Digi
/
meta-digi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

trustfence: make co-processor secure firmware optional 

Introduce a configurable variable to enable/disable secure co-processor
firmware when TrustFence is enabled.

https://onedigi.atlassian.net/browse/DEL-9813

Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
This commit is contained in:
Arturo Buzarra 2025-12-03 09:07:22 +01:00
parent 08637debae
commit 98c3e6427b
4 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
meta-digi-arm/dynamic-layers/stm-st-stm32mp/recipes-security/optee/optee-os-stm32mp_4.0.0.bbappend
View File

@ -21,8 +21,8 @@ SRC_URI = " \
"
SRC_URI:append:ccmp25 = " \
${@oe.utils.conditional('TRUSTFENCE_ENABLED', '1' , 'file://0001-ARM-dts-ccmp25-add-signed-firmware-support-for-RPROC.patch', '', d)} \
${@oe.utils.conditional('TRUSTFENCE_COPRO_ENABLED', '1' , 'file://0001-ARM-dts-ccmp25-add-signed-firmware-support-for-RPROC.patch', '', d)} \
"
# Enable remoteproc OTP public key verification for signed firmware support
EXTRA_OEMAKE:append:ccmp25 = " ${@oe.utils.conditional('TRUSTFENCE_ENABLED', '1', 'CFG_REMOTEPROC_PUB_KEY_VERIFY=y', '', d)}"
EXTRA_OEMAKE:append:ccmp25 = " ${@oe.utils.conditional('TRUSTFENCE_COPRO_ENABLED', '1', 'CFG_REMOTEPROC_PUB_KEY_VERIFY=y', '', d)}"

2
meta-digi-arm/recipes-bsp/u-boot/u-boot-dey_2023.10.bb
View File

@ -14,7 +14,7 @@ SRC_URI += " \
"
SRC_URI:append:ccmp25 = " \
${@oe.utils.conditional('TRUSTFENCE_ENABLED', '1' , 'file://0001-ARM-dts-ccmp25-add-signed-firmware-support-for-RPROC.patch', '', d)} \
${@oe.utils.conditional('TRUSTFENCE_COPRO_ENABLED', '1' , 'file://0001-ARM-dts-ccmp25-add-signed-firmware-support-for-RPROC.patch', '', d)} \
"
install_helper_files() {

2
meta-digi-arm/recipes-kernel/linux/linux-dey_6.6.bb
View File

@ -23,7 +23,7 @@ SRC_URI:append = " \
"
SRC_URI:append:ccmp25 = " \
${@oe.utils.conditional('TRUSTFENCE_ENABLED', '1' , 'file://0001-ARM64-dts-ccmp25-add-signed-firmware-support-for-RPR.patch', '', d)} \
${@oe.utils.conditional('TRUSTFENCE_COPRO_ENABLED', '1' , 'file://0001-ARM64-dts-ccmp25-add-signed-firmware-support-for-RPR.patch', '', d)} \
"
SRC_URI:append:ccimx95 = " \

3
meta-digi-dey/classes/trustfence.bbclass
View File

@ -45,6 +45,9 @@ TRUSTFENCE_ENCRYPT_ROOTFS:ccmp1 ?= "0"
TRUSTFENCE_ENCRYPT_ROOTFS:ccmp2 ?= "0"
TRUSTFENCE_FILE_BASED_ENCRYPT ?= "${TF_FILE_BASED_ENCRYPT}"
# Co-processor settings
TRUSTFENCE_COPRO_ENABLED ?= "1"
# Read-only rootfs
TRUSTFENCE_READ_ONLY_ROOTFS ?= "${@bb.utils.contains("IMAGE_FEATURES", "read-only-rootfs", "1", "0", d)}"