project-lakitu/eclass/cos-kernel.eclass - cos/overlays/board-overlays - Git at Google

 #
 # Copyright 2021 Google LLC
 #
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
 # version 2 as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 # GNU General Public License for more details.
 #

 # Check for EAPI 5+
 case "${EAPI:-0}" in
 0|1|2|3|4) die "Unsupported EAPI=${EAPI:-0} (too old) for ${ECLASS}" ;;
 5|6) inherit eapi7-ver ;;
 7) ;;
 esac

 inherit cros-workon cros-kernel2 osreleased

 #
 # To control the module signing behavior developers can define
 # the following variables in an ebuild file:
 #
 # COS_KERNEL_X509_GENKEY (mandatory) contains path to an OpenSSL
 # configuration file used to generate signing keys/certificates
 #
 # COS_KERNEL_ROOT_CERT (optional) contains path to the list of
 # system-wide trusted keys in PEM format
 #

 CONFIG_FRAGMENTS=(
 	nvme_tcp
 	no_io_strict_devmem
 )

 # When "nofragments" flag is set, do not overlay kernel config
 # with fragments and use the config file as-is
 IUSE="gpu nofragments ${CONFIG_FRAGMENTS[@]} hardened"

 # Describe custom fragments by defining a human-readable
 # description and configuration fragment

 # foo_desc="Enable FOOBAR support"
 # foo_config="
 # CONFIG_FOOBAR=y
 # "

 nvme_tcp_desc="Enable NVME over Fabrics using TCP"
 nvme_tcp_config="
 CONFIG_NVME_COMMON=y
 CONFIG_NVME_FABRICS=m
 CONFIG_NVME_TCP=m
 CONFIG_NVME_AUTH=y
 CONFIG_NVME_TARGET=m
 CONFIG_NVME_TARGET_PASSTHRU=y
 # CONFIG_NVME_TARGET_LOOP is not set
 # CONFIG_NVME_TARGET_FC is not set
 CONFIG_NVME_TARGET_TCP=m
 CONFIG_NVME_TARGET_AUTH=y
 "

 no_io_strict_devmem_desc="Disable CONFIG_IO_STRICT_DEVMEM for GPU driver development"
 no_io_strict_devmem_config="
 # CONFIG_IO_STRICT_DEVMEM is not set
 "

 cos-kernel_src_prepare() {
 	cros_allow_gnu_build_tools
 	cros-kernel2_src_prepare
 }

 cos-kernel_src_configure() {
 	# Provide a custom key configuration file, because otherwise the kernel
 	# would auto-generate one.
 	mkdir -p "$(cros-workon_get_build_dir)/certs"

 	if ! [ -f "${COS_KERNEL_X509_GENKEY}" ]; then
 		die "x509 config not found: '${COS_KERNEL_X509_GENKEY}'"
 	fi
 	cp -f "${COS_KERNEL_X509_GENKEY}" \
 		"$(cros-workon_get_build_dir)/certs/x509.genkey" || die
 	# The root key belongs to lakitu board.
 	if [ -n "${COS_KERNEL_ROOT_CERT}" ]; then
 		if ! [ -f "${COS_KERNEL_ROOT_CERT}" ]; then
 			die "COS kernel root cert not found: '${COS_KERNEL_ROOT_CERT}'"
 		fi
 		cp -f "${COS_KERNEL_ROOT_CERT}" \
 			"$(cros-workon_get_build_dir)/certs/trusted_key.pem" || die
 	fi

 	if use nofragments; then
 		export CONFIG_FRAGMENTS=()
 	fi
         # * -fstack-clash-protection inserts code to probe each page of the stack space
         # as it is allocated to protect from stack-clash style attacks.
         # * -D_FORTIFY_SOURCE=2 enables additional security features of the GNU libc when
         # calling memory and string handling functions.
 	if use hardened; then
 		if [ "${ARCH}" == "amd64" ]; then
 			export KCFLAGS="-fstack-clash-protection -D_FORTIFY_SOURCE=3 -ftrivial-auto-var-init=zero -fstack-protector-strong"
 		else
 			export KCFLAGS="-fstack-clash-protection -D_FORTIFY_SOURCE=3 -ftrivial-auto-var-init=zero -fPIE -fsanitize=shadow-call-stack -fstack-protector-strong"
 		fi
 	fi

 	cros-kernel2_src_configure
 }

 tar_kernel_source() {
 	# Put kernel source tarball under /opt to avoid it gets
 	# masked by INSTALL_MASK.
 	local source_dir=opt/google/src
 	dodir "${source_dir}"
 	pushd "${D}/usr/src/${P}" || die
 	tar --exclude="./build" -czf "${D}/${source_dir}/kernel-src.tar.gz" .
 	popd || die
 }

