From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>

commit 0f510a2457cbbba18a98492bab1bf540be57ebd1 upstream.

The hardware manual states that the operation of the sensor is not
guaranteed with temperatures above 125°C, not that the readings are
invalid. Remove the bound check and try to deliver temperature readings
even if we are outside the guaranteed operation range.

Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20200117160554.3812787-3-niklas.soderlund+renesas@ragnatech.se
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
---
drivers/thermal/rcar_gen3_thermal.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/thermal/rcar_gen3_thermal.c b/drivers/thermal/rcar_gen3_thermal.c
index 42ec69d29540..e7a0c7fc9897 100644
--- a/drivers/thermal/rcar_gen3_thermal.c
+++ b/drivers/thermal/rcar_gen3_thermal.c
@@ -182,9 +182,7 @@ static int rcar_gen3_thermal_get_temp(void *devdata, int *temp)
tsc->coef.a2);
mcelsius = FIXPT_TO_MCELSIUS(val);

- /* Make sure we are inside specifications */
- if ((mcelsius < MCELSIUS(-40)) || (mcelsius > MCELSIUS(125)))
- return -EIO;
+ /* Guaranteed operating range is -40C to 125C. */

/* Round value to device granularity setting */
*temp = rcar_gen3_thermal_round(mcelsius);
--
2.17.1

From: Marian-Cristian Rotariu <marian-cristian.rotariu.rb@bp.renesas.com>

commit d18dbce4e8c02634866dc80c7873e6121fcae970 upstream.

The RZ/G2H (r8a774e1) comes with two clusters of processors, similarly to
the r8a774a1. The first cluster is made of A57s, the second cluster is made
of A53s.

The operating points for the cluster with the A57s are:

Frequency | Voltage
----------|---------
500 MHz | 0.82V
1.0 GHz | 0.82V
1.5 GHz | 0.82V

The operating points for the cluster with the A53s are:

Frequency | Voltage
----------|---------
800 MHz | 0.82V
1.0 GHz | 0.82V
1.2 GHz | 0.82V

This patch adds the definitions for the operating points to the SoC
specific DT.

Signed-off-by: Marian-Cristian Rotariu <marian-cristian.rotariu.rb@bp.renesas.com>
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Link: https://lore.kernel.org/r/1594811350-14066-2-git-send-email-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
---
arch/arm64/boot/dts/renesas/r8a774e1.dtsi | 51 +++++++++++++++++++++++
1 file changed, 51 insertions(+)

diff --git a/arch/arm64/boot/dts/renesas/r8a774e1.dtsi b/arch/arm64/boot/dts/renesas/r8a774e1.dtsi
index d76aec73aa28..3a3490adc8a0 100644
--- a/arch/arm64/boot/dts/renesas/r8a774e1.dtsi
+++ b/arch/arm64/boot/dts/renesas/r8a774e1.dtsi
@@ -34,6 +34,49 @@
clock-frequency = <0>;
};

+ cluster0_opp: opp_table0 {
+ compatible = "operating-points-v2";
+ opp-shared;
+
+ opp-500000000 {
+ opp-hz = /bits/ 64 <500000000>;
+ opp-microvolt = <820000>;
+ clock-latency-ns = <300000>;
+ };
+ opp-1000000000 {
+ opp-hz = /bits/ 64 <1000000000>;
+ opp-microvolt = <820000>;
+ clock-latency-ns = <300000>;
+ };
+ opp-1500000000 {
+ opp-hz = /bits/ 64 <1500000000>;
+ opp-microvolt = <820000>;
+ clock-latency-ns = <300000>;
+ opp-suspend;
+ };
+ };
+
+ cluster1_opp: opp_table1 {
+ compatible = "operating-points-v2";
+ opp-shared;
+
+ opp-800000000 {
+ opp-hz = /bits/ 64 <800000000>;
+ opp-microvolt = <820000>;
+ clock-latency-ns = <300000>;
+ };
+ opp-1000000000 {
+ opp-hz = /bits/ 64 <1000000000>;
+ opp-microvolt = <820000>;
+ clock-latency-ns = <300000>;
+ };
+ opp-1200000000 {
+ opp-hz = /bits/ 64 <1200000000>;
+ opp-microvolt = <820000>;
+ clock-latency-ns = <300000>;
+ };
+ };
+
cpus {
#address-cells = <1>;
#size-cells = <0>;
@@ -79,6 +122,7 @@
enable-method = "psci";
dynamic-power-coefficient = <854>;
clocks = <&cpg CPG_CORE R8A774E1_CLK_Z>;
+ operating-points-v2 = <&cluster0_opp>;
capacity-dmips-mhz = <1024>;
#cooling-cells = <2>;
};
@@ -91,6 +135,7 @@
next-level-cache = <&L2_CA57>;
enable-method = "psci";
clocks = <&cpg CPG_CORE R8A774E1_CLK_Z>;
+ operating-points-v2 = <&cluster0_opp>;
capacity-dmips-mhz = <1024>;
#cooling-cells = <2>;
};
@@ -103,6 +148,7 @@
next-level-cache = <&L2_CA57>;
enable-method = "psci";
clocks = <&cpg CPG_CORE R8A774E1_CLK_Z>;
+ operating-points-v2 = <&cluster0_opp>;
capacity-dmips-mhz = <1024>;
#cooling-cells = <2>;
};
@@ -115,6 +161,7 @@
next-level-cache = <&L2_CA57>;
enable-method = "psci";
clocks = <&cpg CPG_CORE R8A774E1_CLK_Z>;
+ operating-points-v2 = <&cluster0_opp>;
capacity-dmips-mhz = <1024>;
#cooling-cells = <2>;
};
@@ -129,6 +176,7 @@
#cooling-cells = <2>;
dynamic-power-coefficient = <277>;
clocks = <&cpg CPG_CORE R8A774E1_CLK_Z2>;
+ operating-points-v2 = <&cluster1_opp>;
capacity-dmips-mhz = <535>;
};

@@ -140,6 +188,7 @@
next-level-cache = <&L2_CA53>;
enable-method = "psci";
clocks = <&cpg CPG_CORE R8A774E1_CLK_Z2>;
+ operating-points-v2 = <&cluster1_opp>;
capacity-dmips-mhz = <535>;
};

@@ -151,6 +200,7 @@
next-level-cache = <&L2_CA53>;
enable-method = "psci";
clocks = <&cpg CPG_CORE R8A774E1_CLK_Z2>;
+ operating-points-v2 = <&cluster1_opp>;
capacity-dmips-mhz = <535>;
};

@@ -162,6 +212,7 @@
next-level-cache = <&L2_CA53>;
enable-method = "psci";
clocks = <&cpg CPG_CORE R8A774E1_CLK_Z2>;
+ operating-points-v2 = <&cluster1_opp>;
capacity-dmips-mhz = <535>;
};

--
2.17.1

This patch series add RZ/G2H SoC support for OPP/Thermal/Timer/CAN[FD]
to 4.19.y cip kernel.

All the patches in this series are cherry-picked from ML.

