NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2a026ca501
kumquat-buildroot/boot/shim/shim.mk

39 lines
1.1 KiB
Makefile
Raw Normal View History

boot/shim: new package This commit adds a package for 'shim', an EFI bootloader for secure boot chain loading. While gnu-efi supports 32bit ARM, this is currently broken in shim. Patches to fix this have been submitted upstream but are not included here for now. https://github.com/rhboot/shim/pull/162 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> [Thomas: use BR2_PACKAGE_GNU_EFI_ARCH_SUPPORTS, add separate depends on to exclude ARM32 build.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-01-11 11:01:11 +01:00
################################################################################
#
# shim
#
################################################################################
boot/shim: security bump to version 15.8 Fixes the following security issues: CVE-2023-40546 mok: fix LogError() invocation CVE-2023-40547 - avoid incorrectly trusting HTTP headers CVE-2023-40548 Fix integer overflow on SBAT section size on 32-bit system CVE-2023-40549 Authenticode: verify that the signature header is in bounds. CVE-2023-40550 pe: Fix an out-of-bound read in verify_buffer_sbat() CVE-2023-40551: pe-relocate: Fix bounds check for MZ binaries https://github.com/rhboot/shim/tree/15.8 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2024-02-08 09:38:04 +01:00
SHIM_VERSION = 15.8
boot/shim: bump to version 15.4 - Use the tarball provided by upstream developers instead of the one generated by Github. Indeed https://github.com/rhboot/shim/releases/tag/15.4 indicates "As usual, please use the shim-15.4.tar.bz2 tarball, rather than the other two archives github automatically produces." - The tarball now includes the gnu-efi code, so we no longer need to select gnu-efi and have it as a build dependency. We continue to use BR2_PACKAGE_GNU_EFI_ARCH_SUPPORTS as we still only build for those architectures that have gnu-efi support. We also drop the EFI_INCLUDE, EFI_PATH and LIBDIR variables, as gnu-efi no longer needs to be searched in STAGING_DIR. - Drop all four patches, which were backports from upstream. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-04-05 22:21:54 +02:00
SHIM_SITE = https://github.com/rhboot/shim/releases/download/$(SHIM_VERSION)
SHIM_SOURCE = shim-$(SHIM_VERSION).tar.bz2
boot/shim: new package This commit adds a package for 'shim', an EFI bootloader for secure boot chain loading. While gnu-efi supports 32bit ARM, this is currently broken in shim. Patches to fix this have been submitted upstream but are not included here for now. https://github.com/rhboot/shim/pull/162 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> [Thomas: use BR2_PACKAGE_GNU_EFI_ARCH_SUPPORTS, add separate depends on to exclude ARM32 build.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-01-11 11:01:11 +01:00
SHIM_LICENSE = BSD-2-Clause
SHIM_LICENSE_FILES = COPYRIGHT
boot/shim: add SHIM_CPE_ID_VENDOR cpe:2.3:a:redhat:shim is a valid CPE identifier for this package: https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aredhat%3Ashim Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-01-17 17:06:34 +01:00
SHIM_CPE_ID_VENDOR = redhat
boot/shim: new package This commit adds a package for 'shim', an EFI bootloader for secure boot chain loading. While gnu-efi supports 32bit ARM, this is currently broken in shim. Patches to fix this have been submitted upstream but are not included here for now. https://github.com/rhboot/shim/pull/162 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> [Thomas: use BR2_PACKAGE_GNU_EFI_ARCH_SUPPORTS, add separate depends on to exclude ARM32 build.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-01-11 11:01:11 +01:00
SHIM_INSTALL_TARGET = NO
SHIM_INSTALL_IMAGES = YES
boot/shim: force arm mode instead of Thumb mode Use OPTIMIZATIONS parameter to pass -marm to fix the following build failure in Thumb mode: /tmp/ccEjPM4h.s:941: Error: selected processor does not support `mrc p15,0,r2,c9,c13,0' in Thumb mode CFLAGS can't be overridden as it is defined as: CFLAGS = $(FEATUREFLAGS) \ $(OPTIMIZATIONS) \ $(WARNFLAGS) \ $(if $(findstring clang,$(CC)),$(CLANG_WARNINGS)) \ $(ARCH_CFLAGS) \ $(WERRFLAGS) \ $(INCLUDES) \ $(DEFINES) Fixes: - http://autobuild.buildroot.org/results/580156f89cfd72122fef07aa2fe37b4fdd4c316b - http://autobuild.buildroot.org/results/8980c0f422516c7263d8d0c9cc6123f30c4b7ee4 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-02-29 22:56:41 +01:00
SHIM_CFLAGS = $(TARGET_CFLAGS)
boot/shim: new package This commit adds a package for 'shim', an EFI bootloader for secure boot chain loading. While gnu-efi supports 32bit ARM, this is currently broken in shim. Patches to fix this have been submitted upstream but are not included here for now. https://github.com/rhboot/shim/pull/162 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> [Thomas: use BR2_PACKAGE_GNU_EFI_ARCH_SUPPORTS, add separate depends on to exclude ARM32 build.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-01-11 11:01:11 +01:00
SHIM_MAKE_OPTS = \
ARCH="$(GNU_EFI_PLATFORM)" \
CROSS_COMPILE="$(TARGET_CROSS)" \
boot/shim: force arm mode instead of Thumb mode Use OPTIMIZATIONS parameter to pass -marm to fix the following build failure in Thumb mode: /tmp/ccEjPM4h.s:941: Error: selected processor does not support `mrc p15,0,r2,c9,c13,0' in Thumb mode CFLAGS can't be overridden as it is defined as: CFLAGS = $(FEATUREFLAGS) \ $(OPTIMIZATIONS) \ $(WARNFLAGS) \ $(if $(findstring clang,$(CC)),$(CLANG_WARNINGS)) \ $(ARCH_CFLAGS) \ $(WERRFLAGS) \ $(INCLUDES) \ $(DEFINES) Fixes: - http://autobuild.buildroot.org/results/580156f89cfd72122fef07aa2fe37b4fdd4c316b - http://autobuild.buildroot.org/results/8980c0f422516c7263d8d0c9cc6123f30c4b7ee4 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-02-29 22:56:41 +01:00
DASHJ="-j$(PARALLEL_JOBS)" \
OPTIMIZATIONS="$(SHIM_CFLAGS)"
# shim has some assembly function that is not present in Thumb mode:
# Error: selected processor does not support `mrc p15,0,r2,c9,c13,0' in Thumb mode
# so, we desactivate Thumb mode
ifeq ($(BR2_ARM_INSTRUCTIONS_THUMB),y)
SHIM_CFLAGS += -marm
endif
boot/shim: new package This commit adds a package for 'shim', an EFI bootloader for secure boot chain loading. While gnu-efi supports 32bit ARM, this is currently broken in shim. Patches to fix this have been submitted upstream but are not included here for now. https://github.com/rhboot/shim/pull/162 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> [Thomas: use BR2_PACKAGE_GNU_EFI_ARCH_SUPPORTS, add separate depends on to exclude ARM32 build.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-01-11 11:01:11 +01:00
define SHIM_BUILD_CMDS
$(TARGET_CONFIGURE_OPTS) $(MAKE) -C $(@D) $(SHIM_MAKE_OPTS)
endef
define SHIM_INSTALL_IMAGES_CMDS
$(INSTALL) -m 0755 -t $(BINARIES_DIR) $(@D)/*.efi
endef
$(eval $(generic-package))
Reference in New Issue Copy Permalink