:\n", l); +- +- while ((e = ERR_get_error_line(&file, &line))) { +- ERR_error_string(e, buf); +- fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line); +- } +-} +- +-static void drain_openssl_errors(void) +-{ +- const char *file; +- int line; +- +- if (ERR_peek_error() == 0) +- return; +- while (ERR_get_error_line(&file, &line)) {} +-} +- +-#define ERR(cond, fmt, ...) \ +- do { \ +- bool __cond = (cond); \ +- display_openssl_errors(__LINE__); \ +- if (__cond) { \ +- errx(1, fmt, ## __VA_ARGS__); \ +- } \ +- } while(0) +- + static const char *key_pass; + + static int pem_pw_cb(char *buf, int len, int w, void *v) +diff --git a/scripts/ssl-common.h b/scripts/ssl-common.h +new file mode 100644 +index 0000000000000..e6711c75ed913 +--- /dev/null ++++ b/scripts/ssl-common.h +@@ -0,0 +1,39 @@ ++/* SPDX-License-Identifier: LGPL-2.1+ */ ++/* ++ * SSL helper functions shared by sign-file and extract-cert. ++ */ ++ ++static void display_openssl_errors(int l) ++{ ++ const char *file; ++ char buf[120]; ++ int e, line; ++ ++ if (ERR_peek_error() == 0) ++ return; ++ fprintf(stderr, "At main.c:%d:\n", l); ++ ++ while ((e = ERR_get_error_line(&file, &line))) { ++ ERR_error_string(e, buf); ++ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line); ++ } ++} ++ ++static void drain_openssl_errors(void) ++{ ++ const char *file; ++ int line; ++ ++ if (ERR_peek_error() == 0) ++ return; ++ while (ERR_get_error_line(&file, &line)) {} ++} ++ ++#define ERR(cond, fmt, ...) \ ++ do { \ ++ bool __cond = (cond); \ ++ display_openssl_errors(__LINE__); \ ++ if (__cond) { \ ++ errx(1, fmt, ## __VA_ARGS__); \ ++ } \ ++ } while (0) +-- +cgit 1.3.1-korg + diff --git a/meta-ti-bsp/recipes-kernel/linux/files/0002-avoid-using-deprecated-ERR_get_error_line.patch b/meta-ti-bsp/recipes-kernel/linux/files/0002-avoid-using-deprecated-ERR_get_error_line.patch new file mode 100644 index 00000000..993f6739 --- /dev/null +++ b/meta-ti-bsp/recipes-kernel/linux/files/0002-avoid-using-deprecated-ERR_get_error_line.patch @@ -0,0 +1,121 @@ +From 467d60eddf55588add232feda325da7215ddaf30 Mon Sep 17 00:00:00 2001 +From: Jan Stancek +Date: Fri, 12 Jul 2024 09:11:15 +0200 +Subject: sign-file,extract-cert: avoid using deprecated ERR_get_error_line() + +ERR_get_error_line() is deprecated since OpenSSL 3.0. + +Use ERR_peek_error_line() instead, and combine display_openssl_errors() +and drain_openssl_errors() to a single function where parameter decides +if it should consume errors silently. + +Signed-off-by: Jan Stancek +Reviewed-by: Jarkko Sakkinen +Tested-by: R Nageswara Sastry +Reviewed-by: Neal Gompa +Signed-off-by: Jarkko Sakkinen + +Upstream-Status: Inappropriate [OE-specifc] +--- + certs/extract-cert.c | 4 ++-- + scripts/sign-file.c | 6 +++--- + scripts/ssl-common.h | 23 ++++++++--------------- + 3 files changed, 13 insertions(+), 20 deletions(-) + +diff --git a/certs/extract-cert.c b/certs/extract-cert.c +index 8e7ba9974a1fa..61bbe00856717 100644 +--- a/certs/extract-cert.c ++++ b/certs/extract-cert.c +@@ -99,11 +99,11 @@ int main(int argc, char **argv) + parms.cert = NULL; + + ENGINE_load_builtin_engines(); +- drain_openssl_errors(); ++ drain_openssl_errors(__LINE__, 1); + e = ENGINE_by_id("pkcs11"); + ERR(!e, "Load PKCS#11 ENGINE"); + if (ENGINE_init(e)) +- drain_openssl_errors(); ++ drain_openssl_errors(__LINE__, 1); + else + ERR(1, "ENGINE_init"); + if (key_pass) +diff --git a/scripts/sign-file.c b/scripts/sign-file.c +index 39ba58db5d4ea..bb3fdf1a617c2 100644 +--- a/scripts/sign-file.c ++++ b/scripts/sign-file.c +@@ -114,11 +114,11 @@ static EVP_PKEY *read_private_key(const char *private_key_name) + ENGINE *e; + + ENGINE_load_builtin_engines(); +- drain_openssl_errors(); ++ drain_openssl_errors(__LINE__, 1); + e = ENGINE_by_id("pkcs11"); + ERR(!e, "Load PKCS#11 ENGINE"); + if (ENGINE_init(e)) +- drain_openssl_errors(); ++ drain_openssl_errors(__LINE__, 1); + else + ERR(1, "ENGINE_init"); + if (key_pass) +@@ -273,7 +273,7 @@ int main(int argc, char **argv) + + /* Digest the module data. */ + OpenSSL_add_all_digests(); +- display_openssl_errors(__LINE__); ++ drain_openssl_errors(__LINE__, 0); + digest_algo = EVP_get_digestbyname(hash_algo); + ERR(!digest_algo, "EVP_get_digestbyname"); + +diff --git a/scripts/ssl-common.h b/scripts/ssl-common.h +index e6711c75ed913..2db0e181143cf 100644 +--- a/scripts/ssl-common.h ++++ b/scripts/ssl-common.h +@@ -3,7 +3,7 @@ + * SSL helper functions shared by sign-file and extract-cert. + */ + +-static void display_openssl_errors(int l) ++static void drain_openssl_errors(int l, int silent) + { + const char *file; + char buf[120]; +@@ -11,28 +11,21 @@ static void display_openssl_errors(int l) + + if (ERR_peek_error() == 0) + return; +- fprintf(stderr, "At main.c:%d:\n", l); ++ if (!silent) ++ fprintf(stderr, "At main.c:%d:\n", l); + +- while ((e = ERR_get_error_line(&file, &line))) { ++ while ((e = ERR_peek_error_line(&file, &line))) { + ERR_error_string(e, buf); +- fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line); ++ if (!silent) ++ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line); ++ ERR_get_error(); + } + } + +-static void drain_openssl_errors(void) +-{ +- const char *file; +- int line; +- +- if (ERR_peek_error() == 0) +- return; +- while (ERR_get_error_line(&file, &line)) {} +-} +- + #define ERR(cond, fmt, ...) \ + do { \ + bool __cond = (cond); \ +- display_openssl_errors(__LINE__); \ ++ drain_openssl_errors(__LINE__, 0); \ + if (__cond) { \ + errx(1, fmt, ## __VA_ARGS__); \ + } \ +-- +cgit 1.3.1-korg + diff --git a/meta-ti-bsp/recipes-kernel/linux/files/0003-use-pkcs11-provider-for-OPENSSL-MAJOR-3.patch b/meta-ti-bsp/recipes-kernel/linux/files/0003-use-pkcs11-provider-for-OPENSSL-MAJOR-3.patch new file mode 100644 index 00000000..8f509895 --- /dev/null +++ b/meta-ti-bsp/recipes-kernel/linux/files/0003-use-pkcs11-provider-for-OPENSSL-MAJOR-3.patch @@ -0,0 +1,163 @@ +From 558bdc45dfb2669e1741384a0c80be9c82fa052c Mon Sep 17 00:00:00 2001 +From: Jan Stancek +Date: Fri, 20 Sep 2024 19:52:48 +0300 +Subject: sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 + +ENGINE API has been deprecated since OpenSSL version 3.0 [1]. +Distros have started dropping support from headers and in future +it will likely disappear also from library. + +It has been superseded by the PROVIDER API, so use it instead +for OPENSSL MAJOR >= 3. + +[1] https://github.com/openssl/openssl/blob/master/README-ENGINES.md + +[jarkko: fixed up alignment issues reported by checkpatch.pl --strict] + +Signed-off-by: Jan Stancek +Reviewed-by: Jarkko Sakkinen +Tested-by: R Nageswara Sastry +Reviewed-by: Neal Gompa +Signed-off-by: Jarkko Sakkinen + +Upstream-Status: Inappropriate [OE-specifc] +--- + certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++++++++--------------- + 1 file changed, 73 insertions(+), 30 deletions(-) + +(limited to 'certs/extract-cert.c') + +diff --git a/certs/extract-cert.c b/certs/extract-cert.c +index 61bbe00856717..7d6d468ed6129 100644 +--- a/certs/extract-cert.c ++++ b/certs/extract-cert.c +@@ -21,17 +21,18 @@ + #include + #include + #include +-#include +- ++#if OPENSSL_VERSION_MAJOR >= 3 ++# define USE_PKCS11_PROVIDER ++# include ++# include ++#else ++# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0) ++# define USE_PKCS11_ENGINE ++# include ++# endif ++#endif + #include "ssl-common.h" + +-/* +- * OpenSSL 3.0 deprecates