modification du meta-pengwyn pour l'integration d'un initramfs inclus dans le noyau pour chiffrer une partition avec dm-crypt/LUKS

2023-10-18 09:19:18 +00:00
parent b8c8646eb3
commit e0e635d46d
15 changed files with 7136 additions and 47 deletions
--- a/classes/uboot-sign.bbclass
+++ b/classes/uboot-sign.bbclass
@@ -157,7 +157,6 @@ concat_dtb_helper() {
 }

 concat_spl_dtb_helper() {
-	bbplain "SCLE: concat_spl_dtb_helper"
 	# We only deploy symlinks to the u-boot-spl.dtb,as the KERNEL_PN will
 	# be responsible for deploying the real file
 	if [ -e "${SPL_DIR}/${SPL_DTB_BINARY}" ] ; then
@@ -195,8 +194,6 @@ concat_dtb() {
 }

 concat_spl_dtb() {
-	bbplain "concat_spl_dtb"
-	#if [ "${SPL_SIGN_ENABLE}" = "1" -a "${PN}" = "${UBOOT_PN}" -a -n "${SPL_DTB_BINARY}" ]; then
 	if [ "${PN}" = "${UBOOT_PN}" -a -n "${SPL_DTB_BINARY}" ]; then
 		mkdir -p ${DEPLOYDIR}
 		if [ -n "${UBOOT_CONFIG}" ]; then
@@ -319,7 +316,6 @@ uboot_fitimage_assemble() {

 	rm -f $uboot_its $uboot_bin

-	bbplain "SCLE: uboot_its: $uboot_its"
 	# First we create the ITS script
 	cat << EOF >> $uboot_its
 /dts-v1/;
@@ -410,10 +406,6 @@ do_uboot_assemble_fitimage() {
 	# support the scenario where UBOOT_SIGN_ENABLE is placing the Kernel fitImage's
 	# pubkey in the u-boot.dtb file, so that we can use it when building the U-Boot
 	# fitImage itself.
-	bbplain "SCLE: do_uboot_assemble_fitimage"
-	bbplain "SCLE: SPL_DTB_BINARY: ${SPL_DTB_BINARY}"
-	bbplain "SCLE: PN: ${PN}"
-	bbplain "SCLE: KERNEL_PN: ${KERNEL_PN}"
 	if [ "${UBOOT_FITIMAGE_ENABLE}" = "1" ] && \
 	   [ -n "${SPL_DTB_BINARY}" -a "${PN}" = "${KERNEL_PN}" ] ; then
 		if [ "${UBOOT_SIGN_ENABLE}" != "1" ]; then
@@ -435,7 +427,6 @@ do_uboot_assemble_fitimage() {
 		kernel_uboot_fitimage_name=`basename ${STAGING_DATADIR}/u-boot-fitImage-*`
 		kernel_uboot_its_name=`basename ${STAGING_DATADIR}/u-boot-its-*`
 		cd ${B}
-		bbplain "SCLE: call uboot_fitimage_assemble"
 		uboot_fitimage_assemble $kernel_uboot_its_name ${UBOOT_NODTB_BINARY} \
 					${UBOOT_DTB_BINARY} $kernel_uboot_fitimage_name \
 					${SPL_DTB_BINARY}
@@ -467,11 +458,7 @@ do_deploy:prepend:pn-${UBOOT_PN}() {
 		ln -sf ${UBOOT_ITS_IMAGE} ${DEPLOYDIR}/${UBOOT_ITS_SYMLINK}
 	fi

-	bbplain "SCLE: do_deploy prepend"
-	bbplain "SCLE: ${SPL_DTB_BINARY}"
-	#if [ "${SPL_SIGN_ENABLE}" = "1" -a -n "${SPL_DTB_BINARY}" ] ; then
 	if [ -n "${SPL_DTB_BINARY}" ] ; then
-		bbplain "SCLE: call concat_spl_dtb"
 		concat_spl_dtb
 	fi

--- a/conf/machine/pengwyn_fitimage.conf
+++ b/conf/machine/pengwyn_fitimage.conf
@@ -0,0 +1,126 @@
+#@TYPE: Machine
+#@NAME: AM335x Pengwyn
+#@DESCRIPTION: Machine configuration for the Silica Pengwyn Board 
+
+require conf/machine/include/ti33x.inc
+
+IMAGE_CLASSES += "sdcard_image-pengwyn"
+
+#IMAGE_FSTYPES ?= "tar.bz2 ext4 wic wic.bmap"
+IMAGE_FSTYPES = "tar.bz2 ext4"
+#MACHINE_ESSENTIAL_EXTRA_RDEPENDS += "kernel-image kernel-devicetree"
+#MACHINE_ESSENTIAL_EXTRA_RDEPENDS += "kernel-image kernel-modules"
+MACHINE_ESSENTIAL_EXTRA_RDEPENDS += "kernel-image"
+
+# A list of machine-dependent packages not essential for booting the image. 
+# Thus, the build does not fail if the packages do not exist. 
