This patch introduces some parameters which allow to select the type of image
to be signed. Currently the supported types are:
* linux kernel (-l)
* DTB (-d)
* initramfs (-i)
This also moves the CONFIG_PLATFORM environment variable to a parameter, for
consistency.
https://jira.digi.com/browse/DUB-614https://jira.digi.com/browse/DUB-615
Signed-off-by: Diaz de Grenu, Jose <Jose.DiazdeGrenu@digi.com>
The name "ext-eth" seems to indicate "External Ethernet". Rename that variable
and related ones to a more proper name like second ethernet.
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
* Check number of arguments
* Add platform argument
* Read user configuration from .config file
* Remove unused variable (dek_blob_size)
* Remove noise in output messages
https://jira.digi.com/browse/DEL-2688
Signed-off-by: Diaz de Grenu, Jose <Jose.DiazdeGrenu@digi.com>
Add a recipe to include all signing and encryption tools for U-Boot and
kernel images to the SDK. Move existing trustfence kernel scripts to this
new recipe.
This allows to use these scripts not only from the Yocto build system but
also as standalone tools for image signing and encryption.
https://jira.digi.com/browse/DEL-2688
Signed-off-by: Diaz de Grenu, Jose <Jose.DiazdeGrenu@digi.com>
Tweaked to maintain the u-boot and linux revisions to AUTOREV instead of
the fixed SHA1s from the tag.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
When changing any of the secure boot configurable macros the Linux kernel
should be re-deployed so that it can be signed/encrypted as needed.
https://jira.digi.com/browse/DEL-2750
Signed-off-by: Alex Gonzalez <alex.gonzalez@digi.com>
The region code is programmed in the OTP bits. We want to allow to be able to
override this behavior by setting the new value as a property in the device
tree called "regulatory-domain".
This can be done by setting the variable "regdomain=<code>" in uboot or well
by defining that entry in the device tree.
https://jira.digi.com/browse/DEL-2799
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
The country region is programmed in the OTP bits. Based on that value we need
to load the firmware file for the specific country region.
https://jira.digi.com/browse/DEL-2774
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
TRUSTFENCE_SIGN can be defined to "0" to explicitly disable uImage sign and
encryption.
https://jira.digi.com/browse/DEL-2803
Signed-off-by: Diaz de Grenu, Jose <Jose.DiazdeGrenu@digi.com>
NXP Code signing Tool for the High Assurance Boot library is needed for
signing and encrypting different artifacts (U-Boot image, uImage, ...).
As the CST cannot be included in DEY, the user needs to download the
tarball and add it to the recipe folder.
https://jira.digi.com/browse/DUB-618
Signed-off-by: Diaz de Grenu, Jose <Jose.DiazdeGrenu@digi.com>
The external module revision has been upgraded in meta-fsl-arm, thus
refresh the patches so they apply cleanly.
https://jira.digi.com/browse/DEL-2305
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
By default the driver was being compiled with debug messages. Disabled it
but leave the option there so it can be enabled by user.
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
Do not compile the kernel for supporting the static regulatory domain
but force the system to do that by using crda.
https://jira.digi.com/browse/DEL-2539
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
The root filesystem can have installed the busybox modprobe implementation or
the kmod modprobe implementation.
Check the version installed and compound the modprobe arguments.
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
Add recipe kernel-module-qualcomm to compile kernel module externally with all
the patches for kernel 4.1.15.
https://jira.digi.com/browse/DEL-2653
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
We compile those modules as built in to avoid a mismatch
between the current kernel version and the wlan.ko module.
https://jira.digi.com/browse/DEL-2653
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
This enables the Cryptographic Accelerator and Assurance Module (CAAM).
https://jira.digi.com/browse/DEL-2502
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
This module is the interface between user-space (openssl, gnutls) and
the hardware cryptographic acceleration support (CAAM).
This commit installs the module in the rootfs and configures it so it is
loaded on boot.
https://jira.digi.com/browse/DEL-2501
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
This enables the Cryptographic Accelerator and Assurance Module (CAAM).
https://jira.digi.com/browse/DEL-2502
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Used ccimx6ul_defconfig from v4.1/master repository.
The defconfig file will live under module folder and not specific platform
folder because it will be the same for other ccimx6ul platforms.
https://jira.digi.com/browse/DEL-2381https://jira.digi.com/browse/DEL-2529
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
COMPATIBLE_MACHINE is a regular expression, so we need to update the current
pattern for ccimx6 due to it will also match with ccimx6ul.
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
Diaz de Grenu, Jose
Hector Palacios
Isaac Hermida
Javier Viguera
Alex Gonzalez