Merge branch 'dey-3.0/maint' into 'dey-3.0/master'

Merge at commit right after 'dey-3.0-r1.3'.

Signed-off-by: Hector Palacios <hector.palacios@digi.com>
This commit is contained in:
Hector Palacios 2020-06-29 16:07:56 +02:00
commit e56f201a57
35 changed files with 202 additions and 240 deletions

View File

@ -50,32 +50,6 @@ Software for the following hardware platforms is in production support:
* [CC-WMX6UL-KIT](https://www.digi.com/products/models/cc-wmx6ul-kit) ([Get Started](https://www.digi.com/resources/documentation/digidocs/embedded/dey/3.0/cc6ul/yocto-gs_index))
* [CC-SBP-WMX-JN58](https://www.digi.com/products/models/cc-sbp-wmx-jn58)
## ConnectCore 6 Plus
* ConnectCore 6 Plus System-on-Module (SOM)
* [CC-WMX-KK8D-TN](https://www.digi.com/products/models/cc-wmx-kk8d-tn)
* ConnectCore 6 Plus professional development kit
* [CC-WMX6P-KIT](https://www.digi.com/products/models/cc-wmx6p-kit) ([Get Started](https://www.digi.com/resources/documentation/digidocs/embedded/dey/3.0/cc6plus/yocto-gs_index))
## ConnectCore 6
* ConnectCore 6 System-on-Module (SOM)
* [CC-WMX-J97C-TN](https://www.digi.com/products/models/cc-wmx-j97c-tn)
* [CC-WMX-L96C-TE](https://www.digi.com/products/models/cc-wmx-l96c-te)
* [CC-WMX-L87C-TE](https://www.digi.com/products/models/cc-wmx-l87c-te)
* [CC-MX-L76C-Z1](https://www.digi.com/products/models/cc-mx-l76c-z1)
* [CC-MX-L86C-Z1](https://www.digi.com/products/models/cc-mx-l86c-z1)
* [CC-MX-L96C-Z1](https://www.digi.com/products/models/cc-mx-l96c-z1)
* [CC-WMX-L76C-TE](https://www.digi.com/products/models/cc-wmx-l76c-te)
* CC-WMX-K87C-FJA
* CC-WMX-K77C-TE
* CC-WMX-L97D-TN
* CC-WMX-J98C-FJA
* CC-WMX-J98C-FJA-1
* ConnectCore 6 Jumpstart Development Kit (SBC with Connectore 6 module)
* [CC-WMX6-KIT](https://www.digi.com/products/models/cc-wmx6-kit) ([Get Started](https://www.digi.com/resources/documentation/digidocs/embedded/dey/3.0/cc6/yocto-gs_index))
* [CC-SB-WMX-J97C-1](https://www.digi.com/products/models/cc-sb-wmx-j97c-1)
* [CC-SB-WMX-L87C-1](https://www.digi.com/products/models/cc-sb-wmx-l87c-1)
* [CC-SB-WMX-L76C-1](https://www.digi.com/products/models/cc-sb-wmx-l76c-1)
Previous versions of Digi Embedded Yocto include support for additional Digi
hardware.
@ -110,7 +84,11 @@ Documentation is available online at https://www.digi.com/resources/documentatio
* Updated OpenSSL to v1.1.1d
* Package upgrades and security fixes
* Updated kernel version to v5.4 for i.MX8X, i.MX8MN and i.MX6UL platforms
* Updated U-Boot to version 2019.04-r1 for i.MX8X platform
* Updated U-Boot to version 2017.03-r6 for i.MX6UL platform
* Updated U-Boot to version 2018.03-r4 for i.MX8MN platform
* Updated U-Boot to version 2019.04-r2 for i.MX8X platform
* Added support for ConnectCore 8M Nano v2 SOM
* Added initial TrustFence support for ConnectCore 8M Nano
# Known Issues and Limitations
@ -134,8 +112,8 @@ updated list can be found on the online documentation.
* When working as an access point, DFS-capable channels in the 5GHz band are
not supported.
* For P2P connections Digi recommends "Negotiated GO" modes. The QCA6564
devices (ConnectCore 6UL, ConnectCore 6 Plus, ConnectCore 8M Nano) fail to
join autonomous groups.
devices (ConnectCore 6UL and ConnectCore 8M Nano) fail to join autonomous
groups.
* Trustfence is not yet supported on the ConnectCore 8M Nano.
## ConnectCore 8M Nano
@ -167,32 +145,6 @@ updated list can be found on the online documentation.
reducing the maximum throughput of this interface.
* The QCA6564 wireless chip does not support Wake On Wireless LAN.
## ConnectCore 6 Plus
* ConnectCore 6 Plus System-on-Module (SOM)
* NXP i.MX6QP processor has a documented errata (ERR004512) whereby the maximum
performance of the Gigabit FEC is limited to 400Mbps (total for Tx and Rx).
* ConnectCore 6 Plus SBC
* The Micrel PHY KSZ9031 may take between five and six seconds to
auto-negotiate with Gigabit switches.
## ConnectCore 6
* ConnectCore 6 System-on-Module (SOM)
* NXP i.MX6 processor has a documented errata (ERR004512) whereby the maximum
performance of the Gigabit FEC is limited to 400Mbps (total for Tx and Rx).
* The Qualcomm AR6233 firmware does not support the following configuration
modes:
* Concurrent modes involving P2P mode, such as P2P + softAP or P2P + STA.
* Bluetooth + softAP + STA concurrent mode.
* A maximum of five clients are supported when using Qualcomm's AR6233 in
softAP mode.
* A maximum of ten connected devices are supported when using Qualcomm's AR6233
Bluetooth Low Energy mode.
* ConnectCore 6 SBC
* The Micrel PHY KSZ9031 may take between five and six seconds to
auto-negotiate with Gigabit switches.
# Support Contact Information
For support questions please contact Digi Technical Support:

