Aside from code improvements, this version includes fixes for the following
vulnerabilities:
* CVE-2020-25681
* CVE-2020-25682
* CVE-2020-25683
* CVE-2020-25684
* CVE-2020-25685
* CVE-2020-25686
* CVE-2020-25687
While at it, remove files that were inherited from an older vulnerability fix.
These files consist of scripts, patches and configuration files that already
exist in the original meta-openembedded recipe directory.
Remake lua.patch, since the diff context has changed in v2.83.
https://jira.digi.com/browse/DEL-7389
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
When manually changing the partition table, it could happen that
a UBI volume already exists in the 'update' partition.
If not erased, the system may find the old UBI volume (with wrong
geometry information) and try to mount it which will result in
failure.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
On commit 1e5cafeb79 a fall-back
update command was introduced in case the newest command fails.
If the newest command succeeds, however, the 'test' command for
error doesn't match (there is no error) and the return code of
such test is "1". On the next check for errors, this results on
an error, when we really mean to continue because the first
command was successful.
Move the second error check inside the error path of the first
attempt.
Reported-by: Francisco Gil <francisco.gilmartinez@digi.com>
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
These changes were originally applied to the ccimx6 to fix a trailing effect in
the desktop, but we've recently discovered an HDMI hotplug issue on the
ccimx6qp that is also solved when using the g2d backend. Apply the workarounds
to both platforms.
https://jira.digi.com/browse/DEL-7380
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
In order to revoke SRKs in platforms with AHAB we need to set a mask
during the signing/encryption process.
Create new TRUSTFENCE_SRK_REVOKE_MASK variable to export the
SRK_REVOKE_MASK variable required by the imx-boot signing script.
The revoke mask is not necessary for signing/encryption of other artifacts,
so set it by default to 0x0.
Signed-off-by: Gonzalo Ruiz <Gonzalo.Ruiz@digi.com>
Add support to sign and encrypt OS artifacts for AHAB devices.
https://jira.digi.com/browse/DEL-7371
Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
The 'source file system' was removed as an argument from the
'update' command in U-Boot v2020.04.
For platforms using such version, remove it from the update fw
scripts.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://jira.digi.com/browse/DUB-983
This command isn't essential and might not be available on all systems, so
remove it. Use the "oflag=sync" dd parameter instead.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
The buildserver uses this default value when building framebuffer images. Since
the WebKit is not yet compatible with framebuffer images, the builds fail.
Remove dey-image-webkit from the default target lists.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
A similar change was done in the dey-3.0/maint branch for the uSD installation
scripts, but since USB scripts were added in dey-3.0/master, apply the same
to them as well.
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
The landing page for the WebKit examples has gone through a visual overhaul to
improve the overall user experience, so adapt its recipe accordingly. Since the
page now contains resources that are relatively large (such as images and
extensive stylesheets), remove its elements from the recipe directory and
obtain them from Digi's FTP server instead.
https://jira.digi.com/browse/DEL-7365
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
Since this component pulls in Optee dependencies, which in turn depend on
packages from meta-python2, add this layer to the ccimx8mn-dvk's default
bblayers.
Signed-off-by: Mike Engel <Mike.Engel@digi.com>
https://jira.digi.com/browse/DEL-7025
Since there is only 1 supported version of cst, the include file is
only used once.
Move all the recipe implementation to the *.bb recipe and remove the
*.inc file.
Signed-off-by: Gonzalo Ruiz <Gonzalo.Ruiz@digi.com>
Since cst-3.3.1 is now distributed with a BSD-3-Clause license, it is allowed
to distribute its source code from the Digi FTP.
Fetch the tarball from that location.
Signed-off-by: Gonzalo Ruiz <Gonzalo.Ruiz@digi.com>
CC8X SOMs code the RAM size on the OTP bits so this fall-back table
shouldn't be necessary, but update it with latest variants just
in case.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
This machine was not building the 512MB 16bit U-Boot.
While on it, and for consistency, re-order to make the 2GB 32bit
the default (same as the SBC Pro), since the SBC Express was
discontinued as a product.
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
https://jira.digi.com/browse/DEL-7363
Add Compliance Test Limits (CTL) information for FCC, CE and TELEC
certifications to the CC8MN US Board Data File.
