board: microchip: Recalculate and re-sign IPA modules

Buildroot strips its binaries post-installation as an optimization,
which invalidates the original IPA module signatures done during
installation. This causes libcamera to treat them as closed-source and
attempt to run them in isolation using IPC, which fails if the modules
aren't designed for isolated execution/doesn't have IPC
support.Recalculating and re-signing the IPA module signatures is
therefore necessary to ensure proper functionality.

Add support for this in 'post-build.sh', conditionally if the libcamera
IPA module is selected. This ensures IPA modules are signed correctly
after they are built and installed.

Signed-off-by: Balakrishnan Sambath <[email protected]>
Signed-off-by: Conor Dooley <[email protected]>

Author: Balki01

board/microchip/sam9x/post_build.sh

@@ -44,3 +44,27 @@ if grep -Eq "^BR2_PACKAGE_GREENGRASS_CORE=y$" ${BR2_CONFIG}; then
 		_EOF_
 	fi
 fi
+
+# Only run if libcamera IPA is enabled
+if grep -Eq "^BR2_PACKAGE_LIBCAMERA_MCHP_IPA=y$" "${BR2_CONFIG}"; then
+	echo "===== Re-signing IPA modules ====="
+
+	# Extract libcamera-mchp version
+	LIBCAMERA_MCHP_VERSION=$(grep -E '^LIBCAMERA_MCHP_VERSION\s*=' "${BR2_EXTERNAL_MCHP_PATH}/package/libcamera-mchp/"* | cut -d= -f2 | xargs)
+
+	# Find the libcamera build directory
+	LIBCAMERA_DIR="${BUILD_DIR}/libcamera-mchp-${LIBCAMERA_MCHP_VERSION}"
+
+	if [ -d "${LIBCAMERA_DIR}" ]; then
+		echo "Using libcamera-mchp version: ${LIBCAMERA_MCHP_VERSION}"
+	fi
+
+	if [ -d "${TARGET_DIR}/usr/lib/libcamera" ] && [ -n "${LIBCAMERA_DIR}" ]; then
+		find "${TARGET_DIR}/usr/lib/libcamera" -name "ipa_*.so" \
+			-exec "${LIBCAMERA_DIR}/src/ipa/ipa-sign-install.sh" \
+			"${LIBCAMERA_DIR}/build/src/ipa-priv-key.pem" {} \; \
+			-exec touch {}.sign \;
+	fi
+
+	echo "===== IPA modules signing complete ====="
+fi

board/microchip/sama7/post_build.sh

@@ -43,3 +43,27 @@ fi
 
 # Mount debugfs on boot
 echo "debugfs     /sys/kernel/debug debugfs defaults 0 0" >> ${TARGET_DIR}/etc/fstab
+
+# Only run if libcamera IPA is enabled
+if grep -Eq "^BR2_PACKAGE_LIBCAMERA_MCHP_IPA=y$" "${BR2_CONFIG}"; then
+	echo "===== Re-signing IPA modules ====="
+
+	# Extract libcamera-mchp version
+	LIBCAMERA_MCHP_VERSION=$(grep -E '^LIBCAMERA_MCHP_VERSION\s*=' "${BR2_EXTERNAL_MCHP_PATH}/package/libcamera-mchp/"* | cut -d= -f2 | xargs)
+
+	# Find the libcamera build directory
+	LIBCAMERA_DIR="${BUILD_DIR}/libcamera-mchp-${LIBCAMERA_MCHP_VERSION}"
+
+	if [ -d "${LIBCAMERA_DIR}" ]; then
+		echo "Using libcamera-mchp version: ${LIBCAMERA_MCHP_VERSION}"
+	fi
+
+	if [ -d "${TARGET_DIR}/usr/lib/libcamera" ] && [ -n "${LIBCAMERA_DIR}" ]; then
+		find "${TARGET_DIR}/usr/lib/libcamera" -name "ipa_*.so" \
+			-exec "${LIBCAMERA_DIR}/src/ipa/ipa-sign-install.sh" \
+			"${LIBCAMERA_DIR}/build/src/ipa-priv-key.pem" {} \; \
+			-exec touch {}.sign \;
+	fi
+
+	echo "===== IPA modules signing complete ====="
+fi