View File

@ -207,12 +207,8 @@ trustence_sign_cpio() {
[ -n "${TRUSTFENCE_DEK_PATH}" ] && [ "${TRUSTFENCE_DEK_PATH}" != "0" ] && export CONFIG_DEK_PATH="${TRUSTFENCE_DEK_PATH}"
[ -n "${TRUSTFENCE_SIGN_MODE}" ] && export CONFIG_SIGN_MODE="${TRUSTFENCE_SIGN_MODE}"
if [ "${TRUSTFENCE_SIGN_MODE}" = "AHAB" ]; then
mkimage_imx8 -soc ${MX8_SOC_VAR} -rev ${MX8_CHIP_REV} -c -ap ${1} a35 ${RAM_CONTAINER_LOC_TF} -out ${1}-mkimg
mv "${1}-mkimg" "${1}"
fi
# Sign/encrypt the ramdisk
trustfence-sign-kernel.sh -p "${DIGI_FAMILY}" -i "${1}" "${1}.tf"
trustfence-sign-artifact.sh -p "${DIGI_FAMILY}" -i "${1}" "${1}.tf"
else
# Copy the image with no changes
cp "${1}" "${1}.tf"
@ -284,14 +280,19 @@ IMAGE_CMD_sdcard() {
parted -s ${SDIMG} -- unit KiB mkpart primary ext2 $(expr ${IMAGE_ROOTFS_ALIGNMENT} \+ ${BOOT_SPACE_ALIGNED}) -1s
parted -s ${SDIMG} unit KiB print
# FIXME: adapt trustfence handling for imx-boot
# Set u-boot image to flash depending on whether TRUSTFENCE_SIGN is enabled
if [ "${TRUSTFENCE_SIGN}" = "1" ]; then
SDIMG_BOOTLOADER="$(readlink -e ${SDIMG_BOOTLOADER} | sed -e 's,u-boot-,u-boot-signed-,g')"
if [ "${BOOTLOADER_IMAGE_RECIPE}" = "u-boot" ]; then
SDIMG_BOOT="$(readlink -e ${SDIMG_BOOTLOADER} | sed -e 's,u-boot-,u-boot-dtb-signed-,g')"
else
SDIMG_BOOT="$(readlink -e ${SDIMG_BOOTLOADER} | sed -e 's,imx-boot-,imx-boot-signed-,g')"
fi
else
SDIMG_BOOT="$(readlink -e ${SDIMG_BOOTLOADER})"
fi
# Burn bootloader, boot and rootfs partitions
dd if=${SDIMG_BOOTLOADER} of=${SDIMG} conv=notrunc,fsync seek=${BOOTLOADER_SEEK} bs=1K
dd if=${SDIMG_BOOT} of=${SDIMG} conv=notrunc,fsync seek=${BOOTLOADER_SEEK} bs=1K
dd if=${SDIMG_BOOTFS} of=${SDIMG} conv=notrunc,fsync seek=1 bs=$(expr ${IMAGE_ROOTFS_ALIGNMENT} \* 1024)
dd if=${SDIMG_ROOTFS} of=${SDIMG} conv=notrunc,fsync seek=1 bs=$(expr ${IMAGE_ROOTFS_ALIGNMENT} \* 1024 + ${BOOT_SPACE_ALIGNED} \* 1024)
}

View File

@ -34,7 +34,7 @@ WIRELESS_MODULE_append = " ${@oe.utils.conditional('HAVE_WIFI', '1', 'kernel-mod
HAS_WIFI_VIRTWLANS = "true"
# Firmware
MACHINE_FIRMWARE ?= "firmware-imx-sdma firmware-imx-easrc"
MACHINE_FIRMWARE ?= "firmware-imx-sdma firmware-imx-easrc firmware-imx-regulatory"
MACHINE_FIRMWARE_append = " ${@oe.utils.conditional('HAVE_BT', '1', 'firmware-qualcomm-qca6564-bt', '', d)}"
MACHINE_FIRMWARE_append = " ${@oe.utils.conditional('HAVE_WIFI', '1', 'firmware-qualcomm-qca6564-wifi', '', d)}"
@ -60,7 +60,9 @@ VIRTUAL-RUNTIME_initscripts ?= "initscripts"
# TrustFence
TRUSTFENCE_SIGN_MODE = "HAB"
# TODO: not yet supported
# TODO: Encryption not yet supported
TRUSTFENCE_DEK_PATH = "0"
TRUSTFENCE_INITRAMFS_IMAGE = ""
TRUSTFENCE_ENCRYPT_ENVIRONMENT = "0"
# Adding 'wayland' along with 'x11' enables the xwayland backend

View File

@ -44,7 +44,7 @@ WIRELESS_MODULE_append = " ${@oe.utils.conditional('HAVE_WIFI', '1', 'kernel-mod
HAS_WIFI_VIRTWLANS = "true"
# Firmware
MACHINE_FIRMWARE ?= "firmware-imx-vpu-imx8 firmware-imx-sdma"
MACHINE_FIRMWARE ?= "firmware-imx-vpu-imx8 firmware-imx-sdma firmware-imx-regulatory"
MACHINE_FIRMWARE_append = " ${@oe.utils.conditional('HAVE_BT', '1', 'firmware-qualcomm-qca6574-bt', '', d)}"
MACHINE_FIRMWARE_append = " ${@oe.utils.conditional('HAVE_WIFI', '1', 'firmware-qualcomm-qca6574-wifi', '', d)}"
@ -68,18 +68,12 @@ KERNEL_IMAGETYPE = "Image.gz"
VIRTUAL-RUNTIME_init_manager ?= "systemd"
VIRTUAL-RUNTIME_initscripts ?= "initscripts"
# For i.MX 8 silicon chip revision
MX8_CHIP_REV ?= "B0"
MX8_SOC_VAR ?= "QX"
# TrustFence
TRUSTFENCE_SIGN_MODE = "AHAB"
# TODO: not yet supported
# TODO: Encryption not yet supported
TRUSTFENCE_DEK_PATH = "0"
TRUSTFENCE_INITRAMFS_IMAGE = ""
TRUSTFENCE_ENCRYPT_ENVIRONMENT = "0"
# For Trustfence container header RAM locations
RAM_CONTAINER_LOC_BOOT = "0x80280000"
RAM_CONTAINER_LOC_DTB = "0x82000000"
RAM_CONTAINER_LOC_TF = "0x82100000"
# Adding 'wayland' along with 'x11' enables the xwayland backend
# Vulkan is necessary for wayland to build

