Nokia update sonic platform 202205

.gitmodules

@@ -35,7 +35,7 @@
 	url = https://github.com/p4lang/ptf.git
 [submodule "src/sonic-utilities"]
 	path = src/sonic-utilities
-	url = https://github.com/sonic-net/sonic-utilities
+	url = https://github.com/Azure/sonic-utilities.msft
     branch = 202205
 [submodule "platform/broadcom/sonic-platform-modules-arista"]
 	path = platform/broadcom/sonic-platform-modules-arista

Makefile.work

@@ -230,6 +230,23 @@ ifdef SONIC_BUILD_QUIETER
 	DOCKER_RUN += -e "SONIC_BUILD_QUIETER=$(SONIC_BUILD_QUIETER)"
 endif
 
+# Mount the Signing key and Certificate in the slave container
+ifneq ($(SECURE_UPGRADE_DEV_SIGNING_KEY),)
+	DOCKER_RUN += -v $(SECURE_UPGRADE_DEV_SIGNING_KEY):$(SECURE_UPGRADE_DEV_SIGNING_KEY):ro
+endif
+
+ifneq ($(SECURE_UPGRADE_DEV_SIGNING_CERT),)
+	DOCKER_RUN += -v $(SECURE_UPGRADE_DEV_SIGNING_CERT):$(SECURE_UPGRADE_DEV_SIGNING_CERT):ro
+endif
+
+# Mount the Signing prod tool in the slave container
+$(info "SECURE_UPGRADE_PROD_SIGNING_TOOL": "$(SECURE_UPGRADE_PROD_SIGNING_TOOL)")
+ifneq ($(SECURE_UPGRADE_PROD_SIGNING_TOOL),)
+	SECURE_UPGRADE_PROD_SIGNING_TOOL_DST = /sonic/scripts/$(shell basename -- $(SECURE_UPGRADE_PROD_SIGNING_TOOL))
+	DOCKER_RUN += -v $(SECURE_UPGRADE_PROD_SIGNING_TOOL):$(SECURE_UPGRADE_PROD_SIGNING_TOOL_DST):ro
+	SECURE_UPGRADE_PROD_SIGNING_TOOL := $(SECURE_UPGRADE_PROD_SIGNING_TOOL_DST)
+endif
+
 ifneq ($(SONIC_DPKG_CACHE_SOURCE),)
 	DOCKER_RUN += -v "$(SONIC_DPKG_CACHE_SOURCE):/dpkg_cache:rw"
 endif
@@ -392,6 +409,10 @@ SONIC_BUILD_INSTRUCTION :=  make \
                            BUILD_LOG_TIMESTAMP=$(BUILD_LOG_TIMESTAMP) \
                            SONIC_ENABLE_IMAGE_SIGNATURE=$(ENABLE_IMAGE_SIGNATURE) \
                            SONIC_ENABLE_SECUREBOOT_SIGNATURE=$(SONIC_ENABLE_SECUREBOOT_SIGNATURE) \
+                           SECURE_UPGRADE_MODE=$(SECURE_UPGRADE_MODE) \
+                           SECURE_UPGRADE_DEV_SIGNING_KEY=$(SECURE_UPGRADE_DEV_SIGNING_KEY) \
+                           SECURE_UPGRADE_DEV_SIGNING_CERT=$(SECURE_UPGRADE_DEV_SIGNING_CERT) \
+                           SECURE_UPGRADE_PROD_SIGNING_TOOL=$(SECURE_UPGRADE_PROD_SIGNING_TOOL) \
                            SONIC_DEFAULT_CONTAINER_REGISTRY=$(DEFAULT_CONTAINER_REGISTRY) \
                            ENABLE_HOST_SERVICE_ON_START=$(ENABLE_HOST_SERVICE_ON_START) \
                            SLAVE_DIR=$(SLAVE_DIR) \

build_debian.sh

@@ -154,7 +154,8 @@ if [[ $CONFIGURED_ARCH == amd64 ]]; then
 fi
 
 ## Sign the Linux kernel
-if [ "$SONIC_ENABLE_SECUREBOOT_SIGNATURE" = "y" ]; then
+# note: when flag SONIC_ENABLE_SECUREBOOT_SIGNATURE is enabled the Secure Upgrade flags should be disabled (no_sign) to avoid conflict between the features.
+if [ "$SONIC_ENABLE_SECUREBOOT_SIGNATURE" = "y" ] && [ "$SECURE_UPGRADE_MODE" != 'dev' ] && [ "$SECURE_UPGRADE_MODE" != "prod" ]; then
     if [ ! -f $SIGNING_KEY ]; then
        echo "Error: SONiC linux kernel signing key missing"
        exit 1
@@ -629,6 +630,56 @@ then
 
