* [PATCHv4 1/3] optee: updae optee-os.inc to support external TAs
@ 2021-11-16 12:55 Maxim Uvarov
2021-11-16 12:55 ` [PATCHv4 2/3] add optee-ftpm Maxim Uvarov
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Maxim Uvarov @ 2021-11-16 12:55 UTC (permalink / raw)
To: meta-arm; +Cc: jon.mason, ross.burton, Maxim Uvarov
Separate recipe for TA devkit is needed to solve
circular dependency to build TAs withthe devkit
and integrate it inside optee-os.
Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
---
.../recipes-security/optee/optee-examples.inc | 2 +-
.../optee/optee-os-tadevkit_3.14.0.bb | 20 +++++++++++++++++++
meta-arm/recipes-security/optee/optee-os.inc | 7 -------
3 files changed, 21 insertions(+), 8 deletions(-)
create mode 100644 meta-arm/recipes-security/optee/optee-os-tadevkit_3.14.0.bb
diff --git a/meta-arm/recipes-security/optee/optee-examples.inc b/meta-arm/recipes-security/optee/optee-examples.inc
index 921fa18..656722e 100644
--- a/meta-arm/recipes-security/optee/optee-examples.inc
+++ b/meta-arm/recipes-security/optee/optee-examples.inc
@@ -5,7 +5,7 @@ HOMEPAGE = "https://github.com/linaro-swg/optee_examples"
LICENSE = "BSD-2-Clause"
LIC_FILES_CHKSUM = "file://LICENSE;md5=cd95ab417e23b94f381dafc453d70c30"
-DEPENDS = "optee-client optee-os python3-pycryptodome-native"
+DEPENDS = "optee-client optee-os-tadevkit python3-pycryptodome-native"
inherit python3native
diff --git a/meta-arm/recipes-security/optee/optee-os-tadevkit_3.14.0.bb b/meta-arm/recipes-security/optee/optee-os-tadevkit_3.14.0.bb
new file mode 100644
index 0000000..0d37a52
--- /dev/null
+++ b/meta-arm/recipes-security/optee/optee-os-tadevkit_3.14.0.bb
@@ -0,0 +1,20 @@
+FILESEXTRAPATHS:prepend := "${THISDIR}/optee-os:"
+require optee-os_3.14.0.bb
+
+SUMMARY = "OP-TEE Trusted OS TA devkit"
+DESCRIPTION = "OP-TEE TA devkit for build TAs"
+HOMEPAGE = "https://www.op-tee.org/"
+
+do_install() {
+ #install TA devkit
+ install -d ${D}${includedir}/optee/export-user_ta/
+ for f in ${B}/export-ta_${OPTEE_ARCH}/* ; do
+ cp -aR $f ${D}${includedir}/optee/export-user_ta/
+ done
+}
+
+do_deploy() {
+ echo "Do not inherit do_deploy from optee-os."
+}
+
+FILES:${PN} = "${includedir}/optee/"
diff --git a/meta-arm/recipes-security/optee/optee-os.inc b/meta-arm/recipes-security/optee/optee-os.inc
index 277646e..1506a58 100644
--- a/meta-arm/recipes-security/optee/optee-os.inc
+++ b/meta-arm/recipes-security/optee/optee-os.inc
@@ -46,12 +46,6 @@ do_install() {
#install core in firmware
install -d ${D}${nonarch_base_libdir}/firmware/
install -m 644 ${B}/core/*.bin ${B}/core/tee.elf ${D}${nonarch_base_libdir}/firmware/
-
- #install TA devkit
- install -d ${D}${includedir}/optee/export-user_ta/
- for f in ${B}/export-ta_${OPTEE_ARCH}/* ; do
- cp -aR $f ${D}${includedir}/optee/export-user_ta/
- done
}
PACKAGE_ARCH = "${MACHINE_ARCH}"
@@ -66,7 +60,6 @@ addtask deploy before do_build after do_install
SYSROOT_DIRS += "${nonarch_base_libdir}/firmware"
FILES:${PN} = "${nonarch_base_libdir}/firmware/"
-FILES:${PN}-dev = "${includedir}/optee/"
# note: "textrel" is not triggered on all archs
INSANE_SKIP:${PN} = "textrel"
--
2.17.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCHv4 2/3] add optee-ftpm
2021-11-16 12:55 [PATCHv4 1/3] optee: updae optee-os.inc to support external TAs Maxim Uvarov
@ 2021-11-16 12:55 ` Maxim Uvarov
2021-11-16 12:55 ` [PATCHv4 3/3] machine/qemuarm64-secureboot.conf: " Maxim Uvarov
2021-11-16 19:44 ` [PATCHv4 1/3] optee: updae optee-os.inc to support external TAs Jon Mason
2 siblings, 0 replies; 4+ messages in thread
From: Maxim Uvarov @ 2021-11-16 12:55 UTC (permalink / raw)
To: meta-arm; +Cc: jon.mason, ross.burton, Maxim Uvarov
Add software TPM emulated in the OPTEE-OS.
Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
---
.../optee-ftpm/0000-fix-ssl-fallthrough.patch | 20 ++++++
.../0001-add-enum-to-ta-flags.patch | 30 ++++++++
.../optee-ftpm/optee-ftpm_git.bb | 71 +++++++++++++++++++
.../optee-ftpm/optee-os_%.bbappend | 14 ++++
4 files changed, 135 insertions(+)
create mode 100644 meta-arm/recipes-security/optee-ftpm/optee-ftpm/0000-fix-ssl-fallthrough.patch
create mode 100644 meta-arm/recipes-security/optee-ftpm/optee-ftpm/0001-add-enum-to-ta-flags.patch
create mode 100644 meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb
create mode 100644 meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend
diff --git a/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0000-fix-ssl-fallthrough.patch b/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0000-fix-ssl-fallthrough.patch
new file mode 100644
index 0000000..08acde2
--- /dev/null
+++ b/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0000-fix-ssl-fallthrough.patch
@@ -0,0 +1,20 @@
+fix gcc compilation
+
+just fix compilation under gcc.
+Upstream-Status: Submitted [https://github.com/wolfSSL/wolfssl/pull/4563]
+
+Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
+
+diff --git a/wolfssl/wolfcrypt/types.h b/wolfssl/wolfcrypt/types.h
+index 7b3a953aebda..e156ae5c7909 100755
+--- a/external/wolfssl/wolfssl/wolfcrypt/types.h
++++ b/external/wolfssl/wolfssl/wolfcrypt/types.h
+@@ -181,7 +181,7 @@
+ /* GCC 7 has new switch() fall-through detection */
+ #if defined(__GNUC__)
+ #if ((__GNUC__ > 7) || ((__GNUC__ == 7) && (__GNUC_MINOR__ >= 1)))
+- #define FALL_THROUGH __attribute__ ((fallthrough));
++ #define FALL_THROUGH __attribute__ ((__fallthrough__));
+ #endif
+ #endif
+ #ifndef FALL_THROUGH
diff --git a/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0001-add-enum-to-ta-flags.patch b/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0001-add-enum-to-ta-flags.patch
new file mode 100644
index 0000000..bbc1107
--- /dev/null
+++ b/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0001-add-enum-to-ta-flags.patch
@@ -0,0 +1,30 @@
+From 2d00f16058529eb9f4d4d2bcaeed91fd53b43989 Mon Sep 17 00:00:00 2001
+From: Maxim Uvarov <maxim.uvarov@linaro.org>
+Date: Fri, 17 Apr 2020 12:05:53 +0100
+Subject: [PATCH 2/2] add enum to ta flags
+
+If we compile this TA into OPTEE-OS we need to define a flag
+that this TA can be discovered on the optee bus.
+Upstream-Status: Submitted [https://github.com/microsoft/MSRSec/pull/34]
+
+Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
+---
+ TAs/optee_ta/fTPM/user_ta_header_defines.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/TAs/optee_ta/fTPM/user_ta_header_defines.h b/TAs/optee_ta/fTPM/user_ta_header_defines.h
+index 6ff62d1..685b54a 100644
+--- a/TAs/optee_ta/fTPM/user_ta_header_defines.h
++++ b/TAs/optee_ta/fTPM/user_ta_header_defines.h
+@@ -44,7 +44,7 @@
+
+ #define TA_UUID TA_FTPM_UUID
+
+-#define TA_FLAGS (TA_FLAG_SINGLE_INSTANCE | TA_FLAG_INSTANCE_KEEP_ALIVE )
++#define TA_FLAGS (TA_FLAG_SINGLE_INSTANCE | TA_FLAG_INSTANCE_KEEP_ALIVE | TA_FLAG_DEVICE_ENUM_SUPP)
+ #define TA_STACK_SIZE (64 * 1024)
+ #define TA_DATA_SIZE (64 * 1024)
+
+--
+2.17.1
+
diff --git a/meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb b/meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb
new file mode 100644
index 0000000..e61dc9d
--- /dev/null
+++ b/meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb
@@ -0,0 +1,71 @@
+SUMMARY = "OPTEE fTPM Microsoft TA"
+DESCRIPTION = "TCG reference implementation of the TPM 2.0 Specification."
