Initial commit

meta-google/recipes-phosphor/console/obmc-console/host-console-filtered.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# obmc-console-client will immediately exit if we don't give it an stdin
+# that it can block on forever, so we hook it up to /dev/null since that never
+# feeds it data.
+# We only allow printable characters we know to be good. This set is
+# currently newline + all printable ASCII chars (space through hyphen).
+obmc-console-client < <(tail -f /dev/null) | tr -cd '\12\40-\176'

meta-google/recipes-phosphor/console/obmc-console/host-console-journal.service.in

@@ -0,0 +1,11 @@
+[Unit]
+Requires=obmc-console@@HOST_TTY@.service
+After=obmc-console@@HOST_TTY@.service
+
+[Service]
+Type=simple
+SyslogIdentifier=host-console
+ExecStart=/usr/bin/host-console-filtered.sh
+
+[Install]
+WantedBy=multi-user.target

meta-google/recipes-phosphor/console/obmc-console/serial-to-bmc@.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=BMC Serial Getty on %I
+BindsTo=dev-%i.device
+After=dev-%i.device systemd-user-sessions.service
+After=rc-local.service
+Before=getty.target
+IgnoreOnIsolate=yes
+
+Conflicts=serial-to-host@%i.service
+StartLimitIntervalSec=0
+
+[Service]
+Type=simple
+Restart=no
+RestartSec=0
+ExecStart=-/sbin/agetty -8 -n -o '-f root' -i -N -R -L %I 115200 xterm
+ExecStopPost=-/bin/sh -c 'systemctl start --no-block serial-to-host@%i'
+UtmpIdentifier=%I
+TTYPath=/dev/%I
+KillMode=process
+IgnoreSIGPIPE=no
+SendSIGHUP=yes

meta-google/recipes-phosphor/console/obmc-console/serial-to-host@.service.in

@@ -0,0 +1,28 @@
+[Unit]
+Description=Host Serial Getty on %I
+BindsTo=dev-%i.device
+After=dev-%i.device
+Before=getty.target
+IgnoreOnIsolate=yes
+
+Requires=obmc-console@@HOST_TTY@.service
+After=obmc-console@@HOST_TTY@.service
+Conflicts=serial-to-bmc@%i.service
+StartLimitIntervalSec=0
+
+[Service]
+Type=simple
+Restart=always
+RestartSec=0
+RestartPreventExitStatus=2
+SuccessExitStatus=2
+ExecStart=-/sbin/agetty -8 -n -l /usr/bin/obmc-console-client -o '-e a00pae9n2B9m1c' -i -N -R -L %I 115200 xterm
+ExecStopPost=-/bin/sh -c '(( EXIT_STATUS == 2 )) && systemctl start --no-block serial-to-bmc@%i'
+UtmpIdentifier=%I
+TTYPath=/dev/%I
+KillMode=process
+IgnoreSIGPIPE=no
+SendSIGHUP=yes
+
+[Install]
+WantedBy=getty.target

meta-google/recipes-phosphor/console/obmc-console_%.bbappend

@@ -0,0 +1,40 @@
+FILESEXTRAPATHS:prepend:gbmc := "${THISDIR}/${PN}:"
+
+SRC_URI:append:gbmc = " \
+  file://serial-to-bmc@.service \
+  file://serial-to-host@.service.in \
+  file://host-console-journal.service.in \
+  file://host-console-filtered.sh \
+  "
+
+SYSTEMD_SERVICE:${PN}:append:gbmc = " serial-to-bmc@.service"
+SYSTEMD_SERVICE:${PN}:append:gbmc= " serial-to-host@.service"
+
+OBMC_CONSOLE_FRONT_TTY ?= ""
+
+RDEPENDS:${PN}:append:gbmc = " bash"
+
+FILES:${PN}:append:gbmc = " ${systemd_system_unitdir}/host-console-journal.service"
+
+do_install:append:gbmc() {
+  install -d ${D}${systemd_system_unitdir}
+  install -m 0644 ${WORKDIR}/serial-to-bmc@.service \
+    ${D}${systemd_system_unitdir}
+
+  sed "s,@HOST_TTY@,${OBMC_CONSOLE_HOST_TTY}," \
+    ${WORKDIR}/serial-to-host@.service.in \
+    >${D}${systemd_system_unitdir}/serial-to-host@.service
+
+  sed 's,@HOST_TTY@,${OBMC_CONSOLE_HOST_TTY},' \
+    ${WORKDIR}/host-console-journal.service.in \
+    >${D}${systemd_system_unitdir}/host-console-journal.service
+
+  install -d ${D}${bindir}
+  install -m0755 ${WORKDIR}/host-console-filtered.sh ${D}${bindir}/
+}
+
+pkg_postinst:${PN}:append:gbmc () {
+  if [ -n "${OBMC_CONSOLE_FRONT_TTY}" ]; then
+    systemctl --root=$D enable serial-to-host@${OBMC_CONSOLE_FRONT_TTY}.service
+  fi
+}

