This commit enables SWU image authentication when TrustFence
is enabled instead of when signing of images is enabled.
This allows the system to authenticate SWU images on images that
have been externally signed.
https://onedigi.atlassian.net/browse/DEL-8891
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
This commits adds the CCMX91 platform to the DEY
build system. Furthermore, it creates generic ccimx9
support to be used for the CCiMX91 and CCiMX93
platform.
https://onedigi.atlassian.net/browse/DEL-9106
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
There is a harmless error when restoring alsa profiles, as it also
attempts to restore UCM profiles.
Since we do not include UCM profiles for our sound cards, skip it.
https://onedigi.atlassian.net/browse/DEL-9066
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
In legacy NAND platforms like the ccimx6ul, it's possible to use a single-MTD
configuration with dualboot disabled, which allows access to the functionality
provided by the recovery partition. However, the partition encryption feature
requires a multi-MTD configuation, so said feature shouldn't be accessible in
this case.
Prevent access to partition encryption in a single-MTD system by:
* Adding the "system" partition to the partition blacklist in both the
recovery-utils library and the recovery initscript.
* Checking the "singlemtdsys" environment variable before using any
functionality related to partition encryption.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
Currently, when wiping the update volume via the recovery partition on a
ccimx6ul with singlemtdsys enabled, the procedure fails with this error:
[RECOVERY] Starting recovery...
[RECOVERY] Wipe 'update' partition requested
[RECOVERY] Formatting 'update' ubi volume
ubi0 error: ubi_open_volume.part.0: cannot open device 0, volume 3, error -16
ubiupdatevol: error!: cannot open "/dev/ubi0_3"
error 16 (Device or resource busy)
This is because the logic used to unmount a volume before formatting it is
expecting this entry format when running "mount":
ubi0:update on /mnt/update type ubifs
While this is the format of the "mount" output in userspace for the rootfs
volume, other trivial volumes have this format instead:
ubi0_3 on /mnt/update type ubifs
Adapt the logic to this format so that the "update" volume wipe procedure can
take place.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
Add also 'e2fsprogs-tune2fs' to the image, as busybox's version of
tune2fs command does not support setting the "encrypt" feature of the
EXT4 filesystem.
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
On new platforms, trustfence will use file-based encryption instead of
full-disk encryption. Add base variables and platform defaults to allow
implementing file-based encryption.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Encrypting boot artifacts impacts the device's boot time, so disable them
by default. It is still possible to enable it in the project's config
file by setting the TRUSTFENCE_DEK_PATH option.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Unlike the rest of the NXP platforms, in u-boot, the ccimx93 allows
configuring a GPIO name to activate the console when secure console is
enabled. Those u-boot options were not translated to the trustfence code
in meta-digi.
https://onedigi.atlassian.net/browse/DEL-9063
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
This commit adds some basic TSN support to DEY.
It includes the kernel configuration fragment with
the IEEE 802.1 support and the some user space tools
necessary to configure the network.
https://onedigi.atlassian.net/browse/DEL-9026
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
This commit adds real time test tools to the system.
The hwlatedetct is a program that controls the kernel
hardware latency detector module. This is used to detect
large system latencies independent of Linux itself.
The rt-tests package is a test suite that includes the cyclictest
tool to measure the difference between a thread's intended
wake-up time and the time at which it actually wakes up.
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
Rework commit c5c9838e54 to only limit ML
packages for our ccimx93 and not for other imx93-based devices.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Trustfence class was setting the TRUSTFENCE_PASSWORD_FILE variable using the
old keys format where a unique key_pass.txt file contains all the key
passwords. However, in the new format there are one key_pass file for each
key, so using a PKI tree with the new format throws an unexpected error in the
FIP generation due to it is not able to find the required key password.
This commit sets the TRUSTFENCE_PASSWORD_FILE variable for the ccmp1 platforms
on different way.
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
Add a check on the existence of the "temp-fitimg-loaded" environment
variable before setting it. It is needed, as with encrypted FIT images,
we need to decrypt them before accessing the boot script. In such cases,
u-boot sets that variable to "no" so the boot script does not override it,
and the FIT image is loaded again before the final boot to the OS.
https://onedigi.atlassian.net/browse/DEL-8945
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
This patch fixes the hang issue with EiQ demos using multiple tflite files,
for instance the gesture_detection demo.
https://onedigi.atlassian.net/browse/DEL-8949
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
This recipe is not supported anymore. If you need to add that package
for aarch64, a solution is include pip3 in your image and install it
using the pip3 install manager.
