- wolfprovidercmd: install scripts/utils-general.sh (cmd-test-common.sh sources
it; the command-line suite aborts without it) and RDEPEND wolfproviderenv +
openssl-bin so the package runs when installed
- wolfproviderenv.sh: detect FIPS by loading the module so the first run on a
fresh image is correct before openssl.cnf is seeded
Bumps SRC_URI to dgarske/wolfBoot fit_compressed and updates SRCREVs to
pull in the FIT ramdisk extraction (RAMDISK build switch +
linux,initrd-{start,end} DTB fixup) and the gzip subimage decompression
work. Required by ZynqMP boards (e.g. Gilat ZCU102) that ship the
initramfs as a separate FIT ramdisk node rather than bundling it into
the kernel image.
wolfssl SRCREV pinned to v5.9.1-stable to match what fit_compressed
points at via lib/wolfssl.
Validated end-to-end on ZCU102: FSBL -> ATF -> wolfBoot loads kernel +
ramdisk to 0x40000000, patches /chosen/linux,initrd-{start,end}, signed
image (RSA4096+SHA3-384) verifies, kernel boots and unpacks initramfs.
Add wolfBoot secure boot support to meta-wolfssl. Four new recipes
cross-compile wolfboot.elf, build host-side signing/keygen tools,
and sign kernel FIT images with RSA4096+SHA3-384 for verified boot.
New recipes:
wolfboot.inc - shared SRC_URI, LICENSE, SRCREVs
wolfboot_git.bb - cross-compiles wolfboot.elf from a
user-selected config/examples/ template;
embeds a user-supplied RSA4096 public key
wolfboot-keytools-native_git.bb - native wolfboot-keygen / wolfboot-sign
wolfboot-signed-image.bb - signs kernel FIT with RSA4096+SHA3-384
Supporting files:
xilinx-bootbin_%.bbappend - replaces U-Boot with wolfBoot in BOOT.BIN
on ZynqMP (gated by WOLFBOOT_ENABLE="1");
uses BBFILES_DYNAMIC for meta-xilinx-tools
conf/layer.conf - registers wolfboot BBFILES globs and
PREFERRED_PROVIDER
README.md - usage guide, key provisioning, ZynqMP notes
Design decisions:
- Signing key is user-supplied out-of-band (WOLFBOOT_SIGNING_KEY) to
avoid leaking private key material through sstate or DEPLOY_DIR_IMAGE.
- wolfboot_git.bb uses raw make (not oe_runmake) because wolfBoot is a
bare-metal bootloader with its own -nostdlib/-ffreestanding toolchain
flags that conflict with Yocto's CC/CFLAGS/LDFLAGS injection.
- SRCREVs use weak assignment (?=) so downstream users can override via
local.conf to track unreleased upstream fixes.
Tested on AMD/Xilinx ZCU102 hardware with PetaLinux 2025.2:
FSBL -> PMU FW -> ATF -> wolfBoot (EL2) -> signed FIT -> Linux
WOLFBOOT_CONFIG="zynqmp_sdcard.config"
WOLFBOOT_LINUX_BOOTARGS_ROOT="/dev/mmcblk0p4"
JacobBarthelmeh
Zackery
night1rider
Colton Willey
David Garske
Kareem
Andrew Hutchings