Updating a Risc-V system to its latest Yocto release

Cloning an ext4 filesystem is non-trivial in that we need to copy also the device files and other special files. cp -a should potentially do it, but from my upbringing I remembered that tar should be able to do the job. Initial tests showed that tar on the target was the busybox version of that tool and somehow it did not understand my most basic usage of it. Luckily enough, one bitbake tar later, I had a Debian package ready to be installed on the target. But how to get the package onto the board itself?

Connecting the right ethernet port to my local network made the interface alive with the correct hostname smarc-rzfive in my local home network. Luckily, the image sported dropbear, so systemctl start dropbear opened the system to ssh connections. Copying the public key of my local machine via the serial console into ~/.ssh/authorized_keys (mode 600) made the machine accept my private ssh key. Unfortunately, ssh refuseds to connect to dropbear:

dzu@krikkit:/media/dzu/hd01-xfs/renesas/rzfive_vlp_v3.0.7/build-rzfive/tmp/deploy$ ssh root@smarc-rzfive
Unable to negotiate with 192.168.44.58 port 22: no matching host key type found. Their offer: ssh-rsa
dzu@krikkit:/media/dzu/hd01-xfs/renesas/rzfive_vlp_v3.0.7/build-rzfive/tmp/deploy$ 

Doing a websearch on the symptoms, I discovered that modern ssh on my Debian Forky system does not accept the ssh-rsa keys offered by dropbear on the target. One can fix this on the command line like by explicitely adding the crypto algorithm ssh-rsa to the allowed list:

dzu@krikkit:/media/dzu/hd01-xfs/renesas/rzfive_vlp_v3.0.7/build-rzfive/tmp/deploy$ ssh -oHostKeyAlgorithms=+ssh-rsa root@smarc-rzfive
The authenticity of host 'smarc-rzfive (192.168.44.58)' can't be established.
RSA key fingerprint is: SHA256:GR+OxTcKYb6GySjHA7H+SoiM+O3klJtCgE5R6p1OSjk
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'smarc-rzfive' (RSA) to the list of known hosts.
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
root@smarc-rzfive:~#

For copying files, we need the same option like ssh does:

dzu@krikkit:/media/dzu/hd01-xfs/renesas/rzfive_vlp_v3.0.7/build-rzfive/tmp/deploy/deb/riscv64$ scp -oHostKeyAlgorithms=+ssh-rsa e2fsprogs-mke2fs_1.45.7-r0_riscv64.deb   root@smarc-rzfive:/tmp/
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
e2fsprogs-mke2fs_1.45.7-r0_riscv64.deb                                                         100%   46KB 152.5KB/s   00:00    
dzu@krikkit:/media/dzu/hd01-xfs/renesas/rzfive_vlp_v3.0.7/build-rzfive/tmp/deploy/deb/riscv64$

This puts in place the basic transport for newly compiled Yocto packages. Just copy them to /tmp on the target and install them from the serial console with dpkg. The actual commands are left as an excercise to the user ;)

Having installed tar, I tried my remembered command line foo, but the command crashed mysteriously on the target. Unfortunately, I forgot to snapshot the exact error message, but I wondered if there may still be lurking problems with ports to Risc-V. I decided not to dive deeper at this time. Maybe later.

But hey, we have more tools, so I remembered that cpio should be able to do the job, but the exact invocation was no more present in my memory. What a good chance to explore the current level of "AI" functionality. So I asked Mistral about the problem. It prompted me with an answer of two invocations of cpio, once with -i and once with -o. Ironically, trying this on the target gave me error messages that -o was not supported. Checking cpio itself showed that it came from busybox. Hm, time to bring in the real deal once more. One bitbake cpio and scp'ing the deb package to the target later, I now had a real cpio in place. It only irritated me that in order to switch to the target directory, I needed to calls to cpio, once with -o and -i. I ddid remember that there was another, more efficient, method. So I asked Mistral but was told that there was no possibility to combine the two invocations, no way, whatsoever:

Remembering my own upbringing, I studied the man page of cpio and, sure enough, found cpio -p for "passthrough" only a few seconds later. This is what I was looking for. So goging back to "Le Chat", I asked about it:

But hey, so "Detlev: 1, AI: 0". Should I be proud?

Anyway, using this technique, I cloned the contents of the SD cards root directory to the single partition on the eMMC.

Rebooting into this new system of course worked, but it lost me all the modifications to core-image-minimal that I did on the SD card. I decided that once I setup apt to work, it would be easier to redo the steps in the new system. Setting it up consists of

1. running bitbake package-index after every iteration
2. serving tmp/deply/images over http at a known port
3. Having a suitable sources.list file on the target

Serving the directory is as easy as

dzu@krikkit:/media/dzu/hd01-xfs/renesas/rzfive_vlp_v3.0.7/build-rzfive/tmp/deploy$ python3 -m http.server 8010
Serving HTTP on 0.0.0.0 port 8010 (http://0.0.0.0:8010/) ...

I decided not to re-use port 8000 as I will now potentially have multiple http servers serving Yocto results over http. Seperating them is as easy as assigning distinct ports to it. That's why I chose 8010 for the smarc-rzfive board. The port number is also included in the targets sources list, so this should ensure targets should see only from their respective Yocto build. Using the same port number for all such servers would be a recipe for disaster.

As we do not sign our packages, we need some extra bits in the configuration file on the target:

root@smarc-rzfive:~# cat /etc/apt/sources.list.d/local-yocto.list
deb [allow-insecure=yes] http://192.168.44.5:8010/deb/all ./
deb [allow-insecure=yes] http://192.168.44.5:8010/deb/riscv64 ./
deb [allow-insecure=yes] http://192.168.44.5:8010/deb/smarc_rzfive ./
root@smarc-rzfive:~#

Having this in place, we still need the apt binary from the deploy folder. So the next steps were:

1. Copy ssh public key to ~/.ssh/authorized_keys (mode 600)
2. systemctl start dropbear
3. Copy the apt_1.2.31-r0_riscv64.deb package to the targets /tmp with scp and install it. Remember to use '-oHostKeyAlgorithms=+ssh-rsa'
4. Create /etc/apt/sources.list.d/local-yocto.list
5. apt-get update
6. apt-get install cpio e2fsprogs tar
7. apt-get install openssh
8. Reboot