release 2.3.0 dev-->master merge

CHANGELOG.md

@@ -1,3 +1,62 @@
+# Pelion Edge 2.3.0 - 1st April 2021
+
+### New features
+
+This release adds features to the Linux microPlatform (LmP) OS, which supports NXP's i.MX8 development platform i.MX 8M Mini EVK and AVNet's Xilinx MPSoC Starter kit UltraZed-EG IOCC. This release:
+
+- [TPM] Introduces [Secure Pelion Edge with the Trusted Platform Module (TPM) v2.0](https://developer.pelion.com/docs/device-management-edge/latest/secure-with-tpm.html):
+   - [meta-parsec] Leverages [Platfrom Abstraction for Security (Parsec)](https://parallaxsecond.github.io/parsec-book/index.html) to interface with TPM and adds a [new meta layer](https://github.com/PelionIoT/meta-parsec) to build `parsec` service 0.6.0.
+   - [swtpm] `meta-parsec` layer also brings in [IBM's software TPM](https://sourceforge.net/projects/ibmswtpm2/) `swtpm` package. If your hardware supports physical TPM, we recommend you comment out this package from the `console-image-lmp.bb` file.
+   - [parsec-se-driver] Adds a recipe to build [Parsec Secure Element driver](https://github.com/parallaxsecond/parsec-se-driver) 0.4.0, which is a dependency of Edge Core and mbed-fcce package when compiled with `MBED_EDGE_CORE_CONFIG_PARSEC_TPM_SE_SUPPORT=ON`.
+   - Adds `meta-rust`, `meta-clang` and `meta-security/meta-tpm`, which are prerequisites to build Parsec and related packages.
+   - [parsec-tool] Adds a recipe to build [Parsec Tool](https://github.com/parallaxsecond/parsec-tool), a command-line utility to debug and cross-validate the working of Parsec service and TPM.
+- [edge-core] Updates Edge Core to [0.16.1](https://github.com/PelionIoT/mbed-edge/blob/master/CHANGELOG.md#release-0160-2021-3-15).
+   - Reduces the default log level to WARN.
+   - Adds `mbed_cloud_client_user_config.h`, so you can set the values for your use case. This overwrites the default config options set by Edge Core. The default lifetime value is set to 1800s (30min).
+   - Explicitly defines HTTP_PROXY and HTTPS_PROXY environment variables.
+- [edge-examples] Updates examples to [0.16.0](https://github.com/PelionIoT/mbed-edge-examples/blob/master/CHANGELOG.md#release-0160-2021-03-15).
+- [mbed-fcce] Upgrades factory-configurator-client-example to v4.7.1.
+   - Renames the package name from `mbed-fcc` to `mbed-fcce`.
+   - Explicitly defines HTTP_PROXY and HTTPS_PROXY environment variables.
+- [verified-logging] By default, the gateway is configured with persistent journal logging for LMP UltraZed-EG IOCC and i.MX 8M Mini EVK. To disable persistent logging, set flag `VOLATILE_LOG_DIR = "no"` in `local.conf`, and update the `Storage` in recipes-core/systemd/systemd-conf/journald.conf. Note: If you disable persistent logging, the FSS feature won't work.
+- Updates `identity-tool`, `kubelet` and `info-tool` package source file protocol from SSH to HTTPS.
+
+### Bug fixes
+
+- [pt-example] Pelion Edge 2.2 used protocol translator example 0.13.0, which wasn't compatible with Edge Core 0.15.0. We fixed this by upgrading the example to version 0.16.0.
+- In Pelion Edge 2.2, using the i.MX 8M Mini EVK in production mode with firmware update enabled failed with a FOTA_ASSERT after the reboot. This has been fixed.
+
+### Known issues
+
+- The Pelion Device Management portal is not correctly updated after a firmware campaign in some instances.
