4 files changed, 310 insertions, 0 deletions

diff --git a/classes/rmc-boot.bbclass b/classes/rmc-boot.bbclass
new file mode 100644
index 0000000..37c3e30
--- /dev/null
+++ b/classes/rmc-boot.bbclass
@@ -0,0 +1,17 @@
+# rmc-boot bbclass
+# Deploy central RMC database file to ESP
+
+IMAGE_INSTALL_append = " rmc"
+RMC_BOOTLOADER ?= "systemd-boot"
+
+inherit ${RMC_BOOTLOADER}
+
+do_bootimg[depends] += "${MLPREFIX}rmc-db:do_deploy"
+
+efi_populate_append() {
+        if [ -f ${DEPLOY_DIR_IMAGE}/rmc.db ]; then
+                install -m 0400 ${DEPLOY_DIR_IMAGE}/rmc.db ${DEST}/rmc.db
+        else
+                rm -f ${DEST}/rmc.db
+        fi
+}
diff --git a/classes/rmc-db.bbclass b/classes/rmc-db.bbclass
new file mode 100644
index 0000000..72594d6
--- /dev/null
+++ b/classes/rmc-db.bbclass
@@ -0,0 +1,92 @@
+# RMC database bbclass
+# provide functions to generate RMC database file on build host (native)
+
+DEPENDS += "rmc-native"
+
+# rmc_generate_db()
+# $1: a list of directories. Each directory holds directories for a group of
+# boards.
+# $2: path_name of rmc generates database file and records
+#
+# WARNING: content of directory of database file will be removed.
+#
+# Each board directory shall contain a fingerprint file (*.fp) at least, with
+# optional file blob(s) associated to the type of board. If a board directory
+# has no file blob, no record is created for that board.
+#
+# An example of two directories each of which contains two boards for RMC:
+# (All file and directory names are for illustration purpose.)
+#
+# dir_1/
+#     board_1/
+#         board_1_fingerprint.fp
+#         file_1.blob
+#     board_2/
+#         board_2.fp
+# dir_2/
+#     board_3/
+#         b3.fp
+#         file_1.blob
+#         file_2.conf
+#     board_4/
+#         board_foo.fp
+#         mylib.config
+#
+# To generate a RMC database "rmc.db" with data of all (actually 3) of boards in
+# a directory "deploy_dir":
+#
+# rmc_generate_db "dir_1 dir_2" "deploy_dir/rmc.db"
+#
+# The board_2 will be skipped. No record or any data for it is packed in
+# generated database because it only contains a fingerprint file.
+#
+
+rmc_generate_db () {
+        RMC_BOARD_DIRS=$1
+
+        if [ "$#" -ne 2 ]; then
+                echo "rmc_generate_db(): Wrong number of arguments: $#"
+                return 1
+        fi
+
+        RMC_DB_DIR=$(dirname "$2")
+        RMC_RECORDS=""
+
+        rm -rf ${RMC_DB_DIR}
+        mkdir -p ${RMC_DB_DIR}
+
+        # generate rmc database
+        for topdir in ${RMC_BOARD_DIRS}; do
+                # For all board dirs in a topdir:
+                CUR_BOARD_DIRS=$(find ${topdir}/* -type d)
+                for board_dir in ${CUR_BOARD_DIRS}; do
+                        CUR_FINGERPRINT=$(find ${board_dir}/ -name "*.fp")
+
+                        # disallow a board directory without any fingerprint file in it.
+                        if [ -z "${CUR_FINGERPRINT}" ]; then
+                                echo "Cannot find RMC fingerprint file in ${board_dir}"
+                                return 1
+                        fi
+
+                        CUR_FILES=$(find ${board_dir}/ -type f |grep -v '\.fp$' || true)
+
+                        # allow a directory only with fingerprint file. Developer may
+                        # check in fingerprint for future use.
+                        if [ -z "${CUR_FILES}" ]; then
+                                continue
+                        fi
+
+                        for fp in ${CUR_FINGERPRINT}; do
+                                fullname=$(basename ${fp})
+                                CUR_TAG="${fullname%.*}"
+                                CUR_RECORD=${RMC_DB_DIR}/${CUR_TAG}.rec
+                                rmc -R -f ${fp} -b ${CUR_FILES} -o ${CUR_RECORD}
+                                RMC_RECORDS="${RMC_RECORDS} ${CUR_RECORD}"
+                        done
+                done
+        done
+
+        if [ ! -z "${RMC_RECORDS}" ]; then
+                rmc -D ${RMC_RECORDS} -o "$2"
+        fi
+}
diff --git a/classes/uefi-comboapp.bbclass b/classes/uefi-comboapp.bbclass
new file mode 100644
index 0000000..5c3ca8c
--- /dev/null
+++ b/classes/uefi-comboapp.bbclass
@@ -0,0 +1,151 @@
+# This class brings a more generic version of the UEFI combo app from refkit to meta-intel.
