Fixes and improvements for SWUpdate images, kernel/config update

index a9a3663..6e5aacd 100644
@@ -31,4 +31,6 @@ fi
 
 mkdir -p ${rootmnt}/var/local/etc
 mkdir -p ${rootmnt}/var/local/.atomic
-mount -t overlay -o lowerdir=${rootmnt}/etc,upperdir=${rootmnt}/var/local/etc,workdir=${rootmnt}/var/local/.atomic overlay ${rootmnt}/etc
+if ! mount -t overlay -o lowerdir=${rootmnt}/etc,upperdir=${rootmnt}/var/local/etc,workdir=${rootmnt}/var/local/.atomic overlay ${rootmnt}/etc; then
+	panic "Can't mount overlay!"
+fi

new file mode 100644
index 0000000..bfaa7b6
@@ -0,0 +1,25 @@
+#!/bin/sh
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2022
+#
+# Authors:
+#  Jan Kiszka <[email protected]>
+#
+
+PREREQ=""
+prereqs()
+{
+    echo "$PREREQ"
+}
+case $1 in
+prereqs)
+    prereqs
+    exit 0
+    ;;
+esac
+
+. /usr/share/initramfs-tools/hook-functions
+
+manual_add_modules overlay

index 19e9261..37a04ec 100644
@@ -12,6 +12,7 @@
 inherit dpkg-raw
 
 SRC_URI += " \
+    file://etc-overlay.hook \
     file://etc-overlay.script \
     "
 

@@ -22,6 +23,8 @@ do_install[cleandirs] += " \
     ${D}/usr/share/initramfs-tools/scripts/local-bottom"
 
 do_install() {
+    install -m 0755 "${WORKDIR}/etc-overlay.hook" \
+        "${D}/usr/share/initramfs-tools/hooks/etc-overlay"
     install -m 0755 "${WORKDIR}/etc-overlay.script" \
         "${D}/usr/share/initramfs-tools/scripts/local-bottom/etc-overlay"
 }

deleted file mode 100644
index cd2d271..0000000
@@ -1,103 +0,0 @@
---- local.orig	2020-11-18 14:42:43.540055680 +0530
-+++ local	2020-11-18 20:15:48.687164540 +0530
-@@ -1,5 +1,4 @@
- # Local filesystem mounting			-*- shell-script -*-
--
- local_top()
- {
- 	if [ "${local_top_used}" != "yes" ]; then
-@@ -152,36 +151,70 @@
- 	DEV="${real_dev}"
- }
- 
--local_mount_root()
-+local_find_by_uuid()
- {
--	local_top
--	if [ -z "${ROOT}" ]; then
--		panic "No root device specified. Boot arguments must include a root= parameter."
--	fi
--	local_device_setup "${ROOT}" "root file system"
--	ROOT="${DEV}"
-+	partitions="$1"
- 
--	# Get the root filesystem type if not set
--	if [ -z "${ROOTFSTYPE}" ] || [ "${ROOTFSTYPE}" = auto ]; then
--		FSTYPE=$(get_fstype "${ROOT}")
--	else
--		FSTYPE=${ROOTFSTYPE}
--	fi
-+	for part in $partitions; do
-+		if [ "$(blkid -p ${part} --match-types novfat -s USAGE -o value)" = "filesystem" ]; then
-+			local_device_setup "${part}" "root file system"
-+			ROOT="${DEV}"
-+
-+			# Get the root filesystem type if not set
-+			if [ -z "${ROOTFSTYPE}" ] || [ "${ROOTFSTYPE}" = auto ]; then
-+				FSTYPE=$(get_fstype "${ROOT}")
-+			else
-+				FSTYPE=${ROOTFSTYPE}
-+			fi
- 
--	local_premount
-+			local_premount
- 
--	if [ "${readonly?}" = "y" ]; then
--		roflag=-r
--	else
--		roflag=-w
--	fi
-+			if [ "${readonly?}" = "y" ]; then
-+				roflag=-r
-+			else
-+				roflag=-w
-+			fi
-+			checkfs "${ROOT}" root "${FSTYPE}"
- 
--	checkfs "${ROOT}" root "${FSTYPE}"
-+			# Mount root
-+			# shellcheck disable=SC2086
-+			if mount ${roflag} ${FSTYPE:+-t "${FSTYPE}"} ${ROOTFLAGS} "${ROOT}" "${rootmnt?}"; then
-+				if [ -e "${rootmnt?}"/etc/os-release ]; then
-+				image_uuid=$(sed -n 's/^IMAGE_UUID=//p' "${rootmnt?}"/etc/os-release | tr -d '"' )
-+					if [ "${INITRAMFS_IMAGE_UUID}" = "${image_uuid}" ]; then
-+						return 0
-+					fi
-+				fi
-+				umount "${rootmnt?}"
-+			fi
-+		fi
-+	done
-+	return 1
-+}
- 
--	# Mount root
--	# shellcheck disable=SC2086
--	if ! mount ${roflag} ${FSTYPE:+-t "${FSTYPE}"} ${ROOTFLAGS} "${ROOT}" "${rootmnt?}"; then
--		panic "Failed to mount ${ROOT} as root file system."
-+local_mount_root()
-+{
-+	local_top
-+	if [ ! -e /conf/image_uuid ]; then
-+		 panic "could not find image_uuid to select correct root file system"
-+	fi
-+	local INITRAMFS_IMAGE_UUID=$(cat /conf/image_uuid)
-+	local partitions=""
-+	local ret=1
-+	local timeout_uuid=0
-+	while [ "${ret}" != 0 ] && [ "${timeout_uuid}" -le 10 ]; do
-+		wait_for_udev 10
-+		partitions=$(blkid -o device)
-+		local_find_by_uuid "$partitions"
-+		ret=$?
-+		timeout_uuid="$(cat /proc/uptime)"
-+		timeout_uuid="${timeout_uuid%%[. ]*}"
-+		timeout_uuid=$((timeout_uuid - local_top_time))
-+	done
-+	if [ "${ret}" != 0 ]; then
-+		panic "Could not find ROOTFS with matching UUID $INITRAMFS_IMAGE_UUID"
-+	else
-+		return $ret
- 	fi
- }
- 

index b2d7be9..c1a0301 100644
@@ -43,24 +43,22 @@ executable or script with the following interface:
 Supply the script name and path to wic by adding
 `signwith=<path and name of the script to sign>"` to sourceparams of the partition.
 
-### Existing packages to sign an image
+### Existing key packages for signing an image
 
-#### ebg-secure-boot-snakeoil
+#### secure-boot-snakeoil
 
 This package uses the snakeoil key and certificate from the ovmf package(0.0~20200229-2)
-backported from Debian bullseye and signs the image.
+backported from Debian bullseye for signing the image.
 