+- [maestro] The FeatureMgmt config resource is initialized with a maximum 3.8KB of file content. The remaining file content is truncated during initialization. This is most likely due to the limitation of the gorilla/websocket library but needs further investigation. However, you can still push a file size of a maximum of 64KB through cloud service APIs.
+- [pt-example] `cpu-temperature` device reports random values because the default CPU temperature file is not the same on Yocto and LmP.
+- [info] The `info` command must be run with `sudo` on LMP-based boards (UltraZed-EG IOCC and i.MX 8M Mini EVK).
+- [info] The `info` command on the UltraZed-EG IOCC attempts to read the CPU temperature when the temperature file does not exist. This results in a cat error message.
+- The LmP build will enable SW TPM and Parsec stacks by default in all configuration, including developer certificate configurations. However, as it will not be used or set up in those configurations the logs will show some TPM related errors - those logs can be ignored.
+
+#### AVNET ZU3EG
+
+- If you enable kernel configurations [CPU_IDLE](https://cateee.net/lkddb/web-lkddb/CPU_IDLE.html) and [PREEMPT](https://cateee.net/lkddb/web-lkddb/PREEMPT.html), the LmP release including PetaLinux 2020.2 does not work in a stable manner. Our default configuration has those disabled. If you have any issues with those configurations, please contact Xilinx support.
+- You cannot do firmware update from Edge 2.2 to Edge 2.3 on the AVNET ZU3EG board due to LmP v79 release FPGA-support changes. The changes have interdepencies between the BOOT image and kernel image and as in the current update you can only update ther kernel image it fails to boot up correctly with the Edge 2.2 based BOOT image (as it does not supply the required updated device tree/FPGA files etc.). So, update to Edge 2.3 image must be done with manual flashing on ZU3EG targets.
+
+### Limitations
+
+- There is a maximum size limit to the full registration message, which limits the number of devices Edge can host:
+   - Maximum registration message size is 64KB.
+   - Hosted devices with five typical Resources consume ~280B (the exact size depends, for example, on the length of resource paths). This limits the maximum number to 270 devices.
+   - The more Resources you have, the fewer devices can be supported.
+   - The Pelion Edge device Resources are also included in the same registration message.
+   - **Test the limits with your configuration, and set guidance accordingly.**
+- Devices behind Pelion Edge don't support [auto-observation](https://www.pelion.com/docs/device-management/current/connecting/device-guidelines.html#auto-observation).
+- Pelion Device Management Client enabled devices must first boostrap to the Pelion Device Management cloud before connecting to Pelion Edge.
+- No moving devices are supported (such as the device moving from Pelion Edge to another edge device.)
+- LmP's base partition table is set above 10GB to support three upgrade images in OSTree. Therefore, we only support SD card installation (compared to supporting onboard EMMC or NAND) for the i.MX 8M Mini EVK and the UltraZed-EG IOCC.
+
+### Important note
+
+While provisioning your gateway, please use `vendor-id=42fa7b48-1a65-43aa-890f-8c704daade54` to unlock the rich node features, such as gateway logs and gateway terminal in the Pelion web portal.
+
 # Pelion Edge 2.2.0 - February 2021
 
