When TrustFence is enabled, the boot artifacts (TFA and FIP)
have a 'signed' suffix. Handle this case so that the correct
symlinks are created and the correct artifacts are put into the
SWU file.
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
For signing SWU files we need to set a couple of variables:
- SWUPDATE_PRIVATE_KEY_TEMPLATE to the private key file
- SWUPDATE_PASSWORD_FILE to the password of the private key
The latter must only contain one password, whereas the current key_pass.txt
file had (for the ccmp13) the eight keys separated by a white space.
This commit:
- If the file key_pass.txt exists, it extracts each key into a separate
file key_pass0X.txt.
- If the keys don't exist, generates separate files per key.
- Changes the permissions of password files to 400.
- Adapts the sign script to use the single password files.
- Fixes a few quotes
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
Starting with NXP release "lf-6.1.55-2.2.0" the IMX optee fork (based on
version 4.0.0) does not support SOC revision A0. This commit recovers
support to build a bootloader for A0, extending the optee patch for
ccimx93 to support A0 with a build time option, and then extending the
optee-os and imx-boot recipes to build two optee binaries and using them
to generate bootloaders for both SOC revisions.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
This includes also an update and rename of the Edgelock Enclave firmware
package (firmware-ele-imx).
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Commit d3f3cfdb62 removed the inclusion of STM's
linux-stm32mp.inc from meta-st-stm32mp in our linux-dey recipe, but this
inadvertently removed the logic in do_configure() necessary to use our custom
ccmp1_defconfig. Since this commit, the kernel was being built with the default
ARM defconfig, which is very different from our custom defconfig and doesn't
even boot on MP1 platforms.
Rework the logic used to copy our platform's defconfigs to prevent this.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
This commit removes the BOOTLOADER_SEEK_OFFSER, because it has been
moved into the swupdate class and renamed into SWUPDATE_UBOOT_OFFSET.
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
This commit adds u-boot swupdate support for all platforms.
Now u-boot can be updated with all our supported update
options. Currently it will only update first partition
u-boot partition.
https://onedigi.atlassian.net/browse/DEL-8749
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
The 'mtd-blacklist' parameter prevents swupdate from acting upon those
partitions that we consider sensitive.
Make such list platform-dependent.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
The LEGACY_IMAGE_FORMAT defaults to 'y' if there is no FIT
support, which happens after applying the default configuration.
Then, the FIT support is added in a config fragment, but the
LEGACY_IMAGE_FORMAT is not disabled.
Disabling this is recommended to avoid the possibility to boot
unsigned legacy images.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
As part of the integration of the new ML package, also update the
ethos-u-firmware binary built from Stash:
Repo: emp/ethos_u_firmware.git
Revision: a0352b0cf7267c896b55980dedd08daddc780733
Source: NXP's MCUXpresso SDK_2.14.0_MIMX9352xxxxK
And, drop deepview-rt support for ccimx93, as NXP has done the same in
6.1.36-2.1.0 release.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
The U-Boot bootscript loads the fitImage into RAM memory to run
this bootscript. This bootscript ends up calling 'dboot' command
to run the FIT default configuration.
To avoid 'dboot' re-loading again the fitImage into RAM memory,
set this temporary variable that will be immediately reset
by 'dboot'.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
An anonymous function in linux-stm32mp.inc produces a bbfatal error when
KERNEL_DEVICETREE variable contains more than one device tree. This is our
case since we build the main DT plus a number of DT overlays.
This commit removes the dependency to this include file since we have our
own recipe to build the kernel and it is not needed at all.
It also removes the build of a uImage and the need to provide a
LOADADDR.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
Backport of graphics package for ccimx93 from NXP's Mickledore-based
6.1.36-2.1.0 release. Mainly copies and appends of graphics recipes
from the new release, and restricted to ccimx93 by changing the
COMPATIBLE_MACHINE, so it does not affect other platforms.
Notice, that the new version of weston used now by the ccimx93 requires
a different profile file (weston-socket.sh). This profile supercedes the
old 'weston.sh'.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Backport of multimedia package for ccimx93 from NXP's Mickledore-based
6.1.36-2.1.0 release. Mainly copies and appends of multimedia recipes
from the new release, and restricted to ccimx93 by changing the
COMPATIBLE_MACHINE, so it does not affect other platforms.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
In commit 2fd1dbfed7, we accidentally removed some changes needed to
build imx-boot with Trustfence enabled, which were added in commit
1ce17da864.
This partially reverts commit 2fd1dbfed7
Signed-off-by: Francisco Gil <francisco.gilmartinez@digi.com>
In commit 2fd1dbfed7, we accidentally removed some changes needed to
build imx-boot with Trustfence enabled, which were added in commit
1ce17da864.
This partially reverts commit 2fd1dbfed7
Signed-off-by: Francisco Gil <francisco.gilmartinez@digi.com>
LVGL is a free and open-source embedded graphics library that is able to run
in environments with limited resources.
This image includes a desktop environment and an LVGL widget demo (lvgl_demo)
https://onedigi.atlassian.net/browse/DEL-8740
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
This commit adds several overlays for DVK v2 and modifies the boot script to apply it
based on the board_version variable.
https://onedigi.atlassian.net/browse/DEL-8746
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
The nodes "/dev/ramX" and "/dev/loopX" are mounted on boot.
Each node calls the mount.sh script, but they are not mounted
because these nodes are blacklisted in the "blacklist.conf" file.
In the ccmp13 adding this modification in the rule saves
around 4 seconds per boot.
In the ccmp15 and ccimx6ul around 2 seconds are saved.
https://onedigi.atlassian.net/browse/DEL-8725
Signed-off-by: Francisco Gil <francisco.gilmartinez@digi.com>
This commit adds signed FIT image support for the CCMP1
platforms when using Trustfence.
https://onedigi.atlassian.net/browse/DEL-8591
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
During firmware install, the target may be reset several times.
We don't want the bootcount to count these as boot attempts.
This was done in a791bb4463 for the ccmp1
but not for the rest of platforms.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
(cherry picked from commit 961acf48de)
These binaries are installed in subdirectories by default. The uuu
installer expects to find all binaries on the same folder where the script
is. By creating symlinks, the uuu installer can find all the binaries it
needs directly on the deploy folder.
NOTE: variables in 'for' clauses are intentionally without quotes to skip
whitespaces in them.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
(cherry picked from commit 019deb6313)
Improve boot attempts message showing not only the current boot attempt
but also the limit:
(boot attempt 1/3)
Print the message only when the bootcount mechanism is active, i.e. when
the bootlimit is defined (not zero), and when bootcount is > 0.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://onedigi.atlassian.net/browse/DUB-1056
(cherry picked from commit 918a9caf1d)
Use the intention of installing dual boot firmware as a condition to set
bootlimit=3 so that the bootcount mechanism is enabled.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://onedigi.atlassian.net/browse/DUB-1058
During firmware install, the target may be reset several times.
We don't want the bootcount to count these as boot attempts.
This was done in a791bb4463 for the ccmp1
but not for the rest of platforms.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
These binaries are installed in subdirectories by default. The uuu
installer expects to find all binaries on the same folder where the script
is. By creating symlinks, the uuu installer can find all the binaries it
needs directly on the deploy folder.
