Revert "[bluefield] Add secure boot and secure upgrade support (sonic…

…-net#248)" This reverts commit d914780.
vivekrnv · Sep 28, 2023 · ce4a548 · ce4a548
1 parent 2700a0a
commit ce4a548
Show file tree

Hide file tree

Showing 6 changed files with 16 additions and 185 deletions.
diff --git a/build_image.sh b/build_image.sh
@@ -87,7 +87,7 @@ generate_onie_installer_image()
     ## Note: Don't leave blank between lines. It is single line command.
     ./onie-mk-demo.sh $CONFIGURED_ARCH $TARGET_MACHINE $TARGET_PLATFORM-$TARGET_MACHINE-$ONIEIMAGE_VERSION \
           installer platform/$TARGET_MACHINE/platform.conf $output_file OS $IMAGE_VERSION $ONIE_IMAGE_PART_SIZE \
-          $ONIE_INSTALLER_PAYLOAD  $SECURE_UPGRADE_SIGNING_CERT $SECURE_UPGRADE_DEV_SIGNING_KEY
+          $ONIE_INSTALLER_PAYLOAD
 }
 
 # Generate asic-specific device list
@@ -225,10 +225,7 @@ elif [ "$IMAGE_TYPE" = "aboot" ]; then
     fi
 
 elif [[ $CONFIGURED_PLATFORM == nvidia-bluefield ]]; then
-    if [[ $SECURE_UPGRADE_MODE != "no_sign" ]]; then
-         secure_upgrade_keys="--signing-key "$SECURE_UPGRADE_DEV_SIGNING_KEY" --signing-cert "$SECURE_UPGRADE_SIGNING_CERT""
-    fi
-    sudo --preserve-env /sonic/installer/bluefield/create_sonic_image --kernel $KVERSION "$secure_upgrade_keys"
+    sudo --preserve-env /sonic/installer/bluefield/create_sonic_image --kernel $KVERSION
     if [[ $IMAGE_TYPE != bin ]]; then
         sudo chown $USER ./$OUTPUT_BFB_IMAGE
         if [[ $IMAGE_TYPE == pxe ]]; then

diff --git a/installer/bluefield/create_sonic_image b/installer/bluefield/create_sonic_image
@@ -31,8 +31,6 @@ INITRD=
 VMLINUZ=
 MODULES_DIR=
 
-SIGNING_CERT=
-SIGNING_KEY=
 CDIR=/sonic/
 SDIR=$CDIR/installer/bluefield
 DDIR=$CDIR
@@ -54,12 +52,11 @@ cat << EOF
 Usage: `basename $0` [ OPTIONS ]
 OPTIONS:
 -k, --kernel <kernel version>     Kernel version for the SmartNIC.
--sc, --signing-cert               Secure upgrade signing certificate.
--sk, --signing-key                Secure upgrade signing key.
 -v, --verbose                     Run script in verbose mode. Will print out each step of execution.
 -h, --help                        Display help
 EOF
 }
+
 parse_args() {
     while [[ $@ != "" ]]; do
         case $1 in
@@ -75,16 +72,6 @@ parse_args() {
                 shift
                 KERNEL_VERSION=$1
                 ;;
-	    -sc|--signing-cert)
-	        shift
-		echo "signing cert $1"
-		SIGNING_CERT="$1"
-		;;
-            -sk|--signing-key)
-		shift
-		echo "signing key $1"
-		SIGNING_KEY="$1"
-		;;
             *)
                 usage
                 exit 1
@@ -159,56 +146,7 @@ generate_s2s_installer_image_bluefield()
     # Replace variables in the sharch template
     sed -i -e "s/%%IMAGE_SHA1%%/$sha1/" /sonic/$OUTPUT_ONIE_IMAGE
     echo -n "."
-    tar_size="$(wc -c < "${sharch}")"
-    output_file="/sonic/$OUTPUT_ONIE_IMAGE"
-    sed -i -e "s|%%PAYLOAD_IMAGE_SIZE%%|${tar_size}|" ${output_file}
     cat $sharch >> /sonic/$OUTPUT_ONIE_IMAGE
-    echo "secure upgrade flags: SECURE_UPGRADE_MODE = $SECURE_UPGRADE_MODE, \
-        SECURE_UPGRADE_DEV_SIGNING_KEY = $SIGNING_KEY, SECURE_UPGRADE_SIGNING_CERT = $SIGNING_CERT"
-key_file=${SIGNING_KEY}
-cert_file=${SIGNING_CERT}
-if [ "$SECURE_UPGRADE_MODE" = "dev" -o "$SECURE_UPGRADE_MODE" = "prod" -o "$signing_keys_path" = "ok" ]; then
-    CMS_SIG="${tmp_dir}/signature.sig"
-    scripts_dir="/sonic/scripts"
-
-    echo "$0 $SECURE_UPGRADE_MODE signing - creating CMS signature for ${output_file}. Output file ${CMS_SIG}"
-
-    if [ "$SECURE_UPGRADE_MODE" = "dev" ]; then
-        if [[ -z "$key_file" ]] || [[ -z "$cert_file" ]]; then
-            echo "dev signing key and/or cert not defined. SECURE_UPGRADE_DEV_SIGNING_KEY: $key_file SECURE_UPGRADE_SIGNING_CERT: $cert_file"
-            clean_dir $tmp_dir 1
-        fi
-        echo "$0 dev keyfile location: ${key_file}."
-        [ -f ${scripts_dir}/sign_image_dev.sh ] || {
-            echo "dev sign script ${scripts_dir}/sign_image_dev.sh not found"
-            rm -rf ${output_file}
-        }
-        (${scripts_dir}/sign_image_dev.sh ${cert_file} ${key_file} ${output_file} ${CMS_SIG}) || {
-            echo "CMS sign error $?"
-            rm -rf ${CMS_SIG} ${output_file}
-        }
-    else # "$SECURE_UPGRADE_MODE" has to be equal to "prod"
-        [ -f ${scripts_dir}/sign_image_${machine}.sh ] || {
-            echo "prod sign script ${scripts_dir}/sign_image_${machine}.sh not found"
-            rm -rf ${output_file}
-        }
-        (${scripts_dir}/sign_image_${machine}.sh ${output_file} ${CMS_SIG} ${SECURE_UPGRADE_MODE}) || {
-            echo "CMS sign error $?"
-            rm -rf ${CMS_SIG} ${output_file}
-        }
-    fi
-
-    [ -f "$CMS_SIG" ] || {
-         echo "Error: CMS signature not created - exiting without signing"
-         clean_dir $tmp_dir 1
-    }
-    # append signature to binary
-    cat ${CMS_SIG} >> ${output_file}
-    sudo rm -rf ${CMS_SIG}
-elif [ "$SECURE_UPGRADE_MODE" -ne "no_sign" ]; then
-    echo "SECURE_UPGRADE_MODE not defined or defined as $SECURE_UPGRADE_MODE - build without signing"
-fi
-
     rm -rf $tmp_dir
 