+# It uses a combo file, containing kernel, initramfs and
+# command line, presented to the BIOS as UEFI application, by prepending
+# it with the efi stub obtained from systemd-boot.
+
+# Don't add syslinux or build an ISO
+PCBIOS_forcevariable = "0"
+NOISO_forcevariable  = "1"
+
+# image-live.bbclass will default INITRD_LIVE to the image INITRD_IMAGE creates.
+# We want behavior to be consistent whether or not "live" is in IMAGE_FSTYPES, so
+# we default INITRD_LIVE to the INITRD_IMAGE as well.
+INITRD_IMAGE ?= "core-image-minimal-initramfs"
+INITRD_LIVE ?= " ${@ ('${DEPLOY_DIR_IMAGE}/' + d.getVar('INITRD_IMAGE', expand=True) + '-${MACHINE}.cpio.gz') if d.getVar('INITRD_IMAGE', True) else ''}"
+
+do_uefiapp[depends] += " \
+                         intel-microcode:do_deploy \
+                         systemd-boot:do_deploy \
+                         virtual/kernel:do_deploy \
+                       "
+
+# INITRD_IMAGE is added to INITRD_LIVE, which we use to create our initrd, so depend on it if it is set
+do_uefiapp[depends] += "${@ '${INITRD_IMAGE}:do_image_complete' if d.getVar('INITRD_IMAGE') else ''}"
+
+# The image does without traditional bootloader.
+# In its place, instead, it uses a single UEFI executable binary, which is
+# composed by:
+#   - an UEFI stub
+#     The linux kernel can generate a UEFI stub, however the one from systemd-boot can fetch
+#     the command line from a separate section of the EFI application, avoiding the need to
+#     rebuild the kernel.
+#   - the kernel
+#   - an initramfs (optional)
+
+def create_uefiapp(d, uuid=None, app_suffix=''):
+    import glob, re
+    from subprocess import check_call
+
+    build_dir = d.getVar('B')
+    deploy_dir_image = d.getVar('DEPLOY_DIR_IMAGE')
+    image_link_name = d.getVar('IMAGE_LINK_NAME')
+
+    cmdline = '%s/cmdline.txt' % build_dir
+    linux = '%s/%s' % (deploy_dir_image, d.getVar('KERNEL_IMAGETYPE'))
+    initrd = '%s/initrd' % build_dir
+
+    stub_path = '%s/linux*.efi.stub' % deploy_dir_image
+    stub = glob.glob(stub_path)[0]
+    m = re.match(r"\S*(ia32|x64)(.efi)\S*", os.path.basename(stub))
+    app = "boot%s%s%s" % (m.group(1), app_suffix, m.group(2))
+    executable = '%s/%s.%s' % (deploy_dir_image, image_link_name, app)
+
+    if d.getVar('INITRD_LIVE'):
+        with open(initrd, 'wb') as dst:
+            for cpio in d.getVar('INITRD_LIVE').split():
+                with open(cpio, 'rb') as src:
+                    dst.write(src.read())
+        initrd_cmd = "--add-section .initrd=%s --change-section-vma .initrd=0x3000000 " % initrd
+    else:
+        initrd_cmd = ""
+
+    root = 'root=PARTUUID=%s' % uuid if uuid else ''
+
+    with open(cmdline, 'w') as f:
+        f.write('%s %s' % (d.getVar('APPEND'), root))
+
+    objcopy_cmd = ("objcopy "
+        "--add-section .cmdline=%s --change-section-vma .cmdline=0x30000 "
+        "--add-section .linux=%s --change-section-vma .linux=0x40000 "
+        "%s %s %s") % \
+        (cmdline, linux, initrd_cmd, stub, executable)
+
+    check_call(objcopy_cmd, shell=True)
+
+python create_uefiapps () {
+    # We must clean up anything that matches the expected output pattern, to ensure that
+    # the next steps do not accidentally use old files.
+    import glob
+    pattern = d.expand('${DEPLOY_DIR_IMAGE}/${IMAGE_LINK_NAME}.boot*.efi')
+    for old_efi in glob.glob(pattern):
+        os.unlink(old_efi)
+    uuid = d.getVar('DISK_SIGNATURE_UUID')
+    create_uefiapp(d, uuid=uuid)
+}
+
+# This is intentionally split into different parts. This way, derived
+# classes or images can extend the individual parts. We can also use
+# whatever language (shell script or Python) is more suitable.