NOTE: variables in 'for' clauses are intentionally without quotes to skip
whitespaces in them.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
Improve boot attempts message showing not only the current boot attempt
but also the limit:
(boot attempt 1/3)
Print the message only when the bootcount mechanism is active, i.e. when
the bootlimit is defined (not zero), and when bootcount is > 0.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://onedigi.atlassian.net/browse/DUB-1056
New NXP's release is based on upstream v2.8. Use this only for ccimx93,
and keep using the previous Kirkstone release (based on upstream v2.6)
for the rest of the platforms.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Recently, meta-freescale backported the support to build multiple boot
artifacts. This clashes with the changes in our imx-boot bbappend,
so update the bbappend to make it compatible with the latest changes
in meta-freescale.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
(cherry picked from commit 2fd1dbfed7)
Recently, meta-freescale backported the support to build multiple boot
artifacts. This clashes with the changes in our imx-boot bbappend,
so update the bbappend to make it compatible with the latest changes
in meta-freescale.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Through the inclusion of 'nand-4-256' in BOOTDEVICE_LABELS, the include
file 'st-machine-common-stm32mp.inc' adds strings to MULTIUBI_BUILD and
IMAGE_FSTYPES that result in building ubi and ubifs images.
These are redundant and not needed since meta-digi's
'image_types_digi.bbclass' already generates the needed ubifs images.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://onedigi.atlassian.net/browse/DEL-8714
The STM signtools are precompiled binaries with a fixed RPATH to look for
dynamic libraries.
When the binaries are installed to the regular ${bindir} (either native or
nativesdk), additional toolchain libraries in the regular ${libdir} folder
confuse the binaries, resulting in segmentation faults when running them
or missing symbols.
The package has been reworked to place the directory structure expected
by the binaries, in a subfolder "stm" within the ${bindir}.
Two wrapper scripts with the names of the binaries (STM32MP_KeyGen_CLI and
STM32MP_SigningTool_CLI) have been created to run the binaries in the new
subfolder.
Package version has been bumped to 1.1.
While on it, remove the 'do_install' from trustfence-stm-signtools.inc
which is not needed because the 'bin_package' class already provides the
same functionality.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://onedigi.atlassian.net/browse/DEL-8720
The appropriate way to add STM signtools to the SDK is via RDEPENDS on
nativesdk-packagegroup-sdk-host, not through the parent recipe of STM
signtools recipe itself.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://onedigi.atlassian.net/browse/DEL-8720
Through the inclusion of 'nand-4-256' in BOOTDEVICE_LABELS, the include
file 'st-machine-common-stm32mp.inc' adds strings to MULTIUBI_BUILD and
IMAGE_FSTYPES that result in building ubi and ubifs images.
These are redundant and not needed since meta-digi's
'image_types_digi.bbclass' already generates the needed ubifs images.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://onedigi.atlassian.net/browse/DEL-8714
The STM signtools are precompiled binaries with a fixed RPATH to look for
dynamic libraries.
When the binaries are installed to the regular ${bindir} (either native or
nativesdk), additional toolchain libraries in the regular ${libdir} folder
confuse the binaries, resulting in segmentation faults when running them
or missing symbols.
The package has been reworked to place the directory structure expected
by the binaries, in a subfolder "stm" within the ${bindir}.
Two wrapper scripts with the names of the binaries (STM32MP_KeyGen_CLI and
STM32MP_SigningTool_CLI) have been created to run the binaries in the new
subfolder.
Package version has been bumped to 1.1.
While on it, remove the 'do_install' from trustfence-stm-signtools.inc
which is not needed because the 'bin_package' class already provides the
same functionality.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://onedigi.atlassian.net/browse/DEL-8720
The appropriate way to add STM signtools to the SDK is via RDEPENDS on
nativesdk-packagegroup-sdk-host, not through the parent recipe of STM
signtools recipe itself.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://onedigi.atlassian.net/browse/DEL-8720
Some platforms do not support signing external artifacts (kernel, dtb,
etc.) yet, so we need to decouple the signing of the bootloader from the
signing of the external artifacts.
This commit generalizes the code, so instead of having platform exceptions
scattered along the recipes, we create a new variable used conditionally
to sign or not the external artifacts.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
ARM64 generic overrides where in the middle of the chain with more
precedence than IMX overrides.
From:
MACHINEOVERRIDES="imx-generic-bsp:imx-nxp-bsp:imxdrm:imxpxp:mx9-generic-bsp:mx9-nxp-bsp:mx93-generic-bsp:mx93-nxp-bsp:ccimx93:ccimx93:aarch64:armv8-2a:use-nxp-bsp:ccimx93-dvk"
To:
MACHINEOVERRIDES="aarch64:armv8-2a:use-nxp-bsp:imx-generic-bsp:imx-nxp-bsp:imxdrm:imxpxp:mx9-generic-bsp:mx9-nxp-bsp:mx93-generic-bsp:mx93-nxp-bsp:ccimx93:ccimx93:ccimx93-dvk"
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
mkimage output provides some information (basically image offsets) that
cst (code signing tool) uses to sign imx-boot images.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
This version supports i.MX8ULP and i.MX9x devices.
NOTICE: changed the "srk_ca" parameter in ahab_pki_tree.sh from "yes" to
"no". This script is shared between cc8x and ccimx93. The imx93 does not
support that option at the moment (generation of subordinate SGK certs)
and for the cc8x we were generating them but never used them to sign
the artifacts.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Merge the patches for the PKI tree generation scripts, to ease
maintenance (still keeping two separate patches for HAB4/AHAB).
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
ARM64 generic overrides were in the middle of the chain with more
precedence than IMX overrides.
From:
MACHINEOVERRIDES="imx-generic-bsp:imx-nxp-bsp:imxdrm:imxpxp:mx9-generic-bsp:mx9-nxp-bsp:mx93-generic-bsp:mx93-nxp-bsp:ccimx93:ccimx93:aarch64:armv8-2a:use-nxp-bsp:ccimx93-dvk"
To:
MACHINEOVERRIDES="aarch64:armv8-2a:use-nxp-bsp:imx-generic-bsp:imx-nxp-bsp:imxdrm:imxpxp:mx9-generic-bsp:mx9-nxp-bsp:mx93-generic-bsp:mx93-nxp-bsp:ccimx93:ccimx93:ccimx93-dvk"
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
If the default r/w rootfs is not found it will try to do a
fallback to the squashfs image.
In the nand devices additionally we need to set the rootfstype
to squashfs.
https://onedigi.atlassian.net/browse/DEL-8638
Signed-off-by: Francisco Gil <francisco.gilmartinez@digi.com>
When booting from a microSD, the variable 'boot_device' is
set to "mmc". Check this to fall back to booting Linux from
the microSD partitions.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
These are files for programming images with STM32CubeMX tool.
We don't use the tool or the files. Remove the task to avoid build
warnings.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
BOOTDEVICE_LABELS defines the supported boot device (NAND by default).
BOOTSCHEME_LABELS defines the which kind of boot is supported.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
We will use BOOTDEVICE_LABELS as a means to add 'sdcard'
configuration to TF_A_CONFIG within meta-st-stm32 so there
is no need to have a wrapper variable in meta-digi.
This reverts commit 7cf314ba80.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
We will use BOOTDEVICE_LABELS as a means to add 'sdcard'
configuration to TF_A_CONFIG within meta-st-stm32 so there
is no need to have a wrapper variable in meta-digi.
