Re: [cip-dev] [isar-cip-core][PATCH v5 0/4] Enable support for wfx backend based software updates

Re: [cip-dev] [isar-cip-core][PATCH v5 0/4] Enable support for wfx backend based software updates

[Michael Adler]

LGTM!

Reviewed-by: Michael Adler <michael.adler@siemens.com>


-- 
Michael Adler

Siemens AG
Technology
Connectivity & Edge
Open Source Embedded Systems
FT RPD CED OES-DE
Friedrich-Ludwig-Bauer-Str. 3
85748 Garching, Germany

Siemens Aktiengesellschaft: Chairman of the Supervisory Board: Jim Hagemann
Snabe; Managing Board: Roland Busch, Chairman, President and Chief Executive
Officer; Cedrik Neike, Matthias Rebellius, Ralf P. Thomas, Judith Wiese;
Registered offices: Berlin and Munich, Germany; Commercial registries:
Berlin-Charlottenburg, HRB 12300, Munich, HRB 6684; WEEE-Reg.-No. DE 23691322

[isar-cip-core][PATCH v5 0/4] Enable support for wfx backend based software updates

[Adithya.Balakumar]

From: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>

SWUpdate has supported software updates with wfx[1] backend for a while now. But using this requires a few configurations in the image (swupdate.cfg or via command line options). 
These series of patches enables/sets the necessary configurations required to use wfx for software updates.

A couple notes about the implementation:
- Provides using wfx as the update backend as an option (not forced).
- wfx url can be set through Kconfig.
- wfx requires a clientId per device in order to target devices (create jobs for devices). So start
SWUpdate in suricatta daemon mode at service startup with the required suricatta command line args.
- The above point could be made more practical with something like an onboarding function (See [2],
This is still not officially part of the CIP project yet).

[1] https://sbabic.github.io/swupdate/suricatta.html#support-for-wfx
[2] https://gitlab.com/cip-playground/cip-wfx-onboarding-client-plugin

Changes since v4:
- Minor updates to documentation

Changes since v3:
- Drop self-built SWUpdate package and use debian's (required fix is backported to stable now)
- Use suricatta command line arguments to pass wfx url and client-id
- Include Kconfig option to set wfx url
- Enable wfx support if an url is set via the Kconfig

Changes since v2:
- Fix appending suricatta section in swupdate.cfg when wfx based update is not enabled at build time

Changes since v1:
- Rebase to current next
- Drop carrying the patch to fix swupdate issue as its backported to
  debian
- Fix appending suricatta section in swupdate.cfg only if wfx is
  requested at build time
- Use /etc/machine-id as is for client-id in suricatta

Adithya Balakumar (4):
  swupdate-config-wfx: Recipe to set configs for wfx backend based
    updates
  Kconfig: Add option to set WFX_URL
  swupdate.inc: Enable wfx based updates if WFX_URL is set
  doc/README.swupdate.md: Add section for software update with wfx

 Kconfig                                       |   7 ++
 doc/README.swupdate.md                        | 113 ++++++++++++++++++
 recipes-core/images/swupdate.inc              |   4 +
 .../files/suricatta_wfx.conf.tmpl             |   1 +
 .../swupdate-config-wfx_0.1.bb                |  27 +++++
 5 files changed, 152 insertions(+)
 create mode 100644 recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl
 create mode 100644 recipes-core/swupdate-config-wfx/swupdate-config-wfx_0.1.bb

-- 
2.39.5

[isar-cip-core][PATCH v5 1/4] swupdate-config-wfx: Recipe to set configs for wfx backend based updates

[Adithya.Balakumar]

From: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>

wfx requires a unique clientId for each client device for targeted jobs for
each client. Additionally, start SWUpdate in suricatta daemon mode with the
built-in wfx lua client.

Signed-off-by: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
---
 .../files/suricatta_wfx.conf.tmpl             |  1 +
 .../swupdate-config-wfx_0.1.bb                | 27 +++++++++++++++++++
 2 files changed, 28 insertions(+)
 create mode 100644 recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl
 create mode 100644 recipes-core/swupdate-config-wfx/swupdate-config-wfx_0.1.bb

diff --git a/recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl b/recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl
new file mode 100644
index 0000000..744b426
--- /dev/null
+++ b/recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl
@@ -0,0 +1 @@
+SWUPDATE_SURICATTA_ARGS="--server lua -u ${WFX_URL} -i $(cat /etc/machine-id)"
diff --git a/recipes-core/swupdate-config-wfx/swupdate-config-wfx_0.1.bb b/recipes-core/swupdate-config-wfx/swupdate-config-wfx_0.1.bb
new file mode 100644
index 0000000..3569888
--- /dev/null
+++ b/recipes-core/swupdate-config-wfx/swupdate-config-wfx_0.1.bb
@@ -0,0 +1,27 @@
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Toshiba Corporation, 2026
+#
+# Authors:
+#  Adithya Balakumar <adithya.balakumar@toshiba-tsip.com>
+#
+# SPDX-License-Identifier: MIT
+#
+
+inherit dpkg-raw
+
+PROVIDES := "${PN}"
+DEBIAN_PROVIDES := "${PN}"
+
+PN .= "-${MACHINE}"
+
+SRC_URI += "file://suricatta_wfx.conf.tmpl"
+
+TEMPLATE_FILES += " suricatta_wfx.conf.tmpl"
+TEMPLATE_VARS += " WFX_URL"
+
+do_install() {
+    install -d ${D}/etc/swupdate/conf.d
+    install -m 0644 ${WORKDIR}/suricatta_wfx.conf ${D}/etc/swupdate/conf.d/suricatta_wfx.conf
+}
-- 
2.39.5