+# However, the packages are required for a fully-featured image
+#MACHINE_EXTRA_RRECOMMENDS = "kernel-modules"
+
+# Normally AM335 boards use ttyS0, but ICE uses ttyS3, so try both
+SERIAL_CONSOLES = "115200;ttyS0 115200;ttyO0 115200;ttyAMA0"
+SERIAL_CONSOLES_CHECK = "${SERIAL_CONSOLES}"
+
+EXTRA_IMAGEDEPENDS += "virtual/bootloader virtual/dtb"
+
+##########################################################
+#
+# Bootloader
+#
+##########################################################
+
+PREFERRED_PROVIDER_virtual/bootloader ?= "u-boot"
+PREFERRED_VERSION_u-boot ?= "u-boot-ti-staging_2020.07%"
+
+# The file type for the Secondary Program Loader (SPL)
+SPL_BINARY = "MLO"
+UBOOT_SUFFIX = "img"
+UBOOT_MACHINE = "pengwyn_defconfig"
+UBOOT_ENTRYPOINT = "0x80008000"
+UBOOT_LOADADDRESS = "0x80008000"
+UBOOT_DTB_LOADADDRESS = "0x80F80000"
+
+# Localtion of the directory containing the RSA key and certificate used for signing image
+UBOOT_SIGN_KEYDIR = "${PWD}/scle_keys"
+# keys name in keydir (eg. "dev.crt", "dev.key")
+UBOOT_SIGN_KEYNAME = "scle"
+UBOOT_SIGN_ENABLE = "1"
+
+# Localtion of the directory containing the RSA key and certificate used for signing bootloader 
+SPL_SIGN_KEYDIR = "${PWD}/scle_keys"
+SPL_SIGN_KEYNAME = "scle"
+SPL_SIGN_ENABLE = "0"
+
+##########################################################
+#
+# U-Boot FIT Image
+#
+##########################################################
+
+# Enable use of a U-Boot fitImage
+UBOOT_FITIMAGE_ENABLE = "0"
+# U-Boot fitImage Hash Algo
+UBOOT_FIT_HASH_ALG = "sha256"
+# U-Boot fitImage Signature Algo
+UBOOT_FIT_SIGN_ALG = "rsa4096"
+# Generate keys for signing U-Boot fitImage
+UBOOT_FIT_GENERATE_KEYS = "0"
+# Size of private keys in number of bits
+UBOOT_FIT_SIGN_NUMBITS = "4096"
+
+##########################################################
+#
+# Kernel FIT Image
+#
+##########################################################
+
+# Decides whether to generate the keys for signing fitImage if they don’t already exist
+FIT_GENERATE_KEYS = "1"
+# Specifies the hash algorithm used in creating the FIT Image
+FIT_HASH_ALG = "sha256"
+# Specifies the signature algorithm used in creating the FIT Image
+FIT_SIGN_ALG = "rsa4096"
+# Size of private key in number of bits used in fitImage
+FIT_SIGN_NUMBITS = "4096"
+
+##########################################################
+#
+# Linux
+#
+##########################################################
+
+PREFERRED_PROVIDER_virtual/kernel ?= "linux-ti-staging"
+PREFERRED_VERSION_linux-ti-staging ?= "5.4%"
+
+#KERNEL_IMAGETYPE = "uImage"
+KERNEL_CLASSES ?= " kernel-fitimage "
+KERNEL_IMAGETYPE = "fitImage"
+# Not necessary => see devicetree recipe
+#KERNEL_DEVICETREE = "am335x-pengwyn.dtb"
+# Remove dtb from ti33x.inc
+KERNEL_DEVICETREE:remove = " \
+    am335x-evm.dtb \
+    am335x-evmsk.dtb \
+    am335x-icev2.dtb \
+    am335x-pocketbeagle.dtb am335x-bone.dtb am335x-boneblue.dtb \
+    am335x-bonegreen.dtb am335x-bonegreen-wireless.dtb \
+    am335x-boneblack.dtb am335x-boneblack-wireless.dtb \
+    am335x-sancloud-bbe.dtb \
+"
+KERNEL_EXTRA_ARGS += "LOADADDR=${UBOOT_ENTRYPOINT}"
+
+##########################################################
+#
+# Devicetree blob
+#
+##########################################################
+
+PREFERRED_PROVIDER_virtual/dtb ?= "devicetree"
+PREFERRED_VERSION_dtb ?= "1.0%"
+
+MACHINE_FEATURES = "usbgadget usbhost vfat"
+
+#IMAGE_BOOT_FILES = "MLO u-boot.${UBOOT_SUFFIX} uEnv.txt uImage devicetree/am335x-pengwyn.dtb"
+IMAGE_BOOT_FILES = "MLO u-boot.${UBOOT_SUFFIX} uEnv.txt fitImage devicetree/am335x-pengwyn.dtb"
+