This reverts commit c6f19a099c.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
Digi's mechanism to use a custom Linux kernel defconfig is
based on setting the variable KERNEL_DEFCONFIG, however ST
implements their own mechanism with a custom variable
KERNEL_EXTERNAL_DEFCONFIG. When providing an external defconfig,
the variable needs to be set, otherwise a build error
will be generated. So to keep compatibility with NXP
platforms, this commit weakly assigns KERNEL_EXTERNAL_DEFCONFIG
to a default value "defconfig".
Signed-off-by: Francisco Gil <francisco.gilmartinez@digi.com>
ConnectCore Cloud Services examples are included in 'dey-examples' repository
so they can be built from here and also imported in Eclipse/Digi Application
Development Environment for Linux with the samples wizard.
The example 'upload_file' has been removed since currently there is no support
for binary data points in the CCCS daemon/client model.
https://onedigi.atlassian.net/browse/DEL-8628
Signed-off-by: Tatiana Leon <Tatiana.Leon@digi.com>
This recipe generates several packages:
* 'cccs' includes the CCCS shared library
* 'cccs-daemon' includes the binary and resources to execute the CCCS daemon
(daemon, service and init scripts, configuration file)
* 'cccs-cert' includes the required certificate to use CCCS daemon
* 'cccs-gs-demo' includes the binary and resources to execute the CCCS get
started demo (binary, service and init scripts)
* 'cccs-legacy' includes the binary (all-in-one) application to execute
the legacy CCCS application (aka cloud-connector) and the configuration
file
* 'cccs-legacy-dev' includes resources to develop legacy CCCS applications
(all-in-one) (header files inside 'cloud-connector' and 'cloudconnector.pc'
pkg config file)
* 'cccs-legacy-staticdev' includes static resources to develop legacy CCCS
applications (all-in-one) (static library)
This commit also renames:
* 'CLOUDCONNECTOR_PKGS' variable to 'CCCS_PKGS'.
* 'CC_DEVICE_TYPE' variable to 'CCCS_DEVICE_TYPE'.
https://onedigi.atlassian.net/browse/DEL-8628
Signed-off-by: Tatiana Leon <Tatiana.Leon@digi.com>
Until now, for dualboot systems, all boot variables were calculated on each boot depending on the value of the
'active_system'. These variables are used to boot the device but were not saved, which could lead to a missmatch
between their value in the environment and their required values to correctly boot the system. This commit
simplifies a bit the variables calculation and adds a block to synchronize their value in the environment.
Signed-off-by: David Escalona <david.escalona@digi.com>
All the 'altboot' script functionality has been moved directly to the 'altbootcmd' command
in U-Boot, so this script is no longer necessary. Remove it for all platforms.
https://onedigi.atlassian.net/browse/DEL-8674
Signed-off-by: David Escalona <david.escalona@digi.com>
The install scripts from SD/USB use a fixed image name.
If you are trying to install a different image you need to set
the env variable 'image-name' first.
Add a helper message if default files are not found to
avoid needing to go to the documentation.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
During firmware install, the target may be reset several times.
We don't want the bootcount to count these as boot attempts.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
Now in the ccmp1X platform the index for the data partition is
hosted in the ubi1 volume instead of the ubi0.
Signed-off-by: Francisco Gil <francisco.gilmartinez@digi.com>
The ccmp1 has two MTD partitions (UBI, UBI_2) with different system
volumes.
Previously, the fact of having two ubi devices was taken as proof of
being on a multi-MTD system (one that has one UBI volume per partition).
Instead, this commit reformulates the condition to having a partition of
the same name than the UBI volume.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
PKI tree generation for the STM32MP15 cpu provides the undesired file
"publicKeysHashHashes.bin", which is only required by STM32MP13. This commit
generates the PKI tree according to the KeyGen tool documentation to avoid
generate this extra file and avoid confusing the end user.
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
Any errors in the PKI tree generation are not reported to bitbake, so the
script fails silently. This commit adds a validation of the script execution,
and if it fails, it aborts the execution and notifies to bitbake.
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
The KeyGen tool to generate 8 key pairs requires 8 consecutive passwords,
however, when the shell expands the passwords variable, it interprets it as a
single string instead of 8 different strings and fails.
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
The 'bootcount' value is now incremented and stored in the system on every boot and
not only then the 'upgrade_available' flag is set. Also, ensure the value is cleared
when the 'altboot' script is executed by running the new U-Boot command 'bootcount reset'.
https://onedigi.atlassian.net/browse/DEL-8506
Signed-off-by: David Escalona <david.escalona@digi.com>
This branch contains the latest BSP changes from STM's v5.15-stm32mp-r2.1
release.
https://onedigi.atlassian.net/browse/DEL-8659
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
The STM32MP15 SoC can only use one sign key.
Forcibly set TRUSTFENCE_KEY_INDEX on the machine conf so
that it cannot be overriden by mistake on the local.conf.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
When TrustFence is enabled, a PKI tree is generated.
In the case of NXP platforms, the PKI contains public certificates
from which the public key needs to be extracted using an openssl
command.
In the case of STM platforms, the PKI contains directly the
public key.
In all cases, we need the public key to be installed in the
rootfs /etc/ssl/certs/ folder, so that it can be used by
swupdate to authenticate signed SWU packages.
Up to now, this was being done on the dualboot recipe, but the
installation of the public key should really be only dependant
on the fact of TF being enabled.
This commit:
- Removes the generation of the public key from dualboot.bb.
- Generates a patch to extract the public key from the certificate
as part of the PKI tree generation (on NXP platforms).
- Installs the public key during a post install function after
the final rootfs has been created.
- For NXP platforms, extracts the public key using openssl if
it does not exist (for backwards compatibility).
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
When booting from recovery sdcard, in the imx93 the dualboot is yes by
default, so the mmcroot variable was not set correctly for the uSD.
If we boot from uSD, just assume all the system is in the uSD card, whether
it is a recovery system or a prepared uSD card for demo.
https://onedigi.atlassian.net/browse/DEL-8461
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
Commit 92969f0c4 ("plat-stm32mp1: Remove CFG_STM32_BSEC_WRITE dependency with
debug configuration OP-TEE") on OP-TEE source code, removed the link between
the BSEC WRITE feature with DEBUG feature, so now by default it is enabled.
This reverts commit 2395378ec4.
https://onedigi.atlassian.net/browse/DEL-8657
Create a new script for the generation of PKI tree for STM platforms
and leave the trustfence-sign-artifact script exclusively for signing.
The new gen-pki script only requires the platform as an argument and the
path to where to save the tree (if it doesn't exist) in
CONFIG_SIGN_KEYS_PATH.
This commit also reverts commit 13c136dbc5 by getting rid of the
trustfence-genpki-native.bb recipe and moving back the PKI generation
functions into trustfence.bbclass. This recipe didn't quite guarantee
that the PKI was generated on time for the recipes that required the
keys to exist, anyway.
Instead, the PKI generation function must be called right after
do_compile() of recipe tf-a-stm32mp to be ready for do_deploy() where
the key is used.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
Starting at kernel 6.1, the maxim98088 driver has been migrated
from the old imx-max98088.c driver to NXP’s new audio framework
fsl-asoc-card.c.