[isar-cip-core][PATCH v5 2/4] Kconfig: Add option to set WFX_URL

[Adithya.Balakumar]

From: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>

Signed-off-by: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
---
 Kconfig | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/Kconfig b/Kconfig
index 30abb84..3665269 100644
--- a/Kconfig
+++ b/Kconfig
@@ -279,6 +279,13 @@ config IMAGE_SWUPDATE
 
 if IMAGE_SWUPDATE
 
+config WFX_URL
+	string "WFX backend URL"
+	default ""
+	help
+	  URL of the wfx backend for software updates. See ./doc/README.swupdate.md for
+	  more about wfx support for updates.
+
 choice
 	prompt "Update type"
 
-- 
2.39.5

[isar-cip-core][PATCH v5 3/4] swupdate.inc: Enable wfx based updates if WFX_URL is set

[Adithya.Balakumar]

From: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>

WFX_URL can be set via the Kconfig menu. Enable wfx backend based updates
if WFX_URL is set at build time.

Signed-off-by: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
---
 recipes-core/images/swupdate.inc | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/recipes-core/images/swupdate.inc b/recipes-core/images/swupdate.inc
index 7cd816a..7041058 100644
--- a/recipes-core/images/swupdate.inc
+++ b/recipes-core/images/swupdate.inc
@@ -57,5 +57,9 @@ python() {
 IMAGE_INSTALL:append = "${@' swupdate' if bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')) else ''}"
 IMAGE_PREINSTALL:append = "${@'' if bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')) else ' swupdate'}"
 
+# check for wfx url to enable support for wfx backend based updates
+OVERRIDES .= "${@':wfx' if d.getVar("WFX_URL") else ''}"
+IMAGE_INSTALL:append:wfx = " swupdate-config-wfx"
+
 IMAGE_INSTALL += " swupdate-handler-roundrobin"
 IMAGE_INSTALL += " swupdate-config"
-- 
2.39.5

[isar-cip-core][PATCH v5 4/4] doc/README.swupdate.md: Add section for software update with wfx

[Adithya.Balakumar]

From: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>

Signed-off-by: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
---
 doc/README.swupdate.md | 113 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 113 insertions(+)

diff --git a/doc/README.swupdate.md b/doc/README.swupdate.md
index b68b5b7..8b756cd 100644
--- a/doc/README.swupdate.md
+++ b/doc/README.swupdate.md
@@ -464,6 +464,119 @@ Any http server (service) can be used to host the .zck file as long as the http
 
 Follow the steps mentioned in the section [SWUpdate verification](#swupdate-verification) for verification.
 
