|
| 1 | +#!/bin/sh |
| 2 | +set -e |
| 3 | + |
| 4 | +# shellcheck disable=SC2034 |
| 5 | +FIRMWARE_OUTPUT_PATH="${ADDONS_OUTPUT_PATH}/firmware" |
| 6 | + |
| 7 | +# Any firmwares (if any needed) that should ultimately end up in the squashfs |
| 8 | +# should be sitting at this location when this script finishes. |
| 9 | +# (will go in ${ADDONS_PATH}/firmware, siblings with `${ADDONS_PATH}/modules`) |
| 10 | +mkdir -p "${FIRMWARE_OUTPUT_PATH}" |
| 11 | + |
| 12 | +if [ -n "${FIRMWARE_SIG_URL}" ]; then |
| 13 | + # Getting the pubkey from the signature is slightly stupid, ideally we should maintain |
| 14 | + # a list of valid keys out-of-band, this is best-effort. |
| 15 | + echo "Found firmware signature $FIRMWARE_SIG_URL, attempting validation" |
| 16 | + |
| 17 | + # Check if FIRMWARE_URL exists and is a regular file |
| 18 | + if [ ! -f "$FIRMWARE_URL" ]; then |
| 19 | + echo "ERROR: $FIRMWARE_URL does not exist or is not a regular file" |
| 20 | + echo "ERROR: If this was intentional, consider unsetting '$FIRMWARE_SIG_URL'" |
| 21 | + exit 1 |
| 22 | + fi |
| 23 | + |
| 24 | + KEY_INFO=$(gpg --verify "$FIRMWARE_SIG_URL" "$FIRMWARE_URL" 2>&1) || true |
| 25 | + KEY_ID=$(echo "$KEY_INFO" | grep -E "using .* key|key ID" | grep -oE "[A-F0-9]{40}|[A-F0-9]{16,}") |
| 26 | + gpg --recv-key "$KEY_ID" |
| 27 | + unxz "$FIRMWARE_URL" |
| 28 | + # We've uncompressed it, update the env var so later stuff points at the right file |
| 29 | + FIRMWARE_URL="${FIRMWARE_URL%.xz}" |
| 30 | + gpg --verify "$FIRMWARE_SIG_URL" || { echo "ERROR: signature ${FIRMWARE_SIG_URL} cannot validate ${FIRMWARE_URL}"; exit 1; } |
| 31 | +else |
| 32 | + echo "No firmware signature defined, no validation will be performed" |
| 33 | +fi |
| 34 | + |
| 35 | + |
| 36 | +# Note that this assumes the archive is a .tar file, and has already been validated elsewhere. |
| 37 | +if [ -n "${FIRMWARE_URL}" ]; then |
| 38 | + echo "untarring firmware at $FIRMWARE_URL" |
| 39 | + tar -xf "${FIRMWARE_URL}" -C "${FIRMWARE_OUTPUT_PATH}" --strip-components=1 |
| 40 | + # For amdgpu zone kernel, we only want the amdgpu firmwares, so remove the rest to keep the addons small |
| 41 | + if [ "${KERNEL_FLAVOR}" = "zone-amdgpu" ]; then |
| 42 | + OLDDIR=$PWD |
| 43 | + cd "${FIRMWARE_OUTPUT_PATH}" |
| 44 | + find . -maxdepth 1 ! -name 'amdgpu' ! -name "." -exec rm -rf {} + |
| 45 | + # Compress firmwares on-disk |
| 46 | + # As of 6.x kernels the kconfig explicitly says you must use crc32 or none, not the default crc64. |
| 47 | + xz -C crc32 amdgpu/* |
| 48 | + cd "${OLDDIR}" |
| 49 | + fi |
| 50 | +fi |
| 51 | + |
| 52 | +# For nvidia kernel, firmware is distributed via their out-of-tree .run userspace |
| 53 | +# package, which we need to fetch and extract. |
| 54 | +if [ "${KERNEL_FLAVOR}" = "zone-nvidiagpu" ]; then |
| 55 | + # Check that we already set NV_VERSION when building the out-of-tree kmod, |
| 56 | + # naturally, we must fetch the matching runtime package. |
| 57 | + if [ -z "${NV_VERSION}" ]; then |
| 58 | + echo "ERROR: flavor is zone-nvidiagpu but no NV_VERSION is set" |
| 59 | + exit 1 |
| 60 | + fi |
| 61 | + |
| 62 | + OLDDIR=$PWD |
| 63 | + |
| 64 | + # TBH it's probably the same firmware regardless |
| 65 | + if [ "${TARGET_ARCH_STANDARD}" = "aarch64" ]; then |
| 66 | + NV_RUN_FILE="NVIDIA-Linux-aarch64-${NV_VERSION}.run" |
| 67 | + NV_RUN_URL="https://us.download.nvidia.com/XFree86/aarch64/${NV_VERSION}/${NV_RUN_FILE}" |
| 68 | + elif [ "${TARGET_ARCH_STANDARD}" = "x86_64" ]; then |
| 69 | + NV_RUN_FILE="NVIDIA-Linux-x86_64-${NV_VERSION}.run" |
| 70 | + NV_RUN_URL="https://us.download.nvidia.com/XFree86/Linux-x86_64/${NV_VERSION}/${NV_RUN_FILE}" |
| 71 | + fi |
| 72 | + |
| 73 | + NV_EXTRACT_PATH="$(mktemp -d)/extracted-${NV_VERSION}" |
| 74 | + mkdir -p "$NV_EXTRACT_PATH" |
| 75 | + |
| 76 | + echo "Downloading NVIDIA runtime package for driver ${NV_VERSION} from: $NV_RUN_URL" |
| 77 | + curl -L -o "$NV_EXTRACT_PATH/$NV_RUN_FILE" "$NV_RUN_URL" |
| 78 | + chmod +x "$NV_EXTRACT_PATH/$NV_RUN_FILE" |
| 79 | + "$NV_EXTRACT_PATH/$NV_RUN_FILE" -x --target "$NV_EXTRACT_PATH/out" |
| 80 | + # Compress firmwares on-disk |
| 81 | + # As of 6.x kernels the kconfig explicitly says you must use crc32 or none, not the default crc64. |
| 82 | + xz -C crc32 "$NV_EXTRACT_PATH"/out/firmware/* |
| 83 | + ls -lah "$NV_EXTRACT_PATH/out/firmware/" |
| 84 | + cp "$NV_EXTRACT_PATH"/out/firmware/*.xz "${FIRMWARE_OUTPUT_PATH}" |
| 85 | + cd "${OLDDIR}" |
| 86 | +fi |
0 commit comments