+RM_WORK_EXCLUDE += "u-boot-ti-staging linux-ti-staging"
--- a/recipes-bsp/u-boot/files2/0021-debug.patch
+++ b/recipes-bsp/u-boot/files2/0021-debug.patch
@@ -0,0 +1,20 @@
+diff --git a/boot/bootm.c b/boot/bootm.c
+index a4c0870c0f..6059c73158 100644
+--- a/boot/bootm.c
+++ b/boot/bootm.c
+@@ -411,6 +411,7 @@ static int bootm_load_os(struct bootm_headers *images, int boot_progress)
+ 	void *load_buf, *image_buf;
+ 	int err;
+ 
+	printf("[SCLE] load os : start=%x - len=%d\n", image_start, image_len);
+ 	load_buf = map_sysmem(load, 0);
+ 	image_buf = map_sysmem(os.image_start, image_len);
+ 	err = image_decomp(os.comp, load, os.image_start, os.type,
+@@ -1029,6 +1030,7 @@ static int bootm_host_load_image(const void *fit, int req_image_type,
+ 
+ 	/* Allow the image to expand by a factor of 4, should be safe */
+ 	buf_size = (1 << 20) + len * 4;
+	printf("[SCLE] before decompress: buf_size=%d\n", buf_size);
+ 	load_buf = malloc(buf_size);
+ 	ret = image_decomp(image_comp, 0, data, image_type, load_buf,
+ 			   (void *)data, len, buf_size, &load_end);
--- a/recipes-bsp/u-boot/files2/defconfig/pengwyn_fit_kern_defconfig
+++ b/recipes-bsp/u-boot/files2/defconfig/pengwyn_fit_kern_defconfig
@@ -45,7 +45,7 @@ CONFIG_SYS_MMCSD_RAW_MODE_ARGS_SECTORS=0x200
 CONFIG_SPL_USB_GADGET=n
 CONFIG_SPL_USB_ETHER=n
 CONFIG_SYS_MAXARGS=64
-CONFIG_SYS_BOOTM_LEN=0x1000000
+CONFIG_SYS_BOOTM_LEN=0x2000000
 CONFIG_CMD_SPL=y
 CONFIG_CMD_SPL_NAND_OFS=0x00080000
 CONFIG_SYS_I2C_EEPROM_ADDR_LEN=2
--- a/recipes-bsp/u-boot/files2/defconfig/pengwyn_fitimage_defconfig
+++ b/recipes-bsp/u-boot/files2/defconfig/pengwyn_fitimage_defconfig
@@ -49,7 +49,7 @@ CONFIG_SYS_MMCSD_RAW_MODE_ARGS_SECTORS=0x200
 CONFIG_SPL_USB_GADGET=n
 CONFIG_SPL_USB_ETHER=n
 CONFIG_SYS_MAXARGS=64
-CONFIG_SYS_BOOTM_LEN=0x1000000
+CONFIG_SYS_BOOTM_LEN=0x2000000
 CONFIG_CMD_SPL=y
 CONFIG_CMD_SPL_NAND_OFS=0x00080000
 CONFIG_SYS_I2C_EEPROM_ADDR_LEN=2
--- a/recipes-bsp/u-boot/files2/env/uEnv_fit_kernel.txt
+++ b/recipes-bsp/u-boot/files2/env/uEnv_fit_kernel.txt
@@ -16,11 +16,12 @@ ethaddr=00:18:30:fc:c0:35
 fdtaddr=0x80F80000
 fdtfile=am335x-pengwyn.dtb
 importbootenv=echo Importing environment from mmc ...; env import -t $loadaddr $filesize
-loadaddr=0x80600000
+loadaddr=0x84000000
 loadbootenv=fatload mmc ${mmcdev} ${loadaddr} ${bootenv}
 loadfdt=fatload mmc ${mmcdev} ${fdtaddr} devicetree/${fdtfile}
 loadimage=fatload mmc ${mmcdev} ${loadaddr} ${bootfile}
-mmcargs=setenv bootargs console=${console} ${optargs} root=${mmcroot} rootfstype=${mmcrootfstype} shell=before:dmverity
+shell_initramfs=shell=after:cryptfs
+mmcargs=setenv bootargs console=${console} ${optargs} root=${mmcroot} rootfstype=${mmcrootfstype}
 mmcboot=mmc dev ${mmcdev}; if mmc rescan; then echo SD/MMC found on device ${mmcdev};if run loadbootenv; then echo Loaded environment from ${bootenv};run importbootenv;fi;if test -n $uenvcmd; then echo Running uenvcmd ...;run uenvcmd;fi;if run loadimage; then run mmcloados;fi;fi;
 mmcdev=0
 mmcloados=run mmcargs; bootm ${loadaddr};
--- a/recipes-bsp/u-boot/files2/env/uEnv_fitimage.txt
+++ b/recipes-bsp/u-boot/files2/env/uEnv_fitimage.txt
@@ -16,7 +16,7 @@ ethaddr=00:18:30:fc:c0:35
 fdtaddr=0x81200000
 fdtfile=am335x-pengwyn.dtb
 importbootenv=echo Importing environment from mmc ...; env import -t $loadaddr $filesize
-loadaddr=0x80200000
+loadaddr=0x84000000
 loadbootenv=fatload mmc ${mmcdev} ${loadaddr} ${bootenv}
 loadfdt=fatload mmc ${mmcdev} ${fdtaddr} ${fdtfile}
 loadimage=fatload mmc ${mmcdev} ${loadaddr} ${bootfile}
--- a/recipes-bsp/u-boot/files2/pengwyn_defconfig
+++ b/recipes-bsp/u-boot/files2/pengwyn_defconfig
