Switch x86_64 to use Discoverable Disk Images (DDIs)

board/common/Config.in

@@ -1,5 +1,12 @@
+
 menu "Images"
 
+comment "DDI Based"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-ddi/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-ddi-disk/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-ddi-rauc/Config.in"
+
+comment "ITB Based"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rootfs/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-aux/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-boot/Config.in"
@@ -8,10 +15,36 @@ source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-gns3a/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rauc/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-ext4-rauc/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-dl-release/Config.in"
+
+comment "General"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-barebox-esp/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-lvm-stub/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-readme/Config.in"
 
 endmenu
 
+
+menuconfig IX_KERNEL_SIGN
+	bool "Sign Linux Kernel"
+	default y if BR2_x86_64
+
+config IX_KERNEL_SIGN_KEY
+	string "signing key"
+	depends on IX_KERNEL_SIGN
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
+	help
+	  Path to the private RSA key, in PKCS#8 format, used to sign
+	  the kernel image.
+
+config IX_KERNEL_SIGN_CERT
+	string "signing cert"
+	depends on IX_KERNEL_SIGN
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
+	help
+	  Path to the X509 certificate whose associated public key can
+	  validate the authenticity of the generated signature.
+
+
 config IX_QEMU_SCRIPTS
 	bool "QEMU scripts"
 	default y

board/common/barebox/barebox.mk

@@ -0,0 +1,13 @@
+ifeq ($(IX_IMAGE_BAREBOX_ESP),y)
+
+IX_BAREBOX_DIR   := $(BR2_EXTERNAL_INFIX_PATH)/board/common/barebox
+IX_BAREBOX_BUILD := $(BUILD_DIR)/infix-bareboxenv
+
+define BAREBOX_PRE_BUILD_CREATE_ENV
+	@$(call IXMSG,"Creating Barebox environment")
+	rsync -a $(IX_BAREBOX_DIR)/env/ $(IX_BAREBOX_BUILD)
+	dtc <$(IX_BAREBOX_DIR)/state.dts >$(IX_BAREBOX_BUILD)/state.dtb
+endef
+BAREBOX_PRE_BUILD_HOOKS += BAREBOX_PRE_BUILD_CREATE_ENV
+
+endif

board/common/barebox/env/boot/net

@@ -0,0 +1,24 @@
+#!/bin/sh
+
+if dhcp $1; then
+    if [ -z "${global.dhcp.bootfile}" ]; then
+	echo "net: ERROR: DHCP did not supply a bootfile"
+	exit 1
+    fi
+else
+    echo "net: ERROR: DHCP Failed"
+    exit 1
+fi
+
+echo "net: Downloading ${global.dhcp.bootfile}..."
+if tftp ${global.dhcp.bootfile} /initrd; then
+else
+    echo "net: ERROR: Download failed"
+    exit 1
+fi
+
+global bootm.initrd=/initrd
+dmsetup loop initrd /initrd && boot /dev/initrd
+
+echo "net: ERROR: Unable to boot from ${global.dhcp.bootfile}"
+exit 1

board/common/barebox/env/init/infix

@@ -0,0 +1,20 @@
+#!/bin/sh
+
+global allow_color=1
+global model=efi
+export PS1="\e[1;32mbarebox@\h\e[0m:\e[1;36m\w\e[0m# "
+
+global autoboot_timeout=1
+global boot.default="bootchooser storage"
+global bootchooser.reset_attempts="all-zero"
+global bootchooser.retry=1
+global bootchooser.state_prefix="state.bootstate"
+global bootchooser.targets="internal-primary internal-secondary net"
+
+global blspec.require_trust=${efi.secure_mode}
+global ddi.require_trust=${efi.secure_mode}
+
+keys -l os @efi
+
+lvm activate
+

