Merge pull request #177 from qosmio/main-nss

Main nss 29/11

.github/labeler.yml

@@ -180,6 +180,13 @@
 - changed-files:
   - any-glob-to-any-file:
     - "target/linux/starfive/**"
+"target/stm32":
+- changed-files:
+  - any-glob-to-any-file:
+    - "target/linux/stm32/**"
+    - "package/boot/arm-trusted-firmware-stm32/**"
+    - "package/boot/optee-os-stm32/**"
+    - "package/boot/uboot-stm32/**"
 "target/sunxi":
 - changed-files:
   - any-glob-to-any-file:

config/Config-build.in

@@ -70,7 +70,7 @@ menu "Global build settings"
 
 	config USE_APK
 		imply PACKAGE_apk-mbedtls
-		bool "Use APK instead of OPKG to build distribution (EXPERIMENTAL)"
+		bool "Use APK instead of OPKG to build distribution"
 		default y
 
 	comment "General build options"
@@ -423,10 +423,9 @@ menu "Global build settings"
 
 	endchoice
 
-	config SECCOMP
+	config USE_SECCOMP
 		bool "Enable SECCOMP"
 		select KERNEL_SECCOMP
-		select PACKAGE_procd-seccomp
 		depends on (aarch64 || arm || armeb || mips || mipsel || mips64 || mips64el || i386 || powerpc || x86_64)
 		depends on !TARGET_uml
 		default y

config/Config-kernel.in

@@ -333,6 +333,25 @@ if KERNEL_TASKSTATS
 
 endif
 
+config KERNEL_PSI
+	bool "Compile the kernel with pressure stall information tracking"
+	help
+	  Collect metrics that indicate how overcommitted the CPU, memory,
+	  and IO capacity are in the system.
+
+	  If you say Y here, the kernel will create /proc/pressure/ with the
+	  pressure statistics files cpu, memory, and io. These will indicate
+	  the share of walltime in which some or all tasks in the system are
+	  delayed due to contention of the respective resource.
+
+	  In kernels with cgroup support, cgroups (cgroup2 only) will
+	  have cpu.pressure, memory.pressure, and io.pressure files,
+	  which aggregate pressure stalls for the grouped tasks only.
+
+	  For more details see Documentation/accounting/psi.rst.
+
+	  Say N if unsure.
+
 config KERNEL_KALLSYMS
 	bool "Compile the kernel with symbol table information"
 	default y if !SMALL_FLASH

include/image-commands.mk

@@ -732,6 +732,10 @@ define Build/zip
 	rm -rf $@.tmp
 endef
 
+define Build/zyimage
+	$(STAGING_DIR_HOST)/bin/zyimage $(1) $@
+endef
+
 define Build/zyxel-ras-image
 	let \
 		newsize="$(call exp_units,$(RAS_ROOTFS_SIZE))"; \

include/kernel-6.6

@@ -1,2 +1,2 @@
-LINUX_VERSION-6.6 = .61
-LINUX_KERNEL_HASH-6.6.61 = 418fc24df9190f1c3ed9906dc3b7651c2a2eae5c1cb9ab4a6348e20faf047c0b
+LINUX_VERSION-6.6 = .63
+LINUX_KERNEL_HASH-6.6.63 = d1054ab4803413efe2850f50f1a84349c091631ec50a1cf9e891d1b1f9061835

include/meson.mk

@@ -108,7 +108,7 @@ define Host/Configure/Meson
 endef
 
 define Host/Compile/Meson
-	+$(NINJA) -C $(MESON_HOST_BUILD_DIR) $(1)
+	+$(MESON_HOST_VARS) $(NINJA) -C $(MESON_HOST_BUILD_DIR) $(1)
 endef
 
 define Host/Install/Meson
@@ -135,7 +135,7 @@ define Build/Configure/Meson
 endef
 