     echo " Done."
@@ -297,7 +235,7 @@ add_sonic_to_initramfs() {
     # Add the logic to put second stage installer into bfb initramfs
     mkdir -p debian
 
-    j2 ${SDIR}/install.sh.j2 -o ./debian/install.sh -e SECURE_UPGRADE_MODE="$SECURE_UPGRADE_MODE"
+    j2 ${SDIR}/install.sh.j2 -o ./debian/install.sh
     chmod 0755 ./debian/install.sh
 
     # Copy the INSTALLER payload
@@ -454,8 +392,6 @@ create_bfb_image() {
     cp $TMFIFO_DRIVER .
     cp $SDHCI_OF_DWCMSHC_DRIVER .
     cp $WATCHDOG .
-    mkdir -p ./secure-boot
-    cp -r $CDIR/$FILESYSTEM_ROOT/boot/* ./secure-boot
 
     mkdir -p ./lib/firmware/mellanox/boot/
     cp /lib/firmware/mellanox/boot/default.bfb ./lib/firmware/mellanox/boot/default.bfb
@@ -503,9 +439,7 @@ create_pxe_archive(){
     pushd $arxiv_wdir
 
     cp /usr/lib/grub/arm64-efi/monolithic/$GRUB_AA64 .
-    cp $CDIR/$FILESYSTEM_ROOT/boot/shimaa64.efi .
-    cp $CDIR/$FILESYSTEM_ROOT/boot/mmaa64.efi .
-    cp $CDIR/$FILESYSTEM_ROOT/boot/grubaa64.efi .
+
     cp $WDIR/vmlinuz Image
     cp $WDIR/dump-initramfs-v0 initramfs
 
