From e457214351396ef062df4c1ff50053100de9ea4a Mon Sep 17 00:00:00 2001 From: Mohamed-nour Toumi Date: Thu, 7 May 2026 14:09:46 +0200 Subject: [PATCH] profiles: extract secure eMMC boot config into shared profile Create profiles/secure_boot_emmc.yml as a common base for secure eMMC boot with swupdate A/B partitioning, consolidating duplicated config from mxl_x86_osp_tb341_v2 and qca_ipq95xx. Moved to secure_boot_emmc.yml: - Packages: swupdate, libubootenv, imagegenerator, initramfs-generator, readmfg, libfdt, fdt-utils, kmod-sysregister - Diffconfig: secure initramfs, swupdate handlers (ext4/diskpart/diskformat), imagegenerator, MFG global signature, kernel keyring, sysregister bootcount Also remove unused packages from shared profiles: - prpl_core: drop keyctl, keyutils, kmod-sysregister - prpl: drop lvm2 Closes: PCF-2097 Fixes: PCF-1875, PCF-1878 Tracked-by: FEAT-29 Signed-off-by: Mohamed-nour Toumi --- profiles/mxl_x86_osp_tb341_v2.yml | 44 +++---------------------------- profiles/prpl.yml | 1 - profiles/prpl_core.yml | 6 ----- profiles/qca_ipq95xx.yml | 42 +++-------------------------- profiles/secure_boot_emmc.yml | 43 ++++++++++++++++++++++++++++++ 5 files changed, 50 insertions(+), 86 deletions(-) create mode 100644 profiles/secure_boot_emmc.yml diff --git a/profiles/mxl_x86_osp_tb341_v2.yml b/profiles/mxl_x86_osp_tb341_v2.yml index 16eda7dc42..76e23e53f9 100644 --- a/profiles/mxl_x86_osp_tb341_v2.yml +++ b/profiles/mxl_x86_osp_tb341_v2.yml @@ -9,6 +9,10 @@ description: Build images for the Maxlinear x86 devices - OSP TB341 v2 git.maxlinear.com. For reference boards, source code access and reporting issues, please check https://gitlab.com/prpl-foundation/prplos/prplos/-/wikis/MaxLinear-Open-Service-Platform + +include: + - secure_boot_emmc + feeds: - name: intel_x86 uri: https://github.com/maxlinear/feed_target_x86.git @@ -177,19 +181,6 @@ packages: - kmod-mcast-helper - mod-wanmgr-system-ospv2 - conntrack - - swupdate - - libubootenv - - libblkid - - libuuid - - libext2fs - - libfdisk - - imagegenerator - - initramfs-generator - - blkid - - libfdt - - fdt-utils - - kmod-dm - - losetup diffconfig: | CONFIG_DEVEL=y @@ -218,32 +209,5 @@ diffconfig: | CONFIG_LGM_EIP123_SUPPORT=y CONFIG_KERNEL_FTRACE=y CONFIG_IMAGEGENERATOR_BOARD="tb341_wav700" - CONFIG_OPENSOURCE_SWUPDATE_EXT_FILESYSTEM=y - CONFIG_OPENSOURCE_SWUPDATE_DISKPART_HANDLER=y - CONFIG_OPENSOURCE_SWUPDATE_DISKFORMAT_HANDLER=y - CONFIG_SAH_LIB_MFG_RO_PART_FILE="/dev/mmc0p13" - CONFIG_BUSYBOX_CONFIG_BLKID=y - CONFIG_BUSYBOX_CONFIG_BLOCKDEV=y - CONFIG_PACKAGE_libblkid=y - CONFIG_BUSYBOX_CONFIG_MODPROBE=y - CONFIG_EXTERNAL_CPIO="" - CONFIG_TARGET_SECURE_INITRAMFS=y - CONFIG_TARGET_SECURE_INITRAMFS_COMPRESSION_GZIP=y - CONFIG_INITRAMFS_GENERATOR_FLASH_TYPE_EMMC=y - CONFIG_INITRAMFS_GENERATOR_ROOTFS_SIG_PRELOAD=y - CONFIG_INITRAMFS_GENERATOR_ROOTFS_SIG_PRELOAD_MANDATORY=y - CONFIG_KERNEL_DEVTMPFS=y - # CONFIG_TARGET_ROOTFS_INITRAMFS is not set - CONFIG_BUSYBOX_CONFIG_LOSETUP=y - CONFIG_BUSYBOX_CONFIG_STAT=y - CONFIG_BUSYBOX_CONFIG_FEATURE_STAT_FORMAT=y - CONFIG_BUSYBOX_CONFIG_FEATURE_STAT_FILESYSTEM=y CONFIG_SAH_LIB_MFG_RO_PART_FILE="/dev/mmcblk0p13" - CONFIG_IMAGEGENERATOR=y - CONFIG_SAH_LIB_MFG_GLOBAL_SIGNATURE=y - CONFIG_SAH_LIB_MFG_GLOBAL_SIGNATURE_PUBLIC_PEM_FILE="/security/smd_pub.pem" - CONFIG_SAH_LIB_MFG_SECURE_MFG_KERNEL_KEYRING_SUPPORT=y - CONFIG_SAH_LIB_MFG_SECURE_MFG_KERNEL_KEYRING_KEY_NAME="mfg:Kuk" - CONFIG_SAH_LIB_MFG_SECURE_MFG_KERNEL_KEYRING_IV_FILE="/rom/security/initramfs/Kuk-aes-iv.hex" - CONFIG_SYSREGISTER_RESET_BOOTCOUNT=y CONFIG_SECURESTORE_LABEL="config" diff --git a/profiles/prpl.yml b/profiles/prpl.yml index 09b38dd482..b8a17f012a 100644 --- a/profiles/prpl.yml +++ b/profiles/prpl.yml @@ -9,7 +9,6 @@ include: additional_packages: - feed: packages packages: - - lvm2 - opensc - pciids - pciutils diff --git a/profiles/prpl_core.yml b/profiles/prpl_core.yml index e77937d194..5bc5ea179a 100644 --- a/profiles/prpl_core.yml +++ b/profiles/prpl_core.yml @@ -32,10 +32,6 @@ packages: - ip6tables-zz-legacy - iptables-mod-ipopt - iptables-zz-legacy - - keyctl - - keyutils - - kmod-crypto-user - - kmod-keys-encrypted - libdhcpoptions - libfwinterface - libfwrules @@ -82,7 +78,6 @@ packages: - prplmesh - prplmesh-dm-mapper - prplmesh-process-manager - - readmfg - reboot-service - routing-manager - ssh-server @@ -109,7 +104,6 @@ packages: - wifi-sensing - mod-scheduler-amxp - tr181-schedules - - kmod-sysregister diffconfig: | CONFIG_DEVEL=y diff --git a/profiles/qca_ipq95xx.yml b/profiles/qca_ipq95xx.yml index a8440de6ea..7a99d57a70 100644 --- a/profiles/qca_ipq95xx.yml +++ b/profiles/qca_ipq95xx.yml @@ -10,6 +10,9 @@ feeds: uri: https://gitlab.com/prpl-foundation/prplOS/feed-qca.git revision: latest-24.10/ath13.1@659a90103eefa5d52942e7735a48088e7cc910c1 +include: + - secure_boot_emmc + packages: - ipq95xx - wireless-regdb @@ -50,19 +53,6 @@ packages: - kmod-qca-wifi-nss-plugins - wifi-scripts - wifi-helper-scripts - - swupdate - - libubootenv - - imagegenerator - - initramfs-generator - - libblkid - - libuuid - - libcomerr - - libext2fs - - libfdisk - - blkid - - libfdt - - fdt-utils - - kmod-dm diffconfig: | CONFIG_BUSYBOX_CUSTOM=y @@ -74,31 +64,5 @@ diffconfig: | CONFIG_PACKAGE_libnl-ppe=y CONFIG_PACKAGE_kmod-qseecom=m CONFIG_BUSYBOX_CONFIG_DEVMEM=y - CONFIG_EXTERNAL_CPIO="" - CONFIG_TARGET_SECURE_INITRAMFS=y - CONFIG_TARGET_SECURE_INITRAMFS_COMPRESSION_GZIP=y - CONFIG_INITRAMFS_GENERATOR_FLASH_TYPE_EMMC=y - CONFIG_INITRAMFS_GENERATOR_ROOTFS_SIG_PRELOAD=y - CONFIG_INITRAMFS_GENERATOR_ROOTFS_SIG_PRELOAD_MANDATORY=y CONFIG_IMAGEGENERATOR_BOARD="qca_ipq95xx_freedom" - CONFIG_OPENSOURCE_SWUPDATE_EXT_FILESYSTEM=y - CONFIG_OPENSOURCE_SWUPDATE_DISKPART_HANDLER=y - CONFIG_OPENSOURCE_SWUPDATE_DISKFORMAT_HANDLER=y - CONFIG_BUSYBOX_CONFIG_BLKID=y - CONFIG_BUSYBOX_CONFIG_BLOCKDEV=y - CONFIG_INITRAMFS_GENERATOR_ROOTFS_SIG_PRELOAD=y - CONFIG_BUSYBOX_CONFIG_MODPROBE=y - CONFIG_KERNEL_DEVTMPFS=y - # CONFIG_TARGET_ROOTFS_INITRAMFS is not set - CONFIG_BUSYBOX_CONFIG_LOSETUP=y - CONFIG_BUSYBOX_CONFIG_STAT=y - BUSYBOX_CONFIG_FEATURE_STAT_FORMAT=y - BUSYBOX_CONFIG_FEATURE_STAT_FILESYSTEM=y CONFIG_SAH_LIB_MFG_RO_PART_FILE="/dev/mmcblk0p30" - CONFIG_IMAGEGENERATOR=y - CONFIG_SAH_LIB_MFG_GLOBAL_SIGNATURE=y - CONFIG_SAH_LIB_MFG_GLOBAL_SIGNATURE_PUBLIC_PEM_FILE="/security/smd_pub.pem" - CONFIG_SAH_LIB_MFG_SECURE_MFG_KERNEL_KEYRING_SUPPORT=y - CONFIG_SAH_LIB_MFG_SECURE_MFG_KERNEL_KEYRING_KEY_NAME="mfg:Kuk" - CONFIG_SAH_LIB_MFG_SECURE_MFG_KERNEL_KEYRING_IV_FILE="/rom/security/initramfs/Kuk-aes-iv.hex" - CONFIG_SYSREGISTER_RESET_BOOTCOUNT=y diff --git a/profiles/secure_boot_emmc.yml b/profiles/secure_boot_emmc.yml new file mode 100644 index 0000000000..87856c8e2b --- /dev/null +++ b/profiles/secure_boot_emmc.yml @@ -0,0 +1,43 @@ +--- +description: Common configuration for secure eMMC boot with swupdate A/B partitioning + +packages: + - fdt-utils + - imagegenerator + - initramfs-generator + - kmod-crypto-user + - kmod-keys-encrypted + - kmod-sysregister + - libfdt + - libubootenv + - losetup + - readmfg + - swupdate + +diffconfig: | + CONFIG_EXTERNAL_CPIO="" + CONFIG_TARGET_SECURE_INITRAMFS=y + CONFIG_TARGET_SECURE_INITRAMFS_COMPRESSION_GZIP=y + CONFIG_INITRAMFS_GENERATOR_FLASH_TYPE_EMMC=y + CONFIG_INITRAMFS_GENERATOR_ROOTFS_SIG_PRELOAD=y + CONFIG_INITRAMFS_GENERATOR_ROOTFS_SIG_PRELOAD_MANDATORY=y + CONFIG_OPENSOURCE_SWUPDATE_EXT_FILESYSTEM=y + CONFIG_OPENSOURCE_SWUPDATE_DISKPART_HANDLER=y + CONFIG_OPENSOURCE_SWUPDATE_DISKFORMAT_HANDLER=y + CONFIG_BUSYBOX_CONFIG_BLKID=y + CONFIG_BUSYBOX_CONFIG_BLOCKDEV=y + CONFIG_BUSYBOX_CONFIG_LOSETUP=y + CONFIG_BUSYBOX_CONFIG_MODPROBE=y + CONFIG_BUSYBOX_CONFIG_STAT=y + CONFIG_BUSYBOX_CONFIG_FEATURE_STAT_FORMAT=y + CONFIG_BUSYBOX_CONFIG_FEATURE_STAT_FILESYSTEM=y + CONFIG_KERNEL_DEVTMPFS=y + # CONFIG_TARGET_ROOTFS_INITRAMFS is not set + CONFIG_IMAGEGENERATOR=y + CONFIG_SAH_LIB_MFG_GLOBAL_SIGNATURE=y + CONFIG_SAH_LIB_MFG_GLOBAL_SIGNATURE_PUBLIC_PEM_FILE="/security/smd_pub.pem" + CONFIG_SAH_LIB_MFG_SECURE_MFG_KERNEL_KEYRING_SUPPORT=y + CONFIG_SAH_LIB_MFG_SECURE_MFG_KERNEL_KEYRING_KEY_NAME="mfg:Kuk" + CONFIG_SAH_LIB_MFG_SECURE_MFG_KERNEL_KEYRING_IV_FILE="/rom/security/initramfs/Kuk-aes-iv.hex" + CONFIG_SYSREGISTER_RESET_BOOTCOUNT=y + CONFIG_SAH_AMX_PCM_SECURESTORE=y