[secure boot]Add Secure Boot Feature - #3
Open
davidpil2002 wants to merge 13 commits into
Open
Conversation
davidpil2002
force-pushed
the
secure_boot_support
branch
5 times, most recently
from
November 22, 2022 09:45
726e5ff to
944ac0a
Compare
davidpil2002
force-pushed
the
secure_boot_support
branch
from
November 28, 2022 14:19
767ca97 to
b8ac9fc
Compare
davidpil2002
force-pushed
the
secure_boot_support
branch
from
December 6, 2022 20:40
878e879 to
46b3040
Compare
davidpil2002
force-pushed
the
secure_boot_support
branch
from
December 26, 2022 09:36
03f3cf5 to
62092f4
Compare
davidpil2002
force-pushed
the
secure_boot_support
branch
2 times, most recently
from
January 25, 2023 13:25
d9d52a2 to
9cc6b60
Compare
davidpil2002
force-pushed
the
secure_boot_support
branch
3 times, most recently
from
February 9, 2023 13:19
fde9898 to
c758293
Compare
… sonic fs (like original grub.cfg)instead in boot directory
Signed-off-by: Saikrishna Arcot <sarcot@microsoft.com> Signed-off-by: Saikrishna Arcot <sarcot@microsoft.com>
… fix variable typo SECURE_UPGRADE_PROD_SIGNING_TOOL_DST instead SECURE_UPGRADE_PROD_SIGNING_TOOL_SOURCE
davidpil2002
force-pushed
the
secure_boot_support
branch
from
March 6, 2023 13:56
ee7384f to
7509fc5
Compare
davidpil2002
pushed a commit
that referenced
this pull request
May 8, 2025
…et#21095) Adding the below fix from FRR FRRouting/frr#17297 This is to fix the following crash which is a statistical issue [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `/usr/lib/frr/zebra -A 127.0.0.1 -s 90000000 -M dplane_fpm_nl -M snmp'. Program terminated with signal SIGABRT, Aborted. #0 0x00007fccd7351e2c in ?? () from /lib/x86_64-linux-gnu/libc.so.6 [Current thread is 1 (Thread 0x7fccd6faf7c0 (LWP 36))] (gdb) bt #0 0x00007fccd7351e2c in ?? () from /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007fccd7302fb2 in raise () from /lib/x86_64-linux-gnu/libc.so.6 #2 0x00007fccd72ed472 in abort () from /lib/x86_64-linux-gnu/libc.so.6 #3 0x00007fccd75bb3a9 in _zlog_assert_failed (xref=xref@entry=0x7fccd7652380 <_xref.16>, extra=extra@entry=0x0) at ../lib/zlog.c:678 #4 0x00007fccd759b2fe in route_node_delete (node=<optimized out>) at ../lib/table.c:352 #5 0x00007fccd759b445 in route_unlock_node (node=0x0) at ../lib/table.h:258 #6 route_next (node=<optimized out>) at ../lib/table.c:436 #7 route_next (node=node@entry=0x56029d89e560) at ../lib/table.c:410 #8 0x000056029b6b6b7a in if_lookup_by_name_per_ns (ns=ns@entry=0x56029d873d90, ifname=ifname@entry=0x7fccc0029340 "PortChannel1020") at ../zebra/interface.c:312 #9 0x000056029b6b8b36 in zebra_if_dplane_ifp_handling (ctx=0x7fccc0029310) at ../zebra/interface.c:1867 sonic-net#10 zebra_if_dplane_result (ctx=0x7fccc0029310) at ../zebra/interface.c:2221 sonic-net#11 0x000056029b7137a9 in rib_process_dplane_results (thread=<optimized out>) at ../zebra/zebra_rib.c:4810 sonic-net#12 0x00007fccd75a0e0d in thread_call (thread=thread@entry=0x7ffe8e553cc0) at ../lib/thread.c:1990 sonic-net#13 0x00007fccd7559368 in frr_run (master=0x56029d65a040) at ../lib/libfrr.c:1198 sonic-net#14 0x000056029b6ac317 in main (argc=9, argv=0x7ffe8e5540d8) at ../zebra/main.c:478
davidpil2002
pushed a commit
that referenced
this pull request
Jul 26, 2026