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
Trustfence class was setting the TRUSTFENCE_PASSWORD_FILE variable using the
old keys format where a unique key_pass.txt file contains all the key
passwords. However, in the new format there are one key_pass file for each
key, so using a PKI tree with the new format throws an unexpected error in the
FIP generation due to it is not able to find the required key password.
This commit sets the TRUSTFENCE_PASSWORD_FILE variable for the ccmp1 platforms
on different way.
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
Different mechanisms are used to sign FIT images on the ccmp1 platforms and the
ccimx93, and we manage each mechanism via a different variable. The variable
names don't really reflect which platform they affect, which makes maintenance
harder.
Rename the variables so that it's easier to identify the platforms/vendors they
affect:
* Replace TRUSTFENCE_FIT_IMG with TRUSTFENCE_SIGN_FIT_STM
* Replace TRUSTFENCE_SIGN_FIT_ARTIFACT with TRUSTFENCE_SIGN_FIT_NXP
Don't rename TRUSTFENCE_FIT_IMG_SIGN_KEYNAME
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
We rely on FIT support to implement boot artifact authentication on ccmp1
platforms, but our implementation made it impossible to enable FIT support
outside of the context of Trustfence/secure boot.
Change this so that it's possible to enable FIT support without having to sign
the FIT artifacts. Also, modify the linux-dey 5.15 recipe so that the U-Boot
DTBs with signatures get copied only when FIT signing is enabled.
https://onedigi.atlassian.net/browse/DEL-8946
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
This commit updates the required firmware binaries for Bluetooth and Wireless
interfaces, hostapd and wpa_supplicant recipes based on the Cypress Linux WiFi
Driver (FMAC) release v5.15.58-2023_1128 (Wireless firmware v13.10.246.334).
This change also includes a custom defconfig file for the hostapd and
wpa_supplicant recipes including the changes from the patches and the Digi
customizations.
Also are updated the Murata firmware repositories to match with the latest
Murata release imx-kirkstone-hedorah_r1.0, which is based in the same Cypress
Linux Wifi Driver release v5.15.58-2023_1128.
https://onedigi.atlassian.net/browse/DEL-8667
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
Not installing all the ML packages but just tensorflow-lite saves space.
We are not including onnxruntime and torchvision, which are not supported
by the i.mx93 (see NXP user guide for details).
The ext4.gz size is decreased from 430MB to 217MB.
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
The patch we were using comes from the time during dualboot support development
where said feature was selectable at build time. The patch adds a new build
option, giving the impression that it only gets enabled under certain
circumstances, when in reality:
* The option is never enabled anywhere in our code
* It's a string option that is treated like a boolean, meaning its
respective conditional compilation is always getting compiled even when
disabled
Our current dualboot support is enabled at runtime, so it doesn't make sense to
have a build-time option related to it, especially one that's broken. Replace
the patch with a functionally equivalent one that is less confusing. Also,
remove the related config option from our defconfig.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
The current log level is very verbose and generates way too much output in some
cases, such as a binary diff update. Reduce the default log level to avoid
this.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
This commit fixes a build issue using meta-digi layer with a different distro
than "dey". Also simplified the bbappend to avoid creating a custom
do_patch_png() task before do_configure().
Reported-by: Stephan Klatt <skladd@users.noreply.github.com>
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
This reverts commit c5b53c9765.
The HCI reset interface is fixed inside each BT power calibration shell
script, so this workaround is not needed anymore.
https://onedigi.atlassian.net/browse/DEL-8458
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
for the IW61x, when the FW is instructed with an hci reset command, the
LE stack is not correctly reset.
It can be workaround-ed by SW doing a SW power cycle.
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
This is an NXP change that reverts a mainline weston commit form v9.0.0, in
which the mouse cursor only gets activated when there is mouse movement. This
change was only being included in the weston v10.0.X i.MX forks.
For platforms that don't use these weston forks (ccimx93 uses the v11.0.X fork
and ccmp15 uses mainline weston), the mouse cursor doesn't load right away when
booting the system, which causes apps that are automatically launched (such as
the LVGL demo) to not register the mouse, rendering said apps unresponsive to
it.