+HOMEPAGE = "https://github.com/microsoft/ms-tpm-20-ref/"
+
+inherit autotools-brokensep deploy pkgconfig gettext python3native
+
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${S}/LICENSE;md5=27e94c0280987ab296b0b8dd02ab9fe5"
+
+DEPENDS = "python3-pycryptodome-native python3-pycryptodomex-native python3-pyelftools-native"
+DEPENDS += " optee-os-tadevkit"
+
+FTPM_UUID="bc50d971-d4c9-42c4-82cb-343fb7f37896"
+
+# SRC_URI = "git://github.com/Microsoft/ms-tpm-20-ref;branch=master"
+# Since this is not built as a pseudo TA, we can only use it as a kernel module and not built in.
+# The TEE supplicant is also needed to provide access to secure storage.
+# Secure storage access required by OP-TEE fTPM TA
+# is provided via OP-TEE supplicant that's not available during boot.
+# Fix this once we replace this with the MS implementation
+SRC_URI = "gitsm://github.com/microsoft/MSRSec;protocol=https;branch=master \
+ file://0000-fix-ssl-fallthrough.patch \
+ file://0001-add-enum-to-ta-flags.patch"
+SRCREV = "76f81b36efbb1a366b0d382bc0defe677f1f0534"
+
+S = "${WORKDIR}/git"
+
+OPTEE_CLIENT_EXPORT = "${STAGING_DIR_HOST}${prefix}"
+TEEC_EXPORT = "${STAGING_DIR_HOST}${prefix}"
+TA_DEV_KIT_DIR = "${STAGING_INCDIR}/optee/export-user_ta"
+
+EXTRA_OEMAKE += '\
+ CFG_FTPM_USE_WOLF=y \
+ TA_DEV_KIT_DIR=${TA_DEV_KIT_DIR} \
+ TA_CROSS_COMPILE=${TARGET_PREFIX} \
+ CFLAGS="${CFLAGS} --sysroot=${STAGING_DIR_HOST} -I${WORKDIR}/optee-os" \
+'
+
+EXTRA_OEMAKE:append:aarch64:qemuall = "\
+ CFG_ARM64_ta_arm64=y \
+"
+
+B = "${S}"
+
+# fails with j > 1
+PARALLEL_MAKE = ""
+
+do_compile() {
+ sed -i 's/-mcpu=$(TA_CPU)//' TAs/optee_ta/fTPM/sub.mk
+ # there's also a secure variable storage TA called authvars
+ cd ${S}/TAs/optee_ta
+ oe_runmake ftpm
+}
+
+do_install () {
+ mkdir -p ${D}/lib/optee_armtz
+ install -D -p -m 0644 ${S}/TAs/optee_ta/out/fTPM/${FTPM_UUID}.ta ${D}/lib/optee_armtz/
+}
+
+do_deploy () {
+ install -d ${DEPLOYDIR}/optee
+ install -D -p -m 0644 ${S}/TAs/optee_ta/out/fTPM/${FTPM_UUID}.stripped.elf ${DEPLOYDIR}/optee/
+}
+
+addtask deploy before do_build after do_install
+
+FILES:${PN} += "${nonarch_base_libdir}/optee_armtz/${FTPM_UUID}.ta"
+
+# Imports machine specific configs from staging to build
+PACKAGE_ARCH = "${MACHINE_ARCH}"
+INSANE_SKIP:${PN} += "ldflags"
diff --git a/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend b/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend
new file mode 100644
index 0000000..0cfa949
--- /dev/null
+++ b/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend
@@ -0,0 +1,14 @@
+FTPM_UUID="bc50d971-d4c9-42c4-82cb-343fb7f37896"
+
+DEPENDS:append = "\