This patch series depend upon [1]
[1]: https://patchwork.kernel.org/project/cip-dev/list/?series=336609

Dien Pham (1):
thermal/drivers/rcar_gen3: Fix undefined temperature if negative

Geert Uytterhoeven (1):
can: rcar_can: Remove unused platform data support

Lad Prabhakar (1):
arm64: dts: renesas: r8a774e1: Add CAN[FD] support

Marian-Cristian Rotariu (5):
arm64: dts: renesas: r8a774e1: Add operating points
thermal: rcar_gen3_thermal: Add r8a774e1 support
arm64: dts: renesas: r8a774e1: Add RZ/G2H thermal support
arm64: dts: renesas: r8a774e1: Add CMT device nodes
arm64: dts: renesas: r8a774e1: Add TMU device nodes

Niklas Söderlund (2):
thermal: rcar_gen3_thermal: Remove temperature bound
thermal: rcar_gen3_thermal: Generate interrupt when temperature
changes

arch/arm64/boot/dts/renesas/r8a774e1.dtsi | 323 +++++++++++++++++++++-
drivers/net/can/rcar/rcar_can.c | 22 +-
drivers/thermal/rcar_gen3_thermal.c | 34 +--
include/linux/can/platform/rcar_can.h | 18 --
4 files changed, 347 insertions(+), 50 deletions(-)
delete mode 100644 include/linux/can/platform/rcar_can.h

--
2.17.1

On 25.08.20 07:33, nobuhiro1.iwamatsu@toshiba.co.jp wrote:

Hi,

-----Original Message-----
From: Jan Kiszka [mailto:jan.kiszka@siemens.com]
Sent: Saturday, August 22, 2020 1:45 AM
To: iwamatsu nobuhiro(岩松 信洋 □ＳＷＣ◯ＡＣＴ) <nobuhiro1.iwamatsu@toshiba.co.jp>; cip-dev@lists.cip-project.org
Subject: Re: [isar-cip-core][PATCH 1/2] ci: Rewrite using extends

On 21.08.20 17:04, Jan Kiszka wrote:

On 20.08.20 10:24, Nobuhiro Iwamatsu wrote:

Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
---
.gitlab-ci.yml | 70 +++++++++++++++++++++++++++++---------
scripts/deploy-cip-core.sh | 8 +++--
2 files changed, 60 insertions(+), 18 deletions(-)

<snip>

-if [ -n "$DTB" ]; then
+if [ "$DTB" != "none" ]; then
aws s3 cp --no-progress

build/tmp/work/cip-core-*/linux-cip*/*/linux-cip-*/debian/linux-image-cip*/usr/lib/linux-image-*/$DTB
s3://download.cip-project.org/cip-core/$TARGET/

fi

Unfortunately, this scale out to multiple jobs seem to cause download
issues, see e.g.

- https://gitlab.com/cip-project/cip-core/isar-cip-core/-/jobs/697844276
- https://gitlab.com/cip-project/cip-core/isar-cip-core/-/jobs/696946649

First thought it was a sporadic hic-up, but it reoccurs, now with
master. Is kernel.org throttling us here?

This may be a burden on kernel.org as snapshot reconstructs the image
on the server side. I'm not sure, when downloading images continuously,
access may be controlled by kernel.org.

So we need to avoid that for now, I guess. Back to single-job build, or
do we have an alternative download source?

And I'm afraid there is more broken, namely in the deployment that is
only triggered over master. Please have a look at the failing jobs.

I don't have no idea about this.
If we retry the test, it is successful and there may be other causes.

The wic image names changed, and that broke compression and uploading.

Jan

--
Siemens AG, Corporate Technology, CT RDA IOT SES-DE
Corporate Competence Center Embedded Linux

Hi,

On 21.08.20 18:44, Jan Kiszka wrote:

On 21.08.20 17:04, Jan Kiszka wrote:

On 20.08.20 10:24, Nobuhiro Iwamatsu wrote:

Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
---
.gitlab-ci.yml | 70 +++++++++++++++++++++++++++++---------
scripts/deploy-cip-core.sh | 8 +++--
2 files changed, 60 insertions(+), 18 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 3fe7af2..e23345f 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2,10 +2,17 @@ image: kasproject/kas-isar:1.1

variables:
GIT_STRATEGY: clone
+ release: buster
+ extention: base
+ use_rt: enable
+ targz: enable
+ dtb: none

-all:
- stage: build
- script:
+stages:
+ - build
+
+default:
+ before_script:
- export http_proxy=$HTTP_PROXY
- export https_proxy=$HTTPS_PROXY
- export ftp_proxy=$FTP_PROXY
@@ -13,20 +20,51 @@ all:
- export AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID
- export AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY

- - kas build kas-cip.yml:kas/board/simatic-ipc227e.yml:kas/opt/rt.yml:kas/opt/targz-img.yml
- - scripts/deploy-cip-core.sh buster simatic-ipc227e
-
+.build_base:
+ stage: build
+ variables:
+ base_yaml: "kas-cip.yml:kas/board/${target}.yml"
+ script:
- sudo rm -rf build/tmp
- - kas build kas-cip.yml:kas/board/bbb.yml:kas/opt/rt.yml:kas/opt/targz-img.yml
- - scripts/deploy-cip-core.sh buster bbb am335x-boneblack.dtb
+ - if [ "${use_rt}" = "enable" ]; then base_yaml="${base_yaml}:kas/opt/rt.yml"; fi;
+ - if [ "${extention}" != "base" ]; then base_yaml="${base_yaml}:kas/opt/${extention}.yml"; fi;
+ - if [ "${targz}" = "enable" ]; then base_yaml="${base_yaml}:kas/opt/targz-img.yml"; fi;
+ - kas build ${base_yaml}
+ - scripts/deploy-cip-core.sh ${release} ${target} ${extention} ${dtb}

- - sudo rm -rf build/tmp
- - kas build kas-cip.yml:kas/board/iwg20m.yml:kas/opt/rt.yml:kas/opt/targz-img.yml
- - scripts/deploy-cip-core.sh buster iwg20m r8a7743-iwg20d-q7-dbcm-ca.dtb
+# base image
+build:simatic-ipc227e-base:
+ extends:
+ - .build_base
+ variables:
+ target: simatic-ipc227e

- - sudo rm -rf build/tmp
- - kas build kas-cip.yml:kas/board/rzg2m.yml:kas/opt/rt.yml:kas/opt/targz-img.yml
- - scripts/deploy-cip-core.sh buster hihope-rzg2m renesas/r8a774a1-hihope-rzg2m-ex.dtb
+build:bbb-base:
+ extends:
+ - .build_base
+ variables:
+ target: bbb
+ dtb: am335x-boneblack.dtb