meta-google/recipes-phosphor/flash/dummy-gbmc-update.bb

@@ -0,0 +1,23 @@
+SUMMARY = "Dummy image uploader for sending debug binaries"
+DESCRIPTION = "Dummy image uploader for sending debug binaries"
+PR = "r1"
+
+LICENSE = "Apache-2.0"
+LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/Apache-2.0;md5=89aea4e17d99a7cacdbeed46a0096b10"
+
+inherit systemd
+
+SRC_URI += "file://config-dummy.json"
+SRC_URI += "file://dummy-verify.service"
+
+FILES:${PN} += "${datadir}/phosphor-ipmi-flash"
+
+SYSTEMD_SERVICE:${PN} += "dummy-verify.service"
+
+do_install() {
+    install -d ${D}${datadir}/phosphor-ipmi-flash
+    install -m 0644 ${WORKDIR}/config-dummy.json ${D}${datadir}/phosphor-ipmi-flash
+
+    install -d ${D}${systemd_system_unitdir}
+    install -m 0644 ${WORKDIR}/dummy-verify.service ${D}${systemd_system_unitdir}
+}

meta-google/recipes-phosphor/flash/dummy-gbmc-update/config-dummy.json

@@ -0,0 +1,19 @@
+[{
+	"blob": "/flash/dummy",
+	"handler": {
+		"type": "file",
+		"path": "/run/initramfs/bmc-image"
+	},
+	"actions": {
+		"preparation": {
+			"type": "skip"
+		},
+		"verification": {
+			"type": "systemd",
+			"unit": "dummy-verify.service"
+		},
+		"update": {
+			"type": "skip"
+		}
+	}
+}]

meta-google/recipes-phosphor/flash/dummy-gbmc-update/dummy-verify.service

@@ -0,0 +1,6 @@
+[Unit]
+Description=Dummy flash file verification
+
+[Service]
+Type=oneshot
+ExecStart=/bin/mv /run/initramfs/bmc-image /run/initramfs/dummy

meta-google/recipes-phosphor/flash/gbmc-update.bb

@@ -0,0 +1,20 @@
+SUMMARY = "Google BMC Update Utilities"
+DESCRIPTION = "Google BMC Update Utilities"
+PR = "r1"
+
+LICENSE = "Apache-2.0"
+LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/Apache-2.0;md5=89aea4e17d99a7cacdbeed46a0096b10"
+
+SRC_URI += " \
+ file://40-gbmc-upgrade.sh \
+"
+
+FILES:${PN} += "${datadir}/gbmc-br-dhcp"
+
+RDEPENDS:${PN} += "curl"
+RDEPENDS:${PN} += "tar"
+
+do_install() {
+    install -d ${D}${datadir}/gbmc-br-dhcp
+    install -m 0644 ${WORKDIR}/40-gbmc-upgrade.sh ${D}${datadir}/gbmc-br-dhcp/
+}