Update the sound stuff to match the new audio card and some of
the new controls.
https://onedigi.atlassian.net/browse/DEL-8596
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
Commit 7cf314ba80 made a weak assignment of TF_A_CONFIG in the machine
config file, so that it could be overriden from conf/local.conf with a
straight assignment. However, this variable already has a weak assignment
on include files for the tf-a-stm32mp recipe, which apparently take
precedence over the machine files.
This commit creates a new variable DEY_TF_A_CONFIG in the machine config,
and then uses a straight assignment of TF_A_CONFIG to the new variable on the
tf-a-stm32mp.bbappend.
This allows users to override the machine default and avoids the STM recipe
weak assignment.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
Do not install the combo FW and install the WiFi and BT FW as separated FWs,
so they are managed independently.
Md5sums are:
44cf5535f3b40784296843544eae159e sd_w61x_v1.bin.se
300c739a4e126a8f430001c41e5b3a5f uartspi_n61x_v1.bin.se
Note: currently these FW files are copied manually here, till the github FW
files are updated.
These firmware files come from the package IW612_18.99.2.p19.5.zip provided
by NXP support page.
https://onedigi.atlassian.net/browse/DEL-8632
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
The btnxpuart driver is used for the bluetooth chip. We want to control
when to load and unload it, and when power/unpower the chip.
Therefore, blacklist it, so we can manage it in our scripts.
https://onedigi.atlassian.net/browse/DEL-8632
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
This wks file creates the required GPT and partition layout
to have a bootable SD card with the following partitions:
- fsbl1
- fsbl2
- metadata1
- metadata2
- fip-a
- fip-b
- u-boot-env
- linux
- rootfs
- data
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://onedigi.atlassian.net/browse/DEL-8120
This includes NXP's code from the SCFW porting kit v1.15.0, support for
variants with 4 GiB of RAM and a fix for an issue when resuming from suspend.
https://onedigi.atlassian.net/browse/DEL-8604
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
This commit adds support for environment encryption/decryption of the
u-boot environment on the CCMP1 platform in Linux.
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
Equivalent commits in meta-freescale:
71d2a1ad49a3e04d0d401d4e9c52d5a50105b6dc
995f2f0a86da9428af348e72e51beb5063ebd729
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
When the system runs as read-only with '/etc' overlayfs enabled, '/sbin/init' is not a symlink
to 'systemd', but '/sbin/init.orig' is. This causes the script to wrongly think than 'systemd'
is not being used. The outcome is that partitions are not being automatically mounted in R/O
systems running in mmc with '/etc' overlayfs enabled, as the specific '/usr/bin/systemd-mount'
binary needs to be invoked in these cases.
The proposed fix performs a second check with '/sbin/init.orig' to determine whether systemd is
being used or not. While on it, add an early check to determine if the partition is already
mounted to exit the script.
Signed-off-by: David Escalona <david.escalona@digi.com>
Make a series of changes to make sure the imx-boot signing process works:
* Store separate mkimage logs for each imx-boot build. In our case, this
means storing one log per SoC revision. Each SoC revision has a different
SECO fw binary with varying sizes, which causes offsets of specific
signing regions to differ among revisions. Since we parse the offsets
from the logs, we need to make sure the offset information is correct in
each case.
* Remove u-boot-atf-container.img in each mkimage iteration, otherwise the
ATF offset information will be missing from subsequent logs.
* Implement a separate trustfence_sign_imxboot() function for the ccimx8x
to iterate through all SoC revisions.
Note that the SPL+AHAB signing script doesn't support imx-boot encryption yet.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
When building imx-boot images with SPL on the ccimx8x, a different signing
procedure is required. We already have a script for this use case in our U-Boot
fork, so make use of it.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
Regulatory domain is now provided as a Kernel parameter, and the
wlan driver uses it to select the correct BDF file, so we don't
need to change the symbolic links to point to one file or another
anymore.
https://onedigi.atlassian.net/browse/DEL-8360
Signed-off-by: Gonzalo Ruiz <Gonzalo.Ruiz@digi.com>
New NXP's release is based on upstream v2.8. Use this only for ccimx93,
and keep using the previous Kirkstone release (based on upstream v2.6)
for the rest of the platforms.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Weston is not launched in read-only filesystem because /home/root
is not a writable path.
Signed-off-by: Francisco Gil <francisco.gilmartinez@digi.com>
We can't run a post installation script in a readonly file system.
We need to provide a configuration file beforehand.
https://onedigi.atlassian.net/browse/DEL-8556
Signed-off-by: Francisco Gil <francisco.gilmartinez@digi.com>
When EXTRA_IMAGE_FEATURES += "overlayfs-etc" is added these
configurations are needed to compile. They are provided with
the default configuration to work with our software.
The user can modify them in their local.conf if needed.
https://onedigi.atlassian.net/browse/DEL-8552
Signed-off-by: Francisco Gil <francisco.gilmartinez@digi.com>
When the swu package is generated it needs the right
extension of the rootfs to be formed.
https://onedigi.atlassian.net/browse/DEL-8558
Signed-off-by: Francisco Gil <francisco.gilmartinez@digi.com>
We no longer need logic to determine the SOM's RAM size and bus width, we only
need to know the SOC revision, which is info that is always available.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
Now that both U-Boot and the SCFW can autodetect the RAM configuration, we can
simplify the imx-boot build process to generate two binaries (one per SOC
revision) instead of eight. Build "flash_spl" imx-boot images and use only one
global defconfig for u-boot.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
This update includes automatic RAM configuration detection, and only one SCFW
binary is needed for all ccimx8x variants. Adapt the imx-boot recipe
accordingly.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
Use our custom compile/install/deploy functions from DEY 3.2. NXP's imx-boot
recipe assumes only one U-Boot config and SOC revision, but we have multiple,
so we have to rewrite all of these functions.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
For the ccimx8x, we changed the order of the steps in do_deploy() from:
Deploy -> Rename files -> Move binaries
To:
Deploy -> Move binaries -> Rename files
When it's time to rename the files, they won't be in their original place and
the process will fail. Make sure we move the files after they've been renamed
to avoid errors.
Also, one move operation is enough for all artifacts, so remove the second
operation.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
Currenlty, the github FW version is a bit old and some functionality does not
work on latest IW61x batches.
Use this FW binary till it is released on github. This is required to
have WiFi and Bt working simultaneously.
0c6d454ea83b1a78b4e60df16f478f43 sduart_nw61x_v1.bin.se
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
(cherry picked from commit 92ca458e4f)
Currenlty, the github FW version is a bit old and some functionality does not
work on latest IW61x batches.
Use this FW binary till it is released on github. This is required to
have WiFi and Bt working simultaneously.
0c6d454ea83b1a78b4e60df16f478f43 sduart_nw61x_v1.bin.se
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
Backport from NXP's lf-6.1.1-1.0.0 release for the ccimx93 (meta-ml
layer).
This version of flatbuffers is needed for ethos-u-vela version 3.6.0
(backported in following commit).
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
There are two different firmware files for Bluetooth on Murata's type2AE
module:
- JRL: It configures a Bluetooth TxPower of 7dB, to be used in Japan
only.
- FCC.CE: It configures a Bluetooth TxPower of 5dB, to be used in the
rest of the world.