- - sudo rm -rf build/tmp
- - kas build kas-cip.yml:kas/board/qemu-amd64.yml:kas/opt/security.yml
+build:iwg20m-base:
+ extends:
+ - .build_base
+ variables:
+ target: iwg20m
+ dtb: r8a7743-iwg20d-q7-dbcm-ca.dtb
+
+build:hihope-rzg2m-base:
+ extends:
+ - .build_base
+ variables:
+ target: rzg2m
+ dtb: renesas/r8a774a1-hihope-rzg2m-ex.dtb
+
+build:qemu-amd64-base:
+ extends:
+ - .build_base
+ variables:
+ target: qemu-amd64
+ extention: security
+ use_rt: disable
+ targz: disable
diff --git a/scripts/deploy-cip-core.sh b/scripts/deploy-cip-core.sh
index 4c8d4c9..5b7eab9 100755
--- a/scripts/deploy-cip-core.sh
+++ b/scripts/deploy-cip-core.sh
@@ -16,9 +16,13 @@ fi

RELEASE=$1
TARGET=$2
-DTB=$3
+EXTENSION=$3
+DTB=$4

BASE_PATH=build/tmp/deploy/images/$TARGET/cip-core-image-cip-core-$RELEASE-$TARGET
+if [ "${EXTENSION}" != "base" ] ; then
+ BASE_PATH=build/tmp/deploy/images/$TARGET/cip-core-image-cip-core-$RELEASE-$TARGET-$EXTENSION
+fi

echo "Compressing cip-core-image-cip-core-$RELEASE-$TARGET.wic.img..."
xz -9 -k $BASE_PATH.wic.img
@@ -38,6 +42,6 @@ fi
aws s3 cp --no-progress $KERNEL_IMAGE s3://download.cip-project.org/cip-core/$TARGET/
aws s3 cp --no-progress $BASE_PATH-initrd.img s3://download.cip-project.org/cip-core/$TARGET/

-if [ -n "$DTB" ]; then
+if [ "$DTB" != "none" ]; then
aws s3 cp --no-progress build/tmp/work/cip-core-*/linux-cip*/*/linux-cip-*/debian/linux-image-cip*/usr/lib/linux-image-*/$DTB s3://download.cip-project.org/cip-core/$TARGET/
fi

Unfortunately, this scale out to multiple jobs seem to cause download
issues, see e.g.

- https://gitlab.com/cip-project/cip-core/isar-cip-core/-/jobs/697844276
- https://gitlab.com/cip-project/cip-core/isar-cip-core/-/jobs/696946649

First thought it was a sporadic hic-up, but it reoccurs, now with
master. Is kernel.org throttling us here?

And I'm afraid there is more broken, namely in the deployment that is
only triggered over master. Please have a look at the failing jobs.

Ping - or should I revert those two for now?

Jan

--
Siemens AG, Corporate Technology, CT RDA IOT SES-DE
Corporate Competence Center Embedded Linux

Hi Pavel,

Thanks for the feedback.

Subject: Re: [PATCH 4.19.y-cip 01/12] arm64: dts: renesas: r8a774a1-hihope-
rzg2m[-ex/-ex-idk-1110wr]: Rename HiHope RZ/G2M boards

Hi!

Ok, so this is anti-social:

-dtb-$(CONFIG_ARCH_R8A774A1) += r8a774a1-hihope-rzg2m.dtb
+dtb-$(CONFIG_ARCH_R8A774A1) += r8a774a1-hihope-rzg2m-rev2.dtb

This renames dts away, but at the end of series, new dts is created
with the r8a774a1-hihope-rzg2m.dts name, but this time it is for rev4 (not

rev2) board.

So... people with rev2 boards and existing build script will get rev4 dts..
without any error.

Yes, that is true. But if you agree, We need to use our latest/greatest

SoC/board as the main SoC/Board and rest are with explicit revision in
dts/dtb .

I believe it would be better to always use explicit revision in these cases;
anything else is fairly confusing, as kernel update breaks your setup (aka a
regresssion).

Now, if -rev2 had few copies, and people really have -rev4, there will not be
much breakage. But imagine if rare -rev5 is released in future...

But mainline already made the choice. I'd just prefer not making same choice
in future.

Now, what to do here? One way would be to apply a series, but add a
README.cip file explaining incompatible change (and any future stuff people
need to know).

OK. Either README.cip or " by including more information on the reference hardware and test information on CIP wiki." as suggested by Nobuhiro.
Please let us know, How do we want to proceed?

Cheers,
Biju


Renesas Electronics Europe GmbH, Geschaeftsfuehrer/President: Carsten Jauch, Sitz der Gesellschaft/Registered office: Duesseldorf, Arcadiastrasse 10, 40472 Duesseldorf, Germany, Handelsregister/Commercial Register: Duesseldorf, HRB 3708 USt-IDNr./Tax identification no.: DE 119353406 WEEE-Reg.-Nr./WEEE reg. no.: DE 14978647

On 8/21/20 4:45 PM, Jan Kiszka wrote:

On 21.08.20 11:55, Q. Gylstorff wrote:

From: Quirin Gylstorff <quirin.gylstorff@siemens.com>

As the usage of a unified kernel image freeze the kernel commmandline
during build time the rootfs selection for swupdate can no longer be
done with the kernel commandline and must be done later in the boot
process. Read the root filesystem /etc/os-release and check if it contains
the same uuid as stored in the initramfs . If the uuids are the same
boot the root file system.

Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
---
classes/image_uuid.bbclass | 33 ++++++++
.../files/initramfs.image_uuid.hook | 33 ++++++++
.../files/initramfs.lsblk.hook | 29 +++++++
.../initramfs-config/files/postinst.ext | 3 +
.../initramfs-config/files/postinst.tmpl | 31 ++++++++
.../files/secure-boot-debian-local-patch | 79 +++++++++++++++++++
.../initramfs-abrootfs-secureboot_0.1.bb | 38 +++++++++
7 files changed, 246 insertions(+)
create mode 100644 classes/image_uuid.bbclass
create mode 100644 recipes-support/initramfs-config/files/initramfs.image_uuid.hook
create mode 100644 recipes-support/initramfs-config/files/initramfs.lsblk.hook
create mode 100644 recipes-support/initramfs-config/files/postinst.ext
create mode 100644 recipes-support/initramfs-config/files/postinst.tmpl
create mode 100644 recipes-support/initramfs-config/files/secure-boot-debian-local-patch
create mode 100644 recipes-support/initramfs-config/initramfs-abrootfs-secureboot_0.1.bb