+# Software update with wfx
+
+**NOTE**: In the following sections, `WFX_HOST` refers to the IP address or DNS-resolvable name of your `wfx` server. Please substitute `WFX_HOST` with the appropriate value wherever it appears.
+
+Set the `WFX_URL` to `http://WFX_HOST:8080/api/wfx/v1` via the `Kconfig` menu.
+
+Install `wfxctl` and `wfx` in the host:
+The instructions below assume that `wfxctl` and `wfx` are running on a `x86-64` host. Binaries for other architectures are also available for [download](https://github.com/siemens/wfx/releases).
+```
+## Install wfxctl
+host$ curl -LO https://github.com/siemens/wfx/releases/download/v0.4.1/wfxctl_0.4.1_linux_x86_64.deb
+host$ dpkg -i wfxctl_0.4.1_linux-x86_64.deb
+
+## Install wfx
+host$ curl -LO https://github.com/siemens/wfx/releases/download/v0.4.1/wfx_0.4.1_linux_x86_64.deb
+host$ dpkg -i wfx_0.4.1_linux-x86_64.deb
+```
+
+
+Build an image which will later serve as update package:
+```
+host$ ./kas-container build kas-cip.yml:kas/board/qemu-amd64.yml:kas/opt/ebg-swu.yml:kas/opt/trixie.yml
+```
+
+Save the generated swu build/tmp/deploy/images/qemu-amd64/cip-core-image-cip-core-trixie-qemu-amd64.swu into a separate folder
+
+```
+host$ mkdir -p /tmp/artifacts
+host$ cp build/tmp/deploy/images/qemu-amd64/cip-core-image-cip-core-trixie-qemu-amd64.swu /tmp/artifacts
+```
+
+Next, rebuild the image, switching to the RT kernel as modification:
+```
+host$ ./kas-container build kas-cip.yml:kas/board/qemu-amd64.yml:kas/opt/ebg-swu.yml:kas/opt/rt.yml:kas/opt/trixie.yml
+```
+
+Now start the image which will contain the RT kernel:
+```
+host$ SWUPDATE_BOOT=y ./start-qemu.sh amd64
+```
+
+Check the machine-id in `/etc/machine-id`. SWUpdate is launched with this `id` as the `client-id` and is later used to create `wfx` job for the client:
+```
+root@demo cat /etc/machine-id
+049adc79659044f8887c83b3203c84f1
+```
+
+Start `wfx` server in the host:
+```
+host$ wfx --simple-fileserver /tmp/artifacts
+```
+Alternatively, `wfx` can also be run as a [docker container](https://github.com/siemens/wfx/blob/a6ecb60bb47eaf1f95a2b65b4190538a246d79d1/docs/installation.md#build-and-installation).
+
+Create `wfx.workflow.dau.direct` wofkflow:
+```
+host$ curl -L https://raw.githubusercontent.com/siemens/wfx/refs/heads/main/workflow/dau/wfx.workflow.dau.direct.yml | wfxctl workflow create -
+```
+
+Create a wfx job that updates the device. Set `client-id` with the `id` from `/etc/machine-id` in qemu:
+```
+host$ cat <<EOF | envsubst | wfxctl job create --client-id '049adc79659044f8887c83b3203c84f1' --workflow wfx.workflow.dau.direct -
+{
+  "version": "1.0",
+  "type": ["firmware"],
+  "artifacts": [
+    {
+      "name": "Example Device Firmware Artifact",
+      "version": "1.1",
+      "uri": "http://${WFX_HOST}:8080/download/cip-core-image-cip-core-trixie-qemu-amd64.swu"
+    }
+  ]
+}
+EOF
+```
+
+Wait for the next swupdate polling round (every 20 seconds) to see how swupdate downloads and applies the update.
+```
+root@demo journalctl -u swupdate -f
+
+// truncated output
+swupdate.sh[432]: [TRACE] : SWUPDATE running :  [start_suricatta] : Suricatta awakened.
+swupdate.sh[432]: [DEBUG] : SWUPDATE running :  [notify_helper] : Suricatta querying "http://WFX_HOST:8080/api/wfx/v1/jobs?clientId=049adc79659044f8887c83b3203c84f1&group=OPEN"
+```
+
+Once the update is successfully installed, the device automatically reboots. After reboot, suricatta automatically updates the bootloader state.
+```
+root@demo bg_printenv
+
+----------------------------
+ Config Partition #0 Values:
+in_progress:      no
+revision:         2
+kernel:           C:BOOT0:linux.efi
+kernelargs:
+watchdog timeout: 120 seconds
+ustate:           0 (OK)
+
+user variables:
+
+
+
+----------------------------
+ Config Partition #1 Values:
+in_progress:      no
+revision:         3
+kernel:           C:BOOT1:linux.efi
+kernelargs:
+watchdog timeout: 120 seconds
+ustate:           0 (OK)
+
+user variables:
+```
+
 # Building and testing the CIP Core image for BBB
 
 Follow the steps mentioned in the section [Building and testing the CIP Core image](README.swupdate.md#building-and-testing-the-cip-core-image) for creating images and .swu files.
-- 
2.39.5

Re: [cip-dev] [isar-cip-core][PATCH v5 1/4] swupdate-config-wfx: Recipe to set configs for wfx backend based updates

[Quirin Gylstorff]

On 1/16/26 12:49 PM, Adithya Balakumar wrote:
> From: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
> 
> wfx requires a unique clientId for each client device for targeted jobs for
> each client. Additionally, start SWUpdate in suricatta daemon mode with the
> built-in wfx lua client.
> 
> Signed-off-by: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
> ---
>   .../files/suricatta_wfx.conf.tmpl             |  1 +
>   .../swupdate-config-wfx_0.1.bb                | 27 +++++++++++++++++++
>   2 files changed, 28 insertions(+)
>   create mode 100644 recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl
>   create mode 100644 recipes-core/swupdate-config-wfx/swupdate-config-wfx_0.1.bb
> 
> diff --git a/recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl b/recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl
> new file mode 100644
> index 0000000..744b426
> --- /dev/null
> +++ b/recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl
> @@ -0,0 +1 @@
> +SWUPDATE_SURICATTA_ARGS="--server lua -u ${WFX_URL} -i $(cat /etc/machine-id)"
> diff --git a/recipes-core/swupdate-config-wfx/swupdate-config-wfx_0.1.bb b/recipes-core/swupdate-config-wfx/swupdate-config-wfx_0.1.bb
> new file mode 100644
> index 0000000..3569888
> --- /dev/null
> +++ b/recipes-core/swupdate-config-wfx/swupdate-config-wfx_0.1.bb
> @@ -0,0 +1,27 @@
> +#
> +# CIP Core, generic profile
> +#
> +# Copyright (c) Toshiba Corporation, 2026
> +#
> +# Authors:
> +#  Adithya Balakumar <adithya.balakumar@toshiba-tsip.com>
> +#
> +# SPDX-License-Identifier: MIT
> +#
> +
> +inherit dpkg-raw
> +
> +PROVIDES := "${PN}"
> +DEBIAN_PROVIDES := "${PN}"
> +
> +PN .= "-${MACHINE}"
> +
> +SRC_URI += "file://suricatta_wfx.conf.tmpl"
> +
> +TEMPLATE_FILES += " suricatta_wfx.conf.tmpl"
> +TEMPLATE_VARS += " WFX_URL"
WFX_URL is undefined in this recipe, e.g.:

`WFX_URL ??= ""`

Quirin
> +
> +do_install() {
> +    install -d ${D}/etc/swupdate/conf.d
> +    install -m 0644 ${WORKDIR}/suricatta_wfx.conf ${D}/etc/swupdate/conf.d/suricatta_wfx.conf
> +}
> 
> 
> 
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#21631): https://lists.cip-project.org/g/cip-dev/message/21631
> Mute This Topic: https://lists.cip-project.org/mt/117296108/1753640
> Group Owner: cip-dev+owner@lists.cip-project.org
> Unsubscribe: https://lists.cip-project.org/g/cip-dev/unsub [quirin.gylstorff@siemens.com]
> -=-=-=-=-=-=-=-=-=-=-=-
> 

Re: [cip-dev] [isar-cip-core][PATCH v5 3/4] swupdate.inc: Enable wfx based updates if WFX_URL is set

[Quirin Gylstorff]

On 1/16/26 12:49 PM, Adithya Balakumar wrote:
> From: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
> 
> WFX_URL can be set via the Kconfig menu. Enable wfx backend based updates
> if WFX_URL is set at build time.
> 
> Signed-off-by: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
> ---
>   recipes-core/images/swupdate.inc | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/recipes-core/images/swupdate.inc b/recipes-core/images/swupdate.inc
> index 7cd816a..7041058 100644
> --- a/recipes-core/images/swupdate.inc
> +++ b/recipes-core/images/swupdate.inc
> @@ -57,5 +57,9 @@ python() {
>   IMAGE_INSTALL:append = "${@' swupdate' if bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')) else ''}"
>   IMAGE_PREINSTALL:append = "${@'' if bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')) else ' swupdate'}"
>   
> +# check for wfx url to enable support for wfx backend based updates
> +OVERRIDES .= "${@':wfx' if d.getVar("WFX_URL") else ''}"

Why the getVar pattern? In all other cases we set overrides with a file 
in kas/opt/.

Quirin

> +IMAGE_INSTALL:append:wfx = " swupdate-config-wfx"
> +
>   IMAGE_INSTALL += " swupdate-handler-roundrobin"
>   IMAGE_INSTALL += " swupdate-config"
> 
> 
> 
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#21635): https://lists.cip-project.org/g/cip-dev/message/21635
> Mute This Topic: https://lists.cip-project.org/mt/117296113/1753640
> Group Owner: cip-dev+owner@lists.cip-project.org
> Unsubscribe: https://lists.cip-project.org/g/cip-dev/unsub [quirin.gylstorff@siemens.com]
> -=-=-=-=-=-=-=-=-=-=-=-
> 

Re: [cip-dev] [isar-cip-core][PATCH v5 3/4] swupdate.inc: Enable wfx based updates if WFX_URL is set

[Adithya.Balakumar]

[-- Attachment #1: Type: text/plain, Size: 1921 bytes --]

Hi Quirin,

>Why the getVar pattern? In all other cases we set overrides with a file
>in kas/opt/.

I took this approach after a suggestion from Jan in v3  [1]

[1] https://lists.cip-project.org/g/cip-dev/message/20264
________________________________
From: cip-dev@lists.cip-project.org <cip-dev@lists.cip-project.org> on behalf of Quirin Gylstorff via lists.cip-project.org <quirin.gylstorff=siemens.com@lists.cip-project.org>
Sent: Friday, January 16, 2026 7:19 PM
To: cip-dev@lists.cip-project.org <cip-dev@lists.cip-project.org>
Subject: Re: [cip-dev] [isar-cip-core][PATCH v5 3/4] swupdate.inc: Enable wfx based updates if WFX_URL is set



