Re: [PATCH v3 6/7] initramfs: Add recipe for tee-supplicant hook

[Jan Kiszka <jan.kiszka@siemens.com>]

On 05.07.23 07:33, baocheng.su@siemens.com wrote:
> From: Baocheng Su <baocheng.su@siemens.com>
> 
> This adds the tee-supplicant hook so that the tee supplicant daemon is
> started at the initrd stage.
> 
> The tee-supplicant daemon is used to provide service to trust
> applications running in optee, for example to provide RPMB access
> service for StMM or fTPM TAs.
> 
> By running tee-supplicant at initrd stage, disk encryption based on fTPM
> is possible.
> 
> stm32mp15x is used to demo the building of this hook, so add a new ci
> target for the initramfs image of stm32mp15x.
> 
> Signed-off-by: Baocheng Su <baocheng.su@siemens.com>
> ---
>  .../images/stm32mp15x-initramfs.bb            | 14 ++++++++
>  .../files/tee-supplicant.hook                 | 33 +++++++++++++++++++
>  .../files/tee-supplicant.script               | 33 +++++++++++++++++++
>  .../initramfs-tee-supplicant-hook_0.1.bb      | 27 +++++++++++++++
>  testsuite/citest.py                           |  1 +
>  5 files changed, 108 insertions(+)
>  create mode 100644 meta-isar/recipes-initramfs/images/stm32mp15x-initramfs.bb
>  create mode 100644 meta/recipes-initramfs/initramfs-tee-supplicant-hook/files/tee-supplicant.hook
>  create mode 100644 meta/recipes-initramfs/initramfs-tee-supplicant-hook/files/tee-supplicant.script
>  create mode 100644 meta/recipes-initramfs/initramfs-tee-supplicant-hook/initramfs-tee-supplicant-hook_0.1.bb
> 
> diff --git a/meta-isar/recipes-initramfs/images/stm32mp15x-initramfs.bb b/meta-isar/recipes-initramfs/images/stm32mp15x-initramfs.bb
> new file mode 100644
> index 0000000..211c201
> --- /dev/null
> +++ b/meta-isar/recipes-initramfs/images/stm32mp15x-initramfs.bb
> @@ -0,0 +1,14 @@
> +#
> +# Copyright (c) Siemens AG, 2023
> +#
> +# Authors:
> +#  Su Bao Cheng <baocheng.su@siemens.com>
> +#
> +# SPDX-License-Identifier: MIT
> +#
> +
> +inherit initramfs
> +
> +INITRAMFS_INSTALL += " \
> +    initramfs-tee-supplicant-hook \
> +    "
> diff --git a/meta/recipes-initramfs/initramfs-tee-supplicant-hook/files/tee-supplicant.hook b/meta/recipes-initramfs/initramfs-tee-supplicant-hook/files/tee-supplicant.hook
> new file mode 100644
> index 0000000..0af277b
> --- /dev/null
> +++ b/meta/recipes-initramfs/initramfs-tee-supplicant-hook/files/tee-supplicant.hook
> @@ -0,0 +1,33 @@
> +#!/bin/sh
> +# Copyright (c) Siemens AG, 2023
> +#
> +# Authors:
> +#  Su Bao Cheng <baocheng.su@siemens.com>
> +#
> +# SPDX-License-Identifier: MIT
> +#
> +PREREQ=""
> +prereqs()
> +{
> +    echo "$PREREQ"
> +}
> +case $1 in
> +prereqs)
> +    prereqs
> +    exit 0
> +    ;;
> +esac
> +
> +. /usr/share/initramfs-tools/hook-functions
> +
> +hook_error() {
> +    echo "(ERROR): $2" >&2
> +    exit 1
> +}
> +
> +# For stock debian bookworm arm64 kernel, these two .ko exist, but not built-in.
> +manual_add_modules tee
> +manual_add_modules optee