meta-google/recipes-phosphor/flash/gbmc-update/40-gbmc-upgrade.sh

@@ -0,0 +1,113 @@
+#!/bin/bash
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+[ -z "${gbmc_upgrade-}" ] || exit
+
+: "${GBMC_UPGRADE_SIG=/tmp/bmc.sig}"
+
+GBMC_UPGRADE_UNPACK_FILES=()
+# shellcheck disable=SC2034
+GBMC_UPGRADE_HOOKS=(gbmc_upgrade_internal)
+
+if machine="$(source /etc/os-release && echo "$GBMC_TARGET_MACHINE")"; then
+  GBMC_UPGRADE_UNPACK_FILES+=("*/firmware-gbmc/$machine")
+else
+  echo 'Failed to find GBMC machine type from /etc/os-release' >&2
+fi
+
+gbmc_upgrade_dl_unpack() {
+  echo "Fetching $bootfile_url" >&2
+
+  # We only support tarballs at the moment, our URLs will always denote
+  # this with a URI query param of `format=TAR`.
+  local tflags=()
+  if [[ "$bootfile_url" =~ [\&?]format=TAR(_GZIP)?(&|$) ]]; then
+    local t="${BASH_REMATCH[1]}"
+    [ "$t" = '_GZIP' ] && tflags+=('-z')
+  else
+    echo "Unknown upgrade unpack method: $bootfile_url" >&2
+    return 1
+  fi
+
+  # Ensure some sane output file limit
+  # Currently no BMC image is larger than 64M
+  # We want to allow 2 images and a small amount of metadata (2*64+2)M
+  local max_mb=$((2*64 + 2))
+  ulimit -f $((max_mb * 1024 * 1024 / 512)) || return
+  timeout=$((SECONDS + 300))
+  stime=5
+  while true; do
+    local st=()
+    curl -LSsk --max-time $((timeout - SECONDS)) "$bootfile_url" |
+      tar "${tflags[@]}" --wildcards -xC "$tmpdir" "${GBMC_UPGRADE_UNPACK_FILES[@]}" 2>"$tmpdir"/tarerr \
+      && st=("${PIPESTATUS[@]}") || st=("${PIPESTATUS[@]}")
+    # Curl failures should continue
+    if (( st[0] == 0 )); then
+      # Tar failures when curl succeeds are hard errors to start over.
+      # shellcheck disable=SC2143
+      if (( st[1] != 0 )) && [[ -n $(grep -v '\(Exiting with failure status\|Not found in archive\|Cannot hard link\)' "$tmpdir"/tarerr) ]]; then
+        echo 'Unpacking failed' >&2
+        return 1
+      fi
+      # Success should continue without retry
+      break
+    fi
+    if (( SECONDS + stime >= timeout )); then
+      echo 'Timed out fetching image' >&2
+      return 1
+    fi
+    (shopt -s nullglob dotglob; rm -rf -- "${tmpdir:?}"/*)
+    sleep $stime
+  done
+}
+
+gbmc_upgrade_hook() {
+  [ -n "${bootfile_url-}" ] || return 0
+
+  local tmpdir
+  tmpdir="$(mktemp -d)" || return
+  # shellcheck disable=SC2015
+  gbmc_upgrade_dl_unpack && gbmc_br_run_hooks GBMC_UPGRADE_HOOKS || true
+  # shellcheck disable=SC2153
+  rm -rf -- "$tmpdir" "$GBMC_UPGRADE_SIG" "$GBMC_UPGRADE_IMG"
+}
+
+gbmc_upgrade_fetch() (
+  local sig
+  sig="$(find "$tmpdir" -name 'image-*.sig' | head -n 1)" || return
+  local img="${sig%.sig}"
+  mv "$sig" "$GBMC_UPGRADE_SIG" || return
+  mv "$img" "$GBMC_UPGRADE_IMG" || return
+
+  # Regular packages have a VERSION file with the image
+  local imgdir="${sig%/*}"
+  if [ -f "$imgdir/VERSION" ]; then
+    cat "$imgdir/VERSION" || return
+    return 0
+  fi
+
+  # Staging packages have a directory named after the version
+  local vdir="${imgdir##*/}"
+  if [[ "$vdir" =~ ([0-9]+[.]){3}[0-9]+ ]]; then
+    echo "$vdir"
+    return 0
+  fi
+
+  return 1
+)
+
+GBMC_BR_DHCP_HOOKS+=(gbmc_upgrade_hook)
+
+gbmc_upgrade=1

meta-google/recipes-phosphor/flash/google-key.bb

@@ -0,0 +1,26 @@
+SUMMARY = "Google Key installation Script"
+DESCRIPTION = "Google Key installation Script"
+PR = "r1"
+
+LICENSE = "Apache-2.0"
+LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/Apache-2.0;md5=89aea4e17d99a7cacdbeed46a0096b10"
+
+RDEPENDS:${PN} += "bash"
+RDEPENDS:${PN} += "gnupg-gpg"
+
+SRC_URI += " \
+ file://platforms_gbmc_bringup.gpg \
+ file://platforms_gbmc_secure.gpg \
+ file://verify-bmc-image.sh \
+"
+
+do_install() {
+    # Install keys into image.
+    install -d -m 0755 ${D}${datadir}/google-key
+    install -m 0644 ${WORKDIR}/platforms_gbmc_secure.gpg ${D}${datadir}/google-key/prod.key
+    install -m 0644 ${WORKDIR}/platforms_gbmc_bringup.gpg ${D}${datadir}/google-key/dev.key
+
+    # Install the verification helper
+    install -d -m 0755 ${D}${bindir}
+    install -m 0755 ${WORKDIR}/verify-bmc-image.sh ${D}${bindir}
+}