The rest of the file (calibration, target power levels, etc.) remains
intact.
Updated file:
- bdwlan30_US.bin (MD5SUM: f9600f7bf4d601494b9bbe1ccbe94d6a)
https://jira.digi.com/browse/DEL-7359
Signed-off-by: Gonzalo Ruiz <Gonzalo.Ruiz@digi.com>
CST was being built linking to the openssl libcrypto library from the host.
When the openssl version in the host didn't match the version in the SDK,
the SDK build failed like this:
Error:
Problem 1: package nativesdk-packagegroup-sdk-host-1.0-r12.0.x86_64_nativesdk requires nativesdk-trustfence-cst, but none of the providers can be installed
- conflicting requests
- nothing provides libcrypto.so.1.0.0()(64bit) needed by nativesdk-trustfence-cst-3.3.1-r0.0.x86_64_nativesdk
- nothing provides libcrypto.so.1.0.0(OPENSSL_1.0.0)(64bit) needed by nativesdk-trustfence-cst-3.3.1-r0.0.x86_64_nativesdk
- nothing provides libcrypto.so.1.0.0(OPENSSL_1.0.1)(64bit) needed by nativesdk-trustfence-cst-3.3.1-r0.0.x86_64_nativesdk
Problem 2: package nativesdk-packagegroup-qt5-toolchain-host-1.0-r0.0.x86_64_nativesdk requires nativesdk-packagegroup-sdk-host, but none of the providers can be installed
- package nativesdk-packagegroup-sdk-host-1.0-r12.0.x86_64_nativesdk requires nativesdk-trustfence-cst, but none of the providers can be installed
- conflicting requests
- nothing provides libcrypto.so.1.0.0()(64bit) needed by nativesdk-trustfence-cst-3.3.1-r0.0.x86_64_nativesdk
- nothing provides libcrypto.so.1.0.0(OPENSSL_1.0.0)(64bit) needed by nativesdk-trustfence-cst-3.3.1-r0.0.x86_64_nativesdk
- nothing provides libcrypto.so.1.0.0(OPENSSL_1.0.1)(64bit) needed by nativesdk-trustfence-cst-3.3.1-r0.0.x86_64_nativesdk
Fix that by adding the native dependencies include and lib folders to
the CST build. Also add openssl-native as a dependency for the SDK build,
otherwise it wont link to the SDK libcrypto library.
Additionally, to allow running CST in a host machine where the openssl version
does not match the version in the SDK, libcrypto library is statically linked.
https://jira.digi.com/browse/DEL-7346
Signed-off-by: Gonzalo Ruiz <Gonzalo.Ruiz@digi.com>
(cherry picked from commit a95b3ad602)
The Qt WPE plugin has an implicit dependency with libgbm, which is only
available on i.MX8 platforms. Also, it pulls in several Qt dependencies,
increasing the total rootfs image size by about 50MiB. Remove said plugin to
completely separate Qt and WebKit functionality.
https://jira.digi.com/browse/DEL-7339
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
This recipe installs some videos that can be used to test the WebKit's hardware
acceleration during video decoding. Modify the landing page to be able to
access these videos.
https://jira.digi.com/browse/DEL-7314https://jira.digi.com/browse/DEL-7339
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
This recipe installs the main page of the WebKit examples, from which all other
examples can be accessed. For now, only include the WebGL examples.
Since the landing page recipe needs to know which WebGL demos are being
installed and the webserver path where everything is installed, move some of
the variables used in the webglsamples recipe into an *.inc file to be able to
re-use said variables in different recipes.
Use the Digi embedded documentation CSS file for now, so the landing page looks
more on-brand.
https://jira.digi.com/browse/DEL-7314https://jira.digi.com/browse/DEL-7339
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
We're going to be using the busybox http server to house the WebKit examples,
so we need to get rid of any files that might interfere with it. Keep the files
for the ccimx6ul, since it doesn't support WebKit.
https://jira.digi.com/browse/DEL-7314https://jira.digi.com/browse/DEL-7339
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
CST was being built linking to the openssl libcrypto library from the host.
