Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature/bump 2024.02 #104

Open
wants to merge 42 commits into
base: chargepoint/2024.02.x
Choose a base branch
from

Conversation

chardin-cpi
Copy link
Contributor

Rollup for security and CVE fixes.

Jeffrey Hart and others added 30 commits May 16, 2024 09:16
Adds buildroot style enforce check for all changes.

Signed-off-by: Jeffrey Hart <[email protected]>
The default vagrant downloads a buildroot tarball and builds that,
but for testing it is a bit more convenient to just use the shared
directory across the vagrant box against the checked out buildroot

Signed-off-by: Charles Hardin <[email protected]>
In a readonly fs configuration the skeleton-init-fs will move
the var directories to the usr/share/factory and the run a command
like this:

   mv $(TARGET_DIR)/var $(TARGET_DIR)/usr/share/factory/var
   mkdir -p $(TARGET_DIR)/var
   for i in $(TARGET_DIR)/usr/share/factory/var/* \
            $(TARGET_DIR)/usr/share/factory/var/lib/* \
            $(TARGET_DIR)/usr/share/factory/var/lib/systemd/*; do

If the symlink is to the /tmp directory the glob compare on the
dhcp link will evaluate and result in an incorrect entry being
created in the resulting tmpfs mount on var.

    L+! /var/lib/dhcp - - - - ../usr/share/factory//var/lib/dhcp

So, make the link relative and the result of the configuration
doesn't get impacted.

Signed-off-by: Charles Hardin <[email protected]>
This creates a new buildroot package for raw2rgbpnm raw image
debayering tool under the graphics section. This tool converts
raw camera images to pnm images.

Include support for grbg12 and for generic high-aligned bit shifting
(when data is aligned to bit 16 and not bit 0).  In the IMX-isi case
data is aligned to bit 14.

Patch 0001 adds bggr12 support.
Patch 0002 adds png output support.

Signed-off-by: mhungerford-cpi <[email protected]>
Signed-off-by: Charles Hardin <[email protected]>
The customization requires binary updates for image and font files,
so this cannot be patched via the normal buildroot means. So, a
fork was made from the upstream project and changed.

Also adds support for a new logo image and updates the build
process to select the image.

Signed-off-by: Shubham Sharma <[email protected]>
Signed-off-by: Matt Hungerford <[email protected]>
Signed-off-by: Charles Hardin <[email protected]>
The fifo is created from psplash-start and so only having a
Requires lists the dependency on psplash-start but not that this
service needs to come after the start.

  Requires=

    Similar to Wants=, but declares a stronger requirement dependency.
    Dependencies of this type may also be configured by adding a symlink
    to a .requires/ directory accompanying the unit file.

    If this unit gets activated, the units listed will be activated as
    well. If one of the other units fails to activate, and an ordering
    dependency After= on the failing unit is set, this unit will not be
    started. Besides, with or without specifying After=, this unit will
    be stopped (or restarted) if one of the other units is explicitly
    stopped (or restarted).

    Often, it is a better choice to use Wants= instead of Requires= in
    order to achieve a system that is more robust when dealing with
    failing services.

    Note that this dependency type does not imply that the other unit
    always has to be in active state when this unit is running.
    Specifically: failing condition checks (such as ConditionPathExists=,
    ConditionPathIsSymbolicLink=, … — see below) do not cause the start
    job of a unit with a Requires= dependency on it to fail. Also, some
    unit types may deactivate on their own (for example, a service process
    may decide to exit cleanly, or a device may be unplugged by the user),
    which is not propagated to units having a Requires= dependency. Use
    the BindsTo= dependency type together with After= to ensure that a
    unit may never be in active state without a specific other unit also
    in active state (see below).

Signed-off-by: Charles Hardin <[email protected]>
The the logfile "u-boot-dtb.imx.log " contains information
required by the Code Signer Tool to correctly sign the
image and perform validation during bootup. This file
is being added to the build so it can be consumed when
a given build is to be signed.

Example contents:

$ cat u-boot-dtb.imx.log
Image Type:   Freescale IMX Boot Image
Image Ver:    2 (i.MX53/6/7 compatible)
Mode:         DCD
Data Size:    495616 Bytes = 484.00 KiB = 0.47 MiB
Load Address: 177ff420
Entry Point:  17800000
HAB Blocks:   177ff400 00000000 00074c00
DCD Blocks:   00910000 0000002c 00000300
In some cases an openssl engine implemented by an HSM vendor will
use keys and certs stored directly on the filesystem.  For example
AWS CloudHSM needs a fake pem file which contains a reference to
the acutal private key stored in the HSM.

This change adds a command line argument (-m) that forces the
logic that eads pem files to be used even if an openssl engine
is specified when signing a FIT image.

    $ mkimage -m -k /path/to/keys -N cloudhsm -F /path/to//file.itb

Signed-off-by: Michael Robak <[email protected]>
Changes added to select ahab container image
for different imx8 socs including imx8dxl.