@@ -0,0 +1,159 @@
+CONFIG_ARM=y
+CONFIG_ARCH_CPU_INIT=y
+CONFIG_ARCH_OMAP2PLUS=y
+CONFIG_TI_COMMON_CMD_OPTIONS=y
+CONFIG_DEFAULT_DEVICE_TREE="am335x-pengwyn"
+CONFIG_AM33XX=y
+CONFIG_TARGET_PENGWYN=y
+CONFIG_TEXT_BASE=0x81000000
+CONFIG_CLOCK_SYNTHESIZER=y
+CONFIG_AM335X_USB0=y
+CONFIG_AM335X_USB0_PERIPHERAL=y
+CONFIG_AM335X_USB1=y
+CONFIG_SPL=y
+CONFIG_DISTRO_DEFAULTS=y
+CONFIG_HAS_CUSTOM_SYS_INIT_SP_ADDR=y
+CONFIG_CUSTOM_SYS_INIT_SP_ADDR=0x4030ff00
+CONFIG_TIMESTAMP=y
+CONFIG_SPL_LOAD_FIT=y
+# CONFIG_USE_SPL_FIT_GENERATOR is not set
+CONFIG_OF_BOARD_SETUP=y
+CONFIG_BOOTCOMMAND="run mmcboot;"
+CONFIG_LOGLEVEL=3
+CONFIG_SYS_CONSOLE_INFO_QUIET=y
+CONFIG_ARCH_MISC_INIT=y
+# CONFIG_SPL_USE_ARCH_MEMCPY is not set
+# CONFIG_SPL_USE_ARCH_MEMSET is not set
+CONFIG_SYS_MALLOC_F_LEN=0x4000
+CONFIG_SPL_SYS_MALLOC_F_LEN=0x2000
+# CONFIG_SYS_SPL_MALLOC=y
+# CONFIG_SYS_SPL_MALLOC_SIZE=0x800000
+# CONFIG_SPL_FIT_IMAGE_TINY=y
+CONFIG_SPL_ETH=y
+# CONFIG_SPL_FS_EXT4 is not set
+CONFIG_SPL_FS_LOAD_PAYLOAD_NAME="u-boot.img"
+# CONFIG_SPL_MTD_SUPPORT is not set
+CONFIG_SPL_MUSB_NEW=n
+# CONFIG_SPL_NAND_SUPPORT is not set
+# CONFIG_SPL_NAND_DRIVERS is not set
+# CONFIG_SPL_NAND_ECC is not set
+# CONFIG_SPL_NAND_BASE is not set
+# CONFIG_SPL_NET is not set
+CONFIG_SPL_NET_VCI_STRING="AM335x U-Boot SPL"
+# CONFIG_SPL_OS_BOOT is not set
+CONFIG_SYS_NAND_SPL_KERNEL_OFFS=0x200000
+CONFIG_SPL_FALCON_BOOT_MMCSD=n
+CONFIG_SYS_MMCSD_RAW_MODE_KERNEL_SECTOR=0x1700
+CONFIG_SYS_MMCSD_RAW_MODE_ARGS_SECTOR=0x1500
+CONFIG_SYS_MMCSD_RAW_MODE_ARGS_SECTORS=0x200
+CONFIG_SPL_USB_GADGET=n
+CONFIG_SPL_USB_ETHER=n
+CONFIG_SYS_MAXARGS=64
+CONFIG_SYS_BOOTM_LEN=0x1000000
+CONFIG_CMD_SPL=y
+CONFIG_CMD_SPL_NAND_OFS=0x00080000
+CONFIG_SYS_I2C_EEPROM_ADDR_LEN=2
+# CONFIG_CMD_FLASH is not set
+CONFIG_CMD_NAND=y
+# CONFIG_CMD_SETEXPR is not set
+CONFIG_BOOTP_DNS2=y
+CONFIG_CMD_MTDPARTS=y
+CONFIG_MTDIDS_DEFAULT="nand0=nand.0"
+CONFIG_MTDPARTS_DEFAULT="mtdparts=nand.0:128k(NAND.SPL),128k(NAND.SPL.backup1),128k(NAND.SPL.backup2),128k(NAND.SPL.backup3),256k(NAND.u-boot-spl-os),1m(NAND.u-boot),128k(NAND.u-boot-env),128k(NAND.u-boot-env.backup1),8m(NAND.kernel),-(NAND.file-system)"
+# CONFIG_SPL_EFI_PARTITION is not set
+CONFIG_OF_CONTROL=y
+CONFIG_OF_LIST="am335x-pengwyn am335x-evm am335x-bone am335x-sancloud-bbe am335x-sancloud-bbe-lite am335x-sancloud-bbe-extended-wifi am335x-boneblack am335x-evmsk am335x-bonegreen am335x-icev2 am335x-pocketbeagle"
+CONFIG_ENV_OVERWRITE=y
+CONFIG_SYS_RELOC_GD_ENV_ADDR=y
+CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
+# CONFIG_SPL_ENV_IS_NOWHERE is not set
+CONFIG_VERSION_VARIABLE=y
+CONFIG_NET_RETRY_COUNT=10
+CONFIG_BOOTP_SEND_HOSTNAME=y
+CONFIG_BOOTCOUNT_LIMIT=y
+CONFIG_SYS_BOOTCOUNT_BE=y
+CONFIG_CLK=y
+CONFIG_CLK_CDCE9XX=y
+CONFIG_CLK_TI_CTRL=y
+CONFIG_DFU_TFTP=y
+CONFIG_DFU_MMC=y
+CONFIG_DFU_NAND=y
+CONFIG_NAND_OMAP_ECCSCHEME_BCH16_CODE_HW=y
+CONFIG_DFU_RAM=y
+CONFIG_USB_FUNCTION_FASTBOOT=y
+CONFIG_FASTBOOT_FLASH=y
+CONFIG_FASTBOOT_FLASH_MMC_DEV=1
+CONFIG_FASTBOOT_CMD_OEM_FORMAT=y
+CONFIG_DM_I2C=y
+CONFIG_MISC=y
+CONFIG_SYS_I2C_EEPROM_ADDR=0x50
+# CONFIG_MMC_HW_PARTITIONING is not set
+CONFIG_MMC_OMAP_HS=y
+CONFIG_MTD=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_SYS_NAND_BLOCK_SIZE=0x80000
+CONFIG_SYS_NAND_ONFI_DETECTION=y
+CONFIG_SYS_NAND_PAGE_COUNT=0x40
+CONFIG_SYS_NAND_PAGE_SIZE=0x1000
+CONFIG_SYS_NAND_OOBSIZE=0xe0
+CONFIG_SYS_NAND_U_BOOT_LOCATIONS=y
+CONFIG_SYS_NAND_U_BOOT_OFFS=0xc0000
+CONFIG_DM_SPI_FLASH=y
+CONFIG_SF_DEFAULT_SPEED=24000000
+CONFIG_SPI_FLASH_STMICRO=y
+CONFIG_SPI_FLASH_WINBOND=y
+CONFIG_PHY_ATHEROS=y
+CONFIG_PHY_SMSC=y