-#### ebg-secure-boot-secrets
-This package takes a user-generated certificate and adds it to the build system.
+#### secure-boot-key
+
+This package takes a user-generated certificate and key adds them to the build system.
 The following variable and steps are necessary to build a secure boot capable image:
 - Set certification information to sign and verify the image with:
-    - SB_CERTDB: The directory containing the certificate database create with certutil
-    - SB_VERIFY_CERT: The certificate to verify the signing process
-    - SB_KEY_NAME: Name of the key in the certificate database
-- if necessary change the script to select the boot partition after an update
-    - recipes-support/initramfs-config/files/initramfs.selectrootfs.script
+    - SB_CERT: The certificate to verify the signing process
+    - SB_KEY: The private key of for the certificate
 
-The files referred by SB_CERTDB and SB_VERIFY_CERT must be store in  `recipes-devtools/ebg-secure-boot-secrets/files/`
+The files referred by SB_CERT and SB_KEY must be store in `recipes-devtools/secure-boot-secrets/files/`.
 
 ## Running in QEMU
 

@@ -96,7 +94,7 @@ scripts/generate-sb-db-from-existing-certificate.sh
 ```
 This will create the directory `SB_KEYDIR` and will store the `${SB_NAME}certdb` with the given name.
 
-Copy the used certificate and database to `recipes-devtools/ebg-secure-boot-secrets/files/`
+Copy the used certificate and private key to `recipes-devtools/secure-boot-secrets/files/`
 
 #### Generate keys
 

index b329f41..7442eb7 100644
@@ -28,6 +28,7 @@ local_conf_header:
     INITRAMFS_INSTALL_append = " initramfs-verity-hook"
 
   secure-boot: |
-    # Add snakeoil binaries for qemu
-    IMAGER_BUILD_DEPS += "ebg-secure-boot-snakeoil"
-    IMAGER_INSTALL += "ebg-secure-boot-snakeoil"
+    IMAGER_BUILD_DEPS += "ebg-secure-boot-signer"
+    IMAGER_INSTALL += "ebg-secure-boot-signer"
+    # Use snakeoil keys
+    PREFERRED_PROVIDER_secure-boot-secrets = "secure-boot-snakeoil"

51 lines not on this page · raw message

deleted file mode 100644
index c739c51..0000000
@@ -1 +0,0 @@
-For a secure boot image this directory needs to contain the certdb directory and the db.crt file.

deleted file mode 100644
index 8361a49..0000000
@@ -1,12 +0,0 @@
-Source: ${PN}
-Section: misc
-Priority: optional
-Standards-Version: 3.9.6
-Maintainer: ${MAINTAINER}
-Build-Depends: debhelper (>= 9)
-
-Package: ${PN}
-Architecture: ${DPKG_ARCH}
-Depends: ${DEBIAN_DEPENDS}
-Description: ${DESCRIPTION}
-Conflicts: ${DEBIAN_CONFLICTS}

deleted file mode 100644
index e84fd4c..0000000
@@ -1,22 +0,0 @@
-#!/bin/sh
-set -e
-set -x
-signee=$1
-signed=$2
-
-usage(){
-    echo "sign with debian snakeoil"
-    echo "$0 signee signed"
-    echo "signee: path to the image to be signed"
-    echo "signed: path to store the signed image"
-}
-
-
-if [ -z "$signee" ] || [ -z "$signed" ]; then
-    usage
-    exit 1
-fi
-
-pesign --force --verbose --padding -n ${SB_CERT_PATH}/${SB_CERTDB} -c "${SB_KEY_NAME}" -s -i $signee -o $signed
-sbverify --cert ${SB_CERT_PATH}/${SB_VERIFY_CERT} $signed
-exit 0

new file mode 100644
index 0000000..546fded
@@ -0,0 +1,26 @@
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2020-2022
+#
+# Authors:
+#  Quirin Gylstorff <[email protected]>
+#  Jan Kiszka <[email protected]>
+#
+# SPDX-License-Identifier: MIT
+#
+
+inherit dpkg-raw
+
+DESCRIPTION = "Signing script for EFI Boot Guard setups"
+
+DEPENDS = "secure-boot-secrets"
+DEBIAN_DEPENDS = "sbsigntool, secure-boot-secrets"
+
+SRC_URI = "file://sign_secure_image.sh"
+
+do_install() {
+    TARGET=${D}/usr/bin
+    install -d ${TARGET}
+    install -m 755 ${WORKDIR}/sign_secure_image.sh ${TARGET}/sign_secure_image.sh
+}

new file mode 100644
index 0000000..0c9b898
@@ -0,0 +1,33 @@
+#!/bin/sh
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2020-2022
+#
+# Authors:
+#  Quirin Gylstorff <[email protected]>
+#  Jan Kiszka <[email protected]>
+#
+# SPDX-License-Identifier: MIT
+#
+
+set -e
+
+signee=$1
+signed=$2
+
+usage(){
+    echo "sign with image keys"
+    echo "$0 signee signed"
+    echo "signee: path to the image to be signed"
+    echo "signed: path to store the signed image"
+}
+
+if [ -z "$signee" ] || [ -z "$signed" ]; then
+    usage
+    exit 1
+fi
+
+keydir=/usr/share/secure-boot-secrets
+
+sbsign --key ${keydir}/secure-boot.key --cert ${keydir}/secure-boot.pem --output $signed $signee

deleted file mode 100644
index 4975d92..0000000
@@ -1,34 +0,0 @@
-#
-# CIP Core, generic profile
-#
-# Copyright (c) Siemens AG, 2020
-#
-# Authors:
-#  Quirin Gylstorff <[email protected]>
-#
-# SPDX-License-Identifier: MIT
-#
-
-inherit dpkg-raw
-
-DESCRIPTION = "Add script to sign for secure boot with the debian snakeoil keys"
-# used to sign the image
-DEBIAN_DEPENDS = "pesign,  sbsigntool, ovmf, openssl, libnss3-tools"
-
-
-# this package cannot be install together with:
-DEBIAN_CONFLICTS = "ebg-secure-boot-secrets"
-
-SRC_URI = "file://sign_secure_image.sh \