+ ${@bb.utils.contains('MACHINE_FEATURES', \
+ 'optee-ftpm', \
+ 'optee-ftpm', \
+ '' , \
+ d)}"
+
+EXTRA_OEMAKE:append = "${@bb.utils.contains('MACHINE_FEATURES', \
+ 'optee-ftpm', \
+ 'CFG_EARLY_TA=y EARLY_TA_PATHS="${DEPLOY_DIR_IMAGE}/optee/${FTPM_UUID}.stripped.elf"', \
+ '', \
+ d)} "
--
2.17.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCHv4 3/3] machine/qemuarm64-secureboot.conf: add optee-ftpm
2021-11-16 12:55 [PATCHv4 1/3] optee: updae optee-os.inc to support external TAs Maxim Uvarov
2021-11-16 12:55 ` [PATCHv4 2/3] add optee-ftpm Maxim Uvarov
@ 2021-11-16 12:55 ` Maxim Uvarov
2021-11-16 19:44 ` [PATCHv4 1/3] optee: updae optee-os.inc to support external TAs Jon Mason
2 siblings, 0 replies; 4+ messages in thread
From: Maxim Uvarov @ 2021-11-16 12:55 UTC (permalink / raw)
To: meta-arm; +Cc: jon.mason, ross.burton, Maxim Uvarov
Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
---
meta-arm/conf/machine/qemuarm64-secureboot.conf | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-arm/conf/machine/qemuarm64-secureboot.conf b/meta-arm/conf/machine/qemuarm64-secureboot.conf
index c45924a..b664dac 100644
--- a/meta-arm/conf/machine/qemuarm64-secureboot.conf
+++ b/meta-arm/conf/machine/qemuarm64-secureboot.conf
@@ -20,4 +20,6 @@ WKS_FILE ?= "qemuarm64.wks"
WKS_FILE_DEPENDS = "trusted-firmware-a"
IMAGE_BOOT_FILES = "${KERNEL_IMAGETYPE}"
+MACHINE_FEATURES += "optee-ftpm"
+
PREFERRED_VERSION_linux-yocto ?= "5.10%"
--
2.17.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCHv4 1/3] optee: updae optee-os.inc to support external TAs
2021-11-16 12:55 [PATCHv4 1/3] optee: updae optee-os.inc to support external TAs Maxim Uvarov
2021-11-16 12:55 ` [PATCHv4 2/3] add optee-ftpm Maxim Uvarov
2021-11-16 12:55 ` [PATCHv4 3/3] machine/qemuarm64-secureboot.conf: " Maxim Uvarov
@ 2021-11-16 19:44 ` Jon Mason
2 siblings, 0 replies; 4+ messages in thread
From: Jon Mason @ 2021-11-16 19:44 UTC (permalink / raw)
To: Maxim Uvarov; +Cc: meta-arm, jon.mason, ross.burton
On Tue, Nov 16, 2021 at 03:55:03PM +0300, Maxim Uvarov wrote:
> Separate recipe for TA devkit is needed to solve
> circular dependency to build TAs withthe devkit
> and integrate it inside optee-os.
>
> Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
> ---
It's still failing with
ERROR: Nothing PROVIDES 'optee-os-tadevkit' (but /builds/jonmason00/meta-arm/meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb DEPENDS on or otherwise requires it)
https://gitlab.com/jonmason00/meta-arm/-/jobs/1788361637
This can be reproduced with kas
$ kas shell --update --force-checkout ci/base.yml:ci/meta-openembedded.yml --command "ci/check-layers.py ci/check-layers.yml . ."