meta-google/recipes-phosphor/flash/google-key/verify-bmc-image.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+help_out() {
+  echo "$ARG0 [--allow-dev] <image file> <sig file>" >&2
+  exit 2
+}
+
+opts="$(getopt -o 'd' -l 'allow-dev' -- "$@")" || exit
+dev=
+eval set -- "$opts"
+while true; do
+  case "$1" in
+    --allow-dev|-d)
+      dev=1
+      shift
+      ;;
+    --)
+      shift
+      break
+      ;;
+    *)
+      echo "Bad option: $1" >&2
+      help_out
+      ;;
+  esac
+done
+image_file="${1?Missing image file}" || help_out
+sig_file="${2?Missing sig file}" || help_out
+
+# gnupg needs a home directory even though we don't want to persist any
+# information. We always make a new temporary directory for this
+GNUPGHOME=
+cleanup() {
+  test -n "$GNUPGHOME" && rm -rf "$GNUPGHOME"
+}
+trap cleanup ERR EXIT INT
+GNUPGHOME="$(mktemp -d)" || exit
+export GNUPGHOME
+
+gpg() {
+  command gpg --batch --allow-non-selfsigned-uid --no-tty "$@"
+}
+import_key() {
+  gpg --import "/usr/share/google-key/$1.key"
+}
+
+import_key prod
+if [ -n "$dev" ]; then
+  import_key dev
+fi
+gpg --verify --ignore-time-conflict "$sig_file" "$image_file"

meta-google/recipes-phosphor/flash/inplace-gbmc-update.bb

@@ -0,0 +1,52 @@
+SUMMARY = "Google BMC Inplace Update Script"
+DESCRIPTION = "Google BMC Inplace Update Script"
+PR = "r1"
+
+LICENSE = "Apache-2.0"
+LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/Apache-2.0;md5=89aea4e17d99a7cacdbeed46a0096b10"
+
+inherit obmc-phosphor-systemd
+
+PROVIDES += "virtual/bmc-update"
+RPROVIDES:${PN} += "virtual/bmc-update"
+
+RDEPENDS:${PN} += " \
+  bash \
+  gbmc-update \
+  google-key \
+  "
+
+SRC_URI += " \
+ file://config-bmc.json \
+ file://inplace-gbmc-verify.service \
+ file://inplace-gbmc-verify.sh \
+ file://inplace-gbmc-version.service \
+ file://inplace-gbmc-version.sh \
+ file://40-inplace-gbmc-upgrade.sh \
+"
+
+SYSTEMD_SERVICE:${PN} += "inplace-gbmc-verify.service"
+SYSTEMD_SERVICE:${PN} += "inplace-gbmc-version.service"
+
+FILES:${PN} += "${datadir}/phosphor-ipmi-flash"
+FILES:${PN} += "${datadir}/gbmc-br-dhcp"
+
+do_install() {
+    sed -i 's,@ALLOW_DEV@,,' ${WORKDIR}/inplace-gbmc-verify.sh
+
+    install -d ${D}${bindir}
+    install -m 0755 ${WORKDIR}/*.sh ${D}${bindir}
+
+    install -d ${D}${systemd_system_unitdir}
+    install -m 0644 ${WORKDIR}/*.service ${D}${systemd_system_unitdir}
+
+    install -d ${D}${datadir}/phosphor-ipmi-flash
+    install -m 0644 ${WORKDIR}/config-bmc.json ${D}${datadir}/phosphor-ipmi-flash
+
+    install -d ${D}${datadir}/gbmc-br-dhcp
+    install -m 0644 ${WORKDIR}/40-inplace-gbmc-upgrade.sh ${D}${datadir}/gbmc-br-dhcp/
+}
+
+do_install:prepend:dev() {
+    sed -i 's,@ALLOW_DEV@,--allow-dev,' ${WORKDIR}/inplace-gbmc-verify.sh
+}