+CONFIG_PHY_GIGE=y
+CONFIG_MII=y
+CONFIG_DRIVER_TI_CPSW=y
+CONFIG_DM_PMIC=y
+# CONFIG_SPL_DM_PMIC is not set
+CONFIG_PMIC_TPS65217=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_OMAP3_SPI=y
+CONFIG_TIMER=y
+CONFIG_OMAP_TIMER=y
+#CONFIG_USB=y
+#CONFIG_DM_USB_GADGET=y
+#CONFIG_SPL_DM_USB_GADGET=n
+#CONFIG_USB_MUSB_HOST=y
+#CONFIG_USB_MUSB_GADGET=y
+#CONFIG_USB_MUSB_TI=y
+#CONFIG_USB_GADGET=y
+#CONFIG_USB_GADGET_MANUFACTURER="Texas Instruments"
+#CONFIG_USB_GADGET_VENDOR_NUM=0x0451
+#CONFIG_USB_GADGET_PRODUCT_NUM=0xd022
+CONFIG_USB_ETHER=y
+CONFIG_WDT=y
+# CONFIG_SPL_WDT is not set
+CONFIG_DYNAMIC_CRC_TABLE=y
+CONFIG_RSA=y
+CONFIG_LZO=y
+### TEST ###
+## CONFIG_SPL_USE_ARCH_MEMCPY is not set
+## CONFIG_SPL_USE_ARCH_MEMSET is not set
+#CONFIG_SPL_TINY_MEMSET=y
+## CONFIG_BLK is not set
+CONFIG_SPL_OF_CONTROL=y
+#CONFIG_OF_SPL_REMOVE_PROPS="clocks clock-names interrupt-parent"
+CONFIG_OF_SPL_REMOVE_PROPS=""
+#CONFIG_SPL_OF_PLATDATA=y
+CONFIG_SPL_OF_TRANSLATE=y
+### for verified boot ###
+CONFIG_SPL_CRYPTO=y
+CONFIG_RSA=y
+CONFIG_SPL_RSA=y
+CONFIG_SHA1=y
+CONFIG_SHA256=y
+CONFIG_SHA512=y
+CONFIG_SPL_SHA1=y
+CONFIG_SPL_SHA256=y
+CONFIG_SPL_SHA512=y
+CONFIG_FIT_SIGNATURE=y
+CONFIG_FIT_SIGNATURE_MAX_SIZE=0x10000000
+CONFIG_SPL_FIT_FULL_CHECK=y
+CONFIG_SPL_FIT_SIGNATURE=y
+CONFIG_SPL_FIT_SIGNATURE_MAX_SIZE=0x10000000
+CONFIG_SPL_LOAD_FIT_FULL=y
--- a/recipes-bsp/u-boot/files2/uEnv.txt
+++ b/recipes-bsp/u-boot/files2/uEnv.txt
@@ -0,0 +1,51 @@
+arch=arm
+baudrate=115200
+board=pengwyn
+board_name=pengwyn
+bootargs=console=ttyO0,115200n8 root=ubi0:rootfs rw ubi.mtd=7,2048 rootfstype=ubifs rootwait=1
+bootcmd=run mmcboot;run nandboot;
+bootdelay=2
+bootdir=/boot
+bootenv=uEnv.txt
+bootfile=fitImage
+bootpart=0:1
+console=ttyS0,115200n8
+cpu=armv7
+ethact=cpsw
+ethaddr=00:18:30:fc:c0:35
+fdtaddr=0x81200000
+fdtfile=am335x-pengwyn.dtb
+importbootenv=echo Importing environment from mmc ...; env import -t $loadaddr $filesize
+loadaddr=0x80200000
+loadbootenv=fatload mmc ${mmcdev} ${loadaddr} ${bootenv}
+loadfdt=fatload mmc ${mmcdev} ${fdtaddr} ${fdtfile}
+loadimage=fatload mmc ${mmcdev} ${loadaddr} ${bootfile}
+mmcargs_old=setenv bootargs console=${console} ${optargs} root=${mmcroot} rootfstype=${mmcrootfstype} shell=before:dmverity
+mmcargs=setenv bootargs console=${console} ${optargs} root=${mmcroot} rootfstype=${mmcrootfstype}
+mmcboot=mmc dev ${mmcdev}; if mmc rescan; then echo SD/MMC found on device ${mmcdev};if run loadbootenv; then echo Loaded environment from ${bootenv};run importbootenv;fi;if test -n $uenvcmd; then echo Running uenvcmd ...;run uenvcmd;fi;if run loadimage; then run mmcloados;fi;fi;
+mmcboot_old=mmc dev ${mmcdev}; if mmc rescan; then echo SD/MMC found on device ${mmcdev};if run loadbootenv; then echo Loaded environment from ${bootenv};run importbootenv;fi;if test -n $uenvcmd; then echo Running uenvcmd ...;run uenvcmd;fi;if run loadimage; then run loadfdt;run mmcloados;fi;fi;
+mmcdev=0
+mmcloados=run mmcargs; bootm ${loadaddr};
+mmcloados_old=run mmcargs; bootm ${loadaddr} - ${fdtaddr};
+mmcroot=/dev/mmcblk0p2 ro
+mmcrootfstype=ext4 rootwait
+mtddevname=SPL
+mtddevnum=0
+mtdids=nand0=omap2-nand.0
+mtdparts=mtdparts=omap2-nand.0:512k(SPL),512k(SPL.backup1),512k(SPL.backup2),512k(SPL.backup3),1536k(u-boot),512k(u-boot-spl-os),512k(u-boot-env),5m(kernel),-(rootfs)
+nandargs=setenv bootargs console=${console} ${optargs} root=${nandroot} rootfstype=${nandrootfstype}
+nandboot=echo Booting from nand ...; run nandargs; nand read ${fdtaddr} u-boot-spl-os; nand read ${loadaddr} kernel; bootz ${loadaddr} - ${fdtaddr}