 ## New features

conf/bblayers.conf.sample

@@ -19,5 +19,9 @@ BBLAYERS ?= " \
     ##OEROOT##/meta-virtualization \
     ##OEROOT##/meta-raspberrypi \
     ##OEROOT##/meta-security \
+    ##OEROOT##/meta-security/meta-tpm \
     ##OEROOT##/meta-mbed-edge \
+    ##OEROOT##/meta-rust \
+    ##OEROOT##/meta-clang \
+    ##OEROOT##/meta-parsec \
 "

conf/local.conf.sample

@@ -98,6 +98,4 @@ RM_OLD_IMAGE = "1"
 INHERIT += "rm_work"
 CONF_VERSION = "1"
 
-export SSH_AUTH_SOCK
-
 DISABLE_VC4GRAPHICS = "1"

meta-lmp-support/conf/machine/include/lmp-factory-custom.inc

@@ -1,4 +1,4 @@
-WKS_FILE_mx8mm_sota = "sdimage-imx8-sota-config.wks.in"
+WKS_FILE_sota_mx8mm = "sdimage-imx8-spl-sota-config.wks.in"
 
 #Use ttyAMA0 instead of ttyS0 that is set in meta-lmp
 KERNEL_SERIAL_rpi = "${@oe.utils.conditional("ENABLE_UART", "1", "console=ttyAMA0,115200", "", d)}"

meta-lmp-support/recipes-bsp/device-tree/device-tree.bbappend

@@ -0,0 +1,7 @@
+FILESEXTRAPATHS_prepend_uz := "${THISDIR}/files:"
+
+SRC_URI_append_uz = " \
+        file://Read-EMAC-from-EEPROM-on-uz3eg-iocc.patch;patchdir=..;striplevel=8 \
+"
+
+COMPATIBLE_MACHINE_uz = ".*"

meta-lmp-support/recipes-bsp/device-tree/files/uz3eg-iocc/Read-EMAC-from-EEPROM-on-uz3eg-iocc.patch

@@ -0,0 +1,42 @@
+From 536709ded5ff28f82c42bdc04a1378255a3a0371 Mon Sep 17 00:00:00 2001
+From: Ari Parkkila <[email protected]>
+Date: Tue, 30 Mar 2021 11:10:45 +0300
+Subject: [PATCH] Read EMAC from EEPROM on uz3eg-iocc
+
+
+diff --git a/meta-lmp-bsp/dynamic-layers/xilinx/recipes-bsp/device-tree/device-tree/uz3eg-iocc/system-board.dtsi b/meta-lmp-bsp/dynamic-layers/xilinx/recipes-bsp/device-tree/device-tree/uz3eg-iocc/system-board.dtsi
+index 1750937..7b01a4b 100644
+--- a/meta-lmp-bsp/dynamic-layers/xilinx/recipes-bsp/device-tree/device-tree/uz3eg-iocc/system-board.dtsi
++++ b/meta-lmp-bsp/dynamic-layers/xilinx/recipes-bsp/device-tree/device-tree/uz3eg-iocc/system-board.dtsi
+@@ -30,6 +30,11 @@
+ 			linux,default-trigger = "heartbeat";
+ 		};
+ 	};
++
++        chosen {
++                xlnx,eeprom = &eeprom; /* EMAC on EEPROM */
++        };
++
+ };
+
+ /* Ethernet0 with hard-coded MAC */
+@@ -37,7 +42,6 @@
+ 	status = "okay";
+ 	phy-handle = <&phy0>;
+ 	phy-mode = "rgmii-id";
+-	local-mac-address = [00 0a 35 00 02 90];
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&pinctrl_gem3_default>;
+ 	phy0: ethernet-phy@9 {
+@@ -69,7 +73,7 @@
+ 			#size-cells = <0>;
+ 			reg = <0>;
+ 			/* IIC_EEPROM */
+-			eeprom@51 { /* U5 on UZ3EG IOCC and U7 on the UZ7EV EVCC*/
++			eeprom: eeprom@51 { /* U5 on UZ3EG IOCC and U7 on the UZ7EV EVCC*/
+ 				compatible = "atmel,24c08";
+ 				reg = <0x51>;
+ 				#address-cells = <0x01>;
+-- 
+2.17.1
+