meta-google/recipes-phosphor/flash/inplace-gbmc-update/40-inplace-gbmc-upgrade.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+[ -z "${inplace_gbmc_upgrade-}" ] || exit
+
+# SC doesn't know another file depends on this variable
+# shellcheck disable=SC2034
+GBMC_UPGRADE_IMG=/run/initramfs/bmc-image
+
+gbmc_upgrade_internal() {
+  local version
+  version="$(gbmc_upgrade_fetch)" || return
+
+  echo "IMG Version: $version" >&2
+  local active_version
+  active_version="$(inplace-gbmc-version.sh)" || return
+  echo "Active Version: $active_version" >&2
+  if [[ "$version" == "$active_version" ]]; then
+    echo 'Version already active' >&2
+    return 0
+  fi
+
+  echo 'Verifying image' >&2
+  systemctl start inplace-gbmc-verify || return
+  echo 'Rebooting to perform update' >&2
+  reboot || return
+  # Ensure that we don't "complete" the netboot process until
+  # after the update completes
+  exit 0
+}
+
+inplace_gbmc_upgrade=1

meta-google/recipes-phosphor/flash/inplace-gbmc-update/config-bmc.json

@@ -0,0 +1,33 @@
+[{
+	"blob": "/flash/image",
+	"version": {
+		"handler": {
+			"type": "file",
+			"path": "/run/inplace-gbmc-version"
+		},
+		"actions":{
+			"open": {
+				"type": "systemd",
+				"unit": "inplace-gbmc-version.service"
+			}
+		}
+	},
+	"handler": {
+		"type": "file",
+		"path": "/run/initramfs/bmc-image"
+	},
+	"actions": {
+		"preparation": {
+			"type": "skip"
+		},
+		"verification": {
+			"type": "systemd",
+			"unit": "inplace-gbmc-verify.service"
+		},
+		"update": {
+			"type": "systemd",
+			"unit": "reboot.target",
+			"mode": "replace-irreversibly"
+		}
+	}
+}]

meta-google/recipes-phosphor/flash/inplace-gbmc-update/inplace-gbmc-verify.service

@@ -0,0 +1,6 @@
+[Unit]
+Description=Verify the Flash Image File
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/inplace-gbmc-verify.sh

meta-google/recipes-phosphor/flash/inplace-gbmc-update/inplace-gbmc-verify.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+# This script will check the signature for the BMC image against
+# the baked in keyring available.  If any aspect of this fails,
+# the scripts returns non-zero and this can be reported to the
+# host.
+#
+# 1. Verify the image
+# 2. Rename the image
+
+SIGNATURE_FILE=/tmp/bmc.sig
+STATUS_FILE=/tmp/bmc.verify
+
+# Store in /run/initramfs because the behaviour of mv changes
+# depending on whether the file is moving within a tree or not.
+IMAGE_FILE=/run/initramfs/bmc-image
+VERIFIED_FILE=/run/initramfs/image-bmc
+
+# Make sure we run ERR traps when a function returns an error
+set -e
+
+# Write out the result of the script to a status file upon exiting
+# normally or due to an error
+exit_handler() {
+  local status="$?"
+  if (( status == 0 )); then
+    echo "success" >"${STATUS_FILE}"
+  else
+    echo "failed" >"${STATUS_FILE}"
+  fi
+  trap - EXIT ERR
+  exit "$status"
+}
+trap exit_handler EXIT ERR
+
+echo "running" > ${STATUS_FILE}
+
+# Verify the image.
+verify-bmc-image.sh @ALLOW_DEV@ "$IMAGE_FILE" "$SIGNATURE_FILE" || exit
+
+# Rename the staged file for initramfs updates.
+mv ${IMAGE_FILE} ${VERIFIED_FILE}

meta-google/recipes-phosphor/flash/inplace-gbmc-update/inplace-gbmc-version.service