diff --git a/classes/image_uuid.bbclass b/classes/image_uuid.bbclass
new file mode 100644
index 0000000..d5337b8
--- /dev/null
+++ b/classes/image_uuid.bbclass
@@ -0,0 +1,33 @@
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2020
+#
+# Authors:
+# Quirin Gylstorff <quirin.gylstorff@siemens.com>
+#
+# SPDX-License-Identifier: MIT
+#
+
+def generate_image_uuid(d):
+ import uuid
+
+ base_hash = d.getVar("BB_BASEHASH_task-do_rootfs_install", True)
+ if base_hash is None:
+ return None
+ return str(uuid.UUID(base_hash[:32], version=4))
+
+IMAGE_UUID ?= "${@generate_image_uuid(d)}"
+
+do_generate_image_uuid[vardeps] += "IMAGE_UUID"
+do_generate_image_uuid[depends] = "buildchroot-target:do_build"
+do_generate_image_uuid() {
+ sudo sed -i '/^IMAGE_UUID=.*/d' '${IMAGE_ROOTFS}/etc/os-release'
+ echo "IMAGE_UUID=\"${IMAGE_UUID}\"" | \
+ sudo tee -a '${IMAGE_ROOTFS}/etc/os-release'
+ image_do_mounts
+
+ # update initramfs to add uuid
+ sudo chroot '${IMAGE_ROOTFS}' update-initramfs -u
+}
+addtask generate_image_uuid before do_copy_boot_files after do_rootfs_install
diff --git a/recipes-support/initramfs-config/files/initramfs.image_uuid.hook b/recipes-support/initramfs-config/files/initramfs.image_uuid.hook
new file mode 100644
index 0000000..910ce84
--- /dev/null
+++ b/recipes-support/initramfs-config/files/initramfs.image_uuid.hook
@@ -0,0 +1,33 @@
+# This software is a part of ISAR.
+# Copyright (C) Siemens AG, 2020
+#
+# SPDX-License-Identifier: MIT
+
+#!/bin/sh
+set -x
+PREREQ=""
+
+prereqs()
+{
+ echo "$PREREQ"
+}
+
+case $1 in
+prereqs)
+ prereqs
+ exit 0
+ ;;
+esac
+
+. /usr/share/initramfs-tools/scripts/functions
+. /usr/share/initramfs-tools/hook-functions
+
+if [ ! -e /etc/os-release ]; then
+ echo "Warning: couldn't find /etc/os-release!"
+ exit 0
+fi
+
+IMAGE_UUID=$(sed -n 's/^IMAGE_UUID="\(.*\)"/\1/p' /etc/os-release)
+echo "${IMAGE_UUID}" > "${DESTDIR}/conf/image_uuid"
+
+exit 0
\ No newline at end of file
diff --git a/recipes-support/initramfs-config/files/initramfs.lsblk.hook b/recipes-support/initramfs-config/files/initramfs.lsblk.hook
new file mode 100644
index 0000000..cf32404
--- /dev/null
+++ b/recipes-support/initramfs-config/files/initramfs.lsblk.hook
@@ -0,0 +1,29 @@
+# This software is a part of ISAR.
+# Copyright (C) Siemens AG, 2020
+#
+# SPDX-License-Identifier: MIT
+
+#!/bin/sh
+PREREQ=""
+
+prereqs()
+{
+ echo "$PREREQ"
+}
+
+case $1 in
+prereqs)
+ prereqs
+ exit 0
+ ;;
+esac
+
+. /usr/share/initramfs-tools/scripts/functions
+. /usr/share/initramfs-tools/hook-functions
+
+if [ ! -x /usr/bin/lsblk ]; then
+ echo "Warning: couldn't find /usr/bin/lsblk!"
+ exit 0
+fi
+
+copy_exec /usr/bin/lsblk
diff --git a/recipes-support/initramfs-config/files/postinst.ext b/recipes-support/initramfs-config/files/postinst.ext
new file mode 100644
index 0000000..cdafa74
--- /dev/null
+++ b/recipes-support/initramfs-config/files/postinst.ext
@@ -0,0 +1,3 @@
+if [ -d /usr/share/secureboot ]; then
+ patch -s -p0 /usr/share/initramfs-tools/scripts/local /usr/share/secureboot/secure-boot-debian-local.patch
+fi
diff --git a/recipes-support/initramfs-config/files/postinst.tmpl b/recipes-support/initramfs-config/files/postinst.tmpl
new file mode 100644
index 0000000..008f68d
--- /dev/null
+++ b/recipes-support/initramfs-config/files/postinst.tmpl
@@ -0,0 +1,31 @@
+#!/bin/sh
+if [ -d /usr/share/secureboot ]; then
+ patch -s -p0 /usr/share/initramfs-tools/scripts/local /usr/share/secureboot/secure-boot-debian-local.patch
+fi
+
+INITRAMFS_CONF=/etc/initramfs-tools/initramfs.conf
+if [ -f ${INITRAMFS_CONF} ]; then
+ sed -i -E 's/(^MODULES=).*/\1${INITRAMFS_MODULES}/' ${INITRAMFS_CONF}
+ sed -i -E 's/(^BUSYBOX=).*/\1${INITRAMFS_BUSYBOX}/' ${INITRAMFS_CONF}
+ sed -i -E 's/(^COMPRESS=).*/\1${INITRAMFS_COMPRESS}/' ${INITRAMFS_CONF}
+ sed -i -E 's/(^KEYMAP=).*/\1${INITRAMFS_KEYMAP}/' ${INITRAMFS_CONF}
+ sed -i -E 's/(^DEVICE=).*/\1${INITRAMFS_NET_DEVICE}/' ${INITRAMFS_CONF}
+ sed -i -E 's/(^NFSROOT=).*/\1${INITRAMFS_NFSROOT}/' ${INITRAMFS_CONF}
+ sed -i -E 's/(^RUNSIZE=).*/\1${INITRAMFS_RUNSIZE}/' ${INITRAMFS_CONF}
+ if grep -Fxq "ROOT=" "${INITRAMFS_CONF}"; then
+ sed -i -E 's/(^ROOT=).*/\1${INITRAMFS_ROOT}/' ${INITRAMFS_CONF}
+ else
+ sed -i -E "\$aROOT=${INITRAMFS_ROOT}" ${INITRAMFS_CONF}
+ fi
+fi
+
+MODULES_LIST_FILE=/etc/initramfs-tools/modules
+if [ -f ${MODULES_LIST_FILE} ]; then
+ for modname in ${INITRAMFS_MODULE_LIST}; do
+ if ! grep -Fxq "$modname" "${MODULES_LIST_FILE}"; then
+ echo "$modname" >> "${MODULES_LIST_FILE}"
+ fi
+ done
+fi
+
+update-initramfs -v -u
diff --git a/recipes-support/initramfs-config/files/secure-boot-debian-local-patch b/recipes-support/initramfs-config/files/secure-boot-debian-local-patch
new file mode 100644
index 0000000..219578c
--- /dev/null
+++ b/recipes-support/initramfs-config/files/secure-boot-debian-local-patch
@@ -0,0 +1,79 @@
+--- local 2020-07-02 14:59:15.461895194 +0200
++++ ../../../../../../../../../../../recipes-support/initramfs-config/files/local 2020-07-02 14:58:58.405730914 +0200
+@@ -1,5 +1,4 @@
+ # Local filesystem mounting -*- shell-script -*-
+-
+ local_top()
+ {
+ if [ "${local_top_used}" != "yes" ]; then
+@@ -155,34 +154,47 @@
+ local_mount_root()
+ {
+ local_top
+- if [ -z "${ROOT}" ]; then
+- panic "No root device specified. Boot arguments must include a root= parameter."
+- fi
+- local_device_setup "${ROOT}" "root file system"
+- ROOT="${DEV}"
+-
+- # Get the root filesystem type if not set
+- if [ -z "${ROOTFSTYPE}" ] || [ "${ROOTFSTYPE}" = auto ]; then
+- FSTYPE=$(get_fstype "${ROOT}")
+- else
+- FSTYPE=${ROOTFSTYPE}
++ if [ ! -e /conf/image_uuid ]; then
++ panic "could not find image_uuid to select correct root file system"
+ fi
++ local INITRAMFS_IMAGE_UUID=$(cat /conf/image_uuid)
++ local partitions=$(blkid -o device)
++ for part in $partitions; do
++ if [ "$(blkid -p ${part} --match-types novfat -s USAGE -o value)" = "filesystem" ]; then
++ local_device_setup "${part}" "root file system"
++ ROOT="${DEV}"
++
++ # Get the root filesystem type if not set
++ if [ -z "${ROOTFSTYPE}" ] || [ "${ROOTFSTYPE}" = auto ]; then
++ FSTYPE=$(get_fstype "${ROOT}")
++ else
++ FSTYPE=${ROOTFSTYPE}
++ fi
+
+- local_premount
++ local_premount
+
+- if [ "${readonly?}" = "y" ]; then
+- roflag=-r
+- else
+- roflag=-w
+- fi
++ if [ "${readonly?}" = "y" ]; then
++ roflag=-r
++ else
++ roflag=-w
++ fi
++ checkfs "${ROOT}" root "${FSTYPE}"
+
+- checkfs "${ROOT}" root "${FSTYPE}"
++ # Mount root
++ # shellcheck disable=SC2086
++ if mount ${roflag} ${FSTYPE:+-t "${FSTYPE}"} ${ROOTFLAGS} "${ROOT}" "${rootmnt?}"; then
++ if [ -e "${rootmnt?}"/etc/os-release ]; then
++ image_uuid=$(sed -n 's/^IMAGE_UUID=//p' "${rootmnt?}"/etc/os-release | tr -d '"' )
++ if [ "${INITRAMFS_IMAGE_UUID}" = "${image_uuid}" ]; then
++ return
++ fi
++ fi
++ umount "${rootmnt?}"
++ fi
++ fi
++ done
++ panic "Could not find ROOTFS with matching UUID $INITRAMFS_IMAGE_UUID"
+
+- # Mount root
+- # shellcheck disable=SC2086
+- if ! mount ${roflag} ${FSTYPE:+-t "${FSTYPE}"} ${ROOTFLAGS} "${ROOT}" "${rootmnt?}"; then
+- panic "Failed to mount ${ROOT} as root file system."
+- fi
+ }
+
+ local_mount_fs()
diff --git a/recipes-support/initramfs-config/initramfs-abrootfs-secureboot_0.1.bb b/recipes-support/initramfs-config/initramfs-abrootfs-secureboot_0.1.bb
new file mode 100644
index 0000000..0be9871
--- /dev/null
+++ b/recipes-support/initramfs-config/initramfs-abrootfs-secureboot_0.1.bb
@@ -0,0 +1,38 @@
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2020
+#
+# Authors:
+# Quirin Gylstorff <quirin.gylstorff@siemens.com>
+#
+# SPDX-License-Identifier: MIT
+
+require recipes-support/initramfs-config/initramfs-config.inc
+
+FILESPATH =. "${LAYERDIR_isar-siemens}/recipes-support/initramfs-config/files:"
+
+DEBIAN_DEPENDS += ", busybox, patch"
+
+SRC_URI += "file://postinst.ext \
+ file://initramfs.lsblk.hook \
+ file://initramfs.image_uuid.hook \
+ file://secure-boot-debian-local-patch"
+
+INITRAMFS_BUSYBOX = "y"
+
+do_install() {
+ # add patch for local to /usr/share/secure boot
+ TARGET=${D}/usr/share/secureboot
+ install -m 0755 -d ${TARGET}
+ install -m 0644 ${WORKDIR}/secure-boot-debian-local-patch ${TARGET}/secure-boot-debian-local.patch
+ # patch postinst
+ sed -i -e '/configure)/r ${WORKDIR}/postinst.ext' ${WORKDIR}/postinst
+
+ # add hooks for secure boot
+ HOOKS=${D}/etc/initramfs-tools/hooks
+install -m 0755 -d ${HOOKS}
+ install -m 0740 ${WORKDIR}/initramfs.lsblk.hook ${HOOKS}/lsblk.hook
+ install -m 0740 ${WORKDIR}/initramfs.image_uuid.hook ${HOOKS}/image_uuid.hook