meta-lmp-support/recipes-bsp/u-boot/u-boot-fio/imx8mmevk/lmp.cfg

@@ -1,6 +1,13 @@
+CONFIG_SPL_DM=y
+CONFIG_SPL_OF_CONTROL=y
 CONFIG_SPL_FIT=y
 CONFIG_SPL_FIT_SIGNATURE=y
 CONFIG_SPL_LOAD_FIT=y
+# CONFIG_SPL_FIT_IMAGE_TINY is not set
+CONFIG_SPL_CRYPTO_SUPPORT=y
+CONFIG_SPL_HASH_SUPPORT=y
+CONFIG_RSA=y
+CONFIG_HASH=y
 # CONFIG_SPL_LEGACY_IMAGE_SUPPORT is not set
 # CONFIG_SPL_EFI_PARTITION is not set
 # CONFIG_SPL_PARTITION_UUIDS is not set
@@ -14,10 +21,18 @@ CONFIG_OF_LIBFDT_OVERLAY=y
 CONFIG_FIT=y
 CONFIG_FIT_SIGNATURE=y
 CONFIG_FIT_SIGNATURE_STRICT=y
+CONFIG_SPL_FIT_SIGNATURE=y
+CONFIG_SPL_FIT_SIGNATURE_STRICT=y
 CONFIG_FIT_VERBOSE=y
 # CONFIG_LEGACY_IMAGE_FORMAT is not set
 CONFIG_PARTITION_UUIDS=y
+CONFIG_TEE=y
+CONFIG_OPTEE=y
+CONFIG_FIOVB=y
+CONFIG_CMD_FIOVB=y
 CONFIG_CMD_XIMG=y
+CONFIG_SUPPORT_EMMC_RPMB=y
+CONFIG_SUPPORT_EMMC_BOOT=y
 # CONFIG_ENV_IS_IN_MMC is not set
 CONFIG_ENV_IS_IN_FAT=y
 CONFIG_ENV_FAT_INTERFACE="mmc"
@@ -31,14 +46,18 @@ CONFIG_BOOTCOUNT_ENV=y
 CONFIG_BOOTDELAY=-2
 CONFIG_USE_BOOTCOMMAND=y
 CONFIG_BOOTCOMMAND="fatload mmc 1:1 ${loadaddr} /boot.itb; setenv verify 1; source ${loadaddr}; reset"
+# CONFIG_SPL_DM_MMC is not set
+# CONFIG_SPL_BLK is not set
 # CONFIG_ANDROID_BOOT_IMAGE is not set
 # CONFIG_CMD_NFS is not set
 # CONFIG_CMD_SYSBOOT is not set
 # CONFIG_CMD_BDI is not set
 # CONFIG_CMD_BMODE is not set
 # CONFIG_CMD_PXE is not set
 # CONFIG_CMD_SATA is not set
+# CONFIG_CMD_USB is not set
 # CONFIG_CMD_USB_MASS_STORAGE is not set
+# CONFIG_CMD_USB_SDP is not set
 # CONFIG_CMD_BOOTD is not set
 # CONFIG_CMD_BOOTZ is not set
 # CONFIG_CMD_FUSE is not set
@@ -52,9 +71,11 @@ CONFIG_BOOTCOMMAND="fatload mmc 1:1 ${loadaddr} /boot.itb; setenv verify 1; sour
 # CONFIG_DM_SCSI is not set
 # CONFIG_USB_FUNCTION_FASTBOOT is not set
 # CONFIG_FASTBOOT is not set
+# CONFIG_USB is not set
 # CONFIG_USB_STORAGE is not set
 # CONFIG_USB_KEYBOARD is not set
 # CONFIG_USB_HOST_ETHER is not set
+# CONFIG_USB_TCPC is not set
 # CONFIG_BOOTM_NETBSD is not set
 # CONFIG_BOOTM_PLAN9 is not set
 # CONFIG_BOOTM_RTEMS is not set

meta-lmp-support/recipes-bsp/u-boot/u-boot-fio_%.bbappend

@@ -1,3 +1,3 @@
-FILESEXTRAPATHS_prepend_imx8mmevk := "${THISDIR}/${PN}/imx8mmevk:"
+FILESEXTRAPATHS_prepend_imx8mmevk := "${THISDIR}/${PN}:"
 