…dating udevd rules (sonic-net#26343) - Why I did it On SONiC SmartSwitch platforms with DPUs, systemd-udevd crashes with SIGABRT on every reboot when DPU firmware initialization is slow. During the initramfs boot phase, a standalone systemd-udevd daemon is started to handle device discovery. If DPU firmware takes longer than the 60-second udevadm settle timeout (BlueField-3 DPUs can take 120 seconds each in the failure case when they are stuck), the initramfs cannot stop this udevd before switch_root. The stale process survives into the real system but is never chrooted into the overlayfs root, leaving it with a broken filesystem view. When dpu-udev-manager.sh writes udev rules, the stale udevd detects the change and crashes on an assertion in systemd's chase() path resolution (assert(path_is_absolute(p)) at chase.c:648), because dir_fd_is_root() returns false for a process whose root still points to the initramfs rootfs rather than the overlayfs. This triggers a systemd issue : systemd/systemd#29559 which maintainers doesn't consider as a bug from systemd side. Raising this fix for our usecase. Core was generated by `/usr/lib/systemd/systemd-udevd --daemon --resolve-names=never'. Program terminated with signal SIGABRT, Aborted. #0 0x00007f29fe7f695c in ?? () from /lib/x86_64-linux-gnu/libc.so.6 (gdb) bt #0 0x00007f29fe7f695c in ?? () from /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007f29fe7a1cc2 in raise () from /lib/x86_64-linux-gnu/libc.so.6 #2 0x00007f29fe78a4ac in abort () from /lib/x86_64-linux-gnu/libc.so.6 #3 0x00007f29fea50c11 in ?? () from /usr/lib/x86_64-linux-gnu/systemd/libsystemd-shared-257.so #4 0x00007f29feb94a8b in chase () from /usr/lib/x86_64-linux-gnu/systemd/libsystemd-shared-257.so #5 0x00007f29feb956e2 in chase_and_opendir () from /usr/lib/x86_64-linux-gnu/systemd/libsystemd-shared-257.so #6 0x00007f29feb9a609 in conf_files_list_strv () from /usr/lib/x86_64-linux-gnu/systemd/libsystemd-shared-257.so #7 0x00007f29fea913e8 in config_get_stats_by_path () from /usr/lib/x86_64-linux-gnu/systemd/libsystemd-shared-257.so #8 0x0000559f295519cf in ?? () #9 0x0000559f29553a77 in ?? () sonic-net#10 0x00007f29fec36055 in ?? () from /usr/lib/x86_64-linux-gnu/systemd/libsystemd-shared-257.so sonic-net#11 0x00007f29fec3668d in sd_event_dispatch () from /usr/lib/x86_64-linux-gnu/systemd/libsystemd-shared-257.so sonic-net#12 0x00007f29fec394a8 in sd_event_run () from /usr/lib/x86_64-linux-gnu/systemd/libsystemd-shared-257.so sonic-net#13 0x00007f29fec396c7 in sd_event_loop () from /usr/lib/x86_64-linux-gnu/systemd/libsystemd-shared-257.so sonic-net#14 0x0000559f29545820 in ?? () sonic-net#15 0x00007f29fe78bca8 in ?? () from /lib/x86_64-linux-gnu/libc.so.6 sonic-net#16 0x00007f29fe78bd65 in __libc_start_main () from /lib/x86_64-linux-gnu/libc.so.6 sonic-net#17 0x0000559f29545c51 in ?? () - How I did it Added a kill_stale_udevd() function to dpu-udev-manager.sh that runs before writing the udev rules. It identifies the systemd-managed udevd PID via systemctl show, then kills any other systemd-udevd --daemon process that doesn't match -- these are leftover initramfs instances. If no stale process exists (e.g. DPUs are healthy and the initramfs udevd exited cleanly), the function is a no-op. - How to verify it Deploy the image on a SmartSwitch with DPUs in a state where firmware initialization times out (>60s per DPU) by stopping image installation before firmware install step Reboot the switch Verify no new systemd-udevd coredumps in /var/core/ Verify the stale process was killed: journalctl -b 0 | grep dpu-udev-manager should show killing stale initramfs udevd PID (systemd udevd is PID ) Verify systemd-udevd.service is healthy: systemctl status systemd-udevd should show active (running) Verify DPU udev rules were written: cat /etc/udev/rules.d/92-midplane-intf.rules should contain the DPU interface naming rules Signed-off-by: Hemanth Kumar Tirupati <tirupatihemanthkumar@gmail.com>
davidpil2002
pushed a commit
that referenced
this pull request
Jul 26, 2026
