jiazhang0/meta-secure-core

shim fails to build with qemux86

WenzongFan opened this issue · 4 comments

WenzongFan commented

I got the build error even build it with:

setarch linux32 ${MAKE} ${EXTRA_OEMAKE} ARCH=ia32

Looks the shim can't be built with i586-poky-linux-gcc. Any suggestion to fix it? Or just update the COMPATIBLE_HOST to support x86-64 only?

oky-linux/shim/12+gitAUTOINC+5202f80c32-r0/vendor_cert.cer" -c -o security_policy.o security_policy.c
| /tmp/ccvE99ZV.s: Assembler messages:
| /tmp/ccvE99ZV.s:268: Error: bad register name %rsp)' | /tmp/ccvE99ZV.s:269: Error: bad register name %rdi'
| /tmp/ccvE99ZV.s:270: Error: bad register name %rsi' | /tmp/ccvE99ZV.s:271: Error: bad register name %r10'
| /tmp/ccvE99ZV.s:272: Error: bad register name %rsp' | /tmp/ccvE99ZV.s:273: Error: bad register name %rax'
| /tmp/ccvE99ZV.s:274: Error: bad register name %r10' | /tmp/ccvE99ZV.s:275: Error: bad register name %rsp'
| /tmp/ccvE99ZV.s:276: Error: bad register name %rax' | /tmp/ccvE99ZV.s:277: Error: bad register name %r10'
| /tmp/ccvE99ZV.s:278: Error: bad register name %r11' | /tmp/ccvE99ZV.s:279: Error: bad register name %r11'
| /tmp/ccvE99ZV.s:280: Error: bad register name %r11' | /tmp/ccvE99ZV.s:282: Error: bad register name %rdi'
| /tmp/ccvE99ZV.s:283: Error: bad register name %rcx' | /tmp/ccvE99ZV.s:284: Error: bad register name %rdx'
| /tmp/ccvE99ZV.s:285: Error: bad register name %r8' | /tmp/ccvE99ZV.s:286: Error: bad register name %r9'
| /tmp/ccvE99ZV.s:287: Error: bad register name %r10' | /tmp/ccvE99ZV.s:288: Error: invalid instruction suffix for call'
| /tmp/ccvE99ZV.s:289: Error: bad register name %rsp)' | /tmp/ccvE99ZV.s:290: Error: bad register name %r11'
| /tmp/ccvE99ZV.s:291: Error: bad register name %rsi' | /tmp/ccvE99ZV.s:292: Error: bad register name %rdi'
| /tmp/ccvE99ZV.s:297: Error: bad register name %rdi' | /tmp/ccvE99ZV.s:298: Error: bad register name %rsi'
| /tmp/ccvE99ZV.s:299: Error: bad register name %rsp' | /tmp/ccvE99ZV.s:300: Error: bad register name %rax'
| /tmp/ccvE99ZV.s:301: Error: bad register name %r10' | /tmp/ccvE99ZV.s:302: Error: bad register name %rsp'
| /tmp/ccvE99ZV.s:303: Error: bad register name %rax' | /tmp/ccvE99ZV.s:304: Error: bad register name %r10'
| /tmp/ccvE99ZV.s:305: Error: bad register name %r11' | /tmp/ccvE99ZV.s:306: Error: bad register name %r11'
| /tmp/ccvE99ZV.s:307: Error: bad register name %r11' | /tmp/ccvE99ZV.s:309: Error: bad register name %rcx'
| /tmp/ccvE99ZV.s:310: Error: bad register name %rdx' | /tmp/ccvE99ZV.s:311: Error: bad register name %r8'
| /tmp/ccvE99ZV.s:312: Error: invalid instruction suffix for call' | /tmp/ccvE99ZV.s:313: Error: bad register name %rsp)'
| /tmp/ccvE99ZV.s:314: Error: bad register name %r11' | /tmp/ccvE99ZV.s:315: Error: bad register name %rsi'
| /tmp/ccvE99ZV.s:316: Error: bad register name `%rdi'
| make[1]: *** [security_policy.o] Error 1

jiazhang0 commented

Seems like the mok secure boot patch for 32-bit was dropped.

WenzongFan commented

The qemux86 build could be fixed with:

--- a/meta-efi-secure-boot/recipes-bsp/shim/shim_git.bb
+++ b/meta-efi-secure-boot/recipes-bsp/shim/shim_git.bb
@@ -64,10 +64,11 @@ EXTRA_OEMAKE = "\
     ${@'VENDOR_DBX_FILE=${WORKDIR}/vendor_dbx.esl' \
        if uks_signing_model(d) == 'user' else ''} \
     ENABLE_HTTPBOOT=1 \
-    OVERRIDE_SECURITY_POLICY=1 \
     ENABLE_SBSIGN=1 \
 "
 
+EXTRA_OEMAKE_append_x86-64 = " OVERRIDE_SECURITY_POLICY=1"

I wonder if this will impact fallback functions on 32bit host?

jiazhang0 commented

@WenzongFan Sorry for the too late reply.

Currently, fallback is completely dropped. Could you use the latest meta-secure-core to see whether this issue still happens?

jiazhang0 commented

Reopen this if happen again.