Fixed this indention while merging.

Thanks.

+}
+addtask do_install after do_transform_template

Jan

--
Quirin

Hi,

Hi,

Hi,

Hi!

*** gpg4o | The signature of this email could not be verified because the
following public key is missing. Click here to search and import the key
30E7F06A95DBFAF2 ***

Hi!

This patch series for supporting RZ/G2[MN] rev4 board to cip-4.19.y
kernel.

  arch/arm64/boot/dts/renesas/r8a774a1.dtsi | 11 -----------
  1 file changed, 11 deletions(-)

I'm pretty sure this is not the real diffstat.

Let me go through the changes. One concern: you are renaming dts
files. New names make a lot of sense, but that will likely break the
users, including our test infrastructure, no?

Technically yes, it would cause problems. However this seems to be
the way of doing things upstream. I guess upstream is a bit
different though as users would expect such things when upgrading
Kernel versions.

Yes, it is upstream problem, and should be fixed upstream.

And no, not even upgrading kernel versions should break anything.

lab-cip-renesas uses rev4 boards, so from a CIP testing point of
view there will be no issues.

Ok, good to know, it seems -rev2 boards are kind of rare?

I guess we could create "README.cip" explaining such non-standard
issues, and mention it in release changelog.

Best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

Hi!

Ok, so this is anti-social:

-dtb-$(CONFIG_ARCH_R8A774A1) += r8a774a1-hihope-rzg2m.dtb
+dtb-$(CONFIG_ARCH_R8A774A1) += r8a774a1-hihope-rzg2m-rev2.dtb

This renames dts away, but at the end of series, new dts is created with the
r8a774a1-hihope-rzg2m.dts name, but this time it is for rev4 (not rev2) board.

So... people with rev2 boards and existing build script will get rev4 dts..
without any error.

Yes, that is true. But if you agree, We need to use our latest/greatest SoC/board as the main SoC/Board and rest are with explicit revision in dts/dtb .

I believe it would be better to always use explicit revision in these
cases; anything else is fairly confusing, as kernel update breaks your
setup (aka a regresssion).

Now, if -rev2 had few copies, and people really have -rev4, there will
not be much breakage. But imagine if rare -rev5 is released in future...

But mainline already made the choice. I'd just prefer not making same
choice in future.

Now, what to do here? One way would be to apply a series, but add a
README.cip file explaining incompatible change (and any future stuff
people need to know).

Best regards,

Pavel
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

Hi!