 tar_kernel_headers() {
 	einfo "Packaging kernel headers"
 	# We do pretty much exactly what scripts/package/builddeb does.
 	pushd "${D}/usr/src/${P}" || die
 	(
 		find . -name Makefile\* -o -name Kconfig\* -o -name \*.pl
 		find arch/*/include include scripts -type f -o -type l
 		find "arch/$(tc-arch-kernel)" -name module.lds -o -name Kbuild.platforms -o -name Platform
 		find "arch/$(tc-arch-kernel)" -name include -o -name scripts -type d | while IFS='' read -r line; do
 			find "${line}" -type f
 		done
 	) > "${T}/hdrsrcfiles"
 	popd || die

 	pushd "$(cros-workon_get_build_dir)" || die
 	{
 		if cros_chkconfig_present OBJTOOL || cros_chkconfig_present STACK_VALIDATION; then
 			find tools/objtool -type f -executable
 		fi

 		find "arch/$(tc-arch-kernel)/include" Module.symvers include scripts -type f

 		if cros_chkconfig_present GCC_PLUGINS; then
 			find scripts/gcc-plugins -name \*.so -o -name gcc-common.h
 		fi
 	} > "${T}/hdrobjfiles"
 	popd || die

 	local destdir="${T}/headers_tmp/usr/src/linux-headers-$(kernelrelease)"
 	mkdir -p "${destdir}"
 	tar -c -f - -C "${D}/usr/src/${P}" -T "${T}/hdrsrcfiles" | tar -xf - -C "${destdir}"
 	tar -c -f - -C "$(cros-workon_get_build_dir)" -T "${T}/hdrobjfiles" | tar -xf - -C "${destdir}"
 	rm "${T}/hdrsrcfiles" "${T}/hdrobjfiles"

 	cp "$(cros-workon_get_build_dir)/.config" "${destdir}/.config"

 	# We don't configure INSTALL_MASK to remove files in /opt, so export the
 	# headers tarball through /opt.
 	local source_dir=opt/google/src
 	dodir "${source_dir}"
 	pushd "${T}/headers_tmp" || die
 	tar -czf "${D}/${source_dir}/kernel-headers.tgz" .
 	popd || die
 	rm -r "${T}/headers_tmp"
 }

 write_toolchain_env() {
 	# Write the compiler info used for kernel compilation
 	# in toolchain_env.
 	local toolchain_env_dir=etc
 	# Example for toolchain_env content:
 	# CC=x86_64-cros-linux-gnu-clang
 	# CXX=x86_64-cros-linux-gnu-clang++
 	# The file will be deleted after copying data to BUILD_DIR artifact
 	echo "CC=${CC}" > "${D}/${toolchain_env_dir}/toolchain_env"
 	echo "CXX=${CXX}" >> "${D}/${toolchain_env_dir}/toolchain_env"
 }

 write_kernel_info() {
 	# Write kernel information used for building kernel.
 	local kernel_info_dir=etc
 	# Example for kernel_info content:
 	# URL=https://chromium.googlesource.com/chromiumos/third_party/kernel
 	echo "URL=${CROS_WORKON_REPO}/${CROS_WORKON_PROJECT}" > "${D}/${kernel_info_dir}/kernel_info"
 }

 get_kernel_commit_id() {
 	# Provide kernel commit id
 	# VCSID variable is unconditionally set by the cros-workon eclass, and
 	# is in the form of "<ebuild_revision>-<sha1>".
 	echo "${VCSID##*-}"
 }

 write_kernel_commit() {
 	# Write kernel commit information used for building kernel.
 	local kernel_commit_dir=etc
 	# Example for kernel_commit content:
 	# c7ad6ff415b5a1e87f8333e2a63c7209e6efc1b2
 	get_kernel_commit_id > "${D}/${kernel_commit_dir}/kernel_commit"
 }

 cos-kernel_src_install() {
 	cros-kernel2_src_install

 	do_osrelease_field "KERNEL_COMMIT_ID" "$(get_kernel_commit_id)"

 	if use kernel_sources; then
 		# Install kernel source and headers tarballs so they can be exported as
 		# artifacts later.
 		tar_kernel_source
 		tar_kernel_headers
 		# Install kernel compiler information
 		write_toolchain_env
 		# Install kernel source information
 		write_kernel_info
 		# Install kernel commit information
 		write_kernel_commit
 	fi