 define Build/Compile/Meson
-	+$(NINJA) -C $(MESON_BUILD_DIR) $(1)
+	+$(MESON_VARS) $(NINJA) -C $(MESON_BUILD_DIR) $(1)
 endef
 
 define Build/Install/Meson

include/optee-os.mk

@@ -0,0 +1,113 @@
+include $(INCLUDE_DIR)/prereq.mk
+
+PKG_NAME ?= optee-os
+
+ifndef PKG_SOURCE_PROTO
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL_FILE:=$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL = https://github.com/OP-TEE/optee_os/archive/refs/tags/
+TAR_OPTIONS+= --transform 's/optee_os/$(PKG_NAME)/'
+endif
+
+PKG_BUILD_DIR = $(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)
+
+PKG_TARGETS := bin
+PKG_FLAGS:=nonshared
+
+PKG_LICENSE:=BSD 2-Clause
+PKG_LICENSE_FILES:=LICENSE
+
+PKG_BUILD_PARALLEL ?= 1
+
+$(eval $(call TestHostCommand,python3-cryptography, \
+  Please install the Python3 cryptography module, \
+  $(STAGING_DIR_HOST)/bin/python3 -c 'import cryptography'))
+
+$(eval $(call TestHostCommand,python3-pyelftools, \
+    Please install the Python3 pyelftools module, \
+    $(STAGING_DIR_HOST)/bin/python3 -c 'import elftools'))
+
+export GCC_HONOUR_COPTS=s
+
+define Package/optee-os/install/default
+	$(CP) $(patsubst %,$(PKG_BUILD_DIR)/out/arm-plat-$(PLAT)/core/%,$(OPTEE_IMAGE)) $(1)/
+endef
+
+Package/optee-os/install = $(Package/optee-os/install/default)
+
+define Optee-os/Init
+  BUILD_TARGET:=
+  BUILD_SUBTARGET:=
+  BUILD_DEVICES:=
+  NAME:=
+  DEPENDS:=
+  HIDDEN:=
+  DEFAULT:=
+  VARIANT:=$(1)
+  PLAT:=$(1)
+  PLAT_FLAVOR:=
+  OPTEE_IMAGE:=tee-header_v2.bin tee-pager_v2.bin tee-pageable_v2.bin
+endef
+
+TARGET_DEP = TARGET_$(BUILD_TARGET)$(if $(BUILD_SUBTARGET),_$(BUILD_SUBTARGET))
+
+define Build/Optee-os/Target
+  $(eval $(call Optee-os/Init,$(1)))
+  $(eval $(call Optee-os/Default,$(1)))
+  $(eval $(call Optee-os/$(1),$(1)))
+
+  define Package/optee-os-$(1)
+    SECTION:=boot
+    CATEGORY:=Boot Loaders
+    TITLE:=OPTEE-OS for $(NAME)
+    VARIANT:=$(VARIANT)
+    DEPENDS:=@!IN_SDK $(DEPENDS)
+    HIDDEN:=$(HIDDEN)
+    ifneq ($(BUILD_TARGET),)
+      DEPENDS += @$(TARGET_DEP)
+      ifneq ($(BUILD_DEVICES),)
+        DEFAULT := y if ($(TARGET_DEP)_Default \
+		$(patsubst %,|| $(TARGET_DEP)_DEVICE_%,$(BUILD_DEVICES)) \
+		$(patsubst %,|| $(patsubst TARGET_%,TARGET_DEVICE_%,$(TARGET_DEP))_DEVICE_%,$(BUILD_DEVICES)))
+      endif
+    endif
+    $(if $(DEFAULT),DEFAULT:=$(DEFAULT))
+    URL:=https://optee.readthedocs.io
+  endef
+
+  define Package/optee-os-$(1)/install
+	$$(Package/optee-os/install)
+  endef
+endef
+
+define Build/Configure/Optee-os
+endef
+
+define Build/Compile/Optee-os
+	+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
+		PATH=$(LINUX_DIR)/scripts/dtc/:$(PATH) \
+		CROSS_COMPILE=$(TARGET_CROSS) \
+		CROSS_COMPILE_core="$(TARGET_CROSS)" \
+		CROSS_COMPILE_ta_arm64="$(TARGET_CROSS)" \
+		CROSS_COMPILE_ta_arm32="$(TARGET_CROSS)" \
+		$(if $(CONFIG_ARCH_64BIT), CFG_ARM64_core=y CFG_USER_TA_TARGETS=ta_arm64, CFG_ARM32_core=y) \
+		PLATFORM="$(PLAT)" \
+		PLATFORM_FLAVOR="$(call qstrip,$(PLAT_FLAVOR))" \
+		$(OPTEE_MAKE_FLAGS)
+endef
+
+define BuildPackage/Optee-os/Defaults
+  Build/Configure/Default = $$$$(Build/Configure/Optee-os)
+  Build/Compile/Default = $$$$(Build/Compile/Optee-os)
+endef
+
+define BuildPackage/Optee-os
+  $(eval $(call BuildPackage/Optee-os/Defaults))
+  $(foreach type,$(if $(DUMP),$(OPTEE_TARGETS),$(BUILD_VARIANT)), \
+    $(eval $(call Build/Optee-os/Target,$(type)))
+  )
+  $(eval $(call Build/DefaultTargets))
+  $(foreach type,$(if $(DUMP),$(OPTEE_TARGETS),$(BUILD_VARIANT)), \
+    $(call BuildPackage,optee-os-$(type))
+  )
+endef