Port NXP's change to all of the weston versions we currently use to avoid this
problem.
https://onedigi.atlassian.net/browse/DEL-8865
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
The display for the cc93 is 'wayland-1'.
Use backslashes before the curly braces to avoid potential expansion by
bitbake variables.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
This is to avoid duplicating names with variable DEMO_DISPLAY inside
the lvgl-demo-init script itself.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
There are some cases in which the loading of the Wi-Fi modules may be
problematic due to timing conditions:
- when a suspend operation in progress is aborted
- when Bluetooth is disabled
The Wi-Fi needs some time for the system to be ready before loading the
modules.
This commit:
- Stops the Bluetooth before bringing down the Wi-Fi on suspend
- Starts the Bluetooth (or adds a small delay) before bringing up the
Wi-Fi on resume
- Reworks the way the resume operations are programmed, to do them in
reverse order (first load the Wi-Fi modules, then bring the interfaces
up (if required). It does so by appending/prepending actions into a
variable and dumping the contents finally to a temp file.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
Commit c4f2fce4d3 added logic to do_install()
that saves space by removing board image files that don't match the machine
name. However, the ccimx6qpsbc uses the ccimx6sbc board image file, and it was
being removed from the demo, breaking the demo's landing page.
Avoid this by specifying the correct filename for the ccimx6qpsbc.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
The ccimx6ul is the only platform that doesn't include a desktop backend in the
LVGL image, so remove the desktop backend suffix from the image's name. This
affects the image name itself, the corresponding SWU package and the
installation scripts.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
ccimx6ul platform uses the fbdev backend to run LVGL graphical applications,
the mouse input device is not supported by default on this platform.
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
This commit sets the default LVGL demo dimensions to match with the resolution
of the supported LVDS display, showing the application at fullscreen.
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
This commit adds a systemd service and a sysvinit script to initialize the LVGL
demo automatically on boot.
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
LVGL graphical library has support for different backends, in the case of the
ccimx6ul we use the fbdev directly, so we don't need the x11 support.
This commit removes x11 support for the ccimx6ul platform for the
dey-image-lvgl image.
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
This revision disables LVGL's wayland client-side decorations to prevent visual
glitches on some platforms and homogenize the look of the demo regardless of
platforms/backend.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
This is needed to make the LVGL demo work on the ccimx93, which uses a newer
version of weston that no longer includes wl_shell support. Restore the
wl_shell functionality via a patch and enable it.
https://onedigi.atlassian.net/browse/DEL-8849
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
The support to update U-Boot in the redundant partition must be enabled in the project
configuration file by setting the variable "SWUPDATE_UBOOTIMG_REDUNDANT" to "true":
SWUPDATE_UBOOTIMG_REDUNDANT = "true"
This feature is only available for the newer platforms: ccmp13, ccmp15 and ccimx93. Trying to
enable it in older platforms will display a warning and fallback to non-redundant update.
Signed-off-by: David Escalona <david.escalona@digi.com>
Backport of multimedia package for ccimx93 from NXP's Mickledore-based
lf-6.1.55-2.2.0 release. Mainly copies and appends of multimedia
recipes from the new release, and restricted to ccimx93 by changing the
COMPATIBLE_MACHINE, so it does not affect other platforms.
https://onedigi.atlassian.net/browse/DEL-8840
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
The JIRA in the patch description describes a problem in the CC6UL, so
do not use the patches on other platforms.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
If 'CCCS_CONF_PATH' is defined, the specified file is installed as CCCS
configuration file without any modification.
It it is not defined or it is empty, the configuration file in cc_dey
('cc_dey/cccs-daemon/cfg_files/cccs.conf') is installed and modified if
required.
Signed-off-by: Tatiana Leon <Tatiana.Leon@digi.com>
Rework the script so that it has a similar structure as the MMC leaving it ready
to integrate new platforms.
Signed-off-by: David Escalona <david.escalona@digi.com>
This variable is only required to enable the bootcount feature after an update when the bootcount value is
stored in the environment. This only happens in the CCIMX6 products, so it makes no sense to use it for the
CCMP1 devices.
Signed-off-by: David Escalona <david.escalona@digi.com>
While on it, enable support to update encrypted U-Boot for all mmc platforms
supporting it. The install script extracts the DEK blob from the installed
U-Boot and appends it to the new U-Boot before flashing it.
Signed-off-by: David Escalona <david.escalona@digi.com>
This new variable establishes the number of 1Kb blocks to skip before writing U-Boot in the
bootloader partition.