board/common/barebox/env/menu/mainmenu

@@ -0,0 +1,4 @@
+#!/bin/sh
+
+boot -m
+reset

board/common/barebox/state.dts

@@ -0,0 +1,79 @@
+/dts-v1/;
+
+/ {
+	aliases {
+		state = &state;
+	};
+
+	partitions {
+		compatible = "fixed-partitions";
+
+		statepart: state {
+			partuuid = "80ca5554-c020-11f1-ba4d-b3c49d5dbf47";
+		};
+	};
+
+	state: state {
+		compatible = "barebox,state";
+		magic = <0x80ca5554>;
+		backend-type = "raw";
+		backend = <&statepart>;
+		backend-stridesize = <0x200>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		bootstate {
+			internal-primary {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				remaining_attempts@0 {
+					reg = <0x0 0x4>;
+					type = "uint32";
+					default = <3>;
+				};
+				priority@4 {
+					reg = <0x4 0x4>;
+					type = "uint32";
+					default = <20>;
+				};
+			};
+
+			internal-secondary {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				remaining_attempts@8 {
+					reg = <0x8 0x4>;
+					type = "uint32";
+					default = <3>;
+				};
+				priority@c {
+					reg = <0xc 0x4>;
+					type = "uint32";
+					default = <10>;
+				};
+			};
+
+			net {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				remaining_attempts@10 {
+					reg = <0x10 0x4>;
+					type = "uint32";
+					default = <3>;
+				};
+				priority@14 {
+					reg = <0x14 0x4>;
+					type = "uint32";
+					default = <0>;
+				};
+			};
+
+			last_chosen@18 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				reg = <0x18 0x4>;
+				type = "uint32";
+			};
+		};
+	};
+};

board/common/common.mk

@@ -1,6 +1,20 @@
+include $(BR2_EXTERNAL_INFIX_PATH)/board/common/barebox/barebox.mk
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/image/image.mk
+include $(BR2_EXTERNAL_INFIX_PATH)/board/common/initramfs/initramfs.mk
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/qemu/qemu.mk
 
+ifeq ($(IX_KERNEL_SIGN),y)
+define LINUX_POST_BUILD_SIGN
+	@$(call IXMSG,"Signing $(notdir $(LINUX_IMAGE_PATH))")
+	sbsign \
+	    --key    "$(IX_KERNEL_SIGN_KEY)" \
+	    --cert   "$(IX_KERNEL_SIGN_CERT)" \
+	    --output "$(LINUX_IMAGE_PATH)" \
+	    "$(LINUX_IMAGE_PATH)"
+endef
+LINUX_POST_BUILD_HOOKS += LINUX_POST_BUILD_SIGN
+endif
+
 ifeq ($(IX_TRUSTED_KEYS),y)
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/uboot.mk
 

board/common/image/image-barebox-esp/Config.in

@@ -0,0 +1,23 @@
+menuconfig IX_IMAGE_BAREBOX_ESP
+	bool "Barebox EFI System Partition"
+	depends on BR2_TARGET_BAREBOX
+	select BR2_PACKAGE_DT_UTILS
+	help
+	  An EFI System Partition (ESP) with Barebox installed.
+
+config IX_IMAGE_BAREBOX_ESP_KEY
+	string "signing key"
+	depends on IX_IMAGE_BAREBOX_ESP
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
+	help
+	  Path to the private RSA key, in PKCS#8 format, used to sign
+	  the Barebox EFI payload.
+
+config IX_IMAGE_BAREBOX_ESP_CERT
+	string "signing cert"
+	depends on IX_IMAGE_BAREBOX_ESP
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
+	help
+	  Path to the X509 certificate whose associated public key can
+	  validate the authenticity of the generated signature.
+