Signed-off-by: Aswath Gajendran <[email protected]>
There is an example coap-client that is particularly useful
for debugging interactions against various coap servers
running on different endpoints.

Signed-off-by: Charles Hardin <[email protected]>
systemd-resolved has a single hardlink set to compat mode which does
not allow for features such as DNS caching and other fun things. This
choice allows the hard-link to be changed between a couple of operating
modes, the default (compat) and the more useful variant stub which
allows the resolver to act as a caching daemon.

NOTE: systemd recommends default resolver mode

Signed-off-by: Jeff Hart <[email protected]>
The compatible flags for the init and rc directories are disabled
by default, so allow a configuration option to set the expected
paths to /etc/init.d and /etc respectively.

This allows a hybrid systemd approach as needed for startup

Signed-off-by: Charles Hardin <[email protected]>
ModemManager only allows AT commands to be sent over dbus if the --debug
option is specified.  Add a config option to allow setting the compile-time
flag to allow the AT command interface outside of debug-only mode.

Signed-off-by: jhart-cpi <[email protected]>
Some cmake packages leverage fetching dependencies via FetchContent
which requires TLS support in cmake to fetch over secure channels
like HTTPS and SSH. Previous concerns around leaking host
dependencies seems to have been resolved.

Signed-off-by: Michael Rosen <[email protected]>
Add a host option to build the xml2cpp-codegen part of the
sdbus-cpp package for use in creating adaptor and proxy
implementations from the D-Bus IDL.

Signed-off-by: David Leeds <[email protected]>
Signed-off-by: Charles Hardin <[email protected]>
if the LWS_BUILD_HASH is not set then default to an unknown
value which is expected to avoid a zero length string.

Signed-off-by: Jeff Hart <[email protected]>
Signed-off-by: David Leeds <[email protected]>
Adds an option that disables or enables netlink at build time.

Signed-off-by: Jeffrey Hart <[email protected]>
Add kconfig bool for turning on/off libwebsockets non-blocking internal
DNS resolver.

Signed-off-by: jhart-cpi <[email protected]>
The developer arm toolchains do not have a aarch64 host aarch64 target
toolchain. This was built using the tools/docker/emb-toolchain-arm
dockerfiles on an aarch64 and needed to be uploaded to the build
archifacts on its own.

Signed-off-by: Charles Hardin <[email protected]>
The QT maintainance releases are not publicly available without
a license and the 5.15.8 release at the KDE sites has the following
issues that prevent it working with gcc11.

- QTBUG-106256 qml crash when binding alias to property
- QTBUG-100431 Crash in libQt5Qml V4 engine caused by wrong memory
- QTBUG-106377 Cannot create QML_SINGLETON class with newer gcc versions

So, a qt-everything tarball was downloaded and converted into a
buildroot compatible tarball that can be used with the existing
recipes.

    tar -xJf qt-everywhere-src-5.15.12.tar.xz
    cd qt-everywhere-src-5.15.12
    tar --transform=s/^qtbase/qtbase-5.15.12/ \
        -cvjf chargepoint-qtbase-5.15.12.tar.bz2 qtbase
    tar --transform=s/^qtdeclarative/qtdeclarative-5.15.12/ \
        -cvjf chargepoint-qtdeclarative-5.15.12.tar.bz2 qtdeclarative

NOTE: All buildroot patches are removed with the new version bump

Fixes: PLAT-7423

Signed-off-by: Charles Hardin <[email protected]>
The headers for defining types has changed in gcc versions, so
the uint8_t classes require a cstdint include explicitly.

Signed-off-by: Charles Hardin <[email protected]>
Primarily focused on uboot and linux, getting the scmversion from
the custom repository references is required for change control
tracking off of different builds and pipelines. So, extend the
download framework to generate these files while the locks are
being held for the generation to avoid the git information from
changes during the download process.

Signed-off-by: Charles Hardin <[email protected]>
During development the override srcdir is often used with a local
git repo and branch. To help track the builds used in those flows
it is useful to have the scm version available as part of the info.
With this hook, the auto generated version include will include the
example.

    #define PLAIN_VERSION "2018.03-01358-gbda75d6a8b"
    #define U_BOOT_VERSION "U-Boot " PLAIN_VERSION

Signed-off-by: Charles Hardin <[email protected]>
During development the override srcdir is often used with a local
git repo and branch. To help track the builds used in those flows
it is useful to have the scm version available as part of the info.
With this hook, the auto generated version include will include the
example.

    #define UTS_RELEASE "5.4.70-00031-g92c23d10d003"

Signed-off-by: Charles Hardin <[email protected]>
The go-native is mainly for the aarch64 support since that was
added after the go-bootstrap written in C was dropped. So, to
get a cross compiler for go a host/native compiler needs to be
available to generate the setup for the needed target.

Signed-off-by: Charles Hardin <[email protected]>
A host package for build support needs the dateutil module and
so enable the dependency.