@@ -0,0 +1,9 @@
+[Unit]
+Description=Version string for inplace BMC
+
+[Service]
+Type=oneshot
+StandardOutput=file:/run/inplace-gbmc-version
+StandardError=journal
+ExecStartPre=/bin/rm -f /run/inplace-gbmc-version
+ExecStart=/usr/bin/inplace-gbmc-version.sh

meta-google/recipes-phosphor/flash/inplace-gbmc-update/inplace-gbmc-version.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+grep '^VERSION_ID=' /etc/os-release | sed 's,.*-\([^-]*\),\1,g' | tr -d '\n'

meta-google/recipes-phosphor/host/phosphor-host-postd_%.bbappend

@@ -0,0 +1,7 @@
+# It's useful for debugging to have post codes written to the journal
+# while the machine is booting. Especially when host serial logs also get
+# written. This enables the verbose output of the daemon, providing
+# the logging behavior.
+do_install:append:gbmc:dev() {
+  sed -i '/^ExecStart=/ s,$, -v,' ${D}${systemd_system_unitdir}/lpcsnoop.service
+}

meta-google/recipes-phosphor/images/obmc-phosphor-image.bbappend

@@ -0,0 +1,35 @@
+OBMC_IMAGE_EXTRA_INSTALL:append = " google-ipmi-sys"
+OBMC_IMAGE_EXTRA_INSTALL:append = " google-ipmi-i2c"
+OBMC_IMAGE_EXTRA_INSTALL:append = " phosphor-ipmi-blobs"
+OBMC_IMAGE_EXTRA_INSTALL:append = " phosphor-ipmi-ethstats"
+OBMC_IMAGE_EXTRA_INSTALL:append = " phosphor-ipmi-flash"
+OBMC_IMAGE_EXTRA_INSTALL:append = \
+  '${@bb.utils.contains_any("MACHINE_FEATURES", "glome", \
+  " glome-config glome-login", "", d)}'
+
+# Google BMC (gBMC) specific installs
+OBMC_IMAGE_EXTRA_INSTALL:append:gbmc = " iproute2 iproute2-ss"
+OBMC_IMAGE_EXTRA_INSTALL:append:gbmc = " tzdata-core"
+OBMC_IMAGE_EXTRA_INSTALL:append:gbmc = " gbmc-systemd-config"
+OBMC_IMAGE_EXTRA_INSTALL:append:gbmc = " gbmc-iperf3"
+OBMC_IMAGE_EXTRA_INSTALL:append:gbmc = " authorized-keys-comp"
+OBMC_IMAGE_EXTRA_INSTALL:append:gbmc:dev = " gbmc-dev-ssh-key"
+OBMC_IMAGE_EXTRA_INSTALL:append:gbmc = \
+  '${@"" if not d.getVar("GBMC_NCSI_IF_NAME") else " gbmc-ncsi-config"}'
+OBMC_IMAGE_EXTRA_INSTALL:append:gbmc = \
+  '${@"" if not d.getVar("GBMC_MAC_EEPROM_OF_NAME") else " gbmc-mac-config"}'
+OBMC_IMAGE_EXTRA_INSTALL:append:gbmc = \
+  '${@"" if not d.getVar("GBMC_ETHER_MAP") else " gbmc-nic-rename"}'
+
+# Include these useful utilities for all gbmc platforms
+OBMC_IMAGE_EXTRA_INSTALL:append:gbmc = " ipmitool"
+OBMC_IMAGE_EXTRA_INSTALL:append:gbmc = " lrzsz"
+OBMC_IMAGE_EXTRA_INSTALL:append:gbmc:dev = " tcpdump"
+
+# Add gBMC update recipes
+OBMC_IMAGE_EXTRA_INSTALL:append:gbmc = " dummy-gbmc-update"
+OBMC_IMAGE_EXTRA_INSTALL:append:gbmc = " virtual/bmc-update"
+
+# Jettison the cracklib package to save space.
+PACKAGE_INSTALL:remove:gbmc = "cracklib libpwquality"
+PACKAGE_EXCLUDE:gbmc = "cracklib libpwquality"

meta-google/recipes-phosphor/initrdscripts/obmc-phosphor-initfs.bbappend

@@ -0,0 +1,20 @@
+# This is needed to guarantee that our whitelist takes
+# precendence over the OpenBMC one
+FILESEXTRAPATHS:prepend:gbmc := "${THISDIR}/${PN}:"
+
+SRC_URI:append:gbmc:dev = " file://whitelist.dev"
+
+do_install:append:gbmc:dev() {
+    cat ${WORKDIR}/whitelist.dev >>${D}/whitelist
+}
+
+SRC_URI:append:gbmc:dev = " file://rwfs-clean-dev.patch"
+# Required for the clean-dev patch to detect version changes
+RDEPENDS:${PN}:append:gbmc:dev = " os-release"
+
+do_install:append:gbmc:prod() {
+    echo "clean-rwfs-filesystem" > ${D}/init-options-base
+    chmod 0644 ${D}/init-options-base
+}
+
+FILES:${PN}:append:gbmc:prod = " /init-options-base"

meta-google/recipes-phosphor/initrdscripts/obmc-phosphor-initfs/rwfs-clean-dev.patch