include/package-pack.mk

@@ -110,6 +110,13 @@ endif
     IDIR_$(1):=$(PKG_BUILD_DIR)/ipkg-$(PKGARCH)/$(1)
     ADIR_$(1):=$(PKG_BUILD_DIR)/apk-$(PKGARCH)/$(1)
     KEEP_$(1):=$(strip $(call Package/$(1)/conffiles))
+    APK_SCRIPTS_$(1):=\
+    --script "post-install:$$(ADIR_$(1))/post-install" \
+    --script "pre-deinstall:$$(ADIR_$(1))/pre-deinstall"
+
+    ifdef Package/$(1)/postrm
+        APK_SCRIPTS_$(1)+=--script "post-deinstall:$$(ADIR_$(1))/postrm"
+    endif
 
     TARGET_VARIANT:=$$(if $(ALL_VARIANTS),$$(if $$(VARIANT),$$(filter-out *,$$(VARIANT)),$(firstword $(ALL_VARIANTS))))
     ifeq ($(BUILD_VARIANT),$$(if $$(TARGET_VARIANT),$$(TARGET_VARIANT),$(BUILD_VARIANT)))
@@ -294,8 +301,8 @@ else
 		echo 'export root="$$$${IPKG_INSTROOT}"'; \
 		echo 'export pkgname="$(1)"'; \
 		echo "add_group_and_user"; \
-		[ ! -f $$(ADIR_$(1))/postinst-pkg ] || cat "$$(ADIR_$(1))/postinst-pkg"; \
 		echo "default_postinst"; \
+		[ ! -f $$(ADIR_$(1))/postinst-pkg ] || cat "$$(ADIR_$(1))/postinst-pkg"; \
 	) > $$(ADIR_$(1))/post-install;
 
 	( \
@@ -304,8 +311,8 @@ else
 		echo ". \$$$${IPKG_INSTROOT}/lib/functions.sh"; \
 		echo 'export root="$$$${IPKG_INSTROOT}"'; \
 		echo 'export pkgname="$(1)"'; \
-		[ ! -f $$(ADIR_$(1))/prerm-pkg ] || cat "$$(ADIR_$(1))/prerm-pkg"; \
 		echo "default_prerm"; \
+		[ ! -f $$(ADIR_$(1))/prerm-pkg ] || cat "$$(ADIR_$(1))/prerm-pkg"; \
 	) > $$(ADIR_$(1))/pre-deinstall;
 