-           file://control.tmpl"
-
-TEMPLATE_FILES = "control.tmpl"
-TEMPLATE_VARS += "PN MAINTAINER DPKG_ARCH DEBIAN_DEPENDS DESCRIPTION DEBIAN_CONFLICTS"
-
-do_install() {
-    TARGET=${D}/usr/bin
-    install -d ${TARGET}
-    install -m 755 ${WORKDIR}/sign_secure_image.sh ${TARGET}/sign_secure_image.sh
-}
-
-addtask do_install after do_transform_template

deleted file mode 100644
index 8361a49..0000000
@@ -1,12 +0,0 @@
-Source: ${PN}
-Section: misc
-Priority: optional
-Standards-Version: 3.9.6
-Maintainer: ${MAINTAINER}
-Build-Depends: debhelper (>= 9)
-
-Package: ${PN}
-Architecture: ${DPKG_ARCH}
-Depends: ${DEBIAN_DEPENDS}
-Description: ${DESCRIPTION}
-Conflicts: ${DEBIAN_CONFLICTS}

deleted file mode 100644
index 081dbe9..0000000
@@ -1,36 +0,0 @@
-#!/bin/sh
-set -e
-set -x
-signee=$1
-signed=$2
-
-usage(){
-    echo "sign with debian snakeoil"
-    echo "$0 signee signed"
-    echo "signee: path to the image to be signed"
-    echo "signed: path to store the signed image"
-}
-
-
-if [ -z "$signee" ] || [ -z "$signed" ]; then
-    usage
-    exit 1
-fi
-
-name=snakeoil
-keydir=$(mktemp -d)
-inkey=/usr/share/ovmf/PkKek-1-snakeoil.key
-incert=/usr/share/ovmf/PkKek-1-snakeoil.pem
-nick_name=snakeoil
-TMP=$(mktemp -d)
-mkdir -p ${keydir}/${name}certdb
-certutil -N --empty-password -d ${keydir}/${name}certdb
-openssl pkcs12 -export -passin pass:"snakeoil" -passout pass: -out ${TMP}/foo_key.p12 -inkey $inkey  -in $incert  -name $nick_name
-pk12util -W "" -i ${TMP}/foo_key.p12 -d ${keydir}/${name}certdb
-cp $incert ${keydir}/$(basename $incert)
-rm -rf $TMP
-
-pesign --force --verbose --padding -n ${keydir}/${name}certdb -c "$nick_name" -s -i $signee -o $signed
-sbverify --cert $incert $signed
-rm -rf $keydir
-exit 0

new file mode 100644
index 0000000..193de62
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAyIuuXei5qIw+UvavLxPyyNhx0G6Ijuf9SqxVXOpKcQ+l3ZCc
+KQaCLWCH0pbPQj587zVjgMUd4SHgXdVP6awDz8b0NcLgyzF31pHBmmB3z55nv2Jb
+gI56bix9TEHLpoDs4+cWAb2WZPkW8rV/6YR+xVuE8fi9aAWJ7H4dwUhPzU7RBB1d
+Z1wF6Wv3b8nn1jJa5W8I3zOd+tpWczOsqyRnDnFhMiOulGAiFTtmIXv2VReQf7Tx
+rXdqAAs9dcS3qizzNVgY5XpABtmYu1AjyLwwqXZ+blZ2tmUUJicgw3YdCWtlTAtf
+XZDHf+ZzgCNtTvhb2DzpAVmF/H+A8w8lUJZiBQIDAQABAoIBABET/BRZNj5JOyF7
+im2a6Ej8TazvTMfGr8ZFKLvR4+b+6yQUJYhE2p8colRnrVy5z4/bXw7fOm0qol27
+RaPjlyuBiNhvMQ98tfTa0r7fyjQvDCy7JomrGHf7Z+wvijUys3mw+ynIyF7u62pd
+1HfBZb5OzeKBSTfriNRP5R7JlqooDl+O9JVlnvlJIaFe1rX2sQxZ7F8gVINKIJDv
+n7ZZ0o351uIMjKLqwmliULPTjZ2ZeeJqnkB0pFcWZzEf2wAnrrglYRdnn10oNzhB
+6cXMHJeuEOedXECLZtmynRw1dWZK9+Xku1jEAqTWAoI0OIjrfYYzntwe/kab8w/R
+T7ojFGECgYEA9rGhtmSQiim2h+3iGyXNTEQiEOFFL7E8/1ibfWi3vzDhoLARrnH1
+p45DPgnL664xLHXIUl6/wto79Ij/2qA9mp054nVJ4X4AQgq3xCT/57nL0QHfQLaa
+VdzNIoz4jJT3cO0gYcBAK4Bg+dGGQ6ZUrRRt6VkHG/W6fW0D1e7PnEkCgYEA0Bxj
+Jr4ShNXb7J4YDQ24uSwmc2E1IgX5FjHu/JMKCiyIDWQkrxtVdIL9v6+kmYecyxFJ
+S3Qyr3ZqOHqwN1svYuB/CHyKg6dHrzJyZFTj8cr8h0ZKLDu2xZNFxfBIjn5vitSX
+W9q3477oFG/30Ew12Yee4NhDQkaEuB/Ic9+yv90CgYB2y00rLrwnvDSIunXiSs7U
+xg59gG03rSrJb5rYxj+NkvVj0sWA8qGwASLCUidfo69MUJ+ZgsTnCP5MIFjMp9Ni
+jAne0ko0it+G7fBWRNbyeJb8W+FtIUGqzTv/QlFCKU4KlDW+vLxp9lU8l7gHBabK
+/gZ7kwKIZUlbss5hC7Hv+QKBgQCsQBLBKmlhkTEqs9/sTgMrISPiM/8qXg9BE6tf
+WsTgjuM9UjoaxWEBwroMQnDWsqxQV8p2rYKWQEjC3qmj59Fc4bvDZnGvbnGizPpp
+mOniY8SIouEZo4MwHSmPH8auSnBAVJ3C5VF3K7gj0lknCy03E02phNaGsJ+BVq0v
+W2Qz8QKBgEB5RKiwJhgGQA2o+NJKKUUCDM9iBsO1Yy3QwtDWioKKcdAkxdTg3xR+
+XtJdXq6MkCMWM5em3v6GHPceexn81FZTxGBbIMBYNp0Sp4qs/3lK64ln8m5Qttxe
+70HVtrp9HhG5oFJ3fUuLPcYpE2GMgPM9fIbAWh9GZ4GpTLuPRtWg
+-----END RSA PRIVATE KEY-----

new file mode 100644
index 0000000..dd02a82
@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDdzCCAl+gAwIBAgIULTs+L+8XzClMGhAvyFIdsp/PYgUwDQYJKoZIhvcNAQEL
+BQAwSjELMAkGA1UEBhMCVVMxETAPBgNVBAgMCENvbG9yYWRvMRUwEwYDVQQHDAxG
+b3J0IENvbGxpbnMxETAPBgNVBAoMCFNuYWtlT2lsMCAXDTIwMDkwNzE4NDMyMloY
+DzIxMjAwODE0MTg0MzIyWjBKMQswCQYDVQQGEwJVUzERMA8GA1UECAwIQ29sb3Jh
+ZG8xFTATBgNVBAcMDEZvcnQgQ29sbGluczERMA8GA1UECgwIU25ha2VPaWwwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIi65d6LmojD5S9q8vE/LI2HHQ
+boiO5/1KrFVc6kpxD6XdkJwpBoItYIfSls9CPnzvNWOAxR3hIeBd1U/prAPPxvQ1
+wuDLMXfWkcGaYHfPnme/YluAjnpuLH1MQcumgOzj5xYBvZZk+RbytX/phH7FW4Tx
++L1oBYnsfh3BSE/NTtEEHV1nXAXpa/dvyefWMlrlbwjfM5362lZzM6yrJGcOcWEy
+I66UYCIVO2Yhe/ZVF5B/tPGtd2oACz11xLeqLPM1WBjlekAG2Zi7UCPIvDCpdn5u
+Vna2ZRQmJyDDdh0Ja2VMC19dkMd/5nOAI21O+FvYPOkBWYX8f4DzDyVQlmIFAgMB
+AAGjUzBRMB0GA1UdDgQWBBRjuNXuXfh7mi8I3eTboeYGyFTa2zAfBgNVHSMEGDAW
+gBRjuNXuXfh7mi8I3eTboeYGyFTa2zAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
+DQEBCwUAA4IBAQBW2ckn0APqBnwSiOXCWkMCnvY7K7UOfxAlotEsMFSrkzdEa4IE
+sn0+A3RV/r3HZGqIaE8GMsBqp8UiVIbL5H67dkqvJEke94/7wEUC16JSSOBc0Mac
+HeArDWsL/WIbzKiVcRrmgX+XwJFlsUN5UtR/feTHR08yiy5srSCIJEqli/cTrOxS
+JAgvWPLxcoFhOKf6Mi+nwWdrQEbpXvvv8Jv/qyyz5e/VmTRY0wIVmUjd+Yseu+5M
+3+cpKtlYaawMxVni5RibA0A12fm+i60fGPrkCNhascUrNY+Oppaf/h+QmKOwEM7h
+pqKXyGFQyU6dB6cFBQ/uD5IABUYuEOuL7VFY
+-----END CERTIFICATE-----

new file mode 100644
index 0000000..e6ef37c
@@ -0,0 +1,14 @@