To comply with the FCC requirement that it should not be possible to
configure different regulatory domains, or in this case configurations,
than FCC, only deploy the FCC.CE file by default:
- BCM4373A0_FCC.CE.hcd (md5sum: 1e287a3ab7f83e59352cb321315ea80f)
This file reports the following information during boot time:
Bluetooth: hci0: 89373 UART 37.4 MHz wlbga_BU sLNA muRata Type 2EA 5dBm 20220608-0103
Bluetooth: hci0: BCM4373A0 (001.001.025) build 0155
JRL file will be added via the Worldwide DEY patch addon that customers
can request from Digi.
https://onedigi.atlassian.net/browse/DEL-8453
Signed-off-by: Gonzalo Ruiz <Gonzalo.Ruiz@digi.com>
The only user of 'linux-dey-src.inc' was the linux recipe itself, so
instead rename that file to a more generic 'linux-dey.inc' and include
more common code in that renamed file.
This is in preparation for the new linux 6.1.1 recipe for the ccimx93.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Remove patch file "0001-Makefile-Suppress-array-bounds-error.patch"
for ccimx93, as it is already included in the lf-6.1.1_1.0.0 revision.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Weston is not launched in read-only filesystem because /home/root
is not a writable path.
Signed-off-by: Francisco Gil <francisco.gilmartinez@digi.com>
Replace the CLM blob file from Github, which supports several countries
with a custom US-only CLM blob file. This way, default images will only
have support for US regulatory domain, therefore complying with FCC
requirements.
The Worldwide CLM blob file will be provided by Digi International on
request.
https://onedigi.atlassian.net/browse/DEL-8453
Signed-off-by: Gonzalo Ruiz <Gonzalo.Ruiz@digi.com>
We can't run a post installation script in a readonly file system.
We need to provide a configuration file beforehand.
https://onedigi.atlassian.net/browse/DEL-8556
Signed-off-by: Francisco Gil <francisco.gilmartinez@digi.com>
When EXTRA_IMAGE_FEATURES += "overlayfs-etc" is added these
configurations are needed to compile. They are provided with
the default configuration to work with our software.
The user can modify them in their local.conf if needed.
https://onedigi.atlassian.net/browse/DEL-8552
Signed-off-by: Francisco Gil <francisco.gilmartinez@digi.com>
When the swu package is generated it needs the right
extension of the rootfs to be formed.
https://onedigi.atlassian.net/browse/DEL-8558
Signed-off-by: Francisco Gil <francisco.gilmartinez@digi.com>
These variables are used to generate .sdcard images, and without them, said
generation will fail.
https://onedigi.atlassian.net/browse/DEL-8540
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
We still need to use this downgraded version of dtc to be able to build
U-Boot v2017.03, so backport this patch to be able to build dtc with the latest
version of gcc
https://onedigi.atlassian.net/browse/DEL-8540
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
This commit modifies the boot script condition to apply the overlay for MCA
based on HWID MCA field.
https://onedigi.atlassian.net/browse/DEL-8521
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
By default, the signing script generates a file without 'w'
permission so DEY cannot remove it from the deploy dir on
a clean operation.
Add the 'w' permission so that DEY can remove it on clean
operations and generate a new signed file when required.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
Otherwise, the sw-description used for non-dualboot systems will be missing
these values and the software update process will fail.
https://onedigi.atlassian.net/browse/DEL-8513
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
We accidentally used "mx8mm" instead of "mx8mn" in commit
9b165196bb, which caused several elements to stop
working on the target (including the optee-os).
https://onedigi.atlassian.net/browse/DEL-8512
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
The tools STM32MP_KeyGen_CLI and STM32MP_SigningTool_CLI have
a dependency of libQt5Core.so.5 which is provided by qtbase.
Add this dependency to avoid errors during SDK generation.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
This commit disables the uSD mounting, due to issues
detected during the boot process when UBIFS starts
with the wear-leveling process to erase NAND blocks.
https://onedigi.atlassian.net/browse/DEL-8415
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
The FIP image is signed internally by this recipe. The password must be
set in FIP_SIGN_KEY_PASS. With the signing script, the password is
randomly generated and saved in key_pass.txt.
This prefunc obtains the password(s) from the file to set FIP_SIGN_KEY_PASS
so that the FIP can be properly signed.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
For the moment, do not sign aditional artifacts, such as the ramdisk,
the kernel or the boot scripts for STM platforms.
In the specific case of the ramdisk, simply copy it over with the
expected filename extension.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
Several recipes depend on the PKI creation.
Create a small recipe to just run this function which
is moved from the trustfence.bbclass.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
This script can be called stand-alone or from DEY.
Syntax is :
trustfence-sign-artifact.sh -p <platform> [-t input-unsigned-image> <output-signed-image>]
If files are omitted, it at least generates random keys if they do not
exist.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
The do_deploy:append did three things:
- adapt the U-Boot filenames to 'u-boot-<platform>-<config>.<ext>'
- sign/encrypt the U-Boot files (only for iMX6 family)
- sign the boot scripts
Convert the first two actions into functions (the third already was) and
call them conditionally as postfuncs.
Also skip the signing of U-Boot files if the platform is not based on
iMX6 family.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
Certain platforms share a processor family but need to be differentiated
between them. DEY was using the variable DIGI_FAMILY as the SOM name
rather than the family. It becomes useful to have both (DIGI_SOM as the
more specific, and DIGI_FAMILY as the more generic).
This is the case, for example, of:
- ccmp1 (family)
- ccmp15 (SOM)
- ccmp13 (SOM)
- ccimx8m (family)
- ccimx8mm (SOM)
- ccimx8mn (SOM)
Both variables are used on the machine overrides.
Where DIGI_FAMILY was used, use now DIGI_SOM.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
This recipe downloads a tarball that contains the binaries:
- STM32MP_KeyGen_CLI
- STM32MP_SigningTool_CLI
from ST Microelectronics STM32CubeProgrammer v2.12.0.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
This is in preparation of using the same script name for different SOC
vendors (NXP and STM).
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
Set TRUSTFENCE_DEK_PATH to "0" for CCMP1 (not using dek.bin), as if this
was disabled.
Set temporarily TRUSTFENCE_ENCRYPT_ENVIRONMENT to "0" for CCMP1 until
environment encryption is fully supported.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
Dependencies of this recipe are run-time dependencies, not build-time.
While on it, move them to specific native/nativesdk recipe.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
This recipe builds the script (that depends on cst-tool) that is used to
sign the images. It's only run natively.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
The name of the variable was not very intuitive of what
it contains. This variable expands to the SoC vendor
(NXP or STM).
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
Commit 065cf3e9 ("kirkstone migration: general update to the new override
syntax") incorrectly renamed binaries in a massive change. This commit restores
the binary names to the original.
https://onedigi.atlassian.net/browse/DEL-8478
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
By default, our 'cloudconnector' package is installed.
This can be overriden by defining 'CLOUDCONNECTOR_PKG' in the 'local.conf'
with the custom package that includes this application.
Signed-off-by: Tatiana Leon <Tatiana.Leon@digi.com>
These are recipes we created to support Google Coral on i.MX platforms. ST's
machine learning layer provides similar recipes, so to avoid conflicts, move
the recipes meant for i.MX platforms to a dynamic layer.
https://onedigi.atlassian.net/browse/DEL-8308
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
This dependency is only required if you wish to build ST's reference images,
which isn't our case. Add said reference images' recipes to the BBMASK to
avoid build errors.
https://onedigi.atlassian.net/browse/DEL-8308
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
rename interface sta_name to be "wlan0" instead of "mlan0", so it keeps
compatibility with other platforms.
