wolfBoot: add Yocto/OE secure bootloader recipes by dgarske · Pull Request #164 · wolfSSL/meta-wolfssl

dgarske · 2026-04-14T21:59:22Z

Summary

Add wolfBoot secure boot recipes to meta-wolfssl: cross-compilation of
wolfboot.elf, native signing/keygen tools, and RSA4096+SHA3-384 FIT image
signing
Add xilinx-bootbin bbappend to replace U-Boot with wolfBoot in BOOT.BIN
on AMD/Xilinx ZynqMP (opt-in via WOLFBOOT_ENABLE="1")
User-supplied signing key workflow (WOLFBOOT_SIGNING_KEY) keeps private key
material out of sstate and deploy artifacts

New files

File	Purpose
`recipes-wolfssl/wolfboot/wolfboot.inc`	Shared SRC_URI, LICENSE, pinned SRCREVs for wolfBoot + wolfSSL
`recipes-wolfssl/wolfboot/wolfboot_git.bb`	Cross-compiles `wolfboot.elf`; seeds `.config` from `config/examples/${WOLFBOOT_CONFIG}`
`recipes-wolfssl/wolfboot/wolfboot-keytools-native_git.bb`	Native `wolfboot-keygen` and `wolfboot-sign` utilities
`recipes-wolfssl/wolfboot/wolfboot-signed-image.bb`	Signs kernel FIT image, deploys `image_v<N>_signed.bin`
`recipes-wolfssl/wolfboot/README.md`	Usage guide: key provisioning, quick start, ZynqMP caveats
`recipes-bsp/bootbin/xilinx-bootbin_%.bbappend`	Swaps U-Boot for wolfBoot in `BOOT.BIN` (ZynqMP only, gated)
`conf/layer.conf` (modified)	BBFILES globs, `BBFILES_DYNAMIC` for bootbin, `PREFERRED_PROVIDER`

Key design points

Signing key isolation -- WOLFBOOT_SIGNING_KEY is a user-supplied
absolute path to a pre-generated RSA4096 DER private key. Recipes never
auto-generate or deploy private key material. Public key is derived at build
time and compiled into wolfboot.elf via src/keystore.c.
Bare-metal cross-compilation -- wolfboot_git.bb uses raw make
(not oe_runmake) and unsets CFLAGS/LDFLAGS to avoid Yocto host
flags leaking into the freestanding bootloader build. KEYGEN_TOOL is
overridden to point at the native keygen, preventing the Makefile from
trying to cross-compile and execute an AArch64 keygen binary on x86_64.
Conditional bootbin override -- The bbappend only activates when
WOLFBOOT_ENABLE="1" is set in configuration. Uses BBFILES_DYNAMIC
so the layer doesn't hard-depend on meta-xilinx-tools.
Overridable SRCREVs -- wolfboot.inc uses weak assignment (?=) for
SRCREVs so downstream users can pin to specific commits via local.conf
without patching the layer.

Copilot

Pull request overview

This PR introduces initial Yocto/OpenEmbedded support for wolfBoot inside meta-wolfssl, including recipes to build the bootloader, host-side key/sign tools, and a helper recipe/bbappend to produce and consume signed FIT images (notably for ZynqMP boot flows).

Changes:

Add wolfboot.inc and recipes to build wolfboot.elf, build native key/sign tooling, and sign the kernel FIT image.
Add a xilinx-bootbin bbappend to swap the SSBL in BOOT.BIN to wolfBoot when explicitly opted in via EXTRA_IMAGEDEPENDS.
Register the new recipe globs and PREFERRED_PROVIDER_wolfboot in conf/layer.conf.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
recipes-wolfssl/wolfboot/wolfboot_git.bb	Cross-compiles `wolfboot.elf`, generates keys, and deploys artifacts.
recipes-wolfssl/wolfboot/wolfboot.inc	Shared source/Licensing include with git fetch of wolfBoot + wolfSSL side-by-side.
recipes-wolfssl/wolfboot/wolfboot-signed-image.bb	Signs the kernel FIT image and deploys a versioned signed binary.
recipes-wolfssl/wolfboot/wolfboot-keytools-native_git.bb	Builds and installs `wolfboot-keygen` / `wolfboot-sign` as native tools.
recipes-wolfssl/wolfboot/README.md	Documents layer usage, workflow, and ZynqMP caveats.
recipes-bsp/bootbin/xilinx-bootbin_%.bbappend	Conditionally rewrites the BIF to use `wolfboot.elf` as SSBL on ZynqMP.
conf/layer.conf	Adds new BBFILES globs and sets `PREFERRED_PROVIDER_wolfboot`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

night1rider · 2026-04-16T23:03:18Z

Would it make sense for wolfBoot to use PROVIDES += "virtual/bootloader"?