On 1/16/26 12:49 PM, Adithya Balakumar wrote:
> From: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
>
> WFX_URL can be set via the Kconfig menu. Enable wfx backend based updates
> if WFX_URL is set at build time.
>
> Signed-off-by: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
> ---
>   recipes-core/images/swupdate.inc | 4 ++++
>   1 file changed, 4 insertions(+)
>
> diff --git a/recipes-core/images/swupdate.inc b/recipes-core/images/swupdate.inc
> index 7cd816a..7041058 100644
> --- a/recipes-core/images/swupdate.inc
> +++ b/recipes-core/images/swupdate.inc
> @@ -57,5 +57,9 @@ python() {
>   IMAGE_INSTALL:append = "${@' swupdate' if bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')) else ''}"
>   IMAGE_PREINSTALL:append = "${@'' if bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')) else ' swupdate'}"
>
> +# check for wfx url to enable support for wfx backend based updates
> +OVERRIDES .= "${@':wfx' if d.getVar("WFX_URL") else ''}"

Why the getVar pattern? In all other cases we set overrides with a file
in kas/opt/.

Quirin

> +IMAGE_INSTALL:append:wfx = " swupdate-config-wfx"
> +
>   IMAGE_INSTALL += " swupdate-handler-roundrobin"
>   IMAGE_INSTALL += " swupdate-config"
>
>
>
>
>


[-- Attachment #2: Type: text/html, Size: 3776 bytes --]

Re: [cip-dev] [isar-cip-core][PATCH v5 1/4] swupdate-config-wfx: Recipe to set configs for wfx backend based updates

[Adithya.Balakumar]

[-- Attachment #1: Type: text/plain, Size: 2652 bytes --]

Hi Quirin,

Fair enough, I will fix this is in v6.

________________________________
From: cip-dev@lists.cip-project.org <cip-dev@lists.cip-project.org> on behalf of Quirin Gylstorff via lists.cip-project.org <quirin.gylstorff=siemens.com@lists.cip-project.org>
Sent: Friday, January 16, 2026 7:17 PM
To: cip-dev@lists.cip-project.org <cip-dev@lists.cip-project.org>
Subject: Re: [cip-dev] [isar-cip-core][PATCH v5 1/4] swupdate-config-wfx: Recipe to set configs for wfx backend based updates



On 1/16/26 12:49 PM, Adithya Balakumar wrote:
> From: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
>
> wfx requires a unique clientId for each client device for targeted jobs for
> each client. Additionally, start SWUpdate in suricatta daemon mode with the
> built-in wfx lua client.
>
> Signed-off-by: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
> ---
>   .../files/suricatta_wfx.conf.tmpl             |  1 +
>   .../swupdate-config-wfx_0.1.bb                | 27 +++++++++++++++++++
>   2 files changed, 28 insertions(+)
>   create mode 100644 recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl
>   create mode 100644 recipes-core/swupdate-config-wfx/swupdate-config-wfx_0.1.bb
>
> diff --git a/recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl b/recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl
> new file mode 100644
> index 0000000..744b426
> --- /dev/null
> +++ b/recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl
> @@ -0,0 +1 @@
> +SWUPDATE_SURICATTA_ARGS="--server lua -u ${WFX_URL} -i $(cat /etc/machine-id)"
> diff --git a/recipes-core/swupdate-config-wfx/swupdate-config-wfx_0.1.bb b/recipes-core/swupdate-config-wfx/swupdate-config-wfx_0.1.bb
> new file mode 100644
> index 0000000..3569888
> --- /dev/null
> +++ b/recipes-core/swupdate-config-wfx/swupdate-config-wfx_0.1.bb
> @@ -0,0 +1,27 @@
> +#
> +# CIP Core, generic profile
> +#
> +# Copyright (c) Toshiba Corporation, 2026
> +#
> +# Authors:
> +#  Adithya Balakumar <adithya.balakumar@toshiba-tsip.com>
> +#
> +# SPDX-License-Identifier: MIT
> +#
> +
> +inherit dpkg-raw
> +
> +PROVIDES := "${PN}"
> +DEBIAN_PROVIDES := "${PN}"
> +
> +PN .= "-${MACHINE}"
> +
> +SRC_URI += "file://suricatta_wfx.conf.tmpl"
> +
> +TEMPLATE_FILES += " suricatta_wfx.conf.tmpl"
> +TEMPLATE_VARS += " WFX_URL"
WFX_URL is undefined in this recipe, e.g.:

`WFX_URL ??= ""`

Quirin
> +
> +do_install() {
> +    install -d ${D}/etc/swupdate/conf.d
> +    install -m 0644 ${WORKDIR}/suricatta_wfx.conf ${D}/etc/swupdate/conf.d/suricatta_wfx.conf
> +}
>
>
>
>
>


[-- Attachment #2: Type: text/html, Size: 4803 bytes --]

Re: [cip-dev] [isar-cip-core][PATCH v5 3/4] swupdate.inc: Enable wfx based updates if WFX_URL is set

[Adithya.Balakumar]

[-- Attachment #1: Type: text/plain, Size: 2514 bytes --]

Hi Jan,

Any thoughts on this? Do we stick with the current approach or switch over to a file in kas/opt ?