 	if [ -n "$(USERID)" ]; then echo $(USERID) > $$(IDIR_$(1))/lib/apk/packages/$(1).rusers; fi;
@@ -360,8 +367,7 @@ else
 		), \
 		$$(prov) )" \
 	  $(if $(DEFAULT_VARIANT),--info "provider-priority:100",$(if $(PROVIDES),--info "provider-priority:1")) \
-	  --script "post-install:$$(ADIR_$(1))/post-install" \
-	  --script "pre-deinstall:$$(ADIR_$(1))/pre-deinstall" \
+	  $$(APK_SCRIPTS_$(1)) \
 	  --info "depends:$$(foreach depends,$$(subst $$(comma),$$(space),$$(subst $$(space),,$$(subst $$(paren_right),,$$(subst $$(paren_left),,$$(Package/$(1)/DEPENDS))))),$$(depends))" \
 	  --files "$$(IDIR_$(1))" \
 	  --output "$$(PACK_$(1))" \

include/target.mk

@@ -90,6 +90,11 @@ else
   endif
 endif
 
+# include ujail on systems with enough storage
+ifeq ($(filter small_flash,$(FEATURES)),)
+  DEFAULT_PACKAGES+=procd-ujail
+endif
+
 # Add device specific packages (here below to allow device type set from subtarget)
 DEFAULT_PACKAGES += $(DEFAULT_PACKAGES.$(DEVICE_TYPE))
 

include/toplevel.mk

@@ -78,7 +78,7 @@ _ignore = $(foreach p,$(IGNORE_PACKAGES),--ignore $(p))
 # Config that will invalidate the .targetinfo as they will affect
 # DEFAULT_PACKAGES.
 # Keep DYNAMIC_DEF_PKG_CONF in sync with target.mk to reflect the same configs
-DYNAMIC_DEF_PKG_CONF := CONFIG_USE_APK CONFIG_SELINUX CONFIG_SMALL_FLASH CONFIG_SECCOMP
+DYNAMIC_DEF_PKG_CONF := CONFIG_USE_APK CONFIG_SELINUX CONFIG_SMALL_FLASH CONFIG_USE_SECCOMP
 check-dynamic-def-pkg: FORCE
 	@+DEF_PKG_CONFS=""; \
 	if [ -f $(TOPDIR)/.config ]; then \

package/Makefile

@@ -131,7 +131,7 @@ ifneq ($(CONFIG_USE_APK),)
 			--keys-dir $(TOPDIR) \
 			--sign $(BUILD_KEY_APK_SEC) \
 			--output packages.adb \
-			$$(ls *.apk | grep -v 'base-files-\|kernel-\|libc-'); \
+			$$(ls *.apk | grep -vE '^(base-files-|kernel-|libc-)'); \
 		echo -n '{"architecture": "$(ARCH_PACKAGES)", "packages":{' > index.json; \
 		$(STAGING_DIR_HOST)/bin/apk adbdump packages.adb | \
 			awk '/- name: / {pkg = $$NF} ; / version: / {printf "\"%s\": \"%s\", ", pkg, $$NF}' | \

package/base-files/Makefile

@@ -42,8 +42,8 @@ define Package/base-files
   DEPENDS:= \
 	+netifd +libc +jsonfilter +SIGNED_PACKAGES:usign +SIGNED_PACKAGES:openwrt-keyring \
 	+NAND_SUPPORT:ubi-utils +fstools +fwtool \
-	+SELINUX:procd-selinux +!SELINUX:procd +SECCOMP:procd-seccomp \
-	+SELINUX:busybox-selinux +!SELINUX:busybox +!SMALL_FLASH:procd-ujail
+	+SELINUX:procd-selinux +!SELINUX:procd +USE_SECCOMP:procd-seccomp \
+	+SELINUX:busybox-selinux +!SELINUX:busybox
   TITLE:=Base filesystem for OpenWrt
   URL:=http://openwrt.org/
   VERSION:=$(PKG_RELEASE)~$(lastword $(subst -, ,$(REVISION)))

