Add Agilex 5 FCS and wolfBoot integration

README.md

@@ -784,7 +784,7 @@ This repository contains additional README files with detailed information:
 - [recipes-connectivity/README.md](recipes-connectivity/README.md) - BIND,
   OpenSSH, Socat
 - [recipes-support/README.md](recipes-support/README.md) - curl, libssh2,
-  strongSwan, tcpdump
+  strongSwan, tcpdump, libfcs (Altera Agilex 5 SDM)
 - [recipes-protocols/README.md](recipes-protocols/README.md) - net-snmp
 - [recipes-extended/README.md](recipes-extended/README.md) - rsyslog
 

conf/layer.conf

@@ -55,6 +55,23 @@ BBFILES += "${LAYERDIR}/recipes-wolfssl/wolfssl/*.bb \
 # xilinx-bootbin bbappend requires meta-xilinx-tools layer
 BBFILES_DYNAMIC += "xilinx-tools:${LAYERDIR}/recipes-bsp/bootbin/*.bbappend"
 
+# SoCFPGA wolfBoot integration requires the Altera BSP layer. The dynamic
+# collection keeps its modern BitBake syntax out of legacy builds where the
+# Altera layer is absent.
+BBFILES_DYNAMIC += "altera-bsp:${LAYERDIR}/recipes-bsp/u-boot-socfpga/*.bbappend"
+# The Agilex 5 wolfBoot image uses an uncompressed FIT kernel. The GSRD
+# kernel bbappend otherwise hard-codes LZMA, which wolfBoot does not load.
+BBFILES_DYNAMIC += "altera-bsp:${LAYERDIR}/recipes-kernel/linux/*.bbappend"
+
+# Enable with WOLFSSL_ALTERA_FCS = "1" in the build configuration.
+WOLFSSL_ALTERA_FCS ?= "0"
+WOLFSSL_FCS_PROVIDER ?= "libfcs"
+WOLFSSL_ALTERA_FCS_BBFILES = \
+    "${LAYERDIR}/recipes-support/libfcs/libfcs_git.bb \
+     ${LAYERDIR}/recipes-support/libfcs/wolfssl_%.bbappend \
+     ${@'${LAYERDIR}/recipes-support/libfcs/gsrd-intel-fcs-lib_%.bbappend' if d.getVar('WOLFSSL_FCS_PROVIDER') == 'gsrd-intel-fcs-lib' else ''}"
+BBFILES += "${@d.getVar('WOLFSSL_ALTERA_FCS_BBFILES') if d.getVar('WOLFSSL_ALTERA_FCS') == '1' else ''}"
+
 # Uncomment if building bind with wolfSSL.
 #BBFILES += "${LAYERDIR}/recipes-connectivity/bind/*.bbappend"
 

files/wic/agilex5-wolfboot.wks

@@ -0,0 +1,12 @@
+# short-description: Agilex 5 SD image with wolfBoot A/B partitions
+# long-description: Keeps the Altera FAT boot partition, initializes both
+# wolfBoot raw firmware slots, and places the Linux root filesystem in p4.
+
+part --source bootimg-partition --ondisk mmcblk --fstype=vfat --mkfs-extraopts "-F 32" --label boot --active --align 1024 --fixed-size 128M --system-id b
+# WOLFBOOT_IMAGE_VERSION is supplied by the Kas/image configuration so an
+# update version cannot silently leave the A/B slots at version 1.
+part --source rawcopy --sourceparams="file=image_v${WOLFBOOT_IMAGE_VERSION}_signed.bin" --ondisk mmcblk --fstype=none --align 1024 --fixed-size 200M
+part --source rawcopy --sourceparams="file=image_v${WOLFBOOT_IMAGE_VERSION}_signed.bin" --ondisk mmcblk --fstype=none --align 1024 --fixed-size 200M
+# Keep the rootfs cap: the Agilex SD contract reserves exactly 1.5 GiB for p4
+# and the resulting WIC geometry is part of the documented deployment flow.
+part / --source rootfs --ondisk mmcblk --fstype=ext4 --label root --align 1024 --fixed-size 1500M