That's BitBake's standard mechanism for swapping bootloaders - vanilla Yocto and PetaLinux default to U-Boot via PREFERRED_PROVIDER_virtual/bootloader. If wolfBoot participated, selecting it could be as simple as:

PREFERRED_PROVIDER_virtual/bootloader = "wolfboot"

Instead of WOLFBOOT_ENABLE = "1" + the bbappend.

I'm not sure exactly what artifacts/tasks BitBake expects from a virtual/bootloader provider (deploy outputs, IMAGE_BOOT_FILES entries, etc.), and ZynqMP complicates things since xilinx-bootbin references U-Boot by PN directly, but it could be worth exploring for non-Xilinx targets where wolfBoot would be the sole bootloader.

Add wolfBoot secure boot support to meta-wolfssl. Four new recipes cross-compile wolfboot.elf, build host-side signing/keygen tools, and sign kernel FIT images with RSA4096+SHA3-384 for verified boot. New recipes: wolfboot.inc - shared SRC_URI, LICENSE, SRCREVs wolfboot_git.bb - cross-compiles wolfboot.elf from a user-selected config/examples/ template; embeds a user-supplied RSA4096 public key wolfboot-keytools-native_git.bb - native wolfboot-keygen / wolfboot-sign wolfboot-signed-image.bb - signs kernel FIT with RSA4096+SHA3-384 Supporting files: xilinx-bootbin_%.bbappend - replaces U-Boot with wolfBoot in BOOT.BIN on ZynqMP (gated by WOLFBOOT_ENABLE="1"); uses BBFILES_DYNAMIC for meta-xilinx-tools conf/layer.conf - registers wolfboot BBFILES globs and PREFERRED_PROVIDER README.md - usage guide, key provisioning, ZynqMP notes Design decisions: - Signing key is user-supplied out-of-band (WOLFBOOT_SIGNING_KEY) to avoid leaking private key material through sstate or DEPLOY_DIR_IMAGE. - wolfboot_git.bb uses raw make (not oe_runmake) because wolfBoot is a bare-metal bootloader with its own -nostdlib/-ffreestanding toolchain flags that conflict with Yocto's CC/CFLAGS/LDFLAGS injection. - SRCREVs use weak assignment (?=) so downstream users can override via local.conf to track unreleased upstream fixes. Tested on AMD/Xilinx ZCU102 hardware with PetaLinux 2025.2: FSBL -> PMU FW -> ATF -> wolfBoot (EL2) -> signed FIT -> Linux WOLFBOOT_CONFIG="zynqmp_sdcard.config" WOLFBOOT_LINUX_BOOTARGS_ROOT="/dev/mmcblk0p4"

Bumps SRC_URI to dgarske/wolfBoot fit_compressed and updates SRCREVs to pull in the FIT ramdisk extraction (RAMDISK build switch + linux,initrd-{start,end} DTB fixup) and the gzip subimage decompression work. Required by ZynqMP boards (e.g. Gilat ZCU102) that ship the initramfs as a separate FIT ramdisk node rather than bundling it into the kernel image. wolfssl SRCREV pinned to v5.9.1-stable to match what fit_compressed points at via lib/wolfssl. Validated end-to-end on ZCU102: FSBL -> ATF -> wolfBoot loads kernel + ramdisk to 0x40000000, patches /chosen/linux,initrd-{start,end}, signed image (RSA4096+SHA3-384) verifies, kernel boots and unpacks initramfs.

dgarske · 2026-05-06T19:06:38Z

Would it make sense for wolfBoot to use PROVIDES += "virtual/bootloader"?

That's BitBake's standard mechanism for swapping bootloaders - vanilla Yocto and PetaLinux default to U-Boot via PREFERRED_PROVIDER_virtual/bootloader. If wolfBoot participated, selecting it could be as simple as:
PREFERRED_PROVIDER_virtual/bootloader = "wolfboot"
Instead of WOLFBOOT_ENABLE = "1" + the bbappend.