package/base-files/files/etc/profile

@@ -38,3 +38,24 @@ in order to prevent unauthorized SSH logins.
 --------------------------------------------------
 EOF
 fi
+
+if [ -x /usr/bin/apk ]; then
+cat << EOF
+
+ OpenWrt recently switched to the "apk" package manager!
+
+ OPKG Command           APK Equivalent      Description
+ ------------------------------------------------------------------
+ opkg install <pkg>     apk add <pkg>       Install a package
+ opkg remove <pkg>      apk del <pkg>       Remove a package
+ opkg upgrade           apk upgrade         Upgrade all packages
+ opkg files <pkg>       apk info -L <pkg>   List package contents
+ opkg list-installed    apk info            List installed packages
+ opkg update            apk update          Update package lists
+ opkg search <pkg>      apk search <pkg>    Search for packages
+ ------------------------------------------------------------------
+
+For more https://openwrt.org/docs/guide-user/additional-software/opkg-to-apk-cheatsheet
+
+EOF
+fi

package/boot/arm-trusted-firmware-stm32/Makefile

@@ -0,0 +1,63 @@
+#
+# Copyright (C) 2024 Bootlin
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_VERSION:=2.10
+PKG_RELEASE:=1
+
+PKG_HASH:=88215a62291b9ba87da8e50b077741103cdc08fb6c9e1ebd34dfaace746d3201
+PKG_MAINTAINER:=Thomas Richard <[email protected]>
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/trusted-firmware-a.mk
+include $(INCLUDE_DIR)/package.mk
+
+define Trusted-Firmware-A/Default
+  BUILD_TARGET:=stm32
+  BUILD_DEVICES:=$(1)
+  DEPENDS:=+u-boot-$(1) +optee-os-$(1)
+endef
+
+define Trusted-Firmware-A/stm32mp1
+  BUILD_SUBTARGET:=stm32mp1
+  PLAT:=stm32mp1
+  MAKE_ARGS += BL32_EXTRA2=$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-tee-pageable_v2.bin \
+	       STM32MP_USB_PROGRAMMER=1 \
+	       STM32MP1_OPTEE_IN_SYSRAM=1 \
+	       ARM_ARCH_MAJOR=7
+endef
+
+define Trusted-Firmware-A/stm32mp135f-dk
+  $(call Trusted-Firmware-A/stm32mp1)
+  NAME:=STM32MP135F-DK
+  DTB_FILE_NAME=stm32mp135f-dk.dtb
+endef
+
+TFA_TARGETS := stm32mp135f-dk
+
+TFA_MAKE_FLAGS += \
+		ARCH=aarch32 AARCH32_SP=optee \
+		BL32=$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-tee-header_v2.bin \
+		BL32_EXTRA1=$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-tee-pager_v2.bin \
+		BL33=$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-u-boot.bin \
+		BL33_CFG=$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-u-boot.dtb \
+		DTB_FILE_NAME=$(DTB_FILE_NAME) \
+		STM32MP_SDMMC=1 \
+		TARGET_BOARD="" \
+		$(MAKE_ARGS) \
+		all fip
+
+define Package/trusted-firmware-a/install
+	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
+	$(CP) $(PKG_BUILD_DIR)/build/$(PLAT)/release/tf-a-$(BUILD_VARIANT).stm32 \
+		$(STAGING_DIR_IMAGE)/tf-a-$(BUILD_VARIANT).stm32
+	$(CP) $(PKG_BUILD_DIR)/build/$(PLAT)/release/fip.bin \
+		$(STAGING_DIR_IMAGE)/fip-$(BUILD_VARIANT).bin
+endef
+
+$(eval $(call BuildPackage/Trusted-Firmware-A))