 fi
 
+# #################
+#   secure boot 
+# #################
+if [[ $SECURE_UPGRADE_MODE == 'dev' || $SECURE_UPGRADE_MODE == "prod" && $SONIC_ENABLE_SECUREBOOT_SIGNATURE != 'y' ]]; then
+    # note: SONIC_ENABLE_SECUREBOOT_SIGNATURE is a feature that signing just kernel, 
+    # SECURE_UPGRADE_MODE is signing all the boot component including kernel.
+    # its required to do not enable both features together to avoid conflicts.
+    echo "Secure Boot support build stage: Starting .."
+
+    # debian secure boot dependecies
+    sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install      \
+        shim-unsigned \
+        grub-efi
+
+    if [ ! -f $SECURE_UPGRADE_DEV_SIGNING_CERT ]; then
+        echo "Error: SONiC SECURE_UPGRADE_DEV_SIGNING_CERT=$SECURE_UPGRADE_DEV_SIGNING_CERT key missing"
+        exit 1
+    fi
+
+    if [[ $SECURE_UPGRADE_MODE == 'dev' ]]; then
+        # development signing & verification 
+
+        if [ ! -f $SECURE_UPGRADE_DEV_SIGNING_KEY ]; then
+            echo "Error: SONiC SECURE_UPGRADE_DEV_SIGNING_KEY=$SECURE_UPGRADE_DEV_SIGNING_KEY key missing"
+            exit 1
+        fi
+
+        sudo ./scripts/signing_secure_boot_dev.sh -a $CONFIGURED_ARCH \
+                                                  -r $FILESYSTEM_ROOT \
+                                                  -l $LINUX_KERNEL_VERSION \
+                                                  -c $SECURE_UPGRADE_DEV_SIGNING_CERT \
+                                                  -p $SECURE_UPGRADE_DEV_SIGNING_KEY
+    elif [[ $SECURE_UPGRADE_MODE == "prod" ]]; then
+        #  Here Vendor signing should be implemented
+        OUTPUT_SEC_BOOT_DIR=$FILESYSTEM_ROOT/boot
+        sudo $SECURE_UPGRADE_PROD_SIGNING_TOOL $CONFIGURED_ARCH $FILESYSTEM_ROOT $LINUX_KERNEL_VERSION $OUTPUT_SEC_BOOT_DIR
+
+        # verifying all EFI files and kernel modules in $OUTPUT_SEC_BOOT_DIR
+        sudo ./scripts/secure_boot_signature_verification.sh -e $OUTPUT_SEC_BOOT_DIR \
+                                                             -c $SECURE_UPGRADE_DEV_SIGNING_CERT \
+                                                             -k $FILESYSTEM_ROOT
+
+        # verifying vmlinuz file.
+        sudo ./scripts/secure_boot_signature_verification.sh -e $FILESYSTEM_ROOT/boot/vmlinuz-${LINUX_KERNEL_VERSION}-${CONFIGURED_ARCH} \
+                                                             -c $SECURE_UPGRADE_DEV_SIGNING_CERT \
+                                                             -k $FILESYSTEM_ROOT
+    fi
+    echo "Secure Boot support build stage: END."
+fi
+
 ## Update initramfs
 sudo chroot $FILESYSTEM_ROOT update-initramfs -u
 ## Convert initrd image to u-boot format

device/arista/x86_64-arista_7800_sup/Arista-7804R3-FM/fabric_monitor_config.json

@@ -0,0 +1,8 @@
+{
+   "FABRIC_MONITOR_DATA": {
+      "monErrThreshCrcCells": 1,
+      "monErrThreshRxCells": 61035156,
+      "monPollThreshRecovery": 8,
+      "monPollThreshIsolation": 1
+   }
+}