+nandroot=ubi0:rootfs rw ubi.mtd=7,2048
+nandrootfstype=ubifs rootwait=1
+netargs=setenv bootargs console=${console} ${optargs} root=/dev/nfs nfsroot=${serverip}:${rootpath},${nfsopts} rw ip=dhcp
+netboot=echo Booting from network ...; setenv autoload no; dhcp; tftp ${loadaddr} ${bootfile}; tftp ${fdtaddr} ${fdtfile}; run netargs; bootz ${loadaddr} - ${fdtaddr}
+nfsopts=nolock
+partition=nand0,0
+rootpath=/export/rootfs
+soc=am33xx
+static_ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}::off
+stderr=serial@44e09000
+stdin=serial@44e09000
+stdout=serial@44e09000
+vendor=silica
+ver=U-Boot 2020.07-g2f5fbb5b39 (Jul 06 2020 - 19:22:53 +0000)
--- a/recipes-bsp/u-boot/u-boot-ti-staging_2022.10.bb
+++ b/recipes-bsp/u-boot/u-boot-ti-staging_2022.10.bb
@@ -0,0 +1,58 @@
+# Copyright (C) 2023 Vincent BENOIT <vincent.benoit@scle.fr>
+# Release under the MIT license (see COPYING.MIT for the terms)
+require u-boot-ti.inc
+
+FILESEXTRAPATHS:prepend := "${THISDIR}/files2:"
+
+LIC_FILES_CHKSUM = "file://Licenses/README;md5=2ca5f2c35c8cc335f0a19756634782f1"
+
+PR = "r33"
+BRANCH = "master"
+SRC_URI = " \
+            ${UBOOT_GIT_URI};protocol=${UBOOT_GIT_PROTOCOL};branch=${BRANCH} \
+            file://board.c \
+            file://board.h \
+            file://Kconfig \
+            file://MAINTAINERS \
+            file://Makefile \
+            file://mux.c \
+            file://am335x_pengwyn.h \
+            file://pengwyn_defconfig \
+            file://am335x-pengwyn.dts \
+            file://am335x-pengwyn-u-boot.dtsi \
+            file://uEnv.txt \
+            file://0001-add-pengwyn-dts-to-makefile.patch \
+            file://0002-add-target-pengwyn.patch \
+            file://0003-misc-board-failed.patch \
+            file://0010-log-compile-err.patch \
+            file://0020-debug.patch \
+          "
+
+# Tag: v2022.10
+SRCREV = "4debc57a3da6c3f4d3f89a637e99206f4cea0a96"
+
+S = "${WORKDIR}/git"
+
+do_configure:prepend() {
+	install -d ${S}/board/silica/pengwyn
+	install -m 0644 ${WORKDIR}/board.c ${S}/board/silica/pengwyn	
+	install -m 0644 ${WORKDIR}/board.h ${S}/board/silica/pengwyn	
+	install -m 0644 ${WORKDIR}/Kconfig ${S}/board/silica/pengwyn	
+	install -m 0644 ${WORKDIR}/MAINTAINERS ${S}/board/silica/pengwyn	
+	install -m 0644 ${WORKDIR}/Makefile ${S}/board/silica/pengwyn	
+	install -m 0644 ${WORKDIR}/mux.c ${S}/board/silica/pengwyn	
+
+	install -d ${S}/configs
+	install -m 0644 ${WORKDIR}/pengwyn_defconfig ${S}/configs
+
+	install -d ${S}/include/configs/
+	install -m 0644 ${WORKDIR}/am335x_pengwyn.h ${S}/include/configs/
+
+	install -d ${S}/arch/arm/dts
+	install -m 0644 ${WORKDIR}/am335x-pengwyn.dts ${S}/arch/arm/dts	
+	install -m 0644 ${WORKDIR}/am335x-pengwyn-u-boot.dtsi ${S}/arch/arm/dts	
+}
+
+do_deploy:append() {
+	install -m 0644 ${WORKDIR}/uEnv.txt ${DEPLOY_DIR_IMAGE}
+}
--- a/recipes-kernel/linux/files/configs/pengwyn_defconfig
+++ b/recipes-kernel/linux/files/configs/pengwyn_defconfig
@@ -6182,11 +6182,11 @@ CONFIG_CRYPTO_CBC=m
 # CONFIG_CRYPTO_CFB is not set
 CONFIG_CRYPTO_CTR=m
 # CONFIG_CRYPTO_CTS is not set
-CONFIG_CRYPTO_ECB=m
+CONFIG_CRYPTO_ECB=y
 # CONFIG_CRYPTO_LRW is not set
 # CONFIG_CRYPTO_OFB is not set
 # CONFIG_CRYPTO_PCBC is not set
-# CONFIG_CRYPTO_XTS is not set
+CONFIG_CRYPTO_XTS=y
 # CONFIG_CRYPTO_KEYWRAP is not set
 # CONFIG_CRYPTO_ADIANTUM is not set
 # CONFIG_CRYPTO_ESSIV is not set
@@ -6195,7 +6195,7 @@ CONFIG_CRYPTO_ECB=m
 # Hash modes
 #
 CONFIG_CRYPTO_CMAC=m
-CONFIG_CRYPTO_HMAC=m
+CONFIG_CRYPTO_HMAC=y
 # CONFIG_CRYPTO_XCBC is not set
 # CONFIG_CRYPTO_VMAC is not set

@@ -6215,10 +6215,10 @@ CONFIG_CRYPTO_MD5=m