This patch series add support for IPMMU/SYS-DMAC/GPIO/EAVB on
HiHope RZ/G2H board based on R8A774E1 SoC.

This patches in this series are cherry-picked from mainline.

This patch series depend upon [1]
[1]:
https://patchwork.kernel.org/project/cip-dev/list/?series=336489

This series looks ok to me, too.

Best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

Hi!

This patch series add basic support for Hihope RZ/G2H based on
r8a774e1 SoC to 4.19.y-cip kernel. All patches in this series
are cherry-picked from mainline.

This patch series depends on [1]
[1]:
https://patchwork.kernel.org/project/cip-dev/list/?series=335409

For the record, these patches look good to me.

So we need to decide what to do with that dependency.

Best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

Hi all,

CIP kernel team has released Linux kernel v4.19.140-cip33.
The linux-4.19.y-cip tree has been updated base version from v4.19.138
to v4.19.140, and the fix about DRM is added.

You can get this release via the git tree at:

v4.19.140-cip33:
repository:
https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git
branch:
linux-4.19.y-cip
commit hash:
03cdb749e6350f0403badbf7931e420ea7514f56
added commits:
CIP: Bump version suffix to -cip33 after merge from stable
drm: atomic helper: fix W=1 warnings
drm: Add drm_atomic_get_old/new_private_obj_state
drm: of: Fix linking when CONFIG_OF is not set

Best regards,
Nobuhiro

On 21.08.20 17:04, Jan Kiszka wrote:

On 20.08.20 10:24, Nobuhiro Iwamatsu wrote:

Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
---
.gitlab-ci.yml | 70 +++++++++++++++++++++++++++++---------
scripts/deploy-cip-core.sh | 8 +++--
2 files changed, 60 insertions(+), 18 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 3fe7af2..e23345f 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2,10 +2,17 @@ image: kasproject/kas-isar:1.1

variables:
GIT_STRATEGY: clone
+ release: buster
+ extention: base
+ use_rt: enable
+ targz: enable
+ dtb: none

-all:
- stage: build
- script:
+stages:
+ - build
+
+default:
+ before_script:
- export http_proxy=$HTTP_PROXY
- export https_proxy=$HTTPS_PROXY
- export ftp_proxy=$FTP_PROXY
@@ -13,20 +20,51 @@ all:
- export AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID
- export AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY

- - kas build kas-cip.yml:kas/board/simatic-ipc227e.yml:kas/opt/rt.yml:kas/opt/targz-img.yml
- - scripts/deploy-cip-core.sh buster simatic-ipc227e
-
+.build_base:
+ stage: build
+ variables:
+ base_yaml: "kas-cip.yml:kas/board/${target}.yml"
+ script:
- sudo rm -rf build/tmp
- - kas build kas-cip.yml:kas/board/bbb.yml:kas/opt/rt.yml:kas/opt/targz-img.yml
- - scripts/deploy-cip-core.sh buster bbb am335x-boneblack.dtb
+ - if [ "${use_rt}" = "enable" ]; then base_yaml="${base_yaml}:kas/opt/rt.yml"; fi;
+ - if [ "${extention}" != "base" ]; then base_yaml="${base_yaml}:kas/opt/${extention}.yml"; fi;
+ - if [ "${targz}" = "enable" ]; then base_yaml="${base_yaml}:kas/opt/targz-img.yml"; fi;
+ - kas build ${base_yaml}
+ - scripts/deploy-cip-core.sh ${release} ${target} ${extention} ${dtb}

- - sudo rm -rf build/tmp
- - kas build kas-cip.yml:kas/board/iwg20m.yml:kas/opt/rt.yml:kas/opt/targz-img.yml
- - scripts/deploy-cip-core.sh buster iwg20m r8a7743-iwg20d-q7-dbcm-ca.dtb
+# base image
+build:simatic-ipc227e-base:
+ extends:
+ - .build_base
+ variables:
+ target: simatic-ipc227e

- - sudo rm -rf build/tmp
- - kas build kas-cip.yml:kas/board/rzg2m.yml:kas/opt/rt.yml:kas/opt/targz-img.yml
- - scripts/deploy-cip-core.sh buster hihope-rzg2m renesas/r8a774a1-hihope-rzg2m-ex.dtb
+build:bbb-base:
+ extends:
+ - .build_base
+ variables:
+ target: bbb
+ dtb: am335x-boneblack.dtb

- - sudo rm -rf build/tmp
- - kas build kas-cip.yml:kas/board/qemu-amd64.yml:kas/opt/security.yml
+build:iwg20m-base:
+ extends:
+ - .build_base
+ variables:
+ target: iwg20m
+ dtb: r8a7743-iwg20d-q7-dbcm-ca.dtb
+
+build:hihope-rzg2m-base:
+ extends:
+ - .build_base
+ variables:
+ target: rzg2m
+ dtb: renesas/r8a774a1-hihope-rzg2m-ex.dtb
+
+build:qemu-amd64-base:
+ extends:
+ - .build_base
+ variables:
+ target: qemu-amd64
+ extention: security
+ use_rt: disable
+ targz: disable
diff --git a/scripts/deploy-cip-core.sh b/scripts/deploy-cip-core.sh
index 4c8d4c9..5b7eab9 100755
--- a/scripts/deploy-cip-core.sh
+++ b/scripts/deploy-cip-core.sh
@@ -16,9 +16,13 @@ fi

RELEASE=$1
TARGET=$2
-DTB=$3
+EXTENSION=$3
+DTB=$4

BASE_PATH=build/tmp/deploy/images/$TARGET/cip-core-image-cip-core-$RELEASE-$TARGET
+if [ "${EXTENSION}" != "base" ] ; then
+ BASE_PATH=build/tmp/deploy/images/$TARGET/cip-core-image-cip-core-$RELEASE-$TARGET-$EXTENSION
+fi

echo "Compressing cip-core-image-cip-core-$RELEASE-$TARGET.wic.img..."
xz -9 -k $BASE_PATH.wic.img
@@ -38,6 +42,6 @@ fi
aws s3 cp --no-progress $KERNEL_IMAGE s3://download.cip-project.org/cip-core/$TARGET/
aws s3 cp --no-progress $BASE_PATH-initrd.img s3://download.cip-project.org/cip-core/$TARGET/

-if [ -n "$DTB" ]; then
+if [ "$DTB" != "none" ]; then
aws s3 cp --no-progress build/tmp/work/cip-core-*/linux-cip*/*/linux-cip-*/debian/linux-image-cip*/usr/lib/linux-image-*/$DTB s3://download.cip-project.org/cip-core/$TARGET/
fi

Unfortunately, this scale out to multiple jobs seem to cause download
issues, see e.g.

- https://gitlab.com/cip-project/cip-core/isar-cip-core/-/jobs/697844276
- https://gitlab.com/cip-project/cip-core/isar-cip-core/-/jobs/696946649

First thought it was a sporadic hic-up, but it reoccurs, now with
master. Is kernel.org throttling us here?

