- Jun 28, 2022
-
-
Balint Dobszay authored
The Measured Boot option not only enables the relevant config options for TF-A and optee_os, but also building the fTPM TA and its Linux driver. This is unnecessary when the consumer of the Event Log is not fTPM but e.g. the PSA Attestation SP (as introduced in the next commit). This commit modifies the MEASURED_BOOT option to only set the TF-A and optee_os config, and adds the MEASURED_BOOT_FTPM option for the fTPM related components. To keep backwards compatibility if MEASURED_BOOT is selected, by default MEASURED_BOOT_FTPM is enabled too. Reviewed-by:
Gyorgy Szing <gyorgy.szing@arm.com> Reviewed-by:
Jens Wiklander <jens.wiklander@linaro.org> Signed-off-by:
Balint Dobszay <balint.dobszay@arm.com>
-
Balint Dobszay authored
Add support for sharing a host directory with the FVP. Reviewed-by:
-
Balint Dobszay authored
Add support for running the Base Platform FVP. This model offers more configuration options and more peripherals than the Foundation model. It's available free of charge on the Arm Developer website. Link: https://developer.arm.com/downloads/-/arm-ecosystem-models Reviewed-by:
-
Balint Dobszay authored
Refactor the FVP path and argument variables to prepare for adding a new FVP platform in the next commit. Reviewed-by:
-
Jerome Forissier authored
Adds Xen upstream patch "optee: enable OPTEE_SMC_SEC_CAP_MEMREF_NULL capability" ([1] present in Xen 4.16.0) in order to avoid failures in the GlobalPlatform test suite [2]: optee/build $ export GP_PACKAGE=~/work/TEE_Initial_Configuration-Test_Suite_v2_0_0_2-2017_06_09.7z optee/build $ make -j10 XEN_BOOT=y run ... $ xtest gp_ ... gp_10081 FAILED first error at gp_10000.c:1653 gp_10082 FAILED first error at gp_10000.c:1673 gp_10083 FAILED first error at gp_10000.c:1693 gp_10155 FAILED first error at gp_10000.c:3346 gp_10156 FAILED first error at gp_10000.c:3366 gp_10157 FAILED first error at gp_10000.c:3386 gp_10229 FAILED first error at gp_10000.c:5039 gp_10230 FAILED first error at gp_10000.c:5059 gp_10231 FAILED first error at gp_10000.c:5079 gp_10303 FAILED first error at gp_10000.c:6732 gp_10304 FAILED first error at gp_10000.c:6752 gp_10305 FAILED first error at gp_10000.c:6772 gp_10632 FAILED first error at gp_10000.c:15608 gp_10633 FAILED first error at gp_10000.c:15629 gp_10634 FAILED first error at gp_10000.c:15650 gp_10706 FAILED first error at gp_10000.c:17375 gp_10707 FAILED first error at gp_10000.c:17396 gp_10708 FAILED first error at gp_10000.c:17417 gp_10780 FAILED first error at gp_10000.c:19142 gp_10781 FAILED first error at gp_10000.c:19163 gp_10782 FAILED first error at gp_10000.c:19184 gp_10854 FAILED first error at gp_10000.c:20909 gp_10855 FAILED first error at gp_10000.c:20930 gp_10856 FAILED first error at gp_10000.c:20951 For each failed test there is a TA log: E/TA: checkUpdateParameterMemref:195 Received buffer is not NULL but expected to be NULL. Link: [1] https://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=d4fb5f166c2b Link: [2] https://github.com/OP-TEE/optee_os/issues/4897 Signed-off-by:
Jerome Forissier <jerome.forissier@linaro.org> Acked-by:
-
- Jun 06, 2022
-
-
Jerome Forissier authored
"make optee-rust OPTEE_RUST_ENABLE=y" always runs the setup.sh script in $(ROOT)/optee_rust. The script clones about 600 MB of data. That can't be done each time especially since the check-rust target depends on optee-rust. Signed-off-by:
Yuan Zhuang <zhuangyuan04@baidu.com> Acked-by:
-
- May 18, 2022
-
-
Jerome Forissier authored
Adds a Xen bug fix from upstream [1]. With this we will be able to get rid of a revert in the linux kernel [2]. Link: [1] https://github.com/xen-project/xen/commit/1c3ed9c908732d19660fbe83580674d585464d4c Link: [2] https://github.com/linaro-swg/linux/commit/665750f493d3fcf307952f19c0442c092b76d852 Signed-off-by:
-
- May 12, 2022
-
-
Jerome Forissier authored