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
OPTEE_PKGS variable must have a default (empty) value to prevent bitbake
parsing errors.
This fixes a build failure for MP1 platforms where the variable was
undefined in the commit that added the support.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
A recipe may generate different runtime packages, with names other than
PN. This commit allows removing the ontarget postinst script for those
other runtime package names. To do so, just define REMOVE_POSTINST_RPN
before including this class in the recipe.
The first user is in the following commit.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
NXP platforms that have 'optee' in the MACHINE_FEATURES, will install
optee userspace packages (ccimx8m and ccimx93 at the moment).
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Add nxp-wlan-sdk repice as a verbatim copy and add our bbappend
for fixing the build.
This recipe include some tools, mainly for RF porpouses.
https://onedigi.atlassian.net/browse/DEL-8346
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
Add the overlay required to perform the BLE HCI Raw test to the
linux default images. That way, default images can be used to certify
the product.
Signed-off-by: Gonzalo Ruiz <Gonzalo.Ruiz@digi.com>
1)
CcxTagControlData struct in CORE/HDD/inc/CcxTagDefs.h had some fields missing compared
with 'cctags api’ which was producing CCX_TAG_DRVR_RSP_ERR_CTRL_SIZE.
2)
Then CCX_TAG_DRVR_RSP_ERR_PACKET_SIZE aroused because following paddings:
CCX_TAG_MPDU_HEADER_PAD_SIZE = 2
CCX_TAG_CONTENT_HEADER_PAD_SIZE = 3
where producing wrong alignements and sizes between the 'cctags api’ and the driver.
With changes in this commit, master branch of ‘CCxTagTest’ repository compiled
out of source code gets on well with 'cctags api’ repository and with qca driver in
both dey-2.4 and dey4.0.
Packets in the air match 100% in content in both dey-2.4 and dey4.0.
https://onedigi.atlassian.net/browse/DEL-8446
Signed-off-by: Hector Bujanda <hector.bujanda@digi.com>
An official fix was added to meta-timesys in commit
ae4f6e9854361d4a6d71b6f8b87130268d990b32, so our workaround is no longer needed
This reverts commit 7a77130550.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
The HWID is populated on the device tree by the boot loader.
This can be used as a key modifier when encrypting the U-Boot
environment. Some old U-Boot versions however, did not populate
the HWID on the device tree. When updating firmware from an
old version to a new one, the library may not be able to read
the HWID from the DT and then be unable to unencrypt the
environment.
This patch implements a fall-back function to read the HWID
directly from the nvmem node (sysfs). Implementation has been
done for ccimx6 family only, where this case of old U-Boot
can happen.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://onedigi.atlassian.net/browse/DEL-8444
(cherry picked from commit 222a91f213)
The commit we use to build the cryotpauthlib package is currently not part of
any branches or tags in the original MicrochipTech repo. To make sure the
package can always be built, use our mirror of the repo, which includes an
additional branch for the specific commit.
While at it, move the "nobranch=1" parameter to the GIT_URI variable, since
we're putting all other git parameters there, anyway. Also, remove the "branch"
parameter because it isn't needed in this case.
https://onedigi.atlassian.net/browse/DEL-8015
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
The commit we use to build the cryotpauthlib package is currently not part of
any branches or tags in the original MicrochipTech repo. To make sure the
package can always be built, use our mirror of the repo, which includes an
additional branch for the specific commit.
While at it, move the "nobranch=1" parameter to the GIT_URI variable, since
we're putting all other git parameters there, anyway. Also, remove the "branch"
parameter because it isn't needed in this case.
https://onedigi.atlassian.net/browse/DEL-8015
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
The HWID is populated on the device tree by the boot loader.
This can be used as a key modifier when encrypting the U-Boot
environment. Some old U-Boot versions however, did not populate
the HWID on the device tree. When updating firmware from an
old version to a new one, the library may not be able to read
the HWID from the DT and then be unable to unencrypt the
environment.
This patch implements a fall-back function to read the HWID
directly from the nvmem node (sysfs). Implementation has been
done for ccimx6 family only, where this case of old U-Boot
can happen.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://onedigi.atlassian.net/browse/DEL-8444
Commit 32dd3d59c250f916115b339c29aa4dbfe50a3235 in poky breaks i.MX platform
builds when "vigiles" is inherited. While we wait for a fix in the community,
work around this issue by setting a dummy default value in the MULTIUBI_BUILD
variable.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
1)
CcxTagControlData struct in CORE/HDD/inc/CcxTagDefs.h had some fields missing compared
with 'cctags api’ which was producing CCX_TAG_DRVR_RSP_ERR_CTRL_SIZE.
2)
Then CCX_TAG_DRVR_RSP_ERR_PACKET_SIZE aroused because following paddings:
CCX_TAG_MPDU_HEADER_PAD_SIZE = 2
CCX_TAG_CONTENT_HEADER_PAD_SIZE = 3
where producing wrong alignements and sizes between the 'cctags api’ and the driver.
With changes in this commit, master branch of ‘CCxTagTest’ repository compiled
out of source code gets on well with 'cctags api’ repository and with qca driver in
both dey-2.4 and dey4.0.
Packets in the air match 100% in content in both dey-2.4 and dey4.0.
https://onedigi.atlassian.net/browse/DEL-8446
Signed-off-by: Hector Bujanda <hector.bujanda@digi.com>
For devices running 'systemd', the mount process is done through 'systemd-mount', which
spawns a system unit. Trying to mount the partition again throws an error stating that a
unit with the same name is already running. To avoid it, check if the unit is already
spawned before mounting the partition and, if so, just restart the unit.
Signed-off-by: David Escalona <david.escalona@digi.com>
add a verbatim copy of those recipes as they are provided by nxp in langdale-6.1.1-1.0.0
https://onedigi.atlassian.net/browse/DEL-8346
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
Instead of changing POKY_DEFAULT_DISTRO_FEATURES, do the distro features
configuration directly in the DISTRO_FEATURES variable. Also, add a couple
of variables (MACHINE_DISTRO_FEATURES_ADD/REMOVE) that allow machines
for extra tweaking the distro features.
While on it, clean up some distro features:
- pulseaudio: already added by DISTRO_FEATURES_BACKFILL
- bluez5, splashscreen, initrd, gplv3: not used (dead code)
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
In rare cases, the wlan module may fail to load. In this scenario, forcing the
MMC driver to rebind the interface resolves the issue, making the WLAN module
load more reliably.
This only affects to modules where the qca chip is connected through the
MMC interface.
https://onedigi.atlassian.net/browse/DEL-8361
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
There are other device managers (e.g. mdev) that do not understand those
udev rules, so do not install them unconditionally.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
The stand-alone signing script 'trustfence-sign-artifact.sh' checks
if a valid PKI tree exists (by checking the existance of four SRK
files) and if they don't, it calls trustfence-gen-pki.sh (which is
a wrapper over different generators (for HAB or AHAB) to create one.
Recipes such as 'dualboot' or 'recovery-initramfs' may need to call
openssl functions over the PKI tree. These recipes do not currently
generate the PKI tree; they expect it to be already in place.