or with "yocto-check-layer' in poky/scripts
Also failing with
/bin/sh: 1: unlink: not found
/bin/sh: 1: aarch64-poky-linux-gcc: not found
https://gitlab.com/jonmason00/meta-arm/-/jobs/1788361664
https://gitlab.com/jonmason00/meta-arm/-/jobs/1788361665
This can be reproduced by seting clang as your compiler in your
local.conf
TOOLCHAIN = "clang"
or, if you are using kas
$ kas build ci/qemuarm64-secureboot.yml:ci/clang.yml
Thanks,
Jon
> .../recipes-security/optee/optee-examples.inc | 2 +-
> .../optee/optee-os-tadevkit_3.14.0.bb | 20 +++++++++++++++++++
> meta-arm/recipes-security/optee/optee-os.inc | 7 -------
> 3 files changed, 21 insertions(+), 8 deletions(-)
> create mode 100644 meta-arm/recipes-security/optee/optee-os-tadevkit_3.14.0.bb
>
> diff --git a/meta-arm/recipes-security/optee/optee-examples.inc b/meta-arm/recipes-security/optee/optee-examples.inc
> index 921fa18..656722e 100644
> --- a/meta-arm/recipes-security/optee/optee-examples.inc
> +++ b/meta-arm/recipes-security/optee/optee-examples.inc
> @@ -5,7 +5,7 @@ HOMEPAGE = "https://github.com/linaro-swg/optee_examples"
> LICENSE = "BSD-2-Clause"
> LIC_FILES_CHKSUM = "file://LICENSE;md5=cd95ab417e23b94f381dafc453d70c30"
>
> -DEPENDS = "optee-client optee-os python3-pycryptodome-native"
> +DEPENDS = "optee-client optee-os-tadevkit python3-pycryptodome-native"
>
> inherit python3native
>
> diff --git a/meta-arm/recipes-security/optee/optee-os-tadevkit_3.14.0.bb b/meta-arm/recipes-security/optee/optee-os-tadevkit_3.14.0.bb
> new file mode 100644
> index 0000000..0d37a52
> --- /dev/null
> +++ b/meta-arm/recipes-security/optee/optee-os-tadevkit_3.14.0.bb
> @@ -0,0 +1,20 @@
> +FILESEXTRAPATHS:prepend := "${THISDIR}/optee-os:"
> +require optee-os_3.14.0.bb
> +
> +SUMMARY = "OP-TEE Trusted OS TA devkit"
> +DESCRIPTION = "OP-TEE TA devkit for build TAs"
> +HOMEPAGE = "https://www.op-tee.org/"
> +
> +do_install() {
> + #install TA devkit
> + install -d ${D}${includedir}/optee/export-user_ta/
> + for f in ${B}/export-ta_${OPTEE_ARCH}/* ; do
> + cp -aR $f ${D}${includedir}/optee/export-user_ta/
> + done
> +}
> +
> +do_deploy() {
> + echo "Do not inherit do_deploy from optee-os."
> +}
> +
> +FILES:${PN} = "${includedir}/optee/"
> diff --git a/meta-arm/recipes-security/optee/optee-os.inc b/meta-arm/recipes-security/optee/optee-os.inc
> index 277646e..1506a58 100644
> --- a/meta-arm/recipes-security/optee/optee-os.inc
> +++ b/meta-arm/recipes-security/optee/optee-os.inc
> @@ -46,12 +46,6 @@ do_install() {
> #install core in firmware
> install -d ${D}${nonarch_base_libdir}/firmware/
> install -m 644 ${B}/core/*.bin ${B}/core/tee.elf ${D}${nonarch_base_libdir}/firmware/
> -
> - #install TA devkit
> - install -d ${D}${includedir}/optee/export-user_ta/
> - for f in ${B}/export-ta_${OPTEE_ARCH}/* ; do
> - cp -aR $f ${D}${includedir}/optee/export-user_ta/
> - done
> }
>
> PACKAGE_ARCH = "${MACHINE_ARCH}"
> @@ -66,7 +60,6 @@ addtask deploy before do_build after do_install
> SYSROOT_DIRS += "${nonarch_base_libdir}/firmware"
>
> FILES:${PN} = "${nonarch_base_libdir}/firmware/"
> -FILES:${PN}-dev = "${includedir}/optee/"
>
> # note: "textrel" is not triggered on all archs
> INSANE_SKIP:${PN} = "textrel"
> --
> 2.17.1
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-11-16 19:44 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-16 12:55 [PATCHv4 1/3] optee: updae optee-os.inc to support external TAs Maxim Uvarov
2021-11-16 12:55 ` [PATCHv4 2/3] add optee-ftpm Maxim Uvarov
2021-11-16 12:55 ` [PATCHv4 3/3] machine/qemuarm64-secureboot.conf: " Maxim Uvarov
2021-11-16 19:44 ` [PATCHv4 1/3] optee: updae optee-os.inc to support external TAs Jon Mason
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.