Skip to content

Commit 0552d6b

Browse files
authored
Support symcrypt fips config for aboot/uboot (#10729)
Why I did it Support symcrypt fips config for aboot/uboot
1 parent 3eea73c commit 0552d6b

File tree

7 files changed

+21
-5
lines changed

7 files changed

+21
-5
lines changed

build_image.sh

+8
Original file line numberDiff line numberDiff line change
@@ -200,6 +200,14 @@ elif [ "$IMAGE_TYPE" = "aboot" ]; then
200200
generate_device_list ".platforms_asic"
201201
zip -g $OUTPUT_ABOOT_IMAGE .platforms_asic
202202

203+
if [ "$ENABLE_FIPS" = "y" ]; then
204+
echo "sonic_fips=1" > kernel-cmdline
205+
else
206+
echo "sonic_fips=0" > kernel-cmdline
207+
fi
208+
zip -g $OUTPUT_ABOOT_IMAGE kernel-cmdline
209+
rm kernel-cmdline
210+
203211
zip -g $OUTPUT_ABOOT_IMAGE $ABOOT_BOOT_IMAGE
204212
rm $ABOOT_BOOT_IMAGE
205213
if [ "$SONIC_ENABLE_IMAGE_SIGNATURE" = "y" ]; then

files/Aboot/boot0.j2

+1-1
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ installer_image_path="$image_path/$installer_image"
8686

8787
boot_config="$target_path/boot-config"
8888

89-
cmdline_allowlist="crashkernel hwaddr_ma1"
89+
cmdline_allowlist="crashkernel hwaddr_ma1 sonic_fips"
9090

9191
# for backward compatibility with the sonic_upgrade= behavior
9292
install="${install:-${sonic_upgrade:-}}"

installer/arm64/install.sh

+3
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,9 @@ if [ "$install_env" = "onie" ]; then
181181
fi
182182
fi
183183

184+
extra_cmdline_linux=%%EXTRA_CMDLINE_LINUX%%
185+
echo "EXTRA_CMDLINE_LINUX=$extra_cmdline_linux"
186+
184187
# Update Bootloader Menu with installed image
185188
bootloader_menu_config
186189

installer/armhf/install.sh

+3
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,9 @@ if [ "$install_env" = "onie" ]; then
181181
fi
182182
fi
183183

184+
extra_cmdline_linux=%%EXTRA_CMDLINE_LINUX%%
185+
echo "EXTRA_CMDLINE_LINUX=$extra_cmdline_linux"
186+
184187
# Update Bootloader Menu with installed image
185188
bootloader_menu_config
186189

platform/centec-arm64/platform.conf

+4-2
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,10 @@ mount_partition() {
1616

1717
bootloader_menu_config() {
1818
if [ "$install_env" = "onie" ]; then
19+
fw_setenv -f linuxargs "${extra_cmdline_linux}"
1920
fw_setenv -f nos_bootcmd "test -n \$boot_once && setenv do_boot_once \$boot_once && setenv boot_once && saveenv && run do_boot_once; run boot_next"
2021

21-
fw_setenv -f sonic_image_1 "ext4load mmc 0:1 \$loadaddr \$sonic_dir_1/boot/sonic_arm64.fit && setenv bootargs quiet console=\$consoledev,\$baudrate root=/dev/mmcblk0p1 rw rootwait rootfstype=ext4 loopfstype=squashfs loop=\$sonic_dir_1/fs.squashfs systemd.unified_cgroup_hierarchy=0 && bootm \$loadaddr"
22+
fw_setenv -f sonic_image_1 "ext4load mmc 0:1 \$loadaddr \$sonic_dir_1/boot/sonic_arm64.fit && setenv bootargs quiet console=\$consoledev,\$baudrate root=/dev/mmcblk0p1 rw rootwait rootfstype=ext4 loopfstype=squashfs loop=\$sonic_dir_1/fs.squashfs systemd.unified_cgroup_hierarchy=0 \${linuxargs} && bootm \$loadaddr"
2223
fw_setenv -f sonic_image_2 "NONE"
2324
fw_setenv -f sonic_dir_1 $image_dir
2425
fw_setenv -f sonic_dir_2 "NONE"
@@ -37,9 +38,10 @@ bootloader_menu_config() {
3738
fi
3839
done
3940