 # CONFIG_CRYPTO_RMD160 is not set
 # CONFIG_CRYPTO_RMD256 is not set
 # CONFIG_CRYPTO_RMD320 is not set
-CONFIG_CRYPTO_SHA1=m
-CONFIG_CRYPTO_LIB_SHA256=m
-CONFIG_CRYPTO_SHA256=m
-CONFIG_CRYPTO_SHA512=m
+CONFIG_CRYPTO_SHA1=y
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA512=y
 # CONFIG_CRYPTO_SHA3 is not set
 # CONFIG_CRYPTO_SM3 is not set
 # CONFIG_CRYPTO_STREEBOG is not set
--- a/recipes-kernel/linux/linux-ti-staging-5.4/ti33x/defconfig
+++ b/recipes-kernel/linux/linux-ti-staging-5.4/ti33x/defconfig
@@ -887,6 +887,7 @@ CONFIG_IPV6_MULTIPLE_TABLES=y
 # CONFIG_IPV6_MROUTE is not set
 # CONFIG_IPV6_SEG6_LWTUNNEL is not set
 # CONFIG_IPV6_SEG6_HMAC is not set
+# CONFIG_NETLABEL is not set
 # CONFIG_NETWORK_SECMARK is not set
 CONFIG_NET_PTP_CLASSIFY=y
 # CONFIG_NETWORK_PHY_TIMESTAMPING is not set
@@ -1034,6 +1035,7 @@ CONFIG_IP_NF_TARGET_MASQUERADE=m
 # CONFIG_IP_NF_TARGET_REDIRECT is not set
 # CONFIG_IP_NF_MANGLE is not set
 # CONFIG_IP_NF_RAW is not set
+# CONFIG_IP_NF_SECURITY is not set
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
@@ -2751,13 +2753,13 @@ CONFIG_HW_RANDOM_OMAP=y
 CONFIG_HW_RANDOM_OPTEE=y
 # CONFIG_APPLICOM is not set
 # CONFIG_RAW_DRIVER is not set
-CONFIG_TCG_TPM=m
+CONFIG_TCG_TPM=y
 CONFIG_HW_RANDOM_TPM=y
-CONFIG_TCG_TIS_CORE=m
+CONFIG_TCG_TIS_CORE=y
 # CONFIG_TCG_TIS is not set
-CONFIG_TCG_TIS_SPI=m
+CONFIG_TCG_TIS_SPI=y
 # CONFIG_TCG_TIS_I2C_ATMEL is not set
-CONFIG_TCG_TIS_I2C_INFINEON=m
+CONFIG_TCG_TIS_I2C_INFINEON=y
 # CONFIG_TCG_TIS_I2C_NUVOTON is not set
 # CONFIG_TCG_ATMEL is not set
 # CONFIG_TCG_VTPM_PROXY is not set
@@ -5977,7 +5979,7 @@ CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_ORANGEFS_FS is not set
 # CONFIG_ADFS_FS is not set
 # CONFIG_AFFS_FS is not set
-# CONFIG_ECRYPT_FS is not set
+CONFIG_ECRYPT_FS=y
 # CONFIG_HFS_FS is not set
 # CONFIG_HFSPLUS_FS is not set
 # CONFIG_BEFS_FS is not set
@@ -6128,16 +6130,42 @@ CONFIG_KEYS=y
 # CONFIG_KEYS_REQUEST_CACHE is not set
 # CONFIG_PERSISTENT_KEYRINGS is not set
 # CONFIG_BIG_KEYS is not set
-# CONFIG_TRUSTED_KEYS is not set
-# CONFIG_ENCRYPTED_KEYS is not set
+CONFIG_TRUSTED_KEYS=y
+CONFIG_ENCRYPTED_KEYS=y
 # CONFIG_KEY_DH_OPERATIONS is not set
 # CONFIG_SECURITY_DMESG_RESTRICT is not set
-# CONFIG_SECURITY is not set
+CONFIG_SECURITY=y
 CONFIG_SECURITYFS=y
+# CONFIG_SECURITY_NETWORK is not set
+# CONFIG_SECURITY_PATH is not set
 CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y
 # CONFIG_HARDENED_USERCOPY is not set
 # CONFIG_FORTIFY_SOURCE is not set
 # CONFIG_STATIC_USERMODEHELPER is not set
+# CONFIG_SECURITY_SMACK is not set
+# CONFIG_SECURITY_TOMOYO is not set
+# CONFIG_SECURITY_APPARMOR is not set
+# CONFIG_SECURITY_LOADPIN is not set
+# CONFIG_SECURITY_YAMA is not set
+# CONFIG_SECURITY_SAFESETID is not set
+# CONFIG_SECURITY_LOCKDOWN_LSM is not set
+CONFIG_INTEGRITY=y
+# CONFIG_INTEGRITY_SIGNATURE is not set
+CONFIG_IMA=y
+CONFIG_IMA_MEASURE_PCR_IDX=10
+# CONFIG_IMA_TEMPLATE is not set
+CONFIG_IMA_NG_TEMPLATE=y
+# CONFIG_IMA_SIG_TEMPLATE is not set
+CONFIG_IMA_DEFAULT_TEMPLATE="ima-ng"
+# CONFIG_IMA_DEFAULT_HASH_SHA1 is not set
+CONFIG_IMA_DEFAULT_HASH_SHA256=y
+# CONFIG_IMA_DEFAULT_HASH_SHA512 is not set
+CONFIG_IMA_DEFAULT_HASH="sha256"
+CONFIG_IMA_WRITE_POLICY=y
+CONFIG_IMA_READ_POLICY=y
+CONFIG_IMA_APPRAISE=y
+CONFIG_IMA_APPRAISE_BOOTPARAM=y
+# CONFIG_EVM is not set
 CONFIG_DEFAULT_SECURITY_DAC=y
 CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity"

@@ -6167,7 +6195,7 @@ CONFIG_CRYPTO_ALGAPI=y
 CONFIG_CRYPTO_ALGAPI2=y
 CONFIG_CRYPTO_AEAD=m
 CONFIG_CRYPTO_AEAD2=y
-CONFIG_CRYPTO_BLKCIPHER=m
+CONFIG_CRYPTO_BLKCIPHER=y