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2022
+#
+# Authors:
+#  Jan Kiszka <[email protected]>
+#
+# SPDX-License-Identifier: MIT
+#
+
+require secure-boot-secrets.inc
+
+DEBIAN_CONFLICTS = "secure-boot-snakeoil"

new file mode 100644
index 0000000..f53435a
@@ -0,0 +1,34 @@
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2022
+#
+# Authors:
+#  Jan Kiszka <[email protected]>
+#
+# SPDX-License-Identifier: MIT
+#
+
+inherit dpkg-raw
+
+PROVIDES += "secure-boot-secrets"
+
+SB_KEY ??= ""
+SB_CERT ??= ""
+
+SRC_URI_append = " ${@ "file://"+d.getVar('SB_KEY') if d.getVar('SB_KEY') else '' }"
+SRC_URI_append = " ${@ "file://"+d.getVar('SB_CERT') if d.getVar('SB_CERT') else '' }"
+
+do_install() {
+    if [ -z ${SB_KEY} ] || [ -z ${SB_CERT} ]; then
+        bbfatal "You must set SB_KEY and SB_CERT and provide the required files as artifacts to this recipe"
+    fi
+    TARGET=${D}/usr/share/secure-boot-secrets
+    install -d -m 0700 ${TARGET}
+    install -m 0700 ${WORKDIR}/${SB_KEY} ${TARGET}/secure-boot.key
+    install -m 0700 ${WORKDIR}/${SB_CERT} ${TARGET}/secure-boot.pem
+}
+
+do_prepare_build_append() {
+    echo "Provides: secure-boot-secrets" >> ${S}/debian/control
+}

new file mode 100644
index 0000000..24a5352
@@ -0,0 +1,17 @@
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2022
+#
+# Authors:
+#  Jan Kiszka <[email protected]>
+#
+# SPDX-License-Identifier: MIT
+#
+
+require secure-boot-secrets.inc
+
+SB_KEY = "PkKek-1-snakeoil.key"
+SB_CERT = "PkKek-1-snakeoil.pem"
+
+DEBIAN_CONFLICTS = "secure-boot-key"

index 238e5b0..0e36bd5 100644
@@ -25,6 +25,6 @@ SRC_URI_append = " ${@ "git://gitlab.com/cip-project/cip-kernel/cip-kernel-confi
 
 SRC_URI_append_bbb = "file://${KERNEL_DEFCONFIG}"
 
-SRCREV_cip-kernel-config ?= "0150b63d0e74d64cc0d5baa9b9440cc148abad8b"
+SRCREV_cip-kernel-config ?= "a8d04df6595344091eee2b242c3a0f5e108f966c"
 
 S = "${WORKDIR}/linux-cip-v${PV}"

similarity index 72%
rename from recipes-kernel/linux/linux-cip_4.19.235-cip70.bb
rename to recipes-kernel/linux/linux-cip_4.19.239-cip72.bb
index eaad5e8..718bbfb 100644
@@ -13,4 +13,4 @@ require linux-cip-common.inc
 
 KERNEL_DEFCONFIG_VERSION ?= "4.19.y-cip"
 
-SRC_URI[sha256sum] = "b3bcb1ffd82c2ccdcb96aba55bdc46c72db12b6b5442591f804c8e298ad405c4"
+SRC_URI[sha256sum] = "5f22ea902c89b1cd178706411e48a40613c1db069fa7dc5993b979fd4652c2cd"

similarity index 72%
rename from recipes-kernel/linux/linux-cip_5.10.106-cip4.bb
rename to recipes-kernel/linux/linux-cip_5.10.112-cip6.bb
index 2f52cdb..b54dcb5 100644
@@ -13,4 +13,4 @@ require linux-cip-common.inc
 
 KERNEL_DEFCONFIG_VERSION ?= "5.10.y-cip"
 
-SRC_URI[sha256sum] = "512787b7f75b25e2c7f64978957bb2e6613e7c9edccc6d677ddd256109244d25"
+SRC_URI[sha256sum] = "aedeaefcb3da02fe6ab36859eb15c2e36844b2a0ea828a902b85037ad145e1ee"

similarity index 90%
rename from recipes-bsp/efibootguard/efibootguard_0.10.bb
rename to recipes-bsp/efibootguard/efibootguard_0.11.bb
index bfc0ede..ef6cd9c 100644
@@ -19,9 +19,9 @@ MAINTAINER = "Jan Kiszka <[email protected]>"
 SRC_URI = " \
     https://github.com/siemens/efibootguard/archive/refs/tags/v${PV}.tar.gz;downloadfilename=efitbootguard-v${PV}.tar.gz \
     file://debian \
-    file://0001-configure-Fix-aarch64-EFI-arch.patch \
+    file://0001-Makefile-Drop-nostdinc-for-EFI-binaries.patch \
     "
-SRC_URI[sha256sum] = "4d58574a0bb8f1e56056ab0bcc2487d37e49fa147dc991e719c2ec8e20f88dd3"
+SRC_URI[sha256sum] = "12bd84ff63a34bef56e489b48d4f97955aa4d864eeff9ea2dea1d24a286d8ebe"
 
 PROVIDES = "${PN}"
 PROVIDES += "${PN}-dev"

new file mode 100644
index 0000000..8cc1654
@@ -0,0 +1,28 @@
+From daf4cb61bec56dac628be83b95a7072c184eabcd Mon Sep 17 00:00:00 2001
+From: Jan Kiszka <[email protected]>
+Date: Wed, 4 May 2022 11:52:53 +0200
+Subject: [PATCH] Makefile: Drop -nostdinc for EFI binaries
+
+Not needed, also systemd-boot does not use it, and it actually triggers
+a build failure on Debian 10, possibly on other distros as well.
+
+Signed-off-by: Jan Kiszka <[email protected]>
+---
+ Makefile.am | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index f0daa15..7398b85 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -191,7 +191,6 @@ efi_cflags = \
+ 	-Wall \
+ 	-Wextra \
+ 	-std=gnu99 \
+-	-nostdinc \
+ 	-ggdb -O0 \
+ 	-fpic \
+ 	-fshort-wchar \
+-- 
+2.34.1
+

deleted file mode 100644
index ee05e94..0000000
@@ -1,28 +0,0 @@
-From 3f11612fbcbd1c17988d634ecdaecf1ec241f6e0 Mon Sep 17 00:00:00 2001
-From: Jan Kiszka <[email protected]>
-Date: Mon, 21 Mar 2022 07:02:28 +0100
-Subject: [PATCH] configure: Fix aarch64 EFI arch
-
-It's aa64 here according to the UEFI spec.
-
-Signed-off-by: Jan Kiszka <[email protected]>
----
- configure.ac | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/configure.ac b/configure.ac
-index a1a83e9..09d06d7 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -102,7 +102,7 @@ AM_COND_IF(ARCH_X86_64, [
- 	   MACHINE_TYPE_NAME=x64])
- 
- AM_COND_IF(ARCH_AARCH64, [