41+
fw_setenv linuxargs "${extra_cmdline_linux}"
4042
fw_setenv nos_bootcmd "test -n \$boot_once && setenv do_boot_once \$boot_once && setenv boot_once && saveenv && run do_boot_once; run boot_next"
4143

42-
fw_setenv sonic_image_$idx "ext4load mmc 0:1 \$loadaddr \$sonic_dir_$idx/boot/sonic_arm64.fit && setenv bootargs quiet console=\$consoledev,\$baudrate root=/dev/mmcblk0p1 rw rootwait rootfstype=ext4 loopfstype=squashfs loop=\$sonic_dir_$idx/fs.squashfs systemd.unified_cgroup_hierarchy=0 && bootm \$loadaddr"
44+
fw_setenv sonic_image_$idx "ext4load mmc 0:1 \$loadaddr \$sonic_dir_$idx/boot/sonic_arm64.fit && setenv bootargs quiet console=\$consoledev,\$baudrate root=/dev/mmcblk0p1 rw rootwait rootfstype=ext4 loopfstype=squashfs loop=\$sonic_dir_$idx/fs.squashfs systemd.unified_cgroup_hierarchy=0 \${linuxargs} && bootm \$loadaddr"
4345
fw_setenv sonic_dir_$idx $image_dir
4446
fw_setenv sonic_version_$idx `echo $image_dir | sed "s/^image-/SONiC-OS-/g"`
4547

platform/marvell-arm64/platform.conf

+1-1
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ prepare_boot_menu() {
108108
BORDER='echo "---------------------------------------------------";echo;'
109109
fw_setenv ${FW_ARG} print_menu $BORDER $BOOT1 $BOOT2 $BOOT3 $BORDER > /dev/null
110110

111-
fw_setenv ${FW_ARG} linuxargs "net.ifnames=0 loopfstype=squashfs loop=$image_dir/$FILESYSTEM_SQUASHFS systemd.unified_cgroup_hierarchy=0 varlog_size=$VAR_LOG" > /dev/null
111+
fw_setenv ${FW_ARG} linuxargs "net.ifnames=0 loopfstype=squashfs loop=$image_dir/$FILESYSTEM_SQUASHFS systemd.unified_cgroup_hierarchy=0 varlog_size=$VAR_LOG ${extra_cmdline_linux}" > /dev/null
112112
fw_setenv ${FW_ARG} linuxargs_old "net.ifnames=0 loopfstype=squashfs loop=$image_dir_old/$FILESYSTEM_SQUASHFS systemd.unified_cgroup_hierarchy=0 varlog_size=$VAR_LOG" > /dev/null
113113
sonic_bootargs_old='setenv bootargs root='$demo_dev' rw rootwait rootfstype=ext4 panic=1 console=ttyS0,115200 ${othbootargs} ${mtdparts} ${linuxargs_old}'
114114
fw_setenv ${FW_ARG} sonic_bootargs_old $sonic_bootargs_old > /dev/null || true

platform/marvell-armhf/platform.conf

+1-1
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ prepare_boot_menu() {
147147
BORDER='echo "---------------------------------------------------";echo;'
148148
fw_setenv ${FW_ARG} print_menu $BORDER $BOOT1 $BOOT2 $BOOT3 $BORDER > /dev/null
149149

150-
fw_setenv ${FW_ARG} linuxargs "net.ifnames=0 loopfstype=squashfs loop=$image_dir/$FILESYSTEM_SQUASHFS systemd.unified_cgroup_hierarchy=0 varlog_size=$VAR_LOG loglevel=4" > /dev/null
150+
fw_setenv ${FW_ARG} linuxargs "net.ifnames=0 loopfstype=squashfs loop=$image_dir/$FILESYSTEM_SQUASHFS systemd.unified_cgroup_hierarchy=0 varlog_size=$VAR_LOG loglevel=4 ${extra_cmdline_linux}" > /dev/null
151151
fw_setenv ${FW_ARG} linuxargs_old "net.ifnames=0 loopfstype=squashfs loop=$image_dir_old/$FILESYSTEM_SQUASHFS systemd.unified_cgroup_hierarchy=0 varlog_size=$VAR_LOG loglevel=4" > /dev/null
152152

153153
# Set boot configs

0 commit comments

Comments
 (0)