 SRC_URI_append_imx8mmevk += "file://0001-Disable-1V8-on-usdhc2-for-SDMUX.patch "

meta-lmp-support/recipes-core/images/console-image-lmp.bb

@@ -2,11 +2,8 @@ SUMMARY = "Linux microPlatform image running Pelion Edge"
 
 require recipes-samples/images/lmp-image-common.inc
 
-require recipes-samples/images/lmp-feature-factory.inc
-require recipes-samples/images/lmp-feature-wireguard.inc
 require recipes-samples/images/lmp-feature-docker.inc
 require recipes-samples/images/lmp-feature-wifi.inc
-require recipes-samples/images/lmp-feature-ota-utils.inc
 require recipes-samples/images/lmp-feature-sbin-path-helper.inc
 
 IMAGE_FEATURES[validitems] += "tools-debug tools-sdk"
@@ -44,7 +41,7 @@ path-set \
 pelion-version \
 "
 PELION_BASE_OPTIONAL = " \
-mbed-fcc \
+mbed-fcce \
 "
 
 PELION_SYSTEMS_MANAGEMENT = "\
@@ -70,6 +67,19 @@ git \
 panic \
 "
 
+PARSEC_SERVICE = " \
+parsec-service-tpm \
+"
+
+PARSEC_TOOL = " \
+parsec-tool \
+"
+
+SOFTWARE_TPM = " \
+swtpm-service \
+tpm2-tools \
+"
+
 IMAGE_INSTALL += " \
 ${CORE_OS} \
 ${PELION_BASE_REQUIRED} \
@@ -79,8 +89,28 @@ ${PELION_SYSTEMS_MANAGEMENT} \
 ${PELION_CONTAINER_ORCHESTRATION} \
 ${PELION_TESTING} \
 ${MACHINE_EXTRA_RRECOMMENDS} \
+${PARSEC_SERVICE} \
+${PARSEC_TOOL} \
+${SOFTWARE_TPM} \
 "
 
+# Create a parsec user and then set permissions on the parsec components to control access.
+# Create the parsec user.
+inherit extrausers
+EXTRA_USERS_PARAMS += "\
+    useradd parsec;\
+"
+
+# modify the ownership of the folders and files that only the parsec user needs access to.
+
+ROOTFS_POSTPROCESS_COMMAND_append = " \
+  setup_parsec_files; \
+"
+setup_parsec_files() {
+    chown -R parsec:parsec ${IMAGE_ROOTFS}/etc/parsec
+    chown -R parsec:parsec ${IMAGE_ROOTFS}/usr/libexec/parsec
+    chown parsec:parsec ${IMAGE_ROOTFS}/usr/bin/swtpm.sh
+}
 set_local_timezone() {
     ln -sf /usr/share/zoneinfo/EST5EDT ${IMAGE_ROOTFS}/etc/localtime
 }

meta-lmp-support/wic/sdimage-imx8-sota-config.wks.in → meta-lmp-support/wic/sdimage-imx8-spl-sota-config.wks.in

@@ -1,5 +1,6 @@
 # Image partition layout for IMX8 Mini EVK supporting Pelion Edge update
-part u-boot --source rawcopy --sourceparams="file=imx-boot" --ondisk mmcblk --no-table --align ${IMX_BOOT_SEEK}
+part SPL --source rawcopy --sourceparams="file=imx-boot" --ondisk mmcblk --no-table --align ${IMX_BOOT_SEEK}
+part u-boot --source rawcopy --sourceparams="file=u-boot.itb" --ondisk mmcblk --no-table --align 384
 part /boot --source bootimg-partition --ondisk mmcblk --fstype=vfat --label boot --active --align 4096 --size 64
 part / --source otaimage --ondisk mmcblk --fstype=ext4 --align 4096 --size 8000M
 part /mnt/config --size 10M --ondisk mmcblk --fstype=ext4 --label config --align 4096

recipes-connectivity/identity-tool/identity-tool_0.0.1.bb

@@ -4,7 +4,7 @@ LICENSE = "Apache-2.0"
 LIC_FILES_CHKSUM = "file://${WORKDIR}/git/pe-utils/LICENSE;md5=1dece7821bf3fd70fe1309eaa37d52a2"
 