And I'm afraid there is more broken, namely in the deployment that is
only triggered over master. Please have a look at the failing jobs.

Thanks,
Jan

--
Siemens AG, Corporate Technology, CT RDA IOT SES-DE
Corporate Competence Center Embedded Linux

On 21.08.20 11:55, Q. Gylstorff wrote:

From: Quirin Gylstorff <quirin.gylstorff@siemens.com>

This patchset adds secureboot with efibootguard to cip-core.

The image build signs the efibootguard bootloader (bootx64.efi) and generates
a signed [unified kernel image](https://systemd.io/BOOT_LOADER_SPECIFICATION/).
A unified kernel image packs the kernel, initramfs and the kernel command-line
in one binary object. As the kernel command-line is immutable after the build
process, the previous selection of the root file system with a command-line parameter is no longer
possible. Therefore the selection of the root file-system occurs now in the initramfs.

The image uses an A/B partition layout to update the root file system. The sample implementation to
select the root file system generates a uuid and stores the id in /etc/os-release and in the initramfs.
During boot the initramfs compares its own uuid with the uuid stored in /etc/os-release of each rootfs.
If a match is found the rootfs is used for the boot.

Changes V2:

- rebase to [1]
- removed luahandler patch as it now part of [1]
- add handling for sw-description

Changes V3:

- rewrite the image id creation to ensure a new uuid is generated if a new package is
added or another change of the rootfs
- add readme section how to execute/test the software update mechnism
- adapt to version v3 of [1]
- update the patch
- add wks file for efibootguard and swupdate

[1]: a/b rootfsupdate with software update

Changes V4:

- rebase onto next 619edb509bd287277749580cbc842e57d5044756
- fix indent of ./start-qemu.sh
- whitespace fixes
- update libubootenv patch to v2
- update revision of cip-kernel-config to ca24d965adf77730caf1cd32bdfcffd69e369502
to boot secureboot with qemu
- swupdate swdescription for non-secure-boot images

Quirin Gylstorff (6):
linux-cip: Update revision of kernel config
isar-patch: Add initramfs-config patch
secure-boot: select boot partition in initramfs
secure-boot: Add secure boot with unified kernel image
secure-boot: Add Debian snakeoil keys for ease-of-use
doc: Add README for secureboot

classes/image_uuid.bbclass | 33 +++
conf/distro/debian-buster-backports.list | 1 +
conf/distro/preferences.ovmf-snakeoil.conf | 3 +
doc/README.secureboot.md | 229 ++++++++++++++++++
.../0001-u-boot-add-libubootenv.patch | 161 ++++++------
...-support-Generate-a-custom-initramfs.patch | 207 ++++++++++++++++
kas-cip.yml | 3 +
kas/opt/ebg-secure-boot-base.yml | 18 ++
kas/opt/ebg-secure-boot-snakeoil.yml | 28 +++
kas/opt/ebg-swu.yml | 4 +-
recipes-core/images/cip-core-image.bb | 12 +-
.../files/secure-boot/sw-description.tmpl | 29 +++
recipes-core/images/files/sw-description.tmpl | 19 +-
recipes-core/images/secureboot.inc | 21 ++
recipes-core/images/swupdate.inc | 21 ++
.../ebg-secure-boot-secrets_0.1.bb | 51 ++++
.../ebg-secure-boot-secrets/files/README.md | 1 +
.../files/control.tmpl | 12 +
.../files/sign_secure_image.sh.tmpl | 22 ++
.../ebg-secure-boot-snakeoil_0.1.bb | 34 +++
.../files/control.tmpl | 12 +
.../files/sign_secure_image.sh | 36 +++
.../ovmf-binaries/files/control.tmpl | 11 +
.../ovmf-binaries/ovmf-binaries_0.1.bb | 30 +++
recipes-kernel/linux/linux-cip-common.inc | 2 +-
.../files/initramfs.image_uuid.hook | 33 +++
.../files/initramfs.lsblk.hook | 29 +++
.../initramfs-config/files/postinst.ext | 3 +
.../files/secure-boot-debian-local-patch | 79 ++++++
.../initramfs-abrootfs-secureboot_0.1.bb | 38 +++
...enerate-sb-db-from-existing-certificate.sh | 16 ++
scripts/generate_secure_boot_keys.sh | 51 ++++
.../wic/plugins/source/efibootguard-boot.py | 87 ++++++-
.../wic/plugins/source/efibootguard-efi.py | 40 ++-
scripts/start-efishell.sh | 12 +
start-qemu.sh | 59 +++--
wic/ebg-signed-bootloader.inc | 2 +
wic/qemu-amd64-efibootguard-secureboot.wks | 9 +
wic/qemu-amd64-efibootguard.wks | 1 -
39 files changed, 1330 insertions(+), 129 deletions(-)
create mode 100644 classes/image_uuid.bbclass
create mode 100644 conf/distro/debian-buster-backports.list
create mode 100644 conf/distro/preferences.ovmf-snakeoil.conf
create mode 100644 doc/README.secureboot.md
create mode 100644 isar-patches/v7-0001-meta-support-Generate-a-custom-initramfs.patch
create mode 100644 kas/opt/ebg-secure-boot-base.yml
create mode 100644 kas/opt/ebg-secure-boot-snakeoil.yml
create mode 100644 recipes-core/images/files/secure-boot/sw-description.tmpl
create mode 100644 recipes-core/images/secureboot.inc
create mode 100644 recipes-core/images/swupdate.inc
create mode 100644 recipes-devtools/ebg-secure-boot-secrets/ebg-secure-boot-secrets_0.1.bb
create mode 100644 recipes-devtools/ebg-secure-boot-secrets/files/README.md
create mode 100644 recipes-devtools/ebg-secure-boot-secrets/files/control.tmpl
create mode 100644 recipes-devtools/ebg-secure-boot-secrets/files/sign_secure_image.sh.tmpl
create mode 100644 recipes-devtools/ebg-secure-boot-snakeoil/ebg-secure-boot-snakeoil_0.1.bb
create mode 100644 recipes-devtools/ebg-secure-boot-snakeoil/files/control.tmpl
create mode 100644 recipes-devtools/ebg-secure-boot-snakeoil/files/sign_secure_image.sh
create mode 100644 recipes-devtools/ovmf-binaries/files/control.tmpl
create mode 100644 recipes-devtools/ovmf-binaries/ovmf-binaries_0.1.bb
create mode 100644 recipes-support/initramfs-config/files/initramfs.image_uuid.hook
create mode 100644 recipes-support/initramfs-config/files/initramfs.lsblk.hook
create mode 100644 recipes-support/initramfs-config/files/postinst.ext
create mode 100644 recipes-support/initramfs-config/files/secure-boot-debian-local-patch
create mode 100644 recipes-support/initramfs-config/initramfs-abrootfs-secureboot_0.1.bb
create mode 100755 scripts/generate-sb-db-from-existing-certificate.sh
create mode 100755 scripts/generate_secure_boot_keys.sh
create mode 100755 scripts/start-efishell.sh
create mode 100644 wic/ebg-signed-bootloader.inc
create mode 100644 wic/qemu-amd64-efibootguard-secureboot.wks

I've taken this to next, but this also needs a hook-up with the CI system.