This might not be the case if the trustfence-sign-artifact.sh script
has not been called yet.
Originally, a fake dependency on virtual/kernel recipe was made to
force it, but it doesn't quite work since the calling only happens
on deploy() while regular DEPENDS doesn't wait for this task.
If the PKI does not exist, a recipe that requires the PKI tree will
fail.
The solution is to create a function on the trustfence.bbclass that
allows any recipe to check for the existance of a PKI tree and
generate it if it doesn't exist. This is repeated inside the
trustfence-sign-artifact.sh, but it needs to be in both places
because this script must work stand-alone.
The generation of the PKI tree takes some seconds so this commit
adds a lock dir to prevent race conditions when called from
different recipes.
It also removes the fake dependency on virtual/kernel and adds a
dependency on trustfence-cst-native (which is the recipe that
provides the PKI generation tool).
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://onedigi.atlassian.net/browse/DEL-8430
(cherry picked from commit 6a8bf7afff)
The stand-alone signing script 'trustfence-sign-artifact.sh' checks
if a valid PKI tree exists (by checking the existance of four SRK
files) and if they don't, it calls trustfence-gen-pki.sh (which is
a wrapper over different generators (for HAB or AHAB) to create one.
Recipes such as 'dualboot' or 'recovery-initramfs' may need to call
openssl functions over the PKI tree. These recipes do not currently
generate the PKI tree; they expect it to be already in place.
This might not be the case if the trustfence-sign-artifact.sh script
has not been called yet.
Originally, a fake dependency on virtual/kernel recipe was made to
force it, but it doesn't quite work since the calling only happens
on deploy() while regular DEPENDS doesn't wait for this task.
If the PKI does not exist, a recipe that requires the PKI tree will
fail.
The solution is to create a function on the trustfence.bbclass that
allows any recipe to check for the existance of a PKI tree and
generate it if it doesn't exist. This is repeated inside the
trustfence-sign-artifact.sh, but it needs to be in both places
because this script must work stand-alone.
The generation of the PKI tree takes some seconds so this commit
adds a lock dir to prevent race conditions when called from
different recipes.
It also removes the fake dependency on virtual/kernel and adds a
dependency on trustfence-cst-native (which is the recipe that
provides the PKI generation tool).
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://onedigi.atlassian.net/browse/DEL-8430
By launching in system mode it is possible to play music from a shell using
pulseaudio. With change all platforms and images (with or without graphical
support) have pulseaudio working.
https://onedigi.atlassian.net/browse/DEL-8417
Signed-off-by: Tatiana Leon <Tatiana.Leon@digi.com>
This commit modifies the boot script condition to apply the overlay for DVK v1
on boards without the board_version variable defined.
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
This commit adds an overlay for DVK v1 and modifies the boot script to apply it
based on the board_version variable.
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
Partitions 'fip-a' and 'fip-b' are redundant at the moment. They are
not currently part of the dualboot system. In consequence, program
both partitons unconditionally during the install process.
Signed-off-by: Gonzalo Ruiz <Gonzalo.Ruiz@digi.com>
Our /tmp file is a symbolic link to /var/tmp, therefore a "find /tmp" returns
nothing. Force to search files inside tmp folder by using "find /tmp/".
https://onedigi.atlassian.net/browse/DEL-8410
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
Move generic IMX machine firmware to imx-digi-base.inc file. This eases
maintenance, as this file follows imx-base.inc in meta-freescale.
Still, configure platform's Digi specific firmware in each machine's
config file.
As a positive side effect, this removes the "firmware-imx-easrc-imx8mn"
firmware file from the 8M Mini, as it's only used in the 8M Nano. This
saves about 263KB.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
This commit updates the required firmware binaries for Bluetooth and Wireless
interfaces, based on the Murata release imx-kirkstone-fafnir_r1.0 that matches
with the Cypress Linux WiFi Driver (FMAC) release v5.15.58-2023_0222 (Wireless
firmware v13.10.246.300)
https://onedigi.atlassian.net/browse/DEL-8407
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
For now, we're only interested in generating the SBOM, which we can upload and
have Vigiles scan later on if needed. The report generation process adds some
overhead and can cause unwanted errors if the Vigiles server takes too long.
Enable report generation for our automated builds.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
This commit creates a new launcher group in the '/etc/xdg/weston/weston.ini' to
have access to the QT cinematicexperience.
This is done for QT5 (ccmp15, ccimx8mm, ccim8mn) and QT6 (ccimx93).
https://onedigi.atlassian.net/browse/DEL-8379
Signed-off-by: Tatiana Leon <Tatiana.Leon@digi.com>
ConnectCore 93 DVK only connects the XBee reset line (XBEE_RESET_N_GPIO) but not
the sleep request (XBEE_SLEEP_RQ_GPIO)
It also reworks the 'xbee-init' script to support empty reset
(XBEE_RESET_N_GPIO) or sleep request (XBEE_SLEEP_RQ_GPIO) values.
https://onedigi.atlassian.net/browse/DEL-8375
Signed-off-by: Tatiana Leon <Tatiana.Leon@digi.com>
True is the default since long time ago, and thus not necessary. This
follows similar changes done in other layers.
Command used:
sed -e 's|\(d\.getVar \?\)( \?\([^,()]*\), \?True)|\1(\2)|g' -i $(git grep -E 'getVar ?\( ?([^,()]*), ?True\)' | cut -d':' -f1 | sort -u)
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Symbols are needed for DTB overlays. In the CC6UL we are not using
overlays, so disable symbols generation.
https://onedigi.atlassian.net/browse/DEL-8397
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
The SW encryption is much faster than decicated HW in our platforms.
The HW encryption is limited to the use of CAAM which is used through
blob calls, therefore the cryptodev module is not required.
https://onedigi.atlassian.net/browse/DEL-8371
Signed-off-by: Isaac Hermida <isaac.hermida@digi.com>
Set parameter 'greentxConfig__0_0=0x2' to use the optimal TxPower
in MCS7 data rates, improving performance.
Also, adjust maximum TxPower in the 5GHz band to account for
output power tolerances.
The new BDF is:
- bdwlan30_US.bin (53072f8af541a49e4ed9c22698b1912f)
https://onedigi.atlassian.net/browse/CC6UL-1302https://onedigi.atlassian.net/browse/DEL-8364
Signed-off-by: Gonzalo Ruiz <Gonzalo.Ruiz@digi.com>
accel-video was being used only for including or not gstreamer in the
different DEY images. But then we had exceptions to include gstreamer for
machines that do not define accel-video, so just follow what the ccmp15
does, and use a generic 'gstreamer' distro feature to add 'dey-gstreamer'
support to the images.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
MACHINE_GSTREAMER_1_0_PLUGIN should contain the machine-specific gstreamer
plugin to use, but not the rest of the packages to be included in the
rootfs. So clean that variable up, and add the dependent packages in the
dey-gstreamer package group.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
This is a machine specific setting, and moving it to the machine config
allows to get rid of the recipe bbappends.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Number of bootup logos is now configured using fbcon=logo-count parameter,
so use it instead of our deprecated custom code in the kernel.
For backwards compatibility, we add this parameter in the u-boot boot
script for all platforms but the ccimx93, where this is directly handled
by u-boot (v2022.04).
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
This reverts commit 2bdfdc92e1.