 	# Install IMA certificates
 	insinto /etc/ima
 	newins "$(cros-workon_get_build_dir)"/certs/signing_key.x509 pubkey.x509
 }
	#
	# Copyright 2021 Google LLC
	#
	# This program is free software; you can redistribute it and/or
	# modify it under the terms of the GNU General Public License
	# version 2 as published by the Free Software Foundation.
	#
	# This program is distributed in the hope that it will be useful,
	# but WITHOUT ANY WARRANTY; without even the implied warranty of
	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	# GNU General Public License for more details.
	#

	# Check for EAPI 5+
	case "${EAPI:-0}" in
	0\|1\|2\|3\|4) die "Unsupported EAPI=${EAPI:-0} (too old) for ${ECLASS}" ;;
	5\|6) inherit eapi7-ver ;;
	7) ;;
	esac

	inherit cros-workon cros-kernel2 osreleased

	#
	# To control the module signing behavior developers can define
	# the following variables in an ebuild file:
	#
	# COS_KERNEL_X509_GENKEY (mandatory) contains path to an OpenSSL
	# configuration file used to generate signing keys/certificates
	#
	# COS_KERNEL_ROOT_CERT (optional) contains path to the list of
	# system-wide trusted keys in PEM format
	#

	CONFIG_FRAGMENTS=(
	nvme_tcp
	no_io_strict_devmem
	)

	# When "nofragments" flag is set, do not overlay kernel config
	# with fragments and use the config file as-is
	IUSE="gpu nofragments ${CONFIG_FRAGMENTS[@]} hardened"

	# Describe custom fragments by defining a human-readable
	# description and configuration fragment

	# foo_desc="Enable FOOBAR support"
	# foo_config="
	# CONFIG_FOOBAR=y
	# "

	nvme_tcp_desc="Enable NVME over Fabrics using TCP"
	nvme_tcp_config="
	CONFIG_NVME_COMMON=y
	CONFIG_NVME_FABRICS=m
	CONFIG_NVME_TCP=m
	CONFIG_NVME_AUTH=y
	CONFIG_NVME_TARGET=m
	CONFIG_NVME_TARGET_PASSTHRU=y
	# CONFIG_NVME_TARGET_LOOP is not set
	# CONFIG_NVME_TARGET_FC is not set
	CONFIG_NVME_TARGET_TCP=m
	CONFIG_NVME_TARGET_AUTH=y
	"

	no_io_strict_devmem_desc="Disable CONFIG_IO_STRICT_DEVMEM for GPU driver development"
	no_io_strict_devmem_config="
	# CONFIG_IO_STRICT_DEVMEM is not set
	"

	cos-kernel_src_prepare() {
	cros_allow_gnu_build_tools
	cros-kernel2_src_prepare
	}

	cos-kernel_src_configure() {
	# Provide a custom key configuration file, because otherwise the kernel
	# would auto-generate one.
	mkdir -p "$(cros-workon_get_build_dir)/certs"

	if ! [ -f "${COS_KERNEL_X509_GENKEY}" ]; then
	die "x509 config not found: '${COS_KERNEL_X509_GENKEY}'"
	fi
	cp -f "${COS_KERNEL_X509_GENKEY}" \
	"$(cros-workon_get_build_dir)/certs/x509.genkey" \|\| die
	# The root key belongs to lakitu board.
	if [ -n "${COS_KERNEL_ROOT_CERT}" ]; then
	if ! [ -f "${COS_KERNEL_ROOT_CERT}" ]; then
	die "COS kernel root cert not found: '${COS_KERNEL_ROOT_CERT}'"
	fi
	cp -f "${COS_KERNEL_ROOT_CERT}" \
	"$(cros-workon_get_build_dir)/certs/trusted_key.pem" \|\| die
	fi

	if use nofragments; then
	export CONFIG_FRAGMENTS=()
	fi
	# * -fstack-clash-protection inserts code to probe each page of the stack space
	# as it is allocated to protect from stack-clash style attacks.
	# * -D_FORTIFY_SOURCE=2 enables additional security features of the GNU libc when
	# calling memory and string handling functions.
	if use hardened; then
	if [ "${ARCH}" == "amd64" ]; then
	export KCFLAGS="-fstack-clash-protection -D_FORTIFY_SOURCE=3 -ftrivial-auto-var-init=zero -fstack-protector-strong"
	else
	export KCFLAGS="-fstack-clash-protection -D_FORTIFY_SOURCE=3 -ftrivial-auto-var-init=zero -fPIE -fsanitize=shadow-call-stack -fstack-protector-strong"
	fi
	fi