Regards,
Adithya Balakumar
________________________________
From: cip-dev@lists.cip-project.org <cip-dev@lists.cip-project.org> on behalf of Adithya Balakumar <adithya.balakumar@toshiba-tsip.com>
Sent: Friday, January 16, 2026 7:56 PM
To: cip-dev@lists.cip-project.org <cip-dev@lists.cip-project.org>; quirin.gylstorff@siemens.com <quirin.gylstorff@siemens.com>
Subject: Re: [cip-dev] [isar-cip-core][PATCH v5 3/4] swupdate.inc: Enable wfx based updates if WFX_URL is set

Hi Quirin,

>Why the getVar pattern? In all other cases we set overrides with a file
>in kas/opt/.

I took this approach after a suggestion from Jan in v3  [1]

[1] https://lists.cip-project.org/g/cip-dev/message/20264
________________________________
From: cip-dev@lists.cip-project.org <cip-dev@lists.cip-project.org> on behalf of Quirin Gylstorff via lists.cip-project.org <quirin.gylstorff=siemens.com@lists.cip-project.org>
Sent: Friday, January 16, 2026 7:19 PM
To: cip-dev@lists.cip-project.org <cip-dev@lists.cip-project.org>
Subject: Re: [cip-dev] [isar-cip-core][PATCH v5 3/4] swupdate.inc: Enable wfx based updates if WFX_URL is set



On 1/16/26 12:49 PM, Adithya Balakumar wrote:
> From: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
>
> WFX_URL can be set via the Kconfig menu. Enable wfx backend based updates
> if WFX_URL is set at build time.
>
> Signed-off-by: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
> ---
>   recipes-core/images/swupdate.inc | 4 ++++
>   1 file changed, 4 insertions(+)
>
> diff --git a/recipes-core/images/swupdate.inc b/recipes-core/images/swupdate.inc
> index 7cd816a..7041058 100644
> --- a/recipes-core/images/swupdate.inc
> +++ b/recipes-core/images/swupdate.inc
> @@ -57,5 +57,9 @@ python() {
>   IMAGE_INSTALL:append = "${@' swupdate' if bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')) else ''}"
>   IMAGE_PREINSTALL:append = "${@'' if bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')) else ' swupdate'}"
>
> +# check for wfx url to enable support for wfx backend based updates
> +OVERRIDES .= "${@':wfx' if d.getVar("WFX_URL") else ''}"

Why the getVar pattern? In all other cases we set overrides with a file
in kas/opt/.

Quirin

> +IMAGE_INSTALL:append:wfx = " swupdate-config-wfx"
> +
>   IMAGE_INSTALL += " swupdate-handler-roundrobin"
>   IMAGE_INSTALL += " swupdate-config"
>
>
>
>
>


[-- Attachment #2: Type: text/html, Size: 5525 bytes --]

Re: [cip-dev] [isar-cip-core][PATCH v5 3/4] swupdate.inc: Enable wfx based updates if WFX_URL is set

[Quirin Gylstorff]

On 1/21/26 9:14 AM, Adithya.Balakumar@toshiba-tsip.com wrote:
> Hi Jan,
> 
> Any thoughts on this? Do we stick with the current approach or switch 
> over to a file in kas/opt ?
> 
Alternative drop the unnecessary `overrides`. And use WFX_URL direct to 
install swupdate-config-wfx.