View File

@ -9,7 +9,7 @@ XSERVER = "xserver-xorg \
${XSERVER_DRIVER}"
# Ship kernel modules
MACHINE_EXTRA_RRECOMMENDS = "kernel-modules"
MACHINE_EXTRA_RRECOMMENDS += "kernel-modules"
# Tunes for hard/soft float-point selection. Note that we allow building for
# thumb support giving distros the chance to enable thumb by setting

View File

@ -11,8 +11,8 @@ inherit pkgconfig deploy
SRC_URI = "${DIGI_PKG_SRC}/${BPN}-${PV}.tar.gz"
SRC_URI[md5sum] = "bcf3402c9d6a394dad8d518a73cb27ad"
SRC_URI[sha256sum] = "bd5fb8a35d9fbb0e10f93513e52a3ce3e105e4a80d82624a0be4e73eb95b1352"
SRC_URI[md5sum] = "24a8d857d5ecc81f08457f2f4512e779"
SRC_URI[sha256sum] = "769282b099f97af6132e75f505056f3e7914dd8557778af8169db28fcf28727a"
S = "${WORKDIR}/${PN}-${PV}"

View File

@ -0,0 +1,15 @@
# The SDMA firmware needs to be loaded in order for the kernel to carry out
# SPI tranfers with DMA. Such transfers are required when probing the mcp25xxfd
# module, so make sure the firmware is loaded before the module is by adding
# the appropriate dependencies in this service.
[Unit]
Description=User Space SDMA Firmware Loading
Before=systemd-modules-load.service
DefaultDependencies=no
[Service]
ExecStart=/etc/sdma
[Install]
WantedBy=sysinit.target

View File

@ -34,7 +34,7 @@ FW_QCA65X4_PCIE_PROPRIETARY = " \
file://LICENCE.atheros_firmware \
file://qca65X4_pcie_proprietary/otp30.bin \
file://qca65X4_pcie_proprietary/qwlan30.bin \
file://qca65X4_pcie_proprietary/utf30.bin \
file://qca65X4_pcie_proprietary/utf.bin \
"
# Firmware files for QCA6574 (Qualcomm community driver)

View File

@ -116,7 +116,7 @@ do_compile () {
if [ "${TRUSTFENCE_SIGN}" = "1" ]; then
# Log HAB FIT information
bbnote "building ${SOC_TARGET} - print_fit_hab"
make SOC=${SOC_TARGET} print_fit_hab > mkimage-print_fit_hab.log 2>&1
make SOC=${SOC_TARGET} dtbs=${UBOOT_DTB_NAME} print_fit_hab > mkimage-print_fit_hab.log 2>&1
fi
fi
done
@ -212,11 +212,18 @@ do_deploy_append () {
# Sign U-boot image
if [ "${UBOOT_RAM_COMBINATIONS}" = "" ]; then
trustfence-sign-uboot.sh ${DEPLOYDIR}/${UBOOT_PREFIX}-${MACHINE}.bin ${DEPLOYDIR}/${UBOOT_PREFIX}-${MACHINE}-signed.bin
for target in ${IMXBOOT_TARGETS}; do
trustfence-sign-uboot.sh ${DEPLOYDIR}/${UBOOT_PREFIX}-${MACHINE}.bin-${target} ${DEPLOYDIR}/${UBOOT_PREFIX}-signed-${MACHINE}.bin-${target}
done
else
for ramc in ${UBOOT_RAM_COMBINATIONS}; do
for rev in ${SOC_REVISIONS}; do
trustfence-sign-uboot.sh ${DEPLOYDIR}/${UBOOT_PREFIX}-${MACHINE}-${rev}-${ramc}.bin ${DEPLOYDIR}/${UBOOT_PREFIX}-${MACHINE}-${rev}-${ramc}-signed.bin
for target in ${IMXBOOT_TARGETS}; do
# Do not sign "flash_regression_linux_m4" target files
if [ "${target}" != "flash_regression_linux_m4" ]; then
trustfence-sign-uboot.sh ${DEPLOYDIR}/${UBOOT_PREFIX}-${MACHINE}-${rev}-${ramc}.bin-${target} ${DEPLOYDIR}/${UBOOT_PREFIX}-signed-${MACHINE}-${rev}-${ramc}.bin-${target}
fi
done
done
done
fi

View File

@ -8,8 +8,11 @@ LICENSE = "GPLv2"
LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/GPL-2.0;md5=801f80980d171dd6425610833a22dbe6"
SECTION = "BSP"
inherit native deploy
# Beware: applied last to first
DEBUG_PREFIX_MAP = "-fdebug-prefix-map=${WORKDIR}=/usr/src/debug/${PN}/${EXTENDPE}${PV}-${PR} \
-fdebug-prefix-map=${STAGING_DIR_HOST}= \
-fdebug-prefix-map=${STAGING_DIR_NATIVE}= \
"
CFLAGS = "-O2 -Wall -std=c99 -I ${STAGING_INCDIR} -L ${STAGING_LIBDIR}"
REV_CHIP ?= "B0"