@@ -521,16 +455,20 @@ create_pxe_archive(){
 main() {
     echo $@
     parse_args $@
+
     . $CDIR/onie-image-arm64.conf
+
     # Export ENV Variables for j2cli
     CHROOT_DIR=$CDIR/$FILESYSTEM_ROOT
     if [[ ! -d "$CHROOT_DIR" ]]; then
         echo "[create_sonic_image] Error! Path to CHROOT not found"
         exit 1
     fi
+
     export GRUB_CFG=$(cat /sonic/installer/bluefield/sonic-grub.cfg)
     export IMAGE_VERSION=$(cat $CHROOT_DIR/etc/sonic/sonic_version.yml | grep "build_version" | sed -e "s/build_version: //g;s/'//g")
-    export BF2_BOOT_ARGS BF3_BOOT_ARGS BF2_GRUB_CFG BF3_GRUB_CFG ONIE_INSTALLER_PAYLOAD FILESYSTEM_DOCKERFS DOCKERFS_DIR FILESYSTEM_SQUASHFS KERNEL_VERSION SECURE_UPGRADE_MODE SIGNING_KEY SIGNING_CERT
+    export BF2_BOOT_ARGS BF3_BOOT_ARGS BF2_GRUB_CFG BF3_GRUB_CFG ONIE_INSTALLER_PAYLOAD FILESYSTEM_DOCKERFS DOCKERFS_DIR FILESYSTEM_SQUASHFS KERNEL_VERSION
+
     if [[ $IMAGE_TYPE == bin ]]; then
         # bluefield Doesn't have ONiE Support yet and this *.bin image generated can only be used for SONiC-SONiC installation
         echo "Build SONiC to SONiC installer for Bluefield"

diff --git a/installer/bluefield/install.sh.j2 b/installer/bluefield/install.sh.j2
@@ -210,34 +210,9 @@ EOF
 chmod a+r /mnt/machine.conf
 
 sync
-{% if SECURE_UPGRADE_MODE in ['dev', 'prod'] %}
-demo_volume_label="SONiC-OS"
-log "creating demo_volume_label=$demo_volume_label dir under EFI partition to include all boot related modules"
-mkdir -p /mnt/boot/efi/EFI/$demo_volume_label
-
-if [ ! -f /secure-boot/mmaa64.efi ]; then
-   echo "ERROR: /secure-boot/mmaa64.efi file does not exist"
-   exit 1
-fi
-
-if [ ! -f /secure-boot/shimaa64.efi ]; then
-   echo "ERROR: /secure-boot/shimaa64.efi file does not exist"
-   exit 1
-fi
-
-if [ ! -f /secure-boot/grubaa64.efi ]; then
-   echo "ERROR: /secure-boot/grubaa64.efi file does not exist"
-   exit 1
-fi
 
-log "copying signed shim, mm, grub, grub.cfg from /secure-boot to /boot/efi/EFI/$demo_volume_label directory"
-MNT_DIR="/mnt/boot/efi/EFI/$demo_volume_label"
-cp /secure-boot/shimaa64.efi $MNT_DIR
-cp /secure-boot/grubaa64.efi $MNT_DIR
-cp /secure-boot/mmaa64.efi $MNT_DIR
-{% else %}
 log "Installing GRUB"
-{% endif %}
+
 # Create a minimal grub.cfg that allows for:
 #   - configure the serial console
 #   - allows for grub-reboot to work
@@ -273,13 +248,9 @@ cat <<EOF >> $grub_cfg
 EOF
 
 # Copy the grub.cfg onto the boot-directory as specified in the grub-install
-{% if SECURE_UPGRADE_MODE in ['dev', 'prod'] %}
-ex cp $grub_cfg /mnt/boot/efi/EFI/$demo_volume_label/grub.cfg
-{% else %}
-ex mkdir -p /mnt/grub
+ex mkdir -p /mnt/grub 
 ex cp $grub_cfg /mnt/grub/grub.cfg
 
-{% endif %}
 sync
 
 log "GRUB CFG Updated"
@@ -332,17 +303,7 @@ else
 	fi
 	ex efibootmgr -c -d "$device" -p 1 -L $device_label -l "\EFI\\$device_label\grubaa64.efi"
 fi
-{% if SECURE_UPGRADE_MODE in ['dev', 'prod'] %}
-uefi_part=1
-ex efibootmgr --create \
-    --label "$demo_volume_label" \
-    --disk "$device" --part $uefi_part \
-    --loader "\EFI\$demo_volume_label\shimaa64.efi" || {
-    echo "ERROR: efibootmgr failed to create new boot variable on: $device"
-    exit 1
-}
-echo "uefi_shim: Secure Boot components installed successfully"
-{% endif %}
+
 BFCFG=`which bfcfg 2> /dev/null`
 if [ -n "$BFCFG" ]; then
 	# Create PXE boot entries

diff --git a/installer/sharch_body.sh b/installer/sharch_body.sh
@@ -11,9 +11,8 @@
 ##
 
 echo -n "Verifying image checksum ..."
-payload_image_size=%%PAYLOAD_IMAGE_SIZE%%
+sha1=$(sed -e '1,/^exit_marker$/d' "$0" | sha1sum | awk '{ print $1 }')
 