This suffix was removed on error. The artifact does have the suffix.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
The class 'boot-artifacts.bbclass' was created to generate a
list of the bootable artifacts that must be copied from the
deploy dir to the installer ZIP file, so that the installer
has all the possible bootloader files to update any variant
of the hardware.
The class was somewhat over-engineered to produce the list,
specially for the cc8x, with the variants of SoC revision,
RAM size and width. With the arrival of ST family, it got
more complex, as the artifacts don't even come from U-Boot
recipe.
To remove complexity, this commit removes the bbclass and
moves the list to the platform config file.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
This commit adds additional library links that are require to
make weston working with the new kernel version of the STM
BSP 22_11_23.
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
This commit changes the wayland user from weston to root. That
makes video and audio playback possible for the root user.
https://onedigi.atlassian.net/browse/DEL-8211
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
meta-freescale did another merge of recipe updates that we need to follow
to prevent build failures.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
For the momment, Fusion support is not ready in the 5.15 kernel, so do
not add the dtb overlay.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
meta-freescale started updating the recipes to NXP's
rel_imx_5.15.71_2.2.0 release, so now we have a bunch of overlayed
recipes we can clean up.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
For platforms that do not define FIP_UBOOT_DTB, the
'd.getVar('FIP_UBOOT_DTB') gets evaluated to None, which is not equal to
"", and thus the code continues in the wrong "if" branch.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
This is a verbatim copy of the recipe in meta-imx. It is required to
build Wayland based graphical images for ccimx93.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
The sdcard image generation code expects a boot artifact named after
machine's name. On the other hand, u-boot recipe creates symlinks with
the build config's name. So couple machine with build config label to
prevent a failure when building the SD card image.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Crank storyboard engine has runtime dependencies on libELG.so and
libGLESv2.so, which usually are just symlinks that go to the "-dev"
package. As they are needed at runtime, move the files to the normal
(not -dev) package.
Also add explicit RPROVIDES for those libraries, as otherwise the build
fails with:
QA Issue:
/usr/share/crank/sbengine/plugins/librender-plugin-opengles_2.0.so
contained in package crank-sbengine requires libEGL.so, but no providers
found in RDEPENDS:crank-sbengine? [file-rdeps]
QA Issue:
/usr/share/crank/sbengine/plugins/librender-plugin-opengles_2.0.so
contained in package crank-sbengine requires libGLESv2.so, but no providers
found in RDEPENDS:crank-sbengine? [file-rdeps]
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Although in theory, you can use any label to name the different u-boot
build configurations, we have them coupled to machine names in the
boot-artifacts bbclass, and also in the default boot artifact filename
in the firmware installation scripts.
So fix that up for the ccimx93 in the machine config, and create the
proper symlinks in the do_deploy imx-boot recipe.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
This variable was removed from meta-st-stm32mp so we need to get rid of it
in meta-digi, too.
Reported-by: Javier Viguera <javier.viguera@digi.com>
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://onedigi.atlassian.net/browse/DEL-8268
Both recipes (imx-boot and imx-mkimage) use the same source code
repository, so update both of them to the new NXP release, by copying
with minimal changes the recipes in meta-imx.
Also convert the original 'imx-mkimage' recipe, which was only for
native class, to a full target, native, nativesdk recipe. We need this
to be able to include the nativesdk one in our toolchain.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
For this platform the bootable artifact is imx-boot based, so configure
some variables accordingly.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Rework the "build_uboot_scripts" to prevent changing the templates in
the WORKDIR, as those are part of the SRC_URI. Instead, change the
deployed scripts by using "sed" and redirection.
Also, removed UBOOT_HAS_FASTBOOT altogether, as there is no platform
that does not support fastboot.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Instead of overriding the whole do_compile function, just to reconfigure
u-boot for Trustfence, create a do_configure pre-function that takes care
of that. This allows the removal of duplicated code.
Also, disable the generation of u-boot environment artifacts. We are
not using them and so many u-boot artifacts in the deploy directory
are confusing.
Finally, adjust the names of the TF u-boot artifacts in the do_deploy
append function.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Also enable recipe for ccimx93, and pass the correct DTC flags to create
overlays capable DTBs.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Also:
* Support ccimx93
* Add all the patches regardless of the platform (remove overrides). The
patches do not clash, so adding all of them eases the maintanance and
the migration to new versions of the imx-atf.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
These are just a verbatim copy of the ccimx8mm ones, so the project is
buildable. This file list should be revisited and adapted for the
ccimx93.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Use += operator to prevent resetting the value of the EXTRA_IMAGEDEPENDS
variable. That is how it's mostly used elsewhere.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
This is later overridden in the machine config files, but a default
(not empty) value is needed, to prevent a syntactic error in
init-ifupdown recipe (where it is used).
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
The poky recipes were updated on the minor version to 1.20.4
but the bbappends were 1.20.3 specific so they did not apply.
Use a wildcard to have them apply even if the minor version
changes upstream.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
(cherry picked from commit 0c73b31cf5)
The poky recipes were updated on the minor version to 1.20.4
but the bbappends were 1.20.3 specific so they did not apply.
Use a wildcard to have them apply even if the minor version
changes upstream.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
This allows the user 'weston', which is running the video
backend, to access files on external media, such as USB
disks and microSD card.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://onedigi.atlassian.net/browse/DEL-8208
In the past, this file was cloned from poky to skip mounting
an already mounted device. This condition was done on poky's
version so the cloned file is no longer needed.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
A new set of meta-freescale updates broke our layer, because they
updated opencv package and our bbappend does not apply anymore.
The build fails at parsing:
ERROR: No recipes in default available for:
meta-digi/meta-digi-dey/dynamic-layers/freescale-layer/recipes-support/opencv/opencv_4.5.2.imx.bbappend
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
This allows users of the layer to override the value with a different
default. Same change was done in meta-freescale's imx-base file.
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Artifact encryption is now supported for ccimx8mn and ccimx8mm.
This reverts commit 1134e4c07c.
https://onedigi.atlassian.net/browse/DEL-7915
Signed-off-by: Gonzalo Ruiz <Gonzalo.Ruiz@digi.com>
(cherry picked from commit 588005bb4b2200e79b180f77671304d9c5bdf509)
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
When read-only feature is enabled, the rootfs should be .squashfs
and not .ubifs.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
(cherry picked from commit c32278af74cea8cb38aa81590eaa867be1c739c9)
Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Add configuration 'BUILD_UBOOT_SCRIPTS' to select whether to build the
boot and install scripts or not, and set it to 'true' by default.
This allows removing the scripts on upper Yocto layers.
Signed-off-by: Gonzalo Ruiz <Gonzalo.Ruiz@digi.com>
All the dualboot logic will be checked in run time.
To do this:
* Include the altboot.src by default in all the images
* Create a post installation script to change the
firmware_download_path in the cloud connector
* Unify the swupdate file descriptor for dual and single boot
Signed-off-by: Francisco Gil <francisco.gilmartinez@digi.com>
This commit removes duplicated and unused build artifacts for the ccmp1
platforms. Also fixes a build warning related with flashlayout config file.
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
Mike Engel
Hector Palacios
Javier Viguera
Hector Bujanda
Isaac Hermida
Gabriel Valcazar
Francisco Gil
Arturo Buzarra
Tatiana Leon
David Escalona
Gonzalo Ruiz