+python do_uefiapp() {
+    bb.build.exec_func('create_uefiapps', d)
+}
+
+do_uefiapp[vardeps] += "APPEND DISK_SIGNATURE_UUID INITRD_LIVE KERNEL_IMAGETYPE IMAGE_LINK_NAME"
+
+uefiapp_deploy_at() {
+    dest=$1
+    for i in ${DEPLOY_DIR_IMAGE}/${IMAGE_LINK_NAME}.boot*.efi; do
+        target=`basename $i`
+        target=`echo $target | sed -e 's/${IMAGE_LINK_NAME}.//'`
+        cp  --preserve=timestamps -r $i $dest/$target
+    done
+}
+
+do_uefiapp_deploy() {
+    rm -rf ${IMAGE_ROOTFS}/boot/*
+    dest=${IMAGE_ROOTFS}/boot/EFI/BOOT
+    mkdir -p $dest
+    uefiapp_deploy_at $dest
+}
+
+do_uefiapp_deploy[depends] += "${PN}:do_uefiapp"
+
+
+# This decides when/how we add our tasks to the image
+python () {
+    image_fstypes = d.getVar('IMAGE_FSTYPES', True)
+    initramfs_fstypes = d.getVar('INITRAMFS_FSTYPES', True)
+
+    # Don't add any of these tasks to initramfs images
+    if initramfs_fstypes not in image_fstypes:
+        bb.build.addtask('uefiapp', 'do_image', 'do_rootfs', d)
+        bb.build.addtask('uefiapp_deploy', 'do_image', 'do_rootfs', d)
+}
+
+SIGN_AFTER ?= "do_uefiapp"
+SIGN_BEFORE ?= "do_uefiapp_deploy"
+SIGNING_DIR ?= "${DEPLOY_DIR_IMAGE}"
+SIGNING_BINARIES ?= "${IMAGE_LINK_NAME}.boot*.efi"
+inherit uefi-sign
+
+# Legacy hddimg support below this line
+efi_hddimg_populate() {
+    uefiapp_deploy_at "$1"
+}
+
+build_efi_cfg() {
+    # The command line is built into the combo app, so this is a null op
+    :
+}
+
+populate_kernel_append() {
+    # The kernel and initrd are built into the app, so we don't need these
+    if [ -f $dest/initrd ]; then
+        rm $dest/initrd
+    fi
+    if [ -f $dest/vmlinuz ]; then
+        rm $dest/vmlinuz
+    fi
+}
+
+IMAGE_FEATURES[validitems] += "secureboot"
diff --git a/classes/uefi-sign.bbclass b/classes/uefi-sign.bbclass
new file mode 100644
index 0000000..e8f203b
--- /dev/null
+++ b/classes/uefi-sign.bbclass
@@ -0,0 +1,50 @@
+# By default, sign all .efi binaries in ${B} after compiling and before deploying
+SIGNING_DIR ?= "${B}"
+SIGNING_BINARIES ?= "*.efi"
+SIGN_AFTER ?= "do_compile"
+SIGN_BEFORE ?= "do_deploy"
+
+python () {
+    import os
+    import hashlib
+
+    # Ensure that if the signing key or cert change, we rerun the uefiapp process
+    if bb.utils.contains('IMAGE_FEATURES', 'secureboot', True, False, d):
+        for varname in ('SECURE_BOOT_SIGNING_CERT', 'SECURE_BOOT_SIGNING_KEY'):
+            filename = d.getVar(varname)
+            if filename is None:
+                bb.fatal('%s is not set.' % varname)
+            if not os.path.isfile(filename):
+                bb.fatal('%s=%s is not a file.' % (varname, filename))
+            with open(filename, 'rb') as f:
+                data = f.read()
+            hash = hashlib.sha256(data).hexdigest()
+            d.setVar('%s_HASH' % varname, hash)
+
+            # Must reparse and thus rehash on file changes.
+            bb.parse.mark_dependency(d, filename)
+
+        bb.build.addtask('uefi_sign', d.getVar('SIGN_BEFORE'), d.getVar('SIGN_AFTER'), d)
+
+        # Original binary needs to be regenerated if the hash changes since we overwrite it
+        # SIGN_AFTER isn't necessarily when it gets generated, but its our best guess
+        d.appendVarFlag(d.getVar('SIGN_AFTER'), 'vardeps', 'SECURE_BOOT_SIGNING_CERT_HASH SECURE_BOOT_SIGNING_KEY_HASH')
+}
+
+do_uefi_sign() {
+    if [ -f ${SECURE_BOOT_SIGNING_KEY} ] && [ -f ${SECURE_BOOT_SIGNING_CERT} ]; then
+        for i in `find ${SIGNING_DIR}/ -name '${SIGNING_BINARIES}'`; do
+            sbsign --key ${SECURE_BOOT_SIGNING_KEY} --cert ${SECURE_BOOT_SIGNING_CERT} $i
+            sbverify --cert ${SECURE_BOOT_SIGNING_CERT} $i.signed
+            mv $i.signed $i
+        done
+    fi
+}
+
+do_uefi_sign[depends] += "sbsigntool-native:do_populate_sysroot"
+
+do_uefi_sign[vardeps] += "SECURE_BOOT_SIGNING_CERT_HASH \
+                          SECURE_BOOT_SIGNING_KEY_HASH  \
+                          SIGNING_BINARIES SIGNING_DIR  \
+                          SIGN_BEFORE SIGN_AFTER        \
+                         "