When the openssl version in the host didn't match the version in the SDK,
the SDK build failed like this:
Error:
Problem 1: package nativesdk-packagegroup-sdk-host-1.0-r12.0.x86_64_nativesdk requires nativesdk-trustfence-cst, but none of the providers can be installed
- conflicting requests
- nothing provides libcrypto.so.1.0.0()(64bit) needed by nativesdk-trustfence-cst-3.3.1-r0.0.x86_64_nativesdk
- nothing provides libcrypto.so.1.0.0(OPENSSL_1.0.0)(64bit) needed by nativesdk-trustfence-cst-3.3.1-r0.0.x86_64_nativesdk
- nothing provides libcrypto.so.1.0.0(OPENSSL_1.0.1)(64bit) needed by nativesdk-trustfence-cst-3.3.1-r0.0.x86_64_nativesdk
Problem 2: package nativesdk-packagegroup-qt5-toolchain-host-1.0-r0.0.x86_64_nativesdk requires nativesdk-packagegroup-sdk-host, but none of the providers can be installed
- package nativesdk-packagegroup-sdk-host-1.0-r12.0.x86_64_nativesdk requires nativesdk-trustfence-cst, but none of the providers can be installed
- conflicting requests
- nothing provides libcrypto.so.1.0.0()(64bit) needed by nativesdk-trustfence-cst-3.3.1-r0.0.x86_64_nativesdk
- nothing provides libcrypto.so.1.0.0(OPENSSL_1.0.0)(64bit) needed by nativesdk-trustfence-cst-3.3.1-r0.0.x86_64_nativesdk
- nothing provides libcrypto.so.1.0.0(OPENSSL_1.0.1)(64bit) needed by nativesdk-trustfence-cst-3.3.1-r0.0.x86_64_nativesdk
Fix that by adding the native dependencies include and lib folders to
the CST build. Also add openssl-native as a dependency for the SDK build,
otherwise it wont link to the SDK libcrypto library.
Additionally, to allow running CST in a host machine where the openssl version
does not match the version in the SDK, libcrypto library is statically linked.
https://jira.digi.com/browse/DEL-7346
Signed-off-by: Gonzalo Ruiz <Gonzalo.Ruiz@digi.com>
This recipe installs a subset of the samples available at
https://webglsamples.org/ onto the target's web server, to be able to run said
examples locally without needing internet access. Make sure not to install any
source files to avoid making the package too large.
https://jira.digi.com/browse/DEL-7314https://jira.digi.com/browse/DEL-7339
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
Add two patches to improve user experience, such as making the browser
fullscreen and removing the otherwise necessary --platform parameter.
Also, make www.digi.com the default URI to avoid having to explicitly pass a
URI when launching cog.
https://jira.digi.com/browse/DEL-7311https://jira.digi.com/browse/DEL-7339
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
The i.MX8X video decoder requires a specific NXP video converter, otherwise
videos will appear with several glitches. This patch adds said plugin in the
WPE webkit's internal gstreamer pipeline.
https://jira.digi.com/browse/DEL-7311https://jira.digi.com/browse/DEL-7339
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
The EGL library provided by NXP in the v5.4.47 BSP has a bug where a NULL
pointer is returned by eglGetProcAddress() when trying to obtain the entrypoint
for a specific function used throughout the cog code. This caused cog to crash
immediately after launching it.
Recently, a fix was made available in the cog repo, so backport it to the
latest available revision of cog in meta-webkit and apply it.
https://jira.digi.com/browse/DEL-7311https://jira.digi.com/browse/DEL-7312https://jira.digi.com/browse/DEL-7339
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
This image is very similar to dey-image-qt, but it includes the WebKit
packagegroup instead of the Qt one. Said packagegroup contains all of the
elements needed to run a WebKit-based browser environment in DEY.
This image requires the meta-webkit layer, so include it in our default
bblayers template. For now, include all WebKit related recipes in a dynamic
layer, because the ccimx6ul doesn't support WebKit and its projects don't need
meta-webkit at all.
https://jira.digi.com/browse/DEL-7339
Signed-off-by: Gabriel Valcazar <gabriel.valcazar@digi.com>
Arturo Buzarra
Hector Bujanda
Gabriel Valcazar
Hector Palacios
Gonzalo Ruiz
Mike Engel