--	   MACHINE_TYPE_NAME=aarch64])
-+	   MACHINE_TYPE_NAME=aa64])
- 
- AC_SUBST([ARCH])
- AC_SUBST([MACHINE_TYPE_NAME])
--- 
-2.34.1
-

index 54b1994..f8bdd8a 100644
@@ -7,7 +7,7 @@ Homepage: ${HOMEPAGE}
 Maintainer: ${MAINTAINER}
 
 Package: ${PN}
-Depends: ${shlibs:Depends}
+Depends: ${shlibs:Depends}, python3
 Section: base
 Architecture: ${DISTRO_ARCH}
 Priority: required

index 910e153..d3ea007 100755
@@ -1,6 +1,7 @@
 #!/usr/bin/dh-exec
 bg_setenv usr/bin
 bg_printenv usr/bin
-efibootguard*.efi usr/share/efibootguard
+tools/bg_gen_unified_kernel usr/bin
+*.efi usr/share/efibootguard
 completion/bash/bg_printenv.bash => usr/share/bash-completion/completions/bg_printenv
 completion/bash/bg_setenv.bash => usr/share/bash-completion/completions/bg_setenv

index 909e629..9267033 100644
@@ -80,7 +80,7 @@ class EfibootguardBootPlugin(SourcePlugin):
 
         boot_files = source_params.get("files", "").split(' ')
         unified_kernel = source_params.get("unified-kernel") or 'y'
-        cmdline = bootloader.append
+        cmdline = bootloader.append or ''
         if unified_kernel == 'y':
             boot_image = cls._create_unified_kernel_image(rootfs_dir,
                                                           cr_workdir,

@@ -113,7 +113,7 @@ class EfibootguardBootPlugin(SourcePlugin):
             % (
                 part.label.upper(),
                 boot_image,
-                '-a "%s"' % cmdline if cmdline else "",
+                '-a "%s"' % cmdline,
                 source_params.get("revision", 1),
                 wdog_timeout
             )

index 8032ede..135794d 100644
@@ -127,7 +127,7 @@ config KAS_INCLUDE_TESTING
 	string
 	default "kas/opt/test.yml" if IMAGE_TESTING
 
-if IMAGE_FLASH
+if IMAGE_FLASH && !KERNEL_4_4 && !KERNEL_4_19
 
 config IMAGE_SWUPDATE
 	bool "SWUpdate support for root partition"

index 9267033..47c6884 100644
@@ -113,7 +113,7 @@ class EfibootguardBootPlugin(SourcePlugin):
             % (
                 part.label.upper(),
                 boot_image,
-                '-a "%s"' % cmdline,
+                '-a "%s"' % cmdline if unified_kernel != 'y' else '',
                 source_params.get("revision", 1),
                 wdog_timeout
             )

@@ -181,15 +181,9 @@ class EfibootguardBootPlugin(SourcePlugin):
             "i386": "ia32"
         }
         rootfs_path = rootfs_dir.get('ROOTFS_DIR')
-        os_release_file = "{root}/etc/os-release".format(root=rootfs_path)
-        efistub = "{rootfs_path}/usr/lib/systemd/boot/efi/linux{efiarch}.efi.stub"\
+        efistub = "{rootfs_path}/usr/share/efibootguard/kernel-stub{efiarch}.efi"\
             .format(rootfs_path=rootfs_path,
                     efiarch=distro_to_efi_arch[get_bitbake_var("DISTRO_ARCH")])
-        msger.debug("osrelease path: %s", os_release_file)
-        kernel_cmdline_file = "{cr_workdir}/kernel-command-line-file.txt"\
-            .format(cr_workdir=cr_workdir)
-        with open(kernel_cmdline_file, "w") as cmd_fd:
-            cmd_fd.write(cmdline)
         uefi_kernel_name = "linux.efi"
         uefi_kernel_file = "{deploy_dir}/{uefi_kernel_name}"\
             .format(deploy_dir=deploy_dir, uefi_kernel_name=uefi_kernel_name)

@@ -197,23 +191,14 @@ class EfibootguardBootPlugin(SourcePlugin):
             .format(deploy_dir=deploy_dir, kernel_image=kernel_image)
         initrd = "{deploy_dir}/{initrd_image}"\
             .format(deploy_dir=deploy_dir, initrd_image=initrd_image)
-        objcopy_cmd = 'objcopy \
-            --add-section .osrel={os_release_file} \
-            --change-section-vma .osrel=0x20000 \
-            --add-section .cmdline={kernel_cmdline_file} \
-            --change-section-vma .cmdline=0x30000 \
-            --add-section .linux={kernel} \
-            --change-section-vma .linux=0x2000000 \
-            --add-section .initrd={initrd} \
-            --change-section-vma .initrd=0x3000000 \
-            {efistub} {uefi_kernel_file}'.format(
-                os_release_file=os_release_file,
-                kernel_cmdline_file=kernel_cmdline_file,
+        cmd = 'bg_gen_unified_kernel {efistub} {kernel} {uefi_kernel_file} \
+            -c "{cmdline}" -i {initrd}'.format(
+                cmdline=cmdline,
                 kernel=kernel,
                 initrd=initrd,
                 efistub=efistub,
                 uefi_kernel_file=uefi_kernel_file)
-        exec_cmd(objcopy_cmd)
+        exec_cmd(cmd, as_shell=True)
 
         cls._sign_file(signee=uefi_kernel_file, source_params=source_params)
 

index 2d84427..c71cdb3 100644
@@ -23,7 +23,7 @@ local_conf_header:
   efibootguard-wic: |
     WIC_IMAGER_INSTALL_append = " efibootguard"
     WDOG_TIMEOUT ?= "60"
-    WICVARS += "WDOG_TIMEOUT KERNEL_IMAGE INITRD_IMAGE"
+    WICVARS += "WDOG_TIMEOUT KERNEL_IMAGE INITRD_IMAGE DTB_FILES"
     IMAGE_FSTYPES ?= "wic-img"
     WKS_FILE ?= "${MACHINE}-efibootguard.wks.in"
 

index 47c6884..4b7fa8d 100644