Signed-off-by: David Escalona <david.escalona@digi.com>
EGLFS is a platform plugin for running single Qt applications in full-screen
mode, without a windowing system like X11 or Wayland.
https://onedigi.atlassian.net/browse/DEL-8802
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
To work in a dualboot memory layout out of the box, the most
common use case of the firmware update through the cloud should
be on the fly because in nand platforms there is not enough
memory to keep the update file in the system.
https://onedigi.atlassian.net/browse/DEL-8305
Signed-off-by: Francisco Gil <francisco.gilmartinez@digi.com>
As part of the integration of the new ML package, also update the
ethos-u-firmware binary built from Stash:
Repo: emp/ethos_u_firmware.git
Revision: bd5506ddba364ad04602d5009b77077f78450b97
Source: NXP's MCUXpresso SDK_2.14.2_MIMX9352xxxxM
Co-authored-by: Javier Viguera <javier.viguera@digi.com>
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Backport a new version of cmake-native from Poky's mickledore release. This
is required by the new version of the onnxruntime package (updated in
the following commit).
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Our fork contains the same patches that were originally applied in this recipe.
This makes it easier for customers to identify the modifications necessary to
get LVGL working on our platforms.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
When switching off the 3.3V supply from the Wi-Fi during suspend,
around a 10% of the times, when resuming the Wi-Fi driver fails to load.
It was verified that a rebind operation over the mmc interface (which
eventually calls the script that loads the Wi-Fi module) makes it
load successfully, which denotes a timing issue during resume.
Adding a small delay on the resume operation before running the script
makes the Wi-Fi driver load at the first try.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://onedigi.atlassian.net/browse/DEL-8821
Backport of graphics package for ccimx93 from NXP's Mickledore-based
lf-6.1.55-2.2.0 release. Mainly copies and appends of graphics recipes
from the new release, and restricted to ccimx93 by changing the
COMPATIBLE_MACHINE, so it does not affect other platforms.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
We removed this package from the recovery initramfs, but it was getting added
as a recommendation to the trustfence initramfs as well.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
We use cryptsetup in both the recovery and trustfence initramfs to handle block
device encryption on platforms that use eMMC as the internal storage. In
meta-openembedded commit 1ce71d6ec31195280073adec0e400dda7c0dd8a7 (between
DEY 2.6 and 3.0), a lot of PACKAGECONFIG options were added to the cryptsetup
recipe, all of them enabled by default. One of these options is "udev", which
adds a runtime dependency with udev that in turn pulls in a lot of other
dependencies with it. This is unnecessary because we already use mdev in our
recovery image, and the other packages simply take up space as they aren't
needed at all.
Our eMMC partition encryption functionality, which is the reason why we need
cryptsetup to begin with, is unaffected by this change and still works as
expected. Keep in mind that it was working properly without udev in DEY 2.6 and
older DEY releases, so removing udev isn't an issue.
Remove this PACKAGECONFIG option to get rid of udev and its dependencies in
the recovery and trustfence initramfs.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
In theory, libcap's pam_cap module should use libpam's dlopen runtime linking
mechanism, but starting in libcap 2.53, this changed in order to support
distros that can only link it at build-time. Then, in 2.54, a compile-time
option was added (FORCELINKPAM) to allow users to force the link or not. In the
poky recipe for libcap, this option isn't set, so the library was getting
linked by default, dragging all of its dependencies with it.
For more info: https://bugzilla.kernel.org/show_bug.cgi?id=214023
Set the flag to "no" to avoid linking against libpam, removing its dependency
from the recovery image and saving some space.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
The TF-A and OP-TEE images have different suffixes depending
on whether TrustFence is enabled or not, but the suffix variables
themselves must exist independently of whether TF is enabled.
Currently, they were defined on the trustfence.bbclass, and the
variables did not exist when TF was disabled, which caused build
problems, for example, building the SWU file.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
This package is purely vestigial and hasn't been used at all in any of our
initramfs images for over 7 years. It was used in the first implementation
of the trustfence initramfs (commit 4dd7d438af)
to securely erase the key used by cryptsetup, but two weeks later, that logic
was moved to trustfence-tool (commit a8c50c16ea)
and "wipe" was no longer needed. However, the package remained in the
dependencies of the trustfence initramfs, which were then used as reference for
the recovery initramfs, even though this initramfs didn't even need "wipe" to
begin with.