device/arista/x86_64-arista_7800_sup/Arista-7804R3-FM/fabric_port_config.ini

@@ -0,0 +1,193 @@
+# name              lanes     isolateStatus
+Fabric0             0         False
+Fabric1             1         False
+Fabric2             2         False
+Fabric3             3         False
+Fabric4             4         False
+Fabric5             5         False
+Fabric6             6         False
+Fabric7             7         False
+Fabric8             8         False
+Fabric9             9         False
+Fabric10            10        False
+Fabric11            11        False
+Fabric12            12        False
+Fabric13            13        False
+Fabric14            14        False
+Fabric15            15        False
+Fabric16            16        False
+Fabric17            17        False
+Fabric18            18        False
+Fabric19            19        False
+Fabric20            20        False
+Fabric21            21        False
+Fabric22            22        False
+Fabric23            23        False
+Fabric24            24        False
+Fabric25            25        False
+Fabric26            26        False
+Fabric27            27        False
+Fabric28            28        False
+Fabric29            29        False
+Fabric30            30        False
+Fabric31            31        False
+Fabric32            32        False
+Fabric33            33        False
+Fabric34            34        False
+Fabric35            35        False
+Fabric36            36        False
+Fabric37            37        False
+Fabric38            38        False
+Fabric39            39        False
+Fabric40            40        False
+Fabric41            41        False
+Fabric42            42        False
+Fabric43            43        False
+Fabric44            44        False
+Fabric45            45        False
+Fabric46            46        False
+Fabric47            47        False
+Fabric48            48        False
+Fabric49            49        False
+Fabric50            50        False
+Fabric51            51        False
+Fabric52            52        False
+Fabric53            53        False
+Fabric54            54        False
+Fabric55            55        False
+Fabric56            56        False
+Fabric57            57        False
+Fabric58            58        False
+Fabric59            59        False
+Fabric60            60        False
+Fabric61            61        False
+Fabric62            62        False
+Fabric63            63        False
+Fabric64            64        False
+Fabric65            65        False
+Fabric66            66        False
+Fabric67            67        False
+Fabric68            68        False
+Fabric69            69        False
+Fabric70            70        False
+Fabric71            71        False
+Fabric72            72        False
+Fabric73            73        False
+Fabric74            74        False
+Fabric75            75        False
+Fabric76            76        False
+Fabric77            77        False
+Fabric78            78        False
+Fabric79            79        False
+Fabric80            80        False
+Fabric81            81        False
+Fabric82            82        False
+Fabric83            83        False
+Fabric84            84        False
+Fabric85            85        False
+Fabric86            86        False
+Fabric87            87        False
+Fabric88            88        False
+Fabric89            89        False
+Fabric90            90        False
+Fabric91            91        False
+Fabric92            92        False
+Fabric93            93        False
+Fabric94            94        False
+Fabric95            95        False
+Fabric96            96        False
+Fabric97            97        False
+Fabric98            98        False
+Fabric99            99        False
+Fabric100           100       False
+Fabric101           101       False
+Fabric102           102       False
+Fabric103           103       False
+Fabric104           104       False
+Fabric105           105       False
+Fabric106           106       False
+Fabric107           107       False
+Fabric108           108       False
+Fabric109           109       False
+Fabric110           110       False
+Fabric111           111       False
+Fabric112           112       False
+Fabric113           113       False
+Fabric114           114       False
+Fabric115           115       False
+Fabric116           116       False
+Fabric117           117       False
+Fabric118           118       False
+Fabric119           119       False
+Fabric120           120       False
+Fabric121           121       False
+Fabric122           122       False
+Fabric123           123       False
+Fabric124           124       False
+Fabric125           125       False
+Fabric126           126       False
+Fabric127           127       False
+Fabric128           128       False
+Fabric129           129       False
+Fabric130           130       False
+Fabric131           131       False
+Fabric132           132       False
+Fabric133           133       False
+Fabric134           134       False
+Fabric135           135       False
+Fabric136           136       False
+Fabric137           137       False
+Fabric138           138       False
+Fabric139           139       False
+Fabric140           140       False
+Fabric141           141       False
+Fabric142           142       False
+Fabric143           143       False
+Fabric144           144       False
+Fabric145           145       False
+Fabric146           146       False
+Fabric147           147       False
+Fabric148           148       False
+Fabric149           149       False
+Fabric150           150       False
+Fabric151           151       False
+Fabric152           152       False
+Fabric153           153       False
+Fabric154           154       False
+Fabric155           155       False
+Fabric156           156       False
+Fabric157           157       False
+Fabric158           158       False
+Fabric159           159       False
+Fabric160           160       False
+Fabric161           161       False
+Fabric162           162       False
+Fabric163           163       False
+Fabric164           164       False
+Fabric165           165       False
+Fabric166           166       False
+Fabric167           167       False
+Fabric168           168       False
+Fabric169           169       False
+Fabric170           170       False
+Fabric171           171       False
+Fabric172           172       False
+Fabric173           173       False
+Fabric174           174       False
+Fabric175           175       False
+Fabric176           176       False
+Fabric177           177       False
+Fabric178           178       False
+Fabric179           179       False
+Fabric180           180       False
+Fabric181           181       False
+Fabric182           182       False
+Fabric183           183       False
+Fabric184           184       False
+Fabric185           185       False
+Fabric186           186       False
+Fabric187           187       False
+Fabric188           188       False
+Fabric189           189       False
+Fabric190           190       False
+Fabric191           191       False

device/arista/x86_64-arista_7800_sup/Arista-7808R3-FM/fabric_monitor_config.json

@@ -0,0 +1,8 @@
+{
+   "FABRIC_MONITOR_DATA": {
+      "monErrThreshCrcCells": 1,
+      "monErrThreshRxCells": 61035156,
+      "monPollThreshRecovery": 8,
+      "monPollThreshIsolation": 1
+   }
+}