View File

@ -1,6 +1,6 @@
# Copyright 2017-2019 NXP
DEPENDS = "zlib-native openssl-native"
DEPENDS = "zlib openssl"
SRCBRANCH = "imx_5.4.3_2.0.0"
IMX_MKIMAGE_SRC ?= "git://source.codeaurora.org/external/imx/imx-mkimage.git;protocol=https"

View File

@ -171,11 +171,9 @@ do_deploy_append() {
[ -n "${TRUSTFENCE_SIGN_MODE}" ] && export CONFIG_SIGN_MODE="${TRUSTFENCE_SIGN_MODE}"
# Sign boot script
if [ "${TRUSTFENCE_SIGN_MODE}" = "HAB" ] && [ "${BOOTLOADER_IMAGE_RECIPE}" = "u-boot" ]; then
TMP_SIGNED_BOOTSCR="$(mktemp ${WORKDIR}/bootscr-signed.XXXXXX)"
trustfence-sign-kernel.sh -p "${DIGI_FAMILY}" -b "${DEPLOYDIR}/boot.scr" "${TMP_SIGNED_BOOTSCR}"
mv "${TMP_SIGNED_BOOTSCR}" "${DEPLOYDIR}/boot.scr"
fi
TMP_SIGNED_BOOTSCR="$(mktemp ${WORKDIR}/bootscr-signed.XXXXXX)"
trustfence-sign-artifact.sh -p "${DIGI_FAMILY}" -b "${DEPLOYDIR}/boot.scr" "${TMP_SIGNED_BOOTSCR}"
mv "${TMP_SIGNED_BOOTSCR}" "${DEPLOYDIR}/boot.scr"
fi
rm -f ${TMP_BOOTSCR}
}
@ -188,11 +186,6 @@ do_deploy_append_ccimx8x() {
install -d ${DEPLOYDIR}/${BOOT_TOOLS}
mv ${DEPLOYDIR}/u-boot* ${DEPLOYDIR}/${BOOT_TOOLS}/
mv ${DEPLOYDIR}/${UBOOT_SYMLINK}-* ${DEPLOYDIR}/${BOOT_TOOLS}/
if [ "${TRUSTFENCE_SIGN}" = "1" ]; then
mkimage_imx8 -soc ${MX8_SOC_VAR} -rev ${MX8_CHIP_REV} -c -ap ${DEPLOYDIR}/boot.scr a35 ${RAM_CONTAINER_LOC_BOOT} -out ${DEPLOYDIR}/boot-mkimg.scr
trustfence-sign-kernel.sh -p "${DIGI_FAMILY}" -b "${DEPLOYDIR}/boot-mkimg.scr" "${DEPLOYDIR}/boot.scr"
rm -f ${DEPLOYDIR}/boot-mkimg.scr
fi
}
do_deploy_append_ccimx8mn() {

View File

@ -32,4 +32,5 @@ else
# We are booting from the SD card.
setenv mmcroot /dev/mmcblk${mmcbootdev}p2
fi
setenv extra_bootargs fbcon=logo-pos:center ${extra_bootargs}
dboot linux mmc ${mmcbootdev}:${mmcpart}

View File

@ -62,4 +62,5 @@ else
# We are booting from the SD card.
setenv mmcroot /dev/mmcblk${mmcbootdev}p2
fi
setenv extra_bootargs fbcon=logo-pos:center ${extra_bootargs}
dboot linux mmc ${mmcbootdev}:${mmcpart}

View File

@ -26,4 +26,5 @@ if test "${mtdbootpart}" = "recovery"; then
else
true
fi
setenv extra_bootargs fbcon=logo-pos:center ${extra_bootargs}
dboot linux nand ${mtdbootpart}

View File

@ -26,4 +26,5 @@ if test "${mtdbootpart}" = "recovery"; then
else
true
fi
setenv extra_bootargs fbcon=logo-pos:center ${extra_bootargs}
dboot linux nand ${mtdbootpart}

View File

@ -47,4 +47,5 @@ else
# We are booting from the SD card.
setenv mmcroot /dev/mmcblk${mmcbootdev}p2
fi
setenv extra_bootargs fbcon=logo-pos:center ${extra_bootargs}
dboot linux mmc ${mmcbootdev}:${mmcpart}

View File

@ -8,4 +8,4 @@ DEPENDS += "flex-native bison-native"
SRCBRANCH = "v2019.04/master"
SRCREV = "${AUTOREV}"
COMPATIBLE_MACHINE = "(ccimx8x)"
COMPATIBLE_MACHINE = "(ccimx8x)"

View File

@ -1,4 +0,0 @@
# Copyright (C) 2020 Digi International.
# wireless-regdb-static conflicts with wireless-regdb required by crda
RDEPENDS_packagegroup-base-wifi_remove = "wireless-regdb-static"

View File

@ -8,13 +8,13 @@ PKGNAME = "mca_tool"
# ARM tarball
SRC_URI_arm = "${DIGI_PKG_SRC}/${PKGNAME}-${PV}-${TUNE_ARCH}.tar.gz;name=arm"
SRC_URI[arm.md5sum] = "2007a858cd8f82ae2ddbff43f437335a"
SRC_URI[arm.sha256sum] = "d9a0c1ca1c9f20041602edd585c31bd79b75bc8d8a74648d1809350e731af3d5"
SRC_URI[arm.md5sum] = "2b2ce463139be67bd9929c7ce145ae42"
SRC_URI[arm.sha256sum] = "2a241dbaad099cf2d526eff6bbfdbd7c548e4391cc6751bb9eaa22d16c3cd5e4"
# AARCH64 tarball
SRC_URI_aarch64 = "${DIGI_PKG_SRC}/${PKGNAME}-${PV}-${TUNE_ARCH}.tar.gz;name=aarch64"
SRC_URI[aarch64.md5sum] = "600451f7312a130c63f3b3b5c7abdbb6"
SRC_URI[aarch64.sha256sum] = "1acc7498943662e7e5bd26a67d2733a4814823170ba0756313459cb0e68e6e5f"
SRC_URI[aarch64.md5sum] = "c5f235c29fd663fde135095016daed4f"
SRC_URI[aarch64.sha256sum] = "9a0fd1bb053d9be0ede344ba22b0811528547130ef6c78432548a27dcd8f460c"
S = "${WORKDIR}/${PKGNAME}-${PV}"