Removing this package saves 30.8 KiB in the ccimx6ul recovery image.
https://onedigi.atlassian.net/browse/DEL-8819
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
This is added as a recommendation for libcrypto and only contains legacy
ciphers which are deemed outdated or unsafe. If any of the packages in the
image actually required this module, they would depend on it explicitly, but
this isn't the case. This saves 66.8 KiB on the ccimx6ul recovery image.
https://onedigi.atlassian.net/browse/DEL-8819
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
We depend on libarchive so that swupdate can perform updates with .tar.gz
files, but by default, libarchive is configured to support a lot of additional
features that pull in even more dependencies. This increases the size of the
recovery image, which barely fits on platforms with limited internal storage
like the ccimx6ul. We already removed zstd support to mitigate this, but the
image size increased again after adding imx-kobs to it in commit
aa2480d1de.
Since libarchive isn't used by any other package in our system, remove the
configurations that bloat the recovery image and are not needed at all for
our file update use case. Note that removing the "lzo" packageconfig doesn't
remove its respective library from the image because mtd-utils also depends on
it, but it still reduces the size of libarchive. On the ccimx6ul, this removes
193 KiB worth of libraries and trims libarchive down by 20.5 KiB in the
recovery image.
https://onedigi.atlassian.net/browse/DEL-8819
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
These fields were added to default files, but not to the
special sw-description files for ccmp1 and cc6ul platforms.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
When TrustFence is enabled, the boot artifacts (TFA and FIP)
have a 'signed' suffix. Handle this case so that the correct
symlinks are created and the correct artifacts are put into the
SWU file.
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
For signing SWU files we need to set a couple of variables:
- SWUPDATE_PRIVATE_KEY_TEMPLATE to the private key file
- SWUPDATE_PASSWORD_FILE to the password of the private key
The latter must only contain one password, whereas the current key_pass.txt
file had (for the ccmp13) the eight keys separated by a white space.
This commit:
- If the file key_pass.txt exists, it extracts each key into a separate
file key_pass0X.txt.
- If the keys don't exist, generates separate files per key.
- Changes the permissions of password files to 400.
- Adapts the sign script to use the single password files.
- Fixes a few quotes
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
We were using the .cfg suffix for both the build-time config fragments and the
runtime configuration file. During do_configure(), all files in SRC_URI ending
in .cfg were being merged together to create the final build configuration,
including said runtime file, which has a completely different syntax. In most
cases, the contents of this file were being ignored, but when tweaking
swupdate's configuration and re-building the package, sometimes strange errors
would prevent the build from finishing.
Change the runtime file's suffix entirely to separate it from the config
fragments and prevent it from being treated as such, and reflect the name
change in the defconfig and the recovery script.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
meta-swupdate recently added support for swupdate 2023.12 and libubootenv
0.3.5. This upgrade conflicts with our custom functionality in both packages,
so keep using 2023.05 and 0.3.2 respectively so DEY 4.0 can be built without
introducing possible functionality changes.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
meta-swupdate recently added support for swupdate 2023.12 and libubootenv
0.3.5. This upgrade conflicts with our custom functionality in both packages,
so keep using 2023.05 and 0.3.2 respectively so DEY 4.0 can be built without
introducing possible functionality changes.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
Commit 7e81e706a1 modified the logic used to
determine if a NAND is using multi-MTD or single-MTD, but single quotes were
used in the grep pattern, which prevents the variable inside from expanding.
This makes the script always enter the single-MTD code path, even in multi-MTD
systems, which breaks partition formatting in these cases.
Replace the single quotes with double quotes so the variable can expand and the
condition can be properly checked.
https://onedigi.atlassian.net/browse/DEL-8773
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
Commit 7e81e706a1 modified the logic used to
determine if a NAND is using multi-MTD or single-MTD, but single quotes were
used in the grep pattern, which prevents the variable inside from expanding.
This makes the script always enter the single-MTD code path, even in multi-MTD
systems, which breaks partition formatting in these cases.
Replace the single quotes with double quotes so the variable can expand and the
condition can be properly checked.
https://onedigi.atlassian.net/browse/DEL-8773
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
Fixed via commit 311a492c21f0f3643f4b764f8b743c4c6908d31b in meta-st-stm32mp
This reverts commit 09c4645894.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
Fixed via commit 311a492c21f0f3643f4b764f8b743c4c6908d31b in meta-st-stm32mp
This reverts commit 09c4645894.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
This commit adds u-boot swupdate support for all platforms.