-sha1=$(sed -e '1,/^exit_marker$/d' "$0" | head -c $payload_image_size | sha1sum | awk '{ print $1 }')
 payload_sha1=%%IMAGE_SHA1%%
 
 if [ "$sha1" != "$payload_sha1" ] ; then
@@ -46,7 +45,7 @@ if [ "$(id -u)" = "0" ] ; then
 fi
 cd $tmp_dir
 echo -n "Preparing image archive ..."
-sed -e '1,/^exit_marker$/d' $archive_path | head -c $payload_image_size | tar xf - || exit 1
+sed -e '1,/^exit_marker$/d' $archive_path | tar xf - || exit 1
 echo " OK."
 cd $cur_wd
 if [ -n "$extract" ] ; then

diff --git a/onie-mk-demo.sh b/onie-mk-demo.sh
@@ -14,9 +14,6 @@ output_file=$6
 demo_type=$7
 image_version=$8
 onie_image_part_size=$9
-onie_installer_payload=${10}
-cert_file=${11}
-key_file=${12}
 
 shift 9
 
@@ -64,13 +61,6 @@ tmp_dir=
 clean_up()
 {
     rm -rf $tmp_dir
-    if [ -n "$2" ]; then
-        rm -rf "$2"
-        if [ -n "$3" ];then
-            rm -rf "$3"
-        fi
-        echo "Error: CMS signature not created - exiting without signing"
-    fi
     exit $1
 }
 
@@ -110,7 +100,7 @@ sed -i -e "s/%%DEMO_TYPE%%/$demo_type/g" \
        -e "s@%%OUTPUT_RAW_IMAGE%%@$output_raw_image@" \
     $tmp_installdir/install.sh || clean_up 1
 echo -n "."
-cp -r $onie_installer_payload $tmp_installdir || clean_up 1
+cp -r $* $tmp_installdir || clean_up 1
 echo -n "."
 [ -r "$platform_conf" ] && {
     cp $platform_conf $tmp_installdir || clean_up 1
@@ -140,50 +130,7 @@ cp $installer_dir/sharch_body.sh $output_file || {
 # Replace variables in the sharch template
 sed -i -e "s/%%IMAGE_SHA1%%/$sha1/" $output_file
 echo -n "."
-tar_size="$(wc -c < "${sharch}")"
-sed -i -e "s|%%PAYLOAD_IMAGE_SIZE%%|${tar_size}|" ${output_file}
 cat $sharch >> $output_file
-echo "secure upgrade flags: SECURE_UPGRADE_MODE = $SECURE_UPGRADE_MODE, \
-SECURE_UPGRADE_DEV_SIGNING_KEY = $SECURE_UPGRADE_DEV_SIGNING_KEY, SECURE_UPGRADE_SIGNING_CERT = $SECURE_UPGRADE_SIGNING_CERT"
-
-if [ "$SECURE_UPGRADE_MODE" = "dev" -o "$SECURE_UPGRADE_MODE" = "prod" ]; then
-    CMS_SIG="${tmp_dir}/signature.sig"
-    DIR="$(dirname "$0")"
-    scripts_dir="${DIR}/scripts"
-    echo "$0 $SECURE_UPGRADE_MODE signing - creating CMS signature for ${output_file}. Output file ${CMS_SIG}"
-
-    if [ "$SECURE_UPGRADE_MODE" = "dev" ]; then
-        echo "$0 dev keyfile location: ${key_file}."
-        . ${scripts_dir}/sign_image_dev.sh || {
-            echo "dev sign script ${scripts_dir}/sign_image_dev.sh not found"
-            clean_up 1 ${output_file}
-        }
-        sign_image_dev ${cert_file} ${key_file} ${output_file} ${CMS_SIG} || { 
-            echo "CMS sign error $?"
-            clean_up 1 ${CMS_SIG} ${output_file}
-        }
-    else # "$SECURE_UPGRADE_MODE" has to be equal to "prod"
-        . ${scripts_dir}/sign_image_${machine}.sh || {
-            echo "prod sign script ${scripts_dir}/sign_image_${machine}.sh not found"
-            clean_up 1 ${output_file}
-        }
-        sign_image_prod ${output_file} ${CMS_SIG} ${SECURE_UPGRADE_MODE} || { 
-            echo "CMS sign error $?"
-            clean_up 1 ${CMS_SIG} ${output_file}
-        }
-    fi
-
-    [ -f "$CMS_SIG" ] || {
-         echo "Error: CMS signature not created - exiting without signing"
-         clean_up 1
-    }
-    # append signature to binary
-    cat ${CMS_SIG} >> ${output_file}
-    sudo rm -rf ${CMS_SIG}
-elif [ "$SECURE_UPGRADE_MODE" -ne "no_sign" ]; then
-    echo "SECURE_UPGRADE_MODE not defined or defined as $SECURE_UPGRADE_MODE - build without signing"
-fi
-
 rm -rf $tmp_dir
 echo " Done."
 

diff --git a/scripts/sign_image_dev.sh b/scripts/sign_image_dev.sh