Quirin
> Regards,
> Adithya Balakumar
> ------------------------------------------------------------------------
> *From:* cip-dev@lists.cip-project.org <cip-dev@lists.cip-project.org> on 
> behalf of Adithya Balakumar <adithya.balakumar@toshiba-tsip.com>
> *Sent:* Friday, January 16, 2026 7:56 PM
> *To:* cip-dev@lists.cip-project.org <cip-dev@lists.cip-project.org>; 
> quirin.gylstorff@siemens.com <quirin.gylstorff@siemens.com>
> *Subject:* Re: [cip-dev] [isar-cip-core][PATCH v5 3/4] swupdate.inc: 
> Enable wfx based updates if WFX_URL is set
> 
> Hi Quirin,
> 
>  >Why the getVar pattern? In all other cases we set overrides with a file
>  >in kas/opt/.
> 
> I took this approach after a suggestion from Jan in v3  [1]
> 
> [1] https://lists.cip-project.org/g/cip-dev/message/20264 <https:// 
> lists.cip-project.org/g/cip-dev/message/20264>
> ------------------------------------------------------------------------
> *From:* cip-dev@lists.cip-project.org <cip-dev@lists.cip-project.org> on 
> behalf of Quirin Gylstorff via lists.cip-project.org 
> <quirin.gylstorff=siemens.com@lists.cip-project.org>
> *Sent:* Friday, January 16, 2026 7:19 PM
> *To:* cip-dev@lists.cip-project.org <cip-dev@lists.cip-project.org>
> *Subject:* Re: [cip-dev] [isar-cip-core][PATCH v5 3/4] swupdate.inc: 
> Enable wfx based updates if WFX_URL is set
> 
> 
> 
> On 1/16/26 12:49 PM, Adithya Balakumar wrote:
>  > From: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
>  >
>  > WFX_URL can be set via the Kconfig menu. Enable wfx backend based updates
>  > if WFX_URL is set at build time.
>  >
>  > Signed-off-by: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
>  > ---
>  >   recipes-core/images/swupdate.inc | 4 ++++
>  >   1 file changed, 4 insertions(+)
>  >
>  > diff --git a/recipes-core/images/swupdate.inc b/recipes-core/images/ 
> swupdate.inc
>  > index 7cd816a..7041058 100644
>  > --- a/recipes-core/images/swupdate.inc
>  > +++ b/recipes-core/images/swupdate.inc
>  > @@ -57,5 +57,9 @@ python() {
>  >   IMAGE_INSTALL:append = "${@' swupdate' if 
> bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')) else ''}"
>  >   IMAGE_PREINSTALL:append = "${@'' if 
> bb.utils.to_boolean(d.getVar('SWUPDATE_SELFBUILT')) else ' swupdate'}"
>  >
>  > +# check for wfx url to enable support for wfx backend based updates
>  > +OVERRIDES .= "${@':wfx' if d.getVar("WFX_URL") else ''}"
> 
> Why the getVar pattern? In all other cases we set overrides with a file
> in kas/opt/.
> 
> Quirin
> 
>  > +IMAGE_INSTALL:append:wfx = " swupdate-config-wfx"
>  > +
>  >   IMAGE_INSTALL += " swupdate-handler-roundrobin"
>  >   IMAGE_INSTALL += " swupdate-config"
>  >
>  >
>  >
>  >
>  >
> 

Re: [cip-dev] [isar-cip-core][PATCH v5 3/4] swupdate.inc: Enable wfx based updates if WFX_URL is set

[Jan Kiszka]

On 21.01.26 16:32, Quirin Gylstorff wrote:
> 
> 
> On 1/21/26 9:14 AM, Adithya.Balakumar@toshiba-tsip.com wrote:
>> Hi Jan,
>>
>> Any thoughts on this? Do we stick with the current approach or switch
>> over to a file in kas/opt ?
>>
> Alternative drop the unnecessary `overrides`. And use WFX_URL direct to
> install swupdate-config-wfx.
> 

Right, the value of overrides is primarily in controlling more than one
variable via it. If there are more case already foreseeable, we can keep
it (but please name them), otherwise fold the override creation logic
into IMAGE_INSTALL:append.

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center

Re: [isar-cip-core][PATCH v5 2/4] Kconfig: Add option to set WFX_URL

[Jan Kiszka]

On 16.01.26 13:03, Adithya.Balakumar@toshiba-tsip.com wrote:
> From: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
> 
> Signed-off-by: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
> ---
>  Kconfig | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/Kconfig b/Kconfig
> index 30abb84..3665269 100644
> --- a/Kconfig
> +++ b/Kconfig
> @@ -279,6 +279,13 @@ config IMAGE_SWUPDATE
>  
>  if IMAGE_SWUPDATE
>  
> +config WFX_URL
> +	string "WFX backend URL"
> +	default ""
> +	help
> +	  URL of the wfx backend for software updates. See ./doc/README.swupdate.md for
> +	  more about wfx support for updates.

Maybe clarify here that an empty string implies that wfx support is
disabled.

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center

Re: [isar-cip-core][PATCH v5 4/4] doc/README.swupdate.md: Add section for software update with wfx

[Jan Kiszka]

On 16.01.26 13:03, Adithya.Balakumar@toshiba-tsip.com wrote:
> From: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
> 
> Signed-off-by: Adithya Balakumar <Adithya.Balakumar@toshiba-tsip.com>
> ---
>  doc/README.swupdate.md | 113 +++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 113 insertions(+)
> 
> diff --git a/doc/README.swupdate.md b/doc/README.swupdate.md
> index b68b5b7..8b756cd 100644
> --- a/doc/README.swupdate.md
> +++ b/doc/README.swupdate.md
> @@ -464,6 +464,119 @@ Any http server (service) can be used to host the .zck file as long as the http
>  
>  Follow the steps mentioned in the section [SWUpdate verification](#swupdate-verification) for verification.
>  
> +# Software update with wfx
> +
> +**NOTE**: In the following sections, `WFX_HOST` refers to the IP address or DNS-resolvable name of your `wfx` server. Please substitute `WFX_HOST` with the appropriate value wherever it appears.
> +
> +Set the `WFX_URL` to `http://WFX_HOST:8080/api/wfx/v1` via the `Kconfig` menu.
> +
> +Install `wfxctl` and `wfx` in the host:
> +The instructions below assume that `wfxctl` and `wfx` are running on a `x86-64` host. Binaries for other architectures are also available for [download](https://github.com/siemens/wfx/releases).
> +```
> +## Install wfxctl
> +host$ curl -LO https://github.com/siemens/wfx/releases/download/v0.4.1/wfxctl_0.4.1_linux_x86_64.deb
> +host$ dpkg -i wfxctl_0.4.1_linux-x86_64.deb
> +
> +## Install wfx
> +host$ curl -LO https://github.com/siemens/wfx/releases/download/v0.4.1/wfx_0.4.1_linux_x86_64.deb
> +host$ dpkg -i wfx_0.4.1_linux-x86_64.deb
> +```
> +
> +

Only one blank line needed here.