Commit 8b808915 ("qemu_v8: xen: apply patch to fix issue with RPC buffer release") really did only one part of the job. Only the Xen tools are built with Buildroot; the hypervisor itself (which needs the patch mentioned in the commit) is actually built from the top-level xen/ directory. As a result the issue is stil present. This commit changes the QEMUv8 makefiles as well as the Buildroot configuration for Xen so that both the hypervisor and the tools are built. As for the Xen configuration (enabling OP-TEE support), it is introduced via a patch to the defconfig file. Signed-off-by:
-
Jerome Forissier authored
Adds a patch to revert a Xen commit [1] which causes a regression with OP-TEE. There is no more logs to the secure console after these lines: I/TC: Added guest 1 D/TC:2 tee_entry_exchange_capabilities:100 Asynchronous notifications are disabled D/TC:2 tee_entry_exchange_capabilities:109 Dynamic shared memory is enabled ...and TAs fail to open sessions with TEEC_ERROR_COMMUNICATION. This is to prepare building Xen with Buildroot. The version of Xen pulled by $(ROOT)/buildroot/package/xen is 4.14.3 and is affected by this issue while the one we are currently using in $(ROOT)/xen is 4.14.1 and doesn't have the regression. Signed-off-by:
-
- May 06, 2022
-
-
Yuan Zhuang authored
When C source code is built into the Rust TA, the Rust crate `cc`[1] uses gcc compiler defined in the env var `CC`. Setting `CC` in `optee_rust_examples_ext.mk` fixes the building error of those Rust TAs in buildroot. [1] https://crates.io/crates/cc Signed-off-by:
-
Yuan Zhuang authored
In the new version of Teaclave TrustZone SDK, OPTEE_DIR is checked in setup.sh. If OPTEE_DIR is not set, it will download OP-TEE source code. Set OPTEE_DIR as the directory of OP-TEE repo. Signed-off-by:
Joakim Bech <joakim.bech@linaro.org> Acked-by:
-
- May 05, 2022
-
-
Joakim Bech authored
With LOG_LEVEL=50 and DEBUG=1, BL31 becomes too big, with LOG_LEVEL=40 we will miss a few debug prints, but it will at produce a valid binary and more importantly, you'll get an elf-file with all debug symbols, i.e., it's GDB makes up for the missing prints. Signed-off-by:
-
Jerome Forissier authored
CFG_FLASH_SIZE can be used to generate only linux-4g or linux-8g instead of both. Signed-off-by:
-
- May 04, 2022
-
-
Jerome Forissier authored
Adds a patch to be applied by Buildroot when building Xen. This fixes a race condition in RPC buffer management, which causes random failures in the OP-TEE CI jobs [1]. The patch is being upstreamed [2]. Link: [1] https://dev.azure.com/OPTEE/optee_os/_build/results?buildId=2827&view=logs&j=705748f3-7146-5e86-79af-1c0266d20a8c&t=d3458a7d-1a81-5639-8e63-8927d807e53a&l=7812 Link: [2] https://lists.xenproject.org/archives/html/xen-devel/2022-05/msg00245.html Fixes: https://github.com/OP-TEE/optee_os/issues/5288 Signed-off-by:
-
- May 03, 2022
-
-
Jens Wiklander authored
Introduces the option MEMTAG which enabled tagging of memory using the ARM Memory Tagging Extension (MTE). Acked-by:
-
Jens Wiklander authored
Updates the matching rules to only trap OP-TEE Core assert or panic. Panic or assert in a TA may very well be part of a test case. Reviewed-by:
-
- Apr 11, 2022
-
-
Jens Wiklander authored
Adds a missing linux dependency for the flash-image target. This should fix erros like: CC [M] drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.o mformat -i .../build/../out/boot.img.fat -n 64 -h 255 -T 131072 -v "BOOT IMG" -C :: mcopy -i .../build/../out/boot.img.fat .../build/../linux/arch/arm64/boot/Image :: .../build/../linux/arch/arm64/boot/Image: No such file or directory Acked-by:
-
- Apr 01, 2022
-
-
Etienne Carriere authored
Provision a GPT partition for U-Boot to store its environment. U-Boot expects this partition to be labeled u-boot-env. Acked-by:
Etienne Carriere <etienne.carriere@linaro.org>
-
Etienne Carriere authored
Changes stm32mp1 SDcard partitions to use a single FIP formatted image to store U-Boot and OP-TEE binaries. The change also removes duplicated fsbl partition that is not used. Changes build directives to use standard OP-TEE binary images and embed U-Boot DTB in the FIP image. Acked-by:
-
- Feb 15, 2022
-
-
Jerome Forissier authored
Set BR2_PER_PACKAGE_DIRECTORIES=y to allow better parallelism when building Buildroot packages [1] and therefore faster build times on multi-core machines. Link: [1] https://buildroot.org/downloads/manual/manual.html#top-level-parallel-build Signed-off-by:
Jerome Forissier <jerome@forissier.org> Reviewed-by:
-
Jerome Forissier authored
When BR2_PACKAGE_OPENSSL=y, OPENSC_DEPENDENCIES is overwritten with 'openssl' which is wrong. 'openssl' should be appended instead, otherwise the dependency on 'pcsc-lite' is lost. This issue was found when building with BR2_PER_PACKAGE_DIRECTORIES=y which triggers a parallel build. It looks like the non-parallel build works by chance (a matter of build order probably). Signed-off-by:
-
- Feb 10, 2022
-
-
Sadiq Hussain authored
Steps to reproduce: 1)cd into the QEMU build directory 2)make CFG_TEE_BENCHMARK=y run We end up in a compile error as mentioned in https://github.com/OP-TEE/build/issues/489 and https://github.com/linaro-swg/optee_benchmark/issues/17 Turns out the path to benchmark sources wasn't properly defined and hence "BR2_PACKAGE_OPTEE_BENCHMARK_EXT_SITE" was incorrect. Signed-off-by:
Sadiq Hussain <sadiq.muchumarri@intel.com> Acked-by:
-
Jens Wiklander authored
Adds support for building TF-A and OP-TEE the SPMC at EL3. A special manifest is added to be consumed by the SPMC. Acked-by:
-
- Feb 03, 2022
-
-
Ruchika Gupta authored
Introduces option PAUTH, which can be used to enable Pointer Authentication for TA's. Signed-off-by:
Ruchika Gupta <ruchika.gupta@linaro.org> Reviewed-by:
-
- Jan 25, 2022
-
-
Ruchika Gupta authored
XEN fails to boot linux when cpu is selected as max with following kernel crash. Hence revert to using cortex-a57 when XEN_BOOT is selected. [ 0.000000] ------------[ cut here ]------------ [ 0.000000] kernel BUG at arch/arm64/kernel/traps.c:498! [ 0.000000] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 0.000000] Modules linked in: [ 0.000000] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.16.0-gdbeb6ea978fc #1 [ 0.000000] Hardware name: linux,dummy-virt (DT) [ 0.000000] pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 0.000000] pc : do_undefinstr+0x2bc/0x2e0 [ 0.000000] lr : do_undefinstr+0x2c8/0x2e0 [ 0.000000] sp : ffffd399cddc3c60 [ 0.000000] x29: ffffd399cddc3c60 x28: ffffd399cddd34c0 x27: 0000000000000000 [ 0.000000] x26: 0000000000000000 x25: 0000000000000000 x24: ffffd399cd830008 [ 0.000000] x23: 00000000000000c5 x22: ffffd399cd7810bc x21: ffffd399cddc3e30 [ 0.000000] x20: 00000000d5182101 x19: ffffd399cddc3ce0 x18: 0000000000000014 [ 0.000000] x17: 0000000049426f60 x16: 0000000056a84232 x15: 0000000099ac15ae [ 0.000000] x14: 00000000ab810c49 x13: 501bac190a4c3eb1 x12: 89c8a6a0aab2e7c5 [ 0.000000] x11: 00000000c16d9c19 x10: 00000000e4fb46a5 x9 : 00000000d78a73db [ 0.000000] x8 : 0000000000000014 x7 : 501bac190a4c3eb1 x6 : 89c8a6a0aab2e7c5 [ 0.000000] x5 : ffffd399cddd5910 x4 : 0000000000000000 x3 : ffffd399ce0e70f8 [ 0.000000] x2 : 0000000000000000 x1 : ffffd399cddd34c0 x0 : 00000000000000c5 [ 0.000000] Call trace: [ 0.000000] do_undefinstr+0x2bc/0x2e0 [ 0.000000] el1_undef+0x2c/0x4c [ 0.000000] el1h_64_sync_handler+0x84/0xd0 [ 0.000000] el1h_64_sync+0x78/0x7c [ 0.000000] start_kernel+0x4c4/0x664 [ 0.000000] __primary_switched+0xc0/0xc8 [ 0.000000] Code: 17ffff8d a9425bf5 17ffffb1 a9025bf5 (d4210000) [ 0.000000] ---[ end trace 32823fcd1957a64b ]--- [ 0.000000] Kernel panic - not syncing: Attempted to kill the idle task! [ 0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]--- Signed-off-by:
-
- Jan 14, 2022
-
-
Etienne Carriere authored
Explicitly enable platform config switch STM32MP_USE_STM32IMAGE to enforce TF-A legacy boot of OP-TEE and U-Boot images in several storage partitions. Platform stm32mp1 changed in TF-A v2.6 in that the default configuration do enable use of a FIP image. Upgrading platform build to use FIP is out of the scope of this change. Acked-by:
-
- Jan 12, 2022
-
-
Ruchika Gupta authored
-cpu max provides support of maximum feature set available with AArch64 architecture.This includes FEAT_PAuth and FEAT_BTI. Additionally sve is turned off as linux fails to boot with sve=on when -cpu max is enabled. Signed-off-by:
-
- Jan 11, 2022
-
-
Jerome Forissier authored