@@ -0,0 +1,29 @@
+diff --git a/meta-phosphor/recipes-phosphor/initrdscripts/files/obmc-init.sh b/meta-phosphor/recipes-phosphor/initrdscripts/files/obmc-init.sh
+index 2a32d26ffc..a8cc76d440 100644
+--- a/obmc-init.sh
++++ b/obmc-init.sh
+@@ -287,6 +287,14 @@ then
+ 	fi
+ fi
+ 
++# Ensure that we clean our rwfs on version change
++if mount $rwdev $rwdir -t $rwfst -o $rwopts; then
++	if ! cmp "$rwdir"/os-release /etc/os-release 2>/dev/null; then
++		echo "RWFS from older BMC version, cleaning"
++		touch $trigger
++	fi
++	umount "$rwdir"
++fi
+ if grep -w clean-rwfs-filesystem $optfile
+ then
+ 	echo "Cleaning of read-write overlay filesystem requested."
+@@ -411,6 +419,9 @@ HERE
+ 	debug_takeover "$msg"
+ fi
+ 
++# Keep track of the last version to use this rwfs
++cp /etc/os-release "$rwdir"/os-release
++
+ # Empty workdir; do not remove workdir itself for it will fail to recreate it if
+ # RWFS is full
+ if [ -d $work ]

meta-google/recipes-phosphor/initrdscripts/obmc-phosphor-initfs/whitelist

@@ -0,0 +1,8 @@
+/etc/dropbear/dropbear_rsa_host_key
+/etc/hostname
+/etc/machine-id
+/etc/systemd/network
+/var/google
+/var/lib/phosphor-inventory-manager
+/var/lib/smbios/smbios2
+/var/log/state

meta-google/recipes-phosphor/initrdscripts/obmc-phosphor-initfs/whitelist.dev

@@ -0,0 +1 @@
+/home/root

meta-google/recipes-phosphor/interfaces/bmcweb_%.bbappend

@@ -0,0 +1,4 @@
+# Enable google domain for gBMC
+EXTRA_OEMESON:append:gbmc = " \
+   -Dgoogle-api=enabled \
+"

meta-google/recipes-phosphor/ipmi/phosphor-ipmi-config.bbappend

@@ -0,0 +1,76 @@
+FILESEXTRAPATHS:prepend:gbmc := "${THISDIR}/${PN}:"
+
+SRC_URI:append:gbmc = " \
+  file://gbmc_bridge_config.json \
+  file://gbmc_bridge_access.json \
+"
+
+DEPENDS:append:gbmc = " jq-native"
+
+GBMCBR_IPMI_CHANNEL ?= "11"
+
+ENTITY_MAPPING ?= "default"
+
+# Replace a channel in config.json to add gbmcbr reporting
+do_install:append:gbmc() {
+  config_json=${D}${datadir}/ipmi-providers/channel_config.json
+  overlapping="$(jq '."${GBMCBR_IPMI_CHANNEL}" | .is_valid and .name != "gbmcbr"' $config_json)"
+  if [ "$overlapping" != "false" ]; then
+    echo "gBMC channel config overlaps on ${GBMCBR_IPMI_CHANNEL}" >&2
+    cat $config_json
+    exit 1
+  fi
+  jq --slurpfile brcfg ${WORKDIR}/gbmc_bridge_config.json \
+    '. + {"${GBMCBR_IPMI_CHANNEL}": $brcfg[0]}' $config_json >${WORKDIR}/tmp
+  mv ${WORKDIR}/tmp $config_json
+
+  access_json=${D}${datadir}/ipmi-providers/channel_access.json
+  overlapping="$(jq '."${GBMCBR_IPMI_CHANNEL}" | .access_mode and .access_mode != "always_available"' $access_json)"
+  if [ "$overlapping" != "false" ]; then
+    echo "gBMC channel access overlaps on ${GBMCBR_IPMI_CHANNEL}" >&2
+    cat $access_json
+    exit 1
+  fi
+  jq --slurpfile brcfg ${WORKDIR}/gbmc_bridge_access.json \
+    '. + {"${GBMCBR_IPMI_CHANNEL}": $brcfg[0]}' $access_json >${WORKDIR}/tmp
+  mv ${WORKDIR}/tmp $access_json
+
+  # Set entity-map.json to empty json for gBMC by default.
+  # Each system will override it if needed.
+  if [[ "${ENTITY_MAPPING}" != "default" ]]; then
+    echo "[]" > ${D}${datadir}/ipmi-providers/entity-map.json
+  fi
+}
+
+python do_gbmc_version () {
+  import json
+
+  if d.getVar('GBMC_VERSION') is None:
+    return
+
+  version = d.getVar('GBMC_VERSION').split('.')
+  major = min(int(version[0]), 0x7F) & 0x7F
+  minor = min(int(version[1]), 99)
+  minor = int(minor / 10) * 16 + minor % 10;
+  point = int(version[2])
+  subpoint = int(version[3])
+
+  dir = d.getVar('D') + d.getVar('datadir') + '/ipmi-providers'
+  path = os.path.join(dir, 'dev_id.json')
+
+  dev_id = {}
+
+  # Open existing dev_id and override the fields not needed for version.
+  with open(path, 'r') as f:
+    dev_id = json.load(f)
+    dev_id["firmware_revision"] = {
+      "major": major,
+      "minor": minor
+    }
+    dev_id["aux"] =  subpoint << 16 | (0xFFFF & point)
+
+  with open(path, 'w') as f:
+    json.dump(dev_id, f, sort_keys=True, indent=4)
+}
+
+addtask gbmc_version after do_install before do_package