 CONFIG_CRYPTO_BLKCIPHER2=y
 CONFIG_CRYPTO_HASH=y
 CONFIG_CRYPTO_HASH2=y
@@ -6214,15 +6242,15 @@ CONFIG_CRYPTO_ECHAINIV=m
 #
 # Block modes
 #
-CONFIG_CRYPTO_CBC=m
+CONFIG_CRYPTO_CBC=y
 # CONFIG_CRYPTO_CFB is not set
 CONFIG_CRYPTO_CTR=m
 # CONFIG_CRYPTO_CTS is not set
-CONFIG_CRYPTO_ECB=m
+CONFIG_CRYPTO_ECB=y
 # CONFIG_CRYPTO_LRW is not set
 # CONFIG_CRYPTO_OFB is not set
 # CONFIG_CRYPTO_PCBC is not set
-# CONFIG_CRYPTO_XTS is not set
+CONFIG_CRYPTO_XTS=y
 # CONFIG_CRYPTO_KEYWRAP is not set
 # CONFIG_CRYPTO_ADIANTUM is not set
 CONFIG_CRYPTO_ESSIV=m
@@ -6231,7 +6259,7 @@ CONFIG_CRYPTO_ESSIV=m
 # Hash modes
 #
 CONFIG_CRYPTO_CMAC=m
-CONFIG_CRYPTO_HMAC=m
+CONFIG_CRYPTO_HMAC=y
 # CONFIG_CRYPTO_XCBC is not set
 # CONFIG_CRYPTO_VMAC is not set

@@ -6245,16 +6273,16 @@ CONFIG_CRYPTO_CRCT10DIF=y
 CONFIG_CRYPTO_GHASH=m
 # CONFIG_CRYPTO_POLY1305 is not set
 CONFIG_CRYPTO_MD4=m
-CONFIG_CRYPTO_MD5=m
+CONFIG_CRYPTO_MD5=y
 # CONFIG_CRYPTO_MICHAEL_MIC is not set
 # CONFIG_CRYPTO_RMD128 is not set
 # CONFIG_CRYPTO_RMD160 is not set
 # CONFIG_CRYPTO_RMD256 is not set
 # CONFIG_CRYPTO_RMD320 is not set
-CONFIG_CRYPTO_SHA1=m
-CONFIG_CRYPTO_LIB_SHA256=m
-CONFIG_CRYPTO_SHA256=m
-CONFIG_CRYPTO_SHA512=m
+CONFIG_CRYPTO_SHA1=y
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA512=y
 # CONFIG_CRYPTO_SHA3 is not set
 # CONFIG_CRYPTO_SM3 is not set
 # CONFIG_CRYPTO_STREEBOG is not set
@@ -6264,8 +6292,8 @@ CONFIG_CRYPTO_SHA512=m
 #
 # Ciphers
 #
-CONFIG_CRYPTO_LIB_AES=m
-CONFIG_CRYPTO_AES=m
+CONFIG_CRYPTO_LIB_AES=y
+CONFIG_CRYPTO_AES=y
 # CONFIG_CRYPTO_AES_TI is not set
 # CONFIG_CRYPTO_ANUBIS is not set
 CONFIG_CRYPTO_LIB_ARC4=m
@@ -6274,8 +6302,8 @@ CONFIG_CRYPTO_LIB_ARC4=m
 # CONFIG_CRYPTO_CAMELLIA is not set
 # CONFIG_CRYPTO_CAST5 is not set
 # CONFIG_CRYPTO_CAST6 is not set
-CONFIG_CRYPTO_LIB_DES=m
-CONFIG_CRYPTO_DES=m
+CONFIG_CRYPTO_LIB_DES=y
+CONFIG_CRYPTO_DES=y
 # CONFIG_CRYPTO_FCRYPT is not set
 # CONFIG_CRYPTO_KHAZAD is not set
 # CONFIG_CRYPTO_SALSA20 is not set
--- a/recipes-kernel/linux/linux-ti-staging-5.4/ti33x/defconfig.old
+++ b/recipes-kernel/linux/linux-ti-staging-5.4/ti33x/defconfig.old
--- a/wic/pengwyn-yocto-crypt.wks.in
+++ b/wic/pengwyn-yocto-crypt.wks.in
@@ -0,0 +1,9 @@
+# short-description: Create SD card image for Pengwyn Board
+# long-description: Creates a partitioned SD card image for Pengwyn Board.
+# Boot files are located in the first vfat partition.
+
+part /boot --source bootimg-partition --ondisk mmcblk0 --fstype=vfat --label boot --active --align 4096 --fixed-size 50 --use-uuid
+part / --source rootfs --ondisk mmcblk0 --fstype=ext4 --label root --align 4 --use-uuid --size 1G
+part /data --ondisk mmcblk0 --fstype=ext4 --label data --use-uuid --fixed-size 100M
+part /data2 --ondisk mmcblk0 --fstype=ext4 --label data2 --use-uuid --fixed-size 200M
+bootloader --append="console=ttyS0,115200"
--- a/wic/pengwyn-yocto-verity-crypt.wks.in
+++ b/wic/pengwyn-yocto-verity-crypt.wks.in
@@ -0,0 +1,9 @@
+# short-description: Create SD card image for Pengwyn Board
+# long-description: Creates a partitioned SD card image for Pengwyn Board.
+# Boot files are located in the first vfat partition.
+
+part /boot --source bootimg-partition --ondisk mmcblk0 --fstype=vfat --label boot --active --align 4096 --fixed-size 20 --sourceparams="loader=u-boot" --use-uuid
+part / --source rawcopy --ondisk mmcblk0 --sourceparams="file=${IMGDEPLOYDIR}/${DM_VERITY_IMAGE}-${MACHINE}.${DM_VERITY_IMAGE_TYPE}.verity"
+#part /data --source empty --ondisk mmcblk0 --fstype=ext4 --label data --use-uuid --size 100M
+bootloader --append="console=ttyS0,115200"
+