View File

@ -1,7 +1,7 @@
#!/bin/sh
#===============================================================================
#
# trustfence-sign-kernel.sh
# trustfence-sign-artifact.sh
#
# Copyright (C) 2016-2020 by Digi International Inc.
# All rights reserved.
@ -12,10 +12,11 @@
#
#
# Description:
# Script for building signed and encrypted kernel uImages using NXP CST.
# Script for building signed and encrypted artifacts using NXP CST.
#
# The following environment variables define the script behaviour:
# CONFIG_SIGN_KEYS_PATH: (mandatory) path to the CST folder by NXP with keys generated.
# CONFIG_SIGN_MODE: (mandatory) Signing method: HAB/AHAB
# CONFIG_KEY_INDEX: (optional) key index to use for signing. Default is 0.
# CONFIG_DEK_PATH: (optional) Path to keyfile. Define it to generate
# encrypted images
@ -32,12 +33,13 @@ done
SCRIPT_NAME="$(basename ${0})"
SCRIPT_PATH="$(cd $(dirname ${0}) && pwd)"
while getopts "bdilp:" c; do
while getopts "bdilop:" c; do
case "${c}" in
b) ARTIFACT_BOOTSCRIPT="y";;
d) ARTIFACT_DTB="y";;
i) ARTIFACT_INITRAMFS="y";;
l) ARTIFACT_KERNEL="y";;
o) ARTIFACT_DTB_OVERLAY="y";;
p) PLATFORM="${OPTARG}";;
esac
done
@ -51,10 +53,11 @@ Usage: ${SCRIPT_NAME} [OPTIONS] input-unsigned-image output-signed-image
-p <platform> select platform for the project
-b sign/encrypt bootscript
-d sign/encrypt DTB
-o sign/encrypt DTB overlay
-i sign/encrypt initramfs
-l sign/encrypt Linux image
Supported platforms: ccimx6, ccimx6ul, ccimx8x
Supported platforms: ccimx6, ccimx6ul, ccimx8x, ccimx8mn
EOF
}
@ -67,13 +70,6 @@ fi
UIMAGE_PATH="$(readlink -e ${1})"
TARGET="$(readlink -m ${2})"
# Negative offset with respect to CONFIG_RAM_START in which U-Boot
# copies the DEK blob.
if [ "${CONFIG_SIGN_MODE}" = "HAB" ]; then
DEK_BLOB_OFFSET="0x100"
CONFIG_CSF_SIZE="0x4000"
fi
# Read user configuration file (if used)
[ -f .config ] && . ./.config
@ -82,8 +78,54 @@ if [ -z "${CONFIG_SIGN_KEYS_PATH}" ]; then
exit 1
fi
[ -d "${CONFIG_SIGN_KEYS_PATH}" ] || mkdir "${CONFIG_SIGN_KEYS_PATH}"
if [ -z "${CONFIG_SIGN_MODE}" ]; then
echo "Undefined CONFIG_SIGN_MODE";
exit 1
fi
# Get RAM_START address
if [ "${PLATFORM}" = "ccimx6" ]; then
CONFIG_FDT_LOADADDR="0x18000000"
CONFIG_RAMDISK_LOADADDR="0x19000000"
CONFIG_KERNEL_LOADADDR="0x12000000"
CONFIG_CSF_SIZE="0x4000"
elif [ "${PLATFORM}" = "ccimx6ul" ]; then
CONFIG_FDT_LOADADDR="0x83000000"
CONFIG_RAMDISK_LOADADDR="0x83800000"
CONFIG_KERNEL_LOADADDR="0x80800000"
CONFIG_CSF_SIZE="0x4000"
elif [ "${PLATFORM}" = "ccimx8x" ]; then
CONFIG_FDT_LOADADDR="0x82000000"
CONFIG_RAMDISK_LOADADDR="0x82100000"
CONFIG_KERNEL_LOADADDR="0x80280000"
elif [ "${PLATFORM}" = "ccimx8mn" ]; then
CONFIG_FDT_LOADADDR="0x43000000"
CONFIG_RAMDISK_LOADADDR="0x43800000"
CONFIG_KERNEL_LOADADDR="0x40480000"
CONFIG_CSF_SIZE="0x2000"
else
echo "Invalid platform: ${PLATFORM}"
echo "Supported platforms: ccimx6, ccimx6ul, ccimx8x, ccimx8mn"
exit 1
fi
[ "${ARTIFACT_DTB}" = "y" ] && CONFIG_RAM_START="${CONFIG_FDT_LOADADDR}"
[ "${ARTIFACT_INITRAMFS}" = "y" ] && CONFIG_RAM_START="${CONFIG_RAMDISK_LOADADDR}"
[ "${ARTIFACT_KERNEL}" = "y" ] && CONFIG_RAM_START="${CONFIG_KERNEL_LOADADDR}"
# bootscripts are loaded to $loadaddr, just like the kernel
[ "${ARTIFACT_BOOTSCRIPT}" = "y" ] && CONFIG_RAM_START="${CONFIG_KERNEL_LOADADDR}"
# DTB overlays are loaded to $initrd_addr, just like the ramdisk
[ "${ARTIFACT_DTB_OVERLAY}" = "y" ] && CONFIG_RAM_START="${CONFIG_RAMDISK_LOADADDR}"