@@ -66,10 +66,12 @@ class EfibootguardBootPlugin(SourcePlugin):
             initrd_image = "initrd.img"
         bootloader = creator.ks.bootloader
 
+        dtb_files = (get_bitbake_var("DTB_FILES") or '').split()
+
         deploy_dir = get_bitbake_var("DEPLOY_DIR_IMAGE")
         if not deploy_dir:
             msger.error("DEPLOY_DIR_IMAGE not set, exiting\n")
-            sys.exit(1)
+            exit(1)
         creator.deploy_dir = deploy_dir
 
         wdog_timeout = get_bitbake_var("WDOG_TIMEOUT")

@@ -88,9 +90,13 @@ class EfibootguardBootPlugin(SourcePlugin):
                                                           deploy_dir,
                                                           kernel_image,
                                                           initrd_image,
+                                                          dtb_files,
                                                           source_params)
             boot_files.append(boot_image)
         else:
+            if dtb_files:
+                msger.error("DTB_FILES specified while unified kernel is disabled\n")
+                exit(1)
             root_dev = source_params.get("root", None)
             if not root_dev:
                 msger.error("Specify root in source params")

@@ -173,7 +179,7 @@ class EfibootguardBootPlugin(SourcePlugin):
     @classmethod
     def _create_unified_kernel_image(cls, rootfs_dir, cr_workdir, cmdline,
                                      deploy_dir, kernel_image, initrd_image,
-                                     source_params):
+                                     dtb_files, source_params):
         # we need to map the distro_arch to uefi values
         distro_to_efi_arch = {
             "amd64": "x64",

@@ -198,6 +204,11 @@ class EfibootguardBootPlugin(SourcePlugin):
                 initrd=initrd,
                 efistub=efistub,
                 uefi_kernel_file=uefi_kernel_file)
+        if dtb_files:
+            for dtb in dtb_files:
+                cmd += ' -d {deploy_dir}/{dtb_file}'.format(
+                    deploy_dir=deploy_dir,
+                    dtb_file=os.path.basename(dtb))
         exec_cmd(cmd, as_shell=True)
 
         cls._sign_file(signee=uefi_kernel_file, source_params=source_params)

new file mode 100644
index 0000000..b2ff705
@@ -0,0 +1,107 @@
+From 8b990a06685678abd8dbc8be86c27bf3e94e3694 Mon Sep 17 00:00:00 2001
+From: Jan Kiszka <[email protected]>
+Date: Sun, 24 Apr 2022 11:24:54 +0200
+Subject: [PATCH] lib/date: Make rtc_mktime and mktime64 Y2038-ready
+
+We currently overflow due to wrong types used internally in rtc_mktime,
+on all platforms, and we return a too small type on 32-bit.
+
+One consumer that directly benefits from this is mktime64. Many others
+may still store the result in a wrong type.
+
+While at it, drop the redundant cast of mon in rtc_mktime (obsoleted by
+714209832db1).
+
+Signed-off-by: Jan Kiszka <[email protected]>
+---
+ include/linux/time.h |  3 ---
+ include/rtc.h        |  8 +++++---
+ lib/date.c           | 13 +++++--------
+ 3 files changed, 10 insertions(+), 14 deletions(-)
+
+diff --git a/include/linux/time.h b/include/linux/time.h
+index 702dd276aea..14ff5b6f481 100644
+--- a/include/linux/time.h
++++ b/include/linux/time.h
+@@ -152,9 +152,6 @@ _DEFUN (ctime_r, (tim_p, result),
+     return asctime_r (localtime_r (tim_p, &tm), result);
+ }
+ 
+-/* for compatibility with linux code */
+-typedef __s64 time64_t;
+-
+ #ifdef CONFIG_LIB_DATE
+ time64_t mktime64(const unsigned int year, const unsigned int mon,
+ 		  const unsigned int day, const unsigned int hour,
+diff --git a/include/rtc.h b/include/rtc.h
+index 6c7fcadd488..10104e3bf5a 100644
+--- a/include/rtc.h
++++ b/include/rtc.h
+@@ -16,6 +16,8 @@
+ #include <bcd.h>
+ #include <rtc_def.h>
+ 
++typedef int64_t time64_t;
++
+ #ifdef CONFIG_DM_RTC
+ 
+ struct udevice;
+@@ -301,7 +303,7 @@ int rtc_calc_weekday(struct rtc_time *time);
+ void rtc_to_tm(u64 time_t, struct rtc_time *time);
+ 
+ /**
+- * rtc_mktime() - Convert a broken-out time into a time_t value
++ * rtc_mktime() - Convert a broken-out time into a time64_t value
+  *
+  * The following fields need to be valid for this function to work:
+  *	tm_sec, tm_min, tm_hour, tm_mday, tm_mon, tm_year
+@@ -309,9 +311,9 @@ void rtc_to_tm(u64 time_t, struct rtc_time *time);
+  * Note that tm_wday and tm_yday are ignored.
+  *
+  * @time:	Broken-out time to convert
+- * Return: corresponding time_t value, seconds since 1970-01-01 00:00:00
++ * Return: corresponding time64_t value, seconds since 1970-01-01 00:00:00
+  */
+-unsigned long rtc_mktime(const struct rtc_time *time);
++time64_t rtc_mktime(const struct rtc_time *time);
+ 
+ /**
+  * rtc_month_days() - The number of days in the month
+diff --git a/lib/date.c b/lib/date.c
+index c589d9ed3a2..e3d22459cd0 100644
+--- a/lib/date.c
++++ b/lib/date.c
+@@ -71,19 +71,16 @@ int rtc_calc_weekday(struct rtc_time *tm)