Upstream buildroot commit 43147827a7b7 ("package/python3-cryptography: drop package") has made host-python3-cryptography unavailable. This dependency needs to be replaced with host-python-cryptography. This fix is needed to upgrade Buildroot from 2021.08 to 2021.11. Signed-off-by: -
Jens Wiklander authored
Introduces SPMC_AT_EL which controls configuration of TF-A and optee_os. Currently the value "n" and "1" are supported, with the following meanings: "n" - No SPMC at all, that is, the default configuration using the SMC based ABI. "1" - SPMC implemented at S-EL1, that is, in OP-TEE. TF-A is configured accordingly with SPMD instead of OPTEED. Acked-by: -
Jens Wiklander authored
Drops ARM_TSP_RAM_LOCATION from TF_A_FLAGS as it's not needed any longer. Acked-by:
-
Jens Wiklander authored
Always try to enable FF-A in the kernel. The kernel tries to probe for FF-A, but only enables it if other components supports it. Acked-by:
-
- Jan 05, 2022
-
-
Jerome Forissier authored
In order to match all the digits in a number on its own line, use (\\d+)\r not (\\d+) which could return a truncated value depending on what the content of input buffer is when the matching is done. Signed-off-by:
Sumit Garg <sumit.garg@linaro.org>
-
Jerome Forissier authored
When running only the Trusted Keys test in Xen, qemu-check.exp waits for a prompt twice causing a hang. Move the expect command at the right place to fix that. Signed-off-by:
-
- Jan 03, 2022
-
-
Sumit Garg authored
Add a new argument for script: qemu-check.exp as the type of tests to be executed. After this change its possible to run tests granularly as follows: - Executes all tests: $ make check $ make check CHECK_TESTS=all - Execute only xtest tests: $ make check CHECK_TESTS=xtest - Execute only trusted-keys tests: $ make check CHECK_TESTS=trusted-keys Signed-off-by:
-
Sumit Garg authored
Brief description of changes: - Enable Qemu kernel configs for Trusted Keys. - Add keyutils buildroot package. - Enable Trusted Keys early TA in OP-TEE. - Create a new test script (trusted-keys.exp) which is invoked as part of "make check" for automated Trusted Keys tests. Signed-off-by:
-
Sumit Garg authored
Lets switch over to using aarch64 hosted cross-compiler for aarch32 rather than building toochain for aarch32 from source which is very cumbersome. But in case of native build for aarch64 on aarch64 host we are left with no choice but to use buildroot toolchain as Arm doesn't provide binary toolchain releases for aarch64 native compiler. Also, we can't rely on distribution toolchain as buildroot doesn't support it (refer here [1] for details). Link: [1] https://buildroot.org/downloads/manual/manual.html#_cross_compilation_toolchain Signed-off-by:
-
- Dec 22, 2021
-
-
Joakim Bech authored
When running the GitHub action, there is a warning: Unexpected input(s) 'exempt-issue-label', 'exempt-pr-label', valid inputs are ... 'exempt-issue-labels', 'exempt-pr-labels'. Add the missing 's' to labels to fix the issue. This is a new warning after upgrading to the 'Stale' action to v4.1.0, so they must have changed to the plural version in more recent versions. Signed-off-by:
-
- Dec 21, 2021
-
-
Joakim Bech authored
- Update 'stale' from v1.0 to v4.0.1. - Give 'write' permissions to actions (pull requests and issues). - Add 'enhancement' to 'exempt-issue-label', so we that stale doesn't automatically close issues and pr's with the 'enhancement' label. - Add 'exempt-pr-label' to match exempt-issue-label'. - Add and set (to true) remove-issue-stale-when-updated remove-pr-stale-when-updated which will automatically remove the 'Stale' label when someone adds a new comment to a ticket marked as stale. Signed-off-by:
-
- Nov 04, 2021
-
-
Jerome Forissier authored
With optee_os commit "scripts: migrate away from pycryptodome" [1], the host-python3-cryptography package is required to sign TAs. Keep host-python3-pycryptodomex for the time being to facilitate the transition. Link: [1] https://github.com/OP-TEE/optee_os/pull/4937 Signed-off-by:
-
Yuan Zhuang authored
"cargo: command not found" occurs when building Rust examples. BR2_PACKAGE_OPTEE_RUST_EXAMPLES_TC_PATH_ENV clears the PATH when building optee_rust_examples_ext. Add the cargo PATH to BR2_PACKAGE_OPTEE_RUST_EXAMPLES_TC_PATH_ENV. Signed-off-by:
-