if [ -z "${CONFIG_RAM_START}" ]; then
echo "Specify the type of image to process (-b, -i, -d, -l, or -o)"
exit 1
fi
if [ "${CONFIG_SIGN_MODE}" = "HAB" ]; then
# Negative offset with respect to CONFIG_RAM_START in which U-Boot
# copies the DEK blob.
DEK_BLOB_OFFSET="0x100"
if [ -n "${CONFIG_DEK_PATH}" ]; then
if [ ! -f "${CONFIG_DEK_PATH}" ]; then
echo "DEK not found. Generating random 256 bit DEK."
@ -97,31 +139,6 @@ if [ "${CONFIG_SIGN_MODE}" = "HAB" ]; then
fi
ENCRYPT="true"
fi
if [ "${PLATFORM}" = "ccimx6" ]; then
CONFIG_FDT_LOADADDR="0x18000000"
CONFIG_RAMDISK_LOADADDR="0x19000000"
CONFIG_KERNEL_LOADADDR="0x12000000"
elif [ "${PLATFORM}" = "ccimx6ul" ]; then
CONFIG_FDT_LOADADDR="0x83000000"
CONFIG_RAMDISK_LOADADDR="0x83800000"
CONFIG_KERNEL_LOADADDR="0x80800000"
else
echo "Invalid platform: ${PLATFORM}"
echo "Supported platforms: ccimx6, ccimx6ul"
exit 1
fi
[ "${ARTIFACT_DTB}" = "y" ] && CONFIG_RAM_START="${CONFIG_FDT_LOADADDR}"
[ "${ARTIFACT_INITRAMFS}" = "y" ] && CONFIG_RAM_START="${CONFIG_RAMDISK_LOADADDR}"
[ "${ARTIFACT_KERNEL}" = "y" ] && CONFIG_RAM_START="${CONFIG_KERNEL_LOADADDR}"
# bootscripts are loaded to $loadaddr, just like the kernel
[ "${ARTIFACT_BOOTSCRIPT}" = "y" ] && CONFIG_RAM_START="${CONFIG_KERNEL_LOADADDR}"
if [ -z "${CONFIG_RAM_START}" ]; then
echo "Specify the type of image to process (-b, -i, -d, or -l)"
exit 1
fi
fi
# Default values
@ -166,6 +183,22 @@ elif [ "${CONFIG_SIGN_MODE}" = "AHAB" ]; then
fi
fi
LINUX64_MAGIC="0x644d5241"
get_image_size()
{
# Check if LINUX_ARM64 image magic number is found
magic_number="$(hexdump -n 4 -s 56 -e '/4 "0x%08x\t" "\n"' ${UIMAGE_PATH})"
if [ ${magic_number} = "${LINUX64_MAGIC}" ]; then
# LINUX_ARM64, read the size from the file header
image_size="$(hexdump -n 4 -s 16 -e '/4 "0x%08x\t" "\n"' ${UIMAGE_PATH})"
else
# Unknown image type, return the actual filesize
image_size="$(stat -L -c %s ${UIMAGE_PATH})"
fi
echo ${image_size}
}
SRK_TABLE="$(pwd)/SRK_table.bin"
if [ "${CONFIG_SIGN_MODE}" = "HAB" ]; then
HAB_VER="hab_ver 4"
@ -179,7 +212,7 @@ if [ "${CONFIG_SIGN_MODE}" = "HAB" ]; then
dek_blob_offset="$((CONFIG_KERNEL_LOADADDR - DEK_BLOB_OFFSET))"
# Compute the layout: sizes and offsets.
uimage_size="$(stat -L -c %s ${UIMAGE_PATH})"
uimage_size="$(get_image_size)"
uimage_offset="0x0"
pad_len="$(((uimage_size + 0x1000 - 1) & ~(0x1000 - 1)))"
auth_len="$((pad_len + 0x20))"
@ -245,12 +278,15 @@ else
# Other constants
KERNEL_START_OFFSET="0x0"
KERNEL_SIG_BLOCK_OFFSET="0x90"
KERNEL_NAME="${1}"
HAB_VER="ahab"
DIGEST="sign_digest"
DIGEST_ALGO="sha512"
# Prepare the image container
mkimage_imx8 -soc "QX" -rev "B0" -c -ap ${UIMAGE_PATH} a35 ${CONFIG_RAM_START} -out temp-mkimg
KERNEL_NAME="$(readlink -e temp-mkimg)"
# Compute the layout: sizes and offsets.
container_header_offset="${KERNEL_START_OFFSET}"
signature_block_offset="${KERNEL_SIG_BLOCK_OFFSET}"
@ -309,6 +345,7 @@ if [ "${CONFIG_SIGN_MODE}" = "HAB" ]; then
objcopy -I binary -O binary --pad-to "${sig_len}" --gap-fill="${GAP_FILLER}" "${TARGET}"
else
# Sign the image
CURRENT_PATH="$(pwd)"
cst -o "${TARGET}" -i "${CURRENT_PATH}/csf_descriptor" >/dev/null
if [ $? -ne 0 ]; then
@ -319,4 +356,4 @@ fi
[ "${ENCRYPT}" = "true" ] && ENCRYPTED_MSG="and encrypted "
echo "Signed ${ENCRYPTED_MSG}image ready: ${TARGET}"
rm -f "${SRK_TABLE}" csf_descriptor csf.bin 2> /dev/null
rm -f "${SRK_TABLE}" csf_descriptor csf.bin temp-mkimg 2> /dev/null