meta-google/recipes-phosphor/ipmi/phosphor-ipmi-config/gbmc_bridge_access.json

@@ -0,0 +1,7 @@
+{
+  "access_mode": "always_available",
+  "user_auth_disabled": false,
+  "per_msg_auth_disabled": false,
+  "alerting_disabled": false,
+  "priv_limit": "priv-admin"
+}

meta-google/recipes-phosphor/ipmi/phosphor-ipmi-config/gbmc_bridge_config.json

@@ -0,0 +1,11 @@
+{
+  "name" : "gbmcbr",
+  "is_valid" : true,
+  "active_sessions" : 0,
+  "channel_info" : {
+    "medium_type" : "lan-802.3",
+    "protocol_type" : "ipmb-1.0",
+    "session_supported" : "multi-session",
+    "is_ipmi" : true
+  }
+}

meta-google/recipes-phosphor/ipmi/phosphor-ipmi-ethstats_%.bbappend

@@ -0,0 +1,2 @@
+# Enable registration via Google OEM Number in addition to OpenBMC.
+PACKAGECONFIG += "google-oen"

meta-google/recipes-phosphor/ipmi/phosphor-ipmi-host_%.bbappend

@@ -0,0 +1,5 @@
+# Neither of these are used in a gbmc configuration
+RDEPENDS:${PN}:remove:gbmc = "clear-once"
+RDEPENDS:${PN}:remove:gbmc = "phosphor-software-manager-updater"
+
+EXTRA_OEMESON:append:gbmc = " -Dget-dbus-active-software=disabled"

meta-google/recipes-phosphor/network/phosphor-network_%.bbappend

@@ -0,0 +1,3 @@
+# Platforms with Hoth don't use the U-Boot environment since this would allow
+# bypassing attestation.
+PACKAGECONFIG:remove:hoth = "uboot-env"

meta-google/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend

@@ -0,0 +1,8 @@
+# Remove unneeded packages installed
+RDEPENDS:${PN}-extras:remove:gbmc = "obmc-ikvm"
+RDEPENDS:${PN}-extras:remove:gbmc = "phosphor-nslcd-cert-config"
+RDEPENDS:${PN}-extras:remove:gbmc = "phosphor-nslcd-authority-cert-config"
+RDEPENDS:${PN}-devtools:remove:gbmc = "trace-enable"
+
+# Disable bmcweb for gbmc machines without redfish.
+RDEPENDS:${PN}-extras:remove:gbmc = '${@bb.utils.contains:any("MACHINE_FEATURES", ['redfish'], "", "bmcweb", d)}'

meta-google/recipes-phosphor/sensors/phosphor-hwmon_%.bbappend

@@ -0,0 +1,4 @@
+EXTRA_OEMESON:append:gbmc = " \
+  -Dupdate-functional-on-fail=true \
+  -Dnegative-errno-on-fail=false \
+"