+  * -year / 100 + year / 400 terms, and add 10.]
+  *
+  * This algorithm was first published by Gauss (I think).
+- *
+- * WARNING: this function will overflow on 2106-02-07 06:28:16 on
+- * machines where long is 32-bit! (However, as time_t is signed, we
+- * will already get problems at other places on 2038-01-19 03:14:08)
+  */
+-unsigned long rtc_mktime(const struct rtc_time *tm)
++time64_t rtc_mktime(const struct rtc_time *tm)
+ {
+ 	int mon = tm->tm_mon;
+ 	int year = tm->tm_year;
+-	int days, hours;
++	unsigned long days;
++	time64_t hours;
+ 
+ 	mon -= 2;
+-	if (0 >= (int)mon) {	/* 1..12 -> 11, 12, 1..10 */
++	if (0 >= mon) {		/* 1..12 -> 11, 12, 1..10 */
+ 		mon += 12;	/* Puts Feb last since it has leap day */
+ 		year -= 1;
+ 	}
+@@ -109,5 +106,5 @@ time64_t mktime64(const unsigned int year, const unsigned int mon,
+ 	time.tm_min = min;
+ 	time.tm_sec = sec;
+ 
+-	return (time64_t)rtc_mktime((const struct rtc_time *)&time);
++	return rtc_mktime((const struct rtc_time *)&time);
+ }
+-- 
+2.34.1
+

new file mode 100755
index 0000000..36e1e1b
@@ -0,0 +1,40 @@
+#!/usr/bin/make -f
+#
+# Copyright (c) Siemens AG, 2018-2022
+#
+# SPDX-License-Identifier: MIT
+
+ifneq ($(DEB_BUILD_GNU_TYPE),$(DEB_HOST_GNU_TYPE))
+export CROSS_COMPILE=$(DEB_HOST_GNU_TYPE)-
+SET_CROSS_BUILD_TOOLS=CROSS_BUILD_TOOLS=y
+endif
+
+override_dh_auto_build:
+	if [ -e /usr/share/secure-boot-secrets/secure-boot.pem ]; then \
+		openssl x509 -in /usr/share/secure-boot-secrets/secure-boot.pem -out secure-boot.der -outform der; \
+		rm -f secure-boot.esl; \
+		efisiglist -a -c secure-boot.der -o secure-boot.esl; \
+		rm -f ubootefi.var; \
+		tools/efivar.py set -i ubootefi.var -n PK -d secure-boot.esl -t file; \
+		tools/efivar.py set -i ubootefi.var -n KEK -d secure-boot.esl -t file; \
+		tools/efivar.py set -i ubootefi.var -n db -d secure-boot.esl -t file; \
+	fi
+	$(MAKE) $(PARALLEL_MAKE) $(U_BOOT_CONFIG)
+	$(MAKE) $(PARALLEL_MAKE) ${U_BOOT_BIN}
+	$(MAKE) -n u-boot-initial-env >/dev/null 2>&1; if [ $$? -ne 2 ]; then \
+		$(MAKE) $(PARALLEL_MAKE) u-boot-initial-env; \
+	else \
+		./scripts/get_default_envs.sh >u-boot-initial-env; \
+	fi
+	$(MAKE) $(PARALLEL_MAKE) $(SET_CROSS_BUILD_TOOLS) NO_SDL=1 tools-only envtools
+
+override_dh_auto_install:
+	mv tools/env/lib.a tools/env/libubootenv.a
+
+override_dh_auto_test:
+
+override_dh_strip:
+	dh_strip -X libubootenv.a
+
+%:
+	dh $@ --parallel

new file mode 100644
index 0000000..a1b9931
@@ -0,0 +1,6 @@
+### Secure boot config
+CONFIG_BOOTDELAY=-2
+CONFIG_USE_BOOTCOMMAND=y
+CONFIG_BOOTCOMMAND="setenv scan_dev_for_boot 'if test -e ${devtype} ${devnum}:${distro_bootpart} efi/boot/bootaa64.efi; then load ${devtype} ${devnum}:${distro_bootpart} ${kernel_addr_r} efi/boot/bootaa64.efi; bootefi ${kernel_addr_r} ${fdtcontroladdr}; fi'; run distro_bootcmd; echo 'EFI Boot failed!'; sleep 1000; reset"
+CONFIG_EFI_VARIABLES_PRESEED=y
+CONFIG_EFI_SECURE_BOOT=y

50 lines not on this page · raw message

index 135794d..651a726 100644
@@ -131,11 +131,11 @@ if IMAGE_FLASH && !KERNEL_4_4 && !KERNEL_4_19
 
 config IMAGE_SWUPDATE
 	bool "SWUpdate support for root partition"
-	depends on TARGET_QEMU_AMD64 || TARGET_SIMATIC_IPC227E
+	depends on TARGET_QEMU_AMD64 || TARGET_SIMATIC_IPC227E || TARGET_QEMU_ARM64
 
 config IMAGE_SECURE_BOOT
 	bool "Secure boot support"
-	depends on TARGET_QEMU_AMD64
+	depends on TARGET_QEMU_AMD64 || TARGET_QEMU_ARM64
 	select IMAGE_SWUPDATE
 
 config KAS_INCLUDE_SWUPDATE_SECBOOT

index 0d21262..4e12cdb 100644
@@ -11,3 +11,6 @@ DISTRO_ARCH = "arm64"
 IMAGE_FSTYPES ?= "ext4-img"
 USE_CIP_KERNEL_CONFIG = "1"
 KERNEL_DEFCONFIG ?= "cip-kernel-config/${KERNEL_DEFCONFIG_VERSION}/arm64/qemu_arm64_defconfig"
+
+# for SWUpdate setups: watchdog is configured in U-Boot
+WDOG_TIMEOUT = "0"

index 7442eb7..3f2a794 100644
@@ -32,3 +32,6 @@ local_conf_header:
     IMAGER_INSTALL += "ebg-secure-boot-signer"
     # Use snakeoil keys
     PREFERRED_PROVIDER_secure-boot-secrets = "secure-boot-snakeoil"
+
+  secureboot_override: |
+    OVERRIDES .= ":secureboot"

index c71cdb3..d85aed7 100644
@@ -27,10 +27,12 @@ local_conf_header:
     IMAGE_FSTYPES ?= "wic-img"
     WKS_FILE ?= "${MACHINE}-efibootguard.wks.in"
 
-  ovmf-binaries: |
+  firmware-binaries: |
     # Add ovmf binaries for qemu
     IMAGER_BUILD_DEPS_append_qemu-amd64 += "ovmf-binaries"
     # not needed for Debian 11 and later
     OVERRIDES_append_qemu-amd64 = ":${BASE_DISTRO_CODENAME}"
     DISTRO_APT_SOURCES_append_qemu-amd64_buster = " conf/distro/debian-buster-backports.list"
     DISTRO_APT_PREFERENCES_append_qemu-amd64_buster = " conf/distro/preferences.ovmf-snakeoil.conf"
+    # Add U-Boot for qemu
+    IMAGER_BUILD_DEPS_append_qemu-arm64 += "u-boot-qemu-arm64"

new file mode 100644
index 0000000..df6a9a1
@@ -0,0 +1,15 @@
+# EFI partition containing efibootguard bootloader binary
+include ebg-signed-bootloader.inc
+
+# EFI Boot Guard environment/config partitions plus Kernel files