View File

@ -16,10 +16,10 @@ UBOOT_GIT_URI ?= "${@oe.utils.conditional('DIGI_INTERNAL_GIT', '1' , '${DIGI_GIT
SRC_URI = " \
${UBOOT_GIT_URI};branch=${SRCBRANCH} \
file://trustfence-sign-kernel.sh;name=kernel-script \
file://sign_hab;name=kernel-sign \
file://encrypt_hab;name=kernel-encrypt \
file://sign_ahab;name=kernel-sign \
file://trustfence-sign-artifact.sh;name=artifact-sign-script \
file://sign_hab;name=artifact-hab-sign \
file://encrypt_hab;name=artifact-hab-encrypt \
file://sign_ahab;name=artifact-ahab-sign \
"
do_configure[noexec] = "1"
@ -36,7 +36,7 @@ do_install() {
bberror "Unkown TRUSTFENCE_SIGN_MODE value"
exit 1
fi
install -m 0755 trustfence-sign-kernel.sh ${D}${bindir}/
install -m 0755 trustfence-sign-artifact.sh ${D}${bindir}/
install -m 0755 git/scripts/csf_templates/* ${D}${bindir}/csf_templates
# Select U-Boot sign script depending on U-Boot including an SPL image

View File

@ -25,49 +25,41 @@ trustfence_sign() {
[ -n "${TRUSTFENCE_SIGN_MODE}" ] && export CONFIG_SIGN_MODE="${TRUSTFENCE_SIGN_MODE}"
# Sign/encrypt the kernel images
if [ "${TRUSTFENCE_SIGN_MODE}" = "HAB" ]; then
for type in ${KERNEL_IMAGETYPES}; do
KERNEL_IMAGE="${type}-${KERNEL_IMAGE_NAME}.bin"
TMP_KERNEL_IMAGE_SIGNED="$(mktemp ${KERNEL_IMAGE}-signed.XXXXXX)"
trustfence-sign-kernel.sh -p "${DIGI_FAMILY}" -l "${KERNEL_IMAGE}" "${TMP_KERNEL_IMAGE_SIGNED}"
mv "${TMP_KERNEL_IMAGE_SIGNED}" "${KERNEL_IMAGE}"
done
for type in ${KERNEL_IMAGETYPES}; do
KERNEL_IMAGE="${type}-${KERNEL_IMAGE_NAME}.bin"
if [ "${type}" = "Image.gz" ]; then
# Sign the uncompressed Image
KERNEL_IMAGE=${WORKDIR}/build/arch/arm64/boot/Image
fi
# Sign/encrypt the device tree blobs
for DTB in ${KERNEL_DEVICETREE}; do
DTB=`normalize_dtb "${DTB}"`
DTB_EXT=${DTB##*.}
DTB_BASE_NAME=`basename ${DTB} ."${DTB_EXT}"`
DTB_IMAGE="${DTB_BASE_NAME}-${KERNEL_IMAGE_NAME}.${DTB_EXT}"
TMP_DTB_IMAGE_SIGNED="$(mktemp ${DTB_IMAGE}-signed.XXXXXX)"
trustfence-sign-kernel.sh -p "${DIGI_FAMILY}" -d "${DTB_IMAGE}" "${TMP_DTB_IMAGE_SIGNED}"
mv "${TMP_DTB_IMAGE_SIGNED}" "${DTB_IMAGE}"
done
elif [ "${TRUSTFENCE_SIGN_MODE}" = "AHAB" ]; then
# Sign the kernel images
for type in ${KERNEL_IMAGETYPES}; do
KERNEL_IMAGE="${type}-${KERNEL_IMAGE_NAME}.bin"
mkimage_imx8 -soc ${MX8_SOC_VAR} -rev ${MX8_CHIP_REV} -c -ap ${WORKDIR}/build/arch/arm64/boot/Image a35 ${RAM_CONTAINER_LOC_BOOT} -out flash_os.bin
trustfence-sign-kernel.sh -p "${DIGI_FAMILY}" -l "flash_os.bin" "${type}-${MACHINE}-signed.bin"
gzip ${type}-${MACHINE}-signed.bin
mv ${type}-${MACHINE}-signed.bin.gz "${KERNEL_IMAGE}"
done
TMP_KERNEL_IMAGE_SIGNED="$(mktemp ${KERNEL_IMAGE}-signed.XXXXXX)"
trustfence-sign-artifact.sh -p "${DIGI_FAMILY}" -l "${KERNEL_IMAGE}" "${TMP_KERNEL_IMAGE_SIGNED}"
# Sign/encrypt the device tree blobs
for DTB in ${KERNEL_DEVICETREE}; do
DTB=`normalize_dtb "${DTB}"`
DTB_EXT=${DTB##*.}
DTB_BASE_NAME=`basename ${DTB} ."${DTB_EXT}"`
DTB_IMAGE="${DTB_BASE_NAME}-${KERNEL_IMAGE_NAME}.${DTB_EXT}"
mkimage_imx8 -soc ${MX8_SOC_VAR} -rev ${MX8_CHIP_REV} -c -ap ${DTB_IMAGE} a35 ${RAM_CONTAINER_LOC_DTB} -out ${DTB_IMAGE}-mkimg-signed
trustfence-sign-kernel.sh -p "${DIGI_FAMILY}" -d "${DTB_IMAGE}-mkimg-signed" "${DTB_IMAGE}-signed"
mv "${DTB_IMAGE}-signed" "${DTB_IMAGE}"
rm -f ${DTB_IMAGE}-mkimg-signed
done
else
bberror "Unkown TRUSTFENCE_SIGN_MODE value"
exit 1
fi
if [ "${type}" = "Image.gz" ]; then
# Compress the signed Image and restore the original filename
gzip "${TMP_KERNEL_IMAGE_SIGNED}"
mv "${TMP_KERNEL_IMAGE_SIGNED}.gz" "${TMP_KERNEL_IMAGE_SIGNED}"
KERNEL_IMAGE="${type}-${KERNEL_IMAGE_NAME}.bin"
fi
mv "${TMP_KERNEL_IMAGE_SIGNED}" "${KERNEL_IMAGE}"
done
# Sign/encrypt the device tree blobs
for DTB in ${KERNEL_DEVICETREE}; do
DTB=`normalize_dtb "${DTB}"`
DTB_EXT=${DTB##*.}
DTB_BASE_NAME=`basename ${DTB} ."${DTB_EXT}"`
DTB_IMAGE="${DTB_BASE_NAME}-${KERNEL_IMAGE_NAME}.${DTB_EXT}"
TMP_DTB_IMAGE_SIGNED="$(mktemp ${DTB_IMAGE}-signed.XXXXXX)"
if [ "${DTB_EXT}" = "dtbo" ]; then
trustfence-sign-artifact.sh -p "${DIGI_FAMILY}" -o "${DTB_IMAGE}" "${TMP_DTB_IMAGE_SIGNED}"
else
trustfence-sign-artifact.sh -p "${DIGI_FAMILY}" -d "${DTB_IMAGE}" "${TMP_DTB_IMAGE_SIGNED}"
fi
mv "${TMP_DTB_IMAGE_SIGNED}" "${DTB_IMAGE}"
done
}
trustfence_sign[dirs] = "${DEPLOYDIR}"