 SRC_URI="\
-git://[email protected]/armPelionEdge/pe-utils.git;protocol=ssh;name=pe-utils;destsuffix=git/pe-utils \
+git://[email protected]/armPelionEdge/pe-utils.git;protocol=https;name=pe-utils;destsuffix=git/pe-utils \
 file://wait-for-pelion-identity.service \
 "
 

recipes-containers/kubelet/kubelet_git.bb

@@ -3,7 +3,7 @@ LICENSE = "Apache-2.0"
 LIC_FILES_CHKSUM = "file://src/${GO_IMPORT}/LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
 
 inherit go pkgconfig gitpkgv systemd
-SRC_URI = "git://[email protected]/armPelionEdge/edge-kubelet.git;protocol=ssh;branch=master;depth=1 \
+SRC_URI = "git://[email protected]/armPelionEdge/edge-kubelet.git;protocol=https;branch=master;depth=1 \
 file://10-c2d.conf \
 file://99-loopback.conf \
 file://kubeconfig \

recipes-core/images/console-image.bb

@@ -28,7 +28,7 @@ path-set \
 pelion-version \
 "
 PELION_BASE_OPTIONAL = " \
-mbed-fcc \
+mbed-fcce \
 "
 
 PELION_SYSTEMS_MANAGEMENT = "\
@@ -58,6 +58,19 @@ RPI_EXTRA = " \
 wpa-supplicant \
 "
 
+PARSEC_SERVICE = " \
+parsec-service-tpm \
+"
+
+PARSEC_TOOL = " \
+parsec-tool \
+"
+
+SOFTWARE_TPM = " \
+swtpm-service \
+tpm2-tools \
+"
+
 IMAGE_INSTALL += " \
 ${CORE_OS} \
 ${PELION_BASE_REQUIRED} \
@@ -68,9 +81,29 @@ ${PELION_CONTAINER_ORCHESTRATION} \
 ${PELION_TESTING} \
 ${RPI_EXTRA} \
 ${MACHINE_EXTRA_RRECOMMENDS} \
+${PARSEC_SERVICE} \
+${PARSEC_TOOL} \
+${SOFTWARE_TPM} \
 "
 
 
+# Create a parsec user and then set permissions on the parsec components to control access.
+# Create the parsec user.
+inherit extrausers
+EXTRA_USERS_PARAMS += "\
+    useradd parsec;\
+"
+
+# modify the ownership of the folders and files that only the parsec user needs access to.
+
+ROOTFS_POSTPROCESS_COMMAND_append = " \
+  setup_parsec_files; \
+"
+setup_parsec_files() {
+    chown -R parsec:parsec ${IMAGE_ROOTFS}/etc/parsec
+    chown -R parsec:parsec ${IMAGE_ROOTFS}/usr/libexec/parsec
+    chown parsec:parsec ${IMAGE_ROOTFS}/usr/bin/swtpm.sh
+}
 set_local_timezone() {
     ln -sf /usr/share/zoneinfo/EST5EDT ${IMAGE_ROOTFS}/etc/localtime
 }

recipes-misc/info-tool/info-tool_2.0.0.bb

@@ -4,7 +4,7 @@ LICENSE = "Apache-2.0"
 LIC_FILES_CHKSUM = "file://${WORKDIR}/git/pe-utils/LICENSE;md5=1dece7821bf3fd70fe1309eaa37d52a2"
 
 SRC_URI="\
-git://[email protected]/armPelionEdge/pe-utils.git;protocol=ssh;name=pe-utils;destsuffix=git/pe-utils \
+git://[email protected]/armPelionEdge/pe-utils.git;protocol=https;name=pe-utils;destsuffix=git/pe-utils \
 "
 
 #SRCREV_FORMAT = "wwrelay-dss"