+part --source efibootguard-boot --size 32M --extra-space 0 --overhead-factor 1 --label BOOT0 --align 1024 --part-type=0700 --sourceparams "revision=2,signwith=/usr/bin/sign_secure_image.sh"
+part --source efibootguard-boot --size 32M --extra-space 0 --overhead-factor 1 --label BOOT1 --align 1024 --part-type=0700 --sourceparams "revision=1,signwith=/usr/bin/sign_secure_image.sh"
+
+part --source rawcopy --sourceparams "file=${IMAGE_FULLNAME}.${VERITY_IMAGE_TYPE}.verity.img" --align 1024 --fixed-size 1G --uuid "fedcba98-7654-3210-cafe-5e0710000001"
+part --source rawcopy --sourceparams "file=${IMAGE_FULLNAME}.${VERITY_IMAGE_TYPE}.verity.img" --align 1024 --fixed-size 1G --uuid "fedcba98-7654-3210-cafe-5e0710000002"
+
+# home and var are extra partitions
+part /home --source rootfs --rootfs-dir=${IMAGE_ROOTFS}/home --fstype=ext4 --label home --align 1024 --size 1G
+part /var  --source rootfs --rootfs-dir=${IMAGE_ROOTFS}/var  --fstype=ext4 --label var  --align 1024 --size 2G
+
+bootloader --ptable gpt --append="panic=5"

new file mode 100644
index 0000000..a153205
@@ -0,0 +1,13 @@
+# short-description: arm64 with EFI Boot Guard and SWUpdate
+# long-description: Disk image for arm64 machines with EFI Boot Guard and SWUpdate
+
+include ebg-sysparts.inc
+
+part --source rawcopy --sourceparams "file=${IMAGE_FULLNAME}.squashfs.img" --align 1024 --fixed-size 1G --uuid "fedcba98-7654-3210-cafe-5e0710000001"
+part --source rawcopy --sourceparams "file=${IMAGE_FULLNAME}.squashfs.img" --align 1024 --fixed-size 1G --uuid "fedcba98-7654-3210-cafe-5e0710000002"
+
+# home and var are extra partitions
+part /home --source rootfs --rootfs-dir=${IMAGE_ROOTFS}/home --fstype=ext4 --label home --align 1024  --size 1G
+part /var --source rootfs --rootfs-dir=${IMAGE_ROOTFS}/var --fstype=ext4 --label var --align 1024  --size 2G
+
+bootloader --ptable gpt

index fe08ebd..ad4fca5 100755
@@ -45,7 +45,10 @@ if [ -z "${TARGET_IMAGE}" ];then
 	fi
 fi
 
-case "$1" in
+arch="$1"
+shift 1
+
+case "${arch}" in
 	x86|x86_64|amd64)
 		DISTRO_ARCH=amd64
 		QEMU=qemu-system-x86_64

@@ -98,7 +101,7 @@ case "$1" in
 		usage
 		;;
 	*)
-		echo "Unsupported architecture: $1"
+		echo "Unsupported architecture: ${arch}"
 		exit 1
 		;;
 esac

@@ -107,40 +110,54 @@ IMAGE_PREFIX="$(dirname $0)/build/tmp/deploy/images/qemu-${DISTRO_ARCH}/${TARGET
 
 if [ -z "${DISPLAY}" ]; then
 	QEMU_EXTRA_ARGS="${QEMU_EXTRA_ARGS} -nographic"
-	case "$1" in
+	case "${arch}" in
 		x86|x86_64|amd64)
 			KERNEL_CMDLINE="${KERNEL_CMDLINE} console=ttyS0"
 	esac
 fi
 
-shift 1
-
 QEMU_COMMON_OPTIONS=" \
 	-m 1G \
 	-serial mon:stdio \
 	-netdev user,id=net,hostfwd=tcp:127.0.0.1:22222-:22 \
 	${QEMU_EXTRA_ARGS}"
 
-if [ -n "${SECURE_BOOT}" ]; then
-		ovmf_code=${OVMF_CODE:-./build/tmp/deploy/images/qemu-amd64/OVMF/OVMF_CODE_4M.secboot.fd}
-		ovmf_vars=${OVMF_VARS:-./build/tmp/deploy/images/qemu-amd64/OVMF/OVMF_VARS_4M.snakeoil.fd}
-
-		${QEMU_PATH}${QEMU} \
-			-global ICH9-LPC.disable_s3=1 \
-			-global isa-fdc.driveA= \
-			-drive if=pflash,format=raw,unit=0,readonly=on,file=${ovmf_code} \
-			-drive if=pflash,format=raw,file=${ovmf_vars} \
-			-drive file=${IMAGE_PREFIX}.wic.img,discard=unmap,if=none,id=disk,format=raw \
-			${QEMU_COMMON_OPTIONS} "$@"
-
-elif [ -n "${SWUPDATE_BOOT}" ]; then
-		ovmf_code=${OVMF_CODE:-./build/tmp/deploy/images/qemu-amd64/OVMF/OVMF_CODE_4M.fd}
-
-		${QEMU_PATH}${QEMU} \
-			-drive file=${IMAGE_PREFIX}.wic.img,discard=unmap,if=none,id=disk,format=raw \
-			-drive if=pflash,format=raw,unit=0,readonly=on,file=${ovmf_code} \
-			${QEMU_COMMON_OPTIONS} "$@"
-
+if [ -n "${SECURE_BOOT}${SWUPDATE_BOOT}" ]; then
+	case "${arch}" in
+		x86|x86_64|amd64)
+			if [ -n "${SECURE_BOOT}" ]; then
+				ovmf_code=${OVMF_CODE:-./build/tmp/deploy/images/qemu-amd64/OVMF/OVMF_CODE_4M.secboot.fd}
+				ovmf_vars=${OVMF_VARS:-./build/tmp/deploy/images/qemu-amd64/OVMF/OVMF_VARS_4M.snakeoil.fd}
+
+				${QEMU_PATH}${QEMU} \
+					-global ICH9-LPC.disable_s3=1 \
+					-global isa-fdc.driveA= \
+					-drive if=pflash,format=raw,unit=0,readonly=on,file=${ovmf_code} \
+					-drive if=pflash,format=raw,file=${ovmf_vars} \
+					-drive file=${IMAGE_PREFIX}.wic.img,discard=unmap,if=none,id=disk,format=raw \
+					${QEMU_COMMON_OPTIONS} "$@"
+			else
+				ovmf_code=${OVMF_CODE:-./build/tmp/deploy/images/qemu-amd64/OVMF/OVMF_CODE_4M.fd}
+
+				${QEMU_PATH}${QEMU} \
+					-drive file=${IMAGE_PREFIX}.wic.img,discard=unmap,if=none,id=disk,format=raw \
+					-drive if=pflash,format=raw,unit=0,readonly=on,file=${ovmf_code} \
+					${QEMU_COMMON_OPTIONS} "$@"
+			fi
+			;;
+		arm64|aarch64)
+			u_boot_bin=${FIRMWARE_BIN:-./build/tmp/deploy/images/qemu-arm64/firmware.bin}
+
+			${QEMU_PATH}${QEMU} \
+				-drive file=${IMAGE_PREFIX}.wic.img,discard=unmap,if=none,id=disk,format=raw \
+				-bios ${u_boot_bin} \
+				${QEMU_COMMON_OPTIONS} "$@"
+			;;
+		*)
+			echo "Unsupported architecture: ${arch}"
+			exit 1
+			;;
+	esac
 else
 		IMAGE_FILE=$(ls ${IMAGE_PREFIX}.ext4.img)