> +Build an image which will later serve as update package:
> +```
> +host$ ./kas-container build kas-cip.yml:kas/board/qemu-amd64.yml:kas/opt/ebg-swu.yml:kas/opt/trixie.yml
> +```
> +

Wait - how will that image get the WFX_URL? This can only be achieved
via menu-based configuration and build.

> +Save the generated swu build/tmp/deploy/images/qemu-amd64/cip-core-image-cip-core-trixie-qemu-amd64.swu into a separate folder
> +
> +```
> +host$ mkdir -p /tmp/artifacts
> +host$ cp build/tmp/deploy/images/qemu-amd64/cip-core-image-cip-core-trixie-qemu-amd64.swu /tmp/artifacts
> +```
> +
> +Next, rebuild the image, switching to the RT kernel as modification:
> +```
> +host$ ./kas-container build kas-cip.yml:kas/board/qemu-amd64.yml:kas/opt/ebg-swu.yml:kas/opt/rt.yml:kas/opt/trixie.yml
> +```
> +
> +Now start the image which will contain the RT kernel:
> +```
> +host$ SWUPDATE_BOOT=y ./start-qemu.sh amd64
> +```
> +
> +Check the machine-id in `/etc/machine-id`. SWUpdate is launched with this `id` as the `client-id` and is later used to create `wfx` job for the client:
> +```
> +root@demo cat /etc/machine-id
> +049adc79659044f8887c83b3203c84f1
> +```
> +
> +Start `wfx` server in the host:
> +```
> +host$ wfx --simple-fileserver /tmp/artifacts
> +```
> +Alternatively, `wfx` can also be run as a [docker container](https://github.com/siemens/wfx/blob/a6ecb60bb47eaf1f95a2b65b4190538a246d79d1/docs/installation.md#build-and-installation).
> +
> +Create `wfx.workflow.dau.direct` wofkflow:
> +```
> +host$ curl -L https://raw.githubusercontent.com/siemens/wfx/refs/heads/main/workflow/dau/wfx.workflow.dau.direct.yml | wfxctl workflow create -
> +```
> +
> +Create a wfx job that updates the device. Set `client-id` with the `id` from `/etc/machine-id` in qemu:
> +```
> +host$ cat <<EOF | envsubst | wfxctl job create --client-id '049adc79659044f8887c83b3203c84f1' --workflow wfx.workflow.dau.direct -
> +{
> +  "version": "1.0",
> +  "type": ["firmware"],
> +  "artifacts": [
> +    {
> +      "name": "Example Device Firmware Artifact",
> +      "version": "1.1",
> +      "uri": "http://${WFX_HOST}:8080/download/cip-core-image-cip-core-trixie-qemu-amd64.swu"
> +    }
> +  ]
> +}
> +EOF
> +```
> +
> +Wait for the next swupdate polling round (every 20 seconds) to see how swupdate downloads and applies the update.
> +```
> +root@demo journalctl -u swupdate -f
> +
> +// truncated output
> +swupdate.sh[432]: [TRACE] : SWUPDATE running :  [start_suricatta] : Suricatta awakened.
> +swupdate.sh[432]: [DEBUG] : SWUPDATE running :  [notify_helper] : Suricatta querying "http://WFX_HOST:8080/api/wfx/v1/jobs?clientId=049adc79659044f8887c83b3203c84f1&group=OPEN"
> +```
> +
> +Once the update is successfully installed, the device automatically reboots. After reboot, suricatta automatically updates the bootloader state.
> +```
> +root@demo bg_printenv
> +
> +----------------------------
> + Config Partition #0 Values:
> +in_progress:      no
> +revision:         2
> +kernel:           C:BOOT0:linux.efi
> +kernelargs:
> +watchdog timeout: 120 seconds
> +ustate:           0 (OK)
> +
> +user variables:
> +
> +
> +
> +----------------------------
> + Config Partition #1 Values:
> +in_progress:      no
> +revision:         3
> +kernel:           C:BOOT1:linux.efi
> +kernelargs:
> +watchdog timeout: 120 seconds
> +ustate:           0 (OK)
> +
> +user variables:
> +```
> +
>  # Building and testing the CIP Core image for BBB
>  
>  Follow the steps mentioned in the section [Building and testing the CIP Core image](README.swupdate.md#building-and-testing-the-cip-core-image) for creating images and .swu files.

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center