By default, on closed devices you cannot revoke any key. To do so, it is
required to compile a U-Boot which instructs the HAB not to set the sticky
bit which write protects that field in the OCOTP controller.
This patch introduces a Yocto macro which allows to configure U-Boot in
that way.
In the ConnectCore 6, the value of this settings is ignored, because HAB never
sets the sticky bit which write protects that field.
https://jira.digi.com/browse/DUB-665
Signed-off-by: Diaz de Grenu, Jose <Jose.DiazdeGrenu@digi.com>
While performing usability testing on the TrustFence documentation, it has
been noted that in order to follow the secure boot instructions the
console needs to be enabled.
We have now moved the secure console section to the end of the
documentation so that disabling the console is the last configuration to
make in a secure system.
Signed-off-by: Alex Gonzalez <alex.gonzalez@digi.com>
When Trustfence is enabled, this adds a dependence on the TF initramfs,
so it's built and added to the boot image.
It also modifies the u-boot boot script on the fly, to boot correctly
using the Trustfence initramfs.
https://jira.digi.com/browse/DEL-2278
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
The TRUSTFENCE_UBOOT_DEK_SIZE Yocto macro maps to the UBOOT_DEK_SIZE U-Boot
Kconfig entry, which is defined as a choice entry. This makes necessary
to explicitly define the choice Kconfig entry for the configuration to
work.
Signed-off-by: Diaz de Grenu, Jose <Jose.DiazdeGrenu@digi.com>
There are several possible values for TRUSTFENCE_UBOOT_ENV_DEK:
* Not defined: if the trustfence support is not included.
Should not include the feature.
* 32 characters: when defining a valid key.
Should include the feature.
* "0": when explicitly disabling the feature.
Should not include the feature
* <other>: Invalid value, should trigger the error.
This commits fixes the logic so that 'None' (no defined) is taken as a valid
value.
Signed-off-by: Diaz de Grenu, Jose <Jose.DiazdeGrenu@digi.com>
This commit changes the CONFIG_CCIMX6SBC_CONSOLE_ENABLE_GPIO_NR define
into a platform independent setting.
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
https://jira.digi.com/browse/DEL-2641
https://jira.digi.com/browse/DEL-2603
Signed-off-by: Alex Gonzalez <alex.gonzalez@digi.com>
Signed-off-by: Jose Diaz de Grenu de Pedro <Jose.DiazdeGrenudePedro@digi.com>
Implement the set of TRUSTFENCE_ macros to configure each secure boot feature
available in U-Boot.
https://jira.digi.com/browse/DUB-570
Signed-off-by: Jose Diaz de Grenu de Pedro <Jose.DiazdeGrenudePedro@digi.com>
This commit adds a trustfence class to encapsulate all trustfence
configurations.
https://jira.digi.com/browse/DEL-2257
Signed-off-by: Alex Gonzalez <alex.gonzalez@digi.com>
The meta-qt5 layer provides a 'populate_sdk_qt5' class with all what's
needed to build a SDK based on an image recipe.
Inherit the class here so it's available for all DEY image recipes
depending on 'dey-qt' image feature.
https://jira.digi.com/browse/DEL-1973
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
This was used just for SARES testing and according to the SA team it is
not needed anymore, so just remove it.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
This simplifies the code and as an extra allows to override the default
root password from the project's local.conf (setting MD5_ROOT_PASSWD
variable)
https://jira.digi.com/browse/DEL-1558
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Poky added a new class that provides the same functionality we
implemented in our 'dey-image' class. So just use that class instead
of reimplementing it in our layer.
https://jira.digi.com/browse/DEL-1558
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Remove 'dey-test' image feature and create a SARES bbclass with the
same functionality. This makes easier the creation of images suitable
for SARES testing just adding:
INHERIT += "sares-image"
to your project's local.conf
https://jira.digi.com/browse/DEL-1558
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
After the upstream commit in d63c8a1597c9bd0a838cb59ca461ac432b630a90,
bitbake checks to see if the image feature has a valid packagegroup
associated.
For this check to work dey features need to be defined for all images,
not only dey images, so the definitions need to move to the distro
configuration file.
https://jira.digi.com/browse/DEL-852
Signed-off-by: Alex Gonzalez <alex.gonzalez@digi.com>
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
SERIAL_CONSOLE variable has been deprecated in poky. The new
SERIAL_CONSOLES allows to configure multiple devices.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
The final product will be called "Digi Embedded for Yocto" or DEY for
short.
This commit renames all relevant files.
https://jira.digi.com/browse/DEL-474
Signed-off-by: Alex Gonzalez <alex.gonzalez@digi.com>
Diaz de Grenu, Jose
Alex Gonzalez
Javier Viguera
Mike Engel
Jose Diaz de Grenu de Pedro