View File

@ -7,12 +7,14 @@ PACKAGE_ARCH = "${MACHINE_ARCH}"
inherit packagegroup
RDEPENDS_${PN} = "\
crda \
hostapd \
iw \
wireless-regdb-static \
wpa-supplicant \
wpa-supplicant-cli \
wpa-supplicant-passphrase \
"
RDEPENDS_${PN}_remove_ccimx6sbc = "hostapd"
RDEPENDS_${PN}_remove_ccimx6 = "wireless-regdb-static"
RDEPENDS_${PN}_append_ccimx6 = " crda"

View File

@ -374,17 +374,14 @@ mount -t sysfs sysfs /sys
mount -t devtmpfs devtmpfs /dev
mount -t tmpfs tmpfs /tmp
# Register mdev as device manager
if [ -f /proc/sys/kernel/hotplug ]; then
echo > /dev/mdev.seq
echo > /dev/mdev.log
echo "/sbin/mdev" > /proc/sys/kernel/hotplug
mdev -s
fi
# Give some time for the devices to settle down
# Give some time for the devices to settle down so mdev can mount all of them
sleep 2
# Register mdev as device manager
echo > /dev/mdev.seq
echo > /dev/mdev.log
mdev -s
# Run all shell scripts in postinstall folder
run-parts /etc/*-postinsts

View File

@ -1,4 +1,4 @@
require recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.16.1.bb
require recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.16.2.bb
DEPENDS += "jpeg libdrm"
DEPENDS_append_imxgpu2d = " virtual/libg2d"

View File

@ -1,4 +1,4 @@
require recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.16.1.bb
require recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.16.2.bb
PV = "1.16.0.imx"

View File

@ -1,4 +1,4 @@
require recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.16.1.bb
require recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.16.2.bb
PV = "1.16.0.imx"

View File

@ -1,4 +1,4 @@
require recipes-multimedia/gstreamer/gstreamer1.0_1.16.1.bb
require recipes-multimedia/gstreamer/gstreamer1.0_1.16.2.bb
PV = "1.16.0.imx"

View File

@ -1,4 +1,4 @@
require recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.16.1.bb
require recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.16.2.bb
FILESEXTRAPATHS_prepend := "${COREBASE}/meta/recipes-multimedia/gstreamer/files:"

View File

@ -14,14 +14,6 @@ IMX_BACKEND = \
SRC_URI_append = " \
file://qt5-${IMX_BACKEND}.sh \
"
# Technically, we should add the following patches to imxgpu platforms, but
# doing so duplicates them for imxgpu2d platforms and causes build errors.
# As of now, the only SoC that is imxgpu and not imxgpu2d is the i.MX8MN, so
# append the patches to that SoC only.
SRC_URI_append_mx8mn = " \
file://0014-Add-IMX-GPU-support.patch \
file://0001-egl.prf-Fix-build-error-when-egl-headers-need-platfo.patch \
"
SRC_URI_append_imxgpu3d = " \
${@bb.utils.contains('DISTRO_FEATURES', 'x11', \
'', \

View File

@ -1,26 +0,0 @@
SUMMARY = "Library for using PKCS"
DESCRIPTION = "\
Libp11 is a library implementing a small layer on top of PKCS \
make using PKCS"
HOMEPAGE = "https://github.com/OpenSC/libp11"
BUGTRACKER = "https://github.com/OpenSC/libp11/issues"
SECTION = "Development/Libraries"
LICENSE = "LGPLv2+"
LIC_FILES_CHKSUM = "file://COPYING;md5=fad9b3332be894bab9bc501572864b29"
DEPENDS = "libtool openssl"
SRC_URI = "git://github.com/OpenSC/libp11.git"
SRCREV = "973d31f3f58d5549ddd8b1f822ce8f72186f9d68"
S = "${WORKDIR}/git"
inherit autotools pkgconfig
EXTRA_OECONF = "--disable-static"
do_install_append () {
rm -rf ${D}${docdir}/${BPN}
}
FILES_${PN} += "${libdir}/engines*/pkcs11.so"
FILES_${PN}-dev += "${libdir}/engines*/libpkcs11${SOLIBSDEV}"

View File

@ -186,7 +186,7 @@ _EOF_
YOCTO_IMGS_DIR="${WORKSPACE}/images"
YOCTO_INST_DIR="${WORKSPACE}/digi-yocto-sdk.$(echo ${DY_REVISION} | tr '/' '_')"
YOCTO_DOWNLOAD_DIR="${WORKSPACE}/downloads"
YOCTO_DOWNLOAD_DIR="${DY_DOWNLOADS:-${WORKSPACE}}/downloads"
YOCTO_PROJ_DIR="${WORKSPACE}/projects"
CPUS="$(grep -c processor /proc/cpuinfo)"