Now u-boot can be updated with all our supported update
options. Currently it will only update first partition
u-boot partition.
https://onedigi.atlassian.net/browse/DEL-8749
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
The 'mtd-blacklist' parameter prevents swupdate from acting upon those
partitions that we consider sensitive.
Make such list platform-dependent.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
The swupdate recipe installs by default a systemd service
and a socket to listen for updates coming from a web server.
DEY only makes use of such service during on-the-fly updates from Cloud
Connector web service.
The default swupdate service fails on images with TrustFence because it's
called with no arguments and there doesn't exist a configuration file.
This commit installs a default configuration file and, if TrustFence is
enabled, sets the parameter 'public-key-file' to point to the public
certificate to use to authenticate SWU packages.
While on it, it removes the same file from the recovery-initramfs recipe
that was the only recipe that was adding such config file for recovery
images only.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
meta-digi layers use many conditionals basing on TRUSTFENCE_SIGN, but this
variable may be disabled when the signing process wants to be isolated
from the image creation.
There are cases when we still need to know if TrustFence is enabled even
if the images are not going to be signed.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
In commit df9b1cf329, the UBOOT_SIGN_ENABLE is set for all
platforms, and should be only added for FIT images.
This is making the process failing in cc8mn/cc8mm platforms
due to the UBOOT_SIGN_ENABLE is also used there to use a dtb
patched with the signature node.
https://onedigi.atlassian.net/browse/DEL-8764
Signed-off-by: Francisco Gil francisco.gilmartinez@digi.com
Otherwise, bitbake's git client won't be able to fetch the sources if there are
no mirrors available.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
Otherwise, bitbake's git client won't be able to fetch the sources if there are
no mirrors available.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
As part of the integration of the new ML package, also update the
ethos-u-firmware binary built from Stash:
Repo: emp/ethos_u_firmware.git
Revision: a0352b0cf7267c896b55980dedd08daddc780733
Source: NXP's MCUXpresso SDK_2.14.0_MIMX9352xxxxK
And, drop deepview-rt support for ccimx93, as NXP has done the same in
6.1.36-2.1.0 release.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
- Set variables required for FIT signing inside python function, under the
condition of having TRUSTFENCE_SIGN="1".
- Define two sign keys using TRUSTFENCE_ wrapper constants. Default values:
- 'fitcfg' for configuration nodes inside the FIT
- 'fitimg' for image nodes inside the FIT
- Enable FIT_SIGN_INDIVIDUAL to also sign individual images inside the FIT
- Set FIT_GENERATE_KEYS by default (kernel-fitimage.bbclass already checks
if the keys exist before generating new ones)
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
This change isn't functional, but necessary if we want to be able to separate
the logic in the include file and the demo recipe. This way the include file is
agnostic and can be included into other recipes if needed.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
Otherwise, launching a Qt5 app will result in errors and the QPA platform will
need to be set manually to get it to work.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
Otherwise, launching a Qt5 app will result in errors and the QPA platform will
need to be set manually to get it to work.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
Backport of graphics package for ccimx93 from NXP's Mickledore-based
6.1.36-2.1.0 release. Mainly copies and appends of graphics recipes
from the new release, and restricted to ccimx93 by changing the
COMPATIBLE_MACHINE, so it does not affect other platforms.
Notice, that the new version of weston used now by the ccimx93 requires
a different profile file (weston-socket.sh). This profile supercedes the
old 'weston.sh'.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Backport of multimedia package for ccimx93 from NXP's Mickledore-based
6.1.36-2.1.0 release. Mainly copies and appends of multimedia recipes
from the new release, and restricted to ccimx93 by changing the
COMPATIBLE_MACHINE, so it does not affect other platforms.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
This is required to build the new version of gstreamer used by NXP for
the ccimx93 and integrated in following commits.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
LVGL is a free and open-source embedded graphics library that is able to run
in environments with limited resources.