…m.d (sonic-net#27996) What: Updated files/build_templates/sonic_debian_extension.j2 to also copy com.sonic.*.conf dbus config files (e.g. com.sonic.RackManager.conf) to /etc/dbus-1/system.d/, not just xyz.openbmc_project.*.conf. Why: sonic-redfish PR #3 adds com.sonic.RackManager.conf which doesn't match the existing xyz.openbmc_project pattern; without it sonic-dbus-bridge fails to start and buildimage breaks. How: Added a loop over com.sonic.*.conf (file-existence guarded) copying into the host system.d dir on aspeed. Testing: All CI green — Azure.sonic-buildimage + all KVM tests pass, DCO/EasyCLA/Semgrep pass. Approved by judyjoseph, chinmoy-nexthop, yxieca. Signed-off-by: shreyansh-nexthop <shreyansh@nexthop.ai>
davidpil2002
pushed a commit
that referenced
this pull request
Jul 26, 2026
…ically (sonic-net#28157) #### Why I did it src/sonic-redfish ``` * c24aa81 - (HEAD -> master, origin/master, origin/HEAD) Merge pull request #3 from nexthop-ai/oem/bmcweb-with-dbus-bridge (11 hours ago) [judyjoseph] * b39fa2b - pmon-hld : align with platform design and schema (5 days ago) [Chinmoy Dey] * 0a6164d - schema-test: adding api test for generic schema and field unit test (5 days ago) [Chinmoy Dey] * ea2de01 - oem-schema: generic schema support for Alert adn Telemetry (5 days ago) [Chinmoy Dey] * d0062b5 - oem-src: Adding GET, patch update, new test added (5 days ago) [Chinmoy Dey] * 5b46cc8 - doc-update: readme update for oem and test (5 days ago) [Chinmoy Dey] * 788e6d8 - test-framework-update: support OEM POST api and redis validation (5 days ago) [Chinmoy Dey] * 49b4001 - oem-schema: Generic field supoort for oem telemetry (5 days ago) [Chinmoy Dey] * abcb8e0 - oem-schema: Generic field supoort for oem Alert (5 days ago) [Chinmoy Dey] * f86121a - oem-bmcweb: centralize D-Bus constants, cap body size, refine HTTP status mapping (5 days ago) [Chinmoy Dey] * 964b372 - oem-bridge: dedicate com.sonic.RackManager bus name and offload Redis I/O to a worker thread (5 days ago) [Chinmoy Dey] * 2d5b126 - oem-redfish-tests: add Redfish API integration cases for SONiC OEM routes (5 days ago) [Chinmoy Dey] * 26361e5 - oem-unit-tests: add field_mapping gtest suite + header-only test support (5 days ago) [Chinmoy Dey] * 948b53b - oem-build: integrate OEM extension copy step into build (5 days ago) [Chinmoy Dey] * baeb3af - oem-bmcweb-integration: patch bmcweb to register SONiC OEM routes (5 days ago) [Chinmoy Dey] * d7b747b - oem-bridge-integration: wire RackManagerReceiver into BridgeApp (5 days ago) [Chinmoy Dey] * 1b09cf7 - oem-bridge-infra: add RackManagerReceiver D-Bus->Redis bridge (5 days ago) [Chinmoy Dey] * c79e933 - oem-bmcweb-headers: add SONiC OEM Redfish route headers for bmcweb (5 days ago) [Chinmoy Dey] * 3179d07 - oem-schema: add SONiC Redfish OEM JSON schemas (5 days ago) [Chinmoy Dey] ``` #### How I did it #### How to verify it #### Description for the changelog
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why I did it
Add Secure Boot support to SONiC OS.
Secure Boot (SB) is a verification mechanism for ensuring that code launched by a computer's UEFI firmware is trusted. It is designed to protect a system against malicious code being loaded and executed early in the boot process before the operating system has been loaded.
How I did it
Added a signing process to sign the following components:
shim, grub, Linux kernel, and kernel modules when doing the build, and when feature is enabled in build time according to the HLD explanations (the feature is disabled by default).
How to verify it
There are self-verifications of each boot component when building the image, in addition, added an end-to-end test in sonic-mgmt repo that checks that the boot succeeds when loading a secure system.
TBD: PR link of sonic-mgmt will be added soon
Which release branch to backport (provide reason below if selected)
Description for the changelog
Link to config_db schema for YANG module changes
No REDIS DB used in this feature
HLD link: sonic-net/SONiC#1028
A picture of a cute animal (not mandatory but encouraged)