Build-time secure-boot signing of Qualcomm firmware

[Igor Opaniuk (igoropaniuk)]

This PR adds a build-time secure-boot signing pipeline for Qualcomm firmware. It introduces two -native recipes - sectools-native, security-profiles-native, and - together with a qcom-firmware-sign.bbclass that any recipe can inherit to sign its deploy artefacts before they ship. It also generates VIP tables using QDL, so the final package is ready to be flashed with QDL to the secured device with VIP engaged.

A development ECDSA test-key set and a ci/secure-boot.yml kas overlay are included so a fresh checkout can exercise the full pipeline end-to-end without sourcing OEM signing material.

To test this build:

kas build ci/base.yml:ci/<machine>.yml:ci/secure-boot.yml:ci/ecdsa-secure-boot-test-keys.yml

[Igor Opaniuk (igoropaniuk)]

This is based on the original #2598 + comments addressed

[Ricardo Salveti (ricardosalveti)]

Also need a CI entry so we can build with the new kas files.

[github-actions]

Test run workflow

Test jobs for commit 2073d47

qcom-distro_linux-qcom-6.18
Pass: 228 | Fail: 5 | Total: 253

nodistro
Pass: 10 | Fail: 0 | Total: 10

qcom-distro
Pass: 11 | Fail: 1 | Total: 12

[test-reporting-app]

Test Results

   66 files    311 suites   4h 35m 8s ⏱️
  171 tests   160 ✅  1 💤 10 ❌
2 052 runs  2 015 ✅ 20 💤 17 ❌

For more details on these failures, see this check.

Results for commit 2073d47.

♻️ This comment has been updated with latest results.

[qcomlnxci]

Test Coral run workflow

Test jobs for commit ee5c01a

• qcomdistro: multimedia image-prop
  Pass: 33 | Fail: 2 | Others: 5 | Total: 40
• qcomdistro: multimedia image
  Pass: 9 | Fail: 0 | Total: 9

[Ricardo Salveti (ricardosalveti)]

We should also hash the content of the keys, in keys they are modified by the user, something like:

 #   sha384_roots_hash.txt   -- root hash for verification
 # Tests use ci/test-keys/ecdsa via ci/ecdsa-secure-boot-test-keys.yml.
 QCOM_FIRMWARE_SIGN_KEY_DIR ?= ""
+QCOM_FIRMWARE_SIGN_KEY_FILES ?= "\
+    qpsa_rootca0.cer \
+    qpsa_attestca0.cer \
+    qpsa_attestca0.key \
+    sha384_roots_hash.txt \
+"

 # Fuse identifiers, passed through to consumers / signing wrappers.
 QCOM_FUSE_OEM_HW_ID                  ?= ""
@@ -68,7 +74,7 @@ qcom_check_signing_enabled() {
     if [ ! -d "${QCOM_FIRMWARE_SIGN_KEY_DIR}" ]; then
         bbfatal "QCOM_FIRMWARE_SIGN_KEY_DIR ('${QCOM_FIRMWARE_SIGN_KEY_DIR}') is not a directory."
     fi
-    for f in qpsa_rootca0.cer qpsa_attestca0.cer qpsa_attestca0.key sha384_roots_hash.txt; do
+    for f in ${QCOM_FIRMWARE_SIGN_KEY_FILES}; do
         if [ ! -f "${QCOM_FIRMWARE_SIGN_KEY_DIR}/${f}" ]; then
             bbfatal "Required key file missing: ${QCOM_FIRMWARE_SIGN_KEY_DIR}/${f}"
         fi
@@ -236,4 +242,14 @@ python () {
                      'do_deploy do_package do_populate_sysroot', 'do_install', d)
     d.setVarFlag('do_qcom_firmware_sign', 'fakeroot', '1')
     d.appendVarFlag('do_qcom_firmware_sign', 'depends', ' virtual/fakeroot-native:do_populate_sysroot')
+
+    # The task hash has to follow the key material itself, not just the
+    # path to it: keys rotated in place under an unchanged
+    # QCOM_FIRMWARE_SIGN_KEY_DIR would otherwise leave the previously
+    # signed images valid in sstate.
+    keydir = d.getVar('QCOM_FIRMWARE_SIGN_KEY_DIR')
+    if keydir:
+        keyfiles = d.getVar('QCOM_FIRMWARE_SIGN_KEY_FILES').split()
+        d.appendVarFlag('do_qcom_firmware_sign', 'file-checksums',
+                        ' ' + ' '.join('%s/%s:True' % (keydir, f) for f in keyfiles))
 }

[qcomlnxci]

Test Coral run workflow

Test jobs for commit d5751ae

• qcomdistro: multimedia image-prop
  Pass: 41 | Fail: 0 | Total: 41
• qcomdistro: multimedia image
  Pass: 9 | Fail: 0 | Total: 9

[Igor Opaniuk (igoropaniuk)]

Test fails are unrelated to these changes, seems they are board/lab flakes (sm8750/qcs8300/iq-9075 LAVA jobs)

[qcomlnxci]

Test Coral run workflow

Test jobs for commit 510cff2

• qcomdistro: multimedia image-prop
  Pass: 33 | Fail: 1 | Others: 4 | Total: 38
• qcomdistro: multimedia image
  Pass: 7 | Fail: 0 | Others: 4 | Total: 11

[qcomlnxci]

Test Coral run workflow

Test jobs for commit 510cff2

• qcomdistro: multimedia image
  Pass: 7 | Fail: 0 | Others: 4 | Total: 11
• qcomdistro: multimedia image-prop
  Pass: 26 | Fail: 1 | Others: 10 | Total: 37

[qcomlnxci]

Test Coral run workflow

Test jobs for commit 510cff2

• qcomdistro: multimedia image-prop
  Pass: 35 | Fail: 1 | Total: 36
• qcomdistro: multimedia image
  Pass: 9 | Fail: 0 | Total: 9

[qcomlnxci]

Test Coral run workflow

Test jobs for commit 510cff2

• qcomdistro: multimedia image-prop
  Pass: 34 | Fail: 2 | Total: 36
• qcomdistro: multimedia image
  Pass: 9 | Fail: 0 | Total: 9

[Igor Opaniuk (igoropaniuk)]

Jose Quaresma (@quaresmajose) addressed you comments, thanks!

[qcomlnxci]

Test Coral run workflow

Test jobs for commit f7d5c86

• qcomdistro: multimedia image
  Pass: 6 | Fail: 3 | Total: 9
• qcomdistro: multimedia image-prop
  Pass: 27 | Fail: 2 | Others: 3 | Total: 32

[qcomlnxci]

Test Coral run workflow

Test jobs for commit 0558c45

• qcomdistro: multimedia image
  Pass: 7 | Fail: 2 | Total: 9
• qcomdistro: multimedia image-prop
  Pass: 27 | Fail: 2 | Others: 3 | Total: 32

[qcomlnxci]

Test Coral run workflow

Test jobs for commit 2073d47

• qcomdistro: multimedia image
  Pass: 4 | Fail: 0 | Total: 4
• qcomdistro: multimedia image-prop
  Pass: 19 | Fail: 0 | Others: 3 | Total: 22

[Ricardo Salveti (ricardosalveti)]

This ln -rsf now runs after create_symlinks (image.bbclass prepends it to every do_image_* postfunc list), so the link already exists and points at a directory. Without -n, ln follows it and creates <IMAGE_NAME>.qcomflash -> . inside the bundle, which then ends up in the tarball (confirmed on a local rb3gen2 build). create_symlinks already creates the same link, so just drop this line.