This image includes a desktop environment and an LVGL widget demo (lvgl_demo)
https://onedigi.atlassian.net/browse/DEL-8740
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
Rename the recipe to lvgl-demo to reflect the generalization and select the
most appropriate backend for each platform. Aside from making sure each backend
builds and runs fine, add some usability improvements:
* Specify the mouse as the default evdev device instead of the touchscreen
* Use common resolution variables to be able to configure the app's
dimensions easily
https://onedigi.atlassian.net/browse/DEL-8740
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
This commit adds signed FIT image support for the CCMP1
platforms when using Trustfence.
https://onedigi.atlassian.net/browse/DEL-8591
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
ConnectCore 6 based products require the use of the 'upgrade_available' environment flag to save the
bootcount value between resets. Extend the use of this U-Boot variable for single system updates and
updates based on files.
Signed-off-by: David Escalona <david.escalona@digi.com>
This package was inadvertantly pulling in a lot of dependencies into our
images that make use of Qt6. Most of these packages consisted of *-dev
packages, which are only useful for development with the SDK.
Remove this package along with its dependencies to significantly reduce the
dey-image-qt rootfs image size.
Note that this change was already done in commit
8979331ef8, but it was accidentally reverted when
upgrading to Qt 6.5 in commit a5c6f2b795.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
(cherry picked from commit 0d6d6d219f)
This package was inadvertantly pulling in a lot of dependencies into our
images that make use of Qt6. Most of these packages consisted of *-dev
packages, which are only useful for development with the SDK.
Remove this package along with its dependencies to significantly reduce the
dey-image-qt rootfs image size.
Note that this change was already done in commit
8979331ef8, but it was accidentally reverted when
upgrading to Qt 6.5 in commit a5c6f2b795.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
This fix systemd error on boot:
[ 6.974370] systemd[1]: /lib/systemd/system/connectcore-demo-example.service:3: Failed to add dependency on connectcore-demo-server, ignoring: Invalid argument
Signed-off-by: Tatiana Leon <Tatiana.Leon@digi.com>
This fix systemd error on boot:
[ 6.974370] systemd[1]: /lib/systemd/system/connectcore-demo-example.service:3: Failed to add dependency on connectcore-demo-server, ignoring: Invalid argument
Signed-off-by: Tatiana Leon <Tatiana.Leon@digi.com>
Current pattern does not match the SRKs generated for the ccimx93. The
ccimx93 does not support subordinated SGK certs, so the name of the SRKs
do not contain the "_ca_" pattern. So relax the expression used in the
trustfence bbclass to match the SRKs generated for both platforms.
# For the ccimx93
$ ls -1 crts/SRK1*crt.pem
crts/SRK1_sha512_secp521r1_v3_usr_crt.pem
# For the ccimx8x
$ ls -1 crts/SRK1*crt.pem
crts/SRK1_sha512_secp521r1_v3_ca_crt.pem
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Some platforms do not support signing external artifacts (kernel, dtb,
etc.) yet, so we need to decouple the signing of the bootloader from the
signing of the external artifacts.
This commit generalizes the code, so instead of having platform exceptions
scattered along the recipes, we create a new variable used conditionally
to sign or not the external artifacts.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
If the system is send to suspend mode, the bluetooth core is reconfigured.
Therefore, restart the service if it is running, to configure the ble
service.
https://onedigi.atlassian.net/browse/DEL-8694
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
Bitbake was always copying the public key 1 to the rootfs, no matter what the value specified in
the 'TRUSTFENCE_KEY_INDEX' variable was. This commit fixes the issue by enclosing the variable
between curly braces so that bitbake is able to expand it and calculate the correct key index.
Signed-off-by: David Escalona <david.escalona@digi.com>
Commit 429125cce0 created a minimal version 'defconfig'
that doesn't include all the default configuration options
of swupdate.
However, an anonymous python function inside the swupdate
repository establishes dependencies basing on configuration
switches it finds (or not) in the 'defconfig' file and any
additional configuration fragments.
For this reason, a minimal 'defconfig' cannot be used in
this recipe and a full configuration file (that also includes
default options) must be used instead.
Reported-by: Stephan Klatt
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
There was a missmatch between the configuration file and the
correct adc in the ccmp15 platform.
Also a whitespace is removed from ccmp13 configuration file.
https://onedigi.atlassian.net/browse/DEL-8702
Signed-off-by: Francisco Gil <francisco.gilmartinez@digi.com>
Javier Viguera
Hector Palacios
Mike Engel
Arturo Buzarra
Francisco Gil
Isaac Hermida
Gabriel Valcazar
Stephan Klatt
David Escalona
Tatiana Leon