	cros-kernel2_src_configure
	}

	tar_kernel_source() {
	# Put kernel source tarball under /opt to avoid it gets
	# masked by INSTALL_MASK.
	local source_dir=opt/google/src
	dodir "${source_dir}"
	pushd "${D}/usr/src/${P}" \|\| die
	tar --exclude="./build" -czf "${D}/${source_dir}/kernel-src.tar.gz" .
	popd \|\| die
	}

	tar_kernel_headers() {
	einfo "Packaging kernel headers"
	# We do pretty much exactly what scripts/package/builddeb does.
	pushd "${D}/usr/src/${P}" \|\| die
	(
	find . -name Makefile\* -o -name Kconfig\* -o -name \*.pl
	find arch/*/include include scripts -type f -o -type l
	find "arch/$(tc-arch-kernel)" -name module.lds -o -name Kbuild.platforms -o -name Platform
	find "arch/$(tc-arch-kernel)" -name include -o -name scripts -type d \| while IFS='' read -r line; do
	find "${line}" -type f
	done
	) > "${T}/hdrsrcfiles"
	popd \|\| die

	pushd "$(cros-workon_get_build_dir)" \|\| die
	{
	if cros_chkconfig_present OBJTOOL \|\| cros_chkconfig_present STACK_VALIDATION; then
	find tools/objtool -type f -executable
	fi

	find "arch/$(tc-arch-kernel)/include" Module.symvers include scripts -type f

	if cros_chkconfig_present GCC_PLUGINS; then
	find scripts/gcc-plugins -name \*.so -o -name gcc-common.h
	fi
	} > "${T}/hdrobjfiles"
	popd \|\| die

	local destdir="${T}/headers_tmp/usr/src/linux-headers-$(kernelrelease)"
	mkdir -p "${destdir}"
	tar -c -f - -C "${D}/usr/src/${P}" -T "${T}/hdrsrcfiles" \| tar -xf - -C "${destdir}"
	tar -c -f - -C "$(cros-workon_get_build_dir)" -T "${T}/hdrobjfiles" \| tar -xf - -C "${destdir}"
	rm "${T}/hdrsrcfiles" "${T}/hdrobjfiles"

	cp "$(cros-workon_get_build_dir)/.config" "${destdir}/.config"

	# We don't configure INSTALL_MASK to remove files in /opt, so export the
	# headers tarball through /opt.
	local source_dir=opt/google/src
	dodir "${source_dir}"
	pushd "${T}/headers_tmp" \|\| die
	tar -czf "${D}/${source_dir}/kernel-headers.tgz" .
	popd \|\| die
	rm -r "${T}/headers_tmp"
	}

	write_toolchain_env() {
	# Write the compiler info used for kernel compilation
	# in toolchain_env.
	local toolchain_env_dir=etc
	# Example for toolchain_env content:
	# CC=x86_64-cros-linux-gnu-clang
	# CXX=x86_64-cros-linux-gnu-clang++
	# The file will be deleted after copying data to BUILD_DIR artifact
	echo "CC=${CC}" > "${D}/${toolchain_env_dir}/toolchain_env"
	echo "CXX=${CXX}" >> "${D}/${toolchain_env_dir}/toolchain_env"
	}

	write_kernel_info() {
	# Write kernel information used for building kernel.
	local kernel_info_dir=etc
	# Example for kernel_info content:
	# URL=https://chromium.googlesource.com/chromiumos/third_party/kernel
	echo "URL=${CROS_WORKON_REPO}/${CROS_WORKON_PROJECT}" > "${D}/${kernel_info_dir}/kernel_info"
	}

	get_kernel_commit_id() {
	# Provide kernel commit id
	# VCSID variable is unconditionally set by the cros-workon eclass, and
	# is in the form of "<ebuild_revision>-<sha1>".
	echo "${VCSID##*-}"
	}

	write_kernel_commit() {
	# Write kernel commit information used for building kernel.
	local kernel_commit_dir=etc
	# Example for kernel_commit content:
	# c7ad6ff415b5a1e87f8333e2a63c7209e6efc1b2
	get_kernel_commit_id > "${D}/${kernel_commit_dir}/kernel_commit"
	}

	cos-kernel_src_install() {
	cros-kernel2_src_install

	do_osrelease_field "KERNEL_COMMIT_ID" "$(get_kernel_commit_id)"

	if use kernel_sources; then
	# Install kernel source and headers tarballs so they can be exported as
	# artifacts later.
	tar_kernel_source
	tar_kernel_headers
	# Install kernel compiler information
	write_toolchain_env
	# Install kernel source information
	write_kernel_info
	# Install kernel commit information
	write_kernel_commit
	fi

	# Install IMA certificates
	insinto /etc/ima
	newins "$(cros-workon_get_build_dir)"/certs/signing_key.x509 pubkey.x509
	}