I'm not sure exactly what artifacts/tasks BitBake expects from a virtual/bootloader provider (deploy outputs, IMAGE_BOOT_FILES entries, etc.), and ZynqMP complicates things since xilinx-bootbin references U-Boot by PN directly, but it could be worth exploring for non-Xilinx targets where wolfBoot would be the sole bootloader.

Good suggestion. PROVIDES += "virtual/bootloader" is the idiomatic Yocto path and would make wolfBoot a drop-in for vanilla machines that go through the standard EXTRA_IMAGEDEPENDS += "virtual/bootloader" flow.

The reason it doesn't simplify our ZynqMP case (and won't help Versal either): xilinx-bootbin references the SSBL by recipe name -- BIF_PARTITION_IMAGE[u-boot] is hardwired in meta-xilinx, and the BIF generator just expects u-boot.elf to exist in deploy/sysroot. It bypasses virtual/bootloader entirely. That's why meta-wolfssl's xilinx-bootbin_%.bbappend has to actively rewrite BIF_PARTITION_ATTR[wolfboot] and add a sysroot dep on wolfboot:do_populate_sysroot. WOLFBOOT_ENABLE is just the trigger for that rewrite, not a fundamental need for a custom variable.

Where virtual/bootloader PROVIDES would clearly help:

non-Xilinx Yocto machines (Raspberry Pi, generic ARM) where wolfBoot is the only SSBL and the standard image flow looks for virtual/bootloader
meta-wolfssl users not going through xilinx-bootbin
making the recipe more idiomatic to a Yocto reviewer / CI checker that flags custom enable flags as non-standard

dgarske self-assigned this Apr 14, 2026

Copilot AI review requested due to automatic review settings April 14, 2026 21:59

Copilot started reviewing on behalf of dgarske April 14, 2026 22:01 View session

Copilot AI reviewed Apr 14, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings April 15, 2026 22:23

Copilot started reviewing on behalf of dgarske April 15, 2026 22:27 View session

Copilot AI reviewed Apr 15, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings April 16, 2026 17:32

Copilot started reviewing on behalf of dgarske April 16, 2026 17:34 View session

Copilot AI reviewed Apr 16, 2026

View reviewed changes

Comment thread recipes-wolfssl/wolfboot/wolfboot_git.bb

Comment thread recipes-wolfssl/wolfboot/wolfboot_git.bb

Comment thread recipes-wolfssl/wolfboot/wolfboot_git.bb

Comment thread recipes-wolfssl/wolfboot/README.md

Comment thread recipes-bsp/bootbin/xilinx-bootbin_%.bbappend

dgarske force-pushed the wolfboot_bb branch from e391f0a to 3137a26 Compare April 16, 2026 18:14

Copilot AI review requested due to automatic review settings April 16, 2026 21:16

Copilot started reviewing on behalf of dgarske April 16, 2026 21:17 View session

Copilot AI reviewed Apr 16, 2026

View reviewed changes

Comment thread recipes-wolfssl/wolfboot/wolfboot.inc

Comment thread recipes-wolfssl/wolfboot/wolfboot-signed-image.bb

Comment thread recipes-wolfssl/wolfboot/wolfboot_git.bb

dgarske changed the title ~~wolfBoot: initial Yocto/OE recipes~~ wolfBoot: add Yocto/OE secure bootloader recipes Apr 16, 2026

dgarske force-pushed the wolfboot_bb branch 2 times, most recently from f9a731e to cd53f08 Compare April 17, 2026 21:30

dgarske force-pushed the wolfboot_bb branch 2 times, most recently from 22c5183 to 96e8e2a Compare April 24, 2026 22:49

dgarske force-pushed the wolfboot_bb branch from 96e8e2a to 1b58000 Compare April 28, 2026 20:27

dgarske force-pushed the wolfboot_bb branch from 5618317 to 96743f2 Compare May 4, 2026 20:57

wolfboot: switch to upstream wolfssl/wolfBoot master after PR #763 merge

d592d2c

dgarske force-pushed the wolfboot_bb branch from 96743f2 to d592d2c Compare May 5, 2026 17:22

dgarske requested a review from night1rider May 5, 2026 21:40

dgarske assigned wolfSSL-Bot and night1rider and unassigned dgarske May 5, 2026

Conversation

dgarske commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

New files

Key design points

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

night1rider commented Apr 16, 2026

Uh oh!

dgarske commented May 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

dgarske commented Apr 14, 2026 •

edited

Loading