Thanks,
Jan

--
Siemens AG, Corporate Technology, CT RDA IOT SES-DE
Corporate Competence Center Embedded Linux

From: Jan Kiszka <jan.kiszka@siemens.com>

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---

Quirin, please check if this is actually an unconditional dep!

classes/swupdate-config.bbclass | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/classes/swupdate-config.bbclass b/classes/swupdate-config.bbclass
index 7ce51c5..42f0654 100644
--- a/classes/swupdate-config.bbclass
+++ b/classes/swupdate-config.bbclass
@@ -15,7 +15,7 @@ inherit kconfig-snippets

BUILD_DEB_DEPENDS = " \
zlib1g-dev, debhelper, libconfig-dev, libarchive-dev, \
- python-sphinx:native, dh-systemd, libsystemd-dev"
+ python-sphinx:native, dh-systemd, libsystemd-dev, libssl-dev"

KFEATURE_lua = ""
KFEATURE_lua[BUILD_DEB_DEPENDS] = "liblua5.3-dev"
--
2.26.2

--
Siemens AG, Corporate Technology, CT RDA IOT SES-DE
Corporate Competence Center Embedded Linux

On 20.08.20 10:24, Nobuhiro Iwamatsu wrote:

Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
---
.gitlab-ci.yml | 70 +++++++++++++++++++++++++++++---------
scripts/deploy-cip-core.sh | 8 +++--
2 files changed, 60 insertions(+), 18 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 3fe7af2..e23345f 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2,10 +2,17 @@ image: kasproject/kas-isar:1.1

variables:
GIT_STRATEGY: clone
+ release: buster
+ extention: base
+ use_rt: enable
+ targz: enable
+ dtb: none

-all:
- stage: build
- script:
+stages:
+ - build
+
+default:
+ before_script:
- export http_proxy=$HTTP_PROXY
- export https_proxy=$HTTPS_PROXY
- export ftp_proxy=$FTP_PROXY
@@ -13,20 +20,51 @@ all:
- export AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID
- export AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY

- - kas build kas-cip.yml:kas/board/simatic-ipc227e.yml:kas/opt/rt.yml:kas/opt/targz-img.yml
- - scripts/deploy-cip-core.sh buster simatic-ipc227e
-
+.build_base:
+ stage: build
+ variables:
+ base_yaml: "kas-cip.yml:kas/board/${target}.yml"
+ script:
- sudo rm -rf build/tmp
- - kas build kas-cip.yml:kas/board/bbb.yml:kas/opt/rt.yml:kas/opt/targz-img.yml
- - scripts/deploy-cip-core.sh buster bbb am335x-boneblack.dtb
+ - if [ "${use_rt}" = "enable" ]; then base_yaml="${base_yaml}:kas/opt/rt.yml"; fi;
+ - if [ "${extention}" != "base" ]; then base_yaml="${base_yaml}:kas/opt/${extention}.yml"; fi;
+ - if [ "${targz}" = "enable" ]; then base_yaml="${base_yaml}:kas/opt/targz-img.yml"; fi;
+ - kas build ${base_yaml}
+ - scripts/deploy-cip-core.sh ${release} ${target} ${extention} ${dtb}

- - sudo rm -rf build/tmp
- - kas build kas-cip.yml:kas/board/iwg20m.yml:kas/opt/rt.yml:kas/opt/targz-img.yml
- - scripts/deploy-cip-core.sh buster iwg20m r8a7743-iwg20d-q7-dbcm-ca.dtb
+# base image
+build:simatic-ipc227e-base:
+ extends:
+ - .build_base
+ variables:
+ target: simatic-ipc227e

- - sudo rm -rf build/tmp
- - kas build kas-cip.yml:kas/board/rzg2m.yml:kas/opt/rt.yml:kas/opt/targz-img.yml
- - scripts/deploy-cip-core.sh buster hihope-rzg2m renesas/r8a774a1-hihope-rzg2m-ex.dtb
+build:bbb-base:
+ extends:
+ - .build_base
+ variables:
+ target: bbb
+ dtb: am335x-boneblack.dtb

- - sudo rm -rf build/tmp
- - kas build kas-cip.yml:kas/board/qemu-amd64.yml:kas/opt/security.yml
+build:iwg20m-base:
+ extends:
+ - .build_base
+ variables:
+ target: iwg20m
+ dtb: r8a7743-iwg20d-q7-dbcm-ca.dtb
+
+build:hihope-rzg2m-base:
+ extends:
+ - .build_base
+ variables:
+ target: rzg2m
+ dtb: renesas/r8a774a1-hihope-rzg2m-ex.dtb
+
+build:qemu-amd64-base:
+ extends:
+ - .build_base
+ variables:
+ target: qemu-amd64
+ extention: security
+ use_rt: disable
+ targz: disable
diff --git a/scripts/deploy-cip-core.sh b/scripts/deploy-cip-core.sh
index 4c8d4c9..5b7eab9 100755
--- a/scripts/deploy-cip-core.sh
+++ b/scripts/deploy-cip-core.sh
@@ -16,9 +16,13 @@ fi

RELEASE=$1
TARGET=$2
-DTB=$3
+EXTENSION=$3
+DTB=$4

BASE_PATH=build/tmp/deploy/images/$TARGET/cip-core-image-cip-core-$RELEASE-$TARGET
+if [ "${EXTENSION}" != "base" ] ; then
+ BASE_PATH=build/tmp/deploy/images/$TARGET/cip-core-image-cip-core-$RELEASE-$TARGET-$EXTENSION
+fi

echo "Compressing cip-core-image-cip-core-$RELEASE-$TARGET.wic.img..."
xz -9 -k $BASE_PATH.wic.img
@@ -38,6 +42,6 @@ fi
aws s3 cp --no-progress $KERNEL_IMAGE s3://download.cip-project.org/cip-core/$TARGET/
aws s3 cp --no-progress $BASE_PATH-initrd.img s3://download.cip-project.org/cip-core/$TARGET/

-if [ -n "$DTB" ]; then
+if [ "$DTB" != "none" ]; then
aws s3 cp --no-progress build/tmp/work/cip-core-*/linux-cip*/*/linux-cip-*/debian/linux-image-cip*/usr/lib/linux-image-*/$DTB s3://download.cip-project.org/cip-core/$TARGET/
fi

Unfortunately, this scale out to multiple jobs seem to cause download
issues, see e.g.

- https://gitlab.com/cip-project/cip-core/isar-cip-core/-/jobs/697844276
- https://gitlab.com/cip-project/cip-core/isar-cip-core/-/jobs/696946649

First thought it was a sporadic hic-up, but it reoccurs, now with
master. Is kernel.org throttling us here?

Jan

--
Siemens AG, Corporate Technology, CT RDA IOT SES-DE
Corporate Competence Center Embedded Linux