> +
> +copy_exec /usr/sbin/tee-supplicant || hook_error "/usr/sbin/tee-supplicant not found"
> +copy_exec /usr/bin/pgrep || hook_error "/usr/bin/pgrep not found"
> diff --git a/meta/recipes-initramfs/initramfs-tee-supplicant-hook/files/tee-supplicant.script b/meta/recipes-initramfs/initramfs-tee-supplicant-hook/files/tee-supplicant.script
> new file mode 100644
> index 0000000..bb6dcc1
> --- /dev/null
> +++ b/meta/recipes-initramfs/initramfs-tee-supplicant-hook/files/tee-supplicant.script
> @@ -0,0 +1,33 @@
> +#!/bin/sh
> +# Copyright (c) Siemens AG, 2023
> +#
> +# Authors:
> +#  Su Bao Cheng <baocheng.su@siemens.com>
> +#
> +# SPDX-License-Identifier: MIT
> +#
> +PREREQ=""
> +prereqs()
> +{
> +	echo "$PREREQ"
> +}
> +case $1 in
> +prereqs)
> +	prereqs
> +	exit 0
> +	;;
> +esac
> +
> +. /scripts/functions
> +
> +/usr/sbin/tee-supplicant -d
> +
> +# The tee-supplicant would take some time to be discovered, 10 seconds should be
> +# enough
> +wait_sec=10
> +until test $wait_sec -eq 0 || test -c "${FTPM_DEV}" ; do
> +	wait_sec=$((wait_sec-1))
> +	sleep 1
> +done
> +
> +/usr/bin/pgrep tee-supplicant > /dev/null || panic "Can't start the tee-supplicant daemon!"
> diff --git a/meta/recipes-initramfs/initramfs-tee-supplicant-hook/initramfs-tee-supplicant-hook_0.1.bb b/meta/recipes-initramfs/initramfs-tee-supplicant-hook/initramfs-tee-supplicant-hook_0.1.bb
> new file mode 100644
> index 0000000..3768b8e
> --- /dev/null
> +++ b/meta/recipes-initramfs/initramfs-tee-supplicant-hook/initramfs-tee-supplicant-hook_0.1.bb
> @@ -0,0 +1,27 @@
> +# Copyright (c) Siemens AG, 2023
> +#
> +# Authors:
> +#  Su Bao Cheng <baocheng.su@siemens.com>
> +#
> +# SPDX-License-Identifier: MIT
> +#
> +
> +inherit dpkg-raw
> +
> +SRC_URI += " \
> +    file://tee-supplicant.hook \
> +    file://tee-supplicant.script \
> +    "
> +
> +DEBIAN_DEPENDS = "initramfs-tools, tee-supplicant, procps"
> +
> +do_install[cleandirs] += " \
> +    ${D}/usr/share/initramfs-tools/hooks \
> +    ${D}/usr/share/initramfs-tools/scripts/local-bottom"
> +
> +do_install() {
> +    install -m 0755 "${WORKDIR}/tee-supplicant.hook" \
> +        "${D}/usr/share/initramfs-tools/hooks/tee-supplicant"
> +    install -m 0755 "${WORKDIR}/tee-supplicant.script" \
> +        "${D}/usr/share/initramfs-tools/scripts/local-bottom/tee-supplicant"
> +}
> diff --git a/testsuite/citest.py b/testsuite/citest.py
> index 17a9024..1aa2928 100755
> --- a/testsuite/citest.py
> +++ b/testsuite/citest.py
> @@ -214,6 +214,7 @@ class NoCrossTest(CIBaseTest):
>              'mc:bananapi-bullseye:isar-image-base',
>              'mc:nanopi-neo-bullseye:isar-image-base',
>              'mc:stm32mp15x-bullseye:isar-image-base',
> +            'mc:stm32mp15x-bullseye:stm32mp15x-initramfs',

Argh, this is why I get nothing of the initramfs in the final image. But
this is not helpful. We need the initramfs for the integrated image.

Jan

-- 
Siemens AG, Technology
Competence Center Embedded Linux