the OpenSSL's ENGINE API. +- * +- * Remove this if/when that API is no longer used +- */ +-#pragma GCC diagnostic ignored "-Wdeprecated-declarations" +- + #define PKEY_ID_PKCS7 2 + + static __attribute__((noreturn)) +@@ -61,6 +62,66 @@ static void write_cert(X509 *x509) + fprintf(stderr, "Extracted cert: %s\n", buf); + } + ++static X509 *load_cert_pkcs11(const char *cert_src) ++{ ++ X509 *cert = NULL; ++#ifdef USE_PKCS11_PROVIDER ++ OSSL_STORE_CTX *store; ++ ++ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true)) ++ ERR(1, "OSSL_PROVIDER_try_load(pkcs11)"); ++ if (!OSSL_PROVIDER_try_load(NULL, "default", true)) ++ ERR(1, "OSSL_PROVIDER_try_load(default)"); ++ ++ store = OSSL_STORE_open(cert_src, NULL, NULL, NULL, NULL); ++ ERR(!store, "OSSL_STORE_open"); ++ ++ while (!OSSL_STORE_eof(store)) { ++ OSSL_STORE_INFO *info = OSSL_STORE_load(store); ++ ++ if (!info) { ++ drain_openssl_errors(__LINE__, 0); ++ continue; ++ } ++ if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_CERT) { ++ cert = OSSL_STORE_INFO_get1_CERT(info); ++ ERR(!cert, "OSSL_STORE_INFO_get1_CERT"); ++ } ++ OSSL_STORE_INFO_free(info); ++ if (cert) ++ break; ++ } ++ OSSL_STORE_close(store); ++#elif defined(USE_PKCS11_ENGINE) ++ ENGINE *e; ++ struct { ++ const char *cert_id; ++ X509 *cert; ++ } parms; ++ ++ parms.cert_id = cert_src; ++ parms.cert = NULL; ++ ++ ENGINE_load_builtin_engines(); ++ drain_openssl_errors(__LINE__, 1); ++ e = ENGINE_by_id("pkcs11"); ++ ERR(!e, "Load PKCS#11 ENGINE"); ++ if (ENGINE_init(e)) ++ drain_openssl_errors(__LINE__, 1); ++ else ++ ERR(1, "ENGINE_init"); ++ if (key_pass) ++ ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN"); ++ ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &parms, NULL, 1); ++ ERR(!parms.cert, "Get X.509 from PKCS#11"); ++ cert = parms.cert; ++#else ++ fprintf(stderr, "no pkcs11 engine/provider available\n"); ++ exit(1); ++#endif ++ return cert; ++} ++ + int main(int argc, char **argv) + { + char *cert_src; +@@ -89,28 +150,10 @@ int main(int argc, char **argv) + fclose(f); + exit(0); + } else if (!strncmp(cert_src, "pkcs11:", 7)) { +- ENGINE *e; +- struct { +- const char *cert_id; +- X509 *cert; +- } parms; ++ X509 *cert = load_cert_pkcs11(cert_src); + +- parms.cert_id = cert_src; +- parms.cert = NULL; +- +- ENGINE_load_builtin_engines(); +- drain_openssl_errors(__LINE__, 1); +- e = ENGINE_by_id("pkcs11"); +- ERR(!e, "Load PKCS#11 ENGINE"); +- if (ENGINE_init(e)) +- drain_openssl_errors(__LINE__, 1); +- else +- ERR(1, "ENGINE_init"); +- if (key_pass) +- ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN"); +- ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &parms, NULL, 1); +- ERR(!parms.cert, "Get X.509 from PKCS#11"); +- write_cert(parms.cert); ++ ERR(!cert, "load_cert_pkcs11 failed"); ++ write_cert(cert); + } else { + BIO *b; + X509 *x509; +-- +cgit 1.3.1-korg + diff --git a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.6.bb b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.6.bb index 9acc95c8..3d6b7007 100644 --- a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.6.bb +++ b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.6.bb @@ -28,6 +28,12 @@ KERNEL_REPRODUCIBILITY_PATCHES = " \ file://0001-vt-conmakehash-improve-reproducibility.patch \ " +SRC_URI += "\ + file://0001-move-common-SSL-helper-functions-to-a-header.patch \ + file://0002-avoid-using-deprecated-ERR_get_error_line.patch \ + file://0003-use-pkcs11-provider-for-OPENSSL-MAJOR-3.patch \ +" + # Special configuration for remoteproc/rpmsg IPC modules module_conf_rpmsg_client_sample = "blacklist rpmsg_client_sample" module_conf_ti_k3_r5_remoteproc = "softdep ti_k3_r5_remoteproc pre: virtio_rpmsg_bus"