recipes-bsp/u-boot-socfpga/u-boot-socfpga_%.bbappend

@@ -0,0 +1,48 @@
+# Use wolfBoot as BL33 in the SoCFPGA TF-A FIT when explicitly enabled.
+#
+# The Altera BSP still builds U-Boot SPL so DDR, clocks, pinmux and the SD
+# controller are initialized by the supported platform first stage. Only the
+# U-Boot-proper blob in u-boot.itb is replaced. TF-A BL31 and the board DTB
+# remain in their existing FIT nodes.
+
+WOLFBOOT_ENABLE ??= "0"
+
+python __anonymous() {
+    if (d.getVar('WOLFBOOT_ENABLE') or '') != '1':
+        return
+
+    d.appendVar('DEPENDS', ' wolfboot')
+    depends = d.getVarFlag('do_compile', 'depends') or ''
+    d.setVarFlag('do_compile', 'depends',
+                 depends + ' wolfboot:do_deploy')
+}
+
+do_compile:prepend() {
+    if [ "${WOLFBOOT_ENABLE}" = "1" ]; then
+        fit_dtsi="${S}/arch/arm/dts/socfpga_soc64_fit-u-boot.dtsi"
+        if [ ! -f "$fit_dtsi" ]; then
+            bbfatal "SoCFPGA FIT description not found: $fit_dtsi"
+        fi
+
+        # Keep the source tree pristine. The backup/trap covers both normal
+        # completion and compile failures, including workdirs reused from
+        # sstate, while still letting U-Boot's normal FIT build consume the
+        # generated description.
+        fit_dtsi_backup="${B}/socfpga_soc64_fit-u-boot.dtsi.orig"
+        install -m 0644 "$fit_dtsi" "$fit_dtsi_backup"
+        trap 'install -m 0644 "$fit_dtsi_backup" "$fit_dtsi"; rm -f "$fit_dtsi_backup"' EXIT
+        sed -i \
+            -e 's/description = "U-Boot SoC64";/description = "wolfBoot secure boot";/' \
+            -e 's/filename = "u-boot-nodtb.bin";/filename = "wolfboot.bin";/' \
+            "$fit_dtsi"
+        wolfboot_payload="${DEPLOY_DIR_IMAGE}/wolfboot.bin"
+        if [ ! -f "$wolfboot_payload" ]; then
+            bbfatal "wolfBoot BL33 payload not found: $wolfboot_payload"
+        fi
+
+        install -m 0644 "$wolfboot_payload" "${S}/wolfboot.bin"
+        install -d "${B}/${UBOOT_DEFCONFIG}"
+        install -m 0644 "$wolfboot_payload" \
+            "${B}/${UBOOT_DEFCONFIG}/wolfboot.bin"
+    fi
+}

recipes-kernel/linux/linux-socfpga-lts_%.bbappend

@@ -0,0 +1,25 @@
+# wolfBoot's Agilex 5 FIT loader accepts an uncompressed kernel image. The
+# GSRD kernel append creates Image.lzma unconditionally even though the machine
+# configuration requests FIT_KERNEL_COMP_ALG = "none". Rebuild only the FIT
+# payload after the GSRD deploy task when wolfBoot is enabled.
+
+do_deploy:append() {
+    if [ "${WOLFBOOT_ENABLE}" = "1" ]; then
+        fit_its="${B}/fit_${MACHINE_STRIP}_kernel.its"
+        if [ "${FPGA_CORE_PGM_ENABLE}" != "1" ]; then
+            fit_its="${B}/fit_${MACHINE_STRIP}_kernel_no_rbf.its"
+        fi
+
+        if [ -f "${LINUXDEPLOYDIR}/Image" ] && [ -f "$fit_its" ]; then
+            cp "${LINUXDEPLOYDIR}/Image" "${B}/Image"
+            sed -i \
+                -e 's#Image\.lzma#Image#g' \
+                -e 's/compression = "lzma"/compression = "none"/g' \
+                "$fit_its"
+            (cd "${B}" && mkimage -f "$(basename "$fit_its")" "${B}/kernel.itb")
+            install -m 0644 "${B}/kernel.itb" "${DEPLOYDIR}/kernel.itb"
+        else
+            bbfatal "wolfBoot FIT rebuild requires ${LINUXDEPLOYDIR}/Image and $fit_its"
+        fi
+    fi
+}

recipes-support/README.md

@@ -86,3 +86,9 @@ Zeus, Dunfell, and Gatesgarth
 
     Then just compile the image that use's `tcpdumb` and include the `wolfSSL`
     package or preform `bitbake tcpdumb`
+
+libfcs (Altera Agilex 5 SDM crypto)
+-----
+
+See [libfcs/agilex5/README.md](libfcs/agilex5/README.md) for the complete
+Agilex 5 integration, image deployment, and on-target test procedure.