Signed-off-by: Charles Hardin <[email protected]>
A host package like pykwalify needs the docopt module for buid
support and so enable the dependency.

Signed-off-by: Charles Hardin <[email protected]>
A host package like pykwalify needs to the ruamel module for build
support and so enable the dependency.

Signed-off-by: Charles Hardin <[email protected]>
When building zephyrproject-rtos based firmware, the cmake
integrates with python scripts that can be run using the buildroot
host-python dependencies. This is useful for the sdk setups and
associated build steps for the firmware.

See https://github.com/zephyrproject-rtos/zephyr for the build
steps that are used in the cmake and the requirements are
satisfied for the majority of build minus this package.

Signed-off-by: Charles Hardin <[email protected]>
chardin-cpi and others added 3 commits May 16, 2024 09:17
To generate various reports requires a host package for generating
those reports.

Signed-off-by: Charles Hardin <[email protected]>
To support the menuconfig options for the build in the sdk,
add in the curses as an option.

Signed-off-by: Charles Hardin <[email protected]>
i.MX Sentinel Firmware is used for i.MX Advanced High Assurance
Boot (AHAB). For previous i.MX generations this was provided
by imx-seco package.

Co-authored-by: Bernhard Kellner <[email protected]>

[PLAT-8084]
@chardin-cpi chardin-cpi force-pushed the feature/bump-2024.02 branch from 033b8e4 to c751f32 Compare May 16, 2024 16:17
davidschneider-cpi and others added 9 commits May 21, 2024 11:43
Zephyr build system depends on intelhex Python package.
The autotool finds the curses as expected, but there is a hook in
setup.py that is not immediately obvious.

    def detect_readline_curses(self):
        # readline
        readline_termcap_library = ""
        curses_library = ""

        ... snip snip ...

Which detects the host readline and then ends up trying to use
ncursesw instead of the cureses in the host tools. So, by using
the host-readline then curses library is the same as expected.

Signed-off-by: Charles Hardin <[email protected]>
Zephyr build system depends on click and since it is a build it will
run the host packages.

    Traceback (most recent call last):
      File "emb-mcu-local/extern/zephyrproject/bootloader/mcuboot/" \
           "scripts/imgtool.py", line 19, in <module>
        from imgtool import main
      File "emb-mcu-local/extern/zephyrproject/bootloader/mcuboot/" \
           "scripts/imgtool/main.py", line 21, in <module>
        import click
    ModuleNotFoundError: No module named 'click'

Signed-off-by: Charles Hardin <[email protected]>
Zephyr build system depends on click and since it is a build it will
run the host packages.

    Traceback (most recent call last):
      File "emb-mcu-local/extern/zephyrproject/bootloader/" \
           "mcuboot/scripts/imgtool/boot_record.py", line 21, in <module>
        from cbor2 import dumps
    ModuleNotFoundError: No module named 'cbor2'

Signed-off-by: Charles Hardin <[email protected]>
This version adds support for cgroups v2 which are
enforced by systemd.

Changelog:
https://github.com/balena-os/balena-engine/releases/tag/v20.10.40
- update the firmware-imx versions to the 6.1.x versions
- Get newer imx-gpu versions (shamelessly stolen from yocto)

Signed-off-by: Carl Norum <[email protected]>
Signed-off-by: Charles Hardin <[email protected]>
There is snippet in the install path that calls /sbin/ldconfig
when a variable FAKEROOT is empty

  install-shared-cap: install-common-cap $(MINCAPLIBNAME)
          install -m 0755 $(MINCAPLIBNAME) $(FAKEROOT)$(LIBDIR)/$(MINCAPLIBNAME)
          ln -sf $(MINCAPLIBNAME) $(FAKEROOT)$(LIBDIR)/$(MAJCAPLIBNAME)
          ln -sf $(MAJCAPLIBNAME) $(FAKEROOT)$(LIBDIR)/$(CAPLIBNAME)
  ifeq ($(FAKEROOT),)
          -/sbin/ldconfig
  endif

And this variable is defined when DESTDIR is used, so still define prefix
but use the DESTDIR in the host build as well to avoid calling ldconfig
at all.

Signed-off-by: Charles Hardin <[email protected]>
There is a patch series to add tensorflow-lite to buildroot
and so apply this as one commit since the upstream will be
post 2024.02 and this allows the package to be used in the
release branch now.

https://patchwork.ozlabs.org/project/buildroot/list/?series=346546

Signed-off-by: Charles Hardin <[email protected]>
During a configuration with per-package, seeing the following
meson build error which is resolved when the qt5tools are
declared explicitly as a dependency.

    build/gst1-plugins-good-1.22.9/ext/qt/meson.build:48:4: \
      ERROR: Problem encountered: qt5 qmlglsink plugin is enabled, \
      but qt specific tools were not found

Signed-off-by: Charles Hardin <[email protected]>
@chardin-cpi chardin-cpi force-pushed the feature/bump-2024.02 branch from c751f32 to e3709d6 Compare May 21, 2024 22:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

8 participants