board/common/image/image-barebox-esp/generate.sh

@@ -0,0 +1,44 @@
+#!/bin/sh
+
+set -e
+
+case "$BR2_ARCH" in
+    x86_64)
+	BOOT_EFI=BOOTX64.EFI
+	;;
+    *)
+	echo "Unknown EFI boot path for $BR2_ARCH" >&2
+	exit 1
+	;;
+esac
+
+mkdir -p "${WORKDIR}"/root
+rm -rf   "${WORKDIR}"/tmp
+mkdir -p "${WORKDIR}"/tmp
+
+sbsign \
+    --key    "${KEY}" \
+    --cert   "${CERT}" \
+    --output "${BINARIES_DIR}"/barebox.efi.signed \
+    "${BINARIES_DIR}"/barebox.efi
+
+cat <<EOF >"${WORKDIR}"/genimage.cfg
+image barebox-esp.vfat {
+	size = "16M"
+	vfat {
+		file EFI/BOOT/$BOOT_EFI {
+			image = $BINARIES_DIR/barebox.efi.signed
+		}
+	}
+}
+
+# Silence genimage warnings
+config {}
+EOF
+
+genimage \
+    --tmppath    "${WORKDIR}"/tmp  \
+    --rootpath   "${WORKDIR}"/root \
+    --inputpath  "${WORKDIR}"      \
+    --outputpath "${BINARIES_DIR}" \
+    --config "${WORKDIR}"/genimage.cfg

board/common/image/image-barebox-esp/image-barebox-esp.mk

@@ -0,0 +1,9 @@
+################################################################################
+#
+# image-barebox-esp
+#
+################################################################################
+
+IMAGE_BAREBOX_ESP_CONFIG_VARS := KEY CERT
+
+$(eval $(ix-image))

board/common/image/image-ddi-disk/Config.in

@@ -0,0 +1,8 @@
+menuconfig IX_IMAGE_DDI_DISK
+	bool "LVM2 based provisioning disk (DDI)"
+	depends on IX_IMAGE_DDI
+	select IX_IMAGE_BAREBOX_ESP
+	help
+	  Compose a full disk image consisting of an EFI System
+	  Partition (ESP) containing Barebox, and an LVM PV in which
+	  Infix is installed as an LV.

board/common/image/image-ddi-disk/generate.sh

@@ -0,0 +1,69 @@
+#!/bin/sh
+
+set -e
+
+
+mkdir -p "${WORKDIR}"/root
+rm -rf   "${WORKDIR}"/tmp
+mkdir -p "${WORKDIR}"/tmp
+
+"${BR2_EXTERNAL_INFIX_PATH}"/utils/lvm-mkinternal \
+	primary "${BINARIES_DIR}"/"${ARTIFACT}".raw >"${WORKDIR}"/internal.lvm
+
+. $BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/etc/partition-uuid
+[ -n "${BAREBOX_STATE_UUID}" ]
+[ -n "${ESP_UUID}" ]
+[ -n "${ESP_BACKUP_UUID}" ]
+
+cat <<EOF >"${WORKDIR}"/genimage.cfg
+
+image ${ARTIFACT}.disk {
+	hdimage {
+		partition-table-type = "gpt"
+	}
+
+	partition esp {
+		partition-type-uuid = "esp"
+		partition-uuid = "$ESP_UUID"
+		image = "$BINARIES_DIR/barebox-esp.vfat"
+	}
+
+	partition esp-backup {
+		partition-type-uuid = "esp"
+		partition-uuid = "$ESP_BACKUP_UUID"
+		image = "$BINARIES_DIR/barebox-esp.vfat"
+	}
+
+	partition barebox-state {
+		partition-type-uuid = "barebox-state"
+		partition-uuid = "$BAREBOX_STATE_UUID"
+		size = 2048
+	}
+
+	partition internal {
+		growfs = "true"
+		partition-type-uuid = "lvm"
+		image = "internal.lvm"
+	}
+}
+
+image ${ARTIFACT}.qcow2 {
+	qemu {
+		format = "qcow2"
+	}
+
+	partition disk {
+		image = "${ARTIFACT}.disk"
+	}
+}
+
+# Silence genimage warnings
+config {}
+EOF
+
+genimage \
+    --tmppath    "${WORKDIR}"/tmp  \
+    --rootpath   "${WORKDIR}"/root \
+    --inputpath  "${WORKDIR}"      \
+    --outputpath "${BINARIES_DIR}" \
+    --config "${WORKDIR}"/genimage.cfg

board/common/image/image-ddi-disk/image-ddi-disk.mk

@@ -0,0 +1,9 @@
+################################################################################
+#
+# image-ddi-disk
+#
+################################################################################
+
+IMAGE_DDI_DISK_DEPENDENCIES := image-barebox-esp image-ddi
+
+$(eval $(ix-image))